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Note 


. The term Arm can refer to versions of the Arm architecture, for example Armv8 refers to version 8 of the Arm architecture. 
The context makes it clear when the term is used in this way. 





> This document describes only the Armv8-A architecture profile. For the behaviors required by the previous version of this 
architecture profile, ARMv7-A, see the ARM Architecture Reference Manual, ARMv7-A and ARMv7-R edition. 
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This preface introduces the Arm Architecture Reference Manual, Armv8, for Armv8-A architecture profile. It 


contains the following sections: 


About this manual on page xviii. 
Using this manual on page xx. 
Conventions on page xxvi. 
Additional reading on page xxviii. 


Feedback on page xxx. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


xvii 


Preface 
About this manual 


About this manual 


This manual describes the Arm” architecture v8, Armv8. The architecture describes the operation of an Armv8-A 
Processing element (PE), and this manual includes descriptions of: 


. The two Execution states, AArch64 and AArch32. 


° The instruction sets: 
— In AArch32 state, the A32 and T32 instruction sets, that are compatible with earlier versions of the 
Arm architecture. 


— In AArch64 state, the A64 instruction set. 


s The states that determine how a PE operates, including the current Exception level and Security state, and in 
AArch32 state the PE mode. 


° The Exception model. 
$ The interprocessing model, that supports transitioning between AArch64 state and AArch32 state. 


° The memory model, that defines memory ordering and memory management. This manual covers a single 
architecture profile, Armv8-A, that defines a Virtual Memory System Architecture (VMSA). 


$ The programmers’ model, and its interfaces to System registers that control most PE and memory system 
features, and provide status information. 


à The Advanced SIMD and floating-point instructions, that provide high-performance: 
— Single-precision, half-precision, and double-precision floating-point operations. 
— Conversions between double-precision, single-precision, and half-precision floating-point values. 
— Integer, single-precision floating-point, half-precision floating-point, and in A64, double-precision 
vector operations in all instruction sets. 


—  Single-precision, half-precision, and double-precision floating-point vector operations in the A64 
instruction set. 


. The security model, that provides two security states to support secure applications. 
$ The virtualization model, that support the virtualization of Non-secure operation. 
° The Debug architecture, that provides software access to debug features. 


This manual gives the assembler syntax for the instructions it describes, meaning that it describes instructions in 
textual form. However, this manual is not a tutorial for Arm assembler language, nor does it describe Arm assembler 
language, except at a very basic level. To make effective use of Arm assembler language, read the documentation 
supplied with the assembler being used. 


This manual is organized into parts: 


Part A Provides an introduction to the Armv8-A architecture, and an overview of the AArch64 and 
AArch32 Execution states. 


Part B Describes the application level view of the AArch64 Execution state, meaning the view from ELO. 
It describes the application level view of the programmers’ model and the memory model. 


Part C Describes the A64 instruction set, that is available in the AArch64 Execution state. The descriptions 
for each instruction also include the precise effects of each instruction when executed at ELO, 
described as unprivileged execution, including any restrictions on its use, and how the effects of the 
instruction differ at higher Exception levels. This information is of primary importance to authors 
and users of compilers, assemblers, and other programs that generate Arm machine code. 


Part D Describes the system level view of the AArch64 Execution state. It includes details of the System 
registers, most of which are not accessible from ELO, and the system level view of the programmers’ 
model and the memory model. This part includes the description of self-hosted debug. 
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Part E 


Part F 


Part G 


Part H 


Part I 


Part J 
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Describes the application level view of the AArch32 Execution state, meaning the view from the 
ELO. It describes the application level view of the programmers’ model and the memory model. 


Note 


In AArch32 state, execution at ELO is execution in User mode. 








Describes the T32 and A32 instruction sets, that are available in the AArch32 Execution state. These 
instruction sets are backwards-compatible with earlier versions of the Arm architecture. This part 
describes the precise effects of each instruction when executed in User mode, described as 
unprivileged execution or execution at ELO, including any restrictions on its use, and how the effects 
of the instruction differ at higher Exception levels. This information is of primary importance to 
authors and users of compilers, assemblers, and other programs that generate Arm machine code. 





Note 


User mode is the only mode where software execution is unprivileged. 





Describes the system level view of the AArch32 Execution state, that is generally compatible with 
earlier versions of the Arm architecture. This part includes details of the System registers, most of 
which are not accessible from ELO, and the instruction interface to those registers. It also describes 
the system level view of the programmers’ model and the memory model. 


Describes the Debug architecture for external debug. This provides configuration, breakpoint and 
watchpoint support, and a Debug Communications Channel (DCC) to a debug host. 


Describes additional features of the architecture that are not closely coupled to a processing element 
(PE), and therefore are accessed through memory-mapped interfaces. Some of these features are 
OPTIONAL. 


Provides pseudocode that describes various features of the Armv8 architecture. 


Part K, Appendixes 


Glossary 


Provide additional information. Some appendixes give information that is not part of the Armv8 
architectural requirements. The cover page of each appendix indicates its status. 


Defines terms used in this document that have a specialized meaning. 


Note 


Terms that are generally well understood in the microelectronics industry are not included in the 
Glossary. 
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Using this manual 


The information in this manual is organized into parts, as described in this section. 


Part A, Introduction and Architecture Overview 


Part A gives an overview of the Armv8-A architecture profile, including its relationship to the other Arm PE 
architectures. It introduces the terminology used to describe the architecture, and gives an overview of the 
Executions states, AArch64 and AArch32. It contains the following chapter: 


Chapter A1 Introduction to the Armv8 Architecture 


Read this for an introduction to the Armv8 architecture. 


Part B, The AArch64 Application Level Architecture 
Part B describes the AArch64 state application level view of the architecture. It contains the following chapters: 


Chapter B1 The AArch64 Application Level Programmers’ Model 


Read this for an application level description of the programmers’ model for software executing in 
AArch64 state. It describes execution at ELO when ELO is using AArch64 state. 


Chapter B2 The AArch64 Application Level Memory Model 


Read this for an application level description of the memory model for software executing in 
AArché64 state. It describes the memory model for execution in ELO when ELO is using AArch64 
state. It includes information about Arm memory types, attributes, and memory access controls. 


Part C, The A64 Instruction Set 


Part C describes the A64 instruction set, that is used in AArch64 state. It contains the following chapters: 


Chapter C1 The A64 Instruction Set 


Read this for a description of the A64 instruction set and common instruction operation details. 


Chapter C2 About the A64 Instruction Descriptions 


Read this to understand the format of the A64 instruction descriptions. 


Chapter C3 464 Instruction Set Overview 
Read this for an overview of the individual A64 instructions, that are divided into five functional 
groups. 

Chapter C4 A464 Instruction Set Encoding 


Read this for a description of the A64 instruction set encoding. 


Chapter C5 The A64 System Instruction Class 
Read this for a description of the AArch64 System instructions and register descriptions, and the 
System instruction class encoding space. 

Chapter C6 464 Base Instruction Descriptions 
Read this for information on key aspects of the A64 base instructions and for descriptions of the 
individual instructions, which are listed in alphabetical order. 

Chapter C7 464 Advanced SIMD and Floating-point Instruction Descriptions 


Read this for information on key aspects of the A64 Advanced SIMD and floating-point instructions 
and for descriptions of the individual instructions, which are listed in alphabetical order. 
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Part D, The AArch64 System Level Architecture 


Part D describes the AArch64 state system level view of the architecture. It contains the following chapters: 


Chapter D1 The AArch64 System Level Programmers’ Model 

Read this for a description of the AArch64 state system level view of the programmers’ model. 
Chapter D2 AArch64 Self-hosted Debug 

Read this for an introduction to, and a description of, self-hosted debug in AArch6é4 state. 


Chapter D3 AArch64 Self-hosted Trace 


Read this for an introduction to, and a description of, self-hosted trace in AArch64 state. 


Chapter D4 The AArch64 System Level Memory Model 
Read this for a description of the AArch64 state system level view of the general features of the 
memory system. 

Chapter D5 The AArch64 Virtual Memory System Architecture 
Read this for a system level view of the AArch64 Virtual Memory System Architecture (VMSA), 
the memory system architecture of an Armv8 implementation that is executing in AArch64 state. 

Chapter D7 The Performance Monitors Extension 
Read this for a description of an implementation of the Arm Performance Monitors, that are an 
optional non-invasive debug component. 

Chapter D8 The Activity Monitors Extension 
Read this for a description of an implementation of the Arm Activity Monitors, an optional 
non-invasive component. 

Chapter D9 The Statistical Profiling Extension 
Read this for a description of an implementation of the Statistical Profiling Extension, that is an 
optional AArch64 state non-invasive debug component. 

Chapter D10 Statistical Profiling Extension Sample Record Specification 


Read this for a description the sample records generated by the Statistical Profiling Extension. 


Chapter D11 The Generic Timer in AArch64 state 


Read this for a description of the AArch64 view of an implementation of the Arm Generic Timer. 


Chapter D12 AArch64 System Register Encoding 


Read this for a description of the description of the encoding of the AArch64 System registers, and 
the other uses of the AArch64 System registers encoding space. 


Chapter D13 AArch64 System Register Descriptions 


Read this for an introduction to, and description of, each of the AArch64 System registers. 


Part E, The AArch32 Application Level Architecture 
Part E describes the AArch32 state application level view of the architecture. It contains the following chapters: 


Chapter E1 The AArch32 Application Level Programmers’ Model 
Read this for an application level description of the programmers’ model for software executing in 
AAtrch32 state. It describes execution at ELO when ELO is using AArch32 state. 

Chapter E2 The AArch32 Application Level Memory Model 


Read this for an application level description of the memory model for software executing in 
AArch32 state. It describes the memory model for execution in ELO when ELO is using AArch32 
state. It includes information about Arm memory types, attributes, and memory access controls. 
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Part F, The AArch32 Instruction Sets 


Part F describes the T32 and A32 instruction sets, that are used in AArch32 state. It contains the following chapters: 


Chapter F1 The AArch32 Instruction Sets Overview 


Read this for an overview of the T32 and A32 instruction sets. 


Chapter F2 About the T32 and A32 Instruction Descriptions 
Read this to understand the format of the T32 and A32 instruction descriptions. 


Chapter F3 732 Instruction Set Encoding 


Read this for a description of the T32 instruction set encoding. This includes the T32 encoding of 
the Advanced SIMD and floating-point instructions. 


Chapter F4 432 Instruction Set Encoding 


Read this for a description of the A32 instruction set encoding. This includes the A32 encoding of 
the Advanced SIMD and floating-point instructions. 


Chapter F5 732 and A32 Base Instruction Set Instruction Descriptions 
Read this for a description of each of the T32 and A32 base instructions. 


Chapter F6 732 and A32 Advanced SIMD and Floating-point Instruction Descriptions 


Read this for a description of each of the T32 and A32 Advanced SIMD and floating-point 
instructions. 


Part G, The AArch32 System Level Architecture 


Part G describes the AArch32 state system level view of the architecture. It contains the following chapters: 


Chapter G1 The AArch32 System Level Programmers’ Model 


Read this for a description of the AArch32 state system level view of the programmers’ model for 
execution in an Exception level that is using AArch32. 


Chapter G2 AArch32 Self-hosted Debug 
Read this for an introduction to, and a description of, self-hosted debug in AArch64 state. 


Chapter G3 AArch32 Self-hosted Trace 


Read this for an introduction to, and a description of, self-hosted trace in AArch64 state. 


Chapter G4 The AArch32 System Level Memory Model 


Read this for a system level view of the general features of the memory system. 


Chapter G5 The AArch32 Virtual Memory System Architecture 
Read this for a description of the AArch32 Virtual Memory System Architecture (VMSA). 


Chapter G6 The Generic Timer in AArch32 state 
Read this for a description of the AArch32 view of an implementation of the Arm Generic Timer. 


Chapter G7 AArch32 System Register Encoding 


Read this for a description of the description of the encoding of the AArch32 System registers, 
including the System instructions that are part of the AArch32 System registers encoding space. 


Chapter G8 AArch32 System Register Descriptions 
Read this for a description of each of the AArch32 System registers. 
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Part H, External Debug 


Part H describes the architecture for external debug. It contains the following chapters: 


Chapter H1 About External Debug 


Read this for an introduction to external debug, and a definition of the scope of this part of the 
manual. 


Chapter H2 Debug State 


Read this for a description of debug state, which the PE might enter as the result of a Halting debug 
event. 


Chapter H3 Halting Debug Events 
Read this for a description of the external debug events referred to as Halting debug events. 


Chapter H4 The Debug Communication Channel and Instruction Transfer Register 


Read this for a description of the communication between a debugger and the PE debug logic using 
the Debug Communications Channel and the Instruction Transfer register. 


Chapter H5 The Embedded Cross-Trigger Interface 


Read this for a description of the embedded cross-trigger interface. 


Chapter H6 Debug Reset and Powerdown Support 


Read this for a description of reset and powerdown support in the Debug architecture. 


Chapter H7 The PC Sample-based Profiling Extension 


Read this for a description of the PC Sample-based Profiling Extension that is an OPTIONAL 
extension to an Armv8 implementation. 


Chapter H8 About the External Debug Registers 


Read this for some additional information about the external debug registers. 


Chapter H9 External Debug Register Descriptions 


Read this for a description of each external debug register. 


Part |, Memory-mapped Components of the Armv8 Architecture 


ARM DDI 0487E.a 


Part I describes the memory-mapped components in the architecture. It contains the following chapters: 


Chapter I1 Requirements for Memory-mapped Components 
Read this for descriptions of some general requirements for memory-mapped components within a 
system that complies with the Armv8 Architecture. 

Chapter I2 System Level Implementation of the Generic Timer 


Read this for a definition of a system level implementation of the Generic Timer. 


Chapter I3 Recommended External Interface to the Performance Monitors 
Read this for a description of the recommended memory-mapped and external debug interfaces to 
the Performance Monitors. 

Chapter I4 Recommended External Interface to the Activity Monitors 


Read this for a description of the recommended memory-mapped interface to the Activity Monitors. 


Chapter I5 External System Control Register Descriptions 


Read this for a description of each memory-mapped system control register. 
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Part J, Architectural Pseudocode 
Part J contains pseudocode that describes various features of the Arm architecture. It contains the following chapter: 


Chapter J1 Armv8 Pseudocode 


Read this for the pseudocode definitions that describe various features of the Armv8 architecture, 
for operation in AArch64 state and in AArch32 state. 


Part K, Appendixes 
This manual contains the following appendixes: 


Appendix K1 Architectural Constraints on UNPREDICTABLE behaviors 


Read this for a description of the architecturally-required constraints on UNPREDICTABLE behaviors 
in the Armv8 architecture, including AArch32 behaviors that were UNPREDICTABLE in previous 
versions of the architecture. 


Appendix K2 Recommended External Debug Interface 


Read this for a description of the recommended external debug interface. 





Note 


This description is not part of the Arm architecture specification. It is included here as 
supplementary information, for the convenience of developers and users who might require this 
information. 





Appendix K3 Recommendations for Performance Monitors Event Numbers for IMPLEMENTATION 
DEFINED Events 


Read this for a description of Arm recommendations for the use of the IMPLEMENTATION DEFINED 
event numbers. 


Note 


This description is not part of the Arm architecture specification. It is included here as 
supplementary information, for the convenience of developers and users who might require this 
information. 








Appendix K4 Recommendations for reporting memory attributes on an interconnect 
Read this for the Arm recommendations about how the architectural memory attributes are reported 
on an interconnect. 

Appendix K5 Additional Information for Implementations of the Generic Timer 
Read this for additional information about implementations of the Arm Generic Timer. This 
information does not form part of the architectural definition of the Generic Timer. 

Appendix K6 Legacy Instruction Syntax for AArch32 Instruction Sets 
Read this for information about the pre-UAL syntax of the AArch32 instruction sets, which can still 
be valid for the A32 instruction set. 

Appendix K7 Address translation examples 


Read this for examples of translation table lookups using the translation regimes described in 
Chapter D5 The AArch64 Virtual Memory System Architecture and Chapter G5 The AArch32 Virtual 
Memory System Architecture. 


Appendix K8 Example OS Save and Restore Sequences 


Read this for software examples that perform the OS Save and Restore sequences for an Armv8 
debug implementation. 
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Note 
Chapter H6 Debug Reset and Powerdown Support describes the OS Save and Restore mechanism. 








Appendix K9 Recommended Upload and Download Processes for External Debug 
Read this for information about implementing and using the Arm architecture. 


Note 


This description is not part of the Arm architecture specification. It is included here as 
supplementary information, for the convenience of developers and users who might require this 
information. 





Appendix K10 Software Usage Examples 


Read this for software examples that help understanding of some aspects of the Arm architecture. 





Note 


This description is not part of the Arm architecture specification. It is included here as 
supplementary information, for the convenience of developers and users who might require this 
information. 


Appendix K11 Barrier Litmus Tests 
Read this for examples of the use of barrier instructions provided by the Armv§8 architecture. 


Note 


This description is not part of the Arm architecture specification. It is included here as 
supplementary information, for the convenience of developers and users who might require this 
information. 








Appendix K13 Arm Pseudocode Definition 
Read this for definitions of the AArch32 pseudocode. 


Appendix K14 Registers Index 


Read this for an alphabetic and functional index of AArch32 and AArch64 registers, and 
memory-mapped registers. 


Defines terms used in this document that have a specialized meaning. 


Note 


Terms that are generally well understood in the microelectronics industry are not included in the Glossary. 
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Conventions 


The following sections describe conventions that this book can use: 


$ Typographic conventions. 

à Signals on page xxvii. 

° Numbers on page xxvii. 

s Pseudocode descriptions on page xxvii. 

. Assembler syntax descriptions on page xxvii. 


Typographic conventions 


xxvi 


The typographical conventions are: 


italic 


bold 


monospace 


Introduces special terminology, and denotes citations. 
Denotes signal names, and is used for terms in descriptive lists, where appropriate. 


Used for assembler syntax descriptions, pseudocode, and source code examples. 


Also used in the main text for instruction mnemonics and for references to other items appearing in 
assembler syntax descriptions, pseudocode, and source code examples. 


SMALL CAPITALS 


Colored text 


{and} 


Notes 


Used in body text for a few terms that have specific technical meanings, and are defined in the 
Glossary. 


Indicates a link. This can be: 
° A URL, for example http://infocenter.arm.com. 


. A cross-reference, that includes the page number of the referenced information if it is not on 
the current page, for example, Assembler syntax descriptions on page xxvii. 


e A link, to a chapter or appendix, or to a glossary entry, or to the section of the document that 
defines the colored term, for example Simple sequential execution or SCTLR. 


Braces, { and }, have two distinct uses: 


Optional items 
In syntax descriptions braces enclose optional items. In the following example they 
indicate that the <shift> parameter is optional: 
ADD <Wd|WSP>, <Wn|WSP>, #<imm>{, <shift>} 
Similarly they can be used in generalized field descriptions, for example 
TCR_ELx. {I}PS refers to a field in the TCR_ELx registers that is called either IPS or 
PS. 
Sets of items 


Braces can be used to enclose sets. For example, HCR_EL2.{E2H, TGE} refers to a set 
of two register fields, HCR_EL2.E2H and HCR_EL2.TGE 


Notes are formatted as: 





Note 
This is a Note. 


In this Manual, Notes are used only to provide additional information, usually to help understanding 
of the text. While a Note may repeat architectural information given elsewhere in the Manual, a 
Note never provides any part of the definition of the architecture. 
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In general this specification does not define hardware signals, but it does include some signal examples and 
recommendations. The signal conventions are: 


Signal level The level of an asserted signal depends on whether the signal is active-HIGH or 
active-LOW. Asserted means: 


° HIGH for active-HIGH signals. 
a LOW for active-LOW signals. 


Lower-case n At the start or end of a signal name denotes an active-LOW signal. 


Numbers are normally written in decimal. Binary numbers are preceded by 0b, and hexadecimal numbers by 0x. In 
both cases, the prefix and the associated value are written in a monospace font, for example 0xFFFFQ000. To improve 
readability, long numbers can be written with an underscore separator between every four characters, for example 
OxFFFF_0000_0000_0000. Ignore any underscores when interpreting the value of a number. 


Pseudocode descriptions 


This manual uses a form of pseudocode to provide precise descriptions of the specified functionality. This 
pseudocode is written in monospace font, and is described in Appendix K13 Arm Pseudocode Definition. 


Assembler syntax descriptions 


ARM DDI 0487E.a 
ID070919 


This manual contains numerous syntax descriptions for assembler instructions and for components of assembler 
instructions. These are shown in a monospace font, and use the conventions described in Structure of the A64 
assembler language on page C1-171, Appendix K13 Arm Pseudocode Definition, and Pseudocode operators and 
keywords on page K12-5648. 
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Additional reading 


This section lists relevant publications from Arm and third parties. 


See the Infocenter, http://infocenter.arm.com, for access to Arm documentation. 


Arm publications 


Other publications 


ARM” AMBA” 4 ATB Protocol Specification, ATBv1.0 and ATBv1.1, (ARM IHI 0032B). 
ARM” Architecture Reference Manual, ARMv7-A and ARMv7-R edition (ARM DDI 0406). 


ARM” Architecture Reference Manual Supplement, ARMv6, for the ARMv8-R AArch32 architecture profile 
(ARM DDI 0568). 


ARM” Debug Interface Architecture Specification, ADIv6.0 (ARM IHI 0074). 
ARM” Debug Interface Architecture Specification, ADIv5.0 to ADIv5.2 (ARM IHI 0031). 
ARM” Embedded Trace Macrocell Architecture Specification, ETMv4 (ARM IHI 0064). 


ARM® Generic Interrupt Controller Architecture Specification, GIC architecture version 3.0 and version 4.0 
(ARM IHI 0069). 


ARM® CoreSight™ SoC Technical Reference Manual (ARM DDI 0480). 
ARM” CoreSight™ Architecture Specification (ARM IHI 0029). 
ARM” Procedure Call Standard for the ARM 64-bit Architecture (ARM IHI 0055). 


ARM® Reliability, Availability, and Serviceability (RAS) Specification, Armvé, for the Armv8-A architecture 
profile (ARM DDI 0587). 


Arm” Architecture Reference Manual Supplement, The Scalable Vector Extension (SVE), for Armv8-A (ARM 
DDI 0584). 


Arm® Architecture Reference Manual Supplement, Memory System Resource Partitioning and Monitoring 
(MPAM), for Armv8-A (ARM DDI 0598). 


The following publications are referred to in this manual, or provide more information: 


xxviii 


Announcing the Advanced Encryption Standard (AES), Federal Information Processing Standards 
Publication 197, November 2001. 


IEEE Std 754-2008, IEEE Standard for Floating-point Arithmetic, August 2008. 
IEEE Std 754-1985, JEEE Standard for Floating-point Arithmetic, March 1985. 
Secure Hash Standard (SHA), Federal Information Processing Standards Publication 180-2, August 2002. 


The Galois/Counter Mode of Operation, McGraw, D. and Viega, J., Submission to NIST Modes of Operation 
Process, January 2004. 


Memory Consistency Models for Shared Memory-Multiprocessors, Gharachorloo, Kourosh, 1995, Stanford 
University Technical Report CSL-TR-95-685. 


Standard Manufacturer s Identification Code, JEP106, JEDEC Solid State Technology Association. 
SM3 Cryptographic Hash Algorithm, China Internet Network Information Center (CNNIC). 
SM4 Block Cipher Algorithm, China Internet Network Information Center (CNNIC). 


The QARMA Block Cipher Family, Roberto Avanzi, Qualcomm Product Security Initiative. 
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Available from https://eprint.iacr.org/2016/444. 
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Feedback 


Arm welcomes feedback on its documentation. 


Feedback on this manual 


If you have comments on the content of this manual, send e-mail to errata@arm.com. Give: 


° The title. 

° The number, ARM DDI 0487E.a. 

° The page numbers to which your comments refer. 
° A concise explanation of your comments. 


Arm also welcomes general suggestions for additions and improvements. 


Note 


Arm tests PDFs only in Adobe Acrobat and Acrobat Reader, and cannot guarantee the appearance or behavior of 
any document when viewed with any other PDF reader. 
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Part A 


Armv8 Architecture Introduction and Overview 


Chapter A1 


Introduction to the Armv8 Architecture 


This chapter introduces the Arm architecture. It contains the following sections: 
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About the Arm architecture on page A1-34. 

Architecture profiles on page A1-36. 

Armv8 architectural concepts on page A1-38. 

Supported data types on page A1-41. 

Advanced SIMD and floating-point support on page A1-51. 
The Arm memory model on page A1-57. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


A1-33 


Introduction to the Armv8 Architecture 
A1.1 About the Arm architecture 


A1.1 


A1-34 


About the Arm architecture 


The Arm architecture described in this Architecture Reference Manual defines the behavior of an abstract machine, 
referred to as a processing element, often abbreviated to PE. Implementations compliant with the Arm architecture 
must conform to the described behavior of the processing element. It is not intended to describe how to build an 
implementation of the PE, nor to limit the scope of such implementations beyond the defined behaviors. 


Except where the architecture specifies differently, the programmer-visible behavior of an implementation that is 
compliant with the Arm architecture must be the same as a simple sequential execution of the program on the 
processing element. This programmer-visible behavior does not include the execution time of the program. 


The Arm Architecture Reference Manual also describes rules for software to use the processing element. 


The Arm architecture includes definitions of: 


. An associated debug architecture, see: 
— Chapter D2 AArch64 Self-hosted Debug. 
— Chapter G2 AArch32 Self-hosted Debug. 
— Part H of this manual, External Debug on page 6697. 


è Associated trace architectures that define PE Trace Units that implementers can implement with the 
associated processor hardware. For more information, see: 
— The Embedded Trace Macrocell Architecture Specification. 
— Chapter D3 AArch64 Self-hosted Trace. 
— Chapter G3 AArch32 Self-hosted Trace. 





Note 


A PE Trace Unit may be named a trace macrocell in other documentation. 





The Arm architecture is a Reduced Instruction Set Computer (RISC) architecture with the following RISC 
architecture features: 


à A large uniform register file. 


° A load/store architecture, where data-processing operations only operate on register contents, not directly on 
memory contents. 


. Simple addressing modes, with all load/store addresses determined from register contents and instruction 
fields only. 


The architecture defines the interaction of the PE with memory, including caches, and includes a memory translation 
system. It also describes how multiple PEs interact with each other and with other observers in a system. 


This document defines the Armv8-A architecture profile. See Architecture profiles on page A1-36 for more 
information. 


The Arm architecture supports implementations across a wide range of performance points. Implementation size, 
performance, and very low power consumption are key attributes of the Arm architecture. 


An important feature of the Armv8 architecture is backwards compatibility, combined with the freedom for optimal 
implementation in a wide range of standard and more specialized use cases. The Armv8 architecture supports: 


° A 64-bit Execution state, AArch64. 
$ A 32-bit Execution state, AArch32, that is compatible with previous versions of the Arm architecture. 


Note 


The AArch32 Execution state is compatible with the Armv7-A architecture profile, and enhances that profile to 
support some features included in the AArch64 Execution state. 








Features that are optional are explicitly defined as such in this Manual. 
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Note 


The presence of an ID register field for a feature does not imply that the feature is optional. 





Both Execution states support SIMD and floating-point instructions: 
° AArch32 state provides: 
— SIMD instructions in the base instruction sets that operate on the 32-bit general-purpose registers. 


— Advanced SIMD instructions that operate on registers in the SIMD and floating-point register 
(SIMD&FP register) file. 


— Floating-point instructions that operate on registers in the SIMD&FP register file. 

. AArch64 state provides: 
— Advanced SIMD instructions that operate on registers in the SIMD&FP register file. 
— Floating-point instructions that operate on registers in the SIMD&FP register file. 


Note 


See Conventions on page xxvi for information about conventions used in this manual, including the use of SMALL 
CAPITALS for particular terms that have Arm-specific meanings that are defined in the Glossary. 
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A1.2 


A1-36 


Architecture profiles 


The Arm architecture has evolved significantly since its introduction, and Arm continues to develop it. Eight major 
versions of the architecture have been defined to date, denoted by the version numbers | to 8. Of these, the first three 
versions are now obsolete. 


The generic names AArch64 and AArch32 describe the 64-bit and 32-bit Execution states: 


AArch64 Is the 64-bit Execution state, meaning addresses are held in 64-bit registers, and instructions in the 
base instruction set can use 64-bit registers for their processing. AArch64 state supports the A64 
instruction set. 


AArch32 Is the 32-bit Execution state, meaning addresses are held in 32-bit registers, and instructions in the 
base instruction sets use 32-bit registers for their processing. AArch32 state supports the T32 and 
A32 instruction sets. 





Note 


The Base instruction set comprises the supported instructions other than the Advanced SIMD and floating-point 
instructions. 





See sections Execution state on page A1-38 and The Armv8 instruction sets on page A1-39 for more information. 


Arm defines three architecture profiles: 


A Application profile, described in this manual: 
5 Supports a Virtual Memory System Architecture (VMSA) based on a Memory Management 
Unit (MMU). 
Note 





An Armv8-A implementation can be called an AArchv8-A implementation. 





° Supports the A64, A32, and T32 instruction sets. 


R Real-time profile: 
° Supports a Protected Memory System Architecture (PMSA) based on a Memory Protection 
Unit (MPU). 


° Supports the A32 and T32 instruction sets. 


M Microcontroller profile: 
: Implements a programmers' model designed for low-latency interrupt processing, with 
hardware stacking of registers and support for writing interrupt handlers in high-level 
languages. 


$ Implements a variant of the R-profile PMSA. 


° Supports a variant of the T32 instruction set. 


Note 
This Architecture Reference Manual describes only the Armv8-A profile. 








For information about the R and M architecture profiles, and earlier Arm architecture versions see: 
5 The ARM” Architecture Reference Manual Supplement, ARMVv6, for the ARMv8-R AArch32 architecture 


profile. 
. The ARM” Architecture Reference Manual, ARMv7-A and ARMv7-R edition. 
s The Arm*v8-M Architecture Reference Manual. 


è The ARM®v7-M Architecture Reference Manual. 
s The ARM"v6-M Architecture Reference Manual. 
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A1.2.1 Debug architecture version 


The Arm Debug architecture is fully integrated with the architecture, and does not have a separate version number. 
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A1.3 


A1.3.1 


A1-38 


Armv8 architectural concepts 


Armv8 introduces major changes to the Arm architecture, while maintaining a high level of consistency with 
previous versions of the architecture. The Armv8 Architecture Reference Manual includes significant changes in 
the terminology used to describe the architecture, and this section introduces both the Armvé8 architectural concepts 
and the associated terminology. 


The following subsections describe key Armv8 architectural concepts. Each section introduces the corresponding 
terms that are used to describe the architecture: 


è Execution state. 
e The Armv8 instruction sets on page A1-39. 
7 System registers on page A1-39. 


. Armv8 Debug on page A1-40. 


Execution state 


The Execution state defines the PE execution environment, including: 


° The supported register widths. 
° The supported instruction sets. 
a Significant aspects of: 


— The exception model. 
— The Virtual Memory System Architecture (VMSA). 
— The programmers’ model. 


The Execution states are: 


AArch64 The 64-bit Execution state. This Execution state: 
G Provides 31 64-bit general-purpose registers, of which X30 is used as the procedure link 
register. 
s Provides a 64-bit program counter (PC), stack pointers (SPs), and exception link registers 
(ELRs). 
° Provides 32 128-bit registers for SIMD vector and scalar floating-point support. 
° Provides a single instruction set, A64. For more information, see The Armv8 instruction sets 


on page A 1-39. 
. Defines the Armv8 Exception model, with up to four Exception levels, ELO - EL3, that 
provide an execution privilege hierarchy, see Exception levels on page D1-2268. 


: Provides support for 64-bit virtual addressing. For more information, including the limits on 
address ranges, see Chapter D5 The AArch64 Virtual Memory System Architecture. 


: Defines a number of Process state (PSTATE) elements that hold PE state. The A64 
instruction set includes instructions that operate directly on various PSTATE elements. 


a Names each System register using a suffix that indicates the lowest Exception level at which 
the register can be accessed. 
AArch32 The 32-bit Execution state. This Execution state: 


. Provides 13 32-bit general-purpose registers, and a 32-bit PC, SP, and link register (LR). The 
LR is used as both an ELR and a procedure link register. 


Some of these registers have multiple banked instances for use in different PE modes. 


° Provides a single ELR, for exception returns from Hyp mode. 
. Provides 32 64-bit registers for Advanced SIMD vector and scalar floating-point support. 
. Provides two instruction sets, A32 and T32. For more information, see The Armv8 instruction 


sets on page A1-39. 


e Supports the Armv7-A exception model, based on PE modes, and maps this onto the Armv8 
Exception model, that is based on the Exception levels. 


° Provides support for 32-bit virtual addressing. 
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è Defines a number of Process state (PSTATE) elements that hold PE state. The A32 and T32 
instruction sets include instructions that operate directly on various PSTATE elements, and 
instructions that access PSTATE by using the Application Program Status Register (APSR) 
or the Current Program Status Register (CPSR). 


Later subsections give more information about the different properties of the Execution states. 


Transferring control between the AArch64 and AArch32 Execution states is known as interprocessing. The PE can 
move between Execution states only on a change of Exception level, and subject to the rules given in 
Interprocessing on page D1-2380. This means different software layers, such as an application, an operating system 
kernel, and a hypervisor, executing at different Exception levels, can execute in different Execution states. 


A1.3.2 The Armv8 instruction sets 


In Armv8 the possible instruction sets depend on the Execution state: 


AArch64 AArch64 state supports only a single instruction set, called A64. This is a fixed-length instruction 
set that uses 32-bit instruction encodings. 


For information on the A64 instruction set, see Chapter C3 464 Instruction Set Overview. 


AArch32 AArch32 state supports the following instruction sets: 
A32 This is a fixed-length instruction set that uses 32-bit instruction encodings. 
T32 This is a variable-length instruction set that uses both 16-bit and 32-bit instruction 
encodings. 


In previous documentation, these instruction sets were called the ARM and Thumb instruction sets. 
Armv8 extends each of these instruction sets. In AArch32 state, the Instruction set state determines 
the instruction set that the PE executes. 


For information on the A32 and T32 instruction sets, see Chapter F1 The AArch32 Instruction Sets 


Overview. 


The Armv8 instruction sets support SIMD and scalar floating-point instructions. See Advanced SIMD and 
floating-point support on page A1-51. 


A1.3.3 System registers 
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System registers provide control and status information of architected features. 


The System registers use a standard naming format: <register_name>.<bit_field_name> to identify specific 
registers as well as control and status bits within a register. 


Bits can also be described by their numerical position in the form <register_name>[x:y] or the generic form 
bits[x:y]. 

In addition, in AArch64 state, most register names include the lowest Exception level that can access the register as 
a suffix to the register name: 

. <register_name>_ELx, where x is 0, 1, 2, or 3. 

For information about Exception levels, see Exception levels on page D1-2268. 


The System registers comprise: 


è The following registers that are described in this manual: 
— General system control registers. 
— Debug registers. 
— Generic Timer registers. 
— Optionally, Performance Monitor registers. 
— Optionally, the Activity Monitors registers. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. A1-39 
Non-Confidential 


Introduction to the Armv8 Architecture 
A1.3 Armv8 architectural concepts 


A1.3.4 


A1-40 


: Optionally, one or more of the following groups of registers that are defined in other Arm architecture 
specifications: 


— Trace System registers, as defined in the Embedded Trace Macrocell Architecture Specification, 
ETMv4. 


— Scalable Vector Extension System registers, as defined in the Arm® Architecture Reference Manual 
Supplement, The Scalable Vector Extension (SVE), for Armv8-A. 


— Generic Interrupt Controller (GIC) System registers, see The Arm Generic Interrupt Controller 
System registers. 


s RAS Extension System registers, as defined in the Arm” Reliability, Availability, and Serviceability (RAS) 
Specification, Armv8, for the Armv8-A architecture profile. The RAS Extension is a mandatory extension to 
the Armv8.2 architecture, and an optional extension to the Armv8.0 and the Armv8.1 architectures. 


For information about the AArch64 System registers, see Chapter D13 AArch64 System Register Descriptions. 


For information about the AArch32 System registers, see Chapter G8 AArch32 System Register Descriptions. 


The Arm Generic Interrupt Controller System registers 


From version 3 of the Arm Generic Interrupt Controller architecture, GICv3, the GIC architecture specification 
defines a System register interface to some of its functionality. The System register summaries in this manual 
include these registers, see: 


. About the GIC System registers on page D12-2815, for more information about the AArch64 GIC System 
registers. 


s About the GIC System registers on page G7-5888, for more information about the AArch32 GIC System 
registers. 


These sections give only short overviews of the GIC System registers. For more information, including descriptions 
of the registers, see the ARM” Generic Interrupt Controller Architecture Specification, GIC architecture version 3.0 
and version 4.0 (ARM IHI 0069). 


Note 


The programmers’ model for earlier versions of the GIC architecture is wholly memory-mapped. 








Armv8 Debug 


Armv§8 supports the following: 


Self-hosted debug 


In this model, the PE generates debug exceptions. Debug exceptions are part of the Armv8 
Exception model. 


External debug 


In this model, debug events cause the PE to enter Debug state. In Debug state, the PE is controlled 
by an external debugger. 


All Armv8 implementations support both models. The model chosen by a particular user depends on the debug 
requirements during different stages of the design and development life cycle of the product. For example, external 
debug might be used during debugging of the hardware implementation and OS bring-up, and self-hosted debug 
might be used during application development. 


For more information about self-hosted debug: 
$ In AArch64 state, see Chapter D2 AArch64 Self-hosted Debug. 
° In AArch32 state, see Chapter G2 AArch32 Self-hosted Debug. 


For more information about external debug, see Part H External Debug on page 6697. 
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The Armv8 architecture supports the following integer data types: 


Byte 8 bits. 
Halfword 16 bits. 
Word 32 bits. 


Doubleword 64 bits. 
Quadword 128 bits. 


The architecture also supports the following floating-point data types: 


$ Half-precision, see Half-precision floating-point formats on page A1-45 for details. 
7 Single-precision, see Single-precision floating-point format on page A1-47 for details. 
s Double-precision, see Double-precision floating-point format on page A1-48 for details. 


It also supports: 
7 Fixed-point interpretation of words and doublewords. See Fixed-point format on page A1-49. 


s Vectors, where a register holds multiple elements, each of the same data type. See Vector formats on 
page A1-42 for details. 


The Armv8 architecture provides two register files: 
° A general-purpose register file. 
. A SIMD&FP register file. 


In each of these, the possible register widths depend on the Execution state. 


In AArch64 state: 


7 A general-purpose register file contains 64-bit registers: 
— Many instructions can access these registers as 64-bit registers or as 32-bit registers, using only the 
bottom 32 bits. 
$ A SIMD&FP register file contains 128-bit registers: 
— The quadword integer data types only apply to the SIMD&FP register file. 
— The floating-point data types only apply to the SIMD&FP register file. 


— While the AArch64 vector registers support 128-bit vectors, the effective vector length can be 64-bits 
or 128-bits depending on the A64 instruction encoding used, see /nstruction Mnemonics on 
page C1-173. 


For more information on the register files in AArch64 state, see Registers in AArch64 Execution state on 
page B1-99. 


In AArch32 state: 
$ A general-purpose register file contains 32-bit registers: 


— Two 32-bit registers can support a doubleword. 


— Vector formatting is supported, see Figure A1-4 on page A1-45. 
$ A SIMD&FP register file contains 64-bit registers: 
—  AArch32 state does not support quadword integer or floating-point data types. 


Note 


Two consecutive 64-bit registers can be used as a 128-bit register. 








For more information on the register files in AArch32 state, see The general-purpose registers, and the PC, in 
AArch32 state on page E1-3785. 
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Vector formats 


In an implementation that includes the SIMD instructions that operate on the SIMD&FP register file, a register can 
hold one or more packed elements, all of the same size and type. The combination of a register and a data type 
describes a vector of elements. The vector is considered to be an array of elements of the data type specified in the 
instruction. The number of elements in the vector is implied by the size of the data elements and the size of the 
register. 


Vector indices are in the range 0 to (number of elements — 1). An index of 0 refers to the least significant end of the 
vector. 

Vector formats in AArch64 state 

In AArch64 state, the SIMD&FP registers can be referred to as Vn, where n is a value from 0 to 31. 


The SIMD&FP registers support three data formats for loads, stores, and data-processing operations: 


è A single, scalar, element in the least significant bits of the register. 
° A 64-bit vector of byte, halfword, or word elements. 
. A 128-bit vector of byte, halfword, word, or doubleword elements. 


The element sizes are defined in Table A1-1 with the vector format described as: 
. For a 128-bit vector: Vn{.2D, .4S, .8H, .16B}. 
° For a 64-bit vector: Vn{.1D, .2S, .4H, .8B}. 


Table A1-1 SIMD elements in AArch64 state 





Mnemonic Size 

















B 8 bits 
H 16 bits 
S 32 bits 
D 64 bits 
Figure Al-1 on page A1-43 shows the SIMD vectors in AArch64 state. 
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127 112 111 96 95 80 79 64 63 48 47 32 31 16 15 0 


128-bit vector of 64-bit elements (.2D) 


128-bit vector of 32-bit elements (.4S) 


128-bit vector of 16-bit elements (.8H) 





[2] [1] [0] 


[7] [6] [5] [4] [3] 
12-bit vector of &-bit elements (168) | 8 | 8| .8|.8].8|.8)/8|8/.8|2/ 8] 8|.8/ 2/2] 3| 


[15] [14] [13] [12] [11] [10] [9] [8] [7] [6] [5] [4] [3] [2] [1] [0] 


63 48 47 32 31 1615 0 


64-bit vector of 32-bit elements (.2S) 
64-bit vector of 16-bit elements (.4H) 


[3] [2] [1] [0] 


64-bit vector of 8-bit elements (.8B) BBE Ei 


[7] [6] [5] [4] [S] [2] [1] [0] 


Figure A1-1 SIMD vectors in AArch64 state 


Vector formats in AArch32 state 


Table A1-2 shows the available formats. Each instruction description specifies the data types that the instruction 
supports. 


Table A1-2 Advanced SIMD data types in AArch32 state 





Data type specifier Meaning 

















.<size> Any element of <size> bits 

.F<size> Floating-point number of <size> bits 

.I<size> Signed or unsigned integer of <size> bits 
.P<size> Polynomial over {0, 1} of degree less than <size> 
.S<size> Signed integer of <size> bits 

.U<size> Unsigned integer of <size> bits 


Polynomial arithmetic over {0, 1} on page A1-50 describes the polynomial data type. 


The .F16 data type is the half-precision data type selected by the FPSCR.AHP bit, see Half-precision floating-point 
formats on page Al-45. 


The .F32 data type is the Arm standard single-precision floating-point data type, see Single-precision floating-point 
format on page Al-47. 
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The instruction definitions use a data type specifier to define the data types appropriate to the operation. Figure A1-2 


shows the hierarchy of the Advanced SIMD data types. 
























































r S8 
i U8 
i P8 
16 = 
i. U16 
P16 + 
F16 
ie O 
32 
F32 
.164 = 
a U64 
P64} 








t Output format only. See VMULL instruction description. 


t Available only if the Cyptographic Extension is implemented. 


See VMULL instruction description. 


Figure A1-2 Advanced SIMD data type hierarchy in AArch32 state 


For example, a multiply instruction must distinguish between integer and floating-point data types. 


An integer multiply instruction that generates a double-width (long) result must specify the input data types as 
signed or unsigned. However, some integer multiply instructions use modulo arithmetic, and therefore do not have 


to distinguish between signed and unsigned inputs. 


Figure Al-3 on page Al-45 shows the Advanced SIMD vectors in AArch32 state. 


Note 





In AArch32 state, a pair of even and following odd numbered doubleword registers can be concatenated and treated 


as a single quadword register. 
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127 112 111 96 95 80 79 64 63 48 47 32 31 16 15 0 


128-bit vector of double-precision 64 64 
(64-bit) elements ` i 
128-bit vector of single-precision 


[7] [2] [1] [0] 


[6] [5] [4] [3] 
128-bit vector of 8-bit elements }2|s|s|s]e/s]s|s]e|s|s| BE 


[15] [14] [13] [12] [11] [10] [9] [8] [7] [6] [5] [4] [S] [2] [1] [0] 





63 48 47 32 31 16 15 0 


64-bit vector of 32-bit elements 
64-bit vector of 16-bit elements 
[3] [0] 


64-bit vector of 8-bit elements 


[7] [6] [5] [4] [S] [2] [1] [0] 


Figure A1-3 Advanced SIMD vectors in AArch32 state 


The AArch32 general-purpose registers support vectors formats for use by the SIMD instructions in the Base 
instruction set. Figure A1-4 shows these formats, that means that a general-purpose register can be treated as either 
2 halfwords or 4 bytes. 
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32-bit general-purpose register 
as a set of two halfwords 


as a set of four bytes 


Figure A1-4 Vector formatting in AArch32 state 


ua 
Oo 
vs) 
=I 
ua 
oa 


A1.4.2 Half-precision floating-point formats 
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Armv§8 supports two half-precision floating-point formats: 
$ IEFE half-precision, as described in the IEEE 754-2008 standard. 


. Arm alternative half-precision format. 


Both formats can be used for conversions to and from other floating-point formats. FPCR.AHP controls the format 
in AArch64 state and FPSCR.AHP controls the format in AArch32 state. ARMv8.2-FP16 adds half-precision 
data-processing instructions, which always use the IEEE format. These instructions ignore the value of the relevant 
AHP field, and behave as if it has an Effective value of 0. 
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The description of IEEE half-precision includes Arm-specific details that are left open by the standard, and is only 
an introduction to the formats and to the values they can contain. For more information, especially on the handling 
of infinities, NaNs, and signed zeros, see the IEEE 754 standard. 


For both half-precision floating-point formats, the layout of the 16-bit format is the same. The format is: 


15 14 10 9 0 


The interpretation of the format depends on the value of the exponent field, bits[ 14:10] and on which half-precision 
format is being used. 


0 < exponent < 0x1F 
The value is a normalized number and is equal to: 
(=1)S x 2(exponent-15) x (] fraction) 
The minimum positive normalized number is 2-!4, or approximately 6.104 - 10-5. 
The maximum positive normalized number is (2 — 2-10) x 215, or 65504. 
Larger normalized numbers can be expressed using the alternative format when the 
exponent == Qx1F. 
exponent == 
The value is either a zero or a denormalized number, depending on the fraction bits: 
fraction == 
The value is a zero. There are two distinct zeros: 
+0 when S==0 
—0 when S==1. 
fraction != 0 
The value is a denormalized number and is equal to: 
(=1)S x 2-14 x (0. fraction) 
The minimum positive denormalized number is 2-24, or approximately 5.960 x 10-8. 


Half-precision denormalized numbers are not flushed to zero by default. When ARMv8.2-FP16 is 
implemented, the FPCR.FZ16 bit controls whether Flush-to-Zero mode is enabled for half-precision 
data-processing instructions. For details, see F/ush-to-zero on page A1-54. 


exponent == Qx1F 
The value depends on which half-precision format is being used: 


IEEE half-precision 
The value is either an infinity or a Not a Number (NaN), depending on the fraction bits: 


fraction == 
The value is an infinity. There are two distinct infinities: 
+infinity When S==0. This represents all positive numbers that are too 
big to be represented accurately as a normalized number. 
-infinity When S==1. This represents all negative numbers with an 
absolute value that is too big to be represented accurately as a 
normalized number. 
fraction != 0 
The value is a NaN, and is either a quiet NaN or a signaling NaN. 
The two types of NaN are distinguished by their most significant fraction 
bit, bit[9]: 
bit[9] == 0 The NaN is a signaling NaN. The sign bit can take any value, 
and the remaining fraction bits can take any value except all 
Zeros. 
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bit[9] == 1 The NaN is a quiet NaN. The sign bit and remaining fraction 
bits can take any value. 
Alternative half-precision 
The value is a normalized number and is equal to: 
-1S x 216 x (1. fraction) 


The maximum positive normalized number is (2-2-10) x 2!6 or 131008. 


A1.4.3 Single-precision floating-point format 
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The single-precision floating-point format is as defined by the IEEE 754 standard. 


This description includes Arm-specific details that are left open by the standard. It is only intended as an 
introduction to the formats and to the values they can contain. For full details, especially of the handling of infinities, 
NaNs, and signed zeros, see the IEEE 754 standard. 


A single-precision value is a 32-bit word with the format: 


31 30 23 22 0 


The interpretation of the format depends on the value of the exponent field, bits[30:23]: 


0 < exponent < QxFF 
The value is a normalized number and is equal to: 
(=1)S x 2(exponent — 127) x (] fraction) 
The minimum positive normalized number is 2-!26, or approximately 1.175 x 10-38. 


The maximum positive normalized number is (2 — 2-23) x 2!27, or approximately 3.403 x 1038. 


exponent == 
The value is either a zero or a denormalized number, depending on the fraction bits: 


fraction == 
The value is a zero. There are two distinct zeros: 
+0 When S==0. 
—0 When S==1. 


These usually behave identically. In particular, the result is equal if +0 and —0 are 
compared as floating-point numbers. However, they yield different results in some 
circumstances. For example, the sign of the infinity produced as the result of dividing 
by zero depends on the sign of the zero. The two zeros can be distinguished from each 
other by performing an integer comparison of the two words. 


fraction != 0 
The value is a denormalized number and is equal to: 
(-1)§ x 27126 x (0.fraction) 
The minimum positive denormalized number is 2-!49, or approximately 1.401 x 1045. 


Denormalized numbers are always flushed to zero in Advanced SIMD processing in AArch32 state. 
They are optionally flushed to zero in floating-point processing and in Advanced SIMD processing 
in AArch64 state. For details, see F/ush-to-zero on page A1-54. 


exponent == 0xFF 
The value is either an infinity or a Not a Number (NaN), depending on the fraction bits: 


fraction == 
The value is an infinity. There are two distinct infinities: 
+infinity When S==0. This represents all positive numbers that are too big to be 
represented accurately as a normalized number. 
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-infinity When S==1. This represents all negative numbers with an absolute value 
that is too big to be represented accurately as a normalized number. 


fraction != 0 
The value is a NaN, and is either a quiet NaN or a signaling NaN. 
The two types of NaN are distinguished by their most significant fraction bit, bit[22]: 
bit[22] == 


The NaN is a signaling NaN. The sign bit can take any value, and the 
remaining fraction bits can take any value except all zeros. 


bit[22] = 


The NaN is a quiet NaN. The sign bit and remaining fraction bits can take 
any value. 


For details of the default NaN, see NaN handling and the Default NaN on page A1-55. 





Note 


NaNs with different sign or fraction bits are distinct NaNs, but this does not mean software can use floating-point 
comparison instructions to distinguish them. This is because the IEEE 754 standard specifies that a NaN compares 
as unordered with everything, including itself. 





A1.4.4 Double-precision floating-point format 


The double-precision floating-point format is as defined by the IEEE 754 standard. Double-precision floating-point 
is supported by both SIMD and floating-point instructions in AArch64 state, and only by floating-point instructions 
in AArch32 state. 


This description includes implementation-specific details that are left open by the standard. It is only intended as an 
introduction to the formats and to the values they can contain. For full details, especially of the handling of infinities, 
NaNs, and signed zeros, see the IEEE 754 standard. 


A double-precision value is a 64-bit doubleword, with the format: 


63 62 52 51 32 31 0 


| eee OOO l 
exponent fraction 
c 


Double-precision values represent numbers, infinities, and NaNs in a similar way to single-precision values, with 
the interpretation of the format depending on the value of the exponent: 
0 < exponent < 0x7FF 

The value is a normalized number and is equal to: 

(=1)S x 2(exponent-1023) x (1 fraction) 

The minimum positive normalized number is 271022, or approximately 2.225 x 10-7308, 

The maximum positive normalized number is (2 — 2-52) x 21023, or approximately 1.798 x 10308, 
exponent == 

The value is either a zero or a denormalized number, depending on the fraction bits: 


fraction == 


The value is a zero. There are two distinct zeros that behave in the same way as the two 
single-precision zeros: 


+0 when S==0 
—0 when S==1. 
fraction != 0 
The value is a denormalized number and is equal to: 
(-1)S x 2-1022 x (0.fraction) 
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The minimum positive denormalized number is 2-!974, or approximately 4.941 x 10-324, 


Optionally, denormalized numbers are flushed to zero in floating-point calculations. For details, see 
Flush-to-zero on page A1-54. 


exponent == 0x7FF 
The value is either an infinity or a NaN, depending on the fraction bits: 
fraction == 
The value is an infinity. As for single-precision, there are two infinities: 
+infinity When S==0. 
-infinity When S==1. 
fraction != 0 
The value is a NaN, and is either a quiet NaN or a signaling NaN. 
The two types of NaN are distinguished by their most significant fraction bit, bit[51] of 
the doubleword: 
bit[51] == 
The NaN is a signaling NaN. The sign bit can take any value, and the 
remaining fraction bits can take any value except all zeros. 
bit[51] == 
The NaN is a quiet NaN. The sign bit and the remaining fraction bits can 
take any value. 


For details of the default NaN, see NaN handling and the Default NaN on page A1-55. 


Note 


NaNs with different sign or fraction bits are distinct NaNs, but this does not mean software can use floating-point 
comparison instructions to distinguish them. This is because the IEEE 754 standard specifies that a NaN compares 
as unordered with everything, including itself. 








A1.4.5 Fixed-point format 


Fixed-point formats are used only for conversions between floating-point and fixed-point values. They apply to 
general-purpose registers. 


Fixed-point values can be signed or unsigned, and can be 16-bit or 32-bit. Conversion instructions take an argument 
that specifies the number of fraction bits in the fixed-point number. That is, it specifies the position of the binary 
point. 


A1.4.6 Conversion between floating-point and fixed-point values 
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Armv8 supports the conversion of a scalar floating-point to or from a signed or unsigned fixed-point value in a 
general-purpose register. 


The instruction argument #fbits indicates that the general-purpose register holds a fixed-point number with fbits bits 
after the binary point, where fbits is in the range 1 to 64 for a 64-bit general-purpose register, or 1 to 32 for a 32-bit 
general-purpose register. 


More specifically: 
$ For a 64-bit register Xa: 
— The integer part is Xq[63:#fbits]. 
— The fractional part is Xa[(#fbits-1):0]. 
° For a 32-bit register Wg or Rg: 
— The integer part is Wq[31:#fbits] or Ra[3 1:#fbits]. 
— The fractional part is Wa[(#fbits-1):0] or Ra[(#fbits-1):0]. 
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A1.4.7 
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These instructions can cause the following floating-point exceptions: 


Invalid Operation When the floating-point input is NaN or Infinity or when a numerical value cannot be 
represented within the destination register. 


Inexact When the numeric result differs from the input value. 


Input Denormal When Flush-to-zero mode is enabled and the denormal input is replaced by a zero. 





Note 
An out of range fixed-point result is saturated to the destination size. 





For more information, see Floating-point exceptions and exception traps on page D1-2313. 


Polynomial arithmetic over {0, 1} 


Some SIMD instructions that operate on SIMD&FP registers can operate on polynomials over {0, 1}, see Supported 
data types on page Al-41. The polynomial data type represents a polynomial in x of the form bn-1x™=! + ... + bix 
+ bo where bx is bit[k] of the value. 


The coefficients 0 and 1 are manipulated using the rules of Boolean arithmetic: 
a 0+0=1+1=0 

š 0+1=1+0=1 

: 0x0=0x1=1x0=0 





. 1x1=1. 

That is: 

. Adding two polynomials over {0, 1} is the same as a bitwise exclusive OR. 

s Multiplying two polynomials over {0, 1} is the same as integer multiplication except that partial products are 


exclusive-ORed instead of being added. 
A64, A32, and T32 provide instructions for performing polynomial multiplication of 8-bit values. 


: For AArch32, see VMUL (integer and polynomial) on page F6-5165 and VMULL (integer and polynomial) 
on page F6-5171. 


E For AArch64, see PMUL on page C7-1849 and PMULL, PMULL2 on page C7-1851. 

The Cryptographic Extension adds the ability to perform long polynomial multiplies of 64-bit values. See PMULL, 
PMULL2 on page C7-1851. 

Pseudocode description of polynomial multiplication 

In pseudocode, polynomial addition is described by the EOR operation on bitstrings. 


Polynomial multiplication is described by the PolynomialMult() function defined in Chapter J1 ArmvS Pseudocode. 
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A1.5 Advanced SIMD and floating-point support 


ARM DDI 0487E.a 
ID070919 


Note 


In AArch32 state, the SIMD instructions that operate on SIMD&FP registers are always described as the Advanced 
SIMD instructions, to distinguish them from the SIMD instructions in the base instruction sets, that operate on the 
32-bit general-purpose registers. The A64 instruction set does not provide any SIMD instructions that operate on 
the general-purpose registers, and therefore some AArch64 state descriptions use SIMD as a synonym for Advanced 
SIMD. Unless the context clearly indicates otherwise, this section describes the support for SIMD instructions that 
operate on SIMD&FP registers. 








Armv§8 can support the following levels of support for Advanced SIMD and floating-point instructions: 
$ Full SIMD and floating-point support without exception trapping. 
s Full SIMD and floating-point support with exception trapping. 


° No floating-point or SIMD support. This option is licensed only for implementations targeting specialized 
markets. 





Note 
All systems that support standard operating systems with rich application environments provide hardware 


support for Advanced SIMD and floating-point. It is a requirement of the ARM Procedure Call Standard for 
AArch64, see Procedure Call Standard for the Arm 64-bit Architecture. 





Armv8 supports single-precision (32-bit) and double-precision (64-bit) floating-point data types and arithmetic as 
defined by the IEEE 754 floating-point standard. It also supports the half-precision (16-bit) floating-point data type 
for data storage, by supporting conversions between single-precision and half-precision data types and 
double-precision and half-precision data types. When ARMv8.2-FP16 is implemented, it also supports the 
half-precision floating-point data type for data-processing operations. 


The SIMD instructions provide packed Single Instruction Multiple Data (SIMD) and single-element scalar 
operations, and support: 


° Single-precision and double-precision arithmetic in AArch64 state. 

$ Single-precision arithmetic only in AArch32 state. 

7 When ARMv8.2-FP 16 is implemented, half-precision arithmetic is supported in AArch64 and AArch32 
states. 


Floating-point support in AArch64 state SIMD is IEEE 754-2008 compliant with: 


° Configurable rounding modes. 
° Configurable Default NaN behavior. 
° Configurable Flush-to-zero behavior. 


Floating-point computation using AArch32 Advanced SIMD instructions remains unchanged from Armv7. A32 
and T32 Advanced SIMD floating-point always uses Arm standard floating-point arithmetic and performs 
IEEE 754 floating-point arithmetic with the following restrictions: 


° Denormalized numbers are flushed to zero, see Flush-to-zero on page A1-54. 

$ Only default NaNs are supported, see NaN handling and the Default NaN on page A1-55. 
. The Round to Nearest rounding mode is used. 

: Untrapped floating-point exception handling is used for all floating-point exceptions. 


If floating-point exception trapping is supported, floating-point exceptions, such as Overflow or Divide by Zero, 
can be handled without trapping. This applies to both SIMD and floating-point operations. When handled in this 
way, a floating-point exception causes a cumulative status register bit to be set to 1 and a default result to be 
produced by the operation. For more information about floating-point exceptions, see Floating-point exceptions and 
exception traps on page D1-2313. 
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A1.5.1 
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In AArch64 state, the following registers control floating-point operation and return floating-point status 
information: 


s The Floating-Point Control Register, FPCR, controls: 
— The half-precision format where applicable, FPCR.AHP bit. 


— Default NaN behavior, FPCR.DN bit. 


—  Flush-to-zero behavior, FPCR. {FZ, FZ16} bits. If ARMv8.2-FP16 is not implemented, FPCR.FZ16 
is RESO. 


— Rounding mode support, FPCR.Rmode field. 
— Len and Stride fields associated with execution in AArch32 state, and only supported for a context 
save and restore from AArch64 state. These fields are obsolete in Armv8 and can be implemented as 


RAZ/WI. If they are implemented as RW and are programmed to a nonzero value, they make some 
AArch32 floating-point instructions UNDEFINED. 


— Floating-point exception trap controls, the FPCR. {IDE, IXE, UFE, OFE, DZE, IOE} bits, see 
Floating-point exceptions and exception traps on page D1-2313. 


. The Floating-Point Status Register, FPSR, provides: 
— Cumulative floating-point exceptions flags, FPSR. {IDC, IXC, UFC, OFC, DZC, IOC and QC}. 
— The AArch32 floating-point comparison flags {N,Z,C,V}. These bits are RESO if AArch32 
floating-point is not implemented. 
Note 


In AArch64 state, the process state flags, PSTATE. {N,Z,C,V} are used for all data-processing 
compares and any associated conditional execution. 

If ARMv8.5-CondM is implemented, the instructions AXFLAG and XAFLAG convert between the Arm 
condition flag format and an alternative format shown in Relationship between ARM format and 
alternative format PSTATE condition flags on page C6-752. 








AArch32 state provides a single Floating-Point Status and Control Register, FPSCR, combining the FPCR and 
FPSR fields. 


For system level information about the SIMD and floating-point support, see Advanced SIMD and floating-point 
support on page G1-5570. 


Instruction support 


The Advanced SIMD and floating-point instructions support: 
d Load and store for single elements and vectors of multiple elements. 


Note 


Single elements are also referred to as scalar elements. 





$ Data processing on single and multiple elements for both integer and floating-point data types. 
7 When ARMv8.3-CompNum is implemented, complex number arithmetic. 

° Floating-point conversion between different levels of precision. 

: Conversion between floating-point, fixed-point integer, and integer data types. 

$ Floating-point rounding. 


For more information on the SIMD and floating-point instructions in AArch64 state, see Chapter C3 464 
Instruction Set Overview. 


For more information on the Advanced SIMD and floating-point instructions in AArch32 state, see Chapter F1 The 
AArch32 Instruction Sets Overview. 
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A1.5.2 Floating-point standards, and terminology 


The Arm includes support for all the required features of ANSI/IEEE Std 754-2008, IEEE Standard for Binary 
Floating-Point Arithmetic, referred to as IEEE 754-2008. However, some terms in this manual are based on the 
1985 version of this standard, referred to as IEEE 754-1985: 


è Arm floating-point terminology generally uses the IEEE 754-1985 terms. This section summarizes how 
IEEE 754-2008 changes these terms. 


$ References to IEEE 754 that do not include the issue year apply to either issue of the standard. 


Table A1-3 shows how the terminology in this manual differs from that used in IEEE 754-2008. 


Table A1-3 Floating-point terminology 











This manual IEEE 754-2008 
Normalized è Normal 
Denormal, or denormalized Subnormal 





Round towards Minus Infinity (RM) roundTowardsNegative 











Round towards Plus Infinity (RP) roundTowardsPositive 
Round towards Zero (RZ) roundTowardZero 
Round to Nearest (RN) roundTiesToEven 





Round to Nearest with Ties to Away roundTiesToAway 





Rounding mode Rounding-direction attribute 


a. Normalized number is used in preference to normal number, 
because of the other specific uses of normal in this manual. 


A1.5.3 Arm standard floating-point input and output values 
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Armv8 provides full IEEE 754 floating-point arithmetic support. In AArch32 state, floating-point operations 
performed using Advanced SIMD instructions are limited to Arm standard floating-point operation, regardless of 
the selected rounding mode in the FPSCR. Unlike AArch32, AArch64 SIMD floating point arithmetic is performed 
using the rounding mode selected by the FPCR. 


Arm standard floating-point arithmetic supports the following input formats defined by the IEEE 754 floating-point 
standard: 


7 Zeros. 

. Normalized numbers. 

. Denormalized numbers are flushed to 0 before floating-point operations, see F/ush-to-zero on page A1-54. 
s NaNs. 

. Infinities. 


Arm standard floating-point arithmetic supports the Round to Nearest (roundTiesToEven) rounding mode defined 
by the IEEE 754 standard. 


Arm standard floating-point arithmetic supports the following output result formats defined by the IEEE 754 
standard: 


è Zeros. 
° Normalized numbers. 
° Results that are less than the minimum normalized number are flushed to zero, see Flush-to-zero on 
page A1-54. 
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A1.5.4 


A1-54 


s NaNs produced in floating-point operations are always the default NaN, see NaN handling and the Default 
NaN on page A1-55. 


. Infinities. 


Flush-to-zero 


The performance of floating-point processing can be reduced when doing calculations involving denormalized 
numbers and Underflow exceptions. In many algorithms, this performance can be recovered, without significantly 
affecting the accuracy of the final result, by replacing the denormalized operands and intermediate results with 
zeros. To permit this optimization, Arm floating-point implementations allow a Flush-to-zero mode to be used for 
different floating-point formats as follows: 


For AArch64: 


e If FPCR.FZ==1, then Flush-to-Zero mode is used for all Single-Precision and Double-Precision inputs and 
outputs of all instructions. 


° If FPCR.FZ16==1, then Flush-to-Zero mode is used for all Half-Precision inputs and outputs of 
floating-point instructions, other than: 
— Conversions between Half-Precision and Single-Precision numbers. 


— Conversions between Half-Precision and Double-Precision numbers. 
For AArch32: 


: If FPSCR.FZ==0, then Flush-to-Zero mode is used for all Single-Precision and Double-Precision inputs and 
outputs of all Advanced SIMD floating-point instructions. 


$ If FPSCR.FZ==1, then Flush-to-Zero mode is used for all Single-Precision and Double-Precision inputs and 
outputs of all instructions. 


e If FPSCR.FZ16==1, then Flush-to-Zero mode is used for all Half-Precision inputs and outputs of 
floating-point instructions, other than: 
— Conversions between Half-Precision and Single-Precision numbers. 


— Conversions between Half-Precision and Double-Precision numbers. 
If Flush-To-Zero mode is used on an Single-precision or Double-precision input: 


: All inputs to floating-point operations that are denormalized numbers in their represented precision are 
treated as though they were zero with the same sign as the input, and an Input Denormal floating-point 
exception is generated. 

Note 


The Input Denormal floating-point exception occurs only in Flush-to-zero mode. 








7 In AArch32 state, the FPSCR contains a cumulative exception bit FPSCR.IDC and optional trap enable bit 
FPSCR.IDE corresponding to the Input Denormal floating-point exception. 


` In AArch64 state, the FPSR contains a cumulative exception bit FPSR.IDC and optional trap enable bit 
FPCR.IDE corresponding to the Input Denormal floating-point exception. 


$ The occurrence of all floating-point exceptions except Input Denormal is determined using the input values 
that are treated as zero by this mechanism. 


If Flush-To-Zero mode is used on a Half-precision input: 


: All inputs to floating-point operations that are denormalized numbers in their represented precision are 
treated as though they were zero with the same sign as the input. 


Note 


When ARMv8.2-FP16 is implemented, when in Flush-to-zero mode, a half-precision floating-point number 
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that is flushed to zero does not generate an Input Denormal floating-point exception. This is because this 


situation is much less exceptional than for double-precision or single-precision denormalized numbers. 





The occurrence of all floating-point exceptions is determined using the input values that are treated as zero 
by this mechanism. 


If Flush-To-Zero mode is used on any output of an instruction: 


The output is returned as zero, with the same sign bit as the result, if the result before rounding of the 
operation specified by the instruction satisfies the condition: 


0 < Abs(result) < MinNorm, where: 

—  MinNorm is 2-14 for half-precision. 

—  MinNorm is 24-126 for single-precision. 
—  MiunNorm is 24-1022 for double-precision. 
If this occurs, then: 


— An Underflow Exception is generated, but in all implementations, the Underflow Exception is not 
trapped even if the AArch32 FPSCR.UFE==1 or the AArch64 FPCR.UFE==1. 


— An Inexact Exception is not generated. 


Note 





Flush-to-zero mode is incompatible with the IEEE 754 standard, and must not be used when IEEE 754 compatibility 
is a requirement. Flush-to-zero mode must be used with care. Although it can improve performance on some 
algorithms, there are significant limitations on its use. These are application dependent: 


On many algorithms, it has no noticeable effect, because the algorithm does not normally use denormalized 
numbers. 


On other algorithms, it can cause exceptions to occur or seriously reduce the accuracy of the results of the 
algorithm. 





A1.5.5 NaN handling and the Default NaN 


The IEEE 754 standard specifies that: 
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An operation that causes an Invalid Operation floating-point exception generates a quiet NaN as its result if 
that exception is untrapped. 


An operation involving a quiet NaN operand, but not a signaling NaN operand, returns an input NaN as its 
result. 


The floating-point processing behavior when Default NaN mode is disabled adheres to this, with the following 
additions: 


If an untrapped Invalid Operation floating-point exception occurs, the quiet NaN result is derived from: 


— The first signaling NaN operand, if the exception occurs because at least one of the operands is a 
signaling NaN. 


— Otherwise, the default NaN. 


If an untrapped Invalid Operation floating-point exception does not occur, but at least one of the operands is 
a quiet NaN, the result is derived from the first quiet NaN operand. 


Depending on the operation, the exact value of a derived quiet NaN result may differ in both sign and number of 
fraction bits from its source. For a quiet NaN result derived from signaling NaN operand, the most-significant 
fraction bit is set to 1. 
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Note 


$ In these descriptions, first operand relates to the left-to-right ordering of the arguments to the pseudocode 
function that describes the operation. 





è The IEEE 754 standard specifies that the sign bit of a NaN has no significance. 





The SIMD and floating-point processing behavior when Default NaN mode is enabled is that the Default NaN is 
the result of all floating-point operations that either: 


s Cause untrapped Invalid Operation floating-point exceptions. 
$ Have one or more quiet NaN inputs, but no signaling NaN inputs. 


Table A1-4 shows the format of the default NaN for Arm floating-point operations. 
Default NaN mode is selected for the floating-point processing by setting the FPCR.DN bit to 1. 


Other aspects of the functionality of the Invalid Operation floating-point exception are not affected by Default NaN 
mode. These are that: 


° If untrapped, it causes the FPSR.IOC bit to be set to 1. 














a If trapped, it causes a user trap handler to be invoked. 
Table A1-4 Default NaN encoding 
Half-precision, IEEE Format Single-precision Double-precision 
Sign bit 0 0 0 
Exponent 0x1F OxFF Ox7FF 
Fraction Bit[9] == 1, bits[8:0] == Bit[22] == 1, bits[21:0] == Bit[51] == 1, bits[50:0] == 
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A1.6 The Arm memory model 
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The Arm memory model supports: 


$ Generating an exception on an unaligned memory access. 

à Restricting access by applications to specified areas of memory. 

` Translating virtual addresses (VAs) provided by executing instructions to physical addresses (PAs). 
è Altering the interpretation of multi-byte data between big-endian and little-endian. 

° Controlling the order of accesses to memory. 

° Controlling caches and address translation structures. 

è Synchronizing access to shared memory by multiple PEs. 

. Barriers that control and prevent speculative access to memory. 


VA support depends on the Execution state, as follows: 


AArch64 state 


Supports 64-bit virtual addressing, with the Translation Control Register determining the supported 
VA range. Execution at EL1 and ELO supports two independent VA ranges, each with its own 
translation controls. 


AArch32 state 


Supports 32-bit virtual addressing, with the Translation Control Register determining the supported 
VA range. For execution at EL1 and ELO, system software can split the VA range into two 
subranges, each with its own translation controls. 


The supported PA space is IMPLEMENTATION DEFINED, and can be discovered by system software. 


Regardless of the Execution state, the Virtual Memory System Architecture (VMSA) can translate VAs to blocks or 
pages of memory anywhere within the supported PA space. 


For more information, see: 


For execution in AArch64 state 
. Chapter B2 The AArch64 Application Level Memory Model. 
- Chapter D4 The AArch64 System Level Memory Model. 
- Chapter D5 The AArch64 Virtual Memory System Architecture. 


For execution in AArch32 state 
è Chapter E2 The AArch32 Application Level Memory Model. 
` Chapter G4 The AArch32 System Level Memory Model. 
è Chapter G5 The AArch32 Virtual Memory System Architecture. 
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Armv8-A Architecture Extensions 


This chapter introduces the Arm architecture versions and extensions. It contains the following sections: 
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Armvé architecture extensions on page A2-60. 

Architectural features within Armv8.0 architecture on page A2-63. 
The Armv8 Cryptographic Extension on page A2-66. 

The Armv8.1 architecture extension on page A2-67. 

The Armv8.2 architecture extension on page A2-70. 

The Armv8.3 architecture extension on page A2-78. 

The Armv8.4 architecture extension on page A2-81. 

The Armvs8.5 architecture extension on page A2-86. 


The Reliability, Availability, and Serviceability Extension (RAS Extension) on page A2-90. 


The Statistical Profiling Extension (SPE) on page A2-91. 

The Scalable Vector Extension (SVE) on page A2-92. 

The Activity Monitors Extension on page A2-93. 

The Memory Partitioning and Monitoring (MPAM) Extension on page A2-94. 
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A2.1 Armvé8 architecture extensions 


The original Armv8-A architecture is called Armv8.0. The following sections of this manual describe or summarize 
permitted extensions to Armv8.0: 


The Armv8 Cryptographic Extension on page A2-66. 

The Reliability, Availability, and Serviceability Extension (RAS Extension) on page A2-90. 
Event monitors on page D1-2379. 

The IVIPT Extension on page D5-2657. 

Chapter H7 The PC Sample-based Profiling Extension. 


In addition to describing Armv8.0, this manual describes the following architectural extensions: 


Features added to Armv8.0 in later releases 


Architectural features and architectural requirements have been added to the original Armv8-A 
architecture. For more information, see: 


Additional functionality added to Armv8.0 in later releases on page A2-63. 


Architectural requirements within Armv8.0 architecture on page A2-65. 


For more information, see Architectural features within Armv8.0 architecture on page A2-63. 


The Armv8.1 architectural extension 


The Armv8.1 architecture extension adds both: 


Architectural features. Some of these are mandatory, others are optional. Some features must 
be implemented together. 


Architectural requirements. These are mandatory. 


An implementation is Armv8.1 compliant when all of the following apply: 


It includes all of the Armv8.1 architectural features that are mandatory. This includes all 
architectural features of an optional architecture component or extension that are defined as 
mandatory, if the Armv8.1 compliant implementation includes the optional architecture 
component or extension. See Architectural features added by Armv8.1 on page A2-67 for all 
of the Armv8.1 architectural features. 


It includes all of the Armv8. 1 architectural requirements. Additional requirements of Armv8.1 
on page A2-69 lists these requirements. 


For more information, see The Armyv8. 1 architecture extension on page A2-67. 


The Armv8.2 architectural extension 


A2-60 


The Armv8.2 architecture extension is an extension to Armv8.1. It adds both: 


Architectural features. Some of these are mandatory, others are optional. Some features must 
be implemented together. 


Architectural requirements. These are mandatory. 


An implementation is Armv8.2 compliant if all of the following apply: 


It is Armv8.1 compliant. 


It includes all of the Armv8.2 architectural features that are mandatory. This includes all 
architectural features of an optional architecture component or extension that are defined as 
mandatory, if the Armv8.2 compliant implementation includes the optional architecture 
component or extension. The features are listed at: 


— Architectural features added by Armv8.2 on page A2-70, which lists the original 
Armv8.2 architectural features. 


— Features added to the Armv8.2 extension in later releases on page A2-76, which lists 
additional Armv8.2 architectural features. 


It includes all of the Armv8.2 architectural requirements. Additional requirements of Armv8.2 
on page A2-76 lists these requirements. 


For more information, see The Armv&.2 architecture extension on page A2-70. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


Armvs-A Architecture Extensions 
A2.1 Armv8 architecture extensions 


The Armv8.3 architectural extension 
The Armv8.3 architecture extension is an extension to Armv8.2. It adds both: 


° Architectural features. Some of these are mandatory, others are optional. Some features must 
be implemented together. 


. Architectural requirements. These are mandatory. 
An implementation is Armv8.3 compliant if all of the following apply: 
3 It is Armv8.2 compliant. 


° It includes all of the Armv8.3 architectural features that are mandatory. This includes all 
architectural features of an optional architecture component or extension that are defined as 
mandatory, if the Armv8.3 compliant implementation includes the optional architecture 
component or extension. The features are listed at: 


— Architectural features added by Armv8.3 on page A2-78, which lists the original 
Armv8.3 architectural features. 


— Features added to the Armv8.3 extension in later releases on page A2-80, which lists 
additional Armv8.3 architectural features. 


. It includes all of the Armv8.3 architectural requirements. Additional requirements of Armvs.3 
on page A2-80 lists these requirements. 


For more information, see The Armv8.3 architecture extension on page A2-78. 


The Armv8.4 architectural extension 


The Armv8.4 architecture extension is an extension to Armv8.3. It adds architectural features. Some 
of these are mandatory, others are optional. Some features must be implemented together. 


An implementation is Armv8.4 compliant if all of the following apply: 
° It is Armv8.3 compliant. 


° It includes all of the Armv8.4 architectural features that are mandatory. This includes all 
architectural features of an optional architecture component or extension that are defined as 
mandatory, if the Armv8.4 compliant implementation includes the optional architecture 
component or extension. See Architectural features added by Armv8.4 on page A2-81 for all 
of the Armv8.4 architectural features. 


For more information, see The Armv&.4 architecture extension on page A2-81. 


The Armv8.5 architectural extension 


The Armv8.5 architecture extension is an extension to Armv8.4. It adds architectural features. Some 
of these are mandatory, others are optional. Some features must be implemented together. 


An implementation is Armv8.5 compliant if all of the following apply: 
è It is Armv8.4 compliant. 


° It includes all of the Armv8.5 architectural features that are mandatory. This includes all 
architectural features of an optional architecture component or extension that are defined as 
mandatory, if the Armv8.5 compliant implementation includes the optional architecture 
component or extension. See Architectural features added by Armv8.5 on page A2-86 for all 
of the Armv8.5 architectural features. 


$ It includes all of the Armv8.3 architectural requirements. Additional requirements of Armv8.5 
on page A2-88 lists these requirements. 


For more information, see The Armv8. 5 architecture extension on page A2-86. 

The Statistical Profiling Extension (SPE) 
SPE is an optional extension to Armv8.2. That is, SPE requires the implementation of Armv8.2. 
For more information, see The Statistical Profiling Extension (SPE) on page A2-91. 

The Scalable Vector Extension (SVE) 


SVE is an optional extension to Armv8.2. That is, SVE requires the implementation of Armv8.2. 
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For more information, see The Scalable Vector Extension (SVE) on page A2-92. 


The Activity Monitors Extension (AMU) 
AMU is an optional extension to Armv8.4. That is, AMU requires the implementation of Armv8.4. 
For more information, see The Activity Monitors Extension on page A2-93. 

The Memory Partitioning and Monitoring Extension (MPAM) 


MPAM is an optional extension to Armv8.2. That is, MPAM requires the implementation of 
Armv8.2. 


For more information, see The Memory Partitioning and Monitoring (MPAM) Extension on 
page A2-94, 


See also Permitted implementation of subsets of Armv8.x and Armv8.(x+ 1) architectural features. 


A2.1.1 Permitted implementation of subsets of Armv8.x and Armv8.(x+1) architectural features 


An Armv8.x compliant implementation can include any arbitrary subset of the architectural features of 
Armv8.(x+1), subject only to those constraints that require that certain features be implemented together. 


An Armv8.x compliant implementation cannot include any features of Armv8.(x+2). 





Note 


The addition of Armv8.(x+1) features to an Armv8.x compliant implementation is only permitted ifthe implementer 
has a licence to Armv8.(x+1) in addition to the licence to Armv8.x. 
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A2.2 Architectural features within Armv8.0 architecture 


This includes architectural features and architectural requirements that have been added to the Armv8.0 architecture 
since the initial release, that were not part of the original Armv8-A architecture, see: 


. Additional functionality added to Armv8.0 in later releases 
. Architectural requirements within Armv8.0 architecture on page A2-65 
A2.2.1 Additional functionality added to Armv8.0 in later releases 


An implementation of Armv8.0 can include any or all of the features that this section describes. 


The Armv8.0 architecture extension adds the following architectural features, which are identified by the 
architectural feature name and a short description of the feature: 


ARMv8.0-SB, Armvs8.0 Speculation Barrier 
ARMv8.0-SB introduces a barrier to control speculation. 
This instruction is introduced to both AArch64 and AArch32 states. 
This feature is optional in Armv8.0 implementations, and mandatory in Armv8.5 implementations. 
The following fields identify the presence of ARMv8.0-SB: 
° ID_AA64ISAR1_EL1.SB 
° ID_ISAR6_EL1.SB 
° ID_ISAR6.SB 


For more information, see: 

7 Speculation Barrier (SB) on page B2-126. 

e Barriers and CLREX instructions on page C3-193. 
° Speculation Barrier (SB) on page E2-3825. 

š Miscellaneous instructions on page F1-3883. 


ARMv8.0-SSBS, Armv8.0 Speculative Store Bypass Safe 


ARMvVv8.0-SSBS allows software to indicate whether hardware is permitted to load or store 
speculatively in a manner that could give rise to a cache timing side channel, which in turn could be 
used to derive an address from values loaded to a register from memory. To do this, the software 
sets the PSTATE.SSBS bit. 


This feature is supported in both AArch64 and AArch32 states. 

This feature is optional in Armv8.0 implementations, and mandatory in Armv8.5 implementations. 
The following fields identify the presence of ARMv8.0-SSBS: 

° ID_AA64PFR0_EL1.SSBS 

° ID_PFRO_EL1.SSBS 

° ID_PFRO.SSBS 


For more information, see: 
. Speculative Store Bypass Safe (SSBS) on page B2-123. 
- Speculative Store Bypass Safe (SSBS) on page E2-3822. 


ARMv8.0-CSV2, Armv8.0 Cache Speculation Variant 2 


Armv8.0-CSV2 adds a mechanism to identify if hardware cannot disclose information about 
whether branch targets trained in one hardware described context can affect speculative execution 
in a different hardware described context. In AArch64 state, this feature also adds the 
SCXTNUM_EL0, SCXTNUM_EL1, SCXTNUM_EL2 and SCXTNUM _EL3 registers, which 
provide a number that can be used to separate out different context numbers within their respective 
Exception levels for the purpose of protecting against side-channels using branch prediction and 
similar resources. 


This feature is supported in both AArch64 and AArch32 states. The SCXTNUM_ELx registers are 
only supported in AArch64 state. 
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This feature is mandatory in Armv8.0 implementations. 

The following fields identify the presence of ARMv8.0-CSV2: 

° ID_AA64PFR0 _EL1.CSV2 

° ID_PFRO_EL1.CSV2 

° ID_PFRO.CSV2 

For more information, see: 

. Restrictions on the effects of speculation on page B2-123. 
. Restrictions on the effects of speculation on page E2-3821. 


ARMv8.0-CSV3, Armv8.0 Cache Speculation Variant 3 


Armv8.0-CSV3 adds a mechanism to identify if hardware cannot disclose information about 
whether data loaded under speculation with a permission or domain fault can be used to form an 
address, generate condition codes, or generate SVE predicate values, to be used by instructions 
newer than the load in the speculative sequence. 


This feature is supported in both AArch64 and AArch32 states. 
This feature is mandatory in Armv8.0 implementations. 

The following fields identify the presence of ARMv8.0-CSV3: 
° ID_AA64PFR0_EL1.CSV3 

° ID_PFR2_EL1.CSV3 

° ID_PFR2.CSV3 


ARMv8.0-PredInv, Armv8.0 Prediction Invalidation 


ARMv8.0-PredInv adds the CFP RCTX, CPP RCTX, DVP RCTX, CFPRCTX, CPPRCTX, and 
DVPRCTX System instructions. These instructions prevent predictions based on information 
gathered from earlier execution within a particular execution context from affecting the later 
speculative execution within that context, to the extent that the speculative execution is observable 
through side channels. 


This feature is supported in both AArch64 and AArch32 states. 

This feature is optional in Armv8.0 implementations, and mandatory in Armv8.5 implementations. 
The following fields identify the presence of ARMv8.0-PredInv: 

° ID_AA64ISAR1_EL1.SPECRES 

° ID_ISAR6_EL1.SPECRES 

° ID_ISAR6.SPECRES 


For more information, see: 


° Prediction restriction instructions on page C5-368. 
3 Execution and data prediction restriction System instructions on page D4-2494. 
s Execution and data prediction restriction System instructions on page G4-5708. 


ARMv8.0-CP1I5SDISABLE2, Armv8.0 CPI5SDISABLE2 


ARMv8.0-CPI5SDISABLE2 provides an implementation-defined mechanism, the 
CP15SDISABLE2 signal, which when asserted HIGH prevents writes to a set of Secure CP15 
registers. This signal is analogous to the existing CPISSDISABLE signal. 


This feature is only supported when EL3 is executing in AArch32 state. 
This feature is optional in Armv8.0 implementations. 


For more information, see: 
od The CPIS5SDISABLE and CP15SDISABLE2 input signals on page G5-5854. 


ARMv8.0-DoubleLock, Armv8.0 Double Lock 


A2-64 


The ARMv8.0-DoubleLock feature is the mnemonic used for the OS Double Lock. 


If ARMv8.3-DoPD is not implemented, this feature is OPTIONAL if ARMv8.2-Debug is 
implemented and mandatory if ARMv8.2-Debug is not implemented. 
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If ARMv8.3-DoPD is implemented, this feature is not implemented. 


The ID AA64DFRO_EL1.DoubleLock field identifies that the OS Double Lock has been 
implemented. 


A2.2.2 Architectural requirements within Armv8.0 architecture 


The Armv8.0 architecture includes some mandatory changes that have been added to the architecture at a later date 
that are not associated with a feature. These are: 


Prefetch speculation protection 


When substituting a direct branch with another direct branch, or a NOP with a direct branch, by the 
modified PE, at around the time that the executing PE is executing the software being modified, 
prefetch speculation protection prevents the old instructions from accidentally being fetched to the 
executing PE. For further information on implementation of these requirements, see: 

$ Ordering of instruction fetches on page B2-122. 

è Ordering of instruction fetches on page E2-3820. 


An implementation of the Armv8.0 architecture must comply with all of the additional requirements. When 
combined with the mandatory architectural features that have been added to the Armv8.0 architecture, such an 
implementation is also called an implementation of the Armv8.0 architecture. 
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A2.3 


A2.3.1 


A2-66 


The Armv8 Cryptographic Extension 


The Armv8 Cryptographic Extension provides instructions for the acceleration of encryption and decryption, and 
includes the following features: 


° ARMv8.0-AES, which includes AESD and AESE instructions. 
° ARMv8.0-SHA, which includes the SHA1»+ and SHA256« instructions. 


The presence of the Cryptographic Extension in an implementation is subject to export license controls. The 
Cryptographic Extension is an extension of the SIMD support and operates on the vector register file. 


The Cryptographic Extension also provides multiply instructions that operate on long polynomials. 


The Cryptographic Extension provides this functionality in AArch64 state and AArch32 state, and an 
implementation that supports both AArch64 state and AArch32 state provides the same Cryptographic Extension 
functionality in both states. 


For more information, see The Cryptographic Extension on page C3-247 or The Cryptographic Extension in 
AArch32 state on page F1-3899. 


Armv8.2 extensions to the Cryptographic Extension 


From Armv8.2, an implementation of the Armv8.0 Cryptographic Extension can include either or both of: 


$ The AES functionality, including support for multiplication of 64-bit polynomials. The 
ID_AA64ISARO_EL1.AES field indicates whether this functionality is supported. 


The SHA1 and SHA2-256 functionality. The ID AA64ISARO_EL1.{SHA2, SHA1} fields indicate whether 
this functionality is supported. 


In addition, Armv8.2 adds two optional extensions to the Armv8 Cryptographic Extension, that provide 
cryptographic functionality in AArch64 state only. These two optional features are: 
ARMv8.2-SHA, SHA2-512 and SHA3 functionality 


In the A64 instruction set only, ARMv8.2-SHA adds Advanced SIMD instructions that support: 
° SHA2-512 (SHA512). 
° SHA3. 


Implementation of ARMv8.2-SHA requires implementation of the Armv8.0 Cryptographic 
Extension SHA-1 and SHA256 functionality. 


The ID_AA64ISARO EL1.{SHA2, SHA3} fields identify the presence of Armv8.2-SHA. 
For more information see Armv8.2-SHA, SHA2-512 and SHA3 on page C3-248. 


ARMv8.2-SM, SM3 and SM4 functionality 


In the A64 instruction set only, ARMv8.2-SM adds Advanced SIMD instructions that support the 
Chinese cryptography algorithms SM3 and SM4. 


Implementation of ARMv8.2-SM is independent of the implementation of any SHA functionality. 
The ID_AA64ISARO EL1.{SM3, SM4} fields identify the presence of ARMv8.2-SM. 


Note 


This means ARMv8.2-SM can be implemented without any other Cryptographic Extension 
features. 








For more information see Armv8.2-SM, SM3 and SM4 on page C3-249. 
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A2.4 The Armv8.1 architecture extension 


The Armv8.1 architecture extension adds both architectural features and architectural requirements, see: 
7 Architectural features added by Armv8.1. 
° Additional requirements of Armv8.1 on page A2-69. 


A2.4.1 Architectural features added by Armv8.1 


An implementation of the Armv8.1 extension must include all of the features that this section describes as 
mandatory. Such an implementation, when combined with the additional requirements of Armv8.1, is also called an 
implementation of the Armv8.1 architecture. 


The Armv8.1 architecture extension adds the following architectural features, which are identified by the 
architectural feature name and a short description of the feature: 
ARMv8.1-LSE, Armv8.1 Large System Extensions 

ARMv8.1-LSE introduces a set of atomic instructions: 

: Compare and Swap instructions, CAS and CASP. 


. Atomic memory operation instructions, LD<OP> and ST<0P>, where <0P> is one of ADD, CLR, EOR, 
SET, SMAX, SMIN, UMAX, and UMIN. 


: Swap instruction, SWP. 

These instructions are only added to the A64 instruction set. 

This feature is mandatory in Armv8.1 implementations. 

Implementations of ARMv8.1-VHE require the implementation of ARMv8.1-LSE. 
The ID_AA64ISARO EL1.Atomic field identifies the presence of ARMv8.1-LSE. 
For more information, see: 

s Compare and Swap on page C3-209. 


e Atomic memory operations on page C3-210. 
7 Swap on page C3-212. 


ARMv8.1-RDMA, Armv8.1 Advanced SIMD instructions 
ARMv8.1-RDMA introduces Rounding Double Multiply Add/Subtract Advanced SIMD 


instructions. For more information, see: 
For the A64 instruction set 
. SQRDMLAH (by element) on page C7-2009. 
° SQRDMLAH (vector) on page C7-2012. 
g SORDMLSH (by element) on page C7-2014. 
s SQRDMLSH (vector) on page C7-2017. 
For the T32 and A32 instruction sets 
° VORDMLAH on page F6-5247. 
š VORDMLSH on page F6-5251. 
This feature is mandatory in Armv8.1 implementations. 
The following fields identify the presence of Armv8.1-RDMA: 
° ID_AA64ISARO_EL1.RDM. 
° ID_ISAR5_EL1.RDM. 
° ID_ISARS.RDM. 


ARMv8.1-LOR, Limited ordering regions 


Limited ordering regions allow large systems to perform special load-acquire and store-release 
instructions that provide order between the memory accesses to a region of the PA map as observed 
by a limited set of observers. 


This feature is supported in AArch64 state only. 
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This feature is mandatory in Armv8.1 implementations. 
The ID AA64MMFRI1_EL1.LO field identifies the support for ARMv8.1-LOR. 
For more information, see: 


$ Limited ordering regions on page B2-131. 


ARMv8.1-HPD, Hierarchical permission disables 


ARMvVv8.1-HPD introduces the facility to disable the hierarchical attributes, APTable, PXNTable, 
and UXNTable, in the translation tables. This disable has no effect on the NSTable bit. 


This feature is mandatory in Armv8.1 implementations. 


This feature is added only to the VMSAv8-64 translation regimes. Armv8.2 extends this to the 
AArch32 translation regimes, see ARMv8.2-AA32HPD. 


The ID AA64MMFR1_EL1.HPDS field identifies the support for ARMv8.1-HPD. 


ARMv8.1-TTHM, Hardware management of the Access flag and dirty state 


In Armv8.0, all updates to the translation tables are performed by software. From Armv8.1, for the 
VMSAv8-64 translation regimes only, hardware can perform updates to the translation tables in two 


contexts: 
. Hardware management of the Access flag. 
. Hardware management of dirty state, with updates to a dirty state in the translation tables. 


The dirty state is introduced in Armv8.1. 


Hardware management of dirty state can only be enabled when hardware management of the Access 
flag is also enabled. 


This feature is optional in Armv8.1 implementations. It is IMPLEMENTATION DEFINED whether this 
is implemented. 


The ID AA64MMFR1_EL1.HAFDBS field identifies the support for ARMv8.1-TTHM. 
For more information, see: 

. The dirty state on page D5-2589. 

. Hardware management of the Access flag and dirty state on page D5-2590. 


ARMv8.1-PAN, Privileged access never 


ARMv8.1-PAN adds a bit to PSTATE. When the value of this PAN state bit is 1, any privileged data 
access from EL1, or EL2 when HCR_EL2.E2H is 1, to a virtual memory address that is accessible 
at ELO, generates a Permission fault. 


This feature is mandatory in Armv8.1 implementations. 
This feature is supported in AArch64 and AArch32 states. 


The following fields identify the support for ARMv8.1-PAN: 
° ID_AA64MMFR1_EL1.PAN. 

° ID_MMFR3_EL1.PAN. 

° ID_MMFR3.PAN. 

For more information, see: 

7 About PSTATE.PAN on page D5-2578. 

. About the PAN bit on page G5-5769. 


ARMv8.1-VMID16, 16-bit VMID 


Inan Armv8.1 implementation, when EL2 is using AArch64, the VMID size is an IMPLEMENTATION 
DEFINED choice of 8 bits or 16 bits. 


This feature is optional in Armv8.1 implementations. It is IMPLEMENTATION DEFINED whether this 
is implemented. 


When implemented, this feature is supported only when EL2 is using AArch64. 
The ID AA64MMFR1_EL1.VMIDBits field identifies the supported VMID size. 
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For more information, see: 


b VMID size on page D5-2634. 


ARMv8.1-VHE, Virtualization Host Extensions 


Armv8.1 introduces the Virtualization Host Extensions (VHE) that provide enhanced support for 
Type 2 hypervisors in Non-secure state. 


This feature is mandatory in Armv8.1 implementations. 
An implementation that includes ARMv8.1-VHE requires ARMv8.1-LSE to be implemented. 
The ID AA64MMFR1_EL1.VH field identifies the support for ARMv8.1-VHE. 


The following fields indicate the presence of the Virtualization Host Extensions for debug, 
including the changes for the PC Sample-based Profiling Extension and the Performance Monitors 
Extension: 


. ID_AA64DFRO_EL1.DebugVer. 
° ID_DFRO_EL1.{CopSDbg, CopDbg}. 
For more information, see: 


° Virtualization Host Extensions on page D5-2609. 


ARMv8.1-PMU, Armv8.1 PMU Extension 
Armv8.1 makes the following enhancements to the Performance Monitors Extension: 


. The event number space is extended to 16 bits to allow additional IMPLEMENTATION DEFINED 
event types, and the reserved space for future additions to the architecturally-defined event 
types is extended. 


- The HPMD bit is added to MDCR_EL2. This bit disables event counting at EL2. 


° The STALL_FRONTEND and STALL_BACKEND events are required to be implemented. 
For more information, see Required events on page D7-2720. 


The Performance Monitors Extension is an OPTIONAL feature, but if it is implemented, an Arm8.1 
implementation must include ARMv8.1-PMU. 

The following fields identify the ARMv8.1-PMU: 

. ID_AA64DFRO_EL1.PMUVer. 

. ID_DFRO_EL1.PerfMon. 

. ID_DFRO.PerfMon. 


A2.4.2 Additional requirements of Armv8.1 
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The Armv8.1 architecture includes some mandatory changes that are not associated with a feature. These are: 


Changes to CRC32 instructions 


All implementations of the Armv8.1 architecture are required to implement the CRC32. instructions. 
These are optional in Armv8.0. 

The following fields identify the support for the CRC32+ instructions: 

° ID_AA64ISARO_EL1.CRC32. 

° ID_ISAR5_EL1.CRC32. 

° ID_ISARS.CRC32. 


An implementation of the Armv8.1 extension must comply with all of the additional requirements. Such an 
implementation, when combined with the mandatory architectural features of Armv8.1, is also called an 
implementation of the Armv8.1 architecture. 
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A2.5 The Armv8.2 architecture extension 


The Armv8.2 architecture extension adds both architectural features and architectural requirements, see: 
s Architectural features added by Armv8.2. 

. Additional requirements of Armv8.2 on page A2-76. 

. Features added to the Armv8.2 extension in later releases on page A2-76. 


The Armv8.2 architecture extension also adds functionality to the Cryptographic Extension, see Armv8.2 extensions 
to the Cryptographic Extension on page A2-66. 


A2.5.1 Architectural features added by Armv8.2 


An implementation of the Armv8.2 extension must include all of the features that this section describes as 
mandatory. Such an implementation, when combined with the additional requirements of Armv8.2, is also called an 
implementation of the Armv8.2 architecture. 


The Armv8.2 architecture extension adds the following architectural features, which are identified by the 
architectural feature name and a short description of the feature: 
ARMv8.2-A64ISA, Armv8.2 changes to the A64 ISA 


ARMv8.2-A64ISA adds the BFC instruction to the A64 instruction set as an alias of BFM. It also 
requires that the BFC instruction and the A64 pseudo-instruction REV64 are implemented by 
assemblers. 

—— Note 

$ In Armv8.0 and Armv8.1, the A64 pseudo-instruction REV64 is optional. 


s Because this feature relates to support for an instruction alias and for a pseudo-instruction, 
there are no corresponding feature ID register fields. 





This change to the instruction set and assembler requirements is mandatory in an Armv8.2 
implementation. 

For more information, see: 

s BFC on page C6-800. 

$ REV64 on page C6-1155. 


ARMv8.2-ATS1E1, AT S1E1R and AT S1E1W instruction variants, taking account of PSTATE.PAN 


ARMvV8.2-ATS1E1 adds variants of the AArch64 AT S1E1R and AT S1E1W instructions and the 
AArch32 ATSICPR and ATS1CPW instructions. These instructions factor in the PSTATE.PAN bit when 
determining whether or not the location will generate a permission fault for a privileged access, as 
is reported in the PAR. For more information, see: 
For the AArch64 System instructions 

. AT SIEIRP, Address Translate Stage 1 EL1 Read PAN on page C5-533. 

. AT SIEIWP, Address Translate Stage 1 EL1 Write PAN on page C5-537. 


For the AArch32 System instructions 


. ATSICPRP, Address Translate Stage 1 Current state PLI Read PAN on 
page G8-5930. 


. ATSICPWP, Address Translate Stage 1 Current state PLI Write PAN on 
page G8-5932. 
This feature is mandatory in Armv8.2 implementations. 
These instructions are added to the A64 and A32/T32 instruction sets. 
The following fields identify the presence of ARMv8.2-ATS1E1: 
° ID_AA64MMEFR1 EL1.PAN. 
° ID_MMFR3_EL1.PAN. 
° ID_MMFR3.PAN. 
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For more information, see: 


° Address translation instructions on page D5-2561. 
. ATS1C**, Address translation stage 1, current security state on page G5-5842. 
° Encoding and availability of the address translation instructions on page G5-5843. 


ARMv8.2-FP16, Half-precision floating-point data processing 
ARMv8.2-FP16 supports: 


è Half-precision data-processing instructions for Advanced SIMD and floating-point in both 
AArch64 and AArch32 states. 


° The FPCR.FZ16 and FPSCR.FZ16 bits, that enable a Flush-to-zero mode for half-precision 
data-processing instructions. 


This feature is optional in Armv8.2 implementations, unless The Scalable Vector Extension (SVE) 
is implemented, in which case ARMv8.2-FP16 is mandatory. When this feature is implemented it 
is implemented in both Advanced SIMD and floating-point, and in AArch64 and AArch32 states. 
The following fields identify the presence of ARMv8.2-FP 16: 

. ID_AA64PFR0_EL1.{FP, AdvSIMD}. 

° MVFR1_EL1.{FPHP, SIMDHP}. 

e MVFR1.{FPHP, SIMDHP}. 

For more information, see: 

. Half-precision floating-point formats on page A1-45. 

: Flush-to-zero on page A1-54. 

s Modified immediate constants in A64 instructions on page C2-186. 


ARMv8.2-DotProd, SIMD Dot Product 


ARMv8.2-DotProd provides instructions to perform the dot product of two 32-bit vectors, 
accumulating the result in a third 32-bit vector. This can be performed using signed or unsigned 
arithmetic. 


This feature is optional in Armv8.2 implementations, and mandatory in Armv8.4 implementations. 
These instructions are added to the A64 and A32/T32 instruction sets. 

The following fields identify the presence of ARMv8.2-DotProd: 

° ID_AA64ISARO_EL1.DP. 

° ID_ISAR6_EL1.DP. 

° ID_ISAR6.DP. 

For more information, see: 

: SIMD dot product on page C3-246. 

. Advanced SIMD dot product instructions on page F1-3897. 


ARMv8.2-FHM, Floating-point multiplication variant 
ARMv8.2-FHM adds floating-point multiplication instructions. 
These instructions are added to the A64 and A32/T32 instruction sets. 


This feature is optional in Armv8.2 implementations, and can only be implemented when 
ARMv8.2-FP16 is implemented. This feature is mandatory in Armv8.4 implementations when 
ARMv8.2-FP16 is implemented. This feature is not implemented in Armv8.4 implementations 
when ARMv8.2-FP16 is not implemented. 

The following fields identify the presence of ARMv8.2-FHM: 

. ID_AA64ISARO_EL1.FHM. 

e ID_ISAR6_EL1.FHM. 

° ID_ISAR6.FHM. 


For more information, see: 
s SIMD arithmetic on page C3-234. 
s SIMD by element arithmetic on page C3-240. 
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. Advanced SIMD multiply instructions on page F1-3896. 


ARMv8.2-LSMAOC, Load/Store Multiple atomicity and ordering controls 


ARMv8.2-LSMAOC adds controls that disable legacy behavior of AArch32 Load Multiple and 
Store Multiple instructions, and provide a trap of one aspect of this legacy behavior. 


Implementation of ARMv8.2-LSMAOC is optional. When implemented it provides: 


° LSMAOE fields in the SCTLR_EL1, SCTLR_EL2, HSCTLR, and SCTLR registers. These 
fields can have the following effects on the behavior of AArch32 Load Multiple and Store 
Multiple instructions: 


— An interrupt can be taken between two memory accesses made by a single Load 
Multiple or Store Multiple instruction. 


— The memory accesses made by a single Load Multiple or Store Multiple instruction to 
Device memory with the non-Reordering attribute can be reordered. 


. nTLSMD fields in the SCTLR_EL1, SCTLR_EL2, HSCTLR, and SCTLR registers. These 
fields can cause an access to Device-nGRE, Device-nGnRE, or Device-nGnRnE memory by 
an AArch32 Load Multiple and Store Multiple instruction to generate an Alignment fault. 


— Note 


Armv8.2 deprecates software dependence on the legacy behavior of AArch32 Load Multiple and 
Store Multiple instructions, and these fields disable this behavior. 





The following fields identify the support for ARMv8.2-LSMAOC: 
. ID_AA64MMFR2_EL1.LSM 

° ID_MMFR4 EL1.LSM 

. ID_MMFR4.LSM. 

For more information, see the register field descriptions and: 


è Generation of Alignment faults by Load/store multiple accesses to Device memory on 
page E2-3835. 


$ Multi-register loads and stores that access Device memory on page E2-3848. 


. Taking an interrupt or other exception during a multiple-register load or store on 
page G1-5535. 


ARMv8.2-UAO, PSTATE override of Unprivileged Load/Store 


Armv8.2 adds a bit to PSTATE. When the value of PSTATE.UAO is 1, and when executed at EL1 
or at EL2 with HCR_EL2.{E2H, TGE} == {1, 1}, the memory accesses made by the Load/Store 
unprivileged instructions behave as if they were made by the Load/Store register instructions. See 
Load/Store unprivileged on page C3-201 and Load/Store register on page C3-197. 


This feature is mandatory in Armv8.2 implementations. 

This feature is supported in AArch64 state only. 

The ID AA64MMFR2_ EL1.UAO field identifies the support for ARMv8.2-UAO. 
For more information, see About PSTATE.UAO on page D5-2579. 


ARMv8.2-DCPoP, Data cache clean to Point of Persistence 


ARMv8.2-DCPoP introduces a mechanism to identify and manage persistent memory locations in 
a shared memory hierarchy, including adding the DC CVAP instruction. 


This feature is mandatory in Armv8.2 implementations. 

This feature is supported in AArch64 state only. 

The ID_AA64ISARI_EL1.DPB field identifies the support for ARMv8.2-DCPoP. 

For more information about ARMv8.2-DCPoP, see Memory hierarchy on page B2-133. 
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ARMv8.2-VPIPT, VMID-aware PIPT instruction cache 
ARMv8.2-VPIPT supports a instruction cache type, described as the VMID-aware PIPT (VPIPT) 


instruction cache. 


— Note 


Armv8.2 adds VPIPT to the set of supported cache types, meaning an Armv8.2 implementation is 
permitted to implement VPIPT caches, but is not required to do so. 





This feature is supported in AArch64 and AArch32 states. 

The CTR_ELO.L1Ip and CTR.L1Ip fields identify the support for ARMv8.2-VPIPT. 
For more information, see: 

. VPIPT (VMID-aware PIPT) instruction caches on page D5-2656. 

. VPIPT (VMID-aware PIPT ) instruction caches on page G5-5808. 


ARMxv8.2-AA32HPD, AArch32 Hierarchical permission disables 


ARMv8.1-HPD introduced the ability to disable the hierarchical attributes, APTable, PXNTable, 
and UXNTable, in the VMSAv8-64 translation regimes. ARMv8.2-AA32HPD extends this 
functionality to the VMSAv8-32 translation regimes when those regimes are using the Long 
descriptor translation table format. 


This feature is optional in Armv8.2 implementations. It is IMPLEMENTATION DEFINED whether this 
is implemented. 


The ID MMFR4_ EL1.HPDS and ID MMFR4.HPDS fields identify the support for 
ARMv8.2-AA32HPD. 


For more information, see Attribute fields in VUSAv8-32 Long-descriptor translation table format 
descriptors on page G5-5750. 


ARMv8.2-TTPBHA, Translation table page-based hardware attributes 


Armv8.2 provides a mechanism to allow operating systems or hypervisors to make up to four bits 
of translation table final-level descriptors available for IMPLEMENTATION DEFINED hardware use. 


This functionality is available for all translation regimes in AArch64 state and for stages of 
translation in AArch32 state that use the Long descriptor translation table format. 


ARMv8.2-TTPBHA is optional in Armv8.2 implementations, but implementation of 
ARMv8.2-TTPBHA requires implementation of both: 
° ARMvVv8.1-HPD. 


è ARMv8.2-AA32HPD, if any Exception level higher than ELO can use AArch32. 
Note 


For stage 1 translations, page-based hardware attributes can only be used for a stage of translation 
for which the Hierarchical permission disables field has a value of 1. 








The following fields identify the support for ARMv8.2-TTPBHA: 
° ID_AA64MMFR1_EL1.HPDS 

. ID_MMFR4 EL1.HPDS 

. ID_MMFR4.HPDS. 


For more information, see: 


. Memory attribute fields in the VMSAv8-64 translation table format descriptors on 
page D5-2570. 


3 Attribute fields in VMSAv8-32 Long-descriptor translation table format descriptors on 
page GS-5750. 
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ARMv8.2-LPA, Large PA and IPA support 


ARMV8.2-LPA: 


s Allows a larger intermediate physical address (IPA) and PA space of up to 52 bits when using 
the 64KB translation granule. 


° Allows a level 1 block size where the block covers a 4TB address range for the 64KB 
translation granule if the implementation support 52 bits of PA. 


This is an optional feature in Armv8.2 implementations. It is IMPLEMENTATION DEFINED whether it 
is implemented. 


This feature is supported in AArch64 state only. 

The ID AA64MMFRO_EL1.PARange field identifies the support for ARMv8.2-LPA. 
For more information about ARMv8.2-LPA, see: 

. VMSA address types and address spaces on page D5-2505. 

. Address size configuration on page D5-2519. 

. Extending addressing above 48 bits on page D5-2524. 


. VMSAv8-64 translation table level 0, level 1, and level 2 descriptor formats on 
page DS-2565. 


. Armyv8 translation table level 3 descriptor formats on page D5-2568. 


ARMv8.2-LVA, Large VA support 


ARMv8.2-LVA supports a larger VA space for each translation table base register of up to 52 bits 
when using the 64KB translation granule. 


This feature is supported in AArch64 state only. 


This is an optional feature in Armv8.2 implementations. It is IMPLEMENTATION DEFINED whether it 
is implemented. 


If ARMv8.2-LVA is implemented, then any implemented trace macrocell must be at least ETMv4.2. 
The ID AA64MMFR2_ EL1.VARange field identifies the support for ARMv8.2-LVA. 

For more information about ARMv8.2-LVA, see: 

. VMSA address types and address spaces on page D5-2505. 

. Address size configuration on page D5-2519. 

è Extending addressing above 48 bits on page D5-2524. 


: VMSAVv8-64 translation table level 0, level 1, and level 2 descriptor formats on 
page D5-2565. 


. Armyv8 translation table level 3 descriptor formats on page D5-2568. 


ARMv8.2-TTCNP, Translation table Common not private translations 


A2-74 


ARMv8.2-TTCNP permits multiple PEs in the same Inner Shareable domain to use the same 
translation tables for a given stage of address translation. 


This feature is mandatory in Armv8.2 implementations. 


This facility is available for all VMSAv8-64 translation regimes and for VMSAv8-32 translation 
stages that use the Long descriptor translation table format. 

The following fields identify the support for ARMv8.2-TTCNP: 

° ID_AA64MMFR2_EL1.CnP. 

° ID_MMFR4 EL1.CnP. 

° ID_MMFR4.CnP. 

For more information, see: 

7 Common not private translations on page D5-2633. 


e Common not private translations in VMSAv8-32 on page G5-5797. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


Armvs-A Architecture Extensions 
A2.5 The Armv8.2 architecture extension 


ARMvVv8.2-TTS2UXN, Translation table stage 2 Unprivileged Execute-never 


ARMvV8.2-TTS2UXN extends the stage 2 translation table access permissions to provide control of 
whether memory is executable at ELO independent of whether it is executable at EL1. 


This feature is mandatory in Armv8.2 implementations. 
This facility is available for stage 2 translation stages in VMSAv8-64 and VMSAv8-32. 


The following fields identify the support for ARMv8.2-TTS2UXN: 
° ID_AA64MMFR1_EL1.XNX. 

. ID_MMFR4 EL1.XNX. 

. ID_MMFR4.XNX. 


For more information, see: 
5 Access permissions for instruction execution on page D5-2583. 


. Access permissions for instruction execution on page G5-5770. 
ARMv8.2-Debug, Armv8.2 Debug 


ARMv8.2-Debug covers a selection of mandatory changes, including: 


° If the Core power domain is powered up and DoubleLockStatus() == TRUE, 
EDPRSR.{DLK,SPD,PU} is only permitted to read {UNKNOWN, 0, 0}. 


° The definition of Exception Catch debug events is extended to include reset entry. 

. All CONSTRAINED UNPREDICTABLE cases that generate Exception Catch debug events are 
removed. 

è Controls are added to EDECCR to control Exception Catch debug event generation on 
exception return. 

. All IMPLEMENTATION DEFINED control of external debug accesses to OSLAR_EL1 is 
removed. 

. ExternalSecureNoninvasiveDebugEnabled() cannot override software controls of counting 


attributable events in Secure state. 
If ARMv8.2-Debug is implemented, ARMv8.0-DoubleLock is OPTIONAL. 


The fields that identify the support for ARMv8.2-Debug are: 

. ID_AA64DFRO_EL1.DebugVer and DBGDIDR. Version. 

° ID_DFRO_EL1.{CopSDbg, CopDbg} and ID_DFRO.{CopSDbg, CopDbg}. 
° EDDEVARCH.ARCHID. 

For more information, see: 

. Exception Catch debug events from Armv8.2 on page H3-6759. 

. EDPRSR.{DLK, SPD, PU} and the Core power domain on page H6-6813. 

. Interaction with EL3 on page D7-2679. 

. External access disabled on page H8-6835. 


ARMv8.2-PCSample, PC Sample-based Profiling 


In Armv8.2, the control and implementation of the OPTIONAL PC Sample-based Profiling extension 
is moved from ED*SR Debug registers to PM*SR registers in the Performance Monitors address 
space. See Chapter H7 The PC Sample-based Profiling Extension. 


This is an optional feature in Armv8.2 implementations. It is IMPLEMENTATION DEFINED whether it 
is implemented. 

The following fields identify the support for ARMv8.2-PCSample: 

. EDDEVID.PCSample. 

. DBGDEVID.PCSample. 

° EDDEVID1.PCSROffset. 

° DBGDEVID1.PCSROffset. 

° PMDEVID.PCSample. 
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ARMv8.2-IESB, Implicit error synchronization event 


ARMv8.2-IESB adds an implicit error synchronization event at exception entry and return, 
controlled by the added SCTLR_ELx.IESB fields. An IESB field is added to the ESR_ELx 
syndrome registers. 


The implicit error synchronization events affect the same synchronizable asynchronous events that 
are synchronized by the ESB instruction, see The Reliability, Availability, and Serviceability 
Extension (RAS Extension) on page A2-90. 


This feature is optional in Armv8.2 implementations. 
This feature is supported in AArch64 state only. 
The ID AA64MMFR2_ EL1.JESB field identifies the support for ARMv8.2-IESB. 


For more information, see the ARM” Reliability, Availability, and Serviceability (RAS) 
Specification, ARMV68, for the ARMv8-A architecture profile. 


Extensions to the Arm Cryptographic Extensions 


See the description of the ARMv8.2-SHA and ARMv8.2-SM features in Armv8.2 extensions to the 
Cryptographic Extension on page A2-66. 


A2.5.2 Additional requirements of Armv8.2 
The Armv8.2 architecture includes some mandatory changes that are not associated with a feature. These are: 


Changes to ACTLR2 and HCTLR2 registers 
In AArch32 state, the ACTLR2 and HACTLR2 registers become mandatory. 


Implementation of RAS Extension 


The RAS Extension must be implemented, see The Reliability, Availability, and Serviceability 
Extension (RAS Extension) on page A2-90. 


An implementation of the Armv8.2 extension must comply with all of the additional requirements. Such an 
implementation, when combined with the mandatory architectural features of Armv8.2, is also called an 
implementation of the Armv8.2 architecture. 


If PMUv3 is implemented, the feature ARMv8.4-PMU is optional in Armv8.2 implementations. 


A2.5.3 Features added to the Armv8.2 extension in later releases 


ARMv8.2-EVT, Armv8.2 Enhanced Virtualization Traps 


ARMv8.2-EVT introduces additional traps for EL1 and ELO Cache controls. These traps are 
independent of existing controls. 


This feature is supported in AArch64 and AArch32 states. 

This feature is optional in Armv8.2 implementations and is mandatory in Armv8.5. 
ID_AA64MMFR2_ EL1.EVT identifies the support for the AArch64 traps controls. 
ID_MMFR4 EL1.EVT and ID MMFR4.EVT identify support for the AArch32 traps. 
For more information, see: 

° HCR_EL2.{TTLBIS, TTLBOS, TICAB, TOCU, TID4}. 

° HCR2.{TTLBIS, TICAB, TOCU, TID4}. 


ARMv8.2-DCCVADP, Armv8.2 Cache clean to Point of Deep Persistence 
ARMv8.2-DCCVADP allows two levels of cache clean to the Point of Persistence by: 
. Redefining Point of Persistence, which changes the scope of DC CVAP. 
* Defining a Point of Deep Persistence. 
° Adding the DC CVADP System instruction. 
This feature is supported in AArch64 state only. 
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This feature is optional in Armv8.2 implementations, and is mandatory in Armv8.5 
implementations. 


The ID_ AA64ISARI _EL1.DPB identifies the support for ARMv8.2-DCCVADP. 


For further information, see Terminology for Clean, Invalidate, and Clean and Invalidate 
instructions on page D4-2479. 
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A2.6 The Armv8.3 architecture extension 


The Armv8.3 architecture extension adds both architectural features and additional requirements, see: 
$ Architectural features added by Armv8.3. 
° Additional requirements of Armv8.3 on page A2-80. 


° Features added to the Armv8.3 extension in later releases on page A2-80. 


A2.6.1 Architectural features added by Armv8.3 


An implementation of the Armv8.3 extension must include all of the features that this section describes as 
mandatory. Such an implementation is also called an implementation of the Armv8.3 architecture. 


The Armv8.3 architecture extension adds the following architectural features, which are identified by the 
architectural feature name and a short description of the feature: 


ARMv8.3-CompNum, SIMD complex number support 


ARMv8.3-CompNum introduces instructions for floating-point multiplication and addition of 
complex numbers. 


These instructions are added to the A64 and A32/T32 instruction sets. 
This feature is mandatory in Armv8.3 implementations. 


The half-precision versions of these instructions are implemented only if ARMv8.2-FP 16 is 
implemented. Otherwise they are UNDEFINED. 


The fields that identify the presence of ARMv8.3-CompNum are: 

e ID_AA64ISAR1_EL1.FCMA. 

° ID_ISAR5_EL1.VCMA. 

° ID_ISARS.VCMA. 

For more information, see: 

s SIMD complex number arithmetic on page C3-246. 

s Advanced SIMD complex number arithmetic instructions on page F1-3897. 


ARMv8.3-JSConv, Javascript conversion instructions 


ARMv8.3-JSConv introduces instructions that perform a conversion from a double-precision 
floating point value to a signed 32-bit integer, with rounding to zero. For more information, see: 


For the A64 instruction set 
s FICVTZS on page C7-1584. 
For the A32/T32 instruction set 
. VICVT on page F6-5015. 
These instructions are added to the A64 and A32/T32 instruction sets. 
The feature is mandatory in Armv8.3 implementations. 


The fields that identify the presence of ARMv8.3-JSConv are: 

° ID_AA64ISAR1_EL1.JSCVT 

° ID_ISAR6_EL1.JSCVT 

° ID_ISAR6.JSCVT. 

For more information, see: 

° Floating-point conversion on page C3-229. 

. About the A64 SIMD and floating-point instructions on page C7-1372. 
° Advanced SIMD and floating-point instructions on page E1-3794. 

° Floating-point data-processing instructions on page F1-3901. 


ARMv8.3-RCPC, Weaker release consistency 
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ARMv8.3-RCPC introduces three instructions to support the weaker Release Consistency processor 
consistent (RCpc) model that enables the reordering of a Store-Release followed by a Load-Acquire 
to a different address: 


$ LDAPR on page C6-920. 

° LDAPRB on page C6-922. 

. LDAPRH on page C6-924. 

These instructions are added to the A64 instruction set. 

The feature is mandatory in Armv8.3 implementations. 

The ID AA64ISARI_EL1.LRCPC field identifies the presence of ARMv8.3-RCPC. 
For more information, see: 

. Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. 

à Load-Acquire/Store-Release on page C3-202. 


ARMv8.3-NV, Nested Virtualization 


ARMvVv8.3-NV provides support for a Guest Hypervisor to run in Non-secure EL1 and ensures that 
the Guest Hypervisor is unaware that it is running at that Exception level. A Guest Hypervisor is 
supported regardless of the value of HCR_EL2.E2H. 


This feature is supported in AArch64 state only. 


The feature is optional in Armv8.3 implementations. This feature must be implemented if 
ARMv8.4-NV is implemented. 


The ID AA64MMFR2_ EL1.NV field identifies the support for ARMv8.3-NV. 


For more information, see Nested virtualization on page D5-2615. 


ARMv8.3-CCIDX, Cache extended number of sets 


ARMv8.3-CCIDX introduces the following registers to allow caches to be described with greater 
numbers of sets and greater associativity: 

s A 64-bit format of CCSIDR_EL1. 

+ CCSIDR2 ELI. 

$ CCSIDR2. 


This feature is supported in AArch64 and AArch32 states. 
This feature is optional in Armv8.3 implementations. 


The following fields identify the support for ARMv8.3-CCIDX: 

. ID_AA64MMFR2_EL1.CCIDX 

. ID_MMFR4 EL1.CCIDX. 

° ID_MMFR4.CCIDX. 

For more information, see: 

° Possible formats of the Cache Size Identification Register, CCSIDR_EL1 on page D4-2473. 
. Possible formats of the Cache Size Identification Registers, CCSIDR and CCSIDR2 on 


page G4-5689. 
ARMv8.3-PAuth, Pointer Authentication 


ARMv8.3-PAuth adds functionality that supports address authentication of the contents ofa register 
before that register is used as the target of an indirect branch, or as a load. 


This feature is supported only in AArch64 state. 
This feature is mandatory in Armv8.3 implementations. 


The fields ID AA64ISARI_EL1.{GPI, GPA, API, APA} identify the presence for 
ARMv8.3-PAuth. 


For more information, see Pointer authentication in AArch64 state on page DS-2508. 
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A2.6.2 


A2.6.3 


A2-80 


Additional requirements of Armv8.3 


If PMUv3 is implemented, the feature ARMv8.4-PMU is optional in Armv8.3 implementations. 


Features added to the Armv8.3 extension in later releases 


ARMv8.3-SPE, Armv8.3 Statistical Profiling Extensions 


The ARMv8.3-SPE adds an Alignment Flag in the Events packet and filtering on this event using 
PMSEVFR _ ELI, together with support for the profiling of Scalable Vector Extension operations. 


This feature is only supported in AArch64. 


This feature is optional in Armv8.3 implementations. When ARMv8.3-SPE is implemented the 
Statistical Profiling Extension must be implemented. 


The fields in ID AA64DFRO_EL1.PMSVer identify the support for ARMv8.3-SPE. 


For more information see Chapter D9 The Statistical Profiling Extension and Chapter D10 
Statistical Profiling Extension Sample Record Specification. 


ARMv8.3-DoPD, Armv8.3 Debug over Powerdown 


The ARMv8.3-DoPD provides a debug programmers’ model where all debug and PMU registers 
are in the Core power domain, all CTI registers are in the Debug power domain. Power control is 
provided by a CoreSight Granular Power requestor (GPR) component. 


When the OPTIONAL powerup mechanism is implemented and this feature is implemented, the 
debugger makes power control requests for the Core power domain using a CoreSight Class 0x9 
ROM Table block, instead of using EDRCR.COREPURQ. EDRCR.COREPURQ is not 
implemented. Refer to the ARM” CoreSight Architecture Specification for more information. 


This feature is optional in Armv8.3 implementations. 

When ARMv8.3-DoPD is implemented: 

° ARMv8.0-DoubleLock is not implemented. 

° ARMv8.2-Debug must be implemented. 

- If an ETMv4 PE Trace Unit is implemented, the ETM must implement: 
—  ETMv4.5 or later. 
— The Unified Power Domain Model. 

The fields that identify the presence of ARMv8.3-DoPD are: 

. EDDEVID.DebugPower. 

° CTIDEVARCH.REVISION. 


For more information see Chapter H6 Debug Reset and Powerdown Support. 
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A2.7 The Armv8.4 architecture extension 


The Armv8.4 architecture extension adds architectural features, see Architectural features added by Armv8.4. It also 
adds features to earlier architecture extensions, see Features added to earlier extensions on page A2-85. 


A2.7.1 Architectural features added by Armv8.4 


An implementation of the Armv8.4 extension must include all of the features that this section describes as 
mandatory. Such an implementation is also called an implementation of the Armv8.4 architecture. 


The Armv8.4 architecture extension adds the following architectural features, which are identified by the 
architectural feature name and a short description of the feature: 
ARMvVv8.4-DIT, Data Independent Timing instructions 


ARMv8.4-DIT provides independent timing for data processing instructions with the addition of the 
PSTATE.DIT and CPSR.DIT fields. 


This feature is supported in AArch64 and AArch32 states. 
This feature is mandatory in Armv8.4 implementations. 


The following fields identify the support for ARMv8.4-DIT: 
° ID_AA64PFR0_EL1.DIT. 

° ID_PFRO_EL1.DIT. 

° ID_PFRO.DIT. 

For more information, see: 

$ About PSTATE.DIT on page B1-105. 

. About the DIT bit on page E1-3793. 


ARMv8.4-CondM, Condition flag Manipulation 
ARMv8.4-CondM provides instructions which manipulate the PSTATE. {N,Z,C,V} flags. 
These instructions are added to the A64 instruction set only. 
This feature is mandatory in Armv8.4 implementations. 
The ID AA64ISARO ELL.TS field identifies the presence of ARMv8.4-CondM. 


For more information, see Flag manipulation instructions on page C3-221. 


ARMv8.4-RCPC, Armv8.4 enhancements to weaker release consistency 


ARMv8.4-RCPC provides versions of the LDAPR and STLR with a 9-bit unscaled signed 
immediate offset. 


These instructions are added to the A64 instruction set only. 

This feature is mandatory in Armv8.4 implementations. 

The ID AA64ISARI_EL1.LRCPC field identifies the presence of ARMv8.4-RCPC. 
For more information, see: 

a Changes to single-copy atomicity in Armv8.4 on page B2-111. 

. Non-exclusive Load-Acquire and Store-Release instructions on page C3-203. 


. A64 instructions that are changed in Debug state on page H2-6715. 


ARMv8.4-LSE, Large System Extensions 


ARMv8.4-LSE introduces changes to single-copy atomicity requirements for loads and stores, and 
changes to alignment requirements for loads and stores. 


This feature is supported in AArch64 state only. 

This feature is mandatory in Armv8.4 implementations. 

The ID AA64MMFR2_ EL1.AT field identifies the support for ARMv8.4-LSE. 
For more information, see: 


s Requirements for single-copy atomicity on page B2-110. 
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. Alignment of data accesses on page B2-138. 


ARMv8.4-TLBI, TLB maintenance and TLB range instructions 


ARMv8.4-TLBI provides TLBI maintenance instructions that extend to the Outer Shareable domain 
and TLBI invalidation instructions that apply to a range of input addresses. 


This feature is supported in AArch64 state only. 

This feature is mandatory in Armv8.4 implementations. 

The field ID AA64ISARO EL1.TLB identifies the presence of ARMv8.4-TLBI. 
For more information, see: 

° TLB maintenance instruction syntax on page D5-2641. 


° TLB range maintenance instructions on page D5-2649. 


ARMvxv8.4-TTL, Translation Table Level 


ARMv8.4-TTL provides the TTL field to indicate the level of translation table walk holding the leaf 
entry for the address that is being invalidated. This field is provided in all TLB maintenance 
instructions that take a VA or an IPA argument. 


This feature is supported in AArch64 state only. 
This feature is mandatory in Armv8.4 implementations. 
The field ID AA64MMFR2_ EL1.TTL identifies the presence of ARMv8.4-TTL. 


For more information, see: 
° TLB maintenance instruction syntax on page D5-2641. 
° TLB range maintenance instructions on page D5-2649. 


ARMv8.4-S2F WB, Stage 2 forced Write-Back 


ARMv8.4-S2FWB reduces the requirement of additional cache maintenance instructions in systems 
where the data Cacheability attributes used by the Guest operating system are different from those 
expected by the Hypervisor. 


This feature is supported in AArch64 state. 

This feature is mandatory in Armv8.4 implementations. 

The ID AA64MMFR2_EL1.FWB field identifies the support for ARMv8.4-S2FWB. 

For more information, see: 

° Memory region attributes on page D5-2599. 

° The stage 2 memory region attributes, ELI &0 translation regime on page D5-2601. 
ARMv8.4-TTST, Small Translation tables 


ARMv8.4-TTST relaxes the lower limit on the size of translation tables, by increasing the maximum 
permitted value of the T1SZ and TOSZ fields in TCR_EL1, TCR_EL2, TCR_EL3, VTCR_EL2 and 
VSTCR_EL2. 


This feature is supported in AArch64 state only. 

This feature is mandatory in Armv8.4 implementations or if ARMv8.4-SecEL2 is implemented. 
This feature is optional if ARMv8.4-SecEL2 is not implemented. 

The ID AA64MMFR2 EL1.ST field identifies the support for ARMv8.4-TTST. 

For more information, see: 

° Input address size on page D5-2521. 

š Overview of the VMSAv8-64 address translation stages on page D5-2536. 


ARMv8.4-TTRem, Change in size of translation table mappings 


ARMv8.4-TTRem provides support to identify the requirements of hardware to have 
break-before-make sequences when changing between block size for a translation. 


This feature is supported in AArch64 state only. 


This feature is mandatory in Armv8.4 implementations. 
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The ID AA64MMFR2_ EL1.BBM field identifies the support for ARMv8.4-TTRem. 
For more information, see: 


. Memory attribute fields in the VMSAv8-64 translation table format descriptors on 
page D5-2570. 


. Support levels for changing block size on page D5-2640. 


ARMV8.4-SecEL2, Secure EL2 


ARMv8.4-SecEL2 permits EL2 to be implemented in Secure state, When Secure EL2 is enabled, a 
translation regime is introduced that follows the same format as the other Secure translation 
regimes. 


This feature is not supported if EL2 is using AArch32. 


This feature is mandatory in Armv8.4 implementations which implement both EL2 and Secure 
state. 


The ID AA64PFRO_EL1.SEL2 field identifies the support for ARMv8.4-SecEL2. 
For more information, see: 

. Virtualization on page D1-2274. 

- The VMSAv8-64 address translation system on page D5-2512. 


ARMv8.4-NV, Enhanced support for Nested Virtualization 


Armv8.4 supports nested virtualization by redirecting register accesses that would be trapped to 
EL! and EL2 to access memory instead. The address of the memory access depends on information 
held in introduced register, VNCR_EL2. 


This feature is supported in AArch64 state only. 
This feature is optional in Armv8.4 implementations. 
The ID AA64MMFR2_ EL1.NV field identifies the support for ARMv8.4-NV. 


For more information, see Enhanced support for nested virtualization on page D5-2617. 


ARMv8.4-IDST, ID Space Trap handling 


ARMvVv8.4-IDST causes all AArch64 read accesses to the feature ID register space when exceptions 
are generated, to be reported in ESR_ELx using the EC code 0x18. 


This feature is supported in AArch64 state only. 
This feature is mandatory in Armv8.4 implementations. 


The ID AA64MMFR2_ EL1.IDS field identifies the support for ARMv8.4-IDST. 


ARMv8.4-CNTSC, Generic Counter Scaling 


ARMv8.4-CNTSC adds a scaling register to the memory-mapped counter module that allows the 
frequency of the counter that is generated to be scaled from the basic frequency reported in the 
counter ID mechanisms. 


This feature is supported in AArch64 and AArch32 states. 

This feature is optional in Armv8.4 implementations. 

The CNTID.CNTSC field identifies the support for ARMv8.4-CNTSC. 
For more information, see: 


s CNTCR, Counter Control Register on page 15-7154. 


ARMv8.4-Debug, Armv8.4 Debug relaxations and extensions 


ARMv8.4-Debug covers a selection of mandatory changes, including: 


° The fields MDCR_EL3.{EPMAD, EDAD} control Non-secure access to the debug and 
PMU registers. The bus master is responsible for other debug authentication. 


. The feature ARMv8.0-DoubleLock has been introduced. See Features added to earlier 
extensions on page A2-85. 


. The Software Lock is obsolete. 
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° Non-invasive Debug controls are relaxed. 

° Secure and Non-secure views of the debug registers are enabled. 

The fields that identify the support for ARMv8.4-Debug are: 

. ID_AA64DFRO_EL1.DebugVer 

. DBGDIDR. Version 

° ID_DFRO_EL1.{CopSDbg, CopDbg} 

° ID_DFRO. {CopSDbg, CopDbg} 

. EDDEVARCH.ARCHID 

For more information, see: 

. Definition and constraints of a debugger in the context of external debug on page H1-6700 
. External debug interface register access permissions on page H8-6835 


ARMV8.4-Trace, Armv8.4 Self-hosted Trace Extensions 
ARMvVv8.4-Trace adds controls of trace in a self-hosted system through System registers. 


The feature provides: 


g Control of Exception levels and Security states where trace generation is prohibited. 
s Control of whether an offset is used for the timestamp recorded with trace information. 
e A context synchronization instruction TSB CSYNC which can be used to prevent reordering of 


trace operation accesses with respect to other accesses of the same System registers. 


Ifan ETM Architecture PE Trace Unit is implemented, this feature is mandatory, and the ETM PE 
Trace Unit must implement System register access to its control registers. If a different PE Trace 
Unit is implemented, this feature is optional. 


The reset state of the PE has prohibited regions controlled by the feature and not the external 
authentication signals. An external trace controller must override the internal controls before 
enabling trace, including trace from reset. This is a change from previous trace architectures and is 
not backwards-compatible. 

The fields that identify the support for ARMv8.4-Trace are: 

. ID_AA64DFRO_EL1.TraceFilt, 

° ID_DFRO_EL1.TraceFilt 

š ID_DFRO.TraceFilt 

EDDFR.TraceVer 

° ID_AA64DFRO_EL1.TraceVer 


For more information, see: 
è Chapter D3 AArch64 Self-hosted Trace. 
a Chapter G3 AArch32 Self-hosted Trace. 


ARMv8.4-PMU, Armv8.4 PMU Extensions 
ARMv8.4-PMU introduces the PMMIR_ ELI and PMMIR registers. 
This feature is supported in AArch64 and AArch32 states. 


The Performance Monitors Extension is an optional feature, but if it is implemented, an Armv8.4 
implementation must include ARMv8.4-PMU. 

The fields that identify the support for ARMv8.4-PMU are: 

° ID_AA64DFRO_EL1.PMUVer. 

. ID_DFRO_EL1.Perfmon. 

. ID_DFRO.Perfmon. 

° EDDFR.PMUVer, 


For more information, see PMU events and event numbers on page D7-2689. 
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ARMV8.4-RAS, Armv8.4 RAS Extension 


ARMv8.4-RAS implements RAS System Architecture v1.1 and adds support for: 
° ARMv8.4-DFE. 

$ Simplifications to ERR<n>STATUS. 

s Additional ERR<n>MISC<m> registers. 

è The optional RAS Common Fault Injection Model Extension. 

This feature is supported in AArch64 and AArch32 states. 

This feature is mandatory in Armv8.4 implementations. 

The following fields identify the support or partial support for ARMv8.4-RAS: 
° ID_AA64PFR0_EL1.RAS. 

. ID_AA64PFR1_EL1.RAS_frac. 

. ID_PFRO_EL1.RAS. 

° ID_PFR2_EL1.RAS_frac. 

° ID_PFRO.RAS. 

° ID_PFR2.RAS frac. 


For more information, see: 
. The Reliability, Availability, and Serviceability Extension (RAS Extension) on page A2-90. 


° ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMv8, for the 
ARMVv8-A architecture profile. 


ARMv8.4-DFE, Armv8.4 Double Fault Extension 


ARMvV8.4-DFE provides two controls: 

. SCR_EL3.EASE. 

s SCR_EL3.NMEA. 

This feature is supported in AArch64 state only. 


This feature is mandatory in Armv8.4 implementations if EL3 is implemented and EL3 uses 
AArch64. Otherwise, it is not implemented. 


This feature is implemented if ID AA64PFRO_EL1.RAS >= 0b0010 and the implementation 
includes EL3 using AArch64. 

For more information, see: 

. The Reliability, Availability, and Serviceability Extension (RAS Extension) on page A2-90. 


° ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMVv8, for the 
ARMV8-A architecture profile. 


A2.7.2 Features added to earlier extensions 
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The existing functionality of OS Double Lock is added as a feature mnemonic in Armv8.0, see 
ARMv8.0-DoubleLock on page A2-64. 
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A2.8 The Armv8s.5 architecture extension 


The Armv8.5 architecture extension adds architectural features and additional requirements, see: 
s Architectural features added by Armv8.5. 
. Additional requirements of Armv8.5 on page A2-88. 


Features are also added to earlier architecture extensions, see Features added to earlier extensions on page A2-89. 


A2.8.1 Architectural features added by Armv8.5 


An implementation of the Armv8.5 extension must include all of the features that this section describes as 
mandatory. Such an implementation is also called an implementation of the Armv8.5 architecture. 


The Armv8.5 architecture extension adds the following architectural features, which are identified by the 
architectural feature name and a short description of the feature: 
ARMv8.5-CondM, Armv8.5 Condition flag manipulation 


ARMv8.5-CondM provides instructions that convert between the PSTATE condition flag format 
used by the FCMP instruction and an alternative format described in Relationship between ARM 
format and alternative format PSTATE condition flags on page C6-752. 


These instructions are added to the A64 instruction set only. 
This feature is mandatory in Armv8.5 implementations. 
The ID AA64ISARO ELL.TS field identifies the presence of ARMv8.5-CondM. 
For more information, see: 
. Flag manipulation instructions on page C3-221. 
° Relationship between ARM format and alternative format PSTATE condition flags on 
page C6-752. 
ARMv8.5-FRINT, Armv8.5 Floating-point to integer 


ARMv8.5-FRINT provides instructions that round a floating-point number to an integral valued 
floating point number that fits in a 32-bit or 64-bit integer number range. 


These instructions are added to the A64 instruction set only. 


This feature requires SIMD&FP, and is mandatory in Armv8.5 implementations when SIMD&FP 
is implemented. 


The ID_AA64ISARI_EL1.FRINTTS identifies the presence of ARMVv8.5-FRINT. 


For more information see Floating-point round to integral value on page C3-230. 


ARMv8.5-CSEH, Armv8.5 Context synchronization and exception handling 


ARMv8.5-CSEH provides a mechanism to control whether exception entry and exception return are 
context synchronization events. Fields in the SCTLR_ELx registers enable and disable context 
synchronization at exception entry and return at an Exception level. 


This feature is supported in AArch64 state only. 

This feature is optional in Armv8.5 implementations. 

The ID AA64MMFRO_EL1.ExS identifies the presence of ARMv8.5-CSEH. 
For more information see: 


è SCTLR_EL1, System Control Register (EL1) on page D13-3258, SCTLR_EL2 and 
SCTLR EL3. 


, Context synchronization event on page Glossary-7884 


ARMv8.5-GTG, Armv8.5 Guest translation granule size 


ARMv8.5-GTG allows a hypervisor to support different granule sizes for Stage 2 and Stage 1 
translation. and allows a nested hypervisor to determine what stage 2 granule sizes are available. 


This feature is supported in AArch64 state only. 
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This feature is mandatory in Armv8.5 implementations. 


The ID AA64MMFRO EL1.{TGran16_2, TGran64_2, TGran4_2} fields identify whether each of 
the granule sizes is supported for Stage 2 translation. The ID AA64MMFRO_EL1.{TGran16, 
TGran64, TGran4} fields identify whether each of the granule sizes is supported for Stage 1 
translations. 


For more information, see Memory translation granule size on page DS-2526. 


ARMv8.5-BTI, Armv8.5 Branch target identification 


ARMv8.5-BTI allows memory pages to be guarded against the execution of instructions that are not 
the intended target of a branch, To do this, it introduces: 


° The GP field, which denotes the blocks and pages in stage 1 translation tables that are 
guarded pages, 


° The PSTATE.BTYPE field, which is used to determine whether an access to a guarded 
memory region will generate a Branch Target exception. 


- The BTI instruction, which is used to guard against the execution of instructions that are not 
the intended target of a branch. 


This feature is supported in AArch64 state only. 

This feature is mandatory in Armv8.5 implementations. 

The ID AA64PFR1_EL1.BT field identifies the presence of ARMv8.5-BTI. 
For more information, see: 

s Exception entry on page D1-2293. 

° Synchronous exception types, routing and priorities on page D1-2307. 


. VMSAv8-64 translation table level 0, level 1, and level 2 descriptor formats on 
page D5-2565. 


. About PSTATE.BTYPE on page D5-2579. 
: Effect of entering Debug state on PSTATE on page H2-6713. 


ARMv8.5-E0PD, Armv8.5 Preventing ELO access to halves of address maps 
ARMv8.5-E0PD prevents access at ELO to half of the addresses in the memory map. 


This feature is supported in AArch64 state only. When EL1 is using AArch64 state, this feature 
affects access to ELO, in either execution state. 


This feature is mandatory in Armv8.5 implementations. 
The ID AA64MMFR2_ EL1.E0PD field identifies support for ARMv8.5-EOPD. 


For more information see: 

$ Preventing ELO access to halves of the address map on page D5-2581. 
° TCR_EL1.{E0PD0, EOPD1}. 

° TCR_EL2.{E0PD0, EOPD1}. 


ARMv8.5-RNG, Armv8.5 Random number generator 


ARMv8.5-RNG introduces the RNDR and RNDRRS registers. Reads to these registers return a 
64-bit random number. A read to RNDRRS will cause a reseeding of the random number before the 
generation of the random number that is returned. 


This feature is supported in AArch64 state only. 
This feature is optional in Armv8.5 implementations. 
The ID AA64ISARO EL1.RNDR field identifies support for ARMv8.5-RNG. 


For more information see: 
. Effect of random number generation instructions on Condition flags on page C6-752. 
- Appendix K12 Random Number Generation. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. A2-87 
ID070919 Non-Confidential 


Armvs-A Architecture Extensions 
A2.8 The Armv8.5 architecture extension 


A2.8.2 


A2-88 


ARMv8.5-MemTag, Armv8.5 Memory Tagging Extension 


ARMv8.5-MemtTag provides architectural support for run-time, always-on detection of various 
classes of memory error to aid with software debugging to eliminate vulnerabilities arising from 
memory-unsafe languages. 


This feature is supported in AArch64 state only. 

This feature is optional in Armv8.5 implementations. 

The field that identifies the support for ARMv8.5-MemTag is ID AA64PFR1_EL1.MTE. 
For more information, see: 

$ Chapter D6 Armv8.5 Memory Tagging Extension. 

à Chapter B2 The AArch64 Application Level Memory Model. 

. PMU events and event numbers on page D7-2689. 

. Chapter D9 The Statistical Profiling Extension. 

$ Chapter H2 Debug State. 


ARMvxv8.5-PMU, Armv8.5 PMU Extensions 


ARMv8.5-PMU extends event counters to 64-bit event counters, and adds mechanisms to disable 
the cycle counter in Secure state and in EL2. 


ARMv8.5-PMU relaxes the behavior of PMCR. {IMP, IDCODE}, and deprecates use of these 
fields. 


This feature is supported in AArch64 and AArch32 states. 


The Performance Monitors Extension is an optional feature, but if it is implemented, an Armv8.5 
implementation must include ARMv8.5-PMU. 

The fields that identify the support for ARMv8.5-PMU are: 
° ID_AA64DFRO_EL1.PMUVer. 

. ID_DFRO_EL1.Perfmon. 

° ID_DFRO.Perfmon. 

. EDDFR.PMU Ver, 

For more information, see: 

. Behavior on overflow on page D7-2675 

. Prohibiting event counting on page D7-2679. 

. PMU events and event numbers on page D7-2689. 


Additional requirements of Armv8.5 


The Armv8.5 architecture includes some mandatory changes that are not associated with a feature. These are: 


Restrictions on effects of speculation 


Further restrictions are placed on execution for: 


° Execution prediction instructions that predict addresses or register values 
è Data loaded under speculation with a permission or domain fault. 
- Any System register read under speculation to a register that is not architecturally accessible 


from the current Exception level. 
For more information, see: 
ë Restrictions on the effects of speculation on page B2-123. 


. Restrictions on the effects of speculation on page E2-3821. 


Changes to CTIDEVARCH, CTIDEVAFF0, and CTIDEVAFF1 
CTIDEVARCH, CTIDEVAFFO, and CTIDEVAFF1 must be implemented. 


Changes to the input channel gate function 
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If the Cross-Trigger Matrix (CTM) is implemented, the input channel gate function must be 
implemented. 


Deprecation of EDPRCR.CWRR 


EDPRCR.CWRR is deprecated. 


Mandatory changes are also made to earlier architectural extensions, see Architectural requirements added to 
earlier extensions. 


A2.8.3 Features added to earlier extensions 


The features that have been added to earlier architectural extensions are: 


ARMv8.0-SB on page A2-63. 
ARMvVv8.0-SSBS on page A2-63. 
ARMvé8.0-CSV2 on page A2-63. 
ARMV8.0-CSV3 on page A2-64. 
ARMv8.0-PredInv on page A2-64. 
ARMV8.0-CP15SDISABLE?2 on page A2-64. 
ARMvV8.2-EVT on page A2-76. 
ARMVv8.2-DCCVADP on page A2-76. 
ARMvV8.3-SPE on page A2-80. 
ARMvV8.3-DoPD on page A2-80. 


A2.8.4 Architectural requirements added to earlier extensions 
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The additional architectural requirement that has been added to earlier extensions is Prefetch speculation protection 
on page A2-65. 
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A2.9 


A2-90 


The Reliability, Availability, and Serviceability Extension (RAS Extension) 


The RAS Extension is a mandatory extension to the Armv8.2 architecture, and an optional extension to the Armv8.0 
and the Armv8.1 architectures. 


The RAS Extension improves the dependability of a system by providing: 


è Reliability, that is, the continuity of correct service. 
. Availability, that is, the readiness for correct service. 
$ Serviceability, that is, the ability to undergo modifications and repairs. 


ID_AA64PFRO_EL1.RAS in AArch64 state, and ID_PFRO.RAS in AArch32 state, indicate whether the RAS 
Extension is implemented. 


The RAS Extension introduces a barrier instruction, the Error Synchronization Barrier (ESB), to the A32, T32, and 
A64 instruction sets. 


System registers introduced by the RAS Extension are described in: 
7 For AArch6é4, RAS registers on page D13-3647. 
. For AArch32, RAS registers on page G8-6579. 


In addition, the RAS Extension introduces a number of memory-mapped registers. These are described in the ARM” 
Reliability, Availability, and Serviceability (RAS) Specification, ARMv6, for the ARMv8-A architecture profile. 


Armv8.2 introduces the following architectural features to the RAS Extension: 
° ARMv8.2-IESB. 


Armv8.4 introduces the following architectural features to the RAS Extension: 
° ARMv8.4-RAS. 
e ARMv8.4-DFE. 
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A2.10 The Statistical Profiling Extension (SPE) 
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The Statistical Profiling Extension is an optional extension introduced by the Armv8.2 architecture. Implementation 
of the Statistical Profiling Extension requires implementation of at least Armv8.1 of the Armv8-A architecture 
profile. The Statistical Profiling Extension is only supported in AArch64 state. 


The Statistical Profiling Extension provides a non-invasive method of sampling software and hardware using 
randomized sampling of either architectural instructions, as defined by the instruction set architecture, or by 
microarchitectural operations. 


ID_AA64DFRO_EL1.PMSVer indicates whether the Statistical Profiling Extension is implemented. 


For more information see Chapter D9 The Statistical Profiling Extension. 
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A2-92 


The Scalable Vector Extension (SVE) 


The Scalable Vector Extension is an optional extension introduced by the Armv8.2 architecture. SVE is supported 
in AArch64 state only. 


The Scalable Vector Extension provides vector instructions that, primarily, support wider vectors than the Arm 
Advanced SIMD instruction set. The ARM” Architecture Reference Manual Supplement, The Scalable Vector 
Extension (SVE), for ARMv8-A describes the SVE. 


ID_AA64PFRO_EL1.SVE indicates whether the Scalable Vector Extension is implemented. 


The Scalable Vector Extension affects some AArch64 System registers, and those register changes are included in 
this issue of this Manual, where they are identified as SVE features. SVE also introduces AArch64 System registers, 
however these do not appear in this manual. For more information about the System registers introduced by SVE, 
please see the ARM” Architecture Reference Manual Supplement, The Scalable Vector Extension (SVE), for 
ARMvs-A. 


The Scalable Vector Extension introduces the following System registers: 
. ID_AA64ZFRO ELI. 

$ ZCR_EL1, and an EL2 alias of this register, ZCR_EL12. 

° ZCR_EL2. 

° ZCR_EL3. 


The Scalable Vector Extension modifies the following existing System registers: 
° CPACR_EL1. 

. CPTR_EL2. 

° CPTR EL3. 


+ ESR _ELx. 
e ID_AA64PFRO_EL1I. 
+ TCR ELI. 


«e TCR_EL2. 
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The Activity Monitors Extension is an optional extension introduced by the Armv8.4 architecture. AMU is 
supported in AArch64 and AArch32 states. 


The Activity Monitors Extension implements version 1 of the Activity Monitors architecture, AMUv1, which 
provides a function similar to a subset of the existing Performance Monitors Extension functionality, intended for 
system management use rather than debugging and profiling. 


The Activity Monitors Extension implements a System register interface to the Activity Monitors registers, and also 
supports an optional external memory-mapped interface. 


The fields that identify the presence of the Activity Monitors Extension are: 
° ID_AA64PFR0 _EL1.AMU. 

. ID_PFRO_EL1.AMU. 

° ID_PFR0.AMU. 

° EDPFR.AMU. 


For more information, see Chapter D8 The Activity Monitors Extension. 
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A2-94 


The Memory Partitioning and Monitoring (MPAM) Extension 


The Memory Partitioning and Monitoring Extension is an optional extension introduced by the Armv8.4 
architecture and requires implementation of at least Armv8.2 of the Armv8-A architecture profile. MPAM is 
supported in AArch64 state only. 


The MPAM Extension provides a framework for memory-system component controls that partition one or more of 
the performance resources of the component. 


The fields that identify the presence of the MPAM Extension are: 
° ID_AA64PFR0_EL1.MPAM. 
. EDPFR.MPAM. 


For more information, see ARM" Architecture Reference Manual Supplement, Memory System Resource 
Partitioning and Monitoring (MPAM), for ARMv8-A. 
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Part B 


The AArch64 Application Level Architecture 


Chapter B1 
The AArch64 Application Level Programmers’ Model 


About the Application level programmers’ model on page B1-98. 
Registers in AArch64 Execution state on page B1-99. 
Software control features and ELO on page B1-104. 
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B1-98 


About the Application level programmers’ model 


This chapter contains the programmers’ model information required for application development. 


The information in this chapter is distinct from the system information required to service and support application 
execution under an operating system, or higher level of system software. However, some knowledge of the system 
information is needed to put the Application level programmers' model into context. 


Depending on the implementation choices, the architecture supports multiple levels of execution privilege, 
indicated by different Exception levels that number upwards from ELO to EL3. ELO corresponds to the lowest 
privilege level and is often described as unprivileged. The Application level programmers’ model is the 
programmers’ model for software executing at ELO. For more information see Exception levels on page D1-2268. 


System software determines the Exception level, and therefore the level of privilege, at which software runs. When 
an operating system supports execution at both EL1 and ELO, an application usually runs unprivileged at ELO. This: 


° Permits the operating system to allocate system resources to an application in a unique or shared manner. 


° Provides a degree of protection from other processes, and so helps protect the operating system from 
malfunctioning software. 


This chapter indicates where some system level understanding is necessary, and where relevant it gives a reference 
to the system level description. 


Execution at any Exception level above ELO is often referred to as privileged execution. 


For more information on the system level view of the architecture refer to Chapter D1 The AArch64 System Level 
Programmers’ Model. 
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B1.2 Registers in AArch64 Execution state 


This section describes the registers and process state visible at ELO when executing in the AArch64 state. It includes 
the following: 


3 Registers in AArch64 state 
7 Process state, PSTATE on page B1-100 
a System registers on page B1-102 


B1.2.1 Registers in AArch64 state 
In the AArch64 application level view, an Arm processing element has: 


RO-R30 31 general-purpose registers, RO to R30. Each register can be accessed as: 
. A 64-bit general-purpose register named XO to X30. 
$ A 32-bit general-purpose register named WO to W30. 


See the register name mapping in Figure B1-1. 


63 32:31 0 
<4 Wn > 





+ A S f aOAv>qxxum > 


Figure B1-1 General-purpose register naming 
The X30 general-purpose register is used as the procedure call link register. 


Note 


In instruction encodings, the value @b11111 (31) is used to indicate the ZR (zero register). This 
indicates that the argument takes the value zero, but does not indicate that the ZR is implemented 
as a physical register. 








SP A 64-bit dedicated Stack Pointer register. The least significant 32 bits of the stack-pointer can be 
accessed via the register name WSP. 


The use of SP as an operand in an instruction, indicates the use of the current stack pointer. 





Note 


Stack pointer alignment to a 16-byte boundary is configurable at EL1. For more information see the 
Procedure Call Standard for the Arm 64-bit Architecture. 





PC A 64-bit Program Counter holding the address of the current instruction. 


Software cannot write directly to the PC. It can only be updated on a branch, exception entry or 
exception return. 


Note 


Attempting to execute an A64 instruction that is not word-aligned generates a PC alignment fault, 
see PC alignment checking on page D1-2287. 








V0-V31 32 SIMD&FP registers, VO to V31. Each register can be accessed as: 
° A 128-bit register named QO to Q31. 
` A 64-bit register named DO to D31. 
s A 32-bit register named SO to $31. 
- A 16-bit register named HO to H31. 
. An 8-bit register named BO to B31. 
$ A 128-bit vector of elements. 
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. A 64-bit vector of elements. 


Where the number of bits described by a register name does not occupy an entire SIMD&FP 
register, it refers to the least significant bits. See Figure B1-2. 








127 64 63 32 31 1615 8 7 0 
+Bn> 
+ Hn——> 
< Sn > 
< Dn > 
<4 Qn > 





Figure B1-2 SIMD and floating-point register naming 


For more information about data types and vector formats, see Supported data types on page Al-41. 
FPCR, FPSR Two SIMD and floating-point control and status registers, FPCR and FPSR. 


See Registers for instruction processing and exception handling on page D1-2277 for more information on the 
registers. 


Pseudocode description of registers in AArch64 state 


In the pseudocode functions that access registers: 
è The assignment form is used for register writes. 
$ The non-assignment for register reads. 


The uses of the X[] function are: 
: Reading or writing X0-X30, using n to index the required register. 
. Reading the zero register ZR, accessed as X[31]. 


Note 


The pseudocode use of X[31] to represent the zero register does not indicate that hardware must implement this 
register. 








The AArch64 SP[] function is used to read or write the current SP. 
The AArch64 PC[] function is used to read the PC. 


The AArch64 V[] function is used to read or write the Advanced SIMD and floating-point registers V0-V31, using 
a parameter n to index the required register. 


The AArch64 Vpart[] function is used to read or write a part of one of V0-V31, using a parameter n to index the 
required register, and a parameter part to indicate the required part of the register, see the function description for 
more information. 


The SP[], PCL], V[], and Vpart[] functions are defined in Chapter J1 Armv8 Pseudocode. 


B1.2.2 Process state, PSTATE 


Process state or PSTATE is an abstraction of process state information. All of the instruction sets provide 
instructions that operate on elements of PSTATE. 
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The following PSTATE information is accessible at ELO: 


The Condition flags 


Flag-setting instructions set these. They are: 


N 


Negative Condition flag. If the result of the instruction is regarded as a two's 
complement signed integer, the PE sets this to: 


â 1 if the result is negative. 
od 0 if the result is positive or zero. 


Zero Condition flag. Set to: 
° 1 if the result of the instruction is zero. 
° 0 otherwise. 


A result of zero often indicates an equal result from a comparison. 
Carry Condition flag. Set to: 


° 1 if the instruction results in a carry condition, for example an unsigned overflow 
that is the result of an addition. 


° 0 otherwise. 
Overflow Condition flag. Set to: 


° 1 if the instruction results in an overflow condition, for example a signed 
overflow that is the result of an addition. 


. 0 otherwise. 


Conditional instructions test the N, Z, C and V Condition flags, combining them with the Condition 
code for the instruction to determine whether the instruction must be executed. In this way, 
execution of the instruction is conditional on the result of a previous operation. For more 
information about conditional execution, see Condition flags and related instructions on 

page C6-751. 


The exception masking bits 


D 


A 
I 
F 


Debug exception mask bit. When ELO is enabled to modify the mask bits, this bit is 
visible and can be modified. However, this bit is architecturally ignored at ELO. 


SError interrupt mask bit. 
IRQ interrupt mask bit. 
FIQ interrupt mask bit. 


For each bit, the values are: 


0 
1 


Exception not masked. 
Exception masked. 


Access at ELO using AArch64 state depends on SCTLR_EL1.UMA. See Traps to ELI of ELO 
accesses to the PSTATE. {D, A, I, F} interrupt masks on page D1-2330. 


See Process state, PSTATE on page D1-2284 for the system level view of PSTATE. 
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B1.2.3 


B1-102 


Accessing PSTATE fields at ELO 


At ELO using AArch64 state, PSTATE fields can be accessed using Special-purpose registers that can be directly 
read using the MRS instruction and directly written using the MSR (register) instructions. Table B1-1 shows the 
Special-purpose registers that access the PSTATE fields that hold AArch64 state when the PE is at ELO using 
AArché4. All other PSTATE fields do not have direct read and write access at ELO. 


Table B1-1 Accessing PSTATE fields at ELO using MRS and MSR (register) 





Special-purpose register PSTATE fields 





NZCV N,Z,C,V 





DAIF D, A, I, F 





Software can also use the MSR (immediate) instruction to directly write to PSTATE. {D, A, I, F}. Table B1-2 shows 
the MSR (immediate) operands that can directly write to PSTATE. {D, A, I, F} when the PE is at ELO using AArch64 
state. 


Table B1-2 Accessing PSTATE.{D, A, I, F} at ELO using MSR (immediate) 





Operand PSTATE fields Notes 





DAIFSet D, A, I, F Directly sets any of the PSTATE. {D,A, I, F} bits to 1 





DAIFCIr D, A, I, F Directly clears any of the PSTATE. {D, A, I, F} bits to 0 





However, access to the PSTATE. {D, A, I, F} fields at ELO using AArch64 state depends on SCTLR_EL1.UMA. 
Traps to ELI of ELO accesses to the PSTATE. {D, A, I, F} interrupt masks on page D1-2330. 


Writes to the PSTATE fields have side-effects on various aspects of the PE operation. All of these side-effects, are 
guaranteed: 


. Not to be visible to earlier instructions in the execution stream. 


. To be visible to later instructions in the execution stream. 


System registers 


System registers provide support for execution control, status and general system configuration. The majority of the 
System registers are not accessible at ELO. 


However, some System registers can be configured to allow access from software executing at ELO. Any access 
from ELO to a System register with the access right disabled causes the instruction to behave as UNDEFINED. The 
registers that can be accessed from ELO are: 


Cache ID registers The CTR_ELO and DCZID_ELO registers provide implementation parameters for ELO 
cache management support. 


Debug registers A debug communications channel is supported by the MDCCSR_EL0, DBGDTR_ELO, 
DBGDTRRX_ELO and DBGDTRTX_ELO registers. 
Performance Monitors registers 


The Performance Monitors Extension provides counters and configuration registers. 
Software executing at EL1 ora higher Exception level can configure some of these registers 
to be accessible at ELO. 


For more details, see Chapter D7 The Performance Monitors Extension. 


Activity Monitors registers 


The Activity Monitors Extension provides counters and configuration registers. Software 
executing at EL1 or a higher Exception level can configure these registers to be accessible 
at ELO. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch64 Application Level Programmers’ Model 
B1.2 Registers in AArch64 Execution state 


For more details, see Chapter D8 The Activity Monitors Extension. 


Thread ID registers The TPIDR_ELO and TPIDRRO ELO registers are two thread ID registers with different 
access rights. 

Timer registers In Armv8 the following operations are performed: 
° Read access to the system counter clock frequency using CNTFRQ ELO. 
. Physical and virtual timer count registers, CNTPCT_ELO and CNTVCT_ELO. 


° Physical up-count comparison, down-count value and timer control registers, 
CNTP_CVAL_EL0, CNTP_TVAL_ ELO, and CNTP_CTL_ELO. 


a Virtual up-count comparison, down-count value and timer control registers, 
CNTV_CVAL_EL0, CNTV_TVAL ELO, and CNTV_CTL_ELO. 
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B1.3 


B1.3.1 


B1.3.2 


B1.3.3 


B1-104 


Software control features and ELO 


The following sections describe the ELO view of the Armv8 software control features: 
. Exception handling 

. Wait for Interrupt and Wait for Event 

° The YIELD instruction 

° Application level cache management on page B1-105 

. Instructions relating to Debug on page B1-105 


Exception handling 


In the Arm architecture, an exception causes a change of program flow. Execution of an exception handler starts, at 
an Exception level higher than ELO, from a defined vector that relates to the exception taken. 


Exceptions include: 


s Interrupts. 

s Memory system aborts. 

° Exceptions generated by attempting to execute an instruction that is UNDEFINED. 
: System calls. 

s Secure monitor or Hypervisor traps. 

. Debug exceptions. 


Most details of exception handling are not visible to application level software, and are described in Chapter D1 The 
AArch64 System Level Programmers’ Model. 


The SVC instruction causes a Supervisor Call exception. This provides a mechanism for unprivileged software to 
make a system call to an operating system. 


The BRK instruction generates a Breakpoint Instruction exception. This provides a mechanism for debugging 
software using debugger executing on the same PE, see Breakpoint Instruction exceptions on page D2-2411. 





Note 


The BRK instruction is supported only in the A64 instruction set. The equivalent instruction in the T32 and A32 
instruction sets is BKPT. 





Wait for Interrupt and Wait for Event 


Issuing a WFI instruction indicates that no further execution is required until a WFI wake-up event occurs, see Wait 
For Interrupt on page D1-2375. This permits entry to a low-power state. 


Issuing a WFE instruction indicates that no further execution is required until a WFE wake-up event occurs, see Wait 
for Event mechanism and Send event on page D1-2372. This permits entry to a low-power state. 


The YIELD instruction 


The YIELD instruction provides a hint that the task performed by a thread is of low importance so that it could yield, 
see YIELD on page C6-1370. This mechanism can be used to improve overall performance in a Symmetric 
Multithreading (SMT) or Symmetric Multiprocessing (SMP) system. 


Examples of when the YIELD instruction might be used include a thread that is sitting in a spin-lock, or where the 
arbitration priority of the snoop bit in an SMP system is modified. The YIELD instruction permits binary 
compatibility between SMT and SMP systems. 


The YIELD instruction is a NOP hint instruction. 


The YIELD instruction has no effect in a single-threaded system, but developers of such systems can use the 
instruction to flag its intended use for future migration to a multiprocessor or multithreading system. Operating 
systems can use YIELD in places where a yield hint is wanted, knowing that it will be treated as a NOP if there is no 
implementation benefit. 
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B1.3.4 Application level cache management 


A small number of cache management instructions can be enabled at ELO from higher levels of privilege using the 
SCTLR_EL1 System register. Any access from ELO to an operation with the access right disabled causes the 
instruction to behave as UNDEFINED. 


About the available operations, see Application level access to functionality related to caches on page B2-134. 


B1.3.5 Instructions relating to Debug 


Exception handling on page B1-104 refers to the BRK instruction, which generates a Breakpoint Instruction 
exception. In addition, in both AArch64 state and AArch32 state, the HLT instruction causes the PE to halt execution 
and enter Debug state. This provides a mechanism for debugging software using a debugger that is external to the 
PE, see Chapter H1 About External Debug. 





Note 


In AArch32 state, previous versions of the architecture defined the DBG instruction, that could provide a hint to the 
debug system. In Armv8, this instruction executes as a NOP. Arm deprecates the use of the DBG instruction. 


B1.3.6 About PSTATE.DIT 
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When the value of PSTATE.DIT is 1: 


° The instructions listed in DIT are required to have; 


— Timing which is independent of the values of the data supplied in any of its registers, and the values 
of the NZCV flags. 


— Responses to asynchronous exceptions which do not vary based on the values supplied in any of their 
registers, or the values of the NZCV flags. 





° All loads and stores must have their timing insensitive to the value of the data being loaded or stored. 
Note 
° Arm recommends that the ARMv8.3-PAuth instructions do not have their timing dependent on the key value 


used in the pointer authentication, regardless of the PSTATE.DIT bit. 


è When the value of PSTATE.DIT is 0, the architecture makes no statement about the timing properties of any 
instructions. However, it is likely that these instructions have timing that is invariant of the data in many 
situations. 





A corresponding DIT bit is added to PSTATE in AArch64 state, and to CPSR in AArch32 state. 
On an exception that is taken from AArch64 state to AArch64 state, PSTATE.DIT is copied to SPSR_ELx.DIT. 
On an exception that is taken from AArch32 state to AArch64 state, CPSR.DIT is copied to SPSR_ELx.DIT. 


On an exception return from AArch64 state: 
s SPSR_ELx.DIT is copied to PSTATE.DIT, when the target Exception level is in AArch64 state. 
a SPSR_ELx.DIT is copied to CPSR.DIT, when the target Exception level is in AArch32 state. 


PSTATE.DIT can be written and read at all exception levels. 
Note 


$ PSTATE.DIT is unchanged on entry into Debug state. 
: PSTATE.DIT is not guaranteed to have any effect in Debug state. 








Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. B1-105 
Non-Confidential 


The AArch64 Application Level Programmers’ Model 
B1.3 Software control features and ELO 


B1-106 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Chapter B2 
The AArch64 Application Level Memory Model 


This chapter gives an application level view of the memory model. It contains the following sections: 
` About the Arm memory model on page B2-108. 

. Atomicity in the Arm architecture on page B2-110. 

. Definition of the Armv8 memory model on page B2-115. 

. Caches and memory hierarchy on page B2-133. 

e Alignment support on page B2-138. 

$ Endian support on page B2-140. 

. Memory types and attributes on page B2-143. 

. Mismatched memory attributes on page B2-153. 


a Synchronization and semaphores on page B2-156. 





Note 


In this chapter, System register names usually link to the description of the register in Chapter D13 AArch64 
System Register Descriptions, for example SCTLR_EL1. 
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B2.1 About the Arm memory model 


The Arm architecture is a weakly ordered memory architecture that permits the observation and completion of 
memory accesses in a different order from the program order. The following sections of this chapter provide the 
complete definition of the Armv8 memory model, this introduction is not intended to contradict the definition found 
in those sections. In general, the basic principles of the Armv8 memory model are: 


° To provide a memory model that has similar weaknesses to those found in the memory models used by 
high-level programming languages such as C or Java. For example, by permitting independent memory 
accesses to be reordered as seen by other observers. 


s To avoid the requirement for multi-copy atomicity in the majority of memory types. 


- The provision of instructions and memory barriers to compensate for the lack of multi-copy atomicity in the 
cases where it would be needed. 


° The use of address, data, and control dependencies in the creation of order so as to avoid having excessive 
numbers of barriers or other explicit instructions in common situations where some order is required by the 
programmer or the compiler. 


` If ARMv8.5-MemTag is implemented and enabled the definitions of the memory model which apply to data 
accesses and data apply to Allocation Tag accesses and Allocation tags, unless otherwise specified in 
Chapter D6 Armv8.5 Memory Tagging Extension. 


This section contains: 
. Address space. 


° Memory type overview. 


B2.1.1 Address space 


Address calculations are performed using 64-bit registers. However, supervisory software can configure the top 
eight address bits for use as a tag, as described in Address tagging in AArch64 state on page D5-2506. If this is done, 
address bits[63:56]: 


à Are not considered when determining whether the address is valid. 
° Are never propagated to the program counter. 


Supervisory software determines the valid address range. Attempting to access an address that is not valid generates 
an MMU fault. 


Simple sequential execution of instructions might overflow the valid address range. For more information, see 
Virtual address space overflow on page D4-2469. 


Memory accesses use the Mem[] function. This function makes an access of the required type. If supervisory software 
configures the top eight address bits for use as a tag, the top eight address bits are ignored. 


The AccType{} enumeration defines the different access types. 


Note 
à Chapter D4 The AArch64 System Level Memory Model and Chapter DS The AArch64 Virtual Memory System 
Architecture include descriptions of memory system features that are transparent to the application, including 
memory access, address translation, memory maintenance instructions, and alignment checking and the 
associated fault handling. These chapters also include pseudocode descriptions of these operations. 





, For information on the pseudocode that relates to memory accesses, see Basic memory access on 
page D4-2499, Unaligned memory access on page D4-2500, and Aligned memory access on page D4-2500. 





B2.1.2 Memory type overview 
Armv8 provides the following mutually-exclusive memory types: 


Normal This is generally used for bulk memory operations, both read/write and read-only operations. 
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Device The Arm architecture forbids Speculative reads of any type of Device memory. This means Device 
memory types are suitable attributes for read-sensitive Locations. 


Locations of the memory map that are assigned to peripherals are usually assigned the Device 
memory attribute. 


Device memory has additional attributes that have the following effects: 


$ They prevent aggregation of reads and writes, maintaining the number and size of the 
specified memory accesses. See Gathering on page B2-149. 


° They preserve the access order and synchronization requirements for accesses to a single 
peripheral. See Reordering on page B2-150 


à They indicate whether a write can be acknowledged other than at the end point. See Early 
Write Acknowledgement on page B2-151. 


For more information on Normal memory and Device memory, see Memory types and attributes on page B2-143. 


Note 


Farlier versions of the Arm architecture defined a single Device memory type and a Strongly-ordered memory type. 
A Note in Device memory on page B2-147 describes how these memory types map onto the Armv8 memory types. 
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B2.2 


B2.2.1 


B2-110 


Atomicity in the Arm architecture 


Atomicity is a feature of memory accesses, described as atomic accesses. The Arm architecture description refers to 
two types of atomicity, single-copy atomicity and multi-copy atomicity. In the Armv8 architecture, the atomicity 
requirements for memory accesses depend on the memory type, and whether the access is explicit or implicit. For 
more information, see: 


Requirements for single-copy atomicity. 

Properties of single-copy atomic accesses on page B2-112. 
Multi-copy atomicity on page B2-112. 

Requirements for multi-copy atomicity on page B2-112. 


Concurrent modification and execution of instructions on page B2-112. 


For more information about the memory types, see Memory type overview on page B2-108. 


Requirements for single-copy atomicity 


For explicit memory accesses generated from an Exception level the following rules apply: 


A read that is generated by a load instruction that loads a single general-purpose register and is aligned to the 
size of the read in the instruction is single-copy atomic. 


A write that is generated by a store instruction that stores a single general-purpose register and is aligned to 
the size of the write in the instruction is single-copy atomic. 


Reads that are generated by a Load Pair instruction that loads two general-purpose registers and are aligned 
to the size of the load to each register are treated as two single-copy atomic reads, one for each register being 
loaded. 


Writes that are generated by a Store pair instruction that stores two general-purpose registers and are aligned 
to the size of the store of each register are treated as two single-copy atomic writes, one for each register being 
stored. 


Load-Exclusive Pair instructions of two 32-bit quantities and Store-Exclusive Pair instructions of 32-bit 
quantities are single-copy atomic. 


When the Store-Exclusive of a Load-Exclusive/Store-Exclusive pair instruction using two 64-bit quantities 
succeeds, it causes a single-copy atomic update of the entire memory location being updated. 


Note 


To atomically load two 64-bit quantities, perform a Load-Exclusive pair/Store-Exclusive pair sequence of 
reading and writing the same value for which the Store-Exclusive pair succeeds, and use the read values from 
the Load-Exclusive pair. 








Where translation table walks generate a read of a translation table entry, this read is single-copy atomic. 


For the atomicity of instruction fetches, see Concurrent modification and execution of instructions on 
page B2-112. 


Reads to SIMD and floating-point registers of a single 64-bit or smaller quantity that is aligned to the size of 
the quantity being loaded are treated as single-copy atomic reads. 


Writes from SIMD and floating-point registers of a single 64-bit or smaller quantity that is aligned to the size 
of the quantity being stored are treated as single-copy atomic writes. 


Element or Structure Reads to SIMD and floating-point registers of 64-bit or smaller elements, where each 
element is aligned to the size of the element being loaded, have each element treated as a single-copy atomic 
read. 


Element or Structure Writes from SIMD and floating-point registers of 64-bit or smaller elements, where 
each element is aligned to the size of the element being stored, have each element treated as a single-copy 
atomic store. 
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è Reads to SIMD and floating-point registers of a 128-bit value that is 64-bit aligned in memory are treated as 
a pair of single-copy atomic 64-bit reads. 


7 Writes from SIMD and floating-point registers of a 128-bit value that is 64-bit aligned in memory are treated 
as a pair of single-copy atomic 64-bit writes. 


è For unaligned memory accesses, the single-copy atomicity is described in Alignment of data accesses on 
page B2-138. 
. The reads and writes of the two words or two double-words accessed by CASP instructions are single-copy 


atomic at the size of the two words or double-words. 


All other memory accesses are regarded as streams of accesses to bytes, and no atomicity between accesses to 
different bytes is ensured by the architecture. 


All accesses to any byte are single-copy atomic. 


Note 


In AArch64 state, no memory accesses from a DC ZVA have single-copy atomicity of any quantity greater than 
individual bytes. 








If, according to these rules, an instruction is executed as a sequence of accesses, exceptions, including interrupts, 
can be taken during that sequence, regardless of the memory type being accessed. If any of these exceptions are 
returned from using their preferred return address, the instruction that generated the sequence of accesses is 
re-executed, and so any access performed before the exception was taken is repeated. See also Taking an interrupt 
or other exception during a multiple-register load or store on page D1-2325. 


Note 


The exception behavior for these multiple access instructions means that they are not suitable for use for writes to 
memory for the purpose of software synchronization. 





Changes to single-copy atomicity in Armv8.4 


Instructions that are introduced in ARMv8.4-RCPC are single-copy atomic when the following conditions are true: 
è All bytes being accessed are within the same 16-byte quantity aligned to 16 bytes. 
$ Accesses are to Inner Write-Back, Outer Write-Back Normal cacheable memory. 


Otherwise it is IMPLEMENTATION DEFINED whether they are single-copy atomic. 


If ARMv8.4-LSE is implemented, all loads and stores are single-copy atomic when the following conditions are 


true: 
s Accesses are unaligned to their data size but are aligned within a 16-byte quantity that is aligned to 16 bytes. 
$ Accesses are to Inner Write-Back, Outer Write-Back Normal cacheable memory. 


Otherwise it is IMPLEMENTATION DEFINED whether loads and stores are single-copy atomic. 


If ARMv8.4-LSE is implemented, LDP, LDNP, and STP instructions that load or store two 64-bit registers are 
single-copy atomic when the following conditions are true: 


7 The overall memory access is aligned to 16 bytes. 
s Accesses are to Inner Write-Back, Outer Write-Back Normal cacheable memory. 


If ARMv8.4-LSE is implemented, LDP, LDNP, and STP instructions that access fewer than 16 bytes are single-copy 
atomic when the following conditions are true: 


è All bytes being accessed are within a 16-byte quantity aligned to 16 bytes. 
è Accesses are to Inner Write-Back, Outer Write-Back Normal cacheable memory. 


Otherwise it is IMPLEMENTATION DEFINED whether LDP, LDNP, or STP instructions that access fewer than 16 bytes are 
single-copy atomic. 
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B2.2.2 


B2.2.3 


B2.2.4 


B2.2.5 


B2-112 


Properties of single-copy atomic accesses 


A memory access instruction that is single-copy atomic has the following properties: 


l. For a pair of overlapping single-copy atomic store instructions, all of the overlapping writes generated by one 
of the stores are Coherence-after the corresponding overlapping writes generated by the other store. 


2, For a single-copy atomic load instruction L4 that overlaps a single-copy atomic store instruction Sy», if one of 
the overlapping reads generated by Lı Reads-from one of the overlapping writes generated by S2, then none 
of the overlapping writes generated by S2 are Coherence-after the corresponding overlapping reads generated 
by Lı. 


For more information, see Definition of the Armv8 memory model on page B2-115. 


Multi-copy atomicity 


In a multiprocessing system, writes to a memory location are multi-copy atomic if the following conditions are both 
true: 


° All writes to the same location are serialized, meaning they are observed in the same order by all observers, 
although some observers might not observe all of the writes. 


° A read of a location does not return the value of a write until all observers observe that write. 





Note 


Writes that are not coherent are not multi-copy atomic. 





Requirements for multi-copy atomicity 


For Normal memory, writes are not required to be multi-copy atomic. 
For Device memory, writes are not required to be multi-copy atomic. 


The Armv8 memory model is Other-multi-copy atomic. For more information, see Ordering constraints on 
page B2-119. 


Concurrent modification and execution of instructions 


The Armv8 architecture limits the set of instructions that can be executed by one thread of execution as they are 
being modified by another thread of execution without requiring explicit synchronization. 


Concurrent modification and execution of instructions can lead to the resulting instruction performing any behavior 
that can be achieved by executing any sequence of instructions that can be executed from the same Exception level, 
except where each of the instruction before modification and the instruction after modification is one of a B, BL, BRK, 
HVC, ISB, NOP, SMC, or SVC instruction. 


For the B, BL, BRK, HVC, ISB, NOP, SMC, and SVC instructions the architecture guarantees that, after modification of the 
instruction, behavior is consistent with execution of either: 


è The instruction originally fetched. 
e A fetch of the modified instruction. 


For all other instructions, to avoid UNPREDICTABLE or CONSTRAINED UNPREDICTABLE behavior, instruction 
modifications must be explicitly synchronized before they are executed. The required synchronization is as follows: 


1. No PE must be executing an instruction when another PE is modifying that instruction. 
2, To ensure that the modified instructions are observable, a PE that is writing the instructions must issue the 


following sequence of instructions and operations: 


; Coherency example for data and instruction accesses within the same Inner Shareable domain. 
; enter this code with <Wt> containing a new 32-bit instruction, 
; to be held in Cacheable space at a location pointed to by Xn. 
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STR Wt, [Xn] 
DC CVAU, Xn ; Clean data cache by VA to point of unification (PoU) 
DSB ISH ; Ensure visibility of the data cleaned from cache 
IC IVAU, Xn ; Invalidate instruction cache by VA to PoU 
DSB ISH 
Note 
s The DC CVAU operation is not required if the area of memory is either Non-cacheable or Write-Through 
Cacheable. 


s If the contents of physical memory differ between the mappings, changing the mapping of VAs to PAs 
can cause the instructions to be concurrently modified by one PE and executed by another PE. If the 
modifications affect instructions other than those listed as being acceptable for modification, 
synchronization must be used to avoid UNPREDICTABLE or CONSTRAINED UNPREDICTABLE behavior. 





3. In a multiprocessor system, the IC IVAU is broadcast to all PEs within the Inner Shareable domain of the PE 
running this sequence. However, when the modified instructions are observable, each PE that is executing 
the modified instructions must issue the following instruction to ensure execution of the modified 
instructions: 


ISB ; Synchronize fetched instruction stream 


For more information about the required synchronization operation, see Synchronization and coherency issues 
between data and instruction accesses on page B2-136. 


For information about memory accesses caused by instruction fetches, see Ordering relations on page B2-118. 


B2.2.6 Possible implementation restrictions on using atomic instructions 
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In some implementations, and for some memory types, the properties of atomicity can be met only by functionality 
outside the PE. Some system implementations might not support atomic instructions for all regions of the memory. 
In particular, this can apply to: 


` Any type of memory in the system that does not support hardware cache coherency. 


° Device, Non-cacheable memory, or memory that is treated as Non-cacheable, in an implementation that does 
support hardware cache coherency. 


In such implementations, it is defined by the system: 
° Whether the atomic instructions are atomic in regard to other agents that access memory. 


° If the atomic instructions are atomic in regard to other agents that access memory, which address ranges or 
memory types this applies to. 


An implementation can choose which memory type is treated as Non-cacheable. 
The memory types for which it is architecturally guaranteed that the atomic instructions will be atomic are: 


° Inner Shareable, Inner Write-Back, Outer Write-Back Normal memory with Read allocation hints and Write 
allocation hints and not transient. 


° Outer Shareable, Inner Write-Back, Outer Write-Back Normal memory with Read allocation hints and Write 
allocation hints and not transient. 


If the atomic instructions are not atomic in regard to other agents that access memory, then performing an atomic 
instruction to such a location can have one or more of the following effects: 


è The instruction generates a synchronous External abort. 
è The instruction generates a System Error interrupt. 
: The instruction generates an IMPLEMENTATION DEFINED MMU fault reported using the Data Abort Fault 


status code of ESR_ELx.DFSC = 110101. 
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For the EL1&0 translation regime, if the atomic instruction is not supported because of the memory type that 
is defined in the first stage of translation, or the second stage of translation is not enabled, then this exception 
is a first stage abort and is taken to EL1. Otherwise, the exception is a second stage abort and is taken to EL2. 


The instruction is treated as a NOP. 


The instructions are performed, but there is no guarantee that the memory accesses were performed 
atomically in regard to other agents that access memory. In this case, the instruction might also generate a 
System Error interrupt. 
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B2.3 Definition of the Armv8 memory model 


This section describes observation and ordering in the Armv8 memory model. It contains the following subsections: 


. Locations. 
. Ordering and observability on page B2-116. 
e Ordering constraints on page B2-119. 


° Completion and endpoint ordering on page B2-120. 

. Ordering of instruction fetches on page B2-122. 

. Restrictions on the effects of speculation on page B2-123. 
° Memory barriers on page B2-124. 

7 Limited ordering regions on page B2-131. 


For more information about endpoint ordering of memory accesses, see Reordering on page B2-150. 


In the Armv8 memory model, the Shareability memory attribute indicates the degree to which hardware must ensure 
memory coherency between a set of observers, see Memory types and attributes on page B2-143. 


The Armv8 architecture defines additional memory attributes and associated behaviors, which are defined in the 
system level section of this manual. See: 


$ Chapter D4 The AArch64 System Level Memory Model. 
- Chapter DS The AArch64 Virtual Memory System Architecture. 


See also Mismatched memory attributes on page B2-153. 


B2.3.1 Locations 
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The Armv8 memory model provides a set of definitions that are used to constrain the permitted sequences of 
accesses to memory. The Armv8 memory model defines: 


° The ordering of observation of memory accesses between different observers. 
$ The ordering of arrival of memory accesses arriving at an endpoint. 
° The mechanisms to control the ordering of observation of memory accesses and the arrival of memory 


accesses at an endpoint. 


Locations, Memory effects, and Observers 
The Armv8 memory model provides the following definition of a Location in memory: 


Location 

A Location refers to a single byte in memory. 
As part of its execution an instruction might generate a Memory effect. Observers in the system might observe the 
Memory effects of that instruction on a Location. The Armv8 memory model provides the following definitions of 
a Memory effect and an Observer: 
Memory effect 


The Memory effects of an instruction are the read, write, or barrier effects of that instruction. For an 
instruction that accesses memory: 


. A read effect is generated for each Location that is read by the instruction. 
` A write effect is generated for each Location that is written by the instruction. 
An instruction can generate both read and write effects. 


The Memory effects of an instruction I; are said to appear in program order before the Memory 
effects of instruction I if and only if I; occurs before Iz in program order. 
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Observer 


For the purposes of describing the Armv8 memory model, all read and write effects access only 
Normal memory locations ina Common Shareability Domain, and excludes the situations described 
in Mismatched memory attributes on page B2-153. Where this section refers to a read, write, or 
memory barrier without any qualification, then it is referring to the corresponding Memory effect. 


An Observer refers to either a processing element, or some other memory accessing agent that can 
generate reads from or writes to memory. 


Common Shareability Domain 


A Common Shareability Domain for a program is the smallest Shareability domain that contains all 
of the active Observers of the Memory effects generated by a program. 


B2.3.2 Ordering and observability 


The Armv8 memory model permits reordering of memory accesses. This section defines the constraints placed on 
the reordering of memory accesses using the following: 


. Register value dependencies to establish order between instructions on a PE. 


e Ordering constraints to establish order between accesses to a Location. 


Register value dependencies 


The Armv8 memory model defines the following dependencies between instructions: 


Register dependency 


A Register dependency from a first data value V; to a second data value V3 exists within a PE if and 

only if either: 

° The register, excluding the AArch64 zero register (XZR or WZR), that is used to hold V is 
used in the calculation of V2. 


s There is a Register dependency from V; to a third data value V3 and there is a register 
dependency from V3 to V2. 


Register data dependency 


A Register data dependency from a first data value V, to a second data value V2 exists within a PE 

if and only if either: 

° The register, excluding the AArch64 zero register (XZR or WZR) and the AArch32 PC, that 
is used to hold V4 and is used in the calculation of V2, and the calculation between V, and 
the V> does not consist of either: 


— A conditional branch whose condition is determined by V1. 


— A conditional selection, move, or computation whose condition is determined by V1, 
where the input data values for the selection, move, or computation do not have a data 
dependency on Vj. 


è There is a Register data dependency from Vj to a third data value V3, and there is a Register 
data dependency from V3 to V2. 


Address dependency 


B2-116 


An Address dependency from a read R; to a subsequent read R2 exists if and only if there is a 
Register data dependency from the data value that is returned by R, to the address used by Ro. 


An Address dependency from a read R; to a subsequent write W3 exists if and only if there is a 
Register dependency from the data value that is returned by Rj to the address used by W2. 
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Data dependency 
A Data dependency from a read R; to a subsequent write W3 exists if and only if there is a Register 
dependency from the data value returned by Rj to the data value written by W2. 

Control dependency 
A Control dependency from a read R; to a subsequent instruction Ip exists if and only if either: 


à There is a Register dependency from the data value returned by R; to the data value used in 
the evaluation of a conditional branch, and I, is only executed as a result of one of the 
possible outcomes of that conditional branch. 


. There is a Register dependency from the data value returned by R; to the data value used in 
the determination of a synchronous exception on an instruction I3, and Iz appears in program 
order after Is. 


Ordering and observability at a Location 
Memory effects on a Location are related by the following relations: 


Reads-from 


A Reads-from relation that couples reads and writes to the same Location such that each read is 
paired with a single write in the program. A read R3 of a Location Reads-from a write W to the 
same Location if and only if R3 takes its data from W1. 


— Note 


The Reads-from relation represents a read being satisfied by a write and then returning the written 
data. 





Coherence order 


A Coherence order relation for each Location in the program that provides a total order on all writes 
from all coherent Observers to that Location, starting with a notional write of the initial value. 


Note 


The Coherence order of a Location represents the order in which writes to the Location arrive at 
memory. 








Coherence-after 


A write W3 to a Location is Coherence-after another write W4 to the same Location if and only if 
W> is sequenced after W, in the Coherence order of the Location. 


A write W2 to a Location is Coherence-after a read R; of the same location if and only if Ry 
Reads-from a write W3 to the same Location and W2 is Coherence-after W3. 
Overlapping accesses 


Two Memory effect overlap if and only if they access the same Location. Two instructions overlap 
if and only if one or more of their generated Memory effects overlap. 


Observed-by 


A read or a write RW, from an Observer is Observed-by a write W2 from a different Observer if and 
only if W2 is coherence-after RW}. 


A write W1 from an Observer is Observed-by a read R2 from a different Observer if and only if R2 
Reads-from W. 


Note 


The Observed-by relation only relates accesses generated by different Observers. 
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DMB FULL 
A DMB FULL is a DMB with neither the LD or the ST qualifier. 


Where this section refers to DMB without any qualification, then it is referring to all types of DMB. 
Unless a specific shareability domain is defined, a DMB applies to the Common Shareability Domain. 


All properties that apply to DMB also apply to the corresponding DSB. 


Ordering relations 


In addition to the ordering relations for a single Location, the Armv8 memory model also provides ordering relations 
to describe the ordering of Memory effects to multiple Locations. These are as follows: 


Dependency-ordered-before 


A dependency creates externally-visible order between a read and another Memory effect generated 
by the same Observer. A read R; is Dependency-ordered-before a read or write RW2 from the same 
Observer if and only if R; appears in program order before RW? and any of the following cases 
apply: 

. There is an Address dependency or a Data dependency from R; to RW. 


. RW> is a write W2 and there is a Control dependency from R; to W2. 

s RW> is a read R3 generated by an instruction appearing in program order after an instruction 
I; that generates a Context synchronization event, and there is a Control dependency from Ry 
to I3. 

s RW> is a write W2 appearing in program order after a read or a write RW3 and there is an 


Address dependency from R; to RW3. 


° RW; is a write W3 that is Coherence-after a write W3 and there is a Control dependency or a 
Data dependency from R; to W3. 


. RW;z2 is a read R3 that Reads-from a write W3 and there is an Address dependency or a Data 
dependency from R; to W3. 


Atomic-ordered-before 


Load-Exclusive and Store-Exclusive instructions provide some ordering guarantees, even in the 
absence of dependencies. A read or a write RW, is Atomic-ordered-before a read or a write RW2 
from the same Observer if and only if RW, appears in program order before RW? and either of the 
following cases apply: 


° RW, is a read R and RW; is a write W2 such that R; and W3 are generated by an atomic 
instruction or a successful Load-Exclusive/Store-Exclusive instruction pair to the same 
Location. 

° RW; is a write W generated by an atomic instruction or a successful Store-Exclusive 


instruction and RW; is a read R3 generated by an instruction with Acquire or AcquirePC 
semantics such that Rọ Reads-from W1. 


For more information, see Synchronization and semaphores on page B2-156. 


Barrier-ordered-before 


Barrier instructions order prior Memory effects before subsequent Memory effects generated by the 
same Observer. A read or a write RW1 is Barrier-ordered-before a read or a write RW2 from the 
same Observer if and only if RW1 appears in program order before RW> and any of the following 
cases apply: 


è RW; appears in program order before a DMB FULL that appears in program order before RW2. 


$ At least one of RW; and RW? is generated by an atomic instruction with both Acquire and 
Release semantics. 


° RW; is a write W generated by an instruction with Release semantics and RW2 is a read R2 
generated by an instruction with Acquire semantics. 
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° RW; is a read R, and either: 
— Ry, appears in program order before a DMB LD that appears in program order before RW2. 
— R; is generated by an instruction with Acquire or AcquirePC semantics. 

° RW; is a write W3 and either: 


— RW} isa write W; appearing in program order before a DMB ST that appears in program 
order before W2. 


—  W2is generated by an instruction with Release semantics. 
— RW, appears in program order before a write W3 generated by an instruction with 
Release semantics and W2 is Coherence-after W3. 
Locally-ordered-before 


Dependencies, Load/Store-Exclusive, atomic and barrier instructions can be composed within an 
observer to create externally-visible order. A read or write (RW}) is Locally-ordered-before a read 
or write (RW2) from the same observer if and only if any of the following apply: 


- RW; Dependency-ordered-before RW. 

° RW, is Atomic-ordered-before RW2. 

. RW, is Barrier-ordered-before RW2. 

° RW, is Locally-ordered-before a read or a write that is Locally-ordered-before RW2. 


Ordered-before 


An arbitrary pair of Memory effects is ordered if it can be linked by a chain of ordered accesses 
consistent with external observation. A read or a write RW, is Ordered-before a read or a write RW2 
if and only if any of the following cases apply: 


° RW; is Observed-by RW2. 

. RW, is Locally-ordered-before RW2. 

° RW; is Ordered-before a read or write that is Ordered-before RW2. 

. If ARMv8.5-MemTag is implemented, RW is Tag-ordered-before RW2. 


Tag-determined-by 


If ARMv8.5-MemTag is implemented, a Checked access read or write, RW1, is Tag-determined-by 
a Tag read Ro if and only if all of the following applies: 


: RW, and R3 are generated by the same instruction. 


- R2 reads the Allocation Tag at a tag physical address and compares it with the physical 
address Tag passed as part of the access RW). 


If the result of the comparison can cause a precise exception and the result if negative then RW, 
does not architecturally occur. 
Tag-ordered-before 


If ARMv8s.5-MemTag is implemented, a read, Ry, is Zag-ordered-before a read or a write RW2 
generated by the same instruction if and only if Rj is a Tag read and RW? is a Checked data access 
Tag-determined-by Rj. 


B2.3.3 Ordering constraints 


The Armv8 memory model is described as being Other-multi-copy atomic. The definition of Other-multi-copy 
atomic is as follows: 


Other-multi-copy atomic 


In an Other-multi-copy atomic system, it is required that a write from an Observer, if observed by a 
different Observer, is then observed by all other Observers that access the Location coherently. It is, 
however, permitted for an Observer to observe its own writes prior to making them visible to other 
observers in the system. 
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B2.3.4 


B2-120 


The Other-multi-copy atomic property of the Armv8 memory model is enforced by placing constraints on the 
possible executions of a program. Those executions that meet the constraints given by the ordering model are said 
to be architecturally well-formed. An implementation that is executing a program is only permitted to exhibit 
behavior consistent with an architecturally well-formed execution: 
Architecturally well-formed 
An architecturally well-formed execution must satisfy both of the following requirements: 
Internal visibility requirement 


For a read or a write RW; that appears in program order before a read or a write RW? to 
the same Location, the internal visibility requirement requires that exactly one of the 
following statements is true: 


° RW2 is a write W> that is Coherence-after RW. 
° RW; is a write W; and RW; is a read R3 such that either: 
— R Reads-from W. 
—  R> Reads-from another write that is Coherence-after W1. 


. RW, and RW? are both reads R, and R3 such that R; Reads-from a write W3 and 
either: 


— R Reads-from W3. 
— R Reads-from another write that is Coherence-after W3. 


Note 


Ifa Memory effect Mı from an Observer appears in program order before a Memory 
effect M2 from the same Observer, then M; will be seen to occur before M3 by that 
Observer. 








External visibility requirement 
For a read or a write RW, from an Observer that is Ordered-before a read or a write RW2 
from a different Observer, the external visibility constraint requires that RW2 is not 
Observed-by RW}. This means that an Architecturally well-formed execution must not 
exhibit a cycle in the Ordered-before relation. 


Note 


If a Memory effect Mı from an Observer is Ordered-before another Memory effect Mo, 
from a different Observer, then Mı will be seen to occur before M2 by all Observers in 
the system. 








Completion and endpoint ordering 


Interaction between Observers in a system is not restricted to communication via shared variables in coherent 
memory. For example, an Observer could configure an interrupt controller to raise an interrupt on another Observer 
as a form of message passing. These interactions typically involve an additional agent, which defines the instruction 
sequence that is required to establish communication links between different Observers. When these forms of 
interaction are used in conjunction with shared variables, a DSB instruction can be used to enforce ordering between 
them. 


For all memory, the completion rules are defined as: 


$ A read R, to a Location is complete for a shareability domain when all of the following are true: 


— Any write to the same Location by an Observer within the shareability domain will be Coherence-after 
Ry. 


— Any translation table walks associated with R; are complete for that shareability domain. 
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è A write W, to a Location is complete for a shareability domain when all of the following are true: 


— Any write to the same Location by an Observer within the shareability domain will be Coherence-after 
Wi. 


— Any read to the same Location by an Observer within the shareability domain will either Reads-from 
W; or Reads-from a write that is Coherence-after W1. 


— Any translation table walks associated with the write are complete for that shareability domain. 
° A translation table walk is complete for a shareability domain when the memory accesses, including the 


updates to translation table entries, associated with the translation table walk are complete for that 
shareability domain, and the TLB is updated. 


s A cache maintenance instruction is complete for a shareability domain when the memory effects of the 
instruction are complete for that shareability domain, and any translation table walks that arise from the 
instruction are complete for that shareability domain. 


° A TLB invalidate instruction is complete when all memory accesses using the TLB entries that have been 
invalidated are complete. 


The completion of any cache or TLB maintenance instruction includes its completion on all PEs that are affected 
by both the instruction and the DSB operation that is required to guarantee visibility of the maintenance instruction. 


Note 


These completion rules mean that, for example, a cache maintenance instruction that operates by VA to the PoC 
completes only after memory at the PoC has been updated. 








Additionally, for Device-nGnRnE memory, a read or write of a Location in a Memory-mapped peripheral that 
exhibits side-effects is complete only when the read or write both: 


: Can begin to affect the state of the Memory-mapped peripheral. 
7 Can trigger all associated side-effects, whether they affect other peripheral devices, PEs, or memory. 


Note 


This requirement for Device-nGnRnE memory is consistent with the memory access having reached the peripheral 
endpoint. 








Peripherals 


This section defines a Memory-mapped peripheral and the total order of reads and writes to a peripheral which is 
defined as the Peripheral coherence order: 


Memory-mapped peripheral 


A Memory-mapped peripheral occupies a memory region of IMPLEMENTATION DEFINED size and 
can be accessed using load and store instructions. Memory effects to a Memory-mapped peripheral 
can have side-effects, such as causing the peripheral to perform an action. Values that are read from 
addresses within a Memory-mapped peripheral might not correspond to the last data value written 
to those addresses. As such, Memory effects to a Memory-mapped peripheral might not appear in 
the Reads-from or Coherence order relations. 


Peripheral coherence order 
The Peripheral coherence order of a Memory-mapped peripheral is a total order on all reads and 
writes to that peripheral. 
— Note 


The Peripheral coherence order for a Memory-mapped peripheral signifies the order in which 
accesses atrive at the endpoint. 
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For a read or a write RW, and a read or a write RW? to the same peripheral, then RW; will appear 
in the Peripheral coherence order for the peripheral before RW> if either of the following cases 


apply: 
. RW, and RW: are accesses using Non-cacheable or Device attributes and RW is 
Ordered-before RW2. 


° RW; and RW? are accesses using Device-nGnRE or Device-nGnRnE attributes and RW, 
appears in program order before RW2. 
Out-of-band-ordered-before 


A read or a write RW, is Out-of-band-ordered-before a read or a write RW2 if and only if either of 
the following cases apply: 


° RW; appears in program order before a DSB instruction that begins an IMPLEMENTATION 
DEFINED instruction sequence indirectly leading to the generation of RW2. 


. RW, is Ordered-before a read or a write RW3 and RW; is Out-of-band-ordered-before RW2. 


Ifa Memory effect Mı is Out-of-band-ordered-before a read or a write Mo, then M; is seen to occur 
before M3 by all Observers. 


B2.3.5 Ordering of instruction fetches 


For two memory locations A and B, if A has been written to and been made coherent with the instruction fetches of 
the shareability domain, before an update to B by an observer in the same shareability domain, then the instruction 
stream of each observer in the shareability domain will not see the updated value of B without also seeing the 
updated value of A. 


A write has been made coherent with an instruction fetch of a shareability domain when: 


CTR_ELO.{DIC, IDC} == {0, 0} 
The location written to has been cleaned to the Point of unification (PoU) from the data cache, and 
that clean is complete for the shareability domain. Subsequently the location has been invalidated 
to the Point of unification (PoU) from the instruction cache, and that invalidation is complete for 
the shareability domain. 

CTR_ELO.{DIC, IDC} == {1, 0} 
The location written to has been cleaned to the Point of unification (PoU) from the data cache, and 
that clean is complete for the shareability domain. 

CTR_ELO.{DIC, IDC} == {0, 1} 


The write is complete for the shareability domain. Subsequently the location has been invalidated 
to the Point of unification (PoU) from the instruction cache, and that invalidation is complete for 
the shareability domain. 


CTR_ELO.{DIC, IDC} == {1, 1} 


The write is complete for the shareability domain. 





Note 
Microarchitecturally, this means that these situations cannot both be true in an implementation: 
à After delays in fetching from memory, the instruction queue can have entries written into it out of order. 
à For an implementation: 


— When CTR_EL0.DIC == 0, if there is an outstanding entry in the instruction queue, then later entries 
in the instruction queue are not impacted by the IC IVAU instructions of a different core. 


— When CTR _ELO.DIC == 1, if there is a write to the location that is held in the queue when there is an 
outstanding entry in the instruction queue for an older entry, then the instruction queue does not have 
entries invalidated from it. 


B2-122 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch64 Application Level Memory Model 
B2.3 Definition of the Armv8 memory model 


B2.3.6 Restrictions on the effects of speculation 


This section covers restrictions on speculation effects, including: 


Restrictions on the effects of speculation in Armv8.0. 
Speculative Store Bypass Safe (SSBS). 


Restrictions on the effects of speculation in Armv8.5 on page B2-124. 


Restrictions on the effects of speculation in Armv8.0 


The Armv8.0 architecture places certain restrictions on the effects of speculation. These are: 


Each load from a location using a particular VA after an exception return that is a Context synchronization 
event will not speculatively read an entry from earlier in the coherence order for the location being loaded 
from than the entry generated by the latest store to that location using the same VA before the exception exit. 


Each load from a location using a particular VA after an exception entry that is a Context synchronization 
event will not speculatively read an entry from earlier in the coherence order for the location being loaded 
from than the entry generated by the latest store to that location using the same VA before the exception entry. 


Any load from a location using a particular VA before an exception entry that is a Context synchronization 
event will not speculatively read data from a store to the same location using the same VA after the exception 
entry. 


Any load from a location using a particular VA before an exception return that is a Context synchronization 
event will not speculatively read data from a store to the same location using the same VA after the exception 
exit. 


When data is loaded under speculation with a translation fault, it cannot be used to form an address, generate 
condition codes, or generate SVE predicate values to be used by instructions newer than the load in the 
speculative sequence. 


When data is loaded under speculation from a location without a translation for the translation regime being 
speculated in, the data cannot be used to form an address, generate condition codes, or generate SVE 
predicate values to be used by instructions newer than the load in the speculative sequence. 


Speculative Store Bypass Safe (SSBS) 


When ARMv8.0-SSBS is implemented, PSTATE.SSBS is a control that can be set by software to indicate whether 
hardware is permitted to load or store speculatively in such a manner that could be exploited to produce a cache 
timing side channel, which uses an address derived from a register value that has been loaded from memory using 
a load instruction that speculatively read an entry for the location being loaded from, where the entry that is 
speculatively read is from earlier in the coherence order than the entry generated by the latest store to that location 
using the same virtual address as the load instruction. 


When the value of PSTATE.SSBS is 0, hardware is not permitted to load or store speculatively in this way. 


When the value of PSTATE.SSBS is 1, hardware is permitted to load or store speculatively in this way. 





Note 


If speculation is permitted, then cache timing side channels can lead to addresses being derived using reads 
of address values that have been speculatively loaded from memory to a register. 


Software written for architectures from Armv8.0 to Armv8.4 will set SPSR_ELx.SSBS to 0. This means that 
PSTATE.SSBS will not set, so hardware will not be permitted to use speculative loads with outstanding 
memory disambiguation issues for any subsequent speculative memory accesses if there is any possibility of 
those subsequent memory accesses creating a cache timing side channel. 
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Restrictions on the effects of speculation in Armv8.5 


From Armvs.5 there are some further restrictions on the effects of speculation in addition to those in Armv8.0: 


Data loaded under speculation with a permission or domain fault cannot be used to form an address, to 
generate condition codes, or to generate SVE predicate values to be used by instructions newer than the load 
in the speculative sequence. 


Any System register read under speculation to a register that is not architecturally accessible from the current 
Exception level cannot be used to form an address, to generate condition codes, or to generate SVE predicate 
values to be used by instructions newer than the load in the speculative sequence. 


Note 


As the effects of speculation are not architecturally visible, this restriction requires that the effect of any 
speculation cannot give rise to side channels that will leak the values of memory locations, System registers, 
or Special-purpose registers to a level of privilege that would otherwise not be able to determine those values. 








For all execution prediction resources that predict address or register values, speculative execution at one 
hardware defined context should be separated in a hard-to-determine manner from the predictions trained in 
a different hardware defined context. In the case of this definition, the hardware defined context is determined 
by: 


— The Exception level. 

— The Security state. 

— When executing at EL1, the VMID. 

— When executing at ELO and using the EL1&0 translation regime, the ASID and the VMID. 
— When executing at ELO and using the EL2&0 translation regime, the ASID. 

— When in AArch64 state, the current SCKTNUM_ELx value. 


Note 





The definition of “hard-to-determine manner” is left open to implementations. Examples could include the 
complete separation of prediction resources, or the isolation of the predictions using a cryptographic or 
pseudo-random mechanism to separate each context. 


The architecture does not require that prediction resources that simply predict the direction of a branch are 
separated in this way. 





Memory barriers 


Memory barrier is the general term applied to an instruction, or sequence of instructions, that forces synchronization 
events by a PE with respect to retiring Load/Store instructions. The memory barriers defined by the Armv8 
architecture provide a range of functionality, including: 


Ordering of Load/Store instructions. 
Completion of Load/Store instructions. 
Context synchronization. 


The following subsections describe the Armv8 memory barrier instructions: 


Instruction Synchronization Barrier (ISB) on page B2-125 

Data Memory Barrier (DMB) on page B2-125. 

Data Synchronization Barrier (DSB) on page B2-128. 

Speculation Barrier (SB) on page B2-126. 

Consumption of Speculative Data Barrier (CSDB) on page B2-126. 
Speculative Store Bypass Barrier (SSBB) on page B2-126. 

Profiling Synchronization Barrier (PSB CSYNC) on page B2-127. 
Physical Speculative Store Bypass Barrier (PSSBB) on page B2-127. 
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. Trace Synchronization Barrier (TSB CSYNC) on page B2-127 

. Shareability and access limitations on the data barrier operations on page B2-129. 
. Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. 

. LoadLOAcquire, StoreLORelease on page B2-130. 





Note 
Depending on the required synchronization, a program might use memory barriers on their own, or it might use them 
in conjunction with cache maintenance and memory management instructions that in general are only available 
when software execution is at EL1 or higher. 





DMB and DSB instructions affect reads and writes to the memory system generated by Load/Store instructions and data 
or unified cache maintenance instructions being executed by the PE. Instruction fetches or accesses caused by a 
hardware translation table access are not explicit accesses. 


Instruction Synchronization Barrier (ISB) 


An ISB instruction ensures that all instructions that come after the ISB instruction in program order are fetched from 
the cache or memory after the ISB instruction has completed. Using an ISB ensures that the effects of 
context-changing operations executed before the ISB are visible to the instructions fetched after the ISB instruction. 
Examples of context-changing operations that require the insertion of an ISB instruction to ensure the effects of the 
operation are visible to instructions fetched after the ISB instruction are: 

e Completed cache and TLB maintenance instructions. 


. Changes to System registers. 


Any context-changing operations appearing in program order after the ISB instruction only take effect after the ISB 
has been executed. 


The pseudocode function for the operation ofan ISB is InstructionSynchronizationBarrier(). 


See also Memory barriers on page D4-2501. 


Data Memory Barrier (DMB) 


The DMB instruction is a memory barrier instruction that ensures the relative order of memory accesses before the 
barrier with memory accesses after the barrier. The DMB instruction does not ensure the completion of any of the 
memory accesses for which it ensures relative order. 


The full definition of the DMB is covered formally in the Definition of the Armv8 memory model on page B2-115 
and this introduction to the DMB instruction is not intended to contradict that section. 


The basic principle of a DMB instruction is to introduce order between memory accesses that are specified to be 
affected by the DMB options supplied as arguments to the DMB instruction. The DMB instruction ensures that all 
affected memory accesses by the PE executing the DMB that appear in program order before the DMB and those 
which originate from a different PE, to the extent required by the DMB options, which have been Observed-by the 
PE before the DMB is executed, are Observed-by each PE, to the extent required by the DMB options, before any 
affected memory accesses that appear in program order after the DMB are Observed-by that PE. 


The use of a DMB creates order between the Memory effects of instructions as described in the definition of 
Barrier-ordered-before. 


DMB only affects memory accesses and the operation of data cache and unified cache maintenance instructions, see 
A64 Cache maintenance instructions on page D4-2482. It has no effect on the ordering of any other instructions 
executing on the PE. A DMB instruction intended to ensure the completion of cache maintenance instructions must 
have an access type of both loads and stores. 


The pseudocode function for the operation of a DMB is DataMemoryBarrier(). 
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Speculation Barrier (SB) 


An SB is a memory barrier that prevents speculative execution of instructions until after the barrier has completed 
when those instructions could be observed through side-channels. 


Until the barrier completes, the speculative execution of any instruction appearing later in the program order than 
the barrier: 


. Cannot be performed to the extent that such speculation can be observed through side-channels as a result of 
control flow speculation or data value speculation. 


° Can be performed when predicting that a instruction that could generate an exception does not generate an 
exception. 


Speculative execution of an SB instruction: 


° Cannot be as a result of control flow speculation. 

° Cannot be as a result of data value speculation. 

° Can be as a result of predicting that an instruction that could generate an exception does not generate an 
exception. 


An SB instruction can complete when: 
. It is known that it is not speculative. 


° All the predicted data values generated by instructions appearing in program order before the SB instruction 
have their predicted values confirmed. 


Note 
The SB instruction has no effect on the use of prediction resources to predict the instruction stream that is being 
fetched, so long as the prediction of the instruction stream is not informed by data taken from the register outputs 
of the speculative execution of instructions appearing in program order after the SB instruction. 








Consumption of Speculative Data Barrier (CSDB) 


The CSDB instruction is a memory barrier instruction that controls speculative execution and data value prediction. 
This includes: 


° Data value predictions of any instructions. 


. PSTATE. {N,Z,C,V} predictions of any instructions other than conditional branch instructions appearing in 
program order before the CSDB that have not been architecturally resolved. 


° Predictions of SVE predication state for any SVE instructions. 
For purposes of the definition of CSDB, PSTATE.{N,Z,C,V} is not considered a data value. This definition permits: 
° Control flow speculation before and after the CSDB. 


° Speculative execution of conditional data processing instructions after the CSDB, unless they use the results 
of data value or PSTATE. {N,Z,C,V} predictions of instructions appearing in program order before the CSDB 
that have not been architecturally resolved. 


Speculative Store Bypass Barrier (SSBB) 


The SSBB is a memory barrier that prevents speculative loads from bypassing earlier stores to the same virtual 
address under certain conditions. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch64 Application Level Memory Model 
B2.3 Definition of the Armv8 memory model 


The semantics of the Speculative Store Bypass Barrier are: 


° When a load to a location appears in program order after the SSBB, then the load does not speculatively read 
an entry earlier in the coherence order for that location than the entry generated by the latest store satisfying 
all of the following conditions: 


— The store is to the same location as the load. 
— The store uses the same virtual address as the load. 
— The store appears in program order before the SSBB. 


° When a load to a location appears in program order before the SSBB, then the load does not speculatively read 
data from any store satisfying all of the following conditions: 


— The store is to the same location as the load. 
— The store uses the same virtual address as the load. 
— The store appears in program order before the SSBB. 


Profiling Synchronization Barrier (PSB CSYNC) 


The PSB CSYNC is a memory barrier that ensures that all existing profiling data for the current PE has been 
formatted, and profiling buffer addresses have been translated such that all writes to the profiling buffer have been 
initiated. A following DSB instruction completes when the writes to the profiling buffer have completed. 


If the Statistical Profiling Extension is not implemented, this instruction executes as a NOP. 


Physical Speculative Store Bypass Barrier (PSSBB) 


The PSSBB is a memory barrier that prevents speculative loads from bypassing earlier stores to the same physical 
address under certain conditions. 


The semantics of the Physical Speculative Store Bypass Barrier are: 


° When a load to a location appears in program order after the PSSBB, then the load does not speculatively read 
an entry earlier in the coherence order for that location than the entry generated by the latest store satisfying 
all of the following conditions: 


— The store is to the same location as the load. 
— The store appears in program order before the PSSBB. 


° When a load to a location appears in program order before the PSSBB, then the load does not speculatively read 
data from any store satisfying all of the following conditions: 


— The store is to the same location as the load. 
— The store appears in program order before the PSSBB. 


Trace Synchronization Barrier (TSB CSYNC) 


The TSB CSYNC is a memory barrier instruction that preserves the relative order of memory accesses to System 
registers due to trace operations and other memory accesses to the same registers. 


A trace operation is an operation of the PE Trace Unit generating trace for an instruction when ARMVv8.4-Trace is 
implemented and enabled. 


A TSB CSYNC is not required to execute in program order with respect to other instructions. This includes being 
reordered with respect to other trace instructions. One or more context synchronization events are required to ensure 
that TSB CSYNC is executed in the necessary order. 


If trace is generated between a context synchronization event and a TSB CSYNC operation, these trace operations may 
be reordered with respect to the TSB CSYNC operation, and therefore may not be synchronized. 
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The following situations are synchronized using a TSB CSYNC: 


$ A direct write B to a System register is ordered after an indirect read or indirect write of the same register by 
a trace operation A, if all of the following are true: 


— Ais executed in program order before a context synchronization event C. 
— Cis in program order before a TSB CSYNC operation T. 
— Bis executed in program order after T. 


a A direct read B of a System register is ordered after an indirect write to the same register by a trace operation 
A if all the following are true: 


— Ais executed in program order before a context synchronization event C1. 

— Cl isin program order before TSB CSYNC operation T. 

— Tis executed in program order before a second context synchronization event C2. 
— Bis executed in program order after C2. 


ATSB CSYNC operation is not needed to ensure a direct write B to a System register is ordered before an indirect read 
or indirect write of the same register by a trace operation A, if all the following are true: 


s A is executed in program order after a context synchronization event C. 


° B is executed in program order before C. 


The pseudocode function for the operation of a TSB CSYNC is TraceSynchronizationBarrier(). 


Data Synchronization Barrier (DSB) 


A DSB is a memory barrier that ensures that memory accesses that occur before the DSB have completed before 
the completion of the DSB instruction. In doing this, it acts as a stronger barrier than a DMB and all ordering that 
is created by a DMB with specific options is also generated by a DSB with the same options. 


Execution of a DSB: 


G At EL2 ensures that any memory accesses caused by Speculative translation table walks from the EL1&0 
translation regime have been observed. 


$ At EL3 ensures that any memory accesses caused by speculative translation table walks from the EL2 or 
EL2&0 translation regimes. 


For more information, see Use of out-of-context translation regimes on page D5-2526. 
A DSB executed by a PE, PEe, completes when all of the following apply: 


° All explicit memory accesses of the required access types appearing in program order before the DSB are 
complete for the set of observers in the required shareability domain. 


° If the required access types of the DSB is reads and writes, then all cache maintenance instructions, all TLB 
maintenance instructions, and all PSB CYNC instructions issued by PEe before the DSB are complete for the 
required shareability domain. 


In addition, no instruction that appears in program order after the DSB instruction can alter any state of the system 
or perform any part of its functionality until the DSB completes other than: 


° Being fetched from memory and decoded. 


G Reading the general-purpose, SIMD and floating-point, Special-purpose, or System registers that are directly 
or indirectly read without causing side-effects. 


If ARMv8.5-MemTag is implemented and enabled on completion of a DSB instruction, all updates to 
TFSR_ELx.TFx or TFSRE0_EL1.TFx due to Tag Check fails caused by accesses for which the DSB operates will be 
complete. For more information on ARMv8.5-MemTag see Chapter D6 Armv8.5 Memory Tagging Extension. 


The pseudocode function for the operation of a DSB is DataSynchronizationBarrier(). 


See also Memory barriers on page D4-2501. 
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Shareability and access limitations on the data barrier operations 


The DMB and DSB instructions take an argument that specifies: 
s The shareability domain over which the instruction must operate. This is one of: 
— Full system. 
— Outer Shareable. 
— Inner Shareable. 
— Non-shareable. 
° The accesses for which the instruction operates. This is one of: 
— Read and write accesses, both before and after the barrier instruction. 
— Write accesses only, before and after the barrier instruction. 


— Read accesses before the barrier instruction, and read and write accesses after the barrier instruction. 


Note 
This form of a DMB or DSB instruction can be described as a Load-Load/Store barrier. 





For more information on whether an access is before or after a barrier instruction, see Data Memory Barrier (DMB) 
on page B2-125 or Data Synchronization Barrier (DSB) on page B2-128. 


Table B2-1 shows how these options are encoded in the <option> field of the instruction: 


Table B2-1 Encoding of the DMB and DSB <option> parameter 





Accesses 


Shareability domain 


Before the barrier After the barrier Full system Outer Shareable Inner Shareable Non-shareable 








Reads and writes Reads and writes SY OSH ISH NSH 
Writes Writes ST OSHST ISHST NSHST 
Reads Reads and writes LD OSHLD ISHLD NSHLD 
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See the instruction descriptions for more information: 
s DMB on page C6-888. 
: DSB on page C6-891. 


Note 


ISB also supports an optional limitation argument that can only contain one value that corresponds to full system 
operation, see ZSB on page C6-912. 








Load-Acquire, Load-AcquirePC, and Store-Release 


Armv8 provides a set of instructions with Acquire semantics for loads, and Release semantics for stores. These 
instructions support the Release Consistency sequentially consistent (RCsc) model. In addition, ARMv8.3-RCPC 
provides Load-AcquirePC instructions. The combination of Load-AcquirePC and Store-Release can be use to 
support the weaker Release Consistency processor consistent (RCpc) model. 


The full definitions of the Load-Acquire and Load-AcquirePC instructions are covered formally in the Definition of 
the Armv8 memory model on page B2-115. This introduction to the Load-Acquire and Load-AcquirePC instructions 
is not intended to contradict that section. 


The basic principle of both Load-Acquire and Load-AcquirePC instructions is to introduce order between the 
memory access generated by the Load-Acquire or Load-AcquirePC instruction and the memory accesses appearing 
in program order after the Load-Acquire or Load-AcquirePC instruction, such that the memory access generated by 
the Load-Acquire or Load-AcquirePC instruction is Observed-by each PE, to the extent that the PE is required to 
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observe the access coherently, before any of the memory accesses appearing in program order after the 
Load-Acquire or Load-AcquirePC instruction are Observed-by that PE, to the extent that the PE is required to 
observe the accesses coherently. 


The use of a Load-Acquire or Load-AcquirePC instruction creates order between the Memory effects of instructions 
as described in the definition of Barrier-ordered-before. 


The full definition of the Store-Release instruction is covered formally in the Definition of the Armv8 memory model 
on page B2-115 and this introduction to the Store-Release instruction is not intended to contradict that section. 


The basic principle of a Store-Release instruction is to introduce order between the memory accesses generated by 
the PE executing the Store-Release instruction, together with those which originate from a different PE, to the extent 
that the PE is required to observe them coherently, Observed-by the PE before executing the Store-release. 


The use of a Store-Release instruction creates order between the Memory effects of instructions as described in the 
definition of Barrier-ordered-before. 


Where a Load-Acquire appears in program order after a Store-Release, then the memory access generated by the 
Store-Release instruction is Observed-by each PE, to the extent that PE is required to observe the access coherently, 
before the memory access generated by the Load-Acquire instruction are Observed-by that PE, to the extent that the 
PE is required to observe the access coherently. In addition, the use of a Load-Acquire, Load-AcquirePC or a 
Store-Release instruction on accesses to a Memory-mapped peripheral introduces order between the Memory 
effects of the instructions that access that peripheral, as described in the definition of Peripheral coherence order. 


Load-Acquire, Load-AcquirePC and Store-Release, other than Load-Acquire Exclusive Pair and 
Store-Release-Exclusive Pair, access only a single data element. This access is single-copy atomic. The address of 
the data object must be aligned to the size of the data element being accessed, otherwise the access generates an 
Alignment fault. 


Load-Acquire Exclusive Pair and Store-Release Exclusive Pair access two data elements. The address supplied to 
the instructions must be aligned to twice the size of the element being loaded, otherwise the access generates an 
Alignment fault. 


A Store-Release Exclusive instruction only has the release semantics if the store is successful. 


Note 


7 Each Load-Acquire Exclusive and Store-Release Exclusive instruction is essentially a variant of the 
equivalent Load-Exclusive or Store-Exclusive instruction. All usage restrictions and single-copy atomicity 
properties: 





— That apply to the Load-Exclusive instructions also apply to the Load-Acquire Exclusive instructions. 
— That apply to the Store-Exclusive instructions also apply to the Store-Release Exclusive instructions. 


è The Load-Acquire, Load-AcquirePC, and Store-Release instructions can remove the requirement to use the 
explicit DMB instruction. 





LoadLOAcquire, StoreLORelease 


For each PE, the Non-secure physical memory map is divided into a set of LORegions using a table that is held 
within the PE. Any PA in the Non-secure memory map can be a member of one LORegion. If a PA is assigned to 
more than one LORegion, then an implementation might treat it as if it has been assigned to fewer LORegions than 
that have been specified. A PA in the Secure physical memory map cannot be a member of any LORegion. For more 
information, see Limited ordering regions on page B2-131. 


Armv8.1 provides a set of instructions with Acquire semantics for loads, and Release semantics for stores that apply 
in relation to the defined LORegions. The new variants of the Load-Acquire and Store-Release instructions are 
LoadLOAcquire and StoreLORelease. See LoadLOAcquire/StoreLORelease on page C3-204. 


For all memory types, these instructions have the following ordering requirements: 


s LoadLOAcquire has the same semantics as Load-Acquire except that the memory accesses affected lie within 
the same LORegion as the address of the memory access generated by the LoadLOAcquire instruction. See 
Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. 
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- StoreLORelease has the same semantics as Store-Release except that the memory accesses affected lie within 
the same LORegion as the address of the memory access generated by the StoreLORelease instruction. See 
Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. 


In addition, for accesses to Memory-mapped peripherals: 


7 LoadLOAcquire has the same semantics as Load-Acquire except that the affected Memory effects of 
instructions that access the peripheral lie within the same LORegion as the address of the memory access 
generated by the LoadLOAcquire instruction. See Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


z StoreLORelease has the same semantics as Store-Release except that the affected Memory effects of 
instructions that access the peripheral lie within the same LORegion as the address of the memory access 
generated by the StoreLORelease instruction. See Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 





Note 


The LoadLOAcquire/StoreLORelease instructions can remove the requirement to use the explicit DMB instruction. 





B2.3.8 Limited ordering regions 
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Armv8.1 introduces limited ordering regions (LORegions), which allow large systems to perform special 
load-acquire and store-release instructions that provide order between the memory accesses to a region of the PA 
map as observed by a set of observers. 


This feature is supported in AArch64 state only. 


Specification of the LORegions 


The LORegions are defined in the Non-secure physical memory map using a set of LORegion descriptors. The 
number of LORegion descriptors is IMPLEMENTATION DEFINED, and can be discovered by reading the LORID_EL1 
register. 


Each LORegion descriptor consists of: 
° A tuple of the following values: 
— A Start Address. 
— An End Address. 
— An LORegion Number. 
$ Valid bit which indicates whether that LORegion descriptor is valid. 


A memory location lies within the LORegion identified by the LORegion Number if the PA lies between the Start 
Address and the End Address, inclusive. The Start Address must be defined to be aligned to 64KB and the End 
Address must be defined as the top byte of a 64KB block of memory. 


The LORegion descriptors are programmed using the LORSA_EL1, LOREA_EL1, LORN_EL1, and LORC_EL1 
registers in the System register space. These registers are only supported in the Non-secure memory map. 


If a LoadLOAcquire or a StoreLORelease does not match with any LORegion, then: 


s The LoadLOAcquire will behave as a Load-Acquire, and will be ordered in the same way with respect to all 
accesses, independent of their LORegions. 


è The StoreLORelease will behave as a Store-Release, and will be ordered in the same way with respect to all 
accesses, independent of their LORegions. 





Note 


If no LORegions are implemented, then the LoadLOAcquire and StoreLORelease will therefore behave as a 
Load-Acquire and Store-Release. 
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A new access type AccType_LIMITEDORDERED has been added for these limited ordering instructions to be identified. 
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B2.4 Caches and memory hierarchy 


The implementation of a memory system depends heavily on the microarchitecture and therefore many details of 
the memory system are IMPLEMENTATION DEFINED. Armv8 defines the application level interface to the memory 
system, including a hierarchical memory system with multiple levels of cache. This section describes an application 
level view of this system. It contains the subsections: 


° Introduction to caches. 

7 Memory hierarchy. 

. Application level access to functionality related to caches on page B2-134 
° Implication of caches for the application programmer on page B2-135. 

. Preloading caches on page B2-137. 


B2.4.1 Introduction to caches 


A cache is a block of high-speed memory that contains a number of entries, each consisting of: 
7 Main memory address information, commonly known as a tag. 


od The associated data. 
Caches increase the average speed of a memory access. Caching takes account of two principles of locality: 


Spatial locality 


An access to one Location is likely to be followed by accesses to adjacent Locations. Examples of 
this principle are: 


° Sequential instruction execution. 


è Accessing a data structure. 


Temporal locality 


An access to an area of memory is likely to be repeated in a short time period. An example of this 
principle is the execution of a software loop. 


To minimize the quantity of control information stored, the spatial locality property groups several locations 
together under the same tag. This logical block is commonly known as a cache line. When data is loaded into a 
cache, access times for subsequent loads and stores are reduced, resulting in overall performance benefits. An access 
to information already in a cache is known as a cache hit, and other accesses are called cache misses. 


Normally, caches are self-managing, with the updates occurring automatically. Whenever the PE accesses a 
cacheable memory location, the cache is checked. If the access is a cache hit, the access occurs in the cache. 
Otherwise, the access is made to memory. Typically, when making this access, a cache location is allocated and the 
cache line loaded from memory. Armv8 permits different cache topologies and access policies, provided they 
comply with the memory coherency model described in this manual. 


Caches introduce a number of potential problems, mainly because: 
° Memory accesses can occur at times other than when the programmer would expect them. 


è A data item can be held in multiple physical locations. 


B2.4.2 Memory hierarchy 


Typically memory close to a PE has very low latency, but is limited in size and expensive to implement. Further 
from the PE it is common to implement larger blocks of memory but these have increased latency. To optimize 
overall performance, an Armv8 memory system can include multiple levels of cache in a hierarchical memory 
system that exploits this trade-off between size and latency. Figure B2-1 on page B2-134 shows an example of such 
a system in an Armv8-A system that supports virtual addressing. 
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In this manual, in a hierarchical memory system, Level 1 refers to the level closest to the processing element, as 
shown in Figure B2-1. 





Instructions and data can be held in separate caches or in a unified cache. A cache hierarchy can have one or more 
levels of separate instruction and data caches, with one or more unified caches that are located at the levels closest 
to the main memory. Memory coherency for cache topologies can be defined using the conceptual points Point of 
Unification (PoU), Point of Coherency (PoC), Point of Persistence (PoP), and Point of Deep Persistence (PoDP). 


For more information, including the definitions of PoU, PoC, PoP, and PoDP, see About cache maintenance in 
AArch64 state on page D4-2478. 


If ARMv8.5-MemTag is implemented and enabled the behavior of cache maintenance instructions is modified for 
more information see Allocation Tags on page D6-2661. 


The cacheability and shareability memory attributes 
Cacheability and shareability are two attributes that describe the memory hierarchy in a multiprocessing system: 


Cacheability This attribute defines whether memory locations are allowed to be allocated into a cache or not. 
Cacheability is defined independently for Inner and Outer Cacheability locations. 


Shareability This attribute defines whether memory locations are shareable between different agents in a system. 
Marking a memory location as shareable for a particular domain requires hardware to ensure that 
the location is coherent for all agents in that domain. Shareability is defined independently for Inner 
and Outer Shareability domains. 


For more information about Cacheability and Shareability, see Memory types and attributes on page B2-143. 


B2.4.3 Application level access to functionality related to caches 


As indicated in About the Application level programmers’ model on page B1-98, the application level corresponds 
to execution at ELO. The architecture defines a set of cache maintenance instructions that software can use to 
manage cache coherency. Software executing at a higher Exception level can enable use of some of this 
functionality from ELO, as follows: 


When the value of SCTLR_EL1.UCI is 1 
Software executing at ELO can access: 


° The data cache maintenance instructions, DC CVAU, DC CVAC, DC CVAP, DC CVADP, and DC CIVAC. 
See The data cache maintenance instruction (DC) on page D4-2483. 
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° The instruction cache maintenance instruction IC IVAU. See The instruction cache 
maintenance instruction (IC) on page D4-2483. 


Attempted execution of these instructions might generate a Permission fault as described in 
Permission fault on page D5-2623. 


When the value of SCTLR_EL1.UCT is 1 
Software executing at ELO can access the cache type register. See CTR_ELO. 


When the value of SCTLR_EL1.DZE is 1 


Software executing at ELO can access the data cache zero instruction DC ZVA. See Data cache zero 
instruction on page D4-2492. 


The SCTLR_EL1.{UCI, UCT, DZE} control fields are only accessible by software executing at EL1 or higher. 
When HCR_EL2.{E2H, TGE} == 1 the controls {UCI, UCT and DZE} are found in SCTLR_EL2. 


This functionality is UNDEFINED at ELO when the value of the corresponding SCTLR_EL1 control field is 0, see: 
e Traps to EL1 of ELO execution of cache maintenance instructions on page D1-2328. 

. Traps to EL1 of ELO accesses to the CTR_ELO on page D1-2329. 

5 Traps to EL1 of ELO execution of DC ZVA instructions on page D1-2330. 


B2.4.4 Implication of caches for the application programmer 


In normal operation, the caches are largely invisible to the application programmer. However they can become 
visible when there is a breakdown in the coherency of the caches. Such a breakdown can occur: 


a When memory locations are updated by other agents in the system that do not use hardware management of 
coherency. 
è When memory updates made from the application software must be made visible to other agents in the 


system, without the use of hardware management of coherency. 
For example: 


è In the absence of hardware management of coherency of DMA accesses, in a system with a DMA controller 
that reads memory locations that are held in the data cache of a PE, a breakdown of coherency occurs when 
the PE has written new data in the data cache, but the DMA controller reads the old data held in memory. 


: In a Harvard cache implementation, where there are separate instruction and data caches, a breakdown of 
coherency occurs when new instruction data has been written into the data cache, but the instruction cache 
still contains the old instruction data. 


Data coherency issues 


Software can ensure the data coherency of caches in the following ways: 


° By not using the caches in situations where coherency issues can arise. This can be achieved by: 
— Using Non-cacheable or, in some cases, Write-Through Cacheable memory. 
— Not enabling caches in the system. 


$ By using cache maintenance instructions to manage the coherency issues in software. See Application level 
access to functionality related to caches on page B2-134. 


° By using hardware coherency mechanisms to ensure the coherency of data accesses to memory for cacheable 
locations by observers within the different shareability domains, see Non-shareable Normal memory on 
page B2-145 and Shareable, Inner Shareable, and Outer Shareable Normal memory on page B2-144. 
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B2-136 





Note 


The performance of these hardware coherency mechanisms is highly implementation-specific. In some 
implementations, the mechanism suppresses the ability to cache shareable locations. In other 
implementations, cache coherency hardware can hold data in caches while managing coherency between 
observers within the shareability domains. 








Note 


Not all these mechanisms are directly available to software operating at ELO and might involve interaction with 
software operating at a higher Exception level. 





Synchronization and coherency issues between data and instruction accesses 


How far ahead of the current point of execution instructions are fetched from is IMPLEMENTATION DEFINED. Such 
prefetching can be either a fixed or a dynamically varying number of instructions, and can follow any or all possible 
future execution paths. For all types of memory: 


$ The PE might have fetched the instructions from memory at any time since the last Context synchronization 
event on that PE. 


a Any instructions fetched in this way might be executed multiple times, if this is required by the execution of 
the program, without being refetched from memory. In the absence ofa Context synchronization event, there 
is no limit on the number of times such an instruction might be executed without being refetched from 
memory. 


The Arm architecture requires the hardware to ensure coherency between instruction caches and memory, even for 
locations of shared memory. A write has been made coherent with an instruction fetch of a shareability domain 
when: 


CTR_ELO.{DIC, IDC} == {0, 0} 


The location written to has been cleaned to the Point of unification (PoU) from the data cache, and 
that clean is complete for the shareability domain. Subsequently the location has been invalidated 
to the Point of unification (PoU) from the instruction cache, and that invalidation is complete for 
the shareability domain. 


CTR_ELO.{DIC, IDC} == {1, 0} 
The location written to has been cleaned to the Point of unification (PoU) from the data cache, and 
that clean is complete for the shareability domain. 

CTR_ELO.{DIC, IDC} == {0, 1} 


The write is complete for the shareability domain. Subsequently the location has been invalidated 
to the Point of unification (PoU) from the instruction cache, and that invalidation is complete for 
the shareability domain. 


CTR_ELO.{DIC, IDC} == {1, 1} 


The write is complete for the shareability domain. 


If software requires coherency between instruction execution and memory, it must manage this coherency using 
Context synchronization events and cache maintenance instructions. The following code sequence can be used to 
allow a PE to execute code that the same PE has written. 


; Coherency example for data and instruction accesses within the same Inner Shareable domain. 
; Enter this code with <Wt> containing a new 32-bit instruction, 
; to be held in Cacheable space at a location pointed to by Xn. 


STR Wt, [Xn] 
DC CVAU, Xn ; Clean data cache by VA to point of unification (PoU) 
DSB ISH ; Ensure visibility of the data cleaned from cache 
IC IVAU, Xn ; Invalidate instruction cache by VA to PoU 
DSB ISH ; Ensure completion of the invalidations 
ISB ; Synchronize the fetched instruction stream 
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Note 


° If this sequence is not executed between writing data to a location and executing the instruction at that 
location, the lack of coherency between instruction caches and memory means that the instructions that are 
executed might be the old instruction or the updated instruction, and which is used can arbitrarily vary during 
execution. It must not be assumed by software, before the synchronization sequence is executed, that when 
the updated instruction has been seen, the old instruction will not be seen again. 


7 For Non-cacheable or Write-Through accesses, the clean data cache by VA instruction is not required. 
However, the invalidate instruction cache instruction is required because the Armv8-A AArch64 architecture 
allows Non-cacheable accesses to be held in an instruction cache. See Non-cacheable accesses and 
instruction caches on page D4-2477. 


° This code can be used when the thread of execution modifying the code is the same thread of execution that 
is executing the code. The Armv8 architecture limits the set of instructions that can be executed by one thread 
of execution as they are being modified by another thread of execution without requiring explicit 
synchronization. See Concurrent modification and execution of instructions on page B2-112. 


e The system software controls whether these cache maintenance instructions are available to the application 
level by setting SCTLR_EL1.UCI. 





B2.4.5 Preloading caches 
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The Arm architecture provides memory system hints PRFM, LDNP, and STNP that software can use to communicate the 
expected use of memory locations to the hardware. The memory system can respond by taking actions that are 
expected to speed up the memory accesses if they occur. The effect of these memory system hints is 
IMPLEMENTATION DEFINED. Typically, implementations use this information to bring the data or instruction 
locations into caches. 


The Preload instructions are hints, and so implementations can treat them as NOPs without affecting the functional 
behavior of the device. The instructions cannot generate synchronous Data Abort exceptions, but the resulting 
memory system operations might, under exceptional circumstances, generate an asynchronous External abort, 
which is taken using an SError interrupt exception. For more information, see ZSS encoding for an exception from 
a Data Abort on page D13-2943. 


PrefetchHint{} defines the prefetch hint types. 


The Hint_Prefetch() function signals to the memory system that memory accesses of the type hint to or from the 
specified address are likely to occur in the near future. The memory system might take some action to speed up the 
memory accesses when they do occur, such as preloading the specified address into one or more caches as indicated 
by the innermost cache level target and non-temporal hint stream. 


For more information on PRFM and Load/Store instructions that provide hints to the memory system, see Prefetch 
memory on page C3-208 and Load/Store SIMD and Floating-point Non-temporal pair on page C3-206. 
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B2.5 Alignment support 


This section describes alignment support. It contains the following subsections: 


. Instruction alignment. 
. Alignment of data accesses. 
B2.5.1 Instruction alignment 


A64 instructions must be word-aligned. 


Attempting to fetch an instruction from a misaligned location results in a PC alignment fault. See PC alignment 
checking on page D1-2287. 


B2.5.2 Alignment of data accesses 


An unaligned access to any type of Device memory causes an Alignment fault. 


Unaligned accesses to Normal memory 


The behavior of unaligned accesses to Normal memory is dependent on all of the following: 
: The instruction causing the memory access. 

° The memory attributes of the accessed memory. 

° The value of SCTLR_ELx{A, nAA}. 

° Whether or not ARMv8.4-LSE is implemented. 


Load or Store of Single or Multiple registers 


For all instructions that load or store single or multiple registers, but not Load-Exclusive, Store-Exclusive, 
Load-Acquire/Store-Release and Atomic instructions, if the address that is accessed is not aligned to the size of the 
data element being accessed, then: 


When the value of SCTLR_ELx.A applicable to the current Exception level is 1, an Alignment fault is generated. 


When the value of SCTLR_ELx.A applicable to the current Exception level is 0: 
° An unaligned access is performed. 


. If ARMv8.4-LSE is not implemented, the access is not guaranteed to be single-copy atomic except at the byte 
access level. 


. If ARMv8.4-LSE is implemented: 


—  Ifallthe bytes of the memory access lie within a 16-byte quantity aligned to 16 bytes and are to Normal 
Inner Write-Back, Outer Write-Back Cacheable memory, the memory access is single-copy atomic. 
For a Load-Pair or Store-Pair, including load non-temporal pair, instructions the entire memory access 
will be single-copy atomic. 


— Ifall the bytes of the memory accessed do not lie within a 16-byte quantity aligned to 16 bytes or the 
access is not to Normal Inner Write-Back, Outer Write-Back Cacheable memory the access is not 
guaranteed to be single-copy atomic except at the byte access level. 


For these instructions, the definition of an unaligned access is based on the size of the accessed elements, not the 
overall size of the memory access. This affects SIMD element and structure loads and stores, and also Load/store 
pair instructions. 


Load-Exclusive/ Store-Exclusive and Atomic instructions 


For Load-Exclusive/Store-Exclusive, and Atomic instructions including those with acquire or acquire-release 
semantics: 


When the value of SCTLR_ELx.A applicable to the current Exception level is 1, an Alignment fault is generated. 


When the value of SCTLR_ELx.A applicable to the current Exception level is 0: 
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If ARMv8.4-LSE is not implemented, these instructions generate an Alignment fault if the address being accessed 
is not aligned to the size of the data structure being accessed. 


If ARMv8.4-LSE is implemented, then: 


à Ifall the bytes ofthe memory access lie within a 16-byte quantity aligned to 16 bytes and are to Normal Inner 
Write-Back, Outer Write-Back Cacheable memory, an unaligned access is performed. 


° Ifall the bytes of the memory access do not lie within a 16-byte quantity aligned to 16-bytes, or the memory 
access is not to Normal Inner Write-Back, Outer Write-Back Cacheable memory, then it is an 
IMPLEMENTATION DEFINED choice of either of the following: 


— An unaligned access is performed meeting all of the semantics of the instruction. 


— An Alignment fault is generated. 
Where memory access is performed, then it is single-copy atomic. 


For these instructions, the definition of an unaligned access is based on the overall access size. 


Non-atomic Load-Acquire/Store-Release instructions 

For Load-Acquire/Store-Release instructions which do not have exclusive or atomic behaviors: 

When the value of SCTLR_ELx.A applicable to the current Exception level is 1, an Alignment fault is generated. 
When the value of SCTLR_ELx.A applicable to the current Exception level is 0: 


If ARMv8.4-LSE is not implemented, then these instructions generate an Alignment fault if the address being 
accessed is not aligned to the size of the data structure being accessed. 


If ARMv8.4-LSE is implemented, then: 

$ If the memory access is not to Normal Inner Write-Back or Outer Write-Back Cacheable memory, then it is 
an IMPLEMENTATION DEFINED choice of either of the following: 
— An unaligned access is performed meeting all of the semantics of the instruction. 
— An Alignment fault is generated. 

° If all of the bytes of the memory access do not lie within a 16-byte quantity aligned to 16 bytes then the 
following applies: 
—  IfSCTLR_ELx.nAA applicable to the current Exception level is 0 an Alignment fault is generated. 


—  IfSCTLR_ELx.nAA applicable to the current Exception level is 1 then an unaligned access is 
performed which is not guaranteed to be single-copy atomic except at the byte access level. 


In this case, the architecture does no define the order of the different transactions of the access defined by the 
single instructions relative to each other. 





Note 
à Unaligned accesses typically take additional cycles to complete compared to a naturally-aligned access. 
$ An operation that is not single-copy atomic above the byte level can abort on any memory access that it makes 


and can abort on more than one access. This means that an unaligned access that occurs across a page 
boundary can generate an abort on either side of the page boundary. 
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B2.6 Endian support 


General description of endianness in the Arm architecture describes the relationship between endianness and 
memory addressing in the Arm architecture. 


The following subsections then describe the endianness schemes supported by the architecture: 
° Instruction endianness on page B2-141. 

° Data endianness on page B2-141. 

° Endianness of memory-mapped peripherals on page B2-142. 


B2.6.1 General description of endianness in the Arm architecture 


This section only describes memory addressing and the effects of endianness for data elements up to quadwords of 
128 bits. However, this description can be extended to apply to larger data elements. 


For an address A, Figure B2-2 shows, for big-endian and little-endian memory systems, the relationship between: 
° The quadword at address A. 
7 The doubleword at address A and A+8. 


. The words at addresses A, A+4, A+8, and A+12. 





. The halfwords at addresses A, A+2, A+4, A+6, A+8, A+10, A+12, and A+14. 





e The bytes at addresses A, A+1, A+2, A+3, A+4, A+5, A+6, A+7, A+8, A+9, A+10, A+11, A+12, A+13, 
A+14, and A+15. 





The terms in Figure B2-2 have the following definitions: 


BA Byte at address A. 
HW_A Halfword at address A. 
MSByte Most significant byte. 
LSByte Least significant byte. 


Big-endian memory system 
MSByte Incrementing byte address: > LSByte 








Quadword at address A 


Doubleword at address A Doubleword at address A+8 


Word at address A Word at address A+4 Word at address A+8 Word at address A+12 


HW_A+2 HW_A+4 HW_A+6 HW_A+8 HW_A+10 | HW_A+12 | HW A+14 


Little-endian memory system 











MSByte« Incrementing byte address LSByte 


Quadword at address A 
Doubleword at address A+8 Doubleword at address A 


Word at address A+12 Word at address A+8 Word at address A+4 Word at address A 


Hw A+14 | HW.AH2 | HW AHO HW_A+8 HW_A+6 HW_A+4 HW_A+2 





Figure B2-2 Endianness relationships 
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The big-endian and little-endian mapping schemes determine the order in which the bytes of a quadword, 
doubleword, word, or halfword are interpreted. For example, a load of a word from address 0x1000 always results 
in an access to the bytes at memory locations 0x1000, 0x1001, @x1002, and 0x1003. The endianness mapping scheme 
determines the significance of these 4 bytes. 


B2.6.2 Instruction endianness 


In Armv8-A, A64 instructions have a fixed length of 32 bits and are always little-endian. 


B2.6.3 Data endianness 
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SCTLR_EL1.EOE, configurable at EL1 or higher, determines the data endianness for execution at ELO. 
The data size used for endianness conversions: 


° Is the size of the data value that is loaded or stored for SIMD and floating-point register and general-purpose 
register loads and stores. 


. Is the size of the data element that is loaded or stored for SIMD element and data structure loads and stores. 
For more information, see Endianness in SIMD operations. 





Note 


This means the Armv8 architecture introduces a requirement for 128-bit endian conversions. 





Instructions to reverse bytes in a general-purpose register or a SIMD and floating-point 
register 


An application or device driver might have to interface to memory-mapped peripheral registers or shared memory 
structures that are not the same endianness as the internal data structures. Similarly, the endianness of the operating 
system might not match that of the peripheral registers or shared memory. In these cases, the PE requires an efficient 
method to transform explicitly the endianness of the data. 


Table B2-2 shows the instructions that provide this functionality: 


Table B2-2 Byte reversal instructions 























Function Instructions Notes 

Reverse bytes in 32-bit word or words? REV32 For use with general-purpose registers 

Reverse bytes in whole register REV For use with general-purpose registers 

Reverse bytes in 16-bit halfwords REV16 For use with general-purpose registers 

Reverse elements in doublewords, vector REV64 For use with SIMD and floating-point registers 
Reverse elements in words, vector REV32 For use with SIMD and floating-point registers 
Reverse elements in halfwords, vector REV16 For use with SIMD and floating-point registers 





a. Can operate on multiple words. 


Endianness in SIMD operations 


SIMD element Load/Store instructions transfer vectors of elements between memory and the SIMD and 
floating-point register file. An instruction specifies both the length of the transfer and the size of the data elements 
being transferred. This information is used to load and store data correctly in both big-endian and little-endian 
systems. 


For example: 
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LD1 {V0.4H}, [X1] 


This loads a 64-bit register with four 16-bit values. The four elements appear in the register in array order, with the 
lowest indexed element fetched from the lowest address. The order of bytes in the elements depends on the 
endianness configuration, as shown in Figure B2-3. Therefore, the order of the elements in the registers is the same 
regardless of the endianness configuration. 


64-bit register containing four 16-bit elements 








0 [A[15:8] 
1 |AI7:0] 
2 |B[15:8] 
3 |B[7:0] 
4 
5 
6 














C[15:8] 
C[7:0] 
D[15:8] 
7 |D[7:0] 


LD1 {VO.4H}, [X1] LD1 {V0.4H}, [X1] 





























NOOR WN = O 





s kan 
Memory system with Memory system with 
little-endian addressing (LE) big-endian addressing (BE) 


Figure B2-3 SIMD byte order example 


The BigEndian() pseudocode function determines the current endianness of the data. 


The BigEndianReverse() pseudocode function reverses the endianness of a bitstring. 


The BigEndian() and BigEndianReverse() functions are defined in Chapter J1 Armv8 Pseudocode. 


B2.6.4 Endianness of memory-mapped peripherals 


All memory-mapped peripherals defined in the Arm architecture must be little-endian. 


Peripherals to which this requirement applies include: 


B2-142 


Memory-mapped register interfaces to a debugger, or to a cross-trigger interface, see Chapter H8 About the 
External Debug Registers. 


The memory-mapped register interface to the system level implementation of the Generic Timer, see 
Chapter I2 System Level Implementation of the Generic Timer. 


A memory-mapped register interface to the Performance Monitors, see Chapter 13 Recommended External 
Interface to the Performance Monitors. 


A memory-mapped register interface to the Activity Monitors, see Chapter 14 Recommended External 
Interface to the Activity Monitors. 


Memory-mapped register interfaces to an Arm Generic Interface Controller, see the ARM” Generic Interrupt 
Controller Architecture Specification, GIC architecture version 3.0 and version 4.0. 


The memory-mapped register interface to an Arm trace component. See, for example, the ARM® Embedded 
Trace Macrocell Architecture Specification, ETMv4. 
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B2.7 Memory types and attributes 


In Armv8 the ordering of accesses for addresses in memory, referred to as the memory order model, is defined by 
the memory attributes. The following sections describe this model: 


Normal memory. 
Device memory on page B2-147. 


Memory access restrictions on page B2-152. 


B2.7.1 Normal memory 


ARM DDI 0487E.a 
ID070919 


The Normal memory type attribute applies to most memory in a system. It indicates that the hardware is permitted 
by the architecture to perform Speculative data read accesses to these locations, regardless of the access permissions 
for these locations. 


The Normal memory type has the following properties: 


A write to a memory location with the Normal attribute completes in finite time. This means that it is globally 
observed for the shareability domain of the memory location in finite time. For a Non-cacheable location, the 
location is observed by all observers in finite time. 


A completed write to a memory location with the Normal attribute is globally observed for the shareability 
domain of the memory location in finite time without the need for explicit cache maintenance instructions or 
barriers. For a Non-cacheable location, the completed write is globally observed for all observers in finite 
time without the need for explicit cache maintenance instructions or barriers. 


Writes to a memory location with the Normal memory attribute that are Non-cacheable must reach the 
endpoint for that location in the memory system in finite time. 


Unaligned memory accesses can access Normal memory if the system is configured to generate such 
accesses. 


There is no requirement for the memory system beyond the PE to be able to identify the elements accessed 
by multi-register Load/Store instructions. See Multi-register loads and stores that access Normal memory on 
page B2-147. 





Note 


The Normal memory attribute is appropriate for locations of memory that are idempotent, meaning that they 
exhibit all of the following properties: 


— Read accesses can be repeated with no side-effects. 
— Repeated read accesses return the last value written to the resource being read. 
— Read accesses can fetch additional memory locations with no side-effects. 


— Write accesses can be repeated with no side-effects if the contents of the location accessed are 
unchanged between the repeated writes or as the result of an exception, as described in this section. 


— Unaligned accesses can be supported. 


— Accesses can be merged before accessing the target memory system. 


An instruction that generates a sequence of accesses as described in Atomicity in the Arm architecture on 
page B2-110 might be abandoned as a result of an exception being taken during the sequence of accesses. On 
return from the exception the instruction is restarted, and therefore, one or more of the memory locations 
might be accessed multiple times. This can result in repeated write accesses to a location that has been 
changed between the write accesses. 





For accesses to Normal memory, a DMB instruction is required to ensure the required ordering. 


The following sections describe the other attributes for Normal memory: 


Shareable Normal memory on page B2-144. 
Non-shareable Normal memory on page B2-145. 
Cacheability attributes for Normal memory on page B2-145. 
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See also: 

. Multi-register loads and stores that access Normal memory on page B2-147. 
. Atomicity in the Arm architecture on page B2-110. 

e Memory barriers on page B2-124. 

. Concurrent modification and execution of instructions on page B2-112. 


Shareable Normal memory 


A Normal memory location has a Shareability attribute that is one of: 


s Inner Shareable, meaning it applies across the Inner Shareable shareability domain. 

° Outer Shareable, meaning it applies across both the Inner Shareable and the Outer Shareable shareability 
domains. 

. Non-shareable. 


The shareability attributes define the data coherency requirements of the location, that hardware must enforce. They 
do not affect the coherency requirements of instruction fetches, see Synchronization and coherency issues between 
data and instruction accesses on page B2-136. 


Note 


s System designers can use the shareability attribute to specify the locations in Normal memory for which 
coherency must be maintained. However, software developers must not assume that specifying a memory 
location as Non-shareable permits software to make assumptions about the incoherency of the location 
between different PEs in a shared memory system. Such assumptions are not portable between different 
multiprocessing implementations that might use the shareability attribute. Any multiprocessing 
implementation might implement caches that are shared, inherently, between different processing elements. 





: This architecture assumes that all PEs that use the same operating system or hypervisor are in the same Inner 
Shareable shareability domain. 





Shareable, Inner Shareable, and Outer Shareable Normal memory 
The Arm architecture abstracts the system as a series of Inner and Outer Shareability domains. 


Each Inner Shareability domain contains a set of observers that are data coherent for each member of that set for 
data accesses with the Inner Shareable attribute made by any member of that set. 


Each Outer Shareability domain contains a set of observers that are data coherent for each member of that set for 
data accesses with the Outer Shareable attribute made by any member of that set. 


The following properties also hold: 


° Each observer is only a member of a single Inner Shareability domain. 
` Each observer is only a member of a single Outer Shareability domain. 
7 All observers in an Inner Shareability domain are always members of the same Outer Shareability domain. 


This means that an Inner Shareability domain is a subset of an Outer Shareability domain, although it is not 
required to be a proper subset. 


Note 


. Because all data accesses to Non-cacheable locations are data coherent to all observers, Non-cacheable 
locations are always treated as Outer Shareable. 





; The Inner Shareable domain is expected to be the set of PEs controlled by a single hypervisor or operating 
system. 





The details of the use of the shareability attributes are system-specific. Example B2-1 on page B2-145 shows how 
they might be used. 
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Example B2-1 Use of shareability attributes 


In an implementation, a particular subsystem with two clusters of PEs has the requirement that: 


e In each cluster, the data caches or unified caches of the PEs in the cluster are transparent for all data accesses 
to memory locations with the Inner Shareable attribute. 


. However, between the two clusters, the caches: 
— Are not required to be coherent for data accesses that have only the Inner Shareable attribute. 
— Are coherent for data accesses that have the Outer Shareable attribute. 


In this system, each cluster is in a different shareability domain for the Inner Shareable attribute, but all components 
of the subsystem are in the same shareability domain for the Outer Shareable attribute. 


A system might implement two such subsystems. If the data caches or unified caches of one subsystem are not 
transparent to the accesses from the other subsystem, this system has two Outer Shareable shareability domains. 


Having two levels of shareability means system designers can reduce the performance and power overhead for 
shared memory locations that do not need to be part of the Outer Shareable shareability domain. 


For shareable Normal memory, the Load-Exclusive and Store-Exclusive synchronization primitives take account of 
the possibility of accesses by more than one observer in the same Shareability domain. 


Non-shareable Normal memory 


For Normal memory locations, the Non-shareable attribute identifies Normal memory that is likely to be accessed 
only by a single PE. 


A location in Normal memory with the Non-shareable attribute does not require the hardware to make data accesses 
by different observers coherent, unless the memory is Non-cacheable. For a Non-shareable location, if other 
observers share the memory system, software must use cache maintenance instructions, if the presence of caches 
might lead to coherency issues when communicating between the observers. This cache maintenance requirement 
is in addition to the barrier operations that are required to ensure memory ordering. 


For Non-shareable Normal memory, it is IMPLEMENTATION DEFINED whether the Load-Exclusive and 
Store-Exclusive synchronization primitives take account of the possibility of accesses by more than one observer. 


Cacheability attributes for Normal memory 


In addition to being Outer Shareable, Inner Shareable or Non-shareable, each region of Normal memory is assigned 
a Cacheability attribute that is one of: 


° Write-Through Cacheable. 
. Write-Back Cacheable. 
. Non-cacheable. 


Also, for Write-Through Cacheable and Write-Back Cacheable Normal memory regions: 
. A region might be assigned cache allocation hints for read and write accesses. 


. It is IMPLEMENTATION DEFINED whether the cache allocation hints can have an additional attribute of 
Transient or Non-transient. 


For more information see Cacheability, cache allocation hints, and cache transient hints on page D4-2474. 


A memory location can be marked as having different cacheability attributes, for example when using aliases in a 
VA to PA mapping: 


s If the attributes differ only in the cache allocation hint, this does not affect the behavior of accesses to that 
location. 
è For other cases, see Mismatched memory attributes on page B2-153. 
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The cacheability attributes provide a mechanism of coherency control with observers that lie outside the shareability 
domain of a region of memory. In some cases, the use of Write-Through Cacheable or Non-cacheable regions of 
memory might provide a better mechanism for controlling coherency than the use of hardware coherency 
mechanisms or the use of cache maintenance routines. To this end, the architecture requires the following properties 
for Non-cacheable or Write-Through Cacheable memory: 


G A completed write to a memory location that is Non-cacheable or Write-Through Cacheable for a level of 
cache made by an observer accessing the memory system inside the level of cache is visible to all observers 
accessing the memory system outside the level of cache without the need of explicit cache maintenance. 


° A completed write to a memory location that is Non-cacheable for a level of cache made by an observer 
accessing the memory system outside the level of cache is visible to all observers accessing the memory 
system inside the level of cache without the need of explicit cache maintenance. 


° For accesses to Normal memory that is Non-cacheable, a DMB instruction introduces a Barrier-ordered-before 
relation on all accesses to a single peripheral or block of memory that is of IMPLEMENTATION DEFINED size. 
For more information, see Ordering and observability on page B2-116. 





Note 


Implementations can use the cache allocation hints to indicate a probable performance benefit of caching. For 
example, a programmer might know that a piece of memory is not going to be accessed again and would be better 
treated as Non-cacheable. The distinction between memory regions with attributes that differ only in the cache 
allocation hints exists only as a hint for performance. 





For Normal memory, the Arm architecture provides cacheability attributes that are defined independently for each 
of two conceptual levels of cache, the inner and the outer cache. The relationship between these conceptual levels 
of cache and the implemented physical levels of cache is IMPLEMENTATION DEFINED, and can differ from the 
boundaries between the Inner and Outer Shareability domains. However: 


s Inner refers to the innermost caches, meaning the caches that are closest to the PE, and always includes the 
lowest level of cache. 

: No cache that is controlled by the Inner cacheability attributes can lie outside a cache that is controlled by the 
Outer cacheability attributes. 

. An implementation might not have any outer cache. 


Example B2-2, Example B2-3 on page B2-147, and Example B2-4 on page B2-147 describe the possible ways of 
implementing a system with three levels of cache, level 1 (L1) to level 3 (L3). 


Note 
° L1 cache is the level closest to the PE, see Memory hierarchy on page B2-133. 





: When managing coherency, system designs must consider both the inner and outer cacheability attributes, as 
well as the shareability attributes. This is because hardware might have to manage the coherency of caches 
at one conceptual level, even when another conceptual level has the Non-cacheable attribute. 


Example B2-2 Implementation with two inner and one outer cache levels 


Implement the three levels of cache in the system, L1 to L3, with: 
à The Inner cacheability attribute applied to L1 and L2 cache. 
d The Outer cacheability attribute applied to L3 cache. 
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Example B2-3 Implementation with three inner and no outer cache levels 


Implement the three levels of cache in the system, L1 to L3, with the Inner cacheability attribute applied to L1, L2, 
and L3 cache. Do not use the Outer cacheability attribute. 


Example B2-4 Implementation with one inner and two outer cache levels 


Implement the three levels of cache in the system, L1 to L3, with: 
s The Inner cacheability attribute applied to L1 cache. 
è The Outer cacheability attribute applied to L2 and L3 cache. 


Multi-register loads and stores that access Normal memory 


For all instructions that load or store more than one general-purpose register from an Exception level there is no 
requirement for the memory system beyond the PE to be able to identify the size of the elements accessed by these 
load or store instructions. 


For all instructions that load or store more than one general-purpose register from an Exception level the order in 
which the registers are accessed is not defined by the architecture. 


For all instructions that load or store one or more SIMD&FP registers from an Exception level, there is no 
requirement for the memory system beyond the PE to be able to identify the size of the element accessed by these 
load or store instructions. 


B2.7.2 Device memory 


ARM DDI 0487E.a 
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The Device memory type attributes define memory locations where an access to the location can cause side-effects, 
or where the value returned for a load can vary depending on the number of loads performed. Typically, the Device 
memory attributes are used for memory-mapped peripherals and similar locations. 


The attributes for Armv8 Device memory are: 
Gathering Identified as G or nG, see Gathering on page B2-149. 
Reordering Identified as R or nR, see Reordering on page B2-150. 
Early Write Acknowledgement 
Identified as E or nE, see Early Write Acknowledgement on page B2-151. 

The Armv8 Device memory types are: 
Device-nGnRnE Device non-Gathering, non-Reordering, No Early write acknowledgement. 

Equivalent to the Strongly-ordered memory type in earlier versions of the architecture. 
Device-nGnRE Device non-Gathering, non-Reordering, Early Write Acknowledgement. 

Equivalent to the Device memory type in earlier versions of the architecture. 


Device-nGRE Device non-Gathering, Reordering, Early Write Acknowledgement. 


Armv§8 adds this memory type to the translation table formats found in earlier versions of 
the architecture. The use of barriers is required to order accesses to Device-nGRE memory. 


Device-GRE Device Gathering, Reordering, Early Write Acknowledgement. 


Armv8 adds this memory type to the translation table formats found in earlier versions of 
the architecture. Device-GRE memory has the fewest constraints. It behaves similar to 
Normal memory, with the restriction that Speculative accesses to Device-GRE memory is 
forbidden. 
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Collectively these are referred to as any Device memory type. Going down the list, the memory types are described 
as getting weaker; conversely the going up the list the memory types are described as getting stronger. 


Note 





As the list of types shows, these additional attributes are hierarchical. For example, a memory location that 
permits Gathering must also permit Reordering and Early Write Acknowledgement. 


The architecture does not require an implementation to distinguish between each of these memory types and 
Arm recognizes that not all implementations will do so. The subsection that describes each of the attributes, 
describes the implementation rules for the attribute. 


Strongly-ordered memory. This is the equivalent of the Device-nGnRnE memory type. 
— Device memory. This is the equivalent of the Device-nGnRE memory type. 


All of these memory types have the following properties: 


Speculative data accesses are not permitted to any memory location with any Device memory attribute. This 
means that each memory access to any Device memory type must be one that would be generated by a simple 
sequential execution of the program. 


The following exceptions to this apply: 


— Reads generated by the SIMD and floating-point instructions can access bytes that are not explicitly 
accessed by the instruction if the bytes accessed are in a 16-byte window, aligned to 16-bytes, that 
contains at least one byte that is explicitly accessed by the instruction. 


— For Device memory with the Gathering attribute, reads generated by the LDNP instructions are 
permitted to access bytes that are not explicitly accessed by the instruction, provided that the bytes 
accessed are in a 128-byte window, aligned to 128-bytes, that contains at least one byte that is 
explicitly accessed by the instruction. 


— Where a load or store instruction performs a sequence of memory accesses, as opposed to one 
single-copy atomic access as defined in the rules for single-copy atomicity, these accesses might occur 
multiple times as a result of executing the load or store instruction. See Properties of single-copy 
atomic accesses on page B2-112. 


Note 


— Aninstruction that generates a sequence of accesses as described in Atomicity in the Arm architecture 
on page B2-110 might be abandoned as a result of an exception being taken during the sequence of 
accesses. On return from the exception, the instruction is restarted, and therefore, one or more of the 
memory locations might be accessed multiple times. This can result in repeated accesses to a location 
where the program only defines a single access. For this reason, Arm strongly recommends that no 
accesses to Device memory are performed from a single instruction that spans the boundary of a 
translation granule or which in some other way could lead to some of the accesses being aborted. 





— Write speculation that is visible to other observers is prohibited for all memory types. 





A write to a memory location with any Device memory attribute completes in finite time. This means that it 
is globally observed for all observers in the system in finite time. 


Ifa location with any Device memory attribute changes without an explicit write by an observer, this change 
must also be globally observed for all observers in the system in finite time. Such a change might occur in a 
peripheral location that holds status information. 


A completed write to a memory location with any Device memory attribute is globally observed for all 
observers in finite time without the need for explicit maintenance. 


Data accesses to memory locations are coherent for all observers in the system, and correspondingly are 
treated as being Outer Shareable. 


A memory location with any Device memory attribute cannot be allocated into a cache. 


Writes to a memory location with any Device memory attribute must reach the endpoint for that address in 
the memory system in finite time. Typically, the endpoint is a peripheral or some physical memory. 
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For accesses to any Device memory type, a DMB instruction introduces a Barrier-ordered-before relation on all 
accesses to a single peripheral or block of memory that is of IMPLEMENTATION DEFINED size. For more 
information, see Ordering and observability on page B2-116. 


All accesses to memory with any Device memory attribute must be aligned. Any unaligned access generates 
an Alignment fault at the first stage of translation that defined the location as being Device. 





Note 


In the EL1&0 translation regime in systems where HCR_EL2.TGE==1 and HCR_EL2.DC==0, any 
Alignment fault that results from the fact that all locations are treated as Device is a fault at the first stage of 
translation. This causes ESR_EL2.1SS[24] to be 0. 


Hardware does not prevent speculative instruction fetches from a memory location with any of the Device 
memory attributes unless the memory location is also marked as Execute-never for all Exception levels. 


Note 


This means that to prevent speculative instruction fetches from memory locations with Device memory 
attributes, any location that is assigned any Device memory type must also be marked as Execute-never for 
all Exception levels. Failure to mark a memory location with any Device memory attribute as Execute-never 
for all Exception levels is a programming error. 





See also Memory access restrictions on page B2-152. 


The memory types for translation table walks cannot be defined as any Device memory type within the TCR_ELx. 
For the EL1&0 translation regime, the memory accesses made during a stage 1 translation table walk are subject to 
a stage 2 translation, and as a result of this second stage of translation, the accesses from the first stage translation 
table walk might be made to memory locations with any Device memory type. These accesses might be made 
speculatively. When the value of the HCR_EL2.PTW bit is 1, a stage 2 permission fault is generated if a first stage 
translation table walk is made to any Device memory type. 


— Note 


In general, making a translation table walk to any Device memory type is the result of a programming error. 





For instruction fetches, if branches cause the program counter to point to an area of memory with the Device 
attribute which is not marked as Execute-never for the current Exception level, an implementation can either: 


Treat the instruction fetch as if it were to a memory location with the Normal Non-cacheable attribute. 
Take a Permission fault. 


Gathering 


In the Device memory attribute: 


G 
nG 


Indicates that the location has the Gathering attribute. 
Indicates that the location does not have the Gathering attribute, meaning it is non-Gathering. 


The Gathering attribute determines whether it is permissible for either: 


Multiple memory accesses of the same type, read or write, to the same memory location to be merged into a 
single transaction. 


Multiple memory accesses of the same type, read or write, to different memory locations to be merged into 
a single memory transaction on an interconnect. 





Note 


This also applies to writebacks from the cache, whether caused by a Natural eviction or as a result of a cache 
maintenance instruction. 
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For memory types with the Gathering attribute, either of these behaviors is permitted, provided that the ordering and 
coherency rules of the memory location are followed. 


For memory types with the non-Gathering attribute, neither of these behaviors is permitted. As a result: 


. The number of memory accesses that are made corresponds to the number that would be generated by a 
simple sequential execution of the program. 


$ All accesses occur at their programmed size, except that there is no requirement for the memory system 
beyond the PE to be able to identify the elements accessed by multi-register Load/Store instructions. See 
Multi-register loads and stores that access Device memory on page B2-152. 


Gathering between memory accesses separated by a memory barrier that affects those memory accesses is not 
permitted. 


Gathering between two memory accesses generated by a Load-Acquire/Store-Release is not permitted. 


A read from a memory location with the non-Gathering attribute cannot come from a cache or a buffer, but must 
come from the endpoint for that address in the memory system. Typically this is a peripheral or physical memory. 





Note 


: A read from a memory location with the Gathering attribute can come from intermediate buffering of a 
previous write, provided that: 


— The accesses are not separated by a DMB or DSB barrier that affects both of the accesses. 


— The accesses are not separated by other ordering constructions that require that the accesses are in 
order. Such a construction might be a combination of Load-Acquire and Store-Release. 


— The accesses are not generated by a Store-Release instruction. 


: The Arm architecture only defines programmer visible behavior. Therefore, gathering can be performed if a 
programmer cannot tell whether gathering has occurred. 





An implementation is permitted to perform an access with the Gathering attribute in a manner consistent with the 
requirements specified by the non-Gathering attribute. 


An implementation is not permitted to perform an access with the non-Gathering attribute in a manner consistent 
with the relaxations allowed by the Gathering attribute. 


Reordering 
In the Device memory attribute: 


R Indicates that the location has the Reordering attribute. Accesses to the location can be reordered 
within the same rules that apply to accesses to Normal Non-cacheable memory. All memory types 
with the Reordering attribute have the same ordering rules as accesses to Normal Non-cacheable 
memory, see Ordering relations on page B2-118. 


nR Indicates that the location does not have the Reordering attribute, meaning it is non-Reordering. 


— Note 


Some interconnect fabrics, such as PCle, perform very limited reordering, which is not important 
for the software usage. It is outside the scope of the Arm architecture to prohibit the use of a 
non-Reordering memory type with these interconnects. 





For all memory types with the non-Reordering attribute, the order of memory accesses arriving at a single peripheral 
of IMPLEMENTATION DEFINED size, as defined by the peripheral, must be the same order that occurs in a simple 
sequential execution of the program. That is, the accesses appear in program order. This ordering applies to all 
accesses using any of the memory types with the non-Reordering attribute. As a result, if there is a mixture of 
Device-nGnRE and Device-nGnRnE accesses to the same peripheral, these occur in program order. If the memory 
accesses are not to a peripheral, then this attribute imposes no restrictions. 
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Note 


$ The IMPLEMENTATION DEFINED size of the single peripheral is the same as applies for the ordering guarantee 
provided by the DMB instruction. 





à The Arm architecture only defines programmer visible behavior. Therefore, reordering can be performed if 
a programmer cannot tell whether reordering has occurred. 


$ The non-Reordering property is only required by the architecture to apply the order of arrival of accesses to 
a single memory-mapped peripheral of an IMPLEMENTATION DEFINED size, and is not required to have an 
impact on the order of observation of memory accesses to SDRAM. For this reason, there is no effect of the 
non-Reordering attribute on the ordering relations described in Ordering and observability on page B2-116 
as part of the formal definition of the memory model. 





An implementation: 


s Is permitted to perform an access with the Reordering attribute in a manner consistent with the requirements 
specified by the non-Reordering attribute. 


° Is not permitted to perform an access with the non-Reordering attribute in a manner consistent with the 
relaxations allowed by the Reordering attribute. 


The non-Reordering attribute does not require any additional ordering, other than that which applies to Normal 
memory, between: 


: Accesses to one physical address with the non-Reordering attribute and accesses to a different physical 
address with the Reordering attribute. 


` Access to one physical address with the non-Reordering attribute and access to a different physical address 
to Normal memory. 


° Accesses with the non-Reordering attribute and accesses to different peripherals of IMPLEMENTATION 
DEFINED size. 


The non-Reordering attribute has no effect on the ordering of cache maintenance instructions, even if the memory 
location specified in the instruction has the non-Reordering attribute. 


Early Write Acknowledgement 


In the Device memory attribute: 
E Indicates that the location has the Early Write Acknowledgement attribute. 
nE Indicates that the location has the No Early Write Acknowledgement attribute. 


For memory system endpoints where the system architecture in which the PE is operating requires that 
acknowledgement of a write comes from the endpoint, assigning the No Early Write Acknowledgement attribute to 
a Device memory location guarantees that: 


° Only the endpoint of the write access returns a write acknowledgement of the access. 
: No earlier point in the memory system returns a write acknowledgement. 


This means that a DSB barrier instruction, executed by the PE that performed the write to the No Early Write 
Acknowledgement Location, completes only after the write has reached its endpoint in the memory system. 


Peripherals are an example of system endpoints that require that the acknowledgement of a write comes from the 
endpoint. 


Note 


° The Early Write Acknowledgement attribute only affects where the endpoint acknowledgement is returned 
from, and does not affect the ordering of arrival at the endpoint between accesses, which is determined by 
either the Device Reordering attribute, or the use of barriers to create order. 





z The areas of the physical memory map for which write acknowledgement from the endpoint is required is 
outside the scope of the Arm Architecture definition and must be defined as part of the system architecture 
in which the PE is operating. In particular, regions of memory handled as PCIe configuration writes are 
expected to support write acknowledgement from the endpoint. 
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Arm recognizes that not all areas of a physical memory map will be capable of supporting write 
acknowledgement from the endpoint. In particular, Arm expects that regions of memory handled as posted 
writes under PCIe will not support write acknowledgement from the endpoint. 


For maximum software compatibility, Arm strongly recommends that all peripherals for which standard 
software drivers expect that the use of a DSB instruction will determine that a write has reached its endpoint 
are placed in areas of the physical memory map that support write acknowledgement from the endpoint. 





Multi-register loads and stores that access Device memory 


For all instructions that load or store more than one general-purpose register from an Exception level there is no 
requirement for the memory system beyond the PE to be able to identify the size of the elements accessed by these 
load or store instructions. 


For all instructions that load or store more than one general-purpose register from an Exception level the order in 
which the registers are accessed is not defined by the architecture. This applies even to accesses to any type of 
Device memory. 


For all instructions that load or store one or more SIMD and floating-point registers from an Exception level, there 
is no requirement for the memory system beyond the PE to be able to identify the size of the element accessed by 
these load or store instructions, even for access to any type of Device memory. 


B2.7.3 Memory access restrictions 


The following restrictions apply to memory accesses: 


B2-152 


For accesses to any two bytes, p and q, that are generated by the same instruction: 


— The bytes p and q must have the same memory type and shareability attributes, otherwise the results 
are CONSTRAINED UNPREDICTABLE. For example, an LD1, ST1, or an unaligned load or store that spans 
the boundary between Normal memory and Device memory is CONSTRAINED UNPREDICTABLE. 


— Except for possible differences in the cache allocation hints, Arm deprecates having different 
cacheability attributes for bytes p and q. 


For the permitted CONSTRAINED UNPREDICTABLE behavior, see Crossing a page boundary with different 
memory types or Shareability attributes on page K1-7636. 


If the accesses of an instruction that causes multiple accesses to any type of Device memory cross an address 
boundary that corresponds to the smallest implemented translation granule, then behavior is CONSTRAINED 

UNPREDICTABLE, and Crossing a peripheral boundary with a Device access on page K1-7636 describes the 
permitted behaviors. For this reason, it is important that an access to a volatile memory device is not made 

using a single instruction that crosses an address boundary of the size of the smallest implemented translation 
granule. 





Note 


— The boundary referred to is between two Device memory regions that are both of the size of the 
smallest implemented translation granule and aligned to the size of the smallest implemented 
translation granule. 


— This restriction means it is important that an access to a volatile memory device is not made using a 
single instruction that crosses an address boundary of the size of the smallest implemented translation 
granule. 


—  Armexpects this restriction to constrain the placing of volatile memory devices in the system memory 
map, rather than expecting a compiler to be aware of the alignment of memory accesses. 
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Memory attributes are controlled by privileged software. For more information, see Chapter DS The AArch64 
Virtual Memory System Architecture. 


Physical memory locations are accessed with mismatched attributes if all accesses to the location do not use a 
common definition of all of the following attributes of that location: 


° Memory type, Device or Normal. 
7 Shareability. 
: Cacheability, for the same level of the inner or outer cache, but excluding any cache allocation hints. 


Collectively these are referred to as memory attributes. 





Note 


In this document, the terms location and memory location refer to any byte within the current coherency granule 
and are used interchangeably. 





When a memory Location is accessed with mismatched attributes, the only software visible effects are one or more 
of the following: 
š Uniprocessor semantics for reads and writes to that memory Location might be lost. This means: 


— Aread ofthe memory Location by one agent might not return the value most recently written to that 
memory Location by the same agent. 


— Multiple writes to the memory Location by one agent with different memory attributes might not be 
ordered in program order. 


s There might be a loss of coherency when multiple agents attempt to access a memory Location. 
à There might be a loss of properties derived from the memory type, as described in later bullets in this section. 
. If all Load-Exclusive/Store-Exclusive instructions executed across all threads to access a given memory 


Location do not use consistent memory attributes, the Exclusives monitor state becomes UNKNOWN. 


° Bytes written without the Write-Back cacheable attribute within the same Write-Back granule as bytes 
written with the Write-Back cacheable attribute might have their values reverted to the old values as a result 
of cache Write-Back. 


The loss of properties associated with mismatched memory type attributes refers only to the following properties of 
Device memory that are additional to the properties of Normal memory: 


° Prohibition of Speculative read accesses. 
7 Prohibition on Gathering. 
s Prohibition on reordering. 


For the following situations, when a physical memory Location is accessed with mismatched attributes, a more 
restrictive set of behaviors applies. The description of each situation also describes the behaviors that apply: 


1. If the only memory type mismatch associated with a memory Location across all users of the memory 
Location is between different types of Device memory, then all accesses might take the properties of the 
weakest Device memory type. 


2. Any agent that reads that memory Location using the same common definition of the Memory type, 
Shareability and Cacheability attributes is guaranteed to access it coherently, to the extent required by that 
common definition of the memory attributes, only if all the following conditions are met: 


s All writes are performed to an alias of the memory Location that uses the same definition of the 
Memory type, Shareability and Cacheability attributes. 
. Either: 


— Inthe EL1&0 translation regime, HCR_EL2.MIOCNCE has a value of 0. 


—  Allaliases with write permission have the Inner Cacheability attribute the same as the Outer 
Cacheability attribute. 
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. Either: 


— All writes are performed to an alias of the memory Location that has Inner Cacheability and 
Outer Cacheability attributes both as Non-cacheable. 


—  Allaliases to a memory Location use a definition of the Shareability attributes that encompasses 
all the agents with permission to access the Location. 


The possible software-visible effects caused by mismatched attributes for a memory Location are defined 
more precisely if all of the mismatched attributes define the memory Location as one of: 

° Any Device memory type. 

a Inner Non-cacheable, Outer Non-cacheable Normal memory. 


In these cases, the only permitted software-visible effects of the mismatched attributes are one or more of the 
following: 


° Possible loss of properties derived from the memory type when multiple agents attempt to access the 
memory Location. 


° Possible reordering of memory transactions to the same memory Location with different memory 
attributes, potentially leading to a loss of coherency or uniprocessor semantics. Any possible loss of 
coherency or uniprocessor semantics can be avoided by inserting DMB barrier instructions between 
accesses to the same memory Location that might use different attributes. 


Where there is a loss of the uniprocessor semantics, ordering, or coherency, the following approaches can be used: 


1. 


B2-154 


Ifthe mismatched attributes for a memory location all assign the same shareability attribute to a Location that 
has a cacheable attribute, any loss of uniprocessor semantics, ordering, or coherency within a shareability 
domain can be avoided by use of software cache management. To do so, software must use the techniques 
that are required for the software management of the ordering or coherency of cacheable Locations between 
agents in different shareability domains. This means: 


è Before writing to a cacheable Location not using the Write-Back attribute, software must invalidate, 
or clean, a Location from the caches if any agent might have written to the Location with the 
Write-Back attribute. This avoids the possibility of overwriting the Location with stale data. 


. After writing to a cacheable Location with the Write-Back attribute, software must clean the Location 
from the caches, to make the write visible to external memory. 


° Before reading the Location with a cacheable attribute, software must invalidate, or clean and 
invalidate, the Location from the caches, to ensure that any value held in the caches reflects the last 
value made visible in external memory. 


° Executing a DMB barrier instruction, with scope that applies to the common shareability of the accesses, 
between any accesses to the same cacheable Location that use different attributes. 


In all cases: 


è Location refers to any byte within the current coherency granule. 

. A clean and invalidate instruction can be used instead of a clean instruction, or instead of an invalidate 
instruction. 

. In the sequences outlined in this section, all cache maintenance instructions and memory transactions 


must be completed, or ordered by the use of barrier operations, if they are not naturally ordered by the 
use of a common address, see Ordering and completion of data and instruction cache instructions on 
page D4-2489. 


Note 


With software management of coherency, race conditions can cause loss of data. A race condition occurs 
when different agents write simultaneously to bytes that are in the same Location, and the invalidate, write, 
clean sequence of one agent overlaps with the equivalent sequence of another agent. A race condition also 
occurs if the first operation of either sequence is a clean, rather than an invalidate. 
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2: If the mismatched attributes for a Location mean that multiple cacheable accesses to the Location might be 
made with different shareability attributes, then uniprocessor semantics, ordering, and coherency are 
guaranteed only if: 


° Each PE that accesses the Location with a cacheable attribute performs a clean and invalidate of the 
Location before and after accessing that Location. 


° A DMB barrier with scope that covers the full shareability of the accesses is placed between any accesses 
to the same memory Location that use different attributes. 


Note 


The Note in rule 1 of this list, about possible race conditions, also applies to this rule. 





In addition, if multiple agents attempt to use Load-Exclusive or Store-Exclusive instructions to access a Location, 
and the accesses from the different agents have different memory attributes associated with the Location, the 
Exclusives monitor state becomes UNKNOWN. 


Arm strongly recommends that software does not use mismatched attributes for aliases of the same Location. An 
implementation might not optimize the performance of a system that uses mismatched aliases. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. B2-155 
Non-Confidential 


The AArch64 Application Level Memory Model 
B2.9 Synchronization and semaphores 


B2.9 


B2-156 


Synchronization and semaphores 


Armv8 provides non-blocking synchronization of shared memory, using synchronization primitives. The 
information in this section about memory accesses by synchronization primitives applies to accesses to both Normal 
memory and to any type of Device memory. 


Note 


Use of the Armv8 synchronization primitives scales for multiprocessing system designs. 








Table B2-3 shows the synchronization primitives and the associated CLREX instruction. 


Table B2-3 Synchronization primitives and associated instruction, A64 instruction set 
































Transaction size Additional semantics Load-Exclusive? Store-Exclusive2 Other@ 

Byte = LDXRB STXRB - 
Load-Acquire/Store-Release LDAXRB STLXRB - 

Halfword - LDXRH STXRH - 
Load-Acquire/Store-Release LDAXRH STLXRH - 

Register? - LDXR STXR - 
Load-Acquire/Store-Release LDAXR STLXR - 

Pair? - LDXP STXP - 
Load-Acquire/Store-Release LDAXP STLXP - 

None Clear-Exclusive - - CLREX 





a. Instruction in the A64 instruction set. 


b. A register instruction operates on a doubleword if accessing an X register, or on a word if accessing a W register 
A pair instruction operates on two doublewords if access X registers, or on two words if accessing W registers. 


Except for the row showing the CLREX instruction, the two instructions in a single row are a 
Load-Exclusive/Store-Exclusive instruction pair. The model for the use of a Load-Exclusive/Store-Exclusive 
instruction pair accessing a non-aborting memory address x is: 


e The Load-Exclusive instruction reads a value from memory address x. 


. The corresponding Store-Exclusive instruction succeeds in writing back to memory address x only ifno other 
observer, process, or thread has performed a more recent store to address x. The Store-Exclusive instruction 
returns a status bit that indicates whether the memory write succeeded. 


A Load-Exclusive instruction marks a small block of memory for exclusive access. The size of the marked block is 
IMPLEMENTATION DEFINED, see Marking and the size of the marked memory block on page B2-162. A 
Store-Exclusive instruction to any address in the marked block clears the marking. 





Note 


In this section, the term PE includes any observer that can generate a Load-Exclusive or a Store-Exclusive 
instruction. 





The following sections give more information: 

à Exclusive access instructions and Non-shareable memory locations on page B2-157. 
5 Exclusive access instructions and Shareable memory locations on page B2-158. 

$ Marking and the size of the marked memory block on page B2-162. 

7 Context switch support on page B2-162. 
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. Load-Exclusive and Store-Exclusive instruction usage restrictions on page B2-163. 
: Use of WFE and SEV instructions by spin-locks on page B2-166. 


B2.9.1 Exclusive access instructions and Non-shareable memory locations 


For memory locations for which the shareability attribute is Non-shareable, the exclusive access instructions rely 
on a local Exclusives monitor, or local monitor, that marks any address from which the PE executes a 
Load-Exclusive instruction. Any non-aborted attempt by the same PE to use a Store-Exclusive instruction to modify 
any address is guaranteed to clear the marking. 

A Load-Exclusive instruction performs a load from memory, and: 

° The executing PE marks the physical memory address for exclusive access. 

è The local monitor of the executing PE transitions to the Exclusive Access state. 


A Store-Exclusive instruction performs a conditional store to memory that depends on the state of the local monitor: 


If the local monitor is in the Exclusive Access state 


. If the address of the Store-Exclusive instruction is the same as the address that has been 
marked in the monitor by an earlier Load-Exclusive instruction, then the store occurs. 
Otherwise, it is IMPLEMENTATION DEFINED whether the store occurs. 


A status value is returned to a register: 
— Ifthe store took place, the status value is 0. 
— Otherwise, the status value is 1. 


à The local monitor of the executing PE transitions to the Open Access state. 


When an Exclusives monitor is in the Exclusive Access state, the monitor is set. 


If the local monitor is in the Open Access state 


à No store takes place. 
. A status value of 1 is returned to a register. 
à The local monitor remains in the Open Access state. 


When an Exclusives monitor is in the Open Access state, the monitor is clear. 
The Store-Exclusive instruction defines the register to which the status value is returned. 


When a PE writes using any instruction other than a Store-Exclusive instruction: 


s If the write is to a PA that is not marked as Exclusive Access by its local monitor and that local monitor is in 
the Exclusive Access state, it is IMPLEMENTATION DEFINED whether the write affects the state of the local 
monitor. 

è If the write is to a PA that is marked as Exclusive Access by its local monitor, it is IMPLEMENTATION DEFINED 


whether the write affects the state of the local monitor. 


It is IMPLEMENTATION DEFINED whether a store to a marked PA causes a mark in the local monitor to be cleared if 
that store is by an observer other than the one that caused the PA to be marked. 


Figure B2-4 on page B2-158 shows the state machine for the local monitor and the effect of each of the operations 
shown in the figure. 
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LoadExc]l (x) LoadExc] (x) 
y 
Open Exclusive }¢«— 
ie Access Access 
x x 
StoreExcl (x) Store(Marked_address) * Store(Marked_address) * 
Store(x) Store(!Marked_address) * Store(!Marked_address) * 

CLREX StoreExcl (Marked_address) 

StoreExcl (!Marked_address) 

CLREX 


Operations marked * are possible alternative IMPLEMENTATION DEFINED options. 

In the diagram: LoadExcl represents any Load-Exclusive instruction 
StoreExcl represents any Store-Exclusive instruction 
Store represents any other store instruction. 


Any LoadExcl operation updates the marked address to the most significant bits of the address x used for the operation. 


Figure B2-4 Local monitor state machine diagram 


For more information about marking, see Marking and the size of the marked memory block on page B2-162. 


Note 
For the local monitor state machine, as shown in Figure B2-4: 





. The IMPLEMENTATION DEFINED options for the local monitor are consistent with the local monitor being 
constructed so that it does not hold any PA, but instead treats any access as matching the address of the 
previous Load-Exclusive instruction. 


$ A local monitor implementation can be unaware of Load-Exclusive and Store-Exclusive instructions from 
other PEs. 
à The architecture does not require a load instruction by another PE, that is not a Load-Exclusive instruction, 


to have any effect on the local monitor. 


° It is IMPLEMENTATION DEFINED whether the transition from Exclusive Access to Open Access state occurs 
when the Store or StoreExc] is from another observer. 





Changes to the local monitor state resulting from speculative execution 


The architecture permits a local monitor to transition to the Open Access state as a result of speculation, or from 
some other cause. This is in addition to the transitions to Open Access state caused by the architectural execution 
of an operation shown in Figure B2-4. 


An implementation must ensure that: 


° The local monitor cannot be seen to transition to the Exclusive Access state except as a result of the 
architectural execution of one of the operations shown in Figure B2-4. 


è Any transition of the local monitor to the Open Access state not caused by the architectural execution of an 
operation shown in Figure B2-4 must not indefinitely delay forward progress of execution. 
B2.9.2 Exclusive access instructions and Shareable memory locations 


In the context of this section, a shareable memory location is a memory location that has, or is treated as if it has, a 
Shareability attribute of Inner Shareable or Outer Shareable. 
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For shareable memory locations, exclusive access instructions rely on: 


$ A local monitor for each PE in the system, that marks any address from which the PE executes a 
Load-Exclusive. The local monitor operates as described in Exclusive access instructions and Non-shareable 
memory locations on page B2-157, except that for shareable memory any Store-Exclusive is then subject to 
checking by the global monitor if it is described in that section as doing at least one of the following: 

— Updating memory. 
— Returning a status value of 0. 


The local monitor can ignore accesses from other PEs in the system. 


a A global monitor that marks a PA as exclusive access for a particular PE. This marking is used later to 
determine whether a Store-Exclusive to that address that has not been failed by the local monitor can occur. 
Any successful write to the marked block by any other observer in the shareability domain of the memory 
location is guaranteed to clear the marking. For each PE in the system, the global monitor: 
— Can hold at least one marked block. 


— Maintains a state machine for each marked block it can hold. 


Note 
For each PE, the architecture only requires global monitor support for a single marked address. Any situation 
that might benefit from the use of multiple marked addresses on a single PE is UNPREDICTABLE or 
CONSTRAINED UNPREDICTABLE, see Load-Exclusive and Store-Exclusive instruction usage restrictions on 
page B2-163. 








Note 


The global monitor can either reside within the PE, or exist as a secondary monitor at the memory interfaces. The 
IMPLEMENTATION DEFINED aspects of the monitors mean that the global monitor and local monitor can be combined 
into a single unit, provided that the unit performs the global monitor and local monitor functions defined in this 
manual. 








For shareable memory locations, in some implementations and for some memory types, the properties of the global 
monitor require functionality outside the PE. Some system implementations might not implement this functionality 
for all locations of memory. In particular, this can apply to: 


, Any type of memory in the system implementation that does not support hardware cache coherency. 


e Non-cacheable memory, or memory treated as Non-cacheable, in an implementation that does support 
hardware cache coherency. 


In such a system, it is defined by the system: 


` Whether the global monitor is implemented. 
$ If the global monitor is implemented, which address ranges or memory types it monitors. 
Note 





If ARMv8.5-MemTag is implemented and enabled it is IMPLEMENTATION DEFINED whether a global monitor 
monitors access the Tag PA space. For more information see Chapter D6 Armv8.5 Memory Tagging Extension. 





Note 


To support the use of the Load-Exclusive/Store-Exclusive mechanism when address translation is disabled, a system 
might define at least one location of memory, of at least the size of the translation granule, in the system memory 
map to support the global monitor for all Arm PEs within a common Inner Shareable domain. However, this is not 
an architectural requirement. Therefore, architecturally-compliant software that requires mutual exclusion must not 
rely on using the Load-Exclusive/Store-Exclusive mechanism, and must instead use a software algorithm such as 
Lamport’s Bakery algorithm to achieve mutual exclusion. 
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B2-160 


Because implementations can choose which memory types are treated as Non-cacheable, the only memory types for 
which it is architecturally guaranteed that a global Exclusives monitor is implemented are: 


Inner Shareable, Inner Write-Back, Outer Write-Back Normal memory with Read allocation hints and Write 
allocation hints and not transient. 


Outer Shareable, Inner Write-Back, Outer Write-Back Normal memory with Read allocation hints and Write 
allocation hints and not transient. 


If the global monitor is not implemented for an address range or memory type, then performing a Load-Exclusive 
or a Store-Exclusive instruction to such a location has one or more of the following effects: 


The instruction generates an External abort. 

The instruction generates an IMPLEMENTATION DEFINED MMU fault. This is reported using the Data Abort 
Fault status code of ESR_ELx.DFSC = 110101. 

If the IMPLEMENTATION DEFINED MMU fault is generated for the EL1&0 translation regime then: 


— Ifthe fault is generated because of the memory type defined in the first stage of translation, or if the 
second stage of translation is disabled, then this is a first stage fault and the exception is taken to EL1. 


— Otherwise, the fault is a second stage fault and the exception is taken to EL2. 


The priority of this fault is IMPLEMENTATION DEFINED. 
The instruction is treated as a NOP. 


The Load-Exclusive instruction is treated as if it were accessing a Non-shareable location, but the state of the 
local monitor becomes UNKNOWN. 


The Store-Exclusive instruction is treated as if it were accessing a Non-shareable location, but the state of the 
local monitor becomes UNKNOWN. In this case, if the store exclusive instruction is a store exclusive pair of 
64-bit quantities, then the two quantities being stored might not be stored atomically. 


The value held in the result register of the Store-Exclusive instruction becomes UNKNOWN. 


In addition, for write transactions generated by non-PE observers that do not implement exclusive accesses or other 
atomic access mechanisms, the effect that writes have on the global and local monitors used by Arm PEs is 
IMPLEMENTATION DEFINED. The writes might not clear the global monitors of other PEs for: 


Some address ranges. 
Some memory types. 


Operation of the global Exclusives monitor 


A Load-Exclusive instruction from shareable memory performs a load from memory, and causes the PA of the 
access to be marked as exclusive access for the requesting PE. This access can also cause the exclusive access mark 
to be removed from any other PA that has been marked by the requesting PE. 


Note 





The global monitor only supports a single outstanding exclusive access to shareable memory per PE. 





A Load-Exclusive instruction by one PE has no effect on the global monitor state for any other PE. 


A Store-Exclusive instruction performs a conditional store to memory: 


The store is guaranteed to succeed only if the PA accessed is marked as exclusive access for the requesting 
PE and both the local monitor and the global monitor state machines for the requesting PE are in the 
Exclusive Access state. In this case: 


— A status value of 0 is returned to a register to acknowledge the successful store. 
— The final state of the global monitor state machine for the requesting PE is IMPLEMENTATION DEFINED. 


— Ifthe address accessed is marked for exclusive access in the global monitor state machine for any other 
PE, then that state machine transitions to Open Access state. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch64 Application Level Memory Model 
B2.9 Synchronization and semaphores 


. If no address is marked as exclusive access for the requesting PE, the store does not succeed: 


A status value of 1 is returned to a register to indicate that the store failed. 


The global monitor is not affected and remains in Open Access state for the requesting PE. 


$ Ifa different PA is marked as exclusive access for the requesting PE, it is IMPLEMENTATION DEFINED whether 
the store succeeds or not: 


If the store succeeds a status value of 0 is returned to a register, otherwise a value of 1 is returned. 


If the global monitor state machine for the PE was in the Exclusive Access state before the 
Store-Exclusive instruction it is IMPLEMENTATION DEFINED whether that state machine transitions to 
the Open Access state. 


The Store-Exclusive instruction defines the register to which the status value is returned. 


In a shared memory system, the global monitor implements a separate state machine for each PE in the system. The 
state machine for accesses to shareable memory by PE(n) can respond to all the shareable memory accesses visible 
to it. This means that it responds to: 


e Accesses generated by PE(n). 


° Accesses generated by the other observers in the shareability domain of the memory location. These accesses 
are identified as (!n). 


In a shared memory system, the global monitor implements a separate state machine for each observer that can 
generate a Load-Exclusive or a Store-Exclusive instruction in the system. 


A global monitor: 
° In the Exclusive Access state is set. 
x In the Open Access state is clear. 


Clear global monitor event 


Whenever the global monitor state for a PE changes from Exclusive access to Open access, an event is generated 
and held in the Event register for that PE. This register is used by the Wait for Event mechanism, see Mechanisms 
for entering a low-power state on page D1-2372. 


Figure B2-5 shows the state machine for PE(n) in a global monitor. 


LoadExcl (x,n) LoadExcl (x,n) 






























































y 
Open Exclusive }¢— 
m> Access Access 
x x 
CLREX(n) StoreExcl (Marked_address, !n)+ StoreExcl (Marked_address, !n)+ 
CLREXC!n) Store(Marked_address, !n) Store(!Marked_address,n) 


LoadExcl (x, !n) 
StoreExcl (x,n) 
StoreExcl (x, !n) 


Store(x,n) 
Store(x, !n) 


StoreExcl (Marked_address,n)* 
StoreExcl (!Marked_address,n)* 
Store(Marked_address,n)* 
CLREX(n) * 


StoreExcl (Marked_address,n)* 
StoreExcl(!Marked_address,n)* 
Store(Marked_address,n)* 
CLREX (Cn) * 
StoreExcl(!Marked_address, !n) 
Store(!Marked_address, !n) 
CLREXC!n) 


+StoreExc1(Marked_address,!n) clears the monitor only if the StoreExcl updates memory 
Operations marked * are possible alternative IMPLEMENTATION DEFINED options. 
In the diagram: LoadExcl represents any Load-Exclusive instruction 
StoreExcl represents any Store-Exclusive instruction 


Store represents any other store instruction. 


Any LoadExcl operation updates the marked address to the most significant bits of the address x used for the operation. 
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Figure B2-5 Global monitor state machine diagram for PE(n) in a multiprocessor system 


For more information about marking, see Marking and the size of the marked memory block on page B2-162. 
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Note 


For the global monitor state machine, as shown in Figure B2-5 on page B2-161: 





. The architecture does not require a load instruction by another PE, that is not a Load-Exclusive instruction, 
to have any effect on the global monitor. 


. Whether a Store-Exclusive instruction successfully updates memory or not depends on whether the address 
accessed matches the marked shareable memory address for the PE issuing the Store-Exclusive instruction, 
and whether the local and global monitors are in the exclusive state. For this reason, Figure B2-5 on 
page B2-161 only shows how the operations by (!n) cause state transitions of the state machine for PE(n). 


$ A Load-Exclusive instruction can only update the marked shareable memory address for the PE issuing the 
Load-Exclusive instruction. 


è When the global monitor is in the Exclusive Access state, it is IMPLEMENTATION DEFINED whether a CLREX 
instruction causes the global monitor to transition from Exclusive Access to Open Access state. 
= It is IMPLEMENTATION DEFINED: 


— Whether a modification to a Non-shareable memory location can cause a global monitor to transition 
from Exclusive Access to Open Access state. 


— Whether a Load-Exclusive instruction to a Non-shareable memory location can cause a global monitor 
to transition from Open Access to Exclusive Access state. 





Marking and the size of the marked memory block 


When a Load-Exclusive instruction is executed, the resulting marked block ignores the least significant bits of the 
64-bit memory address. 


When a Load-Exclusive instruction is executed, a marked block of size 2¢ bytes is created by ignoring the least 
significant bits of the memory address. A marked address is any address within this marked block. The size of the 
marked memory block is called the Exclusives reservation granule. The Exclusives reservation granule is 
IMPLEMENTATION DEFINED in the range 4-512 words. 





Note 
This definition means that the Exclusives reservation granule is: 
- 4 words in an implementation where a is 4. 
è 512 words in an implementation where a is 11. 


For example, in an implementation where a is 4, a successful LDXRB of address 0x341B4 defines a marked block using 
bits[47:4] of the address. This means that the four words of memory from 0x341B0 to 0x341BF are marked for 
exclusive access. 





In some implementations the CTR identifies the Exclusives reservation granule, see CTR_ELO. Otherwise, software 
must assume that the maximum Exclusives reservation granule, 512 words, is implemented. 


Context switch support 


An exception return clears the local monitor. As a result, performing a CLREX instruction as part of a context switch 
is not required in most situations. 





Note 


Context switching is not an application level operation. However, this information is included here to complete the 
description of the exclusive operations. 
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The Load-Exclusive and Store-Exclusive instructions are intended to work together as a pair, for example a 
LDXP/STXP pair or a LDXR/STXR pair. To support different implementations of these functions, software must follow the 
notes and restrictions given here. 


The following notes describe the use of a LoadExcl/StoreExcl instruction pair, to indicate the use of any of the 
Load-Exclusive/Store-Exclusive instruction pairs shown in Table B2-3 on page B2-156. In this context, a 
LoadExcl/StoreExcl pair comprises two instructions in the same thread of execution: 


The exclusives support a single outstanding exclusive access for each PE thread that is executed. The 
architecture makes use of this by not requiring an address or size check as part of the IsExclusiveLocal() 
function. If the target VA of a StoreExcl is different from the VA of the preceding LoadExcl instruction in the 
same thread of execution, behavior can be CONSTRAINED UNPREDICTABLE with the following behavior: 


— The StoreExcl either passes or fails, the status value returned by the StoreExcl is UNKNOWN, and the 
states of the local and global monitors for that PE are UNKNOWN. 


Note 


This means the StoreExcl might pass for some instances of a LoadExc1/StoreExcl pair with mismatched 
addresses, and fail for other instances of a LoadExcl/StoreExcl pair with mismatched addresses. 








— The data at the address accessed by the LoadExcl, and at the address accessed by the StoreExcl, is 
UNKNOWN. 


This means software can rely on a LoadExcl/StoreExcl pair to eventually succeed only if the LoadExcl and the 
StoreExcl are executed with the same VA. 


An implementation of the Load-Exclusive and Store-Exclusive instructions can require that, in any thread of 
execution, the transaction size of a StoreExcl instruction is the same as the transaction size of the preceding 
LoadExcl instruction executed in that thread. If the transaction size of a StoreExc] instruction is different from 
the preceding LoadExcl instruction in the same thread of execution, behavior can be CONSTRAINED 
UNPREDICTABLE with the following behavior: 


— The StoreExcl either passes or fails, and the status value returned by the StoreExcl is UNKNOWN. 


Note 


This means the StoreExcl might pass for some instances of a LoadExcl/StoreExcl pair with mismatched 
transaction sizes, and fail for other instances of a LoadExc1/StoreExcl pair with mismatched transaction 
sizes. 








— The block of data of the size of the larger of the transaction sizes used by the LoadExcl/StoreExcl pair 
at the address accessed by the LoadExc1/StoreExcl pair, is UNKNOWN. 


This means software can rely on a LoadExcl/StoreExcl pair to eventually succeed only if the LoadExcl and the 
StoreExcl have the same transaction size. 


An implementation of the LoadExc] and StoreExcl instructions can require that, in any thread of execution, 
the StoreExcl instruction accesses the same number of registers as the preceding LoadExc] instruction 
executed in that thread. Ifthe StoreExcl instruction accesses a different number of registers than the preceding 
LoadExcl instruction in the same thread of execution, behavior is CONSTRAINED UNPREDICTABLE. As a result, 
software can rely on an LoadExcl/StoreExcl pair to eventually succeed only if they access the same number 
of registers. For more information, see CONSTRAINED UNPREDICTABLE behavior when 
Load-Exclusive/Store-Exclusive access a different number of registers on page B2-165. 


LoadExcl/StoreExcl loops are guaranteed to make forward progress only if, for any LoadExcl/StoreExcl loop 
within a single thread of execution, the software meets all of the following conditions: 


1 Between the Load-Exclusive and the Store-Exclusive, there are no explicit memory accesses, 
preloads, direct or indirect System register writes, address translation instructions, cache or TLB 
maintenance instructions, exception generating instructions, exception returns, or indirect 
branches. 
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2 Between the Store-Exclusive returning a failing result and the retry of the corresponding 
Load-Exclusive: 


° There are no stores or PRFM instructions to any address within the Exclusives reservation 
granule accessed by the Store-Exclusive. 


° There are no loads or preloads to any address within the Exclusives reservation granule 
accessed by the Store-Exclusive that use a different VA alias to that address. 


. There are no direct or indirect System register writes, address translation instructions, 
cache or TLB maintenance instructions, exception generating instructions, exception 
returns, or indirect branches. 


° All loads and stores are to a block of contiguous virtual memory of not more than 512 
bytes in size. 


The Exclusives monitor can be cleared at any time without an application-related cause, provided that such 
clearing is not systematically repeated so as to prevent the forward progress in finite time of at least one of 
the threads that is accessing the Exclusives monitor. However, it is permissible for the LoadExc1/StoreExcl] 

loop not to make forward progress if a different thread is repeatedly doing any of the following in a tight loop: 


— Performing stores to a PA covered by the Exclusives monitor. 
—  Prefetching with intent to write to a PA covered by the Exclusives monitor. 


— Executing data cache clean, data cache invalidate, or data cache clean and invalidate instructions to a 
PA covered by the Exclusives monitor. 


— Executing instruction cache invalidate all instructions. 


— Executing instruction cache invalidate by VA instructions to a PA covered by the Exclusives monitor. 


° Implementations can benefit from keeping the LoadExc]l and StoreExcl operations close together in a single 
thread of execution. This minimizes the likelihood of the Exclusives monitor state being cleared between the 
LoadExcl instruction and the StoreExc] instruction. Therefore, for best performance, Arm strongly 
recommends a limit of 128 bytes between LoadExcl and StoreExc] instructions in a single thread of execution. 


° The architecture sets an upper limit of 2048 bytes on the Exclusives reservation granule that can be marked 
as exclusive. For performance reasons, Arm recommends that objects that are accessed by exclusive accesses 
are separated by the size of the Exclusives reservation granule. This is a performance guideline rather than a 
functional requirement. 


° After taking a Data Abort exception, the state of the Exclusives monitors is UNKNOWN. 


° For the memory location accessed by a LoadExcl/StoreExc]1 pair, if the memory attributes for a StoreExc1 
instruction are different from the memory attributes for the preceding LoadExc] instruction in the same thread 
of execution, behavior is CONSTRAINED UNPREDICTABLE. Where this occurs because the translation of the 
accessed address changes between the LoadExcl instruction and the StoreExcl instruction, the CONSTRAINED 
UNPREDICTABLE behavior is as follows: 


— The StoreExcl either passes or fails, and the status value returned by the StoreExcl is UNKNOWN. 


Note 


This means the StoreExcl might pass for some instances of a LoadExcl/StoreExcl pair with changed 
memory attributes, and fail for other instances of a LoadExc1/StoreExcl pair with changed memory 
attributes. 








— The data at the address accessed by the StoreExcl is UNKNOWN. 


Note 


Another bullet point in this list covers the case where the memory attributes of a LoadExcl/StoreExcl pair 
differ as a result of using different VAs with different attributes that point to the same PA. 
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The effect of a data or unified cache invalidate, clean, or clean and invalidate instruction on a local or global 
Exclusives monitor that is in the Exclusive Access state is CONSTRAINED UNPREDICTABLE, and the instruction 
might clear the monitor, or it might leave it in the Exclusive Access state. For address-based maintenance 

instructions, this also applies to the monitors of other PEs in the same shareability domain as the PE executing 
the cache maintenance instruction, as determined by the shareability domain of the address being maintained. 


Note 


Arm strongly recommends that implementations ensure that the use of such maintenance instructions by a 
PE in the Non-secure state cannot cause a denial of service on a PE in the Secure state. 








If the mapping of the VA to PA is changed between the LoadExcl instruction and the STREX instruction, and 
the change is performed using a break-before-make sequence as described in Using break-before-make when 
updating translation table entries on page D5-2639, if the StoreExcl is performed after another write to the 
same PA as the StoreExcl, and that other write was performed after the old translation was properly 
invalidated and that invalidation was properly synchronized, then the StoreExcl will not pass its monitor 
check. 


Note 
— The TLB invalidation will clear either the local or global monitor. 
— The PA will be checked between the LoadExcl and StoreExcl. 








The Exclusive Access state for an address accessed by a PE can be lost as a result of a PFRM PST» instruction 
to the same PA executed by another PE. This means that a very high rate of repeated PFRM PST» accesses to a 
memory location might impede the forward progress of another PE. 


If ARMv8.5-MemTag is implemented and enabled a store exclusive instruction which if Unchecked would 
not perform the store and return a status value of 1, it is CONSTRAINED UNPREDICTABLE whether: 

— The instruction is a Checked access. 

— The instruction is an Unchecked access. 


For more information see Chapter D6 Armv8.5 Memory Tagging Extension. 


Note 


In the event of repeatedly-contending LoadExcl/StoreExcl instruction sequences from multiple PEs, an 
implementation must ensure that forward progress is made by at least one PE. 





CONSTRAINED UNPREDICTABLE behavior when Load-Exclusive/Store-Exclusive 
access a different number of registers 


As stated in this section, an implementation can require that the instructions of a Load-Exclusive/Store-Exclusive 
pair access the same number of registers. In such an implementation, this means behavior is CONSTRAINED 
UNPREDICTABLE if, in a single thread of execution, either: 


An LDXP instruction of two 32-bit quantities is followed by an STXR instruction of one 64-bit quantity at the 
same address. 


An LDXR instruction of one 64-bit quantity is followed by an STXP instruction of two 32-bit quantities at the 
same address. 


In these cases, the CONSTRAINED UNPREDICTABLE behavior must be one of: 


The STXP or STXR instruction generates an external Data Abort. 


The STXP or STXR instruction generates an IMPLEMENTATION DEFINED MMU fault reported using the Data 
Abort Fault status code of ESR_ELx.DFSC = 0b110101. 


The STXP or STXR instruction always fails, returning a status of 1. 








The STXP or STXR instruction always passes, returning a status of 0. 
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è This STXP or STXR instruction has the same pass or fail behavior that it would have had if the instruction had 
used the same size and number of registers as the preceding LDXR or LDXP instruction. 


B2.9.6 Use of WFE and SEV instructions by spin-locks 


Armv8 provides Wait For Event, Send Event, and Send Event Local instructions, WFE, SEV, and SEVL, that can assist 
with reducing power consumption and bus contention caused by PEs repeatedly attempting to obtain a spin-lock. 
These instructions can be used at the application level, but a complete understanding of what they do depends ona 
system level understanding of exceptions. They are described in Wait for Event mechanism and Send event on 
page D1-2372. However, in Armv8, when the global monitor for a PE changes from Exclusive Access state to Open 
Access state, an event is generated. 





Note 


This is equivalent to issuing an SEVL instruction on the PE for which the monitor state has changed. It removes the 
need for spinlock code to include an SEV instruction after clearing a spinlock. 
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This chapter describes the A64 instruction set. It contains the following sections: 


About the A64 instruction set on page C1-170. 

Structure of the A64 assembler language on page C1-171. 
Address generation on page C1-177. 

Instruction aliases on page C1-180. 
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C1.1 About the A64 instruction set 


The A64 instruction set is the instruction set supported in the AArch64 Execution state. 


All A64 instructions have a width of 32 bits. The A64 encoding structure breaks down into the following functional 


groups: 
: A miscellaneous group of branch instructions, exception generating instructions, and System instructions. 
. Data-processing instructions associated with general-purpose registers. These instructions are supported by 


two functional groups, depending on whether the operands: 
— Are all held in registers. 
— Include an operand with a constant immediate value. 


g Load and store instructions associated with the general-purpose register file and the SIMD and floating-point 
register file. 


s SIMD and scalar floating-point data-processing instructions that operate on the SIMD and floating-point 
registers. 


The encoding hierarchy within a functional group breaks down as follows: 


7 A functional group consists of a set of related instruction classes. 464 instruction set encoding on 
page C4-252 provides an overview of the instruction encodings in the form of a list of instruction classes 
within their functional groups. 


. An instruction class consists of a set of related instruction forms. Instruction forms are documented in one of 
two alphabetic lists: 


— The load, store, and data-processing instructions associated with the general-purpose registers, 
together with those in the other instruction classes. See Chapter C6 464 Base Instruction Descriptions. 


— The load, store, and data-processing instructions associated with the SIMD and floating-point support. 
See Chapter C7 464 Advanced SIMD and Floating-point Instruction Descriptions. 
` An instruction form might support a single instruction syntax. Where an instruction supports more than one 
syntax, each syntax is an instruction variant. Instruction variants can occur because of differences in: 
— The size or format of the operands. 
— Theregister file used for the operands. 
— The addressing mode used for load/load/store memory operands. 
Instruction variants might also arise as the result of other factors. 
Instruction variants are described in the instruction description for the individual instructions. 
A64 instructions have a regular bit encoding structure: 
e 5-bit register operand fields at fixed positions within the instruction. For general-purpose register operands, 
the values 0-30 select one of 31 registers. The value 31 is used as a special case that can: 


— Indicate use of the current stack pointer, when identifying a load/store base register or in a limited set 
of data-processing instructions. See The stack pointer registers on page D1-2277. 


— Indicate the value zero when used as a source register operand. 
— Indicate discarding the result when used as a destination register operand. 
For SIMD and floating-point register access, the value used selects one of 32 registers. 
. Immediate bits that provide constant data-processing values or address offsets are placed in contiguous 


bitfields. Some computed values in instruction variants use one or more immediate bitfields together with the 
secondary encoding bitfields. 


All encodings that are not fully defined are described as unallocated. An attempt to execute an unallocated 
instruction is UNDEFINED, unless the behavior is otherwise defined in this Manual. 
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C1.2 Structure of the A64 assembler language 


The following sections describe the A64 assembler syntax: 


General requirements. 

Common syntax terms. 

Instruction Mnemonics on page C1-173. 
Condition code on page C1-173. 
Register names on page C1-174. 


C1.2.1 General requirements 


The letter W denotes a general-purpose register holding a 32-bit word, and X denotes a general-purpose register 
holding a 64-bit doubleword. 


An A64 assembler recognizes both uppercase and lowercase variants of the instruction mnemonics and register 
names, but not mixed case variants. An A64 disassembler can output either uppercase or lowercase mnemonics and 
register names. Program and data labels are case-sensitive. 


The A64 assembly language does not require the # character to introduce constant immediate operands, but an 
assembler must allow immediate values introduced with or without the # character. Arm recommends that an A64 
disassembler outputs a # before an immediate operand. 


In Example C1-1 on page C1-173, the sequence //is used as a comment leader and A64 assemblers are encouraged 
to accept this syntax. 


C1.2.2 Common syntax terms 
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The following syntax terms are used frequently throughout the A64 instruction set description. 


UPPER 


{} 


alb 


+ 


uimmn 


simmn 


SP 


Wn 


WSP 


WZR 


Xn 


Text in upper-case letters is fixed. Text in lower-case letters is variable. This means that register 
name Xn indicates that the X is required, followed by a variable register number, for example X29. 


Any text enclosed by angle braces, <>, is a value that the user supplies. Subsequent text might 
supply additional information. 


Any item enclosed by curly brackets, { }, is optional. A description of the item and how its presence 
or absence affects the instruction is normally supplied by subsequent text. In some cases curly 
braces are actual symbols in the syntax, for example when they surround a register list. These cases 
are called out in the surrounding text. 


Any items enclosed by square brackets, [ ], constitute a list of alternative characters. A single one 
of the characters can be used in that position and the subsequent text describes the meaning of the 
alternatives. In some case the square brackets are part of the syntax itself, such as addressing modes 
or vector elements. These cases are called out in the surrounding text. 


Alternative words are separated by a vertical bar, |, and can be surrounded by parentheses to delimit 
them. For example, U(ADD|SUB)W represents UADDW or USUBW. 


This indicates an optional + or - sign. If neither is used then + is assumed. 

An n-bit unsigned, positive, immediate value. 

An n-bit two’s complement, signed immediate value, where n includes the sign bit. 
See Register names on page C1-174. 

See Register names on page C1-174. 

See Register names on page C1-174. 

See Register names on page C1-174. 


See Register names on page C1-174. 
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XZR See Register names on page C1-174 
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The A64 assembly language overloads instruction mnemonics and distinguishes between the different forms of an 
instruction based on the operand types. For example, the following ADD instructions all have different opcodes. 
However, the programmer must only remember one mnemonic, as the assembler automatically chooses the correct 


opcode based on the operands. The disassembler follows the same procedure in reverse. 


Example C1-1 ADD instructions with different opcodes 


ADD WO, W1, W2 // add 32-bit register 
ADD X0, X1, X2 // add 64-bit register 
ADD X0, X1, W2, SXTW // add 64-bit extended register 
ADD X0, X1, #42 // add 64-bit immediate 


Condition code 


The A64 ISA has some instructions that set Condition flags or test Condition codes or both. For information about 
instructions that set the Condition flags or use the condition mnemonics, see Condition flags and related instructions 
on page C6-751. 


Table C1-1 shows the available Condition codes. 


Table C1-1 Condition codes 
























































cond Mnemonic Meaning (integer) Meaning (floating-point) Condition flags 
0000 EQ Equal Equal Z= 

0001 NE Not equal Not equal or unordered Z= 

0010 CS or HS Carry set Greater than, equal, or unordered C == 

0011  CCorLO Carry clear Less than C= 

0100 MI Minus, negative Less than N = 

0101 PL Plus, positive or zero Greater than, equal, or unordered N == 

0110 VS Overflow Unordered V = 

0111 VC No overflow Ordered V = 

1000 HI Unsigned higher Greater than, or unordered C =] && Z = 
1001 LS Unsigned lower or same Less than or equal '(C ==1 && Z ==0) 
1010 GE Signed greater than or equal Greater than or equal N= V 

1011 LT Signed less than Less than, or unordered N!'=V 

1100 GT Signed greater than Greater than Z == 0 && N = 
1101 LE Signed less than or equal Less than, equal, or unordered (Z == 0 && N == V) 
1110 AL Always Always Any 

1111 Nv Always Always Any 
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Unordered means at least one NaN operand. 


b. The Condition code NV exists only to provide a valid disassembly of the 0b1111 encoding, otherwise its behavior is 


identical to AL. 
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Register names 


This section describes the AArch64 registers. It contains the following subsections: 
s General-purpose register file and zero register and stack pointer. 

° SIMD and floating-point register file on page C1-175. 

. SIMD and floating-point scalar register names on page C1-175. 

° SIMD vector register names on page C1-175. 

E SIMD vector element names on page C1-176. 


General-purpose register file and zero register and stack pointer 


The 31 general-purpose registers in the general-purpose register file are named R0-R30 and encoded in the 
instruction register fields with values 0-30. In a general-purpose register field the value 31 represents either the 
current stack pointer or the zero register, depending on the instruction and the operand position. 


When the registers are used in a specific instruction variant, they must be qualified to indicate the operand data size, 
32 bits or 64 bits, and the data size of the instruction. 


When the data size is 32 bits, the lower 32 bits of the register are used and the upper 32 bits are ignored on a read 
and cleared to zero on a write. 


Table C1-2 shows the qualified names for registers, where n is a register number 0-30. 


Table C1-2 Naming of general-purpose registers, the zero register, and the stack pointer 





Name Size Encoding Description 




















Wn 32 bits 0-30 General-purpose register 0-30 
Xn 64 bits 0-30 General-purpose register 0-30 
WZR 32 bits 31 Zero register 

XZR 64 bits 31 Zero register 

WSP 32 bits 31 Current stack pointer 

SP 64 bits 31 Current stack pointer 





This list gives more information about the instruction arguments shown in Table C1-2: 


: The names Xn and Wn both refer to the same general-purpose register, Rn. 
$ There is no register named W31 or X31. 
. The name SP represents the stack pointer for 64-bit operands where an encoding of the value 31 in the 


corresponding register field is interpreted as a read or write of the current stack pointer. When instructions 
do not interpret this operand encoding as the stack pointer, use of the name SP is an error. 


s The name WSP represents the current stack pointer in a 32-bit context. 


è The name XZR represents the zero register for 64-bit operands where an encoding of the value 31 in the 
corresponding register field is interpreted as returning zero when read or discarding the result when written. 
When instructions do not interpret this operand encoding as the zero register, use of the name XZR is an error. 


è The name WZR represents the zero register in a 32-bit context. 


° The architecture does not define a specific name for general-purpose register R30 to reflect its role as the link 
register on procedure calls. However, an A64 assembler must always use W30 and X30 for this purpose, and 
additional software names might be defined as part of the Procedure Call Standard, see Procedure Call 
Standard for the Arm 64-bit Architecture. 
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SIMD and floating-point register file 


The 32 registers in the SIMD and floating-point register file, VO-V31, hold floating-point operands for the scalar 
floating-point instructions, and both scalar and vector operands for the SIMD instructions. When they are used in a 
specific instruction form, the names must be further qualified to indicate the data shape, that is the data element size 
and the number of elements or lanes within the register. A similar requirement is placed on the general-purpose 
registers. See General-purpose register file and zero register and stack pointer on page C1-174. 


Note 
The data type is described by the instruction mnemonics that operate on the data. The data type is not described by 
the register name. The data type is the interpretation of bits within each register or vector element, whether these 
are integers, floating-point values, polynomials, or cryptographic hashes. 








SIMD and floating-point scalar register names 


SIMD and floating-point instructions that operate on scalar data only access the lower bits of a SIMD and 
floating-point register. The unused high bits are ignored on a read and cleared to 0 on a write. 


Table C1-3 shows the qualified names for accessing scalar SIMD and floating-point registers. The letter n denotes 
a register number between 0 and 31. 


Table C1-3 SIMD and floating-point scalar register names 

















Size Name 
8 bits Bn 
16 bits Hn 
32 bits Sn 
64 bits Dn 
128 bits Qn 


SIMD vector register names 


Ifa register holds multiple data elements on which arithmetic is performed in a parallel, SIMD, manner, then a 
qualifier describes the vector shape. The vector shape is the element size and the number of elements or lanes. If the 
element size in bits multiplied by the number of lanes does not equal 128, then the upper 64 bits of the register are 
ignored on a read and cleared to zero on a write. 


Table C1-4 shows the SIMD vector register names. The letter n denotes a register number between 0 and 31. 


Table C1-4 SIMD vector register names 





Shape Name 





8 bits x 8 lanes Vn. 8B 





8 bits x 16 lanes Vn.16B 





16 bits x 4 lanes Vn.4H 





16 bits x 8 lanes Vn. 8H 





32 bits x 2 lanes -Vn.2S 
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Table C1-4 SIMD vector register names (continued) 





Shape Name 


32 bits x 4 lanes Vn.4S 





64 bits x 1 lane Vn.1D 





64 bits x 2 lanes Vn.2D 





SIMD vector element names 


Appending a constant, zero-based element index to the register name inside square brackets indicates that a single 
element from a SIMD and floating-point register is used as a scalar operand. The number of lanes is not represented, 
as it is not encoded in the instruction and can only be inferred from the index value. 


Table C1-5 shows the vector register names and the element index. The letter i denotes the element index. 


Table C1-5 Vector register names with element index 





Size Name 





8 bits Vn.B[i] 





16 bits Vn.H[i] 





32 bits Vn.S[i] 





64 bits Vn.D[i] 





An assembler must accept a fully qualified SIMD register name if the number of lanes is greater than the index 
value. See SIMD vector register names on page C1-175. For example, an assembler must accept all of the following 
forms as the name for the 32-bit element in bits [63:32] of the SIMD and floating-point register V9: 


V9.S[1] //standard disassembly 
v9.2S[1] //optional number of lanes 
V9.4S[1] //optional number of lanes 


Note 
The SIMD and floating-point register element name Vn. S[0] is not equivalent to the scalar SIMD and floating-point 
register name Sn. Although they represent the same bits in the register, they select different instruction encoding 
forms, either the vector element or the scalar form. 








SIMD vector register list 


Where an instruction operates on multiple SIMD and floating-point registers, for example vector Load/Store 
structure and table lookup operations, the registers are specified as a list enclosed by curly braces. This list consists 
of either a sequence of registers separated by commas, or a register range separated by a hyphen. The registers must 
be numbered in increasing order, modulo 32, in increments of one. The hyphenated form is preferred for 
disassembly if there are more than two registers in the list and the register number are increasing. The following 
examples are equivalent representations of a set of four registers V4 to V7, each holding four lanes of 32-bit elements: 


{ V4.4S - V7.4S } //standard disassembly 
{ V4.4S, V5.4S, V6.4S, V7.4S } //alternative representation 


SIMD vector element list 


Registers in a list can also have a vector element form. For example, the LD4 instruction can load one element into 
each of four registers, and in this case the index is appended to the list as follows: 


{ V4.8 - V7.S }[3] //standard disassembly 
{ V4.4S, V5.4S, V6.4S, V7.4S }[3] //alternative with optional number of lanes 
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C1.3 Address generation 


The A64 instruction set supports 64-bit virtual addresses (VAs). The valid VA range is determined by the following 
factors: 


° The size of the implemented virtual address space. 
. Memory Management Unit (MMU) configuration settings. 


Limits on the VA size mean that the most significant bits of the virtual address do not hold valid address bits. These 
unused bits can hold: 


. A tag, see Address tagging in AArch64 state on page DS-2506. 


$ If ARMv8.3-PAuth is implemented, a Pointer authentication code (PAC), see Pointer authentication in 
AArch64 state on page DS-2508. 


For more information on memory management and address translation, see Chapter DS The AArch64 Virtual 
Memory System Architecture. 


C1.3.1 Register indexed addressing 


The A64 instruction set allows a 64-bit index register to be added to the 64-bit base register, with optional scaling 
of the index by the access size. Additionally it allows for sign-extension or zero-extension of a 32-bit value within 
an index register, followed by optional scaling. 


C1.3.2 PC-relative addressing 


The A64 instruction set has support for position-independent code and data addressing: 





: PC-relative literal loads have an offset range of + IMB. 





$ Process state flag and compare based conditional branches have a range of + 1MB. Test bit conditional 
branches have a restricted range of + 32KB. 





7 Unconditional branches, including branch and link, have a range of + 128MB. 





PC-relative Load/Store operations, and address generation with a range of + 4GB can be performed using two 
instructions. 


C1.3.3 Load/Store addressing modes 
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Load/Store addressing modes in the A64 instruction set require a 64-bit base address from a general-purpose register 
X0-X30 or the current stack pointer, SP, with an optional immediate or register offset. Table C1-6 shows the 
assembler syntax for the complete set of Load/Store addressing modes. 


Table C1-6 A64 Load/Store addressing modes 


























Offset 
Addressing Mode 
Immediate Register Extended Register 

Base register only (no offset) [base{, #0}] - - 

Base plus offset [base{, #imm}] [base, Xm{, LSL #imm}] [base, Wm, (S|U)XTW {#imm}] 
Pre-indexed [base, #imm]! - - 

Post-indexed [base], #imm [base], Xma 7 

Literal (PC-relative) label - - 
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a. The post-indexed by register offset mode can be used with the SIMD Load/Store structure instructions 
described in Load/Store Vector on page C3-206. Otherwise the post-indexed by register offset mode is not 
available. 


Some types of Load/Store instruction support only a subset of the Load/Store addressing modes listed in Table C1-6 
on page C1-177. Details of the supported modes are as follows: 


s Base plus offset addressing means that the address is the value in the 64-bit base register plus an offset. 


s Pre-indexed addressing means that the address is the sum of the value in the 64-bit base register and an offset, 
and the address is then written back to the base register. 


$ Post-indexed addressing means that the address is the value in the 64-bit base register, and the sum of the 
address and the offset is then written back to the base register. 


° Literal addressing means that the address is the value of the 64-bit program counter for this instruction plus 
a 19-bit signed word offset. This means that it is a 4 byte aligned address within +1 MB of the address of this 
instruction with no offset. Literal addressing can only be used for loads of at least 32 bits and for prefetch 
instructions. The PC cannot be referenced using any other addressing modes. The syntax for labels is specific 
to individual toolchains. 





. An immediate offset can be unsigned or signed, and scaled or unscaled, depending on the type of Load/Store 
instruction. When the immediate offset is scaled it is encoded as a multiple of the transfer size, although the 
assembly language always uses a byte offset, and the assembler or disassembler performs the necessary 
conversion. The usable byte offsets therefore depend on the type of Load/Store instruction and the transfer 
size. 


Table C1-7 shows the offset and the type of Load/Store instruction. 


Table C1-7 Immediate offsets and the type of Load/Store instruction 

















Offset bits Sign Scaling Write-Back Load/Store type 
0 - - - Exclusive/acquire/release 
7 Signed Scaled Optional Register pair 
9 Signed Unscaled Optional Single register 
12 Unsigned Scaled No Single register 
e A register offset means that the offset is the 64 bits from a general-purpose register, Xm, optionally scaled 


by the transfer size, in bytes, if LSL #imm is present and where imm must be equal to log2(transfer_size). 


s An extended register offset means that offset is the bottom 32 bits from a general-purpose register Wm, 
sign-extended or zero-extended to 64 bits, and then scaled by the transfer size if so indicated by #imm, where 
imm must be equal to logz(transfer_size). An assembler must accept Wm or Xm as an extended register 
offset, but Wm is preferred for disassembly. 


$ Generating an address lower than the value in the base register requires a negative signed immediate offset 
or a register offset holding a negative value. 


z When stack alignment checking is enabled by system software and the base register is the SP, the current 
stack pointer must be initially quadword aligned, that is aligned to 16 bytes. Misalignment generates a Stack 
Alignment fault. The offset does not have to be a multiple of 16 bytes unless the specific Load/Store 
instruction requires this. SP cannot be used as a register offset. 


Address calculation 


General-purpose arithmetic instructions can calculate the result of most addressing modes and write the address to 
a general-purpose register or, in most cases, to the current stack pointer. 
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Table C1-8 shows the arithmetic instructions that can compute addressing modes. 


Table C1-8 Arithmetic instructions to compute addressing modes 





Addressing 
Form 


Offset 


Immediate Register 


Extended Register 





Base register (no 
offset) 


MOV Xd|SP, base - 





Base plus offset 


ADD Xd|SP, base, #imm 
or 
SUB Xd|SP, base, #imm 


ADD <Xd|SP>, base, Xm{,LSL#imm} 


ADD <Xd|SP>, base, Wm,(S|U)XT(W|H|B|) {#imm} 





Pre-indexed 





Post-indexed 





Literal 
(PC-relative) 


ADR Xd, label - 
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Note 


To calculate a base plus immediate offset the ADD instructions defined in Arithmetic (immediate) on 


page C3-214 accept an unsigned 12-bit immediate offset, with an optional left shift by 12. This means that a 
single ADD instruction cannot support the full range of byte offsets available to a single register Load/Store 
with a scaled 12-bit immediate offset. For example, a quadword LDR effectively has a 16-bit byte offset. To 
calculate an address with a byte offset that requires more than 12 bits it is necessary to use two ADD 
instructions. The following example shows this: 


ADD Xd, base, #(imm & OxFFF) 
ADD Xd, Xd, #(imm>>12), LSL #12 


To calculate a base plus extended register offset, the ADD instructions defined in Arithmetic (extended register) 
on page C3-220 provide a superset of the addressing mode that also supports sign-extension or 
zero-extension of a byte or halfword value with any shift amount between 0 and 4, for example: 


ADD Xd, base, Wm, SXTW #3 // Xd = base + (SignExtend(Wm) LSL 3) 
ADD Xd, base, Wm, UXTH #4 // Xd = base + (ZeroExtend(Wm<15:0>) LSL 4) 


If the same extended register offset is used by more than one Load/Store instruction, then, depending on the 
implementation, it might be more efficient to calculate the extended and scaled intermediate result just once, 
and then reuse it as a simple register offset. The extend and scale calculation can be performed using the SBFIZ 
and UBFIZ bitfield instructions defined in Bitfield move on page C3-216, for example: 


SBFIZ Xd, Xm, #3, #32 //Xd = “Wm, SXTW #3” 
UBFIZ Xd, Xm, #4, #16 //Xd = “Wm, UXTH #4” 
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C1.4 Instruction aliases 


Some instructions have an associated architecture alias that is used for disassembly of the encoding when the 
associated conditions are met. Architecture alias instructions are included in the alphabetic lists of instruction types 
and clearly presented as an alias form in descriptions for the individual instructions. 
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This chapter describes the instruction descriptions contained in Chapter C6 464 Base Instruction Descriptions and 
Chapter C7 464 Advanced SIMD and Floating-point Instruction Descriptions. 


It contains the following sections: 
a Understanding the A64 instruction descriptions on page C2-182. 
è General information about the A64 instruction descriptions on page C2-185. 
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C2.1 


C2.1.1 


C2.1.2 


C2.1.3 


C2-182 


Understanding the A64 instruction descriptions 


Each instruction description in Chapter C6 and Chapter C7 has the following content: 
A title. 

An introduction to the instruction. 

The instruction encoding or encodings. 

Any alias conditions. 

A list of the assembler symbols for the instruction. 

Pseudocode describing how the instruction operates. 


Sy BS es n 


Notes, if applicable. 


The following sections describe each of these. 


The title 


The title of an instruction description includes the base mnemonic for the instruction. 


If different forms of an instruction use the same base mnemonic, each form has its own description. In this case, the 
title is the mnemonic followed by a short description of the instruction form in parentheses. This is most often used 
when an operand is an immediate value in one instruction form, but is a register in another form. 


For example, in Chapter C6 there are the following titles for different forms of the ADD instruction: 
. ADD (extended register) on page C6-758. 

° ADD (immediate) on page C6-761. 

è ADD (Shifted register) on page C6-763. 


An introduction to the instruction 


This briefly describes the function of the instruction. The introduction is not a complete description of the 
instruction, and it is not definitive. If there is any conflict between it and the more detailed information that follows 
it, the more detailed information takes priority. 


The instruction encoding or encodings 


This shows the instruction encoding diagram, or if the instruction has more than one encoding, shows all of the 
encoding diagrams. Each diagram has a subheading. 


For example, for load and store instructions, the subheadings might be: 
° Post-index. 
° Pre-index. 


è Unsigned offset. 


Each diagram numbers the bits from 31 to 0. The diagram for an instruction at address A shows, from left to right, 
the bytes at addresses 4+3, A+2, A+1, and A. 


There might be variants of an encoding, if the assembler syntax prototype differs depending on the value in one or 
more of the encoding fields. In this case, each variant has a subheading that describes the variant and shows the 
distinguishing field value or values in parentheses. For example, in Chapter C6 there are the following subheadings 
for variants of the ADC instruction encoding: 

$ 32-bit variant (sf = 0). 

. 64-bit variant (sf = 1). 


The assembler syntax prototype for an encoding or variant of an encoding shows how to form a complete assembler 
source code instruction that assembles to the encoding. Unless otherwise stated, the prototype is also the preferred 
syntax for a disassembler to disassemble the encoding to. Disassemblers are permitted to omit optional symbols that 
represent the default value of a field or set of fields, to produce more readable disassembled code, provided that the 
output re-assembles to the same encoding. 
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Each encoding diagram, and its associated assembler syntax prototypes, is followed by encoding-specific 
pseudocode that translates the fields of that encoding into inputs for the encoding-independent pseudocode that 
describes the operation of the instruction. See Pseudocode describing how the instruction operates on page C2-184. 


C2.1.4 Any alias conditions, if applicable 


This is an optional part of an instruction description. If included, it describes the set of conditions for which an 
alternative mnemonic and its associated assembler syntax prototypes are preferred for disassembly by a 
disassembler. It includes a link to the alias instruction description that defines the alternative syntax. The alias 
syntax and the original syntax can be used interchangeably in the assembler source code. 


Arm recommends that if a disassembler outputs the alias syntax, it consistently outputs the alias syntax. 


C2.1.5 A list of the assembler symbols for the instruction 
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The Assembler symbols subsection of the instruction description contains a list of the symbols that the assembler 
syntax prototype or prototypes use, if any. 


In assembler syntax prototypes, the following conventions are used: 


<> Angle brackets. Any symbol enclosed by these is a name or a value that the user supplies. For each 
symbol, there is a description of what the symbol represents. The description usually also specifies 
which encoding field or fields encodes the symbol. 


{} Brace brackets. Any symbols enclosed by these are optional. For each optional symbol, there is a 
description of what the symbol represents and how its presence or absence is encoded. 


In some assembler syntax prototypes, some brace brackets are mandatory, for example if they 
surround a register list. When the use of brace brackets is mandatory, they are separated from other 
syntax items by one or more spaces. 


# This usually precedes a numeric constant. All uses of # are optional in A64 assembler source code. 
Arm recommends that disassemblers output the # where the assembler syntax prototype includes it. 


+/- This indicates an optional + or - sign. If neither is coded, + is assumed. 


Single spaces are used for clarity, to separate syntax items. Where a space is mandatory, the assembler syntax 
prototype shows two or more consecutive spaces. 


Any characters not shown in this conventions list must be coded exactly as shown in the assembler syntax prototype. 
Apart from brace brackets, the characters shown are used as part of a meta-language to define the architectural 
assembler syntax for an instruction encoding or alias, but have no architecturally defined significance in the input 
to an assembler or in the output from a disassembler. 


The following symbol conventions are used: 


<Xn> The 64-bit name of a general-purpose register (X0-X30) or the zero register (XZR). 

<Wn> The 32-bit name of a general-purpose register (W0-W30) or the zero register (WZR). 

<Xn | SP> The 64-bit name of a general-purpose register (X0-X30) or the current stack pointer (SP). 
<Wn |WSP> The 32-bit name of a general-purpose register (W0-W30) or the current stack pointer (WSP). 


<Bn>, <Hn>, <Sn>, <Dn>, <Qn> 
The 8, 16, 32, 64 or 128-bit name of a SIMD and floating-point register in a scalar context as 
described in section Register names on page C1-174. 


<Vn> The name ofa SIMD and floating-point register name in a vector context as described in Register 
names on page C1-174. 


If the description of a symbol specifies that the symbol is a register, the description might also specify that the range 
of permitted registers is extended or restricted. It also specifies any differences from the default rules for such fields. 
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Note 


Register names on page C1-174 provides the A64 register names. 





C2.1.6 Pseudocode describing how the instruction operates 
The Operation subsection of the instruction description contains this pseudocode. 
It is encoding-independent pseudocode that provides a precise description of what the instruction does. 


Note 


For a description of Arm pseudocode, see Appendix K13 Arm Pseudocode Definition. This appendix also describes 
the execution model for an instruction. 








C2.1.7 Notes, if applicable 


If applicable, other notes about the instruction appear under additional subheadings. 
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C2.2 General information about the A64 instruction descriptions 


This section provides general information about the A64 instruction descriptions. Some of this information also 
applies to System register descriptions, for example the terms defined in Fixed values in AArch64 instruction and 
System register descriptions apply to the AArch64 descriptions throughout this manual. The following subsections 
provide this information: 


. Execution of instructions in debug state. 

$ Fixed values in AArch64 instruction and System register descriptions. 

. Modified immediate constants in A64 instructions on page C2-186. 
C2.2.1 Execution of instructions in debug state 


In general, except for the instructions described in Debug state on page C3-192, the A64 instruction descriptions do 
not indicate any differences in the behavior of the instruction if it is executed in Debug state. For this information, 
see Executing instructions in Debug state on page H2-6715. 


Note 


For many instructions, execution is unchanged in Debug state. Executing instructions in Debug state on 
page H2-6715 identifies these instructions, 








C2.2.2 Fixed values in AArch64 instruction and System register descriptions 


This section summarizes the terms used to describe fixed values in AArch64 register and instruction descriptions. 
The Glossary gives full descriptions of these terms, and each entry in this section includes a link to the 
corresponding Glossary entry. 


Note 


In register descriptions, the meaning of some bits depends on the PE state. This affects the definitions of RESO and 
RES1, as shown in the Glossary. 





The following terms are used to describe bits or fields with fixed values: 
RAZ Read-As-Zero. See Read-As-Zero (RAZ). 

In diagrams, a RAZ bit can be shown as 0. 
(0), RESO Reserved, Should-Be-Zero (SBZ) or RESO. 


In instruction encoding diagrams, and sometimes in other descriptions, (0) indicates an SBZ bit. If 
the bit is set to 1, behavior is CONSTRAINED UNPREDICTABLE, and must be one of the following: 


° The instruction is UNDEFINED. 

e The instruction is treated as a NOP. 

° The instruction executes as if the value of the bit was 0. 

à Any destination registers of the instruction become UNKNOWN. 


This notation can be expanded for fields, so a three-bit field can be shown as either (0) (0) (0) or as 
(000). 

In register diagrams, but not in the A64 encoding and instruction descriptions, bits or fields can be 
shown as RESO. See the Glossary definition of RESO for more information. 

Note 


Some of the System instruction descriptions in this chapter are based on the field description of the 
input value for the instruction. These are register descriptions and therefore can include RESO fields, 








The (0) and RESO descriptions can be applied to bits or bitfields that are read-only, or are write-only. 
The Glossary definitions cover these cases. 


RAO Read-As-One. See Read-As-One (RAO). 
In diagrams, a RAO bit can be shown as 1. 
(1), RESI Reserved, Should-Be-One (SBO) or RES1. 
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In instruction encoding diagrams, and sometimes in other descriptions, (1) indicates a SBO bit. If 
the bit is set to 0, behavior is CONSTRAINED UNPREDICTABLE, and must be one of the following: 


° The instruction is UNDEFINED. 

° The instruction is treated as a NOP. 

. The instruction executes as if the value of the bit was 1. 

- Any destination registers of the instruction become UNKNOWN. 


This notation can be expanded for fields, so a three-bit field can be shown as either (1)(1)(1) or as 
(111). 


In register diagrams, but not in the A64 encoding and instruction descriptions, bits or fields can be 
shown as RES1. See the Glossary definition of RES1 for more information. 


Note 


Some of the System instruction descriptions in this chapter are based on the field description of the 
input value for the instruction. These are register descriptions and therefore can include RES1 fields, 








The (1) and RES! descriptions can be applied to bits or bitfields that are read-only, or are write-only. 
The Glossary definitions cover these cases. 


C2.2.3 Modified immediate constants in A64 instructions 


It contains the following subsections: 


s Modified immediate constants in A64 floating-point instructions. 


Modified immediate constants in A64 floating-point instructions 


Table C2-1 shows the immediate constants available in FMOV (scalar, immediate) and FMOV (vector, immediate) 
floating-point instructions. 


Table C2-1 A64 Floating-point modified immediate constants 





Datatype immediate Constant a 











F16 abcdefgh aBbbcdef gh000000 
F32 abcdefgh aBbbbbbc defgh@00 00000000 00000000 
F64 abcdefgh aBbbbbbb bbcdefgh 00000000 00000000 20000000 00000000 02000000 a0000000 


a. In this column, B = NOT(b). The bit pattern represents the floating-point number (—1)S x 2°%P x mantissa, where 
S =UInt(a), exp = UInt(NOT(b) :c:d)-3 and mantissa = (16+UInt(e:f:g:h))/16. 
The immediate value shown in the table is either: 


° The value of the imm8 field for an FMOV (scalar, immediate) instruction, see (MOV (scalar, immediate) on 
page C7-1654. 


e The value obtained by concatenating the a:b:c:d:e:f:g:h fields field for an FMOV (vector, immediate) 
instruction, see FMOV (vector, immediate) on page C7-1647. 
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Table C2-2 shows the floating-point constant values encoded in the b:c:d:e:f:g:h fields of the FMOV (vector, 


immediate) instruction. 


Table C2-2 Floating-point constant values 
























































bed 
efgh 

000 001 010 011 100 101 110 111 
0000 2.0 4.0 8.0 16.0 0.125 0.25 0.5 1.0 
0001 2.125 425 8.5 17.0 0.1328125 0.265625 0.53125 1.0625 
0010 225 4.5 9.0 18.0 0.140625 0.28125 0.5625 1.125 
0011 2375 “ATS 955 19.0 0.1484375 0.296875 0.59375 1.1875 
0100 25 5.0 10.0 20.0 0.15625 0.3125 0.625 1.25 
0101 2.625 5.25 10.5 21.0 0.1640625 0.328125 0.65625 1.3125 
0110 2315 5.5 11.0 22.0 0.171875 0.34375 0.6875 1.375 
0111 2.875 5.75 11.5 23.0 0.1796875 0.359375 0.71875 1.4375 
1000 3.0 6.0 12.0 24.0 0.1875 0.375 0.75 1.5 
1001 3.125 6.25 12.5 25.0 0.1953125 0.390625 0.78125 1.5625 
1010 3.25 6.5 13.0 26.0 0.203125 0.40625 0.8125 1.625 
1011 3.375 6.75 13.5 27.0  0.2109375 0.421875 0.84375 1.6875 
1100 35 7.0 14.0 28.0 0.21875 0.4375 0.875 1:75 
1101 3.625 7.25 14.5 29.0 0.2265625 0.453125 0.90625 1.8125 
1110 3.75 7.5 15.0 30.0 0.234375 0.46875 0.9375 1.875 
1111 3.875 7.75 15.5 31.0  0.2421875 0.484375 0.96875 1.9375 





Operation of modified immediate constants, floating-point instructions 


For an A64 floating-point instruction that uses a modified immediate constant, the operation described by the 


VFPExpandImm() pseudocode function returns the value of the immediate constant. 
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This chapter provides an overview of the A64 instruction set. It contains the following sections: 


Branches, Exception generating, and System instructions on page C3-190. 
Loads and stores on page C3-197. 

Data processing - immediate on page C3-214. 

Data processing - register on page C3-219. 

Data processing - SIMD and floating-point on page C3-227. 


For a structured breakdown of instruction groups by encoding, see Chapter C4 464 Instruction Set Encoding. 
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C3.1.1 


C3.1.2 


C3-190 


Branches, Exception generating, and System instructions 


This section describes the branch, exception generating, and System instructions. It contains the following 
subsections: 


s Conditional branch. 
s Unconditional branch (immediate). 


. Unconditional branch (register) on page C3-191. 


° Exception generation and return on page C3-191. 

° System register instructions on page C3-192. 

° System instructions on page C3-192. 

° Hint instructions on page C3-193. 

e Barriers and CLREX instructions on page C3-193. 
7 Pointer authentication instructions on page C3-194. 


For information about the encoding structure of the instructions in this instruction group, see Branches, Exception 
Generating and System instructions on page C4-257. 


Note 


Software must: 





. Use only BLR or BL to perform a nested subroutine call when that subroutine is expected to return to the 
immediately following instruction, that is, the instruction with the address of the BLR or BL instruction 
incremented by four. 


° Use only RET to perform a subroutine return, when that subroutine is expected to have been entered by a BL 
or BLR instruction. 


. Use only B, BR, or the instructions listed in Table C3-1 to perform a control transfer that is not a subroutine 
call or subroutine return described in this Note. 





Conditional branch 


Conditional branches change the flow of execution depending on the current state of the Condition flags or the value 
in a general-purpose register. See Table C1-1 on page C1-173 for a list of the Condition codes that can be used for 
cond. 


Table C3-1 shows the Conditional branch instructions. 


Table C3-1 Conditional branch instructions 




















Mnemonic Instruction Branch offset range fromthe PC See 

B.cond Branch conditionally +1MB B.cond on page C6-798 
CBNZ Compare and branch if nonzero +1MB CBNZ on page C6-831 
CBZ Compare and branch if zero +1MB CBZ on page C6-832 
TBNZ Test bit and branch if nonzero +32KB TBNZ on page C6-1340 
TBZ Test bit and branch if zero +32KB TBZ on page C6-1341 








Unconditional branch (immediate) 


Unconditional branch (immediate) instructions change the flow of execution unconditionally by adding an 
immediate offset with a range of +128MB to the value of the program counter that fetched the instruction. The BL 
instruction also writes the address of the sequentially following instruction to general-purpose register, X30. 
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A64 Instruction Set Overview 
C3.1 Branches, Exception generating, and System instructions 


Table C3-2 shows the Unconditional branch instructions with an immediate branch offset. 


Table C3-2 Unconditional branch instructions (immediate) 











Mnemonic Instruction Immediate branch offset range fromthe PC See 
B Branch unconditionally +128MB B on page C6-799 
BL Branch with link +128MB BL on page C6-812 
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Unconditional branch (register) 


Unconditional branch (register) instructions change the flow of execution unconditionally by setting the program 
counter to the value in a general-purpose register. The BLR instruction also writes the address of the sequentially 
following instruction to general-purpose register X30. The RET instruction behaves identically to BR, but provides an 
additional hint to the PE that this is a return from a subroutine. Table C3-3 shows Unconditional branch instructions 
that jump directly to an address held in a general-purpose register. 


Table C3-3 Unconditional branch instructions (register) 














Mnemonic Instruction See 

BLR Branch with link to register BLR on page C6-813 
BR Branch to register BR on page C6-816 
RET Return from subroutine RET on page C6-1147 





Exception generation and return 


This section describes the following exceptions: 
7 Exception generating. 

5 Exception return on page C3-192. 

7 Debug state on page C3-192. 


Exception generating 


Table C3-4 shows the Exception generating instructions. 


Table C3-4 Exception generating instructions 























Mnemonic Instruction See 

BRK Breakpoint Instruction BRK on page C6-819 

HLT Halt Instruction HLT on page C6-908 

HVC Generate exception targeting Exception level 2 HVC on page C6-909 

SMC Generate exception targeting Exception level3_ SMC on page C6-1180 

SVC Generate exception targeting Exception level 1 SVC on page C6-1325 
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Exception return 


Table C3-5 shows the Exception return instructions. 


Table C3-5 Exception return instructions 





Mnemonic Instruction See 





ERET Exception return using current ELR and SPSR = ERET on page C6-900 





Debug state 


Table C3-6 shows the Debug state instructions. 


Table C3-6 Debug state instructions 

















Mnemonic Instruction See 

DCPS1 Debug switch to Exception level 1 DCPS/ on page C6-885 
DCPS2 Debug switch to Exception level 2 DCPS2 on page C6-886 
DCPS3 Debug switch to Exception level3 = DCPS3 on page C6-887 
DRPS Debug restore PE state DRPS on page C6-890 





C3.1.5 System register instructions 


For detailed information about the System register instructions, see Chapter C5 The A64 System Instruction Class. 
Table C3-7 shows the System register instructions. 


Table C3-7 System register instructions 

















Mnemonic Instruction See 
MRS Move System register to general-purpose register MRS on page C6-1104 
MSR Move general-purpose register to System register MSR (register) on page C6-1108 
Move immediate to PE state field MSR (immediate) on page C6-1105 
C3.1.6 System instructions 


For detailed information about the System instructions, see Chapter C5 The A64 System Instruction Class. 
Table C3-8 shows the System instructions. 


Table C3-8 System instructions 














Mnemonic Instruction See 

SYS System instruction SYS on page C6-1337 

SYSL System instruction with result SYSL on page C6-1339 

IC Instruction cache maintenance /C on page C6-910 and Table C5-1 on page C5-367 
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Table C3-8 System instructions (continued) 





Mnemonic 


DC 


Instruction 


Data cache maintenance 


See 


DC on page C6-883 and Table C5-1 on page C5-367 





AT 


Address translation 


AT on page C6-789 and Table C5-3 on page C5-368 





TLBI 


TLB Invalidate 


TLBI on page C6-1342 and Table C5-4 on page C5-369 





C3.1.7 Hint instructions 


Table C3-9 shows the Hint instructions. 


C3.1.8 


Barriers and CLREX instructions 


Table C3-9 Hint instructions 


























Mnemonic Instruction See 

NOP No operation NOP on page C6-1122 
YIELD Yield hint YIELD on page C6-1370 
WFE Wait for event WFE on page C6-1366 
WFI Wait for interrupt WFI on page C6-1367 
SEV Send event SEV on page C6-1176 
SEVL Send event local SEVL on page C6-1177 
HINT Unallocated hint HINT on page C6-906 





Table C3-10 shows the barrier and CLREX instructions. 


For more information about DSB, DMB, and ISB, see Memory barriers on page B2-124. 


Table C3-10 Barriers and CLREX instructions 

















Mnemonic Instruction See 

CLREX Clear Exclusives monitor CLREX on page C6-847 
DMB Data memory barrier DMB on page C6-888 
DSB Data synchronization barrier DSB on page C6-891 
ISB Instruction synchronization barrier ZSB on page C6-912 





Table C3-11 shows the speculation and synchronization barriers. If these instructions are not implemented, then 
these instructions execute as a NOP. 
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Table C3-11 Speculation and synchronization barriers 
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Mnemonic Instruction See 

CSDB Consumption of Speculative Data Barrier | CSDB on page C6-870 

ESB Error synchronization barrier ESB on page C6-902 

PSB CSYNC Profiling synchronization barrier PSB CSYNC on page C6-1144 
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Table C3-11 Speculation and synchronization barriers (continued) 














Mnemonic Instruction See 

PSSBB Physical Speculative Store Bypass Barrier PSSBB on page C6-1145 

SB Speculation Barrier SB on page C6-1163 

SSBB Speculative Store Bypass Barrier SSBB on page C6-1186 

TSB CSYNC Trace Synchronization Barrier TSB CSYNC on page C6-1345 





For more information about: 
. CSDB, PSSBB, SB, SSBB, TSB CSYNC, see Memory barriers on page B2-124. 


s ESB, see the ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMv8, for the ARMv8-A 
architecture profile. 


s PSB CSYNC, see Chapter D9 The Statistical Profiling Extension. 


C3.1.9 Pointer authentication instructions 


ARMv8.3-PAuth adds support for pointer authentication, see Pointer authentication in AArch64 state on 

page D5-2508. This functionality includes the A64 instructions described in this section. These instructions fall into 
two groups, see: 

s Basic pointer authentication instructions. 

. Combined instructions that include pointer authentication on page C3-196. 


Basic pointer authentication instructions 
Each of these instructions only performs an operation that supports pointer authentication. 


Table C3-12 shows the instructions that add a Pointer Authentication Code (PAC) to the address in a register: 


Table C3-12 Instructions that add a PAC 





Mnemonic Instruction See 





PACIASP Add PAC to instruction address using APIAKey _EL1 and SP PACIA, PACIA1716, PACIASP. PACIAZ, 
PACIZA on page C6-1132 





PACIAZ Add PAC to instruction address using APIAKey_EL1 and zero 





PACIA1716 Add PAC to instruction address X17 using APIAKey_ EL1 and X16 





PACIBSP Add PAC to instruction address using APIBKey_EL1 and SP PACIB, PACIB1716, PACIBSP. PACIBZ, 
PACIZB on page C6-1134 





PACIBZ Add PAC to instruction address using APIBKey_EL1 and zero 





PACIB1716 Add PAC to instruction address X17 using APIBKey_ EL1 and X16 




















PACIA Add PAC to instruction address using APIAKey_ ELI, registers PACIA, PACIA1716, PACIASP, PACIAZ, 
PACIZA on page C6-1132 

PACDA Add PAC to data address using APDAKey ELI, registers PACDA, PACDZA on page C6-1129 

PACIB Add PAC to instruction address using APIBKey_EL1, registers PACIB, PACIB1716, PACIBSP, PACIBZ, 
PACIZB on page C6-1134 

PACDB Add PAC to data address using APDBKey EL], registers PACDB, PACDZB on page C6-1130 

PACIZA Add PAC to instruction address using APIAKey_ EL], register and zero PACIA, PACIA1716, PACIASP, PACIAZ, 


PACIZA on page C6-1132 
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Table C3-12 Instructions that add a PAC (continued) 
















































































Mnemonic Instruction See 
PACDZA Add PAC to data address using APDAKey_ EL], register and zero PACDA, PACDZA on page C6-1129 
PACIZB Add PAC to instruction address using APIBKey_EL1, register and zero PACIB, PACIB1716, PACIBSP, PACIBZ, 
PACIZB on page C6-1134 
PACDZB Add PAC to data address using APDBKey_ EL], register and zero PACDB, PACDZB on page C6-1130 
PACGA Add generic PAC using APGAKey ELI, registers PACGA on page C6-1131 
Table C3-13 shows the instructions that authenticate a PAC in a register: 
Table C3-13 Instructions that authenticate a PAC 
Mnemonic Instruction See 
AUTIASP Authenticate PAC for instruction address using APIAKey_EL1 and SP AUTIA, AUTIA1716, AUTIASP, 
AUTIAZ, AUTIZA on page C6-793 
AUTIAZ Authenticate PAC for instruction address using APIAKey EL] and zero 
AUTIA1716 Authenticate PAC for instruction address X17 using APIAKey EL] and X16 
AUTIBSP Authenticate PAC for instruction address using APIBKey_EL1 and SP AUTIB, AUTIB1I716, AUTIBSP, 
AUTIBZ, AUTIZB on page C6-795 
AUTIBZ Authenticate PAC for instruction address using APIBKey_EL1 and zero 
AUTIB1716 Authenticate PAC for instruction address X17 using APIBKey_EL1 and X16 
AUTIA Authenticate PAC for instruction address using APIAKey EL], registers AUTIA, AUTIA1716, AUTIASP, 
AUTIAZ, AUTIZA on page C6-793 
AUTDA Authenticate PAC for data address using APDAKey_EL1, registers AUTDA, AUTDZA on page C6-791 
AUTIB Authenticate PAC for instruction address using APIBKey_EL1, registers AUTIB, AUTIB1I716, AUTIBSP, 
AUTIBZ, AUTIZB on page C6-795 
AUTDB Authenticate PAC for data address using APDBKey_ ELI, registers AUTDB, AUTDZB on page C6-792 
AUTIZA Authenticate PAC for instruction address using APIAKey ELI, register and = AUTIA, AUTIAI716, AUTIASP, 
zero AUTIAZ, AUTIZA on page C6-793 
AUTDZA Authenticate PAC for data address using APDAKey_ EL], register and zero AUTDA, AUTDZA on page C6-791 
AUTIZB Authenticate PAC for instruction address using APIBKey_ EL1, register and § AUTIB, AUTIB1716, AUTIBSP, 
zero AUTIBZ, AUTIZB on page C6-795 
AUTDZB Authenticate PAC for data address using APDBKey_ ELI, register and zero AUTDB, AUTDZB on page C6-792 
Table C3-14 shows the instructions that strip a PAC from a register, without performing any authentication: 
Table C3-14 Instructions that strip a PAC 
Mnemonic Instruction See 
XPACLRI Strip instruction address PAC from LR XPACD, XPACI, XPACLRI on page C6-1369 
XPACI Strip instruction address PAC, register 
XPACD Strip data address PAC, register 
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Combined instructions that include pointer authentication 


Each of these instructions combines a pointer authentication with another operation that uses the authenticated 


pointer. Table C3-15 shows these instructions: 


Table C3-15 Combined pointer authentication instructions 


















































Mnemonic Instruction See 

RETAA Authenticate PAC for LR using APIAKey_EL1 and SP, and return RETAA, RETAB on 
page C6-1148 

RETAB Authenticate PAC for LR using APIBKey_EL1 and SP, and return 

BRAA Authenticate PAC using APIAKey_ EL] (registers), and branch BRAA, BRAAZ, BRAB, 
BRABZ on page C6-817 

BRAB Authenticate PAC using APIBKey_ EL] (registers), and branch 

BLRAA Authenticate PAC using APIAKey EL] (registers), and branch with link BLRAA, BLRAAZ, BLRAB, 
BLRABZ on page C6-814 

BLRAB Authenticate PAC using APIBKey EL] (registers), and branch with link 

BRAAZ Authenticate PAC using APIAKey EL] (register and zero), and branch BRAA, BRAAZ, BRAB, 
BRABZ on page C6-817 

BRABZ Authenticate PAC using APIBKey_ EL] (register and zero), and branch 

BLRAAZ Authenticate PAC using APIAKey EL] (register and zero), and branch with link BLRAA, BLRAAZ, BLRAB, 

; ; f BLRABZ on page C6-814 
BLRABZ Authenticate PAC using APIBKey_EL1 (register and zero), and branch with link 
ERETAA Authenticate PAC for ELR using APIAKey EL] and SP, and exception return ERETAA, ERETAB on 
: page C6-901 

ERETAB Authenticate PAC for ELR using APIBKey_ EL! and SP, and exception return 

LDRAA Authenticate PAC for data address using APDAKey_ EL] (register and zero) and Load = LDRAA, LDRAB on 
page C6-983 

LDRAB Authenticate PAC for data address using APDBKey_ ELI (register and zero) and Load 
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C3.2 Loads and stores 


This section describes the Load/Store instructions. It contains the following subsections: 
$ Load/Store register. 

d Load/Store register (unscaled offset) on page C3-198. 

° Load/Store Pair on page C3-199. 

° Load/Store Non-temporal Pair on page C3-200. 

è Load/Store unprivileged on page C3-201. 

a Load-Exclusive/Store-Exclusive on page C3-201. 

a Load-Acquire/Store-Release on page C3-202. 

7 LoadLOAcquire/StoreLORelease on page C3-204. 

$ Load/Store scalar SIMD and floating-point on page C3-204. 
7 Load/Store Vector on page C3-206. 

s Prefetch memory on page C3-208. 

7 Compare and Swap on page C3-209. 

° Atomic memory operations on page C3-210. 

$ Swap on page C3-212. 

° Memory Tagging instructions on page C3-213. 


The requirements for the alignment of data memory accesses are strict, for more information see Alignment of data 
accesses on page B2-138. 


The additional control bits SCTLR_ELx.SA and SCTLR_EL1.SA0 control whether the stack pointer must be 
quadword aligned when used as a base register. See SP alignment checking on page D1-2287. Using a misaligned 
stack pointer generates an SP alignment fault exception. 


For information about the encoding structure of the instructions in this instruction group, see Loads and Stores on 
page C4-266. 





Note 


In some cases, Load/Store instructions can lead to CONSTRAINED UNPREDICTABLE behavior. See AArch64 
CONSTRAINED UNPREDICTABLE behaviors on page K1-7630. 





C3.2.1 Load/Store register 
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The Load/Store register instructions support the following addressing modes: 

° Base plus a scaled 12-bit unsigned immediate offset or base plus an unscaled 9-bit signed immediate offset. 
a Base plus a 64-bit register offset, optionally scaled. 

° Base plus a 32-bit extended register offset, optionally scaled. 

° Pre-indexed by an unscaled 9-bit signed immediate offset. 

° Post-indexed by an unscaled 9-bit signed immediate offset. 

$ PC-relative literal for loads of 32 bits or more. 


See also Load/Store addressing modes on page C1-177. 


Ifa Load instruction specifies writeback and the register being loaded is also the base register, then behavior is 
CONSTRAINED UNPREDICTABLE and one of the following behaviors must occur: 


° The instruction is treated as UNDEFINED. 
$ The instruction is treated as a NOP. 
° The instruction performs the load using the specified addressing mode and the base register becomes 


UNKNOWN. In addition, if an exception occurs during the execution of such an instruction, the base address 
might be corrupted so that the instruction cannot be repeated. 
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Ifa Store instruction performs a writeback and the register that is stored is also the base register, then behavior is 
CONSTRAINED UNPREDICTABLE and one of the following behaviors must occur: 


° The instruction is treated as UNDEFINED. 
° The instruction is treated as a NOP. 
. The instruction performs the store to the designated register using the specified addressing mode, but the 


value stored is UNKNOWN. 


Table C3-16 shows the Load/Store Register instructions. 


Table C3-16 Load/Store register instructions 


















































Mnemonic Instruction See 

LDR Load register (register offset) LDR (register) on page C6-981 
Load register (immediate offset) LDR (immediate) on page C6-976 
Load register (PC-relative literal) LDR (literal) on page C6-979 

LDRB Load byte (register offset) LDRB (register) on page C6-988 
Load byte (immediate offset) LDRB (immediate) on page C6-985 

LDRSB Load signed byte (register offset) LDRSB (register) on page C6-998 
Load signed byte (immediate offset) LDRSB (immediate) on page C6-995 

LDRH Load halfword (register offset) LDRH (register) on page C6-993 
Load halfword (immediate offset) LDRH (immediate) on page C6-990 

LDRSH Load signed halfword (register offset) LDRSH (register) on page C6-1003 
Load signed halfword (immediate offset) LDRSH (immediate) on page C6-1000 

LDRSW Load signed word (register offset) LDRSW (register) on page C6-1009 
Load signed word (immediate offset) LDRSW (immediate) on page C6-1005 





Load signed word (PC-relative literal) LDRSW (literal) on page C6-1008 























STR Store register (register offset) STR (register) on page C6-1242 
Store register (immediate offset) STR (immediate) on page C6-1239 

STRB Store byte (register offset) STRB (register) on page C6-1247 
Store byte (immediate offset) STRB (immediate) on page C6-1244 

STRH Store halfword (register offset) STRH (register) on page C6-1252 
Store halfword (immediate offset) STRH (immediate) on page C6-1249 





C3.2.2 Load/Store register (unscaled offset) 
The Load/Store register instructions with an unscaled offset support only one addressing mode: 
° Base plus an unscaled 9-bit signed immediate offset. 


See Load/Store addressing modes on page C1-177. 
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The Load/Store register (unscaled offset) instructions are required to disambiguate this instruction class from the 
Load/Store register instruction forms that support an addressing mode of base plus a scaled, unsigned 12-bit 
immediate offset, because that can represent some offset values in the same range. 


The ambiguous immediate offsets are byte offsets that are both: 
° In the range 0-255, inclusive. 
° Naturally aligned to the access size. 


Other byte offsets in the range -256 to 255 inclusive are unambiguous. An assembler program translating a 
Load/Store instruction, for example LDR, is required to encode an unambiguous offset using the unscaled 9-bit offset 
form, and to encode an ambiguous offset using the scaled 12-bit offset form. A programmer might force the 
generation of the unscaled 9-bit form by using one of the mnemonics in Table C3-17. Arm recommends that a 
disassembler outputs all unscaled 9-bit offset forms using one of these mnemonics, but unambiguous offsets can be 
output using a Load/Store single register mnemonic, for example, LDR. 


Table C3-17 shows the Load/Store register instructions with an unscaled offset. 


Table C3-17 Load/Store register (unscaled offset) instructions 
































Mnemonic Instruction See 

LDUR Load register (unscaled offset) LDUR on page C6-1058 
LDURB Load byte (unscaled offset) LDURB on page C6-1060 
LDURSB Load signed byte (unscaled offset) LDURSB on page C6-1062 
LDURH Load halfword (unscaled offset) LDURH on page C6-1061 
LDURSH Load signed halfword (unscaled offset) LDURSH on page C6-1064 
LDURSW Load signed word (unscaled offset) LDURSW on page C6-1066 
STUR Store register (unscaled offset) STUR on page C6-1290 
STURB Store byte (unscaled offset) STURB on page C6-1292 
STURH Store halfword (unscaled offset) STURH on page C6-1293 





C3.2.3 Load/Store Pair 


The Load/Store Pair instructions support the following addressing modes: 


° Base plus a scaled 7-bit signed immediate offset. 
° Pre-indexed by a scaled 7-bit signed immediate offset. 
° Post-indexed by a scaled 7-bit signed immediate offset. 


See also Load/Store addressing modes on page C1-177. 


If a Load Pair instruction specifies the same register for the two registers that are being loaded, then behavior is 
CONSTRAINED UNPREDICTABLE and one of the following behaviors must occur: 


s The instruction is treated as UNDEFINED. 
$ The instruction is treated as a NOP. 
° The instruction performs all the loads using the specified addressing mode and the register that is loaded takes 


an UNKNOWN value. 


Ifa Load Pair instruction specifies writeback and one of the registers being loaded is also the base register, then 
behavior is CONSTRAINED UNPREDICTABLE and one of the following behaviors must occur: 


. The instruction is treated as UNDEFINED. 
° The instruction is treated as a NOP. 
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C3.2.4 Load 


C3-200 


° The instruction performs all of the loads using the specified addressing mode, and the base register becomes 
UNKNOWN. In addition, if an exception occurs during the instruction, the base address might be corrupted so 
that the instruction cannot be repeated. 


Ifa Store Pair instruction performs a writeback and one of the registers being stored is also the base register, then 
behavior is CONSTRAINED UNPREDICTABLE and one of the following behaviors must occur: 


° The instruction is treated as UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction performs all the stores of the registers indicated by the specified addressing mode, but the 


value stored for the base register is UNKNOWN. 


Table C3-18 shows the Load/Store Pair instructions. 


Table C3-18 Load/Store Pair instructions 














Mnemonic Instruction See 

LDP Load Pair LDP on page C6-970 
LDPSW Load Pair signed words LDPSW on page C6-973 
STP Store Pair STP on page C6-1236 





/Store Non-temporal Pair 

The Load/Store Non-temporal Pair instructions support only one addressing mode: 
° Base plus a scaled 7-bit signed immediate offset. 

See Load/Store addressing modes on page C1-177. 


The Load/Store Non-temporal Pair instructions provide a hint to the memory system that an access is non-temporal 
or streaming, and unlikely to be repeated in the near future. This means that data caching is not required. However, 
depending on the memory type, the instructions might permit memory reads to be preloaded and memory writes to 
be gathered to accelerate bulk memory transfers. 


In addition, there is an exception to the usual memory ordering rules. If an address dependency exists between two 
memory reads, and a Load Non-temporal Pair instruction generated the second read, then in the absence of any other 
barrier mechanism to achieve order, the memory accesses can be observed in any order by the other observers within 
the shareability domain of the memory addresses being accessed. 


Ifa Load Non-Temporal Pair instruction specifies the same register for the two registers that are being loaded, then 
behavior is CONSTRAINED UNPREDICTABLE and one of the following must occur: 


$ The instruction is treated as UNDEFINED. 
- The instruction is treated as a NOP. 
° The instruction performs all the loads using the specified addressing mode and the register that is loaded takes 


an UNKNOWN value. 


Table C3-19 shows the Load/Store Non-temporal Pair instructions. 


Table C3-19 Load/Store Non-temporal Pair instructions 














Mnemonic Instruction See 

LDNP Load Non-temporal Pair LDNP on page C6-968 

STNP Store Non-temporal Pair STNP on page C6-1234 
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C3.2.5 Load/Store unprivileged 


The Load/Store unprivileged instructions support only one addressing mode: 
° Base plus an unscaled 9-bit signed immediate offset. 
See Load/Store addressing modes on page C1-177. 


The accesses permissions that apply to accesses made at ELO apply to the memory accesses made by a Load/Store 
unprivileged instruction that is executed either: 


. At EL1 when the Effective value of PSTATE.UAO is 0. 


è At EL2 when both the Effective value of HCR_EL2.{E2H, TGE} is {1, 1} and the Effective value of 
PSTATE.UAO is 0. 


Otherwise, memory accesses made by a Load/Store unprivileged instruction are subject to the access permissions 
that apply to the Exception level at which the instruction is executed. These are the permissions that apply to the 
corresponding Load/Store register instruction, see Load/Store register on page C3-197. 





Note 


This means that when the value of PSTATE.UAO is 1 the access permissions for a Load/Store unprivileged 
instruction are always the same as those for the corresponding Load/Store register instruction. 





Table C3-20 shows the Load/Store unprivileged instructions. 


Table C3-20 Load-Store unprivileged instructions 









































Mnemonic Instruction See 
LDTR Load unprivileged register LDTR on page C6-1032 
LDTRB Load unprivileged byte LDTRB on page C6-1034 
LDTRSB Load unprivileged signed byte LDTRSB on page C6-1038 
LDTRH Load unprivileged halfword LDTRH on page C6-1036 
LDTRSH Load unprivileged signed halfword ZLDTRSH on page C6-1040 
LDTRSW Load unprivileged signed word LDTRSW on page C6-1042 
STTR Store unprivileged register STTR on page C6-1272 
STTRB Store unprivileged byte STTRB on page C6-1274 
STTRH Store unprivileged halfword STTRH on page C6-1276 
C3.2.6 Load-Exclusive/Store-Exclusive 
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The Load-Exclusive/Store-Exclusive instructions support only one addressing mode: 
7 Base register with no offset. 
See Load/Store addressing modes on page C1-177. 


The Load-Exclusive instructions mark the physical address being accessed as an exclusive access. This exclusive 
access mark is checked by the Store-Exclusive instruction, permitting the construction of atomic read-modify-write 
operations on shared memory variables, semaphores, mutexes, and spinlocks. See Synchronization and semaphores 
on page B2-156. 
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C3.2.7 Load 


C3-202 


The Load-Exclusive/Store-Exclusive instructions other than Load-Exclusive pair and Store-Exclusive pair require 
natural alignment, and an unaligned address generates an Alignment fault. Memory accesses generated by 
Load-Exclusive pair or Store-Exclusive pair instructions must be aligned to the size of the pair, otherwise the access 
generates an Alignment fault. When a Store-Exclusive pair succeeds, it causes a single-copy atomic update of the 
entire memory location. 


Armv8.4 introduces changes to the alignment requirements of Load-Exclusive/Store-Exclusive instructions, see 
Load-Exclusive/ Store-Exclusive and Atomic instructions on page B2-138. 


Table C3-21 shows the Load-Exclusive/Store-Exclusive instructions. 


Table C3-21 Load-Exclusive/Store-Exclusive instructions 





























Mnemonic Instruction See 

LDXR Load Exclusive register LDXR on page C6-1069 
LDXRB Load Exclusive byte LDXRB on page C6-1071 
LDXRH Load Exclusive halfword LDXRH on page C6-1072 
LDXP Load Exclusive pair LDXP on page C6-1067 
STXR Store Exclusive register STXR on page C6-1297 
STXRB Store Exclusive byte STXRB on page C6-1299 
STXRH Store Exclusive halfword STXRH on page C6-1301 
STXP Store Exclusive pair STXP on page C6-1294 





-Acquire/Store-Release 

The Load-Acquire, Load-AcquirePC, and Store-Release instructions support only one addressing mode: 
è Base register with no offset. 

See Load/Store addressing modes on page C1-177. 


The Load-Acquire, Load-AcquirePC, and Store-Release instructions can remove the requirement to use the explicit 
DMB memory barrier instruction. For more information about the ordering of Load-Acquire, Load-AcquirePC, and 
Store-Release, see Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. 


The Load-Acquire, Load-AcquirePC, and Store-Release instructions other than Load-Acquire pair and 
Store-Release pair require natural alignment, and an unaligned address generates an Alignment fault. Memory 
accesses generated by Load-Acquire pair or Store-Release pair instructions must be aligned to the size of the pair, 
otherwise the access generates an Alignment fault. 


A Store-Release Exclusive instruction only has the Release semantics if the store is successful. 


Armv8.1 adds more instructions with load-acquire and store-release mechanisms, see 
LoadL OAcquire/StoreLORelease on page C3-204. 


Armv8.4 introduces changes to the alignment requirements of Load-Acquire/Store-Release instructions, see 
ARMvVv8.4-RCPC on page A2-81. 
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Table C3-22 shows the Non-exclusive Load-Acquire/Store-Release instructions. 
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Table C3-22 Non-exclusive Load-Acquire and Store-Release instructions 




































































Mnemonic Instruction See 

LDAPR Load-Acquire RCpc Register LDAPR on page C6-920 
LDAPRB Load-Acquire RCpc Register Byte LDAPRB on page C6-922 
LDAPRH Load-Acquire RCpc Register Halfword LDAPRH on page C6-924 
LDAPUR Load-Acquire RCpc Register (unscaled) LDAPUR on page C6-926 
LDAPURB Load-Acquire RCpc Register Byte (unscaled) LDAPURB on page C6-928 
LDAPURH Load-Acquire RCpc Register Halfword (unscaled) LDAPURH on page C6-930 
LDAPURSB Load-Acquire RCpc Register Signed Byte (unscaled) 32-bit LDAPURSB on page C6-932 
LDAPURSB Load-Acquire RCpc Register Signed Byte (unscaled) 64-bit LDAPURSB on page C6-932 
LDAPURSH Load-Acquire RCpc Register Signed Halfword (unscaled) 32-bit LDAPURSH on page C6-934 
LDAPURSH Load-Acquire RCpc Register Signed Halfword (unscaled) 64-bit ©LDAPURSH on page C6-934 
LDAPURSW Load-Acquire RCpc Register Signed Word (unscaled) LDAPURSW on page C6-936 
LDAR Load-Acquire Register LDAR on page C6-938 

LDARB Load-Acquire Byte LDARB on page C6-940 
LDARH Load-Acquire Halfword LDARH on page C6-941 
STLR Store-Release Register STLR on page C6-1216 
STLRB Store-Release Byte STLRB on page C6-1217 
STLRH Store-Release Halfword STLRH on page C6-1218 
STLUR Store-Release Register (unscaled) STLUR on page C6-1219 
STLURB Store-Release Register Byte (unscaled) STLURB on page C6-1221 
STLURH Store-Release Register Halfword (unscaled) STLURH on page C6-1223 





Table C3-23 shows the Exclusive Load-Acquire/Store-Release instructions. 


Table C3-23 Exclusive Load-Acquire and Store-Release instructions 

















Mnemonic Instruction See 

LDAXR Load-Acquire Exclusive register LDAXR on page C6-944 
LDAXRB Load-Acquire Exclusive byte LDAXRB on page C6-946 
LDAXRH Load-Acquire Exclusive halfword LDAXRH on page C6-947 
LDAXP Load-Acquire Exclusive pair LDAXP on page C6-942 
STLXR Store-Release Exclusive register STLXR on page C6-1228 
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Table C3-23 Exclusive Load-Acquire and Store-Release instructions (continued) 











Mnemonic Instruction See 

STLXRB Store-Release Exclusive byte STLXRB on page C6-1230 
STLXRH Store-Release Exclusive halfword STLXRH on page C6-1232 
STLXP Store-Release Exclusive pair STLXP on page C6-1225 





C3.2.8 LoadLOAcquire/StoreLORelease 


The LoadLOAcquire/StoreLORelease instructions support only one addressing mode: 
s Base register with no offset. 


See Load/Store addressing modes on page C1-177. 


The LoadLOAcquire/StoreLORelease instructions can remove the requirement to use the explicit DMB memory 
barrier instruction. For more information about the ordering of LoadLOAcquire/StoreLORelease, see 
LoadLOAcquire, StoreLORelease on page B2-130. 


The LoadLOAcquire/StoreLORelease instructions require natural alignment, and an unaligned address generates an 
Alignment fault. 


Table C3-24 shows the LoadLOAcquire/StoreLORelease instructions. 


Table C3-24 LoadLOAcquire and StoreLORelease instructions 























Mnemonic Instruction See 

LDLARB LoadLOAcquire byte LDLARB on page C6-964 
LDLARH LoadLOAcquire halfword LDLARH on page C6-965 
LDLAR LoadLOAcquire register LDLAR on page C6-966 
STLLRB StoreLORelease byte STLLRB on page C6-1212 
STLLRH StoreLORelease halfword STLLRH on page C6-1213 
STLLR StoreLORelease register STLLR on page C6-1214 








C3.2.9 Load/Store scalar SIMD and floating-point 


The Load/Store scalar SIMD and floating-point instructions operate on scalar values in the SIMD and floating-point 
register file as described in SIMD and floating-point scalar register names on page C1-175. The memory addressing 
modes available, described in Load/Store addressing modes on page C1-177, are identical to the general-purpose 
register Load/Store instructions, and like those instructions permit arbitrary address alignment unless strict 
alignment checking is enabled. However, unlike the Load/Store instructions that transfer general-purpose registers, 
Load/Store scalar SIMD and floating-point instructions make no guarantee of atomicity, even when the address is 
naturally aligned to the size of the data. 


Load/Store scalar SIMD and floating-point register 


The Load/Store scalar SIMD and floating-point register instructions support the following addressing modes: 


° Base plus a scaled 12-bit unsigned immediate offset or base plus unscaled 9-bit signed immediate offset. 
- Base plus 64-bit register offset, optionally scaled. 
è Base plus 32-bit extended register offset, optionally scaled. 
° Pre-indexed by an unscaled 9-bit signed immediate offset. 
° Post-indexed by an unscaled 9-bit signed immediate offset. 
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. PC-relative literal for loads of 32 bits or more. 


For more information on the addressing modes, see Load/Store addressing modes on page C1-177. 





Note 


The unscaled 9-bit signed immediate offset address mode requires its own instruction form, see Load/Store scalar 
SIMD and floating-point register (unscaled offset). 


Table C3-25 shows the Load/Store instructions for a single SIMD and floating-point register. 


Table C3-25 Load/Store single SIMD and floating-point register instructions 





Mnemonic Instruction See 





LDR 


Load scalar SIMD&FP register (register offset) LDR (register, SIMD&FP) on page C7-1806 





Load scalar SIMD&FP register (immediate offset) LDR (immediate, SIMD&FP) on page C7-1800 





Load scalar SIMD&FP register (PC-relative literal) LDR (literal, SIMD&FP) on page C7-1804 





STR 


Store scalar SIMD&FP register (register offset) STR (register, SIMD&FP) on page C7-2118 








Store scalar SIMD&FP register (immediate offset) STR (immediate, SIMD&FP) on page C7-2114 





ARM DDI 0487E.a 
ID070919 


Load/Store scalar SIMD and floating-point register (unscaled offset) 

The Load /Store scalar SIMD and floating-point register instructions support only one addressing mode: 
° Base plus an unscaled 9-bit signed immediate offset. 

See also Load/Store addressing modes on page C1-177. 


The Load/Store scalar SIMD and floating-point register (unscaled offset) instructions are required to disambiguate 
this instruction class from the Load/Store single SIMD and floating-point instruction forms that support an 
addressing mode of base plus a scaled, unsigned 12-bit immediate offset. This is similar to the Load/Store register 
(unscaled offset) instructions, that disambiguate this instruction class from the Load/Store register instruction, see 
Load/Store register (unscaled offset) on page C3-198. 


Table C3-26 shows the Load/Store SIMD and floating-point register instructions with an unscaled offset. 


Table C3-26 Load/Store SIMD and floating-point register instructions 








Mnemonic Instruction See 
LDUR Load scalar SIMD&FP register (unscaled offset) LDUR (SIMD&FP) on page C7-1809 
STUR Store scalar SIMD&FP register (unscaled offset) STUR (SIMD&FP) on page C7-2121 





Load/Store SIMD and Floating-point register pair 


The Load/Store SIMD and floating-point register pair instructions support the following addressing modes: 


° Base plus a scaled 7-bit signed immediate offset. 
° Pre-indexed by a scaled 7-bit signed immediate offset. 
° Post-indexed by a scaled 7-bit signed immediate offset. 


See also Load/Store addressing modes on page C1-177. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C3-205 
Non-Confidential 


A64 Instruction Set Overview 
C3.2 Loads and stores 


C3.2.10 


C3-206 


If a Load pair instruction specifies the same register for the two registers that are being loaded, then behavior is 
CONSTRAINED UNPREDICTABLE and one of the following behaviors must occur: 


s The instruction is treated as UNDEFINED. 
è The instruction is treated as a NOP. 
° The instruction performs all of the loads using the specified addressing mode and the register being loaded 


takes an UNKNOWN value. 


Table C3-27 shows the Load/Store SIMD and floating-point register pair instructions. 


Table C3-27 Load/Store SIMD and floating-point register pair instructions 











Mnemonic Instruction See 
LDP Load pair of scalar SIMD&FP registers LDP (SIMD&FP) on page C7-1796 
STP Store pair of scalar SIMD&FP registers STP (SIMD&FP) on page C7-2111 





Load/Store SIMD and Floating-point Non-temporal pair 

The Load/Store SIMD and Floating-point Non-temporal pair instructions support only one addressing mode: 
° Base plus a scaled 7-bit signed immediate offset. 

See also Load/Store addressing modes on page C1-177. 


The Load/Store Non-temporal pair instructions provide a hint to the memory system that an access is non-temporal 
or streaming, and unlikely to be repeated in the near future. This means that data caching is not required. However, 
depending on the memory type, the instructions might permit memory reads to be preloaded and memory writes to 
be gathered to accelerate bulk memory transfers. 


In addition, there is an exception to the usual memory ordering rules. If an address dependency exists between two 
memory reads, and a Load non-temporal pair instruction generated the second read, then in the absence of any other 
barrier mechanism to achieve order, those memory accesses can be observed in any order by the other observers 
within the shareability domain of the memory addresses being accessed. 


If a Load Non-temporal pair instruction specifies the same register for the two registers that are being loaded, then 
behavior is CONSTRAINED UNPREDICTABLE and one of the following behaviors must occur: 


7 The instruction is treated as UNDEFINED. 
è The instruction is treated as a NOP. 
° The instruction performs all the loads using the specified addressing mode and the register that is loaded takes 


an UNKNOWN value. 


Table C3-28 shows the Load/Store SIMD and floating-point Non-temporal pair instructions. 


Table C3-28 Load/Store SIMD and floating-point Non-temporal pair instructions 











Mnemonic Instruction See 
LDNP Load pair of scalar SIMD&FP registers LDNP (SIMD&FP) on page C7-1794 
STNP Store pair of scalar SIMD&FP registers STNP (SIMD&FP) on page C7-2109 





Load/Store Vector 


The Vector Load/Store structure instructions support the following addressing modes: 
$ Base register only. 
° Post-indexed by a 64-bit register. 
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Post-indexed by an immediate, equal to the number of bytes transferred. 


Load/Store vector instructions, like other Load/Store instructions, allow any address alignment, unless strict 
alignment checking is enabled. If strict alignment checking is enabled, then alignment checking to the size of the 
element is performed. However, unlike the Load/Store instructions that transfer general-purpose registers, the 
Load/Store vector instructions do not guarantee atomicity, even when the address is naturally aligned to the size of 


the element. 


Load/Store structures 


Table C3-29 shows the Load/Store structure instructions. A post-increment immediate offset, if present, must be 8, 


16, 24, 32, 48, or 64, depending on the number of elements transferred. 


Table C3-29 Load/Store multiple structures instructions 





















































Mnemonic Instruction See 
LD1 Load single 1-element structure to one lane of one register LD1 (single structure) on page C7-1757 
Load multiple 1-element structures to one register or to two, three, or four LD1 (multiple structures) on 
consecutive registers page C7-1753 
LD2 Load single 2-element structure to one lane of two consecutive registers LD2 (single structure) on page C7-1767 
Load multiple 2-element structures to two consecutive registers LD2 (multiple structures) on 
page C7-1764 
LD3 Load single 3-element structure to one lane of three consecutive registers LD3 (single structure) on page C7-1777 
Load multiple 3-element structures to three consecutive registers LD3 (multiple structures) on 
page C7-1774 
LD4 Load single 4-element structure to one lane of four consecutive registers LD4 (single structure) on page C7-1787 
Load multiple 4-element structures to four consecutive registers LD4 (multiple structures) on 
page C7-1784 
ST1 Store single 1-element structure from one lane of one register ST1 (single structure) on page C7-2084 
Store multiple 1-element structures from one register, or from two, three, STZ (multiple structures) on 
or four consecutive registers page C7-2080 
ST2 Store single 2-element structure from one lane of two consecutive ST2 (single structure) on page C7-2091 
registers 
Store multiple 2-element structures from two consecutive registers ST2 (multiple structures) on 
page C7-2088 
ST3 Store single 3-element structure from one lane of three consecutive ST3 (single structure) on page C7-2098 
registers 
Store multiple 3-element structures from three consecutive registers ST3 (multiple structures) on 
page C7-2095 
ST4 Store single 4-element structure from one lane of four consecutive ST4 (single structure) on page C7-2105 
registers 
ST4 Store multiple 4-element structures from four consecutive registers ST4 (multiple structures) on 


page C7-2102 
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C3.2.11 


C3-208 


Load single structure and replicate 


Table C3-30 shows the Load single structure and replicate instructions. A post-increment immediate offset, if 
present, must be 1, 2, 3, 4, 6, 8, 12, 16, 24, or 32, depending on the number of elements transferred. 


Table C3-30 Load single structure and replicate instructions 

















Mnemonic Instruction See 

LD1R Load single 1-element structure and replicate to all lanes of one register LDIR on page C7-1761 
LD2R Load single 2-element structure and replicate to all lanes of two registers LD2R on page C7-1771 
LD3R Load single 3-element structure and replicate to all lanes of three registers LD3R on page C7-1781 
LD4R Load single 4-element structure and replicate to all lanes of four registers | LD4R on page C7-1791 





Prefetch memory 


The Prefetch memory instructions support the following addressing modes: 

: Base plus a scaled 12-bit unsigned immediate offset or base plus an unscaled 9-bit signed immediate offset. 
s Base plus a 64-bit register offset. This can be optionally scaled by 8-bits, for example LSL#3. 

° Base plus a 32-bit extended register offset. This can be optionally scaled by 8-bits. 

è PC-relative literal. 


The prefetch memory instructions signal to the memory system that memory accesses from a specified address are 
likely to occur in the near future. The memory system can respond by taking actions that are expected to speed up 
the memory access when they do occur, such as preloading the specified address into one or more caches. Because 
these signals are only hints, it is valid for the PE to treat any or all prefetch instructions as a NOP. 


Because they are hints to the memory system, the operation of a PRFM instruction cannot cause a synchronous 
exception. However, a memory operation performed as a result of one of these memory system hints might in 
exceptional cases trigger an asynchronous event, and thereby influence the execution of the PE. An example of an 
asynchronous event that might be triggered is an SError interrupt. 


A PRFM instruction can only have an effect on software visible structures, such as caches and translation lookaside 
buffers associated with memory locations that can be accessed by reads, writes, or execution as defined in the 
translation regime of the current Exception level. 


A PRFM instruction is guaranteed not to access Device memory. 


A PRFM instruction using a PLI hint must not result in any access that could not be performed by the PE speculatively 
fetching an instruction. Therefore, if all associated MMUs are disabled, a PLI hint cannot access any memory 
location that cannot be accessed by instruction fetches. 


The PRFM instructions require an additional <prfop> operand to be specified, which must be one of the following: 
PLDLIKEEP, PLDLISTRM, PLDL2KEEP, PLDL2STRM, PLDL3KEEP, PLDL3STRM 
PSTLIKEEP, PSTLISTRM, PSTL2KEEP, PSTL2STRM, PSTL3KEEP, PSTL3STRM 
PLILIKEEP, PLILISTRM, PLIL2KEEP, PLIL2STRM, PLIL3KEEP, PLIL3STRM 


<prfop> is defined as <type><target><policy>. 


Here: 
<type> Is one of: 
PLD Prefetch for load. 
PST Prefetch for store. 
PLI Preload instructions. 
<target> Is one of: 
L1 Level 1 cache. 
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L2 Level 2 cache. 
L3 Level 3 cache. 
<policy> Is one of: 
KEEP Retained or temporal prefetch, allocated in the cache normally. 
STRM Streaming or non-temporal prefetch, for data that is used only once. 


PRFUM explicitly uses the unscaled 9-bit signed immediate offset addressing mode, as described in Load/Store 
register (unscaled offset) on page C3-198. 


Table C3-31 shows the Prefetch memory instructions. 


Table C3-31 Prefetch memory instructions 





Mnemonic _ Instruction See 





PRFM Prefetch memory (register offset) PRFM (register) on page C6-1140 





Prefetch memory (immediate offset) | PRFM (immediate) on page C6-1136 





Prefetch memory (PC-relative offset) PRFM (literal) on page C6-1138 





PRFUM Prefetch memory (unscaled offset) PRFUM on page C6-1142 





C3.2.12 Compare and Swap 
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The Compare and Swap instructions support only one addressing mode: 
s Base register only. 


See also Load/Store addressing modes on page C1-177. 


For the purpose of permission checking, and for watchpoints, all of the Compare and Swap instructions are treated 
as performing both a load and a store. 


The CAS instructions require natural alignment. 
The CASP instructions require alignment to the total size of the memory being accessed. 


All Compare and Swap instructions generate an Alignment fault if the address being accessed is not aligned to the 
size of the data structure being accessed. 


The instructions are provided with ordering options, which map to the acquire and release definitions used in the 
Armv8-A architecture. If a compare and swap instruction does not perform a store, then the instruction does not 
have release semantics, regardless of the instruction ordering options. 


The atomic instructions with release semantics have the same rules as Store-Release instructions regarding 
multi-copy atomicity. 


For the CAS and CASP instructions, the architecture permits that a data read clears any Exclusives monitors associated 
with that location, even if the compare subsequently fails. If these instructions generate a synchronous Data Abort, 
the registers which are compared and loaded are restored to the values held in the registers before the instruction 
was executed. 


Table C3-32 Compare and swap instructions 




















Mnemonic Instruction See 

CAS Compare and swap CAS, CASA, CASAL, CASL on page C6-829 

CASB Compare and swap byte CASB, CASAB, CASALB, CASLB on page C6-822 

CASH Compare and swap halfword CASH, CASAH, CASALH, CASLH on page C6-824 

CASP Compare and swap pair CASP, CASPA, CASPAL, CASPL on page C6-826 
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C3.2.13 Atomic memory operations 
The atomic memory operation instructions support only one addressing mode: 
s Base register only. 
See also Load/Store addressing modes on page C1-177. 
For the purpose of permission checking, and for watchpoints, all of the Compare and Swap instructions are treated 
as performing both a load and a store. 
The LD<0P> and ST<OP> instructions require natural alignment, and an unaligned address generates an Alignment 
fault. 
The instructions are provided with ordering options, which map to the acquire and release definitions used in the 
Armv8-A architecture. The atomic instructions with release semantics have the same rules as Store-Release 
instructions regarding multi-copy atomicity. These operations map to the acquire and release definitions, and are 
counted as Load-Acquire and Store-Release operations respectively. 
For the LD<0P> instructions, where the source and destination registers are the same, if the instruction generates a 
synchronous Data Abort, then the source register is restored to the value it held before the instruction was executed. 
The ST<0P> instructions, and LD<O0P> instructions where the destination register is WZR or XZR, are not regarded as 
doing a read for the purpose of a DMB LD barrier. 
Armv8.4 introduces changes to the alignment requirements of Atomic instructions, see Load-Exclusive/ 
Store-Exclusive and Atomic instructions on page B2-138. 
Table C3-33 Atomic memory operation instructions 
Mnemonic Instruction See 
LDADD Atomic add LDADD, LDADDA, LDADDAL, LDADDL on 
page C6-917 
LDADDB Atomic add on byte LDADDB, LDADDAB, LDADDALB, LDADDLB on 
page C6-913 
LDADDH Atomic add on halfword LDADDH, LDADDAH, LDADDALH, LDADDLH on 
page C6-915 
LDCLR Atomic bit clear LDCLR, LDCLRA, LDCLRAL, LDCLRL on page C6-952 
LDCLRB Atomic bit clear on byte LDCLRB, LDCLRAB, LDCLRALB, LDCLRLB on 
page C6-948 
LDCLRH Atomic bit clear on halfword LDCLRH, LDCLRAH, LDCLRALH, LDCLRLH on 
page C6-950 
LDEOR Atomic exclusive OR LDEOR, LDEORA, LDEORAL, LDEORL on page C6-959 
LDEORB Atomic exclusive OR on byte LDEORB, LDEORAB, LDEORALB, LDEORLB on 
page C6-955 
LDEORH Atomic exclusive OR on halfword LDEORH, LDEORAH, LDEORALH, LDEORLH on 
page C6-957 
LDSET Atomic bit set LDSET, LDSETA, LDSETAL, LDSETL on page C6-1015 
LDSETB Atomic bit set on byte LDSETB, LDSETAB, LDSETALB, LDSETLB on 
page C6-1011 
LDSETH Atomic bit set on halfword LDSETH, LDSETAH, LDSETALH, LDSETLH on 
page C6-1013 
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Table C3-33 Atomic memory operation instructions (continued) 




























































































Mnemonic Instruction See 

LDMAX Atomic signed maximum LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL on 
page C6-1022 

LDMAXB Atomic signed maximum on byte LDSMAXB, LDSMAXAB, LDSMAXALB, LDSMAXLB on 
page C6-1018 

LDMAXH Atomic signed maximum on halfword LDSMAXH, LDSMAXAH, LDSMAXALH, LDSMAXLH on 
page C6-1020 

LDMIN Atomic signed minimum LDSMIN, LDSMINA, LDSMINAL, LDSMINL on 
page C6-1029 

LDMINB Atomic signed minimum on byte LDSMINB, LDSMINAB, LDSMINALB, LDSMINLB on 
page C6-1025 

LDMINH Atomic signed minimum on halfword LDSMINH, LDSMINAH, LDSMINALH, LDSMINLH on 
page C6-1027 

LDUMAX Atomic unsigned maximum LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL on 
page C6-1048 

LDUMAXB Atomic unsigned maximum on byte LDUMAXB, LDUMAXAB, LDUMAXALB, LDUMAXLB 
on page C6-1044 

LDUMAXH Atomic unsigned maximum on halfword LDUMAXH, LDUMAXAH, LDUMAXALH, LDUMAXLH 
on page C6-1046 

LDUMIN Atomic unsigned minimum LDUMIN, LDUMINA, LDUMINAL, LDUMINL on 
page C6-1055 

LDUMINB Atomic unsigned minimum on byte LDUMINB, LDUMINAB, LDUMINALB, LDUMINLB on 
page C6-1051 

LDUMINH Atomic unsigned minimum on halfword LDUMINH, LDUMINAH, LDUMINALH, LDUMINLH on 
page C6-1053 

STADD Atomic add, without return STADD, STADDL on page C6-1193 

STADDB Atomic add on byte, without return STADDB, STADDLB on page C6-1189 

STADDH Atomic add on halfword, without return STADDH, STADDLH on page C6-1191 

STCLR Atomic bit clear, without return STCLR, STCLRL on page C6-1199 

STCLRB Atomic bit clear on byte, without return STCLRB, STCLRLB on page C6-1195 

STCLRH Atomic bit clear on halfword, without return STCLRH, STCLRLH on page C6-1197 

STEOR Atomic exclusive OR, without return STEOR, STEORL on page C6-1205 

STEORB Atomic exclusive OR on byte, without return STEORB, STEORLB on page C6-1201 

STEORH Atomic exclusive OR on halfword, without return STEORH, STEORLH on page C6-1203 

STSET Atomic bit set, without return STSET, STSETL on page C6-1258 

STSETB Atomic bit set on byte, without return STSETB, STSETLB on page C6-1254 

STSETH Atomic bit set on halfword, without return STSETH, STSETLH on page C6-1256 

STMAX Atomic signed maximum, without return STSMAX, STSMAXL on page C6-1264 
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Table C3-33 Atomic memory operation instructions (continued) 




































































Mnemonic Instruction See 
STMAXB Atomic signed maximum on byte, without return STSMAXB, STSMAXLB on page C6-1260 
STMAXH Atomic signed maximum on halfword, without return STSMAXH, STSMAXLH on page C6-1262 
STMIN Atomic signed minimum, without return STSMIN, STSMINL on page C6-1270 
STMINB Atomic signed minimum on byte, without return STSMINB, STSMINLB on page C6-1266 
STMINH Atomic signed minimum on halfword, without return STSMINH, STSMINLH on page C6-1268 
STUMAX Atomic unsigned maximum, without return STUMAX, STUMAXL on page C6-1282 
STUMAXB Atomic unsigned maximum on byte, without return STUMAXB, STUMAXLB on page C6-1278 
STUMAXH Atomic unsigned maximum on halfword, without return STUMAXH, STUMAXLH on page C6-1280 
STUMIN Atomic unsigned minimum, without return STUMIN, STUMINL on page C6-1288 
STUMINB Atomic unsigned minimum on byte, without return STUMINB, STUMINLB on page C6-1284 
STUMINH Atomic unsigned minimum on halfword, without return = STUMINH, STUMINLH on page C6-1286 
C3.2.14 Swap 
The swap instructions support only one addressing mode: 
$ Base register only. 
See also Load/Store addressing modes on page C1-177. 
For the purpose of permission checking, and for watchpoints, all of the Compare and Swap instructions are treated 
as performing both a load and a store. 
The SWP instructions require natural alignment, and an unaligned address generates an Alignment fault. 
The instructions are provided with ordering options, which map to the acquire and release definitions used in the 
Armv8-A architecture. The atomic instructions with release semantics have the same rules as Store-Release 
instructions regarding multi-copy atomicity. 
For the SWP instructions, where the source and destination registers are the same, if the instruction generates a 
synchronous Data Abort, then the source register is restored to the value it held before the instruction was executed. 
Table C3-34 Swap instructions 
Mnemonic Instruction See 
SWP Swap SWP, SWPA, SWPAL, SWPL on page C6-1330 
SWPB Swap byte SWPB, SWPAB, SWPALB, SWPLB on page C6-1326 
SWPH Swap halfword SWPH, SWPAH, SWPALH, SWPLH on 
page C6-1328 
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C3.2 Loads and stores 


Table C3-35 Tag generation instructions 



























































Mnemonic Instruction See 
ADDG Add immediate value to Logical ADDG on page C6-765 
Address Tag 
GMI Tag Mask Insert GMI on page C6-905 
IRG Random Logical Address Tag IRG on page C6-911 
generation 
SUBG Subtract immediate value to SUBG on 
Logical Address Tag page C6-1315 
Table C3-36 Pointer Arithmetic 
Mnemoniclnstruction See 
SUBP(S) Subtract address and set flagsSUBPS on page C6-1317 
Table C3-37 Tag setting instructions 
Mnemonic Instruction See 
STG Store Allocation Tag to granule STG on page C6-1207, 
STZG Store Allocation Tag to granule STZG on 
Zeroing page C6-1305 
ST2G Store Allocation Tag to two S72Gon 
granules page C6-1187, 
STZ2G Store Allocation Tag to two STZ2G on 
granules Zeroing page C6-1303 
STGP Store Allocation Tag to STGP on 
memory page C6-1210 
Table C3-38 Tag getting instructions 
Mnemonic Instruction See 
LDG Load Allocation Tag LDG on page C6-962 





Table C3-39 Bulk Allocation Tag access 











Mnemoniclnstruction See 

LDGM Load an IMPLEMENTATION DEFINED number of LDGM on page C6-963 
Allocation Tags 

STGM Store an IMPLEMENTATION DEFINED number of STGM on page C6-1209 
Allocation Tags 
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C3.3 


C3.3.1 


C3.3.2 


C3-214 


Data processing - immediate 


This section describes the instruction groups for data processing with immediate operands. It contains the following 
subsections: 


. Arithmetic (immediate). 

$ Logical (immediate). 

. Move (wide immediate) on page C3-215. 

° Move (immediate) on page C3-215. 

. PC-relative address calculation on page C3-216. 
è Bitfield move on page C3-216. 

. Bitfield insert and extract on page C3-217 

e Extract register on page C3-217. 

7 Shift (immediate) on page C3-217. 

s Sign-extend and Zero-extend on page C3-218. 


For information about the encoding structure of the instructions in this instruction group, see Data Processing -- 
Immediate on page C4-252. 


Arithmetic (immediate) 


The Arithmetic (immediate) instructions accept a 12-bit unsigned immediate value, optionally shifted left by 12 bits. 


The Arithmetic (immediate) instructions that do not set Condition flags can read from and write to the current stack 
pointer. The flag setting instructions can read from the stack pointer, but they cannot write to it. 


Table C3-40 shows the Arithmetic instructions with an immediate offset. 


Table C3-40 Arithmetic instructions with an immediate 























Mnemonic Instruction See 

ADD Add ADD (immediate) on page C6-761 
ADDS Add and set flags ADDS (immediate) on page C6-769 
SUB Subtract SUB (immediate) on page C6-1311 
SUBS Subtract and set flags SUBS (immediate) on page C6-1321 
CMP Compare CMP (immediate) on page C6-858 
CMN Compare negative CMN (immediate) on page C6-852 





Logical (immediate) 


The Logical (immediate) instructions accept a bitmask immediate value that is a 32-bit pattern or a 64-bit pattern 
viewed as a vector of identical elements of size e = 2, 4, 8, 16, 32 or, 64 bits. Each element contains the same 

sub-pattern, that is a single run of 1 to (e - 1) nonzero bits from bit 0 followed by zero bits, then rotated by 0 to (e - 
1) bits. This mechanism can generate 5334 unique 64-bit patterns as 2667 pairs of pattern and their bitwise inverse. 


Note 


Values that consist of only zeros or only ones cannot be described in this way. 





The Logical (immediate) instructions that do not set the Condition flags can write to the current stack pointer, for 
example to align the stack pointer in a function prologue. 
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Note 


Apart from ANDS, and its TST alias, Logical (immediate) instructions do not set the Condition flags. However, the 
final results of a bitwise operation can be tested by a CBZ, CBNZ, TBZ, or TBNZ conditional branch. 


Table C3-41 shows the Logical immediate instructions. 


Table C3-41 Logical immediate instructions 




















Mnemonic Instruction See 

AND Bitwise AND AND (immediate) on page C6-775 
ANDS Bitwise AND and set flags ANDS (immediate) on page C6-779 
EOR Bitwise exclusive OR EOR (immediate) on page C6-896 
ORR Bitwise inclusive OR ORR (immediate) on page C6-1125 
TST Test bits TST (immediate) on page C6-1346 





C3.3.3 Move (wide immediate) 


The Move (wide immediate) instructions insert a 16-bit immediate, or inverted immediate, into a 16-bit aligned 
position in the destination register. The value of the other bits in the destination register depends on the variant used. 
The optional shift amount can be any multiple of 16 that is smaller than the register size. 


Table C3-42 shows the Move (wide immediate) instructions. 


Table C3-42 Move (wide immediate) instructions 








Mnemonic Instruction See 

MOVZ Move wide with zero MOVZ on page C6-1102 
MOVN Move wide with NOT MOFYN on page C6-1100 
MOVK Move wide with keep | MOVK on page C6-1098 





C3.3.4 Move (immediate) 


The Move (immediate) instructions are aliases for a single MOVZ, MOVN, or ORR (immediate with zero register), 
instruction to load an immediate value into the destination register. An assembler must permit a signed or unsigned 
immediate, as long as its binary representation can be generated using one of these instructions, and an assembler 
error results if the immediate cannot be generated in this way. On disassembly, it is unspecified whether the 
immediate is output as a signed or an unsigned value. 


If there is a choice between the MOVZ, MOVN, and ORR instruction to encode the immediate, then an assembler must 
prefer MOVZ to MOVN, and MOVZ or MOVN to ORR, to ensure reversability. A disassembler must output ORR (immediate with 
zero register) MOVZ, and MOVN, as a MOV mnemonic except that the underlying instruction must be used when: 


a ORR has an immediate that can be generated by a MOVZ or MOWN instruction. 
$ A MOVN instruction has an immediate that can be encoded by MOVZ. 
à MOVZ #0 or MOVN #0 have a shift amount other than LSL #0. 
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Table C3-43 shows the Move (immediate) instructions. 


Table C3-43 Move (immediate) instructions 

















Mnemonic _ Instruction See 
MOV Move (inverted wide immediate) | MOV (inverted wide immediate) on page C6-1090 
Move (wide immediate) MOV (wide immediate) on page C6-1092 
Move (bitmask immediate) MOV (bitmask immediate) on page C6-1094 
C3.3.5 PC-relative address calculation 


The ADR instruction adds a signed, 21-bit immediate to the value of the program counter that fetched this instruction, 
and then writes the result to a general-purpose register. This permits the calculation of any byte address within 
+1MB of the current PC. 





The ADRP instruction shifts a signed, 21-bit immediate left by 12 bits, adds it to the value of the program counter with 
the bottom 12 bits cleared to zero, and then writes the result to a general-purpose register. This permits the 
calculation of the address at a 4KB aligned memory region. In conjunction with an ADD (immediate) instruction, or 
a Load/Store instruction with a 12-bit immediate offset, this allows for the calculation of, or access to, any address 
within +4GB of the current PC. 


Note 


The term page used in the ADRP description is short-hand for the 4KB memory region, and is not related to the virtual 
memory translation granule size. 








Table C3-44 shows the instructions used for PC-relative address calculations are as follows: 


Table C3-44 PC-relative address calculation instructions 





Mnemonic Instruction See 
ADRP Compute address of 4KB page at a PC-relative offset ADRP on page C6-774 
ADR Compute address of label at a PC-relative offset. ADR on page C6-773 





C3.3.6 Bitfield move 


The Bitfield move instructions copy a field of constant width from bit 0 in the source register to a constant bit 
position in the destination register, or from a constant bit position in the source register to bit 0 in the destination 
register. The remaining bits in the destination register are set as follows: 


. For BFM, the remaining bits are unchanged. 
s For UBFM the lower bits, if any, and upper bits, if any, are set to zero. 
° For SBFM, the lower bits, if any, are set to zero, and the upper bits, if any, are set to a copy of the 


most-significant bit in the copied field. 
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Table C3-45 shows the Bitfield move instructions. 


Table C3-45 Bitfield move instructions 





















































Mnemonic Instruction See 
BFM Bitfield move BFM on page C6-804 
SBFM Signed bitfield move SBFM on page C6-1170 
UBFM Unsigned bitfield move (32-bit)  UBFM on page C6-1351 
C3.3.7 Bitfield insert and extract 
The Bitfield insert and extract instructions are implemented as aliases of the Bitfield move instructions. Table C3-46 
shows the Bitfield insert and extract aliases. 
Table C3-46 Bitfield insert and extract instructions 
Mnemonic Instruction See 
BFC Bitfield insert clear BFC on page C6-800 
BFI Bitfield insert BFI on page C6-802 
BFXIL Bitfield extract and insert low BFXIL on page C6-806 
SBFIZ Signed bitfield insert in zero SBFIZ on page C6-1168 
SBFX Signed bitfield extract SBFX on page C6-1172 
UBFIZ Unsigned bitfield insert in zero UBFIZ on page C6-1349 
UBFX Unsigned bitfield extract UBFX on page C6-1353 
C3.3.8 Extract register 
Depending on the register width of the operands, the Extract register instruction copies a 32-bit or 64-bit field from 
a constant bit position within a double-width value formed by the concatenation of a pair of source registers to a 
destination register. 
Table C3-47 shows the Extract (immediate) instructions. 
Table C3-47 Extract register instructions 
Mnemonic Instruction See 
EXTR Extract register from pair EXTR on page C6-903 
C3.3.9 Shift (immediate) 
Shifts and rotates by a constant amount are implemented as aliases of the Bitfield move or Extract register 
instructions. The shift or rotate amount must be in the range 0 to one less than the register width of the instruction, 
inclusive. 
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Table C3-48 shows the aliases that can be used as immediate shift and rotate instructions. 


Table C3-48 Aliases for immediate shift and rotate instructions 





Mnemonic 


Instruction 


See 





ASR 


Arithmetic shift right 


ASR (immediate) on page C6-785 





LSL 


Logical shift left 


LSL (immediate) on page C6-1075 





LSR 


Logical shift right 


LSR (immediate) on page C6-1081 





ROR 


Rotate right 


ROR (immediate) on page C6-1157 





C3.3.10 Sign-extend and Zero-extend 


The Sign-extend and Zero-extend instructions are implemented as aliases of the Bitfield move instructions. 


Table C3-49 shows the aliases that can be used as zero-extend and sign-extend instructions. 


C3-218 


Table C3-49 Zero-extend and sign-extend instructions 




















Mnemonic Instruction See 

SXTB Sign-extend byte SXTB on page C6-1332 
SXTH Sign-extend halfword SXTH on page C6-1334 
SXTW Sign-extend word SXTW on page C6-1336 
UXTB Unsigned extend byte UXTB on page C6-1364 
UXTH Unsigned extend halfword UXTH on page C6-1365 





Non-Confidential 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


ARM DDI 0487E.a 
ID070919 


A64 Instruction Set Overview 
C3.4 Data processing - register 


C3.4 Data processing - register 


This section describes the instruction groups for data processing with all register operands. It contains the following 
subsections: 


° Arithmetic (shifted register). 

. Arithmetic (extended register) on page C3-220. 
è Arithmetic with carry on page C3-221. 

. Flag manipulation instructions on page C3-221. 
à Logical (shifted register) on page C3-221. 

° Move (register) on page C3-222. 

$ Shift (register) on page C3-222. 

. Multiply and divide on page C3-223. 

7 CRC32 on page C3-224. 

. Bit operation on page C3-225. 

š Conditional select on page C3-225. 

: Conditional comparison on page C3-226. 


For information about the encoding structure of the instructions in this instruction group, see Data Processing -- 
Register on page C4-299. 


C3.4.1 Arithmetic (shifted register) 


The Arithmetic (shifted register) instructions apply an optional shift operator to the second source register value 
before performing the arithmetic operation. The register width of the instruction controls whether the new bits are 
fed into the intermediate result on a right shift or rotate at bit[63] or bit[31]. 


The shift operators LSL, ASR, and LSR accept an immediate shift amount in the range 0 to one less than the register 
width of the instruction, inclusive. 


Omitting the shift operator implies LSL #0, which means that there is no shift. A disassembler must not output LSL 
#0. However, a disassembler must output all other shifts by zero. 


The current stack pointer, SP or WSP, cannot be used with this class of instructions. See Arithmetic (extended 
register) on page C3-220 for arithmetic instructions that can operate on the current stack pointer. 


Table C3-50 shows the Arithmetic (shifted register) instructions. 


Table C3-50 Arithmetic (shifted register) instructions 





























Mnemonic Instruction See 
ADD Add ADD (shifted register) on page C6-763 
ADDS Add and set flags ADDS (shifted register) on page C6-771 
SUB Subtract SUB (shifted register) on page C6-1313 
SUBS Subtract and set flags SUBS (shifted register) on page C6-1323 
CMN Compare negative CMN (shifted register) on page C6-854 
CMP Compare CMP (shifted register) on page C6-860 
NEG Negate NEG (shifted register) on page C6-1114 
NEGS Negate and set flags NEGS on page C6-1116 
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Arithmetic (extended register) 


The extended register instructions provide an optional sign-extension or zero-extension of a portion of the second 
source register value, followed by an optional left shift by a constant amount of 1-4, inclusive. 


The extended shift is described by the mandatory extend operator SXTB, SXTH, SXTW, UXTB, UXTH, or UXTW. This is 
followed by an optional left shift amount. If the shift amount is not specified, the default shift amount is zero. A 
disassembler must not output a shift amount of zero. 


For 64-bit instruction forms, the additional operators UXTX and SXTX use all 64 bits of the second source register with 
an optional shift. In that case, Arm recommends UXTX as the operator. If and only if at least one register is SP, Arm 
recommends use of the LSL operator name, rather than UXTX, and when the shift amount is also zero then both the 
operator and the shift amount can be omitted. UXTW and SXTW both use all 32 bits of the second source register with 
an optional shift. In that case Arm recommends UXTW as the operator. If and only if at least one register is WSP, Arm 
recommends use of the LSL operator name, rather than UXTW, and when the shift amount is also zero then both the 
operator and the shift amount can be omitted. 


For 32-bit instruction forms, the operators UXTW and SXTW both use all 32 bits of the second source register with an 
optional shift. In that case, Arm recommends UXTW as the operator. If and only if at least one register is WSP, Arm 
recommends use of the LSL operator name, rather than UXTW, and when the shift amount is also zero then both the 
operator and the shift amount can be omitted. 


The non-flag setting variants of the extended register instruction permit the use of the current stack pointer as either 
the destination register and the first source register. The flag setting variants only permit the stack pointer to be used 
as the first source register. 


In the 64-bit form of these instructions, the final register operand is written as Wm for all except the UXTX/LSL and SXTX 
extend operators. For example: 


CMP X4, W5, SXTW 
ADD X1, X2, W3, UXTB #2 
SUB SP, SP, X1 // SUB SP, SP, X1, UXTX #0 


Table C3-51 shows the Arithmetic (extended register) instructions. 


Table C3-51 Arithmetic (extended register) instructions 


























Mnemonic Instruction See 

ADD Add ADD (extended register) on page C6-758 
ADDS Add and set flags ADDS (extended register) on page C6-766 
SUB Subtract SUB (extended register) on page C6-1308 
SUBS Subtract and set flags SUBS (extended register) on page C6-1318 
CMN Compare negative CMN (extended register) on page C6-850 
CMP Compare CMP (extended register) on page C6-856 
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C3.4.3 Arithmetic with carry 


The Arithmetic with carry instructions accept two source registers, with the carry flag as an additional input to the 
calculation. They do not support shifting of the second source register. 


Table C3-52 shows the Arithmetic with carry instructions 


Table C3-52 Arithmetic with carry instructions 























Mnemonic Instruction See 

ADC Add with carry ADC on page C6-754 
ADCS Add with carry and set flags ADCS on page C6-756 
SBC Subtract with carry SBC on page C6-1164 
SBCS Subtract with carry and set flags SBCS on page C6-1166 
NGC Negate with carry NGC on page C6-1118 
NGCS Negate with carry and set flags NGCS on page C6-1120 





C3.4.4 Flag manipulation instructions 


The Flag manipulation instructions set the value of the NZCV condition flags directly. 


The instructions SETF8 and SETF16 accept one source register and set the NZV condition flags based on the value of 
the input register. The instruction RMIF accepts one source register and two immediate values, rotating the first 
source register using the first immediate value and setting the NZCV condition flags masked by the second 
immediate value. 


The instructions XAFLAG and AXFLAG convert PSTATE condition flags between the FCMP instruction format and an 
alternative format. See Table C6-1 on page C6-752 for more information. 


Table C3-53 shows the Flag manipulation instructions. 


Table C3-53 Flag manipulation instructions 























Mnemonic Instruction See 
AXFLAG Convert from FCMP comparison AXFLAG on page C6-797 
format to the alternative format 
CFINV Invert value of the PSTATE.C bit CFINV on page C6-841 
RMIF Rotate, mask insert flags RMIF on page C6-1156 
SETF8 Evaluation of 8-bit flags SETFS, SETF'16 on page C6-1175 
SETF16 Evaluation of 16-bit flags SETFS, SETF'16 on page C6-1175 
XAFLAG Convert from alternative format XAFLAG on page C6-1368 


to FCMP comparison format 





C3.4.5 Logical (shifted register) 
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The Logical (shifted register) instructions apply an optional shift operator to the second source register value before 
performing the main operation. The register width of the instruction controls whether the new bits are fed into the 
intermediate result on a right shift or rotate at bit[63] or bit[31]. 


The shift operators LSL, ASR, LSR, and ROR accept a constant immediate shift amount in the range 0 to one less than 
the register width of the instruction, inclusive. 
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Omitting the shift operator and amount implies LSL #0, which means that there is no shift. A disassembler must not 
output LSL #0. However, a disassembler must output all other shifts by zero. 





Apart from ANDS, TST, and BICS the logical instructions do not set the Condition flags, but the final result of a bit 
operation can usually directly control a CBZ, CBNZ, TBZ, or TBNZ conditional branch. 





Table C3-54 shows the Logical (shifted register) instructions. 


C3.4.6 Move (register) 


Table C3-54 Logical (shifted register) instructions 



































Mnemonic Instruction See 

AND Bitwise AND AND (shifted register) on page C6-777 
ANDS Bitwise AND and set flags ANDS (shifted register) on page C6-781 
BIC Bitwise bit clear BIC (shifted register) on page C6-808 
BICS Bitwise bit clear and set flags BICS (shifted register) on page C6-810 
EON Bitwise exclusive OR NOT EON (shifted register) on page C6-894 
EOR Bitwise exclusive OR EOR (shifted register) on page C6-898 
ORR Bitwise inclusive OR ORR (shifted register) on page C6-1127 
MVN Bitwise NOT MVN on page C6-1112 

ORN Bitwise inclusive OR NOT ORN (shifted register) on page C6-1123 
TST Test bits TST (shifted register) on page C6-1347 


The Move (register) instructions are aliases for other data processing instructions. They copy a value from a 


C3.4.7 


C3-222 


general-purpose register to another general-purpose register or the current stack pointer, or from the current stack 
pointer to a general-purpose register. 


Table C3-55 MOV register instructions 





Mnemonic _ Instruction See 





MOV Move register MOV (register) on page C6-1096 





Move register to SP or move SP to register MOV (to/from SP) on page C6-1089 


Shift (register) 


In the Shift (register) instructions, the shift amount is the positive value in the second source register modulo the 
register size. The register width of the instruction controls whether the new bits are fed into the result on a right shift 
or rotate at bit[63] or bit[31]. 
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Table C3-56 shows the Shift (register) instructions. 


Table C3-56 Shift (register) instructions 

















Mnemonic Instruction See 

ASRV Arithmetic shift right variable ASRV on page C6-787 
LSLV Logical shift left variable LSLV on page C6-1077 
LSRV Logical shift right variable LSRV on page C6-1083 
RORV Rotate right variable RORY on page C6-1161 





However, the Shift (register) instructions have a preferred set of aliases that match the shift immediate aliases 
described in Shift (immediate) on page C3-217. 


Table C3-57 shows the aliases for Shift (register) instructions. 


Table C3-57 Aliases for Variable shift instructions 

















Mnemonic Instruction See 

ASR Arithmetic shift right ASR (register) on page C6-783 
LSL Logical shift left LSL (register) on page C6-1073 
LSR Logical shift right LSR (register) on page C6-1079 
ROR Rotate right ROR (register) on page C6-1159 





Multiply and divide 


This section describes the instructions used for integer multiplication and division. It contains the following 


subsections: 
. Multiply. 
$ Divide on page C3-224. 


Multiply 


The Multiply instructions write to a single 32-bit or 64-bit destination register, and are built around the fundamental 
four operand multiply-add and multiply-subtract operation, together with 32-bit to 64-bit widening variants. A 

64-bit to 128-bit widening multiple can be constructed with two instructions, using SMULH or UMULH to generate the 
upper 64 bits. Table C3-58 shows the Multiply instructions. 


Table C3-58 Multiply integer instructions 























Mnemonic Instruction See 

MADD Multiply-add MADD on page C6-1085 
MSUB Multiply-subtract MSUB on page C6-1109 
MNEG Multiply-negate MNEG on page C6-1087 
MUL Multiply MUL on page C6-1111 
SMADDL Signed multiply-add long SMADDL on page C6-1178 
SMSUBL Signed multiply-subtract long SMSUBL on page C6-1182 
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Table C3-58 Multiply integer instructions (continued) 






































Mnemonic Instruction See 

SMNEGL Signed multiply-negate long SMNEGL on page C6-1181 
SMULL Signed multiply long SMULL on page C6-1185 
SMULH Signed multiply high SMULH on page C6-1184 
UMADDL Unsigned multiply-add long UMADDL on page C6-1357 
UMSUBL Unsigned multiply-subtract long UMSUBL on page C6-1360 
UMNEGL Unsigned multiply-negate long UMNEGL on page C6-1359 
UMULL Unsigned multiply long UMULL on page C6-1363 
UMULH Unsigned multiply high UMULHB on page C6-1362 





Divide 


The Divide instructions compute the quotient of a division, rounded towards zero. The remainder can then be 
computed as (numerator - (quotient x denominator)), using the MSUB instruction. 


Ifa signed integer division (INT_MIN / -1) is performed where INT_MIN is the most negative integer value 
representable in the selected register size, then the result overflows the signed integer range. No indication of this 
overflow is produced and the result that is written to the destination register is INT_MIN. 


A division by zero results in a zero being written to the destination register, without any indication that the division 


by zero occurred. 


Table C3-59 shows the Divide instructions. 


C3.4.9 CRC32 


Table C3-59 Divide instructions 











Mnemonic Instruction See 
SDIV Signed divide SDIV on page C6-1174 
UDIV Unsigned divide | UDIV on page C6-1356 





The CRC32 instructions operate on the general-purpose register file to update a 32-bit CRC value from an input value 
comprising 1, 2, 4, or 8 bytes. There are two different classes of CRC instructions, CRC32, and CRC32C, that support two 
commonly used 32-bit polynomials, known as CRC-32 and CRC-32C. 


To fit with common usage, the bit order of the values is reversed as part of the operation. 


When bits[19:16] of ID AA64ISARO_ EL] are set to @b0001, the CRC instructions are implemented. 


These instructions are optional in an Armv8.0 implementation. 


All implementations of Armv8.1 architecture and later are required to implement the CRC32 instructions. 
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Table C3-60 shows the CRC instructions. 
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Table C3-60 CRC32 instructions 
































Mnemonic Instruction See 

CRC32B CRC-32 sum from byte CRC32B, CRC32H, CRC32W, CRC32X on page C6-866 
CRC32H CRC-32 sum from halfword CRC32B, CRC32H, CRC32W, CRC32X on page C6-866 
CRC32W CRC-32 sum from word CRC32B, CRC32H, CRC32W, CRC32X on page C6-866 
CRC32X CRC-32 sum from doubleword CRC32B, CRC32H, CRC32W, CRC32X on page C6-866 
CRC32CB CRC-32C sum from byte CRC32CB, CRC32CH, CRC32CW, CRC32CX on page C6-868 
CRC32CH CRC-32C sum from halfword CRC32CB, CRC32CH, CRC32CW, CRC32CX on page C6-868 
CRC32CW CRC-32C sum from word CRC32CB, CRC32CH, CRC32CW, CRC32CX on page C6-868 
CRC32CX CRC-32C sum from doubleword CRC32CB, CRC32CH, CRC32CW, CRC32CX on page C6-868 





Bit operation 


Table C3-61 shows the Bit operation instructions. 


Table C3-61 Bit operation instructions 


























Mnemonic Instruction See 

CLS Count leading sign bits CLS on page C6-848 
CLZ Count leading zero bits CLZ on page C6-849 
RBIT Reverse bit order RBIT on page C6-1146 
REV Reverse bytes in register REV on page C6-1149 
REV16 Reverse bytes in halfwords REV16 on page C6-1151 
REV32 Reverses bytes in words REV32 on page C6-1153 
REV64 Reverse bytes in register REV64 on page C6-1155 





Conditional select 


The Conditional select instructions select between the first or second source register, depending on the current state 
of the Condition flags. When the named condition is true, the first source register is selected and its value is copied 
without modification to the destination register. When the condition is false the second source register is selected 

and its value might be optionally inverted, negated, or incremented by one, before writing to the destination register. 


Other useful conditional set and conditional unary operations are implemented as aliases of the four Conditional 
select instructions. 
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Table C3-62 shows the Conditional select instructions. 


Table C3-62 Conditional select instructions 
































Mnemonic Instruction See 

CSEL Conditional select CSEL on page C6-871 
CSINC Conditional select increment CSINC on page C6-877 
CSINV Conditional select inversion CSINV on page C6-879 
CSNEG Conditional select negation CSNEG on page C6-881 
CSET Conditional set CSET on page C6-873 
CSETM Conditional set mask CSETM on page C6-875 
CINC Conditional increment CINC on page C6-843 
CINV Conditional invert CINV on page C6-845 
CNEG Conditional negate CNEG on page C6-863 





C3.4.12 Conditional comparison 


The Conditional comparison instructions provide a conditional select for the NZCV Condition flags, setting the 
flags to the result of an arithmetic comparison of its two source register values if the named input condition is true, 
or to an immediate value if the input condition is false. There are register and immediate forms. The immediate form 
compares the source register to a small 5-bit unsigned value. 


Table C3-63 shows the Conditional comparison instructions. 


Table C3-63 Conditional comparison instructions 




















Mnemonic Instruction See 

CCMN Conditional compare negative (register) CCMN (register) on page C6-835 

CCMN Conditional compare negative (immediate) CCMN (immediate) on page C6-833 

CCMP Conditional compare (register) CCMP (register) on page C6-839 

CCMP Conditional compare (immediate) CCMP (immediate) on page C6-837 
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C3.5 Data processing - SIMD and floating-point 


This section describes the instruction groups for data processing with SIMD and floating-point register operands. 
Common features of SIMD instructions gives general information about SIMD instructions. 


The following subsections describe the scalar floating-point data processing instructions: 
. Floating-point move (register) on page C3-228. 
. Floating-point move (immediate) on page C3-228. 


° Floating-point conversion on page C3-229. 

. Floating-point round to integral value on page C3-230. 
. Floating-point multiply-add on page C3-232. 

. Floating-point arithmetic (one source) on page C3-232. 
. Floating-point arithmetic (two sources) on page C3-232. 
s Floating-point minimum and maximum on page C3-233. 


$ Floating-point comparison on page C3-233. 
° Floating-point conditional select on page C3-234. 


The following subsections describe the SIMD data processing instructions: 
s SIMD move on page C3-234 

e SIMD arithmetic on page C3-234. 

7 SIMD compare on page C3-237. 

. SIMD widening and narrowing arithmetic on page C3-237. 

s SIMD table lookup on page C3-246. 

s SIMD by element arithmetic on page C3-240. 

, SIMD permute on page C3-242. 

s SIMD immediate on page C3-242. 

7 SIMD shift (immediate) on page C3-242. 

° SIMD floating-point and integer conversion on page C3-243. 
- SIMD reduce (across vector lanes) on page C3-244. 

° SIMD pairwise arithmetic on page C3-245. 

x SIMD dot product on page C3-246. 

- SIMD table lookup on page C3-246. 

- SIMD complex number arithmetic on page C3-246. 

: The Cryptographic Extension on page C3-247. 


For information about the encoding structure of the instructions in this instruction group, see Data Processing -- 
Scalar Floating-Point and Advanced SIMD on page C4-309. 


For information about the floating-point exceptions, see Floating-point exceptions and exception traps on 
page D1-2313. 


C3.5.1 Common features of SIMD instructions 
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A number of SIMD instructions come in three forms: 


Wide Indicated by the suffix W. The element width of the destination register and the first source operand 
is double that of the second source operand. 


Long Indicated by the suffix L. The element width of the destination register is double that of both source 
operands. 
Narrow Indicated by the suffix N. The element width of the destination register is half that of both source 
operands. 
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In addition, each vector form of the instruction is part of a pair, with a second and upper half suffix of 2, to identify 
the variant of the instruction: 


s Where a SIMD operation widens or lengthens a 64-bit vector to a 128-bit vector, the instruction provides a 
second part operation that can extract the source from the upper 64 bits of the source registers. 


è Where a SIMD operation narrows a 128-bit vector to a 64-bit vector, the instruction provides a second-part 
operation that can pack the result of a second operation into the upper part of the same destination register. 


Note 
This is referred to as a lane set specifier. 





C3.5.2 Floating-point move (register) 


The Floating-point move (register) instructions copy a scalar floating-point value from one register to another 
register without performing any conversion. 


Some of the Floating-point move (register) instructions overlap with the functionality provided by the Advanced 
SIMD instructions DUP, INS, and UMOV. However, Arm recommends using the FMOV instructions when operating on 
scalar floating-point data to avoid the creation of scalar floating-point code that depends on the availability of the 
Advanced SIMD instruction set. 


Table C3-64 shows the Floating-point move (register) instructions. 


Table C3-64 Floating-point move (register) instructions 





Mnemonic 


Instruction See 





FMOV 


Floating-point move register without conversion FMOV (register) on page C7-1649 





Floating-point move to or from general-purpose register without conversion MOV (general) on page C7-1651 





C3.5.3 Floating-point move (immediate) 


C3-228 


The Floating-point move (immediate) instructions convert a small constant immediate floating-point value into a 
half-precision, single-precision, or double-precision scalar floating-point value in a SIMD and floating-point 
register. 


The floating-point constant can be specified either in decimal notation, such as 12.0 or -1.2e1, or as a string 
beginning with 0x followed by a hexadecimal representation of the IEEE 754 half-precision, single-precision, or 
double-precision encoding. Arm recommends that a disassembler uses the decimal notation, provided that this 
displays the value precisely. 





Note 


When ARMvV8.2-FP 16 is not implemented, the only half-precision instructions that are supported are floating-point 
conversions between half-precision, single-precision, and double-precision. 








The floating-point value must be expressible as (+ /16 x 2°), where n is an integer in the range 16 < n <31 andr is 
an integer in the range of -3 <r <4, that is a normalized binary floating-point encoding with one sign bit, four bits 
of fraction, and a 3-bit exponent. 


Table C3-65 shows the Floating-point move (immediate) instruction: 


Table C3-65 Floating-point move (immediate) instruction 





Mnemonic Instruction See 





FMOV Floating-point move immediate FMOV (scalar, immediate) on page C7-1654 
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C3.5.4 Floating-point conversion 
The following subsections describe the conversion of floating-point values: 
s Convert floating-point precision. 
s Convert between floating-point and integer or fixed-point. 
Convert floating-point precision 
These instructions convert a floating-point scalar with one precision to a floating-point scalar with a different 
precision, using the current rounding mode as specified by FPCR.RMode. 
Table C3-66 shows the Floating-point precision conversion instruction. 
Table C3-66 Floating-point precision conversion instruction 
Mnemonic Instruction See 
FCVT Floating-point convert precision (scalar) FCVT on page C7-1512 
Convert between floating-point and integer or fixed-point 
These instructions convert a floating-point scalar in a SIMD and floating-point register to or from a signed or 
unsigned integer or fixed-point value in a general-purpose register. For a fixed-point value, a final immediate 
operand indicates that the general-purpose register holds a fixed-point number and fbits indicates the number of 
bits after the binary point. fbits is in the range 1- 32 inclusive for a 32-bit general-purpose register name, and 1-64 
inclusive for a 64-bit general-purpose register name. 
These instructions can cause the following floating-point exceptions: 
Invalid Operation 
Occurs if the floating-point input is a NaN, infinity, or a numerical value that cannot be represented 
in the destination register. An out of range integer or fixed-point result is saturated to the size of the 
destination register. 
Inexact Occurs if the numeric result that differs from the input value. 
Input Denormal 
As Flush-to-zero on page A1-54 describes, when Flush-to-zero mode is enabled, occurs when zero 
replaces a double-precision or single-precision denormal input. 
Note 
When ARMv8.2-FP16 is implemented, a half-precision denormal input that is flushed to zero does 
not generate an Input Denormal exception. 
Table C3-67 shows the Floating-point and fixed-point conversion instructions. 
Table C3-67 Floating-point and integer or fixed-point conversion instructions 
Mnemonic Instruction See 
FCVTAS Floating-point scalar convert to signed integer, rounding to nearest FCVTAS (scalar) on page C7-1517 
with ties to away (scalar form) 
FCVTAU Floating-point scalar convert to unsigned integer, rounding to FCVTAU (scalar) on page C7-1522 
nearest with ties to away (scalar form) 
FCVTMS Floating-point scalar convert to signed integer, rounding toward FCVTMS (scalar) on page C7-1529 
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minus infinity (scalar form) 
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Table C3-67 Floating-point and integer or fixed-point conversion instructions (continued) 












































Mnemonic Instruction See 
FCVTMU Floating-point scalar convert to unsigned integer, rounding toward = FCVTMU (scalar) on page C7-1534 
minus infinity (scalar form) 
FCVTNS Floating-point scalar convert to signed integer, rounding to nearest FCVTNS (scalar) on page C7-1541 
with ties to even (scalar form) 
FCVTNU Floating-point scalar convert to unsigned integer, rounding to FCVTNU (scalar) on page C7-1546 
nearest with ties to even (scalar form) 
FCVTPS Floating-point scalar convert to signed integer, rounding toward FCVTPS (scalar) on page C7-1551 
positive infinity (scalar form) 
FCVTPU Floating-point scalar convert to unsigned integer, rounding toward FCVTPU (scalar) on page C7-1556 
positive infinity (scalar form) 
FCVTZS Floating-point scalar convert to signed integer, rounding toward FCVTZS (scalar, integer) on page C7-1568 
zero (scalar form) 
Floating-point convert to signed fixed-point, rounding toward zero FCVTZS (scalar, fixed-point) on page C7-1566 
(scalar form) 
FCVTZU Floating-point scalar convert to unsigned integer, rounding toward == FCVTZU (scalar, integer) on page C7-1578 
zero (scalar form) 
Floating-point scalar convert to unsigned fixed-point, rounding FCVTZU (scalar, fixed-point) on page C7-1576 
toward zero (scalar form) 
FICVTZS Floating-point Javascript convert to signed fixed-point, rounding FICVTZS on page C7-1584 
toward zero 
SCVTF Signed integer scalar convert to floating-point, using the current SCVTF (scalar, integer) on page C7-1894 
rounding mode (scalar form) 
Signed fixed-point convert to floating-point, using the current SCVTF (scalar, fixed-point) on page C7-1892 
rounding mode (scalar form) 
UCVTF Unsigned integer scalar convert to floating-point, using the current = UCVTF (scalar, integer) on page C7-2165 
rounding mode (scalar form) 
Unsigned fixed-point convert to floating-point, using the current UCVTF (scalar, fixed-point) on page C7-2163 
rounding mode (scalar form) 
C3.5.5 Floating-point round to integral value 
The following subsections describe instructions which round a floating-point number to an integral valued 
floating-point number in the same format: 
. Floating-point round to an integer of the same size as the register 
. Floating-point round to 32-bit or 64-bit integer on page C3-231 
Floating-point round to an integer of the same size as the register 
The following instructions round a floating-point value to an integer floating-point value of the same size. 
For these instructions: 
s A zero input gives a zero result with the same sign. 
. An infinite input gives an infinite result with the same sign. 
s A NaN is propagated as in normal floating-point arithmetic. 
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These instructions can cause the following floating-point exceptions: 


Invalid Operation 


Occurs in response to a floating-point input of a signaling NaN. 


Inexact, FRINTX instruction only 


Occurs if the result is numeric and does not have the same numerical value as the input. 


Input Denormal 
As Flush-to-zero on page A1-54 describes, when Flush-to-zero mode is enabled, occurs when zero 
replaces a double-precision or single-precision denormal input. 

Note 


When ARMv8.2-FP 16 is implemented, a half-precision denormal input that is flushed to zero does 
not generate an Input Denormal exception. 








Table C3-68 shows the Floating-point round to integer instructions. 


Table C3-68 Floating-point round to integer instructions 
































Mnemonic Instruction See 

FRINTA Floating-point round to integer, to nearest with ties to away FRINTA (scalar) on page C7-1709 
FRINTI Floating-point round to integer, using current rounding mode FRINTI (scalar) on page C7-1713 
FRINTM Floating-point round to integer, toward minus infinity FRINTM (scalar) on page C7-1717 
FRINTN Floating-point round to integer, to nearest with ties to even FRINTN (scalar) on page C7-1721 
FRINTP Floating-point round to integer, toward positive infinity FRINTP (scalar) on page C7-1725 
FRINTX Floating-point round to integer exact, using current rounding mode FRINTX (scalar) on page C7-1729 
FRINTZ Floating-point round to integer, toward zero FRINTZ (scalar) on page C7-1733 


Floating-point round to 32-bit or 64-bit integer 


The following instructions are present if ARMv8.5-FRINT is implemented, The instructions round to a value that 
fits in a 32-bit integer or a 64-bit integer size, and use either round towards zero or the ambient rounding model. 
Invalid Operation 
Forced to be the most negative integer representable in the target size, and occurs in response to a 
floating-point input of a signaling NaN, an infinite input, or an out of range input. 
Inexact 


Occurs if the result is numeric and does not have the same numerical value as the input. 


Input Denormal 


As Flush-to-zero on page A1-54 describes, when Flush-to-zero mode is enabled, occurs when zero 
replaces a double-precision or single-precision denormal input. 
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Table C3-69 shows the Floating-point round to 32-bit or 64-bit integer instructions. 


Table C3-69 Floating-point round to integer instructions 











Mnemonic Instruction See 

FRINT32X Floating-point round to 32-bit integer, using current rounding FRINT32X (scalar) on 
model page C7-1693 

FRINT32Z Floating-point round to 32-bit integer, toward zero FRINT32Z (scalar) on 


page C7-1697 





FRINT64X Floating point round to 64-bit integer using current rounding model FRINT64X (scalar) on 
page C7-1701 











FRINT64Z Floating point round to 64-bit integer, toward zero FRINT64Z (scalar) on 
page C7-1705 





C3.5.6 Floating-point multiply-add 


Table C3-70 shows the Floating-point multiply-add instructions that require three source register operands. 


Table C3-70 Floating-point multiply-add instructions 




















Mnemonic Instruction See 

FMADD Floating-point scalar fused multiply-add FMADD on page C7-1585 

FMSUB Floating-point scalar fused multiply-subtract FMSUB on page C7-1656 

FNMADD Floating-point scalar negated fused multiply-add FNMADD on page C7-1677 

FNMSUB Floating-point scalar negated fused multiply-subtract /NMSUB on page C7-1679 
C3.5.7 Floating-point arithmetic (one source) 


Table C3-71 shows the Floating-point arithmetic instructions that require a single source register operand. 


Table C3-71 Floating-point arithmetic instructions with one source register 














Mnemonic Instructions See 

FABS Floating-point scalar absolute value FABS (scalar) on page C7-1450 

FNEG Floating-point scalar negate FNEG (scalar) on page C7-1675 

FSQRT Floating-point scalar square root FSQRT (scalar) on page C7-1743 
C3.5.8 Floating-point arithmetic (two sources) 


Table C3-72 shows the Floating-point arithmetic instructions that require two source register operands. 


Table C3-72 Floating-point arithmetic instructions with two source registers 











Mnemonic Instruction See 

FADD Floating-point scalar add FADD (scalar) on page C7-1462 

FDIV Floating-point scalar divide FDIV (scalar) on page C7-1582 
C3-232 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


A64 Instruction Set Overview 
C3.5 Data processing - SIMD and floating-point 


Table C3-72 Floating-point arithmetic instructions with two source registers (continued) 














Mnemonic Instruction See 

FMUL Floating-point scalar multiply FMUL (scalar) on page C7-1664 

FNMUL Floating-point scalar multiply-negate © FNMUL (scalar) on page C7-1681 

FSUB Floating-point scalar subtract FSUB (scalar) on page C7-1747 
C3.5.9 Floating-point minimum and maximum 


The min(x,y) and max(x,y) operations return a quiet NaN when either x or y is NaN. 


As described in Flush-to-zero on page A1-54, in flush-to-zero mode, denormal operands are flushed to zero before 
comparison, and if the result of the comparison is the flushed value, then a zero value is returned. Where both x and 
y are zero, or denormal values flushed to zero, with different signs, then +0.0 is returned by max() and -0.0 by min(). 


The minNum(x,y) and maxNum(x,y) operations follow the IEEE 754-2008 standard and return the numerical operand 
when one operand is numerical and the other a quiet NaN. Apart from this additional handling of a single quiet NaN 
the result is then identical to min(x,y) and max(x,y). 


Table C3-73 shows the Floating-point instructions that can perform floating-point minimum and maximum 
operations. 


Table C3-73 Floating-point minimum and maximum instructions 

















Mnemonic Instruction See 

FMAX Floating-point scalar maximum FMAX (scalar) on page C7-1589 
FMAXNM Floating-point scalar maximum number FMAXNM (scalar) on page C7-1593 
FMIN Floating-point scalar minimum FMIN (scalar) on page C7-1609 
FMINNM Floating-point scalar minimum number FMINNM (scalar) on page C7-1613 





C3.5.10 Floating-point comparison 
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These instructions set the NZCV Condition flags in PSTATE, based on the result of a comparison of two operands. 
If the floating-point comparisons are unordered, where one or both operands are a form of NaN, the C and V bits 
are set to 1 and the N and Z bits are cleared to 0. 


Note 


The NZCV flags in the FPSR are associated with AArch32 state. The A64 floating-point comparison instructions 
do not change the Condition flags in the FPSR. 








For the conditional Floating-point comparison instructions, if the condition is TRUE, the flags are updated to the 
result of the comparison, otherwise the flags are updated to the immediate value that is defined in the instruction 
encoding. 


The quiet compare instructions generate an Invalid Operation floating-point exception if either of the source 
operands is a signaling NaN. The signaling compare instructions generate an Invalid Operation floating-point 
exception if either of the source operands is any type of NaN. 


Note 


If ARMVv8.5-CondM is implemented, instructions AXFLAG and XAFLAG convert between the PSTATE condition 
flag format used by the FCMP instruction and an alternative format. See ARMv8.4-CondM on page A2-81 for more 
information. 
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Table C3-74 shows the Floating-point comparison instructions. 


Table C3-74 Floating-point comparison instructions 

















Mnemonic Instruction See 

FCMP Floating-point quiet compare FCMP on page C7-1506 
FCMPE Floating-point signaling compare FCMPE on page C7-1508 
FCCMP Floating-point conditional quiet compare FCCMP on page C7-1470 
FCCMPE Floating-point conditional signaling compare /CCMPE on page C7-1472 


















































C3.5.11 Floating-point conditional select 
Table C3-75 shows the Floating-point conditional select instructions. 
Table C3-75 Floating-point conditional select instructions 
Mnemonic Instruction See 
FCSEL Floating-point scalar conditional select #CSEL on page C7-1510 
C3.5.12 SIMD move 
The functionality of some data movement instructions overlaps with that provided by the scalar floating-point FMOV 
instructions described in Floating-point move (register) on page C3-228. 
Table C3-76 shows the SIMD move instructions. 
Table C3-76 SIMD move instructions 
Mnemonic Instruction See 
DUP Duplicate vector element to vector or scalar DUP (element) on page C7-1435 
DUP Duplicate general-purpose register to vector DUP (general) on page C7-1438 
INS? Insert vector element from another vector element INS (element) on page C7-1749 
Insert vector element from general-purpose register INS (general) on page C7-1751 
MOV Move vector element to vector element MOV (element) on page C7-1821 
Move general-purpose register to vector element MOV (from general) on page C7-1823 
Move vector element to scalar MOV (scalar) on page C7-1819 
Move vector element to general-purpose register MOV (to general) on page C7-1826 
UMOV Unsigned move vector element to general-purpose register UMOV on page C7-2197 
SMOV Signed move vector element to general-purpose register SMOV on page C7-1971 
a. Disassembles as MOV. 
C3.5.13 SIMD arithmetic 
Table C3-77 on page C3-235 shows the SIMD arithmetic instructions. 
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Table C3-77 SIMD arithmetic instructions 





































































































Mnemonic Instruction See 

ADD Add (vector and scalar form) ADD (vector) on page C7-1377 

AND Bitwise AND (vector form) AND (vector) on page C7-1391 

BIC Bitwise bit clear (register) (vector form) BIC (vector, register) on page C7-1395 
BIF Bitwise insert if false (vector form) BIF on page C7-1397 

BIT Bitwise insert if true (vector form) BIT on page C7-1399 

BSL Bitwise select (vector form) BSL on page C7-1401 

EOR Bitwise exclusive OR (vector form) EOR (vector) on page C7-1440 

FABD Floating-point absolute difference (vector and scalar form) FABD on page C7-1445 

FADD Floating-point add (vector form) FADD (scalar) on page C7-1462 

FDIV Floating-point divide (vector form) FDIV (vector) on page C7-1580 

FMAX Floating-point maximum (vector form) FMAXP (vector) on page C7-1603 
FMAXNM Floating-point maximum number (vector form) FMAXNM (vector) on page C7-1591 
FMIN Floating-point minimum (vector form) FMIN (vector) on page C7-1607 
FMINNM Floating-point minimum number (vector form) FMINNM (vector) on page C7-1611 
FMLA Floating-point fused multiply-add (vector form) FMLA (vector) on page C7-1631 
FMLAL, FMLAL2 Floating-point fused multiply-add long (vector form) FMLAL, FMLAL2 (vector) on page C7-1635 
FMLS Floating-point fused multiply-subtract (vector form) F'MLS (vector) on page C7-1641 

FMLSL, FMLSL2 Floating-point fused multiply-subtract long (vector form) FMLSL, FMLSL2 (vector) on page C7-1645 
FMUL Floating-point multiply (vector form) FMUL (vector) on page C7-1662 
FMULX Floating-point multiply extended (vector and scalar form) FMULX on page C7-1670 

FRECPS Floating-point reciprocal step (vector and scalar form) FRECPS on page C7-1686 

FRSQRTS Floating-point reciprocal square root step (vector and scalar form) FRSORTS on page C7-1738 

FSUB Floating-point subtract (vector form) FSUB (vector) on page C7-1745 

MLA Multiply-add (vector form) MLA (vector) on page C7-1813 

MLS Multiply-subtract (vector form) MLS (vector) on page C7-1817 

MUL Multiply (vector form) MUL (vector) on page C7-1833 

MOV Move vector register (vector form) MOV (vector) on page C7-1825 

ORN Bitwise inclusive OR NOT (vector form) ORN (vector) on page C7-1843 

ORR Bitwise inclusive OR (register) (vector form) ORR (vector, register) on page C7-1847 
PMUL Polynomial multiply (vector form) PMUL on page C7-1849 

SABA Signed absolute difference and accumulate (vector form) SABA on page C7-1868 

SABD Signed absolute difference (vector form) SABD on page C7-1872 
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Mnemonic Instruction See 

SHADD Signed halving add (vector form) SHADD on page C7-1918 

SHSUB Signed halving subtract (vector form) SHSUB on page C7-1926 

SMAX Signed maximum (vector form) SMAX on page C7-1949 

SMIN Signed minimum (vector form) SMIN on page C7-1955 

SQADD Signed saturating add (vector and scalar form) SQADD on page C7-1980 

SQDMULH Signed saturating doubling multiply returning high half (vector and SQDMULH (vector) on page C7-1999 
scalar form) 

SQRSHL Signed saturating rounding shift left (register) (vector and scalar SORSHL on page C7-2024 
form) 

SQRDMLAH Signed saturating rounding doubling multiply accumulate returning SQRDMLAH (vector) on page C7-2012 
high half 

SQRDMLSH Signed saturating rounding doubling multiply subtract returning high SQRDMLSH (vector) on page C7-2017 
half 

SQRDMULH Signed saturating rounding doubling multiply returning high half SQRDMULH (vector) on page C7-2022 
(vector and scalar form) 

SQSHL Signed saturating shift left (register) (vector and scalar form) SOSHL (register) on page C7-2035 

SQSUB Signed saturating subtract (vector and scalar form) SOSUB on page C7-2046 

SRHADD Signed rounding halving add (vector form) SRHADD on page C7-2054 

SRSHL Signed rounding shift left (register) (vector and scalar form) SRSHL on page C7-2059 

SSHL Signed shift left (register) (vector and scalar form) SSHL on page C7-2065 

SUB Subtract (vector and scalar form) SUB (vector) on page C7-2123 

UABA Unsigned absolute difference and accumulate (vector form) UABA on page C7-2139 

UABD Unsigned absolute difference (vector form) UABD on page C7-2143 

UHADD Unsigned halving add (vector form) UHADD on page C7-2171 

UHSUB Unsigned halving subtract (vector form) UHSUB on page C7-2173 

UMAX Unsigned maximum (vector form) UMAX on page C7-2175 

UMIN Unsigned minimum (vector form) UMIN on page C7-2181 

UQADD Unsigned saturating add (vector and scalar form) UQADD on page C7-2204 

UQRSHL Unsigned saturating rounding shift left (register) (vector and scalar UQRSHL on page C7-2206 
form) 

UQSHL Unsigned saturating shift left (register) (vector and scalar form) UQSHL (register) on page C7-2214 

UQSUB Unsigned saturating subtract (vector and scalar form) UQSUB on page C7-2219 

URHADD Unsigned rounding halving add (vector form) URHADD on page C7-2225 

URSHL Unsigned rounding shift left (register) (vector and scalar form) URSHL on page C7-2227 

USHL Unsigned shift left (register) (vector and scalar form) USHL on page C7-2234 
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C3.5.14 SIMD compare 
The SIMD compare instructions compare vector or scalar elements according to the specified condition and set the 
destination vector element to all ones if the condition holds, or to zero if the condition does not hold. 
Note 
Some of the comparisons, such as LS, LE, LO, and LT, can be made by reversing the operands and using the 
opposite comparison, HS, GE, HI, or GT. 
Table C3-78 shows that SIMD compare instructions. 
Table C3-78 SIMD compare instructions 
Mnemonic Instruction See 
CMEQ Compare bitwise equal (vector and scalar form) CMEQ (register) on page C7-1407 
Compare bitwise equal to zero (vector and scalar form) CMEO (zero) on page C7-1409 
CMHS Compare unsigned higher or same (vector and scalar form) CMHS (register) on page C7-1424 
CMGE Compare signed greater than or equal (vector and scalar form) CMGE (register) on page C7-1412 
Compare signed greater than or equal to zero (vector and scalar form) CMGE (zero) on page C7-1414 
CMHI Compare unsigned higher (vector and scalar form) CMHI (register) on page C7-1422 
CMGT Compare signed greater than (vector and scalar form) CMGT (register) on page C7-1417 
Compare signed greater than zero (vector and scalar form) CMGT (zero) on page C7-1419 
CMLE Compare signed less than or equal to zero (vector and scalar form) CMLE (zero) on page C7-1426 
CMLT Compare signed less than zero (vector and scalar form) CMLT (zero) on page C7-1429 
CMTST Compare bitwise test bits nonzero (vector and scalar form) CMTST on page C7-1431 
FCMEQ Floating-point compare equal (vector and scalar form) FCMEQ (register) on 
page C7-1474 
Floating-point compare equal to zero (vector and scalar form) FCMEQ (zero) on page C7-1478 
FCMGE Floating-point compare greater than or equal (vector and scalar form) FCMGE (register) on 
page C7-1481 
Floating-point compare greater than or equal to zero (vector and scalar form) FCMGE (zero) on page C7-1485 
FCMGT Floating-point compare greater than (vector and scalar form) FCMGT (register) on page C7-1488 
Floating-point compare greater than zero (vector and scalar form) FCMGT (zero) on page C7-1492 
FCMLE Floating-point compare less than or equal to zero (vector and scalar form) FCMLE (zero) on page C7-1500 
FCMLT Floating-point compare less than zero (vector and scalar form) FCMLT (zero) on page C7-1503 
FACGE Floating-point absolute compare greater than or equal (vector and scalar form) FACGE on page C7-1452 
FACGT Floating-point absolute compare greater than (vector and scalar form) FACGT on page C7-1456 
C3.5.15 SIMD widening and narrowing arithmetic 
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Table C3-79 shows the SIMD widening and narrowing arithmetic instructions. 


Table C3-79 SIMD widening and narrowing arithmetic instructions 





Mnemonic Instruction 


See 





ADDHN, ADDHN2 


Add returning high, narrow (vector form) 


ADDHN, ADDHN2? on page C7-1379 





PMULL, PMULL2 


Polynomial multiply long (vector form) 


PMULL, PMULL2 on page C7-1851 


See also The Cryptographic Extension on 
page C3-247 





RADDHN, RADDHN2 


Rounding add returning high, narrow (vector form) 


RADDHN, RADDHN2? on page C7-1853 





RSUBHN, RSUBHN2 


Rounding subtract returning high, narrow (vector form) 


RSUBHN, RSUBHN? on page C7-1866 





SABAL, SABAL2 


Signed absolute difference and accumulate long (vector form) 


SABAL, SABAL2 on page C7-1870 





SABDL, SABDL2 


Signed absolute difference long (vector form) 


SABDL, SABDL2 on page C7-1874 





SADDL, SADDL2 


Signed add long (vector form) 


SADDL, SADDL?2 on page C7-1878 





SADDW, SADDW2 


Signed add wide (vector form) 


SADDW, SADDW2 on page C7-1884 





SMLAL, SMLAL2 


Signed multiply-add long (vector form) 


SMLAL, SMLAL2 (vector) on page C7-1964 





SMLSL, SMLSL2 


Signed multiply-subtract long (vector form) 


SMLSL, SMLSL2 (vector) on page C7-1969 





SMULL, SMULL2 


Signed multiply long (vector form) 


SMULL, SMULL2 (vector) on page C7-1976 





SQDMLAL, SQDMLAL2 


Signed saturating doubling multiply-add long (vector and 


scalar form) 


SQDMLAL, SODMLAL2 (vector) on 
page C7-1986 





SQDMLSL, SQDMLSL2 


Signed saturating doubling multiply-subtract long (vector and 


scalar form) 


SQDMLSL, SQDMLSL2 (vector) on 
page C7-1993 





SQDMULL, SQDMULL2 


Signed saturating doubling multiply long (vector and scalar 


SQDMULL, SQDMULL2 (vector) on 





















































form) page C7-2004 
SSUBL, SSUBL2 Signed subtract long (vector form) SSUBL, SSUBL2 on page C7-2076 
SSUBW, SSUBW2 Signed subtract wide (vector form) SSUBW, SSUBW2 on page C7-2078 
SUBHN, SUBHN2 Subtract returning high, narrow (vector form) SUBHN, SUBHN? on page C7-2125 
UABAL, UABAL2 Unsigned absolute difference and accumulate long (vector UABAL, UABAL2 on page C7-2141 
form) 
UABDL, UABDL2 Unsigned absolute difference long (vector form) UABDL, UABDL2 on page C7-2145 
UADDL, UADDL2 Unsigned add long (vector form) UADDL, UADDL2 on page C7-2149 
UADDW, UADDW2 Unsigned add wide (vector form) UADDW, UADDW2 on page C7-2155 
UMLAL, UMLAL2 Unsigned multiply-add long (vector form) UMLAL, UMLAL2 (vector) on page C7-2190 
UMLSL, UMLSL2 Unsigned multiply-subtract long (vector form) UMLSL, UMLSL2 (vector) on page C7-2195 
UMULL, UMULL2 Unsigned multiply long (vector form) UMULL, UMULL2 (vector) on page C7-2202 
USUBL, USUBL2 Unsigned subtract long (vector form) USUBL, USUBL2 on page C7-2247 
USUBW, USUBW2 Unsigned subtract wide (vector form) USUBW, USUBW2 on page C7-2249 
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C3.5.16 SIMD unary arithmetic 
For information about the variants of these instructions, see Common features of SIMD instructions on page C3-227. 
Table C3-80 shows the SIMD unary arithmetic instructions. 
Table C3-80 SIMD unary arithmetic instructions 
Mnemonic Instruction See 
ABS Absolute value (vector and scalar form) ABS on page C7-1375 
CLS Count leading sign bits (vector form) CLS (vector) on page C7-1403 
CLZ Count leading zero bits (vector form) CLZ (vector) on page C7-1405 
CNT Population count per byte (vector form) CNT on page C7-1433 
FABS Floating-point absolute (vector form) FABS (vector) on page C7-1448 





FCVTL, FCVTL2 


Floating-point convert to higher precision long (vector form) 


FCVTL, FCVTL2 on page C7-1524 





FCVTN, FCVTN2 


Floating-point convert to lower precision narrow (vector form) 


FCVTN, FCVTN2 on 
page C7-1536 





FCVTXN, FCVTXN2 


Floating-point convert to lower precision narrow, rounding to odd (vector 
and scalar form) 


FCVTXN, FCVTXN2 on 
page C7-1558 





















































FNEG Floating-point negate (vector form) F'NEG (vector) on page C7-1673 
FRECPE Floating-point reciprocal estimate (vector and scalar form) FRECPE on page C7-1683 
FRECPX Floating-point reciprocal square root (scalar form) FRECPX on page C7-1689 
FRINT32X Floating-point round to 32-bit integer, using current rounding mode (vector FRINT32X (vector) on 

form) page C7-1691 
FRINT32Z Floating-point round to 32-bit integer, toward zero (vector form) FRINT32Z (vector) on 

page C7-1695 

FRINT64X Floating-point round to 64-bit integer, using current rounding mode (vector FRINT64X (vector) on 

form) page C7-1699 
FRINT64Z Floating-point round to 64-bit integer, toward zero (vector form) FRINT64Z (vector) on 

page C7-1703 

FRINTA Floating-point round to integer, to nearest with ties to away (vector form) FRINTA (vector) on page C7-1707 
FRINTI Floating-point round to integer, using current rounding mode (vector form) FRINTI (vector) on page C7-1711 
FRINTM Floating-point round to integer, toward minus infinity (vector form) FRINTM (vector) on page C7-1715 
FRINTN Floating-point round to integer, to nearest with ties to even (vector form) FRINTN (vector) on page C7-1719 
FRINTP Floating-point round to integer, toward positive infinity (vector form) FRINTP (vector) on page C7-1723 
FRINTX Floating-point round to integer exact, using current rounding mode (vector FRINTX (vector) on page C7-1727 

form) 
FRINTZ Floating-point round to integer, toward zero (vector form) FRINTZ (vector) on page C7-1731 
FRSQRTE Floating-point reciprocal square root estimate (vector and scalar form) FRSORTE on page C7-1735 
FSQRT Floating-point square root (vector form) F'SQRT (vector) on page C7-1741 
MVN Bitwise NOT (vector form) MVN on page C7-1835 
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Table C3-80 SIMD unary arithmetic instructions (continued) 
































Mnemonic Instruction See 

NEG Negate (vector and scalar form) NEG (vector) on page C7-1839 
NOT Bitwise NOT (vector form) NOT on page C7-1841 

RBIT Bitwise reverse (vector form) RBIT (vector) on page C7-1856 
REV16 Reverse elements in 16-bit halfwords (vector form) REV16 (vector) on page C7-1858 
REV32 Reverse elements in 32-bit words (vector form) REV32 (vector) on page C7-1860 
REV64 Reverse elements in 64-bit doublewords (vector form) REV64 on page C7-1862 

SADALP Signed add and accumulate long pairwise (vector form) SADALP on page C7-1876 
SADDLP Signed add long pairwise (vector form) SADDLP on page C7-1880 

SQABS Signed saturating absolute value (vector and scalar form) SQABS on page C7-1978 

SQNEG Signed saturating negate (vector and scalar form) SONEG on page C7-2007 





SQXTN, SQXTN2 


Signed saturating extract narrow (vector form) 


SOXTN, SOXTN2 on 
page C7-2048 





SQXTUN, SQXTUN2 


Signed saturating extract unsigned narrow (vector and scalar form) 


SOXTUN, SOXTUN?2 on 
page C7-2051 














SUQADD Signed saturating accumulate of unsigned value (vector and scalar form) SUQADD on page C7-2127 
SXTL, SXTL2 Signed extend long SXTL, SXTL2 on page C7-2129 
UADALP Unsigned add and accumulate long pairwise (vector form) UADALP on page C7-2147 
UADDLP Unsigned add long pairwise (vector form) UADDLP on page C7-2151 





UQXTN, UQXTN2 


Unsigned saturating extract narrow (vector form) 


UQXTN, UQXTN2 on 
page C7-2221 























URECPE Unsigned reciprocal estimate (vector form) URECPE on page C7-2224 

URSQRTE Unsigned reciprocal square root estimate (vector form) URSORTE on page C7-2231 

USQADD Unsigned saturating accumulate of signed value (vector and scalar form) USQADD on page C7-2242 

UXTL, UXTL2 Unsigned extend long UXTL, UXTL2 on page C7-2251 

XTN, XTN2 Extract narrow (vector form) XTN, XTN2 on page C7-2258 
C3.5.17 SIMD by element arithmetic 

For information about the variants of these instructions, see Common features of SIMD instructions on page C3-227. 
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Table C3-81 SIMD by element arithmetic instructions 
Mnemonic Instruction See 
FMLA Floating-point fused multiply-add (vector and scalar form) FMLA (by element) on page C7-1627 





FMLAL, FMLAL2 


Floating-point fused multiply-add long (vector form) 


FMLAL, FMLAL2 (by element) on 
page C7-1633 





FMLS 


Floating-point fused multiply-subtract (vector and scalar form) 


FMLS (by element) on page C7-1637. 





FMLSL, FMLSL2 


Floating-point fused multiply-subtract long (vector form) 


FMLSL, FMLSL2 (by element) on 
page C7-1643 




















FMUL Floating-point multiply (vector and scalar form) FMUL (by element) on page C7-1658 
FMULX Floating-point multiply extended (vector and scalar form) FMULX (by element) on page C7-1666 
MLA Multiply-add (vector form) MLA (by element) on page C7-1811 
MLS Multiply-subtract (vector form) MLS (by element) on page C7-1815 
MUL Multiply (vector form) MUL (by element) on page C7-1831 





SMLAL, SMLAL2 


Signed multiply-add long (vector form) 


SMLAL, SMLAL2 (by element) on 
page C7-1961 





SMLSL, SMLSL2 


Signed multiply-subtract long (vector form) 


SMLSL, SMLSL2 (by element) on 
page C7-1966 








SMULL, SMULL2 


Signed multiply long (vector form) 


SMULL, SMULL2 (by element) on 
page C7-1973 





SQDMLAL, SQDMLAL2 


Signed saturating doubling multiply-add long (vector and scalar 
form) 


SQDMLAL, SODMLAL2 (by element) on 
page C7-1982 





SQDMLSL, SQDMLSL2 


Signed saturating doubling multiply-subtract long (vector form) 


SQDMLSL, SODMLSL2 (by element) on 
page C7-1989 





SQDMULH 


Signed saturating doubling multiply returning high half (vector 
and scalar form) 


SQDMULH (by element) on page C7-1996 








SQDMULL, SQDMULL2 


Signed saturating doubling multiply long (vector and scalar 
form) 


SQDMULL, SQDMULL2 (by element) on 
page C7-2001 














SQRDMLAH Signed saturating rounding doubling multiply accumulate SOQRDMLSH (by element) on page C7-2014 
returning high half 

SQRDMLSH Signed saturating rounding doubling multiply subtract returning © SQRDMLSH (vector) on page C7-2017 
high half 

SQRDMULH Signed saturating rounding doubling multiply returning high SQRDMULH (by element) on page C7-2019 


half (vector and scalar form) 





UMLAL, UMLAL2 


Unsigned multiply-add long (vector form) 


UMLAL, UMLAL2 (by element) on 
page C7-2187 





UMLSL, UMLSL2 


Unsigned multiply-subtract long (vector form) 


UMLSL, UMLSL2 (by element) on 
page C7-2192 





UMULL, UMULL2 


Unsigned multiply long (vector form) 


UMULL, UMULL2 (by element) on 
page C7-2199 
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C3.5.18 SIMD permute 


Table C3-82 shows the SIMD permute instructions. 


Table C3-82 SIMD permute instructions 


























Mnemonic Instruction See 

EXT Extract vector from a pair of vectors EXT on page C7-1443 
TRN1 Transpose vectors (primary) TRN] on page C7-2135 
TRN2 Transpose vectors (secondary) TRN2 on page C7-2137 
UZP1 Unzip vectors (primary) UZP1 on page C7-2253 
UZP2 Unzip vectors (secondary) UZP2 on page C7-2255 
ZIP1 Zip vectors (primary) ZIPI on page C7-2260 
ZIP2 Zip vectors (secondary) ZIP2 on page C7-2262 





C3.5.19 SIMD immediate 


Table C3-83 shows the SIMD immediate instructions. 


Table C3-83 SIMD immediate instructions 




















Mnemonic Instruction See 

BIC Bitwise bit clear immediate BIC (vector, immediate) on page C7-1393 
FMOV Floating-point move immediate F MOV (vector, immediate) on page C7-1647 
MOVI Move immediate MOVI on page C7-1828 

MVNI Move inverted immediate MVNI on page C7-1836 

ORR Bitwise inclusive OR immediate ORR (vector, immediate) on page C7-1845 





C3.5.20 SIMD shift (immediate) 
For information about the variants of these instructions, see Common features of SIMD instructions on page C3-227. 


Table C3-84 shows the SIMD shift immediate instructions. 


Table C3-84 SIMD shift (immediate) instructions 




















Mnemonic Instruction See 
RSHRN, RSHRN2 Rounding shift right narrow immediate (vector form) RSHRN, RSHRN?2 on page C7-1864 
SHL Shift left immediate (vector and scalar form) SHL on page C7-1920 
SHLL, SHLL2 Shift left long (by element size) (vector form) SHLL, SHLL2 on page C7-1922 
SHRN, SHRN2 Shift right narrow immediate (vector form) SHRN, SHRN2 on page C7-1924 
SLI Shift left and insert immediate (vector and scalar form) SLI on page C7-1928 
SQRSHRN, SQRSHRN2 Signed saturating rounded shift right narrow immediate (vector SORSHRN, SORSHRN2 on 
and scalar form) page C7-2026 
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Table C3-84 SIMD shift (immediate) instructions (continued) 





Mnemonic 


SQRSHRUN, SQRSHRUN2 


Instruction 


Signed saturating shift right unsigned narrow immediate (vector 
and scalar form) 


See 


SORSHRUN, SORSHRUN2 on 
page C7-2029 





SQSHL 


Signed saturating shift left immediate (vector and scalar form) 


SQSHL (immediate) on page C7-2032 





SQSHLU 


Signed saturating shift left unsigned immediate (vector and scalar 
form) 


SOSHLU on page C7-2037 





SQSHRN, SQSHRN2 


Signed saturating shift right narrow immediate (vector and scalar 
form) 


SOSHRN, SOSHRN?2 on page C7-2040 





SQSHRUN, SQSHRUN2 


Signed saturating shift right unsigned narrow immediate (vector 
and scalar form) 


SOSHRUN, SOSHRUN2 on 
page C7-2043 











SRI Shift right and insert immediate (vector and scalar form) SRI on page C7-2056 
SRSHR Signed rounding shift right immediate (vector and scalar form) SRSHR on page C7-2061 
SRSRA Signed rounding shift right and accumulate immediate (vectorand SRSRA on page C7-2063. 


scalar form) 





SSHLL, SSHLL2 


Signed shift left long immediate (vector form) 


SSHLL, SSHLL2 on page C7-2068 











SSHR Signed shift right immediate (vector and scalar form) SSHR on page C7-2070 
SSRA Signed integer shift right and accumulate immediate (vector and SSRA on page C7-2073 
scalar form) 
SXTL, SXTL2 Signed integer extend (vector only) SXTL, SXTL2 on page C7-2129 





UQRSHRN, UQRSHRN2 


Unsigned saturating rounded shift right narrow immediate (vector 
and scalar form) 


UQRSHRN, UQRSHRN2 on 
page C7-2208 





UQSHL 


nsigned saturating shift left immediate (vector and scalar form) 


UQSHL (immediate) on page C7-2211 





UQSHRN, UQSHRN2 


U 
Unsigned saturating shift right narrow immediate (vector and 
scalar form) 


UQSHRN, UQSHRN?2 on page C7-2216 





URSHR 


Unsigned rounding shift right immediate (vector and scalar form) 


URSHR on page C7-2229 





URSRA 


Unsigned integer rounding shift right and accumulate immediate 
(vector and scalar form) 


URSRA on page C7-2232 





USHLL, USHLL2 


Unsigned shift left long immediate (vector form) 


USHLL, USHLL2 on page C7-2237 























USHR Unsigned shift right immediate (vector and scalar form) USHR on page C7-2239 
USRA Unsigned shift right and accumulate immediate (vector and scalar USRA on page C7-2244 
form) 
UXTL, UXTL2 Unsigned integer extend (vector only) UXTL, UXTL2 on page C7-2251 
C3.5.21 SIMD floating-point and integer conversion 
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ID070919 


The SIMD floating-point and integer conversion instructions generate the Invalid Operation floating-point 
exception in response to a floating-point input of NaN, infinity, or a numerical value that cannot be represented 
within the destination register. An out of range integer or a fixed-point result is saturated to the size of the destination 
register. A numeric result that differs from the input raises the Inexact floating-point exception. 
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Table C3-85 shows the SIMD floating-point and integer conversion instructions. 


Table C3-85 SIMD floating-point and integer conversion instructions 



























































Mnemonic Instruction See 

FCVTAS Floating-point convert to signed integer, rounding to nearest with ties FCVTAS (vector) on page C7-1514 
to away (vector and scalar form) 

FCVTAU Floating-point convert to unsigned integer, rounding to nearest with ties FCVTAU (vector) on page C7-1519 
to away (vector and scalar form) 

FCVTMS Floating-point convert to signed integer, rounding toward minus FCVTMS (vector) on page C7-1526 
infinity (vector and scalar form) 

FCVTMU Floating-point convert to unsigned integer, rounding toward minus FCVTMU (vector) on page C7-1531 
infinity (vector and scalar form) 

FCVTNS Floating-point convert to signed integer, rounding to nearest with ties FCVTNS (vector) on page C7-1538 
to even (vector and scalar form) 

FCVTNU Floating-point convert to unsigned integer, rounding to nearest withties FCVTNU (vector) on page C7-1543 
to even (vector and scalar form) 

FCVTPS Floating-point convert to signed integer, rounding toward positive FCVIPS (vector) on page C7-1548 
infinity (vector and scalar form) 

FCVTPU Floating-point convert to unsigned integer, rounding toward positive FCVTPU (vector) on page C7-1553 
infinity (vector and scalar form) 

FCVTZS Floating-point convert to signed integer, rounding toward zero (vector FCVTZS (vector, integer) on 
and scalar form) page C7-1563 
Floating-point convert to signed fixed-point, rounding toward zero FCVTZS (vector, fixed-point) on 
(vector and scalar form) page C7-1560 

FCVTZU Floating-point convert to unsigned integer, rounding toward zero FCVTZU (vector, integer) on 
(vector and scalar form) page C7-1573 
Floating-point convert to unsigned fixed-point, rounding toward zero, FCVTZU (vector, fixed-point) on 
(vector and scalar form) page C7-1570 

SCVTF Signed integer convert to floating-point (vector and scalar form) SCVTF (vector, integer) on page C7-1889 
Signed fixed-point convert to floating-point (vector and scalar form) SCVTF (vector, fixed-point) on 

page C7-1886 

UCVTF Unsigned integer convert to floating-point (vector and scalar form) UCVTF (vector, integer) on page C7-2160 

Unsigned fixed-point convert to floating-point (vector and scalar form) © UCVTF (vector, fixed-point) on 
page C7-2157 
C3.5.22 SIMD reduce (across vector lanes) 


C3-244 


The SIMD reduce (across vector lanes) instructions perform arithmetic operations horizontally, that is across all 


lanes of the input vector. They deliver a single scalar result. 
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Table C3-86 shows the SIMD reduce (across vector lanes) instructions. 


Table C3-86 SIMD reduce (across vector lanes) instructions 












































Mnemonic Instruction See 

ADDV Add (across vector) ADDV on page C7-1385 
FMAXNMV Floating-point maximum number (across vector) FMAXNMV on page C7-1599 
FMAXV Floating-point maximum (across vector) FMAXV on page C7-1605 
FMINNMV Floating-point minimum number (across vector) /MINNMV on page C7-1619 
FMINV Floating-point minimum (across vector) FMINV on page C7-1625 
SADDLV Signed add long (across vector) SADDLYV on page C7-1882 
SMAXV Signed maximum (across vector) SMAXV on page C7-1953 
SMINV Signed minimum (across vector) SMINV on page C7-1959 
UADDLV Unsigned add long (across vector) UADDLYV on page C7-2153 
UMAXV Unsigned maximum (across vector) UMAXV on page C7-2179 
UMINV Unsigned minimum (across vector) UMINV on page C7-2185 





















































C3.5.23 SIMD pairwise arithmetic 
The SIMD pairwise arithmetic instructions perform operations on pairs of adjacent elements and deliver a vector 
result. 
Table C3-87 shows the SIMD pairwise arithmetic instructions. 
Table C3-87 SIMD pairwise arithmetic instructions 
Mnemonic Instruction See 
ADDP Add pairwise (vector and scalar form) ADDP (vector) on page C7-1383 
ADDP (scalar) on page C7-1381 
FADDP Floating-point add pairwise (vector and scalar form) FADDP (vector) on page C7-1466 
FADDP (scalar) on page C7-1464 
FMAXNMP Floating-point maximum number pairwise (vector and scalar form) FMAXNMP (vector) on page C7-1597 
FMAXNMP (scalar) on page C7-1595 
FMAXP Floating-point maximum pairwise (vector and scalar form) FMAXP (vector) on page C7-1603 
FMAXP (scalar) on page C7-1601 
FMINNMP Floating-point minimum number pairwise (vector and scalar form)  FMINNMP (vector) on page C7-1617 
FMINNMP (scalar) on page C7-1615 
FMINP Floating-point minimum pairwise (vector and scalar form) FMINP (vector) on page C7-1623 
FMINP (scalar) on page C7-1621 
SMAXP Signed maximum pairwise SMAXP on page C7-1951 
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Table C3-87 SIMD pairwise arithmetic instructions (continued) 











Mnemonic Instruction See 

SMINP Signed minimum pairwise SMINP on page C7-1957 
UMAXP Unsigned maximum pairwise UMAXP on page C7-2177 
UMINP Unsigned minimum pairwise UMINP on page C7-2183 





C3.5.24 SIMD dot product 


ARMv8.2-DotProd provides SIMD instructions that perform the dot product of the four 8-bit subelements of the 
32-bit elements of one vector with the four 8-bit subelements of a second vector. It provides two forms of the 
instructions, each with signed and unsigned versions: 


Vector form The dot product is calculated for each element of the first vector with the corresponding element of 
the second element. 


Indexed form The dot product is calculated for each element of the first vector with the element of the second 
vector that is indicated by the index argument to the instruction. 
Note 


That is, a single element from the second vector is used, and a the dot product is calculated between 
each element of the first vector and this single element from the second vector. 





Table C3-88 SIMD dot product 

















Mnemonic Instruction See 

SDOT Signed dot product (vector form) SDOT (vector) on page C7-1898 
UDOT Unsigned dot product (vector form) UDOT (vector) on page C7-2169 
SDOT Signed dot product (indexed form) SDOT (by element) on page C7-1896 
UDOT Unsigned dot product (indexed form) | UDOT (by element) on page C7-2167 





C3.5.25 SIMD table lookup 


Table C3-89 shows the SIMD table lookup instructions. 


Table C3-89 SIMD table lookup instructions 








Mnemonic Instruction See 
TBL Table vector lookup TBL on page C7-2131 
TBX Table vector lookup extension 7BX on page C7-2133 





C3.5.26 SIMD complex number arithmetic 


ARMv8.3-CompNum provides SIMD instructions that perform arithmetic on complex numbers held in element 
pairs in vector registers, where the less significant element of the pair contains the real component and the more 
significant element contains the imaginary component. 


These instructions provide double-precision and single-precision versions. If ARMv8.2-FP16 is implemented they 
also provide half-precision versions, otherwise the half-precision encodings are UNDEFINED. 


C3-246 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Table C3-90 shows the ARMv8.3-CompNum SIMD instructions: 


A64 Instruction Set Overview 
C3.5 Data processing - SIMD and floating-point 


Table C3-90 SIMD complex number arithmetic 





Mnemonic Instruction 


See 











FCADD Floating-point complex add FCADD on page C7-1468 
FCMLA Floating-point complex multiply accumulate (vector form) FCMLA on page C7-1498 
FCMLA Floating-point complex multiply accumulate (indexed form) © /CMLA (by element) on page C7-1495 





A pair of FCMLA instructions can be used to perform a complex number multiplication. This is demonstrated in 
Complex multiplication on page K10-7730. 


C3.5.27 


The Cryptographic Extension 


The instructions provided by the optional Armv8.0 Cryptographic Extension use the SIMD and floating-point 
register file. For more information about the functions they provide see: 


$ Announcing the Advanced Encryption Standard. 
s The Galois/Counter Mode of Operation. 
à Announcing the Secure Hash Standard. 


Table C3-91 shows the Armv8.0 Cryptographic Extension instructions. 


Table C3-91 Cryptographic Extension instructions 





Mnemonic 


Instruction 


See 





AESD 


AES single round decryption 


AESD on page C7-1387 





AESE 


AES single round encryption 


AESE on page C7-1388 





AESIMC 


AES inverse mix columns 


AESIMC on page C7-1389 





AESMC 


AES mix columns 


AESMC on page C7-1390 





PMULL 


Polynomial multiply long 


PMULL, PMULL2 on page C7-18512 





SHA1C 


SHA1 hash update (choose) 


SHAIC on page C7-1900 





SHA1H 


SHA fixed rotate 


SHA1H on page C7-1901 





SHA1M 


SHAT hash update (majority) 


SHAIM on page C7-1902 





SHA1P 


SHA1 hash update (parity) 


SHAIP on page C7-1903 





SHA1SUQ@ 


SHA1 schedule update 0 


SHAISU0 on page C7-1904 





SHA1SU1 


SHA1 schedule update 1 


SHAISU1 on page C7-1905 





SHA256H 


SHA256 hash update, part 1 


SHA256H on page C7-1907 





SHA256H2 


SHA256 hash update, part 2 


SHA256H2 on page C7-1906 





SHA256SU0 


SHA256 schedule update 0 


SHA256SU0 on page C7-1908 





SHA256SU1 


SHA256 schedule update 1 


SHA256SU1 on page C7-1909 





a. The Cryptographic Extension adds the variant of the instruction that operates on two 64-bit polynomials. 


See The Armv8 Cryptographic Extension on page A2-66 for information about the permitted implementation 
options for the Cryptographic Extension. 
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Armv8.2 extensions to the Cryptographic Extension 


Armv8.2 provides two optional extensions to the Cryptographic Extension, see: 
. Armv8.2-SHA, SHA2-512 and SHA3. 
a Armyv8.2-SM, SM3 and SM4 on page C3-249. 


Armv8.2-SHA, SHA2-512 and SHA3 
ARMv8.2-SHA provides: 


s Instructions to accelerate the SHA-2 hash algorithm using a digest that is larger than 256 bits. The relevant 
standards are SHA-384, SHA-512, SHA-512|224 and SHA-512|256. These are all based on the SHA-512 
computation, and therefore this set of instructions is described as the SHA5/2 instructions. 


° Instructions to accelerate the SHA-3 hash algorithm. This set of instructions is described as the SHA3 
instructions. 


Implementation of ARMv8.2-SHA requires the implementation of the SHA1 and SHA2-256 instructions from the 
Armv8.0 Cryptographic Extension. 


Note 


Implementation of ARMv8.2-SHA does not require the implementation of the AES instructions, and the 64-bit 
polynomial variants of the PMULL instructions, from the Armv8.0 Cryptographic Extension. 








When ARMv8.2-SHA is implemented: 
s The value of ID_AA64ISAR0 EL1.SHA2 is 0b0010, indicating support for the SHA512 instructions. 
$ The value of ID_AA64ISARO_EL1.SHA3 is 0b0001, indicating support for the SHA3 instructions. 


Table C3-92 shows the ARMv8.2-SHA SHA512 instructions: 


Table C3-92 Armv8.2-SHA SHA512 instructions 











Mnemonic Instruction See 
SHA512H SHA512 Hash update part 1 SHA5/2H on page C7-1911 
SHA512H2 SHAS512 Hash update part2 SHA5/2H2 on page C7-1913 





SHA512SUQ SHAS512 Schedule Update0 SHA512S5U0 on page C7-1915 





SHA512SU1 SHAS512 Schedule Update 1 SHA512SU1 on page C7-1916 





Use of the SHA512 instructions on page K10-7732 shows an example of the use of these instructions to calculate a 
SHAS 12 hash iteration. This example code is not part of the architectural definition of these instructions. 


Table C3-93 on page C3-249 shows the ARMv8.2-SHA SHA3 instructions. The SHA-3 hash algorithm is based on 
a running digest of 1600 bytes, arranged as a five by five array of 64-bit registers. The Arm acceleration of these 
instructions is based on mapping the 25 64-bit values into 25 vector registers, with each 64-bit value occupying the 
same 64-bit element in each vector. A series of transformations is performed on these registers as part of a round of 
the SHA-3 hash calculation. 


The SIMD nature of the vector registers means the acceleration can compute two parallel SHA3 hash calculations, 
where one calculation is performed using the zeroth 64-bit element of each vector, and the other calculation is 
performed using the first 64-bit element of each vector. 


Note 


This is useful because the SHA-3 family of standards is being extended to introduce a fast parallel hash algorithm 
that benefits from being able to calculate SHA-3 hashes in parallel. 
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To provide acceleration where the SIMD calculation is not required, the instructions provide variants that operate 
only on the zeroth 64-bit elements. These are provided as a power optimization. 


Table C3-93 Armv8.2-SHA SHA3 instructions 

















Mnemonic Instruction See 

EOR3 Three-way Exclusive OR EOR3 on page C7-1442 
RAX1 Rotate and Exclusive OR RAX] on page C7-1855 
XAR Exclusive OR and Rotate XAR on page C7-2257 
BCAX Bit Clear and Exclusive OR BCAX on page C7-1392 





Use of the SHA3 instructions on page K10-7733 shows an example of the use of these instructions to calculate the 
combined theta, phi, rho and chi operations of a SHA3 iteration. This example code is not part of the architectural 
definition of these instructions. 


Armv8.2-SM, SM3 and SM4 
ARMv8.2-SM provides: 


s Instructions to accelerate the SM3 hash algorithm, the standard Chinese hash algorithm. These are described 
as the SM3 instructions. 


: Instructions to accelerate the SM4 encryption algorithm, the standard Chinese encryption algorithm. This set 
of instructions is described as the SM4 instructions. 


ARMv8.2-SM can be implemented independently of any part of the Armv8.0 Cryptographic Extension, and 
independently of ARMv8.2-SHA. 


Note 


This means that Armv8.2 permits an implementation of the Cryptographic Extension that provides only the 
ARMv8.2-SM functionality. 








When ARMv8.2-SM is implemented: 
s The value of ID_AA64ISAR0 EL1.SM3 is 0b0001, indicating support for the SM3 instructions. 
s The value of ID_AA64ISAR0 EL1.SM4 is 0b0001, indicating support for the SM4 instructions. 


Table C3-94 shows the ARMv8.2-SM SM3 instructions. The SM3 algorithm computes a digest of 256 bits, that can 
be held in two vector registers. The SM3 instructions include instructions to accelerate the computation of the hash 
and the schedule update. 


Note 


The SM3 instruction names refer to intermediate variables defined as part of the SM3 Cryptographic Hash 
Algorithm specification. 








Table C3-94 Armv8.2-SM SM3 instructions 














Mnemonic Instruction See 

SM3SS1 SM3 SS1 calculation SM3SS1 on page C7-1935 

SM3TTIA SM3 TT! calculation, part A SM3TTIA on page C7-1937 

SM3TT1B SM3 TT1 calculation, part B SM3TTIB on page C7-1939 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C3-249 


ID070919 Non-Confidential 


A64 Instruction Set Overview 
C3.5 Data processing - SIMD and floating-point 


C3-250 


Table C3-94 Armv8.2-SM SM3 instructions (continued) 














Mnemonic Instruction See 

SM3TT2A SM3 TT2 calculation, part A SM3TT2A on page C7-1941 
SM3TT2B SM3 TT2 calculation, part B SM3TT2B on page C7-1943 
SM3PARTW1 SM3 PARTW calculation, part 1 SM3PARTW1 on page C7-1931 
SM3PARTW2 SM3 PARTW calculation, part 1 SM3PARTW2 on page C7-1933 





Use of the SM3 instructions on page K10-7734 shows an example of the use of these instructions to generate an 
SM3 hash. This example code is not part of the architectural definition of these instructions. 


Table C3-95 shows the ARMv8.2-SM SM4 instructions. The SM4 algorithm is 128-bit wide block cipher. The SM4E 
instruction accelerates a single round of encryption or decryption, and the SM4EKEY instruction accelerates a single 


round of key generation: 


Table C3-95 Armv8.2-SM SM4 instructions 











Mnemonic Instruction See 
SM4E SM4 Encrypt SM4E on page C7-1945 
SM4EKEY SM4 Key SM4EKEY on page C7-1947 





Use of the SM4 instructions on page K10-7736 shows an example of the use of these instructions to perform SM4 
encryption and decryption. This example code is not part of the architectural definition of these instructions. 
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This chapter describes the encoding of the A64 instruction set. It contains the following section: 
° 464 instruction set encoding on page C4-252. 


In this chapter: 


$ In the decode tables, an entry of - for a field value means the value of the field does not affect the decoding. 
7 In the decode diagrams, a shaded field indicates that the bits in that field are not used in that level of decode. 
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C4.1 A64 instruction set encoding 


The A64 instruction encoding is: 


|31 29 28 25 24| | | | | | 0| 


Table C4-1 Main encoding table for the A64 instruction set 





Decode fields 
Decode group or instruction page 





























op0 

0000 Reserved 

0001 Unallocated. 

0010 SVE instructions. See SVE on page A2-92 

0011 Unallocated. 

100x Data Processing -- Immediate 

101x Branches, Exception Generating and System instructions on page C4-257 

x1x0ð Loads and Stores on page C4-266 

x101 Data Processing -- Register on page C4-299 

x111 Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309 





C4.1.1 Reserved 


This section describes the encoding of the Reserved group. The encodings in this section are decoded from 464 
instruction set encoding. 


|31 2928| 24| | 16/15 | | | 0| 


| opo | o000 | opt —-— 


Table C4-2 Encoding table for the Reserved group 





Decode fields 
Decode group or instruction page 
op0 op1 





000 000000000 UDF 





- l= 000000000 Unallocated. 





l= 000 - Unallocated. 





C4.1.2 Data Processing -- Immediate 


This section describes the encoding of the Data Processing -- Immediate group. The encodings in this section are 
decoded from A64 instruction set encoding. 
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|31 29 28 25 |2322 | | | | | 0| 


C Joo] op 


Table C4-3 Encoding table for the Data Processing -- Immediate group 





Decode fields 
Decode group or instruction page 























op0 

00x PC-rel. addressing 

010 Add/subtract (immediate) 

011 Add/subtract (immediate, with tags) on page C4-254 
100 Logical (immediate) on page C4-254 

101 Move wide (immediate) on page C4-255 

110 Bitfield on page C4-256 

111 Extract on page C4-256 





PC-rel. addressing 


This section describes the encoding of the PC-rel. addressing instruction class. The encodings in this section are 
decoded from Data Processing -- Immediate on page C4-252. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| o| 


immlo}1 0000 immhi 
lopimmiof 1 0 0 0 Of mmi | | Ra | 





Decode fields 
Instruction page 








op 
0 ADR 
1 ADRP 





Add/subtract (immediate) 


This section describes the encoding of the Add/subtract (immediate) instruction class. The encodings in this section 
are decoded from Data Processing -- Immediate on page C4-252. 
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|31 30 29 28|27 26 25 24/23 22 21 | | 10 9 5 4| 0| 


sos oo o rop m o e o a 





Decode fields 
Instruction page 


sf op S 





0 0 ) ADD (immediate) - 32-bit variant on page C6-761 





0 0 1 ADDS (immediate) - 32-bit variant on page C6-769 





0 1 0 SUB (immediate) - 32-bit variant on page C6-1311 





0 1 1 SUBS (immediate) - 32-bit variant on page C6-1321 





1 0 ) ADD (immediate) - 64-bit variant on page C6-761 





1 0 1 ADDS (immediate) - 64-bit variant on page C6-769 





1 1 0 SUB (immediate) - 64-bit variant on page C6-1311 








1 1 1 SUBS (immediate) - 64-bit variant on page C6-1321 





Add/subtract (immediate, with tags) 


This section describes the encoding of the Add/subtract (immediate, with tags) instruction class. The encodings in 
this section are decoded from Data Processing -- Immediate on page C4-252. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 14 13 10 9 5 4| 


Ce eT a A 





Decode fields 
Instruction page Architecture version 














sf op S 

0 - - Unallocated. - 

1 - 1 Unallocated. - 

1 0 0 ADDG Armv8.5 
1 1 0 SUBG Armv8.5 





Logical (immediate) 


This section describes the encoding of the Logical (immediate) instruction class. The encodings in this section are 
decoded from Data Processing -- Immediate on page C4-252. 
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| 109 5 4| o| 


a a a 





Decode fields 


Instruction page 





Unallocated. 





AND (immediate) - 32-bit variant on page C6-775 





ORR (immediate) - 32-bit variant on page C6-1125 





EOR (immediate) - 32-bit variant on page C6-896 





ANDS (immediate) - 32-bit variant on page C6-779 





AND (immediate) - 64-bit variant on page C6-775 





ORR (immediate) - 64-bit variant on page C6-1125 





EOR (immediate) - 64-bit variant on page C6-896 





sf opc N 
0 - 1 
i) 00 ( 
0 01 ) 
0 10 ) 
0 11 0 
1 00 z 
1 01 - 
1 10 = 
1 11 - 


ANDS (immediate) - 64-bit variant on page C6-779 





Move wide (immediate) 


This section describes the encoding of the Move wide (immediate) instruction class. The encodings in this section 
are decoded from Data Processing -- Immediate on page C4-252. 


|31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4| 0 | 
Isffopc]1 0 0 10 1]hw] imme CT R | 





Decode fields 


Instruction page 


sf opc hw 



































- 01 - Unallocated. 

(] - 1x Unallocated. 

0 00 - MOVWN - 32-bit variant on page C6-1100 
Q 10 - MOVZ - 32-bit variant on page C6-1102 
0 11 - MOVK - 32-bit variant on page C6-1098 
1 00 - MOVWN - 64-bit variant on page C6-1100 
1 10 - MOVZ - 64-bit variant on page C6-1102 
1 11 - MOVK - 64-bit variant on page C6-1098 
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Bitfield 


This section describes the encoding of the Bitfield instruction class. The encodings in this section are decoded from 


Data Processing -- Immediate on page C4-252. 


|31 30 29 28|27 26 25 24/23 22 21 | 16/15 


5 4| o| 


a e ee a 





Decode fields 


Instruction page 





























sf opc N 

- 11 - Unallocated. 

0 - 1 Unallocated. 

(] 00 i) SBFM - 32-bit variant on page C6-1170 
0 01 0 BFM - 32-bit variant on page C6-804 

Q 10 0 UBEM - 32-bit variant on page C6-1351 
1 - 0 Unallocated. 

il 00 1 SBFM - 64-bit variant on page C6-1170 
1 01 1 BFM - 64-bit variant on page C6-804 

1 10 1 UBFM - 64-bit variant on page C6-1351 





Extract 


This section describes the encoding of the Extract instruction class. The encodings in this section are decoded from 


Data Processing -- Immediate on page C4-252. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 


54| 


aa e a a a 





Decode fields 


Instruction page 
































sf op21 N o0 imms 

- x1 - - - Unallocated. 

- 00 - 1 - Unallocated. 

- 1x - - - Unallocated. 

i) - - - Ixxxxx Unallocated. 

i) - 1 - - Unallocated. 

i) 00 o 0 Oxxxxx EXTR - 32-bit variant on page C6-903 
1 - i) - - Unallocated. 

1 00 1 0 - EXTR - 64-bit variant on page C6-903 
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C4.1.3 Branches, Exception Generating and System instructions 
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This section describes the encoding of the Branches, Exception Generating and System instructions group. The 
encodings in this section are decoded from 464 instruction set encoding on page C4-252. 


|31 2928| 25 | 


o0 | 107] 


op1 


12\11 | 5 4| 0 | 


ee ae 


Table C4-4 Encoding table for the Branches, Exception Generating and System instructions 


group 





Decode fields 


Decode group or instruction page 



































op0 op1 op2 

010 OXXXXXXXXXXXXX_ = Conditional branch (immediate) 

110 QOXXXXXXXXXXXX —- Exception generation on page C4-258 

110 01000000110010 11111 Hints on page C4-258 

110 01000000110011 - Barriers on page C4-260 

110 Q100000xxx0100 - PSTATE on page C4-260 

110 0100x01xxxxxxx - System instructions on page C4-261 

110 0100x1xXXXXXXX - System register move on page C4-261 

110 AXXXXXXXXXXXXX  - Unconditional branch (register) on page C4-262 
x00 - - Unconditional branch (immediate) on page C4-264 
x01 OXXXXXXXXXXXXX = Compare and branch (immediate) on page C4-265 
x01 1XXXXXXXXXXXXX - Test and branch (immediate) on page C4-265 


Conditional branch (immediate) 


This section describes the encoding of the Conditional branch (immediate) instruction class. The encodings in this 
section are decoded from Branches, Exception Generating and System instructions. 


|31 30 29 28|27 26 25 24|23 


| | 5 4|3 o| 


o10101 0b] 7 immig o| oa | 





Decode fields 
Instruction page 














01 o0 

Q Q B.cond 

Q 1 Unallocated. 

1 - Unallocated. 
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Exception generation 


This section describes the encoding of the Exception generation instruction class. The encodings in this section are 
decoded from Branches, Exception Generating and System instructions on page C4-257. 


|31 30 29 28|27 26 25 24/23 21 20| | | 54| 21 0| 
Ti 070100] we | — mme |o «TL 





Decode fields 


Instruction page 













































































ope op2 LL 

- xx1 - Unallocated. 
- x1x - Unallocated. 
- 1xx - Unallocated. 
000 000 00 Unallocated. 
0o00 oð l SVC 

000 000 10 HVC 

000 000 11 SMC 

001 000 x1 Unallocated. 
001 009 0 BRK 

001 000 1x Unallocated. 
010 000 x1 Unallocated. 
010 o9 0 HLT 

010 000 1x Unallocated. 
011 000 01 ~~ Unallocated. 
011 000 1x Unallocated. 
100 000 00 Unallocated. 
101 000 00 Unallocated. 
101 000 0l  DCPSI 

101 000 10 DCPS2 

101 000 11 DCPS3 

110 000 - Unallocated. 
111 000 01 Unallocated. 
111 000 1x Unallocated. 








Hints 


This section describes the encoding of the Hints instruction class. The encodings in this section are decoded from 


Branches, Exception Generating and System instructions on page C4-257. 
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5 4/3 21 0| 





Decode fields 


Instruction page 


Architecture version 




































































CRm op2 

- - HINT - 

0000 000 NOP - 

0000 001 YIELD - 

0000 010 WFE = 

0000 011 WFI : 

0000 100 SEV = 

0000 101 SEVL = 

0000 111 XPACD, XPACI, XPACLRI Armv8.3 

0001 000 PACIA, PACIA1716, PACIASP, PACIAZ, PACIZA - PACIA1716 variant on Armv8.3 
page C6-1133 

0001 010 PACIB, PACIB1716, PACIBSP, PACIBZ, PACIZB - PACIBI716 variant on Armv8.3 
page C6-1135 

0001 100 AUTIA, AUTIA1716, AUTIASP, AUTIAZ, AUTIZA - AUTIA1716 variant on Armv8.3 
page C6-794 

0001 110 AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZB - AUTIB1716 variant on Armv8.3 
page C6-796 

0010 000 ESB Armv8.2 

0010 001 PSB CSYNC Armv8.2 

0010 010 TSB CSYNC Armv8.4 

0010 100 CSDB - 

0011 000 PACIA, PACIA1716, PACIASP, PACIAZ, PACIZA - PACIAZ variant on Armv8.3 
page C6-1133 

0011 001 PACIA, PACIA1716, PACIASP, PACIAZ, PACIZA - PACIASP variant on Armv8.3 
page C6-1133 

0011 010 PACIB, PACIB1716, PACIBSP, PACIBZ, PACIZB - PACIBZ variant on Armv8.3 
page C6-1135 

0011 011 PACIB, PACIB1716, PACIBSP, PACIBZ, PACIZB - PACIBSP variant on Armv8.3 
page C6-1135 

0011 100 AUTIA, AUTIA1716, AUTIASP, AUTIAZ, AUTIZA - AUTIAZ variant on Armv8.3 
page C6-794 

0011 101 AUTIA, AUTIA1716, AUTIASP, AUTIAZ, AUTIZA - AUTIASP variant on Armv8.3 
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page C6-794 
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Decode fields 
Instruction page 


Architecture version 











CRm op2 

0011 110 AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZB - AUTIBZ variant on Armv8.3 
page C6-796 

0011 111 AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZB - AUTIBSP variant on Armv8.3 
page C6-796 

0100 xx BTI Armv8s.5 





Barriers 


This section describes the encoding of the Barriers instruction class. The encodings in this section are decoded from 


Branches, Exception Generating and System instructions on page C4-257. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 8|7 


5 4| 


o| 


1101010100000011 0011| Rm | oz] R | 


Decode fields 


Instruction page 





















































CRm op2 Rt 

- 000 - Unallocated. 
- 001 - Unallocated. 
= 010 11111 CLREX 

= 101 11111 DMB 

- 110 11111 ISB 

- 111 = 11111 Unallocated. 
- 111 11111 SB 

l= 0x00 100 11111 DSB 

0000 100 11111 SSBB 

0001 011 - Unallocated. 
001x 011 - Unallocated. 
01xx 011 - Unallocated. 
0100 100 11111 PSSBB 

1xxx 011 - Unallocated. 





PSTATE 


This section describes the encoding of the PSTATE instruction class. The encodings in this section are decoded from 


Branches, Exception Generating and System instructions on page C4-257. 
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[31 30 29 28|27 26 25 24/23 22 2120/1918  16/151413 12|11 8/7 54] 0 | 





Decode fields 
Instruction page Architecture version 
op1 op2 Rt 





= - l= 11111 Unallocated. - 














- - 11111 MSR (immediate) - 

000 000 11111 CFINV Armv8.4 
000 001 11111 XAFLAG Armvs.5 
000 010 11111 AXFLAG Armvs.5 





System instructions 
This section describes the encoding of the System instructions instruction class. The encodings in this section are 


decoded from Branches, Exception Generating and System instructions on page C4-257. 


|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12\11 8/7 54] 0 | 





Decode fields 
Instruction page 








L 
0 SYS 
1 SYSL 





System register move 
This section describes the encoding of the System register move instruction class. The encodings in this section are 


decoded from Branches, Exception Generating and System instructions on page C4-257. 


[31 30 29 28|27 26 25 24|23 22 21 20|1918  16|15 12111 8l7 54] 0| 


101010 1 0 ofLjijoo] opt | cRn | cRm | o2 | R | 





Decode fields 
Instruction page 











L 
0 MSR (register) 
1 MRS 
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C4-262 


Unconditional branch (register) 


This section describes the encoding of the Unconditional branch (register) instruction class. The encodings in this 


section are decoded from Branches, Exception Generating and System instructions on page C4-257. 


[31 30 29 28|27 26 25 24| 


21 20| 


16/15 


10 9 


5 4| 

























































































a a 

E Instruction page Architecture 

opc op2 op3 Rn op4 oe 

- 11111 Žž - - - Unallocated. - 

0000 11111 000000 - != 00000 Unallocated. - 

0000 11111 000000 - 00000 BR - 

0000 11111 000001 - - Unallocated. - 

0000 11111 000010 - 11111 Unallocated. - 

0000 11111 000010 - 11111 BRAA, BRAAZ, BRAB, BRABZ - Key A, zero Armv8.3 
modifier variant on page C6-817 

0000 11111 000011 - 11111 Unallocated. - 

0000 11111 000011 - 11111 BRAA, BRAAZ, BRAB, BRABZ - Key B, zero Armv8.3 
modifier variant on page C6-817 

0000 11111 0001xx - - Unallocated. - 

0000 11111 001xxx - - Unallocated. - 

0000 11111 Q1xxxx - - Unallocated. - 

0000 11111 1xXXXX - - Unallocated. - 

0001 11111 000000 - != 00000 Unallocated. - 

0001 11111 000000 - 00000 BLR 7 

0001 11111 000001 - - Unallocated. - 

0001 11111 000010 - 11111 Unallocated. - 

0001 11111 000010 - 11111 BLRAA, BLRAAZ, BLRAB, BLRABZ- Key A, = Armv8.3 
zero modifier variant on page C6-814 

0001 11111 000011 - 11111 Unallocated. 7 

0001 = 11111 000011 - 11111 BLRAA, BLRAAZ, BLRAB, BLRABZ- KeyB, = Armv8.3 
zero modifier variant on page C6-814 

0001 11111 0001xx - - Unallocated. - 

0001 11111 Q01xxx - - Unallocated. - 

0001 11111 Q1xxxx - - Unallocated. - 

0001 11111 1XXXXx - - Unallocated. - 

0010 11111 000000 - != 00000 Unallocated. - 
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Decode fields 


Instruction page 


Architecture 
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opc op2 op3 Rn op4 version 

0010 11111 000000 - 00000 RET - 

0010 11111 000001 - - Unallocated. - 

0010 11111 000010 != 11111 l= 11111 Unallocated. = 

0010 11111 000010 11111 11111 RETAA, RETAB - RETAA variant on Armv8.3 
page C6-1148 

0010 11111 000011 l= 11111 l= 11111 Unallocated. 7 

0010 11111 000011 11111 11111 RETAA, RETAB - RETAB variant on Armv8.3 
page C6-1148 

0010 11111 Q001xx - - Unallocated. - 

0010 11111 Q01xxx - - Unallocated. - 

0010 11111 Q1xxxx - - Unallocated. - 

0010 11111 1xXXXX - - Unallocated. - 

0011 11111 - - - Unallocated. - 

0100 11111 000000 != 11111 l= 00000 Unallocated. - 

0100 11111 000000 != 11111 00000 Unallocated. = 

0100 11111 000000 11111 != 00000 Unallocated. - 

0100 11111 000000 11111 00000 ERET - 

0100 11111 000001 - - Unallocated. - 

0100 11111 000010 != 11111 = 11111 Unallocated. = 

0100 11111 000010 != 11111 11111 Unallocated. = 

0100 11111 000010 11111 = 11111 Unallocated. = 

0100 11111 000010 11111 11111 ERETAA, ERETAB - ERETAA variant on Armv8.3 
page C6-901 

0100 11111 000011 l= 11111 l= 11111 Unallocated. 7 

0100 11111 000011 l= 11111 11111 Unallocated. - 

0100 11111 000011 11111 l= 11111 Unallocated. - 

0100 11111 000011 11111 11111 ERETAA, ERETAB - ERETAB variant on Armv8.3 
page C6-901 

0100 11111 0001xx - - Unallocated. - 

0100 11111 001xxx - - Unallocated. - 

0100 11111 Q1xxxx - - Unallocated. - 

0100 11111 1xXXXX - - Unallocated. - 

0101 11111 != 000000 - - Unallocated. - 
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C4-264 





Decode fields 


Instruction page 


Architecture 
















































































opc op2 op3 Rn op4 version 

0101 11111 000000 l= 11111 != 00000 Unallocated. z 

0101 11111 000000 != 11111 00000 Unallocated. = 

0101 11111 000000 11111 != 00000 Unallocated. 7 

0101 11111 000000 11111 00000 DRPS š 

011x 11111 - - - Unallocated. - 

1000 11111 00000x - - Unallocated. - 

1000 11111 000010 - - BRAA, BRAAZ, BRAB, BRABZ - Key A, Armv8.3 
register modifier variant on page C6-817 

1000 11111 000011 - - BRAA, BRAAZ, BRAB, BRABZ - Key B, Armv8.3 
register modifier variant on page C6-817 

1000 11111 0001xx - - Unallocated. - 

1000 11111 001xxx - - Unallocated. - 

1000 11111 Q1xxxx - - Unallocated. - 

1000 11111 1XXXXx - - Unallocated. - 

1001 11111 00000x - - Unallocated. - 

1001 11111 000010 - - BLRAA, BLRAAZ, BLRAB, BLRABZ - Key A, Armv8.3 
register modifier variant on page C6-814 

1001 11111 000011 - - BLRAA, BLRAAZ, BLRAB, BLRABZ - KeyB, Armv8.3 
register modifier variant on page C6-814 

1001 11111 0001xx - - Unallocated. - 

1001 11111 001xxx - - Unallocated. - 

1001 11111 Q1xxxx - - Unallocated. - 

1001 11111 1XXXXx - - Unallocated. - 

101x 11111 - - - Unallocated. - 

11xx 11111 - - - Unallocated. - 





Unconditional branch (immediate) 


This section describes the encoding of the Unconditional branch (immediate) instruction class. The encodings in 


this section are decoded from Branches, Exception Generating and System instructions on page C4-257. 
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|31 30 29 28|27 26 25 | | | | | | 0| 


po O01 07] SSCS — ë 





Decode fields 
Instruction page 








op 
0 B 
1 BL 





Compare and branch (immediate) 


This section describes the encoding of the Compare and branch (immediate) instruction class. The encodings in this 
section are decoded from Branches, Exception Generating and System instructions on page C4-257. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| 0 | 
[sfļo 14 1 0 1 ofo] imme | R | 





Decode fields 
Instruction page 











sf op 

0 0 CBZ - 32-bit variant on page C6-832 
0 1 CBNZ - 32-bit variant on page C6-831 
1 0 CBZ - 64-bit variant on page C6-832 





1 1 CBNZ - 64-bit variant on page C6-831 


Test and branch (immediate) 


This section describes the encoding of the Test and branch (immediate) instruction class. The encodings in this 
section are decoded from Branches, Exception Generating and System instructions on page C4-257. 


|31 30 29 28|27 26 25 24|23 |19 18 | | | 5 4| 0 | 
peo 7107 tf] oa [| o a O a 





Decode fields 
Instruction page 











op 
i) TBZ 
1 TBNZ 
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C4.1 A64 instruction set encoding 


C4.1.4 


C4-266 


Loads and Stores 


This section describes the encoding of the Loads and Stores group. The encodings in this section are decoded from 
A64 instruction set encoding on page C4-252. 


31 


28|27 26 25 24|23 2221 | 16/15 12/1110 9 | | 
| opo [|1| fofop2] | os [ td 
op1 a 


o| 


Table C4-5 Encoding table for the Loads and Stores group 





Decode fields 


Decode group or instruction page 













































































op0 opi op2 op3 op4 

0x00 1 00 000000 - Advanced SIMD load/store multiple structures on page C4-267 
0x00 1 01 Oxxxxx = Advanced SIMD load/store multiple structures (post-indexed) on page C4-268 
0x00 1 0x 1xxxxx - Unallocated. 

0x00 1 10 x00000 - Advanced SIMD load/store single structure on page C4-269 
0x00 1 11 - - Advanced SIMD load/store single structure (post-indexed) on page C4-272 
0x00 1 x0 x1xxxx - Unallocated. 

0x00 1 x0 XX1Xxx Žž - Unallocated. 

0x00 1 x0 xxxlxx Žž - Unallocated. 

0x00 1 x0 XXXX1x = Unallocated. 

0x00 1 x XXXXX1 = Unallocated. 

1101 0 1x 1xxxxx Žž - Load/store memory tags on page C4-276 

1x00 1 - - - Unallocated. 

xx00 Q 0x - - Load/store exclusive on page C4-276 

xx01 0 1x Oxxxxx 00 LDAPR/STLR (unscaled immediate) on page C4-279 

xxl - 0x - - Load register (literal) on page C4-280 

xxl1ð Žž - 00 - - Load/store no-allocate pair (offset) on page C4-280 

xxlð Žž - 01 - - Load/store register pair (post-indexed) on page C4-281 

xxl1ð Žž - 10 - - Load/store register pair (offset) on page C4-282 

xxlð Žž - 11 - - Load/store register pair (pre-indexed) on page C4-282 

xxll - Ox Oxxxxx 00 Load/store register (unscaled immediate) on page C4-283 

xxll - 0x Oxxxxx 01 Load/store register (immediate post-indexed) on page C4-284 
xxll - 0x Oxxxxx 10 Load/store register (unprivileged) on page C4-286 

xxll - Ox Oxxxxx 11 Load/store register (immediate pre-indexed) on page C4-286 
xxll- Ox 1xxxxx 00 Atomic memory operations on page C4-288 
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Table C4-5 Encoding table for the Loads and Stores group (continued) 





Decode fields 
Decode group or instruction page 
op0 opt op2 op3 op4 











xxll - 0x 1xxxxx 10 Load/store register (register offset) on page C4-295 
xxll1 Ž - Ox 1xxxxx x1 Load/store register (pac) on page C4-297 
xxll - 1x - - Load/store register (unsigned immediate) on page C4-297 





Advanced SIMD load/store multiple structures 


This section describes the encoding of the Advanced SIMD load/store multiple structures instruction class. The 
encodings in this section are decoded from Loads and Stores on page C4-266. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 1615 12/1110 9 | 5 4| 0 | 


fofajo o 1100 ojLjo 0000 o| opcode [size] Rn | R | 





Decode fields 
Instruction page 







































































L opcode 
(2 0000 ST4 (multiple structures) 
) 0001 Unallocated. 
) 0010 ST1 (multiple structures) - Four registers variant on page C7-2080 
0 0011 Unallocated. 
t) 0100 ST3 (multiple structures) 
0 0101 Unallocated. 
0 0110 ST1 (multiple structures) - Three registers variant on page C7-2080 
0 0111 ST1 (multiple structures) - One register variant on page C7-2080 
() 1000 ST2 (multiple structures) 
0 1001 Unallocated. 
0 1010 ST1 (multiple structures) - Two registers variant on page C7-2080 
) 1011 Unallocated. 
(2 11xx Unallocated. 
1 0000 LD4 (multiple structures) 
1 0001 Unallocated. 
1 0010 LD1 (multiple structures) - Four registers variant on page C7-1753 
1 0011 Unallocated. 
1 0100 LD3 (multiple structures) 
1 0101 Unallocated. 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C4-267 


ID070919 Non-Confidential 


A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 


C4-268 





Decode fields 


Instruction page 























L opcode 

1 0110 LD1 (multiple structures) - Three registers variant on page C7-1753 
1 0111 LD1 (multiple structures) - One register variant on page C7-1753 

1 1000 LD2 (multiple structures) 

1 1001 Unallocated. 

1 1010 LD1 (multiple structures) - Two registers variant on page C7-1753 
1 1011 Unallocated. 

1 11xx Unallocated. 











Advanced SIMD load/store multiple structures (post-indexed) 


This section describes the encoding of the Advanced SIMD load/store multiple structures (post-indexed) instruction 
class. The encodings in this section are decoded from Loads and Stores on page C4-266. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12\1110 9 | 5 4| 0 | 


[olajo o 14 1 0 o tfifo}] Rm | opcode [sie] Rn | R | 





Decode fields 


Instruction page 
























































L Rm opcode 
a - 0001 Unallocated. 
0 - 0011 Unallocated. 
0 - 0101 Unallocated. 
0 - 1001 Unallocated. 
0 - 1011 Unallocated. 
0 - 11xx Unallocated. 
O = 11111 0000 ST4 (multiple structures) - Register offset variant on page C7-2102 
O  != 11111 0010 ST1 (multiple structures) - Four registers, register offset variant on page C7-2081 
O  != 11111 0100 ST3 (multiple structures) - Register offset variant on page C7-2095 
O != 11111 0110 ST1 (multiple structures) - Three registers, register offset variant on page C7-2081 
O  != 11111 0111 ST1 (multiple structures) - One register, register offset variant on page C7-2080 
O  !=11111 1000 ST2 (multiple structures) - Register offset variant on page C7-2088 
O  != 11111 1010 ST1 (multiple structures) - Two registers, register offset variant on page C7-2081 
® 11111 0000 ST4 (multiple structures) - Immediate offset variant on page C7-2102 
o 11111 0010 ST1 (multiple structures) - Four registers, immediate offset variant on page C7-2081 
O 11111 0100 ST3 (multiple structures) - Immediate offset variant on page C7-2095 
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Decode fields 


Instruction page 













































































L Rm opcode 

O 11111 0110 ST1 (multiple structures) - Three registers, immediate offset variant on page C7-2081 
O 11111 0111 ST1 (multiple structures) - One register, immediate offset variant on page C7-2080 

® 11111 1000 ST2 (multiple structures) - Immediate offset variant on page C7-2088 

O 11111 1010 ST1 (multiple structures) - Two registers, immediate offset variant on page C7-2081 
1 - 0001 Unallocated. 

1 - 0011 Unallocated. 

1 - 0101 Unallocated. 

1 - 1001 Unallocated. 

1 - 1011 Unallocated. 

1 - 11xx Unallocated. 

1 != 11111 0000 LD4 (multiple structures) - Register offset variant on page C7-1784 

1 != 11111 0010 LD1 (multiple structures) - Four registers, register offset variant on page C7-1754 

1  != 11111 0100 LD3 (multiple structures) - Register offset variant on page C7-1774 

1 != 11111 0110 LD1 (multiple structures) - Three registers, register offset variant on page C7-1754 

1 != 11111 0111 LD1 (multiple structures) - One register, register offset variant on page C7-1753 

1 != 11111 1000 LD2 (multiple structures) - Register offset variant on page C7-1764 

1  != 11111 1010 LD1 (multiple structures) - Two registers, register offset variant on page C7-1754 

1 = 11111 0000 LD4 (multiple structures) - Immediate offset variant on page C7-1784 

1 = 11111 0010 LD1 (multiple structures) - Four registers, immediate offset variant on page C7-1754 
1 = 11111 0100 LD3 (multiple structures) - Immediate offset variant on page C7-1774 

1 11111 0110 LD1 (multiple structures) - Three registers, immediate offset variant on page C7-1754 
1 = 11111 0111 LD1 (multiple structures) - One register, immediate offset variant on page C7-1753 

1 11111 1000 LD2 (multiple structures) - Immediate offset variant on page C7-1764 

1 11111 1010 LD1 (multiple structures) - Two registers, immediate offset variant on page C7-1754 
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This section describes the encoding of the Advanced SIMD load/store single structure instruction class. The 
encodings in this section are decoded from Loads and Stores on page C4-266. 
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|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 


13121110 9 | 5 4| 0| 


ojejo o 4707 Oft[R[O 0 0 0 O]opade[S[sze] Rn | R] 





Decode fields 


Instruction page 


































































































L R opcode size 

O - Ix - Unallocated. 

o 08 000 - ST1 (single structure) - 8-bit variant on page C7-2084 

o © 001 - ST3 (single structure) - 8-bit variant on page C7-2098 

o © 010 x0 ST1 (single structure) - 76-bit variant on page C7-2084 

o 0 010 x1 Unallocated. 

o 0o ou x0 ST3 (single structure) - 76-bit variant on page C7-2098 

o 0o ou x1 Unallocated. 

o © 100 00 ST1 (single structure) - 32-bit variant on page C7-2084 

o © 100 1x Unallocated. 

o © 100 01 ST1 (single structure) - 64-bit variant on page C7-2084 

o © 100 01 Unallocated. 

o © 101 00 ST3 (single structure) - 32-bit variant on page C7-2098 

o © 101 10 Unallocated. 

o © 101 01 ST3 (single structure) - 64-bit variant on page C7-2098 

o © 101 11 Unallocated. 

o © 101 x1 Unallocated. 

O 1 000 - ST2 (single structure) - 8-bit variant on page C7-2091 

O 1 = 001 - ST4 (single structure) - 8-bit variant on page C7-2105 

O 1 = 010 x0 ST2 (single structure) - 16-bit variant on page C7-2091 

O 1 = 010 x1 Unallocated. 

o 1 Oou x0 ST4 (single structure) - 16-bit variant on page C7-2105 

o 1 = 11 x1 Unallocated. 

O 1 100 00 ST2 (single structure) - 32-bit variant on page C7-2091 

O 1 100 10 Unallocated. 

O 1 100 01 ST2 (single structure) - 64-bit variant on page C7-2091 

O 1 100 11 Unallocated. 

O 1 100 x1 Unallocated. 

O 1 11 00 ST4 (single structure) - 32-bit variant on page C7-2105 
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o 1 11 - 10 Unallocated. 

o 1 11 o O21 ST4 (single structure) - 64-bit variant on page C7-2105 

o 1 = 101 ®@ i121 Unallocated. 

o 1 = 101 1 xl Unallocated. 

1 0 000 - - LD1 (single structure) - 8-bit variant on page C7-1757 

1 0 001 - - LD3 (single structure) - 8-bit variant on page C7-1777 

1 0 010 - x0 LD1 (single structure) - 76-bit variant on page C7-1757 

1 0 010 - xl Unallocated. 

1 0 oll - x0 LD3 (single structure) - 76-bit variant on page C7-1777 

1 0 oll - xl Unallocated. 

1 0 100 - 00 LD1 (single structure) - 32-bit variant on page C7-1757 

1 0 100 - 1x Unallocated. 

1 0 100 o ol LD1 (single structure) - 64-bit variant on page C7-1757 

1 0 100 1 01 Unallocated. 

1 0 101 - 00 LD3 (single structure) - 32-bit variant on page C7-1777 

1 0 101 - 10 Unallocated. 

1 0 101 o al LD3 (single structure) - 64-bit variant on page C7-1777 

1 0 101 o i121 Unallocated. 

1 0 101 1 xl Unallocated. 

1 0 110 o - LDIR 

1 0 110 1 - Unallocated. 

1 (/ 111 0 - LD3R 

1 0 111 1 - Unallocated. 

1 1 000 - - LD2 (single structure) - 8-bit variant on page C7-1767 

1 1 001 - - LD4 (single structure) - 8-bit variant on page C7-1787 

1 1 01 - x0 LD2 (single structure) - 16-bit variant on page C7-1767 

1 1 = 010 - xl Unallocated. 

1 1 @11 - x0 LD4 (single structure) - 16-bit variant on page C7-1787 

1 1 @11 - xl Unallocated. 

1 1 = 100 - 00 LD2 (single structure) - 32-bit variant on page C7-1767 

1 1 100 - 10 Unallocated. 

1 1 1 o ol LD2 (single structure) - 64-bit variant on page C7-1767 
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1 1 100 o 11 Unallocated. 

1 1 1 1 xl Unallocated. 

1 1 101 - 00 LD4 (single structure) - 32-bit variant on page C7-1787 
1 1 101 - 10 Unallocated. 

1 1 101 o al LD4 (single structure) - 64-bit variant on page C7-1787 
1 1 101 o 1 Unallocated. 

1 1 101 1 xl Unallocated. 

1 1 110 0 - LD2R 

1 1 1 1 - Unallocated. 

1 1 111 Q - LD4R 

1 1 11 1 - Unallocated. 








Advanced SIMD load/store single structure (post-indexed) 


This section describes the encoding of the Advanced SIMD load/store single structure (post-indexed) instruction 
class. The encodings in this section are decoded from Loads and Stores on page C4-266. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/11109 | 5 4| 0 | 


ojejo o 4707 1[t[R] Rm  [opcode[S[sze[ Rn | R| 





Decode fields 
Instruction page 












































L R Rm opcode S size 

o - - 11x - - Unallocated. 

0 Oo - 010 - xl Unallocated. 

0 0 - 011 - xl Unallocated. 

o 0 - 100 - 1x Unallocated. 

o 0 - 100 1 0l Unallocated. 

o 0 - 101 - 10 Unallocated. 

o 0 - 101 o 11 Unallocated. 

0 0 - 101 1 x Unallocated. 

o 20 {= 11111 000 - - ST1 (single structure) - 8-bit, register offset variant on page C7-2084 

o 20 {= 11111 001 - - ST3 (single structure) - 8-bit, register offset variant on page C7-2098 

o 0 {= 11111 010 - xð ST1 (single structure) - 16-bit, register offset variant on page C7-2085 

o 20 {= 11111 011 - xð ST3 (single structure) - 16-bit, register offset variant on page C7-2099 
C4-272 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 





Decode fields 
Instruction page 




















































































































L R Rm opcode S size 

o 20 {= 11111 100 - 00 ST1 (single structure) - 32-bit, register offset variant on page C7-2085 

o 20 {= 11111 100 o æl ST1 (single structure) - 64-bit, register offset variant on page C7-2085 

o 0 {= 11111 101 - 00 ST3 (single structure) - 32-bit, register offset variant on page C7-2099 

o 20 {= 11111 101 o æl ST3 (single structure) - 64-bit, register offset variant on page C7-2099 

o @ 11111 000 - - ST1 (single structure) - 8-bit, immediate offset variant on page C7-2084 

o o 11111 001 - - ST3 (single structure) - 8-bit, immediate offset variant on page C7-2098 

o @ 11111 010 - xð ST1 (single structure) - 16-bit, immediate offset variant on page C7-2085 

o @ 11111 011 - xð ST3 (single structure) - 16-bit, immediate offset variant on page C7-2099 

o o 11111 100 - 00 ST1 (single structure) - 32-bit, immediate offset variant on page C7-2085 

o @ 11111 100 o 1 ST1 (single structure) - 64-bit, immediate offset variant on page C7-2085 

o o 11111 101 - 00 ST3 (single structure) - 32-bit, immediate offset variant on page C7-2099 

o 0 11111 101 o 1 ST3 (single structure) - 64-bit, immediate offset variant on page C7-2099 

O 1 - 010 - xl Unallocated. 

®@ 1 - 011 - x Unallocated. 

0 1 - 100 - 10 Unallocated. 

O 1 - 100 o 11 Unallocated. 

0 1 - 100 1 xl Unallocated. 

0 1 - 101 - 1 Unallocated. 

0 1 - 101 o 11 Unallocated. 

0 1 - 101 1 x Unallocated. 

O 1 = 11111 000 - - ST2 (single structure) - 8-bit, register offset variant on page C7-2091 

o 1 != 11111 001 - - ST4 (single structure) - 8-bit, register offset variant on page C7-2105 

o 1 = 11111 010 - xð ST2 (single structure) - 16-bit, register offset variant on page C7-2092 

o 1 = 11111 011 - xð ST4 (single structure) - 16-bit, register offset variant on page C7-2106 

o 1 {= 11111 100 - 00 ST2 (single structure) - 32-bit, register offset variant on page C7-2092 

o 1 = 11111 100 o 1 ST2 (single structure) - 64-bit, register offset variant on page C7-2092 

o 1 {= 11111 101 - 00 ST4 (single structure) - 32-bit, register offset variant on page C7-2106 

o 1 {= 11111 101 o æl ST4 (single structure) - 64-bit, register offset variant on page C7-2106 

®@ 1 11111 000 - - ST2 (single structure) - 8-bit, immediate offset variant on page C7-2091 

®@ 1 11111 001 - - ST4 (single structure) - 8-bit, immediate offset variant on page C7-2105 

®@ 1 11111 010 - xð ST2 (single structure) - 16-bit, immediate offset variant on page C7-2092 

®@ 1 11111 011 - xð ST4 (single structure) - 16-bit, immediate offset variant on page C7-2106 
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L R Rm opcode size 
o 1 11111 100 00 ST2 (single structure) - 32-bit, immediate offset variant on page C7-2092 
0 1 11111 100 01 ST2 (single structure) - 64-bit, immediate offset variant on page C7-2092 
0 1 11111 101 00 ST4 (single structure) - 32-bit, immediate offset variant on page C7-2106 
oO 1 11111 101 01 ST4 (single structure) - 64-bit, immediate offset variant on page C7-2106 
1 0 - 010 x1 Unallocated. 
1 0 - 011 x1 Unallocated. 
1 0 - 100 1x Unallocated. 
1 0 - 100 01 Unallocated. 
1 0 - 101 10 Unallocated. 
1 0 - 101 11 Unallocated. 
1 0 - 101 x1 Unallocated. 
1 0 - 110 - Unallocated. 
1 0 - 111 - Unallocated. 
1 0 {= 11111 000 - LD1 (single structure) - 8-bit, register offset variant on page C7-1757 
1 0 {= 11111 001 - LD3 (single structure) - 8-bit, register offset variant on page C7-1777 
1 0 {= 11111 010 x0 LD1 (single structure) - 16-bit, register offset variant on page C7-1758 
1 0 {= 11111 011 x0 LD3 (single structure) - 16-bit, register offset variant on page C7-1778 
1 0 {= 11111 100 00 LD1 (single structure) - 32-bit, register offset variant on page C7-1758 
1 0 {= 11111 100 01 LD1 (single structure) - 64-bit, register offset variant on page C7-1758 
1 0 {= 11111 101 00 LD3 (single structure) - 32-bit, register offset variant on page C7-1778 
1 0 {= 11111 101 01 LD3 (single structure) - 64-bit, register offset variant on page C7-1778 
1 0 {= 11111 110 - LDIR - Register offset variant on page C7-1761 
1 0 l= 11111 111 - LD3R - Register offset variant on page C7-1781 
1 0 11111 000 - LD1 (single structure) - 8-bit, immediate offset variant on page C7-1757 
1 0 11111 001 - LD3 (single structure) - 8-bit, immediate offset variant on page C7-1777 
1 0 11111 010 x0 LD1 (single structure) - 16-bit, immediate offset variant on page C7-1758 
1 @ = 11111 011 x0 LD3 (single structure) - 16-bit, immediate offset variant on page C7-1778 
1 0 11111 100 00 LD1 (single structure) - 32-bit, immediate offset variant on page C7-1758 
1 0 11111 100 Q1 LD1 (single structure) - 64-bit, immediate offset variant on page C7-1758 
1 0 11111 101 00 LD3 (single structure) - 32-bit, immediate offset variant on page C7-1778 
1 0 11111 101 01 LD3 (single structure) - 64-bit, immediate offset variant on page C7-1778 
1 0 11111 110 - LDIR - Immediate offset variant on page C7-1761 
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L R Rm opcode S size 
1 0 11111 111 o - LD3R - Immediate offset variant on page C7-1781 
1 1 - 010 - xl Unallocated. 
1 1 - 011 - xl Unallocated. 
1 1 - 100 - 1 Unallocated. 
1 1 - 100 o 1 Unallocated. 
1 1 - 100 1 xl Unallocated. 
1 1 - 101 - 10 Unallocated. 
1 1 - 101 o 11 Unallocated. 
1 1 - 101 1 x Unallocated. 
1 1 - 110 1 - Unallocated. 
1 1 - 111 1 - Unallocated. 
1 1 != 11111 000 - - LD2 (single structure) - 8-bit, register offset variant on page C7-1767 
1 1 {= 11111 001 - - LD4 (single structure) - 8-bit, register offset variant on page C7-1787 
1 1 {= 11111 010 - xð LD2 (single structure) - 16-bit, register offset variant on page C7-1768 
1 1 {= 11111 011 - xð LD4 (single structure) - 16-bit, register offset variant on page C7-1788 
1 1 {= 11111 100 - 00 LD2 (single structure) - 32-bit, register offset variant on page C7-1768 
1 1 != 11111 100 o 1 LD2 (single structure) - 64-bit, register offset variant on page C7-1768 
1 1 {= 11111 101 - 00 LD4 (single structure) - 32-bit, register offset variant on page C7-1788 
1 1 {= 11111 101 o 1 LD4 (single structure) - 64-bit, register offset variant on page C7-1788 
1 1 {= 11111 110 o - LD2R - Register offset variant on page C7-1771 
1, í l= 11111 111 o - LDAR - Register offset variant on page C7-1791 
1 1 11111 000 - - LD2 (single structure) - 8-bit, immediate offset variant on page C7-1767 
1 1 11111 001 - - LD4 (single structure) - 8-bit, immediate offset variant on page C7-1787 
1 1 11111 010 - xð LD2 (single structure) - 16-bit, immediate offset variant on page C7-1768 
1 1 11111 011 - xð LD4 (single structure) - 16-bit, immediate offset variant on page C7-1788 
1 1 11111 100 - 00 LD2 (single structure) - 32-bit, immediate offset variant on page C7-1768 
1 1 11111 100 o 1 LD2 (single structure) - 64-bit, immediate offset variant on page C7-1768 
1 1 11111 101 - 00 LD4 (single structure) - 32-bit, immediate offset variant on page C7-1788 
1 1 11111 101 o æl LD4 (single structure) - 64-bit, immediate offset variant on page C7-1788 
1 1 11111 110 o - LD2R - Immediate offset variant on page C7-1771 
1 1 11111 111 o - LD4R - Immediate offset variant on page C7-1791 
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Load/store memory tags 


This section describes the encoding of the Load/store memory tags instruction class. The encodings in this section 
are decoded from Loads and Stores on page C4-266. 


|31 30 29 28|27 26 25 24/23 22 21 20| 


12|11 10 9 


5 4| 0 | 


11011001] mmo fom] Rn | R | 





Decode fields 


Instruction page 


Architecture version 



























































opc imm9 op2 

00 - 01 STG - Post-index variant on page C6-1207 Armv8.5 
00 - 10 STG - Signed offset variant on page C6-1207 Armvs8.5 
00 - 11 STG - Pre-index variant on page C6-1207 Armv8.5 
00 000000000 00 STZGM Armv8.5 
01 - 00 LDG Armv8.5 
Q1 - 01 STZG - Post-index variant on page C6-1305 Armv8.5 
01 - 10 STZG - Signed offset variant on page C6-1305 Armv8.5 
Q1 - 11 STZG - Pre-index variant on page C6-1305 Armv8.5 
10 - 01 ST2G - Post-index variant on page C6-1187 Armv8.5 
10 - 10 ST2G - Signed offset variant on page C6-1187 Armv8.5 
10 - 11 ST2G - Pre-index variant on page C6-1187 Armv8.5 
10 != 000000000 00 Unallocated. - 

10 000000000 00 STGM Armv8.5 
11 - 01 STZ2G - Post-index variant on page C6-1303 Armvs.5 
11 - 10 STZ2G - Signed offset variant on page C6-1303 Armv8.5 
11 - 11 STZ2G - Pre-index variant on page C6-1303 Armv8.5 
11 != 000000000 00 Unallocated. - 

11 000000000 00 LDGM Armv8.5 





Load/store exclusive 


This section describes the encoding of the Load/store exclusive instruction class. The encodings in this section are 


decoded from Loads and Stores on page C4-266. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 


31 30 29 28|27 26 25 24|23 22 21 20| 1615 14 | 109 5 4| 
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size o2 L o1 o0 Rt2 version 

- 1 - 1 - != 11111 Unallocated. - 

Ox 0 - 1 - != 11111 Unallocated. - 

00 0 o 9 0 - STXRB - 

00 0 o 0 1 - STLXRB - 

00 0 ® 1 0 11111 CASP, CASPA, CASPAL, CASPL - 32-bit CASP variant on Armv8.1 
page C6-826 

00 0 0 1 1 11111 CASP, CASPA, CASPAL, CASPL - 32-bit CASPL variant on Armv8.1 
page C6-826 

00 0 1 0 0 - LDXRB - 

00 0 1 0 1 - LDAXRB - 

00 0 1° I 0 11111 CASP, CASPA, CASPAL, CASPL - 32-bit CASPA variant on Armv8.1 
page C6-826 

00 0 1 1 1 11111 CASP, CASPA, CASPAL, CASPL - 32-bit CASPAL variant on Armv8.1 
page C6-826 

00 1 0 20 0 - STLLRB Armv8.1 

00 1 o 9 1 - STLRB - 

00 1 o 1 0 11111 CASB, CASAB, CASALB, CASLB - CASB variant on page C6-822 Armv8.1 

00 1 o 1 1 11111 CASB, CASAB, CASALB, CASLB - CASLB variant on page C6-822 Armv8.1 

00 1 1 9 0 - LDLARB Armv8.1 

00 1 1 9 1 - LDARB - 

00 1 1 1 ) 11111 CASB, CASAB, CASALB, CASLB - CASAB variant on page C6-822 Armv8.1 

00 1 1 1 1 11111 CASB, CASAB, CASALB, CASLB - CASALB variant on Armv8. 1 
page C6-822 

01 0 o 9 0 - STXRH - 

01 0 o 0 1 - STLXRH - 

01 0 o 1 0 11111 CASP, CASPA, CASPAL, CASPL - 64-bit CASP variant on Armv8.1 
page C6-826 

01 0 o 1 1 11111 CASP, CASPA, CASPAL, CASPL - 64-bit CASPL variant on Armv8.1 
page C6-827 

01 0 1 0 0 - LDXRH - 

01 0 1 9 1 - LDAXRH - 
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size o2 L o1 o0 Rt2 VEKRIM 

01 0 I- al 0 11111 CASP, CASPA, CASPAL, CASPL - 64-bit CASPA variant on Armv8.1 
page C6-827 

01 0 1 1 1 11111 CASP, CASPA, CASPAL, CASPL - 64-bit CASPAL variant on Armv8.1 
page C6-827 

01 1 o 9 0 - STLLRH Armv8.1 

01 1 0 20 1 - STLRH - 

01 1 ® 1 0 11111 CASH, CASAH, CASALH, CASLH - CASH variant on page C6-824 Armv8.1 

01 1 o 1 1 11111 CASH, CASAH, CASALH, CASLH - CASLH variant on page C6-824 Armv8.1 

01 1 1 9 0 - LDLARH Armv8.1 

01 il il ( 1 - LDARH - 

01 1 1 l 0 11111 CASH, CASAH, CASALH, CASLH - CASAH variant on Armv8.1 
page C6-824 

01 1 1 1 1 11111 CASH, CASAH, CASALH, CASLH - CASALH variant on Armv8.1 
page C6-824 

10 i) o Q 0 - STXR - 32-bit variant on page C6-1297 - 

10 i) o Q 1 - STLXR - 32-bit variant on page C6-1228 - 

10 i) o 1 i) - STXP - 32-bit variant on page C6-1294 - 

10 0 o 1 1 - STLXP - 32-bit variant on page C6-1225 - 

10 0 1 0 0 - LDXR - 32-bit variant on page C6-1069 - 

10 0 1 0 1 - LDAXR - 32-bit variant on page C6-944 - 

10 0 1 1 0 - LDXP - 32-bit variant on page C6-1067 - 

10 0 t 1 1 - LDAXP - 32-bit variant on page C6-942 - 

10 1 o Q i) - STLLR - 32-bit variant on page C6-1214 Armv8. 1 

10 1 o 0 1 - STLR - 32-bit variant on page C6-1216 - 





10 1 o 1 0 11111 CAS, CASA, CASAL, CASL - 32-bit CAS variant on page C6-829 Armv8.1 





10 1 o 1 1 11111 CAS, CASA, CASAL, CASL - 32-bit CASL variant on page C6-829 Armv8. 1 























10 1 1 0 0 - LDLAR - 32-bit variant on page C6-966 Armv8. 1 
10 1 1 0 1 - LDAR - 32-bit variant on page C6-938 - 
10 1 1 1 0 11111 CAS, CASA, CASAL, CASL - 32-bit CASA variant on page C6-829 Armv8.1 
10 1 1 1 1 11111 CAS, CASA, CASAL, CASL - 32-bit CASAL variant on page C6-829 Armv8.1 
11 0 o 0 0 - STXR - 64-bit variant on page C6-1297 - 
11 i) o 9 1 - STLXR - 64-bit variant on page C6-1228 - 
11 0 o 1 0 - STXP - 64-bit variant on page C6-1294 - 
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size o2 L of o0 Rt2 VERIN 
11 0 o 1 1 - STLXP - 64-bit variant on page C6-1225 - 
11 0 1 0 0 - LDXR - 64-bit variant on page C6-1069 - 
11 0 1 0 1 - LDAXR - 64-bit variant on page C6-944 - 
11 0 1 1 0 - LDXP - 64-bit variant on page C6-1067 - 
11 0 E 1 - LDAXP - 64-bit variant on page C6-942 - 
11 1 o 9 0 - STLLR - 64-bit variant on page C6-1214 Armv8. 1 
11 1 o 0 1 - STLR - 64-bit variant on page C6-1216 - 
11 1 o 1 0 11111 CAS, CASA, CASAL, CASL - 64-bit CAS variant on page C6-829 Armv8.1 
11 1 o 1 1 11111 CAS, CASA, CASAL, CASL - 64-bit CASL variant on page C6-830 Armv8.1 
11 1 1 0 i) - LDLAR - 64-bit variant on page C6-966 Armv8. 1 
11 1 1 0 1 - LDAR - 64-bit variant on page C6-938 - 
11 1 1 1 0 11111 CAS, CASA, CASAL, CASL - 64-bit CASA variant on page C6-829 Armv8.1 
11 1 1 1 1 11111 CAS, CASA, CASAL, CASL - 64-bit CASAL variant on page C6-830 Armv8.1 





ARM DDI 0487E.a 
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LDAPR/STLR (unscaled immediate) 


This section describes the encoding of the LDAPR/STLR (unscaled immediate) instruction class. The encodings in 
this section are decoded from Loads and Stores on page C4-266. 


|31 30 29 28|27 26 25 24/23 22 21 20| 
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size opc 

00 00 STLURB Armv8.4 
00 01 LDAPURB Armv8.4 
00 10 LDAPURSB - 64-bit variant on page C6-932 Armv8.4 
00 11 LDAPURSB - 32-bit variant on page C6-932 Armv8.4 
01 00 STLURH Armv8.4 
01 01 LDAPURH Armv8.4 
01 10 LDAPURSH - 64-bit variant on page C6-934 Armv8.4 
01 11 LDAPURSH - 32-bit variant on page C6-934 Armv8.4 
10 00 STLUR - 32-bit variant on page C6-1219 Armv8.4 
10 01 LDAPUR - 32-bit variant on page C6-926 Armv8.4 
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Instruction page Architecture version 

size opc 

10 10 LDAPURSW Armv8.4 

10 11 Unallocated. - 

11 00 STLUR - 64-bit variant on page C6-1219 Armv8.4 

11 01 LDAPUR - 64-bit variant on page C6-926 Armv8.4 

11 10 Unallocated. = 

11 11 Unallocated. - 








Load register (literal) 


This section describes the encoding of the Load register (literal) instruction class. The encodings in this section are 
decoded from Loads and Stores on page C4-266. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| 0| 
CA C a Cd’ 





Decode fields 
Instruction page 
































opc V 

00 0 LDR (literal) - 32-bit variant on page C6-979 

00 1 LDR (literal, SIMD&FP) - 32-bit variant on page C7-1804 
01 ) LDR (literal) - 64-bit variant on page C6-979 

01 1 LDR (literal, SIMD&FP) - 64-bit variant on page C7-1804 
10 ) LDRSW (literal) 

10 1 LDR (literal, SIMD&FP) - 128-bit variant on page C7-1804 
11 ) PRFM (literal) 

11 1 Unallocated. 





Load/store no-allocate pair (offset) 


This section describes the encoding of the Load/store no-allocate pair (offset) instruction class. The encodings in 
this section are decoded from Loads and Stores on page C4-266. 
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Instruction page 





00 () ( STNP - 32-bit variant on page C6-1234 





00 0 1 LDNP - 32-bit variant on page C6-968 





00 1 ( STNP (SIMD&FP) - 32-bit variant on page C7-2109 





00 1 1 LDNP (SIMD&FP) - 32-bit variant on page C7-1794 





01 (2) - Unallocated. 





01 1 Q STNP (SIMD&FP) - 64-bit variant on page C7-2109 





01 1 1 LDNP (SIMD&FP) - 64-bit variant on page C7-1794 





10 0 0 STNP - 64-bit variant on page C6-1234 





10 0 1 LDNP - 64-bit variant on page C6-968 











10 1 0 STNP (SIMD&FP) - 128-bit variant on page C7-2109 











10 1 1 LDNP (SIMD&FP) - 28-bit variant on page C7-1794 








11 - - Unallocated. 





Load/store register pair (post-indexed) 


This section describes the encoding of the Load/store register pair (post-indexed) instruction class. The encodings 
in this section are decoded from Loads and Stores on page C4-266. 


|31 30 29 28/27 26 25 24|23 2221 | |1514 | 109 | 
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Decode fields 


Instruction page 


Architecture version 


























opc V L 

00 ) 0 STP - 32-bit variant on page C6-1236 - 

00 0 1 LDP - 32-bit variant on page C6-970 - 

00 1 © STP (SIMD&FP)- 32-bit variant on page C7-2111 - 

00 1 1 LDP (SIMD&FP) - 32-bit variant on page C7-1796 - 

01 Q Q STGP Armv8.5 
01 @ 1  LDPSW - 

01 1 0 STP (SIMD&FP) - 64-bit variant on page C7-2111 - 
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C4-282 





Decode fields 


Instruction page 


Architecture version 























ope V L 

01 1 1 LDP (SIMD&FP) - 64-bit variant on page C7-1796 - 
10 0 ) STP - 64-bit variant on page C6-1236 - 
10 Q 1 LDP - 64-bit variant on page C6-970 - 
10 1 0 STP (SIMD&FP) - 128-bit variant on page C7-2111 - 
10 1 1 LDP (SIMD&FP) - 128-bit variant on page C7-1796 - 
11 - - Unallocated. - 





Load/store register pair (offset) 


This section describes the encoding of the Load/store register pair (offset) instruction class. The encodings in this 
section are decoded from Loads and Stores on page C4-266. 


|31 30 29 28|27 26 25 24|23 2221 | |1514 | 109 | 


5 4| 


o | 





Decode fields 


Instruction page 


Architecture version 















































ope V L 

00 0 0 STP - 32-bit variant on page C6-1237 - 
00 Q 1 LDP - 32-bit variant on page C6-971 - 
00 1 ) STP (SIMD&FP) - 32-bit variant on page C7-2112 - 
00 1 1 LDP (SIMD&FP) - 32-bit variant on page C7-1797 - 
01 Q ) STGP Armv8.5 
01 @ 1  LDPSW - 
01 1 0 STP (SIMD&FP) - 64-bit variant on page C7-2112 - 
01 1 1 LDP (SIMD&FP) - 64-bit variant on page C7-1797 - 
10 0 ) STP - 64-bit variant on page C6-1237 - 
10 0 1 LDP - 64-bit variant on page C6-971 - 
10 1 © STP (SIMD&FP) - /28-bit variant on page C7-2112 - 
10 1 1 LDP (SIMD&EFP) - 128-bit variant on page C7-1797 - 
11 - - Unallocated. - 





Load/store register pair (pre-indexed) 


This section describes the encoding of the Load/store register pair (pre-indexed) instruction class. The encodings in 
this section are decoded from Loads and Stores on page C4-266. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


|31 30 29 28|27 26 25 24/23 22 21 | 


C4. 


|1514 | 109 | 


A64 Instruction Set Encoding 
1 A64 instruction set encoding 
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Decode fields 


Instruction page 


Architecture version 


















































ope V L 

00 ) 0 STP - 32-bit variant on page C6-1236 - 
00 0 ae LDP - 32-bit variant on page C6-970 - 
00 1 © STP (SIMD&FP)- 32-bit variant on page C7-2111 - 
00 1 1 LDP (SIMD&FP) - 32-bit variant on page C7-1796 - 
01 Q 0 STGP Armv8.5 
01 @ 1  LDPSW - 
01 1 0 STP (SIMD&FP) - 64-bit variant on page C7-2111 - 
01 1 1 LDP (SIMD&FP) - 64-bit variant on page C7-1796 - 
10 0 ) STP - 64-bit variant on page C6-1236 - 
10 Q 1 LDP - 64-bit variant on page C6-970 - 
10 1 0 STP (SIMD&FP) - 128-bit variant on page C7-2111 - 
10 1 1 LDP (SIMD&FP) - 128-bit variant on page C7-1796 - 
11 - - Unallocated. = 


Load/store register (unscaled immediate) 


This section describes the encoding of the Load/store register (unscaled immediate) instruction class. The encodings 
in this section are decoded from Loads and Stores on page C4-266. 
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Decode fields 
Instruction page 




















size V opc 

x1 1 1x Unallocated. 

00 O 00 STURB 

00 o 1 LDURB 

00 o 10 LDURSB - 64-bit variant on page C6-1062 

00 o 11 LDURSB - 32-bit variant on page C6-1062 

00 1 00 STUR (SIMD&FP) - 8-bit variant on page C7-2121 
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Decode fields 


Instruction page 







































































size V opc 

00 1 @l LDUR (SIMD&FP) - 8-bit variant on page C7-1809 
00 1 1 STUR (SIMD&FP) - 128-bit variant on page C7-2121 
00 1 1 LDUR (SIMD&FP) - 128-bit variant on page C7-1809 
01 O 00 STURH 

01 o 1 LDURH 

01 o 1 LDURSH - 64-bit variant on page C6-1064 

01 o 11 LDURSH - 32-bit variant on page C6-1064 

01 1 00 STUR (SIMD&FP) - 16-bit variant on page C7-2121 
01 1 01 LDUR (SIMD&FP) - 16-bit variant on page C7-1809 
1x o 11 Unallocated. 

1x 1 1x Unallocated. 

10 O 00 STUR - 32-bit variant on page C6-1290 

10 o 1 LDUR - 32-bit variant on page C6-1058 

10 o 10 LDURSW 

10 1 00 STUR (SIMD&FP) - 32-bit variant on page C7-2121 
10 1 01 LDUR (SIMD&FP) - 32-bit variant on page C7-1809 
11 o 00 STUR - 64-bit variant on page C6-1290 

11 o 1 LDUR - 64-bit variant on page C6-1058 

11 o 1 PRFUM 

11 1 00 STUR (SIMD&FP) - 64-bit variant on page C7-2121 
11 1 01 LDUR (SIMD&FP) - 64-bit variant on page C7-1809 





Load/store register (immediate post-indexed) 


This section describes the encoding of the Load/store register (immediate post-indexed) instruction class. The 
encodings in this section are decoded from Loads and Stores on page C4-266. 
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Decode fields 
Instruction page 
size V opc 





x1 1 1x Unallocated. 





00 O 00 STRB (immediate) 





00 o 1 LDRB (immediate) 





00 o 10 LDRSB (immediate) - 64-bit variant on page C6-995 





00 o 11 LDRSB (immediate) - 32-bit variant on page C6-995 





00 1 00 STR (immediate, SIMD&FP) - 8-bit variant on page C7-2114 





00 1 @1 LDR (immediate, SIMD&FP) - 8-bit variant on page C7-1800 





00 1 10 STR (immediate, SIMD&FP) - 128-bit variant on page C7-2114 





00 1 1 LDR (immediate, SIMD&FP) - 128-bit variant on page C7-1800 





01 0 00 STRH (immediate) 





01 o æl LDRH (immediate) 





01 o 10 LDRSH (immediate) - 64-bit variant on page C6-1000 





01 o 11 LDRSH (immediate) - 32-bit variant on page C6-1000 





01 1 0 STR (immediate, SIMD&FP) - 16-bit variant on page C7-2114 





01 1 0l LDR (immediate, SIMD&FP) - 16-bit variant on page C7-1800 





1x ) 11 Unallocated. 





1x 1 1x Unallocated. 





10 O 00 STR (immediate) - 32-bit variant on page C6-1239 





10 o 1 LDR (immediate) - 32-bit variant on page C6-976 





10 o 10 LDRSW (immediate) 





10 1 0 STR (immediate, SIMD&FP) - 32-bit variant on page C7-2114 





10 1 0l LDR (immediate, SIMD&FP) - 32-bit variant on page C7-1800 





11 Oo 00 STR (immediate) - 64-bit variant on page C6-1239 





11 o æl LDR (immediate) - 64-bit variant on page C6-976 





11 1) 10 Unallocated. 





11 1 00 STR (immediate, SIMD&FP) - 64-bit variant on page C7-2114 








11 1 @1 LDR (immediate, SIMD&FP) - 64-bit variant on page C7-1800 
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Load/store register (unprivileged) 


This section describes the encoding of the Load/store register (unprivileged) instruction class. The encodings in this 
section are decoded from Loads and Stores on page C4-266. 


|31 30 29 28|27 26 25 24/23 22 21 20| | 12/1110 9 | 5 4| 0 | 
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Decode fields 
Instruction page 
size V opc 





= 1 - Unallocated. 





00 o 00 STTRB 





00 o l LDTRB 





00 o 10 LDTRSB - 64-bit variant on page C6-1038 





00 o 11 LDTRSB - 32-bit variant on page C6-1038 





01 0 00 STTRH 





01 o O01 LDTRH 





01 o 1 LDTRSH - 64-bit variant on page C6-1040 





01 o 11 LDTRSH - 32-bit variant on page C6-1040 





1x o 11 Unallocated. 





10 0 00 STTR - 32-bit variant on page C6-1272 





10 o 1 LDTR - 32-bit variant on page C6-1032 





10 o 10 LDTRSW 





11 O 00 STTR - 64-bit variant on page C6-1272 





11 o 1 LDTR - 64-bit variant on page C6-1032 





11 ) 10 Unallocated. 





Load/store register (immediate pre-indexed) 


This section describes the encoding of the Load/store register (immediate pre-indexed) instruction class. The 
encodings in this section are decoded from Loads and Stores on page C4-266. 
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Decode fields 
Instruction page 
size V opc 





x1 1 1x Unallocated. 





00 O 00 STRB (immediate) 





00 o 1 LDRB (immediate) 





00 o 10 LDRSB (immediate) - 64-bit variant on page C6-995 





00 o 11 LDRSB (immediate) - 32-bit variant on page C6-995 





00 1 00 STR (immediate, SIMD&FP) - 8-bit variant on page C7-2114 





00 1 @1 LDR (immediate, SIMD&FP) - 8-bit variant on page C7-1800 





00 1 10 STR (immediate, SIMD&FP) - 128-bit variant on page C7-2115 





00 1 1 LDR (immediate, SIMD&FP) - 128-bit variant on page C7-1801 





01 0 00 STRH (immediate) 





01 o æl LDRH (immediate) 





01 o 10 LDRSH (immediate) - 64-bit variant on page C6-1000 





01 o 11 LDRSH (immediate) - 32-bit variant on page C6-1000 





01 1 0 STR (immediate, SIMD&FP) - 16-bit variant on page C7-2115 





01 1 0l LDR (immediate, SIMD&FP) - 16-bit variant on page C7-1801 





1x ) 11 Unallocated. 





1x 1 1x Unallocated. 





10 O 00 STR (immediate) - 32-bit variant on page C6-1239 





10 o 1 LDR (immediate) - 32-bit variant on page C6-976 





10 o 10 LDRSW (immediate) 





10 1 0 STR (immediate, SIMD&FP) - 32-bit variant on page C7-2115 





10 1 0l LDR (immediate, SIMD&FP) - 32-bit variant on page C7-1801 





11 0 00 STR (immediate) - 64-bit variant on page C6-1239 





11 o æl LDR (immediate) - 64-bit variant on page C6-976 





11 1) 10 Unallocated. 





11 1 00 STR (immediate, SIMD&FP) - 64-bit variant on page C7-2115 








11 1 @1 LDR (immediate, SIMD&FP) - 64-bit variant on page C7-1801 
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Atomic memory operations 


This section describes the encoding of the Atomic memory operations instruction class. The encodings in this 
section are decoded from Loads and Stores on page C4-266. 


31 30 29 28|27 26 25 24|23 22 21 20 16/1514 12/11109 | 5 4| 
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Decode fields 


Instruction page 


Architecture 






























































: version 

sie V A R o3 opc 

- Q - 1 001 Unallocated. - 

- 0 - 1 01x Unallocated. - 

- Q - 1 101 Unallocated. - 

- 0 - 1 11x Unallocated. - 

- 0 - 1 100 Unallocated. - 

- Q 1 1 100 Unallocated. - 

- 1 - = - Unallocated. - 

00 Q o 0 000 LDADDB, LDADDAB, LDADDALB, LDADDLB - Armv8. 1 
LDADDB variant on page C6-913 

00 0 o 0 001  LDCLRB,LDCLRAB, LDCLRALB, LDCLRLB -LDCLRB Armv8.1 
variant on page C6-948 

00 Q o 0 010 LDEORB, LDEORAB, LDEORALB, LDEORLB - Armv8.1 
LDEORB variant on page C6-955 

00 0 o 0 011 LDSETB, LDSETAB, LDSETALB, LDSETLB - LDSETB Armv8. 1 
variant on page C6-1011 

00 Q o 0 100 LDSMAXB, LDSMAXAB, LDSMAXALB, LDSMAXLB- Armv8.1 
LDSMAXB variant on page C6-1018 

00 0 o 0 101  LDSMINB, LDSMINAB, LDSMINALB, LDSMINLB - Armv8.1 
LDSMINB variant on page C6-1025 

00 Q o 0 110 LDUMAXB, LDUMAXAB, LDUMAXALB, LDUMAXLB Armv8.l 
- LDUMAXB variant on page C6-1044 

00 0 o 0 111  LDUMINB, LDUMINAB, LDUMINALB, LDUMINLB - Armv8. 1 
LDUMINB variant on page C6-1051 

00 0 0 1 000 SWPB, SWPAB, SWPALB, SWPLB - SWPB variant on Armv8.1 
page C6-1326 

00 0 1 0 000 LDADDB, LDADDAB, LDADDALB, LDADDLB - Armv8.1 
LDADDLB variant on page C6-913 

00 Q 1 0 001  LDCLRB, LDCLRAB, LDCLRALB, LDCLRLB - Armv8. 1 
LDCLRLB variant on page C6-948 

00 0 1 0 010 LDEORB, LDEORAB, LDEORALB, LDEORLB - Armv8. 1 


C4-288 


LDEORLB variant on page C6-955 
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Decode field 
ecode fields Architecture 


Instruction page z 
version 


size V A R o3 opc 





00 o © 1 9 011 LDSETB, LDSETAB, LDSETALB, LDSETLB - LDSETLB — Armv8.1 
variant on page C6-1011 





00 o © 1 9 100 LDSMAXB, LDSMAXAB, LDSMAXALB, LDSMAXLB- Armvŝ.1l 
LDSMAXLB variant on page C6-1018 





00 o © 1 9 101 LDSMINB, LDSMINAB, LDSMINALB, LDSMINLB - Armv8.1 
LDSMINLB variant on page C6-1025 





00 o © 1 9 110 LDUMAXB, LDUMAXAB, LDUMAXALB, LDUMAXLB  Armv8.1 
- LDUMAXLB variant on page C6-1044 





00 o ® 1 9 111  LDUMINB, LDUMINAB, LDUMINALB, LDUMINLB - Armv8. 1 
LDUMINLB variant on page C6-1051 





00 0 © 1 1 000  SWPB, SWPAB, SWPALB, SWPLB - SWPLB variant on Armv8. 1 
page C6-1326 



































00 o 1 0 9 000 LDADDB, LDADDAB, LDADDALB, LDADDLB - Armv8. 1 
LDADDAB variant on page C6-913 

00 ® 1 0 9 001 LDCLRB, LDCLRAB, LDCLRALB, LDCLRLB - Armv8. 1 
LDCLRAB variant on page C6-948 

00 o 1 0 9 010 LDEORB, LDEORAB, LDEORALB, LDEORLB - Armv8. 1 
LDEORAB variant on page C6-955 

00 o 1 0 9 011 LDSETB, LDSETAB, LDSETALB, LDSETLB-LDSETAB — Armv8.1 
variant on page C6-1011 

00 o 1 0 9 100 LDSMAXB, LDSMAXAB, LDSMAXALB, LDSMAXLB- Armvŝ.1l 
LDSMAXAB variant on page C6-1018 

00 O 1 0 @ 101 LDSMINB, LDSMINAB, LDSMINALB, LDSMINLB - Armv8. 1 
LDSMINAB variant on page C6-1025 

00 o 1 0 9 110 LDUMAXB, LDUMAXAB, LDUMAXALB, LDUMAXLB_ ss Armv8.1 
- LDUMAXAB variant on page C6-1044 

00 O 1 0 @ 111 = LDUMINB, LDUMINAB, LDUMINALB, LDUMINLB - Armv8. 1 
LDUMINAB variant on page C6-1051 

00 oO 1 0 1 000 SWPB, SWPAB, SWPALB, SWPLB - SWPAB variant on Armv8. 1 
page C6-1326 

00 O 1 0 1 100 LDAPRB Armv8.3 

00 ® 1 1 90 000 LDADDB, LDADDAB, LDADDALB, LDADDLB - Armv8. 1 


LDADDALB variant on page C6-913 





00 O 1 1 9 001 LDCLRB, LDCLRAB, LDCLRALB, LDCLRLB - Armv8. 1 
LDCLRALB variant on page C6-948 





00 O 1 1 @ 010 + LDEORB, LDEORAB, LDEORALB, LDEORLB - Armv8. 1 
LDEORALB variant on page C6-955 








00 O 1 1 9 011 LDSETB, LDSETAB, LDSETALB, LDSETLB -LDSETALB Armv8.1 
variant on page C6-1011 
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C4-290 


Instruction page 




































































; version 

size opc 

00 100 LDSMAXB, LDSMAXAB, LDSMAXALB, LDSMAXLB- Armv8.1 
LDSMAXALB variant on page C6-1018 

00 101 LDSMINB, LDSMINAB, LDSMINALB, LDSMINLB - Armv8. 1 
LDSMINALB variant on page C6-1025 

00 110 LDUMAXB, LDUMAXAB, LDUMAXALB, LDUMAXLB Armv8.1l 
- LDUMAXALB variant on page C6-1044 

00 111  LDUMINB, LDUMINAB, LDUMINALB, LDUMINLB - Armv8. 1 
LDUMINALB variant on page C6-1051 

00 000 SWPB, SWPAB, SWPALB, SWPLB - SWPALB variant on Armv8. 1 
page C6-1326 

01 000 LDADDH, LDADDAH, LDADDALH, LDADDLH - Armv8. 1 
LDADDBH variant on page C6-915 

01 001  LDCLRH, LDCLRAH, LDCLRALH, LDCLRLH - Armv8.1 
LDCLRH variant on page C6-950 

01 010 LDEORH, LDEORAH, LDEORALH, LDEORLH - Armv8.1 
LDEORH variant on page C6-957 

01 011 LDSETH, LDSETAH, LDSETALH, LDSETLH - LDSETH Armv8.1 
variant on page C6-1013 

01 100 LDSMAXH, LDSMAXAH, LDSMAXALH, LDSMAXLH- Armv8.1 
LDSMAXH variant on page C6-1020 

01 101 LDSMINH, LDSMINAH, LDSMINALH, LDSMINLH - Armv8. 1 
LDSMINH variant on page C6-1027 

01 110 LDUMAXH, LDUMAXAH, LDUMAXALH, LDUMAXLH Armv8.1 
- LDUMAXH variant on page C6-1046 

01 111  LDUMINA, LDUMINAH, LDUMINALH, LDUMINLH - Armv8. 1 
LDUMINH variant on page C6-1053 

01 000 SWPH, SWPAH, SWPALH, SWPLH - SWPH variant on Armv8. 1 
page C6-1328 

01 000 LDADDH, LDADDAH, LDADDALH, LDADDLH - Armv8. 1 
LDADDLH variant on page C6-915 

01 001  LDCLRH, LDCLRAH, LDCLRALH, LDCLRLH - Armv8.1 
LDCLRLH variant on page C6-950 

01 010 LDEORH, LDEORAH, LDEORALH, LDEORLH - Armv8.1 
LDEORLH variant on page C6-957 

01 011 LDSETH, LDSETAH, LDSETALH, LDSETLH - LDSETLH = Armvé8.1 
variant on page C6-1013 

01 100 LDSMAXH, LDSMAXAH, LDSMAXALH, LDSMAXLH- Armv8.1 
LDSMAXLH variant on page C6-1020 

01 101 LDSMINH, LDSMINAH, LDSMINALH, LDSMINLH - Armv8. 1 


LDSMINLH variant on page C6-1027 
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Decode fields ; 
Instruction page Architecture 




































































; version 

size V A R o3 opc 

01 o ® 1 9 110 LDUMAXH, LDUMAXAH, LDUMAXALH, LDUMAXLH Armvg.1 
- LDUMAXLH variant on page C6-1046 

01 o © 1 9 111 LDUMINH, LDUMINAH, LDUMINALH, LDUMINLH - Armv8. 1 
LDUMINLA variant on page C6-1053 

01 o ® 1 1 000 SWPH, SWPAH, SWPALH, SWPLH - SWPLH variant on Armv8.1 
page C6-1328 

01 O 1 0 9 000 LDADDH, LDADDAH, LDADDALH, LDADDLH - Armv8. 1 
LDADDABH variant on page C6-915 

01 O 1 0 @ 001 LDCLRH, LDCLRAH, LDCLRALH, LDCLRLH - Armv8. 1 
LDCLRAH variant on page C6-950 

01 o 1 0 9 010 LDEORH, LDEORAH, LDEORALH, LDEORLH - Armv8. 1 
LDEORAH variant on page C6-957 

01 o 1 0 @ 011 LDSETH, LDSETAH, LDSETALH, LDSETLH - LDSETAH = Armv8.1 
variant on page C6-1013 

01 O 1 0 @ 100 LDSMAXH, LDSMAXAH, LDSMAXALH, LDSMAXLH- = Armv8.1 
LDSMAXAH variant on page C6-1020 

01 o 1 0 @ 101 LDSMINH, LDSMINAH, LDSMINALH, LDSMINLH - Armv8. 1 
LDSMINAH variant on page C6-1027 

01 O 1 0 9 110 LDUMAXH, LDUMAXAH, LDUMAXALH, LDUMAXLH = Armv8.1 
- LDUMAXAH variant on page C6-1046 

01 O 1 0 @ 111 LDUMINH, LDUMINAH, LDUMINALH, LDUMINLH - Armv8. 1 
LDUMINAH variant on page C6-1053 

01 O 1 0 1 000 SWPH, SWPAH, SWPALH, SWPLH - SWPAH variant on Armv8.1 
page C6-1328 

01 O 1 0 1 100 LDAPRH Armv8.3 

01 O 1 1 9 000 LDADDH, LDADDAH, LDADDALH, LDADDLH - Armv8. 1 
LDADDALH variant on page C6-915 

01 O 1 1 9 001 LDCLRH, LDCLRAH, LDCLRALH, LDCLRLH - Armv8. | 
LDCLRALH variant on page C6-950 

01 O 1 1 9 010 LDEORH, LDEORAH, LDEORALH, LDEORLH - Armv8. 1 
LDEORALH variant on page C6-957 

01 O 1 1 9 011 LDSETH, LDSETAH, LDSETALH, LDSETLH - Armv8.1 
LDSETALH variant on page C6-1013 

01 O 1 1 @ 100 LDSMAXH, LDSMAXAH, LDSMAXALH, LDSMAXLH- = Armv8.1 
LDSMAXALH variant on page C6-1020 

01 O 1 1 9 101 LDSMINH, LDSMINAH, LDSMINALH, LDSMINLH - Armv8. 1 
LDSMINALH variant on page C6-1027 

01 O 1 1 @ 110 LDUMAXH, LDUMAXAH, LDUMAXALH, LDUMAXLH = Armv8.1 
- LDUMAXALH variant on page C6-1046 
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Architecture 






























































; version 

size V A R o3 opc 

01 O 1 1 9 111 =LDUMINH, LDUMINAH, LDUMINALH, LDUMINLH - Armv8.1 
LDUMINALH variant on page C6-1053 

01 O 1 1 1 000 SWPH, SWPAH, SWPALH, SWPLH - SWPALH varianton Armv8.1 
page C6-1328 

10 o o eo 2@ 09  LDADD, LDADDA, LDADDAL, LDADDL - 32-bit Armv8. 1 
LDADD variant on page C6-917 

10 o o eo ð 001  LDCLR, LDCLRA, LDCLRAL, LDCLRL - 32-bit LDCLR Armv8.1 
variant on page C6-952 

10 o o eo 2@ 010  LDEOR, LDEORA, LDEORAL, LDEORL - 32-bit LDEOR = Armvé8.1 
variant on page C6-959 

10 o 0 0o 9 011 LDSET, LDSETA, LDSETAL, LDSETL - 32-bit LDSET Armv8. 1 
variant on page C6-1015 

10 o o eo ð 100  LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL - 32-bit  Armv8.1 
LDSMAX variant on page C6-1022 

10 o o eo 2@ 101 LDSMIN, LDSMINA, LDSMINAL, LDSMINL - 32-bit Armv8. 1 
LDSMIN variant on page C6-1029 

10 o o 0o 9 110  LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL - Armv8.1 
32-bit LDUMAX variant on page C6-1048 

10 o o 0o 9 111  LDUMIN, LDUMINA, LDUMINAL, LDUMINL - 32-bit Armv8.1 
LDUMIN variant on page C6-1055 

10 o o ® 1 000 SWP, SWPA, SWPAL, SWPL - 32-bit SWP variant on Armv8.1 
page C6-1330 

10 o © 1 9 00  LDADD, LDADDA, LDADDAL, LDADDL - 32-bit Armv8.1 
LDADDL variant on page C6-917 

10 o ® 1 Q 001 LDCLR, LDCLRA, LDCLRAL, LDCLRL - 32-bit LDCLRL Armv8.1 
variant on page C6-952 

10 o ® 1 9 010  LDEOR,LDEORA, LDEORAL, LDEORL - 32-bit LDEORL Armv8.1 
variant on page C6-959 

10 o © 1 9 011 LDSET, LDSETA, LDSETAL, LDSETL - 32-bit LDSETL Armv8.1 
variant on page C6-1015 

10 o ® 1 9 100  LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL - 32-bit  Armv8.1 
LDSMAXL variant on page C6-1022 

10 o © 1 9 101  LDSMIN, LDSMINA, LDSMINAL, LDSMINL - 32-bit Armv8.1 
LDSMINL variant on page C6-1029 

10 o O 1 9 110  LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL - Armv8. 1 
32-bit LDUMAXL variant on page C6-1048 

10 o © 1 @ 111 LDUMIN, LDUMINA, LDUMINAL, LDUMINL - 32-bit Armv8. 1 
LDUMINL variant on page C6-1055 

10 o © 1 1 000 SWP, SWPA, SWPAL, SWPL - 32-bit SWPL variant on Armv8.1 
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; version 

size V A R o3 opc 

10 O 1 0 @ 000 LDADD, LDADDA, LDADDAL, LDADDL - 32-bit Armv8.1 
LDADDA variant on page C6-917 

10 o 1 0 @ 001  LDCLR, LDCLRA, LDCLRAL, LDCLRL - 32-bit LDCLRA Armv8.1 
variant on page C6-952 

10 O 1 0 @ 010 LDEOR, LDEORA, LDEORAL, LDEORL - 32-bit LDEORA Armv8.1 
variant on page C6-959 

10 o 1 0 9 011 LDSET, LDSETA, LDSETAL, LDSETL - 32-bit LDSETA Armv8.1 
variant on page C6-1015 

10 o 1 0 @ 100 LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL - 32-bit =Armv8.1 
LDSMAXA variant on page C6-1022 

10 o 1 0 @ 101 LDSMIN, LDSMINA, LDSMINAL, LDSMINL - 32-bit Armv8. 1 
LDSMINA variant on page C6-1029 

10 o 1 0 @ 110 LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL - Armv8. 1 
32-bit LDUMAXA variant on page C6-1048 

10 o 1 0 @ 111 = LDUMIN, LDUMINA, LDUMINAL, LDUMINL - 32-bit Armv8. 1 
LDUMINA variant on page C6-1055 

10 O 1 0 1 000 SWP, SWPA, SWPAL, SWPL - 32-bit SWPA variant on Armv8.1 
page C6-1330 

10 oO 1 9 1 100 LDAPR - 32-bit variant on page C6-920 Armv8.3 

10 O 1 1 9 000 LDADD, LDADDA, LDADDAL, LDADDL - 32-bit Armv8. 1 
LDADDAL variant on page C6-917 

10 O 1 1 @ 001  LDCLR, LDCLRA, LDCLRAL, LDCLRL - 32-bit Armv8. 1 
LDCLRAL variant on page C6-952 

10 O 1 1 9 010 LDEOR, LDEORA, LDEORAL, LDEORL - 32-bit Armv8. 1 
LDEORAL variant on page C6-959 

10 O 1 1 9 011 LDSET,LDSETA, LDSETAL, LDSETL - 32-bit LDSETAL Armv8. | 
variant on page C6-1015 

10 O 1 1 @ 100 LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL - 32-bit =Armv8.1 
LDSMAXAL variant on page C6-1022 

10 O 1 1 9 101 LDSMIN, LDSMINA, LDSMINAL, LDSMINL - 32-bit Armv8. 1 
LDSMINAL variant on page C6-1029 

10 O 1 1 9 110 LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL - Armv8. 1 
32-bit LDUMAXAL variant on page C6-1048 

10 O 1 1 @ 111 =LDUMIN, LDUMINA, LDUMINAL, LDUMINL - 32-bit Armv8. 1 
LDUMINAL variant on page C6-1055 

10 O 1 1 1 000 SWP, SWPA, SWPAL, SWPL - 32-bit SWPAL variant on Armv8.1 
page C6-1330 

11 o o 0o 9 000 LDADD, LDADDA, LDADDAL, LDADDL - 64-bit Armv8.1 
LDADD variant on page C6-917 
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Instruction page 


Architecture 

































































; version 

size V A R o3 ope 

11 o 0 0 9 001  LDCLR, LDCLRA, LDCLRAL, LDCLRL - 64-bit LDCLR Armv8.1 
variant on page C6-952 

iR o 0 0 9 010 LDEOR, LDEORA, LDEORAL, LDEORL - 64-bit LDEOR  Armv8.1 
variant on page C6-959 

11 o 0 0 9 011 LDSET, LDSETA, LDSETAL, LDSETL - 64-bit LDSET Armv8.1 
variant on page C6-1015 

11 o 0o 0 9 100 LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL - 64-bit Armv8.1 
LDSMAX variant on page C6-1022 

11 o 0 0 9 101 LDSMIN, LDSMINA, LDSMINAL, LDSMINL - 64-bit Armv8.1 
LDSMIN variant on page C6-1029 

Akik o 0 0 9 110 LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL - Armv8.1 
64-bit LDUMAX variant on page C6-1048 

11 o o 0o Q 111  LDUMIN, LDUMINA, LDUMINAL, LDUMINL - 64-bit Armv8.1 
LDUMIN variant on page C6-1055 

11 o 0 ð 1 000 SWP, SWPA, SWPAL, SWPL - 64-bit SWP variant on Armv8.1 
page C6-1330 

11 o ® 1 9 000 LDADD, LDADDA, LDADDAL, LDADDL - 64-bit Armv8.1 
LDADDL variant on page C6-918 

11 o ® 1 9 001 LDCLR,LDCLRA, LDCLRAL, LDCLRL - 64-bit LDCLRL Armv8.1 
variant on page C6-953 

11 o ® 1 9 010 LDEOR, LDEORA, LDEORAL, LDEORL - 64-bit LDEORL Armv8.1 
variant on page C6-960 

11 o ® 1 9 011 LDSET, LDSETA, LDSETAL, LDSETL - 64-bit LDSETL Armv8.1 
variant on page C6-1016 

11 o ® 1 @ 100 LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL - 64-bit Armv8.1 
LDSMAXL variant on page C6-1023 

11 o ® 1 9 101 LDSMIN, LDSMINA, LDSMINAL, LDSMINL - 64-bit Armv8. 1 
LDSMINL variant on page C6-1030 

11 o © 1 @ 110 LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL - Armv8. 1 
64-bit LDUMAXL variant on page C6-1049 

11 o © 1 9 111  LDUMIN, LDUMINA, LDUMINAL, LDUMINL - 64-bit Armv8. 1 
LDUMINL variant on page C6-1056 

11 o © 1 1 000 SWP, SWPA, SWPAL, SWPL - 64-bit SWPL variant on Armv8. 1 
page C6-1331 

11 o 1 0 @ 000 LDADD, LDADDA, LDADDAL, LDADDL - 64-bit Armv8. 1 
LDADDA variant on page C6-917 

11 o 1 0 @ 001 LDCLR,LDCLRA,LDCLRAL, LDCLRL - 64-bit LDCLRA = Armvé8.1 
variant on page C6-952 

11 O 1 0 @ 010 LDEOR, LDEORA, LDEORAL, LDEORL - 64-bit LDEORA Armv8.1 


variant on page C6-959 
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version 

size V A R o3 ope a 

11 Q o 0 011 LDSET, LDSETA, LDSETAL, LDSETL - 64-bit LDSETA Armv8.1 
variant on page C6-1015 

11 Q o 0 100 LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL - 64-bit Armv8.1 
LDSMAXA variant on page C6-1022 

11 0 o 0 101 LDSMIN, LDSMINA, LDSMINAL, LDSMINL - 64-bit Armv8.1 
LDSMINA variant on page C6-1029 

11 Q o 0 110 LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL - Armv8.1 
64-bit LDUMAXA variant on page C6-1048 

11 Q o 0 111  LDUMIN, LDUMINA, LDUMINAL, LDUMINL - 64-bit Armv8. 1 
LDUMINA variant on page C6-1055 

11 0 0 I 000 SWP, SWPA, SWPAL, SWPL - 64-bit SWPA variant on Armv8.1 
page C6-1330 

11 ) (] 1 100 LDAPR - 64-bit variant on page C6-920 Armv8.3 

11 Q 1 0 000 LDADD, LDADDA, LDADDAL, LDADDL - 64-bit Armv8. 1 
LDADDAL variant on page C6-918 

11 0 1 0 001  LDCLR, LDCLRA, LDCLRAL, LDCLRL - 64-bit Armv8. | 
LDCLRAL variant on page C6-953 

11 Q 1 0 010 LDEOR, LDEORA, LDEORAL, LDEORL - 64-bit Armv8. 1 
LDEORAL variant on page C6-960 

H: 0 1 0 011 LDSET, LDSETA, LDSETAL, LDSETL - 64-bit LDSETAL Armv8.1 
variant on page C6-1016 

11 Q 1 0 100 LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL - 64-bit =Armv8.1 
LDSMAXAL variant on page C6-1023 

11 0 1 0 101 LDSMIN, LDSMINA, LDSMINAL, LDSMINL - 64-bit Armv8.1 
LDSMINAL variant on page C6-1030 

11 0 1 0 110 LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL - Armv8.1 
64-bit LDUMAXAL variant on page C6-1049 

11 Q 1 0 111  LDUMIN, LDUMINA, LDUMINAL, LDUMINL - 64-bit Armv8.1 
LDUMINAL variant on page C6-1056 

11 Q 1 1 000 SWP, SWPA, SWPAL, SWPL - 64-bit SWPAL variant on Armv8. 1 


page C6-1330 
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This section describes the encoding of the Load/store register (register offset) instruction class. The encodings in 
this section are decoded from Loads and Stores on page C4-266. 
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[sze 1 vo olo] Rm | option [S[7 o] Rn | Rt 





Decode fields 
Instruction page 
size V opc option 








































































































- - = xOx Unallocated. 
x1 1 1x - Unallocated. 
00 0 00 != 011 STRB (register) - Extended register variant on page C6-1247 
00 O 00 011 STRB (register) - Shifted register variant on page C6-1247 
00 o 1 != 011 LDRB (register) - Extended register variant on page C6-988 
00 o 1 011 LDRB (register) - Shifted register variant on page C6-988 
00 o 10 != 011 LDRSB (register) - 64-bit with extended register offset variant on page C6-998 
00 o 10 011 LDRSB (register) - 64-bit with shifted register offset variant on page C6-998 
00 o 11 != 011 LDRSB (register) - 32-bit with extended register offset variant on page C6-998 
00 o 1 011 LDRSB (register) - 32-bit with shifted register offset variant on page C6-998 
00 1 00 l= 011 STR (register, SIMD&FP) 
00 1 00 011 STR (register, SIMD&FP) 
00 1 @1 != 011 LDR (register, SIMD&FP) 
00 1 1 011 LDR (register, SIMD&FP) 
00 1 10 - STR (register, SIMD&FP) 
00 2d) ad. - LDR (register, SIMD&FP) 
01 O 00 - STRH (register) 
01 o 1 - LDRH (register) 
01 o 10 - LDRSH (register) - 64-bit variant on page C6-1003 
01 o 11 - LDRSH (register) - 32-bit variant on page C6-1003 
01 1 00 - STR (register, SIMD&FP) 
01 1 0l - LDR (register, SIMD&FP) 
1x o 11 - Unallocated. 
1x 1 1x - Unallocated. 
10 O 00 - STR (register) - 32-bit variant on page C6-1242 
10 o 1 - LDR (register) - 32-bit variant on page C6-981 
10 o 10 - LDRSW (register) 
10 1 0 - STR (register, SIMD&FP) 
C4-296 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 





Decode fields 


Instruction page 




















size V opc option 

10 1 1 - LDR (register, SIMD&FP) 

11 O 00 - STR (register) - 64-bit variant on page C6-1242 
11 o 1 - LDR (register) - 64-bit variant on page C6-981 
11 o 10 - PRFM (register) 

11 1 00 - STR (register, SIMD&FP) 

11 1 1 - LDR (register, SIMD&FP) 





Load/store register (pac) 


This section describes the encoding of the Load/store register (pac) instruction class. The encodings in this section 
are decoded from Loads and Stores on page C4-266. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


szej vo oms] — mo — W) m | Rt 





Decode fields 




















Instruction page Architecture version 

sie V M W 

l=11 - - - Unallocated. - 

11 o 0 i) LDRAA, LDRAB - Key A, offset variant on page C6-983 Armv8.3 

11 o 0 1 LDRAA, LDRAB - Key A, pre-indexed variant on page C6-983 Armv8.3 

11 O 1 0 LDRAA, LDRAB - Key B, offset variant on page C6-983 Armv8.3 

11 O 1 1 LDRAA, LDRAB - Key B, pre-indexed variant on page C6-983 Armv8.3 

11 1 - - Unallocated. E 
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This section describes the encoding of the Load/store register (unsigned immediate) instruction class. The 
encodings in this section are decoded from Loads and Stores on page C4-266. 
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Decode fields 
Instruction page 
size V opc 





x1 1 1x Unallocated. 





00 O 00 STRB (immediate) 





00 o 1 LDRB (immediate) 





00 o 10 LDRSB (immediate) - 64-bit variant on page C6-996 





00 o 11 LDRSB (immediate) - 32-bit variant on page C6-996 





00 1 00 STR (immediate, SIMD&FP) - 8-bit variant on page C7-2115 





00 1 @1 LDR (immediate, SIMD&FP) - 8-bit variant on page C7-1801 





00 1 10 STR (immediate, SIMD&FP) - 128-bit variant on page C7-2116 





00 1 1 LDR (immediate, SIMD&FP) - 128-bit variant on page C7-1802 





01 0 00 STRH (immediate) 





01 o æl LDRH (immediate) 





01 o 10 LDRSH (immediate) - 64-bit variant on page C6-1001 





01 o 11 LDRSH (immediate) - 32-bit variant on page C6-1001 





01 1 0 STR (immediate, SIMD&FP) - 16-bit variant on page C7-2115 





01 1 0l LDR (immediate, SIMD&FP) - 16-bit variant on page C7-1801 





1x ) 11 Unallocated. 





1x 1 1x Unallocated. 





10 O 00 STR (immediate) - 32-bit variant on page C6-1240 





10 o 1 LDR (immediate) - 32-bit variant on page C6-977 





10 o 10 LDRSW (immediate) 





10 1 0 STR (immediate, SIMD&FP) - 32-bit variant on page C7-2115 





10 1 0l LDR (immediate, SIMD&FP) - 32-bit variant on page C7-1801 





11 Oo 00 STR (immediate) - 64-bit variant on page C6-1240 





11 o æl LDR (immediate) - 64-bit variant on page C6-977 





11 ® 10 PRFM (immediate) 





11 1 0 STR (immediate, SIMD&FP) - 64-bit variant on page C7-2115 








11 1 @1 LDR (immediate, SIMD&FP) - 64-bit variant on page C7-1801 
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Processing -- Register 
This section describes the encoding of the Data Processing -- Register group. The encodings in this section are 


decoded from 464 instruction set encoding on page C4-252. 


ines al a2 16/15 m 109 | | 0| 


op0 J 
op1 





Table C4-6 Encoding table for the Data Processing -- Register group 





Decode fields 
Decode group or instruction page 
op0 opt op2 op3 

















Q 1 0110 - Data-processing (2 source) 

1 1 0110 - Data-processing (1 source) on page C4-301 

- 0 Oxxx - Logical (shifted register) on page C4-303 

- ) 1xxð Žž - Add/subtract (shifted register) on page C4-303 

- ) 1xx1 - Add/subtract (extended register) on page C4-304 





- 1 0000 000000 Add/subtract (with carry) on page C4-305 





- 1 0000 x00001 Rotate right into flags on page C4-305 





- 1 0000 = xx0010 Evaluate into flags on page C4-306 





- 1 0010 xxxxðx Conditional compare (register) on page C4-306 





- 1 0010 = xxxxlx Conditional compare (immediate) on page C4-307 





- 1 0100 Žž - Conditional select on page C4-307 








- 1 1xxx - Data-processing (3 source) on page C4-308 





Data-processing (2 source) 
This section describes the encoding of the Data-processing (2 source) instruction class. The encodings in this section 


are decoded from Data Processing -- Register. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 | 109 | 5 4| 0 | 


sloje 70707170] Rm | ooe | Rn | Ro | 





Decode fields 








Instruction page Architecture version 
sf S opcode 
- - 000001 Unallocated. p 
- -  @11xxx Unallocated. = 
- - 1XXxxxx Unallocated. - 
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Instruction page 


Architecture version 





































































































sf opcode 
- 00011x Unallocated. E 
- 001101 Unallocated. z 
- 00111x Unallocated. z 
- 00001x Unallocated. z 
- 0001xx Unallocated. 7 
- QQ1xxx Unallocated. = 
- Q1xxxx Unallocated. - 
) 000000 Unallocated. z 
0 000010 UDIV - 32-bit variant on page C6-1356 - 
0 000011 SDIV - 32-bit variant on page C6-1174 - 
) 00010x Unallocated. - 
0 001000 LSLV - 32-bit variant on page C6-1077 - 
0 001001 LSRV - 32-bit variant on page C6-1083 - 
) 001010 ASRV - 32-bit variant on page C6-787 - 
) 001011 RORV - 32-bit variant on page C6-1161 - 
i) 001100 Unallocated. - 
) 010x11 Unallocated. - 
() 010000 CRC32B, CRC32H, CRC32W, CRC32X - CRC32B variant on page C6-866 - 
0 010001 CRC32B, CRC32H, CRC32W, CRC32X - CRC32H variant on page C6-866 - 
() 010010 CRC32B, CRC32H, CRC32W, CRC32X - CRC32W variant on page C6-866 - 
V) 010100 CRC32CB, CRC32CH, CRC32CW, CRC32CX - CRC32CB variant on - 
page C6-868 
() 010101 CRC32CB, CRC32CH, CRC32CW, CRC32CX - CRC32CH variant on - 
page C6-868 
() 010110 CRC32CB, CRC32CH, CRC32CW, CRC32CX - CRC32CW variant on - 
page C6-868 
1 000000 SUBP Armv8.5 
1 000010 UDIV - 64-bit variant on page C6-1356 - 
1 000011 SDIV - 64-bit variant on page C6-1174 - 
1 000100 IRG Armv8.5 
1 000101 GMI Armv8.5 
1 001000 LSLV - 64-bit variant on page C6-1077 - 
1 001001 LSRV - 64-bit variant on page C6-1083 - 
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Decode fields 
Instruction page Architecture version 
sf S opcode 





1 O 001010 ASRV - 64-bit variant on page C6-787 = 





1 O 001011 RORV - 64-bit variant on page C6-1161 - 





1 O 001100 PACGA Armv8.3 





1 © @10xxd Unallocated. - 





1 © @10x0x Unallocated. - 





1 O 010011 CRC32B, CRC32H, CRC32W, CRC32X - CRC32X variant on page C6-866 - 





1 O 10111 CRC32CB, CRC32CH, CRC32CW, CRC32CX - CRC32CX variant on - 
page C6-868 








1 1 000000 SUBPS Armv8.5 





Data-processing (1 source) 


This section describes the encoding of the Data-processing (1 source) instruction class. The encodings in this section 
are decoded from Data Processing -- Register on page C4-299. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 | 109 | 5 4| 0 | 


st[s]1 1010110] omoda | opcode] Rn] Rd 


Decode fields 
Instruction page Architecture 















































sf S opcode2 opcode Rn version 
- - - 1xXXxXX - Unallocated. - 
- -  xxxÍx - - Unallocated. - 
- -  xXXĪXX - - Unallocated. - 
- -  xX1xxx - - Unallocated. - 
- -  1xxxx - - Unallocated. - 
- O 00000 00011x - Unallocated. - 
- O 00000 001xxx - Unallocated. - 
- O 00000 01xxxx - Unallocated. - 
- 1 - - - Unallocated. - 
Q - 00001 - - Unallocated. - 
7) O 00000 000000 - RBIT - 32-bit variant on page C6-1146 - 
() O 00000 000001 - REV16 - 32-bit variant on page C6-1151 - 
) O 00000 000010 - REV - 32-bit variant on page C6-1149 - 
) O 00000 000011 - Unallocated. - 
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Decode fields ; Architecture 
Instruction page 































































































version 

sf S opcode2 opcode Rn or 

7) O 00000 000100 - CLZ - 32-bit variant on page C6-849 - 

7) O 00000 000101 - CLS - 32-bit variant on page C6-848 - 

1 O 00000 000000 - RBIT - 64-bit variant on page C6-1146 - 

1 O 00000 000001 - REV 16 - 64-bit variant on page C6-1151 - 

1 O 00000 000010 - REV32 - 

1 O 00000 000011 - REV - 64-bit variant on page C6-1149 - 

1 O 00000 000100 - CLZ - 64-bit variant on page C6-849 - 

1 O 00000 000101 - CLS - 64-bit variant on page C6-848 - 

1 O 00001 000000 - PACIA, PACIA1716, PACIASP, PACIAZ, PACIZA - PACIA Armv8.3 
variant on page C6-1132 

1 O 00001 000001 - PACIB, PACIB1716, PACIBSP, PACIBZ, PACIZB - PACIB Armv8.3 
variant on page C6-1134 

1 O 00001 000010 - PACDA, PACDZA - PACDA variant on page C6-1129 Armv8.3 

1 O 00001 000011 - PACDB, PACDZB - PACDB variant on page C6-1130 Armv8.3 

1 O 00001 000100 - AUTIA, AUTIA1716, AUTIASP, AUTIAZ, AUTIZA - Armv8.3 
AUTIA variant on page C6-793 

1 O 00001 000101 - AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZB - Armv8.3 
AUTITB variant on page C6-795 

1 O 00001 000110 - AUTDA, AUTDZA - AUTDA variant on page C6-791 Armv8.3 

1 O 00001 000111 - AUTDB, AUTDZB - AUTDB variant on page C6-792 Armv8.3 

1 O 00001 001000 11111 PACIA, PACIA1716, PACIASP, PACIAZ, PACIZA - Armv8.3 
PACIZA variant on page C6-1132 

1 O 00001 001001 11111 PACIB, PACIB1716, PACIBSP, PACIBZ, PACIZB- PACIZB Armv8.3 
variant on page C6-1134 

1 O 00001 001010 11111 PACDA, PACDZA - PACDZA variant on page C6-1129 Armv8.3 

1 O 00001 001011 11111 PACDB, PACDZB - PACDZB variant on page C6-1130 Armv8.3 

1 O 00001 001100 11111 AUTIA, AUTIAI716, AUTIASP, AUTIAZ, AUTIZA - Armv8.3 
AUTIZA variant on page C6-793 

1 O 00001 001101 11111 AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZB - Armv8.3 
AUTIZB variant on page C6-795 

1 O 00001 001110 11111 AUTDA, AUTDZA - AUTDZA variant on page C6-791 Armv8.3 

1 O 00001 001111 11111 AUTDB, AUTDZB - AUTDZB variant on page C6-792 Armv8.3 

1 O 00001 010000 11111 XPACD, XPACI, XPACLRI - XPACI variant on Armv8.3 
page C6-1369 

1 O 00001 010001 11111 XPACD, XPACI, XPACLRI - XPACD variant on Armv8.3 
page C6-1369 
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Decode fields 
Instruction page 
sf S opcode2 opcode Rn 


Architecture 
version 











1 © 00001 01001x - Unallocated. - 
1 O 00001 0101xx - Unallocated. - 
1 O 00001 Q11xxx - Unallocated. - 





Logical (shifted register) 


This section describes the encoding of the Logical (shifted register) instruction class. The encodings in this section 
are decoded from Data Processing -- Register on page C4-299. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 


| 109 5 4| 0 | 


E E a 





Decode fields 


sf opc N imm6 


Instruction page 


















































0 - -  Ixxxxx Unallocated. 

() 00 i) - AND (shifted register) - 32-bit variant on page C6-777 
0 00 1 - BIC (shifted register) - 32-bit variant on page C6-808 

0 01 o - ORR (shifted register) - 32-bit variant on page C6-1127 
0 01 1 = ORN (shifted register) - 32-bit variant on page C6-1123 
0 10 o - EOR (shifted register) - 32-bit variant on page C6-898 
0 10 1 - EON (shifted register) - 32-bit variant on page C6-894 
0 11 o - ANDS (shifted register) - 32-bit variant on page C6-781 
0 11 1 - BICS (shifted register) - 32-bit variant on page C6-810 
1 00 o - AND (shifted register) - 64-bit variant on page C6-777 
1 00 1 - BIC (shifted register) - 64-bit variant on page C6-808 

1 01 o - ORR (shifted register) - 64-bit variant on page C6-1127 
1 01 1 - ORN (shifted register) - 64-bit variant on page C6-1123 
1 10 o - EOR (shifted register) - 64-bit variant on page C6-898 
1 10 1 - EON (shifted register) - 64-bit variant on page C6-894 
1 11 o - ANDS (shifted register) - 64-bit variant on page C6-781 
I 11 1 - BICS (shifted register) - 64-bit variant on page C6-810 





Add/subtract (shifted register) 


This section describes the encoding of the Add/subtract (shifted register) instruction class. The encodings in this 
section are decoded from Data Processing -- Register on page C4-299. 
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|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 | 109 5 4| 0 | 


FR TRC Ne 





Decode fields 
Instruction page 
sf op S shift imm6 






































- - - il - Unallocated. 

0 - - =- 1xxxxx Unallocated. 

) 0 o - - ADD (shifted register) - 32-bit variant on page C6-763 

0 0 1 - - ADDS (shifted register) - 32-bit variant on page C6-771 
0 1 o - - SUB (shifted register) - 32-bit variant on page C6-1313 
) 1 1 - - SUBS (shifted register) - 32-bit variant on page C6-1323 
1 0 O - - ADD (shifted register) - 64-bit variant on page C6-763 

1 0 1 - - ADDS (shifted register) - 64-bit variant on page C6-771 
1 1 0O - - SUB (shifted register) - 64-bit variant on page C6-1313 
1 1 1 - - SUBS (shifted register) - 64-bit variant on page C6-1323 





Add/subtract (extended register) 


This section describes the encoding of the Add/subtract (extended register) instruction class. The encodings in this 
section are decoded from Data Processing -- Register on page C4-299. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 1312| 109 | 5 4| 0 | 


sols] 10 1 roa] Rm | option | mma] Rn] Rd 





Decode fields 
Instruction page 
sf op S opt imm3 





























- - - - 1x1 Unallocated. 

- - - - 11x Unallocated. 

- - - xl - Unallocated. 

- - - ix - Unallocated. 

0 0 o 0 - ADD (extended register) - 32-bit variant on page C6-758 

0 Q 1 00 - ADDS (extended register) - 32-bit variant on page C6-766 

0 1 o 0 - SUB (extended register) - 32-bit variant on page C6-1308 

0 1 1 00 - SUBS (extended register) - 32-bit variant on page C6-1318 
il 0 o 0 - ADD (extended register) - 64-bit variant on page C6-758 
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Decode fields 
Instruction page 
sf op S opt imm3 











1 Q 1 00 - ADDS (extended register) - 64-bit variant on page C6-766 
1 1 o 0 - SUB (extended register) - 64-bit variant on page C6-1308 
I 1 1 00 - SUBS (extended register) - 64-bit variant on page C6-1318 





Add/subtract (with carry) 


This section describes the encoding of the Add/subtract (with carry) instruction class. The encodings in this section 
are decoded from Data Processing -- Register on page C4-299. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9 | 5 4| 0| 


os 1070000] Rm Joooooo] Rn | Ro | 


Decode fields 
Instruction page 
sf op S 





0 Q 0 ADC - 32-bit variant on page C6-754 





0 Q 1 ADCS - 32-bit variant on page C6-756 





0 1 0 SBC - 32-bit variant on page C6-1164 





0 1 1 SBCS - 32-bit variant on page C6-1166 





1 0 0 ADC - 64-bit variant on page C6-754 





1 0 1 ADCS - 64-bit variant on page C6-756 





1 1 0 SBC - 64-bit variant on page C6-1164 





1 1 1 SBCS - 64-bit variant on page C6-1166 





Rotate right into flags 
This section describes the encoding of the Rotate right into flags instruction class. The encodings in this section are 


decoded from Data Processing -- Register on page C4-299. 


[31 30 29 28|27 26 25 24|23 22 21 20| [151413 12/1110 9 | 5 4]3 0 | 


[sloes] 101000 0] imme [o 0001| Rn fo2] mask | 





Decode fields 
Instruction page Architecture version 
sf op S 02 








) - - - Unallocated. - 
1 ) o - Unallocated. - 
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Decode fields 
Instruction page Architecture version 
sf op S 02 





1 i) 1 0 RMIF Armv8.4 





1 () 1 1 Unallocated. - 





1 1 - - Unallocated. - 





Evaluate into flags 


This section describes the encoding of the Evaluate into flags instruction class. The encodings in this section are 
decoded from Data Processing -- Register on page C4-299. 


|31 30 29 28|27 26 25 24/23 22 21 20| 151413 1211110 9 | 5 413 0| 


os 1010.00 0] opcode? az]0 01 0] Rn Joo] mask | 


Decode fields ; Architecture 
Instruction page 


























sf op S opcode2 sz o3 mask version 
7) 0 0 - - - - Unallocated. - 
0 0 1  != 000000 - - - Unallocated. - 
7) 0 1 000000 - 0 != 1101 Unallocated. - 
0 0 1 000000 - 1 - Unallocated. - 
o o 1 000000 0 0 1101 SETF8, SETF16 - SETF8 variant on page C6-1175 Armv8.4 
o o 1 000000 1 0 1101 SETF8, SETF16 - SETF16 variant on page C6-1175 Armv8.4 
0 1 - - - - - Unallocated. - 
1 - - - - - - Unallocated. - 





Conditional compare (register) 
This section describes the encoding of the Conditional compare (register) instruction class. The encodings in this 


section are decoded from Data Processing -- Register on page C4-299. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 12/1110 9 | 5 4|3 0 | 


sflopfs]1_ 1010070) Rm | cond [ofo] _ Rn [os| nzv | 





Decode fields 
Instruction page 
sf op S 02 03 





L 2 a ok 1 Unallocated. 








- - - 1 - Unallocated. 
- - o - - Unallocated. 
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Decode fields 
Instruction page 
sf op S 02 03 





Q 0 1 0 0 CCMN (register) - 32-bit variant on page C6-835 





Q 1 1 0 0 CCMP (register) - 32-bit variant on page C6-839 





1 0 1 0 0 CCMN (register) - 64-bit variant on page C6-835 





1 1 1 0 0 CCMP (register) - 64-bit variant on page C6-839 





Conditional compare (immediate) 
This section describes the encoding of the Conditional compare (immediate) instruction class. The encodings in this 


section are decoded from Data Processing -- Register on page C4-299. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4|3 0 | 


ojs 1070070] mms | cond fijoa) Rn oo] raw 





Decode fields 
Instruction page 
sf op S 02 03 





7 = a i 1 Unallocated. 





- a = 4 7 Unallocated. 





- - () - - Unallocated. 





) 0 1 0 0 CCMN (immediate) - 32-bit variant on page C6-833 





) 1 1 0 0 CCMP (immediate) - 32-bit variant on page C6-837 





1 0 1 0 0 CCMN (immediate) - 64-bit variant on page C6-833 





1 1 1 0 0 CCMP (immediate) - 64-bit variant on page C6-837 





Conditional select 
This section describes the encoding of the Conditional select instruction class. The encodings in this section are 


decoded from Data Processing -- Register on page C4-299. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 12/1110 9 | 5 4| 0| 


sflopfs]1_ 1 0 10 100| Rm | cond Jop2] Rn | Ra | 





Decode fields 
Instruction page 
sf op S op2 





- 5 - 1x Unallocated. 





- - 1 - Unallocated. 





i) ) o 00 CSEL - 32-bit variant on page C6-871 
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C4-308 





Decode fields 


Instruction page 























sf op S op2 

0 0 o 1 CSINC - 32-bit variant on page C6-877 
i) 1 0 00 CSINV - 32-bit variant on page C6-879 
i) 1 o 01 CSNEG - 32-bit variant on page C6-881 
1 ( 0 00 CSEL - 64-bit variant on page C6-871 

1 0 o 1 CSINC - 64-bit variant on page C6-877 
1 1 O 00 CSINV - 64-bit variant on page C6-879 
1 1 o @1 CSNEG - 64-bit variant on page C6-881 





Data-processing (3 source) 


This section describes the encoding of the Data-processing (3 source) instruction class. The encodings in this section 
are decoded from Data Processing -- Register on page C4-299. 


|31 30 29 28|27 26 25 24|23 21 20| 


16|15 14 


eae a oY Vr ne 


10 9 


5 4| 





Decode fields 


Instruction page 
























































sf op54 op31 00 

- 0 010 1 Unallocated. 

- 0 011 - Unallocated. 

- 00 100 - Unallocated. 

- 00 110 1 Unallocated. 

- 00 111 - Unallocated. 

- 1 - - Unallocated. 

- 1x - - Unallocated. 

0 00 000 0 MADD - 32-bit variant on page C6-1085 
0 00 000 1 MSUB - 32-bit variant on page C6-1109 
0 00 001 0 Unallocated. 

o 2 001 1 Unallocated. 

0 00 010 0 Unallocated. 

o o 101 0 Unallocated. 

0 00 101 1 Unallocated. 

0 00 110 0 Unallocated. 

1 00 000 0 MADD - 64-bit variant on page C6-1085 
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Decode fields 
Instruction page 
sf op54 op31 00 























1 00 000 1 MSUB - 64-bit variant on page C6-1109 
1 00 001 0 SMADDL 

1 0 001 1 SMSUBL 

1 2 010 0 SMULH 

1 0 101 0 UMADDL 

1 2 101 1 UMSUBL 

1 00 110 0 UMULH 





Data Processing -- Scalar Floating-Point and Advanced SIMD 


This section describes the encoding of the Data Processing -- Scalar Floating-Point and Advanced SIMD group. The 
encodings in this section are decoded from 464 instruction set encoding on page C4-252. 


|31 28|27 24|23 22 |19 18 | | 109 | | 0 | 
| opo | 1 opt] o2 | oœ C 


Table C4-7 Encoding table for the Data Processing -- Scalar Floating-Point and Advanced SIMD group 





Decode fields 


Decode group or instruction page 


Architecture 





















































op0 opi op2 op3 version 
0000 Ox x101 00xxxxx10 Unallocated. - 
0010 = Ox x101 @Oxxxxx1@ Unallocated. - 
0100 0x x101 @Oxxxxxl@ Cryptographic AES on page C4-311 - 
0101 0x XOXxx XxxOxxx00 Cryptographic three-register SHA on page C4-312 - 
0101 0x x0xx xxx0xxx1ð Unallocated. - 
0101 0x x101 @Oxxxxxl@ Cryptographic two-register SHA on page C4-312 - 
0110 0x x101 00xxxxx10 Unallocated. - 
0111 = Ox XOxx xxx0xxxxð Unallocated. - 
0111 = Ox x101 @Oxxxxx1@ Unallocated. F 
01x1 00 00xx XxXOxxxxl Advanced SIMD scalar copy on page C4-313 - 
Q1x1l 01 00xx Xxx@xxxxl Unallocated. = 
01x1 = Qx 0111 @Oxxxxx1@ Unallocated. = 
01x1 = Qx 10xx Xxx0Oxxxl Advanced SIMD scalar three same FP16 on page C4-313 - 
Q1x1l 0x 10xx Xxx@1xxx1 Unallocated. - 
01x1 = Qx 1111 @Oxxxxxl@ Advanced SIMD scalar two-register miscellaneous FP16 on page C4-314 - 
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Table C4-7 Encoding table for the Data Processing -- Scalar Floating-Point and Advanced SIMD group (continued) 





Decode fields 


Decode group or instruction page 


Architecture 


































































































op0 opi op2 op3 version 
01x1 = Qx XOxx Xxx1xxxx@ Unallocated. = 
01x1 = Qx XOxx XXX1xxxxl Advanced SIMD scalar three same extra on page C4-316 - 
01x1 = Qx x100 @Oxxxxxl@ Advanced SIMD scalar two-register miscellaneous on page C4-316 - 
Q1x1l 0x x110 @@xxxxx1@ Advanced SIMD scalar pairwise on page C4-318 - 
01x1 = Qx x1xx 1xxxxxx1@ Unallocated. - 
01x1 = Qx x1xx X1xxxxxl@ Unallocated. = 
01x1 = Qx x1xx xxxxxxx0ð Advanced SIMD scalar three different on page C4-319 - 
01x1 = Ox x1xx XXXXXXXXL Advanced SIMD scalar three same on page C4-320 - 
01x1 10 - XXXXXXXXL Advanced SIMD scalar shift by immediate on page C4-322 - 
01x1 11 - XXXXXXXX1 Unallocated. Š 
01x1 1x - XXXXXXXX@ Advanced SIMD scalar x indexed element on page C4-324 - 
0x00 0x XOxx Xxx0xxx00 Advanced SIMD table lookup on page C4-325 - 
0x00 0x XOXxx xxx0xxx1ð Advanced SIMD permute on page C4-326 - 
0x10 0x XOxx xxx0xxxxð Advanced SIMD extract on page C4-327 - 
Oxx® 00 00xx XxXOxxxxl Advanced SIMD copy on page C4-327 - 
Oxx® 01 QOxx XxxOxxxxl Unallocated. - 
Qxx® 0x 0111 @Oxxxxx1@ Unallocated. = 
Qxx® 0x 10xx xxx00xxx] Advanced SIMD three same (FP16) on page C4-328 - 
Oxx® 0x 10xx Xxx@1xxx1 Unallocated. = 
Oxx® =x 1111 @Oxxxxxl@ Advanced SIMD two-register miscellaneous (FP16) on page C4-329 - 
Qxx® 0x XOxx xxx1xxxxð Unallocated. - 
Oxx® 0x XOxx XXX1xxxxl Advanced SIMD three same extra on page C4-330 - 
Oxx® 0x x100 @Oxxxxxl@ Advanced SIMD two-register miscellaneous on page C4-331 - 
Qxx® 0x x110 @Oxxxxxl@ Advanced SIMD across lanes on page C4-334 - 
Qxx® 0x x1xx 1xxxxxx1@ Unallocated. - 
Qxx® 0x x1xx x1xxxxx1ð Unallocated. - 
Oxx® = Ox x1xx xxxxxxxð0ð Advanced SIMD three different on page C4-335 - 
Qxx® 0x x1xx XXXXXXXXL Advanced SIMD three same on page C4-336 - 
Oxx® 10 0000 XXXXXXXXL Advanced SIMD modified immediate on page C4-340 - 
Oxxd 10 != 0000 = xxxxxxxxl Advanced SIMD shift by immediate on page C4-340 - 
Oxx®@ 11 - XXXXXXXXL Unallocated. = 
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Table C4-7 Encoding table for the Data Processing -- Scalar Floating-Point and Advanced SIMD group (continued) 





Decode fields : 
‘ A Architecture 
Decode group or instruction page 
























































op0 opi op2 op3 version 
Oxx® 1x - XXXXXXXX@ Advanced SIMD vector x indexed element on page C4-342 - 
1100 00 10xx xxx10xxxx Cryptographic three-register, imm2 on page C4-344 - 
1100 00 11xx XxX1x00xx Cryptographic three-register SHA 512 on page C4-345 - 
1100 00 - xxx0xxxxx Cryptographic four-register on page C4-345 - 
1100 1 QQxx - XAR Armv8.2 
1100 01 1000 0001000xx Cryptographic two-register SHA 512 on page C4-345 - 
1xxd 1x - - Unallocated. = 
x0x1 Ox XOxx - Conversion between floating-point and fixed-point on page C4-346 - 
x@xl 0x x1xx xxx000000 Conversion between floating-point and integer on page C4-348 - 
x0xl 0x x1xx Xxxx10000 Floating-point data-processing (1 source) on page C4-352 - 
x@x1 Ox x1xx xxxxx1000 Floating-point compare on page C4-355 - 
xðx1 = Ox x1xx xxxxxx100 Floating-point immediate on page C4-356 - 
x0x1 0x x1xx xxxxxxxð0] Floating-point conditional compare on page C4-356 - 
x0x1 = Ox X1xx XXXXXXxX1@ Floating-point data-processing (2 source) on page C4-357 - 
x0xl 0x x1xx XXXXXXX11 Floating-point conditional select on page C4-358 - 
x@xl 1x - - Floating-point data-processing (3 source) on page C4-359 - 
Cryptographic AES 


This section describes the encoding of the Cryptographic AES instruction class. The encodings in this section are 
decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16| 12|11 10 9 = 5 4| 0 | 


0100171 O[sze]1 0100] opcode [10] rn J Rd 





Decode fields 
Instruction page 
size opcode 




















- X1xxx Unallocated. 
- Q00xx Unallocated. 
- 1xxxx Unallocated. 
x1 - Unallocated. 
00 00100 AESE 
00 00101 AESD 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C4-311 


ID070919 Non-Confidential 


A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 





Decode fields 
Instruction page 
size opcode 











00 00110 AESMC 
00 00111 AESIMC 
1x - Unallocated. 





Cryptographic three-register SHA 


This section describes the encoding of the Cryptographic three-register SHA instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[0101141771 ofso] Rm [Olopcode[o o) Rn | Ro | 


Decode fields 
Instruction page 
size opcode 
































- 111 Unallocated. 
x1 - Unallocated. 
00 000 SHAIC 

00 001 SHAIP 

00 010 SHAIM 

00 011 SHAISUO 
00 100 SHA256H 
00 101 SHA256H2 
00 110 SHA256SU1 
1x - Unallocated. 





Cryptographic two-register SHA 


This section describes the encoding of the Cryptographic two-register SHA instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 
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|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16| 12/1110 9 | 5 4| 0 | 


oT011771 olse 0100] opcode [io] Rn J Rd 





Decode fields 
Instruction page 
size opcode 





























- XX1xx Unallocated. 
- X1xxx Unallocated. 
- 1xxxx Unallocated. 
x1 - Unallocated. 
00 00000 SHA1IH 

00 00001 SHAISU1 

00 00010 SHA256SU0 
00 00011 Unallocated. 
1x - Unallocated. 





Advanced SIMD scalar copy 


This section describes the encoding of the Advanced SIMD scalar copy instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 11109 | 5 4| 0 | 


[o loji 1141000 of immS [o| imma Jit Rao | Ra | 





Decode fields 
Instruction page 
op imm5 imm4 


























0 - xxxl Unallocated. 
0 - xx1x Unallocated. 
0 - x1xx Unallocated. 
Q - 0000 DUP (element) 
0 - 1xxx Unallocated. 
0 x0000 0000 Unallocated. 
1 - - Unallocated. 





Advanced SIMD scalar three same FP16 


This section describes the encoding of the Advanced SIMD scalar three same FP 16 instruction class. The encodings 
in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 
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C4-314 


|31 30 29 28|27 26 25 24/23 22 21 20 


fo sul +771 oja of Rm Jo Olopcode[i] Rn | Rd 


16|15 14 13 


111109 | 


o| 





Decode fields 


U a opcode 


Instruction page 


Architecture version 



























































- - 110 Unallocated. 
- 1 11 Unallocated. 
o 0 11 FMULX Armv8.2 
O © 100 FCMEQ (register) Armv8.2 
o O 101 Unallocated. 
o 0o 111 FRECPS Armv8.2 
O 1 10 Unallocated. 
o 1 10 Unallocated. 
@ 1 111 FRSQRTS Armv8.2 
1 0 11 Unallocated. 
1 0 100 FCMGE (register) Armv8.2 
1 0 101 FACGE Armv8.2 
1 0 i111 Unallocated. 
1 1 010 FABD Armv8.2 
1 1 100 FCMGT (register) Armv8.2 
1 1 101 FACGT Armv8.2 
1 1 11 Unallocated. 








Advanced SIMD scalar two-register miscellaneous FP16 
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This section describes the encoding of the Advanced SIMD scalar two-register miscellaneous FP16 instruction 
class. The encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced 
SIMD on page C4-309. 


ARM DDI 0487E.a 
ID070919 


A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16| 12/1110 9 | 5 4| 0 | 


fo tfult +771 [ali i710 0] opcode [io] Rn | Rd 





Decode fields 
Instruction page Architecture version 
U a opcode 





- -  00XXxX nallocated. - 





- -  010xx nallocated. - 





- -  10xxx nallocated. - 





2 - 1100x nallocated. = 




















U 
U 
U 
U 
- - 11110 Unallocated. - 
U 
U 
U 
U 




































































- © @llxx nallocated. - 

- 0 11111 nallocated. - 

- 1 oul nallocated. - 

- 1 11100 nallocated. - 

() © 11010 FCVTNS (vector) Armv8.2 
) © 11011 FCVTMS (vector) Armv8.2 
0 © 11100 FCVTAS (vector) Armv8.2 
o © 11101 SCVTF (vector, integer) Armv8.2 
0 1 01100 FCMGT (zero) Armv8.2 
0 1 01101 FCMEQ (zero) Armv8.2 
0 1 01110 FCMLT (zero) Armv8.2 
O 1 11010 FCVTPS (vector) Armv8.2 
O 1 = 11011 FCVTZS (vector, integer) Armv8.2 
O 1 = 11101 FRECPE Armv8.2 
oO 1 = 11111 FRECPX Armv8.2 
1 © 11010 FCVTNU (vector) Armv8.2 
1 © 11011 FCVTMU (vector) Armv8.2 
1 © 11100 FCVTAU (vector) Armv8.2 
1 © 11101 UCVTF (vector, integer) Armv8.2 
1 1 01100 FCMGE (zero) Armv8.2 
1 1 01101 FCMLE (zero) Armv8.2 
1 1 01110 Unallocated. - 

1 1 11010 FCVTPU (vector) Armv8.2 
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A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 





Decode fields 


U a opcode 


Instruction page 


Architecture version 











1 1 11011 FCVTZU (vector, integer) Armv8.2 
1 1 11101 FRSQRTE Armvs8.2 
1 1 11111 Unallocated. - 





Advanced SIMD scalar three same extra 


This section describes the encoding of the Advanced SIMD scalar three same extra instruction class. The encodings 
in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 


11109 | 


5 4| 0| 


oao 117 ofso] Rm [1] opcode [i] Rn] Rd 


Decode fields 


Instruction page 


Architecture version 


























U opcode 

- 001x Unallocated. - 

- 01xx Unallocated. - 

- 1xxx Unallocated. - 

0 0000 Unallocated. - 

0 0001 Unallocated. - 

1 0000 SQRDMLAH (vector) Armv8.1 
1 0001 SQRDMLSH (vector) Armv8.1 





Advanced SIMD scalar two-register miscellaneous 


This section describes the encoding of the Advanced SIMD scalar two-register miscellaneous instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 


page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16| 


12/1110 9 | 


fo Jul 1771 O[sze]1 0000] ood [io] Rn | Rd 


5 4| o| 





Decode fields 


Instruction page 











U size opcode 
- - 0000x Unallocated. 
- - 00010 Unallocated. 
- - 0010x Unallocated. 
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C4.1 A64 instruction set encoding 





Decode fields 


Instruction page 








































































































U size opcode 

- = 00110 Unallocated. 

- - 01111 Unallocated. 

- - 1000x Unallocated. 

- - 10011 Unallocated. 

- - 10101 Unallocated. 

- = 10111 Unallocated. 

- = 1100x Unallocated. 

- - 11110 Unallocated. 

- 0x Q11xx Unallocated. 

- 0x 11111 Unallocated. 

- 1x 10110 Unallocated. 

- ix 11100 Unallocated. 

o - 00011 SUQADD 

o - 00111 SQABS 

i) - 01000 CMGT (zero) 

0 - 01001 CMEQ (zero) 

(/ - 01010 CMLT (zero) 

0 = 01011 ABS 

0 - 10010 Unallocated. 

o - 10100 SQXTN, SQXTN2 
o ex 10110 Unallocated. 

(/ Ox 11010 FCVTNS (vector) 
v) 0x 11011 FCVTMS (vector) 
O ex 11100 FCVTAS (vector) 
O ox 11101 SCVTF (vector, integer) 
0 1x 01100 FCMGT (zero) 

() 1x 01101 FCMEQ (zero) 

0 1x 01110 FCMLT (zero) 

) 1x 11010 FCVTPS (vector) 
i) 1x 11011 FCVTZS (vector, integer) 
® ix 11101 FRECPE 

0 1x 11111 FRECPX 





C4-317 


A64 Instruction Set Encoding 


C4.1 A64 instruction set encoding 





Decode fields 


Instruction page 

































































U size opcode 

1 - 00011 USQADD 

i e 00111 SQNEG 

1 - 01000 CMGE (zero) 

1 - 01001 CMLE (zero) 

1 - 01010 Unallocated. 

il - 01011 NEG (vector) 

1 - 10010 SQXTUN, SQXTUN2 
1 - 10100 UQXTN, UQXTN2 

1 ex 10110 FCVTXN, FCVTXN2 
1 Ox 11010 FCVTNU (vector) 

1 Ox 11011 FCVTMU (vector) 

1 Ox 11100 FCVTAU (vector) 

1 ex 11101 UCVTF (vector, integer) 
1 1x 01100 FCMGE (zero) 

1 1x 01101 FCMLE (zero) 

1 1x 01110 Unallocated. 

1 1x 11010 FCVTPU (vector) 

1 1x 11011 FCVTZU (vector, integer) 
1 ix 11101 FRSQRTE 

1 ix 11111 Unallocated. 








Advanced SIMD scalar pairwise 


This section describes the encoding of the Advanced SIMD scalar pairwise instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16| 


12/1110 9 | 


5 4| o| 


oao 117 O[sze]i 1000] oo [io] Rn | Rd 





Decode fields 


Instruction page 


Architecture 











R version 
U size opcode 
- - QOxxx Unallocated. s 
- - 010xx Unallocated. - 
- - 01110 Unallocated. z 
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C4.1 A64 instruction set encoding 





Decode fields 


Instruction page 


Architecture 










































































U size opcode version 
- - 10xxx Unallocated. = 
- =- 1100x Unallocated. * 
- - 11010 Unallocated. - 
- - 111xx Unallocated. = 
- ix 01101 Unallocated. - 
i) - 11011 ADDP (scalar) - 
O 0 01100 FMAXNMP (scalar) - Half-precision variant on page C7-1595 Armv8.2 
Oo 0 01101 FADDP (scalar) - Half-precision variant on page C7-1464 Armv8.2 
Oo o 01111 FMAXP (scalar) - Half-precision variant on page C7-1601 Armv8.2 
o al 01100 Unallocated. - 
o æl 01101 Unallocated. - 
o al 01111 Unallocated. - 
o 10 01100 FMINNMP (scalar) - Half-precision variant on page C7-1615 Armv8.2 
o 10 01111 FMINP (scalar) - Half-precision variant on page C7-1621 Armv8.2 
o n 01100 Unallocated. - 
o 11 01111 Unallocated. - 
1 - 11011 Unallocated. = 
1 0x 01100 FMAXNMP (scalar) - Single-precision and double-precision variant on page C7-1595  - 
1 0x 01101 FADDP (scalar) - Single-precision and double-precision variant on page C7-1464 - 
1 0x 01111 FMAXP (scalar) - Single-precision and double-precision variant on page C7-1601 - 
1 1x 01100 FMINNMP (scalar) - Single-precision and double-precision variant on page C7-1615 - 
1 1x 01111 FMINP (scalar) - Single-precision and double-precision variant on page C7-1621 - 








Advanced SIMD scalar three different 


This section describes the encoding of the Advanced SIMD scalar three different instruction class. The encodings 
in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 
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A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 


C4-320 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12|11 10 9 


| 5 4 


o| 


o ajo +771 O[sze]i] Rm | opcode [oo] Rn | Ro | 





Decode fields 


Instruction page 









































U opcode 

- 00xx Unallocated. 

- 01xx Unallocated. 

- 1000 Unallocated. 

- 1010 Unallocated. 

- 1100 Unallocated. 

- 111x Unallocated. 

(] 1001 SQDMLAL, SQDMLAL2 (vector) 
(] 1011 SQDMLSL, SQDMLSL2? (vector) 
(] 1101 SQDMULL, SQDMULL2 (vector) 
1 1001 Unallocated. 

1 1011 Unallocated. 

1 1101 Unallocated. 








Advanced SIMD scalar three same 


This section describes the encoding of the Advanced SIMD scalar three same instruction class. The encodings in 
this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 |1110 9 


| 5 4 


o | 


oao +771 O[sze]i] Rm | oode [i] Rn] Rd 





Decode fields 


Instruction page 


























U size opcode 

= = 00000 Unallocated. 
- - 0001x Unallocated. 
= 2 00100 Unallocated. 
- - Q11xx Unallocated. 
- - 1001x Unallocated. 
- ix 11011 Unallocated. 
o - 00001 SQADD 
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C4.1 A64 instruction set encoding 





Decode fields 


U size opcode 


Instruction page 














































































































o - 00101 SQSUB 

) - 00110 CMGT (register) 
) - 00111 CMGE (register) 
o - 01000 SSHL 

) - 01001 SQSHL (register) 
o - 01010 SRSHL 

o - 01011 SQRSHL 

7) - 10000 ADD (vector) 

o - 10001 CMTST 

o - 10100 Unallocated. 

o - 10101 Unallocated. 

) - 10110 SQDMULH (vector) 
o - 10111 Unallocated. 

O ex 11000 Unallocated. 

O ex 11001 Unallocated. 

O ex 11010 Unallocated. 

o ex 11011 FMULX 

O x 11100 FCMEQ (register) 
O ex 11101 Unallocated. 

O ex 11110 Unallocated. 

) Ox 11111 FRECPS 

O 1x 11000 Unallocated. 

O ix 11001 Unallocated. 

O ix 11010 Unallocated. 

O ix 11100 Unallocated. 

O ix 11101 Unallocated. 

O ix 11110 Unallocated. 

O 1x 11111 FRSQRTS 

1 - 00001 UQADD 

1 - 00101 UQSUB 

1 - 00110 CMHI (register) 
1 - 00111 CMHS (register) 
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C4.1 A64 instruction set encoding 


C4-322 





Decode fields 


U size opcode 


Instruction page 
















































































1 - 01000 USHL 

1 - 01001 UQSHL (register) 
1 - 01010 URSHL 

1 - 01011 UQRSHL 

1 - 10000 SUB (vector) 

1 - 10001 CMEQ (register) 
1 - 10100 Unallocated. 

1 - 10101 Unallocated. 

1 - 10110 SQRDMULH (vector) 
1 - 10111 Unallocated. 

1 0x 11000 Unallocated. 

1 0x 11001 Unallocated. 

1 ex 11010 Unallocated. 

1 0x 11011 Unallocated. 

1 0x 11100 FCMGE (register) 
1 ex 11101 FACGE 

1 0x 11110 Unallocated. 

1 0x 11111 Unallocated. 

1 1x 11000 Unallocated. 

1 1x 11001 Unallocated. 

1 1x 11010 FABD 

1 1x 11100 FCMGT (register) 
1 1x 11101 FACGT 

1 ix 11110 Unallocated. 

1 ix 11111 Unallocated. 











Advanced SIMD scalar shift by immediate 


This section describes the encoding of the Advanced SIMD scalar shift by immediate instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 


page C4-309. 
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|31 30 29 28|27 26 25 24/23 22 1918 16/15 111109 | 5 4| 0 | 


fo ajuin n of mmh | immb | opcode [i] Rn | Rd 





Decode fields 
Instruction page 
U immh opcode 





- '= 0000 00001 nallocated. 





- l= 0000 00011 nallocated. 





- '= 0000 00101 nallocated. 





- '= 0000 00111 nallocated. 





- '= 0000 01001 nallocated. 





- '= 0000 01011 nallocated. 





























U 
U 
U 
U 
U 
U 
- != 0000 01101 Unallocated. 
U 
U 
U 
U 
U 
U 





















































- != 0000 01111 nallocated. 
- l= 0000 101xx nallocated. 
- != 0000 110xx nallocated. 
- != 0000 11101 nallocated. 
- != 0000 11110 nallocated. 
- 0000 - nallocated. 
0 '= 0000 00000 SSHR 
(] '= 0000 00010 SSRA 
0 '= 0000 00100 SRSHR 
0 '= 0000 00110 SRSRA 
0 != 0000 01000 Unallocated. 
0 '= 0000 01010 SHL 
0 '= 0000 01100 Unallocated. 
() l= 0000 01110 SQSHL (immediate) 
0 != 0000 10000 Unallocated. 
0 != 0000 10001 Unallocated. 
0 != 0000 10010 SQSHRN, SQSHRN2 
0 != 0000 10011 SQRSHRN, SQRSHRN2 
Q l= 0000 11100 SCVTF (vector, fixed-point) 
0 != 0000 11111 FCVTZS (vector, fixed-point) 
1 '= 0000 00000 USHR 
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C4.1 A64 instruction set encoding 





Decode fields 
Instruction page 
U immh opcode 















































1 != 0000 00010 USRA 

1 != 0000 00100 URSHR 

1 '= 0000 00110 URSRA 

1 != 0000 01000 SRI 

1 '= 0000 01010 SLI 

1 != 0000 01100 SQSHLU 

1 != 0000 01110 UQSHL (immediate) 

1  !=0000 10000 SQSHRUN, SQSHRUN2 

1  !=0000 10001 SQRSHRUN, SQRSHRUN2 
1  !=0000 10010 UQSHRN, UQSHRN2 

1  !=0000 10011 UQRSHRN, UQRSHRN2 

1 != 0000 11100 UCVTF (vector, fixed-point) 
1 != 0000 11111 FCVTZU (vector, fixed-point) 





Advanced SIMD scalar x indexed element 


This section describes the encoding of the Advanced SIMD scalar x indexed element instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 
page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 | 5 4| 0 | 


fo tfuji 1 1 1 1[sizefLjm| Rm | opcode [njo] Rn | Ra | 





Decode fields , Architecture 
Instruction page 
































U size opcode version 
- =- 0000 Unallocated. - 
- - 0010 Unallocated. - 
- - 0100 Unallocated. - 
- - 0110 Unallocated. - 
- - 1000 Unallocated. - 
- - 1010 Unallocated. - 
- - 1110 Unallocated. - 
- Q1 0001 Unallocated. - 
- Q1 0101 Unallocated. - 
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Decode fields 


Instruction page 


Architecture 




























































































U size opcode version 
- al 1001 Unallocated. - 
) - 0011 SQDMLAL, SQDMLAL2 (by element) - 
o - 0111 SQDMLSL, SQDMLSL2 (by element) - 
o - 1011 SQDMULL, SQDMULL2 (by element) - 
) - 1100 SQDMULH (by element) - 
) - 1101 SQRDMULH (by element) - 
o - 1111 Unallocated. - 
O 0 0001 FMLA (by element) - Scalar, half-precision variant on page C7-1627 Armv8.2 
O 0 0101 FMLS (by element) - Scalar, half-precision variant on page C7-1637 Armv8.2 
O o 1001 FMUL (by element) - Scalar, half-precision variant on page C7-1658 Armv8.2 
O 1x 0001 FMLA (by element) - Scalar, single-precision and double-precision variant on - 
page C7-1627 
O ix 0101 FMLS (by element) - Scalar, single-precision and double-precision variant on - 
page C7-1637 
O ix 1001 FMUL (by element) - Scalar, single-precision and double-precision variant on - 
page C7-1658 
1 - 0011 Unallocated. 7 
1 - 0111 Unallocated. - 
1 - 1011 Unallocated. = 
1 - 1100 Unallocated. = 
1 = 1101 SQRDMLAH (by element) Armv8. 1 
1 - 1111 SQRDMLSH (by element) Armv8. 1 
1 00 0001 Unallocated. - 
1 00 0101 Unallocated. - 
1 00 1001 FMULX (by element) - Scalar, half-precision variant on page C7-1666 Armv8.2 
1 ix 0001 Unallocated. - 
1 ix 0101 Unallocated. - 
1 ix 1001 FMULX (by element) - Scalar, single-precision and double-precision variant on - 


page C7-1666 
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C4-326 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16/15 14 13 121110 9 | 5 4| 0| 


[olafo o 14 1 1 ofo2fo| Rm _ [often fopfo of Rn | Ra | 





Decode fields 


Instruction page 





Unallocated. 





TBL - Single register table variant on page C7-2131 





TBX - Single register table variant on page C7-2133 





TBL - Two register table variant on page C7-2131 





TBX - Two register table variant on page C7-2133 





TBL - Three register table variant on page C7-2131 





TBX - Three register table variant on page C7-2133 





TBL - Four register table variant on page C7-2131 





TBX - Four register table variant on page C7-2133 





op2 len op 
x1 - - 
00 00 (] 
00 00 1 
00 01 ( 
00 01 1 
00 10 ( 
00 10 1 
00 11 Q 
00 11 1 
1x - - 


Unallocated. 





Advanced SIMD permute 


This section describes the encoding of the Advanced SIMD permute instruction class. The encodings in this section 
are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 


12/1110 9 | 5 4| 0 | 


olojo o 4771 O[sze]o] Rm [OJopcode]7 of] Rn | Ro] 
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Decode fields 
Instruction page 


























opcode 

000 Unallocated. 
001 UZPI 

010 TRNI 

011 ZIP1 

100 Unallocated. 
101 UZP2 

110 TRN2 

111 ZIP2 
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Advanced SIMD extract 


This section describes the encoding of the Advanced SIMD extract instruction class. The encodings in this section 
are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20 16|15 14 111109 | 5 4| 0 | 


[olajn o 14 1 1 ofop2fo] Rm fo] imma [of Rn | Ra | 





Decode fields 
Instruction page 











op2 

x1 Unallocated. 
00 EXT 

1x Unallocated. 





Advanced SIMD copy 


This section describes the encoding of the Advanced SIMD copy instruction class. The encodings in this section are 
decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 111109 | 5 4| 0 | 


fofajopfo 111000 of mm5 [o| imma Jit Ran | Ra | 





Decode fields 
Instruction page 









































Q op imm5 imm4 

- - x0000 - Unallocated. 

- () - 0000 DUP (element) 
- Q - 0001 DUP (general) 
- 0 - 0010 Unallocated. 

- 0 - 0100 Unallocated. 

- 0 - 0110 Unallocated. 

- 9 - 1xxx Unallocated. 

o 0 - 0011 Unallocated. 
0 0 - 0101 SMOV 

o 9 - 0111 UMOV 

o 1 - - Unallocated. 

1 0 - 0011 INS (general) 
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Decode fields 


Instruction page 








Q op imm5 imm4 
0 - 0101 SMOV 
0 x1000 0111 UMOV 





INS (element) 





Advanced SIMD three same (FP16) 


This section describes the encoding of the Advanced SIMD three same (FP16) instruction class. The encodings in 
this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


[31 30 29 


28|27 26 25 24|23 22 21 20| 


16|15 14 13 


11109 | 


o| 


olojujo +71 olal o] Rm [0 ojoo] Rn | Ro] 


C4-328 


Decode fields 


Instruction page 


Architecture version 

































































U a opcode 

( © 000 FMAXNM (vector) Armvs.2 
O © 001 FMLA (vector) Armv8.2 
) o 010 FADD (vector) Armv8.2 
o o O11 FMULX Armv8.2 
O © 100 FCMEQ (register) Armv8.2 
o O 101 Unallocated. 

o © 110 FMAX (vector) Armyv8.2 
o o 111 FRECPS Armv8.2 
0 1 000 FMINNM (vector) Armv8.2 
) 1 001 FMLS (vector) Armv8.2 
0 1 010 FSUB (vector) Armv8.2 
O 1 @11 Unallocated. 

O 1 10 Unallocated. 

O 1 101 Unallocated. 

( 1 110 FMIN (vector) Armv8.2 
o 1 111 FRSQRTS Armv8.2 
1 O 000 FMAXNMP (vector) Armv8.2 
1 © 001 Unallocated. 

1 0 010 FADDP (vector) Armv8.2 
1 o 11 FMUL (vector) Armv8.2 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 





Decode fields 


Instruction page 


U a opcode 


Architecture version 









































1 0 100 FCMGE (register) Armv8.2 
1 0 101 FACGE Armv8.2 
1 ® 110 FMAXP (vector) Armv8.2 
1 ðo 111 FDIV (vector) Armv8.2 
1 1 000 FMINNMP (vector) Armvs.2 
1 1 001 Unallocated. - 

1 1 010 FABD Armv8.2 
1 1 @11 Unallocated. - 

1 1 1 FCMGT (register) Armv8.2 
1 1 101 FACGT Armv8.2 
1 1 110 FMINP (vector) Armv8.2 
1 1 i111 Unallocated. - 





Advanced SIMD two-register miscellaneous (FP16) 


This section describes the encoding of the Advanced SIMD two-register miscellaneous (FP 16) instruction class. 
The encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 


page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16| 


12/1110 9 | 


5 4| o| 


ojojujo +77 olain n o o) oode [io] Rn | Rd 





Decode fields 


U a opcode 


Instruction page 


Architecture version 






































- =  0OXXX Unallocated. - 
- -  010xx Unallocated. - 
- -  10xxx Unallocated. - 
- - 11110 Unallocated. - 
- © O1lxx Unallocated. - 
- @ 11111 Unallocated. - 
- 1 11100 Unallocated. - 
) © 11000 FRINTN (vector) Armvs.2 
0 © 11001 FRINTM (vector) Armv8.2 
0 © 11010 FCVTNS (vector) Armv8.2 
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U a opcode 

) © 11011 FCVTMS (vector) Armv8.2 
) © 11100 FCVTAS (vector) Armv8.2 
o © 11101 SCVTF (vector, integer) Armv8.2 
O 1 01100 FCMGT (zero) Armv8.2 
O 1 01101 FCMEQ (zero) Armv8.2 
) 1 01110 FCMLT (zero) Armv8.2 
0 1 01111 FABS (vector) Armv8.2 
O 1 11000 FRINTP (vector) Armv8.2 
O 1 11001 FRINTZ (vector) Armv8.2 
O 1 11010 FCVTPS (vector) Armv8.2 
O 1 11011 FCVTZS (vector, integer) Armv8.2 
O 1 11101 FRECPE Armv8.2 
@ 1 = 11111 Unallocated. - 

1 © 11000 FRINTA (vector) Armv8.2 
1 © 11001 FRINTX (vector) Armv8.2 
1 © 11010 FCVTNU (vector) Armv8.2 
1 © 11011 FCVTMU (vector) Armv8.2 
1 © 11100 FCVTAU (vector) Armv8.2 
1 © 11101 UCVTEF (vector, integer) Armv8.2 
1 1 = 01100 FCMGE (zero) Armv8.2 
1 1 01101 FCMLE (zero) Armv8.2 
1 1 01110 Unallocated. - 

1 1 01111 FNEG (vector) Armv8.2 
1 1 11000 Unallocated. - 

1 1 11001 FRINTI (vector) Armv8.2 
1 1 11010 FCVTPU (vector) Armv8.2 
1 1 = 11011 FCVTZU (vector, integer) Armv8.2 
1 1 11101 FRSQRTE Armv8.2 
1 1 11111 FSQRT (vector) Armv8.2 











Advanced SIMD three same extra 


This section describes the encoding of the Advanced SIMD three same extra instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 
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1 A64 instruction set encoding 


5 4| 0 | 


fo[auo +771 O[szefo[ Rm [1] opcode [i] Rn] Rd 





Decode fields 


U size opcode 


Instruction page 


Architecture version 


















































= - 0011 Unallocated. - 
- =- Q1xx Unallocated. - 
o - 0000 Unallocated. - 
o - 0001 Unallocated. - 
0 - 0010 SDOT (vector) Armv8.2 
o - 1xxx Unallocated. - 
1 - 0000 SQRDMLAH (vector)  Armv8.1 
1 - 0001 SQRDMLSH (vector) Armv8.1 
1 - 0010 UDOT (vector) Armv8.2 
1 - 10xx FCMLA Armv8.3 
1 - 11x0 FCADD Armv8.3 
1 0 1101 Unallocated. - 
1 0 1111 Unallocated. - 
1 ix 1101 Unallocated. - 
1 10 1111 Unallocated. - 








Advanced SIMD two-register miscellaneous 


This section describes the encoding of the Advanced SIMD two-register miscellaneous instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 


page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16| 


12/1110 9 | 


5 4| o| 


[olajujo 1 1 1 ofsize[1 o0 o o of opcode f1 of Rn | Ra | 





Decode fields 


Instruction page 


U size opcode 


Architecture version 














- - 1000x Unallocated. - 
- - 10101 Unallocated. - 
- 0x 011xx Unallocated. - 
- 1x 10111 Unallocated. - 
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- 1x 11110 Unallocated. 

- i 10110 Unallocated. 

o - 00000 REV64 

( - 00001 REV 16 (vector) 

o - 00010 SADDLP 

o - 00011 SUQADD 

) - 00100 CLS (vector) 

o - 00101 CNT 

o - 00110 SADALP 

o - 00111 SQABS 

) - 01000 CMGT (zero) 

0 - 01001 CMEQ (zero) 

( - 01010 CMLT (zero) 

o - 01011 ABS 

o - 10010 XTN, XTN2 

0 - 10011 Unallocated. 

o - 10100 SQXTN, SQXTN2 

o ex 10110 FCVTN, FCVTN2 

Oo ex 10111 FCVTL, FCVTL2 

O ex 11000 FRINTN (vector) 

( Ox 11001 FRINTM (vector) 

O ex 11010 FCVTNS (vector) 

) Ox 11011 FCVTMS (vector) 

0 0x 11100 FCVTAS (vector) 

O x 11101 SCVTF (vector, integer) 
) Ox 11110 FRINT32Z (vector) Armv8s.5 
0 Ox 11111 FRINT64Z (vector) Armvs.5 








0 1x 01100 


FCMGT (zero) 





( 1x 01101 


FCMEQ (zero) 





Q 1x 01110 


FCMLT (zero) 





) 1x 01111 


FABS (vector) 








( 1x 11000 
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Instruction page Architecture version 

U size opcode 

0 1x 11001 FRINTZ (vector) - 

) 1x 11010 FCVTPS (vector) - 

O 1x 11011 FCVTZS (vector, integer) - 

O 1x 11100 URECPE - 

O 1x 11101 FRECPE - 

O 1x 11111 Unallocated. - 

1 - 00000 REV32 (vector) - 

1 - 00001 Unallocated. - 

1 - 00010 UADDLP - 

1 - 00011 USQADD - 

1 - 00100 CLZ (vector) - 

1 - 00110 UADALP - 

Ü, = 00111 SQNEG - 

1 - 01000 CMGE (zero) - 

1 - 01001 CMLE (zero) - 

1 - 01010 Unallocated. - 

1 - 01011 NEG (vector) - 

1 - 10010 SQXTUN, SQXTUN2 - 

1 - 10011 SHLL, SHLL2 - 

1 - 10100 UQXTN, UQXTN2 - 

1 ex 10110 FCVTXN, FCVTXN2 - 

1 0x 10111 Unallocated. - 

1 Ox 11000 FRINTA (vector) - 

1 0x 11001 FRINTX (vector) - 

1 Ox 11010 FCVTNU (vector) - 

1 Ox 11011 FCVTMU (vector) - 

1 0x 11100 FCVTAU (vector) - 

1 0x 11101 UCVTF (vector, integer) - 

1 0x 11110 FRINT32X (vector) Armvs.5 
1 Ox 11111 FRINT64X (vector) Armvs.5 
1 00 00101 NOT - 

1 01 00101 RBIT (vector) - 
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1 1x 00101 Unallocated. - 
1 1x 01100 FCMGE (zero) - 
1 1x 01101 FCMLE (zero) - 
1 1x 01110 Unallocated. - 





1 1x 01111 


FNEG (vector) 





























1 ix 11000 Unallocated. - 
1 1x 11001 FRINTI (vector) - 
1 1x 11010 FCVTPU (vector) - 
1 1x 11011 FCVTZU (vector, integer) - 
1 ix 11100 URSQRTE - 
1 ix 11101 FRSQRTE - 
1 1x 11111 FSQRT (vector) - 
1 10 10110 Unallocated. - 








Advanced SIMD across lanes 


This section describes the encoding of the Advanced SIMD across lanes instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16| 


[olajujo 1 1 1 ofsize{1 1 0 o 0] opcode f1 of Rn | Ra | 


12/1110 9 | 


54| 0| 





Decode fields 


Instruction page 


Architecture version 



































U size opcode 

- - 0000x Unallocated. - 
- - 00010 Unallocated. - 
- - Q01xx Unallocated. - 
- - 0100x Unallocated. - 
- - 01011 Unallocated. - 
- - 01101 Unallocated. 7 
- - 01110 Unallocated. - 
- - 10xxx Unallocated. - 
- - 1100x Unallocated. 7 
- - 111xx Unallocated. 7 
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Instruction page Architecture version 

U size opcode 

0 - 00011 SADDLV é 

0 - 01010 SMAXV = 

0 - 11010 SMINV z 

0 - 11011 ADDV z 

O o 01100 FMAXNMV - Half-precision variant on page C7-1599 Armv8.2 
o 0 01111 FMAXYV - Half-precision variant on page C7-1605 Armv8.2 
o æl 01100 Unallocated. - 

o al 01111 Unallocated. - 

Q 10 01100 FMINNMV - Half-precision variant on page C7-1619 Armv8.2 
o 10 01111 FMINV - Half-precision variant on page C7-1625 Armv8.2 
o i 01100 Unallocated. - 

o n 01111 Unallocated. - 

1 - 00011 UADDLV - 

1 - 01010 UMAXV - 

1 7 11010 UMINV = 

1 - 11011 Unallocated. = 

1 0x 01100 FMAXNMV - Single-precision and double-precision variant on page C7-1599 - 

1 0x 01111 FMAXV - Single-precision and double-precision variant on page C7-1605 - 

1 1x 01100 FMINNMV - Single-precision and double-precision variant on page C7-1619 —- 

1 1x 01111 FMINV - Single-precision and double-precision variant on page C7-1625 - 








Advanced SIMD three different 


This section describes the encoding of the Advanced SIMD three different instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4| 0 | 


fo[auo +771 O[sze]i] Rm | opcode [oo] Rn | Rd 





Decode fields 
Instruction page 











U opcode 
- 1111 Unallocated. 
( 0000 SADDL, SADDL2 
0 0001 SADDW, SADDW2 
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U opcode 

0 0010 SSUBL, SSUBL2 

0 0011 SSUBW, SSUBW2 

0 0100 ADDHN, ADDHN2 

0 0101 SABAL, SABAL2 

0 0110 SUBHN, SUBHN2 

0 0111 SABDL, SABDL2 

0 1000 SMLAL, SMLAL2 (vector) 

0 1001 SQDMLAL, SQDMLAL2 (vector) 
0 1010 SMLSL, SMLSL2 (vector) 

(] 1011 SQDMLSL, SQDMLSL2 (vector) 
0 1100 SMULL, SMULL2 (vector) 

(] 1101 SQDMULL, SQDMULL2 (vector) 
) 1110 PMULL, PMULL2 

1 0000 UADDL, UADDL2 

1 0001 UADDW, UADDW2 

1 0010 USUBL, USUBL2 

1 0011 USUBW, USUBW2 

1 0100 RADDHN, RADDHN2 

1 0101 UABAL, UABAL2 

1 0110 RSUBHN, RSUBHN2 

1 0111 UABDL, UABDL2 

1 1000 UMLAL, UMLAL2 (vector) 

1 1001 Unallocated. 

1 1010 UMLSL, UMLSL2 (vector) 

1 1011 Unallocated. 

1 1100 UMULL, UMULL2 (vector) 

1 1101 Unallocated. 

1 1110 Unallocated. 








Advanced SIMD three same 


This section describes the encoding of the Advanced SIMD three same instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 
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U size opcode 

o - 00000 SHADD - 
0 - 00001 SQADD - 
o - 00010 SRHADD - 
0 - 00100 SHSUB = 
o - 00101 SQSUB - 
i) - 00110 CMGT (register) - 
o - 00111 CMGE (register) - 
0 - 01000 SSHL - 
i) - 01001 SQSHL (register) - 
0 - 01010 SRSHL - 
o - 01011 SQRSHL - 
o - 01100 SMAX - 
o - 01101 SMIN - 
o - 01110 SABD - 
0 = 01111 SABA - 
(/ - 10000 ADD (vector) - 
o - 10001 CMTST - 
(/ - 10010 MLA (vector) - 
0 - 10011 MUL (vector) - 
o - 10100 SMAXP - 
o - 10101 SMINP - 
() - 10110 SQDMULH (vector) - 
0 - 10111 ADDP (vector) - 
O ex 11000 FMAXNM (vector) - 
0 0x 11001 FMLA (vector) - 
() Ox 11010 FADD (vector) - 
o ex 11011 FMULX - 
O ex 11100 FCMEQ (register) - 
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U size opcode 

0 0x 11110 FMAX (vector) - 
( Ox 11111 FRECPS - 
(/ 00 00011 AND (vector) - 
o o 11101 FMLAL, FMLAL2 (vector) - FMLAL variant on page C7-1635 Armv8.2 
o al 00011 BIC (vector, register) - 
o al 11101 Unallocated. - 
() 1x 11000 FMINNM (vector) - 
() 1x 11001 FMLS (vector) - 
( 1x 11010 FSUB (vector) - 
O ix 11011 Unallocated. - 
O ix 11100 Unallocated. - 
0 1x 11110 FMIN (vector) - 
O 1x 11111 FRSQRTS - 
o 10 00011 ORR (vector, register) - 
i) 10 11101 FMLSL, FMLSL2 (vector) - FMLSL variant on page C7-1645 Armv8.2 
v) 11 00011 ORN (vector) - 
o 11 11101 Unallocated. - 
1 - 00000 UHADD = 
1 - 00001 UQADD - 
1 - 00010 URHADD - 
1 - 00100 UHSUB Š 
1 - 00101 UQSUB - 
1 - 00110 CMHI (register) - 
1 - 00111 CMHS (register) - 
1 - 01000 USHL - 
1 - 01001 UQSHL (register) - 
1 - 01010 URSHL - 
1 - 01011 UQRSHL - 
1 - 01100 UMAX 2 
1 = 01101 UMIN - 
1 - 01110 UABD - 
1 7 01111 UABA - 
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U size opcode 

1 - 10000 SUB (vector) - 
1 - 10001 CMEQ (register) - 
1 - 10010 MLS (vector) - 
1 - 10011 PMUL - 
1 - 10100 UMAXP - 
1 - 10101 UMINP - 
1 - 10110 SQRDMULH (vector) - 
1 - 10111 Unallocated. - 
1 0x 11000 FMAXNMP (vector) - 
1 Ox 11010 FADDP (vector) - 
1 0x 11011 FMUL (vector) - 
1 0x 11100 FCMGE (register) - 
1 ex 11101 FACGE - 
1 0x 11110 FMAXP (vector) - 
1 Ox 11111 FDIV (vector) - 
1 00 00011 EOR (vector) - 
1 00 11001 FMLAL, FMLAL2 (vector) - FMLAL2 variant on page C7-1635 =Armv8.2 
1 01 00011 BSL = 
1 01 11001 Unallocated. Š 
1 1x 11000 FMINNMP (vector) - 
dl 1x 11010 FABD = 
1 1x 11011 Unallocated. - 
1 ix 11100 FCMGT (register) - 
1 1x 11101 FACGT = 
al 1x 11110 FMINP (vector) - 
1 ix 11111 Unallocated. - 
1 10 00011 BIT - 
1 10 11001 FMLSL, FMLSL2 (vector) - FMLSL2 variant on page C7-1645 Armv8.2 
1 11 00011 BIF = 
1 il 11001 Unallocated. - 
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Advanced SIMD modified immediate 


This section describes the encoding of the Advanced SIMD modified immediate instruction class. The encodings 
in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 


12/1110 9 8|7 6 5 4| 


o| 


oloo 77770000 ofajeje] omode foal Jaje [ilor] Ra 
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Instruction page 


Architecture version 



















































































Q op cmode 02 

- 0 Oxxx 1 Unallocated. - 

- 0 Oxxd 0 MOVI - 32-bit shifted immediate variant on page C7-1828 - 

- 0 Oxx1 0 ORR (vector, immediate) - 32-bit variant on page C7-1845 - 

- 0 10xx 1 Unallocated. - 

- 0 10x0 0 MOVI - 16-bit shifted immediate variant on page C7-1828 - 

- 0 10x1 0 ORR (vector, immediate) - 16-bit variant on page C7-1845 - 

- 0 110x 0 MOVI - 32-bit shifting ones variant on page C7-1828 - 

- 0 110x 1 Unallocated. - 

- 0 1110 0 MOVI - 8-bit variant on page C7-1828 - 

- 0 1110 1 Unallocated. = 

- 0 1111 0 FMOV (vector, immediate) - Single-precision variant on page C7-1647 - 

- 0 1111 1 FMOV (vector, immediate) - Half-precision variant on page C7-1647 Armv8.2 

- 1 - 1 Unallocated. - 

- 1 Oxxd 0 MVNI - 32-bit shifted immediate variant on page C7-1836 - 

- 1 Oxx1 0 BIC (vector, immediate) - 32-bit variant on page C7-1393 - 

- 1 10x0 0 MVNI - 16-bit shifted immediate variant on page C7-1836 - 

- 1 10x1 0 BIC (vector, immediate) - 76-bit variant on page C7-1393 - 

- 1 110x 0 MVNI - 32-bit shifting ones variant on page C7-1836 - 

0 1 1110 0 MOVI - 64-bit scalar variant on page C7-1828 - 

® 1 1111 0 Unallocated. 7 

1 1 1110 0 MOVI - 64-bit vector variant on page C7-1828 - 

1 1 1111 0 FMOV (vector, immediate) - Double-precision variant on page C7-1647 - 
Advanced SIMD shift by immediate 
This section describes the encoding of the Advanced SIMD shift by immediate instruction class. The encodings in 
this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 
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|31 30 29 28|27 26 25 24|23 22 11918 16/15 11109 | 5 4| 0 | 
immh 
Decode fields 
Instruction page 
U opcode 
- 00001 Unallocated. 
- 00011 Unallocated. 
- 00101 Unallocated. 
- 00111 Unallocated. 
- 01001 Unallocated. 
- 01011 Unallocated. 
- 01101 Unallocated. 
- 01111 Unallocated. 
- 10101 Unallocated. 
- 1011x Unallocated. 
- 110xx Unallocated. 
- 11101 Unallocated. 
- 11110 Unallocated. 
0 00000 SSHR 
0 00010 SSRA 
0 00100 SRSHR 
0 00110 SRSRA 
0 01000 Unallocated. 
0 01010 SHL 
0 01100 Unallocated. 
i) 01110 SQSHL (immediate) 
0 10000 SHRN, SHRN2 
0 10001 RSHRN, RSHRN2 
0 10010 SQSHRN, SQSHRN2 
0 10011 SQRSHRN, SQRSHRN2 
0 10100 SSHLL, SSHLL2 
i) 11100 SCVTF (vector, fixed-point) 
0 11111 FCVTZS (vector, fixed-point) 
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U opcode 

1 00000 USHR 

1 00010 USRA 

1 00100 URSHR 

1 00110 URSRA 

1 01000 SRI 

1 01010 SLI 

1 01100 SQSHLU 

1 01110 UQSHL (immediate) 

1 10000 SQSHRUN, SQSHRUN2 

1 10001 SQRSHRUN, SQRSHRUN2 
1 10010 UQSHRN, UQSHRN2 

1 10011 UQRSHRN, UQRSHRN2 

Ï 10100 USHLL, USHLL2 

1 11100 UCVTF (vector, fixed-point) 
1 11111 FCVTZU (vector, fixed-point) 








Advanced SIMD vector x indexed element 


This section describes the encoding of the Advanced SIMD vector x indexed element instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 
page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 | 5 4| 0 | 


fo[auyo 171 [szejm] Rm | opcode Jajo] Rn | Rd 





Decode fields Architecture 
Instruction page 























U size opcode version 
- 01 1001 Unallocated. - 
() - 0010 SMLAL, SMLAL2 (by element) - 
o - 0011 SQDMLAL, SQDMLAL2 (by element) - 
) - 0110 SMLSL, SMLSL2 (by element) - 
i) - 0111 SQDMLSL, SQDMLSL2 (by element) - 
o - 1000 MUL (by element) - 
0 - 1010 SMULL, SMULL2 (by element) - 
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Architecture 














































































































U size opcode version 
o - 1011 SQDMULL, SQDMULL2 (by element) - 
i) - 1100 SQDMULH (by element) - 
i) - 1101 SQRDMULH (by element) - 
() - 1110 SDOT (by element) Armv8s.2 
o ex 0000 Unallocated. - 
® ex 0100 Unallocated. - 
O 0 0001 FMLA (by element) - Vector, half-precision variant on page C7-1628 Armv8.2 
O 0 0101 FMLS (by element) - Vector, half-precision variant on page C7-1638 Armv8.2 
Oo 0 1001 FMUL (by element) - Vector, half-precision variant on page C7-1659 Armv8.2 
Oo 0 1111 Unallocated. - 
o al 0001 Unallocated. - 
o al 0101 Unallocated. - 
O ix 0001 FMLA (by element) - Vector, single-precision and double-precision variant on - 
page C7-1628 
O ix 0101 FMLS (by element) - Vector, single-precision and double-precision variant on - 
page C7-1638 
O ix 1001 FMUL (by element) - Vector, single-precision and double-precision variant on - 
page C7-1659 
i) 10 0000 FMLAL, FMLAL2 (by element) - FMLAL variant on page C7-1633 Armv8.2 
o 10 0100 FMLSL, FMLSL2 (by element) - FMLSL variant on page C7-1643 Armv8.2 
o 10 1111 Unallocated. z 
o 11 0000 Unallocated. 7 
o 11 0100 Unallocated. - 
1 - 0000 MLA (by element) - 
1 - 0010 UMLAL, UMLAL2 (by element) - 
1 - 0100 MLS (by element) - 
l> - 0110 UMLSL, UMLSL2 (by element) - 
1 - 1010 UMULL, UMULL2 (by element) - 
l- - 1011 Unallocated. - 
1 - 1101 SQRDMLAH (by element) Armv8. 1 
1 - 1110 UDOT (by element) Armv8s.2 
1 - 1111 SQRDMLSH (by element) Armvs. | 
1 0x 1000 Unallocated. - 
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U size opcode version 
1 0x 1100 Unallocated. - 
1 00 0001 Unallocated. = 
1 00 0011 Unallocated. z 
1 00 0101 Unallocated. = 
1 00 0111 Unallocated. 2 
1 00 1001 FMULX (by element) - Vector, half-precision variant on page C7-1667 Armv8.2 
1 01 Oxx1 FCMLA (by element) Armv8.3 
1 1x 1001 FMULX (by element) - Vector, single-precision and double-precision variant on - 
page C7-1667 
1 10 Oxx1 FCMLA (by element) Armv8.3 
1 10 1000 FMLAL, FMLAL2 (by element) - FMLAL2 variant on page C7-1633 Armv8.2 
1 10 1100 FMLSL, FMLSL2 (by element) - FMLSL2 variant on page C7-1643 Armv8.2 
1 1 0001 Unallocated. - 
1 11 0011 Unallocated. - 
1 1 0101 Unallocated. - 
1 11 0111 Unallocated. = 
1 1 1000 Unallocated. - 
1 11 1100 Unallocated. - 
Cryptographic three-register, imm2 
This section describes the encoding of the Cryptographic three-register, imm2 instruction class. The encodings in 
this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 
|31 30 29 28|27 26 25 24/23 22 21 20 16/15 14 13 1211110 9 | 5 4| 0| 
11001110010| Rm [i ofimm2| | Rn | Ra | 
E opcode 
Decode fields 
Instruction page Architecture version 
opcode 
00 SM3TT1A Armv8.2 
01 SM3TT1B Armv8.2 
10 SM3TT2A Armv8.2 
11 SM3TT2B Armv8.2 
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Cryptographic three-register SHA 512 
This section describes the encoding of the Cryptographic three-register SHA 512 instruction class. The encodings 
in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9 | 5 4| 0| 


1100111001 1| Rm [Jijofoo] | Rmh | R | 
goc 





Decode fields 
Instruction page Architecture version 


























O opcode 

0 00 SHA512H Armv8.2 
0 01 SHA512H2 Armv8.2 
0 10 SHA512SU1 Armv8.2 
() 11 RAX1 Armv8.2 
1 00 SM3PARTWI1 Armv8.2 
1 01 SM3PARTW2 Armv8.2 
1 10 SM4EKEY Armv8.2 
1 11 Unallocated. - 








Cryptographic four-register 


This section describes the encoding of the Cryptographic four-register instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


31 sac 20| 16|15 14 | 109 5 4| 0 | 


CG, TE E 


Decode fields 
Instruction page Architecture version 














Op0 

00 EOR3 Armv8.2 
01 BCAX Armv8.2 
10 SM3SS1 Armv8.2 
11 Unallocated. - 





Cryptographic two-register SHA 512 


This section describes the encoding of the Cryptographic two-register SHA 512 instruction class. The encodings in 
this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 
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Decode fields 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 


Tioo7Ti0770000007000/ | Rk | R | 
E 


0| 





Decode fields 


Instruction page Architecture version 











opcode 

00 SHA512SU0 Armv8.2 
01 SM4E Armv8.2 
1x Unallocated. - 





Conversion between floating-point and fixed-point 


This section describes the encoding of the Conversion between floating-point and fixed-point instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 
page C4-309. 


|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 | 109 5 4| 


TOGO ae | ae a 


Instruction page 


Architecture 









































sf S ptype rmode opcode scale version 
- - - - 1xx - Unallocated. 7 
- - - x0 00x - Unallocated. z 
- - - x1 01x - Unallocated. - 
- - - Ox 00x - Unallocated. S 
- - - 1x 01x - Unallocated. - 
z - 10 e - = Unallocated. z 
Z F e = - - Unallocated. z 
() - - - - Oxxxxx Unallocated. - 
0 O 0 00 010 - SCVTF (scalar, fixed-point) - 32-bit to single-precision —- 
variant on page C7-1892 
0 O 00 00 011 - UCVTF (scalar, fixed-point) - 32-bit to single-precision  - 
variant on page C7-2163 
0 O 0 11 000 - FCVTZS (scalar, fixed-point) - Single-precision to - 
32-bit variant on page C7-1566 
0 O 00 11 001 - FCVTZU (scalar, fixed-point) - Single-precision to - 
32-bit variant on page C7-1576 
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Decode fields | 
Instruction page Architecture 




































































version 

sf S ptype rmode opcode scale 

() o 1 00 010 - SCVTF (scalar, fixed-point) - 32-bit to - 
double-precision variant on page C7-1892 

(2 o æl 00 011 - UCVTE (scalar, fixed-point) - 32-bit to - 
double-precision variant on page C7-2163 

0 o al 11 000 - FCVTZS (scalar, fixed-point) - Double-precision to - 
32-bit variant on page C7-1566 

0 o æl 11 001 - FCVTZU (scalar, fixed-point) - Double-precision to - 
32-bit variant on page C7-1576 

) o 11 00 010 - SCVTF (scalar, fixed-point) - 32-bit to half-precision Armv8.2 
variant on page C7-1892 

0 o n 00 011 - UCVTF (scalar, fixed-point) - 32-bit to half-precision Armv8.2 
variant on page C7-2163 

) o i121 11 000 - FCVTZS (scalar, fixed-point) - Half-precision to 32-bit | Armv8.2 
variant on page C7-1566 

0 o 11 11 001 - FCVTZU (scalar, fixed-point) - Half-precision to 32-bit Armv8.2 
variant on page C7-1576 

1 O 00 00 010 - SCVTF (scalar, fixed-point) - 64-bit to single-precision - 
variant on page C7-1892 

1 O 00 00 011 - UCVTF (scalar, fixed-point) - 64-bit to single-precision  - 
variant on page C7-2163 

1 O 2 11 000 - FCVTZS (scalar, fixed-point) - Single-precision to - 
64-bit variant on page C7-1566 

1 O 00 11 001 - FCVTZU (scalar, fixed-point) - Single-precision to - 
64-bit variant on page C7-1576 

1 o æl 00 010 - SCVTF (scalar, fixed-point) - 64-bit to - 
double-precision variant on page C7-1892 

1 o æl 00 011 - UCVTF (scalar, fixed-point) - 64-bit to - 
double-precision variant on page C7-2163 

1 o al 11 000 - FCVTZS (scalar, fixed-point) - Double-precision to - 
64-bit variant on page C7-1566 

1 o æl 11 001 - FCVTZU (scalar, fixed-point) - Double-precision to - 
64-bit variant on page C7-1576 

1 o i121 00 010 - SCVTF (scalar, fixed-point) - 64-bit to half-precision Armv8.2 
variant on page C7-1892 

1 o n 00 011 - UCVTF (scalar, fixed-point) - 64-bit to half-precision Armv8.2 
variant on page C7-2163 

1 o i121 11 000 - FCVTZS (scalar, fixed-point) - Half-precision to 64-bit | Armv8.2 
variant on page C7-1566 

1 o n 11 001 - FCVTZU (scalar, fixed-point) - Half-precision to 64-bit Armv8.2 
variant on page C7-1576 
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Decode fields 


Conversion between floating-point and integer 


This section describes the encoding of the Conversion between floating-point and integer instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 
page C4-309. 


|31 30 29 28|27 26 25 24|23 22 2120/1918  16/15141312/11109 | 5 4| 


0| 


loje 1 1 1 O[ptype] 1 }modd opcode[0 0 0 0 0o 0o) Rn | Ro | 


Instruction page 


Architecture 






























































version 

sf S ptype rmode opcode i 

- - - x1 01x Unallocated. - 

- - =- x1 10x Unallocated. - 

- - - 1x 01x Unallocated. - 

- - =- 1x 10x Unallocated. - 

- o 10 - Oxx Unallocated. - 

- O 10 - 10x Unallocated. - 

- 1 - - - Unallocated. - 

) O 0 x1 11x Unallocated. - 

Q O 0 00 000 FCVTNS (scalar) - Single-precision to 32-bit variant on - 
page C7-1541 

0 O 0 00 001 FCVTNU (scalar) - Single-precision to 32-bit variant on - 
page C7-1546 

0 O 0 00 010 SCVTF (scalar, integer) - 32-bit to single-precision variant on - 
page C7-1894 

Q O 0 00 011 UCVTF (scalar, integer) - 32-bit to single-precision variant on - 
page C7-2165 

0 O 0 00 100 FCVTAS (scalar) - Single-precision to 32-bit variant on - 
page C7-1517 

Q O 0 00 101 FCVTAU (scalar) - Single-precision to 32-bit variant on - 
page C7-1522 

) O 0 00 110 FMOV (general) - Single-precision to 32-bit variant on - 
page C7-1651 

Q O 0 00 111 FMOV (general) - 32-bit to single-precision variant on - 
page C7-1651 

) O 0 01 000 FCVTPS (scalar) - Single-precision to 32-bit variant on - 
page C7-1551 

0 O 0 01 001 FCVTPU (scalar) - Single-precision to 32-bit variant on - 
page C7-1556 

0 O 0 1x 11x Unallocated. - 
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Decode fields 


Instruction page 


Architecture 




































































version 
sf S ptype rmode opcode rsio 
0 O 0 10 000 FCVTMS (scalar) - Single-precision to 32-bit variant on - 
page C7-1529 
0 O 0 10 001 FCVTMU (scalar) - Single-precision to 32-bit variant on - 
page C7-1534 
Q O 0 11 000 FCVTZS (scalar, integer) - Single-precision to 32-bit variant on - 
page C7-1568 
) O 0 11 001 FCVTZU (scalar, integer) - Single-precision to 32-bit variant on - 
page C7-1578 
Q o al Ox 11x Unallocated. - 
( o 1 00 000 FCVTNS (scalar) - Double-precision to 32-bit variant on - 
page C7-1541 
) o 1 00 001 FCVTNU (scalar) - Double-precision to 32-bit variant on - 
page C7-1546 
0 o al 00 010 SCVTF (scalar, integer) - 32-bit to double-precision variant on - 
page C7-1894 
0 o al 00 011 UCVTF (scalar, integer) - 32-bit to double-precision variant on - 
page C7-2165 
Q o al 00 100 FCVTAS (scalar) - Double-precision to 32-bit variant on - 
page C7-1517 
) o æl 00 101 FCVTAU (scalar) - Double-precision to 32-bit variant on - 
page C7-1522 
) o 1 01 000 FCVTPS (scalar) - Double-precision to 32-bit variant on - 
page C7-1551 
) o æl 01 001 FCVTPU (scalar) - Double-precision to 32-bit variant on - 
page C7-1556 
) o æl 10 000 FCVTMS (scalar) - Double-precision to 32-bit variant on - 
page C7-1529 
) o æl 10 001 FCVTMU (scalar) - Double-precision to 32-bit variant on - 
page C7-1534 
0 o al 10 11x Unallocated. - 
0 o al 11 000 FCVTZS (scalar, integer) - Double-precision to 32-bit variant on - 
page C7-1568 
0 o al 11 001 FCVTZU (scalar, integer) - Double-precision to 32-bit variant on - 
page C7-1578 
o o al 11 110 FJCVTZS Armv8.3 
0 o al 11 111 Unallocated. - 
0 o 10 - 11x Unallocated. - 
0 o 1 00 000 FCVTNS (scalar) - Half-precision to 32-bit variant on Armv8.2 
page C7-1541 
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Instruction page 


Architecture 

































































version 

sf S ptype rmode opcode 

Q o i121 00 001 FCVTNU (scalar) - Half-precision to 32-bit variant on Armv8.2 
page C7-1546 

0 o i121 00 010 SCVTF (scalar, integer) - 32-bit to half-precision variant on Armv8.2 
page C7-1894 

Q o i121 00 011 UCVTF (scalar, integer) - 32-bit to half-precision variant on Armv8.2 
page C7-2165 

) o i121 00 100 FCVTAS (scalar) - Half-precision to 32-bit variant on Armv8.2 
page C7-1517 

0 o 11 00 101 FCVTAU (scalar) - Half-precision to 32-bit variant on Armv8.2 
page C7-1522 

) ®@ i121 00 110 FMOV (general) - Half-precision to 32-bit variant on Armv8.2 
page C7-1651 

0 o 11 00 111 FMOV (general) - 32-bit to half-precision variant on page C7-1651 = Armvé8.2 

0 o i121 01 000 FCVTPS (scalar) - Half-precision to 32-bit variant on Armv8.2 
page C7-1551 

0 ®@ 11 01 001 FCVTPU (scalar) - Half-precision to 32-bit variant on Armv8.2 
page C7-1556 

Q o i121 10 000 FCVTMS (scalar) - Half-precision to 32-bit variant on Armv8.2 
page C7-1529 

0 ®@ 11 10 001 FCVTMU (scalar) - Half-precision to 32-bit variant on Armv8.2 
page C7-1534 

0 o i121 11 000 FCVTZS (scalar, integer) - Half-precision to 32-bit variant on Armv8.2 
page C7-1568 

) o i121 11 001 FCVTZU (scalar, integer) - Half-precision to 32-bit variant on Armv8.2 
page C7-1578 

il O 0 - 11x Unallocated. - 

ik O 0 00 000 FCVTNS (scalar) - Single-precision to 64-bit variant on - 
page C7-1541 

ii O 0 00 001 FCVTNU (scalar) - Single-precision to 64-bit variant on - 
page C7-1546 

1 O 0 00 010 SCVTF (scalar, integer) - 64-bit to single-precision variant on - 
page C7-1894 

1 O 0 00 011 UCVTF (scalar, integer) - 64-bit to single-precision variant on - 
page C7-2165 

T O 0 00 100 FCVTAS (scalar) - Single-precision to 64-bit variant on - 
page C7-1517 

1 O 0 00 101 FCVTAU (scalar) - Single-precision to 64-bit variant on - 
page C7-1522 

1 O 20 01 000 FCVTPS (scalar) - Single-precision to 64-bit variant on - 
page C7-1551 

C4-350 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


A64 Instruction Set Encoding 
C4.1 A64 instruction set encoding 





Decode fields : 
Instruction page Architecture 

































































version 

sf S ptype rmode opcode erso 

1 O 0 01 001 FCVTPU (scalar) - Single-precision to 64-bit variant on - 
page C7-1556 

a O 0 10 000 FCVTMS (scalar) - Single-precision to 64-bit variant on - 
page C7-1529 

1 O 0 10 001 FCVTMU (scalar) - Single-precision to 64-bit variant on - 
page C7-1534 

1 O 0 11 000 FCVTZS (scalar, integer) - Single-precision to 64-bit variant on - 
page C7-1568 

1 O 0 11 001 FCVTZU (scalar, integer) - Single-precision to 64-bit variant on - 
page C7-1578 

1 o al x1 11x Unallocated. - 

1 o 1 00 000 FCVTNS (scalar) - Double-precision to 64-bit variant on - 
page C7-1541 

1 o æl 00 001 FCVTNU (scalar) - Double-precision to 64-bit variant on - 
page C7-1546 

1 o al 00 010 SCVTF (scalar, integer) - 64-bit to double-precision variant on - 
page C7-1894 

1 o al 00 011 UCVTF (scalar, integer) - 64-bit to double-precision variant on - 
page C7-2165 

1 o æl 00 100 FCVTAS (scalar) - Double-precision to 64-bit variant on - 
page C7-1517 

1 o al 00 101 FCVTAU (scalar) - Double-precision to 64-bit variant on - 
page C7-1522 

T o al 00 110 FMOV (general) - Double-precision to 64-bit variant on - 
page C7-1652 

il o al 00 111 FMOV (general) - 64-bit to double-precision variant on - 
page C7-1651 

1 o 1 01 000 FCVTPS (scalar) - Double-precision to 64-bit variant on - 
page C7-1551 

1 o æl 01 001 FCVTPU (scalar) - Double-precision to 64-bit variant on - 
page C7-1556 

1 o al 1x 11x Unallocated. - 

1 o 1 10 000 FCVTMS (scalar) - Double-precision to 64-bit variant on - 
page C7-1529 

1 o æl 10 001 FCVTMU (scalar) - Double-precision to 64-bit variant on - 
page C7-1534 

1 o al 11 000 FCVTZS (scalar, integer) - Double-precision to 64-bit variant on - 
page C7-1568 

1 o al 11 001 FCVTZU (scalar, integer) - Double-precision to 64-bit variant on - 
page C7-1578 
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Decode fields 


Instruction page 


Architecture 



























































version 
sf ptype rmode opcode 
1 10 x0 11x Unallocated. - 
L 10 01 110 FMOV (general) - Top half of 128-bit to 64-bit variant on - 
page C7-1652 
1 10 01 111 FMOV (general) - 64-bit to top half of 128-bit variant on - 
page C7-1651 
1 10 1x 11x Unallocated. - 
a 11 00 000 FCVTNS (scalar) - Half-precision to 64-bit variant on Armv8.2 
page C7-1541 
1 11 00 001 FCVTNU (scalar) - Half-precision to 64-bit variant on Armv8.2 
page C7-1546 
ab 11 00 010 SCVTF (scalar, integer) - 64-bit to half-precision variant on Armv8.2 
page C7-1894 
1 11 00 011 UCVTF (scalar, integer) - 64-bit to half-precision variant on Armv8.2 
page C7-2165 
1 11 00 100 FCVTAS (scalar) - Half-precision to 64-bit variant on Armv8s.2 
page C7-1517 
ii 11 00 101 FCVTAU (scalar) - Half-precision to 64-bit variant on Armv8.2 
page C7-1522 
a 11 00 110 FMOV (general) - Half-precision to 64-bit variant on Armv8.2 
page C7-1651 
1 11 00 111 FMOV (general) - 64-bit to half-precision variant on page C7-1651 Armv8.2 
ab 11 01 000 FCVTPS (scalar) - Half-precision to 64-bit variant on Armv8.2 
page C7-1551 
1 11 01 001 FCVTPU (scalar) - Half-precision to 64-bit variant on Armv8.2 
page C7-1556 
1 11 10 000 FCVTMS (scalar) - Half-precision to 64-bit variant on Armv8s.2 
page C7-1529 
ii 11 10 001 FCVTMU (scalar) - Half-precision to 64-bit variant on Armv8.2 
page C7-1534 
1 11 11 000 FCVTZS (scalar, integer) - Half-precision to 64-bit variant on Armv8.2 
page C7-1568 
1 11 11 001 FCVTZU (scalar, integer) - Half-precision to 64-bit variant on Armv8.2 
page C7-1578 
Floating-point data-processing (1 source) 
This section describes the encoding of the Floating-point data-processing (1 source) instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 
page C4-309. 
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|31 30 29 28|27 26 25 24/23 22 21 20| 151413 1211110 9 | 


5 4| 


[M[O[S[1 11 1 opwel] oos [70000] Rn | Ro | 





Decode fields 


M S ptype opcode 


Instruction page 


Architecture version 































































































- - =- 1xXXXX Unallocated. - 
- 1 - - Unallocated. - 
0 0 2 000000 FMOV (register) - Single-precision variant on page C7-1649 - 
0 O 00 000001 FABS (scalar) - Single-precision variant on page C7-1450 - 
0 O 00 000010 FNEG (scalar) - Single-precision variant on page C7-1675 - 
0 O 00 000011 FSQRT (scalar) - Single-precision variant on page C7-1743 - 
o O 200 000100 Unallocated. - 
0 O 00 000101 FCVT - Single-precision to double-precision variant on page C7-1512  - 
0 O 00 000110 Unallocated. - 
0 O 00 000111 FCVT - Single-precision to half-precision variant on page C7-1512 - 
0 0 00 001000 FRINTN (scalar) - Single-precision variant on page C7-1721 - 
0 O 00 001001 FRINTP (scalar) - Single-precision variant on page C7-1725 - 
0 O 2 001010 FRINTM (scalar) - Single-precision variant on page C7-1717 - 
0 O 00 001011 FRINTZ (scalar) - Single-precision variant on page C7-1733 - 
0 O 00 001100 FRINTA (scalar) - Single-precision variant on page C7-1709 - 
0 O 00 001101 Unallocated. - 
0 O 00 001110 FRINTX (scalar) - Single-precision variant on page C7-1729 - 
0 0 00 001111 FRINTI (scalar) - Single-precision variant on page C7-1713 - 
0 O 00 010000 FRINT32Z (scalar) - Single-precision variant on page C7-1697 Armvs.5 
0 O 2 010001 FRINT32X (scalar) - Single-precision variant on page C7-1693 Armv8.5 
0 O 00 010010 FRINT64Z (scalar) - Single-precision variant on page C7-1705 Armv8.5 
() 0 00 010011 FRINT64X (scalar) - Single-precision variant on page C7-1701 Armv8.5 
0 O 2 0101xx Unallocated. - 
0 O 00 011xxx Unallocated. - 
0 o 1 000000 FMOV (register) - Double-precision variant on page C7-1649 - 
0 o 1 000001 FABS (scalar) - Double-precision variant on page C7-1450 - 
0 o 1 000010 FNEG (scalar) - Double-precision variant on page C7-1675 - 
0 o 1 000011 FSQRT (scalar) - Double-precision variant on page C7-1743 - 


ARM DDI 0487E.a 
ID070919 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


C4-353 


A64 Instruction Set Encoding 


C4.1 A64 instruction set encoding 





Decode fields 


Instruction page 


Architecture version 























































































































M S ptype opcode 

0 o 1 000100 FCVT - Double-precision to single-precision variant on page C7-1512 - 

o o a 000101 Unallocated. - 

0 o 1 000111 FCVT - Double-precision to half-precision variant on page C7-1512 - 

0 o 1 001000 FRINTN (scalar) - Double-precision variant on page C7-1721 - 

0 o 1 001001 FRINTP (scalar) - Double-precision variant on page C7-1725 - 

0 o 1 001010 FRINTM (scalar) - Double-precision variant on page C7-1717 - 

0 o 1 001011 FRINTZ (scalar) - Double-precision variant on page C7-1733 - 

0 o 1 001100 FRINTA (scalar) - Double-precision variant on page C7-1709 - 

0 o 1 001101 Unallocated. - 

0 o 1 001110 FRINTX (scalar) - Double-precision variant on page C7-1729 - 

0 o 1 001111 FRINTI (scalar) - Double-precision variant on page C7-1713 - 

0 o 1 010000 FRINT32Z (scalar) - Double-precision variant on page C7-1697 Armvs8.5 
0 o 1 010001 FRINT32X (scalar) - Double-precision variant on page C7-1693 Armv8.5 
0 o 1 010010 FRINT64Z (scalar) - Double-precision variant on page C7-1705 Armv8.5 
0 o 1 010011 FRINT64X (scalar) - Double-precision variant on page C7-1701 Armv8.5 
0 o 1 0101xx Unallocated. - 

0 o 1 011xxx Unallocated. - 

0 o 10 OXXXXX Unallocated. - 

0 o 11 000000 FMOV (register) - Half-precision variant on page C7-1649 Armv8.2 
0 o 1 000001 FABS (scalar) - Half-precision variant on page C7-1450 Armv8.2 
0 o 11 000010 FNEG (scalar) - Half-precision variant on page C7-1675 Armv8.2 
0 o 11 000011 FSQRT (scalar) - Half-precision variant on page C7-1743 Armv8.2 
0 o 11 000100 FCVT - Half-precision to single-precision variant on page C7-1512 - 

0 o 11 000101 FCVT - Half-precision to double-precision variant on page C7-1512 - 

0 o 11 00011x Unallocated. - 

0 o 11 001000 FRINTN (scalar) - Half-precision variant on page C7-1721 Armv8.2 
0 o 11 001001 FRINTP (scalar) - Half-precision variant on page C7-1725 Armv8.2 
Q o 11 001010 FRINTM (scalar) - Half-precision variant on page C7-1717 Armv8.2 
0 o 1 001011 FRINTZ (scalar) - Half-precision variant on page C7-1733 Armv8.2 
0 o 1 001100 FRINTA (scalar) - Half-precision variant on page C7-1709 Armv8.2 
0 o 11 001101 Unallocated. - 

0 o 11 001110 FRINTX (scalar) - Half-precision variant on page C7-1729 Armv8.2 
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Decode fields 


Instruction page 


Architecture version 











M S ptype opcode 

0 o 11 001111 FRINTI (scalar) - Half-precision variant on page C7-1713 Armv8.2 
0 o 11 01xxxx Unallocated. - 

1 - =- - Unallocated. - 
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Floating-point compare 


This section describes the encoding of the Floating-point compare instruction class. The encodings in this section 


are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24|23 22 21 20| 


16|15 14 13 12|11 10 9 


5 4| 


OTS a a e Tp [oe 





Decode fields 


M S ptype op opcode2 


Instruction page 


Architecture version 

































































- - =- - xxxx1 Unallocated. - 
- - =- - xxx1x Unallocated. - 
- - =- - xx1xx Unallocated. - 
- - - xl - Unallocated. - 
z ey a% 1x - Unallocated. = 
z - 10 = - Unallocated. - 
- 1 - - - Unallocated. - 
o O 00 00 00000 FCMP - 
o O 00 00 01000 FCMP - 
o O 00 00 10000 FCMPE - 
o O 00 00 11000 FCMPE - 
o o a 00 00000 FCMP - 
o o al 00 01000 FCMP - 
o o a 00 10000 FCMPE - 
o o al 00 11000 FCMPE - 
0 o n 00 00000 FCMP Armv8.2 
0 o u 00 01000 FCMP Armv8.2 
0 o n 00 10000 FCMPE Armv8.2 
o o n 00 11000 FCMPE Armv8.2 
1 - - - - Unallocated. - 
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Floating-point immediate 


This section describes the encoding of the Floating-point immediate instruction class. The encodings in this section 
are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20| | 1312\11109 | 5 4| 0 | 


[M[O[S[1 111 ofpe] mms [10 0] mm | Ro | 





Decode fields 
Instruction page Architecture version 
M S ptype imm5 






























































- - - xxxxl Unallocated. - 
- - - xxxlx Unallocated. - 
- - - xxlxx Unallocated. - 
- - - xlxxx Unallocated. - 
- - - 1xxxx Unallocated. - 
- - 10 - Unallocated. - 
- 1 - - Unallocated. - 
) o 00 00000 FMOV (scalar, immediate) - Single-precision variant on page C7-1654 - 
) o æl 00000 FMOV (scalar, immediate) - Double-precision variant on page C7-1654 - 
Q o 11 00000 FMOV (scalar, immediate) - Half-precision variant on page C7-1654 Armv8.2 
1 - - - Unallocated. - 
Floating-point conditional compare 
This section describes the encoding of the Floating-point conditional compare instruction class. The encodings in 
this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 12/1110 9 | 5 4|3 0 | 
Decode fields 
Instruction page Architecture version 
M S ptype op 
- - 10 - Unallocated. - 
- 1 - - Unallocated. - 
i) 0 00 (] FCCMP - Single-precision variant on page C7-1470 - 
0 o 00 1 FCCMPE - Single-precision variant on page C7-1472 - 
0 o l 0 FCCMP - Double-precision variant on page C7-1470 - 
0 o l 1 FCCMPE - Double-precision variant on page C7-1472 - 
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Decode fields 


Instruction page 


Architecture version 











M S ptype op 

0 o 11 Q FCCMP - Half-precision variant on page C7-1470 Armv8.2 
0 o 11 1 FCCMPE - Half-precision variant on page C7-1472 Armv8.2 
1 - =- - Unallocated. - 





Floating-point data-processing (2 source) 


This section describes the encoding of the Floating-point data-processing (2 source) instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 


page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 


[Mjo|s|1_ 1 1 1 Ofptype]1] Rm | opcode [1 of Rn | Ra | 


5 4| 0| 





Decode fie 


Ids 


M S ptype opcode 


Instruction page 


Architecture version 

































































- - = 1xx1 Unallocated. - 
- - - 1x1x Unallocated. - 
- - - 11xx Unallocated. - 
- - 10 - Unallocated. - 
- 1 - - Unallocated. - 
0 0 20 0000 FMUL (scalar) - Single-precision variant on page C7-1664 - 
0 0 0 0001 FDIV (scalar) - Single-precision variant on page C7-1582 - 
0 o 0 0010 FADD (scalar) - Single-precision variant on page C7-1462 - 
0 0 0 0011 FSUB (scalar) - Single-precision variant on page C7-1747 - 
0 o 0 0100 FMAX (scalar) - Single-precision variant on page C7-1589 - 
0 0 0 0101 FMIN (scalar) - Single-precision variant on page C7-1609 - 
0 o 2 0110 FMAXNM (scalar) - Single-precision variant on page C7-1593 - 
0 o 20 0111 FMINNM (scalar) - Single-precision variant on page C7-1613 - 
0 0 0 1000 FNMUL (scalar) - Single-precision variant on page C7-1681 - 
0 o æl 0000 FMUL (scalar) - Double-precision variant on page C7-1664 - 
0 o æl 0001 FDIV (scalar) - Double-precision variant on page C7-1582 - 
0 o 1 0010 FADD (scalar) - Double-precision variant on page C7-1462 - 
0 o æl 0011 FSUB (scalar) - Double-precision variant on page C7-1747 - 
0 o æl 0100 FMAX (scalar) - Double-precision variant on page C7-1589 - 
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C4-358 





Decode fie 


Ids 


M S&S ptype opcode 


Instruction page 


Architecture version 


















































0 o æl 0101 FMIN (scalar) - Double-precision variant on page C7-1609 - 
0 o æl 0110 FMAXNM (scalar) - Double-precision variant on page C7-1593  - 
0 o æl 0111 FMINNM (scalar) - Double-precision variant on page C7-1613 - 
0 o æl 1000 FNMUL (scalar) - Double-precision variant on page C7-1681 - 
0 o 1 0000 FMUL (scalar) - Half-precision variant on page C7-1664 Armv8.2 
0 o 1 0001 FDIV (scalar) - Half-precision variant on page C7-1582 Armv8.2 
0 o 1 0010 FADD (scalar) - Half-precision variant on page C7-1462 Armv8.2 
0 o 1 0011 FSUB (scalar) - Half-precision variant on page C7-1747 Armv8.2 
0 o 1 0100 FMAX (scalar) - Half-precision variant on page C7-1589 Armv8.2 
0 o 11 0101 FMIN (scalar) - Half-precision variant on page C7-1609 Armv8.2 
0 o 1 0110 FMAXNM (scalar) - Half-precision variant on page C7-1593 Armv8.2 
0 o 11 0111 FMINNM (scalar) - Half-precision variant on page C7-1613 Armv8.2 
0 o 1 1000 FNMUL (scalar) - Half-precision variant on page C7-1681 Armv8.2 
1 - - - Unallocated. - 





Floating-point conditional select 


This section describes the encoding of the Floating-point conditional select instruction class. The encodings in this 
section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 


Mpole 171 opwel] Rm | cond [1 a] Rn] Rd 


5 4| 0 | 





Decode fields 


Instruction page 


Architecture version 




















M S  ptype 

- 10 Unallocated. - 

- - Unallocated. - 

0 00 FCSEL - Single-precision variant on page C7-1510 - 

Q 01 FCSEL - Double-precision variant on page C7-1510 - 

0 11 FCSEL - Half-precision variant on page C7-1510 Armv8.2 
1 - Unallocated. - 
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Floating-point data-processing (3 source) 


This section describes the encoding of the Floating-point data-processing (3 source) instruction class. The 
encodings in this section are decoded from Data Processing -- Scalar Floating-Point and Advanced SIMD on 
page C4-309. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 


GO EE a | 


Decode fields 





















































Instruction page Architecture version 

M S ptype o1 00 

- - 10 - - Unallocated. - 

- 1 - - - Unallocated. - 

0 O 00 i) i) FMADD - Single-precision variant on page C7-1585 - 

) O 00 i) 1 FMSUB - Single-precision variant on page C7-1656 - 

0 O 00 1 0 FNMADD - Single-precision variant on page C7-1677 - 

( O 2 1 1 FNMSUB - Single-precision variant on page C7-1679 - 

Q o æl 0 0 FMADD - Double-precision variant on page C7-1585 - 

0 o l 0 1 FMSUB - Double-precision variant on page C7-1656 - 

Q o al 1 0 FNMADD - Double-precision variant on page C7-1677  - 

0 o al 1 1 FNMSUB - Double-precision variant on page C7-1679 - 

0 ®@ n 0 0 FMADD - Half-precision variant on page C7-1585 Armv8.2 

0 o i121 0 1 FMSUB - Half-precision variant on page C7-1656 Armv8.2 

0 o 11 1 i) FNMADD - Half-precision variant on page C7-1677 Armv8.2 

0 o i121 1 1 FNMSUB - Half-precision variant on page C7-1679 Armv8.2 

1 =- - - - Unallocated. =- 
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This chapter describes the A64 System instruction class, and the System instruction class encoding space, that is a 
subset of the System registers encoding space. It contains the following sections: 


The System instruction class encoding space on page C5-362. 
Special-purpose registers on page C5-374. 

A64 System instructions for cache maintenance on page C5-459, 
A64 System instructions for address translation on page C5-520. 
A64 System instructions for TLB maintenance on page C5-543. 
A64 System instructions for prediction restriction on page CS5-739. 


See General information about the A64 instruction descriptions on page C2-185 for information about entries used 
in the instruction encoding descriptions. 
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C5.1 The System instruction class encoding space 


Part of the A64 instruction encoding space is assigned to instructions that access the System register encoding space. 
These instructions provide: 


e Access to System registers, including the debug registers, that provide system control, and system status 
information. 


° Access to Special-purpose registers such as SPSR_ELx, ELR_ELx, and the equivalent fields of the Process 


State. 
e The cache and TLB maintenance instructions and address translation instructions. 
° Barriers and the CLREX instruction. 
° Architectural hint instructions. 


This section describes the general model for accessing this functionality. 





Note 


s See Fixed values in AArch64 instruction and System register descriptions on page C2-185 for information 
about abbreviations used in the System instruction descriptions. 


. In AArch32 state much of this functionality is provided through the System register interface described in 
The AArch32 System register interface on page G1-5567. In AArch64 state, the parameters used to 
characterize the System register encoding space are {opQ, 0p1, CRn, CRm, op2}. These are based on the 
parameters that characterize the AArch32 System register encoding space, which reflect the original 
implementation of these registers, as described in Background to the System register interface on 
page G1-5568. In Armv8, there is no particular significance to the naming of these parameters, and no 
functional distinction between the opn parameters and the CRx parameters. 





Principles of the System instruction class encoding describes some general properties of these encodings. System 
instruction class encoding overview on page C5-363 then describes the top-level encoding of these instructions, and 
the following sections then describe the next level of the encoding hierarchy of System instructions and 
Special-purpose registers: 

. op0==0b00, architectural hints, barriers and CLREX, and PSTATE access on page C5-364. 

. op0==0b01, cache maintenance, TLB maintenance, and address translation instructions on page C5-366. 
. op0==0b11, Moves to and from Special-purpose registers on page C5-372. 


For the description of the next level of encoding hierarchy of System registers, see: 

. op0==0b10, Moves to and from debug and trace System registers on page D12-2801. 

. op0==0b11, Moves to and from non-debug System registers, Special-purpose registers on page D12-2803. 
. Reserved encodings for IMPLEMENTATION DEFINED registers on page D12-2815. 


C5.1.1 Principles of the System instruction class encoding 


In Armv8, an encoding in the System instruction space is identified by a set of arguments, {0p0, op1, CRn, CRm, op2}. 
These form an encoding hierarchy, where: 


opd Defines the top-level division of the encoding space, see System instruction class encoding overview 
on page C5-363. 

op1 Identifies the lowest Exception level at which the encoding is accessible, as follows: 
Accessible at ELO op1 has the value 3. 


Accessible at EL1 op1 has the value 0, 1, or 2. The value is the same as the op1 value used to 
access the equivalent AArch32 register. 


Accessible at EL2 op1 has the value 4. 
Accessible at EL3 op1 has the value 6. 
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Arm strongly recommends that implementers adopt this use of op1 when using the IMPLEMENTATION DEFINED 
regions of the encoding space described in Reserved encodings for IMPLEMENTATION DEFINED registers on 
page D12-2815. 


C5.1.2 System instruction class encoding overview 


The encoding of the System instruction class describes each instruction as being either: 
s A transfer to a System register. This is a System instruction with the semantics of a write. 
$ A transfer from a System register. This is a System instruction with the semantics of a read. 


A System instruction that initiates an operation operates as if it was making a transfer to a register. 
In the AArch64 instruction set, the decode structure for the System instruction class is: 


31 30 29 28 27 26 25 24 23 22 21 20 1918 1615 12 11 5 4 


ToT oT oT 0 oL] of | om | cfm | ae [a 


The value of L indicates the transfer direction: 
0 Transfer to System register. 
1 Transfer from System register. 


The op@ field is the top level encoding of the System instruction type. Its possible values are: 


0b0ð These encodings provide: 
$ Instructions with an immediate field for accessing PSTATE, the current PE state. 
° The architectural hint instructions. 
° Barriers and the CLREX instruction. 


For more information about these encodings, see op0==0b00, architectural hints, barriers and 
CLREX, and PSTATE access on page C5-364. 


0b01 These encodings provide the cache maintenance, TLB maintenance, and address translation 
instructions. 


Note 
These are equivalent to operations in the AArch32 (coproc==0b1111) encoding space. 





For more information, see op0==0b01, cache maintenance, TLB maintenance, and address 
translation instructions on page C5-366. 


0b10 These encodings provide moves to and from: 
° Legacy AArch32 System registers for execution environments, to provide access to these 
registers from higher Exception levels that are using AArch64. 
° Debug and trace registers. 
Note 





These are equivalent to the registers in the AArch32 (coproc==0b1110) encoding space. 


For more information, see op0==0b10, Moves to and from debug and trace System registers on 
page D12-2801. 





Qb11 These encodings provide: 
. Moves to and from Non-debug System registers. The accessed registers provide system 
control, and system status information. 
Note 


The accessed registers are equivalent to the registers in the AArch32 (coproc==0b1111) 
encoding space. 





. Access to Special-purpose registers. 
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C5.1.3 


C5-364 


For more information, see /nstructions for accessing Special-purpose registers on page C5-372 and 
Instructions for accessing non-debug System registers on page D12-2803. 


UNDEFINED behaviors 
In the System register instruction encoding space, the following principles apply: 
od All unallocated encodings are treated as UNDEFINED. 


° All encodings with L==1 and op0==0b0x are UNDEFINED, except for encodings in the area reserved for 
IMPLEMENTATION DEFINED use, see Reserved encodings for IMPLEMENTATION DEFINED registers on 


page D12-2815. 


For registers and operations that are accessible from a particular Exception level, any attempt to access those 
registers from a lower Exception level is UNDEFINED. 


If a particular Exception level: 


è Defines a register to be RO, then any attempt to write to that register, at that Exception level, is UNDEFINED. 
This means that any access to that register with L==0 is UNDEFINED. 


$ Defines a register to be WO, then any attempt to read from that register, at that Exception level, is UNDEFINED. 
This means that any access to that register with L==1 is UNDEFINED. 


For IMPLEMENTATION DEFINED encoding spaces, the treatment of the encodings is IMPLEMENTATION DEFINED, but 
see the recommendation in Principles of the System instruction class encoding on page C5-362. 


op0==0b00, architectural hints, barriers and CLREX, and PSTATE access 


The different groups of System register instructions with op0==0b00: 
° Are identified by the value of CRn. 
è Are always encoded with a value of 0b11111 in the Rt field. 


The encoding of these instructions is: 


31 30 29 28 27 26 25 24 23 22 21 20 1918 1615 12 11 8 
Pero rere ole op et | om | ome Ter TTT 
op0 


The encoding of the CRn field is as follows: 


0b0010 See Architectural hint instructions. 
0b0011 See Barriers and CLREX on page C5-365. 
0b0100 See Instructions for accessing the PSTATE fields on page C5-366. 


Architectural hint instructions 


Within the op0==0b00 encodings, the architectural hint instructions are identified by CRn having the value 0b0010. The 
encoding of these instructions is: 


31 30 29 28 27 26 25 24 23 22 21201918 1615 1211 5 4 0 
110101010 ojojo ojo 11/0010 Op<6:0> 11111 
op0 op1 CRn CRm op2 Rt 


The value of op<6:0>, formed by concatenating the CRm and op2 fields, determines the hint instruction as follows: 
0b0000000 NOP instruction. 

0b0000001 YIELD instruction. 

0b0000010 WFE instruction. 

0b0000011 WFI instruction. 

0b0000100 SEV instruction. 

0b0000101 SEVL instruction. 
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0b0000110-0b0001111 
Unallocated values. These encodings behave as NOPs. 
0b0010000 ESB instruction. 
0b0010001 PSB CSYNC instruction. 
0b0010010 TSB CSYNC instruction. 
0b0010011-0b1111111 
Unallocated values. These encodings behave as NOPs. 


These instructions are described in Chapter C6 464 Base Instruction Descriptions. 





Note 
è Instruction encodings with bits[4:0] not set to 0b11111 are UNDEFINED. 
. The operation of the A64 instructions for architectural hints are identical to the corresponding A32 and T32 
instructions. 





For more information about: 
: The WFE, WFI, SEV, and SEVL instructions, see Mechanisms for entering a low-power state on page D1-2372. 
a The YIELD instruction, see Software control features and ELO on page B1-104. 


Barriers and CLREX 


Within the op0==0b00 encodings, the barriers and CLREX instructions are identified by CRn having the value 0b0011. 
The encoding of these instructions is: 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 a 15 2 1 
I EEE EEKE 
op0 op1 CRn Rt 


The value of op2 determines the instruction, as follows. 


0b010 CLREX instruction. 
0b100 DSB instruction. 
0b101 DMB instruction. 
0b110 ISB instruction. 
0b000, 0b001, 0b011, 0b111 
UNDEFINED. 


These instructions are described in Chapter C6 464 Base Instruction Descriptions. 





Note 
x Instruction encodings with bits[4:0] not set to 0b11111 are UNDEFINED. 
7 The operation of the A64 instructions for barriers and CLREX are identical to the corresponding A32 and T32 
instructions. 





For more information about: 


a The barrier instructions, see Memory barriers on page B2-124. 
7 The CLREX instruction, see Synchronization and semaphores on page B2-156. 
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C5.1.4 


C5-366 


Instructions for accessing the PSTATE fields 


Within the op0==0b00 encodings, the instructions that can be used to modify PSTATE fields directly are identified 
by CRn having the value @b0100. The encoding of these instructions is: 


31 30 29 28 27 26 25 24 23 2221201918 1615 12 11 
a a 
op0 CRn CRm Rt 


These instructions are: 


CFINV ; Inverts the value of PSTATE.C 

MSR DAIFSet, #Imm4 ; Used to set any or all of DAIF to 1 

MSR DAIFCIr, #Imm4 ; Used to clear any or all of DAIF to 0 

MSR SPSel, #Imm4 ; Used to select the Stack Pointer, between SP_EL@ and SP_ELx 
MSR UAO, #Imm4 ; Used to set the value of PSTATE.UAO 


MSR PAN, #Imm4 ; Used to set the value of PSTATE.PAN 


The value of op2 selects the instruction form, which defines the constraints on the values of the op1 and Imm4 
arguments, as follows: 


op2==0b000 Selects the CFINV instruction. 
op2==0b011 Selects the MSR UAO instruction. 
op2==0b100 Selects the MSR PAN instruction. 
op2==0b101 Selects the MSR SPSel instruction. 


op2==0b110 Selects the MSR DAIFSet instruction, that sets the specified PSTATE. {D, A, I, F} bits to 1. 








op2==0b111 Selects the MSR DAIFCir instruction, that clears the specified PSTATE. {D, A, I, F} bits to 0. 


All other combinations of op1 and op2 are reserved, and the corresponding instructions are UNDEFINED. 


Note 
For PSTATE updates, instruction encodings with bits[4:0] not set to 0b11111 are UNDEFINED. 








Writes to PSTATE. {PAN, D, A, I, F} occur in program order without the need for additional synchronization. 
Changing PSTATE.SPSel to use SP_ELO synchronizes any updates to SP_ELO that have been written by an MSR to 
SP_ELO, without the need for additional synchronization. 


op0==0b01, cache maintenance, TLB maintenance, and address translation instructions 


The System instructions are encoded with op0==0b01. The different groups of System instructions are identified by 
the values of CRn and CRm, except that some of this encoding space is reserved for IMPLEMENTATION DEFINED 
functionality. The encoding of these instructions is: 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 16 15 12 11 8 
ior oT O10 oooi of | om | om a a J 
op0 
The grouping of these instructions depending on the CRn and CRm fields is as follows: 
CRn==7 The instruction group is determined by the value of CRm, as follows: 
CRm=={1, 5} Instruction cache maintenance instructions. 
See Cache maintenance instructions, and data cache zero operation on 
page C5-367. 
CRn== Prediction restriction instructions. 


See Prediction restriction instructions on page C5-368. 


CRn== Data cache zero operation. 
See Cache maintenance instructions, and data cache zero operation on 
page C5-367. 
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CRn=={6, 10, 11, 12, 14} 
Data cache maintenance instructions. 
See Cache maintenance instructions, and data cache zero operation. 
CRm== See Address translation instructions on page C5-368. 
CRn== See TLB maintenance instructions on page C5-369. 
CRn=={11, 15} See Reserved encoding space for IMPLEMENTATION DEFINED instructions on page C5-371. 


Cache maintenance instructions, and data cache zero operation 


Table C5-1 lists the Cache maintenance instructions and their encodings. Instructions that take an argument include 
Xt in the instruction syntax. For instructions that do not take an argument, the Xt field is encoded as 0b11111. For 
these instructions, if the Xt field is not set to 0b11111, it is CONSTRAINED UNPREDICTABLE whether: 


. The instruction is UNDEFINED. 


. The instruction behaves as if the Xt field is set to 0b11111. 


Table C5-1 Cache maintenance instructions and data cache zero operation 





Access instruction encoding 
Instruction Notes 
op0 op1 CRn CRm op2 





Instruction cache maintenance instructions 








IC IALLUIS 1 0 7 1 0 Accessible from EL! or higher. 
IC IALLU 5 0 
IC IVAU, Xt 3 7 5 1 When SCTLR_EL1.UCI = 1, accessible from ELO or higher. Otherwise, 


accessible from EL1 or higher. 





Data cache maintenance instructions 











DCIVAC, Xt 1 0 7 6 1 Accessible from EL1 or higher. 

DC ISW, Xt 2 

DC CSW, Xt 10 2 

DC CISW, Xt 14 2 

DC CVAC, Xt 3 7 10 1 When SCTLR_EL1.UCI == 1, accessible from ELO or higher. Otherwise, 
ae eae ~~~ accessible from EL1 or higher. 

DC CVAU, Xt 11 1 

DC CVAP, Xt 12 1 

DC CIVAC, Xt 14 1 





Data cache zero operation 





DC ZVA, Xt 1 3 7 4 1 When SCTLR_EL1.DZE== 1, accessible from ELO or higher. Otherwise, 
accessible from EL1 or higher. 





For more information about these instructions, see About cache maintenance in AArch64 state on page D4-2478 and 
A64 Cache maintenance instructions on page D4-2482. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C5-367 
ID070919 Non-Confidential 


The A64 System Instruction Class 
C5.1 The System instruction class encoding space 


Prediction restriction instructions 


Table C5-2 lists the Prediction restriction instructions and their encodings. Instructions that take an argument 


include Xt in the instruction syntax. 


Table C5-2 Prediction restriction instructions 





Prediction restriction encoding 

















Instruction Notes 
op0 opi CRn CRm op2 
CFP RCTX, Xt 1 3 7 3 4 When ARMv8.0-PredInv is 
implemented, accessible from 
CPP RCTX, Xt 5 ELO or higher. 
DVP RCTX, Xt T 





For more information about these instructions, see Execution and data prediction restriction System instructions on 


page D4-2494. 


Address translation instructions 


Table C5-3 lists the Address translation instructions and their encodings. The syntax of the instructions includes Xt, 
that provides the address to be translated. 


Table C5-3 Address translation instructions 





Access instruction encoding 
















































































Instruction Notes 
op0 opi CRn CRm op2 
AT SIEIR, Xt 1 0 T 8 0 Accessible from EL1 or higher. 
AT SIEIW, Xt 1 
AT S1EOR, Xt 2 
AT S1EOW, Xt 3 
AT SIEIRP, Xt 9 0 
AT SIEIWP, Xt 1 
AT S1E2R, Xt 4 7 8 0 Accessible from EL2 or higher. 
AT S1E2W, Xt 1 
AT S12E1R, Xt 4 
AT S12E1W, Xt 5 
AT S12E0R, Xt 6 
AT S12E0W, Xt I 
AT SIE3R, Xt 6 7 8 0 Accessible only from EL3. 
AT SIE3W, Xt 1 





For more information about these instructions, see Address translation instructions on page D5-2561. 
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TLB maintenance instructions 


Table C5-4 lists the TLB maintenance instructions and their encodings. Instructions that take an argument include 
Xt in the instruction syntax. For instructions that do not take an argument, the Xt field is encoded as 0b11111. For 
these instructions, if the Xt field is not set to 0b11111, it is CONSTRAINED UNPREDICTABLE whether: 


. The instruction is UNDEFINED. 


° The instruction behaves as if the Xt field is set to 0b11111. 


Table C5-4 TLB maintenance instructions 















































































































































Access instruction encoding Notes 
Instruction 
op0 opi CRn CRm op2 

TLBI VMALLEIOS, Xt 1 0 8 1 0 Accessible from EL1 or higher. 
TLBI VAEIOS, Xt 1 

TLBI ASIDEIOS, Xt 2 

TLBI VAAEIOS, Xt 3 

TLBI VALEIOS, Xt 5 

TLBI VAALEIOS, Xt 7 

TLBI RVAEHLS, Xt 2 1 

TLBI RVAAEIIS, Xt 3 

TLBI RVALEIS, Xt 5 

TLBI RVAALEI1IS, Xt 7 

TLBI VMALLEIIS 3 0 

TLBI VAEIS, Xt 1 

TLBI ASIDEIS, Xt 2 

TLBI VAAEIS, Xt 3 

TLBI VALEIS, Xt 5 

TLBI VAALEIIS, Xt 7 

TLBI RVAEIOS, Xt 5 1 

TLBI RVAAEIOS, Xt 3 

TLBI RVALEIOS, Xt 5 

TLBI RVAALEIOS, Xt 7 

TLBI RVAE1, Xt 6 1 

TLBI RVAAEI, Xt 3 

TLBI RVALE1, Xt 5 

TLBI RVAALE1, Xt 7 

TLBI VMALLE1 7 0 

TLBI VAE1, Xt 1 
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Table C5-4 TLB maintenance instructions (continued) 










































































































































































Access instruction encoding Notes 
Instruction 
op0 opi CRn CRm op2 

TLBI ASIDE], Xt 1 0 8 T 2 Accessible from EL1 or higher. 
TLBI VAAE1, Xt 3 
TLBI VALE1, Xt 5 
TLBI VAALE1, Xt 7 
TLBIIPAS2EIUS, Xt 4 8 0 1 Accessible from EL2 or higher. 
TLBI RIPAS2E1IS, Xt 2 
TLBI IPAS2LE1IS, Xt 5 
TLBI RIPAS2LEIIS, Xt 6 
TLBI ALLE2OS 1 0 
TLBI VAE20S, Xt 1 
TLBI ALLE1OS 4 
TLBI VALE20S, Xt 5 
TLBI VMALLS12E10S 6 
TLBI RVAE2IS, Xt 2 1 
TLBI RVALEZ2IS, Xt > 
TLBI ALLEZ2IS 3 0 
TLBI VAEZ2IS, Xt 1 
TLBI ALLEIIS 4 
TLBI VALEZ2IS, Xt 5 
TLBI VMALLS12E1IS 6 
TLBIIPAS2E10S, Xt 4 0 
TLBI IPAS2E1, Xt 1 
TLBI RIPAS2E1, Xt 2 
TLBI RIPAS2E10S, Xt 3 
TLBI IPAS2LEIOS, Xt 4 
TLBIIPAS2LE1, Xt 5 
TLBI RIPAS2LE1, Xt 6 
TLBI RIPAS2LEI1OS, Xt 7 
TLBI RVAE20OS, Xt 5 1 
TLBI RVALE20S, Xt 5 
TLBI RVAE2, Xt 6 1 
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Table C5-4 TLB maintenance instructions (continued) 














































































































Access instruction encoding Notes 
Instruction 
op0 opi CRn CRm op2 
TLBI RVALE2, Xt 1 4 8 6 5 Accessible from EL2 or higher. 
TLBI ALLE2 7 0 
TLBI VAE2, Xt 1 
TLBI ALLE1 4 
TLBI VALE2, Xt 5 
TLBI VMALLS12E1 6 
TLBI ALLE308S 6 8 1 0 Accessible only from EL3. 
TLBI VAE30S, Xt 1 
TLBI VALE30S, Xt 5 
TLBI RVAE3IS, Xt 2 1 
TLBI RVALE3IS, Xt 5 
TLBI ALLE3IS 3 0 
TLBI VAE3IS, Xt 1 
TLBI VALE3IS, Xt 5 
TLBI RVAE30S, Xt 5 1 
TLBI RVALE30S, Xt 5 
TLBI RVAE3, Xt 6 1 
TLBI RVALE3, Xt 5 
TLBI ALLE3 7 0 
TLBI VAE3, Xt 1 
TLBI VALE3, Xt 5 





For more information about these instructions, see TLB maintenance instructions on page D5-2641. 


Reserved encoding space for IMPLEMENTATION DEFINED instructions 


The A64 instruction set reserves the following encoding space for IMPLEMENTATION DEFINED instructions: 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 me zi 5 4 
rroTeroTo oo i of ffxii) om | >a 
op0 CRn 


The value of L defines the use of Rt as follows: 
0 Rt is an argument supplied to the instruction. 
1 Rt is a result returned by the instruction. 


IMPLEMENTATION DEFINED instructions in this encoding space are accessed using the SYS and SYSL instructions, see 
SYS on page C6-1337 and SYSL on page C6-1339. 
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See also Reserved encodings for IMPLEMENTATION DEFINED registers on page D12-2815. 



































C5.1.5 op0==0b11, Moves to and from Special-purpose registers 
The instructions that move data to and from non-debug System registers are encoded with op0==0b11, except that 
some of this encoding space is reserved for IMPLEMENTATION DEFINED functionality. The encoding of these 
instructions is: 
31 30 29 28 27 26 25 24 23 22 21 Z = 18 — B 12 L 
TroTororT oot i] m | om | om [os] a4 
op0 
Instructions for accessing Special-purpose registers 
The value of CRn provides the next level of decode of these instructions. For Special-purpose registers, the value of 
CRn is 4. 
The A64 instructions for accessing Special-purpose registers are: 
MSR <Special-purpose register>, Xt ; Write to Special-purpose register 
MRS Xt, <Special-purpose register> ; Read from Special-purpose register 
For these accesses, CRn has the value 4. The encoding for Special-purpose register accesses is: 
31 30 29 28 27 26 25 24 23 22 21 20 19 18 16 15 12 11 8 7 5 4 
TiTT DTS Teo a on toto ol ca fae | 
op0 CRn 
The full list of Special-purpose registers is in Table C5-5. The characteristic of a Special-purpose register is that all 
direct and indirect reads and writes to the register appear to occur in program order relative to other instructions, 
without the need for any explicit synchronization. 
Table C5-5 lists the encodings for op1, CRm, and op2 fields for accesses to the Special-purpose registers in AArch64. 
Table C5-5 Special-purpose register accesses 
Access instruction encoding 
Register Notes 
op0 opi CRn CRm op2 
SPSR_EL1 3 0 4 0 0 Accessible from EL1 or higher 
ELR_EL1 1 
SP_ELO 1 0 Accessible from EL1 or higher. If SP_ELO is the current stack pointer 
then the access is UNDEFINED. 
SPSel 2 0 Accessible from EL1 or higher. 
CurrentEL 2 RO. Accessible from EL1 or higher. 
PAN 3 Accessible from EL1 or higher. 
UAO 4 
NZCV 3 4 2 0 Accessible from ELO or higher. 
DAIF 1 Configurable whether accesses at ELO are permitted. 
DIT > Accessible from ELO or higher. 
SSBS 6 
TCO 7 
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Table C5-5 Special-purpose register accesses (continued) 





Access instruction encoding 
Register Notes 
op0 opt CRn CRm op2 





























FPCR 3 3 4 4 0 Accessible from ELO or higher. 

FPSR 1 

DSPSR_ELO 5 0 Accessible only in Debug state, from ELO or higher. 

DLR_ELO 1 

SPSR_EL2 4 4 0 0 Accessible from EL2 or higher. 

ELR_EL2 1 

SP_EL1 1 0 

SPSR_irq 3 0 

SPSR_abt 1 

SPSR_und 2 

SPSR_fiq 3 

* EL12 5 4 {0-15} {0-7} Reserved for EL2 aliases of EL1 Special-purpose registers, see 
Table D5-48 on page D5-2614. 

SPSR_EL3 6 4 0 0 Accessible from EL3 or higher. 

ELR_EL3 1 

SP_EL2 1 0 





All direct and indirect reads and writes to Special-purpose registers appear to occur in program order relative to 
other instructions. 
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Special-purpose registers 


This section describes the following Special-purpose registers: 
CurrentEL, that holds PSTATE.EL, and that software can read to determine the current Exception level. 


DAIF, that holds the current PSTATE. {D, A, I, F} interrupt mask bits. 

DIT, that holds the PSTATE.DIT bit. 

ELR_EL1, that holds the address to return to for an exception return from EL1. 
ELR_EL2, that holds the address to return to for an exception return from EL2. 
ELR_EL3, that holds the address to return to for an exception return from EL3. 
FPCR, that provides control of floating-point operation. 

FPSR, that provides floating-point status information. 

NZCV, that holds the PSTATE. {N, Z, C, V} condition flags. 

PAN, that holds the PSTATE.PAN state bit. 

SP_ELO, that holds the stack pointer for ELO. 

SP_EL1, that holds the stack pointer for EL1. 

SP_EL2, that holds the stack pointer for EL2. 

SP_EL3, that holds the stack pointer for EL3. 

SPSel, that holds PSTATE.SP, that at EL1 or higher selects the current SP. 
SPSR_abt, that holds process state on taking an exception to AArch32 Abort mode. 
SPSR_EL1, that holds process state on taking an exception to AArch64 EL1. 
SPSR_EL2, that holds process state on taking an exception to AArch64 EL2. 
SPSR_EL3, that holds process state on taking an exception to AArch64 EL3. 
SPSR_fiq, that holds process state on taking an exception to AArch32 FIQ mode. 
SPSR_irq, that holds process state on taking an exception to AArch32 IRQ mode. 


SPSR_und, that holds process state on taking an exception to AArch32 Undefined mode. 


SSBS, that holds the PSTATE.SSBS bit. 
TCO, that holds the PSTATE.TCO bit. 
UAO, that holds the PSTATE.UAO bit. 


The following registers are also Special-purpose registers: 


DLR_ELO, that holds the address to return to for a return from Debug state. 


DSPSR_ELO, that holds process state on entry to Debug state. 
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C5.2.1 CurrentEL, Current Exception Level 


The CurrentEL characteristics are: 


Purpose 
Holds the current Exception level. 

Configurations 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


CurrentEL is a 64-bit register. 


Field descriptions 


The CurrentEL bit assignments are: 


63 43210 


Bits [63:4] 
Reserved, RESO. 
EL, bits [3:2] 


Current Exception level. Possible values of this field are: 


Oboe ELO 
QbO1 EL1 
0b10 EL2 
Qb11 EL3 


When the HCR_EL2.NV bit is 1, EL1 read accesses to the CurrentEL register return the value of 
0b10 in this field. 


This field resets to the highest implemented Exception Level. 


Bits [1:0] 


Reserved, RESO. 


Accessing the CurrentEL 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CurrentEL 








op0 op1 CRn CRm op2 
0b11 0b000 0b0100 0b0010 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
return Zeros(60):'10':Zeros(2); 
else 


return Zeros(6Q):PSTATE.EL:Zeros(2); 
elsif PSTATE.EL == EL2 then 
return Zeros(6Q):PSTATE.EL:Zeros(2); 
elsif PSTATE.EL == EL3 then 
return Zeros(6Q):PSTATE.EL:Zeros(2); 
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Purpose 
Allows access to the interrupt mask bits. 

Configurations 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


DAIF is a 64-bit register. 


Field descriptions 


The DAIF bit assignments are: 


63 109 87 65 0 


RESO fafie RESO 


Bits [63:10] 


Reserved, RESO. 


D, bit [9] 
Process state D mask. The possible values of this bit are: 
Qbd Watchpoint, Breakpoint, and Software Step exceptions targeted at the current Exception 

level are not masked. 
Qb1 Watchpoint, Breakpoint, and Software Step exceptions targeted at the current Exception 
level are masked. 

When the target Exception level of the debug exception is higher than the current Exception level, 
the exception is not masked by this bit. 
This field resets to 1. 

A, bit [8] 
SError interrupt mask bit. The possible values of this bit are: 
Qbd Exception not masked. 
Qb1 Exception masked. 
This field resets to 1. 

I, bit [7] 
IRQ mask bit. The possible values of this bit are: 
Qbd Exception not masked. 
Qb1 Exception masked. 
This field resets to 1. 

F, bit [6] 
FIQ mask bit. The possible values of this bit are: 
Qbd Exception not masked. 
Qb1 Exception masked. 
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This field resets to 1. 


Bits [5:0] 


Reserved, RESO. 


Accessing the DAIF 


For details on the operation of the MSR (immediate) accessor, see MSR (immediate) in the Arm® Architecture 
Reference Manual, Armv8, for Armv8-A architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DAIF 





op0 op1 CRn CRm op2 





0b11 0b011 0b0100 0b0010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && ((EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') || SCTLR_EL1.UMA == '@') then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
return Zeros(54):PSTATE.<D,A,I,F>:Zeros(6); 
elsif PSTATE.EL == EL1 then 
return Zeros(54):PSTATE.<D,A,1I,F>:Zeros(6); 
elsif PSTATE.EL == EL2 then 
return Zeros(54):PSTATE.<D,A,1I,F>:Zeros(6); 
elsif PSTATE.EL == EL3 then 
return Zeros(54):PSTATE.<D,A,1I,F>:Zeros(6); 


MSR DAIF, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b0100 0b0010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && ((EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') || SCTLR_EL1.UMA == '@') then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
PSTATE.<D,A,I,F> = X[t]<9:6>; 
elsif PSTATE.EL == EL1 then 
PSTATE.<D,A,I,F> = X[t]<9:6>; 
elsif PSTATE.EL == EL2 then 
PSTATE.<D,A,1I,F> = X[t]<9:6>; 
elsif PSTATE.EL == EL3 then 
PSTATE.<D,A,1I,F> = X[t]<9:6>; 
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op0 op1 CRn op2 
0b00 0b011 0b0100 0b110 
MSR DAIFCIr, #<imm> 
op0 op1 CRn op2 
0b00 0b011 0b0100 0b111 
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C5.2.3 DIT, Data Independent Timing 
The DIT characteristics are: 


Purpose 


Allows access to the Data Independent Timing bit. 


Configurations 


This register is present only when ARMv8.4-DIT is implemented. Otherwise, direct accesses to DIT 
are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
DIT is a 64-bit register. 


Field descriptions 


The DIT bit assignments are: 


63 25 24 23 0 


RESO RESO 


Bits [63:25] 
Reserved, RESO. 
DIT, bit [24] 
Data Independent Timing. 


Qbd The architecture makes no statement about the timing properties of any instructions. 
Qb1 The architecture requires that: 
$ The timing of every load and store instruction is insensitive to the value of the 


data being loaded or stored. 


: For certain data processing instructions, the instruction takes a time which is 
independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


3 For certain data processing instructions, the response of the instruction to 
asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 

The data processing instructions affected by this bit are: 

. All cryptographic instructions. These instructions are: 


— AESD, AESE, AESIMC, AESMC, SHA1C, SHA1H, SHA1M, SHA1P, SHA1SUQ, SHA1SU1, SHA256H, 
SHA256H2, SHA256SU0, SHA256SU1, SHA512H, SHA512H2, SHA512SU@, SHA512SU1, EOR3, RAX1, 
XAR, BCAX, SM3SS1, SM3TT1A, SM3TT1B, SM3TT2A, SM3TT2B, SM3PARTW1, SM3PARTW2, SM4E, and 
SM4EKEY. 
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° A subset of those instructions which use the general-purpose register file. These instructions 
are: 


— ADC, ADCS, ADD, ADDS, AND, ANDS, ASR, ASRV, BFC, BFI, BFM, BFXIL, BIC, BICS, CCMN, CCMP, CFINV, 
CINC, CINV, CLS, CLZ, CMN, CMP, CNEG, CSEL, CSET, CSETM, CSINC, CSINV, CSNEG, EON, EOR, EXTR, 
LSL, LSLV, LSR, LSRV, MADD, MNEG, MOV, MOVK, MOVN, MOVZ, MSUB, MUL, MVN, NEG, NEGS, NGC, NGCS, 
NOP, ORN, ORR, RBIT, RET, REV, REV16, REV32, REV64, RMIF, ROR, RORV, SBC, SBCS, SBFIZ, SBFM, 
SBFX, SETF8, SETF16, SMADDL, SMNEGL, SMSUBL, SMULH, SMULL, SUB, SUBS, SXTB, SXTH, SXTW, TST, 
UBFIZ, UBFM, UBFX, UMADDL, UMNEGL, UMSUBL, UMULH, UMULL, UXTB, and UXTH. 


° A subset of those instuctions which use the SIMD&FP register file. These instructions are: 


— ABS, ADD, ADDHN, ADDHN2, ADDP, ADDV, AND, BIC, BIF, BIT, BSL, CLS, CLZ, CMEQ, CMGE, CMGT, CMHI, 
CMHS, CMLE, CMLT, CMTST, CNT, CRC32B, CRC32H, CRC32W, CRC32X, CRC32CB, CRC32CH, CRC32CW, 
CRC32CX, DUP, EOR, EXT, FCSEL, INS, MLA, MLS, MOV, MOVI, MUL, MVN, MVNI, NEG, NOT, ORN, ORR, 
PMUL, PMULL, PMULL2, RADDHN, RADDHN2, RBIT, REV16, REV32, RSHRN, RSHRN2, RSUBHN, RSUBHN2, 
SABA, SABD, SABAL, SABAL2, SABDL, SABDL2, SADALP, SADDL, SADDL2, SADDLP, SADDLV, SADDW, 
SADDW2, SHADD, SHL, SHLL, SHLL2, SHRN, SHRN2, SHSUB, SLI, SMAX, SMAXP, SMAXV, SMIN, SMINP, 
SMINV, SMLAL, SMLAL2, SMLSL, SMLSL2, SMOV, SMULL, SMULL2, SRI, SSHL, SSHLL, SSHLL2, SSHR, 
SSRA, SSUBL, SSUBL2, SSUBW, SSUBW2, SUB, SUBHN, SUBHN2, SXTL, SXTL2, TBL, TBX, TRN1, TRN2, 
UABA, UABAL, UABAL2, UABD, UABDL, UABDL2, UADALP, UADDL, UADDL2, UADDLP, UADDLV, UADDW, 
UADDW2, UHADD, UHSUB, UMAX, UMAXP, UMAXV, UMIN, UMINP, UMINV, UMLAL, UMLAL2, UMLSL, UMOV, 
UMLSL2, UMULL, UMULL2, USHL, USHLL, USHLL2, USHR, USRA, USUBL, USUBL2, USUBW, USUBW2, UXTL, 
UXTL2, UZP1, UZP2, XTN, XTN2, ZIP1, and ZIP2. 








Note 

The architecture makes no statement about the timing properties when the PSTATE.DIT bit is not 
set. However, it is likely that many of these instructions have timing that is invariant of the data in 
many situations. 





In particular, Arm strongly recommends that the Armv8.3 pointer authentication instructions do not 
have their timing dependent on the key value used in the pointer authentication in all cases, 
regardless of the PSTATE.DIT bit. 





This field resets to Q. 


Bits [23:0] 


Reserved, RESO. 


Accessing the DIT 


For details on the operation of the MSR (immediate) accessor, see MSR (immediate) in the Arm® Architecture 
Reference Manual, Armv8, for Armv8-A architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DIT 





op0 op1 CRn CRm op2 





0b11 0b011 0b0100 0b0010 0b101 





if PSTATE.EL == EL@ then 

return Zeros(39):PSTATE.DIT:Zeros(24); 
elsif PSTATE.EL == EL1 then 

return Zeros(39):PSTATE.DIT:Zeros(24); 
elsif PSTATE.EL == EL2 then 

return Zeros(39):PSTATE.DIT:Zeros(24); 
elsif PSTATE.EL == EL3 then 

return Zeros(39):PSTATE.DIT:Zeros(24); 
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MSR DIT, <Xt> 

















op0 op1 CRn CRm op2 
0b11 0b011 0b0100 0b0010 0b101 
if PSTATE.EL == ELO then 
PSTATE.DIT = X[t]<24>; 
elsif PSTATE.EL == EL1 then 
PSTATE.DIT = X[t]<24>; 
elsif PSTATE.EL == EL2 then 
PSTATE.DIT = X[t]<24>; 
elsif PSTATE.EL == EL3 then 
PSTATE.DIT = X[t]<24>; 
MSR DIT, #<imm> 
op0 op1 CRn op2 
0b00 0b011 0b0100 0b010 
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C5.2.4 ELR_EL1, Exception Link Register (EL1) 


The ELR_ELI characteristics are: 


Purpose 

When taking an exception to EL1, holds the address to return to. 
Configurations 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ELR_EL1 is a 64-bit register. 


Field descriptions 


The ELR_ELI bit assignments are: 


63 0 


Return address 


Bits [63:0] 
Return address. 
An exception return from EL1 using AArch64 makes ELR_EL1 become UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Accessing the ELR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic ELR_EL1 or 
ELR_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ELR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0100 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x230]; 
else 
return ELR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return ELR_EL2; 
else 
return ELR_EL1; 
elsif PSTATE.EL == EL3 then 
return ELR_EL1; 
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MSR ELR_EL1, <Xt> 





op0 op1 


0b11 0b000 


CRn 


0b0100 


CRm 


0b0000 


op2 


0b001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


NVMem[@x230] = X[t]; 
else 
ELR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
ELR_EL2 = X[t]; 
else 





ELR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ELR_EL1 = X[t]; 





MRS <Xt>, ELR_EL12 





op0 op1 


CRn 


CRm 


op2 





0b11 0b101 


0b0100 


0b0000 


0b001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 


return NVMem[0x230]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return ELR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return ELR_EL1; 
else 
UNDEFINED; 


MSR ELR_EL12, <Xt> 





op0 op1 


CRn 


CRm 


op2 





0b11 0b101 


0b0100 


0b0000 


0b001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 


NVMem[@x23@] = X[t]; 
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elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
ELR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
ELR_EL1 = X[t]; 
else 
UNDEFINED; 


MRS <Xt>, ELR_EL2 


op0 op1 CRn CRm op2 





0b11 0b100 0b0100 0b0000 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return ELR_EL1; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return ELR_EL2; 
elsif PSTATE.EL == EL3 then 
return ELR_EL2; 


MSR ELR_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b0100 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
ELR_EL1 = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
ELR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
ELR_EL2 = X[t]; 
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C5.2.5 ELR_EL2, Exception Link Register (EL2) 


The ELR_EL2 characteristics are: 


Purpose 
When taking an exception to EL2, holds the address to return to. 
Configurations 
AArch6é4 System register ELR_EL2[31:0] is architecturally mapped to AArch32 System register 
ELR_hyp[31:0]. 
This register has no effect if EL2 is not enabled in the current Security state. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ELR_EL2 is a 64-bit register. 


Field descriptions 


The ELR_EL2 bit assignments are: 


63 0 


Return address 


Bits [63:0] 
Return address. 
An exception return from EL2 using AArch64 makes ELR_EL2 become UNKNOWN. 


When EL2 is in AArch32 Execution state and an exception is taken from ELO, EL1, or EL2 to EL3 
and AArch64 execution, the upper 32-bits of ELR_EL2 are either set to 0 or hold the same value 
that they did before AArch32 execution. Which option is adopted is determined by an 
implementation, and might vary dynamically within an implementation. Correspondingly software 
must regard the value as being an UNKNOWN choice between the two values. 


This field resets to an architecturally UNKNOWN value. 


Accessing the ELR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic ELR_EL2 or 
ELR_ELI are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ELR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0100 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return ELR_EL1; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return ELR_EL2; 
elsif PSTATE.EL == EL3 then 
return ELR_EL2; 


MSR ELR_EL2, <Xt> 
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op0 op1 CRn 


CRm op2 





0b11 0b100 0b0100 


0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
ELR_EL1 = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
ELR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
ELR_EL2 = X[t]; 


MRS <Xt>, ELR_EL1 





op0 op1 CRn 


CRm op2 





0b11 0b000 0b0100 


0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == '@1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


return NVMem[0x230]; 
else 
return ELR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return ELR_EL2; 
else 
return ELR_EL1; 
elsif PSTATE.EL == EL3 then 
return ELR_EL1; 


MSR ELR_EL1, <Xt> 





op0 op1 CRn 


CRm op2 





0b11 0b000 0b0100 


if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && HCR_EL2.<NV2,NV1> == '@1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x230] = X[t]; 

else 
ELR_EL1 = X[t]; 

elsif PSTATE.EL == EL2 then 

if HCR_EL2.E2H == '1' then 
ELR_EL2 = X[t]; 

else 








ELR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ELR_EL1 = X[t]; 





C5-388 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The A64 System Instruction Class 
C5.2 Special-purpose registers 


C5.2.6 ELR_EL3, Exception Link Register (EL3) 


63 
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The ELR_EL3 characteristics are: 


Purpose 

When taking an exception to EL3, holds the address to return to. 
Configurations 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ELR_EL3 is a 64-bit register. 


Field descriptions 


The ELR_EL3 bit assignments are: 


Return address 


Bits [63:0] 
Return address. 
An exception return from EL3 using AArch64 makes ELR_EL3 become UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Accessing the ELR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ELR_EL3 

















op0 op1 CRn CRm op2 
0b11 0b110 0b0100 0b0000 0b001 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return ELR_EL3; 
MSR ELR_EL3, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b110 0b0100 0b0000 0b001 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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UNDEFINED; 

elsif PSTATE.EL == EL2 then 
UNDEFINED; 

elsif PSTATE.EL == EL3 then 
ELR_EL3 = X[t]; 
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C5.2.7 FPCR, Floating-point Control Register 
The FPCR characteristics are: 


Purpose 


Controls floating-point behavior. 


Configurations 
The named fields in this register map to the equivalent fields in the AArch32 FPSCR. 


It is IMPLEMENTATION DEFINED whether the Len and Stride fields can be programmed to non-zero 
values, which will cause some AArch32 floating-point instruction encodings to be UNDEFINED, or 
whether these fields are RAZ. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
FPCR is a 64-bit register. 


Field descriptions 


The FPCR bit assignments are: 


63 27 26 25 24 23 22 21 201918. 16 15 14 13 12 11 10 9 8 7 


| — e 
OFE 
UFE 

IXE 
RESO 
IDE 
FZ16 





Bits [63:27] 


Reserved, RESO. 


AHP, bit [26] 
Alternative half-precision control bit: 
Qbd IEEE half-precision format selected. 
Qb1 Alternative half-precision format selected. 


This bit is only used for conversions between half-precision floating-point and other floating-point 
formats. 


The data-processing instructions added as part of the ARMv8.2-FP16 extension always use the 
IEEE half-precision format, and ignore the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


DN, bit [25] 
Default NaN mode control bit: 
Qbd NaN operands propagate through to the output of a floating-point operation. 
Qb1 Any operation involving one or more NaNs returns the Default NaN. 


The value of this bit controls both scalar and Advanced SIMD floating-point arithmetic. 
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FZ, bit [24] 


This field resets to an architecturally UNKNOWN value. 


Flush-to-zero mode control bit: 


Obed Flush-to-zero mode disabled. Behavior of the floating-point system is fully compliant 
with the IEEE 754 standard. 


Qb1 Flush-to-zero mode enabled. 
The value of this bit controls both scalar and Advanced SIMD floating-point arithmetic. 
This bit has no effect on half-precision calculations. 


This field resets to an architecturally UNKNOWN value. 


RMode, bits [23:22] 


Rounding Mode control field. The encoding of this field is: 


Oboe Round to Nearest (RN) mode. 

0b01 Round towards Plus Infinity (RP) mode. 
0b10 Round towards Minus Infinity (RM) mode. 
0b11 Round towards Zero (RZ) mode. 


The specified rounding mode is used by both scalar and Advanced SIMD floating-point 
instructions. 


This field resets to an architecturally UNKNOWN value. 


Stride, bits [21:20] 


FZ16, bit [19] 


This field has no function in AArch64 state, and non-zero values are ignored during execution in 
AArché64 state. It is included only for context saving and restoration of the AArch32 FPSCR. Stride 
field. 


This field resets to an architecturally UNKNOWN value. 


When ARMV8.2-FP16 is implemented: 


Flush-to-zero mode control bit on half-precision data-processing instructions: 


ObO Flush-to-zero mode disabled. Behavior of the floating-point system is fully compliant 
with the IEEE 754 standard. 


Qb1 Flush-to-zero mode enabled. 


The value of this bit applies to both scalar and Advanced SIMD floating-point half-precision 
calculations. A half-precision floating-point number that is flushed to zero as a result of the value 
of the FZ16 bit does not generate an Input Denormal exception. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Len, bits [18:16] 


IDE, bit [15] 


This field has no function in AArch64 state, and non-zero values are ignored during execution in 
AArché64 state. It is included only for context saving and restoration of the AArch32 FPSCR.Len 
field. 


This field resets to an architecturally UNKNOWN value. 


Input Denormal floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
FPSR.IDC bit is set to 1. 
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Bits [14:13] 


IXE, bit [12] 


UFE, bit [11] 


OFE, bit [10] 


DZE, bit [9] 
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Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the FPSR.IDC bit. The trap handling software can decide whether to set the 
FPSR.IDC bit to 1. 


The value of this bit controls both scalar and Advanced SIMD floating-point arithmetic. 
If the implementation does not support this exception, this bit is RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Inexact floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
FPSR.IXC bit is set to 1. 


Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the FPSR.IXC bit. The trap handling software can decide whether to set the 
FPSR.IXC bit to 1. 


The value of this bit controls both scalar and Advanced SIMD floating-point arithmetic. 
If the implementation does not support this exception, this bit is RAZ/WI. 
This field resets to an architecturally UNKNOWN value. 


Underflow floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
FPSR.UFC bit is set to 1. 


Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the FPSR.UFC bit. The trap handling software can decide whether to set the 
FPSR.UFC bit to 1. 


The value of this bit controls both scalar and Advanced SIMD floating-point arithmetic. 
If the implementation does not support this exception, this bit is RAZ/WI. 
This field resets to an architecturally UNKNOWN value. 


Overflow floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
FPSR.OFC bit is set to 1. 


Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the FPSR.OFC bit. The trap handling software can decide whether to set the 
FPSR.OFC bit to 1. 


The value of this bit controls both scalar and Advanced SIMD floating-point arithmetic. 
If the implementation does not support this exception, this bit is RAZ/WI. 
This field resets to an architecturally UNKNOWN value. 


Divide by Zero floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
FPSR.DZC bit is set to 1. 


Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the FPSR.DZC bit. The trap handling software can decide whether to set the 
FPSR.DZC bit to 1. 


The value of this bit controls both scalar and Advanced SIMD floating-point arithmetic. 
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If the implementation does not support this exception, this bit is RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


IOE, bit [8] 
Invalid Operation floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
FPSR.IOC bit is set to 1. 


Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the FPSR.IOC bit. The trap handling software can decide whether to set the 
FPSR.IOC bit to 1. 


The value of this bit controls both scalar and Advanced SIMD floating-point arithmetic. 
If the implementation does not support this exception, this bit is RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


Bits [7:0] 


Reserved, RESO. 


Accessing the FPCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, FPCR 





op0 CRn op1 op2 CRm 





0b11 0b0100 0b011 0b000 0b0100 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CPACR_EL1.FPEN != '11' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x00); 
else 
AArch64.SystemAccessTrap(EL1, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CPTR_EL2.FPEN != '11' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
return FPCR; 
elsif PSTATE.EL == EL1 then 
if CPACR_EL1.FPEN == 'x@' then 
AArch64.SystemAccessTrap(EL1, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
return FPCR; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x0' then 
AArch64.SystemAccessTrap(EL2, 0x07); 


&& CPTR_EL2.FPEN == 'xQ' then 


&& CPTR_EL2.TFP == '1' then 





&& CPTR_EL2.TFP == '1' then 


&& CPTR_EL2.FPEN == 'xQ' then 
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elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 

else 
return FPCR; 

elsif PSTATE.EL == EL3 then 

if CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 

else 
return FPCR; 


MSR FPCR, <Xt> 


op0 CRn op1 
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op2 


CRm 





0b11 0b0100 0b011 


if PSTATE.EL == EL@ then 


0b000 


0b0100 


if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CPACR_EL1.FPEN != '11' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x00); 
else 
AArch64.SystemAccessTrap(EL1, 0x07); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CPTR_EL2.FPEN != '11' then 


AArch64.SystemAccessTrap(EL2, 0x07); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 


AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
FPCR = X[t]; 
elsif PSTATE.EL == EL1 then 
if CPACR_EL1.FPEN == 'x@' then 
AArch64.SystemAccessTrap(EL1, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
FPCR = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x0' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
FPCR = X[t]; 
elsif PSTATE.EL == EL3 then 
if CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
FPCR = X[t]; 
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&& CPTR_EL2.TFP 


== '1' then 


== '1' then 


&& CPTR_EL2.FPEN == 'xQ' then 
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C5.2.8 FPSR, Floating-point Status Register 


The FPSR characteristics are: 


Purpose 
Provides floating-point system status information. 

Configurations 
The named fields in this register map to the equivalent fields in the AArch32 FPSCR. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


FPSR is a 64-bit register. 


Field descriptions 


The FPSR bit assignments are: 


63 32 31 30 29 28 27 26 876543210 


| IOC 


OFC 
UFC 
IXC 
RESO 
IDC 
QC 


RESO RESO 





Bits [63:32] 


Reserved, RESO. 


N, bit [31] 


Negative condition flag for AArch32 floating-point comparison operations. AArch64 floating-point 
comparisons set the PSTATE.N flag instead. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero condition flag for AArch32 floating-point comparison operations. AArch64 floating-point 
comparisons set the PSTATE.Z flag instead. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry condition flag for AArch32 floating-point comparison operations. AArch64 floating-point 
comparisons set the PSTATE.C flag instead. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow condition flag for AArch32 floating-point comparison operations. AArch64 
floating-point comparisons set the PSTATE.V flag instead. 


This field resets to an architecturally UNKNOWN value. 
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QC, bit [27] 


Cumulative saturation bit, Advanced SIMD only. This bit is set to 1 to indicate that an Advanced 
SIMD integer operation has saturated since 0 was last written to this bit. 


This field resets to an architecturally UNKNOWN value. 


Bits [26:8] 


Reserved, RESO. 


IDC, bit [7] 


Input Denormal cumulative floating-point exception bit. This bit is set to 1 to indicate that the Input 
Denormal floating-point exception has occurred since 0 was last written to this bit. 


How scalar and Advanced SIMD floating-point instructions update this bit depends on the value of 
the FPCR.IDE bit. This bit is only set to 1 to indicate a floating-point exception if FPCR.IDE is 0, 
or if trapping software sets it. 


This field resets to an architecturally UNKNOWN value. 


Bits [6:5] 


Reserved, RESO. 


IXC, bit [4] 


Inexact cumulative floating-point exception bit. This bit is set to 1 to indicate that the Inexact 
exception floating-point has occurred since 0 was last written to this bit. 


How scalar and Advanced SIMD floating-point instructions update this bit depends on the value of 
the FPCR.IXE bit. This bit is only set to 1 to indicate a floating-point exception if FPCR.IXE is 0, 
or if trapping software sets it. 


This field resets to an architecturally UNKNOWN value. 


UFC, bit [3] 


Underflow cumulative floating-point exception bit. This bit is set to 1 to indicate that the Underflow 
floating-point exception has occurred since 0 was last written to this bit. 


How scalar and Advanced SIMD floating-point instructions update this bit depends on the value of 
the FPCR.UFE bit. This bit is only set to 1 to indicate a floating-point exception if FPCR.UFE is 0, 
or if trapping software sets it. 


This field resets to an architecturally UNKNOWN value. 


OFC, bit [2] 


Overflow cumulative floating-point exception bit. This bit is set to 1 to indicate that the Overflow 
floating-point exception has occurred since 0 was last written to this bit. 


How scalar and Advanced SIMD floating-point instructions update this bit depends on the value of 
the FPCR.OFE bit. This bit is only set to 1 to indicate a floating-point exception if FPCR.OFE is 0, 
or if trapping software sets it. 


This field resets to an architecturally UNKNOWN value. 


DZC, bit [1] 


Divide by Zero cumulative floating-point exception bit. This bit is set to 1 to indicate that the Divide 
by Zero floating-point exception has occurred since 0 was last written to this bit. 


How scalar and Advanced SIMD floating-point instructions update this bit depends on the value of 
the FPCR.DZE bit. This bit is only set to 1 to indicate a floating-point exception if FPCR.DZE is 0, 
or if trapping software sets it. 


This field resets to an architecturally UNKNOWN value. 
IOC, bit [0] 


Invalid Operation cumulative floating-point exception bit. This bit is set to 1 to indicate that the 
Invalid Operation floating-point exception has occurred since 0 was last written to this bit. 
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How scalar and Advanced SIMD floating-point instructions update this bit depends on the value of 
the FPCR.IOE bit. This bit is only set to 1 to indicate a floating-point exception if FPCR.IOE is 0, 
or if trapping software sets it. 


This field resets to an architecturally UNKNOWN value. 


Accessing the FPSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, FPSR 





op0 CRn op1 op2 CRm 





0b11 0b0100 0b011 0b001 0b0100 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CPACR_EL1.FPEN != '11' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x00); 
else 
AArch64.SystemAccessTrap(EL1, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CPTR_EL2.FPEN != '11' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x@' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
return FPSR; 
elsif PSTATE.EL == EL1 then 
if CPACR_EL1.FPEN == 'x@' then 
AArch64.SystemAccessTrap(EL1, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
return FPSR; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
return FPSR; 
elsif PSTATE.EL == EL3 then 
if CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
return FPSR; 


&& CPTR_EL2.TFP == '1' then 


&& CPTR_EL2.TFP == '1' then 


&& CPTR_EL2.FPEN == 'xQ' then 
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MSR FPSR, <Xt> 





op0 CRn op1 op2 CRm 


0b11 0b0100 0b011 0b001 0b0100 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CPACR_EL1.FPEN != '11' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x00); 
else 
AArch64.SystemAccessTrap(EL1, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CPTR_EL2.FPEN != '11' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
FPSR = X[t]; 
elsif PSTATE.EL == EL1 then 
if CPACR_EL1.FPEN == 'x@' then 
AArch64.SystemAccessTrap(EL1, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
FPSR = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.SystemAccessTrap(EL2, 0x07); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
FPSR = X[t]; 
elsif PSTATE.EL == EL3 then 
if CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 
else 
FPSR = X[t]; 


&& CPTR_EL2.TFP == '1' then 





&& CPTR_EL2.TFP == '1' then 


&& CPTR_EL2.FPEN == 'xQ' then 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C5-399 
Non-Confidential 


The A64 System Instruction Class 
C5.2 Special-purpose registers 


C5.2.9 NZCV, Condition Flags 


The NZCV characteristics are: 


Purpose 

Allows access to the condition flags. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


NZCV is a 64-bit register. 


Field descriptions 


The NZCV bit assignments are: 


63 32 31 30 29 28 27 0 


RESO RESO 





Bits [63:32] 


Reserved, RESO. 


N, bit [31] 
Negative condition flag. Set to 1 if the result of the last flag-setting instruction was negative. 
Z, bit [30] 
Zero condition flag. Set to 1 if the result of the last flag-setting instruction was zero, and to 0 
otherwise. A result of zero often indicates an equal result from a comparison. 
C, bit [29] 
Carry condition flag. Set to 1 if the last flag-setting instruction resulted in a carry condition, for 
example an unsigned overflow on an addition. 
V, bit [28] 
Overflow condition flag. Set to 1 ifthe last flag-setting instruction resulted in an overflow condition, 
for example a signed overflow on an addition. 
Bits [27:0] 


Reserved, RESO. 


Accessing the NZCV 


Accesses to this register use the following encodings in the System instruction encoding space: 
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op0 op1 CRn CRm op2 
0b11 0b011 0b0100 0b0010 0b000 
if PSTATE.EL == EL@ then 
return Zeros(32):PSTATE.<N,Z,C,V>:Zeros(28); 
elsif PSTATE.EL == EL1 then 
return Zeros(32):PSTATE.<N,Z,C,V>:Zeros(28); 
elsif PSTATE.EL == EL2 then 
return Zeros(32):PSTATE.<N,Z,C,V>:Zeros(28); 
elsif PSTATE.EL == EL3 then 
return Zeros(32):PSTATE.<N,Z,C,V>:Zeros(28); 
MSR NZCV, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b011 0b0100 0b0010 0b000 





if PSTATE.EL == ELO then 
PSTATE.<N,Z,C,V> = X[t]<31:28>; 
elsif PSTATE.EL == EL1 then 
PSTATE.<N,Z,C,V> = X[t]<31:28>; 
elsif PSTATE.EL == EL2 then 
PSTATE.<N,Z,C,V> = X[t]<31:28>; 
elsif PSTATE.EL == EL3 then 
PSTATE.<N,Z,C,V> = X[t]<31:28>; 
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C5.2.10 


C5-402 


PAN, Privileged Access Never 


The PAN characteristics are: 


Purpose 
Allows access to the Privileged Access Never bit. 
Configurations 
This register is present only when ARMv8.1-PAN is implemented. Otherwise, direct accesses to 
PAN are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


PAN is a 64-bit register. 


Field descriptions 


The PAN bit assignments are: 


23 22 21 0 


RESO RESO 


Bits [63:23] 
Reserved, RESO. 


PAN, bit [22] 
Privileged Access Never. 
Qbd Privileged reads and write are not disabled by this mechanism. 


Qb1 Disables privileged read and write accesses to addresses accessible at ELO for an 
enabled stage 1 translation regime that defines the ELO permissions. 


The value of this bit is usually preserved on taking an exception, except in the following situations: 


è When the target of the exception is EL1, and the value of the SCTLR_EL1.SPAN bitis 0, this 
bit is set to 1. 


. When the target of the exception is EL2, HCR_EL2.{E2H, TGE} is {1, 1}, and the value of 
the SCTLR_EL2.SPAN bit is 0, this bit is set to 1. 


Bits [21:0] 
Reserved, RESO. 


Accessing the PAN 


For details on the operation of the MSR (immediate) accessor, see MSR (immediate) in the Arm® Architecture 
Reference Manual, Armv8, for Armv8-A architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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op0 op1 


0b11 0b000 


CRn CRm op2 


0b0100 0b0010 0b011 





if PSTATE.EL == EL@ then 

UNDEFINED; 
elsif PSTATE.EL == EL1 then 

return Zeros(41) :PSTATE.PAN:Zeros(22); 
elsif PSTATE.EL == EL2 then 

return Zeros(41) :PSTATE.PAN:Zeros(22); 
elsif PSTATE.EL == EL3 then 

return Zeros(41) :PSTATE.PAN:Zeros(22) ; 


MSR PAN, <Xt> 





op0 op1 


CRn CRm op2 





0b11 0b000 


0b0100 0b0010 0b011 





if PSTATE.EL == ELO then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
PSTATE.PAN = X[t]<22>; 

elsif PSTATE.EL == EL2 then 
PSTATE.PAN = X[t]<22>; 

elsif PSTATE.EL == EL3 then 
PSTATE.PAN = X[t]<22>; 


MSR PAN, #<imm> 





op0 


0b00 


op1 CRn op2 


0b000 0b0100 0b100 
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C5.2.11 SP_ELO, Stack Pointer (ELO) 


The SP_ELO characteristics are: 


Purpose 
Holds the stack pointer associated with ELO. At higher Exception levels, this is used as the current 
stack pointer when the value of SPSel.SP is 0. 

Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


SP_ELO is a 64-bit register. 


Field descriptions 


The SP_ELO bit assignments are: 


63 0 


Stack pointer 


Bits [63:0] 
Stack pointer. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SP_ELO 
When the value of PSTATE.SP is 0, this register is accessible at all Exception levels as the current stack pointer. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SP_ELO 





op0 op1 CRn CRm op2 





0b11 0b000 0b0100 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if PSTATE.SP == '@' then 
UNDEFINED; 
else 
return SP_ELQ; 
elsif PSTATE.EL == EL2 then 
if PSTATE.SP == '@' then 
UNDEFINED; 
else 
return SP_ELQ; 
elsif PSTATE.EL == EL3 then 
if PSTATE.SP == 'Q' then 
UNDEFINED; 
else 
return SP_ELQ; 
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op0 op1 CRn CRm op2 
0b11 0b000 0b0100 0b0001 0b000 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if PSTATE.SP == 'Q' then 
UNDEFINED; 
else 
SP_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if PSTATE.SP == 'Q@' then 
UNDEFINED; 
else 
SP_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
if PSTATE.SP == 'Q' then 
UNDEFINED; 
else 
SP_ELO = X[t]; 
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C5.2.12 SP_EL1, Stack Pointer (EL1) 


The SP_EL1 characteristics are: 














Purpose 
Holds the stack pointer associated with EL1. When executing at EL1, the value of SPSel.SP 
determines the current stack pointer: 
SPSel.SP Current stack pointer 
bo SP_ELO 
Qb1 SP_EL1 
Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SP_ELI is a 64-bit register. 


Field descriptions 


The SP_EL1 bit assignments are: 


63 0 


Stack pointer 


Bits [63:0] 
Stack pointer. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SP_EL1 
This accessibility information only applies to accesses using the MRS or MSR instructions. 


When the value of SPSel.SP is 1, this register is also accessible at EL1 as the current stack pointer. 


Note 
When the value of SPSel.SP is 0, SP_ELO is used as the current stack pointer at all Exception levels. 








Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SP_EL1 





op0 op1 CRn CRm op2 





0b11 0b100 0b0100 0b0001 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x240] ; 
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elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return SP_EL1; 
elsif PSTATE.EL == EL3 then 
return SP_EL1; 


MSR SP_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b0100 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x240] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
SP_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
SP_EL1 = X[t]; 
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C5.2.13 SP_EL2, Stack Pointer (EL2) 


The SP_EL2 characteristics are: 














Purpose 
Holds the stack pointer associated with EL2. When executing at EL2, the value of SPSel. SP 
determines the current stack pointer: 
SPSel.SP Current stack pointer 
bo SP_ELO 
Qb1 SP_EL2 
Configurations 
This register has no effect if EL2 is not enabled in the current Security state. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SP_EL2 is a 64-bit register. 


Field descriptions 


The SP_EL2 bit assignments are: 


63 0 


Stack pointer 


Bits [63:0] 
Stack pointer. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SP_EL2 
This accessibility information only applies to accesses using the MRS or MSR instructions. 


When the value of SPSel.SP is 1, this register is also accessible at EL2 as the current stack pointer. 


Note 
When the value of SPSel.SP is 0, SP_ELO is used as the current stack pointer at all Exception levels. 








Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SP_EL2 











op0 op1 CRn CRm op2 
0b11 0b110 0b0100 0b0001 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
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elsif PSTATE.EL == EL2 then 
UNDEFINED; 

elsif PSTATE.EL == EL3 then 
return SP_EL2; 


MSR SP_EL2, <Xt> 


if PSTATE.EL == EL@ then 


UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
UNDEFINED; 


elsif PSTATE.EL == EL3 then 
SP_EL2 = X[t]; 
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CRm 


op2 





0b11 0b110 
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0b0001 
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C5.2.14 SP_EL3, Stack Pointer (EL3) 


The SP_EL3 characteristics are: 














Purpose 
Holds the stack pointer associated with EL3. When executing at EL3, the value of SPSel.SP 
determines the current stack pointer: 
SPSel.SP Current stack pointer 
bo SP_ELO 
Qb1 SP_EL3 
Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SP_EL3 is a 64-bit register. 


Field descriptions 


The SP_EL3 bit assignments are: 


63 0 
Stack pointer 
Bits [63:0] 


Stack pointer. 


This field resets to an architecturally UNKNOWN value. 
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C5.2.15 SPSel, Stack Pointer Select 


The SPSel characteristics are: 


Purpose 
Allows the Stack Pointer to be selected between SP_ELO and SP_ELx. 

Configurations 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


SPSel is a 64-bit register. 
Field descriptions 


The SPSel bit assignments are: 


63 1 0 


RESO 


| S| 


Bits [63:1] 
Reserved, RESO. 

SP, bit [0] 
Stack pointer to use. Possible values of this bit are: 
Qbd Use SP_ELO at all Exception levels. 
Qb1 Use SP_ELx for Exception level ELx. 


This field resets to 1. 


Accessing the SPSel 


For details on the operation of the MSR (immediate) accessor, see MSR (immediate) in the Arm® Architecture 
Reference Manual, Armv8, for Armv8-A architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SPSel 





op0 op1 CRn CRm op2 





0b11 0b000 0b0100 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
return Zeros(63):PSTATE. SP; 

elsif PSTATE.EL == EL2 then 
return Zeros(63):PSTATE. SP; 

elsif PSTATE.EL == EL3 then 
return Zeros(63):PSTATE. SP; 
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MSR SPSel, <Xt> 

















op0 op1 CRn CRm op2 
0b11 0b000 0b0100 0b0010 0b000 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
PSTATE.SP = X[t]<Q>; 
elsif PSTATE.EL == EL2 then 
PSTATE.SP = X[t]<Q>; 
elsif PSTATE.EL == EL3 then 
PSTATE.SP = X[t]<Q>; 
MSR SPSel, #<imm> 
op0 op1 CRn op2 
0b00 0b000 0b0100 0b101 
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C5.2.16 SPSR_abt, Saved Program Status Register (Abort mode) 


63 





IT[1:0] | 
SSBS 


PAN 


ARM DDI 0487E.a 
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The SPSR_abt characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to Abort mode. 
Configurations 
AArch64 System register SPSR_abt[31:0] is architecturally mapped to AArch32 System register 
SPSR_abt[31:0]. 
If EL1 does not support execution in AArch32 state, this register is RESO. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_abt is a 64-bit register. 


Field descriptions 


The SPSR_abt bit assignments are: 






RESO 


Bits [63:32] 


N, bit [31] 


Z, bit [30] 


C, bit [29] 


V, bit [28] 


Q, bit [27] 


32 31 30 29 28 27 26 25 24 23 22 21 20 19., 1615 1098765 4 


GE | IT[7:2] 





0 
M[4:0] 
DIT 





Reserved, RESO. 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to Abort mode, and 
copied to PSTATE.N on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to Abort mode, and 
copied to PSTATE.Z on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to Abort mode, and 
copied to PSTATE.C on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to Abort mode, and 
copied to PSTATE.V on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to Abort mode, 
and copied to PSTATE.Q on executing an exception return operation in Abort mode. 
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This field resets to an architecturally UNKNOWN value. 


IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to Abort mode, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in Abort mode. 


On executing an exception return operation in Abort mode SPSR_abt.IT must contain a value that 
is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to Abort mode, 
and copied to PSTATE.SSBS on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMV8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to Abort mode, 
and copied to PSTATE.PAN on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to Abort mode, 
and copied to PSTATE.DIT on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to Abort mode, and 
copied to PSTATE.IL on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to Abort mode, 
and copied to PSTATE.GE on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to Abort mode, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in Abort mode. 
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SPSR_abt.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


E, bit [9] 
Endianness. Set to the value of PSTATE.E on taking an exception to Abort mode, and copied to 
PSTATE.E on executing an exception return operation in Abort mode. 
If the implementation does not support big-endian operation, SPSR_abt.E is RESO. If the 
implementation does not support little-endian operation, SPSR_abt.E is RES1. On executing an 
exception return operation in Abort mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_abt.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_abt.E is 
RES1. 
This field resets to an architecturally UNKNOWN value. 

A, bit [8] 
SError interrupt mask. Set to the value of PSTATE.A on taking an exception to Abort mode, and 
copied to PSTATE.A on executing an exception return operation in Abort mode. 
This field resets to an architecturally UNKNOWN value. 

I, bit [7] 
IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to Abort mode, and copied 
to PSTATE.I on executing an exception return operation in Abort mode. 
This field resets to an architecturally UNKNOWN value. 

F, bit [6] 
FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to Abort mode, and copied 
to PSTATE.F on executing an exception return operation in Abort mode. 
This field resets to an architecturally UNKNOWN value. 

T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to Abort mode, and 
copied to PSTATE.T on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to Abort mode, and copied to 
PSTATE.M[4:0] on executing an exception return operation in Abort mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10111 Abort. 
0b11011 Undefined. 
Qb11111 System. 





Other values are reserved. If SPSR_abt.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in Abort mode is an illegal 
return event, as described in ///egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_abt 


Accesses to this register use the following encodings in the System instruction encoding space: 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C5-415 
ID070919 Non-Confidential 


The A64 System Instruction Class 
C5.2 Special-purpose registers 


C5-416 


MRS <Xt>, SPSR_abt 














op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0011 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return SPSR_abt; 
elsif PSTATE.EL == EL3 then 
return SPSR_abt; 
MSR SPSR_abt, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0011 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
SPSR_abt = X[t]; 
elsif PSTATE.EL == EL3 then 
SPSR_abt = X[t]; 
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SPSR_EL1, Saved Program Status Register (EL1) 


The SPSR_EL1 characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to EL1. 
Configurations 
AArch64 System register SPSR_EL1[31:0] is architecturally mapped to AArch32 System register 
SPSR_svc[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_EL] is a 64-bit register. 


Field descriptions 


The SPSR_EL1 bit assignments are: 


When exception taken from AArch32 state: 


63 32 31 30 29 28 27 26 25 24 23 22 21 2019, 1615 1098765 4 3 0 


RESO GE | IT[7:2] M[3:0] 












IT[1 :0] a M[4] 
DIT 


SSBS 
PAN 


An exception return from EL1 using AArch64 makes SPSR_EL1 become UNKNOWN. 


Bits [63:32] 


Reserved, RESO. 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to EL1, and copied 
to PSTATE.N on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to EL1, and copied to 
PSTATE.Z on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to EL1, and copied to 
PSTATE.C on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to EL1, and copied 
to PSTATE.V on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
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Q, bit [27] 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to EL1, and 
copied to PSTATE.Q on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to EL1, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in EL1. 


On executing an exception return operation in EL1 SPSR_EL1.IT must contain a value that is valid 
for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


DIT, bit [24] 
When ARMV8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to EL1, and 
copied to PSTATE. DIT on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to EL1, and 
copied to PSTATE.SSBS on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMV8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to EL1, and 
copied to PSTATE.PAN on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SS, bit [21] 


Software Step. Set to the value of PSTATE.SS on taking an exception to EL1, and conditionally 
copied to PSTATE.SS on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to EL1, and copied to 
PSTATE.IL on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to EL1, and 
copied to PSTATE.GE on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
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IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to EL1, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in EL1. 


SPSR_EL1.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


E, bit [9] 
Endianness. Set to the value of PSTATE.E on taking an exception to EL1, and copied to PSTATE.E 
on executing an exception return operation in EL1. 
If the implementation does not support big-endian operation, SPSR_EL1.E is RESO. If the 
implementation does not support little-endian operation, SPSR_EL1.E is RES1. On executing an 
exception return operation in EL1, if the implementation does not support big-endian operation at 
the Exception level being returned to, SPSR_EL1.E is RESO, and if the implementation does not 
support little-endian operation at the Exception level being returned to, SPSR_EL1.E is RES1. 
This field resets to an architecturally UNKNOWN value. 

A, bit [8] 
SError interrupt mask. Set to the value of PSTATE.A on taking an exception to EL1, and copied to 
PSTATE.A on executing an exception return operation in EL1. 
This field resets to an architecturally UNKNOWN value. 

I, bit [7] 
IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to EL1, and copied to 
PSTATE.] on executing an exception return operation in EL1. 
This field resets to an architecturally UNKNOWN value. 

F, bit [6] 
FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to EL1, and copied to 
PSTATE.F on executing an exception return operation in EL1. 
This field resets to an architecturally UNKNOWN value. 

T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to EL1, and copied 
to PSTATE.T on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


MIA], bit [4] 


Execution state. Set to 0b1, the value of PSTATE.nRW, on taking an exception to EL1 from AArch32 
state, and copied to PSTATE.nRW on executing an exception return operation in EL1. 


Qb1 AArch32 execution state. 


This field resets to an architecturally UNKNOWN value. 


M[3:0], bits [3:0] 


AArch32 Mode. Set to the value of PSTATE.M[3:0] on taking an exception to EL1, and copied to 
PSTATE.M[3:0] on executing an exception return operation in EL1. 


0b0000 User. 
0b0001 FIQ. 
0b0010 IRQ. 
0b0011 Supervisor. 
0b0111 Abort. 
0b1011 Undefined. 
0b1111 System. 
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RESO | 
TCO 


DIT 
UAO 
PAN 


C5-420 


Other values are reserved. If SPSR_EL1.M[3:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in EL] is an illegal return 
event, as described in ///egal return events from AArch64 state on page D1-2304. 


This field resets to an architecturally UNKNOWN value. 


When exception taken from AArch64 state: 


63 32 31 30 29 28 27 26 25 24 23 22 21 20 19 |. 131211109 8 7 6 5 4 3 0 





RESO 












An exception return from EL1 using AArch64 makes SPSR_EL1 become UNKNOWN. 


Bits [63:32] 


N, bit [31] 


Z, bit [30] 


C, bit [29] 


V, bit [28] 


Bits [27:26] 


TCO, bit [25] 


Reserved, RESO. 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to EL1, and copied 
to PSTATE.N on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to EL1, and copied to 
PSTATE.Z on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to EL1, and copied to 
PSTATE.C on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to EL1, and copied 
to PSTATE.V on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


When ARMVv8.5-MemTag is implemented: 


Tag Check Override. Set to the value of PSTATE.TCO on taking an exception to EL1, and copied 
to PSTATE.TCO on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 
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DIT, bit [24] 
When ARMV8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to EL1, and 
copied to PSTATE. DIT on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


UAO, bit [23] 
When ARMV8.2-UAO is implemented: 


User Access Override. Set to the value of PSTATE.UAO on taking an exception to EL1, and copied 
to PSTATE.UAO on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMV8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to EL1, and 
copied to PSTATE.PAN on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SS, bit [21] 
Software Step. Set to the value of PSTATE.SS on taking an exception to EL1, and conditionally 
copied to PSTATE.SS on executing an exception return operation in EL1. 
This field resets to an architecturally UNKNOWN value. 

IL, bit [20] 
Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to EL1, and copied to 
PSTATE.IL on executing an exception return operation in EL1. 
This field resets to an architecturally UNKNOWN value. 

Bits [19:13] 


Reserved, RESO. 


SSBS, bit [12] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to EL1, and 
copied to PSTATE.SSBS on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


BTYPE, bits [11:10] 
When ARMV8.5-BTI is implemented: 


Branch Type Indicator. Set to the value of PSTATE.BTYPE on taking an exception to EL1, and 
copied to PSTATE.BTYPE on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 
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Otherwise: 


Reserved, RESO. 


D, bit [9] 


Debug exception mask. Set to the value of PSTATE.D on taking an exception to EL1, and copied to 
PSTATE.D on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to EL1, and copied to 
PSTATE.A on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to EL1, and copied to 
PSTATE.] on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to EL1, and copied to 
PSTATE.F on executing an exception return operation in EL1. 


This field resets to an architecturally UNKNOWN value. 


Bit [5] 


Reserved, RESO. 


M[4], bit [4] 


Execution state. Set to 0b0, the value of PSTATE.nRW, on taking an exception to EL1 from AArch64 
state, and copied to PSTATE.nRW on executing an exception return operation in EL1. 


Qbd AArch64 execution state. 
If AArch32 is not supported at any Exception level, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


M[3:0], bits [3:0] 
AArch64 Exception level and selected Stack Pointer. 
0b0000 ELOt. 
0b0100 ELIt. 
0b0101 ELth. 


Other values are reserved. If SPSR_EL1.M[3:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in EL] is an illegal return 
event, as described in ///egal return events from AArch64 state on page D1-2304. 


The bits in this field are interpreted as follows: 


$ M[3:2] is set to the value of PSTATE.EL on taking an exception to EL1 and copied to 
PSTATE.EL on executing an exception return operation in EL1. 


° M[1] is unused and is 0 for all non-reserved values. 


è M[0] is set to the value of PSTATE.SP on taking an exception to EL1 and copied to 
PSTATE.SP on executing an exception return operation in EL1 


This field resets to an architecturally UNKNOWN value. 
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Accessing the SPSR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic SPSR_EL1 or 
SPSR_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SPSR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0100 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == '@1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x160] ; 
else 
return SPSR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return SPSR_EL2; 
else 
return SPSR_EL1; 
elsif PSTATE.EL == EL3 then 
return SPSR_EL1; 


MSR SPSR_EL1, <Xt> 


op0 op1 CRn CRm op2 


0b11 0b000 0b0100 0b0000 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == '@1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x160] = X[t]; 
else 
SPSR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
SPSR_EL2 = X[t]; 
else 
SPSR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
SPSR_EL1 = X[t]; 
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MRS <Xt>, SPSR_EL12 





op0 op1 CRn CRm 


0b11 0b101 0b0100 0b0000 


op2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x160] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return SPSR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return SPSR_EL1; 
else 
UNDEFINED; 


MSR SPSR_EL12, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b101 0b0100 0b0000 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x160] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
SPSR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
SPSR_EL1 = X[t]; 
else 
UNDEFINED; 
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MRS <Xt>, SPSR_EL2 





op0 op1 CRn CRm op2 


0b11 0b100 0b0100 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return SPSR_EL1; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return SPSR_EL2; 
elsif PSTATE.EL == EL3 then 
return SPSR_EL2; 


MSR SPSR_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b0100 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
SPSR_EL1 = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
SPSR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
SPSR_EL2 = X[t]; 
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C5.2.18 


SPSR_EL2, Saved Program Status Register (EL2) 


The SPSR_EL2 characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to EL2. 
Configurations 
AArch64 System register SPSR_EL2[31:0] is architecturally mapped to AArch32 System register 
SPSR_hyp[31:0]. 
This register has no effect if EL2 is not enabled in the current Security state. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_EL2 is a 64-bit register. 


Field descriptions 


The SPSR_EL2 bit assignments are: 


When exception taken from AArch32 state: 


63 


RESO 





32 31 30 29 28 27 26 25 24 23 22 21 2019, 1615 1098765 4 3 0 


M[3:0] 


GE | IT[7:2] 








DIT 


SSBS 
PAN 


C5-426 


An exception return from EL2 using AArch64 makes SPSR_EL2 become UNKNOWN. 


Bits [63:32] 


N, bit [31] 


Z, bit [30] 


C, bit [29] 


V, bit [28] 


Reserved, RESO. 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to EL2, and copied 
to PSTATE.N on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to EL2, and copied to 
PSTATE.Z on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to EL2, and copied to 
PSTATE.C on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to EL2, and copied 
to PSTATE.V on executing an exception return operation in EL2. 
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This field resets to an architecturally UNKNOWN value. 


Q, bit [27] 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to EL2, and 
copied to PSTATE.Q on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to EL2, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in EL2. 


On executing an exception return operation in EL2 SPSR_EL2.IT must contain a value that is valid 
for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


DIT, bit [24] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to EL2, and 
copied to PSTATE.DIT on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to EL2, and 
copied to PSTATE.SSBS on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to EL2, and 
copied to PSTATE.PAN on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SS, bit [21] 


Software Step. Set to the value of PSTATE.SS on taking an exception to EL2, and conditionally 
copied to PSTATE.SS on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to EL2, and copied to 
PSTATE.IL on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to EL2, and 
copied to PSTATE.GE on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 
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IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to EL2, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in EL2. 


SPSR_EL2.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


E, bit [9] 


Endianness. Set to the value of PSTATE.E on taking an exception to EL2, and copied to PSTATE.E 
on executing an exception return operation in EL2. 


If the implementation does not support big-endian operation, SPSR_EL2.E is RESO. If the 
implementation does not support little-endian operation, SPSR_EL2.E is RES1. On executing an 
exception return operation in EL2, if the implementation does not support big-endian operation at 
the Exception level being returned to, SPSR_EL2.E is RESO, and if the implementation does not 
support little-endian operation at the Exception level being returned to, SPSR_EL2.E is RES1. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to EL2, and copied to 
PSTATE.A on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to EL2, and copied to 
PSTATE.I on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to EL2, and copied to 
PSTATE.F on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to EL2, and copied 
to PSTATE.T on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


MIA], bit [4] 


Execution state. Set to 0b1, the value of PSTATE.nRW, on taking an exception to EL2 from AArch32 
state, and copied to PSTATE.nRW on executing an exception return operation in EL2. 


Qb1 AArch32 execution state. 


This field resets to an architecturally UNKNOWN value. 


M[3:0], bits [3:0] 


AArch32 Mode. Set to the value of PSTATE.M[3:0] on taking an exception to EL2, and copied to 
PSTATE.M[3:0] on executing an exception return operation in EL2. 


0b0000 User. 
0b0001 FIQ. 
0b0010 IRQ. 
0b0011 Supervisor. 
0b0111 Abort. 
0b1010 Hyp. 
0b1011 Undefined. 
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Qb1111 System. 


Other values are reserved. If SPSR_EL2.M[3:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in EL2 is an illegal return 
event, as described in ///egal return events from AArch64 state on page D1-2304. 


This field resets to an architecturally UNKNOWN value. 


When exception taken from AArch64 state: 


32 31 30 29 28 27 26 25 24 23 22 21 20 19 |. 131211109 8 7 6 5 4 3 0 
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An exception return from EL2 using AArch64 makes SPSR_EL2 become UNKNOWN. 


Bits [63:32] 


N, bit [31] 


Z, bit [30] 


C, bit [29] 


V, bit [28] 


Bits [27:26] 


TCO, bit [25] 


Reserved, RESO. 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to EL2, and copied 
to PSTATE.N on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to EL2, and copied to 
PSTATE.Z on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to EL2, and copied to 
PSTATE.C on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to EL2, and copied 
to PSTATE.V on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


When ARMV8.5-MemTag is implemented: 


Tag Check Override. Set to the value of PSTATE.TCO on taking an exception to EL2, and copied 
to PSTATE.TCO on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 
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DIT, bit [24] 
When ARMV8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to EL2, and 
copied to PSTATE. DIT on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


UAO, bit [23] 
When ARMV8.2-UAO is implemented: 


User Access Override. Set to the value of PSTATE.UAO on taking an exception to EL2, and copied 
to PSTATE.UAO on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMV8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to EL2, and 
copied to PSTATE.PAN on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SS, bit [21] 
Software Step. Set to the value of PSTATE.SS on taking an exception to EL2, and conditionally 
copied to PSTATE.SS on executing an exception return operation in EL2. 
This field resets to an architecturally UNKNOWN value. 

IL, bit [20] 
Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to EL2, and copied to 
PSTATE.IL on executing an exception return operation in EL2. 
This field resets to an architecturally UNKNOWN value. 

Bits [19:13] 


Reserved, RESO. 


SSBS, bit [12] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to EL2, and 
copied to PSTATE.SSBS on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


BTYPE, bits [11:10] 
When ARMV8.5-BTI is implemented: 


Branch Type Indicator. Set to the value of PSTATE.BTYPE on taking an exception to EL2, and 
copied to PSTATE.BTYPE on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 
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Otherwise: 


Reserved, RESO. 


D, bit [9] 


Debug exception mask. Set to the value of PSTATE.D on taking an exception to EL2, and copied to 
PSTATE.D on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to EL2, and copied to 
PSTATE.A on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to EL2, and copied to 
PSTATE.] on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to EL2, and copied to 
PSTATE.F on executing an exception return operation in EL2. 


This field resets to an architecturally UNKNOWN value. 


Bit [5] 


Reserved, RESO. 


M[4], bit [4] 


Execution state. Set to 0b0, the value of PSTATE.nRW, on taking an exception to EL2 from AArch64 
state, and copied to PSTATE.nRW on executing an exception return operation in EL2. 


Qbd AArch64 execution state. 
If AArch32 is not supported at any Exception level, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


M[3:0], bits [3:0] 
AArch64 Exception level and selected Stack Pointer. 
0b0000 ELOt. 
0b0100 ELIt. 
0b0101 ELth. 
0b1000 EL2t. 
0b1001 EL2h. 


Other values are reserved. If SPSR_EL2.M[3:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in EL2 is an illegal return 
event, as described in ///egal return events from AArch64 state on page D1-2304. 


The bits in this field are interpreted as follows: 


a M[3:2] is set to the value of PSTATE.EL on taking an exception to EL2 and copied to 
PSTATE.EL on executing an exception return operation in EL2. 


° M[1] is unused and is 0 for all non-reserved values. 


$ M[0] is set to the value of PSTATE.SP on taking an exception to EL2 and copied to 
PSTATE.SP on executing an exception return operation in EL2 


This field resets to an architecturally UNKNOWN value. 
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C5-432 


Accessing the SPSR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic SPSR_EL2 or 
SPSR_EL] are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SPSR_EL2 























op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return SPSR_EL1; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return SPSR_EL2; 
elsif PSTATE.EL == EL3 then 
return SPSR_EL2; 
MSR SPSR_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
SPSR_EL1 = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
SPSR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
SPSR_EL2 = X[t]; 
MRS <Xt>, SPSR_EL1 
op0 op1 CRn CRm op2 
0b0000 0b000 


0b11 0b000 0b0100 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
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return NVMem[0x160] ; 
else 
return SPSR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return SPSR_EL2; 
else 
return SPSR_EL1; 
elsif PSTATE.EL == EL3 then 
return SPSR_EL1; 


MSR SPSR_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b0100 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x160] = X[t]; 
else 
SPSR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
SPSR_EL2 = X[t]; 
else 
SPSR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
SPSR_EL1 = X[t]; 
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C5.2.19 SPSR_EL3, Saved Program Status Register (EL3) 


The SPSR_EL3 characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to EL3. 
Configurations 
AArch64 System register SPSR_EL3[31:0] can be mapped to AArch32 System register 
SPSR_mon[31:0], but this is not architecturally mandated. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_EL3 is a 64-bit register. 


Field descriptions 


The SPSR_EL3 bit assignments are: 


When exception taken from AArch32 state: 


63 32 31 30 29 28 27 26 25 24 23 22 21 2019, 1615 1098765 4 3 0 


RESO GE | IT[7:2] M[3:0] 
IT[1:0] = e 
DIT 


SSBS 
PAN 












An exception return from EL3 using AArch64 makes SPSR_EL1 become UNKNOWN. 
Bits [63:32] 

Reserved, RESO. 
N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to EL3, and copied 
to PSTATE.N on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to EL3, and copied to 
PSTATE.Z on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to EL3, and copied to 
PSTATE.C on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to EL3, and copied 
to PSTATE.V on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
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Q, bit [27] 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to EL3, and 
copied to PSTATE.Q on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to EL3, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in EL3. 


On executing an exception return operation in EL3 SPSR_EL1.IT must contain a value that is valid 
for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


DIT, bit [24] 
When ARMV8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to EL3, and 
copied to PSTATE. DIT on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to EL3, and 
copied to PSTATE.SSBS on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMV8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to EL3, and 
copied to PSTATE.PAN on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SS, bit [21] 


Software Step. Set to the value of PSTATE.SS on taking an exception to EL3, and conditionally 
copied to PSTATE.SS on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to EL3, and copied to 
PSTATE.IL on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to EL3, and 
copied to PSTATE.GE on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
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IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to EL3, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in EL3. 


SPSR_EL1.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


E, bit [9] 


Endianness. Set to the value of PSTATE.E on taking an exception to EL3, and copied to PSTATE.E 
on executing an exception return operation in EL3. 


If the implementation does not support big-endian operation, SPSR_EL1.E is RESO. If the 
implementation does not support little-endian operation, SPSR_EL1.E is RES1. On executing an 
exception return operation in EL3, if the implementation does not support big-endian operation at 
the Exception level being returned to, SPSR_EL1.E is RESO, and if the implementation does not 
support little-endian operation at the Exception level being returned to, SPSR_EL1.E is RES1. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to EL3, and copied to 
PSTATE.A on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to EL3, and copied to 
PSTATE.] on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to EL3, and copied to 
PSTATE.F on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to EL3, and copied 
to PSTATE.T on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


M{4], bit [4] 


Execution state. Set to 0b1, the value of PSTATE.nRW, on taking an exception to EL3 from AArch32 
state, and copied to PSTATE.nRW on executing an exception return operation in EL3. 


Qb1 AArch32 execution state. 


This field resets to an architecturally UNKNOWN value. 


M[3:0], bits [3:0] 


AArch32 Mode. Set to the value of PSTATE.M[3:0] on taking an exception to EL3, and copied to 
PSTATE.M[3:0] on executing an exception return operation in EL3. 


0b0000 User. 
0b0001 FIQ. 
0b0010 IRQ. 
0b0011 Supervisor. 
0b0110 Monitor. 
0b0111 Abort. 
0b1010 Hyp. 
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0b1011 Undefined. 
Qb1111 System. 


Other values are reserved. If SPSR_EL1.M[3:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in EL3 is an illegal return 
event, as described in ///egal return events from AArch64 state on page D1-2304. 


This field resets to an architecturally UNKNOWN value. 


When exception taken from AArch64 state: 


32 31 30 29 28 27 26 25 24 23 22 21 20 19 .. 131211109 8 7 6 5 4 3 0 


RESO 





RESO 





An exception return from EL3 using AArch64 makes SPSR_EL1 become UNKNOWN. 


Bits [63:32] 


N, bit [31] 


Z, bit [30] 


C, bit [29] 


V, bit [28] 


Bits [27:26] 


TCO, bit [25] 


Reserved, RESO. 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to EL3, and copied 
to PSTATE.N on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to EL3, and copied to 
PSTATE.Z on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to EL3, and copied to 
PSTATE.C on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to EL3, and copied 
to PSTATE.V on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


When ARMv8.5-MemTag is implemented: 


Tag Check Override. Set to the value of PSTATE.TCO on taking an exception to EL3, and copied 
to PSTATE.TCO on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
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Otherwise: 


Reserved, RESO. 


DIT, bit [24] 
When ARMV8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to EL3, and 
copied to PSTATE.DIT on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


UAO, bit [23] 
When ARMV8.2-UAO is implemented: 


User Access Override. Set to the value of PSTATE.UAO on taking an exception to EL3, and copied 
to PSTATE.UAO on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMV8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to EL3, and 
copied to PSTATE.PAN on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SS, bit [21] 


Software Step. Set to the value of PSTATE.SS on taking an exception to EL3, and conditionally 
copied to PSTATE.SS on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to EL3, and copied to 
PSTATE.IL on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


Bits [19:13] 
Reserved, RESO. 


SSBS, bit [12] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to EL3, and 
copied to PSTATE.SSBS on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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BTYPE, bits [11:10] 
When ARMV8.5-BTI is implemented: 


Branch Type Indicator. Set to the value of PSTATE.BTYPE on taking an exception to EL3, and 
copied to PSTATE.BTYPE on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


D, bit [9] 


Debug exception mask. Set to the value of PSTATE.D on taking an exception to EL3, and copied to 
PSTATE.D on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to EL3, and copied to 
PSTATE.A on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to EL3, and copied to 
PSTATE.] on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to EL3, and copied to 
PSTATE.F on executing an exception return operation in EL3. 


This field resets to an architecturally UNKNOWN value. 


Bit [5] 


Reserved, RESO. 


M[4], bit [4] 


Execution state. Set to 0b0, the value of PSTATE.nRW, on taking an exception to EL3 from AArch64 
state, and copied to PSTATE.nRW on executing an exception return operation in EL3. 


Qbd AArch64 execution state. 
If AArch32 is not supported at any Exception level, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


MJ[3:0], bits [3:0] 
AArch64 Exception level and selected Stack Pointer. 
0b0000 ELOt. 
0b0100 ELIt. 
0b0101 ELth. 
0b1000 EL2t. 
0b1001 EL2h. 
0b1100 EL3t. 
0b1101 EL3h. 


Other values are reserved. If SPSR_EL1.M[3:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in EL3 is an illegal return 
event, as described in ///egal return events from AArch64 state on page D1-2304. 
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C5-440 


The bits in this field are interpreted as follows: 


M[3:2] is set to the value of PSTATE.EL on taking an exception to EL3 and copied to 
PSTATE.EL on executing an exception return operation in EL3. 


M[1] is unused and is 0 for all non-reserved values. 


M[0] is set to the value of PSTATE.SP on taking an exception to EL3 and copied to 
PSTATE.SP on executing an exception return operation in EL3 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SPSR_EL3 




















op0 op1 CRn CRm op2 
0b11 0b110 0b0100 0b0000 0b000 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return SPSR_EL3; 
MSR SPSR_EL3, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b110 0b0100 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
SPSR_EL3 = X[t]; 
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63 





IT[1:0] | 
SSBS 


PAN 


ARM DDI 0487E.a 
ID070919 


The SPSR_fiq characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to FIQ mode. 
Configurations 
AArch64 System register SPSR_fiq[31:0] is architecturally mapped to AArch32 System register 
SPSR_fiq[3 1:0]. 
If EL1 does not support execution in AArch32 state, this register is RESO. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_fiq is a 64-bit register. 


Field descriptions 


The SPSR_fiq bit assignments are: 






RESO 


Bits [63:32] 


N, bit [31] 


Z, bit [30] 


C, bit [29] 


V, bit [28] 


Q, bit [27] 


32 31 30 29 28 27 26 25 24 23 22 21 20 19., 1615 1098765 4 


GE | IT[7:2] 





0 
M[4:0] 
DIT 





Reserved, RESO. 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to FIQ mode, and 
copied to PSTATE.N on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to FIQ mode, and copied 
to PSTATE.Z on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to FIQ mode, and copied 
to PSTATE.C on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to FIQ mode, and 
copied to PSTATE.V on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to FIQ mode, and 
copied to PSTATE.Q on executing an exception return operation in FIQ mode. 
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This field resets to an architecturally UNKNOWN value. 


IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to FIQ mode, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in FIQ mode. 


On executing an exception return operation in FIQ mode SPSR_fiq.IT must contain a value that is 
valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to FIQ mode, 
and copied to PSTATE.SSBS on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to FIQ mode, and 
copied to PSTATE.PAN on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to FIQ mode, 
and copied to PSTATE.DIT on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to FIQ mode, and 
copied to PSTATE.IL on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to FIQ mode, 
and copied to PSTATE.GE on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to FIQ mode, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in FIQ mode. 
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SPSR_fiq.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


E, bit [9] 


Endianness. Set to the value of PSTATE.E on taking an exception to FIQ mode, and copied to 
PSTATE.E on executing an exception return operation in FIQ mode. 


If the implementation does not support big-endian operation, SPSR_fiq.E is RESO. If the 
implementation does not support little-endian operation, SPSR_fiq.E is RES1. On executing an 
exception return operation in FIQ mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_fiq.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_fiq.E is 
RES1. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to FIQ mode, and 
copied to PSTATE.A on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to FIQ mode, and copied 
to PSTATE.I on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to FIQ mode, and copied 
to PSTATE.F on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to FIQ mode, and 
copied to PSTATE.T on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to FIQ mode, and copied to 
PSTATE.M[4:0] on executing an exception return operation in FIQ mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10111 Abort. 
0b11011 Undefined. 
Qb11111 System. 





Other values are reserved. If SPSR_fiq.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in FIQ mode is an illegal 
return event, as described in ///egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_fiq 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, SPSR_fiq 














op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0011 0b011 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return SPSR_fiq; 
elsif PSTATE.EL == EL3 then 
return SPSR_fiq; 
MSR SPSR fiq, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0011 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
SPSR_fig = X[t]; 
elsif PSTATE.EL == EL3 then 
SPSR_fig = X[t]; 
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C5.2.21 SPSR_irq, Saved Program Status Register (IRQ mode) 


63 





IT[1:0] | 
SSBS 


PAN 


ARM DDI 0487E.a 
ID070919 


The SPSR_irq characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to IRQ mode. 
Configurations 
AArch64 System register SPSR_irq[31:0] is architecturally mapped to AArch32 System register 
SPSR_irq[31:0]. 
If EL1 does not support execution in AArch32 state, this register is RESO. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_irq is a 64-bit register. 


Field descriptions 


The SPSR_ irq bit assignments are: 






RESO 


Bits [63:32] 


N, bit [31] 


Z, bit [30] 


C, bit [29] 


V, bit [28] 


Q, bit [27] 


32 31 30 29 28 27 26 25 24 23 22 21 20 19., 16 15 1098765 4 


GE | IT[7:2] 





0 
M[4:0] 
DIT 





Reserved, RESO. 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to IRQ mode, and 
copied to PSTATE.N on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to IRQ mode, and copied 
to PSTATE.Z on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to IRQ mode, and copied 
to PSTATE.C on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to IRQ mode, and 
copied to PSTATE.V on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to IRQ mode, and 
copied to PSTATE.Q on executing an exception return operation in IRQ mode. 
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This field resets to an architecturally UNKNOWN value. 


IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to IRQ mode, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in IRQ mode. 


On executing an exception return operation in IRQ mode SPSR_irq.IT must contain a value that is 
valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to IRQ mode, 
and copied to PSTATE.SSBS on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to IRQ mode, and 
copied to PSTATE.PAN on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to IRQ mode, 
and copied to PSTATE.DIT on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to IRQ mode, and 
copied to PSTATE.IL on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to IRQ mode, 
and copied to PSTATE.GE on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to IRQ mode, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in IRQ mode. 
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SPSR_irq.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


E, bit [9] 
Endianness. Set to the value of PSTATE.E on taking an exception to IRQ mode, and copied to 
PSTATE.E on executing an exception return operation in IRQ mode. 
If the implementation does not support big-endian operation, SPSR_irq.E is RESO. If the 
implementation does not support little-endian operation, SPSR_irq.E is RES. On executing an 
exception return operation in IRQ mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_irgq.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_irq.E is 
RES1. 
This field resets to an architecturally UNKNOWN value. 

A, bit [8] 
SError interrupt mask. Set to the value of PSTATE.A on taking an exception to IRQ mode, and 
copied to PSTATE.A on executing an exception return operation in IRQ mode. 
This field resets to an architecturally UNKNOWN value. 

I, bit [7] 
IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to IRQ mode, and copied 
to PSTATE.I on executing an exception return operation in IRQ mode. 
This field resets to an architecturally UNKNOWN value. 

F, bit [6] 
FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to IRQ mode, and copied 
to PSTATE.F on executing an exception return operation in IRQ mode. 
This field resets to an architecturally UNKNOWN value. 

T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to IRQ mode, and 
copied to PSTATE.T on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to IRQ mode, and copied to 
PSTATE.M[4:0] on executing an exception return operation in IRQ mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
Qb10111 Abort. 
0b11011 Undefined. 
Qb11111 System. 





Other values are reserved. If SPSR_irq.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in IRQ mode is an illegal 
return event, as described in //legal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_irq 


Accesses to this register use the following encodings in the System instruction encoding space: 
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C5-448 


MRS <Xt>, SPSR_irq 














op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0011 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return SPSR_irq; 
elsif PSTATE.EL == EL3 then 
return SPSR_irq; 
MSR SPSR_irq, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0011 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
SPSR_irg = X[t]; 
elsif PSTATE.EL == EL3 then 
SPSR_irg = X[t]; 
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C5.2.22 SPSR_und, Saved Program Status Register (Undefined mode) 


63 





IT[1:0] | 
SSBS 


PAN 
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The SPSR_und characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to Undefined mode. 
Configurations 
AArch64 System register SPSR_und[31:0] is architecturally mapped to AArch32 System register 
SPSR_und[31:0]. 
If EL1 does not support execution in AArch32 state, this register is RESO. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_und is a 64-bit register. 


Field descriptions 


The SPSR_und bit assignments are: 






RESO 


Bits [63:32] 


N, bit [31] 


Z, bit [30] 


C, bit [29] 


V, bit [28] 


Q, bit [27] 


32 31 30 29 28 27 26 25 24 23 22 21 20 19., 1615 1098765 4 


GE | IT[7:2] 





0 
M[4:0] 
DIT 





Reserved, RESO. 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to Undefined mode, 

and copied to PSTATE.N on executing an exception return operation in Undefined mode. 

This field resets to an architecturally UNKNOWN value. 

Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to Undefined mode, and 

copied to PSTATE.Z on executing an exception return operation in Undefined mode. 

This field resets to an architecturally UNKNOWN value. 

Carry Condition flag. Set to the value of PSTATE.C on taking an exception to Undefined mode, and 

copied to PSTATE.C on executing an exception return operation in Undefined mode. 

This field resets to an architecturally UNKNOWN value. 

Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to Undefined mode, 

and copied to PSTATE.V on executing an exception return operation in Undefined mode. 

This field resets to an architecturally UNKNOWN value. 

Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to Undefined 

mode, and copied to PSTATE.Q on executing an exception return operation in Undefined mode. 
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This field resets to an architecturally UNKNOWN value. 


IT[1:0], bits [26:25] 
If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to Undefined mode, and copied 
to PSTATE.IT[1:0] on executing an exception return operation in Undefined mode. 


On executing an exception return operation in Undefined mode SPSR_und.IT must contain a value 
that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to Undefined 
mode, and copied to PSTATE.SSBS on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to Undefined 
mode, and copied to PSTATE.PAN on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMV8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to Undefined 
mode, and copied to PSTATE.DIT on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to Undefined mode, 
and copied to PSTATE.IL on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to Undefined 
mode, and copied to PSTATE.GE on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to Undefined mode, and copied 
to PSTATE.IT[7:2] on executing an exception return operation in Undefined mode. 
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SPSR_und.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


E, bit [9] 


Endianness. Set to the value of PSTATE.E on taking an exception to Undefined mode, and copied 
to PSTATE.E on executing an exception return operation in Undefined mode. 


If the implementation does not support big-endian operation, SPSR_und.E is RESO. If the 
implementation does not support little-endian operation, SPSR_und.E is RES1. On executing an 
exception return operation in Undefined mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_und.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_und.E is 
RES1. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to Undefined mode, 
and copied to PSTATE.A on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to Undefined mode, and 
copied to PSTATE.I on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to Undefined mode, and 
copied to PSTATE.F on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to Undefined mode, 
and copied to PSTATE.T on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to Undefined mode, and copied 
to PSTATE.M[4:0] on executing an exception return operation in Undefined mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
Qb10111 Abort. 
0b11011 Undefined. 
Qb11111 System. 





Other values are reserved. If SPSR_und.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in Undefined mode is an 
illegal return event, as described in ///egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_und 


Accesses to this register use the following encodings in the System instruction encoding space: 
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C5-452 


MRS <Xt>, SPSR_und 














op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0011 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return SPSR_und; 
elsif PSTATE.EL == EL3 then 
return SPSR_und; 
MSR SPSR_und, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0100 0b0011 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
SPSR_und = X[t]; 
elsif PSTATE.EL == EL3 then 
SPSR_und = X[t]; 
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C5.2.23 SSBS, Speculative Store Bypass Safe 


The SSBS characteristics are: 


Purpose 
Allows access to the Speculative Store Bypass Safe bit. 

Configurations 
This register is present only when ARMV8.0-SSBS is implemented. Otherwise, direct accesses to 
SSBS are UNDEFINED. 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


SSBS is a 64-bit register. 


Field descriptions 


The SSBS bit assignments are: 
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Bits [63:13] 


SSBS, bit [12] 
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13 12 11 0 


RESO RESO 


Reserved, RESO. 


Speculative Store Bypass Safe. 
Prohibits speculative loads or stores which might practically allow a cache timing side channel. 


A cache timing side channel might be exploited where a load or store uses an address that is derived 
from a register that is being loaded from memory using a load instruction speculatively read from a 
memory location. If PSTATE.SSBS is enabled, the address derived from the load instruction might 
be from earlier in the coherence order than the latest store to that memory location with the same 
virtual address. 


Qbd Hardware is not permitted to load or store speculatively, in a manner that could 
practically give rise to a cache timing side channel, using an address derived from a 
register value that has been loaded from memory using a load instruction (L) that 
speculatively reads an entry from earlier in the coherence order from that location being 
loaded from than the entry generated by the latest store (S) to that location using the 
same virtual address as L. 


Qb1 Hardware is permitted to load or store speculatively, in a manner that could practically 
give rise to a cache timing side channel, using an address derived from a register value 
that has been loaded from memory using a load instruction (L) that speculatively reads 
an entry from earlier in the coherence order fro that location being loaded from than the 
entry generated by the latest store (S) to that location using the same virtual address as L. 


The value of this bit is set to the value in the SCTLR_ELx.DSSBS field on taking an exception to 
ELx. 


This field resets to an IMPLEMENTATION DEFINED value. 
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C5-454 


Bits [11:0] 


Reserved, RESO. 


Accessing the SSBS 


For details on the operation of the MSR (immediate) accessor, see MSR (immediate) in the Arm® Architecture 


Reference Manual, Armv8, for Armv8-A architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SSBS 


if PSTATE.EL == EL@ then 











return Zeros(51):PSTATE.SSBS:Zeros(12); 


elsif PSTATE.EL == EL1 then 


return Zeros(51):PSTATE.SSBS:Zeros(12); 


elsif PSTATE.EL == EL2 then 


return Zeros(51):PSTATE.SSBS:Zeros(12); 


elsif PSTATE.EL == EL3 then 


return Zeros(51):PSTATE.SSBS:Zeros(12); 


MSR SSBS, <Xt> 


if PSTATE.EL == ELO then 
PSTATE.SSBS = X[t]<12>; 
elsif PSTATE.EL == EL1 then 
PSTATE.SSBS = X[t]<12>; 
elsif PSTATE.EL == EL2 then 
PSTATE.SSBS = X[t]<12>; 
elsif PSTATE.EL == EL3 then 
PSTATE.SSBS = X[t]<12>; 


MSR SSBS, #<imm> 
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op0 op1 CRn CRm op2 
Ob11 0b011 0b0100 0b0010 0b110 
op0 op1 CRn CRm op2 
0b11 0b011 0b0100 0b0010 0b110 
op0 op1 CRn op2 
0b00 0b011 0b0100 0b001 
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C5.2.24 TCO, Tag Check Override 
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The TCO characteristics are: 


Purpose 
When ARMV8.5-MemTag is implemented, this register allows tag checks to be disabled globally. 
Configurations 
This register is present only when ARMV8.5-MemTag is implemented. Otherwise, direct accesses 
to TCO are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TCO is a 64-bit register. 


Field descriptions 


The TCO bit assignments are: 


26 25 24 0 


RESO RESO 


Bits [63:26] 
Reserved, RESO. 
TCO, bit [25] 
Allows memory tag checks to be globally disabled. 
ObO Loads and Stores are not affected by this control. 


Qb1 Loads and Stores are unchecked. 


Bits [24:0] 


Reserved, RESO. 


Accessing the TCO 
For details on the operation of the MSR (immediate) accessor, see MSR (immediate). 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TCO 





op0 op1 CRn CRm op2 





0b11 0b011 0b0100 0b0010 0b111 





if PSTATE.EL == EL@ then 

return Zeros(38):PSTATE.TCO:Zeros(25); 
elsif PSTATE.EL == EL1 then 

return Zeros(38):PSTATE.TCO:Zeros(25); 
elsif PSTATE.EL == EL2 then 

return Zeros(38):PSTATE.TCO:Zeros(25); 
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elsif PSTATE.EL == EL3 then 
return Zeros(38):PSTATE.TCO:Zeros(25); 


MSR TCO, <Xt> 

















op0 op1 CRn CRm op2 
0b11 0b011 0b0100 0b0010 0b111 
if PSTATE.EL == EL@ then 
PSTATE.TCO = X[t]<25>; 
elsif PSTATE.EL == EL1 then 
PSTATE.TCO = X[t]<25>; 
elsif PSTATE.EL == EL2 then 
PSTATE.TCO = X[t]<25>; 
elsif PSTATE.EL == EL3 then 
PSTATE.TCO = X[t]<25>; 
MSR TCO, #<imm> 
op0 op1 CRn op2 
0b00 0b011 0b0100 0b100 
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C5.2.25 UAO, User Access Override 


The UAO characteristics are: 


Purpose 
Allows access to the User Access Override bit. 
Configurations 
This register is present only when ARMV8.2-UAO is implemented. Otherwise, direct accesses to 
UAO are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


UAO is a 64-bit register. 


Field descriptions 


The UAO bit assignments are: 


63 24 23 22 0 


RESO RESO 


Bits [63:24] 
Reserved, RESO. 
UAO, bit [23] 


User Access Override. 


Oba The behavior of LDTR* and STTR® instructions is as defined in the base Armv8 
architecture. 
Qb1 When executed at EL1, or at EL2 with HCR_EL2. {E2H, TGE} == {1, 1}, LDTR* and 


STTR* instructions behave as the equivalent LDR» and STR» instructions. 


When executed at EL3, or at EL2 with HCR_EL2.E2H == 0 or HCR_EL2.TGE == 0, the LDTR* 
and STTR* instructions behave as the equivalent LDR« and STR« instructions, regardless of the setting 
of the PSTATE.UAO bit. 


Bits [22:0] 


Reserved, RESO. 


Accessing the UAO 


For details on the operation of the MSR (immediate) accessor, see MSR (immediate)in the Arm® Architecture 
Reference Manual, Armv8, for Armv8-A architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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C5-458 


MRS <Xt>, UAO 





op0 op1 CRn 


0b11 0b000 0b0100 


CRm 


0b0010 


op2 


0b100 





if PSTATE.EL == EL@ then 

UNDEFINED; 
elsif PSTATE.EL == EL1 then 

return Zeros(4Q) :PSTATE.UAO:Zeros(23); 
elsif PSTATE.EL == EL2 then 

return Zeros(4Q) :PSTATE.UAO:Zeros(23); 
elsif PSTATE.EL == EL3 then 

return Zeros(4Q) :PSTATE.UAO:Zeros(23); 


MSR UAO, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b0100 


0b0010 


0b100 





if PSTATE.EL == ELO then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
PSTATE.UAO = X[t]<23>; 

elsif PSTATE.EL == EL2 then 
PSTATE.UAO = X[t]<23>; 

elsif PSTATE.EL == EL3 then 
PSTATE.UAO = X[t]<23>; 


MSR UAO, #<imm> 





op0 op1 


0b00 0b000 


CRn 


0b0100 


op2 


0b011 
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C5.3 A64 System instructions for cache maintenance 


This section lists the A64 System instructions for cache maintenance. 
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C5.3.1 
Set/Way 


C5-460 


DC CGDSW, Data, Allocation Tag or unified Cache line Clean of Data and Allocation Tags by 


The DC CGDSW characteristics are: 


Purpose 
Clean data and Allocation Tags in data cache by set/way. 

Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to DC CGDSW are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC CGDSW is a 64-bit System instruction. 


Field descriptions 


The DC CGDSW input value bit assignments are: 


32 31 4 3 1 0 


RESO SetWay tot | | 


Bits [63:32] 


Reserved, RESO. 


SetWay, bits [31:4] 
Contains two fields: 
e Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Log2(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 


Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 


Bit [0] 


Reserved, RESO. 


Executing the DC CGDSW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


The A64 System Instruction Class 
C5.3 A64 System instructions for cache maintenance 


° The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— _ Multiple arbitrary cache lines. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CGDSW, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b1010 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGDSW(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CGDSW(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CGDSW(X[t]); 
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C5.3.2 DC CGDVAC, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by VA to PoC 


The DC CGDVAC characteristics are: 


Purpose 
Clean data and Allocation Tags in data cache by address to Point of Coherency. 
Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented. Otherwise, direct 
accesses to DC CGDVAC are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DC CGDVAC is a 64-bit System instruction. 


Field descriptions 


The DC CGDVAC input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CGDVAC instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, subject to the constraints described in Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CGDVAC, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1010 0b101 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == 'Q@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGDVAC(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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DC_CGDVAC(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CGDVAC(X[t]) ; 
elsif PSTATE.EL == EL3 then 
DC_CGDVAC(X[t]) ; 
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C5.3.3 
PoDP 


C5-464 


DC CGDVADP, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by VA to 


The DC CGDVADP characteristics are: 


Purpose 
Clean Allocation Tags in data cache by address to Point of Deep Persistence. 


If the memory system does not identify a Point of Deep Persistence, then this instruction behaves 
as a DC CGVAP. 


Configurations 


This instruction is present only when ARMv8.2-DCCVADP is implemented and 
ARMv8.5-MemtTag is implemented. Otherwise, direct accesses to DC CGDVADP are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DC CGDVADP is a 64-bit System instruction. 


Field descriptions 


The DC CGDVADP input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CGDVADP instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, see Permission fault on page D5S-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CGDVADP, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1101 0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGDVADP(X[t]); 
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elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGDVADP(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CGDVADP(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CGDVADP(X[t]); 
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C5.3.4 
VA to PoP 


C5-466 


DC CGDVAP, Data, Allocation Tag or unified Cache line Clean of Data and Allocation Tags by 


The DC CGDVAP characteristics are: 


Purpose 
Clean data and Allocation Tags in data cache by address to Point of Persistence. 
If the memory system does not identify a Point of Persistence, then this instruction behaves as a DC 
CGDVAC. 

Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented. Otherwise, direct 
accesses to DC CGDVAP are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC CGDVAP is a 64-bit System instruction. 


Field descriptions 


The DC CGDVAP input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CGDVAP instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, see Permission fault on page D5S-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CGDVAP, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1100 0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGDVAP(X[t]); 
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elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGDVAP(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CGDVAP(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CGDVAP(X[t]); 
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C5.3.5 


C5-468 


DC CGSW, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by Set/Way 


The DC CGSW characteristics are: 


Purpose 
Clean Allocation Tags in data cache by set/way. 

Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to DC CGSW are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC CGSW is a 64-bit System instruction. 


Field descriptions 


The DC CGSW input value bit assignments are: 


32 31 4 3 1 0 


RESO SetWay tot | | 


Bits [63:32] 
Reserved, RESO. 
SetWay, bits [31:4] 
Contains two fields: 
° Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Log:(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 


Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 


Bit [0] 


Reserved, RESO. 


Executing the DC CGSW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED. 


$ The instruction performs cache maintenance on one of: 


—  Nocache lines. 
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A single arbitrary cache line. 


Multiple arbitrary cache lines. 


Accesses to this register use the following encodings in the System instruction encoding space: 
DC CGSW, <Xt> 


op0 


op1 CRn CRm op2 
0b01 0b000 0b0111 0b1010 
if PSTATE.EL == EL@ then 
UNDEFINED; 


elsif PSTATE.EL == EL1 then 








0b100 





if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 


DC_CGSW(X[t]); 

elsif PSTATE.EL == EL2 then 
DC_CGSW(X[t]); 

elsif PSTATE.EL == EL3 then 
DC_CGSW(X[t]); 
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C5.3.6 DC CGVAC, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by VA to PoC 


The DC CGVAC characteristics are: 


Purpose 
Clean Allocation Tags in data cache by address to Point of Coherency. 
Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented. Otherwise, direct 
accesses to DC CGVAC are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DC CGVAC is a 64-bit System instruction. 


Field descriptions 


The DC CGVAC input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CGVAC instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, subject to the constraints described in Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CGVAC, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1010 0b011 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == 'Q@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGVAC(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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DC_CGVAC(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CGVAC(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CGVAC(X[t]); 
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C5.3.7 DC CGVADP, Data, Allocation Tag or unified Cache line Clean of Data and Allocation Tags by 
VA to PoDP 


The DC CGVADP characteristics are: 


Purpose 
Clean data and Allocation Tags in data cache by address to Point of Deep Persistence. 


If the memory system does not identify a Point of Deep Persistence, then this instruction behaves 
as a DC CGDVAP. 


Configurations 


This instruction is present only when ARMv8.2-DCCVADP is implemented and 
ARMv8.5-MemtTag is implemented. Otherwise, direct accesses to DC CGVADP are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DC CGVADP is a 64-bit System instruction. 


Field descriptions 


The DC CGVADP input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CGVADP instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, see Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CGVADP, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1101 0b011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGVADP(X[t]); 
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elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGVADP(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CGVADP(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CGVADP(X[t]); 
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C5.3.8 DC CGVAP, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by VA to PoP 


The DC CGVAP characteristics are: 


Purpose 
Clean Allocation Tags in data cache by address to Point of Persistence. 
If the memory system does not identify a Point of Persistence, then this instruction behaves as a DC 
CGVAC. 

Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented. Otherwise, direct 
accesses to DC CGVAP are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC CGVAP is a 64-bit System instruction. 


Field descriptions 


The DC CGVAP input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CGVAP instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, see Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CGVAP, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 Ob0111 0b1100 0b011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGVAP(X[t]); 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CGVAP(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CGVAP(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CGVAP(X[t]); 
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C5.3.9 


DC CIGDSW, Data, Allocation Tag or unified Cache line Clean and Invalidate of Data and 


Allocation Tags by Set/Way 


C5-476 


The DC CIGDSW characteristics are: 


Purpose 
Clean and Invalidate data and Allocation Tags in data cache by set/way. 

Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented and 
ID_AA64PFR1_EL1.MTE != 0b0001. Otherwise, direct accesses to DC CIGDSW are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC CIGDSW is a 64-bit System instruction. 


Field descriptions 


The DC CIGDSW input value bit assignments are: 


32 31 4 3 1 0 


RESO SetWay tot | | 


Bits [63:32] 


Reserved, RESO. 


SetWay, bits [31:4] 
Contains two fields: 
e Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Log2(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 


Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 


Bit [0] 


Reserved, RESO. 


Executing the DC CIGDSW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED. 
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° The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— Multiple arbitrary cache lines. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CIGDSW, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b1110 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CIGDSW(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CIGDSW(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CIGDSW(X[t]); 
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C5.3.10 


DC CIGDVAC, Data, Allocation Tag or unified Cache line Clean and Invalidate of Data and 


Allocation Tags by VA to PoC 


C5-478 


The DC CIGDVAC characteristics are: 


Purpose 
Clean and Invalidate data and Allocation Tags in data cache by address to Point of Coherency. 
Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented. Otherwise, direct 
accesses to DC CIGDVAC are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DC CIGDVAC is a 64-bit System instruction. 


Field descriptions 


The DC CIGDVAC input value bit assignments are: 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CIGDVAC instruction 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, subject to the constraints described in Permission fault on page D5-2623. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CIGDVAC, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1110 0b101 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CIGDVAC(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


else 
DC_CIGDVAC(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CIGDVAC(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CIGDVAC(X[t]); 
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C5.3.11 
by Set/Way 


C5-480 


DC CIGSW, Data, Allocation Tag or unified Cache line Clean and Invalidate of Allocation Tags 


The DC CIGSW characteristics are: 


Purpose 
Clean and Invalidate Allocation Tags in data cache by set/way. 

Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to DC CIGSW are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC CIGSW is a 64-bit System instruction. 


Field descriptions 


The DC CIGSW input value bit assignments are: 


32 31 4 3 1 0 


RESO SetWay tot | | 


Bits [63:32] 


Reserved, RESO. 


SetWay, bits [31:4] 
Contains two fields: 
e Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Log2(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 


Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 


Bit [0] 


Reserved, RESO. 


Executing the DC CIGSW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED. 
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° The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— Multiple arbitrary cache lines. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CIGSW, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b1110 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CIGSW(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CIGSW(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CIGSW(X[t]); 
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C5.3.12 DC CIGVAC, Data, Allocation Tag or unified Cache line Clean and Invalidate of Allocation Tags 
by VA to PoC 
The DC CIGVAC characteristics are: 
Purpose 
Clean and Invalidate Allocation Tags in data cache by address to Point of Coherency. 
Configurations 
This instruction is present only when ARMv8.5-MemtTag is implemented. Otherwise, direct 
accesses to DC CIGVAC are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 
DC CIGVAC is a 64-bit System instruction. 
Field descriptions 
The DC CIGVAC input value bit assignments are: 
63 0 
Virtual address to use 
Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 
Executing the DC CIGVAC instruction 
Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 
If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, subject to the constraints described in Permission fault on page D5-2623. 
Accesses to this register use the following encodings in the System instruction encoding space: 
DC CIGVAC, <Xt> 
op0 op1 CRn CRm op2 
0b01 0b011 0b0111 0b1110 0b011 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CIGVAC(X[t]) ; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
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else 
DC_CIGVAC(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CIGVAC(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CIGVAC(X[t]); 
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C5.3.13 DC CISW, Data or unified Cache line Clean and Invalidate by Set/Way 
The DC CISW characteristics are: 


Purpose 
Clean and Invalidate data cache by set/way. 


When ARMv8.5-MemTag is implemented, this instruction might clean and invalidate Allocation 
Tags from caches. 


Configurations 


AArch64 System instruction DC CISW performs the same function as AArch32 System instruction 
DCCISW. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DC CISW is a 64-bit System instruction. 


Field descriptions 


The DC CISW input value bit assignments are: 


63 32 31 4 3 1 0 


RESO SetWay tot | | 


Bits [63:32] 
Reserved, RESO. 
SetWay, bits [31:4] 
Contains two fields: 
s Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Log2(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 


Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 


Bit [0] 


Reserved, RESO. 


Executing the DC CISW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED. 
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° The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— Multiple arbitrary cache lines. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CISW, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b1110 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CISW(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CISW(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CISW(X[t]); 
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C5.3.14 DC CIVAC, Data or unified Cache line Clean and Invalidate by VA to PoC 
The DC CIVAC characteristics are: 


Purpose 
Clean and Invalidate data cache by address to Point of Coherency. 


When ARMv8.5-MemTag is implemented, this instruction might clean and invalidate Allocation 
Tags from caches. 


Configurations 


AArch64 System instruction DC CIVAC performs the same function as AArch32 System 
instruction DCCIMVAC. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DC CIVAC is a 64-bit System instruction. 


Field descriptions 


The DC CIVAC input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CIVAC instruction 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, subject to the constraints described in Permission fault on page D5-2623. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CIVAC, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 Ob0111 0b1110 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CIVAC(X[t]); 
elsif PSTATE.EL == EL1 then 


C5-486 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The A64 System Instruction Class 
C5.3 A64 System instructions for cache maintenance 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CIVAC(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CIVAC(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CIVAC(X[t]); 
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C5.3.15 DC CSW, Data or unified Cache line Clean by Set/Way 
The DC CSW characteristics are: 


Purpose 
Clean data cache by set/way. 


When ARMv8.5-MemTag is implemented, this instruction might clean Allocation Tags from 
caches. 


Configurations 


AArch64 System instruction DC CSW performs the same function as AArch32 System instruction 
DCCSW. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DC CSW is a 64-bit System instruction. 


Field descriptions 


The DC CSW input value bit assignments are: 


63 32 31 4 3 1 0 


RESO SetWay tot | | 


Bits [63:32] 
Reserved, RESO. 
SetWay, bits [31:4] 
Contains two fields: 
s Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Log2(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 


Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 


Bit [0] 


Reserved, RESO. 


Executing the DC CSW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED. 
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° The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— Multiple arbitrary cache lines. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CSW, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b1010 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CSW(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CSW(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CSw(X[t]); 
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C5.3.16 DC CVAC, Data or unified Cache line Clean by VA to PoC 
The DC CVAC characteristics are: 


Purpose 
Clean data cache by address to Point of Coherency. 


When ARMv8.5-MemTag is implemented, this instruction might clean Allocation Tags from 
caches. 


Configurations 


AArch64 System instruction DC CVAC performs the same function as AArch32 System instruction 
DCCMVAC. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DC CVAC is a 64-bit System instruction. 


Field descriptions 


The DC CVAC input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CVAC instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, subject to the constraints described in Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CVAC, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CVAC(X[t]); 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 


DC_CVAC(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CVAC(X[t]); 


elsif PSTATE.EL == 


EL3 then 
DC_CVAC(X[t]); 
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C5.3.17 


C5-492 


DC CVADP, Data or unified Cache line Clean by VA to PoDP 


The DC CVADP characteristics are: 


Purpose 
Clean data cache by address to Point of Deep Persistence. 


If the memory system does not identify a Point of Deep Persistence, then this instruction behaves 
as a DC CVAP. 


When ARMv8.5-MemTag is implemented, this instruction might clean Allocation Tags from 
caches. 


Configurations 


This instruction is present only when ARMv8.2-DCCVADP is implemented. Otherwise, direct 
accesses to DC CVADP are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DC CVADP is a 64-bit System instruction. 


Field descriptions 


The DC CVADP input value bit assignments are: 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CVADP instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, see Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CVADP, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1101 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == 'Q@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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DC_CVADP(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CVADP(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CVADP(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CVADP(X[t]); 
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C5.3.18 


C5-494 


DC CVAP, Data or unified Cache line Clean by VA to PoP 


The DC CVAP characteristics are: 


Purpose 
Clean data cache by address to Point of Persistence. 
If the memory system does not identify a Point of Persistence, then this instruction behaves as a DC 
CVAC. 
When ARMv8.5-MemTag is implemented, this instruction might clean Allocation Tags from 
caches. 

Configurations 
This instruction is present only when ARMv8.2-DCPoP is implemented. Otherwise, direct accesses 
to DC CVAP are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC CVAP is a 64-bit System instruction. 


Field descriptions 


The DC CVAP input value bit assignments are: 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CVAP instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, see Permission fault on page DS-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CVAP, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1100 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == 'Q@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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DC_CVAP(X[t]); 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CVAP(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CVAP(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CVAP(X[t]); 
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C5.3.19 


C5-496 


DC CVAU, Data or unified Cache line Clean by VA to PoU 


The DC CVAU characteristics are: 


Purpose 
Clean data cache by address to Point of Unification. 
Configurations 
AArch64 System instruction DC CVAU performs the same function as AArch32 System instruction 
DCCMVAU. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DC CVAU is a 64-bit System instruction. 


Field descriptions 


The DC CVAU input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC CVAU instruction 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it generates a Permission Fault, subject to the constraints described in Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC CVAU, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b1011 0b001 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == 'Q@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPU == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TOCU == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CVAU(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPU == '1' then 
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AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TOCU == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_CVAU(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_CVAU(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_CVAU(X[t]); 
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C5.3.20 


C5-498 


DC GVA, Data Cache set Allocation Tag by VA 


The DC GVA characteristics are: 


Purpose 
Write a value to the Allocation Tags of a naturally aligned block of N bytes, where the size of N is 
identified in DCZID_ELO. The Allocation Tag used is determined by the input address. 
Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented. Otherwise, direct 
accesses to DC GVA are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DC GVA is a 64-bit System instruction. 


Field descriptions 


The DC GVA input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 


Virtual address to use. There is no alignment restriction on the address within the block of N bytes 
that is used. 


Executing the DC GVA instruction 


When this instruction is executed, it can generate memory faults or watchpoints which are prioritized in the same 
way as other memory-related faults or watchpoints. If a synchronous data abort fault or a watchpoint is generated, 
the CM bit in the ESR_ELx.ISS field is not set. 


Ifthe memory region being zeroed is any type of Device memory, this instruction can give an alignment fault which 
is prioritized in the same way as other alignment faults that are determined by the memory type. 


This instruction applies to Normal memory regardless of cacheability attributes. 


This instruction behaves as a set of Stores to each byte within the block being accessed, and so it: 


$ Generates a Permission Fault if the translation system does not permit writes to the locations. 
a Requires the same considerations for ordering and the management of coherency as any other store 
instructions. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC GVA, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 Ob0111 0b0100 0b011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.DZE == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
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else 
AArch64.SystemAccessTrap(EL1, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TDZ == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.DZE == 'Q' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_GVA(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TDZ == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_GVA(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_GVA(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_GVA(X[t]); 
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C5.3.21 


C5-500 


DC GZVA, Data Cache set Allocation Tags and Zero by VA 


The DC GZVA characteristics are: 


Purpose 
Zero data and write a value to the Allocation Tags of a naturally aligned block of N bytes, where the 
size of N is identified in DCZID_ELO. The Allocation Tag used is determined by the input address. 
Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented. Otherwise, direct 
accesses to DC GZVA are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DC GZVA is a 64-bit System instruction. 


Field descriptions 


The DC GZVA input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 


Virtual address to use. There is no alignment restriction on the address within the block of N bytes 
that is used. 


Executing the DC GZVA instruction 


When this instruction is executed, it can generate memory faults or watchpoints which are prioritized in the same 
way as other memory-related faults or watchpoints. If a synchronous data abort fault or a watchpoint is generated, 
the CM bit in the ESR_ELx.ISS field is not set. 


Ifthe memory region being zeroed is any type of Device memory, this instruction can give an alignment fault which 
is prioritized in the same way as other alignment faults that are determined by the memory type. 


This instruction applies to Normal memory regardless of cacheability attributes. 


This instruction behaves as a set of Stores to each byte within the block being accessed, and so it: 


$ Generates a Permission Fault if the translation system does not permit writes to the locations. 
` Requires the same considerations for ordering and the management of coherency as any other store 
instructions. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC GZVA, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 Ob0111 0b0100 0b100 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.DZE == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
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AArch64.SystemAccessTrap(EL1, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TDZ == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


DC_GZVA(X[t]); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.DZE == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 

else 

elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TDZ == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 


DC_GZVA(X[t]); 

elsif PSTATE.EL == EL2 then 
DC_GZVA(X[t]); 

elsif PSTATE.EL == 


EL3 then 
DC_GZVA(X[t]); 
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C5.3.22 
by Set/Way 


C5-502 


DC IGDSW, Data, Allocation Tag or unified Cache line Invalidate of Data and Allocation Tags 


The DC IGDSW characteristics are: 


Purpose 
Invalidate data and Allocation Tags in data cache by set/way. 

Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented and 
ID_AA64PFRI1_EL1.MTE != 0b0001. Otherwise, direct accesses to DC IGDSW are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC IGDSW is a 64-bit System instruction. 


Field descriptions 


The DC IGDSW input value bit assignments are: 


32 31 4 3 1 0 


RESO SetWay tot | | 


Bits [63:32] 


Reserved, RESO. 


SetWay, bits [31:4] 
Contains two fields: 
e Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Log2(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 


Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 


Bit [0] 


Reserved, RESO. 


Executing the DC IGDSW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED. 
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° The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— Multiple arbitrary cache lines. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC IGDSW, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b0110 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.SWIO == '1' then 
DC_CIGDSW(X[t]); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<DC,VM> != 
DC_CIGDSW(X[t]); 
else 
DC_IGDSW(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_IGDSW(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_IGDSW(X[t]); 


'00' then 
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C5.3.23 


PoC 


C5-504 


DC IGDVAC, Data, Allocation Tag or unified Cache line Invalidate of Allocation Tags by VA to 


The DC IGDVAC characteristics are: 


Purpose 
Invalidate data and Allocation Tags in data cache by address to Point of Coherency. 
Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to DC IGDVAC are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DC IGDVAC is a 64-bit System instruction. 


Field descriptions 


The DC IGDVAC input value bit assignments are: 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC IGDVAC instruction 


When the instruction is executed, it can generate a watchpoint, which is prioritized in the same way as other 
watchpoints. If a watchpoint is generated, the CM bit in the ESR_ELx.ISS field is set to 1. 


This instruction requires write access permission to the VA, otherwise it generates a Permission Fault, subject to the 
constraints described in Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC IGDVAC, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b0110 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<DC,VM> != '@@' then 
DC_CIGDVAC(X[t]); 
else 
DC_IGDVAC(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_IGDVAC(X[t]); 
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elsif PSTATE.EL == EL3 then 
DC_IGDVAC(X[t]); 
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C5.3.24 


C5-506 


DC IGSW, Data, Allocation Tag or unified Cache line Invalidate of Allocation Tags by Set/Way 


The DC IGSW characteristics are: 


Purpose 
Invalidate Allocation Tags in data cache by set/way. 

Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to DC IGSW are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC IGSW is a 64-bit System instruction. 


Field descriptions 


The DC IGSW input value bit assignments are: 


32 31 4 3 1 0 


RESO SetWay tot | | 


Bits [63:32] 
Reserved, RESO. 
SetWay, bits [31:4] 
Contains two fields: 
° Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Log:(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 


Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 


Bit [0] 


Reserved, RESO. 


Executing the DC IGSW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED. 


$ The instruction performs cache maintenance on one of: 


—  Nocache lines. 
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A single arbitrary cache line. 


Multiple arbitrary cache lines. 


Accesses to this register use the following encodings in the System instruction encoding space: 
DC IGSW, <Xt> 











op0 op1 CRn CRm op2 
0b01 0b000 0b0111 0b0110 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.SWIO == 
DC_CIGSW(X[t]); 


== '1' then 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<DC,VM> 
DC_CIGSW(X[t]) ; 
else 


= '00' then 
DC_IGSW(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_IGSW(X[t]); 
elsif PSTATE.EL == EL3 then 


DC_IGSW(X[t]); 
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C5.3.25 


PoC 


C5-508 


DC IGVAC, Data, Allocation Tag or unified Cache line Invalidate of Allocation Tags by VA to 


The DC IGVAC characteristics are: 


Purpose 
Invalidate Allocation Tags in data cache by address to Point of Coherency. 

Configurations 
This instruction is present only when ARMv8.5-MemTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to DC IGVAC are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DC IGVAC is a 64-bit System instruction. 


Field descriptions 


The DC IGVAC input value bit assignments are: 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC IGVAC instruction 


When the instruction is executed, it can generate a watchpoint, which is prioritized in the same way as other 
watchpoints. If a watchpoint is generated, the CM bit in the ESR_ELx.ISS field is set to 1. 


This instruction requires write access permission to the VA, otherwise it generates a Permission Fault, subject to the 
constraints described in Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC IGVAC, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b0110 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<DC,VM> != '@0' then 
DC_CIGVAC(X[t]); 
else 
DC_IGVAC(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_IGVAC(X[t]); 
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elsif PSTATE.EL == EL3 then 
DC_IGVAC(X[t]); 
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C5.3.26 DC ISW, Data or unified Cache line Invalidate by Set/Way 
The DC ISW characteristics are: 


Purpose 
Invalidate data cache by set/way. 


When ARMv8.5-MemTag is implemented, this instruction might invalidate Allocation Tags from 
caches. When it invalidates Allocation Tags from caches, it also cleans them. 


Configurations 


AArch64 System instruction DC ISW performs the same function as AArch32 System instruction 
DCISW. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DC ISW is a 64-bit System instruction. 


Field descriptions 


The DC ISW input value bit assignments are: 


63 32 31 4 3 1 0 


RESO SetWay tot | | 


Bits [63:32] 
Reserved, RESO. 
SetWay, bits [31:4] 
Contains two fields: 
s Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Log2(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 


Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 


Bit [0] 


Reserved, RESO. 


Executing the DC ISW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED. 


C5-510 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


The A64 System Instruction Class 
C5.3 A64 System instructions for cache maintenance 


° The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— Multiple arbitrary cache lines. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC ISW, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b0110 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.SWIO == '1' then 
DC_CISW(X[t]); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<DC,VM> != 
DC_CISW(X[t]); 


'00' then 


else 
DC_ISW(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_ISW(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_ISW(X[t]); 
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C5.3.27 


C5-512 


DC IVAC, Data or unified Cache line Invalidate by VA to PoC 
The DC IVAC characteristics are: 


Purpose 
Invalidate data cache by address to Point of Coherency. 


When ARMv8.5-MemTag is implemented, this instruction might invalidate Allocation Tags from 
caches. When it invalidates Allocation Tags from caches, it also cleans them. 


Configurations 


AArch64 System instruction DC IVAC performs the same function as AArch32 System instruction 
DCIMVAC. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DC IVAC is a 64-bit System instruction. 


Field descriptions 


The DC IVAC input value bit assignments are: 


63 0 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DC IVAC instruction 


When the instruction is executed, it can generate a watchpoint, which is prioritized in the same way as other 
watchpoints. If a watchpoint is generated, the CM bit in the ESR_ELx.ISS field is set to 1. 


This instruction requires write access permission to the VA, otherwise it generates a Permission Fault, subject to the 
constraints described in Permission fault on page D5-2623. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The data cache maintenance instruction (DC) on page D4-2483. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC IVAC, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b0110 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<DC,VM> != 'QQ' then 
DC_CIVAC(X[t]); 
else 
DC_IVAC(X[t]); 
elsif PSTATE.EL == EL2 then 
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elsif PSTATE.EL == EL3 then 
DC_IVAC(X[t]); 
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C5.3.28 


C5-514 


DC ZVA, Data Cache Zero by VA 


The DC ZVA characteristics are: 


Purpose 
Zero data cache by address. Zeroes a naturally aligned block of N bytes, where the size of N is 
identified in DCZID_ELO. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DC ZVA is a 64-bit System instruction. 


Field descriptions 


The DC ZVA input value bit assignments are: 


Virtual address to use 


Bits [63:0] 


Virtual address to use. There is no alignment restriction on the address within the block of N bytes 
that is used. 


Executing the DC ZVA instruction 


When this instruction is executed, it can generate memory faults or watchpoints which are prioritized in the same 
way as other memory-related faults or watchpoints. If a synchronous data abort fault or a watchpoint is generated, 
the CM bit in the ESR_ELx.ISS field is set to 0. 


Ifthe memory region being zeroed is any type of Device memory, this instruction can give an Alignment fault which 
is prioritized in the same way as other Alignment faults that are determined by the memory type. 


This instruction applies to Normal memory regardless of cacheability attributes. 


This instruction behaves as a set of Stores to each byte within the block being accessed, and so it: 


š Generates a Permission Fault if the translation system does not permit writes to the locations. 
s Requires the same considerations for ordering and the management of coherency as any other store 
instructions. 


Accesses to this register use the following encodings in the System instruction encoding space: 


DC ZVA, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b0100 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.DZE == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TDZ == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.DZE == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_ZVA(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TDZ == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DC_ZVA(X[t]); 
elsif PSTATE.EL == EL2 then 
DC_ZVA(X[t]); 
elsif PSTATE.EL == EL3 then 
DC_ZVA(X[t]); 
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C5.3.29 IC IALLU, Instruction Cache Invalidate All to PoU 


The IC IALLU characteristics are: 


Purpose 
Invalidate all instruction caches to Point of Unification. 
Configurations 
AArch64 System instruction IC IALLU performs the same function as AArch32 System instruction 
ICIALLU. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


IC IALLU is a 64-bit System instruction. 


Field descriptions 


IC IALLU ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 


Executing the IC IALLU instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


IC IALLU{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b000 0b0111 0b0101 0b000 Ob11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPU == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TOCU == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
IC_IALLUIS(); 


else 
IC_IALLU(); 
elsif PSTATE.EL == EL2 then 
IC_IALLU(); 
elsif PSTATE.EL == EL3 then 
IC_IALLU() ; 
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C5.3.30 IC IALLUIS, Instruction Cache Invalidate All to PoU, Inner Shareable 


ARM DDI 0487E.a 
ID070919 


The IC IALLUIS characteristics are: 


Purpose 
Invalidate all instruction caches in Inner Shareable domain to Point of Unification. 
Configurations 
AArch64 System instruction IC IALLUIS performs the same function as AArch32 System 
instruction ICI[ALLUIS. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


IC IALLUIS is a 64-bit System instruction. 


Field descriptions 


IC IALLUIS ignores the value in the register specified by the instruction. Software does not have to write a value 
to the register before issuing this instruction. 


Executing the IC IALLUIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


IC IALLUIS{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b000 0b0111 0b0001 0b000 Ob11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPU == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TICAB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
IC_IALLUIS(); 
elsif PSTATE.EL == EL2 then 
IC_IALLUIS(); 
elsif PSTATE.EL == EL3 then 
IC_IALLUIS(); 
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C5.3.31 


C5-518 


IC IVAU, Instruction Cache line Invalidate by VA to PoU 


The IC IVAU characteristics are: 


Purpose 
Invalidate instruction cache by address to Point of Unification. 
Configurations 
AArch64 System instruction IC IVAU performs the same function as AArch32 System instruction 
ICIMVAU. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


IC IVAU is a 64-bit System instruction. 


Field descriptions 


The IC IVAU input value bit assignments are: 


Virtual address to use 


Bits [63:0] 
Virtual address to use. No alignment restrictions apply to this VA. 


Executing the IC IVAU instruction 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see The instruction cache maintenance instruction (IC) on page D4-2483. 


If ELO access is enabled, when executed at ELO, this instruction requires read access permission to the VA, 
otherwise it is IMPLEMENTATION DEFINED whether it generates a Permission Fault, see Permission fault on 
page D5-2623. 


Accesses to this register use the following encodings in the System instruction encoding space: 


IC IVAUL, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b011 0b0111 0b0101 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCI == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TPU == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TOCU == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCI == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
IC_IVAU(X[t]); 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPU == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TOCU == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
IC_IVAU(X[t]); 
elsif PSTATE.EL == EL2 then 
IC_IVAU(X[t]); 
elsif PSTATE.EL == EL3 then 
IC_IVAU(X[t]); 
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C5.4 A64 System instructions for address translation 


This section lists the A64 System instructions for address translation. 
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C5.4.1 AT S12E0R, Address Translate Stages 1 and 2 ELO Read 


The AT S12EOR characteristics are: 


Purpose 
Performs stage 1 and 2 address translations from ELO, with permissions as if reading from the given 
virtual address from ELO, using the following translation regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime. 
e Otherwise, the EL1&0 translation regime. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S12E0R is a 64-bit System instruction. 
Field descriptions 


The AT S12EOR input value bit assignments are: 


63 0 


Input address for translation 





Bits [63:0] 
Input address for translation. The resulting address can be read from the PAR_EL1. 


If the address translation instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S12E0R instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S12E0R, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b100 Ob0111 0b1000 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.<E2H,TGE> == '11' || HCR_EL2.<DC,VM> == 'QQ' then 
AT_S1E@R(X[t]); 
else 
AT_S12E@R(X[t]); 
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elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
AT_S1EOR(X[t]); 
elsif EL2Enabled() && (HCR_EL2.<E2H,TGE> == '11' || HCR_EL2.<DC,VM> == 'QQ') then 
AT_S1E@R(X[t]); 
else 
AT_S12E@R(X[t]); 
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AT S12E0W, Address Translate Stages 1 and 2 ELO Write 


The AT S12E0W characteristics are: 


Purpose 
Performs stage 1 and 2 address translations from ELO, with permissions as if writing to the given 
virtual address from ELO, using the following translation regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime. 
e Otherwise, the EL1&0 translation regime. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S12E0W is a 64-bit System instruction. 


Field descriptions 


The AT S12E0W input value bit assignments are: 


63 


Input address for translation 


Bits [63:0] 


Input address for translation. The resulting address can be read from the PAR_EL1. 





If the address translation instructions are targeting a translation regime that is using AArch32, and 


so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S12E0W instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S12E0W, <Xt> 











op0 op1 CRn CRm op2 
0b01 0b100 0b0111 0b1000 0b111 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.<E2H,TGE> == '11' || HCR_EL2.<DC,VM> == 'Q0' then 
AT_S1EQW(X[t]); 
else 
AT_S12EQW(X[t]); 
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elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
AT_S1EQW(X[t]); 
elsif EL2Enabled() && (HCR_EL2.<E2H,TGE> == '11' || HCR_EL2.<DC,VM> == 'QQ') then 
AT_S1EQW(X[t]); 
else 
AT_S12EQW(X[t]); 
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C5.4.3 AT S12E1R, Address Translate Stages 1 and 2 EL1 Read 


63 
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The AT S12EI1R characteristics are: 


Purpose 
Performs stage 1 and 2 address translation, with permissions as if reading from the given virtual 
address from EL1, or from EL2 if the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, using 
the following translation regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime, accessed from 
ELI. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime, accessed from 
EL2. 
. Otherwise, the EL1&0 translation regime, accessed from EL1. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S12E1R is a 64-bit System instruction. 


Field descriptions 


The AT S12E1R input value bit assignments are: 


Input address for translation 





Bits [63:0] 
Input address for translation. The resulting address can be read from the PAR_EL1. 


If the address translation instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S$12E1R instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S12E1R, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b100 Ob0111 0b1000 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
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if HCR_EL2.<E2H,TGE> == 
T_S1E1R(X[t]); 


> 


else 


> 


T_S12E1R(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 





"11" || HCR_EL2.<DC,VM> == '00' then 


AT_S1E1R(X[t]); 
elsif EL2Enabled() && (HCR_EL2.<E2H,TGE> == '11' || HCR_EL2.<DC,VM> == 'Q0') then 
AT_S1E1R(X[t]); 
else 
AT_S12E1R(X[t]); 
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C5.4.4 AT S12E1W, Address Translate Stages 1 and 2 EL1 Write 


63 


ARM DDI 0487E.a 
ID070919 


The AT S12E1W characteristics are: 


Purpose 
Performs stage 1 and 2 address translation, with permissions as if writing to the given virtual address 
from EL1, or from EL2 if the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, using the 
following translation regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime, accessed from 
ELI. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime, accessed from 
EL2. 
. Otherwise, the EL1&0 translation regime, accessed from EL1. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S12E1W is a 64-bit System instruction. 


Field descriptions 


The AT S12E1W input value bit assignments are: 


Input address for translation 


Bits [63:0] 


Input address for translation. The resulting address can be read from the PAR_EL1. 





If the address translation instructions are targeting a translation regime that is using AArch32, and 


so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S$12E1W instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S12E1W, <Xt> 











op0 op1 CRn CRm op2 
0b01 0b100 0b0111 0b1000 0b101 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C5-527 


Non-Confidential 


The A64 System Instruction Class 
C5.4 A64 System instructions for address translation 


if HCR_EL2.<E2H,TGE> == 
T_S1E1W(X[t]); 


> 


else 


> 


T_S12E1w(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 





"11" || HCR_EL2.<DC,VM> == '00' then 


AT_S1E1w(X[t]); 
elsif EL2Enabled() && (HCR_EL2.<E2H,TGE> == '11' || HCR_EL2.<DC,VM> == 'Q0') then 
AT_S1E1w(X[t]); 
else 
AT_S12E1W(X[t]); 
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C5.4.5 AT S1E0R, Address Translate Stage 1 ELO Read 


63 
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The AT S1IEOR characteristics are: 


Purpose 
Performs stage 1 address translation from ELO, with permissions as if reading from the given virtual 
address from ELO, using the following translation regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime. 
e Otherwise, the EL1&0 translation regime. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1EOR is a 64-bit System instruction. 


Field descriptions 


The AT S1EOR input value bit assignments are: 


Input address for translation 


Bits [63:0] 


Input address for translation. The resulting address can be read from the PAR_EL1. 





If the address translation instructions are targeting a translation regime that is using AArch32, and 


so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S1E0R instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S1E0R, <Xt> 











op0 op1 CRn CRm op2 
0b01 0b000 0b0111 0b1000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AT == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AT_S1EOR(X[t]); 
elsif PSTATE.EL == EL2 then 
AT_S1EOR(X[t]); 
elsif PSTATE.EL == EL3 then 
AT_S1EOR(X[t]); 
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C5.4.6 


C5-530 


AT S1E0W, Address Translate Stage 1 ELO Write 


63 


The AT S1E0W characteristics are: 


Purpose 
Performs stage 1 address translation from ELO, with permissions as if writing to the given virtual 
address from ELO, using the following translation regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime. 
e Otherwise, the EL1&0 translation regime. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1E0W is a 64-bit System instruction. 


Field descriptions 


The AT S1EOW input value bit assignments are: 


Input address for translation 


Bits [63:0] 





Input address for translation. The resulting address can be read from the PAR_EL1. 


If the address translation instructions are targeting a translation regime that is using AArch32, and 


so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S1E0W instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S1E0W, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b01 0b000 Ob0111 


0b1000 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AT == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AT_S1EQW(X[t]); 
elsif PSTATE.EL == EL2 then 
AT_S1EQW(X[t]); 
elsif PSTATE.EL == EL3 then 
AT_S1EQW(X[t]); 
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C5.4.7 AT S1E1R, Address Translate Stage 1 EL1 Read 


63 
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The AT S1E1R characteristics are: 


Purpose 
Performs stage 1 address translation, with permissions as if reading from the given virtual address 
from EL1, or from EL2 if the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, using the 
following translation regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime, accessed from 
ELI. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime, accessed from 
EL2. 
. Otherwise, the EL1&0 translation regime, accessed from EL1. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1E1R is a 64-bit System instruction. 


Field descriptions 


The AT S1E1R input value bit assignments are: 


Input address for translation 


Bits [63:0] 


Input address for translation. The resulting address can be read from the PAR_EL1. 





If the address translation instructions are targeting a translation regime that is using AArch32, and 


so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S1E1R instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S1E1R, <Xt> 











op0 op1 CRn CRm op2 
0b01 0b000 0b0111 0b1000 0b000 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AT == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AT_S1E1R(X[t]); 
elsif PSTATE.EL == EL2 then 
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AT_S1E1R(X[t]); 
elsif PSTATE.EL == EL3 then 
AT_S1E1R(X[t]); 
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C5.4.8 AT S1E1RP, Address Translate Stage 1 EL1 Read PAN 


The AT S1E1RP characteristics are: 


Purpose 
Performs a stage 1 address translation, where the value of PSTATE.PAN determines if a read from 
a location will generate a permission fault for a privileged access, using the following translation 
regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime, accessed from 
ELI. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime, accessed from 
EL2. 
. Otherwise, the EL1&0 translation regime, accessed from EL1. 
Configurations 
This instruction is present only when ARMv8.2-ATSIE1 is implemented. Otherwise, direct 
accesses to AT S1E1RP are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1E1RP is a 64-bit System instruction. 


Field descriptions 


The AT S1E1RP input value bit assignments are: 


63 0 


Input address for translation 





Bits [63:0] 
Input address for translation. The resulting address can be read from the PAR_EL1. 


If the address translation instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S1E1RP instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S1E1RP, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b1001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AT == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AT_S1E1RP(X[t]); 
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elsif PSTATE.EL == EL2 then 
AT_S1E1RP(X[t]); 

elsif PSTATE.EL == EL3 then 
AT_S1E1RP(X[t]); 


C5-534 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The A64 System Instruction Class 
C5.4 A64 System instructions for address translation 


C5.4.9 AT S1E1W, Address Translate Stage 1 EL1 Write 


63 


ARM DDI 0487E.a 
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The AT S1E1W characteristics are: 


Purpose 
Performs stage 1 address translation, with permissions as if writing to the given virtual address from 
EL1, or from EL2 if the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, using the following 
translation regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime, accessed from 
ELI. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime, accessed from 
EL2. 
. Otherwise, the EL1&0 translation regime, accessed from EL1. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1E1W is a 64-bit System instruction. 


Field descriptions 


The AT S1E1W input value bit assignments are: 


Input address for translation 


Bits [63:0] 


Input address for translation. The resulting address can be read from the PAR_EL1. 





If the address translation instructions are targeting a translation regime that is using AArch32, and 


so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S1E1W instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S1E1W, <Xt> 











op0 op1 CRn CRm op2 
0b01 0b000 0b0111 0b1000 0b001 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AT == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AT_S1E1w(X[t]); 
elsif PSTATE.EL == EL2 then 
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AT_S1E1W(X[t]); 
elsif PSTATE.EL == EL3 then 
AT_S1E1W(X[t]); 
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C5.4.10 AT S1E1WP, Address Translate Stage 1 EL1 Write PAN 


The AT S1E1 WP characteristics are: 


Purpose 
Performs a stage | address translation, where the value of PSTATE.PAN determines if a write to a 
location will generate a permission fault for a privileged access, using the following translation 
regime: 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the EL1&0 translation regime, accessed from 
ELI. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the EL2&0 translation regime, accessed from 
EL2. 
. Otherwise, the EL1&0 translation regime, accessed from EL1. 
Configurations 
This instruction is present only when ARMv8.2-ATS1E1 is implemented. Otherwise, direct 
accesses to AT S1E1WP are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1E1WP is a 64-bit System instruction. 
Field descriptions 


The AT S1E1 WP input value bit assignments are: 


63 0 


Input address for translation 





Bits [63:0] 
Input address for translation. The resulting address can be read from the PAR_EL1. 


If the address translation instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S1E1WP instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S1E1WP, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b000 0b0111 0b1001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AT == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AT_S1E1wP(X[t]); 
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elsif PSTATE.EL == EL2 then 
AT_S1E1WP(X[t]); 

elsif PSTATE.EL == EL3 then 
AT_S1E1WP(X[t]); 
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C5.4.11 AT S1E2R, Address Translate Stage 1 EL2 Read 


The AT S1E2R characteristics are: 


Purpose 
Performs stage 1 address translation as defined for EL2, with permissions as if reading from the 
given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1E2R is a 64-bit System instruction. 
Field descriptions 


The AT S1E2R input value bit assignments are: 


63 0 


Input address for translation 





Bits [63:0] 
Input address for translation. The resulting address can be read from the PAR_EL1. 


If the address translation instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S1E2R instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S1E2R, <Xt> 





op0 op1 CRn CRm op2 





0b01 0b100 0b0111 0b1000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
AT_S1E2R(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
AT_S1E2R(X[t]); 
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C5.4.12 AT S1E2W, Address Translate Stage 1 EL2 Write 


The AT S1E2W characteristics are: 


Purpose 
Performs stage 1 address translation as defined for EL2, with permissions as if writing to the given 
virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1E2W is a 64-bit System instruction. 


Field descriptions 


The AT S1E2W input value bit assignments are: 














63 0 
Input address for translation 
Bits [63:0] 
Input address for translation. The resulting address can be read from the PAR_EL1. 
If the address translation instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then VA[63:32] is RESO. 
Executing the AT S1E2W instruction 
Accesses to this register use the following encodings in the System instruction encoding space: 
AT S1E2W, <Xt> 
op0 op1 CRm op2 
0b01 0b100 0b1000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
AT_S1E2W(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
AT_S1E2W(X[t]); 
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C5.4.13 AT S1E3R, Address Translate Stage 1 EL3 Read 


The AT S1E3R characteristics are: 


Purpose 
Performs stage 1 address translation as defined for EL3, with permissions as if reading from the 
given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1E3R is a 64-bit System instruction. 


Field descriptions 


The AT S1E3R input value bit assignments are: 


63 0 


Input address for translation 





Bits [63:0] 
Input address for translation. The resulting address can be read from the PAR_EL1. 


If the address translation instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S1E3R instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S1E3R, <Xt> 











op0 op1 CRn CRm op2 
0b01 0b110 0b0111 0b1000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
AT_S1E3R(X[t]); 
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C5.4.14 AT S1E3W, Address Translate Stage 1 EL3 Write 


The AT S1E3W characteristics are: 


Purpose 
Performs stage 1 address translation as defined for EL3, with permissions as if writing to the given 
virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AT S1E3W is a 64-bit System instruction. 


Field descriptions 


The AT S1E3W input value bit assignments are: 


63 0 


Input address for translation 





Bits [63:0] 
Input address for translation. The resulting address can be read from the PAR_EL1. 


If the address translation instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then VA[63:32] is RESO. 


Executing the AT S1E3W instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


AT S1E3W, <Xt> 











op0 op1 CRn CRm op2 
0b01 0b110 0b0111 0b1000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
AT_S1E3W(X[t]); 
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C5.5 A64 System instructions for TLB maintenance 
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This section lists the A64 System instructions for TLB maintenance. 


For more information about these instructions see TLB maintenance instructions on page D5-2641. In particular, for 
the full description of the scope of each instruction see Scope of the A64 TLB maintenance instructions on 
page D5-2646. 
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C5.5.1 TLBI ALLE1, TLB Invalidate All, EL1 


C5-544 


The TLBI ALLE] characteristics are: 








Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
s The entry is a stage 1 or stage 2 translation table entry, from any level of the translation table 
walk. 
° If SCR_EL3.NS is 0 and the entry would be required to translate an address using the Secure 
EL1&0 translation regime. 
. If SCR_EL3.NS is 1 and the entry would be required to translate an address using the 
Non-secure EL1&0 translation regime. 
The invalidation applies to entries with any VMID. 
The invalidation only applies to the PE that executes this System instruction. 
Note 
For the EL1&0 translation regimes, the invalidation applies to both global entries, and non-global 
entries with any ASID. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI ALLE! is a 64-bit System instruction. 


Field descriptions 


TLBI ALLE1 ignores the value in the register specified by the instruction. Software does not have to write a value 
to the register before issuing this instruction. 


Executing the TLBI ALLE1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI ALLE1{, <Xt>} 


op0 op1 CRn CRm op2 Rt 





0b01 0b100 0b1000 0b0111 0b100 0b11111 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_ALLE1(); 
elsif PSTATE.EL == EL3 then 
TLBI_ALLE1(); 
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C5.5.2 TLBI ALLE1IS, TLB Invalidate All, EL1, Inner Shareable 
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The TLBI ALLELIS characteristics are: 


Purpose 


Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 


s The entry is a stage 1 or stage 2 translation table entry, from any level of the translation table 
walk. 


° If SCR_EL3.NS is 0 and the entry would be required to translate an address using the Secure 
EL1&0 translation regime. 


. If SCR_EL3.NS is | and the entry would be required to translate an address using the 
Non-secure EL1&0 translation regime. 


The invalidation applies to entries with any VMID. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 





Note 


For the EL1&0 translation regimes, the invalidation applies to both global entries, and non-global 
entries with any ASID. 





Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI ALLELIS is a 64-bit System instruction. 


Field descriptions 


TLBI ALLELIS ignores the value in the register specified by the instruction. Software does not have to write a value 
to the register before issuing this instruction. 


Executing the TLBI ALLE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI ALLE1IS{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b100 0b1000 0b0011 0b100 Ob11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_ALLE1IS(); 
elsif PSTATE.EL == EL3 then 
TLBI_ALLE1IS(); 
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C5.5.3 


C5-546 


TLBI ALLE10S, TLB Invalidate All, EL1, Outer Shareable 


The TLBI ALLE1OS characteristics are: 


Purpose 


Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 


s The entry is a stage 1 or stage 2 translation table entry, from any level of the translation table 
walk. 


° If SCR_EL3.NS is 0 and the entry would be required to translate an address using the Secure 
EL1&0 translation regime. 


. If SCR_EL3.NS is 1 and the entry would be required to translate an address using the 
Non-secure EL1&0 translation regime. 


The invalidation applies to entries with any VMID. 


The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 





Note 


For the EL1&0 translation regimes, the invalidation applies to both global entries, and non-global 
entries with any ASID. 





Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI ALLEIOS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI ALLEIOS is a 64-bit System instruction. 


Field descriptions 


TLBI ALLE1OS ignores the value in the register specified by the instruction. Software does not have to write a 
value to the register before issuing this instruction. 


Executing the TLBI ALLE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI ALLE10S{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b100 0b1000 0b0001 0b100 Ob11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_ALLE10S(); 
elsif PSTATE.EL == EL3 then 
TLBI_ALLE10S(); 
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C5.5.4 TLBI ALLE2, TLB Invalidate All, EL2 
The TLBI ALLE2 characteristics are: 


Purpose 


If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


: The entry is a stage 1 translation table entry, from any level of the translation table walk. 


$ If SCR_EL3.NS is 1 and the entry would be required to translate an address using the 
Non-secure EL2 or Non-secure EL2&0 translation regime. 


: If SCR_EL3.NS is 0 and the entry would be required to translate an address using the Secure 
EL2 or Secure EL2&0 translation regime. 


The invalidation only applies to the PE that executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI ALLE2 is a 64-bit System instruction. 


Field descriptions 


TLBI ALLE2 ignores the value in the register specified by the instruction. Software does not have to write a value 
to the register before issuing this instruction. 


Executing the TLBI ALLE2 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI ALLE2{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b100 0b1000 0b0111 0b000 0b11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_ALLE2(); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_ALLE2(); 
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C5.5.5 TLBI ALLE2IS, TLB Invalidate All, EL2, Inner Shareable 
The TLBI ALLEZIS characteristics are: 


Purpose 


If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


: The entry is a stage 1 translation table entry, from any level of the translation table walk. 


$ If SCR_EL3.NS is 1 and the entry would be required to translate an address using the 
Non-secure EL2 or Non-secure EL2&0 translation regime. 


: If SCR_EL3.NS is 0 and the entry would be required to translate an address using the Secure 
EL2 or Secure EL2&0 translation regime. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI ALLEZIS is a 64-bit System instruction. 


Field descriptions 


TLBI ALLEZIS ignores the value in the register specified by the instruction. Software does not have to write a value 
to the register before issuing this instruction. 


Executing the TLBI ALLE2IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI ALLE2IS{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b100 0b1000 0b0011 0b000 Ob11111 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_ALLE2IS(); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_ALLE2IS(); 
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C5.5.6 TLBI ALLE2OS, TLB Invalidate All, EL2, Outer Shareable 


The TLBI ALLE2OS characteristics are: 


Purpose 
If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
: The entry is a stage 1 translation table entry, from any level of the translation table walk. 
$ If SCR_EL3.NS is 1 and the entry would be required to translate an address using the 
Non-secure EL2 or Non-secure EL2&0 translation regime. 
: If SCR_EL3.NS is 0 and the entry would be required to translate an address using the Secure 
EL2 or Secure EL2&0 translation regime. 
The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI ALLE2OS are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI ALLE2OS is a 64-bit System instruction. 


Field descriptions 


TLBI ALLE2OS ignores the value in the register specified by the instruction. Software does not have to write a 
value to the register before issuing this instruction. 


Executing the TLBI ALLE2OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI ALLE2OS{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b100 0b1000 0b0001 0b000 Ob11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_ALLE20S(); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_ALLE20S(); 
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C5.5.7 


C5-550 


TLBI ALLE3, TLB Invalidate All, EL3 


The TLBI ALLE3 characteristics are: 


Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


The entry is a stage 1 translation table entry, from any level of the translation table walk. 


The entry would be required to translate an address using the EL3 translation regime. 


The invalidation applies to the PE that executes this System instruction. 


Configurations 


There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBI ALLE3 is a 64-bit System instruction. 


Field descriptions 


TLBI ALLE3 ignores the value in the register specified by the instruction. Software does not have to write a value 
to the register before issuing this instruction. 


Executing the TLBI ALLE3 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI ALLE3{, <Xt>} 











op0 op1 CRn CRm op2 Rt 
0b01 0b110 0b1000 0b0111 0b000 Ob11111 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_ALLE3(); 
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C5.5.8 TLBI ALLE3IS, TLB Invalidate All, EL3, Inner Shareable 
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The TLBI ALLE3IS characteristics are: 


Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


° The entry is a stage 1 translation table entry, from any level of the translation table walk. 
° The entry would be required to translate an address using the EL3 translation regime. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI ALLE3IS is a 64-bit System instruction. 


Field descriptions 


TLBI ALLE3IS ignores the value in the register specified by the instruction. Software does not have to write a value 
to the register before issuing this instruction. 


Executing the TLBI ALLE3IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI ALLE3IS{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b110 0b1000 0b0011 0b000 Ob11111 





if PSTATE.EL == EL@ then 


UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
UNDEFINED; 


elsif PSTATE.EL == EL3 then 
TLBI_ALLE31S(); 
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C5.5.9 


C5-552 


TLBI ALLE3OS, TLB Invalidate All, EL3, Outer Shareable 


The TLBI ALLE3OS characteristics are: 


Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


° The entry is a stage 1 translation table entry, from any level of the translation table walk. 
° The entry would be required to translate an address using the EL3 translation regime. 


The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI ALLE3OS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI ALLE3OS is a 64-bit System instruction. 


Field descriptions 


TLBI ALLE3OS ignores the value in the register specified by the instruction. Software does not have to write a 
value to the register before issuing this instruction. 


Executing the TLBI ALLE3OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI ALLE3OS{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b110 0b1000 0b0001 0b000 Ob11111 





if PSTATE.EL == EL@ then 


UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
UNDEFINED; 


elsif PSTATE.EL == EL3 then 
TLBI_ALLE30S(); 
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C5.5.10 TLBI ASIDE1, TLB Invalidate by ASID, EL1 


63 


ARM DDI 0487E.a 
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The TLBI ASIDE] characteristics are: 


Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
s The entry is a stage 1 translation table entry. 
° The entry would be used for the specified ASID, and either: 
— Is from a level of lookup above the final level. 
— Isanon-global entry from the final level of lookup. 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID, and would be required to translate an address using the EL1&0 translation 
regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate an 
address using the EL2&0 translation regime. 
° When ElL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate an address using the EL1&0 translation regime. 
The invalidation applies to the PE that executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI ASIDE] is a 64-bit System instruction. 


Field descriptions 


The TLBI ASIDE! input value bit assignments are: 


48 47 0 


ASID RESO 


ASID, bits [63:48] 


ASID value to match. Any appropriate TLB entries that match the ASID values will be affected by 
this System instruction. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Bits [47:0] 


Reserved, RESO. 


Executing the TLBI ASIDE1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI ASIDE1{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0111 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
TLBI_ASIDE1IS(X[t]); 
else 
TLBI_ASIDE1(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_ASIDE1(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_ASIDE1(X[t]); 
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C5.5.11 TLBI ASIDE1IS, TLB Invalidate by ASID, EL1, Inner Shareable 
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The TLBI ASIDES characteristics are: 


Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
s The entry is a stage 1 translation table entry. 
° The entry would be used for the specified ASID, and either: 
— Is from a level of lookup above the final level. 
— Isanon-global entry from the final level of lookup. 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID, and would be required to translate an address using the EL1&0 translation 
regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate an 
address using the EL2&0 translation regime. 
° When ElL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate an address using the EL1&0 translation regime. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI ASIDEIIS is a 64-bit System instruction. 


Field descriptions 


The TLBI ASIDELIS input value bit assignments are: 


48 47 0 


ASID RESO 


ASID, bits [63:48] 


ASID value to match. Any appropriate TLB entries that match the ASID values will be affected by 
this System instruction. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Bits [47:0] 


Reserved, RESO. 


Executing the TLBI ASIDE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI ASIDE1IS{, <Xt>} 





op0 op1 CRn CRm 


0b01 0b000 0b1000 0b0011 


op2 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_ASIDE1IS(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_ASIDE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_ASIDE11S(X[t]); 
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C5.5.12 TLBI ASIDE10S, TLB Invalidate by ASID, EL1, Outer Shareable 
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The TLBI ASIDE1OS characteristics are: 


Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
s The entry is a stage 1 translation table entry. 
° The entry would be used for the specified ASID, and either: 
— Is from a level of lookup above the final level. 
— Isanon-global entry from the final level of lookup. 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID, and would be required to translate an address using the EL1&0 translation 
regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate an 
address using the EL2&0 translation regime. 
° When ElL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate an address using the EL1&0 translation regime. 
The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI ASIDE1OS are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI ASIDEIOS is a 64-bit System instruction. 


Field descriptions 


The TLBI ASIDE1OS input value bit assignments are: 


48 47 0 


ASID RESO 


ASID, bits [63:48] 


ASID value to match. Any appropriate TLB entries that match the ASID values will be affected by 
this System instruction. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Bits [47:0] 


Reserved, RESO. 


Executing the TLBI ASIDE10OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI ASIDE10S{, <Xt>} 





op0 op1 CRn CRm 


0b01 0b000 0b1000 0b0001 


op2 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_ASIDE10S(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_ASIDE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_ASIDE10S(X[t]); 
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C5.5.13 TLBI IPAS2E1, TLB Invalidate by Intermediate Physical Address, Stage 2, EL1 


63 62 


The TLBI IPAS2E1 characteristics are: 


Purpose 


If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


: The entry is a stage 2 only translation table entry, from any level of the translation table walk. 
. One of the following applies: 


—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 


—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 


° The entry would be used with the current VMID. 


The invalidation is not required to apply to caching structures that combine stage 1 and stage 2 
translation table entries. 


The invalidation applies to the PE that executes this System instruction. 


For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI IPAS2E1 is a 64-bit System instruction. 


Field descriptions 


The TLBI IPAS2E1 input value bit assignments are: 


48 47 44 43 40 39 36 35 


hs RESO RESO IPA[47:12] 


IPA[51:48] 


ARM DDI 0487E.a 
ID070919 





NS, bit [63] 
When ARMV8.4-SecEL2 is implemented: 
Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Otherwise: 
Reserved, RESO. 
Bits [62:48] 


Reserved, RESO. 
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TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 


Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 
Reserved, RESO. 
Bits [43:40] 
Reserved, RESO. 
IPA[51:48], bits [39:36] 
When ARMV8.2-LPA is implemented: 
Extension to IPA[47:12]. See IPA[47:12] for more details. 
Otherwise: 


Reserved, RESO. 


IPA[47:12], bits [35:0] 


Bits[47:12] of the intermediate physical address to match. For implementations with fewer than 48 
bits, the upper bits of this field are RESO. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use, IPA[51:48] form the upper part of the address value. Otherwise, IPA[51:48] are RESO. 


Executing the TLBI IPAS2E1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI IPAS2E1{, <Xt>} 
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C5.5 A64 System instructions for TLB maintenance 





CRn CRm op2 


0b1000 0b0100 0b001 





op0 op1 
0b01 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_IPAS2E1(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_IPAS2E1(X[t]); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


C5-561 


The A64 System Instruction Class 
C5.5 A64 System instructions for TLB maintenance 


C5.5.14 TLBI IPAS2E1IS, TLB Invalidate by Intermediate Physical Address, Stage 2, EL1, Inner 
Shareable 


The TLBI IPAS2E1IS characteristics are: 


Purpose 


If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


s The entry is a stage 2 only translation table entry, from any level of the translation table walk. 
: One of the following applies: 


—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 


—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 


° The entry would be used with the current VMID. 


The invalidation is not required to apply to caching structures that combine stage 1 and stage 2 
translation table entries. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI IPAS2EIIS is a 64-bit System instruction. 


Field descriptions 


The TLBI IPAS2E1IS input value bit assignments are: 


63 62 48 47 44 43 40 39 36 35 0 


RESO TTL RESO IPA[47:12] 





IPA[51:48] 


NS, bit [63] 
When ARMVv%8.4-SecEL2 is implemented: 
Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Otherwise: 


Reserved, RESO. 
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Bits [62:48] 
Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 


Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
Qb11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 
Bits [43:40] 
Reserved, RESO. 
IPA[51:48], bits [39:36] 
When ARMV8.2-LPA is implemented: 
Extension to IPA[47:12]. See IPA[47:12] for more details. 
Otherwise: 
Reserved, RESO. 
TPA[47:12], bits [35:0] 


Bits[47:12] of the intermediate physical address to match. For implementations with fewer than 48 
bits, the upper bits of this field are RESO. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use, IPA[51:48] form the upper part of the address value. Otherwise, IPA[51:48] are RESO. 


Executing the TLBI IPAS2E1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI IPAS2E1IS{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b100 0b1000 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_IPAS2E11IS(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_IPAS2E11S(X[t]); 
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C5.5.15 TLBI IPAS2E10S, TLB Invalidate by Intermediate Physical Address, Stage 2, EL1, Outer 


Shareable 


The TLBI IPAS2E10S characteristics are: 


Purpose 


If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


s The entry is a stage 2 only translation table entry, from any level of the translation table walk. 
: One of the following applies: 


—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 


—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 


° The entry would be used with the current VMID. 


The invalidation is not required to apply to caching structures that combine stage 1 and stage 2 
translation table entries. 


The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 


For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 


Configurations 


Attributes 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI IPAS2E10S are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


TLBI IPAS2E10S is a 64-bit System instruction. 


Field descriptions 


The TLBI IPAS2E10S input value bit assignments are: 


63 62 


48 47 44 43 40 39 36 35 


hs RESO RESO IPA[47:12] 


IPA[51:48] 


NS, bit [63] 


Bits [62:48] 





Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Reserved, RESO. 
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TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


ObO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Ob11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 
Otherwise: 


Reserved, RESO. 
Bits [43:40] 

Reserved, RESO. 
IPA[51:48], bits [39:36] 

Extension to IPA[47:12]. See IPA[47:12] for more details. 
IPA[47:12], bits [35:0] 


Bits[47:12] of the intermediate physical address to match. For implementations with fewer than 48 
bits, the upper bits of this field are RESO. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use, IPA[51:48] form the upper part of the address value. Otherwise, IPA[51:48] are RESO. 


Executing the TLBI IPAS2E10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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CRn CRm op2 


0b1000 0b0100 0b000 





op0 op1 
0b01 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_IPAS2E10S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_IPAS2E10S(X[t]); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


C5-567 


The A64 System Instruction Class 
C5.5 A64 System instructions for TLB maintenance 


C5.5.16 TLBI IPAS2LE1, TLB Invalidate by Intermediate Physical Address, Stage 2, Last level, EL1 
The TLBI IPAS2LE1 characteristics are: 


Purpose 


If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


: The entry is a stage 2 only translation table entry, from the final level of the translation table 
walk. 


. One of the following applies: 


—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 


—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 


° The entry would be used with the current VMID. 


The invalidation is not required to apply to caching structures that combine stage 1 and stage 2 
translation table entries. 


The invalidation applies to the PE that executes this System instruction. 


For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI IPAS2LE1 is a 64-bit System instruction. 


Field descriptions 


The TLBI IPAS2LE1 input value bit assignments are: 


63 62 48 47 44 43 40 39 36 35 


0 
RESO TTL RESO IPA[47:12] 


NS, bit [63] 
When ARMVv%8.4-SecEL2 is implemented: 





IPA[51:48] 


Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Otherwise: 


Reserved, RESO. 
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Bits [62:48] 
Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 


Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
Qb11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 
Bits [43:40] 
Reserved, RESO. 
IPA[51:48], bits [39:36] 
When ARMV8.2-LPA is implemented: 
Extension to IPA[47:12]. See IPA[47:12] for more details. 
Otherwise: 
Reserved, RESO. 
TPA[47:12], bits [35:0] 


Bits[47:12] of the intermediate physical address to match. For implementations with fewer than 48 
bits, the upper bits of this field are RESO. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use, IPA[51:48] form the upper part of the address value. Otherwise, IPA[51:48] are RESO. 


Executing the TLBI IPAS2LE1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI IPAS2LE1{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b100 0b1000 0b0100 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_IPAS2LE1(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_IPAS2LE1(X[t]); 
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C5.5.17 TLBI IPAS2LE1IS, TLB Invalidate by Intermediate Physical Address, Stage 2, Last level, EL1, 
Inner Shareable 


The TLBI IPAS2LELIS characteristics are: 


Purpose 


If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


$ The entry is a stage 2 only translation table entry, from the final level of the translation table 
walk. 


- One of the following applies: 


—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 


—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 


° The entry would be used with the current VMID. 


The invalidation is not required to apply to caching structures that combine stage 1 and stage 2 
translation table entries. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI IPAS2LELIS is a 64-bit System instruction. 


Field descriptions 


The TLBI IPAS2LEIIS input value bit assignments are: 
63 62 48 47 44 43 40 39 36 35 


hs RESO RESO IPA[47:12] 


NS, bit [63] 
When ARMVv%8.4-SecEL2 is implemented: 





IPA[51:48] 


Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Otherwise: 


Reserved, RESO. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C5-571 
ID070919 Non-Confidential 


The A64 System Instruction Class 
C5.5 A64 System instructions for TLB maintenance 


C5-572 


Bits [62:48] 
Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 


Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
Qb11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 
Bits [43:40] 
Reserved, RESO. 
IPA[51:48], bits [39:36] 
When ARMV8.2-LPA is implemented: 
Extension to IPA[47:12]. See IPA[47:12] for more details. 
Otherwise: 
Reserved, RESO. 
TPA[47:12], bits [35:0] 


Bits[47:12] of the intermediate physical address to match. For implementations with fewer than 48 
bits, the upper bits of this field are RESO. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use, IPA[51:48] form the upper part of the address value. Otherwise, IPA[51:48] are RESO. 


Executing the TLBI IPAS2LE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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CRn CRm op2 


0b1000 0b0000 0b101 





op0 op1 
0b01 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_IPAS2LE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_IPAS2LE11S(X[t]); 
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C5.5.18 TLBI IPAS2LE10OS, TLB Invalidate by Intermediate Physical Address, Stage 2, Last level, EL1, 
Outer Shareable 


The TLBI IPAS2LE10OS characteristics are: 


Purpose 


If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


$ The entry is a stage 2 only translation table entry, from the final level of the translation table 
walk. 


- One of the following applies: 


—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 


—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 


° The entry would be used with the current VMID. 


The invalidation is not required to apply to caching structures that combine stage 1 and stage 2 
translation table entries. 


The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 


For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 


Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI IPAS2LE10OS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI IPAS2LE10OS is a 64-bit System instruction. 


Field descriptions 


The TLBI IPAS2LE1OS input value bit assignments are: 


63 62 48 47 44 43 40 39 36 35 0 


RESO TTL RESO IPA[47:12] 





IPA[51:48] 


NS, bit [63] 
When ARMV8.4-SecEL2 is implemented: 
Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 
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Otherwise: 


Reserved, RESO. 


Bits [62:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


Ob01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
Qb11 : Level 3. 
Ob11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
Qb11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 
Reserved, RESO. 
Bits [43:40] 
Reserved, RESO. 
IPA[51:48], bits [39:36] 
Extension to IPA[47:12]. See IPA[47:12] for more details. 
IPA[47:12], bits [35:0] 


Bits[47:12] of the intermediate physical address to match. For implementations with fewer than 48 
bits, the upper bits of this field are RESO. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use, IPA[51:48] form the upper part of the address value. Otherwise, IPA[51:48] are RESO. 


Executing the TLBI IPAS2LE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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C5-576 


TLBI IPAS2LE10S{, <Xt>} 








op0 op1 CRn CRm op2 
0b01 0b100 0b1000 0b0100 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
TLBI_IPAS2LE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_IPAS2LE10S(X[t]); 
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C5.5.19 TLBI RIPAS2E1, TLB Range Invalidate by Intermediate Physical Address, Stage 2, EL1 


The TLBI RIPAS2E1 characteristics are: 





Purpose 
If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
: The entry is a stage 2 only translation table entry, from any level of the translation table walk. 
. One of the following applies: 
—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 
—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 
° The entry would be used with the current VMID. 
$ The entry is within the address range determined by the formula [BaseA DDR <= VA < 
BaseADDR + ((NUM +1)*2^(5*SCALE +1) * Translation_Granule_Size)]. 
The invalidation is not required to apply to caching structures that combine stage 1 and stage 2 
translation table entries. 
The invalidation applies to the PE that executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
$ For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
è For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
. For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RIPAS2E1 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RIPAS2E1 is a 64-bit System instruction. 


Field descriptions 


The TLBI RIPAS2E1 input value bit assignments are: 


63 62 48 47 46 45 44 43 39 38 37 36 0 


RESO pro] NUM TTL BaseADDR 
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NS, bit [63] 
When ARMV8.4-SecEL2 is implemented: 
Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Otherwise: 
Reserved, RESO. 
Bits [62:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved. Hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RIPAS2E1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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CRn CRm op2 


0b1000 0b0100 0b010 





op0 op1 
0b01 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RIPAS2E1(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_RIPAS2E1(X[t]); 
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C5.5.20 
Inner Shareable 


C5-580 


TLBI RIPAS2E1IS, TLB Range Invalidate by Intermediate Physical Address, Stage 2, EL1, 


The TLBI RIPAS2E1IS characteristics are: 





Purpose 
If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
s The entry is a stage 2 only translation table entry, from any level of the translation table walk. 
: One of the following applies: 
—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 
—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 
° The entry would be used with the current VMID. 
$ The entry is within the address range determined by the formula [BaseA DDR <= VA < 
BaseADDR + ((NUM +1)*2^(5*SCALE +1) * Translation _Granule_Size)]. 
The invalidation is not required to apply to caching structures that combine stage | and stage 2 
translation table entries. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
$ For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
è For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
. For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 
Configurations 
This instruction is present only when ARMV8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RIPAS2E1IS are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RIPAS2ELIS is a 64-bit System instruction. 


Field descriptions 


The TLBI RIPAS2EI1IS input value bit assignments are: 


48 47 46 45 44 43 39 38 37 36 0 


ro] NUM TTL BaseADDR 
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NS, bit [63] 
When ARMV8.4-SecEL2 is implemented: 
Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Otherwise: 
Reserved, RESO. 
Bits [62:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved. Hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RIPAS2E1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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C5-582 


TLBI RIPAS2E1IS{, <Xt>} 








op0 op1 CRn CRm op2 
0b01 0b100 0b1000 0b0000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
TLBI_RIPAS2E11S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_RIPAS2E11S(X[t]); 
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C5.5.21 TLBI RIPAS2E10S, TLB Range Invalidate by Intermediate Physical Address, Stage 2, EL1, 
Outer Shareable 


The TLBI RIPAS2E10OS characteristics are: 





Purpose 
If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
s The entry is a stage 2 only translation table entry, from any level of the translation table walk. 
: One of the following applies: 
—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 
—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 
° The entry would be used with the current VMID. 
$ The entry is within the address range determined by the formula [BaseA DDR <= VA < 
BaseADDR + ((NUM +1)*2^(5*SCALE +1) * Translation Granule Size)]. 
The invalidation is not required to apply to caching structures that combine stage | and stage 2 
translation table entries. 
The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
$ For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
è For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
. For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 
Configurations 
This instruction is present only when ARMV8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RIPAS2E10S are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RIPAS2E10S is a 64-bit System instruction. 


Field descriptions 


The TLBI RIPAS2E10S input value bit assignments are: 


63 62 48 47 46 45 44 43 39 38 37 36 0 


RESO ro] NUM BaseADDR 


SCALE e a 
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NS, bit [63] 
Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Bits [62:48] 
Reserved, RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved. Hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RIPAS2E10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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CRn CRm op2 


0b1000 0b0100 0b011 





op0 op1 
0b01 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RIPAS2E10S(X[t]) ; 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_RIPAS2E10S(X[t]); 
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C5.5.22 TLBI RIPAS2LE1, TLB Range Invalidate by Intermediate Physical Address, Stage 2, Last level, 
EL1 


The TLBI RIPAS2LE1 characteristics are: 





Purpose 
If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
$ The entry is a stage 2 only translation table entry, from the final level of the translation table 
walk. 
- One of the following applies: 
—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 
—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 
° The entry would be used with the current VMID. 
` The entry is within the address range determined by the formula [BaseA DDR <= VA < 
BaseADDR + ((NUM +1)*24(5*SCALE +1) * Translation _Granule_Size)]. 
The invalidation is not required to apply to caching structures that combine stage | and stage 2 
translation table entries. 
The invalidation only applies to the PE that executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
$ For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
è For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
. For the 64K translation granule: 
— IfTTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RIPAS2LE1 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RIPAS2LE1 is a 64-bit System instruction. 


Field descriptions 


The TLBI RIPAS2LE1 input value bit assignments are: 


63 62 48 47 46 45 44 43 39 38 37 36 0 


RESO ro] NUM TTL BaseADDR 
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NS, bit [63] 
When ARMV8.4-SecEL2 is implemented: 
Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Otherwise: 
Reserved, RESO. 
Bits [62:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved. Hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RIPAS2LE1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI RIPAS2LE1{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b100 0b1000 0b0100 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RIPAS2LE1(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_RIPAS2LE1(X[t]); 
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C5.5.23 TLBI RIPAS2LE1IS, TLB Range Invalidate by Intermediate Physical Address, Stage 2, Last 
level, EL1, Inner Shareable 


The TLBI RIPAS2LEI1IS characteristics are: 





Purpose 
If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
$ The entry is a stage 2 only translation table entry, from the final level of the translation table 
walk. 
- One of the following applies: 
—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 
—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 
° The entry would be used with the current VMID. 
` The entry is within the address range determined by the formula [BaseA DDR <= VA < 
BaseADDR + ((NUM +1)*2^(5*SCALE +1) * Translation _Granule_Size)]. 
The invalidation is not required to apply to caching structures that combine stage | and stage 2 
translation table entries. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
. For the 4K translation granule: 
— IfTTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
° For the 16K translation granule: 
— IfTTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
. For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RIPAS2LE1IS are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RIPAS2LELIS is a 64-bit System instruction. 


Field descriptions 


The TLBI RIPAS2LELIIS input value bit assignments are: 
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63 62 48 47 46 45 44 43 39 38 37 36 0 


RESO fro] | NUM TTL BaseADDR 


NS, bit [63] 
When ARMVv%8.4-SecEL2 is implemented: 
Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
Qb1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Otherwise: 
Reserved, RESO. 
Bits [62:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved. Hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 
0b11 All entries to invalidate are Level 3 translation table entries. 
BaseA DDR, bits [36:0] 


The starting address for the range of the maintenance instruction. 
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When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RIPAS2LE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RIPAS2LE1IS{, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b100 0b1000 0b0000 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RIPAS2LE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_RIPAS2LE11S(X[t]); 
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C5.5.24 TLBI RIPAS2LE10S, TLB Range Invalidate by Intermediate Physical Address, Stage 2, Last 
level, EL1, Outer Shareable 


The TLBI RIPAS2LE1OS characteristics are: 











Purpose 

If EL2 is implemented and enabled in the current Security state, invalidates cached copies of 

translation table entries from TLBs that meet all the following requirements: 

s The entry is a stage 2 only translation table entry, from any level of the translation table walk. 

: One of the following applies: 

—  SCR_EL3.NS==1 and the entry would be required to translate the specified IPA using 
the Non-secure EL1&0 translation regime. 

—  SCR_EL3.NS==0 and the entry would be required to translate the specified IPA using 
the Secure EL1&0 translation regime. 

° The entry would be used with the current VMID. 

$ The entry is within the address range determined by the formula [BaseA DDR <= VA < 
BaseADDR + ((NUM +1)*2^(5*SCALE +1) * Translation _Granule_Size)]. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1 &0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

à A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

- A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

: A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

The invalidation is not required to apply to caching structures that combine stage | and stage 2 

translation table entries. 

The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 

executes this System instruction. 

The range of addresses invalidated is UNPREDICTABLE when: 

g For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

è For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 

$ For the 64K translation granule: 

— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 
Configurations 

This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 

to TLBI RIPAS2LE1OS are UNDEFINED. 

RW fields in this register reset to architecturally UNKNOWN values. 
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Attributes 
TLBI RIPAS2LEI1OS is a 64-bit System instruction. 


Field descriptions 


The TLBI RIPAS2LE10OS input value bit assignments are: 


63 62 48 47 46 45 44 43 39 38 37 36 0 


RESO ro] NUM TTL BaseADDR 


NS, bit [63] 
When ARMV8.4-SecEL2 is implemented: 
Not Secure. Specifies the IPA space. 
Qbd IPA is in the Secure IPA space. 
0b1 IPA is in the Non-secure IPA space. 


When the instruction is executed in Non-secure state, this field is RESO, and the instruction applies 
only to the Non-secure IPA space. 


When ARMv8.4-SecEL2 is not implemented or is disabled in the current Security state, this field is 
RESO. 


Otherwise: 
Reserved, RESO. 
Bits [62:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 

The exponent element of the calculation that is used to produce the upper range. 
NUM, bits [43:39] 

The base element of the calculation that is used to produce the upper range. 
TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 
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When using a 16KB translation granule, this value is reserved. Hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RIPAS2LE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RIPAS2LE10S{, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b100 0b1000 0b0100 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RIPAS2LE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
//no operation 
else 
TLBI_RIPAS2LE10S(X[t]); 
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C5.5.25 TLBI RVAAE1, TLB Range Invalidate by VA, All ASID, EL1 


The TLBI RVAAE! characteristics are: 











Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
s The entry is a stage 1 translation table entry, from any level of the translation table walk. 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When ElL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 
$ The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2^(5*SCALE +1) * Translation _Granule_Size)]. 
The invalidation applies to the PE that executes this System instruction. 
Note 
For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both: 
: Global entries. 
s Non-global entries with any ASID. 
The range of addresses invalidated is UNPREDICTABLE when: 
s For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
° For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
- For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAAE]1 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RVAAE1 is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAAE1 input value bit assignments are: 
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63 48 47 46 45 44 43 39 38 37 36 0 


RESO ef | NUM TTL BaseADDR 


ee art O O 


Bits [63:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAAE‘1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI RVAAE1{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0110 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
TLBI_RVAAE1IS(X[t]); 
else 
TLBI_RVAAE1(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVAAE1(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVAAE1(X[t]); 
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C5.5.26 


C5-598 


TLBI RVAAE1IS, TLB Range Invalidate by VA, All ASID, EL1, Inner Shareable 


The TLBI RVAAEIIS characteristics are: 











Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry, from any level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When ElL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

$ The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2^(5*SCALE +1) * Translation _Granule_Size)]. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1&0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

è A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

s A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

s A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both: 

e Global entries. 

a Non-global entries with any ASID. 

The range of addresses invalidated is UNPREDICTABLE when: 

. For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 

— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

. For the 16K translation granule: 

— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 

a For the 64K translation granule: 

— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 

— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 

Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAAEIIS are UNDEFINED. 
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RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI RVAAEILIS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAAEIIS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


RESO fro] | NUM BaseADDR 


a ela 


Bits [63:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 
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Executing the TLBI RVAAE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVAAE1IS{, <Xt>} 


op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0010 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_RVAAE1IS(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVAAE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVAAE1IS(X[t]); 
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C5.5.27 TLBI RVAAE10S, TLB Range Invalidate by VA, All ASID, EL1, Outer Shareable 


The TLBI RVAAEIOS characteristics are: 











Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry, from any level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

. The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 

The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1&0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

è A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

s A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

s A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both: 

e Global entries. 

a Non-global entries with any ASID. 

The range of addresses invalidated is UNPREDICTABLE when: 

G For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 

— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

. For the 16K translation granule: 

— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 

° For the 64K translation granule: 

— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 

— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 

Configurations 

This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 

to TLBI RVAAEIOS are UNDEFINED. 
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RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI RVAAEIOS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAAEIOS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


RESO fro] | NUM TTL BaseADDR 


a ela 


Bits [63:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 
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Executing the TLBI RVAAE10OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVAAE10S{, <Xt>} 


op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0101 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_RVAAE10S(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVAAE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVAAE10S(X[t]); 
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C5.5.28 


C5-604 


TLBI RVAALE1, TLB Range Invalidate by VA, All ASID, Last level, EL1 


The TLBI RVAALE1 characteristics are: 











Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
: The entry is a stage 1 translation table entry, from the final level of the translation table walk. 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When ElL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 
$ The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2^(5*SCALE +1) * Translation _Granule_Size)]. 
The invalidation applies to the PE that executes this System instruction. 
Note 
For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both: 
: Global entries. 
s Non-global entries with any ASID. 
The range of addresses invalidated is UNPREDICTABLE when: 
s For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
° For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
- For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAALE1 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RVAALE1 is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAALE] input value bit assignments are: 
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63 48 47 46 45 44 43 39 38 37 36 0 


RESO ef | NUM TTL BaseADDR 


ee art O O 


Bits [63:48] 


Reserved, RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 
0b01 
0b10 
0b11 


Reserved. 
4K translation granule. 
16K translation granule. 


64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 
0b01 


0b10 
0b11 


BaseADDR, bits [36:0] 


The entries in the range can be using any level for the translation table entries. 


When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


All entries to invalidate are Level 2 translation table entries. 


All entries to invalidate are Level 3 translation table entries. 


The starting address for the range of the maintenance instruction. 

When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAALE‘1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI RVAALE1{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0110 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
TLBI_RVAAE1IS(X[t]); 
else 
TLBI_RVAALE1(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVAALE1(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVAALE1(X[t]); 
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C5.5.29 TLBI RVAALE1IS, TLB Range invalidate by VA, All ASID, Last Level, EL1, Inner Shareable 


The TLBI RVAALEIIS characteristics are: 











Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

: The entry is a stage 1 translation table entry, from the final level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

$ The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2^(5*SCALE +1) * Translation _Granule_Size)]. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1&0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

è A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

s A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

s A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both: 

e Global entries. 

a Non-global entries with any ASID. 

The range of addresses invalidated is UNPREDICTABLE when: 

G For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 

— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

. For the 16K translation granule: 

— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 

° For the 64K translation granule: 

— IfTTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 

— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 

Configurations 

This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 

to TLBI RVAALEIIS are UNDEFINED. 
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RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI RVAALEIIS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAALELIS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


RESO fro] | NUM TTL BaseADDR 


a ela 


Bits [63:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 
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Executing the TLBI RVAALE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVAALE1IS{, <Xt>} 


op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0010 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_RVAALE1IS(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVAALE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVAALE1IS(X[t]); 
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C5.5.30 


C5-610 


TLBI RVAALE10S, TLB Range invalidate by VA, All ASID, Last Level, EL1, Outer Shareable 


The TLBI RVAALEIOS characteristics are: 











Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

: The entry is a stage 1 translation table entry, from the final level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL? is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

. The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 

The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1&0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

è A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

s A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

s A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both: 

e Global entries. 

a Non-global entries with any ASID. 

The range of addresses invalidated is UNPREDICTABLE when: 

G For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 

— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

. For the 16K translation granule: 

— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 

a For the 64K translation granule: 

— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 

— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 

Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAALEIOS are UNDEFINED. 
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RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI RVAALEI1OS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAALEIOS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


RESO fro] | NUM TTL BaseADDR 


a ela 


Bits [63:48] 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 
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Executing the TLBI RVAALE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVAALE10S{, <Xt>} 


op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0101 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_RVAALE10S(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVAALE10S(X[t]) ; 
elsif PSTATE.EL == EL3 then 
TLBI_RVAALE10S(X[t]) ; 


C5-612 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The A64 System Instruction Class 
C5.5 A64 System instructions for TLB maintenance 


C5.5.31 TLBI RVAE1, TLB Range Invalidate by VA, EL1 


The TLBI RVAE1 characteristics are: 


ARM DDI 0487E.a 
ID070919 


Purpose 


Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 


The entry is a stage 1 translation table entry. 
The entry would be used to translate the specified VA, and one of the following applies: 


— The entry is from a level of lookup above the final level and matches the specified 
ASID. 


— The entry is a global entry from the final level of lookup. 


— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 


When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 


—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 


—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 


When EL? is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to the PE that executes this System instruction. 


The range of addresses invalidated is UNPREDICTABLE when: 


Configurations 


For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAE1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBI RVAE1 is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAE! input value bit assignments are: 
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63 48 47 46 45 44 43 39 38 37 36 0 


ASID ef | NUM TTL BaseADDR 


eo es a 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAE1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI RVAE1{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0110 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
TLBI_RVAE1IS(X[t]); 
else 
TLBI_RVAE1(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVAE1(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVAE1(X[t]); 
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C5.5.32 TLBI RVAE1IS, TLB Range Invalidate by VA, EL1, Inner Shareable 


The TLBI RVAELIS characteristics are: 


Purpose 


Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 


The entry is a stage 1 translation table entry. 
The entry would be used to translate the specified VA, and one of the following applies: 


— The entry is from a level of lookup above the final level and matches the specified 
ASID. 


— The entry is a global entry from the final level of lookup. 


— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 


When EL2 is implemented and enabled in the Security state described by the current value 

of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 


—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 


When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


— Note 


When a TLB maintenance instruction is generated to the Secure EL1 &0 translation regime and is 
defined to pass a VMID argument, or would be defined to pass a VMID argument if 
SCR_EL3.EEL2==1, then: 


A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 


A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 


A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 





The range of addresses invalidated is UNPREDICTABLE when: 


For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
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Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAELS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI RVAEIIS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAEIIS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID fro] | NUM TTL BaseADDR 


Bee ee 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 
When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 
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0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVAE1IS{, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0010 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_RVAE1IS(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVAE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVAE1IS(X[t]); 
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C5.5.33 TLBI RVAE10S, TLB Range Invalidate by VA, EL1, Outer Shareable 


The TLBI RVAEI1OS characteristics are: 








Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry. 

. The entry would be used to translate the specified VA, and one of the following applies: 

— The entry is from a level of lookup above the final level and matches the specified 
ASID. 

— The entry is a global entry from the final level of lookup. 

— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

- The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*24(5*SCALE +1) * Translation Granule _Size)]. 

The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 

executes this System instruction. 

— Note 

When a TLB maintenance instruction is generated to the Secure EL1&0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

. A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

a A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

. A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

The range of addresses invalidated is UNPREDICTABLE when: 

. For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 

— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

: For the 16K translation granule: 

— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 

. For the 64K translation granule: 

— IfTTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 

— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 

ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C5-619 


ID070919 Non-Confidential 


The A64 System Instruction Class 
C5.5 A64 System instructions for TLB maintenance 


Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAEIOS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI RVAE1OS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAE1OS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID fro] | NUM BaseADDR 


Bee ee 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 
TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 
0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 
When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 
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0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVAE10S{, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0101 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_RVAE10S(X[t]) ; 
elsif PSTATE.EL == EL2 then 
TLBI_RVAE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVAE10S(X[t]); 
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C5.5.34 TLBI RVAE2, TLB Range Invalidate by VA, EL2 


The TLBI RVAE2 characteristics are: 





Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified VA in the specified range determined by 
the formula [BaseADDR <= VA < BaseADDR + ((NUM +1)*2X5*SCALE +1) * 
Translation_Granule_Size)], using the EL2 or EL2&0 translation regime. 
g If HCR_EL2.E2H == 0, the entry is from any level of the translation table walk. 
à If HCR_EL2.E2H == 1, one of the following applies: 
— The entry is froma level of the translation table walk above the final level and matches 
the specified ASID. 
— The entry is a global entry from the final level of the translation table walk. 
— The entry is a non-global entry from the final level of the translation table walk and 
matches the specified ASID. 
The invalidation applies to the PE that executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
$ For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
è For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
. For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAE2 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RVAE2 is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAE2 input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID fro] | NUM TTL BaseADDR 


ed or 
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ASID, bits [63:48] 
When HCR_EL2.E2H == 1: 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Otherwise: 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


bee Reserved. 

QbO1 4K translation granule. 
0b10 16K translation granule. 
Qb11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAE2 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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C5-624 


TLBI RVAE2{, <Xt>} 








op0 op1 CRn CRm op2 
0b01 0b100 0b1000 0b0110 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
TLBI_RVAE2(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_RVAE2(X[t]); 
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C5.5.35 TLBI RVAEZ2IS, TLB Range Invalidate by VA, EL2, Inner Shareable 


The TLBI RVAEZ2IS characteristics are: 





Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified VA in the specified range determined by 
the formula [BaseADDR <= VA < BaseADDR + ((NUM +1)*2X5*SCALE +1) * 
Translation_Granule_Size)], using the EL2 or EL2&0 translation regime. 
g If HCR_EL2.E2H == 0, the entry is from any level of the translation table walk. 
à If HCR_EL2.E2H == 1, one of the following applies: 
— The entry is froma level of the translation table walk above the final level and matches 
the specified ASID. 
— The entry is a global entry from the final level of the translation table walk. 
— The entry is a non-global entry from the final level of the translation table walk and 
matches the specified ASID. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
: For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
° For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
. For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAEZIS are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RVAEZIS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAEZIS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID fro] | NUM TTL BaseADDR 


sae ne er 
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ASID, bits [63:48] 
When HCR_EL2.E2H == 1: 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Otherwise: 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


bee Reserved. 

QbO1 4K translation granule. 
0b10 16K translation granule. 
Qb11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAEZIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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CRn CRm op2 


0b1000 0b0010 0b001 





op0 op1 
0b01 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RVAE21S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_RVAE2IS(X[t]); 
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C5.5.36 TLBI RVAE2OS, TLB Range Invalidate by VA, EL2, Outer Shareable 


The TLBI RVAE2OS characteristics are: 





Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified VA in the specified range determined by 
the formula [BaseADDR <= VA < BaseADDR + ((NUM +1)*2X5*SCALE +1) * 
Translation_Granule_Size)], using the EL2 or EL2&0 translation regime. 
g If HCR_EL2.E2H == 0, the entry is from any level of the translation table walk. 
à If HCR_EL2.E2H == 1, one of the following applies: 
— The entry is froma level of the translation table walk above the final level and matches 
the specified ASID. 
— The entry is a global entry from the final level of the translation table walk. 
— The entry is a non-global entry from the final level of the translation table walk and 
matches the specified ASID. 
The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
: For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
° For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
. For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAE2OS are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RVAE2OS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAE2OS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID fro] | NUM TTL BaseADDR 


sae ne er 
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ASID, bits [63:48] 
When HCR_EL2.E2H == 1: 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Otherwise: 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


bee Reserved. 

QbO1 4K translation granule. 
0b10 16K translation granule. 
Qb11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAE2OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI RVAE20S{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b100 0b1000 0b0101 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RVAE20S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_RVAE20S(X[t]); 
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C5.5.37 TLBI RVAE3, TLB Range Invalidate by VA, EL3 


The TLBI RVAE3 characteristics are: 
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Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


The entry is a stage 1 translation table entry, from any level of the translation table walk. 


The entry would be used to translate the specified VA using the EL3 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to the PE that executes this System instruction. 


The range of addresses invalidated is UNPREDICTABLE when: 


Configurations 


For the 4K translation granule: 
If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 


For the 16K translation granule: 


For the 64K translation granule: 


If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 


If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAE3 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBI RVAE3 is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAE3 input value bit assignments are: 


48 47 46 45 44 43 39 38 37 36 


RESO fro] | NUM TTL BaseADDR 


ean Ao o 


Bits [63:48] 


Reserved, RESO. 


TG bits [47:46] 


Translation granule size. 


0b00 
0b01 
0b10 
0b11 
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The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 

0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 
When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 

0b10 All entries to invalidate are Level 2 translation table entries. 

0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 


The starting address for the range of the maintenance instruction. 


When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAE3 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 








TLBI RVAE3{, <Xt>} 
op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0110 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_RVAE3 (X[t]) ; 
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C5.5.38 TLBI RVAE3IS, TLB Range Invalidate by VA, EL3, Inner Shareable 


The TLBI RVAE3IS characteristics are: 
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Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


The entry is a stage 1 translation table entry, from any level of the translation table walk. 


The entry would be used to translate the specified VA using the EL3 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


The range of addresses invalidated is UNPREDICTABLE when: 


Configurations 


For the 4K translation granule: 
If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 


For the 16K translation granule: 


For the 64K translation granule: 


If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 


If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAE3IS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBI RVAES3IS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAE3IS input value bit assignments are: 


48 47 46 45 44 43 39 38 37 36 


RESO fro] | NUM TTL BaseADDR 


seg ee 


Bits [63:48] 


Reserved, RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 
0b01 
0b10 
0b11 
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The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 

0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 
When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 

0b10 All entries to invalidate are Level 2 translation table entries. 

0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 


The starting address for the range of the maintenance instruction. 


When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAESIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVAESIS{, <Xt>} 








op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0010 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_RVAE31S(X[t]); 
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C5.5.39 TLBI RVAE3OS, TLB Range Invalidate by VA, EL3, Outer Shareable 


The TLBI RVAE3OS characteristics are: 
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Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


The entry is a stage 1 translation table entry, from any level of the translation table walk. 


The entry would be used to translate the specified VA using the EL3 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 


The range of addresses invalidated is UNPREDICTABLE when: 


Configurations 


For the 4K translation granule: 
If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 


For the 16K translation granule: 


For the 64K translation granule: 


If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 


If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVAE30OS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBI RVAE30OS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVAE3OS input value bit assignments are: 


48 47 46 45 44 43 39 38 37 36 


RESO fro] | NUM TTL BaseADDR 


seg ee 


Bits [63:48] 


Reserved, RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 
0b01 
0b10 
0b11 
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The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 

0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 
When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 

0b10 All entries to invalidate are Level 2 translation table entries. 

0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 


The starting address for the range of the maintenance instruction. 


When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVAE3OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVAE3OS{, <Xt>} 








op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0101 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_RVAE30S(X[t]); 
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C5.5.40 TLBI RVALE1, TLB Range Invalidate by VA, Last level, EL1 


The TLBI RVALE1 characteristics are: 
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Purpose 


Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 


The entry is a stage 1 translation table entry. 
The entry would be used to translate the specified VA, and one of the following applies: 
— The entry is a global entry from the final level of lookup. 


— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 


When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 


—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 


—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 


When EL? is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to the PE that executes this System instruction. 


The range of addresses invalidated is UNPREDICTABLE when: 


For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





For more information about the architectural requirements for this System instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 


Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVALE1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBI RVALE1 is a 64-bit System instruction. 


Field descriptions 


The TLBI RVALE1 input value bit assignments are: 
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63 48 47 46 45 44 43 39 38 37 36 0 


ASID ef | NUM TTL BaseADDR 


eo es a 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVALE‘1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI RVALE1{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0110 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
TLBI_RVALE1IS(X[t]); 
else 
TLBI_RVALE1(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVALE1(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVALE1(X[t]); 
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C5.5.41 


C5-640 


TLBI RVALE1IS, TLB Range Invalidate by VA, Last level, EL1, Inner Shareable 


The TLBI RVALEIIS characteristics are: 


Purpose 


Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 


The entry is a stage 1 translation table entry. 
The entry would be used to translate the specified VA, and one of the following applies: 
— The entry is a global entry from the final level of lookup. 


— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 


When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 


—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 


—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 


When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 





Note 


When a TLB maintenance instruction is generated to the Secure EL1&0 translation regime and is 
defined to pass a VMID argument, or would be defined to pass a VMID argument if 
SCR_EL3.EEL2==1, then: 


A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 


A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 


A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 





The range of addresses invalidated is UNPREDICTABLE when: 


Configurations 


For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVALELIS are UNDEFINED. 
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RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI RVALELIS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVALEIIS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID fro] | NUM TTL BaseADDR 


a 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 
0b11 All entries to invalidate are Level 3 translation table entries. 
BaseA DDR, bits [36:0] 


The starting address for the range of the maintenance instruction. 
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When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVALE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVALE1IS{, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0010 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_RVALE1IS(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVALE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVALE1IS(X[t]); 
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C5.5.42 TLBI RVALE10S, TLB Range invalidate by VA, Last level, EL1, Outer Shareable 


The TLBI RVALEI1OS characteristics are: 


Purpose 


Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 


The entry is a stage 1 translation table entry. 
The entry would be used to translate the specified VA, and one of the following applies: 
— The entry is a global entry from the final level of lookup. 


— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 


When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 


—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 


—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 


When EL? is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 





Note 


When a TLB maintenance instruction is generated to the Secure EL1 &0 translation regime and is 
defined to pass a VMID argument, or would be defined to pass a VMID argument if 
SCR_EL3.EEL2==1, then: 


A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 


A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 


A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 





The range of addresses invalidated is UNPREDICTABLE when: 


Configurations 


For the 4K translation granule: 

— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 

For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVALEIOS are UNDEFINED. 
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RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI RVALEIOS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVALEI1OS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID fro] | NUM BaseADDR 


a 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 
0b11 All entries to invalidate are Level 3 translation table entries. 
BaseA DDR, bits [36:0] 


The starting address for the range of the maintenance instruction. 
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When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVALE10OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVALE10S{, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0101 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_RVALE10S(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_RVALE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_RVALE10S(X[t]); 
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C5.5.43 TLBI RVALE2, TLB Range Invalidate by VA, Last level, EL2 


The TLBI RVALE2 characteristics are: 





Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified VA in the specified range determined by 
the formula [BaseADDR <= VA < BaseADDR + ((NUM +1)*2X5*SCALE +1) * 
Translation_Granule_Size)] using the EL2 or EL2&0 translation regime. 
g If HCR_EL2.E2H == 0, the entry is from the final level of the translation table walk. 
à If HCR_EL2.E2H == 1, one of the following applies: 
— The entry is a global entry from the final level of translation table walk. 
— The entry is a non-global entry from the final level of the translation table walk and 
matches the specified ASID. 
The invalidation applies to the PE that executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
. For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
a For the 16K translation granule: 
— IfTTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
. For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVALE2 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RVALE2 is a 64-bit System instruction. 


Field descriptions 


The TLBI RVALE2 input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID f | NUM TTL BaseADDR 


wwe O 


ASID, bits [63:48] 
When HCR_EL2.E2H == 1: 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 
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Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Otherwise: 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVALE2 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVALE2{, <Xt>} 











op0 op1 CRn CRm op2 
0b01 0b100 0b1000 0b0110 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RVALE2(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_RVALE2(X[t]); 
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C5.5.44 TLBI RVALEZ2IS, TLB Range invalidate by VA, Last level, EL2, Inner Shareable 


The TLBI RVALEZ2IS characteristics are: 





Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
° The entry would be used to translate the specified VA in the specified range determined by 
the formula [BaseADDR <= VA < BaseADDR + ((NUM +1)*2%(5*SCALE +1) * 
Translation_Granule_Size)] using the EL2 or EL2&0 translation regime. 
g If HCR_EL2.E2H == 0, the entry is from the final level of the translation table walk. 
à If HCR_EL2.E2H == 1, one of the following applies: 
— The entry is a global entry from the final level of translation table walk. 
— The entry is a non-global entry from the final level of the translation table walk and 
matches the specified ASID. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
° For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
° For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
` For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVALEZIS are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RVALEZIS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVALEZIS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID f | NUM TTL BaseADDR 


eea ot 


ASID, bits [63:48] 
When HCR_EL2.E2H == 1: 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 
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Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Otherwise: 


Reserved, RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 


The starting address for the range of the maintenance instruction. 

When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVALE2IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVALE2IS{, <Xt>} 











if PSTATE.EL == EL@ then 


UNDEFINED; 


C5-650 


op0 op1 CRn CRm op2 
0b01 0b100 0b1000 0b0010 0b101 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RVALE2IS(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_RVALE2IS(X[t]); 
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C5.5.45 


TLBI RVALE2OS, TLB Range Invalidate by VA, Last level, EL2, Outer Shareable 


The TLBI RVALE2OS characteristics are: 





Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified VA in the specified range determined by 
the formula [BaseADDR <= VA < BaseADDR + ((NUM +1)*2X5*SCALE +1) * 
Translation_Granule_Size)] using the EL2 or EL2&0 translation regime. 
g If HCR_EL2.E2H == 0, the entry is from the final level of the translation table walk. 
à If HCR_EL2.E2H == 1, one of the following applies: 
— The entry is a global entry from the final level of translation table walk. 
— The entry is a non-global entry from the final level of the translation table walk and 
matches the specified ASID. 
The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 
The range of addresses invalidated is UNPREDICTABLE when: 
° For the 4K translation granule: 
— If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
— If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 
° For the 16K translation granule: 
— If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 
` For the 64K translation granule: 
— If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
— If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVALE2OS are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI RVALE2OS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVALE2OS input value bit assignments are: 


63 48 47 46 45 44 43 39 38 37 36 0 


ASID f | NUM TTL BaseADDR 


eea ot 


C5-652 


ASID, bits [63:48] 
When HCR_EL2.E2H == 1: 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 
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Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Otherwise: 
Reserved, RESO. 
TG bits [47:46] 


Translation granule size. 


0b00 Reserved. 

0b01 4K translation granule. 
0b10 16K translation granule. 
0b11 64K translation granule. 


The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


0b10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVALE2OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVALE2OS{, <Xt>} 











op0 op1 CRn CRm op2 
0b01 0b100 0b1000 0b0101 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_RVALE20S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_RVALE20S(X[t]); 
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C5.5.46 TLBI RVALE3, TLB Range Invalidate by VA, Last level, EL3 


The TLBI RVALE3 characteristics are: 
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Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


The entry is a stage 1 translation table entry, from any level of the translation table walk. 


The entry would be used to translate the specified VA using the EL3 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to the PE that executes this System instruction. 


The range of addresses invalidated is UNPREDICTABLE when: 


Configurations 


For the 4K translation granule: 
If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 


For the 16K translation granule: 


For the 64K translation granule: 


If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 


If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVALE3 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBI RVALE3 is a 64-bit System instruction. 


Field descriptions 


The TLBI RVALE3 input value bit assignments are: 


48 47 46 45 44 43 39 38 37 36 


RESO fro] | NUM TTL BaseADDR 


ean Ao o 


Bits [63:48] 


Reserved, RESO. 


TG bits [47:46] 


Translation granule size. 


0b00 
0b01 
0b10 
0b11 
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The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 

0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 
When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 

0b10 All entries to invalidate are Level 2 translation table entries. 

0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 


The starting address for the range of the maintenance instruction. 


When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVALE3 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVALE3{, <Xt>} 








op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0110 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_RVALE3(X[t]) ; 
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C5.5.47 TLBI RVALE3IS, TLB Range Invalidate by VA, Last level, EL3, Inner Shareable 


The TLBI RVALE3IS characteristics are: 
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Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


The entry is a stage 1 translation table entry, from any level of the translation table walk. 


The entry would be used to translate the specified VA using the EL3 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


The range of addresses invalidated is UNPREDICTABLE when: 


Configurations 


For the 4K translation granule: 
If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 


For the 16K translation granule: 


For the 64K translation granule: 


If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 


If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVALE3IS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBI RVALES3IS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVALE3IS input value bit assignments are: 


48 47 46 45 44 43 39 38 37 36 


RESO fro] | NUM TTL BaseADDR 


seg ee 


Bits [63:48] 


Reserved, RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 
0b01 
0b10 
0b11 
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The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 

SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 


0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 


When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 


Qb10 All entries to invalidate are Level 2 translation table entries. 


0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 
The starting address for the range of the maintenance instruction. 
When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVALESIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVALESIS{, <Xt>} 








op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0010 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_RVALE31S(X[t]); 
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C5.5.48 TLBI RVALE30S, TLB Range Invalidate by VA, Last level, EL3, Outer Shareable 


The TLBI RVALE3OS characteristics are: 
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Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


The entry is a stage 1 translation table entry, from any level of the translation table walk. 


The entry would be used to translate the specified VA using the EL3 translation regime. 


The entry is within the address range determined by the formula [BaseADDR <= VA < 
BaseADDR + ((NUM +1)*2“(5*SCALE +1) * Translation _Granule_Size)]. 


The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 


The range of addresses invalidated is UNPREDICTABLE when: 


Configurations 


For the 4K translation granule: 
If TTL==01 and BaseADDR[29:12] is not equal to 000000000000000000. 
If TTL==10 and BaseADDR[20:12] is not equal to 000000000. 


For the 16K translation granule: 


For the 64K translation granule: 


If TTL==10 and BaseADDR[24:14] is not equal to 00000000000. 


If TTL==01 and BaseADDR[41:16] is not equal to 00000000000000000000000000. 
If TTL==10 and BaseADDR[28:16] is not equal to 0000000000000. 





This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI RVALE30S are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBI RVALE3OS is a 64-bit System instruction. 


Field descriptions 


The TLBI RVALE3OS input value bit assignments are: 


48 47 46 45 44 43 39 38 37 36 


RESO fro] | NUM BaseADDR 


seg ee 


Bits [63:48] 


Reserved, RESO. 


TG, bits [47:46] 


Translation granule size. 


0b00 
0b01 
0b10 
0b11 
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The instruction takes a translation granule size for the translations that are being invalidated. If the 
translations used a different translation granule size than the one being specified, then the 
architecture does not require that the instruction invalidates any entries. 


SCALE, bits [45:44] 


The exponent element of the calculation that is used to produce the upper range. 


NUM, bits [43:39] 


The base element of the calculation that is used to produce the upper range. 


TTL, bits [38:37] 


TTL Level hint. The TTL hint is only guaranteed to invalidate entries in the range that match the 
level described by the TTL hint. 


0b00 The entries in the range can be using any level for the translation table entries. 

0b01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 
translation table entries. 
When using a 16KB translation granule, this value is reserved and hardware should treat 
this field as 0b00. 

0b10 All entries to invalidate are Level 2 translation table entries. 

0b11 All entries to invalidate are Level 3 translation table entries. 


BaseADDR, bits [36:0] 


The starting address for the range of the maintenance instruction. 


When using a 4KB translation granule, this field is BaseADDR[48:12]. 
When using a 16KB translation granule, this field is BaseADDR[50:14]. 
When using a 64KB translation granule, this field is BaseADDR[52:16]. 


Executing the TLBI RVALE3OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI RVALE30S{, <Xt>} 








op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0101 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_RVALE30S(X[t]) ; 
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C5.5.49 TLBI VAAE1, TLB Invalidate by VA, All ASID, EL1 
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The TLBI VAAE!1 characteristics are: 








Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
s The entry is a stage 1 translation table entry, from any level of the translation table walk. 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 
. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 
The invalidation applies to the PE that executes this System instruction. 
Note 
For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both global entries, and 
non-global entries with any ASID. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VAAE1 is a 64-bit System instruction. 


Field descriptions 


The TLBI VAAE1 input value bit assignments are: 


48 47 44 43 0 


RESO TTL VA[55:12] 


Bits [63:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV%8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


0b01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C5-661 
Non-Confidential 


The A64 System Instruction Class 
C5.5 A64 System instructions for TLB maintenance 


Qb11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Ob11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the VA will be 
affected by this System instruction, regardless of the ASID. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAAE1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VAAE1{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0111 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
TLBI_VAAE1IS(X[t]); 
else 
TLBI_VAAE1(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VAAE1(X[t]); 
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elsif PSTATE.EL == EL3 then 
TLBI_VAAE1(X[t]); 
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C5.5.50 TLBI VAAE1IS, TLB Invalidate by VA, All ASID, EL1, Inner Shareable 


The TLBI VAAELIS characteristics are: 





Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry, from any level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

From Armv8.4, when a TLB maintenance instruction is generated to the Secure EL1&0 translation 

regime and is defined to pass a VMID argument, or would be defined to pass a VMID argument if 
SCR_EL3.EEL2==1, then: 
. A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 
a A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 
a A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 
For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both global entries, and 
non-global entries with any ASID. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VAAEILIS is a 64-bit System instruction. 
Field descriptions 


The TLBI VAAEIIS input value bit assignments are: 


63 48 47 44 43 0 


RESO TTL VA[55:12] 


Bits [63:48] 


Reserved, RESO. 
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TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


0b01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Reserved. Treat as if TTL<3:2> is @b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Ob11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the VA will be 
affected by this System instruction, regardless of the ASID. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAAE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VAAE1IS{, <Xt>} 





op0 op1 CRn CRm 


0b01 0b000 0b1000 0b0011 


op2 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VAAE1IS(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VAAE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VAAE1IS(X[t]); 
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C5.5.51 TLBI VAAE10S, TLB Invalidate by VA, All ASID, EL1, Outer Shareable 


The TLBI VAAE1OS characteristics are: 





Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry, from any level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1 &0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

g A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

a A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

a A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both global entries, and 

non-global entries with any ASID. 

Configurations 

This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 

to TLBI VAAEIOS are UNDEFINED. 

RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


TLBI VAAEIOS is a 64-bit System instruction. 


Field descriptions 


The TLBI VAAEI1OS input value bit assignments are: 


63 48 47 44 43 0 
RESO TTL VA[55:12] 
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Bits [63:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Ob11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the VA will be 
affected by this System instruction, regardless of the ASID. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAAE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VAAE10S{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0001 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VAAE10S(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VAAE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VAAE10S(X[t]); 
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C5.5.52 


C5-670 


TLBI VAALE1, TLB Invalidate by VA, All ASID, Last level, EL1 


The TLBI VAALE!1 characteristics are: 


Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 


The entry is a stage | translation table entry, from the final level of the translation table walk. 


When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 


If HCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

If HCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 


When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 


The invalidation applies to the PE that executes this System instruction. 





Note 


For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both global entries, and 
non-global entries with any ASID. 





There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Purpose 
Configurations 
Attributes 


TLBI VAALE] is a 64-bit System instruction. 


Field descriptions 


The TLBI VAALE1 input value bit assignments are: 


63 48 47 


RESO 


Bits [63:48] 


TTL 


44 43 0 


VA[55:12] 


Reserved, RESO. 


TTL, bits [47:44] 


When ARMV%8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx 


0b01xx 


No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Level 1. 

0b10 : Level 2. 
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0b11 : Level 3. 

The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b10 : Level 2. 

0b11 : Level 3. 

The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Level 1. 

0b10 : Level 2. 

0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the VA will be 
affected by this System instruction, regardless of the ASID. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 


when the instruction is executed, because VA[13:12] have no effect on the operation of the 


instruction. 


Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 


when the instruction is executed, because VA[15:12] have no effect on the operation of the 


instruction. 


Executing the TLBI VAALE‘1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VAALE1{, <Xt>} 


if PSTATE.EL == EL@ then 


UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0111 0b111 





AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 


else 





TLBI_VAALE1(X[t]); 


TLBI_VAALE1IS(X[t]); 


elsif PSTATE.EL == EL2 then 


TLBI_VAALE1(X[t]) ; 
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elsif PSTATE.EL == EL3 then 
TLBI_VAALE1(X[t]); 
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C5.5.53 TLBI VAALE1IS, TLB Invalidate by VA, All ASID, Last Level, EL1, Inner Shareable 


The TLBI VAALELIS characteristics are: 





Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

: The entry is a stage 1 translation table entry, from the final level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

From Armv8.4, when a TLB maintenance instruction is generated to the Secure EL1&0 translation 

regime and is defined to pass a VMID argument, or would be defined to pass a VMID argument if 
SCR_EL3.EEL2==1, then: 
. A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 
a A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 
a A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 
For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both global entries, and 
non-global entries with any ASID. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VAALEIIS is a 64-bit System instruction. 
Field descriptions 


The TLBI VAALELIS input value bit assignments are: 


63 48 47 44 43 0 


RESO TTL VA[55:12] 


Bits [63:48] 


Reserved, RESO. 
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TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


0b01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Reserved. Treat as if TTL<3:2> is @b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Ob11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the VA will be 
affected by this System instruction, regardless of the ASID. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAALE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VAALE1IS{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0011 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VAALE1IS(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VAALE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VAALE1IS(X[t]); 
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C5.5.54 TLBI VAALE10OS, TLB Invalidate by VA, All ASID, Last Level, EL1, Outer Shareable 


The TLBI VAALEI1OS characteristics are: 





Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

: The entry is a stage 1 translation table entry, from the final level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1 &0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

g A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

a A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

a A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

For the EL1&0 and EL2&0 translation regimes, the invalidation applies to both global entries, and 

non-global entries with any ASID. 

Configurations 

This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 

to TLBI VAALE1OS are UNDEFINED. 

RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


TLBI VAALEIOS is a 64-bit System instruction. 
Field descriptions 


The TLBI VAALEIOS input value bit assignments are: 


63 48 47 44 43 0 


RESO TTL VA[55:12] 
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Bits [63:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Ob11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the VA will be 
affected by this System instruction, regardless of the ASID. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAALE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VAALE10S{, <Xt>} 





op0 op1 CRn CRm 


0b01 0b000 0b1000 0b0001 


op2 


0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VAALE10S(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VAALE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VAALE10S(X[t]); 
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C5.5.55 TLBI VAE1, TLB Invalidate by VA, EL1 


The TLBI VAE! characteristics are: 


Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
s The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified VA, and one of the following applies: 
— The entry is from a level of lookup above the final level and matches the specified 
ASID. 
— The entry is a global entry from the final level of lookup. 
— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 
. When EL? is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 
The invalidation applies to the PE that executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VAE! is a 64-bit System instruction. 


Field descriptions 


The TLBI VAE! input value bit assignments are: 


63 48 47 44 43 0 


ASID TTL VA[55:12] 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 
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TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


0b01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Reserved. Treat as if TTL<3:2> is @b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Ob11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAE1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VAE1{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 Ob0111 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
TLBI_VAE1IS(X[t]); 
else 
TLBI_VAE1(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VAE1(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VAE1(X[t]); 
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C5.5.56 TLBI VAE1IS, TLB Invalidate by VA, EL1, Inner Shareable 


The TLBI VAELIS characteristics are: 








Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry. 

. The entry would be used to translate the specified VA, and one of the following applies: 

— The entry is from a level of lookup above the final level and matches the specified 
ASID. 

— The entry is a global entry from the final level of lookup. 

— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

— IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

From Armv8.4, when a TLB maintenance instruction is generated to the Secure EL1&0 translation 

regime and is defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

° A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

: A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

a A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VAEIIS is a 64-bit System instruction. 


Field descriptions 


The TLBI VAEIIS input value bit assignments are: 
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48 47 44 43 


63 0 
| ASID TTL | VA[55:12] 


ASID, bits [63:48] 
ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


Qb01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
Qb11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Reserved. Treat as if TTL<3:2> is @b00. 
0b10 : Level 2. 
Qb11 : Level 3. 
Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


` Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 
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° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VAE1IS{, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0011 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VAE1IS(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VAE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VAE1IS(X[t]); 


C5-684 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The A64 System Instruction Class 
C5.5 A64 System instructions for TLB maintenance 


C5.5.57 TLBI VAE10S, TLB Invalidate by VA, EL1, Outer Shareable 


The TLBI VAE1OS characteristics are: 
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Purpose 


Attributes 


Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 


The entry is a stage 1 translation table entry. 
The entry would be used to translate the specified VA, and one of the following applies: 


— The entry is from a level of lookup above the final level and matches the specified 
ASID. 


— The entry is a global entry from the final level of lookup. 


— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 


When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 


—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 


—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 


When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 


The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 





Note 


When a TLB maintenance instruction is generated to the Secure EL1 &0 translation regime and is 
defined to pass a VMID argument, or would be defined to pass a VMID argument if 
SCR_EL3.EEL2==1, then: 


A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 


A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 


A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 





Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI VAE1OS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


TLBI VAEIOS is a 64-bit System instruction. 


Field descriptions 


The TLBI VAE1OS input value bit assignments are: 
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48 47 44 43 


63 0 
| ASID TTL | VA[55:12] 


ASID, bits [63:48] 
ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


Qb01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
Qb11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Reserved. Treat as if TTL<3:2> is @b00. 
0b10 : Level 2. 
Qb11 : Level 3. 
Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


` Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 
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° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 

° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 


when the instruction is executed, because VA[15:12] have no effect on the operation of the 


instruction. 


Executing the TLBI VAE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VAE10S{, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VAE10S(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VAE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VAE10S(X[t]); 
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C5.5.58 


C5-688 


TLBI VAE2, TLB invalidate by VA, EL2 


The TLBI VAE2 characteristics are: 


Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
° The entry would be required to translate the specified VA using the EL2 or the EL2&0 
translation regime. 
d If HCR_EL2.E2H == 0, the entry is from any level of the translation table walk. 
` If HCR_EL2.E2H == 1 one of the following applies: 
— The entry is from a level of the translation table walk above the final level and matches 
the specified ASID. 
— The entry is a global entry from the final level of the translation table walk. 
— The entry is a non-global entry from the final level of the translation table walk and 
matches the specified ASID. 
The invalidation applies to the PE that executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VAE2 is a 64-bit System instruction. 


Field descriptions 


The TLBI VAE2 input value bit assignments are: 


48 47 44 43 0 


ASID TTL VA[55:12] 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 
TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 


Qb00 : Reserved. Treat as if TTL<3:2> is @b00. 
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Qb01 : Level 1. 

0b10 : Level 2. 

0b11 : Level 3. 

The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

Qb01 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b10 : Level 2. 

0b11 : Level 3. 

The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

Qb01 : Level 1. 

0b10 : Level 2. 

0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAE2 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VAE2{, <Xt>} 


if PSTATE.EL == EL@ then 


UNDEFINED; 





op0 op1 CRn CRm op2 





0b01 0b100 0b1000 Ob0111 0b001 





elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 


TLBI_VAE2(X[t]); 


elsif PSTATE.EL == EL3 then 
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if !EL2Enabled() then 
UNDEFINED; 

else 
TLBI_VAE2(X[t]); 
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C5.5.59 TLBI VAEZ2IS, TLB Invalidate by VA, EL2, Inner Shareable 


63 
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The TLBI VAEZIS characteristics are: 


Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
° The entry would be required to translate the specified VA using the EL2 or the EL2&0 
translation regime. 
d If HCR_EL2.E2H == 0, the entry is from any level of the translation table walk. 
° If HCR_EL2.E2H == 1 one of the following applies: 
— The entry is from a level of the translation table walk above the final level and matches 
the specified ASID. 
— The entry is a global entry from the final level of the translation table walk. 
— The entry is a non-global entry from the final level of the translation table walk and 
matches the specified ASID. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VAEZIS is a 64-bit System instruction. 


Field descriptions 


The TLBI VAEZ2IS input value bit assignments are: 


48 47 44 43 0 


ASID TTL VA[55:12] 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 
TTL, bits [47:44] 
When ARMV%8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
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Qb10xx 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Level 1. 

0b10 : Level 2. 

0b11 : Level 3. 

The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 


0b10 : Level 2. 
Qb11 : Level 3. 


Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 


Obxx is encoded as: 


Qb00 : Reserved. Treat as if TTL<3:2> is @b00. 


Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 


(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 

° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 

° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 


when the instruction is executed, because VA[15:12] have no effect on the operation of the 


instruction. 


Executing the TLBI VAEZ2IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VAE2IS{, <Xt>} 





op0 op1 


CRm op2 





0b01 0b100 


0b0011 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_VAE2IS(X[t]); 
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elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_VAE2IS(X[t]); 
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C5.5.60 TLBI VAE2OS, TLB Invalidate by VA, EL2, Outer Shareable 


The TLBI VAE2OS characteristics are: 


Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
° The entry would be required to translate the specified VA using the EL2 or the EL2&0 
translation regime. 
d If HCR_EL2.E2H == 0, the entry is from any level of the translation table walk. 
° If HCR_EL2.E2H == 1 one of the following applies: 
— The entry is from a level of the translation table walk above the final level and matches 
the specified ASID. 
— The entry is a global entry from the final level of the translation table walk. 
— The entry is a non-global entry from the final level of the translation table walk and 
matches the specified ASID. 
The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 
Configurations 
This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI VAE20S are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VAE2OS is a 64-bit System instruction. 


Field descriptions 


The TLBI VAE2OS input value bit assignments are: 


63 48 47 44 43 0 


ASID TTL VA[55:12] 


ASID, bits [63:48] 
When HCR_EL2.E2H == 1: 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Otherwise: 


Reserved, RESO. 
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TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


0b01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Reserved. Treat as if TTL<3:2> is @b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Ob11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAE2OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VAE20S{, <Xt>} 





op0 op1 CRn 


0b01 0b100 0b1000 


CRm 


0b0001 


op2 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_VAE20S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_VAE20S(X[t]); 
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C5.5.61 TLBI VAE3, TLB Invalidate by VA, EL3 
The TLBI VAE3 characteristics are: 


Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


. The entry is a stage 1 translation table entry, from any level of the translation table walk. 
° The entry would be used to translate the specified VA using the EL3 translation regime. 


The invalidation applies to the PE that executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI VAE3 is a 64-bit System instruction. 


Field descriptions 


The TLBI VAE3 input value bit assignments are: 


63 48 47 44 43 0 


RESO TTL VA[55:12] 


Bits [63:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


ObO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
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0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAE3 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VAE3{, <Xt>} 











op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0111 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_VAE3(X[t]); 
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C5.5.62 TLBI VAE3IS, TLB Invalidate by VA, EL3, Inner Shareable 
The TLBI VAE3IS characteristics are: 


Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


. The entry is a stage 1 translation table entry, from any level of the translation table walk. 
° The entry would be used to translate the specified VA using the EL3 translation regime. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 

Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI VAE3IS is a 64-bit System instruction. 


Field descriptions 


The TLBI VAE3IS input value bit assignments are: 


63 48 47 44 43 0 


RESO TTL VA[55:12] 


Bits [63:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV%8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
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0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 

° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAE3IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VAE3IS{, <Xt>} 











op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0011 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_VAE3IS(X[t]); 
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C5.5.63 TLBI VAE30S, TLB Invalidate by VA, EL3, Outer Shareable 
The TLBI VAE3OS characteristics are: 


Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


. The entry is a stage 1 translation table entry, from any level of the translation table walk. 
° The entry would be used to translate the specified VA using the EL3 translation regime. 
The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 

Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI VAE3OS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI VAE3OS is a 64-bit System instruction. 


Field descriptions 


The TLBI VAE3OS input value bit assignments are: 


63 48 47 44 43 0 


RESO TTL VA[55:12] 


Bits [63:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


Ob01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
@b11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
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Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VAE3OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VAE3OS{, <Xt>} 











op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0001 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_VAE30S(X[t]) ; 
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C5.5.64 TLBI VALE1, TLB Invalidate by VA, Last level, EL1 


63 
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The TLBI VALE] characteristics are: 


Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
s The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified VA, and one of the following applies: 
— The entry is a global entry from the final level of lookup. 
— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 
° When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 
. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 
The invalidation applies to the PE that executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VALE1 is a 64-bit System instruction. 


Field descriptions 


The TLBI VALE] input value bit assignments are: 


48 47 44 43 0 


ASID TTL VA[55:12] 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 
TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 
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QbO1xx 


Qb10xx 


Qb11xx 


The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Level 1. 

0b10 : Level 2. 

0b11 : Level 3. 

The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b10 : Level 2. 

0b11 : Level 3. 

The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Level 1. 

0b10 : Level 2. 

0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA [55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VALE1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VALE1{, <Xt>} 


if PSTATE.EL == EL@ then 


UNDEFINED; 





op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0111 0b101 





elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
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TLBI_VALE1IS(X[t]); 
else 
TLBI_VAAE1(X[t]) ; 
elsif PSTATE.EL == EL2 then 
TLBI_VAAE1(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VAAE1(X[t]); 
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C5.5.65 TLBI VALE1IS, TLB Invalidate by VA, Last level, EL1, Inner Shareable 


The TLBI VALELS characteristics are: 





Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry. 

. The entry would be used to translate the specified VA, and one of the following applies: 

— The entry is a global entry from the final level of lookup. 

— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 

° When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When ElL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

From Armv8.4, when a TLB maintenance instruction is generated to the Secure EL1&0 translation 

regime and is defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

. A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

. A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

è A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VALELIS is a 64-bit System instruction. 
Field descriptions 


The TLBI VALEIIS input value bit assignments are: 


63 48 47 44 43 0 


ASID TTL VA[55:12] 
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ASID, bits [63:48] 
ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


Ob01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 

° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 

° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 
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Executing the TLBI VALE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VALE1IS{, <Xt>} 


op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0011 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VALE1IS(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VALE1IS(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VALE1IS(X[t]); 
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C5.5.66 TLBI VALE10S, TLB Invalidate by VA, Last level, EL1, Outer Shareable 


The TLBI VALE1OS characteristics are: 





Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry. 

. The entry would be used to translate the specified VA, and one of the following applies: 
— The entry is a global entry from the final level of lookup. 

— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 

° When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL2 is not implemented or disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1&0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

. A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

. A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

è A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

Configurations 

This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 

to TLBI VALE1OS are UNDEFINED. 

RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


TLBI VALEIOS is a 64-bit System instruction. 


Field descriptions 


The TLBI VALE1OS input value bit assignments are: 
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48 47 44 43 


63 0 
| ASID TTL | VA[55:12] 


ASID, bits [63:48] 
ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


Qb01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
Qb11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Reserved. Treat as if TTL<3:2> is @b00. 
0b10 : Level 2. 
Qb11 : Level 3. 
Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


` Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 
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° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 

° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 


when the instruction is executed, because VA[15:12] have no effect on the operation of the 


instruction. 


Executing the TLBI VALE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VALE10S{, <Xt>} 





op0 op1 CRn CRm op2 





0b01 0b000 0b1000 0b0001 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VALE10S(X[t]); 
elsif PSTATE.EL == EL2 then 
TLBI_VALE10S(X[t]); 
elsif PSTATE.EL == EL3 then 
TLBI_VALE10S(X[t]); 
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C5.5.67 TLBI VALE2, TLB Invalidate by VA, Last level, EL2 


The TLBI VALE2 characteristics are: 


Purpose 
When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 
£ The entry is a stage 1 translation table entry. 
° The entry would be used to translate the specified VA using the EL2 or EL2&0 translation 
regime. 
- If HCR_EL2.E2H == 0, the entry is from the final level of the translation table walk. 
g If HCR_EL2.E2H = 1, one of the following applies: 
— The entry is a global entry from the final level of the translation table walk. 
— The entry is a non-global entry from the final level of translation table walk that 
matches the specified ASID. 
The invalidation applies to the PE that executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VALE2 is a 64-bit System instruction. 


Field descriptions 


The TLBI VALE2 input value bit assignments are: 


63 48 47 44 43 0 


ASID TTL VA[55:12] 


ASID, bits [63:48] 
When HCR_EL2.E2H == 1: 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Otherwise: 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 

address being invalidated. 

0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
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0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Level 1. 

0b10 : Level 2. 

Qb11 : Level 3. 

The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b10 : Level 2. 

Qb11 : Level 3. 

The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Level 1. 

0b10 : Level 2. 

Qb11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VALE2 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VALE2{, <Xt>} 


if PSTATE.EL == EL@ then 


UNDEFINED; 





op0 op1 CRn CRm op2 





0b01 0b100 0b1000 0b0111 0b101 





elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 


TLBI_VALE2(X[t]) ; 
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elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_VALE2(X[t]); 
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C5.5.68 TLBI VALEZ2IS, TLB Invalidate by VA, Last level, EL2, Inner Shareable 


63 
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The TLBI VALEZIS characteristics are: 


Purpose 


When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


£ The entry is a stage 1 translation table entry. 


° The entry would be used to translate the specified VA using the EL2 or EL2&0 translation 
regime. 


- If HCR_EL2.E2H == 0, the entry is from the final level of the translation table walk. 
° If HCR_EL2.E2H = 1, one of the following applies: 
— The entry is a global entry from the final level of the translation table walk. 


— The entry is a non-global entry from the final level of translation table walk that 
matches the specified ASID. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 

Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI VALEZIS is a 64-bit System instruction. 


Field descriptions 


The TLBI VALEZIS input value bit assignments are: 


48 47 44 43 0 


ASID TTL VA[55:12] 


ASID, bits [63:48] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 
TTL, bits [47:44] 
When ARMV%8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


Qb01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
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Qb10xx 


0b10 : Level 2. 

Qb11 : Level 3. 

The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

Qb01 : Reserved. Treat as if TTL<3:2> is 0b00. 


0b10 : Level 2. 
0b11 : Level 3. 


Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 


Obxx is encoded as: 


Qb00 : Reserved. Treat as if TTL<3:2> is @b00. 


Qb01 : Level 1. 
0b10 : Level 2. 
Qb11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 


(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 

° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 

° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 


when the instruction is executed, because VA[15:12] have no effect on the operation of the 


instruction. 


Executing the TLBI VALEZ2IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VALE2IS{, <Xt>} 











op0 op1 CRm op2 
0b01 0b100 0b0011 0b101 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_VALE21S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
C5-716 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


The A64 System Instruction Class 
C5.5 A64 System instructions for TLB maintenance 


UNDEFINED; 
else 
TLBI_VALE2IS(X[t]); 
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C5.5.69 TLBI VALE2OS, TLB Invalidate by VA, Last level, EL2, Outer Shareable 
The TLBI VALE2OS characteristics are: 


Purpose 


When EL2 is implemented and enabled in the current Security state, invalidates cached copies of 
translation table entries from TLBs that meet all the following requirements: 


£ The entry is a stage 1 translation table entry. 


° The entry would be used to translate the specified VA using the EL2 or EL2&0 translation 
regime. 


- If HCR_EL2.E2H == 0, the entry is from the final level of the translation table walk. 
° If HCR_EL2.E2H = 1, one of the following applies: 
— The entry is a global entry from the final level of the translation table walk. 


— The entry is a non-global entry from the final level of translation table walk that 
matches the specified ASID. 


The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 
Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI VALE20S are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI VALE2OS is a 64-bit System instruction. 


Field descriptions 


The TLBI VALE2OS input value bit assignments are: 


63 48 47 44 43 0 


ASID TTL VA[55:12] 


ASID, bits [63:48] 
When HCR_EL2.E2H == 1: 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 


If the implementation supports 16 bits of ASID, but only 8 bits are being used in the context being 
invalidated, the upper bits are RESO. 


Otherwise: 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMVv%8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 
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The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 


0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Level 1. 

0b10 : Level 2. 

0b11 : Level 3. 

The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b10 : Level 2. 

0b11 : Level 3. 

The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 

0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 

0b01 : Level 1. 

0b10 : Level 2. 

0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA [55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 


Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VALE2OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VALE2OS{, <Xt>} 


if PSTATE.EL == EL@ then 


UNDEFINED; 





op0 op1 CRn CRm op2 





0b01 0b100 0b1000 0b0001 0b101 





elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 
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UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_VALE20S(X[t]); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
UNDEFINED; 
else 
TLBI_VALE20S(X[t]); 
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C5.5.70 TLBI VALE3, TLB Invalidate by VA, Last level, EL3 
The TLBI VALE3 characteristics are: 


Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


. The entry is a stage 1 translation table entry, from the final level of the translation table walk. 
° The entry would be used to translate the specified VA using the EL3 translation regime. 


The invalidation applies to the PE that executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI VALE3 is a 64-bit System instruction. 


Field descriptions 


The TLBI VALE3 input value bit assignments are: 


63 48 47 44 43 0 


RESO TTL VA[55:12] 


Bits [63:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


0b00xx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


ObO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
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0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VALE3 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VALE3{, <Xt>} 











op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0111 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_VALE3(X[t]) ; 
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C5.5.71 TLBI VALE3IS, TLB Invalidate by VA, Last level, EL3, Inner Shareable 
The TLBI VALE3IS characteristics are: 


Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


. The entry is a stage 1 translation table entry, from the final level of the translation table walk. 
° The entry would be used to translate the specified VA using the EL3 translation regime. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 

Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI VALE3IS is a 64-bit System instruction. 


Field descriptions 


The TLBI VALE3IS input value bit assignments are: 


63 48 47 44 43 0 


RESO TTL VA[55:12] 


Bits [63:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV%8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


QbO1xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Qbxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
@bxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
Qb01 : Level 1. 
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0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VALESIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VALE3IS{, <Xt>} 











op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0011 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_VALE31S(X[t]); 
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C5.5.72 TLBI VALE3OS, TLB Invalidate by VA, Last level, EL3, Outer Shareable 
The TLBI VALE30S characteristics are: 


Purpose 


If EL3 is implemented, invalidates cached copies of translation table entries from TLBs that meet 
all the following requirements: 


° The entry is a stage 1 translation table entry, from the final level of the translation table walk. 
° The entry would be used to translate the specified VA using the EL3 translation regime. 
The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 
executes this System instruction. 

Configurations 


This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 
to TLBI VALE30S are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBI VALE30OS is a 64-bit System instruction. 


Field descriptions 


The TLBI VALE30S input value bit assignments are: 


63 48 47 44 43 0 


RESO TTL VA[55:12] 


Bits [63:48] 


Reserved, RESO. 


TTL, bits [47:44] 
When ARMV8.4-TTL is implemented: 


Translation Table Level. Indicates the level of the page table walk that holds the leaf entry for the 
address being invalidated. 


QbOOxx No information supplied as to the translation table level. Hardware must assume that the 
entry can be from any level. In this case, TTL<1:0> is RESO. 


Ob01xx The entry comes from a 4KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is @b00. 
0b01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 
Qb10xx The entry comes from a 16KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b01 : Reserved. Treat as if TTL<3:2> is 0b00. 
0b10 : Level 2. 
0b11 : Level 3. 
@b11xx The entry comes from a 64KB translation granule. The level of walk for the leaf level 
Obxx is encoded as: 
0b00 : Reserved. Treat as if TTL<3:2> is 0b00. 
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Qb01 : Level 1. 
0b10 : Level 2. 
0b11 : Level 3. 


If an incorrect value of the TTL field is specified for the entry being invalidated by the instruction, 
then no entries are required by the architecture to be invalidated from the TLB. 


Otherwise: 


Reserved, RESO. 


VA[55:12], bits [43:0] 


Bits[55:12] of the virtual address to match. Any appropriate TLB entries that match the ASID value 
(if appropriate) and VA will be affected by this System instruction. 


If the TLB maintenance instructions are targeting a translation regime that is using AArch32, and 
so has a VA of only 32 bits, then the software must treat bits[55:32] as RESO. 


The treatment of the low-order bits of this field depends on the translation granule size, as follows: 
° Where a 4KB translation granule is being used, all bits are valid and used for the invalidation. 


° Where a 16KB translation granule is being used, bits [1:0] of this field are RESO and ignored 
when the instruction is executed, because VA[13:12] have no effect on the operation of the 
instruction. 


° Where a 64KB translation granule is being used, bits [3:0] of this field are RESO and ignored 
when the instruction is executed, because VA[15:12] have no effect on the operation of the 
instruction. 


Executing the TLBI VALE3OS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VALE3OSf{, <Xt>} 











op0 op1 CRn CRm op2 
0b01 0b110 0b1000 0b0001 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TLBI_VALE30S(X[t]); 
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C5.5.73 TLBI VMALLE1, TLB Invalidate by VMID, All at stage 1, EL1 


ARM DDI 0487E.a 
ID070919 


The TLBI VMALLE! characteristics are: 








Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
s The entry is a stage 1 translation table entry, from any level of the translation table walk. 
. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 
—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 
—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 
. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 
The invalidation applies to the PE that executes this System instruction. 
Note 
For the EL1&0 translation regimes, the invalidation applies to both global entries, and non-global 
entries with any ASID. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VMALLE1 is a 64-bit System instruction. 


Field descriptions 


TLBI VMALLE1 ignores the value in the register specified by the instruction. Software does not have to write a 
value to the register before issuing this instruction. 


Executing the TLBI VMALLE1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VMALLE1{, <Xt>} 





op0 op1 CRn CRm op2 Rt 


0b01 0b000 0b1000 0b0111 0b000 0b11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FB == '1' then 
TLBI_VMALLE1IS(); 
else 
TLBI_VMALLE1(); 
elsif PSTATE.EL == EL2 then 
TLBI_VMALLE1(); 
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elsif PSTATE.EL == EL3 then 
TLBI_VMALLE1(); 
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C5.5.74 TLBI VMALLE1IS, TLB Invalidate by VMID, All at stage 1, EL1, Inner Shareable 


ARM DDI 0487E.a 
ID070919 


The TLBI VMALLELIS characteristics are: 





Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry, from any level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL 2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

From Armv8.4, when a TLB maintenance instruction is generated to the Secure EL1&0 translation 

regime and is defined to pass a VMID argument, or would be defined to pass a VMID argument if 
SCR_EL3.EEL2==1, then: 
. A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 
a A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 
è A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 
For the EL1&0 translation regimes, the invalidation applies to both global entries, and non-global 
entries with any ASID. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VMALLEIIS is a 64-bit System instruction. 


Field descriptions 


TLBI VMALLEIIS ignores the value in the register specified by the instruction. Software does not have to write a 
value to the register before issuing this instruction. 


Executing the TLBI VMALLE1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VMALLETIS{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0011 0b000 


Rt 


Ob11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VMALLE1IS(); 
elsif PSTATE.EL == EL2 then 
TLBI_VMALLE1IS(); 
elsif PSTATE.EL == EL3 then 
TLBI_VMALLE1IS(); 
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C5.5.75 TLBI VMALLE10S, TLB Invalidate by VMID, All at stage 1, EL1, Outer Shareable 


The TLBI VMALLEIOS characteristics are: 





Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

s The entry is a stage 1 translation table entry, from any level of the translation table walk. 

. When EL2 is implemented and enabled in the Security state described by the current value 
of SCR_EL3.NS: 

—  IfHCR_EL2.{E2H, TGE} is not {1, 1}, the entry would be used with the current 
VMID and would be required to translate the specified VA using the EL1&0 
translation regime. 

—  IfHCR_EL2.{E2H, TGE} is {1, 1}, the entry would be required to translate the 
specified VA using the EL2&0 translation regime. 

. When EL2 is not implemented or is disabled in the current Security state, the entry would be 
required to translate the specified VA using the EL1&0 translation regime. 

The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1 &0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

g A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

a A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

è A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

For the EL1&0 translation regimes, the invalidation applies to both global entries, and non-global 

entries with any ASID. 

Configurations 

This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 

to TLBI VMALLE1OS are UNDEFINED. 

RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


TLBI VMALLEIOS is a 64-bit System instruction. 


Field descriptions 


TLBI VMALLEIOS ignores the value in the register specified by the instruction. Software does not have to write 
a value to the register before issuing this instruction. 


Executing the TLBI VMALLE10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VMALLE10S{, <Xt>} 





op0 op1 CRn CRm op2 


0b01 0b000 0b1000 0b0001 0b000 


Rt 


Ob11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBOS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
TLBI_VMALLE10S() ; 
elsif PSTATE.EL == EL2 then 
TLBI_VMALLE10S() ; 
elsif PSTATE.EL == EL3 then 
TLBI_VMALLE10S() ; 
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C5.5.76 TLBI VMALLS12E1, TLB Invalidate by VMID, All at Stage 1 and 2, EL1 


ARM DDI 0487E.a 
ID070919 


The TLBI VMALLS12E1 characteristics are: 








Purpose 
Invalidates cached copies of translation table entries from TLBs that meet all the following 
requirements: 
. The entry is a stage | or stage 2 translation table entry, from any level of the translation table 
walk. 
° If SCR_EL3.NS is 0, then 
— The entry would be required to translate an address using the Secure EL1&0 
translation regime. 
— If ARMv8.4-SecEL2 is implemented and enabled, the entry would be used with the 
current VMID. 
a If SCR_EL3.NS is 1, then: 
— The entry would be required to translate an address using the Non-secure EL1&0 
translation regime. 
—  IfNon-secure EL2 is implemented, the entry would be used with the current VMID. 
The invalidation applies to the PE that executes this System instruction. 
Note 
For the EL1&0 translation regimes, the invalidation applies to both global entries, and non-global 
entries with any ASID. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VMALLS12E1 is a 64-bit System instruction. 


Field descriptions 


TLBI VMALLS12E1 ignores the value in the register specified by the instruction. Software does not have to write 
a value to the register before issuing this instruction. 


Executing the TLBI VMALLS12E1 instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


TLBI VMALLS12E1{, <Xt>} 





op0 op1 CRn CRm op2 Rt 





0b01 0b100 0b1000 Ob0111 0b110 Ob11111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBI_VMALLS12E1(); 
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elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
TLBI_VMALLE1(); 
else 
TLBI_VMALLS12E1(); 
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C5.5.77 TLBI VMALLS12E1IS, TLB Invalidate by VMID, All at Stage 1 and 2, EL1, Inner Shareable 


The TLBI VMALLS12E1IS characteristics are: 


ARM DDI 0487E.a 
ID070919 








Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

. The entry is a stage | or stage 2 translation table entry, from any level of the translation table 
walk. 

° If SCR_EL3.NS is 0, then 
— The entry would be required to translate an address using the Secure EL1&0 

translation regime. 
— If ARMv8.4-SecEL2 is implemented and enabled, the entry would be used with the 
current VMID. 

° If SCR_EL3.NS is 1, then: 

— The entry would be required to translate an address using the Non-secure EL1&0 
translation regime. 
—  IfNon-secure EL2 is implemented, the entry would be used with the current VMID. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

From Armv8.4, when a TLB maintenance instruction is generated to the Secure EL1&0 translation 

regime and is defined to pass a VMID argument, or would be defined to pass a VMID argument if 
SCR_EL3.EEL2==1, then: 
s A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 
g A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 
. A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 
For the EL1&0 translation regimes, the invalidation applies to both global entries, and non-global 
entries with any ASID. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBI VMALLS12EIIS is a 64-bit System instruction. 


Field descriptions 


TLBI VMALLS12EIIS ignores the value in the register specified by the instruction. Software does not have to write 
a value to the register before issuing this instruction. 


Executing the TLBI VMALLS12E1IS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VMALLS12E1IS{, <Xt>} 





op0 op1 CRn CRm 


0b01 0b100 0b1000 0b0011 


op2 


0b110 


Rt 


Ob11111 





if PSTATE.EL == EL@ then 


UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
TLBI_VMALLS12E11S(); 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
TLBI_VMALLE1IS(); 
else 
TLBI_VMALLS12E11S(); 
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C5.5.78 TLBI VMALLS12E108S, TLB Invalidate by VMID, All at Stage 1 and 2, EL1, Outer Shareable 


ARM DDI 0487E.a 
ID070919 


The TLBI VMALLS12E10OS characteristics are: 








Purpose 

Invalidates cached copies of translation table entries from TLBs that meet all the following 

requirements: 

. The entry is a stage | or stage 2 translation table entry, from any level of the translation table 
walk. 

° If SCR_EL3.NS is 0, then 
— The entry would be required to translate an address using the Secure EL1&0 

translation regime. 
— If ARMv8.4-SecEL2 is implemented and enabled, the entry would be used with the 
current VMID. 

° If SCR_EL3.NS is 1, then: 

— The entry would be required to translate an address using the Non-secure EL1&0 
translation regime. 
—  IfNon-secure EL2 is implemented, the entry would be used with the current VMID. 

The invalidation applies to all PEs in the same Outer Shareable shareability domain as the PE that 

executes this System instruction. 

Note 

When a TLB maintenance instruction is generated to the Secure EL1&0 translation regime and is 

defined to pass a VMID argument, or would be defined to pass a VMID argument if 

SCR_EL3.EEL2==1, then: 

s A PE with SCR_EL3.EEL2==1 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==0. 

g A PE with SCR_EL3.EEL2==0 is not architecturally required to invalidate any entries in the 
Secure EL1&0 translation of a PE in the same required shareability domain with 
SCR_EL3.EEL2==1. 

. A PE is architecturally required to invalidate all relevant entries in the Secure EL1&0 
translation of a System MMU in the same required shareability domain with a VMID of 0. 

For the EL1&0 translation regimes, the invalidation applies to both global entries, and non-global 

entries with any ASID. 

Configurations 

This instruction is present only when ARMv8.4-TLBI is implemented. Otherwise, direct accesses 

to TLBI VMALLS12E10S are UNDEFINED. 

RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


TLBI VMALLS12E10S is a 64-bit System instruction. 


Field descriptions 


TLBI VMALLS12E10OS ignores the value in the register specified by the instruction. Software does not have to 
write a value to the register before issuing this instruction. 


Executing the TLBI VMALLS12E10S instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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TLBI VMALLS12E10S{, <Xt>} 





op0 op1 CRn CRm 


0b01 0b100 0b1000 0b0001 


op2 


0b110 


Rt 


Ob11111 





if PSTATE.EL == EL@ then 


UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
TLBI_VMALLS12E10S() ; 
elsif PSTATE.EL == EL3 then 
if !EL2Enabled() then 
TLBI_VMALLE10S() ; 
else 
TLBI_VMALLS12E10S() ; 
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C5.6 A64 System instructions for prediction restriction 


This section lists the A64 System instructions for prediction restriction. 
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C5.6.1 CFP RCTX, Control Flow Prediction Restriction by Context 
The CFP RCTX characteristics are: 


Purpose 


Control Flow Prediction Restriction by Context applies to all Control Flow Prediction Resources 
that predict execution based on information gathered within the target execution context or contexts. 


When this instruction is complete and synchronized, control flow prediction does not permit later 
speculative execution within the target execution context to be observable through side channels. 
This instruction is guaranteed to be complete following a DSB that covers both read and write 

behavior on the same PE as executed the original restriction instruction, and a subsequent context 


synchronization event is required to ensure that the effect of the completion of the instructions is 
synchronized to the current execution. 


Note 


This instruction does not require the invalidation of prediction structures so long as the behavior 
described for completion of this instruction is met by the implementation. 





On some implementations the instruction is likely to take a significant number of cycles to execute. 
This instruction is expected to be used very rarely, such as on the roll-over of an ASID or VMID, 
but should not be used on every context switch. 





Configurations 


This instruction is present only when ARMV8.0-PredInv is implemented. Otherwise, direct accesses 
to CFP RCTX are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CFP RCTX is a 64-bit System instruction. 


Field descriptions 


The CFP RCTX input value bit assignments are: 


63 49 48 47 32 31 27 26 25 24 23 17 16 15 
RESO Le VMID RESO kd = | RESO | [oe |. ASID 
wem — a a 


Bits [63:49] 
Reserved, RESO. 
GVMID, bit [48] 
Execution of this instruction applies to all VMIDs or a specified VMID. 


Ob Applies to specified VMID for an ELO or EL1 context. For all other contexts this field 
is RESO. 
Qb1 Applies to all VMIDs for an ELO or EL1 context. For all other contexts this field is RESO. 


If the instruction is executed at ELO or EL1, then this field has an Effective value of 0. 


VMID, bits [47:32] 
Only applies when bit[48] is 0 and either: 


. an EL1 context. 
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° an ELO context when (HCR_EL2.E2H==0 or HCR_EL2.TGE==0). 
Otherwise this field is RESO. 
When the instruction is executed at EL1 then this field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==0 or HCR_EL2.TGE==0) then this 
field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==1 and HCR_EL2.TGE==1) then 
this field is ignored. 
Bits [31:27] 


Reserved, RESO. 


NS, bit [26] 
Security State 
Qbd Secure state 
Qb1 Non-secure state 


If the instruction is executed in Non-secure state, this field has an Effective value of 1. 


EL, bits [25:24] 


Exception Level 


0b00 ELO. 
0b01 ELI. 
0b10 EL2. 
0b11 EL3. 
If the instruction is executed at an exception level lower than the specified level, this instruction is 
treated as a NOP. 


Bits [23:17] 
Reserved, RESO. 
GASID, bit [16] 
Execution of this instruction applies to all ASIDs or a specified ASID. 
Ob Applies to specified ASID for an ELO context. For all other contexts this field is RESO. 
Qb1 Applies to all ASID for an ELO context. For all other contexts this field is RESO. 
If the instruction is executed at ELO, then this field has an Effective value of 0. 
ASID, bits [15:0] 
Only applies for an ELO context and when bit[16] is 0. 
Otherwise this field is RESO. 
When the instruction is executed at ELO then this field is treated as the current ASID. 


Executing the CFP RCTX instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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CFP RCTX, <Xt> 





op0 CRn op1 op2 CRm 


0b01 0b0111 0b011 0b100 0b0011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.EnRCTX == '0' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.EnRCTX == '0' 
then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
CFP_RCTX(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
CFP_RCTX(X[t]); 
elsif PSTATE.EL == EL2 then 
CFP_RCTX(X[t]); 
elsif PSTATE.EL == EL3 then 
CFP_RCTX(X[t]); 
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C5.6.2 CPP RCTX, Cache Prefetch Prediction Restriction by Context 
The CPP RCTX characteristics are: 


Purpose 


Cache Prefetch Prediction Restriction by Context applies to all Cache Allocation Resources that 
predict cache allocations based on information gathered within the target execution context or 
contexts. 


When this instruction is complete and synchronized, cache prefetch prediction does not permit later 
speculative execution within the target execution context to be observable through side channels. 


This instruction applies to all: 
° Instruction caches. 
° Data caches. 


$ TLB prefetching hardware used by the executing PE that applies to the supplied context or 
contexts. 


This instruction is guaranteed to be complete following a DSB that covers both read and write 
behavior on the same PE as executed the original restriction instruction, and a subsequent context 
synchronization event is required to ensure that the effect of the completion of the instructions is 
synchronized to the current execution. 


Note 


This instruction does not require the invalidation of Cache Allocation Resources so long as the 
behavior described for completion of this instruction is met by the implementation. 





On some implementations the instruction is likely to take a significant number of cycles to execute. 
This instruction is expected to be used very rarely, such as on the roll-over of an ASID or VMID, 
but should not be used on every context switch. 





Configurations 


This instruction is present only when ARMV8.0-PredInv is implemented. Otherwise, direct accesses 
to CPP RCTX are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CPP RCTX is a 64-bit System instruction. 


Field descriptions 


The CPP RCTX input value bit assignments are: 


63 49 48 47 32 31 27 26 25 24 23 17 16 15 
RESO Le VMID RESO he & | RESO | Log |) ASID 
Cn A O S 


Bits [63:49] 
Reserved, RESO. 
GVMID, bit [48] 
Execution of this instruction applies to all VMIDs or a specified VMID. 


Ob Applies to specified VMID for an ELO or EL1 context. For all other contexts this field 
is RESO. 
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C5-744 


Qb1 Applies to all VMIDs for an ELO or EL1 context. For all other contexts this field is RESO. 
If the instruction is executed at ELO or EL1, then this field has an Effective value of 0. 


VMID, bits [47:32] 
Only applies when bit[48] is 0 and one of: 
° an EL1 context. 
- an ELO context when (HCR_EL2.E2H==0 or HCR_EL2.TGE==0). 
Otherwise this field is RESO. 
When the instruction is executed at EL1 then this field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==0 or HCR_EL2.TGE==0) then this 
field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==1 and HCR_EL2.TGE==1) then 
this field is ignored. 
Bits [31:27] 
Reserved, RESO. 
NS, bit [26] 
Security State. 
Obed Secure state. 


Qb1 Non-secure state. 


If the instruction is executed in Non-secure state, this field has an Effective value of 1. 


EL, bits [25:24] 


Exception Level. 


0b00 ELO. 
0b01 EL1. 
0b10 EL2. 
0b11 EL3. 


If the instruction is executed at an exception level lower than the specified level, this instruction is 
treated as a NOP. 


Bits [23:17] 
Reserved, RESO. 
GASID, bit [16] 
Execution of this instruction applies to all ASIDs or a specified ASID. 
Ob Applies to specified ASID for an ELO context. For all other contexts this field is RESO. 
Qb1 Applies to all ASID for an ELO context. For all other contexts this field is RESO. 
If the instruction is executed at ELO, then this field has an Effective value of 0. 
ASID, bits [15:0] 
Only applies for an ELO context and when bit[16] is 0. 
Otherwise this field is RESO. 
When the instruction is executed at ELO then this field is treated as the current ASID. 


Executing the CPP RCTX instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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CPP RCTX, <Xt> 





op0 CRn op1 op2 CRm 


0b01 0b0111 0b011 0b111 0b0011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.EnRCTX == '0' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.EnRCTX == '0' 
then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
CPP_RCTX(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
CPP_RCTX(X[t]); 
elsif PSTATE.EL == EL2 then 
CPP_RCTX(X[t]); 
elsif PSTATE.EL == EL3 then 
CPP_RCTX(X[t]); 
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C5.6.3 DVP RCTX, Data Value Prediction Restriction by Context 
The DVP RCTX characteristics are: 


Purpose 


Data Value Prediction Restriction by Context applies to all Data Value Prediction Resources that 
predict execution based on information gathered within the target execution context or contexts. 


When this instruction is complete and synchronized, data value prediction does not permit later 
speculative execution within the target execution context to be observable through side channels. 


This instruction is guaranteed to be complete following a DSB that covers both read and write 
behavior on the same PE as executed the original restriction instruction, and a subsequent context 
synchronization event is required to ensure that the effect of the completion of the instructions is 
synchronized to the current execution. 





Note 


This instruction does not require the invalidation of prediction structures so long as the behavior 
described for completion of this instruction is met by the implementation. 


On some implementations the instruction is likely to take a significant number of cycles to execute. 
This instruction is expected to be used very rarely, such as on the roll-over of an ASID or VMID, 
but should not be used on every context switch. 





Configurations 


This instruction is present only when ARMV8.0-PredInv is implemented. Otherwise, direct accesses 
to DVP RCTX are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DVP RCTX is a 64-bit System instruction. 


Field descriptions 


The DVP RCTX input value bit assignments are: 


63 49 48 47 32 31 27 26 25 24 23 17 16 15 


RESO VMID RESO kd = | RESO | [oe |. ASID 


GVMID _ S ë ëåë E a 


Bits [63:49] 
Reserved, RESO. 
GVMID, bit [48] 
Execution of this instruction applies to all VMIDs or a specified VMID. 


Ob Applies to specified VMID for an ELO or EL1 context. For all other contexts this field 
is RESO. 
Qb1 Applies to all VMIDs for an ELO or EL1 context. For all other contexts this field is RESO. 


If the instruction is executed at ELO or EL1, then this field has an Effective value of 0. 


VMID, bits [47:32] 
Only applies when bit[48] is 0 and one of: 


. an EL1 context. 
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° an ELO context when (HCR_EL2.E2H==0 or HCR_EL2.TGE==0). 
Otherwise this field is RESO. 
When the instruction is executed at EL1 then this field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==0 or HCR_EL2.TGE==0) then this 
field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==1 and HCR_EL2.TGE==1) then 
this field is ignored. 
Bits [31:27] 


Reserved, RESO. 


NS, bit [26] 
Security State. 
Qbd Secure state. 
Qb1 Non-secure state. 


If the instruction is executed in Non-secure state, this field has an Effective value of 1. 


EL, bits [25:24] 


Exception Level 


0b00 ELO. 
0b01 ELI. 
0b10 EL2. 
0b11 EL3. 
If the instruction is executed at an exception level lower than the specified level, this instruction is 
treated as a NOP. 


Bits [23:17] 
Reserved, RESO. 
GASID, bit [16] 
Execution of this instruction applies to all ASIDs or a specified ASID. 
Ob Applies to specified ASID for an ELO context. For all other contexts this field is RESO. 
Qb1 Applies to all ASID for an ELO context. For all other contexts this field is RESO. 
If the instruction is executed at ELO, then this field has an Effective value of 0. 
ASID, bits [15:0] 
Only applies for an ELO context and when bit[16] is 0. 
Otherwise this field is RESO. 
When the instruction is executed at ELO then this field is treated as the current ASID. 


Executing the DVP RCTX instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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DVP RCTX, <Xt> 





op0 CRn op1 op2 CRm 


0b01 0b0111 0b011 0b101 0b0011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.EnRCTX == '0' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.EnRCTX == '0' 
then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DVP_RCTX(X[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
DVP_RCTX(X[t]); 
elsif PSTATE.EL == EL2 then 
DVP_RCTX(X[t]); 
elsif PSTATE.EL == EL3 then 
DVP_RCTX(X[t]); 
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This chapter describes the A64 base instructions. 


It contains the following sections: 
. About the A64 base instructions on page C6-750. 
° Alphabetical list of A64 base instructions on page C6-753. 
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C6.1 About the A64 base instructions 


Alphabetical list of A64 base instructions on page C6-753 gives full descriptions of the A64 instructions that are in 
the following instruction groups: 


è Branch, Exception generation, and System instructions. 

. Loads and stores associated with the general-purpose registers. 
è Data processing (immediate). 

a Data processing (register). 


A64 instruction set encoding on page C4-252 provides an overview of the instruction encodings as well as of the 
instruction classes within their functional groups. 

The rest of this section is general description of the base instructions. It contains the following subsections: 

° Register size. 

s Use of the PC. 

. Use of the stack pointer on page C6-751. 

° Condition flags and related instructions on page C6-751. 


C6.1.1 Register size 


Most data processing, comparison, and conversion instructions that use the general-purpose registers as the source 
or destination operand have two instruction variants that operate on either a 32-bit or a 64-bit value. 


Where a 32-bit instruction form is selected, the following holds: 


° The upper 32 bits of the source registers are ignored. 

$ The upper 32 bits of the destination register are set to zero. 

7 Right shifts and right rotates inject at bit[31], not at bit[63]. 

s The Condition flags, where set by the instruction, are computed from the lower 32 bits. 


This distinction applies even when the results of a 32-bit instruction form are indistinguishable from the lower 32 
bits computed by the equivalent 64-bit instruction form. For example, a 32-bit bitwise ORR could be performed using 
a 64-bit ORR and simply ignoring the top 32 bits of the result. However, the A64 instruction set includes separate 
32-bit and 64-bit forms of the ORR instruction. 


As well as distinct sign-extend or zero-extend instructions, the A64 instruction set also provides the ability to extend 
and shift the final source register of an ADD, SUB, ADDS, or SUBS instruction and the index register of a Load/Store 
instruction. This enables array index calculations involving a 64-bit array pointer and a 32-bit array index to be 
implemented efficiently. 


The assembly language notation enables the distinct identification of registers holding 32-bit values and registers 
holding 64-bit values. See Register names on page C1-174 and Register indexed addressing on page C1-177. 
C6.1.2 Use of the PC 


A64 instructions have limited access to the PC. The only instructions that can read the PC are those that generate a 
PC relative address: 


g ADR and ADRP. 


7 The Load register (literal) instruction class. 

. Direct branches that use an immediate offset. 

. The unconditional branch with link instructions, BL and BLR, that use the PC to create the return link 
address. 


Only explicit control flow instructions can modify the PC: 


e Conditional and unconditional branch and return instructions. 
è Exception generation and exception return instructions. 
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For more details of instructions that can modify the PC, see Branches, Exception generating, and System 
instructions on page C3-190. 


C6.1.3 Use of the stack pointer 


A64 instructions can use the stack pointer only in a limited number of cases: 


Load/Store instructions use the current stack pointer as the base address: 


— When stack alignment checking is enabled by system software and the base register is SP, the current 
stack pointer must be initially quadword aligned, That is, it must be aligned to 16 bytes. Misalignment 
generates an SP alignment fault. See SP alignment checking on page D1-2287 for more information. 


Add and subtract data processing instructions in their immediate and extended register forms, use the current 
stack pointer as a source register or the destination register or both. 


Logical data processing instructions in their immediate form use the current stack pointer as the destination 
register. 


C6.1.4 Condition flags and related instructions 


The A64 base instructions that use the Condition flags as an input are: 


Conditional branch. The conditional branch instruction is B.cond. 


Add or subtract with carry. These instruction types include instructions to perform multi-precision arithmetic 
and calculate checksums. The add or subtract with carry instructions are ADC, ADCS, SBC, and SBCS, or an 
architectural alias for these instructions. 


Conditional select with increment, negate, or invert.This instruction type conditionally selects between one 
source register and a second, incremented, negated, inverted, or unmodified source register. The conditional 
select with increment, negate, or invert instructions are CSINC, CSINV, and CSNEG. 


These instructions also implement: 


— Conditional select or move. The Condition flags select one of two source registers as the destination 
register. Short conditional sequences can be replaced by unconditional instructions followed by a 
conditional select, CSEL. 


— Conditional set. Conditionally selects between 0 and 1, or 0 and -1. This can be used to convert the 
Condition flags to a Boolean value or mask in a general-purpose register, for example. These 
instructions include CSET and CSETM. 


Conditional compare. This instruction type sets the Condition flags to the result of a comparison if the 
original condition is true, otherwise it sets the Condition flags to an immediate value. It permits the flattening 
of nested conditional expressions without using conditional branches or performing Boolean arithmetic 
within the general-purpose registers. The conditional compare instructions are CCMP and CCMN. 


The A64 base instructions that update the Condition flags as an output are: 


Flag-setting data processing instructions, such as ADCS, ADDS, ANDS, BICS, RMIF, SBCS, SETF8, SETF16, and SUBS, 
and the aliases CMN, CMP, and TST. 


Conditional compare instructions such as CCMN, CCMP. 


The random number generation instructions MRS RNDR and MRS RNDRRS, see Effect of random number generation 
instructions on Condition flags on page C6-752. 


The A64 base instructions that manipulate the Condition flags are: 
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Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-751 
Non-Confidential 


A64 Base Instruction Descriptions 
C6.1 About the A64 base instructions 


C6-752 


s If ARMv8.5-CondM is implemented, the base instructions AXFLAG and XAFLAG. These instructions convert 


between the Arm floating point comparison PSTATE condition flag format and an alternative format shown 
in Table C6-1. 


Table C6-1 Relationship between ARM format and alternative format PSTATE condition flags 





Arm format Alternative format 





Result N Z C VIN Z C UV 





Greater than 0 0 1 0 0 0 1 0 





Less than 1 0 0 0 0 0 0 0 





Equal 0O 1 1 0140 1 1 0 





Unordered 0 0 1 1 0 1 0 0 








The flags can be directly accessed for a read/write using the NZCV, Condition Flags on page C5-400. 


The A64 base instructions also include conditional branch instructions that do not use the Condition flags as an 


input: 
° Compare and branch if a register is zero or nonzero, CBZ and CBNZ. 
s Test a single bit in a register and branch if the bit is zero or nonzero, TBZ and TBNZ. 


Effect of random number generation instructions on Condition flags 
If ARMv8.5-RNG is implemented, then: 
$ When a valid random number is returned, the PSTATE.NZCV flags are set to 0b0000. 


a If the random number hardware is not capable of returning a random number in a reasonable period of time, 
the PSTATE.NZCV flags are set to 0b0100, and the random number generation instructions return the value 0. 


Note 
The definition of “reasonable period of time” is IMPLEMENTATION DEFINED. The expectation is that software might 
use this as an opportunity to reschedule or run a different routine, perhaps after a small number of retries have failed 
to return a valid value. 
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C6.2 Alphabetical list of A64 base instructions 


This section lists every instruction in the base category of the A64 instruction set. For details of the format used, see 
Understanding the A64 instruction descriptions on page C2-182. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-753 
ID070919 Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.1 


C6-754 


ADC 


Add with Carry adds two register values and the Carry flag value, and writes the result to the destination register. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| 0 | 
lolo TO 70000] Am joooo000] Rn | Fd | 
op S 


32-bit variant 
Applies when sf == 0. 


ADC <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 1. 


ADC <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
Operation 


bits(datasize) result; 

bits(datasize) operand1 = X[n]; 
bits(datasize) operand2 = X[m] 
(result, -) = AddWithCarry(operand1, operand2, PSTATE.C); 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.2 ADCS 


Add with Carry, setting flags, adds two register values and the Carry flag value, and writes the result to the 
destination register. It updates the condition flags based on the result. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 13 12/11 10 9 5 4| 0 | 
sfloli{1 1010000] Rm joo0o0000|) R | R | 
op S 


32-bit variant 
Applies when sf == 


ADCS <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 


ADCS <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
Operation 


bits(datasize) result; 
bits(datasize) operand1 
bits(datasize) operand2 
bits(4) nzcv; 


X[n]; 
X[m]; 


(result, nzcv) = AddWithCarry(operand1, operand2, PSTATE.C); 
PSTATE.<N,Z,C,V> = nzcv; 


X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2 Alphabetical list of A64 base instructions 


C6.2.3 ADD (extended register) 


Add (extended register) adds a register value and a sign or zero-extended register value, followed by an optional left 
shift amount, and writes the result to the destination register. The argument that is extended from the <Rm> register 
can be a byte, halfword, word, or doubleword. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312; 109 | 5 4| 0 | 


sflofoJo 1 0 1 1fo oft] Rm | option | imms | Rn | Ra | 


op S 


32-bit variant 


Applies when sf == 


ADD <Wd|WSP>, <Wn|WSP>, <Wm>{, <extend> {#<amount>}} 


64-bit variant 


Applies when sf == 


ADD <Xd|SP>, <Xn|SP>, <R><m>{, <extend> {#<amount>}} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = UInt(imm3); 
if shift > 4 then UNDEFINED; 


Assembler symbols 


<Wd|WSP> 


<Wn|WSP> 


<Wm> 


<Xd | SP> 


<Xn | SP> 


<R> 


<m> 


C6-758 


Is the 32-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 


Is the 32-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 


Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 


Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 


Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 


Is a width specifier, encoded in the "option" field. It can have the following values: 


W when option = 00x 
W when option = 010 
X when option = x11 
W when option = 10x 
W when option = 110 


Is the number [0-30] of the second general-purpose source register or the name ZR (31), encoded in 
the "Rm" field. 
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<extend> For the 32-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 
UXTB when option = 000 
UXTH when option = 001 
LSL|UXTW when option = 010 
UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If"Rd" or "Rn" is '11111' (WSP) and "option" is '010' then LSL is preferred, but may be omitted 
when "imm3" is '000". In all other cases <extend> is required and must be UXTW when "option" is 
'010'. 

For the 64-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 


UXTB when option = 000 
UXTH when option = 001 
UXTW when option = 010 
LSL|UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If"Rd" or "Rn" is '11111' (SP) and "option" is '011' then LSL is preferred, but may be omitted when 
"imm3" is '000'. In all other cases <extend> is required and must be UXTX when "option" is '011'. 


<amount> Is the left shift amount to be applied after extension in the range 0 to 4, defaulting to 0, encoded in 
the "imm3" field. It must be absent when <extend> is absent, is required when <extend> is LSL, 
and is optional when <extend> is present but not LSL. 


Operation 


bits(datasize) result; 
bits(datasize) operandl = if n == 31 then SP[] else X[n]; 
bits(datasize) operand2 = ExtendReg(m, extend_type, shift); 


(result, -) = AddWithCarry(operand1l, operand2, 'Q'); 
if d == 31 then 
SP[] = result; 
else 
X[d] = result; 
Operational information 


If PSTATE.DIT is 1: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 


C6-760 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.4 ADD (immediate) 


Add (immediate) adds a register value and an optionally-shifted immediate value, and writes the result to the 
destination register. 


This instruction is used by the alias MOV (to/from SP). See Alias conditions for details of when each alias is 


preferred. 
|31 30 29 28|27 26 25 24/23 2221 | | | 109 | 5 4| 0 | 
isflofo[1 0 o o 1 ojs] immt2 | m | rR | 
op S 
32-bit variant 


Applies when sf == 0. 


ADD <Wd|WSP>, <Wn|WSP>, #<imm>{, <shift>} 


64-bit variant 
Applies when sf == 1. 


ADD <Xd|SP>, <Xn|SP>, #<imm>{, <shift>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer datasize = if sf == '1' then 64 else 32; 
bits(datasize) imm; 


case sh of 
when 'Q' imm = ZeroExtend(imm12, datasize); 
when '1' imm = ZeroExtend(imm12:Zeros(12), datasize); 


Alias conditions 





Alias is preferred when 


MOV (to/from SP) sh == 'Q' && imm12 == '000000000000' && (Rd == '11111' || Rn 








== '11111') 
Assembler symbols 
<Wd | WSP> Is the 32-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 
<Wn | WSP> Is the 32-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<Xd | SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 
<Xn | SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<imm> Is an unsigned immediate, in the range 0 to 4095, encoded in the "imm12" field. 
<shi ft> Is the optional left shift to apply to the immediate, defaulting to LSL #0 and encoded in the "sh" 


field. It can have the following values: 
LSL #0 when sh = 0 
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LSL #12 when sh = 1 


Operation 


bits(datasize) result; 
bits(datasize) operandl = if n == 31 then SP[] else X[n]; 


(result, -) = AddWithCarry(operand1, imm, 'Q'); 


if d == 31 then 
SP[] = result; 
else 
X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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Add (shifted register) adds a register value and an optionally-shifted register value, and writes the result to the 


destination register. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 


| 109 5 4| 0 | 


ROD acs alamo a ee a 


op S 


32-bit variant 
Applies when sf == 


ADD <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


ADD <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize = if sf == '1' then 64 else 32; 


if shift == '11' then UNDEFINED; 
if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift type to be applied to the second source operand, defaulting to LSL and encoded 

in the "shift" field. It can have the following values: 

LSL when shift = 00 

LSR when shift = 01 

ASR when shift = 10 


The encoding shift = 11 is reserved. 


<amount> 
"imm6" field. 


For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 


"imm6" field. 
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Operation 


bits(datasize) result; 
bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


(result, -) = AddWithCarry(operand1, operand2, '@'); 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


$ The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.6 ADDG 


Add with Tag adds an immediate value scaled by the Tag granule to the address in the source register, modifies the 
Logical Address Tag of the address using an immediate value, and writes the result to the destination register. Tags 
specified in GCR_EL1.Exclude are excluded from the possible outputs when modifying the Logical Address Tag. 


ARMV8.5 


|31 30 29 28/27 26 25 24|23 2221 | 16/151413 | 109 5 4| 0| 


e RO e a 


op3 


Integer variant 


ADDG <Xd|SP>, <Xn|SP>, #<uimm6>, #<uimm4> 


Decode for this encoding 
integer d = UInt(Xd); 


integer n = UInt(Xn); 
bits(64) offset = LSL(ZeroExtend(uimm6, 64), LOG2_TAG_GRANULE) ; 


Assembler symbols 


<Xd | SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Xd" 
field. 

<Xn | SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Xn" field. 

<uimm6> Is an unsigned immediate, a multiple of 16 in the range 0 to 1008, encoded in the "uimm6" field. 

<uimm4> Is an unsigned immediate, in the range 0 to 15, encoded in the "uimm4" field. 

Operation 


bits(64) operandl = if n == 31 then SP[] else X[n]; 

bits(4) start_tag = AArch64.AllocationTagFromAddress(operand1) ; 
bits(16) exclude = GCR_EL1.Exclude; 

bits(64) result; 

bits(4) rtag; 


if AArch64.AllocationTagAccessIsEnabled() then 
rtag = AArch64.ChooseNonExcludedTag(start_tag, uimm4, exclude); 
else 
rtag 


"0000' ; 


(result, -) = AddWithCarry(operand1, offset, 'Q'); 
result = AArch64.AddresswWithAl locationTag(result, rtag); 


if d == 31 then 
SP[] = result; 
else 
X[d] = result; 
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C6.2.7 ADDS (extended register) 


Add (extended register), setting flags, adds a register value and a sign or zero-extended register value, followed by 
an optional left shift amount, and writes the result to the destination register. The argument that is extended from 
the <Rm> register can be a byte, halfword, word, or doubleword. It updates the condition flags based on the result. 


This instruction is used by the alias CMN (extended register). See Alias conditions for details of when each alias is 


preferred. 
|31 30 29 28|27 26 25 24/23 22 21 20| 1615 1312| 109 | 5 4| 0 | 
fffo[t[o 101 1]0 0]4] Rm | option] mma] Rn | Ra 
op S 
32-bit variant 


Applies when sf == 0. 


ADDS <Wd>, <Wn|WSP>, <Wm>{, <extend> {#<amount>}} 


64-bit variant 
Applies when sf == 1. 


ADDS <Xd>, <Xn|SP>, <R><m>{, <extend> {#<amount>}} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = UInt(imm3); 

if shift > 4 then UNDEFINED; 


Alias conditions 





Alias is preferred when 
CMN (extended Rd == '11111' 
register) 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn |WSP> Is the 32-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 

<R> Is a width specifier, encoded in the "option" field. It can have the following values: 
W when option = 00x 
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W when option = 010 
X when option = x11 
W when option = 10x 
W when option = 110 
<m> Is the number [0-30] of the second general-purpose source register or the name ZR (31), encoded in 
the "Rm" field. 
<extend> For the 32-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 
UXTB when option = 000 
UXTH when option = 001 
LSL|UXTW when option = 010 
UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If "Rn" is '11111' (WSP) and "option" is '010' then LSL is preferred, but may be omitted when 
"imm3" is '000'. In all other cases <extend> is required and must be UXTW when "option" is '010'. 


For the 64-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 


UXTB when option = 000 
UXTH when option = 001 
UXTW when option = 010 
LSL|UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If"Rn" is '11111' (SP) and "option" is '011' then LSL is preferred, but may be omitted when "imm3" 
is '000'. In all other cases <extend> is required and must be UXTX when "option" is '011'. 


<amount> Is the left shift amount to be applied after extension in the range 0 to 4, defaulting to 0, encoded in 
the "imm3" field. It must be absent when <extend> is absent, is required when <extend> is LSL, 
and is optional when <extend> is present but not LSL. 


Operation 


bits(datasize) result; 

bits(datasize) operandl = if n == 31 then SP[] else X[n]; 
bits(datasize) operand2 = ExtendReg(m, extend_type, shift); 
bits(4) nzcv; 


(result, nzcv) = AddWithCarry(operand1, operand2, 'Q'); 
PSTATE.<N,Z,C,V> = nzcv; 


X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.8 ADDS (immediate) 


ARM DDI 0487E.a 
ID070919 


Add (immediate), setting flags, adds a register value and an optionally-shifted immediate value, and writes the result 
to the destination register. It updates the condition flags based on the result. 


This instruction is used by the alias CMN (immediate). See Alias conditions for details of when each alias is 
preferred. 


|31 30 29 28|27 26 25 24|23 2221 | | | 109 | 5 4| 0| 
isfloli{1 0 0 0 4 ofsh] imm2 | m | rR | 
op S 
32-bit variant 


Applies when sf == 0. 


ADDS <Wd>, <Wn|WSP>, #<imm>{, <shift>} 


64-bit variant 
Applies when sf == 1. 


ADDS <Xd>, <Xn|SP>, #<imm>{, <shift>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer datasize = if sf == '1' then 64 else 32; 
bits(datasize) imm; 


case sh of 
when 'Q' imm = ZeroExtend(imm12, datasize); 
when '1' imm = ZeroExtend(imm12:Zeros(12), datasize); 


Alias conditions 





Alias is preferred when 


CMN (immediate) Rd == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn | WSP> Is the 32-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn | SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<imm> Is an unsigned immediate, in the range 0 to 4095, encoded in the "imm12" field. 

<shift> Is the optional left shift to apply to the immediate, defaulting to LSL #0 and encoded in the "sh" 


field. It can have the following values: 
LSL #0 when sh = 0 
LSL #12 when sh = 1 
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Operation 

bits(datasize) result; 

bits(datasize) operandl = if n == 31 then SP[] else X[n]; 
bits(4) nzcv; 

(result, nzcv) = AddWithCarry(operand1, imm, 'Q'); 


PSTATE.<N,Z,C,V> = nzcv; 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.9 ADDS (shifted register) 


ARM DDI 0487E.a 
ID070919 


Add (shifted register), setting flags, adds a register value and an optionally-shifted register value, and writes the 
result to the destination register. It updates the condition flags based on the result. 


This instruction is used by the alias CMN (shifted register). See Alias conditions for details of when each alias is 
preferred. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 | 109 5 4| o| 


ane e e a e a a a a 


op S 


32-bit variant 
Applies when sf == 


ADDS <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


ADDS <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


if shift == '11' then UNDEFINED; 
if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Alias conditions 





Alias is preferred when 
CMN (shifted Rd == '11111' 
register) 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
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<shift> Is the optional shift type to be applied to the second source operand, defaulting to LSL and encoded 
in the "shift" field. It can have the following values: 


LSL when shift = 00 
LSR when shift = 01 


ASR when shift = 10 


The encoding shift = 11 is reserved. 


<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 
For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field. 

Operation 


bits(datasize) result; 

bits(datasize) operandl = X[n]; 

bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 
bits(4) nzcv; 


(result, nzcv) = AddWithCarry(operand1, operand2, 'Q'); 
PSTATE.<N,Z,C,V> = nzcv; 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.10 ADR 


Form PC-relative address adds an immediate value to the PC value to form a PC-relative address, and writes the 
result to the destination register. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| o| 


immlo}1 0 0 0 0 immhi 
[Ojimmioft_ 0 000|) immbit | R 


op 


Literal variant 


ADR <Xd>, <label> 


Decode for this encoding 


integer d = UInt(Rd); 
bits(64) imm; 


imm = SignExtend(immhi:immlo, 64); 


Assembler symbols 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 


<label> Is the program label whose address is to be calculated. Its offset from the address of this instruction, 
in the range +/-1 MB, is encoded in "immhi:immlo". 


Operation 
bits(64) base = PC[]; 


X[d] = base + imm; 
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C6.2.11 ADRP 


Form PC-relative address to 4KB page adds an immediate value that is shifted left by 12 bits, to the PC value to 
form a PC-relative address, with the bottom 12 bits masked out, and writes the result to the destination register. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| o| 


1jimmlo}1 0000 immhi 
[tfimmioft_o 0 00) mmi | RT 


op 


Literal variant 


ADRP <Xd>, <label> 


Decode for this encoding 


integer d = UInt(Rd); 
bits(64) imm; 


imm = SignExtend(immhi:immlo:Zeros(12), 64); 


Assembler symbols 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<label> Is the program label whose 4KB page address is to be calculated. Its offset from the page address of 


this instruction, in the range +/-4GB, is encoded as "immhi:immlo" times 4096. 


Operation 
bits(64) base = PC[]; 
base<11:0> = Zeros(12); 


X[d] = base + imm; 
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C6.2.12 AND (immediate) 


Bitwise AND (immediate) performs a bitwise AND of a register value and an immediate value, and writes the result 
to the destination register. 


|31 30 29 28|27 26 25 24/23 22 21 | 16/15 | 109 5 4| 0 | 


ohh) ae a a 


opc 


32-bit variant 
Applies when sf == 0 && N == 


AND <Wd|WSP>, <Wn>, #<imm> 


64-bit variant 
Applies when sf == 


AND <Xd|SP>, <Xn>, #<imm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer datasize = if sf == '1' then 64 else 32; 
bits(datasize) imm; 

if sf == '@' && N != '@' then UNDEFINED; 

(imm, -) = DecodeBitMasks(N, imms, immr, TRUE); 


Assembler symbols 


<Wd|WSP> Is the 32-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd | SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<imm> For the 32-bit variant: is the bitmask immediate, encoded in "imms:immr". 


For the 64-bit variant: is the bitmask immediate, encoded in "N:imms:immr". 


Operation 


bits(datasize) result; 
bits(datasize) operandl = X[n]; 


result = operand AND imm; 
if d == 31 then 

SP[] = result; 
else 

X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.13 AND (shifted register) 


ARM DDI 0487E.a 
ID070919 


Bitwise AND (shifted register) performs a bitwise AND of a register value and an optionally-shifted register value, 
and writes the result to the destination register. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 | 109 5 4| 0 | 


C 1-0-1 Oso] ea | as E B 


opc 


32-bit variant 
Applies when sf == 


AND <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


AND <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 
ROR when shift = 11 
<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field, 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-777 
Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Operation 


bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


result = operandl AND operand2; 
X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.14 ANDS (immediate) 


ARM DDI 0487E.a 
ID070919 


Bitwise AND (immediate), setting flags, performs a bitwise AND of a register value and an immediate value, and 
writes the result to the destination register. It updates the condition flags based on the result. 


This instruction is used by the alias TST (immediate). See Alias conditions for details of when each alias is 
preferred. 


|31 30 29 28|27 26 25 24|23 2221 | 16/15 | 109 5 4| o| 


aaea a a aa 


opc 


32-bit variant 
Applies when sf == 0 && N == 


ANDS <Wd>, <Wn>, #<imm> 


64-bit variant 
Applies when sf == 


ANDS <Xd>, <Xn>, #<imm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer datasize = if sf == '1' then 64 else 32; 


bits(datasize) imm; 


if sf == '@' && N != '@' then UNDEFINED; 
(imm, -) = DecodeBitMasks(N, imms, immr, TRUE); 


Alias conditions 





Alias is preferred when 


TST (immediate) Rd == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<imm> For the 32-bit variant: is the bitmask immediate, encoded in "imms:immr". 


For the 64-bit variant: is the bitmask immediate, encoded in "N:imms:immr". 


Operation 


bits(datasize) result; 
bits(datasize) operandl = X[n]; 
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result = operand1 AND imm; 
PSTATE.<N,Z,C,V> = result<datasize-1>:IsZeroBit(result):'QQ'; 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


` The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.15 ANDS (shifted register) 


ARM DDI 0487E.a 
ID070919 


Bitwise AND (shifted register), setting flags, performs a bitwise AND of a register value and an optionally-shifted 
register value, and writes the result to the destination register. It updates the condition flags based on the result. 


This instruction is used by the alias TST (shifted register). See Alias conditions for details of when each alias is 
preferred. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 | 109 5 4| o| 


aione rolno] aa | e — [eT 


opc 


32-bit variant 
Applies when sf == 


ANDS <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


ANDS <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Alias conditions 





Alias is preferred when 
TST (shifted Rd == '11111' 
register) 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
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<shift> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 
ROR when shift = 11 

<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field, 
Operation 


bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


result = operandl AND operand2; 
PSTATE.<N,Z,C,V> = result<datasize-1>:IsZeroBit(result):'QQ'; 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.16 ASR (register) 


ARM DDI 0487E.a 
ID070919 


Arithmetic Shift Right (register) shifts a register value right by a variable number of bits, shifting in copies of its 
sign bit, and writes the result to the destination register. The remainder obtained by dividing the second source 
register by the data size defines the number of bits by which the first source register is right-shifted. 


This instruction is an alias of the ASRV instruction. This means that: 
s The encodings in this description are named to match the encodings of ASRV. 


s The description of ASRV gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24/23 22 21 20 16/15 14 13 1211110 9 | 5 4| 0| 


lojo 70707170] Rm [oo710]10] Rn | Rd 


op2 


32-bit variant 
Applies when sf == 
ASR <Wd>, <Wn>, <Wm> 
is equivalent to 

ASRV <Wd>, <Wn>, <Wm> 


and is always the preferred disassembly. 


64-bit variant 
Applies when sf == 
ASR <Xd>, <Xn>, <Xm> 
is equivalent to 

ASRV <Xd>, <Xn>, <Xm> 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding a shift amount from 0 to 


31 in its bottom 5 bits, encoded in the "Rm" field. 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding a shift amount from 0 to 


63 in its bottom 6 bits, encoded in the "Rm" field. 


Operation 


The description of ASRV gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.17 ASR (immediate) 


ARM DDI 0487E.a 
ID070919 


Arithmetic Shift Right (immediate) shifts a register value right by an immediate number of bits, shifting in copies 
of the sign bit in the upper bits and zeros in the lower bits, and writes the result to the destination register. 


This instruction is an alias of the SBFM instruction. This means that: 
$ The encodings in this description are named to match the encodings of SBFM. 


° The description of SBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


ECR E EE E 


opc imms 


32-bit variant 

Applies when sf == 0 && N == 0 && imms == 011111. 
ASR <Wd>, <Wn>, #<shift> 

is equivalent to 

SBFM <Wd>, <Wn>, #<shift>, #31 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1 && N == 1 && imms == 111111. 
ASR <Xd>, <Xn>, #<shift> 

is equivalent to 

SBFM <Xd>, <Xn>, #<shift>, #63 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<shift> For the 32-bit variant: is the shift amount, in the range 0 to 31, encoded in the "immr" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, encoded in the "immr" field. 


Operation 


The description of SBFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.18 ASRV 


ARM DDI 0487E.a 
ID070919 


Arithmetic Shift Right Variable shifts a register value right by a variable number of bits, shifting in copies of its sign 
bit, and writes the result to the destination register. The remainder obtained by dividing the second source register 


by the data size defines the number of bits by which the first source register is right-shifted. 


This instruction is used by the alias ASR (register). The alias is always the preferred disassembly. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12/11 10 9 = 5 4| 0| 
isffofojt 10701770] Rm  foorol1 of Rn | Ra | 
op2 
32-bit variant 


Applies when sf == 


ASRV <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 


ASRV <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
ShiftType shift_type = DecodeShift(op2); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding a shift amount from 0 to 


31 in its bottom 5 bits, encoded in the "Rm" field. 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding a shift amount from 0 to 


63 in its bottom 6 bits, encoded in the "Rm" field. 


Operation 


bits(datasize) result; 
bits(datasize) operand2 = X[m]; 


result = ShiftReg(n, shift_type, UInt(operand2) MOD datasize); 
X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Address Translate. For more information, see op0==0b01, cache maintenance, TLB maintenance, and address 
translation instructions on page C5-366. 


This instruction is an alias of the SYS instruction. This means that: 


g The encodings in this description are named to match the encodings of SYS. 
s The description of SYS gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20|1918  16|15 12111 8|7 54] 0| 


Daor 01070 0)0f0 7] o [o1 oo om] R | 
L CRn CRm 


System variant 

AT <at_op>, <Xt> 

is equivalent to 

SYS #<op1>, C7, <Cm>, #<op2>, <Xt> 


and is the preferred disassembly when SysOp(op1,'@111',CRm,op2) == Sys_AT. 


Assembler symbols 





<at_op> Is an AT instruction name, as listed for the AT system instruction group, encoded in the 

"op1:CRm<0>:op2" field. It can have the following values: 

S1E1R when op1 = 000, CRm<@> = 0, op2 = 000 

S1E1W when op1 = 000, CRm<@> = 0, op2 = 001 

S1EQR when op1 = 000, CRm<@> = 0, op2 = 010 

S1EQW when op1 = 000, CRm<@> = 0, op2 = 011 

S1E2R when op1 = 100, CRm<@> = 0, op2 = 000 

S1E2W when op1 = 100, CRm<@> = 0, op2 = 001 

S12E1R when op1 = 100, CRm<@> = 0, op2 = 100 

S12E1W when op1 = 100, CRm<@> = 0, op2 = 101 

S12EQR when op1 = 100, CRm<@> = 0, op2 = 110 

S12EQW when op1 = 100, CRm<@> = 0, op2 = 111 

S1E3R when op1 = 110, CRm<@> = 0, op2 = 000 

S1E3W when op1 = 110, CRm<@> = 0, op2 = 001 

When ARMV8.2-ATS1E1 is implemented, the following values are also valid: 
S1E1RP when op1 = 000, CRm<@> = 1, op2 = 000 

S1E1wP when op1 = 000, CRm<@> = 1, op2 = 001 





<op1> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op1" field. 
<Cm> Is a name 'Cm', with 'm' in the range 0 to 15, encoded in the "CRm" field. 
<op2> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op2" field. 
<Xt> Is the 64-bit name of the general-purpose source register, encoded in the "Rt" field. 
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Operation 


The description of SYS gives the operational pseudocode for this instruction. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.20 AUTDA, AUTDZA 


ARM DDI 0487E.a 
ID070919 


Authenticate Data address, using key A. This instruction authenticates a data address, using a modifier and key A. 
The address is in the general-purpose register that is specified by <Xd>. 

The modifier is: 

à In the general-purpose register or stack pointer that is specified by <Xn|SP> for AUTDA. 

° The value zero, for AUTDZA. 


If the authentication passes, the upper bits of the address are restored to enable subsequent use of the address. If the 
authentication fails, the upper bits are corrupted and any subsequent use of the address results in a Translation fault. 


ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


Goon orr ojo oo onjojojz i o] Rn | Rd 


AUTDA variant 
Applies when Z == 0. 


AUTDA <Xd>, <Xn|SP> 


AUTDZA variant 
Applies when Z == 1 && Rn == 11111. 


AUTDZA <Xd> 


Decode for all variants of this encoding 


boolean source_is_sp = FALSE; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if !HavePACExt() then 
UNDEFINED; 


if Z == '@' then // AUTDA 

if n == 31 then source_is_sp = TRUE; 
else // AUTDZA 

if n != 31 then UNDEFINED; 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn | SP> Is the 64-bit name of the general-purpose source register or stack pointer, encoded in the "Rn" field. 
Operation 


if source_is_sp then 

X[d] = AuthDA(X[d], SP[]); 
else 

X[d] = AuthDA(X[d], X[n]); 
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C6.2.21 


C6-792 


AUTDB, AUTDZB 


Authenticate Data address, using key B. This instruction authenticates a data address, using a modifier and key B. 
The address is in the general-purpose register that is specified by <Xd>. 

The modifier is: 

à In the general-purpose register or stack pointer that is specified by <Xn | SP> for AUTDB. 

° The value zero, for AUTDZB. 


If the authentication passes, the upper bits of the address are restored to enable subsequent use of the address. If the 
authentication fails, the upper bits are corrupted and any subsequent use of the address results in a Translation fault. 


ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


Guo onori ojo oo onjoj ie] eo | Rd 


AUTDB variant 
Applies when Z == 0. 


AUTDB <Xd>, <Xn|SP> 


AUTDZB variant 
Applies when Z == 1 && Rn == 11111. 


AUTDZB <Xd> 


Decode for all variants of this encoding 


boolean source_is_sp = FALSE; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if !HavePACExt() then 
UNDEFINED; 


if Z == 'Q' then // AUTDB 

if n == 31 then source_is_sp = TRUE; 
else // AUTDZB 

if n != 31 then UNDEFINED; 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn | SP> Is the 64-bit name of the general-purpose source register or stack pointer, encoded in the "Rn" field. 
Operation 


if source_is_sp then 

X[d] = AuthDB(X[d], SP[]); 
else 

X[d] = AuthDB(X[d], X[n]); 
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C6.2.22 AUTIA, AUTIA1716, AUTIASP, AUTIAZ, AUTIZA 


ARM DDI 0487E.a 
ID070919 


Authenticate Instruction address, using key A. This instruction authenticates an instruction address, using a modifier 
and key A. 


The address is: 

s In the general-purpose register that is specified by <Xd> for AUTIA and AUTIZA. 

. In X17, for AUTIA1716. 

° In X30, for AUTIASP and AUTIAZ. 

The modifier is: 

s In the general-purpose register or stack pointer that is specified by <Xn|SP> for AUTIA. 

. The value zero, for AUTIZA and AUTIAZ. 

: In X16, for AUTIA1716. 

° In SP, for AUTIASP. 

If the authentication passes, the upper bits of the address are restored to enable subsequent use of the address. If the 
authentication fails, the upper bits are corrupted and any subsequent use of the address results in a Translation fault. 
Integer 


ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0 | 


i{ijoj1 101011 0/0000 rJfofojzji oof] Rn | Ra | 


AUTIA variant 
Applies when Z == 


AUTIA <Xd>, <Xn|SP> 


AUTIZA variant 
Applies when Z == 1 && Rn == 11111. 


AUTIZA <Xd> 


Decode for all variants of this encoding 


boolean source_is_sp = FALSE; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if !HavePACExt() then 
UNDEFINED; 


if Z == 'Q' then // AUTIA 

if n == 31 then source_is_sp = TRUE; 
else // AUTIZA 

if n != 31 then UNDEFINED; 
System 


ARMVv8.3 
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[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/11 81/7 5 4|3 21 0| 


T707107010 0/00 001 1f001 000x111 0xJ11111] 
CRm op2 


p 


AUTIA1716 variant 
Applies when CRm == 0001 && op2 == 100. 


AUTIA1716 


AUTIASP variant 
Applies when CRm == 0011 && op2 == 101. 


AUTIASP 


AUTIAZ variant 
Applies when CRm == 0011 && op2 == 100. 


AUTIAZ 


Decode for all variants of this encoding 


integer d; 
integer n; 
boolean source_is_sp = FALSE; 


case CRm:op2 of 
when '0011 100' // AUTIAZ 


d = 30; 
n = 31; 

when '0011 101' // AUTIASP 
d = 30; 


source_is_sp = TRUE; 
when 'Q001 100' // AUTIA1716 


when '0001 000' SEE "PACIA"; 
when '0001 010' SEE "PACIB"; 
when '0001 110' SEE "AUTIB"; 
when 'QQ11 00x' SEE "PACIA"; 
when 'QQ11 @1x' SEE "PACIB"; 
when 'QQ11 11x' SEE "AUTIB"; 
when '0000 111' SEE "XPACLRI"; 
otherwise SEE "HINT"; 








Assembler symbols 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 


<Xn | SP> Is the 64-bit name of the general-purpose source register or stack pointer, encoded in the "Rn" field. 


Operation for all encodings 


if HavePACExt() then 
if source_is_sp then 
X[d] = AuthIA(X[d], SP[]); 
else 
X[d] = AuthIA(X[d], X[n]); 
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C6.2.23 AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZB 


ARM DDI 0487E.a 
ID070919 


Authenticate Instruction address, using key B. This instruction authenticates an instruction address, using a modifier 
and key B. 


The address is: 

s In the general-purpose register that is specified by <Xd> for AUTIB and AUTIZB. 

. In X17, for AUTIB1716. 

° In X30, for AUTIBSP and AUTIBZ. 

The modifier is: 

s In the general-purpose register or stack pointer that is specified by <Xn|SP> for AUTIB. 

. The value zero, for AUTIZB and AUTIBZ. 

: In X16, for AUTIB1716. 

° In SP, for AUTIBSP. 

If the authentication passes, the upper bits of the address are restored to enable subsequent use of the address. If the 
authentication fails, the upper bits are corrupted and any subsequent use of the address results in a Translation fault. 
Integer 


ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0 | 


i{ijol1 101011 ojoooo sfojojzjio 1| Rn | Ra | 


AUTIB variant 
Applies when Z == 


AUTIB <Xd>, <Xn|SP> 


AUTIZB variant 
Applies when Z == 1 && Rn == 11111. 


AUTIZB <Xd> 


Decode for all variants of this encoding 


boolean source_is_sp = FALSE; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if !HavePACExt() then 
UNDEFINED; 


if Z == 'Q' then // AUTIB 

if n == 31 then source_is_sp = TRUE; 
else // AUTIZB 

if n != 31 then UNDEFINED; 
System 


ARMVv8.3 
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[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/11 81/7 5 4|3 21 0| 


T7107107010 0fo0o ofo1tjo010O0x11xJi 11114] 
CRm op2 


p 
AUTIB1716 variant 


Applies when CRm == 0001 && op2 == 110. 


AUTIB1716 


AUTIBSP variant 
Applies when CRm == 0011 && op2 == 111. 


AUTIBSP 


AUTIBZ variant 
Applies when CRm == 0011 && op2 == 110. 


AUTIBZ 


Decode for all variants of this encoding 


integer d; 
integer n; 
boolean source_is_sp = FALSE; 


case CRm:op2 of 
when '0011 110' // AUTIBZ 


d = 30; 
n = 31; 

when 'QQ11 111' // AUTIBSP 
d = 30; 


source_is_sp = TRUE; 
when '0001 110' // AUTIB1716 


when '0001 000' SEE "PACIA"; 
when '0001 010' SEE "PACIB"; 
when '0001 100' SEE "AUTIA"; 
when 'QQ11 00x' SEE "PACIA"; 
when 'QQ11 @1x' SEE "PACIB"; 
when 'QQ11 10x' SEE "AUTIA"; 
when '0000 111' SEE "XPACLRI"; 








Assembler symbols 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 


<Xn | SP> Is the 64-bit name of the general-purpose source register or stack pointer, encoded in the "Rn" field. 


Operation for all encodings 


if HavePACExt() then 
if source_is_sp then 
X[d] = AuthIB(X[d], SP[]); 
else 
X[d] = AuthIB(X[d], X[n]); 
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C6.2 Alphabetical list of A64 base instructions 


C6.2.24 AXFLAG 


Convert floating-point condition flags from Arm to external format. This instruction converts the state of the 
PSTATE. {N,Z,C,V} flags from a form representing the result of an Arm floating-point scalar compare instruction 
to an alternative representation required by some software. 


ARMV8.5 


|31 30 29 28/27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/11 8|7 6 5 4/3 2 1 0| 


[1 101074070 ofojo ofo o ofo 1 0 of ojo 1 ofi 141 4) 


CRm 


System variant 


AXFLAG 


Decode for this encoding 


if !HaveFlagFormatExt() then UNDEFINED; 


Operation 


bit Z 
bit C 


PSTATE.Z OR PSTATE.V; 
PSTATE.C AND NOT(PSTATE.V); 


PSTATE.N = 'Q'; 
PSTATE.Z = Z; 
PSTATE.C = C; 
PSTATE.V = '0'; 
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C6.2.25 B.cond 


Branch conditionally to a label at a PC-relative offset, with a hint that this is not a subroutine call or return. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4|3 o| 


orororoo] — — č mw P om 


19-bit signed PC-relative branch offset variant 
B.<cond> <label> 


Decode for this encoding 


bits(64) offset = SignExtend(imm19:'00', 64); 


Assembler symbols 
<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 


<label> Is the program label to be conditionally branched to. Its offset from the address of this instruction, 
in the range +/-1MB, is encoded as "imm19" times 4. 


Operation 


if ConditionHolds(cond) then 
BranchTo(PC[] + offset, BranchType_DIR); 
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C6.2.26 B 
Branch causes an unconditional branch to a label at a PC-relative offset, with a hint that this is not a subroutine call 
or return. 
|31 30 29 28|27 2625 | | | | | | 0| 
ojo 0 101 
op 
26-bit signed PC-relative branch offset variant 
B <label> 
Decode for this encoding 
bits(64) offset = SignExtend(imm26:'00', 64); 
Assembler symbols 
<label> Is the program label to be unconditionally branched to. Its offset from the address of this instruction, 
in the range +/-128MB, is encoded as "imm26" times 4. 
Operation 
BranchTo(PC[] + offset, BranchType_DIR); 
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C6.2.27 


C6-800 


BFC 


Bitfield Clear sets a bitfield of <width> bits at bit position <1sb> of the destination register to zero, leaving the other 


destination bits unchanged. 
This instruction is an alias of the BFM instruction. This means that: 
$ The encodings in this description are named to match the encodings of BFM. 


s The description of BFM gives the operational pseudocode for this instruction. 


ARMv8.2 


|31 30 29 28|27 26 25 24|23 22 21 | 16|15 | 109 | 5 4| 0 | 


fo [1 0047 O(N] mm [| mms (i7771] Rd | 
Rn 


opc 


32-bit variant 

Applies when sf == 0 && N == 

BFC <Wd>, #<Isb>, #<width> 

is equivalent to 

BFM <Wd>, WZR, #(-<lsb> MOD 32), #(<width>-1) 


and is the preferred disassembly when UInt(imms) < UInt(immr). 


64-bit variant 

Applies when sf == 1 && N == 

BFC <Xd>, #<Isb>, #<width> 

is equivalent to 

BFM <Xd>, XZR, #(-<lsb> MOD 64), #(<width>-1) 


and is the preferred disassembly when UInt(imms) < UInt(immr). 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Isb> For the 32-bit variant: is the bit number of the lsb of the destination bitfield, in the range 0 to 31. 


For the 64-bit variant: is the bit number of the lsb of the destination bitfield, in the range 0 to 63. 


<width> For the 32-bit variant: is the width of the bitfield, in the range 1 to 32-<Isb>. 
For the 64-bit variant: is the width of the bitfield, in the range 1 to 64-<Isb>. 


Operation 


The description of BFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.28 BFI 


Bitfield Insert copies a bitfield of <width> bits from the least significant bits of the source register to bit position 
<|sb> of the destination register, leaving the other destination bits unchanged. 


This instruction is an alias of the BFM instruction. This means that: 
$ The encodings in this description are named to match the encodings of BFM. 


s The description of BFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


DOT TON — ae | as |e] a 


opc 


32-bit variant 

Applies when sf == 0 && N == 

BFI <Wd>, <Wn>, #<lsb>, #<width> 

is equivalent to 

BFM <Wd>, <Wn>, #(-<Isb> MOD 32), #(<width>-1) 


and is the preferred disassembly when UInt(imms) < UInt(immr). 


64-bit variant 

Applies when sf == 1 && N == 

BFI <Xd>, <Xn>, #<lsb>, #<width> 

is equivalent to 

BFM <Xd>, <Xn>, #(-<Isb> MOD 64), #(<width>-1) 


and is the preferred disassembly when UInt(imms) < UInt(immr). 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Isb> For the 32-bit variant: is the bit number of the lsb of the destination bitfield, in the range 0 to 31. 


For the 64-bit variant: is the bit number of the lsb of the destination bitfield, in the range 0 to 63. 


<width> For the 32-bit variant: is the width of the bitfield, in the range 1 to 32-<Isb>. 
For the 64-bit variant: is the width of the bitfield, in the range 1 to 64-<Isb>. 


Operation 


The description of BFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.29 


C6-804 


BFM 


Bitfield Move is usually accessed via one of its aliases, which are always preferred for disassembly. 


If <imms> is greater than or equal to <immr>, this copies a bitfield of (<imms>-<immr>+1) bits starting from bit position 
<immr> in the source register to the least significant bits of the destination register. 


If <imms> is less than <immr>, this copies a bitfield of (<imms>+1) bits from the least significant bits of the source 
register to bit position (regsize-<immr>) of the destination register, where regsize is the destination register size of 32 
or 64 bits. 


In both cases the other bits of the destination register remain unchanged. 


This instruction is used by the aliases BFC, BFI, and BFXIL. See Alias conditions on page C6-805 for details of 
when each alias is preferred. 


|31 30 29 2827 26 25 24|23 2221 | 16/15 | 109 5 4| 0 | 


ECE COR Ne E 


opc 


32-bit variant 
Applies when sf == 0 && N == 


BFM <Wd>, <Wn>, #<immr>, #<imms> 


64-bit variant 
Applies when sf == 1 && N == 


BFM <Xd>, <Xn>, #<immr>, #<imms> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer datasize = if sf == '1' then 64 else 32; 


integer R; 
bits(datasize) wmask; 
bits(datasize) tmask; 


if sf == '1' && N != '1' then UNDEFINED; 
if sf == '@' && (N != '0' || immr<5> != 'O' || imms<5> != 'Q') then UNDEFINED; 


R = UInt(immr); 
(wmask, tmask) = DecodeBitMasks(N, imms, immr, FALSE); 
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Alias conditions 





Alias is preferred when 

BFC Rn == '11111' && UInt(imms) < UInt(immr) 
BFI Rn != '11111' && UInt(imms) < UInt(immr) 
BFXIL UInt(imms) >= UInt(immr) 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<immr> For the 32-bit variant: is the right rotate amount, in the range 0 to 31, encoded in the "immr" field. 


For the 64-bit variant: is the right rotate amount, in the range 0 to 63, encoded in the "immr" field. 


<imms> For the 32-bit variant: is the leftmost bit number to be moved from the source, in the range 0 to 31, 
encoded in the "imms" field. 


For the 64-bit variant: is the leftmost bit number to be moved from the source, in the range 0 to 63, 
encoded in the "imms" field. 


Operation 


bits(datasize) dst = X[d]; 
bits(datasize) src = X[n]; 


// perform bitfield move on low bits 
bits(datasize) bot = (dst AND NOT(wmask)) OR (ROR(src, R) AND wmask); 


// combine extension bits and result bits 

X[d] = (dst AND NOT(tmask)) OR (bot AND tmask); 
Operational information 

If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.30 BFXIL 


Bitfield Extract and Insert Low copies a bitfield of <width> bits starting from bit position <1sb> in the source register 
to the least significant bits of the destination register, leaving the other destination bits unchanged. 


This instruction is an alias of the BFM instruction. This means that: 
g The encodings in this description are named to match the encodings of BFM. 


s The description of BFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


DOE T E 


opc 


32-bit variant 

Applies when sf == 0 && N == 

BFXIL <Wd>, <Wn>, #<lsb>, #<width> 

is equivalent to 

BFM <Wd>, <Wn>, #<Isb>, #(<]sb>+<width>-1) 


and is the preferred disassembly when UInt(imms) >= UInt(immr). 


64-bit variant 

Applies when sf == 1 && N == 

BFXIL <Xd>, <Xn>, #<Isb>, #<width> 

is equivalent to 

BFM <Xd>, <Xn>, #<Isb>, #(<]sb>+<width>-1) 


and is the preferred disassembly when UInt(imms) >= UInt(immr). 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Isb> For the 32-bit variant: is the bit number of the Isb of the source bitfield, in the range 0 to 31. 


For the 64-bit variant: is the bit number of the Isb of the source bitfield, in the range 0 to 63. 


<width> For the 32-bit variant: is the width of the bitfield, in the range 1 to 32-<Isb>. 
For the 64-bit variant: is the width of the bitfield, in the range 1 to 64-<Isb>. 


Operation 


The description of BFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.31 BIC (shifted register) 


Bitwise Bit Clear (shifted register) performs a bitwise AND of a register value and the complement of an 
optionally-shifted register value, and writes the result to the destination register. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 | 109 5 4| 0 | 


C RA EA Ra | as — | ee Tr 


opc 


32-bit variant 
Applies when sf == 


BIC <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


BIC <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 
ROR when shift = 11 
<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field, 
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Operation 


bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


operand2 = NOT(operand2) ; 
result = operandl AND operand2; 
X[d] = result; 

Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.32 BICS (shifted register) 


Bitwise Bit Clear (shifted register), setting flags, performs a bitwise AND of a register value and the complement 
of an optionally-shifted register value, and writes the result to the destination register. It updates the condition flags 
based on the result. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 | 109 5 4| 0 | 


iero rolmh] a | ans [re 


opc 


32-bit variant 
Applies when sf == 


BICS <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


BICS <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<shi ft> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 
ROR when shift = 11 

<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 
For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field, 
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Operation 


bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


operand2 = NOT(operand2); 


result = operandl AND operand2; 
PSTATE.<N,Z,C,V> = result<datasize-1>:IsZeroBit(result):'QQ'; 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.33 BL 


Branch with Link branches to a PC-relative offset, setting the register X30 to PC+4. It provides a hint that this is a 
subroutine call. 


|31 30 29 28|27 2625 | | | | | | 0| 
f[ooto7] SSS —=ă ë | 
op 


26-bit signed PC-relative branch offset variant 


BL <label> 


Decode for this encoding 


bits(64) offset = SignExtend(imm26:'00', 64); 


Assembler symbols 
<label> Is the program label to be unconditionally branched to. Its offset from the address of this instruction, 
in the range +/-128MB, is encoded as "imm26" times 4. 
Operation 
X[30] = PC[] + 4; 


BranchTo(PC[] + offset, BranchType_DIRCALL) ; 
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C6.2.34 BLR 


Branch with Link to Register calls a subroutine at an address in a register, setting register X30 to PC+4. 


[31 30 29 28/27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9. | 5 4| o| 
110101 1/o/ofo 1/1 1111/0 00 ojojo] R [00000 
Z op AM Rm 


Integer variant 
BLR <Xn> 


Decode for this encoding 


integer n = UInt(Rn); 


Assembler symbols 

<Xn> Is the 64-bit name of the general-purpose register holding the address to be branched to, encoded in 
the "Rn" field. 

Operation 


bits(64) target = X[n]; 
X[30] = PC[] + 4; 


BranchTo(target, BranchType_INDCALL) ; 
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C6.2.35 


C6-814 


BLRAA, BLRAAZ, BLRAB, BLRABZ 


Branch with Link to Register, with pointer authentication. This instruction authenticates the address in the 
general-purpose register that is specified by <Xn>, using a modifier and the specified key, and calls a subroutine at 


the authenticated address, setting register X30 to PC+4. 


The modifier is: 


s In the general-purpose register or stack pointer that is specified by <Xm|SP> for BLRAA and BLRAB. 


° The value zero, for BLRAAZ and BLRABZ. 


Key A is used for BLRAA and BLRAAZ, and key B is used for BLRAB and BLRABZ. 


If the authentication passes, the PE continues execution at the target of the branch. If the authentication fails, a 


Translation fault is generated. 


The authenticated address is not written back to the general-purpose register. 


ARMVv8.3 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 


0 


op 


Key A, zero modifier variant 
Applies when Z == 0 && M == @ && Rm == 11111. 


BLRAAZ <Xn> 


Key A, register modifier variant 
Applies when Z == 1 && M == 


BLRAA <Xn>, <Xm|SP> 


Key B, zero modifier variant 
Applies when Z == @ && M == 1 && Rm == 11111. 


BLRABZ <Xn> 


Key B, register modifier variant 
Applies when Z == 1 && M == 


BLRAB <Xn>, <Xm|SP> 


Decode for all variants of this encoding 


integer n = UInt(Rn); 

integer m = UInt(Rm); 

boolean use_key_a = (M == 'Q'); 

boolean source_is_sp = ((Z == '1') && (m == 31)); 


if !HavePACExt() then 
UNDEFINED; 


if Z == 'Q' && m != 31 then 
UNDEFINED; 
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Assembler symbols 


<Xn> Is the 64-bit name of the general-purpose register holding the address to be branched to, encoded in 
the "Rn" field. 
<Xm| SP> Is the 64-bit name of the general-purpose source register or stack pointer holding the modifier, 


encoded in the "Rm" field. 


Operation 


bits(64) target = X[n]; 
bits(64) modifier = if source_is_sp then SP[] else X[m]; 


if use_key_a then 

target = AuthIA(target, modifier); 
else 

target = AuthIB(target, modifier); 
X[3@] = PC[] + 4; 


BranchTo(target, BranchType_INDCALL) ; 
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C6.2.36 BR 
Branch to Register branches unconditionally to an address in a register, with a hint that this is not a subroutine return. 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
110101 1/o/o/o 0/1 1111/0 00 ojojo] R [00000 
Z op AM Rm 
Integer variant 
BR <Xn> 
Decode for this encoding 
integer n = UInt(Rn); 
Assembler symbols 
<Xn> Is the 64-bit name of the general-purpose register holding the address to be branched to, encoded in 
the "Rn" field. 
Operation 
bits(64) target = X[n]; 
BranchTo(target, BranchType_INDIR) ; 
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C6.2 Alphabetical list of A64 base instructions 


BRAA, BRAAZ, BRAB, BRABZ 


Branch to Register, with pointer authentication. This instruction authenticates the address in the general-purpose 
register that is specified by <Xn>, using a modifier and the specified key, and branches to the authenticated address. 


The modifier is: 


s In the general-purpose register or stack pointer that is specified by <Xm|SP> for BRAA and BRAB. 


° The value zero, for BRAAZ and BRABZ. 


Key A is used for BRAA and BRAAZ, and key B is used for BRAB and BRABZ. 


If the authentication passes, the PE continues execution at the target of the branch. If the authentication fails, a 


Translation fault is generated. 


The authenticated address is not written back to the general-purpose register. 


ARMVv8.3 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/1514 1312/1110 9 | 


5 4| o| 


110101 dade e i o o s edd n o e 


Key A, zero modifier variant 
Applies when Z == 0 && M == @ && Rm == 11111. 


BRAAZ <Xn> 


Key A, register modifier variant 
Applies when Z == 1 && M == 


BRAA <Xn>, <Xm|SP> 


Key B, zero modifier variant 
Applies when Z == 0 && M == 1 && Rm == 11111. 


BRABZ <Xn> 


Key B, register modifier variant 
Applies when Z == 1 & M == 


BRAB <Xn>, <Xm|SP> 


Decode for all variants of this encoding 


integer n = UInt(Rn); 

integer m = UInt(Rm); 

boolean use_key_a = (M == '0'); 

boolean source_is_sp = ((Z == '1') && (m == 31)); 


if !HavePACExt() then 
UNDEFINED; 


if Z == '0' && m != 31 then 
UNDEFINED; 
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Assembler symbols 


<Xn> Is the 64-bit name of the general-purpose register holding the address to be branched to, encoded in 
the "Rn" field. 
<Xm| SP> Is the 64-bit name of the general-purpose source register or stack pointer holding the modifier, 


encoded in the "Rm" field. 


Operation 


bits(64) target = X[n]; 
bits(64) modifier = if source_is_sp then SP[] else X[m]; 


if use_key_a then 

target = AuthIA(target, modifier); 
else 

target = AuthIB(target, modifier); 


BranchTo(target, BranchType_INDIR) ; 
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C6.2.38 BRK 


Breakpoint instruction. A BRK instruction generates a Breakpoint Instruction exception. The PE records the 
exception in ESR_ELx, using the EC value 0x3c, and captures the value of the immediate argument in 


ESR_ELx.ISS. 
|31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4|3 21 0| 
11010100jo01]|  — mme [oo oft. | 


System variant 


BRK #<imm> 
Decode for this encoding 


- = HaveBTIExt(); 


Assembler symbols 


<imm> Is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the "imm16" field. 


Operation 


AArch64.SoftwareBreakpoint(imm16); 
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C6.2.39 BTI 


Branch Target Identification. A BTI instruction is used to guard against the execution of instructions which are not 
the intended target of a branch. 


Outside of a guarded memory region, a BTI instruction executes as a NOP. Within a guarded memory region while 
PSTATE.BTYPE != b00, a BTI instruction compatible with the current value of PSTATE.BTYPE will not generate 
a Branch Target Exception and will allow execution of subsequent instructions within the memory region. 


The operand <targets> passed to a BTI instruction determines the values of PSTATE.BTYPE which the BTI 
instruction is compatible with. 


Note 
Within a guarded memory region, while PSTATE.BTYPE 





!= 0b00, all instructions will generate a Branch Target 
Exception, other than BRK, BTI, HLT, PACIASP, 


and PACIBSP, which may not. See the individual instructions for details. 





ARMVv8.5 


|31 30 29 28/27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/11 8|7 5 4/3 21 0| 


110101010000 ofo11f00710J0100/xxoii1111| 
CRm op2 


p 


System variant 


BTI {<targets>} 


Decode for this encoding 
SystemHintOp op; 


if CRm:op2 == 'Q100 xx' then 
op = SystemHintOp_BTI; 
// Check branch target compatibility between BTI instruction and PSTATE.BTYPE 
- = BTypeCompatible_BTI(op2<2:1>); 
else 
EndOfInstruction(); 


Assembler symbols 


<targets> Is the type of indirection, encoded in the "op2<2:1>" field. It can have the following values: 
(omitted) when op2<2:1> = 00 
c when op2<2:1> = 01 
j when op2<2:1> = 10 
jc when op2<2:1> = 11 
Operation 
case op of 
when SystemHintOp_YIELD 
Hint_Yield(); 
when SystemHintOp_WFE 
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if IsEventRegisterSet() then 
ClearEventRegister(); 
else 
if PSTATE.EL == ELQ@ then 
// Check for traps described by the OS which may be EL1 or EL2. 
AArch64.CheckForWFxTrap(EL1, TRUE); 
if PSTATE.EL IN {EL@, EL1} && EL2Enabled() && !IsInHost() then 
// Check for traps described by the Hypervisor. 
AArch64.CheckForWFxTrap(EL2, TRUE); 
if HaveEL(EL3) && PSTATE.EL != EL3 then 
// Check for traps described by the Secure Monitor. 
AArch64.CheckForWFxTrap(EL3, TRUE); 
WaitForEvent(); 


when SystemHintOp_WFI 
if !InterruptPending() then 

if PSTATE.EL == ELQ@ then 
// Check for traps described by the OS which may be EL1 or EL2. 
AArch64.CheckForWFxTrap(EL1, FALSE); 

if PSTATE.EL IN {EL@, EL1} && EL2Enabled() && !IsInHost() then 
// Check for traps described by the Hypervisor. 
AArch64.CheckForWFxTrap(EL2, FALSE); 

if HaveEL(EL3) && PSTATE.EL != EL3 then 
// Check for traps described by the Secure Monitor. 
AArch64.CheckForWFxTrap(EL3, FALSE); 

WaitForInterrupt(); 


when SystemHintOp_SEV 
SendEvent(); 


when SystemHintOp_SEVL 
SendEventLocal(); 


when SystemHintOp_ESB 
SynchronizeErrors(); 
AArch64.ESBOperation(); 
if PSTATE.EL IN {EL@, EL1} && EL2Enabled() then AArch64.vESBOperation(); 
TakeUnmaskedSErrorInterrupts(); 


when SystemHintOp_PSB 
Profi lingSynchronizationBarrier(); 


when SystemHintOp_TSB 
TraceSynchronizationBarrier(); 


when SystemHintOp_CSDB 
ConsumptionOfSpeculativeDataBarrier(); 


otherwise // do nothing 
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C6.2.40 


C6-822 


CASB, CASAB, CASALB, CASLB 


Compare and Swap byte in memory reads an 8-bit byte from memory, and compares it against the value held in a 
first register. Ifthe comparison is equal, the value in a second register is written to memory. If the write is performed, 
the read and write occur atomically such that no other modification of the memory location can take place between 
the read and write. 


è CASAB and CASALB load from memory with acquire semantics. 
$ CASLB and CASALB store to memory with release semantics. 
. CASB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


The architecture permits that the data read clears any exclusive monitors associated with that location, even if the 
compare subsequently fails. 


If the instruction generates a synchronous Data Abort, the register which is compared and loaded, that is <Ws>, is 
restored to the values held in the register before the instruction was executed. 


ARMV8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


jo ofo o roo oftfrft}] Rs foot t+tatf Rn | R | 


size 


CASAB variant 
Applies when L == 1 && 0@ == 


CASAB <Ws>, <Wt>, [<Xn|SP>{,#0}] 


CASALB variant 
Applies when L == 1 && 0@ == 


CASALB <Ws>, <Wt>, [<Xn|SP>{,#0}] 


CASB variant 
Applies when L == 0 && 0@ == 


CASB <Ws>, <Wt>, [<Xn|SP>{,#0}] 


CASLB variant 
Applies when L == 0 && 0@ == 


CASLB <Ws>, <Wt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer n = UInt(Rn); 


integer t = UInt(Rt); 
integer s = UInt(Rs); 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


AccType ldacctype = if L == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if o0 == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register to be compared and loaded, encoded in the "Rs" 
field. 

<Wt> Is the 32-bit name of the general-purpose register to be conditionally stored, encoded in the "Rt" 
field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 

Operation 


bits(64) address; 
bits(8) comparevalue; 
bits(8) newvalue; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


comparevalue = X[s]; 
newalue = X[t]; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data = MemAtomicCompareAndSwap(address, comparevalue, newvalue, Idacctype, stacctype); 


X[s] = ZeroExtend(data, 32); 
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C6.2.41 


C6-824 


CASH, CASAH, CASALH, CASLH 


Compare and Swap halfword in memory reads a 16-bit halfword from memory, and compares it against the value 
held in a first register. If the comparison is equal, the value in a second register is written to memory. If the write is 
performed, the read and write occur atomically such that no other modification of the memory location can take 
place between the read and write. 


è CASAH and CASALH load from memory with acquire semantics. 
$ CASLH and CASALH store to memory with release semantics. 
. CAS has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


The architecture permits that the data read clears any exclusive monitors associated with that location, even if the 
compare subsequently fails. 


If the instruction generates a synchronous Data Abort, the register which is compared and loaded, that is <Ws>, is 
restored to the values held in the register before the instruction was executed. 


ARMv8.1 
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CASAH variant 


Applies when L == 1 && 0@ == 


CASAH <Ws>, <Wt>, [<Xn|SP>{,#0}] 


CASALH variant 
Applies when L == 1 && 0@ == 


CASALH <Ws>, <Wt>, [<Xn|SP>{,#0}] 


CASH variant 
Applies when L == 0 && 0@ == 


CASH <Ws>, <Wt>, [<Xn|SP>{,#0}] 


CASLH variant 
Applies when L == 0 && 0@ == 


CASLH <Ws>, <Wt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer n = UInt(Rn); 


integer t = UInt(Rt); 
integer s = UInt(Rs); 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


AccType ldacctype = if L == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if o0 == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register to be compared and loaded, encoded in the "Rs" 
field. 

<Wt> Is the 32-bit name of the general-purpose register to be conditionally stored, encoded in the "Rt" 
field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 

Operation 


bits(64) address; 
bits(16) comparevalue; 
bits(16) newvalue; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


comparevalue = X[s]; 
newalue = X[t]; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data = MemAtomicCompareAndSwap(address, comparevalue, newvalue, Idacctype, stacctype); 


X[s] = ZeroExtend(data, 32); 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.42 


C6-826 


CASP, CASPA, CASPAL, CASPL 


Compare and Swap Pair of words or doublewords in memory reads a pair of 32-bit words or 64-bit doublewords 
from memory, and compares them against the values held in the first pair of registers. If the comparison is equal, 
the values in the second pair of registers are written to memory. If the writes are performed, the reads and writes 
occur atomically such that no other modification of the memory location can take place between the reads and 
writes. 


7 CASPA and CASPAL load from memory with acquire semantics. 
s CASPL and CASPAL store to memory with release semantics. 
s CAS has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


The architecture permits that the data read clears any exclusive monitors associated with that location, even if the 
compare subsequently fails. 


If the instruction generates a synchronous Data Abort, the registers which are compared and loaded, that is <Ws> and 
<W(s+1)>, or <Xs> and <X(s+1)>, are restored to the values held in the registers before the instruction was executed. 


ARMVv8.1 
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32-bit CASP variant 

Applies when sz == 0 && L == 0 && 00 == 

CASP <Ws>, <W(s+1)>, <Wt>, <W(t+1)>, [<Xn|SP>{,#0}] 
32-bit CASPA variant 

Applies when sz == 0 && L == 1 && 00 == 

CASPA <Ws>, <W(s+1)>, <Wt>, <W(t+1)>, [<Xn|SP>{,#0}] 
32-bit CASPAL variant 

Applies when sz == 0 && L == 1 && 00 == 

CASPAL <Ws>, <W(s+1)>, <Wt>, <W(t+1)>, [<Xn|SP>{,#0}] 
32-bit CASPL variant 

Applies when sz == 0 && L == 0 && 00 == 

CASPL <Ws>, <W(s+1)>, <Wt>, <W(t+1)>, [<Xn|SP>{,#0}] 
64-bit CASP variant 

Applies when sz == 1 && L == 0 && 00 == 


CASP <Xs>, <X(S+1)>, <Xt>, <X(t+1)>, [<Xn|SP>{,#0}] 
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64-bit CASPA variant 
Applies when sz == 1 && L == 1 && 00 == 


CASPA <Xs>, <X(s+1)>, <Xt>, <X(t+1)>, [<Xn|SP>{,#0}] 


64-bit CASPAL variant 
Applies when sz == 1 && L == 1 && 00 == 


CASPAL <Xs>, <X(s+1)>, <Xt>, <X(t+1)>, [<Xn|SP>{,#0}] 


64-bit CASPL variant 
Applies when sz == 1 && L == 0 && 00 == 


CASPL <Xs>, <X(s+1)>, <Xt>, <X(t+1l)>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 
if Rs<@> == '1' then UNDEFINED; 
if Rt<@> == '1' then UNDEFINED; 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer s = UInt(Rs); 


integer datasize = 32 << UInt(sz); 
AccType ldacctype = if L == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 


AccType stacctype = if o0 == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
tag_checked = n != 31; 


boolean 


Assembler symbols 





<Ws> Is the 32-bit name of the first general-purpose register to be compared and loaded, encoded in the 
"Rs" field. <Ws> must be an even-numbered register. 

<W(s+1)> Is the 32-bit name of the second general-purpose register to be compared and loaded. 

<Wt> Is the 32-bit name of the first general-purpose register to be conditionally stored, encoded in the "Rt" 
field. <Wt> must be an even-numbered register. 

<W(t+1)> Is the 32-bit name of the second general-purpose register to be conditionally stored. 

<Xs> Is the 64-bit name of the first general-purpose register to be compared and loaded, encoded in the 
"Rs" field. <Xs> must be an even-numbered register. 

<X(s+1)> Is the 64-bit name of the second general-purpose register to be compared and loaded. 

<Xt> Is the 64-bit name of the first general-purpose register to be conditionally stored, encoded in the "Rt" 
field. <Xt> must be an even-numbered register. 

<X(t+1)> Is the 64-bit name of the second general-purpose register to be conditionally stored. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 

Operation 


bits(64) address; 
bits(2sdatasize) comparevalue; 
bits(2sdatasize) newvalue; 
bits(2sdatasize) data; 


bits(datasize) s1 = X[s]; 
bits(datasize) s2 = X[s+1]; 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6-828 


bits(datasize) t1 = X[t]; 

bits(datasize) t2 = X[t+1]; 

comparevalue = if BigEndian() then sl:s2 else s2:s1; 
newvalue = if BigEndian() then t1:t2 else t2:t1; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data = MemAtomicCompareAndSwap(address, comparevalue, newvalue, Idacctype, stacctype); 


if BigEndian() then 
X[s] = ZeroExtend(data<2«datasize-1:datasize>, datasize); 
X[s+1] = ZeroExtend(data<datasize-1:0>, datasize); 
else 
X[s] = ZeroExtend(data<datasize-1:0>, datasize); 
X[s+1] = ZeroExtend(data<2«datasize-1:datasize>, datasize); 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.43 CAS, CASA, CASAL, CASL 


ARM DDI 0487E.a 
ID070919 


Compare and Swap word or doubleword in memory reads a 32-bit word or 64-bit doubleword from memory, and 
compares it against the value held in a first register. If the comparison is equal, the value in a second register is 
written to memory. If the write is performed, the read and write occur atomically such that no other modification of 
the memory location can take place between the read and write. 


s CASA and CASAL load from memory with acquire semantics. 
$ CASL and CASAL store to memory with release semantics. 
` CAS has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


The architecture permits that the data read clears any exclusive monitors associated with that location, even if the 
compare subsequently fails. 


If the instruction generates a synchronous Data Abort, the register which is compared and loaded, that is <Ws>, or 
<Xs>, is restored to the value held in the register before the instruction was executed. 


ARMv8.1 
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32-bit CAS variant 


Applies when size == 10 && L == 0 && 00 == 0. 
CAS <Ws>, <Wt>, [<Xn|SP>{,#0}] 

32-bit CASA variant 

Applies when size == 10 && L == 1 && 00 == 0. 
CASA <Ws>, <Wt>, [<Xn|SP>{,#0}] 

32-bit CASAL variant 

Applies when size == 10 && L == 1 & 0@ == 1. 
CASAL <Ws>, <Wt>, [<Xn|SP>{,#0}] 

32-bit CASL variant 

Applies when size == 10 && L == 0 && o0 == 1. 
CASL <Ws>, <Wt>, [<Xn|SP>{,#0}] 

64-bit CAS variant 

Applies when size == 11 && L == 0 && 00 == 0. 
CAS <Xs>, <Xt>, [<Xn|SP>{,#0}] 

64-bit CASA variant 


Applies when size == 11 && L == 1 && 00 == 0. 
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C6-830 


CASA <Xs>, <Xt>, [<Xn|SP>{,#0}] 


64-bit CASAL variant 


Applies when size == 11 && L == 1 & o0 = 1. 


CASAL <X 


s>, <Xt>, [<Xn|SP>{,#0}] 


64-bit CASL variant 


Applies when size == 11 && L == 0 && o0 == 1. 


CASL <Xs>, <Xt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


if !Hav 


integer 
integer 
integer 


integer 
integer 
AccType 
AccType 
boolean 


eAtomicExt() then UNDEFINED; 
n = UInt(Rn); 
t = UInt(Rt); 
s = UInt(Rs); 


datasize = 8 << UInt(size); 

regsize = if datasize == 64 then 64 else 32; 

|dacctype = if L == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
stacctype = if o0 == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
tag_checked = n != 31; 


Assembler symbols 


<Ws> 


<Wt> 


<Xs> 


<Xt> 


<Xn | SP> 


Is the 32-bit name of the general-purpose register to be compared and loaded, encoded in the "Rs" 
field. 


Is the 32-bit name of the general-purpose register to be conditionally stored, encoded in the "Rt" 
field. 


Is the 64-bit name of the general-purpose register to be compared and loaded, encoded in the "Rs" 
field. 


Is the 64-bit name of the general-purpose register to be conditionally stored, encoded in the "Rt" 
field. 


Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


bits(64 
bits(da 
bits(da 
bits(da 


if Have 
Set 


compare 
newvalu 


) address; 

tasize) comparevalue; 
tasize) newvalue; 
tasize) data; 


MTEExt() then 
NotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 
e = X[t]; 


if n == 31 then 
CheckSPAlignment(); 


add 
else 

add 
data = 


X[s] 


ress = SP[]; 

ress = X[n]; 

MemAtomi cCompareAndSwap(address, comparevalue, newvalue, Idacctype, stacctype); 
ZeroExtend(data, regsize); 
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C6.2.44 CBNZ 


Compare and Branch on Nonzero compares the value in a register with zero, and conditionally branches to a label 
at a PC-relative offset if the comparison is not equal. It provides a hint that this is not a subroutine call or return. 
This instruction does not affect the condition flags. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| 0 | 


sos tot oh] TT immig | Re e 
op 


32-bit variant 
Applies when sf == 0. 


CBNZ <Wt>, <label> 


64-bit variant 
Applies when sf == 1. 


CBNZ <Xt>, <label> 


Decode for all variants of this encoding 
integer t = UInt(Rt); 


integer datasize = if sf == '1' then 64 else 32; 
bits(64) offset = SignExtend(imm19:'Q00', 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be tested, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be tested, encoded in the "Rt" field. 
<label> Is the program label to be conditionally branched to. Its offset from the address of this instruction, 


in the range +/-1MB, is encoded as "imm19" times 4. 


Operation 
bits(datasize) operandl = X[t]; 


if IsZero(operand1) == FALSE then 
BranchTo(PC[] + offset, BranchType_DIR); 
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C6.2.45 CBZ 


C6-832 


Compare and Branch on Zero compares the value in a register with zero, and conditionally branches to a label at a 
PC-relative offset if the comparison is equal. It provides a hint that this is not a subroutine call or return. This 


instruction does not affect condition flags. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| 0 | 


lsffo.1 1070/0) immi9 RT 
op 


32-bit variant 
Applies when sf == 0. 


CBZ <Wt>, <label> 


64-bit variant 
Applies when sf == 1. 


CBZ <Xt>, <label> 


Decode for all variants of this encoding 
integer t = UInt(Rt); 


integer datasize = if sf == '1' then 64 else 32; 
bits(64) offset = SignExtend(imm19:'Q00', 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be tested, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be tested, encoded in the "Rt" field. 
<label> Is the program label to be conditionally branched to. Its offset from the address of this instruction, 


in the range +/-1MB, is encoded as "imm19" times 4. 


Operation 
bits(datasize) operandl = X[t]; 


if IsZero(operand1) == TRUE then 
BranchTo(PC[] + offset, BranchType_DIR); 
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CCMN (immediate) 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Conditional Compare Negative (immediate) sets the value of the condition flags to the result of the comparison of 
a register value and a negated immediate value if the condition is TRUE, and an immediate value otherwise. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 
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32-bit variant 
Applies when sf == 0. 


CCMN <Wn>, #<imm>, #<nzcv>, <cond> 


64-bit variant 
Applies when sf == 1. 


CCMN <Xn>, #<imm>, #<nzcv>, <cond> 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer datasize = if sf == '1' then 64 else 32; 
bits(4) flags = nzcv; 
bits(datasize) imm = ZeroExtend(imm5, datasize); 


Assembler symbols 


<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<imm> Is a five bit unsigned (positive) immediate encoded in the "imm5" field. 

<nzcv> Is the flag bit specifier, an immediate in the range 0 to 15, giving the alternative state for the 4-bit 
NZCV condition flags, encoded in the "nzcv" field. 

<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 

Operation 


bits(datasize) operandl = X[n]; 


if ConditionHolds(cond) then 


(-, flags) = AddWithCarry(operandl, imm, '0'); 


PSTATE.<N,Z,C,V> = flags; 


Operational information 


If PSTATE.DIT is 1: 


s The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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C6.2.47 CCMN (register) 
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Conditional Compare Negative (register) sets the value of the condition flags to the result of the comparison of a 
register value and the inverse of another register value if the condition is TRUE, and an immediate value otherwise. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4|3 0 | 
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32-bit variant 


Applies when sf == 0. 


CCMN <Wn>, <Wm>, #<nzcv>, <cond> 


64-bit variant 


Applies when sf == 1. 


CCMN <Xn>, <Xm>, #<nzcv>, <cond> 


Decode for all variants of this encoding 


integ 
integ 
integ 
bits( 


Asse 


er n = UInt(Rn); 
er m = UInt(Rm); 
er datasize = if sf == '1' then 64 else 32; 
4) flags = nzcv; 


mbler symbols 


<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<nzcv> Is the flag bit specifier, an immediate in the range 0 to 15, giving the alternative state for the 4-bit 
NZCV condition flags, encoded in the "nzcv" field. 

<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 
Operation 

bits(datasize) operandl = X[n]; 

bits(datasize) operand2 = X[m]; 

if ConditionHolds(cond) then 

(-, flags) = AddWithCarry(operand1, operand2, 'Q'); 
PSTATE.<N,Z,C,V> = flags; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.48 CCMP (immediate) 


Conditional Compare (immediate) sets the value of the condition flags to the result of the comparison of a register 
value and an immediate value if the condition is TRUE, and an immediate value otherwise. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4|3 0 | 


stajali 104007 0] imm5 | cond fijo] Rn fof nz | 
op 


32-bit variant 
Applies when sf == 0. 


CCMP <Wn>, #<imm>, #<nzcv>, <cond> 


64-bit variant 
Applies when sf = 1. 


CCMP <Xn>, #<imm>, #<nzcv>, <cond> 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer datasize = if sf == '1' then 64 else 32; 
bits(4) flags = nzcv; 
bits(datasize) imm = ZeroExtend(imm5, datasize); 


Assembler symbols 


<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<imm> Is a five bit unsigned (positive) immediate encoded in the "imm5" field. 

<nzcv> Is the flag bit specifier, an immediate in the range 0 to 15, giving the alternative state for the 4-bit 


NZCV condition flags, encoded in the "nzcv" field. 


<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 


Operation 


bits(datasize) operandl = X[n]; 
bits(datasize) operand2; 


if ConditionHolds(cond) then 

operand2 = NOT(imm); 

(-, flags) = AddWithCarry(operand1, operand2, '1'); 
PSTATE.<N,Z,C,V> = flags; 


Operational information 
If PSTATE.DIT is 1: 
i. The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.49 CCMP (register) 


Conditional Compare (register) sets the value of the condition flags to the result of the comparison of two registers 
if the condition is TRUE, and an immediate value otherwise. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4|3 0 | 


sfltfi]1 totoo 4 of Rm | cond jojo] Ran fol] nzv | 
op 


32-bit variant 
Applies when sf == 0. 


CCMP <Wn>, <Wm>, #<nzcv>, <cond> 


64-bit variant 
Applies when sf == 1. 


CCMP <Xn>, <Xm>, #<nzcv>, <cond> 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 
bits(4) flags = nzcv; 


Assembler symbols 


<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<nzcv> Is the flag bit specifier, an immediate in the range 0 to 15, giving the alternative state for the 4-bit 


NZCV condition flags, encoded in the "nzcv" field. 


<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 


Operation 


bits(datasize) operand1 = X[n]; 
bits(datasize) operand2 = X[m]; 


if ConditionHolds(cond) then 

operand2 = NOT(operand2) ; 

(-, flags) = AddWithCarry(operand1, operand2, '1'); 
PSTATE.<N,Z,C,V> = flags; 
Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.50 CFINV 


ARM DDI 0487E.a 
ID070919 


Invert Carry Flag. This instruction inverts the value of the PSTATE.C flag. 


ARMVv8.4 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 8|7 6 5 4|3 21 0| 


770107070 fofojojooofo 1 o onoono o o ar 


CRm 


System variant 


CFINV 


Decode for this encoding 


if !HaveFlagManipulateExt() then UNDEFINED; 


Operation 


PSTATE.C = NOT(PSTATE.C); 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.51 


C6-842 


CFP 


Control Flow Prediction Restriction by Context prevents control flow predictions that predict execution addresses, 
based on information gathered from earlier execution within a particular execution context, from allowing later 


speculative execution within that context to be observable through side-channels. 
For more information, see CFP RCTX. 


This instruction is an alias of the SYS instruction. This means that: 


s The encodings in this description are named to match the encodings of SYS. 
$ The description of SYS gives the operational pseudocode for this instruction. 
ARMv8.5 
|31 30 29 28|27 26 25 24|23 22 21 20|1918  16|15 12111 8|7 54] 0| 
110101010 0fojo 1j0 11/0 111/0011]100{ R č | 
L op1 CRn CRm op2 
System variant 
CFP RCTX, <Xt> 
is equivalent to 
SYS #3, C8, C3, #4, <Xt> 
and is always the preferred disassembly. 
Assembler symbols 
<Xt> Is the 64-bit name of the general-purpose source register, encoded in the "Rt" field. 


Operation 


The description of SYS gives the operational pseudocode for this instruction. 
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Conditional Increment returns, in the destination register, the value of the source register incremented by 1 if the 
condition is TRUE, and otherwise returns the value of the source register. 


This instruction is an alias of the CSINC instruction. This means that: 
g The encodings in this description are named to match the encodings of CSINC. 


s The description of CSINC gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 12/1110 9 | 5 4| 0| 


soo onor o o) Sinn | =i [o| =m | R 
op Rm Rn 


cond 02 


32-bit variant 

Applies when sf == 0. 

CINC <Wd>, <Wn>, <cond> 

is equivalent to 

CSINC <Wd>, <Wn>, <Wn>, invert(<cond>) 


and is the preferred disassembly when Rn == Rm. 


64-bit variant 

Applies when sf = 1. 

CINC <Xd>, <Xn>, <cond> 

is equivalent to 

CSINC <Xd>, <Xn>, <Xn>, invert(<cond>) 


and is the preferred disassembly when Rn == Rm. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" and "Rm" fields. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" and "Rm" fields. 
<cond> Is one of the standard conditions, excluding AL and NV, encoded in the "cond" field with its least 


significant bit inverted. 


Operation 


The description of CSINC gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Conditional Invert returns, in the destination register, the bitwise inversion of the value of the source register if the 
condition is TRUE, and otherwise returns the value of the source register. 


This instruction is an alias of the CSINV instruction. This means that: 
g The encodings in this description are named to match the encodings of CSINV. 


° The description of CSINV gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 12/1110 9 | 5 4| 0 | 


spot to 7 o+00] Sinn | =i ojo] =m | Ro | 
op Rm Rn 


cond 02 


32-bit variant 

Applies when sf == 0. 

CINV <Wd>, <Wn>, <cond> 

is equivalent to 

CSINV <Wd>, <Wn>, <Wn>, invert(<cond>) 


and is the preferred disassembly when Rn == Rm. 


64-bit variant 

Applies when sf == 1. 

CINV <Xd>, <Xn>, <cond> 

is equivalent to 

CSINV <Xd>, <Xn>, <Xn>, invert(<cond>) 


and is the preferred disassembly when Rn == Rm. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" and "Rm" fields. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" and "Rm" fields. 
<cond> Is one of the standard conditions, excluding AL and NV, encoded in the "cond" field with its least 


significant bit inverted. 


Operation 


The description of CSINV gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.54 CLREX 


Clear Exclusive clears the local monitor of the executing PE. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/11 8|7 6 5 4|3 21 0| 


770107070 0)0)0 0017/0077] crm Joro rrr 


System variant 


CLREX {#<imm>} 


Decode for this encoding 


// CRm field is ignored 


Assembler symbols 


<imm> Is an optional 4-bit unsigned immediate, in the range 0 to 15, defaulting to 15 and encoded in the 
"CRm" field. 


Operation 


ClearExclusiveLocal(ProcessorID()); 
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C6.2.55 


C6-848 


CLS 


Count Leading Sign bits counts the number of leading bits of the source register that have the same value as the 
most significant bit of the register, and writes the result to the destination register. This count does not include the 


most significant bit of the source register. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


sldolt To tos solo 9 9 9 ole oo oft mo d n 


32-bit variant 
Applies when sf == 


CLS <Wd>, <Wn> 


64-bit variant 
Applies when sf == 


CLS <Xd>, <Xn> 


Decode for all variants of this encoding 
integer d = UInt(Rd); 


integer n = UInt(Rn); 
integer datasize = if sf == '1' then 64 else 32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


integer result; 
bits(datasize) operandl = X[n]; 


result = CountLeadingSignBits(operand1) ; 


X[d] = result<datasize-1:0>; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.56 CLZ 


Count Leading Zeros counts the number of binary zero bits before the first binary one bit in the value of the source 
register, and writes the result to the destination register. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


sTfotr To Fo tt ofp oo poe eo 7 oo] no do oa 


32-bit variant 
Applies when sf == 


CLZ <Wd>, <Wn> 


64-bit variant 
Applies when sf == 


CLZ <Xd>, <Xn> 


Decode for all variants of this encoding 
integer d = UInt(Rd); 


integer n = UInt(Rn); 
integer datasize = if sf == '1' then 64 else 32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


integer result; 
bits(datasize) operandl = X[n]; 


result = CountLeadingZeroBits(operand1) ; 
X[d] = result<datasize-1:0>; 
Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.57 


C6-850 


CMN (extended register) 


Compare Negative (extended register) adds a register value and a sign or zero-extended register value, followed by 
an optional left shift amount. The argument that is extended from the <Rm> register can be a byte, halfword, word, 
or doubleword. It updates the condition flags based on the result, and discards the result. 


This instruction is an alias of the ADDS (extended register) instruction. This means that: 
s The encodings in this description are named to match the encodings of ADDS (extended register). 


s The description of ADDS (extended register) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312| 109 | 5 4| 


CTC KACO C EA E [ns | TT 


op S 


32-bit variant 

Applies when sf == 

CMN <Wn|WSP>, <Wm>{, <extend> {#<amount>}} 

is equivalent to 

ADDS WZR, <Wn|WSP>, <Wm>{, <extend> {#<amount>}} 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 

CMN <Xn|SP>, <R><m>{, <extend> {#<amount>}} 

is equivalent to 

ADDS XZR, <Xn|SP>, <R><m>{, <extend> {#<amount>}} 


and is always the preferred disassembly. 


Assembler symbols 


<Wn | WSP> Is the 32-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 
<R> Is a width specifier, encoded in the "option" field. It can have the following values: 
W when option = 00x 
W when option = 010 
X when option = x11 
W when option = 10x 
W when option = 110 
<m> Is the number [0-30] of the second general-purpose source register or the name ZR (31), encoded in 
the "Rm" field. 
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<extend> For the 32-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 
UXTB when option = 000 
UXTH when option = 001 
LSL|UXTW when option = 010 
UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If "Rn" is '11111' (WSP) and "option" is '010' then LSL is preferred, but may be omitted when 
"imm3" is '000'. In all other cases <extend> is required and must be UXTW when "option" is '010'. 


For the 64-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 


UXTB when option = 000 
UXTH when option = 001 
UXTW when option = 010 
LSL|UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If"Rn" is '11111' (SP) and "option" is '011' then LSL is preferred, but may be omitted when "imm3" 
is '000'. In all other cases <extend> is required and must be UXTX when "option" is '011'. 


<amount> Is the left shift amount to be applied after extension in the range 0 to 4, defaulting to 0, encoded in 
the "imm3" field. It must be absent when <extend> is absent, is required when <extend> is LSL, 
and is optional when <extend> is present but not LSL. 


Operation 


The description of ADDS (extended register) gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


à The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.58 


C6-852 


CMN (immediate) 


Compare Negative (immediate) adds a register value and an optionally-shifted immediate value. It updates the 


condition flags based on the result, and discards the result. 
This instruction is an alias of the ADDS (immediate) instruction. This means that: 
g The encodings in this description are named to match the encodings of ADDS (immediate). 


s The description of ADDS (immediate) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | | | 109 | 5 4| 0 | 


sop ooo rop mma | m Sid 


op S Rd 


32-bit variant 

Applies when sf == 0. 

CMN <Wn|WSP>, #<imm>{, <shift>} 

is equivalent to 

ADDS WZR, <Wn|WSP>, #<imm> {, <shift>} 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1. 

CMN <Xn|SP>, #<imm>{, <shift>} 

is equivalent to 

ADDS XZR, <Xn|SP>, #<imm> {, <shift>} 


and is always the preferred disassembly. 


Assembler symbols 


<Wn | WSP> Is the 32-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<Xn | SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<imm> Is an unsigned immediate, in the range 0 to 4095, encoded in the "imm12" field. 

<shift> Is the optional left shift to apply to the immediate, defaulting to LSL #0 and encoded in the "sh" 


field. It can have the following values: 
LSL #0 when sh = 0 
LSL #12 when sh = 1 


Operation 


The description of ADDS (immediate) gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.59 CMN (shifted register) 


C6-854 


Compare Negative (shifted register) adds a register value and an optionally-shifted register value. It updates the 


condition flags based on the result, and discards the result. 
This instruction is an alias of the ADDS (shifted register) instruction. This means that: 
g The encodings in this description are named to match the encodings of ADDS (shifted register). 


s The description of ADDS (shifted register) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 | 109 | 5 4| 0| 
slogo 1071 feino] Rm | mme | Rn ‘(i 77714 
op S Rd 
32-bit variant 
Applies when sf == 0. 
CMN <Wn>, <Wm>{, <shift> #<amount>} 
is equivalent to 
ADDS WZR, <Wn>, <Wm> {, <shift> #<amount>} 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1. 

CMN <Xn>, <Xm>{, <shift> #<amount>} 

is equivalent to 

ADDS XZR, <Xn>, <Xm> {, <shift> #<amount>} 


and is always the preferred disassembly. 


Assembler symbols 


<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift type to be applied to the second source operand, defaulting to LSL and encoded 
in the "shift" field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 


The encoding shift = 11 is reserved. 


<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 


"imm6" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 


"imm6" field. 
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Operation 


The description of ADDS (shifted register) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.60 


C6-856 


CMP (extended register) 


Compare (extended register) subtracts a sign or zero-extended register value, followed by an optional left shift 
amount, from a register value. The argument that is extended from the <Rm> register can be a byte, halfword, word, 
or doubleword. It updates the condition flags based on the result, and discards the result. 


This instruction is an alias of the SUBS (extended register) instruction. This means that: 
s The encodings in this description are named to match the encodings of SUBS (extended register). 


s The description of SUBS (extended register) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312| 109 | 5 4| 


Noop a Ta [ns | TT 


op S 


32-bit variant 

Applies when sf == 

CMP <Wn|WSP>, <Wm>{, <extend> {#<amount>}} 

is equivalent to 

SUBS WZR, <Wn|WSP>, <Wm>{, <extend> {#<amount>}} 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 

CMP <Xn|SP>, <R><m>{, <extend> {#<amount>}} 

is equivalent to 

SUBS XZR, <Xn|SP>, <R><m>{, <extend> {#<amount>}} 


and is always the preferred disassembly. 


Assembler symbols 


<Wn | WSP> Is the 32-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 
<R> Is a width specifier, encoded in the "option" field. It can have the following values: 
W when option = 00x 
W when option = 010 
X when option = x11 
W when option = 10x 
W when option = 110 
<m> Is the number [0-30] of the second general-purpose source register or the name ZR (31), encoded in 
the "Rm" field. 
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<extend> For the 32-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 
UXTB when option = 000 
UXTH when option = 001 
LSL|UXTW when option = 010 
UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If "Rn" is '11111' (WSP) and "option" is '010' then LSL is preferred, but may be omitted when 
"imm3" is '000'. In all other cases <extend> is required and must be UXTW when "option" is '010'. 


For the 64-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 


UXTB when option = 000 
UXTH when option = 001 
UXTW when option = 010 
LSL|UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If"Rn" is '11111' (SP) and "option" is '011' then LSL is preferred, but may be omitted when "imm3" 
is '000'. In all other cases <extend> is required and must be UXTX when "option" is '011'. 


<amount> Is the left shift amount to be applied after extension in the range 0 to 4, defaulting to 0, encoded in 
the "imm3" field. It must be absent when <extend> is absent, is required when <extend> is LSL, 
and is optional when <extend> is present but not LSL. 


Operation 


The description of SUBS (extended register) gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


à The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.61 CMP (immediate) 


Compare (immediate) subtracts an optionally-shifted immediate value from a register value. It updates the condition 
flags based on the result, and discards the result. 


This instruction is an alias of the SUBS (immediate) instruction. This means that: 
$ The encodings in this description are named to match the encodings of SUBS (immediate). 


s The description of SUBS (immediate) gives the operational pseudocode for this instruction. 
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32-bit variant 

Applies when sf == 0. 

CMP <Wn|WSP>, #<imm>{, <shift>} 

is equivalent to 

SUBS WZR, <Wn|WSP>, #<imm> {, <shift>} 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1. 

CMP <Xn|SP>, #<imm>{, <shift>} 

is equivalent to 

SUBS XZR, <Xn|SP>, #<imm> {, <shift>} 


and is always the preferred disassembly. 


Assembler symbols 


<Wn | WSP> Is the 32-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<Xn | SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<imm> Is an unsigned immediate, in the range 0 to 4095, encoded in the "imm12" field. 

<shift> Is the optional left shift to apply to the immediate, defaulting to LSL #0 and encoded in the "sh" 


field. It can have the following values: 
LSL #0 when sh = 0 
LSL #12 when sh = 1 


Operation 


The description of SUBS (immediate) gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-859 
ID070919 Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.62 CMP (shifted register) 


Compare (shifted register) subtracts an optionally-shifted register value from a register value. It updates the 


condition flags based on the result, and discards the result. 


This instruction is an alias of the SUBS (shifted register) instruction. This means that: 


g The encodings in this description are named to match the encodings of SUBS (shifted register). 
s The description of SUBS (shifted register) gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16115 | 109 | 0 | 
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32-bit variant 

Applies when sf == 0. 

CMP <Wn>, <Wm>{, <shift> #<amount>} 

is equivalent to 

SUBS WZR, <Wn>, <Wm> {, <shift> #<amount>} 

and is always the preferred disassembly. 

64-bit variant 

Applies when sf == 1. 

CMP <Xn>, <Xm>{, <shift> #<amount>} 

is equivalent to 

SUBS XZR, <Xn>, <Xm> {, <shift> #<amount>} 

and is always the preferred disassembly. 

Assembler symbols 

<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<shift> Is the optional shift type to be applied to the second source operand, defaulting to LSL and encoded 
in the "shift" field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 
The encoding shift = 11 is reserved. 

<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 
For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field. 
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Operation 


The description of SUBS (shifted register) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.63 


C6-862 


CMPP 


Compare with Tag subtracts the 56-bit address held in the second source register from the 56-bit address held in the 
first source register, updates the condition flags based on the result of the subtraction, and discards the result. 


This instruction is an alias of the SUBPS instruction. This means that: 
g The encodings in this description are named to match the encodings of SUBPS. 


s The description of SUBPS gives the operational pseudocode for this instruction. 


ARMv8.5 
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Integer variant 

CMPP <Xn|SP>, <Xm|SP> 

is equivalent to 

SUBPS XZR, <Xn|SP>, <Xm|SP> 


and is always the preferred disassembly. 


Assembler symbols 


<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Xn" 
field. 

<Xm| SP> Is the 64-bit name of the second general-purpose source register or stack pointer, encoded in the 
"Xm" field. 

Operation 


The description of SUBPS gives the operational pseudocode for this instruction. 
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C6.2.64 CNEG 
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Conditional Negate returns, in the destination register, the negated value of the source register if the condition is 
TRUE, and otherwise returns the value of the source register. 


This instruction is an alias of the CSNEG instruction. This means that: 
g The encodings in this description are named to match the encodings of CSNEG. 


s The description of CSNEG gives the operational pseudocode for this instruction. 
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32-bit variant 

Applies when sf == 0. 

CNEG <Wd>, <Wn>, <cond> 

is equivalent to 

CSNEG <Wd>, <Wn>, <Wn>, invert(<cond>) 


and is the preferred disassembly when Rn == Rm. 


64-bit variant 

Applies when sf == 1. 

CNEG <Xd>, <Xn>, <cond> 

is equivalent to 

CSNEG <Xd>, <Xn>, <Xn>, invert(<cond>) 


and is the preferred disassembly when Rn == Rm. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" and "Rm" fields. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" and "Rm" fields. 
<cond> Is one of the standard conditions, excluding AL and NV, encoded in the "cond" field with its least 


significant bit inverted. 


Operation 


The description of CSNEG gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


C6-864 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


C6.2.65 CPP 


ARM DDI 0487E.a 
ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Cache Prefetch Prediction Restriction by Context prevents cache allocation predictions, based on information 
gathered from earlier execution within a particular execution context, from allowing later speculative execution 
within that context to be observable through side-channels. 


For more information, see CPP RCTX. 
This instruction is an alias of the SYS instruction. This means that: 
s The encodings in this description are named to match the encodings of SYS. 


$ The description of SYS gives the operational pseudocode for this instruction. 


ARMV8.5 
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System variant 
CPP RCTX, <Xt> 
is equivalent to 
SYS #3, C8, C3, #7, <Xt> 


and is always the preferred disassembly. 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose source register, encoded in the "Rt" field. 


Operation 


The description of SYS gives the operational pseudocode for this instruction. 
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C6.2.66 


C6-866 


CRC32B, CRC32H, CRC32W, CRC32X 


CRC32 checksum performs a cyclic redundancy check (CRC) calculation on a value held in a general-purpose 

register. It takes an input CRC value in the first source operand, performs a CRC on the input value in the second 
source operand, and returns the output CRC value. The second source operand can be 8, 16, 32, or 64 bits. To align 
with common usage, the bit order of the values is reversed as part of the operation, and the polynomial @x04C11DB7 


is used for the CRC calculation. 


In Armv8-A, this is an OPTIONAL instruction, and in Armv8.1 it is mandatory for all implementations to implement 


it. 





Note 


ID_AA64ISARO_EL1.CRC32 indicates whether this instruction is supported. 





|31 30 29 28|27 26 25 24/23 22 21 20| 


CRC32B variant 
Applies when sf == 0 && sz == 00. 


CRC32B <Wd>, <Wn>, <Wm> 


CRC32H variant 

Applies when sf == 0 && sz == 01. 
CRC32H <Wd>, <Wn>, <Wm> 
CRC32W variant 

Applies when sf == 0 && sz == 10. 
CRC32W <Wd>, <Wn>, <Wm> 
CRC32X variant 

Applies when sf == 1 && sz == 11. 


CRC32X <Wd>, <Wn>, <Xm> 


Decode for all variants of this encoding 


if !HaveCRCExt() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if sf == '1' && sz != '11' then UNDEFINED; 
if sf == '@' && sz == '11' then UNDEFINED; 


integer size = 8 << UInt(sz); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose accumulator output register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose accumulator input register, encoded in the "Rn" field. 


<Xm> Is the 64-bit name of the general-purpose data source register, encoded in the "Rm" field. 
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<Wm> Is the 32-bit name of the general-purpose data source register, encoded in the "Rm" field. 
Operation 

bits(32) acc = X[n]; // accumulator 

bits(size) val = X[m]; // input value 


bits(32) poly = @x@4C11DB7<31:0>; 


bits(32+size) tempacc = BitReverse(acc) :Zeros(size) ; 
bits(size+32) tempval = BitReverse(val):Zeros(32); 


// Poly32Mod2 on a bitstring does a polynomial Modulus over {0,1} operation 
X[d] = BitReverse(Poly32Mod2(tempacc EOR tempval, poly)); 


Operational information 
If PSTATE.DIT is 1: 
° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.67 


C6-868 


CRC32CB, CRC32CH, CRC32CW, CRC32CX 


CRC32 checksum performs a cyclic redundancy check (CRC) calculation on a value held in a general-purpose 
register. It takes an input CRC value in the first source operand, performs a CRC on the input value in the second 
source operand, and returns the output CRC value. The second source operand can be 8, 16, 32, or 64 bits. To align 
with common usage, the bit order of the values is reversed as part of the operation, and the polynomial @x1EDC6F41 
is used for the CRC calculation. 


In Armv8-A, this is an OPTIONAL instruction, and in Armv8.1 it is mandatory for all implementations to implement 
it. 





Note 
ID_AA64ISARO_EL1.CRC32 indicates whether this instruction is supported. 
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CRC32CB variant 
Applies when sf == 0 && sz == 00. 


CRC32CB <Wd>, <Wn>, <Wm> 


CRC32CH variant 
Applies when sf == 0 && sz == 01. 


CRC32CH <Wd>, <Wn>, <Wm> 


CRC32CW variant 
Applies when sf == 0 && sz == 10. 


CRC32CW <Wd>, <Wn>, <Wm> 


CRC32CX variant 
Applies when sf == 1 && sz == 11. 


CRC32CX <Wd>, <Wn>, <Xm> 


Decode for all variants of this encoding 


if !HaveCRCExt() then UNDEFINED; 

integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sf == '1' && sz != '11' then UNDEFINED; 
if sf == '@' && sz == '11' then UNDEFINED; 
integer size = 8 << UInt(sz); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose accumulator output register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose accumulator input register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the general-purpose data source register, encoded in the "Rm" field. 
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<Wm> Is the 32-bit name of the general-purpose data source register, encoded in the "Rm" field. 
Operation 

bits(32) acc = X[n]; // accumulator 

bits(size) val = X[m]; // input value 


bits(32) poly = @x1EDC6F41<31:0>; 


bits(32+size) tempacc = BitReverse(acc) :Zeros(size); 
bits(size+32) tempval = BitReverse(val):Zeros(32); 


// Poly32Mod2 on a bitstring does a polynomial Modulus over {0,1} operation 
X[d] = BitReverse(Poly32Mod2(tempacc EOR tempval, poly)); 


Operational information 
If PSTATE.DIT is 1: 
° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.68 CSDB 


Consumption of Speculative Data Barrier is a memory barrier that controls speculative execution and data value 
prediction. 


No instruction other than branch instructions appearing in program order after the CSDB can be speculatively 
executed using the results of any: 


s Data value predictions of any instructions. 


s PSTATE. {N,Z,C,V} predictions of any instructions other than conditional branch instructions appearing in 
program order before the CSDB that have not been architecturally resolved. 


ê Predictions of SVE predication state for any SVE instructions. 


Note 
For purposes of the definition of CSDB, PSTATE. {N,Z,C,V } is not considered a data value. This definition permits: 





° Control flow speculation before and after the CSDB. 


° Speculative execution of conditional data processing instructions after the CSDB, unless they use the results 
of data value or PSTATE. {N,Z,C,V} predictions of instructions appearing in program order before the CSDB 
that have not been architecturally resolved. 
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System variant 

CSDB 

Decode for this encoding 


// Empty. 


Operation 


ConsumptionOfSpeculativeDataBarrier(); 
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C6.2.69 CSEL 


Conditional Select returns, in the destination register, the value of the first source register if the condition is TRUE, 
and otherwise returns the value of the second source register. 
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32-bit variant 
Applies when sf == 


CSEL <Wd>, <Wn>, <Wm>, <cond> 


64-bit variant 
Applies when sf == 


CSEL <Xd>, <Xn>, <Xm>, <cond> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 
Operation 


bits(datasize) result; 
bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = X[m] 


if ConditionHolds(cond) then 
result = operand; 

else 
result = operand2; 


X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.70 CSET 


ARM DDI 0487E.a 
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Conditional Set sets the destination register to 1 if the condition is TRUE, and otherwise sets it to 0. 


This instruction is an alias of the CSINC instruction. This means that: 


: The encodings in this description are named to match the encodings of CSINC. 
è The description of CSINC gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 12/1110 9 | 5 4| 0 | 
sojo tO 71010011174) Hix folii 777i) Ra 
op Rm cond 02 Rn 


32-bit variant 

Applies when sf == 0. 

CSET <Wd>, <cond> 

is equivalent to 

CSINC <Wd>, WZR, WZR, invert(<cond>) 
and is always the preferred disassembly. 
64-bit variant 

Applies when sf == 1. 

CSET <Xd>, <cond> 

is equivalent to 

CSINC <Xd>, XZR, XZR, invert(<cond>) 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<cond> Is one of the standard conditions, excluding AL and NV, encoded in the "cond" field with its least 


significant bit inverted. 


Operation 


The description of CSINC gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.71 CSETM 
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Conditional Set Mask sets all bits of the destination register to 1 if the condition is TRUE, and otherwise sets all bits 
to 0. 


This instruction is an alias of the CSINV instruction. This means that: 


g The encodings in this description are named to match the encodings of CSINV. 
s The description of CSINV gives the operational pseudocode for this instruction. 
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32-bit variant 

Applies when sf == 0. 

CSETM <Wd>, <cond> 

is equivalent to 

CSINV <Wd>, WZR, WZR, invert(<cond>) 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1. 

CSETM <Xd>, <cond> 

is equivalent to 

CSINV <Xd>, XZR, XZR, invert(<cond>) 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<cond> Is one of the standard conditions, excluding AL and NV, encoded in the "cond" field with its least 


significant bit inverted. 


Operation 


The description of CSINV gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.72 CSINC 


Conditional Select Increment returns, in the destination register, the value of the first source register if the condition 
is TRUE, and otherwise returns the value of the second source register incremented by 1. 


This instruction is used by the aliases CINC and CSET. See Alias conditions for details of when each alias is 
preferred. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 12/1110 9 | 5 4| o| 


ee of Rm | cond Jolt] Rn | Re 
op 


32-bit variant 
Applies when sf == 


CSINC <Wd>, <Wn>, <Wm>, <cond> 


64-bit variant 
Applies when sf == 


CSINC <Xd>, <Xn>, <Xm>, <cond> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Alias conditions 





Alias is preferred when 
CINC Rm != '11111' && cond != '111x' && Rn != '11111' && Rn == Rm 
CSET Rm == '11111' && cond != '111x' && Rn == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 
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C6-878 


Operation 

bits(datasize) result; 

bits(datasize) operandl = X[n]; 

bits(datasize) operand2 = X[m]; 

if ConditionHolds(cond) then 
result = operand1; 


else 
result = operand2 + 1; 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C6.2.73 CSINV 


Conditional Select Invert returns, in the destination register, the value of the first source register if the condition is 
TRUE, and otherwise returns the bitwise inversion value of the second source register. 


This instruction is used by the aliases CINV and CSETM. See Alias conditions for details of when each alias is 
preferred. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 12/1110 9 | 5 4| o| 


CHOE Rm | cond Jojo| Rn | Re 
op 


32-bit variant 
Applies when sf == 


CSINV <Wd>, <Wn>, <Wm>, <cond> 


64-bit variant 
Applies when sf == 


CSINV <Xd>, <Xn>, <Xm>, <cond> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Alias conditions 





Alias is preferred when 
CINV Rm != '11111' && cond != '111x' && Rn != '11111' && Rn == Rm 
CSETM Rm == '11111' && cond != '111x' && Rn == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 
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C6-880 


Operation 

bits(datasize) result; 

bits(datasize) operandl = X[n]; 

bits(datasize) operand2 = X[m]; 

if ConditionHolds(cond) then 
result = operand; 


else 
result = NOT(operand2); 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C6.2.74 CSNEG 


Conditional Select Negation returns, in the destination register, the value of the first source register if the condition 
is TRUE, and otherwise returns the negated value of the second source register. 


This instruction is used by the alias CNEG. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4| 0 | 


slifoli Fo Fo Fo of Rm | cond Joli] Rn | Rd 
op 


32-bit variant 
Applies when sf == 


CSNEG <Wd>, <Wn>, <Wm>, <cond> 


64-bit variant 
Applies when sf == 


CSNEG <Xd>, <Xn>, <Xm>, <cond> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Alias conditions 





Alias is preferred when 


CNEG cond != '111x' && Rn == Rm 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 
Operation 


bits(datasize) result; 
bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = X[m] 


if ConditionHolds(cond) then 
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result = operand; 

else 
result = NOT(operand2); 
result = result + 1; 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


š The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.75 DC 


Data Cache operation. For more information, see op0==0b01, cache maintenance, TLB maintenance, and address 
translation instructions on page C5-366. 


This instruction is an alias of the SYS instruction. This means that: 


g The encodings in this description are named to match the encodings of SYS. 
s The description of SYS gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20|1918  16|15 12111 8|7 54] 0| 


770107070 0)0)0 7] o 011i) em | o | R 
L CRn 


System variant 

DC <dc_op>, <Xt> 

is equivalent to 

SYS #<op1>, C7, <Cm>, #<op2>, <Xt> 


and is the preferred disassembly when SysOp(op1,'@111',CRm,op2) == Sys_DC. 


Assembler symbols 








<dc_op> Is a DC instruction name, as listed for the DC system instruction group, encoded in the 

"op1:CRm:op2" field. It can have the following values: 

IVAC when op1 = 000, CRm = 0110, op2 = 001 

ISW when op1 = 000, CRm = 0110, op2 = 010 

CSW when op1 = 000, CRm = 1010, op2 = 010 

CISW when op1 = 000, CRm = 1110, op2 = 010 

ZVA when op1 = 011, CRm = 0100, op2 = 001 

CVAC when op1 = 011, CRm = 1010, op2 = 001 

CVAU when op1 = 011, CRm = 1011, op2 = 001 

CIVAC when op1 = 011, CRm = 1110, op2 = 001 

When ARMv8.5-MemTag is implemented, the following values are also valid: 
IGVAC when op1 = 000, CRm = 0110, op2 = 011 

IGSW when op1 = 000, CRm = 0110, op2 = 100 

IGDVAC when op1 = 000, CRm = 0110, op2 = 101 

IGDSW when op1 = 000, CRm = 0110, op2 = 110 

CGSW when op1 = 000, CRm = 1010, op2 = 100 

CGDSW when op1 = 000, CRm = 1010, op2 = 110 


CIGSW when op1 = 000, CRm = 1110, op2 = 100 
CIGDSW when op1 = 000, CRm = 1110, op2 = 110 





GVA when op1 = 011, CRm = 0100, op2 = 011 
GZVA when op1 = 011, CRm = 0100, op2 = 100 
CGVAC when op1 = 011, CRm = 1010, op2 = 011 


CGDVAC when op1 = 011, CRm = 1010, op2 = 101 
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C6-884 


CGVAP 
CGDVAP 
CGVADP 
CGDVADP 
CIGVAC 
CIGDVAC 


when op1 = 
when op1 = 
when op1 = 
when op1 = 
when op1 = 


when op1 = 


011, CRm 
011, CRm 
011, CRm 
011, CRm 
011, CRm 
011, CRm 


1100, op2 = 011 
1100, op2 = 101 
1101, op2 = 011 
1101, op2 = 101 
1110, op2 = 011 
1110, op2 = 101 


When ARMv8.2-DCPoP is implemented, the following value is also valid: 


CVAP 


when op1 = 011, CRm = 1100, op2 = 001 


When ARMv8.2-DCCVADP is implemented, the following value is also valid: 








CVADP when op1 = 011, CRm = 1101, op2 = 001 
<op1> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op1" field. 
<Cm> Is a name 'Cm', with 'm' in the range 0 to 15, encoded in the "CRm" field. 
<op2> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op2" field. 
<Xt> Is the 64-bit name of the general-purpose source register, encoded in the "Rt" field. 


Operation 


The description of SYS gives the operational pseudocode for this instruction. 
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C6.2.76 DCPS1 
Debug Change PE State to EL1, when executed in Debug state: 
` If executed at ELO changes the current Exception level and SP to EL1 using SP_EL1. 
. Otherwise, if executed at ELx, selects SP_ELx. 
The target exception level of a DCPS1 instruction is: 
$ EL1 if the instruction is executed at ELO. 
. Otherwise, the Exception level at which the instruction is executed. 


When the target Exception level of a DCPS1 instruction is ELx, on executing this instruction: 


7 ELR_ELx becomes UNKNOWN. 
° SPSR_ELx becomes UNKNOWN. 
° ESR _ELx becomes UNKNOWN. 


° DLR_ELO and DSPSR_ELO become UNKNOWN. 

° The endianness is set according to SCTLR_ELx.EE. 

This instruction is UNDEFINED at ELO in Non-secure state if EL2 is implemented and HCR_EL2.TGE == 1. 
This instruction is always UNDEFINED in Non-debug state. 


For more information on the operation of the DCPSn instructions, see DCPS<n> on page H2-6731. 


|31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4/3 21 0| 
11010100h o1] imme ——séid‘ VC OT 14 
LL 


System variant 


DCPS1 {#<imm>} 


Decode for this encoding 


if !Halted() then AArch64.UndefinedFault(); 


Assembler symbols 

<imm> Is an optional 16-bit unsigned immediate, in the range 0 to 65535, defaulting to 0 and encoded in 
the "imm16" field. 

Operation 


DCPSInstruction(LL); 
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C6.2.77 


C6-886 


DCPS2 


Debug Change PE State to EL2, when executed in Debug state: 

` If executed at ELO or EL1 changes the current Exception level and SP to EL2 using SP_EL2. 
. Otherwise, if executed at ELx, selects SP_ELx. 

The target exception level of a DCPS2 instruction is: 

$ EL2 if the instruction is executed at an exception level that is not EL3. 

° EL3 if the instruction is executed at EL3. 


When the target Exception level of a DCPS2 instruction is ELx, on executing this instruction: 


7 ELR_ELx becomes UNKNOWN. 
° SPSR_ELx becomes UNKNOWN. 
° ESR _ELx becomes UNKNOWN. 


° DLR_ELO and DSPSR_EL0 become UNKNOWN. 

° The endianness is set according to SCTLR_ELx.EE. 

This instruction is UNDEFINED at the following exception levels: 

. All exception levels if EL2 is not implemented. 

. At ELO and EL1 if EL2 is disabled in the current Security state. 
This instruction is always UNDEFINED in Non-debug state. 


For more information on the operation of the DCPSn instructions, see DCPS<n> on page H2-6731. 


|31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4/3 21 0| 
11010100 o] _mme——S—S—~S TOT 
LL 


System variant 


DCPS2 {#<imm>} 


Decode for this encoding 


if !Halted() then AArch64.UndefinedFault(); 


Assembler symbols 
<imm> Is an optional 16-bit unsigned immediate, in the range 0 to 65535, defaulting to 0 and encoded in 


the "imm16" field. 


Operation 


DCPSInstruction(LL); 
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DCPS3 


Debug Change PE State to EL3, when executed in Debug state: 

` If executed at EL3 selects SP_EL3. 

° Otherwise, changes the current Exception level and SP to EL3 using SP_EL3. 
The target exception level of a DCPS3 instruction is EL3. 


On executing a DCPS3 instruction: 


` ELR _EL3 becomes UNKNOWN. 
° SPSR_EL3 becomes UNKNOWN. 
° ESR _EL3 becomes UNKNOWN. 


° DLR_ELO and DSPSR_ELO become UNKNOWN. 

° The endianness is set according to SCTLR_EL3.EE. 
This instruction is UNDEFINED at all exception levels if either: 
° EDSCR.SDD == 1. 

. EL3 is not implemented. 

This instruction is always UNDEFINED in Non-debug state. 


For more information on the operation of the DCPSn instructions, see DCPS<n> on page H2-6731. 


|31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4/3 21 0| 
11010100h o1] imme _—_— Jooofi 1| 
LL 


System variant 


DCPS3 {#<imm>} 


Decode for this encoding 


if !Halted() then AArch64.UndefinedFault(); 


Assembler symbols 

<imm> Is an optional 16-bit unsigned immediate, in the range 0 to 65535, defaulting to 0 and encoded in 
the "imm16" field. 

Operation 


DCPSInstruction(LL); 
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C6.2.79 DMB 


Data Memory Barrier is a memory barrier that ensures the ordering of observations of memory accesses, see Data 
Memory Barrier (DMB) on page B2-125. 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/11 8|7 6 5 4|3 21 0| 


110101010 ofofo ofotijoor ial crm jijo iji 11 11| 


System variant 


DMB <option>|#<imm> 


opc 


Decode for this encoding 


case CRm<3:2> 


when 
when 
when 
when 


case CRm<1: 0> 


when 
when 
when 
when 


'o0' 
'01' 
'10' 
111' 


'00' 
'01' 
'10' 
'11' 


of 
domain 
domain 
domain 
domain 
of 
types 
types 
types 
types 


p ie e oe 


MB 
MB 
MB 
MB 


Assembler symbols 


<option> 


C6-888 


BReqDomain_OuterShareable; 
BReqDomain_Nonshareable; 
BReqDomain_InnerShareable; 
BReqDomain_Ful1System; 


ReqTypes_All; domain = MBReqDomain_FullSystem; 
ReqTypes_Reads; 

ReqTypes_Writes; 

ReqTypes_Al1; 





Specifies the limitation on the barrier operation. Values are: 


SY 


ST 


LD 


ISH 


ISHST 


ISHLD 


NSH 


NSHST 


NSHLD 


OSH 


Full system is the required shareability domain, reads and writes are the required access 
types, both before and after the barrier instruction. This option is referred to as the full 
system barrier. Encoded as CRm = 0b1111. 


Full system is the required shareability domain, writes are the required access type, both 
before and after the barrier instruction. Encoded as CRm = 0b1110. 


Full system is the required shareability domain, reads are the required access type before 
the barrier instruction, and reads and writes are the required access types after the barrier 
instruction. Encoded as CRm = 0b1101. 


Inner Shareable is the required shareability domain, reads and writes are the required 
access types, both before and after the barrier instruction. Encoded as CRm = 0b1011. 


Inner Shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as CRm = 0b1010. 


Inner Shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as CRm = 0b1001. 


Non-shareable is the required shareability domain, reads and writes are the required 
access, both before and after the barrier instruction. Encoded as CRm = 0b0111. 


Non-shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as CRm = 0b0110. 


Non-shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as CRm = 0b0101. 


Outer Shareable is the required shareability domain, reads and writes are the required 
access types, both before and after the barrier instruction. Encoded as CRm = 0b0011. 
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OSHST Outer Shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as CRm = @b0010. 


OSHLD Outer Shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as CRm = 0b0001. 


All other encodings of CRm that are not listed above are reserved, and can be encoded using the #<imm> 
syntax. All unsupported and reserved options must execute as a full system barrier operation, but 
software must not rely on this behavior. For more information on whether an access is before or after 
a barrier instruction, see Data Memory Barrier (DMB) on page B2-125 or see Data Synchronization 
Barrier (DSB) on page B2-128. 


<imm> Is a 4-bit unsigned immediate, in the range 0 to 15, encoded in the "CRm" field. 


Operation 


DataMemoryBarrier(domain, types); 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-889 
ID070919 Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.80 DRPS 


Debug restore process state 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/1110 9 8/7 6 5 4/3 21 0| 


110101 31/0 101/111 11/0 0000 0/1 1111/0 0000 


System variant 


DRPS 


Decode for this encoding 


if !Halted() || PSTATE.EL == EL@ then UNDEFINED; 


Operation 


DRPSInstruction(); 
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C6.2.81 DSB 


Data Synchronization Barrier is a memory barrier that ensures the completion of memory accesses, see Data 
Synchronization Barrier (DSB) on page B2-128. 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 8|7 6 5 4|3 21 0| 


110101010 ofofo ofo 1 1jo o0 1 1| 0x00 jijo ofi 111 4) 


CRm opc 


System variant 


DSB <option>|#<imm> 


Decode for this encoding 


case CRm<3:2> of 
when 'QQ' domain = 
when 'Q1' domain 
when '10' domain 
when '11' domain 

case CRm<1:0> of 
when '00' types 
when '@1' types 
when '10' types 
when '11' types 


BReqDomain_OuterShareable; 
BReqDomain_Nonshareable; 
BReqDomain_InnerShareable; 
BReqDomain_Ful1System; 


now ou 
ee ee re oe 


MBReqTypes_All; domain = MBReqDomain_Ful1System; 
MBReqTypes_Reads; 

MBReqTypes_Writes; 

MBReqTypes_Al1; 





Assembler symbols 


<option> Specifies the limitation on the barrier operation. Values are: 


SY Full system is the required shareability domain, reads and writes are the required access 
types, both before and after the barrier instruction. This option is referred to as the full 
system barrier. Encoded as CRm = 0b1111. 


ST Full system is the required shareability domain, writes are the required access type, both 
before and after the barrier instruction. Encoded as CRm = @b1110. 


LD Full system is the required shareability domain, reads are the required access type before 
the barrier instruction, and reads and writes are the required access types after the barrier 
instruction. Encoded as CRm = 0b1101. 


ISH Inner Shareable is the required shareability domain, reads and writes are the required 
access types, both before and after the barrier instruction. Encoded as CRm = 0b1011. 


ISHST Inner Shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as CRm = 0b1010. 


ISHLD Inner Shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as CRm = 0b1001. 


NSH Non-shareable is the required shareability domain, reads and writes are the required 
access, both before and after the barrier instruction. Encoded as CRm = 0b0111. 


NSHST Non-shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as CRm = 0b0110. 


NSHLD Non-shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as CRm = 0b0101. 


OSH Outer Shareable is the required shareability domain, reads and writes are the required 
access types, both before and after the barrier instruction. Encoded as CRm = 0b0011. 
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OSHST Outer Shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as CRm = @b0010. 


OSHLD Outer Shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as CRm = 0b0001. 


All other encodings of CRm that are not listed above are reserved, and can be encoded using the #<imm> 
syntax. All unsupported and reserved options must execute as a full system barrier operation, but 
software must not rely on this behavior. For more information on whether an access is before or after 
a barrier instruction, see Data Memory Barrier (DMB) on page B2-125 or see Data Synchronization 
Barrier (DSB) on page B2-128. 


<imm> Is a 4-bit unsigned immediate, in the range 0 to 15, encoded in the "CRm" field. 


Operation 


DataSynchronizationBarrier(domain, types); 
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Data Value Prediction Restriction by Context prevents data value predictions, based on information gathered from 
earlier execution within an particular execution context, from allowing later speculative execution within that 
context to be observable through side-channels. 


For more information, see DVP RCTX. 


This instruction is an alias of the SYS instruction. This means that: 


s The encodings in this description are named to match the encodings of SYS. 
$ The description of SYS gives the operational pseudocode for this instruction. 
ARMv8.5 
|31 30 29 28|27 26 25 24|23 22 21 20|1918  16|15 12111 8|7 54] 0| 
110101010 0fojo 1ļlo0o 11/0111/0011]/101{ R | 
L op1 CRn CRm op2 
System variant 
DVP RCTX, <Xt> 
is equivalent to 
SYS #3, C8, C3, #5, <Xt> 
and is always the preferred disassembly. 
Assembler symbols 
<Xt> Is the 64-bit name of the general-purpose source register, encoded in the "Rt" field. 


Operation 


The description of SYS gives the operational pseudocode for this instruction. 
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C6.2.83 EON (shifted register) 


Bitwise Exclusive OR NOT (shifted register) performs a bitwise Exclusive OR NOT of a register value and an 
optionally-shifted register value, and writes the result to the destination register. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 | 109 5 4| 0 | 


sole 10-1 Ola Ra | as | eer 


opc 


32-bit variant 
Applies when sf == 


EON <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


EON <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 
ROR when shift = 11 
<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field, 
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Operation 


bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


operand2 = NOT(operand2); 
result = operandi EOR operand2; 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.84 EOR (immediate) 


Bitwise Exclusive OR (immediate) performs a bitwise Exclusive OR of a register value and an immediate value, 
and writes the result to the destination register. 


|31 30 29 28|27 26 25 24/23 22 21 | 16/15 10 9 5 4| 


eo VV Re 


opc 


32-bit variant 
Applies when sf == 0 && N == 


EOR <Wd|WSP>, <Wn>, #<imm> 


64-bit variant 
Applies when sf == 


EOR <Xd|SP>, <Xn>, #<imm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer datasize = if sf == '1' then 64 else 32; 
bits(datasize) imm; 

if sf == '@' && N != '@' then UNDEFINED; 

(imm, -) = DecodeBitMasks(N, imms, immr, TRUE); 


Assembler symbols 


<Wd |WSP> Is the 32-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd|SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<imm> For the 32-bit variant: is the bitmask immediate, encoded in "imms:immr". 


For the 64-bit variant: is the bitmask immediate, encoded in "N:imms:immr". 


Operation 


bits(datasize) result; 
bits(datasize) operand1 = X[n]; 


result = operand1 EOR imm; 


if d == 31 then 
SP[] = result; 
else 


X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-897 
ID070919 Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.85 


C6-898 


EOR (shifted register) 


Bitwise Exclusive OR (shifted register) performs a bitwise Exclusive OR of a register value and an 
optionally-shifted register value, and writes the result to the destination register. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 | 109 5 4| 0 | 


sole 10+ a ea | as E 


opc 


32-bit variant 
Applies when sf == 


EOR <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


EOR <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 
ROR when shift = 11 
<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 


"imm6" field, 
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C6.2 Alphabetical list of A64 base instructions 


Operation 


bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


result = operandi EOR operand2; 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.86 ERET 


Exception Return using the ELR and SPSR for the current Exception level. When executed, the PE restores PSTATE 
from the SPSR, and branches to the address held in the ELR. 


The PE checks the SPSR for the current Exception level for an illegal return event. See ///egal return events from 
AArch64 state on page D1-2304. 


ERET is UNDEFINED at ELO. 


[31 30 29 28/27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9. | 5 4| o| 
110101 1/0/10 0/1 1111/0 00 ofofo[11111]00000 
AM Rn op4 


System variant 
ERET 


Decode for this encoding 


if PSTATE.EL == ELO then UNDEFINED; 


Operation 


AArch64.CheckForERetTrap(FALSE, TRUE); 
bits(64) target = ELR[]; 


AArch64.ExceptionReturn(target, SPSR[]); 
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C6.2.87 ERETAA, ERETAB 


Exception Return, with pointer authentication. This instruction authenticates the address in ELR, using SP as the 
modifier and the specified key, the PE restores PSTATE from the SPSR for the current Exception level, and branches 
to the authenticated address. 


Key A is used for ERETAA, and key B is used for ERETAB. 


If the authentication passes, the PE continues execution at the target of the branch. If the authentication fails, a 
Translation fault is generated. 


The authenticated address is not written back to ELR. 


The PE checks the SPSR for the current Exception level for an illegal return event. See ///egal return events from 
AArch64 state on page D1-2304. 


ERETAA and ERETAB are UNDEFINED at ELO. 


ARMVv8.3 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/1514 1312/1110 9. | 5 4| 
T10107 J E w Tet PTT 
op4 
ERETAA variant 
Applies when M == 
ERETAA 
ERETAB variant 
Applies when M == 
ERETAB 
Decode for all variants of this encoding 
if PSTATE.EL == EL@ then UNDEFINED; 
boolean use_key_a = (M == 'Q'); 
if !HavePACExt() then 
UNDEFINED; 
Operation 
AArch64.CheckForERetTrap(TRUE, use_key_a); 
bits(64) target; 
if use_key_a then 
target = AuthIA(ELR[], SP[]); 
else 
target = AuthIB(ELR[], SP[]); 
AArch64.ExceptionReturn(target, SPSR[]); 
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C6.2.88 ESB 


Error Synchronization Barrier is an error synchronization event that might also update DISR_EL1 and 
VDISR_EL2. 


This instruction can be used at all Exception levels and in Debug state. 


In Debug state, this instruction behaves as if SError interrupts are masked at all Exception levels. See Error 
Synchronization Barrier in the Arm(R) Reliability, Availability, and Serviceability (RAS) Specification, Armv8, for 
Armv8-A architecture profile. 


If the RAS Extension is not implemented, this instruction executes as a NOP. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/11 8|7 5 4/3 21 0| 


770107070 ojojo ojo 11o o1 0ojo o1 ojoo oj 111r 


0 
CRm op2 


System variant 


ESB 


Decode for this encoding 


if !HaveRASExt() then EndOfInstruction(); 


Operation 


SynchronizeErrors(); 

AArch64.ESBOperation(); 

if PSTATE.EL IN {EL@, EL1} && EL2Enabled() then AArch64.vESBOperation(); 
TakeUnmaskedSErrorInterrupts(); 
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C6.2.89 EXTR 


ARM DDI 0487E.a 
ID070919 


Extract register extracts a register from a pair of registers. 


This instruction is used by the alias ROR (immediate). See Alias conditions for details of when each alias is 


preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 | 109 5 4| 0 | 


a Vd a 


32-bit variant 
Applies when sf == @ && N == 0 && imms == Qxxxxx. 


EXTR <Wd>, <Wn>, <Wm>, #<Isb> 


64-bit variant 
Applies when sf == 1 && N == 


EXTR <Xd>, <Xn>, <Xm>, #<Isb> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
integer lsb; 


if N != sf then UNDEFINED; 


if sf == 'Q' && imms<5> == '1' then UNDEFINED; 
Isb = UInt(imms); 


Alias conditions 





Alias is preferred when 


ROR (immediate) Rn == Rm 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<lsb> For the 32-bit variant: is the least significant bit position from which to extract, in the range 0 to 31, 


encoded in the "imms" field. 


For the 64-bit variant: is the least significant bit position from which to extract, in the range 0 to 63, 


encoded in the "imms" field. 
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Operation 

bits(datasize) result; 

bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = X[m]; 
bits(2sdatasize) concat = operand1:operand2; 


result = concat<Isb+datasize-1:1sb>; 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


< The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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Tag Mask Insert inserts the tag in the first source register into the excluded set specified in the second source register, 
writing the new excluded set to the destination register. 


ARMV8.5 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


loloj 1010110] xm fofofojifojsy xn | x | 


Integer variant 


GMI <Xd>, <Xn|SP>, <Xm> 


Decode for this encoding 


integer d = UInt(Xd); 
integer n = UInt(Xn); 
integer m = UInt(Xm); 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Xd" field. 

<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Xn" 
field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Xm" field. 

Operation 


bits(64) address = if n == 31 then SP[] else X[n]; 
bits(64) mask = X[m]; 

bits(4) tag = AArch64.AllocationTagFromAddress(address) ; 
mask<UInt(tag)> = '1'; 

X[d] = mask; 
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C6.2.91 


C6-906 


HINT 


Hint instruction is for the instruction set space that is reserved for architectural hint instructions. 


Some encodings described here are not allocated in this revision of the architecture, and behave as NOPs. These 
encodings might be allocated to other hint functionality in future revisions of the architecture and therefore must 
not be used by software. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/11 8|7 5 4/3 21 0| 


1010101 0 ofojo ojo 1 1fo 0 10] cRm | op2 [1 1111| 


System variant 

HINT #<imm> 

Decode for this encoding 
SystemHintOp op; 


case CRm:op2 of 


when '0000 000' op 
when 'Q000 001' op 
when 'Q000 010' op 
when '0000 Q11' op 
when '0000 100' op 
when '0000 101' op 
when '0000 111' 
SEE "XPACLRI"; 
when '0001 xxx' 
SEE "PACIA1716, PACIB1716, AUTIA1716, AUTIB1716"; 
when 'Q010 000' 
if !HaveRASExt() then EndOfInstruction(); // Instruction executes as NOP 
op = SystemHintOp_ESB; 
when '0010 001' 
if !HaveStatisticalProfiling() then EndOfInstruction(); // Instruction executes as NOP 
op = SystemHintOp_PSB; 
when '0010 010' 
if !HaveSelfHostedTrace() then EndOfInstruction(); // Instruction executes as NOP 
op = SystemHintOp_TSB; 
when '0010 100' 
op = SystemHintOp_CSDB; 
when 'QQ11 xxx' 
SEE "PACIAZ, PACIASP, PACIBZ, PACIBSP, AUTIAZ, AUTIASP, AUTIBZ, AUTIBSP"; 
when 'Q100 xxQ' 
op = SystemHintOp_BTI; 
// Check branch target compatibility between BTI instruction and PSTATE.BTYPE 
- = BTypeCompatible_BTI(op2<2:1>); 
otherwise EndOfInstruction(); 


SystemHintOp_NOP; 
SystemHintOp_YIELD; 
SystemHintOp_WFE; 
SystemHintOp_WFI; 
SystemHintOp_SEV; 
SystemHintOp_SEVL; 


Assembler symbols 


<imm> Is a 7-bit unsigned immediate, in the range 0 to 127 encoded in the "CRm:op2" field. 


The encodings that are allocated to architectural hint functionality are described in the "Hints" table 
in the "Index by Encoding". 





Note 
For allocated encodings of "CRm:op2": 
° A disassembler will disassemble the allocated instruction, rather than the HINT instruction. 
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e An assembler may support assembly of allocated encodings using HINT with the 
corresponding <imm> value, but it is not required to do so. 





Operation 


case op of 
when SystemHintOp_YIELD 
Hint_Yield(); 


when SystemHintOp_WFE 
if IsEventRegisterSet() then 
ClearEventRegister(); 
else 
if PSTATE.EL == ELQ@ then 
// Check for traps described by the OS which may be EL1 or EL2. 
AArch64.CheckForWFxTrap(EL1, TRUE); 
if PSTATE.EL IN {EL0, EL1} && EL2Enabled() && !IsInHost() then 
// Check for traps described by the Hypervisor. 
AArch64.CheckForWFxTrap(EL2, TRUE); 
if HaveEL(EL3) && PSTATE.EL != EL3 then 
// Check for traps described by the Secure Monitor. 
AArch64.CheckForWFxTrap(EL3, TRUE); 
WaitForEvent(); 


when SystemHintOp_WFI 
if !InterruptPending() then 

if PSTATE.EL == ELQ@ then 
// Check for traps described by the OS which may be EL1 or EL2. 
AArch64.CheckForWFxTrap(EL1, FALSE); 

if PSTATE.EL IN {EL@, EL1} && EL2Enabled() && !IsInHost() then 
// Check for traps described by the Hypervisor. 
AArch64.CheckForWFxTrap(EL2, FALSE); 

if HaveEL(EL3) && PSTATE.EL != EL3 then 
// Check for traps described by the Secure Monitor. 
AArch64.CheckForWFxTrap(EL3, FALSE); 

WaitForInterrupt(); 


when SystemHintOp_SEV 
SendEvent(); 


when SystemHintOp_SEVL 
SendEventLocal(); 


when SystemHintOp_ESB 
SynchronizeErrors(); 
AArch64.ESBOperation(); 
if PSTATE.EL IN {EL@, EL1} && EL2Enabled() then AArch64.vESBOperation(); 
TakeUnmaskedSErrorInterrupts(); 


when SystemHintOp_PSB 
Profi lingSynchronizationBarrier(); 


when SystemHintOp_TSB 
TraceSynchronizationBarrier(); 


when SystemHintOp_CSDB 
ConsumptionOfSpeculativeDataBarrier(); 


otherwise // do nothing 
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C6.2.92 HLT 


Halt instruction. A HLTinstruction can generate a Halt Instruction debug event, which causes entry into Debug state. 


|31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4/3 21 0| 
11010100010] — — mme Joop 


System variant 


HLT #<imm> 


Decode for this encoding 


if EDSCR.HDE == '@' || !HaltingAllowed() then UndefinedFault(); 
- = HaveBTIExt(); 


Assembler symbols 


<imm> Is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the "imm16" field. 


Operation 


Halt(DebugHalt_HaltInstruction); 
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Hypervisor Call causes an exception to EL2. Non-secure software executing at EL1 can use this instruction to call 
the hypervisor to request a service. 


The HVC instruction 1s UNDEFINED: 

° At ELO. 

° At EL1 if EL2 is not enabled in the current Security state. 
s When SCR_EL3.HCE is set to 0. 


On executing an HVC instruction, the PE records the exception as a Hypervisor Call exception in ESR_ELx, using 
the EC value 0x16, and the value of the immediate argument. 


|31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4/3 21 0| 
11010100000] — mme Joop 


System variant 


HVC #<imm> 


Decode for this encoding 


// Empty. 


Assembler symbols 


<imm> Is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the "imm16" field. 


Operation 


if !HaveEL(EL2) || PSTATE.EL == EL@ || (PSTATE.EL == EL1 && (!IsSecureEL2Enabled() && IsSecure())) then 
UNDEFINED; 


hvc_enable = if HaveEL(EL3) then SCR_EL3.HCE else NOT(HCR_EL2.HCD); 
if hvc_enable == 'Q' then 

AArch64.UndefinedFault(); 
else 

AArch64.CallHypervisor(imm16) ; 
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C6.2.94 


C6-910 


IC 


Instruction Cache operation. For more information, see op0==0b01, cache maintenance, TLB maintenance, and 
address translation instructions on page C5-366. 


This instruction is an alias of the SYS instruction. This means that: 


$ The encodings in this description are named to match the encodings of SYS. 
s The description of SYS gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20|1918  16|15 12111 8|7 54] 0| 


770107070 0)0)0 7] o [oii] em [om] R 
L CRn 


System variant 

IC <ic_op>{, <Xt>} 

is equivalent to 

SYS #<opl>, C7, <Cm>, #<op2>{, <Xt>} 


and is the preferred disassembly when SysOp(op1,'@111',CRm,op2) == Sys_IC. 


Assembler symbols 


<ic_op> Is an IC instruction name, as listed for the IC system instruction pages, encoded in the 
"opl:CRm:op2" field. It can have the following values: 


TALLUIS when op1 = 000, CRm = 0001, op2 = 000 
TALLU when op1 = 000, CRm = 0101, op2 = 000 
IVAU when op1 = 011, CRm = 0101, op2 = 001 
<op1> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op1" field. 
<Cm> Is a name 'Cm', with 'm' in the range 0 to 15, encoded in the "CRm" field. 
<op2> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op2" field. 
<Xt> Is the 64-bit name of the optional general-purpose source register, defaulting to '11111', encoded in 


the "Rt" field. 


Operation 


The description of SYS gives the operational pseudocode for this instruction. 
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C6.2.95 IRG 


ARM DDI 0487E.a 
ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Insert Random Tag inserts a random Logical Address Tag into the address in the first source register, and writes the 
result to the destination register. Any tags specified in the optional second source register or in GCR_EL1.Exclude 
are excluded from the selection of the random Logical Address Tag. 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| o| 


lojo 10 10110| xm _ fofofofijofoy xn | xa | 


Integer variant 


IRG <Xd|SP>, <Xn|SP>{, <Xm>} 


Decode for this encoding 


integer d = UInt(Xd); 
integer n = UInt(Xn); 
integer m = UInt(Xm); 


Assembler symbols 


<Xd|SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Xd" 
field. 

<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Xn" 
field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Xm" field. 
Defaults to XZR if absent. 

Operation 


bits(64) operand = if n == 31 then SP[] else X[n]; 
bits(64) exclude_reg = X[m]; 
bits(16) exclude = exclude_reg<15:@> OR GCR_EL1.Exclude; 


if AArch64.AllocationTagAccessIsEnabled() then 
if GCR_EL1.RRND == '1' then 
rtag = _ChooseRandomNonExcludedTag(exclude) ; 
else 
bits(4) start = RGSR_EL1.TAG; 
bits(4) offset = AArch64.RandomTag(); 


rtag = AArch64.ChooseNonExcludedTag(start, offset, exclude); 


RGSR_EL1.TAG = rtag; 
else 
rtag = '0000'; 


bits(64) result = AArch64.AddressWithAllocationTag(operand, rtag); 


if d == 31 then 
SP[] = result; 
else 
X[d] = result; 
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C6.2.96 ISB 


Instruction Synchronization Barrier flushes the pipeline in the PE and is a context synchronization event. For more 
information, see Instruction Synchronization Barrier (ISB) on page B2-125. 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/11 8|7 6 5 4|3 21 0| 
110707010 ojojo ofo11f00%41] CRm fiji 0]1111 1 
opc 


System variant 
ISB {<option>|#<imm>} 
Decode for this encoding 


// No additional decoding required 


Assembler symbols 


<option> Specifies an optional limitation on the barrier operation. Values are: 
SY Full system barrier operation, encoded as CRm = 0b1111. Can be omitted. 


All other encodings of CRm are reserved. The corresponding instructions execute as full system 
barrier operations, but must not be relied upon by software. 


<imm> Is an optional 4-bit unsigned immediate, in the range 0 to 15, defaulting to 15 and encoded in the 
"CRm" field. 
Operation 


InstructionSynchronizationBarrier(); 
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C6.2 Alphabetical list of A64 base instructions 


C6.2.97 LDADDB, LDADDAB, LDADDALB, LDADDLB 


ARM DDI 0487E.a 
ID070919 


Atomic add on byte in memory atomically loads an 8-bit byte from memory, adds the value held in a register to it, 
and stores the result back to memory. The value initially loaded from memory is returned in the destination register. 


à If the destination register is not WZR, LDADDAB and LDADDALB load from memory with acquire semantics. 
° LDADDLB and LDADDALB store to memory with release semantics. 
° LDADDB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STADDB, STADDLB. See Alias conditions on page C6-914 for details of when 
each alias is preferred. 
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size opc 


LDADDAB variant 
Applies when A == 1 && R == 


LDADDAB <Ws>, <Wt>, [<Xn|SP>] 


LDADDALB variant 
Applies when A == 1 && R == 


LDADDALB <Ws>, <Wt>, [<Xn|SP>] 


LDADDB variant 
Applies when A == 0 && R == 0. 


LDADDB <Ws>, <Wt>, [<Xn|SP>] 


LDADDLB variant 
Applies when A == @ && R == 1. 


LDADDLB <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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C6.2 Alphabetical list of A64 base instructions 


C6-914 


Alias conditions 





Alias is preferred when 


STADDB, STADDLB A == '0' & Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) value; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_ADD, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.98 LDADDH, LDADDAH, LDADDALH, LDADDLH 


ARM DDI 0487E.a 
ID070919 


Atomic add on halfword in memory atomically loads a 16-bit halfword from memory, adds the value held in a 
register to it, and stores the result back to memory. The value initially loaded from memory is returned in the 
destination register. 


g If the destination register is not WZR, LDADDAH and LDADDALH load from memory with acquire semantics. 
° LDADDLH and LDADDALH store to memory with release semantics. 
è LDADDH has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STADDH, STADDLH. See Alias conditions on page C6-916 for details of when 
each alias is preferred. 


ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 54| 0| 
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size opc 
LDADDAH variant 


Applies when A == 1 & R == 
LDADDAH <Ws>, <Wt>, [<Xn|SP>] 
LDADDALH variant 

Applies when A == 1 && R == 
LDADDALH <Ws>, <Wt>, [<Xn|SP>] 
LDADDH variant 

Applies when A == 0 && R == 0. 


LDADDH <Ws>, <Wt>, [<Xn|SP>] 


LDADDLH variant 
Applies when A == 0 && R = 1. 


LDADDLH <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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C6.2 Alphabetical list of A64 base instructions 


C6-916 


Alias conditions 





Alias is preferred when 


STADDH, STADDLH A == '0' & Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) value; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_ADD, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.99 LDADD, LDADDA, LDADDAL, LDADDL 


Atomic add on word or doubleword in memory atomically loads a 32-bit word or 64-bit doubleword from memory, 
adds the value held in a register to it, and stores the result back to memory. The value initially loaded from memory 
is returned in the destination register. 


° If the destination register is not one of WZR or XZR, LDADDA and LDADDAL load from memory with acquire 
semantics. 

. LDADDL and LDADDAL store to memory with release semantics. 

` LDADD has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STADD, STADDL. See Alias conditions on page C6-918 for details of when 
each alias is preferred. 


ARMV8.1 
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size opc 


32-bit LDADD variant 

Applies when size == 10 && A == 0 && R = 0. 
LDADD <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDADDA variant 

Applies when size == 10 && A == 1 && R == 0. 
LDADDA <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDADDAL variant 

Applies when size == 10 && A == 1 & R = 1. 
LDADDAL <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDADDL variant 

Applies when size == 10 && A == 0 && R = 1. 
LDADDL <Ws>, <Wt>, [<Xn|SP>] 

64-bit LDADD variant 

Applies when size == 11 && A == 0 && R == 0. 
LDADD <Xs>, <Xt>, [<Xn|SP>] 

64-bit LDADDA variant 

Applies when size == 11 && A == 1 && R == 0. 


LDADDA <Xs>, <Xt>, [<Xn|SP>] 
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64-bit LDADDAL variant 
Applies when size == 11 && A == 1 && R = 1. 
LDADDAL <Xs>, <Xt>, [<Xn|SP>] 
64-bit LDADDL variant 
Applies when size == 11 && A == 0 && R = 1. 
LDADDL <Xs>, <Xt>, [<Xn|SP>] 
Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer t = UInt(Rt); 


integer n = UInt(Rn); 
integer s = UInt(Rs); 


integer datasize = 8 << UInt(size); 

integer regsize = if datasize == 64 then 64 else 32; 

AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = 


n != 31; 
Alias conditions 
Alias is preferred when 
STADD, STADDL == '0' @& Rt == '11111' 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(datasize) value; 
bits(datasize) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_ADD, value, ldacctype, stacctype); 
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if t != 31 then 
X[t] = ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.100 


C6-920 


LDAPR 


Load-Acquire RCpc Register derives an address from a base register value, loads a 32-bit word or 64-bit 
doubleword from the derived address in memory, and writes it to a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129, except that: 


$ There is no ordering requirement, separate from the requirements of a Load-AcquirePC or a Store-Release, 
created by having a Store-Release followed by a Load-AcquirePC instruction. 


° The reading of a value written by a Store-Release by a Load-AcquirePC instruction by the same observer 
does not make the write of the Store-Release globally observed. 


This difference in memory ordering is not described in the pseudocode. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMVv8.3 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


1 x[i 1 tfofo ojijo wmm] o ojo of Rn | rR | 
Rs 


size 
32-bit variant 
Applies when size == 10. 
LDAPR <Wt>, [<Xn|SP> {,#0}] 
64-bit variant 
Applies when size == 11. 
LDAPR <Xt>, [<Xn|SP> {,#0}] 


Decode for all variants of this encoding 


integer n 
integer t 


UInt(Rn) ; 
UInt (Rt) ; 


integer elsize = 8 << UInt(size); 
integer regsize = if elsize == 64 then 64 else 32; 
boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 

<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(elsize) data; 
constant integer dbytes = elsize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 
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if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


Mem[address, dbytes, AccType_ORDERED]; 
ZeroExtend(data, regsize); 


data 
X[t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2 Alphabetical list of A64 base instructions 


C6.2.101 LDAPRB 


C6-922 


Load-Acquire RCpc Register Byte derives an address from a base register value, loads a byte from the derived 
address in memory, zero-extends it and writes it to a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129, except that: 


$ There is no ordering requirement, separate from the requirements of a Load-AcquirePC or a Store-Release, 
created by having a Store-Release followed by a Load-AcquirePC instruction. 


° The reading of a value written by a Store-Release by a Load-AcquirePC instruction by the same observer 
does not make the write of the Store-Release globally observed. 


This difference in memory ordering is not described in the pseudocode. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMVv8.3 
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Rs 


size 


Integer variant 


LDAPRB <Wt>, [<Xn|SP> {,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data 
X(t] 


Mem[address, 1, AccType_ORDERED]; 
ZeroExtend(data, 32); 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.102 LDAPRH 


C6-924 


Load-Acquire RCpc Register Halfword derives an address from a base register value, loads a halfword from the 
derived address in memory, zero-extends it and writes it to a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129, except that: 


$ There is no ordering requirement, separate from the requirements of a Load-AcquirePC or a Store-Release, 
created by having a Store-Release followed by a Load-AcquirePC instruction. 


° The reading of a value written by a Store-Release by a Load-AcquirePC instruction by the same observer 
does not make the write of the Store-Release globally observed. 


This difference in memory ordering is not described in the pseudocode. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMVv8.3 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 
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size 


Integer variant 


LDAPRH <Wt>, [<Xn|SP> {,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data 
X(t] 


Mem[address, 2, AccType_ORDERED]; 
ZeroExtend(data, 32); 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.103 


C6-926 


LDAPUR 


Load-Acquire RCpc Register (unscaled) calculates an address from a base register and an immediate offset, loads 
a 32-bit word or 64-bit doubleword from memory, zero-extends it, and writes it to a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129, except that: 


$ There is no ordering requirement, separate from the requirements of a Load-AcquirePC or a Store-Release, 
created by having a Store-Release followed by a Load-AcquirePC instruction. 


° The reading of a value written by a Store-Release by a Load-AcquirePC instruction by the same observer 
does not make the write of the Store-Release globally observed. 


This difference in memory ordering is not described in the pseudocode. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMvV8.4 
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size opc 


32-bit variant 

Applies when size == 10. 

LDAPUR <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when size == 11. 

LDAPUR <Xt>, [<Xn|SP>{, #<simm>}] 

Decode for all variants of this encoding 


integer scale = UInt(size); 
bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer regsize; 


regsize = if size == '11' then 64 else 32; 
integer datasize = 8 << scale; 
boolean tag_checked = n != 31; 
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Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


Mem[address, datasize DIV 8, AccType_ORDERED]; 
ZeroExtend(data, regsize); 


data 
X[t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.104 


C6-928 


LDAPURB 


Load-Acquire RCpc Register Byte (unscaled) calculates an address from a base register and an immediate offset, 
loads a byte from memory, zero-extends it, and writes it to a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129, except that: 


$ There is no ordering requirement, separate from the requirements of a Load-AcquirePC or a Store-Release, 
created by having a Store-Release followed by a Load-AcquirePC instruction. 


° The reading of a value written by a Store-Release by a Load-AcquirePC instruction by the same observer 
does not make the write of the Store-Release globally observed. 


This difference in memory ordering is not described in the pseudocode. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMv8.4 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|11 10 9 | 5 4| o| 
[o ojo 1100 1ļo ajo] imma jo of Rm | R | 
size opc 


Unscaled offset variant 


LDAPURB <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


address = X[n]; 
address = address + offset; 


Mem[address, 1, AccType_ORDERED]; 
ZeroExtend(data, 32); 


data 
X(t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.105 


C6-930 


LDAPURH 


Load-Acquire RCpc Register Halfword (unscaled) calculates an address from a base register and an immediate 
offset, loads a halfword from memory, zero-extends it, and writes it to a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129, except that: 


$ There is no ordering requirement, separate from the requirements of a Load-AcquirePC or a Store-Release, 
created by having a Store-Release followed by a Load-AcquirePC instruction. 


° The reading of a value written by a Store-Release by a Load-AcquirePC instruction by the same observer 
does not make the write of the Store-Release globally observed. 


This difference in memory ordering is not described in the pseudocode. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMv8.4 
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size opc 


Unscaled offset variant 


LDAPURH <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


address = X[n]; 
address = address + offset; 


Mem[address, 2, AccType_ORDERED]; 
ZeroExtend(data, 32); 


data 
X(t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.106 


C6-932 


LDAPURSB 


Load-Acquire RCpc Register Signed Byte (unscaled) calculates an address from a base register and an immediate 
offset, loads a signed byte from memory, sign-extends it, and writes it to a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129, except that: 


$ There is no ordering requirement, separate from the requirements of a Load-AcquirePC or a Store-Release, 
created by having a Store-Release followed by a Load-AcquirePC instruction. 


° The reading of a value written by a Store-Release by a Load-AcquirePC instruction by the same observer 
does not make the write of the Store-Release globally observed. 


This difference in memory ordering is not described in the pseudocode. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMVv8.4 
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32-bit variant 

Applies when opc == 11. 

LDAPURSB <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when opc == 10. 

LDAPURSB <Xt>, [<Xn|SP>{, #<simm>}] 
Decode for all variants of this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
MemOp memop; 

boolean signed; 
integer regsize; 


if opc<l> == '@' then 
// store or zero-extending load 
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memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH && (n != 31); 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


if n == 31 then 
if memop != MemOp_PREFETCH then CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = X[t]; 
Mem[address, 1, AccType_ORDERED] = data; 


when MemOp_LOAD 
data = Mem[address, 1, AccType_ORDERED] ; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:0>); 


Operational information 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.107 


C6-934 


LDAPURSH 


Load-Acquire RCpc Register Signed Halfword (unscaled) calculates an address from a base register and an 
immediate offset, loads a signed halfword from memory, sign-extends it, and writes it to a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129, except that: 


$ There is no ordering requirement, separate from the requirements of a Load-AcquirePC or a Store-Release, 
created by having a Store-Release followed by a Load-AcquirePC instruction. 


° The reading of a value written by a Store-Release by a Load-AcquirePC instruction by the same observer 
does not make the write of the Store-Release globally observed. 


This difference in memory ordering is not described in the pseudocode. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 
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32-bit variant 

Applies when opc == 11. 

LDAPURSH <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when opc == 10. 

LDAPURSH <Xt>, [<Xn|SP>{, #<simm>}] 
Decode for all variants of this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
MemOp memop; 

boolean signed; 
integer regsize; 


if opc<l> == '@' then 
// store or zero-extending load 
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memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH && (n != 31); 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 
if memop != MemOp_PREFETCH then CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = X[t]; 
Mem[address, 2, AccType_ORDERED] = data; 


when MemOp_LOAD 
data = Mem[address, 2, AccType_ORDERED] ; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:0>); 


Operational information 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.108 


C6-936 


LDAPURSW 


Load-Acquire RCpc Register Signed Word (unscaled) calculates an address from a base register and an immediate 
offset, loads a signed word from memory, sign-extends it, and writes it to a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129, except that: 


$ There is no ordering requirement, separate from the requirements of a Load-AcquirePC or a Store-Release, 
created by having a Store-Release followed by a Load-AcquirePC instruction. 


° The reading of a value written by a Store-Release by a Load-AcquirePC instruction by the same observer 
does not make the write of the Store-Release globally observed. 


This difference in memory ordering is not described in the pseudocode. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMv8.4 
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Unscaled offset variant 


LDAPURSW <Xt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(32) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


address = X[n]; 
address = address + offset; 


Mem[address, 4, AccType_ORDERED]; 
SignExtend(data, 64); 


data 
X[t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.109 


C6-938 


LDAR 


Load-Acquire Register derives an address from a base register value, loads a 32-bit word or 64-bit doubleword from 
memory, and writes it to a register. The instruction also has memory ordering semantics as described in 
Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


Note 


For this instruction, if the destination is WZR/ZXR, it is impossible for software to observe the presence of the 
acquire semantic other than its effect on the arrival at endpoints. 








|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 = 10 9 5 4| 0 | 
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size Rt2 


32-bit variant 
Applies when size == 10. 


LDAR <Wt>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when size == 11. 


LDAR <Xt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n 
integer t 


UInt(Rn) ; 
UInt (Rt) ; 


integer elsize = 8 << UInt(size); 
integer regsize = if elsize == 64 then 64 else 32; 
boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(elsize) data; 
constant integer dbytes = elsize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


data 
X[t] 


Mem[address, dbytes, AccType_ORDERED]; 
ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.110 LDARB 


Load-Acquire Register Byte derives an address from a base register value, loads a byte from memory, zero-extends 
it and writes it to a register. The instruction also has memory ordering semantics as described in Load-Acquire, 
Load-AcquirePC, and Store-Release on page B2-129. For information about memory accesses, see Load/Store 
addressing modes on page C1-177. 


Note 


For this instruction, if the destination is WZR/ZXR, it is impossible for software to observe the presence of the 
acquire semantic other than its effect on the arrival at endpoints. 








|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 = 10 9 5 4| 0 | 
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size Rt2 


No offset variant 


LDARB <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data 
X(t] 


Mem[address, 1, AccType_ORDERED]; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.111 | LDARH 
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Load-Acquire Register Halfword derives an address from a base register value, loads a halfword from memory, 
zero-extends it, and writes it to a register. The instruction also has memory ordering semantics as described in 
Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


Note 


For this instruction, if the destination is WZR/ZXR, it is impossible for software to observe the presence of the 
acquire semantic other than its effect on the arrival at endpoints. 
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size Rt2 


No offset variant 


LDARH <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data 
X(t] 


Mem[address, 2, AccType_ORDERED]; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.112 LDAXP 


Load-Acquire Exclusive Pair of Registers derives an address from a base register value, loads two 32-bit words or 
two 64-bit doublewords from memory, and writes them to two registers. A 32-bit pair requires the address to be 
doubleword aligned and is single-copy atomic at doubleword granularity. A 64-bit pair requires the address to be 
quadword aligned and is single-copy atomic for each doubleword at doubleword granularity. The PE marks the 
physical address being accessed as an exclusive access. This exclusive access mark is checked by Store Exclusive 
instructions. See Synchronization and semaphores on page B2-156. The instruction also has memory ordering 
semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. For information 
about memory accesses see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 
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32-bit variant 
Applies when sz == 


LDAXP <Wtl>, <Wt2>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when sz == 


LDAXP <Xtl>, <Xt2>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 
integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer t2 = UInt(Rt2); 

integer elsize = 32 << UInt(sz); 

integer datasize = elsize « 2; 

boolean tag_checked = n != 31; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDAXP on page K1-7637. 


Assembler symbols 


<Wtl> Is the 32-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Wt2> Is the 32-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xt1> Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Xt2> Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Operation 


bits(64) address; 

bits(datasize) data; 

constant integer dbytes = datasize DIV 8; 
boolean rt_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if t == t2 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; // result is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


// Tell the Exclusives monitors to record a sequence of one or more atomic 
// memory reads from virtual address range [address, address+dbytes-1]. 

// The Exclusives monitor will only be set if all the reads are from the 
// same dbytes-aligned physical address, to allow for the possibility of 
// an atomicity break if the translation is changed between reads. 
AArch64.SetExclusiveMonitors(address, dbytes); 


if rt_unknown then 
// ConstrainedUNPREDICTABLE case 
X[t] = bits(datasize) UNKNOWN; // In this case t = t2 
elsif elsize == 32 then 
// 32-bit load exclusive pair (atomic) 
data = Mem[address, dbytes, AccType_ORDEREDATOMIC] ; 
if BigEndian() then 
X[t] = data<datasize-1l:elsize>; 
X[t2] = data<elsize-1:0>; 
else 
X[t] = data<elsize-1:0>; 
X[t2] = data<datasize-1l:elsize>; 
else // elsize == 64 
// 64-bit load exclusive pair (not atomic), 
// but must be 128-bit aligned 
if address != Align(address, dbytes) then 


AArch64.Abort(address, AArch64.AlignmentFault(AccType_ORDEREDATOMIC, FALSE, FALSE)); 


X[t] = Mem[address, 8, AccType_ORDEREDATOMIC] ; 
X[t2] = Mem[address+8, 8, AccType_ORDEREDATOMIC] ; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.113 


C6-944 


LDAXR 


Load-Acquire Exclusive Register derives an address from a base register value, loads a 32-bit word or 64-bit 
doubleword from memory, and writes it to a register. The memory access is atomic. The PE marks the physical 
address being accessed as an exclusive access. This exclusive access mark is checked by Store Exclusive 
instructions. See Synchronization and semaphores on page B2-156. The instruction also has memory ordering 
semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. For information 
about memory accesses see Load/Store addressing modes on page C1-177. 
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size Rt2 


32-bit variant 
Applies when size == 10. 


LDAXR <Wt>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when size == 11. 


LDAXR <Xt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n 
integer t 


UInt(Rn) ; 
UInt (Rt) ; 


integer elsize = 8 << UInt(size); 
integer regsize = if elsize == 64 then 64 else 32; 
boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(elsize) data; 
constant integer dbytes = elsize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


// Tell the Exclusives monitors to record a sequence of one or more atomic 
// memory reads from virtual address range [address, address+dbytes-1]. 
// The Exclusives monitor will only be set if all the reads are from the 
// same dbytes-aligned physical address, to allow for the possibility of 
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// an atomicity break if the translation is changed between reads. 
AArch64.SetExclusiveMonitors(address, dbytes); 


Mem[address, dbytes, AccType_ORDEREDATOMIC] ; 
ZeroExtend(data, regsize); 


data 
X(t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.114 


C6-946 


LDAXRB 


Load-Acquire Exclusive Register Byte derives an address from a base register value, loads a byte from memory, 
zero-extends it and writes it to a register. The memory access is atomic. The PE marks the physical address being 
accessed as an exclusive access. This exclusive access mark is checked by Store Exclusive instructions. See 
Synchronization and semaphores on page B2-156. The instruction also has memory ordering semantics as described 
in Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. For information about memory accesses see 
Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 = 5 4| 0 | 


oofo 0 Fo 0 fof POM MM mais OK E E 


size Rt2 


No offset variant 
LDAXRB <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


// Tell the Exclusives monitors to record a sequence of one or more atomic 
// memory reads from virtual address range [address, address+dbytes-1]. 

// The Exclusives monitor will only be set if all the reads are from the 
// same dbytes-aligned physical address, to allow for the possibility of 
// an atomicity break if the translation is changed between reads. 
AArch64.SetExclusiveMonitors(address, 1); 


data 
X(t] 


Mem[address, 1, AccType_ORDEREDATOMIC]; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.115 LDAXRH 


ARM DDI 0487E.a 
ID070919 


Load-Acquire Exclusive Register Halfword derives an address from a base register value, loads a halfword from 
memory, zero-extends it and writes it to a register. The memory access is atomic. The PE marks the physical address 
being accessed as an exclusive access. This exclusive access mark is checked by Store Exclusive instructions. See 
Synchronization and semaphores on page B2-156. The instruction also has memory ordering semantics as described 
in Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. For information about memory accesses see 
Load/Store addressing modes on page C1-177. 


[31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 = 5 4| 0 | 


io ifo oF 0 0 fof Pom Oma OK E E 


size Rt2 


No offset variant 
LDAXRH <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


// Tell the Exclusives monitors to record a sequence of one or more atomic 
// memory reads from virtual address range [address, address+dbytes-1]. 

// The Exclusives monitor will only be set if all the reads are from the 
// same dbytes-aligned physical address, to allow for the possibility of 
// an atomicity break if the translation is changed between reads. 
AArch64.SetExclusiveMonitors(address, 2); 


data 
X(t] 


Mem[address, 2, AccType_ORDEREDATOMIC] ; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.116 


C6-948 


LDCLRB, LDCLRAB, LDCLRALB, LDCLRLB 


Atomic bit clear on byte in memory atomically loads an 8-bit byte from memory, performs a bitwise AND with the 
complement of the value held in a register on it, and stores the result back to memory. The value initially loaded 
from memory is returned in the destination register. 


è If the destination register is not WZR, LDCLRAB and LDCLRALB load from memory with acquire semantics. 
7 LDCLRLB and LDCLRALB store to memory with release semantics. 
è LDCLRB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STCLRB, STCLRLB. See Alias conditions on page C6-949 for details of when 
each alias is preferred. 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[o oja 1 tfofo ofajRis] rs [ojoo 1joo] Rao | R | 


size opc 


LDCLRAB variant 

Applies when A == 1 && R == 
LDCLRAB <Ws>, <Wt>, [<Xn|SP>] 
LDCLRALB variant 
Applies when A == 1 && R == 


LDCLRALB <Ws>, <Wt>, [<Xn|SP>] 


LDCLRB variant 
Applies when A == 0 && R == 0. 


LDCLRB <Ws>, <Wt>, [<Xn|SP>] 


LDCLRLB variant 
Applies when A == 0 && R = 1. 


LDCLRLB <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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Alias conditions 





Alias is preferred when 


STCLRB, STCLRLB A == '0' && Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) value; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_BIC, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.117 


C6-950 


LDCLRH, LDCLRAH, LDCLRALH, LDCLRLH 


Atomic bit clear on halfword in memory atomically loads a 16-bit halfword from memory, performs a bitwise AND 
with the complement of the value held in a register on it, and stores the result back to memory. The value initially 
loaded from memory is returned in the destination register. 


è If the destination register is not WZR, LDCLRAH and LDCLRALH load from memory with acquire semantics. 
7 LDCLRLH and LDCLRALH store to memory with release semantics. 
è LDCLRH has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STCLRH, STCLRLH. See Alias conditions on page C6-951 for details of when 
each alias is preferred. 


ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 54| 0| 
[o fa 1 tfofo ofAjR{i] Rs jojo ojo of Rn | R | 
size opc 
LDCLRAH variant 


Applies when A == 1 && R == 
LDCLRAH <Ws>, <Wt>, [<Xn|SP>] 
LDCLRALH variant 
Applies when A == 1 && R == 


LDCLRALH <Ws>, <Wt>, [<Xn|SP>] 


LDCLRH variant 
Applies when A == 0 && R == 0. 


LDCLRH <Ws>, <Wt>, [<Xn|SP>] 


LDCLRLH variant 
Applies when A == 0 && R = 1. 


LDCLRLH <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Alias conditions 





Alias is preferred when 


STCLRH, STCLRLH A == '0' && Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) value; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_BIC, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.118 


C6-952 


LDCLR, LDCLRA, LDCLRAL, LDCLRL 


Atomic bit clear on word or doubleword in memory atomically loads a 32-bit word or 64-bit doubleword from 
memory, performs a bitwise AND with the complement of the value held in a register on it, and stores the result 
back to memory. The value initially loaded from memory is returned in the destination register. 


e If the destination register is not one of WZR or XZR, LDCLRA and LDCLRAL load from memory with acquire 
semantics. 

s LDCLRL and LDCLRAL store to memory with release semantics. 

` LDCLR has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STCLR, STCLRL. See Alias conditions on page C6-953 for details of when 
each alias is preferred. 


ARMV8.1 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


L x[i 1 tfofo ojajrji] Rs fofo o tfo of R | R | 


size opc 


32-bit LDCLR variant 

Applies when size == 10 && A == 0 && R = 0. 
LDCLR <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDCLRA variant 

Applies when size == 10 && A == 1 && R == 0. 
LDCLRA <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDCLRAL variant 

Applies when size == 10 && A == 1 & R = 1. 
LDCLRAL <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDCLRL variant 

Applies when size == 10 && A == 0 && R = 1. 
LDCLRL <Ws>, <Wt>, [<Xn|SP>] 

64-bit LDCLR variant 

Applies when size == 11 && A == 0 && R == 0. 
LDCLR <Xs>, <Xt>, [<Xn|SP>] 

64-bit LDCLRA variant 

Applies when size == 11 && A == 1 && R == 0. 


LDCLRA <Xs>, <Xt>, [<Xn|SP>] 
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64-bit LDCLRAL variant 
Applies when size == 11 && A == 1 && R = 1. 
LDCLRAL <Xs>, <Xt>, [<Xn|SP>] 
64-bit LDCLRL variant 
Applies when size == 11 && A == 0 && R = 1. 
LDCLRL <Xs>, <Xt>, [<Xn|SP>] 
Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer t = UInt(Rt); 


integer n = UInt(Rn); 
integer s = UInt(Rs); 


integer datasize = 8 << UInt(size); 

integer regsize = if datasize == 64 then 64 else 32; 

AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = 


n != 31; 
Alias conditions 
Alias is preferred when 


STCLR, STCLRL A == '0' && Rt == '11111' 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(datasize) value; 
bits(datasize) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_BIC, value, ldacctype, stacctype); 
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if t != 31 then 
X[t] = ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.119 LDEORB, LDEORAB, LDEORALB, LDEORLB 


ARM DDI 0487E.a 
ID070919 


Atomic exclusive OR on byte in memory atomically loads an 8-bit byte from memory, performs an exclusive OR 
with the value held in a register on it, and stores the result back to memory. The value initially loaded from memory 
is returned in the destination register. 


a If the destination register is not WZR, LDEORAB and LDEORALB load from memory with acquire semantics. 
7 LDEORLB and LDEORALB store to memory with release semantics. 
è LDEORB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STEORB, STEORLB. See Alias conditions on page C6-956 for details of when 
each alias is preferred. 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[o oja 1 tfofo ofajrji] rs jojo t ojo of Rao | R | 


size opc 


LDEORAB variant 

Applies when A == 1 && R == 
LDEORAB <Ws>, <Wt>, [<Xn|SP>] 
LDEORALB variant 

Applies when A == 1 && R == 
LDEORALB <Ws>, <Wt>, [<Xn|SP>] 
LDEORB variant 

Applies when A == 0 && R == 0. 


LDEORB <Ws>, <Wt>, [<Xn|SP>] 


LDEORLB variant 
Applies when A == 0 && R = 1. 


LDEORLB <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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C6-956 


Alias conditions 





Alias is preferred when 


STEORB, STEORLB A == '0' && Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) value; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_EOR, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.120 LDEORH, LDEORAH, LDEORALH, LDEORLH 


ARM DDI 0487E.a 
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Atomic exclusive OR on halfword in memory atomically loads a 16-bit halfword from memory, performs an 
exclusive OR with the value held in a register on it, and stores the result back to memory. The value initially loaded 
from memory is returned in the destination register. 


° If the destination register is not WZR, LDEORAH and LDEORALH load from memory with acquire semantics. 
7 LDEORLH and LDEORALH store to memory with release semantics. 
è LDEORH has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STEORH, STEORLH. See Alias conditions on page C6-958 for details of when 
each alias is preferred. 


ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 54| 0| 
[o fa 1 tfofo ofAjR{i] Rs jojo 1 ojo of Rn | R | 
size opc 
LDEORAH variant 


Applies when A == 1 && R == 
LDEORAH <Ws>, <Wt>, [<Xn|SP>] 
LDEORALH variant 
Applies when A == 1 && R == 


LDEORALH <Ws>, <Wt>, [<Xn|SP>] 


LDEORH variant 
Applies when A == 0 && R == 0. 


LDEORH <Ws>, <Wt>, [<Xn|SP>] 


LDEORLH variant 
Applies when A == 0 && R = 1. 


LDEORLH <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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C6-958 


Alias conditions 





Alias is preferred when 


STEORH, STEORLH_ A == '0' && Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) value; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_EOR, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.121 LDEOR, LDEORA, LDEORAL, LDEORL 


Atomic exclusive OR on word or doubleword in memory atomically loads a 32-bit word or 64-bit doubleword from 
memory, performs an exclusive OR with the value held in a register on it, and stores the result back to memory. The 
value initially loaded from memory is returned in the destination register. 


e If the destination register is not one of WZR or XZR, LDEORA and LDEORAL load from memory with acquire 
semantics. 

$ LDEORL and LDEORAL store to memory with release semantics. 

` LDEOR has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STEOR, STEORL. See Alias conditions on page C6-960 for details of when 
each alias is preferred. 


ARMV8.1 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


L x[i 1 tfofo ojajrfi] Rs fojo 1 ofo of R | R | 


size opc 


32-bit LDEOR variant 

Applies when size == 10 && A == 0 && R = 0. 
LDEOR <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDEORA variant 

Applies when size == 10 && A == 1 && R == 0. 
LDEORA <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDEORAL variant 

Applies when size == 10 && A == 1 & R = 1. 
LDEORAL <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDEORL variant 

Applies when size == 10 && A == 0 && R = 1. 
LDEORL <Ws>, <Wt>, [<Xn|SP>] 

64-bit LDEOR variant 

Applies when size == 11 && A == 0 && R == 0. 
LDEOR <Xs>, <Xt>, [<Xn|SP>] 

64-bit LDEORA variant 

Applies when size == 11 && A == 1 && R == 0. 


LDEORA <Xs>, <Xt>, [<Xn|SP>] 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-959 
ID070919 Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


64-bit LDEORAL variant 
Applies when size == 11 & A == 1 && R = 1. 
LDEORAL <Xs>, <Xt>, [<Xn|SP>] 
64-bit LDEORL variant 
Applies when size == 11 && A == 0 && R = 1. 
LDEORL <Xs>, <Xt>, [<Xn|SP>] 
Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer t = UInt(Rt); 


integer n = UInt(Rn); 
integer s = UInt(Rs); 


integer datasize = 8 << UInt(size); 

integer regsize = if datasize == 64 then 64 else 32; 

AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = 


n != 31; 
Alias conditions 
Alias is preferred when 


STEOR, STEORL A == '0' && Rt == '11111' 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(datasize) value; 
bits(datasize) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_EOR, value, ldacctype, stacctype); 
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if t != 31 then 
X[t] = ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.122 


C6-962 


LDG 


Load Allocation Tag loads an Allocation Tag from a memory address, generates a Logical Address Tag from the 
Allocation Tag and merges it into the destination register. The address used for the load is calculated from the base 
register and an immediate signed offset scaled by the Tag granule. 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| o| 


1101100 ajoji] immo fofof x» | x | 


Integer variant 


LDG <Xt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 
integer t = UInt(Xt); 


integer n = UInt(Xn); 
bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Xt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Xn" field. 
<simm> Is the optional signed immediate offset, a multiple of 16 in the range -4096 to 4080, defaulting to 0 


and encoded in the "imm9" field. 


Operation 


bits(64) address; 
bits(4) tag; 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 
address = Align(address, TAG_GRANULE) ; 


tag = AArch64.MemTag[address]; 
X[t] = AArch64.AddressWithAllocationTag(X[t], tag); 
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C6.2.123  LDGM 


ARM DDI 0487E.a 
ID070919 


Load Tag Multiple reads a naturally aligned block of N Allocation Tags, where the size of N is identified in 
GMID_EL1.BS, and writes the Allocation Tag read from address A to the destination register at 
4* A<7:4>+3:4*A<7:4>. Bits of the destination register not written with an Allocation Tag are set to 0. 


This instruction is UNDEFINED at ELO. 
This instruction generates an Unchecked access. 


This instruction is Unallocated when ID_AA64PFR1_EL1.MTE == 0b0001. 


ARMV8.5 


[31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


101100 aftfiftjofojofofofofofofojofo} xn | x | 


Integer variant 


LDGM <Xt>, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Xt); 
integer n = UInt(Xn); 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Xt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Xn" field. 
Operation 


if PSTATE.EL == ELO then 
UndefinedFault(); 


bits(64) data = Zeros(64); 
bits(64) address; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


integer size = 4 » (2 A (UInt(GMID_EL1.BS))); 

address = Align(address, size); 

integer count = size >> LOG2_TAG_GRANULE; 

integer index = UInt(address<LOG2_TAG_GRANULE+3 : LOG2_TAG_GRANULE>) ; 


for i = 0 to count-1 
bits(4) tag = AArch64.MemTag[address]; 
data<(indexs4)+3:indexs4> = tag; 
address = address + TAG_GRANULE; 
index = index + 1; 


X[t] = data; 
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C6.2.124 


C6-964 


LDLARB 


Load LOAcquire Register Byte loads a byte from memory, zero-extends it and writes it to a register. The instruction 
also has memory ordering semantics as described in LoadLOAcquire, StoreLORelease on page B2-130. For 
information about memory accesses, see Load/Store addressing modes on page C1-177. 


Note 


For this instruction, if the destination is WZR/ZXR, it is impossible for software to observe the presence of the 
acquire semantic other than its effect on the arrival at endpoints. 








ARMV8.1 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 = 10 9 5 4| 0 | 


o olo o 100 ofa fifo lnm cfo|ay MNA 7 as a 


size Rs 00 Rt2 


No offset variant 


LDLARB <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data 
X[t] 


Mem[address, 1, AccType_LIMITEDORDERED] ; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.125 LDLARH 


ARM DDI 0487E.a 
ID070919 


Load LOAcquire Register Halfword loads a halfword from memory, zero-extends it, and writes it to a register. The 
instruction also has memory ordering semantics as described in LoadLOAcquire, StoreLORelease on page B2-130. 
For information about memory accesses, see Load/Store addressing modes on page C1-177. 


Note 


For this instruction, if the destination is WZR/ZXR, it is impossible for software to observe the presence of the 
acquire semantic other than its effect on the arrival at endpoints. 








ARMV8.1 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 = 10 9 5 4| 0 | 


o slo o 100 ofa fifo fn aaa cola MNA 7 as a 


size Rs 00 Rt2 


No offset variant 


LDLARH <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data 
X[t] 


Mem[address, 2, AccType_LIMITEDORDERED] ; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.126 


C6-966 


LDLAR 


Load LOAcquire Register loads a 32-bit word or 64-bit doubleword from memory, and writes it to a register. The 
instruction also has memory ordering semantics as described in LoadLOAcquire, StoreLORelease on page B2-130. 
For information about memory accesses, see Load/Store addressing modes on page C1-177. 


Note 


For this instruction, if the destination is WZR/ZXR, it is impossible for software to observe the presence of the 
acquire semantic other than its effect on the arrival at endpoints. 








ARMV8.1 


|31 30 29 28|27 26 25 24|23 22 21 20) 16/15 14 = 10 9 5 4| 0 | 


tdo 0 49 0 ofa titolo maa ao| MNA ee a 


size Rs o0 Rt2 


32-bit variant 
Applies when size == 10. 


LDLAR <Wt>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when size == 11. 


LDLAR <Xt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n 
integer t 


UInt(Rn) ; 
UInt(Rt) ; 


integer elsize = 8 << UInt(size); 
integer regsize = if elsize == 64 then 64 else 32; 
boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(elsize) data; 
constant integer dbytes = elsize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 
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data 
X(t] 


Mem[address, dbytes, AccType_LIMITEDORDERED] ; 
ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.127 


C6-968 


LDNP 


Load Pair of Registers, with non-temporal hint, calculates an address from a base register value and an immediate 
offset, loads two 32-bit words or two 64-bit doublewords from memory, and writes them to two registers. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. For information about 
Non-temporal pair instructions, see Load/Store Non-temporal Pair on page C3-200. 


|31 30 29 28/27 26 25 24|23 22 21 | |1514 | 109 | 5 4| o| 


[x ojs o tfofo o oji] imm | R2? | Rm | R | 


1 
opc L 


32-bit variant 

Applies when opc == 00. 

LDNP <Wt1>, <Wt2>, [<Xn|SP>{, #<imm>}] 
64-bit variant 

Applies when opc == 10. 

LDNP <Xt1>, <Xt2>, [<Xn|SP>{, #<imm>}] 
Decode for all variants of this encoding 


// Empty. 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDNP on page K1-7637. 


Assembler symbols 


<Wtl> Is the 32-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Wt2> Is the 32-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xt1> Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Xt2> Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 

<imm> For the 32-bit variant: is the optional signed immediate byte offset, a multiple of 4 in the range -256 


to 252, defaulting to 0 and encoded in the "imm7" field as <imm>/4. 


For the 64-bit variant: is the optional signed immediate byte offset, a multiple of 8 in the range -512 
to 504, defaulting to 0 and encoded in the "imm7" field as <imm>/8. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer t2 = UInt(Rt2); 

if opc<@> == '1' then UNDEFINED; 
integer scale = 2 + UInt(opc<1>); 
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integer datasize = 8 << scale; 
bits(64) offset = LSL(SignExtend(imm7, 64), scale); 
boolean tag_checked = n != 31; 


Operation 


bits(64) address; 

bits(datasize) datal; 

bits(datasize) data2; 

constant integer dbytes = datasize DIV 8; 
boolean rt_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if t == t2 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; // result is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


datal = Mem[address, dbytes, AccType_STREAM] ; 
data2 = Mem[address+dbytes, dbytes, AccType_STREAM] ; 
if rt_unknown then 
datal = bits(datasize) UNKNOWN; 
data2 = bits(datasize) UNKNOWN; 
X[t] = datal; 
X[t2] = data2; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.128 


C6-970 


LDP 


Load Pair of Registers calculates an address from a base register value and an immediate offset, loads two 32-bit 
words or two 64-bit doublewords from memory, and writes them to two registers. For information about memory 


accesses, see Load/Store addressing modes on page C1-177. 


Post-index 


|31 30 29 28/27 26 25 24|23 2221 | 


|1514 


109 | 


5 4| 


o | 


[x o]1 o tfofo o aji] imm | R2? | Rmn | R | 


1 
opc L 


32-bit variant 

Applies when opc == 00. 

LDP <Wtl>, <Wt2>, [<Xn|SP>], #<imm> 

64-bit variant 

Applies when opc == 10. 

LDP <Xtl>, <Xt2>, [<Xn|SP>], #<imm> 
Decode for all variants of this encoding 


boolean whack = TRUE; 
boolean postindex = TRUE; 


Pre-index 


|31 30 29 28|27 26 25 24/23 22 21 | 


|1514 


109 | 


5 4| 


o| 


cop oop 7 t[i] mm? | Re | m | Rt 


1 
opc L 


32-bit variant 

Applies when opc == 00. 

LDP <Wtl>, <Wt2>, [<Xn|SP>, #<imm>]! 

64-bit variant 

Applies when opc == 10. 

LDP <Xtl>, <Xt2>, [<Xn|SP>, #<imm>]! 
Decode for all variants of this encoding 


boolean whack = TRUE; 
boolean postindex = FALSE; 


Signed offset 


|31 30 29 28|27 26 25 24/23 22 21 | 


|1514 


109 | 


54| 


o| 


[x ojs o tfofo 1 oji] imm | R2? | Rm | R | 


1 
opc L 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


32-bit variant 
Applies when opc == 00. 
LDP <Wtl>, <Wt2>, [<Xn|SP>{, #<imm>}] 
64-bit variant 
Applies when opc == 10. 
LDP <Xtl>, <Xt2>, [<Xn|SP>{, #<imm>}] 
Decode for all variants of this encoding 
boolean whack = FALSE; 
boolean postindex = FALSE; 
Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDP on page K1-7638. 


Assembler symbols 


<Wtl> Is the 32-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Wt2> Is the 32-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xt1> Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Xt2> Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 

<imm> For the 32-bit post-index and 32-bit pre-index variant: is the signed immediate byte offset, a 


multiple of 4 in the range -256 to 252, encoded in the "imm7" field as <imm>/4. 


For the 32-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 4 in 
the range -256 to 252, defaulting to 0 and encoded in the "imm/7" field as <imm>/4. 


For the 64-bit post-index and 64-bit pre-index variant: is the signed immediate byte offset, a 
multiple of 8 in the range -512 to 504, encoded in the "imm7" field as <imm>/8. 


For the 64-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 8 in 
the range -512 to 504, defaulting to 0 and encoded in the "imm/7" field as <imm>/8. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer t2 = UInt(Rt2); 

if L:opc<@> == '@1' || opc == '11' then UNDEFINED; 
boolean signed = (opc<@> != '0'); 

integer scale = 2 + UInt(opc<1>); 

integer datasize = 8 << scale; 

bits(64) offset = LSL(SignExtend(imm7, 64), scale); 
boolean tag_checked = whack || n != 31; 


Operation for all encodings 
bits(64) address; 


bits(datasize) datal; 
bits(datasize) data2; 
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constant integer dbytes = datasize DIV 8; 
boolean rt_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


boolean wb_unknown = FALSE; 


if whack && (t == n || t2 == n) & n != 31 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_WBSUPPRESS, Constraint UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_WBSUPPRESS wback = FALSE; // writeback is suppressed 
when Constraint_UNKNOWN wb_unknown = TRUE; // writeback is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if t == t2 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; // result is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


datal = Mem[address, dbytes, AccType_NORMAL]; 
data2 = Mem[address+dbytes, dbytes, AccType_NORMAL]; 
if rt_unknown then 

datal = bits(datasize) UNKNOWN; 

data2 = bits(datasize) UNKNOWN; 
if signed then 

X[t] = SignExtend(datal, 64); 

X[t2] = SignExtend(data2, 64); 
else 

X[t] = datal; 

X[t2] = data2; 


if whack then 
if wb_unknown then 
address = bits(64) UNKNOWN; 
elsif postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.129 LDPSW 
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Load Pair of Registers Signed Word calculates an address from a base register value and an immediate offset, loads 
two 32-bit words from memory, sign-extends them, and writes them to two registers. For information about memory 
accesses, see Load/Store addressing modes on page C1-177. 


Post-index 
|31 30 29 28|27 26 25 24|23 2221 | |15 14 | 109 | 5 4| 0 | 
[o if1 o tfofo o 1j] imm | R2 
opc L 


Post-index variant 


LDPSW <Xtl>, <Xt2>, [<Xn|SP>], #<imm> 


Decode for this encoding 


boolean wback = TRUE; 
boolean postindex = TRUE; 


Pre-index 
|31 30 29 28|27 26 25 24|23 2221 | |15 14 | 109 | 5 4| 0| 
fo [ro 7jofo + 11] mm? | Re 
opc L 


Pre-index variant 


LDPSW <Xt1>, <Xt2>, [<Xn|SP>, #<imm>]! 


Decode for this encoding 
boolean wback = TRUE; 
boolean postindex = FALSE; 


Signed offset 


[31 30 29 28|27 26 25 24|23 22 21 | |1514 | 109 | 5 4| 0| 


oip oojo 7 oli] mmr | Re | m | Rt 


1 
opc L 


Signed offset variant 


LDPSW <Xt1>, <Xt2>, [<Xn|SP>{, #<imm>}] 


Decode for this encoding 
boolean wback = FALSE; 
boolean postindex = FALSE; 

Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDPSW on page K1-7638. 
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Assembler symbols 


<Xtl> Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Xt2> Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 

<imm> For the post-index and pre-index variant: is the signed immediate byte offset, a multiple of 4 in the 


range -256 to 252, encoded in the "imm7" field as <imm>/4. 


For the signed offset variant: is the optional signed immediate byte offset, a multiple of 4 in the 
range -256 to 252, defaulting to 0 and encoded in the "imm7" field as <imm>/4. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer t2 = UInt(Rt2); 

bits(64) offset = LSL(SignExtend(imm7, 64), 2); 
boolean tag_checked = whack || n != 31; 


Operation for all encodings 


bits(64) address; 

bits(32) datal; 

bits(32) data2; 

boolean rt_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


boolean wb_unknown = FALSE; 


if whack && (t == n || t2 == n) && n != 31 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_WBSUPPRESS, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_WBSUPPRESS wback = FALSE; // writeback is suppressed 
when Constraint_UNKNOWN wb_unknown = TRUE; // writeback is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if t == t2 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; // result is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


datal = Mem[address, 4, AccType_NORMAL]; 
data2 = Mem[address+4, 4, AccType_NORMAL]; 
if rt_unknown then 

datal = bits(32) UNKNOWN; 

data2 = bits(32) UNKNOWN; 
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X[t] = SignExtend(datal, 64); 
X[t2] = SignExtend(data2, 64); 
if whack then 
if wb_unknown then 
address = bits(64) UNKNOWN; 
elsif postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] 


address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.130 


C6-976 


LDR (immediate) 


Load Register (immediate) loads a word or doubleword from memory and writes it to a register. The address that is 
used for the load is calculated from a base register and an immediate offset. For information about memory accesses, 
see Load/Store addressing modes on page C1-177. The Unsigned offset variant scales the immediate offset value 
by the size of the value accessed before adding it to the base register value. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12\1110 9 | 5 4| 0 | 
Ox oo oono] mo por) Ra f Re Cd 
size opc 


32-bit variant 
Applies when size == 10. 


LDR <Wt>, [<Xn|SP>], #<simm> 


64-bit variant 
Applies when size == 11. 


LDR <Xt>, [<Xn|SP>], #<simm> 


Decode for all variants of this encoding 


boolean whack = TRUE; 

boolean postindex = TRUE; 

integer scale = UInt(size); 

bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12\1110 9 | 5 4| 0 | 
Oooo] mo p ma | oe 
size opc 
32-bit variant 


Applies when size == 10. 


LDR <Wt>, [<Xn|SP>, #<simm>]! 


64-bit variant 
Applies when size == 11. 


LDR <Xt>, [<Xn|SP>, #<simm>]! 


Decode for all variants of this encoding 


boolean wback = TRUE; 

boolean postindex = FALSE; 

integer scale = UInt(size); 

bits(64) offset = SignExtend(imm9, 64); 
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Unsigned offset 


|31 30 29 2827 26 25 24|23 2221 | | | 109 | 5 4| 0 | 


xf 1 opon me | m | e | 


size opc 


32-bit variant 
Applies when size == 10. 


LDR <Wt>, [<Xn|SP>{, #<pimm>}] 


64-bit variant 
Applies when size == 11. 


LDR <Xt>, [<Xn|SP>{, #<pimm>}] 


Decode for all variants of this encoding 


boolean whack = FALSE; 

boolean postindex = FALSE; 

integer scale = UInt(size); 

bits(64) offset = LSL(ZeroExtend(imm12, 64), scale); 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDR (immediate) on page K1-7639. 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 

<pimm> For the 32-bit variant: is the optional positive immediate byte offset, a multiple of 4 in the range 0 


to 16380, defaulting to 0 and encoded in the "imm12" field as <pimm>/4. 


For the 64-bit variant: is the optional positive immediate byte offset, a multiple of 8 in the range 0 
to 32760, defaulting to 0 and encoded in the "imm12" field as <pimm>/8. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer regsize; 


regsize = if size == '11' then 64 else 32; 
integer datasize = 8 << scale; 
boolean tag_checked = whack || n != 31; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 


bits(datasize) data; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-977 
ID070919 Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


boolean wb_unknown = FALSE; 


if whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_WBSUPPRESS, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_WBSUPPRESS wback = FALSE; // writeback is suppressed 
when Constraint_UNKNOWN wb_unknown = TRUE; // writeback is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


data 
X(t] 


Mem[address, datasize DIV 8, AccType_NORMAL]; 
ZeroExtend(data, regsize); 


if whack then 
if wb_unknown then 
address = bits(64) UNKNOWN; 
elsif postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


C6-978 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.131 LDR (literal) 


Load Register (literal) calculates an address from the PC value and an immediate offset, loads a word from memory, 
and writes it to a register. For information about memory accesses, see Load/Store addressing modes on 
page C1-177. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| 0 | 


jo x[o 1 tfofo of immig | R | 


opc 


32-bit variant 
Applies when opc == 00. 


LDR <Wt>, <label> 


64-bit variant 
Applies when opc == 01. 


LDR <Xt>, <label> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
MemOp memop = MemOp_LOAD; 
boolean signed = FALSE; 
integer size; 

bits(64) offset; 


case opc of 

when 'QQ' 
size = 4; 

when 'Q1' 
size = 8; 

when '10' 
size = 4; 
signed = TRUE; 

when '11' 
memop = MemOp_PREFETCH; 


offset = SignExtend(imm19:'Q0', 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<label> Is the program label from which the data is to be loaded. Its offset from the address of this 


instruction, in the range +/-1MB, is encoded as "imm19" times 4. 


Operation 


bits(64) address = PC[] + offset; 
bits(sizex8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(TRUE) ; 


case memop of 
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when MemOp_LOAD 
data = Mem[address, size, AccType_NORMAL]; 
if signed then 
X[t] = SignExtend(data, 64); 
else 
X[t] = data; 


when MemOp_PREFETCH 
Prefetch(address, t<4:@>); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.132 LDR (register) 


Load Register (register) calculates an address from a base register value and an offset register value, loads a word 
from memory, and writes it to a register. The offset register value can optionally be shifted and extended. For 
information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/1109 | 5 4| 0 | 


[1 x[i 1 ajojo ofo aft] Rm | options} of Rn | R | 


size opc 


32-bit variant 
Applies when size == 10. 


LDR <Wt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


64-bit variant 
Applies when size == 11. 


LDR <Xt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


Decode for all variants of this encoding 


integer scale = UInt(size); 

if option<1> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = if S == '1' then scale else 0; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 

<Wm> When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 

<Xm> When option<®> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 

<extend> Is the index extend/shift specifier, defaulting to LSL, and which must be omitted for the LSL option 
when <amount> is omitted. encoded in the "option" field. It can have the following values: 
UXTW when option = 010 
LSL when option = 011 
SXTW when option = 110 
SXTX when option = 111 

<amount> For the 32-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 
is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 
#0 when S = 0 
#2 when S = 1 
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For the 64-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 
is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 


values: 
#0 when S = 0 
#3 when S = 1 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer m = UInt(Rm); 
integer regsize; 


regsize = if size == '11' then 64 else 32; 
integer datasize = 8 << scale; 


Operation 


bits(64) offset = ExtendReg(m, extend_type, shift); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(FALSE) ; 


bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


data 
X(t] 


Mem[address, datasize DIV 8, AccType_NORMAL]; 
ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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Load Register, with pointer authentication. This instruction authenticates an address from a base register using a 
modifier of zero and the specified key, adds an immediate offset to the authenticated address, and loads a 64-bit 


doubleword from memory at this resulting address into a register. 


Key A is used for LDRAA, and key B is used for LDRAB. 


If the authentication passes, the PE behaves the same as for an LDR instruction. If the authentication fails, a 


Translation fault is generated. 


The authenticated address is not written back to the base register, unless the pre-indexed variant of the instruction 
is used. In this case, the address that is written back to the base register does not include the pointer authentication 


code. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMVv8.3 


|31 30 29 28|27 26 25 24/23 22 21 20| | 


att opo oms] mma — W) m | Rt 


size 


Key A, offset variant 
Applies when M == 0 && W == 


LDRAA <Xt>, [<Xn|SP>{, #<simm>}] 


Key A, pre-indexed variant 
Applies when M == 0 && W == 


LDRAA <Xt>, [<Xn|SP>{, #<simm>}]! 


Key B, offset variant 

Applies when M == 1 && W == 
LDRAB <Xt>, [<Xn|SP>{, #<simm>}] 
Key B, pre-indexed variant 
Applies when M == 1 && W == 


LDRAB <Xt>, [<Xn|SP>{, #<simm>}]! 


Decode for all variants of this encoding 


if !HavePACExt() then UNDEFINED; 
integer t = UInt(Rt); 

integer n = UInt(Rn); 

boolean wback = (W = '1'); 
boolean use_key_a = (M == '0'); 
bits(10) S10 = S:imm9; 


bits(64) offset = LSL(SignExtend(S10, 64), 3); 
boolean tag_checked = wback || n != 31; 


Assembler symbols 


54| o| 


<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
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C6-984 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


<simm> Is the optional signed immediate byte offset, a multiple of 8 in the range -4096 to 4088, defaulting 


to 0 and encoded in the "S:imm9" field as <simm>/8. 


Operation 


bits(64) address; 
bits(64) data; 
boolean wb_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_WBSUPPRESS, Constraint UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_WBSUPPRESS wback = FALSE; // writeback is suppressed 
when Constraint_UNKNOWN wb_unknown = TRUE; // writeback is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
address = SP[]; 
else 
address = X[n]; 


if use_key_a then 

address = AuthDA(address, X[31]); 
else 

address = AuthDB(address, X[31]); 


if n == 31 then 
CheckSPAlignment(); 


address = address + offset; 
data = Mem[address, 8, AccType_NORMAL]; 
X[t] = data; 


if whack then 
if wb_unknown then 
address = bits(64) UNKNOWN; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.134 LDRB (immediate) 


ARM DDI 0487E.a 
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Load Register Byte (immediate) loads a byte from memory, zero-extends it, and writes the result to a register. The 
address that is used for the load is calculated from a base register and an immediate offset. For information about 
memory accesses, see Load/Store addressing modes on page C1-177. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
[o ofja 1 tfofo ofo afo] imma ft R | R | 
size opc 


Post-index variant 


LDRB <Wt>, [<Xn|SP>], #<simm> 


Decode for this encoding 


boolean wback = TRUE; 
boolean postindex = TRUE; 
bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 54| 0| 
[o ofa 1 1fojo ofo ajo] imma fii] Rmn | R | 
size opc 


Pre-index variant 


LDRB <Wt>, [<Xn|SP>, #<simm>]! 


Decode for this encoding 


boolean wback = TRUE; 
boolean postindex = FALSE; 
bits(64) offset = SignExtend(imm9, 64); 


Unsigned offset 


[31 30 29 28|27 26 25 24|23 22 21 | | | 109 | 5 4| 0 | 
[o ofja 1 tfofo ajoa] mm2 RT 
size opc 


Unsigned offset variant 


LDRB <Wt>, [<Xn|SP>{, #<pimm>}] 


Decode for this encoding 


boolean whack = FALSE; 
boolean postindex = FALSE; 
bits(64) offset = LSL(ZeroExtend(imm12, 64), 0); 
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Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDRB (immediate) on page K1-7639. 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 

<pimm> Is the optional positive immediate byte offset, in the range 0 to 4095, defaulting to 0 and encoded 


in the "imm12" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = whack || n != 31; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


boolean wb_unknown = FALSE; 


if whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_WBSUPPRESS, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_WBSUPPRESS wback = FALSE; // writeback is suppressed 
when Constraint_UNKNOWN wb_unknown = TRUE; // writeback is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


data 
X(t] 


Mem[address, 1, AccType_NORMAL]; 
ZeroExtend(data, 32); 


if whack then 
if wb_unknown then 
address = bits(64) UNKNOWN; 
elsif postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 


X[n] = address; 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.135 


C6-988 


LDRB (register) 


Load Register Byte (register) calculates an address from a base register value and an offset register value, loads a 
byte from memory, zero-extends it, and writes it to a register. For information about memory accesses, see 


Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 1615 1312/1110 9 


FOC) RT Ta 


size opc 


Extended register variant 
Applies when option != 011. 


LDRB <Wt>, [<Xn|SP>, (<Wm>|<Xm>), <extend> {<amount>}] 


Shifted register variant 
Applies when option == 011. 


LDRB <Wt>, [<Xn|SP>, <Xm>{, LSL <amount>}] 


Decode for all variants of this encoding 


if option<1> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Wm> When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<Xm> When option<®> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<extend> Is the index extend specifier, encoded in the "option" field. It can have the following values: 
UXTW when option = 010 
SXTW when option = 110 
SXTX when option = 111 
<amount> Is the index shift amount, it must be #0, encoded in "S" as @ if omitted, or as 1 if present. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer m = UInt(Rm); 


Operation 


bits(64) offset = ExtendReg(m, extend_type, 0); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(FALSE) ; 
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bits(64) address; 
bits(8) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


Mem[address, 1, AccType_NORMAL]; 
ZeroExtend(data, 32); 


data 
X[t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.136 LDRH (immediate) 


Load Register Halfword (immediate) loads a halfword from memory, zero-extends it, and writes the result to a 
register. The address that is used for the load is calculated from a base register and an immediate offset. For 
information about memory accesses, see Load/Store addressing modes on page C1-177. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
[o 1f1 1 t1fofo ofo 1fo] imma ft R | R | 
size opc 


Post-index variant 


LDRH <Wt>, [<Xn|SP>], #<simm> 


Decode for this encoding 


boolean whack = TRUE; 
boolean postindex = TRUE; 
bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 54| 0| 
fo [1 oo ofo to] mo po Ra ~~ R 
size opc 


Pre-index variant 


LDRH <Wt>, [<Xn|SP>, #<simm>]! 


Decode for this encoding 


boolean whack = TRUE; 
boolean postindex = FALSE; 
bits(64) offset = SignExtend(imm9, 64); 


Unsigned offset 


[31 30 29 28|27 26 25 24|23 22 21 | | | 109 | 5 4| 0 | 
fo fla 1 tfofo ajoa] mm2 RT 
size opc 


Unsigned offset variant 


LDRH <Wt>, [<Xn|SP>{, #<pimm>}] 


Decode for this encoding 


boolean whack = FALSE; 
boolean postindex = FALSE; 
bits(64) offset = LSL(ZeroExtend(imm12, 64), 1); 
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Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDRH (immediate) on page K1-7639. 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm09" field. 

<pimm> Is the optional positive immediate byte offset, a multiple of 2 in the range 0 to 8190, defaulting to 0 


and encoded in the "imm12" field as <pimm>/2. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = whack || n != 31; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


boolean wb_unknown = FALSE; 


if whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_WBSUPPRESS, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_WBSUPPRESS wback = FALSE; // writeback is suppressed 
when Constraint_UNKNOWN wb_unknown = TRUE; // writeback is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


data 
X(t] 


Mem[address, 2, AccType_NORMAL]; 
ZeroExtend(data, 32); 


if whack then 
if wb_unknown then 
address = bits(64) UNKNOWN; 
elsif postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 


X[n] = address; 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.137 | LDRH (register) 


Load Register Halfword (register) calculates an address from a base register value and an offset register value, loads 
a halfword from memory, zero-extends it, and writes it to a register. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/1109 | 5 4| 0 | 


fo afi 1 tJofo ofo aft] Rm | optionjsji of Rn | R | 


size opc 


32-bit variant 


LDRH <Wt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 

Decode for this encoding 

if option<1> == '@' then UNDEFINED; // sub-word index 

ExtendType extend_type = DecodeRegExtend(option) ; 

integer shift = if S == '1' then 1 else 0; 

Notes for all encodings 

For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Wm> When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<Xm> When option<0> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<extend> Is the index extend/shift specifier, defaulting to LSL, and which must be omitted for the LSL option 
when <amount> is omitted. encoded in the "option" field. It can have the following values: 
UXTW when option = 010 
LSL when option = 011 
SXTW when option = 110 
SXTX when option = 111 
<amount> Is the index shift amount, optional only when <extend> is not LSL. Where it is permitted to be 
optional, it defaults to #0. It is encoded in the "S" field. It can have the following values: 
#0 when S = 0 
#1 when S = 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer m = UInt(Rm); 
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C6-994 


Operation 


bits(64) offset = ExtendReg(m, extend_type, shift); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(FALSE) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


data 
X[t] 


Mem[address, 2, AccType_NORMAL]; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.138 LDRSB (immediate) 
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Load Register Signed Byte (immediate) loads a byte from memory, sign-extends it to either 32 bits or 64 bits, and 
writes the result to a register. The address that is used for the load is calculated from a base register and an immediate 
offset. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
[o oja 1 tfofo oji xlo] imma ft R | R | 
size opc 


32-bit variant 
Applies when opc == 11. 


LDRSB <Wt>, [<Xn|SP>], #<simm> 


64-bit variant 
Applies when opc == 10. 


LDRSB <Xt>, [<Xn|SP>], #<simm> 


Decode for all variants of this encoding 


boolean wback = TRUE; 
boolean postindex = TRUE; 
bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
fo ofja 1 tfofo ofi xfo] immo jii] Rmn | R | 
size opc 


32-bit variant 
Applies when opc == 11. 


LDRSB <Wt>, [<Xn|SP>, #<simm>]! 


64-bit variant 
Applies when opc == 10. 


LDRSB <Xt>, [<Xn|SP>, #<simm>]! 


Decode for all variants of this encoding 


boolean wback = TRUE; 
boolean postindex = FALSE; 
bits(64) offset = SignExtend(imm9, 64); 


Unsigned offset 


|31 30 29 28|27 26 25 24|23 2221 | | | 109 | 5 4| 0 | 
fo oft 4 tfojo sft x] me J] m | R | 
size opc 
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C6-996 


32-bit variant 

Applies when opc == 11. 

LDRSB <Wt>, [<Xn|SP>{, #<pimm>}] 

64-bit variant 

Applies when opc == 10. 

LDRSB <Xt>, [<Xn|SP>{, #<pimm>}] 

Decode for all variants of this encoding 
boolean whack = FALSE; 


boolean postindex = FALSE; 
bits(64) offset = LSL(ZeroExtend(imm12, 64), 0); 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDRSB (immediate) on page K1-7640. 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 

<pimm> Is the optional positive immediate byte offset, in the range 0 to 4095, defaulting to 0 and encoded 


in the "imm12" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
MemOp memop; 

boolean signed; 
integer regsize; 


if opc<1l> == '@' then 
// store or zero-extending load 
memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH && (wback || n != 31); 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 
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boolean wb_unknown 
boolean rt_unknown 


FALSE; 
FALSE; 


if memop == MemOp_LOAD && whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_WBSUPPRESS, Constraint UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_WBSUPPRESS wback = FALSE; // writeback is suppressed 
when Constraint_UNKNOWN wb_unknown = TRUE; // writeback is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if memop == MemOp_STORE && whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_NONE, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_NONE rt_unknown = FALSE; // value stored is original value 
when Constraint_UNKNOWN rt_unknown = TRUE; // value stored is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
if memop != MemOp_PREFETCH then CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


if !postindex then 
address = address + offset; 


case memop of 
when MemOp_STORE 
if rt_unknown then 
data = bits(8) UNKNOWN; 
else 
data = X[t]; 
Mem[address, 1, AccType_NORMAL] = data; 


when MemOp_LOAD 
data = Mem[address, 1, AccType_NORMAL]; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:@>); 


if whack then 
if wb_unknown then 
address = bits(64) UNKNOWN; 
elsif postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-997 
Non-Confidential 


A64 Base Instruction Descriptions 


C6.2 Alphabetical list of A64 base instructions 


C6.2.139 


C6-998 


LDRSB (register) 


Load Register Signed Byte (register) calculates an address from a base register value and an offset register value, 
loads a byte from memory, sign-extends it, and writes it to a register. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/1109 | 5 4| 0 | 


[o ofa 1 tJofo ofa xfi] Rm | option {s}1 of Rn | R | 


size 


opc 


32-bit with extended register offset variant 


Applies when opc == 11 && option != 011. 


LDRSB <Wt>, [<Xn|SP>, (<Wm>|<Xm>), <extend> {<amount>}] 


32-bit with shifted register offset variant 


Applies when opc == 11 && option == 011. 


LDRSB <Wt>, [<Xn|SP>, <Xm>{, LSL <amount>}] 


64-bit with extended register offset variant 


Applies when opc == 10 && option != 011. 


LDRSB <Xt>, [<Xn|SP>, (<Wm>|<Xm>), <extend> {<amount>}] 


64-bit with shifted register offset variant 


Applies when opc == 10 && option == 011. 


LDRSB <Xt>, [<Xn|SP>, <Xm>{, LSL <amount>}] 


Decode for all variants of this encoding 


if option<1> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 


Assembler symbols 


<Wt> 
<Xt> 
<Xn | SP> 


<Wm> 


<Xm> 


<extend> 


<amount> 


Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 


When option<0> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 

Is the index extend specifier, encoded in the "option" field. It can have the following values: 

UXTW when option = 010 

SXTW when option = 110 

SXTX when option = 111 


Is the index shift amount, it must be #0, encoded in "S" as @ if omitted, or as 1 if present. 
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Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer m = UInt(Rm); 
MemOp memop; 

boolean signed; 
integer regsize; 


if opc<l> == 'Q' then 
// store or zero-extending load 
memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH; 


Operation 


bits(64) offset = ExtendReg(m, extend_type, 0); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


if n == 31 then 
if memop != MemOp_PREFETCH then CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = X[t]; 
Mem[address, 1, AccType_NORMAL] = data; 


when MemOp_LOAD 
data = Mem[address, 1, AccType_NORMAL]; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:0>); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.140 LDRSH (immediate) 


Load Register Signed Halfword (immediate) loads a halfword from memory, sign-extends it to 32 bits or 64 bits, 
and writes the result to a register. The address that is used for the load is calculated from a base register and an 
immediate offset. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
[o 1f1 1 tfofo oji xlo] imma ft R | R | 
size opc 


32-bit variant 
Applies when opc == 11. 


LDRSH <Wt>, [<Xn|SP>], #<simm> 


64-bit variant 
Applies when opc == 10. 


LDRSH <Xt>, [<Xn|SP>], #<simm> 


Decode for all variants of this encoding 


boolean whack = TRUE; 
boolean postindex = TRUE; 
bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
[o fa 1 tfofo ofi xlo] immo tt tf Rmn | R | 
size opc 


32-bit variant 
Applies when opc = 11. 


LDRSH <Wt>, [<Xn|SP>, #<simm>]! 


64-bit variant 
Applies when opc == 10. 


LDRSH <Xt>, [<Xn|SP>, #<simm>]! 


Decode for all variants of this encoding 


boolean wback = TRUE; 
boolean postindex = FALSE; 
bits(64) offset = SignExtend(imm9, 64); 


Unsigned offset 


|31 30 29 28|27 26 25 24|23 2221 | | | 109 | 5 4| 0 | 
fot + tfojo tft x] me J] m | R | 
size opc 
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32-bit variant 
Applies when opc == 11. 


LDRSH <Wt>, [<Xn|SP>{, #<pimm>}] 


64-bit variant 
Applies when opc == 10. 


LDRSH <Xt>, [<Xn|SP>{, #<pimm>}] 


Decode for all variants of this encoding 
boolean whack = FALSE; 

boolean postindex = FALSE; 

bits(64) offset = LSL(ZeroExtend(imm12, 64), 1); 
Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDRSH (immediate) on 
page K1-7640. 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 

<pimm> Is the optional positive immediate byte offset, a multiple of 2 in the range 0 to 8190, defaulting to 0 


and encoded in the "imm12" field as <pimm>/2. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
MemOp memop; 

boolean signed; 
integer regsize; 


if opc<1l> == '@' then 
// store or zero-extending load 
memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH && (wback || n != 31); 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 
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boolean wb_unknown = FALSE; 
boolean rt_unknown = FALSE; 


if memop == MemOp_LOAD && whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_WBSUPPRESS, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_WBSUPPRESS wback = FALSE; // writeback is suppressed 
when Constraint_UNKNOWN wb_unknown = TRUE; // writeback is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if memop == MemOp_STORE && whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_NONE, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_NONE rt_unknown = FALSE; // value stored is original value 
when Constraint_UNKNOWN rt_unknown = TRUE; // value stored is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
if memop != MemOp_PREFETCH then CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


if !postindex then 
address = address + offset; 


case memop of 
when MemOp_STORE 
if rt_unknown then 
data = bits(16) UNKNOWN; 
else 
data = X[t]; 
Mem[address, 2, AccType_NORMAL] = data; 


when MemOp_LOAD 
data = Mem[address, 2, AccType_NORMAL]; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:@>); 


if whack then 
if wb_unknown then 
address = bits(64) UNKNOWN; 
elsif postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.141_ _LDRSH (register) 


Load Register Signed Halfword (register) calculates an address from a base register value and an offset register 
value, loads a halfword from memory, sign-extends it, and writes it to a register. For information about memory 
accesses see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/1109 | 5 4| 0 | 


[o afa 1 ajojo ofa xfa] Rm | option {s]1 of Rn | R | 


size opc 


32-bit variant 
Applies when opc == 11. 
LDRSH <Wt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 
64-bit variant 
Applies when opc == 10. 
LDRSH <Xt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 
Decode for all variants of this encoding 
if option<1> == '@' then UNDEFINED; // sub-word index 


ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = if S == '1' then 1 else 0; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 

<Wm> When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 

<Xm> When option<0> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 

<extend> Is the index extend/shift specifier, defaulting to LSL, and which must be omitted for the LSL option 
when <amount> is omitted. encoded in the "option" field. It can have the following values: 
UXTW when option = 010 
LSL when option = 011 
SXTW when option = 110 
SXTX when option = 111 

<amount> Is the index shift amount, optional only when <extend> is not LSL. Where it is permitted to be 
optional, it defaults to #0. It is encoded in the "S" field. It can have the following values: 
#0 when S = 0 
#1 when S = 1 
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Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer m = UInt(Rm); 
MemOp memop; 

boolean signed; 
integer regsize; 


if opc<l> == 'Q' then 
// store or zero-extending load 
memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH; 


Operation 


bits(64) offset = ExtendReg(m, extend_type, shift); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 
if memop != MemOp_PREFETCH then CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = X[t]; 
Mem[address, 2, AccType_NORMAL] = data; 


when MemOp_LOAD 
data = Mem[address, 2, AccType_NORMAL]; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:0>); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.142 LDRSW (immediate) 


ARM DDI 0487E.a 
ID070919 


Load Register Signed Word (immediate) loads a word from memory, sign-extends it to 64 bits, and writes the result 
to a register. The address that is used for the load is calculated from a base register and an immediate offset. For 
information about memory accesses, see Load/Store addressing modes on page C1-177. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
[1 ofja 1 tfofo ojs ofo] imma ft R | R | 
size opc 


Post-index variant 


LDRSW <Xt>, [<Xn|SP>], #<simm> 


Decode for this encoding 


boolean wback = TRUE; 
boolean postindex = TRUE; 
bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 54| 0| 
[1 of1 1 1fojo ofi ofo] imma fii] Rn | R | 
size opc 


Pre-index variant 


LDRSW <Xt>, [<Xn|SP>, #<simm>]! 


Decode for this encoding 


boolean wback = TRUE; 
boolean postindex = FALSE; 
bits(64) offset = SignExtend(imm9, 64); 


Unsigned offset 


[31 30 29 28|27 26 25 24|23 2221 | | | 109 | 5 4| 0 | 
[1 oļi 1 tfofo 1{1 of immt2— | Rm | R | 
size opc 


Unsigned offset variant 


LDRSW <Xt>, [<Xn|SP>{, #<pimm>}] 


Decode for this encoding 


boolean wback = FALSE; 
boolean postindex = FALSE; 
bits(64) offset = LSL(ZeroExtend(imm12, 64), 2); 
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C6-1006 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDRSW (immediate) on 


page 


K1-7640. 


Assembler symbols 


<Xt> 
<Xn|S 
<simm 


<pimm 


Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 


P> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 
> Is the optional positive immediate byte offset, a multiple of 4 in the range 0 to 16380, defaulting to 


0 and encoded in the "imm12" field as <pimm>/4. 


Shared decode for all encodings 


inte 
inte 


bool 


Ope 


if H 


bits 
bits 


bool 


if w 


ifn 


else 


if | 


data 
X[t] 
if w 


ger n = UInt(Rn); 
ger t = UInt(Rt); 


ean tag_checked = whack || n != 31; 


ration for all encodings 


aveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


(64) address; 
(32) data; 


ean wb_unknown = FALSE; 


back && n == t && n != 31 then 
c = ConstrainUnpredictable(); 


assert c IN {Constraint_WBSUPPRESS, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 


case c of 


when Constraint_WBSUPPRESS wback = FALSE; // writeback is suppressed 
when Constraint_UNKNOWN wb_unknown = TRUE; // writeback is UNKNOWN 


when Constraint_UNDEF UNDEFINED; 

when Constraint_NOP EndOfInstruction(); 
== 31 then 
CheckSPAlignment() ; 


address = SP[]; 
address = X[n]; 


postindex then 
address = address + offset; 


= Mem[address, 4, AccType_NORMAL]; 
= SignExtend(data, 64); 
back then 
if wb_unknown then 

address = bits(64) UNKNOWN; 
elsif postindex then 

address = address + offset; 
if n == 31 then 

SP[] = address; 
else 

X[n] = address; 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.143 LDRSW (literal) 


Load Register Signed Word (literal) calculates an address from the PC value and an immediate offset, loads a word 
from memory, and writes it to a register. For information about memory accesses, see Load/Store addressing modes 
on page C1-177. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| 0 | 


L ofo 1 tfofo of mmg S | R | 


opc 


Literal variant 


LDRSW <Xt>, <label> 


Decode for this encoding 


integer t = UInt(Rt); 
bits(64) offset; 


offset = SignExtend(imm19:'00', 64); 


Assembler symbols 

<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 

<label> Is the program label from which the data is to be loaded. Its offset from the address of this 
instruction, in the range +/-1MB, is encoded as "imm19" times 4. 

Operation 


bits(64) address = PC[] + offset; 
bits(32) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(TRUE) ; 


data = Mem[address, 4, AccType_NORMAL]; 
X[t] = SignExtend(data, 64); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.144 LDRSW (register) 


Load Register Signed Word (register) calculates an address from a base register value and an offset register value, 
loads a word from memory, sign-extends it to form a 64-bit value, and writes it to a register. The offset register value 
can be shifted left by 0 or 2 bits. For information about memory accesses, see Load/Store addressing modes on 
page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/1109 | 5 4| 0 | 


oft 1 ifofo oft on] Rm [oons o] Rn | Rt 


size opc 


64-bit variant 


LDRSW <Xt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


Decode for this encoding 


if option<l> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = if S == '1' then 2 else 0; 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Wm> When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<Xm> When option<0> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<extend> Is the index extend/shift specifier, defaulting to LSL, and which must be omitted for the LSL option 
when <amount> is omitted. encoded in the "option" field. It can have the following values: 
UXTW when option = 010 
LSL when option = 011 
SXTW when option = 110 
SXTX when option = 111 
<amount> Is the index shift amount, optional only when <extend> is not LSL. Where it is permitted to be 
optional, it defaults to #0. It is encoded in the "S" field. It can have the following values: 
#0 when S = 0 
#2 when S = 1 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer m = UInt(Rm); 


Operation 


bits(64) offset = ExtendReg(m, extend_type, shift); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(FALSE) ; 
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bits(64) address; 
bits(32) data; 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


Mem[address, 4, AccType_NORMAL]; 
SignExtend(data, 64); 


data 
X[t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.145 LDSETB, LDSETAB, LDSETALB, LDSETLB 


ARM DDI 0487E.a 
ID070919 


Atomic bit set on byte in memory atomically loads an 8-bit byte from memory, performs a bitwise OR with the value 
held in a register on it, and stores the result back to memory. The value initially loaded from memory is returned in 
the destination register. 


a If the destination register is not WZR, LDSETAB and LDSETALB load from memory with acquire semantics. 
7 LDSETLB and LDSETALB store to memory with release semantics. 
è LDSETB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STSETB, STSETLB. See Alias conditions on page C6-1012 for details of when 
each alias is preferred. 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[o oja 1 tfofo ofajRis] rs fojot joo] Rao | R | 


size opc 


LDSETAB variant 

Applies when A == 1 && R == 
LDSETAB <Ws>, <Wt>, [<Xn|SP>] 
LDSETALB variant 

Applies when A == 1 && R == 


LDSETALB <Ws>, <Wt>, [<Xn|SP>] 


LDSETB variant 
Applies when A == 0 && R == 0. 


LDSETB <Ws>, <Wt>, [<Xn|SP>] 


LDSETLB variant 
Applies when A == 0 && R = 1. 


LDSETLB <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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C6-1012 


Alias conditions 





Alias is preferred when 


STSETB, STSETLB A == '0' & Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) value; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_ORR, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.146 LDSETH, LDSETAH, LDSETALH, LDSETLH 


ARM DDI 0487E.a 
ID070919 


Atomic bit set on halfword in memory atomically loads a 16-bit halfword from memory, performs a bitwise OR with 
the value held in a register on it, and stores the result back to memory. The value initially loaded from memory is 
returned in the destination register. 


` If the destination register is not WZR, LDSETAH and LDSETALH load from memory with acquire semantics. 
7 LDSETLH and LDSETALH store to memory with release semantics. 
è LDSETH has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STSETH, STSETLH. See Alias conditions on page C6-1014 for details of when 
each alias is preferred. 


ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 54| 0| 
[o fa 1 tfofo ofAjR{i] Rs jojo 1 ijo of Rn | R | 
size opc 
LDSETAH variant 


Applies when A == 1 && R == 
LDSETAH <Ws>, <Wt>, [<Xn|SP>] 
LDSETALH variant 

Applies when A == 1 && R == 


LDSETALH <Ws>, <Wt>, [<Xn|SP>] 


LDSETH variant 
Applies when A == 0 && R == 0. 


LDSETH <Ws>, <Wt>, [<Xn|SP>] 


LDSETLH variant 
Applies when A == 0 && R = 1. 


LDSETLH <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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C6-1014 


Alias conditions 





Alias is preferred when 


STSETH, STSETLH A == '0' && Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) value; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_ORR, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.147 LDSET, LDSETA, LDSETAL, LDSETL 


Atomic bit set on word or doubleword in memory atomically loads a 32-bit word or 64-bit doubleword from 
memory, performs a bitwise OR with the value held in a register on it, and stores the result back to memory. The 
value initially loaded from memory is returned in the destination register. 


e If the destination register is not one of WZR or XZR, LDSETA and LDSETAL load from memory with acquire 
semantics. 

s LDSETL and LDSETAL store to memory with release semantics. 

` LDSET has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STSET, STSETL. See Alias conditions on page C6-1016 for details of when 
each alias is preferred. 


ARMV8.1 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


L x[i 1 tfofo ofajR{1] rs fojo 1 tfo of R | R | 


size opc 


32-bit LDSET variant 

Applies when size == 10 && A == 0 && R = 0. 
LDSET <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDSETA variant 

Applies when size == 10 && A == 1 && R == 0. 
LDSETA <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDSETAL variant 

Applies when size == 10 && A == 1 & R = 1. 
LDSETAL <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDSETL variant 

Applies when size == 10 && A == 0 && R = 1. 
LDSETL <Ws>, <Wt>, [<Xn|SP>] 

64-bit LDSET variant 

Applies when size == 11 && A == 0 && R == 0. 
LDSET <Xs>, <Xt>, [<Xn|SP>] 

64-bit LDSETA variant 

Applies when size == 11 && A == 1 & R == 0. 


LDSETA <Xs>, <Xt>, [<Xn|SP>] 
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64-bit LDSETAL variant 
Applies when size == 11 && A == 1 && R = 1. 
LDSETAL <Xs>, <Xt>, [<Xn|SP>] 
64-bit LDSETL variant 
Applies when size == 11 && A == 0 && R = 1. 
LDSETL <Xs>, <Xt>, [<Xn|SP>] 
Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer t = UInt(Rt); 


integer n = UInt(Rn); 
integer s = UInt(Rs); 


integer datasize = 8 << UInt(size); 

integer regsize = if datasize == 64 then 64 else 32; 

AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = 


n != 31; 
Alias conditions 
Alias is preferred when 
STSET, STSETL A == '0' && Rt == '11111' 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(datasize) value; 
bits(datasize) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_ORR, value, ldacctype, stacctype); 
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if t != 31 then 
X[t] = ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.148 


C6-1018 


LDSMAXB, LDSMAXAB, LDSMAXALB, LDSMAXLB 


Atomic signed maximum on byte in memory atomically loads an 8-bit byte from memory, compares it against the 
value held in a register, and stores the larger value back to memory, treating the values as signed numbers. The value 
initially loaded from memory is returned in the destination register. 


° If the destination register is not WZR, LDSMAXAB and LDSMAXALB load from memory with acquire semantics. 
7 LDSMAXLB and LDSMAXALB store to memory with release semantics. 
s LDSMAXB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STSMAXB, STSMAXLB. See Alias conditions on page C6-1019 for details of 
when each alias is preferred. 


ARMv8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[o oja 1 tfofo ofajrjij rs [oji o ofo of Rn | R | 


size opc 


LDSMAXAB variant 

Applies when A == 1 && R == 
LDSMAXAB <Ws>, <Wt>, [<Xn|SP>] 
LDSMAXALB variant 
Applies when A == 1 && R == 


LDSMAXALB <Ws>, <Wt>, [<Xn|SP>] 


LDSMAXB variant 
Applies when A == @ && R == 


LDSMAXB <Ws>, <Wt>, [<Xn|SP>] 


LDSMAXLB variant 
Applies when A == @ && R == 


LDSMAXLB <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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Alias conditions 





Alias is preferred when 


STSMAXB, STSMAXLB A == '0' && Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) value; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_SMAX, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-1019 
Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.149 


C6-1020 


LDSMAXH, LDSMAXAH, LDSMAXALH, LDSMAXLH 


Atomic signed maximum on halfword in memory atomically loads a 16-bit halfword from memory, compares it 
against the value held in a register, and stores the larger value back to memory, treating the values as signed 
numbers. The value initially loaded from memory is returned in the destination register. 


- If the destination register is not WZR, LDSMAXAH and LDSMAXALH load from memory with acquire semantics. 
$ LDSMAXLH and LDSMAXALH store to memory with release semantics. 
s LDSMAXH has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STSMAXH, STSMAXLH. See Alias conditions on page C6-1021 for details of 
when each alias is preferred. 


ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 54| 0| 
fo 1j1 1 tfofo ofAjR{i] Rs [oļi o ojoo] R | R | 
size opc 
LDSMAXAH variant 


Applies when A == 1 && R == 
LDSMAXAH <Ws>, <Wt>, [<Xn|SP>] 
LDSMAXALH variant 
Applies when A == 1 && R == 


LDSMAXALH <Ws>, <Wt>, [<Xn|SP>] 


LDSMAXH variant 
Applies when A == @ && R == 


LDSMAXH <Ws>, <Wt>, [<Xn|SP>] 


LDSMAXLH variant 
Applies when A == @ && R == 


LDSMAXLH <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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ARM DDI 0487E.a 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Alias conditions 





Alias is preferred when 


STSMAXH, STSMAXLH A= '0' && Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) value; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_SMAX, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.150 


C6-1022 


LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL 


Atomic signed maximum on word or doubleword in memory atomically loads a 32-bit word or 64-bit doubleword 
from memory, compares it against the value held in a register, and stores the larger value back to memory, treating 
the values as signed numbers. The value initially loaded from memory is returned in the destination register. 


e If the destination register is not one of WZR or XZR, LDSMAXA and LDSMAXAL load from memory with acquire 


semantics. 
$ LDSMAXL and LDSMAXAL store to memory with release semantics. 
` LDSMAX has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STSMAX, STSMAXL. See Alias conditions on page C6-1023 for details of 
when each alias is preferred. 


ARMV8.1 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


L x[i 1 tfofo ojajrji] Rs [oļi o ofo of R | R | 


size opc 


32-bit LDSMAX variant 

Applies when size == 10 & A == 0 && R = 0. 
LDSMAX <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDSMAXA variant 

Applies when size == 10 && A == 1 && R == 0. 
LDSMAXA <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDSMAXAL variant 

Applies when size == 10 && A == 1 & R = 1. 
LDSMAXAL <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDSMAXL variant 

Applies when size == 10 && A == 0 && R = 1. 
LDSMAXL <Ws>, <Wt>, [<Xn|SP>] 

64-bit LDSMAX variant 

Applies when size == 11 && A == 0 && R == 0. 
LDSMAX <Xs>, <Xt>, [<Xn|SP>] 

64-bit LDSMAXA variant 

Applies when size == 11 && A == 1 && R == 0. 


LDSMAXA <Xs>, <Xt>, [<Xn|SP>] 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


64-bit LDSMAXAL variant 
Applies when size == 11 && A == 1 && R = 1. 
LDSMAXAL <Xs>, <Xt>, [<Xn|SP>] 
64-bit LDSMAXL variant 
Applies when size == 11 && A == 0 && R = 1. 
LDSMAXL <Xs>, <Xt>, [<Xn|SP>] 
Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer t = UInt(Rt); 


integer n = UInt(Rn); 
integer s = UInt(Rs); 


integer datasize = 8 << UInt(size); 

integer regsize = if datasize == 64 then 64 else 32; 

AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 

boolean tag_checked = n != 31; 


Alias conditions 


Alias is preferred when 


STSMAX, STSMAXL A == '0' & Rt == '11111' 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(datasize) value; 
bits(datasize) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_SMAX, value, ldacctype, stacctype); 
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if t != 31 then 
X[t] = ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.151 LDSMINB, LDSMINAB, LDSMINALB, LDSMINLB 


ARM DDI 0487E.a 
ID070919 


Atomic signed minimum on byte in memory atomically loads an 8-bit byte from memory, compares it against the 
value held in a register, and stores the smaller value back to memory, treating the values as signed numbers. The 
value initially loaded from memory is returned in the destination register. 


° If the destination register is not WZR, LDSMINAB and LDSMINALB load from memory with acquire semantics. 
7 LDSMINLB and LDSMINALB store to memory with release semantics. 
s LDSMINB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STSMINB, STSMINLB. See Alias conditions on page C6-1026 for details of 
when each alias is preferred. 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[o oja 1 tfofo ofajrjij rs [oji o ajo of Rn | R | 


size opc 


LDSMINAB variant 

Applies when A == 1 && R == 
LDSMINAB <Ws>, <Wt>, [<Xn|SP>] 
LDSMINALB variant 
Applies when A == 1 && R == 


LDSMINALB <Ws>, <Wt>, [<Xn|SP>] 


LDSMINB variant 
Applies when A == @ && R == 


LDSMINB <Ws>, <Wt>, [<Xn|SP>] 


LDSMINLB variant 
Applies when A == @ && R == 


LDSMINLB <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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C6-1026 


Alias conditions 





Alias is preferred when 


STSMINB, STSMINLB A == '0' && Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) value; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_SMIN, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.152  LDSMINH, LDSMINAH, LDSMINALH, LDSMINLH 


ARM DDI 0487E.a 
ID070919 


Atomic signed minimum on halfword in memory atomically loads a 16-bit halfword from memory, compares it 
against the value held in a register, and stores the smaller value back to memory, treating the values as signed 
numbers. The value initially loaded from memory is returned in the destination register. 


° If the destination register is not WZR, LDSMINAH and LDSMINALH load from memory with acquire semantics. 
7 LDSMINLH and LDSMINALH store to memory with release semantics. 
s LDSMINH has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STSMINH, STSMINLH. See Alias conditions on page C6-1028 for details of 
when each alias is preferred. 


ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 54| 0| 
[o ijt 1 tfofo ofAjR{i] Rs [oļi o joo] R | R | 
size opc 
LDSMINAH variant 


Applies when A == 1 && R == 
LDSMINAH <Ws>, <Wt>, [<Xn|SP>] 
LDSMINALH variant 
Applies when A == 1 && R == 


LDSMINALH <Ws>, <Wt>, [<Xn|SP>] 


LDSMINH variant 
Applies when A == @ && R == 


LDSMINH <Ws>, <Wt>, [<Xn|SP>] 


LDSMINLH variant 
Applies when A == @ && R == 


LDSMINLH <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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C6-1028 


Alias conditions 





Alias is preferred when 


STSMINH, STSMINLH A == '0' && Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) value; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_SMIN, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.153 LDSMIN, LDSMINA, LDSMINAL, LDSMINL 


Atomic signed minimum on word or doubleword in memory atomically loads a 32-bit word or 64-bit doubleword 
from memory, compares it against the value held in a register, and stores the smaller value back to memory, treating 
the values as signed numbers. The value initially loaded from memory is returned in the destination register. 


e If the destination register is not one of WZR or XZR, LDSMINA and LDSMINAL load from memory with acquire 


semantics. 
$ LDSMINL and LDSMINAL store to memory with release semantics. 
` LDSMIN has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STSMIN, STSMINL. See Alias conditions on page C6-1030 for details of when 
each alias is preferred. 


ARMV8.1 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


L x[i 1 tfofo ofajR{t] rs fofi o tfo of R | R | 


size opc 


32-bit LDSMIN variant 

Applies when size == 10 && A == 0 && R = 0. 
LDSMIN <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDSMINA variant 

Applies when size == 10 && A == 1 && R == 0. 
LDSMINA <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDSMINAL variant 

Applies when size == 10 && A == 1 & R = 1. 
LDSMINAL <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDSMINL variant 

Applies when size == 10 && A == 0 && R = 1. 
LDSMINL <Ws>, <Wt>, [<Xn|SP>] 

64-bit LDSMIN variant 

Applies when size == 11 && A == 0 && R == 0. 
LDSMIN <Xs>, <Xt>, [<Xn|SP>] 

64-bit LDSMINA variant 

Applies when size == 11 && A == 1 && R == 0. 


LDSMINA <Xs>, <Xt>, [<Xn|SP>] 
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64-bit LDSMINAL variant 
Applies when size == 11 && A == 1 && R = 1. 
LDSMINAL <Xs>, <Xt>, [<Xn|SP>] 
64-bit LDSMINL variant 
Applies when size == 11 && A == 0 && R = 1. 
LDSMINL <Xs>, <Xt>, [<Xn|SP>] 
Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer t = UInt(Rt); 


integer n = UInt(Rn); 
integer s = UInt(Rs); 


integer datasize = 8 << UInt(size); 

integer regsize = if datasize == 64 then 64 else 32; 

AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = 


n != 31; 
Alias conditions 
Alias is preferred when 


STSMIN, STSMINL A == '0' && Rt == '11111' 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(datasize) value; 
bits(datasize) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_SMIN, value, ldacctype, stacctype); 
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if t != 31 then 
X[t] = ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.154 


C6-1032 


LDTR 


Load Register (unprivileged) loads a word or doubleword from memory, and writes it to a register. The address that 
is used for the load is calculated from a base register and an immediate offset. 


Memory accesses made by the instruction behave as if the instruction was executed at ELO if the Effective value on 
page Glossary-7886 of PSTATE.UAO is 0 and either: 


° The instruction is executed at EL1. 


s The instruction is executed at EL2 when the Effective value on page Glossary-7886 of HCR_EL2.{E2H, 
TGE} is {1, 1}. 


Otherwise, the memory access operates with the restrictions determined by the Exception level at which the 
instruction is executed. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| o| 
[i xla 1 tfofo ofo ifo] imma tt of Rmn | R | 
size opc 


32-bit variant 

Applies when size == 10. 

LDTR <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when size == 11. 

LDTR <Xt>, [<Xn|SP>{, #<simm>}] 

Decode for all variants of this encoding 


integer scale = UInt(size); 
bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


unpriv_at_ell = PSTATE.EL == EL1 && !(EL2Enabled() && HaveNVExt() && HCR_EL2.<NV,NV1> == '11'); 
unpriv_at_el2 = PSTATE.EL == EL2 && HaveVirtHostExt() && HCR_EL2.<E2H,TGE> == '11'; 


user_access_override = HaveUAOExt() && PSTATE.UAO == '1'; 

if !user_access_override && (unpriv_at_ell || unpriv_at_el2) then 
acctype = AccType_UNPRIV; 

else 
acctype = AccType_NORMAL ; 
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integer regsize; 


regsize = if size == '11' then 64 else 32; 
integer datasize = 8 << scale; 
boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


Mem[address, datasize DIV 8, acctype]; 
ZeroExtend(data, regsize); 


data 
X[t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.155 


C6-1034 


LDTRB 


Load Register Byte (unprivileged) loads a byte from memory, zero-extends it, and writes the result to a register. The 
address that is used for the load is calculated from a base register and an immediate offset. 


Memory accesses made by the instruction behave as if the instruction was executed at ELO if the Effective value on 
page Glossary-7886 of PSTATE.UAO is 0 and either: 


° The instruction is executed at EL1. 


s The instruction is executed at EL2 when the Effective value on page Glossary-7886 of HCR_EL2.{E2H, 
TGE} is {1, 1}. 


Otherwise, the memory access operates with the restrictions determined by the Exception level at which the 
instruction is executed. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| o| 
[o ofa 1 tfofo ofo ifo] imma tt of Rmn | R | 
size opc 


Unscaled offset variant 


LDTRB <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


unpriv_at_ell = PSTATE.EL == EL1 && !(EL2Enabled() && HaveNVExt() && HCR_EL2.<NV,NV1> == '11'); 
unpriv_at_el2 = PSTATE.EL == EL2 && HaveVirtHostExt() && HCR_EL2.<E2H,TGE> == '11'; 


user_access_override = HaveUAOExt() && PSTATE.UAO == '1'; 

if !user_access_override && (unpriv_at_ell || unpriv_at_el2) then 
acctype = AccType_UNPRIV; 

else 
acctype = AccType_NORMAL; 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 
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if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


Mem[address, 1, acctype]; 
ZeroExtend(data, 32); 


data 
X[t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.156 


C6-1036 


LDTRH 


Load Register Halfword (unprivileged) loads a halfword from memory, zero-extends it, and writes the result to a 
register. The address that is used for the load is calculated from a base register and an immediate offset. 


Memory accesses made by the instruction behave as if the instruction was executed at ELO if the Effective value on 
page Glossary-7886 of PSTATE.UAO is 0 and either: 


° The instruction is executed at EL1. 


s The instruction is executed at EL2 when the Effective value on page Glossary-7886 of HCR_EL2.{E2H, 
TGE} is {1, 1}. 


Otherwise, the memory access operates with the restrictions determined by the Exception level at which the 
instruction is executed. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| o| 
[o 1]1 1 tfofo ofo ifo] imma tt of Rm | R | 
size opc 


Unscaled offset variant 


LDTRH <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


unpriv_at_ell = PSTATE.EL == EL1 && !(EL2Enabled() && HaveNVExt() && HCR_EL2.<NV,NV1> == '11'); 
unpriv_at_el2 = PSTATE.EL == EL2 && HaveVirtHostExt() && HCR_EL2.<E2H,TGE> == '11'; 


user_access_override = HaveUAOExt() && PSTATE.UAO == '1'; 

if !user_access_override && (unpriv_at_ell || unpriv_at_el2) then 
acctype = AccType_UNPRIV; 

else 
acctype = AccType_NORMAL; 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 
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if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


Mem[address, 2, acctype]; 
ZeroExtend(data, 32); 


data 
X[t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-1037 
ID070919 Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.157 


C6-1038 


LDTRSB 


Load Register Signed Byte (unprivileged) loads a byte from memory, sign-extends it to 32 bits or 64 bits, and writes 
the result to a register. The address that is used for the load is calculated from a base register and an immediate offset. 


Memory accesses made by the instruction behave as if the instruction was executed at ELO if the Effective value on 
page Glossary-7886 of PSTATE.UAO is 0 and either: 


° The instruction is executed at EL1. 


s The instruction is executed at EL2 when the Effective value on page Glossary-7886 of HCR_EL2.{E2H, 
TGE} is {1, 1}. 


Otherwise, the memory access operates with the restrictions determined by the Exception level at which the 
instruction is executed. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| o| 
[o ofa 1 tfofo ofi x[o] imma jio) Rm | R | 
size opc 


32-bit variant 

Applies when opc == 11. 

LDTRSB <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when opc == 10. 

LDTRSB <Xt>, [<Xn|SP>{, #<simm>}] 

Decode for all variants of this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


unpriv_at_ell = PSTATE.EL == EL1 && !(EL2Enabled() && HaveNVExt() && HCR_EL2.<NV,NV1> == '11'); 
unpriv_at_el2 = PSTATE.EL == EL2 && HaveVirtHostExt() && HCR_EL2.<E2H,TGE> == '11'; 


user_access_override = HaveUAOExt() && PSTATE.UAO == '1'; 

if !user_access_override && (unpriv_at_ell || unpriv_at_el2) then 
acctype = AccType_UNPRIV; 

else 
acctype = AccType_NORMAL; 
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MemOp memop; 
boolean signed; 
integer regsize; 


if opc<1l> == '@' then 
// store or zero-extending load 
memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH && (n != 31); 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


if n == 31 then 
if memop != MemOp_PREFETCH then CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = X[t]; 
Mem[address, 1, acctype] = data; 


when MemOp_LOAD 
data = Mem[address, 1, acctype]; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:0>); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.158 


C6-1040 


LDTRSH 


Load Register Signed Halfword (unprivileged) loads a halfword from memory, sign-extends it to 32 bits or 64 bits, 
and writes the result to a register. The address that is used for the load is calculated from a base register and an 
immediate offset. 


Memory accesses made by the instruction behave as if the instruction was executed at ELO if the Effective value on 
page Glossary-7886 of PSTATE.UAO is 0 and either: 


. The instruction is executed at EL1. 


° The instruction is executed at EL2 when the Effective value on page Glossary-7886 of HCR_EL2.{E2H, 
TGE} is {1, 1}. 


Otherwise, the memory access operates with the restrictions determined by the Exception level at which the 
instruction is executed. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


oap 1 ifofo oft xfo] mma po) rn | Rt 


size opc 


32-bit variant 

Applies when opc == 11. 

LDTRSH <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when opc == 10. 

LDTRSH <Xt>, [<Xn|SP>{, #<simm>}] 

Decode for all variants of this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


unpriv_at_ell = PSTATE.EL == EL1 && !(EL2Enabled() && HaveNVExt() && HCR_EL2.<NV,NV1> == '11'); 
unpriv_at_el2 = PSTATE.EL == EL2 && HaveVirtHostExt() && HCR_EL2.<E2H,TGE> == '11'; 


user_access_override = HaveUAOExt() && PSTATE.UAO == '1'; 

if !user_access_override && (unpriv_at_ell || unpriv_at_el2) then 
acctype = AccType_UNPRIV; 

else 
acctype = AccType_NORMAL; 
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MemOp memop; 
boolean signed; 
integer regsize; 


if opc<l> == '@' then 
// store or zero-extending load 
memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH && (n != 31); 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 
if memop != MemOp_PREFETCH then CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = X[t]; 
Mem[address, 2, acctype] = data; 


when MemOp_LOAD 
data = Mem[address, 2, acctype]; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:0>); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.159 


C6-1042 


LDTRSW 


Load Register Signed Word (unprivileged) loads a word from memory, sign-extends it to 64 bits, and writes the 
result to a register. The address that is used for the load is calculated from a base register and an immediate offset. 


Memory accesses made by the instruction behave as if the instruction was executed at ELO if the Effective value on 
page Glossary-7886 of PSTATE.UAO is 0 and either: 


° The instruction is executed at EL1. 


s The instruction is executed at EL2 when the Effective value on page Glossary-7886 of HCR_EL2.{E2H, 
TGE} is {1, 1}. 


Otherwise, the memory access operates with the restrictions determined by the Exception level at which the 
instruction is executed. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| o| 
[1 ofa 1 tfofo ofi ofo] imma tt of Rm | R | 
size opc 


Unscaled offset variant 


LDTRSW <Xt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


unpriv_at_ell = PSTATE.EL == EL1 && !(EL2Enabled() && HaveNVExt() && HCR_EL2.<NV,NV1> == '11'); 
unpriv_at_el2 = PSTATE.EL == EL2 && HaveVirtHostExt() && HCR_EL2.<E2H,TGE> == '11'; 


user_access_override = HaveUAOExt() && PSTATE.UAO == '1'; 

if !user_access_override && (unpriv_at_ell || unpriv_at_el2) then 
acctype = AccType_UNPRIV; 

else 
acctype = AccType_NORMAL; 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(32) data; 
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if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


Mem[address, 4, acctype]; 
SignExtend(data, 64); 


data 
X[t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.160 


C6-1044 


LDUMAXB, LDUMAXAB, LDUMAXALB, LDUMAXLB 


Atomic unsigned maximum on byte in memory atomically loads an 8-bit byte from memory, compares it against 
the value held in a register, and stores the larger value back to memory, treating the values as unsigned numbers. 
The value initially loaded from memory is returned in the destination register. 


a If the destination register is not WZR, LDUMAXAB and LDUMAXALB load from memory with acquire semantics. 
7 LDUMAXLB and LDUMAXALB store to memory with release semantics. 
è LDUMAXB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STUMAXB, STUMAXLB. See Alias conditions on page C6-1045 for details 
of when each alias is preferred. 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[o oja 1 tfofo ofajrji] rs [oji 1 ofo of Rao | R | 


size opc 


LDUMAXAB variant 

Applies when A == 1 && R == 
LDUMAXAB <Ws>, <Wt>, [<Xn|SP>] 
LDUMAXALB variant 
Applies when A == 1 && R == 


LDUMAXALB <Ws>, <Wt>, [<Xn|SP>] 


LDUMAXB variant 
Applies when A == @ && R == 


LDUMAXB <Ws>, <Wt>, [<Xn|SP>] 


LDUMAXLB variant 
Applies when A == @ && R == 


LDUMAXLB <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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Alias conditions 





Alias is preferred when 


STUMAXB, STUMAXLB_ A == '0' & Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) value; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_UMAX, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.161 


C6-1046 


LDUMAXH, LDUMAXAH, LDUMAXALH, LDUMAXLH 


Atomic unsigned maximum on halfword in memory atomically loads a 16-bit halfword from memory, compares it 
against the value held in a register, and stores the larger value back to memory, treating the values as unsigned 
numbers. The value initially loaded from memory is returned in the destination register. 


a If the destination register is not WZR, LDUMAXAH and LDUMAXALH load from memory with acquire semantics. 
s LDUMAXLH and LDUMAXALH store to memory with release semantics. 
è LDUMAXH has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STUMAXH, STUMAXLH. See Alias conditions on page C6-1047 for details 
of when each alias is preferred. 


ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 54| 0| 
[o fa 1 tfofo ofAjR{i] Rs [oļi 1 ojo of R | R | 
size opc 
LDUMAXAH variant 


Applies when A == 1 && R == 
LDUMAXAH <Ws>, <Wt>, [<Xn|SP>] 
LDUMAXALH variant 
Applies when A == 1 && R == 


LDUMAXALH <Ws>, <Wt>, [<Xn|SP>] 


LDUMAXH variant 
Applies when A == @ && R == 


LDUMAXH <Ws>, <Wt>, [<Xn|SP>] 


LDUMAXLH variant 
Applies when A == @ && R == 


LDUMAXLH <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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Alias conditions 





Alias is preferred when 


STUMAXH, STUMAXLH A == '0' & Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) value; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_UMAX, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.162 


C6-1048 


LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL 


Atomic unsigned maximum on word or doubleword in memory atomically loads a 32-bit word or 64-bit doubleword 
from memory, compares it against the value held in a register, and stores the larger value back to memory, treating 
the values as unsigned numbers. The value initially loaded from memory is returned in the destination register. 


e If the destination register is not one of WZR or XZR, LDUMAXA and LDUMAXAL load from memory with acquire 


semantics. 
$ LDUMAXL and LDUMAXAL store to memory with release semantics. 
` LDUMAX has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STUMAX, STUMAXL. See Alias conditions on page C6-1049 for details of 
when each alias is preferred. 


ARMV8.1 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[1 x[i 1 tfofo ojajrji] rs foli 1 ofo of R | R | 


size opc 


32-bit LDUMAX variant 

Applies when size == 10 & A == 0 && R = 0. 
LDUMAX <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDUMAXA variant 

Applies when size == 10 && A == 1 & R == 0. 
LDUMAXA <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDUMAXAL variant 

Applies when size == 10 && A == 1 & R = 1. 
LDUMAXAL <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDUMAXL variant 

Applies when size == 10 && A == 0 && R = 1. 
LDUMAXL <Ws>, <Wt>, [<Xn|SP>] 

64-bit LDUMAX variant 

Applies when size == 11 && A == 0 && R == 0. 
LDUMAX <Xs>, <Xt>, [<Xn|SP>] 

64-bit LDUMAXA variant 

Applies when size == 11 && A == 1 && R == 0. 


LDUMAXA <Xs>, <Xt>, [<Xn|SP>] 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


64-bit LDUMAXAL variant 
Applies when size == 11 && A == 1 && R = 1. 
LDUMAXAL <Xs>, <Xt>, [<Xn|SP>] 
64-bit LDUMAXL variant 
Applies when size == 11 && A == 0 && R = 1. 
LDUMAXL <Xs>, <Xt>, [<Xn|SP>] 
Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer t = UInt(Rt); 


integer n = UInt(Rn); 
integer s = UInt(Rs); 


integer datasize = 8 << UInt(size); 

integer regsize = if datasize == 64 then 64 else 32; 

AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 

boolean tag_checked = n != 31; 


Alias conditions 


Alias is preferred when 


STUMAX, STUMAXL A= '0' && Rt == '11111' 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(datasize) value; 
bits(datasize) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_UMAX, value, ldacctype, stacctype); 
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if t != 31 then 
X[t] = ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.163 LDUMINB, LDUMINAB, LDUMINALB, LDUMINLB 


ARM DDI 0487E.a 
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Atomic unsigned minimum on byte in memory atomically loads an 8-bit byte from memory, compares it against the 
value held in a register, and stores the smaller value back to memory, treating the values as unsigned numbers. The 
value initially loaded from memory is returned in the destination register. 


° If the destination register is not WZR, LDUMINAB and LDUMINALB load from memory with acquire semantics. 
7 LDUMINLB and LDUMINALB store to memory with release semantics. 
s LDUMINB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STUMINB, STUMINLB. See Alias conditions on page C6-1052 for details of 
when each alias is preferred. 


ARMV8.1 


31 oo 20| sei. i 10 9 m 5 4| 0| 


size opc 


LDUMINAB variant 

Applies when A == 1 && R == 
LDUMINAB <Ws>, <Wt>, [<Xn|SP>] 
LDUMINALB variant 
Applies when A == 1 && R == 


LDUMINALB <Ws>, <Wt>, [<Xn|SP>] 


LDUMINB variant 
Applies when A == @ && R == 


LDUMINB <Ws>, <Wt>, [<Xn|SP>] 


LDUMINLB variant 
Applies when A == @ && R == 


LDUMINLB <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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C6.2 Alphabetical list of A64 base instructions 


C6-1052 


Alias conditions 





Alias is preferred when 


STUMINB, STUMINLB A == '@' & Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) value; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_UMIN, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.164 LDUMINH, LDUMINAH, LDUMINALH, LDUMINLH 


ARM DDI 0487E.a 
ID070919 


Atomic unsigned minimum on halfword in memory atomically loads a 16-bit halfword from memory, compares it 
against the value held in a register, and stores the smaller value back to memory, treating the values as unsigned 
numbers. The value initially loaded from memory is returned in the destination register. 


° If the destination register is not WZR, LDUMINAH and LDUMINALH load from memory with acquire semantics. 
7 LDUMINLH and LDUMINALH store to memory with release semantics. 
s LDUMINH has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STUMINH, STUMINLH. See Alias conditions on page C6-1054 for details of 
when each alias is preferred. 


ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 54| 0| 
[o fa 1 tfofo ofAjR{i] Rs [oļi 1 ifo of R | R | 
size opc 
LDUMINAH variant 


Applies when A == 1 && R == 
LDUMINAH <Ws>, <Wt>, [<Xn|SP>] 
LDUMINALH variant 
Applies when A == 1 && R == 


LDUMINALH <Ws>, <Wt>, [<Xn|SP>] 


LDUMINH variant 
Applies when A == @ && R == 


LDUMINH <Ws>, <Wt>, [<Xn|SP>] 


LDUMINLH variant 
Applies when A == @ && R == 


LDUMINLH <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6-1054 


Alias conditions 





Alias is preferred when 


STUMINH, STUMINLH A == '@' & Rt == '11111' 





Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) value; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_UMIN, value, ldacctype, stacctype); 


if t != 31 then 
X[t] = ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.165 LDUMIN, LDUMINA, LDUMINAL, LDUMINL 


Atomic unsigned minimum on word or doubleword in memory atomically loads a 32-bit word or 64-bit doubleword 
from memory, compares it against the value held in a register, and stores the smaller value back to memory, treating 
the values as unsigned numbers. The value initially loaded from memory is returned in the destination register. 


e If the destination register is not one of WZR or XZR, LDUMINA and LDUMINAL load from memory with acquire 


semantics. 
$ LDUMINL and LDUMINAL store to memory with release semantics. 
` LDUMIN has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is used by the alias STUMIN, STUMINL. See Alias conditions on page C6-1056 for details of when 
each alias is preferred. 


ARMV8.1 


pe Se E 20! ae tl 10 9 ES 5 4| 0 | 


size opc 


32-bit LDUMIN variant 

Applies when size == 10 && A == 0 && R == 0. 
LDUMIN <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDUMINA variant 

Applies when size == 10 && A == 1 && R == 0. 
LDUMINA <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDUMINAL variant 

Applies when size == 10 && A == 1 & R = 1. 
LDUMINAL <Ws>, <Wt>, [<Xn|SP>] 

32-bit LDUMINL variant 

Applies when size == 10 && A == 0 && R = 1. 
LDUMINL <Ws>, <Wt>, [<Xn|SP>] 

64-bit LDUMIN variant 

Applies when size == 11 && A == 0 && R == 0. 
LDUMIN <Xs>, <Xt>, [<Xn|SP>] 

64-bit LDUMINA variant 

Applies when size == 11 && A == 1 && R == 0. 


LDUMINA <Xs>, <Xt>, [<Xn|SP>] 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


64-bit LDUMINAL variant 
Applies when size == 11 && A == 1 && R = 1. 
LDUMINAL <Xs>, <Xt>, [<Xn|SP>] 
64-bit LDUMINL variant 
Applies when size == 11 && A == 0 && R = 1. 
LDUMINL <Xs>, <Xt>, [<Xn|SP>] 
Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 
integer t = UInt(Rt); 


integer n = UInt(Rn); 
integer s = UInt(Rs); 


integer datasize = 8 << UInt(size); 

integer regsize = if datasize == 64 then 64 else 32; 

AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = 


n != 31; 
Alias conditions 
Alias is preferred when 


STUMIN, STUMINL A == '0' && Rt == '11111' 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(datasize) value; 
bits(datasize) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


value = X[s]; 

if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 


data = MemAtomic(address, MemAtomicOp_UMIN, value, ldacctype, stacctype); 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


if t != 31 then 
X[t] = ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.166 LDUR 


Load Register (unscaled) calculates an address from a base register and an immediate offset, loads a 32-bit word or 
64-bit doubleword from memory, zero-extends it, and writes it to a register. For information about memory accesses, 
see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


[1 x[i 1 fofo ofo fo] imma fo of Rmh | R | 


size opc 


32-bit variant 

Applies when size == 10. 

LDUR <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when size == 11. 

LDUR <Xt>, [<Xn|SP>{, #<simm>}] 

Decode for all variants of this encoding 


integer scale = UInt(size); 
bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer regsize; 


regsize = if size == '11' then 64 else 32; 
integer datasize = 8 << scale; 
boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


address = X[n]; 
address = address + offset; 


Mem[address, datasize DIV 8, AccType_NORMAL]; 
ZeroExtend(data, regsize); 


data 
X(t] 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.167 LDURB 


Load Register Byte (unscaled) calculates an address from a base register and an immediate offset, loads a byte from 
memory, zero-extends it, and writes it to a register. For information about memory accesses, see Load/Store 
addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


fo ofa 1 1Jofo ofo fo] imma fo of Rh | R | 


size opc 


Unscaled offset variant 


LDURB <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


data 
X(t] 


Mem[address, 1, AccType_NORMAL]; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.168 LDURH 


Load Register Halfword (unscaled) calculates an address from a base register and an immediate offset, loads a 
halfword from memory, zero-extends it, and writes it to a register. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


fo afa 1 1Jofo ofo ifo] imma fo of Rn | R | 


size opc 


Unscaled offset variant 


LDURH <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


data 
X(t] 


Mem[address, 2, AccType_NORMAL]; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.169 


C6-1062 


LDURSB 


Load Register Signed Byte (unscaled) calculates an address from a base register and an immediate offset, loads a 
signed byte from memory, sign-extends it, and writes it to a register. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


fo ofa 1 tJofo ofa xfo] imma fo of Rmn | R | 


size opc 


32-bit variant 

Applies when opc == 11. 

LDURSB <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when opc == 10. 

LDURSB <Xt>, [<Xn|SP>{, #<simm>}] 

Decode for all variants of this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
MemOp memop; 

boolean signed; 
integer regsize; 


if opc<1> == '@' then 
// store or zero-extending load 
memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH && (n != 31); 
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Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


if n == 31 then 


if memop != MemOp_PREFETCH then CheckSPAlignment(); 


address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = X[t]; 
Mem[address, 1, AccType_NORMAL] = data; 


when MemOp_LOAD 
data = Mem[address, 1, AccType_NORMAL]; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:0>); 


Operational information 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.170 


C6-1064 


LDURSH 


Load Register Signed Halfword (unscaled) calculates an address from a base register and an immediate offset, loads 
a signed halfword from memory, sign-extends it, and writes it to a register. For information about memory accesses, 
see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


fo afa 1 tJofo ofi xlo] imma fo of Rn | R | 


size opc 


32-bit variant 

Applies when opc == 11. 

LDURSH <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when opc == 10. 

LDURSH <Xt>, [<Xn|SP>{, #<simm>}] 

Decode for all variants of this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
MemOp memop; 

boolean signed; 
integer regsize; 


if opc<1> == '@' then 
// store or zero-extending load 
memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
regsize = 32; 
signed = FALSE; 
else 
// sign-extending load 
memop = MemOp_LOAD; 
regsize = if opc<@> == '1' then 32 else 64; 
signed = TRUE; 


boolean tag_checked = memop != MemOp_PREFETCH && (n != 31); 
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Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 


if memop != MemOp_PREFETCH then CheckSPAlignment(); 


address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = X[t]; 
Mem[address, 2, AccType_NORMAL] = data; 


when MemOp_LOAD 
data = Mem[address, 2, AccType_NORMAL]; 
if signed then 
X[t] = SignExtend(data, regsize); 
else 
X[t] = ZeroExtend(data, regsize); 


when MemOp_PREFETCH 
Prefetch(address, t<4:0>); 


Operational information 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.171 LDURSW 


Load Register Signed Word (unscaled) calculates an address from a base register and an immediate offset, loads a 
signed word from memory, sign-extends it, and writes it to a register. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


[1 ofa 1 tJofo ofa ofo] imma fo of Rmn | R | 


size opc 


Unscaled offset variant 


LDURSW <Xt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(32) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


data 
X(t] 


Mem[address, 4, AccType_NORMAL]; 
SignExtend(data, 64); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2 Alphabetical list of A64 base instructions 


C6.2.172 LDXP 


Load Exclusive Pair of Registers derives an address from a base register value, loads two 32-bit words or two 64-bit 
doublewords from memory, and writes them to two registers. A 32-bit pair requires the address to be doubleword 
aligned and is single-copy atomic at doubleword granularity. A 64-bit pair requires the address to be quadword 
aligned and is single-copy atomic for each doubleword at doubleword granularity. The PE marks the physical 
address being accessed as an exclusive access. This exclusive access mark is checked by Store Exclusive 
instructions. See Synchronization and semaphores on page B2-156. For information about memory accesses see 
Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 
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32-bit variant 
Applies when sz == 


LDXP <Wtl>, <Wt2>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when sz == 


LDXP <Xtl>, <Xt2>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer t2 = UInt(Rt2); 


integer elsize = 32 << UInt(sz); 

integer datasize = elsize « 2; 

boolean tag_checked = n != 31; 

Notes for all encodings 

For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDXP on page K1-7640. 


Assembler symbols 


<Wtl> Is the 32-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Wt2> Is the 32-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xt1> Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Xt2> Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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C6-1068 


Operation 


bits(64) address; 

bits(datasize) data; 

constant integer dbytes = datasize DIV 8; 
boolean rt_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if t == t2 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; // result is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


// Tell the Exclusives monitors to record a sequence of one or more atomic 
// memory reads from virtual address range [address, address+dbytes-1]. 

// The Exclusives monitor will only be set if all the reads are from the 
// same dbytes-aligned physical address, to allow for the possibility of 
// an atomicity break if the translation is changed between reads. 
AArch64.SetExclusiveMonitors(address, dbytes); 


if rt_unknown then 
// ConstrainedUNPREDICTABLE case 
X[t] = bits(datasize) UNKNOWN; // In this case t = t2 
elsif elsize == 32 then 
// 32-bit load exclusive pair (atomic) 
data = Mem[address, dbytes, AccType_ATOMIC]; 
if BigEndian() then 
X[t] = data<datasize-1l:elsize>; 
X[t2] = data<elsize-1:0>; 
else 
X[t] = data<elsize-1:0>; 
X[t2] = data<datasize-1l:elsize>; 
else // elsize == 64 
// 64-bit load exclusive pair (not atomic), 
// but must be 128-bit aligned 
if address != Align(address, dbytes) then 


AArch64.Abort(address, AArch64.AlignmentFault(AccType_ATOMIC, FALSE, FALSE)); 


X[t] = Mem[address, 8, AccType_ATOMIC]; 
X[t2] = Mem[address+8, 8, AccType_ATOMIC]; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.173 LDXR 
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Load Exclusive Register derives an address from a base register value, loads a 32-bit word or a 64-bit doubleword 
from memory, and writes it to a register. The memory access is atomic. The PE marks the physical address being 
accessed as an exclusive access. This exclusive access mark is checked by Store Exclusive instructions. See 
Synchronization and semaphores on page B2-156. For information about memory accesses see Load/Store 
addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 l- 10 9 5 4| 0 | 


mde 0 40 0 ofa} fo @@mafolay OK o e 


size Rt2 


32-bit variant 
Applies when size == 10. 


LDXR <Wt>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when size == 11. 


LDXR <Xt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n 
integer t 


UInt(Rn) ; 
UInt (Rt) ; 


integer elsize = 8 << UInt(size); 
integer regsize = if elsize == 64 then 64 else 32; 
boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(elsize) data; 
constant integer dbytes = elsize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


// Tell the Exclusives monitors to record a sequence of one or more atomic 
// memory reads from virtual address range [address, address+dbytes-1]. 
// The Exclusives monitor will only be set if all the reads are from the 
// same dbytes-aligned physical address, to allow for the possibility of 
// an atomicity break if the translation is changed between reads. 
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AArch64.SetExclusiveMonitors(address, dbytes); 


data 
X[t] 


Mem[address, dbytes, AccType_ATOMIC]; 
ZeroExtend(data, regsize); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.174 LDXRB 
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Load Exclusive Register Byte derives an address from a base register value, loads a byte from memory, zero-extends 
it and writes it to a register. The memory access is atomic. The PE marks the physical address being accessed as an 
exclusive access. This exclusive access mark is checked by Store Exclusive instructions. See Synchronization and 
semaphores on page B2-156. For information about memory accesses see Load/Store addressing modes on 

page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20) 16/15 14 l- 10 9 5 4| 0 | 


Lole o 19 0 ofo fo HM a mcfolay OK C 


size Rt2 


No offset variant 


LDXRB <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


// Tell the Exclusives monitors to record a sequence of one or more atomic 
// memory reads from virtual address range [address, address+dbytes-1]. 

// The Exclusives monitor will only be set if all the reads are from the 
// same dbytes-aligned physical address, to allow for the possibility of 
// an atomicity break if the translation is changed between reads. 
AArch64.SetExclusiveMonitors(address, 1); 


data 
X(t] 


Mem[address, 1, AccType_ATOMIC]; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.175 


C6-1072 


LDXRH 


Load Exclusive Register Halfword derives an address from a base register value, loads a halfword from memory, 
zero-extends it and writes it to a register. The memory access is atomic. The PE marks the physical address being 
accessed as an exclusive access. This exclusive access mark is checked by Store Exclusive instructions. See 
Synchronization and semaphores on page B2-156. For information about memory accesses see Load/Store 
addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 l- 10 9 5 4| 0 | 


esl 0 40 0 ojjan OK o e 


size Rt2 


No offset variant 


LDXRH <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


// Tell the Exclusives monitors to record a sequence of one or more atomic 
// memory reads from virtual address range [address, address+dbytes-1]. 

// The Exclusives monitor will only be set if all the reads are from the 
// same dbytes-aligned physical address, to allow for the possibility of 
// an atomicity break if the translation is changed between reads. 
AArch64.SetExclusiveMonitors(address, 2); 


data 
X(t] 


Mem[address, 2, AccType_ATOMIC]; 
ZeroExtend(data, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.176 LSL (register) 
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Logical Shift Left (register) shifts a register value left by a variable number of bits, shifting in zeros, and writes the 
result to the destination register. The remainder obtained by dividing the second source register by the data size 
defines the number of bits by which the first source register is left-shifted. 


This instruction is an alias of the LSLV instruction. This means that: 
s The encodings in this description are named to match the encodings of LSLV. 


° The description of LSLV gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20 16|15 14 13 121110 9. | 5 4| 0| 


sffofojt 10 10110| Rm foot ojo of] R | Ra | 


op2 


32-bit variant 
Applies when sf == 
LSL <Wd>, <Wn>, <Wm> 
is equivalent to 

LSLV <Wd>, <Wn>, <Wm> 


and is always the preferred disassembly. 


64-bit variant 
Applies when sf == 
LSL <Xd>, <Xn>, <Xm> 
is equivalent to 

LSLV <Xd>, <Xn>, <Xm> 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding a shift amount from 0 to 


31 in its bottom 5 bits, encoded in the "Rm" field. 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding a shift amount from 0 to 


63 in its bottom 6 bits, encoded in the "Rm" field. 


Operation 


The description of LSLV gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.177 LSL (immediate) 


Logical Shift Left (immediate) shifts a register value left by an immediate number of bits, shifting in zeros, and 
writes the result to the destination register. 


This instruction is an alias of the UBFM instruction. This means that: 
g The encodings in this description are named to match the encodings of UBFM. 


s The description of UBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


FET T E 


opc 


32-bit variant 

Applies when sf == 0 && N == 0 && imms != 011111. 
LSL <Wd>, <Wn>, #<shift> 

is equivalent to 

UBFM <Wd>, <Wn>, #(-<shift> MOD 32), #(31-<shift>) 


and is the preferred disassembly when imms + 1 == immr. 


64-bit variant 

Applies when sf == 1 && N == 1 && imms != 111111. 
LSL <Xd>, <Xn>, #<shift> 

is equivalent to 

UBFM <Xd>, <Xn>, #(-<shift> MOD 64), #(63-<shift>) 


and is the preferred disassembly when imms + 1 == immr. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<shi ft> For the 32-bit variant: is the shift amount, in the range 0 to 31. 


For the 64-bit variant: is the shift amount, in the range 0 to 63. 


Operation 


The description of UBFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.178 LSLV 
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Logical Shift Left Variable shifts a register value left by a variable number of bits, shifting in zeros, and writes the 
result to the destination register. The remainder obtained by dividing the second source register by the data size 
defines the number of bits by which the first source register is left-shifted. 


This instruction is used by the alias LSL (register). The alias is always the preferred disassembly. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12/11 10 9 = 5 4| 0| 
lsffofo[1 10707170] Rm joo 1 ojoo] Rn | Ra | 
op2 
32-bit variant 


Applies when sf == 


LSLV <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 


LSLV <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
ShiftType shift_type = DecodeShift(op2); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding a shift amount from 0 to 


31 in its bottom 5 bits, encoded in the "Rm" field. 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding a shift amount from 0 to 


63 in its bottom 6 bits, encoded in the "Rm" field. 


Operation 


bits(datasize) result; 
bits(datasize) operand2 = X[m]; 


result = ShiftReg(n, shift_type, UInt(operand2) MOD datasize); 
X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.179 LSR (register) 
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Logical Shift Right (register) shifts a register value right by a variable number of bits, shifting in zeros, and writes 
the result to the destination register. The remainder obtained by dividing the second source register by the data size 
defines the number of bits by which the first source register is right-shifted. 


This instruction is an alias of the LSRV instruction. This means that: 
s The encodings in this description are named to match the encodings of LSRV. 


s The description of LSRV gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24/23 22 21 20 16/15 14 13 1211110 9. | 5 4| 0| 


sffofojt 10 10110| Rm |oo10ļ01| R | Ra | 


op2 


32-bit variant 
Applies when sf == 
LSR <Wd>, <Wn>, <Wm> 
is equivalent to 

LSRV <Wd>, <Wn>, <Wm> 


and is always the preferred disassembly. 


64-bit variant 
Applies when sf == 
LSR <Xd>, <Xn>, <Xm> 
is equivalent to 

LSRV <Xd>, <Xn>, <Xm> 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding a shift amount from 0 to 


31 in its bottom 5 bits, encoded in the "Rm" field. 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding a shift amount from 0 to 


63 in its bottom 6 bits, encoded in the "Rm" field. 


Operation 


The description of LSRV gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


C6-1080 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.180 LSR (immediate) 
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Logical Shift Right (immediate) shifts a register value right by an immediate number of bits, shifting in zeros, and 
writes the result to the destination register. 


This instruction is an alias of the UBFM instruction. This means that: 
g The encodings in this description are named to match the encodings of UBFM. 


s The description of UBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


EET E E E 


opc imms 


32-bit variant 

Applies when sf == 0 && N == 0 && imms == 011111. 
LSR <Wd>, <Wn>, #<shift> 

is equivalent to 

UBFM <Wd>, <Wn>, #<shift>, #31 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1 && N == 1 && imms == 111111. 
LSR <Xd>, <Xn>, #<shift> 

is equivalent to 

UBFM <Xd>, <Xn>, #<shift>, #63 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<shift> For the 32-bit variant: is the shift amount, in the range 0 to 31, encoded in the "immr" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, encoded in the "immr" field. 


Operation 


The description of UBFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.181 LSRV 


ARM DDI 0487E.a 
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Logical Shift Right Variable shifts a register value right by a variable number of bits, shifting in zeros, and writes 
the result to the destination register. The remainder obtained by dividing the second source register by the data size 
defines the number of bits by which the first source register is right-shifted. 


This instruction is used by the alias LSR (register). The alias is always the preferred disassembly. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|/11 10 9 = 5 4| 0| 
lsflofo[1 10707170] Rm  joorojot{ Rn | Ra | 
op2 
32-bit variant 


Applies when sf == 


LSRV <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 


LSRV <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
ShiftType shift_type = DecodeShift(op2); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding a shift amount from 0 to 


31 in its bottom 5 bits, encoded in the "Rm" field. 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding a shift amount from 0 to 


63 in its bottom 6 bits, encoded in the "Rm" field. 


Operation 


bits(datasize) result; 
bits(datasize) operand2 = X[m]; 


result = ShiftReg(n, shift_type, UInt(operand2) MOD datasize); 
X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.182 MADD 


Multiply-Add multiplies two register values, adds a third register value, and writes the result to the destination 
register. 


This instruction is used by the alias MUL. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 


seo or veo] eae] me | | 


32-bit variant 
Applies when sf == 


MADD <Wd>, <Wn>, <Wm>, <Wa> 


64-bit variant 
Applies when sf == 


MADD <Xd>, <Xn>, <Xm>, <Xa> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer a = UInt(Ra); 
integer destsize = if sf == '1' then 64 else 32; 


Alias conditions 


Alias is preferred when 


MUL Ra == '11111' 


Assembler symbols 





<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 

<Wa> Is the 32-bit name of the third general-purpose source register holding the addend, encoded in the 
"Ra" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 
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<Xa> Is the 64-bit name of the third general-purpose source register holding the addend, encoded in the 
"Ra" field. 


Operation 

bits(destsize) operandl = X[n]; 
bits(destsize) operand2 = X[m]; 
bits(destsize) operand3 = X[a]; 
integer result; 


result = UInt(operand3) + (UInt(operand1) » UInt(operand2)); 


X[d] = result<destsize-1:0>; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C6.2.183 MNEG 


ARM DDI 0487E.a 
ID070919 


Multiply-Negate multiplies two register values, negates the product, and writes the result to the destination register. 


This instruction is an alias of the MSUB instruction. This means that: 


: The encodings in this description are named to match the encodings of MSUB. 
° The description of MSUB gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 | 109 5 4| 0 | 
sloop e100) Life tt] | 
Ra 
32-bit variant 


Applies when sf == 

MNEG <Wd>, <Wn>, <Wm> 

is equivalent to 

MSUB <Wd>, <Wn>, <Wm>, WZR 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 

MNEG <Xd>, <Xn>, <Xm> 

is equivalent to 

MSUB <Xd>, <Xn>, <Xm>, XZR 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 

Operation 


The description of MSUB gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.184 MOV (to/from SP) 
Move between register and stack pointer : Rd = Rn 
This instruction is an alias of the ADD (immediate) instruction. This means that: 
: The encodings in this description are named to match the encodings of ADD (immediate). 


è The description of ADD (immediate) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 2221 | | | 109 | 5 4| 0 | 


lojo oo 07 ojojo oo0o0o0o000000] Rn | Ro | 


op S sh imm12 


32-bit variant 

Applies when sf == 0. 

MOV <Wd|WSP>, <Wn|WSP> 

is equivalent to 

ADD <Wd|WSP>, <Wn|WSP>, #0 


and is the preferred disassembly when (Rd == '11111' || Rn == '11111'). 


64-bit variant 

Applies when sf == 1. 
MOV <Xd|SP>, <Xn|SP> 

is equivalent to 

ADD <Xd|SP>, <Xn|SP>, #0 


and is the preferred disassembly when (Rd == '11111' || Rn == '11111'). 


Assembler symbols 





<Wd | WSP> Is the 32-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Wn | WSP> Is the 32-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 

<Xd | SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Xn | SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 

Operation 


The description of ADD (immediate) gives the operational pseudocode for this instruction. 
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C6.2.185 MOV (inverted wide immediate) 
Move (inverted wide immediate) moves an inverted 16-bit immediate value to a register. 
This instruction is an alias of the MOVN instruction. This means that: 
: The encodings in this description are named to match the encodings of MOVN. 


è The description of MOVN gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4| 0 | 


so o ooro mw] —— me J w | 


opc 


32-bit variant 

Applies when sf == 0. 

MOV <Wd>, #<imm> 

is equivalent to 

MOVN <Wd>, #<imm16>, LSL #<shift> 
and is the preferred disassembly when ! (IsZero(imm16) && hw != 'Q0') && ! IsOnes(imm16). 
64-bit variant 

Applies when sf == 1. 

MOV <Xd>, #<imm> 

is equivalent to 

MOVN <Xd>, #<imm16>, LSL #<shift> 


and is the preferred disassembly when ! (IsZero(imm16) && hw != 'Q0'). 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<imm> For the 32-bit variant: is a 32-bit immediate, the bitwise inverse of which can be encoded in 


"imm16:hw", but excluding Oxffff0000 and Ox0000ffff 
For the 64-bit variant: is a 64-bit immediate, the bitwise inverse of which can be encoded in 


"imm16:hw". 


<shift> For the 32-bit variant: is the amount by which to shift the immediate left, either 0 (the default) or 
16, encoded in the "hw" field as <shift>/16. 


For the 64-bit variant: is the amount by which to shift the immediate left, either 0 (the default), 16, 
32 or 48, encoded in the "hw" field as <shift>/16. 


Operation 


The description of MOVN gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.186 


C6-1092 


MOV (wide immediate) 


Move (wide immediate) moves a 16-bit immediate value to a register. 


This instruction is an alias of the MOVZ instruction. This means that: 


: The encodings in this description are named to match the encodings of MOVZ. 
è The description of MOVZ gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4| 0| 
FO — me J ro | 
opc 
32-bit variant 


Applies when sf == 0. 

MOV <Wd>, #<imm> 

is equivalent to 

MOVZ <Wd>, #<imm16>, LSL #<shift> 

and is the preferred disassembly when ! (IsZero(imml6) && hw != 'QQ'). 
64-bit variant 

Applies when sf == 1. 

MOV <Xd>, #<imm> 

is equivalent to 

MOVZ <Xd>, #<imm16>, LSL #<shift> 


and is the preferred disassembly when ! (IsZero(imm16) && hw != 'Q0'). 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<imm> For the 32-bit variant: is a 32-bit immediate which can be encoded in "imm16:hw". 


For the 64-bit variant: is a 64-bit immediate which can be encoded in "imm16:hw". 


<shift> For the 32-bit variant: is the amount by which to shift the immediate left, either 0 (the default) or 
16, encoded in the "hw" field as <shift>/16. 


For the 64-bit variant: is the amount by which to shift the immediate left, either 0 (the default), 16, 
32 or 48, encoded in the "hw" field as <shift>/16. 


Operation 


The description of MOVZ gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.187 


C6-1094 


MOV (bitmask immediate) 


Move (bitmask immediate) writes a bitmask immediate value to a register. 
This instruction is an alias of the ORR (immediate) instruction. This means that: 
: The encodings in this description are named to match the encodings of ORR (immediate). 


è The description of ORR (immediate) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 | 5 4| 0 | 
sfo 0070 ON] mm | mms (17774) Ra | 
opc Rn 

32-bit variant 

Applies when sf == 0 && N == 

MOV <Wd|WSP>, #<imm> 

is equivalent to 

ORR <Wd|WSP>, WZR, #<imm> 


and is the preferred disassembly when ! MoveWidePreferred(sf, N, imms, immr). 


64-bit variant 

Applies when sf == 1. 
MOV <Xd|SP>, #<imm> 

is equivalent to 

ORR <Xd|SP>, XZR, #<imm> 


and is the preferred disassembly when ! MoveWidePreferred(sf, N, imms, immr). 


Assembler symbols 


<Wd | WSP> Is the 32-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Xd | SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<imm> For the 32-bit variant: is the bitmask immediate, encoded in "imms:immr", but excluding values 


which could be encoded by MOVZ or MOVN. 


For the 64-bit variant: is the bitmask immediate, encoded in "N:imms:immr", but excluding values 
which could be encoded by MOVZ or MOVN. 


Operation 


The description of ORR (immediate) gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.188 


C6-1096 


MOV (register) 


Move (register) copies the value in a source register to the destination register. 
This instruction is an alias of the ORR (shifted register) instruction. This means that: 
: The encodings in this description are named to match the encodings of ORR (shifted register). 


è The description of ORR (shifted register) gives the operational pseudocode for this instruction. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 | 109 | 5 4| 0 | 


fo Jo 7074 ojo ojo] Rm  joooo00077111] Rd | 
Rn 


opc shift N imm6 


32-bit variant 
Applies when sf == 0. 
MOV <Wd>, <Wm> 

is equivalent to 

ORR <Wd>, WZR, <Wm> 
and is always the preferred disassembly. 
64-bit variant 
Applies when sf == 1. 
MOV <Xd>, <Xm> 

is equivalent to 

ORR <Xd>, XZR, <Xm> 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wm> Is the 32-bit name of the general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xm> Is the 64-bit name of the general-purpose source register, encoded in the "Rm" field. 
Operation 


The description of ORR (shifted register) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 
s The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.189 


C6-1098 


MOVK 
Move wide with keep moves an optionally-shifted 16-bit immediate value into a register, keeping other bits 
unchanged. 
|31 30 29 28|27 26 25 24/23 22 21 20| | | | 5 4| 0 | 
100101ļw] mme TRG 
opc 


32-bit variant 


Applies when sf == 0. 


MOVK <Wd>, #<imm>{, LSL #<shift>} 


64-bit variant 


Applies when sf == 1. 


MOVK <Xd>, #<imm>{, LSL #<shift>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer datasize = if sf == '1' then 64 else 32; 
integer pos; 


if sf == '0' && hw<1l> == '1' then UNDEFINED; 
pos = UInt(hw: '0000'); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<imm> Is the 16-bit unsigned immediate, in the range 0 to 65535, encoded in the "imm16" field. 

<shift> For the 32-bit variant: is the amount by which to shift the immediate left, either 0 (the default) or 
16, encoded in the "hw" field as <shift>/16. 
For the 64-bit variant: is the amount by which to shift the immediate left, either 0 (the default), 16, 
32 or 48, encoded in the "hw" field as <shift>/16. 

Operation 


bits(datasize) result; 


result = X[d]; 
result<pos+15:pos> = imm16; 


X[d] = 


result; 


Operational information 


If PSTATE.DIT is 1: 


; The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.190 


C6-1100 


MOVN 


Move wide with NOT moves the inverse of an optionally-shifted 16-bit immediate value to a register. 


This instruction is used by the alias MOV (inverted wide immediate). See Alias conditions for details of when each 


alias is preferred. 


|31 30 29 28|27 26 25 24|23 22 21 20| | | | 54| 0| 
stjo oji 0o 0101ļ|w] immt6 RT 
opc 
32-bit variant 


Applies when sf == 0. 


MOVN <Wd>, #<imm>{, LSL #<shift>} 


64-bit variant 
Applies when sf == 1. 


MOVN <Xd>, #<imm>{, LSL #<shift>} 


Decode for all variants of this encoding 
integer d = UInt(Rd); 

integer datasize = if sf == '1' then 64 else 32; 
integer pos; 

if sf == '@' && hw<l> == '1' then UNDEFINED; 

pos = UInt(hw: '0000'); 


Alias conditions 





Alias of variant 


MOV (inverted wide immediate) 64-bit 


MOV (inverted wide immediate) 32-bit 


is preferred when 
! (IsZero(imm16) && hw != '00') 


! (IsZero(imm16) && hw != 'Q0') && ! IsOnes(imm16) 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<imm> Is the 16-bit unsigned immediate, in the range 0 to 65535, encoded in the "imm16" field. 
<shift> For the 32-bit variant: is the amount by which to shift the immediate left, either 0 (the default) or 


16, encoded in the "hw" field as <shift>/16. 


For the 64-bit variant: is the amount by which to shift the immediate left, either 0 (the default), 16, 
32 or 48, encoded in the "hw" field as <shift>/16. 


Operation 
bits(datasize) result; 


result = Zeros(); 
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result<pos+15:pos> = imm16; 
result = NOT(result); 
X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


$ The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


` The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.191 MOVZ 


Move wide with zero moves an optionally-shifted 16-bit immediate value to a register. 


This instruction is used by the alias MOV (wide immediate). See Alias conditions for details of when each alias is 


preferred. 
|31 30 29 28|27 26 25 24/23 22 21 20| | | | 5 4| 0| 
100101ļw] imme CT Rd | 
opc 
32-bit variant 


Applies when sf == 0. 


MOVZ <Wd>, #<imm>{, LSL #<shift>} 


64-bit variant 
Applies when sf == 1. 


MOVZ <Xd>, #<imm>{, LSL #<shift>} 


Decode for all variants of this encoding 
integer d = UInt(Rd); 

integer datasize = if sf == '1' then 64 else 32; 
integer pos; 

if sf == '@' && hw<l> == '1' then UNDEFINED; 
pos = UInt(hw: '0000'); 


Alias conditions 





Alias is preferred when 


MOV (wide immediate) ! (IsZero(imml6) && hw != '00') 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<imm> Is the 16-bit unsigned immediate, in the range 0 to 65535, encoded in the "imm16" field. 
<shift> For the 32-bit variant: is the amount by which to shift the immediate left, either 0 (the default) or 


16, encoded in the "hw" field as <shift>/16. 
For the 64-bit variant: is the amount by which to shift the immediate left, either 0 (the default), 16, 


32 or 48, encoded in the "hw" field as <shift>/16. 
Operation 
bits(datasize) result; 


result = Zeros(); 
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result<pos+15:pos> = imm16; 
X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.192 MRS 


Move System Register allows the PE to read an AArch64 System register into a general-purpose register. 


|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12\11 8/7 54] 0 | 


770107070 0)1] to] opt | cen | cRm [om] Rt 
L 


System variant 
MRS <Xt>, (<systemreg>|S<op0>_<op1>_<Cn>_<Cm>_<op2>) 
Decode for this encoding 
AArch64.CheckSystemAccess('1':00, op1, CRn, CRm, op2, Rt, L); 
integer t = UInt(Rt); 
integer sys_op0 = 2 + UInt(o0); 
integer sys_op1 = UInt(op1); 
integer sys_op2 = UInt(op2); 
integer sys_crn = UInt(CRn); 
integer sys_crm = UInt(CRm); 
Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose destination register, encoded in the "Rt" field. 


<systemreg> Is a System register name, encoded in the "00:op1:CRn:CRm:op2". 
The System register names are defined in Chapter D13 AArch64 System Register Descriptions. 


<opQ> Is an unsigned immediate, encoded in the "o0" field. It can have the following values: 
2 when 00 = 0 
3 when o0 = 1 

<op1> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op1" field. 

<Cn> Is a name 'Cn', with 'n' in the range 0 to 15, encoded in the "CRn" field. 

<Cm> Is a name 'Cm', with 'm' in the range 0 to 15, encoded in the "CRm" field. 

<op2> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op2" field. 

Operation 


X[t] = AArch64.SysRegRead(sys_op0, sys_opl, sys_crn, sys_crm, sys_op2); 


C6-1104 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 


C6.2 Alphabetical list of A64 base instructions 


C6.2.193 MSR (immediate) 


Move immediate value to Special Register moves an immediate value to selected bits of the PSTATE. For more 
information, see PSTATE. 


The bits that can be written by this instruction are: 


s PSTATE.D, PSTATE.A, PSTATE.I, PSTATE.F, and PSTATE.SP. 


` If ARMv8.0-SSBS is implemented, PSTATE.SSBS. 


s If ARMv8.1-PAN is implemented, PSTATE.PAN. 


. If ARMv8.2-UAO is implemented, PSTATE.UAO. 


è If ARMv8.4-DIT is implemented, PSTATE.DIT. 





à If ARMv8.5-MemTag is implemented, PSTATE.TCO. 


|31 30 29 28|27 26 25 24/23 22 2120/1918 16/15 1413 12|11 8|7 


110101010 ofojo of opt [o0 100| cRm | op2 [1 1141 14) 


System variant 


MSR <pstatefield>, #<imm> 


Decode for this encoding 


if op1 == '000' && op2 == 'Q00' then SEE "CFINV"; 
if opl == 'Q00' && op2 == 'Q01' then SEE "XAFLAG"; 
if opl == 'Q00' && op2 == '@10' then SEE "AXFLAG"; 


AArch64.CheckSystemAccess('00', op1, '@100', CRm, op2, '11111', '0'); 


PSTATEField 


field; 


case opl:op2 of 
when '000 Q11' 
if !HaveUAOExt() then 


UNDEFINED; 


field = PSTATEField_UAO; 
when '000 100' 


if 


'HavePANExt() then 


UNDEFINED; 


field = PSTATEField_PAN; 
when '000 101' field = PSTATEField_SP; 
when '011 010' 


if 


fiel 


lHaveDITExt() then 


UNDEFINED; 
d = PSTATEField_DIT; 


when '011 100' 


if 


fiel 





lHaveMTEExt() then 


UNDEFINED; 
d = PSTATEField_TCO; 


when '011 110' field = PSTATEField_DAIFSet; 
when '011 111' field = PSTATEField_DAIFCIr; 
when '011 001' 

if !HaveSSBSExt() then 


UNDEFINED; 


field = PSTATEField_SSBS; 
otherwise UNDEFINED; 


// Check that an AArch64 MSR/MRS access to the DAIF flags is permitted 
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C6-1106 


if PSTATE.EL == ELO && field IN {PSTATEField_DAIFSet, PSTATEField_DAIFCIr} then 
if IsInHost() || SCTLR_EL1.UMA == 'Q' then 
AArch64.SystemAccessTrap(EL1, 0x18); // Exception_SystemRegisterTrap 


Assembler symbols 


<pstatefield> Is a PSTATE field name, encoded in the "op1:op2" field. It can have the following values: 


<imm> 


Operation 


case field of 


SPSel when op1 = 000, op2 = 101 

DAIFSet when op1 = 011, op2 = 110 

DAIFCIr when op1 = 011, op2 = 111 

When ARMv8.2-UAO is implemented, the following value is also valid: 
UAO when op1 = 000, op2 = 011 

When ARMv8.1-PAN is implemented, the following value is also valid: 
PAN when op1 = 000, op2 = 100 

When ARMv8.0-SSBS is implemented, the following value is also valid: 
SSBS when op1 = 011, op2 = 001 

When ARMV8.4-DIT is implemented, the following value is also valid: 

DIT when op1 = 011, op2 = 010 





When ARMV8.5-MemTag is implemented, the following value is also valid: 


TCO when op1 = 011, op2 = 100 

See PSTATE on page C4-260 when op1 = 000, op2 = 00x. 
See PSTATE on page C4-260 when op1 = 000, op2 = 010. 
The following encodings are reserved: 

s op1 = 000, op2 = 11x. 

s opl = 001, op2 = xxx. 

° op1 = 010, op2 = xxx. 

. op1 = 011, op2 = 000. 

s opl = 011, op2 = 011. 

: op1 = 011, op2 = 101. 


. op1 = 1xx, op2 = XXX. 


Is a 4-bit unsigned immediate, in the range 0 to 15, encoded in the "CRm" field. 


when PSTATEField_SSBS 
PSTATE.SSBS = CRm<Q@>; 

when PSTATEField_SP 
PSTATE.SP = CRm<@>; 

when PSTATEField_DAIFSet 
PSTATE.D = PSTATE.D OR CRm<3>; 
PSTATE.A = PSTATE.A OR CRm<2>; 
PSTATE.I = PSTATE.I OR CRm<1>; 
PSTATE.F = PSTATE.F OR CRm<@>; 

when PSTATEField_DAIFCIr 
PSTATE.D = PSTATE.D AND NOT(CRm<3>) ; 
PSTATE.A = PSTATE.A AND NOT(CRm<2>) ; 
PSTATE.I = PSTATE.I AND NOT(CRm<1>) ; 
PSTATE.F = PSTATE.F AND NOT(CRm<@>) ; 

when PSTATEField_PAN 
PSTATE.PAN = CRm<@>; 

when PSTATEField_UAO 
PSTATE.UAO = CRm<@>; 
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when PSTATEField_DIT 
PSTATE.DIT = CRm<0>; 

when PSTATEField_TCO 
PSTATE.TCO = CRm<@>; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-1107 
ID070919 Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.194 MSR (register) 


Move general-purpose register to System Register allows the PE to write an AArch64 System register from a 
general-purpose register. 


[31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12\11 8/7 54] 0 | 


dodo to 4 9 ojojo opt | orn | orm | o2 | Rt | 


System variant 


MSR (<systemreg>|S<op0>_<op1>_<Cn>_<Cm>_<op2>), <Xt> 


Decode for this encoding 
AArch64.CheckSystemAccess('1':00, op1, CRn, CRm, op2, Rt, L); 
integer t = UInt(Rt); 


integer sys_op0 = 2 + UInt(0Q); 
integer sys_op1 = UInt(op1); 
integer sys_op2 = UInt(op2); 
integer sys_crn = UInt(CRn); 
integer sys_crm = UInt(CRm); 


Assembler symbols 


<systemreg> Is a System register name, encoded in the "00:op1:CRn:CRm:op2". 
The System register names are defined in Chapter D13 AArch64 System Register Descriptions. 


<opQ> Is an unsigned immediate, encoded in the "00" field. It can have the following values: 
2 when o0 = 0 
3 when 0@ = 1 

<opl> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op1" field. 

<Cn> Is a name 'Cn', with 'n' in the range 0 to 15, encoded in the "CRn" field. 

<Cm> Is a name 'Cm', with 'm' in the range 0 to 15, encoded in the "CRm" field. 

<op2> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op2" field. 

<Xt> Is the 64-bit name of the general-purpose source register, encoded in the "Rt" field. 

Operation 


AArch64.SysRegWrite(sys_op®, sys_opl, sys_crn, sys_crm, sys_op2, X[t]); 
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C6.2.195 MSUB 


Multiply-Subtract multiplies two register values, subtracts the product from a third register value, and writes the 
result to the destination register. 


This instruction is used by the alias MNEG. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 


seo toro] e me | | 


32-bit variant 
Applies when sf == 


MSUB <Wd>, <Wn>, <Wm>, <Wa> 


64-bit variant 
Applies when sf == 


MSUB <Xd>, <Xn>, <Xm>, <Xa> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer a = UInt(Ra); 
integer destsize = if sf == '1' then 64 else 32; 


Alias conditions 


Alias is preferred when 


MNEG Ra == '11111' 


Assembler symbols 





<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 

<Wa> Is the 32-bit name of the third general-purpose source register holding the minuend, encoded in the 
"Ra" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 
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<Xa> Is the 64-bit name of the third general-purpose source register holding the minuend, encoded in the 
"Ra" field. 


Operation 

bits(destsize) operandl = X[n]; 

bits(destsize) operand2 = X[m]; 

bits(destsize) operand3 = X[a]; 

integer result; 

result = UInt(operand3) - (UInt(operand1) » UInt(operand2)); 
X[d] = result<destsize-1:0>; 

Operational information 

If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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Multiply : Rd = Rn » Rm 


This instruction is an alias of the MADD instruction. This means that: 


: The encodings in this description are named to match the encodings of MADD. 
è The description of MADD gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 | 109 5 4| 0 | 
aloof e100) aol TTT] | 
Ra 
32-bit variant 


Applies when sf == 

MUL <Wd>, <Wn>, <Wm> 

is equivalent to 

MADD <Wd>, <Wn>, <Wm>, WZR 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 

MUL <Xd>, <Xn>, <Xm> 

is equivalent to 

MADD <Xd>, <Xn>, <Xm>, XZR 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 

Operation 


The description of MADD gives the operational pseudocode for this instruction. 
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C6.2.197 


C6-1112 


Bitwise NOT writes the bitwise inverse of a register value to the destination register. 
This instruction is an alias of the ORN (shifted register) instruction. This means that: 
: The encodings in this description are named to match the encodings of ORN (shifted register). 


è The description of ORN (shifted register) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 | 109 | 5 4| 0| 
o jo 107 ofsi] Rm | mmo (17777) Ra 
opc N Rn 

32-bit variant 

Applies when sf == 0. 

MVN <Wd>, <Wm>{, <shift> #<amount>} 

is equivalent to 

ORN <Wd>, WZR, <Wm>{, <shift> #<amount>} 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1. 

MVN <Xd>, <Xm>{, <shift> #<amount>} 

is equivalent to 

ORN <Xd>, XZR, <Xm>{, <shift> #<amount>} 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wm> Is the 32-bit name of the general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xm> Is the 64-bit name of the general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 
ROR when shift = 11 
<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 
For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field, 
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Operation 


The description of ORN (shifted register) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.198 NEG (shifted register) 


C6-1114 


Negate (shifted register) negates an optionally-shifted register value, and writes the result to the destination register. 


This instruction is an alias of the SUB (shifted register) instruction. This means that: 
: The encodings in this description are named to match the encodings of SUB (shifted register). 


è The description of SUB (shifted register) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 | 109 | 5 4| 0| 
olo 707 feno] Rm | mmo [17777] Ra 
op S Rn 

32-bit variant 

Applies when sf == 0. 

NEG <Wd>, <Wm>{, <shift> #<amount>} 

is equivalent to 

SUB <Wd>, WZR, <Wm> {, <shift> #<amount>} 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1. 

NEG <Xd>, <Xm>{, <shift> #<amount>} 

is equivalent to 

SUB <Xd>, XZR, <Xm> {, <shift> #<amount>} 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wm> Is the 32-bit name of the general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xm> Is the 64-bit name of the general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift type to be applied to the second source operand, defaulting to LSL and encoded 
in the "shift" field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 


The encoding shift = 11 is reserved. 


<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 


"imm6" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 


"imm6" field. 
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Operation 


The description of SUB (shifted register) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.199 


C6-1116 


NEGS 


Negate, setting flags, negates an optionally-shifted register value, and writes the result to the destination register. It 
updates the condition flags based on the result. 


This instruction is an alias of the SUBS (shifted register) instruction. This means that: 
g The encodings in this description are named to match the encodings of SUBS (shifted register). 


s The description of SUBS (shifted register) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 | 109 | 5 4| 0| 
o 107 fijo] Rm | mmo [17777] Ra 
op S Rn 

32-bit variant 

Applies when sf == 0. 

NEGS <Wd>, <Wm>{, <shift> #<amount>} 

is equivalent to 

SUBS <Wd>, WZR, <Wm> {, <shift> #<amount>} 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1. 

NEGS <Xd>, <Xm>{, <shift> #<amount>} 

is equivalent to 

SUBS <Xd>, XZR, <Xm> {, <shift> #<amount>} 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wm> Is the 32-bit name of the general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xm> Is the 64-bit name of the general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift type to be applied to the second source operand, defaulting to LSL and encoded 
in the "shift" field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 


The encoding shift = 11 is reserved. 


<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field. 
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Operation 


The description of SUBS (shifted register) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.200 


C6-1118 


NGC 


Negate with Carry negates the sum of a register value and the value of NOT (Carry flag), and writes the result to 
the destination register. 


This instruction is an alias of the SBC instruction. This means that: 
$ The encodings in this description are named to match the encodings of SBC. 


s The description of SBC gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9 | 5 4| 0| 


Sto onoo oo] Rm joooo00171111] RG | 
Rn 


op S 


32-bit variant 
Applies when sf == 0. 
NGC <Wd>, <Wm> 

is equivalent to 

SBC <Wd>, WZR, <Wm> 
and is always the preferred disassembly. 
64-bit variant 
Applies when sf == 1. 
NGC <Xd>, <Xm> 

is equivalent to 

SBC <Xd>, XZR, <Xm> 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wm> Is the 32-bit name of the general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xm> Is the 64-bit name of the general-purpose source register, encoded in the "Rm" field. 
Operation 


The description of SBC gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 
: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.201 


C6-1120 


NGCS 


Negate with Carry, setting flags, negates the sum of a register value and the value of NOT (Carry flag), and writes 
the result to the destination register. It updates the condition flags based on the result. 


This instruction is an alias of the SBCS instruction. This means that: 
$ The encodings in this description are named to match the encodings of SBCS. 


° The description of SBCS gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9. | 5 4| 0| 
op S Rn 
32-bit variant 
Applies when sf == 0. 
NGCS <Wd>, <Wm> 
is equivalent to 
SBCS <Wd>, WZR, <Wm> 
and is always the preferred disassembly. 
64-bit variant 
Applies when sf == 1. 
NGCS <Xd>, <Xm> 
is equivalent to 
SBCS <Xd>, XZR, <Xm> 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wm> Is the 32-bit name of the general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xm> Is the 64-bit name of the general-purpose source register, encoded in the "Rm" field. 
Operation 


The description of SBCS gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 
: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.202 NOP 


No Operation does nothing, other than advance the value of the program counter by 4. This instruction can be used 
for instruction alignment purposes. 


Note 


The timing effects of including a NOP instruction in a program are not guaranteed. It can increase execution time, 
leave it unchanged, or even reduce it. Therefore, NOP instructions are not suitable for timing loops. 





[31 30 29 28/27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 817 5 4/3210 
1101041010 0fofo ojo 11/001 0f0 00 0/0 00/1111 1 
CRm op2 


System variant 


NOP 


Decode for this encoding 


// Empty. 


Operation 


// do nothing 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Bitwise OR NOT (shifted register) performs a bitwise (inclusive) OR of a register value and the complement of an 
optionally-shifted register value, and writes the result to the destination register. 


This instruction is used by the alias MVN. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 


| 109 5 4| 0 | 


CA OKA EA — Ra | as E 


opc 


32-bit variant 
Applies when sf == 


ORN <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


ORN <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize = if sf == '1' then 64 else 32; 


if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift); 
integer shift_amount = UInt(imm6); 


Alias conditions 





Alias is preferred when 


MVN Rn == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
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C6.2 Alphabetical list of A64 base instructions 


ASR when shift = 10 
ROR when shift = 11 

<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 
For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field, 

Operation 


bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


operand2 = 


NOT (operand2) ; 


result = operand1 OR operand2; 
X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


z The execution time of this instruction is independent of: 


è The response of this instruction to asynchronous exceptions does not vary based on: 


C6-1124 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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C6.2.204 ORR (immediate) 


Bitwise OR (immediate) performs a bitwise (inclusive) OR of a register value and an immediate register value, and 
writes the result to the destination register. 


This instruction is used by the alias MOV (bitmask immediate). See Alias conditions for details of when each alias 
is preferred. 


|31 30 29 2827 26 25 24|23 22 21 | 16/15 | 109 5 4| o| 


aea a a ee 


opc 


32-bit variant 
Applies when sf == 0 && N == 


ORR <Wd|WSP>, <Wn>, #<imm> 


64-bit variant 
Applies when sf == 


ORR <Xd|SP>, <Xn>, #<imm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer datasize = if sf == '1' then 64 else 32; 
bits(datasize) imm; 

if sf == '@' && N != '@' then UNDEFINED; 

(imm, -) = DecodeBitMasks(N, imms, immr, TRUE); 


Alias conditions 





Alias is preferred when 


MOV (bitmask immediate) Rn == '11111' && ! MoveWidePreferred(sf, N, imms, immr) 


Assembler symbols 


<Wd | WSP> Is the 32-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd| SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<imm> For the 32-bit variant: is the bitmask immediate, encoded in "imms:immr". 


For the 64-bit variant: is the bitmask immediate, encoded in "N:imms:immr". 
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C6-1126 


Operation 


bits(datasize) result; 
bits(datasize) operandl = X[n]; 


result = operand1 OR imm; 


if d == 31 then 
SP[] = result; 
else 
X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


< The execution time of this instruction is independent of: 


° The response of this instruction to asynchronous exceptions does not vary based on: 


The values of the data supplied in any of its registers. 


The values of the NZCV flags. 


The values of the data supplied in any of its registers. 


The values of the NZCV flags. 
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C6.2.205 ORR (shifted register) 


Bitwise OR (shifted register) performs a bitwise (inclusive) OR of a register value and an optionally-shifted register 
value, and writes the result to the destination register. 


This instruction is used by the alias MOV (register). See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 | 109 54| 0| 
lsf}o_ t]o0 1010 st [| a a eT 
opc 
32-bit variant 


Applies when sf == 


ORR <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


ORR <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Alias conditions 





Alias is preferred when 


MOV (register) shift == '00' && imm6 == '000000' && Rn == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<shift> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
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ASR when shift = 10 
ROR when shift = 11 

<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 


For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field, 


Operation 


bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


result = operand1 OR operand2; 
X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.206 PACDA, PACDZA 


ARM DDI 0487E.a 
ID070919 


Pointer Authentication Code for Data address, using key A. This instruction computes and inserts a pointer 
authentication code for a data address, using a modifier and key A. 


The address is in the general-purpose register that is specified by <Xd>. 
The modifier is: 
` In the general-purpose register or stack pointer that is specified by <Xn | SP> for PACDA. 


° The value zero, for PACDZA. 


ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


Goon orr ojo oo onjojojzlo ro] Rn | Rd 


PACDA variant 
Applies when Z == 0. 


PACDA <Xd>, <Xn|SP> 


PACDZA variant 
Applies when Z == 1 && Rn == 11111. 


PACDZA <Xd> 


Decode for all variants of this encoding 


boolean source_is_sp = FALSE; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if !HavePACExt() then 
UNDEFINED; 


if Z == '@' then // PACDA 

if n == 31 then source_is_sp = TRUE; 
else // PACDZA 

if n != 31 then UNDEFINED; 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn | SP> Is the 64-bit name of the general-purpose source register or stack pointer, encoded in the "Rn" field. 
Operation 


if source_is_sp then 

X[d] = AddPACDA(X[d], SP[]); 
else 

X[d] = AddPACDA(X[d], X[n]); 
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C6.2.207 PACDB, PACDZB 


Pointer Authentication Code for Data address, using key B. This instruction computes and inserts a pointer 
authentication code for a data address, using a modifier and key B. 


The address is in the general-purpose register that is specified by <Xd>. 
The modifier is: 
` In the general-purpose register or stack pointer that is specified by <Xn | SP> for PACDB. 


° The value zero, for PACDZB. 


ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


Goon 01700000 7ojojzjo1i] Rn | R 


PACDB variant 
Applies when Z == 0. 


PACDB <Xd>, <Xn|SP> 


PACDZB variant 
Applies when Z == 1 && Rn == 11111. 


PACDZB <Xd> 


Decode for all variants of this encoding 


boolean source_is_sp = FALSE; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if !HavePACExt() then 
UNDEFINED; 


if Z == '@' then // PACDB 

if n == 31 then source_is_sp = TRUE; 
else // PACDZB 

if n != 31 then UNDEFINED; 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn | SP> Is the 64-bit name of the general-purpose source register or stack pointer, encoded in the "Rn" field. 
Operation 


if source_is_sp then 

X[d] = AddPACDB(X[d], SP[]); 
else 

X[d] = AddPACDB(X[d], X[n]); 
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C6.2.208 PACGA 


ARM DDI 0487E.a 
ID070919 


Pointer Authentication Code, using Generic key. This instruction computes the pointer authentication code for an 
address in the first source register, using a modifier in the second source register, and the Generic key. The computed 
pointer authentication code is returned in the upper 32 bits of the destination register. 


ARMVv8.3 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| o| 


loloj 1010110] Rm foo1100| R | Ra | 


Integer variant 


PACGA <Xd>, <Xn>, <Xm|SP> 


Decode for this encoding 
boolean source_is_sp = FALSE; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if !HavePACExt() then 
UNDEFINED; 


if m == 31 then source_is_sp = TRUE; 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm|SP> Is the 64-bit name of the second general-purpose source register or stack pointer, encoded in the 
"Rm" field. 

Operation 


if source_is_sp then 

X[d] = AddPACGA(X[n], SP[]); 
else 

X[d] = AddPACGA(X[n], X[m]); 
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C6.2.209 


C6-1132 


PACIA, PACIA1716, PACIASP, PACIAZ, PACIZA 


Pointer Authentication Code for Instruction address, using key A. This instruction computes and inserts a pointer 
authentication code for an instruction address, using a modifier and key A. 


The address is: 

s In the general-purpose register that is specified by <Xd> for PACIA and PACIZA. 

. In X17, for PACIA1716. 

° In X30, for PACIASP and PACIAZ. 

The modifier is: 

s In the general-purpose register or stack pointer that is specified by <Xn|SP> for PACIA. 
. The value zero, for PACIZA and PACIAZ. 

° In X16, for PACIA1716. 


° In SP, for PACIASP. 


Integer 


ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


Gool 107017 0)00007ojojzjooo] rn | R] 


PACIA variant 
Applies when Z == 0. 


PACIA <Xd>, <Xn|SP> 


PACIZA variant 
Applies when Z == 1 && Rn == 11111. 


PACIZA <Xd> 


Decode for all variants of this encoding 


boolean source_is_sp = FALSE; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if !HavePACExt() then 
UNDEFINED; 


if Z == '@' then // PACIA 

if n == 31 then source_is_sp = TRUE; 
else // PACIZA 

if n != 31 then UNDEFINED; 
System 


ARMVv8.3 
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[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/11 81/7 5 4|3 21 0| 


T710107010 0/00 0fo11j001000x1J00xJi1111] 
CRm op2 


p 


PACIA1716 variant 
Applies when CRm == 0001 && op2 == 000. 


PACIA1716 


PACIASP variant 
Applies when CRm == 0011 && op2 == 001. 


PACIASP 


PACIAZ variant 
Applies when CRm == 0011 && op2 == 000. 


PACTAZ 


Decode for all variants of this encoding 


integer d; 
integer n; 
boolean source_is_sp = FALSE; 


case CRm:op2 of 
when '0011 000' // PACIAZ 


d = 30; 
n = 31; 

when 'QQ11 001' // PACIASP 
d = 30; 


source_is_sp = TRUE; 

if HaveBTIExt() then 
// Check for branch target compatibility between PSTATE.BTYPE 
// and implicit branch target of PACIASP instruction. 
- = BTypeCompatible_PACIXSP(); 


when '0001 000' // PACIA1716 
d = 17; 
n = 16; 
when '0001 @10' SEE "PACIB"; 
when '0001 100' SEE "AUTIA"; 
when '0001 110' SEE "AUTIB"; 
when '0011 01x' SEE "PACIB"; 
when '0011 10x' SEE "AUTIA"; 
when '0011 11x' SEE "AUTIB"; 
when '0000 111' SEE "XPACLRI"; 





Assembler symbols 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 


<Xn | SP> Is the 64-bit name of the general-purpose source register or stack pointer, encoded in the "Rn" field. 


Operation for all encodings 


if HavePACExt() then 
if source_is_sp then 
X[d] = AddPACIA(X[d], SP[]); 
else 
X[d] = AddPACIA(X[d], X[n]); 
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C6.2.210 


C6-1134 


PACIB, PACIB1716, PACIBSP, PACIBZ, PACIZB 


Pointer Authentication Code for Instruction address, using key B. This instruction computes and inserts a pointer 
authentication code for an instruction address, using a modifier and key B. 


The address is: 

s In the general-purpose register that is specified by <Xd> for PACIB and PACIZB. 

. In X17, for PACIB1716. 

° In X30, for PACIBSP and PACIBZ. 

The modifier is: 

s In the general-purpose register or stack pointer that is specified by <Xn | SP> for PACIB. 
. The value zero, for PACIZB and PACIBZ. 

° In X16, for PACIB1716. 


° In SP, for PACIBSP. 


Integer 


ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


Gool 70701700000 7ojozjooi en | R 


PACIB variant 
Applies when Z == 0. 


PACIB <Xd>, <Xn|SP> 


PACIZB variant 
Applies when Z == 1 && Rn == 11111. 


PACIZB <Xd> 


Decode for all variants of this encoding 


boolean source_is_sp = FALSE; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if !HavePACExt() then 
UNDEFINED; 


if Z == 'Q' then // PACIB 

if n == 31 then source_is_sp = TRUE; 
else // PACIZB 

if n != 31 then UNDEFINED; 
System 


ARMVv8.3 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/11 81/7 5 4|3 21 0| 


T710107010 0foj0 oo1tjo01000x1J01xJ1 1111] 
CRm op2 


p 


PACIB1716 variant 
Applies when CRm == 0001 && op2 == 010. 


PACIB1716 


PACIBSP variant 
Applies when CRm == 0011 && op2 == 011. 


PACIBSP 


PACIBZ variant 
Applies when CRm == 0011 && op2 == 010. 


PACIBZ 


Decode for all variants of this encoding 


integer d; 
integer n; 
boolean source_is_sp = FALSE; 


case CRm:op2 of 
when 'QQ11 010' // PACIBZ 


d = 30; 
n = 31; 

when 'QQ11 011' // PACIBSP 
d = 30; 


source_is_sp = TRUE; 
if HaveBTIExt() then 
// Check for branch target compatibility between PSTATE.BTYPE 
// and implicit branch target of PACIBSP instruction. 
- = BTypeCompatible_PACIXSP(); 
when 'Q001 010' // PACIB1716 
d = 17; 
n = 16; 
when '0001 000' SEE "PACIA"; 
when '0001 100' SEE "AUTIA"; 
when '0001 110' SEE "AUTIB"; 
when '0011 00x' SEE "PACIA"; 
when '0011 10x' SEE "AUTIA"; 
when '0011 11x' SEE "AUTIB"; 
when '0000 111' SEE "XPACLRI"; 





Assembler symbols 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 


<Xn | SP> Is the 64-bit name of the general-purpose source register or stack pointer, encoded in the "Rn" field. 


Operation for all encodings 


if HavePACExt() then 
if source_is_sp then 
X[d] = AddPACIB(X[d], SP[]); 
else 
X[d] = AddPACIB(X[d], X[n]); 
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C6.2.211 PRFM (immediate) 


Prefetch Memory (immediate) signals the memory system that data memory accesses from a specified address are 
likely to occur in the near future. The memory system can respond by taking actions that are expected to speed up 
the memory accesses when they do occur, such as preloading the cache line containing the specified address into 
one or more caches. 


The effect of an PRFM instruction is IMPLEMENTATION DEFINED. For more information, see Prefetch memory on 
page C3-208. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28/27 26 25 24|23 2221 | | | 109 | 5 4| 0 | 


afi 1 ijofo [1 0] m | e Sd] R 


size opc 


Unsigned offset variant 


PRFM (<prfop>|#<imm5>), [<Xn|SP>{, #<pimm>}] 


Decode for this encoding 


bits(64) offset = LSL(ZeroExtend(imm12, 64), 3); 


Assembler symbols 


<prfop> Is the prefetch operation, defined as <type><target><policy>. 


<type> is one of: 


PLD Prefetch for load, encoded in the "Rt<4:3>" field as 0b00. 
PLI Preload instructions, encoded in the "Rt<4:3>" field as 0b01. 
PST Prefetch for store, encoded in the "Rt<4:3>" field as @b10. 


<target> is one of: 


L1 Level 1 cache, encoded in the "Rt<2:1>" field as 0b00. 
L2 Level 2 cache, encoded in the "Rt<2:1>" field as 0b01. 
L3 Level 3 cache, encoded in the "Rt<2:1>" field as 0b10. 


<policy> is one of: 


KEEP Retained or temporal prefetch, allocated in the cache normally. Encoded in the "Rt<0>" 
field as 0. 
STRM Streaming or non-temporal prefetch, for data that is used only once. Encoded in the 


"Rt<0>" field as 1. 
For more information on these prefetch operations, see Prefetch memory on page C3-208. 


For other encodings of the "Rt" field, use <imm5>. 


<imm5> Is the prefetch operation encoding as an immediate, in the range 0 to 31, encoded in the "Rt" field. 


This syntax is only for encodings that are not accessible using <prfop>. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


<pimm> Is the optional positive immediate byte offset, a multiple of 8 in the range 0 to 32760, defaulting to 
0 and encoded in the "imm12" field as <pimm>/8. 
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Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(TRUE) ; 


bits(64) address; 
if n == 31 then 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


Prefetch(address, t<4:0>); 
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C6.2.212 PRFM (literal) 


Prefetch Memory (literal) signals the memory system that data memory accesses from a specified address are likely 
to occur in the near future. The memory system can respond by taking actions that are expected to speed up the 
memory accesses when they do occur, such as preloading the cache line containing the specified address into one 
or more caches. 


The effect of an PRFM instruction is IMPLEMENTATION DEFINED. For more information, see Prefetch memory on 
page C3-208. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| 0 | 


fafotijofoo] me —  ěž J R | 


opc 


Literal variant 


PREM (<prfop>|#<imm5>), <label> 


Decode for this encoding 


integer t = UInt(Rt); 
bits(64) offset; 


offset = SignExtend(imm19:'Q0', 64); 


Assembler symbols 


<prfop> Is the prefetch operation, defined as <type><target><policy>. 


<type> is one of: 


PLD Prefetch for load, encoded in the "Rt<4:3>" field as 0b00. 
PLI Preload instructions, encoded in the "Rt<4:3>" field as @b01. 
PST Prefetch for store, encoded in the "Rt<4:3>" field as @b10. 


<target> is one of: 


L1 Level 1 cache, encoded in the "Rt<2:1>" field as 0b00. 
L2 Level 2 cache, encoded in the "Rt<2:1>" field as 0b01. 
L3 Level 3 cache, encoded in the "Rt<2:1>" field as @b10. 


<policy> is one of: 


KEEP Retained or temporal prefetch, allocated in the cache normally. Encoded in the "Rt<0>" 
field as 0. 
STRM Streaming or non-temporal prefetch, for data that is used only once. Encoded in the 


"Rt<0>" field as 1. 
For more information on these prefetch operations, see Prefetch memory on page C3-208. 


For other encodings of the "Rt" field, use <imm5>. 


<imm5> Is the prefetch operation encoding as an immediate, in the range 0 to 31, encoded in the "Rt" field. 


This syntax is only for encodings that are not accessible using <prfop>. 


<label> Is the program label from which the data is to be loaded. Its offset from the address of this 
instruction, in the range +/-1MB, is encoded as "imm19" times 4. 
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Operation 
bits(64) address = PC[] + offset; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(TRUE) ; 


Prefetch(address, t<4:0>); 
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C6.2.213  PRFM (register) 


Prefetch Memory (register) signals the memory system that data memory accesses from a specified address are 
likely to occur in the near future. The memory system can respond by taking actions that are expected to speed up 
the memory accesses when they do occur, such as preloading the cache line containing the specified address into 
one or more caches. 


The effect of an PRFM instruction is IMPLEMENTATION DEFINED. For more information, see Prefetch memory on 
page C3-208. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/1109 | 5 4| 0 | 


i]t 1 ifofo oft of7] Rm [oons o] Rn | Rt 


size opc 
Integer variant 
PREM (<prfop>|#<imm5>), [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 
Decode for this encoding 
if option<1> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = if S == '1' then 3 else 0; 
Assembler symbols 


<prfop> Is the prefetch operation, defined as <type><target><policy>. 


<type> is one of: 


PLD Prefetch for load, encoded in the "Rt<4:3>" field as 0b00. 
PLI Preload instructions, encoded in the "Rt<4:3>" field as @b01. 
PST Prefetch for store, encoded in the "Rt<4:3>" field as @b10. 


<target> is one of: 


L1 Level 1 cache, encoded in the "Rt<2:1>" field as 0b00. 
L2 Level 2 cache, encoded in the "Rt<2:1>" field as 0b01. 
L3 Level 3 cache, encoded in the "Rt<2:1>" field as 0b10. 


<policy> is one of: 


KEEP Retained or temporal prefetch, allocated in the cache normally. Encoded in the "Rt<0>" 
field as 0. 
STRM Streaming or non-temporal prefetch, for data that is used only once. Encoded in the 


"Rt<0>" field as 1. 
For more information on these prefetch operations, see Prefetch memory on page C3-208. 


For other encodings of the "Rt" field, use <imm5>. 


<imm5> Is the prefetch operation encoding as an immediate, in the range 0 to 31, encoded in the "Rt" field. 


This syntax is only for encodings that are not accessible using <prfop>. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Wm> When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
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<Xm> 


<extend> 


<amount> 
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When option<Q> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 


Is the index extend/shift specifier, defaulting to LSL, and which must be omitted for the LSL option 
when <amount> is omitted. encoded in the "option" field. It can have the following values: 


UXTW when option = 010 


LSL when option = 011 
SXTW when option = 110 
SXTX when option = 111 


Is the index shift amount, optional only when <extend> is not LSL. Where it is permitted to be 
optional, it defaults to #0. It is encoded in the "S" field. It can have the following values: 


#0 when S = 0 
#3 when S = 1 


Shared decode for all encodings 


integer n = 
integer t = 
integer m = 


Operation 


UInt(Rn) ; 
UInt(Rt) ; 
UInt (Rm) ; 


bits(64) offset = ExtendReg(m, extend_type, shift); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(TRUE) ; 


bits(64) address; 


if n == 31 then 


address 
else 
address 


= SP[]; 


= X[n]; 


address = address + offset; 


Prefetch(address, t<4:0>); 
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C6.2.214 PRFUM 


Prefetch Memory (unscaled offset) signals the memory system that data memory accesses from a specified address 
are likely to occur in the near future. The memory system can respond by taking actions that are expected to speed 
up the memory accesses when they do occur, such as preloading the cache line containing the specified address into 
one or more caches. 


The effect of an PRFUM instruction is IMPLEMENTATION DEFINED. For more information, see Prefetch memory on 
page C3-208. 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


ai 1 oo oft ojo] mma — joo) m | Rt 


size opc 


Unscaled offset variant 


PRFUM (<prfop>|#<imm5>), [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<prfop> Is the prefetch operation, defined as <type><target><policy>. 


<type> is one of: 


PLD Prefetch for load, encoded in the "Rt<4:3>" field as 0b00. 
PLI Preload instructions, encoded in the "Rt<4:3>" field as 0b01. 
PST Prefetch for store, encoded in the "Rt<4:3>" field as @b10. 


<target> is one of: 


L1 Level 1 cache, encoded in the "Rt<2:1>" field as 0b00. 
L2 Level 2 cache, encoded in the "Rt<2:1>" field as 0b01. 
L3 Level 3 cache, encoded in the "Rt<2:1>" field as 0b10. 


<policy> is one of: 


KEEP Retained or temporal prefetch, allocated in the cache normally. Encoded in the "Rt<0>" 
field as 0. 
STRM Streaming or non-temporal prefetch, for data that is used only once. Encoded in the 


"Rt<0>" field as 1. 
For more information on these prefetch operations, see Prefetch memory on page C3-208. 


For other encodings of the "Rt" field, use <imm5>. 


<imm5> Is the prefetch operation encoding as an immediate, in the range 0 to 31, encoded in the "Rt" field. 


This syntax is only for encodings that are not accessible using <prfop>. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 
in the "imm9" field. 


C6-1142 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(TRUE) ; 


bits(64) address; 
if n == 31 then 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


Prefetch(address, t<4:0>); 
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C6.2.215 


C6-1144 


PSB CSYNC 


Profiling Synchronization Barrier. This instruction is a barrier that ensures that all existing profiling data for the 
current PE has been formatted, and profiling buffer addresses have been translated such that all writes to the 
profiling buffer have been initiated. A following DSB instruction completes when the writes to the profiling buffer 
have completed. 


If the Statistical Profiling Extension is not implemented, this instruction executes as a NOP. 


ARMVv8.2 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16/15 14 13 12|11 8/7 5 4/3 21 0| 
110101010 0fofo ojo 11/0 010/001 0]001{11111 
CRm op2 
System variant 
PSB CSYNC 
Decode for this encoding 
if !HaveStatisticalProfiling() then EndOfInstruction(); 
Operation 
Profi lingSynchronizationBarrier(); 
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C6.2.216 PSSBB 


ARM DDI 0487E.a 
ID070919 


Physical Speculative Store Bypass Barrier is a memory barrier which prevents speculative loads from bypassing 
earlier stores to the same physical address. 


The semantics of the Physical Speculative Store Bypass Barrier are: 


: When a load to a location appears in program order after the PSSBB, then the load does not speculatively 
read an entry earlier in the coherence order for that location than the entry generated by the latest store 
satisfying all of the following conditions: 


— The store is to the same location as the load. 


— The store appears in program order before the PSSBB. 


° When a load to a location appears in program order before the PSSBB, then the load does not speculatively 
read data from any store satisfying all of the following conditions: 


— The store is to the same location as the load. 


— The store appears in program order after the PSSBB. 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 8|7 6 5 4|3 21 0| 


110101010 ofojo ofotitjoo1itjo7o 0oļjijooļji11 11| 
CRm 


opc 


System variant 


PSSBB 
Decode for this encoding 


// No additional decoding required 


Operation 


SpeculativeStoreBypassBarrierToPA(); 
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C6.2.217 


C6-1146 


RBIT 


Reverse Bits reverses the bit order in a register. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fot 707 O11 ojo ooo ojoo oojoo] mn | Rd 


32-bit variant 
Applies when sf == 0. 
RBIT <Wd>, <Wn> 
64-bit variant 
Applies when sf == 1. 


RBIT <Xd>, <Xn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize = if sf == '1' then 64 else 32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


bits(datasize) operand = X[n]; 
bits(datasize) result; 


for i = 0 to datasize-1 
result<datasize-1-i> = operand<i>; 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.218 RET 


Return from subroutine branches unconditionally to an address in a register, with a hint that this is a subroutine 
return. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


170707 1ļojoji ofja 1 1 11ļ00 0 ofofo] Rn jo 000 0] 
Z op A M Rm 


Integer variant 
RET {<Xn>} 


Decode for this encoding 


integer n = UInt(Rn); 


Assembler symbols 
<Xn> Is the 64-bit name of the general-purpose register holding the address to be branched to, encoded in 
the "Rn" field. Defaults to X30 if absent. 
Operation 
bits(64) target = X[n]; 


BranchTo(target, BranchType_RET) ; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.219 


C6-1148 


RETAA, RETAB 


Return from subroutine, with pointer authentication. This instruction authenticates the address that is held in LR, 
using SP as the modifier and the specified key, branches to the authenticated address, with a hint that this instruction 
is a subroutine return. 


Key A is used for RETAA, and key B is used for RETAB. 


If the authentication passes, the PE continues execution at the target of the branch. If the authentication fails, a 
Translation fault is generated. 


The authenticated address is not written back to LR. 


ARMV8.3 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/1514 1312/1110 9. | 5 4| 0| 
110101 1/ofo[1 0/1 1111/0 00 of[1jM[1 11141111111 
Z op A Rn Rm 
RETAA variant 
Applies when M == 0. 
RETAA 
RETAB variant 
Applies when M == 1. 
RETAB 
Decode for all variants of this encoding 
boolean use_key_a = (M == 'Q'); 
if !HavePACExt() then 
UNDEFINED; 
Operation 
bits(64) target = X[30]; 
bits(64) modifier = SP[]; 
if use_key_a then 
target = AuthIA(target, modifier); 
else 
target = AuthIB(target, modifier); 
BranchTo(target, BranchType_RET) ; 
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Reverse Bytes reverses the byte order in a register. 


This instruction is used by the pseudo-instruction REV64. The pseudo-instruction is never the preferred 
disassembly. 


ea 2e 20|19 18 17 16|15 14 13 12|11 10 9 z 54| 0| 
stajoj to 10 1 1 ofo o 0o o 0/000 oji x} Rn | R | 
opc 
32-bit variant 


Applies when sf == 0 && opc == 10. 


REV <Wd>, <Wn> 


64-bit variant 
Applies when sf == 1 && opc == 11. 


REV <Xd>, <Xn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize = if sf == '1' then 64 else 32; 


integer container_size; 
case opc of 
when 'QQ' 
Unreachable(); 
when 'Q1' 
container_size = 16; 
when '10' 
container_size 
when '11' 
if sf == '@' then UNDEFINED; 
container_size = 64; 


32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


bits(datasize) operand = X[n]; 
bits(datasize) result; 


integer containers = datasize DIV container_size; 
integer elements_per_container = container_size DIV 8; 
integer index = Q; 

integer rev_index; 
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for c = Q to containers-1 
rev_index = index + ((elements_per_container - 1) » 8); 
for e = 0 to elements_per_container-1 
result<rev_index+7:rev_index> = operand<index+7:index>; 
index = index + 8; 
rev_index = rev_index - 8; 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.221 REV16 


ARM DDI 0487E.a 
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Reverse bytes in 16-bit halfwords reverses the byte order in each 16-bit halfword of a register. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
so ToT O11 ojo ooo olo oo OO] em | Ra | 
opc 


32-bit variant 
Applies when sf == 0. 


REV16 <Wd>, <Wn> 
64-bit variant 
Applies when sf == 1. 
REV16 <Xd>, <Xn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize = if sf == '1' then 64 else 32; 


integer container_size; 
case opc of 
when 'QQ' 
Unreachable(); 
when '01' 
container_size = 16; 
when '10' 
container_size = 32; 
when '11' 
if sf == '@' then UNDEFINED; 
container_size = 64; 


Assembler symbols 

<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


bits(datasize) operand = X[n]; 
bits(datasize) result; 


integer containers = datasize DIV container_size; 
integer elements_per_container = container_size DIV 8; 
integer index = Q; 
integer rev_index; 
for c = 0 to containers-1 
rev_index = index + ((elements_per_container - 1) » 8); 
for e = Q to elements_per_container-1 
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result<rev_index+7:rev_index> = operand<index+7: index>; 
index = index + 8; 
rev_index = rev_index - 8; 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


C6-1152 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.222  REV32 


Reverse bytes in 32-bit words reverses the byte order in each 32-bit word of a register. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


Ool onor rojo ooo ojo ooon o] mn | Ro | 


sf opc 


64-bit variant 


REV32 <Xd>, <Xn> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize = if sf == '1' then 64 else 32; 


integer container_size; 
case opc of 
when '00' 
Unreachable(); 
when '01' 
container_size = 16; 
when '10' 
container_size = 32; 
when '11' 
if sf == '0' then UNDEFINED; 
container_size = 64; 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


bits(datasize) operand = X[n]; 
bits(datasize) result; 


integer containers = datasize DIV container_size; 
integer elements_per_container = container_size DIV 8; 
integer index = 0; 
integer rev_index; 
for c = Q to containers-1 
rev_index = index + ((elements_per_container - 1) » 8); 
for e = 0 to elements_per_container-1 
result<rev_index+7:rev_index> = operand<index+7 :index>; 
index = index + 8; 
rev_index = rev_index - 8; 


X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.223 REV64 
Reverse Bytes reverses the byte order in a 64-bit general-purpose register. 


When assembling for Armv8.2, an assembler must support this pseudo-instruction. It is OPTIONAL whether an 
assembler supports this pseudo-instruction when assembling for an architecture earlier than Armv8.2. 


This instruction is a pseudo-instruction of the REV instruction. This means that: 


° The encodings in this description are named to match the encodings of REV. 

. The assembler syntax is used only for assembly, and is not used on disassembly. 

è The description of REV gives the operational pseudocode for this instruction. 
|31 ee aaa 20/19 18 17 16|15 14 13 12/11 10 9 a 5 4| 0 | 
aoon ot ojo ooo ojoo oO i] mn | R | 
sf opc 


64-bit variant 
REV64 <Xd>, <Xn> 
is equivalent to 
REV <Xd>, <Xn> 


and is never the preferred disassembly. 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


The description of REV gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


: The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.224 


C6-1156 


RMIF 


Performs a rotation right of a value held in a general purpose register by an immediate value, and then inserts a 
selection of the bottom four bits of the result of the rotation into the PSTATE flags, under the control of a second 
immediate mask. 


ARMv8.4 


|31 30 29 28|27 26 25 24|23 22 21 20| [151413 12/1110 9 | 5 4]3 o| 


lojiji 1010000] imme [o0 001| Rn [o] mask | 


sf 


Integer variant 


RMIF <Xn>, #<shift>, #<mask> 


Decode for this encoding 
if !HaveFlagManipulateExt() then UNDEFINED; 


integer Isb = UInt(imm6); 
integer n = UInt(Rn); 


Assembler symbols 


<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<shift> Is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the "imm6" field, 
<mask> Is the flag bit mask, an immediate in the range 0 to 15, which selects the bits that are inserted into 


the NZCV condition flags, encoded in the "mask" field. 


Operation 


bits(4) tmp; 

bits(64) tmpreg = X[n]; 

tmp = (tmpreg:tmpreg)<1sb+3:1sb>; 

if mask<3> == '1' then PSTATE.N = tmp<3>; 
if mask<2> == '1' then PSTATE.Z = tmp<2>; 
if mask<l> == '1' then PSTATE.C = tmp<l>; 
if mask<@> == '1' then PSTATE.V = tmp<Q@>; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.225 ROR (immediate) 


ARM DDI 0487E.a 
ID070919 


Rotate right (immediate) provides the value of the contents of a register rotated by a variable number of bits. The 
bits that are rotated off the right end are inserted into the vacated bit positions on the left. 


This instruction is an alias of the EXTR instruction. This means that: 


g The encodings in this description are named to match the encodings of EXTR. 
s The description of EXTR gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 | 109 5 4| 0| 


e a a a a aa 


32-bit variant 

Applies when sf == 0 && N == 0 && imms == Qxxxxx. 
ROR <Wd>, <Ws>, #<shift> 

is equivalent to 

EXTR <Wd>, <Ws>, <Ws>, #<shift> 


and is the preferred disassembly when Rn == Rm. 


64-bit variant 

Applies when sf == 1 && N == 
ROR <Xd>, <Xs>, #<shift> 

is equivalent to 

EXTR <Xd>, <Xs>, <Xs>, #<shift> 


and is the preferred disassembly when Rn == Rm. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Ws> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" and "Rm" fields. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xs> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" and "Rm" fields. 

<shift> For the 32-bit variant: is the amount by which to rotate, in the range 0 to 31, encoded in the "Imms" 
field. 
For the 64-bit variant: is the amount by which to rotate, in the range 0 to 63, encoded in the "Imms" 
field. 

Operation 


The description of EXTR gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.226 ROR (register) 


ARM DDI 0487E.a 
ID070919 


Rotate Right (register) provides the value of the contents of a register rotated by a variable number of bits. The bits 
that are rotated off the right end are inserted into the vacated bit positions on the left. The remainder obtained by 
dividing the second source register by the data size defines the number of bits by which the first source register is 


right-shifted. 


This instruction is an alias of the RORV instruction. This means that: 


è The encodings in this description are named to match the encodings of RORV. 
° The description of RORV gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16115 14 13 12|1110 9. | 5 4| 0| 
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32-bit variant 


Applies when sf == 0. 
ROR <Wd>, <Wn>, <Wm> 
is equivalent to 

RORV <Wd>, <Wn>, <Wm> 


and is always the preferred disassembly. 


64-bit variant 
Applies when sf == 1. 
ROR <Xd>, <Xn>, <Xm> 
is equivalent to 

RORV <Xd>, <Xn>, <Xm> 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding a shift amount from 0 to 


31 in its bottom 5 bits, encoded in the "Rm" field. 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding a shift amount from 0 to 


63 in its bottom 6 bits, encoded in the "Rm" field. 


Operation 


The description of RORV gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.227  RORV 


ARM DDI 0487E.a 
ID070919 


Rotate Right Variable provides the value of the contents of a register rotated by a variable number of bits. The bits 
that are rotated off the right end are inserted into the vacated bit positions on the left. The remainder obtained by 
dividing the second source register by the data size defines the number of bits by which the first source register is 
right-shifted. 


This instruction is used by the alias ROR (register). The alias is always the preferred disassembly. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15141312/11109 | 5 4| 0 | 
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32-bit variant 
Applies when sf == 0. 


RORV <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 1. 


RORV <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
ShiftType shift_type = DecodeShift(op2); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding a shift amount from 0 to 


31 in its bottom 5 bits, encoded in the "Rm" field. 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding a shift amount from 0 to 


63 in its bottom 6 bits, encoded in the "Rm" field. 


Operation 


bits(datasize) result; 
bits(datasize) operand2 = X[m]; 


result = ShiftReg(n, shift_type, UInt(operand2) MOD datasize); 
X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.228 SB 
Speculation Barrier is a barrier that controls speculation. 


The semantics of the Speculation Barrier are that the execution, until the barrier completes, of any instruction that 
appears later in the program order than the barrier: 


. Cannot be performed speculatively to the extent that such speculation can be observed through side-channels 
as a result of control flow speculation or data value speculation. 


à Can be speculatively executed as a result of predicting that a potentially exception generating instruction has 
not generated an exception. 


In particular, any instruction that appears later in the program order than the barrier cannot cause a speculative 
allocation into any caching structure where the allocation of that entry could be indicative of any data value present 
in memory or in the registers. 


The SB instruction: 
° Cannot be speculatively executed as a result of control flow speculation or data value speculation. 


° Can be speculatively executed as a result of predicting that a potentially exception generating instruction has 
not generated an exception. The potentially exception generating instruction can complete once it is known 
not to be speculative, and all data values generated by instructions appearing in program order before the SB 
instruction have their predicted values confirmed. 


When the prediction of the instruction stream is not informed by data taken from the register outputs of the 
speculative execution of instructions appearing in program order after an uncompleted SB instruction, the SB 
instruction has no effect on the use of prediction resources to predict the instruction stream that is being fetched. 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 8|7 6 5 4|3 2 10] 
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CRm opc 


System variant 


SB 


Decode for this encoding 


if !HaveSBExt() then UNDEFINED; 


Operation 


SpeculationBarrier(); 
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C6.2.229 SBC 


Subtract with Carry subtracts a register value and the value of NOT (Carry flag) from a register value, and writes 
the result to the destination register. 


This instruction is used by the alias NGC. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12/11 10 9 7 54| 0| 
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32-bit variant 


Applies when sf == 


SBC <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 


SBC <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Alias conditions 





Alias is preferred when 


NGC Rn == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
Operation 


bits(datasize) result; 
bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = X[m] 


operand2 = NOT(operand2) ; 
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(result, -) = AddWithCarry(operand1, operand2, PSTATE.C); 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.230 SBCS 


Subtract with Carry, setting flags, subtracts a register value and the value of NOT (Carry flag) from a register value, 
and writes the result to the destination register. It updates the condition flags based on the result. 


This instruction is used by the alias NGCS. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12/11 10 9 7 54| 0| 
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32-bit variant 


Applies when sf == 


SBCS <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 


SBCS <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Alias conditions 





Alias is preferred when 


NGCS Rn == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
Operation 


bits(datasize) result; 
bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = X[m] 
bits(4) nzcv; 


operand2 = NOT(operand2) ; 
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(result, nzcv) = AddWithCarry(operand1, operand2, PSTATE.C); 
PSTATE.<N,Z,C,V> = nzcv; 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.231 SBFIZ 


Signed Bitfield Insert in Zeros copies a bitfield of <width> bits from the least significant bits of the source register 
to bit position <1sb> of the destination register, setting the destination bits below the bitfield to zero, and the bits 
above the bitfield to a copy of the most significant bit of the bitfield. 


This instruction is an alias of the SBFM instruction. This means that: 
s The encodings in this description are named to match the encodings of SBFM. 


° The description of SBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 
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opc 


32-bit variant 

Applies when sf == 0 && N == 

SBFIZ <Wd>, <Wn>, #<lsb>, #<width> 

is equivalent to 

SBFM <Wd>, <Wn>, #(-<Isb> MOD 32), #(<width>-1) 


and is the preferred disassembly when UInt(imms) < UInt(immr). 


64-bit variant 

Applies when sf == 1 && N == 

SBFIZ <Xd>, <Xn>, #<Isb>, #<width> 

is equivalent to 

SBFM <Xd>, <Xn>, #(-<Isb> MOD 64), #(<width>-1) 


and is the preferred disassembly when UInt(imms) < UInt(immr). 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Isb> For the 32-bit variant: is the bit number of the lsb of the destination bitfield, in the range 0 to 31. 


For the 64-bit variant: is the bit number of the lsb of the destination bitfield, in the range 0 to 63. 


<width> For the 32-bit variant: is the width of the bitfield, in the range 1 to 32-<Isb>. 
For the 64-bit variant: is the width of the bitfield, in the range 1 to 64-<Isb>. 


Operation 


The description of SBFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.232 


C6-1170 


SBFM 


Signed Bitfield Move is usually accessed via one of its aliases, which are always preferred for disassembly. 


If <imms> is greater than or equal to <immr>, this copies a bitfield of (<imms>-<immr>+1) bits starting from bit position 


<immr> in the source register to the least significant bits of the destination register. 


If <imms> is less than <immr>, this copies a bitfield of (<imms>+1) bits from the least significant bits of the source 
register to bit position (regsize-<immr>) of the destination register, where regsize is the destination register size of 32 


or 64 bits. 


In both cases the destination bits below the bitfield are set to zero, and the bits above the bitfield are set to a copy 


of the most significant bit of the bitfield. 


This instruction is used by the aliases ASR (immediate), SBFIZ, SBFX, SXTB, SXTH, and SXTW. See Alias 


conditions on page C6-1171 for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 
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32-bit variant 
Applies when sf == 0 && N == 


SBFM <Wd>, <Wn>, #<immr>, #<imms> 


64-bit variant 
Applies when sf == 1 && N == 


SBFM <Xd>, <Xn>, #<immr>, #<imms> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer datasize = if sf == '1' then 64 else 32; 


integer R; 
integer S; 
bits(datasize) wmask; 
bits(datasize) tmask; 


if sf == '1' & N != '1' then UNDEFINED; 


if sf == '@' && (N != '@' || immr<5> != 'O' || imms<5> != 'Q') then UNDEFINED; 


R = UInt(immr); 
S = UInt(imms); 
(wmask, tmask) = DecodeBitMasks(N, imms, immr, FALSE); 
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Alias conditions 





Alias of variant is preferred when 

ASR (immediate) 32-bit imms == 'Q11111' 

ASR (immediate) 64-bit imms == '111111' 

SBFIZ š UInt(imms) < UInt(immr) 

SBFX - BFXPreferred(sf, opc<1>, imms, immr) 
SXTB - immr == 'Q00000' && imms == '000111' 
SXTH - immr == 'Q00000' && imms == 'QQ1111' 
SXTW z immr == '000000' && imms == '011111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<immr> For the 32-bit variant: is the right rotate amount, in the range 0 to 31, encoded in the "immr" field. 


For the 64-bit variant: is the right rotate amount, in the range 0 to 63, encoded in the "immr" field. 


<imms> For the 32-bit variant: is the leftmost bit number to be moved from the source, in the range 0 to 31, 
encoded in the "imms" field. 


For the 64-bit variant: is the leftmost bit number to be moved from the source, in the range 0 to 63, 
encoded in the "imms" field. 


Operation 
bits(datasize) src = X[n]; 


// perform bitfield move on low bits 
bits(datasize) bot = ROR(src, R) AND wmask; 


// determine extension bits (sign, zero or dest register) 
bits(datasize) top = Replicate(src<S>); 


// combine extension bits and result bits 

X[d] = (top AND NOT(tmask)) OR (bot AND tmask); 
Operational information 

If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.233 SBFX 


Signed Bitfield Extract copies a bitfield of <width> bits starting from bit position <1sb> in the source register to the 
least significant bits of the destination register, and sets destination bits above the bitfield to a copy of the most 
significant bit of the bitfield. 


This instruction is an alias of the SBFM instruction. This means that: 
s The encodings in this description are named to match the encodings of SBFM. 


° The description of SBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 
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opc 


32-bit variant 

Applies when sf == 0 && N == 

SBFX <Wd>, <Wn>, #<Isb>, #<width> 

is equivalent to 

SBFM <Wd>, <Wn>, #<Isb>, #(<]sb>+<width>-1) 


and is the preferred disassembly when BFxXPreferred(sf, opc<1>, imms, immr). 


64-bit variant 

Applies when sf == 1 && N == 

SBFX <Xd>, <Xn>, #<Isb>, #<width> 

is equivalent to 

SBFM <Xd>, <Xn>, #<Isb>, #(<]sb>+<width>-1) 


and is the preferred disassembly when BFXPreferred(sf, opc<1>, imms, immr). 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Isb> For the 32-bit variant: is the bit number of the Isb of the source bitfield, in the range 0 to 31. 


For the 64-bit variant: is the bit number of the Isb of the source bitfield, in the range 0 to 63. 


<width> For the 32-bit variant: is the width of the bitfield, in the range 1 to 32-<Isb>. 
For the 64-bit variant: is the width of the bitfield, in the range 1 to 64-<Isb>. 


Operation 


The description of SBFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.234 SDIV 


Signed Divide divides a signed integer register value by another signed integer register value, and writes the result 
to the destination register. The condition flags are not affected. 


[31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 
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32-bit variant 
Applies when sf == 


SDIV <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 


SDIV <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
Operation 


bits(datasize) operand1 = X[n]; 
bits(datasize) operand2 = 
integer result; 


1 
>< 
3 

— 


if IsZero(operand2) then 
result = ð; 
else 
result = RoundTowardsZero(Real(Int(operand1, FALSE)) / Real(Int(operand2, FALSE))); 


X[d] = result<datasize-1:0>; 
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C6.2.235 SETF8, SETF16 


ARM DDI 0487E.a 
ID070919 


Set the PSTATE.NZV flags based on the value in the specified general-purpose register. SETF8 treats the value as an 
8 bit value, and SETF16 treats the value as an 16 bit value. 


The PSTATE.C flag is not affected by these instructions. 


ARMVv8.4 
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SETF8 variant 
Applies when sz == 


SETF8 <Wn> 


SETF16 variant 
Applies when sz == 


SETF16 <Wn> 


Decode for all variants of this encoding 


if !HaveFlagManipulateExt() then UNDEFINED; 
integer msb = if sz == '1' then 15 else 7; 
integer n = UInt(Rn); 


Assembler symbols 


<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 


Operation 


bits(32) tmpreg = X[n]; 

PSTATE.N = tmpreg<msb>; 

PSTATE.Z = if (tmpreg<msb:0> == Zeros(msb + 1)) then '1' else 'Q'; 
PSTATE.V = tmpreg<msb+1> EOR tmpreg<msb>; 

//PSTATE.C unchanged; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


` The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2 Alphabetical list of A64 base instructions 


C6.2.236 SEV 


Send Event is a hint instruction. It causes an event to be signaled to all PEs in the multiprocessor system. For more 
information, see Wait for Event mechanism and Send event on page D1-2372. 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/11 8/7 5 4|3 21 0| 
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op2 


System variant 
SEV 
Decode for this encoding 


// Empty. 


Operation 


SendEvent(); 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.237 SEVL 


Send Event Local is a hint instruction that causes an event to be signaled locally without requiring the event to be 
signaled to other PEs in the multiprocessor system. It can prime a wait-loop which starts with a WFE instruction. 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/11 8/7 5 4|3 21 0| 
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op2 


System variant 
SEVL 
Decode for this encoding 


// Empty. 


Operation 


SendEventLocal(); 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.238 SMADDL 


Signed Multiply-Add Long multiplies two 32-bit register values, adds a 64-bit register value, and writes the result 
to the 64-bit destination register. 


This instruction is used by the alias SMULL. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 
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64-bit variant 


SMADDL <Xd>, <Wn>, <Wm>, <Xa> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer a = UInt(Ra); 


Alias conditions 





Alias is preferred when 


SMULL Ra == '11111' 





Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 
<Xa> Is the 64-bit name of the third general-purpose source register holding the addend, encoded in the 
"Ra" field. 
Operation 
bits(32) operand1 = X[n]; 
bits(32) operand2 = X[m]; 


bits(64) operand3 = X[a]; 
integer result; 
result = 


Int(operand3, FALSE) + (Int(operand1, FALSE) « Int(operand2, FALSE)); 


X[d] = result<63:0>; 


ARM DDI 0487E.a 
ID070919 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.239 


C6-1180 


SMC 


Secure Monitor Call causes an exception to EL3. 
SMC is available only for software executing at EL1 or higher. It is UNDEFINED in ELO. 


If the values of HCR_EL2.TSC and SCR_EL3.SMD are both 0, execution of an SMC instruction at EL1 or higher 
generates a Secure Monitor Call exception, recording it in ESR_ELx, using the EC value 0x17, that is taken to EL3. 


If the value of HCR_EL2.TSC is 1 and EL2 is enabled in the current Security state, execution of an SMC instruction 
at EL1 generates an exception that is taken to EL2, regardless of the value of SCR_EL3.SMD. For more 
information, see Traps to EL2 of EL1 execution of SMC instructions on page D1-2343. 


If the value of HCR_EL2.TSC is 0 and the value of SCR_EL3.SMD is 1, the SMC instruction is UNDEFINED. 


[31 30 29 28|27 26 25 24|23 22 21 20| | | | 5 4/3 21 0| 
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System variant 


SMC #<imm> 


Decode for this encoding 


// Empty. 


Assembler symbols 


<imm> Is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the "imm16" field. 


Operation 
AArch64.CheckForSMCUndefOrTrap(imm16) ; 


if SCR_EL3.SMD == '1' then 
// SMC disabled 
AArch64.UndefinedFault(); 

else 
AArch64.Cal1SecureMonitor(imm16) ; 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.240 SMNEGL 


Signed Multiply-Negate Long multiplies two 32-bit register values, negates the product, and writes the result to the 
64-bit destination register. 


This instruction is an alias of the SMSUBL instruction. This means that: 


$ The encodings in this description are named to match the encodings of SMSUBL. 
s The description of SMSUBL gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 | 109 5 4| 0 | 
leo oE ea ea |r 
Ra 
64-bit variant 


SMNEGL <Xd>, <Wn>, <Wm> 
is equivalent to 
SMSUBL <Xd>, <Wn>, <Wm>, XZR 


and is always the preferred disassembly. 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 

Operation 


The description of SMSUBL gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


s The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.241  SMSUBL 


Signed Multiply-Subtract Long multiplies two 32-bit register values, subtracts the product from a 64-bit register 
value, and writes the result to the 64-bit destination register. 


This instruction is used by the alias SMNEGL. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 
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64-bit variant 


SMSUBL <Xd>, <Wn>, <Wm>, <Xa> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer a = UInt(Ra); 


Alias conditions 





Alias is preferred when 


SMNEGL Ra == '11111' 





Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 
<Xa> Is the 64-bit name of the third general-purpose source register holding the minuend, encoded in the 
"Ra" field. 
Operation 
bits(32) operand1 = X[n]; 
bits(32) operand2 = X[m]; 


bits(64) operand3 = X[a]; 
integer result; 


result = Int(operand3, FALSE) - (Int(operand1, FALSE) » Int(operand2, FALSE)); 
X[d] = result<63:0>; 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.242 SMULH 


Signed Multiply High multiplies two 64-bit register values, and writes bits[127:64] of the 128-bit result to the 64-bit 
destination register. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 = 5 4| 0 | 
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64-bit variant 


SMULH <Xd>, <Xn>, <Xm> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 
Operation 
bits(64) operand1 = X[n]; 
bits(64) operand2 = X[m]; 


integer result; 
result = Int(operand1, FALSE) » Int(operand2, FALSE); 


X[d] = result<127:64>; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.243 SMULL 
Signed Multiply Long multiplies two 32-bit register values, and writes the result to the 64-bit destination register. 


This instruction is an alias of the SMADDL instruction. This means that: 


$ The encodings in this description are named to match the encodings of SMADDL. 
è The description of SMADDL gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 | 109 5 4| 0 | 
loop 10-1 tole) e ole Ta] | 
Ra 
64-bit variant 


SMULL <Xd>, <Wn>, <Wm> 
is equivalent to 
SMADDL <Xd>, <Wn>, <Wm>, XZR 


and is always the preferred disassembly. 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 


the "Rm" field. 


Operation 


The description of SMADDL gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


7 The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.244 


C6-1186 


SSBB 


Speculative Store Bypass Barrier is a memory barrier which prevents speculative loads from bypassing earlier stores 


to the same virtual address under certain conditions. 


The semantics of the Speculative Store Bypass Barrier are: 


° When a load to a location appears in program order after the SSBB, then the load does not speculatively read 
an entry earlier in the coherence order for that location than the entry generated by the latest store satisfying 


all of the following conditions: 
— The store is to the same location as the load. 
— The store uses the same virtual address as the load. 


— The store appears in program order before the SSBB. 


° When a load to a location appears in program order before the SSBB, then the load does not speculatively 


read data from any store satisfying all of the following conditions: 
— The store is to the same location as the load. 
— The store uses the same virtual address as the load. 


— The store appears in program order after the SSBB. 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 8|7 6 5 4|3 21 0| 
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System variant 


SSBB 
Decode for this encoding 


// No additional decoding required 


Operation 


SpeculativeStoreBypassBarrierToVA(); 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.245 ST2G 


ARM DDI 0487E.a 
ID070919 


Store Allocation Tags stores an Allocation Tag to two Tag granules of memory. The address used for the store is 
calculated from the base register and an immediate signed offset scaled by the Tag granule. The Allocation Tag is 
calculated from the Logical Address Tag in the source register. 


This instruction generates an Unchecked access. 


Post-index 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 
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Post-index variant 


ST2G <Xt|SP>, [<Xn|SP>], #<simm> 


Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = TRUE; 


Pre-index 


ARMVv8.5 
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1101100 trols] imm [þh] x» Tt 


Pre-index variant 


ST2G <Xt|SP>, [<Xn|SP>, #<simm>]! 


Decode for this encoding 

integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = FALSE; 

Signed offset 


ARMV8.5 
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Signed offset variant 


ST2G <Xt|SP>, [<Xn|SP>{, #<simm>}] 
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C6.2 Alphabetical list of A64 base instructions 


Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = FALSE; 

boolean postindex = FALSE; 


Assembler symbols 


<Xt | SP> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Xt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Xn" field. 
<simm> Is the optional signed immediate offset, a multiple of 16 in the range -4096 to 4080, defaulting to 0 


and encoded in the "imm9" field. 


Operation for all encodings 


bits(64) address; 
bits(64) data = if t == 31 then SP[] else X[t]; 
bits(4) tag = AArch64.AllocationTagFromAddress (data); 


SetNotTagCheckedInstruction(TRUE) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


AArch64.MemTag[address] = tag; 
AArch64.MemTag[address+TAG_GRANULE] = tag; 


if writeback then 
if postindex then 
address = address + offset; 


if n == 31 then 
SP[] = address; 
else 
X[n] = address; 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.246 STADDB, STADDLB 


ARM DDI 0487E.a 
ID070919 


Atomic add on byte in memory, without return, atomically loads an 8-bit byte from memory, adds the value held in 
a register to it, and stores the result back to memory. 


à STADDB has no memory ordering semantics. 


$ STADDLB stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDADDB, LDADDAB, LDADDALB, LDADDLB instruction. This means that: 


. The encodings in this description are named to match the encodings of LDADDB, LDADDAB, 
LDADDALB, LDADDLB. 


s The description of LDADDB, LDADDAB, LDADDALB, LDADDLB gives the operational pseudocode for 
this instruction. 


ARMV8.1 


31 saree a ere eae 20! 16/1514 12/1110 9 L 5 a 


size opc 


No memory ordering variant 
Applies when R == 

STADDB <Ws>, [<Xn|SP>] 

is equivalent to 

LDADDB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STADDLB <Ws>, [<Xn|SP>] 

is equivalent to 

LDADDLB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDADDB, LDADDAB, LDADDALB, LDADDLB gives the operational pseudocode for this 
instruction. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.247 STADDH, STADDLH 


ARM DDI 0487E.a 
ID070919 


Atomic add on halfword in memory, without return, atomically loads a 16-bit halfword from memory, adds the value 
held in a register to it, and stores the result back to memory. 


à STADDH has no memory ordering semantics. 


$ STADDLH stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDADDH, LDADDAH, LDADDALH, LDADDLH instruction. This means that: 


. The encodings in this description are named to match the encodings of LDADDH, LDADDAH, 
LDADDALH, LDADDLH. 


$ The description of LDADDH, LDADDAH, LDADDALH, LDADDLH gives the operational pseudocode for 
this instruction. 


ARMV8.1 
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size opc 


No memory ordering variant 
Applies when R == 

STADDH <Ws>, [<Xn|SP>] 

is equivalent to 

LDADDH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STADDLH <Ws>, [<Xn|SP>] 

is equivalent to 

LDADDLH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDADDH, LDADDAH, LDADDALH, LDADDLH gives the operational pseudocode for this 
instruction. 
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C6.2 Alphabetical list of A64 base instructions 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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A64 Base Instruction Descriptions 


C6.2 Alphabetical list of A64 base instructions 


C6.2.248 STADD, STADDL 


ARM DDI 0487E.a 
ID070919 


Atomic add on word or doubleword in memory, without return, atomically loads a 32-bit word or 64-bit doubleword 
from memory, adds the value held in a register to it, and stores the result back to memory. 


à STADD has no memory ordering semantics. 


$ STADDL stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 


Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDADD, LDADDA, LDADDAL, LDADDL instruction. This means that: 


. The encodings in this description are named to match the encodings of LDADD, LDADDA, LDADDAL, 


LDADDL. 
$ The description of LDADD, LDADDA, LDADDAL, LDADDL gives the operational pseudocode for this 
instruction. 
ARMv8.1 
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size opc 


32-bit LDADD alias variant 
Applies when size == 10 && R == 
STADD <Ws>, [<Xn|SP>] 

is equivalent to 

LDADD <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


32-bit LDADDL alias variant 
Applies when size == 10 && R == 
STADDL <Ws>, [<Xn|SP>] 

is equivalent to 

LDADDL <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


64-bit LDADD alias variant 
Applies when size == 11 && R == 
STADD <Xs>, [<Xn|SP>] 

is equivalent to 

LDADD <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


64-bit LDADDL alias variant 
Applies when size == 11 && R == 
STADDL <Xs>, [<Xn|SP>] 

is equivalent to 

LDADDL <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 

The description of LDADD, LDADDA, LDADDAL, LDADDL gives the operational pseudocode for this 
instruction. 

Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.249 STCLRB, STCLRLB 


ARM DDI 0487E.a 
ID070919 


Atomic bit clear on byte in memory, without return, atomically loads an 8-bit byte from memory, performs a bitwise 
AND with the complement of the value held in a register on it, and stores the result back to memory. 


à STCLRB has no memory ordering semantics. 


$ STCLRLB stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDCLRB, LDCLRAB, LDCLRALB, LDCLRLB instruction. This means that: 


. The encodings in this description are named to match the encodings of LDCLRB, LDCLRAB, LDCLRALB, 
LDCLRLB. 


. The description of LDCLRB, LDCLRAB, LDCLRALB, LDCLRLB gives the operational pseudocode for 
this instruction. 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


TA t tole ole CEA Tole ooo eT TT 


size opc 


No memory ordering variant 
Applies when R == 

STCLRB <Ws>, [<Xn|SP>] 

is equivalent to 

LDCLRB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STCLRLB <Ws>, [<Xn|SP>] 

is equivalent to 

LDCLRLB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDCLRB, LDCLRAB, LDCLRALB, LDCLRLB gives the operational pseudocode for this 
instruction. 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.250 STCLRH, STCLRLH 


ARM DDI 0487E.a 
ID070919 


Atomic bit clear on halfword in memory, without return, atomically loads a 16-bit halfword from memory, performs 
a bitwise AND with the complement of the value held in a register on it, and stores the result back to memory. 


à STCLRH has no memory ordering semantics. 


$ STCLRLH stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDCLRH, LDCLRAH, LDCLRALH, LDCLRLH instruction. This means that: 


. The encodings in this description are named to match the encodings of LDCLRH, LDCLRAH, LDCLRALH, 
LDCLRLH. 


. The description of LDCLRH, LDCLRAH, LDCLRALH, LDCLRLH gives the operational pseudocode for 
this instruction. 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


TI EIC CACT EA S C C eT eT 


size opc 


No memory ordering variant 
Applies when R == 

STCLRH <Ws>, [<Xn|SP>] 

is equivalent to 

LDCLRH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STCLRLH <Ws>, [<Xn|SP>] 

is equivalent to 

LDCLRLH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDCLRH, LDCLRAH, LDCLRALH, LDCLRLH gives the operational pseudocode for this 
instruction. 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.251 STCLR, STCLRL 


ARM DDI 0487E.a 
ID070919 


Atomic bit clear on word or doubleword in memory, without return, atomically loads a 32-bit word or 64-bit 
doubleword from memory, performs a bitwise AND with the complement of the value held in a register on it, and 
stores the result back to memory. 


` STCLR has no memory ordering semantics. 


7 STCLRL stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDCLR, LDCLRA, LDCLRAL, LDCLRL instruction. This means that: 


s The encodings in this description are named to match the encodings of LDCLR, LDCLRA, LDCLRAL, 


LDCLRL. 
° The description of LDCLR, LDCLRA, LDCLRAL, LDCLRL gives the operational pseudocode for this 
instruction. 
ARMV8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 1611514 12/11109 | 5 4| 0 | 
[t_x]1 1 tfojo ofof/Rii] Rs jojo o tjo of Rn [11111 
size A opc Rt 


32-bit LDCLR alias variant 
Applies when size == 10 && R == 0. 
STCLR <Ws>, [<Xn|SP>] 

is equivalent to 

LDCLR <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


32-bit LDCLRL alias variant 
Applies when size == 10 && R == 1. 
STCLRL <Ws>, [<Xn|SP>] 

is equivalent to 

LDCLRL <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


64-bit LDCLR alias variant 
Applies when size == 11 && R == 
STCLR <Xs>, [<Xn|SP>] 

is equivalent to 

LDCLR <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 
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64-bit LDCLRL alias variant 
Applies when size == 11 && R == 
STCLRL <Xs>, [<Xn|SP>] 

is equivalent to 

LDCLRL <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDCLR, LDCLRA, LDCLRAL, LDCLRL gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.252  STEORB, STEORLB 


ARM DDI 0487E.a 
ID070919 


Atomic exclusive OR on byte in memory, without return, atomically loads an 8-bit byte from memory, performs an 
exclusive OR with the value held in a register on it, and stores the result back to memory. 


à STEORB has no memory ordering semantics. 


$ STEORLB stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDEORB, LDEORAB, LDEORALB, LDEORLB instruction. This means that: 


. The encodings in this description are named to match the encodings of LDEORB, LDEORAB, LDEORALB, 
LDEORLB. 


. The description of LDEORB, LDEORAB, LDEORALB, LDEORLB gives the operational pseudocode for 
this instruction. 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


TA OKKA C CACT EA TooToo om [TT 


size opc 


No memory ordering variant 
Applies when R == 

STEORB <Ws>, [<Xn|SP>] 

is equivalent to 

LDEORB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STEORLB <Ws>, [<Xn|SP>] 

is equivalent to 

LDEORLB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDEORB, LDEORAB, LDEORALB, LDEORLB gives the operational pseudocode for this 
instruction. 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.253 STEORH, STEORLH 


ARM DDI 0487E.a 
ID070919 


Atomic exclusive OR on halfword in memory, without return, atomically loads a 16-bit halfword from memory, 
performs an exclusive OR with the value held in a register on it, and stores the result back to memory. 


à STEORH has no memory ordering semantics. 


$ STEORLH stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDEORH, LDEORAH, LDEORALH, LDEORLH instruction. This means that: 


. The encodings in this description are named to match the encodings of LDEORH, LDEORAH, 
LDEORALH, LDEORLH. 


. The description of LDEORH, LDEORAH, LDEORALH, LDEORLH gives the operational pseudocode for 
this instruction. 


ARMv8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


er KKI CACT EA Toe Too oe [TT 


size opc 


No memory ordering variant 
Applies when R == 

STEORH <Ws>, [<Xn|SP>] 

is equivalent to 

LDEORH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STEORLH <Ws>, [<Xn|SP>] 

is equivalent to 

LDEORLH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDEORH, LDEORAH, LDEORALH, LDEORLH gives the operational pseudocode for this 
instruction. 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.254 STEOR, STEORL 


ARM DDI 0487E.a 
ID070919 


Atomic exclusive OR on word or doubleword in memory, without return, atomically loads a 32-bit word or 64-bit 
doubleword from memory, performs an exclusive OR with the value held in a register on it, and stores the result 
back to memory. 


è STEOR has no memory ordering semantics. 


$ STEORL stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDEOR, LDEORA, LDEORAL, LDEORL instruction. This means that: 


s The encodings in this description are named to match the encodings of LDEOR, LDEORA, LDEORAL, 


LDEORL. 
° The description of LDEOR, LDEORA, LDEORAL, LDEORL gives the operational pseudocode for this 
instruction. 
ARMVv8.1 
|31 30 29 28|27 26 25 24/23 22 21 20) 16/1514 12/11109 | 5 4| 0 | 
[1 xli 1 tfojo ofofRii] Rs jojo 1 ojo of Rn [11111 
size A opc Rt 


32-bit LDEOR alias variant 
Applies when size == 10 && R == 0. 
STEOR <Ws>, [<Xn|SP>] 

is equivalent to 

LDEOR <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


32-bit LDEORL alias variant 
Applies when size == 10 && R == 1. 
STEORL <Ws>, [<Xn|SP>] 

is equivalent to 

LDEORL <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


64-bit LDEOR alias variant 
Applies when size == 11 && R == 
STEOR <Xs>, [<Xn|SP>] 

is equivalent to 

LDEOR <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 
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64-bit LDEORL alias variant 
Applies when size == 11 && R == 
STEORL <Xs>, [<Xn|SP>] 

is equivalent to 

LDEORL <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDEOR, LDEORA, LDEORAL, LDEORL gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.255 STG 


Store Allocation Tag stores an Allocation Tag to memory. The address used for the store is calculated from the base 
register and an immediate signed offset scaled by the Tag granule. The Allocation Tag is calculated from the Logical 
Address Tag in the source register. 


This instruction generates an Unchecked access. 


Post-index 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


1101100 tfojolr] immo fojit x» ft 


Post-index variant 


STG <Xt|SP>, [<Xn|SP>], #<simm> 


Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = TRUE; 


Pre-index 


ARMVv8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


1101100 tfojoli] immo fttst xn Tt 


Pre-index variant 


STG <Xt|SP>, [<Xn|SP>, #<simm>] ! 


Decode for this encoding 

integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = FALSE; 

Signed offset 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


11071700 4fofof1] immo fijo xn | xt 


Signed offset variant 


STG <Xt|SP>, [<Xn|SP>{, #<simm>}] 
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Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = FALSE; 

boolean postindex = FALSE; 


Assembler symbols 


<Xt | SP> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Xt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Xn" field. 
<simm> Is the optional signed immediate offset, a multiple of 16 in the range -4096 to 4080, defaulting to 0 


and encoded in the "imm9" field. 


Operation for all encodings 
bits(64) address; 
SetNotTagCheckedInstruction(TRUE) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


bits(64) data = if t == 31 then SP[] else X[t]; 
bits(4) tag = AArch64.AllocationTagFromAddress (data); 
AArch64.MemTag[address] = tag; 


if writeback then 
if postindex then 
address = address + offset; 


if n == 31 then 
SP[] = address; 
else 
X[n] = address; 
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C6.2.256 STGM 


ARM DDI 0487E.a 
ID070919 


Store Tag Multiple writes a naturally aligned block of N Allocation Tags, where the size of N is identified in 
GMID_EL1.BS, and the Allocation Tag written to address A is taken from the source register at 
4*A<7:4>+3:4* A<7:4>. 


This instruction is UNDEFINED at ELO. 
This instruction generates an Unchecked access. 


This instruction is Unallocated when ID_AA64PFR1_EL1.MTE == 0b0001. 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


[1 to 1100 a{tfoftjofojofojofojofofojofoy xn | x | 


Integer variant 


STGM <Xt>, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Xt); 
integer n = UInt(Xn); 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Xt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Xn" field. 
Operation 


if PSTATE.EL == ELO then 
UndefinedFault(); 


bits(64) data = X[t]; 
bits(64) address; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


integer size = 4 » (2 A (UInt(GMID_EL1.BS))); 

address = Align(address, size); 

integer count = size >> LOG2_TAG_GRANULE; 

integer index = UInt(address<LOG2_TAG_GRANULE+3 : LOG2_TAG_GRANULE>) ; 


for i = 0 to count-1 
bits(4) tag = data<(index«4)+3:indexs4>; 
AArch64.MemTag[address] = tag; 
address = address + TAG_GRANULE; 
index = index + 1; 
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C6.2.257 


C6-1210 


STGP 


Store Allocation Tag and Pair of registers stores an Allocation Tag and two 64-bit doublewords to memory, from 
two registers. The address used for the store is calculated from the base register and an immediate signed offset 
scaled by the Tag granule. The Allocation Tag is calculated from the Logical Address Tag in the base register. 


This instruction generates an Unchecked access. 


Post-index 


ARMVv8.5 


|31 30 29 28/27 26 25 24|23 2221 | |1514 | 109 | 5 4| 0 | 


folt]1 o 1fofo o ajo] simmz | x2 | x» | x | 


Post-index variant 


STGP <Xt1l>, <Xt2>, [<Xn|SP>], #<imm> 


Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

integer t2 = UInt(Xt2); 

bits(64) offset = LSL(SignExtend(simm7, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = TRUE; 


Pre-index 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 | |1514 | 109 | 5 4| 0 | 


ofala o tfofo 14 1jof smmz | x2 | x Tt 


Pre-index variant 


STGP <Xtl>, <Xt2>, [<Xn|SP>, #<imm>]! 


Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

integer t2 = UInt(Xt2); 

bits(64) offset = LSL(SignExtend(simm7, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = FALSE; 


Signed offset 
ARMvV8.5 


|31 30 29 28|27 26 25 24/23 22 21 | |1514 | 109 | 5 4| 0 | 


on ooo 7 fo] om | xe | x | ™ | 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


A64 Base Instruction Descriptions 


C6.2 Alphabetical list of A64 base instructions 


Signed offset variant 


STGP <Xtl>, <Xt2>, [<Xn|SP>{, #<imm>}] 


Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

integer t2 = UInt(Xt2); 

bits(64) offset = LSL(SignExtend(simm7, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = FALSE; 

boolean postindex = FALSE; 


Assembler symbols 


<Xt1> Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Xt" field. 

<Xt2> Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Xt2" 
field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Xn" field. 

<imm> For the post-index and pre-index variant: is the signed immediate offset, a multiple of 16 in the range 


-1024 to 1008, encoded in the "simm7" field. 


For the signed offset variant: is the optional signed immediate offset, a multiple of 16 in the range 


-1024 to 1008, defaulting to 0 and encoded in the "simm7" field. 


Operation for all encodings 


bits(64) address; 
bits(64) datal; 
bits(64) data2; 


SetNotTagCheckedInstruction(TRUE) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


datal = X[t]; 
data2 = X[t2]; 


if !postindex then 
address = address + offset; 


Mem[address, 8, AccType_NORMAL] = data1; 
Mem[address+8, 8, AccType_NORMAL] = data2; 


AArch64.MemTag[address] = AArch64.AllocationTagFromAddress(address) ; 


if writeback then 
if postindex then 
address = address + offset; 


if n == 31 then 
SP[] = address; 
else 
X[n] = address; 
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C6.2.258 


C6-1212 


STLLRB 


Store LORelease Register Byte stores a byte from a 32-bit register to a memory location. The instruction also has 
memory ordering semantics as described in LoadLOAcquire, StoreLORelease on page B2-130. For information 
about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMV8.1 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 = 5 4| 0| 


o olo o 100 olrjoloknmmamiokn MNA T E T E 


size Rt2 


No offset variant 


STLLRB <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data = X[t]; 
Mem[address, 1, AccType_LIMITEDORDERED] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.259 STLLRH 


ARM DDI 0487E.a 
ID070919 


Store LORelease Register Halfword stores a halfword from a 32-bit register to a memory location. The instruction 
also has memory ordering semantics as described in LoadLOAcquire, StoreLORelease on page B2-130. For 
information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMV8.1 
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size Rt2 


No offset variant 


STLLRH <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data = X[t]; 
Mem[address, 2, AccType_LIMITEDORDERED] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.260 


C6-1214 


STLLR 


Store LORelease Register stores a 32-bit word or a 64-bit doubleword to a memory location, from a register. The 
instruction also has memory ordering semantics as described in LoadLOAcquire, StoreLORelease on page B2-130. 
For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMV8.1 
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size Rt2 


32-bit variant 
Applies when size == 10. 


STLLR <Wt>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when size == 11. 


STLLR <Xt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


integer elsize = 8 << UInt(size); 
boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(elsize) data; 
constant integer dbytes = elsize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data = X[t]; 
Mem[address, dbytes, AccType_LIMITEDORDERED] = data; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.261 STLR 


Store-Release Register stores a 32-bit word or a 64-bit doubleword to a memory location, from a register. The 
instruction also has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| res L 5 4| 0 | 
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size Rt2 


32-bit variant 
Applies when size == 10. 


STLR <Wt>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when size == 11. 


STLR <Xt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


integer elsize = 8 << UInt(size); 
boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(elsize) data; 
constant integer dbytes = elsize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data = X[t]; 
Mem[address, dbytes, AccType_ORDERED] = data; 
Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


C6-1216 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.262 STLRB 


Store-Release Register Byte stores a byte from a 32-bit register to a memory location. The instruction also has 
memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. 
For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| res L 5 4| 0 | 
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size Rt2 


No offset variant 


STLRB <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data = X[t]; 
Mem[address, 1, AccType_ORDERED] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.263 STLRH 


Store-Release Register Halfword stores a halfword from a 32-bit register to a memory location. The instruction also 
has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| res L 5 4| 0 | 
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size Rt2 


No offset variant 


STLRH <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


data = X[t]; 
Mem[address, 2, AccType_ORDERED] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.264 STLUR 
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Store-Release Register (unscaled) calculates an address from a base register value and an immediate offset, and 
stores a 32-bit word or a 64-bit doubleword to the calculated address, from a register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 


on page B2-129 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


5 4| o| 


ARMv8.4 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12\11109 | 
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size opc 

32-bit variant 


Applies when size == 10. 


STLUR <Wt>, [<Xn|SP>{, #<simm>}] 


64-bit variant 
Applies when size == 11. 


STLUR <Xt>, [<Xn|SP>{, #<simm>}] 


Decode for all variants of this encoding 


integer scale = UInt(size); 
bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


integer datasize = 8 << scale; 
boolean tag_checked = n != 31; 
Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(datasize) data; 


if n == 31 then 
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CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 
address = address + offset; 
data = X[t]; 
Mem[address, datasize DIV 8, AccType_ORDERED] = data; 
Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.265 STLURB 


ARM DDI 0487E.a 
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Store-Release Register Byte (unscaled) calculates an address from a base register value and an immediate offset, 
and stores a byte to the calculated address, from a 32-bit register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMv8.4 


[31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0| 
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size opc 


Unscaled offset variant 


STLURB <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


data = X[t]; 
Mem[address, 1, AccType_ORDERED] = data; 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.266 STLURH 


ARM DDI 0487E.a 
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Store-Release Register Halfword (unscaled) calculates an address from a base register value and an immediate 
offset, and stores a halfword to the calculated address, from a 32-bit register. 


The instruction has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129 


For information about memory accesses, see Load/Store addressing modes on page C1-177. 


ARMv8.4 


[31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0| 
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size opc 


Unscaled offset variant 


STLURH <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


data = X[t]; 
Mem[address, 2, AccType_ORDERED] = data; 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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Store-Release Exclusive Pair of registers stores two 32-bit words or two 64-bit doublewords to a memory location 
if the PE has exclusive access to the memory address, from two registers, and returns a status value of 0 if the store 
was successful, or of 1 if no store was performed. See Synchronization and semaphores on page B2-156. A 32-bit 
pair requires the address to be doubleword aligned and is single-copy atomic at doubleword granularity. A 64-bit 
pair requires the address to be quadword aligned and, if the Store-Exclusive succeeds, it causes a single-copy atomic 
update of the 128-bit memory location being updated. The instruction also has memory ordering semantics as 
described in Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. For information about memory 
accesses see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 
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32-bit variant 


Applies when sz == 


STLXP <Ws>, <Wtl>, <Wt2>, [<Xn|SP>{,#0}] 


64-bit variant 


Applies when sz == 


STLXP <Ws>, <Xtl>, <Xt2>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n = 
integer t = 
integer t 
integer s = 


integer 
integer 
boolean 


UInt(Rn) ; 
UInt (Rt) ; 

= UInt(Rt2); // ignored by load/store single register 
UInt(Rs); // ignored by all loads and store-release 


elsize = 32 << UInt(sz); 
datasize = elsize « 2; 
tag_checked = n != 31; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly STLXP on page K1-7641. 


Assembler symbols 


<Ws> 


<Xtl> 


<Xt2> 


<Wt1> 


<Wt2> 


Is the 32-bit name of the general-purpose register into which the status result of the store exclusive 
is written, encoded in the "Rs" field. The value returned is: 


() If the operation updates memory. 


1 If the operation fails to update memory. 
Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 


Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 


Is the 32-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 


Is the 32-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 
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C6-1226 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Aborts and alignment 

If a synchronous Data Abort exception is generated by the execution of this instruction: 

° Memory is not updated. 

° <Ws> is not updated. 


Accessing an address that is not aligned to the size of the data being accessed causes an Alignment fault Data Abort 
exception to be generated, subject to the following rules: 


° If AArch64.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
$ Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch64.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation 


bits(64) address; 

bits(datasize) data; 

constant integer dbytes = datasize DIV 8; 
boolean rt_unknown = FALSE; 

boolean rn_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if s == t || (s == t2) then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint UNKNOWN, Constraint NONE, Constraint UNDEF, Constraint NOP}; 


case c of 
when Constraint UNKNOWN rt_unknown = TRUE; // store UNKNOWN value 
when Constraint NONE rt_unknown = FALSE; // store original value 
when Constraint UNDEF UNDEFINED; 
when Constraint NOP EndOfInstruction(); 


if s == n && n != 31 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_NONE, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_UNKNOWN rn_unknown = TRUE; // address is UNKNOWN 
when Constraint_NONE rn_unknown = FALSE; // address is original base 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
elsif rn_unknown then 
address = bits(64) UNKNOWN; 
else 
address = X[n]; 


if rt_unknown then 
data = bits(datasize) UNKNOWN; 
else 
bits(datasize DIV 2) ell = X[t]; 
bits(datasize DIV 2) el2 = X[t2]; 
data = if BigEndian() then ell:el2 else el2:e11; 
bit status = '1'; 
// Check whether the Exclusives monitors are set to include the 
// physical memory locations corresponding to virtual address 
// range [address, address+dbytes-1]. 
if AArch64.ExclusiveMonitorsPass(address, dbytes) then 
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// This atomic write will be rejected if it does not refer 
// to the same physical locations after address translation. 
Mem[address, dbytes, AccType_ORDEREDATOMIC] = data; 
status = ExclusiveMonitorsStatus(); 

X[s] = ZeroExtend(status, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.268 


C6-1228 


STLXR 


Store-Release Exclusive Register stores a 32-bit word or a 64-bit doubleword to memory if the PE has exclusive 
access to the memory address, from two registers, and returns a status value of 0 if the store was successful, or of 1 
if no store was performed. See Synchronization and semaphores on page B2-156. The memory access is atomic. 
The instruction also has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. For information about memory accesses see Load/Store addressing modes on 
page C1-177. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 = 5 4| 0 | 
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size Rt2 


32-bit variant 
Applies when size == 10. 


STLXR <Ws>, <Wt>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when size == 11. 


STLXR <Ws>, <Xt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer s = UInt(Rs); // ignored by all loads and store-release 


integer elsize = 8 << UInt(size); 
boolean tag_checked = n != 31; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly STLXR on page K1-7641. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register into which the status result of the store exclusive 
is written, encoded in the "Rs" field. The value returned is: 
() If the operation updates memory. 
al If the operation fails to update memory. 

<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Aborts and alignment 


If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 


° <Ws> is not updated. 
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Accessing an address that is not aligned to the size of the data being accessed causes an Alignment fault Data Abort 
exception to be generated, subject to the following rules: 


° If AArch64.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
° Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch64.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation 


bits(64) address; 

bits(elsize) data; 

constant integer dbytes = elsize DIV 8; 
boolean rt_unknown = FALSE; 

boolean rn_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked); 


if s == t then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint UNKNOWN, Constraint NONE, Constraint UNDEF, Constraint NOP}; 


case c of 
when Constraint UNKNOWN rt_unknown = TRUE; // store UNKNOWN value 
when Constraint NONE rt_unknown = FALSE; // store original value 
when Constraint UNDEF UNDEFINED; 
when Constraint NOP EndOfInstruction(); 


if s == n && n != 31 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint UNKNOWN, Constraint NONE, Constraint UNDEF, Constraint NOP}; 


case c of 
when Constraint UNKNOWN rn_unknown = TRUE; // address is UNKNOWN 
when Constraint NONE rn_unknown = FALSE; // address is original base 
when Constraint UNDEF UNDEFINED; 
when Constraint NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
elsif rn_unknown then 
address = bits(64) UNKNOWN; 
else 
address = X[n]; 


if rt_unknown then 

data = bits(elsize) UNKNOWN; 
else 

data = X[t]; 


bit status = '1'; 
// Check whether the Exclusives monitors are set to include the 
// physical memory locations corresponding to virtual address 
// range [address, address+dbytes-1]. 
if AArch64.ExclusiveMonitorsPass(address, dbytes) then 
// This atomic write will be rejected if it does not refer 
// to the same physical locations after address translation. 
Mem[address, dbytes, AccType_ORDEREDATOMIC] = data; 
status = ExclusiveMonitorsStatus(); 
X[s] = ZeroExtend(status, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.269 


C6-1230 


STLXRB 


Store-Release Exclusive Register Byte stores a byte from a 32-bit register to memory if the PE has exclusive access 
to the memory address, and returns a status value of 0 if the store was successful, or of 1 if no store was performed. 
See Synchronization and semaphores on page B2-156. The memory access is atomic. The instruction also has 
memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release on page B2-129. 
For information about memory accesses see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 l- 10 9 5 4| 0 | 


eoleo 40 0 ofojofo} rs lio OK o e 


size Rt2 


No offset variant 


STLXRB <Ws>, <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer s = UInt(Rs); // ignored by all loads and store-release 


boolean tag_checked = n != 31; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly STLXRB on page K1-7642. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register into which the status result of the store exclusive 
is written, encoded in the "Rs" field. The value returned is: 
0 If the operation updates memory. 
1 If the operation fails to update memory. 

<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Aborts 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

° <Ws> is not updated. 


If AArch64.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation 


bits(64) address; 

bits(8) data; 

boolean rt_unknown = FALSE; 
boolean rn_unknown = FALSE; 


if HaveMTEExt() then 
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SetNotTagCheckedInstruction(!tag_checked) ; 


if s == t then 
Constraint c = ConstrainUnpredictable(); 


assert c IN {Constraint_UNKNOWN, Constraint_NONE, 


case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; 
when Constraint_NONE rt_unknown = FALSE; 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if s == n && n != 31 then 
Constraint c = ConstrainUnpredictable(); 


assert c IN {Constraint_UNKNOWN, Constraint_NONE, 


case c of 
when Constraint_UNKNOWN rn_unknown = TRUE; 
when Constraint_NONE rn_unknown = FALSE; 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
elsif rn_unknown then 
address = bits(64) UNKNOWN; 
else 
address = X[n]; 


if rt_unknown then 

data = bits(8) UNKNOWN; 
else 

data = X[t]; 


bit status = '1'; 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Constraint_UNDEF, Constraint_NOP}; 


// store UNKNOWN value 
// store original value 


Constraint_UNDEF, Constraint_NOP}; 


// address is UNKNOWN 
// address is original base 


// Check whether the Exclusives monitors are set to include the 
// physical memory locations corresponding to virtual address 


// range [address, address+dbytes-1]. 
if AArch64.ExclusiveMonitorsPass(address, 1) then 


// This atomic write will be rejected if it does not refer 
// to the same physical locations after address translation. 


Mem[address, 1, AccType_ORDEREDATOMIC] = data; 
status = ExclusiveMonitorsStatus(); 
X[s] = ZeroExtend(status, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.270 


C6-1232 


STLXRH 


Store-Release Exclusive Register Halfword stores a halfword from a 32-bit register to memory if the PE has 
exclusive access to the memory address, and returns a status value of 0 if the store was successful, or of 1 ifno store 
was performed. See Synchronization and semaphores on page B2-156. The memory access is atomic. The 
instruction also has memory ordering semantics as described in Load-Acquire, Load-AcquirePC, and Store-Release 
on page B2-129. For information about memory accesses see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 l- 10 9 5 4| 0 | 


ele 0 40 0 ojojoj] rs tio OK o e 


size Rt2 


No offset variant 


STLXRH <Ws>, <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer s = UInt(Rs); // ignored by all loads and store-release 


boolean tag_checked = n != 31; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly STLXRH on page K1-7642. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register into which the status result of the store exclusive 
is written, encoded in the "Rs" field. The value returned is: 
0 If the operation updates memory. 
1 If the operation fails to update memory. 

<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Aborts and alignment 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

° <Ws> is not updated. 


A non halfword-aligned memory address causes an Alignment fault Data Abort exception to be generated, subject 
to the following rules: 


° If AArch64.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
$ Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch64.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 
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Operation 


bits(64) address; 

bits(16) data; 

boolean rt_unknown = FALSE; 
boolean rn_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if s == t then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_NONE, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; // store UNKNOWN value 
when Constraint_NONE rt_unknown = FALSE; // store original value 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if s == n && n != 31 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_NONE, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_UNKNOWN rn_unknown = TRUE; // address is UNKNOWN 
when Constraint_NONE rn_unknown = FALSE; // address is original base 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
elsif rn_unknown then 
address = bits(64) UNKNOWN; 
else 
address = X[n]; 


if rt_unknown then 

data = bits(16) UNKNOWN; 
else 

data = X[t]; 


bit status = '1'; 
// Check whether the Exclusives monitors are set to include the 
// physical memory locations corresponding to virtual address 
// range [address, address+dbytes-1]. 
if AArch64.ExclusiveMonitorsPass(address, 2) then 
// This atomic write will be rejected if it does not refer 
// to the same physical locations after address translation. 
Mem[address, 2, AccType_ORDEREDATOMIC] = data; 
status = ExclusiveMonitorsStatus(); 
X[s] = ZeroExtend(status, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.271 


C6-1234 


STNP 


Store Pair of Registers, with non-temporal hint, calculates an address from a base register value and an immediate 
offset, and stores two 32-bit words or two 64-bit doublewords to the calculated address, from two registers. For 
information about memory accesses, see Load/Store addressing modes on page C1-177. For information about 
Non-temporal pair instructions, see Load/Store Non-temporal Pair on page C3-200. 


|31 30 29 28/27 26 25 24|23 2221 | |1514 | 109 | 5 4| 0 | 


fot oojo oojo] mm? | Re | m | Rt 


opc L 


32-bit variant 

Applies when opc == 00. 

STNP <Wtl>, <Wt2>, [<Xn|SP>{, #<imm>}] 
64-bit variant 

Applies when opc == 10. 

STNP <Xt1>, <Xt2>, [<Xn|SP>{, #<imm>}] 
Decode for all variants of this encoding 


// Empty. 


Assembler symbols 


<Wtl> Is the 32-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Wt2> Is the 32-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xt1> Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 

<Xt2> Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 

<imm> For the 32-bit variant: is the optional signed immediate byte offset, a multiple of 4 in the range -256 


to 252, defaulting to 0 and encoded in the "imm7" field as <imm>/4. 


For the 64-bit variant: is the optional signed immediate byte offset, a multiple of 8 in the range -512 
to 504, defaulting to 0 and encoded in the "imm7" field as <imm>/8. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer t2 = UInt(Rt2); 

if opc<@> == '1' then UNDEFINED; 

integer scale = 2 + UInt(opc<1>); 

integer datasize = 8 << scale; 

bits(64) offset = LSL(SignExtend(imm7, 64), scale); 
boolean tag_checked = n != 31; 
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Operation 


bits(64) address; 

bits(datasize) datal; 

bits(datasize) data2; 

constant integer dbytes = datasize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 
datal = X[t]; 


data2 = X[t2]; 
Mem[address, dbytes, AccType_STREAM] = data1; 


Mem[address+dbytes, dbytes, AccType_STREAM] = data2; 


Operational information 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.272 


C6-1236 


STP 


Store Pair of Registers calculates an address from a base register value and an immediate offset, and stores two 
32-bit words or two 64-bit doublewords to the calculated address, from two registers. For information about 
memory accesses, see Load/Store addressing modes on page C1-177. 


Post-index 


|31 30 29 2827 26 25 24|23 2221 | 


|1514 


109 | 


5 4| 


o | 


[x o]1 o tfofo o ijo] imm | R2? | Rmn | R | 


opc L 


32-bit variant 

Applies when opc == 00. 

STP <Wtl>, <Wt2>, [<Xn|SP>], #<imm> 

64-bit variant 

Applies when opc == 10. 

STP <Xtl>, <Xt2>, [<Xn|SP>], #<imm> 
Decode for all variants of this encoding 


boolean whack = TRUE; 
boolean postindex = TRUE; 


Pre-index 


|31 30 29 28|27 26 25 24/23 22 21 | 


|1514 


109 | 


5 4| 


o| 


cop orooro] mm | Re | m | Rt 


opc L 


32-bit variant 

Applies when opc == 00. 

STP <Wtl>, <Wt2>, [<Xn|SP>, #<imm>]! 

64-bit variant 

Applies when opc == 10. 

STP <Xtl>, <Xt2>, [<Xn|SP>, #<imm>]! 

Decode for all variants of this encoding 
boolean whack = TRUE; 
boolean postindex = FALSE; 


Signed offset 


|31 30 29 28|27 26 25 24/23 22 21 | 


|1514 


109 | 


54| 


o| 


[x ojs o tfofo 1 ojo] imm | R2? | Rn | R | 


opc L 
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32-bit variant 


Applies when opc == 00. 


STP <Wtl>, <Wt2>, [<Xn|SP>{, #<imm>}] 


64-bit variant 


Applies when opc == 10. 


STP <Xtl>, <Xt2>, [<Xn|SP>{, #<imm>}] 


Decode for all variants of this encoding 


boolean whack = FALSE; 
boolean postindex = FALSE; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly STP on page K1-7641. 


Assembler symbols 


<Wt1> 


<Wt2> 


<Xtl> 


<Xt2> 


<Xn | SP> 


<imm> 


Is the 32-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 


Is the 32-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 


Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 


Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 


Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
For the 32-bit post-index and 32-bit pre-index variant: is the signed immediate byte offset, a 
multiple of 4 in the range -256 to 252, encoded in the "imm7" field as <imm>/4. 


For the 32-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 4 in 
the range -256 to 252, defaulting to 0 and encoded in the "imm7" field as <imm>/4. 


For the 64-bit post-index and 64-bit pre-index variant: is the signed immediate byte offset, a 
multiple of 8 in the range -512 to 504, encoded in the "imm7" field as <imm>/8. 


For the 64-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 8 in 
the range -512 to 504, defaulting to 0 and encoded in the "imm7" field as <imm>/8. 


Shared decode for all encodings 


integer n 
integer t = 


integer t2 = 


if L:opc<@> 


UInt(Rn); 

UInt(Rt); 

UInt(Rt2); 

== 'Q1' || opc == '11' then UNDEFINED; 


integer scale = 2 + UInt(opc<1>); 
integer datasize = 8 << scale; 
bits(64) offset = LSL(SignExtend(imm7, 64), scale); 


boolean tag_ 


checked = wback || n != 31; 


Operation for all encodings 


bits(64) address; 

bits(datasize) data1; 

bits(datasize) data2; 

constant integer dbytes = datasize DIV 8; 
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C6-1238 


boolean rt_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if whack && (t == n || t2 == n) & n != 31 then 
Constraint c = ConstrainUnpredictable(); 


assert c IN {Constraint_NONE, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_NONE rt_unknown = FALSE; 
when Constraint_UNKNOWN rt_unknown = TRUE; 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


if rt_unknown && t == n then 
datal = bits(datasize) UNKNOWN; 
else 
datal = X[t]; 
if rt_unknown && t2 == n then 
data2 = bits(datasize) UNKNOWN; 
else 
data2 = X[t2]; 
Mem[address, dbytes, AccType_NORMAL] = data1; 
Mem[address+dbytes, dbytes, AccType_NORMAL] = data2; 


if whack then 
if postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


Operational information 


// value stored is pre-writeback 
// value stored is UNKNOWN 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.273 STR (immediate) 


Store Register (immediate) stores a word or a doubleword from a register to memory. The address that is used for 
the store is calculated from a base register and an immediate offset. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
[1 x]11 tfofo ofo ofo] imma fo tf R | R | 
size opc 


32-bit variant 
Applies when size == 10. 


STR <Wt>, [<Xn|SP>], #<simm> 


64-bit variant 
Applies when size == 11. 


STR <Xt>, [<Xn|SP>], #<simm> 


Decode for all variants of this encoding 


boolean wback = TRUE; 

boolean postindex = TRUE; 

integer scale = UInt(size); 

bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0| 
[1 xla 1 tfofo ofo ofo] imma tt tt R | R | 
size opc 


32-bit variant 
Applies when size == 10. 


STR <Wt>, [<Xn|SP>, #<simm>]! 


64-bit variant 
Applies when size == 11. 


STR <Xt>, [<Xn|SP>, #<simm>]! 


Decode for all variants of this encoding 


boolean wback = TRUE; 

boolean postindex = FALSE; 

integer scale = UInt(size); 

bits(64) offset = SignExtend(imm9, 64); 
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Unsigned offset 


|31 30 29 28|27 26 25 24|23 2221 | | | 109 | 5 4| 0 | 


xf 1 opoo m | m | e | 


size opc 


32-bit variant 
Applies when size == 10. 


STR <Wt>, [<Xn|SP>{, #<pimm>}] 


64-bit variant 
Applies when size == 11. 


STR <Xt>, [<Xn|SP>{, #<pimm>}] 


Decode for all variants of this encoding 


boolean whack = FALSE; 

boolean postindex = FALSE; 

integer scale = UInt(size); 

bits(64) offset = LSL(ZeroExtend(imm12, 64), scale); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 

<pimm> For the 32-bit variant: is the optional positive immediate byte offset, a multiple of 4 in the range 0 


to 16380, defaulting to 0 and encoded in the "imm12" field as <pimm>/4. 


For the 64-bit variant: is the optional positive immediate byte offset, a multiple of 8 in the range 0 
to 32760, defaulting to 0 and encoded in the "imm12" field as <pimm>/8. 
Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


integer datasize = 8 << scale; 
boolean tag_checked = whack || n != 31; 
Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(datasize) data; 


boolean rt_unknown = FALSE; 
if whack && n == t && n != 31 then 


c = ConstrainUnpredictable(); 
assert c IN {Constraint_NONE, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_NONE rt_unknown = FALSE; // value stored is original value 
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when Constraint_UNKNOWN rt_unknown = TRUE; // value stored is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


if rt_unknown then 
data = bits(datasize) UNKNOWN; 
else 
data = X[t]; 
Mem[address, datasize DIV 8, AccType_NORMAL] = data; 


if whack then 
if postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 


X[n] = address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.274 STR (register) 


Store Register (register) calculates an address from a base register value and an offset register value, and stores a 
32-bit word or a 64-bit doubleword to the calculated address, from a register. For information about memory 
accesses, see Load/Store addressing modes on page C1-177. 


The instruction uses an offset addressing mode, that calculates the address used for the memory access from a base 
register value and an offset register value. The offset can be optionally shifted and extended. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/11109 | 5 4| 0 | 


7 x[7 1 iJo[o ooon] Rm [option [Ss] o] Rn | Rt 


size opc 
32-bit variant 


Applies when size == 10. 


STR <Wt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


64-bit variant 
Applies when size == 11. 


STR <Xt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


Decode for all variants of this encoding 


integer scale = UInt(size); 

if option<1> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = if S == '1' then scale else 0; 


Assembler symbols 

<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


<Wm> When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 


<Xm> When option<0> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 


<extend> Is the index extend/shift specifier, defaulting to LSL, and which must be omitted for the LSL option 
when <amount> is omitted. encoded in the "option" field. It can have the following values: 
UXTW when option = 010 
LSL when option = 011 
SXTW when option = 110 
SXTX when option = 111 
<amount> For the 32-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 


is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 


#0 when S 
#2 when S 


iT} iT} 
e © 
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For the 64-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 
is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 


values: 
#0 when S = 0 
#3 when S = 1 


Shared decode for all encodings 
integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer m = UInt(Rm); 


integer datasize = 8 << scale; 


Operation 


bits(64) offset = ExtendReg(m, extend_type, shift); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(FALSE) ; 


bits(64) address; 
bits(datasize) data; 


if n == 31 then 

CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 

address = address + offset; 

data = X[t]; 

Mem[address, datasize DIV 8, AccType_NORMAL] = data; 

Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.275 STRB (immediate) 


Store Register Byte (immediate) stores the least significant byte of a 32-bit register to memory. The address that is 
used for the store is calculated from a base register and an immediate offset. For information about memory 
accesses, see Load/Store addressing modes on page C1-177. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
[o oja 1 tfofo ofo ofo] imma ft R | R | 
size opc 


Post-index variant 


STRB <Wt>, [<Xn|SP>], #<simm> 


Decode for this encoding 


boolean wback = TRUE; 
boolean postindex = TRUE; 
bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 54| 0| 
[o ofa 1 1fojo ofo ofo] imma fii] Rmn | R | 
size opc 


Pre-index variant 


STRB <Wt>, [<Xn|SP>, #<simm>]! 


Decode for this encoding 


boolean wback = TRUE; 
boolean postindex = FALSE; 
bits(64) offset = SignExtend(imm9, 64); 


Unsigned offset 


[31 30 29 28|27 26 25 24|23 22 21 | | | 109 | 5 4| 0 | 
[o ofja 1 tfofo 1fo of immt2—— Rn | R | 
size opc 


Unsigned offset variant 


STRB <Wt>, [<Xn|SP>{, #<pimm>}] 


Decode for this encoding 


boolean whack = FALSE; 
boolean postindex = FALSE; 
bits(64) offset = LSL(ZeroExtend(imm12, 64), 0); 
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Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors, and particularly STRB (immediate) on page K1-7642. 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 

<pimm> Is the optional positive immediate byte offset, in the range 0 to 4095, defaulting to 0 and encoded 


in the "imm12" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = whack || n != 31; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


boolean rt_unknown = FALSE; 


if whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 


assert c IN {Constraint_NONE, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_NONE rt_unknown 


when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


if rt_unknown then 
data = bits(8) UNKNOWN; 
else 
data = X[t]; 
Mem[address, 1, AccType_NORMAL] = data; 


if whack then 
if postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 
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FALSE; // value stored is original value 
when Constraint_UNKNOWN rt_unknown = TRUE; // value stored is UNKNOWN 
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C6.2 Alphabetical list of A64 base instructions 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.276 STRB (register) 


Store Register Byte (register) calculates an address from a base register value and an offset register value, and stores 
a byte from a 32-bit register to the calculated address. For information about memory accesses, see Load/Store 
addressing modes on page C1-177. 


The instruction uses an offset addressing mode, that calculates the address used for the memory access from a base 
register value and an offset register value. The offset can be optionally shifted and extended. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/11109 | 5 4| 0 | 


ooj aojo ojo o] Rm |oo js 0] Rn [| Rt 


size opc 
Extended register variant 


Applies when option != 011. 


STRB <Wt>, [<Xn|SP>, (<Wm>|<Xm>), <extend> {<amount>}] 


Shifted register variant 
Applies when option == 011. 


STRB <Wt>, [<Xn|SP>, <Xm>{, LSL <amount>}] 


Decode for all variants of this encoding 


if option<1> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Wm> When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<Xm> When option<0> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<extend> Is the index extend specifier, encoded in the "option" field. It can have the following values: 
UXTW when option = 010 
SXTW when option = 110 
SXTX when option = 111 
<amount> Is the index shift amount, it must be #0, encoded in "S" as 0 if omitted, or as 1 if present. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer m = UInt(Rm); 
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C6-1248 


Operation 


bits(64) offset = ExtendReg(m, extend_type, 0); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(FALSE) ; 


bits(64) address; 
bits(8) data; 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


data = X[t]; 
Mem[address, 1, AccType_NORMAL] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.277 STRH (immediate) 


ARM DDI 0487E.a 
ID070919 


Store Register Halfword (immediate) stores the least significant halfword of a 32-bit register to memory. The 
address that is used for the store is calculated from a base register and an immediate offset. For information about 
memory accesses, see Load/Store addressing modes on page C1-177. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 
[o 1a 1 t1Jofo ofo ofo] imma fo tf R | R | 
size opc 


Post-index variant 


STRH <Wt>, [<Xn|SP>], #<simm> 


Decode for this encoding 


boolean whack = TRUE; 
boolean postindex = TRUE; 
bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 54| 0| 
[o 1{1 1 1fofo ofo ofo] imma fii] Rmn | R | 
size opc 


Pre-index variant 


STRH <Wt>, [<Xn|SP>, #<simm>]! 


Decode for this encoding 


boolean whack = TRUE; 
boolean postindex = FALSE; 
bits(64) offset = SignExtend(imm9, 64); 


Unsigned offset 


[31 30 29 28|27 26 25 24|23 22 21 | | | 109 | 5 4| 0 | 
fo fla 1 tfofo 1fo of mm2 RT 
size opc 


Unsigned offset variant 


STRH <Wt>, [<Xn|SP>{, #<pimm>}] 


Decode for this encoding 


boolean whack = FALSE; 
boolean postindex = FALSE; 
bits(64) offset = LSL(ZeroExtend(imm12, 64), 1); 
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Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly STRH (immediate) on page K1-7643. 


Assembler symbols 
<Wt> 
<Xn | SP> 
<simm> 


<pimm> 


Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 


Is the optional positive immediate byte offset, a multiple of 2 in the range 0 to 8190, defaulting to 0 


and encoded in the "imm12" field as <pimm>/2. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = wback || n != 31; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


boolean rt_unknown = FALSE; 


if whack && n == t && n != 31 then 
c = ConstrainUnpredictable(); 


assert c IN {Constraint_NONE, Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_NONE rt_unknown = FALSE; 
when Constraint_UNKNOWN rt_unknown = TRUE; 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


if rt_unknown then 
data = bits(16) UNKNOWN; 
else 
data = X[t]; 
Mem[address, 2, AccType_NORMAL] = data; 


if whack then 
if postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.278 


C6-1252 


STRH (register) 


Store Register Halfword (register) calculates an address from a base register value and an offset register value, and 
stores a halfword from a 32-bit register to the calculated address. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


The instruction uses an offset addressing mode, that calculates the address used for the memory access from a base 
register value and an offset register value. The offset can be optionally shifted and extended. 


|31 30 29 28|27 26 25 24|23 22 21 20| 1615 1312/1110 9. | 5 4| 0 | 
oa Joyo ofo oi] Rm [oons o] An | e 
size opc 
32-bit variant 


STRH <Wt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


Decode for this encoding 


if option<1> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = if S == '1' then 1 else 0; 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Wm> When option<0> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<Xm> When option<®> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 
<extend> Is the index extend/shift specifier, defaulting to LSL, and which must be omitted for the LSL option 
when <amount> is omitted. encoded in the "option" field. It can have the following values: 
UXTW when option = 010 
LSL when option = 011 
SXTW when option = 110 
SXTX when option = 111 
<amount> Is the index shift amount, optional only when <extend> is not LSL. Where it is permitted to be 
optional, it defaults to #0. It is encoded in the "S" field. It can have the following values: 
#0 when S = 0 
#1 when S = 1 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer m = UInt(Rm); 
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Operation 


bits(64) offset = ExtendReg(m, extend_type, shift); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(FALSE) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 
address = address + offset; 
data = X[t]; 
Mem[address, 2, AccType_NORMAL] = data; 
Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.279 


C6-1254 


STSETB, STSETLB 


Atomic bit set on byte in memory, without return, atomically loads an 8-bit byte from memory, performs a bitwise 
OR with the value held in a register on it, and stores the result back to memory. 


à STSETB has no memory ordering semantics. 


s STSETLB stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDSETB, LDSETAB, LDSETALB, LDSETLB instruction. This means that: 


. The encodings in this description are named to match the encodings of LDSETB, LDSETAB, LDSETALB, 


LDSETLB. 
$ The description of LDSETB, LDSETAB, LDSETALB, LDSETLB gives the operational pseudocode for this 
instruction. 
ARMv8.1 
|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/1109 | 5 4| 0 | 
TAC KIKICA CACT EA Toes C eT TT 
size opc 


No memory ordering variant 
Applies when R == 

STSETB <Ws>, [<Xn|SP>] 

is equivalent to 

LDSETB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STSETLB <Ws>, [<Xn|SP>] 

is equivalent to 

LDSETLB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDSETB, LDSETAB, LDSETALB, LDSETLB gives the operational pseudocode for this 
instruction. 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.280 


C6-1256 


STSETH, STSETLH 


Atomic bit set on halfword in memory, without return, atomically loads a 16-bit halfword from memory, performs 
a bitwise OR with the value held in a register on it, and stores the result back to memory. 


à STSETH has no memory ordering semantics. 


$ STSETLH stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDSETH, LDSETAH, LDSETALH, LDSETLH instruction. This means that: 


. The encodings in this description are named to match the encodings of LDSETH, LDSETAH, LDSETALH, 


LDSETLH. 
$ The description of LDSETH, LDSETAH, LDSETALH, LDSETLH gives the operational pseudocode for this 
instruction. 
ARMv8.1 
|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/1109 | 5 4| 0 | 
er OKKI CACT EA Toes C me [eT 
size opc 


No memory ordering variant 
Applies when R == 

STSETH <Ws>, [<Xn|SP>] 

is equivalent to 

LDSETH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STSETLH <Ws>, [<Xn|SP>] 

is equivalent to 

LDSETLH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDSETH, LDSETAH, LDSETALH, LDSETLH gives the operational pseudocode for this 
instruction. 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.281 STSET, STSETL 


Atomic bit set on word or doubleword in memory, without return, atomically loads a 32-bit word or 64-bit 
doubleword from memory, performs a bitwise OR with the value held in a register on it, and stores the result back 


to memory. 
° STSET has no memory ordering semantics. 
7 STSETL stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 


Store-Release on page B2-129. 
For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDSET, LDSETA, LDSETAL, LDSETL instruction. This means that: 


s The encodings in this description are named to match the encodings of LDSET, LDSETA, LDSETAL, 


LDSETL. 
° The description of LDSET, LDSETA, LDSETAL, LDSETL gives the operational pseudocode for this 
instruction. 
ARMv8.1 
|31 30 29 28|27 26 25 24/23 22 21 20) 16/1514 12/11109 | 


o| 


[1 xla 1 tfofo ofojrjij rs jojo 1 joo] Ra [11111 


size A opc 


32-bit LDSET alias variant 
Applies when size == 10 && R == 0. 
STSET <Ws>, [<Xn|SP>] 

is equivalent to 

LDSET <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


32-bit LDSETL alias variant 
Applies when size == 10 && R == 1. 
STSETL <Ws>, [<Xn|SP>] 

is equivalent to 

LDSETL <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


64-bit LDSET alias variant 
Applies when size == 11 && R == 
STSET <Xs>, [<Xn|SP>] 

is equivalent to 

LDSET <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 
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64-bit LDSETL alias variant 
Applies when size == 11 && R == 
STSETL <Xs>, [<Xn|SP>] 

is equivalent to 

LDSETL <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDSET, LDSETA, LDSETAL, LDSETL gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.282 


C6-1260 


STSMAXB, STSMAXLB 


Atomic signed maximum on byte in memory, without return, atomically loads an 8-bit byte from memory, compares 
it against the value held in a register, and stores the larger value back to memory, treating the values as signed 
numbers. 


è STSMAXB has no memory ordering semantics. 


$ STSMAXLB stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDSMAXB, LDSMAXAB, LDSMAXALB, LDSMAXLB instruction. This 
means that: 


° The encodings in this description are named to match the encodings of LDSMAXB, LDSMAXAB, 
LDSMAXALB, LDSMAXLB. 


. The description of LDSMAXB, LDSMAXAB, LDSMAXALB, LDSMAXLB gives the operational 
pseudocode for this instruction. 


ARMV8.1 


[31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 


CC KETC CAC AT CA C K o] eT TT 


size opc 


No memory ordering variant 
Applies when R == 

STSMAXB <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMAXB <Ws>, WZR, [<Xn|SP>] 
and is always the preferred disassembly. 
Release variant 

Applies when R == 

STSMAXLB <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMAXLB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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Operation 


The description of LDSMAXB, LDSMAXAB, LDSMAXALB, LDSMAXLB gives the operational pseudocode for 
this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.283 


C6-1262 


STSMAXH, STSMAXLH 


Atomic signed maximum on halfword in memory, without return, atomically loads a 16-bit halfword from memory, 
compares it against the value held in a register, and stores the larger value back to memory, treating the values as 
signed numbers. 


a STSMAXH has no memory ordering semantics. 


7 STSMAXLH stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDSMAXH, LDSMAXAH, LDSMAXALH, LDSMAXLH instruction. This 
means that: 


° The encodings in this description are named to match the encodings of LDSMAXH, LDSMAXAH, 
LDSMAXALH, LDSMAXLH. 


. The description of LDSMAXH, LDSMAXAH, LDSMAXALH, LDSMAXLH gives the operational 
pseudocode for this instruction. 


ARMV8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 


oopen wot eof] eT TH 


size opc 


No memory ordering variant 
Applies when R == 

STSMAXH <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMAXH <Ws>, WZR, [<Xn|SP>] 
and is always the preferred disassembly. 
Release variant 

Applies when R == 

STSMAXLH <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMAXLH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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Operation 


The description of LDSMAXH, LDSMAXAH, LDSMAXALH, LDSMAXLH gives the operational pseudocode 
for this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.284 STSMAX, STSMAXL 


C6-1264 


Atomic signed maximum on word or doubleword in memory, without return, atomically loads a 32-bit word or 
64-bit doubleword from memory, compares it against the value held in a register, and stores the larger value back 
to memory, treating the values as signed numbers. 


- STSMAX has no memory ordering semantics. 


s STSMAXL stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL instruction. This means that: 


$ The encodings in this description are named to match the encodings of LDSMAX, LDSMAXA, 
LDSMAXAL, LDSMAXL. 


. The description of LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL gives the operational pseudocode for 
this instruction. 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[1 xla 1 tfofo ofojRis] rs [oji o ofo of Ra {11111 


111 
size A opc Rt 


32-bit LDSMAX alias variant 
Applies when size == 10 && R == 0. 
STSMAX <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMAX <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


32-bit LDSMAXL alias variant 
Applies when size == 10 && R == 1. 
STSMAXL <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMAXL <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


64-bit LDSMAX alias variant 
Applies when size == 11 && R == 
STSMAX <Xs>, [<Xn|SP>] 

is equivalent to 

LDSMAX <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 
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64-bit LDSMAXL alias variant 
Applies when size == 11 && R == 
STSMAXL <Xs>, [<Xn|SP>] 

is equivalent to 

LDSMAXL <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDSMAX, LDSMAXA, LDSMAXAL, LDSMAXL gives the operational pseudocode for this 
instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.285 


C6-1266 


STSMINB, STSMINLB 


Atomic signed minimum on byte in memory, without return, atomically loads an 8-bit byte from memory, compares 
it against the value held in a register, and stores the smaller value back to memory, treating the values as signed 
numbers. 


° STSMINB has no memory ordering semantics. 


7 STSMINLB stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDSMINB, LDSMINAB, LDSMINALB, LDSMINLB instruction. This means 
that: 


° The encodings in this description are named to match the encodings of LDSMINB, LDSMINAB, 
LDSMINALB, LDSMINLB. 


. The description of LDSMINB, LDSMINAB, LDSMINALB, LDSMINLB gives the operational pseudocode 
for this instruction. 


ARMV8.1 


[31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 


eos tole oolel a Tol oreo] eT TT 


size opc 


No memory ordering variant 
Applies when R == 

STSMINB <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMINB <Ws>, WZR, [<Xn|SP>] 
and is always the preferred disassembly. 
Release variant 

Applies when R == 

STSMINLB <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMINLB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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Operation 


The description of LDSMINB, LDSMINAB, LDSMINALB, LDSMINLB gives the operational pseudocode for this 
instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.286 


C6-1268 


STSMINH, STSMINLH 


Atomic signed minimum on halfword in memory, without return, atomically loads a 16-bit halfword from memory, 
compares it against the value held in a register, and stores the smaller value back to memory, treating the values as 
signed numbers. 


° STSMINH has no memory ordering semantics. 


7 STSMINLH stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDSMINH, LDSMINAH, LDSMINALH, LDSMINLH instruction. This means 
that: 


° The encodings in this description are named to match the encodings of LDSMINH, LDSMINAH, 
LDSMINALH, LDSMINLH. 


. The description of LDSMINH, LDSMINAH, LDSMINALH, LDSMINLH gives the operational pseudocode 
for this instruction. 


ARMV8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 


A CCEA CAC CAT CA C oreo] eT TT 


size opc 


No memory ordering variant 
Applies when R == 

STSMINH <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMINH <Ws>, WZR, [<Xn|SP>] 
and is always the preferred disassembly. 
Release variant 

Applies when R == 

STSMINLH <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMINLH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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C6.2 Alphabetical list of A64 base instructions 


Operation 


The description of LDSMINH, LDSMINAH, LDSMINALH, LDSMINLH gives the operational pseudocode for 
this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.287  STSMIN, STSMINL 


C6-1270 


Atomic signed minimum on word or doubleword in memory, without return, atomically loads a 32-bit word or 
64-bit doubleword from memory, compares it against the value held in a register, and stores the smaller value back 
to memory, treating the values as signed numbers. 


° STSMIN has no memory ordering semantics. 


7 STSMINL stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDSMIN, LDSMINA, LDSMINAL, LDSMINL instruction. This means that: 


s The encodings in this description are named to match the encodings of LDSMIN, LDSMINA, LDSMINAL, 


LDSMINL. 
$ The description of LDSMIN, LDSMINA, LDSMINAL, LDSMINL gives the operational pseudocode for this 
instruction. 
ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 
[1 xli 1 1fofo ofofr{i] Rs Joji o 1fo of Rn [11111 
size A opc Rt 


32-bit LDSMIN alias variant 
Applies when size == 10 && R == 0. 
STSMIN <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMIN <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


32-bit LDSMINL alias variant 
Applies when size == 10 && R == 1. 
STSMINL <Ws>, [<Xn|SP>] 

is equivalent to 

LDSMINL <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


64-bit LDSMIN alias variant 
Applies when size == 11 && R == 
STSMIN <Xs>, [<Xn|SP>] 

is equivalent to 

LDSMIN <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 
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64-bit LDSMINL alias variant 
Applies when size == 11 && R == 
STSMINL <Xs>, [<Xn|SP>] 

is equivalent to 

LDSMINL <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDSMIN, LDSMINA, LDSMINAL, LDSMINL gives the operational pseudocode for this 
instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.288 


C6-1272 


STTR 


Store Register (unprivileged) stores a word or doubleword from a register to memory. The address that is used for 
the store is calculated from a base register and an immediate offset. 


Memory accesses made by the instruction behave as if the instruction was executed at ELO if the Effective value on 
page Glossary-7886 of PSTATE.UAO is 0 and either: 


° The instruction is executed at EL1. 


s The instruction is executed at EL2 when the Effective value on page Glossary-7886 of HCR_EL2.{E2H, 
TGE} is {1, 1}. 


Otherwise, the memory access operates with the restrictions determined by the Exception level at which the 
instruction is executed. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| o| 
[1 xla 1 tfofo ofo ofo] imma tt of Rmn | R | 
size opc 


32-bit variant 

Applies when size == 10. 

STTR <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when size == 11. 

STTR <Xt>, [<Xn|SP>{, #<simm>}] 

Decode for all variants of this encoding 


integer scale = UInt(size); 
bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


unpriv_at_ell = PSTATE.EL == EL1 && !(EL2Enabled() && HaveNVExt() && HCR_EL2.<NV,NV1> == '11'); 
unpriv_at_el2 = PSTATE.EL == EL2 && HaveVirtHostExt() && HCR_EL2.<E2H,TGE> == '11'; 


user_access_override = HaveUAOExt() && PSTATE.UAO == '1'; 

if !user_access_override && (unpriv_at_ell || unpriv_at_el2) then 
acctype = AccType_UNPRIV; 

else 
acctype = AccType_NORMAL ; 
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integer datasize = 8 << scale; 
boolean tag_checked = n != 31; 
Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 
address = address + offset; 
data = X[t]; 
Mem[address, datasize DIV 8, acctype] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.289 


C6-1274 


STTRB 


Store Register Byte (unprivileged) stores a byte from a 32-bit register to memory. The address that is used for the 
store is calculated from a base register and an immediate offset. 


Memory accesses made by the instruction behave as if the instruction was executed at ELO if the Effective value on 
page Glossary-7886 of PSTATE.UAO is 0 and either: 


° The instruction is executed at EL1. 


s The instruction is executed at EL2 when the Effective value on page Glossary-7886 of HCR_EL2.{E2H, 
TGE} is {1, 1}. 


Otherwise, the memory access operates with the restrictions determined by the Exception level at which the 
instruction is executed. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| o| 
[o ofa 1 tfofo ofo ofo] imma tt of Rm | R | 
size opc 


Unscaled offset variant 


STTRB <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


unpriv_at_ell = PSTATE.EL == EL1 && !(EL2Enabled() && HaveNVExt() && HCR_EL2.<NV,NV1> == '11'); 
unpriv_at_el2 = PSTATE.EL == EL2 && HaveVirtHostExt() && HCR_EL2.<E2H,TGE> == '11'; 


user_access_override = HaveUAOExt() && PSTATE.UAO == '1'; 

if !user_access_override && (unpriv_at_ell || unpriv_at_el2) then 
acctype = AccType_UNPRIV; 

else 
acctype = AccType_NORMAL; 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 
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if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 
data = X[t]; 


Mem[address, 1, acctype] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.290 


C6-1276 


STTRH 


Store Register Halfword (unprivileged) stores a halfword from a 32-bit register to memory. The address that is used 
for the store is calculated from a base register and an immediate offset. 


Memory accesses made by the instruction behave as if the instruction was executed at ELO if the Effective value on 
page Glossary-7886 of PSTATE.UAO is 0 and either: 


° The instruction is executed at EL1. 


s The instruction is executed at EL2 when the Effective value on page Glossary-7886 of HCR_EL2.{E2H, 
TGE} is {1, 1}. 


Otherwise, the memory access operates with the restrictions determined by the Exception level at which the 
instruction is executed. For information about memory accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| o| 
[o 1ļ1 1 tJofo ofo ofo] imma tt of Rmn | R | 
size opc 


Unscaled offset variant 


STTRH <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


unpriv_at_ell = PSTATE.EL == EL1 && !(EL2Enabled() && HaveNVExt() && HCR_EL2.<NV,NV1> == '11'); 
unpriv_at_el2 = PSTATE.EL == EL2 && HaveVirtHostExt() && HCR_EL2.<E2H,TGE> == '11'; 


user_access_override = HaveUAOExt() && PSTATE.UAO == '1'; 

if !user_access_override && (unpriv_at_ell || unpriv_at_el2) then 
acctype = AccType_UNPRIV; 

else 
acctype = AccType_NORMAL; 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 
data = X[t]; 


Mem[address, 2, acctype] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.291 


C6-1278 


STUMAXB, STUMAXLB 


Atomic unsigned maximum on byte in memory, without return, atomically loads an 8-bit byte from memory, 
compares it against the value held in a register, and stores the larger value back to memory, treating the values as 
unsigned numbers. 


° STUMAXB has no memory ordering semantics. 


7 STUMAXLB stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDUMAXB, LDUMAXAB, LDUMAXALB, LDUMAXLB instruction. This 
means that: 


° The encodings in this description are named to match the encodings of LDUMAXB, LDUMAXAB, 
LDUMAXALB, LDUMAXLB. 


. The description of LDUMAXB, LDUMAXAB, LDUMAXALB, LDUMAXLB gives the operational 
pseudocode for this instruction. 


ARMV8.1 


[31 30 29 28|27 26 25 24/23 22 21 20| 16/1514 12/11109 | 5 4| 


eo o oR |e Tol role] aT TT 


size opc 


No memory ordering variant 
Applies when R == 

STUMAXB <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMAXB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STUMAXLB <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMAXLB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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Operation 


The description of LDUMAXB, LDUMAXAB, LDUMAXALB, LDUMAXLB gives the operational pseudocode 
for this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.292 


C6-1280 


STUMAXH, STUMAXLH 


Atomic unsigned maximum on halfword in memory, without return, atomically loads a 16-bit halfword from 
memory, compares it against the value held in a register, and stores the larger value back to memory, treating the 
values as unsigned numbers. 


a STUMAXH has no memory ordering semantics. 


7 STUMAXLH stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDUMAXH, LDUMAXAH, LDUMAXALH, LDUMAXLH instruction. This 
means that: 


° The encodings in this description are named to match the encodings of LDUMAXH, LDUMAXAH, 
LDUMAXALH, LDUMAXLH. 


. The description of LDUMAXH, LDUMAXAH, LDUMAXALH, LDUMAXLH gives the operational 
pseudocode for this instruction. 


ARMV8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 


eats oR we ol cole] aT TT 


size opc 


No memory ordering variant 
Applies when R == 

STUMAXH <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMAXH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STUMAXLH <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMAXLH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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Operation 


The description of LDUMAXH, LDUMAXAH, LDUMAXALH, LDUMAXLH gives the operational pseudocode 
for this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.293 


C6-1282 


STUMAX, STUMAXL 


Atomic unsigned maximum on word or doubleword in memory, without return, atomically loads a 32-bit word or 
64-bit doubleword from memory, compares it against the value held in a register, and stores the larger value back 
to memory, treating the values as unsigned numbers. 


° STUMAX has no memory ordering semantics. 


7 STUMAXL stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL instruction. This means 
that: 


- The encodings in this description are named to match the encodings of LDUMAX, LDUMAXA, 
LDUMAXAL, LDUMAXL. 


. The description of LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL gives the operational pseudocode 
for this instruction. 


ARMV8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 


real oe oR we Tol cole] eT TT 


size opc 


32-bit LDUMAX alias variant 
Applies when size == 10 && R == 
STUMAX <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMAX <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


32-bit LDUMAXL alias variant 
Applies when size == 10 && R == 
STUMAXL <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMAXL <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


64-bit LDUMAX alias variant 
Applies when size == 11 && R == 
STUMAX <Xs>, [<Xn|SP>] 

is equivalent to 

LDUMAX <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 
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64-bit LDUMAXL alias variant 
Applies when size == 11 && R == 
STUMAXL <Xs>, [<Xn|SP>] 

is equivalent to 

LDUMAXL <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDUMAX, LDUMAXA, LDUMAXAL, LDUMAXL gives the operational pseudocode for this 
instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.294 


C6-1284 


STUMINB, STUMINLB 


Atomic unsigned minimum on byte in memory, without return, atomically loads an 8-bit byte from memory, 
compares it against the value held in a register, and stores the smaller value back to memory, treating the values as 
unsigned numbers. 


° STUMINB has no memory ordering semantics. 


7 STUMINLB stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDUMINB, LDUMINAB, LDUMINALB, LDUMINLB instruction. This means 
that: 


- The encodings in this description are named to match the encodings of LDUMINB, LDUMINAB, 
LDUMINALB, LDUMINLB. 


. The description of LDUMINB, LDUMINAB, LDUMINALB, LDUMINLB gives the operational 
pseudocode for this instruction. 


ARMV8.1 


31 se 20! aA i 10 9 m 5 z 


size opc 


No memory ordering variant 
Applies when R == 

STUMINB <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMINB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STUMINLB <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMINLB <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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Operation 


The description of LDUMINB, LDUMINAB, LDUMINALB, LDUMINLB gives the operational pseudocode for 
this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.295 


C6-1286 


STUMINH, STUMINLH 


Atomic unsigned minimum on halfword in memory, without return, atomically loads a 16-bit halfword from 
memory, compares it against the value held in a register, and stores the smaller value back to memory, treating the 
values as unsigned numbers. 


° STUMINH has no memory ordering semantics. 


7 STUMINLH stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


This instruction is an alias of the LDUMINH, LDUMINAH, LDUMINALH, LDUMINLH instruction. This means 
that: 


- The encodings in this description are named to match the encodings of LDUMINH, LDUMINAH, 
LDUMINALH, LDUMINLH. 


. The description of LDUMINH, LDUMINAH, LDUMINALH, LDUMINLH gives the operational 
pseudocode for this instruction. 


ARMV8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 


eae tol vole. we pho eT TT 


size opc 


No memory ordering variant 
Applies when R == 

STUMINH <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMINH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Release variant 

Applies when R == 

STUMINLH <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMINLH <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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Operation 


The description of LDUMINH, LDUMINAH, LDUMINALH, LDUMINLH gives the operational pseudocode for 
this instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.296 STUMIN, STUMINL 


C6-1288 


Atomic unsigned minimum on word or doubleword in memory, without return, atomically loads a 32-bit word or 
64-bit doubleword from memory, compares it against the value held in a register, and stores the smaller value back 
to memory, treating the values as unsigned numbers. 


° STUMIN has no memory ordering semantics. 


7 STUMINL stores to memory with release semantics, as described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 
This instruction is an alias of the LDUMIN, LDUMINA, LDUMINAL, LDUMINL instruction. This means that: 


s The encodings in this description are named to match the encodings of LDUMIN, LDUMINA, LDUMINAL, 
LDUMINL. 


. The description of LDUMIN, LDUMINA, LDUMINAL, LDUMINL gives the operational pseudocode for 
this instruction. 


ARMv8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 12/11109 | 5 4| 0 | 


[1 xla 1 tfofo ofojRis] rs [oji 1 joo] Ra [11111 


111 
size A opc Rt 


32-bit LDUMIN alias variant 
Applies when size == 10 && R == 0. 
STUMIN <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMIN <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


32-bit LDUMINL alias variant 
Applies when size == 10 && R == 1. 
STUMINL <Ws>, [<Xn|SP>] 

is equivalent to 

LDUMINL <Ws>, WZR, [<Xn|SP>] 


and is always the preferred disassembly. 


64-bit LDUMIN alias variant 
Applies when size == 11 && R == 
STUMIN <Xs>, [<Xn|SP>] 

is equivalent to 

LDUMIN <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 
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64-bit LDUMINL alias variant 
Applies when size == 11 && R == 
STUMINL <Xs>, [<Xn|SP>] 

is equivalent to 

LDUMINL <Xs>, XZR, [<Xn|SP>] 


and is always the preferred disassembly. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xs> Is the 64-bit name of the general-purpose register holding the data value to be operated on with the 
contents of the memory location, encoded in the "Rs" field. 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Operation 


The description of LDUMIN, LDUMINA, LDUMINAL, LDUMINL gives the operational pseudocode for this 
instruction. 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.297. STUR 


Store Register (unscaled) calculates an address from a base register value and an immediate offset, and stores a 
32-bit word or a 64-bit doubleword to the calculated address, from a register. For information about memory 
accesses, see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


[1 x]1 1 tJofo ofo ofo] imma fo of Rmn | R | 


size opc 


32-bit variant 

Applies when size == 10. 

STUR <Wt>, [<Xn|SP>{, #<simm>}] 

64-bit variant 

Applies when size == 11. 

STUR <Xt>, [<Xn|SP>{, #<simm>}] 

Decode for all variants of this encoding 


integer scale = UInt(size); 
bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


integer datasize = 8 << scale; 
boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 
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address = address + offset; 


data = X[t]; 
Mem[address, datasize DIV 8, AccType_NORMAL] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.298 STURB 


Store Register Byte (unscaled) calculates an address from a base register value and an immediate offset, and stores 
a byte to the calculated address, from a 32-bit register. For information about memory accesses, see Load/Store 
addressing modes on page C1-177. 


[31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


[o ofa 1 1Jofo ofo ojoj imma fo of Rmh | R | 


size opc 


Unscaled offset variant 


STURB <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(8) data; 


if n == 31 then 

CheckSPAlignment() ; 
address = SP[]; 

else 
address = X[n]; 

address = address + offset; 

data = X[t]; 

Mem[address, 1, AccType_NORMAL] = data; 

Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.299 STURH 


Store Register Halfword (unscaled) calculates an address from a base register value and an immediate offset, and 
stores a halfword to the calculated address, from a 32-bit register. For information about memory accesses, see 
Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


fo afa 1 1Jofo ofo ofo imma fo of Rmh | R | 


size opc 


Unscaled offset variant 


STURH <Wt>, [<Xn|SP>{, #<simm>}] 


Decode for this encoding 


bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 


in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 
integer t = UInt(Rt); 


boolean tag_checked = n != 31; 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


bits(64) address; 
bits(16) data; 


if n == 31 then 

CheckSPAlignment(); 
address = SP[]; 

else 
address = X[n]; 

address = address + offset; 

data = X[t]; 

Mem[address, 2, AccType_NORMAL] = data; 

Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.300 


C6-1294 


STXP 


Store Exclusive Pair of registers stores two 32-bit words or two 64-bit doublewords from two registers to a memory 
location if the PE has exclusive access to the memory address, and returns a status value of 0 if the store was 
successful, or of 1 if no store was performed. See Synchronization and semaphores on page B2-156. A 32-bit pair 
requires the address to be doubleword aligned and is single-copy atomic at doubleword granularity. A 64-bit pair 
requires the address to be quadword aligned and, if the Store-Exclusive succeeds, it causes a single-copy atomic 
update of the 128-bit memory location being updated. For information about memory accesses see Load/Store 
addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 
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32-bit variant 

Applies when sz == 

STXP <Ws>, <Wtl>, <Wt2>, [<Xn|SP>{,#0}] 
64-bit variant 

Applies when sz == 


STXP <Ws>, <Xtl>, <Xt2>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer t2 = UInt(Rt2); // ignored by load/store single register 
integer s = UInt(Rs); // ignored by all loads and store-release 


integer elsize = 32 << UInt(sz); 
integer datasize = elsize « 2; 
boolean tag_checked = n != 31; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly STXP on page K1-7643. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register into which the status result of the store exclusive 
is written, encoded in the "Rs" field. The value returned is: 
() If the operation updates memory. 
He If the operation fails to update memory. 
<Xt1> Is the 64-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 
<Xt2> Is the 64-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 
<Wt1> Is the 32-bit name of the first general-purpose register to be transferred, encoded in the "Rt" field. 
<Wt2> Is the 32-bit name of the second general-purpose register to be transferred, encoded in the "Rt2" 
field. 
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<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Aborts and alignment 

If a synchronous Data Abort exception is generated by the execution of this instruction: 

° Memory is not updated. 

° <Ws> is not updated. 


Accessing an address that is not aligned to the size of the data being accessed causes an Alignment fault Data Abort 
exception to be generated, subject to the following rules: 


° If AArch64.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
$ Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch64.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation 


bits(64) address; 

bits(datasize) data; 

constant integer dbytes = datasize DIV 8; 
boolean rt_unknown = FALSE; 

boolean rn_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if s == t || (s == t2) then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint UNKNOWN, Constraint NONE, Constraint UNDEF, Constraint NOP}; 


case c of 
when Constraint UNKNOWN rt_unknown = TRUE; // store UNKNOWN value 
when Constraint NONE rt_unknown = FALSE; // store original value 
when Constraint UNDEF UNDEFINED; 
when Constraint NOP EndOfInstruction(); 


if s == n && n != 31 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_NONE, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_UNKNOWN rn_unknown = TRUE; // address is UNKNOWN 
when Constraint_NONE rn_unknown = FALSE; // address is original base 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
elsif rn_unknown then 
address = bits(64) UNKNOWN; 
else 
address = X[n]; 


if rt_unknown then 
data = bits(datasize) UNKNOWN; 
else 
bits(datasize DIV 2) ell = X[t]; 
bits(datasize DIV 2) el2 = X[t2]; 
data = if BigEndian() then ell:el2 else el2:e11; 
bit status = '1'; 
// Check whether the Exclusives monitors are set to include the 
// physical memory locations corresponding to virtual address 
// range [address, address+dbytes-1]. 
if AArch64.ExclusiveMonitorsPass(address, dbytes) then 
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// This atomic write will be rejected if it does not refer 
// to the same physical locations after address translation. 
Mem[address, dbytes, AccType_ATOMIC] = data; 
status = ExclusiveMonitorsStatus(); 

X[s] = ZeroExtend(status, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.301 STXR 


ARM DDI 0487E.a 
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Store Exclusive Register stores a 32-bit word or a 64-bit doubleword from a register to memory if the PE has 
exclusive access to the memory address, and returns a status value of 0 if the store was successful, or of 1 ifno store 
was performed. See Synchronization and semaphores on page B2-156. For information about memory accesses see 
Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 p 10 9 5 4| 0 | 


nxe 0 40 0 ofojofo} rs teln OK eea 


size Rt2 


32-bit variant 
Applies when size == 10. 


STXR <Ws>, <Wt>, [<Xn|SP>{,#0}] 


64-bit variant 
Applies when size == 11. 


STXR <Ws>, <Xt>, [<Xn|SP>{,#0}] 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer s = UInt(Rs); // ignored by all loads and store-release 


integer elsize = 8 << UInt(size); 
boolean tag_checked = n != 31; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly STXR on page K1-7643. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register into which the status result of the store exclusive 
is written, encoded in the "Rs" field. The value returned is: 
) If the operation updates memory. 
I If the operation fails to update memory. 

<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Aborts and alignment 


If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 


° <Ws> is not updated. 
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Accessing an address that is not aligned to the size of the data being accessed causes an Alignment fault Data Abort 
exception to be generated, subject to the following rules: 


° If AArch64.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
° Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch64.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation 


bits(64) address; 

bits(elsize) data; 

constant integer dbytes = elsize DIV 8; 
boolean rt_unknown = FALSE; 

boolean rn_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked); 


if s == t then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint UNKNOWN, Constraint NONE, Constraint UNDEF, Constraint NOP}; 


case c of 
when Constraint UNKNOWN rt_unknown = TRUE; // store UNKNOWN value 
when Constraint NONE rt_unknown = FALSE; // store original value 
when Constraint UNDEF UNDEFINED; 
when Constraint NOP EndOfInstruction(); 


if s == n && n != 31 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint UNKNOWN, Constraint NONE, Constraint UNDEF, Constraint NOP}; 


case c of 
when Constraint UNKNOWN rn_unknown = TRUE; // address is UNKNOWN 
when Constraint NONE rn_unknown = FALSE; // address is original base 
when Constraint UNDEF UNDEFINED; 
when Constraint NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
elsif rn_unknown then 
address = bits(64) UNKNOWN; 
else 
address = X[n]; 


if rt_unknown then 

data = bits(elsize) UNKNOWN; 
else 

data = X[t]; 


bit status = '1'; 
// Check whether the Exclusives monitors are set to include the 
// physical memory locations corresponding to virtual address 
// range [address, address+dbytes-1]. 
if AArch64.ExclusiveMonitorsPass(address, dbytes) then 
// This atomic write will be rejected if it does not refer 
// to the same physical locations after address translation. 
Mem[address, dbytes, AccType_ATOMIC] = data; 
status = ExclusiveMonitorsStatus(); 
X[s] = ZeroExtend(status, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.302 STXRB 


ARM DDI 0487E.a 
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Store Exclusive Register Byte stores a byte from a register to memory if the PE has exclusive access to the memory 
address, and returns a status value of 0 if the store was successful, or of 1 if no store was performed. See 
Synchronization and semaphores on page B2-156. The memory access is atomic. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 m 5 4| 0| 


2 ojo o 10 0 ofojojo}| Rs Jolt MMA T E T E 


size Rt2 


No offset variant 


STXRB <Ws>, <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer s = UInt(Rs); // ignored by all loads and store-release 


boolean tag_checked = n != 31; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly STXRB on page K1-7643. 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register into which the status result of the store exclusive 
is written, encoded in the "Rs" field. The value returned is: 
() If the operation updates memory. 
1 If the operation fails to update memory. 

<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Aborts 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

° <Ws> is not updated. 


If AArch64.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation 


bits(64) address; 

bits(8) data; 

boolean rt_unknown = FALSE; 
boolean rn_unknown = FALSE; 


if HaveMTEExt() then 
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C6-1300 


SetNotTagCheckedInstruction(!tag_checked) ; 


if s == t then 
Constraint c = ConstrainUnpredictable(); 


assert c IN {Constraint_UNKNOWN, Constraint_NONE, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; 
when Constraint_NONE rt_unknown = FALSE; 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 
if s == n && n != 31 then 
Constraint c = ConstrainUnpredictable(); 


assert c IN {Constraint_UNKNOWN, Constraint_NONE, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_UNKNOWN rn_unknown = TRUE; 
when Constraint_NONE rn_unknown = FALSE; 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
elsif rn_unknown then 
address = bits(64) UNKNOWN; 
else 
address = X[n]; 


if rt_unknown then 

data = bits(8) UNKNOWN; 
else 

data = X[t]; 


bit status = '1'; 


// store UNKNOWN value 
// store original value 


// address is UNKNOWN 
// address is original base 


// Check whether the Exclusives monitors are set to include the 
// physical memory locations corresponding to virtual address 


// range [address, address+dbytes-1]. 
if AArch64.ExclusiveMonitorsPass(address, 1) then 


// This atomic write will be rejected if it does not refer 
// to the same physical locations after address translation. 


Mem[address, 1, AccType_ATOMIC] = data; 
status = ExclusiveMonitorsStatus(); 
X[s] = ZeroExtend(status, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.303 STXRH 


ARM DDI 0487E.a 
ID070919 


Store Exclusive Register Halfword stores a halfword from a register to memory if the PE has exclusive access to 
the memory address, and returns a status value of 0 if the store was successful, or of 1 if no store was performed. 
See Synchronization and semaphores on page B2-156. The memory access is atomic. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 m 5 4| 0| 


Ceu Rs Jolt MMA T E T E 


size Rt2 


No offset variant 


STXRH <Ws>, <Wt>, [<Xn|SP>{,#0}] 


Decode for this encoding 


integer n = UInt(Rn); 
integer t = UInt(Rt); 
integer s = UInt(Rs); // ignored by all loads and store-release 


boolean tag_checked = n != 31; 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register into which the status result of the store exclusive 
is written, encoded in the "Rs" field. The value returned is: 
0 If the operation updates memory. 
al If the operation fails to update memory. 

<Wt> Is the 32-bit name of the general-purpose register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Aborts and alignment 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

° <Ws> is not updated. 


A non halfword-aligned memory address causes an Alignment fault Data Abort exception to be generated, subject 
to the following rules: 


° If AArch64.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
s Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch64.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation 


bits(64) address; 

bits(16) data; 

boolean rt_unknown = FALSE; 
boolean rn_unknown = FALSE; 
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C6-1302 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if s == t then 
Constraint c = ConstrainUnpredictable(); 


assert c IN {Constraint_UNKNOWN, Constraint_NONE, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; 
when Constraint_NONE rt_unknown = FALSE; 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 
if s == n && n != 31 then 
Constraint c = ConstrainUnpredictable(); 


assert c IN {Constraint_UNKNOWN, Constraint_NONE, Constraint_UNDEF, Constraint_NOP}; 


case c of 
when Constraint_UNKNOWN rn_unknown = TRUE; 
when Constraint_NONE rn_unknown = FALSE; 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
elsif rn_unknown then 
address = bits(64) UNKNOWN; 
else 
address = X[n]; 


if rt_unknown then 

data = bits(16) UNKNOWN; 
else 

data = X[t]; 


bit status = '1'; 


// store UNKNOWN value 
// store original value 


// address is UNKNOWN 
// address is original base 


// Check whether the Exclusives monitors are set to include the 
// physical memory locations corresponding to virtual address 


// range [address, address+dbytes-1]. 
if AArch64.ExclusiveMonitorsPass(address, 2) then 


// This atomic write will be rejected if it does not refer 
// to the same physical locations after address translation. 


Mem[address, 2, AccType_ATOMIC] = data; 
status = ExclusiveMonitorsStatus(); 
X[s] = ZeroExtend(status, 32); 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C6.2.304 STZ2G 


Store Allocation Tags, Zeroing stores an Allocation Tag to two Tag granules of memory, zeroing the associated data 
locations. The address used for the store is calculated from the base register and an immediate signed offset scaled 
by the Tag granule. The Allocation Tag is calculated from the Logical Address Tag in the source register. 


This instruction generates an Unchecked access. 


Post-index 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


ee ee imm foj] x» | x | 


Post-index variant 


STZ2G <Xt|SP>, [<Xn|SP>], #<simm> 


Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = TRUE; 


Pre-index 


ARMVv8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


1101100 ajili] imm hh] xn Tt 


Pre-index variant 


STZ2G <Xt|SP>, [<Xn|SP>, #<simm>]! 


Decode for this encoding 

integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = FALSE; 

Signed offset 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


1101100 ajili] imm [tfof xn | x* | 


Signed offset variant 


STZ2G <Xt|SP>, [<Xn|SP>{, #<simm>}] 
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Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = FALSE; 

boolean postindex = FALSE; 


Assembler symbols 


<Xt | SP> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Xt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Xn" field. 
<simm> Is the optional signed immediate offset, a multiple of 16 in the range -4096 to 4080, defaulting to 0 


and encoded in the "imm9" field. 


Operation for all encodings 


bits(64) address; 
bits(64) data = if t == 31 then SP[] else X[t]; 
bits(4) tag = AArch64.AllocationTagFromAddress (data); 


SetNotTagCheckedInstruction(TRUE) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


Mem[address, TAG_GRANULE, AccType_NORMAL] = Zeros(8 » TAG_GRANULE); 
Mem[address+TAG_GRANULE, TAG_GRANULE, AccType_NORMAL] = Zeros(8 » TAG_GRANULE); 


AArch64.MemTag[address] = tag; 
AArch64.MemTagLaddress+TAG_GRANULE] = tag; 


if writeback then 
if postindex then 
address = address + offset; 


if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


C6-1304 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.305 STZG 


Store Allocation Tag, Zeroing stores an Allocation Tag to memory, zeroing the associated data location. The address 
used for the store is calculated from the base register and an immediate signed offset scaled by the Tag granule. The 
Allocation Tag is calculated from the Logical Address Tag in the source register. 


This instruction generates an Unchecked access. 


Post-index 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


1101100 ajoji] immo folit x» ft 


Post-index variant 


STZG <Xt|SP>, [<Xn|SP>], #<simm> 


Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = TRUE; 


Pre-index 


ARMVv8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


1101100 ajoji] imm fttst xn Tt 


Pre-index variant 


STZG <Xt|SP>, [<Xn|SP>, #<simm>]! 


Decode for this encoding 

integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = TRUE; 

boolean postindex = FALSE; 

Signed offset 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| 0 | 


1107100 ajoji] immo [tjof xn | x* | 


Signed offset variant 


STZG <Xt|SP>, [<Xn|SP>{, #<simm>}] 
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C6-1306 


Decode for this encoding 


integer n = UInt(Xn); 

integer t = UInt(Xt); 

bits(64) offset = LSL(SignExtend(imm9, 64), LOG2_TAG_GRANULE) ; 
boolean writeback = FALSE; 

boolean postindex = FALSE; 


Assembler symbols 

<Xt | SP> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Xt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Xn" field. 
<simm> Is the optional signed immediate offset, a multiple of 16 in the range -4096 to 4080, defaulting to 0 


and encoded in the "imm9" field. 


Operation for all encodings 
bits(64) address; 
SetNotTagCheckedInstruction(TRUE) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


Mem[address, TAG_GRANULE, AccType_NORMAL] = Zeros(TAG_GRANULE « 


bits(64) data = if t == 31 then SP[] else X[t]; 
bits(4) tag = AArch64.AllocationTagFromAddress (data); 
AArch64.MemTag[address] = tag; 


if writeback then 
if postindex then 
address = address + offset; 


if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


8); 
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C6.2.306 STZGM 


ARM DDI 0487E.a 
ID070919 


Store Tag and Zero Multiple writes a naturally aligned block of N Allocation Tags and stores zero to the associated 
data locations, where the size of N is identified in DCZID_ELO.BS, and the Allocation Tag written to address A is 
taken from the source register bits<3:0>. 


This instruction is UNDEFINED at ELO. 
This instruction generates an Unchecked access. 


This instruction is Unallocated when ID_AA64PFR1_EL1.MTE == 0b0001. 


ARMV8.5 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 1413 12/1110 9. | 5 4| 0 | 


101100 sfojoftjofojofojofojofofojofo} xn | x | 


Integer variant 


STZGM <Xt>, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Xt); 
integer n = UInt(Xn); 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose register to be transferred, encoded in the "Xt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Xn" field. 
Operation 


if PSTATE.EL == ELO then 
UndefinedFault(); 


bits(64) data = X[t]; 
bits(4) tag = data<3:0>; 
bits(64) address; 
if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


integer size = 4 » (2 A (UInt(DCZID_ELQ.BS))); 
address = Align(address, size); 
integer count = size >> LOG2_TAG_GRANULE; 


for i = 0 to count-1 
AArch64.MemTag[address] = tag; 
Mem[address, TAG_GRANULE, AccType_NORMAL] = Zeros(8 « TAG_GRANULE); 
address = address + TAG_GRANULE; 
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C6.2.307 SUB (extended register) 


Subtract (extended register) subtracts a sign or zero-extended register value, followed by an optional left shift 
amount, from a register value, and writes the result to the destination register. The argument that is extended from 
the <Rm> register can be a byte, halfword, word, or doubleword. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312; 109 | 5 4| 0 | 


sfltfojo 1 0 1 1fo oft] Rm | option | imma | Rn | Ra | 


op S 


32-bit variant 
Applies when sf == 


SUB <Wd|WSP>, <Wn|WSP>, <Wm>{, <extend> {#<amount>}} 


64-bit variant 
Applies when sf == 


SUB <Xd|SP>, <Xn|SP>, <R><m>{, <extend> {#<amount>}} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = UInt(imm3); 

if shift > 4 then UNDEFINED; 


Assembler symbols 


<Wd | WSP> Is the 32-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Wn | WSP> Is the 32-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xd | SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 

<R> Is a width specifier, encoded in the "option" field. It can have the following values: 
W when option = 00x 
W when option = 010 
X when option = x11 
W when option = 10x 
W when option = 110 

<m> Is the number [0-30] of the second general-purpose source register or the name ZR (31), encoded in 
the "Rm" field. 
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<extend> 


<amount> 


Operation 
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For the 32-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 


UXTB when option = 000 
UXTH when option = 001 
LSL|UXTW when option = 010 
UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If"Rd" or "Rn" is '11111' (WSP) and "option" is '010' then LSL is preferred, but may be omitted 
when "imm3" is '000". In all other cases <extend> is required and must be UXTW when "option" is 
'010'. 

For the 64-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 


UXTB when option = 000 
UXTH when option = 001 
UXTW when option = 010 
LSL|UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If"Rd" or "Rn" is '11111' (SP) and "option" is '011' then LSL is preferred, but may be omitted when 
"imm3" is '000'. In all other cases <extend> is required and must be UXTX when "option" is '011'. 


Is the left shift amount to be applied after extension in the range 0 to 4, defaulting to 0, encoded in 
the "imm3" field. It must be absent when <extend> is absent, is required when <extend> is LSL, 
and is optional when <extend> is present but not LSL. 


bits(datasize) result; 
bits(datasize) operandl = if n == 31 then SP[] else X[n]; 
bits(datasize) operand2 = ExtendReg(m, extend_type, shift); 


operand2 = NOT(operand2) ; 
(result, -) = AddWithCarry(operand1, operand2, '1'); 


if d == 31 then 
SP[] = result; 
else 
X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


- The execution time of this instruction is independent of: 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.308 SUB (immediate) 


Subtract (immediate) subtracts an optionally-shifted immediate value from a register value, and writes the result to 
the destination register. 


|31 30 29 28|27 26 25 24/23 2221 | | | 109 | 5 4| 0 | 
isflifo[1 0 0 0 1 ojs] immi2 Rn | R | 
op S 


32-bit variant 
Applies when sf == 0. 


SUB <Wd|WSP>, <Wn|WSP>, #<imm>{, <shift>} 


64-bit variant 
Applies when sf == 1. 


SUB <Xd|SP>, <Xn|SP>, #<imm>{, <shift>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer datasize = if sf == '1' then 64 else 32; 
bits(datasize) imm; 


case sh of 
when 'Q' imm = ZeroExtend(imm12, datasize); 
when '1' imm = ZeroExtend(imm12:Zeros(12), datasize); 


Assembler symbols 





<Wd | WSP> Is the 32-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Wn | WSP> Is the 32-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 

<Xd | SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Rd" 
field. 

<Xn | SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 

<imm> Is an unsigned immediate, in the range 0 to 4095, encoded in the "imm12" field. 

<shift> Is the optional left shift to apply to the immediate, defaulting to LSL #0 and encoded in the "sh" 


field. It can have the following values: 
LSL #0 when sh = 0 
LSL #12 when sh = 1 


Operation 


bits(datasize) result; 
bits(datasize) operandl = if n == 31 then SP[] else X[n]; 
bits(datasize) operand2; 


operand2 = NOT(imm); 
(result, -) = AddWithCarry(operand1, operand2, '1'); 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C6-1311 
ID070919 Non-Confidential 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


if d == 31 then 
SP[] = result; 
else 
X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


` The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.309 SUB (shifted register) 


ARM DDI 0487E.a 
ID070919 


Subtract (shifted register) subtracts an optionally-shifted register value from a register value, and writes the result 
to the destination register. 


This instruction is used by the alias NEG (shifted register). See Alias conditions for details of when each alias is 
preferred. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 | 109 5 4| o| 


ae e a e a a a a 


op S 


32-bit variant 
Applies when sf == 


SUB <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


SUB <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


if shift == '11' then UNDEFINED; 
if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Alias conditions 





Alias is preferred when 


NEG (shifted register) Rn == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
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<shift> Is the optional shift type to be applied to the second source operand, defaulting to LSL and encoded 
in the "shift" field. It can have the following values: 


LSL when shift = 00 
LSR when shift = 01 


ASR when shift = 10 


The encoding shift = 11 is reserved. 


<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 
For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field. 

Operation 


bits(datasize) result; 
bits(datasize) operandl = X[n]; 
bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 


operand2 = NOT(operand2) ; 
(result, -) = AddWithCarry(operand1, operand2, '1'); 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.310 SUBG 


Subtract with Tag subtracts an immediate value scaled by the Tag granule from the address in the source register, 
modifies the Logical Address Tag of the address using an immediate value, and writes the result to the destination 
register. Tags specified in GCR_EL1.Exclude are excluded from the possible outputs when modifying the Logical 
Address Tag. 


ARMv8.5 


[31 30 29 28|27 26 25 24|23 2221 | 16|15 14 13 10 9 5 4| 0| 


[for 0001 o] ume OO uma | a [| a 


op3 


Integer variant 


SUBG <Xd|SP>, <Xn|SP>, #<uimm6>, #<uimm4> 


Decode for this encoding 
integer d = UInt(Xd); 


integer n = UInt(Xn); 
bits(64) offset = LSL(ZeroExtend(uimm6, 64), LOG2_TAG_GRANULE) ; 


Assembler symbols 


<Xd | SP> Is the 64-bit name of the destination general-purpose register or stack pointer, encoded in the "Xd" 
field. 

<Xn | SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Xn" field. 

<uimm6> Is an unsigned immediate, a multiple of 16 in the range 0 to 1008, encoded in the "uimm6" field. 

<uimm4> Is an unsigned immediate, in the range 0 to 15, encoded in the "uimm4" field. 

Operation 


bits(64) operandl = if n == 31 then SP[] else X[n]; 

bits(4) start_tag = AArch64.AllocationTagFromAddress(operand1) ; 
bits(16) exclude = GCR_EL1.Exclude; 

bits(64) result; 

bits(4) rtag; 


if AArch64.AllocationTagAccessIsEnabled() then 

rtag = AArch64.ChooseNonExcludedTag(start_tag, uimm4, exclude); 
else 

rtag = '0000'; 


(result, -) = AddWithCarry(operand1, NOT(offset), '1'); 
result = AArch64.AddresswWithAl locationTag(result, rtag); 
if d == 31 then 

SP[] = result; 


else 
X[d] = result; 
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C6.2.311 


C6-1316 


SUBP 


Subtract Pointer subtracts the 56-bit address held in the second source register from the 56-bit address held in the 
first source register, sign-extends the result to 64-bits, and writes the result to the destination register. 


ARMV8.5 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0| 


loloj 1010110] xm  [oļofojojojo] xn | xi | 


Integer variant 


SUBP <Xd>, <Xn|SP>, <Xm|SP> 


Decode for this encoding 


integer d = UInt(Xd); 
integer n = UInt(Xn); 
integer m = UInt(Xm); 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Xd" field. 

<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Xn" 
field. 

<Xm| SP> Is the 64-bit name of the second general-purpose source register or stack pointer, encoded in the 
"Xm" field. 

Operation 


bits(64) operandl = if n == 31 then SP[] else X[n]; 
bits(64) operand2 = if m == 31 then SP[] else X[m]; 
operand1 = SignExtend(operand1<55:0>, 64); 
operand2 = SignExtend(operand2<55:0>, 64); 


bits(64) result; 


operand2 = NOT(operand2) ; 
(result, -) = AddWithCarry(operand1, operand2, '1'); 


X[d] = result; 
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C6.2.312 SUBPS 


ARM DDI 0487E.a 
ID070919 


Subtract Pointer, setting Flags subtracts the 56-bit address held in the second source register from the 56-bit address 
held in the first source register, sign-extends the result to 64-bits, and writes the result to the destination register. It 
updates the condition flags based on the result of the subtraction. 


This instruction is used by the alias CMPP. See Alias conditions for details of when each alias is preferred. 


ARMVv8.5 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


hlolli 10 10110| xm _ fofofofojofo] xn | xi | 


Integer variant 


SUBPS <Xd>, <Xn|SP>, <Xm|SP> 


Decode for this encoding 


integer d = UInt(Xd); 
integer n = UInt(Xn); 
integer m = UInt(Xm); 


Alias conditions 





Alias is preferred when 


CMPP S == '1' & Xd == '11111' 





Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Xd" field. 

<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Xn" 
field. 

<Xm| SP> Is the 64-bit name of the second general-purpose source register or stack pointer, encoded in the 
"Xm" field. 

Operation 


bits(64) operandl = if n == 31 then SP[] else X[n]; 
bits(64) operand2 = if m == 31 then SP[] else X[m]; 
operand1 = SignExtend(operand1<55:0>, 64); 
operand2 = SignExtend(operand2<55:0>, 64); 


bits(64) result; 
bits(4) nzcv; 


operand2 = NOT(operand2) ; 
(result, nzcv) = AddWithCarry(operand1, operand2, '1'); 


PSTATE.<N,Z,C,V> = nzcv; 
X[d] = result; 
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C6.2.313 


C6-1318 


SUBS (extended register) 


Subtract (extended register), setting flags, subtracts a sign or zero-extended register value, followed by an optional 
left shift amount, from a register value, and writes the result to the destination register. The argument that is extended 
from the <Rm> register can be a byte, halfword, word, or doubleword. It updates the condition flags based on the 


result. 


This instruction is used by the alias CMP (extended register). See Alias conditions for details of when each alias is 


preferred. 
|31 30 29 28|27 26 25 24/23 22 21 20| 1615 1312| 109 | 5 4| 0 | 
07074 1]0 0]1] Rm | option] mma] Rn. Ra | 
op S 
32-bit variant 


Applies when sf == 0. 


SUBS <Wd>, <Wn|WSP>, <Wm>{, <extend> {#<amount>}} 


64-bit variant 
Applies when sf == 1. 


SUBS <Xd>, <Xn|SP>, <R><m>{, <extend> {#<amount>}} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer datasize = if sf == '1' then 64 else 32; 
ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = UInt(imm3); 

if shift > 4 then UNDEFINED; 


Alias conditions 


Alias is preferred when 


CMP (extended register) Rd == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn |WSP> Is the 32-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn | SP> Is the 64-bit name of the first source general-purpose register or stack pointer, encoded in the "Rn" 
field. 

<R> Is a width specifier, encoded in the "option" field. It can have the following values: 
W when option = 00x 
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<m> 


<extend> 


<amount> 


Operation 


A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


W when option = 010 
X when option = x11 
W when option = 10x 
W when option = 110 


Is the number [0-30] of the second general-purpose source register or the name ZR (31), encoded in 
the "Rm" field. 


For the 32-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 


UXTB when option = 000 
UXTH when option = 001 
LSL|UXTW when option = 010 
UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If "Rn" is '11111' (WSP) and "option" is '010' then LSL is preferred, but may be omitted when 
"imm3" is '000'. In all other cases <extend> is required and must be UXTW when "option" is '010'. 


For the 64-bit variant: is the extension to be applied to the second source operand, encoded in the 
"option" field. It can have the following values: 


UXTB when option = 000 
UXTH when option = 001 
UXTW when option = 010 
LSL|UXTX when option = 011 
SXTB when option = 100 
SXTH when option = 101 
SXTW when option = 110 
SXTX when option = 111 


If"Rn" is '11111' (SP) and "option" is '011' then LSL is preferred, but may be omitted when "imm3" 
is '000'. In all other cases <extend> is required and must be UXTX when "option" is '011'. 


Is the left shift amount to be applied after extension in the range 0 to 4, defaulting to 0, encoded in 
the "imm3" field. It must be absent when <extend> is absent, is required when <extend> is LSL, 
and is optional when <extend> is present but not LSL. 


bits(datasize) result; 


bits(datasize) operand1 


if n == 31 then SP[] else X[n]; 


bits(datasize) operand2 = ExtendReg(m, extend_type, shift); 


bits(4) nzcv; 


operand2 = NOT(operand2) ; 
(result, nzcv) = AddWithCarry(operand1, operand2, '1'); 


PSTATE.<N,Z,C,V> = nzcv; 


X[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.314 SUBS (immediate) 


ARM DDI 0487E.a 
ID070919 


Subtract (immediate), setting flags, subtracts an optionally-shifted immediate value from a register value, and writes 
the result to the destination register. It updates the condition flags based on the result. 


This instruction is used by the alias CMP (immediate). See Alias conditions for details of when each alias is 
preferred. 


|31 30 29 28|27 26 25 24|23 2221 | | | 109 | 5 4| 0 | 
isfli{i{1 o 0 o 1 ojs] ____ imm2 | m | rR | 
op S 
32-bit variant 


Applies when sf == 0. 


SUBS <Wd>, <Wn|WSP>, #<imm>{, <shift>} 


64-bit variant 
Applies when sf == 1. 


SUBS <Xd>, <Xn|SP>, #<imm>{, <shift>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer datasize = if sf == '1' then 64 else 32; 
bits(datasize) imm; 


case sh of 
when 'Q' imm = ZeroExtend(imm12, datasize); 
when '1' imm = ZeroExtend(imm12:Zeros(12), datasize); 


Alias conditions 





Alias is preferred when 


CMP (immediate) Rd == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn | WSP> Is the 32-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn | SP> Is the 64-bit name of the source general-purpose register or stack pointer, encoded in the "Rn" field. 
<imm> Is an unsigned immediate, in the range 0 to 4095, encoded in the "imm12" field. 

<shift> Is the optional left shift to apply to the immediate, defaulting to LSL #0 and encoded in the "sh" 


field. It can have the following values: 
LSL #0 when sh = 0 
LSL #12 when sh = 1 
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Operation 

bits(datasize) result; 

bits(datasize) operandl = if n == 31 then SP[] else X[n]; 
bits(datasize) operand2; 

bits(4) nzcv; 


operand2 = NOT(imm); 
(result, nzcv) = AddWithCarry(operand1, operand2, '1'); 


PSTATE.<N,Z,C,V> = nzcv; 


X[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.315 SUBS (shifted register) 


Subtract (shifted register), setting flags, subtracts an optionally-shifted register value from a register value, and 
writes the result to the destination register. It updates the condition flags based on the result. 


This instruction is used by the aliases CMP (shifted register) and NEGS. See Alias conditions for details of when 
each alias is preferred. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 | 109 5 4| o| 


AAE E T a 


op S 


32-bit variant 
Applies when sf == 


SUBS <Wd>, <Wn>, <Wm>{, <shift> #<amount>} 


64-bit variant 
Applies when sf == 


SUBS <Xd>, <Xn>, <Xm>{, <shift> #<amount>} 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


if shift == '11' then UNDEFINED; 
if sf == 'Q' && imm6<5> == '1' then UNDEFINED; 


ShiftType shift_type = DecodeShift(shift) ; 
integer shift_amount = UInt(imm6); 


Alias conditions 





Alias is preferred when 


CMP (shifted register) Rd == '11111' 


NEGS Rn == '11111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
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<shift> Is the optional shift type to be applied to the second source operand, defaulting to LSL and encoded 
in the "shift" field. It can have the following values: 


LSL when shift = 00 
LSR when shift = 01 


ASR when shift = 10 


The encoding shift = 11 is reserved. 


<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 
For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field. 

Operation 


bits(datasize) result; 

bits(datasize) operandl = X[n]; 

bits(datasize) operand2 = ShiftReg(m, shift_type, shift_amount) ; 
bits(4) nzcv; 


operand2 = NOT(operand2) ; 
(result, nzcv) = AddWithCarry(operand1, operand2, '1'); 


PSTATE.<N,Z,C,V> = nzcv; 


X[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.316 SVC 
Supervisor Call causes an exception to be taken to EL1. 


On executing an SVC instruction, the PE records the exception as a Supervisor Call exception in ESR_ELx, using the 
EC value 0x15, and the value of the immediate argument. 


|31 30 29 28|27 26 25 24/23 22 21 20| | | | 5 4/3 21 0| 
11010100ļo00| imme ——C—C‘i‘L‘ OC ofo 1| 


System variant 


SVC #<imm> 
Decode for this encoding 


// Empty. 


Assembler symbols 


<imm> Is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the "imm16" field. 


Operation 


AArch64.Cal]Supervisor(imm16) ; 
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C6.2.317 


C6-1326 


SWPB, SWPAB, SWPALB, SWPLB 


Swap byte in memory atomically loads an 8-bit byte from a memory location, and stores the value held in a register 
back to the same memory location. The value initially loaded from memory is returned in the destination register. 


° If the destination register is not WZR, SWPAB and SWPALB load from memory with acquire semantics. 
$ SWPLB and SWPALB store to memory with release semantics. 
° SWPB has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


ARMV8.1 


31 a 20| aek 10 9 m 5 4| 0 | 


size 


SWPAB variant 
Applies when A == 1 & R == 0. 


SWPAB <Ws>, <Wt>, [<Xn|SP>] 


SWPALB variant 
Applies when A == 1 && R == 1. 


SWPALB <Ws>, <Wt>, [<Xn|SP>] 


SWPB variant 
Applies when A == 0 && R == 0. 


SWPB <Ws>, <Wt>, [<Xn|SP>] 


SWPLB variant 
Applies when A == 0 && R = 1. 


SWPLB <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


AccType ldacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
boolean tag_checked = n != 31; 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register to be stored, encoded in the "Rs" field. 
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<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(8) data; 
bits(8) store_value; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


store_value = X[s]; 
data = MemAtomic(address, MemAtomicOp_SWP, store_value, ldacctype, stacctype); 
X[t] = ZeroExtend(data, 32); 
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C6.2.318 


C6-1328 


SWPH, SWPAH, SWPALH, SWPLH 


Swap halfword in memory atomically loads a 16-bit halfword from a memory location, and stores the value held in 
a register back to the same memory location. The value initially loaded from memory is returned in the destination 
register. 


° If the destination register is not WZR, SWPAH and SWPALH load from memory with acquire semantics. 
$ SWPLH and SWPALH store to memory with release semantics. 
s SWPH has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


ARMv8.1 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 121110 9. | 54| 0| 
fo afa 1 1fofo ofAfR}t] Rs [loo ojo of Rn | R | 
size 
SWPAH variant 


Applies when A == 1 & R = 0. 


SWPAH <Ws>, <Wt>, [<Xn|SP>] 


SWPALH variant 
Applies when A == 1 && R == 1. 


SWPALH <Ws>, <Wt>, [<Xn|SP>] 


SWPH variant 
Applies when A == 0 && R == 0. 


SWPH <Ws>, <Wt>, [<Xn|SP>] 


SWPLH variant 
Applies when A == 0 & R == 1. 


SWPLH <Ws>, <Wt>, [<Xn|SP>] 


Decode for all variants of this encoding 
if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
=n != 31; 


AccType ldacctype = 
AccType stacctype = 
boolean tag_checked 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register to be stored, encoded in the "Rs" field. 
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<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(16) data; 
bits(16) store_value; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


store_value = X[s]; 
data = MemAtomic(address, MemAtomicOp_SWP, store_value, ldacctype, stacctype); 
X[t] = ZeroExtend(data, 32); 
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C6.2.319 SWP, SWPA, SWPAL, SWPL 


Swap word or doubleword in memory atomically loads a 32-bit word or 64-bit doubleword from a memory location, 
and stores the value held in a register back to the same memory location. The value initially loaded from memory 
is returned in the destination register. 


e If the destination register is not one of WZR or XZR, SWPA and SWPAL load from memory with acquire semantics. 
$ SWPL and SWPAL store to memory with release semantics. 
: SWP has no memory ordering requirements. 


For more information about memory ordering semantics see Load-Acquire, Load-AcquirePC, and Store-Release on 
page B2-129. 


For information about memory accesses see Load/Store addressing modes on page C1-177. 


ARMVv8.1 
bs tac ca 20) Hie 10 9 L 5 4] 0| 
size 
32-bit SWP variant 
Applies when size == 10 & A == 0 && R == 0. 


SWP <Ws>, <Wt>, [<Xn|SP>] 


32-bit SWPA variant 

Applies when size == 10 && A == 1 && R == 0. 
SWPA <Ws>, <Wt>, [<Xn|SP>] 

32-bit SWPAL variant 

Applies when size == 10 && A == 1 & R = 1. 
SWPAL <Ws>, <Wt>, [<Xn|SP>] 

32-bit SWPL variant 

Applies when size == 10 && A == 0 && R = 1. 
SWPL <Ws>, <Wt>, [<Xn|SP>] 

64-bit SWP variant 

Applies when size == 11 && A == 0 && R == 0. 
SWP <Xs>, <Xt>, [<Xn|SP>] 

64-bit SWPA variant 

Applies when size == 11 && A == 1 && R == 0. 
SWPA <Xs>, <Xt>, [<Xn|SP>] 

64-bit SWPAL variant 


Applies when size == 11 && A == 1 && R = 1. 
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SWPAL <Xs>, <Xt>, [<Xn|SP>] 


64-bit SWPL variant 

Applies when size == 11 && A == 0 && R == 
SWPL <Xs>, <Xt>, [<Xn|SP>] 

Decode for all variants of this encoding 


if !HaveAtomicExt() then UNDEFINED; 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer s = UInt(Rs); 


integer datasize = 8 << UInt(size); 

integer regsize = if datasize == 64 then 64 else 32; 

AccType lIdacctype = if A == '1' && Rt != '11111' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 
AccType stacctype = if R == '1' then AccType_ORDEREDATOMICRW else AccType_ATOMICRW; 

boolean tag_checked = n != 31; 


Assembler symbols 


<Ws> Is the 32-bit name of the general-purpose register to be stored, encoded in the "Rs" field. 

<Wt> Is the 32-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 

<Xs> Is the 64-bit name of the general-purpose register to be stored, encoded in the "Rs" field. 

<Xt> Is the 64-bit name of the general-purpose register to be loaded, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
Operation 


bits(64) address; 
bits(datasize) data; 
bits(datasize) store_value; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 
else 
address = X[n]; 


store_value = X[s]; 
data = MemAtomic(address, MemAtomicOp_SWP, store_value, ldacctype, stacctype); 
X[t] = ZeroExtend(data, regsize); 
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C6.2.320 


C6-1332 


SXTB 


Signed Extend Byte extracts an 8-bit value from a register, sign-extends it to the size of the register, and writes the 


result to the destination register. 
This instruction is an alias of the SBFM instruction. This means that: 
$ The encodings in this description are named to match the encodings of SBFM. 


° The description of SBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


ao oan roo a ee a 


opc immr imms 


32-bit variant 

Applies when sf == 0 && N == 
SXTB <Wd>, <Wn> 

is equivalent to 

SBFM <Wd>, <Wn>, #0, #7 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1 && N == 
SXTB <Xd>, <Wn> 

is equivalent to 

SBFM <Xd>, <Xn>, #0, #7 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


The description of SBFM gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 
: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.321 


C6-1334 


SXTH 


Sign Extend Halfword extracts a 16-bit value, sign-extends it to the size of the register, and writes the result to the 


destination register. 
This instruction is an alias of the SBFM instruction. This means that: 
$ The encodings in this description are named to match the encodings of SBFM. 


s The description of SBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


ao oan roe eae a 


opc immr imms 


32-bit variant 

Applies when sf == 0 && N == 
SXTH <Wd>, <Wn> 

is equivalent to 

SBFM <Wd>, <Wn>, #0, #15 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1 && N == 
SXTH <Xd>, <Wn> 

is equivalent to 

SBFM <Xd>, <Xn>, #0, #15 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


The description of SBFM gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 
: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.322 


C6-1336 


SXTW 


Sign Extend Word sign-extends a word to the size of the register, and writes the result to the destination register. 
This instruction is an alias of the SBFM instruction. This means that: 
$ The encodings in this description are named to match the encodings of SBFM. 


è The description of SBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 2221 | 16/15 10 9 5 4| 0 | 


(i a | 


sf opc N immr imms 


64-bit variant 
SXTW <Xd>, <Wn> 
is equivalent to 
SBFM <Xd>, <Xn>, #0, #31 


and is always the preferred disassembly. 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


The description of SBFM gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


š The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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System instruction. For more information, see op0==0b01, cache maintenance, TLB maintenance, and address 
translation instructions on page C5-366 for the encodings of System instructions. 


This instruction is used by the aliases AT, CFP, CPP, DC, DVP, IC, and TLBI. See Alias conditions for details of 
when each alias is preferred. 


|31 30 29 28|27 26 25 24|23 22 21 20/1918  16|15 12\11 8|7 54| o| 


AEREE ij opt | cRn | Rm | op2 | Rt 


System variant 


SYS #<opl>, <Cn>, <Cm>, #<op2>{, <Xt>} 
Decode for this encoding 
AArch64.CheckSystemAccess('Q1', op1, CRn, CRm, op2, Rt, L); 


integer t = UInt(Rt); 


integer sys_op1 = UInt(op1); 
integer sys_op2 = UInt(op2); 
integer sys_crn = UInt(CRn); 


integer sys_crm = UInt(CRm); 


Alias conditions 








Alias is preferred when 

AT CRn == 'Q111' && CRm == '100x' && SysOp(op1,'Q111',CRm,op2) == 
Sys_AT 

CFP opl == 'Q11' && CRn == 'Q111' && CRm == '0011' && op2 == '100' 

CPP opl == 'Q11' && CRn == 'Q111' && CRm == 'Q011' && op2 == '111' 

DC CRn == 'Q111' && SysOp(op1,'0111',CRm,op2) == Sys_DC 

DVP opl == 'Q11' && CRn == 'Q111' && CRm == 'Q011' && op2 == '101' 

IC CRn == '0111' && SysOp(op1,'0111',CRm,op2) == Sys_IC 

TLBI CRn == '1000' && SysOp(op1,'1000',CRm,op2) == Sys_TLBI 





Assembler symbols 


<op1> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op1" field. 

<Cn> Is a name 'Cn', with 'n' in the range 0 to 15, encoded in the "CRn" field. 

<Cm> Is a name 'Cm', with 'm' in the range 0 to 15, encoded in the "CRm" field. 

<op2> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op2" field. 

<Xt> Is the 64-bit name of the optional general-purpose source register, defaulting to '11111', encoded in 


the "Rt" field. 
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Operation 


AArch64.SysInstr(1, sys_op1, sys_crn, sys_crm, sys_op2, X[t]); 
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C6.2.324 SYSL 


System instruction with result. For more information, see op0==0b01, cache maintenance, TLB maintenance, and 
address translation instructions on page C5-366 for the encodings of System instructions. 


[31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12\11 8/7 54] 0 | 


pio ro dodo ofifo if opt | or | orm | ope | Rt | 


System variant 


SYSL <Xt>, #<opl>, <Cn>, <Cm>, #<op2> 


Decode for this encoding 

AArch64.CheckSystemAccess('Q1', op1, CRn, CRm, op2, Rt, L); 
integer t = UInt(Rt); 

integer sys_op1 = UInt(op1); 

integer sys_op2 = UInt(op2); 


integer sys_crn = UInt(CRn); 
integer sys_crm = UInt(CRm); 


Assembler symbols 


<Xt> Is the 64-bit name of the general-purpose destination register, encoded in the "Rt" field. 
<op1> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op1" field. 

<Cn> Is a name 'Cn', with 'n' in the range 0 to 15, encoded in the "CRn" field. 

<Cm> Is a name 'Cm', with 'm' in the range 0 to 15, encoded in the "CRm" field. 

<op2> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op2" field. 
Operation 


X[t] = AArch64.SysInstrWithResult(1, sys_opl, sys_crn, sys_crm, sys_op2); 
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C6.2.325 TBNZ 


instructions 


Test bit and Branch if Nonzero compares the value of a bit in a general-purpose register with zero, and conditionally 
branches to a label at a PC-relative offset if the comparison is not equal. It provides a hint that this is not a subroutine 
call or return. This instruction does not affect condition flags. 


|31 30 29 


28|27 26 25 24|23 |1918 | | | 5 4| 0 | 


bs[o 11 01 1j] wo Pimms | R | 
op 


14-bit signed PC-relative branch offset variant 


TBNZ <R><t>, #<imm>, <label> 


Decode for this encoding 


integer t 


= UInt(Rt); 


integer datasize = if b5 == '1' then 64 else 32; 
integer bit_pos = UInt(b5:b4Q); 
bits(64) offset = SignExtend(imm14:'00', 64); 


Assembler symbols 


<R> Is a width specifier, encoded in the "b5" field. It can have the following values: 
W when b5 = 0 
X when b5 = 1 
In assembler source code an 'X' specifier is always permitted, but a 'W' specifier is only permitted 
when the bit number is less than 32. 

<t> Is the number [0-30] of the general-purpose register to be tested or the name ZR (31), encoded in 
the "Rt" field. 

<imm> Is the bit number to be tested, in the range 0 to 63, encoded in "b5:b40". 

<label> Is the program label to be conditionally branched to. Its offset from the address of this instruction, 
in the range +/-32KB, is encoded as "imm14" times 4. 

Operation 


bits(datasize) operand = X[t]; 


if operand<bit_pos> == op then 
BranchTo(PC[] + offset, BranchType_DIR); 


C6-1340 
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C6.2.326 TBZ 


Test bit and Branch if Zero compares the value of a test bit with zero, and conditionally branches to a label at a 
PC-relative offset if the comparison is equal. It provides a hint that this is not a subroutine call or return. This 
instruction does not affect condition flags. 


|31 30 29 28|27 26 25 24|23 |1918 | | | 5 4| 0 | 


bs[o 11 0 1 tfof wo | mm, | R | 
op 


14-bit signed PC-relative branch offset variant 


TBZ <R><t>, #<imm>, <label> 


Decode for this encoding 
integer t = UInt(Rt); 
integer datasize = if b5 == '1' then 64 else 32; 


integer bit_pos = UInt(b5:b40); 
bits(64) offset = SignExtend(imm14:'00', 64); 


Assembler symbols 


<R> Is a width specifier, encoded in the "b5" field. It can have the following values: 
W when b5 = 0 
X when b5 = 1 


In assembler source code an 'X' specifier is always permitted, but a 'W' specifier is only permitted 
when the bit number is less than 32. 


<t> Is the number [0-30] of the general-purpose register to be tested or the name ZR (31), encoded in 
the "Rt" field. 


<imm> Is the bit number to be tested, in the range 0 to 63, encoded in "b5:b40". 
<label> Is the program label to be conditionally branched to. Its offset from the address of this instruction, 
in the range +/-32KB, is encoded as "imm14" times 4. 
Operation 
bits(datasize) operand = X[t]; 


if operand<bit_pos> == op then 
BranchTo(PC[] + offset, BranchType_DIR); 
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C6.2.327 


C6-1342 


TLBI 


TLB Invalidate operation. For more information, see op0==0b01, cache maintenance, TLB maintenance, and 


address translation instructions on page C5-366. 


This instruction is an alias of the SYS instruction. This means that: 


$ The encodings in this description are named to match the encodings of SYS. 
s The description of SYS gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20|1918  16|15 12111 8|7 54] 0| 


110101010000 i| pt |000] cm [om] R | 
L CRn 


System variant 

TLBI <tlbi_op>{, <Xt>} 

is equivalent to 

SYS #<opl>, C8, <Cm>, #<op2>{, <Xt>} 


and is the preferred disassembly when SysOp(op1,'1000',CRm,op2) == Sys_TLBI. 


Assembler symbols 


<op1> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op1" field. 

<Cm> Is a name 'Cm', with 'm' in the range 0 to 15, encoded in the "CRm" field. 

<op2> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "op2" field. 

<t]bi_op> Is a TLBI instruction name, as listed for the TLBI system instruction group, encoded in the 


"opl:CRm:op2" field. It can have the following values: 
VMALLE1IS when op1 = 000, CRm = 0011, op2 = 000 

VAE1IS when op1 = 000, CRm = 0011, op2 = 001 
ASIDE1IS when op1 = 000, CRm = 0011, op2 = 010 
VAAE1IS when op1 = 000, CRm = 0011, op2 = 011 
VALE1IS when op1 = 000, CRm = 0011, op2 = 101 
VAALE1IS when op1 = 000, CRm = 0011, op2 = 111 


VMALLE1 when op1 = 000, CRm = 0111, op2 = 000 
VAE1 when op1 = 000, CRm = 0111, op2 = 001 
ASIDE1 when op1 = 000, CRm = 0111, op2 = 010 
VAAE1 when op1 = 000, CRm = 0111, op2 = 011 
VALEL when op1 = 000, CRm = 0111, op2 = 101 
VAALEL when op1 = 000, CRm = 0111, op2 = 111 





IPAS2E1IS when opl = 100, CRm = 0000, op2 = 001 
IPAS2LE1IS when op1 = 100, CRm = 0000, op2 = 101 
ALLE2IS when op1 = 100, CRm = 0011, op2 = 000 
VAE2IS when op1 = 100, CRm = 0011, op2 = 001 
ALLE1IS when op1 = 100, CRm = 0011, op2 = 100 
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VALE2IS when op1 = 100, CRm = 0011, op2 = 101 
VMALLS12E1ISwhen op1 = 100, CRm = 0011, op2 = 110 





IPAS2E1 when op1 = 100, CRm = 0100, op2 = 001 
IPAS2LE1 when opl = 100, CRm = 0100, op2 = 101 
ALLE2 when op1 = 100, CRm = 0111, op2 = 000 
VAE2 when op1 = 100, CRm = 0111, op2 = 001 
ALLE1 when op1 = 100, CRm = 0111, op2 = 100 
VALE2 when op1 = 100, CRm = 0111, op2 = 101 
VMALLS12E1 when op1 = 100, CRm = 0111, op2 = 110 





ALLE3IS when op1 = 110, CRm = 0011, op2 = 000 
VAE3IS when op1 = 110, CRm = 0011, op2 = 001 
VALE3IS when op1 = 110, CRm = 0011, op2 = 101 


ALLE3 when op1 = 110, CRm = 0111, op2 = 000 
VAE3 when op1 = 110, CRm = 0111, op2 = 001 
VALE3 when op1 = 110, CRm = 0111, op2 = 101 


When ARMv8.4-TLBI is implemented, the following values are also valid: 
VMALLE10S_ when op1 = 000, CRm = 0001, op2 = 000 

VAE10S when op1 = 000, CRm = 0001, op2 = 001 
ASIDE10S_ when op1 = 000, CRm = 0001, op2 = 010 
VAAE10S when op1 = 000, CRm = 0001, op2 = 011 
VALE10S when op1 = 000, CRm = 0001, op2 = 101 
VAALE10S when op1 = 000, CRm = 0001, op2 = 111 
RVAE1IS when op1 = 000, CRm = 0010, op2 = 001 
RVAAE1IS when opl = 000, CRm = 0010, op2 = 011 
RVALE1IS when op1 = 000, CRm = 0010, op2 = 101 
RVAALE1IS when opl = 000, CRm = 0010, op2 = 111 
RVAE10S when op1 = 000, CRm = 0101, op2 = 001 
RVAAE10S_ when op1 = 000, CRm = 0101, op2 = 011 
RVALE10S_ when op1 = 000, CRm = 0101, op2 = 101 
RVAALE10S when op1 = 000, CRm = 0101, op2 = 111 
RVAEL when op1 = 000, CRm = 0110, op2 = 001 
RVAAE1 when op1 = 000, CRm = 0110, op2 = 011 
RVALE1 when op1 = 000, CRm = 0110, op2 = 101 
RVAALE1 when op1 = 000, CRm = 0110, op2 = 111 
RIPAS2E1IS when op1 = 100, CRm = 0000, op2 = 010 
RIPAS2LE1ISwhen op1 = 100, CRm = 0000, op2 = 110 
ALLE20S when op1 = 100, CRm = 0001, op2 = 000 
VAE20S when op1 = 100, CRm = 0001, op2 = 001 
ALLE10S when op1 = 100, CRm = 0001, op2 = 100 
VALE20S when op1 = 100, CRm = 0001, op2 = 101 
VMALLS12E10Swhen op1 = 100, CRm = 0001, op2 = 110 
RVAE2IS when op1 = 100, CRm = 0010, op2 = 001 














RVALE2IS when op1 = 100, CRm = 0010, op2 = 101 
IPAS2E10S when op1 = 100, CRm = 0100, op2 = 000 
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C6-1344 


<Xt> 


Operation 


The description of SYS gives the operational pseudocode for this instruction. 
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RIPAS2E1 when op1 
RIPAS2E10S when op1 
IPAS2LE10S when op1 
RIPAS2LE1 when op1 
RIPAS2LE10Swhen op1 
RVAE20S when op1 
RVALE20S_ when op1 
RVAE2 when op1 
RVALE2 when op1 
ALLE30S when op1 
VAE30S when op1 
VALE30S when op1 
RVAE31S when op1 
RVALE3IS_ when op1 
RVAE30S when op1 
RVALE30S_ when op1 
RVAE3 when op1 
RVALE3 when op1 


100, CRm = 0100, op2 
100, CRm = 0100, op2 
100, CRm = 0100, op2 
100, CRm = 0100, op2 
100, CRm = 0100, op2 
100, CRm = 0101, op2 
100, CRm = 0101, op2 
100, CRm = 0110, op2 
100, CRm = 0110, op2 
110, CRm = 0001, op2 
110, CRm = 0001, op2 
110, CRm = 0001, op2 
110, CRm = 0010, op2 
110, CRm = 0010, op2 
110, CRm = 0101, op2 
110, CRm = 0101, op2 
110, CRm = 0110, op2 
110, CRm = 0110, op2 





010 
011 
100 
110 
111 
001 
101 
001 
101 
000 
001 
101 
001 
101 
001 
101 
001 
101 





Is the 64-bit name of the optional general-purpose source register, defaulting to '11111', encoded in 


the "Rt" field. 


ARM DDI 0487E.a 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.328 TSB CSYNC 


ARM DDI 0487E.a 
ID070919 


Trace Synchronization Barrier. This instruction is a barrier that synchronizes the trace operations of instructions. 


If ARMv8.4-Trace is not implemented, this instruction executes as a NOP. 


ARMV8.4 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/11 8/7 5 4/3 21 0] 
110101010 0/0/00 0/0 1 1/0 0 10/0 0 1 O]0 1 Olt 1 4-4 4 
CRm op2 
System variant 
TSB CSYNC 
Decode for this encoding 
if !HaveSelfHostedTrace() then EndOfInstruction(); 
Operation 
TraceSynchronizationBarrier(); 
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C6.2 Alphabetical list of A64 base instructions 


C6.2.329 


C6-1346 


TST (immediate) 


Test bits (immediate) , setting the condition flags and discarding the result : Rn AND imm 


This instruction is an alias of the ANDS (immediate) instruction. This means that: 


: The encodings in this description are named to match the encodings of ANDS (immediate). 
° The description of ANDS (immediate) gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 2221 | 1615 | 109 | 5 4| 0 | 
fst 1]1 00710 O(N] mmr | mms | Rn [1 77 71 
opc Rd 
32-bit variant 


Applies when sf == 0 && N == 

TST <Wn>, #<imm> 

is equivalent to 

ANDS WZR, <Wn>, #<imm> 

and is always the preferred disassembly. 
64-bit variant 

Applies when sf = 1. 

TST <Xn>, #<imm> 

is equivalent to 

ANDS XZR, <Xn>, #<imm> 


and is always the preferred disassembly. 


Assembler symbols 


<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<imm> For the 32-bit variant: is the bitmask immediate, encoded in "imms:immr". 


For the 64-bit variant: is the bitmask immediate, encoded in "N:imms:immr". 


Operation 


The description of ANDS (immediate) gives the operational pseudocode for this instruction. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.330 TST (shifted register) 


Test (shifted register) performs a bitwise AND operation on a register value and an optionally-shifted register value. 
It updates the condition flags based on the result, and discards the result. 


This instruction is an alias of the ANDS (shifted register) instruction. This means that: 
g The encodings in this description are named to match the encodings of ANDS (shifted register). 


s The description of ANDS (shifted register) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 | 109 | 5 4| 0| 
felt t[o 1071 Ofshiefo] Rm | mme | R ‘(i 77714 
opc N Rd 
32-bit variant 
Applies when sf == 0. 
TST <Wn>, <Wm>{, <shift> #<amount>} 
is equivalent to 
ANDS WZR, <Wn>, <Wm>{, <shift> #<amount>} 


and is always the preferred disassembly. 


64-bit variant 

Applies when sf == 1. 

TST <Xn>, <Xm>{, <shift> #<amount>} 

is equivalent to 

ANDS XZR, <Xn>, <Xm>{, <shift> #<amount>} 


and is always the preferred disassembly. 


Assembler symbols 


<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 

<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 

<shi ft> Is the optional shift to be applied to the final source, defaulting to LSL and encoded in the "shift" 
field. It can have the following values: 
LSL when shift = 00 
LSR when shift = 01 
ASR when shift = 10 
ROR when shift = 11 

<amount> For the 32-bit variant: is the shift amount, in the range 0 to 31, defaulting to 0 and encoded in the 
"imm6" field. 
For the 64-bit variant: is the shift amount, in the range 0 to 63, defaulting to 0 and encoded in the 
"imm6" field, 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


Operation 


The description of ANDS (shifted register) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.331 UBFIZ 


Unsigned Bitfield Insert in Zeros copies a bitfield of <width> bits from the least significant bits of the source register 
to bit position <1sb> of the destination register, setting the destination bits above and below the bitfield to zero. 


This instruction is an alias of the UBFM instruction. This means that: 
g The encodings in this description are named to match the encodings of UBFM. 


s The description of UBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


FET T E 


opc 


32-bit variant 

Applies when sf == 0 && N == 

UBFIZ <Wd>, <Wn>, #<Isb>, #<width> 

is equivalent to 

UBFM <Wd>, <Wn>, #(-<Isb> MOD 32), #(<width>-1) 


and is the preferred disassembly when UInt(imms) < UInt(immr). 


64-bit variant 

Applies when sf == 1 && N == 

UBFIZ <Xd>, <Xn>, #<Isb>, #<width> 

is equivalent to 

UBFM <Xd>, <Xn>, #(-<Isb> MOD 64), #(<width>-1) 


and is the preferred disassembly when UInt(imms) < UInt(immr). 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Isb> For the 32-bit variant: is the bit number of the lsb of the destination bitfield, in the range 0 to 31. 


For the 64-bit variant: is the bit number of the lsb of the destination bitfield, in the range 0 to 63. 


<width> For the 32-bit variant: is the width of the bitfield, in the range 1 to 32-<Isb>. 
For the 64-bit variant: is the width of the bitfield, in the range 1 to 64-<Isb>. 


Operation 


The description of UBFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.332 UBFM 


ARM DDI 0487E.a 
ID070919 


Unigned Bitfield Move is usually accessed via one of its aliases, which are always preferred for disassembly. 


If <imms> is greater than or equal to <immr>, this copies a bitfield of (<imms>-<immr>+1) bits starting from bit position 


<immr> in the source register to the least significant bits of the destination register. 


If <imms> is less than <immr>, this copies a bitfield of (<imms>+1) bits from the least significant bits of the source 
register to bit position (regsize-<immr>) of the destination register, where regsize is the destination register size of 32 


or 64 bits. 


In both cases the destination bits below and above the bitfield are set to zero. 


This instruction is used by the aliases LSL (immediate), LSR (immediate), UBFIZ, UBFX, UXTB, and UXTH. See 


Alias conditions on page C6-1352 for details of when each alias is preferred. 


|31 30 29 28/27 26 25 24|23 2221 | 16/15 | 109 5 4| 0 | 


PRT COR oe E 


opc 


32-bit variant 
Applies when sf == 0 && N == 


UBFM <Wd>, <Wn>, #<immr>, #<imms> 


64-bit variant 
Applies when sf == 1 && N == 


UBFM <Xd>, <Xn>, #<immr>, #<imms> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer datasize = if sf == '1' then 64 else 32; 


integer R; 
bits(datasize) wmask; 
bits(datasize) tmask; 


if sf == '1' && N != '1' then UNDEFINED; 
if sf == '@' && (N != '0' || immr<5> != 'O' || imms<5> != 'Q') then UNDEFINED; 


R = UInt(immr); 
(wmask, tmask) = DecodeBitMasks(N, imms, immr, FALSE); 
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Alias conditions 





Alias of variant is preferred when 

LSL (immediate) 32-bit imms != 'Q11111' && imms + 1 == immr 
LSL (immediate) 64-bit imms != '111111' && imms + 1 == immr 
LSR (immediate) 32-bit imms == '011111' 

LSR (immediate) 64-bit imms == '111111' 

UBFIZ - UInt(imms) < UInt(immr) 

UBFX - BFXPreferred(sf, opc<1>, imms, immr) 
UXTB z immr == '000000' && imms == '000111' 
UXTH z immr == 'Q00000' && imms == '001111' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<immr> For the 32-bit variant: is the right rotate amount, in the range 0 to 31, encoded in the "immr" field. 


For the 64-bit variant: is the right rotate amount, in the range 0 to 63, encoded in the "immr" field. 


<imms> For the 32-bit variant: is the leftmost bit number to be moved from the source, in the range 0 to 31, 
encoded in the "imms" field. 


For the 64-bit variant: is the leftmost bit number to be moved from the source, in the range 0 to 63, 
encoded in the "imms" field. 


Operation 
bits(datasize) src = X[n]; 


// perform bitfield move on low bits 
bits(datasize) bot = ROR(src, R) AND wmask; 


// combine extension bits and result bits 
X[d] = bot AND tmask; 

Operational information 

If PSTATE.DIT is 1: 


è The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C6.2.333 UBFX 


Unsigned Bitfield Extract copies a bitfield of <width> bits starting from bit position <1sb> in the source register to 
the least significant bits of the destination register, and sets destination bits above the bitfield to zero. 


This instruction is an alias of the UBFM instruction. This means that: 
g The encodings in this description are named to match the encodings of UBFM. 


s The description of UBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


FEET CT 


opc 


32-bit variant 

Applies when sf == 0 && N == 

UBFX <Wd>, <Wn>, #<Isb>, #<width> 

is equivalent to 

UBFM <Wd>, <Wn>, #<Isb>, #(<Isb>+<width>-1) 


and is the preferred disassembly when BFxXPreferred(sf, opc<1>, imms, immr). 


64-bit variant 

Applies when sf == 1 && N == 

UBFX <Xd>, <Xn>, #<Isb>, #<width> 

is equivalent to 

UBFM <Xd>, <Xn>, #<Isb>, #(<Isb>+<width>-1) 


and is the preferred disassembly when BFxXPreferred(sf, opc<1>, imms, immr). 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 

<Isb> For the 32-bit variant: is the bit number of the Isb of the source bitfield, in the range 0 to 31. 


For the 64-bit variant: is the bit number of the Isb of the source bitfield, in the range 0 to 63. 


<width> For the 32-bit variant: is the width of the bitfield, in the range 1 to 32-<Isb>. 
For the 64-bit variant: is the width of the bitfield, in the range 1 to 64-<Isb>. 


Operation 


The description of UBFM gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.334 UDF 


Permanently Undefined generates an Undefined Instruction exception (ESR_ELx.EC = 0b000000). The encodings 
for UDF used in this section are defined as permanently UNDEFINED in the Armv8-A architecture. 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 | | | 0 | 


o000000000000000] imme _—___ | 


Integer variant 


UDF #<imm> 


Decode for this encoding 


// The imm16 field is ignored by hardware. 
UNDEFINED; 


Assembler symbols 


<imm> is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the "imm16" field. The PE 
ignores the value of this constant. 


Operation 


// No operation. 
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C6.2.335 UDIV 


Unsigned Divide divides an unsigned integer register value by another unsigned integer register value, and writes 
the result to the destination register. The condition flags are not affected. 


[31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


lojor Fo 1011o] Rm Joo oo sof R | Rd 


32-bit variant 
Applies when sf == 


UDIV <Wd>, <Wn>, <Wm> 


64-bit variant 
Applies when sf == 


UDIV <Xd>, <Xn>, <Xm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if sf == '1' then 64 else 32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register, encoded in the "Rm" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register, encoded in the "Rm" field. 
Operation 


bits(datasize) operand1 = X[n]; 
bits(datasize) operand2 = 
integer result; 


1 
>< 
3 

— 


if IsZero(operand2) then 
result = ð; 
else 
result = RoundTowardsZero(Real(Int(operand1, TRUE)) / Real(Int(operand2, TRUE))); 


X[d] = result<datasize-1:0>; 
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C6.2.336 UMADDL 


Unsigned Multiply-Add Long multiplies two 32-bit register values, adds a 64-bit register value, and writes the result 
to the 64-bit destination register. 


This instruction is used by the alias UMULL. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20 16|15 14 | 109 5 4| 0 | 


leonora e e | | 


64-bit variant 


UMADDL <Xd>, <Wn>, <Wm>, <Xa> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer a = UInt(Ra); 


Alias conditions 





Alias is preferred when 


UMULL Ra == '11111' 





Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 
<Xa> Is the 64-bit name of the third general-purpose source register holding the addend, encoded in the 
"Ra" field. 
Operation 
bits(32) operand1 = X[n]; 
bits(32) operand2 = X[m]; 


bits(64) operand3 = X[a]; 
integer result; 
result = Int(operand3, TRUE) + (Int(operand1, TRUE) » Int(operand2, TRUE)); 


X[d] = result<63:0>; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.337  UMNEGL 


Unsigned Multiply-Negate Long multiplies two 32-bit register values, negates the product, and writes the result to 
the 64-bit destination register. 


This instruction is an alias of the UMSUBL instruction. This means that: 


g The encodings in this description are named to match the encodings of UMSUBL. 
s The description of UMSUBL gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 | 109 5 4| 0 | 
neo o rate e a | a 
Ra 
64-bit variant 


UMNEGL <Xd>, <Wn>, <Wm> 
is equivalent to 
UMSUBL <Xd>, <Wn>, <Wm>, XZR 


and is always the preferred disassembly. 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 

Operation 


The description of UMSUBL gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.338 UMSUBL 


Unsigned Multiply-Subtract Long multiplies two 32-bit register values, subtracts the product from a 64-bit register 
value, and writes the result to the 64-bit destination register. 


This instruction is used by the alias UMNEGL. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 


leon or tt 1] ea] | | 


64-bit variant 


UMSUBL <Xd>, <Wn>, <Wm>, <Xa> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer a = UInt(Ra); 


Alias conditions 





Alias is preferred when 


UMNEGL Ra == '11111' 





Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 
<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 
<Xa> Is the 64-bit name of the third general-purpose source register holding the minuend, encoded in the 
"Ra" field. 
Operation 
bits(32) operand1 = X[n]; 
bits(32) operand2 = X[m]; 


bits(64) operand3 = X[a]; 
integer result; 


result = Int(operand3, TRUE) - (Int(operand1, TRUE) » Int(operand2, TRUE)); 
X[d] = result<63:0>; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.339 UMULH 


Unsigned Multiply High multiplies two 64-bit register values, and writes bits[127:64] of the 128-bit result to the 
64-bit destination register. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 = 5 4| 0 | 


fo of torth of Rm foi Tao a a 


64-bit variant 


UMULH <Xd>, <Xn>, <Xm> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 
<Xm> Is the 64-bit name of the second general-purpose source register holding the multiplier, encoded in 
the "Rm" field. 
Operation 
bits(64) operand1 = X[n]; 
bits(64) operand2 = X[m]; 


integer result; 
result = Int(operand1, TRUE) « Int(operand2, TRUE); 


X[d] = result<127:64>; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Base Instruction Descriptions 
C6.2 Alphabetical list of A64 base instructions 


C6.2.340 UMULL 
Unsigned Multiply Long multiplies two 32-bit register values, and writes the result to the 64-bit destination register. 


This instruction is an alias of the UMADDL instruction. This means that: 


: The encodings in this description are named to match the encodings of UMADDL. 
è The description of UMADDL gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 
le op et alee 1) aa ole Ta] eT 
Ra 
64-bit variant 


UMULL <Xd>, <Wn>, <Wm> 
is equivalent to 
UMADDL <Xd>, <Wn>, <Wm>, XZR 


and is always the preferred disassembly. 


Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the first general-purpose source register holding the multiplicand, encoded in 
the "Rn" field. 

<Wm> Is the 32-bit name of the second general-purpose source register holding the multiplier, encoded in 


the "Rm" field. 


Operation 


The description of UMADDL gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.341 


C6-1364 


UXTB 


Unsigned Extend Byte extracts an 8-bit value from a register, zero-extends it to the size of the register, and writes 
the result to the destination register. 


This instruction is an alias of the UBFM instruction. This means that: 
g The encodings in this description are named to match the encodings of UBFM. 


s The description of UBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


CHET a 


sf opc N immr imms 


32-bit variant 
UXTB <Wd>, <Wn> 
is equivalent to 
UBFM <Wd>, <Wn>, #0, #7 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


The description of UBFM gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.342 UXTH 


Unsigned Extend Halfword extracts a 16-bit value from a register, zero-extends it to the size of the register, and 
writes the result to the destination register. 


This instruction is an alias of the UBFM instruction. This means that: 
g The encodings in this description are named to match the encodings of UBFM. 


s The description of UBFM gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 | 109 5 4| 0 | 


CHET CA EE 


sf opc N immr imms 


32-bit variant 
UXTH <Wd>, <Wn> 
is equivalent to 
UBFM <Wd>, <Wn>, #0, #15 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


The description of UBFM gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C6.2.343 WFE 


C6-1366 


Wait For Event is a hint instruction that indicates that the PE can enter a low-power state and remain there until a 
wakeup event occurs. Wakeup events include the event signaled as a result of executing the SEV instruction on any 
PE in the multiprocessor system. For more information, see Wait for Event mechanism and Send event on 

page D1-2372. 


As described in Wait for Event mechanism and Send event on page D1-2372, the execution of a WFE instruction that 
would otherwise cause entry to a low-power state can be trapped to a higher Exception level. See: 


. Traps to EL1 of ELO execution of WFE and WFI instructions on page D1-2329. 
. Traps to EL2 of ELO and EL1 execution of WFE and WFI instructions on page D1-2347. 


. Traps to EL3 of EL2, EL1, and ELO execution of WFE and WFI instructions on page D1-2361. 


|31 30 29 28|27 26 25 24/23 22 21 20|19 18 17 16|15 14 13 12|11 8|7 5 4|3 21 0| 


110101010 ofojo ofo11j0o 01 0/0 00 ofo1 0/1111 11 
CRm 


op2 


System variant 


WFE 


Decode for this encoding 


// Empty. 


Operation 


if IsEventRegisterSet() then 
ClearEventRegister(); 
else 
if PSTATE.EL == ELO then 
// Check for traps described by the OS which may be EL1 or EL2. 
AArch64.CheckForWFxTrap(EL1, TRUE); 
if PSTATE.EL IN {EL@, EL1} && EL2Enabled() && !IsInHost() then 
// Check for traps described by the Hypervisor. 
AArch64.CheckForWFxTrap(EL2, TRUE); 
if HaveEL(EL3) && PSTATE.EL != EL3 then 
// Check for traps described by the Secure Monitor. 
AArch64.CheckForWFxTrap(EL3, TRUE); 
WaitForEvent(); 
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C6.2.344 WEI 


Wait For Interrupt is a hint instruction that indicates that the PE can enter a low-power state and remain there until 
a wakeup event occurs. For more information, see Wait For Interrupt on page D1-2375. 


As described in Wait For Interrupt on page D1-2375, the execution of a WFI instruction that would otherwise cause 
entry to a low-power state can be trapped to a higher Exception level. See: 


. Traps to ELI of ELO execution of WFE and WFI instructions on page D1-2329. 
. Traps to EL2 of ELO and EL1 execution of WFE and WFI instructions on page D1-2347. 


. Traps to EL3 of EL2, EL1, and ELO execution of WFE and WFI instructions on page D1-2361. 


[31 30 29 28|27 26 25 24/23 22 21 20|19 18 17 16|15 14 13 12|11 8|7 5 4|3 21 0| 


770107070 ojojo 00770071 ojo 00 0014 
CRm 2 


op 


System variant 


WFI 


Decode for this encoding 


// Empty. 


Operation 


if !InterruptPending() then 

if PSTATE.EL == ELO then 
// Check for traps described by the OS which may be EL1 or EL2. 
AArch64.CheckForWFxTrap(EL1, FALSE); 

if PSTATE.EL IN {EL@, EL1} && EL2Enabled() && !IsInHost() then 
// Check for traps described by the Hypervisor. 
AArch64.CheckForWFxTrap(EL2, FALSE); 

if HaveEL(EL3) && PSTATE.EL != EL3 then 
// Check for traps described by the Secure Monitor. 
AArch64.CheckForWFxTrap(EL3, FALSE); 

WaitForInterrupt(); 
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C6.2.345 XAFLAG 


Convert floating-point condition flags from external format to Arm format. This instruction converts the state of the 
PSTATE. {N,Z,C,V} flags from an alternative representation required by some software to a form representing the 
result of an Arm floating-point scalar compare instruction. 


ARMV8.5 


|31 30 29 28/27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/11 8|7 6 5 4/3 2 1 0| 


[1 101070140 ofojo ofo o ofo 1 0 oomoo] o ifi 141 4) 


CRm 


System variant 


XAFLAG 


Decode for this encoding 


if !HaveFlagFormatExt() then UNDEFINED; 


Operation 
bit N = NOT(PSTATE.C) AND NOT(PSTATE.Z); 
bit Z = PSTATE.Z AND PSTATE.C; 

bit C = PSTATE.C OR PSTATE.Z; 

bit V = NOT(PSTATE.C) AND PSTATE.Z; 


PSTATE.N 
PSTATE.Z 
PSTATE.C 
PSTATE.V = 


N 
Z 
C 
y: 
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C6.2.346 XPACD, XPACI, XPACLRI 


ARM DDI 0487E.a 
ID070919 


Strip Pointer Authentication Code. This instruction removes the pointer authentication code from an address. The 


address is in the specified general-purpose register for XPACI and XPACD, and is in LR for XPACLRI. 


The XPACD instruction is used for data addresses, and XPACI and XPACLRI are used for instruction addresses. 


Integer 


ARMVv8.3 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


liloj 10701717 0/0000 1fo/1jo o ofjpja 1111| Ra | 
Rn 


XPACD variant 
Applies when D = 1. 


XPACD <Xd> 
XPACI variant 


Applies when D == 0. 


XPACI <Xd> 


Decode for all variants of this encoding 


boolean data = (D == '1'); 
integer d = UInt(Rd); 


if !HavePACExt() then 
UNDEFINED; 


System 
ARMV8.3 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/1110 9 8/7 6 5 4/3 21 0| 


770107070 0)0)0 ojo 11o o1 ojo oo o1 irra 


System variant 
XPACLRI 
Decode for this encoding 
integer d = 30; 
boolean data = FALSE; 
Assembler symbols 


<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 


Operation for all encodings 


if HavePACExt() then 
X[d] = Strip(X[d], data); 
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C6.2.347 YIELD 


YIELD is a hint instruction. Software with a multithreading capability can use a YIELD instruction to indicate to the 
PE that it is performing a task, for example a spin-lock, that could be swapped out to improve overall system 
performance. The PE can use this hint to suspend and resume multiple software threads if it supports the capability. 


For more information about the recommended use of this instruction, see The YIELD instruction on page B1-104. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/11 8|7 5 4/3 21 0| 


1101010 10 ofofo ofo 1 1jo o 1 ofo o o ofo o 1ļi 1111| 
CRm op2 


p 


System variant 


YIELD 
Decode for this encoding 


// Empty. 


Operation 


Hint_Yield(); 
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Chapter C7 
A64 Advanced SIMD and Floating-point Instruction 
Descriptions 


This chapter describes the A64 Advanced SIMD and floating-point instructions. 


It contains the following sections: 
. About the A64 SIMD and floating-point instructions on page C7-1372. 
. Alphabetical list of A64 Advanced SIMD and floating-point instructions on page C7-1374. 
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C7.1 About the A64 SIMD and floating-point instructions 


Alphabetical list of A64 Advanced SIMD and floating-point instructions on page C7-1374 gives full descriptions of 
the A64 instructions that are in the following instruction groups: 


$ Loads and store instructions associated with the SIMD and floating-point registers. 
$ Data processing instructions with SIMD and floating-point registers. 


A64 instruction set encoding on page C4-252 in the A64 Instruction Encodings chapter provides an overview of the 
instruction encodings as part of an instruction class within a functional group. 


The rest of this section is a general description of the SIMD and floating-point instructions. It contains the following 


subsections: 
s Register size. 
° Data types. 


. Condition flags and related instructions on page C7-1373. 
. General capabilities on page C7-1373. 


C7.1.1 Register size 


A64 provides a comprehensive set of packed Single Instruction Multiple Data (SIMD) and scalar operations using 
data held in the 32 entry 128-bit wide SIMD and floating-point register file. 


Each SIMD and floating-point register can be used to hold: 


- A single scalar value of the floating-point or integer type. 
5 A 64-bit wide vector containing one or more elements. 
s A 128-bit wide vector containing two or more elements. 


Where the entire 128-bit wide register is not fully utilized, the vector or scalar quantity is held in the least significant 
bits of the register, with the most significant bits being cleared to zero on a write, see Vector formats on page A1-42. 


The following instructions can insert data into individual elements within a SIMD and floating-pointer register 
without clearing the remaining bits to zero: 


° Insert vector element from another vector element or general-purpose register, INS. 
7 Load structure into a single lane, for example LD3. 
s All second-part narrowing operations, for example SHRN2. 


C7.1.2 Data types 


The A64 instruction set provides support for arithmetic, conversion, and bitwise operations on: 


$ Half-precision, single-precision, and double-precision floating-points. 
° Signed and unsigned integers. 

s Polynomials over {0, 1}. 

è When ARMv8.3-CompNum is implemented, complex numbers. 


For all AArch64 floating-point operations, including SIMD operations, the rounding mode and exception trap 
handling are controlled by the FPCR. 


Note 


ë AArch32 Advanced SIMD operations always use Arm standard floating-point arithmetic, regardless of the 
rounding mode specified by the AArch64 FPCR or the AArch32 FPSCR. 





° In AArch64 state, floating-point multiply-add operations are always performed as fused operations, but 
AArch32 state provides both fused and chained multiply-add instructions. 
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In addition to operations that consume and produce values of the same width and type, the A64 instruction set 
supports SIMD and scalar operations that produce a wider or narrower vector result: 


. Where a SIMD operation narrows a 128-bit vector to a 64-bit vector, the A64 instruction set provides a 
second-part operation, for example SHRN2, that can pack the result of a second operation into the upper part 
of the same destination register. 


° Where a SIMD operation widens a 64-bit vector to a 128-bit vector, the A64 instruction set provides a 
second-part operation, for example SMLAL2, that can extract the source from the upper 64 bits of the source 
registers. 


All SIMD operations that could produce side-effects that are not limited to the destination SIMD and floating-point 
register, for example a potential update of FPSR.Q or FPSR.IDC, have a dedicated scalar variant to support the use 
of SIMD with loops requiring specialised head or tail handling, or both. 


C7.1.3 Condition flags and related instructions 


The A64 instruction set provides support for flag setting and conditional operations on the SIMD and floating-point 

register file: 

s Floating-point FCSEL and FCCMP instructions are equivalent to the integer CSEL and CCMP instructions. 

° Floating-point FCMP, FCMPE, FCCMP, and FCCMP instructions set the PSTATE. {N, Z, C, V} flags based on the 
result of the floating-point comparison. 


$ Floating-point FJCVTZS instruction sets the PSTATE.Z flag if the result of the conversion, when converted 
back to a double-precision floating-point number, gives precisely the same value as the original. Other 
PSTATE flags are cleared by this instruction. 


è Floating-point and integer instructions provide a means of producing either a scalar or a vector mask based 
on a comparison in a SIMD and floating-point register, for example FCMEQ. 


Note 


FCMP and FCMPE differ from the A32/T32 VCMP and VCMPE instructions, which use the dedicated FPSCR.NZCV field 
for the result. A64 instructions store the result of an FCMP or FCMPE operation in the PSTATE. {N, Z, C, V} field. 





If ARMvS8. 5-CondM on page A2-86 is implemented, base instructions XAFLAG and AXFLAG convert between the 
PSTATE condition flag format used by the FCMP instruction and an alternative format. See Table C6-1 on 
page C6-752. 





C7.1.4 General capabilities 


ARM DDI 0487E.a 
ID070919 


A64 SIMD and floating-point instructions provide the following capabilities: 


° General arithmetic on vector and scalar floating-point and integer values. 

n Dedicated polynomial multiply over {0, 1}. 

à Vector and scalar fused multiply-addition of single-precision and double-precision floating-points, and for 
half-precision floating-points when ARMv8.2-FP16 is implemented. 

° Load and store of single and pairs of SIMD and floating-point registers. 

è Load and store of structures and individual lanes of between one and four SIMD and floating-point registers. 

$ Direct conversion between 64-bit integers and floating-point values, with explicit rounding. 

s When ARMv8.3-JSConv is implemented, conversion from double precision floating-point values to 32-bit 
integers, with rounding to zero. 

° Double-rounding free conversion between double-precision and half-precision floating-point values. 

$ Comprehensive SIMD with widening and narrowing support. 

7 Vector to scalar reduction returning the minimum or maximum value, or the sum. 

è Floating-point to nearest integer in floating-point format. 

è When ARMv8.3-CompNum is implemented, complex number arithmetic. 
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C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


This section lists every section in the Advanced SIMD and floating-point categories of the A64 instruction set. For 
details of the format used, see Structure of the A64 assembler language on page C1-171. 


C7-1374 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.1 ABS 


Absolute value (vector). This instruction calculates the absolute value of each vector element in the source 
SIMD&FP register, puts the result into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| o| 


MEE E Ro | Re 


Scalar variant 


ABS <V><d>, <V><n> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 


integer elements = 1; 
boolean neg = (U == '1'); 


Vector 
|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fo[afofo +771 O[sze]i 000 ojo rori o] Rn | Rd 
U 


Vector variant 


ABS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean neg = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 


The following encodings are reserved: 


. size = 0x. 
. size = 10. 
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C7-1376 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


The encoding size = 11, Q = Qis reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


when size = 


when size = 


when size 


when size 


when size = 


when size = 


when size 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 


bits(datasize) result; 


integer element; 


for e = 0 to elements-1 
element = SInt(Elem[operand, e, esize]); 


v[d] 


ifn 


else 


Elem[result, e, esize] = element<esize-1:0>; 


=r 


eg then 


element = -element; 


element = Abs(element); 


esult; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


The response of this instruction to asynchronous exceptions does not vary based on: 


The values of the data supplied in any of its registers. 


00, Q = 
00, Q = 
01, Q = 
01, Q = 
10, Q = 
10, Q = 
11, Q = 


The values of the NZCV flags. 


The values of the data supplied in any of its registers. 


The values of the NZCV flags. 
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C7.2.2 ADD (vector) 


Add (vector). This instruction adds corresponding elements in the two source SIMD&FP registers, places the results 
into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| o| 


OEE a | Re 


Scalar variant 


ADD <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean sub_op = (U == '1'); 


Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|1110 9 | 5 4| o| 


olojojo +771 ojs] Rm j 0000]1] Rn | Rd 
U 


Vector variant 


ADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean sub_op = (U = '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 


The following encodings are reserved: 


. size = 0x. 
. size = 10. 
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C7-1378 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 


2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


= 00,0 = 0 
= 00,Q=1 
= 01,Q0=0 
=01,Q=1 
= 10,Q=0 
= 10,Q=1 
1,007 


The encoding size = 11, Q = 0 is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 


for e = 0 to elements-1 


V[d] 


elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if sub_op then 


Elem[result, e, esize] = elementl - element2; 


else 


Elem[result, e, esize] = elementl + element2; 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Add returning High Narrow. This instruction adds each vector element in the first source SIMD&FP register to the 
corresponding vector element in the second source SIMD&FP register, places the most significant half of the result 
into a vector, and writes the vector to the lower or upper half of the destination SIMD&FP register. 


The results are truncated. For rounded results, see RADDHN, RADDHN2. 


The ADDHN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the ADDHN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24/23 22 21 20| 


Mepla 4 anae Rm Jo tfofojo Re | Rd _| 


16/15 14 13 1211110 9 | 5 4| 0 | 


Three registers, not all the same type variant 


ADDHN{2} <Vd>.<Tb>, 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


Assembler symbols 


2 


<Vd> 


<Tb> 


ARM DDI 0487E.a 
ID070919 


d = UInt(Rd); 


n 


UInt(Rn); 


m = UInt(Rm); 


== '11' then UNDEFINED; 
= 8 << UInt(size); 
datasize = 64; 


esize 


part = 


UInt(Q); 


<Vn>.<Ta>, <Vm>.<Ta> 


elements = datasize DIV esize; 


sub_op = (ol = '1'); 


round = 


(U = '1'); 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] 


[present] 


when Q = 0 


whenQ = 1 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


when size = 00,Q = 0 


8B 
16B 
4H 
8H 
2S 
4S 


when size = 00, Q = 1 


when size 
when size 
when size 


when size 


01, Q = 0 
01, Q =1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 
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<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnabled64(); 

bits(2sdatasize) operandl = V[n]; 

bits(2sdatasize) operand2 = V[m]; 

bits(datasize) result; 

integer round_const = if round then 1 << (esize - 1) else Q; 
bits(2xesize) element1; 

bits(2xesize) element2; 

bits(2sesize) sum; 


for e = 0 to elements-1 
elementl = Elem[operand1, e, 2xesize]; 
element2 = Elem[operand2, e, 2xesize]; 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
sum = sum + round_const; 
Elem[result, e, esize] = sum<2«esize-l:esize>; 


Vpart[d, part] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.4 ADDP (scalar) 


Add Pair of elements (scalar). This instruction adds two vector elements in the source SIMD&FP register and writes 
the scalar result into the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| o| 


[o ajoji 1 1 1 ofsie{1 1 0 0of1 101 1fjrof Rn | Ra | 


Advanced SIMD variant 


ADDP <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize « 2; 
Assembler symbols 


<V> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 


The following encodings are reserved: 


- size = 0x. 
$ size = 10. 

<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<I> Is the source arrangement specifier, encoded in the "size" field. It can have the following values: 
2D when size = 11 


The following encodings are reserved: 
° size = 0x. 


. size = 10. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(ReduceOp_ADD, operand, esize); 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.5 ADDP (vector) 


Add Pairwise (vector). This instruction creates a vector by concatenating the vector elements of the first source 
SIMD&FP register after the vector elements of the second source SIMD&FP register, reads each pair of adjacent 
vector elements from the concatenated vector, adds each pair of values together, places the result into a vector, and 
writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 1312/1110 9. | 5 4| 0 | 


fo[afofo +771 ojs] Rm porii] Rn | Rd 


Three registers of the same type variant 


ADDP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = ® is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 
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for e = 0 to elements-1 
element1 = Elem[concat, 2se, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 
Elem[result, e, esize] = elementl + element2; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


š The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.6 ADDV 


Add across Vector. This instruction adds every vector element in the source SIMD&FP register together, and writes 
the scalar result to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| o| 


fofajojo 1 1 1 ofsie{[1 1 0 0of4 101 1ļlrof Rn | Ra | 


Advanced SIMD variant 


ADDV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size:Q == '100' then UNDEFINED; 
if size == '11' then UNDEFINED; 


integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<V> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 


The encoding size = 11 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = @ 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 10, Q = 0. 


. size = 11,Q = x. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(Reduce0p_ADD, operand, esize); 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.7 AESD 


AES single round decryption. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oToO077 710001070 0)0070/iJ10] kn | Rd 
D 


Advanced SIMD variant 


AESD <Vd>.16B, <Vn>.16B 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
if !HaveAESExt() then UNDEFINED; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) operand1 = V[d]; 

bits(128) operand2 = V[n]; 

bits(128) result; 

result = operand1 EOR operand2; 

result = AESInvSubBytes(AESInvShi ftRows(result)); 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.8 AESE 


AES single round encryption. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 1413 12/1110 9. | 5 4| 0 | 


o7007770/00)10700)0070)0)10] mn | Rd 
D 


Advanced SIMD variant 


AESE <Vd>.16B, <Vn>.16B 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
if !HaveAESExt() then UNDEFINED; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) operandl = V[d]; 

bits(128) operand2 = V[n]; 

bits(128) result; 

result = operand1 EOR operand; 

result = AESSubBytes(AESShiftRows(result)); 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.9 AESIMC 


AES inverse mix columns. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 1413 12/1110 9. | 5 4| 0 | 


oToO011 710001070 0)007 1/1110] Rn | Rd 
D 


Advanced SIMD variant 


AESIMC <Vd>.16B, <Vn>.16B 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
if !HaveAESExt() then UNDEFINED; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) operand = V[n]; 

bits(128) result; 

result = AESInvMixColumns (operand); 
V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
G The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.10 


C7-1390 


AESMC 


AES mix columns. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


o7007770/00)10700)007171)0)10] Rn | Rd 
D 


Advanced SIMD variant 


AESMC <Vd>.16B, <Vn>.16B 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
if !HaveAESExt() then UNDEFINED; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) operand = V[n]; 
bits(128) result; 

result = AESMixColumns(operand) ; 
V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
G The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.11 AND (vector) 


ARM DDI 0487E.a 
ID070919 


Bitwise AND (vector). This instruction performs a bitwise AND between the two source SIMD&FP registers, and 
writes the result to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| o| 


fofajojo 14 1 1 ofo ofi] Rm fooo0o11ji] Rn | Ra | 


size 


Three registers of the same type variant 


AND <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 
bits(datasize) result; 


0 
< 
= 


result = operand1 AND operand2; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.12 


C7-1392 


BCAX 


Bit Clear and Exclusive OR performs a bitwise AND of the 128-bit vector in a source SIMD&FP register and the 
complement of the vector in another source SIMD&FP register, then performs a bitwise exclusive OR of the 


resulting vector and the vector in a third source SIMD&FP register, and writes the result to the destination 
SIMD&FP register. 


This instruction is implemented only when ARMv8.2-SHA is implemented. 


ARMVv8.2 


|31 30 29 2 26 25 24|23 22 21 20| 16|15 14 | 109 5 4| 0 | 


aS TT 


Advanced SIMD variant 


BCAX <Vd>.16B, <Vn>.16B, <Vm>.16B, <Va>.16B 


Decode for this encoding 


if !HaveSHA3Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer a = UInt(Ra); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Va> Is the name of the third SIMD&FP source register, encoded in the "Ra" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 
bits(128) Vn = V[n]; 
bits(128) Va = V[a]; 
V[d] = Vn EOR (Vm AND NOT(Va)); 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.13 BIC (vector, immediate) 
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Bitwise bit Clear (vector, immediate). This instruction reads each vector element from the destination SIMD&FP 
register, performs a bitwise AND between each result and the complement of an immediate constant, places the 
result into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4| 0 | 


ofafifo 77770000 0falblo[x xx iol alelo] Ra 
op 


cmode 


16-bit variant 
Applies when cmode == 10x1. 


BIC <Vd>.<T>, #<imm8>{, LSL #<amount>} 


32-bit variant 
Applies when cmode == Qxx1. 


BIC <Vd>.<T>, #<imm8>{, LSL #<amount>} 


Decode for all variants of this encoding 
integer rd = UInt(Rd); 


integer datasize = if Q == '1' then 128 else 64; 
bits(datasize) imm; 
bits(64) imm64; 


ImmediateOp operation; 
case cmode:op of 
when '@xxQ1' operation = ImmediateOp_MVNI; 
when '@xx11' operation = ImmediateOp_BIC; 
when '10x01' operation = ImmediateOp_MVNI; 
when '10x11' operation = ImmediateOp_BIC; 
when '110x1' operation = ImmediateOp_MVNT; 
when '1110x' operation = ImmediateOp_MOVI; 
when '11111' 
// FMOV Dn,#imm is in main FP instruction set 
if Q == 'Q' then UNDEFINED; 
operation = ImmediateOp_MOVI; 


imm64 = AdvSIMDExpandImm(op, cmode, a:b:c:d:e:f:g:h); 
imm = Replicate(imm64, datasize DIV 64); 
Assembler symbols 
<Vd> Is the name of the SIMD&FP register, encoded in the "Rd" field. 


<I> For the 16-bit variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 


8H when Q = 1 
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For the 32-bit variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 


2S when Q = 0 
4S when Q = 1 
<imm8> Is an 8-bit immediate encoded in "a:b:c:d:e:fig:h". 
<amount> For the 16-bit variant: is the shift amount encoded in the "cmode<1>" field. It can have the 


following values: 

0 

1 
defaulting to 0 if LSL is omitted. 


0 when cmode<1> 


8 when cmode<1> 


For the 32-bit variant: is the shift amount encoded in the "cmode<2:1>" field. It can have the 
following values: 


( when cmode<2:1> = 00 
8 when cmode<2:1> = 01 
16 when cmode<2:1> = 10 
24 when cmode<2:1> = 11 


defaulting to 0 if LSL is omitted. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand; 
bits(datasize) result; 


case operation of 

when ImmediateOp_MOVI 
result = imm; 

when ImmediateOp_MVNI 
result = NOT(imm); 

when ImmediateOp_ORR 
operand = V[rd]; 
result = operand OR imm; 

when ImmediateOp_BIC 
operand = V[rd]; 
result = operand AND NOT(imm) ; 





V[rd] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.14 BIC (vector, register) 


ARM DDI 0487E.a 
ID070919 


Bitwise bit Clear (vector, register). This instruction performs a bitwise AND between the first source SIMD&FP 
register and the complement of the second source SIMD&FP register, and writes the result to the destination 
SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fofafoyo +77 0f0 a7] Rm [oo077|1] Rn | Rd 


size 


Three registers of the same type variant 


BIC <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


operand2 = NOT(operand2) ; 

result = operandl AND operand2; 

V[d] = result; 

Operational information 
If PSTATE.DIT is 1: 

. The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Bitwise Insert if False. This instruction inserts each bit from the first source SIMD&FP register into the destination 
SIMD&FP register if the corresponding bit of the second source SIMD&FP register is 0, otherwise leaves the bit in 
the destination register unchanged. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


ofafijo +7701 if] am oooi] Rn | Rd 


opc2 


Three registers of the same type variant 


BIF <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1; 
bits(datasize) operand3; 
bits(datasize) operand4 = V[n]; 


operandi = V[d]; 
operand3 = NOT(V[m]); 


V[d] = operand1 EOR ((operand1 EOR operand4) AND operand3); 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.16 BIT 


Bitwise Insert if True. This instruction inserts each bit from the first source SIMD&FP register into the SIMD&FP 
destination register if the corresponding bit of the second source SIMD&FP register is 1, otherwise leaves the bit in 
the destination register unchanged. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


opori 0[1 oli] Rm oooi] Rn | Rd 


opc2 


Three registers of the same type variant 


BIT <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1; 
bits(datasize) operand3; 
bits(datasize) operand4 = V[n]; 


operand1 = V[d]; 

operand3 = V[m]; 

V[d] = operand1 EOR ((operand1 EOR operand4) AND operand3); 
Operational information 

If PSTATE.DIT is 1: 


: The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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C7.2.17 BSL 


Bitwise Select. This instruction sets each bit in the destination SIMD&FP register to the corresponding bit from the 
first source SIMD&FP register when the original destination bit was 1, otherwise from the second source SIMD&FP 
register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


opor ojo ii] Rm oooi] Rn | Rd 


opc2 


Three registers of the same type variant 


BSL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1; 
bits(datasize) operand3; 
bits(datasize) operand4 = V[n]; 


operand1 = V[m]; 

operand3 = V[d]; 

V[d] = operand1 EOR ((operand1 EOR operand4) AND operand3); 
Operational information 

If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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Count Leading Sign bits (vector). This instruction counts the number of consecutive bits following the most 
significant bit that are the same as the most significant bit in each vector element in the source SIMD&FP register, 
places the result into a vector, and writes the vector to the destination SIMD&FP register. The count does not include 
the most significant bit itself. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fo[afolo +771 O[sze]i o oo ojo oroo o] Rn | Rd 
U 


Vector variant 


CLS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer 
integer 


if size 
integer 


integer 
integer 


CountOp 


d 
n 


UInt(Rd); 
UInt(Rn); 


== '11' then UNDEFINED; 

esize = 8 << UInt(size); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


countop = if U == '1' then CountOp_CLZ else CountOp_CLS; 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 


16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


integer count; 
for e = Q to elements-1 
if countop == CountOp_CLS then 


count = CountLeadingSignBits(Elem[operand, e, esize]); 
else 
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count = CountLeadingZeroBits(Elem[operand, e, esize]); 
Elem[result, e, esize] = count<esize-1:0>; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.19 CLZ (vector) 


Count Leading Zero bits (vector). This instruction counts the number of consecutive zeros, starting from the most 
significant bit, in each vector element in the source SIMD&FP register, places the result into a vector, and writes 
the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oleo n O[sze]i 000 ojo oroo o] Rn | Rd 
U 


Vector variant 


CLZ <Vd>. 


<T>, <Vn>.<T> 


Decode for this encoding 


integer 
integer 


if size 
integer 


integer 
integer 


CountOp 


d = UInt(Rd); 
n = UInt(Rn); 
== '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


countop = if U == '1' then CountOp_CLZ else CountOp_CLS; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 

8B when size = 00,Q = 0 

16B when size = 00,Q = 1 

4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10,Q = 0 

4S when size = 10,Q = 1 

The encoding size = 11, Q = x is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


integer count; 
for e = Q to elements-1 
if countop == CountOp_CLS then 


ARM DDI 0487E.a 
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count = CountLeadingSignBits(Elem[operand, e, esize]); 
else 
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count = CountLeadingZeroBits(Elem[operand, e, esize]); 
Elem[result, e, esize] = count<esize-1:0>; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.20 CMEQ (register) 


ARM DDI 0487E.a 
ID070919 


Compare bitwise Equal (vector). This instruction compares each vector element from the first source SIMD&FP 
register with the corresponding vector element from the second source SIMD&FP register, and if the comparison is 
equal sets every bit of the corresponding vector element in the destination SIMD&FP register to one, otherwise sets 


every bit of the corresponding vector element in the destination SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| 0| 


oap ose] Rm oooi] e | Rd 
U 


Scalar variant 


CMEQ <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean and_test = (U == '0'); 


Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9 | 5 4| o| 


oloo 1771 o[sze]i] Rm oooi] e | Rd 
U 


Vector variant 


CMEQ <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean and_test = (U == '0'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 
The following encodings are reserved: 


. size = Ox. 
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C7-1408 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


size = 10. 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


00,0 = 0 
00,Q=1 
01,0 = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
11,Q=1 


The encoding size = 11, Q = ® is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 
boolean test_passed; 


for e = 0 to elements-1 


v[d] 


= V[n]; 
= V[m]; 


element1 = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if and_test then 


test_passed = !IsZero(element1 AND element2); 


else 


test_passed = (elementl == element2); 
Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.21 CMEQ (zero) 


Compare bitwise Equal to zero (vector). This instruction reads each vector element in the source SIMD&FP register 
and if the value is equal to zero sets every bit of the corresponding vector element in the destination SIMD&FP 
register to one, otherwise sets every bit of the corresponding vector element in the destination SIMD&FP register 
to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oao +77 O[sze]i 000 ojo 1o ojj o] Rn | Rd 
U op 


Scalar variant 


CMEQ <V><d>, <V><n>, #0 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_GT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofafofo +171 olse 000 ojoro 0/110] Rn | R 
U op 


Vector variant 


CMEQ <Vd>.<T>, <Vn>.<T>, #0 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 
case op:U of 
when '00' comparison = CompareOp_GT; 
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C7-1410 


when 'Q@1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


D when size = 11 


The following encodings are reserved: 


° size = 0x. 

° size = 10. 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 

8B when size = 00,Q = 0 

16B when size = 00,Q = 1 

4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10, Q = 0 

4S when size = 10,Q = 1 

2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element; 

boolean test_passed; 


for e = Q to elements-1 

element = SInt(Elem[operand, e, esize]); 

case comparison of 
when CompareOp_GT test_passed = element > 0; 
when CompareOp_GE test_passed = element >= Q; 
when CompareOp_EQ test_passed = element == Q; 
when CompareOp_LE test_passed = element <= Q; 
when CompareOp_LT test_passed = element < 0; 

Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.22 CMGE (register) 


Compare signed Greater than or Equal (vector). This instruction compares each vector element in the first source 
SIMD&FP register with the corresponding vector element in the second source SIMD&FP register and if the first 
signed integer value is greater than or equal to the second signed integer value sets every bit of the corresponding 
vector element in the destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector 
element in the destination SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9. | 5 4| 0 | 


24 aise Lee Jee fe 


Scalar variant 


CMGE <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean unsigned = (U == '1'); 
boolean cmp_eq = (eq == '1'); 


Vector 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


a ee ee n d s 


Vector variant 


CMGE <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 

boolean cmp_eq = (eq == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


D when size = 11 


C7-1412 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


<d> 
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<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 
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The following encodings are reserved: 


size = Ox. 


size = 10. 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


= 00,0 = 0 
= 00,Q=1 
= 01,Q0=0 
= 01,Q=1 
= 10,Q=0 
= 10,Q=1 
=e <i 


The encoding size = 11, Q = Qis reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) result; 
integer element1; 
integer element2; 
boolean test_passed; 


for e = 0 to elements-1 


V[d] 


0 
< 
= 


element1 = Int(Elem[operand1, e, esize], unsigned); 

element2 = Int(Elem[operand2, e, esize], unsigned); 

test_passed = if cmp_eq then elementl >= element2 else element1 > element2; 
Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.23 


C7-1414 


CMGE (zero) 


Compare signed Greater than or Equal to zero (vector). This instruction reads each vector element in the source 
SIMD&FP register and if the signed integer value is greater than or equal to zero sets every bit of the corresponding 
vector element in the destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector 
element in the destination SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fo a[i[1 177 O[sze]i 000 ojo 1o ojoj o] Rn | Rd 
U op 


Scalar variant 


CMGE <V><d>, <V><n>, #0 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_GT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofaf*fo +171 ose 000 ojo n o ojoj o] Rn | Ra | 
U op 


Vector variant 


CMGE <Vd>.<T>, <Vn>.<T>, #0 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 
case op:U of 
when '00' comparison = CompareOp_GT; 
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when '01' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 

The following encodings are reserved: 

. size = 0x. 


è size = 10. 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the SIMD&FP source register, encoded in the "Rn" field. 

Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element; 

boolean test_passed; 


for 


v[d] 


e = 0 to elements-1 
element = SInt(Elem[operand, e, esize]); 
case comparison of 
when CompareOp_GT test_passed = element > 0; 
when CompareOp_GE test_passed = element >= Q; 
when CompareOp_EQ test_passed = element == Q; 
when CompareOp_LE test_passed = element <= Q; 
when CompareOp_LT test_passed = element < 0; 
Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.24 CMGT (register) 


ARM DDI 0487E.a 
ID070919 


Compare signed Greater than (vector). This instruction compares each vector element in the first source SIMD&FP 
register with the corresponding vector element in the second source SIMD&FP register and if the first signed integer 
value is greater than the second signed integer value sets every bit of the corresponding vector element in the 
destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector element in the 
destination SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0| 


sek oore em deene n l s 


Scalar variant 


CMGT <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean unsigned = (U == '1'); 
boolean cmp_eq = (eq == '1'); 


Vector 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


a ee ee n d s 


Vector variant 


CMGT <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 

boolean cmp_eq = (eq == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


D when size = 11 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1417 
Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7-1418 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


The following encodings are reserved: 


size = Ox. 


size = 10. 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


= 00,0 = 0 
= 00,Q=1 
= 01,Q0=0 
= 01,Q=1 
= 10,Q=0 
= 10,Q=1 
=e <i 


The encoding size = 11, Q = Qis reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) result; 
integer element1; 
integer element2; 
boolean test_passed; 


for e = 0 to elements-1 


V[d] 


0 
< 
= 


element1 = Int(Elem[operand1, e, esize], unsigned); 

element2 = Int(Elem[operand2, e, esize], unsigned); 

test_passed = if cmp_eq then elementl >= element2 else element1 > element2; 
Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.25 CMGT (zero) 


Compare signed Greater than zero (vector). This instruction reads each vector element in the source SIMD&FP 
register and if the signed integer value is greater than zero sets every bit of the corresponding vector element in the 
destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector element in the 
destination SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 2827 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oao +717 O[sze]i 000 ojo 1o ojoj o] Rn | Rd 
U op 


Scalar variant 


CMGT <V><d>, <V><n>, #0 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_GT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


olal +171 olse 000 ojo 1 o 0/0/10] Rn | Ra 
U op 


Vector variant 


CMGT <Vd>.<T>, <Vn>.<T>, #0 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 
case op:U of 
when '00' comparison = CompareOp_GT; 
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C7-1420 


when 'Q@1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


D when size = 11 


The following encodings are reserved: 


° size = 0x. 

° size = 10. 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 

8B when size = 00,Q = 0 

16B when size = 00,Q = 1 

4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10, Q = 0 

4S when size = 10,Q = 1 

2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element; 

boolean test_passed; 


for e = Q to elements-1 

element = SInt(Elem[operand, e, esize]); 

case comparison of 
when CompareOp_GT test_passed = element > 0; 
when CompareOp_GE test_passed = element >= Q; 
when CompareOp_EQ test_passed = element == Q; 
when CompareOp_LE test_passed = element <= Q; 
when CompareOp_LT test_passed = element < 0; 

Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.26  CMHI (register) 


Compare unsigned Higher (vector). This instruction compares each vector element in the first source SIMD&FP 
register with the corresponding vector element in the second source SIMD&FP register and if the first unsigned 
integer value is greater than the second unsigned integer value sets every bit of the corresponding vector element in 
the destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector element in the 
destination SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0| 


a a 


Scalar variant 


CMHI <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean unsigned = (U == '1'); 
boolean cmp_eq = (eq == '1'); 


Vector 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


a a ee deerne o mn o s 


Vector variant 


CMHI <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 

boolean cmp_eq = (eq == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


D when size = 11 
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<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 
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The following encodings are reserved: 


size = Ox. 


size = 10. 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


= 00,0 = 0 
= 00,Q=1 
= 01,Q0=0 
= 01,Q=1 
= 10,Q=0 
= 10,Q=1 
=e <i 


The encoding size = 11, Q = Qis reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) result; 
integer element1; 
integer element2; 
boolean test_passed; 


for e = 0 to elements-1 


V[d] 


0 
< 
= 


element1 = Int(Elem[operand1, e, esize], unsigned); 

element2 = Int(Elem[operand2, e, esize], unsigned); 

test_passed = if cmp_eq then elementl >= element2 else element1 > element2; 
Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.27 CMHS (register) 


Compare unsigned Higher or Same (vector). This instruction compares each vector element in the first source 
SIMD&FP register with the corresponding vector element in the second source SIMD&FP register and if the first 
unsigned integer value is greater than or equal to the second unsigned integer value sets every bit of the 
corresponding vector element in the destination SIMD&FP register to one, otherwise sets every bit of the 
corresponding vector element in the destination SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9. | 5 4| 0 | 


2A aise Lee Jee fe 


Scalar variant 


CMHS <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean unsigned = (U == '1'); 
boolean cmp_eq = (eq == '1'); 


Vector 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


a a ee im deeri o mn o s 


Vector variant 


CMHS <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 

boolean cmp_eq = (eq == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


D when size = 11 
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<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
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The following encodings are reserved: 


size = Ox. 


size = 10. 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


= 00,0 = 0 
= 00,Q=1 
= 01,Q0=0 
= 01,Q=1 
= 10,Q=0 
= 10,Q=1 
=e <i 


The encoding size = 11, Q = Qis reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) result; 
integer element1; 
integer element2; 
boolean test_passed; 


for e = 0 to elements-1 


V[d] 


0 
< 
= 


element1 = Int(Elem[operand1, e, esize], unsigned); 

element2 = Int(Elem[operand2, e, esize], unsigned); 

test_passed = if cmp_eq then elementl >= element2 else element1 > element2; 
Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.28 


C7-1426 


CMLE (zero) 


Compare signed Less than or Equal to zero (vector). This instruction reads each vector element in the source 
SIMD&FP register and if the signed integer value is less than or equal to zero sets every bit of the corresponding 
vector element in the destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector 
element in the destination SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oane +17 ose O00 oOo otto] Rn | R 
U op 


Scalar variant 


CMLE <V><d>, <V><n>, #0 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_GT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofaf7fo +171 ose 000 ojoro 0110] Rn | Ra | 
U op 


Vector variant 


CMLE <Vd>.<T>, <Vn>.<T>, #0 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 
case op:U of 
when '00' comparison = CompareOp_GT; 
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when '01' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 

The following encodings are reserved: 

. size = 0x. 


è size = 10. 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the SIMD&FP source register, encoded in the "Rn" field. 

Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element; 

boolean test_passed; 


for 


v[d] 


e = 0 to elements-1 
element = SInt(Elem[operand, e, esize]); 
case comparison of 
when CompareOp_GT test_passed = element > 0; 
when CompareOp_GE test_passed = element >= Q; 
when CompareOp_EQ test_passed = element == Q; 
when CompareOp_LE test_passed = element <= Q; 
when CompareOp_LT test_passed = element < 0; 
Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.29 CMLT (zero) 


ARM DDI 0487E.a 
ID070919 


Compare signed Less than zero (vector). This instruction reads each vector element in the source SIMD&FP register 
and if the signed integer value is less than zero sets every bit of the corresponding vector element in the destination 


SIMD&FP register to one, otherwise sets every bit of the corresponding vector element in the destination 


SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oao i717 ofso oo ojo roro o] Rn | Rd 


Scalar variant 


CMLT <V><d>, <V><n>, #0 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison = CompareOp_LT; 
Vector 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofafoo 1171 O[sze]i 000 ojo 1o10 o] Rn | Rd 


Vector variant 


CMLT <Vd>.<T>, <Vn>.<T>, #0 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison = CompareOp_LT; 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


D when size = 11 
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C7-1430 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


The following encodings are reserved: 


size = Ox. 


size = 10. 


Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the number of the SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


when size = 


when size = 


when size 


when size 


when size = 


when size 


when size 


00,0 = 0 
00, Q = 
01, Q = 
01, Q = 
10, Q = 
10, Q = 
11, Q = 


PP © FP © re 


The encoding size = 11, Q = Qis reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 


bits(datasize) result; 


integer element; 


boolean test_passed; 


for e = 0 to elements-1 


V[d] 


element = SInt(Elem[operand, e, esize]); 


case comparison of 
when CompareOp_GT test_passed 
when CompareOp_GE test_passed 
when CompareOp_EQ test_passed 
when CompareOp_LE test_passed 
when CompareOp_LT test_passed 


= element > Q; 
= element >= Q; 
= element == Q; 
= element <= Q; 
= element < Q; 


Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.30 CMTST 


ARM DDI 0487E.a 
ID070919 


Compare bitwise Test bits nonzero (vector). This instruction reads each vector element in the first source SIMD&FP 
register, performs an AND with the corresponding vector element in the second source SIMD&FP register, and if 
the result is not zero, sets every bit of the corresponding vector element in the destination SIMD&FP register to one, 
otherwise sets every bit of the corresponding vector element in the destination SIMD&FP register to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| 0| 


oao +77 O[sze]i] Rm ooon] e | Rd 
U 


Scalar variant 


CMTST <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean and_test = (U == 'Q'); 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|1110 9 | 5 4| 0 | 


obb irr ofsee[i] am Moooi m TR 


Vector variant 


CMTST <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean and_test = (U == '0'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 
The following encodings are reserved: 


. size = Ox. 
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C7-1432 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


size = 10. 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


00,0 = 0 
00,Q=1 
01,0 = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
11,Q=1 


The encoding size = 11, Q = ® is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 
boolean test_passed; 


for e = 0 to elements-1 


v[d] 


= V[n]; 
= V[m]; 


element1 = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if and_test then 


test_passed = !IsZero(element1 AND element2); 


else 


test_passed = (elementl == element2); 
Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.31 CNT 


Population Count per byte. This instruction counts the number of bits that have a value of one in each vector element 
in the source SIMD&FP register, places the result into a vector, and writes the vector to the destination SIMD&FP 
register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fo[afofo +771 O[sze]i o oo ojo ororo] Rn | Rd 


Vector variant 


CNT <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size != '00' then UNDEFINED; 

integer esize = 8; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV 8; 


Assembler symbols 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
The following encodings are reserved: 
. size = 01, Q = x. 


. size = 1x, Q = x. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


integer count; 
for e = 0 to elements-1 
count = BitCount(Elem[operand, e, esize]); 
Elem[result, e, esize] = count<esize-1:0>; 
V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.32 DUP (element) 


ARM DDI 0487E.a 
ID070919 


Duplicate vector element to vector or scalar. This instruction duplicates the vector element at the specified element 
index in the source SIMD&FP register into a scalar or each element in a vector, and writes the result to the 


destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is used by the alias MOV (scalar). The alias is always the preferred disassembly. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fo afoot + 770000] mms [ojooo oli] rn | Rd | 


Scalar variant 


DUP <V><d>, <Vn>.<T>[<index>] 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer size = LowestSetBit(immS) ; 
if size > 3 then UNDEFINED; 


integer index = UInt(imm5<4:size+1>) ; 
integer idxdsize = if imm5<4> == '1' then 128 else 64; 


integer esize = 8 << size; 


integer datasize = esize; 
integer elements = 1; 


Vector 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


fofafofo 1770000] mms [ojoo oo] rn | Rd 


Vector variant 


DUP <Vd>.<T>, <Vn>.<Ts>[<index>] 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


integer size = LowestSetBit(immS) ; 
if size > 3 then UNDEFINED; 


integer index = UInt(immS<4:size+1>) ; 
integer idxdsize = if imm5<4> == '1' then 128 else 64; 


if size == 3 && Q == '@' then UNDEFINED; 
integer esize = 8 << size; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
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Assembler symbols 


<T> 


<Ts> 


<V> 


<Vn> 


<index> 


<d> 


<Vd> 


C7-1436 


For the scalar variant: is the element width specifier, encoded in the "imm5" field. It can have the 
following values: 


B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 
D when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


For the vector variant: is an arrangement specifier, encoded in the "imm5:Q" field. It can have the 
following values: 


8B when imm5 = xxxx1, Q = 0 
16B when imm5 = xxxx1, Q = 1 
4H when imm5 = xxx10,Q = 0 
8H when imm5 = xxx10, Q = 1 
2S when imm5 = xx100,Q = 0 
4S when imm5 = xx100, Q = 1 
2D when imm5 = x1000, Q = 1 





The following encodings are reserved: 
è imm5 = x00009, Q = x. 
. imm5 = x10080, Q = 0. 


Is an element size specifier, encoded in the "imm5" field. It can have the following values: 


B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 
D when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


Is the destination width specifier, encoded in the "imm5" field. It can have the following values: 


B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 
D when imm5 = x1000 


The encoding imm5 = x0000 is reserved. 
Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is the element index encoded in the "imm5" field. It can have the following values: 
imm5<4:1> when imm5 = xxxx1 
imm5<4:2> when imm5 = xxx10 
imm5<4:3> when imm5 = xx100 
imm5<4> when imm5 = x1000 


The encoding imm5 = x0000 is reserved. 
Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
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Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(idxdsize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


element = Elem[operand, index, esize]; 
for e = 0 to elements-1 

Elem[result, e, esize] = element; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.33 


C7-1438 


DUP (general) 


Duplicate general-purpose register to vector. This instruction duplicates the contents of the source general-purpose 
register into a scalar or each element in a vector, and writes the result to the SIMD&FP destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| o| 


fofajojo 14110000] imm5 fofo o 0o aii] Rn | Ra | 


Advanced SIMD variant 


DUP <Vd>.<T>, <R><n> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer size = LowestSetBit(imm5); 
if size > 3 then UNDEFINED; 


// imm5<4:size+1> is IGNORED 
if size == 3 && Q == '@' then UNDEFINED; 
integer esize = 8 << size; 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "imm5:Q" field. It can have the following values: 
8B when imm5 = xxxx1,Q = 0 
16B when imm5 = xxxx1, Q = 1 
4H when imm5 = xxx10,Q = 0 
8H when imm5 = xxx10,Q = 1 
2S when imm5 = xx100,Q = 0 
4S when imm5 = xx100, Q = 1 
2D when imm5 = x1000,Q = 1 





The following encodings are reserved: 
. imm5 = x00090, Q = x. 
. imm5 = x1000,Q = 0. 


<R> Is the width specifier for the general-purpose source register, encoded in the "imm5" field. It can 
have the following values: 
W when imm5 = xxxx1 
W when imm5 = xxx10 
W when imm5 = xx100 
X when imm5 = x1000 
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The encoding imm5 = xQ00QQ is reserved. 


Unspecified bits in "Imm5" are ignored but should be set to zero by an assembler. 


<n> Is the number [0-30] of the general-purpose source register or ZR (31), encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(esize) element = X[n]; 
bits(datasize) result; 


for e = 0 to elements-1 
Elem[result, e, esize] = element; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


s The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C7.2.34 


C7-1440 


EOR (vector) 


Bitwise Exclusive OR (vector). This instruction performs a bitwise Exclusive OR operation between the two source 
SIMD&FP registers, and places the result in the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| o| 


[olalijo 1 1 1 ofo oft] Rm fooo0o1 1j] Rn | Ra | 


opc2 


Three registers of the same type variant 


EOR <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand1; 
bits(datasize) operand2; 
bits(datasize) operand3; 
bits(datasize) operand4 = V[n]; 


operand1 = V[m]; 

operand2 = Zeros(); 

operand3 = Ones(); 

V[d] = operand1 EOR ((operand2 EOR operand4) AND operand3); 


Operational information 
If PSTATE.DIT is 1: 


$ The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


` The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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C7.2.35 


C7-1442 


EOR3 


Three-way Exclusive OR performs a three-way exclusive OR of the values in the three source SIMD&FP registers, 


and writes the result to the destination SIMD&FP register. 


This instruction is implemented only when ARMv8.2-SHA is implemented. 


ARMVv8.2 


31 ee 20| 16|15 14 | 109 5 4| 


FR aa a 


Advanced SIMD variant 


EOR3 <Vd>.16B, <Vn>.16B, <Vm>.16B, <Va>.16B 


Decode for this encoding 


if !HaveSHA3Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer a = UInt(Ra); 


Assembler symbols 

<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Va> Is the name of the third SIMD&FP source register, encoded in the "Ra" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 
bits(128) Vn = V[n]; 
bits(128) Va = V[a]; 
V[d] = Vn EOR Vm EOR Va; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


š The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.36 EXT 


Extract vector from pair of vectors. This instruction extracts the lowest vector elements from the second source 
SIMD&FP register and the highest vector elements from the first source SIMD&FP register, concatenates the 
results into a vector, and writes the vector to the destination SIMD&FP register vector. The index value specifies 
the lowest vector element to extract from the first source register, and consecutive elements are extracted from the 
first, then second, source registers until the destination vector is filled. 


The following figure shows the operation of EXT doubleword operation for Q = 0 and imm4<2:0> = 3. 
76543210 76543210 
Vm Vn 


Vd 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 [11109 | 5 


e eee 


Advanced SIMD variant 


EXT <Vd>.<T>, <Vn>.<T>, <Vm>.<T>, #<index> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if Q == 'Q' && imm4<3> == '1' then UNDEFINED; 


integer datasize = if Q == '1' then 128 else 64; 
integer position = UInt(imm4) << 3; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
<index> Is the lowest numbered byte element to be extracted, encoded in the "Q:imm4" field. It can have the 


following values: 


i) 


imm4<2:0> whenQ = 0, imm4<3> 


X 


imm4 when Q = 1, imm4<3> 


The encoding Q = 0, imm4<3> = 1 is reserved. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1443 
ID070919 Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) hi = V[m]; 
bits(datasize) lo = V[n]; 
bits(datasizex2) concat = hi:lo; 


V[d] = concat<position+datasize-1:position>; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.37 FABD 


Floating-point Absolute Difference (vector). This instruction subtracts the floating-point values in the elements of 
the second source SIMD&FP register, from the corresponding floating-point values in the elements of the first 
source SIMD&FP register, places the absolute value of each result in a vector, and writes the vector to the 
destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMV8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


oat 177i o] am oojo rop] rn | Rd 


Scalar half precision variant 


FABD <Hd>, <Hn>, <Hm> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 
boolean abs = TRUE; 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9. | 5 4| 0| 


Lo afifi a 1 1 ofilszfa] Rm fi 101 oft] Rn | Ra | 


Scalar single-precision and double-precision variant 


FABD <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

boolean abs = TRUE; 
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Vector half precision 


ARMv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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Vector half precision variant 


FABD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean abs = (U == '1'); 


Vector single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 141312\1110 9. | 5 4| 0 | 
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Vector single-precision and double-precision variant 


FABD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean abs = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
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<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 

<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<T> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H whenQ = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m] 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 
bits(esize) diff; 


for e = 0 to elements-1 
elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
diff = FPSub(element1, element2, FPCR); 
Elem[result, e, esize] = if abs then FPAbs(diff) else diff; 


V[d] = result; 
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C7.2.38 FABS (vector) 


Floating-point Absolute value (vector). This instruction calculates the absolute value of each vector element in the 
source SIMD&FP register, writes the result to a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Half-precision 


ARMv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Half-precision variant 


FABS <Vd>.<T>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean neg = (U == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Single-precision and double-precision variant 


FABS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean neg = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
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8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
if neg then 
element = FPNeg(element) ; 
else 
element = FPAbs(element) ; 
Elem[result, e, esize] = element; 


V[d] = result; 
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C7.2.39 FABS (scalar) 


Floating-point Absolute value (scalar). This instruction calculates the absolute value in the SIMD&FP source 
register and writes the result to the SIMD&FP destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| o| 
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Half-precision variant 
Applies when ftype == 11. 


FABS <Hd>, <Hn> 


Single-precision variant 
Applies when ftype == 00. 


FABS <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FABS <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 
when '00' datasize 
when '01' datasize 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


32; 
64; 


Assembler symbols 





<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPAbs(operand); 
V[d] = result; 
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C7.2.40 


C7-1452 


FACGE 


Floating-point Absolute Compare Greater than or Equal (vector). This instruction compares the absolute value of 
each floating-point value in the first source SIMD&FP register with the absolute value of the corresponding 
floating-point value in the second source SIMD&FP register and if the first value is greater than or equal to the 
second value sets every bit of the corresponding vector element in the destination SIMD&FP register to one, 
otherwise sets every bit of the corresponding vector element in the destination SIMD&FP register to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/11109 | 5 4| 0 | 
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Scalar half precision variant 


FACGE <Hd>, <Hn>, <Hm> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 
CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when 'Q11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Scalar single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| 0 | 
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Scalar single-precision and double-precision variant 


FACGE <V><d>, <V><n>, <V><m> 
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Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when 'Q11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector half precision 


ARMV8.2 
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Vector half precision variant 


FACGE <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 


integer datasize = if Q == '1' then 128 else 64; 


integer elements = datasize DIV esize; 
CompareOp cmp; 
boolean abs; 


case E:U:ac of 
when '000' cmp 
when '@10' cmp 


CompareOp_EQ; abs = FALSE; 
CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20| 
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Vector single-precision and double-precision variant 


FACGE <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 
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Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '1@' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H whenQ = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1,Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
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bits(esize) element1; 
bits(esize) element2; 
boolean test_passed; 


for e = 0 to elements-1 

elementl = Elem[operand1, e, esize]; 

element2 = Elem[operand2, e, esize]; 

if abs then 
element1 = FPAbs(element1); 
element2 = FPAbs(element2); 

case cmp of 
when CompareOp_EQ test_passed = FPCompareEQ(element1, element2, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element1, element2, FPCR); 
when CompareOp_GT test_passed = FPCompareGT(element1, element2, FPCR); 

Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


V[d] = result; 
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C7.2.41 


C7-1456 


FACGT 


Floating-point Absolute Compare Greater than (vector). This instruction compares the absolute value of each vector 
element in the first source SIMD&FP register with the absolute value of the corresponding vector element in the 
second source SIMD&FP register and if the first value is greater than the second value sets every bit of the 
corresponding vector element in the destination SIMD&FP register to one, otherwise sets every bit of the 
corresponding vector element in the destination SIMD&FP register to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 
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Scalar half precision variant 


FACGT <Hd>, <Hn>, <Hm> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 
CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when 'Q11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Scalar single-precision and double-precision 
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Scalar single-precision and double-precision variant 


FACGT <V><d>, <V><n>, <V><m> 
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Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when 'Q11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector half precision 
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Vector half precision variant 


FACGT <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 


integer datasize = if Q == '1' then 128 else 64; 


integer elements = datasize DIV esize; 
CompareOp cmp; 
boolean abs; 


case E:U:ac of 
when '000' cmp 
when '@10' cmp 


CompareOp_EQ; abs = FALSE; 
CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector single-precision and double-precision 
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Vector single-precision and double-precision variant 


FACGT <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 
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Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '1@' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H whenQ = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1,Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
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bits(esize) element1; 
bits(esize) element2; 
boolean test_passed; 


for e = 0 to elements-1 

elementl = Elem[operand1, e, esize]; 

element2 = Elem[operand2, e, esize]; 

if abs then 
element1 = FPAbs(element1); 
element2 = FPAbs(element2); 

case cmp of 
when CompareOp_EQ test_passed = FPCompareEQ(element1, element2, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element1, element2, FPCR); 
when CompareOp_GT test_passed = FPCompareGT(element1, element2, FPCR); 

Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


V[d] = result; 
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C7.2.42 FADD (vector) 


Floating-point Add (vector). This instruction adds corresponding vector elements in the two source SIMD&FP 
registers, writes the result into a vector, and writes the vector to the destination SIMD&FP register. All the values 
in this instruction are floating-point values. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 
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Half-precision variant 


FADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U == '1'); 
Single-precision and double-precision 
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Single-precision and double-precision variant 


FADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U = '1'); 
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Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 


v[d] 


else 


element1 = Elem[concat, 2e, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 


element1 = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 


Elem[result, e, esize] = FPAdd(element1, element2, FPCR); 


= result; 
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C7.2.43 


C7-1462 


FADD (scalar) 


Floating-point Add (scalar). This instruction adds the floating-point values of the two source SIMD&FP registers, 
and writes the result to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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Half-precision variant 
Applies when ftype == 11. 


FADD <Hd>, <Hn>, <Hm> 


Single-precision variant 
Applies when ftype == 00. 


FADD <Sd>, <Sn>, <Sm> 


Double-precision variant 
Applies when ftype == 01. 


FADD <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
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<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


result = FPAdd(operand1, operand2, FPCR); 


V[d] = result; 
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C7.2.44 


C7-1464 


FADDP (scalar) 


Floating-point Add Pair of elements (scalar). This instruction adds two floating-point vector elements in the source 


SIMD&FP register and writes the scalar result into the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 
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Half-precision variant 


FADDP <V><d>, <Vn>.<T> 


Decode for this encoding 

if !HaveFP16Ext() then UNDEFINED; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = 32; 


Single-precision and double-precision 
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Single-precision and double-precision variant 


FADDP <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 32; 
integer datasize = 64; 


Assembler symbols 


<V> For the half-precision variant: is the destination width specifier, encoded in the "sz" field. It can have 


the following values: 
H when sz = 0 


The encoding sz = 1 is reserved. 
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For the single-precision and double-precision variant: is the destination width specifier, encoded in 
the "sz" field. It can have the following values: 


S when sz = 0 

D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is the source arrangement specifier, encoded in the "sz" field. It can 
have the following values: 

2H when sz = 0 

The encoding sz = 1 is reserved. 


For the single-precision and double-precision variant: is the source arrangement specifier, encoded 
in the "sz" field. It can have the following values: 


2S when sz = 0 


2D when sz = 1 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(ReduceOp_FADD, operand, esize); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1465 


Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.45 


C7-1466 


FADDP (vector) 


Floating-point Add Pairwise (vector). This instruction creates a vector by concatenating the vector elements of the 
first source SIMD&FP register after the vector elements of the second source SIMD&FP register, reads each pair 
of adjacent vector elements from the concatenated vector, adds each pair of values together, places the result into a 
vector, and writes the vector to the destination SIMD&FP register. All the values in this instruction are 
floating-point values. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR ora synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 
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Half-precision variant 


FADDP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U = '1'); 
Single-precision and double-precision 
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Single-precision and double-precision variant 


FADDP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U = '1'); 
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Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 


v[d] 


else 


element1 = Elem[concat, 2e, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 


element1 = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 


Elem[result, e, esize] = FPAdd(element1, element2, FPCR); 


= result; 
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C7.2.46 


C7-1468 


FCADD 


Floating-point Complex Add. 


This instruction operates on complex numbers that are represented in SIMD&FP registers as pairs of elements, with 
the more significant element holding the imaginary part of the number and the less significant element holding the 
real part of the number. Each element holds a floating-point value. It performs the following computation on the 
corresponding complex number element pairs from the two source registers: 


° Considering the complex number from the second source register on an Argand diagram, the number is 
rotated counterclockwise by 90 or 270 degrees. 


: The rotated complex number is added to the complex number from the first source register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR ora synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


ARMVv8.3 
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Three registers of the same type variant 


FCADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T>, #<rotate> 


Decode for this encoding 


if !HaveFCADDExt() then UNDEFINED; 

integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size == '00' then UNDEFINED; 

if Q == '@' && size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 

if !HaveFP16Ext() && esize == 16 then UNDEFINED; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The following encodings are reserved: 
° size = 00, Q = x. 


° size = 11,Q = 0. 
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<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
<rotate> Is the rotation, encoded in the "rot" field. It can have the following values: 

90 when rot = 0 

270 when rot = 1 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element3; 


for e = 0 to (elements DIV 2)-1 
case rot of 
when 'Q' 
element1 = FPNeg(Elem[operand2, ex2+1, esize]); 
element3 = Elem[operand2, ex2, esize]; 
when '1' 
element1 = Elem[operand2, e«2+1, esize]; 
element3 = FPNeg(Elem[operand2, e«2, esize]); 
Elem[result, ex2, esize] = FPAdd(Elem[operand1, ex2, esize], element1l, FPCR); 
Elem[result, ex2+1, esize] = FPAdd(Elem[operand1, e«2+1, esize], element3, FPCR); 


V[d] = result; 
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C7.2.47 


C7-1470 


FCCMP 


Floating-point Conditional quiet Compare (scalar). This instruction compares the two SIMD&FP source register 
values and writes the result to the PSTATE. {N, Z, C, V} flags. If the condition does not pass then the PSTATE. {N, 
Z, C, V} flags are set to the flag bit specifier. 


It raises an Invalid Operation exception only if either operand is a signaling NaN. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4|3 0 | 


olojo +71 ofe] Rm | cond [oa] Rn [0] raw | 
op 


Half-precision variant 
Applies when ftype == 11. 


FCCMP <Hn>, <Hm>, #<nzcv>, <cond> 


Single-precision variant 
Applies when ftype == 00. 


FCCMP <Sn>, <Sm>, #<nzcv>, <cond> 


Double-precision variant 
Applies when ftype == 01. 


FCCMP <Dn>, <Dm>, #<nzcv>, <cond> 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when '01' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


bits(4) flags = nzcv; 


Assembler symbols 


<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


ARM DDI 0487E.a 
ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 

<nzcv> Is the flag bit specifier, an immediate in the range 0 to 15, giving the alternative state for the 4-bit 
NZCV condition flags, encoded in the "nzcv" field. 

<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 

NaNs 

The IEEE 754 standard specifies that the result of a comparison is precisely one of <, ==, > or unordered. If either 


or both of the operands are NaNs, they are unordered, and all three of (Operand! < Operand2), (Operand1 == 
Operand2) and (Operand1 > Operand2) are false. This case results in the FPSCR flags being set to N=0, Z=0, C=1, 


and V=1. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operandl = V[n]; 
bits(datasize) operand2; 


operand2 = V[m]; 


if ConditionHolds(cond) then 


flags 


= FPCompare(operand1, operand2, FALSE, FPCR); 


PSTATE.<N,Z,C,V> = flags; 
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C7.2.48 


C7-1472 


FCCMPE 


Floating-point Conditional signaling Compare (scalar). This instruction compares the two SIMD&FP source 
register values and writes the result to the PSTATE. {N, Z, C, V} flags. If the condition does not pass then the 
PSTATE. {N, Z, C, V} flags are set to the flag bit specifier. 


If either operand is any type of NaN, or if either operand is a signaling NaN, the instruction raises an Invalid 
Operation exception. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4|3 0 | 


olojo 171 ofe] Rm | cond [oa] Rn [1] raw | 
op 


Half-precision variant 

Applies when ftype == 11. 

FCCMPE <Hn>, <Hm>, #<nzcv>, <cond> 
Single-precision variant 
Applies when ftype == 00. 


FCCMPE <Sn>, <Sm>, #<nzcv>, <cond> 


Double-precision variant 
Applies when ftype == 01. 


FCCMPE <Dn>, <Dm>, #<nzcv>, <cond> 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


bits(4) flags = nzcv; 


Assembler symbols 


<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
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<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 

<nzcv> Is the flag bit specifier, an immediate in the range 0 to 15, giving the alternative state for the 4-bit 


NZCV condition flags, encoded in the "nzcv" field. 


<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 
NaNs 
The IEEE 754 standard specifies that the result of a comparison is precisely one of <, ==, > or unordered. If either 


or both of the operands are NaNs, they are unordered, and all three of (Operand1 < Operand2), (Operand1 == 
Operand2) and (Operand1 > Operand2) are false. This case results in the FPSCR flags being set to N=0, Z=0, C=1, 
and V=1. 


FCCMPE raises an Invalid Operation exception if either operand is any type of NaN, and is suitable for testing for <, 
<=, >, >=, and other predicates that raise an exception when the operands are unordered. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operandl = V[n]; 
bits(datasize) operand2; 


operand2 = V[m]; 
if ConditionHolds(cond) then 


flags = FPCompare(operandl, operand2, TRUE, FPCR); 
PSTATE.<N,Z,C,V> = flags; 
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C7.2.49 


C7-1474 


FCMEQ (register) 


Floating-point Compare Equal (vector). This instruction compares each floating-point value from the first source 
SIMD&FP register, with the corresponding floating-point value from the second source SIMD&FP register, and if 
the comparison is equal sets every bit of the corresponding vector element in the destination SSIMD&FP register to 
one, otherwise sets every bit of the corresponding vector element in the destination SIMD&FP register to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMV8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


oao +17 ojo o] Rm Jooj fof] Rn | R 
U E ac 


Scalar half precision variant 


FCMEQ <Hd>, <Hn>, <Hm> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 
CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when '000' cmp 
when 'Q10' cmp 


CompareOp_EQ; abs = FALSE; 
CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Scalar single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 141312\1110 9. | 5 4| 0 | 


[o foja 14 1 1 ofofszi1{ Rm [1171 ojoj] Rn | Ra _ 
U E ac 


Scalar single-precision and double-precision variant 


FCMEQ <V><d>, <V><n>, <V><m> 
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Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when 'Q11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector half precision 


ARMV8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fojajofo 1 1 1 ofoj1 of Rm jo ofi ofoft{ Rn | Ra | 
U E ac 


Vector half precision variant 


FCMEQ <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when '000' cmp 
when '@10' cmp 


CompareOp_EQ; abs = FALSE; 
CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 5 4| 0 | 


oloo +17 olo] Rm [1117 0)o)] Rn | Ra 
U E ac 


Vector single-precision and double-precision variant 


FCMEQ <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 
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Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '1@' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H whenQ = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1,Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
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bits(esize) element1; 
bits(esize) element2; 
boolean test_passed; 


for e = 0 to elements-1 

elementl = Elem[operand1, e, esize]; 

element2 = Elem[operand2, e, esize]; 

if abs then 
element1 = FPAbs(element1); 
element2 = FPAbs(element2); 

case cmp of 
when CompareOp_EQ test_passed = FPCompareEQ(element1, element2, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element1, element2, FPCR); 
when CompareOp_GT test_passed = FPCompareGT(element1, element2, FPCR); 

Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


V[d] = result; 
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C7.2.50 


C7-1478 


FCMEQ (zero) 


Floating-point Compare Equal to zero (vector). This instruction reads each floating-point value in the source 
SIMD&FP register and if the value is equal to zero sets every bit of the corresponding vector element in the 
destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector element in the 
destination SIMD&FP register to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMV8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oao +77 on n o ojo nro o] Rn | Rd 
U op 


Scalar half precision variant 


FCMEQ <Hd>, <Hn>, #0.0 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_CT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oao +171 oe ooo ojo11 0110] Rn | Ra | 
U op 


Scalar single-precision and double-precision variant 


FCMEQ <V><d>, <V><n>, #0.0 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
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integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_GT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


elololo sri ehli itseesi ofits of no do o 


Vector half precision variant 


FCMEQ <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = Compare0p_CT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20/1918 17 16|15 14 13 12|11 10 9 | 5 4| 0 | 


fofajojo 1 1 1 oftjszi1 o0 o o ofo 1 1 ofif of Rn | Ra | 
U op 


Vector single-precision and double-precision variant 


FCMEQ <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 
case op:U of 
when 'QQ' comparison = CompareOp_GT; 
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C7-1480 


when '@1' comparison 


CompareOp_GE; 


when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Assembler symbols 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H when Q = 1 
For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 
2S when sz = 0, Q = 0 
4S when sz = 0,Q = 1 
2D when sz = 1,Q = 1 
The encoding sz = 1,Q = Q is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) zero = FPZero('Q'); 
bits(esize) element; 

boolean test_passed; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
case comparison of 


V[d] 


when CompareOp_GT test_passed = FPCompareGT (element, zero, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element, zero, FPCR); 
when CompareOp_EQ test_passed = FPCompareEQ(element, zero, FPCR); 
when CompareOp_LE test_passed = FPCompareGE(zero, element, FPCR); 
when CompareOp_LT test_passed = FPCompareGT (zero, element, FPCR); 


Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


result; 
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C7.2.51 FCMGE (register) 


ARM DDI 0487E.a 
ID070919 


Floating-point Compare Greater than or Equal (vector). This instruction reads each floating-point value in the first 
source SIMD&FP register and if the value is greater than or equal to the corresponding floating-point value in the 
second source SIMD&FP register sets every bit of the corresponding vector element in the destination SIMD&FP 
register to one, otherwise sets every bit of the corresponding vector element in the destination SIMD&FP register 
to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9 | 5 4| 0 | 


o ajaja 1 1 1 ofoja of Rm fo ofi ofojt{ Rn | Ra | 
U E ac 


Scalar half precision variant 


FCMGE <Hd>, <Hn>, <Hm> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 
CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when 'Q11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Scalar single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


ehjin ojele] em rroo) Rn | Rd 


Scalar single-precision and double-precision variant 


FCMGE <V><d>, <V><n>, <V><m> 
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C7-1482 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when 'Q11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector half precision 


ARMV8.2 


|31 30 29 2827 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fofajif{o 14 1 1 ofoj1 of Rm jo ofi ofoft{ Rn | Ra | 
U E ac 


Vector half precision variant 


FCMGE <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when '000' cmp 
when '@10' cmp 


CompareOp_EQ; abs = FALSE; 
CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 5 4| 0 | 


fofaf7fo +171 ojo] Rm [1117 0)o)] Rn | Ra 
U E ac 


Vector single-precision and double-precision variant 


FCMGE <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 
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Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '1@' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H whenQ = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1,Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
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bits(esize) element1; 
bits(esize) element2; 
boolean test_passed; 


for e = 0 to elements-1 

elementl = Elem[operand1, e, esize]; 

element2 = Elem[operand2, e, esize]; 

if abs then 
element1 = FPAbs(element1); 
element2 = FPAbs(element2); 

case cmp of 
when CompareOp_EQ test_passed = FPCompareEQ(element1, element2, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element1, element2, FPCR); 
when CompareOp_GT test_passed = FPCompareGT(element1, element2, FPCR); 

Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


V[d] = result; 


C7-1484 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.52 FCMGE (zero) 


Floating-point Compare Greater than or Equal to zero (vector). This instruction reads each floating-point value in 
the source SIMD&FP register and if the value is greater than or equal to zero sets every bit of the corresponding 
vector element in the destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector 
element in the destination SIMD&FP register to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMV8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/1110 9. | 5 4| 0 | 


fo aft i177 01i77700)0717 0/0110] Rn | Rd 
U op 


Scalar half precision variant 


FCMGE <Hd>, <Hn>, #0.0 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_CT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Scalar single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fo [ttt +171 oe 000 ojo n a ojo o] Rn | Ra | 
U op 


Scalar single-precision and double-precision variant 


FCMGE <V><d>, <V><n>, #0.0 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
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integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_GT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector half precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


elole Ta polity 7 7 79 oo 7 s ofots of mno do o 


Vector half precision variant 


FCMGE <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_GT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9. | 5 4| 0 | 


fofajijo 1 1 1 oft|szi1 o0 o o ofo 1 1 ojoj of Rn | Ra | 
U op 


Vector single-precision and double-precision variant 


FCMGE <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 
case op:U of 
when 'QQ' comparison = CompareOp_GT; 
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when 'Q@1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Assembler symbols 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) zero = FPZero('Q'); 
bits(esize) element; 

boolean test_passed; 


for e = Q to elements-1 

element = Elem[operand, e, esize]; 

case comparison of 
when CompareOp_GT test_passed = FPCompareGT (element, zero, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element, zero, FPCR); 
when CompareOp_EQ test_passed = FPCompareEQ(element, zero, FPCR); 
when CompareOp_LE test_passed = FPCompareGE(zero, element, FPCR); 
when CompareOp_LT test_passed = FPCompareGT (zero, element, FPCR); 

Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


V[d] = result; 
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C7.2.53 


C7-1488 


FCMGT (register) 


Floating-point Compare Greater than (vector). This instruction reads each floating-point value in the first source 
SIMD&FP register and if the value is greater than the corresponding floating-point value in the second source 
SIMD&FP register sets every bit of the corresponding vector element in the destination SIMD&FP register to one, 
otherwise sets every bit of the corresponding vector element in the destination SIMD&FP register to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMV8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


fot +171 o o] Rm foo ooh] Rn | Ra | 
U E ac 


Scalar half precision variant 


FCMGT <Hd>, <Hn>, <Hm> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 
CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when '000' cmp 
when 'Q10' cmp 


CompareOp_EQ; abs = FALSE; 
CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Scalar single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 141312\1110 9. | 5 4| 0 | 


fo tf1{1 1 1 1 oftfsz{1{ Rm Jı 11 ojoj] Rn | Ra | 
U E ac 


Scalar single-precision and double-precision variant 


FCMGT <V><d>, <V><n>, <V><m> 
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Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when 'Q11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector half precision 


ARMV8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 


16|15 14 13 12/11 10 9 


5 4 


o | 


fofajifo 144 of1{1 of Rm jo ofi ofoft{ Rn | Ra | 
U E ac 


Vector half precision variant 


FCMGT <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 


integer datasize = if Q == '1' then 128 else 64; 


integer elements = datasize DIV esize; 
CompareOp cmp; 
boolean abs; 


case E:U:ac of 
when '000' cmp 
when '@10' cmp 


CompareOp_EQ; abs = FALSE; 
CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16|15 14 13 12/11 10 9 


5 4 


o| 


onon oe] Rm aoo Rn | Ra 
U E ac 


Vector single-precision and double-precision variant 


FCMGT <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 
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Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '1@' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

CompareOp cmp; 

boolean abs; 


case E:U:ac of 
when 'Q00' cmp = CompareOp_EQ; abs = FALSE; 
when 'Q10' cmp = CompareOp_GE; abs = FALSE; 
when '@11' cmp = CompareOp_GE; abs = TRUE; 
when '110' cmp = CompareOp_GT; abs = FALSE; 
when '111' cmp = CompareOp_GT; abs = TRUE; 
otherwise UNDEFINED; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H whenQ = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1,Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


C7-1490 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


bits(esize) element1; 
bits(esize) element2; 
boolean test_passed; 


for e = 0 to elements-1 

elementl = Elem[operand1, e, esize]; 

element2 = Elem[operand2, e, esize]; 

if abs then 
element1 = FPAbs(element1); 
element2 = FPAbs(element2); 

case cmp of 
when CompareOp_EQ test_passed = FPCompareEQ(element1, element2, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element1, element2, FPCR); 
when CompareOp_GT test_passed = FPCompareGT(element1, element2, FPCR); 

Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


V[d] = result; 
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C7.2.54 


C7-1492 


FCMGT (zero) 


Floating-point Compare Greater than zero (vector). This instruction reads each floating-point value in the source 
SIMD&FP register and if the value is greater than zero sets every bit of the corresponding vector element in the 
destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector element in the 
destination SIMD&FP register to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMV8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fo afoot +77 on n o ojo nr ojo o] kn | Rd 
U op 


Scalar half precision variant 


FCMGT <Hd>, <Hn>, #0.0 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_CT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oao +171 oe 000 ojo n a ojo o] Rn | Ra 
U op 


Scalar single-precision and double-precision variant 


FCMGT <V><d>, <V><n>, #0.0 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
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integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_GT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


elololo srr ehli 7 779 oo 7 7 okolie mno do o o 


Vector half precision variant 


FCMGT <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = Compare0p_CT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20/1918 17 16|15 14 13 12|11 10 9. | 5 4| 0 | 


fofajojo 1 1 1 oft|szi1 o0 o o ofo 1 1 ojoj of Rn | Ra | 
U op 


Vector single-precision and double-precision variant 


FCMGT <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 
case op:U of 
when 'QQ' comparison = CompareOp_GT; 
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C7-1494 


when '@1' comparison 


CompareOp_GE; 


when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Assembler symbols 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H when Q = 1 
For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 
2S when sz = 0, Q = 0 
4S when sz = 0,Q = 1 
2D when sz = 1,Q = 1 
The encoding sz = 1,Q = Q is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) zero = FPZero('Q'); 
bits(esize) element; 

boolean test_passed; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
case comparison of 


V[d] 


when CompareOp_GT test_passed = FPCompareGT (element, zero, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element, zero, FPCR); 
when CompareOp_EQ test_passed = FPCompareEQ(element, zero, FPCR); 
when CompareOp_LE test_passed = FPCompareGE(zero, element, FPCR); 
when CompareOp_LT test_passed = FPCompareGT (zero, element, FPCR); 


Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


result; 
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C7.2.55 FCMLA (by element) 


ARM DDI 0487E.a 
ID070919 


Floating-point Complex Multiply Accumulate (by element). 


This instruction operates on complex numbers that are represented in SIMD&FP registers as pairs of elements, with 
the more significant element holding the imaginary part of the number and the less significant element holding the 
real part of the number. Each element holds a floating-point value. It performs the following computation on 
complex numbers from the first source register and the destination register with the specified complex number from 
the second source register: 


s Considering the complex number from the second source register on an Argand diagram, the number is 
rotated counterclockwise by 0, 90, 180, or 270 degrees. 
7 The two elements of the transformed complex number are multiplied by: 


— The real element of the complex number from the first source register, if the transformation was a 
rotation by 0 or 180 degrees. 


— The imaginary element of the complex number from the first source register, if the transformation was 
a rotation by 90 or 270 degrees. 


s The complex number resulting from that multiplication is added to the complex number from the destination 
register. 


The multiplication and addition operations are performed as a fused multiply-add, without any intermediate 
rounding. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


ARMVv8.3 
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Encoding 
Applies when size == 01. 


FCMLA <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>], #<rotate> 


Encoding 
Applies when size == 10. 


FCMLA <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>], #<rotate> 


Decode for all variants of this encoding 


if !HaveFCADDExt() then UNDEFINED; 

integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(M:Rm); 

if size == '00' || size == '11' then UNDEFINED; 
if size == '01' then index = UInt(H:L); 

if size == '10' then index = UInt(H); 

integer esize = 8 << UInt(size); 

if !HaveFP16Ext() && esize == 16 then UNDEFINED; 
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C7-1496 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


if size == 


'10' && (L == '1' || Q == '@') then UNDEFINED; 


if size == '01' && H == '1' && Q == '@' then UNDEFINED; 


Assembler symbols 


<Vd> 


<T> 


<Vn> 
<Vm> 


<Ts> 


<index> 


<rotate> 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 00, Q = x. 
° size = 10, Q = 0. 
° size = 11,Q = x. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "M:Rm" fields. 


Is an element size specifier, encoded in the "size" field. It can have the following values: 


01 
10 


H when size 


S when size 


The following encodings are reserved: 
° size = 00. 


° size = 11. 


Is the element index, encoded in the "size:H:L" field. It can have the following values: 
H:L when size = 01 

H when size = 10 

The following encodings are reserved: 

° size = 00. 


. size = 11. 


Is the rotation, encoded in the "rot" field. It can have the following values: 


) when rot = 00 
90 when rot = 01 
180 when rot = 10 
270 when rot = 11 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) operand3 


nou ou 
— = = 
a3 5 


bits(datasize) result; 


for e = 0 to (elements DIV 2)-1 
case rot of 
when 'QQ' 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


element1 = Elem[operand2, index«2, esize]; 
element2 = Elem[operand1, ex2, esize]; 


Non-Confidential 


ARM DDI 0487E.a 


ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


om 


Jement3 = Elem[operand2, index«2+1, esize]; 
Jement4 = Elem[operand1, ex2, esize]; 

when 'Q1' 
Jement1 = FPNeg(Elem[operand2, index#2+1, esize]); 
ement2 = Elem[operand1, e«2+1, esize]; 

ement3 = Elem[operand2, index«2, esize]; 

ement4 = Elem[operand1, ex2+1, esize]; 

when '10' 
Jement1 = FPNeg(Elem[operand2, index#2, esize]); 
ement2 = Elem[operand1, e«2, esize]; 

ement3 = FPNeg(Elem[operand2, index«2+1, esize]); 
ement4 = Elem[operand1, ex2, esize]; 

when '11' 
Jement1 = Elem[operand2, index«2+1, esize]; 
ement2 = Elem[operand1, e«2+1, esize]; 

ement3 = FPNeg(Elem[operand2, indexs2, esize]); 
ement4 = Elem[operand1, e«2+1, esize]; 


om 


oo mo wm 
eae eee 


oo mo wm 
i aal 





oo mo wm 
et 





Elem[result, ex2, esize] = FPMulAdd(Elem[operand3, e«2, esize], element2, element1, FPCR); 
Elem[result, ex2+1, esize] = FPMulAdd(Elem[operand3, ex2+1, esize], element4, element3, FPCR); 


V[d] = result; 
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C7.2.56 


C7-1498 


FCMLA 


Floating-point Complex Multiply Accumulate. 


This instruction operates on complex numbers that are represented in SIMD&FP registers as pairs of elements, with 
the more significant element holding the imaginary part of the number and the less significant element holding the 
real part of the number. Each element holds a floating-point value. It performs the following computation on the 
corresponding complex number element pairs from the two source registers and the destination register: 


° Considering the complex number from the second source register on an Argand diagram, the number is 
rotated counterclockwise by 0, 90, 180, or 270 degrees. 


è The two elements of the transformed complex number are multiplied by: 


— Thereal element of the complex number from the first source register, if the transformation was a 
rotation by 0 or 180 degrees. 


— The imaginary element of the complex number from the first source register, if the transformation was 
a rotation by 90 or 270 degrees. 


$ The complex number resulting from that multiplication is added to the complex number from the destination 
register. 


The multiplication and addition operations are performed as a fused multiply-add, without any intermediate 
rounding. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


ARMVv8.3 
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Three registers of the same type variant 


FCMLA <Vd>.<T>, <Vn>.<T>, <Vm>.<T>, #<rotate> 


Decode for this encoding 


if !HaveFCADDExt() then UNDEFINED; 

integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size == '00' then UNDEFINED; 

if Q == '0' && size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 

if !HaveFP16Ext() && esize == 16 then UNDEFINED; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
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<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The following encodings are reserved: 
° size = 00, Q =x. 


. size = 11,Q = 0. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
<rotate> Is the rotation, encoded in the "rot" field. It can have the following values: 

) when rot = 00 

90 when rot = 01 

180 when rot = 10 

270 when rot = 11 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 
bits(esize) element3; 
bits(esize) element4; 


for e = 0 to (elements DIV 2)-1 


case rot of 
when 'QQ' 
element1 = Elem[operand2, ex2, esize]; 
element2 = Elem[operand1l, ex2, esize]; 
element3 = Elem[operand2, e«2+1, esize]; 
element4 = Elem[operand1, ex2, esize]; 


when 'Q1' 
Jement1 = FPNeg(Elem[operand2, ex2+1, esize]); 
ement2 = Elem[operand1, e«2+1, esize]; 

ement3 = Elem[operand2, ex2, esize]; 
ement4 = Elem[operand1, e«2+1, esize]; 
when '10' 
Jement1 = FPNeg(Elem[operand2, ex2, esize]); 
ement2 = Elem[operand1, ex2, esize]; 
ement3 = FPNeg(Elem[operand2, ex2+1, esize]); 
ement4 = Elem[operand1, e2, esize]; 
when '11' 
Jement1 = Elem[operand2, e«2+1, esize]; 
ement2 = Elem[operand1, e«2+1, esize]; 
ement3 = FPNeg(Elem[operand2, ex2, esize]); 
ement4 = Elem[operand1, ex2+1, esize]; 


Oo mo wm wm 
a etry 


oo wm Wm 
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Elem[result, e+2, esize] 


= FPMulAdd(Elem[operand3, e2, esize], element2, element1, FPCR); 
Elem[result, ex2+1, esize] = 


FPMulAdd(Elem[operand3, e*2+1, esize], element4, element3, FPCR); 


V[d] = result; 
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C7.2.57 


C7-1500 


FCMLE (zero) 


Floating-point Compare Less than or Equal to zero (vector). This instruction reads each floating-point value in the 
source SIMD&FP register and if the value is less than or equal to zero sets every bit of the corresponding vector 
element in the destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector element 
in the destination SIMD&FP register to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMV8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Scalar half precision variant 


FCMLE <Hd>, <Hn>, #0.0 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_CT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Scalar single-precision and double-precision variant 


FCMLE <V><d>, <V><n>, #0.0 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
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integer elements = 1; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = CompareOp_GT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector half precision 


ARMVv8.2 
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Vector half precision variant 


FCMLE <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 

case op:U of 
when 'QQ' comparison = Compare0p_CT; 
when 'Q1' comparison = CompareOp_GE; 
when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Vector single-precision and double-precision 
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Vector single-precision and double-precision variant 


FCMLE <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison; 
case op:U of 
when 'QQ' comparison = CompareOp_GT; 
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C7-1502 


when '@1' comparison 


CompareOp_GE; 


when '10' comparison = CompareOp_EQ; 
when '11' comparison = CompareOp_LE; 


Assembler symbols 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H when Q = 1 
For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 
2S when sz = 0, Q = 0 
4S when sz = 0,Q = 1 
2D when sz = 1,Q = 1 
The encoding sz = 1,Q = Q is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) zero = FPZero('Q'); 
bits(esize) element; 

boolean test_passed; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
case comparison of 


V[d] 


when CompareOp_GT test_passed = FPCompareGT (element, zero, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element, zero, FPCR); 
when CompareOp_EQ test_passed = FPCompareEQ(element, zero, FPCR); 
when CompareOp_LE test_passed = FPCompareGE(zero, element, FPCR); 
when CompareOp_LT test_passed = FPCompareGT (zero, element, FPCR); 


Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


result; 
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C7.2.58 FCMLT (zero) 


Floating-point Compare Less than zero (vector). This instruction reads each floating-point value in the source 
SIMD&FP register and if the value is less than zero sets every bit of the corresponding vector element in the 
destination SIMD&FP register to one, otherwise sets every bit of the corresponding vector element in the 
destination SIMD&FP register to zero. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMV8.2 
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Scalar half precision variant 
FCMLT <Hd>, <Hn>, #0.0 

Decode for this encoding 

if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 


integer elements = 1; 


CompareOp comparison = CompareOp_LT; 
Scalar single-precision and double-precision 
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Scalar single-precision and double-precision variant 


FCMLT <V><d>, <V><n>, #0.0 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


CompareOp comparison = CompareOp_LT; 
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C7-1504 


Vector half precision 


ARMVv8.2 
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Vector half precision variant 


FCMLT <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison = CompareOp_LT; 
Vector single-precision and double-precision 
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Vector single-precision and double-precision variant 


FCMLT <Vd>.<T>, <Vn>.<T>, #0.0 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


CompareOp comparison = CompareOp_LT; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 

S when sz = 0 

D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
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<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<T> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H whenQ = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1,Q = Q is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) zero = FPZero('Q'); 
bits(esize) element; 

boolean test_passed; 


for e = Q to elements-1 

element = Elem[operand, e, esize]; 

case comparison of 
when CompareOp_GT test_passed = FPCompareGT (element, zero, FPCR); 
when CompareOp_GE test_passed = FPCompareGE(element, zero, FPCR); 
when CompareOp_EQ test_passed = FPCompareEQ(element, zero, FPCR); 
when CompareOp_LE test_passed = FPCompareGE(zero, element, FPCR); 
when CompareOp_LT test_passed = FPCompareGT (zero, element, FPCR); 

Elem[result, e, esize] = if test_passed then Ones() else Zeros(); 


V[d] = result; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1505 
ID070919 Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.59 FCMP 


Floating-point quiet Compare (scalar). This instruction compares the two SIMD&FP source register values, or the 
first SIMD&FP source register value and zero. It writes the result to the PSTATE. {N, Z, C, V} flags. 


It raises an Invalid Operation exception only if either operand is a signaling NaN. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 
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Half-precision variant 
Applies when ftype == 11 & opc == 00. 


FCMP <Hn>, <Hm> 


Half-precision, zero variant 
Applies when ftype == 11 && Rm == (00000) && opc == 01. 


FCMP <Hn>, #0.0 


Single-precision variant 
Applies when ftype == 00 && opc == 00. 


FCMP <Sn>, <Sm> 


Single-precision, zero variant 
Applies when ftype == 00 && Rm == (00000) && opc == 01. 


FCMP <Sn>, #0.0 


Double-precision variant 
Applies when ftype == 01 && opc == 00. 


FCMP <Dn>, <Dm> 


Double-precision, zero variant 
Applies when ftype == 01 && Rm == (00000) && opc == 01. 


FCMP <Dn>, #0.0 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer m = UInt(Rm); // ignored when opc<@> == '1' 


integer datasize; 

case ftype of 
when '00' datasize = 32; 
when '01' datasize = 64; 
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when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 


else 
UNDEFINED; 
boolean signal_all_nans = (opc<l> == '1'); 
boolean cmp_with_zero = (opc<@> == '1'); 


Assembler symbols 


<Dn> For the double-precision variant: is the 64-bit name of the first SIMD&FP source register, encoded 
in the "Rn" field. 


For the double-precision, zero variant: is the 64-bit name of the SIMD&FP source register, encoded 
in the "Rn" field. 


<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 

<Hn> For the half-precision variant: is the 16-bit name of the first SIMD&FP source register, encoded in 
the "Rn" field. 
For the half-precision, zero variant: is the 16-bit name of the SIMD&FP source register, encoded in 
the "Rn" field. 

<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 

<Sn> For the single-precision variant: is the 32-bit name of the first SIMD&FP source register, encoded 


in the "Rn" field. 


For the single-precision, zero variant: is the 32-bit name of the SIMD&FP source register, encoded 
in the "Rn" field. 


<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
NaNs 


The IEEE 754 standard specifies that the result of a comparison is precisely one of <, ==, > or unordered. If either 
or both of the operands are NaNs, they are unordered, and all three of (Operand1! < Operand2), (Operand1 == 
Operand2) and (Operand1 > Operand2) are false. This case results in the FPSCR flags being set to N=0, Z=0, C=1, 
and V=1. 
Operation 

CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operandl = V[n]; 
bits(datasize) operand2; 


operand2 = if cmp_with_zero then FPZero('@') else V[m]; 


PSTATE.<N,Z,C,V> = FPCompare(operand1, operand2, signal_all_nans, FPCR); 
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C7.2.60 FCMPE 


C7-1508 


Floating-point signaling Compare (scalar). This instruction compares the two SIMD&FP source register values, or 
the first SIMD&FP source register value and zero. It writes the result to the PSTATE. {N, Z, C, V} flags. 


If either operand is any type of NaN, or if either operand is a signaling NaN, the instruction raises an Invalid 


Operation exception. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 
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Half-precision variant 
Applies when ftype == 11 && opc == 10. 


FCMPE <Hn>, <Hm> 


Half-precision, zero variant 
Applies when ftype == 11 && Rm == (00000) && opc == 11. 


FCMPE <Hn>, #0.0 


Single-precision variant 
Applies when ftype == 00 && opc == 10. 


FCMPE <Sn>, <Sm> 


Single-precision, zero variant 
Applies when ftype == 00 && Rm == (00000) && opc == 11. 


FCMPE <Sn>, #0.0 


Double-precision variant 
Applies when ftype == 01 && opc == 10. 


FCMPE <Dn>, <Dm> 


Double-precision, zero variant 
Applies when ftype == 01 && Rm == (00000) && opc == 11. 


FCMPE <Dn>, #0.0 


Decode for all variants of this encoding 


integer n = UInt(Rn); 
integer m = UInt(Rm); // ignored when opc<@> == '1' 


integer datasize; 
case ftype of 
when '00' datasize = 32; 
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when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 


else 
UNDEFINED; 
boolean signal_all_nans = (opc<l> == '1'); 
boolean cmp_with_zero = (opc<@> == '1'); 


Assembler symbols 


<Dn> For the double-precision variant: is the 64-bit name of the first SIMD&FP source register, encoded 
in the "Rn" field. 


For the double-precision, zero variant: is the 64-bit name of the SIMD&FP source register, encoded 
in the "Rn" field. 


<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 

<Hn> For the half-precision variant: is the 16-bit name of the first SIMD&FP source register, encoded in 
the "Rn" field. 
For the half-precision, zero variant: is the 16-bit name of the SIMD&FP source register, encoded in 
the "Rn" field. 

<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 

<Sn> For the single-precision variant: is the 32-bit name of the first SIMD&FP source register, encoded 


in the "Rn" field. 


For the single-precision, zero variant: is the 32-bit name of the SIMD&FP source register, encoded 
in the "Rn" field. 


<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
NaNs 


The IEEE 754 standard specifies that the result of a comparison is precisely one of <, ==, > or unordered. If either 
or both of the operands are NaNs, they are unordered, and all three of (Operand1 < Operand2), (Operand1 == 
Operand2) and (Operand1 > Operand2) are false. This case results in the FPSCR flags being set to N=0, Z=0, C=1, 
and V=1. 


FCMPE raises an Invalid Operation exception if either operand is any type of NaN, and is suitable for testing for <, 
<=, >, >=, and other predicates that raise an exception when the operands are unordered. 
Operation 

CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operandl = V[n]; 
bits(datasize) operand2; 


operand2 = if cmp_with_zero then FPZero('@') else V[m]; 


PSTATE.<N,Z,C,V> = FPCompare(operand1, operand2, signal_all_nans, FPCR); 
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C7.2.61 


C7-1510 


FCSEL 


Floating-point Conditional Select (scalar). This instruction allows the SIMD&FP destination register to take the 
value from either one or the other of two SIMD&FP source registers. If the condition passes, the first SIMD&FP 
source register value is taken, otherwise the second SIMD&FP source register value is taken. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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Half-precision variant 
Applies when ftype == 11. 


FCSEL <Hd>, <Hn>, <Hm>, <cond> 


Single-precision variant 
Applies when ftype == 00. 


FCSEL <Sd>, <Sn>, <Sm>, <cond> 


Double-precision variant 
Applies when ftype == 01. 


FCSEL <Dd>, <Dn>, <Dm>, <cond> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when '00' datasize = 32; 
when '01' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
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<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<cond> Is one of the standard conditions, encoded in the "cond" field in the standard way. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 


result = if ConditionHolds(cond) then V[n] else V[m]; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.62 FCVT 


C7-1512 


Floating-point Convert precision (scalar). This instruction converts the floating-point value in the SIMD&FP source 
register to the precision for the destination register data type using the rounding mode that is determined by the 


FPCR and writes the result to the SIMD&FP destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/1514 1312/1110 9. | 


o | 


olojo 171 ofwel 00 iJopc]io 000] Rn | Rd 


Half-precision to single-precision variant 
Applies when ftype == 11 && opc == 00. 


FCVT <Sd>, <Hn> 


Half-precision to double-precision variant 
Applies when ftype == 11 && opc == 01. 


FCVT <Dd>, <Hn> 


Single-precision to half-precision variant 
Applies when ftype == 00 && opc == 11. 


FCVT <Hd>, <Sn> 


Single-precision to double-precision variant 
Applies when ftype == 00 && opc == 01. 


FCVT <Dd>, <Sn> 


Double-precision to half-precision variant 
Applies when ftype == 01 && opc == 11. 


FCVT <Hd>, <Dn> 


Double-precision to single-precision variant 
Applies when ftype == 01 && opc == 00. 


FCVT <Sd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer srcsize; 
integer dstsize; 


if ftype == opc then UNDEFINED; 


case ftype of 
when 'QQ' srcsize = 32; 
when 'Q1' srcsize = 64; 
when '10' UNDEFINED; 
when '11' srcsize = 16; 
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case opc of 
when '00' dstsize = 32; 
when '01' dstsize = 64; 
when '10' UNDEFINED; 
when '11' dstsize = 16; 


Assembler symbols 





<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(dstsize) result; 
bits(srcsize) operand = V[n]; 


result = FPConvert(operand, FPCR); 
V[d] = result; 
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C7.2.63 FCVTAS (vector) 


Floating-point Convert to Signed integer, rounding to nearest with ties to Away (vector). This instruction converts 
each element in a vector from a floating-point value to a signed integer value using the Round to Nearest with Ties 
to Away rounding mode and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 
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Scalar half precision variant 


FCVTAS <Hd>, <Hn> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = esize; 

integer elements = 1; 

FPRounding rounding = FPRounding_TIEAWAY; 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 
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Scalar single-precision and double-precision variant 


FCVTAS <V><d>, <V><n> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd); 
UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPRounding_TIEAWAY; 
boolean unsigned = (U == '1'); 
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Vector half precision 


ARMVv8.2 
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Vector half precision variant 


FCVTAS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPRounding_TIEAWAY; 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 
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Vector single-precision and double-precision variant 


FCVTAS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPRounding_TIEAWAY; 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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C7-1516 


<n> 


<Vd> 


<T> 


<Vn> 


Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.64 FCVTAS (scalar) 


ARM DDI 0487E.a 
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Floating-point Convert to Signed integer, rounding to nearest with ties to Away (scalar). This instruction converts 
the floating-point value in the SIMD&FP source register to a 32-bit or 64-bit signed integer using the Round to 
Nearest with Ties to Away rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTAS <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTAS <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTAS <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTAS <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTAS <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTAS <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 


case ftype of 
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C7-1518 


when 'QQ' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, FALSE, FPCR, FPRounding_TIEAWAY) ; 


X[d] 


= intval; 
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C7.2.65 FCVTAU (vector) 


Floating-point Convert to Unsigned integer, rounding to nearest with ties to Away (vector). This instruction converts 
each element in a vector from a floating-point value to an unsigned integer value using the Round to Nearest with 
Ties to Away rounding mode and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Scalar half precision variant 


FCVTAU <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPRounding_TIEAWAY; 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0| 
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Scalar single-precision and double-precision variant 


FCVTAU <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPRounding_TIEAWAY; 
boolean unsigned = (U == '1'); 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1519 
ID070919 Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7-1520 


Vector half precision 


ARMv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


olor oo noo aroo o] en | Rd 
U 


Vector half precision variant 


FCVTAU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPRounding_TIEAWAY; 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 
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Vector single-precision and double-precision variant 


FCVTAU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPRounding_TIEAWAY; 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.66 FCVTAU (scalar) 


C7-1522 


Floating-point Convert to Unsigned integer, rounding to nearest with ties to Away (scalar). This instruction converts 
the floating-point value in the SIMD&FP source register to a 32-bit or 64-bit unsigned integer using the Round to 
Nearest with Ties to Away rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 2120/1918  16/15141312/11109 | 


aloo ttt Olkpelt oo] 0 ao oo oo] a a 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTAU <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTAU <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTAU <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTAU <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTAU <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTAU <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 


case ftype of 
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when 'QQ' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, TRUE, FPCR, FPRounding_TIEAWAY) ; 


X[d] 


= intval; 
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C7.2.67 FCVTL, FCVTL2 


Floating-point Convert to higher precision Long (vector). This instruction reads each element in a vector in the 
SIMD&FP source register, converts each value to double the precision of the source element using the rounding 
mode that is determined by the FPCR, and writes each result to the equivalent element of the vector in the 
SIMD&FP destination register. 


Where the operation lengthens a 64-bit vector to a 128-bit vector, the FCVTL2 variant operates on the elements in the 
top 64 bits of the source register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofajojo 1 1 1 ofojszi1 o0 o o ofsx o1r afi of Rn | Ra | 


Vector single-precision and double-precision variant 


FCVTL{2} <Vd>.<Ta>, <Vn>.<Tb> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


integer esize = 16 << UInt(sz); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "sz" field. It can have the following values: 
4s when sz = 0 
2D when sz = 1 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<Tb> Is an arrangement specifier, encoded in the "sz:Q" field. It can have the following values: 
4H when sz = 0,Q = 0 
8H when sz = 0,Q = 1 
2S when sz = 1,Q = 0 
4S when sz = 1,Q = 1 

C7-1524 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Operation 

CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = Vpart[n, part]; 
bits(2sdatasize) result; 


for e = 0 to elements-1 
Elem[result, e, 2xesize] = FPConvert(Elem[operand, e, esize], FPCR); 


V[d] = result; 
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C7.2.68 FCVTMS (vector) 


Floating-point Convert to Signed integer, rounding toward Minus infinity (vector). This instruction converts a scalar 
or each element in a vector from a floating-point value to a signed integer value using the Round towards Minus 
Infinity rounding mode, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fo sof rat oor Fro oft te apps of en TR 


Scalar half precision variant 


FCVTMS <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = esize; 

integer elements = 1; 

FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0| 


oao +171 ojo o oo oj o o] Rn | R 
U 02 01 


Scalar single-precision and double-precision variant 


FCVTMS <V><d>, <V><n> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd) ; 
UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 
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Vector half precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fofafofo +17 ofol1 7771001107110] Rn | Ra 
U 02 01 


Vector half precision variant 


FCVIMS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fofafofo +17 Ofofst ooo 01101110] Rn | Ra 
U 02 01 


Vector single-precision and double-precision variant 


FCVIMS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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C7-1528 


<n> 


<Vd> 


<T> 


<Vn> 


Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.69 FCVTMS (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Convert to Signed integer, rounding toward Minus infinity (scalar). This instruction converts the 
floating-point value in the SIMD&FP source register to a 32-bit or 64-bit signed integer using the Round towards 
Minus Infinity rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 2120/1918  16/15141312/11109 | 5 4| 0 | 


sflofo]1 1 1 1 offtype{1]1 ojo o ofoo ooo 0] Rn | Ra | 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTMS <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTMS <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTMS <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTMS <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTMS <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTMS <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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C7-1530 


case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPDecodeRounding(rmode) ; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, FALSE, FPCR, rounding); 


X[d] 


= intval; 
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C7.2.70 FCVTMU (vector) 


Floating-point Convert to Unsigned integer, rounding toward Minus infinity (vector). This instruction converts a 
scalar or each element in a vector from a floating-point value to an unsigned integer value using the Round towards 
Minus Infinity rounding mode, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oar rat oor tt ro oft te pips of ae TR 


Scalar half precision variant 


FCVTMU <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0| 


Dama n ojo o oo oj oi o] Rn | Ra 
U 02 01 


Scalar single-precision and double-precision variant 


FCVTMU <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 
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C7-1532 


Vector half precision 


ARMv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fojaftfo +17 ofofr 771001107110] Rn | Ra 
U 02 01 


Vector half precision variant 


FCVTMU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


OOOMEENOCHHERE E Rn | Ra 
U 02 01 


Vector single-precision and double-precision variant 


FCVTMU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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<T> 


<Vn> 
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Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.71 FCVTMU (scalar) 


C7-1534 


Floating-point Convert to Unsigned integer, rounding toward Minus infinity (scalar). This instruction converts the 
floating-point value in the SIMD&FP source register to a 32-bit or 64-bit unsigned integer using the Round towards 


Minus Infinity rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 2120/1918  16/15141312/11109 | 


olde lomo oma ee E E 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTMU <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTMU <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTMU <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTMU <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTMU <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTMU <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPDecodeRounding(rmode) ; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, TRUE, FPCR, rounding); 
X[d] = intval; 
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C7.2.72 FCVTN, FCVTN2 


Floating-point Convert to lower precision Narrow (vector). This instruction reads each vector element in the 
SIMD&FP source register, converts each result to half the precision of the source element, writes the final result to 
a vector, and writes the vector to the lower or upper half of the destination SIMD&FP register. The destination 
vector elements are half as long as the source vector elements. The rounding mode is determined by the FPCR. 


The FCVTN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the FCVTN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofajojo 1 1 1 ofofsz{1 o0 o o ofa O14 ofr of Rn | Ra | 


Vector single-precision and double-precision variant 


FCVTN{2} <Vd>.<Tb>, <Vn>.<Ta> 


Decode for this encoding 


integer 
integer 


integer 
integer 
integer 
integer 


d 
n 


esize 


UInt(Rd); 
UInt(Rn); 


= 16 << UInt(sz); 


datasize = 64; 


part 


= UInt(Q); 


elements = datasize DIV esize; 


Assembler symbols 


2 


<Vd> 


<Tb> 


<Vn> 


<Ta> 


C7-1536 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "sz:Q" field. It can have the following values: 
4H when sz = 0,Q = 0 


8H when sz = 0,Q = 1 
2S when sz = 1,Q = 0 
4s when sz = 1,Q = 1 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "sz" field. It can have the following values: 


4S when sz = 0 
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2D when sz = 1 


Operation 
CheckFPAdvSIMDEnab1ed64(); 
bits(2sdatasize) operand = V[n]; 
bits(datasize) result; 


for e = 0 to elements-1 
Elem[result, e, esize] = FPConvert(Elem[operand, e, 2xesize], FPCR); 


Vpart[d, part] = result; 
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C7.2.73 FCVTNS (vector) 


Floating-point Convert to Signed integer, rounding to nearest with ties to even (vector). This instruction converts a 
scalar or each element in a vector from a floating-point value to a signed integer value using the Round to Nearest 
rounding mode, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fo spo[r Fat oor Ft To oft to tof of Rn TR 


Scalar half precision variant 


FCVINS <Hd>, <Hn> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = esize; 

integer elements = 1; 

FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0| 


oao +171 ojo o o o oja oo o] Rn | R | 
U 02 01 


Scalar single-precision and double-precision variant 


FCVTNS <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 
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Vector half precision 


ARMVv8.2 


|31 30 29 2827 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fofafofo +17 ofof1 74100110 %)0)10] Rn | Ra | 
U 02 01 


Vector half precision variant 


FCVINS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fofafofo +171 oOfofs1o000j110 10/10] Rn | Ra 
U 02 01 


Vector single-precision and double-precision variant 


FCVTNS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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C7-1540 


<n> 


<Vd> 


<T> 


<Vn> 


Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.74 FCVTNS (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Convert to Signed integer, rounding to nearest with ties to even (scalar). This instruction converts the 
floating-point value in the SIMD&FP source register to a 32-bit or 64-bit signed integer using the Round to Nearest 


rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 2120/1918 16|15 14 13 12|11 10 9. | 


aloo ttt Ole] to ooo oo oo oo] a l a 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTNS <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVINS <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVINS <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVINS <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVINS <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVINS <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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C7-1542 


case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPDecodeRounding(rmode) ; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, FALSE, FPCR, rounding); 


X[d] 


= intval; 
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C7.2.75 FCVTNU (vector) 


Floating-point Convert to Unsigned integer, rounding to nearest with ties to even (vector). This instruction converts 
a scalar or each element in a vector from a floating-point value to an unsigned integer value using the Round to 
Nearest rounding mode, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


COOK K Tat oor Tro oft te tof of an TR 


Scalar half precision variant 


FCVTNU <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = esize; 

integer elements = 1; 

FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0| 


oane +171 ojo o o o oj oon o] Rn | Ra 
U 02 01 


Scalar single-precision and double-precision variant 


FCVTNU <V><d>, <V><n> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd); 
UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 
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C7-1544 


Vector half precision 


ARMv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fofafifo +17 ofo[1 74700110 %)0)10] Rn | Ra | 
U 02 01 


Vector half precision variant 


FCVTNU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


OOQOMEENOCHHER E Rn | Ra 
U 02 01 


Vector single-precision and double-precision variant 


FCVTNU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.76 FCVTNU (scalar) 


C7-1546 


Floating-point Convert to Unsigned integer, rounding to nearest with ties to even (scalar). This instruction converts 
the floating-point value in the SIMD&FP source register to a 32-bit or 64-bit unsigned integer using the Round to 


Nearest rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 2120/1918  16/15141312/11109 | 


olde lee Ulta oma ee 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTNU <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTNU <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTNU <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTNU <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTNU <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTNU <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPDecodeRounding(rmode) ; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, TRUE, FPCR, rounding); 
X[d] = intval; 
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C7.2.77 FCVTPS (vector) 


Floating-point Convert to Signed integer, rounding toward Plus infinity (vector). This instruction converts a scalar 
or each element in a vector from a floating-point value to a signed integer value using the Round towards Plus 
Infinity rounding mode, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


foil robe tro oft te C E of an TR 


Scalar half precision variant 


FCVTPS <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = esize; 

integer elements = 1; 

FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0| 


oao +171 oe ooo o a oo o] Rn | R 
U 02 01 


Scalar single-precision and double-precision variant 


FCVTPS <V><d>, <V><n> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd); 
UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 
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Vector half precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fofafofo +17 Oftf1 777100110 70)10] Rn | Ra | 
U 02 01 


Vector half precision variant 


FCVTPS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 1312/1110 9. | 5 4| 0 | 


fofafofo +171 [tft 0000110 7J0)10] Rn | Ra 
U 02 01 


Vector single-precision and double-precision variant 


FCVTPS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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C7-1550 


<n> 


<Vd> 


<T> 


<Vn> 


Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.78 FCVTPS (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Convert to Signed integer, rounding toward Plus infinity (scalar). This instruction converts the 
floating-point value in the SIMD&FP source register to a 32-bit or 64-bit signed integer using the Round towards 
Plus Infinity rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 2120/1918  16/15141312/11109 | 5 4| 0 | 


sflojo]1 1 1 1 offype{1jo t]o o oJfoo ooo of] Rn | Ra | 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTPS <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTPS <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTPS <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTPS <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTPS <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTPS <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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C7-1552 


case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPDecodeRounding(rmode) ; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, FALSE, FPCR, rounding); 


X[d] 


= intval; 
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C7.2.79 FCVTPU (vector) 


Floating-point Convert to Unsigned integer, rounding toward Plus infinity (vector). This instruction converts a 
scalar or each element in a vector from a floating-point value to an unsigned integer value using the Round towards 
Plus Infinity rounding mode, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


COOK E rr K tt ro oft te C E of an TR 


Scalar half precision variant 


FCVTPU <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0| 


fo yt +171 ohen oooh aooo] Rn | e 
U 02 01 


Scalar single-precision and double-precision variant 


FCVTPU <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 
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C7-1554 


Vector half precision 


ARMv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fojaftfo +17 oftf1 7141100110 70)10] Rn | Ra 
U 02 01 


Vector half precision variant 


FCVTPU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|1110 9. | 5 4| 0| 


OOOMEENOCAER E Rn | Ra 
U 02 01 


Vector single-precision and double-precision variant 


FCVTPU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.80 FCVTPU (scalar) 


C7-1556 


Floating-point Convert to Unsigned integer, rounding toward Plus infinity (scalar). This instruction converts the 
floating-point value in the SIMD&FP source register to a 32-bit or 64-bit unsigned integer using the Round towards 


Plus Infinity rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28/27 26 25 24|23 22 2120/1918  16/15141312/11109 | 


olde lee cara oma ee a 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTPU <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTPU <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTPU <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTPU <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTPU <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTPU <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPDecodeRounding(rmode) ; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, TRUE, FPCR, rounding); 
X[d] = intval; 
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C7.2.81 


C7-1558 


FCVTXN, FCVTXN2 


Floating-point Convert to lower precision Narrow, rounding to odd (vector). This instruction reads each vector 
element in the source SIMD&FP register, narrows each value to half the precision of the source element using the 
Round to Odd rounding mode, writes the result to a vector, and writes the vector to the destination SIMD&FP 
register. 


Note 


This instruction uses the Round to Odd rounding mode which is not defined by the IEEE 754-2008 standard. This 
rounding mode ensures that if the result of the conversion is inexact the least significant bit of the mantissa is forced 
to 1. This rounding mode enables a floating-point value to be converted to a lower precision format via an 
intermediate precision format while avoiding double rounding errors. For example, a 64-bit floating-point value can 
be converted to a correctly rounded 16-bit floating-point value by first using this instruction to produce a 32-bit 
value and then using another instruction with the wanted rounding mode to convert the 32-bit value to the final 
16-bit floating-point value. 








The FCVTXN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the FCVTXN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


o afifi 1 1 1 ofofsz{1 o o o ofa o14 ofr of Rn | Ra | 


Scalar variant 


FCVTXN <Vb><d>, <Va><n> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 

if sz == '@' then UNDEFINED; 
integer esize = 32; 

integer datasize = esize; 


integer elements = 1; 
integer part = Q; 


Vector 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


opo olo ooo o orro o] Rn | Rd 


Vector variant 


FCVTXN{2} <Vd>.<Tb>, <Vn>.<Ta> 
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Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz == 'Q' then UNDEFINED; 
integer esize = 32; 

integer datasize = 64; 
integer elements = 2; 
integer part = UInt(Q); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Tb> Is an arrangement specifier, encoded in the "sz:Q" field. It can have the following values: 
2S when sz = 1,Q = 0 
4S when sz = 1,Q = 1 


The encoding sz = 0, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Ta> Is an arrangement specifier, encoded in the "sz" field. It can have the following values: 
2D when sz = 1 


The encoding sz = @ is reserved. 


<Vb> Is the destination width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 1 


The encoding sz = ® is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Va> Is the source width specifier, encoded in the "sz" field. It can have the following values: 
D when sz = 1 


The encoding sz = @ is reserved. 


<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 
CheckFPAdvSIMDEnab1ed64(); 
bits(2sdatasize) operand = V[n]; 
bits(datasize) result; 


for e = 0 to elements-1 
Elem[result, e, esize] = FPConvert(Elem[operand, e, 2*esize], FPCR, FPRounding_ODD); 


Vpart[d, part] = result; 
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C7.2.82 


C7-1560 


FCVTZS (vector, fixed-point) 


Floating-point Convert to Signed fixed-point, rounding toward Zero (vector). This instruction converts a scalar or 
each element in a vector from floating-point to fixed-point signed integer using the Round towards Zero rounding 
mode, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 1918 16|15141312/11109 | 5 4| 0 | 


fo so[r rat E [imme [VF as] ee TR 


immh 


Scalar variant 


FCVTZS <V><d>, <V><n>, #<fbits> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd) ; 
UInt(Rn) ; 


if immh == '000x' || (immh == 'QQ1x' && !HaveFP16Ext()) then UNDEFINED; 

integer esize = if immh == '1xxx' then 64 else if immh == 'Q1xx' then 32 else 16; 
integer datasize = esize; 

integer elements = 1; 


integer fracbits = (esize » 2) - UInt(immh:immb); 


boolean unsigned = (U == '1'); 
FPRounding rounding = FPRounding_ZERO; 


Vector 


|31 30 29 28|27 26 25 24/23 22 1918  16|15141312/11109 | 5 4| 0 | 


eloo +4 4 + of 0000 [imme [raat ia] ee Re 


immh 


Vector variant 


FCVTZS <Vd>.<T>, <Vn>.<T>, #<fbits> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 

if immh == '000x' || (immh == 'QQ1x' && !HaveFP16Ext()) then UNDEFINED; 

if immh<3>:Q == '10' then UNDEFINED; 

integer esize = if immh == '1xxx' then 64 else if immh == 'Q1xx' then 32 else 16; 
integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 
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integer fracbits = (esize » 2) - UInt(immh:immb); 
boolean unsigned = (U == '1'); 
FPRounding rounding = FPRounding_ZERO; 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<fbits> 


Is a width specifier, encoded in the "immh" field. It can have the following values: 
H when immh = 001x 


S when immh = 01xx 


D when immh = 1xxx 


The encoding immh = 000x is reserved. 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Immh:Q" field. It can have the following values: 


4H when immh = 001x, Q = 0 


8H when immh = Q01x,Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 
2D when immh = 1xxx,Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The following encodings are reserved: 

° immh = 0001, Q = x. 

. immh = 1xxx, Q = 0. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the scalar variant: is the number of fractional bits, in the range 1 to the operand width, encoded 
in the "immh:immb" field. It can have the following values: 

(32-Uint(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = 01xx 

(128-UInt(immh:immb)) when immh = 1xxx 

The encoding immh = 000x is reserved. 


For the vector variant: is the number of fractional bits, in the range | to the element width, encoded 
in the "immh:immb" field. It can have the following values: 


(32-Uint(immh:immb)) when immh = 001x 


(64-UInt(immh:immb)) when immh = 01xx 
(128-UInt(immh:immb)) when immh = 1xxx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 0001 is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
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element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, fracbits, unsigned, FPCR, rounding); 


V[d] = result; 
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C7.2.83 FCVTZS (vector, integer) 


Floating-point Convert to Signed integer, rounding toward Zero (vector). This instruction converts a scalar or each 
element in a vector from a floating-point value to a signed integer value using the Round towards Zero rounding 
mode, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


foil rr ole tt root te apps of ee TR 


Scalar half precision variant 


FCVTZS <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = esize; 

integer elements = 1; 

FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0| 


oaoa i ofie o oo oj o o] Rn | Ra 
U 02 01 


Scalar single-precision and double-precision variant 


FCVTZS <V><d>, <V><n> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd); 
UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 
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C7-1564 


Vector half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fojafofo +17 Oftf1 7711001107110] Rn | Ra | 
U 02 01 


Vector half precision variant 


FCVTZS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 1312/1110 9. | 5 4| 0| 


fofafofo +171 Oftfet ooo 01107110] Rn | Ra 
U 02 01 


Vector single-precision and double-precision variant 


FCVTZS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.84 FCVTZS (scalar, fixed-point) 


C7-1566 


Floating-point Convert to Signed fixed-point, rounding toward Zero (scalar). This instruction converts the 
floating-point value in the SIMD&FP source register to a 32-bit or 64-bit fixed-point signed integer using the Round 


towards Zero rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


|31 30 29 28/27 26 25 24/23 22 2120/1918  16|15 | 109 


FG CT = GR 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTZS <Wd>, <Hn>, #<fbits> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTZS <Xd>, <Hn>, #<fbits> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTZS <Wd>, <Sn>, #<fbits> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTZS <Xd>, <Sn>, #<fbits> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTZS <Wd>, <Dn>, #<fbits> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTZS <Xd>, <Dn>, #<fbits> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 


case ftype of 
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when '00' fltsize = 32; 
when 'Q1' fltsize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


if sf == '@' && scale<5> == '@' then UNDEFINED; 
integer fracbits = 64 - UInt(scale); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<fbits> For the double-precision to 32-bit, half-precision to 32-bit and single-precision to 32-bit variant: is 


the number of bits after the binary point in the fixed-point destination, in the range 1 to 32, encoded 
as 64 minus "scale". 


For the double-precision to 64-bit, half-precision to 64-bit and single-precision to 64-bit variant: is 
the number of bits after the binary point in the fixed-point destination, in the range 1 to 64, encoded 
as 64 minus "scale". 


Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, fracbits, FALSE, FPCR, FPRounding_ZERO) ; 
X[d] = intval; 
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C7.2.85 FCVTZS (scalar, integer) 


C7-1568 


Floating-point Convert to Signed integer, rounding toward Zero (scalar). This instruction converts the floating-point 
value in the SIMD&FP source register to a 32-bit or 64-bit signed integer using the Round towards Zero rounding 


mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28/27 26 25 24|23 22 2120/1918  16/15141312/11109 | 


aloo ttt Olli aoe ooo oo oo] a l 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTZS <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTZS <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTZS <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTZS <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTZS <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTZS <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPDecodeRounding(rmode) ; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, FALSE, FPCR, rounding); 
X[d] = intval; 
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C7.2.86 


C7-1570 


FCVTZU (vector, fixed-point) 


Floating-point Convert to Unsigned fixed-point, rounding toward Zero (vector). This instruction converts a scalar 
or each element in a vector from floating-point to fixed-point unsigned integer using the Round towards Zero 
rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 1918 16|15141312/11109 | 5 4| 0 | 


COOK K K E Tine [FF K Re TR 


immh 


Scalar variant 


FCVTZU <V><d>, <V><n>, #<fbits> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd); 
UInt(Rn); 


if immh == '000x' || (immh == '001x' && !HaveFP16Ext()) then UNDEFINED; 

integer esize = if immh == '1xxx' then 64 else if immh == 'Q1xx' then 32 else 16; 
integer datasize = esize; 

integer elements = 1; 


integer fracbits = (esize » 2) - UInt(immh:immb); 


boolean unsigned = (U == '1'); 
FPRounding rounding = FPRounding_ZERO; 


Vector 


|31 30 29 28|27 26 25 24|23 22 1918  16|15141312/11109 | 5 4| 0 | 


foJafifo +4 4 + of 0000 [immb K ia] ee Re 


immh 


Vector variant 


FCVTZU <Vd>.<T>, <Vn>.<T>, #<fbits> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 

if immh == '000x' || (immh == 'QQ1x' && !HaveFP16Ext()) then UNDEFINED; 

if immh<3>:Q == '10' then UNDEFINED; 

integer esize = if immh == '1xxx' then 64 else if immh == 'Q1xx' then 32 else 16; 
integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 
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integer fracbits = (esize » 2) - UInt(immh:immb); 
boolean unsigned = (U == '1'); 
FPRounding rounding = FPRounding_ZERO; 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<fbits> 


Is a width specifier, encoded in the "immh" field. It can have the following values: 
H when immh = 001x 


S when immh = 01xx 


D when immh = 1xxx 


The encoding immh = 000x is reserved. 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Immh:Q" field. It can have the following values: 


4H when immh = 001x, Q = 0 


8H when immh = Q01x,Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 
2D when immh = 1xxx,Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The following encodings are reserved: 

° immh = 0001, Q = x. 

. immh = 1xxx, Q = 0. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the scalar variant: is the number of fractional bits, in the range 1 to the operand width, encoded 
in the "immh:immb" field. It can have the following values: 

(32-Uint(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = 01xx 

(128-UInt(immh:immb)) when immh = 1xxx 

The encoding immh = 000x is reserved. 


For the vector variant: is the number of fractional bits, in the range | to the element width, encoded 
in the "immh:immb" field. It can have the following values: 


(32-Uint(immh:immb)) when immh = 001x 


(64-UInt(immh:immb)) when immh = 01xx 
(128-UInt(immh:immb)) when immh = 1xxx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 0001 is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
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element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, fracbits, unsigned, FPCR, rounding); 


V[d] = result; 
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C7.2.87 FCVTZU (vector, integer) 


Floating-point Convert to Unsigned integer, rounding toward Zero (vector). This instruction converts a scalar or 
each element in a vector from a floating-point value to an unsigned integer value using the Round towards Zero 
rounding mode, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


COOK E rrr K tro oft te pips of ee TR 


Scalar half precision variant 


FCVTZU <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = esize; 

integer elements = 1; 

FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0| 


fo yt +171 oeno ooh aono] Rn | Ra 
U 02 01 


Scalar single-precision and double-precision variant 


FCVTZU <V><d>, <V><n> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd); 
UInt(Rn); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 
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C7-1574 


Vector half precision 


ARMv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fojaftfo +17 oft 7711001107110] Rn | Ra 
U 02 01 


Vector half precision variant 


FCVTZU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


OOOMEENOCHAERN E Rn | Ra 
U 02 01 


Vector single-precision and double-precision variant 


FCVTZU <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


FPRounding rounding = FPDecodeRounding(01:02); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
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Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 


V[d] 


element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPToFixed(element, @, unsigned, FPCR, rounding); 
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C7.2.88 FCVTZU (scalar, fixed-point) 


C7-1576 


Floating-point Convert to Unsigned fixed-point, rounding toward Zero (scalar). This instruction converts the 
floating-point value in the SIMD&FP source register to a 32-bit or 64-bit fixed-point unsigned integer using the 
Round towards Zero rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


|31 30 29 28/27 26 25 24/23 22 2120/1918  16|15 | 109 


FG TT GR 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTZU <Wd>, <Hn>, #<fbits> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11. 


FCVTZU <Xd>, <Hn>, #<fbits> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTZU <Wd>, <Sn>, #<fbits> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTZU <Xd>, <Sn>, #<fbits> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTZU <Wd>, <Dn>, #<fbits> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTZU <Xd>, <Dn>, #<fbits> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 


case ftype of 
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when '00' fltsize = 32; 
when 'Q1' fltsize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


if sf == '@' && scale<5> == '@' then UNDEFINED; 
integer fracbits = 64 - UInt(scale); 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<fbits> For the double-precision to 32-bit, half-precision to 32-bit and single-precision to 32-bit variant: is 


the number of bits after the binary point in the fixed-point destination, in the range 1 to 32, encoded 
as 64 minus "scale". 


For the double-precision to 64-bit, half-precision to 64-bit and single-precision to 64-bit variant: is 
the number of bits after the binary point in the fixed-point destination, in the range 1 to 64, encoded 
as 64 minus "scale". 


Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, fracbits, TRUE, FPCR, FPRounding_ZERO) ; 
X[d] = intval; 
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C7.2.89 FCVTZU (scalar, integer) 


C7-1578 


Floating-point Convert to Unsigned integer, rounding toward Zero (scalar). This instruction converts the 
floating-point value in the SIMD&FP source register to a 32-bit or 64-bit unsigned integer using the Round towards 


Zero rounding mode, and writes the result to the general-purpose destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 2120/1918  16/15141312/11109 | 


Fs ee A E E T 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11. 


FCVTZU <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 & ftype == 11. 


FCVTZU <Xd>, <Hn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00. 


FCVTZU <Wd>, <Sn> 


Single-precision to 64-bit variant 
Applies when sf == 1 && ftype == 00. 


FCVTZU <Xd>, <Sn> 


Double-precision to 32-bit variant 
Applies when sf == 0 && ftype == 01. 


FCVTZU <Wd>, <Dn> 


Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01. 


FCVTZU <Xd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPDecodeRounding(rmode) ; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


fltval = V[n]; 
intval = FPToFixed(fltval, @, TRUE, FPCR, rounding); 
X[d] = intval; 
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C7.2.90 


C7-1580 


FDIV (vector) 


Floating-point Divide (vector). This instruction divides the floating-point values in the elements in the first source 
SIMD&FP register, by the floating-point values in the corresponding elements in the second source SIMD&FP 


register, places the results in a vector, and writes the vector to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


ofajijo 14 1 1 ojoj of Rm fo ofi 1 aft] R | Ra | 


Half-precision variant 


FDIV <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 121110 9 | 5 4| 0| 


[olalijo 1 1 1 ofojszfi] Rm fi111 1il R | Ra | 


Single-precision and double-precision variant 


FDIV <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
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<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2s when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 


for e = 0 to elements-1 
elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
Elem[result, e, esize] = FPDiv(element1, element2, FPCR); 


V[d] = result; 
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C7.2.91 


C7-1582 


FDIV (scalar) 


Floating-point Divide (scalar). This instruction divides the floating-point value of the first source SIMD&FP 
register by the floating-point value of the second source SIMD&FP register, and writes the result to the destination 
SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0| 


fofojoj1 1 1 1 offype{t] Rm fooo0o1jio]| Rn | Ra | 


Half-precision variant 


Applies when ftype == 11. 


FDIV <Hd>, <Hn>, <Hm> 


Single-precision variant 


Applies when ftype == 00. 


FDIV <Sd>, <Sn>, <Sm> 


Double-precision variant 


Applies when ftype == 01. 


FDIV 


<Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


integer d 
integer n 


UInt(Rd); 
UInt(Rn); 


integer m = UInt(Rm); 


integer datasize; 
case ftype of 


when '00' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> 


<Dn> 


<Dm> 


<Hd> 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
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<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = 


I 
<= 
= 


result = FPDiv(operand1, operand2, FPCR); 


V[d] = result; 
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C7.2.92 FJCVTZS 


Floating-point Javascript Convert to Signed fixed-point, rounding toward Zero. This instruction converts the 
double-precision floating-point value in the SIMD&FP source register to a 32-bit signed integer using the Round 
towards Zero rounding mode, and writes the result to the general-purpose destination register. If the result is too 
large to be accommodated as a signed 32-bit integer, then the result is the integer modulo 232, as held in a 32-bit 
signed integer. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


ARMVv8.3 


[31 30 29 28/27 26 25 24|23 22 2120/1918  16/15141312/11109 | 5 4| 0 | 


olojo 177 olo 47/1 4171 0fo00000] kn | Rd 


sf ftype | rmode opcode 


Double-precision to 32-bit variant 


FJCVTZS <Wd>, <Dn> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if !HaveFJCVTZSExt() then UNDEFINED; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) fltval; 
bits(32) intval; 


bit Z; 

fltval = V[n]; 

(intval, Z) = FPToFixedJS(fltval, FPCR, TRUE); 
PSTATE.<N,Z,C,V> = '0':Z:'Q0'; 

X[d] = intval; 
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C7.2.93 FMADD 


ARM DDI 0487E.a 
ID070919 


Floating-point fused Multiply-Add (scalar). This instruction multiplies the values of the first two SIMD&FP source 
registers, adds the product to the value of the third SIMD&FP source register, and writes the result to the SIMD&FP 


destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16/15 14 | 109 5 4| 0 | 


CTC CAKA Ra Yo] Re |r 


Half-precision variant 
Applies when ftype == 11. 


FMADD <Hd>, <Hn>, <Hm>, <Ha> 


Single-precision variant 
Applies when ftype == 00. 


FMADD <Sd>, <Sn>, <Sm>, <Sa> 


Double-precision variant 
Applies when ftype == 01. 


FMADD <Dd>, <Dn>, <Dm>, <Da> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer a = UInt(Ra); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 
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C7-1586 


<Dm> 


<Da> 


<Hd> 


<Hn> 


<Hm> 


<Ha> 


<Sd> 


<Sn> 


<Sm> 


<Sa> 


Operation 


Is the 64-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 


Is the 64-bit name of the third SIMD&FP source register holding the addend, encoded in the "Ra" 
field. 


Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the 16-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 


Is the 16-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 


Is the 16-bit name of the third SIMD&FP source register holding the addend, encoded in the "Ra" 
field. 


Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the 32-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 


Is the 32-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 


Is the 32-bit name of the third SIMD&FP source register holding the addend, encoded in the "Ra" 
field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 
bits(datasize) operanda = V[a]; 


bits(datasize) operandl = 
bits(datasize) operand2 = V[m]; 


I 
<= 
= 


result = FPMulAdd(operanda, operand1, operand2, FPCR); 


V[d] 
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C7.2.94 FMAX (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Maximum (vector). This instruction compares corresponding vector elements in the two source 
SIMD&FP registers, places the larger of each of the two floating-point values into a vector, and writes the vector to 
the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 


in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 121110 9 | 


eo rroo o em oo Ra J 


Half-precision variant 


FMAX <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer 
integer 
integer 
integer 
integer 
integer 


boolean 
boolean 


d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rm); 

esize = 16; 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


pair = (U == '1'); 
minimum = (ol == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12/11 10 9 


oloo 74 4 olo] Rm [17417 0])1] Rn | Rd | 
U o1 


Single-precision and double-precision variant 


FMAX <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 


if sz:Q == '10' then UNDEFINED; 


integer 
integer 
integer 


boolean 
boolean 


esize = 32 << UInt(sz); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


pair = (U = '1'); 
minimum = (ol == '1'); 
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Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 
element1 = Elem[concat, 2se, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 
else 
element1 = Elem[operandl, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if minimum then 

Elem[result, e, esize] = FPMin(element1, element2, FPCR); 
else 

Elem[result, e, esize] = FPMax(element1, element2, FPCR); 


V[d] = result; 
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C7.2.95 FMAX (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Maximum (scalar). This instruction compares the two source SIMD&FP registers, and writes the 
larger of the two floating-point values to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fofofo]1 11 1 offype}t{ Rm [o tfo oja of Rn | Ra | 
op 


Half-precision variant 
Applies when ftype == 11. 


FMAX <Hd>, <Hn>, <Hm> 


Single-precision variant 
Applies when ftype == 00. 


FMAX <Sd>, <Sn>, <Sm> 


Double-precision variant 
Applies when ftype == 01. 


FMAX <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when '00' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
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<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


result = FPMax(operand1, operand2, FPCR); 
V[d] = result; 


C7-1590 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.96 FMAXNM (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Maximum Number (vector). This instruction compares corresponding vector elements in the two 
source SIMD&FP registers, writes the larger of the two floating-point values into a vector, and writes the vector to 


the destination SIMD&FP register. 


NaNs are handled according to the IEEE 754-2008 standard. If one vector element is numeric and the other is a quiet 
NaN, the result placed in the vector is the numerical value, otherwise the result is identical to FMAX (scalar). 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 


in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9 | 5 4| 0| 


fofajojo 1 1 1 ojoj of Rm fo ofoo oji] R | Ra | 
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Half-precision variant 


FMAXNM <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U == '1'); 
boolean minimum = (a == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9. | 5 4| 0| 


COPEZA ONARE 


Single-precision and double-precision variant 


FMAXNM <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
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boolean pair = (U == '1'); 
boolean minimum = (01 == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 
element1 = Elem[concat, 2e, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 
else 
element1 = Elem[operandl, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if minimum then 

Elem[result, e, esize] = FPMinNum(element1, element2, FPCR); 
else 

Elem[result, e, esize] = FPMaxNum(element1, element2, FPCR); 


V[d] = result; 
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C7.2.97 FMAXNM (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Maximum Number (scalar). This instruction compares the first and second source SIMD&FP 
register values, and writes the larger of the two floating-point values to the destination SIMD&FP register. 


NaNs are handled according to the IEEE 754-2008 standard. If one vector element is numeric and the other is a quiet 
NaN, the result that is placed in the vector is the numerical value, otherwise the result is identical to FMAX (scalar). 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16/15 14 13 1211110 9 | 5 4| 0 | 


elek Aye tee a Jes fe 


Half-precision variant 
Applies when ftype == 11. 


FMAXNM <Hd>, <Hn>, <Hm> 


Single-precision variant 
Applies when ftype == 00. 


FMAXNM <Sd>, <Sn>, <Sm> 


Double-precision variant 
Applies when ftype == 01. 


FMAXNM <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when '00' datasize = 32; 
when '01' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
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<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) result; 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 


result = FPMaxNum(operand1, operand2, FPCR); 
V[d] = result; 
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C7.2.98 FMAXNMP (scalar) 


Floating-point Maximum Number of Pair of elements (scalar). This instruction compares two vector elements in the 
source SIMD&FP register and writes the largest of the floating-point values as a scalar to the destination SIMD&FP 
register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR ora synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Half-precision variant 


FMAXNMP <V><d>, <Vn>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = 32; 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


slijt 11 4 okolji oo ojos 40 of of Rn | ri | 


Single-precision and double-precision variant 


FMAXNMP <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 32; 


integer datasize = 64; 


Assembler symbols 

<V> For the half-precision variant: is the destination width specifier, encoded in the "sz" field. It can have 
the following values: 
H when sz = 0 


The encoding sz = 1 is reserved. 
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C7-1596 


<d> 


<Vn> 


<T> 


For the single-precision and double-precision variant: is the destination width specifier, encoded in 
the "sz" field. It can have the following values: 


S when sz = 0 

D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is the source arrangement specifier, encoded in the "sz" field. It can 
have the following values: 

2H when sz = 0 

The encoding sz = 1 is reserved. 


For the single-precision and double-precision variant: is the source arrangement specifier, encoded 
in the "sz" field. It can have the following values: 


2S when sz = 0 


2D when sz = 1 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(ReduceOp_FMAXNUM, operand, esize); 
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C7.2.99 FMAXNMP (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Maximum Number Pairwise (vector). This instruction creates a vector by concatenating the vector 
elements of the first source SIMD&FP register after the vector elements of the second source SIMD&FP register, 
reads each pair of adjacent vector elements in the two source SIMD&FP registers, writes the largest of each pair of 
values into a vector, and writes the vector to the destination SIMD&FP register. All the values in this instruction are 
floating-point values. 


NaNs are handled according to the IEEE 754-2008 standard. If one vector element is numeric and the other is a quiet 
NaN, the result is the numerical value, otherwise the result is identical to FMAX (scalar). 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR ora synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0| 


COMMER Rm Jo ofo o ofi| Rn | Re 


Half-precision variant 


FMAXNMP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U == '1'); 
boolean minimum = (a == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0| 
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Single-precision and double-precision variant 


FMAXNMP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if sz:Q == '10' then UNDEFINED; 
integer esize = 32 << UInt(sz); 
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integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U == '1'); 
boolean minimum = (01 == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 
elementl = Elem[concat, 2e, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 
else 
element1 = Elem[operandl, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if minimum then 
Elem[result, e, esize] = FPMinNum(element1, element2, FPCR); 
else 
Elem[result, e, esize] 


FPMaxNum(element1, element2, FPCR); 


V[d] = result; 
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C7.2.100 FMAXNMV 


ARM DDI 0487E.a 
ID070919 


Floating-point Maximum Number across Vector. This instruction compares all the vector elements in the source 
SIMD&FP register, and writes the largest of the values as a scalar to the destination SIMD&FP register. All the 
values in this instruction are floating-point values. 


NaNs are handled according to the IEEE 754-2008 standard. If one vector element is numeric and the other is a quiet 
NaN, the result of the comparison is the numerical value, otherwise the result is identical to FMAX (scalar). 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Half-precision variant 


FMAXNMV <V><d>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 


Single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| o| 


oleo ooe 700 ojona ooo) An | Rd | 
01 


Single-precision and double-precision variant 


FMAXNMV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q != '01' then UNDEFINED; // .4S only 


integer esize = 32 << UInt(sz); 
integer datasize = if Q == '1' then 128 else 64; 
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Assembler symbols 


<V> For the half-precision variant: is the destination width specifier, H. 


For the single-precision and double-precision variant: is the destination width specifier, encoded in 
the "sz" field. It can have the following values: 


S when sz = 0 


The encoding sz = 1 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"Q:sz" field. It can have the following values: 


4S when Q = 1, sz = 0 

The following encodings are reserved: 
. Q = 0, sz 
s Q = 1, sz 


X. 


al, 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(ReduceOp_FMAXNUM, operand, esize); 
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C7.2.101 FMAXP (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Maximum of Pair of elements (scalar). This instruction compares two vector elements in the source 
SIMD&FP register and writes the largest of the floating-point values as a scalar to the destination SIMD&FP 
register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fo afolt +77 oojo too ojo rria) Rn | Rd 


01 sz 


Half-precision variant 


FMAXP <V><d>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = 32; 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Single-precision and double-precision variant 


FMAXP <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 32; 
integer datasize = 64; 


Assembler symbols 

<V> For the half-precision variant: is the destination width specifier, encoded in the "sz" field. It can have 
the following values: 
H when sz = 0 


The encoding sz = 1 is reserved. 
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C7-1602 


<d> 


<Vn> 


<T> 


For the single-precision and double-precision variant: is the destination width specifier, encoded in 
the "sz" field. It can have the following values: 


S when sz = 0 

D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is the source arrangement specifier, encoded in the "sz" field. It can 
have the following values: 

2H when sz = 0 

The encoding sz = 1 is reserved. 


For the single-precision and double-precision variant: is the source arrangement specifier, encoded 
in the "sz" field. It can have the following values: 


2S when sz = 0 


2D when sz = 1 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(Reduce0p_FMAX, operand, esize); 
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C7.2.102 FMAXP (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Maximum Pairwise (vector). This instruction creates a vector by concatenating the vector elements 
of the first source SIMD&FP register after the vector elements of the second source SIMD&FP register, reads each 
pair of adjacent vector elements from the concatenated vector, writes the larger of each pair of values into a vector, 
and writes the vector to the destination SIMD&FP register. All the values in this instruction are floating-point 


values. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 


in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 
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Half-precision variant 


FMAXP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U = '1'); 
boolean minimum = (01 == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9. | 5 4| 0| 
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Single-precision and double-precision variant 


FMAXP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
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boolean pair = (U == '1'); 
boolean minimum = (01 == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 
element1 = Elem[concat, 2e, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 
else 
elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if minimum then 

Elem[result, e, esize] = FPMin(element1, element2, FPCR); 
else 

Elem[result, e, esize] = FPMax(element1, element2, FPCR); 


V[d] = result; 
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C7.2.103 FMAXV 


Floating-point Maximum across Vector. This instruction compares all the vector elements in the source SIMD&FP 
register, and writes the largest of the values as a scalar to the destination SIMD&FP register. All the values in this 
instruction are floating-point values. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 
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Half-precision variant 


FMAXV <V><d>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Single-precision and double-precision variant 
FMAXV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q != '@1' then UNDEFINED; 


integer esize = 32 << UInt(sz); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<V> For the half-precision variant: is the destination width specifier, H. 
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C7-1606 


<d> 


<Vn> 


<T> 


For the single-precision and double-precision variant: is the destination width specifier, encoded in 
the "sz" field. It can have the following values: 


S when sz = 0 

The encoding sz = 1 is reserved. 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"Q:sz" field. It can have the following values: 


4s when Q = 1, sz = 0 
The following encodings are reserved: 
3 Q = 0, sz =x. 


e Q = 1, sz = 1. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(Reduce0p_FMAX, operand, esize); 
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C7.2.104 FMIN (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point minimum (vector). This instruction compares corresponding elements in the vectors in the two 
source SIMD&FP registers, places the smaller of each of the two floating-point values into a vector, and writes the 
vector to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 


in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 
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Half-precision variant 


FMIN <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer 
integer 
integer 
integer 
integer 
integer 


boolean 
boolean 


d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rm); 

esize = 16; 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


pair = (U == '1'); 
minimum = (ol == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12/11 10 9 
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Single-precision and double-precision variant 


FMIN <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 


if sz:Q == '10' then UNDEFINED; 


integer 
integer 
integer 


boolean 
boolean 


esize = 32 << UInt(sz); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


pair = (U = '1'); 
minimum = (ol == '1'); 
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Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 
element1 = Elem[concat, 2se, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 
else 
element1 = Elem[operandl, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if minimum then 

Elem[result, e, esize] = FPMin(element1, element2, FPCR); 
else 

Elem[result, e, esize] = FPMax(element1, element2, FPCR); 


V[d] = result; 
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C7.2.105 FMIN (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Minimum (scalar). This instruction compares the first and second source SIMD&FP register values, 
and writes the smaller of the two floating-point values to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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Half-precision variant 
Applies when ftype == 11. 


FMIN <Hd>, <Hn>, <Hm> 


Single-precision variant 
Applies when ftype == 00. 


FMIN <Sd>, <Sn>, <Sm> 


Double-precision variant 
Applies when ftype == 01. 


FMIN <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1609 


Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


result = FPMin(operand1, operand2, FPCR); 
V[d] = result; 
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C7.2.106 FMINNM (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Minimum Number (vector). This instruction compares corresponding vector elements in the two 
source SIMD&FP registers, writes the smaller of the two floating-point values into a vector, and writes the vector 
to the destination SIMD&FP register. 


NaNs are handled according to the IEEE 754-2008 standard. If one vector element is numeric and the other is a quiet 
NaN, the result placed in the vector is the numerical value, otherwise the result is identical to FMIN (scalar). 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 
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Half-precision variant 


FMINNM <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U == '1'); 
boolean minimum = (a == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9. | 5 4| 0| 
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Single-precision and double-precision variant 


FMINNM <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
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boolean pair = (U == '1'); 
boolean minimum = (01 == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 
element1 = Elem[concat, 2e, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 
else 
element1 = Elem[operandl, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if minimum then 

Elem[result, e, esize] = FPMinNum(element1, element2, FPCR); 
else 

Elem[result, e, esize] = FPMaxNum(element1, element2, FPCR); 


V[d] = result; 
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C7.2.107  FMINNM (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Minimum Number (scalar). This instruction compares the first and second source SIMD&FP register 
values, and writes the smaller of the two floating-point values to the destination SIMD&FP register. 


NaNs are handled according to the IEEE 754-2008 standard. If one vector element is numeric and the other is a quiet 
NaN, the result that is placed in the vector is the numerical value, otherwise the result is identical to FMIN (scalar). 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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Half-precision variant 
Applies when ftype == 11. 


FMINNM <Hd>, <Hn>, <Hm> 


Single-precision variant 
Applies when ftype == 00. 


FMINNM <Sd>, <Sn>, <Sm> 


Double-precision variant 
Applies when ftype == 01. 


FMINNM <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when '00' datasize = 32; 
when '01' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
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<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) result; 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 


result = FPMinNum(operand1, operand2, FPCR); 


V[d] = result; 
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C7.2.108 | FMINNMP (scalar) 


Floating-point Minimum Number of Pair of elements (scalar). This instruction compares two vector elements in the 
source SIMD&FP register and writes the smallest of the floating-point values as a scalar to the destination 
SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 
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Half-precision variant 


FMINNMP <V><d>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = 32; 


Single-precision and double-precision 
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Single-precision and double-precision variant 


FMINNMP <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 32; 
integer datasize = 64; 


Assembler symbols 

<V> For the half-precision variant: is the destination width specifier, encoded in the "sz" field. It can have 
the following values: 
H when sz = 0 


The encoding sz = 1 is reserved. 
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C7-1616 


<d> 


<Vn> 


<T> 


For the single-precision and double-precision variant: is the destination width specifier, encoded in 
the "sz" field. It can have the following values: 


S when sz = 0 

D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is the source arrangement specifier, encoded in the "sz" field. It can 
have the following values: 

2H when sz = 0 

The encoding sz = 1 is reserved. 


For the single-precision and double-precision variant: is the source arrangement specifier, encoded 
in the "sz" field. It can have the following values: 


2S when sz = 0 


2D when sz = 1 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(ReduceOp_FMINNUM, operand, esize); 
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C7.2.109 FMINNMP (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Minimum Number Pairwise (vector). This instruction creates a vector by concatenating the vector 

elements of the first source SIMD&FP register after the vector elements of the second source SIMD&FP register, 
reads each pair of adjacent vector elements in the two source SIMD&FP registers, writes the smallest of each pair 
of floating-point values into a vector, and writes the vector to the destination SIMD&FP register. All the values in 
this instruction are floating-point values. 


NaNs are handled according to the IEEE 754-2008 standard. If one vector element is numeric and the other is a quiet 
NaN, the result is the numerical value, otherwise the result is identical to FMIN (scalar). 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 
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Half-precision variant 


FMINNMP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U == '1'); 
boolean minimum = (a == '1'); 


Single-precision and double-precision 
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Single-precision and double-precision variant 


FMINNMP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if sz:Q == '10' then UNDEFINED; 
integer esize = 32 << UInt(sz); 
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integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U == '1'); 
boolean minimum = (01 == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 
elementl = Elem[concat, 2e, esize]; 
element2 = Elem[concat, (2se)+1, esize]; 
else 
elementl = Elem[operandl, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if minimum then 
Elem[result, e, esize] = FPMinNum(element1, element2, FPCR); 
else 
Elem[result, e, esize] 


FPMaxNum(element1, element2, FPCR); 


V[d] = result; 
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C7.2.110 FMINNMV 


ARM DDI 0487E.a 
ID070919 


Floating-point Minimum Number across Vector. This instruction compares all the vector elements in the source 
SIMD&FP register, and writes the smallest of the values as a scalar to the destination SIMD&FP register. All the 
values in this instruction are floating-point values. 


NaNs are handled according to the IEEE 754-2008 standard. If one vector element is numeric and the other is a quiet 
NaN, the result of the comparison is the numerical value, otherwise the result is identical to FMIN (scalar). 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofafofo 7474 O[tfoj7 70000770010] An | Rd | 
o1 


Half-precision variant 


FMINNMV <V><d>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 


Single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| o| 


fofafrfo 774 4 o[t[e[i 700 0j0770010] An | Rd | 
01 


Single-precision and double-precision variant 


FMINNMV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q != '01' then UNDEFINED; // .4S only 


integer esize = 32 << UInt(sz); 
integer datasize = if Q == '1' then 128 else 64; 
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Assembler symbols 


<V> For the half-precision variant: is the destination width specifier, H. 


For the single-precision and double-precision variant: is the destination width specifier, encoded in 
the "sz" field. It can have the following values: 


S when sz = 0 


The encoding sz = 1 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"Q:sz" field. It can have the following values: 


4S when Q = 1, sz = 0 

The following encodings are reserved: 
. Q = 0, sz 
s Q = 1, sz 


X. 


al, 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(ReduceOp_FMINNUM, operand, esize); 
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C7.2.111 FMINP (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Minimum of Pair of elements (scalar). This instruction compares two vector elements in the source 
SIMD&FP register and writes the smallest of the floating-point values as a scalar to the destination SIMD&FP 
register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fo tfolt +77 oto; oo ojo rrio) mn | Rd 


01 sz 


Half-precision variant 


FMINP <V><d>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = 32; 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


e slijters olde oo ojo ra 1 afi of Rn | Rd 


Single-precision and double-precision variant 


FMINP <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 32; 


integer datasize = 64; 


Assembler symbols 

<V> For the half-precision variant: is the destination width specifier, encoded in the "sz" field. It can have 
the following values: 
H when sz = 0 


The encoding sz = 1 is reserved. 
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C7-1622 


<d> 


<Vn> 


<T> 


For the single-precision and double-precision variant: is the destination width specifier, encoded in 
the "sz" field. It can have the following values: 


S when sz = 0 

D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is the source arrangement specifier, encoded in the "sz" field. It can 
have the following values: 

2H when sz = 0 

The encoding sz = 1 is reserved. 


For the single-precision and double-precision variant: is the source arrangement specifier, encoded 
in the "sz" field. It can have the following values: 


2S when sz = 0 


2D when sz = 1 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(ReduceOp_FMIN, operand, esize); 
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C7.2.112  FMINP (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Minimum Pairwise (vector). This instruction creates a vector by concatenating the vector elements 
of the first source SIMD&FP register after the vector elements of the second source SIMD&FP register, reads each 
pair of adjacent vector elements from the concatenated vector, writes the smaller of each pair of values into a vector, 
and writes the vector to the destination SIMD&FP register. All the values in this instruction are floating-point 


values. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 


in either a flag being set in FPSR ora synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


fojatijo 14 1 1 ofif of Rm fo oj171 ofli] Rn | Ra | 
U 01 


Half-precision variant 


FMINP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean pair = (U = '1'); 
boolean minimum = (01 == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9. | 5 4| 0| 


OCONEE COME A 
U 01 


Single-precision and double-precision variant 


FMINP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
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boolean pair = (U == '1'); 
boolean minimum = (01 == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

bits(2sdatasize) concat = operand2:operand1; 
bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
if pair then 
element1 = Elem[concat, 2e, esize]; 
element2 = Elem[concat, (2#e)+1, esize]; 
else 
elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if minimum then 

Elem[result, e, esize] = FPMin(element1, element2, FPCR); 
else 

Elem[result, e, esize] = FPMax(element1, element2, FPCR); 


V[d] = result; 
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C7.2.113 FMINV 


Floating-point Minimum across Vector. This instruction compares all the vector elements in the source SIMD&FP 
register, and writes the smallest of the values as a scalar to the destination SIMD&FP register. All the values in this 
instruction are floating-point values. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


Ofajojo 7 i FV ojrfofi soo ojo rt ifs of Re | Rd 


Half-precision variant 


FMINV <V><d>, <Vn>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 


integer datasize = if Q == '1' then 128 else 64; 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 


eno roe +o ooo 14s a 


Single-precision and double-precision variant 
FMINV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q != '@1' then UNDEFINED; 


integer esize = 32 << UInt(sz); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<V> For the half-precision variant: is the destination width specifier, H. 
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C7-1626 


<d> 


<Vn> 


<T> 


For the single-precision and double-precision variant: is the destination width specifier, encoded in 
the "sz" field. It can have the following values: 


S when sz = 0 

The encoding sz = 1 is reserved. 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"Q:sz" field. It can have the following values: 


4s when Q = 1, sz = 0 
The following encodings are reserved: 
3 Q = 0, sz =x. 


e Q = 1, sz = 1. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
V[d] = Reduce(ReduceOp_FMIN, operand, esize); 
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C7.2.114 FMLA (by element) 


ARM DDI 0487E.a 
ID070919 


Floating-point fused Multiply-Add to accumulator (by element). This instruction multiplies the vector elements in 
the first source SIMD&FP register by the specified value in the second source SIMD&FP register, and accumulates 
the results in the vector elements of the destination SIMD&FP register. All the values in this instruction are 


floating-point values. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 


in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar, half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 5 4| 0 | 


oao 7744 10 ojm Am olojo t[H]o] An | Rd | 
02 


Scalar, half-precision variant 


FMLA <Hd>, <Hn>, <Vm>.H[<index>] 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer index = UInt(H:L:M); 


integer esize = 16; 

integer datasize = esize; 
integer elements = 1; 
boolean sub_op = (02 == '1'); 


Scalar, single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20|19 1615 14 13 12|11 10 9. | 5 4| o| 


[o ijoja 1 1 1 1fifs[tjM]| Rm [ojojo 1jhjo] Rn | Ra | 
02 


Scalar, single-precision and double-precision variant 


FMLA <V><d>, <V><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 
bit Rmhi = M; 
case sz:L of 
when '@x' index = UInt(H:L); 
when '10' index = UInt(H); 
when '11' UNDEFINED; 
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C7-1628 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

boolean sub_op = (02 == '1'); 


Vector, half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15141312\1110 9. | 


oleole r rilo offal e opo e mJ 


Vector, half-precision variant 

FMLA <Vd>.<T>, <Vn>.<T>, <Vm>.H[<index>] 
Decode for this encoding 

if !HaveFP16Ext() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer index = UInt(H:L:M); 
integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 


integer elements = datasize DIV esize; 
boolean sub_op = (02 == '1'); 


Vector, single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 14 13 1211110 9 | 


o| 


[ofajojo 1 1 1 1ļ1fs[tjM| Rm [ofofo 1jhjo] Rn | Ra | 
02 


Vector, single-precision and double-precision variant 


FMLA <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 
bit Rmhi = M; 
case sz:L of 
when '@x' index = UInt(H:L); 
when '10' index = UInt(H); 
when '11' UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


if sz:Q == '10' then UNDEFINED; 
integer esize = 32 << UInt(sz); 
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integer datasize = if Q == '1' then 128 else 64; 


integer elements 


datasize DIV esize; 


boolean sub_op = (02 == '1'); 


Assembler symbols 


<Hd> 


<Hn> 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<Vm> 


<Ts> 


<index> 


Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 


D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector, half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H whenQ = 1 


For the vector, single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "Q:sz" field. It can have the following values: 


2S when Q = 0, sz = 0 
4S when Q = 1, sz = 0 
2D when Q = 1,sz = 1 


The encoding Q = 0, sz = 1 is reserved. 

Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is the name of the second SIMD&FP source register, in the range VO 
to V15, encoded in the "Rm" field. 

For the single-precision and double-precision variant: is the name of the second SIMD&FP source 
register, encoded in the "M:Rm" fields. 

Is an element size specifier, encoded in the "sz" field. It can have the following values: 

S when sz = 0 

D when sz = 1 

For the half-precision variant: is the element index, in the range 0 to 7, encoded in the "H:L:M" 
fields. 


For the single-precision and double-precision variant: is the element index, encoded in the "sz:L:H" 
field. It can have the following values: 


H:L when sz = 0, L = x 
H when sz = 1,L = 0 


The encoding sz = 1,L = 1is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(idxdsize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 
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bits(esize) element1; 
bits(esize) element2 = Elem[operand2, index, esize]; 


for e = 0 to elements-1 

elementl = Elem[operand1, e, esize]; 

if sub_op then element1 = FPNeg(element1) ; 

Elem[result, e, esize] = FPMulAdd(Elem[operand3, e, esize], element1, element2, FPCR); 
V[d] = result; 
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C7.2.115 FMLA (vector) 


Floating-point fused Multiply-Add to accumulator (vector). This instruction multiplies corresponding 
floating-point values in the vectors in the two source SIMD&FP registers, adds the product to the corresponding 
vector element of the destination SIMD&FP register, and writes the result to the destination SIMD&FP register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


Mepla 4 7 oof of Rm Jo ofo o aij Re | Rd 


Half-precision variant 


FMLA <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean sub_op = (a == '1'); 
Single-precision and double-precision 
[31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| o| 


oleoj +77 olof] am roon] e | Rd 
op 


Single-precision and double-precision variant 


FMLA <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean sub_op = (op == '1'); 
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C7-1632 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 


"sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 


for e = 0 to elements-1 
element1 = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
if sub_op then element1 = FPNeg(element1) ; 


Elem[result, e, esize] = FPMulAdd(Elem[operand3, e, esize], element1, element2, FPCR); 


V[d] = result; 
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C7.2.116 FMLAL, FMLAL2 (by element) 


ARM DDI 0487E.a 
ID070919 


Floating-point fused Multiply-Add Long to accumulator (by element). This instruction multiplies the vector 
elements in the first source SIMD&FP register by the specified value in the second source SIMD&FP register, and 
accumulates the product to the corresponding vector element of the destination SIMD&FP register. The instruction 


does not round the result of the multiply before the accumulation. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 


to support it. 


Note 
ID_AA64ISARO_EL1.FHM indicates whether this instruction is supported. 








FMLAL 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 141312/1110 9 | 5 4| 0 | 


fofajojo 1 1 1 4] 4JojLjm] Rm [ojofo ofHjo] Rn | Ra | 
sz S 


FMLAL variant 


FMLAL <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.H[<index>] 


Decode for this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 

integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt('0':Rm); // \m can only be in bottom 16 registers. 
if sz == '1' then UNDEFINED; 

integer index = UInt(H:L:M); 


integer esize = 32; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean sub_op = (S == '1'); 

integer part = 0; 
FMLAL2 
ARMv8.2 

|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 10 9. | 5 4| 0 | 


COUMES a Rn | Re 


FMLAL2 variant 


FMLAL2 <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.H[<index>] 
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C7-1634 


Decode for this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
integer d = 
integer n = 
integer m = 
if sz == '1' then UNDEFINED; 
integer index = UInt(H:L:M); 


UInt(Rd) ; 
UInt(Rn) ; 
UInt('Q':Rm) ; // Nm can only be in bottom 16 registers. 


integer esize = 32; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean sub_op = (S == '1'); 

integer part = 1; 


Assembler symbols 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Vm> 


<index> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 


2S when Q = 0 
4S whenQ = 1 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 


2H when Q = 0 
4H when Q = 1 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the element index, encoded in the "H:L:M" fields. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize DIV 2) operandl = Vpart[n, part]; 

bits(128) operand2 = V[m]; 

bits(datasize) operand3 = V[d]; 

bits(datasize) result; 

bits(esize DIV 2) element1; 

bits(esize DIV 2) element2 = Elem[operand2, index, esize DIV 2]; 


for e = 0 to elements-1 

element1 = Elem[operand1, e, esize DIV 2]; 

if sub_op then element1 = FPNeg(element1) ; 

Elem[result, e, esize] = FPMulAddH(Elem[operand3, e, esize], element1, element2, FPCR); 
= result; 


V[d] 
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C7.2.117 FMLAL, FMLAL2 (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point fused Multiply-Add Long to accumulator (vector). This instruction multiplies corresponding 
half-precision floating-point values in the vectors in the two source SIMD&FP registers, and accumulates the 
product to the corresponding vector element of the destination SIMD&FP register. The instruction does not round 


the result of the multiply before the accumulation. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 


to support it. 


Note 
ID_AA64ISARO_EL1.FHM indicates whether this instruction is supported. 








FMLAL 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0| 


[ofajojo 4 1 1 ojojoj] Rm fili toast] R | Ra | 


S sz 


FMLAL variant 


FMLAL <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz == '1' then UNDEFINED; 

integer esize = 32; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean sub_op = (S == '1'); 

integer part = 0; 


FMLAL2 
ARMv8.2 
|31 ele ate a te 20| 16|15 14 13 121110 9. | 54| 0| 
fojatijo 1 1 1 ofofojt] Rm [ija o0 1j] Rn | Ra | 
S sz 
FMLAL2 variant 


FMLAL2 <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 
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C7-1636 


Decode for this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 


integer d 
integer n 
integer m 


UInt(Rd) ; 
UInt(Rn) ; 
UInt (Rm) ; 


if sz == '1' then UNDEFINED; 

integer esize = 32; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean sub_op = (S == '1'); 

integer part = 1; 


Assembler symbols 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Vm> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
2S when Q = 0 
4S when Q = 1 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
2H when Q = 0 
4H when Q = 1 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize DIV 2) operand1 


Vpart[n, part]; 


bits(datasize DIV 2) operand2 = Vpart[m, part]; 
bits(datasize) operand3 = V[d]; 

bits(datasize) result; 

bits(esize DIV 2) element1; 

bits(esize DIV 2) element2; 


for e = 0 to elements-1 

element1 = Elem[operand1, e, esize DIV 2]; 

element2 = Elem[operand2, e, esize DIV 2]; 

if sub_op then element1 = FPNeg(element1) ; 

Elem[result, e, esize] = FPMulAddH(Elem[operand3, e, esize], element1, element2, FPCR); 
V[d] = result; 
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C7.2.118  FMLS (by element) 


ARM DDI 0487E.a 
ID070919 


Floating-point fused Multiply-Subtract from accumulator (by element). This instruction multiplies the vector 
elements in the first source SIMD&FP register by the specified value in the second source SIMD&FP register, and 
subtracts the results from the vector elements of the destination SIMD&FP register. All the values in this instruction 


are floating-point values. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 


in either a flag being set in FPSR ora synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar, half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 5 4| 0 | 


oao 7744 10 ojm Am foo t[H]o] An | Rd | 
02 


Scalar, half-precision variant 


FMLS <Hd>, <Hn>, <Vm>.H[<index>] 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer index = UInt(H:L:M); 


integer esize = 16; 

integer datasize = esize; 
integer elements = 1; 
boolean sub_op = (02 == '1'); 


Scalar, single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20|19 1615 14 13 12|11 10 9. | 5 4| o| 


oao 74 4 eM em oo Ho An | Rd | 
02 


Scalar, single-precision and double-precision variant 


FMLS <V><d>, <V><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 
bit Rmhi = M; 
case sz:L of 
when '@x' index = UInt(H:L); 
when '10' index = UInt(H); 
when '11' UNDEFINED; 
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C7-1638 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

boolean sub_op = (02 == '1'); 


Vector, half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15141312\1110 9. | 


oeoo rr rilo of [ul e ope — em] mJ 


Vector, half-precision variant 

FMLS <Vd>.<T>, <Vn>.<T>, <Vm>.H[<index>] 
Decode for this encoding 

if !HaveFP16Ext() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer index = UInt(H:L:M); 
integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 


integer elements = datasize DIV esize; 
boolean sub_op = (02 == '1'); 


Vector, single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 


o| 


fofajojo 1 1 1 1ļifs[tjM| Rm [ofifo ijjo] Rn | Ra | 
02 


Vector, single-precision and double-precision variant 


FMLS <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 
bit Rmhi = M; 
case sz:L of 
when '@x' index = UInt(H:L); 
when '10' index = UInt(H); 
when '11' UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


if sz:Q == '10' then UNDEFINED; 
integer esize = 32 << UInt(sz); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


ARM DDI 0487E.a 
ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


integer datasize = if Q == '1' then 128 else 64; 


integer elements 


datasize DIV esize; 


boolean sub_op = (02 == '1'); 


Assembler symbols 


<Hd> 


<Hn> 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<Vm> 


<Ts> 


<index> 


Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 


D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector, half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H whenQ = 1 


For the vector, single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "Q:sz" field. It can have the following values: 


2S when Q = 0, sz = 0 
4S when Q = 1, sz = 0 
2D when Q = 1,sz = 1 


The encoding Q = 0, sz = 1 is reserved. 

Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is the name of the second SIMD&FP source register, in the range VO 
to V15, encoded in the "Rm" field. 

For the single-precision and double-precision variant: is the name of the second SIMD&FP source 
register, encoded in the "M:Rm" fields. 

Is an element size specifier, encoded in the "sz" field. It can have the following values: 

S when sz = 0 

D when sz = 1 

For the half-precision variant: is the element index, in the range 0 to 7, encoded in the "H:L:M" 
fields. 


For the single-precision and double-precision variant: is the element index, encoded in the "sz:L:H" 
field. It can have the following values: 


H:L when sz = 0, L = x 
H when sz = 1,L = 0 


The encoding sz = 1,L = 1is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(idxdsize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 
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bits(esize) element1; 
bits(esize) element2 = Elem[operand2, index, esize]; 


for e = 0 to elements-1 

elementl = Elem[operand1, e, esize]; 

if sub_op then element1 = FPNeg(element1) ; 

Elem[result, e, esize] = FPMulAdd(Elem[operand3, e, esize], element1, element2, FPCR); 
V[d] = result; 
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C7.2.119 | FMLS (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point fused Multiply-Subtract from accumulator (vector). This instruction multiplies corresponding 
floating-point values in the vectors in the two source SIMD&FP registers, negates the product, adds the result to the 
corresponding vector element of the destination SIMD&FP register, and writes the result to the destination 


SIMD&FP register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9 | 5 4| 0 | 


oleole +77 oli o] am oojoo ify] rn | Rd 
a 


Half-precision variant 


FMLS <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean sub_op = (a == '1'); 
Single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 5 4| 0 | 


fofafofo +771 oie] am [17 007]] Rn | Rd 
op 


Single-precision and double-precision variant 


FMLS <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean sub_op = (op == '1'); 
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C7-1642 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 


"sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 


for e = 0 to elements-1 
element1 = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
if sub_op then element1 = FPNeg(element1) ; 


Elem[result, e, esize] = FPMulAdd(Elem[operand3, e, esize], element1, element2, FPCR); 


V[d] = result; 
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C7.2.120 FMLSL, FMLSL2 (by element) 


ARM DDI 0487E.a 
ID070919 


Floating-point fused Multiply-Subtract Long from accumulator (by element). This instruction multiplies the 
negated vector elements in the first source SIMD&FP register by the specified value in the second source 
SIMD&FP register, and accumulates the product to the corresponding vector element of the destination SIMD&FP 
register. The instruction does not round the result of the multiply before the accumulation. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 


Note 
ID_AA64ISARO_EL1.FHM indicates whether this instruction is supported. 








FMLSL 
ARMV8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 141312/1110 9 | 5 4| 0 | 


fofajojo 1 1 1 1jijoftjMm| Rm [ofifo ofHjof Rn | Ra | 
sz S 


FMLSL variant 


FMLSL <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.H[<index>] 


Decode for this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 

integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt('0':Rm); // \m can only be in bottom 16 registers. 
if sz == '1' then UNDEFINED; 

integer index = UInt(H:L:M); 


integer esize = 32; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean sub_op = (S == '1'); 

integer part = 0; 
FMLSL2 
ARMv8.2 

|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 10 9. | 5 4| 0 | 


COUSA e Rn | Re 


FMLSL2 variant 


FMLSL2 <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.H[<index>] 
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C7-1644 


Decode for this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
integer d = 
integer n = 
integer m = 
if sz == '1' then UNDEFINED; 
integer index = UInt(H:L:M); 


UInt(Rd) ; 
UInt(Rn) ; 
UInt('Q':Rm) ; // Nm can only be in bottom 16 registers. 


integer esize = 32; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean sub_op = (S == '1'); 

integer part = 1; 


Assembler symbols 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Vm> 


<index> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 


2S when Q = 0 
4S whenQ = 1 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 


2H when Q = 0 
4H when Q = 1 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the element index, encoded in the "H:L:M" fields. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize DIV 2) operandl = Vpart[n, part]; 

bits(128) operand2 = V[m]; 

bits(datasize) operand3 = V[d]; 

bits(datasize) result; 

bits(esize DIV 2) element1; 

bits(esize DIV 2) element2 = Elem[operand2, index, esize DIV 2]; 


for e = 0 to elements-1 

element1 = Elem[operand1, e, esize DIV 2]; 

if sub_op then element1 = FPNeg(element1) ; 

Elem[result, e, esize] = FPMulAddH(Elem[operand3, e, esize], element1, element2, FPCR); 
= result; 


V[d] 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 


ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.121 FMLSL, FMLSL2 (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point fused Multiply-Subtract Long from accumulator (vector). This instruction negates the values in the 
vector of one SIMD&FP register, multiplies these with the corresponding values in another vector, and accumulates 
the product to the corresponding vector element of the destination SIMD&FP register. The instruction does not 


round the result of the multiply before the accumulation. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 


to support it. 


Note 
ID_AA64ISARO_EL1.FHM indicates whether this instruction is supported. 








FMLSL 
ARMV8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0| 


[ofajojo 14 1 1 ofijoji| Rm filr toast] R | Ra | 


S sz 


FMLSL variant 


FMLSL <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz == '1' then UNDEFINED; 

integer esize = 32; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean sub_op = (S == '1'); 

integer part = 0; 


FMLSL2 
ARMv8.2 
|31 a e 20| 16|15 14 13 121110 9. | 54| 0| 
fojatijo 1 1 1 ofifjoji] Rm [ija o0 1fji|] Rn | Ra | 
S sz 
FMLSL2 variant 


FMLSL2 <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 
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C7-1646 


Decode for this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 


integer d 
integer n 
integer m 


UInt(Rd) ; 
UInt(Rn) ; 
UInt (Rm) ; 


if sz == '1' then UNDEFINED; 

integer esize = 32; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean sub_op = (S == '1'); 

integer part = 1; 


Assembler symbols 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Vm> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
2S when Q = 0 
4S when Q = 1 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
2H when Q = 0 
4H when Q = 1 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize DIV 2) operand1 


Vpart[n, part]; 


bits(datasize DIV 2) operand2 = Vpart[m, part]; 
bits(datasize) operand3 = V[d]; 

bits(datasize) result; 

bits(esize DIV 2) element1; 

bits(esize DIV 2) element2; 


for e = 0 to elements-1 

element1 = Elem[operand1, e, esize DIV 2]; 

element2 = Elem[operand2, e, esize DIV 2]; 

if sub_op then element1 = FPNeg(element1) ; 

Elem[result, e, esize] = FPMulAddH(Elem[operand3, e, esize], element1, element2, FPCR); 
V[d] = result; 
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C7.2.122 FMOV (vector, immediate) 


ARM DDI 0487E.a 
ID070919 


Floating-point move immediate (vector). This instruction copies an immediate floating-point constant into every 
element of the SIMD&FP destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Half-precision 


ARMv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/1110 9 8|7 6 5 4| 0 | 


fofajojo 141470000 ofafofcfi 1 1 1lililajeltlojh] Ra | 


Half-precision variant 

FMOV <Vd>.<T>, #<imm> 

Decode for this encoding 

if !HaveFP16Ext() then UNDEFINED; 
integer rd = UInt(Rd); 


integer datasize = if Q == '1' then 128 else 64; 
bits(datasize) imm; 


imm8 = a:b:c:d:e:f:g:h; 
imm16 = imm8<7>:NOT(imm8<6>) :Replicate(imm8<6>, 2): imm8<5:Q>:Zeros(6); 


imm = Replicate(imm16, datasize DIV 16); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4| 0| 
[ojQfopfo 114110000 Ofafbfc]i1 1 1 1/ojt{dfelf{g{h}] Ra | 
cmode 


Single-precision variant 
Applies when op == 0. 


FMOV <Vd>.<T>, #<imm> 


Double-precision variant 

Applies when Q == 1 && op == 1. 

FMOV <Vd>.2D, #<imm> 

Decode for all variants of this encoding 
integer rd = UInt(Rd); 

integer datasize = if Q == '1' then 128 else 64; 
bits(datasize) imm; 


bits(64) imm64; 


if cmode:op == '11111' then 
// FMOV Dn,#imm is in main FP instruction set 
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C7-1648 


if Q == '@' then UNDEFINED; 


imm64 = AdvSIMDExpandImm(op, cmode, a:b:c:d:e:f:g:h); 
imm = Replicate(imm64, datasize DIV 64); 


Assembler symbols 


<Vd> 


<T> 


<imm> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have 
the following values: 


2S whenQ = 0 
4S whenQ = 1 
Is a signed floating-point constant with 3-bit exponent and normalized 4 bits of precision, encoded 


in "a:b:c:d:e:f:g:h". For details of the range of constants available and the encoding of <imm>, see 
Modified immediate constants in A64 floating-point instructions on page C2-186. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


V[rd] = imm; 
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C7.2.123 FMOV (register) 


Floating-point Move register without conversion. This instruction copies the floating-point value in the SIMD&FP 
source register to the SIMD&FP destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| o| 


fofojo]1 1 1 1 offype{1jo o o ofo ols oo oof Rn | Ra | 


opc 


Half-precision variant 
Applies when ftype == 11. 


FMOV <Hd>, <Hn> 


Single-precision variant 
Applies when ftype == 00. 


FMOV <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FMOV <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 
when '00' datasize 
when '01' datasize 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


32; 
64; 


Assembler symbols 





<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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Operation 
CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 


V[d] = operand; 
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C7.2.124 FMOV (general) 


Floating-point Move to or from general-purpose register without conversion. This instruction transfers the contents 
of a SIMD&FP register to a general-purpose register, or the contents of a general-purpose register to a SIMD&FP 
register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 2120/1918  16/15141312/11109 | 5 4| 0 | 


lojo 171 ofwel x[t 1 xfoo 0000] Rn | Rd 


rmode opcode 


Half-precision to 32-bit variant 
Applies when sf == 0 && ftype == 11 && rmode == 00 && opcode == 110. 


FMOV <Wd>, <Hn> 


Half-precision to 64-bit variant 
Applies when sf == 1 && ftype == 11 && rmode == 00 && opcode == 110. 


FMOV <Xd>, <Hn> 


32-bit to half-precision variant 
Applies when sf == 0 && ftype == 11 && rmode == 00 && opcode == 111. 


FMOV <Hd>, <Wn> 


32-bit to single-precision variant 
Applies when sf == 0 && ftype == 00 && rmode == 00 && opcode == 111. 


FMOV <Sd>, <Wn> 


Single-precision to 32-bit variant 
Applies when sf == 0 && ftype == 00 && rmode == 00 && opcode == 110. 


FMOV <Wd>, <Sn> 


64-bit to half-precision variant 
Applies when sf == 1 && ftype == 11 && rmode == 00 && opcode == 111. 


FMOV <Hd>, <Xn> 


64-bit to double-precision variant 
Applies when sf == 1 && ftype == 01 && rmode == 00 && opcode == 111. 


FMOV <Dd>, <Xn> 


64-bit to top half of 128-bit variant 
Applies when sf == 1 && ftype == 10 && rmode == 01 && opcode == 111. 


FMOV <Vd>.D[1], <Xn> 
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Double-precision to 64-bit variant 
Applies when sf == 1 && ftype == 01 && rmode == 00 && opcode == 110. 


FMOV <Xd>, <Dn> 


Top half of 128-bit to 64-bit variant 
Applies when sf == 1 && ftype == 10 && rmode == 01 && opcode == 110. 


FMOV <Xd>, <Vn>.D[1] 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 

FPConvOp op; 

FPRounding rounding; 

boolean unsigned; 

integer part; 


case ftype of 


when 'QQ' 

fltsize = 32; 
when '01' 

fltsize = 64; 
when '10' 


if opcode<2:1>:rmode != '11 01' then UNDEFINED; 
fltsize = 128; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


case opcode<2:1>:rmode of 

when 'QQ xx' // FCVT[NPMZ] [US] 
rounding = FPDecodeRounding(rmode) ; 
unsigned = (opcode<@> == '1'); 
op = FPConvOp_CVT_Ftol; 

when 'Q1 00' // [US]CVTF 
rounding = FPRoundingMode(FPCR) ; 
unsigned = (opcode<@> == '1'); 
op = FPConvOp_CVT_ItoF; 

when '10 00' // FCVTA[US] 
rounding = FPRounding_TIEAWAY; 
unsigned = (opcode<@> == '1'); 
op = FPConvOp_CVT_Ftol; 

when '11 00' // FMOV 
if fitsize != 16 && fltsize != intsize then UNDEFINED; 


op = if opcode<@> == '1' then FPConvOp_MOV_ItoF else FPConvOp_MOV_FtoI; 


part = 0; 
when '11 01' // FMOV D[1] 
if intsize != 64 || fltsize != 128 then UNDEFINED; 


op = if opcode<@> == '1' then FPConvOp_MOV_ItoF else FPConvOp_MOV_FtoI; 


part = 1; 

fltsize = 64; // size of D[1] is 64 
when '11 11' // FICVTZS 

if !HaveFJCVTZSExt() then UNDEFINED; 

rounding = FPRounding_ZERO; 

unsigned = (opcode<@> == '1'); 

op = FPConvOp_CVT_FtoI_JS; 
otherwise 

UNDEFINED; 
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Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 

<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


case op of 
when FPConvOp_CVT_Ftol 
fltval = V[n]; 
intval = FPToFixed(fltval, 0, unsigned, FPCR, rounding); 
X[d] = intval; 
when FPConvOp_CVT_ItoF 
intval = X[n]; 
fltval = FixedToFP(intval, 0, unsigned, FPCR, rounding); 
V[d] = fltval; 
when FPConvOp_MOV_FtoI 
fltval = Vpart[n, part]; 
intval = ZeroExtend(fltval, intsize); 
X[d] = intval; 
when FPConvOp_MOV_ItoF 
jintval = X[n]; 
fltval = intval<fltsize-1:0>; 
Vpart[d, part] = fltval; 
when FPConvOp_CVT_FtoI_JS 
bit Z; 
fltval = V[n]; 
(intval, Z) = FPToFixedJS(fltval, FPCR, TRUE); 
PSTATE.<N,Z,C,V> = '@':Z:'Q0'; 
X[d] = intval; 
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C7.2.125 FMOV (scalar, immediate) 


Floating-point move immediate (scalar). This instruction copies a floating-point immediate constant into the 
SIMD&FP destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| | 13 12/1110 9 8|7 6 5 4| o| 


[olojoji 1 1 1 offype{t] imma {1 o Cfo ooo of] Ra | 


Half-precision variant 
Applies when ftype == 11. 


FMOV <Hd>, #<imm> 


Single-precision variant 
Applies when ftype == 00. 


FMOV <Sd>, #<imm> 


Double-precision variant 
Applies when ftype == 01. 


FMOV <Dd>, #<imm> 


Decode for all variants of this encoding 
integer d = UInt(Rd); 


integer datasize; 
case ftype of 
when '00' datasize = 32; 
when '01' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


bits(datasize) imm = VFPExpandImm(imm8) ; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<imm> Is a signed floating-point constant with 3-bit exponent and normalized 4 bits of precision, encoded 


in the "imm8" field. For details of the range of constants available and the encoding of <imm>, see 
Modified immediate constants in A64 floating-point instructions on page C2-186. 
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Operation 
CheckFPAdvSIMDEnab1ed64(); 


V[d] = imm; 
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C7.2.126 


C7-1656 


FMSUB 


Floating-point Fused Multiply-Subtract (scalar). This instruction multiplies the values of the first two SIMD&FP 
source registers, negates the product, adds that to the value of the third SIMD&FP source register, and writes the 
result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 


CTC CAK EI Ra] re |r 


Half-precision variant 
Applies when ftype == 11. 


FMSUB <Hd>, <Hn>, <Hm>, <Ha> 


Single-precision variant 
Applies when ftype == 00. 


FMSUB <Sd>, <Sn>, <Sm>, <Sa> 


Double-precision variant 
Applies when ftype == 01. 


FMSUB <Dd>, <Dn>, <Dm>, <Da> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer a = UInt(Ra); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 
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<Dm> Is the 64-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 

<Da> Is the 64-bit name of the third SIMD&FP source register holding the minuend, encoded in the "Ra" 
field. 

<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Hn> Is the 16-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 

<Hm> Is the 16-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 

<Ha> Is the 16-bit name of the third SIMD&FP source register holding the minuend, encoded in the "Ra" 
field. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 

<Sa> Is the 32-bit name of the third SIMD&FP source register holding the minuend, encoded in the "Ra" 
field. 

Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 

bits(datasize) operanda = V[a]; 
bits(datasize) operandl = 
bits(datasize) operand2 = V[m]; 


I 
<= 
= 


operandi = FPNeg(operand1) ; 
result = FPMulAdd(operanda, operand1, operand2, FPCR); 


V[d] = result; 
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C7.2.127 


C7-1658 


FMUL (by element) 


Floating-point Multiply (by element). This instruction multiplies the vector elements in the first source SIMD&FP 
register by the specified value in the second source SIMD&FP register, places the results in a vector, and writes the 
vector to the destination SIMD&FP register. All the values in this instruction are floating-point values. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar, half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 


onio m Moria e J 


Scalar, half-precision variant 


FMUL <Hd>, <Hn>, <Vm>.H[<index>] 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer index = UInt(H:L:M); 


integer esize = 16; 

integer datasize = esize; 
integer elements = 1; 

boolean mulx_op = (U == '1'); 


Scalar, single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15 14 13 12|11 10 9. | 


oo e e o me] eI 


Scalar, single-precision and double-precision variant 


FMUL <V><d>, <V><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 
bit Rmhi = M; 
case sz:L of 
when '@x' index = UInt(H:L); 
when '10' index = UInt(H); 
when '11' UNDEFINED; 


integer d = UInt(Rd); 
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integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

boolean mulx_op = (U == '1'); 


Vector, half-precision 


ARMv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15141312\1110 9. | 


fofajojo 14 1 1 1[o ofLjm| Rm f1 oo tfHfo] Rn | Ra | 
U 


Vector, half-precision variant 


FMUL <Vd>.<T>, <Vn>.<T>, <Vm>.H[<index>] 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer index = UInt(H:L:M); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean mulx_op = (U == '1'); 


Vector, single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 14 13 121110 9 | 


eee he e o maT J 


Vector, single-precision and double-precision variant 


FMUL <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 
bit Rmhi = M; 
case sz:L of 
when '@x' index = UInt(H:L); 
when '10' index = UInt(H); 
when '11' UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


if sz:Q == '10' then UNDEFINED; 
integer esize = 32 << UInt(sz); 
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C7-1660 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
boolean mulx_op = (U == '1'); 


Assembler symbols 


<Hd> 


<Hn> 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<Vm> 


<Ts> 


<index> 


Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 


D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector, half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H whenQ = 1 


For the vector, single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "Q:sz" field. It can have the following values: 


2S when Q = 0, sz = 0 
4S when Q = 1, sz = 0 
2D when Q = 1,sz = 1 


The encoding Q = 0, sz = 1 is reserved. 

Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is the name of the second SIMD&FP source register, in the range VO 
to V15, encoded in the "Rm" field. 

For the single-precision and double-precision variant: is the name of the second SIMD&FP source 
register, encoded in the "M:Rm" fields. 

Is an element size specifier, encoded in the "sz" field. It can have the following values: 

S when sz = 0 

D when sz = 1 

For the half-precision variant: is the element index, in the range 0 to 7, encoded in the "H:L:M" 
fields. 


For the single-precision and double-precision variant: is the element index, encoded in the "sz:L:H" 
field. It can have the following values: 


H:L when sz = 0, L = x 
H when sz = 1,L = 0 


The encoding sz = 1,L = 1is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(idxdsize) operand2 = V[m]; 
bits(datasize) result; 
bits(esize) element1; 
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bits(esize) element2 = Elem[operand2, index, esize]; 


for e = 0 to elements-1 
elementl = Elem[operand1, e, esize]; 
if mulx_op then 
Elem[result, e, esize] 
else 
Elem[result, e, esize] 


FPMulX(element1, element2, FPCR); 


FPMul(element1, element2, FPCR); 


V[d] = result; 
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C7.2.128 


C7-1662 


FMUL (vector) 


Floating-point Multiply (vector). This instruction multiplies corresponding floating-point values in the vectors in 
the two source SIMD&FP registers, places the result in a vector, and writes the vector to the destination SIMD&FP 


register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


ofajijo 14 1 1 ojoj of Rm fo ojoraft] Rao | Ra | 


Half-precision variant 


FMUL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9 | 5 4| 0| 


[olajijo 1 1 1 ofojszfi] Rm fi 101 1j] R | Ra | 


Single-precision and double-precision variant 


FMUL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
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For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 


4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2s when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 


for e = 0 to elements-1 


V[d] 


elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
Elem[result, e, esize] = FPMul(element1, element2, FPCR); 


result; 
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C7.2.129 


C7-1664 


FMUL (scalar) 


Floating-point Multiply (scalar). This instruction multiplies the floating-point values of the two source SIMD&FP 
registers, and writes the result to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fofojoj1 1 1 1 offype{1] Rm fofo o oji of Rn | Ra | 
op 


Half-precision variant 
Applies when ftype == 11. 


FMUL <Hd>, <Hn>, <Hm> 


Single-precision variant 
Applies when ftype == 00. 


FMUL <Sd>, <Sn>, <Sm> 


Double-precision variant 
Applies when ftype == 01. 


FMUL <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when '00' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
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<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


result = FPMul(operand1, operand2, FPCR); 


V[d] = result; 
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C7.2.130 | FMULX (by element) 


Floating-point Multiply extended (by element). This instruction multiplies the floating-point values in the vector 
elements in the first source SIMD&FP register by the specified floating-point value in the second source SIMD&FP 
register, places the results in a vector, and writes the vector to the destination SIMD&FP register. 


If one value is zero and the other value is infinite, the result is 2.0. In this case, the result is negative if only one of 


the values is negative, otherwise the result is positive. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR ora synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar, half-precision 


ARMv8.2 


[31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 


o| 


oap oom em oono] rn | Rd 
U 


Scalar, half-precision variant 


FMULX <Hd>, <Hn>, <Vm>.H[<index>] 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer index = UInt(H:L:M); 


integer esize = 16; 
integer datasize = esize; 


integer elements = 1; 
boolean mulx_op = (U == '1'); 


Scalar, single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20|19 1615 14 13 12|11 10 9. | 


o | 


oap e Rm ooaj] en [| Rd 
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Scalar, single-precision and double-precision variant 


FMULX <V><d>, <V><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 
bit Rmhi = M; 
case sz:L of 
when '@x' index = UInt(H:L); 
when '10' index = UInt(H); 
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when '11' UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

boolean mulx_op = (U == '1'); 


Vector, half-precision 


ARMV8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9. | 


enero oim m ooo e 


Vector, half-precision variant 


FMULX <Vd>.<T>, <Vn>.<T>, <Vm>.H[<index>] 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer index = UInt(H:L:M); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean mulx_op = (U == '1'); 


Vector, single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 14 13 12|11 10 9. | 


eno i ie e o — me e 


Vector, single-precision and double-precision variant 


FMULX <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 
bit Rmhi = M; 
case sz:L of 
when '@x' index = UInt(H:L); 
when '10' index = UInt(H); 
when '11' UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 
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if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean mulx_op = (U == '1'); 


Assembler symbols 


<Hd> 


<Hn> 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<Vm> 


<Ts> 


<index> 


Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 


D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector, half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 

4H when Q = 0 

8H when Q = 1 


For the vector, single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "Q:sz" field. It can have the following values: 


2S when Q = 0, sz = 0 
4S when Q = 1, sz = 0 
2D when Q = 1,sz = 1 


The encoding Q = 0, sz = 1 is reserved. 

Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

For the half-precision variant: is the name of the second SIMD&FP source register, in the range VO 
to V15, encoded in the "Rm" field. 

For the single-precision and double-precision variant: is the name of the second SIMD&FP source 
register, encoded in the "M:Rm" fields. 

Is an element size specifier, encoded in the "sz" field. It can have the following values: 

S when sz = 0 

D when sz = 1 

For the half-precision variant: is the element index, in the range 0 to 7, encoded in the "H:L:M" 
fields. 


For the single-precision and double-precision variant: is the element index, encoded in the "sz:L:H" 
field. It can have the following values: 


H:L when sz = 0,L = x 
H when sz = 1,L = 0 


The encoding sz = 1, L = 1 is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 


bits(datasize) operand1 
bits(idxdsize) operand2 = 


C7-1668 


I ou 
=, E 
3 5 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2 = Elem[operand2, index, esize]; 


for e = 0 to elements-1 
element1 = Elem[operand1, e, esize]; 
if mulx_op then 
Elem[result, e, esize] 
else 
Elem[result, e, esize] 


FPMulX(element1, element2, FPCR); 


FPMul(element1, element2, FPCR); 


V[d] = result; 
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C7.2.131 FMULX 


C7-1670 


Floating-point Multiply extended. This instruction multiplies corresponding floating-point values in the vectors of 
the two source SIMD&FP registers, places the resulting floating-point values in a vector, and writes the vector to 


the destination SIMD&FP register. 


If one value is zero and the other value is infinite, the result is 2.0. In this case, the result is negative if only one of 


the values is negative, otherwise the result is positive. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9. | 5 4| 0 | 


oao +77 olojo] Rm oojo rii] en | Rd 


Scalar half precision variant 


FMULX <Hd>, <Hn>, <Hm> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


Scalar single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20| 1615 14 13 12|11 10 9. | 5 4| o| 


[o ajoji 1 1 1 ojojszfi] Rm fi101 1j) R | Ra | 


Scalar single-precision and double-precision variant 


FMULX <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


Vector half precision 


ARMv8.2 
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|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


ofajojo 14 1 1 ojoj of Rm fo ofo11fji| Rao | Ra | 


Vector half precision variant 


FMULX <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9. | 5 4| 0| 


fofajofo 1 1 1 ofofsz{t} Rm fit 101 1j] R | Ra | 


Vector single-precision and double-precision variant 


FMULX <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 

S when sz = 0 

D when sz = 1 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
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C7-1672 


<T> 


<Vn> 


<Vm> 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 


4H when Q = 0 
8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 


for e = 0 to elements-1 


V[d] 


elementl = Elem[operand1, e, esize]; 

element2 = Elem[operand2, e, esize]; 

Elem[result, e, esize] = FPMulX(element1, element2, FPCR); 
result; 
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C7.2.132 FNEG (vector) 


Floating-point Negate (vector). This instruction negates the value of each vector element in the source SIMD&FP 
register, writes the result to a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Half-precision 


ARMv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Half-precision variant 


FNEG <Vd>.<T>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean neg = (U == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Single-precision and double-precision variant 


FNEG <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean neg = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1673 


ID070919 Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
if neg then 
element = FPNeg(element) ; 
else 
element = FPAbs(element) ; 
Elem[result, e, esize] = element; 


V[d] = result; 
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C7.2.133 FNEG (scalar) 


Floating-point Negate (scalar). This instruction negates the value in the SIMD&FP source register and writes the 
result to the SIMD&FP destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| o| 
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opc 


Half-precision variant 
Applies when ftype == 11. 


FNEG <Hd>, <Hn> 


Single-precision variant 
Applies when ftype == 00. 


FNEG <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FNEG <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 
when '00' datasize 
when '01' datasize 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


32; 
64; 


Assembler symbols 





<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPNeg(operand); 
V[d] = result; 


C7-1676 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.134 FNMADD 


ARM DDI 0487E.a 
ID070919 


Floating-point Negated fused Multiply-Add (scalar). This instruction multiplies the values of the first two 
SIMD&FP source registers, negates the product, subtracts the value of the third SIMD&FP source register, and 
writes the result to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 | 109 5 4| 0 | 


CTC CKAN I EA D To] Re] |r 


Half-precision variant 
Applies when ftype == 11. 


FNMADD <Hd>, <Hn>, <Hm>, <Ha> 


Single-precision variant 
Applies when ftype == 00. 


FNMADD <Sd>, <Sn>, <Sm>, <Sa> 


Double-precision variant 
Applies when ftype == 01. 


FNMADD <Dd>, <Dn>, <Dm>, <Da> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer a = UInt(Ra); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 
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<Dm> Is the 64-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 

<Da> Is the 64-bit name of the third SIMD&FP source register holding the addend, encoded in the "Ra" 
field. 

<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Hn> Is the 16-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 

<Hm> Is the 16-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 

<Ha> Is the 16-bit name of the third SIMD&FP source register holding the addend, encoded in the "Ra" 
field. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 

<Sa> Is the 32-bit name of the third SIMD&FP source register holding the addend, encoded in the "Ra" 
field. 

Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 

bits(datasize) operanda = V[a]; 
bits(datasize) operandl = 
bits(datasize) operand2 = V[m]; 


I 
a 
= 


operanda = FPNeg(operanda) ; 
operandi = FPNeg(operand1) ; 
result = FPMulAdd(operanda, operand1, operand2, FPCR); 


V[d] = result; 
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C7.2.135 FNMSUB 


ARM DDI 0487E.a 
ID070919 


Floating-point Negated fused Multiply-Subtract (scalar). This instruction multiplies the values of the first two 
SIMD&FP source registers, subtracts the value of the third SIMD&FP source register, and writes the result to the 
destination SIMD&FP register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 | 109 5 4| 0 | 
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Half-precision variant 
Applies when ftype == 11. 


FNMSUB <Hd>, <Hn>, <Hm>, <Ha> 


Single-precision variant 
Applies when ftype == 00. 


FNMSUB <Sd>, <Sn>, <Sm>, <Sa> 


Double-precision variant 
Applies when ftype == 01. 


FNMSUB <Dd>, <Dn>, <Dm>, <Da> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer a = UInt(Ra); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 
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C7-1680 


<Dm> 


<Da> 


<Hd> 


<Hn> 


<Hm> 


<Ha> 


<Sd> 


<Sn> 


<Sm> 


<Sa> 


Operation 


Is the 64-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 


Is the 64-bit name of the third SIMD&FP source register holding the minuend, encoded in the "Ra" 
field. 


Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the 16-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 


Is the 16-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 


Is the 16-bit name of the third SIMD&FP source register holding the minuend, encoded in the "Ra" 
field. 


Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the 32-bit name of the first SIMD&FP source register holding the multiplicand, encoded in the 
"Rn" field. 


Is the 32-bit name of the second SIMD&FP source register holding the multiplier, encoded in the 
"Rm" field. 


Is the 32-bit name of the third SIMD&FP source register holding the minuend, encoded in the "Ra" 
field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 
bits(datasize) operanda = V[a]; 


bits(datasize) operandl = 
bits(datasize) operand2 = V[m]; 


I 
<= 
= 


operanda = FPNeg(operanda) ; 
result = FPMulAdd(operanda, operand1, operand2, FPCR); 


V[d] 


result; 
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C7.2.136 | FNMUL (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Multiply-Negate (scalar). This instruction multiplies the floating-point values of the two source 
SIMD&FP registers, and writes the negation of the result to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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Half-precision variant 
Applies when ftype == 11. 


FNMUL <Hd>, <Hn>, <Hm> 


Single-precision variant 
Applies when ftype == 00. 


FNMUL <Sd>, <Sn>, <Sm> 


Double-precision variant 
Applies when ftype == 01. 


FNMUL <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when '00' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
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<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) result; 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 

result = FPMul(operand1, operand2, FPCR); 
result = FPNeg(result); 


V[d] = result; 
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C7.2.137  FRECPE 


Floating-point Reciprocal Estimate. This instruction finds an approximate reciprocal estimate for each vector 
element in the source SIMD&FP register, places the result in a vector, and writes the vector to the destination 
SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR ora synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Scalar half precision variant 


FRECPE <Hd>, <Hn> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 


integer datasize = esize; 
integer elements = 1; 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Scalar single-precision and double-precision variant 


FRECPE <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


Vector half precision 


ARMVv8.2 
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C7-1684 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Vector half precision variant 


FRECPE <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Vector single-precision and double-precision 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Vector single-precision and double-precision variant 


FRECPE <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H when Q = 1 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 


Elem[result, e, esize] = FPRecipEstimate(element, FPCR); 


V[d] = result; 
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C7.2.138 


C7-1686 


FRECPS 


Floating-point Reciprocal Step. This instruction multiplies the corresponding floating-point values in the vectors of 
the two source SIMD&FP registers, subtracts each of the products from 2.0, places the resulting floating-point 
values in a vector, and writes the vector to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 
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Scalar half precision variant 


FRECPS <Hd>, <Hn>, <Hm> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


Scalar single-precision and double-precision 
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Scalar single-precision and double-precision variant 


FRECPS <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


Vector half precision 


ARMv8.2 
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|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 
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Vector half precision variant 


FRECPS <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9 | 5 4| 0| 
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Vector single-precision and double-precision variant 


FRECPS <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 

S when sz = 0 

D when sz = 1 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
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C7-1688 


<T> 


<Vn> 


<Vm> 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 


4H when Q = 0 
8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 


for e = 0 to elements-1 


V[d] 


elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
Elem[result, e, esize] = FPRecipStepFused(element1, element2) ; 


result; 
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C7.2.139 FRECPX 


Floating-point Reciprocal exponent (scalar). This instruction finds an approximate reciprocal exponent for each 
vector element in the source SIMD&FP register, places the result in a vector, and writes the vector to the destination 
SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR ora synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Half-precision 


ARMVv8.2 
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Half-precision variant 
FRECPX <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


Single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 
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Single-precision and double-precision variant 


FRECPX <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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C7-1690 


<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRecpX(element, FPCR); 


V[d] = result; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.140 FRINT32X (vector) 


Floating-point Round to 32-bit Integer, using current rounding mode (vector). This instruction rounds a vector of 
floating-point values in the SIMD&FP source register to integral floating-point values that fit into a 32-bit integer 
size using the rounding mode that is determined by the FPCR, and writes the result to the SIMD&FP destination 
register. 


A zero input returns a zero result with the same sign. When one of the result values is not numerically equal to the 
corresponding input value, an Inexact exception is raised. When an input is infinite, NaN or out-of-range, the 
instruction returns for the corresponding result value the most negative integer representable in the destination size, 
and an Invalid Operation floating-point exception is raised. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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Vector single-precision and double-precision variant 


FRINT32X <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


if !HaveFrintExt() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 

integer intsize = if op == '0' then 32 else 64; 

FPRounding rounding = if U == '@' then FPRounding_ZERO else FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> Is an arrangement specifier, encoded in the "sz:Q" field. It can have the following values: 
2S when sz = 0,Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRoundIntN(element, FPCR, rounding, intsize); 


V[d] = result; 
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C7.2.141 FRINT32X (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to 32-bit Integer, using current rounding mode (scalar). This instruction rounds a 
floating-point value in the SIMD&FP source register to an integral floating-point value that fits into a 32-bit integer 
size using the rounding mode that is determined by the FPCR, and writes the result to the SIMD&FP destination 
register. 


A zero input returns a zero result with the same sign. When the result value is not numerically equal to the input 
value, an Inexact exception is raised. When the input is infinite, NaN or out-of-range, the instruction returns {for 
the corresponding result value} the most negative integer representable in the destination size, and an Invalid 
Operation floating-point exception is raised. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


ARMV8.5 
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ftype 


Single-precision variant 
Applies when ftype == 00. 


FRINT32X <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINT32X <Dd>, <Dn> 


Decode for all variants of this encoding 


if !HaveFrintExt() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 

case ftype of 
when '00' datasize = 32; 
when '01' datasize = 64; 
when '1x' UNDEFINED; 


FPRounding rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundIntN(operand, FPCR, rounding, 32); 


V[d] = result; 
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C7.2.142 FRINT32Z (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to 32-bit Integer toward Zero (vector). This instruction rounds a vector of floating-point 
values in the SIMD&FP source register to integral floating-point values that fit into a 32-bit integer size using the 
Round towards Zero rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input returns a zero result with the same sign. When one of the result values is not numerically equal to the 
corresponding input value, an Inexact exception is raised. When an input is infinite, NaN or out-of-range, the 
instruction returns for the corresponding result value the most negative integer representable in the destination size, 
and an Invalid Operation floating-point exception is raised. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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Vector single-precision and double-precision variant 


FRINT32Z <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


if !HaveFrintExt() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 

integer intsize = if op == '@' then 32 else 64; 

FPRounding rounding = if U == 'Q@' then FPRounding_ZERO else FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> Is an arrangement specifier, encoded in the "sz:Q" field. It can have the following values: 
2S when sz = 0,Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
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bits(esize) element; 
for e = 0 to elements-1 
element = Elem[operand, e, esize]; 


Elem[result, e, esize] = FPRoundIntN(element, FPCR, rounding, intsize); 


V[d] = result; 
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C7.2.143 FRINT32Z (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to 32-bit Integer toward Zero (scalar). This instruction rounds a floating-point value in the 
SIMD&FP source register to an integral floating-point value that fits into a 32-bit integer size using the Round 
towards Zero rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input returns a zero result with the same sign. When the result value is not numerically equal to the 
{corresponding} input value, an Inexact exception is raised. When the input is infinite, NaN or out-of-range, the 
instruction returns {for the corresponding result value} the most negative integer representable in the destination 
size, and an Invalid Operation floating-point exception is raised. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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ftype 


Single-precision variant 
Applies when ftype == 00. 


FRINT32Z <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINT32Z <Dd>, <Dn> 


Decode for all variants of this encoding 


if !HaveFrintExt() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 

case ftype of 
when '00' datasize = 32; 
when '01' datasize = 64; 
when '1x' UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundIntN(operand, FPCR, FPRounding_ZERO, 32); 


V[d] = result; 
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C7.2.144 FRINT64X (vector) 


Floating-point Round to 64-bit Integer, using current rounding mode (vector). This instruction rounds a vector of 
floating-point values in the SIMD&FP source register to integral floating-point values that fit into a 64-bit integer 
size using the rounding mode that is determined by the FPCR, and writes the result to the SIMD&FP destination 
register. 


A zero input returns a zero result with the same sign. When one of the result values is not numerically equal to the 
corresponding input value, an Inexact exception is raised. When an input is infinite, NaN or out-of-range, the 
instruction returns for the corresponding result value the most negative integer representable in the destination size, 
and an Invalid Operation floating-point exception is raised. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


ARMV8.5 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


elole 1 44 ofofs oo 9 op ta it of Rn do a __ 


Vector single-precision and double-precision variant 


FRINT64X <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


if !HaveFrintExt() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 

integer intsize = if op == '@' then 32 else 64; 

FPRounding rounding = if U == '@' then FPRounding_ZERO else FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> Is an arrangement specifier, encoded in the "sz:Q" field. It can have the following values: 
2S when sz = 0,Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = Q is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRoundIntN(element, FPCR, rounding, intsize); 


V[d] = result; 
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C7.2.145 FRINT64X (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to 64-bit Integer, using current rounding mode (scalar). This instruction rounds a 
floating-point value in the SIMD&FP source register to an integral floating-point value that fits into a 64-bit integer 
size using the rounding mode that is determined by the FPCR, and writes the result to the SIMD&FP destination 
register. 


A zero input returns a zero result with the same sign. When the result value is not numerically equal to the input 
value, an Inexact exception is raised. When the input is infinite, NaN or out-of-range, the instruction returns {for 
the corresponding result value} the most negative integer representable in the destination size, and an Invalid 
Operation floating-point exception is raised. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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ftype 


Single-precision variant 
Applies when ftype == 00. 


FRINT64X <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINT64X <Dd>, <Dn> 


Decode for all variants of this encoding 


if !HaveFrintExt() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 

case ftype of 
when '00' datasize = 32; 
when '01' datasize = 64; 
when '1x' UNDEFINED; 


FPRounding rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundIntN(operand, FPCR, rounding, 64); 


V[d] = result; 
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C7.2.146 FRINT64Z (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to 64-bit Integer toward Zero (vector). This instruction rounds a vector of floating-point 
values in the SIMD&FP source register to integral floating-point values that fit into a 64-bit integer size using the 
Round towards Zero rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input returns a zero result with the same sign. When one of the result values is not numerically equal to the 
corresponding input value, an Inexact exception is raised. When an input is infinite, NaN or out-of-range, the 
instruction returns for the corresponding result value the most negative integer representable in the destination size, 
and an Invalid Operation floating-point exception is raised. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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Vector single-precision and double-precision variant 


FRINT64Z <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


if !HaveFrintExt() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 

integer intsize = if op == '@' then 32 else 64; 

FPRounding rounding = if U == 'Q@' then FPRounding_ZERO else FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> Is an arrangement specifier, encoded in the "sz:Q" field. It can have the following values: 
2S when sz = 0,Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
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bits(esize) element; 
for e = 0 to elements-1 
element = Elem[operand, e, esize]; 


Elem[result, e, esize] = FPRoundIntN(element, FPCR, rounding, intsize); 


V[d] = result; 
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C7.2.147 FRINT64Z (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to 64-bit Integer toward Zero (scalar). This instruction rounds a floating-point value in the 
SIMD&FP source register to an integral floating-point value that fits into a 64-bit integer size using the Round 
towards Zero rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input returns a zero result with the same sign. When the result value is not numerically equal to the 
{corresponding} input value, an Inexact exception is raised. When the input is infinite, NaN or out-of-range, the 
instruction returns {for the corresponding result value} the most negative integer representable in the destination 
size, and an Invalid Operation floating-point exception is raised. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


ARMV8.5 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 1413 12/1110 9. | 5 4| 0 | 


delio tole atito 79 oft ofr ooo of Rn l o 


ftype 


Single-precision variant 
Applies when ftype == 00. 


FRINT64Z <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINT64Z <Dd>, <Dn> 


Decode for all variants of this encoding 


if !HaveFrintExt() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 

case ftype of 
when '00' datasize = 32; 
when '01' datasize = 64; 
when '1x' UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundIntN(operand, FPCR, FPRounding_ZERO, 64); 


V[d] = result; 
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C7.2.148 FRINTA (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, to nearest with ties to Away (vector). This instruction rounds a vector of 
floating-point values in the SIMD&FP source register to integral floating-point values of the same size using the 
Round to Nearest with Ties to Away rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofafifo +17 ofol177700i1100)0)10] Rn | Ra 
U 02 01 


Half-precision variant 


FRINTA <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 
when '@xx' rounding = FPDecodeRounding(01:02); 
when '100' rounding = FPRounding_TIEAWAY; 
when '101' UNDEFINED; 
when '110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
when '111' rounding = FPRoundingMode(FPCR) ; 


Single-precision and double-precision 
|31 30 29 28|27 26 25 24/23 22 21 20/19 1817 16/15 14 13 12|1110 9. | 5 4| 0 | 


fofafifo +171 olo o o o oj o 0/010] Rn | Ra 
U 02 01 


Single-precision and double-precision variant 


FRINTA <Vd>.<T>, <Vn>.<T> 
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C7-1708 


Decode for this encoding 


integer 
integer 


d 
n 


UInt(Rd) ; 
UInt(Rn) ; 


if sz:Q == '10' then UNDEFINED; 

esize = 32 << UInt(sz); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


integer 
integer 
integer 


boolean 


when 
when 
when 
when 
when 


exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 


"@xx' rounding = FPDecodeRounding(01:02); 

'100' rounding = FPRounding_TIEAWAY; 

'101' UNDEFINED; 

'110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
'111' rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRoundInt(element, FPCR, rounding, exact); 


V[d] = result; 
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C7.2.149 FRINTA (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, to nearest with ties to Away (scalar). This instruction rounds a floating-point value 
in the SIMD&FP source register to an integral floating-point value of the same size using the Round to Nearest with 
Ties to Away rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


31 


olojo 1771 oleo o 1fiooj7 0000] Rn | Rd 


30 29 28/27 26 25 24/23 22 21 20|1918 17 |15 1413 12|1110 9 | 5 4| 


rmode 


Half-precision variant 


Applies when ftype == 11. 


FRINTA <Hd>, <Hn> 


Single-precision variant 


Applies when ftype == 00. 


FRINTA <Sd>, <Sn> 


Double-precision variant 


Applies when ftype == 01. 


FRINTA <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 


when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> 


<Dn> 


<Hd> 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 


Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
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C7-1710 


<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundInt(operand, FPCR, FPRounding_TIEAWAY, FALSE); 


V[d] = result; 
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C7.2.150 FRINTI (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, using current rounding mode (vector). This instruction rounds a vector of 
floating-point values in the SIMD&FP source register to integral floating-point values of the same size using the 
rounding mode that is determined by the FPCR, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


olene oft 7+ 100110010] Rn | Ra 
U 02 01 


Half-precision variant 


FRINTI <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 
when '@xx' rounding = FPDecodeRounding(01:02); 
when '100' rounding = FPRounding_TIEAWAY; 
when '101' UNDEFINED; 
when '110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
when '111' rounding = FPRoundingMode(FPCR) ; 


Single-precision and double-precision 
[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 1211110 9. | 5 4| 0 | 


fofaftfo +171 oftfet ooo 01 100/110] Rn | Ra 
U 02 01 


Single-precision and double-precision variant 


FRINTI <Vd>.<T>, <Vn>.<T> 
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C7-1712 


Decode for this encoding 


integer 
integer 


d 
n 


UInt(Rd) ; 
UInt(Rn) ; 


if sz:Q == '10' then UNDEFINED; 

esize = 32 << UInt(sz); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


integer 
integer 
integer 


boolean 


when 
when 
when 
when 
when 


exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 


"@xx' rounding = FPDecodeRounding(01:02); 

'100' rounding = FPRounding_TIEAWAY; 

'101' UNDEFINED; 

'110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
'111' rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRoundInt(element, FPCR, rounding, exact); 


V[d] = result; 
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C7.2.151 FRINTI (scalar) 


Floating-point Round to Integral, using current rounding mode (scalar). This instruction rounds a floating-point 
value in the SIMD&FP source register to an integral floating-point value of the same size using the rounding mode 
that is determined by the FPCR, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/191817 |15141312/11109 | 5 4| 0 | 


olojo 1771 ofwel oti 7 ifio0000] Rn | Rd 


rmode 


Half-precision variant 
Applies when ftype == 11. 


FRINTI <Hd>, <Hn> 


Single-precision variant 
Applies when ftype == 00. 


FRINTI <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINTI <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


FPRounding rounding; 
rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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C7-1714 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundInt(operand, FPCR, rounding, FALSE); 


V[d] = result; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.152 FRINTM (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, toward Minus infinity (vector). This instruction rounds a vector of floating-point 
values in the SIMD&FP source register to integral floating-point values of the same size using the Round towards 


Minus Infinity rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 


a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofafofo +17 ojo 771100110 0)110] Rn | Ra 
U 02 01 


Half-precision variant 


FRINTM <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 
when '@xx' rounding = FPDecodeRounding(01:02); 
when '100' rounding = FPRounding_TIEAWAY; 
when '101' UNDEFINED; 
when '110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
when '111' rounding = FPRoundingMode(FPCR) ; 


Single-precision and double-precision 
[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 1211110 9. | 5 4| 0 | 


fofafoyo +171 ofofstoo0 01 100/110] Rn | Ra | 
U 02 01 


Single-precision and double-precision variant 


FRINTM <Vd>.<T>, <Vn>.<T> 
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C7-1716 


Decode for this encoding 


integer 
integer 


d 
n 


UInt(Rd) ; 
UInt(Rn) ; 


if sz:Q == '10' then UNDEFINED; 

esize = 32 << UInt(sz); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


integer 
integer 
integer 


boolean 


when 
when 
when 
when 
when 


exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 


"@xx' rounding = FPDecodeRounding(01:02); 

'100' rounding = FPRounding_TIEAWAY; 

'101' UNDEFINED; 

'110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
'111' rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRoundInt(element, FPCR, rounding, exact); 


V[d] = result; 
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C7.2.153 FRINTM (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, toward Minus infinity (scalar). This instruction rounds a floating-point value in 
the SIMD&FP source register to an integral floating-point value of the same size using the Round towards Minus 
Infinity rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/191817 |15 1413 12|1110 9. | 5 4| 0 | 


olojo 1771 oleo o 1fo 7 oji 0000] Rn | Rd 


rmode 


Half-precision variant 
Applies when ftype == 11. 


FRINTM <Hd>, <Hn> 


Single-precision variant 
Applies when ftype == 00. 


FRINTM <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINTM <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


FPRounding rounding; 
rounding = FPDecodeRounding('10'); 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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C7-1718 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundInt(operand, FPCR, rounding, FALSE); 


V[d] = result; 
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C7.2.154  FRINTN (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, to nearest with ties to even (vector). This instruction rounds a vector of 
floating-point values in the SIMD&FP source register to integral floating-point values of the same size using the 
Round to Nearest rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/1514 1312/1110 9. | 5 4| 0 | 


fofafofo +17 ofolr74700i1100)0)10] Rn | Ra 
U 02 01 


Half-precision variant 


FRINTN <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 
when '@xx' rounding = FPDecodeRounding(01:02); 
when '100' rounding = FPRounding_TIEAWAY; 
when '101' UNDEFINED; 
when '110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
when '111' rounding = FPRoundingMode(FPCR) ; 


Single-precision and double-precision 
[31 30 29 28|27 26 25 24/23 22 21 20/19 1817 16/15 141312|11109 | 5 4| 0 | 


oloo +171 olo o 000/110 0/0/10] Rn | Ra 
U 02 01 


Single-precision and double-precision variant 


FRINTN <Vd>.<T>, <Vn>.<T> 
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C7-1720 


Decode for this encoding 


integer 
integer 


d 
n 


UInt(Rd) ; 
UInt(Rn) ; 


if sz:Q == '10' then UNDEFINED; 

esize = 32 << UInt(sz); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


integer 
integer 
integer 


boolean 


when 
when 
when 
when 
when 


exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 


"@xx' rounding = FPDecodeRounding(01:02); 

'100' rounding = FPRounding_TIEAWAY; 

'101' UNDEFINED; 

'110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
'111' rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRoundInt(element, FPCR, rounding, exact); 


V[d] = result; 
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C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.155 FRINTN (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, to nearest with ties to even (scalar). This instruction rounds a floating-point value 
in the SIMD&FP source register to an integral floating-point value of the same size using the Round to Nearest 
rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/191817 |15 1413 12|1110 9. | 5 4| 0 | 


olojo 1171 ofwel] o o o oji 0000] Rn | Rd 


rmode 


Half-precision variant 
Applies when ftype == 11. 


FRINTN <Hd>, <Hn> 


Single-precision variant 
Applies when ftype == 00. 


FRINTN <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINTN <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


FPRounding rounding; 
rounding = FPDecodeRounding('@0'); 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1721 
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C7-1722 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundInt(operand, FPCR, rounding, FALSE); 


V[d] = result; 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.156 FRINTP (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, toward Plus infinity (vector). This instruction rounds a vector of floating-point 
values in the SIMD&FP source register to integral floating-point values of the same size using the Round towards 
Plus Infinity rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofafofo +17 Oft[1777100i1100/0)10] Rn | Ra 
U 02 01 


Half-precision variant 


FRINTP <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 
when '@xx' rounding = FPDecodeRounding(01:02); 
when '100' rounding = FPRounding_TIEAWAY; 
when '101' UNDEFINED; 
when '110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
when '111' rounding = FPRoundingMode(FPCR) ; 


Single-precision and double-precision 
[31 30 29 28|27 26 25 24/23 22 21 20/19 1817 16/15 14 13 12|1110 9. | 5 4| 0 | 


fofafofo +171 Oftfeto000j110 0/0/10] Rn | Ra 
U 02 01 


Single-precision and double-precision variant 


FRINTP <Vd>.<T>, <Vn>.<T> 
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C7-1724 


Decode for this encoding 


integer 
integer 


d 
n 


UInt(Rd) ; 
UInt(Rn) ; 


if sz:Q == '10' then UNDEFINED; 

esize = 32 << UInt(sz); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


integer 
integer 
integer 


boolean 


when 
when 
when 
when 
when 


exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 


"@xx' rounding = FPDecodeRounding(01:02); 

'100' rounding = FPRounding_TIEAWAY; 

'101' UNDEFINED; 

'110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
'111' rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRoundInt(element, FPCR, rounding, exact); 


V[d] = result; 
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C7.2.157 FRINTP (scalar) 


Floating-point Round to Integral, toward Plus infinity (scalar). This instruction rounds a floating-point value in the 
SIMD&FP source register to an integral floating-point value of the same size using the Round towards Plus Infinity 
rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21201191817 |15 1413 12|1110 9. | 5 4| 0 | 


olojo 1771 oleo oo o ii o000] rn | Rd 


rmode 


Half-precision variant 
Applies when ftype == 11. 


FRINTP <Hd>, <Hn> 


Single-precision variant 
Applies when ftype == 00. 


FRINTP <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINTP <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


FPRounding rounding; 
rounding = FPDecodeRounding('@1'); 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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C7-1726 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundInt(operand, FPCR, rounding, FALSE); 


V[d] = result; 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.158 FRINTX (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral exact, using current rounding mode (vector). This instruction rounds a vector of 
floating-point values in the SIMD&FP source register to integral floating-point values of the same size using the 
rounding mode that is determined by the FPCR, and writes the result to the SIMD&FP destination register. 


When a result value is not numerically equal to the corresponding input value, an Inexact exception is raised. A zero 
input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and a NaN 
is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


ojafijo 14 1 1 ofoja 1110 0{1170 0/1/71 o] Rn | Ra | 
U o2 01 


Half-precision variant 


FRINTX <Vd>.<T>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 
when '@xx' rounding = FPDecodeRounding(01:02); 
when '100' rounding = FPRounding_TIEAWAY; 
when '101' UNDEFINED; 
when '110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
when '111' rounding = FPRoundingMode(FPCR) ; 


Single-precision and double-precision 
[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0 | 


fofafijo +171 Ofojst 00001 100/110] Rn | Ra 
U 02 01 


Single-precision and double-precision variant 


FRINTX <Vd>.<T>, <Vn>.<T> 
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C7-1728 


Decode for this encoding 


integer 
integer 


d 
n 


UInt(Rd) ; 
UInt(Rn) ; 


if sz:Q == '10' then UNDEFINED; 

esize = 32 << UInt(sz); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


integer 
integer 
integer 


boolean 


when 
when 
when 
when 
when 


exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 


"@xx' rounding = FPDecodeRounding(01:02); 

'100' rounding = FPRounding_TIEAWAY; 

'101' UNDEFINED; 

'110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
'111' rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRoundInt(element, FPCR, rounding, exact); 


V[d] = result; 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.159 FRINTX (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral exact, using current rounding mode (scalar). This instruction rounds a 
floating-point value in the SIMD&FP source register to an integral floating-point value of the same size using the 
rounding mode that is determined by the FPCR, and writes the result to the SIMD&FP destination register. 


When the result value is not numerically equal to the input value, an Inexact exception is raised. A zero input gives 
a zero result with the same sign, an infinite input gives an infinite result with the same sign, and a NaN is propagated 
as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/191817 |15 1413 12|1110 9. | 5 4| 0 | 


fofojoj1 1 1 1 offype}ifo o ji 1 0]1 0000] Ran | Ra | 


rmode 


Half-precision variant 
Applies when ftype == 11. 
FRINTX <Hd>, <Hn> 
Single-precision variant 
Applies when ftype == 00. 


FRINTX <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINTX <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


FPRounding rounding; 
rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
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C7-1730 





<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundInt(operand, FPCR, rounding, TRUE); 


V[d] = result; 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.160 FRINTZ (vector) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, toward Zero (vector). This instruction rounds a vector of floating-point values in 
the SIMD&FP source register to integral floating-point values of the same size using the Round towards Zero 


rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 


a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofafofo +17 oftf1 7711001100110] Rn | Ra 
U 02 01 


Half-precision variant 


FRINTZ <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 
when '@xx' rounding = FPDecodeRounding(01:02); 
when '100' rounding = FPRounding_TIEAWAY; 
when '101' UNDEFINED; 
when '110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
when '111' rounding = FPRoundingMode(FPCR) ; 


Single-precision and double-precision 
[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|1110 9. | 5 4| 0 | 


fofafofo +171 Oftfet ooo 01 100/110] Rn | Ra 
U 02 01 


Single-precision and double-precision variant 


FRINTZ <Vd>.<T>, <Vn>.<T> 
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C7-1732 


Decode for this encoding 


integer 
integer 


d 
n 


UInt(Rd) ; 
UInt(Rn) ; 


if sz:Q == '10' then UNDEFINED; 

esize = 32 << UInt(sz); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


integer 
integer 
integer 


boolean 


when 
when 
when 
when 
when 


exact = FALSE; 
FPRounding rounding; 
case U:01:02 of 


"@xx' rounding = FPDecodeRounding(01:02); 

'100' rounding = FPRounding_TIEAWAY; 

'101' UNDEFINED; 

'110' rounding = FPRoundingMode(FPCR); exact = TRUE; 
'111' rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 

4H when Q = 0 

8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRoundInt(element, FPCR, rounding, exact); 


V[d] = result; 
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C7.2.161 | FRINTZ (scalar) 


ARM DDI 0487E.a 
ID070919 


Floating-point Round to Integral, toward Zero (scalar). This instruction rounds a floating-point value in the 
SIMD&FP source register to an integral floating-point value of the same size using the Round towards Zero 
rounding mode, and writes the result to the SIMD&FP destination register. 


A zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and 
a NaN is propagated as for normal arithmetic. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21201191817 |15 1413 12|1110 9. | 5 4| 0 | 


olojo 1771 oleo o 1fo7tfi 0000] Rn | Rd 


rmode 


Half-precision variant 
Applies when ftype == 11. 


FRINTZ <Hd>, <Hn> 


Single-precision variant 
Applies when ftype == 00. 


FRINTZ <Sd>, <Sn> 


Double-precision variant 
Applies when ftype == 01. 


FRINTZ <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 
case ftype of 
when 'QQ' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


FPRounding rounding; 
rounding = FPDecodeRounding('11'); 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
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C7-1734 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPRoundInt(operand, FPCR, rounding, FALSE); 


V[d] = result; 
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C7.2.162 FRSQRTE 


Floating-point Reciprocal Square Root Estimate. This instruction calculates an approximate square root for each 
vector element in the source SIMD&FP register, places the result in a vector, and writes the vector to the destination 
SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oat tit ofiitiooiti07io] mn | Rd 


Scalar half precision variant 


FRSQRTE <Hd>, <Hn> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fo afifi 141 ofijszf1 ooo ofa +110 1f1 of Rn | Ra | 


Scalar single-precision and double-precision variant 


FRSQRTE <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


Vector half precision 


ARMVv8.2 
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C7-1736 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


opo olii77+ 7001170710] Rn | Rd 


Vector half precision variant 


FRSQRTE <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Vector single-precision and double-precision 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


fofa}ijo 1 1 1 oftfse{1 o0 o o ols 110 1ļjr of Rn | Ra | 


Vector single-precision and double-precision variant 


FRSQRTE <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
8H when Q = 1 
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For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPRSqrtEstimate(element, FPCR); 


V[d] = result; 
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C7.2.163 


C7-1738 


FRSQRTS 


Floating-point Reciprocal Square Root Step. This instruction multiplies corresponding floating-point values in the 
vectors of the two source SIMD&FP registers, subtracts each of the products from 3.0, divides these results by 2.0, 


places the results into a vector, and writes the vector to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20 16/15 141312/1110 9 | 


eae tt o not] e e 


Scalar half precision variant 


FRSQRTS <Hd>, <Hn>, <Hm> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer esize = 16; 
integer datasize = esize; 
integer elements = 1; 


Scalar single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 


[o ajoji 1 1 1 ofilszfi] Rm ft ttt aft] R | Ra | 


Scalar single-precision and double-precision variant 


FRSQRTS <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 


Vector half precision 


ARMv8.2 
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|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


ofajojo 14 1 1 ojij of Rm fo ofi 1 aft] Rn | Ra | 


Vector half precision variant 


FRSQRTS <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9 | 5 4| 0| 


fofajojo 1 1 1 ofjilszfi] Rm ft ttt 1j] R | Ra | 


Vector single-precision and double-precision variant 


FRSQRTS <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '1@' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 

S when sz = 0 

D when sz = 1 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
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C7-1740 


<T> 


<Vn> 


<Vm> 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 


4H when Q = 0 
8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 


for e = 0 to elements-1 


V[d] 


elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
Elem[result, e, esize] = FPRSqrtStepFused(element1, element2) ; 


result; 
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C7.2.164 FSQRT (vector) 


ARM DDI 0487E.a 
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Floating-point Square Root (vector). This instruction calculates the square root for each vector element in the source 
SIMD&FP register, places the result in a vector, and writes the vector to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 


in either a flag being set in FPSR or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


opori opiiitio0ii7717J10] Rn | Rd 


Half-precision variant 


FSQRT <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Single-precision and double-precision 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oleo oi o 00011711 o] Rn | Rd 


Single-precision and double-precision variant 


FSQRT <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
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<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2s when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FPSqrt(element, FPCR); 


V[d] = result; 
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Floating-point Square Root (scalar). This instruction calculates the square root of the value in the SIMD&FP source 
register and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


olojo +7 71 Olfype]i[o 00 o 170000] Rn | Rd 


opc 


Half-precision variant 


Applies when ftype == 11. 


FSQRT <Hd>, <Hn> 


Single-precision variant 


Applies when ftype == 00. 


FSQRT <Sd>, <Sn> 


Double-precision variant 


Applies when ftype == 01. 


FSQRT <Dd>, <Dn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer datasize; 


case ftype of 


when 'QQ' 
when 'Q1' 
when '10' 
when '11' 


datasize = 32; 
datasize = 64; 
UNDEFINED; 


if HaveFP16Ext() then 
datasize = 16; 


else 


UNDEFINED; 


Assembler symbols 


<Dd> 


<Dn> 


<Hd> 


<Hn> 


<Sd> 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the 64-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 





Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
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<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) result; 
bits(datasize) operand = V[n]; 


result = FPSqrt(operand, FPCR); 


V[d] = result; 
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C7.2.166 FSUB (vector) 


Floating-point Subtract (vector). This instruction subtracts the elements in the vector in the second source 
SIMD&FP register, from the corresponding elements in the vector in the first source SIMD&FP register, places each 
result into elements of a vector, and writes the vector to the destination SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Half-precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0 | 


Pelon st ofits of Rm Jo ofo s ojij Re | Rd 


Half-precision variant 


FSUB <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean abs = (U == '1'); 


Single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


Ofafojo 7 4 4 of ifs] Rm fr to ojij Ro | Rd 


Single-precision and double-precision variant 


FSUB <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean abs = (U == '1'); 
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Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> For the half-precision variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
8H when Q = 1 


For the single-precision and double-precision variant: is an arrangement specifier, encoded in the 
"sz:Q" field. It can have the following values: 


2S when sz = 0, Q = 0 
4S when sz = 0, Q = 1 
2D when sz = 1,Q = 1 


The encoding sz = 1, Q = 0 is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 
bits(esize) diff; 


for e = 0 to elements-1 
elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
diff = FPSub(element1, element2, FPCR); 
Elem[result, e, esize] = if abs then FPAbs(diff) else diff; 


V[d] = result; 
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C7.2.167 FSUB (scalar) 


ARM DDI 0487E.a 
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Floating-point Subtract (scalar). This instruction subtracts the floating-point value of the second source SIMD&FP 
register from the floating-point value of the first source SIMD&FP register, and writes the result to the destination 


SIMD&FP register. 


This instruction can generate a floating-point exception. Depending on the settings in FPCR, the exception results 
in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16/15 141312/11109 | 5 4| 0 | 


elek oo ee 


Half-precision variant 
Applies when ftype == 11. 


FSUB <Hd>, <Hn>, <Hm> 


Single-precision variant 
Applies when ftype == 00. 


FSUB <Sd>, <Sn>, <Sm> 


Double-precision variant 
Applies when ftype == 01. 


FSUB <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize; 
case ftype of 
when '00' datasize = 32; 
when 'Q1' datasize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
datasize = 16; 
else 
UNDEFINED; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
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<Hn> Is the 16-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Hm> Is the 16-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) result; 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = 


I 
<= 
= 


result = FPSub(operand1, operand2 
V[d] = result; 
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C7.2.168 INS (element) 


Insert vector element from another vector element. This instruction copies the vector element of the source 
SIMD&FP register to the specified vector element of the destination SIMD&FP register. 


This instruction can insert data into individual elements within a SIMD&FP register without clearing the remaining 
bits to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is used by the alias MOV (element). The alias is always the preferred disassembly. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 11109 | 5 4| 0 | 


oorr ooo o] mms Jo) mm [i] Rn | Ro 


Advanced SIMD variant 
INS <Vd>.<Ts>[<index1>], <Vn>.<Ts>[<index2>] 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer size = LowestSetBit(imm5); 
if size > 3 then UNDEFINED; 


integer dst_index = UInt(imm5<4:size+1>); 

integer src_index = UInt(imm4<3:size>); 

integer idxdsize = if imm4<3> == '1' then 128 else 64; 
// imm4<size-1:0> is IGNORED 


integer esize = 8 << size; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ts> Is an element size specifier, encoded in the "imm5" field. It can have the following values: 
B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 
D when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


<index1> Is the destination element index encoded in the "imm5" field. It can have the following values: 
imm5<4:1> when imm5 = xxxx1 
imm5<4:2> when imm5 = xxx10 
imm5<4:3> when imm5 = xx100 
imm5<4> when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
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<index2> Is the source element index encoded in the "imm5:imm4" field. It can have the following values: 
imm4<3:0> when imm5 = xxxx1 
imm4<3:1> when imm5 = xxx10 
imm4<3:2> when immS = xx100 
imm4<3> when immS = x1000 
The encoding imm5 = xQ0QQ is reserved. 


Unspecified bits in "Imm4" are ignored but should be set to zero by an assembler. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(idxdsize) operand = V[n]; 
bits(128) result; 


result = V[d]; 
Elem[result, dst_index, esize] = Elem[operand, src_index, esize]; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.169 INS (general) 


Insert vector element from general-purpose register. This instruction copies the contents of the source 
general-purpose register to the specified vector element in the destination SIMD&FP register. 


This instruction can insert data into individual elements within a SIMD&FP register without clearing the remaining 
bits to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is used by the alias MOV (from general). The alias is always the preferred disassembly. 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


foffofo 770000] mms [ojoo7 [i] Rn | Rd 


Advanced SIMD variant 
INS <Vd>.<Ts>[<index>], <R><n> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer size = LowestSetBit(immS); 


if size > 3 then UNDEFINED; 
integer index = UInt(immS<4:size+1>) ; 


integer esize = 8 << size; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ts> Is an element size specifier, encoded in the "imm5" field. It can have the following values: 
B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 
D when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


<index> Is the element index encoded in the "imm5" field. It can have the following values: 
imm5<4:1> when imm5 = xxxx1 
imm5<4:2> when imm5 = xxx10 
imm5<4:3> when imm5 = xx100 
imm5<4> when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


<R> Is the width specifier for the general-purpose source register, encoded in the "imm5" field. It can 
have the following values: 
W when imm5 = xxxx1 
W when imm5 = xxx10 
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W when imm5 = xx100 
x when imm5 = x1000 


The encoding imm5 = x00QQ is reserved. 


<n> Is the number [0-30] of the general-purpose source register or ZR (31), encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(esize) element = X[n]; 
bits(128) result; 


result = V[d]; 
Elem[result, index, esize] = element; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.170 LD1 (multiple structures) 


ARM DDI 0487E.a 
ID070919 


Load multiple single-element structures to one, two, three, or four registers. This instruction loads multiple 
single-element structures from memory and writes the result to one, two, three, or four SIMD&FP registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 wu 10 9 = 5 4| 0| 
fojajo o 1 1 oo ofijo oo oo ole x1 x}eve] Rn | Rt __| 


opcode 


One register variant 
Applies when opcode == 0111. 


LD1 { <Vt>.<T> }, [<Xn|SP>] 


Two registers variant 
Applies when opcode == 1010. 


LD1 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>] 


Three registers variant 
Applies when opcode == 0110. 


LD1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>] 


Four registers variant 
Applies when opcode == 0010. 


LD1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>] 


Decode for all variants of this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 — 26 25 24|23 22 21 20| 16|15 12/1110 9 | 54| 0| 
jofayo 8 4100 ATO] m [x xT xeon e e 


opcode 


One register, immediate offset variant 
Applies when Rm == 11111 && opcode == 0111. 


LD1 { <Vt>.<T> }, [<Xn|SP>], <imm> 


One register, register offset variant 


Applies when Rm != 11111 && opcode == 0111. 
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LD1 { <Vt>.<T> }, [<Xn|SP>], <Xm> 


Two registers, immediate offset variant 


Applies when Rm == 11111 && opcode == 1010. 


LD1 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <imm> 


Two registers, register offset variant 


Applies when Rm != 11111 && opcode == 1010. 


LD1 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <Xm> 


Three registers, immediate offset variant 


Applies when Rm == 11111 && opcode == 0110. 


LD1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <imm> 


Three registers, register offset variant 


Applies when Rm != 11111 && opcode == 0110. 


LD1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <Xm> 


Four registers, immediate offset variant 


Applies when Rm == 11111 && opcode == 0010. 


LD1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <imm> 


Four registers, register offset variant 


Applies when Rm != 11111 && opcode == 0010. 


LD1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t 
integer n 
integer m 


UInt (Rt) ; 
UInt(Rn) ; 
UInt (Rm) ; 
boolean whack = TRUE; 


boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> 


<T> 


<Vt2> 


<Vt3> 


C7-1754 
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Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
1D 
2D 


when size 


when size 


when size = 


when size = 


when size 


when size = 


when size 


when size 


00, Q = 
00, Q = 
01, Q = 
01, Q = 
10, Q = 
10, Q = 
11,Q = 
11, Q = 


0 


PF © re © FP Or 


Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 


Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
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<Xn | SP> 


<imm> 


<Xm> 
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Is the name of the fourth SIMD&FP register to be transferred, encoded as "Rt" plus 3 modulo 32. 
Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
For the one register, immediate offset variant: is the post-index immediate offset, encoded in the "Q" 
field. It can have the following values: 

#8 when Q = 0 

#16 when Q = 1 


For the two registers, immediate offset variant: is the post-index immediate offset, encoded in the 
"Q" field. It can have the following values: 


#16 when Q = 0 
#32 when Q = 1 


For the three registers, immediate offset variant: is the post-index immediate offset, encoded in the 
"Q" field. It can have the following values: 


#24 when Q = 0 
#48 when Q = 1 


For the four registers, immediate offset variant: is the post-index immediate offset, encoded in the 
"Q" field. It can have the following values: 


#32 when Q = 0 
#64 when Q = 1 


Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 


integer esize 


= 8 << UInt(size); 


integer elements = datasize DIV esize; 


integer rpt; 


// number of iterations 


integer selem; // structure elements 


case opcode of 


when '0000' rpt = 1; selem = 4; // LD/ST4 (4 registers) 
when '0010' rpt = 4; selem = 1; // LD/ST1 (4 registers) 
when '0100' rpt = 1; selem = 3; // LD/ST3 (3 registers) 
when '0110' rpt = 3; selem = 1; // LD/ST1 (3 registers) 
when 'Q111' rpt = 1; selem = 1; // LD/ST1 (1 register) 
when '1000' rpt = 1; selem = 2; // LD/ST2 (2 registers) 
when '1010' rpt = 2; selem = 1; // LD/ST1 (2 registers) 
otherwise UNDEFINED; 


// .1D format only permitted with LD1 & ST1 
if size:Q == '110' && selem != 1 then UNDEFINED; 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 
bits(64) offs; 
bits(datasize) rval; 


integer tt; 


constant integer ebytes = esize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 
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if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
for r = Q to rpt-1 
for e = 0 to elements-1 
tt = (t + r) MOD 32; 
for s = @ to selem-1 
rval = V[tt]; 
if memop == MemOp_LOAD then 
Elem[rval, e, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[tt] = rval; 
else // memop == MemOp_STORE 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, e, esize]; 
offs = offs + ebytes; 
tt = (tt + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 


X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.171 LD1 (single structure) 


ARM DDI 0487E.a 
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Load one single-element structure to one lane of one register. This instruction loads a single-element structure from 
memory and writes the result to the specified lane of the SIMD&FP register without affecting the other bits of the 


register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 a 20|19 18 17 16|15 ew 109 | 5 4| 0| 
Gf CBE RC CSN a 


opcode 


8-bit variant 
Applies when opcode == 000. 


LD1 { <Vt>.B }[<index>], [<Xn|SP>] 


16-bit variant 
Applies when opcode == 010 && size == x0. 


LD1 { <Vt>.H }[<index>], [<Xn|SP>] 


32-bit variant 
Applies when opcode == 100 && size == 00. 


LD1 { <Vt>.S }[<index>], [<Xn|SP>] 


64-bit variant 
Applies when opcode == 100 && S == 0 && size == 01. 


LD1 { <Vt>.D }[<index>], [<Xn|SP>] 


Decode for all variants of this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16\15  1312/11109 | 54| 0| 
Ofajo oF oF tipo] Rm |x x ofs|sze] Re | Rt__| 


opcode 


8-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 000. 


LD1 { <Vt>.B }[<index>], [<Xn|SP>], #1 


8-bit, register offset variant 


Applies when Rm != 11111 && opcode == 000. 
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C7-1758 


LD1 { <Vt>.B }[<index>], [<Xn|SP>], <Xm> 


16-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 010 && size == x0. 


LD1 { <Vt>.H }[<index>], [<Xn|SP>], #2 


16-bit, register offset variant 
Applies when Rm != 11111 && opcode == 010 && size == x0. 


LD1 { <Vt>.H }[<index>], [<Xn|SP>], <Xm> 


32-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 100 && size == 00. 


LD1 { <Vt>.S }[<index>], [<Xn|SP>], #4 


32-bit, register offset variant 
Applies when Rm != 11111 && opcode == 100 && size == 00. 


LD1 { <Vt>.S }[<index>], [<Xn|SP>], <Xm> 


64-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 100 && S == 0 && size == 01. 


LD1 { <Vt>.D }[<index>], [<Xn|SP>], #8 


64-bit, register offset variant 
Applies when Rm != 11111 && opcode == 100 && S == 0 && size == 01. 


LD1 { <Vt>.D }[<index>], [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 
<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 


<index> For the 8-bit variant: is the element index, encoded in "Q:S:size". 
For the 16-bit variant: is the element index, encoded in "Q:S:size<1>". 
For the 32-bit variant: is the element index, encoded in "Q:S". 


For the 64-bit variant: is the element index, encoded in "Q". 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<0>:R) + 1; 
boolean replicate = FALSE; 
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integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[0-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 
Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[t] = rval; 
else // memop == MemOp_STORE 
// extract from one lane of 128-bit register 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
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if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.172 LDIR 


ARM DDI 0487E.a 
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Load one single-element structure and Replicate to all lanes (of one register). This instruction loads a single-element 
structure from memory and replicates the structure to all the lanes of the SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 


|31 30 29 28|27 26 25 24|23 22 21 20/1918 1716/15 1312/11109 | 5 4| o| 


ajo o i tot ojifojo ooo E Rn | Rt 


opcode S 


No offset variant 


LDIR { <Vt>.<T> }, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/1109 | 5 4| 0 | 


ajo o i tot afifof rm [r 1 ofo}size| Rn | Rt 


opcode S 


Immediate offset variant 
Applies when Rm == 11111. 


LDIR { <Vt>.<T> }, [<Xn|SP>], <imm> 


Register offset variant 
Applies when Rm != 11111. 


LDIR { <Vt>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 
<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 


<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
1D when size = 11,Q = 0 
2D when size = 11,Q = 1 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<imm> Is the post-index immediate offset, encoded in the "size" field. It can have the following values: 
#1 when size = 00 
#2 when size = 01 
#4 when size = 10 
#8 when size = 11 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<0>:R) + 1; 
boolean replicate = FALSE; 

integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[0-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 


integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 
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if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = Q to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = @ to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 


Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 


V[t] = rval; 
else // memop == MemOp_STORE 
// extract from one lane of 128-bit register 


Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 


offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] 


address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.173 LD2 (multiple structures) 


Load multiple 2-element structures to two registers. This instruction loads multiple 2-element structures from 
memory and writes the result to the two SIMD&FP registers, with de-interleaving. 


For an example of de-interleaving, see LD3 (multiple structures). 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 | 5 4| 0 | 


ajo oi too ofifo ood 0j 00 olse] Rn | n | 


opcode 


No offset variant 


LD2 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 


|31 30 29 28|27 26 25 24|23 22 21 20) 16/15 12/1110 9 | 5 4| 0| 


elaloo11001jrjo| rm [rooolse| R | n | 


opcode 


Immediate offset variant 
Applies when Rm == 11111. 


LD2 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <imm> 


Register offset variant 
Applies when Rm != 11111. 


LD2 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean wback = TRUE; 
boolean tag_checked = wback || n != 31; 


Assembler symbols 
<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 


<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = @ 


C7-1764 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q=1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<imm> Is the post-index immediate offset, encoded in the "Q" field. It can have the following values: 
#16 when Q = 0 
#32 when Q = 1 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 

integer esize = 8 << UInt(size); 

integer elements = datasize DIV esize; 


integer rpt; // number of iterations 
integer selem; // structure elements 


case opcode of 


when '0000' rpt = 1; selem = 4; // LD/ST4 (4 registers) 
when '0010' rpt = 4; selem = 1; // LD/ST1 (4 registers) 
when '0100' rpt = 1; selem = 3; // LD/ST3 (3 registers) 
when 'Q110' rpt = 3; selem = 1; // LD/ST1 (3 registers) 
when 'Q111' rpt = 1; selem = 1; // LD/ST1 (1 register) 
when '1000' rpt = 1; selem = 2; // LD/ST2 (2 registers) 
when '1010' rpt = 2; selem = 1; // LD/ST1 (2 registers) 
otherwise UNDEFINED; 


// .1D format only permitted with LD1 & ST1 
if size:Q == '110' && selem != 1 then UNDEFINED; 


Operation for all encodings 
CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(datasize) rval; 

integer tt; 

constant integer ebytes = esize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
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for r = Q to rpt-1 
for e = Q to elements-1 
tt = (t + r) MOD 32; 
for s = @ to selem-1 
rval = V[tt]; 
if memop == MemOp_LOAD then 
Elem[rval, e, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[tt] = rval; 
else // memop == MemOp_STORE 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, e, esize]; 
offs = offs + ebytes; 
tt = (tt + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.174 LD2 (single structure) 


ARM DDI 0487E.a 
ID070919 


Load single 2-element structure to one lane of two registers. This instruction loads a 2-element structure from 
memory and writes the result to the corresponding elements of the two SIMD&FP registers without affecting the 


other bits of the registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 S 20|19 18 17 16|15 ew 109 | 5 4| 0| 
Gf CBE CH a 


opcode 


8-bit variant 
Applies when opcode == 000. 


LD2 { <Vt>.B, <Vt2>.B }[<index>], [<Xn|SP>] 


16-bit variant 
Applies when opcode == 010 && size == x0. 


LD2 { <Vt>.H, <Vt2>.H }[<index>], [<Xn|SP>] 


32-bit variant 
Applies when opcode == 100 && size == 00. 


LD2 { <Vt>.S, <Vt2>.S }[<index>], [<Xn|SP>] 


64-bit variant 
Applies when opcode == 100 && S == 0 && size == 01. 


LD2 { <Vt>.D, <Vt2>.D }[<index>], [<Xn|SP>] 


Decode for all variants of this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16\15  1312/11109 | 54| 0| 
ofajo oF vos tipi] Rm |x x ofs|sze] Ro | Rt 


opcode 


8-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 000. 


LD2 { <Vt>.B, <Vt2>.B }[<index>], [<Xn|SP>], #2 


8-bit, register offset variant 


Applies when Rm != 11111 && opcode == 000. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


C7-1767 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


LD2 { <Vt>.B, <Vt2>.B }[<index>], [<Xn|SP>], <Xm> 


16-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 010 && size == x0. 


LD2 { <Vt>.H, <Vt2>.H }[<index>], [<Xn|SP>], #4 


16-bit, register offset variant 
Applies when Rm != 11111 && opcode == 010 && size == x0. 


LD2 { <Vt>.H, <Vt2>.H }[<index>], [<Xn|SP>], <Xm> 


32-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 100 && size == 00. 


LD2 { <Vt>.S, <Vt2>.S }[<index>], [<Xn|SP>], #8 


32-bit, register offset variant 
Applies when Rm != 11111 && opcode == 100 && size == 00. 


LD2 { <Vt>.S, <Vt2>.S }[<index>], [<Xn|SP>], <Xm> 


64-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 100 && S == 0 && size == 01. 


LD2 { <Vt>.D, <Vt2>.D }[<index>], [<Xn|SP>], #16 


64-bit, register offset variant 
Applies when Rm != 11111 && opcode == 100 && S == 0 && size == 01. 


LD2 { <Vt>.D, <Vt2>.D }[<index>], [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<index> For the 8-bit variant: is the element index, encoded in "Q:S:size". 


For the 16-bit variant: is the element index, encoded in "Q:S:size<1>". 
For the 32-bit variant: is the element index, encoded in "Q:S". 


For the 64-bit variant: is the element index, encoded in "Q". 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 
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Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<@>:R) + 1; 
boolean replicate = FALSE; 

integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[Q-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 


Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 


V[t] = rval; 
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else // memop == MemOp_STORE 

// extract from one lane of 128-bit register 

Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.175 LD2R 


ARM DDI 0487E.a 
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Load single 2-element structure and Replicate to all lanes of two registers. This instruction loads a 2-element 
structure from memory and replicates the structure to all the lanes of the two SIMD&FP registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 oe eee ee 20|19 18 17 16|15 1312/11109 | 5 4| 0 | 
fofafoo 1101 elit fo o o 0 0j1 1 ofofsze{ Rn | R | 
opcode S 
No offset variant 
LD2R { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>] 
Decode for this encoding 
integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = integer UNKNOWN; 
boolean whack = FALSE; 
boolean tag_checked = whack || n != 31; 
Post-index 
|31 30 29 28|27 26 25 24/23 22 21 20| 1615 1312/11109 | 5 4| 0 | 
ajo od tor sift} rm |i 1 ofo}size| Rn | Rt 
opcode S 
Immediate offset variant 
Applies when Rm == 11111. 
LD2R { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <imm> 
Register offset variant 
Applies when Rm != 11111. 
LD2R { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <Xm> 
Decode for all variants of this encoding 
integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 
Assembler symbols 
<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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C7-1772 


4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10, Q = 0 

4S when size = 10,Q = 1 

1D when size = 11,Q = 0 

2D when size = 11,Q = 1 
<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<imm> Is the post-index immediate offset, encoded in the "size" field. It can have the following values: 

#2 when size = 00 

#4 when size = 01 

#8 when size = 10 

#16 when size = 11 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 

field. 


Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<@>:R) + 1; 
boolean replicate = FALSE; 

integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when 0 
index = UInt(Q:S:size); // B[@-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[0-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 
bits(64) address; 


bits(64) offs; 
bits(128) rval; 
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bits(esize) element; 
constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = @ to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 
Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[t] = rval; 
else // memop == MemOp_STORE 
// extract from one lane of 128-bit register 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.176 


C7-1774 


LD3 (multiple structures) 


Load multiple 3-element structures to three registers. This instruction loads multiple 3-element structures from 
memory and writes the result to the three SIMD&FP registers, with de-interleaving. 


The following figure shows the operation of de-interleaving of a LD3.16 (multiple 3-element structures) 
instruction:. 

Memory 
AlO].x 
Al0].-y 


AlO}.z 
Amx 
Ais a packed arrayof |AD]y 


3-element structures. A[1].z \ 
Each element is a 16-bit | A[2].x 
halfword. A[2].y 
A[2].z 
AI3].x m 
A[3].y 
A[3].Z1+— ‘ 


[Z3]Z2]Z1|Zo| D2 
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D1 Registers 

















Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 | 5 4| 0| 


olojo o 11o oomoo 0o00 olo 10 0ofsæe] Rn | R| 
L 


opcode 


No offset variant 


LD3 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean wback = FALSE; 

boolean tag_checked = wback || n != 31; 


Post-index 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4| 0 | 


[ofaļlo o 1100 1ļj1jo] Rm [o 10 ojsize] Rn | R | 
L 


opcode 


Immediate offset variant 
Applies when Rm == 11111. 


LD3 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <imm> 


Register offset variant 


Applies when Rm != 11111. 
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LD3 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t 
integer n 
integer m 


UInt (Rt) ; 
UInt(Rn) ; 
UInt (Rm) ; 


boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> 


<T> 


<Vt2> 
<Vt3> 
<Xn | SP> 


<imm> 


<Xm> 


Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00, Q = 0 


16B when size = 00, Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 

Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Is the post-index immediate offset, encoded in the "Q" field. It can have the following values: 
#24 when Q = 0 
#48 when Q = 1 


Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 


integer esize 


= 8 << UInt(size); 


integer elements = datasize DIV esize; 


integer rpt; 


// number of iterations 


integer selem; // structure elements 


case opcode of 


when '0000' rpt = 1; selem = 4; // LD/ST4 (4 registers) 
when '0010' rpt = 4; selem = 1; // LD/ST1 (4 registers) 
when 'Q100' rpt = 1; selem = 3; // LD/ST3 (3 registers) 
when 'Q110' rpt = 3; selem = 1; // LD/ST1 (3 registers) 
when 'Q111' rpt = 1; selem = 1; // LD/ST1 (1 register) 
when '1000' rpt = 1; selem = 2; // LD/ST2 (2 registers) 
when '1010' rpt = 2; selem = 1; // LD/ST1 (2 registers) 
otherwise UNDEFINED; 


// .1D format only permitted with LD1 & ST1 
== '110' && selem != 1 then UNDEFINED; 


if size: 


ARM DDI 0487E.a 
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Operation for all encodings 
CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(datasize) rval; 

integer tt; 

constant integer ebytes = esize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
for r = Q to rpt-1 
for e = 0 to elements-1 
tt = (t + r) MOD 32; 
for s = @ to selem-1 
rval = V[tt]; 
if memop == MemOp_LOAD then 
Elem[rval, e, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[tt] = rval; 
else // memop == MemOp_STORE 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, e, esize]; 
offs = offs + ebytes; 
tt = (tt + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.177 LD3 (single structure) 


ARM DDI 0487E.a 
ID070919 


Load single 3-element structure to one lane of three registers). This instruction loads a 3-element structure from 
memory and writes the result to the corresponding elements of the three SIMD&FP registers without affecting the 
other bits of the registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 a 20|19 18 17 1416|15 1312\11109 | 5 4| 0 | 
meper rore oe a ee a 


opcode 


8-bit variant 
Applies when opcode == 001. 


LD3 { <Vt>.B, <Vt2>.B, <Vt3>.B }[<index>], [<Xn|SP>] 


16-bit variant 
Applies when opcode == 011 && size == x0. 


LD3 { <Vt>.H, <Vt2>.H, <Vt3>.H }[<index>], [<Xn|SP>] 


32-bit variant 
Applies when opcode == 101 && size == 00. 


LD3 { <Vt>.S, <Vt2>.S, <Vt3>.S }[<index>], [<Xn|SP>] 


64-bit variant 
Applies when opcode == 101 && S == 0 && size == 01. 


LD3 { <Vt>.D, <Vt2>.D, <Vt3>.D }[<index>], [<Xn|SP>] 


Decode for all variants of this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15  1312/11109 | 54| 0| 
Ofajo oF oF tipo] Rm |x x i]s|sze] Re | Rt 


opcode 


8-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 001. 


LD3 { <Vt>.B, <Vt2>.B, <Vt3>.B }[<index>], [<Xn|SP>], #3 


8-bit, register offset variant 


Applies when Rm != 11111 && opcode == 001. 
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LD3 { <Vt>.B, <Vt2>.B, <Vt3>.B }[<index>], [<Xn|SP>], <Xm> 


16-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 011 && size == x0. 


LD3 { <Vt>.H, <Vt2>.H, <Vt3>.H }[<index>], [<Xn|SP>], #6 


16-bit, register offset variant 
Applies when Rm != 11111 && opcode == 011 && size == x0. 


LD3 { <Vt>.H, <Vt2>.H, <Vt3>.H }[<index>], [<Xn|SP>], <Xm> 


32-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 101 && size == 00. 


LD3 { <Vt>.S, <Vt2>.S, <Vt3>.S }[<index>], [<Xn|SP>], #12 


32-bit, register offset variant 
Applies when Rm != 11111 && opcode == 101 && size == 00. 


LD3 { <Vt>.S, <Vt2>.S, <Vt3>.S }[<index>], [<Xn|SP>], <Xm> 


64-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 101 && S == 0 && size == 01. 


LD3 { <Vt>.D, <Vt2>.D, <Vt3>.D }[<index>], [<Xn|SP>], #24 


64-bit, register offset variant 
Applies when Rm != 11111 && opcode == 101 && S == 0 && size == 01. 


LD3 { <Vt>.D, <Vt2>.D, <Vt3>.D }[<index>], [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Vt3> Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
<index> For the 8-bit variant: is the element index, encoded in "Q:S:size". 


For the 16-bit variant: is the element index, encoded in "Q:S:size<1>". 
For the 32-bit variant: is the element index, encoded in "Q:S". 


For the 64-bit variant: is the element index, encoded in "Q". 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 
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Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<@>:R) + 1; 
boolean replicate = FALSE; 

integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[Q-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 


Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 


V[t] = rval; 
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else // memop == MemOp_STORE 

// extract from one lane of 128-bit register 

Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.178 LD3R 


ARM DDI 0487E.a 
ID070919 


Load single 3-element structure and Replicate to all lanes of three registers. This instruction loads a 3-element 
structure from memory and replicates the structure to all the lanes of the three SIMD&FP registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 S 20|19 18 17 1416|15 1312/11109 | 5 4| 0 | 
lojajoo 1101 aele o o 0o oļ1 1 1foļsize| Rn | R | 


opcode S 


No offset variant 


LD3R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15  1312/11109 | 5 4| o] 
lajo ot tot aifof rm [r 1 tfo]sie| R | rn | 


opcode S 


Immediate offset variant 
Applies when Rm == 11111. 


LD3R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <imm> 


Register offset variant 
Applies when Rm != 11111. 


LD3R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean wback = TRUE; 
boolean tag_checked = wback || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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<Vt2> 
<Vt3> 
<Xn | SP> 


<imm> 


<Xm> 


4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 
1D when size = 11,Q = 0 
2D when size = 11,Q = 1 


Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Is the post-index immediate offset, encoded in the "size" field. It can have the following values: 


#3 when size = 00 
#6 when size = 01 
#12 when size = 10 
#24 when size = 11 


Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


integer scale 
integer selem 


= UInt(opcode<2:1>); 
= UInt(opcode<@>:R) + 1; 


boolean replicate = FALSE; 
integer index; 


case scale of 
when 3 


// load and replicate 
if L == 'Q' |] S == '1' then UNDEFINED; 


scale 


= UInt(size); 


replicate = TRUE; 


when Q 
index 
when 1 


= UInt(Q:S:size); // B[O-15] 


if size<@> == '1' then UNDEFINED; 


index 
when 2 


= UInt(Q:S:size<1>); // H[0-7] 


if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[0-3] 


else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = 


if L == '1' then MemOp_LOAD else MemOp_STORE; 


integer datasize = if Q == '1' then 128 else 64; 


integer esize 


= 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 
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bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = @ to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 
Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[t] = rval; 
else // memop == MemOp_STORE 
// extract from one lane of 128-bit register 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.179 


C7-1784 


LD4 (multiple structures) 


Load multiple 4-element structures to four registers. This instruction loads multiple 4-element structures from 
memory and writes the result to the four SIMD&FP registers, with de-interleaving. 


For an example of de-interleaving, see LD3 (multiple structures). 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 ni 10 9 m 5 4| 0| 
fojajo o 1 1 co ofifo oo oo ojo 00 ojsæej Rn | r | 


opcode 


No offset variant 


LD4 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 iii 10 9 = 5 4| 0| 
lojajoo1100 tfi}o] Rm {ooo ofsve] Rn | r | 


opcode 


Immediate offset variant 
Applies when Rm == 11111. 


LD4 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <imm> 


Register offset variant 
Applies when Rm != 11111. 


LD4 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
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16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q=1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 

Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
Is the name of the fourth SIMD&FP register to be transferred, encoded as "Rt" plus 3 modulo 32. 
Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Is the post-index immediate offset, encoded in the "Q" field. It can have the following values: 
#32 when Q = 0 
#64 when Q = 1 


Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 

integer esize = 8 << UInt(size); 

integer elements = datasize DIV esize; 


integer rpt; 


// number of iterations 


integer selem; // structure elements 


case opcode of 


when 
when 
when 
when 
when 
when 
when 


otherwise UNDEFIN 


"Q000' rpt = 1; selem = 4; // LD/ST4 (4 registers) 
"Q010' rpt = 4; selem = 1; // LD/ST1 (4 registers) 
"Q100' rpt = 1; selem = 3; // LD/ST3 (3 registers) 
"Q110' rpt = 3; selem = 1; // LD/ST1 (3 registers) 
'0111' rpt = 1; selem = 1; // LD/ST1 (1 register) 
'1000' rpt = 1; selem = 2; // LD/ST2 (2 registers) 
'1010' rpt = 2; selem = 1; // LD/ST1 (2 registers) 
D; 


// .1D format only permitted with LD1 & ST1 
if size:Q == '110' && selem != 1 then UNDEFINED; 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 
bits(64) offs; 
bits(datasize) rval; 


integer tt; 


constant integer ebytes = esize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
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else 
address = X[n]; 


offs = Zeros(); 
for r = Q to rpt-1 
for e = 0 to elements-1 
tt = (t + r) MOD 32; 
for s = @ to selem-1 
rval = V[tt]; 
if memop == MemOp_LOAD then 
Elem[rval, e, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[tt] = rval; 
else // memop == MemOp_STORE 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, e, esize]; 
offs = offs + ebytes; 
tt = (tt + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 


X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.180 LD4 (single structure) 


ARM DDI 0487E.a 
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Load single 4-element structure to one lane of four registers. This instruction loads a 4-element structure from 
memory and writes the result to the corresponding elements of the four SIMD&FP registers without affecting the 
other bits of the registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 S 20|19 18 17 1416|15 1312|1110 9 | 5 4| 0 | 
meper coreia a ee a 


opcode 


8-bit variant 
Applies when opcode == 001. 


LD4 { <Vt>.B, <Vt2>.B, <Vt3>.B, <Vt4>.B }[<index>], [<Xn|SP>] 


16-bit variant 
Applies when opcode == 011 && size == x0. 


LD4 { <Vt>.H, <Vt2>.H, <Vt3>.H, <Vt4>.H }[<index>], [<Xn|SP>] 


32-bit variant 
Applies when opcode == 101 && size == 00. 


LD4 { <Vt>.S, <Vt2>.S, <Vt3>.S, <Vt4>.S }[<index>], [<Xn|SP>] 


64-bit variant 
Applies when opcode == 101 && S == 0 && size == 01. 


LD4 { <Vt>.D, <Vt2>.D, <Vt3>.D, <Vt4>.D }[<index>], [<Xn|SP>] 


Decode for all variants of this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15  1312/11109 | 54| 0| 
Ofajo oF vos tipi] Rm |x x i]S|sze] Re | Rt 


opcode 


8-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 001. 


LD4 { <Vt>.B, <Vt2>.B, <Vt3>.B, <Vt4>.B }[<index>], [<Xn|SP>], #4 


8-bit, register offset variant 


Applies when Rm != 11111 && opcode == 001. 
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C7-1788 


LD4 { <Vt>.B, <Vt2>.B, <Vt3>.B, <Vt4>. 


16-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 


LD4 { <Vt>.H, <Vt2>.H, <Vt3>.H, <Vt4> 


16-bit, register offset variant 
Applies when Rm != 11111 && opcode == 


LD4 { <Vt>.H, <Vt2>.H, <Vt3>.H, <Vt4> 


32-bit, immediate offset variant 


Applies when Rm == 11111 && opcode == 


LD4 { <Vt>.S, <Vt2>.S, <Vt3>.S, <Vt4>. 


32-bit, register offset variant 


Applies when Rm != 11111 && opcode == 


LD4 { <Vt>.S, <Vt2>.S, <Vt3>.S, <Vt4>. 


64-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 


LD4 { <Vt>.D, <Vt2>.D, <Vt3>.D, <Vt4> 


64-bit, register offset variant 


Applies when Rm != 11111 && opcode == 


LD4 { <Vt>.D, <Vt2>.D, <Vt3>.D, <Vt4>. 


B }[<index>], [<Xn|SP>], <Xm> 


011 && size == xQ. 


.H }[<index>], [<Xn|SP>], #8 


011 && size == xQ. 


.H }[<index>], [<Xn|SP>], <Xm> 


101 && size == 00. 


S }[<index>], [<Xn|SP>], #16 


101 && size == 00. 


S }[<index>], [<Xn|SP>], <Xm> 


101 && S == @ && size == 01. 


.D }[<index>], [<Xn|SP>], #32 


101 && S == @ && size == 01. 


D }[<index>], [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 


boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Vt3> Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
<Vt4> Is the name of the fourth SIMD&FP register to be transferred, encoded as "Rt" plus 3 modulo 32. 
<index> For the 8-bit variant: is the element index, encoded in "Q:S:size". 


For the 16-bit variant: is the element index, encoded in "Q:S:size<1>". 


For the 32-bit variant: is the element index, encoded in "Q:S". 


For the 64-bit variant: is the element index, encoded in "Q". 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 
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Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<@>:R) + 1; 
boolean replicate = FALSE; 

integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[Q-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 


Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 


V[t] = rval; 
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else // memop == MemOp_STORE 

// extract from one lane of 128-bit register 

Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.181 LD4R 


ARM DDI 0487E.a 
ID070919 


Load single 4-element structure and Replicate to all lanes of four registers. This instruction loads a 4-element 
structure from memory and replicates the structure to all the lanes of the four SIMD&FP registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 a 20|19 18 17 1416|15 1312/11109 | 5 4| 0 | 
lojajoo 1101 aaie o o 0o oļ1 1 1foļsize]| Rn | R | 


opcode S 


No offset variant 


LD4R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean wback = FALSE; 

boolean tag_checked = wback || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312|1110 9 | 5 4| 0| 
lajo ot tot aif] rm |i 1 tfo}sie| R | Rt 


opcode S 


Immediate offset variant 
Applies when Rm == 11111. 


LD4R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <imm> 


Register offset variant 
Applies when Rm != 11111. 


LD4R { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10, Q = 0 

4S when size = 10,Q = 1 

1D when size = 11,Q = 0 

2D when size = 11,Q = 1 
<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Vt3> Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
<Vt4> Is the name of the fourth SIMD&FP register to be transferred, encoded as "Rt" plus 3 modulo 32. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<imm> Is the post-index immediate offset, encoded in the "size" field. It can have the following values: 

#4 when size = 00 

#8 when size = 01 

#16 when size = 10 

#32 when size = 11 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 

field. 


Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<@>:R) + 1; 
boolean replicate = FALSE; 

integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[0-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 
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bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 
Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[t] = rval; 
else // memop == MemOp_STORE 
// extract from one lane of 128-bit register 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] 


address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1793 
ID070919 Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.182 LDNP (SIMD&FP) 


Load Pair of SIMD&FP registers, with Non-temporal hint. This instruction loads a pair of SIMD&FP registers from 
memory, issuing a hint to the memory system that the access is non-temporal. The address that is used for the load 
is calculated from a base register value and an optional immediate offset. 


For information about non-temporal pair instructions, see Load/Store SIMD and Floating-point Non-temporal pair 
on page C3-206. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 2221 | |1514 | 109 | 5 4| 0 | 


fone [7 oo 0 oli] mm? | Re | Rn | Rt 
L 


32-bit variant 

Applies when opc == 00. 

LDNP <St1>, <St2>, [<Xn|SP>{, #<imm>}] 
64-bit variant 

Applies when opc == 01. 

LDNP <Dtl>, <Dt2>, [<Xn|SP>{, #<imm>}] 
128-bit variant 

Applies when opc == 10. 

LDNP <Qtl>, <Qt2>, [<Xn|SP>{, #<imm>}] 
Decode for all variants of this encoding 


// Empty. 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly LDNP (SIMD&FP) on page K1-7637. 


Assembler symbols 








<Dt1> Is the 64-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Dt2> Is the 64-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
<Qtl> Is the 128-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Qt2> Is the 128-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
<St1> Is the 32-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 
<St2> Is the 32-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<imm> For the 32-bit variant: is the optional signed immediate byte offset, a multiple of 4 in the range -256 


to 252, defaulting to 0 and encoded in the "imm7" field as <imm>/4. 
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For the 64-bit variant: is the optional signed immediate byte offset, a multiple of 8 in the range -512 


to 504, defaulting to 0 and encoded in the "imm7" field as <imm>/8. 


For the 128-bit variant: is the optional signed immediate byte offset, a multiple of 16 in the range 


-1024 to 1008, defaulting to 0 and encoded in the "imm7" field as <imm>/16. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer t2 = UInt(Rt2); 

if opc == '11' then UNDEFINED; 

integer scale = 2 + UInt(opc); 

integer datasize = 8 << scale; 

bits(64) offset = LSL(SignExtend(imm7, 64), scale); 
boolean tag_checked = n != 31; 


Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(datasize) datal; 

bits(datasize) data2; 

constant integer dbytes = datasize DIV 8; 
boolean rt_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if t == t2 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; // result is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


datal = Mem[address, dbytes, AccType_VECSTREAM] ; 
data2 = Mem[address+dbytes, dbytes, AccType_VECSTREAM] ; 
if rt_unknown then 
datal = bits(datasize) UNKNOWN; 
data2 = bits(datasize) UNKNOWN; 
V[t] = datal; 
V[t2] = data2; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.183 LDP (SIMD&FP) 


Load Pair of SIMD&FP registers. This instruction loads a pair of SIMD&FP registers from memory. The address 
that is used for the load is calculated from a base register value and an optional immediate offset. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Post-index 


|31 30 29 28|27 26 25 24|23 2221 | |1514 | 109 | 5 4| o| 


L 


32-bit variant 

Applies when opc == 00. 

LDP <St1>, <St2>, [<Xn|SP>], #<imm> 
64-bit variant 

Applies when opc == 01. 

LDP <Dt1>, <Dt2>, [<Xn|SP>], #<imm> 
128-bit variant 

Applies when opc == 10. 

LDP <Qt1>, <Qt2>, [<Xn|SP>], #<imm> 


Decode for all variants of this encoding 


boolean whack = TRUE; 
boolean postindex = TRUE; 


Pre-index 


|31 30 29 28/27 26 25 24|23 2221 | |1514 | 109 | 5 4| 0| 


L 


32-bit variant 

Applies when opc == 00. 

LDP <Stl>, <St2>, [<Xn|SP>, #<imm>]! 
64-bit variant 

Applies when opc == 01. 

LDP <Dtl>, <Dt2>, [<Xn|SP>, #<imm>]! 
128-bit variant 

Applies when opc == 10. 


LDP <Qtl>, <Qt2>, [<Xn|SP>, #<imm>]! 
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Decode for all variants of this encoding 


boolean whack 


= TRUE; 


boolean postindex = FALSE; 


Signed offset 


|31 30 29 28|27 26 25 24|23 2221 | |1514 | 109 | 5 4| 0 | 


L 


32-bit variant 


Applies when opc == 00. 


LDP <Stl>, <St2>, [<Xn|SP>{, #<imm>}] 


64-bit variant 


Applies when opc == 01. 


LDP <Dtl>, <Dt2>, [<Xn|SP>{, #<imm>}] 


128-bit variant 


Applies when opc == 10. 


LDP <Qtl>, <Qt2>, [<Xn|SP>{, #<imm>}] 


Decode for all variants of this encoding 


boolean whack 


= FALSE; 


boolean postindex = FALSE; 


Notes for all encodings 


For information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see LDP (SIMD&FP) on 
page K1-7638, and particularly LDNP (SIMD&FP) on page K1-7637. 


Assembler symbols 








<Dt1> Is the 64-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Dt2> Is the 64-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
<Qtl> Is the 128-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Qt2> Is the 128-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
<St1> Is the 32-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 
<St2> Is the 32-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<imm> For the 32-bit post-index and 32-bit pre-index variant: is the signed immediate byte offset, a 
multiple of 4 in the range -256 to 252, encoded in the "imm7" field as <imm>/4. 
For the 32-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 4 in 
the range -256 to 252, defaulting to 0 and encoded in the "imm/7" field as <imm>/4. 
For the 64-bit post-index and 64-bit pre-index variant: is the signed immediate byte offset, a 
multiple of 8 in the range -512 to 504, encoded in the "imm7" field as <imm>/8. 
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C7-1798 


For the 64-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 8 in 
the range -512 to 504, defaulting to 0 and encoded in the "imm/7" field as <imm>/8. 


For the 128-bit post-index and 128-bit pre-index variant: is the signed immediate byte offset, a 
multiple of 16 in the range -1024 to 1008, encoded in the "imm7" field as <imm>/16. 


For the 128-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 16 
in the range -1024 to 1008, defaulting to 0 and encoded in the "imm7" field as <imm>/16. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer t2 = UInt(Rt2); 

if opc == '11' then UNDEFINED; 

integer scale = 2 + UInt(opc); 

integer datasize = 8 << scale; 

bits(64) offset = LSL(SignExtend(imm7, 64), scale); 
boolean tag_checked = whack || n != 31; 


Operation for all encodings 
CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(datasize) datal; 

bits(datasize) data2; 

constant integer dbytes = datasize DIV 8; 
boolean rt_unknown = FALSE; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if t == t2 then 
Constraint c = ConstrainUnpredictable(); 
assert c IN {Constraint_UNKNOWN, Constraint_UNDEF, Constraint_NOP}; 
case c of 
when Constraint_UNKNOWN rt_unknown = TRUE; // result is UNKNOWN 
when Constraint_UNDEF UNDEFINED; 
when Constraint_NOP EndOfInstruction(); 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


datal = Mem[address, dbytes, AccType_VEC]; 
data2 = Mem[address+dbytes, dbytes, AccType_VEC]; 
if rt_unknown then 
datal = bits(datasize) UNKNOWN; 
data2 = bits(datasize) UNKNOWN; 
V[t] = datal; 
V[t2] = data2; 


if whack then 
if postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] 


address; 
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Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.184 


C7-1800 


LDR (immediate, SIMD&FP) 


Load SIMD&FP Register (immediate offset). This instruction loads an element from memory, and writes the result 
as a scalar to the SIMD&FP register. The address that is used for the load is calculated from a base register value, 
a signed immediate offset, and an optional offset that is a multiple of the element size. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12\1110 9 | 5 4| 0| 
[szen t[1]o o[x to] ë mo for Ra f Re 


opc 


8-bit variant 
Applies when size == 00 && opc == 01. 


LDR <Bt>, [<Xn|SP>], #<simm> 


16-bit variant 
Applies when size == 01 && opc == 01. 


LDR <Ht>, [<Xn|SP>], #<simm> 


32-bit variant 
Applies when size == 10 && opc == 01. 


LDR <St>, [<Xn|SP>], #<simm> 


64-bit variant 
Applies when size == 11 && opc == 01. 


LDR <Dt>, [<Xn|SP>], #<simm> 


128-bit variant 
Applies when size == 00 && opc == 11. 


LDR <Qt>, [<Xn|SP>], #<simm> 


Decode for all variants of this encoding 


boolean whack = TRUE; 

boolean postindex = TRUE; 

integer scale = UInt(opc<1>:size); 

if scale > 4 then UNDEFINED; 

bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 


szej 1 1]7[0 O[x iJo. mo po Rn] Rt 


opc 


8-bit variant 


Applies when size == 00 && opc == 01. 
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LDR <Bt>, [<Xn|SP>, #<simm>]! 


16-bit variant 
Applies when size == 01 && opc == 01. 


LDR <Ht>, [<Xn|SP>, #<simm>]! 


32-bit variant 
Applies when size == 10 && opc == 01. 


LDR <St>, [<Xn|SP>, #<simm>]! 


64-bit variant 
Applies when size == 11 && opc == 01. 


LDR <Dt>, [<Xn|SP>, #<simm>]! 


128-bit variant 
Applies when size == 00 && opc == 11. 


LDR <Qt>, [<Xn|SP>, #<simm>]! 


Decode for all variants of this encoding 


boolean whack = TRUE; 

boolean postindex = FALSE; 

integer scale = UInt(opc<1>:size); 

if scale > 4 then UNDEFINED; 

bits(64) offset = SignExtend(imm9, 64); 


Unsigned offset 


|31 30 29 28|27 26 25 24/23 2221 | | | 109 | 5 4| 0 | 
opc 


8-bit variant 

Applies when size == 00 && opc == 01. 
LDR <Bt>, [<Xn|SP>{, #<pimm>}] 
16-bit variant 

Applies when size == 01 & opc == 01. 
LDR <Ht>, [<Xn|SP>{, #<pimm>}] 
32-bit variant 

Applies when size == 10 & opc == 01. 
LDR <St>, [<Xn|SP>{, #<pimm>}] 
64-bit variant 

Applies when size == 11 && opc == 01. 


LDR <Dt>, [<Xn|SP>{, #<pimm>}] 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1801 
ID070919 Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


128-bit variant 
Applies when size == 00 && opc == 11. 


LDR <Qt>, [<Xn|SP>{, #<pimm>}] 


Decode for all variants of this encoding 


boolean whack = FALSE; 

boolean postindex = FALSE; 

integer scale = UInt(opc<1>:size); 

if scale > 4 then UNDEFINED; 

bits(64) offset = LSL(ZeroExtend(imm12, 64), scale); 


Assembler symbols 


C7-1802 


<Bt> Is the 8-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<Dt> Is the 64-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<Ht> Is the 16-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<Qt> Is the 128-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<St> Is the 32-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 

<pimm> For the 8-bit variant: is the optional positive immediate byte offset, in the range 0 to 4095, defaulting 


to 0 and encoded in the "imm12" field. 


For the 16-bit variant: is the optional positive immediate byte offset, a multiple of 2 in the range 0 
to 8190, defaulting to 0 and encoded in the "imm12" field as <pimm>/2. 


For the 32-bit variant: is the optional positive immediate byte offset, a multiple of 4 in the range 0 
to 16380, defaulting to 0 and encoded in the "imm12" field as <pimm>/4. 


For the 64-bit variant: is the optional positive immediate byte offset, a multiple of 8 in the range 0 
to 32760, defaulting to 0 and encoded in the "imm12" field as <pimm>/8. 


For the 128-bit variant: is the optional positive immediate byte offset, a multiple of 16 in the range 
0 to 65520, defaulting to 0 and encoded in the "Imm 12" field as <pimm>/16. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

MemOp memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = 8 << scale; 

boolean tag_checked = memop != MemOp_PREFETCH && (wback || n != 31); 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 
bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 
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if !postindex then 
address = address + offset; 


case memop of 
when MemOp_STORE 
data = V[t]; 
Mem[address, datasize DIV 8, AccType_VEC] = data; 


when MemOp_LOAD 
data = Mem[address, datasize DIV 8, AccType_VEC]; 
V[t] = data; 


if whack then 
if postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.185 


C7-1804 


LDR (literal, SIMD&FP) 


Load SIMD&FP Register (PC-relative literal). This instruction loads a SIMD&FP register from memory. The 
address that is used for the load is calculated from the PC value and an immediate offset. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 | | | | 5 4| 0| 
[oc fo 1 1fifo of immi9 | R | 
32-bit variant 


Applies when opc == 00. 


LDR <St>, <label> 


64-bit variant 
Applies when opc == 01. 


LDR <Dt>, <label> 


128-bit variant 
Applies when opc == 10. 


LDR <Qt>, <label> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer size; 
bits(64) offset; 


case opc of 
when '00' 
size = 4; 
when '01' 
size = 8; 
when '10' 
size = 16; 
when '11' 
UNDEFINED; 


offset = SignExtend(imm19:'00', 64); 


Assembler symbols 


<Dt> Is the 64-bit name of the SIMD&FP register to be loaded, encoded in the "Rt" field. 

<Qt> Is the 128-bit name of the SIMD&FP register to be loaded, encoded in the "Rt" field. 

<St> Is the 32-bit name of the SIMD&FP register to be loaded, encoded in the "Rt" field. 
<label> Is the program label from which the data is to be loaded. Its offset from the address of this 


instruction, in the range +/-1MB, is encoded as "imm19" times 4. 
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Operation 


bits(64) address = PC[] + offset; 
bits(sizex8) data; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(TRUE) ; 


CheckFPAdvSIMDEnab1ed64(); 


data 
V[t] 


data; 


Operational information 


Mem[address, size, AccType_VEC]; 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.186 


C7-1806 


LDR (register, SIMD&FP) 


Load SIMD&FP Register (register offset). This instruction loads a SIMD&FP register from memory. The address 
that is used for the load is calculated from a base register value and an offset register value. The offset can be 
optionally shifted and extended. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20) 16/15 1312/11109 | 5 4| 0 | 


szej 1 1]7]0 O[x i]7] Rm [option ps 0] Rn | Rt 


opc 


8-fsreg,LDR-8-fsreg variant 
Applies when size == 00 && opc == 01 && option != 011. 


LDR <Bt>, [<Xn|SP>, (<Wm>|<Xm>), <extend> {<amount>}] 


8-fsreg,LDR-8-fsreg variant 
Applies when size == 00 && opc == 01 && option == 011. 


LDR <Bt>, [<Xn|SP>, <Xm>{, LSL <amount>}] 


16-fsreg,_LDR-16-fsreg variant 
Applies when size == 01 && opc == 01. 


LDR <Ht>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


32-fsreg,_LDR-32-fsreg variant 
Applies when size == 10 && opc == 01. 


LDR <St>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


64-fsreg,_LDR-64-fsreg variant 
Applies when size == 11 && opc == 01. 


LDR <Dt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


128-fsreg,_LDR-128-fsreg variant 
Applies when size == 00 && opc == 11. 


LDR <Qt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


Decode for all variants of this encoding 


integer scale = UInt(opc<1>:size); 

if scale > 4 then UNDEFINED; 

if option<1> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 


integer shift = if S == '1' then scale else 0; 
Assembler symbols 
<Bt> Is the 8-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Dt> Is the 64-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
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<Ht> 
<Qt> 
<St> 
<Xn | SP> 


<Wm> 


<Xm> 


<extend> 


<amount> 
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Is the 16-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

Is the 128-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

Is the 32-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


When option<Q> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 


When option<0> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 


For the 8-bit variant: is the index extend specifier, encoded in the "option" field. It can have the 
following values: 


UXTW when option = 010 
SXTW when option = 110 
SXTX when option = 111 


For the 128-bit, 16-bit, 32-bit and 64-bit variant: is the index extend/shift specifier, defaulting to 
LSL, and which must be omitted for the LSL option when <amount> is omitted. encoded in the 
"option" field. It can have the following values: 


UXTW when option = 010 
LSL when option = 011 
SXTW when option = 110 
SXTX when option = 111 


For the 8-bit variant: is the index shift amount, it must be #0, encoded in "S" as 0 if omitted, or as 1 
if present. 


For the 16-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 
is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 


#0 when S = 0 
#1 when § = 1 


For the 32-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 
is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 

#0 when S = 0 

#2 when $ = 1 


For the 64-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 
is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 


#0 when S = 0 
#3 when § = 1 


For the 128-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where 
it is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 


#0 when S = 0 
#4 when S = 1 
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Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer m = UInt(Rm); 

MemOp memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = 8 << scale; 

boolean tag_checked = memop != MemOp_PREFETCH; 


Operation 


bits(64) offset = ExtendReg(m, extend_type, shift); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 
bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 
case memop of 
when MemOp_STORE 
data = V[t]; 
Mem[address, datasize DIV 8, AccType_VEC] = data; 
when MemOp_LOAD 
data = Mem[address, datasize DIV 8, AccType_VEC]; 
V[t] = data; 
Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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Load SIMD&FP Register (unscaled offset). This instruction loads a SIMD&FP register from memory. The address 
that is used for the load is calculated from a base register value and an optional immediate offset. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20| | 


12/1110 9 | 5 4| o| 


[szeļ1 1 1fıfo ojx Ifo] imma fo of Rh | R | 


8-bit variant 


Applies when size == 


LDUR <Bt>, [<Xn|SP>{, 


16-bit variant 


Applies when size == 


LDUR <Ht>, [<Xn|SP>{, 


32-bit variant 


Applies when size == 


LDUR <St>, [<Xn|SP>{, 


64-bit variant 


Applies when size == 


LDUR <Dt>, [<Xn|SP>{, 


128-bit variant 


Applies when size == 


LDUR <Qt>, [<Xn|SP>{, 


opc 


00 && opc == 


#<simm>}] 


01 && opc == 


#<simm>}] 


10 && opc == 


#<simm>}] 


11 && opc == 


#<simm>}] 


00 && opc == 


#<simm>}] 


01. 


01. 


01. 


01. 


11. 


Decode for all variants of this encoding 


integer scale = 


if scale > 4 then UNDEFINED; 
bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Bt> 
<Dt> 
<Ht> 
<Qt> 
<St> 


<Xn | SP> 
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Is the 8-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
Is the 64-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
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Is the 32-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 


Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 
in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

MemOp memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = 8 << scale; 

boolean tag_checked = memop != MemOp_PREFETCH && (n != 31); 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 
bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = V[t]; 
Mem[address, datasize DIV 8, AccType_VEC] = data; 


when MemOp_LOAD 
data = Mem[address, datasize DIV 8, AccType_VEC]; 
V[t] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.188 MLA (by element) 


Multiply-Add to accumulator (vector, by element). This instruction multiplies the vector elements in the first source 
SIMD&FP register by the specified value in the second source SIMD&FP register, and accumulates the results with 
the vector elements of the destination SIMD&FP register. All the values in this instruction are unsigned integer 
values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24/23 22 21 20|19 16|15141312\1110 9. | 5 4| 0 | 


fofa}jijo 1 1 1 1|szejt]M| Rm [ojojo ofHjo] Rn | Ra | 
02 


Vector variant 


MLA <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


Q's 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean sub_op = (02 == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
° size = 11,Q = x. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
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C7-1812 


<Ts> 


<index> 


Operation 


M:Rm when size = 10 

The following encodings are reserved: 
° size = 00. 

° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 

S when size = 10 

The following encodings are reserved: 

° size = 00. 


. size = 11. 


Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 


H:L:M when size = 01 

H:L when size = 10 

The following encodings are reserved: 
° size = 00. 


° size = 11. 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(idxdsize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 

integer element1; 

integer element2; 

bits(esize) product; 


element2 = UInt(Elem[operand2, index, esize]); 
for e = 0 to elements-1 
element1 = UInt(Elem[operand1, e, esize]); 


product = 


(elementl«element2)<esize-1:0>; 


if sub_op then 
Elem[result, e, esize] = Elem[operand3, e, esize] - product; 


else 


Elem[result, e, esize] 


Elem[operand3, e, esize] + product; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


è The execution time of this instruction is independent of: 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
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C7.2.189 MLA (vector) 
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Multiply-Add to accumulator (vector). This instruction multiplies corresponding elements in the vectors of the two 
source SIMD&FP registers, and accumulates the results with the vector elements of the destination SIMD&FP 


register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fo[afofo +771 ojs] Rm ooro] Rn | Rd 
U 


Three registers of the same type variant 


MLA <Vd>. 


<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 


d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rm); 

== '11' then UNDEFINED; 

esize = 8 << UInt(size); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


sub_op = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 

8B when size = 00,Q = 0 

16B when size = 00,Q = 1 

4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10,Q = 0 

4S when size = 10,Q = 1 

The encoding size = 11, Q = x is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) operand3 


V[d]; 


bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 
bits(esize) product; 
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for e = 0 to elements-1 
element1 = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
product = (UInt(element1)«UInt(element2))<esize-1:0>; 
if sub_op then 
Elem[result, e, esize] 
else 
Elem[result, e, esize] = Elem[operand3, e, esize] + product; 


Elem[operand3, e, esize] - product; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.190 MLS (by element) 


Multiply-Subtract from accumulator (vector, by element). This instruction multiplies the vector elements in the first 
source SIMD&FP register by the specified value in the second source SIMD&FP register, and subtracts the results 
from the vector elements of the destination SIMD&FP register. All the values in this instruction are unsigned integer 
values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24/23 22 21 20|19 16|15 14 13 12|11 10 9. | 5 4| 0| 


fofa}jijo 1 1 1 1|szejtjM| Rm [ofifo ojhjo] Rn | Ra | 
02 


Vector variant 


MLS <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


Q's 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean sub_op = (02 == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
° size = 11,Q = x. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
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C7-1816 


<Ts> 


<index> 


Operation 


M:Rm when size = 10 

The following encodings are reserved: 
° size = 00. 

° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 

S when size = 10 

The following encodings are reserved: 

° size = 00. 


. size = 11. 


Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 


H:L:M when size = 01 

H:L when size = 10 

The following encodings are reserved: 
° size = 00. 


° size = 11. 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(idxdsize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 

integer element1; 

integer element2; 

bits(esize) product; 


element2 = UInt(Elem[operand2, index, esize]); 
for e = 0 to elements-1 
element1 = UInt(Elem[operand1, e, esize]); 


product = 


(elementl«element2)<esize-1:0>; 


if sub_op then 
Elem[result, e, esize] = Elem[operand3, e, esize] - product; 


else 


Elem[result, e, esize] 


Elem[operand3, e, esize] + product; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


è The execution time of this instruction is independent of: 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


Non-Confidential 


ARM DDI 0487E.a 


ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.191 MLS (vector) 


Multiply-Subtract from accumulator (vector). This instruction multiplies corresponding elements in the vectors of 
the two source SIMD&FP registers, and subtracts the results from the vector elements of the destination SIMD&FP 
register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


opo ose] Am ooro] Rn | Rd 
U 


Three registers of the same type variant 


MLS <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean sub_op = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 
bits(esize) product; 
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for e = 0 to elements-1 
element1 = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
product = (UInt(element1)«UInt(element2))<esize-1:0>; 
if sub_op then 
Elem[result, e, esize] 
else 
Elem[result, e, esize] = Elem[operand3, e, esize] + product; 


Elem[operand3, e, esize] - product; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.192 MOV (scalar) 


Move vector element to scalar. This instruction duplicates the specified vector element in the SIMD&FP source 
register into a scalar, and writes the result to the SIMD&FP destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is an alias of the DUP (element) instruction. This means that: 


: The encodings in this description are named to match the encodings of DUP (element). 
$ The description of DUP (element) gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 121110 9. | 5 4| 0| 


oaol o ooo] mms [ojoooo]i] Rn | Rd 


Scalar variant 

MOV <V><d>, <Vn>.<T>[<index>] 
is equivalent to 

DUP <V><d>, <Vn>.<T>[<index>] 


and is always the preferred disassembly. 


Assembler symbols 


<V> Is the destination width specifier, encoded in the "imm5" field. It can have the following values: 
B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 
D when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<I> Is the element width specifier, encoded in the "imm5" field. It can have the following values: 
B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 
D when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


<index> Is the element index encoded in the "imm5" field. It can have the following values: 
imm5<4:1> when imm5 = xxxx1 
imm5<4:2> when imm5 = xxx10 
imm5<4:3> when imm5 = xx100 
imm5<4> when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 
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C7-1820 


Operation 


The description of DUP (element) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.193 MOV (element) 


Move vector element to another vector element. This instruction copies the vector element of the source SIMD&FP 
register to the specified vector element of the destination SIMD&FP register. 


This instruction can insert data into individual elements within a SIMD&FP register without clearing the remaining 
bits to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is an alias of the INS (element) instruction. This means that: 


$ The encodings in this description are named to match the encodings of INS (element). 
$ The description of INS (element) gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 11109 | 5 4| 0| 


[ofijijo 1110000] mm5 [o| imma fi] Ran | Ra | 


Advanced SIMD variant 

MOV <Vd>.<Ts>[<index1>], <Vn>.<Ts>[<index2>] 
is equivalent to 

INS <Vd>.<Ts>[<indexl>], <Vn>.<Ts>[<index2>] 


and is always the preferred disassembly. 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ts> Is an element size specifier, encoded in the "imm5" field. It can have the following values: 
B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 
D when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


<index1> Is the destination element index encoded in the "imm5" field. It can have the following values: 
imm5<4:1> when imm5 = xxxx1 
imm5<4:2> when imm5 = xxx10 
imm5<4:3> when imm5 = xx100 
imm5<4> when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<index2> Is the source element index encoded in the "imm5:imm4" field. It can have the following values: 
imm4<3:0> when imm5 = xxxx1 


imm4<3:1> when imm5 = xxx10 


imm4<3:2> when imm5 = xx100 
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C7-1822 


imm4<3> when imm5 = x1000 


The encoding imm5 = xQ0Q0Q is reserved. 


Unspecified bits in "Imm4" are ignored but should be set to zero by an assembler. 


Operation 


The description of INS (element) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 
s The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.194 MOV (from general) 


Move general-purpose register to a vector element. This instruction copies the contents of the source 
general-purpose register to the specified vector element in the destination SIMD&FP register. 


This instruction can insert data into individual elements within a SIMD&FP register without clearing the remaining 
bits to zero. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is an alias of the INS (general) instruction. This means that: 


$ The encodings in this description are named to match the encodings of INS (general). 
$ The description of INS (general) gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9. | 5 4| 0| 


[ofajojo 1110000 mm5 [ojoo 11ji] Ran | Ra | 


Advanced SIMD variant 

MOV <Vd>.<Ts>[<index>], <R><n> 
is equivalent to 

INS <Vd>.<Ts>[<index>], <R><n> 


and is always the preferred disassembly. 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ts> Is an element size specifier, encoded in the "imm5" field. It can have the following values: 
B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 
D when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


<index> Is the element index encoded in the "imm5" field. It can have the following values: 
imm5<4:1> when imm5 = xxxx1 
imm5<4:2> when imm5 = xxx10 
imm5<4:3> when imm5 = xx100 
imm5<4> when imm5 = x1000 


The encoding imm5 = x00090 is reserved. 


<R> Is the width specifier for the general-purpose source register, encoded in the "imm5" field. It can 
have the following values: 
W when imm5 = xxxx1 
W when imm5 = xxx10 
W when imm5 = xx100 
X when imm5 = x1000 
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C7-1824 


The encoding imm5 = xQ0QQ is reserved. 


<n> Is the number [0-30] of the general-purpose source register or ZR (31), encoded in the "Rn" field. 


Operation 


The description of INS (general) gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 
s The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C7.2.195 MOV (vector) 


Move vector. This instruction copies the vector in the source SIMD&FP register into the destination SIMD&FP 
register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is an alias of the ORR (vector, register) instruction. This means that: 
: The encodings in this description are named to match the encodings of ORR (vector, register). 


$ The description of ORR (vector, register) gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9. | 5 4| 0| 


[ofajofjo 14 1 1 0of1 oft] Rm foo0o011fji| R | Ra | 


size 


Three registers of the same type variant 
MOV <Vd>.<T>, <Vn>.<T> 

is equivalent to 

ORR <Vd>.<T>, <Vn>.<T>, <Vn>.<T> 


and is the preferred disassembly when Rm == Rn. 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
Operation 


The description of ORR (vector, register) gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.196 


C7-1826 


MOV (to general) 


Move vector element to general-purpose register. This instruction reads the unsigned integer from the source 
SIMD&FP register, zero-extends it to form a 32-bit or 64-bit value, and writes the result to the destination 


general-purpose register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is an alias of the UMOV instruction. This means that: 


è The encodings in this description are named to match the encodings of UMOV. 
° The description of UMOV gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24/23 22 21 20| 16|15 14 13 1211110 9 | 5 4| 0| 
[ofaļojo 11 1000 ojx xx o ojojo jijiji] Rn | Ra | 
imm5 


32-bit variant 

Applies when Q == @ && imm5 == xx100. 
MOV <Wd>, <Vn>.S[<index>] 

is equivalent to 

UMOV <Wd>, <Vn>.S[<index>] 


and is always the preferred disassembly. 


64-reg, UMOV-64-reg variant 
Applies when Q == 1 && imm5 == x1000. 
MOV <Xd>, <Vn>.D[<index>] 

is equivalent to 

UMOV <Xd>, <Vn>.D[<index>] 


and is always the preferred disassembly. 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<index> For the 32-bit variant: is the element index encoded in "imm5<4:3>". 


For the 64-reg, UMOV-64-reg variant: is the element index encoded in "imm5<4>". 


Operation 


The description of UMOV gives the operational pseudocode for this instruction. 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.197 MOVI 


Move Immediate (vector). This instruction places an immediate constant into every vector element of the 


destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 


12/1110 9 8|7 6 5 4| 


o | 


lolaloļo 1 1 1 1 0 0 0 0 ojajojc| cmode [ojijajelt[olh] Ra | 


8-bit variant 
Applies when op == 0 && cmode == 1110. 


MOVI <Vd>.<T>, #<imm8>{, LSL #0} 


16-bit shifted immediate variant 
Applies when op == 0 && cmode == 10xQ. 


MOVI <Vd>.<T>, #<imm8>{, LSL #<amount>} 


32-bit shifted immediate variant 
Applies when op == 0 && cmode == QxxQ. 


MOVI <Vd>.<T>, #<imm8>{, LSL #<amount>} 


32-bit shifting ones variant 
Applies when op == 0 && cmode == 110x. 


MOVI <Vd>.<T>, #<imm8>, MSL #<amount> 


64-bit scalar variant 
Applies when Q == @ && op == 1 && cmode == 1110. 


MOVI <Dd>, #<imm> 


64-bit vector variant 
Applies when Q == 1 && op == 1 && cmode == 1110. 


MOVI <Vd>.2D, #<imm> 


Decode for all variants of this encoding 
integer rd = UInt(Rd); 


integer datasize = if Q == '1' then 128 else 64; 
bits(datasize) imm; 
bits(64) imm64; 


ImmediateOp operation; 

case cmode:op of 
when '0xx00' operation = ImmediateOp_MOVT; 
when 'Qxx@1' operation = ImmediateOp_MVNT; 
when 'Qxx10' operation = ImmediateOp_ORR; 
when '@xx11' operation = ImmediateOp_BIC; 
when '10x00' operation = ImmediateOp_MOVI; 
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'10x01' operation = ImmediateOp_MVNT; 
'10x10' operation = ImmediateOp_ORR; 
'10x11' operation = ImmediateOp_BIC; 
'110x0' operation = ImmediateOp_MOVT; 
'110x1' operation = ImmediateOp_MVNT; 
'1110x' operation = ImmediateOp_MOVI; 
'11110' operation = ImmediateOp_MOVT; 
"11111" 

// FMOV Dn,#imm is in main FP instruction set 

if Q == 'Q' then UNDEFINED; 

operation = ImmediateOp_MOVI; 


imm64 = AdvSIMDExpandImm(op, cmode, a:b:c:d:e:f:g:h); 
imm = Replicate(imm64, datasize DIV 64); 


Assembler symbols 


<Dd> 
<Vd> 


<imm> 


<T> 


<imm8> 


<amount> 


ARM DDI 0487E.a 
ID070919 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

Is a 64-bit immediate 'aaaaaaaabbbbbbbbccccccccddddddddeeeceeeeffffffffggegeee¢ghhhhhhhh', 
encoded in "a:b:e:d:e:fig:h". 

For the 8-bit variant: is an arrangement specifier, encoded in the "Q" field. It can have the following 
values: 

8B when Q = 0 

16B when Q = 1 


For the 16-bit variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 


4H when Q = 0 
8H when Q = 1 


For the 32-bit variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 


2s when Q = 0 

4S when Q = 1 

Is an 8-bit immediate encoded in "a:b:c:d:e:fig:h". 

For the 16-bit shifted immediate variant: is the shift amount encoded in the "cmode<1>" field. It can 
have the following values: 

Q when cmode<1> = 0 

8 when cmode<1> = 1 

defaulting to 0 if LSL is omitted. 


For the 32-bit shifted immediate variant: is the shift amount encoded in the "cmode<2:1>" field. It 
can have the following values: 


Q when cmode<2:1> = 00 
8 when cmode<2:1> = 01 
16 when cmode<2:1> = 10 
24 when cmode<2:1> = 11 


defaulting to 0 if LSL is omitted. 


For the 32-bit shifting ones variant: is the shift amount encoded in the "cmode<0>" field. It can have 
the following values: 


8 when cmode<@> = 0 
16 when cmode<@> = 1 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand; 
bits(datasize) result; 


case operation of 

when ImmediateOp_MOVI 
result = imm; 

when ImmediateOp_MVNI 
result = NOT(imm); 

when ImmediateOp_ORR 
operand = V[rd]; 
result = operand OR imm; 

when ImmediateOp_BIC 
operand = V[rd]; 
result = operand AND NOT(imm) ; 





V[rd] = result; 


Operational information 


If PSTATE.DIT is 1: 


: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C7.2.198 | MUL (by element) 


Multiply (vector, by element). This instruction multiplies the vector elements in the first source SIMD&FP register 
by the specified value in the second source SIMD&FP register, places the results in a vector, and writes the vector 
to the destination SIMD&FP register. All the values in this instruction are unsigned integer values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15141312\1110 9. | 5 4| 0 | 


fo[afofo +771 [szejm] Rm [100 o[H[o] Rn | Rd 


Vector variant 


MUL <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'Q': 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
. size = 11,Q = x. 

<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 
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The following encodings are reserved: 
° size = 00. 
° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
. size = 11. 
<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


° size = 11. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(idxdsize) operand2 = V[m]; 
bits(datasize) result; 

integer element1; 

integer element2; 

bits(esize) product; 


element2 = UInt(Elem[operand2, index, esize]); 
for e = 0 to elements-1 
element1 = UInt(Elem[operand1, e, esize]); 
product = (elementl«element2)<esize-1:0>; 
Elem[result, e, esize] = product; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Multiply (vector). This instruction multiplies corresponding elements in the vectors of the two source SIMD&FP 
registers, places the results in a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 


olafojo i 1 4 ofszefif Rm [voor ijif Ro | Re 


16|15141312\1110 9. | 5 4| o| 


Three registers of the same type variant 


MUL <Vd>.<T>, <Vn>.<T>, 


<Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


if U == '1' && size != '00' then UNDEFINED; 
== '11' then UNDEFINED; 


if size 
integer 
integer 
integer 


boolean 


esize = 


8 << UInt(size); 


datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


poly = (U == '1'); 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


when size = 00, Q = 0 


8B 
16B 
4H 
8H 
2S 
4S 


when size 
when size 
when size 
when size 


when size 


00,Q=1 
01,0 = 0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 
bits(esize) product; 


for e = 0 to elements-1 


= V[n]; 
= V[m]; 
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elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
if poly then 

product = PolynomialMult(element1, element2)<esize-1:0>; 
else 

product = (UInt(element1)«UInt(element2) )<esize-1:0>; 
Elem[result, e, esize] = product; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.200 MVN 


Bitwise NOT (vector). This instruction reads each vector element from the source SIMD&FP register, places the 
inverse of each value into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is an alias of the NOT instruction. This means that: 


: The encodings in this description are named to match the encodings of NOT. 
° The description of NOT gives the operational pseudocode for this instruction. 
|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 1413 12/1110 9. | 5 4| 0 | 


oleo n oloo o oo ojo orori o] Rn | Rd 


Vector variant 

MVN <Vd>.<T>, <Vn>.<T> 
is equivalent to 

NOT <Vd>.<T>, <Vn>.<T> 


and is always the preferred disassembly. 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

Operation 


The description of NOT gives the operational pseudocode for this instruction. 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.201 MVNI 


Move inverted Immediate (vector). This instruction places the inverse of an immediate constant into every vector 
element of the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4| o| 


[olajijo 11 11000 o0 oļajejce| cmode [ojijlajeltlojh] Ra | 
op 


16-bit shifted immediate variant 
Applies when cmode == 10x0. 


MVNI <Vd>.<T>, #<imm8>{, LSL #<amount>} 


32-bit shifted immediate variant 
Applies when cmode == QxxQ. 


MVNI <Vd>.<T>, #<imm8>{, LSL #<amount>} 


32-bit shifting ones variant 
Applies when cmode == 110x. 


MVNI <Vd>.<T>, #<imm8>, MSL #<amount> 


Decode for all variants of this encoding 
integer rd = UInt(Rd); 


integer datasize = if Q == '1' then 128 else 64; 
bits(datasize) imm; 
bits(64) imm64; 


ImmediateOp operation; 
case cmode:op of 
when '@xx01' operation = ImmediateOp_MVNI; 
when 'Qxx11' operation = ImmediateOp_BIC; 
when '10x01' operation = ImmediateOp_MVNI; 
when '10x11' operation = ImmediateOp_BIC; 
when '110x1' operation = ImmediateOp_MVNI; 
when '1110x' operation = ImmediateOp_MOVT; 
when '11111' 
// FMOV Dn,#imm is in main FP instruction set 
if Q == 'Q' then UNDEFINED; 
operation = ImmediateOp_MOVI; 


imm64 = AdvSIMDExpandImm(op, cmode, a:b:c:d:e:f:g:h); 
imm = Replicate(imm64, datasize DIV 64); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the 16-bit variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 
4H when Q = 0 
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<imm8> 


<amount> 


Operation 
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8H when Q = 1 


For the 32-bit variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 


2S when Q = 0 
4S whenQ = 1 


Is an 8-bit immediate encoded in "a:b:c:d:e:fig:h". 


For the 16-bit shifted immediate variant: is the shift amount encoded in the "cmode<1>" field. It can 
have the following values: 


) when cmode<1> = 0 


8 when cmode<1> = 1 
defaulting to 0 if LSL is omitted. 


For the 32-bit shifted immediate variant: is the shift amount encoded in the "cmode<2:1>" field. It 
can have the following values: 


Q when cmode<2:1> = 00 
8 when cmode<2:1> = 01 
16 when cmode<2:1> = 10 
24 when cmode<2:1> = 11 


defaulting to 0 if LSL is omitted. 


For the 32-bit shifting ones variant: is the shift amount encoded in the "cmode<0>" field. It can have 
the following values: 


8 when cmode<@> = 0 


16 when cmode<@> = 1 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand; 
bits(datasize) result; 


case operation of 
when ImmediateOp_MOVI 


resul 


t = imm; 


when ImmediateOp_MVNI 


resu 


lt = NOT(imm); 


when ImmediateOp_ORR 
operand = V[rd]; 


resul 


t = operand OR imm; 


when ImmediateOp_BIC 
operand = V[rd]; 


resu 


V[rd] = resul 





t = operand AND NOT(imm) ; 


t; 


Operational information 


If PSTATE.DIT is 1: 


: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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C7.2.202 NEG (vector) 


Negate (vector). This instruction reads each vector element from the source SIMD&FP register, negates each value, 
puts the result into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| o| 
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Scalar variant 


NEG <V><d>, <V><n> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 


integer elements = 1; 
boolean neg = (U == '1'); 


Vector 
|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Vector variant 


NEG <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean neg = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 


The following encodings are reserved: 


. size = 0x. 
. size = 10. 
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C7-1840 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


The encoding size = 11, Q = Qis reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


when size = 


when size = 


when size 


when size 


when size = 


when size = 


when size 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 


bits(datasize) result; 


integer element; 


for e = 0 to elements-1 
element = SInt(Elem[operand, e, esize]); 


v[d] 


ifn 


else 


Elem[result, e, esize] = element<esize-1:0>; 


=r 


eg then 


element = -element; 


element = Abs(element); 


esult; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


The response of this instruction to asynchronous exceptions does not vary based on: 


The values of the data supplied in any of its registers. 


00, Q = 
00, Q = 
01, Q = 
01, Q = 
10, Q = 
10, Q = 
11, Q = 


The values of the NZCV flags. 


The values of the data supplied in any of its registers. 


The values of the NZCV flags. 
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C7.2.203 NOT 


Bitwise NOT (vector). This instruction reads each vector element from the source SIMD&FP register, places the 
inverse of each value into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is used by the alias MVN. The alias is always the preferred disassembly. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Vector variant 


NOT <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 8; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV 8; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 


Elem[result, e, esize] = NOT(element); 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.204 ORN (vector) 
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Bitwise inclusive OR NOT (vector). This instruction performs a bitwise OR NOT between the two source 
SIMD&FP registers, and writes the result to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| o| 
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size 


Three registers of the same type variant 


ORN <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if Q == '1' then 128 else 64; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = V[n]; 
bits(datasize) operand2 
bits(datasize) result; 


0 
< 
= 


operand2 = NOT(operand2); 
result = operand1 OR operand2; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
$ The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


` The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


SIMD&FP register, performs a bitwise OR between each result and an immediate constant, places the result into a 
vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 
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[a[o] 
op 


16-bit variant 


Applies when cmode == 10x1. 


cmode 


ORR <Vd>.<T>, #<imm8>{, LSL #<amount>} 


32-bit variant 


Applies when cmode == 0xx1. 


ORR <Vd>.<T>, #<imm8>{, LSL #<amount>} 


Decode for all variants of this encoding 


integer rd = UInt(Rd); 


integer datasize = if Q == '1' then 128 else 64; 
bits(datasize) imm; 
bits(64) imm64; 


ImmediateOp operation; 
case cmode:op of 


when 
when 
when 
when 
when 
when 
when 


imm64 = AdvSIMDExpandImm(op, 


"@xx00' operation 
"@xx10' operation 
'10x00' operation 
'10x10' operation 
'110x0' operation 
'1110x' operation 
'11110' operation 


ImmediateOp_MOVT; 
ImmediateOp_ORR; 
ImmediateOp_MOVT; 
ImmediateOp_ORR; 
ImmediateOp_MOVT; 
ImmediateOp_MOVT; 
ImmediateOp_MOVI; 
cmode, a:b:c:d:e:f:g:h); 


imm = Replicate(imm64, datasize DIV 64); 


Assembler symbols 


<Vd> 


<T> 


<imm8> 


ARM DDI 0487E.a 
ID070919 


Is the name of the SIMD&FP register, encoded in the "Rd" field. 


12/1110 9 8|7 6 5 4| 


For the 16-bit variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 


4H when Q = 0 
8H whenQ = 1 


For the 32-bit variant: is an arrangement specifier, encoded in the "Q" field. It can have the 
following values: 


2S when Q = 0 
4S whenQ = 1 


Is an 8-bit immediate encoded in "a:b:c:d:e:fig:h". 
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<amount> 


Operation 


For the 16-bit variant: is the shift amount encoded in the "cmode<1>" field. It can have the 


following values: 
) when cmode<1> = 0 
8 when cmode<1> = 1 


defaulting to 0 if LSL is omitted. 


For the 32-bit variant: is the shift amount encoded in the "cmode<2:1>" field. It can have the 


following values: 


Q when cmode<2:1> = 00 
8 when cmode<2:1> = 01 
16 when cmode<2:1> = 10 
24 when cmode<2:1> = 11 


defaulting to 0 if LSL is omitted. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand; 
bits(datasize) result; 


case operation of 
when ImmediateOp_MOVI 


resu 


t = imm; 


when ImmediateOp_MVNI 


resu 


lt = NOT(imm); 


when ImmediateOp_ORR 
operand = V[rd]; 


resul 


t = operand OR imm; 


when ImmediateOp_BIC 
operand = V[rd]; 


resu 


V[rd] = resul 





lt = operand AND NOT(imm) ; 


t; 


Operational information 


If PSTATE.DIT is 1: 


è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.206 ORR (vector, register) 


ARM DDI 0487E.a 
ID070919 


Bitwise inclusive OR (vector, register). This instruction performs a bitwise OR between the two source SIMD&FP 
registers, and writes the result to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is used by the alias MOV (vector). See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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size 


Three registers of the same type variant 


ORR <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
integer datasize = if Q == '1' then 128 else 64; 


Alias conditions 





Alias is preferred when 


MOV (vector) Rm == Rn 





Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


result = operand1 OR operand2; 


V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


C7-1848 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


C7.2.207  PMUL 


ARM DDI 0487E.a 
ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
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Polynomial Multiply. This instruction multiplies corresponding elements in the vectors of the two source SIMD&FP 
registers, places the results in a vector, and writes the vector to the destination SIMD&FP register. 


For information about multiplying polynomials see Polynomial arithmetic over {0, 1} on page A1-50. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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Three registers of the same type variant 


PMUL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if U == 
if size 
integer 
integer 
integer 


boolean 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 
1' && size != '00' then UNDEFINED; 


== '11' then UNDEFINED; 


esize 


= 8 << UInt(size); 


datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


poly = (U == '1'); 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 


16B when size = 00,Q=1 
The following encodings are reserved: 
. size = 01, Q = x. 

. size = 1x, Q = x. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 
bits(esize) product; 


for e = 0 to elements-1 
elementl = Elem[operand1, e, esize]; 
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element2 = Elem[operand2, e, esize]; 
if poly then 

product = PolynomialMult(element1, element2)<esize-1:0>; 
else 

product = (UInt(element1)«UInt(element2) )<esize-1:0>; 
Elem[result, e, esize] = product; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.208 PMULL, PMULL2 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Polynomial Multiply Long. This instruction multiplies corresponding elements in the lower or upper half of the 
vectors of the two source SIMD&FP registers, places the results in a vector, and writes the vector to the destination 
SIMD&FP register. The destination vector elements are twice as long as the elements that are multiplied. 


For information about multiplying polynomials see Polynomial arithmetic over {0, 1} on page A1-50. 


The PMULL instruction extracts each source vector from the lower half of each source register, while the PMULL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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Three registers, not all the same type variant 


PMULL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
if size 
integer 
integer 
integer 
integer 


d 
n 
m 


UInt(Rd) ; 
UInt(Rn) ; 
UInt (Rm) ; 


'Q1' || size == '10' then UNDEFINED; 
'11' && !HaveBit128PMULLExt() then UNDEFINED; 


esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 

elements = datasize DIV esize; 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


ARM DDI 0487E.a 
ID070919 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 

8H when size = 00 

1Q when size = 11 

The following encodings are reserved: 

° size = 0l. 

° size = 10. 

The '1Q' arrangement is only allocated in an implementation that includes the Cryptographic 


Extension, and is otherwise RESERVED. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1851 


Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7-1852 


<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q=1 
1D when size = 11,Q = 0 
2D when size = 11,Q = 1 


The following encodings are reserved: 


° size = 01, Q = x. 
° size = 10, Q = x. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

bits(esize) element1; 

bits(esize) element2; 


for e = 0 to elements-1 
element1 = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 
Elem[result, e, 2xesize] = PolynomialMult(element1, element2) ; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.209 RADDHN, RADDHN2 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Rounding Add returning High Narrow. This instruction adds each vector element in the first source SIMD&FP 
register to the corresponding vector element in the second source SIMD&FP register, places the most significant 
half of the result into a vector, and writes the vector to the lower or upper half of the destination SIMD&FP register. 


The results are rounded. For truncated results, see ADDHN, ADDHN2. 


The RADDHN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the RADDHN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24/23 22 21 20| 
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Three registers, not all the same type variant 


RADDHN{2} <Vd>.<Tb>, <Vn>.<Ta>, <Vm>.<Ta> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


Assembler symbols 


2 


<Vd> 


<Tb> 


ARM DDI 0487E.a 
ID070919 


d = UInt(Rd); 


n 


UInt(Rn); 


m = UInt(Rm); 


== '11' then UNDEFINED; 
= 8 << UInt(size); 
datasize = 64; 


esize 


part = 


UInt(Q); 


elements = datasize DIV esize; 


sub_op = (ol = '1'); 


round = 


(U = '1'); 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


when Q = 0 
whenQ = 1 


[absent] 


[present] 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


when size = 00,Q = 0 


8B 
16B 
4H 
8H 
2S 
4S 


when size = 00, Q = 1 


when size 
when size 
when size 


when size 


01, Q = 0 
01, Q =1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 
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<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnabled64(); 

bits(2sdatasize) operandl = V[n]; 

bits(2sdatasize) operand2 = V[m]; 

bits(datasize) result; 

integer round_const = if round then 1 << (esize - 1) else Q; 
bits(2xesize) element1; 

bits(2xesize) element2; 

bits(2sesize) sum; 


for e = 0 to elements-1 
elementl = Elem[operand1, e, 2xesize]; 
element2 = Elem[operand2, e, 2xesize]; 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
sum = sum + round_const; 
Elem[result, e, esize] = sum<2«esize-l:esize>; 


Vpart[d, part] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.210 RAX1 


Rotate and Exclusive OR rotates each 64-bit element of the 128-bit vector in a source SIMD&FP register left by 1, 
performs a bitwise exclusive OR of the resulting 128-bit vector and the vector in another source SIMD&FP register, 
and writes the result to the destination SIMD&FP register. 


This instruction is implemented only when ARMv8.2-SHA is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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Advanced SIMD variant 


RAX1 <Vd>.2D, <Vn>.2D, <Vm>.2D 


Decode for this encoding 


if !HaveSHA3Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 
bits(128) Vn = V[n]; 
V[d] = Vn EOR (ROL(Vm<127:64>, 1):ROL(Vm<63:0>, 1)); 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.211 RBIT (vector) 


Reverse Bit order (vector). This instruction reads each vector element from the source SIMD&FP register, reverses 
the bits of the element, places the results into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| o| 
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Vector variant 


RBIT <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 8; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV 8; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 
bits(esize) rev; 


for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
for i = 0 to esize-1 
rev<esize-1-i> = element<i>; 
Elem[result, e, esize] = rev; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
s The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.212 


C7-1858 


REV16 (vector) 


Reverse elements in 16-bit halfwords (vector). This instruction reverses the order of 8-bit elements in each halfword 
of the vector in the source SIMD&FP register, places the results into a vector, and writes the vector to the destination 


SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Vector variant 


REV16 <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


// size=esize: B(0), H(1), S(1), D(S) 
integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 


// op=REVx: 64(0), 32(1), 16(2) 
bits(2) op = 00:U; 


// => op+size: 








// 64+B = 0, 64+H = 1, 64+S = 2, 644D = X 
// 32+B = 1, 32+H = 2, 32+S = X, 324D = X 
// 16+B = 2, 16+H = X, 16+S = X, 16+D = X 
// 8+B = X, 8+H =X, 8+S = X, 84D = X 
// => 3-(optsize) (index bits in group) 

// 64/B = 3, 64+H = 2, 6448S = 1, 64+D = X 
// 32+B = 2, 32+H = 1, 32+S = X, 324D = X 
// 16+B = 1, 16+H = X, 16+S = X, 16+D = X 
// 8+B = X, 8+tH =X, 84S =X, 84D =X 


// index bits within group: 1, 2, 3 
if UInt(op) + UInt(size) >= 3 then UNDEFINED; 


integer container_size; 
case op of 


when '10' container_size = 16; 
when 'Q1' container_size = 32; 
when 'QQ' container_size = 64; 


integer containers = datasize DIV container_size; 
integer elements_per_container = container_size DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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The following encodings are reserved: 


. size = 01, Q = x. 
° size = 1x, Q =x. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element = 0; 
integer rev_element; 
for c = 0 to containers-1 
rev_element = element + elements_per_container - 1; 
for e = 0 to elements_per_container-1 
Elem[result, rev_element, esize] = Elem[operand, element, esize]; 
element = element + 1; 
rev_element = rev_element - 1; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.213 REV32 (vector) 


Reverse elements in 32-bit words (vector). This instruction reverses the order of 8-bit or 16-bit elements in each 
word of the vector in the source SIMD&FP register, places the results into a vector, and writes the vector to the 
destination SIMD&FP register. 


Depending on 


the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oleo 7744 olse 000 ojo o oojoo) An | Rd | 
U o0 


Vector variant 


REV32 <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = 
integer n = 


// size=esiz 
integer esiz 
integer data 


// op=REVx: 
bits(2) op = 


// => op+siz 





// 644B = 
// 32+B = 
// 16+B = 
// 8+B = 
// => 3-(op+ 
// 64/B = 
// 324B = 
// 16+B = 
// 8+B = 


// index bit 


UInt(Rd) ; 
UInt(Rn) ; 


e: B(0), H(1), S(1), D(S) 
e = 8 << UInt(size); 


size = if Q == '1' then 128 else 64; 


64(@), 32(1), 16(2) 
00:U; 


e: 





0, 64+H = 1, 64+S = 2, 64+D = X 
1, 32+H = 2, 32+S = X, 32+D = X 
2, 16+H = X, 16+S = X, 16+D = X 
X, 8+tH =X, 8+S =X, 8&D=X 
size) (index bits in group) 

3, 64+H = 2, 64S = 1, 644D = X 
2, 32+H = 1, 32+S = X, 32+D = X 
1, 16+H = X, 16+S = X, 16+D = X 
X, 8+tH =X, 8+S =X, 84D =X 


s within group: 1, 2, 3 


if UInt(op) + UInt(size) >= 3 then UNDEFINED; 


integer cont 

case op of 
when '10 
when 'Q1 
when '00 


integer cont 
integer elem 


ainer_size; 

" container_size = 16; 
' container_size = 32; 
" container_size = 64; 


ainers = datasize DIV container_size; 
ents_per_container = container_size DIV esize; 


Assembler symbols 


<Vd> 


<T> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
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8H when size = 01,Q = 1 


The encoding size = 1x, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element = 0; 
integer rev_element; 
for c = 0 to containers-1 
rev_element = element + elements_per_container - 1; 
for e = 0 to elements_per_container-1 
Elem[result, rev_element, esize] = Elem[operand, element, esize]; 
element = element + 1; 
rev_element = rev_element - 1; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.214 REV64 


Reverse elements in 64-bit doublewords (vector). This instruction reverses the order of 8-bit, 16-bit, or 32-bit 
elements in each doubleword of the vector in the source SIMD&FP register, places the results into a vector, and 
writes the vector to the destination SIMD&FP register. 


Depending on 


the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fofafofo 7741 olse 000 0/000 0/0/10] An | Rd | 
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Vector variant 


REV64 <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = 
integer n = 


// size=esiz 
integer esiz 
integer data 


// op=REVx: 
bits(2) op = 


// => op+siz 





// 644B = 
// 32+B = 
// 16+B = 
// 8+B = 
// => 3-(op+ 
// 64/B = 
// 324B = 
// 16+B = 
// 8+B = 


// index bit 


UInt(Rd) ; 
UInt(Rn) ; 


e: B(0), H(1), S(1), D(S) 
e = 8 << UInt(size); 


size = if Q == '1' then 128 else 64; 


64(@), 32(1), 16(2) 
00:U; 


e: 





0, 64+H = 1, 64+S = 2, 64+D = X 
1, 32+H = 2, 32+S = X, 32+D = X 
2, 16+H = X, 16+S = X, 16+D = X 
X, 8+tH =X, 8+S =X, 8&D=X 
size) (index bits in group) 

3, 64+H = 2, 64S = 1, 644D = X 
2, 32+H = 1, 32+S = X, 32+D = X 
1, 16+H = X, 16+S = X, 16+D = X 
X, 8+tH =X, 8+S =X, 84D =X 


s within group: 1, 2, 3 


if UInt(op) + UInt(size) >= 3 then UNDEFINED; 


integer cont 

case op of 
when '10 
when 'Q1 
when '00 


integer cont 
integer elem 


ainer_size; 

" container_size = 16; 
' container_size = 32; 
" container_size = 64; 


ainers = datasize DIV container_size; 
ents_per_container = container_size DIV esize; 


Assembler symbols 


<Vd> 


<T> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
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8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element = 0; 
integer rev_element; 
for c = Q to containers-1 
rev_element = element + elements_per_container - 1; 
for e = Q to elements_per_container-1 
Elem[result, rev_element, esize] = Elem[operand, element, esize]; 
element = element + 1; 
rev_element = rev_element - 1; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1863 
Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.215 


C7-1864 


RSHRN, RSHRN2 


Rounding Shift Right Narrow (immediate). This instruction reads each unsigned integer value from the vector in 

the source SIMD&FP register, right shifts each result by an immediate value, writes the final result to a vector, and 
writes the vector to the lower or upper half of the destination SIMD&FP register. The destination vector elements 
are half as long as the source vector elements. The results are rounded. For truncated results, see SHRN, SHRN2. 


The RSHRN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the RSHRN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 1918 16/15141312/1110 9 | 5 4| 0 | 


fofafoyo +177 0] 0000 | immb [100 o] Rn | Rd 
op 


immh 


Vector variant 


RSHRN{2} <Vd>.<Tb>, <Vn>.<Ta>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


integer shift = (2 » esize) - UInt(immh:immb) ; 
boolean round = (op == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Tb> Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 
8B when immh = 0001, Q = 0 
16B when immh = 0001,Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
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The encoding immh = 1xxx, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<Ta> Is an arrangement specifier, encoded in the "Immh" field. It can have the following values: 
8H when immh = 0001 
4s when immh = 001x 
2D when immh = Q1xx 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 
The encoding immh = 1xxx is reserved. 
<shift> Is the right shift amount, in the range 1 to the destination element width in bits, encoded in the 
"immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = 01xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation 


CheckFPAdvSIMDEnabled64(); 

bits(datasizex2) operand = V[n]; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else Q; 
integer element; 


for e = 0 to elements-1 
element = (UInt(Elem[operand, e, 2*esize]) + round_const) >> shift; 


Elem[result, e, esize] = element<esize-1:0>; 


Vpart[d, part] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.216 


C7-1866 


RSUBHN, RSUBHN2 


Rounding Subtract returning High Narrow. This instruction subtracts each vector element of the second source 
SIMD&FP register from the corresponding vector element of the first source SIMD&FP register, places the most 
significant half of the result into a vector, and writes the vector to the lower or upper half of the destination 
SIMD&FP register. 


The results are rounded. For truncated results, see SUBHN, SUBHN2. 


The RSUBHN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the RSUBHN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


ollon ii olse] Rm [oojoo] An | Rd | 
U 01 


Three registers, not all the same type variant 


RSUBHN{2} <Vd>.<Tb>, <Vn>.<Ta>, <Vm>.<Ta> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


boolean sub_op = (01 == '1'); 
boolean round = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
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The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(2sdatasize) operandl = V[n]; 

bits(2sdatasize) operand2 = V[m]; 

bits(datasize) result; 

integer round_const = if round then 1 << (esize - 1) else Q; 
bits(2xesize) element1; 

bits(2xesize) element2; 

bits(2sesize) sum; 


for e = 0 to elements-1 
elementl = Elem[operand1, e, 2xesize]; 
element2 = Elem[operand2, e, 2xesize]; 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
sum = sum + round_const; 
Elem[result, e, esize] = sum<2«esize-l:esize>; 


Vpart[d, part] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.217 


C7-1868 


SABA 


Signed Absolute difference and Accumulate. This instruction subtracts the elements of the vector of the second 
source SIMD&FP register from the corresponding elements of the first source SIMD&FP register, and accumulates 
the absolute values of the results into the elements of the vector of the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 


oloo +171 olse] Rm forin Rn | Ra 
U ac 


16|15141312\1110 9. | 5 4| 0 | 


Three registers of the same type variant 


SABA <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 
boolean 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U == '1'); 
accumulate = (ac == '1'); 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size 
when size 
when size 
when size 
when size 


when size 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


integer element1; 
integer element2; 
bits(esize) absdiff; 
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result = if accumulate then V[d] else Zeros(); 
for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
absdiff = Abs(elementl-element2)<esize-1:0>; 
Elem[result, e, esize] = Elem[result, e, esize] + absdiff; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.218 SABAL, SABAL2 


Signed Absolute difference and Accumulate Long. This instruction subtracts the vector elements in the lower or 
upper half of the second source SIMD&FP register from the corresponding vector elements of the first source 
SIMD&FP register, and accumulates the absolute values of the results into the vector elements of the destination 
SIMD&FP register. The destination vector elements are twice as long as the source vector elements. 


The SABAL instruction extracts each source vector from the lower half of each source register, while the SABAL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16|15 14 13 12/11 10 9 


| 5 4) 0 | 


elelo o eleji en deee n l s 


Three registers, not all the same type variant 


SABAL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 


== '11' then UNDEFINED; 

esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 

elements = datasize DIV esize; 


accumulate = a: == 'Q'); 
unsigned = (U == r ); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


C7-1870 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
01 
10 


4S when size 


2D when size 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2xesize) absdiff; 


result = if accumulate then V[d] else Zeros(); 
for e = 0 to elements-1 

element1 = Int(Elem[operandi, e, esize], unsigned); 

element2 = Int(Elem[operand2, e, esize], unsigned); 

absdiff = Abs(elementl-element2)<2sesize-1:0>; 

Elem[result, e, 2xesize] = Elem[result, e, 2sesize] + absdiff; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1871 
ID070919 Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 


C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.219 


C7-1872 


SABD 


Signed Absolute Difference. This instruction subtracts the elements of the vector of the second source SIMD&FP 
register from the corresponding elements of the first source SIMD&FP register, places the absolute values of the 
results into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 


olal +171 olse] Rm forino] Rn | Ra 
U ac 


16|15 14 13 12|11 10 9. | 5 4| 0| 


Three registers of the same type variant 


SABD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 
boolean 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U == '1'); 
accumulate = (ac == '1'); 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size 
when size 
when size 
when size 
when size 


when size 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


integer element1; 
integer element2; 
bits(esize) absdiff; 
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result = if accumulate then V[d] else Zeros(); 
for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
absdiff = Abs(elementl-element2)<esize-1:0>; 
Elem[result, e, esize] = Elem[result, e, esize] + absdiff; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.220 SABDL, SABDL2 


Signed Absolute Difference Long. This instruction subtracts the vector elements of the second source SIMD&FP 
register from the corresponding vector elements of the first source SIMD&FP register, places the absolute value of 
the results into a vector, and writes the vector to the lower or upper half of the destination SIMD&FP register. The 
destination vector elements are twice as long as the source vector elements. 


The SABDL instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the SABDL2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9 | 5 4| 0| 


fofafoo +771 olse] Rm Jooo] rn | Rd 
U op 


Three registers, not all the same type variant 


SABDL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d 
n 
m 


UInt(Rd) ; 
UInt(Rn) ; 
UInt (Rm) ; 


== '11' then UNDEFINED; 

esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 

elements = datasize DIV esize; 


accumulate = (op == 'Q'); 
unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


C7-1874 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
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16B 
4H 
8H 
2S 
4S 


when size 
when size 
when size 
when size 


when size 
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= 00,Q=1 
= 01,Q0=0 
=01,Q=1 
= 10,Q=0 
= 10,Q=1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 


bits(2sdatasize) result; 
integer element1; 
integer element2; 
bits(2xesize) absdiff; 


result = if accumulate then V[d] else Zeros(); 


for e = 0 to elements-1 


element1 = Int(Elem[operand1, e, esize], unsigned); 

element2 = Int(Elem[operand2, e, esize], unsigned); 

absdiff = Abs(elementl-element2)<2sesize-1:0>; 

Elem[result, e, 2xesize] = Elem[result, e, 2esize] + absdiff; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.221 


C7-1876 


SADALP 


Signed Add and Accumulate Long Pairwise. This instruction adds pairs of adjacent signed integer values from the 
vector in the source SIMD&FP register and accumulates the results into the vector elements of the destination 
SIMD&FP register. The destination vector elements are twice as long as the source vector elements. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fo[aolo +771 O[sze]i 000 ojo oio 0] Rn | Rd 
U op 


Vector variant 


SADALP <Vd>.<Ta>, <Vn>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV (2 « esize); 
boolean acc = (op == '1'); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 00,Q = 0 
8H when size = 00,Q = 1 
2S when size = 01,Q = 0 
4S when size = 01,Q = 1 
1D when size = 10,Q = 0 
2D when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


bits(2sesize) sum; 
integer op1; 
integer op2; 


result = if acc then V[d] else Zeros(); 
for e = 0 to elements-1 
op1 = Int(Elem[operand, 2xe+0, esize], unsigned); 
op2 = Int(Elem[operand, 2xe+1, esize], unsigned); 
sum = (opl+op2)<2«esize-1:0>; 
Elem[result, e, 2xesize] = Elem[result, e, 2esize] + sum; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1877 
ID070919 Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.222 SADDL, SADDL2 


Signed Add Long (vector). This instruction adds each vector element in the lower or upper half of the first source 
SIMD&FP register to the corresponding vector element of the second source SIMD&FP register, places the results 
into a vector, and writes the vector to the destination SIMD&FP register. The destination vector elements are twice 
as long as the source vector elements. All the values in this instruction are signed integer values. 


The SADDL instruction extracts each source vector from the lower half of each source register, while the SADDL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0| 


COUEN CNREE of Rn | Rd _| 


Three registers, not all the same type variant 


SADDL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d = UInt(Rd); 


n 


UInt(Rn) ; 


m = UInt(Rm); 


== '11' then UNDEFINED; 


esize = 


8 << UInt(size); 


datasize = 64; 


part = 


UInt (Q); 


elements = datasize DIV esize; 


sub_op = 
unsigned 


(o1 == '1'); 
= (U = '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


C7-1878 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

integer sum; 


for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
Elem[result, e, 2xesize] = sum<2xesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.223 


C7-1880 


SADDLP 


Signed Add Long Pairwise. This instruction adds pairs of adjacent signed integer values from the vector in the 
source SIMD&FP register, places the result into a vector, and writes the vector to the destination SIMD&FP register. 
The destination vector elements are twice as long as the source vector elements. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oloo +171 olse 000 ojo ojoj [to] Rn | Ra 
U op 


Vector variant 


SADDLP <Vd>.<Ta>, <Vn>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV (2 « esize); 
boolean acc = (op == '1'); 
boolean unsigned = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 00,Q = 0 
8H when size = 00,Q = 1 
2S when size = 01,Q = 0 
4S when size = 01,Q = 1 
1D when size = 10,Q = 0 
2D when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


bits(2sesize) sum; 
integer op1; 
integer op2; 


result = if acc then V[d] else Zeros(); 
for e = 0 to elements-1 
op1 = Int(Elem[operand, 2xe+0, esize], unsigned); 
op2 = Int(Elem[operand, 2xe+1, esize], unsigned); 
sum = (opl+op2)<2«esize-1:0>; 
Elem[result, e, 2xesize] = Elem[result, e, 2esize] + sum; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.224 SADDLV 


Signed Add Long across Vector. This instruction adds every vector element in the source SIMD&FP register 
together, and writes the scalar result to the destination SIMD&FP register. The destination scalar is twice as long as 


the source vector elements. All the values in this instruction are signed integer values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 
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U 


Advanced SIMD variant 


SADDLV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size:Q == '10@' then UNDEFINED; 
if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 


Assembler symbols 


o | 


<V> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
H when size = 00 
S when size = 01 
D when size = 10 


The encoding size = 11 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 10, Q = 0. 


° size = 11,Q = x. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
integer sum; 


sum = Int(Elem[operand, 0, esize], unsigned); 
for e = 1 to elements-1 
sum = sum + Int(Elem[operand, e, esize], unsigned); 


V[d] = sum<2xesize-1:0>; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.225 


C7-1884 


SADDW, SADDW2 


Signed Add Wide. This instruction adds vector elements of the first source SIMD&FP register to the corresponding 
vector elements in the lower or upper half of the second source SIMD&FP register, places the results in a vector, 
and writes the vector to the SIMD&FP destination register. 


The SADDW instruction extracts the second source vector from the lower half of the second source register, while the 
SADDW2 instruction extracts the second source vector from the upper half of the second source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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Three registers, not all the same type variant 


SADDW{2} <Vd>.<Ta>, <Vn>.<Ta>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d 
n 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 

esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 

elements = datasize DIV esize; 


sub_op 


(01 == '1'); 


unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Vm> 


<Tb> 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
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16B 
4H 
8H 
2S 
4S 


when size 
when size 
when size 
when size 


when size 
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= 00,Q=1 
= 01,Q0=0 
=01,Q=1 
= 10,Q=0 
= 10,Q=1 


The encoding size = 11, Q = x is reserved. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(2sdatasize) operandl = V[n]; 
bits(datasize) operand2 = Vpart[m, part]; 


bits(2sdatasize) result; 
integer element1; 
integer element2; 


integer sum; 


for e = 0 to elements-1 


element1 = Int(Elem[operand1, e, 2*esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 


if sub_op then 


sum = elementl - element2; 


else 


sum = elementl + element2; 
Elem[result, e, 2xesize] = sum<2xesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.226 


C7-1886 


SCVTF (vector, fixed-point) 


Signed fixed-point Convert to Floating-point (vector). This instruction converts each element in a vector from 
fixed-point to floating-point using the rounding mode that is specified by the FPCR, and writes the result to the 


SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 1918 16|15141312/1110 9 | 5 4| 0 | 


fo io[r rt E [inne [17 to os] an TR 


immh 


Scalar variant 


SCVTF <V><d>, <V><n>, #<fbits> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if immh == '000x' || (immh == 'QQ1x' && !HaveFP16Ext()) then UNDEFINED; 

integer esize = if immh == '1xxx' then 64 else if immh == 'Q1xx' then 32 else 16; 
integer datasize = esize; 

integer elements = 1; 


integer fracbits = (esize » 2) - UInt(immh:immb); 
boolean unsigned = (U == '1'); 
FPRounding rounding = FPRoundingMode(FPCR) ; 


Vector 


|31 30 29 28|27 26 25 24/23 22 1918 16|15141312/1110 9 | 5 4| 0 | 


oel +4 4 + of 0000 [immb [rT 0 ofa] en Re 


immh 


Vector variant 


SCVTF <Vd>.<T>, <Vn>.<T>, #<fbits> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 

if immh == '000x' || (immh == 'QQ1x' && !HaveFP16Ext()) then UNDEFINED; 

if immh<3>:Q == '10' then UNDEFINED; 

integer esize = if immh == '1xxx' then 64 else if immh == 'Q1xx' then 32 else 16; 
integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 
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integer fracbits = (esize » 2) - UInt(immh:immb) ; 
boolean unsigned = (U == '1'); 
FPRounding rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<fbits> 


Is a width specifier, encoded in the "immh" field. It can have the following values: 
H when immh = 001x 


S when immh = 01xx 


D when immh = 1xxx 


The encoding immh = 000x is reserved. 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Immh:Q" field. It can have the following values: 


4H when immh = 001x, Q = 0 


8H when immh = Q01x,Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 
2D when immh = 1xxx,Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The following encodings are reserved: 

° immh = 0001, Q = x. 

. immh = 1xxx, Q = 0. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the scalar variant: is the number of fractional bits, in the range 1 to the operand width, encoded 
in the "immh:immb" field. It can have the following values: 

(32-Uint(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = 01xx 

(128-UInt(immh:immb)) when immh = 1xxx 

The encoding immh = 000x is reserved. 


For the vector variant: is the number of fractional bits, in the range | to the element width, encoded 
in the "immh:immb" field. It can have the following values: 


(32-Uint(immh:immb)) when immh = 001x 


(64-UInt(immh:immb)) when immh = 01xx 
(128-UInt(immh:immb)) when immh = 1xxx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 0001 is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
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element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FixedToFP(element, fracbits, unsigned, FPCR, rounding); 


V[d] = result; 
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C7.2.227 SCVTF (vector, integer) 


Signed integer Convert to Floating-point (vector). This instruction converts each element in a vector from signed 
integer to floating-point using the rounding mode that is specified by the FPCR, and writes the result to the 
SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


foil rat oof rr roost to if of ae TR 


Scalar half precision variant 


SCVTF <Hd>, <Hn> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d 
integer n 


UInt(Rd) ; 
UInt(Rn) ; 


integer esize = 16; 

integer datasize = esize; 
integer elements = 1; 

boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9. | 5 4| 0 | 


foil Tit poet ooo oe tro Tf of a TR 


Scalar single-precision and double-precision variant 


SCVTF <V><d>, <V><n> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd) ; 
UInt(Rn) ; 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

boolean unsigned = (U == '1'); 


Vector half precision 


ARMVv8.2 
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C7-1890 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oleole +77 ofoli77+ 1001770710] Rn | Rd 
U 


Vector half precision variant 


SCVTF <Vd>.<T>, <Vn>.<T> 
Decode for this encoding 
if !HaveFP16Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer esize = 16; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 


Vector single-precision and double-precision 
|31 30 29 28|27 26 25 24/23 22 21 20/1918 17 16|15 14 13 12|11 10 9. | 5 4| 0 | 


fofafofo +771 Ofofsjio000i11707)10] Rn | Rd 
U 


Vector single-precision and double-precision variant 


SCVTF <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz:Q == '10' then UNDEFINED; 

integer esize = 32 << UInt(sz); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 


Assembler symbols 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hn> Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
<V> Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 
D when sz = 1 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 
4H when Q = 0 
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8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1,Q = Q is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
FPRounding rounding = FPRoundingMode(FPCR) ; 
bits(esize) element; 
for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FixedToFP(element, @, unsigned, FPCR, rounding); 


V[d] = result; 
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C7.2.228 SCVTF (scalar, fixed-point) 


C7-1892 


Signed fixed-point Convert to Floating-point (scalar). This instruction converts the signed value in the 32-bit or 
64-bit general-purpose source register to a floating-point value using the rounding mode that is specified by the 


FPCR, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 | 109 


FG Cc = GR 


rmode opcode 


32-bit to half-precision variant 
Applies when sf == 0 && ftype == 11. 


SCVTF <Hd>, <Wn>, #<fbits> 


32-bit to single-precision variant 
Applies when sf == 0 && ftype == 00. 


SCVTF <Sd>, <Wn>, #<fbits> 


32-bit to double-precision variant 
Applies when sf == 0 && ftype == 01. 


SCVTF <Dd>, <Wn>, #<fbits> 


64-bit to half-precision variant 
Applies when sf == 1 && ftype == 11. 


SCVTF <Hd>, <Xn>, #<fbits> 


64-bit to single-precision variant 
Applies when sf == 1 && ftype == 00. 


SCVTF <Sd>, <Xn>, #<fbits> 


64-bit to double-precision variant 
Applies when sf == 1 && ftype == 01. 


SCVTF <Dd>, <Xn>, #<fbits> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


case ftype of 
when '00' fltsize = 32; 
when 'Q1' fltsize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


if sf == '@' && scale<5> == '@' then UNDEFINED; 
integer fracbits = 64 - UInt(scale); 


rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<fbits> For the 32-bit to double-precision, 32-bit to half-precision and 32-bit to single-precision variant: is 


the number of bits after the binary point in the fixed-point source, in the range | to 32, encoded as 
64 minus "scale". 


For the 64-bit to double-precision, 64-bit to half-precision and 64-bit to single-precision variant: is 
the number of bits after the binary point in the fixed-point source, in the range 1 to 64, encoded as 
64 minus "scale". 


Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


intval = X[n]; 
fltval = FixedToFP(intval, fracbits, FALSE, FPCR, rounding); 
V[d] = fltval; 
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C7.2.229 SCVTF (scalar, integer) 


C7-1894 


Signed integer Convert to Floating-point (scalar). This instruction converts the signed integer value in the 
general-purpose source register to a floating-point value using the rounding mode that is specified by the FPCR, and 


writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28/27 26 25 24|23 22 2120/1918  16/15141312/11109 | 


olde ole col ole ome ee 


rmode opcode 


32-bit to half-precision variant 
Applies when sf == 0 && ftype == 11. 


SCVTF <Hd>, <Wn> 


32-bit to single-precision variant 
Applies when sf == 0 && ftype == 00. 


SCVTF <Sd>, <Wn> 


32-bit to double-precision variant 
Applies when sf == 0 && ftype == 01. 


SCVTF <Dd>, <Wn> 


64-bit to half-precision variant 
Applies when sf == 1 && ftype == 11. 


SCVTF <Hd>, <Xn> 


64-bit to single-precision variant 
Applies when sf == 1 && ftype == 00. 


SCVTF <Sd>, <Xn> 


64-bit to double-precision variant 
Applies when sf == 1 && ftype == 01. 


SCVTF <Dd>, <Xn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


intval = X[n]; 
fltval = FixedToFP(intval, @, FALSE, FPCR, rounding); 
V[d] = fltval; 
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C7.2.230 


C7-1896 


SDOT (by element) 


Dot Product signed arithmetic (vector, by element). This instruction performs the dot product of the four 8-bit 
elements in each 32-bit element of the first source register with the four 8-bit elements of an indexed 32-bit element 
in the second source register, accumulating the result into the corresponding 32-bit element of the destination 


register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 


Note 





ID_AA64ISARO_EL1.DP indicates whether this instruction is supported. 





ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 5 4| 


CC CACAN ++ + Ea C E 1 TC Ra TJ 


Vector variant 


SDOT <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.4B[<index>] 


Decode for this encoding 


if !HaveDOTPExt() then UNDEFINED; 
if size != '10' then UNDEFINED; 
boolean signed = (U == '0'); 


integer 
integer 
integer 


integer in 


integer 
integer 
integer 


d 
n 
m 
i 


Q Il 


UInt(Rd); 
UInt(Rn); 
UInt(M:Rm); 

x = UInt(H:L); 


esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


Assembler symbols 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Vm> 


<index> 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(128) operand2 = V[m]; 
bits(datasize) result = V[d]; 
for e = 0 to elements-1 

integer res = 0; 

integer element1, element2; 

for i = 0 to 3 

if signed then 

element1 = SInt(Elem[operand1, 4*e+1, esize DIV 4]); 
element2 = SInt(Elem[operand2, 4*index+i, esize DIV 4]) 


else 
element1 = UInt(Elem[operand1, 4*e+1, esize DIV 4]); 
element2 = UInt(Elem[operand2, 4«index+i, esize DIV 4]); 
res = res + elementl « element2; 

Elem[result, e, esize] = Elem[result, e, esize] + res; 
V[d] = result; 
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C7.2.231 


C7-1898 


SDOT (vector) 


Dot Product signed arithmetic (vector). This instruction performs the dot product of the four 8-bit elements in each 
32-bit element of the first source register with the four 8-bit elements of the corresponding 32-bit element in the 
second source register, accumulating the result into the corresponding 32-bit element of the destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 


Note 
ID_AA64ISARO_EL1.DP indicates whether this instruction is supported. 








ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| 0 | 


fo[afofo +771 Ofszefo. rm Hooro] Rn | Rd 
U 


Three registers of the same type variant 


SDOT <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


if !HaveDOTPExt() then UNDEFINED; 
if size != '10' then UNDEFINED; 
boolean signed = (U == 'Q'); 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
2S when Q = 0 
4S when Q = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


result = V[d]; 
for e = 0 to elements-1 

integer res = 0; 

integer element1, element2; 

for i = 0 to 3 

if signed then 

element1 = SInt(Elem[operand1, 4*e+1, esize DIV 4]); 
element2 = SInt(Elem[operand2, 4«e+1, esize DIV 4]); 


else 
element1 = UInt(Elem[operand1, 4*e+1, esize DIV 4]); 
element2 = UInt(Elem[operand2, 4*e+1, esize DIV 4]); 
res = res + elementl « element2; 
Elem[result, e, esize] = Elem[result, e, esize] + res; 
V[d] = result; 
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C7.2.232 


C7-1900 


SHA1C 


SHA1 hash update (choose). 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


fot orrn 0/0 ojo] Rm [ojooojoo] rn | Rd 


Advanced SIMD variant 


SHAIC <Qd>, <Sn>, <Vm>.4S 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if !HaveSHA1Ext() then UNDEFINED; 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP source and destination, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) X = V[d]; 

bits(32) Y = V[n]; // Note: 32 not 128 bits wide 
bits(128) W = V[m]; 

bits(32) t; 


for e = 0 to 3 
t = SHAchoose(X<63:32>, X<95:64>, X<127:96>); 
Y = Y + ROL(X<31:0>, 5) + t + Elem[W, e, 32]; 
X<63:32> = ROL(X<63:32>, 30); 
<Y, X> = ROL(Y:X, 32); 

V[d] = X; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
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C7.2.233 SHA1H 


ARM DDI 0487E.a 
ID070919 


SHA fixed rotate. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


OTOT11 710001 0700}00000)10] mn | Re 


Advanced SIMD variant 


SHA1H <Sd>, <Sn> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
if !HaveSHA1Ext() then UNDEFINED; 


Assembler symbols 


<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the SIMD&FP source register, encoded in the "Rn" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(32) operand = V[n]; // read element [0] only, [1-3] zeroed 
V[d] = ROL(operand, 30); 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.234 


C7-1902 


SHA1M 


SHA1 hash update (majority). 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


orori 0/0 fo] Rm [ojotojoo] rn | Rd 


Advanced SIMD variant 


SHAIM <Qd>, <Sn>, <Vm>.4S 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if !HaveSHA1Ext() then UNDEFINED; 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP source and destination, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) X = V[d]; 

bits(32) Y = V[n]; // Note: 32 not 128 bits wide 
bits(128) W = V[m]; 

bits(32) t; 


for e = 0 to 3 
t = SHAmajority(X<63:32>, X<95:64>, X<127:96>); 
Y = Y + ROL(X<31:0>, 5) + t + Elem[W, e, 32]; 
X<63:32> = ROL(X<63:32>, 30); 
<Y, X> = ROL(Y:X, 32); 

V[d] = X; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.235 SHA1P 
SHAL hash update (parity). 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


orori 0/0 fo] Rm [ojoo joo] rn | Rd 


Advanced SIMD variant 


SHA1P <Qd>, <Sn>, <Vm>.4S 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if !HaveSHA1Ext() then UNDEFINED; 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP source and destination, encoded in the "Rd" field. 
<Sn> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) X = V[d]; 

bits(32) Y = V[n]; // Note: 32 not 128 bits wide 
bits(128) W = V[m]; 

bits(32) t; 


for e = 0 to 3 
t = SHAparity(X<63:32>, X<95:64>, X<127:96>); 
Y = Y + ROL(X<31:0>, 5) + t + Elem[W, e, 32]; 
X<63:32> = ROL(X<63:32>, 30); 
<Y, X> = ROL(Y:X, 32); 

V[d] = X; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.236 


C7-1904 


SHA1SU0 


SHALI schedule update 0. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9 | 5 4| 0 | 


orori 0/0 jo] Rm [ojo1ijoo] rn | Rd 


Advanced SIMD variant 


SHA1SUQ <Vd>.4S, <Vn>.4S, <Vm>.4S 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if !HaveSHA1Ext() then UNDEFINED; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 


<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 


Operation 
AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) operand1 = V[d]; 
bits(128) operand2 = V[n]; 
bits(128) operand3 = V[m]; 
bits(128) result; 


result = operand2<63:0>:operand1<127:64>; 
result = result EOR operand1 EOR operand3; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.237  SHA1SU1 


SHALI schedule update 1. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


OTOT11 ojoo 07000000710] mn | Rd 


Advanced SIMD variant 


SHA1SU1 <Vd>.4S, <Vn>.4S 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
if !HaveSHA1Ext() then UNDEFINED; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) operandl = V[d]; 

bits(128) operand2 = V[n]; 

bits(128) result; 

bits(128) T = operand1 EOR LSR(operand2, 32); 
result<31:0> = ROL(T<31:@>, 1); 

result<63:32> = ROL(T<63:32>, 1); 

result<95:64> = ROL(T<95:64>, 1); 

result<127:96> = ROL(T<127:96>, 1) EOR ROL(T<31:0>, 2); 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.238 


C7-1906 


SHA256H2 


SHA256 hash update (part 2). 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


0701177700 fo] Rm Jo ojoo] rn | Re 
P 


Advanced SIMD variant 


SHA256H2 <Qd>, <Qn>, <Vm>.4S 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if !HaveSHA256Ext() then UNDEFINED; 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP source and destination, encoded in the "Rd" field. 
<Qn> Is the 128-bit name of the second SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) result; 
result = SHA256hash(V[n], V[d], V[m], FALSE); 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.239 SHA256H 
SHA256 hash update (part 1). 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


0701177700 fo] Rm Jol ojojo o) rn J Re 
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Advanced SIMD variant 


SHA256H <Qd>, <Qn>, <Vm>.4S 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if !HaveSHA256Ext() then UNDEFINED; 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP source and destination, encoded in the "Rd" field. 
<Qn> Is the 128-bit name of the second SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) result; 
result = SHA256hash(V[d], V[n], V[m], TRUE); 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.240 


C7-1908 


SHA256SU0 


SHA256 schedule update 0. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 1817 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oTOtT17 710001070 0J000710)10] mn | Rd 


Advanced SIMD variant 


SHA256SU@ <Vd>.4S, <Vn>.4S 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
if !HaveSHA256Ext() then UNDEFINED; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 


<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 


Operation 
AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) operand1 = V[d]; 

bits(128) operand2 = V[n]; 

bits(128) result; 

bits(128) T = operand2<31:0>:operand1<127 : 32>; 
bits(32) elt; 


for e = 0 to 3 

elt = Elem[T, e, 32]; 
elt = ROR(elt, 7) EOR ROR(elt, 18) EOR LSR(elt, 3); 
Elem[result, e, 32] = elt + Elem[operandi, e, 32]; 
V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


SHA256SU1 


ARM DDI 0487E.a 


SHA256 schedule update 1. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0 | 


fot 01477 0/0 ojo] Rm [oji1ojoo] en | Rd 


Advanced SIMD variant 


SHA256SU1 <Vd>.4S, <Vn>.4S, <Vm>.4S 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if !HaveSHA256Ext() then UNDEFINED; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) operandl = V[d]; 

bits(128) operand2 = V[n]; 

bits(128) operand3 = V[m]; 

bits(128) result; 

bits(128) T0 = operand3<31:0>:operand2<127: 32>; 
bits(64) T1; 

bits(32) elt; 


T1 = operand3<127:64>; 

fore =0 to1 
elt = Elem[T1, e, 32]; 
elt = ROR(elt, 17) EOR ROR(elt, 19) EOR LSR(elt, 10); 
elt = elt + Elem[operand1, e, 32] + Elem[TQ, e, 32]; 
Elem[result, e, 32] = elt; 


T1 = result<63:0>; 

for e = 2 to 3 
elt = Elem[T1, e-2, 32]; 
elt = ROR(elt, 17) EOR ROR(elt, 19) EOR LSR(elt, 10); 
elt = elt + Elem[operand1, e, 32] + Elem[T, e, 32]; 
Elem[result, e, 32] = elt; 


V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
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C7.2.242 SHA512H 


SHAS512 Hash update part 1 takes the values from the three 128-bit source SIMD&FP registers and produces a 
128-bit output value that combines the sigmal and chi functions of two iterations of the SHA512 computation. It 
returns this value to the destination SIMD&FP register. 


This instruction is implemented only when ARMv8.2-SHA is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


1toor1tz10071] Rm _ [tfofoofoof Rn | Ra | 


Advanced SIMD variant 


SHA512H <Qd>, <Qn>, <Vm>.2D 


Decode for this encoding 


if !HaveSHA512Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Qn> Is the 128-bit name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 

Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vtmp; 
bits(64) MSigmal; 
bits(64) tmp; 
bits(128) X = V[n]; 
bits(128) Y 
bits(128) W 


oul 
<< 
os 
o3 
os 


MSigmal = ROR(Y<127:64>, 14) EOR ROR(Y<127:64>, 18) EOR ROR(Y<127:64>, 41); 
Vtmp<127:64> = (Y<127:64> AND X<63:@>) EOR (NOT(Y<127:64>) AND X<127:64>); 
Vtmp<127:64> = (Vtmp<127:64> + MSigmal + W<127:64>); 

tmp = Vtmp<127:64> + Y<63:0>; 

MSigmal = ROR(tmp, 14) EOR ROR(tmp, 18) EOR ROR(tmp, 41); 

Vtmp<63:@> = (tmp AND Y<127:64>) EOR (NOT(tmp) AND X<63:Q>); 

Vtmp<63:0> = (Vtmp<63:0> + MSigmal + W<63:0>); 

V[d] = Vtmp; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


C7-1912 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.243  SHA512H2 


ARM DDI 0487E.a 
ID070919 


SHAS512 Hash update part 2 takes the values from the three 128-bit source SIMD&FP registers and produces a 
128-bit output value that combines the sigma0 and majority functions of two iterations of the SHA512 computation. 
It returns this value to the destination SIMD&FP register. 


This instruction is implemented only when ARMv8.2-SHA is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


11001110011] Rm [ijofooforsf Rn | Ra | 


Advanced SIMD variant 


SHA512H2 <Qd>, <Qn>, <Vm>.2D 


Decode for this encoding 


if !HaveSHA512Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Qn> Is the 128-bit name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 

Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vtmp; 
bits(64) NSigmaQ; 
bits(128) X = V[n]; 
bits(128) Y = V[m]; 
bits(128) W = V[d]; 


NSigma@ = ROR(Y<63:@>, 28) EOR ROR(Y<63:0>, 34) EOR ROR(Y<63:0>, 39); 

Vtmp<127:64> = (X<63:0> AND Y<127:64>) EOR (X<63:0> AND Y<63:@>) EOR (Y<127:64> AND Y<63:0>); 
Vtmp<127:64> = (Vtmp<127:64> + NSigmaQ + W<127:64>); 

NSigma@ = ROR(Vtmp<127:64>, 28) EOR ROR(Vtmp<127:64>, 34) EOR ROR(Vtmp<127:64>, 39); 

Vtmp<63:0> = (Vtmp<127:64> AND Y<63:0>) EOR (Vtmp<127:64> AND Y<127:64>) EOR (Y<127:64> AND Y<63:0>); 
Vtmp<63:0> = (Vtmp<63:0> + NSigma®@ + W<63:0>); 


V[Ed] = Vtmp; 


Operational information 
If PSTATE.DIT is 1: 
è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.244 SHA512SU0 


SHAS512 Schedule Update 0 takes the values from the two 128-bit source SIMD&FP registers and produces a 
128-bit output value that combines the gamma0 functions of two iterations of the SHA512 schedule update that are 
performed after the first 16 iterations within a block. It returns this value to the destination SIMD&FP register. 


ARM DDI 0487E.a 
ID070919 


This instruction is implemented only when ARMv8.2-SHA is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/11 10 9 m 5 4| 0| 


1100111011000000 100 o0ļoo0| R | Ra | 


Advanced SIMD variant 


SHA512SU0 <Vd>.2D, <Vn>.2D 


Decode for this encoding 
if !HaveSHA512Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(64) sigQ; 

bits(128) Vtmp; 

bits(128) X = V[n]; 

bits(128) W = V[d]; 

sigð = ROR(W<127:64>, 1) EOR ROR(W<127:64>, 8) EOR ('0000000':W<127:71>); 
Vtmp<63:0> = W<63:0> + sigQ; 

sigð = ROR(X<63:@>, 1) EOR ROR(X<63:0>, 8) EOR ('0000000' :X<63:7>); 
Vtmp<127:64> = W<127:64> + sigQ; 

V[Ed] = Vtmp; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.245 


C7-1916 


SHA512SU1 


SHAS512 Schedule Update 1 takes the values from the three source SIMD&FP registers and produces a 128-bit 
output value that combines the gammal functions of two iterations of the SHA512 schedule update that are 
performed after the first 16 iterations within a block. It returns this value to the destination SIMD&FP register. 


This instruction is implemented only when ARMv8.2-SHA is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


11001110071] Rm _ [tfofo oft of Rn | Ra | 


Advanced SIMD variant 


SHA512SU1 <Vd>.2D, <Vn>.2D, <Vm>.2D 


Decode for this encoding 


if !HaveSHA512Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(64) sigl; 
bits(128) Vtmp; 
bits(128) X = V[n]; 
bits(128) Y = V[m]; 
bits(128) W = V[d]; 


sigl = ROR(X<127:64>, 19) EOR ROR(X<127:64>, 61) EOR ('@00000' :X<127:70>) ; 
Vtmp<127:64> = W<127:64> + sigl + Y<127:64>; 

sigl = ROR(X<63:@>, 19) EOR ROR(X<63:0>, 61) EOR ('Q00000':X<63:6>); 
Vtmp<63:0> = W<63:0> + sigl + Y<63:0>; 

V[Ed] = Vtmp; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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C7.2.246 SHADD 


C7-1918 


Signed Halving Add. This instruction adds corresponding signed integer values from the two source SIMD&FP 
registers, shifts each result right one bit, places the results into a vector, and writes the vector to the destination 


SIMD&FP register. 


The results are truncated. For rounded results, see SRHADD. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 


o | 


fo[afoo +771 Ofsze]i] Rm [oo 0000/1] Rn | Rd | 
U 


Three registers of the same type variant 


SHADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

integer element1; 

integer element2; 

integer sum; 
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for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
sum = elementl + element2; 
Elem[result, e, esize] = sum<esize:1>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.247 SHL 


Shift Left (immediate). This instruction reads each value from a vector, left shifts each result by an immediate value, 
writes the final result to a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/11109 | 5 4| o| 


[o ajoji 1 1 1 1 of 10000 | immb [o 1 0 1 oji] Rn | Ra | 


immh 


Scalar variant 


SHL <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


integer shift = UInt(immh:immb) - esize; 
Vector 


|31 30 29 28|27 26 25 24|23 22 1918 16|15 1413 12/1110 9 | 5 4| 0| 


olejojo +777 0] cooo | mme o 1010o] Rn | Rd 


immh 


Vector variant 


SHL <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh); 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = UInt(immh:immb) - esize; 


Assembler symbols 


<V> Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 
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Is the number of the SIMD&FP destination register, in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 
16B when immh = 0001,Q = 1 
4H when immh = 001x, Q = @ 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 
2D when immh = 1xxx, Q = 1 





See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 

The encoding immh = 1xxx, Q = 0 is reserved. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the scalar variant: is the left shift amount, in the range 0 to 63, encoded in the "immh:immb" 
field. It can have the following values: 

(UInt(immh:immb)-64) when immh = 1xxx 

The encoding immh = Qxxx is reserved. 


For the vector variant: is the left shift amount, in the range 0 to the element width in bits minus 1, 
encoded in the "immh:immb" field. It can have the following values: 


(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = Q1xx 
(UInt(immh:immb)-64) when immh = 1xxx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


for e = 0 to elements-1 
Elem[result, e, esize] = LSL(Elem[operand, e, esize], shift); 


V[d] = 


result; 


Operational information 


If PSTATE.DIT is 1: 


à The execution time of this instruction is independent of: 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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C7.2.248 


C7-1922 


SHLL, SHLL2 


Shift Left Long (by element size). This instruction reads each vector element in the lower or upper half of the source 
SIMD&FP register, left shifts each result by the element size, writes the final result to a vector, and writes the vector 
to the destination SIMD&FP register. The destination vector elements are twice as long as the source vector 
elements. 


The SHLL instruction extracts vector elements from the lower half of the source register, while the SHLL2 instruction 
extracts vector elements from the upper half of the source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oleo ose o ooo oori o] Rn | Rd 


Vector variant 


SHLL{2} <Vd>.<Ta>, <Vn>.<Tb>, #<shift> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


integer shift = esize; 
boolean unsigned = FALSE; // Or TRUE without change of functionality 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 

<shift> Is the left shift amount, which must be equal to the source element width in bits, encoded in the 
"size" field. It can have the following values: 
8 when size = 00 


16 when size = 01 


32 when size = 10 


The encoding size = 11 is reserved. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = Vpart[n, part]; 
bits(2sdatasize) result; 

integer element; 


for e = 0 to elements-1 
element = Int(Elem[operand, e, esize], unsigned) << shift; 
Elem[result, e, 2xesize] = element<2sesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.249 


C7-1924 


SHRN, SHRN2 


Shift Right Narrow (immediate). This instruction reads each unsigned integer value from the source SSMD&FP 
register, right shifts each result by an immediate value, puts the final result into a vector, and writes the vector to the 
lower or upper half of the destination SIMD&FP register. The destination vector elements are half as long as the 
source vector elements. The results are truncated. For rounded results, see RSHRN, RSHRN2. 


The RSHRN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the RSHRN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 1918 16/15141312/11109 | 5 4| 0 | 


fo[afoo +717 0] 0000 | immb [100 ojo] rn | Rd 


immh op 


Vector variant 


SHRN{2} <Vd>.<Tb>, <Vn>.<Ta>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


integer shift = (2 » esize) - UInt(immh:immb) ; 
boolean round = (op == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Tb> Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 
8B when immh = 0001, Q = 0 
16B when immh = 0001,Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
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The encoding immh = 1xxx, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<Ta> Is an arrangement specifier, encoded in the "Immh" field. It can have the following values: 
8H when immh = 0001 
4s when immh = 001x 
2D when immh = Q1xx 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 
The encoding immh = 1xxx is reserved. 
<shift> Is the right shift amount, in the range 1 to the destination element width in bits, encoded in the 
"immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = 01xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation 


CheckFPAdvSIMDEnabled64(); 

bits(datasizex2) operand = V[n]; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else Q; 
integer element; 


for e = 0 to elements-1 
element = (UInt(Elem[operand, e, 2*esize]) + round_const) >> shift; 


Elem[result, e, esize] = element<esize-1:0>; 


Vpart[d, part] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.250 


C7-1926 


SHSUB 


Signed Halving Subtract. This instruction subtracts the elements in the vector in the second source SIMD&FP 
register from the corresponding elements in the vector in the first source SIMD&FP register, shifts each result right 
one bit, places each result into elements of a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 


fo[afofo +771 Ofsze]i] Rm [oo 700]7] Rn | Rd 
U 


16|15141312/1110 9. | 5 4| 0 | 


Three registers of the same type variant 


SHSUB <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
== '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U == '1'); 


Assembler symbols 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


<Vd> 

<T> 
8B when size 
16B when size 
4H when size 
8H when size 
2S when size 
4S when size 

<Vn> 

<Vm> 

Operation 


CheckFPAdvSIMDEnabled64(); 


bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m] 


bits(datasize) result; 


integer 
integer 
integer 


for e = 


element1; 
element2; 
diff; 


O to elements-1 


element1 = Int(Elem[operand1, e, esize], unsigned); 
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element2 = Int(Elem[operand2, e, esize], unsigned); 
diff = element1 - element2; 
Elem[result, e, esize] = diff<esize:1>; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.251 SLI 


Shift Left and Insert (immediate). This instruction reads each vector element in the source SIMD&FP register, left 
shifts each vector element by an immediate value, and inserts the result into the corresponding vector element in the 
destination SIMD&FP register such that the new zero bits created by the shift are not inserted but retain their 
existing value. Bits shifted out of the left of each vector element in the source register are lost. 


The following figure shows the operation of shift left by 3 for an 8-bit vector element. 


63 56 55 0 
u E E E 
63 56:55 0 


Vd.B[7] after operation 


63 56 55 0 
Vd.B[7] before operation 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 





Scalar 
|31 TPRI eee biki 16|15 14 13 12|11 10 9 5 4| 
CE TA A E E E 
immh 

Scalar variant 
SLI <V><d>, <V><n>, #<shift> 
Decode for this encoding 

integer d = UInt(Rd); 

integer n = UInt(Rn); 

if immh<3> != '1' then UNDEFINED; 

integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 

integer shift = UInt(immh:immb) - esize; 
Vector 

|31 30 29 28|27 26 25 24|23 22 |1918 16|/15141312|11109 | 5 4| 0| 

fojajif{o 14 1 1 1 of !=0000 | immo [o 1 o 1 oji] Rn | Rd | 

immh 
Vector variant 
SLI <Vd>.<T>, <Vn>.<T>, #<shift> 
C7-1928 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = UInt(immh:immb) - esize; 


Assembler symbols 


<V> Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 


<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 

8B when immh = 0001, Q = 0 

16B when immh = 0001, Q = 1 

4H when immh = 001x, Q = 0 

8H when immh = 001x, Q = 1 

2S when immh = 01xx, Q = 0 

4S when immh = 01xx, Q = 1 

2D when immh = 1xxx, Q = 1 





See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The encoding immh = 1xxx, Q = Q is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<shift> For the scalar variant: is the left shift amount, in the range 0 to 63, encoded in the "immh:immb" 
field. It can have the following values: 
(UInt(immh:immb)-64) when immh = 1xxx 
The encoding immh = Qxxx is reserved. 


For the vector variant: is the left shift amount, in the range 0 to the element width in bits minus 1, 
encoded in the "immh:immb" field. It can have the following values: 


(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = Q1xx 


(UInt(immh:immb)-64) when immh = 1xxx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) operand2 = V[d]; 
bits(datasize) result; 
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bits(esize) mask = LSL(Ones(esize), shift); 
bits(esize) shifted; 


for e = 0 to elements-1 

shifted = LSL(Elem[operand, e, esize], shift); 

Elem[result, e, esize] = (Elem[operand2, e, esize] AND NOT(mask)) OR shifted; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.252  SM3PARTW1 


ARM DDI 0487E.a 
ID070919 


SM3PARTW1 takes three 128-bit vectors from the three source SIMD&FP registers and returns a 128-bit result in 
the destination SIMD&FP register. The result is obtained by a three-way exclusive OR of the elements within the 
input vectors with some fixed rotations, see the Operation pseudocode for more information. 


This instruction is implemented only when ARMv8.2-SM is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


1toor1tz1o00r7t} Rm [ififoofoof Rn | Ra | 


Advanced SIMD variant 


SM3PARTW1 <Vd>.4S, <Vn>.4S, <Vm>.4S 


Decode for this encoding 


if !HaveSM3Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 
bits(128) Vn = V[n]; 
bits(128) Vd = V[d]; 
bits(128) result; 


result<95:@> = (Vd EOR Vn)<95:@> EOR (ROL(Vm<127:96>, 15):ROL(Vm<95:64>, 15):ROL(Vm<63:32>, 15)); 


for i = 0 to 3 
if i == 3 then 
result<127:96> = (Vd EOR Vn)<127:96> EOR (ROL(result<31:0>, 15)); 
result<(32#i)+31:(32#1)> = result<(32#7)+31:(32s1)> EOR ROL(result<(32#i)+31:(32s1)>, 15) EOR 
ROL(result<(32#i)+31:(32i)>, 23); 
V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
7 The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.253 SM3PARTW2 


ARM DDI 0487E.a 
ID070919 


SM3PARTW2 takes three 128-bit vectors from three source SIMD&FP registers and returns a 128-bit result in the 
destination SIMD&FP register. The result is obtained by a three-way exclusive OR of the elements within the input 
vectors with some fixed rotations, see the Operation pseudocode for more information. 


This instruction is implemented only when ARMv8.2-SM is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 1312/1110 9. | 5 4| 0 | 


1toortz100rt} Rm [ififooforf Rn | Ra | 


Advanced SIMD variant 


SM3PARTW2 <Vd>.4S, <Vn>.4S, <Vm>.4S 


Decode for this encoding 


if !HaveSM3Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 

bits(128) Vn = V[n]; 

bits(128) Vd = V[d]; 

bits(128) result; 

bits(128) tmp; 

bits(32) tmp2; 

tmp<127:0> = Vn EOR (ROL(Vm<127:96>, 7):ROL(Vm<95:64>, 7):ROL(Vm<63:32>, 7):ROL(Vm<31:0>, 7)); 
result<127:@> = Vd<127:0> EOR tmp<127:0>; 

tmp2 = ROL(tmp<31:@>, 15); 

tmp2 = tmp2 EOR ROL(tmp2, 15) EOR ROL(tmp2, 23); 
result<127:96> = result<127:96> EOR tmp2; 

V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
$ The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.254  SM3SS1 


ARM DDI 0487E.a 
ID070919 


SM3SS1 rotates the top 32 bits of the 128-bit vector in the first source SIMD&FP register by 12, and adds that 32-bit 
value to the two other 32-bit values held in the top 32 bits of each of the 128-bit vectors in the second and third 
source SIMD&FP registers, rotating this result left by 7 and writing the final result into the top 32 bits of the vector 
in the destination SIMD&FP register, with the bottom 96 bits of the vector being written to 0. 


This instruction is implemented only when ARMv8.2-SM is implemented. 


ARMVv8.2 


|31 30 29 a= 26 25 24|23 22 21 20| 16/15 14 | 109 5 4| 0 | 


Sg DT aS 


Advanced SIMD variant 


SM3SS1 <Vd>.4S, <Vn>.4S, <Vm>.4S, <Va>.4S 


Decode for this encoding 


if !HaveSM3Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer a = UInt(Ra); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
<Va> Is the name of the third SIMD&FP source register, encoded in the "Ra" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 

bits(128) Vn = V[n]; 

bits(128) Vd = V[d]; 

bits(128) Va = V[a]; 

Vd<127:96> = ROL((ROL(Vn<127:96>, 12) + Vm<127:96> + Va<127:96>), 7); 
Vd<95:@> = Zeros(); 

V[d] = Vd; 


Operational information 


If PSTATE.DIT is 1: 


s The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.255 SM3TT1A 


ARM DDI 0487E.a 
ID070919 


SM3TTIA takes three 128-bit vectors from three source SIMD&FP registers and a 2-bit immediate index value, 
and returns a 128-bit result in the destination SIMD&FP register. It performs a three-way exclusive OR of the three 
32-bit fields held in the upper three elements of the first source vector, and adds the resulting 32-bit value and the 


following three other 32-bit values: 


. The bottom 32-bit element of the first source vector, Vd, that was used for the three-way exclusive OR. 


. The result of the exclusive OR of the top 32-bit element of the second source vector, Vn, with a rotation left 


by 12 of the top 32-bit element of the first source vector. 


. A 32-bit element indexed out of the third source vector, Vm. 


The result of this addition is returned as the top element of the result. The other elements of the result are taken from 


elements of the first source vector, with the element returned in bits<63:32> being rotated left by 9. 


This instruction is implemented only when ARMv8.2-SM is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9. | 5 4| 0 | 


fp toortt1ooro} Rm 41 ojimmajo of Rn | Ra | 


Advanced SIMD variant 


SM3TTIA <Vd>.4S, <Vn>.4S, <Vm>.S[<imm2>] 


Decode for this encoding 

if !HaveSM3Ext() then UNDEFINED; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 


integer i = UInt(imm2); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 

<imm2> Is a 32-bit element indexed out of <Vm>, encoded in "imm2". 

Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 
bits(128) Vn = V[n]; 
bits(128) Vd = V[d]; 
bits(32) WjPrime; 
bits(128) result; 
bits(32) TT1; 
bits(32) SS2; 


WjPrime = Elem[Vm, i, 32]; 
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SS2 = Vn<127:96> EOR ROL(Vd<127:96>, 12); 

TT1 = Vd<63:32> EOR (Vd<127:96> EOR Vd<95:64>); 
TT1 = (171+Vd<31:0>+SS2+WjPrime)<31:0>; 
result<31:0> = Vd<63:32>; 

result<63:32> = ROL(Vd<95:64>, 9); 
result<95:64> = Vd<127:96>; 

result<127:96> = TT1; 

V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C7.2.256 SM3TT1B 


ARM DDI 0487E.a 
ID070919 


SM3TT1B takes three 128-bit vectors from three source SIMD&FP registers and a 2-bit immediate index value, and 
returns a 128-bit result in the destination SIMD&FP register. It performs a 32-bit majority function between the 
three 32-bit fields held in the upper three elements of the first source vector, and adds the resulting 32-bit value and 


the following three other 32-bit values: 


e The bottom 32-bit element of the first source vector, Vd, that was used for the 32-bit majority function. 


. The result of the exclusive OR of the top 32-bit element of the second source vector, Vn, with a rotation left 


by 12 of the top 32-bit element of the first source vector. 


. A 32-bit element indexed out of the third source vector, Vm. 


The result of this addition is returned as the top element of the result. The other elements of the result are taken from 


elements of the first source vector, with the element returned in bits<63:32> being rotated left by 9. 


This instruction is implemented only when ARMv8.2-SM is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 0 | 


jp toortt1oo7ro} Rm 1 ojimmajo i| Rn | Ra | 


Advanced SIMD variant 


SM3TT1B <Vd>.4S, <Vn>.4S, <Vm>.S[<imm2>] 


Decode for this encoding 

if !HaveSM3Ext() then UNDEFINED; 
integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 


integer i = UInt(imm2); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 

<imm2> Is a 32-bit element indexed out of <Vm>, encoded in "imm2". 

Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 
bits(128) Vn = V[n]; 
bits(128) Vd = V[d]; 
bits(32) WjPrime; 
bits(128) result; 
bits(32) TT1; 
bits(32) SS2; 


WjPrime = Elem[Vm, i, 32]; 
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C7-1940 


SS2 = Vn<127:96> EOR ROL(Vd<127:96>, 12); 


TT1 


TT1 = (171+Vd<31:0>+SS2+WjPrime)<31:0>; 


result<31:0> = Vd<63:32>; 
result<63:32> = ROL(Vd<95:64>, 9); 
result<95:64> = Vd<127:96>; 
result<127:96> = TT1; 

V[d] = result; 


Operational information 


I 


f PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C7.2.257 SM3TT2A 


ARM DDI 0487E.a 
ID070919 


SM3TT2A takes three 128-bit vectors from three source SIMD&FP register and a 2-bit immediate index value, and 
returns a 128-bit result in the destination SIMD&FP register. It performs a three-way exclusive OR of the three 
32-bit fields held in the upper three elements of the first source vector, and adds the resulting 32-bit value and the 
following three other 32-bit values: 


. The bottom 32-bit element of the first source vector, Vd, that was used for the three-way exclusive OR. 
. The 32-bit element held in the top 32 bits of the second source vector, Vn. 
. A 32-bit element indexed out of the third source vector, Vm. 


A three-way exclusive OR is performed of the result of this addition, the result of the addition rotated left by 9, and 
the result of the addition rotated left by 17. The result of this exclusive OR is returned as the top element of the 
returned result. The other elements of this result are taken from elements of the first source vector, with the element 
returned in bits<63:32> being rotated left by 19. 


This instruction is implemented only when ARMv8.2-SM is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


1100717117007 Of Rm _ [1 Ofimma{t of Rn | Ra | 


Advanced SIMD variant 


SM3TT2A <Vd>.4S, <Vn>.4S, <Vm>.S[<imm2>] 


Decode for this encoding 


if !HaveSM3Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer i = UInt(imm2); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 

<imm2> Is a 32-bit element indexed out of <Vm>, encoded in "imm2". 

Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 
bits(128) Vn = V[n]; 
bits(128) Vd = V[d]; 
bits(32) Wj; 
bits(128) result; 
bits(32) TT2; 


Wj = Elem[Vm, i, 32]; 
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C7-1942 


TT2 = Vd<63:32> EOR (Vd<127:96> EOR Vd<95:64>); 
TT2 = (172+Vd<31:0>4+Vn<127 : 96>+Wj )<31:0>; 


result<31:0> = Vd<63:32>; 

result<63:32> = ROL(Vd<95:64>, 19); 

result<95:64> = Vd<127:96>; 

result<127:96> = TT2 EOR ROL(TT2, 9) EOR ROL(TT2, 17); 
V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.258 SM3TT2B 


ARM DDI 0487E.a 
ID070919 


SM3TT2B takes three 128-bit vectors from three source SIMD&FP registers, and a 2-bit immediate index value, 
and returns a 128-bit result in the destination SIMD&FP register. It performs a 32-bit majority function between the 
three 32-bit fields held in the upper three elements of the first source vector, and adds the resulting 32-bit value and 
the following three other 32-bit values: 


° The bottom 32-bit element of the first source vector, Vd, that was used for the 32-bit majority function. 
. The 32-bit element held in the top 32 bits of the second source vector, Vn. 
. A 32-bit element indexed out of the third source vector, Vm. 


A three-way exclusive OR is performed of the result of this addition, the result of the addition rotated left by 9, and 
the result of the addition rotated left by 17. The result of this exclusive OR is returned as the top element of the 
returned result. The other elements of this result are taken from elements of the first source vector, with the element 
returned in bits<63:32> being rotated left by 19. 


This instruction is implemented only when ARMv8.2-SM is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


1100717117007 Of Rm _ [1 olimmi 1| Rn | Ra | 


Advanced SIMD variant 


SM3TT2B <Vd>.4S, <Vn>.4S, <Vm>.S[<imm2>] 


Decode for this encoding 


if !HaveSM3Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer i = UInt(imm2); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 

<Vm> Is the name of the third SIMD&FP source register, encoded in the "Rm" field. 

<imm2> Is a 32-bit element indexed out of <Vm>, encoded in "imm2". 

Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 
bits(128) Vn = V[n]; 
bits(128) Vd = V[d]; 
bits(32) Wj; 
bits(128) result; 
bits(32) TT2; 


Wj = Elem[Vm, i, 32]; 
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C7-1944 


TT2 


(Vd<127:96> AND Vd<95:64>) OR (NOT(Vd<127:96>) AND Vd<63:32>); 


TT2 = (TT2+Vd<31:0>+Vn<127:96>+Wj)<31:0>; 


result<31:0> = Vd<63:32>; 

result<63:32> = ROL(Vd<95:64>, 19); 

result<95:64> = Vd<127:96>; 

result<127:96> = TT2 EOR ROL(TT2, 9) EOR ROL(TT2, 17); 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 


. The response of this instruction to asynchronous exceptions does not vary based on: 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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SM4E 


SM4 Encode takes input data as a 128-bit vector from the first source SIMD&FP register, and four iterations of the 
round key held as the elements of the 128-bit vector in the second source SIMD&FP register. It encrypts the data 
by four rounds, in accordance with the SM4 standard, returning the 128-bit result to the destination SIMD&FP 


register. 


This instruction is implemented only when ARMv8.2-SM is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


TioOTTIOT7O0OODOTO0OON Rn | Ra | 


Advanced SIMD variant 


SM4E <Vd>.4S, <Vn>.4S 


Decode for this encoding 
if !HaveSM4Ext() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP source and destination register, encoded in the "Rd" field. 
<Vn> Is the name of the second SIMD&FP source register, encoded in the "Rn" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vn = V[n]; 
bits(32) intval; 
bits(8) sboxout; 
bits(128) roundresult; 
bits(32) roundkey; 


roundresult = V[d]; 
for index = 0 to 3 
roundkey = Elem[Vn, index, 32]; 
intval = roundresult<127:96> EOR roundresult<95:64> EOR roundresult<63:32> EOR roundkey; 


for i = 0 to 3 
Elem[intval, i, 8] = Sbox(Elem[intval, i, 8]); 


jintval = intval EOR ROL(intval, 2) EOR ROL(intval, 10) EOR ROL(intval, 18) EOR ROL(intval, 24); 


intval = intval EOR roundresult<31:0>; 


roundresult<31:0> = roundresult<63: 32>; 
roundresult<63:32> = roundresult<95:64>; 
roundresult<95:64> = roundresult<127:96>; 
roundresult<127:96> = intval; 

V[d] = roundresult; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.260 SM4EKEY 


SM4 Key takes an input as a 128-bit vector from the first source SIMD&FP register and a 128-bit constant from the 
second SIMD&FP register. It derives four iterations of the output key, in accordance with the SM4 standard, 
returning the 128-bit result to the destination SIMD&FP register. 


This instruction is implemented only when ARMv8.2-SM is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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Advanced SIMD variant 


SM4EKEY <Vd>.4S, <Vn>.4S, <Vm>.4S 


Decode for this encoding 


if !HaveSM4Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 
bits(32) intval; 
bits(8) sboxout; 
bits(128) result; 
bits(32) const; 
bits(128) roundresult; 


roundresult = V[n]; 
for index = 0 to 3 
const = Elem[Vm, index, 32]; 


intval = roundresult<127:96> EOR roundresult<95:64> EOR roundresult<63:32> EOR const; 


for i = 0 to 3 
Elem[intval, i, 8] = Sbox(Elem[intval, i, 8]); 


intval = intval EOR ROL(intval, 13) EOR ROL(intval, 23); 
jintval = intval EOR roundresult<31:0>; 


roundresult<31:0> = roundresult<63: 32>; 
roundresult<63:32> = roundresult<95:64>; 
roundresult<95:64> = roundresult<127:96>; 
roundresult<127:96> = intval; 

V[d] = roundresult; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.261 SMAX 


ARM DDI 0487E.a 
ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Signed Maximum (vector). This instruction compares corresponding elements in the vectors in the two source 
SIMD&FP registers, places the larger of each pair of signed integer values into a vector, and writes the vector to the 
destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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Three registers of the same type variant 


SMAX <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 
boolean 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U 
minimum = (o1 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Operation 


'1'); 
'1'); 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size 
when size 
when size 
when size 
when size 


when size 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


integer element1; 
integer element2; 
integer maxmin; 
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for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
maxmin = if minimum then Min(elementl, element2) else Max(element1, element2); 
Elem[result, e, esize] = maxmin<esize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.262 SMAXP 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Signed Maximum Pairwise. This instruction creates a vector by concatenating the vector elements of the first source 
SIMD&FP register after the vector elements of the second source SIMD&FP register, reads each pair of adjacent 

vector elements in the two source SIMD&FP registers, writes the largest of each pair of signed integer values into 
a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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1615 14 13 12|11 10 9. | 5 4| 0| 


Three registers of the same type variant 


SMAXP <Vd>.<T>, <Vn>.<T>, 


Decode for this encodi 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UND 
integer esize = 8 << UIn 
integer datasize 


<Vm>.<T> 


ng 


EFINED; 
t(size); 


if Q == '1' then 128 else 64; 


integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean minimum = (01 == '1'); 
Assembler symbols 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64( 
bits(datasize) operand1 


bits(datasize) operand2 = 


bits(datasize) result; 
bits(2*datasize) concat 
integer element1; 
integer element2; 


); 


I ou 
= = 
3 5 


= operand2:operand1; 
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integer maxmin; 


for e = 0 to elements-1 
element1 = Int(Elem[concat, 2e, esize], unsigned); 
element2 = Int(Elem[concat, (2xe)+1, esize], unsigned); 
maxmin = if minimum then Min(elementl, element2) else Max(element1, element2); 
Elem[result, e, esize] = maxmin<esize-1:0>; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.263 SMAXV 


Signed Maximum across Vector. This instruction compares all the vector elements in the source SIMD&FP register, 
and writes the largest of the values as a scalar to the destination SIMD&FP register. All the values in this instruction 
are signed integer values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Advanced SIMD variant 


SMAXV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size:Q == '10@' then UNDEFINED; 

if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean min = (op == '1'); 


Assembler symbols 


<V> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 


The encoding size = 11 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 10, Q = 0. 


° size = 11,Q = x. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
integer maxmin; 

integer element; 


maxmin = Int(Elem[operand, 0, esize], unsigned); 
for e = 1 to elements-1 
element = Int(Elem[operand, e, esize], unsigned); 
maxmin = if min then Min(maxmin, element) else Max(maxmin, element); 


V[d] = maxmin<esize-1:0>; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C7.2.264 SMIN 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Signed Minimum (vector). This instruction compares corresponding elements in the vectors in the two source 
SIMD&FP registers, places the smaller of each of the two signed integer values into a vector, and writes the vector 
to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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Three registers of the same type variant 


SMIN <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 
boolean 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U 
minimum = (o1 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Operation 


'1'); 
'1'); 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size 
when size 
when size 
when size 
when size 


when size 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


integer element1; 
integer element2; 
integer maxmin; 
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for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
maxmin = if minimum then Min(elementl, element2) else Max(element1, element2); 
Elem[result, e, esize] = maxmin<esize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.265 SMINP 
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Signed Minimum Pairwise. This instruction creates a vector by concatenating the vector elements of the first source 
SIMD&FP register after the vector elements of the second source SIMD&FP register, reads each pair of adjacent 
vector elements in the two source SIMD&FP registers, writes the smallest of each pair of signed integer values into 
a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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Three registers of the same type variant 


SMINP <Vd>.<T>, <Vn>.<T>, 


Decode for this encodi 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UND 
integer esize = 8 << UIn 
integer datasize 


<Vm>.<T> 


ng 


EFINED; 
t(size); 


if Q == '1' then 128 else 64; 


integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean minimum = (01 == '1'); 
Assembler symbols 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64( 
bits(datasize) operand1 


bits(datasize) operand2 = 


bits(datasize) result; 
bits(2*datasize) concat 
integer element1; 
integer element2; 


); 


I ou 
= = 
3 5 


= operand2:operand1; 
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integer maxmin; 


for e = 0 to elements-1 
element1 = Int(Elem[concat, 2e, esize], unsigned); 
element2 = Int(Elem[concat, (2xe)+1, esize], unsigned); 
maxmin = if minimum then Min(elementl, element2) else Max(element1, element2); 
Elem[result, e, esize] = maxmin<esize-1:0>; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.266 SMINV 


Signed Minimum across Vector. This instruction compares all the vector elements in the source SIMD&FP register, 
and writes the smallest of the values as a scalar to the destination SIMD&FP register. All the values in this 
instruction are signed integer values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 
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Advanced SIMD variant 


SMINV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size:Q == '10@' then UNDEFINED; 

if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean min = (op == '1'); 


Assembler symbols 


<V> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 


The encoding size = 11 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 10, Q = 0. 


° size = 11,Q = x. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
integer maxmin; 

integer element; 


maxmin = Int(Elem[operand, 0, esize], unsigned); 
for e = 1 to elements-1 
element = Int(Elem[operand, e, esize], unsigned); 
maxmin = if min then Min(maxmin, element) else Max(maxmin, element); 


V[d] = maxmin<esize-1:0>; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C7.2.267 SMLAL, SMLAL2 (by element) 


Signed Multiply-Add Long (vector, by element). This instruction multiplies each vector element in the lower or 
upper half of the first source SIMD&FP register by the specified vector element in the second source SIMD&FP 
register, and accumulates the results with the vector elements of the destination SIMD&FP register. The destination 
vector elements are twice as long as the elements that are multiplied. All the values in this instruction are signed 
integer values. 


The SMLAL instruction extracts vector elements from the lower half of the first source register, while the SMLAL2 
instruction extracts vector elements from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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Vector variant 


SMLAL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'Q': 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean sub_op = (02 == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
4s when size = 01 
2D when size = 10 
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C7-1962 


<Vn> 


<Tb> 


<Vm> 


<Ts> 


<index> 


Operation 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 00, Q =x. 


° size = 11,Q = x. 


Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 


the following values: 


01 
10 


O:Rm when size 


M: Rm when size 


The following encodings are reserved: 
° size = 00. 
° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 

S when size = 10 

The following encodings are reserved: 

e size = 00. 


. size = 11. 


Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 


H:L:M when size = 01 

H:L when size = 10 

The following encodings are reserved: 
° size = 00. 


. size = 11. 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = Vpart[n, part]; 
bits(idxdsize) operand2 = V[m]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 


element2 = Int(Elem[operand2, index, esize], unsigned); 
for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
product = (elementl«element2)<2«esize-1:0>; 
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if sub_op then 

Elem[result, e, 2*esize] = Elem[operand3, e, 2xesize] - product; 
else 

Elem[result, e, 2*esize] = Elem[operand3, e, 2xesize] + product; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


š The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.268 


C7-1964 


SMLAL, SMLAL2 (vector) 


Signed Multiply-Add Long (vector). This instruction multiplies corresponding signed integer values in the lower or 
upper half of the vectors of the two source SIMD&FP registers, and accumulates the results with the vector elements 
of the destination SIMD&FP register. The destination vector elements are twice as long as the elements that are 


multiplied. 


The SMLAL instruction extracts each source vector from the lower half of each source register, while the SMLAL2 


instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 
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Three registers, not all the same type variant 


SMLAL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 
boolean sub_op = (01 == '1'); 

boolean unsigned = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 


the following values: 
[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

bits(2xesize) accum; 


for e = 0 to elements-1 

element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
product = (element1l«element2)<2«esize-1:0>; 
if sub_op then 

accum = Elem[operand3, e, 2xesize] - product; 
else 

accum = Elem[operand3, e, 2xesize] + product; 
Elem[result, e, 2xesize] = accum; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.269 


SMLSL, SMLSL2 (by element) 


Signed Multiply-Subtract Long (vector, by element). This instruction multiplies each vector element in the lower or 
upper half of the first source SIMD&FP register by the specified vector element of the second source SIMD&FP 
register and subtracts the results from the vector elements of the destination SIMD&FP register. The destination 
vector elements are twice as long as the elements that are multiplied. 


The SMLSL instruction extracts vector elements from the lower half of the first source register, while the SMLSL2 
instruction extracts vector elements from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 2 


9 28/27 26 25 24|23 22 21 20|19 


16/15 14 13 1211110 9 | 5 4| 0| 


ofafojo 7 4 4 a} AAPEA 


Vector variant 


SMLSL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Ts>[<index>] 


Decode 


for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 


integer 


bit Rmhi; 


case siz 
when 
when 
othe 


integer 
integer 
integer 


integer 
integer 
integer 
integer 


boolean 
boolean 


index; 

e of 

"Q@1' index = UInt(H:L:M); Rmhi 
'10' index = UInt(H:L); Rmhi = M; 
rwise UNDEFINED; 


d 
n 
m 


UInt(Rd) ; 
UInt(Rn) ; 
UInt(Rmhi :Rm) ; 


esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 

elements = datasize DIV esize; 


(U == '1'); 


unsigned = 
= (02 == '1'); 


sub_op 


Assembler symbols 


2 


<Vd> 


<Ta> 


C7-1966 


'O'; 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 


the following values: 
when Q = 0 
when Q = 1 


[absent] 


[present] 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


4s 
2D 


when size = 01 


when size = 10 


The following encodings are reserved: 


. size = 00. 
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<Vn> 


<Tb> 


<Vm> 


<Ts> 


<index> 


Operation 
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° size = 11. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 


8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 

. size = 00, Q = x. 

. size = 11,Q = x. 

Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 

Q:Rm when size = 01 

M:Rm when size = 10 

The following encodings are reserved: 

° size = 00. 

° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 

S when size = 10 

The following encodings are reserved: 

: size = 00. 


° size = 11. 


Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 

H:L when size = 10 

The following encodings are reserved: 

° size = 00. 


. size = 11. 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = Vpart[n, part]; 
bits(idxdsize) operand2 = V[m]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2»datasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 


element2 = Int(Elem[operand2, index, esize], unsigned); 
for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
product = (elementl«xelement2)<2«esize-1:0>; 
if sub_op then 


Elem[result, e, 2*esize] = Elem[operand3, e, 2xesize] - product; 
else 
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Elem[result, e, 2*esize] = Elem[operand3, e, 2sesize] + product; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.270 SMLSL, SMLSL2 (vector) 


ARM DDI 0487E.a 
ID070919 


Signed Multiply-Subtract Long (vector). This instruction multiplies corresponding signed integer values in the 
lower or upper half of the vectors of the two source SIMD&FP registers, and subtracts the results from the vector 
elements of the destination SIMD&FP register. The destination vector elements are twice as long as the elements 
that are multiplied. 


The SMLSL instruction extracts each source vector from the lower half of each source register, while the SMLSL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9. | 5 4| 0 | 


COUEN ofsze}i] Rm _|# ofifofo EE 


Three registers, not all the same type variant 


SMLSL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 
boolean sub_op = (01 == '1'); 

boolean unsigned = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

bits(2xesize) accum; 


for e = 0 to elements-1 

element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
product = (element1l«element2)<2«esize-1:0>; 
if sub_op then 

accum = Elem[operand3, e, 2xesize] - product; 
else 

accum = Elem[operand3, e, 2xesize] + product; 
Elem[result, e, 2xesize] = accum; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.271 SMOV 


Signed Move vector element to general-purpose register. This instruction reads the signed integer from the source 
SIMD&FP register, sign-extends it to form a 32-bit or 64-bit value, and writes the result to destination 
general-purpose register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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32-bit variant 

Applies when Q == 0. 

SMOV <Wd>, <Vn>.<Ts>[<index>] 
64-reg, SMOV-64-reg variant 
Applies when Q == 1. 


SMOV <Xd>, <Vn>.<Ts>[<index>] 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer size; 
case Q:imm5 of 


when 'xxxxx1' size = Q; // SMOV [WX]d, Vn.B 
when 'xxxx10' size = 1; // SMOV [WX]d, Vn.H 
when '1xx100' size = 2; // SMOV Xd, Vn.S 
otherwise UNDEFINED; 

integer idxdsize = if imm5<4> == '1' then 128 else 64; 


integer index = UInt(imm5<4:size+1>) ; 
integer esize = 8 << size; 
integer datasize = if Q == '1' then 64 else 32; 


Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<Ts> For the 32-bit variant: is an element size specifier, encoded in the "imm5" field. It can have the 
following values: 
B when imm5 = xxxx1 
H when imm5 = xxx10 


The encoding imm5 = xxxQQ is reserved. 


For the 64-reg, SMOV-64-reg variant: is an element size specifier, encoded in the "1mm5" field. It 
can have the following values: 


B when imm5 = xxxx1 
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H when imm5 = xxx10 

S when imm5 = xx100 

The encoding imm5 = xx000 is reserved. 

<index> For the 32-bit variant: is the element index encoded in the "imm5" field. It can have the following 

values: 

imm5<4:1> when imm5 = xxxx1 

imm5<4:2> when imm5 = xxx10 

The encoding imm5 = xxx0ð is reserved. 


For the 64-reg,SMOV-64-reg variant: is the element index encoded in the "imm5" field. It can have 
the following values: 


imm5<4:1> when imm5 = xxxx1 
immS<4:2> when imm5 = xxx10 
imm5<4:3> when imm5 = xx100 


The encoding imm5 = xx000 is reserved. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(idxdsize) operand = V[n]; 


X[d] = SignExtend(Elem[operand, index, esize], datasize); 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.272 SMULL, SMULL2 (by element) 


Signed Multiply Long (vector, by element). This instruction multiplies each vector element in the lower or upper 
half of the first source SIMD&FP register by the specified vector element of the second source SIMD&FP register, 
places the result in a vector, and writes the vector to the destination SIMD&FP register. The destination vector 
elements are twice as long as the elements that are multiplied. 


The SMULL instruction extracts vector elements from the lower half of the first source register, while the SMULL2 
instruction extracts vector elements from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 141312/1110 9. | 5 4| 0 | 
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Vector variant 


SMULL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when 'Q1' index = UInt(H:L:M); Rmhi 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'O'; 


UInt(Rd) ; 
UInt(Rn) ; 
UInt(Rmhi :Rm) ; 


integer d 
integer n 
integer m 


integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 
boolean unsigned = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
4s when size = 01 
2D when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
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C7-1974 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
. size = 11,Q = x. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 


The following encodings are reserved: 
. size = 00. 
° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


. size = 00. 
° size = 11. 
<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Operation 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = Vpart[n, part]; 
bits(idxdsize) operand2 = V[m]; 
bits(2»datasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 


element2 = Int(Elem[operand2, index, esize], unsigned); 
for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
product = (elementl«element2)<2«esize-1:0>; 
Elem[result, e, 2*esize] = product; 


V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.273 


C7-1976 


SMULL, SMULL2 (vector) 


Signed Multiply Long (vector). This instruction multiplies corresponding signed integer values in the lower or upper 
half of the vectors of the two source SIMD&FP registers, places the results in a vector, and writes the vector to the 
destination SIMD&FP register. 


The destination vector elements are twice as long as the elements that are multiplied. 


The SMULL instruction extracts each source vector from the lower half of each source register, while the SMULL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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Three registers, not all the same type variant 


SMULL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 


d 
n 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 

esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 

elements = datasize DIV esize; 


unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 


for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
Elem[result, e, 2xesize] = (elementlxelement2)<2sesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.274 


C7-1978 


SQABS 


Signed saturating Absolute value. This instruction reads each vector element from the source SIMD&FP register, 
puts the absolute value of the result into a vector, and writes the vector to the destination SIMD&FP register. All the 
values in this instruction are signed integer values. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oao 117 ojs o 00 ojo orri o] Rn | Rd 
U 


Scalar variant 


SQABS <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean neg = (U == '1'); 


Vector 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


lajojo 11 1 ofsze[s ooo ofoo rs ajiof Ro | r 


Vector variant 


SQABS <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean neg = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 


5 when size = 10 
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D when size = 11 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 

8B when size = 00,Q = 0 

16B when size = 00,Q = 1 

4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10,Q = 0 

4S when size = 10,Q = 1 

2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element; 

boolean sat; 


for e = 0 to elements-1 
element = SInt(Elem[operand, e, esize]); 
if neg then 
element = -element; 
else 
element = Abs(element); 
(Elem[result, e, esize], sat) = SignedSatQ(element, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.275 


C7-1980 


SQADD 


Signed saturating Add. This instruction adds the values of corresponding elements of the two source SIMD&FP 


registers, places the results into a vector, and writes the vector to the destination SIMD&FP register. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 


bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


oao 1717 ojs] Rm [oo 007/1] Rn | Rd 
U 


Scalar variant 


SQADD <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 8 << UInt(size); 
integer datasize = esize; 


integer elements = 1; 

boolean unsigned = (U == '1'); 
Vector 

|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 5 4| 0| 


fofajojo 1 1 1 ofsize]i] Rm joooorjit Rao | Ra | 
U 


Vector variant 


SQADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 


H when size = 01 


S when size = 10 
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D when size = 11 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 

Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = ® is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m] 


bits(datasize) result; 
integer element1; 
integer element2; 
integer sum; 

boolean sat; 


for 


V[d] 


e = Q to elements-1 

element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 

sum = elementl + element2; 

(Elem[result, e, esize], sat) = SatQ(sum, esize, unsigned); 
if sat then FPSR.QC = '1'; 


= result; 
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C7.2.276 


C7-1982 


SQDMLAL, SQDMLAL2 (by element) 


Signed saturating Doubling Multiply-Add Long (by element). This instruction multiplies each vector element in the 
lower or upper half of the first source SIMD&FP register by the specified vector element of the second source 
SIMD&FP register, doubles the results, and accumulates the final results with the vector elements of the destination 
SIMD&FP register. The destination vector elements are twice as long as the elements that are multiplied. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


The SQDMLAL instruction extracts vector elements from the lower half of the first source register, while the SQDMLAL2 
instruction extracts vector elements from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9. | 5 4| 0 | 


fo Jot 7144 sejm] Am fojo t[H]o] An | Rd || 
02 


Scalar variant 


SQDMLAL <Va><d>, <Vb><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


Q's 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

integer part = 0; 


boolean sub_op = (02 == '1'); 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20/19 16|15 14 13 12|11 10 9. | 5 4| 0 | 


fofajojo 1 1 1 1|szeļLjmM| Rm _foloj1 1jhjo] Rn | Ra | 
02 


Vector variant 


SQDMLAL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Ts>[<index>] 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Decode for this encoding 


integer 
integer 


idxdsize = if H == '1' then 128 else 64; 
index; 


bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = '0'; 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


integer 
integer 
integer 


integer 
integer 
integer 
integer 


boolean 


d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rmhi:Rm) ; 
esize = 8 << UInt(size); 


datasize = 64; 
part = UInt(Q); 
elements = datasize DIV esize; 


sub_op = (02 = '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Va> 


ARM DDI 0487E.a 
ID070919 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
4s when size = 01 

2D when size = 10 

The following encodings are reserved: 

e size = 00. 


e size = 11. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 00, Q = x. 


. size = 11,Q = x. 


Is the destination width specifier, encoded in the "size" field. It can have the following values: 
S when size = 01 
D when size = 10 


The following encodings are reserved: 


° size = 00. 
. size = 11. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-1983 


Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

<Vb> Is the source width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 


The following encodings are reserved: 
e size = 00. 


. size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = Vpart[n, part]; 
bits(idxdsize) operand2 = V[m]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

integer accum; 

boolean sat1; 

boolean sat2; 


element2 = SInt(Elem[operand2, index, esize]); 
for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 


(product, sat1) = SignedSatQ(2 » elementl » element2, 2 » esize); 


if sub_op then 


accum = SInt(Elem[operand3, e, 2*esize]) - SInt(product); 


else 
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accum = SInt(Elem[operand3, e, 2*esize]) + SInt(product); 
(Elem[result, e, 2xesize], sat2) = SignedSatQ(accum, 2 » esize); 
if sat1 || sat2 then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.277 SQDMLAL, SQDMLAL2 (vector) 


Signed saturating Doubling Multiply-Add Long. This instruction multiplies corresponding signed integer values in 
the lower or upper half of the vectors of the two source SIMD&FP registers, doubles the results, and accumulates 
the final results with the vector elements of the destination SIMD&FP register. The destination vector elements are 
twice as long as the elements that are multiplied. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


The SQDMLAL instruction extracts each source vector from the lower half of each source register, while the SQDMLAL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9. | 5 4| 0 | 


fo Jolt 1141 olse] Rm M Ofo]tfoo] An | Rd | 
01 


Scalar variant 


SQDMLAL <Va><d>, <Vb><n>, <Vb><m> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '00' || size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = esize; 

integer elements = 1; 

integer part = 0; 


boolean sub_op = (o1 == '1'); 
Vector 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9. | 5 4| 0| 


etejoja a t ruji Rm _|# ofo}ifo of] Ri | R] 


Vector variant 


SQDMLAL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '00' || size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = 64; 

integer part = UInt(Q); 
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integer elements = datasize DIV esize; 


boolean sub_op = (01 == '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Vm> 


<Va> 


<d> 


<Vb> 


<n> 


<m> 


ARM DDI 0487E.a 
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Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
4s when size = 01 


2D when size = 10 


The following encodings are reserved: 
e size = 00. 


° size = 11. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 


8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 00, Q = x. 


. size = 11,Q = x. 
Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the destination width specifier, encoded in the "size" field. It can have the following values: 
S when size = 01 

D when size = 10 

The following encodings are reserved: 

e size = 00. 

° size = 11. 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the source width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 

S when size = 10 

The following encodings are reserved: 

° size = 00. 


e size = 11. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
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C7-1988 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand1 = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

integer accum; 

boolean satl; 

boolean sat2; 


for e = 0 to elements-1 

element1 = SInt(Elem[operand1, e, esize]); 
element2 = SInt(Elem[operand2, e, esize]); 
(product, sat1) = SignedSatQ(2 » elementl « element2, 2 » esize); 
if sub_op then 

accum = SInt(Elem[operand3, e, 2*esize]) - SInt(product); 
else 

accum = SInt(Elem[operand3, e, 2*esize]) + SInt(product); 
(Elem[result, e, 2xesize], sat2) = SignedSatQ(accum, 2 » esize); 
if sat1 || sat2 then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.278 SQDMLSL, SQDMLSL2 (by element) 


Signed saturating Doubling Multiply-Subtract Long (by element). This instruction multiplies each vector element 
in the lower or upper half of the first source SIMD&FP register by the specified vector element of the second source 
SIMD&FP register, doubles the results, and subtracts the final results from the vector elements of the destination 
SIMD&FP register. The destination vector elements are twice as long as the elements that are multiplied. All the 
values in this instruction are signed integer values. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


The SQDMLSL instruction extracts vector elements from the lower half of the first source register, while the SQDMLSL2 
instruction extracts vector elements from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 5 4| 0 | 


fo ajoji 14 1 1 1[sizejLjm]| Rm [olifi 1fhjo] Rn | Ra | 
02 


Scalar variant 


SQDMLSL <Va><d>, <Vb><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'O'; 


UInt(Rd) ; 
UInt(Rn) ; 
UInt(Rmhi :Rm) ; 


integer d 
integer n 
integer m 


integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

integer part = 0; 


boolean sub_op = (02 == '1'); 
Vector 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15 14 13 12|11 10 9. | 5 4| 0| 


eleloo 111 ipso [tfw] rm folji Hjo) R | n 


Vector variant 


SQDMLSL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Ts>[<index>] 
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Decode for this encoding 


integer 
integer 


idxdsize = if H == '1' then 128 else 64; 
index; 


bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = '0'; 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


integer 
integer 
integer 


integer 
integer 
integer 
integer 


boolean 


d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rmhi:Rm) ; 
esize = 8 << UInt(size); 


datasize = 64; 
part = UInt(Q); 
elements = datasize DIV esize; 


sub_op = (02 = '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Va> 


C7-1990 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
4s when size = 01 

2D when size = 10 

The following encodings are reserved: 

e size = 00. 


e size = 11. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 00, Q = x. 


. size = 11,Q = x. 


Is the destination width specifier, encoded in the "size" field. It can have the following values: 
S when size = 01 
D when size = 10 


The following encodings are reserved: 


° size = 00. 
. size = 11. 
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<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vb> Is the source width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 
The following encodings are reserved: 
° size = 00. 
° size = 11. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 
The following encodings are reserved: 
e size = 00. 
° size = 11. 
Restricted to V0-V15 when element size <Ts> is H. 
<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 
The following encodings are reserved: 
° size = 00. 
° size = 11. 
<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = Vpart[n, part]; 
bits(idxdsize) operand2 = V[m]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

integer accum; 

boolean sat1; 

boolean sat2; 


element2 = SInt(Elem[operand2, index, esize]); 


for 


e = Q to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
(product, sat1) = SignedSatQ(2 » elementl » element2, 2 » esize); 
if sub_op then 

accum = SInt(Elem[operand3, e, 2*esize]) - SInt(product); 
else 
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accum = SInt(Elem[operand3, e, 2*esize]) + SInt(product); 
(Elem[result, e, 2xesize], sat2) = SignedSatQ(accum, 2 » esize); 
if sat1 || sat2 then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.279 SQDMLSL, SQDMLSL2 (vector) 


ARM DDI 0487E.a 
ID070919 


Signed saturating Doubling Multiply-Subtract Long. This instruction multiplies corresponding signed integer 
values in the lower or upper half of the vectors of the two source SIMD&FP registers, doubles the results, and 
subtracts the final results from the vector elements of the destination SIMD&FP register. The destination vector 
elements are twice as long as the elements that are multiplied. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


The SQDMLSL instruction extracts each source vector from the lower half of each source register, while the SQDMLSL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9. | 5 4| 0 | 


fo Jolt 1747 olse] Rm Mopo o An | Rd | 
01 


Scalar variant 


SQDMLSL <Va><d>, <Vb><n>, <Vb><m> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '00' || size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = esize; 

integer elements = 1; 

integer part = 0; 


boolean sub_op = (o1 == '1'); 
Vector 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9 | 5 4| 0| 


eleja a t rujat Rm deuln) R | R] 


Vector variant 


SQDMLSL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '00' || size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = 64; 

integer part = UInt(Q); 
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integer elements = datasize DIV esize; 


boolean sub_op = (01 == '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Vm> 


<Va> 


<d> 


<Vb> 


<n> 


<m> 


C7-1994 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
4s when size = 01 


2D when size = 10 


The following encodings are reserved: 
e size = 00. 


° size = 11. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 


8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 00, Q = x. 


. size = 11,Q = x. 
Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the destination width specifier, encoded in the "size" field. It can have the following values: 
S when size = 01 

D when size = 10 

The following encodings are reserved: 

e size = 00. 

° size = 11. 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

Is the source width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 

S when size = 10 

The following encodings are reserved: 

° size = 00. 


e size = 11. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
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Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand1 = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

integer accum; 

boolean satl; 

boolean sat2; 


for e = 0 to elements-1 

element1 = SInt(Elem[operand1, e, esize]); 
element2 = SInt(Elem[operand2, e, esize]); 
(product, sat1) = SignedSatQ(2 » elementl « element2, 2 » esize); 
if sub_op then 

accum = SInt(Elem[operand3, e, 2*esize]) - SInt(product); 
else 

accum = SInt(Elem[operand3, e, 2*esize]) + SInt(product); 
(Elem[result, e, 2xesize], sat2) = SignedSatQ(accum, 2 » esize); 
if sat1 || sat2 then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.280 


C7-1996 


SQDMULH (by element) 


Signed saturating Doubling Multiply returning High half (by element). This instruction multiplies each vector 
element in the first source SIMD&FP register by the specified vector element of the second source SIMD&FP 
register, doubles the results, places the most significant half of the final results into a vector, and writes the vector 
to the destination SIMD&FP register. 


The results are truncated. For rounded results, see SQRDMULH (by element). 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15141312\1110 9. | 5 4| 0 | 


fo ajo +771 sejm Rm [17 ofojH[oy] Rn | Rd 
op 


Scalar variant 


SQDMULH <V><d>, <V><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when 'Q1' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'O'; 


UInt(Rd) ; 
UInt(Rn); 
UInt(Rmhi :Rm) ; 


integer d 
integer n 
integer m 


integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean round = (op == '1'); 
Vector 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9. | 5 4| 0| 


bellei iteli so oo Rn l o 


Vector variant 


SQDMULH <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'0'; 
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integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean round = (op == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
° size = 11,Q = x. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 


The following encodings are reserved: 
° size = 00. 
° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
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<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = V[n]; 

bits(idxdsize) operand2 = V[m]; 

bits(datasize) result; 

integer round_const = if round then 1 << (esize - 1) else Q; 
integer element1; 

integer element2; 

integer product; 

boolean sat; 


element2 = SInt(Elem[operand2, index, esize]); 
for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
product = (2 « elementl « element2) + round_const; 
// The following only saturates if element1 and element2 equal -(2A(esize-1)) 
(Elem[result, e, esize], sat) = SignedSatQ(product >> esize, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.281 SQDMULH (vector) 


ARM DDI 0487E.a 
ID070919 


Signed saturating Doubling Multiply returning High half. This instruction multiplies the values of corresponding 
elements of the two source SIMD&FP registers, doubles the results, places the most significant half of the final 


results into a vector, and writes the vector to the destination SIMD&FP register. 


The results are truncated. For rounded results, see SQRDMULH (vector). 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 


bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20) 16/1514 1312/1110 9. | 5 4| 0 | 


oao +77 ojs] Rm [10717 0]] Rn | Rd 
U 


Scalar variant 


SQDMULH <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' || size == '@@' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = esize; 

integer elements = 1; 


boolean rounding = (U == '1'); 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 5 4| 0| 


fofafoo +771 ofsze]i] am [10717 0]] Rn | Rd 
U 


Vector variant 


SQDMULH <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' || size == '@@' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean rounding = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


H when size = 01 
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C7-2000 


S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 

. size = 11,Q = x. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = V[n]; 

bits(datasize) operand2 = V[m]; 

bits(datasize) result; 

integer round_const = if rounding then 1 << (esize - 1) else Q; 
integer element1; 

integer element2; 

integer product; 

boolean sat; 


for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
element2 = SInt(Elem[operand2, e, esize]); 
product = (2 « elementl « element2) + round_const; 
(Elem[result, e, esize], sat) = SignedSatQ(product >> esize, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.282 SQDMULL, SQDMULL2 (by element) 


ARM DDI 0487E.a 
ID070919 


Signed saturating Doubling Multiply Long (by element). This instruction multiplies each vector element in the 
lower or upper half of the first source SIMD&FP register by the specified vector element of the second source 
SIMD&FP register, doubles the results, places the final results in a vector, and writes the vector to the destination 
SIMD&FP register. All the values in this instruction are signed integer values. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


The SQDMULL instruction extracts the first source vector from the lower half of the first source register, while the 
SQDMULL2 instruction extracts the first source vector from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 5 4| 0 | 


fo ajo 177 sejm) em [1071 [H]o] rn | Rd 


Scalar variant 


SQDMULL <Va><d>, <Vb><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'O'; 


UInt(Rd) ; 
UInt(Rn) ; 
UInt(Rmhi : Rm) ; 


integer d 
integer n 
integer m 


integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

integer part = 0; 


Vector 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9. | 5 4| 0| 


[olajoļo 14 1 1 1[szefLjm| Rm f1 o 1 1fhjo] Rn | Ra | 


Vector variant 


SQDMULL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 

bit Rmhi; 

case size of 
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when '01' index = UInt(H:L:M); Rmhi = 'Q'; 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
4s when size = 01 
2D when size = 10 


The following encodings are reserved: 


- size = 00. 
° size = 11. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
. size = 11,Q = x. 
<Va> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
S when size = 01 
D when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vb> Is the source width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 
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The following encodings are reserved: 


° size = 00. 
° size = 11. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 


The following encodings are reserved: 
° size = 00. 
° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Operation for all encodings 
CheckFPAdvSIMDEnabled64(); 


bits(datasize) operand1 = Vpart[n, part]; 
bits(idxdsize) operand2 = V[m]; 
bits(2»datasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

boolean sat; 


element2 = SInt(Elem[operand2, index, esize]); 
for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
(product, sat) = SignedSatQ(2 » elementl « element2, 2 « esize); 
Elem[result, e, 2*esize] = product; 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.283 


C7-2004 


SQDMULL, SQDMULL2 (vector) 


Signed saturating Doubling Multiply Long. This instruction multiplies corresponding vector elements in the lower 
or upper half of the two source SIMD&FP registers, doubles the results, places the final results in a vector, and 
writes the vector to the destination SIMD&FP register. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


The SQDMULL instruction extracts each source vector from the lower half of each source register, while the SQDMULL2 


instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20 16/15 141312/1110 9 | 


EE ee es ca oh ee E A 


Scalar variant 


SQDMULL <Va><d>, <Vb><n>, <Vb><m> 


Decode for this encoding 


integer 
integer 
integer 


if size == 


integer 
integer 
integer 
integer 


Vector 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 


"Q0' || size == '11' then UNDEFINED; 
esize = 8 << UInt(size); 

datasize = esize; 

elements = 1; 

part = Q; 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 


plage E C ooo] a 


Vector variant 


SQDMULL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rm); 

== 'Q0' || size == '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = 64; 
part = UInt(Q); 
elements = datasize DIV esize; 
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Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Vm> 


<Va> 


<d> 


<Vb> 


<n> 


<m> 


ARM DDI 0487E.a 
ID070919 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


4S when size = 01 


2D when size = 10 
The following encodings are reserved: 
e size = 00. 


° size = 11. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 


8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 00, Q = x. 


. size = 11,Q = x. 
Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the destination width specifier, encoded in the "size" field. It can have the following values: 
S when size = 01 

D when size = 10 

The following encodings are reserved: 

e size = 00. 


° size = 11. 
Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the source width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 

S when size = 10 

The following encodings are reserved: 

° size = 00. 


° size = 11. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
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Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

boolean sat; 


for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
element2 = SInt(Elem[operand2, e, esize]); 
(product, sat) = SignedSatQ(2 » elementl « element2, 2 « esize); 
Elem[result, e, 2*esize] = product; 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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Signed saturating Negate. This instruction reads each vector element from the source SIMD&FP register, negates 
each value, places the result into a vector, and writes the vector to the destination SIMD&FP register. All the values 
in this instruction are signed integer values. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


fo a[i[1 177 ose o 00 ojo orra o] Rn | Rd 
U 


Scalar variant 


SQNEG <V><d>, <V><n> 


Decode for this encoding 


integer 
integer 


integer 
integer 
integer 
boolean 


Vector 


d = UInt(Rd); 
n = UInt(Rn); 
esize = 8 << UInt(size); 


datasize = esize; 
elements = 1; 
neg = (U == '1'); 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


lafijo 111 ofsze[s ooo ofoo rs ajiof Rn | r 


Vector variant 


SQNEG <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer 
integer 


if size 
integer 
integer 
integer 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 
:Q == '110' then UNDEFINED; 


esize = 8 << UInt(size); 


datasize = if Q == '1' then 128 else 64; 


elements = datasize DIV esize; 
neg = (U == '1'); 


Assembler symbols 


<V> 


Is a width specifier, encoded in the "size" field. It can have the following values: 


B when size = 00 
H when size = 01 
S when size = 10 
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D when size = 11 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 

8B when size = 00,Q = 0 

16B when size = 00,Q = 1 

4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10,Q = 0 

4S when size = 10,Q = 1 

2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element; 

boolean sat; 


for e = 0 to elements-1 
element = SInt(Elem[operand, e, esize]); 
if neg then 
element = -element; 
else 
element = Abs(element); 
(Elem[result, e, esize], sat) = SignedSatQ(element, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.285 SQRDMLAH (by element) 


Signed Saturating Rounding Doubling Multiply Accumulate returning High Half (by element). This instruction 
multiplies the vector elements of the first source SIMD&FP register with the value of a vector element of the second 
source SIMD&FP register without saturating the multiply results, doubles the results, and accumulates the most 
significant half of the final results with the vector elements of the destination SIMD&FP register. The results are 
rounded. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSR.QC, is set if saturation occurs. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 5 4| 0 | 


iO ips 7 tt a] size [ef] E Rd 


Scalar variant 


SQRDMLAH <V><d>, <V><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 
if !HaveQRDMLAHExt() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'O'; 


UInt(Rd) ; 
UInt(Rn) ; 
UInt(Rmhi : Rm) ; 


integer d 
integer n 
integer m 


integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean rounding = TRUE; 

boolean sub_op = (S == '1'); 


Vector 


ARMy8.1 
|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9. | 5 4| 0| 


olope +771 sejm) em oo] Rn | Rd 
S 


Vector variant 


SQRDMLAH <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 
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Decode for this encoding 
if !HaveQRDMLAHExt() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


Q': 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean rounding = TRUE; 
boolean sub_op = (S == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
. size = 11,Q = x. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 


The following encodings are reserved: 
e size = 00. 
° size = 11. 


Restricted to VO-V15 when element size <Ts> is H. 
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<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(idxdsize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 

integer rounding_const = if rounding then 1 << (esize - 1) else Q; 
integer element1; 

integer element2; 

integer element3; 

integer product; 

boolean sat; 


element2 = SInt(Elem[operand2, index, esize]); 
for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
element3 = SInt(Elem[operand3, e, esize]); 
if sub_op then 
accum = ((element3 << esize) - 2 » (elementl » element2) + rounding_const); 
else 
accum = ((element3 << esize) + 2 » (elementl » element2) + rounding_const); 
(Elem[result, e, esize], sat) = SignedSatQ(accum >> esize, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.286 SQRDMLAH (vector) 


Signed Saturating Rounding Doubling Multiply Accumulate returning High Half (vector). This instruction 

multiplies the vector elements of the first source SIMD&FP register with the corresponding vector elements of the 
second source SIMD&FP register without saturating the multiply results, doubles the results, and accumulates the 
most significant half of the final results with the vector elements of the destination SIMD&FP register. The results 


are rounded. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSR.QC, is set if saturation occurs. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


ARMV8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12/11 10 9 


ea oje e oo Ra TJ 


Scalar variant 


SQRDMLAH <V><d>, <V><n>, <V><m> 


Decode for this encoding 


if !HaveQRDMLAHExt() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' || size == '@@' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = esize; 

integer elements = 1; 

boolean rounding = TRUE; 

boolean sub_op = (S == '1'); 


Vector 


ARMVv8.1 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12/11 10 9 


o | 


[olajijo 1 1 1 ofsizefo}] Rm fifo o ojoji| Rn | Ra | 
S 


Vector variant 


SQRDMLAH <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 
if !HaveQRDMLAHExt() then UNDEFINED; 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size == '11' || size == '00' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
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integer elements = datasize DIV esize; 
boolean rounding = TRUE; 
boolean sub_op = (S == '1'); 


Assembler symbols 


<V> 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


Is a width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
10 


S when size 
The following encodings are reserved: 
° size = 00. 


. size = 11. 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 

Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 


8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 00, Q = x. 


. size = 11,Q = x. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operandl = V[n]; 

bits(datasize) operand2 = V[m]; 

bits(datasize) operand3 = V[d]; 

bits(datasize) result; 

integer rounding_const = if rounding then 1 << (esize - 1) else Q; 
integer element1; 

integer element2; 

integer element3; 

integer product; 


boolean sat; 


for e = 0 to 
element1 
element2 
element3 


elements-1 

= SInt(Elem[operand1, e, esize]); 
= SInt(Elem[operand2, e, esize]); 
= SInt(Elem[operand3, e, esize]); 


if sub_op then 
accum = ((element3 << esize) - 2 » (element1l » element2) + rounding_const); 


else 


accum = ((element3 << esize) + 2 » (elementl » element2) + rounding_const); 
(Elem[result, e, esize], sat) = SignedSatQ(accum >> esize, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.287 SQRDMLSH (by element) 


Signed Saturating Rounding Doubling Multiply Subtract returning High Half (by element). This instruction 
multiplies the vector elements of the first source SIMD&FP register with the value of a vector element of the second 
source SIMD&FP register without saturating the multiply results, doubles the results, and subtracts the most 
significant half of the final results from the vector elements of the destination SIMD&FP register. The results are 
rounded. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSR.QC, is set if saturation occurs. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 141312/1110 9 | 5 4| 0 | 


iO ips | tt a] size [ef] e Re | Rd 


Scalar variant 


SQRDMLSH <V><d>, <V><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 
if !HaveQRDMLAHExt() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'O'; 


UInt(Rd) ; 
UInt(Rn) ; 
UInt(Rmhi : Rm) ; 


integer d 
integer n 
integer m 


integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean rounding = TRUE; 

boolean sub_op = (S == '1'); 


Vector 


ARMy8.1 
|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9. | 5 4| 0| 


opo sejm em poo Rn [| Rd 
S 


Vector variant 


SQRDMLSH <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 
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Decode for this encoding 
if !HaveQRDMLAHExt() then UNDEFINED; 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


Q': 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean rounding = TRUE; 
boolean sub_op = (S == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
. size = 11,Q = x. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 


The following encodings are reserved: 
e size = 00. 
° size = 11. 


Restricted to VO-V15 when element size <Ts> is H. 
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<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(idxdsize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 

integer rounding_const = if rounding then 1 << (esize - 1) else Q; 
integer element1; 

integer element2; 

integer element3; 

integer product; 

boolean sat; 


element2 = SInt(Elem[operand2, index, esize]); 
for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
element3 = SInt(Elem[operand3, e, esize]); 
if sub_op then 
accum = ((element3 << esize) - 2 » (elementl » element2) + rounding_const); 
else 
accum = ((element3 << esize) + 2 » (elementl » element2) + rounding_const); 
(Elem[result, e, esize], sat) = SignedSatQ(accum >> esize, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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Signed Saturating Rounding Doubling Multiply Subtract returning High Half (vector). This instruction multiplies 
the vector elements of the first source SIMD&FP register with the corresponding vector elements of the second 
source SIMD&FP register without saturating the multiply results, doubles the results, and subtracts the most 
significant half of the final results from the vector elements of the destination SIMD&FP register. The results are 


rounded. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSR.QC, is set if saturation occurs. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


ARMV8.1 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 
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Scalar variant 


SQRDMLSH <V><d>, <V><n>, <V><m> 


Decode for this encoding 


if !HaveQRDMLAHExt() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' || size == '@@' then UNDEFINED; 


integer esize = 8 << UInt(size); 


integer datasize = esize; 


integer elements = 1; 


boolean rounding = TRUE; 


boolean sub_op = (S == '1'); 
Vector 
ARMv8.1 

|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312/1110 9. | 5 4| 0 | 
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Vector variant 


SQRDMLSH <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


if !HaveQRDMLAHExt() then UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' || size == '00' then UNDEFINED; 


integer esize = 8 << UInt(size); 


integer datasize = if Q == '1' then 128 else 64; 
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integer elements = datasize DIV esize; 
boolean rounding = TRUE; 
boolean sub_op = (S == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 

. size = 11,Q = x. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) operand3 = V[d]; 
bits(datasize) result; 

integer rounding_const = if rounding then 1 << (esize - 1) else Q; 
integer element1; 

integer element2; 

integer element3; 

integer product; 

boolean sat; 


for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
element2 = SInt(Elem[operand2, e, esize]); 
element3 = SInt(Elem[operand3, e, esize]); 
if sub_op then 
accum = ((element3 << esize) - 2 » (element1l » element2) + rounding_const); 
else 
accum = ((element3 << esize) + 2 » (elementl » element2) + rounding_const); 
(Elem[result, e, esize], sat) = SignedSatQ(accum >> esize, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 


C7-2018 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.289 SQRDMULH (by element) 


ARM DDI 0487E.a 
ID070919 


Signed saturating Rounding Doubling Multiply returning High half (by element). This instruction multiplies each 


vector element in the first source SIMD&FP register by the specified vector element of the second source 


SIMD&FP register, doubles the results, places the most significant half of the final results into a vector, and writes 


the vector to the destination SIMD&FP register. 


The results are rounded. For truncated results, see SQDMULH (by element). 


If any of the results overflows, they are saturated. If saturation occurs, the cumulative saturation bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15141312\1110 9. | 5 4| 0 | 
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Scalar variant 


SQRDMULH <V><d>, <V><n>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when '01' index = UInt(H:L:M); Rmhi = 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'Q'; 


UInt(Rd) ; 
UInt(Rn) ; 
UInt(Rmhi : Rm) ; 


integer d 
integer n 
integer m 


integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean round = (op == '1'); 
Vector 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 141312/1110 9 | 5 4| 0 | 
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Vector variant 


SQRDMULH <Vd>.<T>, <Vn>.<T>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 
integer index; 
bit Rmhi; 
case size of 
when '01' index = UInt(H:L:M); Rmhi = 'Q'; 
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when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rmhi:Rm); 


integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean round = (op == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
. size = 11. 
<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
° size = 11,Q = x. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 


The following encodings are reserved: 
° size = 00. 
° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


° size = 00. 
. size = 11. 
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<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = V[n]; 

bits(idxdsize) operand2 = V[m]; 

bits(datasize) result; 

integer round_const = if round then 1 << (esize - 1) else Q; 
integer element1; 

integer element2; 

integer product; 

boolean sat; 


element2 = SInt(Elem[operand2, index, esize]); 
for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
product = (2 « elementl « element2) + round_const; 
// The following only saturates if element1 and element2 equal -(2A(esize-1)) 
(Elem[result, e, esize], sat) = SignedSatQ(product >> esize, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.290 


C7-2022 


SQRDMULH (vector) 


Signed saturating Rounding Doubling Multiply returning High half. This instruction multiplies the values of 
corresponding elements of the two source SIMD&FP registers, doubles the results, places the most significant half 
of the final results into a vector, and writes the vector to the destination SIMD&FP register. 


The results are rounded. For truncated results, see SQDMULH (vector). 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20| 16/1514 1312/1110 9. | 5 4| 0 | 
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Scalar variant 


SQRDMULH <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' || size == '@@' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = esize; 

integer elements = 1; 


boolean rounding = (U == '1'); 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 5 4| 0| 
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Vector variant 


SQRDMULH <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' || size == '@@' then UNDEFINED; 
integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean rounding = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


H when size = 01 
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S when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 

. size = 11,Q = x. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = V[n]; 

bits(datasize) operand2 = V[m]; 

bits(datasize) result; 

integer round_const = if rounding then 1 << (esize - 1) else 0; 
integer element1; 

integer element2; 

integer product; 

boolean sat; 


for e = 0 to elements-1 
element1 = SInt(Elem[operand1, e, esize]); 
element2 = SInt(Elem[operand2, e, esize]); 
product = (2 « elementl « element2) + round_const; 
(Elem[result, e, esize], sat) = SignedSatQ(product >> esize, esize); 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.291 


C7-2024 


SQRSHL 


Signed saturating Rounding Shift Left (register). This instruction takes each vector element in the first source 
SIMD&FP register, shifts it by a value from the least significant byte of the corresponding vector element of the 
second source SIMD&FP register, places the results into a vector, and writes the vector to the destination SIMD&FP 
register. 


If the shift value is positive, the operation is a left shift. Otherwise, it is a right shift. The results are rounded. For 
truncated results, see SQSHL (register). 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9. | 5 4| 0 | 
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Scalar variant 


SQRSHL <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 8 << UInt(size); 
integer datasize = esize; 


integer elements = 1; 

boolean unsigned = (U == '1'); 

boolean rounding = (R == '1'); 

boolean saturating = (S == '1'); 

if S == '@' && size != '11' then UNDEFINED; 
Vector 

|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 5 4| 0| 
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Vector variant 


SQRSHL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 
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Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 
D when size = 11 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer round_const = Q; 
integer shift; 

integer element; 
boolean sat; 


for e = 0 to elements-1 
shift = SInt(Elem[operand2, e, esize]<7:0>); 
if rounding then 
round_const = 1 << (-shift - 1); // ® for left shift, 2A(n-1) for right shift 
element = (Int(Elem[operand1, e, esize], unsigned) + round_const) << shift; 
if saturating then 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 
else 
Elem[result, e, esize] = element<esize-1:0>; 


V[d] = result; 
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C7.2.292 SQRSHRN, SQRSHRN2 


Signed saturating Rounded Shift Right Narrow (immediate). This instruction reads each vector element in the 
source SIMD&FP register, right shifts each result by an immediate value, saturates each shifted result to a value that 
is half the original width, puts the final result into a vector, and writes the vector to the lower or upper half of the 
destination SIMD&FP register. All the values in this instruction are signed integer values. The destination vector 
elements are half as long as the source vector elements. The results are rounded. For truncated results, see SQSHRN, 
SQSHRN2. 


The SQRSHRN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the SQRSHRN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


If saturation occurs, the cumulative saturation bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 11918 16|15141312/11109 | 5 4| 0 | 
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immh 


Scalar variant 


SQRSHRN <Vb><d>, <Va><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then UNDEFINED; 

if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 
integer datasize = esize; 

integer elements = 1; 

integer part = 0; 


integer shift = (2 » esize) - UInt(immh:immb) ; 


boolean round = (op == '1'); 

boolean unsigned = (U == '1'); 

Vector 

|31 S ea ioe 16|15 14 13 12|11 10 9. | 5 4| 0 | 
ER AE E S E 


immh 


Vector variant 


SQRSHRN{2} <Vd>.<Tb>, <Vn>.<Ta>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 
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= 8 << HighestSetBit(immh) ; 


datasize = 64; 
part = UInt(Q); 
elements = datasize DIV esize; 


shift 
round 


= (2 x esize) - UInt(immh: immb) ; 
= (op == '1'); 


unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Tb> 


<Vn> 


<Ta> 


<Vb> 


<d> 


<Va> 


ARM DDI 0487E.a 
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Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 


16B when immh = 0001,Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = @ 
4S when immh = 01xx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = x is reserved. 
Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "immh" field. It can have the following values: 
8H when immh = 0001 

4s when immh = 001x 

2D when immh = Q1xx 

See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Is the destination width specifier, encoded in the "immh" field. It can have the following values: 
B when immh = 0001 


H when immh = QQ1x 


S when immh = 01xx 
The following encodings are reserved: 
° immh = 0000. 


. immh = 1xxx. 
Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the source width specifier, encoded in the "immh" field. It can have the following values: 


H when immh = 0001 
S when immh = 001x 
D when immh = 01xx 
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The following encodings are reserved: 


. immh = 0000. 


° immh = 1xxx. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<shift> For the scalar variant: is the right shift amount, in the range 1 to the destination operand width in 


bits, encoded in the "immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 

(32-UInt(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = Q1xx 

The following encodings are reserved: 

° immh = 0000. 

° immh = 1xxx. 


For the vector variant: is the right shift amount, in the range 1 to the destination element width in 
bits, encoded in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasizex2) operand = V[n]; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else Q; 
integer element; 

boolean sat; 


for e = 0 to elements-1 
element = (Int(Elem[operand, e, 2*esize], unsigned) + round_const) >> shift; 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 


Vpart[d, part] = result; 
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C7.2.293 SQRSHRUN, SQRSHRUN2 


ARM DDI 0487E.a 
ID070919 


Signed saturating Rounded Shift Right Unsigned Narrow (immediate). This instruction reads each signed integer 
value in the vector of the source SIMD&FP register, right shifts each value by an immediate value, saturates the 
result to an unsigned integer value that is half the original width, places the final result into a vector, and writes the 
vector to the destination SIMD&FP register. The results are rounded. For truncated results, see SQSHRUN, 


SQSHRUN2. 


The SQRSHRUN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the SQRSHRUN2 instruction writes the vector to the upper half of the destination register without affecting the other 


bits of the register. 


If saturation occurs, the cumulative saturation bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 1918 16|15141312/1110 9 | 5 4| 0 | 


[o jaji 11 11 0f 0000 | immo [1 0 o ofaj] Rn | Ra | 


immh op 


Scalar variant 


SQRSHRUN <Vb><d>, <Va><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then UNDEFINED; 

if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh); 
integer datasize = esize; 

integer elements = 1; 

integer part = 0; 


integer shift = (2 » esize) - UInt(immh:immb) ; 
boolean round = (op == '1'); 


Vector 


|31 30 29 28|27 26 25 24/23 22 1918 16|15141312/11109 | 5 4| 0 | 


oleo n r 0] 0000 | immb [100 o] Rn | Rd 
op 


immh 


Vector variant 


SQRSHRUN{2} <Vd>.<Tb>, <Vn>.<Ta>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = 64; 
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integer part = UInt(Q); 
integer elements = datasize DIV esize; 


integer shift 
boolean round 


(2 » esize) - UInt(immh:immb) ; 
= (op == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 

[absent] whenQ = 0 
[present] whenQ = 1 

<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Tb> Is an arrangement specifier, encoded in the "Immh:Q" field. It can have the following values: 
8B when immh = 0001, Q = 0 
16B when immh = 0001,Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 

The encoding immh = 1xxx, Q = x is reserved. 

<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<Ta> Is an arrangement specifier, encoded in the "immh" field. It can have the following values: 
8H when immh = 0001 
4s when immh = 001x 
2D when immh = Q1xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 

The encoding immh = 1xxx is reserved. 

<Vb> Is the destination width specifier, encoded in the "immh" field. It can have the following values: 
B when immh = 0001 
H when immh = 001x 
S when immh = 01xx 
The following encodings are reserved: 

° immh = 0000. 
° immh = 1xxx. 

<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 

<Va> Is the source width specifier, encoded in the "immh" field. It can have the following values: 
H when immh = 0001 
S when immh = 001x 
D when immh = 01xx 
The following encodings are reserved: 

e immh = 0000. 
e immh = 1xxx. 
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<shift> 
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Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 

For the scalar variant: is the right shift amount, in the range 1 to the destination operand width in 
bits, encoded in the "immh:immb" field. It can have the following values: 

(16-UInt(immh:immb)) when immh = 0001 

(32-UInt(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = Q1xx 

The following encodings are reserved: 

° immh = 0000. 

° immh = 1xxx. 


For the vector variant: is the right shift amount, in the range 1 to the destination element width in 
bits, encoded in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = 01xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasizex2) operand = V[n]; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else Q; 
integer element; 


boolean sat; 


for e = 0 to elements-1 
element = (SInt(Elem[operand, e, 2*esize]) + round_const) >> shift; 
(Elem[result, e, esize], sat) = UnsignedSatQ(element, esize); 
if sat then FPSR.QC = '1'; 


Vpart[d, part] = result; 
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C7.2.294 


C7-2032 


SQSHL (immediate) 


Signed saturating Shift Left (immediate). This instruction reads each vector element in the source SIMD&FP 
register, shifts each result by an immediate value, places the final result in a vector, and writes the vector to the 
destination SIMD&FP register. The results are truncated. For rounded results, see UQRSHL. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/1110 9 | 5 4| 0 | 


CEEE oe soe E 


immh 


Scalar variant 


SQSHL <V><d>, <V><n>, #<shift> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if immh == '0000' then UNDEFINED; 
integer esize = 8 << HighestSetBit(immh) ; 
integer datasize = esize; 

integer elements = 1; 


integer shift = UInt(immh:immb) - esize; 


boolean src_unsigned; 

boolean dst_unsigned; 

case op:U of 
when '00' UNDEFINED; 
when '01' src_unsigned = FALSE; dst_unsigned = TRUE; 
when '10' src_unsigned = FALSE; dst_unsigned = FALSE; 
when '11' src_unsigned = TRUE; dst_unsigned = TRUE; 


Vector 


|31 30 29 28|27 26 25 24|23 22 1918 16/15141312/11109 | 5 4| 0 | 


bellei tt of 0990 Lamm Jo de Rn l o 


immh 


Vector variant 


SQSHL <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = if Q == '1' then 128 else 64; 
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integer elements = datasize DIV esize; 
integer shift = UInt(immh:immb) - esize; 


boolean src_unsigned; 

boolean dst_unsigned; 

case op:U of 
when 'QQ' UNDEFINED; 
when '01' src_unsigned = FALSE; dst_unsigned = TRUE; 
when '10' src_unsigned = FALSE; dst_unsigned = FALSE; 
when '11' src_unsigned = TRUE; dst_unsigned = TRUE; 


Assembler symbols 


<V> Is a width specifier, encoded in the "immh" field. It can have the following values: 
B when immh = 0001 
H when immh = 001x 
S when immh = 01xx 
D when immh = 1xxx 


The encoding immh = 0000 is reserved. 


<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 

8B when immh = 0001, Q = 0 

16B when immh = 0001, Q = 1 

4H when immh = 001x, Q = 0 

8H when immh = 001x, Q = 1 

2S when immh = 01xx, Q = 0 

4S when immh = 01xx, Q = 1 

2D when immh = 1xxx, Q = 1 





See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The encoding immh = 1xxx, Q = 0 is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<shift> For the scalar variant: is the left shift amount, in the range 0 to the operand width in bits minus 1, 
encoded in the "immh:immb" field. It can have the following values: 
(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = 01xx 
(UInt(immh:immb)-64) when immh = 1xxx 
The encoding immh = 0000 is reserved. 


For the vector variant: is the left shift amount, in the range 0 to the element width in bits minus 1, 
encoded in the "immh:immb" field. It can have the following values: 


(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = Q1xx 


(UInt(immh:immb)-64) when immh = 1xxx 
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See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element; 

boolean sat; 


for e = 0 to elements-1 
element = Int(Elem[operand, e, esize], src_unsigned) << shift; 
(Elem[result, e, esize], sat) = SatQ(element, esize, dst_unsigned) ; 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.295 SQSHL (register) 


ARM DDI 0487E.a 
ID070919 


Signed saturating Shift Left (register). This instruction takes each element in the vector of the first source SIMD&FP 
register, shifts each element by a value from the least significant byte of the corresponding element of the second 
source SIMD&FP register, places the results in a vector, and writes the vector to the destination SIMD&FP register. 


If the shift value is positive, the operation is a left shift. Otherwise, it is a right shift. The results are truncated. For 
rounded results, see SQRSHL. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 


eal oje a o Ra J 


Scalar variant 


SQSHL <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer 
integer 
integer 
integer 
integer 
integer 
boolean 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
esize = 8 << UInt(size); 


datasize = esize; 
elements = 1; 

unsigned = (U == '1'); 
rounding = (R == '1'); 


boolean saturating = (S == '1'); 

if S == '@' && size != '11' then UNDEFINED; 
Vector 

|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 


oleojojo 1 rofs] Rm Joropo] Rn | Rd 
U RS 


Vector variant 


SQSHL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 
boolean 
boolean 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
:Q == '11@' then UNDEFINED; 


esize = 8 << UInt(size); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 

unsigned = (U == '1'); 

rounding = (R == '1'); 

saturating = (S == '1'); 
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Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 
D when size = 11 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer round_const = Q; 
integer shift; 

integer element; 
boolean sat; 


for e = 0 to elements-1 
shift = SInt(Elem[operand2, e, esize]<7:0>); 
if rounding then 
round_const = 1 << (-shift - 1); // ® for left shift, 2A(n-1) for right shift 
element = (Int(Elem[operand1, e, esize], unsigned) + round_const) << shift; 
if saturating then 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 
else 
Elem[result, e, esize] = element<esize-1:0>; 


V[d] = result; 
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C7.2.296 SQSHLU 


ARM DDI 0487E.a 
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Signed saturating Shift Left Unsigned (immediate). This instruction reads each signed integer value in the vector of 
the source SIMD&FP register, shifts each value by an immediate value, saturates the shifted result to an unsigned 
integer value, places the result in a vector, and writes the vector to the destination SIMD&FP register. The results 


are truncated. For rounded results, see UQRSHL. 


If saturation occurs, the cumulative saturation bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918  16|15141312/1110 9 | 5 4| 0 | 


sa ne oe E R 


immh 


Scalar variant 


SQSHLU <V><d>, <V><n>, #<shift> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if immh == '0000' then UNDEFINED; 
integer esize = 8 << HighestSetBit(immh) ; 
integer datasize = esize; 

integer elements = 1; 


integer shift = UInt(immh:immb) - esize; 


boolean src_unsigned; 

boolean dst_unsigned; 

case op:U of 
when '00' UNDEFINED; 
when '01' src_unsigned = FALSE; dst_unsigned = TRUE; 
when '10' src_unsigned = FALSE; dst_unsigned = FALSE; 
when '11' src_unsigned = TRUE; dst_unsigned = TRUE; 


Vector 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312|/1110 9 | 5 4| 0 | 


belli tt of 0090 [imme Jo ede Rn __|__e_ 


immh 


Vector variant 


SQSHLU <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = if Q == '1' then 128 else 64; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


C7-2037 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7-2038 


integer elements = datasize DIV esize; 
integer shift = UInt(immh:immb) - esize; 


boolean src_unsigned; 

boolean dst_unsigned; 

case op:U of 
when 'QQ' UNDEFINED; 
when '01' src_unsigned = FALSE; dst_unsigned = TRUE; 
when '10' src_unsigned = FALSE; dst_unsigned = FALSE; 
when '11' src_unsigned = TRUE; dst_unsigned = TRUE; 


Assembler symbols 


<V> Is a width specifier, encoded in the "immh" field. It can have the following values: 
B when immh = 0001 
H when immh = 001x 
S when immh = 01xx 
D when immh = 1xxx 


The encoding immh = 0000 is reserved. 


<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 

8B when immh = 0001, Q = 0 

16B when immh = 0001, Q = 1 

4H when immh = 001x, Q = 0 

8H when immh = 001x, Q = 1 

2S when immh = 01xx, Q = 0 

4S when immh = 01xx, Q = 1 

2D when immh = 1xxx, Q = 1 





See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = 0 is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


<shift> For the scalar variant: is the left shift amount, in the range 0 to the operand width in bits minus 1, 


encoded in the "immh:immb" field. It can have the following values: 
(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = 01xx 
(UInt(immh:immb)-64) when immh = 1xxx 


The encoding immh = 0000 is reserved. 


For the vector variant: is the left shift amount, in the range 0 to the element width in bits minus 1, 


encoded in the "immh:immb" field. It can have the following values: 
(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = Q1xx 


(UInt(immh:immb)-64) when immh = 1xxx 
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See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element; 

boolean sat; 


for e = 0 to elements-1 
element = Int(Elem[operand, e, esize], src_unsigned) << shift; 
(Elem[result, e, esize], sat) = SatQ(element, esize, dst_unsigned) ; 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.297 SQSHRN, SQSHRN2 


Signed saturating Shift Right Narrow (immediate). This instruction reads each vector element in the source 
SIMD&FP register, right shifts and truncates each result by an immediate value, saturates each shifted result to a 
value that is half the original width, puts the final result into a vector, and writes the vector to the lower or upper 
half of the destination SIMD&FP register. All the values in this instruction are signed integer values. The destination 
vector elements are half as long as the source vector elements. For rounded results, see SQRSHRN, SQRSHRN2. 


The SQSHRN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the SQSHRN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


If saturation occurs, the cumulative saturation bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/11109 | 5 4| 0 | 


e jolt 1 4 1 4 of mooo | imme fto orloj) Re | Rd 


immh op 


Scalar variant 


SQSHRN <Vb><d>, <Va><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then UNDEFINED; 

if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 
integer datasize = esize; 

integer elements = 1; 

integer part = 0; 


integer shift = (2 » esize) - UInt(immh:immb) ; 


boolean round = (op == '1'); 

boolean unsigned = (U == '1'); 

Vector 

|31 Da baki 16|15 14 13 12|11 10 9. | 5 4| 0 | 
ERC A E E E 


immh 


Vector variant 


SQSHRN{2} <Vd>.<Tb>, <Vn>.<Ta>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 
integer esize = 8 << HighestSetBit(immh) ; 
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datasize = 64; 
part = UInt(Q); 
elements = datasize DIV esize; 


shift = (2 » esize) - UInt(immh:immb) ; 
round = (op == '1'); 
unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Tb> 


<Vn> 


<Ta> 


<Vb> 


<d> 


<Va> 


ARM DDI 0487E.a 
ID070919 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 
16B when immh = 0001, Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = x is reserved. 
Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "immh" field. It can have the following values: 


8H when immh = 0001 
4S when immh = 001x 
2D when immh = Q1xx 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Is the destination width specifier, encoded in the "immh" field. It can have the following values: 


B when immh = 0001 
H when immh = QQ1x 
S when immh = Q1xx 


The following encodings are reserved: 
° immh = 0000. 


s immh = 1xxx. 
Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the source width specifier, encoded in the "immh" field. It can have the following values: 


H when immh = 0001 
S when immh = 001x 
D when immh = 01xx 
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The following encodings are reserved: 


. immh = 0000. 


° immh = 1xxx. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<shift> For the scalar variant: is the right shift amount, in the range 1 to the destination operand width in 


bits, encoded in the "immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 

(32-UInt(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = Q1xx 

The following encodings are reserved: 

° immh = 0000. 

° immh = 1xxx. 


For the vector variant: is the right shift amount, in the range 1 to the destination element width in 
bits, encoded in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasizex2) operand = V[n]; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else Q; 
integer element; 

boolean sat; 


for e = 0 to elements-1 
element = (Int(Elem[operand, e, 2*esize], unsigned) + round_const) >> shift; 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 


Vpart[d, part] = result; 
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C7.2.298 SQSHRUN, SQSHRUN2 


ARM DDI 0487E.a 
ID070919 


Signed saturating Shift Right Unsigned Narrow (immediate). This instruction reads each signed integer value in the 
vector of the source SIMD&FP register, right shifts each value by an immediate value, saturates the result to an 
unsigned integer value that is half the original width, places the final result into a vector, and writes the vector to 
the destination SIMD&FP register. The results are truncated. For rounded results, see SQRSHRUN, SQRSHRUN2. 


The SQSHRUN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the SQSHRUN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 


of the register. 


If saturation occurs, the cumulative saturation bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 11918 16|15141312/11109 | 5 4| 0 | 


fo afi] 1717 0] 0000 [immb [100 ojo] Rn | Rd 


immh op 


Scalar variant 


SQSHRUN <Vb><d>, <Va><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then UNDEFINED; 

if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 
integer datasize = esize; 

integer elements = 1; 

integer part = 0; 


integer shift = (2 » esize) - UInt(immh:immb) ; 
boolean round = (op == '1'); 


Vector 


|31 30 29 28|27 26 25 24|23 22 1918  16|15141312/11109 | 5 4| 0 | 


oleo n n 0] 0000 | immb [100 ojo] Rn | Rd 


immh op 


Vector variant 


SQSHRUN{2} <Vd>.<Tb>, <Vn>.<Ta>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = 64; 

integer part = UInt(Q); 
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integer elements = datasize DIV esize; 


integer shift = (2 » esize) - UInt(immh:immb) ; 
boolean round = (op == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Tb> Is an arrangement specifier, encoded in the "Immh:Q" field. It can have the following values: 
8B when immh = 0001, Q = 0 
16B when immh = 0001,Q = 1 
4H when immh = 001x, Q = @ 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<Ta> Is an arrangement specifier, encoded in the "Immh" field. It can have the following values: 
8H when immh = 0001 
4s when immh = 001x 
2D when immh = Q1xx 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


<Vb> Is the destination width specifier, encoded in the "immh" field. It can have the following values: 
B when immh = 0001 
H when immh = 001x 
S when immh = 01xx 


The following encodings are reserved: 


. immh = 0000. 


° immh = 1xxx. 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<Va> Is the source width specifier, encoded in the "immh" field. It can have the following values: 
H when immh = 0001 
S when immh = 001x 
D when immh = Q1xx 


The following encodings are reserved: 
° immh = 0000. 


. immh = 1xxx. 
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Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 

For the scalar variant: is the right shift amount, in the range 1 to the destination operand width in 
bits, encoded in the "immh:immb" field. It can have the following values: 

(16-UInt(immh:immb)) when immh = 0001 

(32-UInt(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = Q1xx 

The following encodings are reserved: 

° immh = 0000. 

° immh = 1xxx. 


For the vector variant: is the right shift amount, in the range 1 to the destination element width in 
bits, encoded in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = 01xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 

bits(datasizex2) operand = V[n]; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else Q; 
integer element; 


boolean sat; 


for e = 0 to elements-1 
element = (SInt(Elem[operand, e, 2*esize]) + round_const) >> shift; 
(Elem[result, e, esize], sat) = UnsignedSatQ(element, esize); 
if sat then FPSR.QC = '1'; 


Vpart[d, part] = result; 
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C7.2.299 


C7-2046 


SQSUB 


Signed saturating Subtract. This instruction subtracts the element values of the second source SIMD&FP register 
from the corresponding element values of the first source SIMD&FP register, places the results into a vector, and 
writes the vector to the destination SIMD&FP register. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


oao +77 O[sze]i] Rm ooro] Rn | Rd 
U 


Scalar variant 


SQSUB <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean unsigned = (U == '1'); 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312/11109 | 5 4| 0| 


elalojo i 1 4 oļszeļi| Rm Joo ro ijif Ro | r 


Vector variant 


SQSUB <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 


5 when size = 10 
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<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


D 
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when size = 11 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2s 
4S 
2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


00,0 = 0 
00,Q=1 
01,0 = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
11,Q=1 


The encoding size = 11, Q = ® is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) result; 
integer element1; 
integer element2; 


integer diff; 
boolean sat; 


for e = 0 to elements-1 


V[d] 


= V[n]; 
= V[m]; 


element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
diff = elementl - element2; 
(Elem[result, e, esize], sat) = SatQ(diff, esize, unsigned); 
if sat then FPSR.QC = '1'; 


= result; 
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C7.2.300 SQXTN, SQXTN2 


Signed saturating extract Narrow. This instruction reads each vector element from the source SIMD&FP register, 
saturates the value to half the original width, places the result into a vector, and writes the vector to the lower or 
upper half of the destination SIMD&FP register. The destination vector elements are half as long as the source 
vector elements. All the values in this instruction are signed integer values. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


The SQXTN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the SQXTN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/1514 1312/1110 9. | 


[o loji 1 1 1 ofsize]1 000 0of1 010 0f1 of Rn | Ra | 
U 


Scalar variant 


SQXTN <Vb><d>, <Va><n> 


Decode for this encoding 


integer 
integer 
if size 
integer 
integer 
integer 
integer 


boolean 


Vector 


d = UInt(Rd); 
n = UInt(Rn); 
== '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = esize; 
part = Q; 
elements 


1; 


unsigned = (U == '1'); 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 


CNO CEE EE E e maT J 


Vector variant 


SQXTN{2} 


<Vd>.<Tb>, <Vn>.<Ta> 


Decode for this encoding 


integer 
integer 


if size 
integer 


integer 
integer 


C7-2048 


d = UInt(Rd); 
n = UInt(Rn); 
== '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = 64; 
part = UInt(Q); 
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integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Tb> 


<Vn> 


<Ta> 


<Vb> 


<d> 


<Va> 


<n> 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 


16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 
Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


Is the destination width specifier, encoded in the "size" field. It can have the following values: 


B when size = 00 
H when size = 01 
S when size = 10 


The encoding size = 11 is reserved. 
Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the source width specifier, encoded in the "size" field. It can have the following values: 


H when size = 00 
S when size = 01 
D when size = 10 


The encoding size = 11 is reserved. 


Is the number of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(2sdatasize) operand = V[n]; 
bits(datasize) result; 
bits(2xesize) element; 


boolean sat; 
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for e = 0 to elements-1 
element = Elem[operand, e, 2esize]; 
(Elem[result, e, esize], sat) = SatQ(Int(element, unsigned), esize, unsigned); 
if sat then FPSR.QC = '1'; 


Vpart[d, part] = result; 
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Signed saturating extract Unsigned Narrow. This instruction reads each signed integer value in the vector of the 
source SIMD&FP register, saturates the value to an unsigned integer value that is half the original width, places the 
result into a vector, and writes the vector to the lower or upper half of the destination SIMD&FP register. The 
destination vector elements are half as long as the source vector elements. 


If saturation occurs, the cumulative saturation bit FPSR.QC is set. 


The SQXTUN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the SQXTUN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/1514 1312/1110 9 | 


fo a[i[1 177 olse ooo oj ooroo] Rn | Rd 


Scalar variant 


SQXTUN <Vb><d>, <Va><n> 


Decode for this encoding 


integer 
integer 


if size 
integer 
integer 
integer 
integer 


Vector 


d = UInt(Rd); 
n = UInt(Rn); 
== '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = esize; 
part = Q; 
elements = 1; 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 


fofajijo 1 1 1 ofsie{[1 o o o ofa 007 ofr of Rn | Ra | 


Vector variant 


SQXTUN{2} <Vd>.<Tb>, <Vn>.<Ta> 


Decode for this encoding 


integer 
integer 


if size 
integer 
integer 
integer 
integer 


ARM DDI 0487E.a 
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d = UInt(Rd); 
n = UInt(Rn); 
== '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = 64; 
part = UInt(Q); 


elements = datasize DIV esize; 
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C7-2052 


Assembler symbols 


2 


<Vd> 


<Tb> 


<Vn> 


<Ta> 


<Vb> 


<d> 


<Va> 


<n> 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 


16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = @ 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 
Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


Is the destination width specifier, encoded in the "size" field. It can have the following values: 


B when size = 00 
H when size = Q1 
5 when size = 10 


The encoding size = 11 is reserved. 
Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 


Is the source width specifier, encoded in the "size" field. It can have the following values: 


H when size = 00 
S when size = 01 
D when size = 10 


The encoding size = 11 is reserved. 


Is the number of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(2sdatasize) operand = V[n]; 
bits(datasize) result; 
bits(2sesize) element; 


boolean sat; 


for e = 0 to elements-1 


element = Elem[operand, e, 2esize]; 
(Elem[result, e, esize], sat) = UnsignedSatQ(SInt(element), esize); 
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if sat then FPSR.QC = '1'; 


Vpart[d, part] = result; 
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C7.2.302 


C7-2054 


SRHADD 


Signed Rounding Halving Add. This instruction adds corresponding signed integer values from the two source 
SIMD&FP registers, shifts each result right one bit, places the results into a vector, and writes the vector to the 
destination SIMD&FP register. 


The results are rounded. For truncated results, see SHADD. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fo[afofo +771 ofsi] Rm [oo070]i] Rn | Rd 
U 


Three registers of the same type variant 


SRHADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
== '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 

8B when size = 00,Q = 0 

16B when size = 00,Q = 1 

4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10,Q = 0 

4S when size = 10,Q = 1 

The encoding size = 11, Q = x is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer 


element1; 


integer element2; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
Elem[result, e, esize] = (elementl+element2+1)<esize:1>; 


V[d] = result; 
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C7.2.303 


C7-2056 


SRI 


Shift Right and Insert (immediate). This instruction reads each vector element in the source SIMD&FP register, 
right shifts each vector element by an immediate value, and inserts the result into the corresponding vector element 
in the destination SIMD&FP register such that the new zero bits created by the shift are not inserted but retain their 
existing value. Bits shifted out of the right of each vector element of the source register are lost. 


The following figure shows the operation of shift right by 3 for an 8-bit vector element. 


63 56 55 0 
Vn.B[7] 


63 56 55 0 


63 56 55 0 
Vd.B[7] before operation 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 
|31 aa |19 18 16/15 14 13 121110 9. | 54| 0| 
[o fafi 1 1 1 1 o| !=0000 | immb [0100 0/1] Rn | Ra | 





immh 


Scalar variant 


SRI <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


integer shift = (esize » 2) - UInt(immh:immb) ; 
Vector 
|31 30 29 28|27 26 25 24|23 22 |1918 16|/15141312|11109 | 5 4| 0 | 


fofa}ijo 1 1 1 1 of '0000 | immb [o 1 o o oft] Rn | Ra | 


immh 


Vector variant 


SRI <Vd>.<T>, <Vn>.<T>, #<shift> 
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Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


Assembler symbols 


<V> Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 


<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 

8B when immh = 0001, Q = 0 

16B when immh = 0001, Q = 1 

4H when immh = 001x, Q = 0 

8H when immh = 001x, Q = 1 

2S when immh = 01xx, Q = 0 

4S when immh = 01xx, Q = 1 

2D when immh = 1xxx, Q = 1 





See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The encoding immh = 1xxx, Q = Q is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<shift> For the scalar variant: is the right shift amount, in the range | to 64, encoded in the "immh:immb" 
field. It can have the following values: 
(128-UInt(immh:immb)) when immh = 1xxx 
The encoding immh = Qxxx is reserved. 


For the vector variant: is the right shift amount, in the range 1 to the element width in bits, encoded 
in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 


(128-UInt(immh:immb)) when immh = 1xxx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) operand2 = V[d]; 
bits(datasize) result; 
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bits(esize) mask = LSR(Ones(esize), shift); 
bits(esize) shifted; 


for e = 0 to elements-1 

shifted = LSR(Elem[operand, e, esize], shift); 

Elem[result, e, esize] = (Elem[operand2, e, esize] AND NOT(mask)) OR shifted; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Signed Rounding Shift Left (register). This instruction takes each signed integer value in the vector of the first 
source SIMD&FP register, shifts it by a value from the least significant byte of the corresponding element of the 
second source SIMD&FP register, places the results in a vector, and writes the vector to the destination SIMD&FP 


register. 


If the shift value is positive, the operation is a left shift. If the shift value is negative, it is a rounding right shift. For 
a truncating shift, see SSHL. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 


oni oje e oon Ra TJ 


Scalar variant 


SRSHL <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer 
integer 
integer 
integer 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
esize = 8 << UInt(size); 


integer datasize = esize; 
integer elements = 1; 
boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 
if S == '@' && size != '11' then UNDEFINED; 
Vector 

|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 


olojojo +771 ojs] Rm [07 o]ijofi] Rn | Rd 
U RS 


Vector variant 


SRSHL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 
boolean 
boolean 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
:Q == '110' then UNDEFINED; 


esize = 8 << UInt(size); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 

unsigned = (U == '1'); 

rounding = (R == '1'); 

saturating = (S == '1'); 
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C7-2060 


Assembler symbols 


<V> 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 

The following encodings are reserved: 

’ size = 0x. 


s size = 10. 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 

Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer round_const = Q; 
integer shift; 
integer element; 


bool 


for 


V[d] 


ean sat; 


e = Q to elements-1 
shift = SInt(Elem[operand2, e, esize]<7:0>); 
if rounding then 
round_const = 1 << (-shift - 1); // ® for left shift, 2A(n-1) for right shift 
element = (Int(Elem[operand1, e, esize], unsigned) + round_const) << shift; 
if saturating then 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 
else 
Elem[result, e, esize] = element<esize-1:0>; 


= result; 
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C7.2.305 SRSHR 


ARM DDI 0487E.a 
ID070919 


Signed Rounding Shift Right (immediate). This instruction reads each vector element in the source SIMD&FP 
register, right shifts each result by an immediate value, places the final result into a vector, and writes the vector to 
the destination SIMD&FP register. All the values in this instruction are signed integer values. The results are 


rounded. For truncated results, see SSHR. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15 1413 12/1110 9 | 5 4| 0| 


e slojt 1111 0} moo | imme fo ofrfojoli| R | ni 


immh 01 00 


Scalar variant 


SRSHR <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


boolean unsigned = (U == '1'); 
boolean round = (01 == '1'); 
boolean accumulate = (00 == '1'); 
Vector 
|31 e lets 16/15 14 13 12|1110 9. | 5 4| 0| 
elelo] 01 1 o| !=0000 | immb [o ojifojoji] Rn | R | 
immh 01 00 


Vector variant 


SRSHR <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


boolean unsigned = (U == '1'); 
boolean round = (01 == '1'); 
boolean accumulate = (0@ == '1'); 
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C7-2062 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<shift> 


Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 
Is the number of the SIMD&FP destination register, in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 
16B when immh = 0001, Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = @ 
4S when immh = 01xx, Q = 1 





2D when immh = 1xxx, Q = 1 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


For the scalar variant: is the right shift amount, in the range | to 64, encoded in the "immh:immb" 


field. It can have the following values: 
(128-UInt(immh:immb)) when immh = 1xxx 


The encoding immh = Qxxx is reserved. 


For the vector variant: is the right shift amount, in the range 1 to the element width in bits, encoded 


in the "immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 


(128-UInt(immh:immb)) when immh 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


1xxx 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand = V[n]; 

bits(datasize) operand2; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else ð; 
integer element; 


operand2 = if accumulate then V[d] else Zeros(); 

for e = 0 to elements-1 
element = (Int(Elem[operand, e, esize], unsigned) + round_const) >> shift; 
Elem[result, e, esize] = Elem[operand2, e, esize] + element<esize-1:0>; 


V[d] = result; 
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SRSRA 


Signed Rounding Shift Right and Accumulate (immediate). This instruction reads each vector element in the source 
SIMD&FP register, right shifts each result by an immediate value, and accumulates the final results with the vector 
elements of the destination SIMD&FP register. All the values in this instruction are signed integer values. The 
results are rounded. For truncated results, see SSRA. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 |19 18 


16|15 14 13 12|11 10 9. | 


54| o| 


e slojt 1111 oj 0000 | imme fo ojiji r | Ro 


immh 


Scalar variant 


SRSRA <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


shift = (esize » 2) - UInt(immh:immb); 
unsigned = (U == '1'); 

round = (ol == '1'); 

accumulate = (00 == '1'); 


integer 
boolean 
boolean 
boolean 


Vector 


|31 30 29 28|27 26 25 24/23 22 |1918 


16/15 14 13 1211110 9. | 


01 00 


54| o| 


olafofo 1 1 4 1 oj TAEAE Rn | Ré 


immh 


Vector variant 


SRSRA <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


01 00 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 


if immh<3>:Q == '10' then UNDEFINED; 


integer esize = 8 << HighestSetBit(immh) ; 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

integer shift = (esize » 2) - UInt(immh:immb) ; 
boolean unsigned = (U == '1'); 

boolean round = (01 == '1'); 

boolean accumulate = (0@ == '1'); 
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C7-2064 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<shift> 


Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 
Is the number of the SIMD&FP destination register, in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 
16B when immh = 0001, Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = @ 
4S when immh = 01xx, Q = 1 





2D when immh = 1xxx, Q = 1 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


For the scalar variant: is the right shift amount, in the range | to 64, encoded in the "immh:immb" 


field. It can have the following values: 
(128-UInt(immh:immb)) when immh = 1xxx 


The encoding immh = Qxxx is reserved. 


For the vector variant: is the right shift amount, in the range 1 to the element width in bits, encoded 


in the "immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 


(128-UInt(immh:immb)) when immh 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


1xxx 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand = V[n]; 

bits(datasize) operand2; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else ð; 
integer element; 


operand2 = if accumulate then V[d] else Zeros(); 

for e = 0 to elements-1 
element = (Int(Elem[operand, e, esize], unsigned) + round_const) >> shift; 
Elem[result, e, esize] = Elem[operand2, e, esize] + element<esize-1:0>; 


V[d] = result; 
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Signed Shift Left (register). This instruction takes each signed integer value in the vector of the first source 
SIMD&FP register, shifts each value by a value from the least significant byte of the corresponding element of the 
second source SIMD&FP register, places the results in a vector, and writes the vector to the destination SIMD&FP 


register. 


If the shift value is positive, the operation is a left shift. If the shift value is negative, it is a truncating right shift. For 
a rounding shift, see SRSHL. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9 | 


oni oje e ooo e TJ 


Scalar variant 


SSHL <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer 
integer 
integer 
integer 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
esize = 8 << UInt(size); 


integer datasize = esize; 
integer elements = 1; 
boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 
if S == '@' && size != '11' then UNDEFINED; 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 


fo[afoo +71 Ofsze]i] Rm [07 ofojofi] rn | Rd 
U RS 


Vector variant 


SSHL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 
boolean 
boolean 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
:Q == '110' then UNDEFINED; 


esize = 8 << UInt(size); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 

unsigned = (U == '1'); 

rounding = (R == '1'); 

saturating = (S == '1'); 
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C7-2066 


Assembler symbols 


<V> 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 

The following encodings are reserved: 

’ size = 0x. 


s size = 10. 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 

Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer round_const = Q; 
integer shift; 
integer element; 


bool 


for 


V[d] 


ean sat; 


e = Q to elements-1 
shift = SInt(Elem[operand2, e, esize]<7:0>); 
if rounding then 
round_const = 1 << (-shift - 1); // ® for left shift, 2A(n-1) for right shift 
element = (Int(Elem[operand1, e, esize], unsigned) + round_const) << shift; 
if saturating then 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 
else 
Elem[result, e, esize] = element<esize-1:0>; 


= result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.308 SSHLL, SSHLL2 


Signed Shift Left Long (immediate). This instruction reads each vector element from the source SIMD&FP register, 
left shifts each vector element by the specified shift amount, places the result into a vector, and writes the vector to 
the destination SIMD&FP register. The destination vector elements are twice as long as the source vector elements. 
All the values in this instruction are signed integer values. 


The SSHLL instruction extracts vector elements from the lower half of the source register, while the SSHLL2 instruction 
extracts vector elements from the upper half of the source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is used by the alias SXTL, SXTL2. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24/23 22 1918 16|15141312/11109 | 5 4| 0 | 


foJafofo Tri E [inne [ro 10 K an Ra 


immh 


Vector variant 


SSHLL{2} <Vd>.<Ta>, <Vn>.<Tb>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


integer shift = UInt(immh:immb) - esize; 
boolean unsigned = (U == '1'); 


Alias conditions 





Alias is preferred when 


SXTL, SXTL2 immb == 'Q00' && BitCount(immh) == 





Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "immh" field. It can have the following values: 
8H when immh = 0001 
4s when immh = 001x 
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2D when immh = Q1xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 
8B when immh = 0001, Q = 0 
16B when immh = 0001,Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The encoding immh = 1xxx, Q = x is reserved. 
<shift> Is the left shift amount, in the range 0 to the source element width in bits minus 1, encoded in the 
"immh:immb" field. It can have the following values: 
(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = Q1xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = Vpart[n, part]; 
bits(datasizex2) result; 

integer element; 


for e = 0 to elements-1 
element = Int(Elem[operand, e, esize], unsigned) << shift; 
Elem[result, e, 2xesize] = element<2sesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-2069 
ID070919 Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.309 


C7-2070 


SSHR 


Signed Shift Right (immediate). This instruction reads each vector element in the source SIMD&FP register, right 
shifts each result by an immediate value, places the final result into a vector, and writes the vector to the destination 
SIMD&FP register. All the values in this instruction are signed integer values. The results are truncated. For 


rounded results, see SRSHR. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/11109 | 5 4| 0 | 
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immh 01 00 


Scalar variant 


SSHR <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


boolean unsigned = (U == '1'); 
boolean round = (01 == '1'); 
boolean accumulate = (00 == '1'); 
Vector 
|31 e lets 16/15 14 13 12|1110 9. | 5 4| 0| 
elelo] 01 1 o| !=0000 | immb [o ofofofoji] Rn | R | 
immh 0100 


Vector variant 


SSHR <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh); 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = (esize » 2) - UInt(immh:immb) ; 
boolean unsigned = (U == '1'); 

boolean round = (01 == '1'); 

boolean accumulate = (0@ == '1'); 
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Assembler symbols 


<V> Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 





<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 

8B when immh = 0001, Q = 0 

16B when immh = 0001, Q = 1 

4H when immh = 001x, Q = 0 

8H when immh = 001x, Q = 1 

2S when immh = 01xx, Q = @ 

4S when immh = 01xx, Q = 1 

2D when immh = 1xxx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The encoding immh = 1xxx, Q = Q is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<shi ft> For the scalar variant: is the right shift amount, in the range 1 to 64, encoded in the "immh:immb" 
field. It can have the following values: 
(128-UInt(immh:immb)) when immh = 1xxx 
The encoding immh = Qxxx is reserved. 


For the vector variant: is the right shift amount, in the range 1 to the element width in bits, encoded 
in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 


(128-UInt(immh:immb)) when immh 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


1xxx 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand = V[n]; 

bits(datasize) operand2; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else ð; 
integer element; 


operand2 = if accumulate then V[d] else Zeros(); 

for e = 0 to elements-1 
element = (Int(Elem[operand, e, esize], unsigned) + round_const) >> shift; 
Elem[result, e, esize] = Elem[operand2, e, esize] + element<esize-1:0>; 


V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.310 SSRA 


ARM DDI 0487E.a 
ID070919 


Signed Shift Right and Accumulate (immediate). This instruction reads each vector element in the source 


SIMD&FP register, right shifts each result by an immediate value, and accumulates the final results with the vector 
elements of the destination SIMD&FP register. All the values in this instruction are signed integer values. The 


results are truncated. For rounded results, see SRSRA. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/1110 9 | 5 4| 0 | 


e solri 1 4 7 of mooo | imme fo ofofrjoli| Rn | ni 


immh 01 00 


Scalar variant 


SSRA <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


boolean unsigned = (U == '1'); 
boolean round = (01 == '1'); 
boolean accumulate = (00 == '1'); 
Vector 
|31 e lets 16/15 14 13 12|1110 9. | 5 4| 0| 
elelo] 01 1 o| !=0000 | immb [o ojofjijoji] Rao | R | 
immh 01 00 


Vector variant 


SSRA <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


boolean unsigned = (U == '1'); 
boolean round = (01 == '1'); 
boolean accumulate = (0@ == '1'); 
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C7-2074 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<shift> 


Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 
Is the number of the SIMD&FP destination register, in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 
16B when immh = 0001, Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = @ 
4S when immh = 01xx, Q = 1 





2D when immh = 1xxx, Q = 1 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


For the scalar variant: is the right shift amount, in the range | to 64, encoded in the "immh:immb" 


field. It can have the following values: 
(128-UInt(immh:immb)) when immh = 1xxx 


The encoding immh = Qxxx is reserved. 


For the vector variant: is the right shift amount, in the range 1 to the element width in bits, encoded 


in the "immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 


(128-UInt(immh:immb)) when immh 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


1xxx 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand = V[n]; 

bits(datasize) operand2; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else ð; 
integer element; 


operand2 = if accumulate then V[d] else Zeros(); 

for e = 0 to elements-1 
element = (Int(Elem[operand, e, esize], unsigned) + round_const) >> shift; 
Elem[result, e, esize] = Elem[operand2, e, esize] + element<esize-1:0>; 


V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.311 SSUBL, SSUBL2 


Signed Subtract Long. This instruction subtracts each vector element in the lower or upper half of the second source 
SIMD&FP register from the corresponding vector element of the first source SIMD&FP register, places the results 
into a vector, and writes the vector to the destination SIMD&FP register. All the values in this instruction are signed 
integer values. The destination vector elements are twice as long as the source vector elements. 


The SSUBL instruction extracts each source vector from the lower half of each source register, while the SSUBL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9. | 5 4| 0| 


COMTES E 


Three registers, not all the same type variant 


SSUBL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d = UInt(Rd); 


n 


UInt(Rn) ; 


m = UInt(Rm); 


== '11' then UNDEFINED; 


esize = 


8 << UInt(size); 


datasize = 64; 


part = 


UInt (Q); 


elements = datasize DIV esize; 


sub_op = 
unsigned 


(o1 == '1'); 
= (U = '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


C7-2076 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

integer sum; 


for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
Elem[result, e, 2xesize] = sum<2xesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.312 SSUBW, SSUBW2 


Signed Subtract Wide. This instruction subtracts each vector element in the lower or upper half of the second source 
SIMD&FP register from the corresponding vector element in the first source SIMD&FP register, places the result 
in a vector, and writes the vector to the SIMD&FP destination register. All the values in this instruction are signed 
integer values. 


The SSUBW instruction extracts the second source vector from the lower half of the second source register, while the 
SSUBW2 instruction extracts the second source vector from the upper half of the second source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0| 


COTES E 


Three registers, not all the same type variant 


SSUBW{2} <Vd>.<Ta>, <Vn>.<Ta>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rm); 

== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 


elements = datasize DIV esize; 


sub_op = 
unsigned 


(o1 == '1'); 
= (U = '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Vm> 


C7-2078 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
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<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(2sdatasize) operand1 = V[n]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

integer sum; 


for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, 2*esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
Elem[result, e, 2xesize] = sum<2xesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.313 


C7-2080 


ST1 (multiple structures) 


Store multiple single-element structures from one, two, three, or four registers. This instruction stores elements to 
memory from one, two, three, or four SIMD&FP registers, without interleaving. Every element of each register is 
stored. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 a” 10 9 = 5 4| 0| 
Ge CIBC dC ae a 


opcode 


One register variant 
Applies when opcode == 0111. 


ST1 { <Vt>.<T> }, [<Xn|SP>] 


Two registers variant 
Applies when opcode == 1010. 


ST1 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>] 


Three registers variant 
Applies when opcode == 0110. 


ST1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>] 


Four registers variant 
Applies when opcode == 0010. 


ST1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>] 


Decode for all variants of this encoding 
integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 


boolean whack = FALSE; 
boolean tag_checked = whack || n != 31; 


Post-index 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 12/1110 9 | 5 4| 0 | 


eorr 0 solo] am herse RT 


opcode 


One register, immediate offset variant 
Applies when Rm == 11111 && opcode == 0111. 


ST1 { <Vt>.<T> }, [<Xn|SP>], <imm> 


One register, register offset variant 


Applies when Rm != 11111 && opcode == 0111. 
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ST1 { <Vt>.<T> }, [<Xn|SP>], <Xm> 


Two registers, immediate offset variant 
Applies when Rm == 11111 && opcode == 1010. 


ST1 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <imm> 


Two registers, register offset variant 
Applies when Rm != 11111 && opcode == 1010. 


ST1 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <Xm> 


Three registers, immediate offset variant 
Applies when Rm == 11111 && opcode == 0110. 


ST1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <imm> 


Three registers, register offset variant 
Applies when Rm != 11111 && opcode == 0110. 


ST1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <Xm> 


Four registers, immediate offset variant 
Applies when Rm == 11111 && opcode == 0010. 


ST1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <imm> 


Four registers, register offset variant 
Applies when Rm != 11111 && opcode == 0010. 


ST1 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = @ 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 
1D when size = 11,Q = 0 
2D when size = 11,Q = 1 
<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Vt3> Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
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<Vt4> 
<Xn | SP> 


<imm> 


Is the name of the fourth SIMD&FP register to be transferred, encoded as "Rt" plus 3 modulo 32. 
Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
For the one register, immediate offset variant: is the post-index immediate offset, encoded in the "Q" 
field. It can have the following values: 

#8 when Q = 0 

#16 when Q = 1 


For the two registers, immediate offset variant: is the post-index immediate offset, encoded in the 
"Q" field. It can have the following values: 


#16 when Q = 0 
#32 when Q = 1 


For the three registers, immediate offset variant: is the post-index immediate offset, encoded in the 
"Q" field. It can have the following values: 


#24 when Q = 0 
#48 when Q = 1 


For the four registers, immediate offset variant: is the post-index immediate offset, encoded in the 


"Q" field. It can have the following values: 


#32 when Q = 0 
#64 when Q = 1 


<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 


field. 


Shared decode for all encodings 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 


integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << UInt(size); 
integer elements = datasize DIV esize; 


integer rpt; // number of iterations 
integer selem; // structure elements 


case opcode of 


when '0000' rpt = 1; selem = 4; // LD/ST4 (4 registers) 
when '0010' rpt = 4; selem = 1; // LD/ST1 (4 registers) 
when '0100' rpt = 1; selem = 3; // LD/ST3 (3 registers) 
when 'Q110' rpt = 3; selem = 1; // LD/ST1 (3 registers) 
when 'Q111' rpt = 1; selem = 1; // LD/ST1 (1 register) 
when '1000' rpt = 1; selem = 2; // LD/ST2 (2 registers) 
when '1010' rpt = 2; selem = 1; // LD/ST1 (2 registers) 
otherwise UNDEFINED; 


// .1D format only permitted with LD1 & ST1 
if size:Q == '110' && selem != 1 then UNDEFINED; 


Operation for all encodings 
CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(datasize) rval; 

integer tt; 

constant integer ebytes = esize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 
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if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
for r = Q to rpt-1 
for e = 0 to elements-1 
tt = (t + r) MOD 32; 
for s = @ to selem-1 
rval = V[tt]; 
if memop == MemOp_LOAD then 
Elem[rval, e, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[tt] = rval; 
else // memop == MemOp_STORE 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, e, esize]; 
offs = offs + ebytes; 
tt = (tt + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 


X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-2083 
Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.314 


C7-2084 


ST1 (single structure) 


Store a single-element structure from one lane of one register. This instruction stores the specified element of a 
SIMD&FP register to memory. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 a 20|19 18 17 16|15 ee 109 | 5 4| 0 | 
fojajoo 1101 Tank 000 ojx x ofs|sze]| Rn | R | 


opcode 


8-bit variant 
Applies when opcode == 000. 


ST1 { <Vt>.B }[<index>], [<Xn|SP>] 


16-bit variant 
Applies when opcode == 010 && size == x0. 


ST1 { <Vt>.H }[<index>], [<Xn|SP>] 


32-bit variant 
Applies when opcode == 100 && size == 00. 


ST1 { <Vt>.S }[<index>], [<Xn|SP>] 


64-bit variant 
Applies when opcode == 100 && S == 0 && size == 01. 


ST1 { <Vt>.D }[<index>], [<Xn|SP>] 


Decode for all variants of this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 

|31 30 29 28|27 26 25 24/23 22 21 20| 1615 1312/11109 | 5 4| 0 | 

ojajo oF Fo 4 topo] Rm |x x o]s|sze] Ro | Rt__| 

opcode 
8-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 000. 
ST1 { <Vt>.B }[<index>], [<Xn|SP>], #1 
8-bit, register offset variant 
Applies when Rm != 11111 && opcode == 000. 
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ST1 { <Vt>.B }[<index>], [<Xn|SP>], <Xm> 


16-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 010 && size 


ST1 { <Vt>.H }[<index>], [<Xn|SP>], #2 


16-bit, register offset variant 
Applies when Rm != 11111 && opcode == 010 && size 


ST1 { <Vt>.H }[<index>], [<Xn|SP>], <Xm> 


32-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 100 && size 


ST1 { <Vt>.S }[<index>], [<Xn|SP>], #4 


32-bit, register offset variant 
Applies when Rm != 11111 && opcode == 100 && size 


ST1 { <Vt>.S }[<index>], [<Xn|SP>], <Xm> 


64-bit, immediate offset variant 


x@. 


xð. 


00. 


00. 


Applies when Rm == 11111 && opcode == 100 && S == 0 && size == 01. 
ST1 { <Vt>.D }[<index>], [<Xn|SP>], #8 
64-bit, register offset variant 
Applies when Rm != 11111 && opcode == 100 && S == 0 && size == 01. 
ST1 { <Vt>.D }[<index>], [<Xn|SP>], <Xm> 
Decode for all variants of this encoding 
integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 
Assembler symbols 
<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<index> For the 8-bit variant: is the element index, encoded in "Q:S:size". 


For the 16-bit variant: is the element index, encoded in "Q:S:size<1>". 


For the 32-bit variant: is the element index, encoded in "Q:S". 


For the 64-bit variant: is the element index, encoded in "Q". 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<0>:R) + 1; 
boolean replicate = FALSE; 
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integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[0-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 
Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[t] = rval; 
else // memop == MemOp_STORE 
// extract from one lane of 128-bit register 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
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if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.315 ST2 (multiple structures) 


Store multiple 2-element structures from two registers. This instruction stores multiple 2-element structures from 
two SIMD&FP registers to memory, with interleaving. Every element of each register is stored. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16|15 vu 10 9 — 5 4| 0 | 
fofafo o 11 oo ofofo oo oo oli 00 ofsve} Rn | Rt __| 
opcode 
No offset variant 
ST2 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>] 
Decode for this encoding 
integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = integer UNKNOWN; 
boolean whack = FALSE; 
boolean tag_checked = whack || n != 31; 
Post-index 
|31 30 eens 26 25 24|23 22 21 20| 16|15 ad 109 | 5 4| 0 | 
lofafoo 1100 tolol Rm o 0 o{size} Rn | R | 
opcode 
Immediate offset variant 
Applies when Rm == 11111. 
ST2 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <imm> 
Register offset variant 
Applies when Rm != 11111. 
ST2 { <Vt>.<T>, <Vt2>.<T> }, [<Xn|SP>], <Xm> 
Decode for all variants of this encoding 
integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean wback = TRUE; 
boolean tag_checked = wback || n != 31; 
Assembler symbols 
<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<imm> Is the post-index immediate offset, encoded in the "Q" field. It can have the following values: 
#16 when Q = 0 
#32 when Q = 1 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 

integer esize = 8 << UInt(size); 

integer elements = datasize DIV esize; 


integer rpt; // number of iterations 
integer selem; // structure elements 


case opcode of 


when '0000' rpt = 1; selem = 4; // LD/ST4 (4 registers) 
when '0010' rpt = 4; selem = 1; // LD/ST1 (4 registers) 
when 'Q100' rpt = 1; selem = 3; // LD/ST3 (3 registers) 
when 'Q110' rpt = 3; selem = 1; // LD/ST1 (3 registers) 
when '0111' rpt = 1; selem = 1; // LD/ST1 (1 register) 
when '1000' rpt = 1; selem = 2; // LD/ST2 (2 registers) 
when '1010' rpt = 2; selem = 1; // LD/ST1 (2 registers) 
otherwise UNDEFINED; 


// .1D format only permitted with LD1 & ST1 
if size:Q == '110' && selem != 1 then UNDEFINED; 


Operation for all encodings 
CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(datasize) rval; 

integer tt; 

constant integer ebytes = esize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
for r = Q to rpt-1 
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for e = Q to elements-1 
tt = (t + r) MOD 32; 
for s = @ to selem-1 
rval = V[tt]; 
if memop == MemOp_LOAD then 
Elem[rval, e, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[tt] = rval; 
else // memop == MemOp_STORE 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, e, esize]; 
offs = offs + ebytes; 
tt = (tt + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.316 ST2 (single structure) 


ARM DDI 0487E.a 
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Store single 2-element structure from one lane of two registers. This instruction stores a 2-element structure to 


memory from corresponding elements of two SIMD&FP registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 aa 20|19 18 17 16|15 ee 109 | 5 4| 0 | 
fojajoo 1101 aele 000 ojx x ofs|sze]| Rn | R | 


opcode 


8-bit variant 
Applies when opcode == 000. 


ST2 { <Vt>.B, <Vt2>.B }[<index>], [<Xn|SP>] 


16-bit variant 
Applies when opcode == 010 && size == x0. 


ST2 { <Vt>.H, <Vt2>.H }[<index>], [<Xn|SP>] 


32-bit variant 
Applies when opcode == 100 && size == 00. 


ST2 { <Vt>.S, <Vt2>.S }[<index>], [<Xn|SP>] 


64-bit variant 
Applies when opcode == 100 && S == 0 && size == 01. 


ST2 { <Vt>.D, <Vt2>.D }[<index>], [<Xn|SP>] 


Decode for all variants of this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15  1312/11109 | 54| 0| 
ojajo oF FoF tops] Rm |x x o]s|sze] Re | Rt__| 


opcode 


8-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 000. 


ST2 { <Vt>.B, <Vt2>.B }[<index>], [<Xn|SP>], #2 


8-bit, register offset variant 


Applies when Rm != 11111 && opcode == 000. 
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ST2 { <Vt>.B, <Vt2>.B }[<index>], [<Xn|SP>], <Xm> 


16-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 010 && size == x0. 


ST2 { <Vt>.H, <Vt2>.H }[<index>], [<Xn|SP>], #4 


16-bit, register offset variant 
Applies when Rm != 11111 && opcode == 010 && size == x0. 


ST2 { <Vt>.H, <Vt2>.H }[<index>], [<Xn|SP>], <Xm> 


32-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 100 && size == 00. 


ST2 { <Vt>.S, <Vt2>.S }[<index>], [<Xn|SP>], #8 


32-bit, register offset variant 
Applies when Rm != 11111 && opcode == 100 && size == 00. 


ST2 { <Vt>.S, <Vt2>.S }[<index>], [<Xn|SP>], <Xm> 


64-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 100 && S == 0 && size == 01. 


ST2 { <Vt>.D, <Vt2>.D }[<index>], [<Xn|SP>], #16 


64-bit, register offset variant 
Applies when Rm != 11111 && opcode == 100 && S == 0 && size == 01. 


ST2 { <Vt>.D, <Vt2>.D }[<index>], [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<index> For the 8-bit variant: is the element index, encoded in "Q:S:size". 


For the 16-bit variant: is the element index, encoded in "Q:S:size<1>". 
For the 32-bit variant: is the element index, encoded in "Q:S". 


For the 64-bit variant: is the element index, encoded in "Q". 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 
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Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<@>:R) + 1; 
boolean replicate = FALSE; 

integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[Q-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 


Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 


V[t] = rval; 
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else // memop == MemOp_STORE 

// extract from one lane of 128-bit register 

Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.317 ST3 (multiple structures) 


ARM DDI 0487E.a 
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Store multiple 3-element structures from three registers. This instruction stores multiple 3-element structures to 


memory from three SIMD&FP registers, with interleaving. Every element of each register is stored. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


No offset 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 | 5 4| o| 


ajo o 1 100 eae e Ro | Rt 


opcode 


No offset variant 


ST3 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 12/1110 9 | 5 4| 0 | 


ajo o i 100 1ļojlo| rm [Jo 10 Olsize| R | Rt 


opcode 


Immediate offset variant 
Applies when Rm == 11111. 


ST3 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <imm> 


Register offset variant 
Applies when Rm != 11111. 


ST3 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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C7-2096 


4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Vt3> Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<imm> Is the post-index immediate offset, encoded in the "Q" field. It can have the following values: 
#24 when Q = 0 
#48 when Q = 1 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 

integer esize = 8 << UInt(size); 

integer elements = datasize DIV esize; 


integer rpt; // number of iterations 
integer selem; // structure elements 


case opcode of 
when '0000' rpt = 
when '0010' rpt = 
when 'Q100' rpt = selem = 
when 'Q110' rpt = selem = 


1; selem = 

4 

1 

3 
when '0111' rpt = 1; selem = 

1 

2 

D 


selem = 


// LD/ST4 (4 registers) 
// LD/ST1 (4 registers) 
// LD/ST3 (3 registers) 
// LD/ST1 (3 registers) 
// LD/ST1 (1 register) 

// LD/ST2 (2 registers) 
// LD/ST1 (2 registers) 


PNPRPWHEA 


when '1000' rpt = 1; selem = 
when '1010' rpt = 2; selem = 
otherwise UNDEFIN 


// .1D format only permitted with LD1 & ST1 
if size:Q == '110' && selem != 1 then UNDEFINED; 


Operation for all encodings 
CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(datasize) rval; 

integer tt; 

constant integer ebytes = esize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 
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offs = Zeros(); 
for r = Q to rpt-1 
for e = Q to elements-1 
tt = (t + r) MOD 32; 
for s = @ to selem-1 
rval = V[tt]; 
if memop == MemOp_LOAD then 
Elem[rval, e, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[tt] = rval; 
else // memop == MemOp_STORE 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, e, esize]; 
offs = offs + ebytes; 
tt = (tt + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 


X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.318 


C7-2098 


ST3 (single structure) 


Store single 3-element structure from one lane of three registers. This instruction stores a 3-element structure to 
memory from corresponding elements of three SIMD&FP registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 a 20|19 18 17 1416|15 1312\11109 | 5 4| 0 | 
fojajoo 1101 Tank o 0 0 0|x x 1[s]sze]| Rn | R | 


opcode 


8-bit variant 
Applies when opcode == 001. 


ST3 { <Vt>.B, <Vt2>.B, <Vt3>.B }[<index>], [<Xn|SP>] 


16-bit variant 
Applies when opcode == 011 && size == x0. 


ST3 { <Vt>.H, <Vt2>.H, <Vt3>.H }[<index>], [<Xn|SP>] 


32-bit variant 
Applies when opcode == 101 && size == 00. 


ST3 { <Vt>.S, <Vt2>.S, <Vt3>.S }[<index>], [<Xn|SP>] 


64-bit variant 
Applies when opcode == 101 && S == 0 && size == 01. 


ST3 { <Vt>.D, <Vt2>.D, <Vt3>.D }[<index>], [<Xn|SP>] 


Decode for all variants of this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15  1312/11109 | 54| 0| 
ofajo oF Fo 4 topo] Rm |x x i]sfsze] Re | Rt__| 


opcode 


8-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 001. 


ST3 { <Vt>.B, <Vt2>.B, <Vt3>.B }[<index>], [<Xn|SP>], #3 


8-bit, register offset variant 


Applies when Rm != 11111 && opcode == 001. 
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ST3 { <Vt>.B, <Vt2>.B, <Vt3>.B }[<index>], [<Xn|SP>], <Xm> 


16-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 011 && size == x0. 


ST3 { <Vt>.H, <Vt2>.H, <Vt3>.H }[<index>], [<Xn|SP>], #6 


16-bit, register offset variant 
Applies when Rm != 11111 && opcode == 011 && size == x0. 


ST3 { <Vt>.H, <Vt2>.H, <Vt3>.H }[<index>], [<Xn|SP>], <Xm> 


32-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 101 && size == 00. 


ST3 { <Vt>.S, <Vt2>.S, <Vt3>.S }[<index>], [<Xn|SP>], #12 


32-bit, register offset variant 
Applies when Rm != 11111 && opcode == 101 && size == 00. 


ST3 { <Vt>.S, <Vt2>.S, <Vt3>.S }[<index>], [<Xn|SP>], <Xm> 


64-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 101 && S == 0 && size == 01. 


ST3 { <Vt>.D, <Vt2>.D, <Vt3>.D }[<index>], [<Xn|SP>], #24 


64-bit, register offset variant 
Applies when Rm != 11111 && opcode == 101 && S == 0 && size == 01. 


ST3 { <Vt>.D, <Vt2>.D, <Vt3>.D }[<index>], [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Vt3> Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
<index> For the 8-bit variant: is the element index, encoded in "Q:S:size". 


For the 16-bit variant: is the element index, encoded in "Q:S:size<1>". 
For the 32-bit variant: is the element index, encoded in "Q:S". 


For the 64-bit variant: is the element index, encoded in "Q". 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 
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Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<@>:R) + 1; 
boolean replicate = FALSE; 

integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[Q-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 
Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[t] = rval; 
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else // memop == MemOp_STORE 

// extract from one lane of 128-bit register 

Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.319 


C7-2102 


ST4 (multiple structures) 


Store multiple 4-element structures from four registers. This instruction stores multiple 4-element structures to 
memory from four SIMD&FP registers, with interleaving. Every element of each register is stored. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 a 10 9 = 5 4| 0| 
fojajo o 1 1 oo ofofo ooo 0 ojo 00 ofsve} Rn {| Rt __| 


opcode 


No offset variant 


ST4 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>] 


Decode for this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean whack = FALSE; 

boolean tag_checked = whack || n != 31; 


Post-index 
|31 30 29 sil 26 25 24|23 22 21 20| 16|15 ia) 109 | 5 4| o] 
lojajoo 1100 ‘Jo}o] Rm fo o 0 o[sze[ Rn [| R | 


opcode 


Immediate offset variant 
Applies when Rm == 11111. 


ST4 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <imm> 


Register offset variant 
Applies when Rm != 11111. 


ST4 { <Vt>.<T>, <Vt2>.<T>, <Vt3>.<T>, <Vt4>.<T> }, [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 
boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 

Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
Is the name of the fourth SIMD&FP register to be transferred, encoded as "Rt" plus 3 modulo 32. 
Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


Is the post-index immediate offset, encoded in the "Q" field. It can have the following values: 
#32 when Q = 0 
#64 when Q = 1 


Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 


Shared decode for all encodings 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 


integer esize 


= 8 << UInt(size); 


integer elements = datasize DIV esize; 


integer rpt; 


// number of iterations 


integer selem; // structure elements 


case opcode of 


when '0000' rpt = 1; selem = 4; // LD/ST4 (4 registers) 
when '0010' rpt = 4; selem = 1; // LD/ST1 (4 registers) 
when '0100' rpt = 1; selem = 3; // LD/ST3 (3 registers) 
when 'Q110' rpt = 3; selem = 1; // LD/ST1 (3 registers) 
when 'Q111' rpt = 1; selem = 1; // LD/ST1 (1 register) 
when '1000' rpt = 1; selem = 2; // LD/ST2 (2 registers) 
when '1010' rpt = 2; selem = 1; // LD/ST1 (2 registers) 
otherwise UNDEFINED; 


// .1D format only permitted with LD1 & ST1 
if size:Q == '110' && selem != 1 then UNDEFINED; 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 
bits(64) offs; 
bits(datasize) rval; 


integer tt; 


constant integer ebytes = esize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment() ; 
address = SP[]; 


else 
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address = X[n]; 


offs = Zeros(); 
for r = Q to rpt-1 
for e = 0 to elements-1 
tt = (t + r) MOD 32; 
for s = @ to selem-1 
rval = V[tt]; 
if memop == MemOp_LOAD then 
Elem[rval, e, esize] = Mem[address+offs, ebytes, AccType_VEC]; 
V[tt] = rval; 
else // memop == MemOp_STORE 
Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, e, esize]; 
offs = offs + ebytes; 
tt = (tt + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.320 ST4 (single structure) 
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Store single 4-element structure from one lane of four registers. This instruction stores a 4-element structure to 
memory from corresponding elements of four SIMD&FP registers. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


No offset 
|31 aa 20|19 18 17 1416|15 1312/11109 | 5 4| 0 | 
fojajoo 1101 aele o 0 0 ojx x 1[s]sze]| Rn | R | 


opcode 


8-bit variant 
Applies when opcode == 001. 


ST4 { <Vt>.B, <Vt2>.B, <Vt3>.B, <Vt4>.B }[<index>], [<Xn|SP>] 


16-bit variant 
Applies when opcode == 011 && size == x0. 


ST4 { <Vt>.H, <Vt2>.H, <Vt3>.H, <Vt4>.H }[<index>], [<Xn|SP>] 


32-bit variant 
Applies when opcode == 101 && size == 00. 


ST4 { <Vt>.S, <Vt2>.S, <Vt3>.S, <Vt4>.S }[<index>], [<Xn|SP>] 


64-bit variant 
Applies when opcode == 101 && S == 0 && size == 01. 


ST4 { <Vt>.D, <Vt2>.D, <Vt3>.D, <Vt4>.D }[<index>], [<Xn|SP>] 


Decode for all variants of this encoding 


integer t = UInt(Rt); 

integer n = UInt(Rn); 

integer m = integer UNKNOWN; 

boolean wback = FALSE; 

boolean tag_checked = wback || n != 31; 


Post-index 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312|1110 9 | 54| 0| 
ojajo oF Fo tops] Rm |x x i]S|sze] Ro | Rt 


opcode 


8-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 001. 


ST4 { <Vt>.B, <Vt2>.B, <Vt3>.B, <Vt4>.B }[<index>], [<Xn|SP>], #4 


8-bit, register offset variant 


Applies when Rm != 11111 && opcode == 001. 
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C7-2106 


ST4 { <Vt>.B, <Vt2>.B, <Vt3>.B, <Vt4>. 


16-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 


ST4 { <Vt>.H, <Vt2>.H, <Vt3>.H, <Vt4> 


16-bit, register offset variant 
Applies when Rm != 11111 && opcode == 


ST4 { <Vt>.H, <Vt2>.H, <Vt3>.H, <Vt4> 


32-bit, immediate offset variant 


Applies when Rm == 11111 && opcode == 


ST4 { <Vt>.S, <Vt2>.S, <Vt3>.S, <Vt4>. 


32-bit, register offset variant 


Applies when Rm != 11111 && opcode == 


ST4 { <Vt>.S, <Vt2>.S, <Vt3>.S, <Vt4>. 


64-bit, immediate offset variant 
Applies when Rm == 11111 && opcode == 


ST4 { <Vt>.D, <Vt2>.D, <Vt3>.D, <Vt4> 


64-bit, register offset variant 


Applies when Rm != 11111 && opcode == 


ST4 { <Vt>.D, <Vt2>.D, <Vt3>.D, <Vt4>. 


B }[<index>], [<Xn|SP>], <Xm> 


011 && size == xQ. 


.H }[<index>], [<Xn|SP>], #8 


011 && size == xQ. 


.H }[<index>], [<Xn|SP>], <Xm> 


101 && size == 00. 


S }[<index>], [<Xn|SP>], #16 


101 && size == 00. 


S }[<index>], [<Xn|SP>], <Xm> 


101 && S == @ && size == 01. 


.D }[<index>], [<Xn|SP>], #32 


101 && S == @ && size == 01. 


D }[<index>], [<Xn|SP>], <Xm> 


Decode for all variants of this encoding 


integer t = UInt(Rt); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
boolean whack = TRUE; 


boolean tag_checked = whack || n != 31; 


Assembler symbols 


<Vt> Is the name of the first or only SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Vt2> Is the name of the second SIMD&FP register to be transferred, encoded as "Rt" plus 1 modulo 32. 
<Vt3> Is the name of the third SIMD&FP register to be transferred, encoded as "Rt" plus 2 modulo 32. 
<Vt4> Is the name of the fourth SIMD&FP register to be transferred, encoded as "Rt" plus 3 modulo 32. 
<index> For the 8-bit variant: is the element index, encoded in "Q:S:size". 


For the 16-bit variant: is the element index, encoded in "Q:S:size<1>". 


For the 32-bit variant: is the element index, encoded in "Q:S". 


For the 64-bit variant: is the element index, encoded in "Q". 


<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<Xm> Is the 64-bit name of the general-purpose post-index register, excluding XZR, encoded in the "Rm" 
field. 
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Shared decode for all encodings 


integer scale = UInt(opcode<2:1>); 
integer selem = UInt(opcode<@>:R) + 1; 
boolean replicate = FALSE; 

integer index; 


case scale of 
when 3 
// load and replicate 
if L == '@' || S == '1' then UNDEFINED; 
scale = UInt(size); 
replicate = TRUE; 
when Q 
index = UInt(Q:S:size); // B[O-15] 
when 1 
if size<@> == '1' then UNDEFINED; 
index = UInt(Q:S:size<1>); // H[Q-7] 


when 2 
if size<l> == '1' then UNDEFINED; 
if size<@> == 'Q' then 
index = UInt(Q:S); // S[@-3] 
else 


if S == '1' then UNDEFINED; 
index = UInt(Q); // D[@-1] 
scale = 3; 


MemOp memop = if L == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = if Q == '1' then 128 else 64; 
integer esize = 8 << scale; 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(64) offs; 

bits(128) rval; 

bits(esize) element; 

constant integer ebytes = esize DIV 8; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


offs = Zeros(); 
if replicate then 
// load and replicate to all elements 
for s = 0 to selem-1 
element = Mem[addresstoffs, ebytes, AccType_VEC]; 
// replicate to fill 128- or 64-bit register 
V[t] = Replicate(element, datasize DIV esize); 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 
else 
// load/store one element per register 
for s = 0 to selem-1 
rval = V[t]; 
if memop == MemOp_LOAD then 
// insert into one lane of 128-bit register 


Elem[rval, index, esize] = Mem[address+offs, ebytes, AccType_VEC]; 


V[t] = rval; 
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else // memop == MemOp_STORE 

// extract from one lane of 128-bit register 

Mem[address+offs, ebytes, AccType_VEC] = Elem[rval, index, esize]; 
offs = offs + ebytes; 
t= (t + 1) MOD 32; 


if whack then 
if m != 31 then 
offs = X[m]; 
if n == 31 then 
SP[] = address + offs; 
else 
X[n] = address + offs; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.321 STNP (SIMD&FP) 


Store Pair of SIMD&FP registers, with Non-temporal hint. This instruction stores a pair of SIMD&FP registers to 
memory, issuing a hint to the memory system that the access is non-temporal. The address used for the store is 
calculated from an address from a base register value and an immediate offset. For information about non-temporal 
pair instructions, see Load/Store SIMD and Floating-point Non-temporal pair on page C3-206. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 2221 | |1514 | 109 | 5 4| 0 | 


o| 0 io oojo] mm | Ra | Rn | Rt 
L 


32-bit variant 

Applies when opc == 00. 

STNP <St1>, <St2>, [<Xn|SP>{, #<imm>}] 
64-bit variant 

Applies when opc == 01. 

STNP <Dt1>, <Dt2>, [<Xn|SP>{, #<imm>}] 
128-bit variant 

Applies when opc == 10. 

STNP <Qtl>, <Qt2>, [<Xn|SP>{, #<imm>}] 
Decode for all variants of this encoding 


// Empty. 


Assembler symbols 








<Dt1> Is the 64-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Dt2> Is the 64-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
<Qtl> Is the 128-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Qt2> Is the 128-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
<St1> Is the 32-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 
<St2> Is the 32-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<imm> For the 32-bit variant: is the optional signed immediate byte offset, a multiple of 4 in the range -256 


to 252, defaulting to 0 and encoded in the "imm7" field as <imm>/4. 


For the 64-bit variant: is the optional signed immediate byte offset, a multiple of 8 in the range -512 
to 504, defaulting to 0 and encoded in the "imm7" field as <imm>/8. 


For the 128-bit variant: is the optional signed immediate byte offset, a multiple of 16 in the range 
-1024 to 1008, defaulting to 0 and encoded in the "imm7" field as <imm>/16. 
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Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer t2 = UInt(Rt2); 

if opc == '11' then UNDEFINED; 

integer scale = 2 + UInt(opc); 

integer datasize = 8 << scale; 

bits(64) offset = LSL(SignExtend(imm7, 64), scale); 
boolean tag_checked = n != 31; 


Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(datasize) datal; 

bits(datasize) data2; 

constant integer dbytes = datasize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 

datal = V[t]; 

data2 = V[t2]; 

Mem[address, dbytes, AccType_VECSTREAM] = datal; 
Mem[address+dbytes, dbytes, AccType_VECSTREAM] = data2; 
Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.322 STP (SIMD&FP) 


Store Pair of SIMD&FP registers. This instruction stores a pair of SIMD&FP registers to memory. The address used 
for the store is calculated from a base register value and an immediate offset. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Post-index 


|31 30 29 28/27 26 25 24|23 2221 | |1514 | 109 | 5 4| o| 


fopc]1 0 1fifo o ijo] imm | R2? | R | R | 
L 


32-bit variant 

Applies when opc == 00. 

STP <St1l>, <St2>, [<Xn|SP>], #<imm> 

64-bit variant 

Applies when opc == 01. 

STP <Dt1>, <Dt2>, [<Xn|SP>], #<imm> 
128-bit variant 

Applies when opc == 10. 

STP <Qtl>, <Qt2>, [<Xn|SP>], #<imm> 
Decode for all variants of this encoding 


boolean whack = TRUE; 
boolean postindex = TRUE; 


Pre-index 


|31 30 29 28|27 26 25 24|23 2221 | |1514 | 109 | 5 4| 0| 


oe 0 on o mmr | Re | e | Rt 
L 


32-bit variant 

Applies when opc == 00. 

STP <Stl>, <St2>, [<Xn|SP>, #<imm>]! 
64-bit variant 

Applies when opc == 01. 


STP <Dtl>, <Dt2>, [<Xn|SP>, #<imm>]! 


128-bit variant 
Applies when opc == 10. 


STP <Qtl>, <Qt2>, [<Xn|SP>, #<imm>]! 
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Decode for all variants of this encoding 


boolean whack = TRUE; 
boolean postindex = FALSE; 


Signed offset 


|31 30 29 28/27 26 25 24|23 2221 | |1514 | 109 | 5 4| 0| 


fopc]1 0 1fifo 1 ojo] imz | R2? | Rm | R | 
L 


32-bit variant 


Applies when opc == 00. 


STP <St1>, <St2>, [<Xn|SP>{, #<imm>}] 


64-bit variant 


Applies when opc == 01. 


STP <Dtl>, <Dt2>, [<Xn|SP>{, #<imm>}] 


128-bit variant 


Applies when opc == 10. 


STP <Qt1>, <Qt2>, [<Xn|SP>{, #<imm>}] 


Decode for all variants of this encoding 


boolean whack = FALSE; 
boolean postindex = FALSE; 


Assembler symbols 








C7-2112 


Is the 64-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 

Is the 64-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
Is the 128-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 

Is the 128-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
Is the 32-bit name of the first SIMD&FP register to be transferred, encoded in the "Rt" field. 

Is the 32-bit name of the second SIMD&FP register to be transferred, encoded in the "Rt2" field. 
Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


For the 32-bit post-index and 32-bit pre-index variant: is the signed immediate byte offset, a 
multiple of 4 in the range -256 to 252, encoded in the "imm7" field as <imm>/4. 


For the 32-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 4 in 
the range -256 to 252, defaulting to 0 and encoded in the "imm/7" field as <imm>/4. 


For the 64-bit post-index and 64-bit pre-index variant: is the signed immediate byte offset, a 
multiple of 8 in the range -512 to 504, encoded in the "imm7" field as <imm>/8. 


For the 64-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 8 in 
the range -512 to 504, defaulting to 0 and encoded in the "imm7" field as <imm>/8. 


For the 128-bit post-index and 128-bit pre-index variant: is the signed immediate byte offset, a 
multiple of 16 in the range -1024 to 1008, encoded in the "imm7" field as <imm>/16. 
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For the 128-bit signed offset variant: is the optional signed immediate byte offset, a multiple of 16 
in the range -1024 to 1008, defaulting to 0 and encoded in the "imm7" field as <imm>/16. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer t2 = UInt(Rt2); 

if opc == '11' then UNDEFINED; 

integer scale = 2 + UInt(opc); 

integer datasize = 8 << scale; 

bits(64) offset = LSL(SignExtend(imm7, 64), scale); 
boolean tag_checked = whack || n != 31; 


Operation for all encodings 
CheckFPAdvSIMDEnab1ed64(); 


bits(64) address; 

bits(datasize) datal; 

bits(datasize) data2; 

constant integer dbytes = datasize DIV 8; 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


if !postindex then 
address = address + offset; 


datal = V[t]; 

data2 = V[t2]; 

Mem[address, dbytes, AccType_VEC] = datal; 
Mem[address+dbytes, dbytes, AccType_VEC] = data2; 


if whack then 
if postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.323 


C7-2114 


STR (immediate, SIMD&FP) 


Store SIMD&FP register (immediate offset). This instruction stores a single SIMD&FP register to memory. The 
address that is used for the store is calculated from a base register value and an immediate offset. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Post-index 


|31 30 29 28|27 26 25 24|23 22 21 20| | 12/1110 9 | 5 4| o| 


[szeļ1 1 1]1]o ojx ofo] imma fo tf R | R | 


opc 


8-bit variant 
Applies when size == 00 && opc == 00. 


STR <Bt>, [<Xn|SP>], #<simm> 


16-bit variant 
Applies when size == 01 && opc == 00. 


STR <Ht>, [<Xn|SP>], #<simm> 


32-bit variant 
Applies when size == 10 && opc == 00. 


STR <St>, [<Xn|SP>], #<simm> 


64-bit variant 
Applies when size == 11 && opc == 00. 


STR <Dt>, [<Xn|SP>], #<simm> 


128-bit variant 
Applies when size == 00 && opc == 10. 


STR <Qt>, [<Xn|SP>], #<simm> 


Decode for all variants of this encoding 


boolean whack = TRUE; 

boolean postindex = TRUE; 

integer scale = UInt(opc<1>:size); 

if scale > 4 then UNDEFINED; 

bits(64) offset = SignExtend(imm9, 64); 


Pre-index 
|31 30 29 28|27 26 25 24|23 22 21 20| | 12|1110 9 | 5 4| 0| 


szej 1 1]7]0 oojo] — mo — po) en] e 


opc 
8-bit variant 


Applies when size == 00 && opc == 00. 
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STR <Bt>, [<Xn|SP>, #<simm>]! 


16-bit variant 
Applies when size == 01 && opc == 00. 


STR <Ht>, [<Xn|SP>, #<simm>]! 


32-bit variant 
Applies when size == 10 & opc == 00. 


STR <St>, [<Xn|SP>, #<simm>]! 


64-bit variant 
Applies when size == 11 && opc == 00. 


STR <Dt>, [<Xn|SP>, #<simm>]! 


128-bit variant 
Applies when size == 00 && opc == 10. 


STR <Qt>, [<Xn|SP>, #<simm>]! 


Decode for all variants of this encoding 


boolean whack = TRUE; 

boolean postindex = FALSE; 

integer scale = UInt(opc<1>:size); 

if scale > 4 then UNDEFINED; 

bits(64) offset = SignExtend(imm9, 64); 


Unsigned offset 


|31 30 29 28|27 26 25 24/23 2221 | | | 109 | 5 4| 0 | 
opc 


8-bit variant 

Applies when size == 00 && opc == 00. 
STR <Bt>, [<Xn|SP>{, #<pimm>}] 
16-bit variant 

Applies when size == 01 && opc == 00. 
STR <Ht>, [<Xn|SP>{, #<pimm>}] 
32-bit variant 

Applies when size == 10 && opc == 00. 
STR <St>, [<Xn|SP>{, #<pimm>}] 
64-bit variant 

Applies when size == 11 && opc == 00. 


STR <Dt>, [<Xn|SP>{, #<pimm>}] 
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128-bit variant 
Applies when size == 00 && opc == 10. 


STR <Qt>, [<Xn|SP>{, #<pimm>}] 


Decode for all variants of this encoding 


boolean whack = FALSE; 

boolean postindex = FALSE; 

integer scale = UInt(opc<1>:size); 

if scale > 4 then UNDEFINED; 

bits(64) offset = LSL(ZeroExtend(imm12, 64), scale); 


Assembler symbols 


C7-2116 


<Bt> Is the 8-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<Dt> Is the 64-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<Ht> Is the 16-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<Qt> Is the 128-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<St> Is the 32-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

<Xn | SP> Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
<simm> Is the signed immediate byte offset, in the range -256 to 255, encoded in the "imm9" field. 

<pimm> For the 8-bit variant: is the optional positive immediate byte offset, in the range 0 to 4095, defaulting 


to 0 and encoded in the "imm12" field. 


For the 16-bit variant: is the optional positive immediate byte offset, a multiple of 2 in the range 0 
to 8190, defaulting to 0 and encoded in the "imm12" field as <pimm>/2. 


For the 32-bit variant: is the optional positive immediate byte offset, a multiple of 4 in the range 0 
to 16380, defaulting to 0 and encoded in the "imm12" field as <pimm>/4. 


For the 64-bit variant: is the optional positive immediate byte offset, a multiple of 8 in the range 0 
to 32760, defaulting to 0 and encoded in the "imm12" field as <pimm>/8. 


For the 128-bit variant: is the optional positive immediate byte offset, a multiple of 16 in the range 
0 to 65520, defaulting to 0 and encoded in the "Imm 12" field as <pimm>/16. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

MemOp memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = 8 << scale; 

boolean tag_checked = memop != MemOp_PREFETCH && (wback || n != 31); 


Operation for all encodings 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 
bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 
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if !postindex then 
address = address + offset; 


case memop of 
when MemOp_STORE 
data = V[t]; 
Mem[address, datasize DIV 8, AccType_VEC] = data; 


when MemOp_LOAD 
data = Mem[address, datasize DIV 8, AccType_VEC]; 
V[t] = data; 


if whack then 
if postindex then 
address = address + offset; 
if n == 31 then 
SP[] = address; 
else 
X[n] = address; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.324 


C7-2118 


STR (register, SIMD&FP) 


Store SIMD&FP register (register offset). This instruction stores a single SIMD&FP register to memory. The 
address that is used for the store is calculated from a base register value and an offset register value. The offset can 
be optionally shifted and extended. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 1312/11109 | 5 4| 0 | 


szej 1 1]7][0 oeo] Rm [oons o] Rn | Rt 


opc 


8-fsreg,STR-8-fsreg variant 
Applies when size == 00 && opc == 00 && option != 011. 


STR <Bt>, [<Xn|SP>, (<Wm>|<Xm>), <extend> {<amount>}] 


8-fsreg,STR-8-fsreg variant 
Applies when size == 00 && opc == 00 && option == 011. 


STR <Bt>, [<Xn|SP>, <Xm>{, LSL <amount>}] 


16-fsreg,STR-16-fsreg variant 
Applies when size == 01 && opc == 00. 


STR <Ht>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


32-fsreg,STR-32-fsreg variant 
Applies when size == 10 && opc == 00. 


STR <St>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


64-fsreg,STR-64-fsreg variant 
Applies when size == 11 & opc == 00. 


STR <Dt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


128-fsreg,STR-128-fsreg variant 
Applies when size == 00 && opc == 10. 


STR <Qt>, [<Xn|SP>, (<Wm>|<Xm>){, <extend> {<amount>}}] 


Decode for all variants of this encoding 


integer scale = UInt(opc<1>:size); 

if scale > 4 then UNDEFINED; 

if option<1> == '@' then UNDEFINED; // sub-word index 
ExtendType extend_type = DecodeRegExtend(option) ; 
integer shift = if S == '1' then scale else 0; 


Assembler symbols 


<Bt> Is the 8-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
<Dt> Is the 64-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


<Ht> 
<Qt> 
<St> 
<Xn | SP> 


<Wm> 


<Xm> 


<extend> 


<amount> 
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Is the 16-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

Is the 128-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

Is the 32-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 

Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 


When option<Q> is set to 0, is the 32-bit name of the general-purpose index register, encoded in the 
"Rm" field. 


When option<0> is set to 1, is the 64-bit name of the general-purpose index register, encoded in the 
"Rm" field. 


For the 8-bit variant: is the index extend specifier, encoded in the "option" field. It can have the 
following values: 


UXTW when option = 010 
SXTW when option = 110 
SXTX when option = 111 


For the 128-bit, 16-bit, 32-bit and 64-bit variant: is the index extend/shift specifier, defaulting to 
LSL, and which must be omitted for the LSL option when <amount> is omitted. encoded in the 
"option" field. It can have the following values: 


UXTW when option = 010 
LSL when option = 011 
SXTW when option = 110 
SXTX when option = 111 


For the 8-bit variant: is the index shift amount, it must be #0, encoded in "S" as 0 if omitted, or as 1 
if present. 


For the 16-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 
is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 


#0 when S = 0 
#1 when § = 1 


For the 32-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 
is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 

#0 when S = 0 

#2 when $ = 1 


For the 64-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where it 
is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 


#0 when S = 0 
#3 when § = 1 


For the 128-bit variant: is the index shift amount, optional only when <extend> is not LSL. Where 
it is permitted to be optional, it defaults to #0. It is encoded in the "S" field. It can have the following 
values: 


#0 when S = 0 
#4 when S = 1 
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Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

integer m = UInt(Rm); 

MemOp memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = 8 << scale; 

boolean tag_checked = memop != MemOp_PREFETCH; 


Operation 


bits(64) offset = ExtendReg(m, extend_type, shift); 
if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 
bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 
case memop of 
when MemOp_STORE 
data = V[t]; 
Mem[address, datasize DIV 8, AccType_VEC] = data; 
when MemOp_LOAD 
data = Mem[address, datasize DIV 8, AccType_VEC]; 
V[t] = data; 
Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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Store SIMD&FP register (unscaled offset). This instruction stores a single SIMD&FP register to memory. The 
address that is used for the store is calculated from a base register value and an optional immediate offset. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20| | 


12/1110 9 | 5 4| o| 


[szeļ1 1 1J]1]o ojx ofo] imma fo of R | R | 


8-bit variant 


Applies when size == 


STUR <Bt>, [<Xn|SP>{, 


16-bit variant 


Applies when size == 


STUR <Ht>, [<Xn|SP>{, 


32-bit variant 


Applies when size == 


STUR <St>, [<Xn|SP>{, 


64-bit variant 


Applies when size == 


STUR <Dt>, [<Xn|SP>{, 


128-bit variant 


Applies when size == 


STUR <Qt>, [<Xn|SP>{, 


opc 


00 && opc == 


#<simm>}] 


01 && opc == 


#<simm>}] 


10 && opc == 


#<simm>}] 


11 && opc == 


#<simm>}] 


00 && opc == 


#<simm>}] 


00. 


00. 


00. 


00. 


10. 


Decode for all variants of this encoding 


integer scale = 


if scale > 4 then UNDEFINED; 
bits(64) offset = SignExtend(imm9, 64); 


Assembler symbols 


<Bt> 
<Dt> 
<Ht> 
<Qt> 
<St> 


<Xn | SP> 
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UInt(opc<1>:size); 


Is the 8-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
Is the 64-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
Is the 16-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
Is the 128-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 
Is the 32-bit name of the SIMD&FP register to be transferred, encoded in the "Rt" field. 


Is the 64-bit name of the general-purpose base register or stack pointer, encoded in the "Rn" field. 
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<simm> Is the optional signed immediate byte offset, in the range -256 to 255, defaulting to 0 and encoded 
in the "imm9" field. 


Shared decode for all encodings 


integer n = UInt(Rn); 

integer t = UInt(Rt); 

MemOp memop = if opc<@> == '1' then MemOp_LOAD else MemOp_STORE; 
integer datasize = 8 << scale; 

boolean tag_checked = memop != MemOp_PREFETCH && (n != 31); 


Operation 


if HaveMTEExt() then 
SetNotTagCheckedInstruction(!tag_checked) ; 


CheckFPAdvSIMDEnab1ed64(); 
bits(64) address; 
bits(datasize) data; 


if n == 31 then 
CheckSPAlignment(); 
address = SP[]; 
else 
address = X[n]; 


address = address + offset; 


case memop of 
when MemOp_STORE 
data = V[t]; 
Mem[address, datasize DIV 8, AccType_VEC] = data; 


when MemOp_LOAD 
data = Mem[address, datasize DIV 8, AccType_VEC]; 
V[t] = data; 


Operational information 


If PSTATE.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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C7.2.326 SUB (vector) 
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Subtract (vector). This instruction subtracts each vector element in the second source SIMD&FP register from the 
corresponding vector element in the first source SIMD&FP register, places the result into a vector, and writes the 


vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fo aif 177 ose] am [1 0000/] Rn | Rd 
U 


Scalar variant 


SUB <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size != '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 

boolean sub_op = (U == '1'); 


Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 121110 9. | 54| 0| 


enbiron] am [Fo 0 0 oi] m TR 


Vector variant 


SUB <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean sub_op = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 
The following encodings are reserved: 
° size = 0x. 


. size = 10. 
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C7-2124 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 


2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


= 00,0 = 0 
= 00,Q=1 
= 01,Q0=0 
=01,Q=1 
= 10,Q=0 
= 10,Q=1 
1,007 


The encoding size = 11, Q = 0 is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 
bits(esize) element1; 
bits(esize) element2; 


for e = 0 to elements-1 


V[d] 


elementl = Elem[operand1, e, esize]; 
element2 = Elem[operand2, e, esize]; 


if sub_op then 


Elem[result, e, esize] = elementl - element2; 


else 


Elem[result, e, esize] = elementl + element2; 


= result; 


Operational information 


If PSTATE.DIT is 1: 


The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.327 SUBHN, SUBHN2 


Subtract returning High Narrow. This instruction subtracts each vector element in the second source SIMD&FP 
register from the corresponding vector element in the first source SIMD&FP register, places the most significant 
half of the result into a vector, and writes the vector to the lower or upper half of the destination SIMD&FP register. 
All the values in this instruction are signed integer values. 


The results are truncated. For rounded results, see RSUBHN, RSUBHN2. 


The SUBHN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the SUBHN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


olal 7741 olse] Rm [oojoo An | Rd | 
U 01 


Three registers, not all the same type variant 


SUBHN{2} <Vd>.<Tb>, <Vn>.<Ta>, <Vm>.<Ta> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


boolean sub_op = (01 == '1'); 
boolean round = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
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The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(2sdatasize) operandl = V[n]; 

bits(2sdatasize) operand2 = V[m]; 

bits(datasize) result; 

integer round_const = if round then 1 << (esize - 1) else Q; 
bits(2xesize) element1; 

bits(2xesize) element2; 

bits(2sesize) sum; 


for e = 0 to elements-1 
elementl = Elem[operand1, e, 2xesize]; 
element2 = Elem[operand2, e, 2xesize]; 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
sum = sum + round_const; 
Elem[result, e, esize] = sum<2«esize-l:esize>; 


Vpart[d, part] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.328 SUQADD 
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Signed saturating Accumulate of Unsigned value. This instruction adds the unsigned integer values of the vector 
elements in the source SIMD&FP register to corresponding signed integer values of the vector elements in the 
destination SIMD&FP register, and writes the resulting signed integer values to the destination SIMD&FP register. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 


bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oao 177 O[sze]io 00 ojo oori o] Rn | Rd 
U 


Scalar variant 


SUQADD <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


integer esize = 8 << UInt(size); 
integer datasize = esize; 


integer elements = 1; 

boolean unsigned = (U == '1'); 
Vector 

|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 14 13 12|11 10 9 | 5 4| 0| 


fofaoo +7171 O[sze]i 000 ojoo 0o11 o] Rn | Rd 
U 


Vector variant 


SUQADD <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


B when size = 00 
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C7-2128 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


H when size = 01 
5 when size = 10 
D when size = 11 


Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


bits(datasize) operand2 = V[d]; 
integer op1; 
integer op2; 
boolean sat; 


for 


v[d] 


e = 0 to elements-1 

op1 = Int(Elem[operand, e, esize], !unsigned); 

op2 = Int(Elem[operand2, e, esize], unsigned); 

(Elem[result, e, esize], sat) = SatQ(opl + op2, esize, unsigned); 
if sat then FPSR.QC = '1'; 

= result; 
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SXTL, SXTL2 


Signed extend Long. This instruction duplicates each vector element in the lower or upper half of the source 
SIMD&FP register into a vector, and writes the vector to the destination SIMD&FP register. The destination vector 
elements are twice as long as the source vector elements. All the values in this instruction are signed integer values. 


The SXTL instruction extracts the source vector from the lower half of the source register, while the SXTL2 instruction 


extracts the source vector from the upper half of the source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 
This instruction is an alias of the SSHLL, SSHLL2 instruction. This means that: 
- The encodings in this description are named to match the encodings of SSHLL, SSHLL2. 


: The description of SSHLL, SSHLL2 gives the operational pseudocode for this instruction. 


|31 30 29 28|27 26 25 24|23 22 11918 16/15141312/11109 | 5 4| 0 | 


fofajojo 14 1 1 1 0} 0000 [o o oft o 1 0 ofif Rn | Ra | 
U 


immh immb 


Vector variant 


SXTL{2} <Vd>.<Ta>, <Vn>.<Tb> 


is equivalent to 


SSHLL{2} 


<Vd>.<Ta>, <Vn>.<Tb>, #0 


and is the preferred disassembly when BitCount(immh) == 1. 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


ARM DDI 0487E.a 
ID070919 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "immh" field. It can have the following values: 
8H when immh = 0001 

4s when immh = 001x 

2D when immh = Q1xx 

See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 
Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 


16B when immh = 0001, Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = Q01x,Q = 1 
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2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = x is reserved. 


Operation 


The description of SSHLL, SSHLL2 gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


a The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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Table vector Lookup. This instruction reads each value from the vector elements in the index source SIMD&FP 
register, uses each result as an index to perform a lookup in a table of bytes that is described by one to four source 
table SIMD&FP registers, places the lookup result in a vector, and writes the vector to the destination SSIMD&FP 
register. If an index is out of range for the table, the result for that lookup is 0. If more than one source register is 
used to describe the table, the first source register describes the lowest bytes of the table. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9. | 5 4| 0| 


Jaleo ele ejej em delende ol mo do o 


Two register table variant 
Applies when len == 01. 


TBL <Vd>.<Ta>, { <Vn>.16B, <Vn+1>.16B }, <Vm>.<Ta> 


Three register table variant 
Applies when len == 10. 


TBL <Vd>.<Ta>, { <Vn>.16B, <Vn+1>.16B, <Vn+2>.16B }, <Vm>.<Ta> 


Four register table variant 
Applies when len == 11. 


TBL <Vd>.<Ta>, { <Vn>.16B, <Vn+1>.16B, <Vn+2>.16B, <Vn+3>.16B }, <Vm>.<Ta> 


Single register table variant 
Applies when len == 00. 


TBL <Vd>.<Ta>, { <Vn>.16B }, <Vm>.<Ta> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV 8; 

integer regs = UInt(len) + 1; 

boolean is_tbl = (op == '@'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vn> For the four register table, three register table and two register table variant: is the name of the first 


SIMD&FP table register, encoded in the "Rn" field. 
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C7-2132 


For the single register table variant: is the name of the SIMD&FP table register, encoded in the "Rn" 


field. 
<Vn+1> Is the name of the second SIMD&FP table register, encoded as "Rn" plus 1 modulo 32. 
<Vn+2> Is the name of the third SIMD&FP table register, encoded as "Rn" plus 2 modulo 32. 
<Vn+3> Is the name of the fourth SIMD&FP table register, encoded as "Rn" plus 3 modulo 32. 
<Vm> Is the name of the SIMD&FP index register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) indices = V[m]; 
bits(128«regs) table = Zeros(); 
bits(datasize) result; 

integer index; 


// Create table from registers 

for i = 0 to regs-1 
table<128#1+127:128«i> = V[n]; 
n = (n + 1) MOD 32; 


result = if is_tbl then Zeros() else V[d]; 
for i = 0 to elements-1 
index = UInt(Elem[indices, i, 8]); 
if index < 16 » regs then 
Elem[result, i, 8] = Elem[table, index, 8]; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Table vector lookup extension. This instruction reads each value from the vector elements in the index source 
SIMD&FP register, uses each result as an index to perform a lookup in a table of bytes that is described by one to 
four source table SIMD&FP registers, places the lookup result in a vector, and writes the vector to the destination 
SIMD&FP register. If an index is out of range for the table, the existing value in the vector element of the destination 
register is left unchanged. If more than one source register is used to describe the table, the first source register 
describes the lowest bytes of the table. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0| 


olojo o 4771 olo ojo] Rm  Jo]enjijo o] Rn | Rd 
op 


Two register table variant 
Applies when len == 01. 


TBX <Vd>.<Ta>, { <Vn>.16B, <Vn+1>.16B }, <Vm>.<Ta> 


Three register table variant 
Applies when len == 10. 


TBX <Vd>.<Ta>, { <Vn>.16B, <Vn+1>.16B, <Vn+2>.16B }, <Vm>.<Ta> 


Four register table variant 
Applies when len == 11. 


TBX <Vd>.<Ta>, { <Vn>.16B, <Vn+1>.16B, <Vn+2>.16B, <Vn+3>.16B }, <Vm>.<Ta> 


Single register table variant 
Applies when len == 00. 


TBX <Vd>.<Ta>, { <Vn>.16B }, <Vm>.<Ta> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV 8; 

integer regs = UInt(len) + 1; 

boolean is_tbl = (op == '@'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
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C7-2134 


<Vn> For the four register table, three register table and two register table variant: is the name of the first 


SIMD&FP table register, encoded in the "Rn" field. 


For the single register table variant: is the name of the SIMD&FP table register, encoded in the "Rn" 


field. 
<Vn+1> Is the name of the second SIMD&FP table register, encoded as "Rn" plus 1 modulo 32. 
<Vn+2> Is the name of the third SIMD&FP table register, encoded as "Rn" plus 2 modulo 32. 
<Vn+3> Is the name of the fourth SIMD&FP table register, encoded as "Rn" plus 3 modulo 32. 
<Vm> Is the name of the SIMD&FP index register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) indices = V[m]; 
bits(128*regs) table = Zeros(); 
bits(datasize) result; 

integer index; 


// Create table from registers 

for i = 0 to regs-1 
table<128+i+127:128+i> = V[n]; 
n = (n + 1) MOD 32; 


result = if is_tbl then Zeros() else V[d]; 
for i = 0 to elements-1 
index = UInt(Elem[indices, i, 8]); 
if index < 16 » regs then 
Elem[result, i, 8] = Elem[table, index, 8]; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 
: The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.332 TRN1 
Transpose vectors (primary). This instruction reads corresponding even-numbered vector elements from the two 
source SIMD&FP registers, starting at zero, places each result into consecutive elements of a vector, and writes the 
vector to the destination SIMD&FP register. Vector elements from the first source register are placed into 
even-numbered elements of the destination vector, starting at zero, while vector elements from the second source 
register are placed into odd-numbered elements of the destination vector. 
Note 
By using this instruction with TRN2, a 2 x 2 matrix can be transposed. 
The following figure shows the operation of TRN1 and TRN2 halfword operations where Q = 0. 
TRN1.16 TRN2.16 
Vn 
3 0 
Vd 
Vm 
Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
|31 ae 20) 16|15 14 13 12|1110 9. | 5 4| 0| 
[oļfajo0 1110 selel en deed ehel eo o 
Advanced SIMD variant 
TRN1 <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 
Decode for this encoding 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 
if size:Q == '110' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 
integer part = UInt(op); 
integer pairs = elements DIV 2; 
Assembler symbols 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H 
8H 
2s 
4s 
2D 


The encoding size = 11, Q = Qis reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


when size 
when size 
when size 
when size 


when size 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


for p = Q to pairs-1 
Elem[result, 2*p+@, esize] = Elem[operand1, 2sp+part, esize]; 
Elem[result, 2xp+1, esize] = Elem[operand2, 2sp+part, esize]; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


s The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


01,0 = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
11,Q=1 


— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C7.2.333 TRN2 


Transpose vectors (secondary). This instruction reads corresponding odd-numbered vector elements from the two 
source SIMD&FP registers, places each result into consecutive elements of a vector, and writes the vector to the 
destination SIMD&FP register. Vector elements from the first source register are placed into even-numbered 
elements of the destination vector, starting at zero, while vector elements from the second source register are placed 
into odd-numbered elements of the destination vector. 


Note 


By using this instruction with TRN1, a 2 x 2 matrix can be transposed. 








The following figure shows the operation of TRN1 and TRN2 halfword operations where Q = 0. 


TRN1.16 TRN2.16 
Vn 
3 0 
Vd 
Vm 





Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 1211110 9 | 5 4| 0 | 
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Advanced SIMD variant 


TRN2 <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

integer part = UInt(op); 

integer pairs = elements DIV 2; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H 
8H 
2s 
4s 
2D 


The encoding size = 11, Q = Qis reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


when size 
when size 
when size 
when size 


when size 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


for p = Q to pairs-1 
Elem[result, 2*p+@, esize] = Elem[operand1, 2sp+part, esize]; 
Elem[result, 2xp+1, esize] = Elem[operand2, 2sp+part, esize]; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


s The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


01,0 = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
11,Q=1 


— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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Unsigned Absolute difference and Accumulate. This instruction subtracts the elements of the vector of the second 
source SIMD&FP register from the corresponding elements of the first source SIMD&FP register, and accumulates 
the absolute values of the results into the elements of the vector of the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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Three registers of the same type variant 


UABA <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 
boolean 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U == '1'); 
accumulate = (ac == '1'); 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size 
when size 
when size 
when size 
when size 


when size 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


integer element1; 
integer element2; 
bits(esize) absdiff; 
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result = if accumulate then V[d] else Zeros(); 
for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
absdiff = Abs(elementl-element2)<esize-1:0>; 
Elem[result, e, esize] = Elem[result, e, esize] + absdiff; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


C7-2140 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.335 UABAL, UABAL2 


Unsigned Absolute difference and Accumulate Long. This instruction subtracts the vector elements in the lower or 
upper half of the second source SIMD&FP register from the corresponding vector elements of the first source 
SIMD&FP register, and accumulates the absolute values of the results into the vector elements of the destination 
SIMD&FP register. The destination vector elements are twice as long as the source vector elements. All the values 
in this instruction are unsigned integer values. 


The UABAL instruction extracts each source vector from the lower half of each source register, while the UABAL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0| 
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Three registers, not all the same type variant 


UABAL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d 
n 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 

esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 

elements = datasize DIV esize; 


accumulate = (op == 'Q'); 
unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


ARM DDI 0487E.a 
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Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
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C7-2142 


16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q=1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2xesize) absdiff; 


result = if accumulate then V[d] else Zeros(); 
for e = 0 to elements-1 

element1 = Int(Elem[operand1, e, esize], unsigned); 

element2 = Int(Elem[operand2, e, esize], unsigned); 

absdiff = Abs(elementl-element2)<2sesize-1:0>; 

Elem[result, e, 2xesize] = Elem[result, e, 2esize] + absdiff; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unsigned Absolute Difference (vector). This instruction subtracts the elements of the vector of the second source 
SIMD&FP register from the corresponding elements of the first source SIMD&FP register, places the absolute 
values of the results into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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Three registers of the same type variant 


UABD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 
boolean 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U == '1'); 
accumulate = (ac == '1'); 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size 
when size 
when size 
when size 
when size 


when size 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


integer element1; 
integer element2; 
bits(esize) absdiff; 
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result = if accumulate then V[d] else Zeros(); 
for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
absdiff = Abs(elementl-element2)<esize-1:0>; 
Elem[result, e, esize] = Elem[result, e, esize] + absdiff; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.337  UABDL, UABDL2 


Unsigned Absolute Difference Long. This instruction subtracts the vector elements in the lower or upper half of the 
second source SIMD&FP register from the corresponding vector elements of the first source SIMD&FP register, 
places the absolute value of the result into a vector, and writes the vector to the destination SIMD&FP register. The 
destination vector elements are twice as long as the source vector elements. All the values in this instruction are 
unsigned integer values. 


The UABDL instruction extracts each source vector from the lower half of each source register, while the UABDL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9 | 5 4| 0| 
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Three registers, not all the same type variant 


UABDL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d 
n 
m 


UInt(Rd) ; 
UInt(Rn) ; 
UInt (Rm) ; 


== '11' then UNDEFINED; 

esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 

elements = datasize DIV esize; 


accumulate = (op == 'Q'); 
unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


ARM DDI 0487E.a 
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Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
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C7-2146 


16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q=1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2xesize) absdiff; 


result = if accumulate then V[d] else Zeros(); 
for e = 0 to elements-1 

element1 = Int(Elem[operand1, e, esize], unsigned); 

element2 = Int(Elem[operand2, e, esize], unsigned); 

absdiff = Abs(elementl-element2)<2sesize-1:0>; 

Elem[result, e, 2xesize] = Elem[result, e, 2esize] + absdiff; 
V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unsigned Add and Accumulate Long Pairwise. This instruction adds pairs of adjacent unsigned integer values from 
the vector in the source SIMD&FP register and accumulates the results with the vector elements of the destination 
SIMD&FP register. The destination vector elements are twice as long as the source vector elements. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oleo n O[sze]i 000 ojo oio o] Rn | Rd 
U op 


Vector variant 


UADALP <Vd>.<Ta>, <Vn>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV (2 « esize); 
boolean acc = (op == '1'); 

boolean unsigned = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 00,Q = 0 
8H when size = 00,Q = 1 
2S when size = 01,Q = 0 
4S when size = 01,Q = 1 
1D when size = 10,Q = 0 
2D when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


bits(2sesize) sum; 
integer op1; 
integer op2; 


result = if acc then V[d] else Zeros(); 
for e = 0 to elements-1 
op1 = Int(Elem[operand, 2xe+0, esize], unsigned); 
op2 = Int(Elem[operand, 2xe+1, esize], unsigned); 
sum = (opl+op2)<2«esize-1:0>; 
Elem[result, e, 2xesize] = Elem[result, e, 2esize] + sum; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unsigned Add Long (vector). This instruction adds each vector element in the lower or upper half of the first source 
SIMD&FP register to the corresponding vector element of the second source SIMD&FP register, places the result 
into a vector, and writes the vector to the destination SIMD&FP register. The destination vector elements are twice 
as long as the source vector elements. All the values in this instruction are unsigned integer values. 


The UADDL instruction extracts each source vector from the lower half of each source register, while the UADDL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9. | 5 4| 0| 


lati jo 4 4 4 ofsze |i] Rm | ofojojo of Rn | Rd __| 


Three registers, not all the same type variant 


UADDL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rm); 

== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 


elements = datasize DIV esize; 


sub_op = 
unsigned 


(o1 == '1'); 
= (U = '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


ARM DDI 0487E.a 
ID070919 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

integer sum; 


for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
Elem[result, e, 2xesize] = sum<2xesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unsigned Add Long Pairwise. This instruction adds pairs of adjacent unsigned integer values from the vector in the 
source SIMD&FP register, places the result into a vector, and writes the vector to the destination SIMD&FP register. 
The destination vector elements are twice as long as the source vector elements. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oloo n O[sze]7 000 ojo ojojoj o] Rn | Rd 
U op 


Vector variant 


UADDLP <Vd>.<Ta>, <Vn>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV (2 « esize); 
boolean acc = (op = '1'); 

boolean unsigned = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 00,Q = 0 
8H when size = 00,Q = 1 
2S when size = 01,Q = 0 
4S when size = 01,Q = 1 
1D when size = 10,Q = 0 
2D when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


bits(2sesize) sum; 
integer op1; 
integer op2; 


result = if acc then V[d] else Zeros(); 
for e = 0 to elements-1 
op1 = Int(Elem[operand, 2xe+0, esize], unsigned); 
op2 = Int(Elem[operand, 2xe+1, esize], unsigned); 
sum = (opl+op2)<2«esize-1:0>; 
Elem[result, e, 2xesize] = Elem[result, e, 2esize] + sum; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.341 UADDLV 


Unsigned sum Long across Vector. This instruction adds every vector element in the source SIMD&FP register 
together, and writes the scalar result to the destination SIMD&FP register. The destination scalar is twice as long as 
the source vector elements. All the values in this instruction are unsigned integer values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oleo n O[sze]i too ojo oorr o] Rn | Rd 
U 


Advanced SIMD variant 


UADDLV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size:Q == '10@' then UNDEFINED; 

if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 


Assembler symbols 


<V> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
H when size = 00 
S when size = 01 
D when size = 10 


The encoding size = 11 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 10, Q = 0. 


° size = 11,Q = x. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
integer sum; 


sum = Int(Elem[operand, 0, esize], unsigned); 
for e = 1 to elements-1 
sum = sum + Int(Elem[operand, e, esize], unsigned); 


V[d] = sum<2xesize-1:0>; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.342 UADDW, UADDW2 


ARM DDI 0487E.a 
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Unsigned Add Wide. This instruction adds the vector elements of the first source SIMD&FP register to the 
corresponding vector elements in the lower or upper half of the second source SIMD&FP register, places the result 
in a vector, and writes the vector to the SIMD&FP destination register. The vector elements of the destination 
register and the first source register are twice as long as the vector elements of the second source register. All the 
values in this instruction are unsigned integer values. 


The UADDW instruction extracts vector elements from the lower half of the second source register, while the UADDW2 
instruction extracts vector elements from the upper half of the second source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9 | 5 4| 0| 


oleon i olse] Rm [oohoo] An | Rd | 
U 01 


Three registers, not all the same type variant 


UADDW{2} <Vd>.<Ta>, <Vn>.<Ta>, <Vm>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


boolean sub_op = (01 == '1'); 
boolean unsigned = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
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<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(2sdatasize) operand1 = V[n]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

integer sum; 


for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, 2*esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
Elem[result, e, 2xesize] = sum<2xesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.343  UCVTF (vector, fixed-point) 


Unsigned fixed-point Convert to Floating-point (vector). This instruction converts each element in a vector from 
fixed-point to floating-point using the rounding mode that is specified by the FPCR, and writes the result to the 
SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 1918 16|15141312/1110 9 | 5 4| 0 | 


COOK K ttt E [inne [14 oi] an TR 


immh 


Scalar variant 


UCVTF <V><d>, <V><n>, #<fbits> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd) ; 
UInt(Rn) ; 


if immh == '000x' || (immh == 'QQ1x' && !HaveFP16Ext()) then UNDEFINED; 

integer esize = if immh == '1xxx' then 64 else if immh == 'Q1xx' then 32 else 16; 
integer datasize = esize; 

integer elements = 1; 


integer fracbits = (esize » 2) - UInt(immh:immb); 


boolean unsigned = (U == '1'); 
FPRounding rounding = FPRoundingMode(FPCR) ; 


Vector 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/1110 9 | 5 4| 0 | 


foJafifo +4 4 + of 0000 [immb [17 Fo ofa] en TR 


immh 


Vector variant 


UCVTF <Vd>.<T>, <Vn>.<T>, #<fbits> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 

if immh == '000x' || (immh == 'QQ1x' && !HaveFP16Ext()) then UNDEFINED; 

if immh<3>:Q == '10' then UNDEFINED; 

integer esize = if immh == '1xxx' then 64 else if immh == 'Q1xx' then 32 else 16; 
integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 
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C7-2158 


integer fracbits = (esize » 2) - UInt(immh:immb) ; 
boolean unsigned = (U == '1'); 
FPRounding rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<fbits> 


Is a width specifier, encoded in the "immh" field. It can have the following values: 
H when immh = 001x 


S when immh = 01xx 


D when immh = 1xxx 


The encoding immh = 000x is reserved. 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Immh:Q" field. It can have the following values: 


4H when immh = 001x, Q = 0 


8H when immh = Q01x,Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 
2D when immh = 1xxx,Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The following encodings are reserved: 

° immh = 0001, Q = x. 

. immh = 1xxx, Q = 0. 

Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

For the scalar variant: is the number of fractional bits, in the range 1 to the operand width, encoded 
in the "immh:immb" field. It can have the following values: 

(32-Uint(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = 01xx 

(128-UInt(immh:immb)) when immh = 1xxx 

The encoding immh = 000x is reserved. 


For the vector variant: is the number of fractional bits, in the range | to the element width, encoded 
in the "immh:immb" field. It can have the following values: 


(32-Uint(immh:immb)) when immh = 001x 


(64-UInt(immh:immb)) when immh = 01xx 
(128-UInt(immh:immb)) when immh = 1xxx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 0001 is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(esize) element; 


for e = 0 to elements-1 
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element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FixedToFP(element, fracbits, unsigned, FPCR, rounding); 


V[d] = result; 
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C7.2.344 UCVTF (vector, integer) 


Unsigned integer Convert to Floating-point (vector). This instruction converts each element in a vector from an 
unsigned integer value to a floating-point value using the rounding mode that is specified by the FPCR, and writes 
the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 
Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


Scalar half precision 


ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


COOK E Tat oor tr Toole tao ip of ae TR 


Scalar half precision variant 


UCVTF <Hd>, <Hn> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer d 
integer n 


UInt(Rd) ; 
UInt(Rn) ; 


integer esize = 16; 

integer datasize = esize; 
integer elements = 1; 

boolean unsigned = (U == '1'); 


Scalar single-precision and double-precision 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9. | 5 4| 0 | 


COOK K Tit CO E ooo oe tro if of a TR 


Scalar single-precision and double-precision variant 


UCVTF <V><d>, <V><n> 


Decode for this encoding 


integer d 
integer n 


UInt(Rd) ; 
UInt(Rn) ; 


integer esize = 32 << UInt(sz); 
integer datasize = esize; 
integer elements = 1; 

boolean unsigned = (U == '1'); 


Vector half precision 


ARMVv8.2 
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|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 
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Vector half precision variant 


UCVTF <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


if !HaveFP16Ext() then UNDEFINED; 


integer 
integer 


integer 
integer 
integer 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 


esize = 16; 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 

unsigned = (U == '1'); 


Vector single-precision and double-precision 


|31 30 29 28|27 26 25 24/23 22 21 20/19 1817 16/15 14 13 12|11 10 9. | 5 4| 0 | 


oleo +771 olo 000 0i11707)10] Rn | Rd 
U 


Vector single-precision and double-precision variant 


UCVTF <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer 
integer 


if sz:Q 
integer 
integer 
integer 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 


== '10' then UNDEFINED; 

esize = 32 << UInt(sz); 

datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 

unsigned = (U == '1'); 


Assembler symbols 


<Hd> 


<Hn> 


<V> 


<d> 


<n> 


<Vd> 


<T> 


Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the 16-bit name of the SIMD&FP source register, encoded in the "Rn" field. 


Is a width specifier, encoded in the "sz" field. It can have the following values: 
S when sz = 0 


D when sz = 1 

Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the SIMD&FP source register, encoded in the "Rn" field. 

Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


For the vector half precision variant: is an arrangement specifier, encoded in the "Q" field. It can 
have the following values: 


4H when Q = 0 
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8H when Q = 1 


For the vector single-precision and double-precision variant: is an arrangement specifier, encoded 
in the "sz:Q" field. It can have the following values: 


2S when sz = 0,Q = 0 
4s when sz = 0,Q=1 
2D when sz = 1,Q = 1 


The encoding sz = 1,Q = Q is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
FPRounding rounding = FPRoundingMode(FPCR) ; 
bits(esize) element; 
for e = 0 to elements-1 
element = Elem[operand, e, esize]; 
Elem[result, e, esize] = FixedToFP(element, @, unsigned, FPCR, rounding); 


V[d] = result; 
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C7.2.345 UCVTF (scalar, fixed-point) 


ARM DDI 0487E.a 
ID070919 


Unsigned fixed-point Convert to Floating-point (scalar). This instruction converts the unsigned value in the 32-bit 
or 64-bit general-purpose source register to a floating-point value using the rounding mode that is specified by the 


FPCR, and writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the Security state and 
Exception level in which the instruction is executed, an attempt to execute the instruction might be trapped. 


|31 30 29 28/27 26 25 24/23 22 2120/1918  16|15 | 109 


FCC eG 


rmode opcode 


32-bit to half-precision variant 
Applies when sf == 0 && ftype == 11. 


UCVTF <Hd>, <Wn>, #<fbits> 


32-bit to single-precision variant 
Applies when sf == 0 && ftype == 00. 


UCVTF <Sd>, <Wn>, #<fbits> 


32-bit to double-precision variant 
Applies when sf == 0 && ftype == 01. 


UCVTF <Dd>, <Wn>, #<fbits> 


64-bit to half-precision variant 
Applies when sf == 1 && ftype == 11. 


UCVTF <Hd>, <Xn>, #<fbits> 


64-bit to single-precision variant 
Applies when sf == 1 && ftype == 00. 


UCVTF <Sd>, <Xn>, #<fbits> 


64-bit to double-precision variant 
Applies when sf == 1 && ftype == 01. 


UCVTF <Dd>, <Xn>, #<fbits> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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C7-2164 


case ftype of 
when '00' fltsize = 32; 
when 'Q1' fltsize = 64; 
when '10' UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


if sf == '@' && scale<5> == '@' then UNDEFINED; 
integer fracbits = 64 - UInt(scale); 


rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
<fbits> For the 32-bit to double-precision, 32-bit to half-precision and 32-bit to single-precision variant: is 


the number of bits after the binary point in the fixed-point source, in the range | to 32, encoded as 


64 minus "scale". 


For the 64-bit to double-precision, 64-bit to half-precision and 64-bit to single-precision variant: is 
the number of bits after the binary point in the fixed-point source, in the range 1 to 64, encoded as 


64 minus "scale". 


Operation 
CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


intval = X[n]; 


fltval = FixedToFP(intval, fracbits, TRUE, FPCR, rounding); 


V[d] = fltval; 
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C7.2.346 UCVTF (scalar, integer) 


ARM DDI 0487E.a 
ID070919 


Unsigned integer Convert to Floating-point (scalar). This instruction converts the unsigned integer value in the 
general-purpose source register to a floating-point value using the rounding mode that is specified by the FPCR, and 


writes the result to the SIMD&FP destination register. 


A floating-point exception can be generated by this instruction. Depending on the settings in FPCR, the exception 
results in either a flag being set in FPSR, or a synchronous exception being generated. For more information, see 


Floating-point exceptions and exception traps on page D1-2313. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 2120/1918  16/15141312/11109 | 


aloo [T TT 1 Ole] to oe Tao oo oo] a I a 


rmode opcode 


32-bit to half-precision variant 
Applies when sf == 0 && ftype == 11. 


UCVTF <Hd>, <Wn> 


32-bit to single-precision variant 
Applies when sf == 0 && ftype == 00. 


UCVTF <Sd>, <Wn> 


32-bit to double-precision variant 
Applies when sf == 0 && ftype == 01. 


UCVTF <Dd>, <Wn> 


64-bit to half-precision variant 
Applies when sf == 1 && ftype == 11. 


UCVTF <Hd>, <Xn> 


64-bit to single-precision variant 
Applies when sf == 1 && ftype == 00. 


UCVTF <Sd>, <Xn> 


64-bit to double-precision variant 
Applies when sf == 1 && ftype == 01. 


UCVTF <Dd>, <Xn> 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer intsize = if sf == '1' then 64 else 32; 
integer fltsize; 
FPRounding rounding; 
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C7-2166 


case ftype of 


when '00' 
fltsize = 32; 
when '01' 
fltsize = 64; 
when '10' 
UNDEFINED; 
when '11' 
if HaveFP16Ext() then 
fitsize = 16; 
else 
UNDEFINED; 


rounding = FPRoundingMode(FPCR) ; 


Assembler symbols 


<Dd> 


<Hd> Is the 16-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Xn> Is the 64-bit name of the general-purpose source register, encoded in the "Rn" field. 
<Wn> Is the 32-bit name of the general-purpose source register, encoded in the "Rn" field. 
Operation 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "Rd" field. 


CheckFPAdvSIMDEnab1ed64(); 


bits(fltsize) fltval; 
bits(intsize) intval; 


intval = X[n]; 
fltval = FixedToFP(intval, @, TRUE, FPCR, rounding); 
V[d] = fltval; 
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C7.2.347 UDOT (by element) 


ARM DDI 0487E.a 
ID070919 


Dot Product unsigned arithmetic (vector, by element). This instruction performs the dot product of the four 8-bit 
elements in each 32-bit element of the first source register with the four 8-bit elements of an indexed 32-bit element 
in the second source register, accumulating the result into the corresponding 32-bit element of the destination 
register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 





Note 
ID_AA64ISARO_EL1.DP indicates whether this instruction is supported. 





ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 14 13 1211110 9 | 5 4| 0| 
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Vector variant 


UDOT <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.4B[<index>] 


Decode for this encoding 


if !HaveDOTPExt() then UNDEFINED; 
if size != '10' then UNDEFINED; 
boolean signed = (U == '0'); 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(M:Rm); 
integer index = UInt(H:L); 


integer esize = 8 << UInt(size); 
integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
2S when Q = 0 
4S whenQ = 1 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 
8B when Q = 0 
16B when Q = 1 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "M:Rm" fields. 
<index> Is the element index, encoded in the "H:L" fields. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(128) operand2 = V[m]; 
bits(datasize) result = V[d]; 
for e = 0 to elements-1 

integer res = 0; 

integer element1, element2; 

for i = 0 to 3 

if signed then 

element1 = SInt(Elem[operand1, 4*e+1, esize DIV 4]); 
element2 = SInt(Elem[operand2, 4*index+i, esize DIV 4]) 


else 
element1 = UInt(Elem[operand1, 4*e+1, esize DIV 4]); 
element2 = UInt(Elem[operand2, 4«index+i, esize DIV 4]); 
res = res + elementl « element2; 

Elem[result, e, esize] = Elem[result, e, esize] + res; 
V[d] = result; 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Dot Product unsigned arithmetic (vector). This instruction performs the dot product of the four 8-bit elements in 
each 32-bit element of the first source register with the four 8-bit elements of the corresponding 32-bit element in 
the second source register, accumulating the result into the corresponding 32-bit element of the destination register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 


Note 





ID_AA64ISARO_EL1.DP indicates whether this instruction is supported. 





ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15 14 13 12|11 10 9. | 5 4| 0 | 
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Three registers of the same type variant 


UDOT <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


if !HaveDOTPExt() then UNDEFINED; 
l= '10' then UNDEFINED; 
signed = (U == '0'); 


if size 
boolean 
integer 
integer 
integer 
integer 
integer 
integer 


d 
n 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


Assembler symbols 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


<Vm> 


ARM DDI 0487E.a 
ID070919 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 


2S when Q = 0 
4S when Q = 1 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "Q" field. It can have the following values: 


8B when Q = 0 
16B when Q = 1 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


result = V[d]; 
for e = 0 to elements-1 

integer res = 0; 

integer element1, element2; 

for i = 0 to 3 

if signed then 

element1 = SInt(Elem[operand1l, 4«e+i, 
element2 = SInt(Elem[operand2, 4«e+i, 


else 
element1 = UInt(Elem[operand1l, 4«e+i, 
element2 = UInt(Elem[operand2, 4«e+i, 
res = res + elementl « element2; 





esize DIV 4]); 
esize DIV 4]); 


esize DIV 4]); 
esize DIV 4]); 


Elem[result, e, esize] = Elem[result, e, esize] + res; 


V[d] = result; 


C7-2170 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7.2.349 UHADD 


ARM DDI 0487E.a 
ID070919 


Unsigned Halving Add. This instruction adds corresponding unsigned integer values from the two source 


SIMD&FP registers, shifts each result right one bit, places the results into a vector, and writes the vector to the 


destination SIMD&FP register. 


The results are truncated. For rounded results, see URHADD. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 
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Three registers of the same type variant 


UHADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

integer element1; 

integer element2; 

integer sum; 
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for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
sum = elementl + element2; 
Elem[result, e, esize] = sum<esize:1>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unsigned Halving Subtract. This instruction subtracts the vector elements in the second source SIMD&FP register 
from the corresponding vector elements in the first source SIMD&FP register, shifts each result right one bit, places 
each result into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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Three registers of the same type variant 


UHSUB <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 
boolean 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
== '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = if Q == '1' then 128 else 64; 
datasize DIV esize; 


elements = 
unsigned = 


(U == '1'); 


Assembler symbols 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


when size 
when size 
when size 
when size 
when size 


when size 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


<Vd> 

<T> 
8B 
16B 
4H 
8H 
2S 
4S 

<Vn> 

<Vm> 

Operation 


CheckFPAdvSIMDEnabled64(); 


bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m] 


bits(datasize) result; 


integer 
integer 
integer 


element1; 
element2; 
diff; 


for e = Q to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
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element2 = Int(Elem[operand2, e, esize], unsigned); 
diff = element1 - element2; 
Elem[result, e, esize] = diff<esize:1>; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unsigned Maximum (vector). This instruction compares corresponding elements in the vectors in the two source 
SIMD&FP registers, places the larger of each pair of unsigned integer values into a vector, and writes the vector to 
the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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Three registers of the same type variant 


UMAX <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 
boolean 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U 
minimum = (o1 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Operation 


'1'); 
'1'); 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size 
when size 
when size 
when size 
when size 


when size 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


integer element1; 
integer element2; 
integer maxmin; 
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for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
maxmin = if minimum then Min(elementl, element2) else Max(element1, element2); 
Elem[result, e, esize] = maxmin<esize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


C7-2176 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
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C7.2.352 UMAXP 


ARM DDI 0487E.a 
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A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Unsigned Maximum Pairwise. This instruction creates a vector by concatenating the vector elements of the first 
source SIMD&FP register after the vector elements of the second source SIMD&FP register, reads each pair of 
adjacent vector elements in the two source SIMD&FP registers, writes the largest of each pair of unsigned integer 
values into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 


fofaftfo 7744 olse] Rm [107 0]0)] An | Rd | 
U 01 
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Three registers of the same type variant 


UMAXP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d 
integer n 
integer m 


UInt(Rd); 

UInt(Rn); 

UInt(Rm); 

if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize 
integer elements 


if Q == '1' then 128 else 64; 
datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean minimum = (01 == '1'); 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size = 00,Q = 0 


when size = 00,Q = 1 


when size 
when size 
when size 


when size 


01,Q = 0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 = 


I ou 
= = 
3 5 


bits(datasize) result; 
bits(2sdatasize) concat = operand2:operand1; 
integer element1; 
integer element2; 
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integer maxmin; 


for e = 0 to elements-1 
element1 = Int(Elem[concat, 2e, esize], unsigned); 
element2 = Int(Elem[concat, (2xe)+1, esize], unsigned); 
maxmin = if minimum then Min(elementl, element2) else Max(element1, element2); 
Elem[result, e, esize] = maxmin<esize-1:0>; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.353 UMAXV 


Unsigned Maximum across Vector. This instruction compares all the vector elements in the source SIMD&FP 
register, and writes the largest of the values as a scalar to the destination SIMD&FP register. All the values in this 
instruction are unsigned integer values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oloo n Ofsze]i +00 ojo oro o] en | Rd 
U op 


Advanced SIMD variant 


UMAXV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size:Q == '10@' then UNDEFINED; 

if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean min = (op == '1'); 


Assembler symbols 


<V> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 


The encoding size = 11 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 10, Q = 0. 


° size = 11,Q = x. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
integer maxmin; 

integer element; 


maxmin = Int(Elem[operand, 0, esize], unsigned); 
for e = 1 to elements-1 
element = Int(Elem[operand, e, esize], unsigned); 
maxmin = if min then Min(maxmin, element) else Max(maxmin, element); 


V[d] = maxmin<esize-1:0>; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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Unsigned Minimum (vector). This instruction compares corresponding vector elements in the two source 
SIMD&FP registers, places the smaller of each of the two unsigned integer values into a vector, and writes the 
vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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Three registers of the same type variant 


UMIN <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 
boolean 


d 
n= 
m 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U 
minimum = (o1 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Operation 


'1'); 
'1'); 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size 
when size 
when size 
when size 
when size 


when size 


00,Q = 0 
00,Q=1 
01,Q=0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 


bits(datasize) result; 


integer element1; 
integer element2; 
integer maxmin; 
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for e = 0 to elements-1 
element1 = Int(Elem[operandi, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
maxmin = if minimum then Min(elementl, element2) else Max(element1, element2); 
Elem[result, e, esize] = maxmin<esize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.355 UMINP 
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C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Unsigned Minimum Pairwise. This instruction creates a vector by concatenating the vector elements of the first 
source SIMD&FP register after the vector elements of the second source SIMD&FP register, reads each pair of 
adjacent vector elements in the two source SIMD&FP registers, writes the smallest of each pair of unsigned integer 
values into a vector, and writes the vector to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 
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Three registers of the same type variant 


UMINP <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d 
integer n 
integer m 


UInt(Rd); 

UInt(Rn); 

UInt(Rm); 

if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize 
integer elements 


if Q == '1' then 128 else 64; 
datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean minimum = (01 == '1'); 


Assembler symbols 


<Vd> 


<T> 


<Vn> 


<Vm> 


Operation 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
25 
4S 


when size = 00,Q = 0 


when size = 00,Q = 1 


when size 
when size 
when size 


when size 


01,Q = 0 
01,Q=1 
10,Q = 0 
10,Q=1 


The encoding size = 11, Q = x is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 = 


I ou 
= = 
3 5 


bits(datasize) result; 
bits(2sdatasize) concat = operand2:operand1; 
integer element1; 
integer element2; 
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integer maxmin; 


for e = 0 to elements-1 
element1 = Int(Elem[concat, 2e, esize], unsigned); 
element2 = Int(Elem[concat, (2xe)+1, esize], unsigned); 
maxmin = if minimum then Min(elementl, element2) else Max(element1, element2); 
Elem[result, e, esize] = maxmin<esize-1:0>; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.356 UMINV 


Unsigned Minimum across Vector. This instruction compares all the vector elements in the source SIMD&FP 
register, and writes the smallest of the values as a scalar to the destination SIMD&FP register. All the values in this 
instruction are unsigned integer values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


oleo ose n 00 0]i[1070[10] Rn | Rd 
U op 


Advanced SIMD variant 


UMINV <V><d>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size:Q == '10@' then UNDEFINED; 

if size == '11' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean min = (op == '1'); 


Assembler symbols 


<V> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 


The encoding size = 11 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
4S when size = 10,Q = 1 


The following encodings are reserved: 
. size = 10, Q = 0. 


° size = 11,Q = x. 
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Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand = V[n]; 
integer maxmin; 

integer element; 


maxmin = Int(Elem[operand, 0, esize], unsigned); 
for e = 1 to elements-1 
element = Int(Elem[operand, e, esize], unsigned); 
maxmin = if min then Min(maxmin, element) else Max(maxmin, element); 


V[d] = maxmin<esize-1:0>; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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C7.2.357 UMLAL, UMLAL2 (by element) 


Unsigned 


Multiply-Add Long (vector, by element). This instruction multiplies each vector element in the lower or 


upper half of the first source SIMD&FP register by the specified vector element of the second source SIMD&FP 
register and accumulates the results with the vector elements of the destination SIMD&FP register. The destination 
vector elements are twice as long as the elements that are multiplied. 


The UMLAL instruction extracts vector elements from the lower half of the first source register, while the UMLAL2 
instruction extracts vector elements from the upper half of the first source register. 


Dependin 


g on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 2 


9 28|27 26 25 24|23 22 21 20/19 16/15 14 13 1211110 9. | 5 4| 0| 
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Vector variant 


UMLAL{2} 


Decode 


integer 
integer 


bit Rmhi; 


case siz 
when 
when 
othe 


integer 
integer 
integer 


integer 
integer 
integer 
integer 


boolean 
boolean 


<Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Ts>[<index>] 


for this encoding 


idxdsize = if H == '1' then 128 else 64; 

index; 

e of 
"Q@1' index = UInt(H:L:M); Rmhi = '0'; 
'10' index = UInt(H:L); Rmhi = M; 

rwise UNDEFINED; 

d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rmhi:Rm) ; 

esize = 8 << UInt(size); 


datasize = 64; 
part = UInt(Q); 
elements = datasize DIV esize; 


(U == '1'); 


unsigned = 
= (02 == '1'); 


sub_op 


Assembler symbols 


2 


<Vd> 


<Ta> 


ARM DDI 0487E.a 
ID070919 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
4s when size = 01 

2D when size = 10 

The following encodings are reserved: 


. size = 00. 
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C7-2188 


<Vn> 


<Tb> 


<Vm> 


<Ts> 


<index> 


Operation 


. size = 11. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 

. size = 00, Q = x. 

. size = 11,Q = x. 

Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It 
the following values: 

Q:Rm when size = 01 

M:Rm when size = 10 

The following encodings are reserved: 

° size = 00. 

° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 

S when size = 10 

The following encodings are reserved: 

: size = 00. 


° size = 11. 


can have 


Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 


H:L:M when size = 01 

H:L when size = 10 

The following encodings are reserved: 
° size = 00. 


. size = 11. 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = Vpart[n, part]; 
bits(idxdsize) operand2 = V[m]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2»datasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 


element2 = Int(Elem[operand2, index, esize], unsigned); 
for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
product = (elementl«xelement2)<2«esize-1:0>; 
if sub_op then 
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Elem[result, e, 2*esize] = Elem[operand3, e, 2sesize] + product; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.358 


C7-2190 


UMLAL, UMLAL2 (vector) 


Unsigned Multiply-Add Long (vector). This instruction multiplies the vector elements in the lower or upper half of 
the first source SIMD&FP register by the corresponding vector elements of the second source SIMD&FP register, 
and accumulates the results with the vector elements of the destination SIMD&FP register. The destination vector 


elements are twice as long as the elements that are multiplied. 


The UMLAL instruction extracts vector elements from the lower half of the first source register, while the UMLAL2 


instruction extracts vector elements from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9 | 5 4| 


TENAN +++ EE E C C C a] Ra TJ 


Three registers, not all the same type variant 


UMLAL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 
boolean sub_op = (01 == '1'); 

boolean unsigned = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 


the following values: 
[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 

<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

bits(2xesize) accum; 


for e = 0 to elements-1 

element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
product = (element1l«element2)<2«esize-1:0>; 
if sub_op then 

accum = Elem[operand3, e, 2xesize] - product; 
else 

accum = Elem[operand3, e, 2xesize] + product; 
Elem[result, e, 2xesize] = accum; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.359 


UMLSL, UMLSL2 (by element) 


Unsigned Multiply-Subtract Long (vector, by element). This instruction multiplies each vector element in the lower 
or upper half of the first source SIMD&FP register by the specified vector element of the second source SIMD&FP 
register and subtracts the results from the vector elements of the destination SIMD&FP register. The destination 
vector elements are twice as long as the elements that are multiplied. 


The UMLSL instruction extracts vector elements from the lower half of the first source register, while the UMLSL2 
instruction extracts vector elements from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 
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Vector variant 


16/15 14 13 1211110 9 | 5 4| 0| 


UMLSL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Ts>[<index>] 


Decode 


for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 


integer 


bit Rmhi; 


case siz 
when 
when 
othe 


integer 
integer 
integer 


integer 
integer 
integer 
integer 


boolean 
boolean 


index; 

e of 

"Q@1' index = UInt(H:L:M); Rmhi 
'10' index = UInt(H:L); Rmhi = M; 
rwise UNDEFINED; 


d 
n 
m 


UInt(Rd) ; 
UInt(Rn) ; 
UInt(Rmhi :Rm) ; 


esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 

elements = datasize DIV esize; 


(U == '1'); 


unsigned = 
= (02 == '1'); 


sub_op 


Assembler symbols 


2 


<Vd> 


<Ta> 


C7-2192 


'O'; 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 


the following values: 
when Q = 0 
when Q = 1 


[absent] 


[present] 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


4s 
2D 


when size = 01 


when size = 10 


The following encodings are reserved: 


. size = 00. 
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<Vn> 


<Tb> 


<Vm> 


<Ts> 


<index> 


Operation 
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° size = 11. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


4H when size = 01,Q = 0 


8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 

. size = 00, Q = x. 

. size = 11,Q = x. 

Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 

Q:Rm when size = 01 

M:Rm when size = 10 

The following encodings are reserved: 

° size = 00. 

° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 

S when size = 10 

The following encodings are reserved: 

: size = 00. 


° size = 11. 


Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 

H:L when size = 10 

The following encodings are reserved: 

° size = 00. 


. size = 11. 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = Vpart[n, part]; 
bits(idxdsize) operand2 = V[m]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2»datasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 


element2 = Int(Elem[operand2, index, esize], unsigned); 
for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
product = (elementl«xelement2)<2«esize-1:0>; 
if sub_op then 


Elem[result, e, 2*esize] = Elem[operand3, e, 2xesize] - product; 
else 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-2193 


Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


Elem[result, e, 2*esize] = Elem[operand3, e, 2sesize] + product; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.360 UMLSL, UMLSL2 (vector) 


ARM DDI 0487E.a 
ID070919 


Unsigned Multiply-Subtract Long (vector). This instruction multiplies corresponding vector elements in the lower 
or upper half of the two source SIMD&FP registers, and subtracts the results from the vector elements of the 
destination SIMD&FP register. The destination vector elements are twice as long as the elements that are multiplied. 
All the values in this instruction are unsigned integer values. 


The UMLSL instruction extracts each source vector from the lower half of each source register, while the UMLSL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 141312/1110 9. | 5 4| 0 | 
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Three registers, not all the same type variant 


UMLSL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 
boolean sub_op = (01 == '1'); 

boolean unsigned = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) operand3 = V[d]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 

bits(2xesize) accum; 


for e = 0 to elements-1 

element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
product = (element1l«element2)<2«esize-1:0>; 
if sub_op then 

accum = Elem[operand3, e, 2xesize] - product; 
else 

accum = Elem[operand3, e, 2xesize] + product; 
Elem[result, e, 2xesize] = accum; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.361 UMOV 


ARM DDI 0487E.a 
ID070919 


Unsigned Move vector element to general-purpose register. This instruction reads the unsigned integer from the 
source SIMD&FP register, zero-extends it to form a 32-bit or 64-bit value, and writes the result to the destination 
general-purpose register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is used by the alias MOV (to general). See Alias conditions for details of when each alias is 
preferred. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 
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32-bit variant 

Applies when Q == 0. 

UMOV <Wd>, <Vn>.<Ts>[<index>] 
64-reg, UMOV-64-reg variant 
Applies when Q == 1 && imm5 == x1000. 


UMOV <Xd>, <Vn>.<Ts>[<index>] 


Decode for all variants of this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


integer size; 
case Q:imm5 of 


when 'Qxxxx1' size = Q; // UMOV Wd, Vn.B 
when '0xxx10' size = 1; // UMOV Wd, Vn.H 
when '0xx100' size = 2; // UMOV Wd, Vn.S 
when '1x1000' size = 3; // UMOV Xd, Vn.D 
otherwise UNDEFINED; 
integer idxdsize = if imm5<4> == '1' then 128 else 64; 


integer index = UInt(immS<4:size+1>) ; 
integer esize = 8 << size; 
integer datasize = if Q == '1' then 64 else 32; 


Alias conditions 





Alias is preferred when 
MOV (to general) imm5 == 'x1000' 


MOV (to general) imm5 == 'xx100' 





Assembler symbols 


<Wd> Is the 32-bit name of the general-purpose destination register, encoded in the "Rd" field. 
<Xd> Is the 64-bit name of the general-purpose destination register, encoded in the "Rd" field. 
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<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Ts> For the 32-bit variant: is an element size specifier, encoded in the "imm5" field. It can have the 
following values: 
B when imm5 = xxxx1 
H when imm5 = xxx10 
S when imm5 = xx100 


The encoding imm5 = xx000 is reserved. 


For the 64-reg, UMOV-64-reg variant: is an element size specifier, encoded in the "imm5" field. It 
can have the following values: 


D when imm5 = x1000 
The following encodings are reserved: 
s imm5 = x000. 
s imm5 = xxxx1. 
$ imm5 = xxx10. 
è imm5 = xx10Q. 

<index> For the 32-bit variant: is the element index encoded in the "imm5" field. It can have the following 
values: 
imm5<4:1> when imm5 = xxxx1 
imm5<4:2> when imm5 = xxx10 
imm5<4:3> when imm5 = xx100 
The encoding imm5 = xx000 is reserved. 


For the 64-reg, UMOV-64-reg variant: is the element index encoded in "imm5<4>". 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(idxdsize) operand = V[n]; 


X[d] = ZeroExtend(Elem[operand, index, esize], datasize); 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.362 UMULL, UMULL2 (by element) 


Unsigned Multiply Long (vector, by element). This instruction multiplies each vector element in the lower or upper 
half of the first source SIMD&FP register by the specified vector element of the second source SIMD&FP register, 
places the results in a vector, and writes the vector to the destination SIMD&FP register. The destination vector 
elements are twice as long as the elements that are multiplied. 


The UMULL instruction extracts vector elements from the lower half of the first source register, while the UMULL2 
instruction extracts vector elements from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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Vector variant 


UMULL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Ts>[<index>] 


Decode for this encoding 


integer idxdsize = if H == '1' then 128 else 64; 

integer index; 

bit Rmhi; 

case size of 
when 'Q1' index = UInt(H:L:M); Rmhi 
when '10' index = UInt(H:L); Rmhi = M; 
otherwise UNDEFINED; 


'O'; 


UInt(Rd) ; 
UInt(Rn) ; 
UInt(Rmhi :Rm) ; 


integer d 
integer n 
integer m 


integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 
boolean unsigned = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
4s when size = 01 
2D when size = 10 


The following encodings are reserved: 


° size = 00. 
° size = 11. 
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C7-2200 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The following encodings are reserved: 


. size = 00, Q = x. 
. size = 11,Q = x. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "size:M:Rm" field. It can have 
the following values: 
Q:Rm when size = 01 
M:Rm when size = 10 


The following encodings are reserved: 
. size = 00. 
° size = 11. 


Restricted to V0-V15 when element size <Ts> is H. 


<Ts> Is an element size specifier, encoded in the "size" field. It can have the following values: 
H when size = 01 
S when size = 10 


The following encodings are reserved: 


. size = 00. 
° size = 11. 
<index> Is the element index, encoded in the "size:L:H:M" field. It can have the following values: 
H:L:M when size = 01 
H:L when size = 10 


The following encodings are reserved: 
° size = 00. 


. size = 11. 


Operation 


CheckFPAdvSIMDEnabled64(); 

bits(datasize) operand1 = Vpart[n, part]; 
bits(idxdsize) operand2 = V[m]; 
bits(2»datasize) result; 

integer element1; 

integer element2; 

bits(2sesize) product; 


element2 = Int(Elem[operand2, index, esize], unsigned); 
for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
product = (elementl«element2)<2«esize-1:0>; 
Elem[result, e, 2*esize] = product; 


V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.363 


C7-2202 


UMULL, UMULL2 (vector) 


Unsigned Multiply long (vector). This instruction multiplies corresponding vector elements in the lower or upper 
half of the two source SIMD&FP registers, places the result in a vector, and writes the vector to the destination 
SIMD&FP register. The destination vector elements are twice as long as the elements that are multiplied. All the 
values in this instruction are unsigned integer values. 


The UMULL instruction extracts each source vector from the lower half of each source register, while the UMULL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 
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COTERON EE 


Three registers, not all the same type variant 


UMULL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 


d= 
n 
m= 


UInt(Rd); 
UInt(Rn); 
UInt(Rm); 


== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = 64; 


part = 


UInt (Q) ; 


elements = datasize DIV esize; 


unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
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4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 


for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
Elem[result, e, 2xesize] = (elementlxelement2)<2sesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.364 


C7-2204 


UQADD 


Unsigned saturating Add. This instruction adds the values of corresponding elements of the two source SIMD&FP 
registers, places the results into a vector, and writes the vector to the destination SIMD&FP register. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 
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Scalar variant 


UQADD <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 8 << UInt(size); 
integer datasize = esize; 


integer elements = 1; 

boolean unsigned = (U == '1'); 
Vector 
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Vector variant 


UQADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 


H when size = 01 


S when size = 10 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


D when size = 11 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 

Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = ® is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m] 


bits(datasize) result; 
integer element1; 
integer element2; 
integer sum; 

boolean sat; 


for 


V[d] 


e = Q to elements-1 

element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 

sum = elementl + element2; 

(Elem[result, e, esize], sat) = SatQ(sum, esize, unsigned); 
if sat then FPSR.QC = '1'; 


= result; 
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C7.2.365 


C7-2206 


UQRSHL 


Unsigned saturating Rounding Shift Left (register). This instruction takes each vector element of the first source 
SIMD&FP register, shifts the vector element by a value from the least significant byte of the corresponding vector 
element of the second source SIMD&FP register, places the results into a vector, and writes the vector to the 
destination SIMD&FP register. 


If the shift value is positive, the operation is a left shift. Otherwise, it is a right shift. The results are rounded. For 
truncated results, see UQSHL (immediate). 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9. | 5 4| 0 | 


fo afi] 177 ose] am oroni] Rn |] Rd 
U RS 


Scalar variant 


UQRSHL <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 


if S == '@' && size != '11' then UNDEFINED; 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9. | 5 4| 0| 


oloo +771 Ofsze]i] am oroni] Rn | Rd 
U RS 


Vector variant 


UQRSHL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 
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Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 
D when size = 11 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer round_const = Q; 
integer shift; 

integer element; 
boolean sat; 


for e = 0 to elements-1 
shift = SInt(Elem[operand2, e, esize]<7:0>); 
if rounding then 
round_const = 1 << (-shift - 1); // ® for left shift, 2A(n-1) for right shift 
element = (Int(Elem[operand1, e, esize], unsigned) + round_const) << shift; 
if saturating then 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 
else 
Elem[result, e, esize] = element<esize-1:0>; 


V[d] = result; 
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C7.2.366 UQRSHRN, UQRSHRN2 


Unsigned saturating Rounded Shift Right Narrow (immediate). This instruction reads each vector element in the 
source SIMD&FP register, right shifts each result by an immediate value, puts the final result into a vector, and 
writes the vector to the lower or upper half of the destination SIMD&FP register. All the values in this instruction 
are unsigned integer values. The results are rounded. For truncated results, see UQSHRN, UQSHRN2. 


The UQRSHRN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the UQRSHRN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 1918 16|15141312/11109 | 5 4| 0 | 


Oo iTtyi 7 4 i 4 of F000 [imme a Re | Rd 


immh op 


Scalar variant 


UQRSHRN <Vb><d>, <Va><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then UNDEFINED; 

if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 
integer datasize = esize; 

integer elements = 1; 

integer part = 0; 


integer shift = (2 » esize) - UInt(immh:immb) ; 


boolean round = (op == '1'); 

boolean unsigned = (U == '1'); 

Vector 

|31 Da asl aL baki 16|15 14 13 12|11 10 9. | 5 4| 0 | 
CONN EEN a E E E E 


immh 


Vector variant 


UQRSHRN{2} <Vd>.<Tb>, <Vn>.<Ta>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 
integer esize = 8 << HighestSetBit(immh) ; 
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integer 


integer 
boolean 
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datasize = 64; 
part = UInt(Q); 
elements = datasize DIV esize; 


shift = (2 » esize) - UInt(immh:immb) ; 
round = (op == '1'); 
unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Tb> 


<Vn> 


<Ta> 


<Vb> 


<d> 


<Va> 


ARM DDI 0487E.a 
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Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 
16B when immh = 0001, Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = x is reserved. 
Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "immh" field. It can have the following values: 


8H when immh = 0001 
4S when immh = 001x 
2D when immh = Q1xx 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Is the destination width specifier, encoded in the "immh" field. It can have the following values: 


B when immh = 0001 
H when immh = 001x 
S when immh = Q1xx 


The following encodings are reserved: 
° immh = 0000. 


s immh = 1xxx. 
Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the source width specifier, encoded in the "immh" field. It can have the following values: 


H when immh = 0001 
S when immh = 001x 
D when immh = 01xx 
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The following encodings are reserved: 


. immh = 0000. 


° immh = 1xxx. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<shift> For the scalar variant: is the right shift amount, in the range 1 to the destination operand width in 


bits, encoded in the "immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 

(32-UInt(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = Q1xx 

The following encodings are reserved: 

° immh = 0000. 

° immh = 1xxx. 


For the vector variant: is the right shift amount, in the range 1 to the destination element width in 
bits, encoded in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasizex2) operand = V[n]; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else Q; 
integer element; 

boolean sat; 


for e = 0 to elements-1 
element = (Int(Elem[operand, e, 2*esize], unsigned) + round_const) >> shift; 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 


Vpart[d, part] = result; 
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C7.2.367 UQSHL (immediate) 


ARM DDI 0487E.a 
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Unsigned saturating Shift Left (immediate). This instruction takes each vector element in the source SIMD&FP 
register, shifts it by an immediate value, places the results in a vector, and writes the vector to the destination 


SIMD&FP register. The results are truncated. For rounded results, see UQRSHL. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 


bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/1110 9 | 5 4| 0 | 


a ne eee O_o E 


immh 


Scalar variant 


UQSHL <V><d>, <V><n>, #<shift> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if immh == '0000' then UNDEFINED; 
integer esize = 8 << HighestSetBit(immh) ; 
integer datasize = esize; 

integer elements = 1; 


integer shift = UInt(immh:immb) - esize; 


boolean src_unsigned; 

boolean dst_unsigned; 

case op:U of 
when '00' UNDEFINED; 
when '01' src_unsigned = FALSE; dst_unsigned = TRUE; 
when '10' src_unsigned = FALSE; dst_unsigned = FALSE; 
when '11' src_unsigned = TRUE; dst_unsigned = TRUE; 


Vector 


|31 30 29 28|27 26 25 24|23 22 1918 16/15141312/11109 | 5 4| 0 | 


ototrto 14 tt of 009 [imme Jo 7 ai foti{ Rn __|__e_ 


immh 


Vector variant 


UQSHL <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = if Q == '1' then 128 else 64; 
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C7-2212 


integer elements = datasize DIV esize; 
integer shift = UInt(immh:immb) - esize; 


boolean src_unsigned; 

boolean dst_unsigned; 

case op:U of 
when 'QQ' UNDEFINED; 
when '01' src_unsigned = FALSE; dst_unsigned = TRUE; 
when '10' src_unsigned = FALSE; dst_unsigned = FALSE; 
when '11' src_unsigned = TRUE; dst_unsigned = TRUE; 


Assembler symbols 


<V> Is a width specifier, encoded in the "immh" field. It can have the following values: 
B when immh = 0001 
H when immh = 001x 
S when immh = 01xx 
D when immh = 1xxx 


The encoding immh = 0000 is reserved. 


<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 

8B when immh = 0001, Q = 0 

16B when immh = 0001, Q = 1 

4H when immh = 001x, Q = 0 

8H when immh = 001x, Q = 1 

2S when immh = 01xx, Q = 0 

4S when immh = 01xx, Q = 1 

2D when immh = 1xxx, Q = 1 





See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = 0 is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


<shift> For the scalar variant: is the left shift amount, in the range 0 to the operand width in bits minus 1, 


encoded in the "immh:immb" field. It can have the following values: 
(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = 01xx 
(UInt(immh:immb)-64) when immh = 1xxx 


The encoding immh = 0000 is reserved. 


For the vector variant: is the left shift amount, in the range 0 to the element width in bits minus 1, 


encoded in the "immh:immb" field. It can have the following values: 
(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = Q1xx 


(UInt(immh:immb)-64) when immh = 1xxx 
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See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
integer element; 

boolean sat; 


for e = 0 to elements-1 
element = Int(Elem[operand, e, esize], src_unsigned) << shift; 
(Elem[result, e, esize], sat) = SatQ(element, esize, dst_unsigned) ; 
if sat then FPSR.QC = '1'; 


V[d] = result; 
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C7.2.368 


C7-2214 


UQSHL (register) 


Unsigned saturating Shift Left (register). This instruction takes each element in the vector of the first source 
SIMD&FP register, shifts the element by a value from the least significant byte of the corresponding element of the 
second source SIMD&FP register, places the results in a vector, and writes the vector to the destination SIMD&FP 
register. 


If the shift value is positive, the operation is a left shift. Otherwise, it is a right shift. The results are truncated. For 
rounded results, see UQRSHL. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9. | 5 4| 0 | 


fo t[i[1 177 ojee] am oroo] Rn |] Rd 
U RS 


Scalar variant 


UQSHL <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 


if S == '@' && size != '11' then UNDEFINED; 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 14 13 12|1110 9 | 5 4| 0| 


oleo 1771 O[sze]i] Rm Jo rojon] Rn | Rd 
U RS 


Vector variant 


UQSHL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 
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Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 
D when size = 11 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer round_const = Q; 
integer shift; 

integer element; 
boolean sat; 


for e = 0 to elements-1 
shift = SInt(Elem[operand2, e, esize]<7:0>); 
if rounding then 
round_const = 1 << (-shift - 1); // ® for left shift, 2A(n-1) for right shift 
element = (Int(Elem[operand1, e, esize], unsigned) + round_const) << shift; 
if saturating then 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 
else 
Elem[result, e, esize] = element<esize-1:0>; 


V[d] = result; 
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C7.2.369 UQSHRN, UQSHRN2 


Unsigned saturating Shift Right Narrow (immediate). This instruction reads each vector element in the source 
SIMD&FP register, right shifts each result by an immediate value, saturates each shifted result to a value that is half 
the original width, puts the final result into a vector, and writes the vector to the lower or upper half of the destination 
SIMD&FP register. All the values in this instruction are unsigned integer values. The results are truncated. For 
rounded results, see UQRSHRN, UQRSHRN2. 


The UQSHRN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the UQSHRN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 
of the register. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 11918 16|15141312/11109 | 5 4| 0 | 


oT tt of 0990 fme [1 oo jody ono do o 


immh 


Scalar variant 


UQSHRN <Vb><d>, <Va><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then UNDEFINED; 

if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 
integer datasize = esize; 

integer elements = 1; 

integer part = 0; 


integer shift = (2 » esize) - UInt(immh:immb) ; 


boolean round = (op == '1'); 

boolean unsigned = (U == '1'); 

Vector 

|31 A ioe 16|15 14 13 12|11 10 9. | 5 4| 0 | 
ER A EE S E 


immh 


Vector variant 


UQSHRN{2} <Vd>.<Tb>, <Vn>.<Ta>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 
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boolean 
boolean 


esize 
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= 8 << HighestSetBit(immh) ; 


datasize = 64; 
part = UInt(Q); 
elements = datasize DIV esize; 


shift 
round 


= (2 x esize) - UInt(immh: immb) ; 
= (op == '1'); 


unsigned = (U == '1'); 


Assembler symbols 


2 


<Vd> 


<Tb> 


<Vn> 


<Ta> 


<Vb> 


<d> 


<Va> 


ARM DDI 0487E.a 
ID070919 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 


16B when immh = 0001,Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = @ 
4S when immh = 01xx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = x is reserved. 
Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "immh" field. It can have the following values: 
8H when immh = 0001 

4s when immh = 001x 

2D when immh = Q1xx 

See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Is the destination width specifier, encoded in the "immh" field. It can have the following values: 
B when immh = 0001 


H when immh = QQ1x 


S when immh = 01xx 
The following encodings are reserved: 
° immh = 0000. 


. immh = 1xxx. 
Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the source width specifier, encoded in the "immh" field. It can have the following values: 


H when immh = 0001 
S when immh = 001x 
D when immh = 01xx 
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The following encodings are reserved: 


. immh = 0000. 


° immh = 1xxx. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<shift> For the scalar variant: is the right shift amount, in the range 1 to the destination operand width in 


bits, encoded in the "immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 

(32-UInt(immh:immb)) when immh = 001x 

(64-UInt(immh:immb)) when immh = Q1xx 

The following encodings are reserved: 

° immh = 0000. 

° immh = 1xxx. 


For the vector variant: is the right shift amount, in the range 1 to the destination element width in 
bits, encoded in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasizex2) operand = V[n]; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else Q; 
integer element; 

boolean sat; 


for e = 0 to elements-1 
element = (Int(Elem[operand, e, 2*esize], unsigned) + round_const) >> shift; 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 


Vpart[d, part] = result; 
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C7.2.370 UQSUB 


ARM DDI 0487E.a 
ID070919 


Unsigned saturating Subtract. This instruction subtracts the element values of the second source SIMD&FP register 
from the corresponding element values of the first source SIMD&FP register, places the results into a vector, and 
writes the vector to the destination SIMD&FP register. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fo a[i[1 177 oje] Rm ooro] Rn | Rd 
U 


Scalar variant 


UQSUB <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean unsigned = (U == '1'); 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312/11109 | 5 4| 0| 


lafijo i 1 4 ofszefi| Rm Joo ro ijif Ro | r 


Vector variant 


UQSUB <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 

boolean unsigned = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 


5 when size = 10 
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C7-2220 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


D 


when size = 11 


Is the number of the SIMD&FP destination register, in the "Rd" field. 


Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 
2D 


when size 
when size 
when size 
when size 
when size 
when size 


when size 


00,0 = 0 
00,Q=1 
01,0 = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
11,Q=1 


The encoding size = 11, Q = ® is reserved. 


Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 


bits(datasize) operand1 
bits(datasize) operand2 
bits(datasize) result; 
integer element1; 
integer element2; 


integer diff; 
boolean sat; 


for e = 0 to elements-1 


V[d] 


= V[n]; 
= V[m]; 


element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
diff = elementl - element2; 
(Elem[result, e, esize], sat) = SatQ(diff, esize, unsigned); 
if sat then FPSR.QC = '1'; 


= result; 
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UQXTN, UQXTN2 
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Unsigned saturating extract Narrow. This instruction reads each vector element from the source SIMD&FP register, 
saturates each value to half the original width, places the result into a vector, and writes the vector to the destination 
SIMD&FP register. All the values in this instruction are unsigned integer values. 


If saturation occurs, the cumulative saturation bit FPSR.QC is set. 


The UQXTN instruction writes the vector to the lower half of the destination register and clears the upper half, while 
the UQXTN2 instruction writes the vector to the upper half of the destination register without affecting the other bits 


of the register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


COOK K Ti E ooo oft oo ofr of an TR 


Scalar variant 


UQXTN <Vb><d>, <Va><n> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer part = 0; 


integer elements = 1; 

boolean unsigned = (U == '1'); 
Vector 

|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 14 13 12|11 10 9. | 5 4| 0| 


oleo ose o ooo oroo o] Rn | Rd 
U 


Vector variant 


UQXTN{2} <Vd>.<Tb>, <Vn>.<Ta> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 
integer part = UInt(Q); 


integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
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C7-2222 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = @ 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vb> Is the destination width specifier, encoded in the "size" field. It can have the following values: 
B when size = 00 
H when size = 01 
S when size = 10 


The encoding size = 11 is reserved. 


<d> Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 

<Va> Is the source width specifier, encoded in the "size" field. It can have the following values: 
H when size = 00 
S when size = 01 
D when size = 10 


The encoding size = 11 is reserved. 


<n> Is the number of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(2sdatasize) operand = V[n]; 
bits(datasize) result; 
bits(2sesize) element; 

boolean sat; 


for e = 0 to elements-1 
element = Elem[operand, e, 2esize]; 
(Elem[result, e, esize], sat) = SatQ(Int(element, unsigned), esize, unsigned); 
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if sat then FPSR.QC = '1'; 


Vpart[d, part] = result; 
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C7.2.372 URECPE 


Unsigned Reciprocal Estimate. This instruction reads each vector element from the source SIMD&FP register, 
calculates an approximate inverse for the unsigned integer value, places the result into a vector, and writes the vector 
to the destination SIMD&FP register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


ofafofo +771 oie o 00 0l117 00/10] Rn | Rd 


Vector variant 


URECPE <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz == '1' then UNDEFINED; 

integer esize = 32; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> Is an arrangement specifier, encoded in the "sz:Q" field. It can have the following values: 
2S when sz = 0, Q = 0 
4S when sz = ®@, Q= 1 


The encoding sz = 1, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(32) element; 


for e = 0 to elements-1 
element = Elem[operand, e, 32]; 
Elem[result, e, 32] = UnsignedRecipEstimate(element) ; 


V[d] = result; 
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Unsigned Rounding Halving Add. This instruction adds corresponding unsigned integer values from the two source 
SIMD&FP registers, shifts each result right one bit, places the results into a vector, and writes the vector to the 
destination SIMD&FP register. 


The results are rounded. For truncated results, see UHADD. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


ojoo ofsi] Rm [oo070/i] Rn | Rd | 
U 


Three registers of the same type variant 


URHADD <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 
if size 
integer 
integer 
integer 


boolean 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 
== '11' then UNDEFINED; 
esize = 8 << UInt(size); 


datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


unsigned = (U == '1'); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 

8B when size = 00,Q = 0 

16B when size = 00,Q = 1 

4H when size = 01,Q = 0 

8H when size = 01,Q = 1 

2S when size = 10,Q = 0 

4S when size = 10,Q = 1 

The encoding size = 11, Q = x is reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 

integer element1; 

integer element2; 
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for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
Elem[result, e, esize] = (elementl+element2+1)<esize:1>; 


V[d] = result; 
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C7.2.374 URSHL 


ARM DDI 0487E.a 
ID070919 


Unsigned Rounding Shift Left (register). This instruction takes each element in the vector of the first source 
SIMD&FP register, shifts the vector element by a value from the least significant byte of the corresponding element 
of the second source SIMD&FP register, places the results in a vector, and writes the vector to the destination 
SIMD&FP register. 


If the shift value is positive, the operation is a left shift. If the shift value is negative, it is a rounding right shift. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fo afi +77 ose] Rm Joropo] Rn | Rd 
U RS 


Scalar variant 


URSHL <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 


if S == '@' && size != '11' then UNDEFINED; 
Vector 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


eloljo i 1 4 ofsze[i{ rm Jo 4 of Joli} Rn | Rd 


Vector variant 


URSHL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 
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C7-2228 


Assembler symbols 


<V> 


<d> 


<n> 


<m> 


<Vd> 


<T> 


<Vn> 


<Vm> 


Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 

The following encodings are reserved: 

’ size = 0x. 


s size = 10. 

Is the number of the SIMD&FP destination register, in the "Rd" field. 

Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 

Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer round_const = Q; 
integer shift; 
integer element; 


bool 


for 


V[d] 


ean sat; 


e = Q to elements-1 
shift = SInt(Elem[operand2, e, esize]<7:0>); 
if rounding then 
round_const = 1 << (-shift - 1); // ® for left shift, 2A(n-1) for right shift 
element = (Int(Elem[operand1, e, esize], unsigned) + round_const) << shift; 
if saturating then 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 
else 
Elem[result, e, esize] = element<esize-1:0>; 


= result; 
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C7.2.375 URSHR 


ARM DDI 0487E.a 
ID070919 


Unsigned Rounding Shift Right (immediate). This instruction reads each vector element in the source SIMD&FP 
register, right shifts each result by an immediate value, writes the final result to a vector, and writes the vector to the 
destination SIMD&FP register. All the values in this instruction are unsigned integer values. The results are 
rounded. For truncated results, see USHR. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15 1413 12/1110 9 | 5 4| 0| 


e shijt 4 1 4 7 oj ooo | imme fo ofrfojoli| R | ni 


immh 01 00 


Scalar variant 


URSHR <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


boolean unsigned = (U == '1'); 
boolean round = (01 == '1'); 
boolean accumulate = (00 == '1'); 
Vector 
|31 uo lets 16/15 14 13 12|1110 9. | 5 4| 0| 
elol 01 1 o| !=0000 | immb [o ojifojoji] Rn | R | 
immh 01 00 


Vector variant 


URSHR <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = (esize » 2) - UInt(immh:immb) ; 
boolean unsigned = (U == '1'); 

boolean round = (01 == '1'); 

boolean accumulate = (0@ == '1'); 
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C7-2230 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<shift> 


Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 
Is the number of the SIMD&FP destination register, in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 
16B when immh = 0001, Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = @ 
4S when immh = 01xx, Q = 1 





2D when immh = 1xxx, Q = 1 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


For the scalar variant: is the right shift amount, in the range | to 64, encoded in the "immh:immb" 


field. It can have the following values: 
(128-UInt(immh:immb)) when immh = 1xxx 


The encoding immh = Qxxx is reserved. 


For the vector variant: is the right shift amount, in the range 1 to the element width in bits, encoded 


in the "immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 


(128-UInt(immh:immb)) when immh 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


1xxx 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand = V[n]; 

bits(datasize) operand2; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else ð; 
integer element; 


operand2 = if accumulate then V[d] else Zeros(); 

for e = 0 to elements-1 
element = (Int(Elem[operand, e, esize], unsigned) + round_const) >> shift; 
Elem[result, e, esize] = Elem[operand2, e, esize] + element<esize-1:0>; 


V[d] = result; 
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C7.2.376 URSQRTE 


Unsigned Reciprocal Square Root Estimate. This instruction reads each vector element from the source SIMD&FP 
register, calculates an approximate inverse square root for each value, places the result into a vector, and writes the 
vector to the destination SIMD&FP register. All the values in this instruction are unsigned integer values. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 1312/1110 9. | 5 4| 0 | 


opo oie ooo 0j117 00/10] Rn | Rd 


Vector variant 


URSQRTE <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if sz == '1' then UNDEFINED; 

integer esize = 32; 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<I> Is an arrangement specifier, encoded in the "sz:Q" field. It can have the following values: 
2S when sz = 0, Q = 0 
4S when sz = ®@, Q= 1 


The encoding sz = 1, Q = x is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation 


CheckFPAdvSIMDEnab1led64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 
bits(32) element; 


for e = 0 to elements-1 
element = Elem[operand, e, 32]; 


Elem[result, e, 32] = UnsignedRSqrtEstimate(element) ; 


V[d] = result; 
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C7.2.377 


C7-2232 


URSRA 


Unsigned Rounding Shift Right and Accumulate (immediate). This instruction reads each vector element in the 
source SIMD&FP register, right shifts each result by an immediate value, and accumulates the final results with the 
vector elements of the destination SIMD&FP register. All the values in this instruction are unsigned integer values. 


The results are rounded. For truncated results, see USRA. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918  16|15141312/11109 | 5 4| 0 | 


eslile 4 s 4 7 0} 0000 | imme fo ojlo) Rn | Ro 


immh 01 00 


Scalar variant 


URSRA <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


boolean unsigned = (U == '1'); 
boolean round = (01 == '1'); 
boolean accumulate = (00 == '1'); 
Vector 
|31 uo lets 16/15 14 13 12|1110 9. | 5 4| 0| 
elol 01 1 o| !=0000 | immb [o o[1{i1fo]i] Rao | R | 
immh 0100 


Vector variant 


URSRA <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh); 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = (esize » 2) - UInt(immh:immb) ; 
boolean unsigned = (U == '1'); 

boolean round = (01 == '1'); 

boolean accumulate = (0@ == '1'); 
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Assembler symbols 


<V> Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 





<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 

8B when immh = 0001, Q = 0 

16B when immh = 0001, Q = 1 

4H when immh = 001x, Q = 0 

8H when immh = 001x, Q = 1 

2S when immh = 01xx, Q = @ 

4S when immh = 01xx, Q = 1 

2D when immh = 1xxx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The encoding immh = 1xxx, Q = Q is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<shi ft> For the scalar variant: is the right shift amount, in the range 1 to 64, encoded in the "immh:immb" 
field. It can have the following values: 
(128-UInt(immh:immb)) when immh = 1xxx 
The encoding immh = Qxxx is reserved. 


For the vector variant: is the right shift amount, in the range 1 to the element width in bits, encoded 
in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 


(128-UInt(immh:immb)) when immh 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


1xxx 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand = V[n]; 

bits(datasize) operand2; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else ð; 
integer element; 


operand2 = if accumulate then V[d] else Zeros(); 

for e = 0 to elements-1 
element = (Int(Elem[operand, e, esize], unsigned) + round_const) >> shift; 
Elem[result, e, esize] = Elem[operand2, e, esize] + element<esize-1:0>; 


V[d] = result; 
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C7.2.378 


C7-2234 


USHL 


Unsigned Shift Left (register). This instruction takes each element in the vector of the first source SIMD&FP 
register, shifts each element by a value from the least significant byte of the corresponding element of the second 
source SIMD&FP register, places the results in a vector, and writes the vector to the destination SIMD&FP register. 


If the shift value is positive, the operation is a left shift. If the shift value is negative, it is a truncating right shift. For 
a rounding shift, see URSHL. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


[31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


fo ait 177 ose] Rm [07 ofojofi] Rn | Rd 
U RS 


Scalar variant 


USHL <V><d>, <V><n>, <V><m> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 


if S == '@' && size != '11' then UNDEFINED; 
Vector 


|31 30 29 28|27 26 25 24|23 22 21 20| 16|15141312\1110 9. | 5 4| 0 | 


eloljo 1 1 4 ofsze[t| rm Jo 4 ofofoli| R | ri 


Vector variant 


USHL <Vd>.<T>, <Vn>.<T>, <Vm>.<T> 


Decode for this encoding 


integer d = UInt(Rd); 

integer n = UInt(Rn); 

integer m = UInt(Rm); 

if size:Q == '11@' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 
boolean rounding = (R == '1'); 
boolean saturating = (S == '1'); 
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Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 
D when size = 11 


The following encodings are reserved: 


° size = 0x. 
° size = 10. 
<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<m> Is the number of the second SIMD&FP source register, encoded in the "Rm" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operandl = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer round_const = Q; 
integer shift; 

integer element; 
boolean sat; 


for e = 0 to elements-1 
shift = SInt(Elem[operand2, e, esize]<7:0>); 
if rounding then 
round_const = 1 << (-shift - 1); // ® for left shift, 2A(n-1) for right shift 
element = (Int(Elem[operand1, e, esize], unsigned) + round_const) << shift; 
if saturating then 
(Elem[result, e, esize], sat) = SatQ(element, esize, unsigned); 
if sat then FPSR.QC = '1'; 
else 
Elem[result, e, esize] = element<esize-1:0>; 


V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unsigned Shift Left Long (immediate). This instruction reads each vector element in the lower or upper half of the 
source SIMD&FP register, shifts the unsigned integer value left by the specified number of bits, places the result 
into a vector, and writes the vector to the destination SIMD&FP register. The destination vector elements are twice 
as long as the source vector elements. 


The USHLL instruction extracts vector elements from the lower half of the source register, while the USHLL2 instruction 
extracts vector elements from the upper half of the source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is used by the alias UXTL, UXTL2. See Alias conditions for details of when each alias is preferred. 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/11109 | 5 4| 0 | 


CO C E 4 1 of reoco [imme [ro 10 K an Ra 


immh 


Vector variant 


USHLL{2} <Vd>.<Ta>, <Vn>.<Tb>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3> == '1' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


integer shift = UInt(immh:immb) - esize; 
boolean unsigned = (U == '1'); 


Alias conditions 





Alias is preferred when 


UXTL, UXTL2 immb == 'Q00' && BitCount(immh) == 





Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Ta> Is an arrangement specifier, encoded in the "immh" field. It can have the following values: 
8H when immh = 0001 
4s when immh = 001x 
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2D when immh = Q1xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 
8B when immh = 0001, Q = 0 
16B when immh = 0001,Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The encoding immh = 1xxx, Q = x is reserved. 
<shift> Is the left shift amount, in the range 0 to the source element width in bits minus 1, encoded in the 
"immh:immb" field. It can have the following values: 
(UInt(immh:immb)-8) when immh = 0001 
(UInt(immh:immb)-16) when immh = 001x 
(UInt(immh:immb)-32) when immh = Q1xx 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = Vpart[n, part]; 
bits(datasizex2) result; 

integer element; 


for e = 0 to elements-1 
element = Int(Elem[operand, e, esize], unsigned) << shift; 
Elem[result, e, 2xesize] = element<2sesize-1:0>; 


V[d] = result; 


Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unsigned Shift Right (immediate). This instruction reads each vector element in the source SIMD&FP register, right 
shifts each result by an immediate value, writes the final result to a vector, and writes the vector to the destination 
SIMD&FP register. All the values in this instruction are unsigned integer values. The results are truncated. For 
rounded results, see URSHR. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/11109 | 5 4| 0 | 


eslile 4 1 4 7 0} ooo | imme fo ofofojoli| Ro | Re 


immh 01 00 


Scalar variant 


USHR <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


boolean unsigned = (U == '1'); 
boolean round = (01 == '1'); 
boolean accumulate = (00 == '1'); 
Vector 
|31 uo lets 16/15 14 13 12|1110 9. | 5 4| 0| 
elol 01 1 o| !=0000 | immb [o ofofofoji] Rn | R | 
immh 0100 


Vector variant 


USHR <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh); 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = (esize » 2) - UInt(immh:immb) ; 
boolean unsigned = (U == '1'); 

boolean round = (01 == '1'); 

boolean accumulate = (0@ == '1'); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-2239 
Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


C7-2240 


Assembler symbols 


<V> 


<d> 


<n> 


<Vd> 


<T> 


<Vn> 


<shift> 


Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 
Is the number of the SIMD&FP destination register, in the "Rd" field. 
Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "Iimmh:Q" field. It can have the following values: 


8B when immh = 0001, Q = 0 
16B when immh = 0001, Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = 001x, Q = 1 
2S when immh = 01xx, Q = @ 
4S when immh = 01xx, Q = 1 





2D when immh = 1xxx, Q = 1 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = Q is reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


For the scalar variant: is the right shift amount, in the range | to 64, encoded in the "immh:immb" 


field. It can have the following values: 
(128-UInt(immh:immb)) when immh = 1xxx 


The encoding immh = Qxxx is reserved. 


For the vector variant: is the right shift amount, in the range 1 to the element width in bits, encoded 


in the "immh:immb" field. It can have the following values: 
(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 


(128-UInt(immh:immb)) when immh 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


1xxx 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand = V[n]; 

bits(datasize) operand2; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else ð; 
integer element; 


operand2 = if accumulate then V[d] else Zeros(); 

for e = 0 to elements-1 
element = (Int(Elem[operand, e, esize], unsigned) + round_const) >> shift; 
Elem[result, e, esize] = Elem[operand2, e, esize] + element<esize-1:0>; 


V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.381 USQADD 


Unsigned saturating Accumulate of Signed value. This instruction adds the signed integer values of the vector 
elements in the source SIMD&FP register to corresponding unsigned integer values of the vector elements in the 
destination SIMD&FP register, and accumulates the resulting unsigned integer values with the vector elements of 
the destination SIMD&FP register. 


If overflow occurs with any of the results, those results are saturated. If saturation occurs, the cumulative saturation 
bit FPSR.QC is set. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


COOK K 11 E ooo oo oer ifr of an TR 


Scalar variant 


USQADD <V><d>, <V><n> 


Decode for this encoding 


UInt(Rd) ; 
UInt(Rn) ; 


integer d 
integer n 


integer esize = 8 << UInt(size); 
integer datasize = esize; 
integer elements = 1; 


boolean unsigned = (U == '1'); 
Vector 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 14 13 12|11 10 9 | 5 4| 0| 


fofajijo 1 1 1 ofsie{1 o o o ofooorirji of Rn | Ra | 
U 


Vector variant 


USQADD <Vd>.<T>, <Vn>.<T> 


Decode for this encoding 


UInt(Rd); 
UInt(Rn); 


integer d 
integer n 


if size:Q == '110' then UNDEFINED; 

integer esize = 8 << UInt(size); 

integer datasize = if Q == '1' then 128 else 64; 
integer elements = datasize DIV esize; 


boolean unsigned = (U == '1'); 


Assembler symbols 


<V> Is a width specifier, encoded in the "size" field. It can have the following values: 


B when size = 00 
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<d> 


<n> 


<Vd> 


<T> 


<Vn> 
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H when size = 01 
5 when size = 10 
D when size = 11 


Is the number of the SIMD&FP destination register, encoded in the "Rd" field. 
Is the number of the SIMD&FP source register, encoded in the "Rn" field. 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 
16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 
2D when size = 11,Q = 1 


The encoding size = 11, Q = Qis reserved. 


Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Operation for all encodings 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand = V[n]; 
bits(datasize) result; 


bits(datasize) operand2 = V[d]; 
integer op1; 
integer op2; 
boolean sat; 


for 


v[d] 


e = 0 to elements-1 

op1 = Int(Elem[operand, e, esize], !unsigned); 

op2 = Int(Elem[operand2, e, esize], unsigned); 

(Elem[result, e, esize], sat) = SatQ(opl + op2, esize, unsigned); 
if sat then FPSR.QC = '1'; 

= result; 
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C7.2.382 


C7-2244 


USRA 


Unsigned Shift Right and Accumulate (immediate). This instruction reads each vector element in the source 
SIMD&FP register, right shifts each result by an immediate value, and accumulates the final results with the vector 
elements of the destination SIMD&FP register. All the values in this instruction are unsigned integer values. The 


results are truncated. For rounded results, see URSRA. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


Scalar 


|31 30 29 28|27 26 25 24|23 22 1918 16|15141312/1110 9 | 5 4| 0 | 


eshli 1 4 7 oj 0000 | imme fo ofofrjoli| Rn | Re 


immh 01 00 


Scalar variant 


USRA <V><d>, <V><n>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh<3> != '1' then UNDEFINED; 
integer esize = 8 << 3; 

integer datasize = esize; 

integer elements = 1; 


integer shift = (esize » 2) - UInt(immh:immb) ; 


boolean unsigned = (U == '1'); 
boolean round = (01 == '1'); 
boolean accumulate = (00 == '1'); 
Vector 
|31 uo lets 16/15 14 13 12|1110 9. | 5 4| 0| 
elol 01 1 o| !=0000 | immb [o ojofjijoji] Rao | R | 
immh 01 00 


Vector variant 


USRA <Vd>.<T>, <Vn>.<T>, #<shift> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 


if immh == '0000' then SEE "Advanced SIMD modified immediate"; 
if immh<3>:Q == '10' then UNDEFINED; 

integer esize = 8 << HighestSetBit(immh) ; 

integer datasize = if Q == '1' then 128 else 64; 

integer elements = datasize DIV esize; 


integer shift = (esize » 2) - UInt(immh:immb) ; 
boolean unsigned = (U == '1'); 

boolean round = (01 == '1'); 

boolean accumulate = (0@ == '1'); 
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Assembler symbols 


<V> Is a width specifier, encoded in the "immh" field. It can have the following values: 
D when immh = 1xxx 


The encoding immh = Qxxx is reserved. 





<d> Is the number of the SIMD&FP destination register, in the "Rd" field. 
<n> Is the number of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<I> Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 

8B when immh = 0001, Q = 0 

16B when immh = 0001, Q = 1 

4H when immh = 001x, Q = 0 

8H when immh = 001x, Q = 1 

2S when immh = 01xx, Q = @ 

4S when immh = 01xx, Q = 1 

2D when immh = 1xxx, Q = 1 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 
The encoding immh = 1xxx, Q = Q is reserved. 
<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<shi ft> For the scalar variant: is the right shift amount, in the range 1 to 64, encoded in the "immh:immb" 
field. It can have the following values: 
(128-UInt(immh:immb)) when immh = 1xxx 
The encoding immh = Qxxx is reserved. 


For the vector variant: is the right shift amount, in the range 1 to the element width in bits, encoded 
in the "immh:immb" field. It can have the following values: 


(16-UInt(immh:immb)) when immh = 0001 
(32-UInt(immh:immb)) when immh = 001x 
(64-UInt(immh:immb)) when immh = Q1xx 


(128-UInt(immh:immb)) when immh 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


1xxx 


Operation for all encodings 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operand = V[n]; 

bits(datasize) operand2; 

bits(datasize) result; 

integer round_const = if round then (1 << (shift - 1)) else ð; 
integer element; 


operand2 = if accumulate then V[d] else Zeros(); 

for e = 0 to elements-1 
element = (Int(Elem[operand, e, esize], unsigned) + round_const) >> shift; 
Elem[result, e, esize] = Elem[operand2, e, esize] + element<esize-1:0>; 


V[d] = result; 
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Operational information 
If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unsigned Subtract Long. This instruction subtracts each vector element in the lower or upper half of the second 
source SIMD&FP register from the corresponding vector element of the first source SSIMD&FP register, places the 
result into a vector, and writes the vector to the destination SIMD&FP register. All the values in this instruction are 
unsigned integer values. The destination vector elements are twice as long as the source vector elements. 


The USUBL instruction extracts each source vector from the lower half of each source register, while the USUBL2 
instruction extracts each source vector from the upper half of each source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 121110 9. | 5 4| 0| 


CODEER E 


Three registers, not all the same type variant 


USUBL{2} <Vd>.<Ta>, <Vn>.<Tb>, <Vm>.<Tb> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


boolean 
boolean 


d = UInt(Rd); 

n = UInt(Rn); 

m = UInt(Rm); 

== '11' then UNDEFINED; 
esize = 8 << UInt(size); 
datasize = 64; 

part = UInt(Q); 


elements = datasize DIV esize; 


sub_op = 
unsigned 


(o1 == '1'); 
= (U = '1'); 


Assembler symbols 


2 


<Vd> 


<Ta> 


<Vn> 


<Tb> 


ARM DDI 0487E.a 
ID070919 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
4S when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 
Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q = 1 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. C7-2247 


Non-Confidential 


A64 Advanced SIMD and Floating-point Instruction Descriptions 
C7.2 Alphabetical list of A64 Advanced SIMD and floating-point instructions 


4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 

bits(datasize) operandl = Vpart[n, part]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

integer sum; 


for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
Elem[result, e, 2xesize] = sum<2xesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.384 USUBW, USUBW2 


ARM DDI 0487E.a 
ID070919 


Unsigned Subtract Wide. This instruction subtracts each vector element of the second source SIMD&FP register 

from the corresponding vector element in the lower or upper half of the first source SIMD&FP register, places the 
result in a vector, and writes the vector to the SIMD&FP destination register. All the values in this instruction are 
signed integer values. 


The vector elements of the destination register and the first source register are twice as long as the vector elements 
of the second source register. 


The USUBW instruction extracts vector elements from the lower half of the first source register, while the USUBW2 
instruction extracts vector elements from the upper half of the first source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 16/15 14 13 1211110 9 | 5 4| 0 | 


fofaptfo 7744 olse] Rm [oop 0] An | Rd | 
U 01 


Three registers, not all the same type variant 


USUBW{2} <Vd>.<Ta>, <Vn>.<Ta>, <Vm>.<Tb> 


Decode for this encoding 


integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


if size == '11' then UNDEFINED; 
integer esize = 8 << UInt(size); 
integer datasize = 64; 

integer part = UInt(Q); 

integer elements = datasize DIV esize; 


boolean sub_op = (01 == '1'); 
boolean unsigned = (U == '1'); 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "size" field. It can have the following values: 
8H when size = 00 
4s when size = 01 
2D when size = 10 


The encoding size = 11 is reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
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<Tb> Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
8B when size = 00,Q = 0 
16B when size = 00,Q=1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10, Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 


Operation 


CheckFPAdvSIMDEnabled64(); 
bits(2sdatasize) operand1 = V[n]; 
bits(datasize) operand2 = Vpart[m, part]; 
bits(2sdatasize) result; 

integer element1; 

integer element2; 

integer sum; 


for e = 0 to elements-1 
element1 = Int(Elem[operand1, e, 2*esize], unsigned); 
element2 = Int(Elem[operand2, e, esize], unsigned); 
if sub_op then 
sum = elementl - element2; 
else 
sum = elementl + element2; 
Elem[result, e, 2xesize] = sum<2xesize-1:0>; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.385 UXTL, UXTL2 


Unsigned extend Long. This instruction copies each vector element from the lower or upper half of the source 
SIMD&FP register into a vector, and writes the vector to the destination SIMD&FP register. The destination vector 
elements are twice as long as the source vector elements. 


The UXTL instruction extracts vector elements from the lower half of the source register, while the UXTL2 instruction 
extracts vector elements from the upper half of the source register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


This instruction is an alias of the USHLL, USHLL2 instruction. This means that: 
- The encodings in this description are named to match the encodings of USHLL, USHLL2. 


: The description of USHLL, USHLL2 gives the operational pseudocode for this instruction. 


[31 30 29 28|27 26 25 24|23 22 11918 16/15141312/11109 | 5 4| 0 | 


fofa}ijo 1 1 1 1 0} 0000 [o o oft o 1 0 ofif Rn | Ra | 
U 


immh immb 


Vector variant 

UXTL{2} <Vd>.<Ta>, <Vn>.<Tb> 

is equivalent to 

USHLL{2} <Vd>.<Ta>, <Vn>.<Tb>, #0 


and is the preferred disassembly when BitCount(immh) == 1. 


Assembler symbols 


2 Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 

<Ta> Is an arrangement specifier, encoded in the "immh" field. It can have the following values: 
8H when immh = 0001 
4s when immh = 001x 
2D when immh = Q1xx 


See Advanced SIMD modified immediate on page C4-340 when immh = 0000. 


The encoding immh = 1xxx is reserved. 


<Vn> Is the name of the SIMD&FP source register, encoded in the "Rn" field. 
<Tb> Is an arrangement specifier, encoded in the "immh:Q" field. It can have the following values: 
8B when immh = 0001, Q = 0 
16B when immh = 0001, Q = 1 
4H when immh = 001x, Q = 0 
8H when immh = Q01x,Q = 1 
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2S when immh = 01xx, Q = 0 
4S when immh = 01xx, Q = 1 
See Advanced SIMD modified immediate on page C4-340 when immh = 0000, Q = x. 


The encoding immh = 1xxx, Q = x is reserved. 


Operation 


The description of USHLL, USHLL2 gives the operational pseudocode for this instruction. 


Operational information 
If PSTATE.DIT is 1: 


a The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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Unzip vectors (primary). This instruction reads corresponding even-numbered vector elements from the two source 
SIMD&FP registers, starting at zero, places the result from the first source register into consecutive elements in the 
lower half of a vector, and the result from the second source register into consecutive elements in the upper half of 


a vector, and writes the vector to the destination SIMD&FP register. 


Note 





This instruction can be used with UZP2 to de-interleave two vectors. 





The following figure shows the operation of UZP1 and U 
Ag As 


UZP1.8, doubleword ra Na UZP2.8, doubleword 
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Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16|15 14 13 12/11 10 9 


5 4| 





alge ett Ea ee C C To] eT a] 


Advanced SIMD variant 


UZP1 <Vd>.<T>, <Vn>.<T>, 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


Assembler symbols 


<Vd> 


<T> 


d = UInt(Rd); 


n 


UInt(Rn); 


m = UInt(Rm); 


:Q == '110' then UNDEFINED; 


esize = 8 << UInt(size); 


<Vm>.<T> 


datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


part = 


UInt (op) ; 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 


when size = 


when size = 


when size = 


when size = 


when size = 


when size = 


00,Q = 0 
00,Q=1 
01,Q = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
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2D when size = 11,Q=1 


The encoding size = 11, Q = Qis reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand] = V[n]; 
bits(datasize) operandh = V[m]; 
bits(datasize) result; 


bits(datasizex2) zipped = operandh: operand]; 
for e = 0 to elements-1 
Elem[result, e, esize] = Elem[zipped, 2*e+part, esize]; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Unzip vectors (secondary). This instruction reads corresponding odd-numbered vector elements from the two 
source SIMD&FP registers, places the result from the first source register into consecutive elements in the lower 
half ofa vector, and the result from the second source register into consecutive elements in the upper half of a vector, 
and writes the vector to the destination SIMD&FP register. 


Note 





This instruction can be used with UZP1 to de-interleave two vectors. 





The following figure shows the operation of UZP1 and U 
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Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16|15 14 13 12/11 10 9 


5 4| 
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Advanced SIMD variant 


UZP2 <Vd>.<T>, <Vn>.<T>, 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 


Assembler symbols 


<Vd> 


<T> 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 


esize = 


<Vm>.<T> 


:Q == '11@' then UNDEFINED; 
8 << UInt(size); 


datasize = if Q == '1' then 128 else 64; 
elements = datasize DIV esize; 


part = 


UInt (op) ; 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 
16B 
4H 
8H 
2S 
4S 


when size = 


when size = 


when size = 


when size = 


when size = 


when size = 


00,Q = 0 
00,Q=1 
01,Q = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
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2D when size = 11,Q=1 


The encoding size = 11, Q = Qis reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(datasize) operand] = V[n]; 
bits(datasize) operandh = V[m]; 
bits(datasize) result; 


bits(datasizex2) zipped = operandh: operand]; 
for e = 0 to elements-1 
Elem[result, e, esize] = Elem[zipped, 2*e+part, esize]; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Exclusive OR and Rotate performs a bitwise exclusive OR of the 128-bit vectors in the two source SIMD&FP 
registers, rotates each 64-bit element of the resulting 128-bit vector right by the value specified by a 6-bit immediate 
value, and writes the result to the destination SIMD&FP register. 


This instruction is implemented only when ARMv8.2-SHA is implemented. 


ARMVv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20| 16/15 | 109 5 4| 0 | 


ee ee a a a 


Advanced SIMD variant 


XAR <Vd>.2D, <Vn>.2D, <Vm>.2D, #<imm6> 


Decode for this encoding 


if !HaveSHA3Ext() then UNDEFINED; 
integer d = UInt(Rd); 
integer n = UInt(Rn); 
integer m = UInt(Rm); 


Assembler symbols 


<Vd> Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 
<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
<imm6> Is a rotation right, encoded in "imm6". 

Operation 


AArch64.CheckFPAdvSIMDEnabled(); 


bits(128) Vm = V[m]; 

bits(128) Vn = V[n]; 

bits(128) tmp; 

tmp = Vn EOR Vm; 

V[d] = ROR(tmp<127:64>, UInt(imm6) ):ROR(tmp<63:0>, UInt(imm6)); 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.389 XTN, XTN2 


Extract Narrow. This instruction reads each vector element from the source SIMD&FP register, narrows each value 
to half the original width, places the result into a vector, and writes the vector to the lower or upper half of the 
destination SIMD&FP register. The destination vector elements are half as long as the source vector elements. 


The XTN instruction writes the vector to the lower half of the destination register and clears the upper half, while the 
XTN2 instruction writes the vector to the upper half of the destination register without affecting the other bits of the 


register. 


Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 
and Exception level, an attempt to execute the instruction might be trapped. 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12|11 10 9 | 5 4| 0 | 


oleole +771 ojs o ooo 0070/10] Rn | Rd 


Vector variant 


XTN{2} <Vd>.<Tb>, <Vn>.<Ta> 


Decode for this encoding 


integer 
integer 


if size 
integer 
integer 
integer 
integer 


d 
n 


UInt(Rd) ; 
UInt(Rn) ; 


== '11' then UNDEFINED; 


esize 


= 8 << UInt(size); 


datasize = 64; 


part = 


UInt (Q); 


elements = datasize DIV esize; 


Assembler symbols 


2 


<Vd> 


<Tb> 


<Vn> 


<Ta> 


C7-2258 


Is the second and upper half specifier. If present it causes the operation to be performed on the upper 
64 bits of the registers holding the narrower elements, and is encoded in the "Q" field. It can have 
the following values: 


[absent] whenQ = 0 


[present] whenQ = 1 
Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B when size = 00,Q = 0 


16B when size = 00,Q = 1 
4H when size = 01,Q = 0 
8H when size = 01,Q = 1 
2S when size = 10,Q = 0 
4S when size = 10,Q = 1 


The encoding size = 11, Q = x is reserved. 
Is the name of the SIMD&FP source register, encoded in the "Rn" field. 


Is an arrangement specifier, encoded in the "size" field. It can have the following values: 


8H when size = 00 
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4S when size = 01 


2D when size = 10 


The encoding size = 11 is reserved. 


Operation 


CheckFPAdvSIMDEnab1ed64(); 
bits(2sdatasize) operand = V[n]; 
bits(datasize) result; 
bits(2xesize) element; 


for e = 0 to elements-1 
element = Elem[operand, e, 2esize]; 
Elem[result, e, esize] = element<esize-1:0>; 
Vpart[d, part] = result; 


Operational information 


If PSTATE.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.390 


C7-2260 


ZIP1 


Vd 


Zip vectors (primary). This instruction reads adjacent vector elements from the upper half of two source SIMD&FP 
registers as pairs, interleaves the pairs and places them into a vector, and writes the vector to the destination 

SIMD&FP register. The first pair from the first source register is placed into the two lowest vector elements, with 
subsequent pairs taken alternately from each source register. 


Note 





This instruction can be used with ZIP2 to interleave two vectors. 





The following figure shows the operation of ZIP1 and ZIP2 with the arrangement specifier 8B. 
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Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16|15 14 13 12/11 10 9 


5 4| 





alee et oleae C C To] eT a] 


Advanced SIMD variant 


ZIP1 <Vd>.<T>, <Vn>.<T>, 


<Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 
integer 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 


esize = 


:Q == '11@' then UNDEFINED; 
8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 


elements = datasize DIV esize; 


part = 


UInt (op) ; 


pairs = elements DIV 2; 


Assembler symbols 


<Vd> 


<T> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 
when size = 00,Q = 0 


8B 


when size = 


when size = 


when size = 


when size = 


when size = 


00,Q=1 
01,0 = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
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2D when size = 11,Q=1 


The encoding size = 11, Q = Qis reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer base = part » pairs; 
for p = Q to pairs-1 


Elem[result, 2*p+@, esize] = Elem[operand1, base+p, esize]; 
Elem[result, 2»p+1, esize] = Elem[operand2, base+p, esize]; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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C7.2.391 


C7-2262 


ZIP2 


Vd 


Zip vectors (secondary). This instruction reads adjacent vector elements from the lower half of two source 
SIMD&FP registers as pairs, interleaves the pairs and places them into a vector, and writes the vector to the 
destination SIMD&FP register. The first pair from the first source register is placed into the two lowest vector 


elements, with subsequent pairs taken alternately from each source register. 


Note 





This instruction can be used with ZIP1 to interleave two vectors. 





The following figure shows the operation of ZIP1 and ZIP2 with the arrangement specifier 8B. 
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Depending on the settings in the CPACR_EL1, CPTR_EL2, and CPTR_EL3 registers, and the current Security state 


and Exception level, an attempt to execute the instruction might be trapped. 


|31 30 29 28|27 26 25 24/23 22 21 20| 


16|15 14 13 12/11 10 9 


5 4| 
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Advanced SIMD variant 


ZIP2 <Vd>.<T>, <Vn>.<T>, 


<Vm>.<T> 


Decode for this encoding 


integer 
integer 
integer 


if size 
integer 
integer 
integer 
integer 
integer 


d = UInt(Rd); 
n = UInt(Rn); 
m = UInt(Rm); 


esize = 


:Q == '11@' then UNDEFINED; 
8 << UInt(size); 
datasize = if Q == '1' then 128 else 64; 


elements = datasize DIV esize; 


part = 


UInt (op) ; 


pairs = elements DIV 2; 


Assembler symbols 


<Vd> 


<T> 


Is the name of the SIMD&FP destination register, encoded in the "Rd" field. 


Is an arrangement specifier, encoded in the "size:Q" field. It can have the following values: 


8B 


when size = 00,Q = 0 


when size = 


when size = 


when size = 


when size = 


when size = 


00,Q=1 
01,0 = 0 
01,Q=1 
10,Q = 0 
10,Q=1 
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2D when size = 11,Q=1 


The encoding size = 11, Q = Qis reserved. 


<Vn> Is the name of the first SIMD&FP source register, encoded in the "Rn" field. 
<Vm> Is the name of the second SIMD&FP source register, encoded in the "Rm" field. 
Operation 


CheckFPAdvSIMDEnabled64(); 
bits(datasize) operand1 = V[n]; 
bits(datasize) operand2 = V[m]; 
bits(datasize) result; 


integer base = part » pairs; 
for p = Q to pairs-1 


Elem[result, 2*p+@, esize] = Elem[operand1, base+p, esize]; 
Elem[result, 2»p+1, esize] = Elem[operand2, base+p, esize]; 


V[d] = result; 


Operational information 


If PSTATE.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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This chapter describes the AArch64 system level programmers’ model. It contains the following sections: 


Exception levels on page D1-2268. 

Exception terminology on page D1-2269. 

Execution state on page D1-2271. 

Security state on page D1-2272. 

Virtualization on page D1-2274. 

Registers for instruction processing and exception handling on page D1-2277. 
Process state, PSTATE on page D1-2284. 

Program counter and stack pointer alignment on page D1-2287. 

Reset on page D1-2289. 

Exception entry on page D1-2293. 

Exception return on page D1-2303. 

Synchronous exception types, routing and priorities on page D1-2307. 
Asynchronous exception types, routing, masking and priorities on page D1-2316. 
Configurable instruction enables and disables, and trap controls on page D1-2326. 
System calls on page D1-2371. 

Mechanisms for entering a low-power state on page D1-2372. 

Self-hosted debug on page D1-2377. 

Event monitors on page D1-2379. 

Interprocessing on page D1-2380. 

The effect of implementation choices on the programmers’ model on page D1-2393. 
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D1.1 Exception levels 


The Armv8-A architecture defines a set of Exception levels, ELO to EL3, where: 

. If ELn is the Exception level, increased values of n indicate increased software execution privilege. 
à Execution at ELO is called unprivileged execution. 

° EL2 provides support for virtualization. 

è EL3 provides support for switching between two Security states, Secure state and Non-secure state. 


An implementation might not include all of the Exception levels. All implementations must include ELO and EL1. 
EL2 and EL3 are optional. 


Note 


A PE is not required to implement a contiguous set of Exception levels. For example, it is permissible for an 
implementation to include only ELO, EL1, and EL3. 





The effect of implementation choices on the programmers’ model on page D1-2393 shows some example 
implementations. 


When executing in AArch64 state, execution can move between Exception levels only on taking an exception or on 
returning from an exception: 


s On taking an exception, the Exception level can only increase or remain the same. 


7 On returning from an exception, the Exception level can only decrease or remain the same. 


The Exception level that execution changes to or remains in on taking an exception is called the target Exception 
level of the exception. 


Each exception type has a target Exception level that is either: 
. Implicit in the nature of the exception. 
. Defined by configuration bits in the System registers. 


An exception cannot target ELO. 


Exception levels exist within a particular Security state. The Armv8-A security model on page D1-2272 describes 
this. When executing at an Exception level, the PE can access both of the following: 


s The resources that are available for the combination of the current Exception level and the current Security 
state. 
° The resources that are available at all lower Exception levels, provided that those resources are available to 


the current Security state. 


This means that if the implementation includes EL3, then when execution is at EL3, the PE can access all resources 
available at all Exception levels, for both Security states. 


Each Exception level other than ELO has its own translation regime and associated control registers. For information 
on the translation regimes, see Chapter D5 The AArch64 Virtual Memory System Architecture. 


D1.1.1 Typical Exception level usage model 


D1-2268 


The architecture does not specify what software uses which Exception level. Such choices are outside the scope of 
the architecture. However, the following is a common usage model for the Exception levels: 


ELO Applications. 
ELI OS kernel and associated functions that are typically described as privileged. 
EL2 Hypervisor. 
EL3 Secure monitor. 
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D1.2 Exception terminology 


The following subsections define the terms used when describing exceptions: 


s Terminology for taking an exception. 

. Terminology for returning from an exception. 

° Exception levels. 

. Definition of a precise exception. 

. Definitions of synchronous and asynchronous exceptions on page D1-2270. 
D1.2.1 Terminology for taking an exception 


An exception is generated when the PE first responds to an exceptional condition. The PE state at this time is the 
state the exception is taken from. The PE state immediately after taking the exception is the state the exception is 
taken to. 


D1.2.2 Terminology for returning from an exception 


To return from an exception, the PE must execute an exception return instruction.The PE state when an exception 
return instruction is committed for execution is the state the exception returns from. The PE state immediately after 
the execution of that instruction is the state the exception returns to. 


D1.2.3 Exception levels 


An Exception level, ELn, with a larger value of n than another Exception level, is described as being a higher 
Exception level than the other Exception level. For example, EL3 is a higher Exception level than EL1. 


An Exception level with a smaller value of n than another Exception level is described as being a lower Exception 
level than the other Exception level. For example, ELO is a lower Exception level than EL1. 


An Exception level is described as: 


s Using AArch64 when execution in that Exception level is in the AArch64 Execution state. 
° Using AArch32 when execution in that Exception level is in the AArch32 Execution state. 
D1.2.4 Definition of a precise exception 
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An exception is described as precise when the exception handler receives the PE state and memory system state that 
is consistent with the PE having executed all of the instructions up to but not including the point in the instruction 
stream where the exception was taken, and none afterwards. 


Other than the SError interrupt, all exceptions taken to AArch64 state are required to be precise. For each 
occurrence of an SError interrupt, whether the interrupt is precise or imprecise is IMPLEMENTATION DEFINED. 


Where a synchronous exception that is taken to AArch64 state is generated as part of an instruction that performs 
more than one single-copy atomic memory access, the definition of precise permits that the values in registers or 
memory affected by the instructions can be UNKNOWN, provided that: 


° The accesses affecting those registers or memory locations do not, themselves, generate exceptions. 
. The registers are not involved in the calculation of the memory address used by the instruction. 


Also, for Data Aborts from load or store instructions executed in AArch64 state, where the Data Abort is taken 
synchronously: 


. If the load or store instruction specifies writeback of a new base address, the base address is restored to the 
original value on taking the exception. 


° If the instruction was a load to either the base address register or the offset register, that register is restored 
to the original value. Any other destination registers become UNKNOWN. 


° If the instruction was a load that does not load the base address register or the offset register, then the 
destination registers become UNKNOWN. 
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Examples of instructions that perform more than one single-copy atomic memory access are the AArch32 LDM and 
STM instructions and the AArch64 LDP and STP instructions. 





Note 
For the definition of a single-copy atomic access, see Properties of single-copy atomic accesses on page B2-112. 





D1.2.5 Definitions of synchronous and asynchronous exceptions 


An exception is described as synchronous if all of the following apply: 


$ The exception is generated as a result of direct execution or attempted execution of an instruction. 

à The return address presented to the exception handler is guaranteed to indicate the instruction that caused the 
exception. 

° The exception is precise. 


For more information about synchronous exceptions, see Synchronous exception types, routing and priorities on 
page D1-2307. 


An exception is described as asynchronous if any of the following apply: 
e The exception is not generated as a result of direct execution or attempted execution of the instruction stream. 


i. The return address presented to the exception handler is not guaranteed to indicate the instruction that caused 
the exception. 


è The exception is imprecise. 


For more information about asynchronous exceptions, see Asynchronous exception types, routing, masking and 
priorities on page D1-2316. 
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D1.3 Execution state 
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The Execution states are: 


AArch64 The 64-bit Execution state. 


AArch32 The 32-bit Execution state. Operation in this state is compatible with Armv7-A operation. 


Execution state on page A1-38 gives more information about them. 


Exception levels use Execution states. For example, ELO, EL1 and EL2 might all be using AArch32, under EL3 
using AArch64. 


This means that: 


Different software layers, such as an application, an operating system kernel, and a hypervisor, executing at 
different Exception levels, can execute in different Execution states. 


The PE can change Execution states only either: 
—  Atreset. 
— Ona change of Exception level. 


Note 





Typical Exception level usage model on page D1-2268 shows which Exception levels different software 
layers might typically use. 


The effect of implementation choices on the programmers’ model on page D1-2393 gives information on 
supported configurations of Exception levels and Execution states. 





The interaction between the AArch64 and AArch32 Execution states is called interprocessing. Interprocessing on 
page D1-2380 describes this. 
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D1.4 Security state 


The Armv8-A architecture provides two Security states, each with an associated physical memory address space, 
as follows: 


Secure state When in this state, the PE can access both the Secure physical address space and the 
Non-secure physical address space. 


Non-secure state When in this state, the PE: 
. Can access only the Non-secure physical address space. 
: Cannot access the Secure system control resources. 


For information on how virtual addresses translate onto Secure physical and Non-secure addresses, see About the 
Virtual Memory System Architecture (VMSA) on page D5-2504. 


D1.4.1 The Armv8-A security model 


D1-2272 


The principles of the Armv8-A security model are: 


. If the implementation includes EL3, then it has two Security states, Secure and Non-secure, and: 
—  EL3 exists only in Secure state. 
— A change from Non-secure state to Secure state can only occur on taking an exception to EL3. 
— A change from Secure state to Non-secure state can only occur on an exception return from EL3. 
— If ARMv8.4-SecEL2 is not implemented, EL2 exists only in Non-secure state. 


—  IfARMv8.4-SecEL2 is implemented, EL2 can exist in Secure state. It is enabled when the value of 
SCR_EL3.EEL2 is 1. 


: If the implementation does not include EL3, it has one Security state, that is: 


— IMPLEMENTATION DEFINED, if the implementation does not include EL2 or if ARMv8.4-SecEL2 is 
implemented. 


— Non-secure state, if the implementation includes EL2 and ARMv8.4-SecEL2 is not implemented. 


Security model when EL3 is using AArch64 state 


Figure D1-1 on page D1-2273 shows the security model when EL3 is using AArch64 state. The figure shows how 
instances of ELO and EL] are present in both Security states. It also shows the expected software usage of the 
different Exception levels. 
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Figure D1-1 Armv8-A security model when EL3 is using AArch64 


For an overview of the Security model when EL3 is using AArch32, see Figure G1-1 on page G1-5478. 
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D1.5 Virtualization 


D1-2274 


The support for virtualization described in this section applies only to an implementation that includes EL2. 


When enabled in the current Security state, EL2 provides a set of features that support virtualizing an Armv8-A 
implementation. The basic model of a virtualized system involves: 


: A hypervisor, running in EL2, that is responsible for switching between virtual machines. A virtual machine 
comprises EL1 and ELO. 





. A number of Guest operating systems. A Guest OS runs on a virtual machine in EL1. 
s For each Guest operating system, applications, that run on the virtual machine of that Guest OS, usually in 
ELO. 
Note 


In some systems, a Guest OS is unaware that it is running on a virtual machine, and is unaware of any other Guest 
OS. In other systems, a hypervisor makes the Guest OS aware of these facts. The Armv8-A architecture supports 
both of these models. 





The hypervisor assigns a virtual machine identifier (VMID) to each virtual machine. 


EL2 supports Guest OS management and provides controls to: 


° Provide virtual values for the contents of a small number of identification registers. A read of one of these 
registers by a Guest OS or the applications for a Guest OS returns the virtual value. 


a Trap various operations, including memory management operations and accesses to many other registers. A 
trapped operation generates an exception that is taken to EL2. See Configurable instruction enables and 
disables, and trap controls on page D1-2326. 


s Route interrupts to the appropriate one of: 
— The current Guest OS. 
— A Guest OS that is not currently running. 
— The hypervisor. 


Armv8.1 introduces the Virtualization Host Extensions (VHE) that provide enhanced support for Type 2 
hypervisors. For more information, see Virtualization Host Extensions on page D5-2609. 


In an implementation that includes EL2: 


è The implementation provides an independent translation regime for memory accesses from EL2, the EL2 
translation regime. An implementation that includes ARMv8.1-VHE also supports an alternative EL2&0 
translation regime. 


Note 


An implementation that includes ARMv8.1-VHE can be configured so that the EL2&0 translation regime is 
used both for accesses from EL2 and for accesses from ELO. 








s For the EL1&0 translation regime, address translation occurs in two stages: 


— Stage 1 maps the virtual address (VA) to an intermediate physical address (IPA). This is managed at 
EL1, usually by a Guest OS. The Guest OS believes that the IPA is the physical address (PA). 


— Stage 2 maps the IPA to the PA. This is managed at EL2. The Guest OS might be completely unaware 
of this stage. 


s When ARMv8.3-NV is implemented, a Guest Hypervisor can be run at EL1. For more information on how 
this affects address translation, see Nested virtualization on page D5-2615. 
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e When ARMv8.4-NV is implemented, then accesses of EL1 and EL2 registers that would be trapped are 
instead transformed into memory accesses. For more information, see Enhanced support for nested 
virtualization on page D5-2617. 


For more information on the translation regimes, see Chapter DS The AArch64 Virtual Memory System Architecture. 


D1.5.1 The effect of implementing EL2 on the Exception model 


An implementation that includes EL2 implements the following exceptions: 
° HVC on page C6-909. 
° Traps to EL2. EL2 configurable controls on page D1-2336, describes these. 
° All of the virtual interrupts: 
— Virtual SError. 
— Virtual IRQ. 
— Virtual FIQ. 


All virtual interrupts are always taken to EL1, and can only be taken from EL1 or ELO. 
Each of the virtual interrupts can be independently enabled using controls at EL2. 
Each of the virtual interrupts has a corresponding physical interrupt. See Virtual interrupts. 


When a virtual interrupt is enabled, its corresponding physical exception is taken to EL2, unless EL3 has configured 
that physical exception to be taken to EL3. 


For more information, see Asynchronous exception types, routing, masking and priorities on page D1-2316. 
An implementation that includes EL2 also: 


° Provides controls that can be used to route some synchronous exceptions. For more information, see: 
— Routing exceptions from ELO to EL2 on page D1-2307. 
— Routing debug exceptions on page D2-2403. 


: Provides mechanisms to trap PE operations to EL2. See EL2 configurable controls on page D1-2336. 


When an operation is trapped to EL2, the hypervisor typically either: 
— Emulates the required operation. The application running in the Guest OS is unaware of the trap. 
— Returns an error to the Guest OS. 


Virtual interrupts 


The virtual interrupts have names that correspond to the physical interrupts, as shown in Table D1-1. 


Table D1-1 The virtual interrupt 





Physical interrupt Corresponding virtual interrupt 








SError Virtual SError 
IRQ Virtual IRQ 
FIQ Virtual FIQ 





Software executing in EL2 can use virtual interrupts to signal physical interrupts to EL1 and ELO. Example D1-1 
on page D1-2276 shows a usage model for virtual interrupts. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D1-2275 
ID070919 Non-Confidential 


The AArch64 System Level Programmers’ Model 
D1.5 Virtualization 


Example D1-1 Virtual interrupt usage model 


A virtual interrupt usage model is as follows: 
1. Software executing at EL2 routes a physical interrupt to EL2. 


2s When a physical interrupt of that type occurs, the exception handler executing in EL2 determines whether 
the interrupt can be handled in EL2 or requires routing to a Guest OS in EL1. If the interrupt requires routing 
to a Guest OS: 


° If the Guest OS is currently running, the hypervisor uses the appropriate virtual interrupt type to signal 
the physical interrupt to the Guest OS. 


° If the Guest OS is not currently running, the physical interrupt is marked as pending for the guest OS. 
When the hypervisor next switches to the virtual machine that is running that Guest OS, the hypervisor 
uses the appropriate virtual interrupt type to signal the physical interrupt to the Guest OS. 


A hypervisor can prevent EL1 and ELO from distinguishing a virtual interrupt from a physical interrupt. 
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D1.6 Registers for instruction processing and exception handling 


In the Arm architecture, registers fall into two main categories: 


è Registers that provide system control or status reporting. These are described in Chapter D13 AArch64 
System Register Descriptions. 


è Registers that are used in instruction processing, for example to accumulate a result, and in handling 
exceptions. This section introduces these registers, for execution in AArch64 state. 


This section contains the following subsections: 

. The general purpose registers, RO-R30. 

7 The stack pointer registers. 

$ The SIMD and floating-point registers, V0-V31 on page D1-2278. 
7 Saved Program Status Registers (SPSRs) on page D1-2278. 

s Exception Link Registers (ELRs) on page D1-2282. 


D1.6.1 The general purpose registers, RO-R30 


The general purpose register bank is used when processing instructions in the base instruction set. It comprises 31 
general purpose registers, RO-R30. 


These registers can be accessed as 31 64-bit registers, XO-X30, or 31 32-bit registers, WO-W30. See Register size 
on page C6-750. 


For information on the format of these registers, see Registers in AArch64 state on page B1-99. 


D1.6.2 The stack pointer registers 


ARM DDI 0487E.a 
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In AArch64 state, in addition to the general purpose registers, a dedicated stack pointer register is implemented for 
each implemented Exception level. The stack pointer registers are: 


: SP_ELO and SP_EL1. 
` If the implementation includes EL2, SP_EL2. 
. If the implementation includes EL3, SP_EL3. 


Note 


The four stack pointer register names define an architecture state requirement for four registers. For information on 
how to access these registers, and access restrictions, see Special-purpose registers on page C5-374. 








For information on stack pointer alignment restrictions, see SP alignment checking on page D1-2287. 


Stack pointer register selection 
When executing at ELO, the PE uses the ELO stack pointer, SP_ELO. 


When executing at any other Exception level, the PE can be configured to use either SP_ELO or the stack pointer 
for that Exception level, SP_ELx. 


By default, taking an exception selects the stack pointer for the target Exception level, SP_ELx. For example, taking 
an exception to EL1 selects SP_EL1. Software executing at the target Exception level can then choose to change 
the stack pointer to SP_ELO by updating PSTATE.SP. 


This applies even if taking the exception does not change the Exception level. For example, if the PE is executing 
at EL1 and the PE is using the SP_ELO stack pointer, then on taking an exception that targets EL1, the stack pointer 
changes to SP_EL1. 


The selected stack pointer can be indicated by a suffix to the Exception level: 


t Indicates use of the SP_ELO stack pointer. 
h Indicates use of the SP_ELx stack pointer. 
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D1.6.3 


D1.6.4 


D1-2278 


Note 


The t and h suffixes are based on the terminology of thread and handler. 








Table D1-2 shows the set of stack pointer options. 


Table D1-2 AArch64 stack pointer options 





Exception level (EL) Stack pointer (SP) options 














ELO SP_ELOt 

ELI SP_EL1t, SP_EL1h 
EL2 SP_EL2t, SP_EL2h 
EL3 SP_EL3t, SP_EL3h 





The SIMD and floating-point registers, V0-V31 


The SIMD and floating-point instructions share a common bank of registers for floating-point, vector, and other 
SIMD-related scalar operations. 


The SIMD and floating-point register bank comprises 32 quadword (128-bit) registers, V0-V31. 


These registers can be accessed as: 

° 32 doubleword (64-bit) registers, D0-D31. 
$ 32 word (32-bit) registers, S0-S31. 

° 32 halfword (16-bit) registers, H0-H31. 

d 32 byte (8-bit) registers, BO-B31. 


For information on the format of these registers, see Registers in AArch64 state on page B1-99. 


Saved Program Status Registers (SPSRs) 


The Saved Program Status Registers (SPSRs) are used to save PE state on taking exceptions. 


In AArch64 state, there is an SPSR at each Exception level exceptions can be taken to, as follows: 
: SPSR_EL1, for exceptions taken to EL1 using AArch64. 

è If EL2 is implemented, SPSR_EL2, for exceptions taken to EL2 using AArch64. 

e If EL3 is implemented, SPSR_EL3, for exceptions taken to EL3 using AArch64. 





Note 


Exceptions cannot be taken to ELO. 





When the PE takes an exception, the PE state is saved from PSTATE in the SPSR at the Exception level the 
exception is taken to. For example, if the PE takes an exception to EL1, the PE state is saved in SPSR_EL1. For 
more information on PSTATE, see Process state, PSTATE on page D1-2284. 


Saving the PE state means the exception handler can: 


7 On return from the exception, restore the PE state to the state stored in the SPSR at the Exception level the 
exception is returning from. For example, on returning from EL1, the PE state is restored to the state stored 
in SPSR_EL1. 

$ Examine the value that PSTATE had when the exception was taken, for example to determine the Execution 


state and Exception level in which the instruction that caused an exception was executed. 
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Note 





$ All PSTATE fields are saved, including those which have no direct read and write access, and those that are 
meaningful only in AArch32 state. 


‘ Those PSTATE fields that are meaningful only in AArch32 state are saved when an exception is taken from 
AArch32 state to AArch64 state. 





The SPSRs are UNKNOWN on reset. 


SPSR format for exceptions taken to AArch64 state 
Exceptions can be taken to AArch64 state from AArch64 state or AArch32 state: 


š For an exception taken to AArch64 state from AArch64 state, the SPSR bit assignments are: 
31 30 29 28 27 25 24 23 22 21 20 19 1098376543 





= IL L M[4], Execution State 
Condition —_a— ihe a bits RESO 


PAN, from ARMv8.1 
UAO, from ARMv8s.2 
DIT, from ARMv8.4 
TCO, from ARMv8s.5 


7 For an exception taken to AArch64 state from AArch32 state, the SPSR bit assignments are: 








31 30 29 28 27 26 25 24 23 22 21 20:19 1615 1098765 4:3 
ihe IL L M4], Execution State 
——— flags ee | J | J 
PAN, from ARMV8.1 Mask bits Mode field 
SSBS 
DIT, from ARMv8.4 
IT[1:0] 


The following list describes the bit assignments: 


N, Z, C, V, bits[31:28] 
Shows the values of the PSTATE.{N, Z, C, V} Condition flags immediately before the exception 
was taken. 

Bits[27:24], for exceptions taken from AArch64 state 


Reserved, RESO. 


Q, bit[27], for exceptions taken from AArch32 state 
Shows the value of PSTATE.Q immediately before the exception was taken. 


IT[1:0], bits[26:25], for exceptions taken from AArch32 state 
See IT/7:2] on page D1-2280. 


TCO, bit [25], for exceptions taken from AArch64 state, when ARMv8.5-MemTag is implemented 
Shows the value of PSTATE.TCO immediately before the exception was taken. 


DIT, bit[24], from Armv8.4 
Shows the value of PSTATE.DIT immediately before the exception was taken. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D1-2279 
Non-Confidential 


The AArch64 System Level Programmers’ Model 
D1.6 Registers for instruction processing and exception handling 


UAO, bit[23], from Armv8.2, for exceptions taken from AArch64 state 
Shows the value of PSTATE.UAO immediately before the exception was taken. 
This bit is RESO when ARMVv8.2-UAO is not implemented. 


SSBS, bit[23], for exceptions taken from AArch32 state 
Shows the value of PSTATE.SSBS immediately before the exception was taken. 
This bit is RESO when ARMVv8.0-SSBS is not implemented. 


PAN, bit[22], from Armv8.1 
Shows the value of PSTATE.PAN immediately before the exception was taken. 
This bit is RESO when ARMv8.1-PAN is not implemented. 


SS, bit[21] The Software Step bit. 


SPSR_ELx.SS is used by a debugger to initiate a Software Step exception. The SS bit also indicates 
which software step state machine state the PE was in. See Software Step exceptions on 
page D2-2446. 


IL, bit[20] Illegal Execution state bit. Shows the value of PSTATE.IL immediately before the exception was 
taken. See Ilegal return events from AArch64 state on page D1-2304. 
Bits[19:13], for exceptions taken from AArch64 state 


Reserved, RESO. 


SSBS, bit[12], for exceptions taken from AArch64 state 
Shows the value of PSTATE.SSBS immediately before the exception was taken. 
This bit is RESO when ARMV8.0-SSBS is not implemented. 


BTYPE, bits[11:10], from Armv8.5, for exceptions taken from AArch64 state 
Shows the value of PSTATE.BTYPE immediately before the exception was taken. 
This bit is RESO when ARMV8.5-BTI is not implemented. 


Bits[12:10], for exceptions taken from AArch32 state 


Reserved, RESO. 


GE[3:0], bits [19:16], for exceptions taken from AArch32 state 
Shows the value of PSTATE.GE immediately before the exception was taken. 
IT[7:2], bits [15:10], for exceptions taken from AArch32 state 
With /7/1:0] on page D1-2279, shows the value of PSTATE.IT before the exception was taken. 
D, bit[9], for exceptions taken from AArch64 state 
The debug exception mask bit. Shows the value of PSTATE.D immediately before the exception 
was taken. See The PSTATE debug mask bit, D on page D1-2377. 
E, bit[9], for exceptions taken from AArch32 state 
Endianness of data accesses. Shows the value of PSTATE.E immediately before the exception was 
taken. 
A, I, F, bits[8:6] 
Shows the values of the PSTATE. {A, I, F} exception mask bits immediately before the exception 
was taken: 
A, bit[8] | SError interrupt mask bit. 
I, bit[7] IRQ mask bit. 
F, bit[6] FIQ mask bit. 


See Asynchronous exception masking on page D1-2320. 
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Bit[5], for exceptions taken from AArch64 state 


Reserved, RESO. 


T, bit[5], for exceptions taken from AArch32 state 
Shows the value of PSTATE.T immediately before the exception was taken. 
M[4:0], bits[4:0], for exceptions taken from AArch64 state 


Note 
The name of this field is inherited from Armv7, where the M field specified the PE mode. 





M{4] The value of this is 0. M[4] encodes the value of PSTATE.nRW, that indicates the 
Execution state from which the exception was taken. 


M[3:0] Encodes the Exception level and the stack pointer register selection, as shown in 
Table D1-3. 


Table D1-3 M[3:0] encodings, for exceptions taken from AArch64 state 





M[3:0]2 Exception level and stack pointer 





Qb1101 EL3h 





0b1100 EL3t 





Qb1001 EL2h 





0b1000 EL2t 








0b0101 ELth 





0b0100 ELIt 





0b0000 ELOt 





a. All M[3:0] encodings not shown in the table are 
reserved. 


The M[3:0] encoding comprises: 
MjJ3:2] Encodes the Exception level, 0-3. 


M{1] Reserved, RESO. If set to 1 at the time of an exception return, then that 
exception return is treated as an Illegal Execution state exception return. 


M[0] Selects the SP: 
0 SP_ELO. Indicated by a t suffix on the Exception level. 


1 SP_ELx, where x is the value of M[3:2]. Indicated by anh suffix 
on the Exception level. 


See Stack pointer register selection on page D1-2277. 
M[4:0], bits[4:0], for exceptions taken from AArch32 state 
The Mode field. Specifies the AArch32 PE mode. 


M[4] The value of this is 1. M[4] encodes the value of PSTATE.nRW, that indicates the 
Execution state from which the exception was taken. 
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D1.6.5 


D1-2282 


M[3:0] Encodes the AArch32 PE mode that the PE was in immediately before the exception 
was taken, as shown in Table D1-4. 


Table D1-4 M[3:0] encodings, for exceptions taken from AArch32 state 





M[3:0] AArch32 PE mode 





0b0000 User 





0b0001 FIQ 





0b0010 IRQ 





Qb0011 Supervisor 





0b0111 Abort 





0b1010 Hyp 





0b1011 Undefined 








0b1111 System 








Note 
In this description of SPSR: 
e For exceptions taken from AArch64 state, PSTATE links to the AArch64 system level description. 
e For exceptions taken from AArch32 state, PSTATE links to the AArch32 system level description. 





SPSR bits: 


° That are defined as RESO on an exception taken from AArch32 state are ignored on any exception return to 
AArch32 state. 


$ That are defined as RESO on an exception taken from AArch64 state are ignored on any exception return to 


AArch64 state. 


Pseudocode description of SPSR operations 
The SPSR[] pseudocode function accesses the current SPSR, and is common to AArch32 and AArch64 operations. 


The SetPSTATEFromPSR() pseudocode function updates PSTATE from an SPSR. 


Exception Link Registers (ELRs) 


Exception Link Registers hold preferred exception return addresses. 


Whenever the PE takes an exception, the preferred return address is saved in the ELR at the Exception level the 
exception is taken to. For example, whenever the PE takes an exception to EL1, the preferred return address is saved 
in ELR_EL1. 


On an exception return, the PC is restored to the address stored in the ELR. For example, on returning from EL1, 
the PC is restored to the address stored in ELR_EL1. 


AArch64 state provides an ELR for each Exception level exceptions can be taken to. The ELRs that AArch64 state 
provides are: 


è ELR_EL1, for exceptions taken to EL1. 
7 If EL2 is implemented, ELR_EL2, for exceptions taken to EL2. 
à If EL3 is implemented, ELR_EL3, for exceptions taken to EL3. 


On taking an exception from AArch32 state to AArch64 state, bits[63:32] of the ELR are set to zero. 
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The preferred return address depends on the nature of the exception. For more information, see Preferred exception 
return address on page D1-2295. 
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D1.7 


D1-2284 


Process state, PSTATE 


In the Armv8-A architecture, Process state or PSTATE is an abstraction of process state information. All of the 
instruction sets provide instructions that operate on elements of PSTATE. 


PSTATE includes all of the following: 

: Fields that are meaningful only in AArch32 state. 

s Fields that are meaningful only in AArch64 state. 

è Fields that are meaningful in both Execution states. 


PSTATE is defined in pseudocode as the PSTATE structure, of type ProcState. ProcState is defined in Chapter J1 
Armv8 Pseudocode. 


The PSTATE fields that are meaningful in AArch64 state are: 


The Condition flags 
N Negative Condition flag. 
Z Zero Condition flag. 
C Carry Condition flag. 
Vv Overflow Condition flag. 


Process state, PSTATE on page B1-100 gives more information about these flags. 


The Execution state controls 


SS Software Step bit, see Software Step exceptions on page D2-2446. On a reset or taking 
an exception to AArch64 state, this bit is set to 0. 


IL Illegal Execution state bit, see The Ilegal Execution state exception on page D1-2306. 
On a reset or taking an exception to AArch64 state, this bit is set to 0. 


nRW Current Execution state, see Execution state on page D1-2271. This bit is 0 when the 
current Execution state is AArch64. This bit is set to 0: 
š On reset into an Exception level that is using AArch64. 
s On taking an exception to an Exception level that is using AArch64. 

EL Current Exception level, see Exception levels on page D1-2268. On a reset to AArch64 
state, this field holds the encoding for the highest implemented Exception level. 

Note 


The Arm architecture requires that a PE resets into the highest implemented Exception 
level. 








SP Stack pointer register selection bit, see Stack pointer register selection on 
page D1-2277. On a reset or taking an exception to AArch64 state, this bit is set to 1, 
meaning that SP_ELx is selected. 


The exception mask bits 


D Debug exception mask bit, see The PSTATE debug mask bit, D on page D1-2377. Ona 
reset or taking an exception to AArch64 state, this bit is set to 1. 


A, I, F Asynchronous exception mask bits: 


A SError interrupt mask bit. 
I IRQ interrupt mask bit. 
F FIQ interrupt mask bit. 


See Asynchronous exception types, routing, masking and priorities on page D1-2316. 
On a reset or taking an exception to AArch64 state, each of these bits is set to 1. 


Access control bits 


PAN Privileged Access Never (PAN) state bit. For more information, see About PSTATE. PAN 
on page D5-2578. 


This bit is implemented only when ARMVv8.1-PAN is implemented. 
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UAO User Access Override (UAO) bit. For more information, see About PSTATE. UAO on 
page D5-2579. 


This bit is implemented only when ARMv8.2-UAO is implemented. 

TCO Tag Check Override (TCO) bit. For more information see Chapter D6 Armv8.5 Memory 
Tagging Extension. 
This bit is implemented only when ARMv8.5-MemTag is implemented. 

BTYPE Branch target identification bit. For more information, see About PSTATE.BTYPE on 
page D5-2579. 
This bit is implemented only when ARMV8.5-BTI is implemented. 


Timing control bits 


DIT Data Independent Timing (DIT) bit. For more information, see About PSTATE.DIT on 
page B1-105. 
This bit is implemented only when ARMVv8.4-DIT is implemented. 
On a reset to AArch6é4 state, this bit is set to 0. 


Speculation control bits 


SSBS Speculative Store Bypass Safe (SSBS) bit. For more information, see Speculative Store 
Bypass Safe (SSBS) on page B2-123. 
This bit is implemented only when ARMv8.0-SSBS is implemented. 
On reset, this bit is set to an IMPLEMENTATION DEFINED value. 


D1.7.1 Accessing PSTATE fields 


In AArch64 state, PSTATE fields can be accessed using Special-purpose registers that can be directly read using the 
MRS instruction, and directly written using the MSR (register) instructions. Table D1-5 shows the Special-purpose 
registers that access the PSTATE fields that hold AArch64 state, when the PE is in AArch64 state. All other PSTATE 
fields do not have direct read and write access. 


Table D1-5 Accessing PSTATE fields using MRS and MSR (register) 





Special-purpose register PSTATE fields 
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NZCV N, Z, C, V 
DAIF D, A, I, F 
CurrentEL EL 

SPSel SP 

PAN PAN 
UAO UAO 

DIT DIT 
SSBS SSBS 
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Software can also use the MSR (immediate) instruction to directly write to PSTATE. {D, A, I, F, SP, PAN, UAO, 
SSBS, TCO}. Table D1-6 shows the MSR (immediate) operands that can directly write to these PSTATE fields 
when the PE is in AArch64 state. 


Table D1-6 Accessing PSTATE.{D, A, I, F, SP} using MSR (immediate) 





Operand PSTATE fields Notes 


























DAIFSet D, A, I, F Directly sets any of the PSTATE. {D,A, I, F} bits to 1 
DAIFCIr D, A, I, F Directly clears any of the PSTATE. {D, A, I, F} bits to 0 
SPSel SP Directly sets PSTATE.SP to either 1 or 0 

PAN PAN Directly sets PSTATE.PAN to either 1 or 0 

UAO UAO Directly sets PSTATE.UAO to either 1 or 0 

DIT DIT Directly sets PSTATE.DIT to either 1 or 0 

SSBS SSBS Directly sets PSTATE.SSBS to either 1 or 0 

TCO TCOa Directly sets PSTATE.TCO to either 1 or 0. 





a. PSTATE.TCO can also be accessed by an MSR Xt instruction. 


PSTATE. {N, Z, C, V } can be accessed at ELO. Access to PSTATE. {D, A, I, F} at ELO using AArch64 depends on 
SCTLR_EL1.UMA, see Traps to EL1 of ELO accesses to the PSTATE. {D, A, I, F} interrupt masks on page D1-2330. 
All other PSTATE access instructions can be executed at EL1 or higher and are UNDEFINED at ELO. 


Writes to the PSTATE fields have side-effects on various aspects of the PE operation. All of these side-effects are 


guaranteed: 
° Not to be visible to earlier instructions in the execution stream. 
. To be visible to later instructions in the execution stream. 


D1.7.2 The Saved Program Status Registers (SPSRs) 


On taking an exception, PSTATE is preserved in the SPSR of the Exception level the exception is taken to. The 
SPSRs are described in Saved Program Status Registers (SPSRs) on page D1-2278. 
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D1.8 Program counter and stack pointer alignment 


This section contains the following: 
$ PC alignment checking. 
à SP alignment checking. 


D1.8.1 PC alignment checking 


PC alignment checking generates a PC alignment fault exception associated with the instruction fetch if, in 
AArch64 state, there is an attempt to architecturally execute an instruction that was fetched with a misaligned PC. 
A misaligned PC is when bits[1:0] of the PC are not 0b00. 


Note 


As with Instruction Aborts, speculative fetching of an instruction does not generate an exception. An exception 
occurs only on an attempt to architecturally execute the instruction. 








If an exception is generated as a result of an instruction fetch at ELO, it is taken to EL1. If an exception occurs when 
HCR_EL2.TGE bit is 1 and EL2 is enabled in the current Security state, it is taken to EL2. If an exception is 
generated as a result of an instruction fetch at any other Exception level, the Exception level is unchanged. 


A PC misalignment sets the EC field in the Exception Syndrome Register (ESR) to 0x22, for the ESR associated 
with the target Exception level. 


When the exception is taken to an Exception level using AArch64, the associated Exception Link Register holds the 
entire PC in its misaligned form, as does the FAR_ELx for the Exception level that the exception is taken to. 


Exception return and PC alignment on page D1-2304 gives more information on PC alignment checking associated 
with exception returns. 





Note 


A misalignment of the PC is a common indication of a serious error, for example software corruption of an address. 





The pseudocode function AArch64.CheckPCAlignment() performs PC alignment checking in AArch64 state. When 
necessary it calls AArch64.PCAlignmentFault() to generate an exception. 


D1.8.2 SP alignment checking 


ARM DDI 0487E.a 
ID070919 


A misaligned stack pointer is where bits[3:0] of the stack pointer are not 0b0000, when the stack pointer is used as 
the base address of the calculation, regardless of any offset applied by the instruction. 


The PE can be configured so that if a load or store instruction uses a misaligned stack pointer, the PE generates an 
SP alignment fault exception on the attempt to execute the instruction. In this configuration, CheckSPA1ignment() 
performs the stack pointer check, and calls AArch64.SPAlignmentFau1t() if a misaligned stack pointer is found. 





Note 
° As with Data Aborts, a speculative data access to memory using the stack pointer does not generate the 


exception. The exception occurs only on an attempt to architecturally execute the instruction. 


è Prefetch memory abort instructions do not cause synchronous exceptions. See Prefetch memory on 
page C3-208. 





Stack pointer alignment checking is only performed in AArch64 state, and can be enabled for each Exception level 
as follows: 


. SCTLR_EL1.{SA0, SA} controls ELO and EL1, respectively. 
. SCTLR_EL2.SA controls EL2. 
> SCTLR_EL3.SA controls EL3. 
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If an exception is generated as a result of a load or store at ELO, it is taken as an exception to EL1. If an exception 
occurs when the HCR_EL2.TGE bit is set and EL2 is enabled in the current Security state, it is taken to EL2. If an 
exception is generated as a result of a load or store at any other Exception level, the Exception level is unchanged. 


A stack pointer misalignment sets the EC field to 0x26, in the ESR associated with the target Exception level. If 
memory alignment checking and stack pointer alignment checking are enabled, then an SP alignment fault has 
priority in setting the value of the EC field, in the ESR associated with the target Exception level. 


The pseudocode function CheckSPAlignment() performs the stack pointer alignment check. When necessary it calls 
AArch64.SPAlignmentFault() to generate an exception. 
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D1.9 Reset 
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The Armv8-A architecture supports the following resets: 


Cold reset Resets all of the logic on which the PE executes, including the integrated debug 
functionality. 


In some contexts, this logic is described as belonging to the Cold reset domain. 


Warm reset Resets some of the logic on which the PE executes. However, some state is purposefully 
unchanged by a Warm reset. 


In some contexts, this logic is described as belonging to the Warm reset domain. 


All logic on the which the PE executes that is reset by a Warm reset is also reset by a Cold reset. 





Note 


The Armv8-A architecture also supports an external debug reset. See External debug register resets on 
page H8-6847. 





Ifan RMR_EL<x register is implemented: 
: A Warm reset permits debugging across a reset of the PE logic. 
. Writing 1 to RMR_ELx.RR requests a Warm reset. 


The mechanisms, other than RMR_ELx.RR, to assert these resets are IMPLEMENTATION DEFINED. It is 
IMPLEMENTATION DEFINED whether: 


° It is possible to independently assert an External Debug reset and a Cold reset. 
° It is possible to assert a Warm reset, as opposed to asserting a Cold reset, other than by the use of 
RMR_ELx.RR. 
Note 





Arm recommends that: 


` If separate Core and Debug power domains are implemented, as described in Reset and debug on 
page H6-6819, then a Cold reset can be asserted independently of External Debug reset. 


° A Warm reset can be asserted to permit debugging across a reset of the PE logic. 


This means that an implementation can define other resets according to the requirements the implementation or 
system must fulfil. These other resets are outside the scope of the Armv8-A architecture. However, they can be 
mapped onto the resets described here. 


In the description that follows, the term reset is used in contexts where there is no difference between the effect of 
a Cold reset and the effect of a Warm reset. 


On a reset, the PE enters the highest implemented Exception level. 
If the highest implemented Exception level can use either Execution state, then: 


` The implementation must include a Reset Management Register (RMR). Only one RMR is implemented. The 
RMR implemented is the RMR is associated with the highest Exception level. 


° On a Cold reset, the Execution state entered is determined by a configuration input signal. 
: On a Warm reset, the Execution state entered is determined by RMR_ELx.AA64. 

If the highest implemented Exception level is configured to use AArch64 state, then on reset: 

° The stack pointer for the highest implemented Exception level, SP_ELx, is selected. 


è Execution starts at an IMPLEMENTATION DEFINED address, anywhere in the physical address range. The 
RVBAR associated with the highest implemented Exception level, RVBAR_EL1, RVBAR_EL2, or 
RVBAR_EL3, holds this address. 
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D1-2290 


The remainder of this section contains the following: 


PE state on reset to AArch64 state. 
Code sequence to use RMR_ELx.RR to request a Warm reset on page D1-2292. 


For more information about reset see: 


Behavior of caches at reset on page D4-2477. 
TLB behavior at reset on page D5-2636. 
Reset and debug on page H6-6819. 


PE state on reset to AArch64 state 


Note 





See the ARM” Generic Interrupt Controller Architecture Specification, GIC architecture version 3.0 and version 4.0 
for the reset requirements for GIC System registers. 





Immediately after a reset, much of the PE state is UNKNOWN. However, some of the PE state is defined. If the PE 
resets to AArch64 state using either a Cold or a Warm reset, the PE state that is defined is as follows: 


Each of the PSTATE. {D, A, I, F} interrupt masks is set to 1. 

The Software step control bit, PSTATE.SS, is set to 0. 

The IL process state bit, PSTATE_IL, is set to 0. 

All general-purpose, and SIMD and floating-point registers are UNKNOWN. 

The ELR and SPSR for each Exception level are UNKNOWN. 

The stack pointer register for each Exception level is UNKNOWN. 

The global exclusive monitor and local exclusive monitor for the PE are UNKNOWN. 


Unless explicitly defined in this subsection, each System register at each Exception level is in an 
architecturally UNKNOWN state. 


The TLBs and caches are in an IMPLEMENTATION DEFINED state. This means that the TLBs, the caches, or 
both, might require invalidation using IMPLEMENTATION DEFINED invalidation sequences before the memory 
management system is enabled or Normal memory accesses are permitted to be Cacheable. 


Note 


—  Onreset, System register Cacheability control fields force all Normal memory accesses to be treated 
as Non-cacheable. This applies only for the translation regime used by the Exception level and 
Security state entered on reset. For information about these controls see Enabling and disabling the 
caching of memory accesses on page D4-2475. 





— The implementation might include IMPLEMENTATION DEFINED resets. If it does, each of these resets 
might treat the cache and TLB state differently. The Armv8-A architecture permits this. 


— Different IMPLEMENTATION DEFINED invalidation sequences might be required for different 
IMPLEMENTATION DEFINED resets. 


— In some implementations, the IMPLEMENTATION DEFINED invalidation sequence might be a NOP. 





In the SCTLR_EL-x for the highest implemented Exception level: 
— Each of the {M, C, I} bits is set to 0 
— The EE bit is set to an IMPLEMENTATION DEFINED value, typically defined by a configuration input. 


If an RMR is implemented, RMR_ELx.RR is set to 0. ELx in this context is the highest implemented 
Exception level. 
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The enables for the counter event stream are set to 0. This means that the following bits are set to 0: 
—  CNTKCTL_ELI.EVNTEN. 
— Ifthe implementation includes EL2, CNTHCTL_EL2.EVNTEN. 


PMCR_ELO.E is set to 0. 





Note 


This means the Performance Monitors cannot assert interrupts at reset. 


OSDLR_EL1.DLK bit is set to 0. 

Each of MDCCINT_EL1.{TX, RX} is set to 0. 

EDPRCR.CWRR is set to 0. 

EDPRSR.SR is set to 1. 

If the implementation includes EL3, then each of MDCR_EL3.{EPMAD, EDAD, SPME} is set to 0. 
If the implementation includes EL2, then MDCR_EL2.HPMN is set to the value of PMCR_ELO.N. 
EDESR.OSUC is set to 0. 

If ARMv8.3-DoPD is not implemented,EDESR.SS is set to the value of EDECR.SS. 


If ARMv8.3-DoPD is implemented, EDESR.RC is set to the value of CTIDEVCTL.RCE. Otherwise 
EDESR.RC is set to the value of EDECR.RCE. 


Note 


On an External debug reset, EDECR. {SS, RCE} are set to 0. If ARMv8.3-DoPD is implemented, 
CTIDEVCTL.{OSUCE, RCE} are set to 0. 





Additionally, for a Cold reset into AArch64 state: 


ARM DDI 0487E.a 
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If an RMR is implemented, RMR_ELx.AA64 is set to 1. ELx in this context is the highest implemented 
Exception level. 


Each of MDCCSR_ELO.{TXfull, RXfull} is set to 0. 


If ARMv8.3-DoPD is not implemented, DBGPRCR_EL1.CORENPRDRQ is set to the value of 
EDPRCR.COREPURQ. 





Note 


An External Debug reset sets EDPRCR.COREPURQ to 0, see External debug register resets on 
page H8-6847. If an External Debug reset and a Cold reset coincide, both DBGPRCR_EL1.CORENPRDRQ 
and EDPRCR.COREPURQ are reset to 0. 





If ARMv8.3-DoPD is implemented, DBGPRCR_EL1.CORENPRDRQ is set to 1 if the powerup request is 
implemented and asserted, otherwise is set to 0. 


The debug CLAIM bits are reset to 0. 


Note 


These are the bits that are set to 1 by writing to DBGCLAIMSET_EL1.CLAIM, and cleared to 0 by writing 
to DBGCLAIMCLR_EL1.CLAIM. 








Each of EDSCR.{RXO, TXU, INTdis, TDA, MA, HDE, ERR, RXfull, TXfull} is set to 0. 
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Note 
MDCCSR_ELO.{RXfull, TXfull} reflect the values in EDSCR. {RXfull, TXfull}. 








s Each of EDECCR. {NSE, SE} is set to 0. 
7 If ARMv8.3-DoPD is implemented, EDECR.SS is set to 0. 
° OSLSR EL1.OSLK is set to 1. 


° In the EDPRSR: 
— The SPMAD, SDAD fields are set to 0. 
— The SPD field is set to 1. 


7 Each field of AMCNTENCLRO_ ELO, AMCNTENCLRI1 ELO, AMCNTENSETO_ELO, and 
AMCNTENSET1 ELO is set to 0. 


` Each of the implemented architected activity monitor counters AMEVCNTR0<n>_EL0 and each of the 
implemented auxiliary activity monitor counters AMEVCNTRI1<n>_EL0 are set to 0. 


For more information about resets in AArch64 System registers, see Chapter D13 AArch64 System Register 
Descriptions. 

Code sequence to use RMR_ELx.RR to request a Warm reset 
The following assembler sequence uses RMR_ELx.RR to request a Warm reset: 


; in addition, interrupts and debug requests for this PE should be disabled 
; in the system before running this sequence to ensure the WFI suspends execution 


MOV Wy, #3 ; for AArch64, #2 for AArch32; y is any register 
DSB ; ensure all stores etc are complete 
MSR RMR_ELx, Wy ; request the reset 
ISB ; synchronise change to the RMR 
Loop 
WFI ; enter a quiescent state 
B Loop 


Pseudocode description of reset 
The AArch64.TakeReset() pseudocode function performs a reset into AArch64 state. 


AArch64.TakeReset() calls the functions AArch64.ResetGeneralRegisters(), AArch64.ResetSIMDFPRegisters(), 
AArch64.ResetSpecialRegisters(), AArch64.ResetSystemRegisters(), and ResetExternalDebugRegisters(). 


AArch64.ResetSystemRegisters() resets all System registers to their reset state as defined in the register descriptions 
in PE state on reset to AArch64 state on page D1-2290 and Chapter D13 AArch64 System Register Descriptions. 





Note 
The AArch64.ResetSystemRegisters() function only resets the System registers. 





ResetExternalDebugRegisters() resets all external debug registers to their reset state as defined in the register 
descriptions in Chapter H9 External Debug Register Descriptions. 
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Exceptions are targeted at particular Exception levels. The Exception level that an exception targets is either 
programmed by software, or is determined by the nature of the exception. 


Under no circumstances do exceptions cause execution to move to a lower Exception level. 


If an asynchronous exception targets a lower Exception level, the exception is not taken and remains pending. See 
Asynchronous exception routing on page D1-2317 and Asynchronous exception masking on page D1-2320. 


Note 


The construction of the architecture means that usually, it is impossible for an exception to target a lower Exception 
level. 








The Security state can only change on taking an exception if taken from Non-secure state to EL3. 


Note 
Taking an exception to EL3 from any Exception level has no effect on the value of the SCR_EL3.NS bit. 








On taking an exception to AArch64 state: 


: The PE state is saved in the SPSR_ELx at the target Exception level. See Saved Program Status Registers 
(SPSRs) on page D1-2278. 


° The preferred return address is saved in the ELR_ELx at the target Exception level. See Exception Link 
Registers (ELRs) on page D1-2282. 


° All of PSTATE. {D, A, I, F} are set to 1. See Process state, PSTATE on page D1-2284. 
7 PSTATE.SSBS is set to the value of SCTLR_ELx.DSSBS. 
° If ARMv8.2-UAO is implemented, PSTATE.UAO is set to 0. See Process state, PSTATE on page D1-2284. 


7 If the exception is a synchronous exception or an SError interrupt, information characterizing the reason for 
the exception is saved in the ESR_ELx at the target Exception level. See Use of the ESR_EL1I, ESR_EL2, and 
ESR_EL3 on page D1-2296. 

` If ARMv8.5-MemTag is implemented: 

—  PSTATE.TCO is set to 1. See Process state, PSTATE on page D1-2284. 


— A synchronous exception due to a Tag check fail is reported to as a Data Abort with a Data Fault Status 
Code of Synchronous Tag Check Fail and the faulting virtual address is reported in FAR_ELx. 


For more information see PE handling of Tag Check failure on page D6-2666. 


: If ARMv8.5-BTI is implemented, on taking an asynchronous exception from AArch64 to AArch64, 
PSTATE.BTYPE is copied to SPSR_ELx.BTYPE and then set to 0. 


$ If ARMv8.5-BTI is implemented, on taking certain types of synchronous exception from AArch64 to 
AArch64, PSTATE.BTYPE is copied to SPSR_ELx.BTYPE and then set to 0. These types of synchronous 
exceptions are: 


— Software Step exception. 

— PC alignment fault exception. 

— Instruction Abort exception. 

— Breakpoint exceptions or Address Matching Vector Catch exception. 
— Illegal Execution state exception. 

— Software Breakpoint exception. 


— Branch Target exception. 
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On taking any other synchronous exception from AArch64 to AArch64, it is CONSTRAINED UNPREDICTABLE 
whether: 


—  SPSR_ELx.BTYPE is set to the value of PSTATE.BTYPE. 

—  SPSR_ELx.BTYPE is set to 0. 

PSTATE.BTYPE is then set to 0. 

The stack pointer register selected is the dedicated stack pointer register for the target Exception level. See 
The stack pointer registers on page D1-2277. 

For a physical SError interrupt exception, the pending state of the physical SError is cleared when any of: 
— The SError interrupt is edge-triggered. 

—  ARMv8.4-DFE is implemented. 


— If The Reliability, Availability, and Serviceability Extension (RAS Extension) is implemented, and on 
taking the SError interrupt, the syndrome recorded in ELR_ELx indicates an SError other than 
IMPLEMENTATION DEFINED or uncategorized SError interrupt syndrome. 


Otherwise, it is IMPLEMENTATION DEFINED whether the pending state of the physical SError is cleared. 
This IMPLEMENTATION DEFINED behavior might vary according to the nature of the SError interrupt. 


For a virtual SError interrupt exception, the pending state of the virtual SError, held in the HCR_EL2.VSE 
bit, is cleared to zero. See Virtual interrupts on page D1-2322. 


If ARMv8.2-IESB is implemented, when the Effective value of the SCTLR_ELx.IESB bit at the target 
Exception level is 1, the PE inserts an error synchronization event. See ARM” Reliability, Availability, and 
Serviceability (RAS) Specification, ARMv8, for the ARMv8-A architecture profile. 


Execution moves to the target Exception level, and starts at the address defined by the exception vector. 
Which exception vector is used is also an indicator of whether the exception came from a lower Exception 
level or the current Exception level. See Exception vectors on page D1-2295. 


If an Instruction Abort exception, Data Abort exception, PC alignment fault exception, or a Watchpoint 
exception is taken to an Exception level using AArch64, the faulting virtual address is saved in FAR_ELx. 
.For more information, see Validity of FAR_ELx on page D1-2302. 


Ifan Instruction Abort exception, or Data Abort exception is taken to EL2 and the fault is one connected with 
stage 2 translation, the faulting IPA is saved in HPFAR_EL2. For more information, see Validity of 
HPFAR_EL2 on page D1-2302. 


If ARMv8.5-CSEH is implemented and SCTLR_ELx.EIS is 0, though exception entry is not a context 
synchronization event, the indirect writes to ESR_ELx, FAR_ELx, SPSR_ELx, ELR_ELx, and HPFAR_EL2 due 
to exception entry are synchronized so that a direct read of the register after exception entry sees the indirectly 
written value caused by the exception entry. 





Note 


On exception entry, the memory transactions, including instruction fetches, from an exception level always use the 
translation resources associated with that translation regime. 





The remainder of this section contains the following: 


D1-2294 


Preferred exception return address on page D1-2295. 

Exception vectors on page D1-2295. 

Pseudocode description of exception entry to AArch64 state on page D1-2296. 

Exception classes and the ESR_ELx syndrome registers on page D1-2296. 

Summary of register updates on faults taken to an Exception level that is using AArch64 on page D1-2301. 
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D1.10.1 Preferred exception return address 


For an exception taken to an Exception level using AArch64, the Exception Link Register for that Exception level, 
ELR_ELx, holds the preferred exception return address. The preferred exception return address depends on the 
nature of the exception, as follows: 


° For asynchronous exceptions, it is the address of the instruction following the instruction boundary at which 
the interrupt occurs. Therefore, it is the address of the first instruction that did not execute, or did not 
complete execution, as a result of taking the interrupt. 


° For synchronous exceptions other than system calls, it is the address of the instruction that generates the 
exception. 
è For exception generating instructions, it is the address of the instruction that follows the exception generating 
instruction. 
Note 





If an exception generating instruction is trapped, disabled, or is UNDEFINED because the Exception level has 
insufficient privilege to execute the instruction, the preferred exception return address is the address of the exception 
generating instruction. 





When an exception is taken from an Exception level using AArch32 to an Exception level using AArch64, the top 
32 bits of the modified ELR_ELx are 0. 


D1.10.2 Exception vectors 


ARM DDI 0487E.a 
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When the PE takes an exception to an Exception level that is using AArch64, execution is forced to an address that 
is the exception vector for the exception. The exception vector exists in a vector table at the Exception level the 
exception is taken to. 


A vector table occupies a number of word-aligned addresses in memory, starting at the vector base address. 


Each Exception level has an associated Vector Base Address Register (VBAR), that defines the exception base 
address for the table at that Exception level. 


For exceptions taken to AArch64 state, the vector table provides the following information: 


7 Whether the exception is one of the following: 
— Synchronous exception. 
—  SError. 
— IRQ. 


s Information about the Exception level that the exception came from, combined with information about the 
stack pointer in use, and the state of the register file. 
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Table D1-7 shows this. 


Table D1-7 Vector offsets from vector table base address 





Offset for exception type 


Exception taken from 


Synchronous IRQ orviRQ  FlQorvFIQ SError or vSError 














Current Exception level with SP_ELO. Qx0002 0x080 0x100 0x180 
Current Exception level with SP_ELx, x>0. 0x2004 0x280 0x300 0x380 
Lower Exception level, where the implemented level @x400a 0x480 0x500 0x580 
immediately lower than the target level is using 

AArché4.> 

Lower Exception level, where the implemented level @x600a 0x680 0x700 0x780 


immediately lower than the target level is using 


AArch32.> 





a. When ARMV8.4-DFE is implemented, SCR_EL3.EASE is set to 1, and the exception is a synchronous External abort taken to EL3, the 
exception is routed to the offset in the SError or vSError column. 


b. For exceptions taken to EL3, if EL2 is implemented, the level immediately lower than the target level is EL2 if the exception was taken from 
Non-secure state, but EL1 if the exception was taken from Secure EL1 or ELO. 


D1.10.3 


D1.10.4 


D1-2296 


Reset is treated as a special vector for the highest implemented Exception level. This special vector uses an 
IMPLEMENTATION DEFINED address that is typically set either by a hardwired configuration of the PE or by 
configuration input signals. The RVBAR_EL-x register contains this reset vector address, where x is the number of 
the highest implemented Exception level. 


Pseudocode description of exception entry to AArch64 state 


The AArch64.TakeException() pseudocode function describes the behavior when the PE takes an exception to an 
Exception level that is using AArch64. The AArch64.ExceptionClass() function determines the EC (Exception class) 
and IL (Instruction length) values required to report the exception, and AArch64.ReportException() reports the 
exception. 


The pseudocode functions AArch64.TakeException(), AArch64.ExceptionClass(), and AArch64.ReportException() are 
described in Chapter J1 Armv8 Pseudocode. 


Exception classes and the ESR_ELx syndrome registers 


If the exception is a synchronous exception or an SError interrupt, information characterizing the reason for the 
exception is saved in the ESR_ELx at the Exception level the exception is taken to. The information saved is 
determined at the time the exception is taken, and is not changed as a result of the explicit synchronization that takes 
place at the start of taking the exception. See Synchronization requirements for AArch64 System registers on 

page D13-2819. The following sections give more information: 


° Use of the ESR_EL1, ESR_EL2, and ESR_EL3. 
. The EC used to report an exception routed to EL2 because HCR_EL2.TGE is 1 on page D1-2301. 


Use of the ESR_EL1, ESR_EL2, and ESR_EL3 


An ESR_ELx holds the syndrome information for an exception that is taken to AArch64 state. 


Note 


This use of a syndrome is also the reporting model used for exceptions taken to Hyp mode when they are taken to 
EL2 using AArch32. 








Figure D1-2 on page D1-2297 shows the general format of the ESR_ELx registers. 
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31 26 25 24 0 
| | 
EC IL ISS 


Figure D1-2 Overall format of the ESR_ELx registers 
The ESR_ELx fields are: 


EC, bits[31:26] The Exception class field, that indicates the cause of the exception. 


IL, bit[25] The Instruction length bit, for synchronous exceptions, that indicates whether a trapped 


instruction was a 16-bit or a 32-bit instruction. 


ISS, bits[24:0] The Instruction specific syndrome field. Architecturally, this field can be defined 


independently for each defined Exception class. However, in practice, some ISS encodings 
are used for more than one Exception class. 


ESR_EL1, Exception Syndrome Register (EL1) on page D13-2919, ESR_EL2, Exception Syndrome Register (EL2) 
on page D13-2958 and ESR_EL3, Exception Syndrome Register (EL3) on page D13-2997 describe the registers in 
full, including: 

° Listing the valid EC field values. 

: Describing the ISS for each Exception class. 

° Giving a full description of the use of the IL field. 


Table D1-8 shows the encoding of the ESR_ELx.EC field, the Exception class field. For each EC value, the table 
references a subsection of the ESR_ELx register definition that describes the ISS format, with links to descriptions 
of possible causes of the exception, for example the configuration required to enable a trap. 


Table D1-8 ESR_ELx.EC field encoding 























From, state To, Exception level 
EC Exception class ISS encoding description 
AArch322 AArch64 EL1 EL2 EL3 
000000 Unknown reason Yes Yes Yes Yes Yes ISS encoding for exceptions with an 
unknown reason on page D13-2923 
000001 Trapped WFI or WFE instruction Yes Yes Yes Yes Yes ISS encoding for an exception from 
execution? a WFI or WFE instruction on 
page D13-2925 
000011 Trapped MCR or MRC access Yes No Yes Yes Yese JSS encoding for an exception from 
with (coproc==0b1111)> that an MCR or MRC access on 
is not reported using EC page D13-2926 
0b000000 
000100 Trapped MCRR or MRRC access Yes No Yes Yes Yesi JSS encoding for an exception from 
with (coproc==0b1111)° that an MCRR or MRRC access on 
is not reported using EC page D13-2929 
0b000000 
000101 Trapped MCR or MRC access Yes No Yes Yes Yes ISS encoding for an exception from 
with (coproc==0b1110)> an MCR or MRC access on 
page D13-2926 
000110 Trapped LDC or STC access? Yes No Yes Yes Yes ISS encoding for an exception from 
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Table D1-8 ESR_ELx.EC field encoding (continued) 






































From, state To, Exception level 
EC Exception class ISS encoding description 
AArch322 AArch64 EL1 EL2 EL3 
000111 Access to SVE, Advanced Yes Yes Yes Yes Yes ISS encoding for an exception from 
SIMD or floating-point an access to SVE, Advanced SIMD 
functionality trapped by or floating-point functionality, 
CPACR_EL1.FPEN or resulting from CPACR_EL1.FPEN, 
CPTR_ELx.TFP control CPTR_EL2.FPEN or 
CPTR_ELx.TFP on page D13-2933 
001000 ‘Trapped VMRSaccess, from ID Yes No No Yes No ISS encoding for an exception from 
group traps, that is not an MCR or MRC access on 
reported using EC 0b000111f page D13-2926 
001001 Trapped access to an No Yes No Yes Yes ISS encoding for an exception from 
ARMv8.3-PAuth instruction a Pointer Authentication 
instruction when HCR_EL2.API 
== () || SCR_EL3.API == 0 on 
page D13-2954 
001100 Trapped MRRC access with Yes No Yes Yes Yes ISS encoding for an exception from 
(coproc==0b1110)> an MCRR or MRRC access on 
page D13-2929 
001110 Illegal Execution state Yes Yes Yes Yes Yes ISS encoding for an exception from 
an Illegal Execution state, or a PC 
or SP alignment fault on 
page D13-2935 
010001 SVC instruction execution in Yes No Yes Yess No ISS encoding for an exception from 
AArch32 state HVC or SVC instruction execution 
on page D13-2935 
010010 HVC instruction execution in Yes No No Yes No 
AArch32 state, when HVC is 
not disabled 
010011 SMC instruction execution in Yes No No Yesh Yes ISS encoding for an exception from 
AArch32 state, when SMC is SMC instruction execution in 
not disabled AArch32 state on page D13-2936 
010101 SVC instruction execution in No Yes Yes Yes Yes ISS encoding for an exception from 
AArch64 state HVC or SVC instruction execution 
on page D13-2935 
010110 HVC instruction execution in No Yes No Yes Yes 
AArch6é4 state, when HVC is 
not disabled 
010111 SMC instruction execution in No Yes No Yesh Yes ISS encoding for an exception from 
AArch64 state, when SMC is SMC instruction execution in 
not disabled AArch64 state on page D13-2937 
011000 Trapped MSR, MRS, or System No Yes Yes Yes Yes ISS encoding for an exception from 
instruction execution, that is MSR, MRS, or System instruction 
not reported using EC 0x00, execution in AArch64 state on 
0x01, or 0x07 page D13-2938 
When ARMv8.4-IDST is 
implemented, trapped ID 
registers 
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Table D1-8 ESR_ELx.EC field encoding (continued) 












































From, state To, Exception level 
EC Exception class ISS encoding description 
AArch322 AArch64 EL1 EL2 EL3 
011001 Trapped access to SVE No Yes Yes Yes Yes ISS encoding for an exception from 
functionality, that is not an access to SVE functionality, 
reported using EC 0b000000: resulting from CPACR_EL1.ZEN, 
CPTR_EL2. ZEN, CPTR_EL2.TZ, 
or CPTR_ELZ.EZ on 
page D13-2935 
011010 Trapped ERET, ERETAA or No Yes No Yes No ISS encoding for an exception from 
ERETAB instruction executioni ERET, ERETAA or ERETAB 
instruction on page D13-2953 
011111 IMPLEMENTATION DEFINED Yes Yes No No Yes ISS encoding for a 
exception taken to EL3 IMPLEMENTATION DEFINED 
exception to EL3 on page D13-2940 

100000 Instruction Abort from a Yes Yes Yes Yes Yes ISS encoding for an exception from 

lower Exception levelk an Instruction Abort on 
page D13-2941 

100001 Instruction Abort taken Yes Yes Yes Yes Yes 

without a change in 
Exception levelk 

100010 PC alignment fault Yes Yes Yes Yes Yes ISS encoding for an exception from 
an Illegal Execution state, or a PC 
or SP alignment fault on 
page D13-2935 

100100 Data Abort from a lower Yes Yes Yes Yes Yes ISS encoding for an exception from 

Exception level! a Data Abort on page D13-2943 

100101 Data Abort taken without a Yes Yes Yes Yes Yes 

change in Exception level! 

100110 SP alignment fault No Yes Yes Yes Yes ISS encoding for an exception from 
an Illegal Execution state, or a PC 
or SP alignment fault on 
page D13-2935 

101000 Trapped floating-point Yes No Yes Yes No ISS encoding for an exception from 

exception taken from a trapped floating-point exception 
AArch32 state on page D13-2947 
101100 Trapped floating-point No Yes Yes Yes Yes 
exception taken from 
AArch64 state 

101111 SError interrupt Yes Yes Yes Yes Yes ISS encoding for an SError 
interrupt on page D13-2949 

110000 Breakpoint exception froma Yes Yes Yes Yesm No ISS encoding for an exception from 

lower Exception level a Breakpoint or Vector Catch debug 
7 exception on page D13-2951 
110001 Breakpoint exception taken Yes Yes Yes Yes™ No 
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Table D1-8 ESR_ELx.EC field encoding (continued) 


























From, state To, Exception level 
EC Exception class ISS encoding description 
AArch322 AArch64_ EL1 EL2 EL3 
110010 Software Step exception from Yes Yes Yes Yesm No ISS encoding for an exception from 
a lower Exception level a Software Step exception on 
page D13-2951 
110011 Software Step exception Yes Yes Yes Yesm No 
taken without a change in 
Exception level 
110100 Watchpoint exception froma Yes Yes Yes Yesm No ISS encoding for an exception from 
lower Exception level a Watchpoint exception on 
page D13-2952 
110101 Watchpoint exception taken Yes Yes Yes Yesm No 
without a change in 
Exception level 
111000 BKPT instruction executionin Yes No Yes Yes™ No ISS encoding for an exception from 
AArch32 state execution of a Breakpoint 
instruction on page D13-3031 
111010 Vector Catch exception from Yes No No Yes™ No ISS encoding for an exception from 
AArch32 state a Breakpoint or Vector Catch debug 
exception on page D13-3029 
111100 BRK instruction execution in No Yes Yes Yes™ Yes» ZSS encoding for an exception from 
AArch64 state execution of a Breakpoint 
instruction on page D13-3031 
a. See also Reporting AArch32 synchronous exceptions taken to an Exception level using AArch64 on page D1-2301. 
b. Exceptions caused by configurable traps, enables, or disables. 
c. See Traps to EL3 of Secure monitor functionality from Secure ELI using AArch32 on page D1-2361. 
d. Only for MCRR or MRRC accesses to the PMCCNTR_ELO or PMCCNTR. 
e. Excludes exceptions that are generated because the value of HCR_EL2.TGE is 1, see The EC used to report an exception routed to EL2 
because HCR_EL2.TGE is 1 on page D1-2301. 
f. Applies only to traps of accesses to MVFRO, MVFR1, MVFR2, or FPSID. Includes traps of VMRS accesses. Because the MVFRz registers 
are read-only and a VMSR access to the FPSID is ignored and not trapped, there are no MCR or VMSR accesses that can be trapped with this EC 
value. 
g. Only as a result of HCR_EL2.TGE. 
h. Only as a result of HCR_EL2.TSC. 
i. Only if The Scalable Vector Extension (SVE) is implemented. Otherwise the EC value is reserved. 
j. Only if ARMv8.3-NV is implemented and HCR_EL2.NV is 1. 
k. Used for MMU faults generated by instruction accesses, and for synchronous External aborts, including synchronous parity or ECC errors. 
Not used for debug-related exceptions. 
1. Used for MMU faults generated by data accesses, Alignment faults other than SP alignment faults and PC alignment faults, and for 
synchronous External aborts, including synchronous parity or ECC errors. Not used for debug-related exceptions. 
m. Only as a result of HCR_EL2.TGE ==1 or MDCR_EL2.TDE ==1. 
n. Only if the BRK instruction is executed in EL3. This is the only debug exception that can be taken to EL3 when EL3 is using AArch64. 
Reserved EC values 
For EC values not shown in Table D1-8 on page D1-2297: 
° Unused EC values in the range 0b000000-0b101100 (0x00-0x2C) are reserved by Arm for future use for 
synchronous exceptions. 
e Unused EC values in the range 0b101101-0b111111 (0x2D-0x3F) are reserved by Arm for future use, and might 
be used for synchronous or asynchronous exceptions. 
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The EC used to report an exception routed to EL2 because HCR_EL2.TGE is 1 


When an exception is taken from ELO to EL2 because the value of HCR_EL2.TGE is 1, the exception is reported 
in ESR_EL2. The EC value and corresponding ISS encoding used to report the exception in ESR_EL2 depend on 
how an exception of the same class would be reported in ESR_EL1 when the value of HCR_EL2.{TGE, RW} is 


{0, 1}: 


: If the exception would have been reported in ESR_EL1 using the EC value 0x07 then it is reported in 
ESR_EL2 using the EC value 0x00 and corresponding ISS encoding. 


s Otherwise, the exception is reported in ESR_EL2 using the EC value and ISS encoding that would have been 
used to report the exception ESR_EL1. 


Reporting AArch32 synchronous exceptions taken to an Exception level using AArch64 


Although possible exception causes are generally similar for AArch32 state and AArch64 state, AArch32 state has 
additional exception taxonomy that is not present in AArch64 state. The following sections described named 
AArch32 exceptions that can, in some contexts, be taken to an Exception level that is using AArch64: 


° Undefined Instruction exception on page G1-5536. 


è Supervisor Call (SVC) exception on page G1-5540. 

è Secure Monitor Call (SMC) exception on page G1-5541. 
è Hypervisor Call (HVC) exception on page G1-5542. 

. Prefetch Abort exception on page G1-5543. 


° Data Abort exception on page G1-5547. 


When EL2 is using AArch64 and the value of HCR_EL2.TGE is 1, these exceptions are routed to EL2, and reported 
in the ESR_EL2. Table D1-9 shows how they are reported. 


Table D1-9 Syndrome reporting in ESR_EL2 of HCR_EL2 routing of exceptions 





AArch32 exception 


Pseudocode 


EC value used to report exception in ESR_ELx 





Undefined Instruction 


AArch32.UndefinedFault() 


0x00, Exception for an unknown reason 





Supervisor Call 


AArch32.CallSupervisor() 


0x11, Exception from SVC instruction executed in AArch32 state 





Secure Monitor Call 


See SMC on page F5-45204 


0x13, Exception from SMC instruction executed in AArch32 state 











Hypervisor Call AArch32.CallHypervisor() 0x12, Exception from HVC instruction executed in AArch32 state 
Prefetch Abort AArch32.Abort() 0x20, Exception from an Instruction abort at a lower Exception level 
Data Abort AArch32.Abort() 0x24, Exception from a Data abort at a lower Exception level 





a. The pseudocode in Operation for all encodings on page F5-4521 identifies when the execution of an SMC instruction in AArch32 
state generates an exception that is taken to EL3 using AArch64. 


D1.10.5 Summary of register updates on faults taken to an Exception level that is using AArch64 


For all exceptions taken to an Exception level using AArch64 that are not listed in Validity of FAR_ELx on 
page D1-2302, the FAR_ELx for the Exception level the exception is taken to is UNKNOWN. 


For all exceptions taken to EL2 using AArch64 that are not listed in Validity of HPFAR_EL2 on page D1-2302, the 
HPFAR_EL2 is UNKNOWN. 


The following sections give more information: 
. Validity of FAR_ELx on page D1-2302. 
è Validity of HPFAR_EL2 on page D1-2302. 
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D1-2302 


Validity of FAR_ELx 


The faulting virtual address is saved in FAR_ELx for the Exception level the exception is taken to if an exception 
is one of: 


° An Instruction Abort exception. 
. A Data Abort exception. 
. A PC alignment fault exception. 
. A Watchpoint exception. 


The architecture permits that the FAR_ELx is UNKNOWN for synchronous External aborts other than synchronous 
External aborts on translation table walks. In this case, the ISS.FnV bit returned in ESR_ELx indicates whether 
FAR_ELx is valid. 


If an exception is taken from an Exception level using AArch32 into an Exception level using AArch64, and that 
exception writes the FAR_ELx at the Exception level the exception is taken to, the most significant 32 bits of 
FAR_ELx are all zero, unless both of the following apply, in which case the most significant 32 bits of FAR_ELx 
are 0x00000001: 


è The faulting address was generated by a load or store that sequentially incremented from address 0xFFFFFFFF. 
Such a load or store instruction is CONSTRAINED UNPREDICTABLE, see Out of range VA on page K1-7616. 


7 The implementation treats such incrementing as setting bit[32] of the virtual address to 1. 


The FAR_ELx for an Exception level is made UNKNOWN as a result of an exception return from that Exception level. 


Validity of HPFAR_EL2 


The faulting IPA is saved in HPFAR_EL2 if the exception is an Instruction Abort or Data Abort taken to EL2 and 
the fault is one of: 


$ A Translation or Access Flag fault on a stage 2 translation. 
° A stage 2 Address Size fault. 
è A fault on the stage 2 translation of an address accessed in a stage 1 translation table walk. 


HPFAR_EL2 is made UNKNOWN as a result of an exception return from EL2. 
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In the Armv8-A architecture, an exception return is always to the same Exception level or a lower Exception level. 
An exception return is used for: 


$ A return to a previously executing thread. 

s Entry to a new execution thread. For example: 
— The initialization of a hypervisor by a Secure monitor. 
— The initialization of an operating system by a hypervisor. 
— Application entry from an operating system or hypervisor. 


If ARMv8.5-CSEH is not implemented, or if ARMv8.5-CSEH is implemented and the SCTLR_ELx.EOS field is 
set, exception return from ELx is a context synchronization event. 


An exception return requires the simultaneous restoration of the PC and PSTATE to values that are consistent with 
the desired state of execution on returning from the exception. The indirect write of the PSTATE information and 
the PC is synchronized even if the return is not a context synchronization event. 


In AArch64 state, an ERET instruction causes an exception return, see ERET on page C6-900. 


If ARMv8.2-IESB is implemented, when the SCTLR_ELx.IESB bit at the Exception level the exception is returning 
from is 1, the PE inserts an error synchronization event before the ERET instruction. See ARM Reliability, 
Availability, and Serviceability (RAS) Specification, ARMVv8, for the ARMv8-A architecture profile. 


On executing an ERET instruction at ELx: 
è The PC is restored with the value held in ELR_ELx. 
. PSTATE is restored by using the contents of SPSR_ELx. 


ELR_ELx and SPSR_ELx are the ELR_ELx and SPSR_ELx at the Exception level the exception is returning from. 
The exception return makes this ELR_ELx and SPSR_ELx UNKNOWN. 


See Address tagging in AArch64 state on page D5-2506 for details of how tagged addresses are handled in an 
Exception return from an Exception level using AArch64 to an Exception level using AArch64. 


Note 


When returning from an Exception level using AArch64 to an Exception level using AArch32, the top 32 bits of the 
ELR_ELx are ignored. 








An ERET instruction also: 


: Sets the Event Register for the PE executing the ERET instruction. See Mechanisms for entering a low-power 
state on page D1-2372. 


s Resets the local Exclusives monitor for the PE executing the ERET instruction. This removes the risk of errors 
that might be caused when a path to an exception return fails to include a CLREX instruction. 


Note 


This behavior prevents self-hosted debug from software stepping through a Load-Exclusive/Store-Exclusive 
pair. However, when self-hosted debug is using software step, it is highly probable that the Exclusives 
monitor state would be lost anyway, for other reasons. Stepping code that uses Exclusives monitors on 
page D2-2457 describes this. 








It is IMPLEMENTATION DEFINED whether the resetting of the local Exclusives monitor also resets the global 
Exclusives monitor. 


The ERET instruction is UNDEFINED in ELO. 


When returning from an Exception level using AArch64 to an Exception level using AArch32, the AArch32 context 
is restored. The Armv8-A architecture defines the relationship between AArch64 state and AArch32 state, for: 


. General-purpose registers. 
e Special-purpose registers. 
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s System registers. 


In an implementation that includes EL3, the Security state can only change on returning from an exception if the 
return is from EL3 to a lower Exception level. 


The following sections give more information: 

° Exception return and PC alignment. 

. Illegal return events from AArch64 state. 

. Legal returns that set PSTATE.IL to 1 on page D1-2306. 

a The Illegal Execution state exception on page D1-2306. 

. Pseudocode description of exception return on page D1-2306. 


D1.11.1 Exception return and PC alignment 


When SPSR_ELx.M[4] == 0, indicating an Exception return to AArch64 state, the value of ELR_ELx is transferred 
to the PC. If this value is misaligned, subsequent execution results in a PC alignment fault exception. 


When SPSR_ELx.M[4] == 1, indicating an Exception return to AArch32 state, the value of ELR_ELx is transferred 
to the PC except that, for a legal exception return: 

$ If SPSR_ELx.T is 0, ELR_ELx[1:0] are treated as being 0 for restoring the PC. 

s If SPSR_ELx.T is 1, ELR_ELx[0] is treated as being 0 for restoring the PC. 


This means that a PC alignment fault exception cannot occur following a legal exception return from AArch64 state 
to AArch32 state. However, where the Exception return with SPSR_ELx.M[4] == 1 is an illegal exception return 

then it is IMPLEMENTATION DEFINED whether a misaligned value in ELR_ELx is aligned when it is restored to the 
PC. 


Note 
In an implementation that forces the alignment of the PC value restored from SPSR_ELx on an illegal exception 
return with SPSR_ELx.M[4] == 1, if SPSR_ELx.T == 1 the restored PC value might give rise to a PC alignment 
fault exception, because the PE remains in AArch64 state and only ELR_ELx[0] is treated as being 0 for restoring 
the PC. 








For more information about the illegal exception return cases see ///egal return events from AArch64 state. 


D1.11.2 Illegal return events from AArch64 state 


In this section: 

Return In AArch64 state, refers to any of: 
e Execution of an ERET instruction. 
° Execution of a DRPS instruction in Debug state. 
. Exit from Debug state. 


Saved process state value 
In AArch64 state, refers to any of: 


: The value held in the SPSR_ELx for an ERET instruction. 
s The value held in the SPSR_ELx for a DRPS instruction executed in Debug state. 
: The value held in the DSPSR_ELO for a Debug state exit. 
Link address In AArch64 state, refers to any of: 
5 The address held in ELR_ELx for an ERET instruction. 
à The address held in DLR_ELO for a Debug state exit. 


Configured from reset 
Indicates the state determined on powerup or reset by a configuration input signal, or by another 
IMPLEMENTATION DEFINED mechanism. 
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The Armv§8 architecture has a generic mechanism for handling returns to a mode or state that is illegal. In AArch64 
state, this can occur as the result of any of the following situations: 


A return where the Exception level being returned to is higher than the current Exception level. 


A return where the Exception level being returned to is not implemented. For example a return to EL2 when 
EL2 is not implemented. 


A return to EL2 when EL3 is implemented and the value of the SCR_EL3.NS bit is 0 if ARMv8.4-SecEL2 
is not implemented. 


A return to EL1 when EL2 is implemented and the value of the HCR_EL2.TGE bit is 1. 


A return where the value of the saved process state M[4] bit is 0, indicating a return to AArch64 state, and 
one of the following is true: 

— The M[1] bit is 1. 

— The M[3:0] bits are 0b0001. 


— The Exception level being returned to is using AArch32 state, as programmed by the SCR_EL3.RW 
or HCR_EL2.RW bits, or as configured from reset. 


A return where the value of the saved process state M[4] bit is 1, indicating a return to AArch32 state, and 
one of the following is true: 


— The M field value is not a valid AArch32 state PE mode. Table D1-4 on page D1-2282 shows the valid 
M[3:0] values for AArch32 state PE modes. This includes the case where M[3:0] is 0b0000, indicating 
User mode, and ELO does not support AArch32 state. 


— The Exception level being returned to is using AArch64 state as determined by the SCR_EL3.RW or 
HCR_EL2.RW field or the configuration from reset. This includes the case where the Exception level 
being returned to does not support AArch32 state. 


Note 


This means that, in an implementation that supports only AArch64 state, any attempt to return to AArch32 
state is an illegal exception return. 








A Debug state exit from ELO using AArch64 state, to ELO using AArch32 state. 


In these cases: 


PSTATE.IL is set to 1, to indicate an illegal return. 


PSTATE. {EL, nRW, SP} are unchanged. This means the Exception level, Execution state, and stack pointer 
selection do not change as a result of the return. 


The following PSTATE bits are restored from the saved process state value: 
—  TheN, Z, C, V Condition flags. 
— The D, A, I, F exception mask bits. 


If the illegal return is an illegal exception return, the PSTATE.SS bit is handled as normal for a return. That 
is, the SS bit is handled in the same way as an exception return that is not an illegal exception return. See 
Software Step exceptions on page D2-2446. 


In all these cases the PSTATE.SS bit is handled as it would be for a normal return, as described in Entering 
the active-not-pending state on page D2-2448 and Exiting Debug state on page H2-6740. DRPS never sets 
the SS bit. This is indicated in Entering the active-not-pending state on page D2-2448. 


If the illegal return is not a DRPS instruction executed in Debug state, the PC is restored from the link address. 
However, if the value of the M[4] bit of the saved process state is 1, indicating a return to AArch32 state, then: 


—  Bits[31:2] of the PC are restored from the link address. 
—  Bits[63:32, 1:0] of the PC are UNKNOWN. 
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D1.11.3 


D1.11.4 


D1.11.5 


D1-2306 


When the value of the PSTATE.IL bit is 1, any attempt to execute any instruction results in an Illegal Execution state 
exception. See The Illegal Execution state exception. 


All aspects of the illegal return, other than the effects described in this section, occur as they do for a legal return. 


Legal returns that set PSTATE.IL to 1 


In this section, return, saved process state value, and link address have the same meaning as defined in J//egal return 
events from AArch64 state on page D1-2304. 


If the value of the IL bit in the saved process state is 1, then it is copied to PSTATE by a return, meaning that 
PSTATE.IL is set to 1. In this case, if the return is not an illegal return, and targets AArch32 state, then the 
PSTATE. {IT, T} bits are either: 


a Set to 0. 
. Copied from the saved process state value. 
The choice between these two options is determined by an implementation, and might vary dynamically within the 


implementation. Correspondingly software must regard the value as being an UNKNOWN choice between the two 
values. 


The PSTATE.{IT, T} bits are only valid in AArch32 state, see Process state, PSTATE on page G1-5493. 


When the PSTATE.IL bit is 1, any attempt to execute any instruction results in an Illegal Execution state exception. 
See The Illegal Execution state exception. 


The Illegal Execution state exception 


When the value of the PSTATE.IL bit is 1, any attempt to execute any instruction results in an Illegal Execution state 
exception. In AArch64 state, the PSTATE.IL bit can be to set to 1 by any of: 


$ An illegal return, as described in //legal return events from AArch64 state on page D1-2304. 
s A legal return that sets PSTATE.IL to 1, as described in Legal returns that set PSTATE.IL to 1. 


If an Illegal Execution state exception is generated at ELO, it is taken to EL1. If the exception occurs when EL2 is 
implemented and enabled in the current Security state, and HCR_EL2.TGE == 1, then itis taken to EL2. If an Illegal 
Execution state exception is generated at any other Exception level, the Exception level is unchanged. 


An Illegal Execution state exception sets ESR_ELx.EC for the target Exception level to the value of 0x0E. 
On taking any exception to an Exception level that is using AArch64 state: 


1. The value of the PSTATE.IL bit is copied into the SPSR_ELx.IL bit for the Exception level to which the 
exception is taken. 


2. The PSTATE.IL bit is cleared to 0. 


Note 
This means that it is not possible for software to observe the value of PSTATE.IL. 








For the priority of this exception class, see Synchronous exception prioritization for exceptions taken to AArch64 
state on page D1-2308. 


Pseudocode description of exception return 


The AArch64.ExceptionReturn() pseudocode function transfers the return address to the PC, and restores PSTATE 
to its saved value by calling SetPSTATEFromPSR(). 


The I]legalExceptionReturn() function checks for an Illegal Execution state exception. 
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D1.12 Synchronous exception types, routing and priorities 


Synchronous exceptions are: 


Any exception generated by attempting to execute an instruction that is UNDEFINED, including: 
— Attempts to execute instructions at an inappropriate Exception level. 

— Attempts to execute instructions when they are disabled. 

— Attempts to execute instruction bit patterns that have not been allocated. 


Illegal Execution state exceptions. These are caused by attempts to execute an instruction when the value of 
PSTATE.IL is 1, see //legal return events from AArch64 state on page D1-2304. 


Exceptions caused by the use of a misaligned SP. 
Exceptions caused by attempting to execute an instruction with a misaligned PC. 
Exceptions caused by the exception-generating instructions SVC, HVC, or SMC. 


Traps on attempts to execute instructions that the System registers define as instructions that are trapped to a 
higher Exception level. See Configurable instruction enables and disables, and trap controls on 
page D1-2326. 


Instruction Aborts generated by the memory address translation system that are associated with attempts to 
execute instructions from areas of memory that generate faults. 


Data Aborts generated by the memory address translation system that are associated with attempts to read or 
write memory that generate faults. 


Data Aborts caused by a misaligned address. 


Data Aborts caused by a Tag Check Fail if ARMv8.5-MemTag is implemented, for more information see 
Chapter D6 Armv8.5 Memory Tagging Extension. 


All of the debug exceptions: 

— Breakpoint Instruction exceptions. 
— Breakpoint exceptions. 

—  Watchpoint exceptions. 

— Vector Catch exceptions. 

— Software Step exceptions. 


In an implementation that supports the trapping of floating-point exceptions, exceptions caused by trapped 
IEEE floating-point exceptions, see Floating-point exceptions and exception traps on page D1-2313. 


In some implementations, External aborts. External aborts are failed memory accesses, and include accesses 
to those parts of the memory system that occur during the address translation. The Armv8 architecture 
permits, but does not require, implementations to treat such exceptions synchronously. See External aborts 
on page D4-2496. 


This remainder of this section contains the following: 


Routing exceptions from ELO to EL2. 

Routing debug exceptions to EL2 on page D1-2308. 

Routing synchronous External aborts on page D1-2308 

Synchronous exception prioritization for exceptions taken to AArch64 state on page D1-2308. 
Effect of Data Aborts on page D1-2312. 

Floating-point exceptions and exception traps on page D1-2313. 


D1.12.1 Routing exceptions from ELO to EL2 
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When EL2 is enabled in the current Security state and the value of HCR_EL2.TGE is 1, any exception taken from 
ELO that would otherwise be taken to EL] is, instead, routed to EL2. This means that an application can execute at 
ELO without using any functionality at EL1. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D1-2307 
Non-Confidential 


The AArch64 System Level Programmers’ Model 
D1.12 Synchronous exception types, routing and priorities 


Note 


$ When EL2 is using AArch64 state, the HCR_EL2.TGE control applies regardless of whether ELO is using 
AArch32 state or AArch64 state. 





g Implementations typically use the following Exception level and software hierarchy: 
EL2 Hypervisor. 
ELI Operating system. 
ELO Application. 


In such an implementation, setting HCR_EL2.TGE to 1 means that an application can run at ELO under the 
direct control of a hypervisor executing at EL2, with no operating system involvement. 


D1.12.2 Routing debug exceptions to EL2 


When EL2 is enabled in the current Security state and the value of MDCR_EL2.TDE is 1, debug exceptions are 
routed to EL2. For more information see Routing debug exceptions on page D2-2403. 


When the value of MDCR_EL2.TDE is 1, each of the MDCR_EL2.{TDRA, TDOSA, TDA} bits is treated as 1 for 
all purposes other than direct reads of the MDCR_EL2. 


D1.12.3 Routing synchronous External aborts 
When the value of SCR_EL3.EA is 1, synchronous external aborts are taken to EL3. 
When the RAS Extension is implemented, EL2 is enabled in the current Security state, and the value of 
HCR_EL2.TEA is 1, synchronous external aborts from ELO and EL] that are not routed to EL3 are routed to EL2. 


D1.12.4 Synchronous exception prioritization for exceptions taken to AArch64 state 


In principle, any single instruction can generate a number of different synchronous exceptions, between the fetching 
of the instruction, its decode, and eventual execution. For exceptions taken to an Exception level that is using 
AArch64, these are prioritized as follows, where 1 is the highest priority. 





Note 


The priority numbering in this list correlates with the equivalent AArch32 state list in Synchronous exception 
prioritization for exceptions taken to AArch32 state on page G1-5505 and the list in Debug state entry and debug 
event prioritization on page H2-6707. 


1-3 These priority numbers represent debug events. 

4 Software Step exceptions. See Software Step exceptions on page D2-2446. 

5 This priority number represents debug events. 

6 PC alignment fault exceptions. See PC alignment checking on page D1-2287. 

7 Instruction Abort exceptions. See AArch64 state prioritization of synchronous aborts from a single 


stage of address translation on page D5-2629. 


8 Breakpoint exceptions or Address Matching Vector Catch exceptions. See: 
$ Breakpoint exceptions on page D2-2413. 
7 Vector Catch exceptions on page D2-2445. 
Vector Catch exceptions are only taken from AArch32 state. 
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Note 


An Exception Trapping Vector Catch exception is generated on exception entry for an exception that 
has been prioritized as described in Synchronous exception prioritization for exceptions taken to 
AArch32 state on page G1-5505. This means that it is outside the scope of the description of this 








section. 
9 Illegal Execution state exceptions. See Ilegal return events from AArch64 state on page D1-2304. 
10 Software Breakpoint exceptions caused by the execution of a Breakpoint instruction: 


° For exceptions taken from AArch64 state, BRK. 
e For exceptions taken from AArch32 state, BKPT. 
11 Branch Target exceptions generated for an instruction that lies within a guarded page if 
PSTATE.BTYPE field is not 0b00 and if the instruction is not any of: 
A BTI instruction that is compatible with the PSTATE.BTYPE field. 


à A PACIASP or PACIBSP instruction, and the PSTATE.BTYPE is consistent with implicit BTI 
behavior of these instructions. 


à A Breakpoint Instruction exception. 

° A Halt Instruction debug event. 

A Branch Target exception is taken to: 

: EL1 when executing at ELO and HCR_EL2.E2H==0. 

° EL2 when executing at ELO and HCR_EL2.E2H==1. 

s ELx when executing at ELx. 

For more information on Branch Target exception see [SS encoding for an exception from Branch 


Target Identification instruction on page D13-3032. 


12 Exceptions taken from EL1 to EL2 because of one of the following configuration settings: 
° HSTR_EL2.Tn. 
° HCR_EL2.TIDCP. 
s If ARMv8.3-NV is implemented, HCR_EL2.NV or HCR_EL2.NV1. 


Note 


If ARMv8.4-NV is implemented and HCR_EL2.{NV, NV1, NV2} are set such that register 
accesses to EL1 are transformed into memory accesses, then HCR_EL2{NV, NV1} do not generate 
exceptions to EL2. 








13 Exceptions that occur as a result of attempting to execute an instruction that is UNDEFINED for one 

or more of the following reasons: 

° Attempting to execute an unallocated instruction encoding, including an encoding for an 
instruction that is not implemented in the PE implementation. 

è Attempting to execute an instruction that is defined never to be accessible at the current 
Exception level regardless of any enables or traps. 

. Debug state execution of an instruction encoding that is unallocated in Debug state. 

s Non-debug state execution of an instruction encoding that is unallocated in Non-debug state. 

° Execution of an HVC instruction, when HVC instructions are disabled by SCR_EL3.HCE or 
HCR_EL2.HCD. 

Execution of an MSR or MRS instruction to SP_ELO when the value of SPSel is 0. 


a Execution ofan HLT instruction when HLT instructions are disabled by EDSCR.HDE or halting 
is prohibited. 


° In Debug state: 
— Execution of a DCPS1 instruction in Non-secure ELO when HCR_EL2.TGE is 1. 
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— Execution of a DCPS2 instruction in EL1 or ELO when EL2 is disabled in the current 
Security state or is not implemented. 


— Execution of a DCPS3 instruction when EDSCR.SDD is 1 or when EL3 is not 


implemented. 


— When the value of EDSCR.SDD is 1, execution in EL2, EL1, or ELO of an instruction 
that is configured by EL3 control registers to trap to EL3. It is IMPLEMENTATION 
DEFINED whether this type of exception is prioritized at this level or has the priority of 
the original trap exception. 


à When executing in AArch32 state, execution of an instruction that is UNDEFINED as a result 
of any of: 


— Being in an IT block when SCTLR_EL1.ITD is 1. 
— Executing a SETEND instruction executed SCTLR_EL1.SED. 


— Executing a CP15DMB, CP15DSB, or CP15ISB barrier instruction when 
SCTLR_EL1.CP15BEN is 0. 


Note 


These are the controls for exceptions taken to AArch64 state. For exceptions taken to 
AArch32 state the equivalent controls are SCTLR. {ITD, SED, CP15BEN}, with additional 
controls HSCTLR. {ITD, SED, CP15BEN}. 








See Disabling or enabling ELO use of AArch32 deprecated functionality on page D1-2330 


s When executing in AArch32 state, execution of an instruction that is UNDEFINED because at 
least one of FPCR. {Stride, Len} is nonzero, when programming these bits to nonzero values 
is supported. See Floating-point exceptions and exception traps on page G1-5574. 


Note 


— This case applies only when ELO is using AArch32 and EL] is using AArch64. The 
exception generated by the attempted execution at ELO of the UNDEFINED instruction 
is taken to EL1 using AArch64. 


— When ELl is using AArch32, the corresponding controls are FPSCR. {Stride, Len}, 
and any exception generated by the attempted execution at ELO or EL1 of an 
instruction that is UNDEFINED because of a nonzero {Stride, Len} value is taken to EL1 
using AArch32. 








14 Exceptions taken to EL1, or taken to EL2 because the value of HCR_EL2.TGE is 1, that are 
generated because of configurable access to instructions, and that are not covered by any of 
priorities 4-13. 

Note 

When EL2 is using AArch32, the equivalent control for routing exceptions to EL2 is HCR.TGE. 








15 Exceptions taken from ELO to EL2 because of one of the following configuration settings: 
° HSTR_EL2.Tn. 
° HCR_EL2.TIDCP. 


Note 


These are the controls for exceptions taken to AArch64 state. For exceptions taken to AArch32 state 
the equivalent controls are HSTR.Tn and HCR.TIDCP. 








16 Exceptions taken to EL2 because of configuration settings in CPTR_EL2. 
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Note 


These are the controls for exceptions taken to AArch64 state. For exceptions taken to AArch32 
state, the equivalent controls are in HCPTR. 





Exceptions taken to EL2 because of one of the following configuration settings: 
à Any setting in HCR_EL2 other than the {TIDCP, NV} fields. 

. Any setting in CNTHCTL_EL2. 

s Any setting in MDCR_EL2. 


Note 
These are the controls for exceptions taken to AArch64 state. For exceptions taken to AArch32 
state, equivalent controls are: 
° Settings in HCR, other than the TIDCP bit. 
For exceptions taken to AArch32 state there is no control equivalent to HCR_EL2.NV. 
3 Any setting in CNTHCTL or HDCR. 








Exceptions taken to EL2 because of configurable access to instructions, and that are not covered by 
any of priorities 4-17. 


Exceptions caused by the SMC instruction being UNDEFINED because the value of SCR_EL3.SMD is 
1. 


Exceptions caused by the execution of an Exception generating instruction not covered by priority 
10: 


. For exceptions taken from AArch64 state, Branches, Exception generating, and System 
instructions on page C3-190 defines these and the priority 10 instructions. 


a When executing in AArch32 state, the exception-generating instructions are SVC, HVC, and SMC. 
Exceptions taken to EL3 because of configuration settings in the CPTR_EL3. 


— Note 

When in Debug state and the value of EDSCR.SDD is 1, instructions executed at EL2, EL1 or ELO 
that are configured by EL3 control registers to trap to EL3 are treated as UNDEFINED and generate 
an exception taken to EL2 or EL1. It is IMPLEMENTATION DEFINED whether these exceptions are 
prioritized as an UNDEFINED instruction or have the priority of the original trap exception. 





Exceptions taken to EL3 from Secure EL1 using AArch32, because of execution of the instructions 
listed in Traps to EL3 of Secure monitor functionality from Secure EL1 using AArch32 on 
page D1-2361. 


Exceptions taken to EL3 from ELO, EL1, or EL2 because of configuration settings in the 
MDCR_EL3. 


Note 

When in Debug state and the value of EDSCR.SDD is 1, instructions executed at EL2, EL1 or ELO 
that are configured by EL3 control registers to trap to EL3 are treated as UNDEFINED and generate 
an exception taken to EL2 or EL1. It is IMPLEMENTATION DEFINED whether these exceptions are 
prioritized as an UNDEFINED instruction or have the priority of the original trap exception. 








Exceptions taken to EL3 because of configurable access to instructions, and that are not covered by 
any of priorities 4-23. 
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D1.12.5 


D1-2312 


25 


26 


27 


28 


29 


30 





Note 

When in Debug state and the value of EDSCR.SDD is 1, instructions executed at EL2, EL1 or ELO 
that are configured by EL3 control registers to trap to EL3 are treated as UNDEFINED and generate 
an exception taken to EL2 or EL1. It is IMPLEMENTATION DEFINED whether these exceptions are 
prioritized as an UNDEFINED instruction or have the priority of the original trap exception. 





Trapped floating-point exceptions, if supported. See Floating-point exceptions and exception traps 
on page D1-2313. 


This priority number represents debug events. 
SP alignment faults. See SP alignment checking on page D1-2287. 


Data Abort exceptions other than a Data Abort exception generated by a synchronous External abort 
that was not generated by a translation table walk or the update of a page table entry. That is, any 
Data Abort exception that is not covered by item 30. See AArch64 state prioritization of 
synchronous aborts from a single stage of address translation on page D5-2629. It is 
IMPLEMENTATION DEFINED whether synchronous External aborts are prioritized here or as item 30. 


Watchpoint exceptions. See Watchpoint exceptions on page D2-2431. 


Data Abort exception: 


. Generated by a synchronous External abort that was not generated by a translation table walk 
or the update of a page table entry, see External aborts on page D4-2496. 


: If ARMv8.5-MemTag is implemented and enabled Tag Check Fails are prioritized as Data 
Abort. For more information see PE handling of Tag Check failure on page D6-2666. 


. It is IMPLEMENTATION DEFINED whether synchronous External aborts are prioritized here or 
as item 28. 


For items 28-30, if an instruction results in more than one single-copy atomic memory access, the prioritization 
between synchronous exceptions generated on each of those different memory accesses is not defined by the 


architecture. 





Note 


Exceptions generated by a translation table walk are reported and prioritized as either an Instruction Abort 
exception, priority 7 in this list, or a Data Abort exception, priority 28 in this list. See also AArch64 state 
prioritization of synchronous aborts from a single stage of address translation on page D5-2629. 





Effect of Data Aborts 


If an instruction that stores to memory generates a Data Abort, the value of each memory location that instruction 
stores to is either: 


Unchanged, if one of the following applies: 


An Alignment fault is generated. 

An MMU fault is generated. 

A Watchpoint exception is generated. 

An External abort is generated, if that External abort is taken synchronously. 


Note 


If an External abort is taken asynchronously, using the SError interrupt, it is outside the scope of the 
architecture to define the effect of the store on the memory location, because it depends on the 
system-specific nature of the External abort. However, in general, Arm recommends that such memory 
locations are not updated. 








UNKNOWN for any location for which no exception and no debug event is generated. 
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For External aborts and Watchpoint exceptions, the size of a memory location is defined as being the size for which 
a memory access is single-copy atomic. 





Note 


For the definition of a single-copy atomic access, see Properties of single-copy atomic accesses on page B2-112. 





An External abort might signal a data corruption to the PE. For example a memory location might have been 
corrupted. The error that caused the External abort might have been propagated. The RAS Extension provides 
mechanisms for software to determine the extent of the corruption and contain propagation of the error. For more 
information, see the ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMv8, for the 
ARMVv8-A architecture profile. 


For Data Aborts from load or store instructions executed in AArch6é4 state, if the: 


Data Abort is taken synchronously 


° If the load or store instruction specifies writeback of a new base address, the base address is 
restored to the original value on taking the exception. 


š If the instruction was a load to either the base address register or the offset register, that 
register is restored to the original value. Any other destination registers become UNKNOWN. 


. If the instruction was a load that does not load the base address register or the offset register, 
then the destination registers become UNKNOWN. 
Data Abort is taken asynchronously, using the SError interrupt 


If the instruction was a load, the destination registers of the load take an UNKNOWN value if the 
SError interrupt is taken at a point in the instruction stream after the load. 


D1.12.6 Floating-point exceptions and exception traps 
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Execution of a floating-point instruction, or an Advanced SIMD instruction that performs floating-point operations, 
can generate an exceptional condition, called a floating-point exception. 


Note 


In AArch64 state, a floating-point instruction performs only a single floating-point operation. However, an 
Advanced SIMD instruction that operates on floating-point values can perform multiple floating-point operations. 
Therefore, this section describes the handling of a floating-point exception on an operation, rather than on an 
instruction. 








The Armv8-A architecture supports synchronous exception generation in the event of any or all of the following 
floating-point exceptions: 


. Input Denormal. 

. Inexact. 

R Underflow. 

F Overflow. 

. Divide by Zero. 

s Invalid Operation. 


Whether an implementation includes synchronous exception generation for these floating-point exceptions is 
IMPLEMENTATION DEFINED: 


: For an implementation that does provide this capability, FPCR. {IDE, IXE, UFE, OFE, DZE, IOE} are the 
control bits that enable synchronous exception generation for each of the different floating-point exceptions. 


° For an implementation that does not provide this capability, the FPCR. {IDE, IXE, UFE, OFE, DZE, IOE} 
bits are RAZ/WI. 
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D1-2314 


Note 


° An Input Denormal floating-point exception is generated when a single-precision or double-precision 
floating-point value is flushed-to-zero because the value of FPCR.FZ is 1. However, no Input Denormal 
exception is generated when a half-precision floating-point value is flushed-to-zero because the value of 
FPCR.FZ16 is 1. 





° The Armv8-A architecture does not support asynchronous reporting of floating-point exceptions. 





When generating synchronous exceptions for one or more floating-point exceptions is enabled, the synchronous 
exceptions generated by the floating-point exception traps are taken to the lowest Exception level that can handle 
such an exception, while adhering to the rule that an exception can never be taken to a lower Exception level. 


The exception is reported in the ESR_ELx for the Exception level to which it is taken. 


In an implementation that includes synchronous exception generation for floating-point exceptions in AArch64 
state: 


: The registers that are presented to the exception handler are consistent with the state of the PE immediately 
before the instruction that caused the exception. An implementation is permitted not to restore the cumulative 
exception bits in the event of such an exception. For more information see Combinations of floating-point 
exceptions. 


s When the execution of separate operations in separate SIMD elements causes multiple floating-point 
exceptions, the ESR_ELx reports one exception associated with one element that the instruction uses. The 
architecture does not specify which element is reported, however the element that is reported is identified in 
the ESR_ELx. 


The AArch64.FPTrappedException() and FPProcessException() pseudocode functions describe the handling of 
trapped floating-point exceptions generated in AArch64 state. 


Combinations of floating-point exceptions 


Many pseudocode functions perform floating-point operations, including FixedToFP(), FPAdd(), FPCompare(), 
FPCompareEQ(), FPCompareGE(), FPCompareGT(), FPDiv(), FPMax(), FPMin(), FPMul(), FPMulAdd(), FPRecipEstimate(), 
FPRecipStepFused(), FPRSqrtEstimate(), FPRSqrtStepFused(), FPSqrt(), FPSub(), and FPToFixed(). All of these 
operations can generate floating-point exceptions. 





Note 
FPAbs() and FPNeg() are not classified as floating-point operations because: 
$ They cannot generate floating-point exceptions. 
° The floating-point operation behavior described in the following sections does not apply to them: 


— Flush-to-zero on page A1-54. 
— NaN handling and the Default NaN on page A1-55. 





More than one floating-point exception can occur on the same operation. The only combinations of floating-point 
exceptions that can occur are: 


è Overflow with Inexact. 
: Underflow with Inexact. 
: Input Denormal with other floating-point exceptions. 


The priority order of these floating-point exceptions is that the Inexact exception is treated as lowest priority, and 
the Input Denormal exception is treated as highest priority. 


Some floating-point instructions specify more than one floating-point operation, as indicated by the pseudocode 
descriptions of the instruction. In such cases, a floating-point exception on one operation is treated as higher priority 
than a floating-point exception on another operation if the occurrence of the second floating-point exception 
depends on the result of the first operation. Otherwise, it is CONSTRAINED UNPREDICTABLE which floating-point 
exception is treated as higher priority, where the exception prioritized might differ between different instances of 
the same two floating-point exceptions being generated on the same operation during execution of the instruction. 
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When none of the floating-point exceptions caused by an operation is trapped, any floating-point exception that 
occurs causes the associated cumulative bit in the FPSR to be set to 1. 


When a floating-point exception is trapped: 


° It is IMPLEMENTATION DEFINED whether the FPSR is restored when the trapped floating-point exception is 
taken. If the FPSR is not restored then, then it is CONSTRAINED UNPREDICTABLE which untrapped 
floating-point exception, if any, are indicated by the corresponding FPSR cumulative exception bits having 
the value 1. 


s In the ESR_ELx for the Exception level to which the trapped exception is taken, the value of the 
floating-point exception trapped bit for the highest priority trapped floating-point exception must be 1. 


In this ESR_ELx: 


— The value of the floating-point exception trapped bit for any other untrapped floating-point exception 
generated by the same operation must be 0. This applies to both higher priority and lower priority 
untrapped floating point exceptions. 


— The value of the floating-point exception trapped bit for any lower priority trapped floating-point 
exception generated by the same operation might be 1, but the architecture does not require this. 


For trapped floating-point exceptions from Advanced SIMD instructions, the architecture does not define the 
floating-point exception prioritization between different elements of the instruction. The architectural requirements 
for floating-point exception prioritization apply only to multiple floating-point exceptions generated on the same 
element of an Advanced SIMD operation. 





Note 


An implementation might provide information about a lower priority or untrapped floating-point exceptions in an 
IMPLEMENTATION DEFINED way, for example using an IMPLEMENTATION DEFINED register. 
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D1.13 Asynchronous exception types, routing, masking and priorities 


In the Armv8-A architecture, asynchronous exceptions that are taken to AArch64 state are also known as interrupts. 


There are two types of interrupts: 


Physical interrupts Are signals sent to the PE from outside the PE. They are: 


° SError. System Error. 
° IRQ. 
° FIQ. 


Virtual interrupts Are interrupts that software executing at EL2 can enable and make pending. A virtual 


interrupt is taken from ELO or EL1 to EL1. 


Virtual interrupts have names that correspond to the physical interrupts: 


€ vSError. 
° vIRQ. 
° vFIQ. 





Note 


For information about how virtual interrupts might be used see Virtual interrupt usage model on 
page D1-2276. 


The SError interrupt replaces the Armv7 asynchronous abort. The new name better describes the nature of 
the exception, and means that, in AArch64 state, it is categorized as a unique exception class, with EC 
encoding 0x2F. 





An External abort generated by the memory system might be taken asynchronously using the SError interrupt. 
These SError interrupts always behave as edge-triggered interrupts. An implementation might include other sources 
of SError interrupt. It is IMPLEMENTATION DEFINED whether these other sources are edge-triggered or 
level-sensitive. See also External aborts on page D4-2496. 


Each physical interrupt type can be assigned a target Exception level of EL1, EL2 or EL3, as shown in Asynchronous 
exception routing on page D1-2317. 


When an interrupt occurs: 


On taking an SError or a vSError interrupt to an Exception level using AArch64, the Exception Syndrome 
register for that Exception level is updated to describe an SError interrupt. 


When the RAS Extension is implemented, the exception syndrome for the vSError interrupt is taken from the 
values in the VSESR_EL2 register. See Exception classes and the ESR_ELx syndrome registers on 

page D1-2296, and the ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMV8, for the 
ARMVv8-A architecture profile. 


On taking an IRQ, vIRQ, FIQ or vFIQ interrupt to an Exception level using AArch64, the Exception 
Syndrome register for that Exception level is not updated. 


The remainder of this section contains the following: 


D1-2316 


Asynchronous exception routing on page D1-2317. 
Asynchronous exception masking on page D1-2320. 

Virtual interrupts on page D1-2322. 

Prioritization and recognition of interrupts on page D1-2324. 


Taking an interrupt or other exception during a multiple-register load or store on page D1-2325. 
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D1.13.1 Asynchronous exception routing 
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The following tables show the routing of physical interrupts when the highest implemented Exception level is using 
AArch64: 


s For implementations that include both EL2 and EL3, see Table D1-10. 
š For implementations that include EL3 but not EL2, see Table D1-11 on page D1-2318. 
$ For implementations that include EL2 but not EL3, see Table D1-12 on page D1-2319. 


When the highest implemented Exception level is using AArch32, see Table G1-19 on page G1-5534. 
In the tables: 
SCR This is the Effective value of a field in SCR. 


FIQ IRQ EA The Effective value of the field that handles the asynchronous exception type in SCR, if the highest 
EL is using AArch32, or SCR_EL3, if the highest EL is using AArch64. 


HCR This is the Effective value of a field in HCR, if EL2 is using AArch32 or HCR_EL2 if EL2 is using 
AArché4. 
When the value of the TGE is 1, the virtual exceptions are disabled. 
When the Effective value of HCR.{E2H, TGE} is: 
{0, 1} The Effective value of each of the HCR.{AMO, IMO, FMO} fields is 1. 
{1, 1} The Effective value of each of the HCR.{AMO, IMO, FMO} fields is 0. 


FMO IMO AMO The Effective value of the mask override field for the asynchronous exception type in HCR, if 
EL2 is using AArch32 or HCR_EL2 if EL2 is using AArch64. 


EL2 The exception is taken to EL2 using AArch64. 
EL3 The exception is taken to EL3 using AArch64. 
C The interrupt is not taken and remains pending, regardless of the PSTATE. {A, I, F} interrupt masks. 


FIQ IRQ Abt The exception is taken to the FIQ mode, the IRQ mode or the Abort mode according to the type of 
asynchronous exception. 


Hyp The exception is taken to AArch32 Hyp mode. 
Mon The exception is taken to AArch32 Monitor mode. 
n/a Not applicable. The field does not exist in the register in this configuration or the Exception level is 


not accessible in this configuration. 


Table D1-10 Routing when both EL3 and EL2 are implemented 






































SCR HCR Target | Target | Target | Target 
when when when when 
EA AMO taken taken taken taken 
NS EEL22 IRQ RW | TGE IMO E2H | RW | from from from from 
FIQ FMO ELO EL1 EL2 EL3 
0 0 0 0 x x xX x FIQ FIQ n/a C 
IRQ IRQ 
Abt Abt 
1 X X xX x ELI ELI n/a C 
1 X x X x x EL3 EL3 n/a EL3 
1 0 x 0 0 0 0 FIQ FIQ C C 
IRQ IRQ 
Abt Abt 
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Table D1-10 Routing when both EL3 and EL2 are implemented (continued) 






























































SCR HCR Target | Target | Target | Target 
when when when when 
EA AMO taken taken taken taken 
NS EEL22 IRQ RW | TGE IMO E2H | RW | from from from from 
FIQ FMO ELO EL1 EL2 EL3 
1 ELI EL1 C C 
1 x EL1 EL1 C C 
1 x x EL2 EL2 EL2 C 
1 x x x EL2 n/a EL2 C 
1 x 0 X x x EL3 EL3 EL3 EL3 
1 x x x EL3 n/a EL3 EL3 
1 x 0 0 0 0 n/a n/a FIQ FIQ Hyp C 
IRQ IRQ 
Abt Abt 
1 n/a n/a Hyp Hyp Hyp C 
1 x n/a n/a Hyp n/a Hyp C 
1 0 0 0 0 FIQ FIQ C C 
IRQ IRQ 
Abt Abt 
1 EL1 EL1 C C 
1 x EL1 EL1 C C 
1 x x EL2 EL2 EL2 C 
1 x x x EL2 n/a EL2 C 
1 R 0 x x x EL3 EL3 EL3 EL3 
1 x x x EL3 n/a EL3 EL3 

















a. When the implementation does not include ARMv8.4-SecEL2, the SCR_EL3.EEL2? field is not implemented and 
the Effective value of EEL2 is 0. 


Table D1-11 Routing when EL3 is implemented and EL2 is not implemented 














SCR_EL3 | Target Exception level when executing at 
EA 
IRQ ELO EL1 EL3 
FIQ 
0 ELI ELI C 
1 EL3 EL3 EL3 
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Table D1-12 Routing when EL3 is not implemented and EL2 is implemented 




















HCR_EL2 Target Exception level when executing at 
AMO 

TGE IMO ELO EL1 EL2 
FMO 

0 0 ELI EL1 C 
1 EL2 EL2 EL2 

1 x EL2 n/a EL2 

Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D1-2319 


Non-Confidential 


The AArch64 System Level Programmers’ Model 
D1.13 Asynchronous exception types, routing, masking and priorities 


D1.13.2 


D1-2320 


Asynchronous exception masking 


When an interrupt is masked, it means that it cannot be taken. Instead, it remains pending. 


When executing in AArch64 state, interrupts are masked implicitly when the target Exception level of the interrupt 
is lower than the current Exception level. 


In addition, interrupts can be masked when the target Exception level is the current Exception level. The controls 
for this are: 


SError PSTATE.A 
IRQ PSTATE.I 
FIQ PSTATE.F 


When the target Exception level is higher than the current Exception level: 
s If the target Exception level is EL3, the interrupt cannot be masked by the PSTATE. {A, I, F} bits. 


à If the target Exception level is EL2, and either HCR_EL2.E2H is 0 or HCR_EL2.TGE is 0, the interrupt 
cannot be masked by the PSTATE. {A, I, F} bits. 


s If the target Exception level is EL2, HCR_EL2.E2H is 1, and HCR_EL2.TGE is 1, the interrupt can be 
masked by the PSTATE. {A, I, F} bits. 


: If the target Exception level is EL1, the interrupt can be masked by the PSTATE. {A, I, F} bits. 





Note 


° The ability to execute in ELO with interrupts to EL1 masked is required by some user level driver code. 
: The PSTATE. {A, I, F} bits can mask both physical interrupts and virtual interrupts. 


. The Armv8-A architecture does not support Non-maskable FIQ (NMFI) operations. This means that it does 
not provide a configuration option to override the masking of FIQs by PSTATE.F. 





On taking any exception to an Exception level using AArch64, all of PSTATE. {A, I, F} are set to 1, masking all 
interrupts that target that Exception level. 


The following tables show the masking of physical interrupts when the highest implemented Exception level is 
using AArch64: 


è For implementations that include both EL2 and EL3, see Table D1-13 on page D1-2321. 
s For implementations that include EL3 but not EL2, see Table D1-14 on page D1-2322. 
: For implementations that include EL2 but not EL3, see Table D1-15 on page D1-2322. 


For the masking of interrupts when the highest implemented Exception level is using AArch32, see Table G1-20 on 
page G1-5535. 


For the masking of virtual interrupts, see Virtual interrupts on page D1-2322. 


In the tables: 
SCR This is the Effective value of a field in SCR. 


FIQ IRQ EA The Effective value of the field that handles the asynchronous exception type in SCR, if the highest 
EL is using AArch32, or SCR_EL3, if the highest EL is using AArch64. 


HCR This is the Effective value of a field in HCR. 
When the value of HCR.TGE is 1, the virtual exceptions are disabled. 
When the Effective value of HCR.{E2H, TGE} is: 
{0, 1} The Effective value of each of the HCR.{AMO, IMO, FMO} fields is 1. 
{1, 1} The Effective value of each of the HCR.{AMO, IMO, FMO} fields is 0. 


FMO IMO AMO The Effective value of the mask override field for the asynchronous exception type in HCR, if 
EL2 is using AArch32 or HCR_EL2 if EL2 is using AArch64. 


A When the interrupt is asserted it is taken regardless of the value of the PSTATE. {A, I, F} interrupt 
masks. 
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B When the interrupt is asserted it is subject to the corresponding Process state mask. If the value of 
the mask is 1 then the interrupt is not taken. If the value of the mask is 0 the interrupt is taken. 

A/B When ARMv8.4-DFE is implemented, the interrupt is an SError interrupt, and SCR_EL3.NMEA is 
1, then the interrupt behaves as A. Otherwise, the interrupt behaves as B. 

C When the interrupt is asserted it is not taken, regardless of the value of the PSTATE. {A, I, F} 
interrupt masks. 

n/a Not applicable. The PE cannot be executing at this Exception level for the specified state of HCR 
and SCR_EL3. 


Table D1-13 Physical interrupt target and masking when both EL3 and EL2 are implemented 
























































SCR HCR Effect of the interrupt mask when executing at: 
EA AMO 
NS EEL22 IRQ RW | TGE | E2Hb IMO | ELO EL1 EL2 EL3 
FIQ FMO 
0 0 0 x x x x B B n/a C 
1 X X x X A A n/a A/B 
1 0 x 0 x 0 B B C C 
1 A A B C 
1 0 x A n/a B C 
1 x B n/a B C 
1 x 0 x x A A A A/B 
1 x x A n/a A A/B 
1 X 0 0 0 n/a 0 B B B C 
1 A A B C 
1 n/a x A n/a B C 
1 0 x 0 B B C C 
1 A A B C 
1 0 x A n/a B C 
1 x B n/a B C 
1 X 0 x X A A A A/B 
1 x x A n/a A A/B 














a. When the implementation does not include ARMv8.4-SecEL2, the SCR_EL3.EEL2 field is not implemented and the 


Effective value of EEL2 is 0. 


b. When the implementation does not include ARMv8.1-VHE, the HCR_EL2.E2H field is not implemented and the 


Effective value of E2H is 0. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D1-2321 


ID070919 


Non-Confidential 


The AArch64 System Level Programmers’ Model 
D1.13 Asynchronous exception types, routing, masking and priorities 


D1.13.3 


D1-2322 


Table D1-14 Physical interrupt target and masking when EL3 is implemented and EL2 is not 
implemented 


SCR_EL3 Effect of the interrupt mask when executing at: 








Target 
EA Exception level 
NS IRQ P ELO EL1 EL3 
FIQ 
x 0 EL1 B B C 
1 EL3 A A A/B 











Table D1-15 Physical interrupt target and masking when EL3 is not implemented and EL2 is 
implemented 

















HCR_EL2 Effect of the interrupt mask when executing at: 
AMO Meh ade i 

E2Ha TGE imo | ~ooPHonievel | ELo EL1 EL2 
FMO 

x 0 0 ELI B B C 
1 EL2 A A B 

0 1 x EL2 A n/a B 

1 1 x EL2 B n/a B 











a. Ifthe implementation does not include ARMv8.1-VHE, the HCR.E2H field is not implemented and 
behavior is as if the value of E2H is 0. 


Virtual interrupts 


When the value of HCR_EL2.TGE is 0, setting an HCR_EL2.{FMO, IMO, AMO} routing control bit to 1 enables 
the corresponding virtual interrupt. When the value of HCR_EL2.TGE is 1 all virtual interrupts are disabled. 


When execution is in Secure state, or at EL2, all types of virtual interrupt are always masked. 


Virtual interrupts can only be taken from ELO or EL1 to EL1. When a virtual interrupt type is enabled, that type of 
interrupt can be generated by: 


s Software setting the corresponding virtual interrupt pending bit, HCR_EL2.{VSE, VI, VF}, to 1. 


° For a vIRQ or a vFIQ, by an IMPLEMENTATION DEFINED mechanism. This might be a signal from an interrupt 
controller. See, for example, the ARM Generic Interrupt Controller Architecture Specification. 


Note 


For a usage model for virtual interrupts, see Virtual interrupt usage model on page D1-2276. 








When a virtual interrupt is disabled: 
. It cannot be taken. 
e It cannot be seen in the ISR_EL1. 


Each virtual interrupt type can be masked when execution is in EL1 or ELO, by using the same Process State mask 
bits that mask the physical interrupts, PSTATE. {A, I, F}. 
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Table D1-16 summarizes the bits that enable virtual interrupts and the bits that cause virtual interrupts to be pending. 


Table D1-16 HCR_EL2 interrupt control bits 





Virtual interrupt type Enable controla Cause a virtual interrupt to be pending 











vSError HCR_EL2.AMO HCR_EL2.VSE 
vIRQ HCR_EL2.IMO HCR_EL2.VI 
vFIQ HCR_EL2.FMO HCR EL2.VF 





a. Applies only when the value of HCR_EL2.TGE is 0, otherwise the virtual interrupts are disabled. 


On taking a vIRQ or a vFIQ interrupt, the corresponding virtual interrupt pending bit in the HCR_EL2 retains its 
state. 


On taking a vSError interrupt, HCR_EL2.VSE is cleared to 0. 


Note 


This means that if the virtual interrupt pending bits are used, the vIRQ or vFIQ exception handler must cause 
software executing at EL2 or EL3 to set their corresponding virtual interrupt pending bits to 0. 








Taking a vSError interrupt to an Exception level using AArch64 updates ESR_EL1 with the encoding for an SError 
interrupt. For the encoding, see Exception classes and the ESR_ELx syndrome registers on page D1-2296. When 
the RAS Extension is implemented, the exception syndrome for the vSError interrupt is taken from the values in the 
VSESR_EL2 register, see the ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMV6, for the 
ARMVv8-A architecture profile. Taking a vVIRQ or a vFIQ interrupt to an Exception level using AArch64 does not 
update the ESR_EL1. 


The following table shows the masking of virtual interrupts when the highest implemented Exception level is using 
AArch64. In the table: 


B When the interrupt is asserted it is subject to the corresponding Process state mask. If the value of 
the mask is 1 then the interrupt is not taken. If the value of the mask is 0 the interrupt is taken. 


C When the interrupt is asserted it is not taken, regardless of the value of the Process state mask. 

n/a Not applicable. The PE cannot be executing at this Exception level for the specified state of HCR 
and SCR_EL3. 

HCR In Table D1-17, including in the table footnote: 


° When EL2 is using AArch64 HCR refers to the AArch64 register HCR_EL2. 
$ When EL2 is using AArch32 HCR refers to the AArch32 register HCR. 
When the value of HCR.TGE is 1, the virtual exceptions are disabled. 

When the Effective value of HCR. {E2H, TGE} is: 

{0, 1} The Effective value of each of the HCR.{AMO, IMO, FMO} fields is 1. 
{1, 1} The Effective value of each of the HCR.{AMO, IMO, FMO} fields is 0. 


Table D1-17 Virtual interrupt masking 














SCR_EL3 HCR Effect of the interrupt mask when executing at: 
EA AMO 
EEL2 NS IRQ E2Ha TGE IMO ELO EL1 EL2 EL3 
FIQ FMO 
0 0 x x x x C C n/a C 
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D1.13.4 


D1-2324 


Table D1-17 Virtual interrupt masking (continued) 























SCR_EL3 HCR Effect of the interrupt mask when executing at: 
EA AMO 
EEL2 NS IRQ E2Ha TGE IMO ELO EL1 EL2 EL3 
FIQ FMO 
0 x x 0 0 C C C C 
1 B B C C 
1 x C n/a C C 
1 xX x 0 0 C C C C 
1 B B C C 
1 xX C n/a C C 











a. If EL2 is using AArch32 or the implementation does not include ARMv8.1-VHE, the HCR.E2H field is not 
implemented and behavior is as if the value of E2H is 0. 


Prioritization and recognition of interrupts 


The prioritization of interrupts, including virtual interrupts, is IMPLEMENTATION DEFINED. 


Note 


As indicated at the start of Asynchronous exception types, routing, masking and priorities on page D1-2316, in 
AArch64 state all possible asynchronous exceptions are defined as interrupts. 








Any interrupt that is pending before a Context synchronization event in the following list, is taken before the first 

instruction after the context synchronizing event, provided that the pending interrupt is not masked: 

$ Execution of an ISB instruction. 

7 Exception entry, if ARMv8.5-CSEH is not implemented, or if ARMv8.5-CSEH is implemented and the 
appropriate SCTLR_ELx.EIS bit is set. 


è Exception return, if ARMv8.5-CSEH is not implemented or if ARMv8.5-CSEH is implemented and the 
appropriate SCTLR_ELx.EOS bit is set. 





° Exit from Debug state. 
Note 
$ If the first instruction after the context synchronizing event generates a synchronous exception, then the 


architecture does not define whether the PE takes the interrupt or the synchronous exception first. 
à The ISR_EL1 identifies any pending interrupts. 


‘ Interrupts are masked when the PE is in Debug state, and therefore this list of context synchronizing events 
does not include the DCPS and DRPS instructions. 





An error synchronization event defines additional requirements for taking an SError interrupt, see the ARM® 
Reliability, Availability, and Serviceability (RAS) Specification, ARMv6, for the ARMv8-A architecture profile. 


In the absence of a specific requirement to take an interrupt, the architecture only requires that unmasked pending 
interrupts are taken in finite time. 


If an unmasked interrupt was pending but is changed to not pending before it is taken, then the architecture permits 
the interrupt to be taken, but does not require this to happen. If the interrupt is taken then it must be taken before the 
first Context synchronization event after the interrupt was changed to not pending. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch64 System Level Programmers’ Model 
D1.13 Asynchronous exception types, routing, masking and priorities 


D1.13.5 Taking an interrupt or other exception during a multiple-register load or store 


ARM DDI 0487E.a 
ID070919 


In AArch64 state, interrupts can be taken during a sequence of memory accesses caused by a single load or store 
instruction. This is true regardless of the memory type being accessed. 


If an interrupt, or another exception, is taken from AArch64 during the execution of an instruction that performs a 
sequence of memory accesses, rather than a single single-copy atomic access, then: 


For a load, any register being loaded by the instruction other than ones used in the generation of the address 
by the instruction, can contain an UNKNOWN value. Registers used in the generation of the address are 
restored to their initial value. 


For a store, any data location being stored to by the instruction can contain an UNKNOWN value. 


For either a load or a store, if the instruction specifies writeback of the base address, then that register is 
restored to its initial value. 





Note 


This interrupt behavior is in contrast to behavior in AArch32 state, when interrupts cannot be taken during a 
sequence of memory accesses caused by a single load or store instruction. 


In both Execution states, synchronous data abort exceptions can be taken during the execution of an 
instruction that performs a sequence of memory accesses. 


Software must avoid using multiple-register load and store instructions for accesses to Device memory, 
particularly to Device memory with the non-Gathering attribute, because an exception taken during the load 
or store can result in repeated accesses. 
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Configurable instruction enables and disables, and trap controls 


This section describes the controls provided by AArch64 state for enabling, disabling, and trapping particular 
instructions. Each control is categorized as an instruction enable, an instruction disable, or a trap control: 


Instruction enables and instruction disables 


Enable or disable the use of one or more particular instructions at a particular Exception level and 
Security state. 


When an instruction is disabled as a result of an instruction enable or disable, it is UNDEFINED. 


Trap controls A trap control determines whether one or more particular instructions, whenever executed at a 


particular Exception level, are trapped. 
A trapped instruction generates a Trap exception. 
For trap controls provided by: 


ELI Trap exceptions are taken to EL1, unless routed from ELO to EL2 because 
HCR_EL2.TGE is 1 as described in Routing exceptions from ELO to EL2 on 
page D1-2307. 


For descriptions of these controls see EL/ configurable controls on page D1-2327. 


EL2 Trap exceptions are taken to EL2. 
For descriptions of these controls see EL2 configurable controls on page D1-2336. 


EL3 Trap exceptions are taken to EL3. 
For descriptions of these controls see EL3 configurable controls on page D1-2359. 


Note 





The definitions of traps and enables and disables overlap, and the classification of some controls is historical. In 

AArch64 state, the most significant characteristic of an exception report is the ESR_ELx.EC value with which it is 
reported. Describing a register control field as an instruction enable, an instruction disable, or a trap control, gives 
no indication of how an exception that is generated as a consequence of the value of that field is handled or reported. 





An exception generated as a result of an instruction enable or disable, or a trap control, is only taken if both of the 
following apply: 


The instruction generating the exception does not also generate a higher priority exception. Synchronous 
exception prioritization for exceptions taken to AArch64 state on page D1-2308 defines the prioritization of 
different exceptions on the same instruction. 


The instruction is not UNPREDICTABLE or CONSTRAINED UNPREDICTABLE in the PE state it is executed in. 
UNPREDICTABLE and CONSTRAINED UNPREDICTABLE instructions can generate exceptions as a result of these 
controls, but the architecture does not require them to do so. 


Exceptions generated as a result of these controls are synchronous exceptions. 


Exceptions are reported in the ESR_ELx, with an EC value that indicates the Exception class. and: 


Many cases, including all traps, are reported with a non-zero EC value and an associated syndrome. 


Some cases where an instruction is UNDEFINED are reported with an EC value 0x00, the value for an exception 
for an unknown or uncategorized reason, and in these cases no syndrome is provided. JSS encoding for 
exceptions with an unknown reason on page D13-2923 identifies the cases that are reported with EC value 
0x00. 


Table D1-8 on page D1-2297 lists the EC values that are used for exceptions that result from traps, enables, and 
disables. 


Note 





A particular control might have a mnemonic that suggests it is different type of control to the control type it 
is categorized as. For example, SCTLR_EL1.DZE is a trap control even though DZE means DC ZVA Enable. 
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. In addition to the controls described in this section, a routing control, HCR_EL2.TGE, can be used to route 
exceptions from ELO to EL2. See Routing exceptions from ELO to EL2 on page D1-2307. 


s An implementation might provide additional controls, in IMPLEMENTATION DEFINED registers, to provide 
control of trapping of IMPLEMENTATION DEFINED features. 





This section is organized as follows: 

è Register access instructions. 

. EL1 configurable controls. 

. EL2 configurable controls on page D1-2336. 
. EL3 configurable controls on page D1-2359. 


D1.14.1 Register access instructions 


When an instruction is disabled or trapped, the exception is taken before execution of the instruction. This means 
that if the instruction is a register access instruction: 

: No access is made before the exception is taken. 

5 Side-effects that are normally associated with the access do not occur before the exception is taken. 


D1.14.2 EL1 configurable controls 


These controls are in _ELO and _EL1 System registers. The resulting exceptions might be taken from either 
Execution state. SPSR_EL1.M[4] indicates which Execution state the exception was taken from. 


Table D1-18 shows the ELO and _EL1 System registers that contain these controls. 


Table D1-18 _EL1 registers that contain instruction enables and disables, and trap controls 





Register name Register description 





AMUSERENR ELO Activity Monitors User Enable Register 





CPACR_EL1 Architectural Feature Access Control Register 





MDSCR_EL1 Monitor System Debug Control Register 





PMUSERENR ELO Performance Monitors User Enable Register 





SCTLR_EL1 System Control Register (EL1) 





TCR_EL1 Translation Control Register (EL1) 





Table D1-19 summarizes the controls. 


Table D1-19 Instruction enables and disables, and trap controls, provided by EL1 














Control gs 
Control Description 
typea 
SCTLR_EL1.UCI T Traps to ELI of ELO execution of cache maintenance instructions on 
page D1-2328 
SCTLR_EL1.UCT F Traps to ELI of ELO accesses to the CTR_ELO on page D1-2329 
SCTLR_EL1.{nTWE, nTWI} T Traps to EL1 of ELO execution of WFE and WFI instructions on 
page D1-2329 
SCTLR_EL1.DZE T Traps to ELI of ELO execution of DC ZVA instructions on page D1-2330 
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Table D1-19 Instruction enables and disables, and trap controls, provided by EL1 (continued) 





Control 





























Control Description 
o types escriptio 

SCTLR_EL1.UMA T Traps to EL1 of ELO accesses to the PSTATE.{D, A, I, F} interrupt masks on 
page D1-2330 

SCTLR_EL1.{SED, ITD} D Disabling or enabling ELO use of AArch32 deprecated functionality on 

SCTLR_EL1.CP15BEN E page D1-2330 

CPACR_EL1.TTA T Traps to ELI of ELO and EL1 System register accesses to the trace registers 
on page D1-2331 

CPACR_EL1.FPEN T Traps to ELI of ELO and EL] accesses to SIMD and floating-point 
functionality on page D1-2332 

MDSCR_EL1.TDCC T Traps to EL1 of ELO accesses to the Debug Communications Channel (DCC) 
registers on page D1-2332 

CNTKCTL_EL1.{ELOPTEN, T Traps to EL1 of ELO accesses to the Generic Timer registers on page D1-2333 

ELOVTEN, ELOPCTEN, ELOVCTEN} 

PMUSERENR ELO.{ER, CR, SW, EN} T Traps to ELI of ELO accesses to Performance Monitors registers on 
page D1-2334 

AMUSERENR ELO.EN T Traps to EL1 of EL0 accesses to Activity Monitors registers on page D1-2335 

SCTLR_EL1.{EnDA, EnDB, EnIA, E Enabling use of the Pointer authentication instructions, ELI&O translation 

EnIB} regime on page D1-2336 

TCR_EL1.{TBIDO, TBID1} D Disabling Address tagging for instruction accesses, EL1&0 translation 


regime on page D1-2336 





a. See Table D1-20. 


Table D1-20 Control types, for exceptions taken to EL1 














Abbreviation Type See 

D Disable — Instruction enables and instruction disables on page D1-2326 
E Enable Instruction enables and instruction disables on page D1-2326 
T Trap Trap controls on page D1-2326 





Traps to EL1 of ELO execution of cache maintenance instructions 


SCTLR_EL1.UCI traps ELO execution of cache maintenance instructions to EL1: 
1 ELO execution of cache maintenance instructions is not trapped to EL1. 


0 Any attempt to execute a cache maintenance instruction at ELO is trapped to EL1. 


Table D1-21 shows the instructions that are trapped to EL1, and how the exceptions are reported in ESR_EL1: 


Table D1-21 Instructions trapped to EL1 when SCTLR_EL1.UCI is 0 








Traps from Trapped instructions Syndrome reporting in ESR_EL1 

AArch64 state DC CVAU, DC CIVAC,DC CVAC,DCCVAP, Trapped AArch64 MSR, MRS, or System instruction, using EC value 
IC IVAU Qx184 

AArch32 state n/a n/a 





D1-2328 
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a. IfHCR_EL2.TGE is | and EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 and are reported in ESR_EL2 
using the same EC values as shown in the table. 


Traps to EL1 of ELO accesses to the CTR_ELO 


SCTLR_EL1.UCT traps ELO accesses to the CTR_ELO to EL1: 
1 ELO accesses to the CTR_ELO are not trapped to EL1. 
0 ELO accesses to the CTR_ELO are trapped to EL1. 


Table D1-22 shows how the exceptions are reported in ESR_EL1: 


Table D1-22 Register accesses trapped to EL1 when SCTLR_EL1.UCT is 0 





Traps from Register Syndrome reporting in ESR_EL1 





AArch64 CTR_ELO Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x184 





AArch32 n/a n/a 





a. IfHCR_EL2.TGE is 1 and EL2 is enabled in the current Security state, these Trap exceptions are routed 
to EL2 and are reported in ESR_EL2 using the same EC values as shown in the table. 


Traps to EL1 of ELO execution of WFE and WFI instructions 
SCTLR_EL1.{nTWE, nTWI} trap ELO execution of WFE and WFI instructions to EL1: 
SCTLR_EL1.nTWE 


1 ELO execution of WFE instructions is not trapped to EL1. 


0 Any attempt to execute a WFE instruction at ELO is trapped to EL1, if the instruction 
would otherwise have caused the PE to enter a low-power state. 


SCTLR_EL1.nTWI 
1 ELO execution of WFI instructions is not trapped to EL1. 


0 Any attempt to execute a WFI instruction at ELO is trapped EL1, if the instruction would 
otherwise have caused the PE to enter a low-power state. 


Table D1-23 shows how the exceptions are reported in ESR_EL1: 


Table D1-23 Instructions trapped to EL1 when SCTLR_EL1.{nTWE, nTWI} are 0 














Trap control Traps from Trapped instructions Syndrome reporting in ESR_EL1 
SCTLR_EL1.nTWE Both Execution states WFE Trapped WFI or WFE instruction, using EC value 0x012 
SCTLR_EL1.nTWI WFI 





a. IfHCR_EL2.TGE is 1 and EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 and are reported in 
ESR_EL2 using the same EC values as shown in the table. 


In AArch32 state, the attempted execution of a conditional WFE or WFI instruction is only trapped if the instruction 
passes its Condition code check. 


Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed 
to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the 
instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken. 
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For more information about these instructions, and when they can cause the PE to enter a low-power state, see: 
. Wait for Event mechanism and Send event on page D1-2372. 
e Wait For Interrupt on page D1-2375. 


Traps to EL1 of ELO execution of DC ZVA instructions 
SCTLR_EL1.DZE traps ELO execution of DC ZVA instructions to EL1: 
1 ELO execution of DC ZVA instructions is not trapped to EL1. 


0 Any attempt to execute a DC ZVA instruction at ELO is trapped to EL1. Reading the DCZID_ELO 
returns a value that indicates that DC ZVA instructions are not implemented. 


Table D1-24 shows how the exceptions are reported in ESR_EL1: 


Table D1-24 Instruction trapped to EL1 when SCTLR_EL1.DZE is 0 





Traps from Trapped instruction Syndrome reporting in ESR_EL1 





AArch6é4 state DC ZVA Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x182 





AArch32 state n/a n/a 


a. If HCR_EL2.TGE is 1 and EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 and are 
reported in ESR_EL2 using the same EC values as shown in the table. 


Traps to EL1 of ELO accesses to the PSTATE.{D, A, I, F} interrupt masks 


SCTLR_EL1.UMA traps ELO execution of MSR and MRS instructions that access the PSTATE. {D, A, I, F} masks to 
ELI: 


1 ELO execution of MSR or MRS instructions that access the DAIF is not trapped to EL1. 
0 Any attempt at ELO to execute an MSR or an MRS instruction that accesses the DAIF is trapped to EL1. 


Table D1-25 shows how the exceptions are reported in ESR_EL1: 


Table D1-25 Instructions trapped to EL1 when SCTLR_EL1.UMA is 0 





Taken from 


Disabled instructions Syndrome reporting in ESR_EL1 





AArch6é4 state 


MRS, MSR (register), MSR (immediate), that access the DAIF Trapped AArch64 MSR, MRS, or System instruction, 


using EC value 0x18 





AArch32 state 


n/a n/a 





a. IfHCR EL2.TGE is | and EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 and are reported in ESR_EL2 
using the same EC values as shown in the table. 


D1-2330 


Disabling or enabling ELO use of AArch32 deprecated functionality 


Table D1-26 on page D1-2331 shows the deprecated AArch32 functionality that might have disable controls in the 
SCTLR_EL1: 


è The SED control is always implemented. 


° Whether each of the ITD, CP15BEN controls is implemented is IMPLEMENTATION DEFINED. If a control is 
not implemented then the associated functionality cannot be disabled. 
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These SCTLR_EL1 controls apply only to execution at ELO using AArch32. When an instruction is disabled by one 
of these controls, it is UNDEFINED at ELO using AArch32. Table D1-26 shows how the exceptions are reported in 
ESR ELI: 


Table D1-26 EL1 controls for disabling and enabling ELO use of AArch32 deprecated functionality 





Instruction enable 











ndrome reportin 
E AArch32 or disable in the Disabled instructions a EL1 >P g 
y SCTLR_EL1 l — 

SETEND instructions SED» SETEND instructions Exception for an 

unknown reason, using 
Some uses of IT instructions ITD¢ See the SCTLR_EL1.IT description EC value 0x00 
Accesses to the CP15DMB, CP15DSB, CPI5BEN¢ MCR accesses to the CP15DMB, 
and CP15ISB barrier instructions CP15DSB, and CP15ISB instructions 





a. IfHCR_EL2.TGE is 1 and EL2 is enabled in the current Security state, the exception is routed to EL2 and reported in ESR_EL2 using the 
EC value shown in the table. 


b. SETEND instruction disable. SETEND instructions are disabled when the value of this field is 1. 
c. IT instruction disable. If this control is implemented, some uses of IT instructions are disabled when the value of this field is 1. 


d. System register (coproc==0b1111) memory barrier enable. If this control is implemented, the specified register accesses are disabled when 
the value of CP15BEN is 0. 





Note 


. The uses of the IT instruction, and use of the CP15DMB, CP15DSB, and CP15ISB barrier instructions, are 
deprecated for performance reasons. 


s The SCTLR provides similar controls that apply when EL1 is using AArch32, and the HSCTLR provides 
similar controls that apply when EL2 is using AArch32. 





Traps to EL1 of ELO and EL1 System register accesses to the trace registers 


CPACR_EL1.TTA traps ELO and EL1 System register accesses to the trace registers to EL1. 





1 ELO and EL1 System register accesses to the trace registers are trapped to EL1. 
0 This control has no effect on accesses to the trace registers. 
Note 
: The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A architecture is 


implemented with an ETMv4 implementation, ELO accesses to the trace registers are UNDEFINED, and the 
resulting exception is higher priority than a CPACR_EL1.TTA Trap exception. 


$ The Armv8-A architecture does not provide traps on trace register accesses through the optional 
Memory-mapped interface. 





System register accesses to the trace registers can have side-effects. When a System register access is trapped, no 
side-effects occur before the exception is taken, see Register access instructions on page D1-2327. 
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Table D1-27 shows the registers for which accesses are trapped to EL1 when CPACR_EL1.TTA is 1, and how the 
exceptions are reported in ESR_EL1: 


Table D1-27 Register accesses trapped to EL1 when CPACR_EL1.TTA is 1 





Traps from Registers Syndrome reporting in ESR_EL1 





AArch64 state All implemented trace registers Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18. 





AArch32 state All implemented trace registers For accesses using: 
z MCR or MRC instructions, trapped MCR or MRC access (coproc==0b1110), using 
EC value 0x05.4 
. MCRR or MRRC instructions, trapped MCRR or MRRC access (coproc==0b1110), 
using EC value @x0C.4 


a. IfFHCR_EL2.TGE is 1 and EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 and are reported in ESR_EL2 
using the same EC values as shown in the table. 


Traps to EL1 of ELO and EL1 accesses to SIMD and floating-point functionality 


When EL] is using AArch64, CPACR_EL1.FPEN traps ELO and EL1 accesses to the SIMD and floating-point 
registers to EL1: 


00 Causes any instructions in ELO or EL] that use the registers that are associated with Advanced 
SIMD and floating-point execution to be trapped. 


01 Causes any instructions in ELO that use the registers that are associated with Advanced SIMD and 
floating-point execution to be trapped, but does not cause any instruction in EL] to be trapped. 


10 Causes any instructions in ELO or EL] that use the registers that are associated with Advanced 
SIMD and floating-point execution to be trapped. 


11 Does not cause any instruction to be trapped. 


Table D1-28 shows the registers for which accesses are trapped, and how the exceptions are reported in ESR_EL1: 


Table D1-28 Register accesses trapped to EL1 by CPACR_EL1.FPEN 











Traps from Registers Syndrome reporting in ESR_EL1 

ELO and EL1 FPCR, FPSR, and any of the SIMD and floating-point registers Trapped access to a SIMD or 

using AArch64, V0-V31, including their views as DO-D31 registers or SO-S31 floating-point register, resulting from 

or ELO using registers. See The SIMD and floating-point registers, VO-V31 on CPACR_EL1.FPEN or CPTR_ELx.TFP, 

AArch64 only’. page D1-2278. using EC value 0x07? 

ELO using FPSCR, and any of the SIMD and floating-point registers QO-Q15, Trapped access to a SIMD or 

AArch32 including their views as D0-D31 registers or SO-S31 registers. See floating-point register, resulting from 
Advanced SIMD and floating-point System registers on CPACR_EL1.FPEN or CPTR_ELx.TFP, 
page G1-5572. using EC value 0x07» 





a. As described at the start of this subsection, the value of CPACR_EL1.FPEN determines whether the trap applies only to accesses from ELO, 
or applies to both accesses from EL1 and accesses from ELO. 

b. IfHCR_EL2.TGE is | and EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 and are reported in ESR_EL2 
using EC value 0x00. 


Traps to EL1 of ELO accesses to the Debug Communications Channel (DCC) registers 


MDSCR_EL1.TDCC traps ELO accesses to the DCC registers to EL1: 


1 ELO accesses to the DCC registers are trapped to EL1. 
0 This control has no effect on accesses to the DCC registers. 
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Traps of AArch32 accesses to DBGDTRRXint and DBGDTRT Xint are ignored in Debug state. 


Traps of AArch64 accesses to DBGDTR_ELO, DBGDTRRX_ELO, and DBGDTRTX_ELO are ignored in Debug 
state. 


Table D1-29 shows the accesses that are trapped, and how the exceptions are reported in ESR_EL1: 


Table D1-29 Accesses trapped to EL1 when MDSCR_EL1.TDCC is 1 

















Traps from Trapped accesses Syndrome reporting in ESR_EL1 
AArch64 state Accesses to the MDCCSR_ELO, DBGDTR_EL0, DBGDTRTX ELO Trapped AArch64 MSR, MRS, or System 
and DBGDTRRX_ELO instruction, using EC value 0x184 
AArch32 state œ MRC of DBGDSCRint, DBGDTRRXint, and, if implemented, Trapped MCR or MRC access 
DBGDIDR, DBGDSAR and DBGDRAR. (coproc==0b1110), using EC value 0x052 
° MCR to DBGDTRTXint. 
. LDC access to DBGDTRTXint. Trapped LDC or STC access, using EC value 
7 STC access to DBGDTRRXint. 0x063 
If implemented, MRRC of DBGDSAR and DBGDRAR. Trapped MCRR or MRRC access 


(coproc==0b1110), using EC value 0x0Ca 


a. IfHCR_EL2.TGE is 1 and EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 and are reported in ESR_EL2 
using the same EC values as shown in the table. 


Traps to EL1 of ELO accesses to the Generic Timer registers 


CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN} trap ELO accesses to the Generic Timer 
registers to EL1, as follows: 


s CNTKCTL_EL1.ELOPTEN traps ELO accesses to the physical timer registers. 

° CNTKCTL_EL1.ELOVTEN traps ELO accesses to the virtual timer registers. 

s CNTKCTL_EL1.ELOPCTEN traps ELO accesses to the frequency register and physical counter register. 
s CNTKCTL_EL1.ELOVCTEN traps ELO accesses to the frequency register and virtual counter register. 


For all of these controls: 
1 ELO accesses are not trapped to EL1. 
0 ELO accesses are trapped to EL1. 


Accesses to the frequency register, CNTFRQ ELO or CNTFRQ, are only trapped if CNTKCTL_EL1.ELOPCTEN 
and CNTKCTL_EL1.ELOVCTEN are both 0. 


Table D1-30 shows the registers for which accesses are trapped, and how the exceptions are reported in ESR_EL1: 


Table D1-30 Register accesses trapped from ELO to EL1 by CNTKCTL_EL1 trap controls 

















Traps from Trap control Registers Syndrome reporting in ESR_EL1 
AArch64 state ELOPTEN CNTP_CTL_ELO, CNTP_CVAL ELO, Trapped AArch64 MSR, MRS, or System instruction, 
CNTP_TVAL_ELO using EC value 0x183 
ELOVTEN CNTV_CTL_ELO, CNTV_CVAL ELO, 
CNTV_TVAL_ELO 
ELOPCTEN CNTFRQ ELO0, CNTPCT_ELO 
ELOVCTEN CNTFRQ ELO, CNTVCT_ELO 
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Table D1-30 Register accesses trapped from ELO to EL1 by CNTKCTL_EL1 trap controls (continued) 





Traps from Trap control Registers 








Syndrome reporting in ESR_EL1 


access (coproc==0b1111), using EC value 


` MCRR or MRRC instructions, trapped MCRR or MRRC 


AArch32 state ELOPTEN CNTP CTL, CNTP CVAL, For accesses using: 
CNTP_TVAL ° MCR or MRC instructions, trapped MCR or MRC 
ELOVTEN CNTY CTL, CNTV_CVAL, 0x03 
CNTV_TVAL x 
ELOPCTEN CNTFRQ, CNTPCT access (coproc==0b1111), using EC value 





0x042 








ELOVCTEN CNTFRQ, CNTVCT 





a. IfHCR_EL2.TGE is | and EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 and are reported in ESR_EL2 
using the same EC values as shown in the table. 


Traps to EL1 of ELO accesses to Performance Monitors registers 


PMUSERENR ELO.{ER, CR, SW, EN} trap ELO accesses to the Performance Monitors registers to EL1. For each 
of these controls: 


1 
0 


ELO accesses are not trapped to EL1. 
ELO accesses are trapped to EL1. 


For those Performance Monitors registers that more than one PMUSERENR_ELO.{ER, CR, SW, EN} control 
applies to, accesses are only trapped if all controls that apply are set to 0. 


The accesses that these trap controls trap might be reads, writes, or both. 


Table D1-31 shows: 


How the exceptions are reported in ESR_EL1. 


The registers for which ELO accesses are trapped. For each register, the table shows the type of access 
trapped. 


Table D1-31 Register accesses trapped to EL1 when disabled from ELO 

















Trap n Access 
Traps from Registers 
control type 
AArch64 ER PMXEVCNTR_EL0, PMEVCNTR<n>_EL0 R 
state 
PMSELR_ELO RW 
CR PMCCNTR_ELO R 
SW PMSWINC _ELO Ww 
EN PMCNTENSET ELO, PMCNTENCLR_ELO, PMCR_ELO, RW? 
PMOVSCLR_ELO, PMSWINC_ELO, PMSELR_ELO, 
PMCEIDO ELO, PMCEID1_EL0, PMCCNTR_ELO, 
PMXEVTYPER_ELO, PMXEVCNTR_ELO, 
PMOVSSET_ELO, PMEVCNTR<n>_ELO, 
PMEVTYPER<n>_EL0, PMCCFILTR_ELO. 
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Table D1-31 Register accesses trapped to EL1 when disabled from ELO (continued) 





























Tra Access ingi 
Traps from a Registers Syndrome reporting in 
control type ESR_EL1 
AArch32 ER PMXEVCNTR, PMEVCNTR<n> R Trapped MCR or MRC access 
state (coproc==0b1111), using 
PMSELR RW EC value 0x032 
CR PMCCNTR, accessed using an MRC R 
CR PMCCNTR, accessed using an MRRC R Trapped MCRR or MRRC 
access (coproc==0b1111), 
using EC value 0x04? 
SW PMSWINC W Trapped MCR or MRC access 
(coproc==0b1111), using 
EN PMCNTENSET, PMCNTENCLR, PMCR, PMOVSR, RW? EC value 0x032 
PMSWINC, PMSELR, PMCEIDO, PMCEID1, PMCEID2, 
PMCEID3, PMCCNTR, PMXEVTYPER, PMXEVCNTR, 
PMOVSSET, PMEVCNTR<n>, PMEVTYPER<n>, 
PMCCFILTR, accessed using an MCR or MRC 
EN PMCCNTR, accessed using an MCRR or MRRC RW Trapped MCRR or MRRC 


access (coproc==0b1111), 
using EC value 0x043 





a. IfHCR_EL2.TGE is land EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 and are reported in ESR_EL2 
using the same EC values as shown in the table. 


b. The ELO access is trapped only if the corresponding EL] accesses is permitted. For example, the PMSWINC_ELO and PMSWINC registers 
are WO at ELI, and therefore, when the value of EN is 0: 


Write accesses to these registers from ELO are trapped. 


Read accesses to these registers from ELO are UNDEFINED, because read accesses to the registers from EL1 are UNDEFINED. 


Traps to EL1 of ELO accesses to Activity Monitors registers 


AMUSERENR _ ELO.EN traps ELO accesses to the Activity Monitors registers to EL1: 


1 
0 


ELO accesses are not trapped to EL1. 
ELO accesses are trapped to EL1. 


Table D1-32 on page D1-2336 shows: 
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D1.14.3 


D1-2336 


: How the exceptions are reported in ESR_EL1. 


Table D1-32 Register accesses trapped to EL1 when AMUSERENR_ELO.EN is 1 





Traps from Registers Syndrome reporting in 











ESR_EL1 
AArch64 AMCFGR_EL0, AMCGCR_ELO, AMCNTENCLRO_ELO, Trapped AArch64 MSR, MRS, 
state AMCNTENCLR1 ELO, AMCNTENSETO_ELO, or System instruction, 
AMCNTENSET1 ELO, AMCR_ELO, using EC value 0x182 
AMEVCNTRO<n>_EL0, AMEVCNTRI1<n>_EL0, 
AMEVTYPERO<n>_EL0, or AMEVTYPERI<n>_EL0. 
AArch32 AMCFGR, AMCGCR, AMCNTENCLRO, AMCNTENCLRI1, Trapped MCR or MRC access 
state AMCNTENSET0, AMCNTENSET1, AMCR, (coproc==0b1111), using 
AMEVTYPERO<n>, or AMEVTYPERI<n>. EC value 0x033 
AMEVCNTRO<n>or AMEVCNTRI<n>. Trapped MCRR or MRRC 





access (coproc==0b1111), 
using EC value 0x043 





a. IfHCR_EL2.TGE is | and EL2 is enabled in the current Security state, these Trap exceptions are routed to EL2 
and are reported in ESR_EL2 using the same EC values as shown in the table. 


Enabling use of the Pointer authentication instructions, EL1&0 translation regime 
This control is implemented when ARMv8.3-PAuth is implemented. 


Each of the SCTLR_EL1.{EnDA, EnDB, EnIA, EnIB} fields enables the pointer authentication functionality for 
the corresponding Pointer authentication instructions for the EL1&0 translation regime. For more information see 
System register control of pointer authentication on page D5-2510. 





Note 


These controls cause the pointer authentication instructions to execute as NOPs. They never cause an exception to be 
generated. 





Disabling Address tagging for instruction accesses, EL1&0 translation regime 
This control is implemented when ARMv8.3-PAuth is implemented. 


When a TCR_EL1.{TBIO, TBII} field enables the use of address tagging for the EL1&0 translation regime, the 
corresponding TCR_EL1.{TBIDO, TBID1} field determines whether address tagging is used for both data and 
instruction addresses, or only for data addresses. For more information see Address tagging in AArch64 state on 
page D5-2506. 


Note 


These controls determine the scope of address tagging. They never cause an exception to be generated. 








EL2 configurable controls 


These controls are in _EL2 System registers. The resulting exceptions might be taken from either Execution state. 
SPSR_EL2.M[4] indicates which Execution state the exception was taken from. 


These controls are ignored in Secure state. 
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Table D1-33 shows the EL2 System registers that contain these controls. 


Table D1-33 _EL2 registers that contain instruction disables and trap controls 





Register name Register description 




















SCTLR_EL2 System Control Register, EL2 

HCR EL2 Hypervisor Configuration Register 
HSTR_EL2 Hypervisor System Trap Register 
CPTR_EL2 Architectural Feature Trap Register, EL2 
MDCR_EL2 Monitor Debug Configuration Register, EL2 
TCR. EL2 Translation Control Register, EL2 





Table D1-34 summarizes the controls. 





Note 


For completeness, Table D1-34 includes the routing control described in Routing exceptions from ELO to EL2 on 
page D1-2307. 





Table D1-34 Instruction disables and trap controls provided by EL2 
































Control 
Control Description 
type@ 
HCR_EL2.{TRVM, TVM} T Traps to EL2 of EL1 accesses to virtual memory control registers on 
page D1-2339 
HCR_EL2.HCD D Disabling Non-secure state execution of HVC instructions on page D1-2339 
HCR_EL2.TDZ Ẹ Traps to EL2 of ELO and EL] execution of DC ZVA instructions on 
page D1-2340 
HCR_EL2.TGE R Routing exceptions from ELO to EL2 on page D1-2307 
HCR_EL2.TTLB T Traps to EL2 of EL1 execution of TLB maintenance instructions on 
page D1-2340 
HCR_EL2.{TSW, TPC, TPU} T Traps to EL2 of ELO and EL1 execution of cache maintenance instructions on 
page D1-2341 
HCR_EL2.TACR T Traps to EL2 of EL1 accesses to the Auxiliary Control Register on 
page D1-2342 
HCR_EL2.TIDCP T Traps to EL2 of ELO and EL] accesses to lockdown, DMA, and TCM 
operations on page D1-2343 
HCR_EL2.TSC T Traps to EL2 of EL1 execution of SMC instructions on page D1-2343 





HCR_EL2.{TIDO, TID1, TID2, TID3} T 


Traps to EL2 of ELO and EL] accesses to the ID registers on page D1-2344 








HCR_EL2.{TWI, TWE} T Traps to EL2 of ELO and EL] execution of WFE and WFI instructions on 
page D1-2347 
CPTR_EL2.TAM T Traps to EL2 of EL1 and ELO accesses to Activity Monitors registers on 
page D1-2348 
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Table D1-34 Instruction disables and trap controls provided by EL2 (continued) 


















































Control Control Description 
typea 
CPTR_EL2.TCPAC T Trapping to EL2 of EL1 accesses to the CPACR_EL1 or CPACR on 
page D1-2348 
CPTR_EL2.TFP T General trapping to EL2 of accesses to the SIMD and floating-point registers 
on page D1-2349 
CPTR_EL2.TTA T Traps to EL2 of System register accesses to the trace registers on page D1-2349 
MDCR_EL2.TTRF T Traps to EL2 of System register accesses to the trace filter control registers on 
page D1-2350 
HSTR_EL2.{T0-T3, T5-T13, T15} T General trapping to EL2 of ELO and EL] accesses to System registers, from 
AArch32 state only on page D1-2350 
MDCR_EL2.{TDRA, TDOSA, TDA} T Traps to EL2 of ELO and EL1 System register accesses to debug registers on 
page D1-2351 
CNTHCTL_EL2.{EL1PCEN, T Traps to EL2 of ELO and EL] accesses to the Generic Timer registers on 
EL1PCTEN} page D1-2354 
MDCR_EL2.{TPM, TPMCR} T Traps to EL2 of ELO and EL] accesses to Performance Monitors registers on 
page D1-2355 
HCR_EL2.TERR T Traps to EL2 of EL1 accesses to the RAS error record registers on 
page D1-2356 
HCR_EL2.FIEN T Traps to EL2 of EL1 accesses to the RAS error record registers on 
page D1-2356 
SCTLR_EL2.{EnDA, EnDB, EnIA, E Enabling use of the Pointer authentication instructions, EL2 translation regime 
EnIB} on page D1-2356 
HCR_EL2.APK T Trap to EL2 of EL1 accesses to Pointer authentication key registers on 
page D1-2356 
HCR_EL2.API T Trap to EL2 of ELO accesses to Pointer authentication instructions on 
page D1-2357 
TCR_EL2.TBIDO or D Disabling Address tagging for instruction accesses, EL2 translation regime on 
TCR_EL2.{TBIDO, TBID1} page D1-2357 
HCR_EL2.{NV, NV1} T Traps to EL2 for Nested virtualization on page D1-2358 
HCR_EL2.AT T Trap to EL2 of EL1 accesses to AT S1E* instructions on page D1-2359 





a. See Table D1-35. 


Table D1-35 Control types, for exceptions taken to EL1 

















Abbreviation Type See 

D Disable Instruction enables and instruction disables on page D1-2326 
E Enable Instruction enables and instruction disables on page D1-2326 
R Routing control Routing exceptions from ELO to EL2 on page D1-2307 

T Trap Trap controls on page D1-2326 





D1-2338 
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Also see the following for more general information about traps to EL2: 
e Register access instructions on page D1-2327. 
s For traps from an Exception level using AArch32: 
— Instructions that fail their Condition code check on page G1-5587. 
— Trapping to EL2 of instructions that are UNPREDICTABLE on page G1-5587. 


Traps to EL2 of EL1 accesses to virtual memory control registers 


HCR_EL2.{TRVM, TVM} trap EL1 accesses to the virtual memory control registers to EL2, if enabled in the 
current Security state: 


HCR_EL2.TRVM, for read accesses: 
1 ELI reads of the virtual memory control registers are trapped to EL2. 
0 This control has no effect on reads of the virtual memory control registers. 


HCR_EL2.TVM, for write access: 
1 ELI writes to the virtual memory control registers are trapped to EL2. 
0 This control has no effect on writes to the virtual memory control registers. 


Table D1-36 shows: 

< The registers for which reads are trapped to EL2 when HCR_EL2.TRVM is 1. 
d The registers for which writes are trapped to EL2 when HCR_EL2.TVM is 1. 
- How the exceptions are reported in ESR_EL2. 


Table D1-36 Register read and write accesses trapped when HCR_EL2.{TRVM, TVM} are 1 

















Traps from Registers Syndrome reporting in ESR_EL2 

AArch6é4 state SCTLR_EL1, TTBRO EL1, TTBR1 EL1, TCR_EL1, Trapped AArch64 MSR, MRS, or System instruction, 
ESR_EL1, FAR EL1, AFSRO_EL1, AFSR1_ ELI, using EC value 0x18. 
MAIR EL1, AMAIR ELI, CONTEXTIDR ELI. 

AArch32 state SCTLR, TTBRO, TTBR1, TTBCR, TTBCR2, DACR, Trapped MCR or MRC access (coproc==0b1111), using EC 
DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR, PRRR, value 0x03. 
NMRR, MAIRO, MAIR1, AMAIRO, AMAIRI, Trapped MCRR or MRRC access (coproc==0b1111), using 
CONTEXTIDR. EC value 0x04. 

Note 


ARM DDI 0487E.a 
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EL2 provides a second stage of address translation, that a hypervisor can use to remap the address map defined by 
a Guest OS. In addition, a hypervisor can trap attempts by a Guest OS to write to the registers that control the 
Non-secure memory system. A hypervisor might use this trap as part of its virtualization of memory management. 





Disabling Non-secure state execution of HVC instructions 
HCR_EL2.HCD disables execution of HVC instructions: 


1 HVC instructions are UNDEFINED at EL2 and EL1, and any resulting exception is taken from the 
current Exception level to the current Exception level. 


0 HVC instruction execution is enabled at EL2 and EL1. 





Note 
HVC instructions are always UNDEFINED at ELO. 





HCR_EL2.HCD is only implemented if EL3 is not implemented. Otherwise, it is RESO. 
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Table D1-37 shows how the exceptions are reported in ESR_ELx: 


Table D1-37 Instruction disabled when HCR_EL2.HCD is 1 





Taken from Disabled instruction Syndrome reporting in ESR_ELx 





AArch64 state HVC Exception for an unknown reason, using EC value 0x00 





AArch32 state HVC 





Traps to EL2 of ELO and EL1 execution of DC ZVA instructions 
HCR_EL2.TDZ traps ELO and EL1 execution of DC ZVA instructions to EL2: 


1 Any attempt to execute a DC ZVA instruction at ELO or EL] is trapped to EL2 if enabled in the current 
Security state. Reading the DCZID_ELO returns a value that indicates that DC ZVA instructions are 
not implemented. 


0 This control has no effect on execution of DC ZVA instructions. 


Table D1-38 shows how the exceptions are reported in ESR_EL2: 


Table D1-38 Instruction trapped to EL1 when HCR_EL2.TDZ is 0 





Traps from Trapped instruction Syndrome reporting in ESR_EL2 





AArch64 state DC ZVA Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 





AArch32 state n/a n/a 





Traps to EL2 of EL1 execution of TLB maintenance instructions 
In the Armv8-A architecture, the System instruction encoding space includes TLB maintenance instructions. 


HCR_EL2.TTLB traps EL1 execution of TLB maintenance instructions to EL2 if enabled in the current Security 
state: 


1 Any attempt to execute a TLBI instruction at EL1 is trapped to EL2. 
0 This control has no effect on execution of TLBI instructions. 


Table D1-39 shows the instructions that are trapped, and how the exceptions are reported in ESR_EL2: 


Table D1-39 Instructions trapped to EL2 when HCR_EL2.TTLB is 1 





Traps from 


Trapped instructions 


Syndrome reporting in 
ESR_EL2 





AArch64 state 


TLBI VMALLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1, TLBI VALE1,TLBI Trapped AArch64 MSR, MRS, 
VAALE1, TLBI VMALLEIIS, TLBI VAE1IS, TLBI ASIDES, TLBI VAAEIIS, or System instruction, using 
TLBI VALEIIS, TLBI VAALEIIS, TLBI VMALLEIOS, TLBI VAE1OS, TLBI EC value 0x18 

ASIDE1OS, TLBI VAAE10S, TLBI VALE1OS, TLBI VAALE1OS, TLBI RVAE1, 

TLBI RVAAE]1, TLBI RVALE1, TLBI RVAALE1, TLBI RVAEIIS, TLBI 

RVAAEIIS, TLBI RVALELS, TLBI RVAALEIIS, TLBI RVAE1OS, TLBI 

RVAAE1OS, TLBI RVALE1OS, TLBI RVAALE1OS. 





AArch32 state 


D1-2340 


TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, TLBIMVALIS, Trapped MCR or MRC access 
TLBIMVAALIS, ITLBIALL, ITLBIMVA, ITLBIASID, DTLBIALL, DTLBIMVA, — (coproc==0b1111), using EC 
DTLBIASID, TLBIALL, TLBIMVA, TLBIASID, TLBIMVAA, TLBIMVAL, value 0x03 
TLBIMVAAL. 
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Note 
These instructions are always UNDEFINED at ELO. 








For more information about these instructions, see: 
. TLB maintenance instructions on page D5-2641, for the AArch64 state instructions. 
. The scope of TLB maintenance instructions on page G5-5802, for the AArch32 state instructions. 


Traps to EL2 of ELO and EL1 execution of cache maintenance instructions 


HCR_EL2.{TSW, TPC, TPU} trap cache maintenance instructions to EL2, if enabled in the current Security state, 














as follows: 

0 The control has no effect on the execution of cache maintenance instructions. 

1 Any attempt to execute a corresponding cache maintenance instruction at EL1, or at ELO if 

permitted by SCTLR_EL1.UCI, is trapped to EL2. 
Table D1-40 Controls for trapping cache maintenance instructions to EL2 

Trap control Trapped instructions 
HCR_EL2.TSW Data or unified cache maintenance by set/way 
HCR_EL2.TPC Data or unified cache maintenance to point of coherency 
HCR_EL2.TPU Cache maintenance to point of unification 

For: 


è HCR_EL2.TSW == 1, Table D1-41 shows the instructions that are trapped, and how the exceptions are 
reported in ESR_EL2. 


HCR_EL2.TPC == 1, Table D1-42 on page D1-2342 shows the instructions that are trapped, and how the 
exceptions are reported in ESR_EL2. 


s HCR_EL2.TPU == 1, Table D1-43 on page D1-2342 shows the instructions that are trapped, and how the 
exceptions are reported in ESR_EL2. 


Table D1-41 Instructions trapped to EL2 when HCR_EL2.TSW is 1 





Traps from Trapped instructions Syndrome reporting in ESR_EL2 





AArché4 state DC ISW, DC CSW, DC CISW Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 





AArch32 state DCISW, DCCSW, DCCISW Trapped MCR or MRC access (coproc==0b1111), using EC value 0x03 








Note 
These instructions are always UNDEFINED at ELO. 
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Table D1-42 Instructions trapped to EL2 when HCR_EL2.TPC is 1 





Traps from Trapped instructions Syndrome reporting in ESR_EL2 





AArch64 state DC IVAC, DC CVAC, DC CIVAC Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 





AArch32 state DCIMVAC, DCCIMVAC, DCCMVAC Trapped MCR or MRC access, (coproc==0b1111) using EC value 0x03 





Note 
DC IVAC is always UNDEFINED at ELO using AArch64. 





DCIMVAC, DCCIMVAC, and DCCMVAC are always UNDEFINED at ELO using AArch32. 





Table D1-43 Instructions trapped to EL2 when HCR_EL2.TPU is 1 





Traps from Trapped instructions Syndrome reporting in ESR_EL2 





AArch6é4 state IC IVAU, IC IALLU, IC IALLUIS, DC CVAU Trapped AArch64 MSR, MRS, or System instruction, using EC 
value 0x18 





AArch32 state ICIMVAU, ICIALLU, ICIALLUIS, DCCMVAU Trapped MCR or MRC access (coproc==0b1111), using EC value 
0x03 





Note 
IC IALLUIS and IC IALLU are always UNDEFINED at ELO using AArch64. 





ICIMVAU, ICIALLU, ICIALLUIS, and DCCMVAU are always UNDEFINED at ELO using AArch32. 





For more information about these instructions, see: 


s Cache maintenance instructions, and data cache zero operation on page C5-367 for the AArch64 
instructions. 
è Cache maintenance system instructions on page K14-7836 for the AArch32 instructions. 


Traps to EL2 of EL1 accesses to the Auxiliary Control Register 


HCR_EL2.TACR traps EL1 accesses to the Auxiliary Control Registers to EL2 if enabled in the current Security 


state: 
1 EL1 accesses to the Auxiliary Control Registers are trapped to EL2. 
0 This control has no effect on accesses to the Auxiliary Control Registers. 


Table D1-44 shows the registers for which accesses are trapped, and how the exceptions are reported in ESR_EL2: 


Table D1-44 Register accesses trapped to EL2 when HCR_EL2.TACR is 1 





Traps from Registers Syndrome reporting in ESR_EL2 





AArché4 state ACTLR ELI Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 





AArch32 state ACTLR and, if implemented, ACTLR2. Trapped MCR or MRC access (coproc==0b1111), using EC value 0x03 





Note 
° The ACTLR_EL1, ACTLR, and ACTLR2 are not accessible at ELO. 
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The Auxiliary Control Registers are IMPLEMENTATION DEFINED registers that might implement global control 
bits for the PE. 





Traps to EL2 of ELO and EL1 accesses to lockdown, DMA, and TCM operations 


The lockdown, DMA, and TCM features of the Armv8-A architecture are IMPLEMENTATION DEFINED. The 
architecture reserves the encodings of a number of System registers for control of these features. 


HCR_EL2.TIDCP traps the execution of System register access instructions that access these registers, as follows: 


1 At EL1, any attempt to execute a System register access instruction with a reserved register 
encoding is trapped to EL2, if enabled in the current Security state. 


At ELO, it is IMPLEMENTATION DEFINED whether attempts to execute System register access 
instructions with reserved register encodings are: 


- Trapped to EL2. 
° UNDEFINED, and any resulting exception is taken to EL1. 


0 This control has no effect on register access instructions with reserved register encodings. 


Table D1-45 shows the register encodings for which accesses are trapped, and how the exceptions are reported in 
ESR_EL2: 


Table D1-45 Encodings trapped to EL2 when HCR_EL2.TIDCP is 1 





Traps 
from 


Register encodings Syndrome reportingin ESR_EL2 





AArch64 Any access to any of the encodings described in Reserved encodings for Trapped AArch64 MSR, MRS, or System 





state IMPLEMENTATION DEFINED registers on page D12-2815. instruction, using EC value 0x18 
AArch32 An access to any of the following encodings: Trapped MCR or MRC access (coproc==0b1111), 
state . CRn==c9, opcl=={0-7}, CRm=={c0-c2, c5-c8}, opc2=={0-7}. using EC value 0x03 


CRn==c 10, opcl=={0-7}, CRm=={c0, cl, c4, c8}, opc2=={0-7}. 
CRn==c 11, opcl=={0-7}, CRm=={c0-c8, c15}, opc2=={0-7}. 





ARM DDI 0487E.a 
ID070919 


An implementation can also include IMPLEMENTATION DEFINED registers that provide additional controls, to give 
finer-grained control of the trapping of IMPLEMENTATION DEFINED features. 


Note 


. Arm expects the trapping of ELO accesses to these functions to EL2 to be unusual, and used only when the 
hypervisor is virtualizing ELO operation. Arm strongly recommends that unless the hypervisor must 
virtualize ELO operation, a ELO access to any of these functions is UNDEFINED, as it would be if the 
implementation did not include EL2. The PE then takes any resulting exception to EL1. 





s The trapping of accesses to these registers from EL1 is higher priority than an exception resulting from the 
register access being UNDEFINED. 





Traps to EL2 of EL1 execution of SMC instructions 


HCR_EL2.TSC traps EL1 execution of SMC instructions to EL2 if enabled in the current Security state: 


1 Any attempt to execute an SMC instruction at EL1 is trapped to EL2, regardless of the value of 
SCR_EL3.SMD. 
0 This control has no effect on execution of SMC instructions. 


If EL3 is not implemented, HCR_EL2.TSC is RESO. 
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Table D1-46 shows how the exceptions are reported in ESR_EL2: 


Table D1-46 SMC Instruction trapped to EL2 when HCR_EL2.TSC is 1 





Traps from Trapped instruction Syndrome reporting in ESR_EL2 





AArch64 state SMC on page C6-1180 Trapped SMC instruction execution in AArch64 state, using EC value 0x17 





AArch32 state SMC on page F5-4520 Trapped SMC instruction execution in AArch32 state, using EC value 0x13 





In AArch32 state, the Armv8-A architecture permits, but does not require, this trap to apply to conditional SMC 
instructions that fail their Condition code check, in the same way as with traps on other conditional instructions. 


For more information about SMC instructions, see SMC on page C6-1180. 





Note 
è This trap is implemented only if the implementation includes EL3. 
° SMC instructions are UNDEFINED at ELO. 
è HCR_EL2.TSC traps execution of the SMC instruction. It is not a routing control for the SMC exception. Trap 


exceptions and SMC exceptions have different preferred return addresses. 





Traps to EL2 of ELO and EL1 accesses to the ID registers 


Other than the MIDR_EL1, MPIDR ELI, and PMCR_ELO.N, the ID registers are divided into groups, with a trap 
control in the HCR_EL2 for each group. 


Table D1-47 ID register groups 





Trap control Register group 





HCR_EL2.TIDO JD group 0, Primary device identification registers on page D1-2345 





HCR_EL2.TID1 JD group 1, Implementation identification registers on page D1-2345 





HCR_EL2.TID2 JD group 2, Cache identification registers on page D1-2346 





HCR_EL2.TID3 ID group 3, Detailed feature identification registers on page D1-2346 


These controls trap register accesses to EL2, as follows: 


HCR_EL2.TIDO 
0 This control has no effect on EL1 reads of the ID group 0 registers. 
1 Any attempt at ELO or EL1 to read any register in ID group 0 is trapped to EL2 if 
enabled in the current Security state. 
HCR_EL2.TID1 
0 This control has no effect on EL1 reads of the ID group 1 registers. 
1 Any attempt at EL1 to read any register in ID group 1 is trapped to EL2 if enabled in the 
current Security state. 
HCR_EL2.TID2 
0 This control has no effect on EL1 and ELO accesses to the ID group 2 registers. 


1 Any attempt at ELO or EL1 to read any register in ID group 2, and any attempt at ELO 
or EL1 to write to the CSSELR or CSSELR_EL1, is trapped to EL2 if enabled in the 
current Security state. 
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HCR_EL2.TID3 
0 This control has no effect on EL1 reads of the ID group 3 registers. 
1 Any attempt at EL1 to read any register in ID group 3 is trapped to EL2 if enabled in the 


current Security state. 


For the MIDR_EL1 and MPIDR_ ELI, and for PMCR_ELO.N, the architecture provides read/write aliases. The 
original register becomes accessible only from EL2 or Secure state, and an ELO or EL1 read of the original register 
returns the value of the read/write alias. This substitution is invisible to the ELO or EL1 software reading the register. 


Table D1-48 ID register substitution 











Register Original Alias, EL2 using AArch64 
Main ID MIDR ELI VPIDR_EL2 
Multiprocessor Affinity MPIDR_ EL1 VMPIDR_EL2 





Performance Monitors Control Register PMCR ELO.N MDCR EL2.HPMN 





Note 


. If the optional Performance Monitors Extension is not implemented, MDCR_EL2.HPMN is RESO and 
PMCR_ELO is reserved. 





° MDCR_EL2.HPMN also affects whether a Performance Monitors counter can be accessed from ELO or EL1. 
See the register description of MDCR_EL2 for more information. 


: PMCR_ELO contains other fields that identify the implementation. For more information about trapping 
accesses to the PMCR_ELO, see Traps to EL2 of ELO and EL] accesses to Performance Monitors registers 
on page D1-2355. 





ID group 0, Primary device identification registers 


In: 
s AArch64 state, there are no ID group 0 registers. 
7 AArch32 state, these registers identify some top-level implementation choices. 


Table D1-49 shows the registers that are in ID group 0 for traps to EL2, and how the exceptions are reported in 
ESR_EL2: 


Table D1-49 ID group 0 registers 





Traps from Group 0 registers Syndrome reporting in ESR_EL2 














AArch64 state n/a n/a 
AArch32 state FPSID Trapped VMRS System register access, using EC value 0x08 
JIDR Trapped MRC System register access (coproc==0b1110), using EC value 0x05 
Note 


ARM DDI 0487E.a 
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The FPSID is not accessible from ELO using AArch32. 





When the FPSID is accessible, a T32 or A32 VMSR FPSID, <Rt> instruction is permitted but is ignored. The execution 
of this VMSR instruction execution is not trapped by the ID group 0 trap. 


ID group 1, Implementation identification registers 


These registers often provide coarse-grained identification mechanisms for implementation-specific features. 
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Table D1-50 shows the registers that are in ID group 1 for traps to EL2, and how the exceptions are reported in 








ESR_EL2: 
Table D1-50 ID group 1 registers 
Traps from Group 1 registers Syndrome reporting in ESR_EL2 
AArch64 state REVIDR_ ELI, AIDR EL1 Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 





AArch32 state TCMTR,TLBTR, REVIDR, AIDR Trapped MCR or MRC System register access (coproc==0b1111), using EC value 
0x03 





ID group 2, Cache identification registers 
These registers describe and control the cache implementation. 


Table D1-51 shows the registers that are in ID group 2 for traps to EL2, and how the exceptions are reported in 











ESR_EL2: 
Table D1-51 ID group 2 registers 
Traps from Group 2 registers Syndrome reporting in ESR_EL2 
AArché4 state CTR _ELO, CCSIDR_EL1, CLIDR_EL1, Trapped AArch64 MSR, MRS, or System instruction, using EC 
CSSELR_EL1, and, if implemented, CCSIDR2_EL1. value 0x18 
AArch32 state CTR, CCSIDR, CLIDR, CSSELR, and, if Trapped MCR or MRC System register access 
implemented, CCSIDR2. (coproc==0b1111), using EC value 0x03 





ID group 3, Detailed feature identification registers 


These registers provide detailed information about the features of the implementation. 





Note 
In AArch32 state, these registers are called the CPUID registers. There is no requirement for this trap to apply to 
those registers that the CPUID Identification Scheme defines as reserved. See The CPUID identification scheme on 
page G8-5893. 
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Table D1-52 shows the registers that are in ID group 3 for traps to EL2, and how the exceptions are reported in 


ESR_EL2: 


Table D1-52 ID group 3 registers 





Traps from 


Group 3 registers 


Syndrome reporting in ESR_EL2 





AArch64 state 


ID_PFRO_EL1, ID PFR1_EL1,ID _DFRO ELI. 

ID_AFRO_EL1, ID MMFRO EL1,ID_MMFRI ELI, 

ID_MMFR2_ EL1,1D MMFR3_EL1, andID MMFR4 ELI, except that 
if ID MMFR4 EL]! is implemented as RAZ/WI then it is 
IMPLEMENTATION DEFINED whether reads of the register are trapped. 
ID_ISARO EL1, ID ISAR1_EL1, ID_ISAR2 EL1, ID ISAR3_EL1, 
ID_ISAR4 EL1, ID ISAR5_ EL1. 

MVFRO_EL1, MVFRI_ELI, MVFR2_EL1. 

ID_AA64PFRO_EL1, ID AA64PFR1_EL1.ID_AA64DFRO ELI, 
ID_AA64DFR1_EL1.ID_AA64ISARO EL1,ID_AA64ISAR1_EL1. 
ID_AA64MMEFRO EL1, ID AA64MMFRI ELI, 
ID_AA64MMFR2 ELI, ID _AA64AFRO_EL1,ID_AA64AFRI ELI. 

It is IMPLEMENTATION DEFINED whether HCR_EL2.TID3 traps MRS 
accesses to registers in the following range that are not already mentioned 
in this table: 

° op == 3, CRn == c0, op1 == 0, CRm {c2-c7}, op2 == {0-7}. 























Trapped AArch64 MSR, MRS, or System 
instruction, using EC value 0x18 


When ARMv8.4-IDST is 
implemented, trapped ID registers 





AArch32 state 


MVFRO, MVFR1, MVFR2. 


Trapped VMRS System register access, 
using EC value 0x08 





ID_PFRO, ID_PFR1, ID_DFRO, ID_AFRO. 

ID_MMEFRO, ID MMFR1, ID MMFR2, ID MMFR3 and, ID MMFR4, 
except that if ID MMFR4 is implemented as RAZ/WI then it is 
IMPLEMENTATION DEFINED whether reads of the register are trapped. 
ID_ISARO, ID_ISAR1, ID_ISAR2, ID_ISAR3, ID_ISAR4, ID_ISARS. 
Any MRC access to any of the following encodings in the (coproc==0b1111) 
encoding space: 

. CRn == c0, opc1 == 0, CRm == {c3-c7}, opc2 == {0, 1}. 

. CRn == c0, opc1 == 0, CRm == c3, opc2 == 2. 

. CRn == c0, opc1 == 0, CRm == c5, opc2 {4, 5}. 

It is IMPLEMENTATION DEFINED whether HCR_EL2.TID3 traps MRC 
accesses to in the (coproc==0b1111) encoding space in the following range 
that are not already mentioned in this table: 


° CRn == c0, opc1 == 0, CRm {c2-c7}, opc2 == {0-7}. 


























Trapped MCR or MRC System register 
access (coproc==0b1111), using EC 
value 0x03 
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Traps to EL2 of ELO and EL1 execution of WFE and WFI instructions 


HCR_EL2.{TWE, TWI} trap ELO and EL! execution of WFE and WFI instructions to EL2: 


HCR_EL2.TWE 


1 Any attempt to execute a WFE instruction at ELO or EL1 is trapped to EL2, if the 
instruction would otherwise have caused the PE to enter a low-power state. 

0 This control has no effect on execution of WFE instructions. 

HCR_EL2.TWI 

1 Any attempt to execute a WFI instruction at ELO or EL1 is trapped to EL2, if the 
instruction would otherwise have caused the PE to enter a low-power state. 

0 This control has no effect on execution of WFI instructions. 
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Table D1-53 shows how the exceptions are reported in ESR_EL2: 


Table D1-53 Instructions trapped to EL2 when HCR_EL2.{TWE, TWI} are 1 














Trap control Traps from Trapped instructions Syndrome reporting in ESR_EL2 

HCR_EL2.TWE Both Execution WFE Trapped WFI or WFE instruction, using EC 
states value 0x01 

HCR_EL2.TWI WFI 





In AArch32 state, the attempted execution of a conditional WFE or WFI instruction is only trapped if the instruction 
passes its Condition code check. 





Note 
Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed 
to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the 
instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken. 





For more information about these instructions, and when they can cause the PE to enter a low-power state, see: 
5 Wait for Event mechanism and Send event on page D1-2372. 
° Wait For Interrupt on page D1-2375. 


Traps to EL2 of EL1 and ELO accesses to Activity Monitors registers 


CPTR_EL2.TAM traps EL1 and ELO accesses to the Activity Monitor registers to EL2. 
1 Accesses from EL1 and ELO to Activity Monitor registers are trapped to EL2 
0 This control has no effect on accesses to Activity Monitor registers. 


Table D1-54 shows the registers for which accesses are trapped and how the exceptions are reported in ESR_EL2. 


Table D1-54 Register accesses trapped to EL2 when CPTR_EL2.TAM is 1 


Traps from Registers Syndrome reporting in 





ESR_EL2 
AArch64 state MCFGR_EL0, AMCGCR_EL0, AMCNTENCLRO_ELO, Trapped AArch64 MSR, MRS, 
MCNTENCLR1_EL0, AMCNTENSETO_ELO, or System instruction, 
MCNTENSET1_ELO, AMCR_ELO, using EC value 0x18 


MEVCNTRO<n>_EL0, AMEVCNTR1<n>_EL0, 





AArch32 state MCFGR, AMCGCR, AMCNTENCLRO, AMCNTENCLRI, Trapped MCR or MRC access 
MCNTENSET0, AMCNTENSET1, AMCR, (coproc==0b1111), using 


MEVTYPERO<n>, AMEVTYPER1<n>, AMUSERENR. EC value 0x03 











MEVCNTRO<n>or AMEVCNTRI<n>. Trapped MCRR or MRRC 
access (coproc==0b1111), 
using EC value 0x04 





Trapping to EL2 of EL1 accesses to the CPACR_EL1 or CPACR 
CPTR_EL2.TCPAC traps EL1 accesses to the CPACR_EL1 or CPACR to EL2: 


1 EL1 accesses to the CPACR_EL1 or CPACR are trapped to EL2. 
0 This control has no effect on accesses to CPACR_EL1 or CPACR. 
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Table D1-55 shows how the exceptions are reported in ESR_EL2: 


Table D1-55 Register accesses trapped to EL2 when CPTR_EL2.TCPAC is 1 





Traps from Registers Syndrome reporting in ESR_EL2 





AArch64 state CPACR ELI Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 





AArch32 state CPACR Trapped MCR or MRC System register access (coproc==0b1111), using EC value 0x03 








Note 
The CPACR_EL1 or CPACR is not accessible at ELO. 


In Armv7 and earlier versions of the Arm architecture, one function of the CPACR is as an ID register that 
identifies what coprocessor or conceptual coprocessor functionality is implemented. Legacy software might 
use this identification mechanism, and a hypervisor can use this trap to emulate this mechanism. For more 
information about this coprocessor model see Background to the System register interface on page G1-5568. 


General trapping to EL2 of accesses to the SIMD and floating-point registers 


CPTR_EL2.TFP traps accesses to SIMD and floating-point registers to EL2: 


1 


Any attempt at EL2, or ELO or EL1, to execute an instruction that accesses the SIMD or 
floating-point registers is trapped to EL2. 


This control has no effect on the execution of instructions that access the SIMD or floating-point 
registers. 


Table D1-56 shows the registers for which accesses are trapped, and how the exceptions are reported in ESR_EL2: 


Table D1-56 Register accesses trapped to EL2 when CPTR_EL2.TFP is 1 








Traps from Registers Syndrome reporting in ESR_EL2 
AArch64 state FPCR, FPSR, FPEXC32_EL2, and any of the SIMD and floating-point Trapped access to a SIMD or 

registers VO-V31, including their views as DO-D31 registers or SO-S31 floating-point register, resulting from 

registers. See The SIMD and floating-point registers, VO-V31 on CPACR_EL1.FPEN or 

page D1-2278. CPTR_ELx.TFP, using EC value 0x07 
AArch32 state FPSID, MVFRO, MVFR1, MVFR2, FPSCR, FPEXC, and any of the Trapped access to a SIMD or 

SIMD and floating-point registers QO-Q15, including their views as floating-point register, resulting from 

DO-D31 registers or SO-S31 registers. See Advanced SIMD and CPACR_EL1.FPEN or 

floating-point System registers on page G1-5572. CPTR_ELx.TFP, using EC value 0x072 





a. Permitted VMSR accesses to the FPSID are ignored, but for the purposes of this trap the architecture defines a VMSR access to the FPSID from 
ELI or higher as an access to a SIMD and floating-point register. 


ARM DDI 0487E.a 
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Traps to EL2 of System register accesses to the trace registers 


CPTR_EL2.TTA traps System register accesses to the trace registers to EL2. 


When CPTR_EL2.TTA is: 


1 
0 


System register accesses to the trace registers are trapped to EL2. 
This control has no effect on System register accesses to the trace registers. 


Note 





The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A architecture is 
implemented with an ETMv4 implementation, ELO accesses to the trace registers are UNDEFINED, and any 
resulting exception is higher priority than a CPTR_EL2.TTA Trap exception. 
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s EL2 does not provide traps on trace register accesses through the Memory-mapped interface. 





System register accesses to the trace registers can have side-effects. When a System register access is trapped, no 
side-effects occur before the exception is taken, see Register access instructions on page D1-2327. 


Table D1-57 shows the registers for which accesses are trapped to EL2 when CPTR_EL2.TTA is 1, and how the 
exceptions are reported in ESR_EL2: 


Table D1-57 Register accesses trapped to EL2 when CPTR_EL2.TTA is 1 





Traps from 


Registers Syndrome reporting in ESR_EL2 





AArch64 state 


Trace registers with op0=2, op1=1 Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18. 





AArch32 state 


Trace registers with cpnum=14, ° Trapped MCR or MRC System register access (coproc==0b1110), using EC 
opcl=1 value 0x05. 
à Trapped MCRR or MRRC System register access (coproc==0b1110), using 
EC value 0x0C. 





Traps to EL2 of System register accesses to the trace filter control registers 


MDCR_EL2.TTRF traps System register accesses to the trace filter control registers to EL2, if enabled in the 
current Security state. 


When MDCR_EL2.TTRF is: 
1 EL1 System register accesses to the trace filter control registers are trapped to EL2. 
0 This control has no effect on System register accesses to the trace filter control registers. 


Table D1-58 shows the registers for which accesses are trapped to EL2 when MDCR_EL2.TTRF is 1, and how the 
exceptions are reported in ESR_EL2. 


Table D1-58 Register accesses trapped to EL2 when MDCR_EL2.TTRF is 1 





Traps from Registers Syndrome reporting in ESR_EL2 





AArch64 state TRFCR_EL1 Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18. 





AArch32 state TRFCR Trapped MCR or MRC System register access (coproc==0b1111), using EC value 0x03. 





D1-2350 


General trapping to EL2 of ELO and EL1 accesses to System registers, from AArch32 
state only 


HSTR_EL2. {T0-T3, T5-T13, T15} trap accesses to the AArch32 System registers in the coproc==0b1111 encoding 
space, by the register number, {c0-c3, c5-c13, c15} used for: 

g The CRn argument used when accessing the register using an MCR or MRC instruction. 

è The CRm argument used when accessing the register using an MCRR or MRRC instruction. 


These traps are from AArch32 state only. They are from both: 
. EL1 using AArch32. 
. ELO using AArch32. 


When an HSTR_EL2.Tx trap control is: 


1 Any AArch32 state EL1 or ELO access to the corresponding register is trapped to EL2. 
0 This control has no effect on accesses to the corresponding register. 
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Table D1-59 shows the accesses that are trapped, and how the exceptions are reported in ESR_EL2: 


Table D1-59 Accesses trapped to EL2 when an HSTR_EL2.Tx trap is enabled 





Traps from 


Trapped accesses Syndrome reporting in ESR_EL2 





AArch64 state 


n/a n/a 





AArch32 state 


MCR and MRC instructions, where CRn in the instruction identifies the Trapped MCR or MRC access (coproc==0b1111), 
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trapped encodings in the (coproc==0b1111) encoding space using EC value 0x03 
MCRR and MRRC instructions, where CRm in the instruction identifies Trapped MCRR or MRRC access (coproc==0b1111), 
the trapped encodings in the (coproc==0b1111) encoding space using EC value 0x04 

Note 





HSTR_EL2[4, 14] is reserved, RESO. Although the Generic Timer AArch32 System registers are implemented in 
the coproc==0b1111 encoding space and accessed using a CRn or CRm value of c14, EL2 does not provide a trap on 
accesses to the Generic Timer System registers. 





System registers in the (coproc==0b1111) encoding space with IMPLEMENTATION DEFINED 
access permission from ELO 


For an AArch32 System register in the (coproc==0b1111) encoding space, which is accessed using a CRn or CRm 
value that can be trapped by a HSTR_EL2.Tn control, if an access to the register from ELO is UNDEFINED when the 
value of the corresponding HSTR_EL2.Tn trap control is 0, then when that HSTR_EL2.Tn trap control is 1, it is 
IMPLEMENTATION DEFINED whether an access from Non-secure ELO using AArch32: 


š Generates a Trap exception that is taken to EL2. 
e Is UNDEFINED and generates an exception that is taken to Non-secure EL1. 


If the instruction is treated as UNDEFINED and generates an exception that is taken to Non-secure EL1, and 
Non-secure EL1 is using AArch64, the exception is reported in ESR_EL1 as an exception for an unknown reason, 
using EC value 0x00. 


Note 


Arm expects that trapping to EL2 of Non-secure ELO accesses to AArch32 System register in the (coproc==0b1111) 
encoding space will be unusual, and used only when the hypervisor must virtualize ELO operation. Arm 
recommends that, whenever possible, Non-secure ELO accesses to the System registers behave as they would if the 
implementation did not include EL2. This means that, if the architecture does not support the Non-secure ELO 
access, then the register access instruction is treated as UNDEFINED and generates an exception that is taken to 
Non-secure EL1. 








Traps to EL2 of ELO and EL1 System register accesses to debug registers 


MDCR_EL2.{TDRA, TDOSA, TDA} trap System register accesses to the debug registers to EL2 if enabled in the 
current Security state, as follows: 


° MDCR_EL2.(TDRA, TDA} trap ELO and EL1 accesses. 
e MDCR_EL2.TDOSA traps EL1 accesses. 


Note 


EL2 does not provide traps on debug register accesses through the optional memory-mapped external debug 
interfaces. 








System register accesses to the debug registers can have side-effects. When a System register access is trapped to 
EL2, no side-effects occur before the exception is taken to EL2. See Register access instructions on page D1-2327. 
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Table D1-60 shows the subsections that list the accesses trapped. The subsections describe how the traps are 
reported in ESR_EL2: 


Table D1-60 Traps of Non-secure ELO and EL1 accesses to debug registers 





Trap control Subsection 





MDCR_EL2.TDRA Traps to EL2 of ELO and EL1 System register accesses to debug registers on page D1-2351 





MDCR_EL2.TDOSA Trapping System register accesses to powerdown debug registers to EL2 





MDCR_EL2.TDA Trapping general System register accesses to debug registers to EL2 on page D1-2353 





Trapping System register accesses to Debug ROM registers to EL2 


MDCR_EL2.TDRA traps ELO and EL1 System register accesses to the Debug ROM registers to EL2 if enabled in 
the current Security state: 


1 ELO and EL1 System register accesses to the Debug ROM registers are trapped to EL2. 
0 This control has no effect on System register accesses to the Debug ROM registers. 
This trap applies to Non-secure ELO only if it is using AArch32. 


Table D1-61 shows the register accesses that are trapped, and how the exceptions are reported in ESR_EL2: 


Table D1-61 Register accesses trapped to EL2 when MDCR_EL2.TDRA is 1 





Traps from 


Registers Syndrome reporting in ESR_EL2 





AArch64 state 


MDRAR EL1 Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18. 





AArch32 state 


DBGDRAR, DBGDSAR For accesses using: 


od MCR or MRC instructions, trapped MCR or MRC access (coproc==0b1110), using EC 
value 0x05. 

` MCRR or MRRC instructions, trapped MCRR or MRRC access (coproc==0b1110), using 
EC value 0x0C. 





D1-2352 


If MDCR_EL2.TDE or HCR_EL2.TGE is 1, behavior is as if MDCR_EL2.TDRA is 1 other than for the purpose 
of a direct read. 


Trapping System register accesses to powerdown debug registers to EL2 


MDCR_EL2.TDOSA traps EL1 System register accesses to the powerdown debug registers to EL2 if enabled in 
the current Security state: 


1 EL1 System register accesses to the powerdown debug registers are trapped to EL2. 
0 This control has no effect on accesses to the powerdown debug registers. 
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Table D1-62 shows the register accesses that are trapped, and how the exceptions are reported in ESR_EL2: 


Table D1-62 Register accesses trapped to EL2 when MDCR_EL2.TDOSA is 1 











Traps from Registers Syndrome reporting in ESR_EL2 
AArch64 state OSLAR EL1, OSLSR_EL1, OSDLR_EL1, DBGPRCR_EL1. Trapped AArch64 MSR, MRS, or System 
Any IMPLEMENTATION DEFINED integration registers. instruction, using EC value 0x18. 
Any IMPLEMENTATION DEFINED register with similar functionality that 
the implementation specifies as trapped by MDCR_EL2.TDOSA 
AArch32 state DBGOSLSR, DBGOSLAR, DBGOSDLR, DBGPRCR. Trapped MCR or MRC access 
Any IMPLEMENTATION DEFINED integration registers. (coproc==0b1110), using EC value 0x05. 


Any IMPLEMENTATION DEFINED register with similar functionality that 
the implementation specifies as trapped by HDCR.TDOSA 
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Note 


These registers are not accessible at ELO. 








If MDCR_EL2.TDE or HCR_EL2.TGE is 1, behavior is as if MDCR_EL2.TDOSA is 1 other than for the purpose 
of a direct read. 


Trapping general System register accesses to debug registers to EL2 


MDCR_EL2.TDA traps ELO and EL1 System register accesses to those debug System registers that are not 
mentioned in either of the following: 


. Traps to EL2 of ELO and EL1 System register accesses to debug registers on page D1-2351. 
s Trapping System register accesses to powerdown debug registers to EL2 on page D1-2352. 


This means that MDCR_EL2.TDA traps ELO and EL1 System register accesses to all debug System registers to 
EL2 if enabled in the current Security state, except the following: 


. Any access from: 
—  AArch64 state to the MDRAR ELI. 
—  AArch32 state to the DBGDRAR or DBGDSAR. 


MDCR_EL2.TDRA traps these accesses. 


$ Any access from: 
— AArch64 state to the OSLAR_EL1, OSLSR_EL1, OSDLR_EL1 or DBGPRCR_EL1. 
— AArch32 state to the DBGOSLSR, DBGOSLAR, OSDLR_EL1 or DBGPRCR. 


MDCR_EL2.TDOSA traps these accesses. 


When the PE is in Debug state, MDCR_EL2.TDA does not trap any access from: 
$ AArch32 state to DBGDTRRXint and DBGDTRTXint. 
° AArch64 state to DBGDTR_EL0, DBGDTRRX_ELO, and DBGDTRTX_ELO. 


When MDCR_EL2.TDA is: 


1 ELO or EL1 System register accesses to any of the registers shown in Table D1-63 on page D1-2354 
are trapped to EL2. 
0 This control has no effect on accesses to the registers shown in Table D1-63 on page D1-2354. 
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Table D1-63 shows how the exceptions are reported in ESR_EL2: 


Table D1-63 Accesses trapped to EL2 when MDCR_EL2.TDA is 1 





Traps from 


Trapped accesses 


Syndrome reporting in ESR_EL2 





AArch64 state 


Accesses to the MDCCSR_EL0, MDCCINT_EL1, DBGDTR_ELO, Trapped AArch64 MSR, MRS, or System 
DBGDTRRX_EL0, DBGDTRTX_EL0,OSDTRRX_EL1,MDSCR_EL1, instruction, using EC value 0x18 
OSDTRTX_EL1, OSECCR_EL1, DBGBVR<n>_EL1, 


DBGBCR<n>_EL1, DBGWVR<n>_EL1, DBGWCR<n>_EL1, 


DBGCLAIMSET EL1, DBGCLAIMCLR _ ELI, and 
DBGAUTHSTATUS EL1. 





AArch32 state 


Accesses to the DBGDIDR, DBGDSCRint, DBGDCCINT, 
DBGDTRRXint, DBGDTRTXint, DBGWFAR, DBGVCR, 


For accesses using MCR or MRC 
instructions, trapped MCR or MRC access 


DBGDSCRext, DBGDTRTXext, DBGDTRRXext, DBGBVR<n>, (coproc==0b1110), using EC value 


DBGBCR<n>, DBGBXVR<n>, DBGWCR<n>, DBGWVR<n>, 
DBGCLAIMSET, DBGCLAIMCLR, DBGAUTHSTATUS, 


0x05 


DBGDEVID, DBGDEVID1, DBGDEVID2, and DBGOSECCR. 





STC accesses to DBGDTRRXint. 
LDC accesses to DBGDTRTXint. 


Trapped LDC or STC access, using EC 
value 0x06 





If MDCR_EL2.TDE or HCR_EL2.TGE is 1, behavior is as if MDCR_EL2.TDA is 1 other than for the purpose of 
a direct read. 


Traps to EL2 of ELO and EL1 accesses to the Generic Timer registers 


CNTHCTL_EL2.{EL1PCEN, EL1PCTEN} trap ELO and EL1 accesses to the Generic Timer registers to EL2 if 
enabled for the current Security state, as follows: 


è CNTHCTL_EL2.EL1PCEN traps ELO and EL1 accesses to the physical timer registers. 
è CNTHCTL_EL2.EL1PCTEN traps ELO and EL1 accesses to the physical counter register. 


For each of these controls: 
1 ELO and EL] accesses are not trapped to EL2. 
0 ELO and EL] accesses are trapped to EL2. 


Table D1-64 shows the registers for which accesses are trapped, and how the exceptions are reported in ESR_EL2. 


Table D1-64 Register accesses trapped to EL2 by CNTHCTL_EL2 trap controls 








Traps from Trap control Registers Syndrome reporting in ESR_EL2 
AArch64 state EL1PCEN CNTP_CTL_ELO, CNTP_CVAL EL, Trapped AArch64 MSR, MRS, or System instruction, 
CNTP_TVAL ELO using EC value 0x18 





ELIPCTEN CNTPCT_ELO 





AArch32 state 


D1-2354 


EL1PCEN CNTP_CTL, CNTP_CVAL, CNTP_TVAL For accesses using: 


. MCR or MRC instructions, trapped MCR or MRC 
access (coproc==0b1111), using EC value 
0x03 

° MCRR or MRRC instructions, trapped MCRR or 
MRRC access (coproc==0b1111), using EC 





value 0x04 
ELIPCTEN CNTPCT Trapped MCRR or MRRC access (coproc==0b1111), 
using EC value 0x04 
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Traps to EL2 of ELO and EL1 accesses to Performance Monitors registers 


MDCR_EL2.{TPM, TPMCR} trap ELO and EL 1 accesses to the Performance Monitors registers to EL2 if enabled 
in the current Security state: 


MDCR_EL2.TPM 
1 ELO and EL1 accesses to the Performance Monitors registers are trapped to EL2. 
0 This control has no effect on accesses to the Performance Monitors registers. 


MDCR_EL2.TPMCR 


1 ELO and EL1 accesses to the Performance Monitors Control Registers are trapped to 
EL2. 
0 This control has no effect on accesses to the Performance Monitors Control Registers. 


Note 


EL2 does not provide traps on Performance Monitor register accesses through the optional memory-mapped 
external debug interface. 








For: 


- MDCR_EL2.TPM == 1, Table D1-65 shows the registers for which accesses are trapped, and how the 
exceptions are reported in ESR_EL2. 


° MDCR_EL2.TPMCR == 1, Table D1-66 shows the registers for which accesses are trapped, and how the 
exceptions are reported in ESR_EL2. 


Table D1-65 Register accesses trapped to EL2 when MDCR_EL2.TPM is 1 








Traps from Registers Syndrome reporting in ESR_EL2 
AArch64 state PMCR_ELO, PMCNTENSET_ELO, PMCNTENCLR_ELO, Trapped AArch64 MSR, MRS, or System instruction, 
PMOVSCLR_ELO, PMSWINC_ELO, PMSELR_ELO, using EC value 0x18 
PMCEIDO ELO, PMCEID1_EL0, PMCCNTR_ELO, 
PMXEVTYPER_ ELO, PMXEVCNTR_ELO, 
PMUSERENR_ELO, PMINTENSET EL1, 
PMINTENCLR_EL1, PMOVSSET_ELO, 
PMEVCNTR<n>_ELO, PMEVTYPER<n>_ELO, 
PMCCFILTR_ELO. 
AArch32 state PMCR, PMCNTENSET, PMCNTENCLR, PMOVSR, For accesses using: 
PMSWINC, PMSELR, PMCEIDO, PMCEID1, PMCCNTR, . MCR or MRC instructions, trapped MCR or MRC 
PMXEVTYPER, PMXEVCNTR, PMUSERENR, access (coproc==0b1111), using EC value 
PMINTENSET, PMINTENCLR, PMOVSSET, 0x03 
PMEVCNTR<n>, PMEVTYPER<n>, PMCCFILTR. 


è MCRR or MRRC instructions, trapped MCRR or 
MRRC access, (coproc==0b1111) using 
EC value 0x04 
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Table D1-66 Register accesses trapped to EL2 when MDCR_EL2.TPMCR is 1 





Traps from Registers Syndrome reporting in ESR_EL2 





AArch64 state PMCR_ELO Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 





AArch32 state PMCR Trapped MCR or MRC access (coproc==0b1111), using EC value 0x03 
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Note 


MDCR_EL2.HPMN affects whether a counter can be accessed from Non-secure ELO or ELI. See the register 
description of MDCR_EL2 for more information. 





Traps to EL2 of EL1 accesses to the RAS error record registers 


HCR_EL2.TERR traps EL1 accesses to the RAS ER* registers to EL2 if enabled in the current Security state. 


Table D1-67 Register accesses trapped to EL2 when HCR_EL2.TERR is 1 








Traps from Registers Syndrome reporting in ESR_EL2 
AArch64 state ERRIDR_EL1, ERRSELR EL1, ERXADDR ELI, Trapped AArch64 MSR, MRS, or System instruction, 
ERXCTLR_EL1, ERXFR_EL1, ERXMISCO_EL1, using EC value 0x18 


ERXMISC1_EL1, ERXMISC2_ EL1, ERXMISC3_ ELI, 
ERXSTATUS ELI. 





AArch32 state 


ERRIDR, ERRSELR, ERXADDR, ERXADDR2, For accesses using: 

ERXCTLR, ERXCTLR2, ERXFR, ERXFR2, ERXMISCO, ° MCR or MRC instructions, trapped MCR or MRC 
ERXMISC1, ERXMISC2, ERXMISC3, ERXMISC4, access (coproc==0b1111), using EC value 
ERXMISC5, ERXMISC6, ERXMISC7, ERXSTATUS. 0x03 


G MCRR or MRRC instructions, trapped MCRR or 
MRRC access, (coproc==0b1111) using 
EC value 0x04 





HCR_EL2.FIEN traps EL1 accesses to the RAS ER* registers to EL2 if enabled in the current Security state. 


Table D1-68 Register accesses trapped to EL2 when HCR_EL2.FIEN is 1 





Traps from 


Registers Syndrome reporting in ESR_EL2 





AArch64 state 


ERXPFGCDN_EL1, ERXPFGCTL_EL1, ERXPFGF ELI. Trapped AArch64 MSR, MRS, or System instruction, 


using EC value 0x18 





D1-2356 


Enabling use of the Pointer authentication instructions, EL2 translation regime 
This control is implemented when ARMv8.3-PAuth is implemented. 


Each of the SCTLR_EL2.{EnDA, EnDB, EnIA, EnIB} fields enables the pointer authentication functionality for 
the corresponding Pointer authentication instructions for the EL2 or EL2&0 translation regime. For more 
information see System register control of pointer authentication on page D5-2510. 





Note 


These controls cause the pointer authentication instructions to execute as NOPs. They never cause an exception to be 
generated. 





Trap to EL2 of EL1 accesses to Pointer authentication key registers 


This control is implemented when ARMv8.3-PAuth is implemented. 
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HCR_EL2.APK traps, to EL2 if enabled in the current Security state, accesses to the Pointer authentication key 
registers from EL1 to EL2. Because pointer authentication is supported only in AArch64 state this control only traps 
from AArch64 state. Table D1-69 shows the register accesses that are trapped and how the exceptions are reported 
in ESR_EL2: 


Table D1-69 Register accesses trapped to EL2 when HCR_EL2.APK is 0 

















Traps from Registers Syndrome reporting in ESR_EL2 
AArché4 state APDAKeyLo EL1, APDAKeyHi EL1, APDBKeyLo EL1, Trapped AArch64 MSR, MRS, or System 
APDBKeyHi EL1, APGAKeyLo EL1, APGAKeyHi EL1, instruction, using EC value 0x18. 
APIAKeyLo_EL1, APIAKeyHi EL1, APIBKeyLo EL1, 
APIBKeyHi_EL1 
For more information see System register control of pointer authentication on page D5-2510. 
Trap to EL2 of ELO accesses to Pointer authentication instructions 
This control is implemented when ARMv8.3-PAuth is implemented. 
HCR_EL2.API traps, to EL2 if enabled in the current Security state, accesses to any of the Pointer authentication 
instructions for which pointer authentication is enabled, for instructions executed either: 
° At ELI. 
: If the Effective value of HCR_EL2.{TGE, E2H} is not {1, 1}, at ELO. 
Because pointer authentication is supported only in AArch64 state, this control only traps from AArch6é4 state. 
Table D1-70 shows the instructions that might be trapped and how the exceptions are reported in ESR_EL2: 
Table D1-70 Instructions that might be trapped to EL2 when HCR_EL2.API is 0 
Traps from Instructions that might bea trapped Syndrome reporting in ESR_EL2 
AArch64 state  AUTIASP, AUTIAZ, AUTIA1716, AUTIBSP, AUTIBZ, AUTIB1716, AUTIA, AUTDA, Trapped Pointer authentication 


AUTIB, AUTDB, AUTIZA, AUTDZA, AUTIZB, AUTDZB, PACIASP, PACIAZ, PACIA1716, instruction, using EC value 0x09. 
PACIBSP, PACIBZ, PACIB1716, PACIA, PACDA, PACIB, PACDB, PACIZA, PACDZA, 

PACIZB, PACDZB, PACGA. 

RETAA, RETAB, BRAA, BRAB, BLRAA, BLRAB, BRAAZ, BRABZ, BLRAAZ, BLRABZ, ERETAA, 

ERETAB, LDRAA, LDRAB. 


a. An instruction is trapped only if Pointer authentication is enabled for that instruction. 


ARM DDI 0487E.a 
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For more information, including the description of when pointer authentication is enabled for an instruction, see 
System register control of pointer authentication on page D5-2510. 


Disabling Address tagging for instruction accesses, EL2 translation regime 
This control is implemented when ARMv8.3-PAuth is implemented. 


When a TCR_EL2.TBI or TCR_EL2.{TBIO, TBI1} field enables the use of address tagging for the EL2 translation 
regime, the corresponding TCR_EL2.TBID or TCR_EL2.{TBIDO, TBID1} field determines whether address 
tagging is used for both data and instruction addresses, or only for data addresses. For more information see Address 
tagging in AArch64 state on page D5-2506. 





Note 


These controls determine the scope of address tagging. They never cause an exception to be generated. 
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Traps to EL2 for Nested virtualization 


These controls are implemented when ARMv8.3-NV is implemented. 





Note 


When ARMv8.4-NV is implemented and HCR_EL2.NV2 is 1, the redirection of register accesses to memory 
accesses has priority over the trapping of register accesses by HCR_EL2.{NV, NV1}, see Enhanced support for 
nested virtualization on page D5-2617. 


HCR_EL2.NV traps the following to EL2, if enabled in the current Security state, from EL1: 


Some System register, System instruction, and Special-purpose register accesses that are UNDEFINED at EL1 
when ARMv8.3-NV is not implemented. 


Only accesses that are not UNDEFINED at EL2 are trapped. 


Note 


This means that, for a register that is RO at EL2, and UNDEFINED at Non-secure EL] when ARMV8.3-NV is 
not implemented, when ARMv8.3-NV is implemented and this trap is enabled: 





— Read accesses to the register from EL] are trapped to EL2. 
— Write accesses to the register from EL1 remain UNDEFINED. 





The execution of some instructions that are UNDEFINED at EL! when ARMv8.3-NV is not implemented. 


Because nested virtualization is supported only in AArch64 state this control only traps from AArch64 state. 
Table D1-71 shows the registers and instructions that are trapped and how the exceptions are reported in ESR_EL2: 


Table D1-71 Register accesses and instructions trapped to EL2 when HCR_EL2.NV is 1 








Traps from Trapped register accesses or instructions Syndrome reporting in ESR_EL2 
AArch64 Any System or Special-purpose register named *_EL2,* EL0O2, Trapped AArch64 MSR, MRS, or System 
state or * EL12, except SP_EL2. instruction, using EC value 0x18. 
SPSR_abt, SPSR_fiq, SPSR_irq, SPSR_und, using an MRS or MSR 
instruction. 


SP_EL1 using the dedicated MRS or MSR instruction. 

AT S1E2R, AT S1E2W, TLBI ALLE2, TLBI ALLE2IS, TLBI 
VAE2, TLBI VAE2IS, TLBI VALE2, TLBI VALE2IS 

AT S12E0R, AT S12E0W, AT S12E1R, AT S12E1W, TLBI 
ALLE1, TLBI ALLEIIS, TLBI IPAS2E1, TLBI IPAS2E1IS, 
TLBI IPAS2LE1, TLBI IPAS2LE1IS, TLBI VMALLS12E1, 








TLBI VMALLS12E1IS 

ERET, ERETAA, ERETAB®. Trapped ERET, ERETAA, or ERETAB instruction 
execution, using EC value @x1A. 

When EL3 is not implemented and HCR_EL2.TSC==1, SMC. Trapped AArch64 SMC instruction, using 


EC value 0x17. 





a. ERETAA and ERETAB are implemented when ARMv8.3-PAuth is implemented. 


D1-2358 


Note 





In addition, when the value of HCR_EL2.NV is 1, a read of CurrentEL returns the value 0b10 for bits[3:2]. 
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HCR_EL2.NV1 traps to EL2, if enabled in the current Security state, from EL1 accesses to some System registers 
and Special-purpose registers. Because nested virtualization is supported only in AArch64 state this control only 
traps from AArch64 state. Table D1-72 shows the registers that are trapped and how the exceptions are reported in 
ESR_EL2: 


Table D1-72 Register accesses trapped to EL2 when HCR_EL2.NV1 is 1 





Traps from 


Registers Syndrome reporting in ESR_EL2 





AArch64 state 


VBAR_EL1,ELR_EL1,SPSR_EL1 Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18. 





For more information see Effect of HCR_EL2.{NV, NV1} on page D5-2615. 


Trap to EL2 of EL1 accesses to AT S1E« instructions 
This control is implemented when ARMv8.3-NV is implemented. 


HCR_EL2.AT traps to EL2, if enabled in the current Security state, from EL1 accesses to some Address translation 
instructions. Because nested virtualization is supported only in AArch64 state this control only traps from AArch64 
state. Table D1-73 shows the registers that are trapped and how the exceptions are reported in ESR_EL2: 


Table D1-73 Register accesses trapped to EL2 when HCR_EL2.AT is 1 





Traps from 


Registers Syndrome reporting in ESR_EL2 





AArch64 state 


AT S1EOR, AT SIEOW, AT SIEIR, AT SIE1W, AT S1E1RP, Trapped AArch64 MSR, MRS, or System 
AT SIE1WP instruction, using EC value 0x18. 





For more information see Effect of HCR_EL2.{NV, NV1} on page D5-2615. 


D1.14.4 EL3 configurable controls 


ARM DDI 0487E.a 
ID070919 


These controls are in _EL3 System registers. The resulting exceptions might be taken from either Execution state. 
SPSR_EL3.M[4] indicates which Execution state the exception was taken from. 


Table D1-74 shows the EL3 System registers that contain these controls. 


Table D1-74 _EL3 registers that contain instruction enables and disables, and trap controls 





Register name Register description 




















SCTLR_EL3 System Control Register, EL3 
SCR_EL3 Secure Configuration Register 
CPTR_EL3 Architectural Feature Trap Register, EL3 
MDCR_EL3 Monitor Debug Configuration Register, EL3 
TCR_EL3 Translation Control Register, EL3 
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Table D1-75 summarizes the controls. 


Table D1-75 Instruction enables and disables, and trap controls, provided by EL3 





Control 
























































Control Description 
type? P 
SCR_EL3.{TWE, TWI} T Traps to EL3 of EL2, EL1, and ELO execution of WFE and WFI instructions on 
page D1-2361 
SCR_EL3.ST T Traps to EL3 of Secure EL1 accesses to the Counter-timer Physical Secure timer 
registers on page D1-2362 
SCR_EL3.HCE E Enabling EL3, EL2, and Non-secure EL1 execution of HVC instructions on 
page D1-2362 
SCR_EL3.SMD D Disabling EL3, EL2, and EL] execution of SMC instructions on page D1-2363 
CPTR_EL3.TAM T Traps to EL3 of EL2, EL1, and ELO accesses to Activity Monitors registers on 
page D1-2363 
CPTR_EL3.TCPAC T Trapping to EL3 of EL2 accesses to the CPTR_EL2 or HCPTR, and EL2 and EL1 
accesses to the CPACR_EL1 or CPACR on page D1-2364 
CPTR_EL3.TTA T Traps to EL3 of System register accesses to the trace registers on page D1-2364 
MDCR_EL3.TTRF T Traps to EL3 of System register accesses to the trace registers on page D1-2364 
CPTR_EL3.TFP T Traps to EL3 of all accesses to the SIMD and floating-point registers on page D1-2365 
MDCR_EL3.{TDOSA, TDA} T Traps to EL3 of EL2, EL1, and ELO System register accesses to debug registers on 
page D1-2366 
MDCR_EL3.TPM T Traps to EL3 of EL2, EL1, and ELO accesses to Performance Monitors registers on 
page D1-2368 
SCR_EL3.TERR T Traps to EL3 of EL1 and EL2 accesses to the RAS error record registers on 
page D1-2369 
SCR_EL3.FIEN T Traps to EL3 of EL1 and EL2 accesses to the RAS error record registers on 
page D1-2369 
SCTLR_EL3.{EnDA, EnDB, E Enabling use of the Pointer authentication instructions, EL3 translation regime on 
EnIA, EnIB} page D1-2369 
SCR_EL3.APK T Trap to EL3 accesses to Pointer authentication key registers on page D1-2369 
SCR_EL3.API T Trap to EL3 accesses to Pointer authentication instructions on page D1-2370 
TCR_EL3.TBID D Disabling Address tagging for instruction accesses, EL3 translation regime on 


page D1-2370 





a. See Table D1-76. 


D1-2360 


Table D1-76 Control types, for exceptions taken to EL1 














Abbreviation Type See 

D Disable = Instruction enables and instruction disables on page D1-2326 
E Enable — Instruction enables and instruction disables on page D1-2326 
T Trap Trap controls on page D1-2326 
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Also see the following for more general information about traps to EL3: 
° Register access instructions on page D1-2327. 
$ Traps to EL3 of Secure monitor functionality from Secure EL1 using AArch32. 


Traps to EL3 of Secure monitor functionality from Secure EL1 using AArch32 


If EL1 is using AArch32, all of the following are trapped to EL3: 
° Secure EL1 reads and writes to any of the SCR, NSACR, MVBAR or SDCR. 
3 Any attempt at Secure EL1 to execute any of the following: 
— ATSI2NSO** instructions. 
— SRS instructions that use the R13_mon banked register. 
— MRS or MSR instructions that access any of the SPSR_mon, R13_mon or R14_mon banked registers. 


In addition, if EL1 is using AArch32: 
s Secure EL1 write accesses to the CNTFRQ register are UNDEFINED. They are not trapped to EL3. 


à Any attempt at Secure EL1 to change the PE mode to Monitor mode, by using a CPS or an MSR instruction, or 
by performing an exception return, is treated as an illegal change of the CPSR.M field. See ///egal changes 
to PSTATE.M on page G1-5497. 


Table D1-77 shows the accesses that are trapped to EL3, and how the exceptions are reported in ESR_EL3. 


Table D1-77 Accesses trapped to EL3 from Secure EL1 using AArch32 





Taken from Trapped instructions, or trapped accesses Syndrome reporting in ESR_EL3 





Secure EL1 using Reads and writes to any of the SCR, NSACR, MVBAR or SDCR Trapped MCR or MRC access 


AArch32 (coproc==0b1111), using EC value 0x03 
ATS12NSO** instructions 








SRS instructions that use the R13_mon banked register Exception for an unknown reason, 
using EC value 0x00 





MRS or MSR instructions that accesses any of the SPSR_ mon, R13_ mon 
or R14 mon banked registers 





Note 


. Reads of the NSACR from either Non-secure EL1 using AArch32 or Non-secure EL2 using AArch32 return 
the value 0x00000C00. See Restricted access System registers on page G5-5851. 





$ These operations are not available at ELO. 





Traps to EL3 of EL2, EL1, and ELO execution of WFE and WFI instructions 


SCR_EL3.{TWE, TWI} trap EL2, EL1, and ELO execution of WFE and WFI instructions to EL3: 


SCR_EL3.TWE 
1 Any attempt to execute a WFE instruction at any Exception level lower than EL3 is 
trapped to EL3, if the instruction would otherwise have caused the PE to enter a 
low-power state. 
0 This control has no effect on execution of WFE instructions. 
SCR_EL3.TWI 
1 Any attempt to execute a WFI instruction at any Exception level lower than EL3 is 
trapped to EL3, if the instruction would otherwise have caused the PE to enter a 
low-power state. 
0 This control has no effect on execution of WFI instructions. 
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D1-2362 


For ELO and EL1, these traps apply to WFE and WFI execution in both Security states. 


Table D1-78 shows how the exceptions are reported in ESR_EL3. 


Table D1-78 Instructions trapped to EL3 when SCR_EL3.{TWE, TWI} are 1 














Trap control Traps from Trapped instructions Syndrome reporting in ESR_EL3 

SCR_EL3.TWE Both Execution WFE Trapped WFI or WFE instruction, using 
states EC value 0x01 

SCR_EL3.TWI WFI 





In AArch32 state, the attempted execution of a conditional WFE or WFI instruction is only trapped if the instruction 
passes its Condition code check. 


Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed 
to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the 
instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken. 








For more information about these instructions, and when they can cause the PE to enter a low-power state, see: 
. Wait for Event mechanism and Send event on page D1-2372. 
e Wait For Interrupt on page D1-2375. 


Traps to EL3 of Secure EL1 accesses to the Counter-timer Physical Secure timer 
registers 


SCR_EL3.ST traps Secure EL1 accesses to the Counter-timer Physical Secure timer registers to EL3: 
1 Secure EL1 accesses to the Counter-timer Physical Secure timer registers are not trapped to EL3. 
0 Secure EL1 accesses to the Counter-timer Physical Secure timer registers are trapped to EL3. 





Note 


Accesses to the Counter-timer Physical Secure timer registers are always enabled at EL3. 





Table D1-79 shows the registers for which accesses are trapped to EL3, and how the exceptions are reported in 
ESR_EL3. 


Table D1-79 Register accesses trapped to EL3 when SCR_EL3.ST is 0 


Traps from Registers Syndrome reporting in ESR_EL3 





AArch64 state CNTPS TVAL EL1 Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 
CNTPS CTL ELI 
CNTPS_CVAL _EL1 





AArch32 state n/a n/a 








Note 


These registers are not accessible at ELO. 





Enabling EL3, EL2, and Non-secure EL1 execution of HVC instructions 
SCR_EL3.HCE enables HVC instruction execution at EL1 and above: 


1 HVC instruction execution is enabled at EL1 and above. 
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0 HVC instructions are UNDEFINED at EL1, EL2, and EL3, and any resulting exception is taken from the 
current Exception level to the current Exception level. 


For EL1, this enable control applies to HVC instructions in Non-secure state only. 


If EL2 is not implemented, this bit is RESO. 





Note 
HVC instructions are always UNDEFINED at ELO. 


Table D1-80 shows how the exceptions are reported in ESR_ELx: 


Table D1-80 Instruction disabled when SCR_EL3.HCE is 0 





Taken from Disabled instruction Syndrome reporting in ESR_ELx 





AArch64 state HVC Exception for an unknown reason, using EC value 0x00 


AArch32 state 





Disabling EL3, EL2, and EL1 execution of SMC instructions 
SCR_EL3.SMD disables SMC instruction execution at EL1 and above: 


1 SMC instructions are UNDEFINED at EL 1 and above, and any resulting exception is taken from the 
current Exception level to the current Exception level. 


0 SMC instruction execution is enabled at EL1 and above. 


For EL1, this disable control applies to SMC instructions in both Security states. 


Note 
SMC instructions are always UNDEFINED at ELO. 








Table D1-81 shows how the exceptions are reported in ESR_ELx: 


Table D1-81 Exceptions generated when SCR_EL3.SMD is 1 





Taken from Disabled Instruction Syndrome reporting in ESR_ELx 


AArché4 state SMC Exception for an unknown reason, using EC value 0x00 


AArch32 state 





Note 


If HCR_EL2.TSC or HCR.TSC traps attempted EL1 execution of SMC instructions to EL2, that trap has priority over 
this disable. 





Traps to EL3 of EL2, EL1, and ELO accesses to Activity Monitors registers 


CPTR_EL3.TAM traps EL2, EL1, and ELO accesses to the Activity Monitor registers to EL3. 


1 EL2, EL1, and ELO System register accesses to all Activity Monitor registers are trapped to EL3. 
0 This control has no effect on accesses to Activity Monitor registers. 
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Table D1-54 on page D1-2348 shows the registers for which the accesses are trapped and how the exceptions are 
reported in ESR_EL3. 


Table D1-82 Register accesses trapped to EL3 when CPTR_EL3.TAM is 1 





Traps from Registers Syndrome reporting in 





ESR_EL3 
AArch64 state MCFGR_EL0, AMCGCR_EL0, AMCNTENCLRO_ELO, Trapped AArch64 MSR, MRS, 
MCNTENCLR1_EL0, AMCNTENSETO_ELO, or System instruction, 
MCNTENSET1_EL0, AMCR_ELO, using EC value 0x18 


A 

A 

A 
AMEVCNTRO<n>_EL0, AMEVCNTRI1<n>_EL0, 
AMEVTYPERO<n>_EL0, AMEVTYPER1<n>_EL0, 
AMUSERENR ELO. 
A 
A 
A 
A 





AArch32 state MCFGR, AMCGCR, AMCNTENCLRO, AMCNTENCLRI, Trapped MCR or MRC access 
MCNTENSET0O, AMCNTENSET1, AMCR, (coproc==0b1111), using 


MEVTYPERO<n>, AMEVTYPER1<n>, AMUSERENR. EC value 0x03 











MEVCNTRO<n>or AMEVCNTRI<n>. Trapped MCRR or MRRC 
access (coproc==0b1111), 
using EC value 0x04 





Trapping to EL3 of EL2 accesses to the CPTR_EL2 or HCPTR, and EL2 and EL1 
accesses to the CPACR_EL1 or CPACR 


CPTR_EL3.TCPAC traps all of the following to EL3: 
š EL2 accesses to the CPTR_EL2 or HCPTR. 
° EL2 and EL1 accesses to the CPACR_EL1 or CPACR. 


When CPTR_EL3.TCPAC is: 


1 EL2 accesses to the CPTR_EL2 or HCPTR, and EL2 and EL1 accesses to the CPACR_EL1 or 
CPACR, are trapped to EL3. 


0 This control has no effect on accesses to CPTR_EL2, HCPTR, CPACR_EL1 or CPACR. 
For EL1, this trap control applies to accesses from both Security states. 


Table D1-83 shows how the exceptions are reported in ESR_EL3. 


Table D1-83 Register accesses trapped to EL3 when CPTR_EL3.TCPAC is 1 





Traps from Registers Syndrome reporting in ESR_EL3 





AArché4 state CPTR_EL2 Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 
CPACR_EL1 





AArch32 state HCPTR Trapped MCR or MRC access (coproc==0b1111), using EC value 0x03 
CPACR 





Traps to EL3 of System register accesses to the trace registers 


CPTR_EL3.TTA traps System register accesses to the trace registers, from all Exception levels, to EL3: 


1 System register accesses to the trace registers are trapped to EL3. 
0 This control has no effect on accesses to the trace registers. 
D1-2364 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


The AArch64 System Level Programmers’ Model 
D1.14 Configurable instruction enables and disables, and trap controls 


Note 
2 The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A architecture is 
implemented with an ETMv4 implementation, ELO accesses to the trace registers are UNDEFINED, and any 
resulting exception is higher priority than a CPTR_EL3.TTA Trap exception. 





° EL3 does not provide traps on trace register accesses through the Memory-mapped interface. 





System register accesses to the trace registers can have side-effects. When a System register access is trapped, no 
side-effects occur before the exception is taken, see Register access instructions on page D1-2327. 


For ELO and EL1, this trap control applies to accesses from both Security states. 


Table D1-84 shows the registers for which accesses are trapped to EL3, and how the exceptions are reported in 
ESR_EL3. 


Table D1-84 Register accesses trapped to EL3 when CPTR_EL3.TTA is 1 











Traps from Registers Syndrome reporting in ESR_EL3 
AArch64 state Trace registers with op0=2, Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 
opl=1 
AArch32 state Trace registers with cpnum=14, For accesses using: 
opcl=1 . MCR or MRC instructions, trapped MCR or MRC access (coproc==0b1110), using 
EC value 0x05. 


° MCRR or MRRC instructions, trapped MCRR or MRRC access (coproc==0b1110), 
using EC value 0x0C. 





Traps to EL3 of all System register accesses to the filter trace control registers 


MDCR_EL3.TTRF traps System register accesses to the trace registers, from all Exception levels, to EL3: 
1 System register accesses to the filter trace registers are trapped to EL3. 
0 This control has no effect on accesses to the filter trace registers. 


For ELO and EL1, this trap control applies to accesses from both Security states. 


Table D1-85 shows the registers for which accesses are trapped to EL3, and how the exceptions are reported in 
ESR _EL3. 


Table D1-85 Register accesses trapped to EL3 when MDCR_EL3.TTRF is 1 











Traps from Registers Syndrome reporting in ESR_EL3 
AArché4 state TRFCR_ ELI, TRFCR_EL2 Trapped AArch64 MSR, MRS, or System instruction, using EC value 0x18 
AArch32 state HTRFCR, TRFCR For accesses using:MCR or MRC instructions, trapped MCR or MRC access 


(coproc==0b1111), using EC value 0x03. 
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Traps to EL3 of all accesses to the SIMD and floating-point registers 
CPTR_EL3.TFP traps all accesses to SIMD and floating-point registers, from all Exception levels, to EL3: 


1 Any attempt at any Exception level to execute an instruction that accesses the SIMD or 
floating-point registers is trapped to EL3 


0 This control has no effect on the execution of instructions that access the SIMD or floating-point 
registers. 


For ELO and EL1, this trap control applies to accesses from both Security states. 
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Table D1-86 shows the registers for which accesses are trapped to EL3, and how the exceptions are reported in 
ESR EL3. 


Table D1-86 Register accesses trapped to EL3 when CPTR_EL3.TFP is 1 








Traps from Registers Syndrome reporting in ESR_EL3 

AArch64 state FPCR, FPSR, FPEXC32_EL2, and any of the SIMD and Trapped access to a SIMD or floating-point 
floating-point registers V0-V31, including their views as D0-D31 register, resulting from CPACR_EL1.FPEN 
registers or SO-S31 registers. See The SIMD and floating-point or CPTR_ELx.TFP, using EC value 0x07 


registers, VO-V31 on page D1-2278. 





AArch32 state 


FPSID, MVFRO, MVFR1, MVFR2, FPSCR, FPEXC, and any of Trapped access to a SIMD or floating-point 
the SIMD and floating-point registers Q0-Q15, including their register, resulting from CPACR_EL1.FPEN 
views as D0-D3 1 registers or SO-S31 registers. See Advanced SIMD or CPTR_ELx.TFP, using EC value 0x073 
and floating-point System registers on page G1-5572. 





a. Permitted VMSR accesses to the FPSID are ignored, but for the purposes of this trap the architecture defines a VMSR access to the FPSID from 
ELI or higher is an access to a SIMD and floating-point register. 


D1-2366 





Note 
, FPEXC32_EL2 is not accessible from ELO using AArch64. 
° FPSID, MVFRO, MVFR1, and FPEXC are not accessible from ELO using AArch32. 





Traps to EL3 of EL2, EL1, and ELO System register accesses to debug registers 


MDCR_EL3.{TDOSA, TDA} trap EL2, EL1, and ELO System register accesses to the debug registers to EL3, from 
both Security states. 


Note 


EL3 does not provide traps on debug register accesses through the Memory-mapped or External debug interfaces. 








System register accesses to the debug registers can have side-effects. When a System register access is trapped to 
EL3, no side-effects occur before the exception is taken to EL3. See Register access instructions on page D1-2327. 


Table D1-87 shows the subsections that list the accesses trapped. 


Table D1-87 Traps of EL2, EL1, and ELO accesses to debug registers 





Trap control Subsection 





MDCR_EL3.TDOSA Trapping System register accesses to powerdown debug registers to EL3 





MDCR_EL3.TDA Trapping general System register accesses to debug registers to EL3 on page D1-2367 





Trapping System register accesses to powerdown debug registers to EL3 


MDCR_EL3.TDOSA traps EL2 and EL1 accesses to the powerdown debug registers to EL3: 
1 EL2 and EL1 System register accesses to the powerdown debug registers are trapped to EL3. 
0 This control has no effect on accesses to the powerdown debug registers. 


For EL1, this trap control applies to accesses from both Security states. 
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Table D1-88 shows the registers for which accesses are trapped, and how the exceptions are reported in ESR_EL3. 


Table D1-88 Register accesses trapped to EL3 when MDCR_EL3.TDOSA is 1 








Traps from Registers Syndrome reporting in ESR_EL3 
AArch64 state OSLAR EL1,OSLSR_EL1,OSDLR_EL1, Trapped AArch64 MSR, MRS, or System instruction, using 
DBGPRCR ELI. EC value 0x18. 


Any IMPLEMENTATION DEFINED integration registers. 


Any IMPLEMENTATION DEFINED register with similar 


functionality that the implementation specifies as trapped 
by MDCR_EL3.TDOSA. 





AArch32 state 


DBGOSLSR, DBGOSLAR, DBGOSDLR, DBGPRCR. For accesses using: 


a MCR or MRC instructions, trapped MCR or MRC access 
(coproc==0b1110), using EC value 0x05. 


a MCRR or MRRC instructions, trapped MCRR or MRRC 
access (coproc==0b1110), using EC value 0x0C. 





ARM DDI 0487E.a 
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Note 


These registers are not accessible at ELO. 








Trapping general System register accesses to debug registers to EL3 


MDCR_EL3.TDA traps EL2, EL1, and ELO System register accesses to the debug System registers that are not 
mentioned in Trapping System register accesses to powerdown debug registers to EL3 on page D1-2366. 


This means that MDCR_EL3.TDA traps EL2, EL1, and ELO System register accesses to all debug System registers, 
except the following: 


7 Accesses from AArch64 state to the OSLAR_EL1, OSLSR_EL1, OSDLR_EL1 or DBGPRCR_EL1. 
G Accesses from AArch32 state to the DBGOSLSR, DBGOSLAR, OSDLR_EL1 or DBGPRCR. 


When MDCR_EL3.TDA is: 


1 EL2, EL1, and ELO System register accesses to any of the registers shown in Table D1-89 on 
page D1-2368 are trapped to EL3. 


0 This control has no effect on accesses to the registers shown in Table D1-89 on page D1-2368. 


For ELO and EL1, this trap control applies to accesses from both Security states. 


When the PE is in Debug state, MDCR_EL3.TDA does not trap any access from: 
è AArch32 state to DBGDTRRXint and DBGDTRTXint. 
° AArch64 state to DBGDTR_EL0, DBGDTRRX_ELO, and DBGDTRTX_ELO. 
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Table D1-89 shows the registers for which accesses are trapped, and how the exceptions are reported in ESR_EL3. 


Table D1-89 Accesses trapped to EL3 when MDCR_EL3.TDA is 1 





Traps from 


Trapped accesses 


Syndrome reporting in ESR_EL3 





AArch64 state 


Accesses to the MDCR_EL2, MDRAR_EL1, MDCCSR_ELO, 
MDCCINT_EL1, DBGDTR_ELO, DBGDTRRX_ELO, 
DBGDTRTX_ELO, OSDTRRX_EL1,MDSCR_ ELI, 
OSDTRTX_EL1, OSECCR_EL1, DBGBVR<n>_EL1, 
DBGBCR<n>_EL1, DBGWVR<n>_EL1, DBGWCR<n>_EL1, 
DBGCLAIMSET ELI, DBGCLAIMCLR EL1, 
DBGAUTHSTATUS_EL1, and DBGVCR32_EL2. 


Trapped AArch64 MSR, MRS, or System 
instruction, using EC value 0x18 





AArch32 state 


Accesses to the HDCR, DBGDRAR, DBGDSAR, DBGDIDR, 


DBGDSCRint, DBGDCCINT, DBGDTRRXint, 
DBGDTRTXint, DBGWFAR, DBGVCR, DBGDSCRext, 
DBGDTRTXext, DBGDTRRXext, DBGBVR<n>, 
DBGBCR<n>, DBGBXVR<n>, DBGWCR<n>, DBGWVR<n>, 
DBGCLAIMSET, DBGCLAIMCLR, DBGAUTHSTATUS, 
DBGDEVID, DBGDEVID1, DBGDEVID2, and DBGOSECCR. 


For accesses using: 

. MCR or MRC instructions, trapped MCR or MRC 
access (coproc==0b1110), using EC 
value 0x05. 

: MRRC instructions, trapped MCRR or MRRC 
access (coproc==0b1110), using EC 
value Qx@C. 





Accesses to the SDER. 


Trapped MCR or MRC access (coproc==0b1111), 
using EC value 0x03. 





STC accesses to DBGDTRRXint. 
LDC accesses to DBGDTRT Xint. 


LDC or STC, trapped LDC or STC access, using EC 
value 0x06 





Traps to EL3 of EL2, EL1, and ELO accesses to Performance Monitors registers 


MDCR_EL3.TPM traps EL2, EL1, and ELO accesses to the Performance Monitors registers to EL3: 


1 EL2, EL1, and ELO System register accesses to all Performance Monitors registers are trapped to 
EL3. 
0 This control has no effect on accesses to Performance Monitors registers. 


For ELO and EL1, this trap control applies to accesses from both Security states. 


Table D1-90 shows the registers for which accesses are trapped, and how the exceptions are reported in ESR_EL3. 


Table D1-90 Register accesses trapped to EL3 when MDCR_EL3.TPM is 1 





Traps from 


Registers 


Syndrome reporting in ESR_EL3 





AArch64 state 


MCR_ELO, PMCNTENSET_ELO, PMCNTENCLR_ELO, 
MOVSCLR_ELO, PMSWINC_ELO, PMSELR_ ELO, 
MCEIDO_ELO, PMCEID1 ELO, PMCCNTR_ELO, 
MXEVTYPER ELO, PMXEVCNTR_ELO, PMUSERENR_ ELO, 
MINTENSET_ EL1, PMINTENCLR_ ELI, PMOVSSET ELO, 


MCCFILTR_ELO. 


Trapped AArch64 MSR, MRS, or System 
instruction, using EC value 0x18 





AArch32 state 


D1-2368 


MCR, PMCNTENSET, PMCNTENCLR, PMOVSR, PMSWINC, 
MSELR, PMCEIDO, PMCEID1, PMCCNTR, PMXEVTYPER, 
MXEVCNTR, PMUSERENR, PMINTENSET, PMINTENCLR, 


P 
P 
P 
P 
P 
PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, 
P 
P 
P 
P 
P 





MOVSSET, PMEVCNTR<n>, PMEVTYPER<n>, PMCCFILTR. 


For accesses using: 

. MCR or MRC instructions, trapped MCR or 
MRC access (coproc==0b1111), using 
EC value 0x03 

e MCRR or MRRC instructions, trapped MCRR 
or MRRC access (coproc==0b1111), 
using EC value 0x04 
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Traps to EL3 of EL1 and EL2 accesses to the RAS error record registers 


SCR_EL3.TERR traps EL1 and EL2 read accesses to the RAS ER* to EL3. 


Table D1-91 Register accesses trapped to EL3 when SCR_EL3.TERR is 1 








Traps from Registers Syndrome reporting in ESR_EL3 
AArché4 state ERRIDR_EL1, ERRSELR EL1, ERXADDR ELI, Trapped AArch64 MSR, MRS, or System instruction, 
ERXCTLR_EL1, ERXFR EL1, ERXMISCO EL1, using EC value 0x18 


ERXMISC1_EL1, ERXMISC2 EL1, ERXMISC3 ELI, 
ERXSTATUS ELI. 





AArch32 state ERRIDR, ERRSELR, ERXADDR, ERXADDR2, For accesses using: 
ERXCTLR, ERXCTLR2, ERXFR, ERXFR2, ERXMISCO, P MCR or MRC instructions, trapped MCR or MRC 
ERXMISC1, ERXMISC2, ERXMISC3, ERXMISC4, access (coproc==0b1111), using EC value 
ERXMISCS5, ERXMISC6, ERXMISC7, ERXSTATUS. 0x03 


- MCRR or MRRC instructions, trapped MCRR or 
MRRC access, (coproc==0b1111) using 
EC value 0x04 





SCR_EL3.FIEN traps EL1 and EL2 accesses to the RAS ER* registers to EL3. 


Table D1-92 Register accesses trapped to EL3 when SCR_EL3.FIEN is 1 





Traps from Registers Syndrome reporting in ESR_EL2 





AArch64 state ERXPFGCDN_EL1, ERXPFGCTL_EL1, ERXPFGF_EL1. Trapped AArch64 MSR, MRS, or System instruction, 
using EC value 0x18 





Enabling use of the Pointer authentication instructions, EL3 translation regime 
This control is implemented when ARMv8.3-PAuth is implemented. 


Each of the SCTLR_EL3.{EnDA, EnDB, EnIA, EnIB} fields enables the pointer authentication functionality for 
the corresponding Pointer authentication instructions for the EL3 translation regime. For more information see 
System register control of pointer authentication on page D5-2510. 


Note 


These controls cause the pointer authentication instructions to execute as NOPs. They never cause an exception to be 
generated. 








Trap to EL3 accesses to Pointer authentication key registers 


This control is implemented when ARMv8.3-PAuth is implemented. 
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SCR_EL3.APK traps, to EL3, accesses to the Pointer authentication key registers from EL2 or from Secure or 
Non-secure EL1. Because pointer authentication is supported only in AArch64 state this control only traps from 
AArch64 state. Table D1-93 shows the register accesses that are trapped and how the exceptions are reported in 
ESR_EL3: 


Table D1-93 Register accesses trapped when SCR_EL3.APK is 0 





Traps from 


Registers Syndrome reporting in ESR_EL3 





AArch6é4 state 


APDAKeyLo_EL1, APDAKeyHi EL1, APDBKeyLo EL1, Trapped AArch64 MSR, MRS, or System 
APDBKeyHi EL1, APGAKeyLo EL1, APGAKeyHi EL1, instruction, using EC value 0x18. 
APIAKeyLo_EL1, APIAKeyHi EL1, APIBKeyLo EL1, 

APIBKeyHi_EL1 





For more information see System register control of pointer authentication on page D5-2510. 


Trap to EL3 accesses to Pointer authentication instructions 
This control is implemented when ARMv8.3-PAuth is implemented. 


SCR_EL3.API traps, to EL3, accesses to any of the Pointer authentication instructions for which pointer 
authentication is enabled, for instructions executed at an Exception level lower than EL3, in either Security state. 


Because pointer authentication is supported only in AArch64 state this control only traps from AArch64 state. 
Table D1-94 shows the instructions that might be trapped and how the exceptions are reported in ESR_EL3: 


Table D1-94 Instructions that might be trapped to EL3 when SCR_EL3.API is 0 





Traps from 


AArch64 state 


Instructions that might be trapped Syndrome reporting in ESR_EL3 


AUTIASP, AUTIAZ, AUTIA1716, AUTIBSP, AUTIBZ, AUTIB1716, AUTIA, AUTDA, Trapped Pointer authentication 
AUTIB, AUTDB, AUTIZA, AUTDZA, AUTIZB, AUTDZB, PACIASP, PACIAZ, PACIA1716, instruction, using EC value 0x09. 
PACIBSP, PACIBZ, PACIB1716, PACIA, PACDA, PACIB, PACDB, PACIZA, PACDZA, 

PACIZB, PACDZB, PACGA. 

RETAA, RETAB, BRAA, BRAB, BLRAA, BLRAB, BRAAZ, BRABZ, BLRAAZ, BLRABZ, ERETAA, 

ERETAB, LDRAA, LDRAB. 





a. An instruction is trapped only if Pointer authentication is enabled for that instruction. 


D1-2370 


For more information, including the description of when pointer authentication is enabled for an instruction, see 
System register control of pointer authentication on page D5-2510. 


Disabling Address tagging for instruction accesses, EL3 translation regime 
This control is implemented when ARMv8.3-PAuth is implemented. 


When the TCR_EL3.TBI field enables the use of address tagging for the EL3 translation regime, the 
TCR_EL3.TBID field determines whether address tagging is used for both data and instruction addresses, or only 
for data addresses. For more information see Address tagging in AArch64 state on page D5-2506. 





Note 
This control determines the scope of address tagging. It never causes an exception to be generated. 
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D1.15 System calls 
A system call is generated by the execution of an SVC, HVC, or SMC instruction: 


è By default, the execution of an SVC instruction generates a Supervisor Call, a synchronous exception that 
targets EL1. This provides a mechanism for software executing at ELO to make a call to an operating system 
or other software executing at EL1. 


$ In an implementation that includes EL2, the execution of an HVC instruction generates a Hypervisor Call, a 
synchronous exception that targets EL2 by default. 


The HVC instruction is UNDEFINED: 
—  AtELO. 
— At ELI in Secure state. 


Note 


Software executing at ELO cannot directly generate a Hypervisor Call. 








s In an implementation that includes EL3, by default the execution of an SMC instruction generates a Secure 
Monitor Call, a synchronous exception that targets EL3. 


The SMC instruction is UNDEFINED at ELO, meaning software executing at ELO cannot directly generate a 
Secure Monitor Call. 


The default behavior applies when the instruction is not UNDEFINED and both of the following are true: 
e The instruction is executed at an Exception level that is the same as or lower than the target Exception level. 
: The instruction is not trapped to a different Exception level. 


If an SVC or HVC instruction is executed at an Exception level that is higher than the target Exception then it generates 
a synchronous exception that is taken to the current Exception level. 


EL2 and EL3 can disable Hypervisor Call exceptions, see: 
. Disabling Non-secure state execution of HVC instructions on page D1-2339. 
è Enabling EL3, EL2, and Non-secure EL1 execution of HVC instructions on page D1-2362. 


EL2 can trap use of the SMC instruction, see Traps to EL2 of ELI execution of SMC instructions on page D1-2343. 


EL3 can disable Secure Monitor Call exceptions, see Disabling EL3, EL2, and EL1 execution of SMC instructions 
on page D1-2363. 


D1.15.1 Pseudocode description of system calls 
The AArch64.CallSupervisor() pseudocode function performs an SVC call in AArch64 state. 
The AArch64.CallHypervisor() pseudocode function performs an HVC call in AArch64 state. 
The AArch64.CallSecureMonitor() pseudocode function performs an SMC call in AArch64 state. 


The AArch64.Cal1lSupervisor(), AArch64.CallHypervisor(), and AArch64.CallSecureMonitor() functions are 
described in Chapter J1 Armv8 Pseudocode. 
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D1.16.1 


D1-2372 


Mechanisms for entering a low-power state 


The Arm architecture provides mechanisms that software can use to indicate that the PE can enter a low-power state, 
if it supports that state. The following sections describe those mechanisms: 


$ Wait for Event mechanism and Send event. 


° Wait For Interrupt on page D1-2375. 


Wait for Event mechanism and Send event 


A PE can use the Wait for Event (WFE) mechanism to enter a low-power state, depending on the value of the Event 
Register for that PE. To enter the low-power state, the PE executes a Wait For Event instruction, WFE, and if the Event 
Register is clear, the PE can enter the low-power state. 


If the PE does enter the low-power state, it remains in that low-power state until it receives a WFE wake-up event. 


The architecture does not define the exact nature of the low-power state, except that the execution of a WFE 
instruction must not cause a loss of memory coherency. 


WFE mechanism behavior depends on the interaction of all of the following, that are described in the subsections 
that follow: 


: The Event Register for the PE. See subsection The Event Register on page D1-2373. 
è The Wait For Event instruction, WFE. See subsection The Wait For Event instruction on page D1-2373. 
. WFE wake-up events. See subsection WFE wake-up events in AArch64 state on page D1-2374 


G The Send Event instructions, SEV and SEVL that can cause WFE wake-up events. See subsection The Send 
Event instructions on page D1-2374. 


Note 


Because the Wait for Event mechanism is associated with suspending execution on a PE for the purpose of power 
saving, Arm recommends that the Event Register is set only infrequently. However, software must only use the 
setting of the Event Register as a hint, and must not assume that any particular message is sent as a result of the 
setting of the Event Register. 








Example D1-2 describes how a spinlock implementation might use the WFE mechanism to save energy. 


Example D1-2 Spinlock as an example of using Wait For Event and Send Event 


A multiprocessor operating system requires locking mechanisms to protect data structures from being accessed 
simultaneously by multiple PEs. These mechanisms prevent the data structures becoming inconsistent or corrupted 
if different PEs try to make conflicting changes. If a lock is busy, because a data structure is being used by one PE, 
it might not be practical for another PE to do anything except wait for the lock to be released. For example, if a PE 
is handling an interrupt from a device, it might need to add data received from the device to a queue. If another PE 
is removing data from the same queue, it will have locked the memory area that holds the queue. The first PE cannot 
add the new data until the queue is in a consistent state and the second PE has released the lock. The first PE cannot 
return from the interrupt handler until the data has been added to the queue, so it must wait. 


Typically, a spin-lock mechanism is used in these circumstances: 


7 A PE requiring access to the protected data attempts to obtain the lock using single-copy atomic 
synchronization primitives such as the Load-Exclusive and Store-Exclusive operations described in 
Synchronization and semaphores on page B2-156. 


° If the PE obtains the lock it performs its memory operation and then releases the lock. 


° If the PE cannot obtain the lock, it reads the lock value repeatedly in a tight loop until the lock becomes 
available. When the lock becomes available, the PE again attempts to obtain it. 
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A spin-lock mechanism is not ideal for all situations: 


° In a low-power system the tight read loop is undesirable because it uses energy to no effect. 
: In a multiprocessor system the execution of spin-locks by multiple waiting PEs can degrade overall 
performance. 


Using the Wait For Event and Send Event mechanism can improve the energy efficiency of a spinlock: 


- A PE that fails to obtain a lock executes a WFE instruction to request entry to a low-power state, at the time 
when the Exclusives monitor is set holding the address of the location holding the lock. 


à When a PE releases a lock, the write to the lock location causes the Exclusives monitor of any PE monitoring 
the lock location to be cleared. This clearing of the Exclusives monitors generates a WFE wake-up event for 
each of those PEs. Then, these PEs can attempt to obtain the lock again. 


For large systems, more advanced locking systems, such as ticket locks, can avoid unfairness caused by having 
multiple PEs simultaneously reading the lock. In such systems, the WFE mechanism can be used in a similar way 
to monitor the next ticket value. 


The Event Register 


The Event Register is a single bit register for each PE. When set, an Event Register indicates that an event has 
occurred since the register was last cleared, that might require some action by the PE. Therefore, when the Event 
Register is set, the PE must not suspend operation on executing a WFE instruction. 


The reset value of the Event Register is UNKNOWN. 


The Event Register for a PE is set by any of the following: 


s A Send Event instruction, SEV, executed by any PE in the system. 
. A Send Event Local instruction, SEVL, executed by the PE. 
d An exception return. 


- The clearing of the global monitor for the PE. 
s An event from a Generic Timer event stream, see Event streams on page D11-2795. 
a An event sent by some IMPLEMENTATION DEFINED mechanism. 


The Event Register is cleared only by a Wait For Event instruction. 





Note 


Software cannot read or write the value of the Event Register directly. 





The Wait For Event instruction 
The action of the Wait For Event instruction, WFE, depends on the state of the Event Register: 
è If the Event Register is set, the instruction clears the register and completes immediately. 


$ If the Event Register is clear the PE can suspend execution and enter a low-power state. It remains in that 
state until the PE detects a WFE wake-up event, or earlier if the implementation chooses, or until a reset. 
When the PE detects a WFE wake-up event, or earlier if chosen, the WFE instruction completes. If the 
wake-up event sets the Event Register, it is IMPLEMENTATION DEFINED whether on restarting execution, the 
Event Register is cleared. 


The WFE instruction is available at all Exception levels. Attempts to enter a low-power state made by software 
executing at ELO, EL1, or EL2 might be trapped to a higher Exception level. See: 


. Traps to ELI of ELO execution of WFE and WFI instructions on page D1-2329. 
. Traps to EL2 of ELO and EL1 execution of WFE and WF instructions on page D1-2347. 
. Traps to EL3 of EL2, EL1, and ELO execution of WFE and WFI instructions on page D1-2361. 
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Note 


Software using the Wait For Event mechanism must tolerate spurious wake-up events, including multiple wake-ups. 








WFE wake-up events in AArch64 state 
The following are WFE wake-up events: 
° The execution of an SEV instruction on any PE in the multiprocessor system. 


° Any physical SError interrupt, IRQ interrupt, or FIQ interrupt received by the PE, that is not disabled by 
EDSCR.INTdis and: 


— Is marked as A in the tables in Asynchronous exception masking on page D1-2320, regardless of the 
value of the corresponding PSTATE. {A, I, F} mask bit. 


— Is marked as B in the tables in Asynchronous exception masking on page D1-2320, if the value of the 
corresponding PSTATE. {A, I, F} mask bit is 0. 





Note 


Any physical SError interrupt, IRQ interrupt, or FIQ interrupt that is marked as A/B behaves as A or B. See 
A/B on page D1-2321. 


è In EL1 or ELO, any virtual SError interrupt, IRQ interrupt, or FIQ interrupt received by the PE, that is not 
disabled by EDSCR.INTdis and is marked as B in Table D1-17 on page D1-2323 in Virtual interrupts on 
page D1-2322, if the value of the corresponding PSTATE. {A, I, F} mask bit is 0. 


s An asynchronous External Debug Request debug event, if halting is allowed. For the definition of halting is 
allowed see Halting allowed and halting prohibited on page H2-6705. 


See also External Debug Request debug event on page H3-6761. 


° An event sent by the timer event stream for the PE. See Event streams on page D11-2795. 
° An event caused by the clearing of the global monitor for the PE. 
: An event sent by some IMPLEMENTATION DEFINED mechanism. 


Not all of these wake-up events set the Event Register. 


Note 


The disabling of interrupts, and WFE wake-up events, by EDSCR.INTdis is possible only when external debug is 
enabled. 








The Send Event instructions 
The Send Event instructions are: 
SEV, Send Event This causes an event to be signaled to all PEs in the multiprocessor system. 


SEVL, Send Event Local 
This must set the local Event Register. 


Note 


It might signal an event to other PEs by some IMPLEMENTATION DEFINED mechanism, but 
is not required to do so. 








The mechanism that signals an event to other PEs is IMPLEMENTATION DEFINED. The PE is not required to guarantee 
the ordering of this event with respect to the completion of memory accesses by instructions before the SEV 
instruction. Therefore, Arm recommends that software includes a DSB instruction before any SEV instruction. 
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Note 


A DSB instruction ensures that no instructions, including any SEV instructions, that appear in program order after the 
DSB instruction, can execute until the DSB instruction has completed. See Data Synchronization Barrier (DSB) on 
page B2-128. 





The SEVL instruction appears to execute in program order relative to any subsequent WFE instruction executed on the 
same PE, without the need for any explicit insertion of barrier instructions. 


The receipt of a signaled SEV or SEVL event by a PE sets the Event Register on that PE. 


The SEV and SEVL instructions are available at all Exception levels. 


Pseudocode description of the Wait For Event mechanism 
This section identifies pseudocode functions that describe the behavior of the Wait For Event mechanism. 
The ClearEventRegister() pseudocode function clears the Event Register of the current PE. 


The IsEventRegisterSet() pseudocode function returns TRUE if the Event Register of the current PE is set and 
FALSE if it is clear. 


The WaitForEvent() pseudocode function optionally suspends execution until a WFE wake-up event or reset occurs, 
or until some earlier time if the implementation chooses. It is IMPLEMENTATION DEFINED whether restarting 
execution after the period of suspension causes ClearEventRegister() to be called. 


The SendEvent() pseudocode function sets the Event Register of every PE in the multiprocessor system. 


The SendEventLocal() pseudocode function sets the event register for the local PE. 


D1.16.2 Wait For Interrupt 
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Software can use the Wait for Interrupt (WFI) instruction to cause the PE to enter a low-power state. The PE then 
remains in that low-power state until it receives a WFI wake-up event, or until some other IMPLEMENTATION 

DEFINED reason causes it to leave the low-power state. The architecture permits a PE to leave the low-power state 
for any reason, but requires that it must leave the low-power state on receipt of any architected WFI wake-up event. 





Note 


Because the architecture permits a PE to leave the low-power state for any reason, it is permissible for a PE to treat 
WFI as a NOP, but this is not recommended for lowest power operation. 


When the PE leaves a low-power state that was entered as a result ofa WFI instruction, that WFI instruction completes. 


The architecture does not define the exact nature of the low-power state, except that the execution of a WFI 
instruction must not cause a loss of memory coherency. 


Attempts to enter a low-power state made by software executing at ELO, EL1, or EL2 might be trapped to a higher 
Exception level. See: 


° Traps to ELI of ELO execution of WFE and WFI instructions on page D1-2329. 
. Traps to EL2 of ELO and EL1 execution of WFE and WFI instructions on page D1-2347. 
. Traps to EL3 of EL2, EL1, and ELO execution of WFE and WFI instructions on page D1-2361. 


WFI wake-up events 
The following are WFI wake-up events: 


> Any physical SError interrupt, IRQ interrupt, or FIQ interrupt received by the PE, that is marked as A, Bor 
A/B in the tables in Asynchronous exception masking on page D1-2320, regardless of the value of the 
corresponding PSTATE. {A, I, F} mask bit. 
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e In EL1 or ELO, any virtual SError interrupt, IRQ interrupt, or FIQ interrupt received by the PE, that is marked 
as B in Table D1-17 on page D1-2323 in Virtual interrupts on page D1-2322, regardless of the value of the 
corresponding PSTATE. {A, I, F} mask bit. 


è An asynchronous External Debug Request debug event, if halting is allowed. For the definition of halting is 
allowed see Halting allowed and halting prohibited on page H2-6705. 


See also External Debug Request debug event on page H3-6761. 


: An event sent by some IMPLEMENTATION DEFINED mechanism. 


Note 


s WFI wake-up events are never disabled by EDSCR.INTdis, and are never masked by the PSTATE. {A, I, F} 
mask bits. If wake-up is invoked by an interrupt that is disabled or masked the interrupt is not taken. 





° Because debug events are WFI wake-up events, Arm recommends that Wait For Interrupt is used as part of 
an idle loop rather than waiting for a single specific interrupt event to occur and then moving forward. This 
ensures that the intervention of debug while waiting does not significantly change the function of the program 
being debugged. 


G Some implementations of the WFI mechanism drain down any pending memory activity before suspending 
execution. This increases power saving, by increasing the area over which clocks can be stopped. The 
architecture does not require this operation, therefore software must not rely on the WFI mechanism 
operating in this way. 





Using WFI to indicate an idle state on bus interfaces 


Software can use the WFI mechanism to force quiescence on a PE, and, combined with preventing any possible WFI 
wakeup events, this can be used to complete an entry into a powerdown state. 


Because mechanisms for entering powerdown states are inherently IMPLEMENTATION DEFINED, whether an 
implementation uses the WFI mechanism is IMPLEMENTATION DEFINED. If it does, the WFI instruction forces the 
suspension of execution, and of all associated bus activity. 


The control logic that does this also tracks the activity on the bus interfaces of the PE, so that when the PE has 
completed all current operations and any associated bus activity has completed, it can signal to an external power 
controller that there is no ongoing bus activity. 


However, the PE must continue to process memory-mapped and external debug interface accesses to debug registers 
when in the WFI state. The indication of idle state to the system normally only applies to the non-debug functional 
interfaces used by the PE, not the debug interfaces. 


If the OS Double Lock control is implemented and OSDLR_EL1.DLK is 1, the PE must not signal this idle state to 
the control logic unless it can also guarantee that the debug interface is idle. For more information about the OS 
Double Lock, see Debug behavior when the OS Double Lock is locked on page H6-6817. 





Note 


In a PE that implements separate Core and Debug power domains, the debug interface referred to in this section is 
the interface between the Core and Debug power domains, since the signal to the power controller indicates that the 
Core power domain is idle. For more information about the power domains see Power domains and debug on 
page H6-6807. 





The exact nature of this interface is IMPLEMENTATION DEFINED, but the use of Wait For Interrupt as the only 
architecturally-defined mechanism that completely suspends execution makes it very suitable as the preferred 
powerdown entry mechanism. 


Pseudocode description of Wait For Interrupt 


The WaitForInterrupt() pseudocode function optionally suspends execution until a WFI wake-up event or reset 
occurs, or until some earlier time if the implementation chooses. 
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D1.17 Self-hosted debug 


The Armv8-A architecture supports both of the following: 


Self-hosted debug 
The PE itself hosts a debugger. The debugger programs the PE to generate debug exceptions. Debug 
exceptions are accommodated in the Armv8-A Exception model. 

External debug 


The PE is controlled by an external debugger. The debugger programs the PE to generate Debug 
events, that cause the PE to enter Debug state. In Debug state, the PE is halted. 


This section describes self-hosted debug. It includes: 
$ Debug exceptions. 
. The PSTATE debug mask bit, D. 


For external debug, see part E. 


D1.17.1 Debug exceptions 


Debug exceptions occur during normal program flow, if a debugger has programmed the PE to generate them. 


For example, a software developer might use a debugger contained in an operating system to debug an application. 
To do this, the debugger might enable one or more debug exceptions. 


The possible debug exceptions are: 


° Breakpoint Instruction exceptions. 
° Breakpoint exceptions. 

. Watchpoint exceptions. 

° Vector Catch exceptions. 

° Software Step exceptions. 


Chapter D2 AArch64 Self-hosted Debug describes these in detail for AArch64. 
For the PE to generate a debug exception requires that: 


: The debug exception is enabled. The debug exception enable controls on page D2-2402 gives the controls for 
the different debug exceptions. 


° Debug exceptions are enabled from the current Exception level and Security state. See Enabling debug 
exceptions from the current Exception level on page D2-2405. 


Debug exceptions are synchronous exceptions, and are accommodated in the Armv8 Exception model. 


Note 


Breakpoints and Watchpoints can cause entry to Debug state instead of causing debug exceptions. See Chapter H1 
About External Debug. 








D1.17.2 The PSTATE debug mask bit, D 


ARM DDI 0487E.a 
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As with all other exceptions, when a debug exception is taken, software must take care to avoid generating another 
instance of an exception within the exception handler, to avoid recursive entry into the exception handler and loss 
of return state. 


To help avoid this, the Armv8 architecture provides a debug exception mask bit, PSTATE.D, that can mask 
Watchpoint, Breakpoint, and Software Step exceptions when the target Exception level is the current Exception 
level. 
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PSTATE.D is set to 1 on taking an exception. This means that while handling an exception in AArch64 state, 
Watchpoint, Breakpoint, and Software Step exceptions are masked. This prevents recursive entry at the Exception 
level that debug exceptions are targeted to. 


When execution is in AArch64 state, debug exceptions are also masked implicitly when the target Exception level 
is lower than the current Exception level. 


When the target Exception level is higher than the current Exception level, debug exceptions cannot be masked by 
PSTATE.D. 


Because debug exceptions are synchronous, the architecture requires that debug exceptions are not generated when 
PSTATE.D is 1. By preventing debug exception generation, debug exceptions cannot be taken at a subsequent time 
when the Process state D mask bit is cleared to 0. 


Note 


This differs from the behavior for interrupts, where the PSTATE. {A, I, F} mask has the effect of preventing the 
interrupt from being taken, but instead the interrupt remains pending. 
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D1.18 Event monitors 


The Armv8-A architecture supports the following non-invasive architectural components that allow for event 
monitoring: 
Performance Monitors 
The Performance Monitors have a wide feature set, flexible selection of counted events, and are 
read/write in operation. See Zhe Performance Monitors Extension. 
Activity Monitors 


The Activity Monitors have a narrow feature set, limited selection of counted events, and are 
read-only in operation. See The Activity Monitors Extension. 


D1.18.1 The Performance Monitors Extension 


The System registers provide access to a Performance Monitors Unit (PMU), defined as the OPTIONAL Performance 
Monitors Extension to the architecture, a non-invasive debug resource that provides information about the operation 
of the PE. The PMU provides: 


° A 64-bit cycle counter. 


e An IMPLEMENTATION DEFINED number of event counters. If ARMv8.5-PMU is implemented, the event 
counters are 64-bit unsigned counters, otherwise the event counters are 32-bit event counters. 


Each event counter can be configured to count occurrences of a specified event. The events that can be 
counted are: 


— Architectural and microarchitectural events that are likely to be consistent across many 
microarchitectures. The PMU architecture uses event numbers to identify an event, and the PMU 
specification defines which event number must be used for each of these architectural and 
microarchitectural events. 


— Implementation-specific events. The PMU specification reserves event numbers for 
implementation-specific events. See Appendix K3 Recommendations for Performance Monitors 
Event Numbers for IMPLEMENTATION DEFINED Events. 


For more information, see Chapter D7 The Performance Monitors Extension. 


D1.18.2 The Activity Monitors Extension 


When the OPTIONAL Activity Monitors Extension is implemented, the System registers provide access to controls 
and counters for the Activity Monitors Unit (AMU). For more information, see Chapter D8 The Activity Monitors 
Extension. 
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D1.19  Interprocessing 


Interprocessing is the term used to describe moving between the AArch64 and AArch32 Execution states. 


The Execution state can change only ona change of Exception level. This means that the Execution state can change 
only on taking an exception to a higher Exception level, or returning from an exception to a lower Exception level. 


On taking an exception to a higher Exception level, the Execution state either: 
° Remains unchanged. 
° Changes from AArch32 state to AArch64 state. 


On returning from an exception to a lower Exception level, the Execution state either: 
° Remains unchanged. 
: Changes from AArch64 state to AArch32 state. 


Note 


If, on taking or returning from an exception, the Exception level remains the same, the Execution state cannot 
change. 





For the description of: 
$ Exception entry to an Exception level using AArch64, see Exception entry on page D1-2293. 
è Exception return from an Exception level using AArch64 state, see Exception return on page D1-2303. 


7 Exception return to AArch32 state, see Exception return to an Exception level using AArch32 on 
page G1-5523. 





Note 


The description in Handling exceptions that are taken to an Exception level using AArch32 on page G1-5501 
is outside the scope of interprocessing, because such exceptions must have been taken from an Exception 
level that is using AArch32, and therefore there is no change of Execution state. 





The following sections describe the behavior associated with interprocessing. 

è Register mappings between AArch32 state and AArch64 state. 

° State of the general-purpose registers on taking an exception to AArch64 state on page D1-2390. 
à SPSR, ELR, and AArch64 SP relationships on changing Execution state on page D1-2392. 


D1.19.1 Register mappings between AArch32 state and AArch64 state 


D1-2380 


This section defines the architectural mappings between AArch32 state registers and AArch64 state registers. 


The mappings describe: 
è For exceptions taken from AArch32 state to AArch64 state, where the AArch32 register content is found. 
: For exception returns from AArch64 state to AArch32 state, how the AArch32 register content is derived. 


The general model is: 
, The AArch32 register contents are situated in the bottom 32 bits of the AArch64 registers. 
: In AArch32 state, the upper 32 bits of AArch64 registers are inaccessible and are ignored. 


Note 


System software that executes in AArch64 state, such as an OS or Hypervisor, can use these mappings for context 
save and restore, or to interpret and modify the AArch32 registers of an application or virtual machine. 








For more information see the following subsections: 
s Mapping of the general-purpose registers between the Execution states on page D1-2381. 
è Mapping of the SIMD and floating-point registers between the Execution states on page D1-2382. 
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. Mapping of the System registers between the Execution states on page D1-2383. 


Mapping of the general-purpose registers between the Execution states 


Table D1-95 shows how each of the AArch32 general-purpose registers, RO-R12, SP, and LR, including the banked 
copies of these registers, maps to an AArch64 general-purpose register. A register in the AArch64 register column 
of the table provides the AArch64 view of the corresponding register in the AArch32 register column. 





Note 


For some exceptions, the exception syndrome given in the ESR_ELx identifies one or more register numbers from 
the issued instruction that generated the exception. Where the exception is taken from an Exception level using 
AArch32 these register numbers give the AArch64 view of the register. For example, if an exception is taken from 
AArch32 Abort mode, and the faulting instruction specified R14, the ESR_ELx.ISS field would report this using 
the EC value 0b10100, because register X20 provides the AArch64 view of LR_abt. which is the copy of R14 used 
in Abort mode. 





Table D1-95 General-purpose register mapping between AArch32 state and AArch64 state 





AArch32 register AArch64 register 






























































RO X0 
R1 X1 
R2 X2 
R3 X3 
R4 X4 
R5 X5 
R6 X6 
R7 X7 
R8 usr X8 
R9 usr X9 
R10_usr X10 
R11_usr X11 
R12_usr X12 
SP_usr X13 
LR_usr X14 
SP_hyp X15 
LR irq X16 
SP_irq X17 
LR_sve X18 
SP_sve X19 
LR_abt X20 
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Table D1-95 General-purpose register mapping between AArch32 state and AArch64 state 





AArch32 register AArch64 register 





























SP_abt X21 
LR_und X22 
SP_und X23 
R8_fiq X24 
R9 fiq X25 
R10 fiq X26 
R11_fiq X27 
R12 fiq X28 
SP_fiq X29 
LR fiq X30 





Note 


For a description of the banking of AArch32 general-purpose registers R8-R12, SP, and LR, see AArch32 
general-purpose registers, the PC, and the Special-purpose registers on page G1-5489. 








Mapping of the SIMD and floating-point registers between the Execution states 


Table D1-96 shows the mapping between the AArch64 V registers and the AArch32 Q registers. 


Table D1-96 SIMD and floating-point register mapping between AArch64 state and AArch32 state 





AArch6é4 register AArch32 register 














vo Q0 
y1 Ql 
v2 Q2 
V15 Q15 





The AArch64 registers V16-V31 are not accessible from AArch32 state. 


The mapping between the V, D, and S registers in AArch64 state is not the same as the mapping between the Q, D, 
and S registers in AArch32 state: 


. In AArch64 state, there are: 
— 32 128-bit V registers, V0-V31. 
— 32 64-bit D registers, D0-D31. 
— 3232-bit S registers, S0-S31. 


A smaller register occupies the least-significant bytes of the corresponding larger register. For example, S5 
is the least-significant word of D5 and V5. Figure D1-3 on page D1-2383 shows this mapping. 
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Figure D1-3 AArch64 state SIMD and floating-point register mappings 


. In AArch32 state, there are: 
— 16 128-bit Q registers, Q0-Q15. 
— 32 64-bit D registers, D0-D31. 
— 3232-bit S registers, S0-S31. 


Smaller registers are packed into larger registers. Figure D1-4 shows this mapping. 
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Figure D1-4 AArch32 state SIMD and floating-point register mappings 


In AArch32 state: 
° There are no S registers that correspond to Q8-Q15. 
à D16-D31 pack into Q8-Q15. For example, D16 and D17 pack into Q8. 


Note 


A consequence of this mapping is that if software executing in AArch64 state interprets D or S registers from 
AArch32 state, it must unpack the D or S registers from the V registers before it uses them. 








Mapping of the System registers between the Execution states 


Armv8 architecturally defines the relationship between the AArch64 System registers and the AArch32 System 
registers, to allow supervisory code such as a hypervisor, that is executing in AArch64 state, to save, restore, and 
interpret the System registers belonging to a lower Exception level that is using AArch32. 


Any modifications made to AArch32 System registers affects only those parts of those AArch64 registers that are 
mapped to the AArch32 System registers. Bits[63:32] of AArch64 registers, where they are not mapped to AArch32 
registers, are unchanged by AArch32 state execution. 


Note 

This model is different to the model for the general-purpose registers described in Mapping of the general-purpose 
registers between the Execution states on page D1-2381. In this model, there are several cases where two AArch32 
System registers are packed into a single AArch64 System register. 








When EL3 is implemented and is using AArch32, some System registers are banked between the two Security 
states. When a register is banked in this way, there is an instance of the register in Secure state, and another instance 
of the register in Non-secure state. In Table D1-97 on page D1-2384 these banked registers are identified by 
footnote. This banking is not supported when EL3 is using AArch64 or if EL3 is not implemented. This means that 
when EL3 is implemented and is using AArch64, exactly the same registers are accessed in the following states: 

s Secure EL1 with EL1 using AArch32. 


. Non-secure EL1 with EL1 using AArch32. 
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This means that, architecturally, it is not possible to determine whether an AArch64 register is mapped onto the 
Secure instance of the corresponding AArch32 register, or onto the Non-secure instance of that register. When EL3 
is using AArch64, the interrupt asserted by the AArch64 CNTP _¥* timer is the same interrupt as is asserted by the 
Non-secure AArch32 CNTP_* timer when EL3 is using AArch32. 





Note 
Although the architecture does not require this, because it is not architecturally visible, Arm expects that 
implementations will map many of the AArch64 registers for use by EL3 to the Secure instances of the banked 
AArch32 registers, and will map many of the AArch64 registers for use by EL1 to the Non-secure instances of the 
banked AArch32 registers. However, if EL2 and EL3 are implemented and both support use of AArch32, this is not 
possible for the following registers: 
IFAR This is because when EL3 is using AArch32, HIFAR is an alias of the Secure IFAR. 
DFAR This is because when EL3 is using AArch32, HDFAR is an alias of the Secure DFAR. 





Table D1-97 shows the mappings between the writable AArch64 System registers and the AArch32 System 
registers. 


Table D1-97 Mapping of writable AArch64 System registers to the AArch32 System registers 















































AArch64 register AArch32 register 
ACTLR_EL1[31:0] ACTLR# 
ACTLR_EL1[63:32] ACTLR22? if implemented 
AFSRO_EL1[31:0] ADFSR4 
AFSRI_EL1[31:0] AIFSR# 

AMAIR EL1[31:0] AMAIRO2 

AMAIR EL1[63:32] AMAIR12 
CONTEXTIDR_EL1[31:0] CONTEXTIDR# 
CPACR_EL1[31:0] CPACR 
CSSELR_EL1[31:0] CSSELR& 
DACR32_EL2[31:0] DACR2 
FAR_EL1[31:0] DFAR@4 
ESR_EL1[31:0] DFSR? 

HACR. EL2[31:0] HACR 
ACTLR_EL2[31:0] HACTLR 





ACTLR_EL2[63:32] 


HACTLR2 if implemented 




















AFSRO_EL2[31:0] HADFSR 
AFSR1_EL2[31:0] HAIFSR 
AMAIR EL2[31:0] HAMAIRO 
AMAIR EL2[63:32] HAMAIRI 
CPTR_EL2[31:0] HCPTR 
HCR_EL2[31:0] HCR 
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AArch64 register AArch32 register 
HCR_EL2[63:32] HCR2 
MDCR_EL2[31:0] HDCR 

FAR EL2[31:0] HDFAR 
FAR_EL2[63:32] HIFAR 

MAIR. _EL2[31:0] HMAIRO 

MAIR _ EL2[63:32] HMAIRI 

HPFAR EL2[31:0] HPFAR 
SCTLR_EL2[31:0] HSCTLR 
ESR_EL2[31:0] HSR 
HSTR_EL2[31:0] HSTR 
TCR_EL2[31:0] HTCR 
TPIDR_EL2[31:0] HTPIDR 
TTBRO_EL2[47:1] HTTBR 
VBAR_EL2[31:0] HVBAR 
FAR_EL1[63:32] IFAR4 
IFSR32_EL2[31:0] IFSR@ 
MAIR _ EL1[63:32] NMRR or MAIR14 
PAR_EL1[63:0] PARa 

MAIR EL1[31:0] PRRR or MAIRO? 
RMR. EL1[31:0] RMR (at EL1) 
RMR. EL2[31:0] HRMR 

RMR. EL3[31:0] RMR (at EL3) 
SCTLR_EL1[31:0] SCTLR? 
SDER32_EL3[31:0] SDER 
TPIDR_EL1[31:0] TPIDRPRW2 
TPIDRRO_ELO[31:0] TPIDRURO# 
TPIDR_ELO[31:0] TPIDRURW4 
TCR_EL1[31:0] TTBCR4 
TCR_EL1[63:32] TTBCR2: if implemented 
TTBRO_EL1[63:0] TTBRO# 
TTBRI1_EL1[63:0] TTBRI? 
VBAR _ ELI1[31:0] VBAR2 
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AArch64 register AArch32 register 
VMPIDR_EL2[31:0] VMPIDR 
VPIDR_EL2[31:0] VPIDR 
VTCR_EL2[31:0] VTCR 
VTTBR_EL2[63:0] VITBR 





Timer registers 





CNTFRQ_ELO[31:0] 


NTFRQ 





NTHCTL_EL2[31:0] 


NTHCTL 





NTHP_CTL_EL2[31:0] 


NTHP_CTL 





NTHP_CVAL_EL2[63:0] 


z 


THP_CVAL 





NTHP_TVAL_EL2[31:0] 


NTHP_TVAL 





Z 


THPS_CTL_EL2[31:0] 


Z 


THPS_CTL 





NTHPS_CVAL_EL2[31:0] 


NTHPS_CVAL 





NTHPS_TVAL_EL2[31:0] 


NTHPS_TVAL 





Z 


TKCTL EL1[31:0] 


NTKCTL 





NTP_ CTL EL0[31:0] 


NTP_CTL@ 





Z 


TP_CVAL_EL0[63:0] 


Z 


TP_CVALa 





NTP_TVAL_EL0[31:0] 


NTP_TVAL@ 





NTPCT_EL0[63:0] 


NTPCT 





NTV_CTL_EL0[31:0] 


NTV_CTL 





NTV_CVAL_EL0[63:0] 


NTV_CVAL 





NTV_TVAL_ELO[31:0] 


NTV_TVAL 





NTHV_CTL_EL2[63:0] 


NTHV_CTL 





z 


THV_CVAL_EL2[63:0] 


Z 


THV_CVAL 





2 


THV_TVAL_EL2[63:0] 


z 


THV_TVAL 





NTHVS_CTL_EL2[31:0] 


NTHVS CTL 





NTHVS_CVAL_EL2[63:0] 


Z 


THVS_CVAL 





NTHVS_TVAL_EL2[63:0] 


NTHVS_TVAL 





my) Oo QOQ O| a) a) a\e0\ 6) a| a) eS) O|, e/a) a) a) a) a) GOGG O 


NTVCT_EL0[63:0] 


NTVCT 











CNTVOFF_EL2[63:0] 








OGIO, IOIO OIO a) Qa) ©) @)4)|)6@)6)a)/Ca\ea) ala) a) &@|) a| a) aia 


NTVOFF 





Debug System registers 





DBGAUTHSTATUS_EL1[31:0] 


DBGAUTHSTATUS 





DBGBCR<n>_EL1[31:0] 
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Table D1-97 Mapping of writable AArch64 System registers to the AArch32 System registers 










































































AArch64 register AArch32 register 
DBGBVR<n>_EL1[31:0] DBGBVR<n> 
DBGBVR<n>_EL1[63:32] DBGBXVR<n> 
DBGCLAIMCLR_EL1[31:0] DBGCLAIMCLR 
DBGCLAIMSET_EL1[31:0] DBGCLAIMSET 
DBGDTR_ELO[63:32] DBGDTRRXint 
DBGDTR_ELO[31:0] DBGDTRTXint 
DBGDTRRX_ELO0[31:0] DBGDTRRXint 
DBGDTRTX_EL0[31:0] DBGDTRRXint 
DBGPRCR_EL1[31:0] DBGPRCR 
DBGVCR32_EL2[31:0] DBGVCR 
DBGWCR<n>_EL1[31:0] DBGWCR<n> 
DBGWVR<n>_EL1[31:0] DBGWVR<n> 
ID_DFRO EL1[31:0] ID_DFRO 
MDCCSR_EL0%[30:29] DBGDSCRint» 
MDCR_EL2[31:0] HDCR 

MDRAR _EL1[63:0] DBGDRAR 
MDSCR_EL1[31:0] DBGDSCRext® 
OSDLR_EL1[31:0] DBGOSDLR 
OSDTRRX_EL1°[31:0] DBGDTRRXext 
OSDTRTX_EL1*[31:0] DBGDTRTXext® 
OSECCR_EL1[31:0] DBGOSECCR 
OSLAR_EL1[31:0] DBGOSLAR 
OSLSR_EL1[31:0] DBGOSLSR 
SDER32_EL3[31:0] SDER 





Performance Monitors System registers 
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PMCCNTR_ELO[31:0] PMCCNTR (MRC/MCR) 
PMCEIDO_ELO0[31:0] PMCEIDO 
PMCEIDO_ELO0[63:32] PMCEID2 

PMCEID1_ ELO0[31:0] PMCEID1 

PMCEID1_ ELO0[63:32] PMCEID3 
PMCNTENCLR_ELO[31:0] PMCNTENCLR 
PMCNTENSET_ELO[31:0] PMCNTENSET 
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Table D1-97 Mapping of writable AArch64 System registers to the AArch32 System registers 
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AArch64 register AArch32 register 
PMCR_ELO[31:0] PMCR 
PMEVCNTR<n>_ELO[31:0] PMEVCNTR<n> 
PMEVTYPER<n>_ELO0[31:0] PMEVTYPER<n> 
PMINTENCLR_EL1[31:0] PMINTENCLR 
PMINTENSET EL1[31:0] PMINTENSET 
PMSELR_ELO[31:0] PMSELR 
PMSWINC ELO[31:0] PMSWINC 
PMUSERENR_ ELO[31:0] PMUSERENR 
PMXEVCNTR_ELO[31:0] PMXEVCNTR 
PMXEVTYPER _ELO[31:0] PMXEVTYPER 
Activity Monitors System registers 
AMCNTENCLRO_ELO[31:0] AMCNTENCLRO 
AMCNTENCLRI1_ELO[31:0] AMCNTENCLRI1 
AMCNTENSETO0_ELO[31:0] AMCNTENSETO 
AMCNTENSET1_ELO[31:0] AMCNTENSET1 
AMCR_ELO[31:0] AMCR 
AMEVCNTRO<n>_EL0[63:0] AMEVCNTRO<n> 
AMEVCNTRI1<n>_EL0[63:0] AMEVCNTRI<n> 
AMEVTYPERI<n>_EL0[31:0] |. AMEVTYPERI<n> 
RAS System registers 
DISR_EL1[31:0] DISR 
ERRIDR_EL1[31:0] ERRIDR 
ERRSELR_EL1[31:0] ERRSELR 
ERXADDR EL1[31:0] ERXADDR 
ERXADDR_EL1[63:32] ERXADDR2 
ERXCTLR_EL1[31:0] ERXCTLR 
ERXCTLR_EL1[63:32] ERXCTLR2 
ERXFR_EL1[31:0] ERXFR 
ERXFR_EL1[63:32] ERXFR2 
ERXMISCO_EL1[31:0] ERXMISCO 
ERXMISCO_EL1[63:32] ERXMISC1 
ERXMISC1_EL1[31:0] ERXMISC2 
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Table D1-97 Mapping of writable AArch64 System registers to the AArch32 System registers 
































AArch64 register AArch32 register 
ERXMISC1_EL1[63:32] ERXMISC3 
ERXMISC2_EL1[31:0] ERXMISC4 
ERXMISC2_EL1[63:32] ERXMISCS5 
ERXMISC3_EL1[31:0] ERXMISC6 
ERXMISC3_EL1[63:32] ERXMISC7 
ERXSTATUS_EL1[31:0] ERXSTATUS 
VDISR_EL2[31:0] VDISR 
VSESR_EL2[31:0] VDFSR 





a. AArch32 registers that are banked if EL3 is using AArch32. 


b. These registers have overlapping register content. One or more 
bits of one register appear in the other register. 


There are a small number of AArch32 System registers that are not mapped to any AArch64 System registers. The 
AArch64 registers listed in Table D1-98 can be used to access these from a higher Exception level that is using 
AArch64. The registers shown in the table are UNDEFINED if EL1 cannot use AArch32. 


Table D1-98 AArch64 registers for accessing registers that are only used in AArch32 state 





AArch32 register Register for access from AArch64 state Short description 

















DACR DACR32_EL2 Domain Access Control Register 
DBGVCR DBGVCR32_EL2 Debug Vector Catch Register 

FPEXC FPEXC32_EL2 Floating-Point Exception Control Register 
IFSR IFSR32_EL2 Instruction Fault Status Register 

SDER SDER32_EL3 AArch32 Secure Debug Enable Register 


Table D1-99 shows the AArch64 System registers that allow access from AArch64 state to the AArch32 
ID registers. These AArch64 registers are UNKNOWN if no Exception level can use AArch32. 


Table D1-99 AArch64 registers that access the AArch32 ID registers 





AArch32 register Register for access from AArch64 state Short description 


























ID_AFRO ID_AFRO EL1 AArch32 Auxiliary Feature Register 0 

ID_DFRO ID_DFRO ELI AArch32 Debug Feature Register 0 

ID_ISARO ID_ISARO EL1 EL1, AArch32 Instruction Set Attribute Register 0 

ID_ISARI1 ID_ISARI] EL1 EL1, AArch32 Instruction Set Attribute Register 1 

ID_ISAR2 ID_ISAR2 EL1 EL1, AArch32 Instruction Set Attribute Register 2 

ID_ISAR3 ID_ISAR3_EL1 EL1, AArch32 Instruction Set Attribute Register 3 

ID_ISAR4 ID_ISAR4 EL] EL1, AArch32 Instruction Set Attribute Register 4 

ID_ISARS ID_ISARS_EL1 EL1, AArch32 Instruction Set Attribute Register 5 
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D1.19.2 
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Table D1-99 AArch64 registers that access the AArch32 ID registers (continued) 





AArch32 register 


ID_MMFRO 


Register for access from AArch64 state 


ID_MMFRO_EL1 


Short description 


AArch32 Memory Model Feature Register 0 





ID_MMFR1 


ID_MMEFRI ELI 


AArch32 Memory Model Feature Register 1 





ID MMFR2 


ID MMFR2 EL! 


AArch32 Memory Model Feature Register 2 





ID_MMFR3 


ID MMFR3 ELI 


AArch32 Memory Model Feature Register 3 











ID_MMFR4 








ID MMFR4 ELI 








AArch32 Memory Model Feature Register 4 





ID_PFRO 


ID_PFRO_EL1 


AArch32 PE Feature Register 0 





ID_PFRI 


ID_PFRI_ELI 


AArch32 PE Feature Register 1 





State of the general-purpose registers on taking an exception to AArch64 state 


When an exception is taken from AArch32 state to AArch64 state, the state of a general-purpose register depends 
on whether, immediately before the exception, the register was accessible from AArch32 state, as follows: 


If the general-purpose register was accessible from AArch32 state 


The upper 32 bits either become zero, or hold the value that the same architectural register held 
before any AArch32 execution. The choice between these two options is IMPLEMENTATION 
DEFINED, and might vary dynamically within an implementation. Correspondingly, software must 
regard the value as being a CONSTRAINED UNPREDICTABLE choice between these two values. 


This behavior applies regardless of whether any execution occurred at the Exception level that was 
using AArch32. That is, this behavior applies even if AArch32 state was entered by an exception 
return from AArch64 state, and another exception was immediately taken to AArch64 state without 


any instruction execution in AArch32 state. 


Which general-purpose registers have their upper 32 bits affected in this way depends on both: 
à The AArch64 state target Exception level. 


. The values of both: 
—  SCR_EL3.RW. 


— HCR EL2.RW or HCR.RW, where HCR.RW is a notional bit that is RESO. 


Table D1-100 shows which general-purpose registers can have their upper 32 bits set to zero. 


Table D1-100 General-purpose registers that can have their upper 32 bits set to zero on taking an 


exception to AArch64 state from AArch32 state 





HCR_EL2.RW or 


SCR_EL3.RW HCR.RWa 


Registers when the target Exception level is: 


EL3 EL2 EL1 





0 0 





0 1 


c c c 





1 0 


X0-X14, X16-X30 X0-X14, X16-X30 -b 





1 1 


X0-X14 X0-X14 X0-X14 





a. HCR.RW is a notional bit that is RESO. 


b. The RW bit values are not valid for the targeted Exception level. 
c. Not valid because the RW bit values would imply that EL2 is AArch32 and EL! is AArch64. 
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Note 


If EL2 is not implemented, or the SCR_EL3.NS or SCR.NS bit prevents its use, then as described 
in The effects of supporting fewer than four Exception levels on page D1-2395, the behavior is 
consistent with HCR_EL2.RW taking the value of SCR_EL3.RW. 








If the general-purpose register was not accessible from AArch32 state 
The general rule is that the register retains the state it had before any AArch32 execution. 


There is one exception to this rule, that is when taking an exception to EL3 using AArch64 when 
either EL2 is not implemented or EL1 is in Secure state. In these cases, the X15 register must be 
treated as if it is accessible when the value of SCR_EL3.RW is 0, and therefore the upper bits of 
X15 might either be set to zero or retain their previous value. 
Which general-purpose registers retain their state depends on both: 
$ The AArch64 state target Exception level. 
s The values of both: 

— SCR EL3.RW. 

— HCR EL2.RW or HCR.RW, where HCR.RW is a notional bit that is RESO. 


Table D1-101 shows which general-purpose registers can retain their state. 


Table D1-101 General-purpose registers that can retain their state on taking an exception to 
AArch64 from AArch32 





HCR_EL2.RW or Registers when the target Exception level is: 














SCR_EL3.RW HCR. RWa nP m e 

0 0 None -b -b 

0 1 -c -c z% 

1 0 X15 X15 -b 

1 1 X15-X30 X15-X30 X15-X30 





a. HCR.RW is a notional bit that is RESO. 
b. The RW bit values are not valid for the targeted Exception level. 
c. Not valid because the RW bit values would imply that EL2 is AArch32 and EL1 is AArch64. 


Note 


If EL2 is not implemented, or the SCR_EL3.NS bit prevents its use, then as described in The effects 
of supporting fewer than four Exception levels on page D1-2395, the behavior is consistent with 
HCR_EL2.RW taking the value of SCR_EL3.RW. 
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D1.19.3 SPSR, ELR, and AArch64 SP relationships on changing Execution state 


Table D1-102 shows the SPSR and ELR registers that are architecturally mapped between AArch32 state and 
AArch64 state. 


Table D1-102 SPSR and ELR mappings between AArch32 state and AArch64 state 





AArch32 register AArch64 register 











SPSR_ sve SPSR_EL1 
SPSR_hyp SPSR_EL2 
ELR_hyp ELR_EL2 





On exception entry to EL3 using AArch64 state from an Exception level using AArch32 state, when EL2 has been 
using AArch32 state, the upper 32-bits of ELR_EL2 are either set to zero or they retain the value before the 
AArch32 state execution. The implementation determines the choice between these two options, and the choice 
might vary dynamically within an implementation. Therefore, software must regard the upper 32-bits as being 
UNKNOWN. 


On exception entry to an Exception level using AArch64 state from an Exception level using AArch32 state, the 
AArch64 Stack Pointers and Exception Link Registers associated with an Exception level that are not accessible 
during execution in AArch32 state at that Exception level, retain the state that they had before the execution in 
AArch32 state. 


The following AArch32 registers are used only during execution in AArch32 state. However, they retain their state 
when there is execution at EL1 with EL1 using AArch64 state: 





$ SPSR_abt. 
s SPSR_und. 
è SPSR_ irq. 
° SPSR_fiq. 
Note 
è These registers are accessible during execution in AArch64 state at Exception levels higher than EL1, for 


context switching. 


$ If EL1 does not support execution in AArch32 state then these registers are RESO. 





On exception entry to an Exception level using AArch64 from an Exception level using AArch32, the AArch64 
Stack Pointers and Exception Link Registers associated with an Exception level that are not accessible during 
AArch32 execution at that Exception level retain the state that they had before AArch32 execution. This applies to 
the following registers: 


$ SP ELO. 
E SP ELI: 
7 SP_EL2. 
e ELR ELI. 
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D1.20 The effect of implementation choices on the programmers’ model 
Three of the implementation choices in Armv8 are: 
$ The number of Exception levels implemented. 
a Which Exception levels support AArch32 and which Exception levels support AArch64. 
è Whether SIMD and floating-point support is implemented. 
The following subsections give more information about how these choices affect the programmers’ model: 
. Implication of Exception levels implemented. 
s Support for Exception levels and Execution states on page D1-2394. 
s Implementations not including Advanced SIMD and floating-point instructions on page D1-2394. 
7 The effects of supporting fewer than four Exception levels on page D1-2395. 

D1.20.1 Implication of Exception levels implemented 
All implementations must include ELO and EL1. 
EL2 and EL3 are optional. The architecture permits all combinations of EL2 and EL3. 
See also Implementations not including Advanced SIMD and floating-point instructions on page D1-2394 and The 
effects of supporting fewer than four Exception levels on page D1-2395. 
For an implementation that includes all of the Exception levels Figure D1-5 shows the implemented Exception 
levels and the possible Execution states at lower Exception levels when EL3 is using AArch64. Figure D1-5 applies 
regardless of whether EL3 also supports use of AArch32. 

Non-secure state Secure state 
AArch32 or AArch32 or AArch32 or AArch32 or AArch32 or AArch32 or 
AArch64t AArch64t AArch64* AArch64t AArch64t AArch64t 
ELO App1 App2 App1 App2 Secure App1 Secure App2 


























AArch32 or AArch64* 


AArch32 or AArch64* 





AArch32 or AArch64 





























EL1 Guest OS1 Guest OS2 Secure OS 
AArch32 or AArch64 AArch64 
EL2 Hypervisor Secure Hypervisor 
AArch64 
EL3 Secure monitor 











t AArch64 permitted only if EL1 is using AArch64 
+ AArch64 permitted only if EL2 is using AArch64 
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D1.20.2 


D1.20.3 


D1-2394 


The possible combinations of Exception levels are as follows: 


° ELO, EL1, and EL2. The implementation supports only a single Security state. This might be either Secure 
state or Non-secure state. 


è ELO, EL1, and EL3. The implementation does not support Virtualization. The Exception levels and 
Execution states depend on whether EL3 is using AArch64 state or AArch32 state, as follows: 


—  IfEL3 is using AArch64, the Exception levels and Execution states are as shown in Figure D1-5 on 
page D1-2393 with EL2 removed and no virtualization of EL1 and ELO. 


— IfEL3 is using AArch32, the Exception levels and Execution states are as shown in Figure G1-1 on 
page G1-5478 with EL2 removed and no virtualization of EL1 and ELO. 


è ELO and EL1 only. The implementation supports only a single Security state. This might be either Secure 
state or Non-secure state, see Behavior when only EL1 and ELO are implemented on page D1-2396. 


° ELO, EL1, EL2, and EL3, as described in this section. 


For more information, see The effects of supporting fewer than four Exception levels on page D1-2395. 


Support for Exception levels and Execution states 


Subject to the interprocessing rules defined in Jnterprocessing on page D1-2380, an implementation of the Arm 
architecture could support: 


$ AArch64 state only. 
. AArch64 and AArch32 states. 
- AArch32 state only. 


This means the Armv8-A architecture can, potentially, support implementations with very large number of 
combinations of Execution state and Exception level. Arm intends to license only a subset of the possible 
combinations. 


In an implementation that: 

° Supports AArch64 state, all Exception levels are included. 

. Has Secure and Non-secure states, EL3 should be implemented. 

è Includes all Exception levels, EL3 cannot be included in AArch32 state. 


Implementations not including Advanced SIMD and floating-point instructions 


In general, Armv8-A requires the inclusion of the Advanced SIMD and floating-point instructions in all instruction 
sets. Exceptionally, for implementations targeting specialized markets that do not require support for floating-point 
or use of Advanced SIMD, Arm might produce or license an Armv8-A implementation that does not provide any 
support for Advanced SIMD and floating-point instructions. In such an implementation: 


In AArch64 state 

° The CPACR_EL1.FPEN field is RESO. 

° The CPTR_EL2.TFP bit is RES1. 

° The CPTR_EL3.TFP bit is RES1. 

° Each of the ID_ AA64PFRO_EL1.{AdvSIMD, FP} fields is 0b1111. 

. The FPEXC32_EL2, FPCR, and FPSR registers are not implemented, and their encodings 
are UNDEFINED. 

. Attempted accesses to Advanced SIMD and floating-point functionality are UNDEFINED. This 
means: 
— All Advanced SIMD and floating-point instructions are UNDEFINED. 
— Attempts to access the Advanced SIMD and floating-point System registers are 

UNDEFINED. 


- If at least one Exception level supports execution in AArch32 state, the MVFRO_ELI1, 
MVFRI1_EL1 and MVFR2_ELI registers are RAZ. When no Exception level supports 
execution in AArch32 state these registers are UNKNOWN. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch64 System Level Programmers’ Model 
D1.20 The effect of implementation choices on the programmers’ model 


In AArch32 state 


See AArch32 implications of not including support for Advanced SIMD and floating-point on 
page G1-5570. 


D1.20.4 The effects of supporting fewer than four Exception levels 


ARM DDI 0487E.a 
ID070919 


The effect of implementation choices on the programmers’ model on page D1-2393 defines the permitted 
combinations of Exception levels in an Armv8-A implementation. 


In every implementation that supports the highest Exception level using either AArch64 state or AArch32 state, an 
IMPLEMENTATION DEFINED mechanism determines whether the highest implemented Exception level uses AArch64 
state or AArch32 state from a Cold reset. Typically, this mechanism is a configuration input. When the highest level 
is configured to be AArch64 state, then after a Cold reset execution starts at the reset vector in that Exception level. 


The unimplemented Exception levels have no effect on execution: 


° No interrupts are routed to these Exception levels. 

° No traps that target these Exception levels are active 

à All systems calls to unimplemented Exception levels from lower Exception levels are treated as UNDEFINED. 

a There is no support for address translation from these Exception levels. 

è Any exception return that targets an unimplemented Exception level is treated as an illegal exception return 
as described in ///egal return events from AArch64 state on page D1-2304. 

Every accessible register associated with an unimplemented Exception level is RESO unless the register is 
associated with the Exception level only to provide the ability to transfer execution to a lower Exception 
level. 

Note 





If, for example, EL3 is not implemented and EL2 is the highest implemented Exception level, then because 
none of the EL3 registers are accessible from EL2, the content of those registers is not architecturally visible. 





The following subsections give more information about each of the permitted combinations of Exception levels that 
do not include all Exception levels. 


Behavior when EL3 is not implemented 
If EL3 is not implemented: 
è If EL2 is implemented and Secure EL2 is not implemented, the Effective value of SCR_EL3.NS is 0b1. 


s If Secure EL2 is implemented, the Effective value of SCR_EL3.EEL2 is @b1 and the Effective value of 
SCR_EL3.NS is @b0. 


à If EL2 is not implemented, it is IMPLEMENTATION DEFINED whether the Effective value of SCR_EL3.NS is 
0b1 or 0bð. 


Behavior when EL2 is not implemented 
If EL2 is not implemented and EL3 is implemented: 


: If EL1 can use AArch32 then the following registers are not RESO: 
—  DACR32_EL2. 
—  IFSR32_EL2. 
—  FPEXC32_EL2. 
—  DBGVCR32_EL2. 


. The VMPIDR_EL2 and VPIDR_EL2 behave as follows: 
— Reads of VMPIDR_EL2 return the value of MPIDR_EL1, writes to VMPIDR_EL2 are ignored. 
— Reads of VPIDR_EL2 return the value of MIDR_EL1, writes to VPIDR_EL2 are ignored. 
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e Behavior is consistent with the HCR_EL2.RW bit taking the value of the SCR_EL3.RW bit for all purposes 
other than reading the HCR_EL2. 


° Virtual interrupts are disabled. 
s The following address translation and TLB invalidation instructions are UNDEFINED: 
— AT S1EF2R and AT SIE2W. 


— TLBI VAEF2, TLBI VALE2, TLBI VAE2IS, TLBI VALE2IS, TLBI VAE20S, TLBI VALE20S, TLBI 
ALLE2, TLBI ALLE2IS, TLBI ALLE20S, TLBI RVAE2, TLBI RVALE2, TLBI RVAEZIS, TLBI 
RVALE2IS, TLBI RVAE20S, TLBI RVALE20S. 


Note 


No other TLB or address translation instructions become UNDEFINED with this combination of 
Exception levels. 








à The SCR_EL3.HCE bit is RESO. 


If EL2 is not implemented, regardless of whether EL3 is implemented: 
7 The Effective value of CNTHCTL_EL2[1:0] is @b11. 
. The Effective value of MDCR_EL2.HPMN is the value of PMCR_ELO.N. 


Behavior when only EL1 and ELO are implemented 


If EL3 and EL2 are not implemented, it is IMPLEMENTATION DEFINED whether the Effective value of the 
SCR_EL3.NS bit is @b1 or 0b®. 


This means that if the PE is part of a system that supports two Security states: 


s When the Effective value of the SCR_EL3.NS bit is 0b1, the PE can only access Non-secure memory. 


When the Effective value of the SCR_EL3.NS bit is 0b0, the PE can access both Secure memory and 
Non-secure memory. 


If the Effective value of the SCR_EL3.NS bit is 0b0, then: 

° The Effective value of MDCR_EL3.{EPMAD, EDAD} is {0b1, 0b1}. 
° The Effective value of MDCR_EL3.{SPME, NSPB} is {0b1, 0b01}. 

è The Effective value of MDCR_EL3.SPD32 is 0b11. 


If EL3 is not implemented, regardless of whether EL2 is implemented, the Effective value of MDCR_EL3.STE is 
the inverse of the Effective value of SCR_EL3.NS. 


Note 
° The behavior described in this subsection still applies if EL1 is configured to use AArch32. 





: The implementation can provide a configuration input that determines, from reset, the Effective value of the 
SCR_EL3.NS bit. 
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When the PE is using self-hosted debug, it generates debug exceptions. This chapter describes the AArch64 
self-hosted debug exception model. It is organized as follows: 


Introductory information 
. About self-hosted debug on page D2-2398. 
s The debug exception enable controls on page D2-2402. 


The debug Exception model 
. Routing debug exceptions on page D2-2403. 
. Enabling debug exceptions from the current Exception level on page D2-2405. 
. The effect of powerdown on debug exceptions on page D2-2407. 
. Summary of the routing and enabling of debug exceptions on page D2-2408. 
$ Pseudocode description of debug exceptions on page D2-2410. 


The debug exceptions 
° Breakpoint Instruction exceptions on page D2-2411. 
° Breakpoint exceptions on page D2-2413. 
° Watchpoint exceptions on page D2-2431. 
$ Vector Catch exceptions on page D2-2445. 
7 Software Step exceptions on page D2-2446. 


Synchronization requirements 


The behavior of self-hosted debug after changes to System registers, or after changes to the 
authentication interface, but before a Context synchronization event guarantees the effects of the 
changes: 


. Synchronization and debug exceptions on page D2-2459. 
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D2.1.1 


D2.1.2 


D2.1.3 


D2-2398 


About self-hosted debug 


Self-hosted debug supports debugging through the generation and handling of debug exceptions, that are taken using 
the exception model described in Chapter D1 The AArch64 System Level Programmers’ Model. This section 
introduces some terms that are used in describing self-hosted debug, and then introduces the debug exceptions. See: 


s Definition of a debugger in the context of self-hosted debug. 
$ Context ID and Process ID. 
s About debug exceptions. 


Definition of a debugger in the context of self-hosted debug 


Within this chapter, debugger means that part of an operating system, or higher level of system software, that 
handles debug exceptions and programs the Debug System registers. An operating system with rich application 
environments might provide debug services that support a debugger user interface executing at ELO. From the 
architectural perspective, the debug services are the debugger. 


Context ID and Process ID 


A CONTEXTIDR_ELx identifies the current Context ID, that is used by: 
° The debug logic, for breakpoint and watchpoint matching. 
$ Implemented trace logic, to identify the current process. 


In AArch64 state, the CONTEXTIDR_ELx has a single field, PROCID, that is defined as the Process Identifier 
(Process ID). Therefore, in AArch64 state, the Context ID and Process ID are identical. 


About debug exceptions 


Debug exceptions occur during normal program flow if a debugger has programmed the PE to generate them. For 
example, a software developer might use a debugger contained in an operating system to debug an application. To 
do this, the debugger enables one or more debug exceptions. The debug exceptions that can be generated in stage 1 
of an AArché64 translation regime are: 


° Breakpoint Instruction exceptions on page D2-2399. 

. Breakpoint exceptions on page D2-2399, generated by hardware breakpoints. 
$ Watchpoint exceptions on page D2-2399, generated by hardware watchpoints. 
7 Software Step exceptions on page D2-2400. 


In addition, debug exceptions generated in an AArch32 translation regime might be routed to EL2 using AArch64. 
See Routing debug exceptions on page D2-2403. Chapter G2 describes the debug exceptions that can be generated 
in an AArch32 translation regime. 


Vector Catch exceptions are exceptions that cannot be generated in an AArch64 translation regime but can be 
generated in stage 1 of an AArch32 translation regime and routed to EL2 using AArch64. Vector Catch exceptions 
on page D2-2445 describes the behavior for this case. 


The PE can only generate a particular debug exception when both: 


1. Debug exceptions are enabled from the current Exception level and Security state. 
See Enabling debug exceptions from the current Exception level on page D2-2405. Breakpoint Instruction 
exceptions are always enabled from the current Exception level and Security state. 

2: A debugger has enabled that particular debug exception. 


All of the debug exceptions except for Breakpoint Instruction exceptions have an enable control contained in 
the MDSCR_EL1. See The debug exception enable controls on page D2-2402. 


Note 


If halting is allowed and EDSCR.HDE is 1, hardware breakpoints and watchpoints cause entry to Debug state 
instead of causing debug exceptions. In Debug state, the PE is halted. 
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For the definition of halting is allowed, see Halting allowed and halting prohibited on page H2-6705. 





The following list summarizes each of the debug exceptions: 


Breakpoint Instruction exceptions 


Breakpoint instructions generate these. Breakpoint instructions are instructions that software 
developers can use to cause exceptions at particular points in the program flow. 


The breakpoint instruction in the A64 instruction set is BRK #<immediate>. Whenever one of these is 
committed for execution, the PE takes a Breakpoint Instruction exception. 


PE behavior 


Breakpoint Instruction exceptions cannot be masked. The PE takes Breakpoint 
Instruction exceptions regardless of both of the following: 


s The current Exception level. 
s The current Security state. 


For more information, see Breakpoint Instruction exceptions on page D2-2411. 


Breakpoint exceptions 


The Armv8-A architecture provides 2-16 hardware breakpoints. These can be programmed to 
generate Breakpoint exceptions based on particular instruction addresses, or based on particular PE 
contexts, or both. 


For example, a software developer might program a hardware breakpoint to generate a Breakpoint 
exception whenever the instruction with address 0x1000 is committed for execution. 


The Armv8-A architecture supports the following types of hardware breakpoint for use in stage 1 
of an AArch64 translation regime: 


° Address. 
— Comparisons are made with the virtual address of each instruction in the program flow. 
$ Context: 
— Context ID Match. Matches with the Context ID held in the CONTEXTIDR_EL1. 
—  VMID Match. Matches with the VMID value held in the VTTBR_EL2. 
— Context ID and VMID Match. Matches with both the Context ID and the VMID value. 


An Address breakpoint can link to a Context breakpoint, so that the Address breakpoint only 
generates a Breakpoint exception if the PE is in a particular context when the address match occurs. 


A breakpoint generates a Breakpoint exception whenever an instruction that causes a match is 
committed for execution. 


PE behavior 


If halting is allowed and EDSCR.HDE is 1, hardware breakpoints cause entry to Debug 
state. That is, they halt the PE. See Chapter H2 Debug State. 


Otherwise: 

° If debug exceptions are enabled, hardware breakpoints cause Breakpoint 
exceptions. 

° If debug exceptions are disabled, hardware breakpoints are ignored. 


For more information, see Breakpoint exceptions on page D2-2413. 


Watchpoint exceptions 


The Armv8-A architecture provides 2-16 hardware watchpoints. These can be programmed to 
generate Watchpoint exceptions based on accesses to particular data addresses, or based on accesses 
to any address in a data address range. 


For example, a software developer might program a hardware watchpoint to generate a Watchpoint 
exception on an access to any address in the data address range 0x1000 - 0x101F. 
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A hardware watchpoint can link to a hardware breakpoint if the hardware breakpoint is a Linked 
Context type. In this case, the watchpoint only generates a Watchpoint exception if the PE is ina 
particular context when the data address match occurs. 


The smallest data address size that a watchpoint can be programmed to match on is a byte. A single 
watchpoint can be programmed to match on one or more bytes. 


A watchpoint generates a Watchpoint exception whenever an instruction that initiates an access that 
causes a match is committed for execution. 


PE behavior 


If halting is allowed and EDSCR.HDE is 1, hardware watchpoints cause entry to Debug 
state. That is, they halt the PE. See Chapter H2 Debug State. 


Otherwise: 

° If debug exceptions are enabled, hardware watchpoints cause Watchpoint 
exceptions. 

s If debug exceptions are disabled, hardware watchpoints are ignored. 


For more information, see Watchpoint exceptions on page D2-2431. 


Vector Catch exceptions 
These are not generated in an AArch64 translation regime. They can only be generated in an 
AArch32 translation regime. See Vector Catch exceptions on page D2-2445. 

Software Step exceptions 
Software step is a resource that a debugger can use to make the PE single-step instructions. 


For example, by using software step, debugger software executing at a higher Exception level can 
debug software executing at a lower Exception level, by making it single-step instructions. 


After the software being debugged has single-stepped an instruction, the PE takes a Software Step 
exception. 
PE behavior 


Software step can only be used by a debugger executing in an Exception level that is 
using AArch64. However, the instruction stepped might be executed in either Execution 
state, and therefore Software Step exceptions can be taken from either Execution state. 


If debug exceptions are enabled, Software Step exceptions can be generated. 
If debug exceptions are disabled, software step is inactive. 


For more information, see Software Step exceptions on page D2-2446. 


Table D2-1 summarizes PE behavior and shows the location of the pseudocode for each of the debug exceptions. 


Table D2-1 PE behavior and pseudocode for each of the debug exceptions 


PE behavior if debug exceptions are: 
Debug exception Pseudocode 
Enabled Disabled 





Breakpoint Instruction exceptions Takes the exception Takes the exception Pseudocode description of Breakpoint 
Instruction exceptions on page D2-2412 





Breakpoint exceptions Takes the exception? Ignored Pseudocode description of Breakpoint 
exceptions taken from AArch64 state on 
page D2-2429 
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Table D2-1 PE behavior and pseudocode for each of the debug exceptions (continued) 





PE behavior if debug exceptions are: 
Debug exception Pseudocode 
Enabled Disabled 





Watchpoint exceptions Takes the exception? Ignored Pseudocode description of Watchpoint 
exceptions taken from AArch64 state on 


page D2-2444 





Vector Catch exceptions Takes the exception Ignored Pseudocode description of Vector Catch 
exceptions on page G2-5673 





Software Step exceptions Takes the exception Not applicable? Pseudocode description of Software Step 
exceptions on page D2-2458 





a. If halting is allowed and EDSCR.HDE is 1, hardware breakpoints and watchpoints cause the PE to enter Debug state instead of causing 
debug exceptions. See Chapter H2 Debug State. 


b. Software Step is inactive if debug exceptions are disabled. No Software Step exceptions can be generated. 
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D2.2 The debug exception enable controls 
The enable controls for each debug exception are as follows: 


Breakpoint Instruction exceptions 


None. Breakpoint Instruction exceptions are always enabled. 


Breakpoint exceptions 
MDSCR_EL1.MDE, plus an enable control for each breakpoint, DBGBCR<n>_EL1.E. 


Watchpoint exceptions 
MDSCR_EL1.MDE, plus an enable control for each watchpoint, DBGWCR<n>_EL1.E. 


Vector Catch exceptions 
MDSCR_EL1.MDE. 





Software Step exceptions 
MDSCR_ ELI1.SS. 





In addition, for all debug exceptions other than Breakpoint Instruction exceptions, software must configure the 
controls that enable debug exceptions from the current Exception level and Security state. See Enabling debug 
exceptions from the current Exception level on page D2-2405. 


The PE cannot take a debug exception if debug exceptions are disabled from either the current Exception level or 
the current Security state. 


Breakpoint Instruction exceptions are always enabled from the current Exception level and Security state. 
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D2.3 Routing debug exceptions 


Debug exceptions are enabled and routed according to the following controls: 
. MDCR_EL2.TDE. 

. HCR_EL2.TGE. 

. MDCR_EL3.SDD. 

à The Security state when the exception is taken. 

à The Exception level where the exception is taken. 


Breakpoint Instructions are enabled in some situations where other Debug exceptions are disabled. 


If the OS Lock is locked, or if DoubleLockStatus() == TRUE, a Debug exception cannot be taken. 


Note 


If EL2 is not implemented, the Effective value of HCR_EL2.TGE is 0 and the Effective value of MDCR_EL2.TDE 
is 0. Throughout this section, references to the values of these fields are to the Effective values of the fields. 








If EL3 is not implemented, and the implementation is a Secure state only implementation, the Effective value of 
MDCR_EL3.SDD is 0. 


The routing of debug exceptions is as follows: 


Table D2-2 shows when debug exceptions are enabled from the current Security state. 


Table D2-2 Whether debug exceptions are enabled from the current Security state 





Current Security state | Breakpoint Instruction exceptions All other debug exceptions 





Non-secure 


Enabled Enabled 





Secure 
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Enabled Disabled if MDCR_EL3.SDD is 1. See Disabling debug 
exceptions from Secure state on page D2-2405. 


Otherwise enabled. 





Debug exceptions taken when EL2 is implemented and enabled in the current Security state 
The routing of debug exceptions taken depends on the values of MDCR_EL2.TDE and 
HCR_EL2.TGE: 
If the Effective value of {MDCR_EL2.TDE, HCR_EL2.TGEB} is not {0, 0} 
Debug exceptions are routed to EL2, ELD is EL2. 
Otherwise 
Debug exceptions behave as follows: 
° Debug exceptions taken from EL1 and ELO are routed to EL1. ELD is EL1 
. Breakpoint Instruction exceptions taken from EL2 are routed to EL2. 
° All other debug exceptions are disabled from EL2 using AArch64. 


When EL3 is implemented 
Breakpoint Instruction exceptions taken from EL3 are routed to EL3. 


All other debug exceptions are disabled from EL3 using AArch64. 
Otherwise Debug exceptions are routed to EL1. 


This means that, for all debug exceptions, the Debug target Exception level, ELp, is either EL1 or EL2. When 
executing in the same exception level as ELD, see Enabling debug exceptions from the current Exception level on 
page D2-2405. 
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Table D2-3, Table D2-4, and Table D2-5 show the routing of debug exceptions. In these tables: 


TDE Means the logical OR of the Effective value of MDCR_EL2.TDE and the Effective value of 
HCR_EL2.TGE. 

(ELx) Means ELp is ELx. However: 
è All debug exceptions other than Breakpoint Instruction exceptions are disabled from this 


Exception level. 


s Breakpoint Instruction exceptions taken when executing in this Exception level are routed to 
the same Exception level. This may not be the same as the ELD Exception level. 


ELx Means ELp is ELx. 


Table D2-3 Routing when both EL3 and EL2 are implemented 

















ELp when executing in: 
EEL2a | NS | TDE 
ELO EL1 EL2 EL3 
0 0 x ELI ELI (ELI) (ELI) 
1 0 xX ELI ELI (ELI) (ELI) 
x 1 0 ELI ELI (ELI) (ELI) 
xX 1 1 EL2 EL2 EL2 (EL2) 














a. When the implementation does not include 
ARMvV8.4-SecEL2, the SCR_EL3.EEL2 field is not 
implemented and the Effective value of EEL2 is 0. 


Table D2-4 Routing when EL3 is implemented and EL2 is not implemented 


ELp when executing in: 


ELO 


EL1 EL3 





ELI 


ELI (EL1) 





Table D2-5 Routing when EL3 is not implemented and EL2 is implemented 


D2.3.1 Pseudocode description of routing debug exceptions 


DebugTarget() returns the current debug target Exception level. 











ELp when executing in: 
TDE 

ELO EL1 EL2 
0 ELI ELI (EL1) 
1 EL2 EL2 EL2 








DebugTargetFrom() returns the debug target Exception level for the specified Security state. 


These functions are described in Chapter J1 Armv8 Pseudocode. 
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D2.4 Enabling debug exceptions from the current Exception level 


A debug exception can only be taken if all of the following are true: 


The OS Lock is unlocked. 

DoubleLockStatus() == FALSE. 

The debug exception is enabled from the current Exception level. 
The debug exception is enabled from the current Security state. 


Table D2-6 shows when debug exceptions are enabled from the current Exception level. In the table, ELp is the 
Exception level that Table D2-3 on page D2-2404 defines. 


Table D2-6 Whether debug exceptions are enabled from the current Exception level 














Current Exception level Breakpoint nSmucton All other debug exceptions 
exceptions 

Any Exception level that is Enabled Disabled 

higher than ELp? 

ELp Enabled Disabled if either of the following is true: 
° The Local (kernel) Debug Enable bit, MDSCR_EL1.KDE, is 0. 
° The Debug exception mask bit, PSTATE.D, is 1. 
Otherwise enabled. 
This means that a debugger must explicitly enable these debug 
exceptions from ELp by setting MDSCR_EL1.KDE to 1 and 
PSTATE.D to 0. 

Any Exception level that is Enabled Enabled 

lower than ELp 








a. This includes EL3. EL3 is always higher than ELp. 





Note 


PSTATE.D is set to 1 at reset and on exception entry. 





D2.4.1 


Disabling debug exceptions from Secure state 


If EL3 is implemented, software executing at EL3 can set the Secure Debug Disable bit, MDCR_EL3.SDD, to 1 to 
disable all debug exceptions taken from AArch64 Secure state other than Breakpoint Instruction exceptions. 


The Armv8-A architecture does not support disabling debug in Non-secure state. 


Note 





If the boot software executed when reset is deasserted sets MDCR_EL3.SDD to 1, software operating at EL3 
never has to switch the debug registers between Secure state and Non-secure state. 


The PE cannot take a debug exception unless it is enabled from the current Exception level. See Table D2-6. 


If either the OS Lock or the OS Double Lock is locked, debug exceptions other than Breakpoint Instruction 
exceptions are disabled. 


If EL3 and EL2 are not implemented, and the implementation is a Secure state only implementation, the PE 
behaves as if MDCR_EL3.SDD is 0. 
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D2.4.2 Pseudocode description of enabling debug exceptions 


AArch64.GenerateDebugExceptions() determines whether debug exceptions other than Breakpoint Instruction 
exceptions are enabled from the current Exception level and Security state. 


AArch64.GenerateDebugExceptionsFrom() determines whether debug exceptions other than Breakpoint Instruction 
exceptions are enabled from the specified Exception level and Security state. 


These functions are described in Chapter J1 Armv8 Pseudocode. 
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D2.5 The effect of powerdown on debug exceptions 
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Debug OS Save and Restore sequences on page H6-6813 describes the powerdown save routine and the restore 
routine. 


When executing either routine, software must use the OS Lock to disable generation of all of the following: 


Breakpoint exceptions. 
Watchpoint exceptions. 
Vector Catch exceptions. 
Software Step exceptions. 


This is because the generation of these exceptions depends on the state of the debug registers, and the state of the 
debug registers might be lost over these routines. 


If the OS Lock is unlocked, and DoubleLockStatus()== FALSE, debug exceptions other than Breakpoint Instruction 
exceptions are enabled. 


If OS Lock is locked, or if DoubleLockStatus()==TRUE, debug exceptions other than Breakpoint Instruction 
exceptions are disabled. 


Breakpoint Instruction exceptions are enabled regardless of the state of the OS Lock and the OS Double Lock. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D2-2407 
Non-Confidential 


AArch64 Self-hosted Debug 
D2.6 Summary of the routing and enabling of debug exceptions 


D2.6 


D2-2408 


Summary of the routing and enabling of debug exceptions 


Behavior is as follows: 


Breakpoint Instruction exceptions 


These are always enabled, regardless of the current Exception level and Security state. A Breakpoint 
Instruction exception taken from EL3 is always routed to EL3. A Breakpoint Instruction exception 
taken from EL2 is routed to EL2. A Breakpoint Instruction exception taken from ELO or EL] is 
always routed to ELp. 


All other debug exceptions 


Table D2-7 


shows the valid combinations of MDCR_EL3.SDD, MDCR_EL2.TDE, 


MDSCR_EL1.KDE, and PSTATE.D, and for each combination shows where these exceptions are 
enabled from and where they are taken to. 


In the table: 
Lock 

NS 

SDD 


EEL2 


TGE 


TDE 


Table D2-7 Routin 


Means the value of (OSLSR_EL1.0SLK == ’1’ || DoubleLockStatus()). 
Means the Effective value of SCR_EL3.NS. 


Means the Effective value of MDCR_EL3.SDD. See Disabling debug exceptions from 
Secure state on page D2-2405. 


Means the Effective value of SCR_EL3.EEL2. If ARMv8.4-SecEL2 is not 
implemented, this is 0. 


Means the value of HCR_EL2.TGE. If EL2 is not implemented, the PE behaves as if 
this is 0. 


Means the value of MDCR_EL2.TDE. If EL2 is not implemented, the PE behaves as if 
this is 0. 


Means the value of MDSCR_EL1.KDE. 
Means the value of PSTATE.D. 


Means not applicable. The PE cannot be executing at this Exception level. 





Means that debug exceptions are disabled from that Exception level. 


g of Breakpoint, Watchpoint, Software Step, and Vector Catch exceptions 



































ELp when enabled from: 
Debug state Lock NS SDD EEL2 TGE TDE KDE D 
ELO EL1 EL2 EL3 
Yes X X X X X X xX | - - = : 
No TRUE X X X X X xX | - - - - 
FALSE 0 1 X X X X xX | - - - - 
0 0 X X 0 X | ELI - n/a - 
1 0 | ELI Ell mna - 
1 | ELI - n/a - 
1 0 0 0 X | ELI - - - 
1 0 | ELI El - - 
1 | ELI - - 2 
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Table D2-7 Routing of Breakpoint, Watchpoint, Software Step, and Vector Catch exceptions (continued) 
























































ELp when enabled from: 
Debug state Lock NS SDD EEL2 TGE TDE KDE D 
ELO EL1 EL2 EL3 
No FALSE 0 0 1 0 1 0 X | EL2 EL2 - - 
1 0 | EL2 ŒEL2 EL2 - 
1 | EL2 EIL2 - - 
1 X 0 X | EL2 n/a - - 
1 0 | EL2 n/a EL2 - 
1 | EL2 ma - - 
1 X X 0 0 0 X | ELI - - - 
1 0 | ELI - - - 
1 | ELI ELI - - 
1 0 X | EL2 EL2 - - 
1 0 | EL2 ŒElL2 EL2 - 
1 | EL2 EL2 - - 
1 X 0 X | EL2 n/a - - 
1 0 | EL2 ma - - 
1 | EL2 n/a - - 
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D2.7 Pseudocode description of debug exceptions 


AArch64.DebugFault() returns a FaultRecord object that indicates that a memory access has generated a debug 
exception: 


The AArch64.Abort() function processes FaultRecord objects, as described in Abort exceptions on page D4-2501, 
and generates a debug exception. 


AArch64.Abort() calls one of the following: 
. AArch64.BreakpointException(). 

. AArch64.WatchpointException(). 

. AArch64.VectorCatchException(). 

° AArch64. SoftwareStepException(). 


These functions are defined in Chapter J1 Armv8 Pseudocode. 
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D2.8 Breakpoint Instruction exceptions 


This section describes Breakpoint Instruction exceptions in an AArch64 translation regime. 


The PE is using an AArch64 translation regime when it is executing either: 
: In an Exception level that is using AArch64. 
$ At ELO using AArch32 when EL1 is using AArch64. 


For software executing in an Exception level that is using AArch64, a Breakpoint Instruction exception results from 
the execution ofan A64 BRK instruction. However, within the AArch64 EL1&0 translation regime, executing a T32 
or A32 BKPT instruction at ELO using AArch32 generates a Breakpoint Instruction exception. 


For more information about the T32 and A32 BKPT instructions, see: 
. Breakpoint instruction in the A32 and T32 instruction sets on page G2-5625. 
. BKPT instructions as the first instruction in an IT block on page G2-5626. 


The following subsections describe Breakpoint Instruction exceptions in an AArch64 translation regime: 


. About Breakpoint Instruction exceptions. 

E Breakpoint instructions. 

. Exception syndrome information and preferred return address on page D2-2412. 

. Pseudocode description of Breakpoint Instruction exceptions on page D2-2412. 
D2.8.1 About Breakpoint Instruction exceptions 


A breakpoint is an event that results from the execution of an instruction, which is based on either: 
: The instruction address, the PE context, or both. This type of breakpoint is called a hardware breakpoint. 


a The instruction itself. That is, the instruction is a breakpoint instruction. These can be included in the 
program that the PE executes. This type of breakpoint is called a software breakpoint. 


Breakpoint Instruction exceptions, that this section describes, are software breakpoints. Breakpoint exceptions on 
page D2-2413 describes hardware breakpoints. 


There is no enable control for Breakpoint Instruction exceptions. They are always enabled, and cannot be masked. 


A Breakpoint Instruction exception is generated whenever a breakpoint instruction is committed for execution, 
regardless of all of the following: 


$ The current Exception level. 
° The current Security state. 
$ Whether the debug target Exception level, ELp, is using AArch64 or AArch32. 


Note 


s The debug target Exception level, ELp, is the Exception level that debug exceptions are targeting. Routing 
debug exceptions on page D2-2403 describes how ELp is derived. 





° Debuggers using breakpoint instructions must be aware of the Armv8 rules for concurrent modification and 
execution of instructions. See Concurrent modification and execution of instructions on page B2-112. 





D2.8.2 Breakpoint instructions 
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The breakpoint instruction in the A64 instruction set is BRK #<immediate>. It is unconditional. 
For details of the instruction encoding, see BRK on page C6-819. 
The breakpoint instruction in the A32 and T32 instruction sets is BKPT #<immediate>. 


For more information about the A32 and T32 breakpoint instruction, see Breakpoint instruction in the A32 and T32 
instruction sets on page G2-5625. 
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D2.8.3 Exception syndrome information and preferred return address 


See the following: 
s Exception syndrome information. 


s Preferred return address. 


Exception syndrome information 


On taking a Breakpoint Instruction exception, the PE records information about the exception in the Exception 
Syndrome Register (ESR) at the Exception level the exception is taken to. The ESR used is one of: 


< ESR ELI. 


: ESR_EL2. 
. ESR_EL3. 
Note 





Breakpoint Instruction exceptions are the only debug exception that can be taken to EL3 using AArch64. 





Table D2-8 shows the information that the PE records. 


Table D2-8 Information recorded in the ESR_ELx 





ESR_EL-x field 


Information recorded in ESR_EL1, ESR_EL2, or ESR_EL3. 


Exception Class, EC Whether the breakpoint instruction was executed in AArch64 state or AArch32 state. The PE sets this to: 


. 0x3C for an A64 BRK instruction. 
. 0x38 for an A32 or T32 BKPT instruction. 





Instruction Length, IL The PE sets this to: 


° 0 for a 16-bit T32 BKPT instruction. 
. 1 for an A64 BRK instruction, or an A32 BKPT instruction. 





Instruction Specific ISS[24:16] RESO. 








Syndrome, ISS ISS[15:0] The PE copies the instruction Comment field value into here, zero extended as necessary. 
Note 
° If debug exceptions are routed to EL2, it is the exception that is routed, not the instruction that is trapped. 


Therefore, if a Breakpoint Instruction exception is routed to EL2, ESR_EL2.EC is set to the same value as if 
the exception was taken to EL1. 


° For information about how debug exceptions can be routed to EL2, see Routing debug exceptions on 
page D2-2403. 





Preferred return address 


The preferred return address is the address of the breakpoint instruction, not the next instruction. This is different 
to the behavior of other exception-generating instructions, like SVC. 


D2.8.4 Pseudocode description of Breakpoint Instruction exceptions 


D2-2412 


AArch64.SoftwareBreakpoint() generates a Breakpoint Instruction exception that is taken to AArch64 state. 


This function is defined in Chapter J1 Armv8 Pseudocode. 
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D2.9 Breakpoint exceptions 


This section describes Breakpoint exceptions in stage 1 of an AArch64 translation regime. 


The PE is using an AArch64 translation regime when it is executing either: 
è In an Exception level that is using AArch64. 
: At ELO using AArch32 when EL! is using AArch64. 


This section contains the following subsections: 


. About Breakpoint exceptions. 

. Breakpoint types and linking of breakpoints on page D2-2414. 

. Execution conditions for which a breakpoint generates Breakpoint exceptions on page D2-2422. 
. Breakpoint instruction address comparisons on page D2-2424. 

° Breakpoint context comparisons on page D2-2425. 

5 Breakpoint usage constraints on page D2-2426. 


7 Preferred return address on page D2-2429. 
s Pseudocode description of Breakpoint exceptions taken from AArch64 state on page D2-2429. 


D2.9.1 About Breakpoint exceptions 
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A breakpoint is an event that results from the execution of an instruction, which is based on either: 
a The instruction address, the PE context, or both. This type of breakpoint is called a hardware breakpoint. 


s The instruction itself. That is, the instruction is a breakpoint instruction. These can be included in the 
program that the PE executes. This type of breakpoint is called a software breakpoint. 


Breakpoint exceptions are generated by Breakpoint debug events. Breakpoint debug events are generated by 
hardware breakpoints. Software breakpoints are described in Breakpoint Instruction exceptions on page D2-2411. 


An implementation can include between 2-16 hardware breakpoints. ID_AA64DFR0_EL1.BRPs shows how many 
are implemented. 


To use an implemented hardware breakpoint, a debugger programs the following registers for the breakpoint: 


è The Breakpoint Control Register, DBGBCR<n>_EL1. This contains controls for the breakpoint, for example 
an enable control. 


$ The Breakpoint Value Register, DBGBVR<n>_EL1. This holds the value used for breakpoint matching, that 
is one of: 


— An instruction virtual address. 

— A ContextID. 

—  AVMID value. 

— A concatenation of both a Context ID value and a VMID value. 


These registers are numbered, so that: 
s DBGBCR1_EL1 and DBGBVR1_ELl1 are for breakpoint number one. 
` DBGBCR2_EL1 and DBGBVR2_EL] are for breakpoint number two. 


è DBGBCR<n>_EL1 and DBGBVR<n>_ELl1 are for breakpoint number n. 


A debugger can link a breakpoint that is programmed with an address and a breakpoint that is programmed with 
anything other than an address together, so that a Breakpoint debug event is only generated if both breakpoints 
match. 


For each instruction in the program flow, all of the breakpoints are tested. When a breakpoint is tested, it generates 
a Breakpoint debug event if all of the following are true: 


: The breakpoint is enabled. That is, the breakpoint enable control for it, DBGBCR<n>_EL1.E, is 1. 
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D2.9.2 


D2-2414 


è The conditions specified in the DBGBCR<n>_EL1 are met. 


: The comparison with the value held in the DBGBVR<n>_EL] is successful. 


è If the breakpoint is linked to another breakpoint, the comparisons made by that other breakpoint are also 
successful. 
$ The instruction is committed for execution. 


If all of these conditions are met, the breakpoint generates the Breakpoint debug event regardless of the following: 
° Whether the instruction passes its Condition code check. 
° The instruction type. 


If halting is allowed and EDSCR.HDE is 1, Breakpoint debug events cause entry to Debug state. 


Otherwise, if debug exceptions are: 





$ Enabled, Breakpoint debug events generate Breakpoint exceptions. 
° Disabled, Breakpoint debug events are ignored. 
Note 


The remainder of this Breakpoint exceptions section, including all subsections, describes breakpoints as generating 
Breakpoint exceptions. 


However, the behavior described also applies if breakpoints are causing entry to Debug state. 





The debug exception enable controls on page D2-2402 describes the enable controls for Breakpoint debug events. 


Breakpoint types and linking of breakpoints 


Each implemented breakpoint is one of the following: 


s A context-aware breakpoint. This is a breakpoint that can be programmed to generate a Breakpoint exception 
on any one of the following: 


— An instruction address match. 

— A Context ID match, with the value held in the CONTEXTIDR_EL1. 
— A VMID match, with the VMID value held in the VTTBR_EL2. 

— Botha Context ID match and a VMID match. 


s A breakpoint that is not context-aware. These can only be programmed to generate a Breakpoint exception 
on an instruction address match. 


ID_AA64DFRO_EL1.CTX_CMPs shows how many of the implemented breakpoints are context-aware 
breakpoints. At least one implemented breakpoint must be context-aware. The context-aware breakpoints are the 
highest numbered breakpoints. 


Any breakpoint that is programmed to generate a Breakpoint exception on an instruction address match is 
categorized as an Address breakpoint. Breakpoints that are programmed to match on anything else are categorized 
as Context breakpoints. 


When a debugger programs a breakpoint to be an Address or a Context breakpoint, it must also program that 
breakpoint so that it is either: 


° Used in isolation. In this case, the breakpoint is called an Unlinked breakpoint. 
a Enabled for linking to another breakpoint. In this case, the breakpoint is called a Linked breakpoint. 


By linking an Address breakpoint and a Context breakpoint together, the debugger can create a breakpoint pair that 
only generates a Breakpoint exception ifthe PE is in a particular context when an instruction address match occurs. 
For example, a debugger might: 


1. Program breakpoint number one to be a Linked Address Match breakpoint. 


2, Program breakpoint number five to be a Linked Context ID Match breakpoint. 
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3. Link these two breakpoints together. A Breakpoint exception is only generated if both the instruction address 
matches and the Context ID matches. 


The Breakpoint Type field for a breakpoint, DBGBCR<n>_EL1.BT, controls the breakpoint type and whether the 
breakpoint is enabled for linking. If BT[0] is 1, the breakpoint is enabled for linking. 


If AArch32 state is implemented, Address breakpoints can be programmed to generate Breakpoint exceptions on 
addresses that are halfword-aligned but not word-aligned. This makes it possible to breakpoint on T32 instructions. 
See Specifving the halfword-aligned address that an Address breakpoint matches on on page D2-2424. 


Note 
Stage 1 of an AArch32 translation regimes supports two additional breakpoint types, Unlinked and Linked Address 
Mismatch breakpoints, BT == 0b0100 and BT == 0b0101. For information about these, see Chapter G2 AArch32 


Self-hosted Debug. These types are reserved in stage 1 of an AArch64 translation regime. See Reserved BT values 
on page D2-2427. 





Rules for linking breakpoints 
The rules for breakpoint linking are as follows: 
7 Only Linked breakpoint types can be linked. 


7 Any type of Linked Address breakpoint can link to any type of Linked Context breakpoint. The Linked 
Breakpoint Number field, DBGBCR<n>_EL1.LBN, for the Linked Address breakpoint specifies the 
particular Linked Context breakpoint that the Linked Address breakpoint links to, and: 


—  DBGBCR<n>_EL1.{SSC, HMC, PMC} for the Linked Address breakpoint define the execution 
conditions that the breakpoint pair generates Breakpoint exceptions for. See Execution conditions for 
which a breakpoint generates Breakpoint exceptions on page D2-2422. 


—  DBGBCR<n>_EL1.{SSC, HMC, PMC} for the Linked Context breakpoint are ignored. 


$ Linked Context breakpoint types can only be linked to. The LBN field for Context breakpoints is therefore 
ignored. 


° Linked Address breakpoints cannot link to watchpoints. The LBN field can therefore only specify another 
breakpoint. 


è If a Linked Address breakpoint links to a breakpoint that is not context-aware, the behavior of the Linked 
Address breakpoint is CONSTRAINED UNPREDICTABLE. See Other usage constraints for Address breakpoints 
on page D2-2429. 


s Ifa Linked Address breakpoint links to an Unlinked Context breakpoint, the Linked Address breakpoint 
never generates any Breakpoint exceptions. 


° Multiple Linked Address breakpoints can link to a single Linked Context breakpoint. 





Note 


Multiple Linked watchpoints can also link to a single Linked Context breakpoint. Watchpoint exceptions on 
page D2-2431 describes watchpoints. 





These rules mean that a single Linked Context breakpoint might be linked to by all, or any combination of, the 
following: 


° Multiple Linked Address Match breakpoints. 
. Multiple Linked watchpoints. 


Note 


If ARMv8.4-NV is implemented, the hypervisor must use the 0b1101, Linked CONTEXTIDR_EL2 Match 
breakpoint type to guarantee a linked match, see Interaction with self-hosted and External debug on page D5-2620. 
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It is also possible that a Linked Context breakpoint might have no breakpoints or watchpoints linked to it. 


Figure D2-1 shows an example of permitted breakpoint and watchpoint linking. 
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Figure D2-1 The role of linking in Breakpoint and Watchpoint exception generation 


In Figure D2-1, each Linked Address breakpoint can only generate a Breakpoint exception if the comparisons made 
by both it, and the Linked Context breakpoint that it links, to are successful. Similarly, each Linked watchpoint can 
only generate a Watchpoint exception if the comparisons made by both it, and the Linked Context breakpoint that 
it links to, are successful. 


Breakpoint types defined by DBGBCRn_EL1.BT 


The following list provides more detail about each breakpoint type: 


0b0000, Unlinked Address Match breakpoint 


D2-2416 


Generation of a Breakpoint exception depends on both: 


s DBGBCR<n>_EL1.{SSC, HMC, PMC}. These define the execution conditions for which 
the breakpoint generates Breakpoint exceptions. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page D2-2422. 


° A successful address match, as described in Breakpoint instruction address comparisons on 
page D2-2424. 


DBGBCR<n>_EL1.LBN for this breakpoint is ignored. 
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0b0001, Linked Address Match breakpoint 


Generation of a Breakpoint exception depends on all of the following: 


° DBGBCR<n>_EL1.{SSC, HMC, PMC} for this breakpoint. These define the execution 
conditions that the breakpoint generates Breakpoint exceptions for. See Execution conditions 
for which a breakpoint generates Breakpoint exceptions on page D2-2422. 


° A successful address match defined by this breakpoint, as described in Breakpoint instruction 
address comparisons on page D2-2424. 

° A successful context match defined by the Linked Context breakpoint that this breakpoint 
links to. 


DBGBCR<n>_EL1.LBN for this breakpoint selects the Linked Context breakpoint that this 
breakpoint links to. 


0b0010, Unlinked Context ID Match breakpoint 


BT == 0b0010 is a reserved value if the breakpoint is not a context-aware breakpoint. 
For context-aware breakpoints, generation of a Breakpoint exception depends on both: 


è DBGBCR<n>_EL1.{SSC, HMC, PMC}. These define the execution conditions for which 
the breakpoint generates Breakpoint exceptions. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page D2-2422. 


` A successful Context ID match, as described in Breakpoint context comparisons on 
page D2-2425. 


The value of DBGBVR<n>_EL1.ContextID is compared with the current Context ID. 


CONTEXTIDR_EL2 holds the current Context ID when all of: 

s The implementation includes ARMv8.1-VHE. 

: EL2 is implemented and enabled in the current Security state. 

. EL2 using AArch64 and HCR_EL2.E2H is set to 1. 

s The PE is executing at ELO and HCR_EL2.TGE is 1, or the PE is executing at EL2. 
Otherwise, CONTEXTIDR_EL1 holds the current Context ID. 


DBGBCR<n>_EL1.{LBN, BAS} for this breakpoint are ignored 


0b0011, Linked Context ID Match breakpoint 


BT == 0b0011 is a reserved value if the breakpoint is not a context-aware breakpoint. 
For context-aware breakpoints, one of the following applies: 


à If no Linked breakpoints or Linked watchpoints link to this breakpoint, then the breakpoint 
does not generate any Breakpoint exceptions. 


° Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address breakpoint that 
links to this breakpoint, see Breakpoint instruction address comparisons on 
page D2-2424. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page D2-2425. 


° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page D2-2436. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page D2-2425. 


The value of DBGBVR<n>_EL1.ContextID is compared with the current Context ID. 
CONTEXTIDR_EL2 holds the current Context ID when all of: 
$ The implementation includes ARMv8.1-VHE. 


G EL2 is implemented and enabled in the current Security state. 
- EL2 using AArch64 and HCR_EL2.E2H is set to 1. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D2-2417 


Non-Confidential 


AArch64 Self-hosted Debug 
D2.9 Breakpoint exceptions 


a The PE is executing at ELO and HCR_EL2.TGE is 1, or the PE is executing at EL2. 
Otherwise, CONTEXTIDR_EL1 holds the current Context ID. 
DBGBCR<n>_EL1.{LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


0b0100, Unlinked Address Mismatch breakpoint 


BT == 0b0100 is a reserved value in stage 1 of an AArch64 translation regime. See Reserved BT 
values on page D2-2427. 


0b0100, Unlinked Address Mismatch breakpoint on page G2-5633 describes the behavior of 
Address Mismatch breakpoints in stage 1 of an AArch32 translation regime. 


0b0101, Linked Address Mismatch breakpoint 


BT == 0b0101 is a reserved value in stage 1 of an AArch64 translation regime. See Reserved BT 
values on page D2-2427. 


0b0101, Linked Address Mismatch breakpoint on page G2-5633 describes the behavior of Address 
Mismatch breakpoints in stage 1 of an AArch32 translation regime. 


0b0110, Unlinked CONTEXTIDR_EL1 Match breakpoint 
BT == 0b0110 is a reserved value if either: 
è The breakpoint is not a context-aware breakpoint. 
. The implementation does not include ARMV8.1-VHE. 
In an implementation that includes ARMv8.1-VHE, for context-aware breakpoints, generation of a 
Breakpoint exception depends on both: 
° DBGBCR<n>_EL1.{SSC, HMC, PMC}. These define the execution conditions for which 
the breakpoint generates Breakpoint exceptions. 


` A successful Context ID match defined by this breakpoint, as described in Breakpoint context 
comparisons on page D2-2425. 


The Context ID check is made against the value in CONTEXTIDR_EL1. The value of 
DBGBVR<n>_EL1.ContextID is compared with the Context ID value held in 
CONTEXTIDR EL1. 





Note 
The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 





DBGBCR<n>_EL1.{LBN, BAS} for this breakpoint are ignored. 


0b0111, Linked CONTEXTIDR_EL1 Match breakpoint 


BT == 0b0111 is a reserved value if either: 
è The breakpoint is not a context-aware breakpoint. 
. The implementation does not include ARMV8.1-VHE. 


In an implementation that includes ARMv8.1-VHE, for context-aware breakpoints, one of the 
following applies: 


. If no Linked breakpoints or Linked watchpoints link to this breakpoint, then the breakpoint 
does not generate any Breakpoint exceptions. 


° Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address match 
breakpoint that links to this breakpoint, see Breakpoint instruction address 
comparisons on page D2-2424. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page D2-2425. 


° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page D2-2436. 
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— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page D2-2425. 


The Context ID check is made against the value in CONTEXTIDR_ELI. The value of 
DBGBVR<n>_EL1.ContextID is compared with the Context ID value held in 
CONTEXTIDR ELI. 

Note 

The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 








DBGBCR<n>_EL1.{LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


0b1000, Unlinked VMID Match breakpoint 
BT == 0b1000 is a reserved value if either: 
è: The breakpoint is not a context-aware breakpoint. 
. EL2 is not implemented. 
For context-aware breakpoints, generation of a Breakpoint exception depends on both: 


° DBGBCR<n>_EL1.{SSC, HMC, PMC}. These define the execution conditions for which 
the breakpoint generates Breakpoint exceptions. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page D2-2422. 


s A successful VMID match, as described in Breakpoint context comparisons on 
page D2-2425. 


DBGBCR<n>_EL1.{LBN, BAS} for this breakpoint are ignored. 


0b1001, Linked VMID Match breakpoint 
BT == 0b1000 is a reserved value if either: 
$ The breakpoint is not a context-matching breakpoint. 
. EL2 is not implemented. 
For context-aware breakpoints, one of the following applies: 


è If no Linked breakpoints or Linked watchpoints link to this breakpoint, then the breakpoint 
does not generate any Breakpoint exceptions. 
° Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address Match 
breakpoint that links to this breakpoint. See Breakpoint instruction address 
comparisons on page D2-2424. 


— A successful VMID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page D2-2425. 


° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page D2-2436. 


— A successful VMID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page D2-2425. 


DBGBCR<n>_EL1.{LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


0b1010, Unlinked Context ID and VMID Match breakpoint 
BT == 0b1010 is a reserved value if either: 
° The breakpoint is not a context-aware breakpoint. 
. EL2 is not implemented. 
When EL2 is implemented, for context-aware breakpoints, generation of a Breakpoint exception 


depends on all of the following: 


: DBGBCR<n>_EL1.{SSC, HMC, PMC}. These define the execution conditions that the 
breakpoint generates a Breakpoint exception for. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page D2-2422. 
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° A successful Context ID match, as described in Breakpoint context comparisons on 
page D2-2425. 


7 A successful VMID match. 
The value of DBGBVR<n>_EL1.ContextID is compared with CONTEXTIDR_ ELI. 


Breakpoint context comparisons on page D2-2425 describes the requirements for a successful 
Context ID match and a successful VMID match. 


DBGBCR<n>_EL1.{LBN, BAS} for this breakpoint are ignored. 


0b1011, Linked Context ID and VMID Match breakpoint 


BT == 0b1011 is a reserved value if either: 

: The breakpoint is not a context-aware breakpoint. 

. EL2 is not implemented. 

When EL2 is implemented, for context-aware breakpoints, one of the following applies: 


` If no Linked breakpoints or Linked watchpoints link to this breakpoint, then the breakpoint 
does not generate any Breakpoint exceptions. 


s Generation of a Breakpoint exception depends on all of the following: 


— A successful instruction address match, defined by a Linked Address breakpoint that 
links to this breakpoint, see Breakpoint instruction address comparisons on 
page D2-2424. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page D2-2425. 


— A successful VMID match defined by this breakpoint. 
d Generation of a Watchpoint exception depends on all of the following: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page D2-2436. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page D2-2425. 


— A successful VMID match defined by this breakpoint. 
The value of DBGBVR<n>_EL1.ContextID is compared with CONTEXTIDR_ ELI. 


Breakpoint context comparisons on page D2-2425 describes the requirements for a successful 
Context ID match and a successful VMID match by this breakpoint. 


DBGBCR<n>_EL1.{LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


0b1100, Unlinked CONTEXTIDR_EL2 Match breakpoint 


D2-2420 


BT == 0b1100 is a reserved value if either: 
z The breakpoint is not a context-aware breakpoint. 
- The implementation does not include ARMVv8.1-VHE. 


In an implementation that includes ARMv8.1-VHE, for context-aware breakpoints, generation of a 
Breakpoint exception depends on both: 


° DBGBCR<n>_EL1.{SSC, HMC, PMC}. These define the execution conditions for which 
the breakpoint generates Breakpoint exceptions. 


è A successful CONTEXTIDR_EL2 match, as described in Breakpoint context comparisons 
on page D2-2425. 


The Context ID check is made against the value in CONTEXTIDR_EL2. The value of 
DBGBVR<n>_EL1 is compared with the Context ID value held in CONTEXTIDR_EL2. 


——— Note 
The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 


DBGBCR<n>_EL1.{LBN, BAS} for this breakpoint are ignored. 
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0b1101, Linked CONTEXTIDR_EL2 Match breakpoint 
BT == 0b1101 is a reserved value if either: 
d The breakpoint is not a context-aware breakpoint. 
$ The implementation does not include ARMv8.1-VHE. 
In an implementation that includes ARMv8.1-VHE, for context-aware breakpoints, either: 


s If no Linked breakpoints or Linked watchpoints link to this breakpoint, then the breakpoint 
does not generate any Breakpoint exceptions. 
° Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address match 
breakpoint that links to this breakpoint, see Breakpoint instruction address 
comparisons on page D2-2424. 


— A successful CONTEXTIDR_EL2 match, as described in Breakpoint context 
comparisons on page D2-2425. 


° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page D2-2436. 

— A successful CONTEXTIDR_EL2 match, as described in Breakpoint context 
comparisons on page D2-2425. 


The Context ID check is made against the value in CONTEXTIDR_EL2. The value of 
DBGBVR<n>_EL]1 is compared with the Context ID value held in CONTEXTIDR_EL2. 


Note 
The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 








DBGBCR<n>_EL1.{LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


0b1110, Unlinked Full Context ID Match breakpoint 
BT == 0b1110 is a reserved value if either: 


: The breakpoint is not a context-aware breakpoint. 
° The implementation does not include ARMv8.1-VHE. 


In an implementation that includes ARMv8.1-VHE, for context-aware breakpoints, generation of a 
Breakpoint exception depends on both: 


° DBGBCR<n>_EL1.{SSC, HMC, PMC}. These define the execution conditions for which 
the breakpoint generates Breakpoint exceptions. 

: A successful Context ID match, as described in Breakpoint context comparisons on 
page D2-2425. 


The Context ID check is made against the values in both CONTEXTIDR_EL1 and 
CONTEXTIDR _EL2. The value of DBGBVR<n>_EL1[31:0] is compared with the Context ID 
value held in CONTEXTIDR_EL1, and the value of DBGBVR<n>_EL1[63:32] is compared with 
the Context ID value held in CONTEXTIDR_EL2. Both comparisons must match for the Context 
ID check. 


— Note 
The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 





DBGBCR<n>_EL1.{LBN, BAS} for this breakpoint are ignored. 


0b1111, Linked Full Context ID Match breakpoint 


BT == 0b1111 is a reserved value if either: 
s The breakpoint is not a context-aware breakpoint. 
ë The implementation does not include ARMv8.1-VHE. 
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In an implementation that includes ARMv8.1-VHE, for context-aware breakpoints, one of the 
following applies: 


è If no Linked breakpoints or Linked watchpoints link to this breakpoint, then the breakpoint 
does not generate any Breakpoint exceptions. 


° Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address match 
breakpoint that links to this breakpoint, see Breakpoint instruction address 
comparisons on page D2-2424. 


— A successful Context ID match, as described in Breakpoint context comparisons on 
page D2-2425. 


° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page D2-2436. 


— A successful Context ID match, as described in Breakpoint context comparisons on 
page D2-2425. 


The Context ID check is made against the values in both CONTEXTIDR_EL1 and 
CONTEXTIDR_EL2. The value of DBGBVR<n>_EL1[31:0] is compared with the Context ID 
value held in CONTEXTIDR_EL1, and the value of DBGBVR<n>_EL1[63:32] is compared with 
the Context ID value held in CONTEXTIDR_EL2. Both comparisons must match for the Context 
ID check. 


Note 
The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 








DBGBCR<n>_EL1.{LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


See Reserved DBGBCR<n>_EL1.BT values on page D2-2427 for the behavior of breakpoints programmed with 
reserved BT values. 





D2.9.3 Execution conditions for which a breakpoint generates Breakpoint exceptions 


Each breakpoint can be programmed so that it only generates Breakpoint exceptions for certain execution 
conditions. For example, a breakpoint might be programmed to generate Breakpoint exceptions only when the PE 
is executing at ELO in Secure state. 


DBGBCR<n>_EL1.{SSC, HMC, PMC} defines the execution conditions the breakpoint generates Breakpoint 
exceptions for, as follows: 


Security State Control, SSC 


Controls whether the breakpoint generates Breakpoint exceptions only in Secure state, only in 
Non-secure state, or in both Security states. 
Note 


This is determined by the Security state of the PE, not from the NS attribute returned by the 
translation of the virtual address on which the breakpoint is set. 








Higher Mode Control, HMC, and Privileged Mode Control, PMC 


HMC and PMC together control which Exception levels the breakpoint generates Breakpoint 
exceptions in. 


Table D2-9 on page D2-2423 shows the valid combinations of the values of HMC, SSC, and PMC, and for each 
combination shows which Exception levels breakpoints generate Breakpoint exceptions in. 


D2-2422 
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Y Means that a breakpoint programmed with the values of HMC, SSC, and PMC shown in that row 
can generate Breakpoint exceptions in that Exception level and Security state. 


- Means that a breakpoint programmed with the values of HMC, SSC, and PMC shown in that row 


cannot generate Breakpoint exceptions in that Exception level and Security state. 


For information about which combinations of HMC, SSC and PMC are reserved if an Exception level or Security 


state are not implemented or enabled, see Reserved DBGBCR<n>_EL1.{SSC, HMC, PMC} values on 


page D2-2427. 


Table D2-9 Summary of breakpoint HMC, SSC, and PMC encodings 





























































































































HMC SSC PMC Security state | EL3a EL2 EL1 ELO 
0 00 01 Both - - Y - 
0 00 10 - - - 
0 00 11 - - Y Y 
0 01 01 Non-secure n/a - - 
0 01 10 n/a - - 
0 01 11 n/a - Y 
0 10 01 Secure - - - 
0 10 10 - - - 
0 10 11 = Š Y 
0 11 00 Secure - Y - - 
0 11 01 - Y Y - 
0 11 11 - Y Y Y 
1 00 01 Both Y Y - 
1 00 11 Y Y Y 
1 01 00 Non-secure n/a Y - - 
1 01 01 n/a Y Y - 
1 01 11 n/a Y Y 
1 10 00 Secure - - - 
1 10 01 Y Y - 
1 10 11 Y Y 
1 11 00 Both - Y - - 
1 11 01 - Y z 
1 11 11 - Y Y Y 
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D2.9.4 


D2-2424 


a. Debug exceptions are not generated at EL3 using AArch64. This means that 
these combinations of HMC, SSC, and PMC are only relevant if breakpoints 
cause entry to Debug state. Self-hosted debuggers must avoid combinations 
of HMC, SSC, and PMC that generate Breakpoint exceptions at EL3 using 
AArch64. 


All combinations of HMC, SSC, and PMC that this table does not show are reserved. See Reserved 
DBGBCR<n>_EL1.{SSC, HMC, PMC} values on page D2-2427. 


Breakpoint instruction address comparisons 


In this subsection, the term maxAddressSize represents the maximum supported virtual address size, which is 52 bits 
in an implementation that includes ARMv8.2-LVA and uses the 64KB translation granule, and 48 bits otherwise. 


An address comparison is successful if bits [maxAddressSize:2] of the current instruction virtual address are equal 
to DBGBVR<n>_EL1[maxAddressSize:2]. 





Note 


DBGBVR<n>_EL1 is a 64-bit register. The most significant bits of this register are sign-extension bits. 
DBGBVR<n>_EL1[1:0] are RESO and are ignored. 





If EL1 is using AArch64 and ELO is using AArch32, A32 and T32 instructions can be executed in stage 1 of an 
AArch64 translation regime. In this case, the instruction addresses are zero-extended before comparison with the 
breakpoint. 


Specifying the halfword-aligned address that an Address breakpoint matches on 


For Address Match breakpoints, if the implementation supports AArch32 state, a debugger must program the Byte 
Address Selection field, DBGBCR<n>_EL1.BAS. 


Table D2-10 Programmable BAS values 





BAS Match instruction at Constraint for debuggers 





0b0011 DBGBCR<n>_EL1 Use for T32 instructions. 





0b1100  DBGBCR<n> EL1 +2 Use for T32 instructions. 





0b1111  DBGBCR<n>_EL1 Use for A64 and A32 instructions. 





If the implementation is an AArch64-only implementation, all instructions are word-aligned and 
DBGBCR<n>_EL1.BAS is RES1. 


Figure D2-2 on page D2-2425 shows a summary of when Address Match breakpoints programmed with particular 
BAS values generate Breakpoint exceptions. The figure contains four parts: 


° A column showing the row number, on the left. 
° An instruction set and instruction size table. 
$ A location of instruction figure. 


7 A BAS field values table, on the right. 


To use the figure, read across the rows. For example, row 7 shows that a breakpoint with DBGBCR<n>_EL1.BAS 
programmed as either 0b0011 or @b1111 generates Breakpoint exceptions for A64 instructions. A64 instructions are 
always at word-aligned addresses. 





Note 


To breakpoint on an A64 instruction, Arm recommends that the debugger programs DBGBCR<n>_EL1.BAS as 
0b1111. 
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In the figure: 

Yes Means that the breakpoint generates a Breakpoint exception. 

No Means that the breakpoint does not generate a Breakpoint exception. 

UNP Means that is it CONSTRAINED UNPREDICTABLE whether the breakpoint generates a Breakpoint 

exception. See Other usage constraints for Address breakpoints on page D2-2429. 
Location of instruction? BAS[3:0] 
Instruction set Size -2 -1 0 +1 42 +3 +4 +5 0b0011 0b1100 0b1111 

Row 1 T32 16-bit Yes No Yes 
Row 2 16-bit No Yes UNP 
Row 3 T32 32-bit UNP No UNP 
Row 4 32-bit Yes UNP Yes 
Row 5 32-bit No Yes UNP 
Row 6 A32 32-bit Yes UNP Yes 
Row 7 A64 32-bit Yes UNP Yes 
a. 0 means the word-aligned address held in the DBGBVR<n>_EL1[maxAddressSize:2]:00. The other locations € 


-2 means ((DBGBVR<n>_EL1[maxAddressSize:2]:00) — 2). 
-1 means ((DBGBVR<n>_EL1[maxAddressSize:2]:00) — 1). 


+5 means ((DBGBVR<n>_EL1[maxAddressSize:2]:00) + 5). 


The solid areas show the location of the instruction. 


Figure D2-2 Summary of BAS field meanings for Address Match breakpoints 


D2.9.5 Breakpoint context comparisons 


The breakpoint type defined by DBGBCR<n>_EL1.BT determines what context comparison is required, if any. 
Table D2-11 shows the BT values that require a comparison, and the match required for the comparison to be 
successful. 


Table D2-11 Breakpoint Context ID and VMID comparison tests 





DBGBCR<n>.BT 


Test required for successful context comparison 























Qb001x . When ARMv8.1-VHE is implemented, EL2 is using AArch64, the Effective value of HCR_EL2.E2H 
is 1, and either the PE is executing at ELO with HCR_EL2.TGE set to 1, or the PE is executing at EL2, 
CONTEXTIDR_ EL? must match the DBGBVR<n>_EL1. ContextID value. 
. Otherwise, CONTEXTIDR_EL1 must match the DBGBVR<n>_EL1.ContextID value. 
Qb011x CONTEXTIDR_EL1 must match the DBGBVR<n>_EL1.ContextID value. 
0b100x VTTBR_EL2.VMID must match the DBGBVR<n>_EL1.VMID value. 
Qb101x CONTEXTIDR_ ELI must match the DBGBVR<n>_EL1.ContextID value and VTTBR_EL2.VMID must 
match the DBGBVR<n>_EL1.VMID value. 
Qb110x CONTEXTIDR_EL2 must match the DBGBVR<n>_EL1.ContextID2 value, DBGBVR<n>_EL1[63:32]. 
Qb111x Both: 


CONTEXTIDR_ EL! must match the DBGBVR<n>_EL1.ContextID value, DBGBVR<n>_EL1[31:0]. 


CONTEXTIDR_EL2 must match the DBGBVR<n>_EL1.ContextID2 value, 
DBGBVR<n>_EL1[63:32]. 
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No Context ID or VMID comparison is required for other valid DBGBCR<n>.BT values. 
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Context breakpoints do not generate Breakpoint exceptions when any of: 


The comparison uses the value of CONTEXTIDR_ EL! and any of: 
— The PE is executing at EL3 using AArch64. 
— The PE is executing at EL2. 


—  ARMv8.1-VHE is implemented, EL2 is using AArch64, EL2 is enabled in the current Security state, 
and HCR_EL2.{E2H, TGE} == {1, 1}. 


The comparison uses the value of CONTEXTIDR_EL2 and any of: 
—  ARMv8.1-VHE is not implemented. 


— Ifthe PE is in Secure state, and either ARMv8.4-SecEL2 is not implemented, or Secure EL2 is 
disabled. 


—  EL2 is using AArch32. 
—  EL2 is not implemented. 


The comparison uses the current VMID value and any of: 
—  EL2 is not implemented. 


— Ifthe PE is in Secure state, and either ARMv8.4-SecEL2 is not implemented, or Secure EL2 is 
disabled. 


— The PE is executing at EL2. 


—  ARMv8.1-VHE is implemented, EL2 is using AArch64, EL2 is enabled in the current Security state, 
and HCR_EL2.{E2H, TGE} == {1, 1}. 





Note 
For all Context breakpoints, DBGBCR<n>_EL1.BAS is RES! and is ignored. 
For Linked Context breakpoints, DBGBCR<n>_EL1.{LBN, SSC, HMC, PMC} are RESO and are ignored. 





Breakpoint usage constraints 


See the following sections: 


Reserved DBGBCR<n>_EL1.BT values on page D2-2427. 

Reserved DBGBCR<n>_EL1.{SSC, HMC, PMC} values on page D2-2427. 
Reserved DBGBCR<n>_EL1.BAS values on page D2-2428. 

Reserved DBGBCR<n>_EL1.LBN values on page D2-2429. 

Other usage constraints for Address breakpoints on page D2-2429. 

Other usage constraints for Context breakpoints on page D2-2429. 
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Reserved DBGBCR<n>_EL1.BT values 


Table D2-12 shows when particular DBGBCR<n>_EL1.BT values are reserved. 


Table D2-12 Reserved BT values 





BT value 


Breakpoint type Reserved 





Qb001x 


Context ID Match If the breakpoint is not context-aware 





Qb010x 


Address Mismatch In stage 1 of an AArch64 translation regime, or if EDSCR.HDE is 1 and halting is 


allowed 





Qb011x 


CONTEXTIDR_EL1 Match If ARMv8.1-VHE is not implemented, or the breakpoint is not context-aware 





Qb100x 


VMID Match If EL2 is not implemented, or the breakpoint is not context-aware 





Qb101x 


Context ID and VMID Match If EL2 is not implemented, or the breakpoint is not context-aware 





0b110x 


CONTEXTIDR_EL2 Match If ARMv8.1-VHE is not implemented, or the breakpoint is not context-aware 





Qb111x 


Full Context ID Match If ARMv8.1-VHE is not implemented, or the breakpoint is not context-aware 





If a breakpoint is programmed with one of these reserved BT values: 


` The breakpoint must behave as if it is either: 
— Disabled. 
— Programmed with a BT value that is not reserved, other than for a direct or external read of 
DBGBCR<n>_EL1. 
$ For a direct or external read of DBGBCR<n>_EL1, if the reserved BT value: 
— Has no function for any execution conditions, the value read back is UNKNOWN. 


— Has a function for execution conditions other than the current execution conditions, the value read 
back is the value written. This permits software to save and restore the BT value so that the breakpoint 
functions for the other execution conditions. 


The behavior of breakpoints with reserved BT values might change in future revisions of the architecture. For this 
reason, software must not rely on the behavior described here. 


Reserved DBGBCR<n>_EL1.{SSC, HMC, PMC} values 


Table D2-13 shows when particular combinations of DBGBCR<n>_EL1.{SSC, HMC, PMC} are reserved in 
stage 1 of an AArch64 translation regime. 


Table D2-13 Reserved HMC, SSC, and PMC combinations 





HMC, SSC, and PMC combination Reserved 





All combinations with SSC set to 0b01 or 0b10, except for the combination When EL3 is not implemented and EL2 is implemented 
with HMC set to 1, SSC set to 0b01, and PMC set to 0b00 





Any combination where HMC or SSC is nonzero, except for the When both of EL2 and EL3 are not implemented 
combination with HMC set to 1, SSC set to @b01, and PMC set to 0b0Q, or 
combinations when SSC is set to 0b11 





The combination with HMC set to 1, SSC set to @b11, and PMC set to @b00 When EL2 is not implemented 
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Table D2-13 Reserved HMC, SSC, and PMC combinations (continued) 





HMC, SSC, and PMC combination Reserved 


The combinations with SSC set to @b11 except the combination with When Secure EL2 is not implemented 
HMC set to 1, SSC set to @b11 and PMC set to 0b00 





The combination with HMC set to 1, SSC set to 0b@1 and PMC set to @b00 When Secure EL2 is not implemented 





Combinations not included in Table D2-9 on page D2-2423 Always 





D2-2428 


For all breakpoints except Linked Context breakpoints, if a breakpoint is programmed with one of these reserved 
combinations: 


. If the reserved combination has a function for other execution conditions: 
— The breakpoint must behave as if it is disabled. 


— A direct or external read of DBGBCR<n>_EL1.{SSC, HMC, PMC} returns the values written. This 
means that software can save and restore the combination so that the breakpoint can function for the 
other execution conditions. 


. If the reserved combination does not have a function for other execution conditions: 


— It must behave either as if it is programmed with a combination that is not reserved or as if it is 
disabled. 


— A direct or external read of DBGBCR<n>_EL1.{SSC, HMC, PMC} returns UNKNOWN values. 
If the breakpoint is a Linked Context breakpoint, then: 
. The values of HMC, SSC, and PMC are ignored. 
` A direct or external read of DBGBCR<n>_EL1.{SSC, HMC, PMC} returns UNKNOWN values 


The behavior of breakpoints with reserved combinations of HMC, SSC, and PMC might change in future revisions 
of the architecture. For this reason, software must not rely on the behavior described here. 


Reserved DBGBCR<n>_EL1.BAS values 
In an AArch64-only implementation, DBGBCR<n>_EL1.BAS for all breakpoints is RES1. 
Otherwise: 


For all Context breakpoints 
DBGBCR<n>_EL1.BAS is RES! and is ignored. 


For all Address breakpoints 
Table D2-10 on page D2-2424 gives the valid values of the DBGBCR<n>_EL1.BAS field. 


If a breakpoint is programmed with a reserved BAS value: 


s The breakpoint must behave as if it is either: 
— Disabled. 


— Programmed with a BAS value that is not reserved, other than for a direct or external read of 
DBGBCR<n>_EL1. 


: A direct or external read of DBGBCR<n>_EL1.BAS returns an UNKNOWN value. 


Software must not rely on these properties as the behavior of reserved values might change in a future revision of 
the architecture. 
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Reserved DBGBCR<n>_EL1.LBN values 


For all Context breakpoints 


DBGBCR<n>_EL1.LBN reads UNKNOWN and its value is ignored. 


For Linked Address breakpoints 


A Linked Address breakpoint must link to a context-aware breakpoint. For a Linked Address 
breakpoint, any DBGBCR<n>_EL1.LBN value that is not for a context-aware breakpoint is 
reserved. 


If a Linked Address breakpoint links to a breakpoint that is not implemented, or that is not 
context-aware, then reads of DBGBCR<n>_EL1.LBN return an unknown value and behavior is 
CONSTRAINED UNPREDICTABLE. The Linked Address breakpoint behaves as if it is either: 


° Disabled. 
s Linked to an UNKNOWN context-aware breakpoint. 


Ifa Linked Address breakpoint links to a breakpoint that is implemented and that is context-aware, 
but that is either not enabled or not programmed as a Linked Context breakpoint, it behaves as if it 
is disabled. 

For Unlinked Address breakpoints 
DBGBCR<n>_EL1.LBN reads UNKNOWN and its value is ignored. 


Other usage constraints for Address breakpoints 


For all Address breakpoints 
. DBGBVR<n>_EL1[1:0] are RESO and are ignored. 
a If the implementation supports AArch32 state: 


— For 32-bit instructions, if a breakpoint matches on the address of the second halfword 
but not the address of the first halfword, it is CONSTRAINED UNPREDICTABLE whether 
the breakpoint generates a Breakpoint exception. 


— If DBGBCR<n>.BAS is 0b1111, it is CONSTRAINED UNPREDICTABLE whether the 
breakpoint generates a Breakpoint exception for a T32 instruction starting at address 
((DBGBVR<n>[48:2]:00) + 2). For T32 instructions, Arm recommends that the 
debugger programs the BAS field with either @b0011 or 0b1100. 


Other usage constraints for Context breakpoints 


For all Context breakpoints 


Any bits of DBGBVR<n>_EL] that are not used to specify Context ID or VMID are RESO and are 
ignored. 


For Linked Context breakpoints 


If no Linked Address breakpoints or Linked watchpoints link to a Linked Context breakpoint, the 
Linked Context breakpoint does not generate any Breakpoint exceptions. 


Preferred return address 


The preferred return address of a Breakpoint exception is the address of the instruction that was not executed 
because the PE took the Breakpoint exception instead. 


This means that the preferred return address is the address of the instruction that caused the exception. 


Pseudocode description of Breakpoint exceptions taken from AArch64 state 


AArch64.BreakpointValueMatch() tests the value in DBGBVR<n>_EL1. 
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AArch64.StateMatch() tests the values in DBGBCR<n>_EL1.{SSC, HMC, PMC} and, if the breakpoint links to a 
Linked Context breakpoint, also tests the Linked Context breakpoint. 


For a watchpoint, AArch64.StateMatch() tests the values in DBGWCR<n>_EL1.{SSC, HMC, PAC} and, if the 
watchpoint links to a Linked Context breakpoint, also tests the Linked Context breakpoint. 


AArch64.BreakpointMatch() tests a committed instruction against all breakpoints. 
AArch64.CheckBreakpoint() generates a Breakpoint exception if all of the following are true: 


$ MDSCR_EL1.MDE is 1. 


° Debug exceptions are enabled from the current Exception level and Security state. See Enabling debug 
exceptions from the current Exception level on page D2-2405. 


$ All of the conditions required for Breakpoint exception generation are met. See About Breakpoint exceptions 
on page D2-2413. 


Note 
AArch64.CheckBreakpoint() might halt the PE and cause it to enter Debug state. External debug uses Debug state. 





AArch64.BreakpointException() is called to generate a Breakpoint exception. 


These functions are defined in Chapter J1 Armv8 Pseudocode. 
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D2.10 Watchpoint exceptions 


This section describes Watchpoint exceptions in stage 1 of an AArch64 translation regime. 


The PE is using an AArch64 translation regime when it is executing either: 
è In an Exception level that is using AArch64. 
$ At ELO using AArch32 when EL1 is using AArch64. 


This section contains the following subsections: 


. About Watchpoint exceptions. 

i Watchpoint types and linking of watchpoints on page D2-2432. 

. Execution conditions for which a watchpoint generates Watchpoint exceptions on page D2-2433. 
G Watchpoint data address comparisons on page D2-2436. 

. Determining the memory location that caused a Watchpoint exception on page D2-2439. 

- Watchpoint behavior on other instructions on page D2-2440. 

s Watchpoint usage constraints on page D2-2441. 

. Exception syndrome information and preferred return address on page D2-2443. 


: Pseudocode description of Watchpoint exceptions taken from AArch64 state on page D2-2444. 


D2.10.1 About Watchpoint exceptions 


ARM DDI 0487E.a 
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A watchpoint is an event that results from the execution of an instruction, based on a data address. Watchpoints are 
also known as data breakpoints. 


A watchpoint operates as follows: 


1. A debugger programs the watchpoint with a data address, or a data address range. 
2. The watchpoint generates a Watchpoint debug event on an access to the address, or any address in the address 
range. 


A watchpoint never generates a Watchpoint debug event on an instruction fetch. 


An implementation can include between 2-16 watchpoints. In an implementation, ID AA64DFRO_EL1.WRPs 
shows how many are implemented. 


To use an implemented watchpoint, a debugger programs the following registers for the watchpoint: 


à The Watchpoint Control Register, DBGWCR<n>_EL1. This contains controls for the watchpoint, for 
example an enable control. 


° The Watchpoint Value Register, DBGWVR<n>_EL1. This holds the data virtual address used for watchpoint 
matching. 


These registers are numbered, so that: 
$ DBGWCR1_EL1 and DBGWVR1_EL1 are for watchpoint number one. 
è DBGWCR2_EL2 and DBGWVR2_ELl1 are for watchpoint number two. 


7 DBGWCR<n>_EL1 and DBGWVR<n>_EL] are for watchpoint number n. 
A watchpoint can: 


° Be programmed to generate Watchpoint debug events on read accesses only, on write accesses only, or on 
both types of access. 


s Link to a Linked Context breakpoint, so that a Watchpoint debug event is only generated if the PE is in a 
particular context when the address match occurs. 
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A single watchpoint can be programmed to match on one or more address bytes. A watchpoint generates a 
Watchpoint debug event on an access to any byte that it is watching. The number of bytes a watchpoint is watching 
is either: 


- One to eight bytes, provided that these bytes are contiguous and that they are all in the same naturally-aligned 
doubleword. A debugger uses the Byte Address Select field, DBGWCR<n>_EL1.BAS, to select the bytes. 
See Programming a watchpoint with eight bytes or fewer on page D2-2437. 


7 Eight bytes to 2GB, provided that both of the following are true: 
— The number of bytes is a power-of-two. 
— The range starts at an address that is aligned to the range size. 


A debugger uses the MASK field, DBGWCR<n>_EL1.MASK, to program a watchpoint with eight bytes to 
2GB. See Programming a watchpoint with eight or more bytes on page D2-2438. 


A debugger must use either the BAS field or the MASK field. If it uses both, whether the watchpoint generates 
Watchpoint debug events is CONSTRAINED UNPREDICTABLE. See Programming dependencies of the BAS and MASK 


fields on page D2-2442. 


For each memory access, all of the watchpoints are tested. When a watchpoint is tested, it generates a Watchpoint 
debug event if all of the following are true: 


s The watchpoint is enabled. That is, the watchpoint enable control for it, DBGWCR<n>_EL1.Ẹ, is 1. 
è The conditions specified in the DBGWCR<n>_EL1 are met. 
° The comparison with the address held in the DBGWVR<n>_EL1 is successful. 


° If the watchpoint links to a Linked Context breakpoint, the comparison or comparisons made by the Linked 
Context breakpoint also are successful. See Figure D2-1 on page D2-2416. See also Breakpoint context 
comparisons on page D2-2425. 


7 The instruction that initiates the memory access is committed for execution. 
° The instruction that initiates the memory access passes its Condition code check. 
If halting is allowed and EDSCR.HDE is 1, Watchpoint debug events cause entry to Debug state. 


Otherwise, if debug exceptions are: 


: Enabled, Watchpoint debug events generate Watchpoint exceptions. 
° Disabled, Watchpoint debug events are ignored. 
Note 





The remainder of this Watchpoint Exceptions section, including all subsections, describes watchpoints as generating 
Watchpoint exceptions. 


However, the behavior described also applies if watchpoints are causing entry to Debug state. 





The debug exception enable controls on page D2-2402 describes the enable controls for Watchpoint debug events. 


Watchpoint types and linking of watchpoints 


When a debugger programs a watchpoint, it must program that watchpoint so that it is either: 
è Used in isolation. In this case, the watchpoint is called an Unlinked watchpoint. 
: Enabled for linking to a Linked Context breakpoint. In this case, the watchpoint is called a Linked watchpoint. 


When a Linked watchpoint links to a Linked Context breakpoint, the Linked watchpoint only generates a 
Watchpoint exception if the PE is in a particular context when the data address match occurs. For example, a 
debugger might: 


l. Program watchpoint number one with a data address. 


2; Program breakpoint number five to be a Linked VMID Match breakpoint. 
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3. Link the watchpoint and the breakpoint together. A Watchpoint exception is only generated if both the data 
address matches and the VMID matches. 


The Watchpoint Type field for a watchpoint, DBGWCR<n>_EL1.WT, controls whether the watchpoint is enabled 
for linking. If DBGWCR<n>_EL1.WT is 1, the watchpoint is enabled for linking. 


Rules for linking watchpoints 
The rules for watchpoint linking are as follows: 
7 Only Linked watchpoints can be linked. 


a A Linked watchpoint can link to any type of Linked Context breakpoint. The Linked Breakpoint Number 
field, DBGWCR<n>_EL1.LBN, for the Linked watchpoint specifies the particular Linked Context 
breakpoint that the Linked watchpoint links to, and: 


—  DBGWCR<n>_EL1.WT.{SSC, HMC, PAC} for the Linked watchpoint defines the execution 
conditions that the watchpoint generates Watchpoint exceptions for. See Execution conditions for 
which a watchpoint generates Watchpoint exceptions. 


—  DBGBCR<n>_EL1.{SSC, HMC, PMC} for the Linked Context breakpoint are ignored. 


$ A Linked watchpoint cannot link to another watchpoint. The LBN field can therefore only specify a 
breakpoint. 


7 Ifa Linked watchpoint links to a breakpoint that is not context-aware, the behavior of the Linked watchpoint 
is CONSTRAINED UNPREDICTABLE. See Watchpoint usage constraints on page D2-2441. 


è Ifa Linked watchpoint links to an Unlinked Context breakpoint, the Linked watchpoint never generates any 
Watchpoint exceptions. 


: Multiple Linked watchpoints can link to a single Linked Context breakpoint. 


Note 


Multiple Address breakpoints can also link to a single Linked Context breakpoint. Breakpoint exceptions on 
page D2-2413 describes breakpoints. 








Figure D2-1 on page D2-2416 shows an example of permitted watchpoint linking. 


D2.10.3 Execution conditions for which a watchpoint generates Watchpoint exceptions 


Each watchpoint can be programmed so that it only generates Watchpoint exceptions for certain execution 
conditions. For example, a watchpoint might be programmed to generate Watchpoint exceptions only when the PE 
is executing at EL2 in Non-secure state. 


DBGWCR<n>_EL1.{SSC, HMC, PAC} define the execution conditions a watchpoint generates Watchpoint 
exceptions for, as follows: 
Security State Control, SSC 
Controls whether the watchpoint generates Watchpoint exceptions only in Secure state, only in 
Non-secure state, or in both Security states. 
Note 


This is determined by the Security state of the PE, not from the NS attribute returned by the 
translation of the virtual address on which the watchpoint is set. 








Higher Mode Control, HMC, and Privileged Access Control, PAC 


HMC and PAC together control which Exception levels the watchpoint generates Watchpoint 
exceptions in. 


The PAC control relates to the privilege of the memory access, not to the Exception level at which 
the access was made. 
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Note 


This means that, if the PE executes a Load unprivileged or Store unprivileged instruction at EL1, 
the resulting data access triggers a watchpoint only if both: 





s PAC is programmed to a value that generates watchpoints on ELO accesses. 
: All other conditions for generating the watchpoint are met. 


Example A64 Load unprivileged and Store unprivileged instructions are LDTR and STTR. 





Table D2-14 shows the valid combinations of HMC, SSC, and PAC, and for each combination shows which 
Exception levels watchpoints generate Watchpoint exceptions in. 


In the table: 


Yor- Means that a watchpoint programmed with the values of HMC, SSC, and PAC shown in that row: 
Y Can generate Watchpoint exceptions in that Exception level and Security state. 
- Cannot generate Watchpoint exceptions in that Exception level and Security state. 


For information about which combinations of HMC, SSC and PMC are reserved if an Exception level or Security 
state are not implemented or enabled, see Reserved DBGWCR<n>_EL1.{SSC, HMC, PAC} values on 
page D2-2441. 


Table D2-14 Summary of watchpoint HMC, SSC, and PAC encodings 


































































































HMC SSC PAC Security state | EL3a EL2 EL1 ELO 

0 00 01 Both - - Y - 

0 00 10 - - - 

0 00 11 - - 

0 01 01 Non-secure n/a - Y - 

0 01 10 n/a - - 

0 01 11 n/a - 

0 10 01 Secure - - Y - 

0 10 10 - z - 

0 10 11 - - Y Y 

0 11 00 - Y - - 

0 11 01 - Y Y - 

0 11 11 - Y Y Y 

1 00 01 Both Y Y - 

1 00 11 Y Y Y Y 

1 01 00 Non-secure n/a Y - - 

1 01 01 n/a Y - 

1 01 11 n/a Y Y 
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Table D2-14 Summary of watchpoint HMC, SSC, and PAC encodings (continued) 





























HMC SSC PAC Security state | EL3a EL2 EL1 ELO 
1 10 00 Secure Y - - - 

1 10 01 Y - 

1 10 11 Y Y Y Y 

1 11 00 Both - Y - - 

1 11 01 - Y Y - 

1 11 11 - Y Y Y 

















a. Debug exceptions are not generated at EL3 using AArch64. This means that 
these combinations of HMC, SSC, and PAC are only relevant if watchpoints 
cause entry to Debug state. Self-hosted debuggers must avoid combinations 
of HMC, SSC, and PMC that generate Watchpoint exceptions at EL3 using 


AArch64. 


All combinations of HMC, SSC, and PAC that this table does not show are reserved. See Reserved 


DBGWCR<n>_EL1.{SSC, HMC, PAC} values on page D2-2441. 
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Watchpoint data address comparisons 


In this subsection, the term AddrTop represents the most significant bit of a virtual address used by watchpoint data 
address comparisons. AddrTop is: 


$ 55, if address tagging is used for the address. See Address tagging in AArch64 state on page D5-2506. 
° 63, otherwise. 


Note 


When stage 1 translation is enabled, in AArch64 state, a virtual address has a maximum address width of either 48 
bits or, when ARMv8.2-LVA is implemented and the 64KB translation granule is used, 52 bits. Software can 
configure a smaller address width for a virtual address. See /nput address size on page D5-2521. Attempting to 
translate an address that is larger than the configured input address size generates a Translation fault. 





When stage | translation is disabled, using an address that is larger than the implemented PA size generates an 
Address size fault. The implemented PA size is IMPLEMENTATION DEFINED up to 52 bits. See Physical address size 
on page D5-2520. 


These faults have a higher priority than watchpoints. 





An address comparison is successful if bits [AddrTop:2] of the current data address are equal to 
DBGWVR<n>_EL1[AddrTop:2], taking into account all of the following: 


è The size of the access. See Size of the data access. 


If EL1 is using AArch64 and ELO is using AArch32, AArch32 instructions can be executed in stage 1 of an 
AArch64 translation regime. In this case, data addresses are zero-extended before comparison with the 
watchpoint. 


° The bytes selected by DBGWVR<n>_EL1.BAS. See Programming a watchpoint with eight bytes or fewer 
on page D2-2437. 


è Any address ranges indicated by DBGWVR<n>_EL1.MASK. See Programming a watchpoint with eight or 
more bytes on page D2-2438. 


Note 
è DBGWVR<n>_EL]1 is a 64-bit register. The most significant bits of this register are sign-extension bits. 
. DBGWVR<n>_EL1[1:0] are RESO and are ignored 





Size of the data access 
Because watchpoints can be programmed to generate Watchpoint exceptions on individual bytes, the size of each 


data access must be taken into account. See Example D2-1. 


Example D2-1 


1. A debugger programs a watchpoint to generate Watchpoint exceptions only when the byte at address 0x1009 
is accessed. 


2. The PE accesses the unaligned doubleword starting at address 0x1003. 


In this scenario, the watchpoint must generate a Watchpoint exception. 


The size of data accesses initiated by DC ZVA instructions is the DC ZVA block size that DCZID_ELO.BS defines. 


The size of data accesses initiated by DC IVAC instructions is an IMPLEMENTATION DEFINED size that is both: 
° From the inclusive range between: 
— The size that CTR_EL0.DminLine defines. 
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—  2KB. 
i A power-of-two. 


For both of these instructions: 
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. The lowest address accessed by the instruction is the address supplied to the instruction, rounded down to the 


nearest multiple of the access size initiated by that instruction. 


. The highest address accessed is (size - 1) bytes above the lowest address accessed. 


See also, Watchpoint behavior on accesses by the DC IVAC instruction and the DC ZVA instruction on 


page D2-2441. 


Programming a watchpoint with eight bytes or fewer 


The Byte Address Select field, DBGWCR<n>_EL1.BAS, selects which bytes in the doubleword starting at the 
address contained in the DBGWVR<n>_EL1 the watchpoint generates Watchpoint exceptions for. 


If the address programmed into the DBGWVR<n>_ EL] is: 


. Doubleword-aligned: 


—  Alleight bits of DBGWCR<n>_EL1.BAS are used, and the descriptions given in Table D2-15 apply. 


° Word-aligned but not doubleword-aligned: 


— Only DBGWCR<n>_EL1.BAS[3:0] are used, and the descriptions given in Table D2-16 apply. In this 


case, DBGWCR<n>_EL1.BAS[7:4] are RESO. 


Table D2-15 Supported BAS values when the DBGWVRn_EL1 address alignment is doubleword 
























































BAS value Description 
0b00000000 Watchpoint never generates a Watchpoint exception. 
BAS[0] == Generates a Watchpoint exception if the byte at address DBGWVR<n>_EL1[AddrTop:3]:000 is accessed. 
BAS[1] == Generates a Watchpoint exception if the byte at address DBGWVR<n>_EL1[AddrTop:3]:001 is accessed. 
BAS[2] == Generates a Watchpoint exception if the byte at address DBGWVR<n>_EL1[AddrTop:3]:010 is accessed. 
BAS[3] == Generates a Watchpoint exception if the byte at address DBGWVR<n>_EL1[AddrTop:3]:011 is accessed. 
BAS[4] == Generates a Watchpoint exception if the byte at address DBGWVR<n>_EL1[AddrTop:3]:100 is accessed. 
BAS[5] == Generates a Watchpoint exception if the byte at address DBGWVR<n>_EL1[AddrTop:3]:101 is accessed. 
BAS[6] == Generates a Watchpoint exception if the byte at address DBGWVR<n>_EL1[AddrTop:3]:110 is accessed. 
BAS[7] == Generates a Watchpoint exception if the byte at address DBGWVR<n>_EL1[AddrTop:3]:111 is accessed. 
Table D2-16 Supported BAS values when the DBGWVRn_EL1 address alignment is word 
BAS value? Description 
0b00000000 Watchpoint never generates a Watchpoint exception 
BAS[0] == Generates a Watchpoint exception if byte at address DBGWVR<n>_EL1[AddrTop:2]:00 is accessed. 
BAS[1] == Generates a Watchpoint exception if byte at address DBGWVR<n>_EL1[AddrTop:2]:01 is accessed. 
BAS[2] == Generates a Watchpoint exception if byte at address DBGWVR<n>_EL1[AddrTop:2]:10 is accessed. 
BAS[3] == Generates a Watchpoint exception if byte at address DBGWVR<n>_EL1[AddrTop:2]:11 is accessed. 





a. DBGWCR<n>_EL1.BAS[7:4] are RESO. 
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If the BAS field is programmed with more than one byte, the bytes that it is programmed with must be contiguous. 
For watchpoint behavior when its BAS field is programmed with non-contiguous bytes, see Other usage constraints 
on page D2-2443. 


When programming the BAS field with anything other than @b11111111, a debugger must program 
DBGWCR<n>_EL1.MASK to be 0b00000. See Programming dependencies of the BAS and MASK fields on 
page D2-2442. 


A watchpoint generates a Watchpoint exception whenever a watched byte is accessed, even if: 
. The access size is smaller or larger than the address region being watched. 


° The access is misaligned, and the base address of the access is not in the doubleword or word of memory 
addressed by the DBGWVR<n>_EL1[AddrTop:3]. See Example D2-1 on page D2-2436. 


The following are some example configurations of the BAS field: 


$ To program a watchpoint to generate a Watchpoint exception on the byte at address 0x1003, program: 
— DBGWVR<n>_EL1 with 0x1000. 
— DBGWCR<n>_EL1.BAS to be 0b00001000. 


s To program a watchpoint to generate a Watchpoint exception on the bytes at addresses 0x2003, 0x2004 and 
0x2005, program: 


— DBGWVR<n>_EL1 with 0x2000. 
— DBGWCR<n>_EL1.BAS to be 0b00111000. 


° If the address programmed into the DBGWVR<n>_EL1 is doubleword-aligned: 


— To generate a Watchpoint exception when any byte in the word starting at the doubleword-aligned 
address is accessed, program DBGWCR<n>_EL1.BAS to be 0b00001111. 


— To generate a Watchpoint exception when any byte in the word starting at address 
DBGWVR<n>_EL1[31:3]:100 is accessed, program DBGWCR<n>_EL1.BAS to be 0b11110000. 


Note 
Arm deprecates programming a DBGWVR<n>_EL1 with an address that is not doubleword-aligned. 








Programming a watchpoint with eight or more bytes 


A debugger can use the MASK field, DBGWCR<n>_EL1.MASK, to program a single watchpoint with a data 
address range. The range must meet all of the following criteria: 


° It is a size that is: 
— A power-of-two. 
— A minimun of eight bytes. 
— A maximum of 2GB. 


s It starts at an address that is aligned to the size. 


The MASK field specifies the number of least significant data address bits that must be masked. Up to 31 least 
significant bits can be masked: 


MASK 0b00000 No bits are masked. 
Qb00001 Reserved. 
0b00010 Reserved. 
0b00011 Three least significant bits are masked. 
0b00100 Four least significant bits are masked. 
0b00101 Five least significant bits are masked. 





0b11111 31 least significant bits are masked. 
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If n least significant address bits are masked, the watchpoint generates a Watchpoint exception on all of the 
following: 


à Address DBGWVR<n>_EL1[AddrTop:]:000... 
è Address DBGWVR<n>_EL1[AddrTop:n]:111... 
° Any address between these two addresses. 


For example, if the four least significant address bits are masked, Watchpoint exceptions are generated for all 
addresses between DBGWVR<n>_EL1[AddrTop:4]:0000 and DBGWVR<n>_EL1[AddrTop:4]:1111, including 
these addresses. 





Note 
: The 17 most significant bits cannot be masked. This means that the full address cannot be masked. 
: For watchpoint behavior when its MASK field is programmed with a reserved value, see Reserved 


DBGWCR<n>_EL1.MASK values on page D2-2443. 





When masking address bits, a debugger must both: 


` Program DBGWCR<n>_EL1.BAS to be 0b11111111. See Programming dependencies of the BAS and MASK 
fields on page D2-2442. 


° In the DBGWVR<n>_EL1, set the masked address bits to 0. For watchpoint behavior when any of the 
masked address bits are not 0, see Other usage constraints on page D2-2443. 


D2.10.5 Determining the memory location that caused a Watchpoint exception 


ARM DDI 0487E.a 
ID070919 


On taking a Watchpoint exception, the PE records an address in a Fault Address Register that the debugger can use 
to determine the memory location that triggered the watchpoint. 


The Fault Address Register (FAR) used is either: 
. FAR_EL1, if the exception is taken to EL1. 
. FAR_EL2, if the exception is taken to EL2. 


In cases where one instruction triggers multiple watchpoints, only one address is recorded. 
On entering Debug state on a Watchpoint debug event, the PE records the address in the EDWAR. 


For more information, see the subsections that follow. These are: 


s Address recorded for Watchpoint exceptions generated by instructions other than data cache maintenance 
instructions 


. Address recorded for Watchpoint exceptions generated by data cache maintenance instructions on 
page D2-2440 


Address recorded for Watchpoint exceptions generated by instructions other than data 
cache maintenance instructions 


Note 


Despite its mnemonic, the DC ZVA, Data Cache Zero by VA instruction is not a data cache maintenance instruction. 








The address recorded must be both: 


° From the inclusive range between: 
— The lowest address accessed by the memory access that triggered the watchpoint. 
— The highest watchpointed address accessed by the memory access. A watchpointed address is an 


address that the watchpoint is watching. 


: Within a naturally-aligned block of memory that is all of the following: 
— A power-of-two size. 
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— No larger than the DC ZVA block size. 
— Contains a watchpointed address accessed by the memory access. 


The size of the block is IMPLEMENTATION DEFINED. There is no architectural means of discovering the size. 


Example D2-2 Address recorded for a watchpoint programmed on 0x8019 


A debugger programs a watchpoint to generate a Watchpoint exception on any access to the byte 0x8019. 


An A32 load multiple instruction then loads nine registers starting from address 0x8004 upwards. This triggers the 
watchpoint. 


If the DC ZVA block size is: 
° 32 bytes, the address that the PE records must be between 0x8004 and 0x8019 inclusive. 
° 16 bytes, the address that the PE records must be between 0x8010 and 0x8019 inclusive. 


Address recorded for Watchpoint exceptions generated by data cache maintenance 
instructions 


The address recorded is the address passed to the instruction. This means that the address recorded might be higher 
than the address of the location that triggered the watchpoint. 


Watchpoint behavior on other instructions 


Under normal operating conditions, the following do not generate Watchpoint exceptions: 


° Instruction cache maintenance instructions. 
e Address translation instructions. 
° TLB maintenance instructions. 
à Prefetch memory instructions. 
s If the Point of Coherency is before any level of cache, it is IMPLEMENTATION DEFINED whether a DC IVAC 
instruction can generate a Watchpoint. 
. All data cache maintenance instructions except DC IVAC. 
Note 





Despite its mnemonic, the DC ZVA, Data Cache Zero by VA instruction is not a data cache maintenance instruction. 





However, the debug architecture allows for implementation defined controls, such as those in ACTLR registers, to 
enable watchpoints on an implementation defined subset of these instructions. Whether a watchpoint treats the 
instruction as a load or a store, and the access size of instruction cache, address translation, and TLB operations are 
implementation defined. 


The access size of the IMPLEMENTATION DEFINED instruction cache, address translation, and TLB operations which 
generate Watchpoint exceptions are IMPLEMENTATION DEFINED. 


See also the following subsections: 
7 Watchpoint behavior on accesses by Store-Exclusive instructions. 
à Watchpoint behavior on accesses by the DC IVAC instruction and the DC ZVA instruction on page D2-2441. 


Watchpoint behavior on accesses by Store-Exclusive instructions 
If a watchpoint matches on a data access caused by a Store-Exclusive instruction, then: 


è If the store fails because an Exclusives monitor does not permit it, it is IMPLEMENTATION DEFINED whether 
the watchpoint generates a Watchpoint exception. 


$ Otherwise, the watchpoint generates a Watchpoint exception. 
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Watchpoint behavior on accesses by the DC IVAC instruction and the DC ZVA 
instruction 


DC IVAC and DC ZVA operations are treated as data stores. This means that for a watchpoint to match on an access 
caused by one of these instructions, the debugger must program DBGWCR<n>_EL1.LSC to be one of the 
following: 

10 Match on data stores. 

11 Match on data stores and data loads. 


Note 
For the size of data accesses performed by the DC IVAC instruction and the DC ZVA instruction, see Watchpoint data 
address comparisons on page D2-2436. The size of all data accesses must be considered because watchpoints can 
be programmed to match on individual bytes. 





D2.10.7 Watchpoint usage constraints 


See the following: 

$ Reserved DBGWCR<n>_EL1.{SSC, HMC, PAC} values. 

$ Reserved DBGWCR<n>_EL1.LBN values on page D2-2442. 

: Programming dependencies of the BAS and MASK fields on page D2-2442. 
s Reserved DBGWCR<n>_EL1.BAS values on page D2-2442. 

$ Reserved DBGWCR<n>_EL1.MASK values on page D2-2443. 

7 Other usage constraints on page D2-2443. 


Reserved DBGWCR<n>_EL1.{SSC, HMC, PAC} values 


Table D2-17 shows when particular combinations of DBGWCR<n>_EL1.{SSC, HMC, PAC} are reserved. 


Table D2-17 Reserved SSC, HMC, and PAC combinations 


HMC, SSC, and PMC combination Reserved 





All combinations with SSC set to 0b01 or 0b10 except for the combination When EL3 is not implemented and EL2 is implemented. 
with HMC set to 1, SSC set to 0b01, and PMC set to @b00. 





All combinations where HMC or SSC is nonzero, except for the When both of EL2 and EL3 are not implemented. 
combination with HMC set to 1, SSC set to @b01, and PMC set to 0b00 or 
combinations with SSC set to @b11. 





The combination with HMC set to 1, SSC set to @b11, and PMC set to 0b00. When EL2 is not implemented. 





The combinations with SSC set to 0b11 except the combination with HMC When Secure EL2 is not implemented. 
set to 1, SSC set to @b11, and PMC set to @b00. 





The combination with HMC set to 1, SSC set to @b01, and PMC set to 0b00. When Secure EL2 is not implemented. 





Combinations not included in Table D2-14 on page D2-2434. Always. 
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If a watchpoint is programmed with one of these reserved combinations: 


° The watchpoint must behave as if it is either: 
— Disabled. 


— Programmed with a combination that is not reserved, other than for a direct or external read of 
DBGWCR<n>_EL1. 


5 For a direct or external read of DBGWCR<n>_EL1, if the reserved combination: 


— Has no function for any execution conditions, the value read back for each of SSC, HMC, and PMC 
is UNKNOWN. 
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— Has a function for execution conditions other than the current execution conditions, the value read 
back is the value written. This permits software to save and restore the combination so that the 
watchpoint functions for the other execution conditions. 


The behavior of watchpoints with reserved combinations of SSC, HMC, and PAC might change in future revisions 
of the architecture. For this reason, software must not rely on the behavior described here. 


Reserved DBGWCR<n>_EL1.LBN values 


For Linked Watchpoints 


A Linked watchpoint must link to a context-aware breakpoint. For a Linked watchpoint, any 
DBGWCR<n>_EL1.LBN value that is not for a context-aware breakpoint is reserved. 


If a Linked watchpoint links to a breakpoint that is not implemented, or that is not context-aware, 
then reads of DBGWCR<n>_EL1.LBN return an UNKNOWN value and the behavior is 
CONSTRAINED UNPREDICTABLE. The Linked watchpoint behaves as if it is either: 


. Disabled 
$ Linked to an UNKNOWN context-aware breakpoint. 


If a Linked watchpoint links to a breakpoint that is implemented and is context-aware, but that is 
either not enabled or not programmed as a Linked Context breakpoint, it behaves as if it is disabled. 


For Unlinked Watchpoints For Unlinked watchpoints, DBGWCR<n>_EL1.LBN reads UNKNOWN and its value is 
ignored. 


Programming dependencies of the BAS and MASK fields 
When programming a watchpoint, a debugger must use either: 
$ The MASK field, to program the watchpoint with an address range that can be eight bytes to 2GB. 


° The BAS field, to select which bytes in the doubleword or word starting at the address contained in the 
DBGWVR<n>_EL!1 the watchpoint must generate Watchpoint exceptions for. 


If the debugger uses the: 
° MASK field, it must program BAS to be 0b11111111, so that all bytes in the doubleword or word are selected. 


: BAS field, it must program MASK to be 0b00000, so that the MASK field does not indicate any address 
ranges. 


If an enabled watchpoint has a MASK field that is non-zero and a BAS field that is not set to 0b11111111, then for 
each byte in the address range, it is CONSTRAINED UNPREDICTABLE whether or not a Watchpoint exception 
is generated. 


Reserved DBGWCR<n>_EL1.BAS values 


The BAS field must be programmed with a value Zeros (8-n-m) :Ones(n) :Zeros(m), where: 


od n is a non-zero positive integer less-than-or-equal-to 8. 
a m is a positive integer less-than 8. 
° n+m is less-than-or-equal-to 8. 


All other values are reserved. 


Note 


If x is zero, then Zeros(x) is an empty bitstring. 








If DBGWVR<n>_EL1[2] is 1, DBGWCR<n>_EL1.BAS[7:4] are RESO and are ignored. 
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If a watchpoint is programmed with a reserved BAS value: 


s It is CONSTRAINED UNPREDICTABLE whether the watchpoint generates a Watchpoint exception for each byte 
in the doubleword or word of memory addressed by the DBGWVR<n>_EL1. 


è A direct or external read of DBGWCR<n>_EL1.BAS returns an UNKNOWN value. 


Software must not rely on these properties as the behavior of reserved values might change in a future revision of 
the architecture. 


Reserved DBGWCR<n>_EL1.MASK values 
If a watchpoint is programmed with a reserved MASK value: 


$ The watchpoint must behave as if it is either: 
— Disabled. 


— Programmed with an UNKNOWN value that is not reserved, that might be 0b00000, other than for a direct 
or external read of DBGWCR<n>_EL1. 


s A direct or external read of DBGWCR<n>_EL1.MASK returns an UNKNOWN value. 


Other usage constraints 


For all watchpoints: 
. DBGWVR<n>_EL1[1:0] are RESO and are ignored. 


è If DBGWCR<n>_EL1.MASK is nonzero, and any masked bits of DBGWVR<n>_EL1 are 
not 0, it is CONSTRAINED UNPREDICTABLE whether the watchpoint generates a Watchpoint 
exception when the unmasked bits match. 


a A watchpoint never generates any Watchpoint exceptions if DBGWCR<n>_EL1.LSC is 
0b00. 


D2.10.8 Exception syndrome information and preferred return address 
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See the following: 
. Exception syndrome information. 
è Preferred return address on page D2-2444. 


Exception syndrome information 
On taking a Watchpoint exception, the PE records all of the following: 


è Information about the exception in the Exception Syndrome Register (ESR_ELx) at the Exception level the 
exception is taken to. 


° An address that the debugger can use to determine the memory location that caused the exception. The PE 
records this in a Fault Address Register (FAR). 


The ESR and FAR used is either: 
s ESR_EL1 and FAR_EL1, if the exception is taken to EL1. 
. ESR_EL2 and FAR_EL2, if the exception is taken to EL2. 





Note 
Watchpoint exceptions cannot be taken to EL3 using AArch64. 





See ZSS encoding for an exception from a Watchpoint exception on page D13-2952 for more information. 
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Preferred return address 


The preferred return address of a Watchpoint exception is the address of the instruction that was not executed 
because the PE took the Watchpoint exception instead. 


This means that the preferred return address is the address of the instruction that caused the exception. 


Pseudocode description of Watchpoint exceptions taken from AArch64 state 


AArch64.WatchpointByteMatch() tests an individual byte accessed by an operation. 


AArch64.StateMatch() tests the values in DBGWCR<n>_EL1.{HMC, SSC, PAC}, and if the watchpoint is Linked, 
also tests the Linked Context breakpoint that the watchpoint links to. 


AArch64.WatchpointMatch() tests the value in DBGWVR<n>_ELI. 


AArch64.CheckWatchpoint() generates a FaultRecord that AArch64.Abort() raises a Watchpoint exception for if all of 
the following are true: 


à MDSCR_EL1.MDE is 1. 


° Debug exceptions are enabled from the current Exception level and Security state. See Enabling debug 
exceptions from the current Exception level on page D2-2405. 


: All of the conditions required for Watchpoint exception generation are met. See About Watchpoint exceptions 
on page D2-2431. 


Note 
AArch64.CheckWatchpoint() might halt the PE and cause it to enter Debug state. External debug uses Debug state. 








AArch64.WatchpointException() is called to generate a Watchpoint exception. 


These functions are defined in Chapter J1 Armv8 Pseudocode. 
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D2.11 Vector Catch exceptions 
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Vector Catch exceptions are not generated in AArch64 translation regimes. 


Note 


This means that they are never taken to EL1 using AArch64 and are only supported if at least EL1 using AArch32 
is supported. 








A debugger that is executing in EL2 using AArch64 can route Vector Catch exceptions to EL2 using AArch64. See 
Routing debug exceptions on page D2-2403. 


AArch64.VectorCatchException() is called to generate a Vector Catch exception. 


Vector Catch exceptions on page G2-5667 describes Vector Catch exceptions. 
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D2.12 Software Step exceptions 


The following subsections describe Software Step exceptions: 


$ About Software Step exceptions. 
. Rules for setting MDSCR_EL1.SS to 1. 
. The software step state machine. 


e Entering the active-not-pending state on page D2-2448. 

. Behavior in the active-not-pending state on page D2-2451. 

. Entering the active-pending state on page D2-2453. 

. Behavior in the active-pending state on page D2-2454. 

7 Stepping T32 IT instructions on page D2-2454. 

. Exception syndrome information and preferred return address on page D2-2455. 
. Additional considerations on page D2-2456. 

s Pseudocode description of Software Step exceptions on page D2-2458. 


D2.12.1 About Software Step exceptions 
Software step is an Armv8-A resource that a debugger can use to make the PE single-step instructions. 


For example, by using software step, debugger software executing at a higher Exception level can single-step 
instructions at a lower Exception level. 


Operation is as follows: 


1. A debugger: 


a. Enables software step by setting MDSCR_ELI.SS to 1. See The debug exception enable controls on 
page D2-2402. 


b. Executes an exception return instruction, ERET, to branch to the instruction to be single-stepped in the 
software being debugged. 


2 The PE then: 
a. Executes the instruction to be single-stepped. 
b. Takes a Software Step exception on the next instruction, returning control to the debugger. 


However, another exception might be generated while the instruction is being stepped. This exception is either: 
e A synchronous exception that is generated by the instruction being stepped. 
° An asynchronous exception that is taken before or after the instruction being stepped. 


The PE can only take a Software Step exception if debug exceptions are enabled from the current Exception level 
and Security state. See Enabling debug exceptions from the current Exception level on page D2-2405. 


A state machine describes the behavior of software step, shown in The software step state machine. 


Throughout this Software Step exceptions section, including in all subsections, ELp means the Exception level that 
Software Step exceptions are targeting. Routing debug exceptions on page D2-2403 defines ELp as the debug target 
Exception level. 


D2.12.2 Rules for setting MDSCR_EL1.SS to 1 


Debugger software must be executing in an Exception level and Security state that debug exceptions are disabled 
from when it sets MDSCR_EL1.SS to 1. 


The Exception level that hosts the debugger software must be using AArch64. 


D2.12.3 The software step state machine 


In Figure D2-3 on page D2-2447: 
° The OS Lock is unlocked and DoubleLockStatus() == FALSE. 
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The PE is not in Secure state with MDCR_EL3.SDD set to 1. That is, the PE is in Non-secure state, or is in 


Secure state with MDCR_EL3.SDD set to 0, or the implementation does not include EL3. 





MDSCR_EL1.SS == 0 


Execution in a 
debugger or above 


By a debugger setting 


MDSCR_ELL.SS == 1 MDSCR_EL1.SS to 1 









Execution in a 


debugger or above ; 
88 Inactive 


PSTATE.SS=0 











By ERET setting PSTATE.SS to 1 
Step completed? 
Active-not- 


pending 
PSTATE.SS=1 






By an asynchronous exception taken 
to an Exception level that debug 
exceptions are disabled from 











Step completed” 


Active-pending 
PSTATE.SS=0 


By an asynchronous exception 

taken to an Exception level that 

debug exceptions are enabled 
from 


Software Step 


exception 


Inactive 
PSTATE.SS=0 





a. The step is the PE either: 
. 


Taking an exception to an Exception level that debug exceptions are disabled from. 
. 


If execution is at ELp with MDSCR_EL1.KDE == 1, executing an instruction that sets PSTATE.D to 1. 


Execution is at either: 


e An Exception level that is higher than ELp. 


e ELp with (PSTATE.D == 1 | | MDSCR_EL1.KDE == 
0). 


This is termed execution in a debugger or above. 


To make the PE single-step an instruction, the debugger: 
1. Sets SPSR_ELX.SS to 1. 


2. Programs the ELR_ELx to point to the 
instruction to be stepped. 


3. Executes an ERET instruction. 


Execution is in the software being debugged, at either: 
e An Exception level that is lower than ELp. 


e ELp with (PSTATE.D == 0 && MDSCR_EL1.KDE == 
1). 


By ERET setting PSTATE.SS to 0° 


Execution is in the software being debugged, at either: 
e An Exception level that is lower than ELp. 


e ELp with (PSTATE.D == 0 && MDSCR_EL1.KDE == 
1). 


A Software Step exception is pending. 


Execution has returned to the debugger. 


Software step is inactive when debug exceptions are disabled from the current Exception level, and debug exceptions are disabled from ELp when PSTATE.D is 1. 


b. The step is the PE either: 


e Executing the instruction to be stepped without taking an exception. 
. 


c. Or, if execution is at ELp with MDSCR_EL1.KDE == 1, by software setting PSTATE.D to 0. 


Taking an exception to an Exception level that debug exceptions are enabled from. The Exception level might be using AArch64 or AArch32. 


Figure D2-3 Software step state machine 


For a description of when debug exceptions are enabled or disabled from an Exception level, see Enabling debug 


exceptions from the current Exception level on page D2-2405. 


For more information about how a step is completed, see Behavior in the active-not-pending state on page D2-2451. 
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The software step states are: 


Inactive Software step is inactive. It cannot generate any Software Step exceptions or affect PE execution. 
Software step is inactive whenever any of the following are true: 


° MDSCR_EL1.SS is 0. 
. ELp is using AArch32. 


° Debug exceptions are disabled from the current Exception level or Security state. 
Active-not-pending 
None of the conditions mentioned in /nactive are true, therefore software step is active. 
The current instruction is the instruction to be stepped. 
Active-pending 
None of the conditions mentioned in /nactive are true, therefore software step is active. 


A Software Step exception is pending on the current instruction. 


Whenever software step is active, whether the state machine is in the active-not pending state or the active-pending 
state depends on PSTATE.SS. Table D2-18 shows this. 


Table D2-18 State machine states 























Elpusing, Debug ereeption enable status in the MOSCRLELI.SS pstaress Siate machine 
AArch32 X Inactive 
AArch64 Disabled X Inactive 
AArch64 Enabled 0 X Inactive 
AArch64 Enabled 1 1 Active-not-pending 
AArch64 Enabled 1 0 Active-pending 
D2.12.4 Entering the active-not-pending state 

Software step can only enter the active-not-pending state from the inactive state. 

Software step: 

: Enters the active-not-pending state when an ERET instruction writes 1 to PSTATE.SS, by copying from 


D2-2448 


SPSR_ELx.SS when it restores PSTATE. 


$ Might enter the active-not-pending state on exiting Debug state when DSPSR_ELO.SS or DSPSR.SS is 1. 
See Exiting Debug state on page H2-6740. 


An ERET instruction only copies 1 from SPSR_ELx.SS to PSTATE.SS if all of the following are true: 
. MDSCR_EL1.SS is 1. 

. ELp is using AArch64. 

. Debug exceptions are disabled from the current Exception level. 

$ Debug exceptions are enabled from the Exception level that the ERET instruction targets. 


Otherwise, ERET instructions set PSTATE.SS to 0, regardless of the value of SPSR_ELx.SS. 


Table D2-19 on page D2-2449 shows this. In the table: 





Lock Means the value of (OSLSR_EL1.OSLK == ’1? || DoubleLockStatus()). 
NS Means the Effective value of SCR_EL3.NS. 
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SDD Means the Effective value of MDCR_EL3.SDD. See Disabling debug exceptions from Secure state 
on page D2-2405. 

EEL2 Means the Effective value of SCR_EL3.EEL2. If ARMv8.4-SecEL2 is not implemented, this is 0. 

TGE Means the value of HCR_EL2.TGE. If EL2 is not implemented, the PE behaves as if this is 0. 

TDE Means the Effective value of MDCR_EL2.TDE. See Routing debug exceptions on page D2-2403. 


EL1 is using The Execution state when the ELD is EL1. 


EL2 is using The Execution state when the ELD is EL2. 


Table D2-19 Value an ERET writes to PSTATE.SS 





MDSCR_EL1.SS 


EL1 is EL2 is Value an ERET writes to 


Lock NS SDD EEL2 TGE TDE using using PSTATE.SS 
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0 X X X X X X X 0 
1 TRUE X X X X X X X 0 
FALSE 0 1 X X X X X 0 
0 0 x x AArch32 n/a 0 
AArch64 n/a See Table D2-20 on page D2-2450 
1 0 0 AArch32 n/a 0 
AArch64 AArch64 See Table D2-20 on page D2-2450 
1 AArch32  AArch32 0 
x AArch64 See Table D2-21 on page D2-2451 
1 X n/a AArch32 0 
n/a AArch64 See Table D2-21 on page D2-2451 
1 x x 0 0 AArch32 n/a 0 
AArch64 AArch64 See Table D2-20 on page D2-2450 
1 AArch32 AArch32 0 
X AArch64 See Table D2-21 on page D2-2451 
1 X n/a AArch32 0 
n/a AArch64 See Table D2-21 on page D2-2451 


For: 

s If ELp is EL1 using AArch64, Table D2-20 on page D2-2450 shows the value an ERET writes to PSTATE.SS. 
° If ELp is EL2 using AArch64, Table D2-21 on page D2-2451 shows the value an ERET writes to PSTATE.SS. 
In both tables: 

From EL Means the Exception level at which the PE executes the ERET instruction. 


Target EL Is the target Exception level of the ERET. 
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KDE 


Note 


If the ERET is an illegal exception return, the target Exception level of the ERET is the current 
Exception level. See //legal return events from AArch64 state on page D1-2304. 





Is MDSCR_EL1.KDE. See Enabling debug exceptions from the current Exception level on 
page D2-2405. 


Table D2-20 Value an ERET writes to PSTATE.SS if ELp is EL1 using AArch64 



























































Software step enable Value an ERET writes 
FromEL TargetEL KDE PSTATE.D SPSR_ELx.p Statusat: OPTINIS 
From EL Target EL 

EL3 EL3 X X Disabled Disabled 0 
EL2 X X Disabled Disabled 0 
ELI 0 X X Disabled Disabled 0 
1 X 1 Disabled Disabled 0 

0 Disabled Enabled SPSR_EL3.SS 

ELO X X Disabled Enabled SPSR_EL3.SS 
EL2 EL2 X X Disabled Disabled 0 
ELI 0 X X Disabled Disabled 0 
1 X 1 Disabled Disabled 0 

0 Disabled Enabled SPSR_EL2.SS 

ELO X X Disabled Enabled SPSR_EL2.SS 
EL1 ELI 0 X Disabled Disabled 0 
1 0 x Enabled? -b 0 
1 1 Disabled Disabled 0 

0 Disabled Enabled SPSR_ELI1.SS 

ELO 0 X X Disabled Enabled SPSR_EL1.SS 
1 0 X Enableda Enabled 0 

1 X Disabled Enabled SPSR_EL1.SS 





a. Because MDSCR_EL1.SS 
b. Depends on SPSR_EL1.D. 


D2-2450 


== ], it means that the ERET is itself being stepped. 
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Table D2-21 Value an ERET writes to PSTATE.SS if ELp is EL2 using AArch64 



























































Software step enable Value an ERET writes 
FromEL TargetEL KDE PSTATE.D SPSR_ELx.p Statusat: i i 
From EL Target EL 

EL3 EL3 x X X Disabled Disabled 0 
EL2 0 X X Disabled Disabled 0 
1 X 1 Disabled Disabled 0 

0 Disabled Enabled SPSR_EL3.SS 

ELI X X Disabled Enabled SPSR_EL3.SS 

ELO X X Disabled Enabled SPSR_EL3.SS 
EL2 EL2 0 X X Disabled Disabled 0 
1 0 X Enabled -b 0 
1 1 Disabled Disabled 0 

0 Disabled Enabled SPSR_EL2.SS 

ELI 0 X X Disabled Enabled SPSR_EL2.SS 
1 0 X Enableda Enabled 0 

1 X Disabled Enabled SPSR_EL2.SS 

ELO 0 X X Disabled Enabled SPSR_EL2.SS 
1 0 X Enabled Enabled 0 

1 X Disabled Enabled SPSR_EL2.SS 
EL1 EL1 X X X Enabled Enabled 0 
ELO X X X Enabled? Enabled 0 





a. Because MDSCR_EL1.SS == 1, it means that the ERET is itself being stepped. 
b. Depends on SPSR_EL2.D. 





Note 
No AArch32 instruction can set PSTATE.SS to 1. 





D2.12.5 Behavior in the active-not-pending state 
In this state, the PE does one of the following: 


° Executes the instruction to be stepped and either: 
— Completes it without taking a synchronous exception. 
— Takes a synchronous exception if the instruction generates one. 


à Takes an asynchronous exception without executing any instructions. 
$ Enters Debug state because of a Halting debug event. 
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If the PE executes the instruction without taking any exceptions, then the PE sets PSTATE.SS to 0, meaning that 
after the instruction has been executed: 


7 If the instruction has disabled debug by setting PSTATE.D to 1 then software step advances to the inactive 
state. 


e If the instruction disables software step by a direct write to a System register, for example a write to 
MDSCR_EL1.KDE or MDSCR_EL1.SS, then software step might advance to the inactive state. These 
writes require explicit synchronization to guarantee their effect. See Synchronization and the software step 
state machine on page D2-2457. 


è Otherwise, software step advances to the active-pending state. See Behavior in the active-pending state on 
page D2-2454. 


If the PE takes either a synchronous or an asynchronous exception, behavior is as described in one of the following: 
s If the PE takes an exception to an Exception level that is using AArch64. 
è If the PE takes an exception to an Exception level that is using AArch32 on page D2-2453. 


If the PE enters Debug state because of a Halting debug event, behavior is as described in Entering Debug state and 
Software Step on page H2-6713. 

If the PE takes an exception to an Exception level that is using AArch64 

As part of exception entry, the PE does all of the following: 

: Sets SPSR_ELx.SS to 0 or 1, depending on the exception. See Table D2-22. 


è It is UNPREDICTABLE whether SPSR_ELx.SS to 0 or 1 when an SError interrupt is taken to ELx without 
executing the instruction. 


$ Sets PSTATE.SS to 0. This causes software step to enter either the active-pending state or the inactive state, 
depending on whether debug exceptions are enabled or disabled from the Exception level that the exception 
is taken to: 


Enabled Software step enters the active-pending state. 
Disabled Software step enters the inactive state. 


In either case, on taking the exception, a step is complete. 


s Sets PSTATE.D to 1. 


Table D2-22 Categorization of exceptions, for setting SPSR_ELx.SS to 0 or 1 


Exception description Exceptions SPSR_ELx.SS 





Exceptions whose preferred return address is for Supervisor Call (SVC) exceptions. 0 
the instruction that follows the instruction tobe Hypervisor Call (HVC) exceptions. 














stepped. Secure Monitor Call (SMC) exceptions. 
Exceptions whose preferred return address isthe All other synchronous exceptions, and asynchronous 1 
address of the instruction to be stepped. exceptions that are taken before the instruction to be stepped. 
Note 
If an SMC instruction executed at Non-secure EL1 is trapped to EL2 because HCR_EL2.TSC is 1, the exception is a 
Trap exception, not a Secure Monitor Call exception, and so SPSR_ELx.SS is set to 1, not 0. 
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If the PE takes an exception to an Exception level that is using AArch32 
This can only happen when all of the following is true: 


è EL2 is implemented and is using AArch64, and the Effective value of MDCR_EL2.TDE is 1. Because 
MDCR_EL2.TDE is 1, ELp is EL2. 


7 The exception is taken to EL1 using AArch32. 


As part of exception entry, the PE sets PSTATE.SS to 0. This causes software step to enter the active-pending state. 


Note 
è Software step always enters the active-pending state because the exception is taken to an Exception level that 
debug exceptions are enabled from, EL1. Debug exceptions are enabled from EL1 because ELp is EL2, and 
debug exceptions are always enabled from Exception levels that are lower than ELp. 





. AArch32 SPSRs have no SS bit. 





Summary of behavior in the active-not-pending state 


Table D2-23 summarizes behavior in the active-not-pending state. 


Table D2-23 Summary of behavior in the active-not-pending state 














Bvont Vale erttonto Target Exception poi Yale writer © Next tat 

No exception 0 n/a Disables Software step n/a Inactive 
Otherwise n/a Active-pending 

Exception 0 AArch64 Supervisor Call (SVC) 0 Active-pending 
Hypervisor Call (HVC) or inactive> 


Secure Monitor Call (SMC) 





Other 1 





AArch32 All 0 Active-pending 


a. For the No exception rows, this column shows the effect of the event. 
For the Exception rows, this column shows the exception taken. 


b. Which state software step enters depends on whether debug exceptions are enabled or disabled from the target Exception level. See 
Figure D2-3 on page D2-2447. 


D2.12.6 Entering the active-pending state 
Software step enters the active-pending state after any of the following operations, provided that both: 
. MDSCR_EL1.SS is 1. 


° Debug exceptions are enabled from the Exception level and Security state that execution is in after the 
operation. 


The operations are: 


While software step is in the active-not-pending state 


The PE either: 
è Executing the instruction to be stepped without taking any exceptions. 


. Taking an exception. 
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D2.12.7 


D2.12.8 


D2-2454 


While software step is in the active-pending state 


The PE takes an asynchronous exception. 


While software step is in the inactive state 
The PE executes either: 
° An ERET instruction when SPSR_ELx.SS is 0. 
. An instruction that enables debug by setting PSTATE.D to 0. 


Note 


If entry to the active-pending state is because of the PE taking an exception, it means that the exception is one that 
is taken to EL1 when MDCR_EL2.TDE is 1 and EL2 is implemented and enabled in the current Security state. 
Otherwise, debug exceptions are masked by PSTATE.D, therefore they would be disabled from the target Exception 
level of the exception. 








In addition, software step might enter the active-pending state either: 


7 After a direct write to a System register, for example a write to MDSCR_EL1.KDE or MDSCR_ELI.SS. 
These writes require explicit synchronization to guarantee their effect. See Synchronization and the software 
step state machine on page D2-2457. 


è On exiting Debug state when DSPSR_ELO.SS or DSPSR.SS is 0. See Exiting Debug state on page H2-6740. 


Behavior in the active-pending state 


When the PE is in the active-pending state, a Software Step exception is taken before the PE executes an instruction. 


The Software Step exception has higher priority than all other types of synchronous exception. However, the 
prioritization of this exception with respect to any unmasked pending asynchronous exception is not defined by the 
architecture. 


For more information, see the following: 


$ Synchronous exception prioritization for exceptions taken to AArch64 state on page D1-2308. 
s Prioritization and recognition of interrupts on page D1-2324. 
s Architectural requirements for taking asynchronous exceptions on page G1-5507. 


Stepping T32 IT instructions 


The Armv8-A architecture permits a combination ofan IT instruction and another 16-bit T32 instruction to comprise 
one 32-bit instruction. 


For the purpose of stepping an item, it is IMPLEMENTATION DEFINED whether: 
. The PE considers this combination to be one instruction. 
. The PE considers this combination to be two instructions. 


In an implementation that supports the ITD control, that can disable some uses of the IT instruction, it is then 
IMPLEMENTATION DEFINED whether this behavior depends on the value of the applicable ITD field. For example: 


è The PE might consider this combination to be one instruction, regardless of the state of the applicable ITD 
field. 

7 The PE might consider this combination to be two instructions, regardless of the state of the applicable ITD 
field. 

a The PE might consider this combination to be one instruction when the applicable ITD field is 1, and two 


instructions when it is 0. 


The applicable ITD field is one of: 
$ SCTLR_EL1.ITD if execution is at ELO using AArch32 when EL1 is using AArch64. 
$ SCTLR.ITD if execution is at ELO or EL1 when EL1 is using AArch32. 
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$ HSCTLR.ITD if execution is at Non-secure EL2 using AArch32. 


D2.12.9 Exception syndrome information and preferred return address 


See the following: 
. Exception syndrome information. 
. Preferred return address on page D2-2456. 


Exception syndrome information 


On taking a Software Step exception, the PE records information about the exception in the Exception Syndrome 
Register (ESR_ELx) at the Exception level the exception is taken to. See ZSS encoding for an exception from a 
Software Step exception on page D13-2951 for more information. 


If no instruction was stepped because software step entered the active-pending state from the inactive state without 
passing through the active-not-pending state, then ESR_ELx. {ISV, EX} are set to 0. 


When an instruction has been stepped, if the stepped instruction was a conditional Load-Exclusive instruction that 
failed its Condition code test, then ESR_ELx.EX is set to a CONSTRAINED UNPREDICTABLE choice of 0 or 1. 


When an instruction has been stepped, if the stepped instruction was an ERET or an ISB. then ESR_ELx.ISV is set to 
a CONSTRAINED UNPREDICTABLE choice of 0 or 1, and ESR_ELx.EX is set to 0. 


If the Effective value of MDCR_EL2.TDE == 1, EL2 is implemented and enabled in the current Security state, and 
a different exception is taken before the Software Step exception, then ESR_ELx.ISV is set to a CONSTRAINED 
UNPREDICTABLE choice of 0 or 1. In this case: 


$ If ESR_ELx.ISV is set to 1, then ESR_ELx.EX is set to the correct value for the instruction. 
. If ESR_ELx.ISV is set to 0, then ESR_ELx.EX is set to zero. 

Other than for the cases described above, when an instruction has been stepped: 

$ ESR_ELx.ISV is set to 1, to indicate that the EX bit is valid. 


š The value of ESR_ELx.EX is set according to the instruction stepped. When: 


— The instruction stepped was an instruction other than a Load-Exclusive instruction, an Exception 
Return instruction, or an ISB, and no other exception was taken before the Software Step exception, 
ESR_ELx.EX is set to 0. 


— The instruction stepped was a Load-Exclusive instruction that was either not conditional or did not fail 
its Condition code test, ESR_ELx.EX is set to 1. 








Note 

A Load-Exclusive instruction is any one of the following: 

s In the A64 instruction set, any instruction that has a mnemonic starting with either LDX or LDAX. 

a In the A32 and T32 instruction sets, any instruction that has a mnemonic starting with either LDREX or LDAEX. 
Note 





An implementation that always sets ISV to 0 and never sets EX is not compliant. 
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Table D2-24 summarizes the possible values that the PE can record in ESR_ELx.{ISV, EX}. 


Table D2-24 Values that the PE can record in ESR_ELx.{ISV, EX} 











Description ESR_ELx.ISV ESR_ELx.EX 
Syndrome data is not available because no instruction was stepped. 0 0 
Syndrome data is available because an instruction was stepped. The instruction stepped 1 Oorl 


was a conditional Load-Exclusive instruction that failed its Condition code test. 





Syndrome data is available because an instruction was stepped. The instruction stepped 0 or 1 0 
was an Exception Return instruction or an ISB. 





A different exception is taken before the Software Step exception. 0 0 





1 Set to the correct value 
for the instruction. 





Syndrome data is available because an instruction was stepped. The instruction stepped 1 0 
was an instruction other than a Load-Exclusive instruction, an Exception Return 
instruction, or an ISB, and no other exception was taken before the Software Step 


exception. 





Syndrome data is available because an instruction was stepped. The instruction stepped 1 1 
was a Load-Exclusive instruction that was either not conditional or did not fail its 
Condition code test. 





D2.12.10 


D2-2456 


Preferred return address 


The preferred return of a Software Step exception is the address of the instruction that was not executed because the 
PE took the Software Step exception instead. 


Additional considerations 


This section contains the following: 


Behavior when an ERET instruction is an illegal exception return. 

Behavior when the instruction stepped writes a misaligned PC value on page D2-2457. 
Stepping code that uses Exclusives monitors on page D2-2457. 

Synchronization and the software step state machine on page D2-2457. 


Behavior when an ERET instruction is an illegal exception return 


Ifthe conditions for entering the active-not-pending state in Entering the active-not-pending state on page D2-2448 
are met, but the PE executes an ERET instruction that is an illegal exception return, the exception return must be taken 
to the same Exception level that it was taken from. In this scenario, even though the Exception level remains the 
same before and after the ERET, software step can advance from the inactive state to one of the active states. Consider 
the following case: 


1. 


MDSCR_EL1.SS is 1 and software step is inactive. The current Exception level is EL1 using AArch64, the 
OS Lock and OS Double Lock are unlocked, and MDCR_EL2.TDE is 0, MDSCR_EL1.KDE is 1, and 
PSTATE.D is 1. 


PSTATE.D == 1 is the reason why software step is inactive, because PSTATE.D == 1 means that debug 
exceptions are disabled from the current Exception level. 


The PE executes an ERET instruction. 


The intended target of the ERET is EL2. This means that the ERET is an illegal exception return because the 
intended target is higher than the Exception level the ERET it is executed at. In this case, the ERET must target 
EL1 instead of EL2. 
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If SPSR_EL1.D is 0, then on the ERET PSTATE.D becomes 0 and debug exceptions become enabled from the 
current Exception level. Software step therefore advances from the inactive state to one of the active states. 


Which active state software step advances to depends on whether SPSR_ELx.SS is 1 or 0: 


$ If SPSR_ELx.SS is 1, software step advances to the active-not-pending state. 
In this case, an Illegal Execution state exception is pending on the instruction to be stepped, and the PE takes 
the Illegal Execution state exception instead of executing the instruction to be stepped. 

à If SPSR_ELx.SS is 0, software step advances to the active-pending state. 


In this case, a Software Step exception and an Illegal Execution state exception are both pending. The 
Software Step exception has higher priority. On taking the Software Step exception, the PE sets 
SPSR_ELx.IL to 1. 


Note 


Synchronous exception prioritization for exceptions taken to AArch64 state on page D1-2308 shows the relative 
priorities of synchronous exceptions. 








Behavior when the instruction stepped writes a misaligned PC value 


An indirect branch that writes a misaligned PC value might generate a PC alignment fault exception at the target of 
the branch. However, if the indirect branch is stepped using software step, the PE takes a Software Step exception 
instead, because the Software Step exception has higher priority. Behavior on returning from the Software Step 
exception depends on which Execution state the Exception level being returned to is using: 


AArch64 A PC alignment fault exception is generated. 


AArch32 The return from the Software Step exception forces the PC to the correct alignment, and no PC 
alignment fault exception is generated. 


Debugger software must therefore take care when using software step to single-step an indirect branch instruction 
executed in AArch32 state, that it does not hide a PC alignment fault exception. 


Stepping code that uses Exclusives monitors 


The Armv8-A architecture provides no mechanism for preserving the state of the Exclusives monitors when a 
Load-Exclusive or a Store-Exclusive instruction is stepped. 


However, for certain progressions through the software step state machine, on taking a Software Step exception, the 
PE provides an indication of whether the instruction stepped was a Load-Exclusive instruction. 


Debugger software can use this to detect the state of the Exclusives monitors. For example, if the PE reports that 
the instruction stepped was a Load-Exclusive instruction, the debugger is aware that the next Store-Exclusive 
operation will fail, because all Exclusives monitors are cleared on returning from the Software Step exception. The 
debugger must then take action to ensure that the code being stepped makes forwards progress. 


For more information on how the PE reports whether the instruction stepped was a Load-Exclusive instruction, see 
Exception syndrome information and preferred return address on page D2-2455. 
Synchronization and the software step state machine 


Any of the following can cause transitions between software step states: 


s A direct write to a System register. 
° A direct write to a Special-purpose register. 
° A write to an external debug register that affects the routing of debug exceptions. 


Because the software step state machine indirectly reads these registers, it is not guaranteed to observe any new 
values until after a Context synchronization event has occurred. 
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D2.12.11 
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In the time between a write to one of these registers and the next Context synchronization event, it is CONSTRAINED 
UNPREDICTABLE whether software step uses the state of the PE before the write, or the state of the PE after the write. 


After a Context synchronization event, the state machine must use the state of the PE after the write. 


Example D2-3 


1. Software changes MDSCR_EL1.SS from 0 to 1 when debug exceptions are enabled. 
2. The PE executes some instructions. 
3. A Context synchronization event occurs. 


During step 2, it is CONSTRAINED UNPREDICTABLE whether software step remains in the inactive state, as if 
MDSCR_ELL1.SS is 0, or enters the active-pending state because MDSCR_ELL.SS is 1. If it is in the: 





è Inactive state, then after the Context synchronization event, it must enter the active-pending state. 
$ Active-pending state, the PE might take a Software Step exception before the Context synchronization event. 
Note 


A direct write to a Special-purpose register does not require explicit synchronization. 





Pseudocode description of Software Step exceptions 


SSAdvance() advances software step from the active-not-pending state to the active-pending state, by setting 
PSTATE:SS to 0. It is called on completing execution of each instruction. 


CheckSoftwareStep() checks whether software step is in the active-pending state, and if it is, generates a Software 
Step exception. It is called before each instruction executed, regardless of Execution state, before checking for any 
other synchronous exceptions. 


DebugExceptionReturnSS() returns the value to write to PSTATE.SS on an exception return or an exit from Debug 
state. See Entering the active-not-pending state on page D2-2448. 


These functions are defined in Chapter J1 Armv8 Pseudocode. 
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D2.13 Synchronization and debug exceptions 


The behavior of debug depends on all of the following: 
s The state of the external debug authentication interface. 
° Indirect reads of: 
— External debug registers. 
— System registers, including system debug registers. 
— Special-purpose registers. 
If a change is made to any of these, the effect of that change on debug exception generation cannot be relied on until 


after a Context synchronization event has occurred. Similarly, the effect of the change on the software step state 
machine cannot be relied on until after a Context synchronization event has occurred. 


For any instructions executed between the time when the change is made and the time when the next Context 
synchronization event occurs, it is CONSTRAINED UNPREDICTABLE whether debug uses the state of the PE before the 
change, or the state of the PE after the change. 


Example D2-4 
1. Software changes MDSCR_EL1.MDE from 0 to 1. 
2. An instruction is executed, that would cause a Breakpoint exception if self-hosted debug uses the state of the 
PE after the change. 
3; A Context synchronization event occurs. 


In this case, it is CONSTRAINED UNPREDICTABLE whether the instruction generates a Breakpoint exception. 


Example D2-5 


1. Software unlocks the OS Lock. 
2. The PE executes some instructions. 


3. A Context synchronization event occurs. 


During the time when the PE is executing some instructions, step 2, it is CONSTRAINED UNPREDICTABLE whether 
debug exceptions other than Breakpoint Instruction exceptions can be generated. 


Note 


Some register updates are self-synchronizing. Others require an explicit Context synchronization event. For more 
information, see: 


. Accessing PSTATE fields on page D1-2285. 








s Synchronization requirements for AArch64 System registers on page D13-2819. 
. Synchronization of changes to the external debug registers on page H8-6828. 
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Chapter D3 
AArch64 Self-hosted Trace 


This chapter describes the AArch64 self-hosted trace: 
Introductory information: 

à About self-hosted trace on page D3-2462. 

7 Trace sinks on page D3-2462. 

. Register controls to enable self-hosted trace on page D3-2462. 
Prohibited regions in trace: 

è Controls to prohibit trace at Exception levels on page D3-2463. 

° Self-hosted trace and visibility of virtual data on page D3-2464. 
Timestamps and Synchronization: 

$ Self-hosted trace timestamps on page D3-2465. 

. Synchronization in self-hosted trace on page D3-2466. 
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D3.1 


D3.1.1 


D3.1.2 
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About self-hosted trace 


A PE Trace Unit generates trace data to describe the program flow of the PE. 


The PE Trace Unit may be an implementation of a standard Arm Embedded Trace Macrocell (ETM), or another 
type of Arm Trace Architecture, or an IMPLEMENTATION DEFINED trace function. 


If an Armv8.4-compliant PE implements an ETM Architecture PE Trace Unit, ARMv8.4-Trace extension must be 
implemented. 


If an Armv8.4-compliant PE implements a Trace Unit that is not an ETM Architecture PE Trace Unit, Arm 
recommends that ARMv8.4-Trace extension is implemented, but this is not mandatory. 


Self-hosted trace happens when the agent controlling the trace collection is part of the same software stack as the 
software being traced. The agent controls prohibited regions. The information collected by the agent is sent to a trace 
sink. 


If the self-hosted trace extensions are implemented, the PE Trace Unit must implement the system register interface. 
The PE Trace Unit and the PE must have the same view of the debug authentication interface. If ARMv8.4-Trace 
is implemented, ExternalNoninvasiveDebugEnabled() is always TRUE. 


Trace sinks 


The PE Trace Unit sends the trace data to a trace sink. A system might include multiple trace sinks, and allow 
software to configure which trace sink or sinks are used. 


An example of an internal trace sink is an Embedded Trace Router (ETR), which allows software to define a buffer 
in memory. Trace data is written to this buffer. 


Arm recommends that a system that a system that includes ARMv8.4-Trace incorporates an ETR, and follows the 
system architecture described by the CoreSight Base System Architecture (CS-BSA). 


The self-hosted trace extensions do not describe the programmers’ model trace sinks. 


Register controls to enable self-hosted trace 


It is IMPLEMENTATION DEFINED whether the PE Trace Unit implements an external debug interface or a self-hosted 
interface. 


If ARMv8.4-Trace is implemented, and external self-hosted trace is not implemented, self-hosted trace is always 
enabled. 


If ARMv8.4-Trace is implemented, and external self-hosted trace is implemented, self-hosted trace is also enabled 
if one of the following is true: 


$ EDSCR.TFO == 0. 


$ EDSCR.TFO == 1, EL3 is implemented, MDCR_EL3.STE == 1 and 
External SecureNoninvasiveDebugEnab1ed() == FALSE. 


° EDSCR.TFO ==], EL3 is not implemented, the PE executes in Secure state and 
External SecureNoninvasiveDebugEnabled() = FALSE. 


The pseudocode function Sel fHostedTraceEnabled() shows these rules. 
If ARMv8.4-Trace is not implemented, Sel fHostedTraceEnabled() returns FALSE. 


While Sel fHostedTraceEnabled() == FALSE, ExternalSecureNoninvasiveDebugEnabled() and 
ExternalNoninvasiveDebugEnabled() control whether external tracing is prohibited or allowed in each Security state. 


The self-hosted trace extensions do not provide any mechanism to control software access to the PE Trace Unit 
external debug interface. 
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D3.2 Prohibited regions in self-hosted trace 


Trace is not generated in prohibited regions. The pseudocode function TraceA1]owed() indicates whether tracing is 
allowed in the current Security state and Exception level. 


The IMPLEMENTATION DEFINED debug authentication interface can allow an external agent to disable the self-hosted 
trace extension. 


If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited in Secure state when MDCR_EL3.STE == 0. If 
ARMv8.4-Trace is implemented but not enabled, tracing is prohibited in Secure state when 
External SecureNoninvasiveDebugEnabled() == FALSE. 


D3.2.1 Controls to prohibit trace at Exception levels 


If Sel fHostedTraceEnabled() == TRUE, TRFCR_EL1 and TRFCR_EL2 control whether trace is prohibited at an 
Exception level. While Sel fHostedTraceEnabled() == FALSE, the registers TRFCR_EL1 and TRFCR_EL2 are 
ignored. 


If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited at ELO if one of the following is true: 
. The Effective value of HCR_EL2.TGE == 0 and TRFCR_EL1.EOTRE == 0. 
s The Effective value of HCR_EL2.TGE == 1 and TRFCR_EL2.E0HTRE == 0. 


If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited at EL1 if TRFCR_EL1.E1TRE == 0. 
If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited at EL2 if TRFCR_EL2.E2TRE == 0. 


If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited at EL3 if one of the following is true: 
: EL3 is using AArch64 state. 
7 EL3 is using AArch32 state and TRFCR.EITRE == 0. 


The pseudocode TraceAl lowed() shows the above rules. 


If Sel fHostedTraceEnabled() == TRUE, Table D3-1 shows when export of PMU events to the ETM is prohibited. 


Table D3-1 Export of PMU events prohibited 





Tracing prohibited in 
allofthese Exception HCR_EL2.TGE 


Export of PMU events Attributable to this Exception level to the ETM 
is prohibited at these Exception levels. 

















levels 

ELO, EL2, EL3 1 ELO, EL2, EL3 
ELO, EL1, EL2, EL3 0 ELO, EL1, EL2, EL3 
EL1, EL2, EL3 0 EL1, EL2, EL3 
EL2, EL3 0 EL2, EL3 

EL3 0 EL3 





ARM DDI 0487E.a 
ID070919 


If Sel fHostedTraceEnabled() == TRUE, Table D3-2 on page D3-2464 shows the prohibited regions by exception 
level and state. 


In the table: 





STE Means the Effective value of MDCR_EL3.STE or SDCR.STE, as applicable. 
EEL2 Means the Effective value of SCR_EL3.EEL2. 
TGE Means the Effective value of HCR_EL2.TGE. 
P Means prohibited. 
E2TRE Means allowed if TRFCR_EL2.E2TRE == 1. 
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E1TRE Means allowed if TRFCR_EL1.E1TRE == 1. 


EOHTRE Means allowed if TRFCR_EL2.EOHTRE == 1. 























EOTRE Means allowed if TRFCR_EL1.EOTRE == 1. 
n/a Not applicable. 
Table D3-2 Prohibited regions 
Controls Tracing prohibited at 
State STE EL3 using EEL2 TGE EL3 EL2 EL1 ELO 
Non-secure X X X 0 n/a E2TRE EITRE EOTRE 
X X X 1 n/a E2TRE n/a EOHTRE 
Secure 0 x x x P P P P 
1 AArch64 0 X P n/a EITRE EOTRE 
1 0 P E2TRE EITRE EOTRE 
1 1 P E2TRE n/a EOHTRE 





AArch32 X X EITRE n/a n/a EOTRE 





D3.2.2 Self-hosted trace and visibility of virtual data 
A hypervisor can use TRFCR_EL2.CX to control visibility of CONTEXTIDR_EL2 and VTTBR_EL2.VMID. 
If Sel fHostedTraceEnabled() == TRUE and TRFCR_EL2.CX == 0, or if EL2 is not implemented: 
$ The values of CONTEXTIDR_EL2 and VTTBR_EL2.VMID are not traced. 


° Comparisons between CONTEXTIDR_EL2 and VTTBR_EL2.VMID do not match and results of 
comparison are not exposed through the comparators. 


The PE Trace Unit may either prohibit trace for these values, or may record a CONTEXTIDR_EL2 or 
VTTBR_EL2.VMID value of zero in the trace. 
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D3.3 Self-hosted trace timestamps 
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The trace timestamp is a value that represents the passage of time in real-time. It is calculated from a counter which 
increments all the time, when the PE is generating trace and when the PE is in a prohibited region. 


While Sel fHostedTraceEnab1ed() == FALSE, the external trace provides the trace timestamp. If the external trace is 
a standard CoreSight system, the relationship between CoreSight time and the Generic Timer counter is 
IMPLEMENTATION DEFINED. 


When Sel fHostedTraceEnabled() == TRUE, the trace timestamp is one of the following: 
. The physical counter value CNTPCT_ELO. 


. A virtual counter value, which is calculated from the physical counter value CNTPCT_ELO, minus an offset 
CNTVOFF EL2. 


The fields TRFCR_EL2.TS, HTRFCR.TS, TRFCR_EL1.TS and TRFCR.TS control which counter is used for 
self-hosted trace. 


The timestamp used for trace is shown in Table D3-3. 


Table D3-3 Timestamp used for trace. 





SelfHostedTraceEnabled() TRFCR_EL2.TS TRFCR_EL1.TS Timestamp traced 

















FALSE XX XX CoreSight time 

TRUE 0b00 0b01 CNTPCT - CNTVOFF 
0b00 0b11 CNTPCT 
0b01 XX CNTPCT - CNTVOFF 
0b11 XX CNTPCT 





Note 


The counter value used for the trace timestamp is not affected by the value of HCR_EL2.E2H, or whether EL2 is 
enabled or disabled in the current Security state. 
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D3.4 Synchronization in self-hosted trace 
The PE Trace Unit is an indirect observer of the System registers. 


While Sel fHostedTraceEnabled() == TRUE, indirect reads of the trace filter control fields, TRFCR_EL1.{E1TRE, 
EOTRE} and TRFCR_EL2.{E2TRE, EOHTRE} are treated as indirect reads made by the instruction being traced, 
and are subject to the standard requirements for synchronization of System register accesses. 


The TSB CSYNC operation is used to ensure that a trace operation, due to a PE Trace Unit generating trace for an 
instruction has completed. The TSB CSYNC operation may be reordered with respect to other instructions, so must be 
combined with at least one context synchronization event to ensure the operations are executed in the required order. 
This means that a direct write to TRFCR_EL1 or TRFCR_EL2 is guaranteed to be observed by the PE Trace Unit 
only after a subsequent Context synchronization event. For more information, see Trace Synchronization Barrier 
(TSB CSYNC) on page B2-127. 


While Sel fHostedTraceEnabled() == FALSE, the PE Trace Unit might impose stronger synchronization 
requirements. 


D3-2466 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Chapter D4 
The AArch64 System Level Memory Model 


ARM DDI 0487E.a 
ID070919 


This chapter provides a system level view of the general features of the memory system. It contains the following 
sections: 


About the memory system architecture on page D4-2468. 
Address space on page D4-2469. 

Mixed-endian support on page D4-2470. 

Cache support on page D4-2471. 

External aborts on page D4-2496. 

Memory barrier instructions on page D4-2498. 


Pseudocode description of general memory System instructions on page D4-2499. 
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D4.1 


D4.1.1 


D4.1.2 


D4-2468 


About the memory system architecture 


The Arm architecture supports different implementation choices for the memory system microarchitecture and 
memory hierarchy, depending on the requirements of the system being implemented. In this respect, the memory 
system architecture describes a design space in which an implementation is made. The architecture does not 
prescribe a particular form for the memory systems. Key concepts are abstracted in a way that permits 
implementation choices to be made while enabling the development of common software routines that do not have 
to be specific to a particular microarchitectural form of the memory system. For more information about the concept 
of a hierarchical memory system see Memory hierarchy on page B2-133. 


If ARMv8.5-MemTag is implemented and enabled the definitions of the memory model which apply to data 
accesses and data apply to Allocation Tag accesses and Allocation tags, unless otherwise specified in Chapter D6 
Armvs.5 Memory Tagging Extension. 


Form of the memory system architecture 


The Armv8 A-profile architecture includes a Virtual Memory System Architecture (VMSA). Chapter D5 The 
AArch64 Virtual Memory System Architecture describes the AArch64 view of the VMSA. 


Memory attributes 


Memory types and attributes on page B2-143 describes the memory attributes, including how different memory 
types have different attributes. Each location in memory has a set of memory attributes, and the translation tables 
define the virtual memory locations, and the attributes for each location. 


Table D4-1 shows the memory attributes that are visible at the system level. 


Table D4-1 Memory attribute summary 











Memory type Shareability Cacheability 
Device? Outer Shareable Non-cacheable. 
Normal One of: One of?: 

. Non-shareable. . Non-cacheable. 


° Inner Shareable. e Write-Through Cacheable. 
° Outer Shareable. e Write-Back Cacheable. 





a. Takes additional attributes, see Device memory on page B2-147. 


b. See also Cacheability, cache allocation hints, and cache transient hints on 
page D4-2474. 


For more information on cacheability and shareability see Shareable Normal memory on page B2-144, 
Non-shareable Normal memory on page B2-145, and Caches and memory hierarchy on page B2-133. 
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D4.2 Address space 


The Armv8 architecture is designed to support a wide range of applications with different memory requirements. It 
supports a range of physical address (PA) sizes, and provides associated control and identification mechanisms. For 
more information, see Address size configuration on page D5-2519. 


D4.2.1 Virtual address space overflow 
When a PE performs a Simple sequential execution of instructions, it calculates: 
(address_of_current_instruction) + (size_of_executed_instruction) 
This calculation is performed after each instruction to determine which instruction to execute next. 


If the address calculation performed after executing an instruction overflows @xFFFF FFFF FFFF FFFF, the program 
counter becomes UNKNOWN. 





Note 
Address tags are not propagated to the program counter, so the tag does not affect the address calculation. 





Where an instruction accesses a sequential set of bytes that crosses the @xFFFF_FFFF_FFFF_FFFF boundary when 
tagged addresses are not used, or the @xxxFF_FFFF_FFFF_FFFF boundary when tagged addresses are used, then the 
virtual address accessed for the bytes above this boundary is UNKNOWN. When tagged addresses are used, the value 
of the tag associated with the address also becomes UNKNOWN. 
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D4.3 


Mixed-endian support 


A control bit, SCTLR_EL1.EOE is provided to allow the endianness of explicit data accesses made while executing 
at ELO to be controlled independently of those made while executing at EL1. Table D4-2 shows the endianness of 
explicit data accesses and translation table walks. 


Table D4-2 Endianness support 





Exception level Explicit data accesses Stage 1 translation table walks Stage 2 translation table walks 























ELO SCTLR_EL1.E0E SCTLR_EL1.EE SCTLR_EL2.EE 
EL1 SCTLR_EL1.EE SCTLR_EL1.EE SCTLR_EL2.EE 
EL2 SCTLR_EL2.EE SCTLR_EL2.EE N/A 
EL3 SCTLR_EL3.EE SCTLR_EL3.EE N/A 
Note 
SCTLR_EL1.EOE has no effect on the endianness of the LDTR, LDTRH, LDTRSH, and LDTRSW instructions, or on the 
endianness of the STTR and STTRH instructions, when these are executed at EL1. 
AArch64 state provides the following options for endianness support: 
° All Exception levels support mixed-endianness: 
— SCTLR_ELx.EE is RW and SCTLR_EL1.E0E is RW. 
$ Only ELO supports mixed-endianness and EL1, EL2, and EL3 support only little-endianness: 
—  SCTLR_ELx.EE is RESO and SCTLR_EL1.EO0E is RW. 
e Only ELO supports mixed-endianness and EL1, EL2, and EL3 support only big-endianness: 
—  SCTLR_ELx.EE is RES1 and SCTLR_EL1.E0E is RW. 
: All Exception levels support only little-endianness: 
—  SCTLR_ELx.EE is RESO and SCTLR_EL1.EOE is res0. 
° All Exception levels support only big-endianness: 
— SCTLR_ELx.FE is RES1 and SCTLR_EL1.EOE is res1. 
If mixed endian support is implemented for an Exception level using AArch32, endianness is controlled by 
PSTATE.E. For exception returns to AArch32 state, PSTATE.E is copied from SPSR_ELx.E. If the target Exception 
level supports only little-endian accesses, SPSR_ELx.E is RESO. If the target Exception level supports only 
big-endian accesses, SPSR_ELx.E is RES1. PSTATE.E is ignored in AArch64 state. 
The BigEndian() function determines whether the current Exception level and Execution state are using big-endian 
data. This function is defined in Chapter J1 Armv8S Pseudocode. 
For more information about endianness in the Arm architecture see Endian support on page B2-140. 
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D4.4 Cache support 


This section describes the Armv8 cache identification and control mechanisms, and the A64 cache maintenance 
instructions, in the following sections: 


$ General behavior of the caches. 
$ Cache identification on page D4-2472. 
. Cacheability, cache allocation hints, and cache transient hints on page D4-2474. 


` Enabling and disabling the caching of memory accesses on page D4-2475. 

. Behavior of caches at reset on page D4-2477 

. Non-cacheable accesses and instruction caches on page D4-2477. 

. About cache maintenance in AArch64 state on page D4-2478. 

E A64 Cache maintenance instructions on page D4-2482 

G Data cache zero instruction on page D4-2492. 

$ Cache lockdown on page D4-2492. 

s System level caches on page D4-2494. 

s Branch prediction on page D4-2494. 

. Execution and data prediction restriction System instructions on page D4-2494. 


See also Caches in a VMSAv8-64 implementation on page D5-2655. 


D4.4.1 General behavior of the caches 


When a memory location has a Normal Cacheable memory attribute, determining whether a copy of the memory 
location is held in a cache still depends on many aspects of the implementation. The following non-exhaustive list 
of factors might be involved: 


. The size, line length, and associativity of the cache. 

è The cache allocation algorithm. 

7 Activity by other elements of the system that can access the memory. 
a Speculative instruction fetching algorithms. 


è Speculative data fetching algorithms. 
. Interrupt behaviors. 


Given this range of factors, and the large variety of cache systems that might be implemented, the architecture 
cannot guarantee whether: 


è A memory location present in the cache remains in the cache. 


° A memory location not present in the cache is brought into the cache. 
Instead, the following principles apply to the behavior of caches: 


° The architecture has a concept of an entry locked down in the cache. How lockdown is achieved is 
IMPLEMENTATION DEFINED, and lockdown might not be supported by: 


— A particular implementation. 


— Some memory attributes. 


s An unlocked entry in a cache might not remain in that cache. The architecture does not guarantee that an 
unlocked cache entry remains in the cache or remains incoherent with the rest of memory. Software must not 
assume that an unlocked item that remains in the cache remains dirty. 


° A locked entry in a cache is guaranteed to remain in that cache. The architecture does not guarantee that a 
locked cache entry remains incoherent with the rest of memory, that is, it might not remain dirty. 
Note 


For more information, see The interaction of cache lockdown with cache maintenance instructions on 
page D4-2493. 








ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D4-2471 
ID070919 Non-Confidential 


The AArch64 System Level Memory Model 


D4.4 Cache support 


Any memory location that has a Normal Cacheable attribute at either the current Exception level or at a 
higher Exception level can be allocated to a cache at any time. 


s It is guaranteed that no memory location that does not have a Normal Cacheable attribute is allocated into the 
cache. 
è It is guaranteed that no memory location is allocated to the cache if it has a Normal Non-cacheable attribute 


or any type of Device memory attribute in both: 
— The translation regime at the current Exception level. 
— The translation regime at any higher Exception level. 


° For data accesses, any memory location with a Normal Inner Shareable or Normal Outer Shareable attribute 
is guaranteed to be coherent with all masters in its shareability domain. 


s Any memory location is not guaranteed to remain incoherent with the rest of memory. 


° The eviction of a cache entry from a cache level can overwrite memory that has been written by another 
observer only if the entry contains a memory location that has been written to by an observer in the 
shareability domain of that memory location. The maximum size of the memory that can be overwritten is 
called the Cache Write-back Granule. In some implementations the CTR_ELO identifies the Cache 
Write-back Granule. 


s The allocation ofa memory location into a cache cannot cause the most recent value of that memory location 
to become invisible to an observer if it was previously visible to that observer. 


Note 


The Cacheability attribute of an address is determined by the applicable translation table entry for that address, as 
modified by any applicable System register Cacheability controls, such as the SCTLR_EL1.{I, C} controls. 








For the purpose of these principles, a cache entry covers at least 16 bytes and no more than 2KB of contiguous 
address space, aligned to the size of the cache entry. 


D4.4.2 Cache identification 


D4-2472 


The Armv8 cache identification registers describe the implemented caches that are affected by cache maintenance 
instructions executed on the PE. This includes the cache maintenance instructions that: 


è Affect the entire cache, for example IC IALLU. 
° Operate by VA, for example IC IVAU. 
° Operate by set/way, for example DC ISW. 


The cache identification registers are: 


5 The Cache Type Register, CTR_ELO, that defines: 


— The minimum line length of any of the instruction caches affected by the instruction cache 
maintenance instructions. 


— The minimum line length of any of the data or unified caches, affected by the data cache maintenance 
instruction. 


— The cache indexing and tagging policy of the Level 1 instruction cache. 


Note 


It is IMPLEMENTATION DEFINED whether caches beyond the PoC will be reported by this mechanism, and 
because of the possible existence of system caches some caches before the PoC might not be reported. For 
more information about system caches see System level caches on page D4-2494. 








š A single Cache Level ID Register, CLIDR_EL1, that defines: 


— The type of cache that is implemented and can be maintained using the architected cache maintenance 
instructions that operate by set/way or operate on the entire cache at each cache level, up to the 
maximum of seven levels. 
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— The Level of Coherence (LoC) for the caches. See Terms used in describing the cache maintenance 
instructions on page D4-2478 for the definition of LoC. 


— The Level of Unification Uniprocessor (LoUU) for the caches. See Terms used in describing the cache 
maintenance instructions on page D4-2478 for the definition of LoUU. 


— An optional ICB field to indicate the boundary between the caches use for caching Inner Cacheable 
memory regions and those used only for caching Outer Cacheable regions. 


A single Cache Size Selection Register, CSSELR_EL1, that selects the cache level and cache type of the 
current Cache Size Identification Register. 


For each implemented cache that is identifiable by this mechanism, across all the levels of caching, a Cache 
Size Identification Register, CCSIDR_EL1, that defines: 


— Whether the cache supports Write-Through, Write-Back, Read-Allocate and Write-Allocate. 


— The number of sets, associativity and line length of the cache. See Terms used in describing the cache 
maintenance instructions on page D4-2478 for a definition of these terms. 


Note 


From Armv8.3, multiple formats of the Cache Size Identification Register are supported. For more 
information, see Possible formats of the Cache Size Identification Register, CCSIDR_EL1. 








To determine the cache topology associated with a PE: 


l. 


Read the Cache Type Register to find the indexing and tagging policy used for the Level 1 instruction cache. 
This register also provides the size of the smallest cache lines used for the instruction caches, and for the data 
and unified caches. These values are used in cache maintenance instructions. 


Read the Cache Level ID Register to find what caches are implemented. The register includes seven Cache 
type fields, for cache levels 1 to 7. Scanning these fields, starting from Level 1, identifies the instruction, data 
or unified caches implemented at each level. This scan ends when it reaches a level at which no caches are 
defined. The Cache Level ID Register also specifies the Level of Unification (LoU) and the Level of 
Coherence (LoC) for the cache implementation. 


For each cache identified at stage 2: 


. Write to the Cache Size Selection Register to select the required cache. A cache is identified by its 
level, and whether it is: 
— An instruction cache. 
— A data or unified cache. 


. Read the Cache Size Identification Register to find details of the cache. 


Possible formats of the Cache Size Identification Register, CCSIDR_EL1 


From Armv8.3, the Cache Size Identification Register, CCSIDR_EL1 has two different formats available for 
defining the number of sets and associativity of the cache. For a definition of these terms, see Terms used in 
describing the cache maintenance instructions on page D4-2478. 


When ARMv8.3-CCIDX is implemented: 


CCSIDR_EL1 is a 64-bit register. 


The length of the CCSIDR_EL1.Assoc field is 21 bits. This limits the associativity of the currently selected 
cache to 221, 


The length of the CCSIDR_EL1.NumSets field is 24 bits. This limits the number of sets in the currently 
selected cache to 224. 


This is the 64-bit format of the Cache Size Identification Register. 


When ARMv8.3-CCIDX is not implemented: 


CCSIDR_EL1 is a 32-bit register. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D4-2473 
Non-Confidential 


The AArch64 System Level Memory Model 


D4.4 Cache support 


D4.4.3 
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s The length of the CCSIDR_EL1.Assoc field is 10 bits. This limits the associativity of the currently selected 
cache to 210, 


s The length of the CCSIDR_EL1.NumSets field is 15 bits. This limits the number of sets in the currently 
selected cache to 215, 


This is the 32-bit format of the Cache Size Identification Register. 


When one of these formats is implemented, it is implemented across all the levels of caching. 


Cacheability, cache allocation hints, and cache transient hints 


Cacheability only applies to Normal memory, and can be defined independently for Inner and Outer cache locations. 
All types of Device memory are always treated as Non-cacheable. 


As described in Memory types and attributes on page B2-143, the memory attributes include a cacheability attribute 
that is one of: 


° Non-cacheable. 
° Write-Through cacheable. 
. Write-Back cacheable. 


In Armv8, Cacheability attributes other than Non-cacheable can be complemented by a cache allocation hint. This 
is an indication to the memory system of whether allocating a value to a cache is likely to improve performance. In 
addition, it is IMPLEMENTATION DEFINED whether a cache transient hint is supported, see Transient cacheability 
hint. 


The cache allocation hints are assigned independently for read and write accesses, and therefore when the Transient 
hint is supported the following cache allocation hints can be assigned: 


For read accesses: Read-Allocate, Transient Read-Allocate, or No Read-Allocate. 


For write accesses: Write-Allocate, Transient Write-Allocate, or No Write-Allocate. 





Note 


7 A Cacheable location with both No Read-Allocate and No Write-Allocate hints is not the same as a 
Non-cacheable location. A Non-cacheable location has coherency guarantees for all observers within the 
system that do not apply for a location that is Cacheable, No Read-Allocate, No Write-Allocate. 


è Implementations can use the cache allocation hints to limit cache pollution to a part of a cache, such as to a 
subset of ways. 


7 For VMSAv8-64 translation table walks, the TCR_ELx.{IRGNn, ORGNn} fields define the memory 
attributes of the translation tables, including the cacheability. However, this assignment supports only a 
subset of the cacheability attributes described in this section. 





The architecture does not require an implementation to make any use of cache allocation hints. This means an 
implementation might not make any distinction between memory locations with attributes that differ only in their 
cache allocation hint. 


Transient cacheability hint 


In Armv§8, it is IMPLEMENTATION DEFINED whether a Transient hint is supported. In an implementation that supports 
the Transient hint, the Transient hint is a qualifier of the cache allocation hints, and indicates that the benefit of 
caching is for a relatively short period. It indicates that it might be better to restrict allocation of transient entries, to 
avoid possibly casting-out other, less transient, entries. 


Note 
The architecture does not specify what is meant by a relatively short period. 
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The description of the AArch64 MAIR _EL1, MAIR EL2, and MAIR EL3 registers, and the AArch32 MAIRO, 
MAIRI, HMAIRO, and HMAIR1 registers, includes the assignment of the Transient hint in an implementation that 
supports this option. In this assignment: 


s The Transient hint is defined independently for Inner Cacheable and Outer Cacheable memory regions. 
è A single Transient hint applies to both read and write accesses to a memory region. 
D4.4.4 Enabling and disabling the caching of memory accesses 


In Armv8, Cacheability control fields can force all memory locations with the Normal memory type to be treated 
as Non-cacheable, regardless of their assigned Cacheability attribute. Independent controls are provided for each 
stage of address translation, with separate controls for: 


. Data accesses. These controls also apply to accesses to the translation tables. 
. Instruction accesses. 
Note 





These Cacheability controls replace the cache enable controls provided in previous versions of the Arm architecture. 





The Cacheability control fields and their effects are as follows: 


For the EL1&0 translation regime 
è When the value of SCTLR_EL1.C is 0: 
—  Allstage 1 translations for data accesses to Normal memory are Non-cacheable. 
— All accesses to the EL1&0 stage 1 translation tables are Non-cacheable. 
s When the value of SCTLR_EL1.1 is 0: 
—  Allstage 1 translations for instruction accesses to Normal memory are Non-cacheable. 
è When the value of HCR_EL2.CD is 1: 
— All stage 2 translations for data accesses to Normal memory are Non-cacheable. 
— All accesses to the EL1&0 stage 2 translation tables are Non-cacheable. 
$ When the value of HCR_EL2.ID is 1: 
— Allstage 2 translations for instruction accesses to Normal memory are Non-cacheable. 
: When the value of HCR_EL2.DC is 1, all stage 1 translations and all accesses to the EL1&0 
stage | translation tables, are treated as accesses to Normal Non-shareable Inner Write-Back 
Cacheable Read-Allocate Write-Allocate, Outer Write-Back Cacheable Read-Allocate 


Write-Allocate memory, regardless of the value of SCTLR_EL1.{I, C}. This applies to 
translations for both data and instruction accesses. 





Note 


è The stage 1 and stage 2 cacheability attributes are combined as described in Combining the 
stage I and stage 2 cacheability attributes for Normal memory on page D5-2607. 


s The SCTLR_EL1.{C, I} and HCR_EL2.DC fields have no effect on the EL2, EL2&0, and 
EL3 translation regimes. 


. The HCR_EL2. {ID, CD} fields affect only stage 2 of the EL1&0 translation regime. 


° When EL2 is using AArch64 and EL1 is using AArch32, the HCR_EL2.{ID, CD, DC} 
controls apply as described here, but the EL1 controls are SCTLR. {C, I}. 





For the EL2 translation regime 
5 When the value of SCTLR_EL2.C is 0: 


— All data accesses to Normal memory using the EL2 translation regime are 
Non-cacheable. 


— All accesses to the EL2 translation tables are Non-cacheable. 
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a When the value of SCTLR_EL2.1 is 0: 


— All instruction accesses to Normal memory using the EL2 translation regime are 
Non-cacheable. 


Note 
The SCTLR_EL2.{I, C} fields have no effect on the EL1&0 and EL3 translation regimes. 








For the EL2&0 translation regime 


. When the value of SCTLR_EL2.C is 0: 
—  Allstage 1 translations for data accesses to Normal memory are Non-cacheable. 
— All accesses to the EL2&0 stage 1 translation tables are Non-cacheable. 


è When the value of SCTLR_EL2.I is 0: 


—  Allstage 1 translations for instruction accesses to Normal memory are Non-cacheable. 


For the EL3 translation regime 
à When the value of SCTLR_EL3.C is 0: 


— All data accesses to Normal memory using the EL3 translation regime are 
Non-cacheable. 


— All accesses to the EL3 translation tables are Non-cacheable. 
è When the value of SCTLR_EL3.I is 0: 


— All instruction accesses to Normal memory using the EL3 translation regime are 
Non-cacheable. 


Note 
The SCTLR_EL3.{I, C} fields have no effect on the EL1&0, EL2, and EL2&0 translation regimes. 





In addition: 


: For translation regimes other than the EL1&0 translation regime, if the value of SCTLR_ELx.M is 0, 
indicating that stage 1 translations are disabled for that translation regime, then: 


— Ifthe value of SCTLR_ELx.1 is 0, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Non-cacheable, Outer Non-cacheable. 


— Ifthe value of SCTLR_ELx.1 is 1, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Write-Through cacheable, Outer Write-Through 
cacheable. 


$ For the EL1&0 translation regime, if the value of SCTLR_EL1.M is 0, indicating that stage | translations are 
disabled for that translation regime, and the value of HCR_EL2.DC is 0: 


— Ifthe value of SCTLR_EL1.1 is 0, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Non-cacheable, Outer Non-cacheable. 


— Ifthe value of SCTLR_EL1.1 is 1, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Write-Through Cacheable, Outer Write-Through 
Cacheable. 


The effect of SCTLR_ELx.C, HCR_EL2.DC and HCR_EL2.CD is reflected in the result of the address translation 
instructions in the PAR when these bits have an effect on the stages of translation being reported in the PAR. 


Note 
è In conjunction with the requirements in Non-cacheable accesses and instruction caches on page D4-2477, 
the requirements in this section mean the architecturally required effect of SCTLR_ELx.I is limited to its 
effect on caching instruction accesses in unified caches. 
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: This specification can give rise to different cacheability attributes between instruction and data accesses to 
the same location. Where this occurs, the measures for mismatch memory attributes described in Mismatched 
memory attributes on page B2-153 must be followed to manage the corresponding loss of coherency. 


D4.4.5 Behavior of caches at reset 
In Armvs8: 
è All caches reset to IMPLEMENTATION DEFINED states that might be UNKNOWN. 


: The Cacheability control fields described in Enabling and disabling the caching of memory accesses on 
page D4-2475 reset to values that force all memory locations to be treated as Non-cacheable. 


Note 


This applies only to the controls that apply to the Translation regime that is used by the Exception level and 
Security state entered on reset. 








. An implementation can require the use of a specific cache initialization routine to invalidate its storage array 
before caching is enabled. The exact form of any required initialization routine is IMPLEMENTATION DEFINED, 
and the routine must be documented clearly as part of the documentation of the device. 


. If an implementation permits cache hits when the Cacheability control fields force all memory locations to 
be treated as Non-cacheable then the cache initialization routine must: 


— Provide a mechanism to ensure the correct initialization of the caches. 


— Be documented clearly as part of the documentation of the device. 


In particular, if an implementation permits cache hits when the Cacheability controls force all memory 
locations to be treated as Non-cacheable, and the cache contents are not invalidated at reset, the initialization 
routine must avoid any possibility of running from an uninitialized cache. It is acceptable for an initialization 
routine to require a fixed instruction sequence to be placed in a restricted range of memory. 


è Arm recommends that whenever an invalidation routine is required, it is based on the Armv8 cache 
maintenance instructions. 


See also TLB behavior at reset on page D5-2636. 


D4.4.6 Non-cacheable accesses and instruction caches 
In AArch64 state, instruction accesses to Non-cacheable Normal memory can be held in instruction caches. 


Correspondingly, the sequence for ensuring that modifications to instructions are available for execution must 
include invalidation of the modified locations from the instruction cache, even if the instructions are held in Normal 
Non-cacheable memory. This includes cases where System register Cacheability control fields force instruction 
accesses to memory to be Non-cacheable. 


Therefore when using self-modified code in Non-cacheable space in a uniprocessor system, the following sequence 
is required: 


; Enter this code with <Wt> containing the new 32-bit instruction 

; to be held at a location pointed to by <Xn> in Normal Non-cacheable memory. 
STR <Wt>, [Xn] 

DSB ISH; Ensure visibility of the data stored 

IC IVAU, [Xn] ; Invalidate instruction cache by VA to PoU 

DSB ISH; Ensure completion of the invalidations 

ISB ; 


In a multiprocessor system, the IC IVAU is broadcast to all PEs within the Inner Shareable domain of the PE running 
this sequence, but additional software steps might be required to synchronize the threads with other PEs. This might 
be necessary so that the PEs executing the modified instructions can execute an ISB after completing the 
invalidation, and to avoid issues associated with concurrent modification and execution of instruction sequences. 
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Larger blocks of instructions can be modified using the IC IALLU instruction for a uniprocessor system, or a IC 
TALLUIS for a multiprocessor system. 





Note 


This section applies even when the Cacheability control fields force instruction accesses to memory in AArch64 
state to be Non-cacheable, as described in Enabling and disabling the caching of memory accesses on 
page D4-2475. 





D4.4.7 About cache maintenance in AArch64 state 


D4-2478 


The following sections give general information about cache maintenance: 
$ Terms used in describing the cache maintenance instructions. 
7 The Armv8 abstraction of the cache hierarchy on page D4-2481. 


The following sections describe the A64 cache maintenance instructions: 


° The instruction cache maintenance instruction (IC) on page D4-2483. 
. The data cache maintenance instruction (DC) on page D4-2483. 
Note 





Some descriptions of the cache maintenance instructions refer to the cacheability of the address on which the 
instruction operates. The Cacheability of an address is determined by the applicable translation table entry for that 
address, as modified by any applicable System register Cacheability controls, such as the SCTLR_EL1.{I, C} 
controls. 





Terms used in describing the cache maintenance instructions 


Cache maintenance instructions are defined to act on particular memory locations. Instruction scope can be defined: 
s By the virtual address of the memory location to be maintained, referred to as operating by VA. 
° By a mechanism that describes the location in the hardware of the cache, referred to as operating by set/way. 


In addition, for instruction caches, there are instructions that invalidate all entries. 


The following subsections define the terms used in the descriptions of the cache maintenance instructions: 


. Terminology for cache maintenance instructions operating by set/way. 
. Terminology for Clean, Invalidate, and Clean and Invalidate instructions on page D4-2479. 
Note 





There is no terminology specific to cache maintenance instructions that operate by VA. When all applicable stages 
of translation are disabled, the VA used is identical to the PA. For more information about memory system behavior 
when address translation is disabled, see The effects of disabling a stage of address translation on page DS-2558. 





Terminology for cache maintenance instructions operating by set/way 


Cache maintenance instruction that operate by set/way refer to the particular structures in a cache. Three parameters 
describe the location in a cache hierarchy that an instruction works on. These parameters are: 


Level The cache level of the hierarchy. The number of levels of cache is IMPLEMENTATION DEFINED. The 
cache levels that can be managed using the architected cache maintenance instructions that operate 
by set/way can be determined from the CLIDR_EL1. 


In the Arm architecture, the lower numbered cache levels are those closest to the PE. See Memory 
hierarchy on page B2-133. 


Set Each level of a cache is split up into a number of sets. Each set is a set of locations in a cache level 
to which an address can be assigned. Usually, the set number is an IMPLEMENTATION DEFINED 
function of an address. 
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In the Arm architecture, sets are numbered from 0. 
Way The associativity of a cache is the number of locations in a set to which a specific address can be 
assigned. The way number specifies one of these locations. 


In the Arm architecture, ways are numbered from 0. 


Note 


Because the allocation of a memory address to a cache location is entirely IMPLEMENTATION DEFINED, Arm expects 
that most portable software will use only the cache maintenance instructions by set/way as single steps in a routine 
to perform maintenance on the entire cache. 








Terminology for Clean, Invalidate, and Clean and Invalidate instructions 
Caches introduce coherency problems in two possible directions: 


l. An update to a memory location by a PE that accesses a cache might not be visible to other observers that 
can access memory. This can occur because new updates are still in the cache and are not visible yet to the 
other observers that do not access that cache. 


25 Updates to memory locations by other observers that can access memory might not be visible to a PE that 
accesses a cache. This can occur when the cache contains an old, or stale, copy of the memory location that 
has been updated. 


The Clean and Invalidate instructions address these two issues. The definitions of these instructions are: 


Clean A cache clean instruction ensures that updates made by an observer that controls the cache are made 
visible to other observers that can access memory at the point to which the instruction is performed. 
Once the Clean has completed, the new memory values are guaranteed to be visible to the point to 
which the instruction is performed, for example to the Point of Unification. 


The cleaning of a cache entry from a cache can overwrite memory that has been written by another 
observer only if the entry contains a location that has been written to by an observer in the 
shareability domain of that memory location. 


Invalidate A cache invalidate instruction ensures that updates made visible by observers that access memory 
at the point to which the invalidate is defined, are made visible to an observer that controls the cache. 
This might result in the loss of updates to the locations affected by the invalidate instruction that 
have been written by observers that access the cache, if those updates have not been cleaned from 
the cache since they were made. 


If the address of an entry on which the invalidate instruction operates is Normal, Non-cacheable or 
any type of Device memory then an invalidate instruction also ensures that this address is not 
present in the cache. 


— Note 


Entries for addresses that are Normal Cacheable can be allocated to the cache at any time, and so 
the cache invalidate instruction cannot ensure that the address is not present in a cache. 





Clean and Invalidate 


A cache clean and invalidate instruction behaves as the execution of a clean instruction followed 
immediately by an invalidate instruction. Both instructions are performed to the same location. 


The points to which a cache maintenance instruction can be defined differ depending on whether the instruction 
operates by VA or by set/way: 


° For instructions operating by set/way, the point is defined to be to the next level of caching. For the All 
operations, the point is defined as the Point of Unification for each location held in the cache. 
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D4-2480 


For instructions operating by VA, the following conceptual points are defined: 
Point of Coherency (PoC) 


The point at which all agents that can access memory are guaranteed to see the same copy of a 
memory location for accesses of any memory type or cacheability attribute. In many cases this is 
effectively the main system memory, although the architecture does not prohibit the 
implementation of caches beyond the PoC that have no effect on the coherency between memory 
system agents. 


Note 


The presence of system caches can affect the determination of the point of coherency as described 
in System level caches on page D4-2494. 








Point of Unification (PoU) 


The PoU for a PE is the point by which the instruction and data caches and the translation table 
walks of that PE are guaranteed to see the same copy of a memory location. In many cases, the 
Point of Unification is the point in a uniprocessor memory system by which the instruction and 
data caches and the translation table walks have merged. 

The PoU for an Inner Shareable shareability domain is the point by which the instruction and data 
caches and the translation table walks of all the PEs in that Inner Shareable shareability domain 
are guaranteed to see the same copy of a memory location. Defining this point permits 
self-modifying software to ensure future instruction fetches are associated with the modified 
version of the software by using the standard correctness policy of: 


l. Clean data cache entry by address. 
2. Invalidate instruction cache entry by address. 


Point of Persistence (PoP) 


When ARMv8.2-DCPoP is implemented: 
The point ina memory system, if it exists, at or beyond the Point of Coherency, where 
a write to memory is maintained when system power is removed, and reliably 
recovered when power is restored to the affected locations in memory. 

When ARMv8.2-DCPoP and ARMv8.2-DCCVADP are implemented: 
The point in a memory system where there is a system guarantee that there is 
sufficient energy within the system to ensure that a write to memory will be persistent 
if system power is removed. 

Note 


Such memory is sometimes called non-volatile memory. For example, the Storage-class memory 
shown in Figure B2-1 on page B2-134 could be used as target memory for this feature. 








Point of Deep Persistence (PoDP) 


The point in a memory system where any writes that have reached that point are persistent, even 
in the event of an instantaneous hardware failure of the power sytem. 


The following fields in the CLIDR_ EL] relate to the PoC and PoU: 


LoC, Level of Coherence 


This field defines the last level of cache that must be cleaned or invalidated when cleaning or 
invalidating to the Point of Coherency. The LoC value is a cache level, so, for example, if LoC 
contains the value 3: 


° A clean to the Point of Coherency operation requires the level 1, level 2 and level 3 caches 
to be cleaned. 

° Level 4 cache is the first level that does not have to be maintained. 

If the LoC field value is 0x0, this means that no levels of cache need to cleaned or invalidated 

when cleaning or invalidating to the Point of Coherency. 

If the LoC field value is a nonzero value that corresponds to a level that is not implemented, this 

indicates that all implemented caches are before the Point of Coherency. 
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LoUU, Level of Unification, uniprocessor 


This field defines the last level of data cache that must be cleaned or invalidated when cleaning 
or invalidating to the Point of Unification for the PE. As with LoC, the LoUU value is a cache 
level. 


If the LoUU field value is 0x0, this means that no levels of data cache need to be cleaned or 
invalidated when cleaning or invalidating to the Point of Unification. 


If the LoUU field value is a nonzero value that corresponds to a level that is not implemented, 
this indicates that all implemented caches are before the Point of Unification. 
LoUIS, Level of Unification, Inner Shareable 
In any implementation: 
. This field defines the last level of data or unified cache that must be cleaned or invalidated 


when cleaning or invalidating to the Point of Unification for the Inner Shareable 
shareability domain. As with LoC, the LoUIS value is a cache level. 


° If the LoUIS field value is 0x0, this means that no levels of data or unified cache need to 
cleaned or invalidated when cleaning or invalidating to the Point of Unification for the 
Inner Shareable shareability domain. 


e If the LoUIS field value is a nonzero value that corresponds to a level that is not 
implemented, this indicates that all implemented caches are before the Point of 
Unification. 


The Armv8 abstraction of the cache hierarchy 


The following subsections describe the Armv8 abstraction of the cache hierarchy: 
à Cache maintenance instructions that operate by VA. 


: Cache maintenance instructions that operate by set/way. 


Cache maintenance instructions that operate by VA 


The VA-based cache maintenance instructions are described as operating by VA. Each of these instructions is always 
qualified as being one of: 


è Performed to the Point of Coherency. 
° Performed to the Point of Unification. 
$ When ARMv8.2-DCPoP is implemented, performed to the Point of Persistence. 


See Terms used in describing the cache maintenance instructions on page D4-2478 for definitions of these terms, 
and for more information about possible meanings of VA. 


A64 Cache maintenance instructions on page D4-2482 lists the VA-based maintenance instructions. 


The CTR_ELO holds minimum line length values for: 
° The instruction caches. 
. The data and unified caches. 


These values support efficient invalidation of a range of VAs, because this value is the most efficient address stride 
to use to apply a sequence of VA-based maintenance instructions to a range of VAs. 


For the Invalidate data or unified cache line by VA instruction, the Cache Write-back Granule field of the CTR_ELO 
defines the maximum granule that a single invalidate instruction can invalidate. This meaning of the Cache 
Write-back Granule is in addition to its defining the maximum size that can be written back. 


Cache maintenance instructions that operate by set/way 


A64 Cache maintenance instructions on page D4-2482 lists the set/way-based maintenance instructions. Some 
encodings of these instructions include a required field that specifies the cache level for the instruction: 


a A clean instruction cleans from the level of cache specified through to at least the next level of cache, moving 
further from the PE. 
° An invalidate instruction invalidates only at the level specified. 
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D4.4.8 A64 Cache maintenance instructions 


The A64 cache maintenance instructions are part of the A64 System instruction class in the register encoding space. 


For encoding details and other general information on these System instructions, see System instructions on 
page C3-192, SYS on page C6-1337 and Cache maintenance instructions, and data cache zero operation on 


page C5-367. 


Table D4-3 shows the AArch64 System instructions that perform instruction or data cache maintenance. 
Instructions that take an argument include Xt in the entry in the System instruction column. 





Note 
° In Table D4-3 the Point of Unification is the Point of Unification of the PE executing the cache maintenance 
instruction. 
è In general, the AArch32 instruction and data cache maintenance instructions provide equivalent functionality 


to the AArch64 cache maintenance instructions, see AArch32 cache and branch predictor maintenance 
instructions on page G4-5697. However, the data cache clean to the Point of Persistence instruction, 
implemented when ARMv8.2-DCPoP is implemented, is supported in AArch64 state only. 





Table D4-3 System instructions for cache maintenance 





System instruction Instruction 


Notes 





Instruction cache maintenance instructions 











Ic IALLUIS Invalidate all to Point of Unification, Inner Shareable EL1 or higher access. 
IC IALLU Invalidate all to Point of Unification EL1 or higher access. 
IC IVAU, Xt Invalidate by virtual address to Point of Unification When SCTLR_EL1.UCI# == 1, ELO access. 


Otherwise, EL1 or higher access. 





Data cache maintenance instructions 





























DC IVAC, Xt Invalidate by virtual address to Point of Coherency EL1 or higher access. 
DC ISW, Xt Invalidate by set/way ELI or higher access. 
DC CVAC, Xt Clean by virtual address to Point of Coherency When SCTLR_EL1.UCI@ == 1, ELO access. 
Otherwise EL1 or higher access. 
DC CVAP, Xt Clean by virtual address to Point of Persistence? When SCTLR_EL1.UCI? == 1, ELO access. 
Otherwise EL1 or higher access. 
DC CSW, Xt Clean by set/way EL] or higher access. 
DC CVAU, Xt Clean by virtual address to Point of Unification When SCTLR_EL1.UCI# == 1, ELO access. 
Otherwise EL1 or higher access. 
DC CIVAC, Xt Clean and invalidate by virtual address to When SCTLR_EL1.UCI# == 1, ELO access. 
Point of Coherency Otherwise EL1 or higher access. 
DC CISW, Xt Clean and invalidate by set/way EL1 or higher access. 





a. When HCR EL2.{E2H,TGE} == {1, 1}, the control is from SCTLR_EL2. 
b. Supported only when ARMv8.2-DCPoP is implemented. 


D4-2482 


A DSB or DMB instruction intended to ensure the completion of cache or branch predictor maintenance instructions 


must have an access type of both loads and stores. 
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The following subsections give more information about these instructions: 


è The instruction cache maintenance instruction (IC). 

. The data cache maintenance instruction (DC). 

° ELO accessibility of cache maintenance instructions on page D4-2485. 

. General requirements for the scope of maintenance instructions on page D4-2485. 


$ Effects of instructions that operate by VA to the PoC on page D4-2485. 
. Effects of instructions that operate by VA to the PoP on page D4-2486. 
s Effects of instructions that operate by VA to the PoU on page D4-2486. 
$ Effects of All and set/way maintenance instructions on page D4-2487. 


. Effects of virtualization and Security state on the cache maintenance instructions on page D4-2487. 
. Boundary conditions for cache maintenance instructions on page D4-2489. 

. Ordering and completion of data and instruction cache instructions on page D4-2489. 

e Performing cache maintenance instructions on page D4-2490. 


The instruction cache maintenance instruction (IC) 
System instructions on page C3-192 describes the A64 assembly syntax for this instruction. 


When an IC instruction requires an address argument this takes the form of a 64-bit register that holds the VA 
argument. No alignment restrictions apply for this address. 


Any cache maintenance instruction operating by VA includes as part of any required VA to PA translation: 
° For an instruction executed at EL1, or at EL2 when HCR_EL2.E2H==1, the current ASID. 


. The current Security state. 
° Whether the instruction was executed at EL1 or EL2. 
. For an instruction executed at EL1, the current VMID. 


That VA to PA translation might fault. However, for an instruction cache maintenance instruction that operates by 
VA: 


° It is IMPLEMENTATION DEFINED whether the instruction can generate: 
— An Access flag fault. 
— A Translation fault. 


5 The instruction cannot generate a Permission fault, except for: 


— The possible generation of a Permission fault by the execution of an IC IVAU instruction at ELO when 
the specified address does not have read access at ELO, as described in ELO accessibility of cache 
maintenance instructions on page D4-2485. 


— The possible Permission fault on a Stage 2 fault on a stage 1 translation table walk. 


For more information about possible faults on a cache maintenance instruction that operates by VA see VMSAv8-64 
memory aborts on page D5-2622. 


See also Ordering and completion of data and instruction cache instructions on page D4-2489. 


The data cache maintenance instruction (DC) 
System instructions on page C3-192 describes the A64 assembly syntax for this instruction. 


When a DC instruction requires a set/way/level argument this takes the form of a 64-bit register, the upper 32 bits of 
which are RESO. 


Ifa data cache maintenance by set/way instruction specifies a set, way, or level argument that is larger than the value 
supported by the implementation then the instruction is CONSTRAINED UNPREDICTABLE, see Out of range values of 
the Set/Way/Index fields in cache maintenance instructions on page K1-7644 or the instruction description. 


When a DC instruction requires an address argument this takes the form of a 64-bit register that holds the VA 
argument. No alignment restrictions apply for this address. 
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Any cache maintenance instruction operating by VA includes as part of any required VA to PA translation: 
. For an instruction executed at EL1, or at EL2 when HCR_EL2.E2H is 1, the current ASID. 


. The current Security state. 
. Whether the instruction is executed at EL1 or EL2. 
. For an instruction executed at EL1, the current VMID. 


That VA to PA translation might fault. However, a data or unified cache maintenance instruction that operates by 
VA cannot generate a Permission fault except in the following cases: 


° The possible generation of a Permission fault by: 
— The execution ofa DC IVAC instruction when the specified address does not have write permission. 


— The execution of an enabled DC « instruction at ELO when the specified address does not have read 
access at ELO, as described in ELO accessibility of cache maintenance instructions on page D4-2485. 


The description of Permission faults includes possible constraints on the generation of Permission faults on 
cache maintenance by VA instructions. 


a The possible Permission fault on a Stage 2 fault on a stage 1 translation table walk. 


For more information about possible faults on a VA to PA translation see VMSAv8-64 memory aborts on 
page DS-2622. 


When executed at EL1, a DC ISW instruction performs a clean and invalidate, meaning it performs the same 
maintenance as a DC CISW instruction, if all of the following apply: 


s EL2 is implemented and enabled in the current Security state. 

- Either: 
— The value of HCR_EL2.SWIO is 1, forcing a cache clean to perform a clean and invalidate. 
— The value of HCR_EL2.VM is 1, meaning EL1&0 stage two address translation is enabled. 


When executed at EL1, a DC IVAC instruction performs a clean and invalidate, meaning it performs the same 
maintenance as a DC CIVAC instruction, if all of the following apply: 


s EL2 is implemented and enabled in the current Security state. 
s The value of HCR_EL2.VM is 1, meaning EL1&0 stage two address translation is enabled. 





Note 


The forcing of a clean instruction to perform a clean invalidate applies to the AArch32 cache maintenance 
instructions DCIMVAC and DCISW. See AArch32 data cache maintenance instructions (DC*) on page G4-5699. 





When ARMv8.2-DCPoP is implemented, meaning the DC CVAP instruction is implemented, if the memory system 
does not support the Point of Persistence, a data cache clean to the PoP, DC CVAP, behaves as a data cache clean to 
the PoC, DC CVAC. 





Note 

° Support for the Point of Persistence does not change the definition or behavior of the CLIDR_EL1 System 
register. 

è Because a DSB SYS instruction will not complete until all previous DC CVAP instructions have completed, the 


following sequence can be used to ensure the completion of any store to the Point of Persistence, where the 
store might be to Non-cacheable memory: 


DMB ; Note this can be any DMB that applies to both loads and stores 
DC CVAP, Xt 
DSB SYS 
è If caches that are invisible to the programmer exist beyond the Point of Coherency but before the Point of 


Persistence and hold data that is marked as Non-cacheable, the DC CVAP operation causes the Non-cacheable 
locations to be cleaned from those caches. 


If a memory fault that sets the FAR for the translation regime applicable for the cache maintenance instruction is 
generated from a data cache maintenance instruction, the FAR holds the address specified in the register argument 
of the instruction. 
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Note 


Despite its mnemonic, DC ZVA is not a cache maintenance instruction. 








See also ELO accessibility of cache maintenance instructions and Ordering and completion of data and instruction 
cache instructions on page D4-2489. 


ELO accessibility of cache maintenance instructions 


The SCTLR_EL1.UCI bit enables ELO access for the DC CVAU, DC CVAC, DC CVAP, DC CIVAC, and IC IVAU instructions. 
When ELO use of these instructions is disabled because SCTLR_EL1.UCI == 0, executing one of these instructions 
at ELO generates a trap to EL1, that is reported using EC = 0x18. When HCR_EL2.{E2H,TGE} == 1, the control is 
from SCTLR_EL2. 





Note 
DC CVAP is implemented only if ARMv8.2-DCPoP is implemented. 





For these instructions read access permission is required. When the value of SCTLR_EL1.UCT is 1: 


° For the DC CVAU, DC CVAC, DC CVAP, and DC CIVAC instructions, if the instruction is executed at ELO and the 
address specified in the argument cannot be read at ELO, a Permission fault might be generated. 


` For the IC IVAU instruction, if the instruction is executed at ELO and the address specified in the argument 
cannot be read at ELO, it is IMPLEMENTATION DEFINED whether a Permission fault is generated. 


For more information see the description of Permission faults, In the case of a DC « instruction executed at ELO when 
the address specified cannot be read at ELO the Permission fault is generated unless one of the permitted constraints 
described in that section applies and means the fault cannot be generated. 


Software can read the CTR_ELO to discover the stride needed for cache maintenance instructions. The 
SCTLR_EL1.UCT bit enables ELO access to the CTR_ELO. When ELO access to the Cache Type register is 
disabled, a register access instruction executed at ELO is trapped to EL1 using EC = 0x18. 


General requirements for the scope of maintenance instructions 


The Armv8 specification of the cache maintenance instructions describes what each instruction is guaranteed to do 
in a system. It does not limit other behaviors that might occur, provided they are consistent with the requirements 
described in General behavior of the caches on page D4-2471, Behavior of caches at reset on page D4-2477, and 
Preloading caches on page B2-137. 


This means that as a side-effect of a cache maintenance instruction: 





° Any location in the cache might be cleaned. 
è Any unlocked location in the cache might be cleaned and invalidated. 
Note 


Arm recommends that, for best performance, such side-effects are kept to a minimum. Arm strongly recommends 
that the side-effects of operations performed in Non-secure state do not have a significant performance impact on 
execution in Secure state. 





Effects of instructions that operate by VA to the PoC 


For Normal memory that is not Inner Non-cacheable, Outer Non-cacheable, cache maintenance instructions that 
operate by VA to the PoC must affect the caches of other PEs in the shareability domain described by the shareability 
attributes of the VA supplied with the instruction. 


For Device memory and Normal memory that is Inner Non-cacheable, Outer Non-cacheable, these instructions must 
affect the caches of all PEs in the Outer Shareable shareability domain of the PE on which the instruction is 
operating. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D4-2485 
Non-Confidential 


The AArch64 System Level Memory Model 


D4.4 Cache support 


In all cases, for any affected PE, these instructions affect all data and unified caches to the PoC. Table D4-4 shows 
the scope of these Data and unified cache maintenance instructions. 


Table D4-4 PEs affected by cache maintenance instructions to the PoC 





Shareability 


PEs affected Effective to 





Non-shareable 


The PE executing the instruction The PoC of the entire system 





Inner Shareable 


All PEs in the same Inner Shareable shareability domain as the PE executing the The PoC of the entire system 
instruction 





Outer Shareable 


All PEs in the same Outer Shareable shareability domain as the PE executing the The PoC of the entire system 
instruction 





Effects of instructions that operate by VA to the PoP 


For Normal memory that is not Inner Non-cacheable, Outer Non-cacheable, cache maintenance instructions that 
operate by VA to the PoP must affect the caches of other PEs in the shareability domain described by the shareability 
attributes of the VA supplied with the instruction. 


For Device memory and Normal memory that is Inner Non-cacheable, Outer Non-cacheable, these instructions must 
affect the caches of all PEs in the Outer Shareable shareability domain of the PE on which the instruction is 
operating. 


In all cases, for any affected PE, these instructions affect all data and unified caches to the PoP. Table D4-5 shows 
the scope of these Data and unified cache maintenance to the PoP instructions. 


Table D4-5 PEs affected by cache maintenance instructions to the PoP 





Shareability 


PEs affected Effective to 





Non-shareable 


The PE executing the instruction The PoPof the entire system 





Inner Shareable 


All PEs in the same Inner Shareable shareability domain as the PE executing the The PoP of the entire system 
instruction 











Outer Shareable All PEs in the same Outer Shareable shareability domain as the PE executing the The PoP of the entire system 
instruction 
Effects of instructions that operate by VA to the PoU 
For cache maintenance instructions that operate by VA to the PoU, Table D4-6 shows how, for a VA in a Normal or 
Device memory location, the shareability attribute of the VA determines the minimum set of PEs affected, and the 
point to which the instruction must be effective. 
Table D4-6 PEs affected by cache maintenance instructions to the PoU 
Shareability PEs affected Effective to 





Non-shareable 


The PE executing the instruction The PoU of instruction cache fills, data cache fills and write-backs, and 
translation table walks, on the PE executing the instruction 








Inner Shareable or All PEs in the same Inner The PoU of instruction cache fills, data cache fills and write-backs, and 
Outer Shareable Shareable shareability domainas translation table walks, of all PEs in the same Inner Shareable shareability 
the PE executing the instruction domain as the PE executing the instruction 
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Note 


The set of PEs guaranteed to be affected is never greater than the PEs in the Inner Shareable shareability domain 
containing the PE executing the instruction. 





Effects of All and set/way maintenance instructions 
The IC IALLU and DC set/way instructions apply only to the caches of the PE that performs the instruction. 


The IC IALLUIS instruction can affect the caches of all PEs in the same Inner Shareable shareability domain as the 
PE that performs the instruction. This instruction has an effect to the Point of Unification of instruction cache fills, 
data cache fills, and write-backs, and translation table walks, of all PEs in the same Inner Shareable shareability 
domain. 





Note 


The possible presence of system caches, as described in System level caches on page D4-2494, means architecture 
does not guarantee that all levels of the cache can be maintained using set/way instructions. 





Effects of virtualization and Security state on the cache maintenance instructions 
Each Security state has its own physical address (PA) space, therefore cache entries are associated with PA space. 


Table D4-7 shows the effects of virtualization and security on the cache maintenance instructions. In the table, the 
Specified entries are entries that the architecture requires the instruction to affect. The rules described in General 
behavior of the caches on page D4-2471 mean that an instruction might also affect other entries. 


Table D4-7 Effects of virtualization and security on the maintenance instructions 


Cache maintenance Security 


instructions state Specingdentries 





Data or unified cache maintenance instructions 





Invalidate, Clean, or Clean Both All lines that hold the PA that, in the current Security state, is mapped to by the 
and Invalidate by VA: combination of all of: 

DC IVAC, DC CVAC, DC CVAP, ° The specified VA. 

DC CVAU, DC CIVAC, DC CVAP ° For an instruction executed at EL1, ELO, or at EL2 when HCR_EL2.E2H is 


set to 1 the current ASID if the location is mapped to by a non-global page. 


° For an instruction executed at ELO or EL1 when SCR_EL3.NS == 1 or 
SCR_EL3.EEL2 = 1, the current VMID.4 





Invalidate, Clean, or Clean Non-secure Line specified by set/way provided that the entry comes from the Non-secure PA 
and Invalidate by set/way: space. 


DC ISW, DC CSW, DC CISW 





Secure Line specified by set/way regardless of the PA space that the entry has come from. 
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Table D4-7 Effects of virtualization and security on the maintenance instructions (continued) 





Cache maintenance 


instructions 


Security 


state Specified entries 





Instruction cache maintenance instructions 








Invalidate by VA: Both All lines corresponding to the specified VA® in the current translation regime and: 
IC IVAU . For an instruction executed at EL1, ELO, or at EL2 when HCR_EL2.E2H is 
set to 1 the current ASID. 
: For an instruction executed at ELO or EL1 when SCR_EL3.NS == 1 or 
SCR_EL3.EEL2 = 1, the current VMID.4 
Invalidate All: Both For an instruction executed at: 


IC IALLU, IC TALLUIS 


s EL1 when SCR_EL3.NS ==1 or SCR_EL3.EEL2 == 1, all instruction cache 
lines containing entries associated with the current VMID. 

s EL2 when SCR_EL3.NS ==1, all instruction cache lines containing 
Non-secure entries. 

7 EL1 when the Effective value of SCR_EL3.{EEL2, NS} is {0,0}, EL2 
when SCR_EL3.EEL2 is 1, or EL3, all instruction cache lines. 





a. Dependencies on the VMID apply even when HCR_EL2.VM is set to 0. VTTBR_EL2.VMID resets to zero, meaning there is a valid VMID. 
b. The type of instruction cache used affects the interpretation of the specified entries in this table such that: 

O For a PIPT instruction cache, the cache maintenance applies to all entries whose physical address corresponds to the specified address. 

O For a VIPT instruction cache, the cache maintenance applies to entries whose virtual index and physical tag corresponds to the specified 


address. 


For information on types of instruction cache see Jnstruction caches on page D5-2655. 


For locked entries and entries that might be locked, the behavior of cache maintenance instructions described in The 
interaction of cache lockdown with cache maintenance instructions on page D4-2493 applies. 


With an implementation that generates aborts if entries are locked or might be locked in the cache, when the use of 
lockdown aborts is enabled, these aborts can occur on any cache maintenance instructions. 


In an implementation that includes EL2: 


The architecture does not require cache cleaning when switching between virtual machines. Cache 
invalidation by set/way must not present an opportunity for one virtual machine to corrupt state associated 
with a second virtual machine. To ensure this requirement is met, invalidate by set/way instructions can, 
instead, perform a clean and invalidate by set/way. 


As described in The data cache maintenance instruction (DC) on page D4-2483, the AArch64 Data cache 
invalidate instructions, DC IVAC and DC ISW, when executed at EL1 and ELO, and the AArch32 Data cache 
invalidate instructions DCIMVAC and DCISW, when executed at EL1, can be configured to perform a cache clean 
as well as a cache invalidation. 


TLB and instruction cache invalidate instructions executed at EL1 are broadcast across the Inner Shareable 
domain when all of the following is true: 


— When the value of HCR_EL2.FB is 1. 
= EL3 is not implemented, or EL3 is implemented and either SCR_EL3.NS == 1 or SCR_EL3.EEL2 


When EL] is using AArch64, this applies to the IC IALLU instruction. This means the instruction performs 
the invalidation that would be performed by the corresponding Inner Shareable instruction IC IALLUIS. 


For more information about the cache maintenance instructions, see About cache maintenance in AArch64 state on 
page D4-2478, A64 Cache maintenance instructions on page D4-2482, and Chapter D5 The AArch64 Virtual 
Memory System Architecture. 


D4-2488 
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Boundary conditions for cache maintenance instructions 


Cache maintenance instructions operate on the caches regardless of whether the System register Cacheability 
controls force all memory accesses to be Non-cacheable. 


For VA-based cache maintenance instructions, the instruction operates on the caches regardless of the memory type 
and cacheability attributes marked for the memory address in the VMSA translation table entries. This means that 
the effects of the cache maintenance instructions can apply regardless of: 


Whether the address accessed: 
— Is Normal memory or Device memory. 
— Has the Cacheable attribute or the Non-cacheable attribute. 


Any applicable domain control of the address accessed. 


The access permissions for the address accessed, other than the effect of the stage two write permission on 
data or unified cache invalidation instructions. 


Ordering and completion of data and instruction cache instructions 


All data cache instructions, other than DC ZVA, that specify an address: 


Execute in program order relative to loads or stores which: 


— Access an address in Normal memory with either Inner Write Through or Inner Write Back attributes 
within the same cache line of minimum size, as indicated by CTR_ELO.DMinLine. 


— Usean address with the same cacheability attributes as the address passed to the data cache instruction. 


Can execute in any order relative to loads or stores which: 


— Access an address in Normal memory with either Inner Write Through or Inner Write Back attributes 
within the same cache line of minimum size, as indicated by CTR_ELO.DMinLine. 


—  Usean address with different cacheability attributes as the address passed to the data cache instruction. 


— Do not have a DMB or DSB executed between the load or store instruction and the data cache 
instruction. 


Can execute in any order relative to loads or stores that access any address with the Device memory attribute, 
or with Normal memory with Inner Non-cacheable attribute unless a DMB or DSB is executed between the 
instructions. 


Execute in program order relative to other data cache instructions, other than DC ZVA, that specify an address 
within the same cache line of minimum size, as indicated by CTR_ELO.DMinLine. 


Can execute in any order relative to loads or stores that access an address in a different cache line of minimum 
size, as indicated by CTR_EL0.DMinLine, unless a DMB or DSB is executed between the instructions. 


Can execute in any order relative to other data cache instructions, other than DC ZVA, that specify an address 
in a different cache line of minimum size, as indicated by CTR_ELO.DMinLine, unless a DMB or DSB is 
executed between the instructions. 


Can execute in any order relative to data cache maintenance instructions that do not specify an address unless 
a DMB or DSB is executed between the instructions. 


Note 


Despite its mnemonic, the DC ZVA, Data Cache Zero by VA instruction is not a data cache maintenance 
instruction. 








Can execute in any order relative to instruction cache maintenance instructions unless a DSB is executed 
between the instructions. 
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Note 
. Data cache ordering rules by address are consistent with physically indexed physically tagged caches. See 
Data and unified caches on page D5-2655. 


‘ Data cache zero instruction on page D4-2492 describes the ordering and completion rules for Data Cache 
Zero. 





All data cache maintenance instructions that do not specify an address: 


e Can execute in any order relative to data cache maintenance instructions that do not specify an address unless 
a DMB or DSB is executed between the instructions. 


$ Can execute in any order relative to data cache maintenance instructions that specify an address, other than 
Data Cache Zero, unless a DMB or DSB is executed between the instructions. 


° Can execute in any order relative to loads or stores unless a DMB or DSB is executed between the instructions. 


° Can execute in any order relative to instruction cache maintenance instructions unless a DSB is executed 
between the instructions. 


All instruction cache maintenance instructions can execute in any order relative to other instruction cache 
instructions, data cache instructions, loads, and stores unless a DSB is executed between the instructions. 


A cache maintenance instruction can complete at any time after it is executed, but is only guaranteed to be complete, 
and its effects visible to other observers, following a DSB instruction executed by the PE that executed the cache 
maintenance instruction. See also the requirements for cache maintenance instructions in Completion and endpoint 
ordering on page B2-120. 


In all cases, where the text in this section refers to a DMB or a DSB, this means a DMB or DSB whose required access type 
is both loads and stores. 


— Note 

These ordering requirements are extended from the requirements in AArch32 state given in: 
$ Ordering of cache and branch predictor maintenance instructions on page G4-5705. 
. AArch32 instruction cache maintenance instructions (IC*) on page G4-5698. 





Performing cache maintenance instructions 


To ensure all cache lines in a block of address space are maintained through all levels of cache Arm strongly 
recommends that software: 


è For data or unified cache maintenance, uses the CTR_EL0.DMinLine value to determine the loop increment 
size for a loop of data cache maintenance by VA instructions. 


7 For instruction cache maintenance, uses the CTR_ELO.IMinLine value to determine the loop increment size 
for a loop of instruction cache maintenance by VA instructions. 


Example code for cache maintenance instructions 


The cache maintenance instructions by set/way can clean or invalidate, or both, the entirety of one or more levels 
of cache attached to a PE. However, unless all PEs attached to the caches regard all memory locations as 
Non-cacheable, it is not possible to prevent locations being allocated into the cache during such a sequence of the 
cache maintenance instructions. 





Note 


Since the set/way instructions are performed only locally, there is no guarantee of the atomicity of cache 
maintenance between different PEs, even if those different PEs are each executing the same cache maintenance 
instructions at the same time. Since any cacheable line can be allocated into the cache at any time, it is possible for 
a cache line to migrate from an entry in the cache of one PE to the cache of a different PE in a way that means the 
line is not affected by set/way based cache maintenance. Therefore, Arm strongly discourages the use of set/way 
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instructions to manage coherency in coherent systems. The expected use of the cache maintenance instructions that 
operate by set/way is limited to the cache maintenance associated with the powerdown and powerup of caches, if 
this is required by the implementation. 


The limitations of cache maintenance by set/way mean maintenance by set/way does not happen on multiple PEs, 
and cannot be made to happen atomically for each address on each PE. Therefore in multiprocessor or multithreaded 
systems, the use of cache maintenance by set/way to clean, or clean and invalidate, the entire cache for coherency 
management with very large buffers or with buffers with unknown address can fail to provide the expected 
coherency results because of speculation by other PEs, or possibly by other threads. The only way that these 
instructions can be used in this way is to first ensure that all PEs that might cause speculative accesses to caches that 
need to be maintained are not capable of generating speculative accesses. This can be achieved by ensuring that 
those PEs have no memory locations with a Normal Cacheable attribute. Such an approach can have very large 
system performance effects, and Arm advises implementers to use hardware coherency mechanisms in systems 
where this will be an issue. 


System level caches on page D4-2494 refers to other limitations of cache maintenance by set/way. 





The following example code for cleaning a data or unified cache to the Point of Coherency illustrates a generic 
mechanism for cleaning the entire data or unified cache to the Point of Coherency. It assumes that the current Cache 
Size Identification Register is in 32-bit format. For more information, see Possible formats of the Cache Size 
Identification Register, CCSIDR_EL1 on page D4-2473. 


MRS X@, CLIDR_EL1 





AND 3, WO, #0x07000000 // Get 2 x Level of Coherence 

LSR 3, W3, #23 

CBZ 3, Finished 

MOV 10, #0 // W10 = 2 x cache level 

MOV 8, #1 // W8 = constant 0b1 
Loop1: ADD 2, W10, W10, LSR #1 // Calculate 3 x cache level 

LSR 1, WO, W2 // extract 3-bit cache type for this level 

AND 1, W1, #0x7 

CMP 1, #2 

B.LT Skip // No data or unified cache at this level 

MSR CSSELR_EL1, X10 // Select this cache level 

ISB // Synchronize change of CSSELR 

MRS X1, CCSIDR_EL1 // Read CCSIDR 

AND 2, W1, #7 // W2 = log2(linelen)-4 

ADD 2, W2, #4 // W2 = 1og2(linelen) 

UBFX 4, W1, #3, #10 // W4 = max way number, right aligned 

CLZ 5, W4 // W5 = 32-log2(ways), bit position of way in DC operand 

LSL 9, W4, W5 // W9 = max way number, aligned to position in DC operand 

LSL 16, W8, W5 // W16 = amount to decrement way number per iteration 
Loop2: UBFX 7, W1, #13, #15 // W7 = max set number, right aligned 

LSL 7, W7, W2 // W7 = max set number, aligned to position in DC operand 

LSL 17, W8, W2 // W17 = amount to decrement set number per iteration 
Loop3: ORR 11, W10, w9 // W11 = combine way number and cache number .. 

ORR 11, W11, W7 // ... and set number for DC operand 

DC CSW, X11 // Do data cache clean by set and way 

SUBS 7, W7, W17 // Decrement set number 

B.GE Loop3 

SUBS X9, X9, X16 // Decrement way number 

B.GE Loop2 


Skip: ADD W10, W10, #2 











// Increment 2 x cache level 


CMP W3, W10 


DSB 


B.GT Loop1 


Finished: 


Similar approaches can be used for all cache maintenance instructions. 
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D4.4.9 Data cache zero instruction 


The Data Cache Zero by Address instruction, DC ZVA, writes 0x00 to each byte of a block of N bytes, aligned in 
memory to N bytes in size, where: 


s The block in memory is identified by the address supplied as an argument to the DC ZVA instruction. There are 
no alignment restrictions on this address. 


Note 


This means that each byte of the block of memory that includes the supplied address is set to zero. 








s The DCZID_ELO register indicates the block size, N bytes, that is written with byte values of zero. 


Software can restrict access to this instruction. See Configurable instruction enables and disables, and trap controls 
on page D1-2326 and the description of the DC ZVA instruction. 


The DC ZVA instruction behaves as a set of stores to the location being accessed, and: 


° Generates a Permission fault if the translation regime being used when the instruction is executed does not 
permit writes to the locations. 

s Requires the same considerations for ordering and the management of coherency as any other store 
instruction. 


In addition: 


$ When the instruction is executed, it can generate memory faults or watchpoints that are prioritized in the same 
way as other memory related faults or watchpoints. Where a synchronous Data Abort fault or a watchpoint 
is generated, the CM bit in the syndrome field is not set to 1, which would be the case for all other cache 
maintenance instructions. See ZSS encoding for an exception from a Data Abort on page D13-2943 for more 
information about the encoding of the associated ESR_ELx.ISS field. 


s If the memory region being zeroed is any type of Device memory, then DC ZVA generates an Alignment fault 
which is prioritized in the same way as other alignment faults that are determined by the memory type. 


— Note 


The architecture makes no statements about whether or not a DC ZVA instruction causes allocation to any particular 
level of the cache, for addresses that have a cacheable attribute for those levels of cache. 


Despite its mnemonic, the DC ZVA instruction is not a data cache maintenance instruction. 


D4.4.10 Cache lockdown 


D4-2492 


The concept of an entry locked in a cache is allowed, but not architecturally defined. How lockdown is achieved is 
IMPLEMENTATION DEFINED and might not be supported by: 


$ An implementation. 
° Some memory attributes. 
An unlocked entry in a cache might not remain in that cache. The architecture does not guarantee that an unlocked 


cache entry remains in the cache or remains incoherent with the rest of memory. Software must not assume that an 
unlocked item that remains in the cache remains dirty. 


A locked entry in a cache is guaranteed to remain in that cache. The architecture does not guarantee that a locked 
cache entry remains incoherent with the rest of memory, that is, it might not remain dirty. 
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The interaction of cache lockdown with cache maintenance instructions 


The interaction of cache lockdown and cache maintenance instructions is IMPLEMENTATION DEFINED. However, an 
architecturally-defined cache maintenance instruction on a locked cache line must comply with the following 
general rules: 


è The effect of the following instructions on locked cache entries is IMPLEMENTATION DEFINED: 
— Cache clean by set/way, DC CSW. 
— Cache invalidate by set/way, DC ISW. 
— Cache clean and invalidate by set/way, DC CISW. 
— Instruction cache invalidate all, IC IALLU and IC IALLUIS. 
However, one of the following approaches must be adopted in all these cases: 
1. If the instruction specified an invalidation, a locked entry is not invalidated from the cache. 
2. If the instruction specified a clean it is IMPLEMENTATION DEFINED whether locked entries are cleaned. 


3. If an entry is locked down, or could be locked down, an IMPLEMENTATION DEFINED Data Abort 
exception is generated, using the DFSC value defined for this purpose, see JSS encoding for an 
exception from a Data Abort on page D13-2943. 


This permits a usage model for cache invalidate routines to operate on a large range of addresses by 
performing the required operation on the entire cache, without having to consider whether any cache entries 
are locked. 


The effect of the following instructions is IMPLEMENTATION DEFINED: 
° Cache clean by virtual address, DC CVAC, DC CVAP, and DC CVAU. 
° Cache invalidate by virtual address, DC IVAC. 

5 Cache clean and invalidate by virtual address, DC CIVAC. 


However, one of the following approaches must be adopted in all these cases: 


1. If the instruction specified an invalidation, a locked entry is invalidated from the cache. For the clean and 
invalidate instructions, the entry must be cleaned before it is invalidated. 


2. If the instruction specified an invalidation, a locked entry is not invalidated from the cache. If the instruction 
specified a clean it is IMPLEMENTATION DEFINED whether locked entries are cleaned. 


3. If an entry is locked down, or could be locked down, an IMPLEMENTATION DEFINED Data Abort exception is 
generated, using the DFSC value defined for this purpose. See ESR_ELx on page K14-7814. 


In an implementation that includes EL2 enabled in the current Security state, if HCR_EL2.TIDCP is set to 1, any 
exception relating to lockdown of an entry is routed to EL2. 


Note 


An implementation that uses an abort mechanism for entries that can be locked down but are not actually locked 
down must: 





$ Document the IMPLEMENTATION DEFINED instruction sequences that perform the required operations on 
entries that are not locked down. 


. Implement one of the other permitted alternatives for the locked entries. 


Arm recommends that, when possible, such IMPLEMENTATION DEFINED instruction sequences use 
architecturally-defined instructions. This minimizes the number of customized instructions required. 


In addition, an implementation that uses an abort to handle cache maintenance instructions for entries that might be 
locked must provide a mechanism that ensures that no entries are locked in the cache. 


The reset setting of the cache must be that no cache entries are locked. 
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Additional cache functions for the implementation of lockdown 


An implementation can add additional cache maintenance functions for the handling of lockdown in the 
IMPLEMENTATION DEFINED spaces reserved for Cache Lockdown, see Reserved encodings for IMPLEMENTATION 
DEFINED registers on page D12-2815. 


D4.4.11 System level caches 


The Arm Architecture defines a system cache as a cache that is not described in the PE Cache Identification 
registers, CCSIDR_EL1 and CLIDR_EL1, and for which the set/way cache maintenance instructions do not apply. 


Conceptually, three classes of system cache can be envisaged: 


l. System caches which lie before the point of coherency and cannot be managed by any cache maintenance 
instructions. Such systems fundamentally undermine the concept of cache maintenance instructions 
operating to the point of coherency, as they imply the use of non-architecture mechanisms to manage 
coherency. The use of such systems in the Arm architecture is explicitly prohibited. 


2. System caches which lie before the point of coherency and can be managed by cache maintenance by address 
instructions that apply to the point of coherency, but cannot be managed by cache maintenance by set/way 
instructions. Where maintenance of the entirety of such a cache must be performed, as in the case for power 
management, it must be performed using non-architectural mechanisms. 


3. System caches which lie beyond the point of coherency and so are invisible to the software. The management 
of such caches is outside the scope of the architecture. 


D4.4.12 Branch prediction 


Armv§8 does not define any branch predictor maintenance instructions for AArch64 state. 


If branch prediction is architecturally visible, cache maintenance must also apply to branch prediction. 


D4.4.13 Execution and data prediction restriction System instructions 


D4-2494 


When ARMv8.0-PredInv is implemented, the System instructions listed in 464 System instructions for prediction 
restriction on page C5-739 prevent predictions based on information gathered from earlier execution within a 
particular execution context from affecting the later Speculative execution within that context, to the extent that the 
speculative execution is observable through side-channels. 


The prediction restriction System instructions being used by a particular execution context apply to: 


° All control flow prediction resources that predict execution addresses. 
° Data value prediction. 
e Cache allocation prediction. 


For these System instructions, the execution context is defined by: 

° The SCR_EL3.NS bit. 

è The Exception level. 

° When executing at EL1, the VMID. 

$ When executing at ELO when using the EL1&0 translation regime, the ASID and VMID. 


$ When executing at ELO when using the EL2&0 translation regime, the VMID. 


Note 


è The data value prediction applies to all prediction resources that use some form of training to speculate data 
values as part of an execution. 
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: The cache allocation applies to all instruction and data caches, and TLB prefetching hardware used by the 
executing PE that applies to the supplied context. 





The context information is passed as a register argument, and is restricted so that: 


è Execution of the System instruction at ELO only applies to the current hardware defined context. 

7 Execution of the System instruction at EL1only applies to the current VMID and Security state, and does not 
apply to EL2 or EL3. 

° Execution of the System instruction at EL2 can only apply to the current Security state, and does not apply 
to EL3. 


Ifthe System instruction is specified to apply to Exception levels that are not implemented, or which are higher than 
the Exception level that the System instruction is executed at, then the System instruction is treated as a NOP. 


When the System instruction is complete and synchronized, no predictions of the restricted type for the affected 
context are influenced by the execution of the program before the System instruction in a manner that can be 
observed by the use of any side channels. 





Note 


Prediction restriction System instructions do not require the invalidation of prediction structures so long as the 
behavior described for completion is met by an implementation. 





These System instructions are guaranteed to be complete following a DSB that covers both read and write behavior 
on the same PE that executed the original instruction. A subsequent Context synchronization event is required to 
ensure that the effect of the completion of the instructions is synchronized to the current execution. 


In AArch64 state, ELO access to the System instructions is controlled by: 
s When HCR_EL2.{E2H, TGE} is not {1, 1}, SCTLR_EL1.EnRCTX. 


* When HCR_EL2.{E2H, TGE} == {1, 1}, SCTLR_EL2.EnRCTX. 
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D4.5 External aborts 


The Arm architecture defines External aborts as errors that occur in the memory system, other than those that are 
detected by the MMU or debug logic. An External abort might signal a data corruption to the PE. For example, a 
memory location might have been corrupted, and this corruption is detected by hardware using a parity or error 
correction code (ECC). The error might have been propagated. The RAS Extension provides mechanisms for 
software to determine the extent of the corruption and contain propagation of the error. For more information, see 
the ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMV8, for the ARMvS8-A architecture 
profile. 


An External abort is one of the following: 


. Synchronous. 
. Precise asynchronous. 
° Imprecise asynchronous. 


For more information, see Exception terminology on page D1-2269. 


The RAS Extension provides a more granular taxonomy of aborts. When the RAS Extension is not implemented, 
the Arm architecture does not provide any method to distinguish between precise asynchronous and imprecise 
asynchronous External aborts. 


It is IMPLEMENTATION DEFINED which External aborts, if any, are supported. 


External aborts on data accesses and translation table walks on data accesses can be either synchronous or 
asynchronous. 


When ARMv8.4-DFE is not implemented, External aborts on instruction fetches and translation table walks on 
instruction fetches can be either synchronous or asynchronous. 


When ARMv8.4-DFE is implemented, all External abort exceptions on instruction fetches and translation table 
walks on instruction fetches must be synchronous. 


A synchronous External abort on an instruction fetch, including a translation table walk on an instruction fetch, is 
taken precisely using the Instruction Abort exception. 


A synchronous External abort on a data read or write, including a translation table walk on a data read or write, is 
taken precisely using the Data Abort exception. 


See Synchronous exception types, routing and priorities on page D1-2307. 


An asynchronous External abort is taken using the SError interrupt exception. See Asynchronous exception types, 
routing, masking and priorities on page D1-2316. 


The effect of a failed memory access is described in Effect of Data Aborts on page D1-2312. 


Normally, External aborts are rare. An imprecise asynchronous External abort is likely to be fatal to the process that 
is running, Arm recommends that implementations make External aborts precise wherever possible. 


The following subsections give more information about possible External aborts: 
° Provision for the classification of External aborts. 


7 Parity or ECC error reporting, RAS Extension not implemented on page D4-2497. 


D4.5.1 Provision for the classification of External aborts 


D4-2496 


In AArch64 state, an implementation can use ESR_ELx.EA, ISS[9], to provide more information about 
synchronous External aborts. For all synchronous aborts other than synchronous External aborts, ESR_ELx.EA, 
ISS[9], returns a value of 0. 


If the RAS Extension is implemented: 
$ The ESR_ELx.SET field provides information about the state of the PE following a synchronous External 


abort. 
$ The ESR_ELx.AET field might contain more information following an asynchronous abort taken as an 
SError interrupt. 
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° The implementation might define error record registers. 


For more information, see: 

è ISS encoding for an exception from an Instruction Abort on page D13-2941. 

s ISS encoding for an exception from a Data Abort on page D13-2943. 

7 ISS encoding for an SError interrupt on page D13-2989. 

. ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMV8, for the ARMv8-A architecture 
profile. 


D4.5.2 Parity or ECC error reporting, RAS Extension not implemented 


The Arm architecture supports the reporting of both synchronous and asynchronous parity or ECC errors from the 
cache system. It is IMPLEMENTATION DEFINED what parity or ECC errors in the cache systems, if any, result in 
synchronous or asynchronous parity or ECC errors. 


A fault code is defined for reporting parity or ECC errors, see Use of the ESR_ELI, ESR_EL2, and ESR_EL3 on 
page D1-2296. However, when parity or ECC error reporting is implemented, it is implementation defined whether 
a parity or ECC error is reported using the assigned fault code or using another appropriate encoding. 


For all purposes other than the Fault status encoding, parity or ECC errors are treated as External aborts. 
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D4.6 


D4.6.1 


D4-2498 


Memory barrier instructions 


controls of those instructions. 


Memory barriers on page B2-124 describes the memory barrier instructions. This section describes the system level 


EL2 control of the shareability of data barrier instructions executed at ELO or EL1 


In an implementation that includes EL2 enabled in the current Security state and supports shareability limitations 
on the data barrier instructions, the HCR_EL2.BSU field can modify the required shareability of an instruction that 
is executed at ELO or EL1. Table D4-8 shows the encoding of this field. 


Table D4-8 EL2 control of shareability of barrier instructions executed at ELO or EL1 





HCR_EL2.BSU Minimum shareability of barrier instructions 














00 No effect, shareability is as specified by the instruction 
01 Inner Shareable 

10 Outer Shareable 

11 Full system 





For an instruction executed at ELO or EL1, Table D4-9 shows how the HCR_EL2.BSU is combined with the 
shareability specified by the argument of the DMB or DSB instruction to give the scope of the instruction. 


Table D4-9 Effect of HCR_EL2.BSU on barrier instructions executed at EL1 or ELO 











Shareability specified by the DMB or DSB argument HCR_EL2.BSU Resultant shareability 
Full system Any Full system 
Outer Shareable 00, 01, or 10 Outer Shareable 





11, Full system 


Full system 





Inner Shareable 


00 or 01 


Inner Shareable 





10, Outer Shareable 


Outer Shareable 





11, Full system 


Full system 





Non-shareable 


00, No effect 


Non-shareable 





01, Inner Shareable 


Inner Shareable 





10, Outer Shareable 


Outer Shareable 





11, Full system 


Full system 
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D4.7 Pseudocode description of general memory System instructions 


This section lists the pseudocode describing general memory operations: 
$ Memory data type definitions. 

e Basic memory access. 

a Aligned memory access on page D4-2500. 

° Unaligned memory access on page D4-2500. 

e Exclusives monitors operations on page D4-2500. 

. Access permission checking on page D4-2501. 

e Abort exceptions on page D4-2501. 

7 Memory barriers on page D4-2501. 


D4.7.1 Memory data type definitions 


This section lists the memory data types. 


The memory data types are: 

7 Address descriptor, defined by the AddressDescriptor type. 
° Full address, defined by the FullAddress type. 

` Memory attributes, defined by the MemoryAttributes type. 
s Memory type, defined by the MemType enumeration. 


° Device memory type, defined by the DeviceType enumeration. 

: Normal memory attributes, defined by the MemAttrHints type. 

. Cacheability attributes, defined by the MemAttr_NC, MemAttr_WT, and MemAttr_WB constants. 

° Allocation hints, defined by the MemHint_No, MemHint_WA, MemHint_RA, and MemHint_RWA constants. 
° Access permissions, defined by the Permissions type. 


These types are defined in Chapter J1 Armv8 Pseudocode. 


D4.7.2 Basic memory access 


ARM DDI 0487E.a 
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The two forms of the _Mem[] accessor, non-assignment (memory read) _Mem[] and assignment (memory write) 
_Mem[], are the operations that perform single-copy atomic, aligned, little-endian memory accesses of size bytes to 
or from the underlying physical memory array of bytes. 


The functions address the array using desc.paddress, that supplies: 
° The physical address. 
e An NS bit that selects between the Secure and Non-secure parts of the array. 


The attributes in desc.memattrs are used by the memory system to determine caching and ordering behaviors as 
described in Memory types and attributes on page B2-143, Ordering and observability on page B2-116, and 
Atomicity in the Arm architecture on page B2-110. 


An additional parameter to the _Mem[] accessor defines the access type, for example normal, exclusive, ordered, or 
streaming, and whether the access is made as part of a translation table walk. 


The actual implemented array of physical memory might be smaller than the maximum size permitted by the 
architecture. In this case the scheme for aliasing is IMPLEMENTATION DEFINED, or some parts of the address space 
might give rise to External aborts or a System Error. 





Note 
The permitted physical memory size is: 


° 252 bytes in an implementation that includes ARMv8.2-LPA. However, only 248 bytes are accessible using 
the 4KB or 16KB translation granule. 


. 248 bytes otherwise. 
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D4.7.3 


D4.7.4 


D4.7.5 


D4-2500 


PAMax() returns the IMPLEMENTATION DEFINED size of the physical address. 


Aligned memory access 


The two MemSingle[] accessors, non-assignment (memory read) AArch64.MemSingle[] and assignment (memory 
write) AArch64.MemSingle[], make atomic, little-endian accesses of size bytes. These functions are defined in 
Chapter J1 Armv8 Pseudocode. 


Unaligned memory access 


The two Mem[] accessors, Non-assignment (memory read) Mem[] and Assignment (memory write) Mem[], make 
accesses of the required type. If an access is not architecturally defined to be atomic, Mem[] synthesizes accesses 
from multiple calls to AArch64.MemSingle[]. It also reverses the byte order if the access is big-endian. 


The AArch64.CheckAlignment() function checks the alignment of memory accesses. 


Exclusives monitors operations 


The AArch64.SetExclusiveMonitors() function sets the Exclusives monitors for a block of bytes, the size of which 
is determined by size, at the virtual address defined by address. 


The AArch64.ExclusiveMonitorsPass() function checks whether the Exclusives monitors are set to include the 
location of a number of bytes specified by size, at the virtual address defined by address. The atomic write that 
follows after the Exclusives monitors have been set must be to the same physical address. It is permitted, but not 
required, for this function to return FALSE if the virtual address is not the same as that used in the previous call to 
AArch64.SetExclusiveMonitors(). 


The ExclusiveMonitorsStatus() function returns 0 if the previous atomic write was to the same physical memory 
locations selected by AArch64.ExclusiveMonitorsPass() and therefore succeeded. Otherwise the function returns 1, 
indicating that the address translation delivered a different physical address. 


The MarkExclusiveGlobal() procedure takes as arguments a FullAddress paddress, the PE identifier processorid and 
the size of the transfer. The procedure records that the PE processorid has requested exclusive access covering at 
least size bytes from address paddress. The size of the location marked as exclusive is IMPLEMENTATION DEFINED, 
up to a limit of 2KB and no smaller than two words, and aligned in the address space to the size of the location. It 
is CONSTRAINED UNPREDICTABLE whether this causes any previous request for exclusive access to any other address 
by the same PE to be cleared. 


The MarkExclusiveLocal() procedure takes as arguments a FullAddress paddress, the PE identifier processorid and 
the size of the transfer. The procedure records in a local record that PE processorid has requested exclusive access 
to an address covering at least size bytes from address paddress. The size of the location marked as exclusive is 
IMPLEMENTATION DEFINED, and can at its largest cover the whole of memory but is no smaller than two words, and 
is aligned in the address space to the size of the location. It is IMPLEMENTATION DEFINED whether this procedure 
also performs a MarkExclusiveGlobal() using the same parameters. 


The IsExclusiveGlobal() function takes as arguments a FullAddress paddress, the PE identifier processorid and the 
size of the transfer. The function returns TRUE if the PE processorid has marked in a global record an address range 
as exclusive access requested that covers at least size bytes from address paddress. It is IMPLEMENTATION DEFINED 
whether it returns TRUE or FALSE if a global record has marked a different address as exclusive access requested. 
If no address is marked in a global record as exclusive access, IsExclusiveGlobal() returns FALSE. 


The IsExclusiveLocal() function takes as arguments a FullAddress paddress, the PE identifier processorid and the 
size of the transfer. The function returns TRUE if the PE processorid has marked an address range as exclusive 
access requested that covers at least the size bytes from address paddress. It is IMPLEMENTATION DEFINED whether 
this function returns TRUE or FALSE if the address marked as exclusive access requested does not cover all of size 
bytes from address paddress. If no address is marked as exclusive access requested, then this function returns 
FALSE. It is IMPLEMENTATION DEFINED whether this result is ANDed with the result of IsExclusiveGlobal() with 
the same parameters. 


The ClearExclusiveByAddress() procedure takes as arguments a FullAddress paddress, the PE identifier processorid 
and the size of the transfer. The procedure clears the global records of all PEs, other than processorid, for which an 
address region including any of size bytes starting from paddress has had a request for an exclusive access. It is 
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IMPLEMENTATION DEFINED whether the equivalent global record of the PE processorid is also cleared if any of size 
bytes starting from paddress has had a request for an exclusive access, or if any other address has had a request for 
an exclusive access. 


The ClearExclusiveLocal() procedure takes as arguments the PE identifier processorid. The procedure clears the 
local record of PE processorid for which an address has had a request for an exclusive access. It is IMPLEMENTATION 
DEFINED whether this operation also clears the global record of PE processorid that an address has had a request for 
an exclusive access. 


These functions are defined in Chapter J1 Armv8 Pseudocode. 


D4.7.6 Access permission checking 


The function AArch64.CheckPermission() is used by the architecture to perform access permission checking based 
on attributes derived from the translation tables or location descriptors. It returns the result of the call to 
AArch64.NoFault(). 


These functions are defined in Chapter J1 Armv8 Pseudocode. 


The interpretation of access permission is shown in Memory access control on page D5-2577. 


D4.7.7 Abort exceptions 


The function AArch64.Abort() generates either a Data Abort or an Instruction Abort exception by calling 
AArch64.DataAbort() or AArch64. InstructionAbort(). It also can generate a debug exception for debug related faults, 
see Chapter D2 AArch64 Self-hosted Debug. 


The function AArch64.DataAbort() generates a Data Abort exception, routes the exception to EL2 or EL3, and 
records the information required for the Exception Syndrome registers, ESR_ELx. See JSS encoding for an 
exception from a Data Abort on page D13-2943. A second stage abort might also record the intermediate physical 
address, IPA, but this depends on the type of the abort. 


For a synchronous abort, AArch64.DataAbort() also sets the FAR to the VA of the abort. 


The function AArch64.InstructionAbort() generates an Instruction Abort exception, routes the exception to EL2 or 
EL3, and records the information required for the Exception Syndrome registers, ESR_ELx, see JSS encoding for 
an exception from an Instruction Abort on page D13-2941. A second stage abort might also record the intermediate 
physical address, IPA, but this depends on the type of the abort. 


For a synchronous abort, AArch64.InstructionAbort() also sets the FAR to the VA of the abort. 


The FaultRecord type describes a fault. Functions that check for faults return a record of this type appropriate to the 
type of fault. Pseudocode description of the MMU faults on page D5-2631 provides a number of wrappers to 
generate FaultRecords. 


The function AArch64.NoFau1t() returns a null record that indicates no fault. The IsFault() function tests whether a 
FaultRecord contains a fault. 


D4.7.8 Memory barriers 


ARM DDI 0487E.a 
ID070919 


The definition for the memory barrier functions is given by the enumerations MBReqDomain and MBReqTypes. 


These enumerations define the required shareability domains and required access types used as arguments for DMB 
and DSB instructions. 


The procedures DataMemoryBarrier, DataSynchronizationBarrier, and InstructionSynchronizationBarrier perform 
the memory barriers.* 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D4-2501 
Non-Confidential 


The AArch64 System Level Memory Model 
D4.7 Pseudocode description of general memory System instructions 


D4-2502 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Chapter D5 
The AArch64 Virtual Memory System Architecture 


This chapter provides a system level view of the AArch64 Virtual Memory System Architecture (VMSAv8-64), the 
memory system architecture of an Armv8 implementation that is executing in AArch64 state. It contains the 
following sections: 


. About the Virtual Memory System Architecture (VMSA) on page D5-2504. 
$ The VMSAv8-64 address translation system on page D5-2512. 

° VMSAv8-64 translation table format descriptors on page D5-2565. 

$ Memory access control on page D5-2577. 

e Memory region attributes on page D5-2599. 

e Virtualization Host Extensions on page D5-2609. 

7 VMSAv8-64 memory aborts on page D5-2622. 

$ Nested virtualization on page D5-2615. 

. Translation Lookaside Buffers (TLBs) on page D5-2632. 

. TLB maintenance requirements and the TLB maintenance instructions on page D5-2638. 
s Caches in a VMSAv8-64 implementation on page D5-2655. 
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D5.1 


D5.1.1 


D5.1.2 


D5-2504 


About the Virtual Memory System Architecture (VMSA) 


This chapter describes the Armv8 Virtual Memory System Architecture (VMSA), and in particular how it applies to 
a PE that is executing in AArch64 state. In this state the PE is using VMSAv8-64, as defined in Armv8 VMSA 
naming. See The Armv8 VMSA when some Exception levels are using AArch32 for information about the VMSA in 
other contexts. 


A VMSA provides a Memory Management Unit (MMU), that controls address translation, access permissions, and 
memory attribute determination and checking, for memory accesses made by the PE. The process of address 
translation maps the virtual addresses (VAs) used by the PE onto the physical addresses (PAs) of the physical 
memory system. The mapping of a VA to a PA requires either a single stage of translation, or two sequential stages 
of translation. 


The translations are defined independently for different Exception levels and Security states, as described in The 
VMSAv8-64 address translation system on page D5-2512. 


VMSAv8-64 supports tagging of VAs: 


: Address tagging as described in Address tagging in AArch64 state on page D5-2506. As that section 
describes, this address tagging has no effect on the address translation process. 


è If ARMv8.5-MemTag is implemented and enabled Memory tagging as described in Chapter D6 Armv8. 5 
Memory Tagging Extension. 


The remainder of this chapter gives a full description of VMSAv8-64 for an implementation that includes all of the 
Exception levels. The implemented Exception levels and the resulting translation stages and regimes on 
page DS-2517 describes the differences in the VMSA if some Exception levels are not implemented. 


The following sections give more information about the VMSA: 

7 ArmvS VMSA naming. 

$ The Armv8 VMSA when some Exception levels are using AArch32. 
7 VMSA address types and address spaces on page D5-2505. 

$ Address tagging in AArch64 state on page D5-2506. 

. Pointer authentication in AArch64 state on page D5-2508. 


Armv8 VMSA naming 


The Armv8 VMSA naming model reflects the possible stages of address translation, as follows: 
VMSAv8 The overall translation scheme, within which an address translation has one or two stages. 


VMSAv8-32 The translation scheme for a single stage of address translation that is managed from an Exception 
level that is using AArch32. 


VMSAv8-32 is sometimes used to refer to the two stages of translation used to map a VA to a PA, 
where each stage is managed from an Exception level that is using AArch32. 

VMSAv8-64 The translation scheme for a single stage of address translation that is managed from an Exception 
level that is using AArch64. 


VMSAv8-64 is sometimes used to refer to the two stages of translation used to map a VA to a PA, 
where each stage is managed from an Exception level that is using AArch64. 


The Armv8 VMSA when some Exception levels are using AArch32 


As stated at the start of the chapter, this chapter describes VMSAv8-64, the Armv8 VMSA that applies to an 
Exception level that is using AArch64. However, when a higher Exception level is using AArch64, and therefore 
using VMSAv8-64, lower Exception levels can be using AArch32. Chapter G5 The AArch32 Virtual Memory 
System Architecture describes VMSAv8-32, meaning it describes: 


° The translation stages and translation regimes when EL3 is using AArch32. 
$ Any stages of address translation that are using VMSAv8-32 when EL3 is using AArch64. 
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However, a PE can be executing at ELO using AArch32 when the next higher Exception level is using AArch64, for 
example when ELO is using AArch32 and EL! is using AArch64. When this is the case execution at ELO uses a 
VMSAV8-64 translation regime as described in Constraints on accesses from ELO when ELO is using AArch32 on 
page D5-2515. 


D5.1.3 VMSA address types and address spaces 


A description of the VMSA refers to the following address types. 


Note 


These descriptions relate to the VMSAv8 description and therefore give more detail than the generic definitions 
given in the glossary. 








Virtual address (VA) 


An address used in an instruction, as a data or instruction address, is a Virtual Address (VA). 


Note 
This means that an address held in the PC, LR, SP, or an ELR, is a VA. 








In AArch6é4 state, the VA has a maximum address width of either 48 bits or, when ARMv8.2-LVA 
is implemented and the 64KB translation granule is used, 52 bits. As About address translation and 
supported input address ranges on page D5-2516 describes, a stage of address translation can 
support one or two VA ranges: 

Translation stage can support only a single VA range 


For a translation stage that supports a single VA range, a 48-bit VA width gives a VA 
range of 0x0000000000000000 to 0x0Q000FFFFFFFFFFFF. 


If ARMv8.2-LVA is implemented and the 64KB translation granule is used, for a 
translation regime that supports a single VA range, the 52-bit VA width gives a VA range 
of 0x0000 000000000000 to OxQQOFFFFFFFFFFFFF. 

Translation stage can support two VA ranges 
For a translation stage that supports two VA subranges, one at the bottom of the full 
64-bit address range, and one at the top, as follows: 
. The bottom VA range runs up from address 0x0000 000000000000. 


With a maximum VA width of 48 bits this gives a VA range of 
0x0000 000000000000 to 0x0000FFFFFFFFFFFF. 


With a maximum VA width of 52 bits this gives a VA range of 
0x0000 000000000000 to 0x00OF FFFFFFFFFFFF. 
. The top VA subrange runs up to address 0xFFFFFFFFFFFFFFFF. 


With a maximum VA width of 48 bits this gives a VA range of 
OxFFFF 000000000000 to OxFFFFFFFFFFFFFFFF. 


With a maximum VA width of 52 bits this gives a VA range of 
OxFFFQQ000 00000000 to OxFFFFFFFFFFFFFFFF. 


Reducing the VA width for this subrange increases the bottom address of the 
range. 


Note 


. When ARMV8.1-VHE is not implemented, the only translation stage that can support two VA 
ranges is stage 1 of the EL1&0 translation regime. 


è When ARMv8.1-VHE is implemented and the value of HCR_EL2 is 1, stage 1 of the EL2, 
or EL2&0, translation regime also can support two VA ranges. 








A 48-bit VA range corresponds to an address space of 256TB. A 52-bit VA range corresponds to an 
address space of 4PB. 
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Each translation regime that takes a VA as an input address can be configured to support fewer than 
the maximum number of bits of VA space, see Address size configuration on page D5-2519. 


Intermediate physical address (IPA) 


In a translation regime that provides two stages of address translation, the IPA is: 
: The OA from the stage 1 translation. 
è The IA for the stage 2 translation. 


In a translation regime that provides only one stage of address translation, the IPA is identical to the 
PA. Alternatively, the translation regime can be considered as having no concept of IPAs. 


The EL3, Secure EL1, and if ARMv8.4-SecEL2 is implemented, Secure EL2 Exception levels 
provide independent definitions of the PA spaces for Secure and Non-secure operation. This means 
they provide two independent address spaces, where: 


° A VA accessed in Secure state can be translated to either the Secure or the Non-secure PA 
space. 
. When in Non-secure state, a VA is always mapped to the Non-secure PA space. 


For more information about maximum address widths, see Address size configuration on 
page D5-2519. 


Physical address (PA) 


The address of a location in a physical memory map. That is, an output address from the PE to the 
memory system. 


The EL3, Secure EL1, and if ARMv8.4-SecEL2 is implemented, Secure EL2 Exception levels 
provide independent definitions of the PA spaces for Secure and Non-secure operation. This means 
they provide two independent address spaces, where: 


° A VA accessed in Secure state can be translated to either the Secure or the Non-secure PA 
space. 
è When in Non-secure state, a VA is always mapped to the Non-secure PA space. 


For more information about maximum address widths, see Address size configuration on 
page D5-2519. 


Address tagging in AArch64 state 


In AArch64 state, the Armv8 architecture supports the tagging of addresses. Address tagging in this section is not 
to be confused with Memory tagging if ARMv8.5-MemTag is implemented. For more information on Memory 
tagging see Chapter D6 Armv8.5 Memory Tagging Extension. 


In the case of Address tagging the top eight bits of the VA are ignored when determining: 


If the translation system is enabled, whether the address is out of range and therefore causes a Translation 


If the translation system is not enabled, whether the address is out of range and therefore causes an Address 
size fault. 


Whether the address requires invalidation when performing a TLB invalidation instruction by address. 


The use of address tags is controlled as follows: 


For addresses when stage 1 translation can support two VA ranges 


The value of bit[55] of the VA determines the register bit that controls the use of address tags, as 
follows: 


VA[55]== TCR_ELx.TBIO determines whether address tags are used. If stage 1 
translation is enabled, TTBRO_ELx holds the base address of the translation 
tables used to translate the address. 
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VA[55]== TCR_ELx.TBI1 determines whether address tags are used. If stage 1 
translation is enabled, TTBR1_ELx holds the base address of the translation 
tables used to translate the address. 


For addresses when stage 1 translation supports only a single VA range 


TCR_ELx.TBI determines whether address tags are used. If stage | translation is enabled, 
TTBRO_ELx holds the base address of the translation tables used to translate the address. 


Note 


The TCR_ELx.TBI {n} bit determines whether address tags are used regardless of whether the corresponding 
translation regime is enabled. 








When ARMv8.3-PAuth is implemented, TBID {n} bits are added to TCR_ELx registers. 


When a TCR_ELx.TBI {n} bit enables the use of address tagging, the corresponding TBID {n} bit determines 
whether address tagging is used for both instruction and data addresses, or only for data addresses. 


The bits added are: 
e TCR_ELI.{TBID1, TBIDO}. 


° If stage 1 of the EL2 or EL2&0 translation regime supports two VA ranges, TCR_EL2.{TBID1, TBIDO}. 
Otherwise, TCR_EL2.TBID. 


$ TCR_EL3.TBID. 


Note 


Restricting address tagging to data addresses means instruction addresses can use larger Pointer authentication code 
fields. See Pointer authentication in AArch64 state on page D5-2508. 








An address tag enable bit also has an effect on the PC value in the following cases: 


$ On taking an exception to the controlled Exception level, regardless of whether this is also the Exception 
level from which the exception was taken. 


à Any branch within the controlled Exception level, unless that branch generates an Illegal exception return. 


$ On performing an exception return that is not an Illegal exception return to the controlled Exception level, 
regardless of whether this is also the Exception level from which the exception return was performed. 


Note 
On an Illegal exception return, bits[63:32] of the PC become UNKNOWN. 











° Exiting from debug state to the controlled Exception level. 
Note 
As an example of what is meant by the controlled Exception level, TCR_EL3.TBI controls this effect for: 
° A branch or procedure return within EL3. 
. Taking an exception to EL3. 
è Performing an exception return or a debug state exit to EL3. 





The effect of the controlling TBI {n} bit is: 


For a translation regime where stage 1 translation can support two VA ranges 


If the controlling TBIn bit for the address being loaded into the PC is set to 1, then 
bits[63:56] of the PC are forced to be a sign-extension of bit[55] of that address. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D5-2507 
Non-Confidential 


The AArch64 Virtual Memory System Architecture 
D5.1 About the Virtual Memory System Architecture (VMSA) 


D5.1.5 


D5-2508 


For a translation regime where stage 1 translation supports only a single VA range 
Ifthe controlling TBI bit for the address being loaded into the PC is set to 1, then bits[63:56] 
of the PC are forced to be 0x00. 


However, when ARMv8.3-PAuth is implemented and the value of a TCR_ELx.TBID {n} field is 1, the Effective 
value of the corresponding TCR_ELx.TBI {n} field is 0 for any of: 


$ A branch or procedure return within an Exception level. 
. Taking an exception to an Exception level. 

$ Exception return to an Exception level. 

. Exit from Debug state to an Exception level. 


The AddrTop() pseudocode function shows the algorithm determining the most significant bit of the VA, and 
therefore whether the VA is using tagging. For a translation regime where the stage 1 translation supports two VA 
ranges, this pseudocode includes the selection between TTBRO_ELx and TTBR1_ELx described in Selection 
between TTBRO_ELx and TTBR1_ELx when two VA ranges are supported on page D5-2550. 





Note 


The required behavior prevents a tagged address being propagated to the program counter. 





When address tagging is enabled for an address that causes a Data Abort or a Watchpoint, the address tag is included 
in the VA returned in the FAR. 


Pointer authentication in AArch64 state 


ARMv8.3-PAuth adds functionality that supports the authentication of the contents of a register before that register 
is used as the target of an indirect branch, or as a load. This functionality is supported only in AArch64 state. 


For pointer authentication, the new functionality provides: 


° An instruction that inserts a Pointer Authentication Code (PAC) into the upper bits of a register. The bits used 
are the extension bits that do not hold valid address bits. The inserted PAC value is calculated from the value 
of the register and one other 64-bit value. 


i An instruction that extracts the PAC from the upper bits of a register, and checks that the value is correct, 
based on the value of the register and one other 64-bit value, and: 
— Ifthe value is correct, replaces the PAC with the extension bits. 


— Otherwise, replaces the PAC with the extension bits, except that two bits of the extension are set to a 
fixed unique number. This means that, if the register is used as the target of an indirect branch, 
execution branches to an address that generates a Translation fault because the VA is not mapped. 


s An instruction that removes the PAC, replacing it with the extension bits, without any verification. 


Multiple versions of these instructions are provided to support different use cases. These include instructions that 
combine a pointer authentication operation with another operation. Pointer authentication instructions on 
page C3-194 summarizes these instructions. 


In addition, ARMv8.3-PAuth provides a generic authentication instruction, PACGA, that generates a 32-bit PAC from 
two 64-bit values. 


Note 


The PACGA instruction can be used to provide protection for small blocks of memory. Instructions can be chained 
to allow protection of an arbitrary-sized block. 





For the Pointer authentication instructions, it is IMPLEMENTATION DEFINED whether PACs are generated using: 


s The QARMA algorithm, see The QARMA Block Cipher Family. When this is the case, the value of 
ID_AA64ISAR1_EL1.APA is 0b0001. 
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. An IMPLEMENTATION DEFINED algorithm. When this is the case, the value of ID_AA64ISAR1_EL1.API is 
0b0001. 


Similarly, for the PACGA instruction, it is IMPLEMENTATION DEFINED whether PACs are generated using: 


è The QARMA algorithm, see The QARMA Block Cipher Family. When this is the case, the value of 
ID_AA64ISAR1_EL1.GPA is 0b0001. 


. An IMPLEMENTATION DEFINED algorithm. When this is the case, the value of ID_AA64ISAR1_EL1.GPI is 
0b0001. 


The pseudocode descriptions of the operation of these instructions describe the use of the QARMA algorithm. When 
an IMPLEMENTATION DEFINED algorithm is used the ComputePAC() function: 


° Must have the same arguments as the function defined in this Manual. 


è For a set of arguments passed to the function, must give the same result for all PEs that a thread of execution 
could migrate between. 


ARMv8.3-PAuth is implemented if the value of at least one of ID_AA64ISAR1_EL1.{APA, API, GPA, GPI} are 
not 0b0000. 





Note 


Pointer authentication functionality is useful only when address translation is enabled. However, this functionality 
is the same whether address translation is enabled or disabled, 





The following sections give more information about the ARMv8.3-PAuth functionality: 
: Supported PAC field and relation to the use of address tagging. 
. Keys for PAC generation and verification on page D5-2510. 


. System register control of pointer authentication on page D5-2510. 


Supported PAC field and relation to the use of address tagging 


As stated earlier in this section, the PAC is held in the extension bits of a register, that do not hold valid address bits. 
However, as described in Address tagging in AArch64 state on page D5-2506, when address tagging is used the tag 
is held in Xn[63:56]. Therefore, when Xn is a 64-bit register holding an address: 


When address tagging is used 
The PAC field is Xn[54:bottom_PAC_bit]. 


When address tagging is not used 
The PAC field is Xn[63:56, 54:bottom_PAC_bit]. 


In the PAC field definitions, bottom_PAC_bit == 64-TCR_ELx.TnSZ, 





Note 


Xn[55] determines whether the address lies in the upper or lower address range for the purpose of determining 
whether address tagging is used, see Address tagging in AArch64 state on page D5-2506. The value of Xn[55] is the 
value of n in TnSZ. Therefore, it also determines whether Xn[63:56] are part of the PAC field, and which of 
TCR_ELx.{T0OSZ, T1SZ} determines the value of bottom_PAC_bit. 





If the value of TCR_ELx.TnSZ is outside its permitted range then it is CONSTRAINED UNPREDICTABLE whether the 
value used to determine bottom_PAC_bit is the programmed value of the field, or is forced to the maximum or 
minimum permitted value of the field. However, if the PE treats an out of range TnSZ value as the maximum or 
minimum permitted value of the field for all purposes except reading the value of the field then that behavior also 
applies to determining bottom_PAC_bit. 


ARMv8.3-PAuth adds a new control to TCR_ELx, that disables the use of address tagging for instruction addresses, 
see Address tagging in AArch64 state on page D5-2506. 
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Note 


This control means software can use larger PAC field for instruction addresses, while using tagging and the smaller 
PAC field for data addresses. 





Keys for PAC generation and verification 


For pointer authentication, two 128-bit keys are provided for each of instruction addresses and data addresses, and 
a fifth 128-bit key is provided for the generic authentication instruction, as follows: 
Keys for instruction address PACs 


APIAKey_EL1 
The concatenation of the register values APIAKeyHi_ EL1:APIAKeyLo_EL1. 


APIBKey_EL1 
The concatenation of the register values APIBKeyHi_ EL1:APIBKeyLo_ EL}. 
Keys for data address PACs 


APDAKey_EL1 
The concatenation of the register values APDAKeyHi_ EL1:APDAKeyLo_ ELI. 


APDBKey_EL1 
The concatenation of the register values APDBKeyHi_ EL1:APDBKeyLo_ EL1. 


Key for generic authentication 


APGAKey_EL1 
The concatenation of the register values APGAKeyHi_ EL1:APGAKeyLo_ ELI. 





Note 


Keys are not banked by Exception level. Arm expects software to switch the keys between Exception levels, 
typically by swapping the values with zero so that the current key values are not present in memory. 





System register control of pointer authentication 


ARMv8.3-PAuth adds controls to the SCTLR_ELx registers that enable generation and validation of PACs for data 
and instruction addresses. Formally, the definition of these fields is that when the functionality is disabled the 
AddPAC<I|D><A|B>() and Auth<I|D><A|B>() pseudocode functions return the value of the first parameter passed to 
them. This means: 


i. Except for PACGA, the instructions listed in Table C3-12 on page C3-194, that add a PAC to an address in a 
register, execute as NOPs. 


è The instructions listed in Table C3-13 on page C3-195, that authenticate a pointer, execute as NOPs. 


. For the Combined instructions listed in Table C3-15 on page C3-196, the Auth<I|D><A|B>() function has no 
effect on the operation of the instruction, which operates as the equivalent non-Authenticate pointer 
instruction. This means that, for example: 


— A RETAA instruction operates as a RET instruction. 
—  ALDRAA Xt, [Xn, #<simm10>]! instruction operates as a LDR Xt, [Xn, #<simm1@>:000]! instruction. 


These controls do not affect the PACGA and XPAC« instructions, that are always enabled. 


The controls added to the SCTLR_ELx registers are: 


EnIA Controls instructions that apply to PACs for instruction addresses that are generated using the 
APIAKey_EL1 key. 
EnIB Controls instructions that apply to PACs for instruction addresses that are generated using the 


APIBKey_EL1 key. 
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EnDA Controls instructions that apply to PACs for data addresses that are generated using the APDAKey_EL1 
key. 

EnDB Controls instructions that apply to PACs for data addresses that are generated using the APDBKey_EL1 
key. 


See the SCTLR_ELx. {EnIA, EnIB, EnDA, EnDB} field descriptions for more information. 





Note 


These fields are RESO in versions of the architecture before Armv8.3, and therefore should be written as 0 by legacy 
software. 
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The VMSAv8-64 address translation system 


The following subsections describe the VMSAv8-64 address translation system, that maps VAs to PAs: 
s About the VMSAv8-64 address translation system. 


° The implemented Exception levels and the resulting translation stages and regimes on page D5-2517. 
° Controlling address translation stages on page D5-2517. 

° Memory translation granule size on page D5-2526. 

. Translation tables and the translation process on page D5-2533. 


. Overview of the VMSAv8-64 address translation stages on page D5-2536. 

. The VMSAv8-64 translation table format on page D5-2547. 

. The algorithm for finding the translation table descriptors on page D5-2554. 
. The effects of disabling a stage of address translation on page D5-2558. 


° The implemented Exception levels and the resulting translation stages and regimes on page D5-2517. 

s Pseudocode description of VMSAv8-64 address translation on page D5-2560. 

. Address translation instructions on page D5-2561. 

Related to this: 

° VMSAv8-64 translation table format descriptors on page D5-2565 describes the translation table entries. 


- Memory region attributes on page D5-2599 describes the attributes that are held in the translation table 
entries, including how different attributes can interact. 


. Translation Lookaside Buffers (TLBs) on page D5-2632 describes the caching of translation table lookups in 
TLBs, and the architected instructions for maintaining TLBs. 


° AArch64 Address translation examples on page K7-7698 gives detailed descriptions of typical examples of 
translating a VA to a final PA, and obtaining the memory attributes of that PA. 


s Chapter D6 Armv8.5 Memory Tagging Extension, gives details of ARMv8.5-MemTag and the modified 
behavior of the VMSAv8-64 address translation system when ARMv8.5-MemTag is implemented and 
enabled. 


About the VMSAv8-64 address translation system 


The Memory Management Unit (MMU) controls address translation, memory access permissions, and memory 
attribute determination and checking, for memory accesses made by the PE. 


The general model of MMU operation is that the MMU takes information about a required memory access, 
including an input address (IA), and either: 


è Returns an associated output address (OA), and the memory attributes for that address. 

. Is unable to perform the translation for one of a number of reasons, and therefore causes an exception to be 
generated. This exception is called an MMU fault. System registers are used to report any MMU faults that 
occur. 


The process of mapping an IA to an OA is an address translation, or more precisely a single stage of address 
translation. 


When using a VMSA, a translation regime maps a VA to a PA using one or two stages of translation, and: 
. The AArch64 translation regimes on page D5-2513 defines the translation regimes. 
. VMSA address types and address spaces on page D5-2505 give more information about VAs and PAs. 


The translation granule specifies the granularity of the mapping from IA to OA. That is, it defines both: 


è The page size for a stage of address translation, where a page is the smallest block of memory for which an 
IA to OA mapping can be specified. 


$ The size of a complete translation table for that stage of address translation. 
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The MMU is controlled by System registers, that provide independent control of each address translation stage, 
including a control to disable the stage of address translation. The effects of disabling a stage of address translation 
on page D5-2558 defines how the MMU handles an access for which a required address translation stage is disabled. 


This section describes the address translation system for an implementation that includes all of the Exception levels, 
and gives a complete description of translations that are controlled by an Exception level that is using AArch64. In 
addition: 


° The Armv8 VMSA when some Exception levels are using AArch32 on page D5-2504 gives information about 
the VMSA when some Exception levels are using AArch32. 


. The implemented Exception levels and the resulting translation stages and regimes on page D5-2517 
describes the effect on the address translation model when some Exception levels are not implemented. 


Each enabled stage of address translation uses a set of address translations and associated memory properties held 
in memory mapped tables called translation tables. A single translation table lookup can resolve only a limited 
number of bits of the IA, and therefore a single address translation can require multiple lookups. These are described 
as different levels of lookup. 


Translation table entries can be cached in a Translation Lookaside Buffer (TLB). 


As well as defining the OA that corresponds to the IA, the translation table entries define the following properties: 


. For accesses made from Secure state, whether the access is to the Secure or Non-secure address map. 
° Memory access permissions. 
è Memory region attributes. 


For more information, see Memory attribute fields in the VMSAv8-64 translation table format descriptors on 
page D5-2570. 


The following subsections give more information: 

è The AArch64 translation regimes. 

° About address translation and supported input address ranges on page D5-2516. 
$ The VMSAv8-64 translation table format on page D5-2516. 


The AArch64 translation regimes 


The architecture defines a number of translation regimes, where a translation regime comprises either: 
7 A single stage of address translation. 

This maps an input VA to an output PA. 
a Two, sequential, stages of address translation, where: 

— Stage 1 maps an input VA to an output IPA. 

— Stage 2 maps an input IPA to an output PA. 


Figure D5-1 on page D5-2514 shows these translation stages and translation regimes when EL3 is using AArch64. 
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Translation regimes, when EL3 is using AArch64 


EL1&0 stage 1 











EL1&0, when EL2 is disabled VA > PA 

Controlled from EL1* 
A EL180 stage 1 EL18&0 stage 2 
VA > IPA > PA 
EL180, when EL2 is enabled Controlled from EL1" Controlled from EL2" 

EL2 or EL2&0Ë va EL2, or EL2&0*, stage 1 PA 
Controlled from EL2* 

EL3 VA EL3 stage 1 > PA 


D5-2514 





Controlled from EL3 
t Typically controlled from this Exception level, but also accessible from higher Exception levels 


tOnly when the implementation includes ARMv8.1-VHE and the value of HCR_EL2.E2H is 1 


Figure D5-1 VMSAv8 AArch64 translation regimes, translation stages, and associated controls 
This means that in VMSAv8-64 the set of translation regimes is: 


The Secure EL1&0 translation regime, when EL2 is disabled 


This has a single stage of translation, stage 1, that maps VAs to PAs and can support two VA ranges 
and the use of ASIDs. 


This translation regime is used: 
s For memory accesses from EL1 or ELO when the value of HCR_EL2.{E2H, TGE} is {0,0}. 


The Non-secure EL1&0 translation regime, when EL2 is disabled 


This has a single stage of translation, stage 1, that maps VAs to PAs and can support two VA ranges 
and the use of ASIDs. 


This translation regime is used: 
° For memory accesses from EL1 or ELO when the value of HCR_EL2.{E2H, TGE} is {0,0}. 
The memory access will be Non-secure when SCR_EL3.NS is 1. 


The Secure EL1&0 translation regime, when EL2 is enabled 


If cached in a TLB, a translation table lookup for this regime is associated with the VMID that 
identifies the current virtual machine. This regime has two stages of lookup: 


Stage 1 Maps VAs to IPAs. This stage can support two VA ranges and the use of ASIDs. 
Stage 2 Maps IPAs to PAs. This stage supports a single IPA range. 
This translation regime is used: 


° For memory access from EL1 or ELO when the value of HCR_EL2.{E2H, TGE} is {0, 0}. 


The Non-secure EL1&0 translation regime, when EL2 is enabled 


If cached in a TLB, a translation table lookup for this regime is associated with the VMID that 
identifies the current virtual machine. This regime has two stages of lookup: 


Stage 1 Maps VAs to IPAs. This stage can support two VA ranges and the use of ASIDs. 
Stage2 Maps IPAs to PAs. This stage supports a single IPA range. 

This translation regime is used: 

` For memory access from EL1 or ELO when the value of HCR_EL2.{E2H, TGE} is {0,0}. 


The Secure EL2&0 translation regime 


When ARMv8.1-VHE is implemented, this regime has a single stage of translation, stage 1, that 
maps VAs to PAs and can support two VA ranges and the use of ASIDs. 


This translation regime is used: 
è For memory accesses from ELO when the value of HCR_EL2.{E2H, TGE} is {1,1}. 
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è For memory accesses from EL2 when the value of HCR_EL2.E2H is 1. 


This translation regime is present when ARMv8.4-SecEL2 is implemented and enabled. 


The Non-secure EL2&0 translation regime 


When ARMv8.1-VHE is implemented, this regime has a single stage of translation, stage 1, that 
maps VAs to PAs and can support two VA ranges and the use of ASIDs. 


This translation regime is used: 
è For memory accesses from ELO when the value of HCR_EL2.{E2H, TGE} is {1, 1}. 
s For memory accesses from EL2 when the value of HCR_EL2.E2H is 1. 


The Secure EL2 translation regime 
This has a single stage of translation, stage 1, that maps VAs to PAs and supports a single VA range. 


This translation regime is used: 


. For all memory accesses from EL2 in implementations that do not include ARMv8.1-VHE. 
a For all memory access from EL2, when ARMv8.1-VHE is implemented and HCR_EL2.E2H 
is 0. 


This translation regime is present when ARMv8.4-SecEL2 is implemented and enabled. 


The Non-secure EL2 translation regime 
This has a single stage of translation, stage 1, that maps VAs to PAs and supports a single VA range. 


This translation regime is used: 


. For all memory accesses from EL2 in implementations that do not include ARMv8.1-VHE. 
s For all memory access from EL2, when ARMv8.1-VHE is implemented and HCR_EL2.E2H 
is 0. 


The Secure EL3 translation regime 


This has a single stage of translation, stage 1, that maps VAs to PAs and supports a single VA range. 


An MMU fault might be generated by a particular stage of translation. An MMU fault is described as either a stage 1 
MMU fault or a stage 2 MMU fault. 





Note 


a In the Arm architecture, a software agent, such as an operating system, that uses or defines stage 1 memory 
translations, might be unaware of the second stage of translation, and of the distinction between IPA and PA. 


: A more generalized description of the translation regimes is that a regime always comprises two sequential 
stages of translation, but in some regimes the stage 2 translation both: 


— Returns an OA that equals the IA. This is called a flat mapping of the IA to the OA. 
— Does not change the memory attributes returned by the stage 1 address translation. 





Constraints on accesses from ELO when ELO is using AArch32 


Armv§8 permits execution with ELO using AArch32 when the next higher Exception level is using AArch64. This 
happens in the following situations: 


` EL1 is using AArch64. Execution at ELO using AArch32 uses the VMSAv8-64 EL1&0 translation regime. 


3 EL2 is using AArch64 and the Effective value of HCR_EL2.{E2H, TGE} is {0, 1} or {1, 0}. Execution at 
ELO using AArch32 uses the VMSAv8-64 EL1&0 translation regime. 


: In an implementation that includes ARMv8.1-VHE, EL2 is using AArch64 and the value of 
HCR_EL2.{E2H, TGE} is {1, 1}. Execution at ELO using AArch32 uses the VMSAv8-64 EL2&0 translation 
regime. 


In this case, accesses from ELO using AArch32 are using: 
s The stated VMSAv8-64 translation regime, EL1&0 or EL2&0. 
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° The AArch32 memory model. 


In particular, this means the accesses from ELO are limited to a 32-bit VA range. 


About address translation and supported input address ranges 


For a single stage of address translation, a Translation table base register (TTBR_ELx) indicates the start of the first 
translation table required for a mapping from input address (IA) to output address (OA). For a stage of address 
translation that supports two VA ranges each VA range is an independent mapping from IA to OA. This means that 
each implemented translation stage shown in VMSAv8 AArch64 translation regimes, translation stages, and 
associated controls on page D5-2514 requires: 





: Two associated sets of translation tables if it supports two IA ranges. 
: One associated set of translation tables if it supports a single IA range. 
Note 
s Stage 2 translations never support two IA ranges. This means that, for the translation stages that support two 


IA ranges the IA is always a VA. 


. Example use of the split VA range, and the TTBRO_ELx and TTBR1_ELx controls on page D5-2551 shows 
how two supported VA ranges might be used. 





Controlling address translation stages on page D5-2517 summarizes the System registers that control address 
translation by the MMU, and Selection between TTBRO_ELx and TTBR1_ELx when two VA ranges are supported 
on page D5-2550 gives more information about the address translation stages that support two VA ranges. 


A full translation table lookup is called a translation table walk. It is performed automatically by hardware, and can 
have a significant cost in execution time. To support fine granularity of the VA to PA mapping, a single IA to OA 
translation can require multiple accesses to the translation tables, with each access giving finer granularity. Each 
access is described as a level of address lookup. The final level of the lookup defines: 


° The high bits of the required output address. 
° The attributes and access permissions of the addressed memory. 


Translation table entries can be cached in a Translation Lookaside Buffer, see Translation Lookaside Buffers (TLBs) 
on page D5-2632. 


The VMSAv8-64 translation table format 


Stages of address translation that are controlled by an Exception level that is using AArch64 use the VMSAv8-64 
translation table format. This format uses 64-bit descriptor entries in the translation tables. 


Note 

This format is an extension of the VMSAv8-32 Long-descriptor translation table format originally defined by the 
Armv7 Large Physical Address Extension, and extended slightly by Armv8. VMSAv8-32 also supports a 
Short-descriptor translation table format. Chapter G5 The AArch32 Virtual Memory System Architecture describes 
both of these formats. 








The VMSAv8-64 translation table format provides: 


. Up to four levels of address lookup. 
° A translation granule size of 4KB, 16KB, or 64KB. 
. Input addresses of: 


— Upto 52 bits if ARMv8.2-LVA is implemented and the 64KB translation granule is used. 
— Otherwise, up to 48 bits. 

. Output addresses of: 
— Upto 52 bits if ARMv8.2-LPA is implemented and the 64KB translation granule is used. 
— Otherwise, up to 48 bits. 


For more information about input address and output address sizes see Address size configuration on page D5-2519. 
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D5.2.2 The implemented Exception levels and the resulting translation stages and regimes 


About the VMSAv8-64 address translation system on page D5-2512 describes an implementation that includes all 
Exception levels. Controlling address translation stages describes the control of address translation by Exception 
levels that are using AArch64. This subsection describes how the address translation scheme changes if an 
implementation does not include all of the Exception levels. 


If an implementation does not include EL3, it has only a single Security state, with MMU controls equivalent to the 
Secure state MMU controls. 


If an implementation does not include EL2 then: 
° If it also does not include EL3, the MMU provides only a single EL1&0 stage 1 translation regime. 
7 If it includes EL3, the MMU provides an EL1&0 stage 1 translation regime in each Security state. 


Figure D5-1 on page D5-2514 shows the set of translation regimes for an implementation that implements all of the 
Exception levels. Table D5-1 shows how the supported translation stages depend on the implemented Exception 
levels, and in some cases on the Execution state being used by the highest implemented Exception level. 


Table D5-1 The relation between the implemented translation stages and Exception levels for AArch64 























Translation stage Requires 
Secure EL3 stage 1 EL3 implemented and using AArch64. 
Secure EL2? stage 1 EL2 implemented and using AArch64. 
Secure EL2&0 stage 1 EL2 implemented and using AArch64. 
Secure EL1&04 stage 2 EL2 implemented and using AArch64. 
Secure EL1&0 stage 1 Either: 
. EL3 implemented and using AArch64. 
. Only EL1 and ELO implemented, all operation is in Secure state, and EL1 is using 
AArch64. 
Non-secure EL2 stage 1 EL2 implemented. 





Non-secure EL2&0° stage 1 EL2 implemented. 





Non-secure EL1&0 stage 2 EL2 implemented. 





Non-secure EL1&0 stage 1 Any implementation except: 


è Only EL1 and ELO implemented, with all operation in the Secure state. 





a. This translation regime is supported only if an implementation includes ARMv8.4-SecEL2. When supported, it is used when the value 
of SCR_EL3.EEL2 is 1. 


b. The EL2&0 translation regime is supported only if an implementation includes ARMv8.1-VHE. When supported, it is used when the 
value of HCR_EL2.E2H is 1. 


D5.2.3 Controlling address translation stages 


ARM DDI 0487E.a 
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The implemented Exception levels and the resulting translation stages and regimes defines the translation regimes 
and stages. For each supported address translation stages controlled from AArch64, Table D5-2 on page D5-2518 
shows: 


è A System register bit enables the stage of address translation, SCTLR_ELx.M or HCR_ELx.VM. 
7 A System register bit determines the endianness of the translation table lookups, SCTLR_ELx.EE. 
. A Translation Control Register (TCR_ELx) controls the stage of address translation. 


= If a stage of address translation supports two VA ranges then that stage of translation provides: 
— A single TCR_ELx. 
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—  ATTBR _ELx for each VA range. TTBRO_ELx points to the translation tables for the address range 
that starts at 0x0000000000000000, and TTBR1_ELx points to the translation tables for the address 
range that ends at OxFFFFFFFFFFFFFFFF. 


Otherwise, a stage of translation provides a single TCR_ELx and a single TTBR_ELx that holds the address 
of the translation table that must be used for the first lookup for the stage of address translation. 


Table D5-2 Enable and endianness bits for the AArch64 translation stages 
































Translation stage Controlled from Controlling registers 
Secure EL3 stage 1 EL3 SCTLR_EL3.{EE,M} TCR_EL3 
TTBRO_EL3 
Secure EL2 stage 1 Secure EL2 SCTLR_EL2.{EE,M} TCR EL2 
TTBRO_EL2 
Secure EL2&0? stage 1 Secure EL2 SCTLR_EL2.{EE,M} TCR EL2 
TTBRO_EL2 
TTBR1_EL2 
Secure EL1&0? stage 2 Secure EL2 SCTLR_EL2.EE VSTCR_EL2 
HCR_EL2.VM VSTTBR_EL2 
VTCR_EL2 
VTTBR_EL2 
Secure EL1&0 stage 1 Secure EL1 SCTLR_EL1.{EE,M} TCR ELl 
TTBRO_EL1 
TTBR1_EL1 
Non-secure EL2 stage 1 Non-secure EL2 SCTLR_EL2.{EE,M} TCR EL2 
TTBRO_EL2 
Non-secure EL2&0° stage 1 Non-secure EL2 SCTLR_EL2.{EE,M} TCR _EL2 
TTBRO_EL2 
TTBR1_EL2 
Non-secure EL1&0 stage 2 = Non-secure EL2 SCTLR_EL2.EE VTCR_EL2 
HCR_EL2.VM VTTBR_EL2 
Non-secure EL1&0 stage 1 Non-secure EL1 SCTLR_EL1.{EE,M} TCR ELI 
TTBRO_EL1 
TTBRI_EL1 





a. This translation regime is supported only if an implementation includes ARMv8.4-SecEL2. 
When supported, it is used when the value of SCR_EL3.EEL2 is 1. 


b. The EL2&0 translation regime is supported only if an implementation includes ARMv8.1-VHE. 
When supported, it is used when the value of HCR_EL2.E2H is 1. 


Note 





If the PA of the software that enables or disables a particular stage of address translation differs from its VA, 
speculative instruction fetching can cause complications. Arm strongly recommends that the PA and VA of any 
software that enables or disables a stage of address translation are identical if that stage of translation controls 
translations that apply to the software currently being executed. 





The following subsections give more information about controlling address translation: 


System registers relevant to MMU operation on page D5-2519. 

Address size configuration on page D5-2519. 

Atomicity of register changes on changing virtual machine on page D5-2525. 
Use of out-of-context translation regimes on page D5-2526. 
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If ARMv8.5-MemTag is implemented and enabled, Chapter D6 Armv8.5 Memory Tagging Extension 


System registers relevant to MMU operation 


provides further controls for the checking of Tagged and Untagged addresses. 


In AArch64 state, System registers have a suffix, that indicates the lowest Exception level from which they can be 
accessed. In some general descriptions of MMU control and address translation, this chapter uses a Common 
abbreviation for each of the System registers that affects MMU operation, as Table D5-3 shows. The common 


abbreviation is used when describing features that apply to multiple translation regimes or stages. 


Note 





The only translation regime that supports a stage 2 translation is the EL1&0 translation regime, when EL2 is 
enabled. 


Table D5-3 Abbreviations for System registers used in this chapter 





Common abbreviation 


Translation stage 


Exception level 


























EL1 EL2 EL3 

HCR_ELx : HCR EL2 g 
SCTLR_ELx k SCTLR_EL1 SCTLR_EL2 SCTLR_EL3 
TCR_ELx Stage 1 TCR_ELI1 TCR_EL2 TCR_EL3 

Stage 2 = VTCR_EL2 VSTCR_EL2@ - 
TTBR_ELx Stage 1 TTBRO_EL1,TTBRI_EL1 TTBRO EL2 TTBRO_EL3 

Stage 2 P VTTBR_EL2, VSTTBR EL2è - 
TTBRO_ELx Stage 1 TTBRO_EL1 TTBRO_EL2 TTBRO_EL3 
TTBR1_ELx Stage 1 TTBR1 ELl TTBR1_EL2° - 


a. Only when both the implementation includes ARMv8.4-SecEL2 and the value of SCR_EL3.EEL2 is 1. 
b. Only when both the implementation includes ARMv8.1-VHE and the value of HCR_EL2.E2H is 1. 
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Address size configuration 


The following subsubsections specify the configuration of the PA size and of the input and output address sizes for 
each of the stages of address translation: 


Physical address size on page D5-2520. 


Output address size on page D5-2520. 


Input address size on page D5-2521. 
Supported IPA size on page D5-2523. 
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Physical address size 


The ID AA64MMFRO_EL1.PARange field indicates the implemented PA size, as Table D5-4 shows. 


Table D5-4 Physical address size implementation options 





ID_AA64MMFRO_EL1.PARange’_ Total PA size PA address size 























0000 4 GB 32 bits, PA[31:0] 
0001 64 GB 36 bits, PA[35:0] 
0010 1 TB 40 bits, PA[39:0] 
0011 4TB 42 bits, PA[41:0] 
0100 16 TB 44 bits, PA[43:0] 
0101 256 TB 48 bits, PA[47:0] 
0110 4PB 52 bits, PA[51:0]8 





a. Only when an implementation includes ARMv8.2-LPA and the 64KB 
translation granule is used, see Extending addressing above 48 bits on 
page D5-2524. 


All other PARange values are reserved. 


Output address size 


For each enabled stage of address translation, TCR_ELx. {I} PS must be programmed to maximum output address 
size for that stage of translation, using the encodings as shown in Table DS-5. 


Table D5-5 Output address size implementation options 





TCR_ELx.{I}PS Total output size Output address size 























000 4 GB 32 bits, PA[31:0] 
001 64 GB 36 bits, PA[35:0] 
010 1 TB 40 bits, PA[39:0] 
011 4TB 42 bits, PA[41:0] 
100 16 TB 44 bits, PA[43:0] 
101 256 TB 48 bits, PA[47:0] 
110 4PB 52 bits, PA[51:0]è 





a. Only when an implementation includes ARMv8.2-LPA and is 
using the 64KB translation granule, see Extending addressing 
above 48 bits on page D5-2524. 





Note 
° The naming of this field is as follows: 
IPS ° In TCR_ELI. 
. In an implementation that includes ARMv8.1-VHE, in TCR_EL2 when the value of 
HCR_EL2.E2H is 1. 
PS Otherwise. 
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è The {I}PS fields are 3-bit fields, corresponding to the least-significant PARange bits shown in Table D5-4 
on page D5-2520. 





If {I}PS is programmed to a value larger than the implemented PA size, then the PE behaves as if programmed with 
the implemented PA size, but software must not rely on this behavior. That is, the output address size is never larger 
than the implemented PA size. Table D5-4 on page D5-2520 shows the implemented PA size. 


The PE checks that the TTBR_ELzx, translation table entries, and the output address for the stage of address 
translation have the address bits above the output address size set to zero. If this is not the case, an Address size fault 
is generated for the level and stage of translation that caused the fault. An Address size fault from the TTBR_ELx 
is always reported as a level 0 fault. When ARMv8.2-LPA is implemented and a translation granule of 4KB or 16KB 
is in use, all output addresses are treated as having bits[51:48] set to 0b0000. 


If stage 1 translation is disabled and the input address is larger than the implemented PA size, then a stage 1 level 0 
Address size fault is generated. 


Note 


These faults are reported as level 0 faults even if they occur in a translation stage that does not perform level 0 
lookups. 








When using two stages of translation: 


: If stage 2 translation is disabled and the output address from the stage 1 translation is larger than the 
implemented PA size, then a stage 1 Address size fault is generated for the level of the stage 1 translation that 
generated the output address. 


© If stage 2 translation is enabled and the output address from the stage 1 translation does not generate a stage 1 
Address size fault, but is larger than the input address size specified for the stage 2 translation, then a stage 2 
Translation fault is generated. 


Input address size 
For each enabled stage of address translation, the TCR_ELx.TxSZ fields specify the input address size: 


For a stage of translation that can support two VA ranges 


The TCR_ELx has two TxSZ fields, corresponding to the two VA ranges: 
- TCR_ELx.TOSZ specifies the size for the lower VA range, translated using TTBRO_ELx. 
. TCR_ELx.T1SZ specifies the size for the upper VA range, translated using TTBR1_ELx. 


For a stage of translation that supports only a single input address (IA) range 
The TCR_ELx has a single TOSZ field, and IAs are translated using TTBRO_ELx. 


Attempting to translate an address that is larger than the configured input address size generates a Translation fault. 
This means: 


$ Fora TCR_ELx with a single TOSZ field and a 48-bit address size, Figure D5-2 on page D5-2522 shows the 
input address map: 
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Input address (IA) 
OxFFFF_FFFF_FFFF_FFFF 





Accesses 
generate 
Translation 
faults 





0x0000_FFFF_FFFF_FFFF < Boundary, when TCR_ELx.TOSZ==16 


J| TTBRO_ELx | 
T region T Effect of increasing TCR_ELx.TOSZ 








0x0000_0000_0000_0000 





Figure D5-2 AArch64 input address map when using a single TTBR and 48-bit input address size 


° Fora TCR_ELx with two TxSZ fields, the input address is always a VA, and Selection between TTBRO_ELx 
and TTBR1_ELx when two VA ranges are supported on page D5-2550 describes the VA address map. 


For the EL1&0 translation regime when EL2 is enabled, when both stages of translation are enabled, if the output 
address from the stage 1 translation does not generate a stage 1 address size fault, and is larger than the input address 
specified by VTCR_EL2.T0SZ or VSTCR_EL2.TOSZ, then the input address size check for the stage 2 translation 
generates a Translation fault. 


Although software can configure the input address size to be smaller than 48 bits, all implemented AArch64 
TTBR_ELxs must support input address sizes of up to 48 bits, and in an implementation that includes 
Armv8.2-LVA, all TTBR_ELxs must support input address sizes of up to 52 bits. 


Overview of the VMSAv8-64 address translation stages on page D5-2536 gives more information about the 
relationship between the required input address size, the value of TxSZ, and the required initial lookup level, and 
how these are affected by the translation granule size. However: 


For all translation stages 


If ARMv8.4-TTST is implemented, while the PE is executing in AArch64 state and is using 4KB 
or 16KB translation granules, the maximum TxSZ value is 48. 


If ARMv8.4-TTST is implemented, while the PE is executing in AArch64 state and is using 64KB 
translation granules, the maximum TxSZ value is 47. 


If ARMV8.4-TTST is not implemented or while the PE is executing in AArch32 state, the maximum 
TxSZ value is 39. 


If TxSZ is programmed to a value larger than the defined maximum then it is IMPLEMENTATION 
DEFINED whether: 


: The implementation behaves as if the field is programmed to the maximum for all purposes 
other than reading back the value of the field. 

. Any use of the TxSZ value generates a Level 0 Translation fault for the stage of translation 
at which TxSZ is used. 


For a stage 1 translation 


The effective minimum value of TxSZ is 16 if ARMv8.2-LVA is not supported or if the translation 
granule that is in use is 4KB or 16KB in size. When ARMv8.2-LVA is supported, for the 64KB 
translation granule size only, the effective minimum value of TxSZ is 12. 


If TxSZ is programmed to a value smaller than the effective minimum value, and if ARMv8.2-LVA 
is not supported, then it IMPLEMENTATION DEFINED whether: 


: The implementation behaves as if the field were programmed to 16 for all purposes other than 
reading back the value of the field. 
è Any use of the TxSZ value generates a stage 1 level 0 Translation fault. 
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If TxSZ is programmed to a value smaller than the effective minimum value when ARMv8.2-LVA 
is supported, then any use of the TxSZ value generates a stage 1 level 0 Translation fault. 


For more information, see Extending addressing above 48 bits on page D5-2524. 


For a stage 2 translation 


Supported IPA size defines the effective minimum value of TOSZ, that depends on the supported PA 
size, and also describes the possible effects of programming TOSZ to a value that is smaller than this 
effective minimum value. 


Supported IPA size 


When EL2 is enabled in the current Security state, for the EL1&0 translation regime, the maximum IPA size is the 
maximum input address size for the second stage of translation is specified by VTCR_EL2.T0OSZ or 
VSTCR_EL2.TOSZ. For more information, see Input address size on page D5-2521 and Output address size on 
page D5-2520. 


The maximum IPA size is constrained by the implemented PA size that is specified by 
ID_AA64MMFRO_EL1.PARange, see Physical address size on page DS-2520. 


The implemented PA size also constrains the value of VTCR_EL2.SL0 and VSTCR_EL2.SLO0, that specifies the 
level of the initial lookup. SLO also depends on the translation granule, as described in Overview of the VMSAv8-64 
address translation stages on page D5-2536. 


Table D5-6 PA size implications for the VTCR_EL2.{T0SZ, SLO} and VSTCR_EL2.{T0SZ, SLO} fields 





Valid initial lookup levels 


Supported PA size Effective minimum T0SZ value 


4KB granule 16KBgranule 64KB granule 























32 bits 32 if EL1 is using AArch64 3a, 2,1 352 3,2 
24 if EL1 is using AArch32 

36 bits 28 if EL1 is using AArch64 3a, 2, 1 3,2 3,2 
24 if EL1 is using AArch32 

40 bits 24 34, 2,1 3,2 3,2 

42 bits 22 3a, 2,1 3,2,1 3,2 

44 bits 20 3a, 2.1,0 3,2, 1 3,2, 1 

48 bits 16 34, 2, 1,0 3,2, 1 3, 2, 1 

52 bits 12 -b -b 3,2,1 
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a. Only supported if ARMv8.4-TTST is implemented, while the PE is executing in AArch64 state. 
b. Only supported if ARMv8.2-LPA is implemented, and the PE is using the 64KB translation granule size. 


If VITCR_EL2.SL0 is programmed to represent an initial lookup level not shown in Table D5-6, or is programmed 
to areserved value, then any memory access that uses the second stage of translation generates a stage 2 level 0 
Translation fault. 


If VITCR_EL2.TOSZ is programmed to a value smaller than the effective minimum value shown in Table D5-6, and 
if ARMv8.2-LPA is not implemented, then the implementation consistently does one of the following: 


° Treats the VTCR_EL2.TOSZ field as being programmed to the effective minimum value for all purposes 
other than reading back the value of the field. 


° Treats the VITCR_EL2.TOSZ field as being programmed to the effective minimum value for all purposes 
other than: 


— Reading back the value of the field. 
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— Checking whether the value of VTCR_EL2.TOSZ is consistent with the value of VTCR_EL2.SL0. 
$ Generates a stage 2 level 0 Translation fault on any memory access that uses the second stage of translation. 


If TOSZ is programmed to a value smaller than the effective minimum value when ARMv8.2-LPA is supported, then 
any use of the TOSZ value generates a stage 2 level 0 Translation fault. 


For more information, see Extending addressing above 48 bits. 


Note 


Programming VTCR_EL2.TOSZ to a value smaller than the effective minimum value shown in Table D5-6 on 
page DS-2523 can never provide support for a larger address range than the range given by the effective minimum 
value, because the stage 1 output address will give an Address size fault if it is larger than either: 

e The PA size, for a VMSAv8-64 stage 1 translation. 


: 40 bits, fora VMSAv8-32 stage 1 translation. 








Extending addressing above 48 bits 
Armv8.2 defines the following options for supporting 52-bit addressing: 


ARMv8.2-LVA Supports 52-bit VAs when using the 64KB translation granule. The maximum IPA and PA 
sizes remain 48-bit unless ARMv8.2-LPA is implemented. 


ARMv8.2-LPA Supports 52-bit IPAs and PAs when using the 64KB translation granule. The maximum VA 
size remains 48-bit unless ARMv8.2-LVA is implemented. 


ARMv8.2-LPA and ARMv8.2-LVA can be implemented independently of each other. 


When using the 64KB translation granule, ARMv8.2-LPA supports Block descriptors in level 1 translation tables. 
In this case, a block covers a 4TB address range. 


In all cases, 52-bit address ranges are supported only when using the 64KB translation granule. Maximum address 
sizes when using the other translation granules remain 48-bit. 


See Address size configuration on page D5-2519 for how to configure use of 52-bit VAs when an implementation 
includes ARMV8.2-LVA. 


When using the 64KB translation granule, the 52-bit input address size is supported as follows: 


s In an implementation that includes ARMv8.2-LVA, for stage 1 translations the minimum value of 
TCR_ELx.TnSZ field is 12. 


If TCR_ELx.TnSZ is programmed to a value less than 12, any use of the TCR_ELx.TnSZ bit generates a 
stage 1 level 0 Translation fault. 


7 In an implementation that includes ARMv8.2-LVA, for a stage 2 translation the effective minimum value of 
VTCR_EL2.TOSZ and VSTCR_EL2.TOSZ is 12. 


If VITCR_EL2.TOSZ or VSTCR_EL2.TOSZ is programmed to a smaller value than the effective minimum 
size, then any use of a stage 2 translation generates a stage 2 level 0 Translation fault. 


Table D5-25 on page D5-2557 shows the translation table descriptor addressing for each level of lookup when using 
the 64KB translation granule. 


In an implementation that includes ARMv8.2-LPA and is using the 64KB translation granule: 


° Bits[15:12] ofeach valid translation table descriptor hold bits[51:48] of the output address, or of the address 
of the translation table to be used for the initial lookup at the next level of translation. If the implementation 
does not support 52-bit physical addresses, then it is IMPLEMENTATION DEFINED whether non-zero values for 
these bits generate an Address size fault. In this case, not generating an Address Size Fault is deprecated. 


è For a stage 1 translation, bits[5:2] of TTBRO_ELx or TTBR1_ELx holds bits[51:48] of the address of the 
translation table to be used for the initial lookup of that translation regime. If the implementation does not 
support 52-bit physical addresses, then non-zero values for these bits generate an Address size fault. 
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For a stage 2 translation, bits[5:2] of VTTBR_EL2 or VSTTBR_EL2 holds bits[5 1:48] of the address of the 
translation table to be used for the initial lookup of the stage 2 translation. If the implementation does not 
support 52-bit physical addresses, then non-zero values for these bits generate an Address size fault. 


è The minimum alignment of a translation table containing fewer than eight entries is 64 bytes. 





Note 


This is because, when the OA space is more than 48 bits, TTBR_ELx[5:2] specifies bits[51:48] of the 
translation table base address, and a translation table of fewer than eight entries would require one or more 
bits of TTBR_ELx[5:2] to be RESO if the table was aligned to its size. 





For more information, see VMSAv8-64 translation table level 0, level 1, and level 2 descriptor formats on 
page DS5-2565 and Armv8 translation table level 3 descriptor formats on page D5-2568. 


The ID AA64MMFR2_EL1.VA field indicates the supported VA size. This field has the value 0x1 if the 
implementation includes ARMv8.2-LVA. 


The ID AA64MMFRO_EL1.PArange field indicates the supported PA and IPA size. This field has the value 0x6 if 
the implementation supports 52-bit PAs. 


In addition to the System registers discussed in this subsection, the ARMv8.2-LPA and ARMv8.2-LVA features 
affect the following System registers that contain addresses: 


*  HPFAR _EL2. 
e PAR ELI. 

* VBAR ELI, VBAR_EL2, VBAR_EL3. 
+ DBGBVR<n>_EL]I. 

*  DBGWVR<n>_ELI. 

*  MDRAR ELI. 

e LOREA ELI. 

+ LORSA_ELI. 


The larger VA, IPA, and PA addresses also affect the following System instructions for TLB maintenance: 
° TLBI IPAS2E1. 

. TLBI IPAS2EIIS. 

° TLBI IPAS2E108. 

° TLBI IPAS2LE1. 

. TLBI IPAS2LE1IS. 

° TLBI IPAS2LE10S. 

° TLBI RIPAS2E1. 

° TLBI RIPAS2E1IS. 

. TLBI RIPAS2E10S. 

° TLBI RIPAS2LE1. 

° TLBI RIPAS2LEIIS. 
° TLBI RIPAS2LE10S. 


Atomicity of register changes on changing virtual machine 


From the viewpoint of software executing at EL1 or ELO, when there is a switch from one virtual machine to 
another, the registers that control or affect address translation must be changed atomically. This applies to the 
registers for the EL1&0, when EL2 is enabled, translation regime. This means that all of the following registers must 
change atomically: 


, The registers associated with the stage 1 translations: 
— MAR ELl and AMAIR ELI. 
— TTBRO_EL1, TTBR1_EL1, TCR_EL1, and CONTEXTIDR_ELl1. 
—  SCTLR_EL1. 
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è The registers associated with the stage 2 translations: 
— VTTBR_EL2 and VTCR_EL2. 
— SCTLR ElL2. 


Note 


Only some bits of SCTLR_EL1 affect the stage 1 translation, and only some bits of SCTLR_EL2 affect the stage 2 
translation. However, in each case, changing these bits requires a write to the register, and that write must be atomic 
with the other register updates. 





These registers apply to execution using the EL1&0, when EL2 is enabled, translation regime. However, when 
updated as part of a switch of virtual machines they are updated by software executing at EL2. This means the 
registers are out of context when they are updated, and no synchronization precautions are required. 


Similar considerations apply when ARMv8.1-VHE is implemented. 


Use of out-of-context translation regimes 
The architecture requires that: 


. When executing at EL3, Secure or Non-secure EL2, or Secure EL1, the PE must not use the registers 
associated with the Non-secure EL1&0 translation regime for speculative memory accesses. 


. When executing at EL3, Secure or Non-secure EL2, or Non-secure EL1, the PE must not use the registers 
associated with the Secure EL1&0 translation regime for speculative memory accesses. 


è When executing at EL3 or Non-secure EL1, the PE must not use the registers associated with the Secure EL2, 
or Secure EL2&0 translation regime for speculative memory accesses. 


: When executing at EL3 or Secure EL1, the PE must not use the registers associated with the Non-secure EL2, 
or Non-secure EL2&0 translation regime for speculative memory accesses. 


. When secure EL2 is not enabled, the PE must not use the registers associated with the Secure EL2, or Secure 
EL2&0 translation regime for speculative memory accesses. 


When entering an Exception level, on completion of a DSB instruction, no new memory accesses using any 
translation table entries from a translation regime of an Exception level lower than the Exception level that has been 
entered will be observed by any observers, to the extent that those accesses are required to be observed as 
determined by the shareability and cacheability of those translation table entries. 





Note 


° This does not require that speculative memory accesses cannot be performed using those entries if it is 
impossible to tell that those memory accesses have been observed by the observers. 


s This requirement does not imply that, on taking an exception to a higher Exception level, any translation table 
walks started before the exception was taken will be completed by the time the higher Exception level is 
entered, and therefore memory accesses required for such a translation table walk might, in effect, be 
performed speculatively. However, the execution of a DSB on entry to the higher Exception level ensures that 
these accesses are complete. 





Memory translation granule size 


The memory translation granule size defines both: 
s The maximum size of a single translation table. 


$ The memory page size. That is, the granularity of a translation table lookup. 


VMSAv8-64 supports translation granule sizes of 4KB, 16KB, and 64KB. Support for each granule size is optional. 
If ARMv8.5-GTG is implemented, support for granule size in Stage 1 is indicated as shown in Table D5-7 on 
page DS-2527, and support for granule size in Stage 2 is indicated as shown in Table D5-8 on page D5-2527. 
Otherwise, support for granule size in both Stages 1 and 2 is indicated as shown in Table D5-7 on page D5-2527: 
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Table D5-7 Identifying supported granule sizes 





Support indicated by: 
Granule size 











Field Values 
4KB ID_AA64MMFRO_EL1.TGran4 0bo000 4KB granule size supported. 
0b1111 4KB granule size not supported. 
16KB ID_AA64MMFRO_EL1.TGran1l6 0b0000 16KB granule size not supported. 
0b0001 16KB granule size supported. 
64KB ID_AA64MMFRO_EL1.TGran64 0b0000 64KB granule size supported. 
@b1111 64KB granule size not supported. 





Table D5-8 Identifying supported granule sizes for Level 2 translation 





Support indicated by: 
Granule size 














Field Values 

4KB ID_AA64MMEFRO_EL1.TGran4 2 0b0010 4KB granule size supported at stage 2. 
0b0001 4KB granule size not supported at stage 2. 

16KB ID_AA64MMFRO_ EL1.TGranl6_2  0b0010 16KB granule size supported.at stage 2. 
0b0001 16KB granule size not supported at stage 2. 

64KB ID_AA64MMFRO_ EL1.TGran64 2  0b0010 64KB granule size supported.at stage 2. 
0b0001 64KB granule size not supported at stage 2. 

Note 





From a hardware viewpoint, the TGran*_2 fields hold the same information as the corresponding TGran* fields. 
In VMSAv8-64, each address translation stage is configured, independently, to use one of the supported granule 
sizes. 


Note 


. Using a larger granule size can reduce the maximum required number of levels of address lookup because: 





— Theincreased translation table size means the translation table holds more entries. This means a single 
lookup can resolve more bits of the input address. 


— The increased page size means more of the least-significant address bits are required to address a page. 
These address bits are flat mapped from the input address to the output address, and therefore do not 
require translation. 


s Arm recommends that memory-mapped peripherals are separated by an integer multiple of the largest 
granule size supported by the operating system or hypervisor, to allow each peripheral to be managed 
independently. 
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Table D5-9 summarizes the effects of the different granule sizes. 


Table D5-9 Effect of granule size on a stage of address translation 

















Property 4KB granule 16KB granule 64KB granule Notes 

Maximum number of entries in a translation 512 2048 (2K) 8192 (8K) - 

table 

Address bits resolved in one level of lookup 9 11 13 29=512, 2'1=2K, 213=8K 

Page size 4KB 16KB 64KB - 

Page address range VA[11:0]= VA[13:0]= VA[15:0]= 212=4Ķ, 2!4=16K, 
PA[11:0] PA[13:0] PA[15:0] 216=64K 





How the granule size affects the address translation process 


As Table D5-9 shows, the translation granule determines the number of address bits: 


Required to address a memory page. 
That can be resolved in a single translation table lookup. 


This means the translation granule determines how the input address (IA) is resolved to an output address (OA) by 
the translation process. 


Because a single translation table lookup can resolve only a limited number of address bits, the IA to OA resolution 
requires multiple /evels of lookup. 


Considering the resolution of an JA range of 48 bits, with a translation granule size of 2” bytes: 


The least-significant n bits of the IA address the memory page. This means OA[(n-1):0]=IA[(n-1):0]. 
The remaining (48-7) bits of the IA, [A[47:7], must be resolved by the address translation. 


A translation table descriptor is 8 bytes. Therefore: 

—  Acomplete translation table holds 20-3) descriptors. 

— A single level of translation can resolve a maximum of (n-3) bits of address. 

Consider the translation process, working back from the final level of lookup, that resolves the least 


significant of the address bits that require translation. Because the translation needs to resolve [A[47:n] and 
a level of lookup can resolve (n-3) bits of address: 


— The final level of lookup resolves IA[(2n-4):n]. 
— The previous level of lookup resolves IA[(3n-7):(2n-3)]. 


However, the level of lookup that resolves the most significant bits of the IA might not require a full-sized 
translation table. Therefore, in general, for a 48-bit IA the address bits resolved in a level of lookup are: 


TA[Min(47, ((m-3)(n-3)+2n-4)):(n+(x-3)(n-3))], where: 
Min(a, b) Is a function that returns the minimum of a and b. 


m Indicates the level of lookup. This is defined so that the level that resolves the least significant 
bit of the translated IA bits is level 3. 


The following diagrams show this model, for each of the permitted granule sizes. 


Figure D5-3 on page D5-2529 shows how a 48-bit IA is resolved when using the 4KB translation granule. 


D5-2528 
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pag the 4KB translation granule 
39 38 30 29 2120 1211 





i. 1A[11:0] 


IA[20:12] 





IA[29:21] 








IA[38:30] 





IA[47:39] 





OA[11:0] 
Index the level 3 translation tablet 
or 
OA[20:12]* 
Index the level 2 translation tablet 
or 
OA[29:21]* 


Index the level 1 translation tablet 


Index the level 0 translation table 


OA Output address 
Tt Table entry at previous lookup level 
* Block entry at previous lookup level 


Figure D5-3 How a 48-bit IA is resolved when using the 4KB translation granule 


Figure D5-4 shows how a 48-bit IA is resolved when using the 16KB translation granule. 


Using the 16KB translation granule 


4746 36 35 25 24 14 13 


= I = Input address (IA) 





L__1aj13:0] 

















IA[47] 


IA[24:14] 


IA[35:25] 


|A[46:36] 


OA[13:0] 
Index the level 3 translation tablet 
or 
OA[24:14]* 
Index the level 2 translation tablet 
or 
OA[35:25]* 


Index the level 1 translation table 


Indexes the level 0 translation table 


OA Output address 
t Table entry at previous lookup level 
* Block entry at previous lookup level 


Figure D5-4 How a 48-bit IA is resolved when using the 16KB translation granule 


Figure D5-5 on page D5-2530 shows how a 48-bit IA is resolved when using the 64KB translation granule. 
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Using the 64KB translation granule 


47 
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Input address (IA) 


L~~ afso] OA[15:0] 











Index the level 3 translation tablet 


IA[28:16] or 
OA[28:16]* 
Index the level 2 translation tablet 
IA[41:29] or 
OA[41:29]* 
IA[47:42] Index the level 1 translation table 


OA Output address 
t Table entry at previous lookup level 
* Block entry at previous lookup level 


Figure D5-5 How a 48-bit IA is resolved when using the 64KB translation granule 


In an implementation that includes ARMv8.2-LVA and is using the 64KB translation granule: 
$ The IA range that can be addressed by the level 1 lookup is IA[51:42]. 
° The level 1 lookup can directly address a block of memory, returning OA[5 1:42]. 


Note 





The increased IA range means the size of the indexed level 1 translation table is increased. 





Later sections of this chapter give more information about the translation process, and explain the terminology used 


in these figures. 


Effect of granule size on translation table addressing and indexing 


Table D5-10 shows the effect of the translation granule size on the addressing and indexing of the TTBR_ELx, and 
on the input address range that must be resolved. 


Table D5-10 The effect of translation granule size on the translation tables 





Translation table 














D5-2530 


Granule Translation 
size resolves? Nowe 
Addressed by Indexed by> 
4KB TTBR_ELx[47:12] IA[@ + 8):x] TA[47:12] One level of lookup resolves up to® 9 bits of [A 
16KB TTBR_ELx[47:14] TA[(x+ 10):x] IA[47:14] One level of lookup resolves up to® 11 bits of IA 
64KB TTBR_ELx[47:16]4 TA[@ + 12):x] — TA[47:16]4 One level of lookup resolves up to® 13 bits of IA 
TTBR_ELx[5:2, 47:16] TA[51:16] 
a. When translating a maximum-sized input address, and accessing a page of memory. 
b. Where the value of x depends on the lookup level, see Table DS-11 on page D5-2531. 


ee 


Depending on the IA size, the initial lookup might resolve fewer bits of the IA. 


For the 64KB granule entries in the Addressed by and Translation resolves columns, the second entry applies to an implementation 


that includes ARMv8.2-LVA and has selected an IA space larger than 47 bits, see Extending addressing above 48 bits on 
page D5-2524. The first entry applies otherwise. 
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Table D5-11 shows the IA bits resolved at each level of lookup, and how these correspond to the possible values of 
x in Table D5-10 on page D5-2530. 


Table D5-11 IA bits resolved at different levels of lookup 

















Lookup level 4KB granule size 16KB granule size 64KB granule size 

Zero IA[47:39], x = 39 IA[474], x =47 -b 

First IA[38:30], x = 30 IA[46:36], x = 36 TA[472:42], x = 42° 
TA[51 4:42], x = 42 

Second TA[29:21], x =21 TA[35:25], x = 25 TA[41:29], x = 29 

Third TA[20:12], x = 12 TA[24:14], x = 14 IA[28:16], x = 16 








a. Smaller value than indicated in Table D5-10 on page D5-2530, as explained in this section. 
b. Level 0 lookup not possible with 64KB granule size 


c. The second entry applies to an implementation that includes ARMv8.2-LVA and has selected an IA space 
larger than 47 bits, see Extending addressing above 48 bits on page D5-2524, The first entry applies otherwise. 


Table D5-10 on page D5-2530 refers to accessing a complete translation table, of 4KB, 16KB, or 64KB. However, 
the Armv8 translation system supports the following possible variations from the information in Table D5-10 on 
page D5-2530: 


Reduced IA width 


Depending on the configuration and implementation choices, the required input address width for 
the initial level of lookup might be smaller than the number of address bits that can be resolved at 
that level. This means that, for this initial level of lookup: 


. The translation table size is reduced. For each 1 bit reduction in the input address size the size 
of the translation table is halved. 
Note 


— This has no effect on the translation table size for subsequent levels of lookup, for 
which the lookups always use full-sized translation tables. 





— Fora stage 2 translation, it might be possible to start the translation at a lower level, 
see Concatenated translation tables on page D5-2532. 





° More low-order TTBR_ELx bits are needed to hold the translation table base address. 


Example D5-1 shows how this applies to translating a 35-bit input address range using the 4KB 
granule. 


Example D5-1 Effect of an IA width of 35 bits when using the 4KB granule size 


With a 4KB granule size, a single level of lookup can resolve up to 9 bits of IA. If an implementation has a 35-bit 
input address range, IA[34:0], Table D5-11 shows that lookup must start at level 1, and that the initial lookup must 
resolve IA[34:30], meaning it resolves 5 bits of address: This 4-bit reduction in the required resolution means: 


° The translation table size is divided by 24, giving a size of 256B. 


° The TTBR_ELx requires 4 more bits for the translation table base address, which becomes 
TTBR_ELx[47:8]. 


When using the 64KB translation granule to translate the maximum IA size of 48 bits, Table D5-11 
shows that a level 1 lookup must resolve only IA[47:42]. This is 6 bits of address, compared to the 
13 bits that can be resolved at a single level of lookup. This 7-bit reduction in the required resolution 
means: 


: The translation table size is divided by 27, giving a size of 512B. 
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° The TTBR_ELx requires 7 more bits for the translation table base address, which becomes 
TTBR_ELx[47:9]. 


Concatenated translation tables 


For stage 2 address translations, for the initial lookup, up to 16 translation tables can be 
concatenated. This means additional IA bits can be resolved at that lookup level. The block of 
concatenated translation tables must be aligned to the size of the block of translation tables. 


This means that each additional IA bit resolved: 


- Doubles the number of translation tables required. Resolving an additional n bits requires 2” 
concatenated translation tables at the initial lookup level. 


° Reduces by 1 bit the width of the translation table base address held in the TTBR_ELx. 


This means that, for the initial lookup of a stage 2 translation table, the IA ranges shown in 
Table D5-11 on page D5-2531 can be extended by up to 4 bits. Example D5-2 shows how 
concatenation can be used to resolve a 40-bit IA when using the 4KB translation granule. 


Example D5-2 Concatenating translation tables to resolve a 40-bit IA range, with the 4K granule 


Table D5-11 on page D5-2531 shows that, when using the 4KB translation granule, a level 1 lookup can resolve a 
39-bit IA, with the first lookup resolving IA[38:30]. For a stage 2 translation, to extend the IA width to 40 bits and 
resolve IA[39:30] with the first lookup: 


7 Two translation tables are concatenated, giving a total size of 8KB. 


° The TTBR_ELx requires 1 fewer bit for the translation table base address, which becomes 
TTBR_ELx[47:13]. 


For more information, see Use of concatenated translation tables for the initial stage 2 lookup on 
page D5-2552. 


In all cases, the translation table, or block of concatenated translation tables, must be aligned to the actual size of 
the table or block of concatenated tables. 


The translation table base address held in the TTBR_ELx is defined in the OA map for that stage of address 
translation. The information given in this section assumes this stage of translation has the maximum OA size, 
meaning the translation table base address is: 


° TTBR_ELx[47:12] if using the 4KB translation granule. 
. TTBR_ELx[47:14] if using the 16KB translation granule. 
è TTBR_ELx[47:16] if using the 64KB translation granule with an OA of 48 bits. 


$ In an implementation that includes ARMv8.2-LPA and is using the 64KB translation granule, OA[51:16], 
where: 
—  TTBR_ELx[5:2] holds OA[51:48]. 
— TTBR_ELx[47:16] holds OA[47:16]. 


If the OA address is smaller than 48 bits then the upper bits of this field must be written as zero. For example, for a 
40-bit OA range: 


è If using the 4KB translation granule: 

— TTBR_ELx[47:40] must be set to zero. 

—  TTBR_ELx[39:12] holds the translation table base address. 
à If using the 16KB translation granule: 

— TTBR_ELx[47:40] must be set to zero. 

—  TTBR_ELx[39:14] holds the translation table base address. 
. If using the 64KB translation granule: 

—  TTBR_ELx[47:40] must be set to zero. 

—  TTBR_ELx[39:16] holds the translation table base address. 
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In all cases, if TTBR_ELx[47:40] is not zero, any attempt to access the translation table generates an Address size 
fault. 


D5.2.5 Translation tables and the translation process 


The following subsections describe general properties of the translation tables and translation table walks, that are 
largely independent of the translation table format: 


° Translation table walks. 

$ Ordering of memory accesses from translation table walks on page D5-2535. 
` Security state of translation table lookups on page D5-2535. 

° Control of translation table walks on page D5-2536. 


See also Selection between TTBRO_ELx and TTBR1_ELx when two VA ranges are supported on page D5-2550. 


Translation table walks 


A translation table walk comprises one or more translation table lookups. The translation table walk is the set of 
lookups that are required to translate the VA to the PA. For the EL1&0, when EL2 is enabled, translation regime, 
this set includes lookups for both the stage 1 translation and the stage 2 translation, but translation table walk can 
also be used to refer to either: 


$ The set of lookups required for the stage 1 translation, that translates the VA to the IPA. This is the stage 1 
translation table walk. 


à The set of lookups required for the stage 2 translation, that translates the IPA to the PA. This is the stage 2 
translation table walk. 


The information returned by a successful translation table walk is: 


° The required PA. If the access is from Secure state this includes identifying whether the access is to the Secure 
PA space or the Non-secure PA space, see Security state of translation table lookups on page D5-2535. 


s The memory attributes for the target memory region, as described in Memory types and attributes on 
page B2-143. For more information about how the translation table descriptors specify these attributes see 
Memory region attributes on page D5-2599. 


à The access permissions for the target memory regions. For more information about how the translation table 
descriptors specify these permissions see Memory access control on page D5-2577. 


The translation table walk starts with a read of the translation table for the initial lookup. The TTBR_ELx for the 
stage of translation holds the base address of this table. Each translation table lookup returns a descriptor, that 
indicates one of the following: 


: The entry is the final entry of the walk. In this case, the entry contains the OA, and the permissions and 
attributes for the access. 


à An additional level of lookup is required. In this case, the entry contains the translation table base address for 
that lookup. In addition: 


— The descriptor provides hierarchical attributes that are applied to the final translation, see Hierarchical 
control of Secure or Non-secure memory accesses on page D5-2576 and Hierarchical control of data 
access permissions on page D5-2582. 


— Ifthe translation is in a Secure translation regime, the descriptor indicates whether that base address 
is in the Secure or Non-secure address space, unless a hierarchical control at a previous level of lookup 
has indicated that it must be in the Non-secure address space. 


z The descriptor is invalid. In this case, the memory access generates a Translation fault. 


Figure D5-6 on page D5-2534 gives a generalized view of a single stage of address translation where three levels 
of lookup are required. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D5-2533 
ID070919 Non-Confidential 


The AArch64 Virtual Memory System Architecture 
D5.2 The VMSAv8-64 address translation system 


D5-2534 















































Level 3 table 
Level 2 table 
Memory 
D_Page |» 
Memory = page 
Level 1 table D_Block. r region 4 
v 
D_ Block l» Memory D_Table 

= region A 
a 
D_Table y 














D_Table is a Table descriptor 
D_Block is a Block descriptor 
D_Page is a Page descriptor 











<-> > 


TTBR 














a Indexed by bits from the input address. 
Each lookup level resolves additional bits. 


Figure D5-6 Generalized view of a stage of address translation 


A translation table lookup from VMSAv8-64 performs a single-copy atomic 64-bit access to the translation table 
entry. This means the translation table entry is treated as a 64-bit object for the purpose of endianness. 
SCTLR_ELx.EE determines the endianness of the translation table lookups. 


Note 


Dynamically changing translation table endianness 





Because any change to an SCTLR_ELx.EE, bit requires synchronization before it is visible to 
subsequent operations, Arm strongly recommends that any EE bit is changed only when either: 


. Executing at an Exception level that does not use the translation tables affected by the EE bit 
being changed. 

3 Executing with address translation disabled for any stage of translation affected by the EE bit 
being changed. 


Address translation stages are disabled by setting an SCTLR_ELx.M bit or the HCR_EL2.VM bit 
to 0. See the appropriate register description for more information. 





The appropriate TTBR_ELx holds the output address of the base of the translation table used for the initial lookup, 
and: 


° For all address translation stages other than EL1&0, when EL2 is enabled, stage 1 translations, the output 
address held in the TTBR_ELx, and any translation table base address returned by a translation table 
descriptor, is the PA of the base of the translation table. 


. For EL1&0, when EL2 is enabled, stage 1 translations, the output address held in the TTBR_ELx, and any 
translation table base address returned by a translation table descriptor, is the IPA of the base of the translation 
table. This means that if stage 2 address translation is enabled, each of these OAs is subject to second stage 
translation. 


Note 


TLB caching can be used to minimize the number of translation table lookups that must be performed. For 
the EL1&0, when EL2 is enabled, translation regime, because each stage 1 OA generated during a translation 
table walk is subject to a stage 2 translation, if the caching of translation table entries is ineffective, a VA to 
PA address translation with two stages of translation can give rise to multiple translation table lookups. The 
number of lookups required is given by the following equation: 


(S1+1)*(S2+1) - 1 





Where, for this translation regime, S1 is the number of levels of lookup required for a stage | translation, and 
S2 is the number of levels of lookup required for a stage 2 translation. 
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The TTBR_ELx also determines the memory cacheability and shareability attributes that apply, for the 
corresponding stage of translation, to all translation table lookups generated by that stage of translation. 


The Normal memory type is the memory type defined for a translation table lookup for a stage of translation. 


Note 


è In a two stage translation regime, a translation table lookup from stage 1, that has the Normal memory type 
defined at stage 1 by this rule, can still be given the Device memory type as part of the stage 2 translation of 
that address. Arm strongly recommends against such a remapping of the memory type, and the architecture 
includes a trap of this behavior to EL2. For more information, see Stage 2 fault on a stage 1 translation table 
walk on page D5-2628. 





$ The rules about mismatched attributes given in Mismatched memory attributes on page B2-153 apply to the 
relationship between translation table walks and explicit memory accesses to the translation tables in the 
same way that they apply to the relationship between different explicit memory accesses to the same location. 
For this reason, Arm strongly recommends that the attributes that the TCR_ELx applies to the translation 
tables are the same as the attributes that are applied for explicit accesses to the memory that holds the 
translation tables. 





For more information see Overview of the VMSAv8-64 address translation stages on page D5-2536. 


See also Selection between TTBRO_ELx and TTBR1_ELx when two VA ranges are supported on page D5-2550. 


Ordering of memory accesses from translation table walks 
A translation table walk is considered to be a separate observer, and: 


$ A write to the translation tables can be observed by that separate observer at any time after the execution of 
the instruction that performed that write, but is only guaranteed to be observable after the execution of a DSB 
instruction by the PE that executed the instruction that performed that write to the translation tables. 


° Any writes to the translation tables are not seen by any explicit memory access generated by a load or store 
that occurs in program order before the instruction that performs the write to the translation tables. 


Security state of translation table lookups 
For a Non-secure translation regime, all translation table lookups are performed to Non-secure output addresses. 


For a Secure translation regime, for the first stage of translation, the initial translation table lookup is performed to 
a Secure IPA. 


If the translation table descriptor returned as a result of that initial lookup points to a second translation table, then 
the NSTable bit in that descriptor determines whether that translation table lookup is made to a Secure or to a 
Non-secure IPA. 


This applies for all subsequent translation table lookups as part of that translation table walk, with the additional 
rule that any translation table descriptor that is returned from Non-secure memory is treated as if the NSTable bit in 
that descriptor indicates that the subsequent translation table lookup is to Non-secure memory. 


Where the Secure IPA from a first stage translation table is translated by the second stage translation, the security 
of the output address of that memory access is determined by: 


. For accesses made to Secure IPA space, the VSTCR_EL2.SA bit. 
: For accesses made to Non-secure IPA space, the VTCR_EL2.NSA bit. 


For a Secure translation regime, for the second stage of translation, the security of the output address of the 
translation table walk is determined by: 


$ For translation table walks for the Secure IPA space, the VSTCR_EL2.SW bit. 


e For translation table walks for the Non-secure IPA space, the VTCR_EL2.NSW bit. 
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Control of translation table walks 


When stage 1 translations of a translation can support two VA ranges the TCR_ELx. {EPD0, EPD1} bits determine 
whether, for that regime, the two sets of translation tables for stage 1 are valid. EPDO indicates whether the tables 
that TTBRO_ELx points to is valid, and EPD1 indicates whether the tables that TTBR1_ELx points to is valid. The 
effect of these bits is: 


EPDn == The translation tables are valid, and can be used for a translation table lookup. 


EPDn = Ifa TLB miss occurs based on TTBR_ELx, a Translation fault is returned, and no translation table 
walk is performed. The fault is reported as a level 0 fault. 


D5.2.6 Overview of the VMSAv8-64 address translation stages 


As shown in Memory translation granule size on page D5-2526, the granule size determines significant aspects of 
the address translation process. Effect of granule size on translation table addressing and indexing on page D5-2530 
shows, for each granule size: 


è How the required input address range determines the required initial lookup levels. 
à For stage 2 translations, the possible effect described in Concatenated translation tables on page D5-2532. 
° The TTBR_ELx addressing and indexing for the initial lookup. 


The following subsections summarize the multiple levels of lookup that can be required for a single stage of address 
translation that might require the maximum number of lookups: 


$ Overview of VMSAv8-64 address translation using the 4KB translation granule. 
. Overview of VMSAv8-64 address translation using the 16KB translation granule on page D5-2539. 
. Overview of VMSAv8-64 address translation using the 64KB translation granule on page D5-2544. 


Overview of VMSAv8-64 address translation using the 4KB translation granule 


The requirements for the level of the initial lookup are different for stage 1 and stage 2 translations. 


Overview of stage 1 translations, 4KB granule 


For a stage 1 translation, the required initial lookup level is determined only by the required input address range 
specified by the corresponding TCR_ELx.TnSZ field. When using the 4KB translation granule, Table D5-12 shows 
this requirement. 


Table D5-12 TCR_ELx.TnSZ values and IA ranges, 4KB granule with no concatenation of tables 





TnSZ values for and input address ranges? for starting at this level 
Initial lookup level 














TNSZmin lAmax TnSZmax lAmin 
0 16 IA[47:12] 24 IA[39:12] 
1 25 IA[38:12] 33 IA[30:12] 
2 34 IA[29:12] 42b IA[21:12] 
3c 43 IA[20:12] 48c IA[15:12] 





a. The IAs show the address bits to be resolved when addressing a page of memory, see the Note that follows. 
b. If ARMv8.4-TTST is not implemented, or while the PE is executing in AArch32 state, TnSZmax is 39. 
c. Only available if ARMv8.4-TTST is implemented, while the PE is executing in AArch64 state. 


These configuration options are also permitted for stage 2 translations. 
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Note 


Some bits of the IA do not require resolution by the translation table lookup, because they always map directly to 
the OA, When using the 4KB translation granule, IA[11:0] = OA[11:0] for all translations. 





Figure D5-7 shows the stage 1 address translation, for an address translation using the 4KB granule with an input 
address size greater than 39 bits. 
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c Indexed by IA[29:21] 
d Indexed by IA[20:12] 


Figure D5-7 General view of VMSAv8-64 stage 1 address translation, 4KB granule 


Overview of stage 2 translations, 4KB granule 


For a stage 2 translation, up to 16 translation tables can be concatenated at the initial lookup level. For certain input 
address sizes, concatenating tables in this way means that the lookup starts at a lower level than would otherwise be 
the case. For more information see Use of concatenated translation tables for the initial stage 2 lookup on 

page D5-2552. 


When using the 4KB translation granule, Table DS-13 shows all possibilities for the initial lookup for a stage 2 
translation. 


Table D5-13 VTCR_EL2.T0SZ values and IA ranges, 4KB granule with possible concatenation of translation tables 





Tables4 1 2 4 8 16 
Initial TOSZ values and input address ranges? for starting at this level 
lookup 
level 
(SLO TOSZ IA TOSZ IA TOSZ IA TOSZ IA TOSZ IA 
value) 
0 (2) 16- TA[47:12]- - - - - - z = 2 
24 IA[39:12] 
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Table D5-13 VTCR_EL2.T0SZ values and IA ranges, 4KB granule with possible concatenation of translation tables 














Tables4 1 2 4 8 16 

Initial TOSZ values and input address ranges? for starting at this level 

lookup 

level 

(SLO TOSZ IA TOSZ IA TOSZ IA TOSZ IA TOSZ IA 

value) 

1(1) 25- TA[38:12]- 24 IA[39:12] 23 IA[40:12] 22 IA[41:12] 21 IA[42:12] 
33 IA[30:12] 

2 (0) 34- IA[29:12]- 33 IA[30:12] 32 IA[31:12] 31 IA[32:12] 30 IA[33:12] 
42° IA[21:12] 

34 (3) 43-48  IA[20:12]- 42 TA[21:12] 41 IA[22:12] 40 IA[23:12] 39 1A[24:12] 

TA[15:12] 





a. Number of concatenated translation tables at the initial lookup level. / table corresponds to no concatenation, also shown in Table D5-12 
on page D5-2536. 
b. The IAs shown in the table indicate the address bits to be resolved by an address translation addressing a page of memory, see the Note 
that follows. 
c. If ARMv8.4-TTST is not implemented or while the PE is executing in AArch32 state, the maximum value of TOSZ is 39 with 
corresponding IA[29:12]-IA[24:12]. 
d. If ARMv8.4-TTST is implemented, while the PE is executing in AArch64 state, and is using 4KB granules, an initial lookup level 3, 


(VTCR_EL2.SL0 ==3) is possible. 


D5-2538 





Note 


e Because concatenating translation tables reduces the number of levels of lookup required, when using the 
4KB translation granule, tables cannot be concatenated at level 0. 


è Some bits of the IA do not require resolution by the translation table lookup, because they always map 
directly to the OA. When using the 4KB translation granule, IA[11:0] = OA[11:0] for all translations. 





Because the maximum number of concatenated translation tables is 16, there is a relationship between the permitted 
VTCR_EL2.{TOSZ, SLO} values. Table D5-13 on page D5-2537 shows the permitted TOSZ values for each initial 


lookup level. 


If, when a translation table walk is started, the TOSZ value is not consistent with the SLO value, or VTCR_EL2.SLO0 
is programmed to a reserved value, a stage 2 level 0 Translation fault is generated. 


Figure D5-8 on page D5-2539 shows the stage 2 address translation, in a PE without ARMv8.4-TTST, for an input 
address size of between 40 and 43 bits. For an input address size in this range, the lookup can start at either level 0 


or level 1. 
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D_Table is a Table descriptor 
D_Block is a Block descriptor 
D_Page is a Page descriptor 

Indexed by IA[n:39], where IA width is (n+1) bits 


Indexed by IA[38:30] 
Indexed by IA[n:30], where IA width is (n+1) bits 


Indexed by IA[29:21] 
Indexed by IA[20:12] 


Figure D5-8 General view of VMSAv8-64 stage 2 address translation, 4KB granule 


Overview of VMSAv8-64 address translation using the 16KB translation granule 


The requirements for the level of the initial lookup are different for stage 1 and stage 2 translations. 
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Overview of stage 1 translations, 16KB granule 


For a stage 1 translation, the required initial lookup level is determined only by the required input address range 
specified by the corresponding TCR_ELx.TnSZ field. When using the 16KB translation granule, Table D5-14 
shows this requirement. 


Table D5-14 TCR_ELx.TnSZ values and IA ranges, 16KB granule with no concatenation of tables 





TnSZ values for and input address ranges? for starting at this level 
Initial lookup level 














TNSZmin lAmax TnSZmax lAmin 
0 16 IA[47:14] 16 IA[47:14] 
1 17 IA[46:14] 27 IA[36:14] 
2 28 IA[35:14] 38 IA[25:14] 
3 39 IA[24:14] 48b IA[15:14] 





a. The IAs show the address bits to be resolved when addressing a page of memory, see the Note that follows. 
b. If ARMv8.4-TTST is not implemented, the maximum is 39. 


The configuration options for an initial lookup at level 1, level 2, or level 3 are also permitted for stage 2 translations, 
but stage 2 translation does not permit an initial lookup at level 0. 





Note 
: When using the 16KB translation granule, a maximum of 1 bit of IA is resolved by a level 0 lookup. 
G Some bits of the IA do not require resolution by the translation table lookup, because they always map 


directly to the OA, When using the 16KB translation granule, IA[13:0] = OA[13:0] for all translations. 





Figure D5-9 shows the stage 1 address translation, for an address translation using the 16KB granule with an input 
address size of 48 bits. 

































































Level 3 table 
Level 2 table 
16KB 
— D_Page j» memory 
32MB = 
Level 1 table D-Block j» region 4 page 
D_Table y 
A 
ooo ë f Cc 
Yy 
Level 0 table 4 D labie > 
2 be i 
TTBR_ELx Dable Key: 
Table has 


D_Table is a Table descriptor 
D_Block is a Block descriptor 
D_Page is a Page descriptor 

a Indexed by IA[47] 

b Indexed by IA[46:36] 

c Indexed by IA[35:25] 

d Indexed by IA[24:14] 


only 2 entries 


Figure D5-9 General view of VMSAv8-64 stage 1 address translation, 16KB granule 


D5-2540 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch64 Virtual Memory System Architecture 
D5.2 The VMSAv8-64 address translation system 


Overview of stage 2 translations, 16KB granule 


For a stage 2 translation, up to 16 translation tables can be concatenated at the initial lookup level. For certain input 
address sizes, concatenating tables in this way means that the lookup starts at a lower level than would otherwise be 
the case. For more information see Use of concatenated translation tables for the initial stage 2 lookup on 

page D5-2552. 


When using the 16KB granule, for a stage 2 translation with an input address sized of 48 bits, the initial lookup must 
be at level 1, with two concatenated translation tables at this level. 


When using the 16KB translation granule, Table D5-15 shows all possibilities for the initial lookup for a stage 2 
translation. 


Table D5-15 VTCR_EL2.T0SZ values and IA ranges, 16KB granule with possible concatenation of translation tables 











Tables@ 1 2 4 8 16 

Initial TOSZ values and input address ranges? for starting at this level 

lookup 

level 

(SLO TOSZ IA TOSZ IA TOSZ IA TOSZ IA TOSZ IA 

value) 

1 (2) 17- IA[46:14]- 16 IA[47:14] - : = < - = 
27 IA[36:14] 

2 (1) 28- IA[35:14]- 27 IA[36:14] 26 IA[37:14] 25 IA[38:14] 24 IA[39:14] 
38 IA[25:14] 

3 (0) 39-48¢ IA[24:14]- 38 TA[25:14] 37 1A[26:14] 36 IA[27:14] 35 IA[28:14] 

IA[15:14] 





a. Number of concatenated translation tables at the initial lookup level. 7 table corresponds to no concatenation, also shown in Table D5-14 
on page D5-2540. 
b. The IAs shown in the table indicate the address bits to be resolved by an address translation addressing a page of memory, see the Note 


that follows. 


c. If ARMv8.4-TTST is not implemented or while the PE is executing in AArch32 state, the maximum value of TOSZ is 39 with 
corresponding IA[24:12]. 
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Note 
è When using the 16KB translation granule for a stage 2 translation, the initial lookup cannot be at level 0. 
When a 48-bit input address is required, translation must start with a level 1 lookup using two concatenated 
translation tables. 





$ Some bits of the IA do not require resolution by the translation table lookup, because they always map 
directly to the OA. When using the 16KB translation granule, IA[13:0] = OA[13:0] for all translations. 





Because the maximum number of concatenated translation tables is 16, there is a relationship between the permitted 
VTCR_EL2.{TOSZ, SLO} values. Table D5-15 shows the permitted values of TOSZ for each initial lookup level. 


If, when a translation table walk is started, the TOSZ value is not consistent with the SLO value, or VTCR_EL2.SL0 
is programmed to a reserved value, a stage 2 level 0 Translation fault is generated. 


When stage 2 translation supports a 48-bit input address range, translation must start with a level 1 lookup using 
two concatenated translation tables. Figure DS-10 on page D5-2542 shows the translation for this case. 
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D_Table is a Table descriptor 
D_Block is a Block descriptor 
D_Page is a Page descriptor 
b Indexed by IA[47:36] 
c Indexed by IA[35:25] 
d Indexed by IA[24:14] 


Figure D5-10 VMSAv8-64 stage 2 address translation, 16KB granule, 48 bit input address 


However, for an input address size of between 37 and 40 bits, Table D5-15 on page DS-2541 shows that translation 
can start with either a level 1 lookup or a level 2 lookup, and Figure D5-11 on page D5-2543 shows these options. 


D5-2542 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 


ID070919 


Starting at level 1 

















The AArch64 Virtual Memory System Architecture 
D5.2 The VMSAv8-64 address translation system 















































‘| 
VTTBR_EL2 


Starting at level 2 









































VTCR_EL2.SL0 defines the start level. Level 3 table 
Level 2 table 
16KB 
32MB D_ Page H memory 
Level 1 table D_Block > region A page 
c 
D_Table vy 
bi} 
D_Table » 
Level 3 table 
Level 2 table 
L] 32MB 16KB 
D_Block [> region D_Page |» memory 
4 page 
c 
D_Table vy 
Up to 16 concatenated 
tables at the initial level 
b2 
D_Table Key for both diagrams: 
D_Table is a Table descriptor 
D_Block is a Block descriptor 





VTTBR_EL2 











ARM DDI 0487E.a 
ID070919 


D_Page is a Page descriptor 
a Indexed by IA[n:36], where IA width is (n+1) bits 
b1 Indexed by IA[35:25] 
b2 Indexed by IA[n:25], where IA width is (n+1) bits 
c Indexed by IA[24:14] 


Figure D5-11 General view of VMSAv8-64 stage 2 address translation, 16KB granule 
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Overview of VMSAv8-64 address translation using the 64KB translation granule 


The requirements for the level of the initial lookup are different for stage 1 and stage 2 translations. 


Overview of stage 1 translations, 64KB granule 


For a stage 1 translation, the required initial lookup level is determined only by the required input address range 
specified by the corresponding TCR_ELx.TxSZ field. When using the 64KB translation granule, Table D5-16 
shows this requirement. 


Table D5-16 TCR_ELx.TnSZ values and IA ranges, 64KB granule with no concatenation of tables 





TnSZ values for and input address ranges? for starting at this level 


Lookup level 














TNSZmin lAmax TnSZmax lAmin 
1b 12 IA[51:16] 21 IA[42:16] 
1 16 IA[47:16] 21 IA[42:16] 
2 22 IA[41:16] 34 IA[29:16] 
3 35 IA[28:16] 47° IA[16:16] 





These configuration options are also permitted for stage 2 translations. 


follows. 


value of TnSZ is 39 with IA[24:16]. 





. The IAs show the address bits to be resolved when addressing a page of memory, see the Note that 


. Supported only if ARMv8.2-LVA is implemented and the 64KB translation granule is used, see 
Extending addressing above 48 bits on page D5-2524. 


. IfARMv8.4-TTST is not implemented or while the PE is executing in AArch32 state, the maximum 


Note 
° When using the 64KB translation granule, there are no level 0 lookups. 
s Some bits of the IA do not require resolution by the translation table lookup, because they always map 


directly to the OA. When using the 64KB translation granule, IA[15:0] = OA[15:0] for all translations. 


è When ARMv8.2-LPA is implemented, a level 1 block attribute is supported when using the 64KB granule. 


Figure D5-12 on page D5-2545 shows the stage 1 address translation, for an address translation using the 64KB 
granule with an input address size greater than 42 bits. 
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D_Table is a Table descriptor 
D_Block is a Block descriptor 
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Figure D5-12 General view of VMSAv8-64 stage 1 address translation, 64KB granule with 52-bit VA support 


Overview of stage 2 translations, 64KB granule 


For a stage 2 translation, up to 16 translation tables can be concatenated at the initial lookup level. For certain input 
address sizes, concatenating tables in this way means that the lookup starts at a lower level than would otherwise be 
the case. For more information see Use of concatenated translation tables for the initial stage 2 lookup on 


page D5-2552. 


When using the 64KB translation granule, Table D5-17 shows all possibilities for the initial lookup for a stage 2 


translation. 


Table D5-17 VTCR_EL2.T0SZ values and IA ranges, 64KB granule with possible concatenation of translation tables 























Tablesa 1 2 4 8 16 

Initial TOSZ values and input address ranges? for starting at this level 

lookup 

level 

(SLO TOSZ IA TOSZ IA TOSZ IA TOSZ IA TOSZ IA 

value) 

1° (2) 12-21 IA[51:16]- - - - - - - - 
IA[48:16] 

1 (2) 16-21 TA[47:16]- - - - - - - - 
TA[42:16] 

2 (1) 22-34 TA[41:16]- 21 TA[42:16] 20 TA[43:16] 19 TA[44:16] 18 TA[45:16] 
TA[29:16] 

3 (0) 35-474 IA[28:16]- 34 TA[29:16] 33 IA[30:16] 32 IA[31:16] 31 IA[32:16] 
IA[16:16] 

a. Number of concatenated translation tables at the initial lookup level. 7 table corresponds to no concatenation, also shown in 


Table D5-16 on page D5-2544. 


b. The IAs shown in the table indicate the address bits to be resolved by an address translation addressing a page of memory, see the Note 


that follows. 
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c. Only supported if the PA size is 52 bits, see Extending addressing above 48 bits on page D5-2524. 
d. If ARMv8.4-TTST is not implemented or while the PE is executing in AArch32 state, the maximum TOSZ value is 39, with IA[24:16]. 





Note 
° When using the 64KB translation granule, there are no level 0 lookups. 
° Because concatenating translation tables reduces the number of levels of lookup required, when using the 


64KB translation granule, tables cannot be concatenated at level 1. 


: Some bits of the IA do not require resolution by the translation table lookup, because they always map 
directly to the OA. When using the 64KB translation granule, [A[15:0] = OA[15:0] for all translations. 





Because the maximum number of concatenated translation tables is 16, there is a relationship between the permitted 
VTCR_EL2.{TOSZ, SLO} values. Table D5-17 on page D5-2545 shows the permitted values of TOSZ for each 
initial lookup level. 


If, when a translation table walk is started, the TOSZ value is not consistent with the SLO value, or VTCR_EL2.SLO0 
is programmed to a reserved value, a stage 2 level 0 Translation fault is generated. 


Figure D5-13 shows the stage 2 address translation, for an input address size of between 43 and 46 bits. This means 
the lookup can start at either level 1 or level 2. 




















VTCR_EL2.SL0 defines the start level. Level 3 table 
Starting at level 1 Level 2 table 
64KB 
D_P. 
Level 1 table D Block eee — 898 page 
region l 
c 
D_Table 
b1 
D_Table t 














A 
a 
VTTBR_EL2 cr ~ 











Level 3 table 







Level 2 table 


64KB 
page 






512MB 


Starting at level 2 7 
region 


D_Block 








D_Table 


Up to 16 concatenated 
tables at the initial level 


Key for both diagrams 


D_Table is a Table descriptor 




















VTTBR_EL2 D_Block is a Block descriptor 
D_Page is a Page descriptor 
a Indexed by IA[n:42], 
where IA width is (n+1) bits 
b1 Indexed by IA[41:29] 
b2 Indexed by IA[n:29], 
where IA width is (n+1) bits 
c Indexed by IA[28:16] 
Figure D5-13 General view of VMSAv8-64 stage 2 address translation, 64KB granule 
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D5.2.7 The VMSAv8-64 translation table format 


This section provides the full description of the VMSAv8-64 translation table format, its use for address translations 
that are controlled by an Exception level using AArch64. For these translation regimes: 
For a stage 1 translation that can support two VA ranges 

° For the lower VA range, that uses TTBRO_ELx: 


—  TheTCR_ELx. {SH0, ORGNO, IRGNO} fields define memory region attributes for the 
translation table walks. 


— The TCR_ELx.TGO field defines the Translation granule size. 
à For the upper VA range, that uses TTBR1_ELx: 


— TheTCR ELx.{SH1, ORGN1, IRGN1} fields define memory region attributes for the 
translation table walks. 


— The TCR_ELx.TGI1 field defines the Translation granule size. 
. Each of TTBRO_ELx and TTBR1_ELx contains an ASID field, and the TCR_ELx.A1 field 
selects which of these specifies the ASID to use. 
For a stage 1 translation that supports only one VA range 
The translation table walks use TTBRO_ELx, and: 


. The TCR_ELx.{SH0, ORGNO, IRGNO} fields define memory region attributes for the 
translation table walks. 


s The TCR_ELx.TGO field defines the Translation granule size. 


For a stage 2 translation 
The Non-secure translation table walks use VITTBR_EL2, and: 


G The VTCR_EL2.{SH0, ORGNO, IRGNO} fields define memory region attributes for the 
translation table walks. 


s The VTCR_EL2.TG0 field defines the Translation granule size. 
The Secure translation table walks use VSTTBR_EL2, and: 


s The VSTCR_EL2.SH0 and VTCR_EL2.{ORGNO0, IRGNO} fields define memory region 
attributes for the translation table walks. 


s The VSTCR_EL2.TG0 field defines the Translation granule size. 


For the VMSAv8-64 translation table format, Overview of the VMSAv8-64 address translation stages on 
page D5-2536 summarizes the lookup levels, and Descriptor encodings, Armv8 level 0, level 1, and level 2 formats 
on page D5-2567 describes the translation table entries. 


The following subsections describe the use of this translation table format: 


. Translation granule size and associated block and page sizes on page D5-2548. 
G Selection between TTBRO_ELx and TTBR1_ELx when two VA ranges are supported on page D5-2550. 
° Use of concatenated translation tables for the initial stage 2 lookup on page D5-2552. 
5 Possible errors in programming the translation table registers on page D5-2553. 
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Translation granule size and associated block and page sizes 


Table D5-18 shows the supported granule sizes, block sizes and page sizes, for the different granule sizes. For 
completeness, this table includes information for AArch32 state. In the table, the OA bit ranges are the OA bits that 
the translation table descriptor specifies to address the block or page of memory, in an implementation that supports 
a 48-bit OA range. 


Table D5-18 Translation granule sizes, with block and page sizes, and output address ranges 





Granule size Table level Block size and OA bit range Page size and OA bit range 



































4KB Zero - = 

One 1GB, OA[47:30] - 

Two 2MB, OA[47:21] - 

Three - 4KB, OA[47:12] 
16KB Zero = > 

One - š 

Two 32MB, OA[47:25] - 

Three - 16KB, OA[47:14] 
64KB One 4TB, OA[51:42]2 = 

Two 512MB, OA[47:29] - 

Three - 64KB, OA[47:16] 





a. Only available when ARMv8.2-LPA is implemented, see Extending addressing above 48 bits on 
page D5-2524. 


Bit[1] ofa translation table descriptor identifies whether the descriptor is a block descriptor, and: 


: The 4KB granule size supports block descriptors only in level 1 and level 2 translation tables. 
° The 16KB granule size supports block descriptors only in level 2 translation tables. 
7 The 64KB granule size supports block descriptors in level 2 translation tables, and in level 1 translation tables 


when ARMv8.2-LPA is implemented and the implementation supports 52 bits of physical address. If the 
implementation does not support 52 bits of physical address, then encoding a block descriptor in a level 1 
translation table generates a level 1 Translation fault. 


If bit[1] of a descriptor is 0 in a translation table that does not support block descriptors then a translation table walk 
that accesses that descriptor generates a Translation fault. 


For translations managed from AArch64 state, the following tables expand the information for each granule size, 
showing for an access to a single translation table at each lookup level: 


° The maximum IA size, and the address bits that are resolved for that maximum size. 


a The maximum OA range resolved by the translation table descriptors at this level, and the corresponding 
memory region size. 


: The maximum size of the translation table. This is the size required for the maximum IA size. 


Table D5-19 on page D5-2549 shows this information for the 4KB translation granule size, Table D5-20 on 
page D5-2549 shows this information for the 16KB translation granule size, and Table D5-21 on page D5-2549 
shows this information for the 64KB translation granule size. 
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Table D5-19 Properties of the address lookup levels, 4KB granule size 





Maximum input address 


Maximum output address 














Number Block entries 
revel ofentries supported? 
Size Address range Address range Size of addressed region@ PP 
Zero 256TB Address[47:39] Address[47:39] 512GB Up to 512 No 
One 512GB Address[38:30] Address[47:30] 1GB Up to 512 Yes 
Two 1GB Address[29:21] Address[47:21] 2MB Up to 512 Yes 
Three 2MB Address[20:12] Address[47:12] 4KB 512 Page only 





a. That is, the size of the region either addressed by descriptors at this level or to be resolved at this and the subsequent levels of lookup. 


Table D5-20 Properties of the address lookup levels, 16KB granule size 





Maximum input address 


Maximum output address 














Number Block entries 
Level of entries supported? 
Size Address range Address range Size of addressed regiona Pp j 
Zero 256TB Address[47] Address[47] 128TB 26 No 
One 128TB Address[46:36] Address[47:36] 64GB Up to 2048 No 
Two 64GB Address[35:25] Address[47:25] 32MB Up to 2048 Yes 
Three 32MB Address[24:14] Address[47:14] 16KB 2048 Page only 





a. That is, the size of the region either addressed by descriptors at this level or to be resolved at this and the subsequent levels of lookup. 


b. The translation table size is less than the maximum for this granule size, and therefore the number of entries is reduced. 


Table D5-21 Properties of the address lookup levels, 64KB granule size 





Maximum input address 


Maximum output address 














Number Block entries 
Revel ofentries supported? 
Size Address range Address range Size of addressed regiona PP i 
One 4PB Address[51:42] Address[51:42] 4TB Upto 1024 Yes 
One 256TB Address[47:42] Address[47:42] 4TB Up to 64 No 
Two 4TB Address[4 1:29] Address[47:29] 512MB Up to 8192 Yes 
Three 512MB Address[28:16] Address[47:16] 64KB 8192 Page only 





a. That is, the size of the region either addressed by descriptors at this level or to be resolved at this and the subsequent levels of lookup. 


b. The translation table size is less than the maximum for this granule size, and therefore the number of entries is reduced. 
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: If the IA range specified by the TCR_ELx.TxSZ field is smaller than the maximum size shown in these table 
then this reduces the number of addresses in the table and therefore reduces the table size. The smaller 
translation table is aligned to its table size. 
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s For stage 2 translations, multiple translation tables can be concatenated to extend the maximum IA size 
beyond that shown in these tables. For more information see the stage 2 translation overviews in Overview 
of the VMSAv8-64 address translation stages on page D5-2536 and Use of concatenated translation tables 
for the initial stage 2 lookup on page D5-2552. 


If a supplied input address is larger than the configured input address size, a Translation fault is generated. 


Note 


Larger translation granule sizes typically requires fewer levels of translation tables to translate a particular size of 
VA. 








For the TCR_ELx programming requirements for the initial lookup, see Overview of the VMSAv8-64 address 
translation stages on page D5-2536. 


Selection between TTBRO_ELx and TTBR1_ELx when two VA ranges are supported 


Every translation table walk starts by accessing the translation table addressed by the TTBR_ELx for the stage 1 
translation for the required translation regime. 


For a stage 1 translation that can support two VA ranges, Figure D5-14 shows this VA range split when using 48-bit 
VAs, and: 


° TTBRO_ELx points to the initial translation table for the lower VA range, that starts at address 
0x0000 000000000000, 
. TTBR1_ELx points to the initial translation table for the upper VA range, that runs up to address 
OxFFFFFFFFFFFFFFFF. 
VA 


OxFFFF_FFFF_FFFF_FFFF 





TTBR1_ELx | Effect of increasing TCR_ELx.T1SZ 
region 


OxFFFF_0000_0000_0000 < Boundary, when TCR_ELx.T1SZ==16 


Access generates 
ss atTranslation s 
fault, see text 


0x0000_FFFF_FFFF_FFFF < Boundary, when TCR_ELx.TOSZ==16 








TTBRO_ELx | 
region oP Effect of increasing TCR_ELx.T0SZ 











0x0000_0000_0000_0000 


Figure D5-14 AArch64 TTBRn boundaries and VA ranges for 48-bit VAs 


As Figure D5-14 shows, for 48-bit VAs: 
° The address range translated using TTBRO_ELx is 0x0000000000000000 to 0x0000FFFFFFFFFFFF. 
à The address range translated using TTBR1_ELx is 0xFFFF00000000000A to OxFFFFFFFFFFFFFFFF. 


In an implementation that includes ARMv8.2-LVA and is using the 64KB translation granule, for 52-bit VAs: 
° The address range translated using TTBRO_ELx is 0x0000000000000000 to Ox00OF FFFFFFFFFFFF. 
g The address range translated using TTBR1_ELx is @xFFFQ000000000000 to OxFFFFFFFFFFFFFFFF. 


Which TTBR_ELzx is used depends only on the VA presented for translation. The most significant bits of the VA 
must all be the same value and: 


a If the most significant bits of the VA are zero, then TTBRO_ELx is used. 
$ If the most significant bits of the VA are one, then TTBR1_ELx is used. 
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However, it is configurable whether VA[63:56] are considered when determining which TTBR_ELx is used, that is: 


è In an implementation that includes ARMv8.2-LVA and is using the 64KB translation granule, whether the 
determination depends on VA[63:52] or on VA[55:52]. 


, Otherwise, whether the determination depends on VA[63:48] or on VA[55:48]. 


For more information about whether VA[63:56] are considered for this determination see Address tagging in 
AArch64 state on page D5-2506. 


Note 


The handling of the Contiguous bit can mean that the boundary between the translation regions defined by the 
TCR_ELx.TnSZ values and the region for which an access generates a Translation fault is wider than shown in 
Figure D5-14 on page D5-2550. That is, if the descriptor for an access to the region shown as generating a fault has 
the Contiguous bit set to 1, the access might not generate a fault. Possible errors in programming the translation 
table registers on page D5-2553 describes this possibility. 








Example D5-3 shows a typical application of this VA split. 


Example D5-3 Example use of the split VA range, and the TTBRO_ELx and TTBR1_ELx controls 


An example of using the split VA range is: 


TTBRO_ELx Used for process-specific addresses. 


Each process maintains a separate level 1 translation table. On a context switch: 

: TTBRO_ELx is updated to point to the level 1 translation table for the new context 
$ TCR_ELx is updated if this change changes the size of the translation table 

. CONTEXTIDR_ ELx is updated. 


TTBR1_ELx Used for operating system and I/O addresses, that do not change on a context switch. 


For each VA subrange, the input address size is 2(64-T"SZ), where TnSZ is one of TCR_ELx.{TOSZ, T1SZ}, 
This means the two VA subranges are: 

Lower VA subrange 0x0000_0000_0000_0000 to (2(64-T0SZ) - 1), 

Upper VA subrange (264 - 2(64-T1SZ)) to @xFFFF_FFFF_FFFF_FFFF. 


If ARMv8.5-EOPD is implemented and enabled, the TCR_ELx.EOPD1 field can prevent unprivileged access to the 
addresses translated by TTBR1_ELx. 


For the situation where the minimum TnSZ value is 16, corresponding to a maximum input address range of 48 bits, 
Example D5-4 shows the two VA subranges when TOSZ and T1SZ are both set to this minimum value. 


Example D5-4 Maximum VA ranges when a stage of translation supports two ranges 


The maximum VA subranges correspond to TOSZ and T1SZ each having a minimum value of 16. In this case the 
subranges are: 


Lower VA subrange 0x0000_0000_0000_0000 to @x0000_FFFF_FFFF_FFFF. 


Upper VA subrange QxFFFF_0000_0000_0000 to OxFFFF_FFFF_FFFF_FFFF. 


Figure D5-14 on page D5-2550 indicates the effect of varying the TnSZ values. 
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As described in Overview of the VMSAv8-64 address translation stages on page D5-2536, the TnSZ values also 
determine the initial lookup level for the translation. 


Use of concatenated translation tables for the initial stage 2 lookup 


Overview of the VMSAv8-64 address translation stages on page D5-2536 introduced the ability to concatenate 
translation tables for the initial stage 2 translation lookup. This section gives more information about that 
concatenation. 


Ifa stage 2 translation would require 16 entries or fewer in its top-level translation table, that stage of translation 
can, instead, be configured so that: 


è It requires the corresponding number of concatenated translation tables at the next translation level, aligned 
to the size of the block of concatenated translation tables. 


a The stage 2 translation starts at that next translation level. 


When using the 16KB translation granule, if a 48-bit input address size is required for the stage 2 translations, 
lookup must start with two concatenated translation tables at level 1. 


The use of concatenated translation tables requires the software that is defining the translation to: 


s Define the concatenated translation tables with the required overall alignment. 
° Program VTTBR_EL2 or VSTTBR_EL2 to hold the address of the first of the concatenated translation 
tables. 


è Program VTCR_EL2 or VSTCR_EL2 to indicate the required input address range and initial lookup level. 





Note 


The use of concatenated translation tables avoids the overhead of an additional level of translation. 





Concatenating additional translation tables at the initial level of look up resolves additional address bits at that level. 
To resolve n additional address bits requires 2” concatenated translation tables. Example D5-5 shows how, for 


level 1 lookups using the 4KB translation granule, translation tables can be concatenated to resolve three additional 
address bits. 


Example D5-5 Adding three bits of address resolution at level 1 lookup, using the 4KB granule 


When using the 4KB translation granule, a level 1 lookup with a single translation table resolves address bits[38:30]. 
To add three more address bits requires 23 translation tables, that is, eight translation tables. This means: 
è The total size of the concatenated translation tables is 8x4KB=32KB. 
š This block of concatenated translation tables must be aligned to 32KB. 
° The address range resolved at this lookup level is A[41:30], of which: 
— Bits A[41:39] select the 4KB translation table. 
— Bits A[38:30] index a descriptor within that translation table. 
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As an example of the concatenation of translation tables at the initial lookup level, when using the 4KB translation 
granule, Table D5-22 shows the possible uses of concatenated translation tables to permit lookup to start at level 1 
rather than at level 0. For completeness, the table starts with the case where the required IPA range means lookup 
starts at level 1 with a single translation table at that level. 


Table D5-22 Possible uses of concatenated translation tables for level 1 lookup, 4KB granule 





Configured stage 2 IA size Lookup starts at level0 Lookup starts at level 1 

















IPA range Size Required level 0 entries Number of concatenated tables Required alignment? 
IPA[38:0] 236 bytes - 1 4KB 

IPA[39:0] 237 bytes 2 2 8KB 

IPA[40:0] 238 bytes 4 4 16KB 

IPA[41:0] 239 bytes 8 8 32KB 

IPA[42:0] 240 bytes 16 16 64KB 








a. Required alignment of the set of concatenated level 2 tables. 
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Note 


Because concatenation is permitted only for a stage 2 translation, the input addresses in the table are IPAs. 





Overview of the VMSAv8-64 address translation stages on page D5-2536 identifies all of the possible uses of 
concatenation. In all cases, the block of concatenated translation tables must be aligned to the block size. 


Possible errors in programming the translation table registers 


This subsection describes possible errors in programming the translation table registers. 


Misprogramming the VTCR_EL2.{TOSZ, SLO} and VSTCR_EL2.{TOSZ, SLO} fields 


For a stage 2 translation, the programming of the VTCR_EL2 or VSTCR_EL2 TOSZ and SLO fields must be 
consistent. If these fields are not consistent, or if SLO is programmed to a reserved value, any translation table walk 
that uses stage 2 translation generates a stage 2 level 0 Translation fault. For more information see Overview of the 
VMSAVv8-64 address translation stages on page D5-2536. 


Misprogramming of the Contiguous bit 


For more information about the Contiguous bit, and the range of translation table entries that must have the bit set 
to 1 to mark the entries as contiguous, see The Contiguous bit on page D5-2604. 


If one or more of the following errors is made in programming the translation tables, the TLB might contain 
overlapping entries: 


à One or more of the contiguous translation table entries does not have the Contiguous bit set to 1. 


è One or more of the contiguous translation table entries holds an output address that is not consistent with all 
of the entries pointing to the same aligned contiguous address range. 


è The attributes and permissions of the contiguous entries are not all the same. 


Such misprogramming of the translation tables means the output address, memory permissions, or attributes for a 
lookup might be corrupted, and might be equal to values that are not consistent with any of the programmed 
translation table values. 


In some implementations, such misprogramming might also give rise to a TLB Conflict abort. 
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The architecture guarantees that misprogramming of the Contiguous bit cannot provide a mechanism for any of the 
following to occur: 


s Software executing at EL1 or ELO accessing regions of physical memory that are not accessible by 
programming the translation tables, from EL1, with arbitrary chosen values that do not misprogram the 
Contiguous bit. 


$ Software executing at EL1 or ELO accessing regions of physical memory with attributes or permissions that 
are not possible by programming the translation tables, from EL1, with arbitrary chosen values that do not 
misprogram the Contiguous bit. 


è Software executing in Non-secure state accessing Secure physical memory. 


Note 


Hardware implementations must ensure that use of the Contiguous bit cannot provide a mechanism for avoiding 
output address range checking. This might occur if a Contiguous bit block size of 0.5 GB or 1 GB is used in a system 
with the output address size configured to 4GB. The architecture permits the implemented mechanism for 
preventing any avoidance of output address range checking to suppress the use of the Contiguous bit for such entries 
in such a system. 








Where the Contiguous bit is used to mark a set of blocks as contiguous, if the address range translated by a set of 

blocks marked as contiguous is larger than the size of the input address supported at a stage of translation used to 

translate that address at that stage of translation, as defined by the TCR_ELx.TxSZ field, then this is a programming 
error. An implementation is permitted, but not required, to: 


è Treat such a block within a contiguous set of blocks as causing a Translation fault, even though the block is 
valid, and the address accessed within that block is within the size of the input address supported at a stage 
of translation, as defined by the TCR_ELx.TxSZ field. 


è Treat such a block within a contiguous set of blocks as not causing a Translation fault, even though the 
address accessed within that block is outside the size of the input address supported at a stage of translation, 
as defined by the TCR_ELx.TxSZ field, provided that both of the following apply: 


— The block is valid. 
— Atleast one address within the block, or contiguous set of blocks, is within the size of the input address 


supported at a stage of translation. 


When ARMv8.2-LVA is implemented, level 1 block descriptors for the 64KB granule do not support the Contiguous 
bit, and that field is RESO. 


The algorithm for finding the translation table descriptors 


This subsection gives the algorithms for finding the translation table descriptor that corresponds to a given IA, for 
each required level of lookup. The algorithms encode the descriptions of address translation given earlier in this 
section. The algorithm details depend on the translation granule size for the stage of address translation, see: 


. Finding the translation table descriptor when using the 4KB translation granule on page D5-2555. 
: Finding the translation table descriptor when using the 16KB translation granule on page D5-2556. 
. Finding the translation table descriptor when using the 64KB translation granule on page D5-2557. 


Each subsection uses the following terms: 


BaseAddr The base address for the level of lookup, as defined by: 
è For the initial lookup level, the value of the appropriate TTBR_ELx.BADDR field. 


. Otherwise, the translation table address returned by the previous level of lookup. 
PAMax The supported PA width, in bits. 
IA The supplied IA for this stage of translation. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


The AArch64 Virtual Memory System Architecture 
D5.2 The VMSAv8-64 address translation system 


TnSZ The translation table size for this stage of translation: 
For EL1&0 stage 1 
TCR_EL1.TOSZ or TCR_EL1.T1SZ, as appropriate. 
For Non-secure EL1&0 stage 2 
VTCR_EL2.TOSZ. 
For Secure EL1&0 stage 2 
VSTCR_EL2.T0SZ 
For EL2 stage 1 TCR_EL2.TOSZ. 
For EL2&0 stage 1 TCR EL2.TOSZ or TCR_EL2.T1SZ, as appropriate. 
For EL3 stage 1 TCR_EL3.TOSZ. 
SLO The initial lookup level for this stage of translation: 


For Non-secure EL1&0 stage 2 translation 


VTCR_EL2.SLO0 


For Secure EL1&0 stage 2 translation 


VSTCR_EL2.SLO0 


These subsections show only architecturally-valid programming of the TCR_ELx. See also Possible errors in 
programming the translation table registers on page DS-2553. 


Finding the translation table descriptor when using the 4KB translation granule 


Table D5-23 shows the translation table descriptor address, for each level of lookup, when using the 4KB translation 
granule. See the start of The algorithm for finding the translation table descriptors on page D5-2554 for more 
information about terms used in the table. 


Table D5-23 Translation table entry addresses when using the 4KB translation granule 





Entry address and conditions 














ae General conditions 
Stage 1 translation Stage 2 translation 
Zero BaseAddr[PAMax- 1 :x]:IA[:39]:0b000 BaseAddr[PA Max- 1:x]:[A[y:39]:0b000 y=(x+ 35) 
if4 z < TnSZ < 24 then x = (28 - TnSZ) if SLO> == 2 then z= 16 
ife z < TOSZ < 24 then x = (28 - TOSZ) 
One BaseAddr[PA Max-1:x]:IA[y:30]:0b000 BaseAddr[PA Max- 1:x]:[A[y:30]:0b000 y=(x+ 26) 
if4 25 < TnSZ < 33 then x = (37 - TnSZ) if SLO> == 1 then 
if? 21 < TOSZ < 33 then x = (37 - TOSZ) 
else® x =12 elsif SLO’. ¢ == 2 then x = 12 
Two BaseAddr[PAMax- 1 :x]:TA[}:21]:0b000 BaseAddr[PA Max- 1:x]:[A[y:21]:0b000 y=(x+17) 
if? 34 < TnSZ < 39 then x = (46 - TnSZ) if SLO? == 0 then 
ife 30 < TOSZ < 39 then x = (46 - TOSZ) 
else® x =12 elsif SLO». ¢ ==] or 2 then x = 12 
Three BaseAddr[PAMax-1:x]:IA[y:12]:0b000 BaseAddr[PA Max- 1:x]:TA[y:12]:0b000 if y = (x+ 8) 


ife 43 < TnSZ < 48 then x=(55-TnSZ) 


else® x=12 


a. This line indicates the range of permitted values for TnSZ, for a lookup that starts at this level, see Overview of VMSAv8-64 address 


SLO? == 3 then 
if? 39 < TOSZ < 48 then x = (55 - TOSZ) 
elsif SLO». ¢ =0, 1, or 2 then x=12 


translation using the 4KB translation granule on page D5-2536. 
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b. SLO == 0 if the initial lookup is level 2, SLO == 1 if the initial lookup is level 1, SLO == 2 if the initial lookup level is level 0, and SLO == 
3 if the initial lookup level is level 3. 


c. This is the case where this level of lookup is not the initial level of lookup. 


Table D5-7 on page D5-2527 shows how software can determine whether an implementation supports the 4KB 


granule size. 


Finding the translation table descriptor when using the 16KB translation granule 


Table D5-24 shows the translation table descriptor address, for each level of lookup, when using the 16KB 
translation granule. See the start of The algorithm for finding the translation table descriptors on page D5-2554 for 
more information about terms used in the table. 


Table D5-24 Translation table entry addresses when using the 16KB translation granule 





Entry address and conditions 














oe General conditions 
Stage 1 translation Stage 2 translation 
Zero BaseAddr[PAMax-1:4]:IA[47]:0b000 - Only applies to stage 1 
216 == TnSZ 
One BaseAddr[PAMax-1:x]:IA[y:36]:0b000 BaseAddr[PA Max- 1:x]:[A[y:36]:0b000 y=(x+ 32) 
if@ 17 < TnSZ < 27 then x = (31 - TnSZ) if SLO> == 2 then 
ifa 16 < TOSZ < 27 then x = (31 - TOSZ) 
else? x =14 
Two BaseAddr[PAMax- 1 :x]:TA[}:25]:0b000 BaseAddr[PA Max- 1:x]:[A[y:25]:0b000 y=(x+21) 
ifa 28 < TnSZ < 38 then x = (42 - TnSZ) if SL0? == 1 then 
ifa 24 < TOSZ < 38 then x = (42 - TOSZ) 
else® x =14 elsif SLO ¢ == 2 then x = 14 
Three BaseAddr[PA Max-1:x]:IA[y:14]:0b000 BaseAddr[PA Max-1:x]:IA[y:14]:0b000 y=(x+ 10) 


ife 39 < TnSZ < 48 then x = (53 - TnSZ) 


else® x=14 


if SLO? == 0 then 
if? 35 < TOSZ < 48 then x = (53 - TOSZ) 
elsif SLO> © ==1 or 2 then x = 14 





a. This line indicates the range of permitted values for TnSZ, for a lookup that starts at this level, see Overview of VMSAv8-64 address 
translation using the 16KB translation granule on page D5-2539. 


b. SLO == 0 if the initial lookup is level 3, SLO == 1 if the initial lookup is level 2, and SLO ==2 if the initial lookup level is level 1. 
c. This is the case where this level of lookup is not the initial level of lookup. 


D5-2556 


Table D5-7 on page D5-2527 shows how software can determine whether an implementation supports the 16KB 


granule size. 
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Finding the translation table descriptor when using the 64KB translation granule 


Table D5-25 shows the translation table descriptor address, for each level of lookup, when using the 64KB 
translation granule. See the start of The algorithm for finding the translation table descriptors on page D5-2554 for 
more information about terms used in the table. 


Table D5-25 Translation table entry addresses when using the 64KB translation granule 





Entry address and conditions 











oe General conditions 
Stage 1 translation Stage 2 translation 
One BaseAddr[PAMax-1:x]:IA[y:42]:0b000 BaseAddr[PA Max- 1:x]:[A[y:42]:0b000 y=(x+ 38) 
ifè zb < TnSZ < 21 then x = (25 - TnSZ) if SLO° == 2 then z= 16 or 12> 
ifè zb < TOSZ < 21 then x = (25 - TOSZ) 
Two BaseAddr[PAMax- 1 :x]:IA[1:29]:0b000 BaseAddr[PA Max- 1:x]:[A[y:29]:0b000 y=(x+ 25) 
ifa 22 < TnSZ < 34 then x = (38 - TnSZ) if SLO¢ == 1 then 
if? 18 < TOSZ < 34 then x = (38 - TOSZ) 
else4 x =16 elsif SL0°» d == 2 then x = 16 
Three BaseAddr[PAMax- 1 :x]:IA[}: 16]:0b000 BaseAddr[PA Max- 1:x]:[A[y:16]:0b000 y=(x+ 12) 


if@ 35 < TnSZ < 47 then x = (51 - TnSZ) 


else’ x =16 


if SLO¢ == 0 then 
if? 31 < TOSZ < 47 then x = (51 - TOSZ) 
elsif SLOS- d ==1 or 2 then x = 16 





a. This line indicates the range of permitted values for TnSZ, for a lookup that starts at this level, see Overview of VMSAv8-64 address 
translation using the 64KB translation granule on page D5-2544. 


b. If ARMv8.2-LVA is implemented, the value of z is 12, see Extending addressing above 48 bits on page D5-2524. Otherwise, the value of z 


is 16. 


c. SLO == 0 if the initial lookup is level 3, SLO == 1 if the initial lookup is level 2, and SLO ==2 if the initial lookup level is at level 1. 


d. This is the case where this level of lookup is not the initial level of lookup. 
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Table D5-7 on page D5-2527 shows how software can determine whether an implementation supports the 64KB 


granule size. 
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The effects of disabling a stage of address translation 


The following sections describe the effect on MMU behavior of disabling each stage of translation: 


s Behavior when stage 1 address translation is disabled. 
. Behavior when stage 2 address translation is disabled on page D5-2559. 
. Behavior of instruction fetches when all associated stages of translation are disabled on page D5-2559. 


Behavior when stage 1 address translation is disabled 


When a stage 1 address translation is disabled, memory accesses that would otherwise be translated by that stage of 
translation are treated as follows: 
EL1 and ELO accesses if the HCR_EL2.DC bit is set to 1 


For the EL1&0, when EL2 is enabled, translation regime, when the value of HCR_EL2.DC is 1, the 
stage | translation assigns the Normal Non-shareable, Inner Write-Back Read-Allocate 
Write-Allocate, Outer Write-Back Read-Allocate Write-Allocate memory attributes. 

Note 


This applies for both instruction and data accesses. 








All other accesses 


For all other accesses, when stage 1 address translation is disabled, the assigned attributes depend 
on whether the access is a data access or an instruction access, as follows: 
Data access 

The stage 1 translation assigns the Device-nGnRnE memory type. 


Instruction access 
The stage 1 translation assigns the Normal memory attribute, with the cacheability and 
shareability attributes determined by the value of the SCTLR_ELx.] bit for the 
translation regime, as follows: 
When the value of I is 0 
The stage | translation assigns the Non-cacheable and Outer Shareable 
attributes. 
When the value of I is 1 


The stage 1 translation assigns the Cacheable, Inner Write-Through 
Read-Allocate No Write-Allocate, Outer Write-Through Read-Allocate No 
Write-Allocate Outer Shareable attribute. 


Secure accesses and Non-secure accesses 


For accesses from the Non-secure state, the output address is to the Non-secure output address 
space. 


For accesses from the Secure state, the output address is to the Secure output address space. 


For this stage of translation, no memory access permission checks are performed. Therefore no MMU faults can be 
generated for this stage of address translation. 





Note 
Alignment checking is performed, and therefore Alignment faults can occur. 





For every access, the input address of the stage 1 translation is flat-mapped to the output address. 


For a EL1 or ELO access, if EL1&0 stage 2 address translation is enabled, the stage 1 memory attribute assignments 
and output address can be modified by the stage 2 translation. 
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When the value of HCR_EL2.DC is 1: 


è The SCTLR_EL1.M bit behaves as if it is 0, for all purposes other than reading the value of the bit. This 
means EL1&0 stage | address translation is disabled. 


s The HCR_EL2.VM bit behaves as if it is 1, for all purposes other than reading the value ofthe bit. This means 
that EL1&0 stage 2 address translation is enabled. 


See also Behavior of instruction fetches when all associated stages of translation are disabled. 
Effect of disabling address translation on maintenance and address translation instruction 
instructions 


Cache maintenance instructions act on the target cache regardless of whether any stages of address translation are 
disabled, and regardless of the values of the memory attributes. However, ifa stage of address translation is disabled, 
they use the flat address mapping for that translation stage. 


TLB invalidate operations act on the target TLB regardless of whether any stage of address translation is disabled. 


The value of HCR_EL2.DC affect some address translation instructions, see Address translation instructions, AT* 
on page D5-2561. 


Behavior when stage 2 address translation is disabled 


When stage 2 address translation is disabled: 
$ The IPA output from the stage 1 translation maps flat to the PA. 
s The memory attributes and permissions from the stage 1 translation apply to the PA. 


When both stages of address translation are disabled, see also Behavior of instruction fetches when all associated 
stages of translation are disabled. 
Secure accesses and Non-secure accesses 


For accesses from the Non-secure IPA address space, the output address is to the Non-secure 
physical address space. 


For accesses from the Secure IPA address space, the output address is to the Secure physical address 
space. 
Behavior of instruction fetches when all associated stages of translation are disabled 
When EL3 is using AArch64, this section applies to: 


à The Secure EL1&0, when EL2 is disabled, translation regime when stage 1 address translation is disabled in 
that regime. 





$ The EL3 translation regime when stage 1 address translation is disabled in that regime. 
s The Secure EL2, or Secure EL2&0, translation regime when stage 1 address translation is disabled in that 
regime 
° The Non-secure EL1&0, when EL2 is enabled, translation regime, when both stages of address translation 
are disabled. 
Note 
° The behaviors in Non-secure state apply regardless of the Execution state that EL3 is using. 


e When the value of HCR_EL2.DC is 1, then the behavior of the EL1&0 translation regime is as if stage 1 
translation is disabled and stage 2 translation is enabled, as described in Behavior when stage 1 address 
translation is disabled on page D5-2558. 
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In these cases, when execution is in AArch64 state, amemory location might be accessed as a result of an instruction 
fetch if either: 


7 The memory location is in the same block of memory as, or in the next contiguous block of memory to, an 
instruction that a simple sequential execution of the program either requires to be fetched now or has required 
to be fetched since the last reset. 


$ The memory location is the target of a direct branch that a simple sequential execution of the program would 
have taken since the most recent of: 
— The last reset. 


— The last synchronization of instruction cache maintenance targeting the address of the branch 
instruction. 


In this description, the blocks of memory referred to are of the size of the minimum implemented translation granule 
and are aligned to that size. 


These accesses can be caused by speculative instruction fetches, regardless of whether the prefetched instruction is 
committed for execution. 


Note 


To ensure architectural compliance, software must ensure that both of the following apply: 





è Instructions that will be executed when all associated stages of address translation are disabled are located in 
blocks of the address space, of the translation granule size, that contain only memory that is tolerant to 
speculative accesses. 


` Each block of the address space, of the translation granule size, that immediately follows a similar block that 
holds instructions that will be executed when all associated stages address translation are disabled, contains 
only memory that is tolerant to speculative accesses. 





D5.2.10 Pseudocode description of VMSAv8-64 address translation 


The following subsections outline a pseudocode description of the translation table walk: 
. Definitions required for address translation. 

. Performing the full address translation. 

° Stage I translation on page D5-2561. 

$ Stage 2 translation on page D5-2561. 

. Translation table walk on page D5-2561. 

7 Support functions on page D5-2561. 


Definitions required for address translation 
In pseudocode, the result of a translation table lookup, in either Execution state, is returned in a TLBRecord structure. 


Memory data type definitions on page D4-2499 includes definitions of the Permissions and AddressDescriptor 
parameters. 


Performing the full address translation 


The function AArch64.FullTranslate() performs a full translation table walk. For any translation regime it performs 
a stage 1 translation for the supplied VA, and for the EL1&0, when EL2 is enabled, translation regime it then 
performs a stage 2 translation of the returned address. 
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Stage 1 translation 


The function AArch64.FirstStageTranslate() performs a stage 1 translation, calling the function 
AArch64.TranslationTableWalk(), described in Translation table walk, to perform the required translation table 
walk. However, if stage 1 translation is disabled, it calls the function AArch64.TranslateAddressS10ff() to set the 
memory attributes. 


Stage 2 translation 


In the EL1&0, when EL2 is enabled, translation regime, a descriptor address returned by stage 1 lookup is in the 
IPA address space, and must be mapped to a PA by a stage 2 translation. Function AArch64.SecondStageWalk() 
performs this translation, by calling the AArch64.SecondStageTranslate() function. When called from 

AArch64. SecondStageWalk(), the AArch64.SecondStageTranslate() function performs a second stage translation, from 
IPA to PA, of the supplied address, including checking that the access has read permission at the second stage. If the 
access does not have second stage read permission it generates a second stage Permission fault on the first stage 
translation table walk. The second stage translation might hit in a TLB, or might involve a translation table walk, 
which will use the algorithm described in this section. 


Translation table walk 


The function AArch64.FirstStageTranslate() returns the result, in the form ofa TLBRecord, of a translation table walk 
made for a memory access from an Exception level that is using AArch64. 


Support functions 


In the translation table walk functions, the Wal kAttrDecode() function determines the attributes for a translation table 
lookup. 


The function AArch64.S1AttrDecode() decodes the attributes from a stage 1 translation table lookup. 


The function AArch64.CheckPermission() checks the access permissions returned by a stage | translation table 
lookup, see Access permission checking on page D4-2501. 


The function AArch64.CheckS2Permission() checks the access permissions returned by a stage 2 translation table 
lookup. 


The function AddrTop() returns the bit number of the most significant valid bit of a VA in the current translation 
regime. If EL1 is using AArch64 and ELO is using AArch32 then an address from ELO is zero-extended to 64 bits. 


D5.2.11 Address translation instructions 
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Each of the Armv8 instruction sets provides instructions that return the result of translating an input address, 
su.pplied as an argument to the instruction, using a specified translation stage or regime. 


The available instructions only perform translations that are accessible from the Security state and Exception level 
at which the instruction is executed. That is: 


° No instruction executed in Non-secure state can return the result of a Secure address translation stage. 


e No instruction can return the result of an address translation stage that is controlled by an Exception level 
that is higher than the Exception level at which the instruction is executed. 


Address translation instructions, AT* summarizes the A64 address translation instructions. 
See also 464 System instructions for address translation on page C5-520. 


If ARMv8.5-MemTag is implemented and enabled the behavior of AT* instructions in AArch64 state are modified. 
For more information see Virtual address translation on page D6-2663. 


Address translation instructions, AT* 


The A64 assembly language syntax for address translation instructions is: 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D5-2561 
Non-Confidential 


The AArch64 Virtual Memory System Architecture 
D5.2 The VMSAv8-64 address translation system 


D5-2562 


AT <operation>, <Xt> 


Where: 


<operation> Is one of S1E1R, S1E1RP, S1E1W, S1E1WP, SLEOR, SLEQ@W, S12E1R, S12E1W, S12EQR, S12EQW, S1E2R, S1E2W, 
S1E3R, or S1E3W. 


<operation> has a structure of <stages><level><read|write><pan>, where: 


<stages> Is one of: 


S1 Stage 1 translation. 

S12 Stage 1 translation followed by stage 2 translation. 
<level> Describes the Exception Level that the translation applies to. Is one of: 

EQ ELO. 

E1 ELI. 

E2 EL2. 

E3 EL3. 


If <level> is higher than the current Exception Level, the instruction is UNDEFINED. 
<read|write> 
Is one of: 
R Read. 
W Write. 
<pan> 
Only available when ARMv8.2-ATS1E1 is implemented. Optional, but if present: 
P Determines action based on value of PSTATE.PAN. 
Only permitted for <stages>=S1 and <level>=E1. 
<Xt> The address to be translated. No alignment restrictions apply for the address. 


If EL2 is not implemented, the AT S1E2R and AT S1E2W instructions are UNDEFINED. 


Note 


If EL2 is not implemented but EL3 is implemented, the AT S12E»» instructions are not UNDEFINED, but behave the 
same way as the equivalent AT S1E»» instructions. This is consistent with the behavior if EL2 is implemented but 
stage 2 translation is disabled. 





In each case, the address being translated is held in the 64-bit address argument register, Xt. If the address translation 
instruction uses a translation regime that is using AArch32, meaning it requires a VA of only 32 bits, then VA[63:32] 
is RESO. 


If the address translation is successful, the resulting PA is returned in PAR_EL1.PA, and PAR ELIF is set to 0 to 
indicate that the translation was successful. Otherwise, see Synchronous faults generated by address translation 
instructions on page D5-2563. 





Note 
The architecture provides a single PAR, PAR_EL1, that is used regardless of: 
° The Exception level at which the instruction was executed. 
< The Exception level that controls the stage or stages of translation used by the instruction. 





For all of these instructions, the current context information determines which entries in TLB caching structures are 
used, and how the translation table walk is performed. However, it is IMPLEMENTATION DEFINED whether the 
Address translation instructions return the values held in a TLB or the result of a translation table walk. Therefore, 
Arm recommends that these instructions are not used at a time when the TLB entries might be different from the 
underlying translation tables held in memory. 


If EL3 is implemented, then for instructions that apply to the EL1 or ELO Exception level, SCR_EL3.NS determines 
the translation regime to which the instruction applies, as follows: 


SCR_EL3.NS == Secure EL1&0 translation regime. 
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SCR_EL3.NS == Non-secure EL1&0 translation regime. 
All relevant context information used for the translation depends on this determination. 


When EL1&0 stage 1 address translation is disabled, any AT S1E0*, AT SIE1*, AT S12E0*, or AT S12E1* address 
translation instruction that accesses the Non-secure state translation reflects the effect of the HCR_EL2.DC bit as 
described in Behavior when stage 1 address translation is disabled on page D5-2558. 


If Secure EL2 translation regime is disabled, executing AT S1E2R or AT S1E2W at EL3 with SCR_EL3.NS == 0 is 
UNDEFINED. 


Note 


AT S12E** instructions at EL3 with SCR_EL3.NS == 0 are not UNDEFINED but behave the same way as the equivalent 
AT S1E+* instructions. 











Synchronous faults generated by address translation instructions 


The address translation instructions use the translation mechanism, and that mechanism can generate the following 
synchronous faults: 


° Translation fault. 


$ Access flag fault. 


: Permission fault. 

7 Domain fault, when translating using the AArch32 translation systems. 
s Address size fault. 

G TLB conflict fault. 

è Synchronous External aborts during a translation table walk. 


In addition: 


a If the address translation instruction requires two stages of translation then these faults could arise from either 
stage 1 or stage 2. 


s For a stage 1 translation for the EL1&0 translation regime, the fault might be generated on the stage 2 
translation of an address accessed as part of the stage 1 translation table walk, see Stage 2 fault on a stage 1 
translation table walk on page D5-2628. 


Except as described in this section, these faults are not taken as an exception for the address translation instructions, 
but instead the PAR _EL1.FST field holds the Fault status information. In these cases the PAR _EL1.PA field does 
not hold the output address of the translation. 


The exceptions to this reporting the fault in PAR EL! are: 


: Synchronous External aborts during a translation table walk are taken as a Data Abort exception. 


For an address translation instruction executed at a particular Exception level, if the synchronous External 
abort is generated on a stage | translation table walk, the Data Abort exception is taken to the Exception level 
to which a synchronous External abort on a stage 1 translation table walk for a memory access from that 
Exception level would be taken. 


If the synchronous External abort is generated on a stage 2 translation table walk then: 


— Ifthe address translation instruction was executed at EL3, the synchronous Data Abort exception is 
taken to EL3. 


— Ifthe address translation instruction was executed at EL2 or EL1, the Data Abort exception is taken 
to the Exception level to which a synchronous External abort on a stage 2 translation table walk for a 
memory access from that Exception level would be taken. 


In any case where the address translation instruction causes a synchronous Data Abort exception to be taken: 
— The PAR ELI is UNKNOWN. 


— The ESR_ELx of the target Exception Level of the exception indicates that the fault was due to a 
translation table walk for a cache maintenance instruction. 
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The FAR_ELx of the target Exception Level holds the VA for the translation request. 


$ For the AT S1E0» and AT S1E1+» instructions executed from EL1, if there is a synchronous stage 2 fault on a 
memory access made as part of the translation table walk then: 


If the fault is a synchronous External abort on a stage 2 translation table and SCR_EL3,EA is 1, then 
a synchronous External abort on a stage 2 translation table walk is taken to EL3. 


Otherwise the fault is taken as an exception to EL2. 


If the exception is taken to EL2 the following apply: 


PAR_EL1 is UNKNOWN. 


ESR_EL2 indicates that the fault occurred on a translation table walk, and that the operation that 
faulted was a cache maintenance instruction. 


HPFAR_EL2 holds the IPA that faulted. 
FAR_EL2 holds the VA that the executing software supplied to the address translation instruction. 


This fault can occur for any of the following reasons: 


Stage 2 Translation fault. 

Stage 2 Access fault. 

Stage 2 Permission fault. 

Stage 2 Address size fault. 

Synchronous External abort on a stage 2 translation table walk. 


Synchronization requirements of the address translation instructions 


Where an instruction results in an update to a System register, as is the case with the AT » address translation 
instructions, explicit synchronization must be performed before the result is guaranteed to be visible to subsequent 
direct reads of the PAR_EL1. 





Note 
This is consistent with the AArch32 requirement, where the VA to PA translation instructions are executed as writes 
to the (coproc==0b1111) System register encoding space, and the effect of those writes to other registers require 
explicit synchronization before the result is guaranteed to be visible to subsequent instructions. 
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D5.3 VMSAv8-64 translation table format descriptors 


In general, a descriptor is one of: 


s An invalid or fault entry. 

à A table entry, that points to the next-level translation table. 

° A block entry, that defines the memory properties for the access. 
è A reserved format. 


Bit[1] of the descriptor indicates the descriptor type, and bit[0] indicates whether the descriptor is valid. 


The following sections describe the Armv8 translation table descriptor formats: 
. VMSAv8-64 translation table level 0, level 1, and level 2 descriptor formats. 
. Armv8 translation table level 3 descriptor formats on page D5-2568. 


Memory attribute fields in the VMSAv8-64 translation table format descriptors on page D5-2570 then gives more 
information about the descriptor attribute fields, and Control of Secure or Non-secure memory access on 

page D5-2576 describe how the NS and NSTable together control whether a memory access from Secure state 
accesses the Secure memory map or the Non-secure memory map. 


D5.3.1 VMSAv8-64 translation table level 0, level 1, and level 2 descriptor formats 


ARM DDI 0487E.a 
ID070919 


In the VMSAv8-64 translation table format, the difference in the formats of the level 0, level 1 and level 2 
descriptors is: 


. Whether a Block descriptor is permitted. 
° If a Block descriptor is permitted, the size of the memory region described by that entry. 
$ The maximum OA size, depending on whether ARMv8.2-LPA is implemented. 


These differences depend on the translation granule, as follows: 


4KB granule Level 0 translation tables do not support Block descriptors. 


A block descriptor: 
è In a level 1 table describes the mapping of the associated 1GB input address range. 
è In a level 2 table describes the mapping of the associated 2MB input address range. 


The maximum OA size of a lookup is 48 bits. 


16KB granule Level 0 and level 1 translation tables do not support Block descriptors. 


A Block descriptor in a level 2 table describes the mapping of the associated 32MB input address 
range. 


The maximum OA size of a lookup is 48 bits. 


64KB granule Level 0 lookup is not supported. 
Other properties depend on whether ARMv8.2-LPA is implemented: 
If ARMv8.2-LPA is implemented 


A block descriptor: 
° In a level 1 table describes the mapping of the associated 4TB input address 
range. 


. In a level 2 table describes the mapping of the associated 512MB input address 
range. 


The maximum OA size of a lookup is 48 bits. 
If ARMv8.2-LPA is not implemented 
Level 1 translation tables do not support Block descriptors. 


A Block descriptor in a level 2 table describes the mapping of the associated 512MB 
input address range. 


The maximum OA size of a lookup is 48 bits. 


When a lookup returns a Table descriptor, the OA is the next-level table address. 
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Figure D5-15 shows the Armv8 level 0, level 1, and level 2 descriptor formats that provide 48-bit OAs: 


63 1 0 
Invalid IGNORED 0 | 
RESO 
por — Stage 1 only, RESO at stage 2 


52 51 AN nn-1 16 15 12 11 2 1 0 


Block ae block attributes |_| Jreso] Output address[47:n] RESO [eT RESO |Lower block attributes] o | 1 | 


With the 4KB granule size, for the level 1 descriptor n is 30, and for the level 2 descriptor, n is 21. 
With the 16KB granule size, for the level 2 descriptor, n is 25. 
With the 64KB granule size, for the level 2 descriptor, n is 29. 


NSTable 

APTable Stage 1 only, 
e RESO at stage 2 
be 


63 62 61 iis 52:51 48 47 mm-1 12:11 210 
Table [T_T I [ossoreo | Reso | Next-level table address[47:m] RESO* IGNORED [i] 
With the 4KB Les size m is 12*, with the 16KB granule size m is 14, and with the 64KB granule size, m is 16. 


A level 0 Table descriptor returns the address of the level 1 table. 
A level 1 Table descriptor returns the address of the level 2 table. 
A level 2 Table descriptor returns the address of the level 3 table. 


+ When m is 12, the RESO field shown for bits[(m-1):12] is absent. 


Figure D5-15 VMSAv8-64 level 0, level 1 and level 2 descriptor formats with 48-bit OAs 


In an implementation that includes ARMv8.2-LPA, when the 64KB granule is used, the Block and Table descriptors 
are redefined as Figure D5-16 shows: 


1 0 


63 : 
Invalid IGNORED 0 | 


(ee — Stage 1 only, RESO at stage 2 
siya 48 47 nn-1 1615 1211 210 


Block aos block attributes | [reso | Output address[47:n] RESO [eT OA[51:48] |Lower block attributes] o | 1 | 


For the level 1 descriptor n is 42, and for the level 2 descriptor n is 29. 


NSTable 

APTable Stage 1 only, 

XNTable RESO at stage 2 
r PXNTable 


51 50 48 47 16 15 12 11 210 


63 62 61 60 59 58 
Table [T_T] [eor RESO Next-level table address[47:16] TA[51:48]¢ IGNORED [eal 


A level 1 Table descriptor returns the address of the level 2 table. 
A level 2 Table descriptor returns the address of the level 3 table. 


t TA[51:48] indicates bits[51:48] of the next-level table address. 


Figure D5-16 VMSAv8-64 level 1 and level 2 descriptor formats, 64KB granule with ARMv8.2-LPA 
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Note 


The effects on the Non-secure EL1 descriptors when ARMv8.1-HPD is enabled and HCR_EL2.{NV, NV1} 
=={1,1} are detailed in Effect of HCR_EL2.{NV, NV1} on page D5-2615. 





Descriptor encodings, Armv8 level 0, level 1, and level 2 formats 


Descriptor bit[0] identifies whether the descriptor is valid, and is 1 for a valid descriptor. If a lookup returns an 
invalid descriptor, the associated input address is unmapped, and any attempt to access it generates a Translation 
fault. 


Descriptor bit[1] identifies the descriptor type, and is encoded as: 


0, Block The descriptor gives the base address of a block of memory, and the attributes for that memory 
region. 
1, Table The descriptor gives the address of the next level of translation table, and for a stage 1 translation, 


some attributes for that translation. 
The other fields in the valid descriptors are: 


Block descriptor 
Gives the base address and attributes of a block of memory, as follows: 
4KB translation granule 


° For a level 1 Block descriptor, bits[47:30] are bits[47:30] of the output address. 
This output address specifies a 1GB block of memory. 


s For a level 2 descriptor, bits[47:21] are bits[47:21] of the output address. This 
output address specifies a 2MB block of memory. 

16KB translation granule 

For a level 2 Block descriptor, bits[47:25] are bits[47:25] of the output address.This 

output address specifies a 32MB block of memory. 

64KB translation granule 

For a level 1 Block descriptor: 

. If ARMv8.2-LPA is implemented, bits[15:12] are bits[51:48] of the output 
address and bits[47:42] are bits [47:42] of the output address. This output address 
specifies a 4TB block of memory. 

° If ARMv8.2-LPA is not implemented, there is no level 1 Block descriptor. 

For a level 2 Block descriptor: 

. If ARMv8.2-LPA is implemented, bits[15:12] are bits[51:48] of the output 


address, and bits[47:29] are bits [47:29] of the output address. This output address 
specifies a 512MB block of memory. 


° If ARMv8.2-LPA is not implemented, bits[47:29] are bits[47:29] of the output 
address.This output address specifies a 512MB block of memory. 





In Armv8.0, bits[63:52, 11:2] provide attributes for the target memory block. When 
ARMv8.1-TTHM is implemented, bits[63:51, 11:2] provide the attributes for the target memory 
block. For more information, see Memory attribute fields in the VUSAv8-64 translation table format 
descriptors on page D5-2570. 





Note 
s In Armv8.0, the position and contents of bits[63:52, 11:2] are identical to bits[63:52, 11:2] in 
the Page descriptors. 


- When ARMv8.1-TTHM is implemented, the position and contents of bits[63:51, 11:2] are 
identical to bits[63:51, 11:2] in the Page descriptors. 
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. When ARMv8.2-TTPBHA is implemented, hardware can use bits[62:59] of the Block 
descriptors for IMPLEMENTATION DEFINED purposes, see Memory attribute fields in the 
VMSAV8-64 translation table format descriptors on page D5-2570. 


Table descriptor 
Gives the translation table address for the next-level lookup, as follows: 
4KB translation granule 
7 Bits[47:12] are bits[47:12] of the address of the required next-level table, which 
is: 
— Fora level 0 Table descriptor, the address of a level 1 table. 
— Fora level 1 Table descriptor, the address of a level 2 table. 
— Fora level 2 Table descriptor, the address of a level 3 table. 
š Bits[11:0] of the table address are zero. 
16KB translation granule 
. Bits[47:14] are bits[47:14] of the address of the required next-level table, which 
is: 
— Fora level 0 Table descriptor, the address of a level 1 table. 
— Fora level 1 Table descriptor, the address of a level 2 table. 
— Fora level 2 Table descriptor, the address of a level 3 table. 
š Bits[13:0] of the table address are zero. 
64KB translation granule 
s Bits[47:16] are bits[47:16] of the address of the required next-level table, which 
is: 
— Fora level 1 Table descriptor, the address of a level 2 table. 
— Fora level 2 Table descriptor, the address of a level 3 table. 
When ARMv8.2-LPA is implemented, bits[15:12] are bits[51:48] of the required 
next-level table. 
. Bits[15:0] of the table address are zero. 


For a stage | translation only, bits[63:59] provide attributes for the next-level lookup, see Memory 
attribute fields in the VUSAv8-64 translation table format descriptors on page D5-2570. 


If the translation table defines either the Secure or Non-secure EL1&0, when EL2 is enabled, stage 1 translations, 
then the output address in the descriptor is the IPA of the target block or table. Otherwise, it is the PA of the target 
block or table. 


D5.3.2 Armvé8 translation table level 3 descriptor formats 


For the 4KB granule size, each entry in a level 3 table describes the mapping of the associated 4KB input address 
range. 


For the 16KB granule size, each entry in a level 3 table describes the mapping of the associated 16KB input address 
range. 


For the 64KB granule size, each entry in a level 3 table describes the mapping of the associated 64KB input address 
range. 


Figure D5-17 on page DS-2569 shows the Armv8 level 3 descriptor formats. 
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63 : : 1 0 

Invalid] IGNORED 0 | 
63 210 

Reserved | RESO [o[*] 
63 5150 4847 12:11 210 

Page, 4KB granule| Upper' attributes [Reso | Output address[47:12] | Lower' attributes [+] 4] 
63 5150 4847 14 13 12 11 210 

Page, 16KB granule | Upper' attributes [Reso | Output address[47:14] [oo] Lower' attributes [i] 
63 5150 4847 16:15 12:11 210 








Page, 64KB granule | Upper' attributes [Reso | Output address[47:16] [ TAt51:487 | Lower' attributes KE 


t Upper page attributes and Lower page attributes 
t TA[51:48] indicates bits[51:48] of the page address. 


Figure D5-17 VMSAv8-64 level 3 descriptor format 


Descriptor bit[0] identifies whether the descriptor is valid, and is 1 for a valid descriptor. If a lookup returns an 
invalid descriptor, the associated input address is unmapped, and any attempt to access it generates a Translation 
fault. 


Descriptor bit[1] identifies the descriptor type, and is encoded as: 


0, Reserved, invalid 
Behaves identically to encodings with bit[0] set to 0. 


This encoding must not be used in level 3 translation tables. 
1, Page Gives the address and attributes of a 4KB, 16KB, or 64KB page of memory. 


At this level, the only valid format is the Page descriptor. The other fields in the Page descriptor are: 


Page descriptor 
Gives the output address ofa page of memory, as follows: 


4KB translation granule 
Bits[47:12] are bits[47:12] of the output address for a page of memory. 


16KB translation granule 
Bits[47:14] are bits[47:14] of the output address for a page of memory. 


64KB translation granule 
If ARMv8.2-LPA is implemented, bits[15:12] are bits[51:48] and bits[47:16] are 
bits[47:16] of the output address for a page of memory. 
If ARMv8.2-LPA is not implemented, bits[47:16] are bits[47:16] of the output address 
for a page of memory. 
Bits[63:52, 11:2] provide attributes for the target memory page, see Memory attribute fields in the 
VMSAV8-64 translation table format descriptors on page D5-2570. 


Note 
è In Armv8.0, the position and contents of bits[63:52, 11:2] are identical to bits[63:52, 11:2] in 
the level 0, level 1, and level 2 block descriptors. 


s When ARMv8.1-TTHM is implemented, the position and contents of bits[63:51, 11:2] are 
identical to bits[63:51, 11:2] in the level 0, level 1, and level 2 block descriptors. 
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° When ARMv8.2-TTPBHA is implemented, hardware can use bits[62:59] of the Page 
descriptors for IMPLEMENTATION DEFINED purposes, see Memory attribute fields in the 
VMSAVv8-64 translation table format descriptors. 


For either the Secure or Non-secure EL1&0, when EL2 is enabled, stage 1 translations, the output address in the 
descriptor is the IPA of the target page. Otherwise, it is the PA of the target page. 


D5.3.3 Memory attribute fields in the VMSAv8-64 translation table format descriptors 


Memory region attributes on page D5-2599 describes the region attribute fields. The following subsections 
summarize the descriptor attributes as follows: 


Table descriptor 


Table descriptors for stage 2 translations do not include any attribute field. For a summary of the 
attribute fields in a stage 1 table descriptor, that define the attributes for the next lookup level, see 
Next-level attributes in stage 1 VMSAv8-64 Table descriptors. 


Block and page descriptors 


These descriptors define memory attributes for the target block or page of memory. Stage 1 and 
stage 2 translations have some differences in these attributes, see: 


. Attribute fields in stage 1 VMSAv8-64 Block and Page descriptors on page D5-2572 
. Attribute fields in stage 2 VMSAv8-64 Block and Page descriptors on page D5-2574. 


Next-level attributes in stage 1 VMSAv8-64 Table descriptors 


In a Table descriptor for a stage 1 translation, bits[63:59] of the descriptor define the attributes for the next-level 
translation table access, and bits[58:51] are IGNORED: 


Next-level descriptor attributes, stage 1 only 


63 62 61 60 59 58 51 


T me 


NSTable — 
APTable 
UXNTable or XNTable t 


PXNTable $ 
t UXNTable for a translation regime that can apply to execution at ELO, otherwise XNTable. 
+ RESO for a translation regime that cannot apply to execution at ELO. 


These attributes are: 


NSTable, bit[63] 


For memory accesses from Secure state, specifies the Security state for subsequent levels of lookup, 
see Hierarchical control of Secure or Non-secure memory accesses on page D5-2576. 


For memory accesses from Non-secure state, including all accesses in the EL2 or EL2&0 translation 
regime, this bit is RESO and is ignored by the PE. 
APTable, bits[62:61] 


Access permissions limit for subsequent levels of lookup, see Hierarchical control of data access 
permissions on page D5-2582. 


APTable[0] is RESO: 
. In the EL2 translation regime. 
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Note 


In an implementation that includes ARMv8.1-VHE, when the value of HCR_EL2.E2H is 1 
the translation regime for memory accesses from EL2 is the EL2&0 translation regime. 
APTable[0] can be valid (not RESO) in the EL2&0 translation regime. 








. In the EL3 translation regime. 
From Armv8.1, when ARMv8.1-HPD is implemented, this field can be disabled. When the value 
of TCR_ELx.HPD {0} or TCR_ELx.HPD1 is 1: 


s The value of the corresponding APTable field is IGNORED by hardware, allowing the field to 
be used by software. 


° The behavior of the system is as if the value of the corresponding APTable field is 0. 


Note 

From Armv8.3, if EL2 is enabled in the current Security state, in the EL1 translation regime, when 
the value of HCR_EL2.{NV, NV1} == {1, 1}, bit[61] is treated as 0 regardless of the actual value, 
see Additional behaviors when HCR_EL2.NV == 1 and HCR_EL2.NV1 == 1 on page D5-2616. 








UXNTable or XNTable, bit[60] 


XN limit for subsequent levels of lookup, see Hierarchical control of instruction fetching on 
page DS-2587. 


The naming of this field depends on whether stage 1 of the translation regime can support two VA 
ranges: 


Stage 1 can support two VA ranges 


This field is UXNTable, and determines whether execution at ELO of instructions 
fetched from the region identified at a lower level of lookup permitted. 


Note 


PXNTable is the equivalent control of execution at a higher Exception level. 








Stage 1 supports only one VA range 

This field is XNTable. 
From Armv8.1, when ARMv8.1-HPD is implemented, this field can be disabled. When the value 
of TCR_ELx.HPD {0} or TCR_ELx.HPD1 is 1: 


s The value of the corresponding UXNTable field is IGNORED by hardware, allowing the field 
to be used by software. 


° The behavior of the system is as if the value of the corresponding UXNTable field is 0. 


Note 

From Armv8.3, if EL2 is enabled in the current Security state, in the EL1 translation regime, when 
the value of HCR_EL2.{NV, NV1} == {1, 1}, bit[60] holds PXNTable, see Additional behaviors 
when HCR_EL2.NV == 1 and HCR_EL2.NV1 == 1 on page D5-2616. 








PXNTable, bit[59] 


PXN limit for subsequent levels of lookup, see Hierarchical control of instruction fetching on 
page DS-2587. 


This field is valid only for a stage 1 translation that can support two VA ranges. It is RESO for stage 1 
translations that can support only one VA range. 


From Armv8.1, when ARMv8.1-HPD is implemented, this field can be disabled. When the value 
of TCR_ELx.HPD {0} or TCR_EL1.HPD1 is 1: 


s The value of the corresponding PXNTable field is IGNORED by hardware, allowing the field 
to be used by software. 


° The behavior of the system is as if the value of the corresponding PXNTable field is 0. 
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Note 


From Armv8.3, if EL2 is enabled in the current Security state, in the EL1&0 translation regime, 
when the value of HCR_EL2.{NV, NV1} == {1, 1}, bit[59] is RESO, see Additional behaviors when 
HCR_EL2.NV == 1 and HCR_EL2.NV1 == I on page D5-2616. 








The definition of IGNORED means the architecture guarantees that the PE makes no use of the field, see JGNORED 
on page Glossary-7887. For more information about these fields see Other fields in the VMSAv8-64 translation table 
format descriptors on page D5-2603. 


Attribute fields in stage 1 VMSAv8-64 Block and Page descriptors 


In Block and Page descriptors, the memory attributes are split into an upper block and a lower block, as shown for 
a stage 1 translation: 
Attribute fields for VMSAv8-64 stage 1 Block and Page descriptors 


Upper attributes Lower attributes 
3 62 59 58 55 54 53 52 51 1615 1211109 8765 4 


See) ee in a 


IGNORED — nG 
Reserved for software use AF 
UXN or XNT SH[1:0] 


[e>] 





PXN* AP[2:1] 
Contiguous NS 
DBM’ Attrindx[2:0] 








T IGNORED if ARMv8.2-TTPBHA is not implemented. 

t UXN for a translation regime that can apply to execution at ELO, otherwise XN. 
+ RESO for a translation regime that cannot apply to execution at ELO. 

* RESO if ARMv8.1-TTHM is not implemented. 

§ RESO if ARMv8.2-LPA is not implemented. 


For a stage | descriptor, the attributes are: 


PBHA, bits[62:59] 
Page-based hardware attributes bits. 
These bits are IGNORED when ARMv8.2-TTPBHA is not implemented. 


When ARMv8.2-TTPBHA is implemented, each TCR_ELx has a control bit for each PBHA bit in 
the translation tables that it controls. When the value of that control bit is 1, and the value of the 
corresponding Hierarchical permission disables bit, TCR_ELx.HPD {n} is 1, hardware can use that 
PBHA bit for IMPLEMENTATION DEFINED purposes. 


The TCR_ELx control bits for this feature are: 
For a translation regime that supports only a single VA range 
HWuwU0nn Controls whether Block or Page descriptor bit[nn] can be used by hardware. 
These controls apply only when the value of TCR_ELx.HPD0 is 1. 
For a translation regime that can support two VA ranges 


HWU0nn For the translation tables indicated by TTBRO_ELx, controls whether Block 
or Page descriptor bit[nn] can be used by hardware. 
These controls apply only when the value of TCR_ELx.HPD0 is 1. 
HWuUt1nn For the translation tables indicated by TTBR1_ELx, controls whether Block 
or Page descriptor bit[nn] can be used by hardware. 
These controls apply only when the value of TCR_ELx.HPD1 is 1. 


If ARMv8.2-TTPBHA is not implemented, then the TCR_ELx control bits are RAZ/WI. 
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XN or UXN, bit[54] 


The Execute-never or Unprivileged execute-never field, see Access permissions for instruction 
execution on page D5-2583. 


—— Note 

From Armv8.3, in the Non-secure EL] translation regime, when the value of HCR_EL2.{NV, NV 1} 
== {1, 1}, bit[54] holds PXN, see Additional behaviors when HCR_EL2.NV == 1 and 
HCR_EL2.NV1 == I on page D5-2616. 





PXN, bit[53] The Privileged execute-never field, see Access permissions for instruction execution on 
page D5-2583. 


This field is valid only when stage 1 of the translation regime can support two VA ranges. It is RESO 
when stage | can support only one VA range. 


— Note 


From Armv8.3, in the Non-secure EL] translation regime, when the value of HCR_EL2.{NV, NV 1} 
== {1, 1}, bit[53] is RESO, see Additional behaviors when HCR_EL2.NV == 1 and HCR_EL2.NV1 
== 1 on page DS-2616. 





Contiguous, bit[52] 
A hint bit indicating that the translation table entry is one of a contiguous set or entries, that might 
be cached in a single TLB entry, see The Contiguous bit on page D5-2604. 

DBM, bit[51] Dirty Bit Modifier, see The dirty state on page D5-2589. 


nT, bit[16] Block translation entry, see Block translation entry on page D5-2589. 
If ARMv8.4-TTRem is implemented, this field is present in stage 1 block translation table entries. 
Otherwise, this field is RESO. 


nG, bit[11] The not global bit. Ifa lookup using this descriptor is cached in a TLB, determines whether the TLB 
entry applies to all ASID values, or only to the current ASID value. See Global and process-specific 
translation table entries on page D5-2635. 


This field is valid only when stage 1 of the translation regime can support two VA ranges. It is RESO 
when stage | can support only one VA range. 

AF, bit[10] The Access flag, see The Access flag on page D5-2589. 

SH, bits[9:8] Shareability field, see Memory region attributes on page D5-2599. 


AP[2:1], bits[7:6] 


Data Access Permissions bits, see Memory access control on page D5-2577. 


— Note 


The Armv8 translation table descriptor format defines AP[2:1] as the Access Permissions bits, and 
does not define an AP[0] bit. 


AP[1] is valid only for stage 1 of a translation regime that can support two VA ranges. It is RES] 
when stage 1 translations can support only one VA range. 


— Note 


From Armv8.3, in the Non-secure EL] translation regime, when the value of HCR_EL2.{NV, NV 1} 
== {1, 1}, bit[6] is treated as 0 regardless of its actual value, see Additional behaviors when 
HCR_EL2.NV == 1 and HCR_EL2.NV1 == I on page D5-2616. 





NS, bit[5] Non-secure bit. For memory accesses from Secure state, specifies whether the output address is in 
the Secure or Non-secure address map, see Control of Secure or Non-secure memory access on 
page DS-2576. 
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For memory accesses from Non-secure state this bit is RESO and is ignored by the PE. 


AttrIndx[2:0], bits[4:2] 
Stage 1 memory attributes index field, for the MAIR_ELx, see Stage 1 memory region type and 
Cacheability attributes on page DS-2599. 


The definition of IGNORED means the architecture guarantees that the PE makes no use of the field, see JGNORED 
on page Glossary-7887. For more information about these fields see Other fields in the VMSAv8-64 translation table 
format descriptors on page D5-2603. 


Attribute fields in stage 2 VMSAv8-64 Block and Page descriptors 


In Block and Page descriptors, the memory attributes are split into an upper block and a lower block, as shown for 
a stage 2 translation: 


Attribute fields for VMSAv8-64 stage 2 Block and Page descriptors when ARMv8.4-S2FWB is implemented 


Upper attributes Lower attributes 
63 62 60 59 58 55 54 53 52.51 16 15 12 a 109 8 7 6 5 


aaa aes) es AL 


Reserved for use by a System MMU _| AF——! 
Reserved for software use cae :0] 
XN[1:0]* S2AP[1:0] 


Contiguous MemAttr[3:0] 
DBM’ 

















+ Bit[53] is RESO if ARMv8.2-TTS2UXN is not implemented. 
t Bits [62:60] are IGNORED and reserved for use by System MMU if ARMv8.2-TTPBHA is not implemented. 
Bits [59] is IGNORED if ARMv8.2-TTPBHA is not implemented. 


* RESO if ARMv8.1-TTHM is not implemented. 
§ RESO if ARMv8.2-LPA is not implemented. 


For a stage 2 descriptor, the attributes are: 


PBHA[3:1], bits[62:60] 
Page-based hardware attributes bits. 


These bits are IGNORED and reserved for System MMU use when ARMv8.2-TTPBHA is not 
implemented. 


When ARMv8.2-TTPBHA is implemented, VTCR_EL2 has a control bit for each PBHA bit in the 
EL1&0 stage 2 translation tables. When the value of that control bit is 1, hardware can use the 
corresponding PBHA bit for IMPLEMENTATION DEFINED purposes. When the value of the control bit 
is 0, the corresponding PBHA bit is IGNORED and reserved for System MMU use. 

PBHA[0], bit[59] 
Page-based hardware attributes bit. 
This bit is IGNORED when ARMv8.2-TTPBHA is not implemented. 


When ARMv8.2-TTPBHA is implemented, VTCR_EL2 has a control bit for this bit in the EL1&0 
stage 2 translation tables. When the value of that control bit is 1, hardware can use this bit for 
IMPLEMENTATION DEFINED purposes. When the value of the control bit is 0, this bit is IGNORED. 


XN[1:0], bits[54:53] 
The Execute-never field, see Access permissions for instruction execution on page D5-2583. 


If ARMv8.2-TTS2UXN is not implemented, bit[53] is RESO. 
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Contiguous, bit[52] 


DBM, bit[51] 


nT, bit[16] 


AF, bit[10] 


SH, bits[9:8] 


A hint bit indicating that the translation table entry is one of a contiguous set or entries, that might 
be cached in a single TLB entry, see The Contiguous bit on page D5-2604. 


Dirty Bit Modifier, see The dirty state on page D5-2589. 


Block translation entry, see Block translation entry on page D5-2589. 


If ARMv8.4-TTRem is implemented, this field is present in stage 2 block translation table entries. 
Otherwise, this field is RESO. 


The Access flag, see The Access flag on page D5-2589. 


Shareability field, see The stage 2 memory region attributes, EL1&0 translation regime on 
page D5-2601. 


S2AP, bits[7:6] 


Stage 2 data Access Permissions bits, see The S2AP data access permissions, Secure or Non-secure 
EL1&0, when EL2 is enabled, translation regime on page D5-2582. 


— Note 


In the original VMSAv7-32 Long-descriptor attribute definition, this field was called HAP[2:1], for 
consistency with the AP[2:1] field in the stage 1 descriptors and despite there being no HAP[0] bit. 
Armv§8 renames the field for greater clarity. 





MemAttr, bits[5:2] 


Stage 2 memory attributes, see The stage 2 memory region attributes, EL1&0 translation regime on 
page D5-2601. 


The definition of IGNORED means the architecture guarantees that the PE makes no use of the field, see JGNORED 
on page Glossary-7887. For more information about these fields see Other fields in the VMSAv8-64 translation table 
format descriptors on page DS-2603. 
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D5-2576 


Control of Secure or Non-secure memory access 


As this section describes, the NS bit in the translation table entries: 


` For accesses from Secure state, if the translation table entry was held in secure memory, determines whether 
the access is to Secure or Non-secure memory. 


° Is ignored by: 
— Accesses from Non-secure state. 
— Accesses from Secure state if the translation table entry was held in Non-secure memory. 


In the VMSAv8-64 translation table format: 
° The NS bit relates only to the memory block or page at the output address defined by the descriptor. 


° The descriptors also include an NSTable bit, that affects accesses at lower levels of lookup, see Hierarchical 
control of Secure or Non-secure memory accesses. 


The NS and NSTable bits are valid only for memory accesses from Secure state described by translation table 
descriptors that are fetched from Secure memory, and: 


$ In the translation table descriptors in a Non-secure translation table, the NS and NSTable bits are SBZ. 
° Memory accesses from Non-secure state, including all accesses from EL2, ignore the values of these bits. 


In the Secure translation regimes, for translation table descriptors that are fetched from Secure memory, the NS bit 
in a descriptor indicates whether the descriptor refers to the Secure or the Non-secure address map, as follows: 
NS == Access the Secure PA space. 

NS == Access the Non-secure PA space. 


For Non-secure translation regimes, and for translation table descriptors fetched from Non-secure memory, the 
corresponding bit is RESO and is ignored by the PE. The access is made to Non-secure memory, regardless of the 
value of the bit. 


Hierarchical control of Secure or Non-secure memory accesses 


For VMSAv8-64 table descriptors for stage 1 translations, the descriptor includes an NSTable bit, that indicates 
whether the table identified in the descriptor is in Secure or Non-secure memory. For accesses from Secure state, 
the meaning of the NSTable bit is: 


NSTable == 0 The defined table address is in the Secure PA space. In the descriptors in that translation table, NS 
bits and NSTable bits have their defined meanings. 


NSTable == 1 The defined table address is in the Non-secure PA space. Because this table is fetched from the 
Non-secure address space, the NS and NSTable bits in the descriptors in this table must be ignored. 
This means that, for this table: 


. The value of the NS bit in any block or page descriptor is ignored. The block or page address 
refers to Non-secure memory. 


° The value of the NSTable bit in any table descriptor is ignored, and the table address refers 
to Non-secure memory. When this table is accessed, the NS bit in any block or page 
descriptor is ignored, and all descriptors in the table refer to Non-secure memory. 


In addition, an entry fetched in Secure state is treated as non-global if it is read from the Non-secure IPA space 
memory. That is, these entries must be treated as if nG==1, regardless of the value of the nG bit. For more 
information about the nG bit, see Global and process-specific translation table entries on page D5-2635. 


The effect of NSTable applies to later entries in the translation table walk, and so its effects can be held in one or 
more TLB entries. Therefore a change to NSTable requires coarse-grained invalidation of the TLB to ensure that 
the effect of the change is visible to subsequent memory transactions. 
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D5.4 Memory access control 


The access control fields in the translation table descriptors determine whether the PE, in its current state, is 
permitted to perform the required access to the output address given in the translation table descriptor. If a 
translation stage does not permit the access then an MMU fault is generated for that translation stage, and no 
memory access is performed. 


The following sections describe the memory access controls: 

3 About access permissions. 

7 About PSTATE.PAN on page D5-2578. 

. About PSTATE.UAO on page D5-2579. 

° About PSTATE.BTYPE on page D5-2579. 

3 Data access permission controls on page D5-2580. 

° Access permissions for instruction execution on page D5-2583. 

s The Access flag on page D5-2589. 

7 The dirty state on page D5-2589. 

$ Software management of the Access flag on page D5-2589. 

7 Hardware management of the Access flag and dirty state on page D5-2590. 
. Ordering of hardware updates to the translation tables on page D5-2596. 





. Restriction on memory types for hardware updates on translation tables on page D5-2597. 
$ Use of the Contiguous bit with hardware updates of the translation table entries on page D5-2597. 
Note 


This section describes the access controls for each of the translation regimes, and for each stage of translation in the 
EL1&0, when EL2 is enabled, translation regime. 


A translation applies to memory accesses from either: 
° Only a single Exception level, for example the EL3 translation regime. 
. ELO and one higher Exception level, for example the EL1&0 translation regime. 





In addition to an output address, a translation table entry that refers to a page or region of memory includes fields 
that define properties of the target memory region. These fields can be classified as address map control, access 
control, and region attribute fields. Control of Secure or Non-secure memory access on page D5-2576 describes the 
address map control, and Memory region attributes on page D5-2599 describes the other fields. 


Note 


If ARMv8.5-MemTag is implemented and enabled, and PSTATE.TCO is 1 a Tag Check Fail might generate a 
synchronous exception, for more information see PE handling of Tag Check failure on page D6-2666. 





D5.4.1 About access permissions 


ARM DDI 0487E.a 
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The translation table descriptors include fields that define access permissions for data accesses and for instruction 
fetches. This section introduces those fields. In addition: 


° System register controls can prevent execution from writable locations, see Preventing execution from 
writable locations on page D5-2588. 


7 For the effect of disabling a stage of address translation on the access permissions see The effects of disabling 
a stage of address translation on page D5-2558. 


° From Armv8.1, the PSTATE.PAN bit can affect the access permissions for privileged data accesses, see 
About PSTATE.PAN on page DS-2578. 


. From Armv8.2, the PSTATE.UAO bit can affect the access permissions for unprivileged instructions, see 
About PSTATE.UAO on page D5-2579. 
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D5.4.2 


D5-2578 


Note 


This section gives a general description of memory access permissions. In an implementation that includes EL2, 
software executing at EL1 can see only the access permissions defined by the EL1&0, when EL2 is enabled, stage 
1 translations. However, software executing at EL2 can modify these permissions. This modification is invisible to 
the software executing at EL1 or ELO. 








The access permission bits control access to the corresponding memory region. The VMSAv8-64 translation table 
format: 


. In stage 1 translations, uses AP[2:1] to define the data access permissions, see The AP/2:1] data access 
permissions, for stage 1 translations on page D5-2581. 


Note 


The description of the access permission field as AP[2:1] is for consistency with the VMSAv8-32 
Short-descriptor translation table format, see The VMSAvS8-32 Short-descriptor translation table format on 
page G5-5737. The VMSAv8-64 translation table format does not define an AP[0] bit. 








è In stage 2 translations, uses S2AP[1:0] to define the data access permissions, see The S2AP data access 
permissions, Secure or Non-secure ELI1&0, when EL2 is enabled, translation regime on page D5-2582. 


° Uses the UXN, XN and PXN fields to define access controls for instruction fetches, see Access permissions 
Jor instruction execution on page D5-2583. 


An attempt to perform a memory access that the translation table access permission bits do not permit generates a 
Permission fault, for the corresponding stage of translation. 


Note 


In an implementation that includes EL2, each stage of the translation of a memory access made using the Secure or 
Non-secure EL1&0, when EL2 is enabled, translation regime has its own, independent, permission check. 








About PSTATE.PAN 


When the value of PSTATE.PAN is 1, any privileged data access from EL1, or EL2 when HCR_EL2.E2H is 1, toa 
virtual memory address that is accessible at ELO, generates a Permission fault. 


When the value of PSTATE.PAN is 0, the translation system is the same as in Armv8.0. 


When ARMv8.1-PAN is implemented, the SPSR_EL1.PAN, SPSR_EL2.PAN, and SPSR_EL3.PAN bits are used 
for exception returns, and the DSPSR_ELO register is used for entry to or exit from Debug state. 


When ARMv8.1-PAN is implemented, the SCTLR_EL1.SPAN and SCTLR_EL2.SPAN bits are used to control 
whether the PAN bit is set on an exception to EL1 or EL2. 


When HCR_EL2. {E2H, TGE} == {1, 1} SCTLR_ELI.SPAN and SCTLR_EL2.SPAN are ignored. 


The PAN bit has no effect on: 
° Data Cache instructions other than DC ZVA. 
. Address translation instructions, other than ATS1E1RP and ATS1E1wP when ARMv8.2-ATS1E1 is implemented. 


. Unprivileged instructions, LDTR, LDTRB, LDTRH, LDTRSB, LDTRSH, LDTRSW, STTR, STTRB, and STTRH, unless 
HCR_EL2.{E2H, TGE} == {1, 0}. 


. Instruction accesses. 


The PAN bit has no effect when the first stage of translation is disabled for the current translation regime or when 
the first stage of translation for the current translation regime does not describe the permissions for access at ELO. 


If access is disabled, then the access will give rise to a stage 1 Permission fault. 


On an exception that is taken from AArch64 state to AArch64 state, PSTATE.PAN is copied to SPSR_ELx.PAN. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch64 Virtual Memory System Architecture 
D5.4 Memory access control 


On an exception return from AArch6é4 state: 
` SPSR_ELx.PAN is copied to PSTATE.PAN, when the target Exception level is in AArch64 state. 
e SPSR_ELx.PAN is copied to CPSR.PAN, when the target Exception level is in AArch32 state. 


Note 
5 In Non-debug state, in AArch64 state: 


— Software can use an MSR PAN, #Imm4 or MSR PAN, Xt instruction to modify PSTATE.PAN, or an MRS Xt, 
PAN instruction to read PSTATE.PAN. 


— In EL1, when HCR_EL2.{NV, NV1} == {1, 1}, PSTATE.PAN is treated as 0 for all purposes except 
reading the value of the bit. 





z In Debug state, in AArch64 state, a debugger can use the DRPS instruction to modify PSTATE.PAN. 





D5.4.3 About PSTATE.UAO 


When the value of PSTATE.UAO is 1, a Load/Store unprivileged instruction executed at EL1, or executed at EL2 
when the Effective value of HCR_EL2.{E2H, TGE} is {1, 1} is subject to the memory access permissions that apply 
to the Exception level at which it is executed, rather than being subject to the ELO access permissions. This means 
the Load/Store unprivileged instruction is subject to the same access permissions as the corresponding Load/Store 
register instruction. See Load/Store unprivileged on page C3-201 and Load/Store register on page C3-197. 


When ARMv8.2-UAO is implemented and PSTATE.UAO is 0, it has no effect on the described behavior of any 
Load/Store unprivileged instruction. 


A corresponding UAO bit is added to SPSR_EL1, SPSR_EL2, and SPSR_EL3 for exception returns, and 
DSPSR_ELO for entry to or exit from Debug state. 


On an exception that is taken from AArch64 state to AArch64 state, PSTATE.UAO is copied to SPSR_ELx.UAO 
and then set to 0. 


On an exception that is taken from AArch32 state to AArch64 state: 
° PSTATE.UAO is set to 0. 
° SPSR_ELx.UAO is set to 0. 


On an exception return from AArch64 state to AArch64 state, SPSR_ELx.UAO is copied to PSTATE.UAO. 





Note 


° In Non-debug state, in AArch64 state, software can use an MSR UAO, #Imm4 or MSR UAO, Xt instruction to 
modify PSTATE.UAO, or an MRS Xt, UAO instruction to read PSTATE.UAO. 


s In Debug state, in AArch64 state, a debugger can use the DRPS instruction to modify PSTATE.UAO. 





D5.4.4 About PSTATE.BTYPE 


When ARMv8.5-BTI is implemented, on execution of an instruction, the guarded status of the memory region and 
the register that is accessed by the instruction determines the value that the PSTATE.BTYPE field is set at the end 
of the execution of the instruction as shown in Table D5-26: 


Table D5-26 Values taken by PSTATE.BTYPE on execution of an instruction 














Instruction executed Memory region Register accessed PSTATE.BTYPE 
BR, BRAA, BRAAZ, BRAB, BRABZ Guarded Any register other than X16 or X17 @0b11 
BLR, BLRAA, BLRAAZ, BLRAB, BLRABZ Any Any register 0b10 
BR, BRAA, BRAAZ, BRAB, BRABZ Guarded X16 or X17 0b01 
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Table D5-26 Values taken by PSTATE.BTYPE on execution of an instruction (continued) 











Instruction executed Memory region Register accessed PSTATE.BTYPE 
BR, BRAA, BRAAZ, BRAB, BRABZ Non-guarded Any register Qb01 

RET, RETAA, RETAB Any Any register Qbd0 

Any instruction other than BR, BRAA, BRAAZ, BRAB, Any Any register 0b00 

BRABZ, BLR, BLRAA, BLRAAZ, BLRAB, BLRABZ, RET, 

RETAA, RETAB 





The BTI instructions <targets> operand identifies the compatibility of the BTI instruction to different 
PSTATE.BTYPE values, as seen in Table D5-28 on page D5-2581. 


Table D5-27 Compatibility of BTI instruction to different PSTATE.BTYPE values 





PSTATE.BTYPE value 














<targets> 
0b00 0b01 0b10 0b11 
(omitted) N/A Not compatible Not compatible Not compatible 
c N/A Compatible Compatible Compatible 
j N/A Compatible Not compatible Compatible 
je N/A Compatible Compatible Compatible 





When accessing a guarded memory region and if PSTATE.BTYPE has a value of @b01, 0b10, or 0b11, then a BTI 
instruction that is compatible with the current value of PSTATE.BTYPE will not generate a Branch Target exception 
and will allow execution of subsequent instructions within the memory region. 


When accessing a guarded memory region, PACIASP and PACIBSP instructions have an implicit branch target 
identification instruction. This means that they are a target that is compatible with: 


. A PSTATE.BTYPE value of 0b10 or 0b01, 


° When the associated SCTLR_ELx. {BT0, BT1, BT} bits are 0, a PSTATE.BTYPE value of b11. 


Note 


$ The implicit branch target identification property of PACIASP and PACIBSP is independent of the setting of the 
SCTLR_ELx. {EnIA, EnIB} bits. 





° The Branch Target Identification instructions are NOPs in a non-guarded page. 


: There is no direct way of reading or writing to the PSTATE.BTYPE field. 





The ESR_ELx.EC code for a Branch Target exception is @x@D, see JSS encoding for an exception from Branch Target 
Identification instruction on page D13-3032. 


D5.4.5 Data access permission controls 


The following subsubsections describe the data access permission controls: 
. Preventing ELO access to halves of the address map on page D5-2581 
. The AP[2:1] data access permissions, for stage 1 translations on page D5-2581. 


. The S2AP data access permissions, Secure or Non-secure ELI &0, when EL2 is enabled, translation regime 
on page D5-2582. 
° Hierarchical control of data access permissions on page D5-2582. 
D5-2580 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


The AArch64 Virtual Memory System Architecture 
D5.4 Memory access control 


Preventing ELO access to halves of the address map 


If ARMv8.5-E0PD is implemented and enabled, the TCR_ELx.{EOPD0, EOPD1} fields can prevent unprivileged 
access to the addresses translated by TTBRO_ELx or TTBR1_ELx. If access is prevented, the fault is reported as a 
level 0 fault, and should take the same time to generate, whether the address is present in the TLB or not, to mitigate 
attacks that use fault timing. 


The AP[2:1] data access permissions, for stage 1 translations 


In VMSAv8-64, for a translation regime that applies to both ELO and a higher Exception level, the AP[2:1] bits 
control the stage 1 data access permissions, and: 


AP[2] Selects between read-only and read/write access. 
AP[1] Selects between Application level (ELO) control and the higher Exception level control. 


This provides four permission settings for data accesses: 


° Read-only at all levels. 

° Read/write at all levels. 

è Read-only at the higher Exception level, no access by software executing at ELO. 

è Read/write at the higher Exception level, no access by software executing at ELO. 
Note 





In an implementation that does not include ARMv8.1-VHE, the only translation regime that applies to ELO and a 
higher Exception level is the EL1&0 translation regime. In an implementation that includes ARMv8.1-VHE, the 
EL2&0 translation regime applies to both Non-secure ELO and EL2 when the value of HCR_EL2.{E2H, TGE} is 
{1, 1}. 





For translation regimes that apply only to accesses from a single Exception level, AP[2] determines the stage 1 data 
access permissions, and AP[1] is RES1, meaning it is ignored by hardware and is treated as if it is 1. 


Table D5-28 shows the meaning of the AP[2:1] field for stage 1 ofa translation regime that applies to both ELO and 
a higher Exception level. In this table, an entry of None indicates that any access from that Exception level faults. 


Table D5-28 Data access permissions for stage 1 translations that applies to ELO and a higher 
Exception level 


AP[2:1] Access from higher Exception level Access from ELO 














00 Read/write None 
01 Read/write Read/write 
10 Read-only None 
11 Read-only Read-only 





For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime: 


s The stage 2 translation also defines data access permissions, see The S2AP data access permissions, Secure 
or Non-secure EL1&0, when EL2 is enabled, translation regime on page D5-2582. 


$ When both stages of translation are enabled, Combining the stage 1 and stage 2 data access permissions on 
page D5-2606 describes how these permissions are combined. 
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Table D5-29 shows the effect of the AP[2] field for stage 1 of a translation regime that applies to only a single 
Exception level. 


Table D5-29 Data access permissions for stage 1 translations that apply to only a single 
Exception level 





AP[2] Access permission 





0 Read/write 





1 Read-only 





The S2AP data access permissions, Secure or Non-secure EL1&0, when EL2 is enabled, 
translation regime 


In the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, when stage 2 address translation is 
enabled, the S2AP field in the stage 2 translation table descriptors define the data access permissions as Table D5-30 
shows. In this table, an entry of None indicates that any access generates a Permission fault. 


Table D5-30 Data access permissions for stage 2 of the Secure or Non-secure EL1&0, when EL2 
is enabled, translation regime 





S2AP Access from Non-secure EL1 or Non-secure ELO 














00 None 

01 Read-only 
10 Write-only 
11 Read/write 





The S2AP access permissions make no distinction between Non-secure accesses from EL1 and Non-secure accesses 
from ELO. However, when both stages of address translation are enabled, these permissions are combined with the 
stage 1 access permissions defined by AP[2:1], see Combining the stage 1 and stage 2 data access permissions on 
page D5-2606. 


Combining the stage 1 and stage 2 attributes, EL1&0 translation regime on page D5-2605 gives more information 
about the use of the stage 1 and stage 2 access permissions in an implementation of virtualization. 


Hierarchical control of data access permissions 


The VMSAv8-64 translation table format includes mechanisms by which entries at one level of translation table 
lookup can set limits on the permitted entries at subsequent levels of lookup. This subsection describes how these 
controls apply to the data access permissions. 


Note 


Similar hierarchical controls apply to instruction fetching, see Hierarchical control of instruction fetching on 
page D5-2587. 





However, in an implementation that includes ARMv8.1-HPD, when the value of a TCR_ELx.HPD {0} field is 1, or 
the value of the TCR_ELx.HPD1 field is 1, the hierarchical control of data access permissions is disabled for the 
translation stage controlled by that TCR_ELx, and the information in this subsection does not apply. 
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The restrictions apply only to subsequent levels of lookup for the same stage of translation. The APTable[1:0] field 
restricts the access permissions, as Table D5-31 shows. As stated in the table footnote, for a translation regime that 
applies to only a single Exception level, APTable[0] is RESO, meaning it is ignored by the hardware. 


Table D5-31 Effect of APTable[1:0] on subsequent levels of lookup 





APTable[1:0] Effect 














00 No effect on permissions in subsequent levels of lookup. 

01a Access at ELO not permitted, regardless of permissions in subsequent levels of lookup. 

10 Write access not permitted, at any Exception level, regardless of permissions in subsequent levels 
of lookup. 

114 Regardless of permissions in subsequent levels of lookup: 
° Write access not permitted, at any Exception level. 
° Read access not permitted at ELO. 


a. Not valid any translation regime that applies to only a single Exception level. In the translation tables for such a regime, 
APTable[0] is RESO. 


Note 


The APTable[1:0] settings are combined with the translation table access permissions in the translation tables 
descriptors accessed in subsequent levels of lookup. They do not restrict or change the values entered in those 
descriptors. 








The VMSAv8-64 provides APTable[1:0] control only for stage 1 translations. The corresponding bits are RESO in 
the stage 2 translation table descriptors. 


The effect of APTable applies to later entries in the translation table walk, and so its effects can be held in one or 
more TLB entries. Therefore, a change to APTable requires coarse-grained invalidation of the TLB to ensure that 
the effect of the change is visible to subsequent memory transactions. 


D5.4.6 Access permissions for instruction execution 
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Execute-never controls determine whether instructions can be executed from a memory region. These controls are: 


UXN, Unprivileged execute-never, stage 1 only 


Descriptor bit[54], defined as UXN only for stage 1 of any translation regime for which stage 1 
translation can support two VA ranges. 


This field applies only to execution at ELO. A value of 0 indicates that this control permits 
execution. 

XN, Execute-never 
Descriptor bit[54], defined as XN for: 


* Stage 1 of any translation regime for which the stage 1 translation can support only a single 
VA range. 


. Stage 2 translations when ARMv8.2-TTS2UXN is not implemented. 


Note 


XN[1:0], Execute-never, stage 2 only describes the stage 2 control when ARMv8.2-TTS2UXN is 
implemented. 








This field applies to execution at any Exception level to which the stage of translation applies. A 
value of 0 indicates that this control permits execution. 
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PXN, Privileged execute-never, stage 1 only 


Descriptor bit[53], used only for stage 1 of any translation regime for which stage 1 translation can 
support two VA ranges. 


s For stage 1 ofa translation regime for which the stage 1 translation supports only a single VA 
range the stage 1 descriptors define a PXN field that is RESO, meaning it is ignored by 
hardware. 


This field applies only to execution at an Exception level higher than ELO. A value of 0 indicates 
that this control permits execution. 


XN[1:0], Execute-never, stage 2 only 


Descriptor bits[54:53], defined as XN[1:0] for: 
a Stage 2 translations when ARMv8.2-TTS2UXN is implemented. 


Table D5-32 shows the operation of this control. 


Table D5-32 XN[1:0] stage 2 access permissions model 





XN[1] XN[0] Access 

















0 0 The stage 2 control permits execution at EL1 and ELO 

0 1 The stage 2 control does not permit execution at EL1, but permits execution at ELO 

1 0 The stage 2 control does not permit execution at EL1 or ELO 

1 1 The stage 2 control permits execution at EL1, but does not permit execution at ELO 
Note 





For stage 2 translations when ARMv8.2-TTS2UXN is not implemented, descriptor bit[53] is RESO, 
meaning it is ignored by hardware. 





Note 





In an implementation that does not include ARMv8.1-VHE, the only translation regime for which stage 1 translation 
can support two VA ranges is the EL1&0 translation regime. In an implementation that includes ARMv8.1-VHE: 


When the value of HCR_EL2.E2H is 1, TCR_EL2 controls the EL2&0 translation regime, and this regime: 
— Supports two VA ranges, corresponding to TTBRO_EL2 and TTBR1_EL2. 
— Always supports both UXN and PXN fields. 


Memory accesses from ELO are translated using the EL2&0 translation regime only when the value of 
HCR_EL2. {E2H, TGE} is {1, 1}. 





Table D5-32 shows the operation of the stage 2 XN[1:0] control, and for each single-bit execute-never field a value 
of 1 indicates that, at an exception level to which the control applies, instructions cannot be executed from the target 
memory region. In addition: 


For a translation regime that applies to ELO and a higher Exception level, if the value of the AP[2:1] bits is 
0b01, permitting write access from ELO, then the PXN field is treated as if it has the value 1, regardless of its 
actual value. 


In a translation regime with two stages of translation, a region is execute-never if execution is not permitted 
by the value of the applicable execute-never field in one or both of: 


— The stage 1 translation table descriptor. 
— The stage 2 translation table descriptor. 
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For each translation regime, if the value of the corresponding SCTLR_ELx.WXN field is 1 then any memory 
region that is writable is treated as XN, regardless of the value of the corresponding UXN, XN, or PXN field. 
For more information, see Preventing execution from writable locations on page D5-2588. 


The SCR_EL3.SIF bit prevents execution in Secure state of any instruction fetched from Non-secure 
memory, see Restriction on Secure instruction fetch on page D5-2589. 


The execute-never controls apply to speculative instruction fetching, meaning speculative instruction fetch from a 
memory region that is execute-never at the current Exception level is prohibited. 


Note 





Although the execute-never controls apply to speculative fetching, on a speculative instruction fetch from an 
execute-never location, no Permission fault is generated unless the PE attempts to execute the instruction that 
would have been fetched from that location. This means that, if a speculative fetch from an execute-never 
location is attempted, but there is no attempt to execute the corresponding instruction, a Permission fault is 
not generated. 


The software that defines a translation table must mark any region of memory that is read-sensitive as 
execute-never, to avoid the possibility of a speculative fetch accessing the memory region. This means it must 
mark any memory region that corresponds to a read-sensitive peripheral as execute-never. Hardware does not 
prevent speculative accesses to a region of any Device memory type unless that region is also marked as 
execute-never for all Exception levels from which it can be accessed. 


When no stage of address translation for the translation regime is enabled, memory regions cannot have 
UXN, XN, or PXN attributes assigned. Behavior of instruction fetches when all associated stages of 
translation are disabled on page D5-2559 describes how disabling all stages of address translation affects 
instruction fetching. 





The following subsubsections give more information about the data access permission controls: 


Stage 1 instruction access and execution permissions. 

Stage 2 instruction execution permissions on page D5-2587. 
Hierarchical control of instruction fetching on page D5S-2587. 
Preventing execution from writable locations on page D5-2588. 


Restriction on Secure instruction fetch on page DS-2589. 


Stage 1 instruction access and execution permissions 


Table D5-33 on page D5-2586 and Table D5-34 on page D5-2587 include the AP[2:1] read and write permissions 
shown in Table D5-28 on page D5-2581 and Table D5-29 on page D5-2582. These permissions are shown as: 


R 
WwW 


Indicates Read permission granted. 
Indicates Write permission granted. 
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Table D5-33 shows the stage 1 access permissions for instruction execution when using a translation regime that 


applies to ELO and a higher Exception level. 


Table D5-33 Stage 1 access permissions for instruction execution for a translation regime that applies to ELO anda 


higher Exception level 










































































UXN PXN AP[2:1] SCTLR_ELx.WXN@_ Access from higher Exception level Access from ELO 
0 0 00 0 R, W, Executable Executable 
1 R, W, Not executable> Executable 
01 0 R, W, Not executable R, W, Executable 
1 R, W, Not executable R, W, Not executable d 
10 x R, Executable Executable 
11 x R, Executable R, Executable 
0 1 00 x R, W, Not executable Executable 
01 0 R, W, Not executable R, W, Executable 
1 R, W, Not executable R, W, Not executable d 
10 x R, Not executable Executable 
11 x R, Not executable R, Executable 
1 0 00 0 R, W, Executable Not executable 
1 R, W, Not executable> Not executable 
01 x R, W, Not executable c R, W, Not executable 
10 xX R, Executable Not executable 
11 x R, Executable R, Not executable 
1 00 x R, W, Not executable Not executable 
01 x R, W, Not executable R, W, Not executable 
10 x R, Not executable Not executable 
11 x R, Not executable R, Not executable 
a. Where ELx is the higher Exception level to which the translation regime applies. 
b. Not executable because of SCTLR_ELx.WXN control, because region is writable at ELx. 


a 9 


D5-2586 
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Table D5-34 shows the stage 1 access permissions for instruction execution when using a translation regime that 
applies to only a single Exception level. 


Table D5-34 Access permissions for instruction execution for a translation regime that applies to 
only a single Exception level 





XN AP[2] SCTLR_ELx.WXN?_ Access permission 

















0 0 0 R, W, Executable 
1 R, W, Not executable? 
1 x R, Executable 
1 0 x R, W, Not executable 
1 x R, Not executable 





a. Where ELx is the higher Exception level to which the 
translation regime applies. 


b. Not executable because of the SCTLR_ELx.WXN control, 
because region is writable at ELx. 


Note 


The Access permissions for an AArch64 translation regime that applies to only a single Exception level are 
consistent with the following fields in the translation table entries being treated as shown: 


° AP treated as RES1. 

è APTable[0] treated as RESO. 
° PXN treated as RESO. 

° PXNTable treated as RESO. 








Stage 2 instruction execution permissions 


For the Secure or Non-secure EL1&0, when EL2 is enabled, stage 2 translation, the XN fields in the stage 2 
translation table descriptors control the execution permission, and this control is completely independent of the 
S2AP access permissions: 


è When ARMv8.2-TTS2UXN is not implemented the stage 2 XN field is a 1-bit field that applies to execution 
at both ELO and EL1, see XN, Execute-never on page D5-2583. 


s When ARMv8.2-TTS2UXN is implemented the stage 2 XN field is a 2-bit field that provides independent 
control of execution from ELO and execution from EL1, see XN//:0/, Execute-never, stage 2 only on 
page D5-2584. 


See also Combining the stage 1 and stage 2 instruction execution permissions on page D5-2606. 


Hierarchical control of instruction fetching 


The VMSAv8-64 translation table format includes mechanisms by which entries at one level of translation table 
lookup can set limits on the permitted entries at subsequent levels of lookup. This subsection describes how these 
controls apply to the instruction fetching controls. 


Note 


Similar hierarchical controls apply to data accesses, see Hierarchical control of data access permissions on 
page DS5-2582. 
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D5-2588 


However, in an implementation that includes ARMv8.1-HPD, when the value of aTCR_ELx.HPD {0} field is 1, or 
the value of the TCR_ELx.HPD1 field is 1, the hierarchical control of instruction fetching is disabled for the 
translation stage controlled by that TCR_ELx, and the information in this subsection does not apply. 


The restrictions apply only to subsequent levels of lookup at the same stage of translation, and: 


° UXNTable or XNTable restricts the execute-never control: 
— When the value of the XNTable bit is 1, the UXN bit is treated as 1 in all subsequent levels of lookup, 
regardless of its actual value. 
— When the value of the UXNTable bit is 1, the XN bit is treated as 1 in all subsequent levels of lookup, 
regardless of its actual value. 


— When the value of a UXNTable or XNTable bit is 0 the bit has no effect. 


5 For a translation regime that applies to ELO and a higher Exception level, PXNTable restricts the PXN 
control: 


— When the value of PXNTable is 1, the PXN bit is treated as 1 in all subsequent levels of lookup, 
regardless of the actual value of the bit. 


— When the value of PXNTable is 0 it has no effect. 


Note 


The UXNTable, XNTable, and PXNTable settings are combined with the XN, UXN, and PXN bits in the translation 
table descriptors accessed at subsequent levels of lookup. They do not restrict or change the values entered in those 
descriptors. 








The UXNTable, XNTable, and PXNTable controls are provided only for stage 1 translations. The corresponding bits 
are RESO in the stage 2 translation table descriptors. 


The effect of UXNTable, XNTable, or PXNTable applies to later entries in the translation table walk, and so its 
effects can be held in one or more TLB entries. Therefore, a change to UXNTable, XNTable, or PXNTable requires 
coarse-grained invalidation of the TLB to ensure that the effect of the change is visible to subsequent memory 
transactions. 


Preventing execution from writable locations 


Armv8 provides control bits that, when corresponding stage 1 address translation is enabled, force writable memory 
to be treated as XN, PXN, or UXN, regardless of the value of the XN, PXN, or UXN bit: 


è For a translation regime that applies to ELO and a higher Exception value, when the value of the applicable 
SCTLR_ELx.WXN field is 1: 


—  Allregions that are writable from ELO at stage 1 of the address translation are treated as XN. 
—  Allregions that are writable from EL1 at stage 1 of the address translation are treated as PXN. 


s For a translation regime that applies to only a single Exception level, when the value of the applicable 
SCTLR_ELx.WXN field is 1, all regions that are writable at stage 1 of the address translation are treated as 
UXN. 

Note 





° The SCTLR_ELx.WXN controls are intended to be used in systems with very high security requirements. 


: Setting a WXN field to 1 changes the interpretation of the translation table entry, overriding a zero value of 
a XN, UXN, or PXN field. It does not cause any change to the translation table entry. 





For any given virtual machine, Arm expects WXN to remain static in normal operation. In particular, it is 
IMPLEMENTATION DEFINED whether TLB entries associated with a particular VMID reflect the effect of the values 
of these fields. This means that any change of these fields without a corresponding change of VMID might require 
synchronization and TLB invalidation, as described in TLB maintenance requirements and the TLB maintenance 
instructions on page D5-2638. 
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Restriction on Secure instruction fetch 


EL3 provides a Secure instruction fetch bit, SCR_EL3.SIF. When the value of this bit is 1, and execution is using 
the EL3 translation regime or the Secure EL1&0, when EL2 is disabled, translation regime, any attempt to execute 
an instruction fetched from Non-secure physical memory causes a Permission fault. TLB entries might reflect the 
value of this bit, and therefore any change to the value of this bit requires synchronization and TLB invalidation, as 
described in TLB maintenance requirements and the TLB maintenance instructions on page D5-2638. 


In an implementation that does not implement EL3, the Effective value of this bit is 0. 


D5.4.7 The Access flag 


The Access flag indicates when a page or section of memory is accessed for the first time since the Access flag in 
the corresponding translation table descriptor was set to 0. 


The AF bit in the translation table descriptors is the Access flag. 
In Armv8.0, the Access flag is managed by software as described in Software management of the Access flag. 


From Armv8.1, the Access flag can be managed by hardware as described in Hardware management of the Access 
flag on page D5-2590. 





Note 


The support for hardware management of the Access flag applies only to the VMSAv8-64 translation regimes. 





D5.4.8 The dirty state 


The dirty state indicates whether a page or section of memory is modified. 
The dirty state can be managed by hardware as described in Hardware management of dirty state on page D5-2591. 


Where the dirty state is managed in hardware, the dirty state information is encoded using the access permission bits 
AP[2] and S2AP[1] in conjunction with the DBM bit. 


D5.4.9 Block translation entry 


While the nT bit is set, if the implementation meets either level 1 or level 2 support, the PE either: 


è Generates a translation fault when using a translation table entry that has the nT bit set. Such an entry is not 
permitted to be cached within the TLB. 


7 Guarantees that using a translation table entry that has the nT bit set does not break coherency, ordering 
guarantees or uniprocessor semantics, or fail to clear the Exclusives monitors when an entry that does not 
have the nT bit set is translating the same address cached within the TLB. 


Note 


Using a translation table entry that has the nT bit set might significantly impact the performance of the translation. 








For more information, see Support levels for changing block size on page D5-2640. 


D5.4.10 Software management of the Access flag 


ARM DDI 0487E.a 
ID070919 


Armv8.0 requires that software manages the Access flag. This means an Access flag fault is generated whenever an 
attempt is made to read into the TLB a translation table descriptor entry for which the value of Access flag is 0. 


The Access flag mechanism expects that, when an Access flag fault occurs, software resets the Access flag to 1 in 
the translation table entry that caused the fault. This prevents the fault occurring the next time that memory location 
is accessed. Entries with the Access flag set to 0 are never held in the TLB, meaning software does not have to flush 
the entry from the TLB after setting the flag. 
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Note 


Ifa system incorporates components that can autonomously update translation table entries that are shared with the 
Arm PE, then the software must be aware of the possibility that such components can update the access flag 
autonomously. 





In such a system, system software should perform any changes of translation table entries with an Access flag of 0, 
other than changes to the Access flag value, by using an Load-Exclusive/Store-Exclusive loop, to allow for the 
possibility of simultaneous updates. 





D5.4.11 Hardware management of the Access flag and dirty state 


Armv8.1 introduces the following optional features that perform hardware updates to the translation tables: 
s Hardware management of the Access flag. 


à Hardware management of dirty state on page D5-2591. 


The support for hardware management of the Access flag and dirty state is identified by the feature 
ARMv8.1-TTHM. 


When the hardware management of the Access flag is enabled, in situations where, without this feature, an Access 
flag fault would be generated, the hardware instead performs an atomic read-modify-write of the appropriate 
translation table descriptor to update the Access flag from 0 to 1. 


When the hardware management of dirty state is enabled, if the Block or Page descriptor in a translation table 
indicates that a data access does not have write permission, then in situations where, without this feature, a data 
access would generate a Permission fault only because of this lack of write permission, the hardware checks the 
value of the DBM field in the Block or Page descriptor. If this field is 1, then instead of generating a Permission 
fault, the hardware performs an atomic read-modify-write of the translation table descriptor, to change the value of 
the bit that prohibits the write access. 


It is permissible, but not required, that a stage 2 permission failure on the stage 1 translation table walk is generated 
(and has priority over the stage 1 abort generated by the stage 1 translation table entry) if all of the following are true: 


- Stage 1 hardware updating of either access or dirty information is enabled. 

è A stage 1 translation table entry would result in the stage 1 translation table entry having the access or dirty 
bit updated. 

. The stage 1 translation table entry has stage 2 read permission but not stage 2 write permission. 

° The stage 1 translation entry generates an abort (which might be one of an address size fault, an alignment 


fault caused by memory type or a permission fault). 


Hardware management of the Access flag 


Hardware management of the Access flag is enabled, for the corresponding stage of address translation, by the 
following configuration fields: 


For stage 1 translations 

° TCR_EL1.HA. 

° TCR_EL2.HA. 

° TCR_EL3.HA. 
For stage 2 translations 

$ VTCR_EL2.HA. 


Implementations are not required to support the hardware management of the Access flag. If ARMv8.1-TTHM is 
not supported, then the HA bit in TCR_EL1, TCR_EL2, TCR_EL3, and VTCR_EL2 is RESO. 
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When the value of a configuration bit, HA, is 1, then when a memory access is made using a translation table Block 
or Page descriptor from the corresponding stage of address translation: 


° The PE sets the value of the Access flag to 1 in the translation table descriptor in memory, in a coherent 
manner, by an atomic read-modify-write of the translation table descriptor, if both of the following conditions 
are true: 


— The descriptor does not generate a Permission fault or an Alignment fault based on the memory type. 


— Ifthe hardware update mechanism was disabled or not implemented, the access would have generated 
an Access flag fault. 


When the PE updates the Access flag in this way no Access flag fault is generated. 
° It is CONSTRAINED UNPREDICTABLE whether the PE sets the value of the Access flag in the translation table 


entry in memory to 1, in a coherent manner, by an atomic read-modify-write of the translation table 
descriptor, if both of the following conditions are true. 


— The descriptor generates a Permission fault or an Alignment fault based on the memory type. 


— Ifthe hardware update mechanism was disabled or not implemented, the access would have generated 
an Access flag fault. 


This means that the value of the Access flag becomes UNKNOWN if the above conditions are all true. 


The Access flag might be set to 1 as a result of speculative accesses by the PE. 


Note 


A consequence of the architectural rules for translation table accesses is that the architecture requires that for any 
translation to which an architecturally executed memory access occurs, the Access flag is set to 1, except as 
indicated in Using break-before-make when updating translation table entries on page D5-2639. However, because 
the architecture permits speculative accesses, the Access flag is permitted to be set to 1, even if there is no 
architecturally executed memory accesses by the processor. 








When hardware updating of the Access flag is enabled, each stage of translation is treated independently. This 
means that a single memory access can cause a hardware update to either or both: 


° The stage 1 Access flag. 
° The stage 2 Access flag. 


Note 


Since speculative accesses are permitted to update the Access flags, it is permissible for: 





š The stage 1 Access flag for a translation of a virtual address to be updated in situations where the stage 2 
translation ofthe associated intermediate physical address that is returned by the stage 1 ofthe virtual address 
does not permit access. 


° The stage 2 Access flag for a translation of an intermediate physical address to be updated in situations where 
the stage 1 translation of the associated virtual address which returned that intermediate physical address does 
not permit access. 





An address translation instruction for an address is permitted, but not required, to set the Access flag in the 
translation table entries for that address. Correspondingly, it is IMPLEMENTATION DEFINED whether such an 
instruction can generate a Data Abort if the Access flag for a stage of translation is updated to be set. 


When hardware updates of the Access flag are enabled for a stage of translation an address translation instruction 
that uses that stage of translation will not report that the address will give rise to an Access flag fault in the PAR, 
and the result in PAR will be as if the value of the Access flag in the translation table entries for that address was 1. 


Hardware management of dirty state 


The hardware management of dirty state mechanism can only be enabled if hardware management of the Access 
flag is enabled. For information on the hardware management of the Access flag, see Hardware management of the 
Access flag on page D5-2590. 
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D5-2592 





Note 
The hardware management of dirty state mechanism uses: 
$ In a stage 1 translation table access, the AP[2] bit in conjunction with the DBM bit in the translation table 
descriptors. 
$ In a stage 2 translation table access, the S2AP[1] bit in conjunction with the DBM bit in the translation table 
descriptors. 


Hardware management of dirty state is enabled, for the corresponding stage of address translation, by the following 
configuration fields: 


For stage 1 translations 

° TCR_EL1.HD. 

° TCR_EL2.HD. 

° TCR_EL3.HD. 
For stage 2 translations 

$ VTCR_EL2.HD. 


Implementations are not required to support the dirty state mechanism. If this mechanism is not supported, then the 
HD bit in TCR_EL1, TCR_EL2, TCR_EL3, and VTCR_EL2 is RESO. 


When hardware management of dirty state is enabled, and a memory access is made using a translation table Block 
or Page descriptor: 


° For a stage 1 address translation, if the value of the TCR_ELx.HD field corresponding to the address 
translation is 1, then the PE sets AP[2] to 0 in the translation descriptor in memory, in a coherent manner by 
an atomic read-modify-write of the translation table descriptor, if both of the following conditions are true: 


— The value of the DBM field in the descriptor is 1. 


— Ifthe hardware update mechanism was disabled or not implemented, the access using this descriptor 
would have generated a Permission fault only because the value of the AP[2] field is 1, indicating that 
the access does not have write permission. 


When the PE updates AP[2] in this way no Permission fault is generated because of the value of the AP[2] 
field. 


$ For a stage 2 address translation, if the value of the VTCR_EL2.HD field is 1, then the PE sets S2AP[1] to 1 
in the translation descriptor in memory, in a coherent manner by an atomic read-modify-write of the 
translation table descriptor, if both of the following conditions are true: 


— The value of the DBM field in the descriptor is 1. 


— Ifthe hardware update mechanism was disabled or not implemented, the access using this descriptor 
would have generated a Permission fault only because the value of the S2AP[1] field is 0, indicating 
that the access does not have write permission. 


When the PE updates S2AP[1] in this way no Permission fault is generated because of the value of the 
S2AP[1] field. 





Note 


The PE that does the atomic update of the translation table descriptor is expected to ensure that any cached copy of 
that translation table descriptor for that PE is similarly updated, or removed from the TLB, so that multiple writes 
from the same thread on the same PE do not lead to multiple updates to the table. This is only a performance 
expectation. 





If, for a write access, the PE finds that a cached copy of the descriptor in a TLB had the DBM bit set to 1 and the 

AP[2] or S2AP[1] bit set to the value that forbids writes, then the PE must check that the cached copy is not stale 
with regard to the descriptor entry in memory, and if necessary perform an atomic read-modify-write update of the 
descriptor in memory. This applies if the cached copy of the descriptor in a TLB is either: 

è A stage 1 descriptor in which DBM has the value 1 and AP[2] has the value 1. 


a A stage 2 descriptor in which DBM has the value | and S2AP[1] has the value 0. 
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Note 


Arm expects that, in many implementations, any atomic update ofa translation table entry required by the dirty state 
management mechanism will cause a translation table walk. 





For the hardware updating of the AP[2] and S2AP[1] bits, each translation stage is treated independently. This 
means a single memory access can update either or both of: 

è The stage 1 AP[2] bit. 

° The stage 2 S2AP[1] bit. 


The architecture does not permit updates to AP[2] and S2AP[1] by the hardware management of the dirty state 
mechanism to occur as a result of speculative accesses by the PE that are not performed architecturally, except that 
for translation table entries for which the value of DBM is 1: 


a A non-speculative access that passes stage 1 permissions check can update AP[2], if writes to that stage 
translation table are permitted and subsequently encounter a stage 2 fault. A non-speculative access that 
passes its stage 1 permission check but subsequently encounters a stage 2 fault is also permitted (but not 
required) to generate a stage 2 permission fault on the stage 1 translation table walk if all of the following is 
true: 

— The stage 1 hardware updating of the access flag or dirty state is enabled. 


— The stage 2 translation table entry translating the last level stage 1 translation entry has S2AP[1] ==0 
and either DBM ==0 or hardware updating of the dirty state information is not enabled. 


Note 


These are cases where there is no stage 2 write permission for the hardware updating of the last level stage 1 
translation table entry. 





° A non-speculative access that generates an Alignment fault only because the memory type accessed is Device 
memory by a stage of translation can update AP[2] or S2AP[1] of that stage of translation if the memory 
access would have updated that translation table bit had the memory access not generated the Alignment 
fault. 


$ If the stage 2 hardware management of dirty state mechanism is enabled, the S2AP[1] field of a stage 2 
translation table entry that is translating a stage 1 translation table without generating a stage 2 MMU fault: 


— Is updated from 0 to 1 as a result of a speculative update of the Access flag in an entry of that stage 1 
translation table. 


— Is permitted to be updated speculatively from 0 to 1 as a result of performing a translation table walk 
using that stage1 translation table, even if the entry in the stage 1 translation table is not updated. The 
speculative update is permitted to generate a synchronous External abort or an IMPLEMENTATION 
DEFINED abort caused by the memory type not supporting an atomic read-modify-write. 


Note 


This applies even if the stage 1 translation table contains entries that are not the final level entries and 
therefore would not be updated. This relaxation avoids the hardware complexity of having to detect 
whether the stage | entry is a final level entry before deciding to set the stage 2 dirty state information. 








° If an instruction that generates more than one single-copy atomic memory access has a fault on some, but not 
all, of those memory accesses, then AP[2] and S2AP[1] bits associated with accesses from that instruction, 
which do not fault are permitted to be updated if the associated hardware update of dirty state mechanism is 
enabled. 


° If the hardware update of dirty state mechanism is enabled and a write to memory is prevented by a 
Synchronous Tag Check Fail, the AP[2] and S2AP[1] bits associated with that write are permitted to be 
updated. For more information see Chapter D6 Armv8.5 Memory Tagging Extension. 


à When enabled, the Statistical Profiling Extension can update the AP[2] or S2AP[1] for any Page or Block 
translation table entry in the Profiling Buffer. See Hardware management of dirty state and the Access flag 
by the Statistical Profiling Extension on page D9-2756. 
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For a Block or Page translation table descriptor for which the AF bit is 0, the DBM bit is 1, and either the value of 
the stage 1 AP[2] bit is 1 or the value of the stage 2 S2AP[1] bit is 0, both AF can be set to 1, and either AP[2] set 
to 0 or S2AP[1] set to 1, in a single atomic read-modify-write operation, as a result of an attempted write to a 
memory location that uses the translation table entry. 


Implications of enabling the dirty state management mechanism 


This subsection describes behaviors that result from having the dirty state management mechanism enabled for a 
particular stage of address translation. 


For the final level of lookup in a stage 1 translation: 


In the EL3 translation regime 
The OA of the lookup is treated as writable if all of the following conditions apply: 


è In the descriptor for the final level of lookup, the value of DBM is 1 and the value of 
AP[2] is 1. 


° In the descriptor for every higher level of lookup, the value of APTable[1] is 0. 
In this case, if the value of SCTLR_EL3.WXN is 1 then the OA is treated as Execute-never. 


In the EL2 or EL2&0 translation regime, when the value of HCR_EL2.{E2H, TGE} is not {1, 1} 


Note 


When the value of HCR_EL2.E2H is 1, TCR_EL2 controls the EL2&0 translation regime, and 
otherwise it controls the EL2 translation regime. 








The OA of the lookup is treated as writable if all of the following conditions apply: 

è In the descriptor for the final level of lookup, the value of DBM is 1 and the value of 
AP[2] is 1. 

e In the descriptor for every higher level of lookup the value of APTable[1] is 0. 

In this the value of SCTLR_EL2.WXN is 1 then the OA is treated as Execute-never. 


In addition, if the value of HCR_EL2.E2H is 1, the OA is treated as Privileged execute-never if all 
of the following conditions apply: 


$ In the descriptor for the final level of lookup, the value of DBM is 1 and the value of AP[2:1] 
is 0b11. 


è In the descriptor for every higher level of lookup, the value of APTable[1:0] is 0b00. 





Note 


When the value of HCR_EL2.{E2H, TGE} is not {1, 1}, memory accesses from ELO do not use the 
EL2, or EL2&0, translation regime. 





In the EL2&0 translation regime, when the value of HCR_EL2.{E2H, TGE} is {1, 1} 
The OA of the lookup is treated as writable at EL2 and ELO, Privileged execute-never, if all of the 
following conditions apply: 
s In the descriptor for the final level of lookup, the value of DBM is 1 and the value of 
AP[2:1] is 0b11. 
š In the descriptor for every higher level of lookup the value of APTable[1:0] is 0b00. 


In this case, if the value of SCTLR_EL2.WXN is 1 then the OA is also treated as Unprivileged 
execute-never. 


The OA of the lookup is treated as writable at EL2 but not writable at ELO if either: 


° Both: 
— Inthe descriptor for the final level of lookup, the value of DBM is 1 and the value of 
AP[2:1] is 0b10. 
— Inthe descriptor for every higher level of lookup the value of APTable[1:0] is @bdx. 
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In this case, if the value of SCTLR_EL2.WXN is 1 then the OA is treated as Privileged 
execute-never. 


. Both: 
— Inthe descriptor for the final level of lookup, the value of DBM is 1 and the value of 
AP[2:1] is 0b11. 
— Inatleast one of the descriptors for higher levels of lookup the value of APTable[1:0] 
is 0b01. 


In this case, if the value of SCTLR_EL2.WXN is 1 then the OA is treated as Privileged 
execute-never. 


In the EL1&0 translation regime 
The OA of the lookup is treated as writable at EL1 and ELO, Privileged execute-never, if all of the 
following conditions apply: 
. In the descriptor for the final level of lookup, the value of DBM is 1 and the value of 
AP[2:1] is 0b11. 
è In the descriptor for every higher level of lookup the value of APTable[1:0] is 0b00. 


In this case, if the value of SCTLR_EL1.WXN is 1 then the OA is treated as Unprivileged 
execute-never. 


The OA of the lookup is treated as writable at EL1 but not writable at ELO if either: 
. Both: 
— Inthe descriptor for the final level of lookup, the value of DBM is 1 and the value of 
AP[2:1] is 0b11. 
—  Inat least one of the descriptors for higher levels of lookup the value of APTable[ 1:0] 
is 0b01. 
In this case, if the value of SCTLR_EL1.WXN is 1 then the OA is treated as Privileged 
execute-never. 
$ Both: 
— Inthe descriptor for the final level of lookup, the value of DBM is 1 and the value of 
AP[2:1] is 0b10. 
— Inthe descriptor for every higher level of lookup the value of APTable[1:0] is @b0x. 


In this case, if the value of SCTLR_EL1.WXN is 1 then the OA is treated as Privileged 
execute-never. 


The OA of a translation table entry where the DBM bit is 1, and the stage 1 AP[2] bit is 1 or the stage 2 S2AP[1] 
bit is 0, is treated as writable: 


° For data cache invalidation instructions that require write permission, that is for the DC IVAC instruction. 


° For address translation instructions that require write permission, that is for the AT S12E0W, AT S12E1W, 
AT S1E0W, AT S1E1W, AT S1E2W, and AT S1E3W instructions. 


Cache invalidation and address translation instructions never cause the stage 1 AP[2] bit or the stage 2 S2AP[1] bit 
in the translation table entry to be updated. 


For a Store-Exclusive instruction to a memory location for which the DBM bit is 1 and the stage 1 AP[2] bit is 1, if 
the Store-Exclusive fails because the Exclusives monitor is not in the exclusive state, it is IMPLEMENTATION 
DEFINED whether the AP[2] bit in the translation table is updated. 


For a Store-Exclusive instruction to a memory location for which the DBM bit is 1, and the stage 2 S2AP[1] bit is 
0, if the Store-Exclusive fails because the Exclusives monitor is not in the Exclusive access state, it is 
IMPLEMENTATION DEFINED whether the S2AP[1] bit in the translation table is updated. 


For a store to a memory location for which the DBM bit is 1, and the stage 1 AP[2] bit is 1, it is IMPLEMENTATION 
DEFINED whether the AP[2] bit in the translation table is updated: 


à If the memory location generates a synchronous External abort on a write for a store to a memory location. 
` If the memory location generates a watchpoint on a write. 
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For a store to a memory location for which the DBM bit is 1, and the stage 2 S2AP[1] bit is 0, it is IMPLEMENTATION 
DEFINED whether the S2AP[1] bit in the translation table is updated: 
° If the memory location generates a synchronous External abort on a write for a store to a memory location. 


° If the memory location generates a watchpoint on a write. 


In the event of a PE setting the stage 1 AP[2] bit to 0, it is not required that all associated entries are removed from 
the TLBs of other PEs in the system. 


In the event of a PE setting the stage 2 S2AP[1] bit to 1, it is not required that all associated entries are removed 
from the TLBs of other PEs in the system. 


For the stage 2 translation tables, it is CONSTRAINED UNPREDICTABLE whether the stage 2 S2AP[1] entry is updated 
in response to a stage | translation table walk where the stage 1 translation system is configured to perform hardware 
updates to the Access flag or stage 1 AP[2] bit, but the values of the Access flag and AP[2] bit are such that a 
hardware update to the stage 1 translation table entry being accessed is not required. 


In the event of a PE encountering a situation for a data write for which the DBM bit is 1 and the stage 1 AP[2] bit 
is 1 ina TLB, it is required that the hardware checks that the cached copy is not stale with regards to the translation 
table entry in memory and performs the atomic read-modify-write update with respect to table entry in memory. 


In the event of a PE encountering a situation for a data write for which the DBM bit is 1 and stage 2 S2AP[1] bit is 
0 ina TLB, it is required that the hardware checks that the cached copy is not stale with regards to the translation 
table entry in memory and performs the atomic read-modify-write update with respect to table entry in memory. 


For a CAS or CASP instruction to a memory location for which the DBM bit is 1, and the stage 1 AP[2] bit is 1, if the 
compare fails, and the location is not updated, it is CONSTRAINED UNPREDICTABLE whether the AP[2] bit in the 
translation table is updated. 


For a CAS or CASP instruction to a memory location for which the DBM bit is 1, and the stage 2 S2AP[1] bit is 0, if 
the compare fails, and the location is not updated, it is CONSTRAINED UNPREDICTABLE whether the S2AP[1] bit in 
the translation table is updated. 


For an atomic instruction to a memory location for which the DBM bit is 1, and the stage 2 S2AP[0:1] is 00, if the 
instruction generates a stage 2 Permission fault as a result of not having read permission, it is CONSTRAINED 
UNPREDICTABLE whether the S2AP[1] bit in the translation table is updated. 


Ordering of hardware updates to the translation tables 


A hardware update to the translation table that is caused by a load or a store, including an atomic instruction, is 
guaranteed to be observed, to the extent required by the shareability attributes: 


° Before a load or store, including an atomic instruction, to an arbitrary address, other than the address of the 
translation table entry, that appears in program order after the load or store, including an atomic instruction, 
causing the update to the translation table entry only if a DSB with the appropriate shareability attributes, 
where the DSB applies to both loads and stores, is executed between the load or store, including an atomic 
instruction, that caused the update to the translation table and the subsequent load or store. 


° Before a load to the translation table entry that is being updated that appears in program order after the load 
or store, including an atomic instruction, causing the update to the translation table entry only if a DSB with 
the appropriate shareability attributes, where the DSB applies to both loads and stores, is executed between 
the load or store, including an atomic instruction, that caused the update to the translation table and the 
subsequent load. 


° Before a store or atomic access to the translation table entry that is being updated that appears in program 
order after the load or store, including an atomic instruction, causing the update to the translation table entry. 


° Before a cache maintenance instruction to an arbitrary address appearing in program order after the load or 
store, including an atomic instruction, causing the update to the translation table entry only if a DSB with the 
appropriate shareability attributes, where the DSB applies to both loads and stores, is executed between the 
load or store, including an atomic instructing that caused the update to the translation table entry and the 
subsequent cache maintenance instruction. 


An update to the translation table that is caused by a load is not ordered with respect to the load itself. 
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An update to the translation table that is caused by a store or an atomic access is observed by all observers, to the 
extent required by the shareability attributes, before the store itself in the case that the store is to the same location 
as the translation table update. 


An update to the translation table that is caused by a store or an atomic access is not ordered with respect to the store 
itself in the case that the store is not the same location as the translation table update. 


D5.4.13 Restriction on memory types for hardware updates on translation tables 


Translation tables can be placed in Normal memory with any cacheability, but the hardware updates to the 
translation tables require an atomic update of memory. The properties of the atomicity can be met only by 
functionality outside the PE. Some system implementations might not implement this functionality for all regions 
of memory. This can apply to: 


° Any type of memory in the system that does not support hardware cache coherency. 


è Non-cacheable memory, or memory that is treated as Non-cacheable, in an implementation that does not 
support hardware cache coherency. 


An implementation can choose which memory type is treated as Non-cacheable. 


The memory types for which it is architecturally guaranteed that the hardware updates of the translation tables will 
be atomic are: 


° Inner Shareable, Inner Write-Back, Outer Write-Back Normal memory with Read allocation hints and Write 
allocation hints and not transient. 


. Outer Shareable, Inner Write-Back, Outer Write-Back Normal memory with Read allocation hints and Write 
allocation hints and not transient. 


If the hardware updates of the translation tables are not atomic in regard to other agents that access memory, then 
performing a hardware update to such a location can have one or more of the following effects: 


$ The hardware update generates a synchronous External abort, which is presented as an External abort on a 
translation table walk. 


s The instruction generates a SError interrupt. 


s The hardware update generates an Unsupported atomic hardware update MMU fault reported using the Fault 
status code of: 


— ESR ELx.DFSC = 110001 for Data Aborts. 


— ESR ELx.IFSC = 110001 for Instruction Aborts. 


For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, if atomic hardware 
update is not supported because of the memory type that is defined in the first stage of translation, or 
the second stage of translation is not enabled, then this exception is a first stage abort and is taken to 
EL1. Otherwise, the exception is a second stage abort and is taken to EL2. 


The priority of this MMU fault for a stage of the translation is immediately before or immediately after the 
priority of a Permission fault generated by the same stage of translation as the stage of this MMU fault, as 
determined by an IMPLEMENTATION DEFINED choice. 


. The hardware updates are performed, but there is no guarantee that the memory accesses were performed 
atomically in regard to other agents that access memory. In this case, the instruction might also generate a 
SError interrupt. 


D5.4.14 Use of the Contiguous bit with hardware updates of the translation table entries 
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Hardware updates of the Access flag, and the AP[2] or S2AP[1] bit, only apply to a single translation table entry. 
An update to one of these bits in a translation table entry that also has the Contiguous bit set to 1 can give rise to 
translation table entries that have different Access flag, or different AP[2] or S2AP[1] bits, within the members of 
a group of contiguous translation table entries. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D5-2597 
Non-Confidential 


The AArch64 Virtual Memory System Architecture 
D5.4 Memory access control 


This is acceptable under the architecture when using hardware updates of the translation table entries. In addition, 
an access or a write to a location translated by an entry that has the Contiguous bit set might not result in a hardware 
update of the Access flag or the AP[2] or S2AP[1] bit, if at least one entry in the set of contiguous translation table 
entries has the Access flag set to 1, or the AP[2] or S2AP[1] bit indicating that the entry is dirty. 


Note 


° The provision of the Contiguous bit permits, but does not require, the hardware to hold a single entry in a 
TLB for the set of translation table entries in the group, and to have updated only one or more of the Access 
flags and the AP[2] bit or S2AP[1] bit for the single translation table entry that gave rise to the TLB entry. 





° A consequence of this is that software must combine the Access flag values, and AP[2] or S2AP[1] values, 
across all translation table entries in a contiguous group to determine whether any of the entries have been 
accessed or written to. 





For more information on the Contiguous bit, see The Contiguous bit on page D5-2604. 
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D5.5 Memory region attributes 


The memory region attribute fields control the memory type, accesses to the caches, and whether the memory region 
is Shareable and therefore is coherent. This section also describes some additional translation table fields, that this 
manual groups with the memory region attributes. 


In the EL1&0 translation regime, each enabled stage of address translation assigns memory region attributes, as 
described in this section. When both stages of translation are enabled, Combining the stage 1 and stage 2 attributes, 
EL1&0 translation regime on page D5-2605 describes how the assignments from the two stages are combined. 





Note 
In a virtualization implementation, a hypervisor, executing at EL2, might usefully: 
° Reduce the permitted cacheability of a region. 
° Increase the required shareability of a region. 


The combining of attributes from stage 1 and stage 2 translations supports both of these options. 





The following sections describe these attributes: 

. The stage 1 memory region attributes. 

e The stage 2 memory region attributes, EL1&0 translation regime on page D5-2601. 

$ Other fields in the VMSAv8-64 translation table format descriptors on page D5-2603. 

7 Combining the stage 1 and stage 2 attributes, ELI &0 translation regime on page D5-2605. 


Note 


s This section describes the memory region attributes for each of the translation regimes, and for each stage of 
translation in the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime. 





° A translation applies to memory accesses from either: 
— Only a single Exception level, for example the EL3 translation regime. 
—  ELO and one higher Exception level, for example the EL1&0 translation regime. 


s In general, attribute assignment is simpler in a regime that applies to only a single Exception level, and in 
these regimes behavior is consistent with fields in the translation tables being treated as follows: 


— AP{[1] is RES1, meaning the PE ignores the value of the bit and behaves as if it is 1. 

—  APTable[0] is RESO, meaning the PE ignores the value of the bit and behaves as if it is 0. 

— The PXN field is RESO, meaning the PE ignores the value of the bit and behaves as if it is 0. 

— The PXNTable bit is RESO, meaning the PE ignores the value of the bit and behaves as if it is 0. 





D5.5.1 The stage 1 memory region attributes 
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The description of the memory region attributes in a translation descriptor divides into: 


Memory type and Cacheability 


These are described indirectly, by registers referenced by bits in the table descriptor. This is 
described as remapping the memory type and attribute description. Stage 1 memory region type and 
Cacheability attributes describes this encoding. 


Shareability The SH[1:0] field in the translation table descriptor encodes shareability information. Stage 1 
Shareability attribute, for Normal memory on page D5-2600 describes this encoding. 


Stage 1 memory region type and Cacheability attributes 


In the VMSAv8-64 translation table format, the AttrIndx[2:0] field in a block or page translation table descriptor 
for a stage | translation indicates the 8-bit field in the MAIR_ELx that specifies the attributes for the corresponding 
memory region. The required field is Attrn, where n = AttrIndx[2:0]. For more information about AttrIndx[2:0] see 
Attribute fields in stage 1 VUSAv8-64 Block and Page descriptors on page D5-2572. 
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Note 


Each MAIR _ELx is a 64-bit register that is architecturally mapped to a pair of AArch32 registers. See the 
MAIR _ELx register descriptions for more information. 





Each MAIR _ELx.Attrn field defines, for the corresponding memory region: 
7 The memory type, Device or Normal. 


. For Device memory, the Device memory type, one of: 
—  Device-nGnRnE. 
—  Device-nGnRE. 
—  Device-nGRE. 
—  Device-GRE. 


s For Normal memory: 
— The inner and outer cacheability, Non-cacheable, Write-Through, or Write-Back. 


— For Write-Through Cacheable and Write-Back Cacheable regions, the Read-Allocate and 
Write-Allocate policy hints, each of which is Allocate or No Allocate, and the Transient allocation 
hints, if supported. 


For more information about the memory type and attributes, see Memory types and attributes on page B2-143 and 
Cacheability, cache allocation hints, and cache transient hints on page D4-2474. 


Stage 1 Shareability attribute, for Normal memory 


When using the VMSAv8-64 translation table format, the SH[1:0] field in a block or page translation table 
descriptor specifies the Shareability attributes of the corresponding memory region. Table D5-35 shows the 
encoding of this field. 


Table D5-35 SH[1:0] field encoding for Normal memory, VMSAv8-64 translation table format 





SH[1:0] Normal memory 














00 Non-shareable 

01 Reserved, CONSTRAINED UNPREDICTABLE? 
10 Outer Shareable 

11 Inner Shareable 





a. See Reserved values in System and 
memory-mapped registers and translation table 
entries on page K1-7644 for the permitted 
CONSTRAINED UNPREDICTABLE behavior. 


Note 


The shareability field is only relevant if the memory is a Normal Cacheable memory type. All Device and Normal 
Non-cacheable memory regions are always treated as Outer Shareable, regardless of the translation table 
shareability attributes 








See Combining the stage 1 and stage 2 shareability attributes for Normal memory on page D5-2608 for constraints 
on the Shareability attributes of a Normal memory region that is Inner Non-cacheable, Outer Non-cacheable. 
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D5.5.2 The stage 2 memory region attributes, EL1&0 translation regime 


In the stage 2 translation table descriptors for memory regions and pages, the MemAttr[3:0] and SH[1:0] fields 
describe the stage 2 memory region attributes: 


Stage 2 memory region type and Cacheability attributes describes how the MemAttr[3:0] field defines these 
attributes. 


The SH[1:0] field in the translation table descriptor encodes shareability information. Stage 2 Shareability 
attribute, for Normal memory on page D5-2602 describes this encoding. 


The following sections describe how, when both stages of address translation are enabled, the memory region 
attributes assigned at stage 2 of the translation are combined with those assigned at stage 1: 


Combining the stage 1 and stage 2 memory type attributes on page D5-2606. 
Combining the stage 1 and stage 2 cacheability attributes for Normal memory on page D5-2607. 
Combining the stage I and stage 2 shareability attributes for Normal memory on page D5-2608. 


D5.5.3 Stage 2 memory region type and Cacheability attributes 
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Table D5-36 shows how MemAttr[3:2] gives a top-level definition of the memory type, and of the Outer 
cacheability of a Normal memory region. 


Table D5-36 VMSAv8-64 MemAttr[3:2] encoding, stage 2 translation 

















MemAttr[3:2] Memory type Outer cacheability 

00 Device. MemAttr[1:0] encodes the Device memory type. Not applicable 

01 Normal. MemAttr[1:0] encodes the Inner Cacheability. Outer Non-cacheable 

10 Outer Write-Through Cacheable 
11 Outer Write-Back Cacheable 





The encoding of MemAttr[1:0] depends on the Memory type indicated by MemAttr[3:2]: 


When MemAttr[3:2]==0b00, indicating Device memory, Table D5-37 shows the encoding of MemAttr[1:0]. 


Table D5-37 MemAttr[1:0] encoding for Device memory 





MemAttr[1:0] Meaning when MemAttr[3:2] == 0b00 














00 Region is Device-nGnRnE memory 
01 Region is Device-nGnRE memory 
10 Region is Device-nGRE memory 
11 Region is Device-GRE memory 





When MemAttr[3:2]!=0b00, indicating Normal memory, Table D5-38 shows the encoding of MemAttr[1:0]. 


Table D5-38 MemAttr[1:0] encoding for Normal memory 





MemAttr[1:0] Meaning when MemAttr[3:2] != 0b00 





00 Reserved, CONSTRAINED UNPREDICTABLE? 
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Table D5-38 MemAttr[1:0] encoding for Normal memory (continued) 





MemAttr[1:0] Meaning when MemAttr[3:2] != 0b00 








01 Inner Non-cacheable 
10 Inner Write-Through Cacheable 
11 Inner Write-Back Cacheable 





a. See Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7644 for 
the permitted CONSTRAINED UNPREDICTABLE behavior. 





Note 
. The stage 2 translation does not assign any allocation hints. 
: The following stage 2 translation table attribute settings leave the stage 1 settings unchanged: 


—  MemAttr[3:2] == 0b11, Normal memory, Outer Write-Back Cacheable. 
—  MemAttr[1:0] == 0b11, Inner Write-Back Cacheable. 





D5.5.4 Stage 2 Shareability attribute, for Normal memory 


When using the VMSAv8-64 translation table format, the SH[1:0] field in a block or page translation table 
descriptor specifies the Shareability attributes of the corresponding memory region. Table D5-39 shows the 
encoding of this field. 


Table D5-39 SH[1:0] field encoding for Normal memory, VMSAv8-64 translation table format 





SH[1:0] Normal memory 














00 Non-shareable 

01 Reserved, CONSTRAINED UNPREDICTABLE? 
10 Outer Shareable 

11 Inner Shareable 


a. See Reserved values in System and 
memory-mapped registers and translation table 
entries on page K1-7644 for the permitted 
CONSTRAINED UNPREDICTABLE behavior. 


Note 


° This encoding is the same as the shareability encoding described in Stage 1 Shareability attribute, for Normal 
memory on page D5-2600. 





$ The shareability field is only relevant if the memory is a Normal Cacheable memory type. All Device and 
Normal Non-cacheable memory regions are always treated as Outer Shareable, regardless of the translation 
table shareability attributes. 





See Combining the stage 1 and stage 2 shareability attributes for Normal memory on page D5-2608 for constraints 
on the Shareability attributes of a Normal memory region that is Inner Non-cacheable, Outer Non-cacheable. 
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D5.5.5 Stage 2 memory region type and Cacheability attributes when Armv8.4-S2FWB is 
implemented 


When ARMv8.4-S2FWB is implemented and HCR_EL2.FWB is set to 1, then the MemAttr[5:0] is divided as 


follows: 
7 Bit[5] is RESO. 
$ Bit[4] determines the interpretation of bits [3:2]. 


When bit[4] is one the effects of bits [3:2] are defined in Table D5-40. 


Table D5-40 Effect of bit[4] == 1 on Cacheability and Memory Type 





Stage 1 Memory Type and 
Inner or Outer Cacheability 


Stage 2 Block/ Descriptor Resultant Memory type and Cacheability 




































































attribute Bits[3:2] attribute 

Normal Write-Back 0b11 Normal Write-Back 
Normal Write-Through Normal Write-Though 
Normal Non-cacheable Normal Non-cacheable 
Device<attr> Device<attr> 

Normal Write-Back 0b10 Normal Write-Back 
Normal Write-Through 

Normal Non-cacheable 

Device<attr> 

Normal Write-Back 0b01 Normal Non-cacheable 
Normal Write-Through 

Normal Non-cacheable 

Device<attr> Device<attr> 

- 0b00 RESERVED 





When HCR_EL2.FWB is set to 1 and Bit[4] is 0, then the stage 2 memory type is Device. Bits[3:2] of the Stage 2 
page or block descriptor define the Device memory attributes. The Device Memory attributes are defined in 


Table D5-41. 


Table D5-41 Device Memory Attributes when Bit[4] == 





Stage 2 page/block descriptor bits [3:2] Device Memory Attribute 














0b00 Device-nGnRnE 
0b01 Device-nGnRE 
0b10 Device-nGRE 
0b11 Device-GRE 





D5.5.6 Other fields in the VMSAv8-64 translation table format descriptors 


The following subsections describe the other fields in the translation table block and page descriptors: 


7 The Contiguous bit on page D5-2604. 
à IGNORED fields on page D5-2605. 
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è Field reserved for software use on page D5-2605. 


The Contiguous bit 


When the value of the Contiguous bit is 1, it indicates that the entry is one of a number of adjacent translation table 
entries that point to a contiguous output address range. The required number of adjacent entries depends on the 
current translation granule size, as follows: 


4KB granule 16 adjacent translation table entries point to a contiguous output address range that has the same 
permissions and attributes. These 16 entries must be aligned in the translation table. If accessing a 
full-sized 4KB translation table, this means that the top 5 of the 9 input addresses bits that index the 
descriptor positions in the translation table are the same for all of the entries. 


The contiguous output address range must be aligned to size of 16 translation table entries at the 
same translation table level. 


16KB granule This bit indicates that adjacent translation table entries point to contiguous output address range that 
has the same permissions and attributes. With the 16KB granule, the number of contiguous entries 
indicated by setting this bit to 1 depends on the lookup level of the translation table: 


Level 2 lookup The bit indicates 32 contiguous entries, giving a 1GB block of memory. 
These entries must be aligned in the translation table. When accessing a 
full-sized 16KB translation table, this means the top 6 of the 11 input 
addresses bits that index the descriptor positions in the translation table are 
the same for all of the entries. 


The contiguous output address range must be aligned to size of 32 
translation table entries at the same translation table level. 


Level 3 lookup The bit indicates 128 contiguous entries, giving a 2MB block of memory. 
These entries must be aligned in the translation table. When accessing a 
full-sized 16KB translation table, this means the top 4 of the 11 input 
addresses bits that index the descriptor positions in the translation table are 
the same for all of the entries. 


The contiguous output address range must be aligned to size of 128 
translation table entries at the same translation table level. 


64KB granule 32 adjacent translation table entries point to a contiguous output address range that has the same 
permissions and attributes. These 32 entries must be aligned in the translation table. If accessing a 
full-sized 64KB translation table, this means that the top 8 of the 13 input addresses bits that index 
the descriptor positions in the translation table are the same for all of the entries. 


The contiguous output address range must be aligned to size of 32 translation table entries at the 
same translation table level. 


Setting this bit to 1 means that the TLB can cache a single entry to cover the contiguous translation table entries. 


This section defines the requirements for programming the Contiguous bit. Possible errors in programming the 
translation table registers on page D5-2553 describes the effect of not meeting these requirements. 


The architecture does not require a PE to cache TLB entries in this way. To avoid TLB coherency issues, any TLB 
maintenance by address must not assume any optimization of the TLB tables that might result from use of the 
Contiguous bit. 


TLB maintenance must be performed based on the size of the underlying translation table entries, to avoid TLB 
coherency issues. 


Use of the Contiguous bit with hardware updates of the translation table entries on page D5-2597 describes the 
effect of hardware management of the Access flag and dirty state on the Contiguous bit. 


Note 


When ARMv8.2-LVA is implemented, the level 1 block size for the 64KB granule does not support the Contiguous 
bit, and that field is RESO. 
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IGNORED fields 


In the VMSAv8-64 translation table descriptors, the following fields are identified as IGNORED, meaning the 
architecture guarantees that a PE makes no use of these fields: 


$ In the stage 1 and stage 2 Table descriptors, bits[58:51] and bits[11:2]. 
7 In the stage 1 and stage 2 Block and Page descriptors, bit[63] and bits[58:55]. 


: In the stage 1 and stage 2 Block and Page descriptors in an implementation that does not include 
ARMv8.2-TTPBHA, bits[62:59]. 


Of these fields: 


° In the stage 1 and stage 2 block and page descriptors, bits[58:55] are reserved for software use, see Field 
reserved for software use. 

a In the stage 2 block and page descriptors: 
— Bit[63] is reserved for use by a System MMU. 
—  Inan implementation that does not include ARMv8.2-TTPBHA, bits[62:59] are reserved for use by a 


System MMU. 
Field reserved for software use 


The architecture reserves a 4-bit IGNORED field in the Block and translation table descriptors, bits[58:55], for 
software use. The definition of IGNORED means the architecture guarantees that hardware makes no use of this field. 


Note 
This means there is no need to invalidate the TLB if these bits are changed. 








D5.5.7 Combining the stage 1 and stage 2 attributes, EL1&0 translation regime 
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When EL2 is enabled, the Secure or Non-secure EL1&0 translation regime comprises two stage of translation, each 
of which can be enabled independently: 


: Stage 1 translation is configured and controlled from EL1. When enabled, stage 1 translation can define 
access permissions independently for access from ELO and for accesses from EL1. 


Stage 1 MMU faults are taken to EL1. 


7 When stage 2 translation is enabled, the stage 2 access controls defined at EL2: 
— Affect the stage 1 access permissions settings. 
— Take no account of whether the accesses are at EL1 or ELO. 
— Permit software executing at EL2 to assign a write-only attribute to a memory region. 


Stage 2 MMU faults are taken to EL2. 


Note 


In an implementation of virtualization, the attributes defined in the stage 2 translation tables mean a hypervisor can 
define additional access restrictions to those defined by a Guest OS in the stage 1 translation tables. For a particular 
access, the actual access permission is the more restrictive of the permissions defined by: 





- The Guest OS, in the stage 1 translation tables. 
: The hypervisor, in the stage 2 translation tables. 


The effects of the combination of attributes defined by the Hypervisor are functionally transparent to the Guest OS. 





When HCR_EL2.FWB is set to 1: 


è If the stage 1 page or block descriptor specifies a cacheable memory type, then the specified cacheable 
memory hint is applied to the final cache allocation hint if the final memory type is cacheable. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D5-2605 
Non-Confidential 


The AArch64 Virtual Memory System Architecture 
D5.5 Memory region attributes 


s If the stage 1 page or block descriptor does not specify a cacheable memory type, then the final cache 
allocation hint is Read Allocate, Write Allocate if the final memory type is cacheable. 


The effects of HCR_EL2.FWB apply to both Secure and Non-secure stage 2 translation regime. 


When ARMv8.4-S2F WB is implemented, the architecture requires that CLIDR_EL1.{LOUU, LOIUS} are zero so 
that no levels of data cache need to be cleaned in order to manage coherency with instruction fetches. 


When HCR_EL2.FWB is set to 1, and the stage 2 page or block descriptor [4:2] is set to 0b110, the resultant memory 
type is Normal WriteBack cacheable regardless of the value of the stage 1 memory type. 

Combining the stage 1 and stage 2 data access permissions 

When both stages of translation are enabled, the following access permissions are combined: 


s The stage 1 permissions described in The AP/2:1] data access permissions, for stage 1 translations on 
page D5-2581. 


s The stage 2 permissions described in The S2AP data access permissions, Secure or Non-secure EL1&0, when 
EL2 is enabled, translation regime on page D5-2582. 


The stage 1 and stage 2 permissions are combined as follows: 


l. Ifan access is not permitted by the stage 1 permissions, then it generates a stage 1 Permission fault, regardless 
of the stage 2 permissions. 


2, If an access is permitted by the stage 1 permissions, but is not permitted by the stage 2 Permissions, then it 
generates a stage 2 Permission fault. 


3. Ifan access is permitted by both the stage 1 permissions and the stage 2 permissions, then it does not generate 
a Permission fault. 

Combining the stage 1 and stage 2 instruction execution permissions 

When both stages of translation are enabled, the following access permissions are combined: 

s The stage 1 permissions described in Stage 1 instruction access and execution permissions on page D5-2585. 

` The stage 2 permissions described in Stage 2 instruction execution permissions on page D5-2587. 

The stage 1 and stage 2 permissions are combined as follows: 


l. Ifan instruction fetch is not permitted by the stage 1 permissions, then it generates a stage 1 Permission fault, 
regardless of the stage 2 permissions. 


2, Ifan instruction fetch is permitted by the stage 1 permissions, but is not permitted by the stage 2 Permissions, 
then it generates a stage 2 Permission fault. 


3. If an instruction fetch is permitted by both the stage 1 permissions and the stage 2 permissions, then it does 
not generate a Permission fault. 
Combining the stage 1 and stage 2 memory type attributes 


The combining of memory type attributes from the two stages of translation applies only if HCR_EL2.FWB is set 
to 0. 
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Table D5-42 shows the rules for combining the stage 1 and stage 2 memory type assignments. 


Table D5-42 Combining the stage 1 and stage 2 memory type assignments 





If either stage of translation 














Rule assigns: The resultant memory type is: 
Device has precedence over Normal Any Device memory type A Device memory type 
non-Gathering has precedence over Gathering A Device-nGxx memory type A Device-nGxx memory type 
non-Reordering has precedence over Reordering A Device-nGnRx memory type A Device-nGnRx memory type 

No Early write acknowledge has precedence over The Device-nGnRnE memory type The Device-nGnRnE memory type 


Early write acknowledge 





Regardless of any shareability attribute obtained as described in Combining the stage 1 and stage 2 shareability 
attributes for Normal memory on page D5-2608: 


s Any location for which the resultant memory type is any type of Device memory is always treated as Outer 
Shareable. 
è Any location for which the resultant memory type is Normal Inner Non-cacheable, Outer Non-cacheable is 


always treated as Outer Shareable. 


For information about how the cacheability attribute is obtained from the attributes assigned at each stage of 
translation see Combining the stage 1 and stage 2 cacheability attributes for Normal memory. 


The combining of the memory type attributes from the two stages of translation means a translation table walk for 
stage 1 translation can be made to a type of Device memory. If this occurs then: 


, Ifthe value of HCR_EL2.PTW is 0, then the translation table walk occurs as if it is to Normal Non-cacheable 
memory. This means it can be done speculatively. 


: If the value of HCR_EL2.PTW is 1, then the memory access generates a stage 2 Permission fault. 


When the first stage of the translation regime specifies Device memory, HCR_EL2.FWB is set to 1, and the stage 
2 page or block descriptor [4:2] is set to 0b110, does not prevent: 
$ Instruction fetches from Device memory being a CONSTRAINED UNPREDICTABLE choice between: 

— Generating a prefetch abort. 


— Accessing memory as the resultant memory type of Normal WriteBack cacheable. 
7 A misaligned memory access generating a first stage alignment fault. 


When the first stage of the translation regime specifies Device memory, HCR_EL2.FWB is set to 1, and the stage 
2 page or block descriptor [4:2] is set to @b110, it is IMPLEMENTATION DEFINED whether Atomic memory accesses 
or Exclusives are supported, in the same way as it is for accesses to memory locations whose resultant memory type 
is Device memory. 


Combining the stage 1 and stage 2 cacheability attributes for Normal memory 


The combining of cacheability attributes from the two stages of translation applies only if HCR_EL2.FWB is set to 
0. 
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For a Normal memory region, Table D5-43 shows how the stage 1 and stage 2 cacheability assignments are 
combined. This combination applies, independently, for the Inner cacheability and Outer cacheability attributes. 


Table D5-43 Combining the stage 1 and stage 2 cacheability assignments for Normal memory 





Assignment in stage 1 Assignment in stage 2 Resultant cacheability 





Non-cacheable Any Non-cacheable 





Any Non-cacheable Non-cacheable 





Write-Through Cacheable Write-Through or Write-Back Cacheable — Write-Through Cacheable 





Write-Through or Write-Back Cacheable Write-Through Cacheable Write-Through Cacheable 





Write-Back Cacheable Write-Back Cacheable Write-Back Cacheable 





Combining the stage 1 and stage 2 shareability attributes for Normal memory 


A memory region is treated as Outer Shareable, regardless of any shareability assignments at either stage of 
translation, if either: 


è The resultant memory type attribute, described in Combining the stage 1 and stage 2 memory type attributes 
on page D5-2606, is any type of Device memory. 


è The resultant memory type attribute, described in Combining the stage 1 and stage 2 memory type attributes 
on page D5-2606, is Normal memory, and the resultant cacheability, described in Combining the stage 1 and 
stage 2 cacheability attributes for Normal memory on page D5-2607, is Inner Non-cacheable, Outer 
Non-cacheable. 


For a memory region with a resultant memory type attribute of Normal, that is not Inner Non-cacheable, Outer 
Non-cacheable, Table D5-44 shows how the stage 1 and stage 2 shareability assignments are combined. 


Table D5-44 Combining the stage 1 and stage 2 Shareability assignments for Normal memorya 





Assignment in stage 1 Assignment in stage2 Resultant shareability 





Outer Shareable 


Any 


Outer Shareable 





Inner Shareable 


Outer Shareable 


Outer Shareable 





Inner Shareable 


Inner Shareable 


Inner Shareable 





Inner Shareable 


Non-shareable 


Inner Shareable 





Non-shareable 


Outer Shareable 


Outer Shareable 





Non-shareable 


Inner Shareable 


Inner Shareable 





Non-shareable 


Non-shareable 


Non-shareable 





a. Applies only ifthe Normal memory is not Inner Non-cacheable, Outer Non-cacheable, 


see text. 
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D5.6 Virtualization Host Extensions 


Armv8.1 introduces the Virtualization Host Extensions that provide enhanced support for a Type 2 virtualization 
solution, where there is a Host OS, which is either more privileged than the hypervisor, or is a peer of the hypervisor. 


The Virtualization Host Extensions only apply to an implementation that includes EL2 using AArch64. 


D5.6.1 State added by the Virtualization Host Extensions 


The following state is added as part of ARMv8.1-VHE: 


A configuration bit, E2H, is added to HCR_EL2. 


New registers: 

—  CONTEXTIDR_EL2, which has the same format and contents as CONTEXTIDR_EL1. 

—  TTBRI1_EL2, which has the same format and contents as TTBR1_EL1. 

An EL2 virtual timer which is accessed using the registers CNTHV_CTL_EL2, CNTHV_CVAL_EL2, and 


CNTHV_TVAL EL2. The registers take the same format as CNTV_CTL_EL0, CNTV_CVAL ELO, and 
CNTV_TVAL _ELO respectively. The virtual offset is treated as 0 for this timer. 


D5.6.2 Behavior of HCR_EL2.E2H 


When the value of HCR_EL2.E2H is 0: 
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There are no changes to the Armv8 functionality other than the new state described in State added by the 
Virtualization Host Extensions. 





Note 
This means the translation regime controlled by TCR_EL2 is called the EL2 translation regime. 





The contents of TTBR1_EL2 are ignored by hardware, other than reads by an MRS instruction and writes by 
an MSR instruction. 


The Context ID matching breakpoint is disabled at EL2, and uses the value of CONTEXTIDR_ ELI at ELO 
and EL1. 


When the value of HCR_EL2.E2H is 1, and EL2 is enabled for the current Security state: 


The translation regime controlled by TCR_EL2 is the EL2&0 translation regime, and the behaviors of this 
translation regime differ from those of the EL2 translation regime. 


The EL2&0 translation regime behaves in the same way as stage | of the EL1&0 translation regime, with an 
upper address range translated by tables pointed to by TTBR1_EL2. The existing TTBRO_EL2 translates the 
lower address range of the EL2&0 translation regime and is extended to have the same contents and format 
as the TTBRO ELI. 


The translation tables used in the EL2&0 translation regime take the same format as the EL1&0 translation 
regime. EL2 accesses are treated as privileged in this format. 


Context ID matching can occur at EL2. When executing at EL2, a Context ID matching breakpoint uses 
CONTEXTIDR_EL2. 


VMID and VMID + Context ID matching breakpoints do not match at EL2. 
The virtual offset is treated as 0 when CNTVCT_ELO is read from EL2. 


The Privileged Access Never mechanism applies to accesses from EL2 to a virtual address which has access 
permitted in the EL2&0 translation regime. 


The following registers are redefined: 
—  CNTHCTL _EL2. 
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— CPTR ELZ. 
= TCR BL. 


If HCR_EL2.{E2H, TGE}== {1, 0}, then all accesses from EL! and ELO are not included in the EL2&0 translation 
regime. 


If HCR_EL2.{E2H, TGE} == {1, 1}: 


s The EL2&0 translation regime is used when executing at ELO as well as when executing at EL2, where ELO 
accesses are treated as unprivileged. 


Note 


Accesses from EL1 are not possible under this configuration. 








° In EL2, the unprivileged instructions LDTR, LDTRB, LDTRH, LDTRSB, LDTRSH, LDTRSW, STTR, STTRB, and STTRH act as 
if they are executing at ELO for permission and watchpoint checking. 


: Except for the purpose of reading the value held in the register, some fields in HCR_EL2 and all fields in 
HSTR_EL2 are treated as having a specific value. 


à SCTLR_EL2 is redefined to include additional fields from SCTLR_EL1, and to apply to execution at ELO. 


a The following timer registers, and their equivalent AArch32 registers, are redefined to access the associated 
_EL2 register, rather than accessing the ELO register when in ELO: 


— CNTP CTL ELO. 
— CNTP CVAL ELO. 
— CNTP TVAL _ELO. 
— CNTY CTLELO. 

— CNTV_CVAL ELO. 
— CNTV_TVAL ELO. 


For some information on registers that are redirected, see System and Special-purpose register redirection. 
a When executing at ELO, a Context ID matching breakpoint uses CONTEXTIDR_EL2. 


- VMID and VMID + Context ID matching breakpoints do not match at ELO. 


` The CPACR_EL] register does not cause any instructions to be trapped to EL1, regardless of the contents of 
CPACR_EL1. 
$ The CNTKCTL_EL!1 register does not cause any instructions to be trapped to EL1, and the event stream 


event caused by the CNTKCTL_EL1 is disabled, regardless of the contents of CNTKCTL_EL1. 
od The virtual offset is treated as 0 when CNTVCT_ELO is read from ELO or EL2. 


s The TLB maintenance and address translation instructions that apply to the EL1&0 translation regime are 
redefined to apply to the EL2&0 translation regime. See 464 System instructions for address translation on 
page C5-520 and 464 System instructions for TLB maintenance on page C5-543. 


< When executing at EL2 or ELO, any physical interrupt that is configured to be taken at EL2 is subject to the 
PSTATE. {D, A, I, F} interrupt masks. Ifthe mask bit is set, then the corresponding interrupt will not be taken. 
If the mask bit is not set, then the corresponding interrupt will be taken. See Asynchronous exception masking 
on page D1-2320. 


` When an exception is taken from ELO to EL2, the value of the HCR_EL2.RW bit is not considered when 
determining the exception vector offset to use. Table D1-7 on page D1-2296 lists the vector offsets used when 
an exception is taken from ELO. 


D5.6.3 System and Special-purpose register redirection 


When ARMv8.1-VHE is implemented, and HCR_EL2.E2H is set to 1, when executing at EL2, some EL1 System 
register access instructions are redefined to access the equivalent EL2 register. 
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Table D5-45 shows the System register access instruction encodings that are redirected to the equivalent EL2 
register when the named mnemonic is used. 


Table D5-45 System register redirection 





System register access instruction encoding 

























































































Mnemonic Equivalent register accessed at EL2 
op0 op1 CRn CRm op2 
3 0 1 0 SCTLR_EL1 SCTLR EL2 
CPACR_EL1 CPTR. EL2 
2 TRFCR_ELI TRFCR_EL2 
2 0 TTBRO ELI TTBRO EL2 
TTBRI ELI TTBR1 EL2 
TCR_ELI TCR_EL2 
5 1 AFSRO_EL1 AFSRO_ EL2 
AFSR1_EL1 AFSR1 _EL2 
2 ESR_EL1 ESR_EL2 
6 0 FAR EL1 FAR EL2 
10 2 MAIR ELI MAIR EL2 
3 AMAIR ELI AMAIR EL2 
12 0 VBAR ELI VBAR_EL2 
13 0 CONTEXTIDR_EL1 CONTEXTIDR_EL2 
14 1 CNTKCTL ELI CNTHCTL_EL2 
3 14 2 CNTP_TVAL_ ELO CNTHP_TVAL EL2 
CNTHPS_TVAL_ EL2@ 
CNTP_CTL_ELO CNTHP_CTL _EL2 
CNTHPS_CTL_EL2a 
CNTP_CVAL_ELO CNTHP_CVAL EL2 
CNTHPS_CVAL EL2@ 
3 3 14 3 CNTV_TVAL _ELO CNTHV_TVAL _EL2 
CNTHVS_TVAL EL24 
CNTV_CTL_ELO CNTHV_CTL_EL2 
CNTHVS_CTL_EL2a 
CNTV_CVAL_ELO CNTHV_CVAL_EL2 
CNTHVS CVAL EL2a 
a. This register is accessed when ARMv8.4-SecEL2 is implemented and enabled, when the value of SCR_EL3.EEL2? is 1. 
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Table D5-46 shows the Special-purpose register access instruction encodings that are redirected to the equivalent 
EL2 register when the named mnemonic is used. 


Table D5-46 Special-purpose register redirection 





Special-purpose register access instruction encoding 
Mnemonic [Equivalent register accessed at EL2 











op1 CRm op2 
0 0 0 SPSR_EL1 SPSR_EL2 
1 ELR ELI ELR_EL2 
D5.6.4 System and Special-purpose register aliasing 


New register encodings, and aliases, are provided so that software executing at EL2 can access the EL] registers for 
which accesses from EL2 are redirected as described in System and Special-purpose register redirection on 
page D5-2610. These aliases can also be used at EL3, but are UNDEFINED at EL1 and ELO. 
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Table D5-47 shows the System register access instruction encodings that are aliased. 


Table D5-47 System register aliases 





System register access instruction encoding 

































































Mnemonic Register accessed 
op0 op1 CRn CRm op2 
3 5 1 0 0 SCTLR_EL12 SCTLR_EL1 
2 CPACR_EL12 CPACR EL1 
2 0 ZCR_EL12 ZCR_EL1@ 
1 TRFCR_EL12 TRFCR_EL1 
2 0 0 TTBRO_EL12 TTBRO_ ELI 
1 TTBRI EL12 TTBR1_EL1 
2 TCR_EL12 TCR ELI 
5 1 0 AFSRO_EL12 AFSRO_EL1 
1 AFSR1_EL12 AFSR1_EL1 
2 0 ESR_EL12 ESR ELI 
6 0 0 FAR EL12 FAR EL1 
9 9 0 PMSCR_EL12 PMSCR_EL1 
10 2 0 MAIR EL12 MAIR ELI 
3 0 AMAIR EL12 AMAIR ELI 
12 0 0 VBAR_EL12 VBAR_ ELI 
13 0 1 CONTEXTIDR_EL12 CONTEXTIDR ELI 
14 1 0 CNTKCTL _EL12 CNTKCTL ELI 
2 0 CNTP_TVAL EL02 CNTP_TVAL ELO 
1 CNTP_CTL_EL02 CNTP_CTL_ELO 
2 CNTP_CVAL EL02 CNTP _CVAL ELO 
3 5 14 3 0 CNTV_TVAL_EL02 CNTV_TVAL_EL0 
1 CNTV_CTL EL02 CNTV_CTL_ELO 
2 CNTV_CVAL_EL02 CNTV_CVAL ELO 























a. Scalable Vector Extension System register, see The Scalable Vector Extension (SVE) on page A2-92. 
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Table D5-48 shows the Special-purpose register aliasing. 


Table D5-48 Special-purpose register aliases 





Special-purpose register access instruction encoding 
Register name Register accessed 











op0 op1 CRn CRm op2 
3 > 4 0 0 SPSR_EL12 SPSR_EL1 
1 ELR_EL12 ELR ELI 
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D5.7 Nested virtualization 


From Armv8.3, nested virtualization is supported in AArch64 state: 


. If ARMVv8.3-NV is implemented, a Host hypervisor executing at EL2 can run a Guest hypervisor at EL1, see 
Armvs.3 nested virtualization functionality. 


. If ARMv8.4-NV is implemented, the PE further transforms System register accesses into memory accesses, 
see Enhanced support for nested virtualization on page D5-2617. 


D5.7.1 Armv8.3 nested virtualization functionality 
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Note 


$ When running a Guest hypervisor with HCR_EL2.E2H == 0, the Host hypervisor must set HCR_EL2.TVM 
and CPTR_EL2.TCPAC to trap any Guest hypervisor accesses to the EL1 System registers that would be 
accesses from any Guest OS running under the Guest hypervisor 





è ARMv8.3-NV does not introduce any changes to either debug or to the Performance Monitors. Arm assumes 
that the Host hypervisor will trap accesses to the Breakpoint and Performance Monitors registers to EL2, so 
that it can process any accesses to these registers made by a Guest hypervisor or by a Guest OS running under 
the Guest hypervisor. 





ARMv8.3-NV adds the fields HCR_EL2.{NV, NV1, AT}, see: 
° Effect of HCR_EL2.{NV, NV1}. 
° Effect of HCR_EL2.AT on page D5-2617. 


Effect of HCR_EL2.{NV, NV1} 


The following subsections describe the effect of HCR_EL2.{NV, NV1}: 

. Behavior when HCR_EL2.NV==1. 

. Additional behavior when HCR_EL2.NV == 1 and HCR_EL2.NV1 == 0 on page D5-2616. 
a Additional behaviors when HCR_EL2.NV == 1 and HCR_EL2.NV1 == 1 on page D5-2616. 
è Behavior when HCR_EL2.NV == 0 and HCR_EL2.NV1 == 1 on page D5-2616. 


HCR_EL2.{NV, NV1} are both permitted to be cached in a TLB. 


Behavior when HCR_EL2.NV== 


The following behaviors apply when the value of HCR_EL2.NV is 1, regardless of the value of HCR_EL2.NV1. 
At EL1: 


5 Reads or writes to any allocated and implemented System register or Special-purpose register named *_EL2, 
* ELO2, or *_EL12 in the MRS or MSR instruction, other than SP_EL2, are trapped to EL2 rather than being 
UNDEFINED. In this case, ESR_EL2 uses the EC code of 0x18. 


Only accesses that are permitted at EL2 are trapped. This means that, for example, if the register is a 
read-only register at EL2, then an MSR from Non-secure EL] to the register is not trapped by this mechanism. 
Instead the register access remains UNDEFINED. 





Note 


The priority of this trapping relative to other configurable traps follows the standard hierarchy of exceptions, 
see Synchronous exception prioritization for exceptions taken to AArch64 state on page D1-2308. 





s Reads or writes to SPSR_irq, SPSR_abt, SPSR_und, or SPSR_fiq using MRS and MSR instructions are trapped 
to EL2 rather than being UNDEFINED. In this case the exception is reported in ESR_EL2 using the EC code 
0x18. 
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Reads or writes to SP_EL1 using the dedicated MRS and MSR instruction for accessing that register are trapped 
to EL2 rather than being UNDEFINED. In this case the exception is reported in ESR_EL2 using the EC code 
0x18. 


Execution of the EL2 translation regime Address translation instructions and TLB maintenance instructions 
are trapped to EL2 rather than being UNDEFINED. In this case the exception is reported in ESR_EL2 using the 
EC code 0x18. 


Execution of the EL1 translation regime Address translation instructions and TLB maintenance instructions 
that are only accessible from EL2 and above are trapped to EL2 rather than being UNDEFINED. In this case 
the exception is reported in ESR_EL2 using the EC code 0x18. 


The ERETAA, ERETAB, and ERET instructions are trapped to EL2. In this case the exception is reported in 
ESR_EL2 using the EC code 0x1A. 


Note 
The ERETAA and ERETAB instructions are only available when ARMv8.3-PAuth is implemented. 





A read of CurrentEL returns the value 0x2 in bits[3:2]. 


If EL3 is not implemented and HCR_EL2.TSC == 1, an SMC instruction executed at EL1 is trapped to EL2 
rather than being UNDEFINED, and HCR_EL2.TSC is not RESO. In this case the exception is reported in 
ESR_EL2 using the EC code 0x17. 


Additional behavior when HCR_EL2.NV == 1 and HCR_EL2.NV1 == 


At EL1, all the behaviors described in Behavior when HCR_EL2.NV==1 on page D5-2615 apply. 


In addition, when HCR_EL2.{NV, NV1}== {1, 0}, any exception taken from EL1 to EL1 causes 
SPSR_EL1.M[3:2] to be set to 0b10 rather than 0b01. 


Additional behaviors when HCR_EL2.NV == 1 and HCR_EL2.NV1 == 


At Non-secure EL], all the behaviors described in Behavior when HCR_EL2.NV==1 on page D5-2615 apply. 


In addition, when HCR_EL2.{NV, NV1}=={1, 1}: 


Accesses to VBAR_EL1, ELR_EL1,andSPSR_EL1 from EL] are trapped to EL2. In this case the exception 
is reported in ESR_EL2 using the EC code 0x18. 


In the ELI translation table Block and Page descriptors: 

—  Bit[54] holds PXN, not UXN. 

—  Bit[53] is RESO. 

—  Bit[6] is treated as 0 regardless of the actual value. 

If Hierarchical permissions are enabled, then in the EL1 translation table Table descriptor: 
— _ Bit[61] is treated as 0 regardless of the actual value. 


— _ Bit[60] holds PXNTable, not UXNTable. 
—  Bit[59] is RESO. 


When in EL1, PSTATE.PAN is treated as 0 for all purposes except reading the value of the bit. 


When executed at EL1, the LDTR« behave as the corresponding LDR« instructions, and the STTR« instructions 
behave as the equivalent STR« instructions. 


Behavior when HCR_EL2.NV == 0 and HCR_EL2.NV1 == 


When HCR_EL2.{NV, NV1}=={0, 1}, the behavior is a CONSTRAINED UNPREDICTABLE choice of: 


D5-2616 


Behaving as if HCR_EL2.NV==1 and HCR_EL2.NV1==1 for all purposes other than reading back the 
value of the HCR_EL2.NV bit. 
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s Behaving as if HCR_EL2.NV==0 and HCR_EL2.NV1==0 for all purposes other than reading back the 
value of the HCR_EL2.NV1 bit. 


s Behaving as defined for HCR_EL2.NV==0, with HCR_EL2.NV1==1 having the effect of causing accesses 
to VBAR_EL1, ELR_EL1, and SPSR_EL1! from EL] to be trapped to EL2. 
Effect of HCR_EL2.AT 


When ARMv8.3-NV is implemented, if HCR_EL2.AT is 1, then EL1 accesses to AT SIEOR, AT SIEOW, AT 
SIEIR, AT S1E1W, AT SIEIRP, and AT S1E1 WP, are trapped to EL2. In this case the exception is reported in 
ESR_EL2 using the EC code 0x18. 


D5.7.2 Enhanced support for nested virtualization 


ARM DDI 0487E.a 
ID070919 


If ARMv8.3-NV is implemented, the PE can access the VNCR_EL2 register and the control bit HCR_EL2.NV2. 
When HCR_EL2.NV2 is 1: 


s When in EL1, the PE redirects EL2 register accesses to EL1 register accesses, see Redirection of register 
accesses from EL2 to EL1. 


° When a Guest hypervisor issues System register access instructions to a Guest Guest OS, the PE transforms 
the System register access instructions into memory access instructions, see Loads and stores generated by 
transforming register accesses. 


When HCR_EL2.NV2 is 0, the behavior of HCR_EL2.NV and HCR _EL2.NV1 are as described in Armv8.3 nested 
virtualization functionality on page D5-2615. 


Redirection of register accesses from EL2 to EL1 


When HCR_EL2.NV and HCR_EL2.NV2 are set to 1, instructions accessing certain Special-purpose EL2 registers 
executed at EL1 are redefined to access the corresponding EL1 register: 


Table D5-49 Redirection of accesses to special-purpose registers at EL2 











Special register access instruction 2 Named EL2 register Actual register accessed 
opl = 4, CRm=0, op2=0 SPSR_EL2 SPSR_EL1 
opl = 4, CRm=0, op2=1 ELR EL2 ELR ELI 


a. For further information see op0==0b11, Moves to and from Special-purpose registers on page C5-372. 


When HCR_EL2.NV and HCR_EL2.NV2 are set to 1, instructions accessing certain System registers executed at 
EL] are redefined to access the corresponding EL1 register: 


Table D5-50 Redirection of accesses to System registers at EL2 























System register access instruction 4 Named EL2 register Actual register accessed 
op0 = 3, op1=4, CRn=5, CRm=2, op2=0 ESR_EL2 ESR _EL1 
op0 = 3, op1=4, CRn=6, CRm=0, op2=0 FAR EL2 FAR ELI 











a. For further information see Instructions for accessing non-debug System registers on page D12-2803. 


Loads and stores generated by transforming register accesses 


When an MRS or MSR instruction is executed at EL1 and is accessing a register listed in Table D5-51 on 
page DS-2618, the PE transforms that access into a loads or store, respectively. 
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When the PE transforms a System register access into a memory accesses, the address of the resulting memory 


access is defined using a combination of a base address and an offset according to the formula 
SignExtend(VNCR.BADDR : Offset<11:0>, 64): 


D5-2618 


VNCR_EL2 holds the base memory address used for memory redirection of System register accesses. 


Each register which supports redirection to memory has a unique offset value, see Table D5-51. 


Table D5-51 Memory address offsets associated with each transformed register access 





Register access 



















































































If HCR_EL2.{NV, NV1, NV2} == {1, 0,1} If HCR_EL2.{NV, NV1, NV2} == {1, 1, 1} ais 
VTTBR_EL2 VTTBR_EL2 0x20 
VSTTBR_EL2 VSTTBR_EL2 0x30 
VTCR_EL2 VTCR_EL2 0x40 
VSTCR_EL2 VSTCR_EL2 0x48 
VMPIDR_EL2 VMPIDR_EL2 0x50 
CNTVOFF_EL2 CNTVOFF_EL2 0x60 
HCR_EL2 HCR_EL2 0x78 
HSTR_EL2 HSTR_EL2 0x80 
VPIDR_EL2 VPIDR_EL2 0x88 
TPIDR_EL2 TPIDR_EL2 0x90 
VNCR_EL2 VNCR_EL2 0xB0 
CPACR_EL12 CPACR EL! 0x100 
CONTEXTIDR_EL12 CONTEXTIDR EL! 0x108 
SCTLR_EL12 SCTLR_ELI 0x110 
ACTLR ELI ACTLR ELI 0x118 
TCR_EL12 TCR_ELI 0x120 
AFSRO_EL12 AFSRO_ELI 0x128 
AFSRI_EL12 AFSR1_ELI 0x130 
ESR_EL12 ESR_EL1 0x138 
MAIR EL12 MAIR ELI 0x140 
AMAIR EL12 AMAIR ELI 0x148 
MDSCR_ELI MDSCR EL! 0x158 
SPSR_EL12 SPSR_ELI 0x160 
CNTV_CVAL_EL02 CNTV_CVAL_ELO 0x168 
CNTV_CTL_EL02 CNTV_CTL_ELO 0x170 
CNTP_CVAL_EL02 CNTP_CVAL_ELO 0x178 
CNTP_CTL_EL02 CNTP_CTL_ELO 0x180 
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Table D5-51 Memory address offsets associated with each transformed register access 





Register access 
















































































If HCR_EL2.{NV, NV1, NV2} == {1, 0, 1} If HCR_EL2.{NV, NV1, NV2} == {1, 1, 1} E 
ZCR_EL12 ZCR_ELI1 0x1E0 
TTBRO_ EL12 TTBRO_ELI1 0x200 
TTBRI EL12 TTBR1_EL1 0x210 
FAR_EL12 FAR EL1 0x220 
ELR EL12 ELR ELI 0x230 

SP ELI SP_EL1 0x240 
VBAR_EL12 VBAR ELI 0x250 
ICH_LR<n> EL2 ICH_LR<n> FL2 0x400+8%n 
ICH_APOR<n> EL2 ICH_APOR<n>_EL2 0x480+8%n 
ICH_APIR<n> EL2 ICH_APIR<n>_EL2 Ox4A0+8en 
ICH_HCR_EL2 ICH_HCR_EL2 0x40 
ICH_VMCR_EL2 ICH_VMCR_EL2 Qx4C8 
VDISR_EL2 VDISR_EL2 0x500 
VSESR_EL2 VSESR_EL2 0x508 
PMBLIMITR ELI PMBLIMITR ELI 0x800 
PMBPTR EL1 PMBPTR EL1 0x810 
PMBSR_EL1 PMBSR_EL1 0x820 
PMSCR_EL12 PMSCR_EL1 0x828 
PMSEVFR EL1 PMSEVFR_EL1 0x830 
PMSICR_EL1 PMSICR_EL1 0x838 
PMSIRR_EL1 PMSIRR_ ELI 0x840 
PMSLATFR EL1 PMSLATFR EL1 0x848 
TRFCR_EL12 TRFCR_EL1 0x880 

Note 





Software should assume that future expansion of the architecture will allocate offset values up to but not including 
0x1000. 


Registers that affect hypervisor execution by controlling the event stream are not included in Table D5-51 on 
page D5-2618: 


CNTHCTL EL2 


When HCR_EL2.NV1 is 0, CNTKCTL_EL12. 


When HCR_EL2.NV1 is 1, CNTKCTL_EL1. 
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When a System register access is transformed into a memory access, that memory access has a defined format: 
° The addressees the memory access is translated by the EL2 translation regime. 


e The endianness of the memory access is defined by SCTLR_EL2.EE. 


. The memory access is 64-bit single-copy atomic aligned to 64 bits. 
° The memory access does not have acquire or release semantics. 
Note 





The value of the transformed System register access is not affected by fields that are defined to be RESO or 
RESI in the associated System register. 





s When there is no context synchronizing operation between the read or write of the register and the load or 
store instruction accessing the address, the PE is permitted, but not required, to reorder the memory accesses 
with respect to any EL1 reads or writes generated by load or store instructions to the same address. 


s The memory accesses behave as if PSTATE.PAN == 0 regardless of the value of PSTATE.PAN. 


When a register access instruction targets a register that is not implemented, the PE treats access to that register as 
UNALLOCATED. 


Any attempt to trap a register access instruction is subject to the exception prioritization rules, unless it is trapped 
by either or both of HCR_EL2.{NV, NV1}. When a System register access instruction is trapped by either or both 
of HCR_EL2.{NV, NV1}, then the instruction is transformed into a memory access instruction instead of creating 
a trap, see Synchronous exception prioritization for exceptions taken to AArch64 state on page D1-2308. 


Exceptions from transformed register accesses 


When HCR_EL2.{NV2, NV} == {1,1} any exception taken from EL1 and taken to EL1 causes the 
SPSR_EL1.M[3:2] to be set to 0b10 and not 0b01. 


When the memory access generates a Data Abort, then the resulting fault has a defined format: 
7 The fault is taken to EL2, using the standard vector offset for exceptions from EL1 to EL2. 


à The fault is reported as a Data Abort from the current exception level with the ESR_EL2.EC code 0x25, see 
ISS encoding for an exception from a Data Abort on page D13-2943. 


° FAR_EL2 is updated to hold the faulting address. 


When the memory access generates a synchronous External abort, and when External aborts are not configured to 
be taken to EL3, then the resulting fault has a defined format: 


$ The fault is taken to EL2 using the standard vector offset for exceptions from EL1 to EL2. 


è The fault is reported as a Data Abort from the current Exception level with ESR_EL2.EC code 0x25, see ZSS 
encoding for an exception from a Data Abort on page D13-2943. 


The VNCR field in ESR_EL2 and ESR_EL3 identifies whether the fault came from use of VNCR_EL2 by EL1, see 
ISS encoding for an exception from a Data Abort on page D13-2943. 


Interaction with self-hosted and External debug 


When a register access is transformed into a memory access, the PE checks the memory access against the 
watchpoint registers as an EL2 access. 


When the memory access matches an EL2 access in the watchpoint registers, while a watchpoint is linked to a 
context-aware breakpoint that is programmed to match the value held in CONTEXTIDR_ELI, then it is 
CONSTRAINED UNPREDICTABLE whether there is a watchpoint match. 
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Note 


A breakpoint programmed to match the value held in CONTEXTIDR_ ELI falls under one of four classes of 
breakpoint: 





a 0b0011, Linked Context ID Match breakpoint. 

è 0b0111, Linked CONTEXTIDR_EL1 Match. 

. 0b1011, Linked Context ID and VMID Match breakpoint. 
° 0b1111, Linked Full Context ID Match. 


If ARMv8.4-NV is implemented, the hypervisor must use the 0b1101, Linked CONTEXTIDR_EL2 Match 
breakpoint type to guarantee a linked match. 





When there is a watchpoint match, while EDSCR.HDE is set to 1 and halting is allowed, the watchpoint match 
generates a Watchpoint debug event. 


When there is a watchpoint match, while EDSCR.HDE is set to 0 and debug exceptions are enabled at EL2, then 
the watchpoint match generates a Watchpoint exception. 


When the watchpoint match generates a Watchpoint exception, the resulting exception has a defined format: 
° The exception is taken to EL2. 


à The exception is reported as a Watchpoint from the current Exception level with the ESR_EL2.EC code 0x35, 
see ZSS encoding for an exception from a Watchpoint exception on page D13-2952. 


° FAR_EL2 is updated to hold the watchpointed address. 


The VNCR field in ESR_EL2 identifies whether the Watchpoint exception came from use of VNCR_EL2 by EL1, 
see ISS encoding for an exception from a Watchpoint exception on page D13-2952. 


When in Debug state, or while using performance monitoring, Statistical Profiling, or permission checking, 
breakpoints, trace, and sampling of operations all treat the read and write of registers as executed at EL1. 


When in Debug state, or while using performance monitoring, Statistical Profiling, or permission checking, the 
MMU and watchpoint unit treat the loads and stores generated by the transformation of reads and writes of registers 
as an EL2 access. 


While using performance monitoring, any MRS or MSR instructions that have been transformed to loads or stores 
by this mechanism are treated as loads or stores. 


When the Statistical Profiling Extension selects the instruction generating the memory access for profiling, 
Operation Type packet payload (Load/store) on page D10-2783 records the operation as a Load/Store operation, 
with a SUBCLASS value of 0b0000100x, where bit[0] is 0 for a load and 1 for a store 


When the Statistical Profiling Extension selects the instruction generating the memory access for profiling while 
Statistical Profiling is disabled at EL2, the virtual address for the memory access is not recorded. 
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VMSAv8-64 memory aborts 


In a VMSAv8-64 implementation, the following mechanisms cause a PE to take an exception on a failed memory 
access: 


Debug exception An exception caused by the debug configuration, see Chapter D2 AArch64 Self-hosted 
Debug. 


Alignment fault An Alignment fault is generated if the address used for a memory access does not have the 
required alignment for the operation. For more information, see Alignment support on 
page B2-138. 


MMU fault An MMU fault is a fault generated by the fault checking sequence for the current translation 
regime. See Types of MMU faults. 


External abort Any memory system fault other than a Debug exception, an Alignment fault, or an MMU 
fault. 


Collectively, these mechanisms are called aborts. Chapter D2 AArch64 Self-hosted Debug and on page H3-6743 
describe Debug exceptions, and the remainder of this section describes Alignment faults, MMU faults, and External 
aborts. 


An access that causes an abort is said to be aborted, and uses the Fault Address Registers (FARs) and Exception 
Syndrome Registers (ESRs) to record context information. 


In AArch64 state MMU faults are synchronous exceptions that are reported as either: 
. Data Aborts. 
° Instruction Aborts 


Note 


Instruction Aborts report any synchronous memory abort on an instruction fetch. 








The Exception level that an MMU fault is taken to depends on the translation regime and stage that generated the 
fault. The fault context saved in the appropriate ESR_ELx, where ELx is the Exception level that the fault is taken 
to, is dependent on whether: 


è The MMU fault is reported as an Instruction or as a Data Abort. 
$ The exception is taken from the same or a lower Exception level. 


For more information, see Synchronous exception types, routing and priorities on page D1-2307. 


External aborts can be reported synchronously or asynchronously. Asynchronous External aborts are reported using 
the SError interrupt. For more information, see External aborts on page D4-2496. 


Software stepping, which is a debug feature, and a PC alignment fault exception are the only exceptions that are 
higher priority than an Instruction Abort. Only watchpoints are at a lower priority than Data Aborts in the exception 
priority hierarchy. For more information, see Synchronous exception prioritization for exceptions taken to AArch64 
state on page D1-2308. 


The following sections describe the abort mechanisms: 
° Types of MMU faults. 
$ The MMU fault-checking sequence on page D5-2625. 


: AArch64 state prioritization of synchronous aborts from a single stage of address translation on 
page D5-2629. 


. Pseudocode description of the MMU faults on page D5-2631. 


Types of MMU faults 


This section describes the faults that might be detected during one of the fault-checking sequences described in The 
MMU fault-checking sequence on page D5-2625. The following list includes all the types of exceptions that can 
occur: 


à Alignment fault on a data access, see Alignment support on page B2-138. 
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° Permission fault. 

e Translation fault. 

$ Address size fault. 

° Synchronous External abort on a translation table walk. 


. Access flag fault. 
. TLB conflict abort. 


When an MMU fault generates an abort for a region of memory, no memory access is made if that region is or could 
be marked as Device. 


The following subsections describe the MMU faults that are not described elsewhere this Manual. 


Permission fault 


A Permission fault can be generated at any level of lookup, and the reported fault code identifies the lookup level. 
See About access permissions on page D5-2577 for information about conditions that cause a Permission fault. 


A TLB might hold a translation table entry that causes a Permission fault. Therefore, if the handling of a Permission 
fault results in an update to the associated translation tables, the software that updates the translation tables must 
invalidate the appropriate TLB entry, to prevent the stale information in the TLB being used on a subsequent 
memory access. 


This maintenance requirement applies to Permission faults in both stage 1 and stage 2 translations. 
Cache maintenance instructions cannot generate Permission faults, except that: 


è A stage 1 translation table walk performed as part of a cache maintenance instruction can generate a stage 2 
Permission fault as described in Stage 2 fault on a stage 1 translation table walk. 


. When the value of SCTLR_EL1.UCI is 1, enabling ELO execution of the DC CVAU, DC CVAC, DC CVAP, DC CIVAC, 
and IC IVAU instructions: 


— Executing a DC CVAU, DC CVAC, DC CVAP, or DC CIVAC instruction at ELO to a location that does not have 
read permission at ELO generates a Permission fault, subject to the constraints described in this 
section. 


— Itis IMPLEMENTATION DEFINED whether executing an IC IVAU instruction at ELO to a location that does 
not have read permission at ELO generates a Permission fault. 


° A DC IVAC instruction requires write permission to the address it invalidates, otherwise it generates a 
Permission fault, subject to the constraints described in this section. 


Note 
— Execution ofthe DCIMVAC instruction in AArch32 state does not have this write permission requirement. 





—  WhenEL1&0 stage 2 address translation is enabled, a DC IVAC instruction executed in Non-secure state 
performs a cache clean and invalidate, meaning it performs the same invalidation as a DC CIVAC 
instruction, as described in Effects of virtualization and Security state on the cache maintenance 
instructions on page D4-2487. 





In all cases where the execution of a cache maintenance instruction might generate a Permission fault: 


. If the Point of Coherency is before any level of cache, it is IMPLEMENTATION DEFINED whether a cache 
maintenance by VA to the Point of Coherency instruction can generate a Permission fault. 


i. If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether a data 
or unified cache clean by VA to the Point of Unification instruction can generate a Permission fault. 


The Data Cache Zero instruction, DC ZVA, operates as set of stores to each byte within the block being accessed, and 
therefore it generates a Permission fault if the translation system does not permit writes to these locations. 
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Translation fault 


A Translation fault can be generated at any level of lookup, and the reported fault code identifies the lookup level. 
A Translation fault is generated if bits[1:0] of a translation table descriptor identify the descriptor as either a Fault 
encoding or a reserved encoding. For more information, see VMSAv8-64 translation table format descriptors on 
page D5-2565. 


In addition, a Translation fault is generated if the input address for a translation either does not map onto an address 
range of a TTBR_ELx, or the TTBR_ELx range that it maps onto is disabled. In these cases, the fault is reported as 
a level 0 Translation fault on the translation stage at which the mapping to a region described by a TTBR_ELx 
failed. 


A data or unified cache maintenance by VA instruction can generate a Translation fault, except that: 


s If the Point of Coherency is before any level of cache, it is IMPLEMENTATION DEFINED whether a data or 
unified cache maintenance by VA instruction can generate a Translation fault. 


à If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether a data 
or unified cache clean by VA to the Point of Unification instruction can generate a Translation fault. 


It is IMPLEMENTATION DEFINED whether an instruction cache invalidate by VA operation can generate a Translation 
fault. 


The architecture guarantees that any translation table entry that causes a Translation fault is not cached, meaning 
the TLB never holds such an entry. Therefore, when a Translation fault occurs, the fault handler does not have to 
perform any TLB maintenance instructions to remove the faulting entry. 


If ARMv8.5-E0PD is implemented and enabled, the TCR_ELx.{E0D0, E0D1} fields can prevent unprivileged 
access to the addresses translated by TTBRO_ELx or TTBR1_ELx. If access is prevented, the fault is reported as a 
level 0 Translation fault, and should take the same time to generate, whether the address is present in the TLB or 
not, to mitigate attacks that use fault timing. 


Address size fault 

An Address size fault can be generated at any level of lookup. 

An Address size fault is generated if one of the following has nonzero address bits above the output address size, 
for the current stage of translation: 

7 The TTBR_ELx used for the translation. 

è A translation table entry. 

è The output address of the translation. 

For an Address size fault generated because the TTBR_ELx used for the translation has nonzero address bits above 


the output address size, the reported fault code indicates a fault at level 0. Otherwise, the reported fault code 
indicates the lookup level at which the fault occurred. 


A data or unified cache maintenance by VA instruction can generate an Address size fault, except that: 


. If the Point of Coherency is before any level of cache, it is IMPLEMENTATION DEFINED whether a data or 
unified cache maintenance by VA instruction can generate an Address size fault. 


: If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether a data 
or unified cache clean by VA to the Point of Unification instruction can generate an Address size fault. 


It is IMPLEMENTATION DEFINED whether an instruction cache invalidate by VA operation can generate an Address 
size fault. 


The architecture guarantees that any translation table entry that causes an Address size fault is not cached, meaning 
the TLB never holds such an entry. Therefore, when an Address size fault occurs, the fault handler does not have to 
perform any TLB maintenance instructions to remove the faulting entry. 


For more information on Address size faults, see Output address size on page D5-2520. 
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External abort on a translation table walk 


An External abort on a translation table walk can be either synchronous or asynchronous. An External abort on a 
translation table walk is reported: 


. If the external abort is synchronous, using: 
— A synchronous Instruction Abort exception if the translation table walk is for an instruction fetch. 
— A synchronous Data Abort exception if the translation table walk is for a data access. 


s If the External abort is asynchronous, using the SError interrupt exception. 


Behavior of External aborts on a translation table walk caused by address translation instructions 


The address translation instructions summarized in Address translation instructions on page C5-368 require 
translation table walks. An External abort can occur in the translation table walk. This is reported as follows: 


: If the External abort is synchronous, using a synchronous Data Abort exception. 
è If the External abort is asynchronous, using the SError interrupt exception. 


For more information, see Synchronous faults generated by address translation instructions on page D5-2563. 


Access flag fault 


An Access flag fault can be generated at any level of lookup, and the reported fault code identifies the lookup level. 
An Access flag fault is generated only if a translation table descriptor with the Access flag bit set to 0 is used. 


For more information about the Access flag bit, see VMSAv8-64 translation table format descriptors on 
page D5-2565. 


The architecture guarantees that any translation table entry that causes an Access flag fault is not cached, meaning 
the TLB never holds such an entry. Therefore, when an Access flag fault occurs, the fault handler does not have to 
execute any TLB maintenance instructions to remove the faulting entry. 


Whether any cache maintenance by VA instructions can generate Access flag faults is IMPLEMENTATION DEFINED. 


For more information, see The Access flag on page D5-2589. 


D5.8.2 The MMU fault-checking sequence 
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This section describes the MMU checks made for the memory accesses required for instruction fetches and for 
explicit memory accesses: 

° If an instruction fetch faults, it generates an Instruction Abort. 

s If a data memory access faults, it generates a Data Abort. 


MMU fault checking is performed for each stage of address translation. 


The fault-checking sequence shows a translation from an Input address to an Output address. For more information 
about this terminology, see About address translation and supported input address ranges on page D5-2516. 


Note 


The descriptions in this section do not include the possibility that the attempted address translation generates a TLB 
conflict abort, as described in TLB conflict aborts on page D5-2637. 








Types of MMU faults on page D5-2622 describes the faults that an MMU fault-checking sequence can report. 


Figure D5-18 on page D5-2626 shows the process of fetching a descriptor from the translation table. For the 
top-level fetch for any translation, the descriptor is fetched only if the input address passes any required alignment 
check. As the figure shows, if the translation is stage 1 of the Secure or Non-secure EL1&0 translation regime, when 
EL2 is enabled, then the descriptor address is in the IPA address space, and is subject to a stage 2 translation to obtain 
the required PA. This stage 2 translation requires a recursive entry to the fault checking sequence. 
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Figure D5-18 Fetching the descriptor in a VMSAv8-64 translation table walk 


Figure D5-19 on page D5-2627 shows the full VMSA fault checking sequence, including the alignment check on 
the initial access. 
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Stage 2 fault on a stage 1 translation table walk 


On performing a translation table walk for the stage 1 translations, the descriptor addresses must be translated from 
IPA to PA, using a stage 2 translation. This means that a memory access made as part of a stage 1 translation table 
lookup might generate, on a stage 2 translation: 

° A Translation fault, Access flag fault, or Permission fault. 

: A synchronous External abort on the memory access. 


If SCR_EL3.EA is set to 1, a synchronous External abort is taken to EL3. Otherwise, these faults are reported as 
stage 2 memory aborts. ESR_EL2.ISS[7] is set to 1, to indicate a stage 2 fault during a stage 1 translation table walk, 
and the part of the ISS field that might contain details of the instruction is invalid. For more information see Use of 
the ESR_EL1, ESR_EL2, and ESR_EL3 on page D1-2296. 


Alternatively, a memory access made as part of a stage 1 translation table lookup might target an area of memory 
with the Device attribute assigned on the stage 2 translation of the address accessed. When the HCR_EL2.PTW bit 
is set to 1, such an access generates a stage 2 Permission fault. 





Note 


On most systems, such a mapping to Device memory on the stage 2 translation is likely to indicate a Guest OS error, 
where the stage 1 translation table is corrupted. Therefore, it is appropriate to trap this access to the hypervisor. 





A TLB might hold entries that depend on the effect of HCR_EL2.PTW. Therefore, if HCR_EL2.PTW is changed 
without changing the current VMID, the TLBs must be invalidated before executing in EL1 or ELO state. 


A cache maintenance instruction executed at EL1 or ELO can cause a stage | translation table walk that might 
generate a stage 2 Permission fault as described in this section. However: 


s If the Point of Coherency is before any level of cache, it is IMPLEMENTATION DEFINED whether a cache 
maintenance by VA instruction can generate a Permission fault in this way. 


è If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether a data 
or unified cache clean by VA to the Point of Unification instruction can generate a Permission fault in this 
way. 

: It is IMPLEMENTATION DEFINED whether an instruction cache invalidation by VA instruction can generate a 


Permission fault in this way. 





Note 


This is an exception to the general rule that a cache maintenance instruction cannot generate a Permission fault. 


The level associated with MMU faults 


For MMU faults, Table D5-52 shows how the LL bits in the ESR_ELx.STATUS fields encode the lookup level 
associated with the fault. 


Table D5-52 Use of LL bits to encode the lookup level at which the fault occurred 


LL bits Meaning 














00 Level 0 of translation or translation table base register. 

01 Level 1. 

10 Level 2. 

11 Level 3. When xFSR.STATUS indicates a Domain fault, this value is reserved. 





The lookup level associated with a fault is: 


$ For a fault generated on a translation table walk, the lookup level of the walk being performed. 
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: For a Translation fault, the lookup level of the translation table that gave the fault. If a fault occurs because 
a stage of address translation is disabled, or because the input address is outside the range specified by the 
appropriate base address register or registers, or because ARMv8.5-E0PD is enabled and prevents access to 
the translation table, the fault is reported as a level 0 fault. 


$ For an Access flag fault, the lookup level of the translation table that gave the fault. 


è For a Permission fault, including a Permission fault caused by hierarchical permissions, the lookup level of 
the final level of translation table accessed for the translation. That is, the lookup level of the translation table 
that returned a Block or Page descriptor. 


Also see Synchronous External aborts from address translation caching structures on page D5-2631 


D5.8.3 AArch64 state prioritization of synchronous aborts from a single stage of address translation 


Synchronous exception prioritization for exceptions taken to AArch64 state on page D1-2308 describes the 
prioritization of exceptions taken to an Exception level that is using AArch64. This section gives additional 
information about the prioritization of MMU faults from VMSAv8-64 translation regimes. 


Note 


The priority numbering in this list only shows the relative priorities of aborts from a single stage of address 
translation in a VMSAv8-64 translation regime. This numbering has no global significance and, for example, does 
not correlate with the equivalent AArch32 list in AArch32 state prioritization of synchronous aborts from a single 
stage of address translation on page G5-5819. 








For a single stage of translation ina VMSAv8-64 translation regime, the following numbered list shows the priority 
of the possible memory management faults on a memory access. In this list: 


s For memory accesses that undergo two stages of translation, the italic entries show where the faults from the 
stage 2 translation can occur. A stage 2 fault within a stage 1 translation table walk follows the same 
prioritization of faults: 


- For synchronous External aborts from translation table walks, see also Synchronous External aborts from 
address translation caching structures on page D5-2631. 


The prioritization between the stage 2 permission failure on the stage 1 translation table walk and the stage 1 abort 
generated by the stage | translation table entry is IMPLEMENTATION DEFINED if all the following are true: 


, Stage 1 hardware updating of either access or dirty information is enabled. 

s A stage 1 translation table entry results in the stage 1 translation table entry having the access or dirty bit 
updated. 

è The stage 1 translation table entry has stage 2 read permission but not stage 2 write permission. 

$ The stage 1 translation entry generates an abort (which might be one of an address size fault, an alignment 


fault caused by memory type or a permission fault). 
The priority order, from highest priority to lowest priority, is: 
1. Alignment fault not caused by memory type. This is possible for a stage 1 translation only. 


2, Translation fault due to the input address being out of the address range to be translated or requiring a 
TTBR_ELx that is disabled. This includes VTCR_EL2.SLO0 being inconsistent with VTCR_EL2.TOSZ, 
VSTCR_EL2.SLO0 being inconsistent with VSTCR_EL2.TOSZ, or SLO programmed to a reserved value. 


3. Address size fault on a TTBR_ELx caused by either: 
° The check on TCR_EL1.IPS, TCR_EL2.PS, TCR_EL3.PS, or VTCR_EL2.PS. 
° The PA being out of the range implemented. 
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14. 


15. 


16. 


17. 


18. 


19. 


20. 


21. 


22. 


23, 


24. 


29: 


26. 


27. 


Second stage abort on a level 0 memory access of a a stage 1 table walk. When stage 2 address translation 
is enabled this includes an Address size fault caused by the PA being out of the range implemented. This is 
second stage abort during a first stage translation table walk. 


Synchronous parity or ECC error on a level 0 lookup of a translation table walk. 
Synchronous External abort on a level 0 lookup level of a translation table walk. 
Translation fault on a level 0 translation table entry. 


Address size fault a level 0 lookup translation table entry caused by either: 
. The check on TCR_EL1.IPS, TCR_EL2.PS, TCR_EL3.PS, or VTCR_EL2.PS. 
° The output address being out of the range implemented. 


Second stage abort on a level 1 memory access of a a stage 1 table walk. When stage 2 address translation 
is enabled this includes an Address size fault caused by the PA being out of the range implemented. This is 
second stage abort during a first stage translation table walk. 


Synchronous parity or ECC error on a level 1 lookup of a translation table walk. 
Synchronous External abort on a level 1 lookup level of a translation table walk. 
Translation fault on a level 1 translation table entry. 


Address size fault on a level 1 lookup translation table entry caused by either: 
° The check on TCR_EL1.IPS, TCR_EL2.PS, TCR_EL3.PS, or VTCR_EL2.PS. 
° The output address being out of the range implemented. 


Second stage abort on a level 2 memory access of a a stage 1 table walk. When stage 2 address translation 
is enabled this includes an Address size fault caused by the PA being out of the range implemented. This is 
second stage abort during a first stage translation table walk. 


Synchronous parity or ECC error on a level 2 lookup of a translation table walk. 
Synchronous External abort on a level 2 lookup level of a translation table walk. 
Translation fault on a level 2 translation table entry. 


Address size fault on a level 2 lookup translation table entry caused by either: 
° The check on TCR_EL1.IPS, TCR_EL2.PS, TCR_EL3.PS, or VTCR_EL2.PS. 
s The output address being out of the range implemented. 


Second stage abort on a level 3 memory access of a a stage 1 table walk. When stage 2 address translation 
is enabled this includes an Address size fault caused by the PA being out of the range implemented. This is 
second stage abort during a first stage translation table walk. 


Synchronous parity or ECC error on a level 3 lookup of a translation table walk. 
Synchronous External abort on a level 3 lookup level of a translation table walk. 
Translation fault on a level 3 translation table entry. 


Address size fault on a level 3 lookup translation table entry caused by either: 
è The check on TCR_EL1.IPS, TCR_EL2.PS, TCR_EL3.PS, or VTCR_EL2.PS. 
° The output address being out of the range implemented. 


Access Flag fault. 
Alignment fault caused by the memory type. 
Permission fault. 


A fault from the stage 2 translation of the memory access. When stage 2 address translation is enabled this 
includes an Address size fault caused by the PA being out of the range implemented. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch64 Virtual Memory System Architecture 
D5.8 VMSAv8-64 memory aborts 


28. Synchronous parity or ECC error on the memory access. 


29. Synchronous External abort on the memory access. 


Note 


s The prioritization of TLB Conflict aborts is IMPLEMENTATION DEFINED, as the exact cause of these aborts 
depends on the form of TLBs implemented. However, the TLB conflict abort must have higher priority than 
any abort that depends on a value held in the TLB. 





. The prioritization of IMPLEMENTATION DEFINED MMU faults for a Load-Exclusive or Store-Exclusive to an 
unsupported memory type is IMPLEMENTATION DEFINED. 


Synchronous External aborts from address translation caching structures 


A caching structure used for caching translation table walks might support: 
7 An arbitrary number of levels of translation table lookup. 
s One or more stages of translation, that might not correspond to the stages of an address translation lookup. 


This might mean that, on a synchronous External aborts arising from the caching structure, including parity or ECC 
errors, the PE cannot precisely determine one or both of the translation stage and level of lookup at which the error 
occurred. In this case: 


° If the PE cannot determine precisely the translation stage at which the error occurred, it is reported and 
prioritized as a stage 1 error. 


° If the PE cannot determine precisely the lookup level at which the error occurred, the level is reported and 
prioritized as either: 


— The lowest-numbered level that could have given rise to the error. 
— Level 0 if it the PE cannot determine any information about the level. 


D5.8.4 Pseudocode description of the MMU faults 
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The following functions generate fault records that describe MMU faults: 
° AArch64.AccessFlagFault(). 

° AArch64.AddressSizeFault(). 

° AArch64.PermissionFault(). 

. AArch64.TranslationFault(). 


Abort exceptions on page D4-2501 describes how fault records are used. 
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D5.9 


D5.9.1 


D5-2632 


Translation Lookaside Buffers (TLBs) 


Translation Lookaside Buffers (TLBs) reduce the average cost of a memory access by caching the results of 
translation table walks. TLBs behave as caches of the translation table information, and the VMSA provides TLB 
maintenance instructions for the management of TLB contents. 


Note 


The Arm architecture permits TLBs to hold any translation table entry that does not directly cause a Translation 
fault, an Address size fault, or an Access flag fault. 








The following sections describe the architectural requirements for Translation Lookaside Buffers (TLBs) and their 
maintenance: 


: Use of ASIDs and VMIDs to reduce TLB maintenance requirements. 
. About Armv8 Translation Lookaside Buffers (TLBs) on page D5-2634. 


° TLB maintenance requirements and the TLB maintenance instructions on page D5-2638. 


In these descriptions, TLB entries for a translation regime for a particular Exception level are out of context when 
executing at a higher Exception level. 


Note 


In addition to the functions described in this section, the TLB might cache information from control registers that 
are described as being “permitted to be cached in a TLB”, even when any or all of the stages of translation are 
disabled. This caching of information gives rise to the maintenance requirements described in General TLB 
maintenance requirements on page D5-2638. 





Use of ASIDs and VMIDs to reduce TLB maintenance requirements 


To reduce the need for TLB maintenance on context switches, the lookups from some translation regimes can be 
associated with an ASID, or with an ASID and a VMID, as follows: 


ASID For stage 1 of a translation regime that can support two VA ranges the VMSA can distinguish 
between Global pages and Process-specific pages. The Address Space Identifier (ASID) identifies 
pages associated with a specific process and provides a mechanism for changing process-specific 
tables without having to maintain the TLB structures. 


For these stage 1 translations, each of TTBRO_ELx and TTBR1_ELx has a valid ASID field, and 
TCR_ELx.A1 determines which of these holds the current ASID. 


— Note 


The selected ASID applies regardless of which set of translation tables are used. For example, when 
the value of TCR_ELx.A1 is 0, any translation table lookup using this stage of translation is 
associated with the ASID from TTBRO_ELx.ASID, regardless of whether the translation lookup 
uses TTBRO_ELx or TTBR1_ELx. 





See also ASID size on page D5-2633 and Global and process-specific translation table entries on 
page D5-2635. 


For a symmetric multiprocessor cluster where a single operating system is running on the set of 
processing elements, the Arm architecture requires all ASID values to be assigned uniquely within 
any single Inner Shareable domain. In other words, each ASID value must have the same meaning 
to all processing elements in the system. 


VMID For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, the virtual machine 
identifier (VMID) identifies the current virtual machine, with its own independent ASID space. The 
TLB entries include this VMID information, meaning TLBs do not require explicit invalidation 
when changing from one virtual machine to another if the virtual machines have different VMIDs. 


VTTBR_EL2.VMID holds the current VMID. 
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Common not private translations 


In an implementation that includes ARMv8.2-TTCNP, multiple PEs in the same Inner Shareable domain can use 
the same translation table entries for a given stage of translation in a particular translation regime. This sharing is 
enabled by the TTBR_ELx.CnP field for the stage of address translation. 


For all PEs that are sharing translation table entries for a stage of translation, all system registers bits which apply 
to that stage of translation and which are described as being permitted to be cached in a TLB must be the same for 
all the PEs that are sharing the translation table entry. If this condition is not met by hardware, then it is 
CONSTRAINED UNPREDICTABLE whether the value of such a control bit which has a different value between PEs, 
interpreted by a PE, PE1, takes the value configured for: 


s The system register bit of PE1. 
è The system register bit of one of the PEs that is sharing the translation table entry. 


When the value of a TTBR_ELx.CnP field is 1, translation table entries pointed to by that TTBR_ELx are shared 
with all other PEs in the Inner Shareable domain for which for which the following conditions are met: 


$ The corresponding TTBR_ELx.CnP field has the value 1. 
° That TTBR_EL-x relates to the same translation regime. 


Note 


— For TTBRO_ELI the current Security state determines whether the register relates to the Secure 
EL1&0, when EL2 is disabled, translation regime, or to the Non-secure EL1&0, when EL2 is enabled, 
translation regime. 


— For TTBRO_EL2 the value of HCR_EL2.E2H determines whether the register relates to the EL2 
translation regime, or to the EL2&0 translation regime. 








G If an ASID applies to the stage of translation corresponding to that TTBR_ELx then the current ASID value 
must be the same for all of the PEs that are sharing entries for any translation table entry that is not global or 
leaf level. 


è Ifa VMID applies to the stage of translation corresponding to that TTBR_ELx then the current VMID value 
must be the same for all of the PEs that are sharing entries. 


For a translation regime with both stage 1 and stage 2 translations, where a TLB holds only stage | translation 
table entries or where a TLB combines information from stage 1 and stage 2 translation table entries into a single 
entry, this entry can be shared between different PEs only if the value of the TTBR_ELx.CnP bit is 1 for both 
stage | and stage 2 of the translation table walk. 


The TTBR_ELx.CnP bit can be cached in a TLB. 


For a given TTBR_ELx, if the value of TTBR_ELx.CnP is 1 on multiple PEs in the same Inner Shareable domain, 
and those PEs meet the other conditions for sharing translation table entries as defined in this section, but those 
TTBR_ELxs do not point to the same translation table entries, then the system is misconfigured, and performing 
an address translation using that TTBR_ELx: 


s Might generate multiple hits in the TLB, and as a result generate an exception that is reported using the TLB 
conflict fault code, see TLB conflict aborts on page D5-2637. 


. Otherwise, has a CONSTRAINED UNPREDICTABLE result, as described in CONSTRAINED UNPREDICTABLE 
behaviors due to caching of control or data values on page K1-7630. 


ASID size 


In VMSAv8-64, the ASID size is an IMPLEMENTATION DEFINED choice of 8 bits or 16 bits, and 
ID_AA64MMFRO_EL1.ASIDBits identifies the supported size. 


When an implementation supports a 16-bit ASID, TCR_ELx.AS selects whether the top 8 bits of the ASID are used. 
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D5-2634 


When the value of TCR_ELx.AS is 0, ASID[15:8]: 


. Are ignored by hardware for every purpose other than direct reads of TTBRO_ELx.ASID and 
TTBR1_ELx.ASID. 


$ Are treated as if they are all zeros when used for allocating and matching entries in the TLB. 


Note 


VMSAv8-32 uses an 8-bit ASID. For backwards compatibility, when executing using translations controlled from 
an Exception level that is using AArch32, the ASID size remains at 8 bits. If the implementation supports 16-bit 
ASIDs, the 8-bit ASID used is zero-extended to 16 bits. 





VMID size 


From Armv8.1, the VMID size is an IMPLEMENTATION DEFINED choice of 8 bits or 16 bits, and 
ID_AA64MMFR1_EL1.VMIDBits identifies the supported size. 


When ARMv8.1-VMID16 is implemented, VTTBR_EL2[63:48] contains the 16-bit VMID. 


When an implementation supports a 16-bit VMID, VTCR_EL2.VS selects whether the top 8 bits of the VMID are 
used. 


When the value of VTCR_EL2.VS is 0, VMID[63:56]: 
` Are ignored by hardware for every purpose other than reads of ID AA64MMFRI ELI. 
è Are treated as if they are all zeros when used for allocating and matching entries in the TLB. 


ARMv8.1-VMID16 is only supported when EL2 is using AArch64. 


About Armv8 Translation Lookaside Buffers (TLBs) 


Translation Lookaside Buffers (TLBs) are an implementation technique that caches translations or translation table 
entries. TLBs avoid the requirement for every memory access to perform a translation table walk in memory. The 
Arm architecture does not specify the exact form of the TLB structures for any design. In a similar way to the 
requirements for caches, the architecture only defines certain principles for TLBs: 


od The architecture has a concept of an entry locked down in the TLB. The method by which lockdown is 
achieved is IMPLEMENTATION DEFINED, and an implementation might not support lockdown. 


$ The architecture does not guarantee that an unlocked TLB entry remains in the TLB. 


$ The architecture guarantees that a locked TLB entry remains in the TLB. However, a locked TLB entry might 
be updated by subsequent updates to the translation tables. Therefore, when a change is made to the 
translation tables, the architecture does not guarantee that a locked TLB entry remains incoherent with an 
entry in the translation table. 


$ The architecture guarantees that a translation table entry that generates a Translation fault, an Address size 
fault, or an Access flag fault is not held in the TLB. However a translation table entry that generates a 
Permission fault might be held in the TLB. 


è When address translation is enabled, any translation table entry that does not generate a Translation fault, an 
Address size fault, or an Access flag fault and is not from a translation regime for an Exception level that is 
lower than the current Exception level can be allocated to a TLB at any time. The only translation table entries 
guaranteed not to be held in a TLB are those that generate a Translation fault, an Address size fault, or an 
Access flag fault. 


Note 


A TLB can hold a translation table entry that does not itself generate a Translation fault but that points to a 
subsequent table in the translation table walk. This is referred to as intermediate caching of TLB entries. 
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s Software can rely on the fact that between disabling and re-enabling a stage of address translation, entries in 
the TLB relating to that stage of translation have not have been corrupted to give incorrect translations. 


The following sections give more information about TLB implementation: 
$ Global and process-specific translation table entries. 

. TLB matching. 

s TLB behavior at reset on page D5-2636. 

s TLB lockdown on page D5-2636. 

$ TLB conflict aborts on page D5-2637. 


See also TLB maintenance requirements and the TLB maintenance instructions on page D5-2638. 


Global and process-specific translation table entries 


Ina VMSA implementation, system software can divide the virtual memory map used by a stage of translation that 
can support two VA ranges into global and non-global regions, indicated by the nG bit in the translation table 
descriptors: 


nG == The translation is global, meaning the region is available for all processes. 
nG == The translation is non-global, or process-specific, meaning it relates to the current ASID, as defined 
by: 


. TTBRO_ELx.ASID, if the value of TCR_ELx.A1 is 0. 
. TTBR1_ELx.ASID, if the value of TCR_ELx.A1 is 1. 


As indicated by the nG field definitions, each non-global region has an associated ASID. These identifiers mean 
different translation table mappings can co-exist in a caching structure such as a TLB. This means that software can 
create a new mapping of a non-global memory region without removing previous mappings. 


Note 


: The selected ASID applies to the translation of any address for which the value of the nG bit is 1, regardless 
of whether the address is translated based on TTBRO_ELx or on TTBR1_ELx. 





s In an implementation that does not include ARMv8.1-VHE, the only stage of translation that can support two 
VA ranges is stage 1 of the EL1&0 translation regime. In an implementation that includes ARMv8.1-VHE 
stage | of the EL2&0 translation regime also can support two VA ranges. 


ASIDs are supported only when stage 1 translations can support two VA ranges. Stage 2 translations, and stage 1 
translations that can support only a single VA range do not support ASIDs, and all descriptors in these regimes are 
treated as global. 


In a translation regime that supports global and non-global translations, translation table entries from lookup levels 
other than the final level of lookup are treated as being non-global, regardless of the value of the nG bit. 


When a PE is using the VMSAv8-64 translation table format, and is in Secure state, a translation must be treated as 
non-global, regardless of the value of the nG bit, if NSTable is set to 1 at any level of the translation table walk. 


For more information, see Control of Secure or Non-secure memory access on page D5-2576. 


TLB matching 


A TLB is a hardware caching structure for translation table information. Like other hardware caching structures, it 
is mostly invisible to software. However, there are some situations where it can become visible. These are associated 
with coherency problems caused by an update to the translation table that has not been reflected in the TLB. Use of 
the TLB maintenance instructions described in TLB maintenance requirements and the TLB maintenance 
instructions on page D5-2638 can prevent any TLB incoherency becoming a problem. 
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A particular case where the presence of the TLB can become visible is if the translation table entries that are in use 
under a particular ASID and VMID are changed without suitable invalidation of the TLB. This can occur only if the 
architecturally-required break-before-make sequence described in Using break-before-make when updating 
translation table entries on page D5-2639 is not used. If the break-before make sequence is not used, the TLB can 
hold two mappings for the same address, and this: 


z Might generate an exception that is reported using the TLB conflict fault code, see TLB conflict aborts on 
page D5-2637. 


° Might lead to CONSTRAINED UNPREDICTABLE behavior. In this case, behavior will be consistent with one of 
the mappings held in the TLB, or with some amalgamation of the values held in the TLB, but cannot give 
access to regions of memory with permissions or attributes that could not be assigned by valid translation 
table entries in the translation regime being used for access. In addition, where all the entries being 
amalgamated come from Non-secure memory, the amalgamation cannot give rise to an output address that 
accesses Secure memory. For more information, see CONSTRAINED UNPREDICTABLE behaviors due to 
caching of control or data values on page K1-7630. 


TLB behavior at reset 


The Arm architecture does not require a reset to invalidate the TLBs. The architecture recognizes that an 
implementation might require caches, including TLBs, to maintain their contents over a system reset. Possible 
reasons for doing so include power management and debug requirements. 


Therefore, for Armv8: 
à All TLBs reset to an IMPLEMENTATION DEFINED state that might be UNKNOWN. 


s All TLBs are disabled from reset. All stages of address translation are disabled from reset, and the contents 
of the TLBs have no effect on address translation. For more information, see Controlling address translation 
stages on page D5-2517. 


è An implementation can require the use of a specific TLB invalidation routine, to invalidate the TLB arrays 
before they are enabled after a reset. The exact form of this routine is IMPLEMENTATION DEFINED, but if an 
invalidation routine is required it must be documented clearly as part of the documentation of the device. 


Arm recommends that if an invalidation routine is required for this purpose, the routine is based on the TLB 
maintenance instructions described in TLB maintenance instructions on page D5-2641. 


Similar rules apply to cache behavior, see Behavior of caches at reset on page D4-2477. 


TLB lockdown 


The Arm architecture recognizes that any TLB lockdown scheme is heavily dependent on the microarchitecture, 
making it inappropriate to define a common mechanism across all implementations. This means that: 


. VMSAv8-64 does not require TLB lockdown support. 


7 If TLB lockdown support is implemented, the lockdown mechanism is IMPLEMENTATION DEFINED. However, 
key properties of the interaction of lockdown with the architecture must be documented as part of the 
implementation documentation. 


This means that a region of the System instruction encoding space is reserved for IMPLEMENTATION DEFINED 
functions, see Reserved encodings for IMPLEMENTATION DEFINED registers on page D12-2815. An 
implementation might use some of these encodings to implement TLB lockdown functions. These functions might 
include: 


$ Unlock all locked TLB entries. 
$ Preload into a specific level of TLB. This is beyond the scope of the PLI and PLD hint instructions. 


In an implementation that includes EL2, exceptions generated as a result of TLB lockdown when executing in EL1 
or ELO state can be routed to either: 


° EL1, as a Data Abort exception. 
° EL2, as a Hyp Trap exception. 
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For more information, see Traps to EL2 of ELO and EL] accesses to lockdown, DMA, and TCM operations on 
page D1-2343. 
TLB conflict aborts 


If an address matches multiple entries in the TLB, it is IMPLEMENTATION DEFINED whether a TLB conflict abort is 
generated. 





Note 


An address can hit multiple entries in the TLB if the TLB has been invalidated inappropriately, for example if TLB 
invalidation required by the architecture has not been performed. 





An implementation can generate TLB conflict aborts on either or both instruction fetches and data accesses. A TLB 
conflict abort: 


: On an instruction fetch is reported as an Instruction Abort, see JSS encoding for an exception from an 
Instruction Abort on page D13-2941. 


è On a data access is reported as a Data Abort, see ZSS encoding for an exception from a Data Abort on 
page D13-2943. 


Armv8 defines the Fault status encoding of 0b110000 for TLB conflict aborts. On a TLB conflict abort, the returned 
syndrome includes the address that generated the fault. That is, it includes the address that was being looked up in 
the TLB. 


It is IMPLEMENTATION DEFINED whether a TLB conflict abort is a stage 1 abort or a stage 2 abort. 


Note 


A stage 2 abort cannot be generated if stage 2 of the Secure or Non-secure EL1&0, when EL2 is enabled, translation 
regime is disabled. 








The priority of the TLB conflict abort is IMPLEMENTATION DEFINED, because it depends on the form of a TLB that 
can generate the abort. However, the TLB conflict abort must have higher priority than any abort that depends on a 
value held in the TLB. 


If an address matches multiple entries in the TLB and no TLB conflict abort is generated, the resulting behavior is 
CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching of control or 
data values on page K1-7630. The CONSTRAINED UNPREDICTABLE behavior must not permit access to regions of 
memory with permissions or attributes that mean they cannot be accessed in the current Security state at the current 
Exception level. 
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D5.10 TLB maintenance requirements and the TLB maintenance instructions 


Translation Lookaside Buffers (TLBs) are an implementation mechanism that caches translations or translation 
table entries. The Arm architecture does not specify the form of any TLB structures, but defines the mechanisms by 
which TLBs can be maintained. The following sections describe the VMSA TLB maintenance instructions: 


s General TLB maintenance requirements. 


5 TLB maintenance instructions on page D5-2641. 


See also Atomicity of register changes on changing virtual machine on page D5-2525. 


D5.10.1 General TLB maintenance requirements 


TLB maintenance instructions provide a mechanism for invalidating entries from TLB caching structures to ensure 
that changes to the translation tables are reflected correctly in those TLB caching structures. 


The architecture permits the caching of any translation table entry that has been returned from memory without a 
fault, provided that the entry does not, itself, cause a Translation fault, an Address size fault, or an Access Flag fault. 
This means that the entries that can be cached include: 


7 Entries in translation tables that point to subsequent tables to be used in that stage of translation. 
s Stage 2 translation table entries used as part of a stage 1 translation table walk 
. Stage 2 translation table entries used to translate the output address of the stage 1 translation. 


Such entries might be held in intermediate TLB caching structures that are used during a translation table walk and 
that are distinct from the data caches in that they are not required to be invalidated as the result of writes of the data. 
The architecture makes no restriction of the form of these intermediate TLB caching structures. 


The architecture does not intend to restrict the form of TLB caching structures used for holding translation table 
entries, and in particular for a translation regime that involves two stages of translation, it is recognized that such 
caching structures might contain: 


s Entries containing information from stage 1 translation table entries, at any level of the translation table walk. 
s Entries containing information from stage 2 translation table entries, at any level of the translation table walk. 
. Entries that combine information from stage 1 and stage 2 translation table entries, at any level of the 


translation table walk. 


Note 


For the purpose of TLB maintenance, the term TLB entry denotes any structure, including temporary working 
registers in translation table walk hardware, that holds a translation table entry. 








Where a TLB maintenance instruction is: 


s Required to apply to stage 1 entries, then it must apply to any cached entries in caching structures that include 
any stage 1 information that are used to translate the address being invalidated. 


Note 


— Where stage | information has been cached in multiple TLB entries, as could occur from splintering 
a page when caching in the TLB, then the invalidation must apply to each cached entry containing 
stage 1 information from the page that is used to translate the address being invalidated, regardless of 
whether or not that cached entry would be used to translate the address being invalidated. 





— As stated in Global and process-specific translation table entries on page D5-2635, translation table 
entries from levels of translation other than the final level are treated as being non-global. Arm expects 
that, in at least some implementations, cached copies of levels of the translation table walk other than 
the last level are tagged with their ASID, regardless of whether the final level is global. This means 
that TLB invalidations that involve the ASID require the ASID to match such entries to perform the 
required invalidation. 
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Required to apply to stage 2 entries only, then: 


— Itis not required to apply to caching structures that combine stage 1 and stage 2 translation table 
entries. 


— It must apply to caching structures that contain information only from stage 2 translation table entries. 


è Required to apply to both stage 1 and stage 2 entries, then it must apply to any entry in the caching structures 
that includes information from either a stage 1 translation table entry or a stage 2 translation table entry, 
including any entry that combines information from both stage 1 and stage 2 translation table entries. 


Whenever translation tables entries associated with a particular VMID or ASID are changed, the corresponding 
entries must be invalidated from the TLB to ensure that these changes are visible to subsequent execution, including 
speculative execution, that uses the changed translation table entries. 


Some System register field descriptions state that the effect of the field is permitted to be cached in a TLB. This 
means that all TLB entries that might be affected by a change of the field must be invalidated whenever that field 
is changed, to ensure that the effect of the change of that control field is visible to subsequent execution, including 
speculative execution, that uses that control field. This invalidation is required in addition to, and after, the normal 
synchronization of the System registers described in Synchronization requirements for AArch64 System registers on 
page D13-2819, and applies to any stage of address translation that is implemented for the translation regime, and 
VMID and ASID as appropriate, that is affected by that control field. A control field that is permitted to be cached 
in a TLB requires this maintenance even when all stages of address translation are disabled. 


In addition to any TLB maintenance requirement, when changing the cacheability attributes of an area of memory, 
software must ensure that any cached copies of affected locations are removed from the caches. For more 
information see Cache maintenance requirement created by changing translation table attributes on page D5-2657. 


Because a TLB never holds any translation table entry that generates a Translation fault, an Address size fault, or 
an Access Flag fault, a change from a translation table entry that causes a Translation, Address size, or Access flag 
fault to one that does not fault, does not require any TLB invalidation. However, a Context synchronization event is 
required to ensure that instruction fetches are affected by a completed change to translation table entries that, before 
the change, generated a Translation, Address size, or Access flag fault. 


Special considerations apply to translation table updates that change the memory type, cacheability, or output 
address of an entry, see Using break-before-make when updating translation table entries. 


Using break-before-make when updating translation table entries 


To avoid possibly creating multiple TLB entries for the same address, and to avoid the effects of TLB caching 
possibly breaking coherency, single-copy atomicity properties, ordering guarantees or uniprocessor semantics, or 
possibly failing to clear the Exclusives monitors, the architecture requires the use of a break-before-make sequence 
when changing translation table entries whenever multiple threads of execution can use the same translation tables 
and the change to the translation table entries involves any of: 


° A change of the memory type. 


G A change of the cacheability attributes. 

e A change of the output address (OA), if the OA of at least one of the old translation table entry and the new 
translation table entry is writable, including if the DBM bit is set and hardware updates to the dirty bits are 
enabled. 

s A change to the size of block used by the translation system. This applies both: 


— When changing from a smaller size to a larger size, for example by replacing a table mapping with a 
block mapping in a stage 2 translation table. 


— When changing from a larger size to a smaller size, for example by replacing a block mapping with a 
table mapping in a stage 2 translation table. 


. A change of the output address (OA), if the contents of memory at the new OA do not match the contents of 
memory at the previous OA. 


è Creating a global entry when there might be non-global entries in a TLB that overlap with that global entry. 
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A break-before-make sequence on changing from an old translation table entry to a new translation table entry 
requires the following steps: 


1. Replace the old translation table entry with an invalid entry, and execute a DSB instruction. 


2; Invalidate the translation table entry with a broadcast TLB invalidation instruction, and execute a DSB 
instruction to ensure the completion of that invalidation. 


3. Write the new translation table entry, and execute a DSB instruction to ensure that the new entry is visible. 


This sequence ensures that at no time are both the old and new entries simultaneously visible to different threads of 
execution, and therefore the problems described at the start of this subsection cannot arise. 


In Armv8.1, with the introduction of hardware updates to the translation table entries, the effects of not following 
the break-before-make rules are extended. 


If the break-before-make rules are not followed for changing the translation table entries, the Armv8.1 architecture 
permits that the following failures associated with the hardware updates of the translation table entries could occur: 


è The Access flag is not set on such a translation table entry despite the fact that the memory location associated 
with that entry was accessed. 


° The AP[2] or S2AP[1] bit is modified by the hardware on such a translation table entry despite the fact that 
the memory location associated with that entry was not written to. 


$ The AP[2] or S2AP[1] bit is not modified by the hardware on such a translation table entry despite the fact 
that the memory location associated with that entry was written to. 


° The ordering required between hardware updates to such a translation table entry and stores appearing later 
in program order is not followed. 


Support levels for changing block size 


If ARMv8.4-TTRem is implemented, the PE provides three levels of support when changing block size, without 
changing any other parameters that require break-before-make: 


Level 0 Software must use break-before-make to avoid breaking coherency, ordering guarantees or 
uniprocessor semantics, or failing to clear the Exclusives monitors when changing block size. See 
Using break-before-make when updating translation table entries on page D5-2639. 


Level 1 Software can use the level 0 approach, or software can use the nT block translation entry to avoid 
breaking coherency, ordering guarantees or uniprocessor semantics, or failing to clear the 
Exclusives monitors when changing block size. See Block translation entry on page D5-2589. 


Level 2 Software can use the level 0 or level 1 approach and, in addition, changing block size does not break 
coherency, ordering guarantees or uniprocessor semantics, or fail to clear the Exclusives monitors. 
If there has not been a TLB invalidation of the entries that have changed since the writes that 
changed those entries were completed, this change might cause Conflict aborts. This is because 
multiple translation entries might exist within the TLB for the same input address. 


In addition, an implementation that uses the level 1 or level 2 approach supports the following without breaking 
coherency, ordering guarantees or uniprocessor semantics, or failing to clear the Exclusives monitors: 


: A change to a set of blocks or pages from having the Contiguous bit set to having the Contiguous bit not set. 
è A change to a set of blocks or pages from having the Contiguous bit not set to having the Contiguous bit set. 


If multiple translation entries exist within the TLB for the same input address, this change might cause Conflict 
aborts when translating the address. 


If a Conflict abort is detected in a translation regime for which stage 2 translations are enabled, the Conflict abort 
is reported to EL2. 
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Clearing entries associated with a Conflict abort 


While using level 1 or level 2 support, on a Conflict abort, the following instructions are guaranteed to clear the 
entries associated with the conflict: 


: For the EL1&0 Translation regime, while stage 2 translations are in use: TLBI VMALLS12E1, TLBI ALLE1. 
7 For the EL1&0 Translation regime, while stage 2 translations are not in use: TLBI VMALLE1, TLBI ALLE1. 
è For the EL2&0 Translation regime: TLBI VMALLE1, TLBI ALLE1. 

s For the EL2 Translation regime: TLBI ALLE2. 

$ For the EL3 Translation regime: TLBI ALLE3. 


D5.10.2 TLB maintenance instructions 


The architecture defines TLB maintenance instructions, that provide the following: 
7 Invalidate all entries in the TLB. 

à Invalidate a single TLB entry by ASID for a non-global entry. 

è Invalidate all TLB entries that match a specified ASID. 

: Invalidate all TLB entries that match a specified VA, regardless of the ASID. 
° Invalidate all TLB entries within a range of addresses. 


Each instruction can be specified as applying only to the PE that executes the instruction, or as applying to all PEs 
in the same shareability domain as the PE that executes the instruction. 


The following subsubsections describe these instructions: 

° TLB maintenance instruction syntax. 

e Operation of the TLB maintenance instructions on page D5-2645. 

° Scope of the A64 TLB maintenance instructions on page D5-2646. 

° TLB range maintenance instructions on page D5-2649. 

. Invalidation of TLB entries from stage 2 translations on page D5-2650. 

. Broadcast TLB maintenance between AArch32 and AArch64 on page D5-2651. 


. Broadcast TLB maintenance with different translation granule sizes on page D5-2652. 
s Ordering and completion of TLB maintenance instructions on page D5-2653. 

° TLB maintenance in the event of TLB conflict on page D5-2653. 

° The interaction of TLB lockdown with TLB maintenance instructions on page D5-2654. 


TLB maintenance instructions on page C5-369 describes the encoding of the TLB maintenance instructions. 


TLB maintenance instruction syntax 

The A64 syntax for TLB maintenance instructions is: 
TLBI <operation>{, <Xt>} 

Where: 


<operation> Is one of ALLE1, ALLE2, ALLE3, ALLELIS, ALLE2IS, ALLE3IS, ALLE10S, ALLE20S, ALLE30S, VMALLE1, 
VMALLE1IS, VMALLE10S, VMALLS12E1, VMALLS12E1IS, VMALLS12E10S, ASIDE1, ASIDE1IS, ASIDE10S, 
{R}VA{L}EL, {R}VA{L}E2, {RIVA{L}E3, {R}VA{L}ELIS, {R}VA{L}EZIS, {R}VA{L}E3IS, {R}VA{L}ELOS, 
{R}VA{L}E20S, {R}VA{L}E30S, {R}VAA{L}E1, {R}VAA{L}E1IS, {R}VAA{L}E10S, {R}IPAS2{L}E1, 
{R}IPAS2{L}E1IS, or {R}IPAS2{L}E10S. 
<operation> has a structure of {R}<type><level><shareability> where: 
R When present, indicates that the function applies to all TLBs that are within a 

determined address range, see TLB range maintenance instructions on page D5-2649. 


When not present, indicates that the function applies to all TLBs at a single address that 
contain entries that could be used by the PE that executes the TLBI instruction. 


<type> Is one of: 
ALL All translations used at <level>. 
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For the scope of ALL instructions see ALL on page D5-2646. 
The ALL instructions are valid for all values of <level>. 
VMALL All stage 1 translations used at <level> with the current VMID, if 
appropriate. 
For the scope of the VMALL instructions see VMALL on page D5-2646. 
The VMALL instructions are valid only when level == E1. 
VMALLS12 All stage 1 and stage 2 translations used at EL1 with the current VMID, if 
appropriate. 
For the scope of the VMALLS12 instructions see VMALLS12 on page D5-2646. 
The VMALLS12 instructions are valid only when level == E1. 
ASID All translations used at EL1 with the supplied ASID. 
For the scope of the ASID instructions see AS/D on page D5-2647. 
The ASID instructions are valid only when level == E1. 


VA{L} Translations used at <level> for the specified address and, if appropriate, the 
specified ASID. 


For the scope of the VA instructions see VA on page D5-2647. For the scope 
of the VAL instructions see VAL on page D5-2647. 
The VA{L} instructions are valid for all values of <level>. 

VAA{L} Translations used at <level> for the specified address, for all ASID values, 
if appropriate. 
For the scope of the VAA instructions see VAA on page D5-2648. For the 
scope of the VAAL instructions see VAAL on page D5-2648. 
The VAA{L} instructions are valid only when level == E1. 

IPAS2{L} Translations used at <level> for the specified IPA that are held in stage 2 
only caching structures. 
For the scope of the IPAS2 instructions see /P4S2 on page D5-2648. For the 
scope of the IPAS2L instructions see JPAS2L on page D5-2648 
The IPAS2{L} instructions are valid only when level == E1. 

In the VA{L}, VAA{L}, and IPAS2{L} types: 








L An optional parameter that indicates that the invalidation only applies to 
caching of entries returned from the final lookup level of the translation 
table walk. 

<level> Defines the Exception level of the translation regime that the invalidation applies to. Is 
one of: 

E1 ELI. 

E2 EL2. 

E3 EL3. 

An instruction that applies to the translation regime of an Exception level higher than 

the Exception level at which the instruction is executed is UNDEFINED. 

TLBI ALLE1, TLBI ALLE1IS, TLBI ALLE10S, TLBI {R}IPAS2{L}E1, TLBI {R}IPAS2{L}E1IS, TLBI 

{R}IPAS2{L}E10S, TLBI VMALLS12E1, TLBI VMALLS12E11S, and TLBI VMALLS12E10S are 

UNDEFINED at EL1. 

Note 

All TLB maintenance instructions are UNDEFINED at ELO. 

<shareabi lity> 

Is one of: 

Is When present, it indicates that the function applies to all TLBs in the Inner 
Shareable shareability domain. 

os When present, it indicates that the function applies to all TLBs in the Outer 
Shareable shareability domain. 
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<blank> When no shareability is present, it indicates that the function applies to all 
TLBs that contain entries that could be used by the PE that executes the 
TLBI instruction. 


Note 

When a TLB entry has been invalidated for one PE, it is not consistent with the 
architecture to allow another PE to refill that TLB entry where the new entry might give 
the appearance to software that the invalidation has not occurred. 








<Xt> Passes one or both of an address and an ASID as an argument, where required. <Xt> is required for 
the TLB ASID, TLB VA{L}, TLB VAA{L}, and TLB IPAS2{L} instructions. 


If EL2 is not implemented, the TLBI VA{L}E2, TLBI VA{L}E2IS, TLBI VA{L}E20S, TLBI ALLE2, TLBI ALLE2IS, TLBI 
ALLE20S, TLBI RVA{L}E2, TLBI RVA{L}E2IS, and TLBI RVA{L}E20S instructions are UNDEFINED. 


VMSAv8-64 TLB maintenance instructions that take a register argument that holds a VA, an ASID, or both, and 
that do not apply to a range of addresses, use the register argument format: 


Bits[63:48] ASID. These bits are RESO if the instruction does not require an ASID argument. 


Bits[47:44] TTL. Indicates the level of the translation table walk that holds the leaf entry for the address being 
invalidated, see Translation table level hints on page D5-2644. This field is RESO if the instruction 
does not require an VA argument, or if ARMv8.4-TTL is not implemented. 


Bits[43:0] VA[55:12]. For an instruction that requires a VA argument, the treatment of the low-order bits of 
this field depends on the translation granule size, as follows: 


4KB granule size All bits are valid and used for the invalidation. 


16KB granule size Bits[1:0] RESO and ignored when the instruction is executed, because 
VA[13:12] have no effect on the operation of the instruction. 


64KB granule size _ Bits[3:0] are RESO and ignored when the instruction is executed, because 
VA[15:12] have no effect on the operation of the instruction. 


These bits are RESO if the instruction does not require a VA argument. 


For TLB maintenance instructions that take an address argument, hardware interprets VA[63:56] as each having the 
same value as VA[55]. 


Ifa TLB maintenance instruction targets a translation regime that is using AArch32, meaning the VA is only 32-bit, 
then software must treat VA[55:32] as RESO, and these bits are ignored when the instruction is executed. 


If the implementation supports 16 bits of ASID then the upper 8 bits of the ASID are RESO when the context being 
invalidated only uses 8 bits. 


VMSAv8-64 TLB maintenance instructions that take a register argument that holds an IPA, and that do not apply to 

a range of addresses, use the register argument format: 

Bits[63:48] RESO. 

Bits[47:44] TTL. Indicates the level of the translation table walk that holds the leaf entry for the address being 
invalidated, see Translation table level hints on page D5-2644. This field is RESO if the instruction 
does not require an IPA argument, or if ARMv8.4-TTL is not implemented. 

Bits[43:36] RESO. 

Bits[35:0] IPA[47:12]. For an instruction that requires a VA argument, the treatment of the low-order bits of 
this field depends on the translation granule size, as follows: 
4KB granule size All bits are valid and used for the invalidation. 
16KB granule size Bits[1:0] RESO and ignored when the instruction is executed, because 

IPA[13:12] have no effect on the operation of the instruction. 
64KB granule size _ Bits[3:0] are RESO and ignored when the instruction is executed, because 
IPA[15:12] have no effect on the operation of the instruction. 


For the register argument format of TLB instructions that apply to a range of addresses, see TLB range maintenance 
instructions on page D5-2649, 
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Translation table level hints 


When ARMvV8.4-TTL is implemented, the TTL field indicates the level of page table walk holding the leaf entry for 
the address being invalidated. Hardware can use this information to determine if there was a risk of splintering. 


If an incorrect value for the entry being invalidated by the instruction is specified in the TTL field, then no entries 
are required by the architecture to be invalidated from the TLB. 


The TTL field in TLB maintenance instructions that take a register argument that holds a VA or an IPA, and that do 
not apply to a range of addresses, use the encodings in Table D5-53. 


Table D5-53 TTL field encodings in TLB instructions that apply to a single address 





TTL[3:2]  TTL[1:0] 


Information supplied 












































00 RESO No information supplied about the translation level. 
Hardware must assume that the entry can be from any level. 
01 00 The entry comes from a 4KB translation granule. 
This value is reserved, and hardware should treat this as if TTL[3:2] is @b00. 
01 The entry comes from a 4KB translation granule. 
The leaf entry for the address being invalidated is on level 1 of the page table walk. 
10 The entry comes from a 4KB translation granule. 
The leaf entry for the address being invalidated is on level 2 of the page table walk. 
11 The entry comes from a 4KB translation granule. 
The leaf entry for the address being invalidated is on level 3 of the page table walk. 
10 00 The entry comes from a 16KB translation granule. 
This value is reserved, and hardware should treat this as if TTL[3:2] is @b00. 
01 The entry comes from a 16KB translation granule. 
This value is reserved, and hardware should treat this as if TTL[3:2] is @b00. 
10 The entry comes from a 16KB translation granule. 
The leaf entry for the address being invalidated is on level 2 of the page table walk. 
11 The entry comes from a 16KB translation granule. 
The leaf entry for the address being invalidated is on level 3 of the page table walk. 
11 00 The entry comes from a 64KB translation granule. 
This value is reserved, and hardware should treat this as if TTL[3:2] is @b00. 
01 The entry comes from a 64KB translation granule. 
The leaf entry for the address being invalidated is on level 1 of the page table walk. 
10 The entry comes from a 64KB translation granule. 
The leaf entry for the address being invalidated is on level 2 of the page table walk. 
11 The entry comes from a 64KB translation granule. 
The leaf entry for the address being invalidated is on level 3 of the page table walk. 
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The TTL field in TLB maintenance instructions that take a register argument that holds a VA or an IPA, and that do 
not apply to a range of addresses, use the encodings in Table D5-54. 


Table D5-54 TTL field encodings in TLB instructions that apply to multiple addresses 





TTL Information supplied 





00 The entries in the range can be using any level for the translation table entries. 





01 When using a 4KB or 64KB translation granule, all entries to invalidate are Level 1 translation 
table entries. 


When using a 16KB translation granule, this value is reserved, and hardware should treat the TTL 
field as Qb00. 





10 All entries to invalidate are Level 2 translation table entries. 





11 All entries to invalidate are Level 3 translation table entries. 





Operation of the TLB maintenance instructions 


Any TLB maintenance instruction can affect any TLB entries that are not locked down. 


The TLB maintenance instructions specify the Exception level of the translation regime to which they apply. 


Note 





Because there is no guarantee that an unlocked TLB entry remains in the cache, architecturally it is not possible to 
tell whether a TLB maintenance instruction has affected any TLB entries that were not specified by the instruction. 





Ifa TLB maintenance instruction specifies a VA, and a data or instruction access to that VA would generate an MMU 
abort, the TLB maintenance instruction does not generate an abort. VAs for which a TLB maintenance instruction 
does not generate an abort include VAs that are not in the range of VAs that can be translated. 


When EL3 is implemented: 


The TLB maintenance instructions that apply to the EL1&0 translation regime take account of the current 
Security state, as part of the address translation required for the TLB operation. 
SCR_EL3.NS modifies the effect of the TLB maintenance instructions as follows: 


— For instructions that apply to the EL1&0 translation regime, the SCR_EL3.NS bit identifies whether 
the maintenance instructions apply to the Secure or Non-secure EL1&0 translation regime. 


Note 


If EL3 is not implemented, then there is only a single EL1&0 translation regime. 








— When SCR_EL3.EEL2 is 0 instructions that apply to the EL2 translation regime, or to the EL2&0 
translation regime, the SCR_EL3.NS bit must be 1 or the instruction is UNDEFINED. 


— For instructions that apply to the EL3 translation regime, the SCR_EL3.NS bit has no effect. 





Note 


An address-based TLB maintenance instruction that applies to the Inner Shareable domain or the Outer 
Shareable domain does so regardless of the Shareability attributes of the address supplied as an argument to 
the instruction. 


Previous versions of the Arm architecture included TLB maintenance instructions that operated only on 
instruction TLBs, or only on data TLBs. From the introduction of Armv7, Arm deprecated any use of these 
instructions. In Armv8: 


—  AArch64 state does not include any of these instructions. 
—  AArch32 state includes some of these instructions, but Arm deprecates their use. 
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The Arm architecture does not dictate the form in which the TLB stores translation table entries. However, when a 
TLB maintenance instruction is executed, the minimum size of the table entry that is invalidated from the TLB must 
be at least the size that appears in the translation table entry. 


Note 


The Contiguous bit does not affect the minimum size of entry that must be invalidated from the TLB. 








Scope of the A64 TLB maintenance instructions 
The TLB invalidation instruction <type> affects the different possible cached entries in the TLB as follows: 


ALL The invalidation applies to all cached copies of the stage 1 and stage 2 translation table entries from 
any level of the translation table walk required to translate any address at the specified Exception 
level, that would be used with the state specified by SCR_EL3.NS and SCR_EL3.EEL2. 


For entries from the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, ALL 
applies to entries with any VMID. 


For entries from a translation regime for which an ASID is valid, the invalidation applies to: 





. All entries above the final level of lookup. 
. All entries at the final level of lookup. 
Note 


This means the invalidation applies to both: 
— Global entries. 
— Non-global entries with any ASID. 


VMALL The invalidation applies to all cached copies of the stage 1 translation table entries, from any level 
of the translation table walk required to translate any address at the specified Exception level, that 
would be used with all of: 

° The Security state specified by SCR_EL3.NS and SCR_EL3.EEL2. 
. For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, the current 
VMID. 


For entries from a translation regime for which an ASID is valid that meet the other specified 
conditions, the invalidation applies to: 


. All entries above the final level of lookup. 
° All entries at the final level of lookup. 
Note 





This means the invalidation applies to both: 
— Global entries. 
— Non-global entries with any ASID. 





VMALL is valid for: 
. EL1. 
. EL2, when HCR_EL2.{E2H, TGE} is {1, 1}. 


VMALLS12 The invalidation applies to all cached copies of the stage 1 and stage 2 translation table entries from 
any level of the translation table walk required to translate any address at the specified Exception 
level, that would be used with all of: 

° The Security state specified by SCR_EL3.NS and SCR_EL3.EEL2. 

. For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, the current 
VMID. 

For entries from a translation regime for which an ASID is valid that meet the other specified 

conditions, the invalidation applies to: 

. All entries above the final level of lookup. 
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° All entries at the final level of lookup. 


Note 


This means the invalidation applies to both: 





— Global entries. 
— Non-global entries with any ASID. 





VMALLS12 is valid for EL1. 


If EL2 is not implemented, or if the TLBI VMALLS12 instruction is executed when the value of 
SCR_EL3.NS is 0 and EL2 is disabled, the instruction is not UNDEFINED but it has the same effect 
as TLBI VMALL. This is because there are no stage 2 translations to invalidate. 


ASID The invalidation applies to all cached copies of the stage 1 translation table entries from any level 
of the translation table walk required to translate any address at the specified Exception level, that 
would be used with all of: 

° The Security state specified by SCR_EL3.NS and SCR_EL3.EEL2. 
. For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, the current 
VMID. 


For entries from a translation regime for which an ASID is valid that meet the other specified 
conditions, the invalidation applies only if either: 


à The entry is from a level of lookup above the final level and matches the specified ASID. 

è The entry is a non-global entry from the final level of lookup and matches the specified 
ASID. 

ASID is valid for: 

. ELI. 


© EL2, when HCR_EL2. {E2H, TGE} is {1, 1}. 


VA The invalidation applies to all cached copies of the stage 1 translation table entries from any level 
of the translation table walk required to translate the address specified in the invalidation instruction 
at the specified Exception level that would be used with all of: 

° The Security state specified by SCR_EL3.NS and SCR_EL3.EEL2. 
° For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, the current 
VMID. 


For entries from a translation regime for which an ASID is valid that meet the other specified 
conditions, the invalidation applies only if one of the following applies: 


s The entry is from a level of lookup above the final level and matches the specified ASID. 
5 The entry is a global entry from the final level of lookup. 
à The entry is a non-global entry from the final level of lookup that matches the specified 
ASID. 
VAL The invalidation applies to all cached copies ofthe stage 1 translation table entry from the final level 


of the translation table walk required to translate the address specified in the invalidation instruction 
at the specified Exception level, that would be used with all of: 


° The Security state specified by SCR_EL3.NS and SCR_EL3.EEL2. 


° For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, the current 
VMID. 


For entries from a translation regime for which an ASID is valid that meet the other specified 
conditions, the invalidation applies only if either: 


` The entry is a global entry from the final level of lookup. 


G The entry is a non-global entry from the final level of lookup that matches the specified 
ASID. 
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VAA 


VAAL 


IPAS2 


IPAS2L 
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The invalidation applies to all cached copies of the stage 1 translation table entries from any level 
of the translation table walk required to translate the address specified in the invalidation instruction 
at the specified Exception level that would be used with all of: 


° The Security state specified by SCR_EL3.NS and SCR_EL3.EEL2. 
° For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, the current 
VMID. 


For entries from a translation regime for which an ASID is valid that meet the other specified 
conditions, the invalidation applies to all of: 





. All entries above the final level of lookup. 
° All entries at the final level of lookup. 
Note 


This means the invalidation applies to both: 
— Global entries. 
— Non-global entries with any ASID. 





The invalidation applies to all cached copies ofthe stage 1 translation table entry from the final level 
of the translation table walk required to translate the address specified in the invalidation instruction 
at the specified Exception level that would be used with all of: 


° The Security state specified by SCR_EL3.NS and SCR_EL3.EEL2. 


. For the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime, the current 
VMID. 


For entries from a translation regime for which an ASID is valid that meet the other specified 
conditions, the invalidation applies to all entries at the final level of lookup. 


Note 


This means the invalidation apples to both: 





$ Global entries. 
. Non-global entries with any ASID. 





The invalidation applies to all cached copies of the stage 2 translation table entries from any level 
of the translation table walk required to translate the specified IPA, that both: 


e Are held in TLB caching structures holding stage 2 only entries. 
° Would be used with the current VMID. 


It is not required that this instruction invalidates TLB caching structures holding entries that 
combine stage 1 and stage 2 of the translation. 


The only translation regime to which this instruction can apply is the Secure or Non-secure EL1&0, 
when EL2 is enabled, translation regime. 


When executed with the SCR_EL3.NS == 0, or in an implementation that does not implement EL2, 
this instruction is a NOP. 


For more information about the architectural requirements for the IPAS2 instruction see Jnvalidation 
of TLB entries from stage 2 translations on page D5-2650. 


The invalidation applies to cached copies of the stage 2 translation table entry from the final level 
of the stage 2 translation table walk required to translate the specified IPA, that both: 


° Are held in TLB caching structures holding stage 2 only entries. 
$ Would be used with the current VMID. 


It is not required that this instruction invalidates TLB caching structures holding entries that 
combine stage 1 and stage 2 of the translation. 


The only translation regime to which this instruction can apply is the Secure or Non-secure EL1&0, 
when EL2 is enabled, translation regime. 


When executed with the SCR_EL3.NS == 0, or in an implementation that does not implement EL2, 
this instruction is a NOP. 
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For more information about the architectural requirements for the IPAS2L instruction see 
Invalidation of TLB entries from stage 2 translations on page D5-2650. 


The entries that the invalidations apply to are not affected by the state of any other control bits involved in the 
translation process. Therefore, the following is a non-exhaustive list of control bits that do not affect how a TLB 
maintenance instruction updates the TLB entries: 


In AArch64 state 


SCTLR_ELI.M, SCTLR_EL2.M, SCTLR_EL3.{M, RW], HCR EL2.{VM, RW}, 
TCR_EL1.{TG1, EPD1, T1SZ, TGO, EPDO, TOSZ, AS, Al}, TCR_EL2.{TGO, TOSZ}, 
TCR EL3.{TGO, TOSZ}, VICR_EL2.{SLO, TOSZ}, TTBRO_EL1.ASID, TTBR1_EL1.ASID. 


In AArch32 state 


SCTLR.M, HCR.VM, TTBCR. {EAE, PD1, PDO, N, EPD1, T1SZ, EPDO, TOSZ, A1}, 
HTCR.TOSZ, VTCR. {SLO, TOSZ}, TTBRO.ASID, TTBR1.ASID, CONTEXTIDR.ASID. 


Note 


. Arm expects most TLB maintenance performed by an operating system to occur to the last level entries of 
the stage 1 translation table walks, and the purpose of the address-based TLB invalidation instructions where 
the invalidation need only apply to caching of entries returned from the last level of translation table walk of 
stage 1 translation is to avoid unnecessary loss of the intermediate caching of the translation table entries. 
Similarly, for stage 2 translations Arm expects that most TLB maintenance performed by a hypervisor for a 
given Guest operation system will affect only the last level entries of the stage 2 translations. Therefore, 
similar capability is provided for instructions that invalidate single stage 2 entries. 





7 The architecture permits the invalidation of entries in TLB caching structures at any time, so for each of these 
instructions the definition is in terms of the minimum set of entries that must be invalidated from TLB 
caching structures, and an implementation might choose to invalidate more entries. In general, for best 
performance, Arm recommends not invalidating entries that are not required to be invalidated. 


° Dependencies on the VMID for the Secure or Non-secure EL1&0, when EL2 is enabled, translation regime 
apply even when the value of HCR_EL2.VM is 0. The VTTBR_EL2.VMID field resets to a value that is 
architecturally UNKNOWN, and therefore VTTBR_EL2.VMID[7:0] must be set to a known value, that might 
be zero, as part of the PE initialization sequence, even if stage 2 translation is not in use. 





TLB range maintenance instructions 


Specific TLB invalidation instructions apply to a range of input addresses rather than a single address. All TLB 
range maintenance instructions invalidate TLB entries that are within the address range determined by the formula: 
[BaseADDR <= input_address < BaseADDR + ((NUM +1)#2A(5xSCALE +1) » Translation_Granule_Size)]. 


Note 


The set of masters containing TLBs that can be affected by the TLB range maintenance instructions are defined by 
the system architecture. This means that all masters in a system might not contain TLBs within the defined 
shareability domains. 





VMSAv8-64 TLB range maintenance instructions that take a register argument that holds a VA, or a VA and an 
ASID, use the following register argument format: 


Bits[63:48] ASID. These bits are RESO if the instruction does not require an ASID argument. 


Bits[47:46] TG. This field gives the translation granule size for the translations that are being invalidated. If the 
translations use a different translation granule size than the one specified, then the architecture does 
not require that the instruction invalidates any entries. 


Bits[45:44] | SCALE. This field gives the exponent element of the calculation that is used to produce the upper 
range. 


Bits[43:39] | NUM. This field gives the base element of the calculation that is used to produce the upper range. 
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Bits[38:37] 


Bits[36:0] 


TTL level hint, see Translation table level hints on page D5-2644. This field is RESO if the 
instruction does not require a VA argument, or if ARMv8.4-TTL is not implemented. 
BaseADDR. This field gives the starting address for the range of the maintenance instruction. 
4KB granule size BaseADDR[48:12]. 

16KB granule size =BaseADDR[50:14]. 

64KB granule size BaseADDR[52:16]. 


VMSAv8-64 TLB range maintenance instructions that take a register argument that holds an IPA, use the following 
register argument format: 


Bits[63] 


Bits[62:48] 


Bits[47:46] 


Bits[45:44] 


Bits[43:39] 


Bits[38:37] 


Bits[36:0] 


NS. This bit is RESO if the instruction is executed in Non-secure state. 
RESO. 


TG. This field gives the translation granule size for the translations that are being invalidated. If the 
translations use a different translation granule size than the one specified, then the architecture does 
not require that the instruction invalidates any entries. 


SCALE. This field gives the exponent element of the calculation that is used to produce the upper 
range. 


NUM. This field gives the base element of the calculation that is used to produce the upper range. 


TTL level hint, see Translation table level hints on page D5-2644. This field is RESO if the 
instruction does not require a VA argument, or if ARMv8.4-TTL is not implemented. 
BaseADDR. This field gives the starting address for the range of the maintenance instruction. 
4KB granule size BaseADDR[48:12]. 

16KB granule size BaseADDR[50:14]. 

64KB granule size BaseADDR[52:16]. 


The range of addresses invalidated is UNPREDICTABLE when: 


° When a 4K translation granule used, if the TTL field is 0b01 and BaseADDR[29:12] does not equal 
0b000000000000000000. 


° When a 4K translation granule used, if the TTL field is 0b10 and BaseADDR[20:12] does not equal 
0b000000000. 


e When a 16K translation granule used, if the TTL field is 0b10 and BaseADDR[24:12] does not equal 
0b00000000000. 


° When a 64K translation granule used, if the TTL field is 0b01 and BaseADDR[41:16] does not equal 
0b00000000000000000000000000. 


e When a 64K translation granule used, if the TTL field is 0b10 and BaseADDR[28:16] does not equal 
0b0000000000000. 


Invalidation of TLB entries from stage 2 translations 


The architectural requirements of the IPAS2 instruction are that: 


1. The following code is sufficient to invalidate all cached copies of the stage 2 translation of the IPA held in Xt 
for the current VMID, with the corresponding requirement for the broadcast versions of the instructions: 


TLBI IPAS2E1, Xt 


DSB 


TLBI VMALLE1 


2, The following code is sufficient to invalidate all cached copies of the stage 2 translations of the IPA held in 
Xt used to translate the VA (and the specified ASID when executing TLBI VAE1) held in Xt2, with the 
corresponding requirement for the broadcast versions of the instructions: 
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TLBI IPAS2E1, Xt 


DSB 
TLBI VAE1, Xt2 ; or TLBI VAAE1, Xt2 
3; The following code is sufficient to invalidate all cached copies of the stage 2 translations of the IPA held in 


Xt used to translate the IPA produced by the last level of stage 1 translation table lookup for the VA (and ASID 
when executing TLBI VALE1) held in Xt2, with the corresponding requirement for the broadcast versions of the 





instructions: 

TLBI IPAS2E1, Xt 

DSB 

TLBI VALE1, Xt2 ; or TLBI VAALE1, Xt2 
Note 


Depending on the invalidation required, software must use the entire sequence 1, 2, or 3, even when Secure or 
Non-secure EL1&0, when EL2 is enabled, stage 1 translation is disabled. 





Equivalent architectural requirements apply to the IPAS2L instruction, except that the only TLB entries that must be 
invalidated by an IPAS2L instruction are those that come from the final level of the translation table lookup. 


Broadcast TLB maintenance between AArch32 and AArch64 


In most cases, a TLB maintenance instruction affecting the shareability domain executed by a PE in an Exception 
level that is using AArch64 also affects any other PE in the same shareability domain that is executing at the same 
Exception level and is using AArch32, provided that the address, qualify the scope of the ASID and VMID matching 
requirements of the original instruction are met, as specified in Scope of the A64 TLB maintenance instructions on 
page D5-2646. 


Note 
The requirement to match means that the invalidation only occurs on the PE that is using AArch32 if, for the PE 
that executed the TLB maintenance instruction at an Exception level that is using AArch64, both of the following 
apply: 
: If VA matching is required, the VA is 0x0000FFFFFFFF or lower in the memory map. 
a If ASID matching is required and the PE is using a 16-bit ASID, then the top 8 bits of the ASID are zero. 








Except for the cases identified here, a TLB maintenance instruction affecting the Inner Shareable shareability 
domain executed by a PE in an Exception level that is using AArch32 also affects any other PE in the same Inner 
Shareable domain that is executing at the same Exception level and is using AArch64, provided that the address, 
ASID, and VMID matching requirements of the original instruction are met, as specified in Scope of the A64 TLB 
maintenance instructions on page D5-2646. In addition, for the instruction executed in AArch372 state: 


è For a TLBIMVAAIS, TLBIMVAALIS, TLBIMVAHIS, TLBIMVAIS, TLBIMVALHIS, or TLBIMVALIS instruction, the VA supplied 
as an argument is zero-extended. 


è For a TLBIIPAS2IS or TLBIIPAS2LIS instruction, the IPA supplied as an argument is zero-extended. 


: For a TLBIASIDIS, TLBIMVAIS, or TLBIMVALIS instruction, the ASID supplied as an argument is zero-extended if 
the PE executing in AArch64 state is using a 16-bit ASID. 


The VA from the instruction executed in AArch32 state is zero-extended, and the ASID is zero-extended if the PE 
executing in AArch64 state is using a 16-bit ASID. 
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The exceptions to these general rules are as follows: 


1. 


An Armv7 PE in the same Inner Shareable domain is treated in the same way as an Armv8 PE for which EL3 
is using AArch32, except that if an Armv8 PE issues a broadcast instruction that is not defined in Armv7, 
then that instruction is not required to have an effect on the TLBs of the Armv7 PE. The instructions that do 
not exist in Armv7 include the following TLB maintenance instructions that Armv8 adds to the T32 and A32 
instruction sets: 


. The following instructions that operate on TLB entries for the final level of translation table walk for 
stage | translations: 


TLBIMVALIS, TLBIMVAALIS, TLBIMVALHIS, TLBIMVAL, TLBIMVAAL, and TLBIMVALH. 


= The following instructions that operate by IPA on TLB entries for stage 2 translations: 
TLBIIPAS2IS, TLBIIPAS2LIS, TLBIIPAS2, and TLBIIPASZL. 


The number of Exception levels in Secure state depends on whether EL3 is using AArch32 or EL3 is using 
AArché64. This means that, within the Inner Shareable domain, there might be PEs with different numbers of 
Exception levels in Secure state. Therefore, the following exceptions are made to the general rules: 


$ Ifa PE with EL3 using AArch32 issues a broadcast AArch32 TLB maintenance instruction affecting 
Secure entries, and the Inner Shareable domain also contains PEs with EL3 using AArch64, then the 
architecture does not require that the broadcast AArch32 TLB maintenance instruction has any effect 
on either: 


— The EL3 translation regime of the PEs with EL3 using AArch64. 


— The Secure or Non-secureEL1&0, when EL2 is disabled, translation regime of the PEs with 
EL3 using AArch64, regardless of whether the Secure or Non-secure EL1&0, when EL2 is 
disabled, translation regime is using AArch64 or AArch32. 


= Ifa PE with EL3 using AArch64 issues a broadcast AArch64 TLB maintenance instruction affecting 
EL3 entries, and the Inner Shareable domain also contains PEs with EL3 using AArch32, then the 
architecture does not require that the broadcast AArch64 TLB maintenance instruction has any effect 
on the EL3 translation regime of the PEs with EL3 using AArch32. 


- Ifa PE with EL3 using AArch64 issues a broadcast AArch64 TLB maintenance instruction affecting 
Secure EL1 entries, and the Inner Shareable domain also contains PEs with EL3 using AArch32 then 
the architecture does not require that the broadcast AArch64 TLB maintenance instruction has any 
effect on the EL3 translation regime of the PEs with EL3 using AArch32. 





Note 


While the exceptions to the general rule mean the architecture does not require the specified TLB invalidations, the 
architecture also does not require that entries in the TLB remain in the TLB at any time, and so it is permissible that 
such broadcast instructions affect these translation regimes. 


Broadcast TLB maintenance with different translation granule sizes 


In the following cases, a broadcast TLB maintenance instruction is not required to perform any invalidation on the 
recipient PE: 


The TLB maintenance instruction specifying a VA and affecting the EL2 translation regime, the EL2&0 
translation regime, or the EL3 translation regime is broadcast from a PE using one translation granule size 
for that translation regime to a PE using a different translation granule size for that same translation regime 


The TLB maintenance instruction specifying a VA and affecting the EL1&0 translation regime is broadcast 
from a PE using one stage 1 translation granule size for that translation regime for a particular ASID (if 
applicable), VMID (if applicable), and Security state, to a PE where EL1 for the same ASID (if applicable), 
VMID (if applicable), and Security state, is using a different stage 1 translation granule size. 


The TLB maintenance instruction specifying a VA and affecting the Secure or Non-secure EL1&0, when 
EL2 is enabled, translation regime is broadcast from a PE using one stage 2 translation granule size for a 
particular ASID (if applicable) and VMID, to a PE where EL1 for the same ASID (if applicable) and VMID 
is using a different stage 2 translation granule size. 
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è The TLB maintenance instruction specifying an IPA and affecting the Secure or Non-secure EL1&0, when 
EL2 is enabled, translation regime is broadcast from a PE using one stage 2 translation granule size for a 
particular VMID to a PE where EL1 for the same VMID is using a different stage 2 translation granule size. 

Ordering and completion of TLB maintenance instructions 


For AArch64 execution, a TLB maintenance instruction can be executed in any order relative to: 


° Any load or store instruction, unless a DSB is executed between the load or store and the TLB maintenance 
instruction. 





Note 


In the Arm architecture, a translation table walk is considered to be a separate observer, and a store to the 
translation tables can be observed by that separate observer at any time after the instruction has been 
executed, but is only guaranteed to be observable after the execution of a DSB instruction by the PE that 
executed the store to the translation tables. 





° Another TLB maintenance instruction, unless a DSB is executed between the instructions. 
° A data or instruction cache maintenance instruction, unless a DSB is executed between the instructions. 
For AArch64 execution, the completion rules are: 


. A TLB invalidate instruction is complete when all memory accesses using the TLB entries that have been 
invalidated are complete. 


After the TLB invalidate instruction is complete, no new memory accesses using the invalidated TLB entries 
will be architecturally performed by any observer that is affected by the TLB invalidation. 





Note 


This requirement does not mean that speculative memory accesses cannot be performed using those entries 
if it is impossible for software running on any observer to tell that those memory accesses have been 
performed. 





: A TLB maintenance instruction can complete at any time after it is issued, but is only guaranteed to be 
complete after the execution of DSB by the PE that executed the TLB maintenance instruction. 


è The effects of a completed TLB maintenance instruction are only guaranteed to be visible on the PE that 
executed the instruction after the execution of a Context synchronization event by the PE that executed the 
TLB maintenance instruction. 


In all cases in this section where a DMB or DSB is referred to, it refers to a DMB or DSB whose required access type is 
both loads and stores. A DSB NSH is sufficient to ensure completion of TLB maintenance instructions that apply to a 
single PE. A DSB ISH is sufficient to ensure completion of TLB maintenance instructions that apply to PEs in the 
same Inner Shareable domain. 


TLB maintenance in the event of TLB conflict 


In the event that multiple entries in the TLB are being used to translate a given address (which implies that an 
attempt to access the given address might give rise to a TLB Conflict abort), it is IMPLEMENTATION DEFINED as to 
the form of TLB maintenance operation that the software must perform in order to be guaranteed that all TLB entries 
associated with the given address and translation regime have been invalidated. In all cases, an ALL or VMALL form of 
TLB maintenance operation that targets the given translation regime is guaranteed to remove all entries within that 
regime, even if there are multiple, conflicting TLB entries for any given address within that regime. 
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The interaction of TLB lockdown with TLB maintenance instructions 


The precise interaction of TLB lockdown with the TLB maintenance instructions is IMPLEMENTATION DEFINED. 
However, the architecturally-defined TLB maintenance instructions must comply with these rules: 


p The effect on a locked TLB entry ofa TLB invalidate all operation that would invalidate that entry if the entry 
was not locked must be one of the following, and it is IMPLEMENTATION DEFINED which behavior applies: 


— The operation has no effect on entries that are locked down. 


— The operation generates an IMPLEMENTATION DEFINED Data Abort exception if an entry is locked 
down, or might be locked down. 


Any such exceptions taken from Non-secure EL1 can be trapped to EL2, see Traps to EL2 of ELO and 
EL1 accesses to lockdown, DMA, and TCM operations on page D1-2343. 
Note 


These options permit a usage model for TLB invalidate routines, where the routine invalidates a large range 
of addresses, without considering whether any entries are locked in the TLB. 








: The effect on a locked TLB entry of a TLB invalidate by VA or invalidate by ASID match operation that 
would invalidate that entry if the entry was not locked must be one of the following, and it is 
IMPLEMENTATION DEFINED which behavior applies: 


— The locked entry is invalidated in the TLB. 


— The operation has no effect on any locked entry in the TLB. In the case of an invalidate single entry 
by VA, this means the PE treats the operation as a NOP. 


— The operation generates an IMPLEMENTATION DEFINED Data Abort exception if it operates on an entry 
that is locked down, or might be locked down. 


The exception syndrome definitions include a fault code for cache and TLB lockdown faults, see ESR_EL1, 
Exception Syndrome Register (ELI) on page D13-2919. 


Note 


Any implementation that uses an abort mechanism for entries that can be locked down but are not actually locked 
down must: 





à Document the IMPLEMENTATION DEFINED instruction sequences that perform the required operations on 
entries that are not locked down. 


$ Implement one of the other specified alternatives for the locked entries. 


Arm recommends that, when possible, such IMPLEMENTATION DEFINED instruction sequences use the 
architecturally-defined operations. This minimizes the number of customized operations required. 


In addition, an implementation that uses an abort mechanism for handling the effect of TLB maintenance 
instructions on entries that can be locked down but are not actually locked down must provide an IMPLEMENTATION 
DEFINED mechanism that ensures that no TLB entries are locked. 


Similar rules apply to cache lockdown, see The interaction of cache lockdown with cache maintenance instructions 
on page D4-2493. 





The architecture does not guarantee that any unlocked entry in the TLB remains in the TLB. This means that, as a 
side effect of any TLB maintenance instruction, any unlocked entry in the TLB might be invalidated. 
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D5.11 Caches in a VMSAv8-64 implementation 


The Arm architecture describes the required behavior of an implementation of the architecture. As far as possible it 
does not restrict the implemented microarchitecture, or the implementation techniques that might achieve the 
required behavior. 


In particular, maintaining this level of abstraction is difficult when describing the relationship between memory 
address translation and caches, especially regarding the indexing and tagging policy of caches. This section: 


° Summarizes the architectural requirements for the interaction between caches and address translation. 


è Gives some information about the likely implementation impact of the required behavior. 


The following sections give this information: 
. Data and unified caches. 


. Instruction caches. 


In addition, Cache maintenance requirement created by changing translation table attributes on page D5-2657 
describes the cache maintenance required after updating the translation tables to change the attributes of an area of 
memory. 


For more information about cache maintenance see 464 Cache maintenance instructions on page D4-2482, that 
describes the cache maintenance instructions in the A64 instruction set. 


D5.11.1 Data and unified caches 


For data and unified caches, the use of address translation is entirely transparent to any data access other than as 
described in Mismatched memory attributes on page B2-153. 


This means that the behavior of accesses from the same observer to different VAs, that are translated to the same PA 
with the same memory attributes, is fully coherent. This means these accesses behave as follows, regardless of 
which VA is accessed: 


e Two writes to the same PA occur in program order. 

. A read of a PA returns the value of the last successful write to that PA. 

. A write to a PA that occurs, in program order, after a read of that PA, has no effect on the value returned by 
that read. 


The memory system behaves in this way without any requirement to use barrier or cache maintenance instructions. 


In addition, if cache maintenance is performed on a memory location, the effect of that cache maintenance is visible 
to all aliases of that physical memory location. 


These properties are consistent with implementing all caches that can handle data accesses as Physically-indexed, 
physically-tagged (PIPT) caches. 


D5.11.2 Instruction caches 
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In the Arm architecture, an instruction cache is a cache that is accessed only as a result of an instruction fetch. 
Therefore, an instruction cache is never written to by any load or store instruction executed by the PE. 


The Arm architecture permits different behaviors for instruction caches. These are identified by descriptions of the 
associated expected implementation. The following subsections describe the behavior associated with these cache 
types, including any occasions where explicit cache maintenance is required to make the use of address translation 
transparent to the instruction cache: 


. PIPT (Physically-indexed, physically-tagged) instruction caches on page D5-2656. 
. VPIPT (VMID-aware PIPT) instruction caches on page D5-2656. 

. VIPT (Virtually-indexed, physically-tagged) instruction caches on page D5-2656. 

e The IVIPT Extension on page D5-2657. 


The CTR_ELO.L1Ip field identifies the form of the instruction caches. 
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Note 
For software to be portable between implementations that might use any of PIPT instruction caches, VPIPT 
instruction caches, or VIPT instruction caches, software must invalidate the instruction cache whenever any 
condition occurs that would require instruction cache maintenance for at least one of the instruction cache types. 





PIPT (Physically-indexed, physically-tagged) instruction caches 
For a PIPT instruction cache: 


s The use of memory address translation is entirely transparent to all instruction fetches other than as described 
in Mismatched memory attributes on page B2-153. 


$ If cache maintenance is performed on a memory location, the effect of that cache maintenance is visible to 
all aliases of that physical memory location. 


An implementation that provides PIPT instruction caches implements the IVIPT Extension, see The IVIPT 
Extension on page D5-2657. 


VPIPT (VMID-aware PIPT) instruction caches 


An Armv8.2 implementation can implement VPIPT instruction caches. If it does so then it is described as 
implementing ARMv8.2-VPIPT. 


The CTR_ELO.L1Ip field identifies the implemented cache type, meaning it identifies whether ARMv8.2-VPIPT is 
implemented. 


For a VPIPT instruction cache: 


à Instruction fetches from Non-secure EL1 and Non-secure ELO are only permitted to hit in the cache if the 
instruction fetch is made using the VMID that was used when the entry in the instruction cache was fetched. 


e An instruction cache maintenance instruction executed at Non-secure ELO or at Non-secure EL1 is required 
to have an effect on entries in the instruction cache only if those entries were fetched using the VMID that is 
current when the cache maintenance instruction is executed. 


All other requirements for the use of cache maintenance instructions are the same as for PIPT (Physically-indexed, 
physically-tagged) instruction caches. 


An implementation that provides VPIPT instruction caches implements the IVIPT Extension, see The IVIPT 
Extension on page D5-2657. 


VIPT (Virtually-indexed, physically-tagged) instruction caches 
For a VIPT instruction cache: 


s The use of memory address translation is transparent to all instruction fetches other than for the effect of 
memory address translation on instruction cache invalidate by address operations or as described in 
Mismatched memory attributes on page B2-153. 

Note 


Cache invalidation is the only cache maintenance that can be performed on an instruction cache. 








$ If instruction cache invalidation by address is performed on a memory location, the effect of that invalidation 
is visible only to the VA supplied with the operation. The effect of the invalidation might not be visible to 
any other aliases of that physical memory location. 


The only architecturally-guaranteed way to invalidate all aliases of a PA from a VIPT instruction cache is to 
invalidate the entire instruction cache. 


An implementation that provides VIPT instruction caches implements the [VIPT Extension, see The IVIPT 
Extension on page D5-2657. 
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The IVIPT Extension 


In Armv8, any permitted instruction cache implementation can be described as implementing the VIPT Extension 
to the Arm architecture. 


The formal definition of the Arm IVIPT Extension is that it reduces the instruction cache maintenance requirement 
to the following condition: 


s Instruction cache maintenance is required only after writing new data to a PA that holds an instruction. 


Note 


Previous versions of the Arm architecture have permitted an instruction cache option that does not implement the 
Arm IVIPT Extension. 





D5.11.3 Cache maintenance requirement created by changing translation table attributes 
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Any change to the translation tables to change the attributes of an area of memory can require maintenance of the 
translation tables, as described in General TLB maintenance requirements on page D5-2638. If the change affects 
the cacheability attributes of the area of memory, including any change between Write-Through and Write-Back 
attributes, software must ensure that any cached copies of affected locations are removed from the caches, typically 
by cleaning and invalidating the locations from the levels of cache that might hold copies of the locations affected 
by the attribute change. Any of the following changes to the inner cacheability or outer cacheability attribute creates 
this maintenance requirement: 

. Write-Back to Write-Through 

. Write-Back to Non-cacheable 

° Write-Through to Non-cacheable 

. Write-Through to Write-Back. 


The cache clean and invalidate avoids any possible coherency errors caused by mismatched memory attributes. 


Similarly, to avoid possible coherency errors caused by mismatched memory attributes, the following sequence 
must be followed when changing the shareability attributes of a cacheable memory location: 


1. Make the memory location Non-cacheable, Outer Shareable. 
2; Clean and invalidate the location from them cache. 
3. Change the shareability attributes to the required new values. 
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This chapter provides details of the optional ARMv8.5-MemTag Extension. 


Introduction on page D6-2660. 

Allocation Tags on page D6-2661. 

Tag checking on page D6-2662. 

Tagged and Untagged Addresses on page D6-2663. 

PE access to Allocation Tags on page D6-2664. 

Enabling the Memory Tagging Extension on page D6-2665. 

PE handling of Tag Check failure on page D6-2666. 

PE generation of Tag Checked and Tag Unchecked accesses on page D6-2667. 
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D6.1 


D6-2660 


Introduction 


ARMv8.5-MemtTag is an optional extension to the Armv8.5 architecture in AArch64 state only. 


The extension implements: 


Tag load and store instructions to access Allocation tags in a tag physical address space, separate to the data 
physical address space accessed by data load and store instructions to access data in normal memory and 
devices. 


4-bit Allocation Tags at a granularity of one Allocation Tag for each naturally aligned set of 16 physically 
addressed locations. 





Note 


Implementations are expected to provide one Allocation Tag for each 16 byte granule of bulk data memory. 


System register and page level control over access to Allocation Tags in memory. 


A Logical Address Tag from which a Physical Address Tag can be derived and held in the upper bits of the 
address that is used in load and store data instructions. 


A Tag Check of the Physical Address Tag against the 4-bit Allocation Tag for each data location that is 
accessed by a Tag Checked load or store of data. 


Instructions to generate and manipulate the Logical Address Tag in a register. 
A random tag generator using state that is held in RGSR_EL1 and controlled by GCR_EL1. 


Configurable behavior on a Tag Check returning a fail result causing a synchronous exception or recording 
the failure in a System register, one of TFSR_ELx or TFSREO ELI. 


Cache maintenance operations operating on Allocation Tags, or Allocation Tags and data. 
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D6.2 Allocation Tags 


The tag physical address (tag PA) space provides access to Allocation Tags stored in memory. The data physical 
address (data PA) space provides access to data held in memory. 


An Allocation Tag is 4 bits. 


Each naturally-aligned set of 16 tag PA locations is a Tag Granule. Each Tag Granule is associated with one 





Allocation Tag. 
Note 
$ The value 0b1111 may incur a higher performance overhead than other Allocation Tag encodings. 
e Arm recommends that software does not use instructions which write 0b1111 as an Allocation Tag to memory. 
: Arm recommends that implementations provide storage for Allocation Tags at each tag PA where 


general-purpose memory exists at the same physical address in the data PA space. 





It is IMPLEMENTATION DEFINED what happens when an access is made to the tag PA where Allocation Tag storage 
is not provided. 


It is IMPLEMENTATION DEFINED whether Allocation Tags are permitted to be accessed via regions of the data PA 
space. If Allocation Tags are accessible via the data PA space, then the layout of Allocation Tags is 
IMPLEMENTATION DEFINED. 


It is not architecturally required for an Allocation Tag accessed via the tag PA space to be coherent with the same 
Allocation Tag accessed via the data PA space. A write to one location can be made visible at the other location by 
the use of the cache maintenance operations. 


Unless otherwise stated the definitions in Chapter B2 The AArch64 Application Level Memory Model and 
Chapter D4 The AArch64 System Level Memory Model which apply to data accesses and data apply separately to 
Allocation Tag accesses and Allocation tags. 


It is IMPLEMENTATION DEFINED whether the global monitor monitors access to the tag PA space. 


D6.2.1 Cache activity and Allocation Tags 


For more information on DC operations that affect Allocation Tags see 464 System instructions for cache 
maintenance on page C5-459, 


The eviction of data from a cache entry from a cache level can overwrite data in memory that has been written by 
another observer only if the entry contains a memory location where either or both the data or associated Allocation 
Tags have been written to by an observer in the Shareability domain of that memory location, where the maximum 
size of the memory that can be overwritten is defined by the Cache Write-Back Granule in CTR_ELO. 


The eviction of Allocation Tags from a cache entry from a cache level can overwrite Allocation Tags in memory 
that have been written by another observer only if the entry contains a memory location where the Allocation Tags 
have been written to by an observer in the Shareability domain of that memory location, where the maximum size 
of the memory that can be overwritten is defined by the Cache Write-Back Granule in CTR_ELO. 
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D6.3 Tag checking 


A memory access is either Tag Checked or Tag Unchecked. 

An access to the data PA space is either Tag Checked or Tag Unchecked. 

An access to the tag PA space is always Tag Unchecked. 

A data access which is performed as part of a prefetch operation is Tag Unchecked. 

When the value of PSTATE.TCO is 1, all loads and stores are Tag Unchecked. 

A Tag Checked memory access includes a physical address Tag. A physical address Tag is 4 bits. 
A Tag Checked access causes a Tag Check operation to be performed. 


A Tag Check operation has all of the following characteristics: 


° A Tag Check operation reads an Allocation Tag at a tag PA and compares the Allocation Tag with the physical 
address Tag passed as a part of the memory access. 


` A Tag Check operation generates either a pass or fail result. 


s A Tag Check operation generates a pass result if the Allocation Tag and physical address Tag match. If the 
Allocation Tag and the physical address Tag do not match the Tag Check operation generates a fail result. 


A Tag Check operation is either precise or imprecise. 


The read of an Allocation Tag due to a Tag Check operation and the dependent data access are not required to form 
an atomic operation. 


A precise Tag Checked access occurs when a Tag Check access is configured to be precise by the use of 
SCTLR_ELx.TCF or SCTLR_ELx.TCFO. A precise Tag Check operation which generates a fail result prevents any 
writes to locations causing the Tag Check fail. 


An imprecise Tag Checked access occurs when a Tag Check access is configured to be imprecise by the use of 
SCTLR_ELx.TCF or SCTLR_ELx.TCFO. An Imprecise Tag Check operation configurably reports any failure into 
TFSR_ELx. 


An imprecise Tag Check operation has no effect on the data access, or any side effects on the data access, so that 
the data access is always performed, unless prevented by another exception being taken or Data Abort. 
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D6.4 Tagged and Untagged Addresses 


A virtual address is either Tagged or Untagged. 

An access to memory at an Untagged virtual address generates an Unchecked access. 

An access to memory at a Tagged virtual address permits the generation of Tag Checked or Tag Unchecked access. 
A read of an Allocation Tag from an Untagged virtual address returns the value 0b0000. 

A write of an Allocation Tag to an Untagged address is IGNORED. 


All virtual addresses in AArch32 state are Untagged. 


D6.4.1 Virtual address translation 
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If stage 1 translation at the current Exception level is enabled, stage 1 translations are Tagged or Untagged 
depending on the Memory Attributes for the memory location being accessed. 


If stage 1 translation at the current Exception level is disabled: 


° When the value of HCR_EL2.DC is one, stage 1 translations are Tagged or Untagged depending on the value 
of HCR_EL2.DCT. 


$ When the value of HCR_EL2.DC is zero, stage 1 translations are treated as Untagged. 
Memory locations are treated as Tagged where all of the following is true: 
s The combined effects of stage 1 and stage 2 translations define the memory attributes as: 
— Normal memory, 
— Inner, and Outer Shareable, 
— Write-Back Non-Transient Read-Allocate Write allocate 
° The stage 1 translation is treated as Tagged. 
Otherwise memory locations are Untagged. 


Ifa memory location is marked as Untagged, a data cache invalidation operation that would invalidate Allocation 
Tags at that location cleans and invalidates the Allocation Tags. 


When the EL1&0 stage 1 translation regime is disabled and HCR_EL2.DC is one, in the current Security state, the 
execution of any AT S1E0, AT S1E1, AT S12E0, or AT $12E1 address translation instruction will reflect the effect of 
HCR_EL2.DCT in PAR_EL1.ATTR. 


For more information on Virtual address translation see The VMSAv8-64 address translation system on 
page DS-2512. 
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PE access to Allocation Tags 


A PE can access an Allocation tag using the following instructions: 


STG/STZG 
ST2G/STZ2G 
STGP 

LDG 

LDGM 

STGM 


Instructions that load or store Allocation Tags apply the same address translation and permission checks as a load 
or store of data to a virtual address. 


An instruction that loads or stores an Allocation Tag: 


Is considered a load or store of data to each location associated with the Allocation Tag for the purpose of 
triggering Watchpoints and PMU events. 


Generates a tag PA with the same physical address as a load or store of data to a virtual address. 


If ID _AA64PFR1_EL1,MTE is @b0010 the Memory Tagging Extension is fully implemented. 


IfID_AA64PFR1_EL1,MTE is 0b0001 all of the following is true: 


SCR_EL3.ATA is RESO. 
HCR_EL2.ATA is RESO. 
SCTLR_ELx.ATA is RESO. 
SCTLR_ELx.ATAO is RESO. 


All operations which read Allocation Tags treat the Allocation Tag as zero, any traps or permission checks 
continue to apply. 


All operations which write an Allocation Tag to memory do not modify the Allocation Tag in memory. Any 
traps or permission checks continue to apply. 


Instructions which insert Allocation Tags into addresses treat the Allocation Tag as zero. This means that: 
— _ IRG inserts @b0000. 

—  ADDGor SUBG insert @b0000. 

—  LDG inserts @b0000. 


The System instructions that are introduced by the Memory Tagging Extension are Unallocated. 


All other instructions which read or write Allocation Tags behave as if [ID AA64PFR1_EL1,MTE is 0b0019. 
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D6.6 Enabling the Memory Tagging Extension 
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Access to Allocation Tags in memory can be enabled by the use of the following controls: 
$ SCR_EL3.ATA. 

e HCR_EL2.ATA. 

è SCTLR_ELx.ATA. 

è SCTLR_ELx.ATAO. 


When access to Allocation Tags is disabled for an Exception level, instructions that are executed at that Exception 
level, that: 


$ Load or store data are Unchecked. 
7 Load or store Allocation Tags treat the Allocation Tag as RAZ/WI. 
s Insert Logical Address Tags into addresses treat the Allocation Tag used to generate the Logical Address Tag 
as zero. 
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D6.7 PE handling of Tag Check failure 


If SCTLR_ELx.TCF has the value of 0b00, a Tag Check fail due to a load or store at ELx has no effect on the PE. 


If SCTLR_ELx.TCF has the value of 0b01, a Tag Check fail due to a load or store at ELx generates a synchronous 
exception. 


If SCTLR_ELx.TCF has the value of 0b10, a Tag Check fail due to a load or store at ELy using TTBR_ELx causes 
TFSR_ELx.TFx to be asynchronously set to 1. 


A Tag Check fail due to a load or store at ELO has no effect on the PE if either of the following conditions are true: 
7 SCTLR_EL1.TCFO has the value of @b00 and HCR_EL2{E2H, TGE} does not have the value of {1,1}. 
è SCTLR_EL2.TCF0 has the value of 0b00 and HCR_EL2{E2H, TGE} has the value of {1,1}. 


A Tag Check fail due to a load or store at ELO generates a synchronous exception if either of the following 
conditions are true: 


- SCTLR_EL1.TCFO has the value of @b01 and HCR_EL2{E2H, TGE} does not have the value of {1,1}. 
è SCTLR_EL2.TCFO has the value of 0b01 and HCR_EL2{E2H, TGE} has the value of {1,1}. 


A Tag Check fail due to a load or store at ELO using TTBRy_EL1 or TTBRy_EL2 causes TFSRE0_EL1.TFy to be 
set to 1 if either of the following conditions are true: 


$ SCTLR_EL1.TCF0 has the value of 0b10 and HCR_EL2{E2H, TGE} does not have the value of {1,1} 
è SCTLR_EL2.TCF0 has the value of 0b10 and HCR_EL2{E2H, TGE} has the value of {1,1}. 


TFSR_ELx and TFSRE0_EL1 are unchanged by a memory data access causing a Tag Check pass. 


A synchronous exception due to a Tag Check fail is reported as a Data Abort with a Data Fault status code of 
Synchronous Tag Check fail and the faulting virtual address is reported in FAR_ELx. 


A Data Abort due to a Tag Check fail is taken to: 

. EL1 from ELO if HCR_EL2.TGE has the value of 0. 
. EL2 from ELO if HCR_EL2.TGE has the value of 1. 
. ELx from ELx where x is 1, 2 or 3. 


A Data Abort due to a Tag Check fail is prioritized as a Data Abort exception generated by a synchronous External 
abort that was not generated by a translation table walk. 


If an access generates both a Data Abort due to a Synchronous Tag Check Fail and a Data Abort due to a 
synchronous External abort that was not generated by a translation table walk, it is IMPLEMENTATION DEFINED 
which abort is reported. For more information on prioritization of exceptions see Synchronous exception types, 
routing and priorities on page D1-2307. 


If an instruction that stores to memory generates a Data Abort that is a Synchronous Tag Check Fail, the value of 
each memory location that the instruction stores to is UNKNOWN for any location for which no exceptions and no 
Debug event is generated. The size of a memory location is defined as being the size for which a memory access is 
single-copy atomic. 


If SCTLR_ELx.ITFSB has the value of 0b1, then updates to TFSREO_EL1, and any TFSR_ELx accessible at ELy, 
are synchronized on exception entry to ELy. 


When SVE is implemented, if a load of an element in a SVE Non-faulting or First-faulting load instruction causes 
a Tag Check fail, and is not the first active element in a First-faulting instruction, the Tag Check fail: 


° Is recorded in the corresponding FFR register. 
s Does not generate a Synchronous Tag Check fail exception. 
s Does not cause any bit in any TFSR_ELx or TFSREO ELI registers to be set. 
° The value loaded into the element is UNKNOWN. 
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D6.8 PE generation of Tag Checked and Tag Unchecked accesses 


Bits [59:56] of the 64-bit address that is used for a load or store instruction from a Logical Address Tag. 
The PE generates a physical address Tag from the Logical Address Tag for each Tag Checked access to memory. 


Unless an access is explicitly defined as a Tag Unchecked access it is a Tag Checked access. 


D6.8.1 Tag Unchecked accesses 
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The following operations generate a Tag Unchecked access: 


° An instruction fetch. 
$ A load instruction that loads an Allocation Tag. 
a A store instruction that stores an Allocation Tag. 


When PSTATE.TCO has the value of one all loads and stores generate Tag Unchecked accesses. 


A cache maintenance by virtual address operation other than DC ZVA, Data Cache Zero by VA generates a Tag 
Unchecked access. 


An access due to a translation table walk generates a Tag Unchecked access. 
If ARMv8.4-NV is implemented Loads and Stores relative to VNCR_EL2 generate a Tag Unchecked access. 


If the Statistical Profiling Extension is implemented all accesses to the Profiling Buffer are Tag Unchecked accesses, 
see Chapter D9 The Statistical Profiling Extension for more information. 


Data accesses by an external Debugger may generate Tag Checked accesses, see Chapter H2 Debug State for more 
information. 


An access which would be translated using TTBRO_ELx if the stage 1 translation regime were enabled is Tag 
Unchecked, irrespective of whether the stage 1 translation regime is disabled or not, where either of the following 
conditions apply: 

. TCR_ELx.TBI has the value of zero. 

. TCR_ELx.TBIO has the value of zero. 


If TCR_ELx.TBI has the value of zero, an access which would be translated using TTBR1_ELx if the stage 1 
translation regime were enabled is Tag Unchecked, irrespective of whether the stage 1 translation regime is enabled 
or not. 


An access will be Tag Unchecked, irrespective of whether the stage 1 translation regime is disabled or not, where 
all of the following conditions apply: 


° The access would be translated using TTBRO_ELx. 
° The Logical Address Tag is 0b0000. 
s TCR_ELx.TCMA!1 has the value of one, or TCR_ELx.TCMAO has the value of one. 


An access will be Tag Unchecked, irrespective of whether the stage 1 translation regime is disabled or not, when all 
of the following conditions apply: 


e The access would be translated using TTBR1_ELx. 
: The Logical Address Tag is 0b1111. 
° TCR_ELx.TCMA has the value of one. 


A Tag Unchecked access will be generated for a load or store that uses either of the following: 
° A base register only. 
x A base register plus immediate offset addressing form, with the SP as the base register. 


Literal (PC-relative) loads generate a Tag Unchecked access. 
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D6.8.2 Checked accesses 


When executing at ELO, a Tag Checked access due to a load or store is a precise Tag Checked access if either of the 
following conditions apply: 


$ SCTLR_EL1.TCF0 has the value of 0b01 and HCR_EL2.{TGE,E2H} does not have the value of {1,1}. 
è SCTLR_EL2.TCF0 has the value of 0b01 and HCR_EL2.{TGE,E2H} has the value of {1,1}. 


Otherwise a Tag Checked access is an imprecise Tag Checked access. 
If executing at any Exception level above ELO a Tag Checked access is a precise Tag Checked access if 
SCTLR_ELx.TCF == 0b01 otherwise the Tag Checked access is an imprecise Checked access. 

D6.8.3 Constrained Unpredictable behavior 


When executing a Store Exclusive instruction that if Tag Unchecked would not perform the store and return a status 
value of one, it is CONSTRAINED UNPREDICTABLE whether: 


° The instruction generates a Tag Checked access. 
° The instruction generates a Tag Unchecked access. 
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The Performance Monitors Extension 


This chapter describes the Armv8 implementation of the Arm Performance Monitors, that are an optional 
non-invasive debug component. It describes version 3 of the Performance Monitor Unit (PMU) architecture, 
PMUVv3. It contains the following sections: 


. About the Performance Monitors on page D7-2670. 

. Accuracy of the Performance Monitors on page D7-2673. 
° Behavior on overflow on page D7-2675. 

. Attributability on page D7-2677. 

. Effect of EL3 and EL2 on page D7-2679. 

a Event filtering on page D7-2682 

. Performance Monitors and Debug state on page D7-2684. 
s Counter enables on page D7-2685. 

E Counter access on page D7-2687. 

7 PMU events and event numbers on page D7-2689. 

i Performance Monitors Extension registers on page D7-2723. 





Note 
Table K14-2 on page K14-7812 disambiguates the general register references used in this chapter. 
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D7.1 
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About the Performance Monitors 


In Armv8-A, the Performance Monitors Extension is an OPTIONAL feature of an implementation, but Arm strongly 
recommends that Armv8-A implementations include version 3 of the Performance Monitors Extension, PMUVv3, 





Note 


No previous versions of the Performance Monitors Extension can be implemented in Armv8. 





The basic form of the Performance Monitors is: 
: A 64-bit cycle counter, see Time as measured by the Performance Monitors cycle counter on page D7-2671. 


a A number of 64-bit or 32-bit event counters. If ARMv8.5-PMU is implemented and the highest Exception 
level is using AArch64, the event counters are 64-bit. If ARMv8.5-PMU is not implemented, the event 
counters are 32-bit. 


. The event counted by each event counter is programmable. Armv8 provides space for up to 31 event 
counters. The actual number of event counters is IMPLEMENTATION DEFINED, and the specification includes 
an identification mechanism. 


Note 


Arm recommends that at least two event counters are implemented, and that hypervisors provide at least this 
many event counters to guest operating systems. 








- When EL2 is implemented, the required controls to partition the implemented event counters into the 
following sets: 


— A set which is available for use by the guest operating system accessible at all Exception levels. 


— A set which is available for use by the hypervisor accessible at EL3 and EL2, and, if 
ARMvVv8.4-SecEL2 is not implemented or if Secure EL2 is disabled, in Secure state. 


s Controls for: 
— Enabling and resetting counters. 
— Flagging overflows. 
— Enabling interrupts on overflow. 


Monitoring software can enable the cycle counter independently of the event counters, and if ARMv8.5-PMU 
is implemented, disable the cycle counter in Secure state or in EL2. 


The PMU architecture uses event numbers to identify an event. It: 


. Defines event numbers for common events, for use across many architectures and microarchitectures. 


Note 


Implementations that include PMUv3 must, as a minimum requirement, implement a subset of the common 
events. See Common event numbers on page D7-2694. 








s Reserves a large event number space for IMPLEMENTATION DEFINED events. 


The full set of events for an implementation is IMPLEMENTATION DEFINED. Arm recommends that implementations 
include all of the events that are appropriate to the architecture profile and microarchitecture of the implementation. 


When an implementation includes the Performance Monitors Extension, Armv8 defines the following possible 
interfaces to the Performance Monitors Extension registers: 


e A System register interface. This interface is mandatory. 


— Note 
In AArch32 state, the interface is in the (coproc==0b1111) encoding space. 
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s An external debug interface which optionally supports memory-mapped accesses. Implementation of this 
interface is OPTIONAL. See Chapter 13 Recommended External Interface to the Performance Monitors. 


An operating system can use the System registers to access the counters. 


Also, if required, the operating system can enable application software to access the counters. This enables an 
application to monitor its own performance with fine-grain control without requiring operating system support. For 
example, an application might implement per-function performance monitoring. 


To enable interaction with external monitoring, an implementation might consider additional enhancements, such 
as providing: 
. A set of events, from which a selection can be exported onto a bus for use as external events. 


a The ability to count external events. This enhancement requires the implementation to include a set of 
external event input signals. 


The Performance Monitors Extension is common to AArch64 operation and AArch32 operation. This means the 
Armv8 architecture defines both AArch64 and AArch32 System registers to access the Performance Monitors. For 
example, the Performance Monitors Cycle Count Register is accessible as: 

$ When executing in AArch64 state, PMCCNTR_ELO. 

s When executing in AArch32 state, PMCCNTR. 


When executing in AArch32 state, if ARMv8.5-PMU is implemented, bits [63:32] of the event counters are not 
accessible. If the implementation does not support AArch64 at any Exception level, 64-bit event counters are not 
required to be implemented. 


D7.1.1 Time as measured by the Performance Monitors cycle counter 


The Performance Monitors cycle counter, accessed through PMCCNTR_ELO or PMCCNTR, increments from the 
hardware processor clock, not PE clock cycles. 


The relationship between the count recorded by the Performance Monitors cycle counter and the passage of real 
time is IMPLEMENTATION DEFINED. 


See Prohibiting event counting on page D7-2679 for information about when the cycle counter does not increment. 





Note 


° This means that, in an implementation where PEs are multithreaded, the counter continues to increment 
across all PEs, rather than only counting cycles for which the current PE is active. 


s Although the architecture requires that direct reads of PMCCNTR_ELO or PMCCNTR occur in program 
order, there is no requirement that the count increments between two such reads. Even when the counter is 
incrementing on every clock cycle, software might need check that the difference between two reads of the 
counter is nonzero. 


The architecture requires that an indirect write to the PMCCNTR_ELO or PMCCNTR is observable to direct 
reads of the register in finite time. The counter increments from the hardware processor clock are indirect 
writes to these registers. 





D7.1.2 Interaction with trace 
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It is IMPLEMENTATION DEFINED whether the implementation exports counter events to a PE Trace Unit, or other 
external monitoring agent, to provide triggering information. The form of any exporting is also IMPLEMENTATION 
DEFINED. If implemented, this exporting might be enabled as part of the performance monitoring control 
functionality. 


Arm recommends system designers include a mechanism for importing a set of external events to be counted, but 
such a feature is IMPLEMENTATION DEFINED. When implemented, this feature enables the PE Trace Unit to pass in 
events to be counted. 


Exporting PMU events to the ETM is prohibited for some Exception levels when Sel fHostedTraceEnabled() == 
TRUE. For more information, see Controls to prohibit trace at Exception levels on page D3-2463. 
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D7.1.3 Interaction with power saving operations 
All counters are subject to any changes in clock frequency, including clock stopping caused by the WFI and WFE 
instructions. 
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D7.2 Accuracy of the Performance Monitors 


The Performance Monitors: 
° Are a non-invasive debug component. See Non-invasive behavior. 


° Must provide broadly accurate and statistically useful count information. 
However, the Performance Monitors allow for: 


a A reasonable degree of inaccuracy in the counts to keep the implementation and validation cost low. See A 
reasonable degree of inaccuracy. 


° IMPLEMENTATION DEFINED controls, such as those in ACTLR registers, to put the PE in an operating state 
that might do one or both of the following: 


— Change the level of non-invasiveness of the Performance Monitors so that enabling an event counter 
can impact the performance or behavior of the PE. 


— Allow inaccurate counts. This includes, but is not limited to, cycle counts. 


D7.2.1 Non-invasive behavior 


The Performance Monitors are a non-invasive debug feature. A non-invasive debug feature permits the observation 
of data and program flow. Performance Monitors, PC Sample-based Profiling and Trace are non-invasive debug 
features. 


Non-invasive debug components do not guarantee that they do not make any changes to the behavior or 
performance of the processor. Any changes that do occur must not be severe however, as this will reduce the 
usefulness of event counters for performance measurement and profiling. This does not include any change to 
program behavior that results from the same program being instrumented to use the Performance Monitors, or from 
some other performance monitoring process being run concurrently with the process being profiled in a multitasking 
operating system. As such, a reasonable variation in performance is permissible. 


Note 


Power consumption is one measure of performance. Therefore, a reasonable variation in power consumption is 
permissible. 








Arm does not define a reasonable variation in performance, but recommends that such a variation is kept within 5% 
of normal operating performance, when averaged across a suite of code that is representative of the application 
workload. 





Note 


For profiles other than A-profile, there is the potential for stronger requirements. Ultimately, performance 
requirements are determined by end-users, and not set by the architecture. 





For some common architectural events, this requirement to be non-invasive can conflict with the requirement to 
present an accurate value of the count under normal operating conditions. Should an implementation require more 
performance-invasive techniques to accurately count an event, there are the following options: 


. If the event is optional, define an alternative implementation defined event that accurately counts the event 
and document the impact on performance of enabling the event. 


e Provide an implementation defined control that disables accurate counting of the event to restore broadly 
accurate performance, and document the impact on performance of accurate counting. 


D7.2.2 A reasonable degree of inaccuracy 
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The Performance Monitors provide broadly accurate and statistically useful count information. To keep the 
implementation and validation cost low, a reasonable degree of inaccuracy in the counts is acceptable. Arm does 
not define a reasonable degree of inaccuracy but recommends the following guidelines: 


è Under normal operating conditions, the counters must present an accurate value of the count. 
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s In exceptional circumstances, such as a change in Security state or other boundary condition, it is acceptable 
for the count to be inaccurate. 


° Under very unusual, non-repeating pathological cases, the counts can be inaccurate. These cases are likely to 
occur as a result of asynchronous exceptions, such as interrupts, where the chance of a systematic error in the 
count is very unlikely. 


Note 
An implementation must not introduce inaccuracies that can be triggered systematically by the execution of normal 
pieces of software. For example, it is not reasonable for the count of branch behavior to be inaccurate when caused 
by a systematic error generated by the loop structure producing a dropping in branch count. 





However, dropping a single branch count as the result of a rare interaction with an interrupt is acceptable. 





The permitted inaccuracy limits the possible uses of the Performance Monitors. In particular, the architecture does 
not define the points in a pipeline where the event is generated and where it is counted, relative to the point where 
a read of the counters is made. This means that pipelining effects can cause some imprecision. 


Where a direct write to a Performance Monitors control register disables a counter, and is followed by a Context 
synchronization event, any subsequent indirect read of the control register by the Performance Monitors to 
determine whether the counter is enabled will return the updated value. Any subsequent direct read of the counter 
will return the value at the point the counter was disabled. 





Note 


The imprecision means that the counter might have counted an event around the time the counter was disabled, but 
does not allow the event to be observed as counted after the counter was disabled. 





A change of Security state can also affect the accuracy of the Performance Monitors, see Interaction with EL3 on 
page D7-2679. 


In addition to this, entry to and exit from Debug state can disturb the normal running of the PE, causing further 
inaccuracy in the Performance Monitors. Disabling the counters while in Debug state limits the extent of this 
inaccuracy. An implementation can employ methods to limit this inaccuracy, for example by promptly disabling the 
counters during the Debug state entry sequence. 


An implementation must document any particular scenarios where significant inaccuracies are expected. 
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D7.3 Behavior on overflow 


The event counters, PMEVCNTR<n> are either 32-bit or 64-bit unsigned counters that overflow in the following 
situations: 


s If ARMv8.5-PMU is not implemented, 32-bit event counters are implemented, and if incrementing 
PMEVCNTR<n> causes an unsigned overflow of an event counter, the PE sets PMOVSCLR[n] to 1. 


$ If ARMv8.5-PMU is implemented, 64-bit event counters are implemented, and either n is in the range [0,, 
(HDCR.HPMN-1)] or EL2 is not implemented, then event counter overflow is configured by PMCR.LP: 


— When PMCR_LP is set to 0, if incrementing PMEVCNTR<n> causes an unsigned overflow of bits 
[31:0] of the event counter, the PE sets PMOVSCLR[n] to 1. 


— When PMCR_LP is set to 1, if incrementing PMEVCNTR<n> causes an unsigned overflow of bits 
[63:0] of the event counter, the PE sets PMOVSCLR[n] to 1. 





$ If ARMv8.5-PMU is implemented, 64-bit event counters are implemented, and EL2 is implemented, when 
nis in the range [HDCR.HPMN .. (PMCR.N-1)], event counter overflow is configured by HDCR.HLP: 


— When HDCR.HLP is set to 0, if incrementing PMEVCNTR<n> causes an unsigned overflow of bits 
[31:0] of the event counter, the PE sets PMOVSCLRIn] to 1. 


— When HDCR.HLP is set to 1, if incrementing PMEVCNTR<n> causes an unsigned overflow of bits 
[63:0] of the event counter, the PE sets PMOVSCLRIn] to 1. 


The cycle counter, PMCCNTR, is a 64-bit unsigned counter, that is configured by PMCR.LC: 
. If PMCR.LC is set to 0, if incrementing PMCCNTR causes an unsigned overflow of bits [31:0] of the cycle 
counter, the PE sets PMOVSCLR[31] to 1. 


. If PMCR.LC is set to 1, if incrementing PMCCNTR causes an unsigned overflow of bits [63:0] of the cycle 
counter, the PE sets PMOVSCLRJ31] to 1. 


For all 64-bit counters, incrementing the counter is the same whether an unsigned overflow occurs at [31:0] or 
[63:0]. If the counter increments for an event, bits [63:0] are always incremented, 


When any overflow occurs, an interrupt request is generated if the PE is configured to generate counter overflow 
interrupts. For more information, see Generating overflow interrupt requests. 


Note 


Software executing at EL1 or higher must take care that setting PMCR.LP or HDCR.HLP does not cause software 
executing at lower Exception levels to malfunction. If legacy software accesses the PMU at lower Exception levels, 
software at the higher Exception levels should not set the PMCR.LP or HDCR.HLP fields to 1. However, if the 

legacy software does not use the counter overflow, it is not affected by setting the PMCR.LP or HDCR.HLP to 1. 








D7.3.1 Generating overflow interrupt requests 
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Software can program the Performance Monitors so that an overflow interrupt request is generated when a counter 
overflows. See PMINTENSET and PMINTENCLR. 





Note 
è The mechanism by which an interrupt request from the Performance Monitors generates an FIQ or IRQ 
exception is IMPLEMENTATION DEFINED. 
° Arm recommends that the overflow interrupt requests: 
— Translate into a PMUIRQ signal, so that they are observable to external devices. 


— Connect to inputs on an IMPLEMENTATION DEFINED generic interrupt controller as a Private Peripheral 
Interrupt (PPI) for the originating processor. See the ARM Generic Interrupt Controller Architecture 
Specification for information about PPIs. 


— Connect to a Cross Trigger Interface (CTD, see Chapter H5 The Embedded Cross-Trigger Interface. 
è Arm strongly discourages implementations from connecting overflow interrupt requests from multiple PEs 


to the same System Peripheral Interrupt (SPI) identifier. 
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s From GICv3, the ARM” Generic Interrupt Controller Architecture Specification recommends that the Private 
Peripheral Interrupt (PPI) with ID 23 is used for overflow interrupt requests. 





Software can write to the counters to control the frequency at which interrupt requests occur. For example, software 
might set a 32-bit counter to @xFFFFQ000, to generate another counter overflow after 65536 increments, and reset it 
to this value every time an overflow interrupt occurs. 





Note 


If an event can occur multiple times in a single clock cycle, then counter overflow can occur without the counter 
registering a value of zero. 





The overflow interrupt request is a level-sensitive request. The PE signals a request for: 

à Any given PMEVCNTR<n> counter, when the value of PMOVSSET[n] is 1, the value of 
PMINTENSET[n] is 1, and one of the following is true: 
—  EL2 is not implemented and the value of PMCR.E is 1. 
—  EL2 is implemented, n is less than the value of HDCR.HPMN, and the value of PMCR.E is 1. 
—  EL2 is implemented, n is greater than or equal to the value of HDCR.HPMN, and the value of 

HDCR.HPME is 1. 
g The cycle counter, when the values of PMOVSSET[31], PMINTENSET[31], and PMCR.E are all 1. 


The overflow interrupt request is active in both Secure and Non-secure states. In particular, if EL3 and EL2 are both 
implemented, overflow events from PMEVCNTR<n> where n is greater than or equal to the value of 
HDCR.HPMN can be signaled from all modes and states but only if the value of HDCR.HPME is 1. 


The interrupt handler for the counter overflow request must cancel the interrupt request, by writing to 
PMOVSCLRĪn] to clear the overflow bit to 0. 


Pseudocode description of overflow interrupt requests 


See Chapter J1 Armv8 Pseudocode for a pseudocode description of overflow interrupt requests. The 
AArch64.CheckForPMUOverflow() and AArch32.CheckForPMUOverflow() pseudocode functions signal PMU overflow 
interrupt requests to an interrupt controller and PMU overflow trigger events to the cross-trigger interface. 
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An event caused by the PE counting the event is Attributable. If an agent other than the PE that is counting the events 
causes an event, these events are Unattributable. 


D7.4 Attributability 


An event is defined as being either Attributable or Unattributable. If the event is Attributable, it is further defined 
whether it is Attributable to: 


The current Security state of the PE. 
The current Exception level of the PE. 


When the PE is in Debug state, operations issued to the PE by the debugger through the external debug 


interface. 


In a multithreaded implementation, an event might be Attributable either to the current Exception level alone, or to 
both the Exception level and the Security state of another PE with the same values for affinity level 1 and higher. 


Note 





In an implementation containing multiple PEs, each PE is identified by a unique affinity value reported by 
MPIDR_EL1 {Aff3, Aff2, Affl, Aff0}, where the value of affinity level 0 is the most significant for 
determining the PE behavior, and the values of higher affinity levels are less significant. Affinity level 3 is 


only supported in AArch64 state. 


An implementation is described as multithreaded when the lowest level of affinity consists of logical PEs that 
are implemented using a multithreading type approach. In this section, when referring to a multithreaded 


implementation, thread is used to mean processing elements with: 
—  MPIDR_EL1.MT or MPIDR.MT set to 1, 
— Different values for affinity level 0. 


— The same values for affinity level 1 and higher. 





An event can be defined as the combination of multiple subevents, which can be either Attributable or 
Unattributable. 


All architecturally defined events are Attributable, unless otherwise stated. 


Unattributable events might be counted when Attributable events are not counted. See: 


Interaction with EL3 on page D7-2679. 
Event filtering on page D7-2682. 
Performance Monitors and Debug state on page D7-2684. 


These sections are summarized by Table D7-1 for events Attributable to the processor, and Unattributable events. 


Table D7-1 Counting events 

















Event type 
Counter and Allowed or : yP 
PMU enabled State rohibited Filtered 
i If Attributable to: Then Else 
Yes Non- Allowed Not filtered X Count Count 
debug 
Filtered Current Exception Do not count IMPLEMENTATION DEFINED 
level 
Prohibited X Current Security Do not count IMPLEMENTATION DEFINED 
state 
Debug X X Debugger Do not count IMPLEMENTATION DEFINED 
operations or raw 
cycles 
No X X X X Do not count Do not count 
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D7.5 Effect of EL3 and EL2 


This section describes the effects of implementing EL3 and EL2 on the Performance Monitors. It contains the 
following subsections: 


. Interaction with EL3. 
. Interaction with EL2. 


D7.5.1 Interaction with EL3 


From reset, counting events Attributable to Secure state is prohibited in Secure state. EL3 can prohibit counting of 
events Attributable to Secure state, and if ARMv8.5-PMU is implemented, cycles in Secure state. If EL3 is not 
implemented, the behavior is as if the value of SDCR.SPME or MDCR_EL3.SPME is 1, as appropriate. See 
Prohibiting event counting. 


Software executing at EL3 can trap attempts by lower Exception levels to access the PMU. This means that the 
Secure monitor can identify any software which is using the PMU and switch contexts, if required. 


In AArch32 state, the Performance Monitors registers are Common registers, see Classification of System registers 
on page G5-5850. 


D7.5.2 Interaction with EL2 


When EL2 is implemented, software executing at EL2 or EL3 can: 


° Program HDCR.HPMN to reserve the highest-numbered event counters by partitioning the event counters 
into two sets. Each set has its own global controls. 


; Trap any attempt by ELO or EL1 to access the PMU. This means the hypervisor can identify which Guest 
OSs are using the PMU and intelligently employ switching of the PMU state. 


7 Trap accesses to PMCR by ELO or EL1. 


a If ARMv8.1-PMU is implemented, software can prohibit counting of events Attributable to EL2 by the 
counters accessible to EL1 and ELO. 


è If ARMv8.5-PMU is implemented, software can prohibit counting of cycles at EL2. 


When EL2 is implemented and enabled in the current Security state, software executing at EL1 and, if enabled by 
PMUSERENR ELO, ELO: 


. Will read the value of HDCR.HPMN for PMCR.N. 


° Cannot access the highest-numbered event counters, or the controls associated with them. 


For more information, see: 
° Counter enables on page D7-2685. 
e Counter access on page D7-2687. 


. Prohibiting event counting 


D7.5.3 Prohibiting event counting 
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Counting Attributable events in Secure state is prohibited unless any one of the following is true: 
. EL3 is not implemented. 

s EL3 is implemented, is using AArch64, and the value of MDCR_EL3.SPME is 1. 

è EL3 is implemented, is using AArch32, and the value of SDCR.SPME is 1. 


: EL3 is implemented, EL3 or EL1 is using AArch32, executing at ELO, and the value of 
SDER32_EL3.SUNIDEN is 1. 
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: If ARMv8.2-Debug is not implemented, EL3 is implemented, and counting is permitted by an 
IMPLEMENTATION DEFINED authentication interface, ExternalSecureNoninvasiveDebugEnabled() == TRUE. 
Note 


Software can read the Authentication Status register, DBGAUTHSTATUS to determine the state of an 
IMPLEMENTATION DEFINED authentication interface. 








Counting Attributable events at EL2 is prohibited unless any of the following are true: 

. ARMv8.1-PMU is not implemented. 

° HDCR.HPMD is 0. 

. The event is being counted by an event counter reserved by HDCR.HPMN for use by the hypervisor. 


If ARMv8.4-SecEL2 is implemented, counting Attributable events at Secure EL2 is prohibited if counting events 
in Secure state is prohibited or counting events at EL2 is prohibited. 


The accessibility of Performance Monitors registers is unaffected by whether event counting is enabled or 
prohibited. 


The cycle counter, PMCCNTR, counts unless one of the following is true: 

à Event counting is prohibited and PMCR.DP is set to 1. 

- The PE is in Debug state. 

s ARMv8.5-PMU is implemented, EL3 is implemented, the PE is in Secure state, and SDCR.SCCD is set to 1. 


s ARMv8.5-PMU is implemented, EL2 is implemented, the PE is executing at EL2, and HDCR.HCCD is set 
to 1. 


For each Unattributable event, it is IMPLEMENTATION DEFINED whether it is counted when counting Attributable 
events is prohibited. 


See AArch64.CountEvents() and AArch32.CountEvents() in Chapter J1 Armv8 Pseudocode for more information. The 
CountEvents() functions return TRUE if PMEVCNTR<n> counts events or the cycle counter counts cycles at the 
current Exception level and state. However, these functions do not completely describe the behavior for 
Unattributable events. 


The Performance Monitors are intended to be broadly accurate and statistically useful, see Accuracy of the 
Performance Monitors on page D7-2673. Some inaccuracy is permitted at the point of changing Security state, 
however. To avoid the leaking of information from the Secure state, the permitted inaccuracy is that transactions 
that are not prohibited can be uncounted. Where possible, prohibited transactions must not be counted, but if they 
are counted, then that counting must not degrade security. 


Multithreaded implementations 


If an implementation is multithreaded and the value of PMEVTYPER<n>.MT ==1, then the PE does not count an 
event that is Attributable to Secure state or EL2 on another thread if counting events Attributable to Secure state or 
EL2 is prohibited on the PE that is counting the events. 


Example D7-1 The effect of having PMEVTYPER<n>.MT == 


If the value of MDCR_EL3.SPME is 0 on one thread, then it does not count events Attributable to Secure state on 
another thread, even if one or both of the following applies: 


° This thread is in Non-secure state. 
. MDCR_EL3.SPME==I on the other thread. 
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Example D7-2 The effect of having PMEVTYPER<n>.MT == 1 


If the value of MDCR_EL2.HPMD is 1 on one thread, then it does not count events Attributable to EL2 on another 
thread, even if MDCR_EL2.HPMD==0 or the PE is using another Exception level on the other thread. 


Otherwise: 

$ When the current configuration prohibits counting of events Attributable to Secure state or EL2 in Secure 
state or at EL2, it is IMPLEMENTATION DEFINED whether: 
— Counting events Attributable to Secure state on this PE in Non-secure state is permitted. 
— Counting events Attributable to EL2 when this PE is using another Exception level is permitted 


— Counting Unattributable events related to other secure operations in the system or at EL2 is permitted. 


: Otherwise, counting events that are not prohibited on either PE is permitted. 
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D7.6 Event filtering 


The PMU can filter events by various combinations of Exception level and Security state. This gives software the 
flexibility to count events across multiple processes. 


D7.6.1 Filtering by Exception level and PE state 
In AArch64 state: 


è For each event counter PMEVTYPER<n>_EL0 specifies the Exception levels in which the counter counts 
events Attributable to Exception levels. 


° PMCCFILTR_ELO specifies the Exception levels in which the cycle counter counts. 
In an implementation that supports multithreading: 


s When the value of PMEVTYPER<n>_ELO0.MT is 1, if an event is Attributable to another thread, then the 
specified filtering applies to the current Exception level and PE state of the thread to which the event is 
attributable, regardless of the Exception level and state of the counting thread. 


5 When the value of PMEVTYPER<n>_EL0.MT is 0. the event only counts events that are attributable to the 
counting thread, and the filtering applies to the Exception level and PE state of the counting state, see 
Example D7-3. 


Example D7-3 Example of the effect of the PMEVTYPER<n>_EL0.MT control 


If the value of PMEVTYPER<n>_ELO.U is 0 on the current thread, then it does not count events Attributable to 
ELO on the other thread, even if this thread is not executing at ELO. 


Otherwise, for each Unattributable event, it is IMPLEMENTATION DEFINED whether the filtering applies. 
In AArch32 state, the filtering controls are provided by the PMEVTY PER<n> and PMCCFILTR registers. 


For more information, see the individual register descriptions. 


D7.6.2 Accuracy of event filtering 


For most events, it is acceptable that, during a transition between states, events generated by instructions executed 
in one state are counted in the other state. The following sections describe the cases where event counts must not be 
counted in the wrong state: 


° Exception-related events. 


7 Software increment events on page D7-2683. 


Exception-related events 


The PMU must filter events related to exceptions and exception handling according to the Exception level in which 
the event occurred. These events are: 


s EXC_TAKEN, Exception taken. 
s EXC_RETURN, Instruction architecturally executed, Condition code check pass, exception return. 


° CID_WRITE_RETIRED, Instruction architecturally executed, Condition code check pass, write to 
CONTEXTIDR. 


° TTBR_WRITE_RETIRED, Instruction architecturally executed, Condition code check pass, write to 
translation table base. 
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The PMU must not count an exception after it has been taken because this could systematically report a result of 
zero exceptions at ELO. Similarly, it is not acceptable for the PMU to count exception returns or writes to 
CONTEXTIDR after the return from the exception. 


Software increment events 


The PMU must filter software increment events according to the Exception level in which the software increment 
occurred. Software increment counting must also be precise, meaning the PMU must count every architecturally 
executed software increment event, and must not count any Speculatively executed software increment. 


Software increment events must also be counted without the need for explicit synchronization. For example, two 
software increments executed without an intervening Context synchronization event must increment the event 
counter twice. 


For more information, see SW_INCR, Instruction architecturally executed, Condition code check pass, software 
increment. 


D7.6.3 Pseudocode description of event filtering 
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See AArch64.CountEvents() and AArch32.CountEvents() in Chapter J1 Armv8 Pseudocode for a pseudocode 
description of event filtering. However, this function does not completely describe the behavior for Unattributable 
events. 
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D7.7 Performance Monitors and Debug state 


Events that count cycles are not counted in Debug state. 


Events Attributable to the operations issued by the debugger through the external debug interface are not counted 
in Debug state. 


In an implementation that supports multithreading, when the value of PMEVTYPER<n>_ELO.MT is 1, if an event 
is Attributable to an operation issued by the debugger through the external debug interface to another thread that is 
in Debug state, then the event is not counted, and it is implementation defined whether the event is counted when 
the counting thread is in Debug state. 


For each Unattributable event, it is IMPLEMENTATION DEFINED whether it is counted when the counting PE is in 
Debug state. If the event might be counted, then the rules in Filtering by Exception level and PE state on 
page D7-2682 apply for the current Security state in Debug state. 
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Table D7-2 shows an implementation that does not include EL2, and where the PMCR.E bit is a global counter 
enable bit, and PMCNTENSET provides an enable bit for each counter. 


Table D7-2 Event counter enables when an implementation does not include EL2 











PMCR.E PMCNTENSET[n] == PMCNTENSET[n] == 

0 PMEVCNTR<n> PMEVCNTR<n> 
disabled disabled 

1 PMEVCNTR<n> PMEVCNTR<n> enabled 
disabled 





If the implementation includes EL2, then in addition to the PMCR.E and PMCNTENSET enable bits: 
. HDCR.HPME overrides the value of PMCR.E for counters configured for access in Hyp mode. 


è HDCR.HPMN specifies the number of performance counters that the Guest OS can access. The minimum 
permitted value of HDCR.HPMN is 1, meaning there must be at least one counter that the Guest OS can 
access. 


Table D7-3 shows the combined effect of all the counter enable controls. 


Table D7-3 Event counter enables when an implementation includes EL2 















































PMCNTENSET[n] == 
HDCR.HPME PMCR.E PMCNTENSET[n] == 
n < HDCR.HPMN n2HDCR.HPMN 
0 PMEVCNTR<n> PMEVCNTR<n> PMEVCNTR<n> 
disabled disabled disabled 
0 PMEVCNTR<n> PMEVCNTR<n> PMEVCNTR<n> 
disabled enabled disabled 
1 PMEVCNTR<n> PMEVCNTR<n> PMEVCNTR<n> 
disabled disabled enabled 
1 PMEVCNTR<n> PMEVCNTR<n> PMEVCNTR<n> 
disabled enabled enabled 
Note 





s The effect of HDCR. {HPME, HPMN} on the counter enables applies at all Exception levels and in both 


Security states. 


è The value returned for PMCR.N is not affected by HDCR.HPMN at: 


—  EL3. 
— EL2. 


— Secure EL1, if ARMv8.4-SecEL2 is not implemented or Secure EL2 is disabled. 
— Secure ELO, if ARMv8.4-SecEL2 is not implemented and enabled. 
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EL2 does not affect the enabling of PMCCNTR. Table D7-4 shows the PMCCNTR enables, for all 














implementations. 
Table D7-4 Cycle counter enables 
PMCR.E PMCNTENSET[31] ==0 PMCNTENSET[31] == 
0 PMCCNTR disabled PMCCNTR disabled 
1 PMCCNTR disabled PMCCNTR enabled 
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D7.9 Counter access 


Allimplemented counters are accessible in EL3 and EL2. If EL2 is implemented the hypervisor uses HDCR.HPMN 
to reserve an event counter, with the effect that if EL2 is enabled in the current Security state, software cannot access 
that counter and its associated state from ELO or EL1. 


Note 





This section describes a counter as being accessible from a particular Exception level and state. However, access to 
the registers is subject to the access permissions described in Configurable instruction enables and disables, and 
trap controls on page D1-2326. In particular, accesses from ELO might be UNDEFINED and accesses might be 
trapped to EL1 or EL2. 





D7.9.1 PMEVCNTR<n> event counters 


For an implementation that includes EL2 and EL3, Table D7-5 shows how the values of the HDCR.HPMN field 
control the behavior of accesses to the PMEVCNTR<n> event counter registers. In this table: 

















NS The Effective value of SCR_EL3.NS. 
EEL2 The Effective value of SCR_EL3.EEL2. 
Table D7-5 Result of PMEVCNTR<n> event counter accesses 
Access at Exception level 
Condition NS EEL2 
EL3 EL2 EL1 ELO 
n<HDCR.HPMN X X Succeeds Succeeds if EL2 is implemented and Succeeds Succeeds 
enabled in the current Security state 
n2 HDCR.HPMN 0 0 Succeeds n/a Succeeds Succeeds 
1 Succeeds Succeeds No access No access 
1 X Succeeds Succeeds No access No access 
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Where Table D7-5 shows no access: 


If PMSELR.SEL is n then: 


— A direct read of PMXEVTYPER or PMXEVCNTR is CONSTRAINED UNPREDICTABLE. 
— A direct write to PMXEVTYPER or PMXEVCNTR is CONSTRAINED UNPREDICTABLE. 


A direct read of PMEVTYPER<n> or PMEVCNTR<n> is CONSTRAINED UNPREDICTABLE. 


A direct write of PMEVTYPER<n> or PMEVCNTR<n> is CONSTRAINED UNPREDICTABLE. 


For direct reads and direct writes, PMOVSCLR[n], PMOVSSET[n], PMCNTENSET[n], 


PMCNTENCLR[n], PMINTENSET[n], and PMINTENCLR[n] are RAZ/WI. 


Direct writes to PMSWINC[n] are ignored. 


A direct write of 1 to PMCR.P does not reset PMEVCNTR<n> 


For more information on the CONSTRAINED UNPREDICTABLE behavior of the Performance Monitor Extension, see: 


For AArch32, The Performance Monitors Extension on page K1-7613. 
For AArch64, The Performance Monitors Extension on page K1-7632. 
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D7.9.2 Cycle counter 


The PMU does not provide any control that a hypervisor can use to reserve the cycle counter for its own use. The 
only control over the cycle counter is an access permission control for ELO. See Configurable instruction enables 
and disables, and trap controls on page D1-2326. 
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D7.10 PMU events and event numbers 


The following sections describe the events that can be counted and their associated event numbers, and the 
mnemonics for the events: 


. Definitions. 

$ The PMU event number space and common events on page D7-2693. 

7 Common event numbers on page D7-2694. 

. Cycle event counting on multithreaded implementations on page D7-2719. 

. Meaningful ratios between common microarchitectural events on page D7-2720. 


° Required events on page D7-2720. 
e IMPLEMENTATION DEFINED event numbers on page D7-2721. 


D7.10.1 Definitions 
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The following subsections give more information about terms used in the event definitions: 
. Definition of terms. 

. Levels of caches and TLBs on page D7-2692. 

. Shared caches and buses on page D7-2692. 


Definition of terms 


Instruction architecturally executed 


Instruction architecturally executed is a class of event that counts for each instruction of the 
specified type. Architecturally executed means that the program flow is such that the counted 
instruction would be executed in a Simple sequential execution of the program. Therefore an 
instruction that has been executed and retired is defined to be architecturally executed. When a PE 
can perform speculative execution, an instruction is not architecturally executed if the PE discards 
the results of the speculative execution. 


If an instruction that would be executed in a Simple sequential execution of the program generates 
a synchronous exception, it is IMPLEMENTATION DEFINED whether the instruction is counted. 


Each architecturally executed instruction is counted once, even if the implementation splits the 
instruction into multiple operations. Instructions that have no visible effect on the architectural state 
of the PE are architecturally executed if they form part of the architecturally executed program flow. 
The point where such instructions are retired is IMPLEMENTATION DEFINED. 


Examples of instructions that have no visible effect are: 


° A NOP. 

. A conditional instruction that fails its Condition code check. 

. A Compare and Branch on Zero, CBZ, instruction that does not branch. 

° A Compare and Branch on Nonzero, CBNZ, instruction that does not branch. 


The point at which an event causes an event counter to be updated is not defined. 


Unless otherwise stated, all instructions of the specified type are counted even if they have no visible 
effect on the architectural state of the PE. This includes a conditional instruction that fails its 
Condition code check. 


For events that count only the execution of instructions that update context state, such as writes to 
the CONTEXTIDR, if such an instruction is executed twice without an intervening Context 
synchronization event, it is CONSTRAINED UNPREDICTABLE whether the first instruction is counted. 


Instruction architecturally executed, Condition code check pass 


Instruction architecturally executed, Condition code check pass is a class of events that explicitly 
do not occur for: 


° A conditional instruction that fails its Condition code check. 
. A Compare and Branch on Zero, CBZ, instruction that does not branch. 
° A Compare and Branch on Nonzero, CBNZ, instruction that does not branch. 
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. A Test and Branch on Zero, TBZ, instruction that does not branch. 
° A Test and Branch on Nonzero, TBNZ, instruction that does not branch. 
° A Store-Exclusive instruction that does not write to memory. 


Otherwise, the definition of architecturally executed is the same as for Instruction architecturally 
executed. 


Instruction memory access 


A PE acquires instructions for execution through instruction fetches. Instruction fetches might be 


due to: 

` Fetching instructions that are architecturally executed. 

à The result of the execution of an instruction preload instruction, PLI. 

° Speculation that a particular instruction might be executed in the future. 


The relationship between the fetch of an individual instruction and an instruction memory access is 
IMPLEMENTATION DEFINED. For example, an implementation might fetch many instructions 
including a non-integer number of instructions in a single instruction memory access. 


Memory-read operations 


A PE accesses memory through memory-read operations and Memory-write operations. A 
memory-read operation might be due to: 


° The result of an architecturally executed memory-reading instructions. 
a The result of a Speculatively executed memory-reading instructions. 
° A translation table walk. 


For levels of cache hierarchy beyond the Level 1 caches, memory-read operations also include 
accesses made as part of a refill of another cache closer to the PE. Such refills might be due to: 


s Memory-read operations or Memory-write operations that miss in the cache 
a The execution of a data preload instruction. 
è The execution of an instruction preload instruction on a unified cache. 
s The execution of a cache maintenance instruction. 
— Note 


A preload instruction or cache maintenance instruction is not, in itself, an access to that 
cache. However, it might generate cache refills which are then treated as memory-read 
operations beyond that cache. 





. Speculation that a future instruction might access the memory location. 
. Instruction memory accesses. 
This list is not exhaustive. 


The relationship between memory-read instructions and memory-read operations is 
IMPLEMENTATION DEFINED. For example, for some implementations an LDP instruction that reads 
two 64-bit registers might generate one memory-read operation if the address is quadword-aligned, 
but for other addresses it generates two or more memory-read operations. 


Memory-write operations 


Memory-write operations might be due to: 


° The result of an architecturally executed memory-writing instructions. 
s The result of a Speculatively executed memory-writing instructions. 
— Note 


Speculatively executed memory-writing instructions that do not become architecturally executed 
must not alter the architecturally defined view of memory. They can, however, generate a 
memory-write operation that is later undone in some implementation specific way. 
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For levels of cache hierarchy beyond the Level 1 caches, memory-write operations also include 
accesses made as part of a write-back from another cache closer to the PE. Such write-backs might 


be due to: 

. Evicting a dirty line from the cache, to allocate a cache line for a cache refill, see 
Memory-read operations. 

- The execution of a cache maintenance instruction. 
— Note 


A cache maintenance instruction is not in itself an access to that cache. However, it might 
generate write-backs which are then treated as memory-write operations beyond that cache. 





è The result of a coherency request from another PE. 
This list is not exhaustive. 


The relationship between memory-writing instructions and memory-write operations is 
IMPLEMENTATION DEFINED. For example, for some implementations an STP instruction that writes 
two 64-bit registers might generate one memory-write operation if the address is quadword-aligned, 
but for other addresses it generates two or more memory-write operations. In some 
implementations, the result of two STR instructions that write to adjacent memory might be merged 
into a single memory-write operation. 


— Note 


The data written back from a cache that is shared with other PEs might not be data that was written 
by the PE that performs the operation that leads to the write-back. Nevertheless, the event is counted 
as a write-back event for that PE. 





Microarchitectural operation 


It is permissible for an implementation of a PE to break down instructions into separate, smaller, 
operations. The use of Microarchitectural operations (micro-ops) is IMPLEMENTATION DEFINED. 


An instruction might create one or more micro-ops at any point in the execution pipeline. For the 
purpose of event counting, the micro-ops are counted. The definition of a micro-op is 
implementation specific. An architecture instruction might create more than one micro-op for each 
instruction. micro-ops might also be removed or merged in the execution stream, so an architecture 
instruction might create no micro-ops for an instruction. Any arbitrary translation of instructions to 
an equivalent sequence of micro-ops is permitted. 


The counting of operations can indicate the workload on the PE. However, there is no requirement 
for operations to represent similar amounts of work, and direct comparisons between different 
microarchitectures are not meaningful. 


For example, an implementation might split an A32 or T32 LDM instruction of six registers into six 
micro-ops, one for each load, and a seventh address-generation operation to determine the base 
address or writeback address. Also, for doubleword alignment, the six load micro-ops might 
combine into four operations, that is, a word load, two doubleword loads, and a second word load. 
This single instruction can then be counted as five, or possibly six, events: 


. Four (Operation speculatively executed - Load) events. 
° One (Operation speculatively executed - Integer data processing) event. 
° One (Operation speculatively executed - Software change of the PC) event if the PC was one 


of the six registers in the LDM instruction. 


Slot 


An implementation of a PE might be able to execute multiple micro-ops in a single processor cycle. 
The maximum number of micro-ops that can be executed might vary at different points in the 
execution pipeline. 


To allow profiling of the utilization of the resource of the PE, an implementation specific point in 
the execution pipeline is chosen where the maximum number of micro-ops that can be executed is 
an IMPLEMENTATION DEFINED fixed value. 
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Each possible micro-op that can be executed at that point in a cycle is called a Slot. The maximum 
number of micro-ops that can be executed is defined by PMMIR.SLOTS. 


Speculatively executed 


Many events relate to speculatively executed operations. Here, speculatively executed means the PE 
did some work associated with one or more instructions but the instructions were not necessarily 
architecturally executed. 


There is no architecturally guaranteed relationship between a speculatively executed micro-op and 
an architecturally executed instruction. The results of such an operation can also be discarded, if it 
transpires that the operation was not required, such as a mispredicted branch. Therefore, Armv8-A 
defines these events as operation speculatively executed, where appropriate. 


— Note 


The definition of speculatively executed does not mean only those operations that are executed 
speculatively and later abandoned, for example due to a branch misprediction or fault. That is, 
speculatively executed operations must count operations on both false and correct execution paths. 





Different groups of events can have different IMPLEMENTATION DEFINED definitions of 
speculatively executed. Such groups share a common base type, which the event name denotes. 
Each of the events in the previous example is of the base type, operation speculatively executed. 


For groups of events with a common base type, speculatively executed operations are all counted 
on the same basis, which normally means at the same point in the pipeline. It is possible to compare 
the counts and make meaningful observations about the program being profiled. 


Within these groups, events are commonly defined with reference to a particular architecture 
instruction or group of instructions. In the case of speculatively executed operations this means 
operations with semantics that map to that type of instruction. 


Levels of caches and TLBs 


The mapping of different levels of cache or TLB to the PMU events is determined by the implementation. Although 
the CLIDR_EL1, or the AArch32 CLIDR, defines the implemented levels of cache, the architecture does provide 
any way of determining implemented levels of TLB. Also, many implementations include structures that provide 
some caching at a higher level than the level 1 caches or TLBs. Typically, these structures, that might be called 
Level 0 caches, or mini caches, or microcaches, are invisible to software. The implementation-specific nature of 
cache and TLB implementations mean that, in general, PMU event counts cannot be used reliably to make direct 
comparisons between different implementations. 


Shared caches and buses 


There is no architectural concept of a shared component. However, when a cache, a bus, or any other system 
component that might generate countable events is implemented, and: 


s The extent of the first-order effects due to an event from that component are only applicable to a single PE, 
then the event is not shared. 


. Otherwise, the event is shared. 


Second-order effects are not considered when determining if an event is shared. 


Example D7-4 First and second order effects of a cache miss in a multiple-PE implementation 


In an implementation that consists of two PEs, each with its own L1 cache, a cache miss by one of the PEs is a 
first-order effect of an access to its cache. Any snoop that is performed on the L1 cache of the other PE in the 
implementation as a result of that cache miss is a second order effect. 
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Note 


Shared events are inherently linked to microarchitectures and so the implementer must make an informed decision 
about how such events are implemented. 


D7.10.2 The PMU event number space and common events 


In Armv8.0, the event number space is 10 bits. Armv8.1 extends the event number space, and therefore the 
PMEVTYPER<n>_EL0.evtCount field to 16 bits, and is allocated as Table D7-6 shows. For more information 
about the entries in the A//ocation column see the text that follows this table: 


Table D7-6 Allocation of the PMU event number space 


Event numbers Allocation 





In all versions of Armv8 






































0x0000-0x003F Common architectural and microarchitectural events. 
0x0040-0x0OBF Arm-recommended common architectural and microarchitectural events. 
Qx00CO-0x03FF IMPLEMENTATION DEFINED events. 
From Armv8. 1 
0x0400-Ox3FFF IMPLEMENTATION DEFINED events. 
0x4000-0x403F Common architectural and microarchitectural events. 
0x4040-0x40BF Arm-recommended common architectural and microarchitectural events. 
x40CO-Ox7FFF IMPLEMENTATION DEFINED events. 
Qx8000-0x80FF Common architectural and microarchitectural SVE events. 
0x8100-0xBFFF Reserved. 
OxC000- OxCOBF Reserved. 
OxCOCO- OXFFFF IMPLEMENTATION DEFINED events. 


The meaning of the entries in the Allocation column of Table D7-6 is as follows: 


Common architectural and microarchitectural events 
Arm defines the use of these event numbers. For more information see Common event numbers on 
page D7-2694. 
Arm-recommended common architectural and microarchitectural events 
The use of these event numbers is IMPLEMENTATION DEFINED. For more information see: 
° IMPLEMENTATION DEFINED event numbers on page D7-2721. 
a Appendix K3 Recommendations for Performance Monitors Event Numbers for 
IMPLEMENTATION DEFINED Events. 
Common architectural and microarchitectural SVE events 


Arm defines the use of these event numbers. See the Arm” Architecture Reference Manual 
Supplement, the Scalable Vector Extension (SVE), for ArmvS-A. An implementation is not required 
to implement SVE in order to implement these events. 
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IMPLEMENTATION DEFINED event numbers 


For more information about the use of these event numbers see JMPLEMENTATION DEFINED 
event numbers on page D7-2721. 















































D7.10.3 Common event numbers 
The event numbers of the common architectural and microarchitectural events are reserved for the specified events. 
Each of these event numbers must either: 
° Be used for its assigned event. 
. Not be used. 
However, see Required events on page D7-2720. 
When an implementation supports monitoring of an event that is assigned a common architectural or 
microarchitectural event number, Arm strongly recommends that it uses that number for the event. However, 
software might encounter implementations where an event assigned a number in this range is monitored using an 
event number from an IMPLEMENTATION DEFINED range. 
Note 
Arm might define other common architectural and microarchitectural event numbers. This is one reason why 
software must not assume that an event with an assigned common architectural or microarchitectural event number 
is never monitored using an event number from the IMPLEMENTATION DEFINED range. 
Table D7-7 lists the PMU common architectural and microarchitectural event numbers in event number order. The 
entries in the Event mnemonic column link to the event description in Common architectural events on 
page D7-2698 or Common microarchitectural events on page D7-2703. 
Table D7-7 PMU common architectural and microarchitectural event numbers 
Event : ae 
Event type Event mnemonic Description 
number 
0x0000 Architectural SW_INCR Instruction architecturally executed, Condition code 
check pass, software increment 
0x0001 Microarchitectural = L1] CACHE _REFILL@ Level 1 instruction cache refill 
0x0002 Microarchitectural LII TLB REFILL? Attributable Level 1 instruction TLB refill 
0x0003 Microarchitectural LID CACHE REFILL Level 1 data cache refill 
0x0004 Microarchitectural LID CACHE Level 1 data cache access 
0x0005 Microarchitectural L1D_TLB _ REFILL? Attributable Level 1 data TLB refill 
0x0006 Architectural LD_RETIRED Instruction architecturally executed, Condition code 
check pass, load 
0x0007 Architectural ST_RETIRED Instruction architecturally executed, Condition code 
check pass, store 
0x0008 Architectural INST_RETIRED Instruction architecturally executed 
0x0009 Architectural EXC_TAKEN Exception taken 
Qx000A Architectural EXC_RETURN Instruction architecturally executed, Condition code 
check pass, exception return 
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Table D7-7 PMU common architectural and microarchitectural event numbers (continued) 





Event 



















































































nümber Event type Event mnemonic Description 

0x000B Architectural CID_WRITE_RETIRED Instruction architecturally executed, Condition code 
check pass, write to CONTEXTIDR 

0x000C Architectural PC_WRITE_RETIRED Instruction architecturally executed, Condition code 
check pass, software change of the PC 

0x000D Architectural BR_IMMED RETIRED Instruction architecturally executed, immediate branch 

0x000E Architectural BR_RETURN_RETIRED Instruction architecturally executed, Condition code 
check pass, procedure return 

0x000F Architectural UNALIGNED_LDST_RETIRED Instruction architecturally executed, Condition code 
check pass, unaligned load or store 

0x0010 Microarchitectural BR_MIS_PRED Mispredicted or not predicted branch Speculatively 
executed 

0x0011 Microarchitectural CPU_ CYCLES Cycle 

0x0012 Microarchitectural BR PRED Predictable branch Speculatively executed 

0x0013 Microarchitectural MEM_ACCESS Data memory access 

0x0014 Microarchitectural LII CACHE Attributable Level 1 instruction cache access 

0x0015 Microarchitectural LID CACHE WB Attributable Level 1 data cache write-back 

0x0016 Microarchitectural L2D CACHE Level 2 data cache access 

0x0017 Microarchitectural L2D_CACHE_REFILLa Level 2 data cache refill 

0x0018 Microarchitectural L2D_CACHE WB Attributable Level 2 data cache write-back 

0x0019 Microarchitectural | BUS ACCESS Bus access 

0x001A Microarchitectural MEMORY ERROR Local memory error 

0x001B Microarchitectural INST_SPEC Operation Speculatively executed 

Qx001C Architectural TTBR_WRITE RETIRED Instruction architecturally executed, Condition code 
check pass, write to TTBR 

0x001D Microarchitectural BUS CYCLES Bus cycle 

Ox0Q1E Architectural CHAIN For odd-numbered counters, increments the count by one 
for each overflow of the preceding even-numbered 
counter. For even-numbered counters, there is no 
increment. 

Qx001F Microarchitectural LID CACHE ALLOCATE Attributable Level 1 data cache allocation without refill 

0x0020 Microarchitectural L2D_CACHE ALLOCATE Attributable Level 2 data cache allocation without refill 

0x0021 Architectural BR_RETIRED Instruction architecturally executed, branch 

0x0022 Microarchitectural BR_MIS PRED RETIRED Instruction architecturally executed, mispredicted branch 

0x0023 Microarchitectural STALL FRONTEND No operation issued due to the frontend 

0x0024 Microarchitectural STALL BACKEND No operation issued due to backend 
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Table D7-7 PMU common architectural and microarchitectural event numbers (continued) 





Event 




























































































nümbef Event type Event mnemonic Description 

0x0025 Microarchitectural LID_ TLB Attributable Level 1 data or unified TLB access 

0x0026 Microarchitectural LII TEB Attributable Level 1 instruction TLB access 

0x0027 Microarchitectural L2I CACHE Attributable Level 2 instruction cache access 

0x0028 Microarchitectural L2I1_CACHE_REFILL4 Attributable Level 2 instruction cache refill 

0x0029 Microarchitectural L3D_CACHE ALLOCATE Attributable Level 3 data or unified cache allocation 
without refill 

Qx002A Microarchitectural L3D CACHE REFILL? Attributable Level 3 data cache refill 

0x002B Microarchitectural L3D_CACHE Attributable Level 3 data cache access 

0x002C Microarchitectural L3D_CACHE_WB Attributable Level 3 data or unified cache write-back 

0x002D Microarchitectural 12D TLB REFILL@ Attributable Level 2 data or unified TLB refill 

0x002E Microarchitectural L2I TLB_REFILL® Attributable Level 2 instruction TLB refill 

0x002F Microarchitectural L2D_TLB Attributable Level 2 data or unified TLB access 

0x0030 Microarchitectural L2I TLB Attributable Level 2 instruction TLB access 

0x0031 Microarchitectural REMOTE ACCESS Attributable access to another socket in a multi-socket 
system 

0x0032 Microarchitectural LL CACHE Attributable Last Level data cache access 

0x0033 Microarchitectural LL CACHE _ MISS? Attributable Last level data or unified cache miss 

0x0034 Microarchitectural DTLB_WALK@ Attributable data or unified TLB access with at least one 
translation table walk 

@x0035 Microarchitectural ITLB_ WALK@ Attributable instruction TLB access with at least one 
translation table walk 

0x0036 Microarchitectural LL CACHE RD Attributable Last Level cache memory read 

0x0037 Microarchitectural LL_CACHE_MISS_RD@ Attributable Last Level cache memory read miss 

0x0038 Microarchitectural REMOTE_ACCESS_RD2 Attributable memory read access to another socket in a 
multi-socket system 

0x0039 Microarchitectural L1ID_CACHE LMISS_ RD Level 1 data cache long-latency read miss 

0x003A Microarchitectural OP_RETIRED Micro-operation architecturally executed 

0x003B Microarchitectural OP_SPEC Micro-operation Speculatively executed 

Qx003C Microarchitectural STALL No operation sent for execution 

0x003D Microarchitectural STALL_SLOT BACKEND No operation sent for execution on a Slot due to the 
backend 

0x003E Microarchitectural STALL_SLOT_FRONTEND No operation send for execution on a Slot due to the 
frontend 

0x003F Microarchitectural STALL_SLOT No operation sent for execution on a Slot 
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Table D7-7 PMU common architectural and microarchitectural event numbers (continued) 





Event 



























































nümbeï Event type Event mnemonic Description 

0x4000 Microarchitectural SAMPLE_POP Sample Population 

0x4001 Microarchitectural SAMPLE_FEED Sample Taken 

0x4002 Microarchitectural SAMPLE FILTRATE Sample Taken and not removed by filtering 
0x4003 Microarchitectural SAMPLE COLLISION Sample collided with previous sample 
0x4004 Microarchitectural CNT CYCLES Constant frequency cycles 

0x4005 Microarchitectural STALL_BACKEND MEM Memory stall cycles 

0x4006 Microarchitectural L1I CACHE LMISS Level 1 instruction cache long-latency miss 
0x4009 Microarchitectural L2D_ CACHE LMISS_ RD Level 2 data cache long-latency read miss 
0x400A Microarchitectural L2I CACHE LMISS Level 2 instruction cache long-latency miss 
0x400B Microarchitectural L3D_CACHE LMISS_RD Level 3 data cache long-latency read miss 
0x4020 Microarchitectural LDST_ALIGN_LAT Access with additional latency from alignment 
0x4021 Microarchitectural LD ALIGN LAT Load with additional latency from alignment 
0x4022 Microarchitectural ST_ALIGN_LAT Store with additional latency from alignment 
0x4024 Microarchitectural MEM ACCESS CHECKED Checked data memory access 

0x4025 Microarchitectural MEM ACCESS CHECKED RD Checked data memory access, read 

0x4026 Microarchitectural MEM ACCESS CHECKED WR Checked data memory access, write 

Qx8002 Architectural SVE_INST_RETIRED SVE instructions architecturally executed 
0x8006 Microarchitectural SVE INST SPEC SVE operation speculatively executed 





a. For more information, see Meaningful ratios between common microarchitectural events on page D7-2720. 


The supported common architectural and microarchitectural events are identified by: 
$ The PMCEIDO_ELO and PMCEID1_ELO registers in AArch64 state. 
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° The PMCEIDO, PMCEID1, PMCEID2, and PMCEID3 registers in AArch32 state. 


Arm recommends that the value of 0 is used for the PMCEIDO_ELO or PMCEID1_ELO bit corresponding to any 
event that an implementation never generates, even if the implementation is considered to support but never count 
the event. 


Note 


: For example, if an implementation never generates the LID CACHE ALLOCATE event, event 31, Arm 
recommends that PMCEIDO_ELO[31] is RAZ. 





s In an implementation that supports both Execution states, each bit in the AArch64 PMCEIDO0_ELO0 and 
PMCEID1_ELO registers corresponds to a single bit in the AArch32 PMCEIDO, PMCEID1, PMCEID2, and 
PMCEID3 registers, and corresponding bits must have the same behavior. 





However, for some implementations, an event in the common events range might be generated by the system, 
meaning behavior can vary between systems. In such a case, the corresponding PMCEIDn_ELO bit might be RAO. 
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Event numbers that Table D7-6 on page D7-2693 shows as allocated for common architectural and 
microarchitectural events that are not shown in Table D7-7 on page D7-2694 are reserved. Future revisions of this 
manual, or of the architecture, might assign these reserved values to additional common events. Events that do not 
require additional features in the PMU can be implemented retrospectively, meaning an implementation of a 
particular version of the PMU specification might support common events that are first defined in a later version of 





the PMU specification. 
Note 
$ The requirement that an event that is implemented retrospectively does not require additional features in the 


PMU means that it must be possible to represent the event n the PMEVTY PER<n>_EL0.evtCount field. This 
means, for example, that an implementation with a 12-bit PMEVTYPER<n>_EL0.evtCount field can only 
implement events with event numbers 0x000-0OxFFF. 


. This means that, for example, an Armv7 PMUv2 implementation, for which the evtCount field is 8 bits, can 
include support for any of the event numbers that Table D7-7 on page D7-2694 defines in the range 
Qx00- OxFF. 





Common architectural events 
This section describes the use of the defined common architectural event numbers. 


For the common features, normally the counters must increment only once for each event. The event descriptions 
include any exceptions to this rule. 


In these definitions, the term architecturally executed means that the instruction flow is such that the counted 
instruction would have been executed in a Simple sequential execution model. 


The events corresponding to the common architectural event numbers are: 


0x0000, SW_INCR, Instruction architecturally executed, Condition code check pass, software increment 
The counter increments on writes to the PMSWINC register. 


If the PE performs two architecturally executed writes to the PMSWINC register without an 
intervening Context synchronization event, then the counter is incremented twice. 


If PMEVTYPER<n>_EL0.evtCount is set to 0x000, then in AArch64 state, counts MSR writes to 
PMSWINC _ELO with bit [n] set to 1. 


Ifthe value of PMEVTYPER<n>_ELO.MT is 1 then, in a multithreaded implementation, this counts 
writes by all PEs that have the same affinity at level 1 and above. 


0x0006, LD_ RETIRED, Instruction architecturally executed, Condition code check pass, load 
The counter increments for every executed memory-reading instruction. 


Note 


This event 0x006 does not count the return status value of a Store-Exclusive instruction. 





Whether the preload instructions PRFM, PLD, PLDW, PLI, count as memory-reading instructions is 
IMPLEMENTATION DEFINED. Arm recommends that if the instruction is not implemented as a NOP 
then it is counted as a memory-reading instruction. 

0x0007, ST_RETIRED, Instruction architecturally executed, Condition code check pass, store 
The counter increments for every executed memory-writing instruction. 
DC ZVA is counted as a store. 


The counter does not increment for a Store-Exclusive instruction that fails. 


0x0008, INST_RETIRED, Instruction architecturally executed 
The counter increments for every architecturally executed instruction. 


It is IMPLEMENTATION DEFINED whether the counter increments for the MOVPRFX instruction. 
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0x0009, EXC_TAKEN, Exception taken 


The counter increments for each exception taken. See Exception-related events on page D7-2682. 


—— Note 

The counter counts the PE exceptions described in: 

° For exceptions taken to an Exception level using AArch64, Exception entry on 
page D1-2293. 

g For exceptions taken to an Exception level using AArch32, AArch32 state exception 


descriptions on page G1-5536. 





0x000A, EXC_RETURN, Instruction architecturally executed, Condition code check pass, exception return 


The counter increments for each executed exception return instruction. See also Exception-related 
events on page D7-2682. The following sections define the counted instructions: 


. For an exception return from an Exception level using AArch64, Exception return on 
page D1-2303. 
. For an exception return from an Exception level using AArch32, Exception return 


instructions on page G1-5523. 


However, is CONSTRAINED UNPREDICTABLE whether this event counts the execution of an exception 
return instruction if either: 


° Execution of the instruction is, itself, CONSTRAINED UNPREDICTABLE. 


Note 


Examples of when an exception return instruction is CONSTRAINED UNPREDICTABLE are if the 
instruction is executed at ELO, or in AArch32 state in System mode. 





° Execution of the instruction sets PSTATE.IL and does not generate an exception return. 





Note 


A particular consequence of this CONSTRAINED UNPREDICTABLE behavior is that an implementation 
that does not support AArch32 state at EL1 or higher does not have to treat AArch32 MOVS PC, LR 
instructions, and related instructions, as exception return instructions. 





0x000B, CID_WRITE_RETIRED, Instruction architecturally executed, Condition code check pass, write to 
CONTEXTIDR 


The counter increments for every write to CONTEXTIDR. See Exception-related events on 
page D7-2682. 


If the PE performs two architecturally-executed writes to CONTEXTIDR without an intervening 
Context synchronization event, it is CONSTRAINED UNPREDICTABLE whether the first write is 
counted. 


When Armv8.1-VHE is implemented, the counter is: 


° Incremented as a result of the retirement of an instruction accessing the named register 
CONTEXTIDR_EL1, even when executing at EL2. 
° Not incremented as a result of the retirement of an instruction accessing the named 


CONTEXTIDR_EL12. 


Note 


The event is defined by the name used to access the register. The counter does not count writes to 
the named register CONTEXTIDR_EL2. 
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0x000C, PC_WRITE_RETIRED, Instruction architecturally executed, Condition code check pass, software 


change of the PC 
The counter increments for every software change of the PC. This includes all: 
. Branch instructions. 
a Memory-reading instructions that explicitly write to the PC. 
: Data-processing instructions that explicitly write to the PC. 
s Exception return instructions, ERET and RET. 


It is IMPLEMENTATION DEFINED whether the counter increments for any or all of: 


° BRK and BKPT instructions. 
a An exception generated because an instruction is UNDEFINED. 
° The exception-generating instructions, SVC, HVC, and SMC. 


It is IMPLEMENTATION DEFINED whether an ISB is counted as a software change of the PC. 
The counter does not increment for exceptions other than those explicitly identified in these lists. 


Note 


Conditional branches are only counted if the branch is taken. 








0x000D, BR IMMED_RETIRED, Instruction architecturally executed, immediate branch 
The counter counts all immediate branch instructions that are architecturally executed. 
In AArch32 state, the counter increments each time the PE executes one of the following 
instructions: 
e B{<c>} <label>. 
. BL{<c>} <label>. 
. BLX{<c>} <label>. 
° CBZ <Rn>, <label>. 
’ CBNZ <label>. 


In AArch6é4 state, the counter increments each time the PE executes an immediate branch 


instructions: 
. B <label>. 
. B.cond <label>. 


. BL <label>. 

. CBZ <Rn>, <label>. 
. CBNZ <Rn>, <label>. 
. TBZ <Rn>, <label>. 
. TBNZ <Rn>, <label>. 





Note 


Conditional branches are always counted, regardless of whether the branch is taken. 





Ifan ISB is counted as a software change of the PC instruction, then it is IMPLEMENTATION DEFINED 
whether an ISB is counted as an immediate branch instruction. 


0x000E, BR_RETURN_RETIRED, Instruction architecturally executed, Condition code check pass, 
procedure return 

In AArch32 state, the counter counts the following procedure return instructions: 

E BX R14. 

g MOV PC, LR. 

: POP {.., PC}. 

e LDR PC, [SP], #offset. 
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Note 


The counter counts only the listed instructions as procedure returns. For example, it does not count 
the following as procedure return instructions: 


° BX RQ, because Rm != R14. 
. MOV PC, RO, because Rm != R14. 
. LDM SP, {.., PC}, because writeback is not specified. 





. LDR PC, [SP, #offset], because this specifies the wrong addressing mode. 





In AArch64 state, the counter counts all architecturally executed RET instructions. 
0x000F, UNALIGNED_LDST_RETIRED, Instruction architecturally executed, Condition code check pass, 
unaligned load or store 


The counter counts each memory-reading instruction or memory-writing instruction access that 
would generate an Alignment fault when Alignment fault checking is enabled. 


This event does not count accesses that would generate an SP alignment fault exception if the 
applicable stack pointer alignment check is enabled, unless that access would also generate an 
Alignment fault Data Abort exception if Alignment fault checking is enabled. 


It is IMPLEMENTATION DEFINED whether this event counts accesses that generate an exception, 
including accesses that do generate Alignment fault Data Abort exceptions. 


See SP alignment checking on page D1-2287 for more information. 

See Unaligned data access on page E2-3834 for more information. 
0x001C, TTBR_WRITE_RETIRED, Instruction architecturally executed, Condition code check pass, write to 
TTBR 


The counter counts writes to TTBRO EL! and TTBR1_EL1 in AArch64 state and TTBRO and 
TTBR1 in AArch32 state. When EL3 is implemented and using AArch32, this includes counting 
writes to both banked copies of TTBRO and TTBR1. See Exception-related events on 

page D7-2682. 


If the PE executes two writes to the same TTBR, without an intervening Context synchronization 
event, it is CONSTRAINED UNPREDICTABLE whether the first write to the TTBR, is counted. 


If EL3 is implemented and using AArch64, the counter does not count writes to TTBRO_EL3. 


If EL2 is implemented and using AArch64, the counter does not count writes to TTBRO_EL2 and 
to VITBR_EL2. 


If EL2 is implemented and using AArch32, the counter does not count writes to HTTBR and to 
VTTBR. 


When Armv8.1-VHE is implemented, the counter is: 


e Incremented as a result of the retirement of an instruction accessing the named registers 
TTBRO_EL1 and TTBR1_EL1. 


° Not incremented as a result of the retirement of an instruction accessing the named registers 
TTBRO_EL12 and TTBR1_EL12. 
0x001E, CHAIN 


Even-numbered counters never increment as a result of this event. For an odd-numbered counter 
n+1, if ARMv8.5-PMU is implemented, the odd-numbered event counter does not increment if: 


a EL2 is not implemented and PMCR.LP is set to 1. 
. EL2 is implemented, <n> is less than HDCR.HPMN and PMCR.LP is set to 1. 


$ EL2 is implemented, <n+/> is greater than or equal to HDCR.HPMN and HDCR.HLP is set 
to 1. 


Otherwise, the odd-numbered event counter n+/ increments when an event increments the 
preceding even-numbered counter n on the same PE and causes an unsigned overflow of bits [31:0] 
of event counter n. 
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This means the CHAIN event can be used to link the odd-numbered counter with the preceding 
even-numbered counter to provide a 64-bit counter. 
Note 


When ARMv8.5-PMU is not implemented, the CHAIN event can be used by software to provide N 
32-bit counters, N/2 64-bit counters, or a mixture of 32-bit counters and 64-bit counters. 





The CHAIN event only counts overflows from the preceding even-numbered counter on the same 
PE. This means it is unaffected by the value of PMEVTYPER<n>_ELO.MT. 





To filter the Exception levels and Security states in which the event is counted, software must: 
° Program PMEVTYPER<n>_ELO to count the event in the required conditions. 


$ Program PMEVTYPER<n+1>_ELO to count the CHAIN event in all Exception levels and 
states. 


This allows, but does not require, hardware to ignore the filter settings for the CHAIN event and 
behave as if they are set to count in all Exception levels and states. 


If software does not program the event in this way, the count becomes UNPREDICTABLE. 


There is no atomic access to a pair of counters, so if software reads a counter-pair that is enabled, it 
must use a high-low-high read sequence, or employ reasonable heuristics, to avoid tearing. 
Similarly, if using CHAIN events, when disabling the counters software must take care that the 
result is not torn by the low counter overflowing at the same time as the counters are disabled 
Example D7-5 shows suitable sequences for disabling and enabling CHAIN counters. 


Example D7-5 Usage examples for 64-bit counters 


An example high-low-high read sequence for a 64-bit counter created by a pair of 32-bit counters paired by a 





CHAIN event is: 
RS W2,PMEVCNTR1_EL@ ;; read high counter, must be odd-numbered 
retry: 
ISB ;; force ordering 
RS WQ,PMEVCNTR@_EL@  ;; read low counter 
;; must return the previous counter to PMEVCNTR1_ELO 
ISB ;; force ordering 
RS W1,PMEVCNTR1_ELQ@ ;; read high counter 
CMP W1,W2 
BNE retry ;; if the high counter has changed, then retry 





When disabling a pair of counters that are paired by a CHAIN event, software must: 
l. Disable the low counter, by setting PMEVCNTR<n>_ELO[n] to 1. 
Typically, software uses a read-modify-write sequence to update PMCNTENCLR_ELO. 
2. Execute an ISB instruction, or perform another Context synchronization event. 
3, Disable the high counter, by setting PMCNTENCLR_ELO[n+1] to 1, or setting PMCR_ELO.E to 0. 
When enabling a pair of counters that are paired by a CHAIN event, software must: 


l. Enable the high counter, by setting PMCNTENCLR_ELO[n+1] to 0 and, if necessary, setting PMCR_ELO.E 
to 1. 


2: Execute an ISB instruction, or perform another Context synchronization event. 


3; Enable the low counter by setting PMCNTENCLR_ELO[n] to 0. 


When using 64-bit counters created by a pair of 32-bit counters paired by a CHAIN event, the 
architecture does not define the latency between the first counter overflowing and the second 
counter incrementing the CHAIN event. There is no requirement for updates to occur 
synchronously, but software reading or enabling the counter pair using a /ow-ISB-high sequence, as 
shown in Example D7-5, must not observe the low counter incrementing and overflowing for the 
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event and the high counter not incrementing for the resulting CHAIN event. This means that the ISB 
executed after reading the low counter must ensure the completion of the update of the high counter 
by the CHAIN event. 

0x0021, BR_RETIRED, Instruction architecturally executed, branch 


The counter counts all branches on the architecturally executed path that would incur cost if 


mispredicted. 

. Counts all branch instructions, memory-reading and data-processing instructions that 
explicitly write to the PC, at retirement. 

: Counts both taken and not-taken branches. 

‘ It is IMPLEMENTATION DEFINED whether this includes each of: 


— Unconditional direct branch instructions. 
—  Exception-generating instructions. 
— Exception return instructions. 


— Context synchronization instructions. 


0x8002, SVE_INST_RETIRED, Instruction architecturally executed, SVE 


This event counts architecturally executed SVE instructions. It is IMPLEMENTATION DEFINED 
whether this event counts non-SIMD SVE instructions. 


Common microarchitectural events 
This section describes the use of the defined common microarchitectural event numbers. 


The common microarchitectural events are features that are likely to be implemented across a wide range of 
implementations. Unlike the common architectural events, there can be some IMPLEMENTATION DEFINED variation 
between definitions on different implementations. 


Unless otherwise stated, the common microarchitectural features relate only to events resulting from the operation 
of the PE counting the events. Events resulting from the operation of other PEs that might share a resource must not 
be counted. Where a resource can be subject to events that do not result from the operation of any of the PEs that 
share it, Arm recommends that the resource implements its own event counters. An example ofa resource that might 
require its own event counters is a shared Level 2 cache that is subject to accesses from a system coherency port on 
that cache. 


The event definitions relating to Level 2 caches generally assume the Level 2 cache is shared. The event definitions 
relating to Level 1 caches generally assume the Level 1 cache is not shared. 


The events corresponding to the common microarchitectural event numbers are: 


0x0001, LIL CACHE_REFILL, Level 1 instruction cache refill 


The counter counts each access counted by LII CACHE that causes a demand refill of any of the 
Level 1 caches outside the Level 1 caches of this PE. 


A refill includes any access that causes data to be fetched from outside the cache, even if the data is 
ultimately not allocated into the cache. For example, data might be fetched into a buffer but then 
discarded, rather than being allocated into a cache. These buffers are treated as part of the cache. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. If ARMv8.4-PMU is not implemented, the counter does not count cache 
maintenance instructions. If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED 
whether accesses that result from cache maintenance instructions are counted by this event. 


See also: 
. Attributability on page D7-2677. 


. Meaningful ratios between common microarchitectural events on page D7-2720. 
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0x0002, LII TLB_REFILL, Attributable Level 1 instruction TLB refill 


The counter counts Attributable instruction memory accesses that cause a TLB refill of at least the 
Level 1 instruction TLB. This includes each Instruction memory access that causes an access to a 
level of memory system due to a translation table walk or an access to another level of TLB caching. 
It is IMPLEMENTATION DEFINED whether the count increments when: 

e A refill results in a Translation fault. 


. A refill is not allocated in the TLB. 


The counter does not count: 


s A TLB miss that does not cause a refill but does generate a translation table walk. 
. TLB maintenance instructions. 

See also: 

. Attributability on page D7-2677. 

. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0003, LID_CACHE_REFILL, Level 1 data cache refill 


The counter counts each access counted by LID CACHE that causes a demand refill of at least the 
Level 1 data or unified cache from outside the Level 1 cache. Each access to a cache line that causes 
a new linefill is counted, including those from instructions that generate multiple accesses, such as 
load or store multiples, and PUSH and POP instructions. In particular, the counter counts accesses to 

the Level 1 cache that cause a refill that is satisfied by another Level 1 data or unified cache, or a 

Level 2 cache, or memory. 


A refill includes any access that causes data to be fetched from outside the cache, even if the data is 
ultimately not allocated into the cache. For example, data might be fetched into a buffer but then 
discarded, rather than being allocated into a cache. These buffers are treated as part of the cache. 


The counter does not count: 


° A miss that does not cause a new refill but is satisfied by the refill of a previous miss, even 
if that previous refill is not complete at the time of the miss. 

à A miss that does not generate a refill, such as a write through the cache. 

$ If ARMv8.4-PMU is not implemented, cache maintenance instructions. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED whether 
accesses that result from cache maintenance instructions are counted by this event. 


See also: 
. Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0004, LID_CACHE, Level 1 data cache access 
If ARMv8.4-PMU is not implemented: 


a The counter counts each Memory-read operation or Memory-write operation that causes a 
cache access to at least the Level 1 data or unified cache. 


. The counter does not count cache maintenance instructions. 
If ARMv8.4-PMU is implemented: 


: The counter counts each Memory-read operation or Memory-write operation that cause a 
cache access, involving a data transfer to or from the cache, to at least the Level 1 data or 
unified cache. This includes accesses that transfer data to the cache when the data is not 
ultimately allocated to the cache. This does not include accesses that update the cache status 
information for the cache entry without changing the content of the cache data. 


° It is IMPLEMENTATION DEFINED whether accesses that result from cache maintenance 
instructions are counted. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. 
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Each access to a cache line is counted including the multiple accesses of instructions, such as LDM or 
STM. Each access to other Level 1 data or unified memory structures, for example refill buffers, write 
buffers, and write-back buffers, is also counted. 


See also Attributability on page D7-2677. 


0x0005, LID_TLB_REFILL, Attributable Level 1 data TLB refill 


The counter counts each Attributable Memory-read operation or Attributable Memory-write 
operation that causes a TLB refill of at least the Level 1 data or unified TLB. It counts each read or 
write that causes a refill, in the form of a translation table walk or an access to another level of TLB 
caching. It is IMPLEMENTATION DEFINED whether the count increments when: 

s A refill results in a Translation fault. 


. A refill is not allocated in the TLB. 


The counter does not count: 


è A TLB miss that does not cause a refill but does generate a translation table walk. 
° TLB maintenance instructions. 

See also: 

. Attributability on page D7-2677. 

. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0010, BR_MIS_PRED, Mispredicted or not predicted branch Speculatively executed 


The counter counts each correction to the predicted program flow that occurs because of a 
misprediction from, or no prediction from, the branch prediction resources and that relates to 
instructions that the branch prediction resources are capable of predicting. 


Ifno program-flow prediction resources are implemented, Arm recommends that the counter counts 
all branches that are not taken. 


0x0011, CPU_CYCLES, Cycle 


The counter increments on every cycle. 


All counters are subject to changes in clock frequency, including when a WFI or WFE instruction stops 
the clock. This means that it is CONSTRAINED UNPREDICTABLE whether or not CPU _ CYCLES 
continues to increment when the clocks are stopped by WFI and WFE instructions. 


— Note 


Unlike PMCCNTR, this count is not affected by PMCR.DP, PMCR.D, PMCR.C, SDCR.SCCD or 
HDCR.HCCD: 


° The counter is not incremented in prohibited regions, so is not affected by PMCR.DP. 
a The counter increments on every cycle, regardless of the setting of PMCR.D. 
. The counter is reset when event counters are reset by PMCR.P, never by PMCR.C. 


. The counter is not disabled when ARMv8.5-PMU is implemented, EL3 is implemented, the 
PE is in Secure state, and SDCR.SCCD is set to 1. 

. The counter is not disabled when ARMv8.5-PMU is implemented, EL2 is implemented, the 
PE is executing at EL2, and HDCR.HCCD is set to 1. 





In a multithreaded implementation, CPU_CYCLES counts each cycle for the processor for which 
this PE thread was active and could issue an instruction. For more information, see Cycle event 
counting on multithreaded implementations on page D7-2719. 


0x0012, BR_PRED, Predictable branch Speculatively executed 


The counter counts every branch or other change in the program flow that the branch prediction 
resources are capable of predicting. 


If all branches are subject to prediction, for example a BTB or BTAC, then all branches are 
predictable branches. 
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If branches are decoded before the predictor, so that the branch prediction logic dynamically 
predicts only some branches, for example conditional and indirect branches, then it is 
IMPLEMENTATION DEFINED whether other branches are counted as predictable branches. Arm 
recommends that all branches are counted. 


An implementation might include other structures that predict branches, such as a loop buffer that 
predicts short backwards direct branches as taken. Each execution of such a branch is a predictable 
branch. Terminating the loop might generate a misprediction event that is counted by 

BR_MIS PRED. 


If no program-flow prediction resources are implemented, this event is optional, but Arm 
recommends that BR_PRED counts all branches. 
0x0013, MEM ACCESS, Data memory access 


The counter counts Memory-read operations and Memory-write operations that the PE made. The 
counter increments whether the access results in an access to a Level 1 data or unified cache, a 
Level 2 data or unified cache, or neither of these. 


The counter does not increment as a result of: 


à Instruction memory accesses, see Definition of terms on page D7-2689. 
° Translation table walks. 
. Write-back from any cache. 


° Refilling of any cache. 
The number of accesses generated by each instruction is IMPLEMENTATION DEFINED. 


If ARMv8.4-PMU is not implemented, the counter does not count cache maintenance instructions. 
If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED whether accesses that result 
from cache maintenance instructions are counted. 


0x0014, LII CACHE, Attributable Level 1 instruction cache access 


If ARMv8.4-PMU is not implemented, the counter counts Attributable instruction memory accesses 
that access at least the Level 1 instruction or unified cache. 


If ARMv8.4-PMU is implemented, the counter counts Attributable instruction memory accesses, 
involving a data transfer to or from the cache, that access at least the Level 1 instruction or unified 
cache. This includes accesses that transfer data to the cache when the data is not ultimately allocated 
to the cache. This does not include accesses that update the cache status information for the cache 
entry without changing the content of the cache data. 


Each access to other Level 1 instruction memory structures, such as refill buffers, is also counted. 


See also Attributability on page D7-2677. 


0x0015, LID_ CACHE_WB, Attributable Level 1 data cache write-back 


The counter counts every write-back of data from the Level 1 data or unified cache. The counter 
counts each write-back that causes data to be written from the Level 1 cache to outside of the 
Level 1 cache. For example, the counter counts the following cases: 


° A write-back that causes data to be written to a Level 2 cache or memory. 
à A write-back of a recently fetched cache line that has not been allocated to the Level 1 cache. 
° Transfer of data from the Level 1 cache to outside of this cache made as a result of a 


coherency request. The conditions determining which of these are counted for transfers to 
other Level 1 caches within the same multiprocessor cluster are IMPLEMENTATION DEFINED. 


Each write-back is counted once, even if multiple accesses are required to complete the write-back. 


Whether write-backs made as a result of cache maintenance instructions are counted is 
IMPLEMENTATION DEFINED. 


The counter does not count: 


s The invalidation of a cache line without any write-back to a Level 2 cache or memory. 
° Writes from the PE that write through the Level 1 cache to outside of the Level 1 cache. 
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An Unattributable write-back event occurs when a requestor outside the PE makes a coherency 
request that results in write-back. If the cache is shared, then an Unattributable write-back event is 
not counted. If the cache is not shared, then the event is counted. See Attributability on 

page D7-2677. 


It is IMPLEMENTATION DEFINED whether a write of a whole cache line that is not the result of the 
eviction of a line from the cache, is counted. For example, this applies when the PE determines 
streaming writes to memory and does not allocate lines to the cache, or by a DC ZVA operation. 


See also Attributability on page D7-2677. 


0x0016, L2D_ CACHE, Level 2 data cache access 
If ARMv8.4-PMU is not implemented: 


è The counter counts each Memory-read operation or Memory-write operation that causes a 
cache access to at least the Level 2 data or unified cache. 


. The counter does not count cache maintenance instructions. 
If ARMv8.4-PMU is implemented: 


- The counter counts each Memory-read operation or Memory-write operation that cause a 
cache access, involving a data transfer to or from the cache, to at least the Level 2 data or 
unified cache. This includes accesses that transfer data to the cache when the data is not 
ultimately allocated to the cache. This does not include accesses that update the cache status 
information for the cache entry without changing the content of the cache data. 


. It is IMPLEMENTATION DEFINED whether accesses that result from cache maintenance 
instructions are counted. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. 


Each access to a cache line is counted including refills of and write-backs from the Level 1 data, 
instruction, or unified caches. Each access to other Level 2 data or unified memory structures, such 
as refill buffers, write buffers, and write-back buffers, is also counted. 


See also Attributability on page D7-2677. 


0x0017, LZ2D_ CACHE REFILL, Level 2 data cache refill 


The counter counts each access counted by L2D_CACHE that causes a refill of a demand refill of 
any of the Level 1 or Level 2 caches from outside the Level 1 and Level 2 caches of the PE. 


A refill includes any access that causes data to be fetched from outside the cache, even if the data is 
ultimately not allocated into the cache. For example, data might be fetched into a buffer but then 
discarded, rather than being allocated into a cache. These buffers are treated as part of the cache. 


For example, the counter counts: 


° Accesses to the Level 2 cache that cause a refill that is satisfied by another Level 2 cache, a 
Level 3 cache, or memory. 


. Refills of and write-backs from any Level 1 data, instruction or unified cache that cause a 
refill from outside the Level 1 and Level 2 caches. 


. Accesses to the Level 2 cache that cause a refill of a Level 1 cache from outside of the 
Level 1 and Level 2 caches, even if there is no refill of the Level 2 cache. 


The counter does not count, as events on this PE: 


. A miss that does not cause a new refill but is satisfied by the refill of a previous miss, even 
if that previous refill is not complete at the time of the miss. 

$ A miss that does not generate a refill, such as a write through the cache. 

` If ARMv8.4-PMU is not implemented, cache maintenance instructions. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED whether 
accesses that result from cache maintenance instructions are counted by this event. 
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See also: 
. Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0018, L2D_ CACHE_WB, Attributable Level 2 data cache write-back 


The counter counts every write-back of data from the Level 2 data or unified cache that occurs as a 
result of an operation by this PE. It counts each write-back that causes data to be written from the 
Level 2 cache to outside the Level 1 and Level 2 caches. For example, the counter counts: 


° A write-back that causes data to be written to a Level 3 cache or memory. 
a A write-back of a recently fetched cache line that has not been allocated to the Level 2 cache. 


Each write-back is counted once, even if it requires multiple accesses to complete the write-back. 
It is IMPLEMENTATION DEFINED whether the counter counts: 


. A transfer of data from the Level 2 cache to outside the Level 1 and Level 2 cache made as a 
result of a coherency request. 


. Write-backs made as a result of Cache maintenance instructions. 
The counter does not count: 
$ The invalidation of a cache line without any write-back to a Level 3 cache or memory. 


° Writes from the PE or Level 1 data or unified cache that write through the Level 2 cache to 
outside the Level 1 and Level 2 caches. 


s Transfers of data from the Level 2 cache to a Level 1 cache, to satisfy a Level 1 cache refill. 


An Unattributable write-back event occurs when a requestor outside the PE makes a coherency 
request that results in write-back. If the cache is shared, then an Unattributable write-back event is 
not counted. If the cache is not shared, then the event is counted. 


It is IMPLEMENTATION DEFINED whether a write of a whole cache line that is not the result of the 
eviction of a line from the cache, is counted. For example, this applies when the PE determines 
streaming writes to memory and does not allocate lines to the cache, or by a DC ZVA operation. 


See also Attributability on page D7-2677. 


0x0019, BUS_ACCESS, Attributable Bus access 


The counter counts Memory-read operations and Memory-write operations that access outside of 
the boundary of the PE and its closely-coupled caches. Where this boundary lies with respect to any 
implemented caches is IMPLEMENTATION DEFINED. 


The definition of a bus access is IMPLEMENTATION DEFINED but physically is a single beat rather 
than a burst. That is, for each bus cycle for which the bus is active. 


Bus accesses include refills of and write-backs from data, instruction, and unified caches. Whether 
bus accesses include operations that do use the bus but not explicitly transfer data is 
IMPLEMENTATION DEFINED. 


An Unattributable bus access occurs when a requestor outside the PE makes a request that results in 
a bus access, for example, a coherency request. If the bus is shared, then an Unattributable bus 
access is not counted. If the bus is not shared, then the event is counted. 


If the bus is shared, then only Attributable bus accesses are counted. If the bus is not shared, then 
all bus accesses are counted. 


Where an implementation has multiple buses at this boundary, this event counts the sum of accesses 
across all buses. 


If a bus supports multiple accesses per cycle, for example through multiple channels, the counter 
increments once for each channel that is active on a cycle, and so it might increment by more than 
one in any given cycle. 


The maximum increment in any given cycle is implementation defined. 


See also: 
. Attributability on page D7-2677. 
s Meaningful ratios between common microarchitectural events on page D7-2720. 
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0x001A, MEMORY ERROR, Local memory error 


The counter counts every occurrence of a memory error signaled by a memory closely coupled to 
this PE. The definition of local memories is IMPLEMENTATION DEFINED but includes caches, 
tightly-coupled memories, and TLB arrays. 


Memory error refers to a physical error detected by the hardware, such as a parity or ECC error. It 
includes errors that are correctable and those that are not. It does not include errors as defined in the 
architecture, such as MMU faults. 


0x001B, INST_SPEC, Operation Speculatively executed 


The counter counts Speculatively executed operations. The definition of Speculatively executed is 
IMPLEMENTATION DEFINED. 


0x001D, BUS_CYCLES, Bus cycle 


The counter increments on every cycle of the interface at the boundary of the PE and its 
closely-coupled caches. Where this boundary lies with respect to any implemented caches is 
IMPLEMENTATION DEFINED. 


Note —————_—— 


If the implementation clocks the external memory interface at the same rate as the processor 
hardware, the counter counts every cycle. 








See also Meaningful ratios between common microarchitectural events on page D7-2720. 


0x001F, LID CACHE ALLOCATE, Attributable Level 1 data cache allocation without refill 


The counter increments on every Attributable write that writes an entire line into the Level 1 cache 
without fetching from outside the Level 1 cache, for example: 


s A write from a coalescing buffer of a full cache line. 
. A DC ZVA operation. 


See also Attributability on page D7-2677. 


0x0020, LZD_ CACHE ALLOCATE, Attributable Level 2 data cache allocation without refill 


The counter increments on every Attributable write that writes an entire line into the Level 2 cache 
without fetching from outside the Level 1 or Level 2 caches, for example: 


; A write-back from a Level 1 to Level 2 cache. 
- A write from a coalescing buffer of a full cache line. 
. A DC ZVA operation. 


See also Attributability on page D7-2677. 


0x0022, BR_MIS_ PRED RETIRED, Instruction architecturally executed, mispredicted branch 
The counter counts all instructions counted by BR_RETIRED that were not correctly predicted. 


If no program-flow prediction resources are implemented, this event counts all retired not-taken 
branches. 


0x0023, STALL_ FRONTEND, No operation issued due to the frontend 


The counter counts every cycle counted by the CPU_CYCLES event on which no operation was 
issued because there are no operations available to issue for this PE from the frontend. 


The division between frontend and backend is IMPLEMENTATION DEFINED. STALL, 
STALL_FRONTEND, and STALL BACKEND events must count at the same point in the pipeline. 





Note ———___—_ 
° For a simplified pipeline model of Fetch —> Decode — Issue > Execute — Retire, 
Arm recommends that the events are counted when instructions are dispatched from Decode 
to Issue. 
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° On a given cycle, both events might be counted if the backend is unable to accept any 
operations and there are no operations available to issue from the frontend. 





For more information, see Cycle event counting on multithreaded implementations on 
page D7-2719. 


0x0024, STALL_BACKEND, No operation issued due to the backend 


The counter counts every cycle counted by the CPU_CYCLES event on which no operation was 
issued because either: 

. The backend is unable to accept any of the operations available for issue for this PE. 

à The backend is unable to accept any operations. 


For example, the back end might be unable to accept operations because of a resource conflict or 
non-availability. 


The division between frontend and backend is IMPLEMENTATION DEFINED. STALL, 
STALL_FRONTEND, and STALL_BACKEND events must count at the same point in the pipeline. 
See STALL FRONTEND for more information. 


For more information, see Cycle event counting on multithreaded implementations on 
page D7-2719. 
0x0025, L1D_TLB, Attributable Level 1 data or unified TLB access 


The counter counts each Attributable Memory-read operation or Attributable Memory-write 
operation that causes a TLB access to at least the Level 1 data or unified TLB. Each access to a TLB 
record is counted including the multiple accesses of instructions, such as LDM or STM. 


The counter does not count TLB maintenance instructions. 


See also Attributability on page D7-2677. 


0x0026, L1I TLB, Attributable Level 1 instruction TLB access 


The counter counts each Attributable Instruction memory access that causes a TLB access to at least 
the Level 1 instruction or unified TLB. 


The counter does not count TLB maintenance instructions. 


See also Attributability on page D7-2677. 


0x0027, L2I CACHE, Attributable Level 2 instruction cache access 


If ARMv8.4-PMU is not implemented, the counter counts Attributable instruction memory accesses 
that access at least the Level 2 instruction or unified cache. 


If ARMv8.4-PMU is implemented, the counter counts Attributable instruction memory accesses, 
involving a data transfer to or from the cache, that access at least the Level 2 instruction or unified 
cache. This includes accesses that transfer data to the cache when the data is not ultimately allocated 
to the cache. This does not include accesses that update the cache status information for the cache 
entry without changing the content of the cache data. 


Each Attributable access to other Level 2 instruction memory structures, such as refill buffers, is 
also counted. 


See also Attributability on page D7-2677. 


0x0028, L2I CACHE REFILL, Attributable Level 2 instruction cache refill 


The counter counts each access counted by L2I CACHE that causes a demand refill of any of the 
Level 1 or 2 caches outside the Level 1 or 2 caches of this PE. 


A refill includes any access that causes data to be fetched from outside the cache, even if the data is 
ultimately not allocated into the cache. For example, data might be fetched into a buffer but then 
discarded, rather than being allocated into a cache. These buffers are treated as part of the cache. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. If ARMv8.4-PMU is not implemented, the counter does not count cache 
maintenance instructions. If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED 
whether accesses that result from cache maintenance instructions are counted by this event. 
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See also: 
. Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0029, L3D_CACHE_ALLOCATE, Attributable Level 3 data cache allocation without refill 


The counter increments on every Attributable write that writes an entire line into the Level 3 cache 
without fetching from outside the Level 1, Level 2, or Level 3 cache, for example: 

° A write-back from a Level 2 to Level 3 cache. 

d A write from a coalescing buffer of a full cache line. 

. A DC ZVA operation. 


See also Attributability on page D7-2677. 


0x002A, L3D_CACHE_REFILL, Attributable Level 3 data cache refill 


The counter counts each access counted by L3D_ CACHE which causes a demand refill of any of 
the Level 1, Level 2, or Level 3 caches from outside the Level 1, Level 2, and Level 3 caches. 


A refill includes any access that causes data to be fetched from outside the cache, even if the data is 
ultimately not allocated into the cache. For example, data might be fetched into a buffer but then 
discarded, rather than being allocated into a cache. These buffers are treated as part of the cache. 


The counter does not count as events on this PE: 


° A miss that does not cause a new refill but is satisfied by the refill of a previous miss, even 
if that previous refill is not complete at the time of the miss. 

à A miss that does not generate a refill, such as a write through the cache. 

. If ARMv8.4-PMU is not implemented, cache maintenance instructions. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED whether 
accesses that result from cache maintenance instructions are counted by this event. 


See also: 
° Attributability on page D7-2677. 
s Meaningful ratios between common microarchitectural events on page D7-2720. 


0x002B, L3D_CACHE, Attributable Level 3 data cache access 
If ARMv8.4-PMU is not implemented: 
- The counter counts each Memory-read operation or Memory-write operation that causes a 
cache access to at least the Level 3 data or unified cache. 
e The counter does not count cache maintenance instructions. 
If ARMv8.4-PMU is implemented: 


ë The counter counts each Memory-read operation or Memory-write operation that cause a 
cache access, involving a data transfer to or from the cache, to at least the Level 3 data or 
unified cache. This includes accesses that transfer data to the cache when the data is not 
ultimately allocated to the cache. This does not include accesses that update the cache status 
information for the cache entry without changing the content of the cache data. 


. It is IMPLEMENTATION DEFINED whether accesses that result from cache maintenance 
instructions are counted. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. 


Each access to a cache line is counted including refills of and write-backs from the Level 1 or Level 
2 data, instruction, or unified caches. Each access to other Level 3 data or unified memory 
structures, such as refill buffers, write buffers, and write-back buffers, is also counted. 


See also Attributability on page D7-2677. 
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0x002C, L3D_CACHE_WB, Attributable Level 3 data cache write-back 


The counter counts every write-back of data from the Level 3 data or unified cache that occurs as a 
result of an operation by this PE. It counts each write-back that causes data to be written from the 
Level 3 cache to outside of the Level 1, Level 2, and Level 3 caches. For example, the counter 
counts the following cases: 


e A write-back that causes data to be written to a Level 4 cache, or to memory. 

s A write-back of a recently fetched cache line that has not been allocated to the Level 3 cache. 
Each write-back is counted once, even if multiple accesses are required to complete the write-back. 
It is IMPLEMENTATION DEFINED whether the counter counts: 


. A transfer of data from the Level 3 cache to outside the Level 1, Level 2, and Level 3 caches 
made as a result of a coherency request. 


° A write-back made as a result of a Cache maintenance instruction. 


The counter does not count: 

. The invalidation of a cache line without any write-back to a Level 4 cache or memory. 

. Writes from the PE, Level 1, or Level 2 data or unified cache, that write through the Level 3 
cache to outside of the Level 3 cache. 

° Transfers of data from the Level 3 cache to a Level 1 or Level 2 cache, to satisfy a Level 1 or 
Level 2 cache refill. 


An Unattributable write-back event occurs when a requestor outside the PE makes a coherency 
request that results in write-back. If the cache is shared, then Unattributable write-back events are 
not counted. If the cache is not shared, then Unattributable write-back events are counted. 


It is IMPLEMENTATION DEFINED whether a write of a whole cache line that is not the result of the 
eviction of a line from the cache, is counted. For example, this applies when the PE determines 
streaming writes to memory and does not allocate lines to the cache, or by a DC ZVA operation. 


See also Attributability on page D7-2677. 


0x002D, L2ZD_TLB_REFILL, Attributable Level 2 data TLB refill 


The counter counts each Attributable Memory-read operation or Attributable Memory-write 
operation that causes a TLB refill of at least the Level 2 data or unified TLB. It counts each 
Attributable read or Attributable write that causes a refill, in the form of a translation table walk or 
an access to another level of TLB caching. It is IMPLEMENTATION DEFINED whether the count 
increments when: 

: A refill results in a Translation fault. 


° A refill is not allocated in the TLB. 


The counter does not count: 


è A TLB miss that does not cause a refill but does generate a translation table walk. 
e TLB maintenance instructions. 

See also: 

. Attributability on page D7-2677. 

° Meaningful ratios between common microarchitectural events on page D7-2720. 


0x002E, L2I TLB_REFILL, Attributable Level 2 instruction TLB refill 


The counter counts Attributable instruction memory accesses that cause a TLB refill of at least the 
Level 2 instruction TLB. This includes each Attributable Instruction memory access that causes an 
access to a level of memory system due to a translation table walk or an access to another level of 
TLB caching. It is IMPLEMENTATION DEFINED whether the count increments when: 

: A refill results in a Translation fault. 


° A refill is not allocated in the TLB. 


The counter does not count: 


$ A TLB miss that does not cause a refill but does generate a translation table walk. 
° TLB maintenance instructions. 
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See also: 
° Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x002F, L2D_TLB, Attributable Level 2 data or unified TLB access 


The counter counts each Attributable memory read operation or Attributable memory write 
operation that causes a TLB access to at least the Level 2 data or unified TLB. Each access to a TLB 
record is counted, including the multiple accesses of instructions such as LDM or STM. 


The counter does not count TLB maintenance instructions. 


See also Attributability on page D7-2677. 


0x0030, L2I_ TLB, Attributable Level 2 instruction TLB access 


The counter counts each Attributable memory read operation or Attributable memory write 
operation that causes a TLB access to at least the Level 2 instruction or unified TLB. 


The counter does not count TLB maintenance instructions. 


See also Attributability on page D7-2677. 


0x0031, REMOTE_ACCESS, Access to another socket in a multi-socket system 


The counter counts each Attributable memory read operation or memory write operation that causes 
an access to another socket in a multi-socket system. 


It is IMPLEMENTATION DEFINED whether an access that causes a snoop into another socket but does 
not return data from or pass data to the remote socket is counted. 


See also Attributability on page D7-2677. 


0x0032, LL_CACHE, Last Level cache access 


The counter counts each Memory-read operation or Memory-write operation that causes a cache 
access to at least the Last Level data or unified cache. If the cache is shared, only events Attributable 
to this PE are counted. If the cache is not shared, all events are counted. 


If ARMv8.4-PMU is not implemented, the counter does not count cache maintenance instructions. 
If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED whether accesses that result 
from cache maintenance instructions are counted. 


See also Attributability on page D7-2677. 


0x0033, LL_CACHE MISS, Last Level cache miss 


The Counter counts each Attributable Memory-read operation or Memory-write operation that 
causes a cache access to at least the Last Level data or unified cache, but is not completed by the 
Last Level cache. That is, either of the following: 


$ A memory read operation that does not return data from the Last Level cache. 
a A memory write operation that does not update the Last Level cache. 
The counter does not count operations that are completed by a cache above the Last Level cache. 


If ARMv8.4-PMU is not implemented, the counter does not count cache maintenance instructions. 
If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED whether accesses that result 
from cache maintenance instructions are counted. 


See also: 
. Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0034, DTLB_WALK, Access to data TLB causes a translation table walk 


The counter counts each Attributable memory read or memory write operation that causes a refill of 
a data or unified TLB involving at least one translation table walk access. This includes each 
complete or partial translation table walk that causes an access to memory, including to data or 
translation table walk caches. 


The counter does not count TLB maintenance instructions. 
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See also: 
. Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0035, ITLB_WALK, Access to instruction TLB that causes a translation table walk 


The counter counts each Attributable Instruction memory access that causes a refill ofan instruction 
TLB, involving at least one translation table walk access. This includes each complete or partial 
translation table walk that causes an access to memory, including to data or translation table walk 
caches. 


The counter does not count TLB maintenance instructions. 


See also: 
. Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0036, LL_CACHE_RD, Attributable Last level cache memory read 


As LL CACHE, but counts only memory read accesses. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. If ARMv8.4-PMU is not implemented, the counter does not count cache 
maintenance instructions. If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED 
whether accesses that result from cache maintenance instructions are counted by this event. 


See also: 
. Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0037, LL_CACHE MISS_RD, Last level cache miss, read 


As LL_CACHE MISS, but counts only memory read operations. 


If ARMv8.4-PMU is not implemented, the counter does not count cache maintenance instructions. 
If ARMv8.4-PMU is implemented, it is IMPLEMENTATION DEFINED whether accesses that result 
from cache maintenance instructions are counted. 


See also: 
° Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0038, REMOTE_ACCESS_RD, Access to another socket in a multi-socket system, read 


As REMOTE ACCESS, but counts only memory read operations. 


See also: 
. Attributability on page D7-2677. 
. Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0039, LID_CACHE_LMISS_RD, Level 1 data cache long-latency read miss 





The counter counts each memory read access counted by LID_CACHE that incurs additional 
latency because it returns data from outside the Level 1 data or unified cache of this PE. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. It is IMPLEMENTATION DEFINED whether accesses that result from cache 
maintenance instructions are counted. 


The event indicates to software that the access missed in the Level 1 data or unified cache and might 
have a significant performance impact compared to the latency of an access that hits in the Level 1 
data or unified cache. 
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This counter does not count: 


è Access where the additional latency is unlikely to be significantly performance-impacting. 
For example, if the access hits in another cache in the same local cluster, and the additional 
latency is small when compared against a miss in all Level 1 caches that the access looks up 
in that results in an access being made to a Level 2 cache or elsewhere beyond the Level 1 
data and unified cache. 


. A miss that does not cause a new cache refill but is satisfied from a previous miss. 


An implementation is not required to measure the latency nor to track the access to determine 
whether the additional latency had a performance impact. An implementation can extend the 
definition of this event with additional scenarios where a memory read access counted by 
L1D_CACHE might have a significant performance impact due to additional latency for the 
address. 


See also Attributability on page D7-2677. 


0x003A, OP_RETIRED, Micro-operation architecturally executed 


The counter counts each operation counted by OP_SPEC that would be executed in a Simple 
sequential execution of the program. 


0x003B, OP_SPEC, Micro-operation Speculatively executed 


The counter counts the number of operations executed by the PE, including those that are executed 
speculatively and would not be executed in a Simple sequential execution of the program. 


0x003C, STALL, No operation sent for execution 


The counter counts every Attributable cycle on which no Attributable instruction or operation was 
sent for execution on this PE. 


If the implementation is multi-threaded: 


è When PMEVTYPER<n>_EL0.MT = 0b@, the counter counts cycles for which only 
instructions or operations Attributable to other PEs are sent for execution when this PE is 
eligible to execute instructions or operations on that cycle. The counter does not count cycles 
when this PE of the multi-threaded operation is not eligible to execute instructions or 
operations. 


. When PMEVTYPER<n>_EL0.MT = 0b1, the counter counts all cycles when no instructions 
or operations for any PE of the multi-threaded operation are sent for execution. 


The division between frontend and backend is IMPLEMENTATION DEFINED. STALL, 
STALL_FRONTEND, and STALL_BACKEND events must count at the same point in the pipeline. 
For more information, see STALL FRONTEND. 


See also: 
° Attributability on page D7-2677. 
° Meaningful ratios between common microarchitectural events on page D7-2720. 


0x003D, STALL_SLOT_BACKEND, No operation sent for execution on a Slot due to the backend 


Counts each Slot counted by STALL _ SLOT where no Attributable instruction or operation was sent 
for execution because the backend is unable to accept one of: 


s The instruction operation available for the PE on the Slot. 
. Any operations on the Slot. 


The division between frontend and backend is IMPLEMENTATION DEFINED. STALL SLOT, 
STALL_SLOT_FRONTEND, and STALL SLOT BACKEND events must count at the same point 
in the pipeline. The maximum value that STALL SLOT FRONTEND and 
STALL_SLOT_BACKEND events can count in a single-cycle is IMPLEMENTATION DEFINED. For 
more information, see STALL SLOT. 


See also Attributability on page D7-2677. 
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0x003E, STALL_SLOT_FRONTEND, No operation sent for execution on a Slot due to the frontend 


Counts each Slot counted by STALL_ SLOT where no Attributable instruction or operation was sent 
for execution because there was no Attributable instruction or operation available to issue from the 
PE from the frontend for the Slot. 


The division between frontend and backend is IMPLEMENTATION DEFINED. STALL_SLOT, 
STALL_SLOT_ FRONTEND, and STALL SLOT BACKEND events must count at the same point 
in the pipeline. The maximum value that STALL SLOT FRONTEND and 

STALL_SLOT_ BACKEND events can count ina single-cycle is implementation defined. For more 
information, see STALL SLOT. 


Note 


Arm recommends that STALL SLOT FRONTEND counts instructions that have been decoded 
and, if applicable, split into micro-operations. 








See also Attributability on page D7-2677. 


0x003F, STALL_SLOT, No operation sent for execution on a Slot 


The counter counts on each Attributable cycle the number of instruction or operation Slots that were 
not occupied by an instruction or operation Attributable to the PE. 
If the implementation is multi-threaded: 


è When PMEVTYPER<n>_EL0.MT = 0b@, the counter counts instruction or operation Slots 
for which those Slots are occupied by instructions or operations Attributable to other PEs of 
the multi-threaded implementation only when the PE was eligible to execute instruction or 
operations in that cycle. The counter does not count any instruction or operation Slots on 
cycles when this PE was not eligible to execute instructions or operations. 


è When PMEVTYPER<n>_ELO.MT = 0b1, for every cycle the counter counts all instruction 
or operation Slots not occupied by any instruction or operation for any PE of the 
multi-threaded implementation. 


If ARMv8.4-PMU is implemented: 


s If STALL_SLOT is not implemented, it is IMPLEMENTATION DEFINED whether the PMMIR 
System registers are implemented. 


$ If STALL_SLOT is implemented, then the PMMIR System registers are implemented. 
See also Attributability on page D7-2677. 


0x4000, SAMPLE POP, Sample Population 
The counter increments for each operation that might be sampled, whether or not the operation was 
sampled. Operations that are executed at an Exception level or Security state in which the Statistical 
Profiling Extension is disabled are not counted. 

0x4001, SAMPLE FEED, Sample Taken 


The counter increments each time the sample interval counter reaches zero and is reloaded, and the 
sample does not collide with the previous sample. Samples that are removed by filtering, or 
discarded, and not written to the Profiling Buffer are counted. 

0x4002, SAMPLE FILTRATE, Sample taken and not removed by filtering 


The counter increments each time that a completed sample record is checked against the filters and 
not removed. Sample records that are not removed by filtering, but are discarded before being 
written to the Profiling Buffer because of a Profiling Buffer management event, are counted. 
0x4003, SAMPLE COLLISION, Sample collided with a previous sample 
The counter increments for each sample record that is taken when the previous sampled operation 
has not completed generating its sample record. 
0x4004, CNT_CYCLES, Constant frequency cycles 
This event is defined identically to CNT_CYCLES in the AMUv1 architecture. 
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0x4005, STALL_ BACKEND MEM, Memory stall cycles 
This event is defined identically to STALL_ BACKEND MEM in the AMUV1 architecture. 


0x4006, LII CACHE LMISS, Level 1 instruction cache long-latency read miss 


The counter counts each access counted by LII CACHE that incurs additional latency because it 
returns instructions from outside the Level 1 instruction cache. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. It is IMPLEMENTATION DEFINED whether accesses that result from cache 
maintenance instructions are counted. 


The event indicates to software that the access missed in the Level | instruction cache and might 
have a significant performance impact due to the additional latency, compared to the latency of an 
access that hits in the Level 1 instruction cache. 


This counter does not count: 


s Access where the additional latency is unlikely to be significantly performance-impacting. 
For example, if the access hits in another cache in the same local cluster, and the additional 
latency is small when compared against a miss in all Level 1 caches that the access looks up 
in that results in an access being made to a Level 2 cache or elsewhere beyond the Level 1 
data and unified cache. 


. A miss that does not cause a new cache refill but is satisfied from a previous miss. 


An implementation is not required to measure the latency nor to track the access to determine 
whether the additional latency had a performance impact. An implementation can extend the 
definition of this event with additional scenarios where a memory read access counted by 

L11 CACHE might have a significant performance impact due to additional latency for the address. 


0x4009, L2D_ CACHE _LMISS _ RD, Level 2 data cache long-latency read miss 





The counter counts each memory read access counted by L2D_ CACHE that incurs additional 
latency because it returns data from outside the Level 2 data or unified cache of this PE. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. It is IMPLEMENTATION DEFINED whether accesses that result from cache 
maintenance instructions are counted. 


The event indicates to software that the access missed in the Level 2 data or unified cache and might 
have a significant performance impact compared to the latency of an access that hits in the Level 2 
data or unified cache. 


This counter does not count: 


° Access where the additional latency is unlikely to be significantly performance-impacting. 
For example, if the access hits in another cache in the same local cluster, and the additional 
latency is small when compared against a miss in all Level 2 caches that the access looks up 
in that results in an access being made to a Level 3 cache or elsewhere beyond the Level 2 
data and unified cache. This might be counted as a Level 1 cache miss. 


. A miss that does not cause a new cache refill but is satisfied from a previous miss. 


An implementation is not required to measure the latency nor to track the access to determine 
whether the additional latency had a performance impact. An implementation can extend the 
definition of this event with additional scenarios where a memory read access counted by 
L2D_CACHE might have a significant performance impact due to additional latency for the 
address. 


See also Attributability on page D7-2677. 


0x400A, L2I_ CACHE LMISS, Level 2 instruction cache long-latency read miss 


The counter counts each access counted by L2I CACHE that incurs additional latency because it 
returns instructions from outside the Level 2 instruction cache. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. It is IMPLEMENTATION DEFINED whether accesses that result from cache 
maintenance instructions are counted. 
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The event indicates to software that the access missed in the Level 2 instruction cache and might 
have a significant performance impact due to the additional latency, compared to the latency of an 
access that hits in the Level 2 instruction cache. 


This counter does not count: 


è Access where the additional latency is unlikely to be significantly performance-impacting. 
For example, if the access hits in another cache in the same local cluster, and the additional 
latency is small when compared against a miss in all Level 2 caches that the access looks up 
in that results in an access being made to a Level 3 cache or elsewhere beyond the Level 2 
data and unified cache. This might be counted as a Level 1 cache miss. 


. A miss that does not cause a new cache refill but is satisfied from a previous miss. 


An implementation is not required to measure the latency nor to track the access to determine 
whether the additional latency had a performance impact. An implementation can extend the 
definition of this event with additional scenarios where a memory read access counted by 

L2I CACHE might have a significant performance impact due to additional latency for the address. 


0x400B, L3D_CACHE LMISS_RD, Level 3 data cache long-latency read miss 





The counter counts each memory read access counted by L3D_ CACHE that incurs additional 
latency because it returns data from outside the Level 3 data or unified cache of this PE. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. It is IMPLEMENTATION DEFINED whether accesses that result from cache 
maintenance instructions are counted. 


The event indicates to software that the access missed in the Level 3 data or unified cache and might 
have a significant performance impact compared to the latency of an access that hits in the Level 3 
data or unified cache. 


This counter does not count: 


$ Access where the additional latency is unlikely to be significantly performance-impacting. 
For example, if the access hits in another cache in the same local cluster, and the additional 
latency is small when compared against a miss in all Level 3 caches that the access looks up 
in that results in an access being made to a Level 4 cache or elsewhere beyond the Level 3 
data and unified cache. This might be counted as a Level 2 cache miss. 


. A miss that does not cause a new cache refill but is satisfied from a previous miss. 


An implementation is not required to measure the latency nor to track the access to determine 
whether the additional latency had a performance impact. An implementation can extend the 
definition of this event with additional scenarios where a memory read access counted by 
L3D_CACHE might have a significant performance impact due to additional latency for the 
address. 


See also Attributability on page D7-2677. 


0x4020, LDST_ALIGN_LAT, Access with additional latency from alignment 


The counter counts each access counted by MEM_ ACCESS that, due to the alignment of the 
address and size of data being accessed, incurred additional latency. 


0x4021, LD_ALIGN_ LAT, Load with additional latency from alignment 


The counter counts each memory-read access counted by LDST_ALIGN_LAT. 


0x4022, ST_ALIGN_LAT, Store with additional latency from alignment 


The counter counts each memory-write access counted by LDST_ALIGN_LAT. 


0x4024, MEM ACCESS CHECKED, Checked data memory access 


The counter counts each memory access counted by MEM ACCESS that is Tag Checked by the 
Memory Tagging Extension. For more information see Chapter D6 Armvés.5 Memory Tagging 
Extension. 


0x4025, MEM ACCESS CHECKED _ RD, Checked data memory access, read 


The counter counts each memory-read access counted by MEM ACCESS CHECKED. 
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0x4026, MEM ACCESS CHECKED _ WR, Checked data memory access, write 
The counter counts each memory-write access counted by MEM ACCESS CHECKED. 


0x8006, SVE_INST_SPEC, SVE operation Speculatively executed 


This event counts speculatively executed operations due to SVE instructions. It is IMPLEMENTATION 
DEFINED whether this event counts non-SIMD SVE instructions 


D7.10.4 Cycle event counting on multithreaded implementations 


ARM DDI 0487E.a 
ID070919 


For most events, the event is only counted when it is Attributable to the counting PE or thread, see Attributability 
on page D7-2677. 


Multithreaded implementations can have various forms, some examples of these are: 
° Simultaneous Multithreading (SMT), where every PE thread is active on every cycle. 


° Fine-grained Multithreading (FGMT), also known as a Barrel processor, where one PE thread is active on 
each cycle, and this changes regularly. 


e Switch on Event Multithreading (SoEMT), also known as Coarse-grained Multithreading (CGMT), where 
high latency events cause the processor to switch the active PE thread. 


In the above examples, active means that the PE might execute the instructions. A PE can be active but not executing 
instructions when no instruction is available or because of limited execution resources. 


When the PMEVTYPER<n>_ELO.MT bit is set to 0, the CPU_CYCLES event only counts cycles on which the 
thread was active. For the example multithreaded implementations, this means that: 


od For an SMT implementation, the CPU_CYCLES event counts every cycle. 


° For a particular FGMT implementation, that alternates between two threads on each cycle, the 
CPU_CYCLES event counts every other cycle. 


g For a particular SoEMT implementation, that is waiting for a long latency operation, the CPU_CYCLES 
event does not count cycles, as the PE thread is not active. 


If the PMEVTYPER<n>_EL0.MT bit is set to 1, the processor counts each cycle, and can only count a maximum 
of one cycle each cycle. 


In addition, the STALL_ FRONTEND and STALL BACKEND events only count cycles that are counted by the 
CPU_CYCLES event, and so have the same limitation. For example, in an SMT implementation, if a PE thread 
cannot issue an instruction because of contention with other PE threads, these are counted as STALL_ BACKEND 
cycles. 


If the PMEVTYPER<n>_ELO.MT bit is set to 1, the PE only counts cycles on which no operation is issued from 
any thread. 


Note 
The PMCCNTR register counts every processor cycle. 
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D7.10.5 Meaningful ratios between common microarchitectural events 
The architecture highlights some meaningful ratios that can be derived from the common microarchitectural events. 
Table D7-8 lists the highlighted ratios. 
Table D7-8 REFILL events and associated access events 
Numerator Denominator Ratio 





0x0001 LII CACHE REFILL 


0x0014 LII CACHE 


Attributable Level 1 instruction cache refill rate 





0x0002 LIL TLB REFILL 


0x0026 LII_ TLB 


Attributable Level 1 instruction TLB refill rate 





0x0003 LID CACHE REFILL 


0x0004 LID CACHE 


Attributable Level 1 data or unified cache refill rate 





0x0005 LID TLB REFILL 


0x0025 LID _TLB 


Attributable Level 1 data or unified TLB refill rate 





0x0017 L2D_ CACHE REFILL 


0x0016 L2D CACHE 


Attributable Level 2 data or unified cache refill rate 





0x0028 L2I CACHE REFILL 


0x0027 L2I CACHE 


Attributable Level 2 instruction cache refill rate 





0x002A L3D_ CACHE REFILL 


0x002B L3D_ CACHE 


Attributable Level 3 data or unified cache refill rate 





0x002D L2D TLB REFILL 


0x002F L2D_TLB 


Attributable Level 2 data or unified TLB refill rate 





0x002E L2I TLB REFILL 


0x0030 L2I_TLB 


Attributable Level 2 instruction TLB refill rate 





0x0019 BUS_ACCESS 


0x001 D BUS_CYCLES 


Attributable Bus accesses per cycle 





0x0033 LL_CACHE MISS 


0x0032 LL_ CACHE 


Attributable Last Level data or unified cache refill rate 





0x0034 DTLB WALK 


0x0025 LID TLB 


Attributable data TLB miss rate 





0x0035 ITLB_ WALK 


0x0026 LII TLB 


Attributable instruction TLB miss rate 





0x0037 LL CACHE _MISS_RD 


0x0036 LL_ CACHE RD 


Attributable memory read operation miss rate 





0x0038 REMOTE _ACCESS_RD 


0x0031 REMOTE ACCESS 


Attributable read accesses to another socket in a multi-socket 
system 





D7.10.6 


Required events 


PMUV3 requires that an implementation includes the following common events: 


s 0x0000, SW_INCR, Instruction architecturally executed, Condition code check pass, software increment. 
s 0x0003, LID CACHE REFILL, Level 1 data cache refill. 





Note 


Event 0x0003 is only required if the implementation includes a Level 1 data or unified cache. 





. 0x0004, LID_CACHE, Level 1 data cache access. 


Note 





Event 0x0004 is only required if the implementation includes a Level 1 data or unified cache. 





7 0x0010, BR_MIS_ PRED, Mispredicted or not predicted branch Speculatively executed. 


Note 





Event 0x0010 is only required if the implementation includes program-flow prediction. However, Arm 
strongly recommends that the event is implemented as described in Common microarchitectural events on 
page D7-2703. 





a @x0011, CPU_CYCLES, Cycle. 
è 0x0012, BR_PRED, Predictable branch Speculatively executed. 


D7-2720 
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Note 


Event 0x0012 is only required if the implementation includes program-flow prediction. However, Arm 
recommends that the event is implemented as described in Common microarchitectural events on 
page D7-2703. 








$ At least one of: 
— 0x0008, INST_RETIRED, Instruction architecturally executed. 
— 0x001B, INST_SPEC, Operation Speculatively executed. 
Note 


Arm strongly recommends that event 0x008 is implemented. 








° When ARMv8.1-PMU is implemented: 
— 0x0023, STALL_FRONTEND, No operation issued due to the frontend. 
— 0x0024, STALL _ BACKEND, No operation issued due to the backend. 
° When The Scalable Vector Extension (SVE) is implemented: 
—  0x8002, SVE_INST_RETIRED, SVE instruction architecturally retired. 
— 0x8006, SVE_INST_SPEC, SVE operation speculatively executed. 
$ When the Statistical Profiling Extension is implemented: 
— 0x4000, SAMPLE POP, Sample Population. 
—  0x4001, SAMPLE FEED, Sample Taken. 
— 0x4002, SAMPLE FILTRATE, Sample Filtered. 
—  0x4003, SAMPLE COLLISION, Sample Collision. 
. When ARMv8.4-PMU is implemented: 
—  0x003C, STALL, No operation sent for execution. 
—  0x0039, LID CACHE LMISS_RD, Level 1 data cache long-latency read miss. 
—  0x4006, LII CACHE LMISS, Level 1 instruction cache long-latency miss. 
— 0x0040, LID CACHE RD, Level 1 data cache read. 


When any of the following common events are implemented, all three of them are implemented: 

e 0x003D, STALL_ SLOT_BACKEND, No operation sent for execution on a Slot due to the backend, 
° 0x003E, STALL SLOT FRONTEND, No operation sent for execution on a Slot due to the frontend. 
è 0x003F, STALL_SLOT, No operation sent for execution on a Slot. 


Arm strongly recommends that the following events are implemented: 
° BR_RETIRED. 

e BR_MIS PRED RETIRED. 

° STALL SLOT. 

: STALL _SLOT_BACKEND. 

: STALL_SLOT_ FRONTEND. 

a OP_SPEC. 

$ OP_RETIRED. 


D7.10.7 IMPLEMENTATION DEFINED event numbers 
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For IMPLEMENTATION DEFINED event numbers, each counter is defined, independently, to either: 
° Increment only once for each event. 


° Count the duration for which an event occurs. 


Arm recommends that implementers establish a standardized numbering scheme for their IMPLEMENTATION 
DEFINED events, with common definitions, and common count numbers, applied to all of their implementations. In 
general, the recommended approach is for standardization across implementations with common features. However, 
Arm recognizes that attempting to standardize the encoding of microarchitectural features across too wide a range 
of implementations is not productive. 
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Arm strongly recommends that at least the following classes of event are identified in the IMPLEMENTATION 
DEFINED events: 


Separating each of the STALL FRONTEND and STALL_SLOT_ FRONTEND events to count holes in 
instruction availability. 


Separating each of the STALL_ BACKEND and STALL_SLOT_BACKEND events, to count, for example, 
cumulative duration of stalls, unavailability of execution resources, or missed superscalar issue opportunities. 


Miss rates for additional levels of caches and TLBs. 
Any external events passed to the PE through an IMPLEMENTATION DEFINED mechanism. 
Cumulative duration of a PSTATE. {A, I, F} interrupt mask set to 1. 


Cumulative occupancy for resource queues, such as data access queues, and entry/exit counts, so that average 
latencies can be determined, separating out counts for key resources that might exist. An implementation 
might also provide registers in the IMPLEMENTATION DEFINED space to further extend such counts, for 
example by specifying a minimum latency for an event to be counted. 


Any other microarchitectural features that the implementer considers are valuable to count. 


The range of possible IMPLEMENTATION DEFINED event numbers is described in The PMU event number space and 
common events on page D7-2693. Appendix K3 Recommendations for Performance Monitors Event Numbers for 
IMPLEMENTATION DEFINED Events lists the Arm recommended standardized numbering scheme for these 
events. 
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D7.11 Performance Monitors Extension registers 


Further information on the Performance Monitors Extension Registers can be found in the following sections: 
7 Table K14-2 on page K14-7812 lists the Performance Monitors register names for AArch32 and AArch64 


states. 

$ Performance monitors registers on page K 14-7833 summarizes the Performance Monitors Extension 
registers in AArch6é4 state. 

s Performance monitors registers on page K 14-7857 summarizes the Performance Monitors Extension 


registers in AArch32 state. 
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Chapter D8 
The Activity Monitors Extension 


This chapter describes the Armv8 implementation of version 1 of the Activity Monitor Unit (AMU) architecture, 
AMUvV1, an optional non-invasive component. It contains the following sections: 


. About the Activity Monitors Extension on page D8-2726. 
. Properties and behavior of the activity monitors on page D8-2727. 
. AMU events and event numbers on page D8-2729. 
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D8.1 


D8-2726 


About the Activity Monitors Extension 


The Activity Monitors Extension is an optional extension to the Armv8.4 architecture. 


The Activity Monitors Extension implements version | of the Activity Monitors architecture, AMUv1, and 
interfaces to the registers defined by AMUV1, the Activity Monitors registers. 


Version | of the Activity Monitors architecture implements: 


A counter group of four architected 64-bit event counters. The events counted by the architected event 
counter are fixed and architecturally defined. 
Note 


The Activity Monitors architecture provides space for up to 16 architected event counters. Future versions of 
the Activity Monitors architecture may use this space to implement additional architected event counters. 








A counter group of up to 16 auxiliary 64-bit event counters. The event counted for each auxiliary event 
counter may be fixed or programmable, and whether it is fixed or programmable is IMPLEMENTATION 
DEFINED. When the event counted by an auxiliary event counter is fixed, this event is IMPLEMENTATION 
DEFINED. 


Controls for enabling and disabling counters. 


When the event counted by an auxiliary event counter is programmable, controls for assigning an event to 
the counter. 


Controls that determine whether the activity monitor counters continue to count while the PE is halted in 
Debug state. 


The read-only registers AMCFGR and AMCGCR provide information about features supported by the Activity 
Monitors Extension, the number of counter groups implemented, the total number of counters implemented, the 
number of counters implemented within each group, and the size of the counters. 


The Activity Monitors Extension provides: 


A mandatory System register interface to the Activity Monitors registers, for both AArch64 and AArch32 
states. 


Base system registers on page K14-7841 lists the AArch64 Activity Monitors registers, and Base system 
registers on page K14-7863 lists the AArch32 Activity Monitors registers. Table K14-3 on page K14-7813 
shows the relationship between the AArch64 and the AArch32 Activity Monitors register. 


Controls that allow software to enable or disable access by software running at lower Exception levels to the 
Activity Monitors registers. 


An optional external interface providing read-only memory-mapped access to the Activity Monitors 
registers. 


Alphabetical index of memory-mapped registers on page K14-7867 lists the Activity Monitors 
memory-mapped registers. For more information on the recommended external interface, see Chapter 14 
Recommended External Interface to the Activity Monitors. 
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D8.2 Properties and behavior of the activity monitors 


D8.2.1 Basic characteristics of the activity monitor event counters 


Every activity monitor event counter is a 64-bit wrapping counter. When an activity monitor event counter wraps, 
the counter overflows. 


Note 


The Activity Monitor architecture does not provide support for overflow status indication or interrupts. 








The state of the authentication signals do not affect counting. 


Any change in clock frequency, including when a WFI and WFE instruction stops the clock, can affect any counter. 


D8.2.2 Counter configuration and controls 


For each architected event counter AMEVCNTRO<n>, there is a corresponding event type register 
AMEVTYPERO<n> which provides information on the event counted by that counter. The event type registers 
AMEVTYPERO<n> are read-only. 


For each auxiliary event counter AMEVCNTRI1<n>, there is a corresponding event type register 
AMEVTYPER1<n> which provides information on the event counted by that counter. When the event counted by 
an auxiliary event counter is fixed, the corresponding event type register AMEVTYPER1<n> is read-only. When 
the event counted by an auxiliary event counter is programmable, the corresponding event type register 
AMEVTYPER1<n> is read/write. 


For each counter group, there is a pair of separate controls to enable and disable the counters in that counter group. 
AMCNTENCLRO and AMCNTENSETO0 are used to disable and enable the architected event counters. 
AMCNTENCLR1 and AMCNTENSET1 are used to disable and enable the auxiliary event counters. 


While the PE is halted in Debug state, AMCR.HDBG controls whether activity monitor counting is halted. 





AMUSERENR.EN controls access from ELO to the Activity Monitor Extension System registers. CPTR_EL2.TAM 
and HCPTR.TAM control access from ELO and EL1 to the Activity Monitor Extension System registers. 
CPTR_EL3.TAM control access from ELO, EL1, and EL2 to the Activity Monitor Extension System registers. 


Note 


These controls obey the priority order described in Synchronous exception prioritization for exceptions taken to 
AArch64 state on page D1-2308 and Synchronous exception prioritization for exceptions taken to AArch32 state on 
page G1-5505. 





AMUSERENR.EN is configurable at EL1, EL2, and EL3. All other controls, as well as the value of the counters, 
are configurable only at the highest implemented Exception level. 


D8.2.3 Power and reset domains 
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The power domain of the activity monitoring unit is IMPLEMENTATION DEFINED. 
The reset domain of the activity monitoring unit is IMPLEMENTATION DEFINED. 


When a Cold reset of the power domain of the activity monitoring unit occurs, the activity monitoring unit is reset 
and the counters are reset to zero. When the PE is not in reset, the activity monitoring unit is available. 
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D8.2.4 


D8-2728 


Accuracy and non-invasive behavior 


The activity monitors are a non-invasive component which must provide broadly accurate and statistically useful 
count information. 


The implementation of an architecturally required event might create a conflict between the requirement to be 
non-invasive and the requirement to present an accurate value of the count under normal operating conditions. An 
implementation might provide an IMPLEMENTATION DEFINED control that disables accurate count of the event to 
restore performance and document the impact on performance of accurate counting. The expectations for 
non-invasive behavior and the degree of inaccuracy of the activity monitors are otherwise as described for the 
Performance Monitors architecture. 





Note 


For information on the expectations for non-invasive behavior and the degree of inaccuracy of the Performance 
Monitors, see Non-invasive behavior on page D7-2673 and A reasonable degree of inaccuracy on page D7-2673. 
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D8.3 AMU events and event numbers 


The Activity Monitors architecture uses the event number space defined by the Performance Monitors architecture 
to identify events. 


The Activity Monitors architecture defines additional events and adds them to the event number space defined by 
the Performance Monitors architecture for common events. 


When a common event is available to both the Performance Monitors architecture and the Activity Monitors 
architecture within one implementation, both architectures use the same event number. 


D8.3.1 Architected event counters 


Version | of the Activity Monitors architecture, AMUv1, requires four events to be counted by the architected 
activity monitor event counters. 


The events required to be counted are: 


0x0011, CPU_CYCLES, Processor frequency cycles 
This event is defined identically to CPU_CYCLES in the PMUV3 architecture. 


When the PE is in WFI or WFE, this counter does not increment. When in a multithreaded 
implementation, regardless of which PE is currently active, this counter continues to count for all 
PEs not in WFI or WFE. 


This event is counted by AMEVCNTRO<n>, where n is 0. 


0x4004, CNT_CYCLES, Constant frequency cycles 


The constant frequency cycles counter increments at a constant frequency equal to the rate of 
increment of the System counter, CNTPCT_ELO. 


When the PE is in WFI or WFE, this counter does not increment. When in a multithreaded 
implementation, regardless of which PE is currently active, this counter continues to count for all 
PEs not in WFI or WFE. 


This event is counted by AMEVCNTRO<n>, where n is 1. 


0x0008, INST_RETIRED, Instructions retired 
This event is defined identically to INST_RETIRED in the PMUV3 architecture. 
This event is counted by AMEVCNTRO<n>, where n is 2. 


0x4005, STALL_BACKEND_ MEM, Memory stall cycles 


The counter counts cycles in which the PE is unable to dispatch instructions from the frontend to 
the backend of the PE due to a backend stall caused by a miss in the last level of cache within the 
PE clock domain. 


This event is counted by AMEVCNTRO<n>, where n is 3. 


D8.3.2 Auxiliary event counters 


Auxiliary event counters can count events defined by the Performance Monitors architecture and IMPLEMENTATION 
DEFINED events defined specifically for activity monitoring. 


Arm strongly recommends that implementations do not re-use an IMPLEMENTATION DEFINED event number for 
different hardware events across the Performance Monitors architecture and the Activity Monitors architecture. 
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This chapter describes the Statistical Profiling Extension. It contains the following sections: 


About the Statistical Profiling Extension on page D9-2732. 
Defining the sample population on page D9-2734. 
Controlling when an operation is sampled on page D9-2736. 
Enabling profiling on page D9-2739. 

Filtering sample records on page D9-2741. 

The profiling data on page D9-2742. 

The Profiling Buffer on page D9-2750. 

Profiling Buffer management on page D9-2754. 
Synchronization and Statistical Profiling on page D9-2758. 
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D9.1 About the Statistical Profiling Extension 

Statistical profiling is a four stage process. 

1. An operation is chosen from a sample population, that can be restricted by Exception level, at a 
programmable interval that might have some random, or pseudorandom, perturbation. 

2. A trace of the sampled operation is taken. This includes the PC, events, timings, and data addresses, related 
to the sampled operation. This is the profiling operation. 

3. Before a sample record is created, it is possible to filter out potential sample records generated by the 
profiling operation by reference to any or all of the following: 

a. The type of operation. 
b. Events. 
c. Latency. 

4. A sample record is created that contains the traced information. Sample records that meet the criteria of the 
filter are written to and stored in a memory buffer. These sample records can be processed by software when 
the memory buffer is full. 

D9.1.1 Non-invasive behavior 

Statistical Profiling is a non-invasive debug operation: 

7 While profiling is enabled, the operation and performance of the processing element (PE) must not be 
significantly impacted between sampled operations, that is, other than for writing out sample records and 
processing Profiling Buffer management interrupts. 

: The performance of the sampled operation and the performance of the PE in general must not be significantly 
impacted. The sample records are not written to memory until after the sampled operation has completed. 
However, this does not apply when the user selects a collection of physical addresses for data access 
operations. In this case, the impact is IMPLEMENTATION DEFINED. 

$ The profiling operation to write sample records must not be excessively impactful on the performance of the 
sampled operation or the performance of the PE generally. 

D9.1.2 PMU extensions 

If the Statistical Profiling and Performance Monitors Extensions are implemented, then the following PMU events 

must be implemented: 

° SAMPLE POP. 

° SAMPLE FEED. 

° SAMPLE _ FILTRATE. 

° SAMPLE_COLLISION. 

Note 
These events are discoverable through a read of PMCEIDO_EL0[35:32]. 
D9.1.3 Multithreaded implementations 

In a multithreaded implementation: 

° Statistical Profiling is implemented per-thread. 

è The sample interval counter counts only operations for the thread that is being profiled. 

: Latency and other cycle counters count each cycle for the PE for which the thread was active and could issue 
an operation. 

The architecture does not define features for inter-thread profiling and does not support sharing the Profiling Buffer 

between threads. 
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Note 


An implementation is described as multithreaded when the lowest level of affinity consists of logical processors that 
are implemented using a multi-threading type approach. That is, the performance of processors at the lowest affinity 
level is very interdependent. 
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D9.2 


D9.2.1 


D9.2.2 


Defining the sample population 


All samples are taken from a population of operations. The population is dynamic rather than static. That is, if a 
program executes the same operation multiple times (for example, because of loops and subroutines) then that 
operation appears multiple times in the population. 


The operations are an IMPLEMENTATION DEFINED choice between: 


. Architecture instructions. 
. IMPLEMENTATION DEFINED microarchitectural operations (micro-ops). 


Architecture instruction means a single instruction that is defined by the Armv8 instruction set architecture in 
AArch64 state. 


An architecture instruction might create one or more micro-ops at any point in the execution pipeline. The definition 
of a micro-op is implementation specific. An architecture instruction might create more than one micro-op for each 
instruction. A micro-op might also be removed or merged with another micro-op in the execution stream, so an 
architecture instruction might create no micro-ops for an instruction. 


Any arbitrary translation of architecture instructions to an equivalent sequence of micro-ops is permitted. In some 
implementations, the relationship between architecture instructions and micro-ops might vary over time. 


Note 


Sampling from architecture instructions does not require that the instruction is architecturally executed. 








Operations that might be excluded from the sample population 


It is IMPLEMENTATION DEFINED whether each of the following operations is part of the sample population: 
` Operations on misspeculated paths. 

7 Operations (specifically micro-ops) that do not relate to any architecture instruction. 

è Operations that generate non-architectural exceptions. 


If the operation is not part of the sample population, the operation does not cause the sample interval counter to 
decrement, is not counted by the SAMPLE_POP event and therefore is never sampled. 


If the operation is part of the sample population, the operation causes the sample interval counter to decrement, is 
counted by the SAMPLE_POP event, and might be sampled and counted by the SAMPLE FEED event. 


Misspeculation and non-architectural operations 


It is IMPLEMENTATION DEFINED whether the sample record for a sampled misspeculated operation or a sampled 

operation generating a non-architectural exception is written to the Profiling Buffer: 

; If a sample record of a misspeculated operation or an operation generating a non-architectural exception is 
written to the Profiling Buffer, then neither event 0 (generated exception) nor event 1 (architecturally retired) 
are set in the record Events packet. 

è If a sample record of a misspeculated operation or an operation generating a non-architectural exception is 


not captured into the Profiling Buffer, then no event packets are output and the sample is not counted by the 
SAMPLE FILTRATE event. 


Note 
It is IMPLEMENTATION DEFINED whether such operations can be sampled. See Operations that might be excluded 





from the sample population. 





If such an operation is not part of the sample population 


The operation does not cause the sample counter to decrement, is not counted by the SAMPLE _ POP event, and 
hence is never sampled. 





D9-2734 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The Statistical Profiling Extension 
D9.2 Defining the sample population 


If such an operation is part of the sample population 


The operation causes the sample counter to decrement, is counted by the SAMPLE POP event, and might be 
sampled and counted by the SAMPLE FEED event. 


It is IMPLEMENTATION DEFINED whether the sample record for such an operation, if sampled, is captured in the 

Profiling Buffer: 

. If such a sample record is captured in the Profiling Buffer then some information for the operation might not 
be present. However, the Events packet and either the End packet or theTimestamp packet is always output. 
Neither event 0 (generated exception) nor event | (architecturally retired) will be set in the Events packet. 

è If such a sample record is not captured into the Profiling Buffer then no packets are output and the sample is 
not counted by the SAMPLE _FILTRATE event. 


If the sample record for an operation on a misspeculated path is captured into the Profiling Buffer, then the record 
must not contain information that cannot be accessed by privileged software of the owning Exception level. 


Note 
If the Owning Exception level passes this data to less privileged software for processing, it can set 
PMSFCR_ELI.FE to 1 and PMSEVFR_EL1[1] to 1 to prevent speculative instructions from being recorded in the 
Profiling Buffer. 
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D9.3 Controlling when an operation is sampled 

The sample interval counter, PMSICR_EL1.COUNT controls when an operation is selected for sampling. In some 

implementations, a secondary sample interval counter, PMSICR_EL1.ECOUNT, is also used. 

The following sections describe the operation of the sample interval counters. 

Details of the random or pseudorandom number generator used when PMSIRR_EL1.RND is set to 1 are 

IMPLEMENTATION DEFINED. See Generating random numbers for sampling. 

D9.3.1 Operation sampling 

A sample operation is as follows: 

l. A sampling interval is written to PMSICR_EL1.COUNT by software. The interval is measured in operations. 

2. The sample interval counter is decremented by hardware for each operation when sampling is enabled. 

3y When the sample interval counter reaches zero, then: 

a. Ifrandom perturbation is enabled, the PE continues to count for a random number of further operations 
while sampling is enabled. 
b. An operation is chosen for profiling. 
Note 
The choice of operation around the sampling point is arbitrary. The chosen operation might be the 
operation for which the sample interval counter reached 0, or the next operation. The choice must be 
applied consistently so as not to introduce sampling bias. 

4. The sample interval counter is reloaded and the process loops to step 2. It is IMPLEMENTATION DEFINED 
whether the sample interval counter is reloaded before step 3.a) or at step 3.b). That is, before or after 
counting the random number of further operations. 

5. The chosen operation is marked as the sampled operation. The PE collects information about the sampled 
operation as it executes by a profiling operation. 

6. When the sampled operation is completed, the sample record is created. 

D9.3.2 Generating random numbers for sampling 

The random number generator is IMPLEMENTATION DEFINED. Implementations might use a pseudorandom number. 

The random number generator must be reset into a useable state. An implementation might include 

IMPLEMENTATION DEFINED registers to further configure the random number generator. 

It is IMPLEMENTATION DEFINED whether the PE adds the random number to the sample interval counter prior to 

counting down the interval, or after the counter reaches zero and the counter has been reloaded. 

D9.3.3 Initializing the one or more sample interval counters 

When the PE moves from a state where profiling is disabled to a state where profiling is enabled: 

a If PMSICR_EL1 is nonzero, then sampling restarts from the current values in PMSICR_ELI. 

è If PMSICR_EL1 is zero, then it is loaded with an initial value. The behavior depends on PMSIRR_EL1.RND 
and an IMPLEMENTATION DEFINED choice discoverable by a read of PMSIDR_EL1.ERnd. 

° If PMSIRR_EL1.RND is 0: 

—  PMSICR_EL1.COUNT{[31:8] is set to PMSIRR_EL1.INTERVAL. 
—  PMSICR_EL1.COUNT[7:0] is set to 0x00. 
° If PMSIRR_EL1.RND is 1 and PMSIDR_EL1.ERnd is 0: 
—  PMSICR_EL1.COUNT{[31:8] is set to PMSIRR_EL1.INTERVAL. 
—  PMSICR_EL1.COUNT[7:0] is set to a random or pseudorandom value in the range 0x00 to OxFF. 
° If PMSIRR_EL1.RND is 1 and PMSIDR_EL1.ERnd is 1: 
— PMSICR_EL1.COUNT[[31:8] is set to PMSIRR_EL1.INTERVAL. 
—  PMSICR_EL1.COUNT[7:0] is set to a random or pseudorandom value in the range 0x00 to OxFF. 
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If PMSIRR_EL1.RND is 1 and PMSIDR_EL1.ERnd is 1: 
—  PMSICR_EL1.COUNT{[31:8] is set to PMSIRR_EL1.INTERVAL. 
—  PMSICR_EL1.COUNT[7:0] is set to 0x00. 


D9.3.4 Behavior of the sample interval counter while profiling is enabled 


While profiling is enabled, the counters control when an operation is selected for sampling. The behavior depends 
on PMSIRR_EL1.RND and an IMPLEMENTATION DEFINED choice discoverable in PMSIDR_EL1.ERnd. 


If PMSIRR_EL1.RND is cleared to 0: 


While nonzero, the sample interval counter decrements by 1 for each member of the sample population. When the 
counter reaches zero: 


s A member of the sampling population is selected for sampling. 

° The counter is set as follows: 
—  PMSICR_EL1.COUNT{[31:8] is set to PMSIRR_EL1.INTERVAL. 
—  PMSICR_EL1.COUNT[7:0] is set to 0x00. 


Note 


Because the counter counts down to zero, when PMSIRR_EL1.RND is cleared to 0 the interval between 
operations being selected for sampling is UNTERVALX256+1). 








lf PMSIRR_EL1.RND is 1 and PMSIDR_EL1.ERnd is 0 


While nonzero, the sample interval counter decrements by 1 for each member of the sample population. When the 
counter reaches zero: 


7 A member of the sampling population is selected for sampling. 
° The counter is set as follows: 
—  PMSICR_EL1.COUNT{[31:8] is set to PMSIRR_EL1.INTERVAL. 
—  PMSICR_EL1.COUNT[7:0] is set to a random or pseudorandom value in the range 0x00 to OxFF. 


Note 


When PMSIRR_EL1.RND is set to 0 and PMSIDR_EL1.ERnd is 1, the mean interval between 
operations being selected for sampling is UNTERVALx256+128), if the random number generator is 
uniform. 








If PMSIRR_EL1.RND is 1 and PMSIDR_EL1.ERnd is 1 


While nonzero, the primary sample interval counter decrements by 1 for each member of the sample population. 
When the primary counter reaches zero: 


° The primary sample interval counter is reloaded. 


° The secondary sample interval counter, PMSICR_EL1.ECOUNT, is set to a random or pseudorandom value 
in the range 0x00 to 0xFF. 


While the secondary sample interval counter is nonzero, the secondary sample interval counter decrements by 1 for 
each member of the sample population. The primary sample interval counter also continues to decrement because 
it is also nonzero. 


When the secondary sample interval counter reaches zero, an operation is selected for sampling. 





Note 


When PMSIRR_EL1.RND is set to 1 and PMSIDR_EL1.ERnd is 1, the mean interval between operations being 
selected for sampling is UNTERVALx256+1), if the random number generator is uniform. 
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D9.3.5 


D9.3.6 


D9.3.7 


Behavior of the sample interval counter while profiling is disabled 


When profiling is disabled: 
s No operations are selected for sampling. 
° No sample records are collected. 


è The sample interval counters retain their values and do not decrement. 


Where operations are sampled 


The exact point in the sampled lifespan of operations at which operations are chosen for profiling is 
IMPLEMENTATION DEFINED. 





Note 


Arm recommends that the point at which operations are sampled is linked to the definition of the Performance 
Monitors Extension (PMU) STALL_FRONTEND and STALL_BACKEND events, so that sampling records 
information for STALL BACKEND stalls. 





Sample collisions 


The maximum number of sampled operations that a PE can support simultaneously is IMPLEMENTATION DEFINED. 
If the maximum number of simultaneous sampled operations has been reached at the point when a new operation 
must be sampled, the new sample is said to have collided with a previous sampled operation. 


The PE records the fact that a sampled operation has collided with another sampled operation. Software can also 
count the number of collisions and gauge the impact of the collisions. 


On a sample collision: 

The PMU event SAMPLE COLLISION is generated. 
° PMBSR_EL1.COLL is set to 1. 

od The new operation is not sampled. 


Following a context synchronization event an indirect write to PMBSR_EL1.COLL is guaranteed to be visible to 
instructions in program order after the sampled operation that collided. There is no guarantee of visibility without 
a context synchronization event. For more information see Synchronization and Statistical Profiling on 

page D9-2758. 


Note 


This means that following a context synchronization event PMBSR_EL1.COLL will not change on entry to a state 
where profiling is disabled. 











D9-2738 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


D9.4 Enabling profiling 


ARM DDI 0487E.a 
ID070919 


Profiling is disabled if the Profiling Buffer is disabled, including when: 
. PMBLIMITR_EL1.E is cleared to 0 or PMBSR_EL1.S is set to 1. 
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à Executing at a higher Exception level than the Profiling Buffer owning Exception level. 


` Executing in the Security state that is not the Security state of the owning Exception level. 


° The PE is in Debug state. 


Note 





The owning Exception level is controlled by MDCR_EL3.NSPB and MDCR_EL2.E2PB. 





PMSCR_EL1.{E1SPE, EOSPE} and PMSCR_EL2. {E2SPE, EOHSPE} enable sampling by Exception level: 


s In a guest operating system or Secure state, PMSCR_EL1.E1SPE enables profiling at EL1 and 


PMSCR_EL1.EOSPE at ELO. 


s In a hypervisor or host operating system, PMSCR_EL2.E2SPE enables profiling at EL2 and 


PMSCR_EL2.E0HSPE at ELO. 
° Sampling is always disabled at EL3. 


Table D9-1 defines the valid combinations of the Effective values of SCR_EL3.NS, SCR_EL3.EEL2, 


MDCR_EL3.NSPB, MDCR_EL2.E2PB, and HCR_EL2.TGE that define when sampling is enabled. 


In Table D9-1: 


D Disabled. 
E2SPE Enabled if PMSCR_EL2.E2SPE == 1, disabled otherwise. 
E1SPE Enabled if PMSCR_EL1.E1SPE == 1, disabled otherwise. 


EOHSPE Enabled if PMSCR_EL2.EOHSPE == 1, disabled otherwise. 


EOSPE Enabled if PMSCR_EL1.EOSPE == 1, disabled otherwise. 


Table D9-1 Enabling by Exception level and Security state (for all Exception levels using AArch64 












































state) 
Controls Sampling enabled at 
NS NSPB E2PB EEL2 TGE | EL3 EL2 EL1 ELO 
1 0b0X X X X D D D D 
0b1X 0b1X X 0 D D EISPE EO0SPE 
0b1X X 1 D D n/a D 
0b00 X 0 D E2SPE ŒEISPE EOSPE 
0b00 X 1 D E2SPE n/a E0HSPE 
0 0b1X x X X D D D D 
0b0X X 0 X D n/a EISPE EO0SPE 
0b1X 1 0 D D EISPE EO0SPE 
0b1X 1 1 D D n/a D 
0b00 1 0 D E2SPE EISPE EOSPE 
0b00 1 1 D E2SPE n/a EOHSPE 
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This is described in the pseudocode function StatisticalProfilingEnabled(). 
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D9.5 Filtering sample records 


PMSFCR_ELI1.FT enables filtering by operation type. When enabled PMSFCR_EL1.{ST, LD, B} define the 


collected types: 
° ST enables collection of store sampled operations, including all atomic operations. 
: LD enables collection of load sampled operations, including atomic operations that return a value to a 
register. 
7 B enables collection of branch sampled operations, including direct and indirect branches and exception 
returns. 
Note 





When micro-op sampling is implemented, filtering is based on the micro-op type. 





Table D9-2 summarizes the controls for filtering by operation type. In this table: 


Load Atomic Refers to atomic operations which return a value to a general-purpose register. Other atomic 
operations are classed as Store. 
































D Indicates that the operation is discarded. 
C Indicates that the operation is collected. 
Table D9-2 Filtering by Operation type 
PMSFCR_EL1 field Operation type 
FT LD ST B | Load Load Atomic Store Branch Other 
0 X X X C C C C C 
1 0 0 0 D D D D D 
1 D D D C D 
1 0 D C C D D 
1 D C C C D 
1 0 0 C C D D D 
1 C C D C D 
1 0 C C C D D 
1 C C C C D 








PMSFCR_EL1.FE enables filtering by a set of events that are defined by PMSEVFR_EL1. When enabled, only 
sampled operations with all the events in the filter set are recorded and written to the Profiling Buffer. 


PMSFCR_EL1.FL enables filtering by total latency. PMSLATFR_EL1.MINLAT defines the minimum latency. 
When enabled, only sampled operations with a total latency greater than or equal to the minimum latency are 
recorded and written to the Profiling Buffer. 


These controls combine together as a logical AND. 


This is described in the pseudocode function CollectRecord(). 
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D9.6 The profiling data 


Unless otherwise stated all sample records that are generated by a profiling operation contain: 


A timestamp, if enabled. This is one of: 
— CNTPCT ELO. 
— CNTVCT_ELO. 


It is IMPLEMENTATION DEFINED how this timestamp relates to the sampled operation. It might be the time 
when the sampled operation was taken or any later time during the lifetime of the sampled operation, that is, 
up to the time when the sampled operation is completed. 


If the Generic Timer system counter is disabled and timestamps are enabled, then it is IMPLEMENTATION 
DEFINED whether: 


— The Statistical Profiling Extension behaves as if timestamps are disabled. 
— The timestamp that is collected in the sample record is UNKNOWN. 


Note 


This behavior describes when CNTEN.EN is cleared to 0. This behavior does not apply when the Generic 
Timer system counter is enabled but not accessible at the current Exception level. 








The context, if enabled, which is one or more of: 

— CONTEXTIDR ELl. 

— CONTEXTIDR El2. 

— The Exception level. 

— The Security state. 

Information about whether the sampled operation generated an exception: 

— The target address for an exception generating operation is not collected. 
Information about whether the sampled operation completed execution. 


If the sampled operation completes execution and does not generate an exception, the sample record also contains: 


The PC virtual address for the sampled operation. 

Information about whether the sampled operation is a branch, a load, a load atomic, a store, or other. 
Information about whether the sampled operation is conditional, conditional select, or not. 

The total latency, a cycle count of the lifetime of the sampled operation. For more information see Lifespan 
of a sampled operation on page D9-2748. 

The issue latency, a cycle count from the start of the sampled operation up to the point when at least one part 
of the sampled operation starts executing. A sampled operation might be delayed, for example, because the 
input operands were not available. 


If the sampled operation does not complete execution or generates an exception it is UNPREDICTABLE whether the 
record contains all or any of this information and the other information about the operation listed in this section and 
the following subsections. For information on exceptions being taken in sampled operations see Exceptions on 
page D9-2749. 


The architecture defines a set of additional data that is collected in the sample record for each sampled operation. 
This is described in the following subsections, and comprises: 


Events, which are required to be implemented consistently with PMU Events, for more information see 
Chapter D10 Statistical Profiling Extension Sample Record Specification and Chapter D7 The Performance 
Monitors Extension. 


Cycle counters. Cycle count values as described in this architecture, which, for a particular implementation, 
are fixed with an IMPLEMENTATION DEFINED value, might be omitted from the sample record. 


Addresses. 


In addition, the architecture permits IMPLEMENTATION DEFINED events, counters, and addresses to be collected. 
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D9.6.1 Information collected for micro-ops 


Because architectural instructions might create zero, one, or more micro-ops, micro-ops might have different 
characteristics from the architectural instructions they are created from. The data collected for each micro-op is 
IMPLEMENTATION DEFINED. Implementations should collect the subset of data appropriate to the micro-op. 


Example D9-1 Collection of sampled operations 


If PMSFCR_EL1.FE is set to 1, PMSFCR_EL1.FT is set to 1, and PMSFCR_EL1.FL is set to 1, then only sampled 
operations that meet all of the following criteria are recorded and written to the Profiling Buffer: 


. The sampled operation is one of the selected operation types. 
. The operation has all of the events in the filter set. 
7 The total latency is equal to or greater than the minimum latency. 
D9.6.2 Additional information for each profiled branch or exception return 


For a completed branch or exception return sampled operation, the profiling operation must record: 


: The sampled operation type as an unconditional branch or a conditional branch. Sampled exception returns 
are treated as unconditional branches by the Statistical Profiling Extension. 
° The target virtual address of the branch. The target virtual address includes the Exception level and Security 
state of the target. 
Note 





If the sampled operation is an illegal exception return, it is IMPLEMENTATION DEFINED whether the context 
information recorded in the target virtual address is the actual target context, or the target context that is 
described by the SPSR. 





. If the PE implements branch prediction, whether the branch was correctly predicted or mispredicted. 
. Whether the branch was taken or not taken. 
. Whether the branch was direct or indirect. 

Note 





A sampled operation that generates an exception is not treated as a branch. 





D9.6.3 Additional information for each profiled memory access operation 
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For a completed load, store, or atomic sampled operation that does not generate an exception, the profiling operation 
must record: 


° The data virtual and, if enabled, physical addresses being accessed. 
— Ifthe applicable Top Byte Ignore (TBI) bit is set to one, the virtual address includes any top-byte tag. 


— The physical address is the address the PE accesses in the physical address space, and so includes the 
Secure Address Space Identifier. 


s The sampled operation type, which includes: 
— Whether the sampled operation is a load, store, or atomic. 
— Whether the sampled operation is Load-Exclusive, Store-Exclusive or Load-acquire, Store-release. 
— Whether the sampled operation accesses the general-purpose or SIMD&FP registers. 

s The translation latency. This is defined as an IMPLEMENTATION DEFINED choice between: 


— The count of cycles for which at least one part or a chosen part of a load or store operation is waiting 
for the MMU to complete an address translation, and no part of the operation is accessing memory. 


— The count of cycles for which at least one part or a chosen part of a load or store operation is waiting 
for the MMU to complete an address translation. 


s Whether the sampled operation accessed the Level 1 data cache and the result. 
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$ Whether the sampled operation accessed the data TLB and the result. 

° An optional, IMPLEMENTATION DEFINED, record of whether the sampled operation accessed Last Level data 
cache and the result. 

è An optional, IMPLEMENTATION DEFINED, record of whether the sampled operation accessed another socket 
in a multi-socket system. 

. An optional, IMPLEMENTATION DEFINED, indicator of the data source for a load. 

° If ARMv8.3-SPE is implemented, an optional indication that the sampled memory operation is non-optimal 


for the access size. For more information see Data Alignment Flag. 


For each of the Last level cache and another socket indicators, it is IMPLEMENTATION DEFINED whether this 
information is present only for load accesses, only for store accesses, for neither, or for both. 


For more information see Events packet on page D10-2776. 





Note 


A store might be marked as not accessing a cache or another socket because it completed before doing so. For 
example, the write was held in a write buffer. This behavior is IMPLEMENTATION DEFINED, and such events must be 
interpreted with care. 





If architecture instructions are sampled, for a sampled load or store operation that is not single-copy atomic, the data 
addresses are the lowest address that is accessed by the sampled operation regardless of whether architecture 
instructions are sampled or not. 


Otherwise the information is for the micro-op that is sampled. 


Example D9-2 Sampling of micro-ops 


If an architectural load instruction is split into an address generation micro-op and a load micro-op, then when 
generating the sample record and filtering based on operation type: 

è If the address generation micro-op is sampled, the sampled operation is treated as other. 

$ If the load micro-op is sampled, the sampled operation is treated as a load. 


The sampled data physical address is always the address generated from translating the sampled data virtual address. 
The sampled data physical address packet is not output if any of the following are true: 


. The PE does not translate the address, for example because it does not perform the access or the address 
translation generates a Translation fault. 

° The sampled data virtual address packet is not output. 

i Prohibited by System register controls. 


If ARMv8.5-MemTag is implemented, a PE will generate an Unchecked access for each access to the Profiling 
Buffer as part of writing a sample record. 


For more information on ARMv8.5-MemTag, see Chapter D6 Armv8.5 Memory Tagging Extension. 


Data Alignment Flag 


If ARMv8.3-SPE is implemented Events packet.E[11] is set to 1 for a sampled memory operation if the address 
alignment is non-optimal for the access size. 


Address alignment is defined as non-optimal if that access incurs an additional performance penalty only because 
of the address alignment, and is unrelated to whether the access is architecturally misaligned for the access size. 
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Example D9-3 Data Alignment Flag operation 


od A 32-bit word access that is not word aligned is architecturally misaligned, but (if Alignment faults are 
disabled) might not incur an additional penalty because of this alignment unless the word also happens to 
span a cache-line boundary. 


` A contiguous load operation that loads a vector that is the length of two cache lines is optimally aligned if it 
has cache-line alignment, even though the operation makes two cache line accesses. 

` A non-contiguous SVE load operation that makes a sequence of access is optimal only ifall of the access are 
optimal. 


The definition of non-optimal is IMPLEMENTATION DEFINED and support for the Alignment Flag is OPTIONAL. 


D9.6.4 Additional information for each profiled conditional instruction (including conditional 


branches) 


For a completed conditional branch, conditional select, conditional move, or conditional increment sampled 
operation, the profiling operation must record: 


s That the sampled operation was conditional. 
7 Whether the condition passed or failed. 


If a conditional instruction fails its condition code test, it is IMPLEMENTATION DEFINED whether any of the 
information for the sampled operation that is generated by executing the sampled operation is recorded. Any value 
that is recorded and is the result of executing the sampled operation is UNKNOWN. 


Example D9-4 Conditional branches 


A conditional branch operation fails its condition code test. It is IMPLEMENTATION DEFINED whether the sample 
record contains a branch target Address packet. If the sample record contains a branch target Address packet, the 
value in the packet is UNKNOWN. 


D9.6.5 Additional Information for each profiled Scalable Vector Extension operation 
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When ARMv8.3-SPE and The Scalable Vector Extension (SVE) are implemented, SVE operations are sampled as 
described in this section. 


In this section the following terms are used: 


Maximum implemented vector length 


Means the implemented width of the vector registers. This value is IMPLEMENTATION DEFINED. 


Accessible vector length 


Means the accessible width of the SVE vector registers at the current Exception level, as constrained 
by the ZCR_EL1, ZCR_EL2 or ZCR_EL3 System registers. The Accessible vector length is always 
less-than-or-equal-to the Maximum implemented vector length. 


Sampled SVE operation 


Means an instruction or micro-operation defined by the Arm Architecture Reference Manual 
Supplement: The Scalable Vector Extension (SVE), for Armv8-A and sampled by the Statistical 
Profiling Extension that has a vector or a predicate as an input or output. This includes instructions 
with scalar outputs, but excludes the Non-SIMD SVE instructions. 


Sampled operation vector 


Means the portion of the accessible vector operated on by the Sampled SVE operation. 
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Effective vector length 
Is the length of the Sampled operation vector. The Effective vector length is always 
less-than-or-equal-to the Accessible vector length. 
— Note 


The Accessible vector length is always quantized into multiples of 128-bits. However, the Sampled 
operation vector can be any size down to the element size of the operation. 





Sampled predicated SVE operation 
Means a Sampled SVE operation that is one of: 
° An SVE operation that writes to a vector destination register under a Governing predicate 
using either zeroing or merging predication. 
° A predicated store of a vector register or registers. 


For an implementation that samples micro-operations, an SVE instruction might be split up into one 
or more micro-operations, some of which are predicated and some of which are not predicated. 


Note 


Sampled predicated SVE operation excludes operations that do not write a vector register, or do so but not using 

zeroing or merging predication, and applies to machine instructions rather than aliases. For example, the following 

instructions are not predicated SVE instructions under this definition: 

° CNTP, LASTA, and PTRUE do not write to vector registers. 

° FADDV, and SMAX write scalar values to SIMD&FP registers. 

a COMPACT and SEL (vectors) write to vector registers, and have a predicate operand, but do not use that 
predicate as a Governing predicate for zeroing or merging predication. 





e MOV (vector, predicated) appears to be a predicated SVE instruction because it specifies merging predication 
through the <PG>/M operand, but it is actually an alias for the SEL (vectors) instruction. 





If an implementation samples micro-operations, it is IMPLEMENTATION DEFINED whether individual elements, or 
groups of elements, are treated as single micro-operations. 


The division of instructions into micro-operations must be fixed prior to sampling to guarantee consistently accurate 
statistical sampling. 


Example D9-5 Vector length 


For example, to support a vector length of 1024 bits, an implementation might split all instructions into four 
micro-operations on 256-bit vector paths. The implementation must, however, implement 1024-bit wide vector 
registers. 


This behavior might vary based on operation type. For example, an implementation that has a full-width data-path 
for most operations might choose to break certain complex operations, such as non-contiguous load or stores, into 
shorter vectors. 


Example D9-6 Accessible vector length less-than the Maximum implemented 


To support an Accessible vector length less-than the Maximum implemented vector length, an implementation 
might choose to do all operations at the Maximum implemented vector length and discard the results above the 
Accessible vector length. Discarded results, arising from difference between Maximum implemented vector length 
and Accessible vector length, do not form part of the sampled operation and the Effective vector length must not 
include any discarded portions of the vector. 


Results discarded because of predication are part of the sampled operation. 
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For a sampled SVE cache prefetch operation: 


s The profiling operation captures an IMPLEMENTATION DEFINED subset of the information captured for an SVE 
load instruction. 


è The profiling operation treats the operation type as Other when generating the sample records and filtering 
based on operation. 


7 It is IMPLEMENTATION DEFINED whether the operation is treated as a Sampled SVE operation: 


— Iftreated as a Sampled SVE operation, the Operation Type packet payload format is the Operation 
Type packet on page D10-2781. 


— If not treated as a Sampled SVE operation, the Operation Type packet format is the Operation Type 
packet payload (Other) on page D10-2781. 


For a Sampled SVE operation the Operation Type packet is one of: 
è The SVE operation format. 
5 The SVE load or store format. 


For a Sampled SVE operation the Operation Type packet.EVL field records an upper bound on the Effective vector 
length. The value recorded in the Operation Type packet.EVL field is the Effective vector length rounded up to a 
power-of-two value. 


For a Sampled SVE operation that is a Sampled predicated SVE operation; 
° Operation Type packet.PRED, Predicated SVE operation, is set to 1. 


. If any elements in the Sampled operation vector are Inactive elements, then Events packet.E[17], Partial 
predicate, is set to 1. 


s If all elements in the Sampled operation vector are Inactive elements, then Events packet.E[18],Empty 
predicate, is set to 1 and Events packet.E[17] (Partial predicate) is set to 1. 


° Ifall elements in the Sampled operation vector are Active elements then Events packet.E[18:17] is set to 0b00. 


For a Sampled SVE operation, that is not a Sampled predicated SVE operation: 
è Operation Type packet.PRED, Predicated SVE operation, is set to 0. 
° Events packet.E[18:17] is set to 0b00. 


For a sampled non-contiguous SVE load or store operation that makes multiple memory accesses, the sampled data 
virtual address is the address accessed by a random one of the load or store operations chosen from the Sampled 
operation vector. If the chosen load or store operation is for an Inactive element, the data virtual address packet is 
not output. 


For more information on memory access operations see Additional information for each profiled memory access 
operation on page D9-2743. 


For a sampled contiguous SVE load or store operation that makes multiple memory accesses, the sampled data 
virtual address is an IMPLEMENTATION DEFINED choice of: 


° The address accessed for the lowest element in the Sampled operation vector. 
. The address used for the access containing the lowest Active element in the Sampled operation vector. 


If the corresponding element is an Inactive element, it is IMPLEMENTATION DEFINED whether the data virtual address 
packet is output. 


D9.6.6 Additional information for other operations 


For cache maintenance operations by virtual address, cache prefetch, other than SVE cache prefetch, or address 
translation instructions, the profiling operation: 

7 Captures an IMPLEMENTATION DEFINED subset of the information captured for a load instruction. 

s Treats the operation type as other when generating the sample record and filtering based on operation type. 


See Filtering sample records on page D9-2741, Operation Type packet and Additional Information for each profiled 
Scalable Vector Extension operation on page D9-2745. 
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D9.6.7 Controlling the data that is collected 

Certain data in sample records is only collected if permitted by one or both of EL1 and EL2. This is to restrict 

exposure of data to a lower Exception level or to Non-secure state. 

CONTEXTIDR_ ELI is collected only if PMSCR_EL1.CX is set to 1, the PE is executing at EL1 or ELO and any 

of the following are true: 

. EL2 is not implemented. 

s ARMv8.4-SecEL2 is implemented and EL2 is disabled for the current Security state. 

s The Effective value of HCR_EL2.TGE is 0. 

CONTEXTIDR_EL2 is collected only if the Effective value of PMSCR_EL2.CX is 1 and EL2 is implemented and 

enabled for the current Security state. 

This is described in the pseudocode functions CollectContextIDR1() and CollectContextIDR2(). 

Timestamps are collected only if one of the following is true: 

s PMSCR_EL1.TS is set to 1 and the Profiling Buffer is owned by EL1. 

s PMSCR_EL2.TS is set to 1 and the Profiling Buffer is owned by EL2. 

The timestamp is a choice between: 

à Physical time, which is defined by the value of CNTPCT_ELO. 

s Virtual time, as defined by the value of CNTVCT_ELO. That is, the physical time minus the virtual offset, 
CNTVOFF_EL2. However, the virtual offset is treated as zero if a read of CNTVCT_ELO at the current 
Exception level would treat the virtual offset as zero. 

Physical time is collected if any of the following is true: 

° PMSCR_EL1.PCT is set to 1 and the Profiling Buffer is owned by Secure EL1 and Secure EL2 is disabled 
or is not implemented. 

i. PMSCR_EL2.PCT is set to 1 and the Profiling Buffer is owned by Secure or Non-secure EL2. 

` PMSCR_EL1.PCT is set to 1 and PMSCR_EL2.PCT is set to 1 and the Profiling Buffer is owned by 
Non-secure EL1, or the Profiling Buffer is owned by Secure EL1 and Secure EL2 is enabled. 

Virtual time is collected otherwise. If EL2 is not implemented, PMSCR_EL1.PCT is RES1, and the PE behaves as 

if PMSCR_EL2.PCT is set to 1 other than for a direct read of the register. This is described by the pseudocode 

function CollectTimeStamp(). 

Physical data addresses are collected only if one of the following is true: 

° PMSCR_EL1.PA is set to 1 and the Profiling Buffer is owned by Secure EL1, and Secure EL2 is disabled or 
is not implemented. 

s PMSCR_EL2.PA is set to 1 and the Profiling Buffer is owned by Secure or Non-secure EL2. 

: PMSCR_EL1.PA is set to 1 and PMSCR_EL2.PA is set to 1 and either the Profiling Buffer is owned by 
Non-secure EL1, or the Profiling Buffer is owned by Secure EL1 and Secure EL2 is implemented and 
enabled. 

If EL2 is not implemented or is disabled for the current Security state, the PE behaves as if PMSCR_EL2.PA is set 

to 1, other than for a direct read of the register. 

Enabling collection of the physical data addresses has an IMPLEMENTATION DEFINED impact on the sampled 

operation. This is described by the pseudocode function CollectPhysicalAddress(). 

D9.6.8 Lifespan of a sampled operation 

The sampled lifespan of an operation: 

° Starts with the decoded architectural instruction or micro-op is dispatched for issue. 

s Completes when one of: 

— The instruction or micro-op is committed to the architectural state of the PE (including completion by 
generating a synchronous exception). 
— The speculative instruction or micro-op is discarded because of misspeculation. For more information 
see Misspeculation and non-architectural operations on page D9-2734. 
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— The instruction or micro-op is replayed, on some microarchitectures. For more information see 
Non-architectural exceptions. 


D9.6.9 Exceptions 
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All sample records written to the Profiling Buffer contain the Events packet and either the End packet or the 
Timestamp packet. 


Ifthe sampled operation generates an exception, it is UNPREDICTABLE whether the sample record contains any other 
information. 


Where a sampled operation generates an exception and the type of exception means that a particular item is not 
computed by the sampled operation, that information is not collected by the profiling operation. For more 
information see Synchronization and Statistical Profiling on page D9-2758. 


Example D9-7 Translation Faults 


If a sampled operation generates a Translation Fault, the physical address for the sampled operation was not 
generated by the MMU and cannot be recorded. 


Non-architectural exceptions 


An implementation might include exceptions that are not architectural exceptions. That is, in executing an 
operation, the PE performs some exceptional behavior that does not take an exception as defined by the architecture. 
These non-architectural exceptions are usually not visible to software. 


The use on non-architectural exceptions are IMPLEMENTATION DEFINED. 


If a sampled operations generates a non-architectural exception, the sample might include handling of the 
non-architectural exception. If the sample does not include handling of the non-architectural exception, then the 
sampled operation does not complete because of the non-architectural exception and it is recorded using E[1] == 0 
(operation did not retire) in the Events packet. Bit E[0] (operation generated an exception) might be used to indicate 
the operation did not complete because of the non-architectural exception. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D9-2749 
Non-Confidential 


The Statistical Profiling Extension 
D9.7 The Profiling Buffer 


D9.7 The Profiling Buffer 


The profile data is collected in a memory Profiling Buffer. The Profiling Buffer is defined by: 
. PMBPTR_EL1, the current write pointer. 
. PMBLIMITR_EL1, the write limit pointer. 


The Profiling Buffer starts at the current write pointer and extends to the current limit pointer minus one. The write 
limit pointer must be aligned to the smallest implemented translation granule size. The alignment of the current 
write pointer is IMPLEMENTATION DEFINED. 


PMBLIMITR_EL1 and PMBPTR_EL! are virtual addresses in the stage 1 translation regime of the owning 
Exception level. This is called the owning translation regime. 


Note 


The translation of virtual addresses to physical addresses is identical to that for any other virtual address in the 
owning Exception level. For example, PMBPTR_EL1[63:56] are ignored by address translation if the respective 
TBI bit is set to 1. 








D9.7.1 Restrictions on the current write pointer 


This section describes the software rules on setting the current write pointer, PMBPTR_ ELI. If these rules are not 
followed, the value returned for a direct read of PMBPTR_EL1 is UNKNOWN, the behavior is UNPREDICTABLE, and 
the PE might do any of the following at any point after profiling is enabled: 


. Write sample records to any writeable address in memory that is writable at the owning Exception level. 

s Generate a Profiling Buffer management event, with or without indicating data loss, for one of the following 
reasons: 
— The Profiling Buffer is full. 
— Any MMU Fault. 


When profiling becomes enabled, all the following must be true: 

° The current write pointer must be at least one sample record below the write limit pointer. That is: 
UInt(PMBPTR_EL1.PTR) <= UInt(PMBLIMITR_EL1.LIMIT :Zeros(12)) - 2PMSIDR_EL1.MaxSize, 

° PMBPTR_EL1.PTR[63:56] must equal PMBLIMITR_EL1.LIMIT[63:56]. 


When the Profiling Buffer is first configured, PMBPTR_EL1.PTR must be aligned to PMBIDR_EL1.Align. That 
is, if PMBIDR_EL1.Align is nonzero, PMBPTR_EL1.PTR [UInt(PMBIDR_EL1.Align)-1:0] must be all zeros. 


However, the current write pointer can usually be restored to the saved write pointer value it had when profiling was 
disabled, providing a PSB CSYNC and a context synchronization event were executed before reading PMBPTR_EL1: 


s If no Profiling Buffer management event was signaled then profiling can be restarted from the saved write 
pointer. In this case, the saved write pointer points within one sample record of the write limit pointer. 
7 Ifa Profiling Buffer management event was signaled then: 
— IfPMBSR_ELLS is restored to 1, then profiling is not being enabled, and there are no constraints on 
the value written to PMBPTR_EL1. 


—  IfPMBSR_EL1.Sis restored to 0, and the Profiling Buffer management event was caused by an MMU 
fault, profiling can be restarted from the saved write pointer; if PMBSR_EL1.{EA, DL} did not also 
indicate an external abort or data loss, and the saved write pointer is at least one sample record below 
the write limit pointer. 


Note 


Ifa signaled MMU fault has not been corrected, the Statistical Profiling Extension generates a new 
MMU fault Profiling Buffer management event when it next tries to write a sample record. 








—  IfPMBSR_EL1.S is restored to 0, and the Profiling Buffer management event was caused by a buffer 
full event, the Profiling Buffer can be extended and profiling restarted from the saved write pointer; if 
PMBSR_EL1.{EA, DL} did not also indicate an external abort or data loss and the saved write pointer 
is at least one sample record below the extended write limit pointer. 
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The current write pointer must not be restored from the saved write pointer following a Profiling Buffer 
management event if PMBSR_EL1.DL was set to 1. 


The saved write pointer might not be aligned to 2PMBIDR_ELI-Align and might point to within one sample record of 
the write limit pointer. 


For more information see Synchronization and Statistical Profiling on page D9-2758. 


D9.7.2 The owning Exception level 


The owning Exception level is: 
° Non-secure EL1, if all of the following are true: 


— Either EL3 is not implemented and the PE is executing in Non-secure state, or MDCR_EL3.NSPB is 
set to either 0b10 or 0b11. 


— Either EL2 is not implemented, or MDCR_EL2.E2PB is set to either 0b10 or 0b11. 
$ Non-secure EL2, if all of the following are true: 
—  EL2 is implemented. 


— Either EL3 is not implemented and the PE is executing in Non-secure state, or MDCR_EL3.NSPB is 
set to either 0b10 or 0b11. 


—  MDCR_EL2.E2PB is set to 0b00. 


s Secure EL1, if all of the following are true: 
— Either EL3 is not implemented and the PE is executing in Secure state or MDCR_EL3.NSPB is set to 
either @b00 or 0b01. 
— Either Secure EL2 is not implemented, or is disabled, or MDCR_EL2.E2PB is set to either 0b10 or 0b11. 
a Secure EL2, if all of the following are true: 


— Secure EL2 is implemented and enabled. 


— Either EL3 is not implemented and the PE is executing in Secure state, or MDCR_EL3.NSPB is set to 
either 0b00 or 0b01. 


—  MDCR_EL2.E2PB is set to 0b00. 
When the owning Exception level is Non-secure EL1 


The Profiling Buffer addresses are in the Non-secure EL1&0 translation regime using the current ASID from 
TTBRx_EL1. This is a two-stage translation using the current VMID if EL2 is implemented and HCR_EL2.VM is 
set to 1. 


If EL3 is implemented, then the Profiling Buffer is disabled in Secure state. 


If EL2 is implemented, then profiling is disabled at EL2 and at Non-secure ELO when HCR_EL2.TGE is set to 1. 


When the owning Exception level is Non-secure EL2 


The Profiling Buffer addresses are in the Non-secure EL2 translation regime. If both HCR_EL2.E2H is set to 1 and 
HCR_EL2.TGE is set to 1, this is an EL2&0 translation regime using the current EL2&0 translation regime ASID 
from TTBRx_EL2. 


If EL3 is implemented, then the Profiling Buffer is disabled in Secure state. 


Note 


If either HCR_EL2.E2H is cleared to 0 or HCR_EL2.TGE is cleared to 0, and the PE is executing at EL1 or ELO, 
the EL2 translation regime is not the current stage 1 translation regime because the current stage 1 translation regime 
is EL1&0. 








When the owning Exception level is Secure EL1 


The Profiling Buffer addresses are in the Secure EL1&0 translation regime using the current ASID from 
TTBRx_EL1. This is a two-stage translation using the current VMID if Secure EL2 is implemented and enabled 
and HCR_EL2.VM is set to 1. 
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If EL3 is implemented, then the Profiling Buffer is disabled in Non-secure state. 


If Secure EL2 is implemented and enabled, then profiling is disabled at EL2 and at Secure ELO when 
HCR_EL2.TGE is set to 1. 


When the owing Exception level is Secure EL2 


The Profiling Buffer addresses are in the Secure EL2 translation regime. If both HCR_EL2.E2H is set to 1 and 
HCR_EL2.TGE is set to 1, this is an EL2&0 translation regime using the current EL2&0 translation regime ASID 
from TTBRx_EL2. 


If EL3 is implemented, then the Profiling Buffer is disabled in Non-secure state. 


Table D9-3 summarizes the owning translation regime. 


Table D9-3 Summary of owning translation regime (for all Exception levels using AArch64 state) 
































Owning 
PMBLIMITR_EL1.E SCR_EL3.NS SCR_EL3.EEL2 MDCR_EL3.NSPB MDCR_EL2.E2PB translation 
regime 
0 X X X X Disabled 
1 1 0 Qb1x 0b1x Non-secure 
EL1&0 
0b00 Non-secure EL2 
or 
EL2&0a 
QbOx X Disabled 
0 0 QbOx X Secure EL1&0 
0 1 QbOx 0b1x Secure EL1&0 
0b00 Secure EL2 or 
EL2&04 
X Qb1x X Disabled 
a. Depending on the values of HCR_EL2.{E2H,TGE}. 
The Profiling Buffer is disabled if any of the following are true: 
s SCR_EL3.NS indicates the other Security state to the owning Exception level. 
. The owning Exception level is using AArch372 state. 
. PMBLIMITR_EL1.E is cleared to 0. 
D9.7.3 Memory access types and coherency 
The Statistical Profiling Extension acts as a separate observer in the system and is subject to the rules regarding 
coherency. 
The memory type that is used for a write by the Statistical Profiling Extension to the Profiling Buffer is taken from 
the translation table entries for the virtual address being written to. That is: 
$ The writes are treated as coming from an observer that is coherent with all observers in the Shareability 
domain that is defined by the translation tables. 
$ There is no requirement to manage coherency for observers in the same Shareability domain but coherency 
for other observers in the system might require explicit management. 
For more information see Synchronization and Statistical Profiling on page D9-2758. 
D9-2752 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


The Statistical Profiling Extension 
D9.7 The Profiling Buffer 


If ARMv8.5-MemTag is implemented, an instruction which loads or stores an Allocation tag will be treated as a 
load or store if profiling is enabled. For more information on ARMv8.5-MemTag, see Chapter D6 Armv8.5 Memory 
Tagging Extension. 


Writes to the Profiling Buffer are made as privileged writes within the owning translation regime. 


This means that if ARMv8.5-E0PD is implemented, the values of TCR_ELx.EOPDy, where ELx is the owning 
Exception level, do not apply to accesses to the Profiling Buffer made by the Statistical Profiling Extension. 


D9.7.4 TLB operations 


Translations might be cached in a TLB. TLB maintenance operations (including TLB maintenance operations that 
are broadcast from other PEs) operate on these cached translations. 


Any TLB maintenance operation followed by a DSB (including an operation broadcast from another PE and a 

following DSB on that other PE): 

s Does not complete until all sample records previously translated using an invalidated translation have been 
written to the Profiling Buffer. 


: Any remaining sample records are guaranteed not to use an invalidated translation. 


For such operations, the DSB must apply to both loads and stores. Although the Statistical Profiling Extension acts 
as another observer in the system, for determining the Shareability domain of this DSB or TLB maintenance 
operation, the writes of sample records are treated as coming from the PE that is being profiled. 





Note 


Completion of the DSB does not guarantee that all buffered profiling data has written out. See Synchronization and 
Statistical Profiling on page D9-2758. 





D9.7.5 Effect on the exclusive monitors 


ARM DDI 0487E.a 
ID070919 


Ifan operation between Load-Exclusive and Store-Exclusive instructions is sampled, then the Store-Exclusive must 
be guaranteed not to fail, even though the sample record is written to an unrelated address. 
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D9.8 Profiling Buffer management 


A Profiling Buffer management event occurs: 

7 On a fault, see Faults and watchpoints on page D9-2755. 

` On an external abort, see External aborts on page D9-2756. 

` When the Profiling Buffer fills, see Buffer full event on page D9-2755. 


On a Profiling Buffer management event: 

. The service bit, PMBSR_EL1.S, is set to 1. 

° The data loss bit, PMBSR_EL1.DL, is set as described in the event description. 

$ The Profiling Buffer management interrupt request signal, PMBIRQ, is asserted: 


— PMBIRQ isa level-sensitive interrupt request driven by PMBSR_EL1.S. This means that a direct 
write that sets PMBSR_EL1.S to 1 causes the interrupt to be asserted, and PMBIRQ remains 
asserted until software clears PMBSR_EL1.S to 0. 

— Ifa Generic Interrupt Controller (GIC) is implemented, PMBIRQ must be configured as a Private 
Peripheral Interrupt (PPI) in a multiprocessor system. PMBIRQ is signaled by the PE that implements 
the Statistical Profiling Extension. 


Note 
A standard PPI number is allocated by the ARM*Server Base System Architecture (SBSA). 








s Additional syndrome for the event is written to PMBSR_EL1.MSS. Unless otherwise stated in the event 
description, other PMBSR_ EL! fields are unchanged. 


While PMBSR_EL1:S is set to 1: 

$ The buffer is disabled and profiling is disabled. 

° All remaining buffered sample records are discarded. 

s The values in PMBPTR_EL!1 are retained and PMSICR_EL1 does not decrement. 


Buffer full events and MMU fault Profiling Buffer management events are reported synchronously. 


Note 


Reported synchronously means that profiling is disabled before the SPE samples further operations. The interrupt 
exception resulting from asserting the Profiling Buffer interrupt request is an asynchronous exception. 





It is IMPLEMENTATION DEFINED whether external aborts are reported to the Statistical Profiling Extension 
synchronously or asynchronously. If external aborts are reported as asynchronous: 


è The external abort might not be received until after a first Profiling Buffer management event has set 
PMBSR_EL1.S to 1. 
à Writes to the buffer might generate a second Profiling Buffer management event after the external abort has 


set PMBSR_EL1.S to 1. 


The architecture does not require that a sample record is written sequentially by the Statistical Profiling Extension, 
only that: 


è The Statistical Profiling Extension never writes past the PMBLIMITR_EL!1 limit pointer. 


$ On a Profiling Buffer management interrupt, PMBSR_EL1.DL indicates whether PMBPTR_EL1 points to 
the first byte after the last complete sample record. 


° On an MMU fault or synchronous external abort, PMBPTR_EL!1 serves as a Fault Address Register. 


Note 


. This means that it must not be assumed that: 





— There is ever any valid data beyond the current PMBPTR_EL1 write pointer. 

— The PEhas not written a valid sample record between the current PMBPTR_EL1 write pointer and the 
PMBLIMITR_EL1 limit pointer. 

—  IfPMBSR_EL1.DL is set to 1 on a Profiling Buffer management interrupt, that there is any valid data 
between the end of the last complete sample record and the current PMBPTR_ EL] write pointer. 
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— Any valid data has been written to the Profiling Buffer if an external abort is reported asynchronously 
to the Statistical Profiling Extension. 


° The last complete sample record must end at most 2(PMSIDR_EL1.MaxSize) bytes below PMBPTR_EL1. 





D9.8.1 Prioritization of Profiling Buffer management events 


Where multiple synchronous Profiling Buffer management events occur on writing a sample record, the PE 
prioritizes them as follows (from highest to lowest priority): 


l. Synchronous fault. 
2: Synchronous external abort. 
3: Buffer full event. 


Asynchronous external aborts are not prioritized with respect to other events. 


Note 


Prioritization of Profiling Buffer management interrupt requests is managed by the interrupt controller. Profiling 
Buffer management events are prioritized internally by the PE. 








D9.8.2 Buffer full event 


If, after writing a sample record, there is not sufficient space in the Profiling Buffer for a sample record of the size 
indicated by PMSIDR_EL1.MaxSize, and PMBSR_EL1.S is 0, a Profiling Buffer management event is generated: 


$ PMBSR_EL1.EC is set to 0b000000, other buffer management event. 
° The BSC field of PMBSR_EL1.MSS is set as follows: 
— PMBSR_EL1.BSC is set to 0b000001, buffer filled. 
7 PMBPTR _EL1 is set to the first byte after the last complete sample record. PMBSR_EL1.DL is unchanged. 
à The other PMBSR_ELI fields are unchanged. 


That is, the Profiling Buffer management event is generated when the PE writes past the write limit pointer minus 
2(PMSIDR_ELI.MaxSize), The Statistical Profiling Extension never writes beyond the write limit pointer. 


For more information see Restrictions on the current write pointer on page D9-2750. 


D9.8.3 Faults and watchpoints 


Table D9-4 lists the faults that might be generated by a write to the Profiling Buffer by the Statistical Profiling 
Extension. 


Writes to the Profiling Buffer never generate watchpoints. 


Table D9-4 Faults 





Fault 


Conditions 





Translation 


The translation of a virtual address to a physical address might generate a Translation fault. 





Address Size 


The translation of a virtual address to a physical address might generate an Address Size fault. 





Alignment 
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If PMBPTR_ELI is not aligned to an IMPLEMENTATION DEFINED minimum alignment, the behavior is 
UNPREDICTABLE and a write to the Profiling Buffer by the Statistical Profiling Extension might generate an 
Alignment fault. For more information see Restrictions on the current write pointer on page D9-2750. 
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Table D9-4 Faults (continued) 





Fault 


Permission 


Conditions 


Writes to the Profiling Buffer are made as privileged writes. If the write does not have write permission, a 
Permission fault is generated. The value of PSTATE.PAN is ignored and treated as zero. If the Statistical 
Profiling Extension does not manage the dirty state in translation tables, then accesses ignore the Dirty Bit 
Modifier bit in Page and Block descriptors and an access might as a result generate a Permission fault. For more 
information see The dirty state on page D5-2589.4 





Access Flag 


If the Statistical Profiling Extension does not manage the Access Flag in translation tables or hardware 
management of the Access Flag state is disabled for the owning translation regime, then any access to a Page 
or Block with the Access Flag bit set to 0 in a descriptor will generate an Access Flag fault. For more 
information see The Access flag on page D5-2589.8 





TLB Conflict fault 


IMPLEMENTATION DEFINED. 





a. PMBIDR_ EL1.F defines whether the Statistical Profiling Extension manages the Access Flag and dirty state in the translation tables. 


If a write to the Profiling Buffer generates a fault and PMBSR_EL1:S is 0, then a Profiling Buffer management 
event is generated: 


° PMBSR_EL1.S is set to 1. 
° PMBSR_EL1.EC is set to one of: 
— 0b100100, stage 1 Data Abort on write to the Profiling Buffer. 
— 0b100101, stage 2 Data Abort on write to the Profiling Buffer. 
° The FSC field of PMBSR_EL1.MSS is set as follows: 
— PMBSR_ELI.FSC is set to indicate the type of the fault. 
$ PMBPTR_EL!1 is set to the address that generated the fault. 


e If PMBPTR_EL! is not the address of the first byte after the last complete sample record written by the 
Statistical Profiling Extension, then PMBSR_EL1.DL is set to 1. Otherwise, PMBSR_EL1.DL is unchanged. 


è The other PMBSR_EL1 fields are unchanged. 


Note 


Each of these faults gives rise to a Profiling Buffer management interrupt, not an actual MMU fault exception. The 
ESR and FAR registers are unchanged. 








For more information see The MMU fault-checking sequence on page D5-2625. 


Hardware management of dirty state and the Access flag by the Statistical Profiling 
Extension 


It is IMPLEMENTATION DEFINED whether address translations performed by the Statistical Profiling Extension 
manage dirty state and the Access flag. This is discoverable by software using PMBIDR_EL1.F. See Hardware 
management of dirty state on page D5-2591 and Hardware management of the Access flag on page D5-2590. 


If hardware management of dirty state by the Statistical Profiling Extension is implemented, and hardware 
management of dirty state is enabled for the owning translation regime, then the Statistical Profiling Extension can 
speculatively update the translation table descriptor for any Page or Block in the Statistical Profiling buffer before 
writing data to it, ifthe write is otherwise permitted. This includes the case where a buffer management event means 
the Statistical Profiling Extension stops writing data before the page or block is written to. 


D9.8.4 External aborts 


D9-2756 


A write to the Profiling Buffer might generate an external abort, including an external abort on a translation table 
walk or translation table update. It is an IMPLEMENTATION DEFINED choice whether such an external abort: 


a Is reported to the Statistical Profiling Extension and treated as a Profiling Buffer management event. 
a Generates an SError interrupt exception. 
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If a write to the Profiling Buffer generates an external abort that is reported to the Statistical Profiling Extension: 


The external abort bit, PMBSR_EL1.EA, is set to 1. 

The Statistical Profiling Extension stops writing sample records to the Profiling Buffer. It is implementation 

defined whether an external abort on a write to the Profiling Buffer is reported as synchronous or 

asynchronous: 

—  Theexternal abort is reported as synchronous if PMBPTR_EL1 is set to the address that was externally 
aborted. 

— The external abort is reported as asynchronous if PMBPTR_EL1 is not guaranteed to be set to the 
address that was externally aborted. 

If the external abort is reported as asynchronous or PMBPTR_EL1 is not the address of the first byte of the 

sample record being written by the Statistical Profiling Extension, then PMBSR_EL1.DL is set to 1. 

Otherwise PMBSR_EL1.DL is unchanged. 


Note 


Following an external abort reported asynchronously to the Statistical Profiling Extension, software must not 
assume that any valid data has been written to the Profiling Buffer. 





The other PMBSR_ELI fields are unchanged. 


If a write to the Profiling Buffer generates an external abort that is taken as an SError interrupt exception, the PE 
takes the SError interrupt exception as normal, and PMBSR_ EL] fields are unchanged. 





Note 


Treating the external abort as a Profiling Buffer management event: 


Sets PMBSR_EL1.S to 1 and so disables the Statistical Profiling Extension. 
Allows error recovery software to isolate the event to the actions of the Statistical Profiling Extension. 


Taking an SError interrupt: 


Means that the Statistical Profiling Extension will only be disabled if the SError interrupt is taken to an 
Exception level where the Statistical Profiling Extension is disabled. 


Might not allow error recovery software to isolate the event and error containment. 
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D9.9 


D9-2758 


Synchronization and Statistical Profiling 


The profiling operation of the Statistical Profiling Extension: 


s Makes indirect reads and indirect writes of System registers. 
° Writes to memory. 
è Makes further indirect writes to PMBPTR_EL1 as a result of an external abort on a write to memory. 


The indirect reads of the PMSCR_EL1.{E1SPE, EOSPE} and PMSCR_EL2.{E2SPE, EOHSPE} controls when 
determining whether to select an operation for profiling are treated as indirect reads made by the instruction being 
executed, and subject to the standard requirements for synchronization. 


Otherwise, although the profiling operation is generated by a sampled operation, the profiling operation executes 
independently of the instructions that are executed on the PE, and acts as a separate memory observer from the PE 
in the system. 


A DSB instruction guarantees that all memory transactions that are made by the PE are observable by writes made 
by a profiling operation relating to a sampled operation in program order after the DSB instruction. 


A Context synchronization event guarantees that a direct write to a System register made by the PE in program order 
before the context synchronization event are observable by indirect reads and indirect writes of the same System 
register made by a profiling operation relating to a sampled operation in program order after the context 
synchronization event. 


To synchronize previous profiling operations, software must execute a PSB CSYNC Buffer Synchronization 
instruction. 


Note 
The PSB CSYNC instruction is not defined in the AArch32 instruction set architecture. 








Following a context synchronization event, a PSB CSYNC instruction is guaranteed to synchronize the profiling 
operations for all instructions that are executed in program order before the context synchronization event. 


Synchronized by the PSB CSYNC instruction means: 

: A direct read of a System register in program order following a PSB CSYNC instruction requires explicit 
synchronization to observe an indirect write to the same System register made by a profiling operation 
synchronized by the PSB CSYNC instruction. 

s An indirect write to a System register made by a profiling operation synchronized by a PSB CSYNC instruction 
does not affect a direct write to the same System register made in program order following the PSB CSYNC 
instruction. 

° A direct write to a System register in program order following a PSB CSYNC instruction is not allowed to affect 
an indirect read of the same System register made by a profiling operation synchronized by the PSB CSYNC 
instruction. 

° A DSB instruction in program order following a PSB CSYNC instruction does not complete before the writes to 
the Profiling Buffer of sample records for profiling operations synchronized by the PSB CSYNC instruction have 
completed. The DSB instruction must apply to both loads and stores. 


For the indirect write to PMBSR_ELI that is made as a result of an external abort on a write of a sample record to 
memory, the synchronization rules apply only after the write has completed. 


Although the Statistical Profiling Extension acts as another observer in the system, for determining the Shareability 
domain of the DSB instructions, the writes of sample records are treated as coming from the PE that is being profiled. 


Note 


Ifthe Statistical Profiling Extension is not disabled when the context synchronization event occurs, further profiling 
operations might be generated that are not guaranteed to be synchronized by the PSB CSYNC instruction. 





If the PE takes an exception to an Exception level where the Statistical Profiling Extension is disabled, no new 
operations are selected for sampling. The Statistical Profiling Extension is always disabled if the owning Exception 
level is a lower Exception level than the current Exception level. 
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In the absence of a context synchronization event, a PSB CSYNC instruction is not required to execute in program order 
with respect to sampled operations. 


D9.9.1 UNPREDICTABLE behavior 
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In the absence of correct context synchronization events, it is UNPREDICTABLE whether an indirect read of a System 
register made by a profiling operation will return the old or the new values. 


If the indirect reads mean that Profi lingBufferEnabled() returns FALSE when a sample record or records are about 
to be written to the physical address, then it is further unpredictable whether the sample record or records: 


° Are written to memory. 
è Are silently discarded and not written to memory. 
: Are discarded and not written to memory, and a Profiling Buffer management event is generated: 


—  PMBSR_EL1.DL is set to 1. 
—  PMBSR_EL1.EC is set to 0x00. 
—  PMBSR_EL1.BSC is set to 0x00 to indicate that the buffer is not full. 


This means that software must execute a PSB CSYNC instruction to force any sample records to be written to the 
Profiling Buffer before changing context. 
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Chapter D10 


Statistical Profiling Extension Sample Record 
Specification 


This chapter describes the sample records generated by the Statistical Profiling Extension. It contains the following 
sections: 


à About the Statistical Profiling Extension Sample Records on page D10-2762. 
s Alphabetical list of Statistical Profiling Extension packets on page D10-2765. 
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D10.1 About the Statistical Profiling Extension Sample Records 
The sample record format is self-describing and extensible. This format allows software to parse profile data even 
when that profile data contains extended information. 
The Statistical Profiling Extension writes a series of sample records to memory, each record consisting of a sequence 
of packets, and each packet consisting of: 
° One or two header bytes. 
° Zero, 1, 2, 4 or 8 payload bytes. 
D10.1.1 Headers 
The first header byte encodes the number of payload bytes: 
0x00-0x1F Single byte header, no payload. 
0x20-0x3F First byte of extended header. Second byte encodes the payload length. 
0x40-0x4F, 0x80-0x8F, @xC0-OxCF 
Header with an 8-bit payload. 
0x50-0x5F, 0x90-0x9F, 0xD0-0xDF 
Header with a 16-bit payload. 
0x60-0x6F, @xAQ-OxAF, 0xEQ-0XxXEF 
Header with a 32-bit payload. 
0x70-0x7F, @xBQ-OxBF, 0xF0-0xFF 
Header with a 64-bit payload. 
D10.1.2 Records 
A record consists of multiple packets. A record comprises, in ascending address order: 
° A sequence of headers, each followed by their payload byte or bytes. 
° Either: 
— An End packet header. 
— A Timestamp packet. 
Figures in this chapter show each packet as a sequence of bytes. Figure D10-1 shows how bytes are stored in 
memory in increasing addresses from left to right. 
First byte 1 2 3 4 Last Byte 
Header Data Header DEE 0x01 
(16-bit data) LSB MSB (8-bit data) End Packet 
First Byte 1 2 3 4 5 6 = 12 Last Byte 
Header Data Header 0x71 i ; l 
(16-bit (8-bitdata)| Data Timestamp] TS [7:0] TS [55:48] | TS [63:56] 
data) LSB MSB Packet 
Figure D10-1 Convention for packet descriptions 
In some sections, the figures are split into separate figures for the header byte and payload bytes. For instance, where 
the number of payload bytes varies according to a field in the header. 
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D10.1.3 Byte order 


Header bytes and payload bytes are written in ascending address order. Within a payload value, values are written 
in little-endian byte order. 


The size of the access granule for writes to the Profiling Buffer by the Statistical Profiling Extension is 
IMPLEMENTATION DEFINED, up to a maximum of 2KB. The size of the access granule can vary from time to time. 


Note 


This means that if the memory type accessed is non-Gathering Device, the architecture does not require a specific 
access granule size at the end device. 








D10.1.4 Protocol framing packets and forwards compatibility 


The padding header, alignment command, timestamp packet, and end packet are protocol framing packets that 
frame the records created by the Statistical Profiling Extension. Only padding headers and alignment commands are 
permitted between records. 


Note 


PMBIDR _EL1.Align defines a minimum alignment for records. However, implementations must nevertheless 
create a valid protocol stream that can be parsed without knowledge of the minimum alignment. 





The packet types are described in the following sections. Software must ignore unknown packets, using the size 
field encoded in the header. This includes packets containing reserved values in fields. 


The following sections give an overview of the Statistical Profiling Extension packets output to a memory-mapped 
Profiling Buffer or Device memory: 


s Statistical Profiling Extension protocol packet headers 
D10.1.5 Statistical Profiling Extension protocol packet headers 


8-bit headers 


For Address packets and Counter packets, the 8-bit header format is described as the short format. 


Table D10-1 8-bit header encodings 





[7] [6] [5] [4] [3] [2] [1] [0] | Description 





0 0 0 0 0 0 0 0 Padding on page D10-2786 





0 0 0 0 0 0 0 1 End packet on page D10-2775 





0 1 1 1 0 0 0 1 Timestamp packet on page D10-2787 





0 1 x x 0 0 1 0 Events packet on page D10-2776 





0 1 x xX 0 0 1 1 Data Source packet on page D10-2774 





0 1 1 0 0 1 xX xX Context packet on page D10-2770 








0 1 0 0 1 0 xX xX Operation Type packet on page D10-2781 





1 0 1 1 0 x x x Address packet on page D10-2765 (Short format) 





1 0 0 1 1 x x x Counter packet on page D10-2771 (Short format) 
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16-bit headers 


For Address packets and Counter packets, the 16-bit header format is described as the extended format. 


Table D10-2 16-bit header encodings 





Description 


[7] [6] [5] [4] [S] [2] [1] [0] | [7] [6] [5] [4] [3] [2] [1] [0] 





0 0 1 0 0 0 x x 1 0 1 1 0 x x x | Address packet on 
page D10-2765 





0 0 1 0 0 0 x x 1 0 0 1 1 x x x Counter packet on 
page D10-2771 
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D10.2 Alphabetical list of Statistical Profiling Extension packets 


D10.2.1 Address packet 


The Address packet characteristics are: 
Purpose Provides an address value for the record. Addresses are always 64 bits. 
Attributes Multi-part packet comprising: 

° 8 or 16-bit header. 

° 64-bit payload. 


Address packet header 


When Extended format is used, the Address packet header bit assignments are: 


i e o o | moea | da 
a A A IE 
1 0 f : INDEX([2:0] Byte 1 
When Short format is used, the Address packet header bit assignments are: 
7 6 5 4 3 2 1 o 
1 0 INDEX 
1 1 
Byte 1 bits [7:6], when Extended format, Byte 0 bits [7:6], when Short format 
This field reads as 0b10. 





Byte 0 





SZ, byte 1 bits [5:4], when Extended format, SZ, byte 0 bits [5:4], when Short format 
Payload size. The defined values of this field are: 
0b11 Doubleword. 
This field reads as 0b11. 


Byte 1 bit [3], when Extended format, Byte 0 bit [3], when Short format 
This bit reads as Qb0. 


Byte 0 bits [7:5], when Extended format 
This field reads as 0b001. 


Byte 0 bits [4:2], when Extended format 


This field reads-as-zero. 


INDEX, byte 0 bits [1:0], byte 1 bits [2:0], when Extended format, INDEX, byte 0 bits [2:0], when Short 


format 
The defined values of this field are: 
0b00000 Issued instruction virtual address (PC). Included for all operations. 
0b00001 Branch target address: 

. It is IMPLEMENTATION DEFINED and might be UNPREDICTABLE whether this 
address is included for an Exception Return to an Exception level where profiling 
is disabled. 

° Included for all other branch and exception return instructions. 
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0b00010 
0b00011 


Qb0011x 
0b1xxxx 


Data access virtual address. Included for all load, store and atomic operations. 


Data access physical address: 


° It is IMPLEMENTATION DEFINED and might be UNPREDICTABLE whether this 
address included for accesses that generate Permission or Access Flag faults. 


e Not included for all other accesses that generate an abort, or if disabled by 


CollectPhysicalAddress. 
e Included for all other load, store and atomic operations. 
IMPLEMENTATION DEFINED address. 


IMPLEMENTATION DEFINED address. 


All other values are reserved. 


In the Short format header, bits [4:3] are zero. 


Address packet payload 


When Data access physical address, the Address packet payload bit assignments are: 





7 6 5 4 3 2 1 0 
ADDRI7:0] 


ADDR[15:8] 
_—_———_—_——_ SSS | 
ADDR[23:16 
| 
ADDR[31:24 
ay | 
ADDR[39:32 


ADDR[47:40 





ADDR[55:48 
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When Data access virtual address, the Address packet payload bit assignments are: 


7 6 5 4 3 2 1 0 
ADDRI7:0] Byte 0 


ADDR[15:8] Byte 1 


ADDR[23:16 Byte 2 


ADDRI31:24 Byte 3 


ADDRI39:32 Byte 4 


ADDRIA47:40 Byte 5 





ADDR[55:48 Byte 6 








Byte 7 
When Instruction virtual address, the Address packet payload bit assignments are: 
ADDRI7:0] Byte 0 
D a | 

ADDR([15:8] Byte 1 

i ie taammcstataas 
ADDR[23:16 Byte 2 

ees eee 
ADDR[31:24 Byte 3 

1, SSS 
ADDR[39:32 Byte 4 

O (SS) 
ADDR[47:40 Byte 5 

SE 


: : : : : ee 


TAG byte <7>, when Data access virtual address 





Top-byte tag. 


If the value of the applicable TBI bit is one, a data access virtual address includes the top-byte tag. 
If the applicable TBI bit is zero, it is IMPLEMENTATION DEFINED whether this field reads as zero or 
holds the address tag of the applicable address. 
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NS, byte 7 bit [7], when Instruction virtual address 


Non-secure state. The Security state associated with the address. For an issued instruction virtual 
address (PC) this is the Security state the instruction was executed in. For a branch target address, 
this is the Security state at the target of the branch. The defined values of this bit are: 


) Secure state. 
1 Non-secure state. 
Note 





For an Exception Return, the Security state at the target of the branch might be different to the 
Security state the instruction was executed in. 





NS, byte 7 bit [7], when Data access physical address 


Physical address space identifier. The Security attribute for the physical address. The defined values 
of this bit are: 


) Secure physical address space. 


1 Non-secure physical address space. 


CH, byte 7 bit[6], when Data access physical address 


When ARMv8.5-MemTag is implemented, Checked access identifier. Checked or Unchecked 
access. The defined values of this bit are: 


0 Unchecked access. 

1 Checked access. 

For more information see Chapter D6 Armv8.5 Memory Tagging Extension. 
If ARMv8.5-MemTag is not implemented this bit is RAZ. 


EL, byte 7 bits [6:5], when Instruction virtual address 


Exception level. The Exception level associated with the address. For an issued instruction virtual 
address (PC) this is the Exception level the instruction was executed in. For a branch target address, 
this is the Exception level at the target of the branch. The defined values of this field are: 


0b00 ELO. 
0b01 EL1. 
0b10 EL2. 
0b11 EL3. 
Note 





For an Exception Return, the Exception level at the target of the branch might be different to the 
Exception level the instruction was executed in. 





Byte 7 bits [5:4], when Data access physical address 
This field reads as 0b00. 


PAT, Byte 7 bits [3:0], when Data access physical address 


When ARMv8.5-MemTag is implemented, this field provides the Physical Address Tag for a 
Checked access. If the access is Unchecked this field reads as an IMPLEMENTATION DEFINED choice 
between 0b0000 and the Physical Address Tag used to perform the access. 


For more information see Chapter D6 Armv8.5 Memory Tagging Extension. 
If ARMv8.5-MemTag is not implemented this field is RAZ. 


Byte 7 bits [4:0], when Instruction virtual address 
This field reads as 0b00000. 


D10-2768 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Statistical Profiling Extension Sample Record Specification 
D10.2 Alphabetical list of Statistical Profiling Extension packets 


ADDR, bytes <6:0> 
Address. Bits [55:0] of the address. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D10-2769 
ID070919 Non-Confidential 


Statistical Profiling Extension Sample Record Specification 
D10.2 Alphabetical list of Statistical Profiling Extension packets 


D10.2.2 Context packet 
The Context packet characteristics are: 
Purpose Provides context information for the record. 


Attributes Multi-part packet comprising: 
° 8-bit header. 
° 32-bit payload. 


Context packet header 


The Context packet header bit assignments are: 


7 6 5 4 3 2 1 0 
SZ 
1 0 
Byte 0 bits [7:6] 


This field reads as 0b01. 


Byte 0 





SZ, byte 0 bits [5:4] 
Payload size. The defined values of this field are: 
0b10 Word. 
This field reads as 0b10. 
Byte 0 bits [3:2] 
This field reads as Qb01. 
INDEX, byte 0 bits [1:0] 
Identifies the context value. The defined values of this field are: 
0b00 CONTEXTIDR ELI. Included for all operations if enabled by CollectContextIDR1. 
QbO1 CONTEXTIDR_ EL2. Included for all operations if enabled by CollectContextIDR2. 


All other values are reserved. 


Context packet payload 


The Context packet payload bit assignments are: 


7 6 5 4 3 2 0 
CONTEXT[7:0] Byte 0 


CONTEXT[15:8] Byte 1 


CONTEXT[23:16] Byte 2 


CONTEXT[31:24] Byte 3 


CONTEXT, bytes <3:0> 





The context value. 
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Counter packet 


ARM DDI 0487E.a 


The Counter packet characteristics are: 


Purpose Count of cycles the operation spent performing all or part of its behavior. The counter value 
occupies the least significant bits of the payload. The remaining bits are set to zero. 


Attributes Multi-part packet comprising: 
° 8 or 16-bit header. 
. 16-bit payload. 


Counter packet header 


When Extended format, the Counter packet header bit assignments are: 


o o o | moma | mon 
A Ay ES ET 
1 0 1 INDEX(2:0] Byte 1 
0 1 
When Short format, the Counter packet header bit assignments are: 
7 6 5 4 3 2 1 0 
1 0 1 INDEX 
0 1 
Byte 1 bits [7:6], when Extended format, Byte 0 bits [7:6], when Short format 
This field reads as 0b10. 





Byte 0 





SZ, byte 1 bits [5:4], when Extended format, SZ, byte 0 bits [5:4], when Short format 
Payload size. The defined values of this field are: 
0b01 Halfword. 
This field reads as 0b01. 


Byte 1 bit [3], when Extended format, Byte 0 bit [3], when Short format 
This bit reads as 0b1. 


Byte 0 bits [7:5], when Extended format 
This field reads as 0b001. 


Byte 0 bits [4:2], when Extended format 

This field reads-as-zero. 
INDEX, byte 0 bits [1:0], byte 1 bits [2:0], when Extended format, INDEX, byte 0 bits [2:0], when Short 
format 

The defined values of this field are: 


0b00000 Total latency. Cycle count from the operation being dispatched for issue to the operation 
being complete. Included for all operations. 


0b00001 Issue latency. Cycle count from the operation being dispatched for issue to the operation 
being issued for execution. This counts any delay in waiting the operation being ready 
to issue. Included for all operations. 


0b00010 Translation latency. Cycle count from a virtual address being passed to the MMU for 
translation to the result of the translation being available. Included for all load, store and 
atomic operations. 


Qb0011x IMPLEMENTATION DEFINED counter value. 
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@b1xxxx IMPLEMENTATION DEFINED counter value. 
All other values are reserved. 

In the Short format header, bits [4:3] are zero. 
Dispatched for issue means: 

° The operation has been decoded. 


° The operation might not be ready to start execution because it is waiting for input values. The 
operation might be put into a queue. 


Issued for execution means the operation is ready to start executing: 


° For example, for a memory operation, this should be indicative of the cycle count from 
memory operation being dispatched for issue to access being initiated (virtual address). 


Complete means: 


° The operation has completed execution and is no longer capable of stalling any instruction 
that consumes its output. 


° It is IMPLEMENTATION DEFINED whether the operation has committed its results to the 
architectural state of the PE. 


° For example: 


— Foran arithmetic, floating-point, or SIMD operation with variable timing, such as 
divide, the results of the operation are available. 


— For load and atomic operations that return data, all data have been returned from 
memory. 


— For store and atomic operations that do not return data, it is not required that the store 
has reached its end point for it to be complete. 


— For branch operations, the branch has been resolved as taken or not taken. 
— For barrier operations, the barrier has completed. 


For WFE and WFI operations, it is IMPLEMENTATION DEFINED whether: 


° The instruction is complete before the PE enters a low-power state or when the PE wakes 
from the low-power state. 

° Counters count in the low power state. 

° Sampling an operation is itself a wake-up event. 


Counter packet payload 


The Counter packet payload bit assignments are: 


7 6 5 4 3 2 1 0 


COUNTI7:0] Byte 0 
A 
0 0 0 0 COUNT[11:8] Byte 1 


This field reads-as-zero. 





Byte 1 bits [7:4] 


COUNT, byte 1 bits [3:0], byte <0>, when a 12-bit counter is implemented 


The counter value occupies the least significant bits of the payload. The remaining bits are set to 
zero. The counters are: 


° Unsigned numbers. 
° 12 bits. 
° Saturating. 
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The value @xFFF indicates the count has saturated. 
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D10.2.4 Data Source packet 
The Data Source packet characteristics are: 


Purpose If the implementation includes support for indicating the loaded data source, the Data 
Source packet indicates where the data returned for a load operation was sourced. It might 
also include other information, such as the state of the data at the source. It is 
IMPLEMENTATION DEFINED and might be UNPREDICTABLE whether this is included for load 
and atomic operations that generate an external abort. It is IMPLEMENTATION DEFINED 
whether this is included for atomic operations that do not return data to a PE register. 
Included for all other load and atomic operations. 


Attributes Multi-part packet comprising: 
° 8-bit header. 
° 8 or 16-bit payload. 


Data Source packet header 


The Data Source packet header bit assignments are: 





Byte 0 bits [7:6] 
This field reads as 0b01. 
SZ, byte 0 bits [5:4] 
Payload size. The defined values of this field are: 
Oboe Byte. 
QbO1 Halfword. 
Byte 0 bits [3:0] 
This field reads as 0b0011. 


Data Source packet payload 


When SZ == 0b00, the Data Source packet payload bit assignments are: 


7 6 5 4 3 2 1 0 


Byte 0 





When SZ == 0b01, the Data Source packet payload bit assignments are: 


7 6 5 4 3 2 1 0 


SOURCE[7:0] Byte 0 


SOURCE[15:8] Byte 1 


SOURCE, byte <0>, when SZ == 0b00, SOURCE, bytes <1:0>, when SZ == 0b01 





Because the list of data sources varies from system to system, the definition of this field is 
IMPLEMENTATION DEFINED. If a sampled operation generated multiple data accesses, it is 
IMPLEMENTATION DEFINED how the data source information is combined. 
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D10.2.5 End packet 
The End packet characteristics are: 
Purpose Defines the end of a record if a Timestamp packet is not present. 


Attributes 8-bit packet. 


Field descriptions 


The End packet bit assignments are: 





Byte <0> 
This field reads as 0b00000001. 
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D10.2.6 Events packet 


The Events packet characteristics are: 


Purpose Indicates up to 64 events generated by the sampled operation. If ARMv8.1-PMU is 
implemented and an event counter is configured to count PMU events, then a sampled 
operation that causes the event counter to be incremented has the event recorded as one, and 
conversely a sampled operation that does not cause the counter to be incremented is 
recorded as zero. 


Note 


Arm recommends that the Performance Monitors Extension implements the Events. 








Attributes Multi-part packet comprising: 
š 8-bit header. 
° 8, 16, 32, or 64-bit payload. 


Events packet header 


The Events packet header bit assignments are: 





Byte 0 bits [7:6] 
This field reads as 0b01. 
SZ, byte 0 bits [5:4] 
Payload size. The defined values of this field are: 


0b00 Byte. 

0b01 Halfword. 
0b10 Word. 

0b11 Doubleword. 


Software must treat bits that are not output as zero. 


Byte 0 bits [3:0] 
This field reads as 0b0010. 


Events packet payload 


When SZ == 0b00, the Events packet payload bit assignments are: 





7 6 5 4 3 2 1 0 
E[6] E[5] E[4] E[3] E[2] E[1] Byte 0 
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When SZ == 0b01, the Events packet payload bit assignments are: 


Byte 0 


7 6 5 4 3 2 1 o 
ee e 
When SZ == 0b10, the Events packet payload bit assignments are: 

7 6 5 4 3 2 1 0 
Em] | E6] | Els) | EM j Els} | ER] | Eft) | EI 
—— E 

E[15:12] Em] | Eno | ER | ELS] 
EE 
E(t] | Em7) | Ene) | Byte2 








Byte 1 


Byte 0 





Byte 1 


E[31:24] Byte 3 


When SZ == 0b11, the Events packet payload bit assignments are: 


7 6 5 4 3 2 1 0 
elle [To Tol 
[a T=[=[=[= [~~ 
e OGG 
ee es sibel 


Byte 4 


Byte 0 


Byte 1 


Byte 5 


E [55:48] Byte 6 


E[63:56] Byte 7 


E[63:48], bytes <7:6>, when SZ == 0b11 


Events 63 to 48. IMPLEMENTATION DEFINED. 
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Bytes <5:4,2>, byte 1 bit [3], when SZ == 0b11 
This field reads-as-zero. 

E[31:24], byte <3>, when SZ == 0b10, or when SZ == 0b11 
Events 31 to 24. IMPLEMENTATION DEFINED. 

E[18], byte 2 bit [18], when SZ == 0b10, or SZ == 0b11 
Empty predicate. 


When The Scalable Vector Extension (SVE) and ARMv8.3-SPE are implemented the defined 
values of this bit are: 


Q Operation was not an SVE operation, was unpredicated or executed with all elements 
Active. 
1 SVE operation executed with all elements Inactive. 


Otherwise this bit reads-as-zero. 
If PMUv3 and The Scalable Vector Extension (SVE) are implemented this Event is required to be 
implemented consistently with SVE PRED EMPTY SPEC in the ARM Architecture Reference 
Manual Supplement, the Scalable Vector Extension, for v8-A. 

E[17], byte 2 bit [17], when SZ == 0b10, or SZ == 0b11 
Partial predicate. 


When The Scalable Vector Extension (SVE) and ARMv8.3-SPE are implemented the defined 
values of this bit are: 


Q Operation was not an SVE operation, was unpredicated, or executed with all elements 
Active. 
1 Predicated SVE operation executed with at least one Inactive element. 


Otherwise this bit reads-as-zero. 

If PMUv3 and The Scalable Vector Extension (SVE) are implemented this Event is required to be 

implemented consistently with SVE PRED EMPTY SPEC andSVE PRED PARTIAL SPEC in 

the ARM Architecture Reference Manual Supplement, the Scalable Vector Extension, for v8-A. 
E[15:12], byte 1 bits [7:4], when SZ == 0b01, when SZ == 0b10, or when SZ == 0b11 

Events 15 to 12. IMPLEMENTATION DEFINED. 


E[11], byte 1, bit [11], when SZ == 0b10, or SZ == 0b11 
Alignment. 
When ARMv8.3-SPE is implemented the defined values of this bit are: 
0 Load/store operation that was optimally aligned for the size of data being accessed. 


1 Load/store operation that, due to the alignment of the address and size of data being 
accessed, incurred additional latency. 


Otherwise this bit reads-as-zero. 
If PMUv3 is implemented this Event is required to be implemented consistently with 
LDST_ALIGN_ LAT. 

Byte 1 bit [3], when SZ == 0b01 


This bit reads-as-zero. 


E[10], byte 1 bit [2], when SZ == 0b01, when SZ == 0b10, or when SZ == 0b11 
Remote access. The defined values of this bit are: 
0 Did not cause access to another socket. 


1 Load/store operation caused an access to another socket in a multi-socket system. This 
includes each data memory access that accesses another socket in a multi-socket system, 
including those that do not return data. 
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If PMUv3 is implemented this Event is required to be implemented consistently with 
REMOTE ACCESS. 


E[9], byte 1 bit [1], when SZ == 0b01, when SZ == 0b10, or when SZ == 0b11 


Last Level cache miss. The defined values of this bit are: 


Q Did not miss Last Level cache. 

1 Load/store operation caused an access to at least the Last Level cache but is not 
completed by the Last Level cache. That is, each: 
s Load operation that does not return data from the Last Level cache. 
3 Store operation that does not update the Last Level cache. 


The event is not set for operations that are completed by a cache above the Last Level 
cache. 


If PMUv3 is implemented this Event is required to be implemented consistently with 
LL_CACHE MISS. 


E[8], byte 1 bit [0], when SZ == 0b01, when SZ == 0b10, or when SZ == 0b11 


Last Level cache access. The defined values of this bit are: 


Q Did not access Last Level data or unified cache. 
1 Load/store operation caused a cache access to at least the Last Level data or unified 
cache. 
Note 





The architecture does not define the Last Level cache. The Last Level cache is typically the largest 
cache on this device shared by all PEs in the inner or outer Shareable domain of this PE. Ina 
multi-socket system, it is IMPLEMENTATION DEFINED whether this includes caches on other sockets. 





If PMUv3 is implemented this Event is required to be implemented consistently with LL_CACHE. 


E[7], byte 0 bit [7] 
Mispredicted. The defined values of this bit are: 
Q Did not cause correction to the predicted program flow. 
1 A branch that caused a correction to the predicted program flow. 
If PMUv3 is implemented this Event is required to be implemented consistently with either 
BR_MIS PRED or BR MIS PRED RETIRED. 
E[6], byte 0 bit [6] 
Not taken. The defined values of this bit are: 
() Did not fail condition code check. 


1 A conditional instruction that failed its condition code check. This includes conditional 
branches, compare-and-branch, conditional select, and conditional compares: 


s For a conditional branch or compare-and-branch instruction, this means the 
branch was not taken. 


s For a conditional select, this means the second operand was written to the result. 


. For a condition compare, this means the condition flags were set to the immediate 
value and not the result of the compare. 


Note 


This Event includes branches, selects, CCMP (register), and CCMP (immediate). 








E[5], byte 0 bit [5] 
TLB walk. The defined values of this bit are: 
Q Did not generate TLB walk. 
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1 Load/store operation that causes a refill of a data or unified TLB, involving at least one 
translation table walk access. This includes each complete or partial translation table 
walk that causes an access to memory, including to data or translation table walk caches. 


If PMUv3 is implemented this Event is required to be implemented consistently with 
DTLB_WALK. 
E[4], byte 0 bit [4] 
TLB access. The defined values of this bit are: 
() Did not access TLB. 
1 Load/store operation caused an access to at least the first level of data or unified TLB. 


If PMUVv3 is implemented this Event is required to be implemented consistently with LID_TLB. 


E[3], byte 0 bit [3] 
Level 1 Data cache refill. The defined values of this bit are: 
0 Did not cause level 1 data cache refill. 


1 Load/store operation caused a refill of at least the first level of data or unified cache. 
This includes each data memory access that causes a refill from outside the cache. It 
excludes accesses that do not cause a new cache refill but are satisfied from refilling data 
of a previous miss. 


If PMUv3 is implemented this Event is required to be implemented consistently with 
L1D_CACHE_ REFILL. 


E[2], byte 0 bit [2] 


Level 1 Data cache access. The defined values of this bit are: 


0 Did not access level 1 data cache. 
1 Load/store operation caused a cache access to at least the first level of data or unified 
cache. 


IfPMUv3 is implemented this Event is required to be implemented consistently with LID_CACHE. 


E[1], byte 0 bit [1] 
Architecturally retired. The defined values of this bit are: 


0 Did not retire. 

l Committed its results to the architectural state of the PE, or completed with a 
synchronous architectural exception. 
— Note 


A conditional instruction can retire even if it fails its condition code check. 





If PMUv3 is implemented this Event is required to be implemented consistently with 
INST_RETIRED. 
E[0], byte 0 bit [0] 
Generated exception. The defined values of this bit are: 
0 Did not generate an exception. 
1 Completed with a synchronous exception. 


If E[1] in the same Events packet is set to 0, then the meaning of this bit is IMPLEMENTATION 


DEFINED. 
If PMUv3 is implemented this Event is required to be implemented consistently with 
EXC_TAKEN. 
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D10.2.7 Operation Type packet 
The Operation Type packet characteristics are: 
Purpose Defines the type of operation sampled. Included for all operations. 


Attributes Multi-part packet comprising: 
° 8-bit header. 
° 8-bit payload. 


Operation Type packet header 


The Operation Type packet header bit assignments are: 


7 6 5 4 3 2 1 0 
SZ 
0 0 
Byte 0 bits [7:6] 


This field reads as 0b01. 


Byte 0 





SZ, byte 0 bits [5:4] 
Payload size. The defined values of this field are: 
0b00 Byte. 
This field reads as 0b00. 
Byte 0 bits [3:2] 
This field reads as 0b10. 
CLASS, byte 0 bits [1:0] 


Top-level instruction class. The defined values of this field are: 


0b00 Other. 
b01 Load, store, or atomic. 
0b10 Branch or exception return. 


All other values are reserved. 


Operation Type packet payload (Other) 


When Other operation, the Operation Type packet payload (Other) bit assignments are: 








| 
SUBCLASS 
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When an SVE operation, the Operation Type packet payload (Other) bit assignments are: 


T 6 5 4 3 2 1 0 
L i J 
SUBCLASS 


Byte 0 








SUBCLASS, byte<0> 
Second-level instruction class. Defines the type of instruction. The defined values of this field are: 
0b0000000x Other operation. 


QbOxxx1xx@ SVE operation. If SVE is implemented, and if ARMV8.3-SPE is implemented, bits 
[6:4:2:1] are further defined as the EVL, PRED, and FP fields. 


Otherwise this value is reserved. 


EVL, byte 0 bits [6:4], when SVE operation 


Effective Vector Length. Defines the sampled operation vector length, rounded up to a power of two. 
That is, the length of vector operated on by the sampled operation. The defined values of this field 
are: 


0b000 32 bits. 

0b001 64 bits. 

0b010 128 bits. 
0b011 256 bits. 
0b100 512 bits. 
0b101 1024 bits. 
0b110 2048 bits. 

All other values reserved. 


The accessible vector length is always quantized into multiples of 128 bits. However, the effective 
vector length can be any size down to the smallest element size. 


If the effective vector length is not a power of two, or is less than 32 bits, the value is rounded up 
before it is encoded in this field. 


PRED, byte 0 bit[2], when SVE operation 
Predicated SVE operation. The defined values of this bit are: 


Q Not predicated. 

1 Predicated SVE operation. The operation is an SVE operation that writes to a vector 
destination register under a Governing predicate using either zeroing or merging 
predication. 


FP, byte 0 bits [6:4], when SVE operation 
Floating-point operation. The defined values of this bit are: 
0 Integer. 
1 Floating-point. 


COND, byte 0 bit [0], when Other operation 


Conditional. The defined values of this bit are: 


0 Unconditional operation. 
1 Conditional operation or select. 
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Operation Type packet payload (Branch) 


The Operation Type packet payload (Branch) bit assignments are: 





SUBCLASS 


SUBCLASS, byte <0> 
Second-level instruction class. Describes the branch type. The defined values of this field are: 
0b0000000x Direct branch. 
0b0000001x Indirect branch. 
All other values are reserved. 
COND, byte 0 bit [0] 
Conditional. The defined values of this bit are: 


1) Unconditional branch. 


1 Conditional branch. 


Operation Type packet payload (Load/store) 


When the ARMv8.4-NV transformed System register access, the Operation Type packet payload (Load/store) bit 
assignments are: 





SUBCLASS 


When Extended load/store, the Operation Type packet payload (Load/store) bit assignments are: 


7 6 5 4 3 2 1 0 
L J 


| 
SUBCLASS 


Byte 0 








When General-purpose load/store, the Operation Type packet payload (Load/store) bit assignments are: 








SUBCLASS 


When SIMD&FP load/store, the Operation Type packet payload (Load/store) bit assignments are: 








SUBCLASS 
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When SVE load/store, the Operation Type packet payload (Load/store) bit assignments are: 


T 6 5 4 3 2 1 0 
L i J 
SUBCLASS 


Byte 0 








When Unspecified load/store the Operation type packet payload (Load/store) bit assignments are: 








SUBCLASS 


SUBCLASS, byte <0> 
Second-level instruction class. Indicates the load/store type. The defined values of this field are: 


0b0000000x A load/store targeting the general-purpose registers, other than an atomic operation, 
load-acquire, store-release or exclusive. 


0b000xxx1x An atomic operation, load-acquire, store-release or exclusive. Bits [4:2] are further 
subdivided as described by the AR, EXCL and AT fields. 


0b0000010x A load/store targeting the SIMD&FP registers. 


Obxxxx1x0x A load/store targeting the SVE registers. Bits [7:4,2] are further defined as SG, EVL and 
PRED fields. 


This value is defined only if both The Scalable Vector Extension (SVE) and 
ARMv8.3-SPE are implemented. 


This value is reserved otherwise. 


0b0001000x A load/store targeting unspecified registers. 
This value is defined only if ARMv8.3-SPE is implemented 
This value is reserved otherwise. 


0b0011000x An MRS or MSR operation at EL1 transformed to a load/store when HCR_EL2.NV2 is 1. 
This value is defined only if ARMv8.4-NV is implemented and reserved otherwise. 


All other values are reserved. 


SG, byte 0 bit [7], when SVE load/store 
Gather/scatter load/store. The defined values of this bit are: 
Q Not gather load or scatter store. 


1 Gather load or scatter store. 


EVL, byte 0 bits [6:4], when SVE load/store 


Effective Vector Length. Defines the sampled operation vector length, rounded up to a power of two. 
That is, the length of vector operated on by the sampled operation. The defined values of this field 
are: 


0b000 32 bits. 
0b001 64 bits. 
0b010 128 bits. 
0b011 256 bits. 
0b100 512 bits. 
0b101 1024 bits. 
0b110 2048 bits. 


All other values reserved. 
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The accessible vector length is always quantized into multiples of 128 bits. However, the effective 
vector length can be any size down to the smallest element size. 


If the effective vector length is not a power of two, or is less than 32 bits, the value is rounded up 
before it is encoded in this field. 


AR, byte 0 bit [4], when Extended load/store 
Acquire/Release. The defined values of this bit are: 
0 Load/store/atomic without Acquire or Release semantics. 


1 Load/store/atomic with Acquire or Release semantics. 


EXCL, byte 0 bit [3], when Extended load/store 
Exclusive. The defined values of this bit are: 
) Load/store/atomic without Exclusive. 
1 Load/store with Exclusive. 
This bit is RESO if AT == 1. 


PRED, byte 0 bit[2], when SVE load/store 
Predicated SVE operation. The defined values of this bit are: 


0 Not predicated. 

1 Predicated SVE operation. The operation is an SVE operation that writes to a vector 
destination register under a Governing predicate using either zeroing or merging 
predication. 


AT, byte 0 bit [2], when Extended load/store 
Atomic load/store. The defined values of this bit are: 
0 Not atomic. 
1 Atomic. 

LDST, byte 0 bit [0] 


Store not load. The defined values of this bit are: 


(] Load or swap. 
1 Store. 
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D10.2.8 Padding 
The Padding characteristics are: 
Purpose Allows the PE to create alignment in the protocol buffer. 


Attributes 8-bit packet. 


Field descriptions 


The Padding bit assignments are: 





Byte <0> 
This field reads as 0b00000000. 
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D10.2.9 Timestamp packet 
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The Timestamp packet characteristics are: 


Purpose The 64-bit timestamp value when the operation was sampled. The Timestamp packet must 
come at the end of the record. If the Timestamp packet is not present, an End packet must 
come at the end of the record. 


Attributes Multi-part packet comprising: 
š 8-bit header. 
° 64-bit payload. 


Timestamp packet header 


The Timestamp packet header bit assignments are: 





Byte 0 bits [7:6] 
This field reads as 0b01. 
SZ, byte 0 bits [5:4] 
Payload size. The defined values of this field are: 
Qb11 Doubleword. 
This field reads as 0b11. 
Byte 0 bits [3:0] 
This field reads as 0b0001. 
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Timestamp packet payload 


The Timestamp packet payload bit assignments are: 


7 6 5 4 3 2 1 0 
TS[7:0] 


TS[15:8] 
TS[23:16] 
TS[31:24] 
TS[39:32] 
TS[47:40] 


TS[55:48] 


TS[63:56] 


TS, bytes <7:0> 





Byte 0 


Byte 1 


Byte 2 


Byte 3 


Byte 4 


Byte 5 


Byte 6 


Byte 7 


Timestamp value when the operation was sampled. The value depends on the result of 


aarch64/debug/statisticalprofiling/CollectRecord(): 


. If TimeStamp_ Virtual, this is the virtual timestamp, CNTVCT_ELO. 
: If TimeStamp_Physical, this is the physical timestamp, CNTPCT_ELO. 


` If TimeStamp_None, the timestamp packet is not included and an End packet must come at 


the end of the record. 


However, if the Generic Timer System counter is disabled and 


aarch64/debug/statisticalprofiling/CollectTimeStamp()() returns a value other than 


TimeStamp_None, then it is IMPLEMENTATION DEFINED whether: 


° The Statistical Profiling Extension behaves as if 


aarch64/debug/statisticalprofiling/CollectTimeStamp() returns the value 


TimeStamp_None. 


° The value of this field in the record is UNKNOWN. 


Note 





This relaxation refers to when the actual System counter is disabled, that is, CNTEN.EN == 0. It 
does not apply when the System counter is enabled but not accessible at the current Exception level. 
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Chapter D11 
The Generic Timer in AArch64 state 


This chapter describes the implementation of the Arm Generic Timer. It includes an overview of the AArch64 
System register interface to an Arm Generic Timer. 


It contains the following sections: 
. About the Generic Timer on page D11-2790. 
. The AArch64 view of the Generic Timer on page D11-2794. 


Chapter G6 The Generic Timer in AArch32 state describes the AArch32 view of the Generic Timer, and Chapter 12 
System Level Implementation of the Generic Timer describes the system level implementation of the Generic Timer. 
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About the Generic Timer 


Figure D11-1 shows an example system-on-chip that uses the Generic Timer as a system timer. In this figure: 
























































° This manual defines the architecture of the individual PEs in the multiprocessor blocks. 

è The ARM Generic Interrupt Controller Architecture Specification defines a possible architecture for the 
interrupt controllers. 

è Generic Timer functionality is distributed across multiple components. 
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Figure D11-1 Generic Timer example 
The Generic Timer: 


$ Provides a system counter, that measures the passing of time in real-time. 


Note 


The Generic Timer can also provide other components at a system level, but Figure D11-1 does not show any 
such components. 








$ Supports virtual counters that measure the passing of virtual-time. That is, a virtual counter can measure the 
passing of time on a particular virtual machine. 


s Timers, that can trigger events after a period of time has passed. The timers: 
— Can be used as count-up or as count-down timers. 


— Can operate in real-time or in virtual-time. 


This chapter describes an instance of the Generic Timer component that Figure D11-1 shows as Timer_0 or Timer _1 
within the Multiprocessor A or Multiprocessor B block. This component can be accessed from AArch64 state or 
AArch32 state, and this chapter describes access from AArch64 state. Chapter G6 The Generic Timer in AArch32 
state describes access to this component from AArch32 state. 


A Generic Timer implementation must also include a memory-mapped system component. This component: 
à Must provide the System counter shown in Figure D11-1 


e Optionally, can provide timer components for use at a system level. 


Chapter 12 System Level Implementation of the Generic Timer describes this memory-mapped component. 
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D11.1.1 The full set of Generic Timer components 
Within a system that might include multiple PEs, a full set of Generic Timer components is as follows: 


The system counter 


This provides a uniform view of system time, see The system counter on page D11-2792. Because 
this must be implemented at the system level, it is accessed through The system level 
memory-mapped implementation of the Generic Timer. However, during initialization, a status 
register in each implemented timer in the system must be programmed with the frequency of the 
system counter, so that software can read this frequency. 


PE implementations of the Generic Timer 
Each PE implementation of the Generic Timer provides the following components: 
° A physical counter, that gives access to the count value of the system counter. 


: A virtual counter, that gives access to virtual time. In AArch64 state, the CNTVOFF_EL2 
register defines the offset between physical time, as defined by the value of the system 
counter, and virtual time. 


s A number of timers. In an implementation where all Exception levels are implemented and 
can use AArch64 state, the timers that are accessible from AArch64 state are: 
— An Ell physical timer. 
— A Non-secure EL2 physical timer. 
— An EL3 physical timer. 
— An Ell virtual timer. 
— A Non-secure EL2 virtual timer. 
— A Secure EL2 virtual timer. 
— A Secure EL2 physical timer. 
The Non-secure EL2 virtual timer is available only when ARMv8.1-VHE is implemented. 
The Secure EL2 timers are available only when ARMv8.4-SecEL2 is implemented. 


The AArch64 view of the Generic Timer on page D11-2794 describes these components. 


The system level memory-mapped implementation of the Generic Timer 


The memory-mapped registers that control the components of the system level implementation of 
the Generic Timer are grouped into frames. The Generic Timer architecture defines the offset of 
each register within its frame, but the base address of each frame is IMPLEMENTATION DEFINED, and 
defined by the system. 


Each system level component has one or two register frames. The possible system level components 
are: 
The memory-mapped counter module, required 

This module controls the system counter. It has two frames: 

. A control frame, CNTControlBase. 

° A status frame, CNTReadBase. 


The memory-mapped timer control module, required 


The system level implementation of the Generic Timer can provide up to eight timers, 
and the memory-mapped timer control module identifies: 


. Which timers are implemented. 
s The features of each implemented timer. 
This module has a single frame, CNTCTLBase. 


Memory-mapped timers, optional 
An implemented memory-mapped timer: 
. Must provide a privileged view of the timer, in the CNTBaseN frame. 


° Optionally. provides an unprivileged view of the timer in the CNTELOBaseN 
frame. 


N is the timer number, and the corresponding frame number, in the range 0-7. 
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Chapter 12 System Level Implementation of the Generic Timer describes these components. 


The system counter 


The Generic Timer provides a system counter with the following specification: 
Width At least 56 bits wide. 

The value returned by any 64-bit read of the counter is zero-extended to 64 bits. 
Frequency Increments at a fixed frequency, typically in the range 1-50MHz. 


Can support one or more alternative operating modes in which it increments by larger amounts at a 
lower frequency, typically for power-saving. 


Roll-over Roll-over time of not less than 40 years. 


Accuracy Arm does not specify a required accuracy, but recommends that the counter does not gain or lose 
more than ten seconds in a 24-hour period. 


Use of lower-frequency modes must not affect the implemented accuracy. 
Start-up Starts operating from zero. 


The system counter, once configured and running, must provide a uniform view of system time. More precisely, it 
must be impossible for the following sequence of events to show system time going backwards: 


l. Device A reads the time from the system counter. 
2, Device A communicates with another agent in the system, Device B. 
3. After recognizing the communication from Device A, Device B reads the time from the system counter. 


The system counter must be implemented in an always-on power domain. 


To support lower-power operating modes, the counter can increment by larger amounts at a lower frequency. For 
example, a 1OMHz system counter might either increment: 


e By 1 at 1OMHz. 
è By 500 at 20kHz, when the system lowers the clock frequency, to reduce power consumption. 


In this case, the counter must support transitions between high-frequency, high-precision operation, and 
lower-frequency, lower-precision operation, without any impact on the required accuracy of the counter. 


The CNTFRQ ELO register is intended to hold a copy of the current clock frequency to allow fast reference to this 
frequency by software running on the PE. For more information, see Initializing and reading the system counter 


frequency. 


The mechanism by which the count from the system counter is distributed to system components is 
IMPLEMENTATION DEFINED, but each PE with a System register interface to the system counter must have a counter 
input that can capture each increment of the counter. 


Note 


So that the system counter can be clocked independently from the PE hardware, the count value might be distributed 
using a Gray code sequence. Gray-count scheme for timer distribution scheme on page K5-7688 gives more 
information about this possibility. 








Initializing and reading the system counter frequency 


The CNTFRQ ELO register must be programmed to the clock frequency of the system counter. Typically, this is 
done only during the system boot process, by using the System register interface to write the system counter 
frequency to the CNTFRQ_ ELO register. Only software executing at the highest implemented Exception level can 
write to CNTFRQ ELO. 


Note 


The CNTFRQ ELO register is UNKNOWN at reset, and therefore the counter frequency must be set as part of the 
system boot process. 
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Software can read the CNTFRQ_ELO register, to determine the current system counter frequency, in the following 
states: 


. Secure and Non-secure EL2. 
° Secure and Non-secure EL1. 
è When CNTKCTL_EL1.ELOPCTEN is set to 1, Secure and Non-secure ELO. 


Memory-mapped controls of the system counter 


Some system counter controls are accessible only through the memory-mapped interface to the system counter. 
These controls are: 


. Enabling and disabling the counter. 

° Setting the counter value. 

: Changing the operating mode, to change the update frequency and increment value. 
° Enabling Halt-on-debug, that a debugger can then use to suspend counting. 


For descriptions of these controls, see Chapter 12 System Level Implementation of the Generic Timer. 
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The AArch64 view of the Generic Timer 


The following sections describe the components and features of a PE implementation of the Generic Timer, as seen 
from AArch6é4 state: 


. The physical counter. 

° The virtual counter. 

° Event streams on page D11-2795. 
E Timers on page D11-2796. 


The physical counter 


The PE includes a physical counter that contains the count value of the system counter. The CNTPCT_ELO register 
holds the current physical counter value. 


Reads of CNTPCT_ELO can occur speculatively and out of order relative to other instructions executed on the same 
PE. 


For example, if a read from memory is used to obtain a signal from another agent that indicates that CNTPCT_ELO 
must be read, an ISB is used to ensure that the read of CNTPCT_ELO occurs after the signal has been read from 
memory, as shown in the following code sequence: 


loop ; polling for some communication to indicate a requirement to read the timer 
LDR R1, [R2] 
CMP R1, #1 
BNE loop 
ISB ; without this, the CNTPCT could be read before the memory location in [R2] 


; has had the value 1 written to it 
MRS R1, CNTPCT 


The virtual counter 


An implementation of the Generic Timer always includes a virtual counter, that indicates virtual time. 


The virtual counter contains the value of the physical counter minus a 64-bit virtual offset. When executing at EL1 
or ELO, the virtual offset value relates to the current virtual machine. 


The CNTVOFF_EL2 register contains the virtual offset. CNTVOFF_EL2 is only accessible from EL2 and EL3. 
For more information, see Status of the CNTVOFF register. 
The CNTVCT_ELO register holds the current virtual counter value. 


Reads of CNTVCT_ELO can occur speculatively and out of order relative to other instructions executed on the same 
PE. 


For example, if a read from memory is used to obtain a signal from another agent that indicates that CNTVCT_ELO 
must be read, an ISB is used to ensure that the read of CNTVCT_ELO occurs after the signal has been read from 
memory, as shown in the following code sequence: 


loop ; polling for some communication to indicate a requirement to read the timer 
LDR R1, [R2] 
CMP R1, #1 
BNE loop 
ISB ; without this, the CNTVCT could be read before the memory location in [R2] 


; has had the value 1 written to it 
MRS R1, CNTVCT 


Status of the CNTVOFF register 


All implementations of the Generic Timer include the virtual counter. Therefore, conceptually, all implementations 
include the CNTVOFF_EL2 register that defines the virtual offset between the physical count and the virtual count. 
CNTVOFF _EL2 is only accessible at EL2 or above. If EL2 is not implemented in Secure state and is not 
implemented in Non-secure state, the virtual counter uses a fixed virtual offset of zero. 
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An implementation that includes the Generic Timer can use the system counter to generate one or more event 
streams, to generate periodic wake-up events as part of the mechanism described in Wait for Event mechanism and 
Send event on page D1-2372. 





Note 
An event stream might be used: 
° To impose a time-out on a Wait For Event polling loop. 
7 To safeguard against any programming error that means an expected event is not generated. 





An event stream is configured by: 


è Selecting which bit, from the bottom 16 bits of a counter, triggers the event. This determines the frequency 
of the events in the stream. 


e Selecting whether the event is generated on each 0 to 1 transition, or each 1 to 0 transition, of the selected 
counter bit. 


The CNTKCTL_EL1.{EVNTEN, EVNTDIR, EVNTI} fields define an event stream that is generated from the 
virtual counter. 


In all implementations, the CNTHCTL_EL2.{EVNTEN, EVNTDIR, EVNTI]} fields define an event stream that is 
generated from the physical counter. 


The operation of an event stream is as follows: 


s The pseudocode variables PreviousCNTVCT and PreviousCNTPCT are initialized as: 


// Variables used for generation of the timer event stream. 
bits(64) PreviousCNTVCT = bits(64) UNKNOWN; 
bits(64) PreviousCNTPCT = bits(64) UNKNOWN; 


è The pseudocode functions TestEventCNTV() and TestEventCNTP() are called on each cycle of the PE clock. 


. The TestEventCNTx() pseudocode template defines the functions TestEventCNTV() and TestEventCNTP(): 


// TestEventCNTx() 


// Template for the TestEventCNTV() and TestEventCNTP() functions 

// Describes operation when all Exception Levels are using AArché4: 

//  CNTxCT_ELO is CNTVCT_ELO or CNTPCT_ELO 64-bit count value 
// — CNTx_CTL_ELO is CNTV_CTL_ELO or CNTP_CTL_ELO Control register 
//  PreviousCNTxCT_EL@ is PreviousCNTVCT_ELQ@ or PreviousCNTPCT_ELQ 


TestEventCNTx() 
if CNTx_CTL_EL@.EVNTEN == '1' then 
n = UInt(CNTx_CTL_EL@. EVNTI) ; 
SampleBit = CNTxCT_ELQ<n>; 
PreviousBit = PreviousCNTxCT_ELO<n>; 


if CNTx_CTL_EL@.EVNTDIR == 'Q' then 
if PreviousBit == '0' && SampleBit == '1' then EventRegisterSet(); 
else 
if PreviousBit == '1' && SampleBit == 'Q' then EventRegisterSet(); 
PreviousCNTxCT_EL@ = CNTxCT_ELO; 


return; 
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Timers 


In an implementation of the Generic Timer that includes EL3, if EL3 can use AArch64, the following timers are 
implemented: 


An EL1 physical timer, that: 

— In Secure state, can be accessed from EL1. 

— In Non-secure state, can be accessed from EL1 unless those accesses are trapped to EL2. 

When this timer can be accessed from EL1, an EL1 control determines whether it can be accessed from ELO. 
A Non-secure EL2 physical timer. 

A Secure EL3 physical timer. An EL3 control determines whether this register is accessible from Secure EL1. 
An EL] virtual timer. 

A Non-secure EL2 virtual timer, when ARMv8.1-VHE is implemented. 

A Secure EL2 physical timer, when ARMv8.4-SecEL2 is implemented, that can only be accessed in Secure 
EL2 and EL3. 

A Secure EL2 Virtual timer, when ARMv8.4-SecEL2 is implemented, that can only be accessed in Secure 
EL2 and EL3. 


The output of each implemented timer: 


Provides an output signal to the system. 


If the PE interfaces to a Generic Interrupt Controller (GIC), signals a Private Peripheral Interrupt (PPI) to 
that GIC. In a multiprocessor implementation, each PE must use the same interrupt number for each timer. 


Each timer: 


Is based around a 64-bit Compare Value that provides a 64-bit unsigned upcounter. 


Provides an alternative view of the CompareValue, called the TimerValue, that appears to operate as a 32-bit 
downcounter. 


Has, in addition, a 32-bit Control register. 


Table D11-1 Physical Timer registers summary for the Generic Timer 








Timer@ EL1 EL2 Secure EL2 EL3 Physical 
Register Physical Timer Physical Timer Physical Timer? Timer 
CV CNTP_CVAL ELO CNTHP_CVAL EL2 CNTHPS CVAL EL2 CNTPS CVAL ELI 





TV 


CNTP_TVAL ELO CNTHP TVAL ELZ CNTHPS TVAL ELZ CNTPS TVAL ELI 





Control CNTP CTL ELO  CNTHP CTL EL2 CNTHPS CTL EL2 CNTPS_ CTL ELI 





a. In this column, CV indicates the CompareValue register, and TV indicates the TimerValue register. 


b. Only present when the implementation includes ARMv8.4-SecEL2. 


Table D11-2 Virtual Timer register summary for the Generic Timer 














Timer@ EL1 EL2 Secure EL2 
Register Virtual Timer Virtual Timer? Virtual Timer¢ 

CV CNTV_CVAL_ELO CNTHV_CVAL EL2 CNTHVS_CVAL EL2 
TV CNTV_TVAL ELO  CNTHV_TVAL _EL2 CNTHVS_TVAL EL2 
Control CNTV_CTL_ELO CNTHV_CTL_EL2 CNTHVS_ CTL _EL2 





a. In this column, CV indicates the CompareValue register, and TV indicates the TimerValue register. 
b. Only when the implementation includes ARMv8.1-VHE. 
c. Only present when the implementation includes ARMv8.4-SecEL2. 
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D11.2 The AArch64 view of the Generic Timer 


Operation of the CompareValue views of the timers 


The CompareValue view of a timer operates as a 64-bit upcounter. The timer condition is met when the appropriate 
counter reaches the value programmed into its Compare Value register. When the timer condition is met, an interrupt 
is generated if the interrupt is not masked in the corresponding timer control register, CNTP_CTL_ELO, 
CNTHP_CTL_EL2, CNTHPS CTL_EL2, CNTPS_CTL_EL1, CNTV_CTL_ELO, or CNTHVS_CTL_EL2. For 
CNTP_CTL_ELO, the asserted interrupt is the same as the interrupt asserted by the Non-secure instance of the 
AArch32 register CNTP_CTL. 


The operation of this view of a timer is: 


TimerConditionMet = (((Counter[63:0] - Offset[63:0]) [63:0] - CompareValue[63:0]) >= Q) 


Where: 
TimerConditionMet Is TRUE if the timer condition for this counter is met, and FALSE otherwise. 
Counter The physical counter value, that can be read from the CNTPCT_ELO register. 
Offset For a physical timer, this value is zero. 
For the EL1 virtual timer, this value is held in the CNTVOFF EL? register. 
For the Non-secure EL2 and Secure EL2 virtual timer, this value is zero. 
CompareValue The value of the appropriate Compare Value register, CNTP_CVAL _ELO, 


CNTHP_CVAL_EL2, CNTPS_CVAL_EL1, CNTV_CVAL_ELO, or 
CNTHV_CVAL_EL2. 


In this view of a timer, Counter, Offset, and CompareValue are all 64-bit unsigned values. 


Note 


This means that a timer with a CompareValue of, or close to, @xFFFF_FFFF_FFFF_FFFF might never meet its timer 
condition. However, there is no practical requirement to use values close to the counter wrap value. 





Software can observe the counter value by the offset in some situations by reading CNTVCT_ELO. For more 
information see CNTVCT_ELO. 


Operation of the TimerValue views of the timers 


The TimerValue view of a timer appears to operate as a signed 32-bit downcounter. A TimerValue register is 
programmed with a count value. This value decrements on each increment of the appropriate counter, and the timer 
condition is met when the value reaches zero. When the timer condition is met, an interrupt is generated if the 
interrupt is not masked in the corresponding timer control register, CNTP_CTL_ELO, CNTHP_CTL_EL2, 
CNTHPS_CTL_EL2, CNTPS_CTL_EL1, or CNTV_CTL_ELO, CNTHVS_CTL_EL2. 


This view of a timer depends on the following behavior of accesses to TimerValue registers: 
Reads TimerValue = (CompareValue - (Counter - Offset) ) [31:0] 
Writes CompareValue = ((Counter - Offset) [63:0] + SignExtend(TimerValue) ) [63:0] 


Where the arguments other than TimerValue have the definitions used in Operation of the CompareValue views of 
the timers, and in addition: 


TimerValue The value of a TimerValue register, CNTP_TVAL EL0, CNTHP_TVAL_EL2, 
CNTHPS_TVAL EL2, CNTPS_TVAL EL1, CNTV_TVAL EL0, or CNTHV_TVAL EL2, 
CNTHVS_TVAL EL2. 


In this view of a timer, values are signed in standard two’s complement form. 


A read of a TimerValue register after the timer condition has been met indicates the time since the timer condition 
was met. 
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D11.2 The AArch64 view of the Generic Timer 





Note 


$ Operation of the CompareValue views of the timers on page D11-2797 gives a strict definition of 
TimerConditionMet. However, provided that the TimerValue is not expected to wrap as a 32-bit signed value 
when decremented from 0x80000000, the TimerValue view can be used as giving an effect equivalent to: 


TimerConditionMet = (TimerValue < Q) 
- Programming TimerValue to a negative number with magnitude greater than (Counter—Offset) can lead to 


an arithmetic overflow that causes the Compare Value to be an extremely large positive value. This potentially 
delays meeting the timer condition for an extremely long period of time. 
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Chapter D12 
AArch64 System Register Encoding 


This chapter describes the AArch64 System register encoding space. It contains the following sections: 

The System register encoding space on page D12-2800. 

. op0==0b10, Moves to and from debug and trace System registers on page D12-2801. 

. op0==0b11, Moves to and from non-debug System registers, Special-purpose registers on page D12-2803. 
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D12.1 


D12-2800 


The System register encoding space 


The A64 instruction set includes instructions that access the System register encoding space. These instructions 
provide: 


° Access to System registers, including the debug registers, that provide system control, and system status 
information. 


° Access to Special-purpose registers such as SPSR_ELx, ELR_ELx, and the equivalent fields of the Process 


State. 
e The cache and TLB maintenance instructions and address translation instructions. 
° Barriers and the CLREX instruction. 
° Architectural hint instructions. 


This section describes the parts of the System register encoding space that provides access to the System registers 
described in Chapter D13 AArch64 System Register Descriptions. 


Note 


: See Fixed values in AArch64 instruction and System register descriptions on page C2-185 for information 
about abbreviations used in the System instruction descriptions. 





s In AArch32 state much of this functionality is provided through the System register interface described in 
The AArch32 System register interface on page G1-5567. In AArch64 state, the parameters used to 
characterize the System register encoding space are {opQ, op1, CRn, CRm, op2}. These are based on the 
parameters that characterize the AArch32 System register encoding space, which reflect the original 
implementation of these registers, as described in Background to the System register interface on 
page G1-5568. In Armv8, there is no particular significance to the naming of these parameters, and no 
functional distinction between the opn parameters and the CRx parameters. 





Principles of the System instruction class encoding on page C5-362 describes some general properties of these 
encodings. System instruction class encoding overview on page C5-363 then describes the top-level encoding of 
these instructions, identifying that: 


. Entries in the encoding space are characterized by the parameter set {op0, op1, CRn, CRm, op2}. 


s op0 is the most significant parameter for determining allocations in this space. 


Much of this encoding space is used for System instructions, as described in Chapter C5 The A64 System Instruction 
Class. This chapter describes only the part of the encoding space that is used for System registers, in the following 
sections: 


s op0==0b10, Moves to and from debug and trace System registers on page D12-2801. 
s op0==0b11, Moves to and from non-debug System registers, Special-purpose registers on page D12-2803. 
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AArch64 System Register Encoding 
D12.2 op0==0b10, Moves to and from debug and trace System registers 


Qb10, Moves to and from debug and trace System registers 


The instructions that move data to and from the debug, Execution environment, and trace System registers are 
encoded with op0==0b10. This means the encoding of these instructions is: 





31 30 29 28 27 26 25 24 23 22 21 20 19 18 E L 12 = 
rroToTroTo ol o] of | om | oe [a >a 
op0 
Note 
. The section describes the use of all of the op0==0b10 region of the System register encoding space. 
° These encodings access the registers that are equivalent to the AArch32 System registers in the 


(coproc==0b1110) encoding space. 


The value of op1 provides the next level of decode of these instructions, as follows: 


op1 = {0, 3, 4} 
Debug. See Instructions for accessing debug System registers 


Note 

The standard encoding of debug registers is op0==0b10, op1== {0, 3, 4}. The registers in the 
op0==0b11 encoding space that are classified as debug registers are DLR_ELO, DSPSR_ELO, 
MDCR_EL2, MDCR_EL3, and SDER32_EL3. See Instructions for accessing non-debug System 
registers on page D12-2803 for the encodings of these registers. 








op1 == Trace. See the appropriate trace architecture specification. 


D12.2.1 Instructions for accessing debug System registers 
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The instructions for accessing debug System registers are: 


MSR <System register>, Xt ; Write to System register 
MRS Xt, <System register> ; Read from System register 


Where <System_register> is the register name, for example MDCCSR_ELO. 


This section includes only the System register access encodings for which both: 
. op® is 0b10. 
° The value of op1 is one of {0, 3, 4}. 





Note 
These encodings access the registers that are equivalent to the AArch32 System registers in the (coproc==0b1110) 
encoding space. 
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D12.2 op0==0b10, Moves to and from debug and trace System registers 


Table D12-1 shows the mapping of the System register encodings for debug System register access. 


Table D12-1 System instruction encodings for debug System register access 





Access instruction encoding 


























































































































Register Permitted accesses 
op0 opi CRn CRm op2 
OSDTRRX_EL1 2 0 0 0 2 RW 
MDCCINT ELI 2 0 RW 
MDSCR_ELI1 2 RW 
OSDTRTX_EL1 3 2 RW 
OSECCR _EL1 6 2 RW 
DBGBVR<n>_EL1 0-15a 4 RW 
DBGBCR<n>_EL1 0-154 5 RW 
DBGWVR<n>_EL1 0-154 6 RW 
DBGWCR<n>_EL1 0-154 7 RW 
MDRAR ELI 2 0 1 0 0 RO 
OSLAR_EL1 4 WO 
OSLSR_EL1 1 4 RO 
OSDLR_EL1 3 4 RW 
DBGPRCR_EL1 4 4 RW 
DBGCLAIMSET EL1 T 8 6 RW 
DBGCLAIMCLR ELI 9 6 RW 
DBGAUTHSTATUS_EL1 14 6 RO 
MDCCSR_ELO 3 0 1 0 RO 
DBGDTR_ELO 4 0 RW 
DBGDTRRX_ELO 5 0 RO 
DBGDTRTX_ELO WO 
DBGVCR32_EL2 4 0 7 0 RW 





a. Unimplemented breakpoint and watchpoint register access instructions are unallocated. CRm 


encodes <n>, the breakpoint or watchpoint number. 


For more information see Mapping of the System registers between the Execution states on page D1-2383. 
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AArch64 System Register Encoding 
D12.3 op0==0b11, Moves to and from non-debug System registers, Special-purpose registers 


Qb11, Moves to and from non-debug System registers, Special-purpose 


The instructions that move data to and from non-debug System registers are encoded with op0==0b11, except that 
some of this encoding space is reserved for IMPLEMENTATION DEFINED functionality. The encoding of these 


instructions is: 


31 30 29 28 27 26 25 24 23 22 21201918 1615 12 11 


roo re re otf i ot | om | om | ae | a 


op0 


The value of CRn provides the next level of decode of these instructions, as follows: 
CRn=={0, 1, 2, 3, 5, 6, 7, 9, 10, 12, 13, 14} 
See Instructions for accessing non-debug System registers. 
CRn== See Instructions for accessing Special-purpose registers on page C5-372. 
CRn=={11, 15} See Reserved encodings for IMPLEMENTATION DEFINED registers on page D12-2815. 


D12.3.1 Instructions for accessing non-debug System registers 
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The A64 instructions for accessing System registers are: 


MSR <System register>, Xt ; Write to System register 
MRS Xt, <System register> ; Read from System register 


Where <System_register> is the register name, for example MIDR_EL1. 


This section includes only the System register access encodings for which both: 
° op@ is 0b11. 
° The value of CRn is one of {0, 1, 2, 3, 5, 6, 7,9, 10, 12, 13, 14}. 


Note 
od These encodings access the registers that are equivalent to the AArch32 System registers in the 
(coproc==0b1111) encoding space. 





° While this group is described as accessing the non-debug System registers, its correct characterization is by 
the {op0, CRn} values given in this subsection, and the group includes the debug registers DLR_ELO, 
DSPSR_ELO, MDCR_EL2, MDCR_EL3, and SDER32_EL3, that are described in Debug registers on 
page D13-3429. These registers are exceptions to the standard encoding of debug registers, that has 
op0==0b10, see Instructions for accessing debug System registers on page D12-2801. 





The instruction encoding for these accesses is: 


31 30 29 28 27 26 25 24 23 2221201918 1615 12 11 
Tororo? oot] of | om | om | = | a 
op0 


See text for permitted values of CRn 


Table D12-2 on page D12-2804 shows the encodings of the register access instructions. In the Notes on 
page D12-2804 column of the table: 


Config-RO Means it is configurable whether read accesses are permitted. Write accesses are UNDEFINED. 
Config-WO Means it is configurable whether write accesses are permitted. Read accesses are UNDEFINED. 


Config-RW Means it is configurable whether accesses are permitted. Either read and write accesses are 
permitted, or read and write accesses are UNDEFINED. 


See the register descriptions for information about the control that determines whether these accesses are permitted. 
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D12.3 op0==0b11, Moves to and from non-debug System registers, Special-purpose registers 


Table D12-2 System instruction encodings for non-Debug System register accesses 





Width Access instruction encoding 
Register accessed Source Notes 













































































































































































(bits) op0 opi CRn CRm op2 

MIDR_EL1 32 3 0 0 0 0 v8.0 RO. 

MPIDR_EL1 64 5 v8.0 RO. 

REVIDR EL1 32 6 v8.0 RO. 

ID_PFRO_ ELI 32 1 0 v8.0 RO, but UNKNOWN if AArch32 is 

ID PFRI ELI 32 1 v8.0 ie erat 

ID_DFRO EL1 32 2 v8.0 

ID_AFRO EL1 32 3 v8.0 

ID_MMFRO EL1 32 4 v8.0 

ID_MMFRI EL1 32 5 v8.0 

ID_MMFR2 EL1 32 6 v8.0 

ID_MMFR3 ELI 32 7 v8.0 

ID_ISARO_EL1 32 2 0 v8.0 RO, but UNKNOWN if AArch32 is 

ID_ISAR1_EL1 32 1 v8.0 E 

ID_ISAR2_EL1 32 2 v8.0 

ID_ISAR3_EL1 32 3 v8.0 

ID_ISAR4_EL1 32 4 v8.0 

ID_ISAR5_EL1 32 5 v8.0 

ID_MMFR4 EL1 32 6 v8.0 

Reserved, RAZ - 7 - RO. 

MVFRO0 _EL1 32 3 0 v8.0 RO, but UNKNOWN if AArch32 is 
not implemented. 

MVFR1_EL1 32 1 v8.0 

MVFR2 ELI 32 2 v8.0 

Reserved, RAZ - 3 - RO. 

ID_PFR2 ELI 64 4 v8.0 RO. 

Reserved, RAZ - n - RO, for n=5-7. 

ID_AA64PFRO_EL1 64 4 0 v8.0 RO. 

ID_AA64PFR1_EL1 64 1 v8.0 RO. 

ID_AA64ZFRO_EL1 64 4 SVE2 RO, but RAZ if SVE is not 
implemented. 

Reserved, RAZ - n - RO, for n={2, 3, 5, 6, 7}. 
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Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Access instruction encoding 



















































































































































































Register accessed ee) Source Notes 
op0 opi CRn CRm op2 
ID_AA64DFRO_ ELI 64 3 0 0 5 0 v8.0 RO. 
ID_AA64DFRI_ELI 64 1 v8.0 RO. 
ID_AA64AFRO ELI 64 4 v8.0 RO. 
ID_AA64AFRI_ ELI 64 5 v8.0 RO. 
Reserved, RAZ - n - RO, for n={2, 3, 6, 7}. 
ID_AA64ISARO_EL1 64 6 0 v8.0 RO. 
ID_AA64ISARI_ ELI 64 1 v8.0 RO. 
Reserved, RAZ - n - RO, for n=2-7. 
ID_AA64MMFRO_ EL1 64 7 0 v8.0 RO. 
ID_AA64MMFRI1 ELI 64 1 v8.0 RO. 
ID_AA64MMFR2_EL1 64 2 v8.2 RO. 
Reserved, RAZ - n - RO, for n=3-7. 
SCTLR_EL1 32 1 0 0 v8.0 RW. 
ACTLR ELI 64 1 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 
CPACR_EL1 32 2 v8.0 RW. 
ZCR_ELI1 64 2 0 SVE RW. 
TRFCR_EL1 64 1 v8.4 RW. 
TTBRO_EL1 64 2 0 0 v8.0 RW. 
TTBR1_EL1 64 1 v8.0 RW. 
TCR PLI 64 2 v8.0 RW. 
APIAKeyLo_EL1 64 1 0 v8.3 RW. 
APIAKeyHi EL1 64 1 v8.3 RW. 
APIBKeyLo_EL1 64 2 v8.3 RW. 
APIBKeyHi_EL1 64 3 v8.3 RW. 
APDAKeyLo_EL1 64 2 0 v8.3 RW. 
APDAKeyHi_EL1 64 1 v8.3 RW. 
APDBKeyLo_ ELI 64 2 v8.3 RW. 
APDBKeyHi_EL1 64 3 v8.3 RW. 
APGAKeyLo_EL1 64 3 0 v8.3 RW. 
APGAKeyHi_EL1 64 1 v8.3 RW. 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D12-2805 


ID070919 Non-Confidential 


AArch64 System Register Encoding 
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Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Access instruction encoding 
















































































































































































Register accessed hen Source Notes 
op0 opi CRn CRm op2 
ICC_PMR_ ELI 32 3 0 4 6 0 GIC® RW. 
ICV_PMR ELI 
AFSRO_EL1 32 5 1 0 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 
AFSR1_EL1 32 1 v8.0 
ESR_EL1 32 2 0 v8.0 RW. 
ERRIDR_EL1 64 3 0 RAS¢ RO. 
ERRSELR_EL1 64 1 RAS¢ RW. 
ERXFR_EL1 64 4 0 RAS¢ RO. 
ERXCTLR_EL1 64 1 RAS¢ RW. 
ERXSTATUS_EL1 64 2 RAS¢ RW. 
ERXADDR ELI 64 3 RAS¢ RW. 
ERXPFGF_EL1 64 4 RAS° RO, 
ERXPFGCTL_EL1 64 5 RAS RW. 
ERXPFGCDN_EL1 64 6 RAS¢ RW. 
ERXMISCO_EL1 64 5 0 RAS¢ RW. 
ERXMISC1_EL1 64 1 RAS¢ RW. 
ERXMISC2_EL1 64 2 RAS¢ RW. 
ERXMISC3_EL1 64 3 RAS¢ RW. 
FAR ELI 64 6 0 0 v8.0 RW. 
PAR_ELI 64 7 4 0 v8.0 RW. 
PMSCR EL1 64 9 9 0 SPE4 RW. 
PMSICR_EL1 64 2 SPE4 RW. 
PMSIRR_EL1 64 3 SPE4 RW. 
PMSFCR_EL1 64 4 SPE¢ RW. 
PMSEVFR_EL1 64 5 SPE4 RW. 
PMSLATFR_EL1 64 6 SPE4 RW. 
PMSIDR_EL1 64 7 SPE4 RO. 
PMBLIMITR_EL1 64 10 0 SPE4 RW. 
PMBPTR_EL1 64 1 SPEd RW. 
PMBSR _EL1 64 3 SPE4 RW. 
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Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Access instruction encoding 









































































































































Register accessed ech Source Notes 
op0 opi CRn CRm op2 

PMBIDR_EL1 64 3 0 9 10 7 SPE¢ RO. 

PMINTENSET_EL1 32 14 1 v8.0 RW.¢ 

PMINTENCLR_EL1 32 2 v8.0 RW.¢ 

PMMIR_ EL1 64 6 v8.4 RO. 

MAIR EL1 64 10 2 0 v8.0 RW. 

AMAIR EL1 64 3 0 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 

LORSA_EL1 64 4 0 v8.1 RW. 

LOREA EL1 64 1 v8.1 RW. 

LORN _EL1 64 2 v8.1 RW. 

LORC_EL1 64 3 v8.1 RW. 

LORID _EL1 64 7 v8.1 RO. 

VBAR_EL1 64 12 0 0 v8.0 RW. 

RVBAR EL1 64 1 v8.0 RO. Implemented only if EL2 and 
EL3 are not implemented. 

RMR ELI 64 2 v8.0 RW. Implemented only if EL2 and 
EL3 are not implemented. f 

ISR_EL1 32 1 0 v8.0 RO. 

DISR_EL1 64 1 RAS* RW. 

ICC_IARO_EL1 32 8 0 GIC> RO.» 

ICV_IARO_EL1 

ICC_EOIRO_EL1 32 1 GIC> wo.> 

ICV_EOIRO_EL1 

ICC_HPPIRO_EL1 32 2 GIC> RO.» 

ICV_HPPIRO_ EL1 

ICC_BPRO_EL1 32 3 GIC> Rw.> 

ICV_BPRO_EL1 

ICC_APOR<n>_EL1 32 {4-7} GICb RW, <n> = 0p2-4.> 

ICV_APOR<n>_EL1 

ICC_AP1R<n>_EL1 32 9 {0-3} GIC RW, <n> = 0p2.> 

ICV_AP1IR<n>_EL1 

ICC_DIR_EL1 32 11 1 GIC> wo.> 

ICV_DIR_EL1 
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Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Access instruction encoding 



































































































































Register accessed ech Source Notes 

op0 opi CRn CRm op2 

ICC_RPR_EL1 32 3 0 12 11 3 GIC> RO. 

ICV_RPR_EL1 

ICC_SGIR_EL1 64 5 GIC}? Wo.> 

ICC_ASGIR_EL1 64 6 GIC> wo.> 

ICC_SGIOR_EL1 64 7 GIC}? WO.b 

ICC_IAR1_EL1 32 12 0 GIC}? RO.» 

ICV_IAR1_EL1 

ICC_EOIR1_ ELI 32 l GIC> wo.> 

ICV_EOIR1_EL1 

ICC_HPPIR1_EL1 32 2 GIC}? RO.» 

ICV_HPPIR1_EL1 

ICC_BPR1_EL1 32 3 GIC}? RW.? 

ICV_BPR1_EL1 

ICC_CTLR EL1 32 4 GIC> Rw.> 

ICV_CTLR_EL1 

ICC_SRE_EL1 32 5 GIC}? RW.> 

ICC_IGRPENO_EL1 32 6 GIC}? RW.> 

ICV_IGRPENO_EL1 

ICC_IGRPEN1 ELI 32 7 GIC> RW. 

ICV_IGRPEN1 _EL1 

CONTEXTIDR_EL1 32 13 0 1 v8.0 RW. 

TPIDR_EL1 64 4 v8.0 RW. 

CNTKCTL EL1 32 14 1 0 v8.08 RW 

CCSIDR_EL1 32 1 0 0 0 v8.0hb RO. 

64 v8.3h 

CLIDR_EL1 64 1 v8.0 RO. 

CCSIDR2_EL1 32 2 v8.31 RO, but IMPLEMENTATION 
DEFINED) if AArch32 is not 
implemented. 

AIDR_EL1 32 7 v8.0 RO. 

CSSELR_EL1 32 2 0 0 0 v8.0 RW. 

CTR_ELO 32 3 0 0 1 v8.0 Config-RO at ELO, otherwise RO. 

DCZID_ELO 32 7 v8.0 RO. 
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D12.3 op0==0b11, Moves to and from non-debug System registers, Special-purpose registers 


Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Access instruction encoding 









































































































































Register accessed ean Source Notes 

op0 opi CRn CRm op2 

PMCR_ELO 32 3 3 9 12 0 v8.0¢ Config-RW at ELO, otherwise 
RW. 

PMCNTENSET_ELO 32 1 v8.0° 

PMCNTENCLR_ELO 32 2 v8.0 

PMOVSCLR_ELO 32 3 v8.0¢ 

PMSWINC ELO 32 4 v8.0¢ Config-WO at ELO, otherwise 
WoO. 

PMSELR_ELO 32 5 v8.0¢ Config-RW at ELO, otherwise 
RW. 

PMCEIDO_ELO 32 6 v8.0¢ Config-RO at ELO, otherwise RO. 

PMCEID1 _ELO 32 7 v8.0°¢ 

PMCCNTR_ELO 64 13 0 v8.0¢ Config-RW at ELO, otherwise 
RW. 

PMXEVTYPER_ELO 32 l v8.0° 

PMXEVCNTR_ELO 32 2 v8.0¢ 

PMUSERENR_ ELO 32 14 0 v8.0¢ RO at ELO, otherwise RW. 

PMOVSSET_ELO 32 3 v8.0° Config-RW at ELO, otherwise 
RW. 

TPIDR_ELO 64 13 0 2 v8.0 RW. 

TPIDRRO_ELO 64 3 v8.0 RW. 

AMCR_ELO 32 2 0 AMUk Config-RO at ELO, RW at the 
highest implemented Exception 
level, otherwise RO. 

AMCFGR_ELO 32 1 AMUK Config-RO at ELO, otherwise RO. 

AMCGCR_ELO 32 2 AMUk Config-RO at ELO, otherwise RO. 

AMUSERENR ELO 32 3 AMUk RO at ELO, otherwise RW. 

AMCNTENCLRO_ELO 32 4 AMUK Config-RO at ELO, RW at the 
highest implemented Exception 
level, otherwise RO. 

AMCNTENSETO_ELO 32 5 AMUK Config-RO at ELO, RW at the 
highest implemented Exception 
level, otherwise RO. 

AMCNTENCLR1_ELO 32 3 0 AMUK Config-RO at ELO, RW at the 
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Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Width 
(bits) 


Register accessed 


Access instruction encoding 


op0 


op1 


CRn 


CRm 


op2 


Source 


Notes 





AMCNTENSET1_ELO 32 





AMEVCNTRO<n>_EL0O 64 





AMEVTYPERO<n> ELO 32 





AMEVCNTRI1<n>_EL0O 64 





AMEVTYPERI<n> ELO 32 





CNTFRQ ELO 32 





CNTPCT_ELO 64 





CNTVCT_ELO 64 





CNTP_TVAL ELO 32 





CNTP_CTL_ELO 32 











CNTP_CVAL ELO 64 
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3 


3 


13 


1 


AMUK 


Config-RO at ELO, RW at the 
highest implemented Exception 
level, otherwise RO. 





{4-5} 


{0-7} 


AMUk 


Config-RO at ELO, RW at the 
highest implemented Exception 
level, otherwise RO. 


CRm and op2 encode <n>, the 
counter number: 

. For CRm==4, <n>=0p2. 

. For CRm==5, <n>=0p2+8. 





{6-7} 


{0-7} 


AMUK 


Config-RO at ELO, otherwise RO. 


CRm and op2 encode <n>, the 
counter number: 


. For CRm==6, <n>=op2. 
. For CRm==7, <n>=0p2+8. 





{12-13} 


{0-7} 


AMUK 


Config-RO at EL0, RW at the 
highest implemented Exception 
level, otherwise RO. 


CRm and op2 encode <n>, the 
counter number: 


. For CRm== 12, <n>=op2. 
. For CRm== 13, <n>=0p2+8. 





{14-15} 


{0-7} 


AMUK 


Config-RO at EL0, RW at the 
highest implemented Exception 
level, otherwise RO. 


CRm and op2 encode <n>, the 
counter number: 


s For CRm== 14, <n>=op2. 
s For CRm== 15, <n>=op2+8. 





14 


v8.08 


Config-RO at ELO, RW at the 
highest implemented Exception 
level, otherwise RO. 





v8.08 


Config-RO at ELO, otherwise RO. 





v8.08 
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v8.08 


Config-RW at ELO and 
Non-secure EL1, otherwise RW. 





v8.08 





v8.08 
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Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Access instruction encoding 









































































































































Register accessed ee) Source Notes 
op0 opi CRn CRm op2 
CNTV_TVAL_ELO 32 3 3 14 3 0 v8.08 Config-RW at ELO, otherwise 
RW. 
CNTV_CTL_ELO 32 1 v8.08 
CNTV_CVAL ELO 64 2 v8.08 
PMEVCNTR<n>_ELO 32 {8-10} {0-7}  v8.0° Config-RW at ELO, otherwise 
RW. CRm and op2 encode <n>, the 
counter number: 
° For CRm=={8, 12}, 
<n>=0p2. 
° For CRm=={9, 13}, 
<n>=0p2+8. 
° For CRm=={10, 14}, 
<n>=0p2+ 16. 
e For CRm=={11, 15}, 
<n>=0p2 +24. 
11 {0-6}  v8.0¢ 
PMEVTYPER<n>_ELO 32 {12-14} {0-7}  v8.0° 
15 {0-6}  v8.0° 
PMCCFILTR_ELO 32 7 v8.0¢ Config-RW at ELO, otherwise 
RW. 
VPIDR_EL2 32 4 0 0 0 v8.0 RW. 
VMPIDR_EL2 64 5 v8.0 RW. 
SCTLR. EL2 32 1 0 0 v8.0 RW. 
ACTLR_EL2 64 1 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 
HCR_EL2 64 1 0 v8.0 RW. 
MDCR_EL2 32 1 v8.0 RW.! 
CPTR_EL2 32 2 v8.0 RW. 
HSTR_EL2 32 3 v8.0 RW. 
HACR EL2 32 7 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 
ZCR_EL2 64 2; 0 SVEa RW. 
TRFCR_EL2 64 1 v8.4 RW. 
SDER32_EL2 32 3 1 v8.4 RW. 
TTBRO_EL2 64 2 0 0 v8.0 RW. 
TCR EL2 32 2 v8.0 RW. 
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Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Access instruction encoding 





















































































































































Register accessed ee) Source Notes 
op0 opi CRn CRm op2 

VTTBR_EL2 64 3 4 2 1 0 v8.0 RW. 

VTCR_EL2 32 2 v8.0 RW. 

VNCR_EL2 64 2 0 v8.4 RW. 

VSTTBR_EL2 64 6 0 v8.4 RW. 

VSTCR_EL2 32 2 v8.4 RW. 

DACR32_EL2 32 3 0 0 v8.0 RW if EL1 can use AArch32, 
otherwise UNDEFINED.™ 

IFSR32_EL2 32 5 0 1 v8.0 RW if EL1 can use AArch32, 
otherwise UNDEFINED.™ 

AFSRO_EL2 32 1 0 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 

AFSR1_EL2 32 1 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 

ESR_EL2 32 2 0 v8.0 RW. 

VSESR_EL2 64 3 RAS° RW. 

FPEXC32 EL2 32 3 0 v8.0 RW if EL1 can use AArch32, 
otherwise UNDEFINED.™ 

FAR. EL2 64 6 0 0 v8.0 RW. 

HPFAR_EL2 64 4 v8.0 RW. 

PMSCR_EL2 64 9 9 0 SPE4 RW. 

MAIR EL2 64 10 2 0 v8.0 RW. 

AMAIR EL2 64 3 0 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 

VBAR_EL2 64 12 0 0 v8.0 RW. 

RVBAR_EL2 64 1 v8.0 RO. Implemented only if EL3 is 
not implemented. 

RMR_EL2 64 2 v8.0 RW. Implemented only if EL2 is 
implemented and EL3 is not 
implemented. f 

VDISR_EL2 64 1 1 RAS" RW. 

ICH_APOR<n>_EL2 32 8 {0-3} GICb RW, <n>=op2. 

ICH_AP1R<n>_EL2 32 9 {0-3} GICb RW, <n>=op2. 

ICC_SRE EL2 32 5 GIC}? RW. 

ICH_HCR_EL2 32 11 0 GIC> RW. 
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Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Access instruction encoding 

































































































































































Register accessed ean Source Notes 
op0 opi CRn CRm op2 

ICH_VTR_EL2 32 3 4 12 11 1 GIC> RO. 

ICH_MISR_EL2 32 2 GIC}? RO. 

ICH_EISR_EL2 32 3 GIC> RO. 

ICH_ELRSR_EL2 32 5 GIC}? RO. 

ICH_VMCR_EL2 32 7 GIC> RW. 

ICH_LR<n>_EL2 64 {12,13} {0-7} GIC> RW: 
` For CRm== 12, <n>=op2. 
. For CRm== 13, <n>=0p2 +8. 

CONTEXTIDR_EL2 32 13 0 1 v8.1 RW. 

TPIDR_EL2 64 2 v8.0 RW. 

CNTVOFF_ EL2 64 14 0 3 v8.08 RW. 

CNTHCTL. EL2 32 1 0 v8.08 RW. 

CNTHP_TVAL EL2 32 2 0 v8.08 RW. 

CNTHP CTL BL2 32 1 v8.08 RW. 

CNTHP_CVAL EL2 64 2 v8.08 RW. 

CNTHV_TVAL EL2 32 3 0 v8.1 RW. 

CNTHV_CTL _EL2 32 1 v8.1 RW. 

CNTHV_CVAL_EL2 64 2 v8.1 RW. 

CNTHVS_TVAL EL2 32 4 0 v8.4 RW. 

CNTHVS_CTL_EL2 32 1 v8.4 RW. 

CNTHVS_CVAL EL2 64 2 v8.4 RW. 

CNTHPS_TVAL EL2 32 5 0 v8.4 RW. 

CNTHPS_CTL_EL2 32 1 v8.4 RW. 

CNTHPS_CVAL_EL2 64 2 v8.4 RW. 

* EL02 64 5 {0-15} {0-15} {0-7} v8.1 Reserved for EL2 aliases of ELO 

* EL12 and EL1 registers, see 
Table D5-47 on page D5-2613 
and Table D5-48 on 
page D5-2614. 

SCTLR_EL3 32 6 1 0 0 v8.0 RW. 

ACTLR_EL3[63:0] 64 1 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 

SCR_EL3 32 1 0 v8.0 RW. 
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Table D12-2 System instruction encodings for non-Debug System register accesses (continued) 





Access instruction encoding 



































































































































Register accessed ean Source Notes 
op0 opi CRn CRm op2 

SDER32_EL3 32 3 6 1 1 1 v8.0 RW if EL1 can use AArch32, 
otherwise UNDEFINED. L m 

CPTR_EL3 32 2 v8.0 RW. 

ZCR_EL3 64 2 0 SVE@ RW. 

MDCR_EL3 32 3 1 v8.0 RW.! 

TTBRO EL3 64 2 0 0 v8.0 RW. 

TCR EL3 32 2 v8.0 RW. 

AFSRO_EL3 32 5 1 0 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 

AFSR1_EL3 32 1 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 

ESR_EL3 32 2 0 v8.0 RW. 

FAR_EL3 64 6 0 0 v8.0 RW. 

MAIR _EL3 64 10 2 0 v8.0 RW. 

AMAIR EL3 64 3 0 v8.0 RW, contents IMPLEMENTATION 
DEFINED. 

VBAR_EL3 64 12 0 0 v8.0 RW. 

RVBAR_EL3 64 1 v8.0 RO. 

RMR EL3 64 2 v8.0 RW. Implemented only if EL3 is 
implemented. 

ICC_CTLR_EL3 32 12 4 GIC> RW. 

ICC_SRE_EL3 32 5 GIC> RW. 

ICC_IGRPEN1_EL3 32 7 GIC> RW. 

TPIDR_EL3 64 13 0 2 v8.0 RW. 

CNTPS_TVAL_EL1 32 7 14 2 0 v8.08 RW at EL3, Config-RW at Secure 

CNTPS CTL ELI 32 1 v8.08 iii 

CNTPS_CVAL EL1 64 2 v8.08 


a. Scalable Vector Extension System register, see The Scalable Vector Extension (SVE) on page A2-92. 


b. GIC System register, see About the GIC System registers on page D12-2815 As that subsection describes, each ICV_* register uses the same 
encoding as the corresponding ICC _* register. 


RAS Extension System registers, see The Reliability, Availability, and Serviceability Extension (RAS Extension) on page A2-90. 


a 9 


Statistical Profiling Extension System registers, see The Statistical Profiling Extension (SPE) on page A2-91. 


e. Performance Monitors Extension System register, see Performance Monitors registers on page D13-3526. 


bar) 


Required if the highest implemented Exception level can use both AArch32 and AArch64. If the highest implemented Exception level can 
use only AArch64 then it is IMPLEMENTATION DEFINED whether this register is implemented. 


g. Generic Timer System register, see Generic Timer registers on page D13-3685. 
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h. When ARMv8.3-CCIDX is implemented, CCSIDR_EL] is a 64-bit register. Otherwise, it is a 32-bit register. 


i. CCSIDR2_ EL] is implemented only when ARMv8.3-CCIDX is implemented. 
j- When AArch32 is not implemented, it is IMPLEMENTATION DEFINED whether CCSIDR2_EL1 is UNDEFINED or UNKNOWN. 


k. Activity Monitors System register, see Activity Monitors registers on page D13-3584. 


1. Debug register in the op0==3 encoding space, see Debug registers on page D13-3429. 


m. Defined to allow access from AArch64 state to registers that are only used in AArch32 state. 


About the GIC System registers 


From version 3.0 of the GIC architecture specification, the specification defines three groups of System registers, 
identified by the prefix of the register name: 





ICC_ GIC physical CPU interface System registers. 

ICH_ GIC virtual interface control System registers. 

ICV_ GIC Virtual CPU interface System registers. 
Note 





These registers are in addition to the GIC memory-mapped register groups GICC_, GICD_, GICH_, GICR_, 
GICV_,andGITS _. 





When implemented, the GIC System registers form part of an Arm processor implementation, and therefore these 
registers are included in the register summaries. However, the registers are defined only in the GIC Architecture 
Specification. 


As Table D12-2 on page D12-2804 shows, the ICV_* registers have the same {op0, op1, CRn, CRm, op2} encodings as 
the corresponding ICC_* registers. For these encodings, GIC register configuration fields determine which register 
is accessed. 


For more information see the ARM” Generic Interrupt Controller Architecture Specification, GIC architecture 
version 3.0 and version 4.0 (ARM IHI 0069). 


D12.3.2 Reserved encodings for IMPLEMENTATION DEFINED registers 


ARM DDI 0487E.a 
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The System register encoding space with op@==0b11 reserves the following encodings for IMPLEMENTATION 
DEFINED registers: 


31 30 29 28 27 26 25 24 23 22 21 = us 18 AL 15 1z = 
a E 
op0 CRn 


The value of L defines the access type and the use of Rt as follows: 
0 Write the value in Rt to the IMPLEMENTATION DEFINED register. 
1 Read the value of the IMPLEMENTATION DEFINED register to Rt. 


For more information about these encodings see S3_<op1>_<Cn>_<Cm>_<op2>, IMPLEMENTATION 
DEFINED registers on page D13-3246. As that section describes, any IMPLEMENTATION DEFINED registers are 
accessed in a similar way to architecturally-defined System registers, using MRS and MSR instructions, see: 

$ MRS on page C6-1104. 

7 MSR (immediate) on page C6-1105. 

E MSR (register) on page C6-1108. 





See also Reserved encodings for IMPLEMENTATION DEFINED registers. 


The Arm architecture guarantees not to define any register name prefixed with JMP _ as part of the standard Arm 
architecture. 
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Note 


Arm strongly recommends that any register names created in the IMPLEMENTATION DEFINED register spaces be 
prefixed with JMP_and postfixed with _ELx, where appropriate. 
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This chapter defines the AArch64 System registers. It contains the following sections: 


About the AArch64 System registers on page D13-2818. 
General system control registers on page D13-2826. 
Debug registers on page D13-3429. 

Performance Monitors registers on page D13-3526. 
Activity Monitors registers on page D13-3584. 

Statistical Profiling Extension registers on page D13-3609. 
RAS registers on page D13-3647. 

Generic Timer registers on page D13-3685. 
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D13.1 About the AArch64 System registers 


The following sections describe common features of the AArch64 registers: 

s Fixed values in the System register descriptions. 

à General behavior of accesses to the AArch64 System registers. 

° Principles of the ID scheme for fields in ID registers on page D13-2823. 


D13.1.1 Fixed values in the System register descriptions 


See Fixed values in AArch64 instruction and System register descriptions on page C2-185. This section defines how 
the glossary terms RAZ, RESO, RAO, and RES! can be represented in the System register descriptions. 


D13.1.2 General behavior of accesses to the AArch64 System registers 


The following subsections give general information about the behavior of accesses to the System registers: 
7 Reset behavior of AArch64 System registers. 
3 Synchronization requirements for AArch64 System registers on page D13-2819. 


Reset behavior of AArch64 System registers 
Reset values apply only to RW registers and fields, however: 


° Some RO registers or fields, including feature ID registers and some status registers or register fields, always 
return a known value. 


° Some RW and RO registers or register fields return status information about the PE. Unless the register 
description indicates that the value is UNKNOWN on reset, a read of the register immediately after a reset 
returns valid information. 


° Some RW and RO registers and fields are aliases of other registers or fields. In these cases, the reset behavior 
of the aliased register or field determines the value returned by a read of the register immediately after a reset. 


° WO registers that only have an effect on writes do not have meaningful reset values. However, an access to 
a WO register might affect underlying state, and that state might have a defined reset value. 


. IMPLEMENTATION DEFINED registers have IMPLEMENTATION DEFINED reset behavior. 


After a reset, only a limited subset of the PE state is guaranteed to be set to defined values. Also, for debug and trace 
System registers, reset requirements must take account of different levels of reset. For more information about the 
reset behavior of System registers when the PE resets into an Exception level that is using AArch64, see: 

7 PE state on reset to AArch64 state on page D1-2290. 

$ The appropriate Trace architecture specification, for the Trace System registers. 


For a PE reset into an Exception level that is using AArch64, the architecture defines which AArch64 System 
registers have a defined reset value, and when that defined reset value applies. The register descriptions include this 
information, and PE state on reset to AArch64 state on page D1-2290 summarizes these architectural requirements. 
Otherwise, RW registers that have a meaningful reset value reset to an architecturally UNKNOWN value. 


Note 


When the PE resets into an Exception level that is using AArch32, no PE state that relates to execution in AArch64 
state is accessible until another reset causes the Execution state to change to AArch64. Therefore, on a reset into 
AArch32 state, PE state that relates only to execution in AArch64 state cannot have a meaningful reset value. 








Pseudocode description of resetting System registers 


The AArch64.ResetSystemRegisters() pseudocode function resets all System registers, and register fields, that have 
defined reset values, as described in this section and PE state on reset to AArch64 state on page D1-2290. 
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Note 


For debug and trace System registers, this function resets registers as defined for the appropriate level of reset. 





Synchronization requirements for AArch64 System registers 


Reads of the System registers can occur out of order with respect to earlier instructions executed on the same PE, 
provided that both: 


° Any data dependencies between the instructions, including read-after-read dependencies, are respected. 


5 The reads to the register do not occur earlier than the most recent Context synchronization event to its 
architectural position in the instruction stream. 


Note 


In particular, the values read from System registers that hold self-incrementing counts, such as the Performance 
Monitors counters or the Generic Timer counter or timers, could be accessed from any time after the previous 
Context synchronization event. For example, where a memory access is used to communicate a read of such a 
counter, an ISB must be inserted between the read of the memory location that is known to have returned its data, 
either as a result of a condition on that data or of the read having completed, and the read of the counter, if it is 
necessary that the counter returns a count value after the memory communication. 





Direct writes using the instructions in Table D12-2 on page D12-2804 require synchronization before software can 

rely on the effects of changes to the System registers to affect instructions appearing in program order after the direct 

write to the System register. Direct writes to these registers are not allowed to affect any instructions appearing in 

program order before the direct write. The only exceptions are: 

: All direct writes to the same register, that use the same encoding for that register, are guaranteed to occur in 
program order relative to each other 

a All direct writes to a register occur in program order with respect to all direct reads to the same register using 
the same encoding. 

: Any System register access that an Arm Architecture Specification or equivalent specification defines as not 
requiring synchronization. 


Explicit synchronization occurs as a result of a Context synchronization event, which is one of the following events: 

7 Execution of an ISB instruction. 

s Exception entry, if ARMv8.5-CSEH is not implemented, or if ARMv8.5-CSEH is implemented and defines 
that exception entries to this Exception level are context synchronization events. 


s Exception return, if ARMv8.5-CSEH is not implemented, or if ARMv8.5-CSEH is implemented and defines 
that exception returns from this Exception level are context synchronization events. 


s Execution of a DCPS instruction in Debug state. 
e Execution of a DRPS instruction in Debug state. 
° Exit from Debug state. 

— Note 


The ISB and exception entry events are applicable both in Debug state and in Non-debug state. 





Conceptually, explicit synchronization occurs as the first step of each of these events, so that if the event uses state 
that has previously been changed but was not synchronized by the time of the event, the event is guaranteed to use 
the state as if it had been synchronized. 


Note 
This explicit synchronization applies as the first step of the execution of the events, and does not apply to any effect 
of System registers that apply to the fetch and decode of the instructions that cause these events, such as breakpoints 
or changes to the translation table. 
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In addition, any system instructions that cause a write to a System register must be synchronized before the result 
is guaranteed to be visible to subsequent direct reads of that System register. 


Direct reads to any one of the following registers, using the same encoding, occur in program order relative to each 


other: 


ISR_ELI. 


The Generic Timer registers, that is, CNTPCT_ELO and CNTVCT_ELO, and the Counter registers 
CNTP_TVAL ELO, CNTV_TVAL_ ELO, CNTHP_TVAL EL2, and CNTPS_TVAL EL1. 


DBGCLAIMCLR ELI. 


The PMU Counters, that is, PMCCNTR_ELO, PMEVCNTR<n>_EL0, PMXEVCNTR_ELO, 
PMOVSCLR_ELO, and PMOVSSET_ELO. 


The Debug Communications Channel registers, that is, DBGDTRRX_EL0, DBGDTR_ELO, and 
MDCCSR_ELO. 


All other direct reads of System registers can occur in any order if synchronization has not been performed. 


Table D13-1 describes the synchronization requirements between two successive read or write accesses to the same 
register, where the ordering of the read or write accesses is: 


1. 


Program order, in the event that both the reads or writes are caused by an instruction executed on this PE, 
other than one caused by a memory access by this PE. 


The order of arrival of asynchronous reads and writes at the PE relative to the execution of instructions that 
cause reads or writes. 


The order of arrival of asynchronous reads and writes at the PE relative to each other. 


Table D13-1 Synchronization requirements 





First read-write Second read-write Synchronization requirement 















































Direct read Direct read None 

Direct write None 

Indirect read None 

Indirect write None, see Notes on page D13-2821 
Direct write Direct read None 

Direct write None 

Indirect read Required 

Indirect write None, see Notes on page D13-2821 
Indirect read Direct read None 

Direct write None 

Indirect read None 

Indirect write None 
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Table D13-1 Synchronization requirements (continued) 





First read-write Second read-write Synchronization requirement 











Indirect write Direct read Required, see Notes 
Direct write None, see Notes 
Indirect read Required, see Notes 
Indirect write None, see Notes 





The terms Direct read, Direct write, Indirect read, and Indirect write, as used in Table D13-1 on page D13-2820, are 
defined as follows: 


Direct read 


Direct write 


Indirect read 


Indirect write 


Where software uses a System register access instruction to read the register, see both: 
$ Instructions for accessing debug System registers on page D12-2801. 
g Instructions for accessing non-debug System registers on page D12-2803. 


Where a direct read of a register has a side-effect that changes the contents of a register, the effect 
of a direct read on that register is defined to be an indirect write. In this case, the indirect write is 
only guaranteed to have occurred, and be visible to subsequent direct or indirect reads or writes, if 
synchronization is performed after the direct read. 


Where software uses a System register access instruction to write to the register, see both: 
è Instructions for accessing debug System registers on page D12-2801. 
. Instructions for accessing non-debug System registers on page D12-2803. 


Where a direct write to a register has an effect on the register that means that the value in the register 
is not always the last value that is written (as is the case with set and clear registers), the effect of a 
direct write on that register is defined to be an indirect write. In this case, the indirect write is only 
guaranteed to be visible to subsequent direct or indirect reads or writes if synchronization is 
performed after the direct write and before the subsequent direct or indirect reads or writes. 


Where an instruction uses a System register to establish operating conditions for the instruction, for 
example, the TTBR_ELx address or whether memory accesses are forced to be Non-cacheable. This 
includes situations where the contents of one System register selects what value is read or written 

using a different register. Indirect reads also include reads of the System register by external agents 
such as debuggers. Where an indirect read of a register has a side-effect that changes the contents 

of that register, that is defined to be an indirect write. 


Where a System register is written as the consequence of some other instruction, exception, 
operation, or by the asynchronous operation of an external agent, including the passage of time as 
seen in counters, timers, or performance counters, the assertion of interrupts, or writes from an 
external debugger. 


— Note 


Since an exception is context synchronizing, registers such as the Exception Syndrome registers that 
are indirectly written as part of exception entry do not require additional synchronization. 





Where a direct read or write to a register is followed by an indirect write caused by an external agent, autonomous 
asynchronous event, or as a result of memory mapped write, synchronization is required to guarantee the order of 
those two accesses. 


Where an indirect write caused by a direct write is followed by an indirect write caused by an external agent, 
autonomous asynchronous event, or as a result of memory mapped write, synchronization is required to guarantee 
the order of those two indirect accesses. 
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Where a direct read to one register causes a bit or field in a different register (or the same register using a different 
encoding) to be updated, the change to the different register (or same register using a different encoding) is defined 
to be an indirect write. In this case, the indirect write is only guaranteed to be visible to subsequent direct or indirect 
reads or writes if synchronization is performed after the direct read and before the subsequent direct or indirect reads 
or writes. 


Where a direct write to one register causes a bit or field in a different register (or the same register using a different 
encoding) to be updated as a side-effect of that direct write (as opposed to simply being a direct write to the different 
encoding), the change to the different register (or same register using a different encoding) is defined to be an 
indirect write. In this case, the indirect write is only guaranteed to be visible to subsequent direct or indirect reads 
or writes if synchronization is performed after the direct write and before the subsequent direct or indirect reads or 
writes. 


Where indirect writes are caused by the actions of external agents such as debuggers, or by memory-mapped reads 
or writes by the PE, then an indirect write by that agent and mechanism to a register, followed by an indirect read 
by that agent and mechanism to the same register using the same address, does not require synchronization. 


Where an indirect write occurs as a side-effect of an access, this happens atomically with the access, meaning no 
other accesses are allowed between the register access and its side-effect. 


Indirect writes caused by external agents, autonomous asynchronous events, or as a result of memory-mapped 
writes, to the registers shown in Table D13-2, are required to be observable to: 


: Direct reads in finite time without explicit synchronization. 


° Subsequent indirect reads without explicit synchronization. 


Without explicit synchronization to guarantee the order of the accesses, where the same register is accessed by two 
or more of a System register access instruction, and external agent, and autonomous asynchronous event, or as a 
result of a memory-mapped access, the behavior must be as if the accesses occurred atomically and in any order. 
This applies even if the accesses occur simultaneously. 


Table D13-2 Registers with a guarantee of observability, VMSAv8-64 














Registers Notes 

ISR ELI Interrupt Status Register 
DBGCLAIMCLR_EL1, DBGCLAIMSET_EL1 Debug CLAIM registers 
CNTPCT_ELO, CNTVCT_ELO, CNTP_TVAL_ELO, Generic Timer registers 


CNTV_TVAL_ ELO, CNTHP_TVAL EL2,CNTPS TVAL EL1 





PMCCNTR_ELO, PMEVCNTR<n>_EL0, PMXEVCNTR_ELO, PMU Counters 
PMOVSCLR_ELO, PMOVSSET_ELO 





DBGDTRTX_EL0, DBGDTRRX_EL0, DBGDTR_ELO, and the DCC Debug Communication Channel registers 
flags in MDCCSR_ELO and EDSCR 





EDSCR.PipeAdv 


External Debug Status and Control Register PipeAdv field 





D13-2822 


In addition to the requirements shown in Table D13-2: 


° Indirect writes to the following registers as a result of memory-mapped writes, including accesses by external 
agents, are required to be observable to the indirect read made in determining the response to a subsequent 
memory-mapped access without explicit synchronization: 


—  OSLAR_EL1.OSLAR_ EL] is indirectly read to determine whether the subsequent access is 
permitted. 


—  EDLAR, if implemented. EDLAR is indirectly read to determine whether a subsequent write or 
side-effect of an access is ignored. 
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Note 


This requirement is stricter than the general requirement for the observability of indirect writes. 





The requirement that an indirect write to the registers in Table D13-2 on page D13-2822 is observable to 
direct reads in finite time does not imply that all observers will observe the indirect write at the same time. 


For example, an increment of the system counter is an autonomous asynchronous event that performs an 
indirect write to the counter. This asynchronous event might generate a timer interrupt request, resulting in a 
Context synchronization event. When a GIC is used, the timer interrupt might arrive at the GIC after the PE 
has taken an interrupt request from another source, but before software reads the current interrupt ID from 
the GIC. This means that the GIC might identify the timer interrupt as the current interrupt. Software must 
not assume that a subsequent direct read of the counter register is guaranteed to observe the updated value of 
that register. 


Although this example uses the counter-timer registers, it applies equally to other registers that might be 
linked to interrupt requests, including the PMU and Statistical Profiling status registers. 


When the PE is in Debug state, there are synchronization requirements for the Debug Communication 
Channel and Instruction Transfer registers. See DCC and ITR access in Debug state on page H4-6784. 


Note 





The provision of explicit synchronization requirements to System registers is provided to allow the direct 
access to these registers to be implemented in a small number of cycles, and that updates to multiple registers 
can be performed quickly with the synchronization penalty being paid only when the updates have occurred. 


Since toolkits might use registers such as the thread-local storage registers within compiled code, it is 
recommended that access to these registers is implemented to take a small number of cycles. 


While no synchronization is required between a direct write and a direct read, or between a direct read and 
an indirect write, this does not imply that a direct read causes synchronization of a previous direct write. That 
is, the sequence direct write — direct read — indirect read, with no intervening context synchronization, 
does not guarantee that the indirect read observes the result of the direct write. 





D13.1.3 Principles of the ID scheme for fields in ID registers 


ARM DDI 0487E.a 
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The Arm architecture specifies a number of ID registers that are characterized as comprising a set of 4-bit ID fields, 
Each ID field identifies the presence, and possibly the level of support for, a particular feature in an implementation 
of the architecture. These fields follow an architectural model that aids their use by software and provides future 
compatibility. This section describes that model. ZD registers to which this scheme applies on page D13-2825 
identifies the set of ID registers. 


A small number of ID fields do not follow the scheme described in this section. In these cases, the field description 
states that it does not follow this scheme. 


Note 
The ID fields described here are distinct from register fields that enumerate the number of resources, such as 
the number of breakpoints, watchpoints, or performance monitors, or the amount of memory. 


ID fields that do not follow this scheme include the ID AA64DFRO_EL1.PMUVer, 
ID_DFRO_EL1.PerfMon, ID_DFRO.PerfMon and EDDFR.PMUVer fields, see Alternative ID scheme used 
for the Performance Monitors Extension version on page D13-2825. 


The presence of an ID field for a feature does not imply that the feature is optional. 





To provide forward compatibility, software can rely on the features of these fields that are described in this section. 
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The ID fields, which are either signed or unsigned, use increasing numerical values to indicate increases in 
functionality. Therefore, if a value of 0x1 indicates the presence of some instructions, then the value 0x2 will indicate 
the presence of those instructions plus some additional instructions or functionality. This means software can be 
written in the form: 


if (value >= number) { // do something that relies on the value of the feature} 


For ID fields where the value 0x@ defines that a feature is not present, the field holds an unsigned value. This covers 
the vast majority of such fields. 


In a few cases, the architecture has been changed to permit implementations to exclude a feature that has previously 
been required and for which no ID field has been defined. In these cases, a new ID field is defined and: 


. The field holds a signed value. 


° The field value 0xF indicates that the feature is not implemented. 
° The field value 0x0 indicates that the feature is implemented. 
° Software that depends on the feature can use the test: 
if value >= 0 { // Software features that depend on the presence of the hardware 


feature } 


In some cases, it has been decided retrospectively that the increase in functionality between two consecutive 
numerical values is too great, and it is desirable to permit an intermediate degree of functionality, and the means to 
discover this. This is done by the introduction of a fractional field that both: 


è Is referred to in the definition of the original field. 
$ Applies only when the original field is at the lower value of the step. 


In principle, a fractional field can be used for two different fractional steps, with different meanings associated with 
each of these steps. For this reason, a fractional field must be interpreted in the context of the field to which it relates 
and the value of that field. Example D13-1 shows the use of such a field. 


Example D13-1 Example of the use of a fractional field 


For a field describing some class of functionality: 
< The value 0x1 was defined as indicating that item A is present. 
à The value 0x2 was defined as indicating that items B and C are present, in addition to item A. 


Subsequently, it might be necessary to introduce a second ID field to indicate that A and B only are present. This 
new field is a fractional field, and might be defined as having the value 0x1 when A and B only are present. This 
fractional field is valid only when the original ID field has the value 0x1. 


This approach means that: 


. Software that depends on the test if (value >= 0x2) can rely on features A, B, and C being present, 
° Software that depends on the test if (value >= 0x1) can rely on feature A being present. 
è If new software needs to check only that features A and B are present, then it can test: 
if (value >= 0x2 || (value == 0x1 && fractional_value >= 0x1)) { // Software features 


that depend on A and B only } 


A fractional field uses the same approach of increasing numerical values indicating increasing functionality, and the 
fractional approach can also be applied recursively to fractional fields. 


Unused ID fields, and fractional fields that are not applicable, are RESO to allow their future use when features, or 
fractional implementation options, are added. 
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ID registers to which this scheme applies 
This scheme applies to the following registers: 


AArché64 System registers 
° The AArch64 views of the AArch32 feature ID registers given by: 
— The AArch32 Auxiliary Feature register ID AFRO EL1. 
— The AArch32 Processor Feature registers ID PFRO EL1 and ID PFRI1 ELI. 
— The AArch32 Debug Feature register ID DFRO EL1. 


— The AArch32 Memory Model Feature registers ID MMFRO_EL1, 
ID_MMFR1 EL1, ID MMFR2 EL1, ID MMFR3_ ELI, and ID MMFR4 ELI. 


— The AArch32 Instruction Set Attribute registers ID ISARO EL1, ID ISAR1_ ELI, 
ID_ISAR2 EL1, ID ISAR3_ EL1, ID ISAR4 EL1, andID_ISARS ELI. 


— The AArch32 Media and VFP Feature registers MVFRO_EL1, MVFR1_EL1, and 
MVFR2 ELI. 


a The AArch64 Auxiliary Feature registers ID AA64AFRO_EL1 and ID _AA64AFRI1 ELI. 
` The AArch64 Processor Feature registers ID_AA64PFR0_EL1 and ID_AA64PFR1_EL1. 
The AArch64 Debug Feature registers ID_AA64DFR0_EL1 and ID_AA64DFR1_EL1. 


= The AArch64 Memory Model Feature registers ID AA64MMFRO ELI, 
ID_AA64MMEFR1 ELI, and ID AA64MMFR2 ELI. 


G The AArch64 Instruction Set Attribute registers ID_AA64ISAR0_EL1 and 
ID_AA64ISAR1_EL1. 











AArch32 System registers 
š The AArch32 Auxiliary Feature register ID_AFRO. 
. The AArch32 Processor Feature registers ID _PFRO and ID_PFR1. 
à The AArch32 Debug Feature register ID_DFRO. 


a The AArch32 Memory Model Feature registers ID_MMFRO, ID_MMFR1, ID_MMFR2, 
ID_MMER3, and ID_ MMFR4. 


s The AArch32 Instruction Set Attribute registers ID ISARO, ID_ISAR1, ID_ISAR2, 
ID_ISAR3, ID_ISAR4, and ID_ISARS. 


. The AArch32 Media and FP Feature registers MVFRO, MVFR1, and MVFR2. 


Memory-mapped registers 
g The External Debug Processor Feature register EDPFR. 
$ The External Debug Feature register EDDFR. 


Alternative ID scheme used for the Performance Monitors Extension version 


The ID_AA64DFR0_EL1.PMUVer, ID_DFRO_EL1.PerfMon, ID_DFRO.PerfMon and EDDFR.PMUVer fields, 
that identify the version of the Performance Monitors Extension, do not follow the standard ID scheme. Software 
must treat these fields as follows: 


° The value 0xF indicates that the Arm-architected Performance Monitors Extension is not implemented. 
° If the field value is not 0xF the field is treated as an unsigned value, as described for the standard ID scheme. 


This means that software that depends on the implementation of a particular version of the Arm Performance 
Monitors Extension must be written in the form: 


if (value != @xF and value >= number) { // do something that relies on version 'number' of the 


feature } 


For these fields, Arm deprecates use of the value @xF in new implementations. 
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D13.2 General system control registers 


This section lists the System registers in AArch64 that are not part of one of the other listed groups. 
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D13.2.1 ACTLR_EL1, Auxiliary Control Register (EL1) 


The ACTLR_EL1 characteristics are: 


63 
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Purpose 


Provides IMPLEMENTATION DEFINED configuration and control options for execution at EL1 and 
ELO. 





Note 

Arm recommends the contents of this register have no effect on the PE when HCR_EL2.{E2H, 
TGE} is {1, 1}, and instead the configuration and control fields are provided by the ACTLR_EL2 
register. This avoids the need for software to manage the contents of these register when switching 
between a Guest OS and a Host OS. 





Configurations 


Attributes 


AArch64 System register ACTLR_EL1[31:0] is architecturally mapped to AArch32 System 
register ACTLR[31:0]. 


AArch64 System register ACTLR_EL1[63:32] is architecturally mapped to AArch32 System 
register ACTLR2[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


ACTLR_EL1 is a 64-bit register. 


Field descriptions 


The ACTLR_EL1 bit assignments are: 








0 
IMPLEMENTATION DEFINED 
IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 
Accessing the ACTLR_EL1 
Accesses to this register use the following encodings in the System instruction encoding space: 
MRS <Xt>, ACTLR_EL1 
op0 op1 CRn CRm op2 
Ob11 0b000 0b0001 0b0000 0b001 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TACR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
return NVMem[0x118] ; 
else 
return ACTLR_EL1; 
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elsif PSTATE.EL == EL2 then 
return ACTLR_EL1; 

elsif PSTATE.EL == EL3 then 
return ACTLR_EL1; 


MSR ACTLR_EL1, <Xt> 


op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0000 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TACR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
NVMem[@x118] = X[t]; 
else 
ACTLR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
ACTLR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ACTLR_EL1 = X[t]; 
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D13.2.2 ACTLR_EL42, Auxiliary Control Register (EL2) 


The ACTLR_EL2 characteristics are: 
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Purpose 


Provides IMPLEMENTATION DEFINED configuration and control options for EL2. 


Note 
Arm recommends the contents of this register are updated to apply to ELO when HCR_EL2.{E2H, 
TGE} is {1, 1}, gaining configuration and control fields from the ACTLR_EL1. This avoids the 


need for software to manage the contents of these register when switching between a Guest OS and 
a Host OS. 





Configurations 


Attributes 


AArch64 System register ACTLR_EL2[31:0] is architecturally mapped to AArch32 System 
register HACTLR[31:0]. 


AArch64 System register ACTLR_EL2[63:32] is architecturally mapped to AArch32 System 
register HACTLR2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


ACTLR_EL2 is a 64-bit register. 


Field descriptions 


The ACTLR_EL2 bit assignments are: 











0 
IMPLEMENTATION DEFINED 
IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 
Accessing the ACTLR_EL2 
Accesses to this register use the following encodings in the System instruction encoding space: 
MRS <Xt>, ACTLR_EL2 
op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
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elsif PSTATE.EL == EL2 then 
return ACTLR_EL2; 

elsif PSTATE.EL == EL3 then 
return ACTLR_EL2; 


MSR ACTLR_EL2, <Xt> 





op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
ACTLR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
ACTLR_EL2 = X[t]; 
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D13.2.3 ACTLR_EL3, Auxiliary Control Register (EL3) 
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The ACTLR_EL3 characteristics are: 


Purpose 

Provides IMPLEMENTATION DEFINED configuration and control options for EL3. 
Configurations 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ACTLR_EL3 is a 64-bit register. 


Field descriptions 


The ACTLR_EL3 bit assignments are: 

















0 
IMPLEMENTATION DEFINED 
IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 
Accessing the ACTLR_EL3 
Accesses to this register use the following encodings in the System instruction encoding space: 
MRS <Xt>, ACTLR_EL3 
op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return ACTLR_EL3; 
MSR ACTLR_EL3, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
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UNDEFINED; 
elsif PSTATE.EL == EL3 then 
ACTLR_EL3 = X[t]; 
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D13.2.4 AFSRO_EL41, Auxiliary Fault Status Register 0 (EL‘) 
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The AFSRO_EL1 characteristics are: 


Purpose 
Provides additional IMPLEMENTATION DEFINED fault status information for exceptions taken to EL1. 
Configurations 
AArch64 System register AFSRO_EL1[31:0] is architecturally mapped to AArch32 System register 
ADFSR{[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AFSRO_ ELI is a 64-bit register. 


Field descriptions 


The AFSRO_EL1 bit assignments are: 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the AFSRO_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic AFSRO_EL1 or 
AFSRO_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AFSRO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0101 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x128] ; 
else 
return AFSRQ_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return AFSRQ_EL2; 
else 
return AFSRQ_EL1; 
elsif PSTATE.EL == EL3 then 
return AFSRQ_EL1; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-2833 
Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


MSR AFSRO_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b0101 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x128] = X[t]; 
else 
AFSRQ_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
AFSRQ_EL2 = X[t]; 
else 
AFSRQ_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
AFSR@_EL1 = X[t]; 


MRS <Xt>, AFSRO_EL12 





op0 op1 CRn CRm op2 





0b11 0b101 0b0101 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x128]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return AFSRQ_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return AFSRQ_EL1; 
else 
UNDEFINED; 


MSR AFSRO_EL12, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b0101 0b0001 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x128] = X[t]; 
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elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
AFSRQ_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
AFSRQ_EL1 = X[t]; 
else 
UNDEFINED; 
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D13.2.5 


D13-2836 


AFSRO_EL2, Auxiliary Fault Status Register 0 (EL2) 


The AFSRO_EL2 characteristics are: 
Purpose 
Provides additional IMPLEMENTATION DEFINED fault status information for exceptions taken to EL2. 


Configurations 


AArch64 System register AFSRO_EL2[31:0] is architecturally mapped to AArch32 System register 
HADFSR{31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AFSRO_EL2 is a 64-bit register. 


Field descriptions 


The AFSRO_EL2 bit assignments are: 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the AFSRO_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic AFSRO_EL2 or 
AFSRO_ EL! are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AFSRO_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0101 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return AFSRQ_EL2; 
elsif PSTATE.EL == EL3 then 
return AFSRQ_EL2; 
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MSR AFSRO_EL2, <Xt> 














op0 op1 CRn CRm op2 
0b11 0b100 0b0101 0b0001 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
AFSR@_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
AFSR@_EL2 = X[t]; 
MRS <Xt>, AFSRO_EL1 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x128]; 
else 
return AFSRQ_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return AFSRQ_EL2; 
else 
return AFSRQ_EL1; 
elsif PSTATE.EL == EL3 then 
return AFSRQ_EL1; 


MSR AFSRO_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b0101 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x128] = X[t]; 
else 
AFSRQ_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
AFSRQ_EL2 = X[t]; 
else 
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AFSRQ_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
AFSRQ_EL1 = X[t]; 
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The AFSRO_EL3 characteristics are: 


Purpose 

Provides additional IMPLEMENTATION DEFINED fault status information for exceptions taken to EL3. 
Configurations 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AFSRO_EL3 is a 64-bit register. 


Field descriptions 


The AFSRO_EL3 bit assignments are: 

















0 
IMPLEMENTATION DEFINED 
IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 
Accessing the AFSRO_EL3 
Accesses to this register use the following encodings in the System instruction encoding space: 
MRS <Xt>, AFSRO_EL3 
op0 op1 CRn CRm op2 
0b11 0b110 0b0101 0b0001 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return AFSRQ_EL3; 
MSR AFSRO_EL3, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b110 0b0101 0b0001 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
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UNDEFINED; 
elsif PSTATE.EL == EL3 then 
AFSR@_EL3 = X[t]; 
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The AFSR1_EL1 characteristics are: 


Purpose 
Provides additional IMPLEMENTATION DEFINED fault status information for exceptions taken to EL1. 
Configurations 
AArch64 System register AFSR1_EL1[31:0] is architecturally mapped to AArch32 System register 
AIFSR[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AFSRI1_ ELI is a 64-bit register. 


Field descriptions 


The AFSR1_ EL! bit assignments are: 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the AFSR1_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic AFSR1_EL1 or 
AFSR1_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AFSR1_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0101 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x130]; 
else 
return AFSR1_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return AFSR1_EL2; 
else 
return AFSR1_EL1; 
elsif PSTATE.EL == EL3 then 
return AFSR1_EL1; 
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MSR AFSR1_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b0101 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x130] = X[t]; 
else 
AFSR1_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
AFSR1_EL2 = X[t]; 
else 
AFSR1_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
AFSR1_EL1 = X[t]; 


MRS <Xt>, AFSR1_EL12 





op0 op1 CRn CRm op2 





0b11 0b101 0b0101 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x130] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return AFSR1_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return AFSR1_EL1; 
else 
UNDEFINED; 


MSR AFSR1_EL12, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b0101 0b0001 0b001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x130] = X[t]; 
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elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
AFSR1_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
AFSR1_EL1 = X[t]; 
else 
UNDEFINED; 


AArch64 System Register Descriptions 
D13.2 General system control registers 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-2843 


Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


D13.2.8 


D13-2844 


AFSR1_EL2, Auxiliary Fault Status Register 1 (EL2) 


The AFSR1_EL2 characteristics are: 
Purpose 
Provides additional IMPLEMENTATION DEFINED fault status information for exceptions taken to EL2. 


Configurations 


AArch64 System register AFSR1_EL2[31:0] is architecturally mapped to AArch32 System register 
HAIFSR{31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AFSRI1_EL2 is a 64-bit register. 


Field descriptions 


The AFSR1_EL2 bit assignments are: 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the AFSR1_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic AFSR1_EL2 or 
AFSRI1_ ELI are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AFSR1_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0101 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return AFSR1_EL2; 
elsif PSTATE.EL == EL3 then 
return AFSR1_EL2; 
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MSR AFSR1_EL2, <Xt> 














op0 op1 CRn CRm op2 
0b11 0b100 0b0101 0b0001 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
AFSR1_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
AFSR1_EL2 = X[t]; 
MRS <Xt>, AFSR1_EL1 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x130]; 
else 
return AFSR1_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return AFSR1_EL2; 
else 
return AFSR1_EL1; 
elsif PSTATE.EL == EL3 then 
return AFSR1_EL1; 


MSR AFSR1_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b0101 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x130] = X[t]; 
else 
AFSR1_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
AFSR1_EL2 = X[t]; 
else 
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AFSR1_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
AFSR1_EL1 = X[t]; 
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The AFSR1_EL3 characteristics are: 


Purpose 

Provides additional IMPLEMENTATION DEFINED fault status information for exceptions taken to EL3. 
Configurations 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AFSR1_EL3 is a 64-bit register. 


Field descriptions 


The AFSR1_EL3 bit assignments are: 

















0 
IMPLEMENTATION DEFINED 
IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 
Accessing the AFSR1_EL3 
Accesses to this register use the following encodings in the System instruction encoding space: 
MRS <Xt>, AFSR1_EL3 
op0 op1 CRn CRm op2 
0b11 0b110 0b0101 0b0001 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return AFSR1_EL3; 
MSR AFSR1_EL3, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b110 0b0101 0b0001 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
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UNDEFINED; 
elsif PSTATE.EL == EL3 then 
AFSR1_EL3 = X[t]; 
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The AIDR_ ELI characteristics are: 


Purpose 
Provides IMPLEMENTATION DEFINED identification information. 
The value of this register must be interpreted in conjunction with the value of MIDR_EL1. 
Configurations 
AArch64 System register AIDR_EL1[31:0] is architecturally mapped to AArch32 System register 
AIDR{[3 1:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AIDR_ EL! is a 64-bit register. 


Field descriptions 


The AIDR_ EL! bit assignments are: 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


Accessing the AIDR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AIDR_EL1 





op0 op1 CRn CRm op2 





0b11 0b001 0b0000 0b0000 0b111 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID1 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return AIDR_EL1; 
elsif PSTATE.EL == EL2 then 
return AIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return AIDR_EL1; 
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D13.2.11 AMAIR_EL1, Auxiliary Memory Attribute Indirection Register (EL1) 
The AMAIR EL! characteristics are: 


Purpose 


Provides IMPLEMENTATION DEFINED memory attributes for the memory regions specified by 
MAIR ELI. 


Configurations 


AArch64 System register AMAIR_EL1[31:0] is architecturally mapped to AArch32 System 
register AMAIRO[31:0]. 


AArch64 System register AMAIR_EL1[63:32] is architecturally mapped to AArch32 System 
register AMAIR1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMAIR ELl] is a 64-bit register. 


Field descriptions 


The AMAIR_ EL! bit assignments are: 


63 0 


IMPLEMENTATION DEFINED 


AMAIR_ EL! is permitted to be cached in a TLB. 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the AMAIR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic AMAIR_EL1 
or AMAIR_ EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMAIR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0011 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x148] ; 
else 
return AMAIR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return AMAIR_EL2; 
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else 
return AMAIR_EL1; 
elsif PSTATE.EL == EL3 then 
return AMAIR_EL1; 


MSR AMAIR_EL1, <Xt> 


op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0011 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x148] = X[t]; 
else 
AMAIR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
AMAIR_EL2 = X[t]; 
else 
AMAIR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
AMAIR_EL1 = X[t]; 


MRS <Xt>, AMAIR_EL12 





op0 op1 CRn CRm op2 


0b11 0b101 0b1010 0b0011 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x148] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return AMAIR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return AMAIR_EL1; 
else 
UNDEFINED; 
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MSR AMAIR_EL12, <Xt> 





op0 op1 CRn CRm 


0b11 0b101 0b1010 0b0011 


op2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x148] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
AMAIR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
AMAIR_EL1 = X[t]; 
else 
UNDEFINED; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


D13.2.12 AMAIR_EL2, Auxiliary Memory Attribute Indirection Register (EL2) 


63 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


The AMAIR_EL2 characteristics are: 


Purpose 


Provides IMPLEMENTATION DEFINED memory attributes for the memory regions specified by 


MAIR EL2. 


Configurations 


AArch6é4 System register AMAIR_EL2[31:0] is architecturally mapped to AArch32 System 


register HAMAIRO[3 1:0]. 


AArch6é4 System register AMAIR_EL2[63:32] is architecturally mapped to AArch32 System 


register HAMAIR1[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 


This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMAIR_ EL2 is a 64-bit register. 


Field descriptions 


The AMAIR_EL2 bit assignments are: 


IMPLEMENTATION DEFINED 


AMAIR_ EL2 is permitted to be cached in a TLB. 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the AMAIR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic AMAIR_EL2 
or AMAIR EL] are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMAIR_EL2 











op0 op1 CRn CRm op2 
0b11 0b100 0b1010 0b0011 0b000 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return AMAIR_EL2; 
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elsif PSTATE.EL == EL3 then 
return AMAIR_EL2; 


MSR AMAIR_EL2, <Xt> 





op0 op1 


CRn 


CRm 


op2 





0b11 0b100 


0b1010 


0b0011 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
AMAIR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
AMAIR_EL2 = X[t]; 


MRS <Xt>, AMAIR_EL1 





op0 op1 


CRn 


CRm 


op2 





0b11 0b000 


0b1010 


0b0011 


0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == 


AArch64.SystemAccessTrap(EL2, 0x18); 


'1' then 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


return NVMem[0x148] ; 
else 
return AMAIR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return AMAIR_EL2; 
else 
return AMAIR_EL1; 
elsif PSTATE.EL == EL3 then 
return AMAIR_EL1; 


MSR AMAIR_EL1, <Xt> 





op0 op1 


0b11 0b000 


CRn 


0b1010 


CRm 


0b0011 


op2 


0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


NVMem[0x148] = X[t]; 
else 
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elsif PSTATE.EL == EL2 then 
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AMAIR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
AMAIR_EL1 = X[t]; 
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D13.2.13 AMAIR_EL3, Auxiliary Memory Attribute Indirection Register (EL3) 


The AMAIR EL3 characteristics are: 


Purpose 
Provides IMPLEMENTATION DEFINED memory attributes for the memory regions specified by 
MAIR EL3. 

Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


AMAIR EL3 is a 64-bit register. 


Field descriptions 


The AMAIR_EL3 bit assignments are: 


63 0 


IMPLEMENTATION DEFINED 


AMAIR _ EL3 is permitted to be cached in a TLB. 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the AMAIR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMAIR_EL3 











op0 op1 CRn CRm op2 
0b11 0b110 0b1010 0b0011 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return AMAIR_EL3; 
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MSR AMAIR_EL3, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b110 0b1010 0b0011 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
AMAIR_EL3 = X[t]; 
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D13.2.14 APDAKeyHi_EL1, Pointer Authentication Key A for Data (bits[127:64]) 


63 





D13-2858 


The APDAKeyHi EL] characteristics are: 


Purpose 
Holds bits[127:64] of key A used for authentication of data pointer values. 


Note 


The term APDAKey ELI is used to describe the concatenation of APDAKeyHi_ EL}: 
APDAKeyLo_EL1. 








Configurations 


This register is present only when ARMv8.3-PAuth is implemented. Otherwise, direct accesses to 
APDAKeyHi_ EL! are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APDAKeyHi EL! is a 64-bit register. 


Field descriptions 


The APDAKeyHi EL] bit assignments are: 


64 bit value, bits[127:64] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[127:64] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APDAKeyHi_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APDAKeyHi_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0010 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APDAKeyHi_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APDAKeyHi_EL1; 
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elsif PSTATE.EL == EL3 then 
return APDAKeyHi_EL1; 


MSR APDAKeyHi_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0010 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APDAKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APDAKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APDAKeyHi_EL1 = X[t]; 
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D13.2.15 APDAKeyLo_EL1, Pointer Authentication Key A for Data (bits[63:0]) 


63 





D13-2860 


The APDAKeyLo_EL]1 characteristics are: 


Purpose 
Holds bits[63:0] of key A used for authentication of data pointer values. 


Note 


The term APDAKey ELI is used to describe the concatenation of APDAKeyHi_ ELI: 
APDAKeyLo_EL1. 








Configurations 


This register is present only when ARMv8.3-PAuth is implemented. Otherwise, direct accesses to 
APDAKeyLo_EL1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APDAKeyLo_ EL] is a 64-bit register. 


Field descriptions 


The APDAKeyLo_EL] bit assignments are: 


64 bit value, bits[63:0] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[63:0] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APDAKeyLo_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APDAKeyLo_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0010 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APDAKeyLo_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APDAKeyLo_EL1; 
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elsif PSTATE.EL == EL3 then 
return APDAKeyLo_EL1; 


MSR APDAKeyLo_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0010 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APDAKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APDAKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APDAKeyLo_EL1 = X[t]; 
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D13.2.16 APDBKeyHi_EL1, Pointer Authentication Key B for Data (bits[127:64]) 


63 





D13-2862 


The APDBKeyHi ELI characteristics are: 


Purpose 
Holds bits[127:64] of key B used for authentication of data pointer values. 


Note 


The term APDBKey_ EL] is used to describe the concatenation of APDBKeyHi_ EL1: 
APDBKeyLo _ EL1. 








Configurations 


This register is present only when ARMv8.3-PAuth is implemented. Otherwise, direct accesses to 
APDBKeyHi EL] are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APDBKeyHi EL] is a 64-bit register. 


Field descriptions 


The APDBKeyHi_ EL! bit assignments are: 


64 bit value, bits[127:64] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[127:64] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APDBKeyHi_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APDBKeyHi_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0010 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APDBKeyHi_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APDBKeyHi_EL1; 
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elsif PSTATE.EL == EL3 then 
return APDBKeyHi_EL1; 


MSR APDBKeyHi_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0010 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APDBKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APDBKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APDBKeyHi_EL1 = X[t]; 
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D13.2.17 APDBKeyLo_EL1, Pointer Authentication Key B for Data (bits[63:0]) 


63 





D13-2864 


The APDBKeyLo_ EL] characteristics are: 


Purpose 
Holds bits[63:0] of key B used for authentication of data pointer values. 


Note 


The term APDBKey_ EL] is used to describe the concatenation of APDBKeyHi EL}: 
APDBKeyLo EL1. 








Configurations 


This register is present only when ARMv8.3-PAuth is implemented. Otherwise, direct accesses to 
APDBKeyLo_EL]1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APDBKeyLo_EL1 is a 64-bit register. 


Field descriptions 


The APDBKeyLo_ EL! bit assignments are: 


64 bit value, bits[63:0] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[63:0] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APDBKeyLo_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APDBKeyLo_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0010 0b010 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APDBKeyLo_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APDBKeyLo_EL1; 
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elsif PSTATE.EL == EL3 then 
return APDBKeyLo_EL1; 


MSR APDBKeyLo_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0010 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APDBKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APDBKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APDBKeyLo_EL1 = X[t]; 
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D13.2.18 APGAKeyHi_EL1, Pointer Authentication Key A for Code (bits[127:64]) 


63 





D13-2866 


The APGAKeyHi EL] characteristics are: 


Purpose 
Holds bits[127:64] of key used for generic pointer authentication code. 


Note 


The term APGAKey_ ELI is used to describe the concatenation of APGAKeyHi_EL1: 
APGAKeyLo_EL1. 








Configurations 


This register is present only when ARMVv8.3-PAuth is implemented. Otherwise, direct accesses to 
APGAKeyHi_ EL! are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APGAKeyHi EL] is a 64-bit register. 


Field descriptions 


The APGAKeyHi EL] bit assignments are: 


64 bit value, bits[127:64] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[127:64] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APGAKeyHi_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APGAKeyHi_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0011 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APGAKeyHi_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APGAKeyHi_EL1; 
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elsif PSTATE.EL == EL3 then 
return APGAKeyHi_EL1; 


MSR APGAKeyHi_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0011 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APGAKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APGAKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APGAKeyHi_EL1 = X[t]; 
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D13.2.19 APGAKeyLo_EL1, Pointer Authentication Key A for Code (bits[63:0]) 


63 





D13-2868 


The APGAKeyLo_EL]1 characteristics are: 


Purpose 
Holds bits[63:0] of key used for generic pointer authentication code. 


Note 


The term APGAKey_ ELI is used to describe the concatenation of APGAKeyHi_EL1: 
APGAKeyLo_EL1. 








Configurations 


This register is present only when ARMv8.3-PAuth is implemented. Otherwise, direct accesses to 
APGAKeyLo_EL1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APGAKeyLo_ EL] is a 64-bit register. 


Field descriptions 


The APGAKeyLo_EL] bit assignments are: 


64 bit value, bits[63:0] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[63:0] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APGAKeyLo_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APGAKeyLo_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0011 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APGAKeyLo_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APGAKeyLo_EL1; 
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elsif PSTATE.EL == EL3 then 
return APGAKeyLo_EL1; 


MSR APGAKeyLo_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0011 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APGAKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APGAKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APGAKeyLo_EL1 = X[t]; 
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D13.2.20 APIAKeyHi_EL1, Pointer Authentication Key A for Instruction (bits[127:64]) 


63 





D13-2870 


The APIAKeyHi EL] characteristics are: 


Purpose 
Holds bits[127:64] of key A used for authentication of instruction pointer values. 


Note 


The term APIAKey_ EL] is used to describe the concatenation of APIAKeyHi_EL1: 
APIAKeyLo_EL1. 








Configurations 


This register is present only when ARMv8.3-PAuth is implemented. Otherwise, direct accesses to 
APIAKeyHi_EL1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APIAKeyHi_ ELI is a 64-bit register. 


Field descriptions 


The APIAKeyHi EL] bit assignments are: 


64 bit value, bits[127:64] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[127:64] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APIAKeyHi_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APIAKeyHi_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APIAKeyHi_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APIAKeyHi_EL1; 
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elsif PSTATE.EL == EL3 then 
return APIAKeyHi_EL1; 


MSR APIAKeyHi_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0001 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APIAKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APIAKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APIAKeyHi_EL1 = X[t]; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


D13-2871 


AArch64 System Register Descriptions 
D13.2 General system control registers 


D13.2.21 APIAKeyLo_EL1, Pointer Authentication Key A for Instruction (bits[63:0]) 


63 
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The APIAKeyLo_EL1 characteristics are: 


Purpose 
Holds bits[63:0] of key A used for authentication of instruction pointer values. 


Note 


The term APIAKey_ EL] is used to describe the concatenation of APIAKeyHi_ EL}: 
APIAKeyLo_EL1. 








Configurations 


This register is present only when ARMv8.3-PAuth is implemented. Otherwise, direct accesses to 
APIAKeyLo_EL1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APIAKeyLo_EL1 is a 64-bit register. 


Field descriptions 


The APIAKeyLo_ EL]! bit assignments are: 


64 bit value, bits[63:0] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[63:0] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APIAKeyLo_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APIAKeyLo_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0001 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APIAKeyLo_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APIAKeyLo_EL1; 
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elsif PSTATE.EL == EL3 then 
return APIAKeyLo_EL1; 


MSR APIAKeyLo_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0001 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APIAKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APIAKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APIAKeyLo_EL1 = X[t]; 
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D13.2.22 APIBKeyHi_EL1, Pointer Authentication Key B for Instruction (bits[127:64]) 


63 





D13-2874 


The APIBKeyHi EL! characteristics are: 


Purpose 
Holds bits[127:64] of key B used for authentication of instruction pointer values. 


Note 


The term APIBKey_ EL] is used to describe the concatenation of APIBKeyHi_EL1: 
APIBKeyLo_EL1. 








Configurations 


This register is present only when ARMv8.3-PAuth is implemented. Otherwise, direct accesses to 
APIBKeyHi_EL1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APIBKeyHi ELI is a 64-bit register. 


Field descriptions 


The APIBKeyHi_EL1 bit assignments are: 


64 bit value, bits[127:64] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[127:64] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APIBKeyHi_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APIBKeyHi_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0001 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APIBKeyHi_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APIBKeyHi_EL1; 
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elsif PSTATE.EL == EL3 then 
return APIBKeyHi_EL1; 


MSR APIBKeyHi_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0001 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APIBKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APIBKeyHi_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APIBKeyHi_EL1 = X[t]; 
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D13.2.23 APIBKeyLo_EL1, Pointer Authentication Key B for Instruction (bits[63:0]) 


63 





D13-2876 


The APIBKeyLo_ELI characteristics are: 


Purpose 
Holds bits[63:0] of key B used for authentication of instruction pointer values. 


Note 


The term APIBKey_ EL] is used to describe the concatenation of APIBKeyHi_EL1: 
APIBKeyLo_EL1. 








Configurations 


This register is present only when ARMv8.3-PAuth is implemented. Otherwise, direct accesses to 
APIBKeyLo_EL]1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
APIBKeyLo_EL1 is a 64-bit register. 


Field descriptions 


The APIBKeyLo_ EL]! bit assignments are: 


64 bit value, bits[63:0] of the 128 bit pointer authentication key value 





Bits [63:0] 
64 bit value, bits[63:0] of the 128 bit pointer authentication key value. 


This field resets to an architecturally UNKNOWN value. 


Accessing the APIBKeyLo_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, APIBKeyLo_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0001 0b010 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APIBKeyLo_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return APIBKeyLo_EL1; 
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elsif PSTATE.EL == EL3 then 
return APIBKeyLo_EL1; 


MSR APIBKeyLo_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0001 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.APK == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APIBKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.APK == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
APIBKeyLo_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
APIBKeyLo_EL1 = X[t]; 
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D13.2.24 CCSIDR2_EL1, Current Cache Size ID Register 2 
The CCSIDR2_EL1 characteristics are: 


Purpose 


When ARMv8.3-CCIDX is implemented, provides the information about the architecture of the 
currently selected cache from bits[63:32] of CCSIDR_EL1. 


When ARMv8.3-CCIDX is not implemented, this register is not implemented. 


Configurations 


AArch64 System register CCSIDR2_EL1[31:0] is architecturally mapped to AArch32 System 
register CCSIDR2[31:0]. 


This register is present only when ARMv8.3-CCIDX is implemented. Otherwise, direct accesses to 
CCSIDR2_EL1 are UNDEFINED. 


If AArch32 is not implemented, it is IMPLEMENTATION DEFINED whether reading this register gives 
an UNKNOWN value or is UNDEFINED. 


The implementation includes one CCSIDR2_EL1 for each cache that it can access. CSSELR_EL1 
selects which Cache Size ID Register is accessible. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CCSIDR2_EL1 is a 64-bit register. 


Field descriptions 


The CCSIDR2_ EL! bit assignments are: 


63 24 23 0 


RESO NumSets 


Bits [63:24] 


Reserved, RESO. 


NumSets, bits [23:0] 


(Number of sets in cache) - 1, therefore a value of 0 indicates 1 set in the cache. The number of sets 
does not have to be a power of 2. 


Accessing the CCSIDR2_EL1 


If CSSELR_EL1.Level is programmed to a cache level that is not implemented, then on a read of the 
CCSIDR2_EL1 the behavior is CONSTRAINED UNPREDICTABLE, and can be one of the following: 


à The CCSIDR2_EL1 read is treated as NOP. 
. The CCSIDR2_EL1 read is UNDEFINED. 
$ The CCSIDR2_ EL! read returns an UNKNOWN value. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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op0 


0b11 


CRn CRm op2 


0b0000 0b0000 0b010 





if PSTATE.EL == EL@ then 


if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 


AArch64.SystemAccessTrap(EL1, 0x18); 


else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == 


AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CCSIDR2_EL1; 
elsif PSTATE.EL == EL2 then 
return CCSIDR2_EL1; 
elsif PSTATE.EL == EL3 then 
return CCSIDR2_EL1; 


== '1' then 


'1' then 


== '1' then 
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D13.2.25 © CCSIDR_EL1, Current Cache Size ID Register 
The CCSIDR_EL1 characteristics are: 


Purpose 


Provides information about the architecture of the currently selected cache. 


Configurations 


AArch64 System register CCSIDR_EL1[31:0] is architecturally mapped to AArch32 System 
register CCSIDR[3 1:0]. 


AArch64 System register CCSIDR_EL1 bits [63:32] are architecturally mapped to AArch32 
System register CCSIDR2. 


The implementation includes one CCSIDR_EL1 for each cache that it can access. CSSELR_EL1 
selects which Cache Size ID Register is accessible. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CCSIDR_EL1 is a 64-bit register. 


Field descriptions 


The CCSIDR_ELI bit assignments are: 


When ARMv8.3-CCIDX is implemented: 


56 55 32 31 24 23 3 


63 2 0 
| RESO NumSets | RESO Associativity 
Note 


The parameters NumSets, Associativity, and LineSize in these registers define the architecturally visible parameters 
that are required for the cache maintenance by Set/Way instructions. They are not guaranteed to represent the actual 
microarchitectural features of a design. You cannot make any inference about the actual sizes of caches based on 
these parameters. 











Bits [63:56] 
Reserved, RESO. 


NumSets, bits [55:32] 


(Number of sets in cache) - 1, therefore a value of 0 indicates 1 set in the cache. The number of sets 
does not have to be a power of 2. 


Bits [31:24] 
Reserved, RESO. 
Associativity, bits [23:3] 


(Associativity of cache) - 1, therefore a value of 0 indicates an associativity of 1. The associativity 
does not have to be a power of 2. 


LineSize, bits [2:0] 
(Log2(Number of bytes in cache line)) - 4. For example: 


s For a line length of 16 bytes: Log2(16) = 4, LineSize entry = 0. This is the minimum line 
length. 
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è For a line length of 32 bytes: Log2(32) = 5, LineSize entry = 1. 


When ARMv8.5-MemTag is implemented and enabled, where a cache only holds Allocation Tags, 
this field is RESO. 





Otherwise: 
63 13 12 3 2 0 
| RESO UNKNOWN NumSets | Associativity 
Note 





The parameters NumSets, Associativity, and LineSize in these registers define the architecturally visible parameters 
that are required for the cache maintenance by Set/Way instructions. They are not guaranteed to represent the actual 
microarchitectural features of a design. You cannot make any inference about the actual sizes of caches based on 
these parameters. 





Bits [63:32] 
Reserved, RESO. 


UNKNOWN, bits [31:28] 


Reserved, UNKNOWN. 


NumSets, bits [27:13] 


(Number of sets in cache) - 1, therefore a value of 0 indicates 1 set in the cache. The number of sets 
does not have to be a power of 2. 


Associativity, bits [12:3] 


(Associativity of cache) - 1, therefore a value of 0 indicates an associativity of 1. The associativity 
does not have to be a power of 2. 


LineSize, bits [2:0] 
(Log2(Number of bytes in cache line)) - 4. For example: 


- For a line length of 16 bytes: Logo(16) = 4, LineSize entry = 0. This is the minimum line 
length. 


= For a line length of 32 bytes: Logo(32) = 5, LineSize entry = 1. 


Accessing the CCSIDR_EL1 


If CSSELR_EL1.Level is programmed to a cache level that is not implemented, then on a read of the CCSIDR_EL1 
the behavior is CONSTRAINED UNPREDICTABLE, and can be one of the following: 


$ The CCSIDR_EL!1 read is treated as NOP. 
° The CCSIDR_EL!1 read is UNDEFINED. 
7 The CCSIDR_EL! read returns an UNKNOWN value. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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D13-2882 


MRS <Xt>, CCSIDR_EL1 








op0 op1 CRn CRm op2 
0b11 0b001 0b0000 0b0000 0b000 
if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


else 


return CCSIDR_EL1; 
elsif PSTATE.EL == EL2 then 
return CCSIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return CCSIDR_EL1; 
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D13.2.26 CLIDR_EL1, Cache Level ID Register 
The CLIDR_EL1 characteristics are: 


Purpose 


Identifies the type of cache, or caches, that are implemented at each level and can be managed using 
the architected cache maintenance instructions that operate by set/way, up to a maximum of seven 
levels. Also identifies the Level of Coherence (LoC) and Level of Unification (LoU) for the cache 
hierarchy. 

Configurations 


AArch64 System register CLIDR_EL1[31:0] is architecturally mapped to AArch32 System register 
CLIDR{[3 1:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CLIDR_EL1 is a 64-bit register. 


Field descriptions 


The CLIDR_EL1 bit assignments are: 


4 23 21 20,18 17,15 14, 12 11 6 5,3 2,,0 
ICB |LoUU] LoC j|LoUISI T i 


= a Ttype<n>, bjts [2(n-fl )+34:2(n-1)+33]. for n = 1 to 7 
Ctype1 
Ctype2 
Ctype3 
Ctype4 
Ctype5 
Ctype6 
Ctype7 


Bits [63:47] 
Reserved, RESO. 
Ttype<n>, bits [2(n-1)+34:2(n-1)+33], for n = 1 to 7 
When ARMVv8.5-MemTag is implemented: 


Tag cache type. Indicate the type of cache that is implemented and can be managed using the 
architected cache maintenance instructions that operate by set/way at each level, from Level 1 up to 
a maximum of seven levels of cache hierarchy. 


0b00 No Tag Cache. 

0b01 Separate Allocation Tag Cache. 

0b10 Unified Allocation Tag and Data cache, Allocation Tags and Data in unified lines. 

0b11 Unified Allocation Tag and Data cache, Allocation Tags and Data in separate lines. 
Otherwise: 


Reserved, RESO. 


ICB, bits [32:30] 


Inner cache boundary. This field indicates the boundary for caching Inner Cacheable memory 


regions. 
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D13-2884 


The possible values are: 

0b000 Not disclosed by this mechanism. 

0b001 L1 cache is the highest Inner Cacheable level. 
0b010 L2 cache is the highest Inner Cacheable level. 


0b011 L3 cache is the highest Inner Cacheable level. 
0b100 L4 cache is the highest Inner Cacheable level. 
0b101 L5 cache is the highest Inner Cacheable level. 
0b110 L6 cache is the highest Inner Cacheable level. 
0b111 L7 cache is the highest Inner Cacheable level. 


LoUU, bits [29:27] 

Level of Unification Uniprocessor for the cache hierarchy. 
LoC, bits [26:24] 

Level of Coherence for the cache hierarchy. 
LoUIS, bits [23:21] 


Level of Unification Inner Shareable for the cache hierarchy. 


Ctype<n>, bits [3(n-1)+2:3(n-1)], for n = 1 to 7 


Cache Type fields. Indicate the type of cache that is implemented and can be managed using the 
architected cache maintenance instructions that operate by set/way at each level, from Level 1 up to 
a maximum of seven levels of cache hierarchy. Possible values of each field are: 


0b000 No cache. 

0b001 Instruction cache only. 

0b010 Data cache only. 

0b011 Separate instruction and data caches. 
0b100 Unified cache. 


All other values are reserved. 


If software reads the Cache Type fields from Ctypel upwards, once it has seen a value of 000, no 
caches that can be managed using the architected cache maintenance instructions that operate by 
set/way exist at further-out levels of the hierarchy. So, for example, if Ctype3 is the first Cache Type 
field with a value of 000, the values of Ctype4 to Ctype7 must be ignored. 


Accessing the CLIDR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CLIDR_EL1 





op0 op1 CRn 


CRm op2 





0b11 0b001 0b0000 


0b0000 0b001 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
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AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CLIDR_EL1; 
elsif PSTATE.EL == EL2 then 
return CLIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return CLIDR_EL1; 
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D13.2.27 


D13-2886 


CONTEXTIDR_EL1, Context ID Register (EL1) 


The CONTEXTIDR_ EL! characteristics are: 


Purpose 
Identifies the current Process Identifier. 
The value of the whole of this register is called the Context ID and is used by: 
. The debug logic, for Linked and Unlinked Context ID matching. 
à The trace logic, to identify the current process. 
The significance of this register is for debug and trace use only. 


This register is used when ARMv8.1-VHE is not implemented, or whenARMv8.1-VHE is 
implemented and HCR_EL2.E2H is set to 0. 





Note 
When ARMV8.1-VHE is implemented and HCR_EL2.E2H is set to 1, CONTEXTIDR_El2 is used. 





Configurations 


AArch64 System register CONTEXTIDR_EL1[31:0] is architecturally mapped to AArch32 
System register CONTEXTIDR[3 1:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CONTEXTIDR_EL1 is a 64-bit register. 


Field descriptions 


The CONTEXTIDR_ EL! bit assignments are: 


32 31 0 


RESO PROCID 


Bits [63:32] 
Reserved, RESO. 
PROCID, bits [31:0] 


Process Identifier. This field must be programmed with a unique value that identifies the current 
process. 


Note 
In AArch32 state, when TTBCR.EAE is set to 0, CONTEXTIDR.ASID holds the ASID. 


In AArch64 state, CONTEXTIDR_EL1 is independent of the ASID, and for the EL1&0 translation 
regime either TTBRO_EL1 or TTBR1_EL1 holds the ASID. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CONTEXTIDR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic 
CONTEXTIDR_EL1 or CONTEXTIDR_EL12 are not guaranteed to be ordered with respect to accesses using the 
other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CONTEXTIDR_EL1 





op0 op1 CRn 


0b11 0b000 0b1101 


CRm 


0b0000 


op2 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


return NVMem[0x108] ; 
else 
return CONTEXTIDR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return CONTEXTIDR_EL2; 
else 
return CONTEXTIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return CONTEXTIDR_EL1; 


MSR CONTEXTIDR_EL1, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b1101 


0b0000 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


NVMem[@x108] = X[t]; 

else 
CONTEXTIDR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
CONTEXTIDR_EL2 = X[t]; 
else 





CONTEXTIDR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
CONTEXTIDR_EL1 = X[t]; 


MRS <Xt>, CONTEXTIDR_EL12 





op0 op1 CRn 


CRm 


op2 





0b11 0b101 0b1101 


0b0000 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x108] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


D13-2887 


AArch64 System Register Descriptions 
D13.2 General system control registers 


D13-2888 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CONTEXTIDR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CONTEXTIDR_EL1; 
else 
UNDEFINED; 


MSR CONTEXTIDR_EL12, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b101 0b1101 0b0000 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x108] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CONTEXTIDR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CONTEXTIDR_EL1 = X[t]; 
else 
UNDEFINED; 
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D13.2.28 CONTEXTIDR_EL2, Context ID Register (EL2) 


The CONTEXTIDR_EL2 characteristics are: 


63 
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Purpose 


When HCR_EL2.E2H is set to 1, identifies the current Process Identifier. 
The value of the whole of this register is called the Context ID and is used by: 
° The debug logic, for Linked and Unlinked Context ID matching. 

à The trace logic, to identify the current process. 


The significance of this register is for debug and trace use only. 


Note 


When HCR_EL2.E2H is 0, CONTEXTIDR_EL2 replaces CONTEXTIDR_EL1 where 
CONTEXTIDR_EL1 would usually be used. 








Configurations 


Attributes 


This register is present only when ARMv8.1-VHE is implemented. Otherwise, direct accesses to 
CONTEXTIDR_EL2 are UNDEFINED. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


CONTEXTIDR_EL2 is a 64-bit register. 


Field descriptions 


The CONTEXTIDR_EL2 bit assignments are: 


Bits [63:32] 


32 31 0 


RESO PROCID 


Reserved, RESO. 


PROCID, bits [31:0] 


Process Identifier. This field must be programmed with a unique value that identifies the current 
process. 

Note 

In AArch32 state, when TTBCR.EAE is set to 0, CONTEXTIDR.ASID holds the ASID. 


In AArch64 state, CONTEXTIDR_EL2 is independent of the ASID, and for the EL2&0 translation 
regime either TTBRO_EL2 or TTBR1_EL2 holds the ASID. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CONTEXTIDR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic 
CONTEXTIDR_EL2 or CONTEXTIDR_ELI are not guaranteed to be ordered with respect to accesses using the 
other mnemonic. 
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Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CONTEXTIDR_EL2 




















op0 op1 CRn CRm op2 
0b11 0b100 0b1101 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return CONTEXTIDR_EL2; 
elsif PSTATE.EL == EL3 then 
return CONTEXTIDR_EL2; 
MSR CONTEXTIDR_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b1101 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CONTEXTIDR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CONTEXTIDR_EL2 = X[t]; 
MRS <Xt>, CONTEXTIDR_EL1 
op0 op1 CRn CRm op2 
0b11 0b000 0b1101 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x108] ; 
else 
return CONTEXTIDR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return CONTEXTIDR_EL2; 
else 
return CONTEXTIDR_EL1; 
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elsif PSTATE.EL == EL3 then 
return CONTEXTIDR_EL1; 


MSR CONTEXTIDR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1101 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x108] = X[t]; 
else 
CONTEXTIDR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
CONTEXTIDR_EL2 = X[t]; 
else 





CONTEXTIDR_EL1 = X[t] 
elsif PSTATE.EL == EL3 then 
CONTEXTIDR_EL1 = X[t]; 
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D13.2.29 CPACR_EL1, Architectural Feature Access Control Register 


The CPACR_EL1 characteristics are: 


Purpose 


Controls access to trace, SVE, Advanced SIMD and floating-point functionality. 


Configurations 


Attributes 


AArch64 System register CPACR_EL1[31:0] is architecturally mapped to AArch32 System 
register CPACR[31:0]. 


When HCR_EL2.{E2H, TGE} == {1, 1}, the fields in this register have no effect on execution at 
ELO and EL1. In this case, the controls provided by CPTR_EL2 are used. 


RW fields in this register reset to architecturally UNKNOWN values. 


CPACR_EL] is a 64-bit register. 


Field descriptions 


The CPACR_EL1 bit assignments are: 


63 


RESO RESO RESO 


29 28 27 22 21 20 19 18 17 16 15 





=f e 








TTA 
Bits [63:29] 
Reserved, RESO. 
TTA, bit [28] 

Traps ELO and EL1 System register accesses to all implemented trace registers to EL1, or to EL2 

when it is implemented and enabled for the current Security state and HCR_EL2.TGE is 1, from 

both Execution states as follows: 

. In AArch64 state, accesses to trace registers are trapped, reported using EC syndrome value 
0x18. 

. In AArch32 state, MRC and MCR accesses to trace registers are trapped, reported using EC 
syndrome value 0x05. 

° In AArch32 state, MRRC and MCRR accesses to trace registers are trapped, reported using 
EC syndrome value 0x0C. 

0bd This control does not cause any instructions to be trapped. 

Qb1 This control causes ELO and EL1 System register accesses to all implemented trace 

registers to be trapped. 
Note 

$ The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A 
architecture is implemented with an ETMv4 implementation, ELO accesses to the trace 
registers are UNDEFINED, and any resulting exception is higher priority than an exception that 
would be generated because the value of CPACR_EL1.TTA is 1. 

. The Armv8-A architecture does not provide traps on trace register accesses through the 
optional memory-mapped interface. 
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System register accesses to the trace registers can have side-effects. When a System register access 
is trapped, any side-effects that are normally associated with the access do not occur before the 
exception is taken. 


If System register access to the trace functionality is not implemented, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


FPEN, bits [21:20] 


Bits [19:18] 


Traps ELO and EL1 accesses to the SVE, Advanced SIMD, and floating-point registers to EL1, 
reported using EC syndrome value 0x07, or to EL2 reported using EC syndrome value 0x00, when 
EL2 is implemented and enabled for the current Security state and HCR_EL2.TGE is 1, from both 
Execution states as follows: 


° In AArch64 state, accesses to FPCR, FPSR, any of the SIMD and floating-point registers 
V0-V31, including their views as D0-D31 registers or S0-31 registers. See The SIMD and 
floating-point registers, V0-V31 on page D1-2278. 


è FPSCR, and any of the SIMD and floating-point registers Q0-15, including their views as 
D0-D31 registers or S0-31 registers. See Advanced SIMD and floating-point System registers 
on page G1-5572. 


0b00 This control causes any instructions at ELO or EL1 that use the registers associated with 


SVE, Advanced SIMD and floating-point execution to be trapped, unless they are 
trapped by CPACR_EL1.ZEN. 


QbO1 This control causes any instructions at ELO that use the registers associated with SVE, 
Advanced SIMD and floating-point execution to be trapped, unless they are trapped by 
CPACR_EL1.ZEN, but does not cause any instruction at EL1 to be trapped. 


0b10 This control causes any instructions at ELO or EL] that use the registers associated with 
SVE, Advanced SIMD and floating-point execution to be trapped, unless they are 
trapped by CPACR_EL1.ZEN. 


Qb11 This control does not cause any instructions to be trapped. 


Writes to MVFRO, MVFRI and MVFR2 from EL1 or higher are CONSTRAINED UNPREDICTABLE 
and whether these accesses can be trapped by this control depends on implemented CONSTRAINED 
UNPREDICTABLE behavior. 


— Note 
è Attempts to write to the FPSID count as use of the registers for accesses from EL1 or higher. 


’ Accesses from ELO to FPSID, MVFRO, MVFR1, MVFR2, and FPEXC are UNDEFINED, and 
any resulting exception is higher priority than an exception that would be generated because 
the value of CPACR_EL1.FPEN is not 0b11. 





This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


ZEN, bits [17:16] 
When SVE is implemented: 


Traps SVE instructions and instructions that access SVE System registers at ELO and EL1 to EL1, 
or to EL2 when it is implemented and enabled for the current Security state and HCR_EL2.TGE is 1. 


0b00 This control causes these instructions executed at ELO or EL1 to be trapped. 
0b01 This control causes these instructions executed at ELO to be trapped, but does not cause 
any instruction at EL1 to be trapped. 
0b10 This control causes these instructions executed at ELO or EL1 to be trapped. 
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Qb11 This control does not cause any instruction to be trapped. 
If SVEis not implemented, this field is RESO. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
Bits [15:0] 


Reserved, RESO. 


Accessing the CPACR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic CPACR_EL1 
or CPACR_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CPACR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x100] ; 
else 
return CPACR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
return CPTR_EL2; 
else 
return CPACR_EL1; 
elsif PSTATE.EL == EL3 then 
return CPACR_EL1; 


MSR CPACR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x100] = X[t]; 
else 
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CPACR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
CPTR_EL2 = X[t]; 
else 
CPACR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
CPACR_EL1 = X[t]; 


MRS <Xt>, CPACR_EL12 

















op0 op1 CRn CRm op2 
0b11 0b101 0b0001 0b0000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x100] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return CPACR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CPACR_EL1; 
else 
UNDEFINED; 
MSR CPACR_EL12, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b101 0b0001 0b0000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x100] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
CPACR_EL1 = X[t]; 
else 
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UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CPACR_EL1 = X[t]; 
else 
UNDEFINED; 
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D13.2.30 CPTR_EL2, Architectural Feature Trap Register (EL2) 
The CPTR_EL2 characteristics are: 


Purpose 
Controls: 


$ Trapping to EL2 of access to CPACR, CPACR_EL1, trace functionality, and to SVE, 
Advanced SIMD and floating-point functionality. 


$ EL2 access to trace functionality, and to SVE, Advanced SIMD and floating-point 
functionality. 


Configurations 


AArch64 System register CPTR_EL2[31:0] is architecturally mapped to AArch32 System register 
HCPTR[{31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CPTR_EL2 is a 64-bit register. 


Field descriptions 


The CPTR_EL2 bit assignments are: 


When ARMv8.1-VHE is implemented and HCR_EL2.E2H == 1: 


32 31 30 29 28 27 22 21 20 19 18 17 16 15 0 


63 
| RESO | | RESO RESO 


TCPAC Lo O i | (ca RESO 


TAM 
RESO 
TTA 





Bits [63:32] 


Reserved, RESO. 


TCPAC, bit [31] 


When HCR_EL2.TGE is 0, traps EL1 accesses to CPACR_EL1 reported using EC syndrome value 
0x18, and accesses to CPACR reported using EC syndrome value 0x03, to EL2 when EL2 is enabled 
in the current Security state. 


Ob This control does not cause any instructions to be trapped. 


Qb1 ELI accesses to CPACR_EL1 and CPACR are trapped to EL2 when EL2 is enabled in 
the current Security state. 


When HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped. 





Note 
CPACR_EL1 and CPACR are not accessible at ELO. 





This field resets to an architecturally UNKNOWN value. 
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TAM, bit [30] 


When AMUv1 is implemented: 


Trap Activity Monitor access. Traps EL1 and ELO accesses to all Activity Monitor registers to EL2, 
as follows: 


In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC 
syndrome value 0x18: 


— AMUSERENR ELO, AMCFGR ELO, AMCGCR ELO, AMCNTENCLRO_ ELO, 
AMCNTENCLR1 _ELO, AMCNTENSETO_ELO, AMCNTENSETI ELO, 
AMCR_ELO, AMEVCNTRO<n>_EL0, AMEVCNTR1<n>_EL0, 
AMEVTYPERO<n>_EL0, and AMEVTYPERI<n>_ELO. 


In AArch32 state, MRC or MCR accesses to the following registers are trapped to EL2 and 
reported using EC syndrome value 0x03: 


—  AMUSERENR, AMCFGR, AMCGCR, AMCNTENCLRO, AMCNTENCLRI, 
AMCNTENSETO0, AMCNTENSET1, AMCR, AMEVTYPERO<n>, and 
AMEVTYPERI<n>. 


In AArch32 state, MRRC or MCRR accesses to AMEVCNTRO<n> and AMEVCNTRI<n>, 
are trapped to EL2, reported using EC syndrome value 0x04. 





Accesses from EL1 and ELO to Activity Monitor registers are not trapped. 


Accesses from EL1 and ELO to Activity Monitor registers are trapped to EL2, when 
EL2 is enabled in the current Security state. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Bit [29] 


Reserved, RESO. 


TTA, bit [28] 


Traps System register accesses to all implemented trace registers to EL2 when EL2 is enabled in the 
current Security state, from both Execution states, as follows: 


In AArch64 state, accesses to trace registers with op0=2, op1=1 are trapped to EL2, reported 
using EC syndrome value 0x18. 


In AArch32 state, MRC or MCR accesses to trace registers with cpnum=14, opc1=1, are 
trapped to EL2, reported using EC syndrome value 0x05. 


In AArch32 state, MRRC or MCRR accesses to trace registers with cpnum=14, opc1=1, are 
trapped to EL2, reported using EC syndrome value 0x@C. 


This control does not cause any instructions to be trapped. 


Any attempt at ELO, EL1 or EL2, to execute a System register access to an implemented 
trace register is trapped to EL2 when EL2 is enabled in the current Security state, unless 
HCR_EL2.TGE is 0 and it is trapped by CPACR.NSTRCDIS or CPACR_EL1.TTA. 


When HCR_EL2.TGE is 1, any attempt at ELO or EL2 to execute a System register 
access to an implemented trace register is trapped to EL2 when EL2 is enabled in the 
current Security state. 


— Note 


The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A 
architecture is implemented with an ETMv4 implementation, ELO accesses to the trace 
registers are UNDEFINED, and any resulting exception is higher priority than an exception that 
would be generated because the value of CPTR_EL2.TTA is 1. 


EL2 does not provide traps on trace register accesses through the optional memory-mapped 
interface. 
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System register accesses to the trace registers can have side-effects. When a System register access 
is trapped, any side-effects that are normally associated with the access do not occur before the 
exception is taken. 

If System register access to the trace functionality is not supported, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Bits [27:22] 


Reserved, RESO. 


FPEN, bits [21:20] 


Traps ELO, EL2 and, when HCR_EL2.TGE is 0, EL1 accesses to the SVE, Advanced SIMD and 
floating-point registers to EL2 when EL2 is enabled in the current Security state, from both 
Execution states. 


0b00 This control causes any instructions at ELO, EL1, or EL2 that use the registers 
associated with SVE, Advanced SIMD and floating-point execution to be trapped, 
subject to the exception prioritization rules, unless they are trapped by 
CPTR_EL2.ZEN. 


0b01 When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped. 
When HCR_EL2.TGE is 1, this control causes instructions at ELO that use the registers 
associated with SVE, Advanced SIMD and floating-point execution to be trapped, 
unless they are trapped by CPTR_EL2.ZEN, but does not cause any instruction at EL2 
to be trapped. 


0b10 This control causes any instructions at ELO, EL1, or EL2 that use the registers 
associated with SVE, Advanced SIMD and floating-point execution to be trapped, 
subject to the exception prioritization rules, unless they are trapped by 
CPTR_EL2.ZEN. 


Qb11 This control does not cause any instructions to be trapped. 


Writes to MVFRO, MVFR1, and MVFR2 from EL1 or higher are CONSTRAINED UNPREDICTABLE 
and whether these accesses can be trapped by this control depends on implemented CONSTRAINED 





UNPREDICTABLE behavior. 
Note 
; Attempts to write to the FPSID count as use of the registers for accesses from EL1 or higher. 


° Accesses from ELO to FPSID, MVFRO, MVFR1, MVFR2, and FPEXC are UNDEFINED, and 
any resulting exception is higher priority than an exception that would be generated because 
the value of CPTR_EL2.FPEN is not 0b11. 





This field resets to an architecturally UNKNOWN value. 


Bits [19:18] 
Reserved, RESO. 


ZEN, bits [17:16] 
When SVE is implemented: 


Traps execution at EL2, EL1, and ELO of SVE instructions or instructions that access SVE System 
registers to EL2 when EL2 is enabled in the current Security state. 


0b00 This control causes execution at EL2, EL1, and ELO of these instructions to be trapped, 
subject to the exception prioritization rules. 
0b01 When HCR_EL2.TGE is 0, this control does not cause any instruction to be trapped. 


When HCR_EL2.TGE is 1, this control causes these instructions executed at ELO to be 
trapped, but does not cause any instruction at EL2 to be trapped. 


0b10 This control causes execution at EL2, EL1, and ELO of these instructions to be trapped, 
subject to the exception prioritization rules. 
Qb11 This control does not cause any instruction to be trapped. 
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This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [15:0] 
Reserved, RESO. 


Otherwise: 


32 31 30 29 21 20 19 14131211109 8 7 0 


63 

| RESO | RESO | RESO 
TCPAC a | 
TAM 





This format applies in all Armv8.0 implementations. 


Bits [63:32] 
Reserved, RESO. 


TCPAC, bit [31] 


Traps EL1 accesses to CPACR_EL1, reported using EC syndrome value 0x18 and accesses to 
CPACR, reported using EC syndrome value 0x03, to EL2 when EL2 is enabled in the current 
Security state. 


0bd This control does not cause any instructions to be trapped. 


Qb1 ELI accesses to CPACR_EL1 and CPACR are trapped to EL2 when EL2 is enabled in 
the current Security state. 


When HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped. 


Note 
CPACR_EL1 and CPACR are not accessible at ELO. 








This field resets to an architecturally UNKNOWN value. 


TAM, bit [30] 


Trap Activity Monitor access. Traps EL1 and ELO accesses to all Activity Monitor registers to EL2, 
as follows: 


° In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC 
syndrome value 0x18: 


— AMUSERENR ELO, AMCFGR ELO, AMCGCR ELO, AMCNTENCLRO ELO, 
AMCNTENCLR1_ ELO, AMCNTENSETO_ELO, AMCNTENSETI ELO, 
AMCR_ELO, AMEVCNTRO<n>_EL0, AMEVCNTR1<n>_EL0, 
AMEVTYPERO<n>_EL0, and AMEVTYPERI<n>_ELO. 


° In AArch32 state, MCR or MRC accesses to the following registers are trapped to EL2 and 
reported using EC syndrome value 0x03: 


—  AMUSERENR, AMCFGR, AMCGCR, AMCNTENCLRO, AMCNTENCLRI, 


AMCNTENSETO0, AMCNTENSET1, AMCR, AMEVTYPERO<n>, and 
AMEVTYPERI<n>. 
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. In AArch32 state, MCRR or MRRC accesses to AMEVCNTRO<n> and AMEVCNTRI<n>, 
are trapped to EL2, reported using EC syndrome value 0x04. 


Qbd Accesses from EL1 and ELO to Activity Monitor registers are not trapped. 


Qb1 Accesses from EL1 and ELO to Activity Monitor registers are trapped to EL2, when 
EL2 is enabled in the current Security state. 


This field resets to an architecturally UNKNOWN value. 


Bits [29:21] 


Reserved, RESO. 


TTA, bit [20] 
Traps System register accesses to all implemented trace registers to EL2 when EL2 is enabled in the 


current Security state, from both Execution states as follows: 


° In AArch64 state, accesses to trace registers with op0=2, op1=1 are trapped to EL2, reported 
using EC syndrome value 0x18. 


° In AArch32 state, MRC or MCR accesses to trace registers with cpnum=14, opc1=1 are 
trapped to EL2, reported using EC syndrome value 0x05. 


° In AArch32 state, MRRC or MCRR accesses to trace registers with cpnum=14, opc1=1 are 
trapped to EL2, reported using EC syndrome value 0x@C. 


0bd This control does not cause any instructions to be trapped. 


Qb1 Any attempt at ELO, EL1, or EL2, to execute a System register access to an 
implemented trace register is trapped to EL2 when EL2 is enabled in the current 
Security state, unless it is trapped by CPACR.TRCDIS or CPACR_EL1.TTA. 


Note 


$ The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A 
architecture is implemented with an ETMv4 implementation, ELO accesses to the trace 
registers are UNDEFINED, and any resulting exception is higher priority than an exception that 
would be generated because the value of CPTR_EL2.TTA is 1. 


$ EL2 does not provide traps on trace register accesses through the optional memory-mapped 
interface. 








System register accesses to the trace registers can have side-effects. When a System register access 
is trapped, any side-effects that are normally associated with the access do not occur before the 
exception is taken. 


If System register access to the trace functionality is not supported, this bit is RESO. 
This field resets to an architecturally UNKNOWN value. 
Bits [19:14] 
Reserved, RESO. 
Bits [13:12] 
Reserved, RES]. 
Bit [11] 


Reserved, RESO. 
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TEP, bit [10] 


Bit [9] 


TZ, bit [8] 


Bits [7:0] 


Traps accesses to SVE, Advanced SIMD and floating-point functionality to EL2 when EL2 is 
enabled in the current Security state, from both Execution states, as follows: 


° In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC 
syndrome value 0x07: 


— FPCR, FPSR, FPEXC32_EL2, any of the SIMD and floating-point registers V0-V31, 
including their views as DO-D31 registers or S0-31 registers. See The SIMD and 
floating-point registers, VO-V31 on page D1-2278. 


° In AArch32 state, accesses to the following registers are trapped to EL2, reported using EC 
syndrome value 0x07: 


—  MVFRO,MVFR1,MVFR2, FPSCR, FPEXC, and any of the SIMD and floating-point 
registers Q0-15, including their views as D0-D31 registers or S0-31 registers. See 
Advanced SIMD and floating-point System registers on page G1-5572. For the 
purposes of this trap, the architecture defines a VMSR access to FPSID from EL1 or 
higher as an access to a SIMD and floating point register. Otherwise, permitted VMSR 
accesses to FPSID are ignored. 


0b0ð This control does not cause any instructions to be trapped. 


Qb1 Any attempt at ELO, EL1 or EL2, to execute an instruction that uses the registers 
associated with SVE, Advanced SIMD and floating-point execution is trapped to EL2 
when EL2 is enabled in the current Security state, subject to the exception prioritization 
rules, unless it is trapped by CPTR_EL2.TZ. 


Note 
FPEXC32_EL2 is not accessible from ELO using AArch64. 


FPSID, MVFRO, MVFR1, and FPEXC are not accessible from ELO using AArch32. 








This field resets to an architecturally UNKNOWN value. 


Reserved, RES1. 


Traps execution at EL2, EL1, or ELO of SVE instructions and instructions that access SVE System 
registers to EL2 when EL2 is enabled in the current Security state. 


0b0 This control does not cause any instruction to be trapped. 


Qb1 This control causes these instructions to be trapped, subject to the exception 
prioritization rules. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RES]. 


Accessing the CPTR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CPTR_EL2 




















op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0001 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return CPTR_EL2; 
elsif PSTATE.EL == EL3 then 
return CPTR_EL2; 
MSR CPTR_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0001 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
CPTR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CPTR_EL2 = X[t]; 
MRS <Xt>, CPACR_EL1 
op0 op1 CRn CRm op2 
0b11 0b000 0b0001 0b0000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x100] ; 
else 
return CPACR_EL1; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

elsif HCR_EL2.E2H == '1' then 
return CPTR_EL2; 

else 
return CPACR_EL1; 

elsif PSTATE.EL == EL3 then 
return CPACR_EL1; 


MSR CPACR_EL1, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b0001 


0b0000 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


NVMem[@x100] = X[t]; 
else 
CPACR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
CPTR_EL2 = X[t]; 
else 
CPACR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
CPACR_EL1 = X[t]; 
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D13.2.31 CPTR_EL3, Architectural Feature Trap Register (EL3) 


The CPTR_EL3 characteristics are: 


Purpose 
Controls trapping to EL3 of access to CPACR_EL1, CPTR_EL2, trace functionality and registers 
associated with SVE, Advanced SIMD and floating-point execution. Also controls EL3 access to 
trace functionality and registers associated with SVE, Advanced SIMD and floating-point 
execution. 

Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


CPTR_EL3 is a 64-bit register. 


Field descriptions 


The CPTR_EL3 bit assignments are: 


32 31 30 29 21 20 19 11109 8 7 0 


63 

| RESO RESO | RESO 
TCPAC | | 
TAM 


Bits [63:32] 





Reserved, RESO. 


TCPAC, bit [31] 
Traps all of the following to EL3, from both Security states and both Execution states. 


a EL2 accesses to CPTR_EL2, reported using EC syndrome value 0x18, or HCPTR, reported 
using EC syndrome value 0x03. 


- EL2 and EL1 accesses to CPACR_EL1 reported using EC syndrome value 0x18, or CPACR 
reported using EC syndrome value 0x03. 


When CPTR_EL3.TCPAC is: 
Ob This control does not cause any instructions to be trapped. 


Qb1 EL2 accesses to the CPTR_EL2 or HCPTR, and EL2 and EL1 accesses to the 
CPACR_EL1 or CPACR, are trapped to EL3, unless they are trapped by 
CPTR_EL2.TCPAC. 


This field resets to an architecturally UNKNOWN value. 
TAM, bit [30] 
When AMUV1 is implemented: 


Trap Activity Monitor access. Traps EL2, EL1 and ELO accesses to all Activity Monitor registers 
to EL3. 
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Accesses to the Activity Monitors registers are trapped as follows: 


e In AArch64 state, the following registers are trapped to EL3 and reported with EC syndrome 
value 0x18: 


— AMUSERENR ELO, AMCFGR_EL0, AMCGCR_EL0, AMCNTENCLRO ELO, 
AMCNTENCLR1_ELO, AMCNTENSETO_EL0, AMCNTENSET1_ELO, 
AMCR_ELO, AMEVCNTRO<n>_ELO, AMEVCNTR1<n>_ELO0, 
AMEVTYPERO<n>_ELO, and AMEVTYPER1<n>_EL0. 


° In AArch32 state, accesses with MRC or MCR to the following registers reported with EC 
syndrome value 0x03: 


— AMUSERENR, AMCFGR, AMCGCR, AMCNTENCLRO, AMCNTENCLRI, 
AMCNTENSETO0, AMCNTENSET1, AMCR, AMEVTYPERO<n>, and 
AMEVTYPERI<n>. 


- In AArch32 state, accesses with MRRC or MCRR to the following registers, reported with 
EC syndrome value 0x04: 


— AMEVCNTRO<n>, AMEVCNTRI<n>. 
Qbd Accesses from EL2, EL1, and ELO to Activity Monitor registers are not trapped. 
Qb1 Accesses from EL2, EL1, and ELO to Activity Monitor registers are trapped to EL3. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Bits [29:21] 


TTA, bit [20] 


Bits [19:11] 


Reserved, RESO. 


Reserved, RESO. 


Traps System register accesses. Accesses to the trace registers, from all Exception levels, both 
Security states, and both Execution states are trapped to EL3 as follows: 


è In AArch64 state, Trace registers with op0=2, op1=1, are trapped to EL3 and reported using 
EC syndrome value 0x18. 


° In AArch32 state, accesses using MCR or MRC to the Trace registers with cpnum=14 and 
opcl=1 are reported using EC syndrome value 0x05. 


e In AArch32 state, accesses using MCRR or MRRC to the Trace registers with cpnum=14 and 
opcl=1 are reported using EC syndrome value 0x@C. 


0bd This control does not cause any instructions to be trapped. 


Qb1 Any System register access to the trace registers is trapped to EL3, subject to the 
exception prioritization rules, unless it is trapped by CPACR.TRCDIS, 
CPACR_EL1.TTA or CPTR_EL2.TTA. 


If System register access to trace functionality is not supported, this bit is RESO. 


Note 


The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A 
architecture is implemented with an ETMv4 implementation, ELO accesses to the trace registers are 
UNDEFINED, and any resulting exception is higher priority than this trap exception. 





EL3 does not provide traps on trace register accesses through the Memory-mapped interface. 





System register accesses to the trace registers can have side-effects. When a System register access 
is trapped, no side-effects occur before the exception is taken, see Register access instructions on 
page D1-2327. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 
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TFP, bit [10] 
Traps all accesses to SVE, Advanced SIMD and floating-point functionality, from all Exception 
levels, both Security states, and both Execution states, to EL3. Defined values are: 
This includes the following registers, all reported using EC syndrome value 0x07: 


. FPCR, FPSR, FPEXC32_EL2, any of the SIMD and floating-point registers VO-V31, 
including their views as DO-D31 registers or S0-31 registers. See The SIMD and 
floating-point registers, VO-V31 on page D1-2278. 

. MVFRO, MVFR1, MVFR2, FPSCR, FPEXC, and any of the SIMD and floating-point 
registers QO-15, including their views as DO-D31 registers or S0-31 registers. See Advanced 
SIMD and floating-point System registers on page G1-5572. 


Permitted VMSR accesses to FPSID are ignored, but for the purposes of this trap the architecture 
define a VMSR access to the FPSID from EL1 or higher as an access to a SIMD and floating-point 


register. 

0bd This control does not cause any instructions to be trapped. 

Qb1 Any attempt at any Exception level to execute an instruction that uses the registers 
associated with SVE, Advanced SIMD and floating-point is trapped to EL3, subject to 
the exception prioritization rules, unless it is trapped by CPTR_EL3.EZ. 

Note 





FPEXC32_EL2 is not accessible from ELO using AArch64. 
FPSID, MVFRO, MVFR1, and FPEXC are not accessible from ELO using AArch32. 





This field resets to an architecturally UNKNOWN value. 


Bit [9] 


Reserved, RESO. 


EZ, bit [8] 
When SVE is implemented: 


Traps all accesses to SVE functionality and registers from all Exception levels, and both Security 
states, to EL3. 


0bd This control causes these instructions executed at any Exception level to be trapped, 
subject to the exception prioritization rules. 


Qb1 This control does not cause any instruction to be trapped. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
Bits [7:0] 


Reserved, RESO. 


Accessing the CPTR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CPTR_EL3 


if PSTATE.EL == 
UNDEFINED; 
elsif PSTATE.EL 
UNDEFINED; 
elsif PSTATE.EL 
UNDEFINED; 
elsif PSTATE.EL 
return CPTR. 








MSR CPTR_EL3, <Xt> 


if PSTATE.EL == 
UNDEFINED; 

elsif PSTATE.EL 
UNDEFINED; 

elsif PSTATE.EL 
UNDEFINED; 











op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0001 0b010 
ELO then 
== EL1 then 
== EL2 then 
== EL3 then 
EL3; 
op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0001 0b010 
ELO then 
== EL1 then 
== EL2 then 


elsif PSTATE.EL == EL3 then 
CPTR_EL3 = X[t]; 
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D13.2.32 CSSELR_EL1, Cache Size Selection Register 
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The CSSELR_EL1 characteristics are: 


Purpose 
Selects the current Cache Size ID Register, CCSIDR_EL1, by specifying the required cache level 
and the cache type (either instruction or data cache). 

Configurations 
AArch64 System register CSSELR_EL1[31:0] is architecturally mapped to AArch32 System 
register CSSELR[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


CSSELR_EL1 is a 64-bit register. 


Field descriptions 


The CSSELR_EL1 bit assignments are: 


Bits [63:5] 


Reserved, RESO. 


TnD, bit [4] 
When ARMv8.5-MemTag is implemented: 
Allocation Tag not Data bit. 
Qbd Data or unified cache. 
Qb1 Allocation Tag cache. 
When CCSELR_EL1.InD == 1, this bit is RESO. 


If CSSELR_EL1.Level is programmed to a cache level that is not implemented, then the value for 
this field on a read of CSSELR_EL1 is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Level, bits [3:1] 
Cache level of required cache. 
0b000 Level 1 cache. 
0b001 Level 2 cache. 
0b010 Level 3 cache. 


0b011 Level 4 cache. 
0b100 Level 5 cache. 
0b101 Level 6 cache. 
0b110 Level 7 cache. 
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All other values are reserved. 


If CSSELR_EL1.Level is programmed to a cache level that is not implemented, then the value for 
this field on a read of CSSELR_EL1 is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


InD, bit [0] 


Instruction not Data bit. 


QbO Data or unified cache. 


Qb1 Instruction cache. 


If CSSELR_EL1.Level is programmed to a cache level that is not implemented, then a read of 
CSSELR_EL1 is CONSTRAINED UNPREDICTABLE, and returns UNKNOWN values for 


CSSELR_EL1.{Level, InD}. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CSSELR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CSSELR_EL1 

















op0 op1 CRn CRm op2 
0b11 0b010 0b0000 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CSSELR_EL1; 
elsif PSTATE.EL == EL2 then 
return CSSELR_EL1; 
elsif PSTATE.EL == EL3 then 
return CSSELR_EL1; 
MSR CSSELR_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b010 0b0000 0b0000 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


else 
CSSELR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
CSSELR_EL1 = X[t]; 
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elsif PSTATE.EL == EL3 then 
CSSELR_EL1 = X[t]; 
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D13.2.33 CTR_ELO, Cache Type Register 


The CTR_ELO characteristics are: 


Purpose 
Provides information about the architecture of the caches. 
Configurations 
AArch6é4 System register CTR_ELO[31:0] is architecturally mapped to AArch32 System register 
CTR[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CTR_ELO is a 64-bit register. 


Field descriptions 


The CTR_ELO bit assignments are: 


38 37 32 31 30 29 28 27 |. 24 23... 20 19 i 


RES1 
RESO 


Bits [63:38] 





Reserved, RESO. 


TminLine, bits [37:32] 
When ARMVv8.5-MemTag is implemented: 
Tag minimum Line. Log» of the number of words covered by Allocation Tags in the smallest cache 


line of all caches which can contain Allocation tags that are controlled by the PE. 


Note 


For an implementation with cache lines containing 64 bytes of data and 4 Allocation Tags this will 
be log2(64/4) = 4. 





For an implementation with Allocations Tags in separate cache lines of 128 Allocation Tags per line 
this will be logo(128* 16/4) = 9. 





Otherwise: 
Reserved, RESO. 
Bit [31] 
Reserved, RES1. 
Bit [30] 


Reserved, RESO. 
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DIC, bit [29] 


Instruction cache invalidation requirements for instruction to data coherence. The meaning of this 


bit is: 

Qbd Instruction cache invalidation to the Point of Unification is required for instruction to 
data coherence. 

Qb1 Instruction cache cleaning to the Point of Unification is not required for instruction to 


data coherence. 


IDC, bit [28] 
Data cache clean requirements for instruction to data coherence. The meaning of this bit is: 


Qbd Data cache clean to the Point of Unification is required for instruction to data coherence, 
unless CLIDR_EL1.LoC == 0b000 or (CLIDR_EL1.LoUIS == 0b000 && 
CLIDR_EL1.LoUU == 0b000). 


Qb1 Data cache clean to the Point of Unification is not required for instruction to data 
coherence. 
CWG, bits [27:24] 


Cache writeback granule. Logz of the number of words of the maximum size of memory that can be 
overwritten as a result of the eviction of a cache entry that has had a memory location in it modified. 


A value of 0b0000 indicates that this register does not provide Cache writeback granule information 


and either: 
° The architectural maximum of 512 words (2KB) must be assumed. 
a The Cache writeback granule can be determined from maximum cache line size encoded in 


the Cache Size ID Registers. 
Values greater than 0b1001 are reserved. 
Arm recommends that an implementation that does not support cache write-back implements this 
field as 0b0001. This applies, for example, to an implementation that supports only write-through 
caches. 
ERG bits [23:20] 


Exclusives reservation granule. Log» of the number of words of the maximum size of the reservation 
granule that has been implemented for the Load-Exclusive and Store-Exclusive instructions. 


The use of the value @b0000 is deprecated. 


The value 0b0001 and values greater than 0b1001 are reserved. 


DminLine, bits [19:16] 


Log» of the number of words in the smallest cache line of all the data caches and unified caches that 
are controlled by the PE. 


L1lIp, bits [15:14] 


Level 1 instruction cache policy. Indicates the indexing and tagging policy for the L1 instruction 
cache. Possible values of this field are: 


0b00 VMID aware Physical Index, Physical tag (VPIPT) 
0b01 ASID-tagged Virtual Index, Virtual Tag (AIVIVT) 
0b10 Virtual Index, Physical Tag (VIPT) 

0b11 Physical Index, Physical Tag (PIPT) 


The value 0b01 is reserved in Armv8. 


The value 0b00 is permitted only in an implementation that includes ARMv8.2-VPIPT, otherwise 
the value is reserved. 


Bits [13:4] 


Reserved, RESO. 
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IminLine, bits [3:0] 
Log» of the number of words in the smallest cache line of all the instruction caches that are 
controlled by the PE. 


Accessing the CTR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CTR_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b0000 0b0000 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.UCT == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TID2 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.UCT == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CTR_ELQ; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CTR_ELQ; 
elsif PSTATE.EL == EL2 then 
return CTR_ELQ; 
elsif PSTATE.EL == EL3 then 
return CTR_ELQ; 
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D13.2.34 DACR32_EL2, Domain Access Control Register 
The DACR32_EL2 characteristics are: 


Purpose 


Allows access to the AArch32 DACR register from AArch64 state only. Its value has no effect on 
execution in AArch64 state. 


Configurations 


AArch6é4 System register DACR32_EL2[31:0] is architecturally mapped to AArch32 System 
register DACR[31:0]. 


If EL1 does not support AArch32, this register is UNDEFINED. 


If EL2 is not implemented but EL3 is implemented, and EL! is capable of using AArch32, then this 
register is not RESO. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DACR32_EL2 is a 64-bit register. 


Field descriptions 


The DACR32_EL2 bit assignments are: 


63 32 31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 12 11109 8 76543 210 





Bits [63:32] 


Reserved, RESO. 


D<n>, bits [2n+1:2n], for n = 0 to 15 


Domain n access permission, where n = 0 to 15. Permitted values are: 


0b00 No access. Any access to the domain generates a Domain fault. 
0b01 Client. Accesses are checked against the permission bits in the translation tables. 
0b11 Manager. Accesses are not checked against the permission bits in the translation tables. 


The value 0b10 is reserved. 


This field resets to an architecturally UNKNOWN value. 


Accessing the DACR32_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DACR32_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0011 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
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else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return DACR32_EL2; 
elsif PSTATE.EL == EL3 then 
return DACR32_EL2; 


MSR DACR32_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b0011 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
DACR32_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
DACR32_EL2 = X[t]; 
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D13.2.35 ©DCZID_ELO, Data Cache Zero ID register 
The DCZID_ELO characteristics are: 


Purpose 


Indicates the block size that is written with byte values of 0 by the DC ZVA (Data Cache Zero by 
Address) System instruction. 


If ARMv8.5-MemTag is implemented, this register also indicates the granularity at which the DC 
GVA and DC GZVA instructions write. 

Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DCZID_ELO is a 64-bit register. 


Field descriptions 


The DCZID_ELO bit assignments are: 


63 5 4 3 0 


RESO BS 


Bits [63:5] 


Reserved, RESO. 


DZP, bit [4] 


Data Zero Prohibited. This field indicates whether use of DC ZVA instructions is permitted or 
prohibited. 


If ARMv8.5-MemTag is implemented, this field also indicates whether use of the DC GVA and DC 
GZVA instructions are permitted or prohibited. 


Qbd Instructions are permitted. 
Qb1 Instructions are prohibited. 


The value read from this field is governed by the access state and the values of the HCR_EL2.TDZ 
and SCTLR_EL1.DZE bits. 


BS, bits [3:0] 


Log) of the block size in words. The maximum size supported is 2KB (value == 9). 


Accessing the DCZID_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, DCZID_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b0000 0b0000 0b111 





if PSTATE.EL == EL@ then 
return DCZID_ELO; 

elsif PSTATE.EL == EL1 then 
return DCZID_ELO; 

elsif PSTATE.EL == EL2 then 
return DCZID_ELO; 

elsif PSTATE.EL == EL3 then 
return DCZID_ELQ; 
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D13.2.36 ESR_EL1, Exception Syndrome Register (EL1) 


The ESR_EL1 characteristics are: 


Purpose 
Holds syndrome information for an exception taken to EL1. 
Configurations 
AArch64 System register ESR_EL1[31:0] is architecturally mapped to AArch32 System register 
DFSR[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ESR_EL1 is a 64-bit register. 


Field descriptions 


The ESR_EL1 bit assignments are: 


32 31 26 25 24 


63 0 
| RESO EC h ISS 


ESR_EL1 is made UNKNOWN as a result of an exception return from EL1. 


When an UNPREDICTABLE instruction is treated as UNDEFINED, and the exception is taken to EL1, the value of 
ESR_EL1 is UNKNOWN. The value written to ESR_EL1 must be consistent with a value that could be created as a 
result of an exception from the same Exception level that generated the exception as a result of a situation that is 
not UNPREDICTABLE at that Exception level, in order to avoid the possibility of a privilege violation. 

Bits [63:32] 


Reserved, RESO. 


EC, bits [31:26] 
Exception Class. Indicates the reason for the exception that this register holds information about. 
For each EC value, the table references a subsection that gives information about: 
: The cause of the exception, for example the configuration required to enable the trap. 
° The encoding of the associated ISS. 
Possible values of the EC field are: 
EC == 0b000000 
Unknown reason. 
See ISS encoding for exceptions with an unknown reason. 
EC == 0b000001 
Trapped WFI or WFE instruction execution. 


Conditional WFE and WFI instructions that fail their condition code check do not cause 
an exception. 


See ISS encoding for an exception from a WFI or WFE instruction. 


EC == 0b000011 


Trapped MCR or MRC access with (coproc==0b1111) that is not reported using EC 
0b000000. 


See ISS encoding for an exception from an MCR or MRC access. 
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EC == 0b000100 


Trapped MCRR or MRRC access with (coproc==0b1111) that is not reported using EC 
0b000000. 


See ISS encoding for an exception from an MCRR or MRRC access. 
EC = 0b000101 

Trapped MCR or MRC access with (coproc==0b1110). 

See ISS encoding for an exception from an MCR or MRC access. 
EC = 0b000110 

Trapped LDC or STC access. 

The only architected uses of these instruction are: 


g An STC to write data to memory from DBGDTRRXint. 


e An LDC to read data from memory to DBGDTRTXint. 
See ISS encoding for an exception from an LDC or STC instruction. 


EC == 0b000111 


Access to SVE, Advanced SIMD, or floating-point functionality trapped by 
CPACR_EL1.FPEN, CPTR_EL2.FPEN, CPTR_EL2.TFP, or CPTR_EL3.TFP control. 


Excludes exceptions resulting from CPACR_EL1 when the value of HCR_EL2.TGE is 
1, or because SVE or Advanced SIMD and floating-point are not implemented. These 
are reported with EC value 0b000000 as described in The EC used to report an exception 
routed to EL2 because HCR_EL2.TGE is 1 on page D1-2301. 


See ISS encoding for an exception from an access to SVE, Advanced SIMD or 
floating-point functionality, resulting from CPACR_EL1.FPEN, CPTR_EL2.FPEN or 
CPTR_ELx.TFP. 
EC == 0b001100 
Trapped MRRC access with (coproc==0b1110). 
See ISS encoding for an exception from an MCRR or MRRC access. 
EC == 0b001101 When ARMVv8.5-BTI is implemented 
Branch Target Exception. 
See ISS encoding for an exception from Branch Target Identification instruction. 
EC == 0b001110 
Illegal Execution state. 
See ISS encoding for an exception from an Illegal Execution state, or a PC or SP 
alignment fault. 
EC == 0b010001 
SVC instruction execution in AArch372 state. 


This is reported in ESR_EL2 only when the exception is generated because the value of 
HCR_EL2.TGE is 1. 


See ISS encoding for an exception from HVC or SVC instruction execution. 
EC == 0b010101 
SVC instruction execution in AArch64 state. 
See ISS encoding for an exception from HVC or SVC instruction execution. 
EC == 0b011000 
Trapped MSR, MRS or System instruction execution in AArch64 state, that is not 
reported using EC 0b00000, 0b000001 or 0b000111. 
If ARMv8.4-IDST is implemented, also exceptions generated by a read access to the 
feature ID space. 
If ARMv8.0-CSV2 is implemented, also Cache Speculation Variant exceptions. 
If ARMv8.2-EVT is implemented, also traps for EL1 and ELO Cache controls. 
This includes all instructions that cause exceptions that are part of the encoding space 


defined in System instruction class encoding overview on page C5-363, except for those 
exceptions reported using EC values 0b000000, 0b000001, or 0b000111. 
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See ISS encoding for an exception from MSR, MRS, or System instruction execution in 
AArch64 state. 
EC = 0b011001 


Access to SVE functionality trapped as a result of CPACR_EL1.ZEN, 
CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ, that is not reported using EC 
0b000000. 


This EC is defined only if SVEis implemented. 
See ISS encoding for an exception from an access to SVE functionality, resulting from 
CPACR _EL1.ZEN, CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ. 

EC = 0b100000 


Instruction Abort from a lower Exception level, that might be using AArch32 or 
AArché4. 


Used for MMU faults generated by instruction accesses and synchronous External 
aborts, including synchronous parity or ECC errors. Not used for debug related 
exceptions. 


See ISS encoding for an exception from an Instruction Abort. 
EC = 0b100001 
Instruction Abort taken without a change in Exception level. 


Used for MMU faults generated by instruction accesses and synchronous External 
aborts, including synchronous parity or ECC errors. Not used for debug related 
exceptions. 


See ISS encoding for an exception from an Instruction Abort. 


EC = 0b100010 
PC alignment fault exception. 
See ISS encoding for an exception from an Illegal Execution state, or a PC or SP 
alignment fault. 
EC = 0b100100 
Data Abort from a lower Exception level, that might be using AArch32 or AArch64. 


Used for MMU faults generated by data accesses, alignment faults other than those 
caused by Stack Pointer misalignment, and synchronous External aborts, including 
synchronous parity or ECC errors. Not used for debug related exceptions. 


See ISS encoding for an exception from a Data Abort. 
EC = 0b100101 
Data Abort taken without a change in Exception level. 


Used for MMU faults generated by data accesses, alignment faults other than those 
caused by Stack Pointer misalignment, and synchronous External aborts, including 
synchronous parity or ECC errors. Not used for debug related exceptions. 


See ISS encoding for an exception from a Data Abort. 
EC = 0b100110 
SP alignment fault exception. 
See ISS encoding for an exception from an Illegal Execution state, or a PC or SP 
alignment fault. 
EC = 0b101000 
Trapped floating-point exception taken from AArch32 state. 


This EC value is valid if the implementation supports trapping of floating-point 
exceptions, otherwise it is reserved. Whether a floating-point implementation supports 
trapping of floating-point exceptions is IMPLEMENTATION DEFINED. 


See ISS encoding for an exception from a trapped floating-point exception. 
EC = 0b101100 
Trapped floating-point exception taken from AArch64 state. 
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This EC value is valid if the implementation supports trapping of floating-point 
exceptions, otherwise it is reserved. Whether a floating-point implementation supports 
trapping of floating-point exceptions is IMPLEMENTATION DEFINED. 


See ISS encoding for an exception from a trapped floating-point exception. 
EC == 0b101111 

SError interrupt. 

See ISS encoding for an SError interrupt. 
EC = 0b110000 


Breakpoint exception from a lower Exception level, that might be using AArch32 or 
AArché4. 


See ISS encoding for an exception from a Breakpoint or Vector Catch debug exception. 
EC = 0b110001 

Breakpoint exception taken without a change in Exception level. 

See ISS encoding for an exception from a Breakpoint or Vector Catch debug exception. 
EC = 0b110010 


Software Step exception from a lower Exception level, that might be using AArch32 or 
AArché4. 


See ISS encoding for an exception from a Software Step exception. 
EC == 0b110011 

Software Step exception taken without a change in Exception level. 

See ISS encoding for an exception from a Software Step exception. 
EC == 0b110100 


Watchpoint exception from a lower Exception level, that might be using AArch32 or 
AArché4. 


See ISS encoding for an exception from a Watchpoint exception. 
EC == 0b110101 

Watchpoint exception taken without a change in Exception level. 

See ISS encoding for an exception from a Watchpoint exception. 
EC == 0b111000 

BKPT instruction execution in AArch32 state. 

See ISS encoding for an exception from execution of a Breakpoint instruction. 
EC == 0b111100 

BRK instruction execution in AArch64 state. 

This is reported in ESR_EL3 only ifa BRK instruction is executed. 

See ISS encoding for an exception from execution of a Breakpoint instruction. 


All other EC values are reserved by Arm, and: 


° Unused values in the range 0b000000 - 0b101100 (0x00 - 0x2C) are reserved for future use for 
synchronous exceptions. 


e Unused values in the range 0b101101 - 0b111111 (0x2D - 0x3F) are reserved for future use, and 
might be used for synchronous or asynchronous exceptions. 


The effect of programming this field to a reserved value is that behavior is CONSTRAINED 
UNPREDICTABLE, as described in Reserved values in System and memory-mapped registers and 
translation table entries on page K1-7628. 


This field resets to an architecturally UNKNOWN value. 
IL, bit [25] 
Instruction Length for synchronous exceptions. Possible values of this bit are: 


Obd 16-bit instruction trapped. 
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Qb1 32-bit instruction trapped. This value is also used when the exception is one of the 
following: 
s An SError interrupt. 
° An Instruction Abort exception. 
. A PC alignment fault exception. 
. An SP alignment fault exception. 


g A Data Abort exception for which the value of the ISV bit is 0. 
An Illegal Execution state exception. 


. Any debug exception except for Breakpoint instruction exceptions. For 
Breakpoint instruction exceptions, this bit has its standard meaning: 


—  @b0: 16-bit T32 BKPT instruction. 
—  b1: 32-bit A32 BKPT instruction or A64 BRK instruction. 
° An exception reported using EC value 0b000000. 


This field resets to an architecturally UNKNOWN value. 


ISS, bits [24:0] 


Instruction Specific Syndrome. Architecturally, this field can be defined independently for each 
defined Exception class. However, in practice, some ISS encodings are used for more than one 
Exception class. 


Typically, an ISS encoding has a number of subfields. When an ISS subfield holds a register number, 
the value returned in that field is the AArch64 view of the register number. For an exception taken 
from AArch32 state, Mapping of the general-purpose registers between the Execution states on 
page D1-2381. 


If the AArch32 register descriptor is @b1111, then: 


: If the instruction that generated the exception was not UNPREDICTABLE, the field takes the 
value @b11111. 


od If the instruction that generated the exception was UNPREDICTABLE, the field takes an 
UNKNOWN value that must be either: 


— The AArch64 view of the register number of a register that might have been used at 
the Exception level from which the exception was taken. 


— The value 0b11111. 


When the EC field is 0b000000, indicating an exception with an unknown reason, the ISS field is not 
valid, RESO. 


The following subsections describe each ISS format. 


ISS encoding for exceptions with an unknown reason 


24 0 


RESO 


Reserved, RESO. 


Bits [24:0] 


When an exception is reported using this EC code the IL field is set to 1. 
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This EC code is used for all exceptions that are not covered by any other EC value. This includes exceptions that 
are generated in the following situations: 


The attempted execution of an instruction bit pattern that has no allocated instruction or that is not accessible 
at the current Exception level and Security state, including: 


—  Aread access using a System register pattern that is not allocated for reads or that does not permit reads 
at the current Exception level and Security state. 


— A write access using a System register pattern that is not allocated for writes or that does not permit 
writes at the current Exception level and Security state. 


— Instruction encodings that are unallocated. 


— Instruction encodings for instructions that are not implemented in the implementation. 
In Debug state, the attempted execution of an instruction bit pattern that is not accessible in Debug state. 


In Non-debug state, the attempted execution of an instruction bit pattern that is not accessible in Non-debug 
state. 


In AArch32 state, attempted execution of a short vector floating-point instruction. 


In an implementation that does not include Advanced SIMD and floating-point functionality, an attempted 
access to Advanced SIMD or floating-point functionality under conditions where that access would be 
permitted if that functionality was present. This includes the attempted execution of an Advanced SIMD or 
floating-point instruction, and attempted accesses to Advanced SIMD and floating-point System registers. 


An exception generated because of the value of one of the SCTLR_EL1.{ITD, SED, CP15BEN} control bits. 


Attempted execution of: 

— An HVC instruction when disabled by HCR_EL2.HCD or SCR_EL3.HCE. 
— An SMC instruction when disabled by SCR_EL3.SMD. 

— An HLT instruction when disabled by EDSCR.HDE. 


Attempted execution of an MSR or MRS instruction to access SP_ELO when the value of SPSel.SP is 0. 


Attempted execution, in Debug state, of: 


— A DCPS! instruction when the value of HCR_EL2.TGE is 1 and EL2 is disabled or not implemented 
in the current Security state. 


— A DCPS2 instruction from EL1 or ELO when EL2 is disabled or not implemented in the current 
Security state. 


— A DCPS3 instruction when the value of EDSCR.SDD is 1, or when EL3 is not implemented. 


When EL3 is using AArch64, attempted execution from Secure EL1 of an SRS instruction using R13_ mon. 
See Traps to EL3 of Secure monitor functionality from Secure ELI using AArch32 on page D1-2361. 


In Debug state when the value of EDSCR.SDD is 1, the attempted execution at EL2, EL1, or ELO of an 
instruction that is configured to trap to EL3. 


In AArch32 state, the attempted execution of an MRS (banked register) or an MSR (banked register) 
instruction to SPSR_mon, SP_mon, or LR_mon. 


An exception that is taken to EL2 because the value of HCR_EL2.TGE is 1 that, if the value of 
HCR_EL2.TGE was 0 would have been reported with an ESR_ELx.EC value of 0b000111. 
When SVE is not implemented, attempted execution of: 

— An SVE instruction. 

— An MSR or MRS instruction to access ZCR_EL1, ZCR_EL2, or ZCR_EL3. 
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ISS encoding for an exception from a WFI or WFE instruction 


24 23 20 19 1 0 


fi COND RESO 


el 


CV, bit [24] 
Condition code valid. Possible values of this bit are: 
0b0 The COND field is not valid. 
Qb1 The COND field is valid. 
For exceptions taken from AArch64, CV is set to 1. 
For exceptions taken from AArch32: 
° When an A32 instruction is trapped, CV is set to 1. 


° When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is setto 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
° When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— If the instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
° When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


—  CVis set to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


. For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to | it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Bits [19:1] 
Reserved, RESO. 
TI, bit [0] 
Trapped instruction. Possible values of this bit are: 
Qbd WFI trapped. 
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Qb1 WFE trapped. 


This field resets to an architecturally UNKNOWN value. 
The following fields describe configuration settings for generating this exception: 


s SCTLR_EL1.{nTWE, nTWI}. 


HCR_EL2.{TWE, TWI}. 


*  SCR_EL3.{TWE, TWL. 


ISS encoding for an exception from an MCR or MRC access 


24 23 2019 1716 1413 10 0 


9 5 4 1 


A —— 


Direction 
CV, bit [24] 
Condition code valid. Possible values of this bit are: 
ObO The COND field is not valid. 
Qb1 The COND field is valid. 
For exceptions taken from AArch64, CV is set to 1. 
For exceptions taken from AArch32: 
< When an A32 instruction is trapped, CV is set to 1. 
5 When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 


set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to @b1110. 
For exceptions taken from AArch32: 
: When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
$ When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 
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. For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Opcz2, bits [19:17] 
The Opc2 value from the issued instruction. 
For a trapped VMRS access, holds the value 0b000. 
This field resets to an architecturally UNKNOWN value. 


Opcl, bits [16:14] 
The Opcl value from the issued instruction. 
For a trapped VMRS access, holds the value @b111. 
This field resets to an architecturally UNKNOWN value. 


CRa, bits [13:10] 
The CRn value from the issued instruction. 
For a trapped VMRS access, holds the reg field from the VMRS instruction encoding. 


This field resets to an architecturally UNKNOWN value. 


Rt, bits [9:5] 


The Rt value from the issued instruction, the general-purpose register used for the transfer. The 
reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field resets to an architecturally UNKNOWN value. 


CRm, bits [4:1] 
The CRm value from the issued instruction. 
For a trapped VMRS access, holds the value 0b0000. 


This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 
Indicates the direction of the trapped instruction. The possible values of this bit are: 
Qbd Write to System register space. MCR instruction. 
Qb1 Read from System register space. MRC or VMRS instruction. 
This field resets to an architecturally UNKNOWN value. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b000011: 


° CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN}, for accesses to the Generic Timer 
Registers from ELO using AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL1 or EL2. 


- PMUSERENR ELO.{ER, CR, SW, EN}, for accesses to Performance Monitor registers from ELO using 
AArch32 state, MCR or MRC access (coproc == @b1111) trapped to EL1 or EL2. 


7 AMUSERENR _ ELO.EN, for accesses to Activity Monitors registers from ELO using AArch32 state, MCR 
or MRC access (coproc == 0b1111) trapped to EL1 or EL2. 


a HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers from EL1 using AArch32 state, 
MCR or MRC access (coproc == 0b1111) trapped to EL2. 


: HCR_EL2.TTLB, for execution of TLB maintenance instructions at EL1 using AArch32 state, MCR or 
MRC access (coproc == 0b1111) trapped to EL2. 
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HCR_EL2.{TSW, TPC, TPU} for execution of cache maintenance instructions at ELO and EL1 using 
AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.TACR, for accesses to the Auxiliary Control Register at EL1 using AArch32 state, MCR or MRC 
access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.TIDCP, for accesses to lockdown, DMA, and TCM operations at ELO and EL1 using AArch32 
state, MCR or MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.{TID1, TID2, TID3}, for accesses to ID registers at ELO and EL1 using AArch32 state, MCR or 
MRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL2.TCPAC, for accesses to CPACR_EL1 or CPACR using AArch32 state, MCR or MRC access 
(coproc == @b1111) trapped to EL2. 


HSTR_EL2.T<n>, for accesses to System registers using AArch32 state, MCR or MRC access (coproc == 
0b1111) trapped to EL2. 


CNTHCTL_EL2.EL1PCEN, for accesses to the Generic Timer registers from ELO and EL1 using AArch32 
state, MCR or MRC access (coproc == @b1111) trapped to EL2. 


MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers from ELO and EL1 using 
AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL2.TAM, for accesses to Activity Monitors registers from ELO and EL1 using AArch32 state, MCR 
or MRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL3.TCPAC, for accesses to CPACR from EL1 and EL2, and accesses to HCPTR from EL2 using 
AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL3. 


MDCR_EL3.TPM, for accesses to Performance Monitor registers from ELO, EL1 and EL2 using AArch32 
state, MCR or MRC access (coproc == 0b1111) trapped to EL3. 


CPTR_EL3.TAM, for accesses to Activity Monitors registers from ELO, EL1 and EL2 using AArch32 state, 
MCR or MRC access (coproc == 0b1111) trapped to EL3. 


See Traps to EL3 of Secure monitor functionality from Secure ELI using AArch32 on page D1-2361 for 
information on other traps using EC value 0b000011. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b000101: 


CPACR_EL1.TTA for accesses to trace registers, MCR or MRC access (coproc == 0b1110) trapped to EL1 
or EL2. 


MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers at ELO and EL1 
using AArch32 state, MCR or MRC access (coproc == 0b1110) trapped to EL1 or EL2. 


HCR_EL2.TIDO, for accesses to the JIDR register in the ID group 0 at ELO and EL1 using AArch32, MRC 
access (coproc == 0b1110) trapped to EL2. 


CPTR_EL2.TTA, for accesses to trace registers using AArch32, MCR or MRC access (coproc == 0b1110) 
trapped to EL2. 


MDCR_EL2.TDRA, for accesses to Debug ROM registers DBGDRAR and AArch-DBGDSAR using 
AArch32, MCR or MRC access (coproc == 0b1110) trapped to EL2. 


MDCR_EL2.TDOSA, for accesses to powerdown debug registers, using AArch32 state, MCR or MRC 
access (coproc == 0b1110) trapped to EL2. 


MDCR_EL2.TDA, for accesses to other debug registers, using AArch32 state, MCR or MRC access (coproc 
== 0b1110) trapped to EL2. 


CPTR_EL3.TTA, for accesses to trace registers using AArch32, MCR or MRC access (coproc == 0b1110) 
trapped to EL3. 
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° MDCR_EL3.TDOSA, for accesses to powerdown debug registers using AArch32, MCR or MRC access 
(coproc == 0b1110) trapped to EL3. 


. MDCR_EL3.TDA, for accesses to other debug registers, using AArch32, MCR or MRC access (coproc == 
0b1110) trapped to EL3. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b001000: 


è HCR_EL2.TIDO, for accesses to the FPSID register in ID group 0 at EL1 using AArch32 state, VMRS access 
trapped to EL2. 


s HCR_EL2.TID3, for accesses to registers in ID group 3 including MVFRO, MVFR1 and MVFR2, VMRS 
access trapped to EL2. 


ISS encoding for an exception from an MCRR or MRRC access 


24 23 20 19 16 15 14 10 0 


9 5 4 1 
CV — | = Direction 


RESO 


CV, bit [24] 
Condition code valid. Possible values of this bit are: 
ObO The COND field is not valid. 
0b1 The COND field is valid. 
For exceptions taken from AArch64, CV is set to 1. 
For exceptions taken from AArch32: 
° When an A32 instruction is trapped, CV is set to 1. 


s When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to @b1110. 
For exceptions taken from AArch32: 
è When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
G When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


—  CVis set to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 
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—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


. For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to | it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Opcl, bits [19:16] 
The Opcl value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Bit [15] 


Reserved, RESO. 


Rt2, bits [14:10] 


The Rt2 value from the issued instruction, the second general-purpose register used for the transfer. 
The reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field resets to an architecturally UNKNOWN value. 


Rt, bits [9:5] 


The Rt value from the issued instruction, the first general-purpose register used for the transfer. The 
reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field resets to an architecturally UNKNOWN value. 


CRm, bits [4:1] 
The CRm value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 
Indicates the direction of the trapped instruction. The possible values of this bit are: 
Qbd Write to System register space. MCRR instruction. 
Qb1 Read from System register space. MRRC instruction. 
This field resets to an architecturally UNKNOWN value. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b000100: 


° CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN}, for accesses to the Generic Timer 
Registers from ELO using AArch32 state, MCRR or MRRC access (coproc == @b1111) trapped to EL1 or 
EL2. 


: PMUSERENR ELO.{CR, EN}, for accesses to Performance Monitor registers from ELO using AArch32 
state, MCRR or MRRC access (coproc == 0b1111) trapped to EL1 or EL2. 


$ AMUSERENR ELO. {EN}, for accesses to Activity Monitors registers AMEVCNTRO<n> and 
AMEVCNTRI1<n> from ELO using AArch32 state, MCRR or MRRC access (coproc == @b1111) trapped to 
EL1 or EL2. 


< HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers from EL1 using AArch32 state, 
MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


$ HSTR_EL2.T<n>, for accesses to System registers using AArch32 state, MCRR or MRRC access (coproc 
== 0b1111) trapped to EL2. 
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CNTHCTL_EL2.{EL1PCEN, EL1PCTEN}, for accesses to the Generic Timer registers from ELO and EL1 
using AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


s MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers from ELO and EL1 using 
AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


° CPTR_EL2.TAM, for accesses to Activity Monitors registers AMEVCNTRO<n> and AMEVCNTR1<n> 
from ELO and EL1 using AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


$ MDCR_EL3.TPM, for accesses to Performance Monitor registers from ELO, EL1 and EL2 using AArch32 
state, MCRR or MRRC access (coproc == 0b1111) trapped to EL3. 


a CPTR_EL3.TAM, for accesses to Activity Monitors registers from ELO, EL1 and EL2 using AArch32 state, 
MCRR or MRRC access (coproc == 0b1111) trapped to EL3. 


The following sections describe configuration settings for generating exceptions that are reported using EC value 
0b001100: 


: CPACR_EL1.TTA for accesses to trace registers using MCR or MRC instructions, MCRR or MRRC access 
(coproc == 0b1110) trapped to EL1 or EL2. 


: MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers DBGDSAR and 
DBGDRAR at ELO using AArch32 state, MCRR or MRRC access (coproc == 0b1110) trapped to EL1 or 
EL2. 


$ CPTR_EL2.TTA, for accesses to trace registers using AArch32, MCRR or MRRC access (coproc == 0b1110) 
trapped to EL2. 


š MDCR_EL2.TDRA, for accesses to Debug ROM registers DBGDRAR and AArch-DBGDSAR using 
AArch32, MCRR or MRRC access (coproc == 0b1110) trapped to EL2. 


è CPTR_EL3.TTA, for accesses to trace registers using AArch32, MCRR or MRRC access (coproc == 0b1110) 
trapped to EL3. 


s MDCR_EL3.TDOSA, for traps to powerdown debug registers using AArch32, MCRR or MRRC access 
(coproc == 0b1110) trapped to EL3. 


° MDCR_EL3.TDA, for accesses to other debug registers, using AArch32, MCRR or MRRC access (coproc 
== 0b1110) trapped to EL3. 


ISS encoding for an exception from an LDC or STC instruction 


24 23 20 19 121110 9 5 4 3 1 0 


CV = | | L- Direction 
Offset 


RESO 


CV, bit [24] 
Condition code valid. Possible values of this bit are: 
Qbe The COND field is not valid. 
Qb1 The COND field is valid. 
For exceptions taken from AArch64, CV is set to 1. 
For exceptions taken from AArch32: 
- When an A32 instruction is trapped, CV is set to 1. 
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à When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is setto 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
s When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
è When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVis set to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


à For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


imm§8, bits [19:12] 


Bits [11:10] 


Rn, bits [9:5] 


Offset, bit [4] 


The immediate value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


The Rn value from the issued instruction, the general-purpose register used for the transfer. The 
reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field is valid only when AM[2] is 0, indicating an immediate form of the LDC or STC 
instruction. When AM[2] is 1, indicating a literal form of the LDC or STC instruction, this field is 
UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Indicates whether the offset is added or subtracted: 

ObO Subtract offset. 

Qb1 Add offset. 

This bit corresponds to the U bit in the instruction encoding. 


This field resets to an architecturally UNKNOWN value. 
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AM, bits [3:1] 
Addressing mode. The permitted values of this field are: 


0b000 Immediate unindexed. 

0b001 Immediate post-indexed. 

0b010 Immediate offset. 

0b011 Immediate pre-indexed. 

0b100 For a trapped STC instruction or a trapped T32 LDC instruction this encoding is 
reserved. 

0b110 For a trapped STC instruction, this encoding is reserved. 


The values 0b101 and 0b111 are reserved. The effect of programming this field to a reserved value is 
that behavior is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and 
memory-mapped registers and translation table entries on page K1-7644. 


Bit [2] in this subfield indicates the instruction form, immediate or literal. 
Bits [1:0] in this subfield correspond to the bits {P, W} in the instruction encoding. 
This field resets to an architecturally UNKNOWN value. 

Direction, bit [0] 
Indicates the direction of the trapped instruction. The possible values of this bit are: 
Obd Write to memory. STC instruction. 
Qb1 Read from memory. LDC instruction. 


This field resets to an architecturally UNKNOWN value. 
The following fields describe the configuration settings for the traps that are reported using EC value 0b000110: 


, MDSCR_EL1.TDCC, for accesses using AArch32 state, LDC access to DBGDTRTXint or STC access to 
DBGDTRRXint trapped to EL1 or EL2. 


$ MDCR_EL2.TDA, for accesses using AArch32 state, LDC access to DBGDTRTXint or STC access to 
DBGDTRRXint MCR or MRC access trapped to EL2. 


x MDCR_EL3.TDA, for accesses using AArch32 state, LDC access to DBGDTRTXint or STC access to 
DBGDTRRXint MCR or MRC access trapped to EL3. 


ISS encoding for an exception from an access to SVE, Advanced SIMD or floating-point 
functionality, resulting from CPACR_EL1.FPEN, CPTR_EL2.FPEN or CPTR_ELx.TFP 


24 23 20 19 0 


f COND RESO 


| 


The accesses covered by this trap include: 
e Execution of SVE or Advanced SIMD and floating-point instructions. 
° Accesses to the Advanced SIMD and floating-point System registers. 


For an implementation that does not include either SVE or support for floating-point and Advanced SIMD, the 
exception is reported using the EC value 0b000000. 


CV, bit [24] 
Condition code valid. Possible values of this bit are: 
Qbd The COND field is not valid. 
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COND, bits [23:20] 


Qb1 


The COND field is valid. 


For exceptions taken from AArch64, CV is set to 1. 


For exceptions taken from AArch32: 


When an A32 instruction is trapped, CV is set to 1. 


When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AAtrch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 


For exceptions taken from AArch32: 


When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Bits [19:0] 


Reserved, RESO. 


The following sections describe the configuration settings for the traps that are reported using EC value @b000111: 


CPACR_EL1.FPEN, for accesses to SIMD and floating-point registers trapped to EL1. 


CPTR_EL2.TFP, for accesses to SIMD and floating-point registers trapped to EL2. 


CPTR_EL2.TFP, for accesses to SIMD and floating-point registers trapped to EL3. 
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ISS encoding for an exception from an access to SVE functionality, resulting from 
CPACR_EL1.ZEN, CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ 


Bits [24:0] 
When SVE is implemented: 


Reserved, RESO. 
The accesses covered by this trap include: 
° Execution of SVE instructions. 
$ Accesses to the SVE system registers, ZCR_ELx and ID_AA64ZFR0 _EL1. 


For an implementation that does not include SVE, the exception is reported using the EC value 0b000000. 


ISS encoding for an exception from an Illegal Execution state, or a PC or SP alignment fault 


Bits [24:0] 


Reserved, RESO. 


There are no configuration settings for generating Illegal Execution state exceptions and PC alignment fault 
exceptions. For more information about these exceptions see The Illegal Execution state exception on page D1-2306 
and PC alignment checking on page D1-2287. 


SP alignment checking on page D1-2287 describes the configuration settings for generating SP alignment fault 
exceptions. 


ISS encoding for an exception from HVC or SVC instruction execution 


Reserved, RESO. 


Bits [24:16] 


imm16, bits [15:0] 
The value of the immediate field from the HVC or SVC instruction. 


For an HVC instruction, and for an A64 SVC instruction, this is the value of the imm16 field of the 
issued instruction. 


For an A32 or T32 SVC instruction: 
° If the instruction is unconditional, then: 


— For the T32 instruction, this field is zero-extended from the imm8 field of the 
instruction. 
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— For the A32 instruction, this field is the bottom 16 bits of the imm24 field of the 
instruction. 


° If the instruction is conditional, this field is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


In AArch32 state, the HVC instruction is unconditional, and a conditional SVC instruction generates an exception 
only if it passes its condition code check. Therefore, the syndrome information for these exceptions does not require 
conditionality information. 


For T32 and A32 instructions, see SVC and HVC. 


For A64 instructions, see SVC and HVC. 


ISS encoding for an exception from SMC instruction execution in AArch32 state 


24 23 20 19 18 0 


fj COND p RESO 
| 
CCKNOWNPASS 


For an SMC instruction that completes normally and generates an exception that is taken to EL3, the ISS encoding 
is RESO. 


For an SMC instruction that is trapped to EL2 from EL1 because HCR_EL2.TSC is 1, the ISS encoding is as shown 
in the diagram. 
CV, bit [24] 

Condition code valid. Possible values of this bit are: 

Qbe The COND field is not valid. 

Qb1 The COND field is valid. 

For exceptions taken from AArch64, CV is set to 1. 

For exceptions taken from AArch32: 

a When an A32 instruction is trapped, CV is set to 1. 


- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 
set to 0. See the description of the COND field for more information. 


This field is only valid if CCKNOWMPASS is 1, otherwise it is RESO. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
: When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 


D13-2936 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


— With the COND value held in the instruction. 
3 When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


—  CVis set to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


° For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field is only valid if CCKNOWMPASS is 1, otherwise it is RESO. 
This field resets to an architecturally UNKNOWN value. 
CCKNOWNMPASS, bit [19] 


Indicates whether the instruction might have failed its condition code check. 





Ob The instruction was unconditional, or was conditional and passed its condition code 
check. 
Qb1 The instruction was conditional, and might have failed its condition code check. 
Note 


In an implementation in which an SMC instruction that fails it code check is not trapped, this field 
can always return the value 0. 





This field resets to an architecturally UNKNOWN value. 
Bits [18:0] 
Reserved, RESO. 
HCR_EL2.TSC describes the configuration settings for trapping SMC instructions to EL2. 


See System calls on page D1-2371 describes the case where these exceptions are trapped to EL3. 


ISS encoding for an exception from SMC instruction execution in AArch64 state 


Bits [24:16] 
Reserved, RESO. 
imm16, bits [15:0] 
The value of the immediate field from the issued SMC instruction. 


This field resets to an architecturally UNKNOWN value. 


The value of ISS[24:0] described here is used both: 


s When an SMC instruction is trapped from EL1 modes. 
- When an SMC instruction is not trapped, so completes normally and generates an exception that is taken to 
EL3. 


HCR_EL2.TSC describes the configuration settings for trapping SMC from EL1 modes. 


System calls on page D1-2371 describes the case where these exceptions are trapped to EL3. 
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ISS encoding for an exception from MSR, MRS, or System instruction execution in AArch64 state 


22212019 1716 1413 


Lean 


Bits [24:22] 


Reserved, RESO. 


Op), bits [21:20] 

The Op0 value from the issued instruction. 

This field resets to an architecturally UNKNOWN value. 
Op2, bits [19:17] 

The Op2 value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Op1, bits [16:14] 
The Op! value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


CRn, bits [13:10] 
The CRn value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Rt, bits [9:5] 
The Rt value from the issued instruction, the general-purpose register used for the transfer. 


This field resets to an architecturally UNKNOWN value. 


CRm, bits [4:1] 
The CRm value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 
Indicates the direction of the trapped instruction. The possible values of this bit are: 
Oba Write access, including MSR instructions. 
Qb1 Read access, including MRS instructions. 


This field resets to an architecturally UNKNOWN value. 


For exceptions caused by System instructions, see System instructions for the encoding values returned by an 
instruction. 


The following fields describe configuration settings for generating the exception that is reported using EC value 
0b011000: 


è SCTLR_EL1.UCI, for execution of cache maintenance instructions using AArch64 state, MSR or MRS 
access trapped to EL1 or EL2. 


s SCTLR_EL1.UCT, for accesses to CTR_ELO using AArch64 state, MSR or MRS access trapped to EL1 or 
EL2. 


s SCTLR_EL1.DZE, for execution of DC ZVA instructions using AArch64 state, MSR or MRS access trapped 
to EL1 or EL2. 
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SCTLR_EL1.UMA, for accesses to the PSTATE interrupt masks using AArch64 state, MSR or MRS access 
trapped to EL1 or EL2. 


CPACR_ELI1.TTA, for accesses to the trace registers using AArch64 state, MSR or MRS access trapped to 
EL] or EL2. 


MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers using AArch64 
state, MSR or MRS access trapped to EL1 or EL2. 


CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN} accesses to the Generic Timer 
registers using AArch64 state, MSR or MRS access trapped to EL! or EL2. 


PMUSERENR ELO.{ER, CR, SW, EN}, for accesses to the Performance Monitor registers using AArch64 
state, MSR or MRS access trapped to EL1 or EL2. 


AMUSERENR _ ELO.EN, for accesses to Activity Monitors registers using AArch64 state, MSR or MRS 
access trapped to EL1 or EL2. 


HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers using AArch64 state, MSR or 
MRS access trapped to EL2. 


HCR_EL2.TDZ, for execution of DC ZVA instructions using AArch64 state, MSR or MRS access trapped 
to EL2. 


HCR_EL2.TTLB, for execution of TLB maintenance instructions using AArch64 state, MSR or MRS access 
trapped to EL2. 


HCR_EL2.{TSW, TPC, TPU}, for execution of cache maintenance instructions using AArch64 state, MSR 
or MRS access trapped to EL2. 


HCR_EL2.TACR, for accesses to the Auxiliary Control Register, ACTLR_EL1, using AArch64 state, MSR 
or MRS access trapped to EL2. 


HCR_EL2.TIDCP, for accesses to lockdown, DMA, and TCM operations using AArch64 state, MSR or 
MRS access trapped to EL2. 


HCR_EL2.{TID1, TID2, TID3}, for accesses to ID group 1, ID group 2 or ID group 3 registers, using 
AArch64 state, MSR or MRS access trapped to EL2. 


CPTR_EL2.TCPAC, for accesses to CPACR_EL1, using AArch64 state, MSR or MRS access trapped to 
EL2. 


CPTR_EL2.TTA, for accesses to the trace registers, using AArch64 state, MSR or MRS access trapped to 
EL2. 


MDCR_EL2.TTRF, for accesses to the trace filter register, TRFCR_EL1, using AArch64 state, MSR or MRS 
access trapped to EL2. 


MDCR_EL2.TDRA, for accesses to Debug ROM registers, using AArch64 state, MSR or MRS access 
trapped to EL2. 


MDCR_EL2.TDOSA, for accesses to powerdown debug registers using AArch64 state, MSR or MRS access 
trapped to EL2. 


CNTHCTL_EL2.{EL1PCEN, EL1PCTEN}, for accesses to the Generic Timer registers using AArch64 
state, MSR or MRS access trapped to EL2. 


MDCR_EL2.TDA, for accesses to debug registers using AArch64 state, MSR or MRS access trapped to EL2. 


MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers, using AArch64 state, MSR or 
MRS access trapped to EL2. 


CPTR_EL2.TAM, for accesses to Activity Monitors registers, using AArch64 state, MSR or MRS access 
trapped to EL2. 
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s HCR_EL2.APK, for accesses to Pointer authentication key registers. using AArch64 state, MSR or MRS 
access trapped to EL2. 


s HCR_EL2.{NV, NV1}, for Nested virtualization register access, using AArch64 state, MSR or MRS access, 
trapped to EL2. 


è HCR_EL2.AT, for execution of AT S1E* instructions, using AArch64 state, MSR or MRS access, trapped to 
EL2. 


s HCR_EL2.{TERR, FIEN}, for accesses to RAS registers, using AArch64 state, MSR or MRS access, 
trapped to EL2. 


à SCR_EL3.APK, for accesses to Pointer authentication key registers, using AArch64 state, MSR or MRS 
access trapped to EL3. 


$ SCR_EL3.ST, for accesses to the Counter-timer Physical Secure timer registers, using AArch64 state, MSR 
or MRS access trapped to EL3. 


è SCR_EL3.{TERR, FIEN}, for accesses to RAS registers, using AArch64 state, MSR or MRS access trapped 
to EL3. 


s CPTR_EL3.TCPAC, for accesses to CPTR_EL2 and CPACR_EL1 using AArch64 state, MSR or MRS 
access trapped to EL3. 


s CPTR_EL3.TTA, for accesses to the trace registers, using AArch64 state, MSR or MRS access trapped to 
EL3. 


7 MDCR_EL3.TTRF, for accesses to the filter trace control registers, TRFCR_EL1 and TRFCR_EL2, using 
AArch64 state, MSR or MRS access trapped to EL3. 


` MDCR_EL3.TDA, for accesses to debug registers, using AArch64 state, MSR or MRS access trapped to 
EL3. 


. MDCR_EL3.TDOSA, for accesses to powerdown debug registers, using AArch64 state, MSR or MRS 
access trapped to EL3. 





s MDCR_EL3.TPM, for accesses to Performance Monitor registers, using AArch64 state, MSR or MRS 
access trapped to EL3. 


. CPTR_EL3.TAM, for accesses to Activity Monitors registers, using AArch64 state, MSR or MRS access, 
trapped to EL3. 


° If ARMv8.2-EVT is implemented, HCR_EL2.{TTLBOS, TTLBIS, TICAB, TOCU, TID4} and 
HCR2.{TTLBIS, TICAB, TOCU, TID4} control traps for EL1 and ELO Cache controls that use this EC 
value. 


ISS encoding for a IMPLEMENTATION DEFINED exception to EL3 


24 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [24:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 
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ISS encoding for an exception from an Instruction Abort 


24 131211109 8 7 6 5 0 


Bits [24:13] 
Reserved, RESO. 
SET, bits [12:11] 


Synchronous Error Type. When the RAS Extension is implemented and IFSC is 0b010000, describes 
the state of the PE after taking the Instruction Abort exception. The possible values of this field are: 


0b00 Recoverable error (UER). 
0b10 Uncontainable error (UC). 
0b11 Restartable error (UEO) or Corrected error (CE). 


All other values are reserved. 


Note 


Software can use this information to determine what recovery might be possible. Taking a 
synchronous External Abort exception might result in an unrecoverable PE state. 








This field is RESO if either: 
° The RAS Extension is not implemented. 
° The value returned in the IFSC field is not 0b010000. 


This field resets to an architecturally UNKNOWN value. 


FnV, bit [10] 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd FAR is valid. 
Qb1 FAR is not valid, and holds an UNKNOWN value. 
This field is only valid if the IFSC code is @b@10000. It is RESO for all other aborts. 


This field resets to an architecturally UNKNOWN value. 


EA, bit [9] 


External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External 
aborts. 


For any abort other than an External abort this bit returns a value of 0. 
This field resets to an architecturally UNKNOWN value. 
Bit [8] 


Reserved, RESO. 
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SIPTW, bit [7] 


Bit [6] 


IFSC, bits [5:0 


For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 
translation table walk: 


Qbd Fault not on a stage 2 translation for a stage 1 translation table walk. 
Qb1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. 
For any abort other than a stage 2 fault this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


] 


Instruction Fault Status Code. Possible values of this field are: 
@b000000 Address size fault, level 0 of translation or translation table base register 
0b000001 Address size fault, level 1 

0b000010 Address size fault, level 2 

0b000011 Address size fault, level 3 

0b000100 Translation fault, level 0 

0b000101 Translation fault, level 1 

0b000110 Translation fault, level 2 

0b000111 Translation fault, level 3 

0b001001 Access flag fault, level 1 

0b001010 Access flag fault, level 2 

0b001011 Access flag fault, level 3 

0b001101 Permission fault, level 1 

0b001110 Permission fault, level 2 

0b001111 Permission fault, level 3 





0b010000 Synchronous External abort, not on translation table walk 

0b010100 Synchronous External abort, on translation table walk, level 0 

0b010101 Synchronous External abort, on translation table walk, level 1 

0b010110 Synchronous External abort, on translation table walk, level 2 

0b010111 Synchronous External abort, on translation table walk, level 3 

0b011000 Synchronous parity or ECC error on memory access, not on translation table walk 
0b01110@ Synchronous parity or ECC error on memory access on translation table walk, level 0 
0b011101 Synchronous parity or ECC error on memory access on translation table walk, level 1 
0b011110 Synchronous parity or ECC error on memory access on translation table walk, level 2 
Qb011111 Synchronous parity or ECC error on memory access on translation table walk, level 3 
0b110000 TLB conflict abort 


0b110001 Unsupported atomic hardware update fault, if the implementation includes 
ARMv8.1-TTHM. Otherwise reserved. 


All other values are reserved. 
When the RAS Extension is implemented, 06011000, 0b011100, 0b011101, 0b011110, and 0b011111, are 


reserved. 


Note 
Armv8.2 requires the implementation of the RAS Extension. 
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For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on page D5-2628. 
Note 


Because Access flag faults and Permission faults can only result from a Block or Page translation 
table descriptor, they cannot occur at level 0. 








If the SIPTW bit is set, then the level refers the level of the stage2 translation that is translating a 
stage 1 translation walk. 


This field resets to an architecturally UNKNOWN value. 


ISS encoding for an exception from a Data Abort 


24 23 22 21 20 161514131211109 8 7 6 5 





—e 
a 


ISV, bit [24] 
Instruction syndrome valid. Indicates whether the syndrome information in ISS[23:14] is valid. 
ObO No valid instruction syndrome. ISS[23:14] are RESO. 
Qb1 ISS[23:14] hold a valid instruction syndrome. 
This bit is 0 for all faults reported in ESR_EL2 except the following stage 2 aborts: 


° AArch64 loads and stores of a single general-purpose register (including the register 
specified with 0b11111, including those with Acquire/Release semantics, but excluding Load 
Exclusive or Store Exclusive and excluding those with writeback. 


. AArch32 instructions where the instruction: 


— Isan LDR, LDA, LDRT, LDRSH, LDRSHT, LDRH, LDAH, LDRHT, LDRSB, 
LDRSBT, LDRB, LDAB, LDRBT, STR, STL, STRT, STRH, STLH, STRHT, STRB, 
STLB, or STRBT instruction. 


— Is not performing register writeback. 
—  Isnot using R15 as a source or destination register. 


For these cases, ISV is UNKNOWN if the exception was generated in Debug state in memory access 
mode, and otherwise indicates whether ISS[23:14] hold a valid syndrome. 


ISV is 0 for all faults reported in ESR_EL1 or ESR_EL3. 
When the RAS Extension is implemented, ISV is 0 for any synchronous External abort. 


For ISS reporting, a stage 2 abort on a stage 1 translation table walk does not return a valid 
instruction syndrome, and therefore ISV is 0 for these aborts. 


When the RAS Extension is not implemented, the value of ISV on a synchronous External abort on 
a stage 2 translation table walk is IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


SAS, bits [23:22] 


Syndrome Access Size. When ISV is 1, indicates the size of the access attempted by the faulting 
operation. 


0b00 Byte 
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SSE, bit [21] 


Qb01 Halfword 
0b10 Word 
Qb11 Doubleword 


This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 
This field resets to an architecturally UNKNOWN value. 


Syndrome Sign Extend. When ISV is 1, for a byte, halfword, or word load operation, indicates 
whether the data item must be sign extended. For these cases, the possible values of this bit are: 


Qbe Sign-extension not required. 

Qb1 Data item must be sign-extended. 

For all other operations this bit is 0. 

This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


SRT, bits [20:16] 


SF, bit [15] 


AR, bit [14] 


Syndrome Register transfer. When ISV is 1, the register number of the Rt operand of the faulting 
instruction. If the exception was taken from an Exception level that is using AArch32 then this is 
the AArch64 view of the register. See Mapping of the general-purpose registers between the 
Execution states on page D1-2381. 


This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 
This field resets to an architecturally UNKNOWN value. 


Width of the register accessed by the instruction is Sixty-Four. When ISV is 1, the possible values 
of this bit are: 


Qbd Instruction loads/stores a 32-bit wide register. 
Qb1 Instruction loads/stores a 64-bit wide register. 
Note 





This field specifies the register width identified by the instruction, not the Execution state. 





This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


Acquire/Release. When ISV is 1, the possible values of this bit are: 
Qbd Instruction did not have acquire/release semantics. 

Qb1 Instruction did have acquire/release semantics. 

This field is UNKNOWN when the value of ISV is UNKNOWN. 

This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 
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VNCR, bit [13] 
Indicates that the fault came from use of VNCR_EL2 register by EL1 code. 


Qbd The fault was not generated by the use of VNCR_EL2, by an MRS or MSR instruction 
executed at EL1. 
Qb1 The fault was generated by the use of VNCR_EL2, by an MRS or MSR instruction 


executed at EL1. 
This field is 0 in ESR_EL1. 
This field resets to an architecturally UNKNOWN value. 


SET, bits [12:11] 


Synchronous Error Type. When the RAS Extension is implemented and DFSC is 0b010000, 
describes the state of the PE after taking the Data Abort exception. The possible values of this field 


are: 
0b00 Recoverable error (UER). 
0b10 Uncontainable error (UC). 
0b11 Restartable error (UEO) or Corrected error (CE). 


All other values are reserved. 





Note 


Software can use this information to determine what recovery might be possible. Taking a 
synchronous External Abort exception might result in an unrecoverable PE state. 





This field is RESO if either: 
: The RAS Extension is not implemented. 
° The value returned in the DFSC field is not 0b010000. 


This field resets to an architecturally UNKNOWN value. 


Fn, bit [10] 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Obd FAR is valid. 

0b1 FAR is not valid, and holds an UNKNOWN value. 

This field is valid only if the DFSC code is 0b010000. It is RESO for all other aborts. 
This field resets to an architecturally UNKNOWN value. 


EA, bit [9] 


External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External 
aborts. 


For any abort other than an External abort this bit returns a value of 0. 


This field resets to an architecturally UNKNOWN value. 


CM, bit [8] 
Cache maintenance. Indicates whether the Data Abort came from a cache maintenance or address 


translation instruction: 


Qbd The Data Abort was not generated by the execution of one of the System instructions 
identified in the description of value 1. 


Qb1 The Data Abort was generated by either the execution of a cache maintenance 
instruction or by a synchronous fault on the execution of an address translation 
instruction. The DC ZVA instruction is not classified as a cache maintenance 
instruction, and therefore its execution cannot cause this field to be set to 1. 


This field resets to an architecturally UNKNOWN value. 
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SIPTW, bit [7] 


Wa, bit [6] 


For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 
translation table walk: 


Qbd Fault not on a stage 2 translation for a stage 1 translation table walk. 
Qb1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. 
For any abort other than a stage 2 fault this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Write not Read. Indicates whether a synchronous abort was caused by an instruction writing to a 
memory location, or by an instruction reading from a memory location. The possible values of this 
bit are: 


Obed Abort caused by an instruction reading from a memory location. 
Qb1 Abort caused by an instruction writing to a memory location. 


For faults on cache maintenance and address translation instructions, this bit always returns a value 
of 1. 


For faults from an atomic instruction that both reads and writes from a memory location, this bit is 
set to 0 if a read of the address specified by the instruction would have generated the fault which is 
being reported, otherwise it is set to 1. The architecture permits, but does not require, a relaxation 
of this requirement such that for all stage 2 aborts on stage 1 translation table walks for atomic 
instructions, the WnR bit is always 0. 


This field is UNKNOWN for: 
. An External abort on an Atomic access. 


° A fault reported using a DFSC value of 0b110101 or 0b110001, indicating an unsupported 
Exclusive or atomic access. 


This field resets to an architecturally UNKNOWN value. 


DFSC, bits [5:0] 


Data Fault Status Code. Possible values of this field are: 
0b000000 Address size fault, level 0 of translation or translation table base register. 
0b000001 Address size fault, level 1. 

0b000010 Address size fault, level 2. 

0b000011 Address size fault, level 3. 

0b000100 ‘Translation fault, level 0. 

0b000101 Translation fault, level 1. 

0b000110 Translation fault, level 2. 

0b000111 Translation fault, level 3. 

0b001001 Access flag fault, level 1. 

0b001010 Access flag fault, level 2. 

0b001011 Access flag fault, level 3. 

0b001101 Permission fault, level 1. 

0b001110 Permission fault, level 2. 

0b001111 Permission fault, level 3. 





0b010000 Synchronous External abort, not on translation table walk. 
0b010001 Synchronous Tag Check fail 

0b01010@ Synchronous External abort, on translation table walk, level 0. 
0b010101 Synchronous External abort, on translation table walk, level 1. 
0b010110 Synchronous External abort, on translation table walk, level 2. 
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0b010111 Synchronous External abort, on translation table walk, level 3. 

0b01100@ Synchronous parity or ECC error on memory access, not on translation table walk. 
0b011100 Synchronous parity or ECC error on memory access on translation table walk, level 0. 
0b011101 Synchronous parity or ECC error on memory access on translation table walk, level 1. 
0b011110 Synchronous parity or ECC error on memory access on translation table walk, level 2. 
Qb011111 Synchronous parity or ECC error on memory access on translation table walk, level 3. 
0b100001 Alignment fault. 

0b110000 TLB conflict abort. 


0b110001 Unsupported atomic hardware update fault, if the implementation includes 
ARMv8.1-TTHM. Otherwise reserved. 


Qb11010@ IMPLEMENTATION DEFINED fault (Lockdown). 

@b110101 IMPLEMENTATION DEFINED fault (Unsupported Exclusive or Atomic access). 
@b111101 Section Domain Fault, used only for faults reported in the PAR_EL1. 
@b111110 Page Domain Fault, used only for faults reported in the PAR_EL1. 

All other values are reserved. 


When the RAS Extension is implemented, 06011000, @b011100, 0b011101, 0b011110, and 0b011111, are 
reserved. 


For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on page D5-2628. 





Note 


Because Access flag faults and Permission faults can only result from a Block or Page translation 
table descriptor, they cannot occur at level 0. 





If the SIPTW bit is set, then the level refers the level of the stage2 translation that is translating a 
stage 1 translation walk. 


This field resets to an architecturally UNKNOWN value. 


ISS encoding for an exception from a trapped floating-point exception 


24 23 22 11 10 876543210 


RESO — | = IOF 
TFV DZF 


Bit [24] 


TEV, bit [23] 


Reserved, RESO. 


Trapped Fault Valid bit. Indicates whether the IDF, [IXF, UFF, OFF, DZF, and IOF bits hold valid 
information about trapped floating-point exceptions. The possible values of this bit are: 


Qbd The IDF, [XF, UFF, OFF, DZF, and IOF bits do not hold valid information about trapped 
floating-point exceptions and are UNKNOWN. 
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Bits [22:11] 


VECITR, bits 


IDF, bit [7] 


Bits [6:5] 


IXF, bit [4] 


UFF, bit [3] 


OFF, bit [2] 


Qb1 One or more floating-point exceptions occurred during an operation performed while 
executing the reported instruction. The IDF, IXF, UFF, OFF, DZF, and IOF bits indicate 
trapped floating-point exceptions that occurred. For more information see 
Floating-point exceptions and exception traps on page D1-2313. 


It is IMPLEMENTATION DEFINED whether this field is set to 0 on an exception generated by a trapped 
floating point exception from a vector instruction. 
Note 


This is not a requirement. Implementations can set this field to 1 on a trapped floating-point 
exception from a vector instruction and return valid information in the {IDF, IXF, UFF, OFF, DZF, 
IOF} fields. 








This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


[10:8] 


For a trapped floating-point exception from an instruction executed in AArch32 state this field is 
RES1. 


For a trapped floating-point exception from an instruction executed in AArch64 state this field is 
UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Input Denormal floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Input denormal floating-point exception has not occurred. 
Qb1 Input denormal floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Inexact floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, 
the possible values of this bit are: 


Qbd Inexact floating-point exception has not occurred. 
Qb1 Inexact floating-point exception occurred during execution of the reported instruction. 


This field resets to an architecturally UNKNOWN value. 


Underflow floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Underflow floating-point exception has not occurred. 
Qb1 Underflow floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


Overflow floating-point exception trapped bit. Ifthe TFV field is 0, this bit is UNKNOWN. Otherwise, 
the possible values of this bit are: 


Qbd Overflow floating-point exception has not occurred. 
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Qb1 Overflow floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 
DZF, bit [1] 


Divide by Zero floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Divide by Zero floating-point exception has not occurred. 
Qb1 Divide by Zero floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


IOF, bit [0] 


Invalid Operation floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Invalid Operation floating-point exception has not occurred. 
Qb1 Invalid Operation floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 
In an implementation that supports the trapping of floating-point exceptions: 


° From an Exception level using AArch64, the FPCR. {IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of 
the floating-point exception traps. 


. From an Exception level using AArch32, the FPSCR. {IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of 
the floating-point exception traps. 


ISS encoding for an SError interrupt 


24 23 141312 109 8 6 5 0 


i RESO | ver | RESO DFSC 
IDS _ 4 eer EA 
IESB 


IDS, bit [24] 


IMPLEMENTATION DEFINED syndrome. Possible values of this bit are: 








Ob Bits[23:0] of the ISS field holds the fields described in this encoding. 
Note 
If the RAS Extension is not implemented, this means that bits[23:0] of the ISS field are 
RESO. 
Qb1 Bits[23:0] of the ISS field holds IMPLEMENTATION DEFINED syndrome information that 


can be used to provide additional information about the SError interrupt. 


Note 
This field was previously called ISV. 








This field resets to an architecturally UNKNOWN value. 
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Bits [23:14] 


IESB, bit [13] 


Reserved, RESO. 


Implicit error synchronization event. 


Qbd The SError interrupt was either not synchronized by the implicit error synchronization 
event or not taken immediately. 


Qb1 The SError interrupt was synchronized by the implicit error synchronization event and 
taken immediately. 


This field is RESO if the value returned in the DFSC field is not 0b010001. 





Note 
Armv8.2 requires the implementation of the RAS Extension and ARMv8.2-IESB. 


This field resets to an architecturally UNKNOWN value. 


AET, bits [12:10] 


EA, bit [9] 


Asynchronous Error Type. 


When the RAS Extension is implemented and DFSC is 0b010001, describes the state of the PE after 
taking the SError interrupt exception. The possible values of this field are: 


0b000 Uncontainable error (UC). 
0b001 Unrecoverable error (UEU). 
0b010 Restartable error (UEO). 
0b011 Recoverable error (UER). 
0b110 Corrected error (CE). 

All other values are reserved. 


If multiple errors are taken as a single SError interrupt exception, the overall state of the PE is 
reported. For example, if both a Recoverable and Unrecoverable error occurred, the state is 
Unrecoverable. 





Note 


Software can use this information to determine what recovery might be possible. The recovery 
software must also examine any implemented fault records to determine the location and extent of 
the error. 


This field is RESO if either: 
. The RAS Extension is not implemented. 


. The value returned in the DFSC field is not 0b010001. 


Note 
Armv8.2 requires the implementation of the RAS Extension. 





This field resets to an architecturally UNKNOWN value. 


External abort type. When the RAS Extension is implemented, this bit can provide an 
IMPLEMENTATION DEFINED Classification of External aborts. 


For any abort other than an External abort this bit returns a value of 0. 
This field is RESO if either: 
- The RAS Extension is not implemented. 


° The value returned in the DFSC field is not 0b010001. 
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Note 
Armv8.2 requires the implementation of the RAS Extension. 








This field resets to an architecturally UNKNOWN value. 


Bits [8:6] 


Reserved, RESO. 


DFSC, bits [5:0] 
Data Fault Status Code. When the RAS Extension is implemented, possible values of this field are: 
0b000000 Uncategorized. 
0b010001 Asynchronous SError interrupt. 
All other values are reserved. 
If the RAS Extension is not implemented, this field is RESO. 


Note 
Armv8.2 requires the implementation of the RAS Extension. 








This field resets to an architecturally UNKNOWN value. 


ISS encoding for an exception from a Breakpoint or Vector Catch debug exception 


24 6 5 0 
RESO IFSC 


Reserved, RESO. 


Bits [24:6] 


IFSC, bits [5:0] 
Instruction Fault Status Code. This field is set to 0b100010, to indicate a Debug exception. 


This field resets to an architecturally UNKNOWN value. 
For more information about generating these exceptions: 
° For exceptions from AArch64, see Breakpoint exceptions on page D2-2413. 


: For exceptions from AArch32, see Breakpoint exceptions on page G2-5628 and Vector Catch exceptions on 
page G2-5667. 


ISS encoding for an exception from a Software Step exception 


24 23 765 0 


ISV, bit [24] 
Instruction syndrome valid. Indicates whether the EX bit, ISS[6], is valid, as follows: 


Qbd EX bit is RESO. 
0b1 EX bit is valid. 
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Bits [23:7] 


EX, bit [6] 


See the EX bit description for more information. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Exclusive operation. If the ISV bit is set to 1, this bit indicates whether a Load-Exclusive instruction 
was stepped. 


Ob An instruction other than a Load-Exclusive instruction was stepped. 
Qb1 A Load-Exclusive instruction was stepped. 
If the ISV bit is set to 0, this bit is RESO, indicating no syndrome data is available. 


This field resets to an architecturally UNKNOWN value. 


IFSC, bits [5:0] 


Instruction Fault Status Code. This field is set to 0b100010, to indicate a Debug exception. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see Software Step exceptions on page D2-2446. 


ISS encoding for an exception from a Watchpoint exception 


VNCR ee ee: WnR 


Bits [24:14] 


24 14 13 12 98765 0 
RESO i] RESO 7 | DFSC 


RESO 
CM 


Reserved, RESO. 


VNCR, bit [13] 


Indicates that the watchpoint came from use of VNCR_EL2 register by EL1 code. 

Qbd The watchpoint was not generated by the use of VNCR_EL2 by EL] code. 
Qb1 The watchpoint was generated by the use of VNCR_EL2 by EL1 code. 
This field is 0 in ESR_ELI. 


This field resets to an architecturally UNKNOWN value. 


Bits [12:9] 
Reserved, RESO. 
CM, bit [8] 

Cache maintenance. Indicates whether the Watchpoint exception came from a cache maintenance 

or address translation instruction: 

Qbd The Watchpoint exception was not generated by the execution of one of the System 
instructions identified in the description of value 1. 

Qb1 The Watchpoint exception was generated by either the execution of a cache 
maintenance instruction or by a synchronous Watchpoint exception on the execution of 
an address translation instruction. The DC ZVA instruction is not classified as a cache 
maintenance instruction, and therefore its execution cannot cause this field to be set to 1. 
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This field resets to an architecturally UNKNOWN value. 


Bit [7] 


Reserved, RESO. 


Wak, bit [6] 


Write not Read. Indicates whether the Watchpoint exception was caused by an instruction writing 
to a memory location, or by an instruction reading from a memory location. The possible values of 
this bit are: 


Qbd Watchpoint exception caused by an instruction reading from a memory location. 
Qb1 Watchpoint exception caused by an instruction writing to a memory location. 


For Watchpoint exceptions on cache maintenance and address translation instructions, this bit 
always returns a value of 1. 


For Watchpoint exceptions from an atomic instruction, this field is set to 0 if a read of the location 
would have generated the Watchpoint exception, otherwise it is set to 1. 


Ifmultiple watchpoints match on the same access, it is UNPREDICTABLE which watchpoint generates 
the Watchpoint exception. 


This field resets to an architecturally UNKNOWN value. 


DFSC, bits [5:0] 
Data Fault Status Code. This field is set to 0b100010, to indicate a Debug exception. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see Watchpoint exceptions on page D2-2431. 


ISS encoding for an exception from execution of a Breakpoint instruction 


24 1615 0 


Reserved, RESO. 


Bits [24:16] 


Comment, bits [15:0] 


Set to the instruction comment field value, zero extended as necessary. For the AArch32 BKPT 
instructions, the comment field is described as the immediate field. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see Breakpoint Instruction exceptions on page D2-2411. 


ISS encoding for an exception from ERET, ERETAA or ERETAB instruction 


24 2 10 
RESO il 
— 
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This EC value only applies when HCR_EL2.NV is 1. 


Bits [24:2] 
Reserved, RESO. 
ERET, bit [1] 
Indicates whether an ERET or ERETA* instruction was trapped to EL2. Possible values are: 
Qbd ERET instruction trapped to EL2. 
Qb1 ERETAA or ERETAB instruction trapped to EL2. 
If this bit is 0, the ERETA field is RESO. 
This field resets to an architecturally UNKNOWN value. 
ERETA, bit [0] 
Indicates whether an ERETAA or ERETAB instruction was trapped to EL2. Possible values are: 
Qbd ERETAA instruction trapped to EL2. 
Qb1 ERETAB instruction trapped to EL2. 
When the ERET field is 0, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see HCR_EL2.NV. 


ISS encoding for an exception from Branch Target Identification instruction 


Bits [24:2] 


Reserved, RESO. 


BTYPE, bits [1:0] 
This field is set to the PSTATE.BTYPE value that generated the Branch Target Exception. 


For more information about generating these exceptions, see Chapter B1 The AArch64 Application Level 
Programmers’ Model. 


ISS encoding for an exception from a Pointer Authentication instruction when HCR_EL2.API == 


|| SCR_EL3.API == 
24 0 


Reserved, RESO. 


Bits [24:0] 


For more information about generating these exceptions, see: 


$ HCR_EL2.API, for exceptions from Pointer authentication instructions, using AArch64 state, trapped to 
EL2. 


D13-2954 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


: SCR_EL3.API, for exceptions from Pointer authentication instructions, using AArch64 state, trapped to EL3. 


Accessing the ESR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic ESR_EL1 or 
ESR_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ESR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0101 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x138]; 
else 
return ESR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.£2H == '1' then 
return ESR_EL2; 
else 
return ESR_EL1; 
elsif PSTATE.EL == EL3 then 
return ESR_EL1; 


MSR ESR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b0101 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x138] = X[t]; 
else 
ESR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
ESR_EL2 = X[t]; 
else 








ESR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ESR_EL1 = X[t]; 
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MRS <Xt>, ESR_EL12 





op0 op1 CRn CRm 


op2 


0b11 0b101 0b0101 0b0010 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x138]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return ESR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return ESR_EL1; 
else 
UNDEFINED; 


MSR ESR_EL12, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b101 0b0101 0b0010 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x138] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
ESR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
ESR_EL1 = X[t]; 
else 
UNDEFINED; 
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MRS <Xt>, ESR_EL2 





op0 op1 CRn 


0b11 0b100 0b0101 


CRm 


0b0010 


op2 


0b000 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 


if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return ESR_EL1; 

elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 

else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 


return ESR_EL2; 


elsif PSTATE.EL == EL3 then 


return ESR_EL2; 


MSR ESR_EL2, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b100 0b0101 


0b0010 


0b000 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 


if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
ESR_EL1 = X[t]; 

elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 

else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 


ESR_EL2 = X[t]; 


elsif PSTATE.EL == EL3 then 


ESR_EL2 = X[t]; 
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D13.2.37 ESR_EL2, Exception Syndrome Register (EL2) 
The ESR_EL2 characteristics are: 


Purpose 


Holds syndrome information for an exception taken to EL2. 


Configurations 


AArch6é4 System register ESR_EL2[31:0] is architecturally mapped to AArch32 System register 
HSR[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ESR_EL2 is a 64-bit register. 


Field descriptions 


The ESR_EL2 bit assignments are: 


32 31 26 25 24 


63 0 
| RESO EC h ISS 


ESR_EL2 is made UNKNOWN as a result of an exception return from EL2. 


When an UNPREDICTABLE instruction is treated as UNDEFINED, and the exception is taken to EL2, the value of 
ESR_EL2 is UNKNOWN. The value written to ESR_EL2 must be consistent with a value that could be created as a 
result of an exception from the same Exception level that generated the exception as a result of a situation that is 
not UNPREDICTABLE at that Exception level, in order to avoid the possibility of a privilege violation. 

Bits [63:32] 


Reserved, RESO. 


EC, bits [31:26] 
Exception Class. Indicates the reason for the exception that this register holds information about. 
For each EC value, the table references a subsection that gives information about: 
x The cause of the exception, for example the configuration required to enable the trap. 
° The encoding of the associated ISS. 
Possible values of the EC field are: 
EC == 0b000000 
Unknown reason. 
See ISS encoding for exceptions with an unknown reason. 
EC == 0b000001 
Trapped WFI or WFE instruction execution. 


Conditional WFE and WFI instructions that fail their condition code check do not cause 
an exception. 


See ISS encoding for an exception from a WFI or WFE instruction. 
EC == 0b000011 


Trapped MCR or MRC access with (coproc==0b1111) that is not reported using EC 
0b000000. 
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See ISS encoding for an exception from an MCR or MRC access. 
EC = 0b000100 


Trapped MCRR or MRRC access with (coproc==0b1111) that is not reported using EC 
0b000000. 


See ISS encoding for an exception from an MCRR or MRRC access. 
EC == 0b000101 

Trapped MCR or MRC access with (coproc==0b1110). 

See ISS encoding for an exception from an MCR or MRC access. 
EC == 0b000110 

Trapped LDC or STC access. 

The only architected uses of these instruction are: 

s An STC to write data to memory from DBGDTRRXint. 

s An LDC to read data from memory to DBGDTRTXint. 

See ISS encoding for an exception from an LDC or STC instruction. 
EC = 0b000111 


Access to SVE, Advanced SIMD, or floating-point functionality trapped by 
CPACR_EL1.FPEN, CPTR_EL2.FPEN, CPTR_EL2.TFP, or CPTR_EL3.TFP control. 


Excludes exceptions resulting from CPACR_EL1 when the value of HCR_EL2.TGE is 
1, or because SVE or Advanced SIMD and floating-point are not implemented. These 
are reported with EC value 0b000000 as described in The EC used to report an exception 
routed to EL2 because HCR_EL2.TGE is 1 on page D1-2301. 


See ISS encoding for an exception from an access to SVE, Advanced SIMD or 
floating-point functionality, resulting from CPACR_EL1.FPEN, CPTR_EL2.FPEN or 
CPTR_ELx-TFP. 

EC = 0b001000 
Trapped VMRS access, from ID group trap, that is not reported using EC 0b000111. 
See ISS encoding for an exception from an MCR or MRC access. 

EC == 0b001001 When ARMv8.3-PAuth is implemented 


Trapped use of a Pointer authentication instruction because HCR_EL2.API == 0 || 
SCR_EL3.API == 0. 


See ZSS encoding for an exception from a Pointer Authentication instruction when 
HCR_EL2.API == 0 || SCR_EL3.API == 0 on page D13-2994. 
EC == 0b001100 
Trapped MRRC access with (coproc==0b1110). 
See ISS encoding for an exception from an MCRR or MRRC access. 
EC = 0b001101 When ARMv8.5-BTI is implemented 
Branch Target Exception. 
See ISS encoding for an exception from Branch Target Identification instruction. 
EC == 0b001110 
Illegal Execution state. 


See ISS encoding for an exception from an Illegal Execution state, or a PC or SP 
alignment fault. 


EC = 0b010001 
SVC instruction execution in AArch32 state. 


This is reported in ESR_EL2 only when the exception is generated because the value of 
HCR_EL2.TGE is 1. 


See ISS encoding for an exception from HVC or SVC instruction execution. 
EC = 0b010010 

HVC instruction execution in AArch32 state, when HVC is not disabled. 

See ISS encoding for an exception from HVC or SVC instruction execution. 
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EC == 0b010011 


SMC instruction execution in AArch32 state, when SMC is not disabled. 


This is reported in ESR_EL2 only when the exception is generated because the value of 
HCR_EL2.TSC is 1. 


See ISS encoding for an exception from SMC instruction execution in AArch32 state. 


EC == 0b010101 


SVC instruction execution in AArch64 state. 


See ISS encoding for an exception from HVC or SVC instruction execution. 


EC == 0b010110 


HVC instruction execution in AArch64 state, when HVC is not disabled. 
See ISS encoding for an exception from HVC or SVC instruction execution. 


EC == 0b010111 


SMC instruction execution in AArch64 state, when SMC is not disabled. 


This is reported in ESR_EL2 only when the exception is generated because the value of 
HCR_EL2.TSC is 1. 


See ISS encoding for an exception from SMC instruction execution in AArch64 state. 


EC == 0b011000 


Trapped MSR, MRS or System instruction execution in AArch64 state, that is not 
reported using EC b000000, 0b000001 or 0b000111. 

If ARMv8.4-IDST is implemented, also exceptions generated by a read access to the 
feature ID space. 

If ARMv8.0-CSV2 is implemented, also Cache Speculation Variant exceptions. 

If ARMv8.2-EVT is implemented, also traps for EL1 and ELO Cache controls. 

This includes all instructions that cause exceptions that are part of the encoding space 
defined in System instruction class encoding overview on page C5-363, except for those 
exceptions reported using EC values 0b000000, 0b000001, or 0b000111. 

See ISS encoding for an exception from MSR, MRS, or System instruction execution in 
AArch64 state. 


EC == 0b011001 


Access to SVE functionality trapped as a result of CPACR_EL1.ZEN, 
CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ, that is not reported using EC 
0b000000. 

This EC is defined only if SVEis implemented. 


See ISS encoding for an exception from an access to SVE functionality, resulting from 
CPACR EL1.ZEN, CPTR_EL2.ZEN, CPTR.EL2.TZ, or CPTR_EL3.EZ. 


EC == 0b011010 When ARMv8.3-PAuth is implemented 


Trapped ERET, ERETAA, or ERETAB instruction execution. 
See ISS encoding for an exception from ERET, ERETAA or ERETAB instruction. 


EC == 0b100000 


Instruction Abort from a lower Exception level, that might be using AArch32 or 
AArch64. 

Used for MMU faults generated by instruction accesses and synchronous External 
aborts, including synchronous parity or ECC errors. Not used for debug related 
exceptions. 


See ISS encoding for an exception from an Instruction Abort. 


EC == 0b100001 


Instruction Abort taken without a change in Exception level. 


Used for MMU faults generated by instruction accesses and synchronous External 
aborts, including synchronous parity or ECC errors. Not used for debug related 
exceptions. 


See ISS encoding for an exception from an Instruction Abort. 
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EC = 0b100010 
PC alignment fault exception. 
See ISS encoding for an exception from an Illegal Execution state, or a PC or SP 
alignment fault. 
EC = 0b100100 
Data Abort from a lower Exception level, that might be using AArch32 or AArch64. 


Used for MMU faults generated by data accesses, alignment faults other than those 
caused by Stack Pointer misalignment, and synchronous External aborts, including 
synchronous parity or ECC errors. Not used for debug related exceptions. 


See ISS encoding for an exception from a Data Abort. 
EC = 0b100101 
Data Abort taken without a change in Exception level. 


Used for MMU faults generated by data accesses, alignment faults other than those 
caused by Stack Pointer misalignment, and synchronous External aborts, including 
synchronous parity or ECC errors. Not used for debug related exceptions. 


See ISS encoding for an exception from a Data Abort. 


EC = 0b100110 
SP alignment fault exception. 
See ISS encoding for an exception from an Illegal Execution state, or a PC or SP 
alignment fault. 
EC = 0b101000 
Trapped floating-point exception taken from AArch32 state. 


This EC value is valid if the implementation supports trapping of floating-point 
exceptions, otherwise it is reserved. Whether a floating-point implementation supports 
trapping of floating-point exceptions is IMPLEMENTATION DEFINED. 


See ISS encoding for an exception from a trapped floating-point exception. 
EC = 0b101100 
Trapped floating-point exception taken from AArch64 state. 


This EC value is valid if the implementation supports trapping of floating-point 
exceptions, otherwise it is reserved. Whether a floating-point implementation supports 
trapping of floating-point exceptions is IMPLEMENTATION DEFINED. 


See ISS encoding for an exception from a trapped floating-point exception. 


EC = 0b101111 
SError interrupt. 
See ISS encoding for an SError interrupt. 


EC == 0b110000 


Breakpoint exception from a lower Exception level, that might be using AArch32 or 
AArché4. 


See ISS encoding for an exception from a Breakpoint or Vector Catch debug exception. 
EC = 0b110001 

Breakpoint exception taken without a change in Exception level. 

See ISS encoding for an exception from a Breakpoint or Vector Catch debug exception. 
EC = 0b110010 


Software Step exception from a lower Exception level, that might be using AArch32 or 
AArché4. 


See ISS encoding for an exception from a Software Step exception. 
EC == 0b110011 

Software Step exception taken without a change in Exception level. 

See ISS encoding for an exception from a Software Step exception. 
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IL, bit [25] 
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EC == 0b110100 


Watchpoint exception from a lower Exception level, that might be using AArch32 or 
AArché4. 


See ISS encoding for an exception from a Watchpoint exception. 


EC == 0b110101 


Watchpoint exception taken without a change in Exception level. 
See ISS encoding for an exception from a Watchpoint exception. 


EC == 0b111000 


BKPT instruction execution in AArch32 state. 


See ISS encoding for an exception from execution of a Breakpoint instruction. 


EC == 0b111010 


Vector Catch exception from AArch32 state. 


The only case where a Vector Catch exception is taken to an Exception level that is using 
AArch64 is when the exception is routed to EL2 and EL2 is using AArch64. 


See ISS encoding for an exception from a Breakpoint or Vector Catch debug exception. 


EC = 0b111100 


BRK instruction execution in AArch64 state. 
This is reported in ESR_EL3 only if a BRK instruction is executed. 
See ISS encoding for an exception from execution of a Breakpoint instruction. 


All other EC values are reserved by Arm, and: 


Unused values in the range 0b000000 - 0b101100 (0x00 - @x2C) are reserved for future use for 
synchronous exceptions. 


Unused values in the range @b101101 - 0b111111 (0x2D - 0x3F) are reserved for future use, and 
might be used for synchronous or asynchronous exceptions. 


The effect of programming this field to a reserved value is that behavior is CONSTRAINED 
UNPREDICTABLE, as described in Reserved values in System and memory-mapped registers and 
translation table entries on page K1-7628. 


This field resets to an architecturally UNKNOWN value. 


Instruction Length for synchronous exceptions. Possible values of this bit are: 


Obed 
Qb1 


16-bit instruction trapped. 


32-bit instruction trapped. This value is also used when the exception is one of the 


following: 

g An SError interrupt. 

° An Instruction Abort exception. 
. A PC alignment fault exception. 
. An SP alignment fault exception. 


s A Data Abort exception for which the value of the ISV bit is 0. 
š An Illegal Execution state exception. 


. Any debug exception except for Breakpoint instruction exceptions. For 
Breakpoint instruction exceptions, this bit has its standard meaning: 


—  0b0: 16-bit T32 BKPT instruction. 
—  b1: 32-bit A32 BKPT instruction or A64 BRK instruction. 
: An exception reported using EC value 0b000000. 


This field resets to an architecturally UNKNOWN value. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


ISS, bits [24:0] 


Instruction Specific Syndrome. Architecturally, this field can be defined independently for each 
defined Exception class. However, in practice, some ISS encodings are used for more than one 
Exception class. 


Typically, an ISS encoding has a number of subfields. When an ISS subfield holds a register number, 
the value returned in that field is the AArch64 view of the register number. For an exception taken 
from AArch32 state, Mapping of the general-purpose registers between the Execution states on 
page D1-2381. 


If the AArch32 register descriptor is @b1111, then: 


- If the instruction that generated the exception was not UNPREDICTABLE, the field takes the 
value @b11111. 


$ If the instruction that generated the exception was UNPREDICTABLE, the field takes an 
UNKNOWN value that must be either: 


— The AArch64 view of the register number of a register that might have been used at 
the Exception level from which the exception was taken. 


— The value 0b11111. 


When the EC field is 0b000000, indicating an exception with an unknown reason, the ISS field is not 
valid, RESO. 


The following subsections describe each ISS format. 


ISS encoding for exceptions with an unknown reason 


Bits [24:0] 


24 0 


RESO 


Reserved, RESO. 


When an exception is reported using this EC code the IL field is set to 1. 


This EC code is used for all exceptions that are not covered by any other EC value. This includes exceptions that 
are generated in the following situations: 


s The attempted execution ofan instruction bit pattern that has no allocated instruction or that is not accessible 
at the current Exception level and Security state, including: 


A read access using a System register pattern that is not allocated for reads or that does not permit reads 
at the current Exception level and Security state. 


A write access using a System register pattern that is not allocated for writes or that does not permit 
writes at the current Exception level and Security state. 


Instruction encodings that are unallocated. 


Instruction encodings for instructions that are not implemented in the implementation. 


G In Debug state, the attempted execution of an instruction bit pattern that is not accessible in Debug state. 

7 In Non-debug state, the attempted execution of an instruction bit pattern that is not accessible in Non-debug 
state. 

è In AArch32 state, attempted execution of a short vector floating-point instruction. 

° In an implementation that does not include Advanced SIMD and floating-point functionality, an attempted 


access to Advanced SIMD or floating-point functionality under conditions where that access would be 
permitted if that functionality was present. This includes the attempted execution of an Advanced SIMD or 
floating-point instruction, and attempted accesses to Advanced SIMD and floating-point System registers. 
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° An exception generated because of the value of one of the SCTLR_EL1.{ITD, SED, CP15BEN} control bits. 


° Attempted execution of: 
— An HVC instruction when disabled by HCR_EL2.HCD or SCR_EL3.HCE. 
— An SMC instruction when disabled by SCR_EL3.SMD. 
— An HLT instruction when disabled by EDSCR.HDE. 


a Attempted execution of an MSR or MRS instruction to access SP_ELO when the value of SPSel.SP is 0. 


s Attempted execution, in Debug state, of: 


—  ADCPS1 instruction when the value of HCR_EL2.TGE is 1 and EL2 is disabled or not implemented 
in the current Security state. 


— A DCPS2 instruction from EL1 or ELO when EL2 is disabled or not implemented in the current 
Security state. 


— A DCPS3 instruction when the value of EDSCR.SDD is 1, or when EL3 is not implemented. 


s When EL3 is using AArch64, attempted execution from Secure EL1 ofan SRS instruction using R13_mon. 
See Traps to EL3 of Secure monitor functionality from Secure ELI using AArch32 on page D1-2361. 


. In Debug state when the value of EDSCR.SDD is 1, the attempted execution at EL2, EL1, or ELO of an 
instruction that is configured to trap to EL3. 


° In AArch32 state, the attempted execution of an MRS (banked register) or an MSR (banked register) 
instruction to SPSR_mon, SP_mon, or LR_mon. 


. An exception that is taken to EL2 because the value of HCR_EL2.TGE is 1 that, if the value of 
HCR_EL2.TGE was 0 would have been reported with an ESR_ELx.EC value of 0b000111. 

è When SVE is not implemented, attempted execution of: 
— An SVE instruction. 
— An MSR or MRS instruction to access ZCR_EL1, ZCR_EL2, or ZCR_EL3. 


ISS encoding for an exception from a WFI or WFE instruction 


24 23 20 19 1 0 


f COND RESO 


| 


CV, bit [24] 
Condition code valid. Possible values of this bit are: 
Qbe The COND field is not valid. 
Qb1 The COND field is valid. 
For exceptions taken from AArch64, CV is set to 1. 
For exceptions taken from AArch32: 
à When an A32 instruction is trapped, CV is set to 1. 


$ When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is setto 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 
COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AAtrch32, and only when the value of CV is 1. 
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For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
s When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
G When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


. For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Bits [19:1] 
Reserved, RESO. 
TI, bit [0] 
Trapped instruction. Possible values of this bit are: 
Qbd WFI trapped. 
Qb1 WFE trapped. 


This field resets to an architecturally UNKNOWN value. 
The following fields describe configuration settings for generating this exception: 


+ SCTLR_EL1.{nTWE, nTWI}. 


HCR_EL2.{TWE, TWI}. 


+ SCR_EL3.{TWE, TWI}. 


ISS encoding for an exception from an MCR or MRC access 


24 23 2019 1716 1413 10 0 


9 5 4 1 


a—l 


Direction 
CV, bit [24] 
Condition code valid. Possible values of this bit are: 
Qbd The COND field is not valid. 
Qb1 The COND field is valid. 
For exceptions taken from AArch64, CV is set to 1. 
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For exceptions taken from AArch32: 
è When an A32 instruction is trapped, CV is set to 1. 


. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AAtrch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to @b1110. 
For exceptions taken from AArch32: 
a When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
$ When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY is setto 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


° For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Opc2, bits [19:17] 


The Opc2 value from the issued instruction. 
For a trapped VMRS access, holds the value 0b000. 
This field resets to an architecturally UNKNOWN value. 


Opcl, bits [16:14] 


The Opcl value from the issued instruction. 
For a trapped VMRS access, holds the value 0b111. 


This field resets to an architecturally UNKNOWN value. 


CRn, bits [13:10] 


Rt, bits [9:5] 


The CRn value from the issued instruction. 
For a trapped VMRS access, holds the reg field from the VMRS instruction encoding. 


This field resets to an architecturally UNKNOWN value. 


The Rt value from the issued instruction, the general-purpose register used for the transfer. The 
reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field resets to an architecturally UNKNOWN value. 
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CRm, bits [4:1] 


The CRm value from the issued instruction. 
For a trapped VMRS access, holds the value 0b0000. 


This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 
Qbd Write to System register space. MCR instruction. 
Qb1 Read from System register space. MRC or VMRS instruction. 


This field resets to an architecturally UNKNOWN value. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b000011: 


CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN}, for accesses to the Generic Timer 
Registers from ELO using AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL1 or EL2. 


PMUSERENR _ELO.{ER, CR, SW, EN}, for accesses to Performance Monitor registers from ELO using 
AArch32 state, MCR or MRC access (coproc == b1111) trapped to EL1 or EL2. 


AMUSERENR ELO.EN, for accesses to Activity Monitors registers from ELO using AArch32 state, MCR 
or MRC access (coproc == 0b1111) trapped to EL1 or EL2. 


HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers from EL1 using AArch32 state, 
MCR or MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.TTLB, for execution of TLB maintenance instructions at EL1 using AArch32 state, MCR or 
MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.{TSW, TPC, TPU} for execution of cache maintenance instructions at ELO and EL1 using 
AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.TACR, for accesses to the Auxiliary Control Register at EL1 using AArch32 state, MCR or MRC 
access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.TIDCP, for accesses to lockdown, DMA, and TCM operations at ELO and EL1 using AArch32 
state, MCR or MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.{TID1, TID2, TID3}, for accesses to ID registers at ELO and EL] using AArch32 state, MCR or 
MRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL2.TCPAC, for accesses to CPACR_EL1 or CPACR using AArch32 state, MCR or MRC access 
(coproc == 0b1111) trapped to EL2. 


HSTR_EL2.T<n>, for accesses to System registers using AArch32 state, MCR or MRC access (coproc == 
0b1111) trapped to EL2. 


CNTHCTL_EL2.EL1PCEN, for accesses to the Generic Timer registers from ELO and EL1 using AArch32 
state, MCR or MRC access (coproc == @b1111) trapped to EL2. 


MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers from ELO and EL1 using 
AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL2.TAM, for accesses to Activity Monitors registers from ELO and EL1 using AArch32 state, MCR 
or MRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL3.TCPAC, for accesses to CPACR from EL1 and EL2, and accesses to HCPTR from EL2 using 
AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL3. 


MDCR_EL3.TPM, for accesses to Performance Monitor registers from ELO, EL1 and EL2 using AArch32 
state, MCR or MRC access (coproc == @b1111) trapped to EL3. 
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CPTR_EL3.TAM, for accesses to Activity Monitors registers from ELO, EL1 and EL2 using AArch32 state, 
MCR or MRC access (coproc == 0b1111) trapped to EL3. 


See Traps to EL3 of Secure monitor functionality from Secure ELI using AArch32 on page D1-2361 for 
information on other traps using EC value 0b000011. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b000101: 


CPACR_EL1.TTA for accesses to trace registers, MCR or MRC access (coproc == @b1110) trapped to EL1 
or EL2. 


MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers at ELO and EL1 
using AArch32 state, MCR or MRC access (coproc == 0b1110) trapped to EL1 or EL2. 


HCR_EL2.TIDO, for accesses to the JIDR register in the ID group 0 at ELO and EL1 using AArch32, MRC 
access (coproc == 0b1110) trapped to EL2. 


CPTR_EL2.TTA, for accesses to trace registers using AArch32, MCR or MRC access (coproc == 0b1110) 
trapped to EL2. 


MDCR_EL2.TDRA, for accesses to Debug ROM registers DBGDRAR and AArch-DBGDSAR using 
AArch32, MCR or MRC access (coproc == 0b1110) trapped to EL2. 


MDCR_EL2.TDOSA, for accesses to powerdown debug registers, using AArch32 state, MCR or MRC 
access (coproc == 0b1110) trapped to EL2. 


MDCR_EL2.TDA, for accesses to other debug registers, using AArch32 state, MCR or MRC access (coproc 
== 0b1110) trapped to EL2. 


CPTR_EL3.TTA, for accesses to trace registers using AArch32, MCR or MRC access (coproc == 0b1110) 
trapped to EL3. 


MDCR_EL3.TDOSA, for accesses to powerdown debug registers using AArch32, MCR or MRC access 
(coproc == 0b1110) trapped to EL3. 


MDCR_EL3.TDA, for accesses to other debug registers, using AArch32, MCR or MRC access (coproc == 
0b1110) trapped to EL3. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b001000: 


HCR_EL2.TIDO, for accesses to the FPSID register in ID group 0 at EL1 using AArch32 state, VMRS access 
trapped to EL2. 


HCR_EL2.TID3, for accesses to registers in ID group 3 including MVFRO, MVFR1 and MVFR2, VMRS 
access trapped to EL2. 


ISS encoding for an exception from an MCRR or MRRC access 


24 23 20 19 16 15 14 10 0 


9 5 4 1 
CV — | = Direction 
RESO 


CV, bit [24] 


Condition code valid. Possible values of this bit are: 


0bd The COND field is not valid. 
Qb1 The COND field is valid. 
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For exceptions taken from AArch64, CV is set to 1. 
For exceptions taken from AArch32: 
° When an A32 instruction is trapped, CV is set to 1. 


$ When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
. When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


e A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
: When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVis set to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


a For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to @b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Opcl, bits [19:16] 


Bit [15] 


The Opcl value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Rt2, bits [14:10] 


Rt, bits [9:5] 


The Rt2 value from the issued instruction, the second general-purpose register used for the transfer. 
The reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field resets to an architecturally UNKNOWN value. 


The Rt value from the issued instruction, the first general-purpose register used for the transfer. The 
reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field resets to an architecturally UNKNOWN value. 


CRm, bits [4:1] 


The CRm value from the issued instruction. 
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This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 
Qbd Write to System register space. MCRR instruction. 
Qb1 Read from System register space. MRRC instruction. 


This field resets to an architecturally UNKNOWN value. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b000100: 


CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN}, for accesses to the Generic Timer 
Registers from ELO using AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL1 or 
EL2. 


PMUSERENR ELO.{CR, EN}, for accesses to Performance Monitor registers from ELO using AArch32 
state, MCRR or MRRC access (coproc == 0b1111) trapped to EL1 or EL2. 


AMUSERENR _ ELO. {EN}, for accesses to Activity Monitors registers AMEVCNTRO<n> and 
AMEVCNTRI1<n> from ELO using AArch32 state, MCRR or MRRC access (coproc == @b1111) trapped to 
EL1 or EL2. 


HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers from EL1 using AArch32 state, 
MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


HSTR_EL2.T<n>, for accesses to System registers using AArch32 state, MCRR or MRRC access (coproc 
== 0b1111) trapped to EL2. 


CNTHCTL_EL2.{EL1PCEN, EL1PCTEN}, for accesses to the Generic Timer registers from ELO and EL1 
using AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers from ELO and EL1 using 
AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL2.TAM, for accesses to Activity Monitors registers AMEVCNTRO<n> and AMEVCNTRI1<n> 
from ELO and EL1 using AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


MDCR_EL3.TPM, for accesses to Performance Monitor registers from ELO, EL1 and EL2 using AArch32 
state, MCRR or MRRC access (coproc == 0b1111) trapped to EL3. 


CPTR_EL3.TAM, for accesses to Activity Monitors registers from ELO, EL1 and EL2 using AArch32 state, 
MCRR or MRRC access (coproc == 0b1111) trapped to EL3. 


The following sections describe configuration settings for generating exceptions that are reported using EC value 
0b001100: 


CPACR_EL1.TTA for accesses to trace registers using MCR or MRC instructions, MCRR or MRRC access 
(coproc == 0b1110) trapped to EL1 or EL2. 


MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers DBGDSAR and 
DBGDRAR at ELO using AArch32 state, MCRR or MRRC access (coproc == 0b1110) trapped to EL1 or 
EL2. 


CPTR_EL2.TTA, for accesses to trace registers using AArch32, MCRR or MRRC access (coproc == 0b1110) 
trapped to EL2. 


MDCR_EL2.TDRA, for accesses to Debug ROM registers DBGDRAR and AArch-DBGDSAR using 
AArch32, MCRR or MRRC access (coproc == 0b1110) trapped to EL2. 


CPTR_EL3.TTA, for accesses to trace registers using AArch32, MCRR or MRRC access (coproc == 0b1110) 
trapped to EL3. 
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s MDCR_EL3.TDOSA, for traps to powerdown debug registers using AArch32, MCRR or MRRC access 
(coproc == 0b1110) trapped to EL3. 


° MDCR_EL3.TDA, for accesses to other debug registers, using AArch32, MCRR or MRRC access (coproc 
== 0b1110) trapped to EL3. 


ISS encoding for an exception from an LDC or STC instruction 


24 23 20 19 121110 9 5 4 3 1 0 


CV — | | E Direction 
Offset 


RESO 
CY, bit [24] 
Condition code valid. Possible values of this bit are: 
ObO The COND field is not valid. 
Qb1 The COND field is valid. 
For exceptions taken from AArch64, CV is set to 1. 
For exceptions taken from AArch32: 
: When an A32 instruction is trapped, CV is set to 1. 
è When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is setto 1 or 


set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
$ When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
è When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


° For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to | it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 
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imm8, bits [19:12] 


Bits [11:10] 


Rn, bits [9:5] 


Offset, bit [4] 


AM, bits [3:1] 


The immediate value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


The Rn value from the issued instruction, the general-purpose register used for the transfer. The 
reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field is valid only when AM[2] is 0, indicating an immediate form of the LDC or STC 
instruction. When AM[2] is 1, indicating a literal form of the LDC or STC instruction, this field is 
UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Indicates whether the offset is added or subtracted: 

ObO Subtract offset. 

Qb1 Add offset. 

This bit corresponds to the U bit in the instruction encoding. 


This field resets to an architecturally UNKNOWN value. 


Addressing mode. The permitted values of this field are: 


0b000 Immediate unindexed. 

0b001 Immediate post-indexed. 

0b010 Immediate offset. 

0b011 Immediate pre-indexed. 

0b100 For a trapped STC instruction or a trapped T32 LDC instruction this encoding is 
reserved. 

0b110 For a trapped STC instruction, this encoding is reserved. 


The values 0b101 and 0b111 are reserved. The effect of programming this field to a reserved value is 
that behavior is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and 
memory-mapped registers and translation table entries on page K1-7644. 


Bit [2] in this subfield indicates the instruction form, immediate or literal. 
Bits [1:0] in this subfield correspond to the bits {P, W} in the instruction encoding. 
This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 
Qbd Write to memory. STC instruction. 
Qb1 Read from memory. LDC instruction. 


This field resets to an architecturally UNKNOWN value. 


The following fields describe the configuration settings for the traps that are reported using EC value 0b000110: 


. MDSCR_EL1.TDCC, for accesses using AArch32 state, LDC access to DBGDTRTXint or STC access to 
DBGDTRRXint trapped to EL1 or EL2. 


s MDCR_EL2.TDA, for accesses using AArch32 state, LDC access to DBGDTRTXint or STC access to 
DBGDTRRXint MCR or MRC access trapped to EL2. 
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è MDCR_EL3.TDA, for accesses using AArch32 state, LDC access to DBGDTRTXint or STC access to 
DBGDTRRXint MCR or MRC access trapped to EL3. 


ISS encoding for an exception from an access to SVE, Advanced SIMD or floating-point 
functionality, resulting from CPACR_EL1.FPEN, CPTR_EL2.FPEN or CPTR_ELx.TFP 


24 23 20 19 0 


i COND RESO 


a| 


The accesses covered by this trap include: 
° Execution of SVE or Advanced SIMD and floating-point instructions. 
° Accesses to the Advanced SIMD and floating-point System registers. 


For an implementation that does not include either SVE or support for floating-point and Advanced SIMD, the 
exception is reported using the EC value 0b000000. 
CV, bit [24] 

Condition code valid. Possible values of this bit are: 

Obed The COND field is not valid. 

Qb1 The COND field is valid. 

For exceptions taken from AArch64, CV is set to 1. 

For exceptions taken from AArch32: 

° When an A32 instruction is trapped, CV is set to 1. 


: When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is setto 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AAtrch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
- When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
è When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


—  CVis set to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVis set to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 
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° For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Bits [19:0] 


Reserved, RESO. 
The following sections describe the configuration settings for the traps that are reported using EC value 0b000111: 
s CPACR_EL1.FPEN, for accesses to SIMD and floating-point registers trapped to EL1. 
: CPTR_EL2.TFP, for accesses to SIMD and floating-point registers trapped to EL2. 


è CPTR_EL2.TFP, for accesses to SIMD and floating-point registers trapped to EL3. 


ISS encoding for an exception from an access to SVE functionality, resulting from 
CPACR_EL1.ZEN, CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ 


24 0 
RESO 
Bits [24:0] 


When SVE is implemented: 


Reserved, RESO. 
The accesses covered by this trap include: 
° Execution of SVE instructions. 
: Accesses to the SVE system registers, ZCR_ELx and ID_AA64ZFRO_EL1. 


For an implementation that does not include SVE, the exception is reported using the EC value 0b000000. 


ISS encoding for an exception from an Illegal Execution state, or a PC or SP alignment fault 


24 0 
RESO 


Reserved, RESO. 


Bits [24:0] 


There are no configuration settings for generating Illegal Execution state exceptions and PC alignment fault 
exceptions. For more information about these exceptions see The Illegal Execution state exception on page D1-2306 
and PC alignment checking on page D1-2287. 


SP alignment checking on page D1-2287 describes the configuration settings for generating SP alignment fault 
exceptions. 
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ISS encoding for an exception from HVC or SVC instruction execution 


Bits [24:16] 


Reserved, RESO. 


imm16, bits [15:0] 
The value of the immediate field from the HVC or SVC instruction. 


For an HVC instruction, and for an A64 SVC instruction, this is the value of the imm16 field of the 
issued instruction. 


For an A32 or T32 SVC instruction: 
. If the instruction is unconditional, then: 


— For the T32 instruction, this field is zero-extended from the imm8 field of the 
instruction. 


— For the A32 instruction, this field is the bottom 16 bits of the imm24 field of the 
instruction. 


° If the instruction is conditional, this field is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


In AArch32 state, the HVC instruction is unconditional, and a conditional SVC instruction generates an exception 
only if it passes its condition code check. Therefore, the syndrome information for these exceptions does not require 
conditionality information. 


For T32 and A32 instructions, see SVC and HVC. 


For A64 instructions, see SVC and HVC. 


ISS encoding for an exception from SMC instruction execution in AArch32 state 


24 23 20 19 18 0 


i COND i RESO 
ail 
CCKNOWNPASS 


For an SMC instruction that completes normally and generates an exception that is taken to EL3, the ISS encoding 
is RESO. 


For an SMC instruction that is trapped to EL2 from EL1 because HCR_EL2.TSC is 1, the ISS encoding is as shown 
in the diagram. 
CV, bit [24] 

Condition code valid. Possible values of this bit are: 

ObO The COND field is not valid. 

Qb1 The COND field is valid. 

For exceptions taken from AArch64, CV is set to 1. 

For exceptions taken from AArch32: 

$ When an A32 instruction is trapped, CV is set to 1. 
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a When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 
set to 0. See the description of the COND field for more information. 


This field is only valid if CCKNOWMPASS is 1, otherwise it is RESO. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to @b1110. 
For exceptions taken from AArch32: 
. When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
à When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 
$ For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to @b1110, or to the value of any condition that applied to the instruction. 


This field is only valid if CCKNOWMPASS is 1, otherwise it is RESO. 


This field resets to an architecturally UNKNOWN value. 


CCKNOWNPASS, bit [19] 


Bits [18:0] 


Indicates whether the instruction might have failed its condition code check. 


Ob The instruction was unconditional, or was conditional and passed its condition code 
check. 
Qb1 The instruction was conditional, and might have failed its condition code check. 
Note 





In an implementation in which an SMC instruction that fails it code check is not trapped, this field 
can always return the value 0. 





This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


HCR_EL2.TSC describes the configuration settings for trapping SMC instructions to EL2. 


See System calls on page D1-2371 describes the case where these exceptions are trapped to EL3. 
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ISS encoding for an exception from SMC instruction execution in AArch64 state 


Bits [24:16] 
Reserved, RESO. 
imm16, bits [15:0] 
The value of the immediate field from the issued SMC instruction. 


This field resets to an architecturally UNKNOWN value. 


The value of ISS[24:0] described here is used both: 


$ When an SMC instruction is trapped from EL1 modes. 
a When an SMC instruction is not trapped, so completes normally and generates an exception that is taken to 
EL3. 


HCR_EL2.TSC describes the configuration settings for trapping SMC from EL1 modes. 


System calls on page D1-2371 describes the case where these exceptions are trapped to EL3. 


ISS encoding for an exception from MSR, MRS, or System instruction execution in AArch64 state 


22212019 1716 1413 


Ee 


Bits [24:22] 

Reserved, RESO. 
Op), bits [21:20] 

The Op0 value from the issued instruction. 

This field resets to an architecturally UNKNOWN value. 
Op2, bits [19:17] 

The Op2 value from the issued instruction. 

This field resets to an architecturally UNKNOWN value. 
Op1, bits [16:14] 

The Op! value from the issued instruction. 

This field resets to an architecturally UNKNOWN value. 
CRa, bits [13:10] 

The CRn value from the issued instruction. 

This field resets to an architecturally UNKNOWN value. 
Rt, bits [9:5] 

The Rt value from the issued instruction, the general-purpose register used for the transfer. 


This field resets to an architecturally UNKNOWN value. 
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CRm, bits [4:1] 


The CRm value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 
b0 Write access, including MSR instructions. 
Qb1 Read access, including MRS instructions. 


This field resets to an architecturally UNKNOWN value. 


For exceptions caused by System instructions, see System instructions for the encoding values returned by an 
instruction. 


The following fields describe configuration settings for generating the exception that is reported using EC value 
0b011000: 


SCTLR_EL1.UCI, for execution of cache maintenance instructions using AArch64 state, MSR or MRS 
access trapped to EL1 or EL2. 


SCTLR_EL1.UCT, for accesses to CTR_ELO using AArch64 state, MSR or MRS access trapped to EL1 or 
EL2. 


SCTLR_EL1.DZE, for execution of DC ZVA instructions using AArch64 state, MSR or MRS access trapped 
to ELI or EL2. 


SCTLR_EL1.UMA, for accesses to the PSTATE interrupt masks using AArch64 state, MSR or MRS access 
trapped to EL1 or EL2. 


CPACR_EL1.TTA, for accesses to the trace registers using AArch64 state, MSR or MRS access trapped to 
EL1 or EL2. 


MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers using AArch64 
state, MSR or MRS access trapped to EL1 or EL2. 


CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN} accesses to the Generic Timer 
registers using AArch64 state, MSR or MRS access trapped to EL! or EL2. 


PMUSERENR _ELO.{ER, CR, SW, EN}, for accesses to the Performance Monitor registers using AArch64 
state, MSR or MRS access trapped to EL1 or EL2. 


AMUSERENR _ ELO.EN, for accesses to Activity Monitors registers using AArch64 state, MSR or MRS 
access trapped to EL1 or EL2. 


HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers using AArch64 state, MSR or 
MRS access trapped to EL2. 


HCR_EL2.TDZ, for execution of DC ZVA instructions using AArch64 state, MSR or MRS access trapped 
to EL2. 


HCR_EL2.TTLB, for execution of TLB maintenance instructions using AArch64 state, MSR or MRS access 
trapped to EL2. 


HCR_EL2.{TSW, TPC, TPU}, for execution of cache maintenance instructions using AArch64 state, MSR 
or MRS access trapped to EL2. 


HCR_EL2.TACR, for accesses to the Auxiliary Control Register, ACTLR_EL1, using AArch64 state, MSR 
or MRS access trapped to EL2. 


HCR_EL2.TIDCP, for accesses to lockdown, DMA, and TCM operations using AArch64 state, MSR or 
MRS access trapped to EL2. 


HCR_EL2.{TID1, TID2, TID3}, for accesses to ID group 1, ID group 2 or ID group 3 registers, using 
AArch64 state, MSR or MRS access trapped to EL2. 
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CPTR_EL2.TCPAC, for accesses to CPACR_EL1, using AArch64 state, MSR or MRS access trapped to 
EL2. 


CPTR_EL2.TTA, for accesses to the trace registers, using AArch64 state, MSR or MRS access trapped to 
EL2. 


MDCR_EL2.TTRF, for accesses to the trace filter register, TRFCR_EL1, using AArch64 state, MSR or MRS 
access trapped to EL2. 


MDCR_EL2.TDRA, for accesses to Debug ROM registers, using AArch64 state, MSR or MRS access 
trapped to EL2. 


MDCR_EL2.TDOSA, for accesses to powerdown debug registers using AArch64 state, MSR or MRS access 
trapped to EL2. 


CNTHCTL_EL2.{EL1PCEN, EL1PCTEN}, for accesses to the Generic Timer registers using AArch64 
state, MSR or MRS access trapped to EL2. 


MDCR_EL2.TDA, for accesses to debug registers using AArch64 state, MSR or MRS access trapped to EL2. 


MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers, using AArch64 state, MSR or 
MRS access trapped to EL2. 


CPTR_EL2.TAM, for accesses to Activity Monitors registers, using AArch64 state, MSR or MRS access 
trapped to EL2. 


HCR_EL2.APK, for accesses to Pointer authentication key registers. using AArch64 state, MSR or MRS 
access trapped to EL2. 


HCR_EL2.{NV, NV1}, for Nested virtualization register access, using AArch64 state, MSR or MRS access, 
trapped to EL2. 


HCR_EL2.AT, for execution of AT S1E* instructions, using AArch64 state, MSR or MRS access, trapped to 
EL2. 


HCR_EL2.{TERR, FIEN}, for accesses to RAS registers, using AArch64 state, MSR or MRS access, 
trapped to EL2. 


SCR_EL3.APK, for accesses to Pointer authentication key registers, using AArch64 state, MSR or MRS 
access trapped to EL3. 


SCR_EL3.ST, for accesses to the Counter-timer Physical Secure timer registers, using AArch64 state, MSR 
or MRS access trapped to EL3. 


SCR_EL3.{TERR, FIEN}, for accesses to RAS registers, using AArch64 state, MSR or MRS access trapped 
to EL3. 


CPTR_EL3.TCPAC, for accesses to CPTR_EL2 and CPACR_EL1 using AArch64 state, MSR or MRS 
access trapped to EL3. 


CPTR_EL3.TTA, for accesses to the trace registers, using AArch64 state, MSR or MRS access trapped to 
EL3. 


MDCR_EL3.TTRF, for accesses to the filter trace control registers, TRFCR_EL1 and TRFCR_EL2, using 
AArch64 state, MSR or MRS access trapped to EL3. 


MDCR_EL3.TDA, for accesses to debug registers, using AArch64 state, MSR or MRS access trapped to 
EL3. 


MDCR_EL3.TDOSA, for accesses to powerdown debug registers, using AArch64 state, MSR or MRS 
access trapped to EL3. 





MDCR_EL3.TPM, for accesses to Performance Monitor registers, using AArch64 state, MSR or MRS 
access trapped to EL3. 
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s CPTR_EL3.TAM, for accesses to Activity Monitors registers, using AArch64 state, MSR or MRS access, 
trapped to EL3. 


° If ARMv8.2-EVT is implemented, HCR_EL2.{TTLBOS, TTLBIS, TICAB, TOCU, TID4} and 
HCR2.{TTLBIS, TICAB, TOCU, TID4} control traps for EL1 and ELO Cache controls that use this EC 
value. 


ISS encoding for a IMPLEMENTATION DEFINED exception to EL3 


24 0 
IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [24:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


ISS encoding for an exception from an Instruction Abort 


24 131211109 8 7 6 5 0 


Bits [24:13] 
Reserved, RESO. 
SET, bits [12:11] 


Synchronous Error Type. When the RAS Extension is implemented and IFSC is 0b010000, describes 
the state of the PE after taking the Instruction Abort exception. The possible values of this field are: 


0b00 Recoverable error (UER). 
0b10 Uncontainable error (UC). 
0b11 Restartable error (UEO) or Corrected error (CE). 


All other values are reserved. 


Note 


Software can use this information to determine what recovery might be possible. Taking a 
synchronous External Abort exception might result in an unrecoverable PE state. 








This field is RESO if either: 
. The RAS Extension is not implemented. 
. The value returned in the IFSC field is not 0b010000. 


This field resets to an architecturally UNKNOWN value. 
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FnV, bit [10] 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd FAR is valid. 
Qb1 FAR is not valid, and holds an UNKNOWN value. 
This field is only valid if the IFSC code is @b@10000. It is RESO for all other aborts. 


This field resets to an architecturally UNKNOWN value. 


EA, bit [9] 
External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External 
aborts. 
For any abort other than an External abort this bit returns a value of 0. 
This field resets to an architecturally UNKNOWN value. 
Bit [8] 


Reserved, RESO. 


SIPTW, bit [7] 


For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 
translation table walk: 


Obd Fault not on a stage 2 translation for a stage 1 translation table walk. 
Qb1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. 
For any abort other than a stage 2 fault this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Bit [6] 


Reserved, RESO. 


IFSC, bits [5:0] 
Instruction Fault Status Code. Possible values of this field are: 
@b000000 Address size fault, level 0 of translation or translation table base register 
Qb000001 Address size fault, level 1 
0b000010 Address size fault, level 2 
0b000011 Address size fault, level 3 
0b000100 ‘Translation fault, level 0 
0b000101 Translation fault, level 1 
0b000110 ‘Translation fault, level 2 
0b000111 Translation fault, level 3 
0b001001 Access flag fault, level 1 
0b001010 Access flag fault, level 2 
0b001011 Access flag fault, level 3 
0b001101 Permission fault, level 1 
0b001110 Permission fault, level 2 
0b001111 Permission fault, level 3 





0b010000 Synchronous External abort, not on translation table walk 

0b01010@ Synchronous External abort, on translation table walk, level 0 
0b010101 Synchronous External abort, on translation table walk, level 1 
0b010110 Synchronous External abort, on translation table walk, level 2 
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0b010111 Synchronous External abort, on translation table walk, level 3 

0b01100@ Synchronous parity or ECC error on memory access, not on translation table walk 
0b011100 Synchronous parity or ECC error on memory access on translation table walk, level 0 
Qb011101 Synchronous parity or ECC error on memory access on translation table walk, level 1 
0b011110 Synchronous parity or ECC error on memory access on translation table walk, level 2 
Qb011111 Synchronous parity or ECC error on memory access on translation table walk, level 3 
0b110000 TLB conflict abort 


0b110001 Unsupported atomic hardware update fault, if the implementation includes 
ARMv8.1-TTHM. Otherwise reserved. 


All other values are reserved. 


When the RAS Extension is implemented, 0b011000, b011100, 0b011101, 0b011110, and 0b011111, are 
reserved. 


Note 


Armv8.2 requires the implementation of the RAS Extension. 








For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on page DS5-2628. 
Note 


Because Access flag faults and Permission faults can only result from a Block or Page translation 
table descriptor, they cannot occur at level 0. 








If the SIPTW bit is set, then the level refers the level of the stage2 translation that is translating a 
stage 1 translation walk. 


This field resets to an architecturally UNKNOWN value. 


ISS encoding for an exception from a Data Abort 


24 23 22 21 20 161514131211109 8 7 6 5 





Ta 
Ga 


ISV, bit [24] 


Instruction syndrome valid. Indicates whether the syndrome information in ISS[23:14] is valid. 
ObO No valid instruction syndrome. ISS[23:14] are RESO. 

Qb1 ISS[23:14] hold a valid instruction syndrome. 

This bit is 0 for all faults reported in ESR_EL2 except the following stage 2 aborts: 


° AArch64 loads and stores of a single general-purpose register (including the register 
specified with 0b11111, including those with Acquire/Release semantics, but excluding Load 
Exclusive or Store Exclusive and excluding those with writeback. 


° AArch32 instructions where the instruction: 


— Isan LDR, LDA, LDRT, LDRSH, LDRSHT, LDRH, LDAH, LDRHT, LDRSB, 
LDRSBT, LDRB, LDAB, LDRBT, STR, STL, STRT, STRH, STLH, STRHT, STRB, 
STLB, or STRBT instruction. 
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— Is not performing register writeback. 
— [snot using R15 as a source or destination register. 


For these cases, ISV is UNKNOWN if the exception was generated in Debug state in memory access 
mode, and otherwise indicates whether ISS[23:14] hold a valid syndrome. 


ISV is 0 for all faults reported in ESR_EL1 or ESR_EL3. 
When the RAS Extension is implemented, ISV is 0 for any synchronous External abort. 


For ISS reporting, a stage 2 abort on a stage 1 translation table walk does not return a valid 
instruction syndrome, and therefore ISV is 0 for these aborts. 


When the RAS Extension is not implemented, the value of ISV on a synchronous External abort on 
a stage 2 translation table walk is IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


SAS, bits [23:22] 
Syndrome Access Size. When ISV is 1, indicates the size of the access attempted by the faulting 


operation. 

0b00 Byte 

0b01 Halfword 
0b10 Word 

0b11 Doubleword 


This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


SSE, bit [21] 


Syndrome Sign Extend. When ISV is 1, for a byte, halfword, or word load operation, indicates 
whether the data item must be sign extended. For these cases, the possible values of this bit are: 


0b0 Sign-extension not required. 

0b1 Data item must be sign-extended. 

For all other operations this bit is 0. 

This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


SRT, bits [20:16] 


Syndrome Register transfer. When ISV is 1, the register number of the Rt operand of the faulting 
instruction. If the exception was taken from an Exception level that is using AArch32 then this is 
the AArch64 view of the register. See Mapping of the general-purpose registers between the 
Execution states on page D1-2381. 


This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


SF, bit [15] 


Width of the register accessed by the instruction is Sixty-Four. When ISV is 1, the possible values 
of this bit are: 


Qbd Instruction loads/stores a 32-bit wide register. 
Qb1 Instruction loads/stores a 64-bit wide register. 
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AR, bit [14] 


Note 
This field specifies the register width identified by the instruction, not the Execution state. 








This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 
This field resets to an architecturally UNKNOWN value. 


Acquire/Release. When ISV is 1, the possible values of this bit are: 
Qbd Instruction did not have acquire/release semantics. 

Qb1 Instruction did have acquire/release semantics. 

This field is UNKNOWN when the value of ISV is UNKNOWN. 

This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


VNCR, bit [13] 


Indicates that the fault came from use of VNCR_EL2 register by EL1 code. 


Qbd The fault was not generated by the use of VNCR_EL2, by an MRS or MSR instruction 
executed at EL1. 
Qb1 The fault was generated by the use of VNCR_EL2, by an MRS or MSR instruction 


executed at EL1. 
This field is 0 in ESR_EL1. 


This field resets to an architecturally UNKNOWN value. 


SET, bits [12:11] 


FnV, bit [10] 


Synchronous Error Type. When the RAS Extension is implemented and DFSC is 0b010000, 
describes the state of the PE after taking the Data Abort exception. The possible values of this field 
are: 


Oba Recoverable error (UER). 
0b10 Uncontainable error (UC). 
0b11 Restartable error (UEO) or Corrected error (CE). 


All other values are reserved. 





Note 


Software can use this information to determine what recovery might be possible. Taking a 
synchronous External Abort exception might result in an unrecoverable PE state. 


This field is RESO if either: 
à The RAS Extension is not implemented. 
. The value returned in the DFSC field is not 0b010000. 


This field resets to an architecturally UNKNOWN value. 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd FAR is valid. 
Qb1 FAR is not valid, and holds an UNKNOWN value. 
This field is valid only if the DFSC code is 0b010000. It is RESO for all other aborts. 


This field resets to an architecturally UNKNOWN value. 


D13-2984 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


EA, bit [9] 
External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External 
aborts. 
For any abort other than an External abort this bit returns a value of 0. 
This field resets to an architecturally UNKNOWN value. 
CM, bit [8] 


Cache maintenance. Indicates whether the Data Abort came from a cache maintenance or address 
translation instruction: 


Qbd The Data Abort was not generated by the execution of one of the System instructions 
identified in the description of value 1. 


Qb1 The Data Abort was generated by either the execution of a cache maintenance 
instruction or by a synchronous fault on the execution of an address translation 
instruction. The DC ZVA instruction is not classified as a cache maintenance 
instruction, and therefore its execution cannot cause this field to be set to 1. 


This field resets to an architecturally UNKNOWN value. 


SIPTW, bit [7] 


For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 
translation table walk: 


Qbd Fault not on a stage 2 translation for a stage 1 translation table walk. 
Qb1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. 
For any abort other than a stage 2 fault this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Wak, bit [6] 


Write not Read. Indicates whether a synchronous abort was caused by an instruction writing to a 
memory location, or by an instruction reading from a memory location. The possible values of this 


bit are: 
ObO Abort caused by an instruction reading from a memory location. 
Qb1 Abort caused by an instruction writing to a memory location. 


For faults on cache maintenance and address translation instructions, this bit always returns a value 
of 1. 


For faults from an atomic instruction that both reads and writes from a memory location, this bit is 
set to 0 if a read of the address specified by the instruction would have generated the fault which is 
being reported, otherwise it is set to 1. The architecture permits, but does not require, a relaxation 
of this requirement such that for all stage 2 aborts on stage | translation table walks for atomic 
instructions, the WnR bit is always 0. 


This field is UNKNOWN for: 
. An External abort on an Atomic access. 


° A fault reported using a DFSC value of 0b110101 or 0b110001, indicating an unsupported 
Exclusive or atomic access. 


This field resets to an architecturally UNKNOWN value. 


DFSC, bits [5:0] 
Data Fault Status Code. Possible values of this field are: 
0b000000 Address size fault, level 0 of translation or translation table base register. 
0b000001 Address size fault, level 1. 
0b000010 Address size fault, level 2. 
0b000011 Address size fault, level 3. 
0b000100 ‘Translation fault, level 0. 
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0b000101 Translation fault, level 1. 
0b000110 Translation fault, level 2. 
0b000111 Translation fault, level 3. 
0b001001 Access flag fault, level 1. 
0b001010 Access flag fault, level 2. 
0b001011 Access flag fault, level 3. 
0b001101 Permission fault, level 1. 
0b001110 Permission fault, level 2. 
0b001111 Permission fault, level 3. 





0b010000 Synchronous External abort, not on translation table walk. 

0b010001 Synchronous Tag Check fail 

0b010100 Synchronous External abort, on translation table walk, level 0. 

0b010101 Synchronous External abort, on translation table walk, level 1. 

0b010118 Synchronous External abort, on translation table walk, level 2. 

0b010111 Synchronous External abort, on translation table walk, level 3. 

0b011000 Synchronous parity or ECC error on memory access, not on translation table walk. 
0b011100 Synchronous parity or ECC error on memory access on translation table walk, level 0. 
0b011101 Synchronous parity or ECC error on memory access on translation table walk, level 1. 
0b011110 Synchronous parity or ECC error on memory access on translation table walk, level 2. 
0b011111 Synchronous parity or ECC error on memory access on translation table walk, level 3. 
0b100001 Alignment fault. 

0b110000 TLB conflict abort. 


0b110001 Unsupported atomic hardware update fault, if the implementation includes 
ARMv8.1-TTHM. Otherwise reserved. 


@b110100 IMPLEMENTATION DEFINED fault (Lockdown). 

@b110101 IMPLEMENTATION DEFINED fault (Unsupported Exclusive or Atomic access). 
@b111101 Section Domain Fault, used only for faults reported in the PAR_EL1. 
@b111110 Page Domain Fault, used only for faults reported in the PAR_EL1. 

All other values are reserved. 


When the RAS Extension is implemented, 0011000, 0b011100, 0b011101, 0b011110, and 0b011111, are 
reserved. 


For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on page DS5-2628. 


Note 


Because Access flag faults and Permission faults can only result from a Block or Page translation 
table descriptor, they cannot occur at level 0. 








If the SIPTW bit is set, then the level refers the level of the stage2 translation that is translating a 
stage 1 translation walk. 


This field resets to an architecturally UNKNOWN value. 
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ISS encoding for an exception from a trapped floating-point exception 


24 23 22 11 10 876543210 


Bit [24] 


Reserved, RESO. 


TFYV, bit [23] 
Trapped Fault Valid bit. Indicates whether the IDF, IXF, UFF, OFF, DZF, and IOF bits hold valid 
information about trapped floating-point exceptions. The possible values of this bit are: 


Obd The IDF, IXF, UFF, OFF, DZF, and IOF bits do not hold valid information about trapped 
floating-point exceptions and are UNKNOWN. 

Qb1 One or more floating-point exceptions occurred during an operation performed while 
executing the reported instruction. The IDF, IXF, UFF, OFF, DZF, and IOF bits indicate 
trapped floating-point exceptions that occurred. For more information see 
Floating-point exceptions and exception traps on page D1-2313. 


It is IMPLEMENTATION DEFINED whether this field is set to 0 on an exception generated by a trapped 
floating point exception from a vector instruction. 





Note 


This is not a requirement. Implementations can set this field to 1 on a trapped floating-point 
exception from a vector instruction and return valid information in the {IDF, IXF, UFF, OFF, DZF, 
IOF} fields. 





This field resets to an architecturally UNKNOWN value. 


Bits [22:11] 


Reserved, RESO. 


VECITR, bits [10:8] 


For a trapped floating-point exception from an instruction executed in AArch32 state this field is 
RES1. 


For a trapped floating-point exception from an instruction executed in AArch6é4 state this field is 
UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


IDF, bit [7] 


Input Denormal floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Input denormal floating-point exception has not occurred. 
Qb1 Input denormal floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 
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Bits [6:5] 


IXF, bit [4] 


UFF, bit [3] 


OFF, bit [2] 


DZF, bit [1] 


IOF, bit [0] 


Reserved, RESO. 


Inexact floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, 
the possible values of this bit are: 


Qbd Inexact floating-point exception has not occurred. 
0b1 Inexact floating-point exception occurred during execution of the reported instruction. 


This field resets to an architecturally UNKNOWN value. 


Underflow floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Underflow floating-point exception has not occurred. 
Qb1 Underflow floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


Overflow floating-point exception trapped bit. Ifthe TFV field is 0, this bit is UNKNOWN. Otherwise, 
the possible values of this bit are: 


Qbd Overflow floating-point exception has not occurred. 
Qb1 Overflow floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


Divide by Zero floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Divide by Zero floating-point exception has not occurred. 
Qb1 Divide by Zero floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


Invalid Operation floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Invalid Operation floating-point exception has not occurred. 
Qb1 Invalid Operation floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


In an implementation that supports the trapping of floating-point exceptions: 


° From an Exception level using AArch64, the FPCR. {IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of 
the floating-point exception traps. 


. From an Exception level using AArch32, the FPSCR. {IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of 
the floating-point exception traps. 
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ISS encoding for an SError interrupt 


24 23 141312 109 8 6 5 0 


f RESO a] RESO DFSC 
IDS — | Loo EA 
IESB 


IDS, bit [24] 


IMPLEMENTATION DEFINED syndrome. Possible values of this bit are: 








Ob Bits[23:0] of the ISS field holds the fields described in this encoding. 
Note 
If the RAS Extension is not implemented, this means that bits[23:0] of the ISS field are 
RESO. 
Qb1 Bits[23:0] of the ISS field holds IMPLEMENTATION DEFINED syndrome information that 


can be used to provide additional information about the SError interrupt. 


Note 
This field was previously called ISV. 








This field resets to an architecturally UNKNOWN value. 


Bits [23:14] 


Reserved, RESO. 


TESB, bit [13] 
Implicit error synchronization event. 


Qbd The SError interrupt was either not synchronized by the implicit error synchronization 
event or not taken immediately. 


Qb1 The SError interrupt was synchronized by the implicit error synchronization event and 
taken immediately. 


This field is RESO if the value returned in the DFSC field is not 0b010001. 


Note 
Armv8.2 requires the implementation of the RAS Extension and ARMv8.2-IESB. 








This field resets to an architecturally UNKNOWN value. 


AET, bits [12:10] 
Asynchronous Error Type. 


When the RAS Extension is implemented and DFSC is 0b010001, describes the state of the PE after 
taking the SError interrupt exception. The possible values of this field are: 


0b000 Uncontainable error (UC). 
0b001 Unrecoverable error (UEU). 
0b010 Restartable error (UEO). 
0b011 Recoverable error (UER). 
0b110 Corrected error (CE). 


All other values are reserved. 
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EA, bit [9] 


Bits [8:6] 


If multiple errors are taken as a single SError interrupt exception, the overall state of the PE is 
reported. For example, if both a Recoverable and Unrecoverable error occurred, the state is 
Unrecoverable. 


Note 


Software can use this information to determine what recovery might be possible. The recovery 
software must also examine any implemented fault records to determine the location and extent of 
the error. 





This field is RESO if either: 
° The RAS Extension is not implemented. 
. The value returned in the DFSC field is not 0b010001. 





Note 


Armv8.2 requires the implementation of the RAS Extension. 





This field resets to an architecturally UNKNOWN value. 


External abort type. When the RAS Extension is implemented, this bit can provide an 
IMPLEMENTATION DEFINED classification of External aborts. 


For any abort other than an External abort this bit returns a value of 0. 
This field is RESO if either: 
° The RAS Extension is not implemented. 


. The value returned in the DFSC field is not 0b010001. 





Note 


Armv8.2 requires the implementation of the RAS Extension. 





This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


DESC, bits [5:0] 


D13-2990 


Data Fault Status Code. When the RAS Extension is implemented, possible values of this field are: 
0b000000 Uncategorized. 

0b010001 Asynchronous SError interrupt. 

All other values are reserved. 


If the RAS Extension is not implemented, this field is RESO. 





Note 
Armv8.2 requires the implementation of the RAS Extension. 


This field resets to an architecturally UNKNOWN value. 
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ISS encoding for an exception from a Breakpoint or Vector Catch debug exception 


24 6 5 0 
RESO IFSC 


Reserved, RESO. 


Bits [24:6] 


IFSC, bits [5:0] 
Instruction Fault Status Code. This field is set to 0b100010, to indicate a Debug exception. 


This field resets to an architecturally UNKNOWN value. 
For more information about generating these exceptions: 
$ For exceptions from AArch64, see Breakpoint exceptions on page D2-2413. 


` For exceptions from AArch32, see Breakpoint exceptions on page G2-5628 and Vector Catch exceptions on 
page G2-5667. 


ISS encoding for an exception from a Software Step exception 


24 23 765 0 


ISV, bit [24] 
Instruction syndrome valid. Indicates whether the EX bit, ISS[6], is valid, as follows: 
0b0 EX bit is RESO. 
0b1 EX bit is valid. 
See the EX bit description for more information. 


This field resets to an architecturally UNKNOWN value. 


Bits [23:7] 


Reserved, RESO. 


EX, bit [6] 


Exclusive operation. If the ISV bit is set to 1, this bit indicates whether a Load-Exclusive instruction 
was stepped. 


0bd An instruction other than a Load-Exclusive instruction was stepped. 
Qb1 A Load-Exclusive instruction was stepped. 
If the ISV bit is set to 0, this bit is RESO, indicating no syndrome data is available. 


This field resets to an architecturally UNKNOWN value. 


IFSC, bits [5:0] 
Instruction Fault Status Code. This field is set to 0b100010, to indicate a Debug exception. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see Software Step exceptions on page D2-2446. 
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ISS encoding for an exception from a Watchpoint exception 


ieee ee 


Bits [24:14] 


24 14 13 12 98765 0 
RESO 7 RESO f | DFSC 


RESO 
CM 


Reserved, RESO. 


VNCR, bit [13] 


Bits [12:9] 


CM, bit [8] 


Bit [7] 


Wak, bit [6] 


Indicates that the watchpoint came from use of VNCR_EL2 register by EL1 code. 

Qbd The watchpoint was not generated by the use of VNCR_EL2 by EL] code. 
Qb1 The watchpoint was generated by the use of VNCR_EL2 by EL1 code. 
This field is 0 in ESR_EL1. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Cache maintenance. Indicates whether the Watchpoint exception came from a cache maintenance 
or address translation instruction: 


ObO The Watchpoint exception was not generated by the execution of one of the System 
instructions identified in the description of value 1. 


Qb1 The Watchpoint exception was generated by either the execution of a cache 
maintenance instruction or by a synchronous Watchpoint exception on the execution of 
an address translation instruction. The DC ZVA instruction is not classified as a cache 
maintenance instruction, and therefore its execution cannot cause this field to be set to 1. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Write not Read. Indicates whether the Watchpoint exception was caused by an instruction writing 
to a memory location, or by an instruction reading from a memory location. The possible values of 
this bit are: 


Qbd Watchpoint exception caused by an instruction reading from a memory location. 
Qb1 Watchpoint exception caused by an instruction writing to a memory location. 


For Watchpoint exceptions on cache maintenance and address translation instructions, this bit 
always returns a value of 1. 


For Watchpoint exceptions from an atomic instruction, this field is set to 0 if a read of the location 
would have generated the Watchpoint exception, otherwise it is set to 1. 


Ifmultiple watchpoints match on the same access, it is UNPREDICTABLE which watchpoint generates 
the Watchpoint exception. 


This field resets to an architecturally UNKNOWN value. 
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DFSC, bits [5:0] 
Data Fault Status Code. This field is set to 0b100010, to indicate a Debug exception. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see Watchpoint exceptions on page D2-2431. 


ISS encoding for an exception from execution of a Breakpoint instruction 


24 1615 0 


Reserved, RESO. 


Bits [24:16] 


Comment, bits [15:0] 


Set to the instruction comment field value, zero extended as necessary. For the AArch32 BKPT 
instructions, the comment field is described as the immediate field. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see Breakpoint Instruction exceptions on page D2-2411. 


ISS encoding for an exception from ERET, ERETAA or ERETAB instruction 


24 2 10 
RESO il 
[= 


This EC value only applies when HCR_EL2.NV is 1. 


Bits [24:2] 


Reserved, RESO. 


ERET, bit [1] 
Indicates whether an ERET or ERETA* instruction was trapped to EL2. Possible values are: 
Qbd ERET instruction trapped to EL2. 
Qb1 ERETAA or ERETAB instruction trapped to EL2. 
If this bit is 0, the ERETA field is RESO. 


This field resets to an architecturally UNKNOWN value. 


ERETA, bit [0] 
Indicates whether an ERETAA or ERETAB instruction was trapped to EL2. Possible values are: 
Qbd ERETAA instruction trapped to EL2. 
Qb1 ERETAB instruction trapped to EL2. 
When the ERET field is 0, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see HCR_EL2.NV. 
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D13-2994 


ISS encoding for an exception from Branch Target Identification instruction 


Bits [24:2] 


Reserved, RESO. 


BTYPE, bits [1:0] 
This field is set to the PSTATE.BTYPE value that generated the Branch Target Exception. 


For more information about generating these exceptions, see Chapter B1 The AArch64 Application Level 
Programmers’ Model. 


ISS encoding for an exception from a Pointer Authentication instruction when HCR_EL2.API == 
|| SCR_EL3.API == 


24 0 
RESO 


Reserved, RESO. 


Bits [24:0] 


For more information about generating these exceptions, see: 


à HCR_EL2.API, for exceptions from Pointer authentication instructions, using AArch64 state, trapped to 
EL2. 


s SCR_EL3.API, for exceptions from Pointer authentication instructions, using AArch64 state, trapped to EL3. 


Accessing the ESR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic ESR_EL2 or 
ESR_EL] are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ESR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0101 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return ESR_EL1; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
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elsif PSTATE.EL == EL2 then 
return ESR_EL2; 

elsif PSTATE.EL == EL3 then 
return ESR_EL2; 


MSR ESR_EL2, <Xt> 


op0 op1 CRn 


CRm 


op2 





0b11 0b100 0b0101 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
ESR_EL1 = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
ESR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
ESR_EL2 = X[t]; 


MRS <Xt>, ESR_EL1 


0b0010 


0b000 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b0101 


0b0010 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


return NVMem[0x138]; 
else 
return ESR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return ESR_EL2; 
else 
return ESR_EL1; 
elsif PSTATE.EL == EL3 then 
return ESR_EL1; 


MSR ESR_EL1, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b0101 


if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
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AArch64.SystemAccessTrap(EL2, 0x18); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x138] = X[t]; 

else 
ESR_EL1 = X[t]; 

elsif PSTATE.EL == EL2 then 

if HCR_EL2.E2H == '1' then 
ESR_EL2 = X[t]; 

else 








ESR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ESR_EL1 = X[t]; 
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D13.2.38 ESR_EL3, Exception Syndrome Register (EL3) 


The ESR_EL3 characteristics are: 


Purpose 

Holds syndrome information for an exception taken to EL3. 
Configurations 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ESR_EL3 is a 64-bit register. 


Field descriptions 


The ESR_EL3 bit assignments are: 


32 31 26 25 24 


63 0 
| RESO EC h ISS 


ARM DDI 0487E.a 
ID070919 


ESR_EL3 is made UNKNOWN as a result of an exception return from EL3. 


When an UNPREDICTABLE instruction is treated as UNDEFINED, and the exception is taken to EL3, the value of 
ESR_EL3 is UNKNOWN. The value written to ESR_EL3 must be consistent with a value that could be created as a 
result of an exception from the same Exception level that generated the exception as a result of a situation that is 
not UNPREDICTABLE at that Exception level, in order to avoid the possibility of a privilege violation. 


Bits [63:32] 


Reserved, RESO. 


EC, bits [31:26] 
Exception Class. Indicates the reason for the exception that this register holds information about. 
For each EC value, the table references a subsection that gives information about: 
= The cause of the exception, for example the configuration required to enable the trap. 
e The encoding of the associated ISS. 
Possible values of the EC field are: 
EC == 0b000000 
Unknown reason. 
See ISS encoding for exceptions with an unknown reason. 
EC == 0b000001 
Trapped WFI or WFE instruction execution. 


Conditional WFE and WFI instructions that fail their condition code check do not cause 
an exception. 


See ISS encoding for an exception from a WFI or WFE instruction. 
EC == 0b000011 


Trapped MCR or MRC access with (coproc==0b1111) that is not reported using EC 
0b000000. 


See ISS encoding for an exception from an MCR or MRC access. 
EC == 0b000100 


Trapped MCRR or MRRC access with (coproc==0b1111) that is not reported using EC 
0b000000. 


See ISS encoding for an exception from an MCRR or MRRC access. 
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EC = 0b000101 

Trapped MCR or MRC access with (coproc==0b1110). 

See ISS encoding for an exception from an MCR or MRC access. 
EC = 0b000110 

Trapped LDC or STC access. 

The only architected uses of these instruction are: 


a An STC to write data to memory from DBGDTRRXint. 

s An LDC to read data from memory to DBGDTRTXint. 

See ISS encoding for an exception from an LDC or STC instruction. 
EC == 0b000111 


Access to SVE, Advanced SIMD, or floating-point functionality trapped by 
CPACR_EL1.FPEN, CPTR_EL2.FPEN, CPTR_EL2.TFP, or CPTR_EL3.TFP control. 


Excludes exceptions resulting from CPACR_EL1 when the value of HCR_EL2.TGE is 
1, or because SVE or Advanced SIMD and floating-point are not implemented. These 
are reported with EC value 0b000000 as described in The EC used to report an exception 
routed to EL2 because HCR_EL2.TGE is 1 on page D1-2301. 


See ISS encoding for an exception from an access to SVE, Advanced SIMD or 
floating-point functionality, resulting from CPACR_EL1.FPEN, CPTR_EL2.FPEN or 
CPTR_ELX.TFP. 

EC == 0b001001 When ARMxv8.3-PAuth is implemented 


Trapped use of a Pointer authentication instruction because HCR_EL2.API == 0 || 
SCR_EL3.API == 0. 


See ZSS encoding for an exception from a Pointer Authentication instruction when 
HCR_EL2.API == 0 || SCR_EL3.API == 0 on page D13-3032. 
EC == 0b001100 
Trapped MRRC access with (coproc==0b1110). 
See ISS encoding for an exception from an MCRR or MRRC access. 
EC == 0b001101 When ARMv8.5-BTI is implemented 
Branch Target Exception. 
See ISS encoding for an exception from Branch Target Identification instruction. 
EC == 0b001110 
Illegal Execution state. 


See ISS encoding for an exception from an Illegal Execution state, or a PC or SP 
alignment fault. 


EC == 0b010011 
SMC instruction execution in AArch32 state, when SMC is not disabled. 


This is reported in ESR_EL2 only when the exception is generated because the value of 
HCR_EL2.TSC is 1. 


See ISS encoding for an exception from SMC instruction execution in AArch32 state. 
EC = 0b010101 

SVC instruction execution in AArch6é4 state. 

See ISS encoding for an exception from HVC or SVC instruction execution. 
EC == 0b010110 

HVC instruction execution in AArch64 state, when HVC is not disabled. 

See ISS encoding for an exception from HVC or SVC instruction execution. 
EC = 0b010111 

SMC instruction execution in AArch64 state, when SMC is not disabled. 


This is reported in ESR_EL2 only when the exception is generated because the value of 
HCR_EL2.TSC is 1. 


See ISS encoding for an exception from SMC instruction execution in AArch64 state. 
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EC == 0b011000 


Trapped MSR, MRS or System instruction execution in AArch64 state, that is not 
reported using EC b000000, 0b000001 or 0b000111. 


If ARMv8.4-IDST is implemented, also exceptions generated by a read access to the 
feature ID space. 


If ARMv8.0-CSV2 is implemented, also Cache Speculation Variant exceptions. 


This includes all instructions that cause exceptions that are part of the encoding space 
defined in System instruction class encoding overview on page C5-363, except for those 
exceptions reported using EC values 0b000000, 0b000001, or @b000111. 


See ISS encoding for an exception from MSR, MRS, or System instruction execution in 
AArché6é4 state. 
EC == 0b011001 


Access to SVE functionality trapped as a result of CPACR_EL1.ZEN, 
CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ, that is not reported using EC 
0b000000. 


This EC is defined only if SVEis implemented. 
See ISS encoding for an exception from an access to SVE functionality, resulting from 
CPACR ELIZEN, CPTR. EL2.ZEN, CPTR EL2.TZ, or CPTR. EL3.EZ. 
EC == 0b011111 
IMPLEMENTATION DEFINED exception to EL3. 
See ISS encoding for a IMPLEMENTATION DEFINED exception to EL3. 


EC == 0b100000 


Instruction Abort from a lower Exception level, that might be using AArch32 or 
AArché4. 


Used for MMU faults generated by instruction accesses and synchronous External 
aborts, including synchronous parity or ECC errors. Not used for debug related 
exceptions. 


See ISS encoding for an exception from an Instruction Abort. 
EC = 0b100001 
Instruction Abort taken without a change in Exception level. 


Used for MMU faults generated by instruction accesses and synchronous External 
aborts, including synchronous parity or ECC errors. Not used for debug related 
exceptions. 


See ISS encoding for an exception from an Instruction Abort. 
EC = 0b100010 
PC alignment fault exception. 
See ISS encoding for an exception from an Illegal Execution state, or a PC or SP 
alignment fault. 
EC = 0b100100 
Data Abort from a lower Exception level, that might be using AArch32 or AArch64. 


Used for MMU faults generated by data accesses, alignment faults other than those 
caused by Stack Pointer misalignment, and synchronous External aborts, including 
synchronous parity or ECC errors. Not used for debug related exceptions. 


See ISS encoding for an exception from a Data Abort. 
EC = 0b100101 
Data Abort taken without a change in Exception level. 


Used for MMU faults generated by data accesses, alignment faults other than those 
caused by Stack Pointer misalignment, and synchronous External aborts, including 
synchronous parity or ECC errors. Not used for debug related exceptions. 


See ISS encoding for an exception from a Data Abort. 
EC = 0b100110 
SP alignment fault exception. 
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D13-3000 


See ISS encoding for an exception from an Illegal Execution state, or a PC or SP 
alignment fault. 


EC = 0b101100 
Trapped floating-point exception taken from AArch6é4 state. 


This EC value is valid if the implementation supports trapping of floating-point 
exceptions, otherwise it is reserved. Whether a floating-point implementation supports 
trapping of floating-point exceptions is IMPLEMENTATION DEFINED. 


See ISS encoding for an exception from a trapped floating-point exception. 
EC = 0b101111 
SError interrupt. 
See ISS encoding for an SError interrupt. 
EC = 0b111100 
BRK instruction execution in AArch64 state. 
This is reported in ESR_EL3 only if a BRK instruction is executed. 
See ISS encoding for an exception from execution of a Breakpoint instruction. 
All other EC values are reserved by Arm, and: 
. Unused values in the range 0b000000 - 0b101100 (0x00 - 0x2C) are reserved for future use for 
synchronous exceptions. 
° Unused values in the range 0b101101 - 0b111111 (0x2D - 0x3F) are reserved for future use, and 
might be used for synchronous or asynchronous exceptions. 


The effect of programming this field to a reserved value is that behavior is CONSTRAINED 
UNPREDICTABLE, as described in Reserved values in System and memory-mapped registers and 
translation table entries on page K1-7628. 


This field resets to an architecturally UNKNOWN value. 
IL, bit [25] 


Instruction Length for synchronous exceptions. Possible values of this bit are: 


Qbd 16-bit instruction trapped. 
Qb1 32-bit instruction trapped. This value is also used when the exception is one of the 
following: 
s An SError interrupt. 
° An Instruction Abort exception. 
. A PC alignment fault exception. 
. An SP alignment fault exception. 


s A Data Abort exception for which the value of the ISV bit is 0. 
s An Illegal Execution state exception. 


e Any debug exception except for Breakpoint instruction exceptions. For 
Breakpoint instruction exceptions, this bit has its standard meaning: 


— _ @b0: 16-bit T32 BKPT instruction. 
—  @b1: 32-bit A32 BKPT instruction or A64 BRK instruction. 
° An exception reported using EC value 0b000000. 


This field resets to an architecturally UNKNOWN value. 


ISS, bits [24:0] 


Instruction Specific Syndrome. Architecturally, this field can be defined independently for each 
defined Exception class. However, in practice, some ISS encodings are used for more than one 
Exception class. 
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Typically, an ISS encoding has a number of subfields. When an ISS subfield holds a register number, 
the value returned in that field is the AArch64 view of the register number. For an exception taken 
from AArch32 state, Mapping of the general-purpose registers between the Execution states on 
page D1-2381. 


If the AArch32 register descriptor is @b1111, then: 


- If the instruction that generated the exception was not UNPREDICTABLE, the field takes the 
value @b11111. 


$ If the instruction that generated the exception was UNPREDICTABLE, the field takes an 
UNKNOWN value that must be either: 


— The AArch64 view of the register number of a register that might have been used at 
the Exception level from which the exception was taken. 


— The value 0b11111. 


When the EC field is 0b000000, indicating an exception with an unknown reason, the ISS field is not 
valid, RESO. 


The following subsections describe each ISS format. 


ISS encoding for exceptions with an unknown reason 


24 0 


RESO 


Bits [24:0] 


Reserved, RESO. 


When an exception is reported using this EC code the IL field is set to 1. 


This EC code is used for all exceptions that are not covered by any other EC value. This includes exceptions that 
are generated in the following situations: 


The attempted execution of an instruction bit pattern that has no allocated instruction or that is not accessible 
at the current Exception level and Security state, including: 


—  Aread access using a System register pattern that is not allocated for reads or that does not permit reads 
at the current Exception level and Security state. 


— A write access using a System register pattern that is not allocated for writes or that does not permit 
writes at the current Exception level and Security state. 


— Instruction encodings that are unallocated. 


— Instruction encodings for instructions that are not implemented in the implementation. 
In Debug state, the attempted execution of an instruction bit pattern that is not accessible in Debug state. 


In Non-debug state, the attempted execution of an instruction bit pattern that is not accessible in Non-debug 
state. 


In AArch32 state, attempted execution ofa short vector floating-point instruction. 


In an implementation that does not include Advanced SIMD and floating-point functionality, an attempted 
access to Advanced SIMD or floating-point functionality under conditions where that access would be 
permitted if that functionality was present. This includes the attempted execution of an Advanced SIMD or 
floating-point instruction, and attempted accesses to Advanced SIMD and floating-point System registers. 


An exception generated because of the value of one of the SCTLR_EL1.{ITD, SED, CP15BEN} control bits. 


Attempted execution of: 
— An HVC instruction when disabled by HCR_EL2.HCD or SCR_EL3.HCE. 
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An SMC instruction when disabled by SCR_EL3.SMD. 
An HLT instruction when disabled by EDSCR.HDE. 


7 Attempted execution of an MSR or MRS instruction to access SP_ELO when the value of SPSel.SP is 0. 


s Attempted execution, in Debug state, of: 


A DCPS! instruction when the value of HCR_EL2.TGE is 1 and EL2 is disabled or not implemented 
in the current Security state. 


A DCPS2 instruction from EL1 or ELO when EL2 is disabled or not implemented in the current 
Security state. 


A DCPS3 instruction when the value of EDSCR.SDD is 1, or when EL3 is not implemented. 


è When EL3 is using AArch64, attempted execution from Secure EL1 ofan SRS instruction using R13_mon. 
See Traps to EL3 of Secure monitor functionality from Secure ELI using AArch32 on page D1-2361. 


. In Debug state when the value of EDSCR.SDD is 1, the attempted execution at EL2, EL1, or ELO of an 
instruction that is configured to trap to EL3. 


° In AArch32 state, the attempted execution of an MRS (banked register) or an MSR (banked register) 
instruction to SPSR_mon, SP_mon, or LR_mon. 


è An exception that is taken to EL2 because the value of HCR_EL2.TGE is 1 that, if the value of 
HCR_EL2.TGE was 0 would have been reported with an ESR_ELx.EC value of 0b000111. 


: When SVE is not implemented, attempted execution of: 


An SVE instruction. 
An MSR or MRS instruction to access ZCR_EL1, ZCR_EL2, or ZCR_EL3. 


ISS encoding for an exception from a WFI or WFE instruction 


24 23 20 19 1 0 


f COND RESO 


| 


CV, bit [24] 


Condition code valid. Possible values of this bit are: 

Qbe The COND field is not valid. 

Qb1 The COND field is valid. 

For exceptions taken from AArch64, CV is set to 1. 

For exceptions taken from AArch32: 

* When an A32 instruction is trapped, CV is set to 1. 


° When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is setto 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to @b1110. 
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For exceptions taken from AArch32: 
è When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
: When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY is set to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


° For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Bits [19:1] 
Reserved, RESO. 
TI, bit [0] 
Trapped instruction. Possible values of this bit are: 
Qbd WFI trapped. 
Qb1 WFE trapped. 


This field resets to an architecturally UNKNOWN value. 
The following fields describe configuration settings for generating this exception: 
è SCTLR_EL1.{nTWE, nTWI}. 
° HCR_EL2.{TWE, TWI}. 


* SCR _EL3.{TWE, TWL. 


ISS encoding for an exception from an MCR or MRC access 


24 23 2019 1716 1413 10 0 


9 5 4 1 


CV — | L- Direction 


CY, bit [24] 
Condition code valid. Possible values of this bit are: 
0bd The COND field is not valid. 
Qb1 The COND field is valid. 
For exceptions taken from AArch64, CV is set to 1. 
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For exceptions taken from AArch32: 
è When an A32 instruction is trapped, CV is set to 1. 


. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AAtrch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to @b1110. 
For exceptions taken from AArch32: 
a When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
$ When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY is setto 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


° For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Opc2, bits [19:17] 


The Opc2 value from the issued instruction. 
For a trapped VMRS access, holds the value 0b000. 
This field resets to an architecturally UNKNOWN value. 


Opcl, bits [16:14] 


The Opcl value from the issued instruction. 
For a trapped VMRS access, holds the value 0b111. 


This field resets to an architecturally UNKNOWN value. 


CRn, bits [13:10] 


Rt, bits [9:5] 


The CRn value from the issued instruction. 
For a trapped VMRS access, holds the reg field from the VMRS instruction encoding. 


This field resets to an architecturally UNKNOWN value. 


The Rt value from the issued instruction, the general-purpose register used for the transfer. The 
reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field resets to an architecturally UNKNOWN value. 
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CRm, bits [4:1] 


The CRm value from the issued instruction. 
For a trapped VMRS access, holds the value 0b0000. 


This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 
Qbd Write to System register space. MCR instruction. 
Qb1 Read from System register space. MRC or VMRS instruction. 


This field resets to an architecturally UNKNOWN value. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b000011: 


CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN}, for accesses to the Generic Timer 
Registers from ELO using AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL1 or EL2. 


PMUSERENR _ELO.{ER, CR, SW, EN}, for accesses to Performance Monitor registers from ELO using 
AArch32 state, MCR or MRC access (coproc == b1111) trapped to EL1 or EL2. 


AMUSERENR ELO.EN, for accesses to Activity Monitors registers from ELO using AArch32 state, MCR 
or MRC access (coproc == 0b1111) trapped to EL1 or EL2. 


HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers from EL1 using AArch32 state, 
MCR or MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.TTLB, for execution of TLB maintenance instructions at EL1 using AArch32 state, MCR or 
MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.{TSW, TPC, TPU} for execution of cache maintenance instructions at ELO and EL1 using 
AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.TACR, for accesses to the Auxiliary Control Register at EL1 using AArch32 state, MCR or MRC 
access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.TIDCP, for accesses to lockdown, DMA, and TCM operations at ELO and EL1 using AArch32 
state, MCR or MRC access (coproc == 0b1111) trapped to EL2. 


HCR_EL2.{TID1, TID2, TID3}, for accesses to ID registers at ELO and EL] using AArch32 state, MCR or 
MRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL2.TCPAC, for accesses to CPACR_EL1 or CPACR using AArch32 state, MCR or MRC access 
(coproc == 0b1111) trapped to EL2. 


HSTR_EL2.T<n>, for accesses to System registers using AArch32 state, MCR or MRC access (coproc == 
0b1111) trapped to EL2. 


CNTHCTL_EL2.EL1PCEN, for accesses to the Generic Timer registers from ELO and EL1 using AArch32 
state, MCR or MRC access (coproc == @b1111) trapped to EL2. 


MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers from ELO and EL1 using 
AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL2.TAM, for accesses to Activity Monitors registers from ELO and EL1 using AArch32 state, MCR 
or MRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL3.TCPAC, for accesses to CPACR from EL1 and EL2, and accesses to HCPTR from EL2 using 
AArch32 state, MCR or MRC access (coproc == 0b1111) trapped to EL3. 


MDCR_EL3.TPM, for accesses to Performance Monitor registers from ELO, EL1 and EL2 using AArch32 
state, MCR or MRC access (coproc == @b1111) trapped to EL3. 
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CPTR_EL3.TAM, for accesses to Activity Monitors registers from ELO, EL1 and EL2 using AArch32 state, 
MCR or MRC access (coproc == 0b1111) trapped to EL3. 


See Traps to EL3 of Secure monitor functionality from Secure ELI using AArch32 on page D1-2361 for 
information on other traps using EC value 0b000011. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b000101: 


CPACR_EL1.TTA for accesses to trace registers, MCR or MRC access (coproc == @b1110) trapped to EL1 
or EL2. 


MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers at ELO and EL1 
using AArch32 state, MCR or MRC access (coproc == 0b1110) trapped to EL1 or EL2. 


HCR_EL2.TIDO, for accesses to the JIDR register in the ID group 0 at ELO and EL1 using AArch32, MRC 
access (coproc == 0b1110) trapped to EL2. 


CPTR_EL2.TTA, for accesses to trace registers using AArch32, MCR or MRC access (coproc == 0b1110) 
trapped to EL2. 


MDCR_EL2.TDRA, for accesses to Debug ROM registers DBGDRAR and AArch-DBGDSAR using 
AArch32, MCR or MRC access (coproc == 0b1110) trapped to EL2. 


MDCR_EL2.TDOSA, for accesses to powerdown debug registers, using AArch32 state, MCR or MRC 
access (coproc == 0b1110) trapped to EL2. 


MDCR_EL2.TDA, for accesses to other debug registers, using AArch32 state, MCR or MRC access (coproc 
== 0b1110) trapped to EL2. 


CPTR_EL3.TTA, for accesses to trace registers using AArch32, MCR or MRC access (coproc == 0b1110) 
trapped to EL3. 


MDCR_EL3.TDOSA, for accesses to powerdown debug registers using AArch32, MCR or MRC access 
(coproc == 0b1110) trapped to EL3. 


MDCR_EL3.TDA, for accesses to other debug registers, using AArch32, MCR or MRC access (coproc == 
0b1110) trapped to EL3. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b001000: 


HCR_EL2.TIDO, for accesses to the FPSID register in ID group 0 at EL1 using AArch32 state, VMRS access 
trapped to EL2. 


HCR_EL2.TID3, for accesses to registers in ID group 3 including MVFRO, MVFR1 and MVFR2, VMRS 
access trapped to EL2. 


ISS encoding for an exception from an MCRR or MRRC access 


24 23 20 19 16 15 14 10 0 


9 5 4 1 
CV — | = Direction 
RESO 


CV, bit [24] 


Condition code valid. Possible values of this bit are: 


0bd The COND field is not valid. 
Qb1 The COND field is valid. 
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For exceptions taken from AArch64, CV is set to 1. 
For exceptions taken from AArch32: 
° When an A32 instruction is trapped, CV is set to 1. 


$ When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
. When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


e A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
: When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVis set to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


a For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to @b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Opcl, bits [19:16] 


Bit [15] 


The Opcl value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Rt2, bits [14:10] 


Rt, bits [9:5] 


The Rt2 value from the issued instruction, the second general-purpose register used for the transfer. 
The reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field resets to an architecturally UNKNOWN value. 


The Rt value from the issued instruction, the first general-purpose register used for the transfer. The 
reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field resets to an architecturally UNKNOWN value. 


CRm, bits [4:1] 


The CRm value from the issued instruction. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3007 


Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


D13-3008 


This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 
Qbd Write to System register space. MCRR instruction. 
Qb1 Read from System register space. MRRC instruction. 


This field resets to an architecturally UNKNOWN value. 


The following fields describe configuration settings for generating exceptions that are reported using EC value 
0b000100: 


CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN}, for accesses to the Generic Timer 
Registers from ELO using AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL1 or 
EL2. 


PMUSERENR ELO.{CR, EN}, for accesses to Performance Monitor registers from ELO using AArch32 
state, MCRR or MRRC access (coproc == 0b1111) trapped to EL1 or EL2. 


AMUSERENR _ ELO. {EN}, for accesses to Activity Monitors registers AMEVCNTRO<n> and 
AMEVCNTRI1<n> from ELO using AArch32 state, MCRR or MRRC access (coproc == @b1111) trapped to 
EL1 or EL2. 


HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers from EL1 using AArch32 state, 
MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


HSTR_EL2.T<n>, for accesses to System registers using AArch32 state, MCRR or MRRC access (coproc 
== 0b1111) trapped to EL2. 


CNTHCTL_EL2.{EL1PCEN, EL1PCTEN}, for accesses to the Generic Timer registers from ELO and EL1 
using AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers from ELO and EL1 using 
AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


CPTR_EL2.TAM, for accesses to Activity Monitors registers AMEVCNTRO<n> and AMEVCNTRI1<n> 
from ELO and EL1 using AArch32 state, MCRR or MRRC access (coproc == 0b1111) trapped to EL2. 


MDCR_EL3.TPM, for accesses to Performance Monitor registers from ELO, EL1 and EL2 using AArch32 
state, MCRR or MRRC access (coproc == 0b1111) trapped to EL3. 


CPTR_EL3.TAM, for accesses to Activity Monitors registers from ELO, EL1 and EL2 using AArch32 state, 
MCRR or MRRC access (coproc == 0b1111) trapped to EL3. 


The following sections describe configuration settings for generating exceptions that are reported using EC value 
0b001100: 


CPACR_EL1.TTA for accesses to trace registers using MCR or MRC instructions, MCRR or MRRC access 
(coproc == 0b1110) trapped to EL1 or EL2. 


MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers DBGDSAR and 
DBGDRAR at ELO using AArch32 state, MCRR or MRRC access (coproc == 0b1110) trapped to EL1 or 
EL2. 


CPTR_EL2.TTA, for accesses to trace registers using AArch32, MCRR or MRRC access (coproc == 0b1110) 
trapped to EL2. 


MDCR_EL2.TDRA, for accesses to Debug ROM registers DBGDRAR and AArch-DBGDSAR using 
AArch32, MCRR or MRRC access (coproc == 0b1110) trapped to EL2. 


CPTR_EL3.TTA, for accesses to trace registers using AArch32, MCRR or MRRC access (coproc == 0b1110) 
trapped to EL3. 
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s MDCR_EL3.TDOSA, for traps to powerdown debug registers using AArch32, MCRR or MRRC access 
(coproc == 0b1110) trapped to EL3. 


° MDCR_EL3.TDA, for accesses to other debug registers, using AArch32, MCRR or MRRC access (coproc 
== 0b1110) trapped to EL3. 


ISS encoding for an exception from an LDC or STC instruction 


24 23 20 19 121110 9 5 4 3 1 0 


CV — | | E Direction 
Offset 


RESO 
CY, bit [24] 
Condition code valid. Possible values of this bit are: 
ObO The COND field is not valid. 
Qb1 The COND field is valid. 
For exceptions taken from AArch64, CV is set to 1. 
For exceptions taken from AArch32: 
: When an A32 instruction is trapped, CV is set to 1. 
è When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is setto 1 or 


set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
$ When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
è When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


° For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to | it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 
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imm8, bits [19:12] 


Bits [11:10] 


Rn, bits [9:5] 


Offset, bit [4] 


AM, bits [3:1] 


The immediate value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


The Rn value from the issued instruction, the general-purpose register used for the transfer. The 
reported value gives the AArch64 view of the register. See Mapping of the general-purpose 
registers between the Execution states on page D1-2381. 


This field is valid only when AM[2] is 0, indicating an immediate form of the LDC or STC 
instruction. When AM[2] is 1, indicating a literal form of the LDC or STC instruction, this field is 
UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Indicates whether the offset is added or subtracted: 

ObO Subtract offset. 

Qb1 Add offset. 

This bit corresponds to the U bit in the instruction encoding. 


This field resets to an architecturally UNKNOWN value. 


Addressing mode. The permitted values of this field are: 


0b000 Immediate unindexed. 

0b001 Immediate post-indexed. 

0b010 Immediate offset. 

0b011 Immediate pre-indexed. 

0b100 For a trapped STC instruction or a trapped T32 LDC instruction this encoding is 
reserved. 

0b110 For a trapped STC instruction, this encoding is reserved. 


The values 0b101 and 0b111 are reserved. The effect of programming this field to a reserved value is 
that behavior is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and 
memory-mapped registers and translation table entries on page K1-7644. 


Bit [2] in this subfield indicates the instruction form, immediate or literal. 
Bits [1:0] in this subfield correspond to the bits {P, W} in the instruction encoding. 
This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 
Qbd Write to memory. STC instruction. 
Qb1 Read from memory. LDC instruction. 


This field resets to an architecturally UNKNOWN value. 


The following fields describe the configuration settings for the traps that are reported using EC value 0b000110: 


. MDSCR_EL1.TDCC, for accesses using AArch32 state, LDC access to DBGDTRTXint or STC access to 
DBGDTRRXint trapped to EL1 or EL2. 


s MDCR_EL2.TDA, for accesses using AArch32 state, LDC access to DBGDTRTXint or STC access to 
DBGDTRRXint MCR or MRC access trapped to EL2. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


è MDCR_EL3.TDA, for accesses using AArch32 state, LDC access to DBGDTRTXint or STC access to 
DBGDTRRXint MCR or MRC access trapped to EL3. 


ISS encoding for an exception from an access to SVE, Advanced SIMD or floating-point 
functionality, resulting from CPACR_EL1.FPEN, CPTR_EL2.FPEN or CPTR_ELx.TFP 


24 23 20 19 0 


i COND RESO 


a| 


The accesses covered by this trap include: 
° Execution of SVE or Advanced SIMD and floating-point instructions. 
° Accesses to the Advanced SIMD and floating-point System registers. 


For an implementation that does not include either SVE or support for floating-point and Advanced SIMD, the 
exception is reported using the EC value 0b000000. 
CV, bit [24] 

Condition code valid. Possible values of this bit are: 

Obed The COND field is not valid. 

Qb1 The COND field is valid. 

For exceptions taken from AArch64, CV is set to 1. 

For exceptions taken from AArch32: 

° When an A32 instruction is trapped, CV is set to 1. 


: When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is setto 1 or 
set to 0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AAtrch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to 0b1110. 
For exceptions taken from AArch32: 
- When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
è When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


—  CVis set to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVis set to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3011 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


° For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to 0b1110, or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Bits [19:0] 


Reserved, RESO. 
The following sections describe the configuration settings for the traps that are reported using EC value 0b000111: 
s CPACR_EL1.FPEN, for accesses to SIMD and floating-point registers trapped to EL1. 
: CPTR_EL2.TFP, for accesses to SIMD and floating-point registers trapped to EL2. 


è CPTR_EL2.TFP, for accesses to SIMD and floating-point registers trapped to EL3. 


ISS encoding for an exception from an access to SVE functionality, resulting from 
CPACR_EL1.ZEN, CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ 


24 0 
RESO 
Bits [24:0] 


When SVE is implemented: 


Reserved, RESO. 
The accesses covered by this trap include: 
° Execution of SVE instructions. 
: Accesses to the SVE system registers, ZCR_ELx and ID_AA64ZFRO_EL1. 


For an implementation that does not include SVE, the exception is reported using the EC value 0b000000. 


ISS encoding for an exception from an Illegal Execution state, or a PC or SP alignment fault 


24 0 
RESO 


Reserved, RESO. 


Bits [24:0] 


There are no configuration settings for generating Illegal Execution state exceptions and PC alignment fault 
exceptions. For more information about these exceptions see The Illegal Execution state exception on page D1-2306 
and PC alignment checking on page D1-2287. 


SP alignment checking on page D1-2287 describes the configuration settings for generating SP alignment fault 
exceptions. 
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ISS encoding for an exception from HVC or SVC instruction execution 


Bits [24:16] 


Reserved, RESO. 


imm16, bits [15:0] 
The value of the immediate field from the HVC or SVC instruction. 


For an HVC instruction, and for an A64 SVC instruction, this is the value of the imm16 field of the 
issued instruction. 


For an A32 or T32 SVC instruction: 
. If the instruction is unconditional, then: 


— For the T32 instruction, this field is zero-extended from the imm8 field of the 
instruction. 


— For the A32 instruction, this field is the bottom 16 bits of the imm24 field of the 
instruction. 


° If the instruction is conditional, this field is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


In AArch32 state, the HVC instruction is unconditional, and a conditional SVC instruction generates an exception 
only if it passes its condition code check. Therefore, the syndrome information for these exceptions does not require 
conditionality information. 


For T32 and A32 instructions, see SVC and HVC. 


For A64 instructions, see SVC and HVC. 


ISS encoding for an exception from SMC instruction execution in AArch32 state 


24 23 20 19 18 0 


i COND i RESO 
ail 
CCKNOWNPASS 


For an SMC instruction that completes normally and generates an exception that is taken to EL3, the ISS encoding 
is RESO. 


For an SMC instruction that is trapped to EL2 from EL1 because HCR_EL2.TSC is 1, the ISS encoding is as shown 
in the diagram. 
CV, bit [24] 

Condition code valid. Possible values of this bit are: 

ObO The COND field is not valid. 

Qb1 The COND field is valid. 

For exceptions taken from AArch64, CV is set to 1. 

For exceptions taken from AArch32: 

$ When an A32 instruction is trapped, CV is set to 1. 
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a When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or 
set to 0. See the description of the COND field for more information. 


This field is only valid if CCKNOWMPASS is 1, otherwise it is RESO. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. This field is valid only for exceptions taken from 
AArch32, and only when the value of CV is 1. 


For exceptions taken from AArch64, this field is set to @b1110. 
For exceptions taken from AArch32: 
. When an A32 instruction is trapped, CV is set to 1 and: 


— Ifthe instruction is conditional, COND is set to the condition code field value from the 
instruction. 


— Ifthe instruction is unconditional, COND is set to 0b1110. 


° A conditional A32 instruction that is known to pass its condition code check can be presented 
either: 


— With COND set to 0b1110, the value for unconditional. 
— With the COND value held in the instruction. 
à When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


— CY isset to 0 and COND is set to an UNKNOWN value. Software must examine the 
SPSR.IT field to determine the condition, if any, of the T32 instruction. 


—  CVisset to 1 and COND is set to the condition code for the condition that applied to 
the instruction. 
$ For an implementation that, for both A32 and T32 instructions, takes an exception on a 
trapped conditional instruction only if the instruction passes its condition code check, these 
definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND 
field is set to @b1110, or to the value of any condition that applied to the instruction. 


This field is only valid if CCKNOWMPASS is 1, otherwise it is RESO. 


This field resets to an architecturally UNKNOWN value. 


CCKNOWNPASS, bit [19] 


Bits [18:0] 


Indicates whether the instruction might have failed its condition code check. 


Ob The instruction was unconditional, or was conditional and passed its condition code 
check. 
Qb1 The instruction was conditional, and might have failed its condition code check. 
Note 





In an implementation in which an SMC instruction that fails it code check is not trapped, this field 
can always return the value 0. 





This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


HCR_EL2.TSC describes the configuration settings for trapping SMC instructions to EL2. 


See System calls on page D1-2371 describes the case where these exceptions are trapped to EL3. 


D13-3014 
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ISS encoding for an exception from SMC instruction execution in AArch64 state 


Bits [24:16] 
Reserved, RESO. 
imm16, bits [15:0] 
The value of the immediate field from the issued SMC instruction. 


This field resets to an architecturally UNKNOWN value. 


The value of ISS[24:0] described here is used both: 


$ When an SMC instruction is trapped from EL1 modes. 
a When an SMC instruction is not trapped, so completes normally and generates an exception that is taken to 
EL3. 


HCR_EL2.TSC describes the configuration settings for trapping SMC from EL1 modes. 


System calls on page D1-2371 describes the case where these exceptions are trapped to EL3. 


ISS encoding for an exception from MSR, MRS, or System instruction execution in AArch64 state 


22212019 1716 1413 


Ee 


Bits [24:22] 

Reserved, RESO. 
Op), bits [21:20] 

The Op0 value from the issued instruction. 

This field resets to an architecturally UNKNOWN value. 
Op2, bits [19:17] 

The Op2 value from the issued instruction. 

This field resets to an architecturally UNKNOWN value. 
Op1, bits [16:14] 

The Op! value from the issued instruction. 

This field resets to an architecturally UNKNOWN value. 
CRa, bits [13:10] 

The CRn value from the issued instruction. 

This field resets to an architecturally UNKNOWN value. 
Rt, bits [9:5] 

The Rt value from the issued instruction, the general-purpose register used for the transfer. 


This field resets to an architecturally UNKNOWN value. 
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D13-3016 


CRm, bits [4:1] 


The CRm value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 
b0 Write access, including MSR instructions. 
Qb1 Read access, including MRS instructions. 


This field resets to an architecturally UNKNOWN value. 


For exceptions caused by System instructions, see System instructions for the encoding values returned by an 
instruction. 


The following fields describe configuration settings for generating the exception that is reported using EC value 
0b011000: 


SCTLR_EL1.UCI, for execution of cache maintenance instructions using AArch64 state, MSR or MRS 
access trapped to EL1 or EL2. 


SCTLR_EL1.UCT, for accesses to CTR_ELO using AArch64 state, MSR or MRS access trapped to EL1 or 
EL2. 


SCTLR_EL1.DZE, for execution of DC ZVA instructions using AArch64 state, MSR or MRS access trapped 
to ELI or EL2. 


SCTLR_EL1.UMA, for accesses to the PSTATE interrupt masks using AArch64 state, MSR or MRS access 
trapped to EL1 or EL2. 


CPACR_EL1.TTA, for accesses to the trace registers using AArch64 state, MSR or MRS access trapped to 
EL1 or EL2. 


MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers using AArch64 
state, MSR or MRS access trapped to EL1 or EL2. 


CNTKCTL_EL1.{ELOPTEN, ELOVTEN, ELOPCTEN, ELOVCTEN} accesses to the Generic Timer 
registers using AArch64 state, MSR or MRS access trapped to EL! or EL2. 


PMUSERENR _ELO.{ER, CR, SW, EN}, for accesses to the Performance Monitor registers using AArch64 
state, MSR or MRS access trapped to EL1 or EL2. 


AMUSERENR _ ELO.EN, for accesses to Activity Monitors registers using AArch64 state, MSR or MRS 
access trapped to EL1 or EL2. 


HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers using AArch64 state, MSR or 
MRS access trapped to EL2. 


HCR_EL2.TDZ, for execution of DC ZVA instructions using AArch64 state, MSR or MRS access trapped 
to EL2. 


HCR_EL2.TTLB, for execution of TLB maintenance instructions using AArch64 state, MSR or MRS access 
trapped to EL2. 


HCR_EL2.{TSW, TPC, TPU}, for execution of cache maintenance instructions using AArch64 state, MSR 
or MRS access trapped to EL2. 


HCR_EL2.TACR, for accesses to the Auxiliary Control Register, ACTLR_EL1, using AArch64 state, MSR 
or MRS access trapped to EL2. 


HCR_EL2.TIDCP, for accesses to lockdown, DMA, and TCM operations using AArch64 state, MSR or 
MRS access trapped to EL2. 


HCR_EL2.{TID1, TID2, TID3}, for accesses to ID group 1, ID group 2 or ID group 3 registers, using 
AArch64 state, MSR or MRS access trapped to EL2. 
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CPTR_EL2.TCPAC, for accesses to CPACR_EL1, using AArch64 state, MSR or MRS access trapped to 
EL2. 


CPTR_EL2.TTA, for accesses to the trace registers, using AArch64 state, MSR or MRS access trapped to 
EL2. 


MDCR_EL2.TTRF, for accesses to the trace filter register, TRFCR_EL1, using AArch64 state, MSR or MRS 
access trapped to EL2. 


MDCR_EL2.TDRA, for accesses to Debug ROM registers, using AArch64 state, MSR or MRS access 
trapped to EL2. 


MDCR_EL2.TDOSA, for accesses to powerdown debug registers using AArch64 state, MSR or MRS access 
trapped to EL2. 


CNTHCTL_EL2.{EL1PCEN, EL1PCTEN}, for accesses to the Generic Timer registers using AArch64 
state, MSR or MRS access trapped to EL2. 


MDCR_EL2.TDA, for accesses to debug registers using AArch64 state, MSR or MRS access trapped to EL2. 


MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers, using AArch64 state, MSR or 
MRS access trapped to EL2. 


CPTR_EL2.TAM, for accesses to Activity Monitors registers, using AArch64 state, MSR or MRS access 
trapped to EL2. 


HCR_EL2.APK, for accesses to Pointer authentication key registers. using AArch64 state, MSR or MRS 
access trapped to EL2. 


HCR_EL2.{NV, NV1}, for Nested virtualization register access, using AArch64 state, MSR or MRS access, 
trapped to EL2. 


HCR_EL2.AT, for execution of AT S1E* instructions, using AArch64 state, MSR or MRS access, trapped to 
EL2. 


HCR_EL2.{TERR, FIEN}, for accesses to RAS registers, using AArch64 state, MSR or MRS access, 
trapped to EL2. 


SCR_EL3.APK, for accesses to Pointer authentication key registers, using AArch64 state, MSR or MRS 
access trapped to EL3. 


SCR_EL3.ST, for accesses to the Counter-timer Physical Secure timer registers, using AArch64 state, MSR 
or MRS access trapped to EL3. 


SCR_EL3.{TERR, FIEN}, for accesses to RAS registers, using AArch64 state, MSR or MRS access trapped 
to EL3. 


CPTR_EL3.TCPAC, for accesses to CPTR_EL2 and CPACR_EL1 using AArch64 state, MSR or MRS 
access trapped to EL3. 


CPTR_EL3.TTA, for accesses to the trace registers, using AArch64 state, MSR or MRS access trapped to 
EL3. 


MDCR_EL3.TTRF, for accesses to the filter trace control registers, TRFCR_EL1 and TRFCR_EL2, using 
AArch64 state, MSR or MRS access trapped to EL3. 


MDCR_EL3.TDA, for accesses to debug registers, using AArch64 state, MSR or MRS access trapped to 
EL3. 


MDCR_EL3.TDOSA, for accesses to powerdown debug registers, using AArch64 state, MSR or MRS 
access trapped to EL3. 





MDCR_EL3.TPM, for accesses to Performance Monitor registers, using AArch64 state, MSR or MRS 
access trapped to EL3. 
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s CPTR_EL3.TAM, for accesses to Activity Monitors registers, using AArch64 state, MSR or MRS access, 
trapped to EL3. 


° If ARMv8.2-EVT is implemented, HCR_EL2.{TTLBOS, TTLBIS, TICAB, TOCU, TID4} and 
HCR2.{TTLBIS, TICAB, TOCU, TID4} control traps for EL1 and ELO Cache controls that use this EC 
value. 


ISS encoding for a IMPLEMENTATION DEFINED exception to EL3 


24 0 
IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [24:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


ISS encoding for an exception from an Instruction Abort 


24 131211109 8 7 6 5 0 


Bits [24:13] 
Reserved, RESO. 
SET, bits [12:11] 


Synchronous Error Type. When the RAS Extension is implemented and IFSC is 0b010000, describes 
the state of the PE after taking the Instruction Abort exception. The possible values of this field are: 


0b00 Recoverable error (UER). 
0b10 Uncontainable error (UC). 
0b11 Restartable error (UEO) or Corrected error (CE). 


All other values are reserved. 


Note 


Software can use this information to determine what recovery might be possible. Taking a 
synchronous External Abort exception might result in an unrecoverable PE state. 








This field is RESO if either: 
. The RAS Extension is not implemented. 
. The value returned in the IFSC field is not 0b010000. 


This field resets to an architecturally UNKNOWN value. 
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FnV, bit [10] 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd FAR is valid. 
Qb1 FAR is not valid, and holds an UNKNOWN value. 
This field is only valid if the IFSC code is @b@10000. It is RESO for all other aborts. 


This field resets to an architecturally UNKNOWN value. 


EA, bit [9] 
External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External 
aborts. 
For any abort other than an External abort this bit returns a value of 0. 
This field resets to an architecturally UNKNOWN value. 
Bit [8] 


Reserved, RESO. 


SIPTW, bit [7] 


For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 
translation table walk: 


Obd Fault not on a stage 2 translation for a stage 1 translation table walk. 
Qb1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. 
For any abort other than a stage 2 fault this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Bit [6] 


Reserved, RESO. 


IFSC, bits [5:0] 
Instruction Fault Status Code. Possible values of this field are: 
@b000000 Address size fault, level 0 of translation or translation table base register 
Qb000001 Address size fault, level 1 
0b000010 Address size fault, level 2 
0b000011 Address size fault, level 3 
0b000100 ‘Translation fault, level 0 
0b000101 Translation fault, level 1 
0b000110 ‘Translation fault, level 2 
0b000111 Translation fault, level 3 
0b001001 Access flag fault, level 1 
0b001010 Access flag fault, level 2 
0b001011 Access flag fault, level 3 
0b001101 Permission fault, level 1 
0b001110 Permission fault, level 2 
0b001111 Permission fault, level 3 





0b010000 Synchronous External abort, not on translation table walk 

0b01010@ Synchronous External abort, on translation table walk, level 0 
0b010101 Synchronous External abort, on translation table walk, level 1 
0b010110 Synchronous External abort, on translation table walk, level 2 
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0b010111 Synchronous External abort, on translation table walk, level 3 

0b01100@ Synchronous parity or ECC error on memory access, not on translation table walk 
0b011100 Synchronous parity or ECC error on memory access on translation table walk, level 0 
Qb011101 Synchronous parity or ECC error on memory access on translation table walk, level 1 
0b011110 Synchronous parity or ECC error on memory access on translation table walk, level 2 
Qb011111 Synchronous parity or ECC error on memory access on translation table walk, level 3 
0b110000 TLB conflict abort 


0b110001 Unsupported atomic hardware update fault, if the implementation includes 
ARMv8.1-TTHM. Otherwise reserved. 


All other values are reserved. 


When the RAS Extension is implemented, 0b011000, b011100, 0b011101, 0b011110, and 0b011111, are 
reserved. 


Note 


Armv8.2 requires the implementation of the RAS Extension. 








For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on page DS5-2628. 
Note 


Because Access flag faults and Permission faults can only result from a Block or Page translation 
table descriptor, they cannot occur at level 0. 








If the SIPTW bit is set, then the level refers the level of the stage2 translation that is translating a 
stage 1 translation walk. 


This field resets to an architecturally UNKNOWN value. 


ISS encoding for an exception from a Data Abort 


24 23 22 21 20 161514131211109 8 7 6 5 





Ta 
Ga 


ISV, bit [24] 


Instruction syndrome valid. Indicates whether the syndrome information in ISS[23:14] is valid. 
ObO No valid instruction syndrome. ISS[23:14] are RESO. 

Qb1 ISS[23:14] hold a valid instruction syndrome. 

This bit is 0 for all faults reported in ESR_EL2 except the following stage 2 aborts: 


° AArch64 loads and stores of a single general-purpose register (including the register 
specified with 0b11111, including those with Acquire/Release semantics, but excluding Load 
Exclusive or Store Exclusive and excluding those with writeback. 


° AArch32 instructions where the instruction: 


— Isan LDR, LDA, LDRT, LDRSH, LDRSHT, LDRH, LDAH, LDRHT, LDRSB, 
LDRSBT, LDRB, LDAB, LDRBT, STR, STL, STRT, STRH, STLH, STRHT, STRB, 
STLB, or STRBT instruction. 
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— Is not performing register writeback. 
— [snot using R15 as a source or destination register. 


For these cases, ISV is UNKNOWN if the exception was generated in Debug state in memory access 
mode, and otherwise indicates whether ISS[23:14] hold a valid syndrome. 


ISV is 0 for all faults reported in ESR_EL1 or ESR_EL3. 
When the RAS Extension is implemented, ISV is 0 for any synchronous External abort. 


For ISS reporting, a stage 2 abort on a stage 1 translation table walk does not return a valid 
instruction syndrome, and therefore ISV is 0 for these aborts. 


When the RAS Extension is not implemented, the value of ISV on a synchronous External abort on 
a stage 2 translation table walk is IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


SAS, bits [23:22] 
Syndrome Access Size. When ISV is 1, indicates the size of the access attempted by the faulting 


operation. 

0b00 Byte 

0b01 Halfword 
0b10 Word 

0b11 Doubleword 


This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


SSE, bit [21] 


Syndrome Sign Extend. When ISV is 1, for a byte, halfword, or word load operation, indicates 
whether the data item must be sign extended. For these cases, the possible values of this bit are: 


0b0 Sign-extension not required. 

0b1 Data item must be sign-extended. 

For all other operations this bit is 0. 

This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


SRT, bits [20:16] 


Syndrome Register transfer. When ISV is 1, the register number of the Rt operand of the faulting 
instruction. If the exception was taken from an Exception level that is using AArch32 then this is 
the AArch64 view of the register. See Mapping of the general-purpose registers between the 
Execution states on page D1-2381. 


This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


SF, bit [15] 


Width of the register accessed by the instruction is Sixty-Four. When ISV is 1, the possible values 
of this bit are: 


Qbd Instruction loads/stores a 32-bit wide register. 
Qb1 Instruction loads/stores a 64-bit wide register. 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3021 


ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


AR, bit [14] 


Note 
This field specifies the register width identified by the instruction, not the Execution state. 








This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 
This field resets to an architecturally UNKNOWN value. 


Acquire/Release. When ISV is 1, the possible values of this bit are: 
Qbd Instruction did not have acquire/release semantics. 

Qb1 Instruction did have acquire/release semantics. 

This field is UNKNOWN when the value of ISV is UNKNOWN. 

This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


VNCR, bit [13] 


Indicates that the fault came from use of VNCR_EL2 register by EL1 code. 


Qbd The fault was not generated by the use of VNCR_EL2, by an MRS or MSR instruction 
executed at EL1. 
Qb1 The fault was generated by the use of VNCR_EL2, by an MRS or MSR instruction 


executed at EL1. 
This field is 0 in ESR_EL1. 


This field resets to an architecturally UNKNOWN value. 


SET, bits [12:11] 


FnV, bit [10] 


Synchronous Error Type. When the RAS Extension is implemented and DFSC is 0b010000, 
describes the state of the PE after taking the Data Abort exception. The possible values of this field 
are: 


Oba Recoverable error (UER). 
0b10 Uncontainable error (UC). 
0b11 Restartable error (UEO) or Corrected error (CE). 


All other values are reserved. 





Note 


Software can use this information to determine what recovery might be possible. Taking a 
synchronous External Abort exception might result in an unrecoverable PE state. 


This field is RESO if either: 
à The RAS Extension is not implemented. 
. The value returned in the DFSC field is not 0b010000. 


This field resets to an architecturally UNKNOWN value. 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd FAR is valid. 
Qb1 FAR is not valid, and holds an UNKNOWN value. 
This field is valid only if the DFSC code is 0b010000. It is RESO for all other aborts. 


This field resets to an architecturally UNKNOWN value. 
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EA, bit [9] 
External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External 
aborts. 
For any abort other than an External abort this bit returns a value of 0. 
This field resets to an architecturally UNKNOWN value. 
CM, bit [8] 


Cache maintenance. Indicates whether the Data Abort came from a cache maintenance or address 
translation instruction: 


Qbd The Data Abort was not generated by the execution of one of the System instructions 
identified in the description of value 1. 


Qb1 The Data Abort was generated by either the execution of a cache maintenance 
instruction or by a synchronous fault on the execution of an address translation 
instruction. The DC ZVA instruction is not classified as a cache maintenance 
instruction, and therefore its execution cannot cause this field to be set to 1. 


This field resets to an architecturally UNKNOWN value. 


SIPTW, bit [7] 


For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 
translation table walk: 


Qbd Fault not on a stage 2 translation for a stage 1 translation table walk. 
Qb1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. 
For any abort other than a stage 2 fault this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Wak, bit [6] 


Write not Read. Indicates whether a synchronous abort was caused by an instruction writing to a 
memory location, or by an instruction reading from a memory location. The possible values of this 


bit are: 
ObO Abort caused by an instruction reading from a memory location. 
Qb1 Abort caused by an instruction writing to a memory location. 


For faults on cache maintenance and address translation instructions, this bit always returns a value 
of 1. 


For faults from an atomic instruction that both reads and writes from a memory location, this bit is 
set to 0 if a read of the address specified by the instruction would have generated the fault which is 
being reported, otherwise it is set to 1. The architecture permits, but does not require, a relaxation 
of this requirement such that for all stage 2 aborts on stage | translation table walks for atomic 
instructions, the WnR bit is always 0. 


This field is UNKNOWN for: 
. An External abort on an Atomic access. 


° A fault reported using a DFSC value of 0b110101 or 0b110001, indicating an unsupported 
Exclusive or atomic access. 


This field resets to an architecturally UNKNOWN value. 


DFSC, bits [5:0] 
Data Fault Status Code. Possible values of this field are: 
0b000000 Address size fault, level 0 of translation or translation table base register. 
0b000001 Address size fault, level 1. 
0b000010 Address size fault, level 2. 
0b000011 Address size fault, level 3. 
0b000100 ‘Translation fault, level 0. 
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0b000101 Translation fault, level 1. 
0b000110 Translation fault, level 2. 
0b000111 Translation fault, level 3. 
0b001001 Access flag fault, level 1. 
0b001010 Access flag fault, level 2. 
0b001011 Access flag fault, level 3. 
0b001101 Permission fault, level 1. 
0b001110 Permission fault, level 2. 
0b001111 Permission fault, level 3. 





0b010000 Synchronous External abort, not on translation table walk. 

0b010001 Synchronous Tag Check fail 

0b010100 Synchronous External abort, on translation table walk, level 0. 

0b010101 Synchronous External abort, on translation table walk, level 1. 

0b010118 Synchronous External abort, on translation table walk, level 2. 

0b010111 Synchronous External abort, on translation table walk, level 3. 

0b011000 Synchronous parity or ECC error on memory access, not on translation table walk. 
0b011100 Synchronous parity or ECC error on memory access on translation table walk, level 0. 
0b011101 Synchronous parity or ECC error on memory access on translation table walk, level 1. 
0b011110 Synchronous parity or ECC error on memory access on translation table walk, level 2. 
0b011111 Synchronous parity or ECC error on memory access on translation table walk, level 3. 
0b100001 Alignment fault. 

0b110000 TLB conflict abort. 


0b110001 Unsupported atomic hardware update fault, if the implementation includes 
ARMv8.1-TTHM. Otherwise reserved. 


@b110100 IMPLEMENTATION DEFINED fault (Lockdown). 

@b110101 IMPLEMENTATION DEFINED fault (Unsupported Exclusive or Atomic access). 
@b111101 Section Domain Fault, used only for faults reported in the PAR_EL1. 
@b111110 Page Domain Fault, used only for faults reported in the PAR_EL1. 

All other values are reserved. 


When the RAS Extension is implemented, 0011000, 0b011100, 0b011101, 0b011110, and 0b011111, are 
reserved. 


For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on page DS5-2628. 


Note 


Because Access flag faults and Permission faults can only result from a Block or Page translation 
table descriptor, they cannot occur at level 0. 








If the SIPTW bit is set, then the level refers the level of the stage2 translation that is translating a 
stage 1 translation walk. 


This field resets to an architecturally UNKNOWN value. 
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ISS encoding for an exception from a trapped floating-point exception 


24 23 22 11 10 876543210 


Bit [24] 


Reserved, RESO. 


TFYV, bit [23] 
Trapped Fault Valid bit. Indicates whether the IDF, IXF, UFF, OFF, DZF, and IOF bits hold valid 
information about trapped floating-point exceptions. The possible values of this bit are: 


Obd The IDF, IXF, UFF, OFF, DZF, and IOF bits do not hold valid information about trapped 
floating-point exceptions and are UNKNOWN. 

Qb1 One or more floating-point exceptions occurred during an operation performed while 
executing the reported instruction. The IDF, IXF, UFF, OFF, DZF, and IOF bits indicate 
trapped floating-point exceptions that occurred. For more information see 
Floating-point exceptions and exception traps on page D1-2313. 


It is IMPLEMENTATION DEFINED whether this field is set to 0 on an exception generated by a trapped 
floating point exception from a vector instruction. 





Note 


This is not a requirement. Implementations can set this field to 1 on a trapped floating-point 
exception from a vector instruction and return valid information in the {IDF, IXF, UFF, OFF, DZF, 
IOF} fields. 





This field resets to an architecturally UNKNOWN value. 


Bits [22:11] 


Reserved, RESO. 


VECITR, bits [10:8] 


For a trapped floating-point exception from an instruction executed in AArch32 state this field is 
RES1. 


For a trapped floating-point exception from an instruction executed in AArch6é4 state this field is 
UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


IDF, bit [7] 


Input Denormal floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Input denormal floating-point exception has not occurred. 
Qb1 Input denormal floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 
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Bits [6:5] 


IXF, bit [4] 


UFF, bit [3] 


OFF, bit [2] 


DZF, bit [1] 


IOF, bit [0] 


Reserved, RESO. 


Inexact floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, 
the possible values of this bit are: 


Qbd Inexact floating-point exception has not occurred. 
0b1 Inexact floating-point exception occurred during execution of the reported instruction. 


This field resets to an architecturally UNKNOWN value. 


Underflow floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Underflow floating-point exception has not occurred. 
Qb1 Underflow floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


Overflow floating-point exception trapped bit. Ifthe TFV field is 0, this bit is UNKNOWN. Otherwise, 
the possible values of this bit are: 


Qbd Overflow floating-point exception has not occurred. 
Qb1 Overflow floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


Divide by Zero floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Divide by Zero floating-point exception has not occurred. 
Qb1 Divide by Zero floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


Invalid Operation floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. 
Otherwise, the possible values of this bit are: 


Qbd Invalid Operation floating-point exception has not occurred. 
Qb1 Invalid Operation floating-point exception occurred during execution of the reported 
instruction. 


This field resets to an architecturally UNKNOWN value. 


In an implementation that supports the trapping of floating-point exceptions: 


° From an Exception level using AArch64, the FPCR. {IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of 
the floating-point exception traps. 


. From an Exception level using AArch32, the FPSCR. {IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of 
the floating-point exception traps. 
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ISS encoding for an SError interrupt 


24 23 141312 109 8 6 5 0 


f RESO a] RESO DFSC 
IDS — | Loo EA 
IESB 


IDS, bit [24] 


IMPLEMENTATION DEFINED syndrome. Possible values of this bit are: 








Ob Bits[23:0] of the ISS field holds the fields described in this encoding. 
Note 
If the RAS Extension is not implemented, this means that bits[23:0] of the ISS field are 
RESO. 
Qb1 Bits[23:0] of the ISS field holds IMPLEMENTATION DEFINED syndrome information that 


can be used to provide additional information about the SError interrupt. 


Note 
This field was previously called ISV. 








This field resets to an architecturally UNKNOWN value. 


Bits [23:14] 


Reserved, RESO. 


TESB, bit [13] 
Implicit error synchronization event. 


Qbd The SError interrupt was either not synchronized by the implicit error synchronization 
event or not taken immediately. 


Qb1 The SError interrupt was synchronized by the implicit error synchronization event and 
taken immediately. 


This field is RESO if the value returned in the DFSC field is not 0b010001. 


Note 
Armv8.2 requires the implementation of the RAS Extension and ARMv8.2-IESB. 








This field resets to an architecturally UNKNOWN value. 


AET, bits [12:10] 
Asynchronous Error Type. 


When the RAS Extension is implemented and DFSC is 0b010001, describes the state of the PE after 
taking the SError interrupt exception. The possible values of this field are: 


0b000 Uncontainable error (UC). 
0b001 Unrecoverable error (UEU). 
0b010 Restartable error (UEO). 
0b011 Recoverable error (UER). 
0b110 Corrected error (CE). 


All other values are reserved. 
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EA, bit [9] 


Bits [8:6] 


If multiple errors are taken as a single SError interrupt exception, the overall state of the PE is 
reported. For example, if both a Recoverable and Unrecoverable error occurred, the state is 
Unrecoverable. 


Note 


Software can use this information to determine what recovery might be possible. The recovery 
software must also examine any implemented fault records to determine the location and extent of 
the error. 





This field is RESO if either: 
° The RAS Extension is not implemented. 
. The value returned in the DFSC field is not 0b010001. 





Note 


Armv8.2 requires the implementation of the RAS Extension. 





This field resets to an architecturally UNKNOWN value. 


External abort type. When the RAS Extension is implemented, this bit can provide an 
IMPLEMENTATION DEFINED classification of External aborts. 


For any abort other than an External abort this bit returns a value of 0. 
This field is RESO if either: 
° The RAS Extension is not implemented. 


. The value returned in the DFSC field is not 0b010001. 





Note 


Armv8.2 requires the implementation of the RAS Extension. 





This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


DESC, bits [5:0] 


D13-3028 


Data Fault Status Code. When the RAS Extension is implemented, possible values of this field are: 
0b000000 Uncategorized. 

0b010001 Asynchronous SError interrupt. 

All other values are reserved. 


If the RAS Extension is not implemented, this field is RESO. 





Note 
Armv8.2 requires the implementation of the RAS Extension. 


This field resets to an architecturally UNKNOWN value. 
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ISS encoding for an exception from a Breakpoint or Vector Catch debug exception 


24 6 5 0 
RESO IFSC 


Reserved, RESO. 


Bits [24:6] 


IFSC, bits [5:0] 
Instruction Fault Status Code. This field is set to 0b100010, to indicate a Debug exception. 


This field resets to an architecturally UNKNOWN value. 
For more information about generating these exceptions: 
$ For exceptions from AArch64, see Breakpoint exceptions on page D2-2413. 


` For exceptions from AArch32, see Breakpoint exceptions on page G2-5628 and Vector Catch exceptions on 
page G2-5667. 


ISS encoding for an exception from a Software Step exception 


24 23 765 0 


ISV, bit [24] 
Instruction syndrome valid. Indicates whether the EX bit, ISS[6], is valid, as follows: 
0b0 EX bit is RESO. 
0b1 EX bit is valid. 
See the EX bit description for more information. 


This field resets to an architecturally UNKNOWN value. 


Bits [23:7] 


Reserved, RESO. 


EX, bit [6] 


Exclusive operation. If the ISV bit is set to 1, this bit indicates whether a Load-Exclusive instruction 
was stepped. 


0bd An instruction other than a Load-Exclusive instruction was stepped. 
Qb1 A Load-Exclusive instruction was stepped. 
If the ISV bit is set to 0, this bit is RESO, indicating no syndrome data is available. 


This field resets to an architecturally UNKNOWN value. 


IFSC, bits [5:0] 
Instruction Fault Status Code. This field is set to 0b100010, to indicate a Debug exception. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see Software Step exceptions on page D2-2446. 
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ISS encoding for an exception from a Watchpoint exception 


ieee ee 


Bits [24:14] 


24 14 13 12 98765 0 
RESO 7 RESO f | DFSC 


RESO 
CM 


Reserved, RESO. 


VNCR, bit [13] 


Bits [12:9] 


CM, bit [8] 


Bit [7] 


Wak, bit [6] 


Indicates that the watchpoint came from use of VNCR_EL2 register by EL1 code. 

Qbd The watchpoint was not generated by the use of VNCR_EL2 by EL] code. 
Qb1 The watchpoint was generated by the use of VNCR_EL2 by EL1 code. 
This field is 0 in ESR_EL1. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Cache maintenance. Indicates whether the Watchpoint exception came from a cache maintenance 
or address translation instruction: 


ObO The Watchpoint exception was not generated by the execution of one of the System 
instructions identified in the description of value 1. 


Qb1 The Watchpoint exception was generated by either the execution of a cache 
maintenance instruction or by a synchronous Watchpoint exception on the execution of 
an address translation instruction. The DC ZVA instruction is not classified as a cache 
maintenance instruction, and therefore its execution cannot cause this field to be set to 1. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Write not Read. Indicates whether the Watchpoint exception was caused by an instruction writing 
to a memory location, or by an instruction reading from a memory location. The possible values of 
this bit are: 


Qbd Watchpoint exception caused by an instruction reading from a memory location. 
Qb1 Watchpoint exception caused by an instruction writing to a memory location. 


For Watchpoint exceptions on cache maintenance and address translation instructions, this bit 
always returns a value of 1. 


For Watchpoint exceptions from an atomic instruction, this field is set to 0 if a read of the location 
would have generated the Watchpoint exception, otherwise it is set to 1. 


Ifmultiple watchpoints match on the same access, it is UNPREDICTABLE which watchpoint generates 
the Watchpoint exception. 


This field resets to an architecturally UNKNOWN value. 
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DFSC, bits [5:0] 
Data Fault Status Code. This field is set to 0b100010, to indicate a Debug exception. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see Watchpoint exceptions on page D2-2431. 


ISS encoding for an exception from execution of a Breakpoint instruction 


24 1615 0 


Reserved, RESO. 


Bits [24:16] 


Comment, bits [15:0] 


Set to the instruction comment field value, zero extended as necessary. For the AArch32 BKPT 
instructions, the comment field is described as the immediate field. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see Breakpoint Instruction exceptions on page D2-2411. 


ISS encoding for an exception from ERET, ERETAA or ERETAB instruction 


24 2 10 
RESO il 
[= 


This EC value only applies when HCR_EL2.NV is 1. 


Bits [24:2] 


Reserved, RESO. 


ERET, bit [1] 
Indicates whether an ERET or ERETA* instruction was trapped to EL2. Possible values are: 
Qbd ERET instruction trapped to EL2. 
Qb1 ERETAA or ERETAB instruction trapped to EL2. 
If this bit is 0, the ERETA field is RESO. 


This field resets to an architecturally UNKNOWN value. 


ERETA, bit [0] 
Indicates whether an ERETAA or ERETAB instruction was trapped to EL2. Possible values are: 
Qbd ERETAA instruction trapped to EL2. 
Qb1 ERETAB instruction trapped to EL2. 
When the ERET field is 0, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


For more information about generating these exceptions, see HCR_EL2.NV. 
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ISS encoding for an exception from Branch Target Identification instruction 


Bits [24:2] 


Reserved, RESO. 


BTYPE, bits [1:0] 
This field is set to the PSTATE.BTYPE value that generated the Branch Target Exception. 


For more information about generating these exceptions, see Chapter B1 The AArch64 Application Level 
Programmers’ Model. 


ISS encoding for an exception from a Pointer Authentication instruction when HCR_EL2.API == 


|| SCR_EL3.API == 
24 0 


Reserved, RESO. 


Bits [24:0] 


For more information about generating these exceptions, see: 


à HCR_EL2.API, for exceptions from Pointer authentication instructions, using AArch64 state, trapped to 
EL2. 


s SCR_EL3.API, for exceptions from Pointer authentication instructions, using AArch64 state, trapped to EL3. 


Accessing the ESR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ESR_EL3 











op0 op1 CRn CRm op2 
0b11 0b110 0b0101 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return ESR_EL3; 
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MSR ESR_EL3, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b110 0b0101 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
ESR_EL3 = X[t]; 
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D13.2.39 


D13-3034 


FAR_EL1, Fault Address Register (EL1) 


The FAR_ ELI characteristics are: 


63 





Purpose 


Holds the faulting Virtual Address for all synchronous Instruction or Data Abort, PC alignment fault 
and Watchpoint exceptions that are taken to EL1. 


Configurations 


Attributes 


AArch64 System register FAR_EL1[31:0] is architecturally mapped to AArch32 System register 
DFAR[31:0] (NS). 


AArch64 System register FAR_EL1[63:32] is architecturally mapped to AArch32 System register 
IFAR[3 1:0] (NS). 


RW fields in this register reset to architecturally UNKNOWN values. 


FAR_ ELI is a 64-bit register. 


Field descriptions 


The FAR_ ELI bit assignments are: 


Bits [63:0] 


Faulting Virtual Address for synchronous exceptions taken to EL1 





Faulting Virtual Address for synchronous exceptions taken to EL1. Exceptions that set the 
FAR _ EL! are Instruction Aborts (EC 0x20 or 0x21), Data Aborts (EC 0x24 or 0x25), PC alignment 
faults (EC 0x22), and Watchpoints (EC 0x34 or 0x35). ESR_EL1.EC holds the EC value for the 
exception. 


For a synchronous External abort, if the VA that generated the abort was from an address range for 
which TCR_ELx.TBI{<0|1>} == 1 for the translation regime in use when the abort was generated, 
then the top eight bits of FAR_EL1 are UNKNOWN. 


For a synchronous External abort other than a synchronous External abort on a translation table 
walk, this field is valid only ifESR_EL1.FnV is 0, andthe FAR_EL1 is UNKNOWNif ESR_EL1.FnV 
is 1. 


For all other exceptions taken to EL1, the FAR_EL1 is UNKNOWN. 


If a memory fault that sets FAR_EL1 is generated from a data cache maintenance or other DC 
instruction, this field holds the address specified in the register argument of the instruction. 


If the exception that updates FAR EL] is taken from an Exception level that is using AArch32, the 
top 32 bits are all zero, unless both of the following apply, in which case the top 32 bits of FAR_ELx 
are 0x00000001: 


. The faulting address was generated by a load or store instruction that sequentially 
incremented from address OxFFFFFFFF. Such a load or store is CONSTRAINED UNPREDICTABLE. 
See Out of range VA on page K1-7616. 


: The implementation treats such incrementing as setting bit[32] of the virtual address to 1. 


For a Data Abort or Watchpoint exception, if address tagging is enabled for the address accessed by 
the data access that caused the exception, then this field includes the tag. For more information 
about address tagging, see Address tagging in AArch64 state on page D5-2506. 


Execution at ELO makes FAR_EL1 become UNKNOWN. 
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Note 


The address held in this field is an address accessed by the instruction fetch or data access that 
caused the exception that gave rise to the instruction or data abort. It is the lower address that gave 
rise to the fault. Where different faults from different addresses arise from the same instruction, such 
as for an instruction that loads or stores a mis-aligned address that crosses a page boundary, the 
architecture does not prioritize between those different faults. 








FAR_EL1 is made UNKNOWN on an exception return from EL1. 


This field resets to an architecturally UNKNOWN value. 


Accessing the FAR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic FAR_EL1 or 
FAR_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, FAR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0110 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x220]; 
else 
return FAR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return FAR_EL2; 
else 
return FAR_EL1; 
elsif PSTATE.EL == EL3 then 
return FAR_EL1; 


MSR FAR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b0110 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x220] = X[t]; 
else 
FAR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
FAR_EL2 = X[t]; 
else 
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FAR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
FAR_EL1 = X[t]; 


MRS <Xt>, FAR_EL12 





op0 op1 CRn CRm op2 





0b11 0b101 0b0110 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x220]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return FAR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return FAR_EL1; 
else 
UNDEFINED; 


MSR FAR_EL12, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b0110 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x220] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
FAR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
FAR_EL1 = X[t]; 
else 
UNDEFINED; 
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MRS <Xt>, FAR_EL2 





op0 op1 CRn 


0b11 0b100 0b0110 


CRm 


0b0000 


op2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return FAR_EL1; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return FAR_EL2; 
elsif PSTATE.EL == EL3 then 
return FAR_EL2; 


MSR FAR_EL2, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b100 0b0110 


0b0000 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
FAR_EL1 = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
FAR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
FAR_EL2 = X[t]; 
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D13.2.40 


D13-3038 


FAR_EL2, Fault Address Register (EL2) 


The FAR_EL2 characteristics are: 


63 





Purpose 


Holds the faulting Virtual Address for all synchronous Instruction or Data Abort, PC alignment fault 
and Watchpoint exceptions that are taken to EL2. 


Configurations 


Attributes 


AArch64 System register FAR_EL2[31:0] is architecturally mapped to AArch32 System register 
HDFAR{3 1:0]. 


AArch64 System register FAR_EL2[63:32] is architecturally mapped to AArch32 System register 
HIFAR[3 1:0]. 


AArch64 System register FAR_EL2[31:0] is architecturally mapped to AArch32 System register 
DFAR[31:0] (S) when HaveEL(EL2). 


AArch64 System register FAR_EL2[63:32] is architecturally mapped to AArch32 System register 
IFAR[31:0] (S) when HaveEL(EL2). 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


FAR_EL2 is a 64-bit register. 


Field descriptions 


The FAR_EL2 bit assignments are: 


Bits [63:0] 


Faulting Virtual Address for synchronous exceptions taken to EL2 





Faulting Virtual Address for synchronous exceptions taken to EL2. Exceptions that set the 
FAR_EL2 are Instruction Aborts (EC 0x20 or 0x21), Data Aborts (EC 0x24 or 0x25), PC alignment 
faults (EC 0x22), and Watchpoints (EC 0x34 or 0x35). ESR_EL2.EC holds the EC value for the 
exception. 


For a synchronous External abort, if the VA that generated the abort was from an address range for 
which TCR_ELx.TBI{<0|1>} == 1 for the translation regime in use when the abort was generated, 
then the top eight bits of FAR_EL2 are UNKNOWN. 


For a synchronous External abort other than a synchronous External abort on a translation table 
walk, this field is valid only if ESR_EL2.FnV is 0, and the FAR_EL2 is UNKNOWN ifESR_EL2.FnV 
is 1. 

For all other exceptions taken to EL2, the FAR_EL2 is UNKNOWN. 


Ifa memory fault that sets FAR_EL2 is generated from a data cache maintenance or other DC 
instruction, this field holds the address specified in the register argument of the instruction. 


If the exception that updates FAR_EL2 is taken from an Exception level that is using AArch32, the 
top 32 bits are all zero, unless both of the following apply, in which case the top 32 bits of FAR_ELx 
are 0x00000001: 


s The faulting address was generated by a load or store instruction that sequentially 
incremented from address 0xFFFFFFFF. Such a load or store instruction is CONSTRAINED 
UNPREDICTABLE. See Out of range VA on page K1-7616. 
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g The implementation treats such incrementing as setting bit[32] of the virtual address to 1. 


For a Data Abort or Watchpoint exception, if address tagging is enabled for the address accessed by 
the data access that caused the exception, then this field includes the tag. For more information 
about address tagging, see Address tagging in AArch64 state on page D5-2506. 


Execution at EL1 or ELO makes FAR_EL2 become UNKNOWN. 


Note 


The address held in this field is an address accessed by the instruction fetch or data access that 
caused the exception that gave rise to the instruction or data abort. It is the lower address that gave 
rise to the fault. Where different faults from different addresses arise from the same instruction, such 
as for an instruction that loads or stores a mis-aligned address that crosses a page boundary, the 
architecture does not prioritize between those different faults. 








FAR_EL2 is made UNKNOWN on an exception return from EL2. 


This field resets to an architecturally UNKNOWN value. 


Accessing the FAR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic FAR_EL2 or 
FAR_ELI are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, FAR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0110 0b0000 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return FAR_EL1; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return FAR_EL2; 
elsif PSTATE.EL == EL3 then 
return FAR_EL2; 


MSR FAR_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b0110 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
FAR_EL1 = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
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elsif PSTATE.EL == EL2 then 
FAR_EL2 = X[t]; 

elsif PSTATE.EL == EL3 then 
FAR_EL2 = X[t]; 


MRS <Xt>, FAR_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b0110 0b0000 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x220]; 
else 
return FAR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return FAR_EL2; 
else 
return FAR_EL1; 
elsif PSTATE.EL == EL3 then 
return FAR_EL1; 


MSR FAR_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b0110 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x220] = X[t]; 
else 
FAR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
FAR_EL2 = X[t]; 
else 








FAR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
FAR_EL1 = X[t]; 
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FAR_EL3, Fault Address Register (EL3) 


The FAR_EL3 characteristics are: 


Purpose 
Holds the faulting Virtual Address for all synchronous Instruction or Data Abort and PC alignment 
fault exceptions that are taken to EL3. 

Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


FAR_EL3 is a 64-bit register. 


Field descriptions 


The FAR_EL3 bit assignments are: 


Bits [63:0] 


ARM DDI 0487E.a 


ID070919 


Faulting Virtual Address for synchronous exceptions taken to EL3 





Faulting Virtual Address for synchronous exceptions taken to EL3. Exceptions that set the 
FAR_EL3 are Instruction Aborts (EC 0x20 or 0x21), Data Aborts (EC 0x24 or 0x25), and PC 
alignment faults (EC @x22). ESR_EL3.EC holds the EC value for the exception. 


For a synchronous External abort, if the VA that generated the abort was from an address range for 
which TCR_ELx.TBI{<0|1>} == 1 for the translation regime in use when the abort was generated, 
then the top eight bits of FAR_EL3 are UNKNOWN. 


For a synchronous External abort other than a synchronous External abort on a translation table 
walk, this field is valid only if ESR_EL3.FnV is 0, and the FAR_EL3 is UNKNOWN if ESR_EL3.FnV 
is 1. 

For all other exceptions taken to EL3, the FAR_EL3 is UNKNOWN. 


Ifa memory fault that sets FAR_EL3 is generated from a data cache maintenance or other DC 
instruction, this field holds the address specified in the register argument of the instruction. 


If the exception that updates FAR_EL3 is taken from an Exception Level using AArch32, the top 
32 bits are all zero, unless both of the following apply, in which case the top 32 bits of FAR_ELx 
are 0x00000001: 


. The faulting address was generated by a load or store instruction that sequentially 
incremented from address OxFFFFFFFF. Such a load or store instruction is CONSTRAINED 
UNPREDICTABLE. See Out of range VA on page K1-7616. 


s The implementation treats such incrementing as setting bit[32] of the virtual address to 1. 
For a Data Abort or Watchpoint exception, if address tagging is enabled for the address accessed by 


the data access that caused the exception, then this field includes the tag. For more information 
about address tagging, see Address tagging in AArch64 state on page D5-2506. 


Execution at EL2, EL1 or ELO makes FAR_EL3 become UNKNOWN. 


Note 


The address held in this register is an address accessed by the instruction fetch or data access that 
caused the exception that actually gave rise to the instruction or data abort. It is the lowest address 
that gave rise to the fault. Where different faults from different addresses arise from the same 
instruction, such as for an instruction that loads or stores a mis-aligned address that crosses a page 
boundary, the architecture does not prioritize between those different faults. 
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FAR_EL3 is made UNKNOWN on an exception return from EL3. 


This field resets to an architecturally UNKNOWN value. 


Accessing the FAR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, FAR_EL3 




















op0 op1 CRm op2 
0b11 0b110 0b0000 0b000 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return FAR_EL3; 
MSR FAR_EL3, <Xt> 
op0 op1 CRm op2 
0b11 0b110 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
FAR_EL3 = X[t]; 
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D13.2.42 FPEXC32_EL2, Floating-Point Exception Control register 
The FPEXC32_EL2 characteristics are: 


Purpose 


Allows access to the AArch32 register FPEXC from AArch64 state only. Its value has no effect on 
execution in AArch64 state. 


Configurations 


AArch6é4 System register FREXC32_EL2[31:0] is architecturally mapped to AArch32 System 
register FPEXC[3 1:0]. 


If EL1 cannot use AArch32, this register is UNDEFINED. 


If EL2 is not implemented but EL3 is implemented, and EL! is capable of using AArch32, then this 
register is not RESO. 


Implemented only if the implementation includes the Advanced SIMD and floating-point 
functionality. 


This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
FPEXC32_EL2 is a 64-bit register. 


Field descriptions 


The FPEXC32_EL2 bit assignments are: 


63 32 31 30 29 28 27 26 25 


VECITR 





Bits [63:32] 


Reserved, RESO. 


EX, bit [31] 
Exception bit. From Armv§8, this bit is RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


EN, bit [30] 
Enables access to the Advanced SIMD and floating-point functionality from all Exception levels, 
except that setting this field to 0 does not disable the following: 
. VMSR accesses to the FPEXC or FPSID. 
° VMRS accesses from the FPEXC, FPSID, MVFRO, MVFR1, or MVFR2. 


Qbd Accesses to the FPSCR, and any of the SIMD and floating-point registers QO-Q15, 
including their views as DO-D31 registers or SO-S31 registers, are UNDEFINED at all 
Exception levels. 
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DEX, bit [29] 


FP2V, bit [28] 


Qb1 This control permits access to the Advanced SIMD and floating-point functionality at 
all Exception levels. 


Execution of floating-point and Advanced SIMD instructions in AArch32 state can be disabled or 
trapped by the following controls: 


s CPACR.cp10, or, if executing at EL0, CPACR_EL1.FPEN. 
° FPEXC.EN. 
. If executing in Non-secure state: 
—  HCPTR.TCP10, or if EL2 is using AArch64, CPTR_EL2.TFP. 
—  NSACR.cp10, or if EL3 is using AArch64, CPTR_EL3.TFP. 
s For Advanced SIMD instructions only: 
—  CPACR.ASEDIS. 
—  Ifexecuting in Non-secure state, HCPTR.TASE and NSACR.NSTRCDIS. 


See the descriptions of the controls for more information. 


— Note 
When executing at ELO using AArch32: 
è If EL1 is using AArch64 then behavior is as if the value of FPEXC.EN is 1. 


° If EL2 is using AArch64 and enabled in the current Security state, and the value of 
HCR_EL2.{RW, TGE} is {1, 1} then behavior is as if the value of FPEXC.EN is 1. 


° If EL2 is using AArch64 and enabled in the current Security state, and the value of 
HCR_EL2.{RW, TGE} is {0, 1} then it is IMPLEMENTATION DEFINED whether the behavior 
is: 


— Asif the value of FPEXC.EN is 1. 


— Determined by the value of FREXC32_EL2.EN, as described in this field description. 
However, Arm deprecates using the value of FREXC32_EL2.EN to determine 
behavior. 


This field resets to an architecturally UNKNOWN value. 


Defined synchronous exception on floating-point execution. 


This field identifies whether a synchronous exception generated by the attempted execution of an 
instruction was generated by an unallocated encoding. The instruction must be in the encoding space 
that is identified by the pseudocode function ExecutingCP 1 0or11Instr() returning TRUE. This field 
also indicates whether the FPEXC32_EL2.TFV field is valid. 

The meaning of this bit is: 


0b0 The exception was generated by the attempted execution of an unallocated instruction 
in the encoding space that is identified by the pseudocode function 
ExecutingCP 10or11Instr(). If FREXC32_EL2.TFV is RW then it is invalid and 
UNKNOWN. If FPEXC32_EL2.{IDF, IXF, UFF, OFF, DZF, IOF} are RW then they are 
invalid and UNKNOWN. 


Qb1 The exception was generated during the execution of an unallocated encoding. 
FPEXC32_EL2.TFV is valid and indicates the cause of the exception. 


On an exception that sets this bit to 1 the exception-handling routine must clear this bit to 0. 


On an implementation that both does not support trapping of floating-point exceptions and 
implements the AArch32 FPSCR. {Stride, Len} fields as RAZ, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


FPINST2 instruction valid bit. From Armv8, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 
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VV, bit [27] 
VECITR valid bit. From Armv8, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


TEV, bit [26] 


Trapped Fault Valid bit. Valid only when the value of FREXC.DEX is 1. When valid, it indicates the 
cause of the exception and therefore whether the FPEXC. {IDF, IXF, UFF, OFF, DZF, IOF} bits are 
valid. 


ObO The exception was caused by the execution of a floating-point VABS, VADD, VDIV, 
VFMA, VFMS, VFNMA, VFNMS, VMLA, VMLS, VMOV, VMUL, VNEG, 
VNMLA, VNMLS, VNMUL, VSQRT, or VSUB instruction when one or both of 
FPSCR. {Stride, Len} was non-zero. If the FPEXC. {IDF, IXF, UFF, OFF, DZF, IOF} 
bits are RW then they are invalid and UNKNOWN. 


Qb1 FPEXC. {IDF, [XF, UFF, OFF, DZF, IOF} indicate the presence of trapped 
floating-point exceptions that had occurred at the time of the exception. Bits are set for 
all trapped exceptions that had occurred at the time of the exception. 


This bit returns a status value and ignores writes. 
When the value of FPEXC.DEX is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


On an implementation that supports the trapping of floating-point exceptions and implements 
FPSCR. {Stride, Len} as RAZ, this bit is RAO/WI. 


This field resets to an architecturally UNKNOWN value. 


Bits [25:11] 


Reserved, RESO. 


VECITR, bits [10:8] 
Vector iteration count. From Armv8, this field is RES1. 


This field resets to an architecturally UNKNOWN value. 


IDF, bit [7] 


Input Denormal trapped exception bit. Valid only when the value of FPEXC.TFV is 1. When valid, 
it indicates whether an Input Denormal exception occurred while FPSCR.IDE was 1: 


Qbd Input Denormal exception has not occurred. 
Qb1 Input Denormal exception has occurred. 


Input Denormal exceptions can occur only when FPSCR.FZ is 1. 





Note 


A half-precision floating-point value that is flushed to zero because the value of FPSCR.FZ16 is 1 
does not generate an Input Denormal exception. 





This bit must be cleared to 0 by the exception-handling routine. 
When the value of FREXC32_EL2.TFV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 
Bits [6:5] 


Reserved, RESO. 
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IXF, bit [4] 


UFF, bit [3] 


OFF, bit [2] 


DZF, bit [1] 


Inexact trapped exception bit. Valid only when the value of FPEXC.TFV is 1. When valid, it 
indicates whether an Inexact exception occurred while FPSCR.IXE was 1: 


Obd Inexact exception has not occurred. 

Qb1 Inexact exception has occurred. 

This bit must be cleared to 0 by the exception-handling routine. 

When the value of FPEXC.TFYV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


Underflow trapped exception bit. Valid only when the value of FREXC.TFV is 1. When valid, it 
indicates whether an Underflow exception occurred while FPSCR.UFE was 1: 


Qbd Underflow exception has not occurred. 

Qb1 Underflow exception has occurred. 

Underflow trapped exceptions can occur: 

è On half-precision data-processing instructions only when FPSCR.FZ16 is 0. 

. Otherwise only when FPSCR.FZ is 0. 

This bit must be cleared to 0 by the exception-handling routine. 

When the value of FPEXC32_EL2.TFV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


Overflow trapped exception bit. Valid only when the value of FPEXC.TFV is 1. When valid, it 
indicates whether an Overflow exception occurred while FPSCR.OFE was 1: 


0bd Overflow exception has not occurred. 

Qb1 Overflow exception has occurred. 

This bit must be cleared to 0 by the exception-handling routine. 

When the value of FPEXC.TFYV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


Divide by Zero trapped exception bit. Valid only when the value of FREXC.TFV is 1. When valid, 
it indicates whether a Divide by Zero exception occurred while FPSCR.DZE was 1: 


ObO Divide by Zero exception has not occurred. 

Qb1 Divide by Zero exception has occurred. 

This bit must be cleared to 0 by the exception-handling routine. 

When the value of FPEXC.TFYV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 
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Invalid Operation trapped exception bit. Valid only when the value of FPEXC.TFV is 1. When valid, 
it indicates whether an Invalid Operation exception occurred while FPSCR.IOE was 1: 


Qbd Invalid Operation exception has not occurred. 

0b1 Invalid Operation exception has occurred. 

This bit must be cleared to 0 by the exception-handling routine. 

When the value of FPEXC.TFV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


Accessing the FPEXC32_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, FPEXC32_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0101 0b0011 0b000 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 

if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x07); 

elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.SystemAccessTrap(EL2, 0x07); 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 


else 


return FPEXC32_EL2; 
elsif PSTATE.EL == EL3 then 
if CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 


else 


return FPEXC32_EL2; 


MSR FPEXC32_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b0101 0b0011 0b000 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
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AArch64.SystemAccessTrap(EL2, 0x07); 

elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x0' then 
AArch64.SystemAccessTrap(EL2, 0x07); 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 

else 
FPEXC32_EL2 = X[t]; 

elsif PSTATE.EL == EL3 then 

if CPTR_EL3.TFP == '1' then 
AArch64.SystemAccessTrap(EL3, 0x07); 

else 
FPEXC32_EL2 = X[t]; 
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D13.2.43  GCR_EL1, Tag Control Register. 


The GCR_EL]1 characteristics are: 


Purpose 
Tag Control Register. 

Configurations 
This register is present only when ARMVv8.5-MemtTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to GCR_EL1 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


GCR_ELI is a 64-bit register. 


Field descriptions 


The GCR_EL1 bit assignments are: 


63 17 16 15 0 


RESO Exclude 


ee RRND 


Bits [63:17] 


Reserved, RESO. 


RRND, bit [16] 


Controls whether RandomTag() generates a deterministic value solely based on the contents of 
RGSR_ELI, or a non-deterministic value. 


Qbd Generate a deterministic value based on RGSR_EL1. 
Qb1 Generate an IMPLEMENTATION DEFINED non-deterministic value. 


Note 


When the value of GCR_EL1.RRND is 1, the value generated does not need to be cryptographically 
random. 





A similar algorithm to that used when RRND=0 but with free running clock is sufficient. 





This field resets to an architecturally UNKNOWN value. 


Exclude, bits [15:0] 
Allocation Tag values excluded from selection by ChooseNonExcludedTag(). 


This field resets to an architecturally UNKNOWN value. 


Accessing the GCR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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D13-3050 


MRS <Xt>, GCR_EL1 














op0 op1 CRn CRm op2 
0b11 0b000 0b0001 0b0000 0b110 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return GCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return GCR_EL1; 
elsif PSTATE.EL == EL3 then 
return GCR_EL1; 
MSR GCR_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0001 0b0000 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
GCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
GCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
GCR_EL1 = X[t]; 
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D13.2.44 GMID_EL1, Multiple tag transfer ID register 


The GMID EL! characteristics are: 


Purpose 
Indicates the block size that is accessed by the LDGM and STGM System instructions. 
Configurations 
This register is present only when ARMVv8.5-MemTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to GMID_EL1 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


GMID_EL1 is a 64-bit register. 


Field descriptions 


The GMID _ EL} bit assignments are: 


63 4 3 
| RESO BS 


Bits [63:4] 


0 


Reserved, RESO. 


BS, bits [3:0] 


Log) of the block size in words. The minimum supported size is 16B (value == 2) and the maximum 
is 256B (value == 6). 


Accessing the GMID_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, GMID_EL1 





CRn op0 op1 op2 CRm 





0b0000 0b11 0b001 0b100 0b0000 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TIDS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return GMID_EL1; 
elsif PSTATE.EL == EL2 then 
return GMID_EL1; 
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elsif PSTATE.EL == EL3 then 
return GMID_EL1; 
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D13.2.45 HACR_EL2, Hypervisor Auxiliary Control Register 


The HACR_EL2 characteristics are: 


63 


ARM DDI 0487E.a 
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Purpose 


Controls trapping to EL2 of IMPLEMENTATION DEFINED aspects of EL1 or ELO operation. 


Note 


Arm recommends that the values in this register do not cause unnecessary traps to EL2 when 
HCR_EL2.{E2H, TGE} == {1, 1}. 








Configurations 


Attributes 


AArch64 System register HACR_EL2[31:0] is architecturally mapped to AArch32 System register 
HACR{31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


HACR_EL2 is a 64-bit register. 


Field descriptions 


The HACR_EL2 bit assignments are: 








0 
IMPLEMENTATION DEFINED 
IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 
Accessing the HACR_EL2 
Accesses to this register use the following encodings in the System instruction encoding space: 
MRS <Xt>, HACR_EL2 
op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0001 0b111 

if PSTATE.EL == EL@ then 

UNDEFINED; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && HCR_EL2.NV == '1' then 

AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 

return HACR_EL2; 
elsif PSTATE.EL == EL3 then 

return HACR_EL2; 
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MSR HACR_EL2, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0001 0b111 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HACR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
HACR_EL2 = X[t]; 
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D13.2.46 HCR_EL2, Hypervisor Configuration Register 
The HCR_EL2 characteristics are: 


Purpose 


Provides configuration controls for virtualization, including defining whether various operations are 


trapped to EL2. 


Configurations 


AArch64 System register HCR_EL2[31:0] is architecturally mapped to AArch32 System register 


HCR[31:0]. 


AArch64 System register HCR_EL2[63:32] is architecturally mapped to AArch32 System register 


HCR2[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HCR_EL2 is a 64-bit register. 


Field descriptions 


The HCR_EL2 bit assignments are: 


CD? 5a S7 PG S3 DSS S2 S150 49 4847 46 ASMA 13 42.41.40 3998 37 I6 95 24 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11109876543210 
t 





f JATI ID BSU [FB] |VI 



















































































































































































RESO S VM 
TIDS SWIO 
DCT PTW 
ATA FMO 
TTLBOS IMO 
TTLBIS AMO 
EnSCXT VF 
TOCU VSE 
RESO DC 
TICAB TWI 
TID4 TWE 
RESO TIDO 
FIEN TID1 
FWB TID2 
NV2 TID3 
NV1 TSC 
API TIDCF 
APK TACR 
RESO TSW 
MIOCNCE TPCF 
TEA TPL 
TERR TILE 
TLOR TVM 
E2H TGE 
cD TDZ 
RW HCD 
TRVM 
Bits [63:59] 
Reserved, RESO. 
TIDS, bit [58] 
When ARMVv8.5-MemTag is implemented: 
Trap ID group 5. Traps the following register accesses to EL2, when EL2 is enabled in the current 
Security state: 
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AArch64: 

° GMID_ELI. 

ObO This control does not cause any instructions to be trapped. 

Qb1 The specified EL1 and ELO accesses to ID group 5 registers are trapped to EL2. 


When the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field has an Effective value of 0 for all 
purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DCT, bit [57] 
When ARMV8.5-MemTag is implemented: 


Default Cacheability Tagging. When HCR_EL2.DC is in effect, controls whether stage 1 
translations are treated as Tagged or Untagged. 


Ob Stage 1 translations are treated as Untagged. 

Qb1 Stage 1 translations are treated as Tagged. 

This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


ATA, bit [56] 
When ARMV8.5-MemTag is implemented: 


Allocation Tag Access. When SCR_EL3.ATA=1 and HCR_EL2.{E2H,TGE} != {1,1}, controls 
EL1 and ELO access to Allocation Tags. 


When access is prevented: 
° Instructions which Load or Store data are Unchecked. 
$ Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI. 


` Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used 
to generate the Logical Address Tag as 0. 


` Cache maintenance instructions which invalidate Allocation Tags from caches behave as the 
equivalent Clean and Invalidate operation on Allocation Tags. 


° MRS and MSR instructions at EL1 using GCR_EL1, RGSR_EL1, TFSR_EL1, TFSR_EL2, 
or TFSREO ELI that are not UNDEFINED are trapped to EL2. 


0bd Access is prevented. 

Qb1 Access is not prevented. 

This field is permitted to be cached in a TLB. 

This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TTLBOS, bit [55] 
When ARMV8.2-EVT is implemented: 


Trap TLB maintenance instructions that operate on the Outer Shareable domain. Traps execution of 
those TLB maintenance instructions at EL1 using AArch64 to EL2 when EL2 is enabled in the 
current Security state. This applies to the following instructions: 


TLBI VMALLEIOS, TLBI VAE1OS, TLBI ASIDE10S,TLBI VAAE1OS, TLBI VALE1OS, TLBI 
VAALEIOS,TLBI RVAE1OS, TLBI RVAAE10S,TLBI RVALE1OS, and TLBI RVAALEIOS. 


0bd This control does not cause any instructions to be trapped. 
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Qb1 Execution of the specified instructions are trapped to EL2. 
If ARMv8.2-EVT is not implemented, this field is RESO. 


When ARMvV8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TTLBIS, bit [54] 
When ARMV8.2-EVT is implemented: 


Trap TLB maintenance instructions that operate on the Inner Shareable domain. Traps execution of 
those TLB maintenance instructions at EL1 using AArch64, and at EL1 using AArch32, to EL2 
when EL2 is enabled in the current Security state. This applies to the following instructions: 


d When EL! is using AArch64, TLBI VMALLELIS, TLBI VAE1IS, TLBI ASIDE1IS,TLBI 
VAAELS, TLBI VALEUS, TLBI VAALEIIS,TLBI RVAEIIS, TLBI RVAAEIS,TLBI 
RVALELS, and TLBI RVAALEIIS. 


- When EL! is using AArch32, TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, 
TLBIMVALIS, and TLBIMVAALIS. 


Qbd This control does not cause any instructions to be trapped. 
Qb1 Execution of the specified instructions are trapped to EL2. 
If ARMv8.2-EVT is not implemented, this field is RESO. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


EnSCXT, bit [53] 
When ARMV8.0-CSV2 is implemented: 
Enable Access to the SCXTNUM_EL1 and SCXTNUM _ELO registers. The defined values are: 


Ob When (HCR_EL2.TGE==0 or HCR_EL2.E2H==0) and EL2 is enabled in the current 
Security state , EL1 and ELO access to SCXTNUM_ELO and EL1 access to 
SCXTNUM_EL1 is disabled by this mechanism, causing an exception to EL2, and the 
values of these registers to be treated as 0. 


When ((HCR_EL2.TGE==1 and HCR_EL2.E2H==1) and EL2 is enabled in the current 
Security state , ELO access to SCXTNUM_ELO is disabled by this mechanism, causing 
an exception to EL2, and the value of this register to be treated as 0. 


Qb1 This control does not cause accesses to SCXTNUM_ELO or SCXTNUM_ELI to be 
trapped. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1,1}, this bit 
has no effect on execution at ELO. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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TOCU, bit [52] 
When ARMV8.2-EVT is implemented: 


Trap cache maintenance instructions that operate to the Point of Unification. Traps execution of 
those cache maintenance instructions at EL1 or ELO using AArch64, and at EL1 using AArch32, to 
EL2 when EL2 is enabled in the current Security state. This applies to the following instructions: 


< When SCTLR_EL1.UCTI is 1, HCR_EL2.{TGE, E2H} is not {1, 1}, and ELO is using 
AArch64, IC IVAU, DC CVAU. 


s When EL] is using AArch64, IC IVAU, IC IALLU, DC CVAU. 
è When EL] is using AArch32, ICIMVAU, ICIALLU, DCCMVAU. 


Note 


An exception generated because an instruction is UNDEFINED at ELO is higher priority than this trap 
to EL2. In addition: 


s IC IALLUIS and IC IALLU are always UNDEFINED at ELO using AArch64. 
g ICIMVAU, ICIALLU, ICIALLUIS, and DCCMVAU are always UNDEFINED at ELO using 








AArch32. 
ObO This control does not cause any instructions to be trapped. 
Qb1 Execution of the specified instructions are trapped to EL2. 


If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean by VA to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED 
whether the execution of any instruction cache invalidate to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bit [51] 


Reserved, RESO. 


TICAB, bit [50] 
When ARMV8.2-EVT is implemented: 


Trap ICIALLUIS/IC IALLUIS cache maintenance instructions. Traps execution of those cache 
maintenance instructions at EL1 using AArch64, and at EL1 using AArch32, to EL2 when EL2 is 
enabled in the current Security state. This applies to the following instructions: 


s When EL1 is using AArch64, IC IALLUIS. 

` When EL] is using AArch32, ICIALLUIS. 

0bd This control does not cause any instructions to be trapped. 
Qb1 ELI execution of the specified instructions is trapped to EL2. 
If ARMv8.2-EVT is not implemented, this field is RESO. 


If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED 
whether the execution of any instruction cache invalidate to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 
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Otherwise: 


Reserved, RESO. 


Trap ID group 4. Traps the following register accesses to EL2, when EL2 is enabled in the current 
Security state: 


AArch64: 

° CCSIDR_EL1, CCSIDR2_EL1, CLIDR_EL1, and CSSELR_EL1. 

° EL1 writes to CSSELR_EL1. 

AArch32: 

° EL1 reads of the CCSIDR, CCSIDR2, CLIDR, and CSSELR. 

- EL1 writes to the CSSELR. 

0bd This control does not cause any instructions to be trapped. 

Qb1 The specified EL1 and ELO accesses to ID group 4 registers are trapped to EL2. 
If ARMv8.2-EVT is not implemented, this field is RESO. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Reserved, RESO. 


Fault Injection Enable. Unless this bit is set to 1, accesses to the ERXPFGCDN_EL1, 
ERXPFGCTL_EL1, and ERXPFGF ELI registers from EL1 generate a Trap exception to EL2, 
when EL2 is enabled in the current Security state, reported using EC syndrome value 0x18. 


ObO Accesses to the specified registers from EL1 are trapped to EL2, when EL2 is enabled 
in the current Security state. 


0b1 This control does not cause any instructions to be trapped. 
If EL2 is disabled in the current Security state, the Effective value of HCR_EL2.FIEN is 0b1. 


If ERRIDR_EL1.NUM is zero, meaning no error records are implemented, or no error record 
accessible using System registers is owned by a node that implements the RAS Common Fault 
Injection Model Extension, then this bit might be RESO. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Defines the combined cacheability attributes in a 2 stage translation regime. 
Qbd When this bit is 0, then: 


e The combination of stage 1 and stage 2 translations on memory type and 
cacheability attributes are as described in the Armv8.0 architecture. For more 
information see Combining the stage 1 and stage 2 attributes, ELI &0 translation 
regime on page D5-2605 
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7 The encoding of the stage 2 memory type and cacheability attributes in bits[5:2] 
of the stage 2 page or block descriptors are as described in the Armv8.0 
architecture. 

Qb1 When this bit is 1, then: 

° Bit[5] of stage 2 page or block descriptor is RESO. 

s When bit[4] of stage 2 page or block descriptor is 1 and when: 

— Bits[3:2] of stage 2 page or block descriptor are 0b11, the resultant memory 
type and inner or outer cachebility attribute is the same as the stage 1 
memory type and inner or outer cacheability attribute. 

—  Bits[3:2] of stage 2 page or block descriptor are 0b10, the resultant memory 
type and attribute is Normal Write-Back. 

—  Bits[3:2] of stage 2 page or block descriptor are 0b0x, the resultant memory 
type will be Normal Non-cacheable except where the stage 1 memory type 
was Device->attr< the resultant memory type will be Device->attr< 

° When bit[4] of stage 2 page or block descriptor is 0 the memory type is Device, 
and when: 


—  Bits[3:2] of stage 2 page or block descriptor are 0b00, the stage 2 memory 
type is Device-nGnRnE. 


—  Bits[3:2] of stage 2 page or block descriptor are 0b01, the stage 2 memory 
type is Device-nGnRE. 


—  Bits[3:2] of stage 2 page or block descriptor are 0b10, the stage 2 memory 
type is Device-nGRE. 





—  Bits[3:2] of stage 2 page or block descriptor are 0b11, the stage 2 memory 
type is Device-GRE. 


e If the stage 1 translation specifies a cacheable memory type, then the stage 1 
cache allocation hint is applied to the final cache allocation hint where the final 
memory type is cacheable. 


` If the stage 1 translation does not specify a cacheable memory type, then if the 
final memory type is cacheable, it is treated as read allocate, write allocate. 


The stage 1 and stage 2 memory types are combined in the manner described in 
Combining the stage 1 and stage 2 attributes, ELI &0 translation regime on 
page D5-2605 


In Secure state, this bit applies to both the Secure stage 2 translation and the Non-secure stage 2 
translation. 


This bit is permitted to be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


NV?2, bit [45] 
When ARMV8.4-NV is implemented: 


Nested Virtualization. Changes the behaviors of HCR_EL2.{NV, NV1} to provide a mechanism for 
hardware to transform reads and writes from System registers into reads and writes from memory. 


Qbd This bit has no effect on the behavior of HCR_EL2.{NV, NV1}. 

Qb1 Redefines behavior of HCR_EL2{NV, NV1} to enable: 
a Transformation of read/writes to registers into read/writes to memory. 
s Redirection of EL2 registers to EL1 registers. 


When this bit is 0, the behavior of HCR_EL2.{NV, NV1} is as defined for ARMv8.3-NV. 


When this is bit is 1, then any exception taken from EL1 and taken to EL1 causes SPSR_EL1.M[3:2] 
to be set to 0b10 and not 0b01 
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This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


AT, bit [44] 
When ARMV8.3-NV is implemented: 


Address Translation. EL1 execution of the following address translation instructions is trapped to 
EL2, when EL2 is enabled in the current Security state, reported using EC syndrome value 0x18: 


. AT S1EOR, AT S1E0W, AT S1E1R, AT SIE1W, AT S1E1RP, AT SIEIWP 
0b0ð This control does not cause any instructions to be trapped. 
Qb1 EL1 execution of the specified instructions is trapped to EL2. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


NVI, bit [43] 
When ARMV8.4-NV is implemented: 

Nested Virtualization. 

Qbd If HCR_EL2.{NV, NV2} are both 1, accesses executed from EL1 to implemented 
EL12, EL02, or EL2 registers are transformed to loads and stores. 
If HCR_EL2.NV2 is 0 or HCR_EL2.{NV, NV2} == {0, 1}, this control does not cause 
any instructions to be trapped. 

Qb1 If HCR_EL2.NV2 is 1, accesses executed from EL1 to implemented EL2 registers are 
transformed to loads and stores. 


If HCR_EL2.NV2 is 0, EL1 accesses to VBAR_EL1, ELR_EL1, and SPSR_EL1, are 
trapped to EL2, when EL2 is enabled in the current Security state, reported using EC 
syndrome value 0x18. 


If HCR_EL2.NV2 is 1, the value of HCR_EL2.NV1 defines which EL1 register accesses are 
transformed to loads and stores. These transformed accesses have priority over the trapping of 
registers. 





The trapping of EL1 registers caused by other control bits has priority over the transformation of 
these accesses. 


If a register is specified that is not implemented by an implementation, then access to that register 
are UNDEFINED. 


For the list of registers affected, see Enhanced support for nested virtualization on page DS-2617. 


If HCR_EL2.{NV, NV1, NV2} are {1, 0, 0},any exception taken from EL1, and taken to EL1, 
causes the SPSR_EL1.M[3:2] to be set to 0b10, and not 0b01. 


If HCR_EL2.{NV, NV1, NV2} are {1, 1, 0}, then: 

° The EL1 translation table Block and Page descriptors: 
—  Bit[54] holds the PXN instead of the UXN. 
—  Bit[53] is RESO. 
— _ Bit[6] is treated as 0 regardless of the actual value. 


° If Hierarchical Permissions are enabled, the EL1 translation table Table descriptors are as 
follows: 


— Bit[61] is treated as 0 regardless of the actual value. 
—  Bit[60] holds the PXNTable instead of the UXNTable. 
— _ Bit[59] is RESO. 


° When executing at EL1, the PSTATE.PAN bit is treated as zero for all purposes except 
reading the value of the bit. 
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s When executing at EL1, the LDTR* instructions are treated as the equivalent LDR* 
instructions, and the STTR* instructions are treated as the equivalent STR* instructions. 


IfHCR_EL2.{NV, NV1, NV2} are {0, 1, 0}, then the behavior is a CONSTRAINED UNPREDICTABLE 
choice of: 


s Behaving as if HCR_EL2.NV is 1 and HCR_EL2.NV1 is 1 for all purposes other than 
reading than reading back the value of the HCR_EL2.NV bit. 


G Behaving as if HCR_EL2.NV is 0 and HCR_EL2.NV1 is 0 for all purposes other than 
reading than reading back the value of the HCR_EL2.NV1 bit. 


s Behaving with regard to the HCR_EL2.NV and HCR_EL2.NV1 bits behavior as defined in 
the rest of this description. 


This bit is permitted to be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 
When ARMV8.3-NV is implemented: 


Nested Virtualization. EL1 accesses to certain registers are trapped to EL2, when EL2 is enabled in 
the current Security state. 


0bd This control does not cause any instructions to be trapped. 


Qb1 ELI accesses to VBAR_EL1, ELR_EL1, SPSR_EL1 are trapped to EL2, when EL2 is 
enabled in the current Security state, reported using EC syndrome value 0x18. 


If HCR_EL2.NV is 1 and HCR_EL2.NV1 is 0 then the following effects also apply: 


° Any exception taken from EL1, and taken to EL1, causes the SPSR_EL1.M[3:2] to be set to 
0b10, and not 0b01. 


If the bits HCR_EL2.NV and HCR_EL2.NV1 are both set to 1 then following effects also apply: 
. The EL! translation table Block and Page descriptors: 

— Bit[54] holds the PXN instead of the UXN. 

—  Bit[53] is RESO. 

—  Bit[6] is treated as 0 regardless of the actual value. 


° If Hierarchical Permissions are enabled, the EL1 translation table Table descriptors are as 
follows: 


— Bit[61] is treated as 0 regardless of the actual value. 
— Bit[60] holds the PXNTable instead of the UXNTable. 
—  Bit[59] is RESO. 


° When executing at EL1, the PSTATE.PAN bit is treated as zero for all purposes except 
reading the value of the bit. 


è When executing at EL1, the LDTR* instructions are treated as the equivalent LDR* 
instructions, and the STTR* instructions are treated as the equivalent STR* instructions. 


IfHCR_EL2.NV is 0 and HCR_EL2.NV1 is 1 then the behavior is a CONSTRAINED UNPREDICTABLE 
choice of: 


a Behaving as if HCR_EL2.NV is 1 and HCR_EL2.NV1 is 1 for all purposes other than 
reading than reading back the value of the HCR_EL2.NV bit. 


$ Behaving as if HCR_EL2.NV is 0 and HCR_EL2.NV1 is 0 for all purposes other than 
reading than reading back the value of the HCR_EL2.NV1 bit. 


. Behaving with regard to the HCR_EL2.NV and HCR_EL2.NV1 bits behavior as defined in 
the rest of this description. 


This bit is permitted to be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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NV, bit [42] 
When ARMV8.4-NV is implemented: 

Nested Virtualization. 

When HCR_EL2.NV2 is 1, redefines register accesses so that: 

° Instructions accessing the Special purpose registers SPSR_EL2 and ELR_EL2 instead access 

SPSR_EL1 and ELR_ELI respectively. 

` Instructions accessing the System registers ESR_EL2 and FAR _EL2 instead access 

ESR_EL1 and FAR_EL1. 

When HCR_EL2.NV2 is 0, or if ARMv8.4-NV is not implemented, traps functionality that is 

permitted at EL2 and would be UNDEFINED at EL] if this field was 0, when EL2 is enabled in the 

current Security state. This applies to the following operations: 

° EL1 accesses to Special-purpose registers that are not UNDEFINED at EL2. 

$ EL1 accesses to System registers that are not UNDEFINED at EL2. 

. Execution of EL1 or EL2 translation regime address translation and TLB maintenance 

instructions for EL2 and above. 

Qbd When this bit is set to 0, HCR_EL2.NV2 == 0 for all purposes other than reading this 
register. This control does not cause any instructions to be trapped. 

When HCR_EL2.NV2 is 1, no ARMv8.4-NV functionality is implemented. 

Qb1 When HCR_EL2.NV2 is 0, or if ARMv8.4-NV is not implemented, EL1 accesses to the 
specified registers or the execution of the specified instructions are trapped to EL2, 
when EL2 is enabled in the current Security state. EL1 read accesses to the CurrentEL 
register return a value of 0x2. 

When HCR_EL2.NV2 is 1, this control redefines EL1 register accesses so that 
instructions accessing SPSR_EL2, ELR_EL2, ESR_EL2, and FAR_EL2 instead access 
SPSR_EL1, ELR_EL1, ESR_EL1, and FAR ELI respectively. 

When HCR_EL2.NV2 is 0, or if ARMv8.4-NV is not implemented, then: 

° The System or Special-purpose registers for which accesses are trapped and reported using 

EC syndrome value 0x18 are as follows: 

— Registers accessed using MRS or MSR with a name ending in _EL2, except SP_EL2. 

— Registers accessed using MRS or MSR with a name ending in_EL12. 

— Registers accessed using MRS or MSR with a name ending in_EL02. 

— Special-purpose registers SPSR_irq, SPSR_abt, SPSR_und and SPSR_fiq, accessed 
using MRS or MSR. 

— Special-purpose register SP_EL1 accessed using the dedicated MRS or MSR 
instruction. 

. The instructions for which the execution is trapped and reported using EC syndrome value 

0x18 are as follows: 

—  EL2 translation regime Address Translation instructions and TLB maintenance 
instructions. 

— ELl translation regime Address Translation instructions and TLB maintenance 
instructions that are only accessible from EL2 and EL3. 

. The instructions for which the execution is trapped as follows: 

— SMC in an implementation that does not include EL3 and when HCR_EL2.TSC is 1. 
HCR_EL2.TSC bit is not RESO in this case. This is reported using EC syndrome value 
0x17. 

— The ERET, ERETAA, and ERETAB instructions, reported using EC syndrome value 
Ox1A. 
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Note 


The priority of this trap is higher than the priority of the HCR_EL2.API trap. If both of these bits 
are set so that EL1 execution of an ERETAA or ERETAB instruction is trapped to EL2, then the 
syndrome reported is 0x1A. 








This field resets to an architecturally UNKNOWN value. 
When ARMVv8.3-NV is implemented: 


Nested Virtualization. Traps functionality that is permitted at EL2 and would be UNDEFINED at EL1 
if this field was 0, when EL2 is enabled in the current Security state. This applies to the following 


operations: 

° EL1 accesses to Special-purpose registers that are not UNDEFINED at EL2. 

. EL1 accesses to System registers that are not UNDEFINED at EL2. 

$ Execution of EL1 or EL2 translation regime address translation and TLB maintenance 


instructions for EL2 and above. 
The possible values are: 
0b0ð This control does not cause any instructions to be trapped. 


Qb1 ELI accesses to the specified registers or the execution of the specified instructions are 
trapped to EL2, when EL2 is enabled in the current Security state. EL1 read accesses to 
the CurrentEL register return a value of 0x2. 


The System or Special-purpose registers for which accesses are trapped and reported using EC 
syndrome value 0x18 are as follows: 


° Registers accessed using MRS or MSR with a name ending in _EL2, except SP_EL2. 
è Registers accessed using MRS or MSR with a name ending in _EL12. 
s Registers accessed using MRS or MSR with a name ending in _EL02. 


. Special-purpose registers SPSR_irq, SPSR_abt, SPSR_und and SPSR fiq, accessed using 
MRS or MSR. 


. Special-purpose register SP_EL1 accessed using the dedicated MRS or MSR instruction. 


The instructions for which the execution is trapped and reported using EC syndrome value 0x18 are 


as follows: 
è EL2 translation regime Address Translation instructions and TLB maintenance instructions. 
è EL] translation regime Address Translation instructions and TLB maintenance instructions 


that are only accessible from EL2 and EL3. 


The execution of the ERET, ERETAA, and ERETAB instructions are trapped and reported using EC 
syndrome value 0x1A 


Note 


The priority of this trap is higher than the priority of the HCR_EL2.API trap. If both of these bits 
are set so that EL1 execution of an ERETAA or ERETAB instruction is trapped to EL2, then the 
syndrome reported is @x1A. 





The execution of the SMC instructions in an implementation that does not include EL3 and when 
HCR_EL2.TSC is 1 are trapped and reported using EC syndrome value 0x17. HCR_EL2.TSC bit is 
not RESO in this case. 


This bit is permitted to be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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API, bit [41] 
When ARMV8.3-PAuth is implemented: 
Controls the use of instructions related to Pointer Authentication: 


$ In ELO, when HCR_EL2.TGE==0 or HCR_EL2.E2H==0, and the associated 
SCTLR_EL1.En<N><M>==1. 


a In EL1, the associated SCTLR_EL1.En<N><M>==1. 


Traps are reported using EC syndrome value 0x09. The Pointer Authentication instructions trapped 
are: 


` AUTDA, AUTDB, AUTDZA, AUTDZB, AUTIA, AUTIA1716, AUTIASP, AUTIAZ, 
AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZA, AUTIZB. 


$ PACGA, PACDA, PACDB, PACDZA, PACDZB, PACIA, PACIA1716, PACIASP, PACIAZ, 
PACIB, PACIB1716, PACIBSP, PACIBZ, PACIZA, PACIZB. 


: RETAA, RETAB, BRAA, BRAB, BLRAA, BLRAB, BRAAZ, BRABZ, BLRAAZ, 
BLRABZ. 


e ERETAA, ERETAB, LDRAA and LDRAB. 


Qbd The instructions related to Pointer Authentication are trapped to EL2, when EL2 is 
enabled in the current Security state and the instructions are enabled for the EL1&0 
translation regime, from: 


a ELO when HCR_EL2.TGE==0 or HCR_EL2.E2H==0. 


š EL1. 


IfHCR_EL2.NV is 1, the HCR_EL2.NV trap takes precedence over the HCR_EL2.API 
trap for the ERETAA and ERETAB instructions. 


Qb1 This control does not cause any instructions to be trapped. 


If ARMv8.3-PAuth is implemented but EL2 is not implemented or disabled in the current Security 
state, the system behaves as if this bit is 1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


APK, bit [40] 
When ARMv8.3-PAuth is implemented: 


Trap registers holding "key" values for Pointer Authentication. Traps accesses to the following 
registers from EL1 to EL2, when EL2 is enabled in the current Security state, reported using EC 
syndrome value 0x18: 


e APIAKeyLo_EL1, APIAKeyHi_EL1, APIBKeyLo_EL1, APIBKeyHi_EL1, 
APDAKeyLo_EL1, APDAKeyHi_EL1, APDBKeyLo_EL1, APDBKeyHi_ ELI, 
APGAKeyLo_EL1, and APGAKeyHi_ ELI. 


0b0 Access to the registers holding "key" values for pointer authentication from EL1 are 
trapped to EL2, when EL2 is enabled in the current Security state. 
Qb1 This control does not cause any instructions to be trapped. 
Note 





If ARMv8.3-PAuth is implemented but EL2 is not implemented or is disabled in the current Security 
state, the system behaves as if this bit is 1. 





This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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Bit [39] 


Reserved, RESO. 


MIOCNCE, bit [38] 


TEA, bit [37] 


Mismatched Inner/Outer Cacheable Non-Coherency Enable, for the EL1&0 translation regimes. 


Qbd For the EL1&0 translation regimes, for permitted accesses to a memory location that use 
a common definition of the Shareability and Cacheability of the location, there must be 
no loss of coherency if the Inner Cacheability attribute for those accesses differs from 
the Outer Cacheability attribute. 


Qb1 For the EL1&0 translation regimes, for permitted accesses to a memory location that use 
acommon definition of the Shareability and Cacheability of the location, there might be 
a loss of coherency if the Inner Cacheability attribute for those accesses differs from the 
Outer Cacheability attribute. 


For more information see Mismatched memory attributes on page B2-153. 
This field can be implemented as RAZ/WI. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE 
ignores the value of this field for all purposes other than a direct read of this field. 


This field resets to an architecturally UNKNOWN value. 


Route synchronous External abort exceptions to EL2. If the RAS Extension is implemented, the 
possible values of this bit are: 


Qbe This control does not cause exceptions to be routed from ELO and EL1 to EL2. 


Qb1 Route synchronous External abort exceptions from ELO and EL1 to EL2, when EL2 is 
enabled in the current Security state, if not routed to EL3. 


When the RAS Extension is not implemented, this field is RESO. 
This field resets to an architecturally UNKNOWN value. 


TERR, bit [36] 
When RAS is implemented: 


Trap Error record accesses. Trap accesses to the RAS error registers from EL1 to EL2 as follows: 
° If EL1 is using AArch64 state, accesses to the following registers are trapped to EL2, 
reported using EC syndrome value 0x18: 


—  ERRIDR_EL1, ERRSELR EL1, ERXADDR EL1, ERXCTLR_EL1, ERXFR ELI, 
ERXMISCO_EL1, ERXMISC1_EL1, and ERXSTATUS_EL1. 


— When ARMV8.4-RAS is implemented, ERXMISC2_EL1, and ERXMISC3_EL1. 


° If EL1 is using AArch32 state, MCR or MRC accesses are trapped to EL2, reported using EC 
syndrome value 0x03, MCRR or MRRC accesses are trapped to EL2, reported using EC 
syndrome value 0x04: 


—  ERRIDR, ERRSELR, ERXADDR, ERXADDR2, ERXCTLR, ERXCTLR2, ERXFR, 
ERXFR2, ERXMISCO, ERXMISC1, ERXMISC2, ERXMISC3, and ERXSTATUS. 


— When ARMV8.4-RAS is implemented, ERXMISC4, ERXMISCS, ERXMISC6, and 


ERXMISC7. 
0bd This control does not cause any instructions to be trapped. 
Qb1 Accesses to the specified registers from EL1 generate a Trap exception to EL2, when 


EL2 is enabled in the current Security state. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 
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TLOR, bit [35] 
When ARMv8.1-LOR is implemented: 


Trap LOR registers. Traps accesses to the LORSA_EL1, LOREA EL1,LORN_EL1, LORC_ ELI, 
and LORID EL! registers from EL1 to EL2, when EL2 is enabled in the current Security state. 


0bd This control does not cause any instructions to be trapped. 


Qb1 ELI accesses to the LOR registers are trapped to EL2, when EL2 is enabled in the 
current Security state. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


E2H, bit [34] 
When ARMv8.1-VHE is implemented: 


EL2 Host. Enables a configuration where a Host Operating System is running in EL2, and the Host 
Operating System's applications are running in ELO. 


Qbd The facilities to support a Host Operating System at EL2 are disabled. 
Qb1 The facilities to support a Host Operating System at EL2 are enabled. 
For information on the behavior of this bit see Behavior of HCR_EL2.E2H on page D5-2609. 
This bit is permitted to be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


ID, bit [33] 


Stage 2 Instruction access cacheability disable. For the EL1&0 translation regime, when EL2 is 
enabled in the current Security state and HCR_EL2.VM==1, this control forces all stage 2 
translations for instruction accesses to Normal memory to be Non-cacheable. 


Qbd This control has no effect on stage 2 of the EL1&0 translation regime. 


Qb1 Forces all stage 2 translations for instruction accesses to Normal memory to be 
Non-cacheable. 


This bit has no effect on the EL2, EL2&0, or EL3 translation regimes. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE 
ignores the value of this field for all purposes other than a direct read of this field. 


This field resets to an architecturally UNKNOWN value. 


CD, bit [32] 


Stage 2 Data access cacheability disable. For the EL1&0 translation regime, when EL2 is enabled 
in the current Security state and HCR_EL2.VM==1, this control forces all stage 2 translations for 
data accesses and translation table walks to Normal memory to be Non-cacheable. 


Qbd This control has no effect on stage 2 of the EL1&0 translation regime for data accesses 
and translation table walks. 


Qb1 Forces all stage 2 translations for data accesses and translation table walks to Normal 
memory to be Non-cacheable. 


This bit has no effect on the EL2, EL2&0, or EL3 translation regimes. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE 
ignores the value of this field for all purposes other than a direct read of this field. 


This field resets to an architecturally UNKNOWN value. 
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RW, bit [31] 


Execution state control for lower Exception levels: 
0b0 Lower levels are all AArch32. 


Qb1 The Execution state for EL1 is AArch64. The Execution state for ELO is determined by 
the current value of PSTATE.nRW when executing at ELO. 


If AArch32 state is not supported by the implementation at EL1, then this bit is RAO/WI. 


In an implementation that includes EL3, when EL2 is not enabled in Secure state, the PE behaves 
as if this bit has the same value as the SCR_EL3.RW bit for all purposes other than a direct read or 
write access of HCR_EL2. 


The RW bit is permitted to be cached in a TLB. 


When ARMvV8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 1 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


TRVM, bit [30] 


HCD, bit [29] 


Trap Reads of Virtual Memory controls. Traps EL1 reads of the virtual memory control registers to 
EL2, when EL2 is enabled in the current Security state, from both Execution states as follows: 


G If EL1 is using AArch64 state, the following registers are trapped to EL2 and reported using 
EC syndrome value 0x18. 


— SCTLR EL1, TTBRO_ EL], TTBR1 ELI, TCR ELI, ESR. ELI, FAR ELI, 
AFSRO_EL1, AFSR1_EL1, MAIR EL1, AMAIR EL1, CONTEXTIDR ELI. 


e If EL1 is using AArch32 state, accesses using MRC to the following registers are trapped to 
EL2 and reported using EC syndrome value 0x03, accesses using MRRC are trapped to EL2 
and reported using EC syndrome value 0x04: 


— SCTLR, TTBRO, TTBR1, TTBCR, TTBCR2, DACR, DFSR, IFSR, DFAR, IFAR, 
ADFSR, AIFSR, PRRR, NMRR, MAIRO, MAIR1, AMATIRO, AMAIR1, 


CONTEXTIDR. 
0bd This control does not cause any instructions to be trapped. 
0b1 ELI read accesses to the specified Virtual Memory controls are trapped to EL2, when 


EL2 is enabled in the current Security state. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


— Note 


EL2 provides a second stage of address translation, that a hypervisor can use to remap the address 
map defined by a Guest OS. In addition, a hypervisor can trap attempts by a Guest OS to write to 
the registers that control the memory system. A hypervisor might use this trap as part of its 
virtualization of memory management. 





This field resets to an architecturally UNKNOWN value. 


HVC instruction disable. Disables EL1 execution of HVC instructions, from both Execution states, 
when EL2 is enabled in the current Security state, reported using EC syndrome value 0x00. 


b0 HVC instruction execution is enabled at EL2 and EL1. 


Qb1 HVC instructions are UNDEFINED at EL2 and EL1. Any resulting exception is taken to 
the Exception level at which the HVC instruction is executed. 


Note 
HVC instructions are always UNDEFINED at ELO. 








This bit is only implemented if EL3 is not implemented. Otherwise, it is RESO. 
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This field resets to an architecturally UNKNOWN value. 


Trap DC ZVA instructions. Traps ELO and EL1 execution of DC ZVA instructions to EL2, when 
EL2 is enabled in the current Security state, from AArch64 state only, reported using EC syndrome 


value 0x18. 


If ARMv8.5-MemTag is implemented, this trap also applies to DC GVA and DC GZVA. 


Obed 
Qb1 


This control does not cause any instructions to be trapped. 


In AArch64 state, any attempt to execute an instruction this trap applies to at EL1, or at 
ELO when the instruction is not UNDEFINED at ELO, is trapped to EL2 when EL2 is 
enabled in the current Security state. 

Reading the DCZID_ELO returns a value that indicates that the instructions this trap 
applies to are not supported. 


When ARMV8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


Trap General Exceptions, from ELO. 


Ob 
Qb1 


This control has no effect on execution at ELO. 

When EL2 is not enabled in the current Security state, this control has no effect on 
execution at ELO. 

When EL2 is enabled in the current Security state, in all cases: 


s All exceptions that would be routed to EL1 are routed to EL2. 


a The SCTLR_EL1.M field, or the SCTLR.M field if EL1 is using AArch32, is 
treated as being 0 for all purposes other than returning the result of a direct read 
of SCTLR_EL1 or SCTLR. 


° All virtual interrupts are disabled. 

. Any IMPLEMENTATION DEFINED mechanisms for signaling virtual interrupts are 
disabled. 

s An exception return to EL] is treated as an illegal exception return. 


- The MDCR_EL2.{TDRA, TDOSA, TDA, TDE} fields are treated as being 1 for 
all purposes other than returning the result of a direct read of MDCR_EL2. 


In addition, when EL2 is enabled in the current Security state, if: 


: HCR_EL2.E2H is 0, the Effective values of the HCR_EL2.{FMO, IMO, AMO} 
fields are 1. 


s HCR_EL2.E2H is 1, the Effective values of the HCR_EL2.{FMO, IMO, AMO} 
fields are 0. 


For further information on the behavior of this bit when E2H is 1, see Behavior of 
HCR_EL2.E2H on page D5-2609. 


HCR_EL2.TGE must not be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 


Trap Virtual Memory controls. Traps EL1 writes to the virtual memory control registers to EL2, 


when EL2 is enabled in the current Security state, from both Execution states as follows: 


If EL1 is using AArch64 state, the following registers are trapped to EL2 and reported using 
EC syndrome value 0x18: 


SCTLR ELI, TTBRO ELI, TTBR1 ELI, TCR ELI, ESR ELI, FAR. ELI, 
AFSRO_EL1, AFSR1_EL1, MAIR ELI, AMAIR EL1,CONTEXTIDR ELI. 
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° If EL1 is using AArch32 state, accesses using MCR to the following registers are trapped to 
EL2 and reported using EC syndrome value 0x03, accesses using MCRR are trapped to EL2 
and reported using EC syndrome value 0x04: 


—  SCTLR, TTBRO, TTBR1, TTBCR, TTBCR2, DACR, DFSR, IFSR, DFAR, IFAR, 
ADFSR, AIFSR, PRRR, NMRR, MAIRO, MAIR1, AMATRO, AMAIR1, 


CONTEXTIDR. 
0bd This control does not cause any instructions to be trapped. 
Qb1 EL1 write accesses to the specified EL1 virtual memory control registers are trapped to 


EL2, when EL2 is enabled in the current Security state. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 


TTLB, bit [25] 
When ARMV8.4-TLBI is implemented: 


Trap TLB maintenance instructions. Traps EL1 execution of TLB maintenance instructions to EL2, 
when EL2 is enabled in the current Security state, from both Execution states as follows: 


° When EL! is using AArch64 state, the following instructions are trapped to EL2 and reported 
using EC syndrome value 0x18: 


— TLBI VMALLE!, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1, TLBI VALE1, TLBI 
VAALEL. 


— TLBI VMALLE!IS, TLBI VAEIIS, TLBI ASIDE1IS, TLBI VAAE1IS, TLBI 
VALEIIS, TLBI VAALEIIS. 


—  TLBI VMALLE1OS, TLBI VAEIOS, TLBI ASIDE1OS, TLBI VAAE1OS, TLBI 
VALEIOS, TLBI VAALE10S. 


—  TLBIRVAE1, TLBI RVAAE1, TLBI RVALE1, TLBI RVAALE1. 
—  TLBIRVAEIIS, TLBI RVAAELS, TLBI RVALEIS, TLBI RVAALELS. 
—  TLBIRVAEIOS, TLBI RVAAE10S, TLBI RVALE1OS, TLBI RVAALEIOS. 


° When EL! is using AArch32 state, the following instructions are trapped to EL2 and reported 
using EC syndrome value 0x03: 


— TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, TLBIMVALIS, 
TLBIMVAALIS. 


—  TLBIALL, TLBIMVA, TLBIASID, TLBIMVAA, TLBIMVAL, TLBIMVAAL 
—  ITLBIALL, ITLBIMVA, ITLBIASID. 
—  DTLBIALL, DTLBIMVA, DTLBIASID. 

0bd This control does not cause any instructions to be trapped. 


Qb1 ELI execution of the specified TLB maintenance instructions are trapped to EL2, when 
EL2 is enabled in the current Security state. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


Note 
The TLB maintenance instructions are UNDEFINED at ELO. 








This field resets to an architecturally UNKNOWN value. 
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Otherwise: 


Trap TLB maintenance instructions. Traps EL1 execution of TLB maintenance instructions to EL2, 
when EL2 is enabled in the current Security state, from both Execution states. This applies to the 
following instructions: 


è When EL! is using AArch64, TLBI VMALLE1IS, TLBI VAE1IS, TLBI ASIDEIIS, TLBI 
VAAELS, TLBI VALEUS, TLBI VAALEIIS, TLBI VMALLE1, TLBI VAE1, TLBI 
ASIDE1, TLBI VAAE1, TLBI VALE], TLBI VAALE1. 


$ When EL! is using AArch32, TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, 
TLBIMVALIS, TLBIMVAALIS, ITLBIALL, ITLBIMVA, ITLBIASID, DTLBIALL, 
DTLBIMVA, DTLBIASID, TLBIALL, TLBIMVA, TLBIASID, TLBIMVAA, TLBIMVAL, 


TLBIMVAAL 
ObO This control does not cause any instructions to be trapped. 
Qb1 ELI execution of the specified TLB maintenance instructions are trapped to EL2, when 


EL2 is enabled in the current Security state. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 


TPU, bit [24] 


Trap cache maintenance instructions that operate to the Point of Unification. Traps execution of 
those cache maintenance instructions at EL1 or ELO using AArch64, and at EL1 using AArch32, to 
EL2 when EL2 is enabled in the current Security state as follows: 


è If ELO is using AArch64 state and the value of SCTLR_EL1.UCI is not 0, the following 
instructions are trapped to EL2 and reported with EC syndrome value 0x18: 


— IC IVAU, DC CVAU. If the value of SCTLR_EL1.UCI is 0 these instructions are 
UNDEFINED at ELO and any resulting exception is higher priority than this trap to EL2. 


° If EL1 is using AArch64 state, the following instructions are trapped to EL2 and reported 
with EC syndrome value 0x18: 


— IC IVAU, IC IALLU, IC IALLUIS, DC CVAU. 


° If EL1 is using AArch32 state, the following instructions are trapped to EL2 and reported 
with EC syndrome value 0x18: 


—  ICIMVAU, ICIALLU, ICIALLUIS, DCCMVAU. 


Note 


An exception generated because an instruction is UNDEFINED at ELO is higher priority than this trap 
to EL2. In addition: 


$ IC IALLUIS and IC IALLU are always UNDEFINED at ELO using AArch64. 
a ICIMVAU, ICIALLU, ICIALLUIS, and DCCMVAU are always UNDEFINED at ELO using 








AArch32. 
0b0 This control does not cause any instructions to be trapped. 
Qb1 Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the 


current Security state. 


If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean by VA to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED 
whether the execution of any instruction cache invalidate to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 
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TPCP, bit [23] 


When ARMV8.2-DCPoP is implemented: 


Trap data or unified cache maintenance instructions that operate to the Point of Coherency or 
Persistence. Traps execution of those cache maintenance instructions at EL1 or ELO using AArch64, 
and at EL1 using AArch32, to EL2 when EL2 is enabled in the current Security state as follows: 


s If ELO is using AArch64 state and the value of SCTLR_EL1.UCI is not 0, the following 
instructions are trapped to EL2 and reported using EC syndrome value 0x18: 


—  DCCIVAC, DC CVAC, DC CVAP. If the value of SCTLR_EL1.UCI is 0 these 
instructions are UNDEFINED at ELO and any resulting exception is higher priority than 
this trap to EL2. 


° If EL1 is using AArch64 state, the following instructions are trapped to EL2 and reported 
using EC syndrome value 0x18: 


—  DCIVAC, DC CIVAC, DC CVAC, DC CVAP. 


° If EL1 is using AArch32 state, the following instructions are trapped to EL2 and reported 
using EC syndrome value 0x03: 


—  DCIMVAC, DCCIMVAC, DCCMVAC. 
If ARMv8.2-DCCVADP is implemented, this trap also applies to DC CVADP. 


If ARMv8.5-MemTag is implemented, this trap also applies to DC CIGVAC, DC CIGDVAC, DC 
IGVAC, DC IGDVAC, DC CGVAC, DC CGDVAC, DC CGVAP and DC CGDVAP. 


If ARMv8.2-DCCVADP and ARMv8.5-MemTag are implemented, this trap also applies to DC 
CGVADP and DC CGDVADP. 
Note 


: An exception generated because an instruction is UNDEFINED at ELO is higher priority than 
this trap to EL2. In addition: 





— AArch64 instructions which invalidate by VA to the Point of Coherency are always 
UNDEFINED at ELO using AArch64. 


—  DCIMVAC, DCCIMVAC, and DCCMVAC are always UNDEFINED at ELO using 
AArch32. 


° In Armv8.0 and Armv8.1, this field is named TPC. From Armv8.2 it is named TPCP. 





0bd This control does not cause any instructions to be trapped. 


Qb1 Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the 
current Security state. 


If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean, invalidate, or clean and invalidate instruction that 
operates by VA to the point of coherency can be trapped when the value of this control is 1. 


If HCR_EL2.{E2H, TGE} is set to {1, 1}, this field behaves as 0 for all purposes other than a direct 
read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Trap data or unified cache maintenance instructions that operate to the Point of Coherency. Traps 
execution of those cache maintenance instructions at EL1 or ELO using AArch64, and at EL1 using 
AArch32, to EL2 when EL2 is enabled in the current Security state as follows: 


. If ELO is using AArch64 state and the value of SCTLR_EL1.UCI is not 0, accesses to the 
following registers are trapped and reported using EC syndrome value 0x18: 


—  DCCIVAC, DC CVAC. However, if the value of SCTLR_EL1.UCI is 0 these 
instructions are UNDEFINED at ELO and any resulting exception is higher priority than 
this trap to EL2. 


e If EL1 is using AArch64 state, accesses to DC IVAC, DC CIVAC, DC CVAC are trapped and 
reported using EC syndrome value 0x18. 
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. When EL1 is using AArch32, accesses to DCIMVAC, DCCIMVAC, and DCCMVAC are 
trapped and reported using EC syndrome value 0x03. 


Note 


s An exception generated because an instruction is UNDEFINED at ELO is higher priority than 
this trap to EL2. In addition: 





— AArch64 instructions which invalidate by VA to the Point of Coherency are always 
UNDEFINED at ELO using AArch64. 


—  DCIMVAC, DCCIMVAC, and DCCMVAC are always UNDEFINED at ELO using 
AArch32. 


. In Armv8.0 and Armv8.1, this field is named TPC. From Armv8.2 it is named TPCP. 





0bd This control does not cause any instructions to be trapped. 


Qb1 Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the 
current Security state. 


If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean, invalidate, or clean and invalidate instruction that 
operates by VA to the point of coherency can be trapped when the value of this control is 1. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 
TSW, bit [22] 


Trap data or unified cache maintenance instructions that operate by Set/Way. Traps execution of 
those cache maintenance instructions at EL1 using AArch64, and at EL1 using AArch32, to EL2 
when EL2 is enabled in the current Security state as follows: 


. If EL1 is using AArch64 state, accesses to DC ISW, DC CSW, DC CISW are trapped to EL2, 
reported using EC syndrome value 0x18. 


. If EL1 is using AArch32 state, accesses to DCISW, DCCSW, DCCISW are trapped to EL2, 
reported using EC syndrome value 0x03. 


If ARMv8.5-MemTag is implemented, this trap also applies to DC IGSW, DC IGDSW, DC CGSW, 
DC CGDSW, DC CIGSW, and DC CIGDSW. 





Note 


An exception generated because an instruction is UNDEFINED at ELO is higher priority than this trap 
to EL2, and these instructions are always UNDEFINED at ELO. 





0bd This control does not cause any instructions to be trapped. 


Qb1 Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the 
current Security state. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 


TACR, bit [21] 
Trap Auxiliary Control Registers. Traps EL1 accesses to the Auxiliary Control Registers to EL2, 
when EL2 is enabled in the current Security state, from both Execution states as follows: 


s If EL1 is using AArch64 state, accesses to ACTLR_EL1 to EL2, are trapped to EL2 and 
reported using EC syndrome value 0x18. 


° If EL1 is using AArch32 state, accesses to ACTLR and, if implemented, ACTLR2 are 
trapped to EL2 and reported using EC syndrome value 0x03. 


0b0ð This control does not cause any instructions to be trapped. 
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Qb1 ELI accesses to the specified registers are trapped to EL2, when EL2 is enabled in the 
current Security state. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 

Note 

ACTLR_EL1, ACTLR, and ACTLR2 are not accessible at ELO. 





The Auxiliary Control Registers are IMPLEMENTATION DEFINED registers that might implement 
global control bits for the PE. 





This field resets to an architecturally UNKNOWN value. 


TIDCP, bit [20] 


TSC, bit [19] 


Trap IMPLEMENTATION DEFINED functionality. Traps EL1 accesses to the encodings reserved for 
IMPLEMENTATION DEFINED functionality to EL2, when EL2 is enabled in the current Security state 
as follows: 


. In AArch64 state, access to any of the encodings in the following reserved encoding spaces 
are trapped and reported using EC syndrome 0x18: 


— IMPLEMENTATION DEFINED System instructions, which are accessed using SYS and 
SYSL, with CRn = {11, 15}. 


— IMPLEMENTATION DEFINED System registers, which are accessed using MRS and MSR 
with the S3_<op1>_<Cn>_<Cm>_<op2> register name. 





° In AArch32 state, MCR and MRC access to instructions with the following encodings are 
trapped and reported using EC syndrome 0x03: 


— All coproc==p15, CRn==c9, opc 1 == {0-7}, CRm == {c0-c2, c5-c8}, opc2 == {0-7}. 
— All coproc==p15, CRn==c10, opel =={0-7}, CRm == {c0, cl, c4, c8}, opc2 == 
{0-7}. 
— All coproc==p15, CRn==c11, opcl=={0-7}, CRm == {c0-c8, c15}, opc2 == {0-7}. 
When the value of HCR_EL2.TIDCP is 1, it is IMPLEMENTATION DEFINED whether any of this 


functionality accessed from ELO is trapped to EL2. If itis not, then it is UNDEFINED, and any attempt 
to access it from ELO generates an exception that is taken to EL1. 


0bd This control does not cause any instructions to be trapped. 

Qb1 ELI accesses to or execution of the specified encodings reserved for IMPLEMENTATION 
DEFINED functionality are trapped to EL2, when EL2 is enabled in the current Security 
state. 


An implementation can also include IMPLEMENTATION DEFINED registers that provide additional 
controls, to give finer-grained control of the trapping of IMPLEMENTATION DEFINED features. 





Note 


Arm expects the trapping of ELO accesses to these functions to EL2 to be unusual, and used only 
when the hypervisor is virtualizing ELO operation. Arm strongly recommends that unless the 
hypervisor must virtualize ELO operation, an ELO access to any of these functions is UNDEFINED, as 
it would be if the implementation did not include EL2. The PE then takes any resulting exception 
to ELI. 


The trapping of accesses to these registers from EL1 is higher priority than an exception resulting 
from the register access being UNDEFINED. 





This field resets to an architecturally UNKNOWN value. 


Trap SMC instructions. Traps EL1 execution of SMC instructions to EL2, when EL2 is enabled in the 
current Security state, from both Execution states. 
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If execution is in AArch64 state the trap is reported using EC syndrome value 0x17 and if execution 
is in AArch32 state, the trap is reported using EC syndrome value 0x13. 
Note 


HCR_EL2.TSC traps execution of the SMC instruction. It is not a routing control for the SMC 
exception. Trap exceptions and SMC exceptions have different preferred return addresses. 








0bd This control does not cause any instructions to be trapped. 


Qb1 If EL3 is implemented, then any attempt to execute an SMC instruction at EL1 using 
AArch64 or EL1 using AArch32 is trapped to EL2, when EL2 is enabled in the current 
Security state, regardless of the value of SCR_EL3.SMD. 
IfEL3 is not implemented, ARMv8.3-NV is implemented, and HCR_EL2.NV is 1, then 
any attempt to execute an SMC instruction at EL1 using AArch64 is trapped to EL2, when 
EL2 is enabled in the current Security state. 


In AArch32 state, the Armv8-A architecture permits, but does not require, this trap to apply to 
conditional SMC instructions that fail their condition code check, in the same way as with traps on 
other conditional instructions. 


SMC instructions are UNDEFINED at ELO. 
If EL3 is not implemented, and HCR_EL2.NV is 0, this bit is RESO. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 


TID3, bit [18] 


Trap ID group 3. Traps EL1 reads of group 3 ID registers to EL2, when EL2 is enabled in the current 
Security state, as follows: 


° In AArch64 state, reads of the following registers are trapped to EL2, reported using EC 
syndrome value 0x18: 


— ID PFRO ELI, ID PFRI EL1,ID DFRO EL1,ID AFRO EL1,ID MMFRO ELI, 
ID_MMFR1_EL1, ID_MMFR2_EL1, ID_MMFR3_EL1, ID_ISARO0 ELI, 
ID_ISAR1_EL1, ID_ISAR2_EL1, ID_ISAR3_EL1, ID ISAR4 ELI, 
ID_ISARS_EL1, ID_ISAR6_EL1, MVFRO_EL1, MVFR1_EL1, MVFR2_ELl1. 


— ID _AA64PFRO EL1,ID_AA64PFR1_EL1,ID_AA64DFRO0 EL1, 
ID_AA64DFR1_EL1, ID AA64ISARO _EL1, ID_AA64ISAR1_EL1, 
ID_AA64MMFRO EL1, ID_AA64MMFR1_EL1, ID AA64MMFR2 ELI, 
ID_AA64AFRO_EL1, ID AA64AFR1_EL1, ID AA64ZFRO_EL1 (where SVE is 
implemented), and ID MMFR4 EL1 


à In AArch64 state, if ID MMFR4 EL] is implemented as RAZ/WI then it is 
IMPLEMENTATION DEFINED whether accesses to ID MMFR4 EL] are trapped to EL2, 
reported using EC syndrome value 0x18. 














° In AArch64 state, it is IMPLEMENTATION DEFINED whether this field traps MRS accesses to 
encodings in the following range that are not already mentioned in this field description, 
reported using EC syndrome value 0x18: 


Op0 == 3, op1 == 0, CRn == c0, CRm == {c2-c7}, op2 == {0-7}. 











s In AArch32 state, MRC access to the following registers are trapped to EL2, reported using 
EC syndrome value 0x03: 


—  ID_PFRO,ID_PFR1,ID_DFRO, ID AFRO, ID MMFRO, ID_MMFR1, ID_MMFR2, 
ID_MMEFR3, ID _ISARO,ID_ISARI,ID ISAR2,ID_ISAR3, ID ISAR4,ID_ISARS, 
MVFRO, MVFR1, MVFR2, and ID MMFR4. 


. In AArch32 state, if ID MMFR4 is implemented as RAZ/WI then it is IMPLEMENTATION 
DEFINED whether accesses to ID MMFR4 are trapped to EL2, reported using EC syndrome 
value 0x03. 
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° In AArch32 state, MRC access to any of the following encodings are also trapped, reported 
using EC syndrome value 0x03: 


— coproc==p15, opcl == 0, CRn == c0, CRm == {c3-c7}, opc2 == {0,1}. 
— coproc==p15, opcl == 0, CRn == c0, CRm == c3, opc2 == 2. 
— coproc==p15, opel == 0, CRn == c0, CRm == c5, opc2 == {4,5}. 
. In AArch32 state, it is IMPLEMENTATION DEFINED whether this bit traps MRC accesses to the 
following encodings, reported using EC syndrome value 0x03: 
—  coproc==p15, opel == 0, CRn == c0, CRm == c2, opc2 == 7. 
—  coproc==p15, opel == 0, CRn == c0, CRm == c3, opc2 == {3-7}. 
—  coproc==p15, opel == 0, CRn == c0, CRm == {c4, c6, c7}, opc2 == {2-7}. 
— coproc==p15, opel == 0, CRn == c0, CRm == c5, opc2 == {2, 3, 6, 7}. 
° In AArch32 state, VMRS access to MVFRO, MVFR1, and MVFR2, reported using EC 
syndrome value 0x08. 
0bd This control does not cause any instructions to be trapped. 


Qb1 The specified EL1 read accesses to ID group 3 registers are trapped to EL2, when EL2 
is enabled in the current Security state. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 


TID2, bit [17] 
Trap ID group 2. Traps the following register accesses to EL2, when EL2 is enabled in the current 
Security state, as follows: 


5 IfEL1 is using AArch64, reads of CTR_EL0, CCSIDR_EL1, CCSIDR2_EL1, CLIDR ELI, 
and CSSELR_EL] are trapped to EL2, reported using EC syndrome value 0x18. 


è If ELO is using AArch64 and the value of SCTLR_EL1.UCT is not 0, reads of CTR_ELO are 
trapped to EL2, reported using EC syndrome value 0x18. If the value of SCTLR_EL1.UCT 
is 0 then ELO reads of CTR_ELO are UNDEFINED and any resulting exception takes 
precedence over this trap. 


° If EL1 is using AArch64, writes to CSSELR_EL1 are trapped to EL2, reported using EC 
syndrome value 0x18. 


. If EL1 is using AArch32, reads of CTR, CCSIDR, CCSIDR2, CLIDR, and CSSELR are 
trapped to EL2, reported using EC syndrome value 0x03. 


° IfEL1 is using AArch32, writes to CSSELR are trapped to EL2, reported using EC syndrome 


value 0x03. 
0b0 This control does not cause any instructions to be trapped. 
Qb1 The specified EL1 and ELO accesses to ID group 2 registers are trapped to EL2, when 


EL2 is enabled in the current Security state. 


When ARMvV8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


TID1, bit [16] 
Trap ID group 1. Traps EL] reads of the following registers to EL2, when EL2 is enabled in the 
current Security state as follows: 


° In AArch64 state, accesses of REVIDR_EL1, AIDR_EL1, reported using EC syndrome 
value 0x18. 


° In AArch32 state, accesses of TCMTR, TLBTR, REVIDR, AIDR, reported using EC 
syndrome value 0x03. 


0b0ð This control does not cause any instructions to be trapped. 
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Qb1 The specified EL1 read accesses to ID group 1 registers are trapped to EL2, when EL2 
is enabled in the current Security state. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 


TIDO, bit [15] 
Trap ID group 0. Traps the following register accesses to EL2: 
° EL1 reads of the JIDR, reported using EC syndrome value 0x05. 


. If the JIDR is RAZ from ELO, ELO reads of the JIDR, reported using EC syndrome value 
0x05. 


. EL1 accesses using VMRS of the FPSID, reported using EC syndrome value 0x08. 


Note 


It is IMPLEMENTATION DEFINED whether the JIDR is RAZ or UNDEFINED at ELO. If it is 
UNDEFINED at ELO then any resulting exception takes precedence over this trap. 


° The FPSID is not accessible at ELO using AArch32. 





e Writes to the FPSID are ignored, and not trapped by this control. 





0b0ð This control does not cause any instructions to be trapped. 


0b1 The specified EL1 read accesses to ID group 0 registers are trapped to EL2, when EL2 
is enabled in the current Security state. 

In an AArch64 only implementation, this bit is RESO. 

When ARMvV8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 

behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


TWE, bit [14] 


Traps ELO and EL1 execution of WFE instructions to EL2, when EL2 is enabled in the current 
Security state, from both Execution states, reported using EC syndrome value 0x01. 


0bd This control does not cause any instructions to be trapped. 


Qb1 Any attempt to execute a WFE instruction at ELO or EL! is trapped to EL2, when EL2 
is enabled in the current Security state, if the instruction would otherwise have caused 
the PE to enter a low-power state and it is not trapped by SCTLR.nTWE or 
SCTLR_EL1.nTWE. 


In AArch32 state, the attempted execution of a conditional WFE instruction is only trapped if the 
instruction passes its condition code check. 


Note 


Since a WFE can complete at any time, even without a Wakeup event, the traps on WFE are not 
guaranteed to be taken, even if the WFE is executed when there is no Wakeup event. The only 
guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, 
the trap will be taken. 








When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


For more information about when WFE instructions can cause the PE to enter a low-power state, 
see Wait for Event mechanism and Send event on page D1-2372. 


This field resets to an architecturally UNKNOWN value. 
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TWI, bit [13] 


DC, bit [12] 


Traps ELO and EL1 execution of WFI instructions to EL2, when EL2 is enabled in the current 
Security state, from both Execution states, reported using EC syndrome value 0x01. 


0bd This control does not cause any instructions to be trapped. 


Qb1 Any attempt to execute a WFI instruction at ELO or EL] is trapped to EL2, when EL2 
is enabled in the current Security state, if the instruction would otherwise have caused 
the PE to enter a low-power state and it is not trapped by SCTLR.nTWI or 
SCTLR_EL1.nTWI. 


In AArch32 state, the attempted execution of a conditional WFI instruction is only trapped if the 
instruction passes its condition code check. 


— Note 


Since a WFI can complete at any time, even without a Wakeup event, the traps on WFI are not 
guaranteed to be taken, even if the WFI is executed when there is no Wakeup event. The only 
guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, 
the trap will be taken. 





When ARMvV8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


For more information about when WFI instructions can cause the PE to enter a low-power state, see 
Wait For Interrupt on page D1-2375. 


This field resets to an architecturally UNKNOWN value. 


Default Cacheability. 
Qbd This control has no effect on the EL1&0 translation regime. 
Qb1 In both Security states: 


s When EL] is using AArch64, the PE behaves as if the value of the 
SCTLR_EL1.M field is 0 for all purposes other than returning the value of a 
direct read of SCTLR_EL1. 


° When EL] is using AArch32, the PE behaves as if the value of the SCTLR.M 
field is 0 for all purposes other than returning the value ofa direct read of SCTLR. 


° The PE behaves as if the value of the HCR_EL2.VM field is 1 for all purposes 
other than returning the value of a direct read of HCR_EL2. 


° The memory type produced by stage 1 of the EL1&0 translation regime is 
Normal Non-Shareable, Inner Write-Back Read-Allocate Write-Allocate, Outer 
Write-Back Read-Allocate Write-Allocate. 


This field has no effect on the EL2, EL2&0, and EL3 translation regimes. 
This field is permitted to be cached in a TLB. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this field. 


This field resets to an architecturally UNKNOWN value. 


BSU, bits [11:10] 


Barrier Shareability upgrade. This field determines the minimum shareability domain that is applied 
to any barrier instruction executed from EL1 or ELO: 


0b00 No effect. 
0b01 Inner Shareable. 
0b10 Outer Shareable. 
0b11 Full system. 
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This value is combined with the specified level of the barrier held in its instruction, using the same 
principles as combining the shareability attributes from two stages of address translation. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0b00 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


EB, bit [9] 


Force broadcast. Causes the following instructions to be broadcast within the Inner Shareable 
domain when executed from EL1: 


AArch32: BPIALL, TLBIALL, TLBIMVA, TLBIASID, DTLBIALL, DTLBIMVA, DTLBIASID, 
ITLBIALL, ITLBIMVA, ITLBIASID, TLBIMVAA, ICIALLU, TLBIMVAL, TLBIMVAAL. 


AArch64: TLBI VMALLE1, TLBI VAE1, TLBI ASIDE1, TLBI VAAE1, TLBI VALE1, TLBI 
VAALE], IC IALLU, TLBI RVAE1, TLBI RVAAE1, TLBI RVALE1, TLBI RVAALE1. 


Obd This field has no effect on the operation of the specified instructions. 


0b1 When one of the specified instruction is executed at EL1, the instruction is broadcast 
within the Inner Shareable shareability domain. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 


VSE, bit [8] 
Virtual SError interrupt. 
Qbd This mechanism is not making a virtual SError interrupt pending. 
Qb1 A virtual SError interrupt is pending because of this mechanism. 
The virtual SError interrupt is only enabled when the value of HCR_EL2.{TGE, AMO} is {0, 1}. 


This field resets to an architecturally UNKNOWN value. 


VI, bit [7] 
Virtual IRQ Interrupt. 
Qbd This mechanism is not making a virtual IRQ pending. 
Qb1 A virtual IRQ is pending because of this mechanism. 
The virtual IRQ is enabled only when the value of HCR_EL2.{TGE, IMO} is {0, 1}. 


This field resets to an architecturally UNKNOWN value. 


VF, bit [6] 
Virtual FIQ Interrupt. 
Qbd This mechanism is not making a virtual FIQ pending. 
Qb1 A virtual FIQ is pending because of this mechanism. 
The virtual FIQ is enabled only when the value of HCR_EL2.{TGE, FMO} is {0, 1}. 
This field resets to an architecturally UNKNOWN value. 


AMO, bit [5] 
Physical SError interrupt routing. 


Ob When executing at Exception levels below EL2, and EL2 is enabled in the current 
Security state: 


a Physical SError interrupts are not taken to EL2. 


7 When the value of HCR_EL2.TGE is 0, if the PE is executing at EL2 using 
AArch64, physical SError interrupts are not taken unless they are routed to EL3 
by the SCR_EL3.EA bit. 


° Virtual SError interrupts are disabled. 
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IMO, bit [4] 


FMO, bit [3] 


Qb1 When executing at any Exception level, and EL2 is enabled in the current Security state: 
g Physical SError interrupts are taken to EL2, unless they are routed to EL3. 
$ When the value of HCR_EL2.TGE is 0, then virtual SError interrupts are 
enabled. 


If EL2 is enabled in the current Security state and the value of HCR_EL2.TGE is 1: 


a Regardless of the value of the AMO bit physical asynchronous External aborts and SError 
interrupts target EL2 unless they are routed to EL3. 


- When ARMv8.1-VHE is not implemented, or if HCR_EL2.E2H is 0, this field behaves as 1 
for all purposes other than a direct read of the value of this bit. 


à When ARMv8.1-VHE is implemented and HCR_EL2.E2H is 1, this field behaves as 0 for 
all purposes other than a direct read of the value of this bit. 


For more information, see Asynchronous exception routing on page D1-2317. 


This field resets to an architecturally UNKNOWN value. 


Physical IRQ Routing. 


Ob When executing at Exception levels below EL2, and EL2 is enabled in the current 
Security state: 


s Physical IRQ interrupts are not taken to EL2. 


a When the value of HCR_EL2.TGE is 0, if the PE is executing at EL2 using 
AArch64, physical IRQ interrupts are not taken unless they are routed to EL3 by 
the SCR_EL3.IRQ bit. 


° Virtual IRQ interrupts are disabled. 
Qb1 When executing at any Exception level, and EL2 is enabled in the current Security state: 
s Physical IRQ interrupts are taken to EL2, unless they are routed to EL3. 
° When the value of HCR_EL2.TGE is 0, then Virtual IRQ interrupts are enabled. 
If EL2 is enabled in the current Security state, and the value of HCR_EL2.TGE is 1: 


s Regardless of the value of the IMO bit, physical IRQ Interrupts target EL2 unless they are 
routed to EL3. 


: When ARMv8.1-VHE is not implemented, or if HCR_EL2.E2H is 0, this field behaves as 1 
for all purposes other than a direct read of the value of this bit. 


à When ARMv8.1-VHE is implemented and HCR_EL2.E2H is 1, this field behaves as 0 for 
all purposes other than a direct read of the value of this bit. 


For more information, see Asynchronous exception routing on page D1-2317. 


This field resets to an architecturally UNKNOWN value. 


Physical FIQ Routing. 


Qbd When executing at Exception levels below EL2, and EL2 is enabled in the current 
Security state: 


s Physical FIQ interrupts are not taken to EL2. 


š When the value of HCR_EL2.TGE is 0, if the PE is executing at EL2 using 
AArch64, physical FIQ interrupts are not taken unless they are routed to EL3 by 
the SCR_EL3.FIQ bit. 


° Virtual FIQ interrupts are disabled. 

Qb1 When executing at any Exception level, and EL2 is enabled in the current Security state: 
. Physical FIQ interrupts are taken to EL2, unless they are routed to EL3. 
s When HCR_EL2.TGE is 0, then Virtual FIQ interrupts are enabled. 
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If EL2 is enabled in the current Security state and the value of HCR_EL2.TGE is 1: 


è Regardless of the value of the FMO bit, physical FIQ Interrupts target EL2 unless they are 
routed to EL3. 


$ When ARMv8.1-VHE is not implemented, or if HCR_EL2.E2H is 0, this field behaves as 1 
for all purposes other than a direct read of the value of this bit. 


è When ARMv8.1-VHE is implemented and HCR_EL2.E2H is 1, this field behaves as 0 for 
all purposes other than a direct read of the value of this bit. 


For more information, see Asynchronous exception routing on page D1-2317. 


This field resets to an architecturally UNKNOWN value. 


PTW, bit [2] 


Protected Table Walk. In the EL1&0 translation regime, a translation table access made as part of a 
stage | translation table walk is subject to a stage 2 translation. The combining of the memory type 
attributes from the two stages of translation means the access might be made to a type of Device 
memory. If this occurs, then the value of this bit determines the behavior: 


Ob The translation table walk occurs as if it is to Normal Non-cacheable memory. This 
means it can be made speculatively. 


Qb1 The memory access generates a stage 2 Permission fault. 
This field is permitted to be cached in a TLB. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 
SWIO, bit [1] 


Set/Way Invalidation Override. Causes EL1 execution of the data cache invalidate by set/way 
instructions to perform a data cache clean and invalidate by set/way: 


Qbd This control has no effect on the operation of data cache invalidate by set/way 
instructions. 

Qb1 Data cache invalidate by set/way instructions perform a data cache clean and invalidate 
by set/way. 


When the value of this bit is 1: 

AArch32: DCISW performs the same invalidation as a DCCISW instruction. 
AArch64: DC ISW performs the same invalidation as a DC CISW instruction. 
This bit can be implemented as RES1. 


When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct 
read of this field. 


This field resets to an architecturally UNKNOWN value. 


VM, bit [0] 


Virtualization enable. Enables stage 2 address translation for the EL1&0 translation regime, when 
EL2 is enabled in the current Security state. 


Qbo EL1&0 stage 2 address translation disabled. 
Qb1 EL1&0 stage 2 address translation enabled. 


When the value of this bit is 1, data cache invalidate instructions executed at EL1 perform a data 
cache clean and invalidate. For the invalidate by set/way instruction this behavior applies regardless 
of the value of the HCR_EL2.SWIO bit. 


This bit is permitted to be cached in a TLB. 


When ARMvVv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 
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D13-3082 


Accessing the HCR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, HCR_EL2 


op0 op1 CRn CRm op2 





Ob11 0b100 0b0001 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x078] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HCR_EL2; 
elsif PSTATE.EL == EL3 then 
return HCR_EL2; 


MSR HCR_EL2, <Xt> 





op0 op1 CRn CRm op2 





Ob11 0b100 0b0001 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x078] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HCR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
HCR_EL2 = X[t]; 
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D13.2.47  HPFAR_EL2, Hypervisor IPA Fault Address Register 
The HPFAR_EL2 characteristics are: 


Purpose 


Holds the faulting IPA for some aborts on a stage 2 translation taken to EL2. 


Configurations 


AArch64 System register HPFAR_EL2[31:0] is architecturally mapped to AArch32 System register 
HPFAR[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HPFAR_EL2 is a 64-bit register. 


Field descriptions 


The HPFAR_EL2 bit assignments are: 


63 62 44 43 40 39 


4 3 0 
RESO FIPA[47:12] | RESO 


FIPA(51:48] ees ca 


Execution at EL1 or ELO makes HPFAR_EL2 become UNKNOWN. 


NS, bit [63] 
When ARMV8.4-SecEL2 is implemented: 
Faulting IPA address space. 
Qbd Faulting IPA is from the Secure IPA space. 
Qb1 Faulting IPA is from the Non-secure IPA space. 
For data or instruction aborts taken to Non-secure EL2, this field is RESO. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
Bits [62:44] 
Reserved, RESO. 
FIPA[51:48], bits [43:40] 
When ARMV%8.2-LPA is implemented: 
Extension to FIPA[47:12]. See FIPA[47:12] for more details. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
FIPA[47:12], bits [39:4] 
Bits [47:12] of the faulting intermediate physical address. 
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Bits [3:0] 


For implementations with fewer than 48 physical address bits, the corresponding upper bits in this 
field are RESO. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use for the stage 1 translation, the FIPA[51:48] bits form the upper part of the address value. For 
implementations or stage | translation granules with fewer than 52 physical address bits the 
FIPA[51:48] bits are RESO. 


The HPFAR_EL2 is written for: 


$ Translation or Access faults in the second stage of translation. 

: An abort in the second stage of translation performed during the translation table walk of a 
first stage translation, caused by a Translation fault, an Access flag fault, or a Permission 
fault. 


° A stage 2 Address size fault. 
Note 


The address held in this register is an address accessed by the instruction fetch or data access that 
caused the exception that gave rise to the instruction or data abort. It is the lowest address that gave 
rise to the fault. Where different faults from different addresses arise from the same instruction, such 
as for an instruction that loads or stores a mis-aligned address that crosses a page boundary, the 
architecture does not prioritize between those different faults. 








For all other exceptions taken to EL2, this register is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Accessing the HPFAR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, HPFAR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0110 0b0000 0b100 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HPFAR_EL2; 
elsif PSTATE.EL == EL3 then 
return HPFAR_EL2; 


D13-3084 
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MSR HPFAR_EL2, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b100 0b0110 0b0000 0b100 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HPFAR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
HPFAR_EL2 = X[t]; 
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D13.2.48 


D13-3086 


HSTR_EL2, Hypervisor System Trap Register 
The HSTR_EL2 characteristics are: 


Purpose 


Controls trapping to EL2 of EL1 or lower AArch32 accesses to the System register in the coproc == 
0b1111 encoding space, by the CRn value used to access the register using MCR or MRC instruction. 
When the register is accessible using an MCRR or MRRC instruction, this is the CRm value used 
to access the register. 


Configurations 


AArch64 System register HSTR_EL2[31:0] is architecturally mapped to AArch32 System register 
HSTR{31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
If no Exception level can use AArch32, then this register is RESO. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HSTR_EL2 is a 64-bit register. 


Field descriptions 


The HSTR_EL2 bit assignments are: 


63 161514131211109 8 76543210 





Bits [63:16] 


Reserved, RESO. 


T<n>, bit [n], for n = 0 to 15 
Fields T14 and T4 are RESO. 


The remaining fields control whether ELO and EL1 accesses, using MCR, MRC, MCRR, and 


MRRC instructions, to the System registers in the coproc == 0b1111 encoding space are trapped to 
EL2 as follows: 


° MCR or MRC accesses to these registers that are trapped to EL2 are reported using EC 
syndrome value 0x03, unless the access is UNDEFINED. 


e MCRR or MRRC accesses to these registers that are trapped to EL2 are reported using EC 
syndrome value 0x04, unless the access is UNDEFINED. 


0b0 This control has no effect on ELO or EL1 accesses to System registers. 


Qb1 Any EL1 MCR or MRC access with coproc == 0b1111 and CRn == <n> is trapped to EL2. 
An ELO MCR or MRC access with these values is trapped to EL2 only if the access is 
not UNDEFINED when the value of this field is 0. 
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Any EL1 MCRR or MRRC access with coproc == 0b1111 and CRm == <n> is trapped to 
EL2. An ELO MCRR or MRRC access with these values is trapped to EL2 only if the 
access is not UNDEFINED when the value of this field is 0. 


It is IMPLEMENTATION DEFINED whether a Non-secure ELO access using AArch32 to 
these registers is trapped to EL2, or is UNDEFINED and generates an exception that is 
taken to Non-secure EL1. If the access is UNDEFINED, and generates an exception that 
is taken to Non-secure EL1 using AArch64, this is reported with EC syndrome value 
0x00. 


Note 


Arm expects that trapping to EL2 of Non-secure ELO accesses to these registers is 
unusual and used only when the hypervisor must virtualize ELO operation. Arm 
recommends that, whenever possible, Non-secure ELO accesses to these registers 
behave as they would if the implementation did not include EL2. This means that, if the 
architecture does not support the Non-secure ELO access, then the register access 
instruction is treated as UNDEFINED and generates an exception that is taken to 
Non-secure EL1. 








For example, when HSTR_EL2.7T7 is 1, for instructions executed at EL1: 
° An MCR or MRC instruction with coproc set to 0b1111 and <CRn> set to c7 is trapped to EL2. 


° An MCRR or MRRC instruction with coproc set to 0b1111 and <CRm> set to c7 is trapped to 
EL2. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


Accessing the HSTR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, HSTR_EL2 


op0 op1 CRn CRm op2 


0b11 0b100 0b0001 0b0001 0b011 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x080] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HSTR_EL2; 
elsif PSTATE.EL == EL3 then 
return HSTR_EL2; 
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D13-3088 


MSR HSTR_EL2, <Xt> 





op0 op1 CRn 


CRm 


op2 


0b11 0b100 0b0001 


0b0001 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x080] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HSTR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
HSTR_EL2 = X[t]; 
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D13.2.49 ID_AA64AFRO_EL1, AArch64 Auxiliary Feature Register 0 


ARM DDI 0487E.a 
ID070919 


The ID_ AA64AFRO_EL]I characteristics are: 


Purpose 
Provides information about the IMPLEMENTATION DEFINED features of the PE in AArch64 state. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ID_AA64AFRO_EL1 is a 64-bit register. 


Field descriptions 


The ID AA64AFRO_ EL! bit assignments are: 


32 31 28 27 24 23 20 19 16 15 12 11 


RESO | IMP DEF | IMP DEF | IMP DEF | IMP DEF | IMP DEF | IMP DEF | IMP DEF | IMP DEF 


Bits [63:32] 
Reserved, RESO. 


IMPLEMENTATION DEFINED, bits [31:28] 


IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [27:24] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [23:20] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [19:16] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [15:12] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [11:8] 


IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [7:4] 


IMPLEMENTATION DEFINED. 

















IMPLEMENTATION DEFINED, bits [3:0] 
IMPLEMENTATION DEFINED. 


Accessing the ID_AA64AFRO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, ID_AA64AFRO_EL1 





op0 op1 CRn CRm 


0b11 0b000 0b0000 0b0101 


op2 


0b100 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AAG4AFRO_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AA64AFRQ_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AA64AFRO_EL1; 
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D13.2.50 ID_AA64AFR1_EL1, AArch64 Auxiliary Feature Register 1 


63 


ARM DDI 0487E.a 
ID070919 


The ID_ AA64AFR1_EL1 characteristics are: 


Purpose 


Reserved for future expansion of information about the IMPLEMENTATION DEFINED features of the 
PE in AArch64 state. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_AA64AFR1_EL1 is a 64-bit register. 


Field descriptions 


The ID AA64AFRI1 EL! bit assignments are: 


RESO 


Bits [63:0] 


Reserved, RESO. 


Accessing the ID_AA64AFR1_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_AA64AFR1_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0101 0b101 





if PSTATE.EL == EL@ then 
if IsFeatureImp]lemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64AFR1_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AA64AFR1_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AA64AFR1_EL1; 
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D13.2.51 ID _AA64DFRO_EL1, AArch64 Debug Feature Register 0 


The ID_AA64DFRO_EL] characteristics are: 


Purpose 
Provides top level information about the debug system in AArch64 state. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 
Configurations 
The external register EDDFR gives information from this register. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ID_AA64DFRO_ EL] is a 64-bit register. 


Field descriptions 


The ID AA64DFRO_ EL! bit assignments are: 


63,44 43 |. 40 39 36 35 |, 32 31 28 27 24 23 2019 161412 11.. 8 7 4 3 0 
[e= TraceFilt |DoubleLock|PMSVer|CTX_CMPs |RES0|WRPs|RES0 cnr TraceVer |DebugVer 


Bits [63:44] 






Reserved, RESO. 


TraceFilt, bits [43:40] 
From ARMv8.4: 
Armv8.4 Self-hosted Trace Extension version. Defined values are: 
0b0000 Armv8.4 Self-hosted Trace Extension not implemented. 
0b0001 Armv8.4 Self-hosted Trace Extension implemented. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


DoubleLock, bits [39:36] 
OS Double Lock implemented. Defined values are: 
0b0000 OS Double Lock implemented. OSDLR_EL1 is RW. 
0b1111 OS Double Lock not implemented. OSDLR_EL1 is RAZ/WI. 
ARMv8.0-DoubleLock implements the functionality identified by the value 0b0000. 


All other values are reserved. 


PMSVer, bits [35:32] 
From ARMvé8.2: 
Statistical Profiling Extension version. Defined values are: 
0b0000 Statistical Profiling Extension not implemented. 
0b0001 Statistical Profiling Extension implemented. 
0b0010 As @b0001 and also includes support for: 
3 The Event packet Alignment flag. 
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s If SVE is implemented, the Scalable Vector extensions to Statistical Profiling. 
ARMv8.0-DoubleLock implements the functionality added by the value 0b0001. 


ARMv8.3-SPE implements the functionality added by the value @b0010. If ARMv8.3-SPE is 
implemented, then ID AA64DFRO_EL1.PMSVer is not permitted to read as 0b0000 or 0b0001. 


All other values are reserved. 
Otherwise: 


Reserved, RESO. 


CTX_CMPs, bits [31:28] 
Number of breakpoints that are context-aware, minus 1. These are the highest numbered 
breakpoints. 

Bits [27:24] 


Reserved, RESO. 


WRPs, bits [23:20] 


Number of watchpoints, minus 1. The value of 0b0000 is reserved. 


Bits [19:16] 


Reserved, RESO. 


BRPs, bits [15:12] 


Number of breakpoints, minus 1. The value of @b0000 is reserved. 


PMUVer, bits [11:8] 
Performance Monitors Extension version. 


This field does not follow the standard ID scheme, but uses the Alternative ID scheme described in 
Alternative ID scheme used for the Performance Monitors Extension version on page D13-2825. 


Defined values are: 

0b0000 Performance Monitors Extension not implemented. 

0b0001 Performance Monitors Extension implemented, PMUv3. 
0b0100 PMUV3 for Armv8.1. As @b0001, and also includes support for: 

: Extended 16-bit PMEVTYPER<n>_EL0.evtCount field. 

. If EL2 is implemented, the MDCR_EL2.HPMD control bit. 
0b0101 PMUV3 for Armv8.4. As 0b0100 and also includes support for the PMMIR_EL! register. 
0b0110 PMUV3 for Armv8.5. As @b0101 and also includes support for: 

$ 64-bit event counters. 

. If EL2 is implemented, the MDCR_EL2.HCCD control bit. 

a If EL3 is implemented, the MDCR_EL3.SCCD control bit. 


Qb1111 IMPLEMENTATION DEFINED form of performance monitors supported, PMUVv3 not 
supported. Arm does not recommend this value in new implementations. 


ARMv8.1-PMU implements the functionality added by the value 0b0100. 
ARMv8.4-PMU implements the functionality added by the value 0b0101. 
ARMv8.5-PMU implements the functionality added by the value 0b0110. 
All other values are reserved. 

From Armv8.1, the value 0b0001 is not permitted. 

From Armv8.4, the value 0b0100 is not permitted. 

From Armvs.5, the value 0b0101 is not permitted. 
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TraceVer, bits [7:4] 


Trace support. Indicates whether System register interface to a PE trace unit is implemented. 
Defined values are: 


0b0000 PE trace unit System registers not implemented. 
0b0001 PE trace unit System registers implemented. 
All other values are reserved. 


A value of 0b0000 only indicates that no System register interface to a PE trace unit is implemented. 
A PE trace unit might nevertheless be implemented without a System register interface. 


See the ETM Architecture Specification for more information. 


DebugVer, bits [3:0] 
Debug architecture version. Indicates presence of Armv8 debug architecture. Defined values are: 
0b0110 Armv8 debug architecture. 
0b0111 Armv8 debug architecture with Virtualization Host Extensions. 
0b1000 Armv8.2 debug architecture 
0b1001 Armv8.4 debug architecture 
All other values are reserved. 
ARMv8.2-Debug adds the functionality indicated by the value 0b1000. 
è: If ARMv8.1-VHE is not implemented the only permitted value is 0b0110. 


. In an Armv8.0 implementation the value 0b1000 is not permitted. 


Accessing the ID_AA64DFRO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_AA64DFRO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0101 0b000 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64DFRO_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AA64DFRO_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AA64DFRO_EL1; 
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D13.2.52  ID_AA64DFR1_EL1, AArch64 Debug Feature Register 1 
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The ID_ AA64DFR1_EL1 characteristics are: 


Purpose 
Reserved for future expansion of top level information about the debug system in AArch64 state. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ID_AA64DFR1_EL1 is a 64-bit register. 


Field descriptions 


The ID AA64DFRI1_ EL! bit assignments are: 


RESO 


Bits [63:0] 


Reserved, RESO. 


Accessing the ID_AA64DFR1_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_AA64DFR1_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0101 0b001 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64DFR1_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AA64DFR1_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AA64DFR1_EL1; 
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D13.2.53 ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute Register 0 


The ID_AA64ISARO EL! characteristics are: 


Purpose 
Provides information about the instructions implemented in AArch64 state. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ID_AA64ISARO_ EL] is a 64-bit register. 


Field descriptions 


The ID AA64ISARO EL]! bit assignments are: 


161512 11,8 7,4 3,0 


63 60 59 56 55 52 51, 48 47 44 43 40 39 36 35 32 31, 28 27, 24 23, 20 19 
RNDRIĮ TLB | TS feul DP | SM4 | SM3 |SHA3| RDM |RES0|Atomic|CRC32|SHA2 sin AE es 


RNDR, bits [63:60] 

From ARMv8.5: 
Indicates support for Random Number instructions in AArch64 state. Defined values are: 
0b0000 No Random Number instructions are implemented. 
0b0001 MRS reading the RNDR and RNDRRS registers are implemented. 
All other values are reserved. 
ARMv8.5-RNG implements the functionality identified by the value 0b0001. 
From Armv8.5, the permitted values are 0b0000 and 0b0001. 

Otherwise: 


Reserved, RESO. 


TLB, bits [59:56] 

From ARMv8.4: 
Indicates support for Outer shareable and TLB range maintenance instructions. Defined values are: 
0b0000 Outer shareable and TLB range maintenance instructions are not implemented. 
0b0001 Outer shareable TLB maintenance instructions are implemented. 
0b0010 Outer shareable and TLB range maintenance instructions are implemented. 
All other values are reserved. 
ARMv8.4-TLBI implements the functionality identified by the values 0b0001 and 0b0010. 
From Armv8.4, the only permitted value is 0b0010. 

Otherwise: 


Reserved, RESO. 
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TS, bits [55:52] 
Indicates support for flag manipulation instructions. Defined values are: 
0b0000 No flag manipulation instructions are implemented. 
0b0001 CFINV, RMIF, SETF16, and SETF8 instructions are implemented. 


0b0010 CFINV, RMIF, SETF16, SETF8, AXFLAG, and XAFLAG instructions are 
implemented. 


All other values are reserved. 

ARMv8.4-CondM implements the functionality identified by the value 0b0001. 
ARMv8.5-CondM implements the functionality identified by the value 0b0010. 
From Armv8.4, the only permitted value is 0b0001. 

From Armvs.5, the only permitted value is 0b0010. 


FHM, bits [51:48] 

From ARMvé8.2: 
Indicates whether FMLAL and FMLSL instructions are implemented. 
0b0000 FMLAL and FMLSL instructions are not implemented. 
0b0001 FMLAL and FMLSL instructions are implemented. 
All other values are reserved. 
ARMv8.2-FHM implements the functionality identified by the value 0b0001. 
From Armv8.2, the permitted values are 0b0000 and 0b0001. 

Otherwise: 


Reserved, RESO. 


DP, bits [47:44] 

From ARMv8.2: 
Dot Product instructions implemented in AArch64 state. Defined values are: 
0b0000 No Dot Product instructions implemented. 
0b0001 UDOT and SDOT instructions implemented. 
All other values are reserved. 
ARMv8.2-DotProd implements the functionality identified by the value 0b0001. 
From Armv8.2, the permitted values are 0b0000 and 0b0001. 

Otherwise: 


Reserved, RESO. 


SM4, bits [43:40] 
From ARMvé6.2: 
SM4 instructions implemented in AArch64 state. Defined values are: 
0b0000 No SM4 instructions implemented. 
0b0001 SM4E and SM4EKEY instructions implemented. 
All other values are reserved. 
If ARMv8.2-SM is not implemented the value @b0001 is reserved. 
From Armv8.2, the permitted values are 0b0000 and 0b0001. 
This field must have the same value as ID AA64ISARO_EL1.SM3. 
Otherwise: 


Reserved, RESO. 
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SM3, bits [39:36] 
From ARMv8.2: 
SM3 instructions implemented in AArch64 state. Defined values are: 
0b0000 No SM3 instructions implemented. 


0b0001 SM3SS1, SM3TT1A, SM3TT1B, SM3TT2A, SM3TT2B, SM3PARTW1, and 
SM3PARTW2 instructions implemented. 


All other values are reserved. 

If ARMv8.2-SM is not implemented the value @b0001 is reserved. 

ARMv8.2-SM implements the functionality identified by the value 0b0001. 

From Armv8.2, the permitted values are 0b0000 and 0b0001. 

This field must have the same value as ID AA64ISARO_EL1.SM4. 
Otherwise: 


Reserved, RESO. 


SHAS, bits [35:32] 
From ARMv8.2: 
SHA3 instructions implemented in AArch64 state. Defined values are: 
0b0000 No SHA3 instructions implemented. 
0b0001 EOR3, RAX1, XAR, and BCAX instructions implemented. 
All other values are reserved. 
If ARMv8.2-SHA is not implemented the value 0b0001 is reserved. 
ARMv8.2-SHA implements the functionality identified by the value 0b0001. 
From Armv8.2, the permitted values are 0b0000 and 0b0001. 
If the value of ID AA64ISARO EL1.SHA1 is 0b0000, then this field must have the value 0b0000. 
If the value of this field is 0b0001, then ID AA64ISARO EL1.SHA2 must have the value 0b0010. 
Otherwise: 


Reserved, RESO. 


RDM, bits [31:28] 

From ARMv8.1: 
SQRDMLAH and SQRDMLSH instructions implemented in AArch64 state. Defined values are: 
0b0000 No SQRDMLAH and SQRDMLSH instructions implemented. 
0b0001 SQRDMLAH and SQRDMLSH instructions implemented. 
All other values are reserved. 
ARMv8.1-RDMA implements the functionality identified by the value 0b0001. 
From Armv8.1, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 
Bits [27:24] 
Reserved, RESO. 
Atomic, bits [23:20] 
From ARMv68.1: 


Atomic instructions implemented in AArch64 state. Defined values are: 


0b0000 No Atomic instructions implemented. 
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0b0010 LDADD, LDCLR, LDEOR, LDSET, LDSMAX, LDSMIN, LDUMAX, LDUMIN, 
CAS, CASP, and SWP instructions implemented. 


All other values are reserved. 
ARMv8.1-LSE implements the functionality identified by the value @b0010. 
From Armv8.1, the only permitted value is 0b0010. 


Otherwise: 


Reserved, RESO. 


CRC32, bits [19:16] 


CRC32 instructions implemented in AArch64 state. Defined values are: 
0b0000 No CRC32 instructions implemented. 


0b0001 CRC32B, CRC32H, CRC32W, CRC32X, CRC32CB, CRC32CH, CRC32CW, and 
CRC32CxX instructions implemented. 


All other values are reserved. 
In Armv8.0, the permitted values are 0b0000 and 0b0001. 
From Armv8.1, the only permitted value is 0b0001. 


SHA2, bits [15:12] 


SHA2 instructions implemented in AArch64 state. Defined values are: 
0b0000 No SHA2 instructions implemented. 
0b0001 SHA256H, SHA256H2, SHA256SU0, and SHA256SU1 instructions implemented. 


0b0010 As 0b0001, plus SHA512H, SHA512H2, SHA512SU0, and SHA512SU1 instructions 
implemented. 


All other values are reserved. 

If ARMv8.2-SHA is not implemented the value 0b0010 is reserved. 

From Armv8.2, the permitted values are 0b0000, 0b0001, and @b0010. 

If the value of ID AA64ISARO EL1.SHA1 is 0b0000, then this field must have the value 0b0000. 
If the value of this field is 0b0010, then ID AA64ISARO EL1.SHA3 must have the value 0b0001. 


SHALL, bits [11:8] 


AES, bits [7:4] 


Bits [3:0] 


SHA! instructions implemented in AArch64 state. Defined values are: 
0b0000 No SHA1 instructions implemented. 


0b0001 SHAIC, SHAIP, SHAIM, SHA1H, SHA1SU0, and SHA1SU1 instructions 
implemented. 


All other values are reserved. 
From Armvé8, the permitted values are 0b0000 and 0b0001. 
If the value of ID AA64ISARO EL1.SHA2 is 0b0000, then this field must have the value 0b0000. 


AES instructions implemented in AArch64 state. Defined values are: 

0b0000 No AES instructions implemented. 

0b0001 AESE, AESD, AESMC, and AESIMC instructions implemented. 

0b0010 As for 0b0001, plus PMULL/PMULL2? instructions operating on 64-bit data quantities. 
All other values are reserved. 


From Armv§8, the permitted values are 0b0000, 0b0001, and @b0010. 


Reserved, RESO. 
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Accessing the ID_AA64ISARO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_AA64ISARO_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0110 0b000 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64ISARQ_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AA64ISARQ_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AAG64ISARQ_EL1; 
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ID_AA64ISAR1_EL1, AArch64 Instruction Set Attribute Register 1 


The ID_AA64ISARI_ EL] characteristics are: 


Purpose 
Provides information about the features and instructions implemented in AArch64 state. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ID_AA64ISAR1_ EL] is a 64-bit register. 


Field descriptions 


The ID_AA64ISARI_ EL! bit assignments are: 


44 43 40 39, 36 35 32 31,28 27, 24 23 | 2019,.1615.. 12 11 


i RESO SPECRES| SB rans GPI Ee herce AA API | APA MEJ 


Bits [63:44] 


Reserved, RESO. 


SPECRES, bits [43:40] 
Speculation invalidation instruction support in AArch64 state. Defined values are: 
0b0000 CFP RCTX, DVP RCTX, and CPP RCTX instructions are not implemented. 
0b0001 CFP RCTX, DVP RCTX, and CPP RCTX instructions are implemented. 
All other values are reserved. 


From Armvs.5, the only permitted value is 0b0001. 


SB, bits [39:36] 
SB instruction support in AArch64 state. Defined values are: 
0b0000 SB instruction is not implemented. 
0b0001 SB instruction is implemented. 
All other values are reserved. 
From Armvs.5, the only permitted value is 0b0001. 


FRINTTS, bits [35:32] 


Indicates whether FRINT32Z, FRINT32X, FRINT64Z, and FRINT64X instructions are 
implemented. Defined values are: 


0b0000 FRINT32Z, FRINT32X, FRINT64Z, and FRINT64X instructions are not implemented. 
Qb0001 FRINT32Z, FRINT32X, FRINT64Z, and FRINT64X instructions are implemented. 
All other values are reserved. 


From Armvs.5, the only permitted value is 0b0001. 
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GPI, bits [31:28] 
From ARMV8.3: 


Indicates whether an IMPLEMENTATION DEFINED algorithm is implemented in the PE for generic 
code authentication, in AArch64 state. Defined values are: 


0b0000 Generic Authentication using an IMPLEMENTATION DEFINED algorithm is not 
implemented. 
0b0001 Generic Authentication using an IMPLEMENTATION DEFINED algorithm is implemented. 


This involves the PACGA instruction. 
All other values are reserved. 
From Armv8.3, the permitted values are 0b0000 and 0b0001. 
If the value of ID AA64ISARI1_EL1.GPA is non-zero, this field must have the value 0b0000. 
Otherwise: 


Reserved, RESO. 


GPA, bits [27:24] 
From ARMV8.3: 


Indicates whether QARMA or Architected algorithm is implemented in the PE for generic code 
authentication, in AArch64 state. Defined values are: 


0b0000 Generic Authentication using an Architected algorithm is not implemented. 


0b0001 Generic Authentication using the QARMA algorithm is implemented. This involves the 
PACGA instruction. 


All other values are reserved. 

From Armv8.3, the permitted values are 0b0000 and 0b0001. 

If the value of ID AA64ISARI_EL1.GPI is non-zero, this field must have the value 0b0000. 
Otherwise: 


Reserved, RESO. 


LRCPC, bits [23:20] 
From ARMv8.4: 
Indicates support for weaker release consistency, RCpc based model. Defined values are: 
0b0000 The LDAPUR*, STLUR*, and LDAPR* instructions are not implemented. 
0b0001 The LDAPR* instructions are implemented. 
0b0010 The LDAPUR*, STLUR*, and LDAPR* instructions are implemented. 
In Armv8.0, Armv8.1, and Armv8.2, the only permitted value is 0b0000. 


In Armv8.3, the only permitted value is 0b0001. ARMv8.3-RCPC implements the functionality 
identified by the value @b0001. 


From Armv8.4, the only permitted value is 0b0010. ARMv8.4-RCPC implements the functionality 
identified by the value 0b0010. 


All other values are reserved. 
From ARMv8.3: 
Indicates support for weaker release consistency, RCpc based model. Defined values are: 
0b0000 The LDAPRB, LDAPRH and LDAPR instructions are not implemented. 
0b0001 The LDAPRB, LDAPRH and LDAPR instructions are implemented. 
All other values are reserved. 
ARMv8.3-RCPC implements the functionality identified by the value 0b0001. 
In Armv8.0, Armv8.1, and Armv8.2, the only permitted value is 0b0000. 
In Armv8.3, the only permitted value is 0b0001. 
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Otherwise: 


Reserved, RESO. 


FCMA, bits [19:16] 
From ARMV8.3: 


Indicates support for complex number addition and multiplication, where numbers are stored in 
vectors. Defined values are: 


0b0000 The FCMLA and FCADD instructions are not implemented. 

0b0001 The FCMLA and FCADD instructions are implemented. 

All other values are reserved. 

ARMv8.3-CompNum implements the functionality identified by the value @b0001. 
In Armv8.0, Armv8.1, and Armv8.2, the only permitted value is 0b0000. 

From Armv8.3, the only permitted value is 0b0001. 


Otherwise: 


Reserved, RESO. 


JSCVT, bits [15:12] 
From ARMV8.3: 


Indicates support for javascript conversion from double precision floating point values to integers 
in AArch6é4 state. Defined values are: 


0b0000 The FJCVTZS instruction is not implemented. 

0b0001 The FJCVTZS instruction is implemented. 

All other values are reserved. 

ARMVv8.3-JSConv implements the functionality identified by 0b0001. 
In Armv8.0, Armv8.1, and Armv8.2, the only permitted value is 0b0000. 
From Armv8.3, the only permitted value is 0b0001. 


Otherwise: 


Reserved, RESO. 


API, bits [11:8] 
From ARMV8.3: 


Indicates whether an IMPLEMENTATION DEFINED algorithm is implemented in the PE for address 
authentication, in AArch64 state. Defined values are: 


0b0000 Address Authentication using an IMPLEMENTATION DEFINED algorithm is not 
implemented. 


0b0001 Address Authentication using an IMPLEMENTATION DEFINED algorithm is implemented. 
This involves all Pointer Authentication instructions other than the PACGA instruction. 


0b0010 Address Authentication using an IMPLEMENTATION DEFINED algorithm is implemented, 
with the EnhancedPAC() function returning TRUE. This applies to all Pointer 
Authentication instructions other than the PACGA instruction. 


All other values are reserved. 
From Armv8.3, the permitted values are 0b0000 and 0b0001. 
If the value of ID AA64ISARI_EL1.APA is non-zero, this field must have the value 0b0000. 


Otherwise: 


Reserved, RESO. 
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D13-3104 


APA, bits [7:4] 


From ARMV8.3: 


Indicates whether QARMA or Architected algorithm is implemented in the PE for address 
authentication, in AArch64 state. Defined values are: 


0b0000 Address Authentication using an Architected algorithm is not implemented. 


0b0001 Address Authentication using the QARMA algorithm is implemented, with the 
EnhancedPAC() function returning FALSE. This applies to all Pointer Authentication 
instructions other than the PACGA instruction. 


0b0010 Address Authentication using the QARMA algorithm is implemented, with the 
EnhancedPAC() function returning TRUE. This applies to all Pointer Authentication 
instructions other than the PACGA instruction. 


All other values are reserved. 
From Armv8.3, the permitted values are 0b0000 and 0b0001. 
If the value of the ID AA64ISARI_ EL1.API is non-zero, this field must have the value 0b0000. 


Otherwise: 


DPB, bits [3:0] 


Reserved, RESO. 


From ARMVv8.2: 


Data Persistence writeback. Indicates support for the DC CVAP and DC CVADP instructions in 
AArch64 state. Defined values are: 


0b0000 DC CVAP not supported. 

0b0001 DC CVAP supported. 

0b0010 DC CVAP and DC CVADP supported. 

All other values are reserved. 

ARMv8.2-DCPoP implements the functionality identified by the value 0b0001. 
ARMv8.2-DCCVADP implements the functionality identified by the value 0b0010. 
From Armv8.2 to Armv8.4, the only permitted value is 0b0001. 

From Armvs.5, the only permitted value is 0b0010 


Otherwise: 


If API == 0000 


Reserved, RESO. 


and APA == 0000, then: 


s The TCR_EL1.{TBID,TBIDO}, TCR_EL2.{TBID0,TBID1}, TCR_EL2.TBID and TCR_EL3.TBID bits 


are RESO. 


° APIAKeyHi_EL1, APIAKeyLo_EL1, APIBKeyHi_EL1, APIBKeyLo_EL1, APDAKeyHi_EL1, 
APDAKeyLo_EL1, APDBKeyHi_EL1, APDBKeyLo_EL1 are not allocated. 


If API == 0000 


7 SCTLR_ELx.EnIA, SCTLR_ELx.EnIB, SCTLR_ELx.EnDA, SCTLR_ELx.EnDB are all RESO. 


and APA == 0000 and GPI == 0000 and GPA == 0000, then: 


s HCR_EL2.APK and HCR_EL2.API are RESO. 


*  SCR_EL 


Accessing t 


3.APK and SCR_EL3.API are RESO. 


he ID_AA64ISAR1_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, ID_AA64ISAR1_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0000 0b0110 0b001 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64ISAR1_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AAG64ISAR1_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AAG64ISAR1_EL1; 
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D13.2.55 


is 47. 44 43 


RESO ia 


TGran4_2 
TGran64_2 
TGran16_2 
TGran4 
TGran64 


D13-3106 


ID_AA64MMFRO_EL1, AArch64 Memory Model Feature Register 0 


The ID AA64MMFRO_ ELI characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch64 state. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_AA64MMEFRO ELI! is a 64-bit register. 


Field descriptions 


The ID AA64MMFRO_ EL] bit assignments are: 


40 39 36 35 32 31,28 27 |. 2423 |. 2019 1615 12 11 


HHH 


PARange 
ASIDBits 
BigEnd 
SNSMem 
BigEndELO 
TGran16 


Bits [63:48] 
Reserved, RESO. 


ExS, bits [47:44] 
From ARMv8.5: 
Support for disabling context synchronizing exception entry and exit. Defined values are: 
0b0000 All exception entries and exits are context synchronization events. 
0b0001 Non-context synchronizing exception entry and exit are supported. 
All other values are reserved. 
ARMv8.5-CSEH implements the functionality identified by the value 0b0001. 
Otherwise: 


Reserved, RESO. 


TGran4 2, bits [43:40] 
From ARMvs.5: 
Support for 4KB memory granule size for stage 2. Defined values are: 
0b0000 4KB Stage 2 granule is identified in the TGran4 field 
0b0001 4KB granule not supported at stage 2 
0b0010 4KB granule supported at stage 2 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


All other values are reserved. 
The 0b0000 value is deprecated. 
Otherwise: 


Reserved, RESO. 


TGran64_2, bits [39:36] 

From ARMvs.5: 
Support for 64KB memory granule size for stage 2. Defined values are: 
0b0000 64KB Stage 2 granule is identified in the TGran64 field 
0b0001 64KB granule not supported at stage 2 
0b0010 64KB granule supported at stage 2 
All other values are reserved. 
The 0b0000 value is deprecated. 

Otherwise: 


Reserved, RESO. 


TGranl6_2, bits [35:32] 

From ARMv8.5: 
Support for 16KB memory granule size for stage 2. Defined values are: 
0b0000 16KB Stage 2 granule is identified in the TGran16 field 
0b0001 16KB granule not supported at stage 2 
0b0010 16KB granule supported at stage 2 
All other values are reserved. 
The 0b0000 value is deprecated. 

Otherwise: 


Reserved, RESO. 


TGrand4, bits [31:28] 
Support for 4KB memory translation granule size. Defined values are: 
0b0000 4KB granule supported. 
0b1111 4KB granule not supported. 


All other values are reserved. 


TGran64, bits [27:24] 
Support for 64KB memory translation granule size. Defined values are: 
0b0000 64KB granule supported. 
0b1111 64KB granule not supported. 


All other values are reserved. 


TGran16, bits [23:20] 
Support for 16KB memory translation granule size. Defined values are: 
0b0000 16KB granule not supported. 
0b0001 16KB granule supported. 


All other values are reserved. 
BigEndELO, bits [19:16] 
Mixed-endian support at ELO only. Defined values are: 
0b0000 No mixed-endian support at ELO. The SCTLR_EL1.E0E bit has a fixed value. 
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0b0001 Mixed-endian support at ELO. The SCTLR_EL1.EOE bit can be configured. 
All other values are reserved. 
This field is invalid and is RESO if the BigEnd field, bits [11:8], is not 0b0000. 


SNSMem, bits [15:12] 
Secure versus Non-secure Memory distinction. Defined values are: 
0b0000 Does not support a distinction between Secure and Non-secure Memory. 
0b0001 Does support a distinction between Secure and Non-secure Memory. 


All other values are reserved. 


BigEnd, bits [11:8] 
Mixed-endian configuration support. Defined values are: 


0b0000 No mixed-endian support. The SCTLR_ELx.EE bits have a fixed value. See the 
BigEndELO field, bits[19:16], for whether ELO supports mixed-endian. 


0b0001 Mixed-endian support. The SCTLR_ELx.EE and SCTLR_EL1.E0E bits can be 
configured. 


All other values are reserved. 


ASIDBits, bits [7:4] 
Number of ASID bits. Defined values are: 
0b0000 8 bits. 
0b0010 16 bits. 


All other values are reserved. 


PARange, bits [3:0] 
Physical Address range supported. Defined values are: 
0b0000 32 bits, 4GB. 
0b0001 36 bits, 64GB. 
0b0010 40 bits, 1TB. 
0b0011 42 bits, 4TB. 
0b0100 44 bits, 16TB. 
0b0101 48 bits, 256TB. 
0b0110 52 bits, 4PB. 
All other values are reserved. 


The value 0b0110 is permitted only if the implementation includes ARMv8.2-LPA, otherwise it is 
reserved. 


Accessing the ID_AA64MMFRO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_AA64MMFRO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0111 0b000 





if PSTATE.EL == EL@ then 
if IsFeatureImp]lemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
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else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64MMFRO_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AA64MMFRQ_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AA64MMFRQ_EL1; 
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D13.2.56 ID_AA64MMFR1_EL1, AArch64 Memory Model Feature Register 1 
The ID AA64MMFRI1 ELI characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch6é4 state. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_AA64MMER1 ELI is a 64-bit register. 


Field descriptions 


The ID AA64MMFR1_ ELI bit assignments are: 


63 32 31 ,, 28 27 24 23.2019... 16 15., 12 11 


Bits [63:32] 


Reserved, RESO. 


XNX, bits [31:28] 

From ARMv68.2: 
Support for execute-never control distinction by Exception level at stage 2. Defined values are: 
0b0000 Distinction between ELO and EL1 execute-never control at stage 2 not supported. 
0b0001 Distinction between ELO and EL1 execute-never control at stage 2 supported. 
All other values are reserved. 
ARMv8.2-TTS2UXN implements the functionality identified by the value @b0001. 
From Armv8.2, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 


SpecSEI, bits [27:24] 
When RAS is implemented: 


Describes whether the PE can generate SError interrupt exceptions from speculative reads of 
memory, including speculative instruction fetches. The defined values of this field are: 


0b0000 The PE never generates an SError interrupt due to an External abort on a speculative 
read. 

0b0001 The PE might generate an SError interrupt due to an External abort on a speculative 
read. 


All other values are reserved. 
Otherwise: 


Reserved, RESO. This provides no information about whether the PE generates a speculative SError 
interrupt. 
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PAN, bits [23:20] 
From ARMVv8.1: 


Privileged Access Never. Indicates support for the PAN bit in PSTATE, SPSR_EL1, SPSR_EL2, 
SPSR_EL3, and DSPSR_ELO. Defined values are: 


0b0000 PAN not supported. 
0b0001 PAN supported. 
0b0010 PAN supported and AT S1E1RP and AT SIE] WP instructions supported. 
All other values are reserved. 
ARMv8.1-PAN implements the functionality identified by the value 0b0001. 
ARMv8.2-ATS1E1 implements the functionality added by the value 0b0010. 
In Armv8.1, the only permitted value is 0b0001. 
From Armv8.2, the only permitted value is 0b0010. 
Otherwise: 


Reserved, RESO. 


LO, bits [19:16] 

From ARMv8.1: 
LORegions. Indicates support for LORegions. Defined values are: 
0b0000 LORegions not supported. 
0b0001 LORegions supported. 
All other values are reserved. 
ARMv8.1-LOR implements the functionality identified by the value 0b0001. 
From Armv8.1, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 


HPDS, bits [15:12] 
From ARMv8.1: 
Hierarchical permission disables bits in translation tables. Defined values are: 
0b0000 Disabling of hierarchical controls not supported. 


0b0001 Disabling of hierarchical controls supported with the TCR_EL1.{HPD1, HPDO}, 
TCR_EL2.HPD or TCR_EL2.{HPD1, HPDO}, and TCR_EL3.HPD bits. 


0b0010 As for value @b0001, and adds possible hardware allocation of bits[62:59] of the 
translation table descriptors from the final lookup level for IMPLEMENTATION DEFINED 
use. 


All other values are reserved. 
ARMv8.1-HPD implements the functionality identified by the value 0b0001. 
ARMv8.2-TTPBHA implements the functionality identified by the value 0b0010. 
From Armv8.1, the value 0b0000 is not permitted. 

Otherwise: 


Reserved, RESO. 


VH, bits [11:8] 
From ARMv8.1: 
Virtualization Host Extensions. Defined values are: 
0b0000 Virtualization Host Extensions not supported. 
0b0001 Virtualization Host Extensions supported. 
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All other values are reserved. 
ARMv8.1-VHE implements the functionality identified by the value 0b0001. 
From Armv8.1, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 


VMIDBits, bits [7:4] 

From ARMv8.1: 
Number of VMID bits. Defined values are: 
0b0000 8 bits 
0b0010 16 bits 
All other values are reserved. 
ARMv8.1-VMID16 implements the functionality identified by the value 0b0010. 
From Armv8.1, the permitted values are 0b0000 and 0b0010. 

Otherwise: 


Reserved, RESO. 


HAFDBS, bits [3:0] 

From ARMv8.1: 
Hardware updates to Access flag and Dirty state in translation tables. Defined values are: 
0b0000 Hardware update of the Access flag and dirty state are not supported. 
0b0001 Hardware update of the Access flag is supported. 
0b0010 Hardware update of both the Access flag and dirty state is supported. 
All other values are reserved. 
ARMv8.1-TTHM implements the functionality identified by the values 0b0001 and 0b0010. 
From Armv8.1, the permitted values are 0b0000, 0b0001, and 0b0010. 

Otherwise: 


Reserved, RESO. 


Accessing the ID_AA64MMFR1_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_AA64MMFR1_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0111 0b001 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64MMFR1_EL1; 
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elsif PSTATE.EL == EL2 then 
return ID_AA64MMFR1_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AA64MMFR1_EL1; 
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D13.2.57 ID_AA64MMFR2_EL1, AArch64 Memory Model Feature Register 2 


The ID AA64MMFR2 EL] characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch6é4 state. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 


Attributes 


This register is present only from ARMv8.2. Otherwise, direct accesses to ID AA64MMFR2 EL1 
are RESO. 


RW fields in this register reset to architecturally UNKNOWN values. 
This register is introduced in ARMV8.2. 


ID_AA64MMEFR2 ELI is a 64-bit register. 


Field descriptions 


The ID AA64MMFR2 _ EL! bit assignments are: 


63 60 59 56 55 52 51, 48 47 44 43 40 39 36 35 32 31, 28 27, 24 23, 20 19 161912 11,8 7,4 3,0 
EOPD} EVT | BBM | TTL |RES0| FWB | IDS | AT | ST | NV |CCIDX'VARange sa wolar! 


EOPD, bits [63:60] 


From ARMV8.5: 


Indicates support for the ARMv8.5-EOPD mechanism. Defined values are: 
0b0000 EOPDx mechanism is not implemented. 

0b0001 EOPDx mechanism is implemented. 

All other values are reserved. 

In Armv8.4, the only permitted value is 0b0000. 

From Armv8.5, the only permitted values is 0b0001. 


Otherwise: 


Reserved, RESO. 


EVT, bits [59:56] 


D13-3114 


When ARMV8.2-EVT is implemented: 


Enhanced Virtualization Traps. If EL2 is implemented, indicates support for the 
HCR_EL2.{TTLBOS, TTLBIS, TOCU, TICAB, TID4} traps. Defined values are: 


0b0000 HCR_EL2.{TTLBOS, TTLBIS, TOCU, TICAB, TID4} traps are not supported. 


b0001 HCR _EL2.{TOCU, TICAB, TID4} traps are supported. HCR_EL2.{TTLBOS, 
TTLBIS} traps are not supported. 


0b0010 HCR_EL2.{TTLBOS, TTLBIS, TOCU, TICAB, TID4} traps are supported. 
All other values are reserved. 

In Armv8.0, the only permitted value is 0b0000. 

From Armv8.1, the permitted values are 0b0000, 0b0001, and 0b0010. 
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From Armvs.5, the permitted values are: 

. 0b0000 when EL2 is not implemented. 

° 0b0010 when EL2 is implemented. This feature is identified as ARMv8.2-EVT. 
Otherwise: 


Reserved, RESO. 


BBM, bits [55:52] 
From ARMV8.4: 


Allows identification of the requirements of the hardware to have break-before-make sequences 
when changing block size for a translation. 


0b0000 Level 0 support for changing block size is supported. 
0b0001 Level 1 support for changing block size is supported. 
0b0010 Level 2 support for changing block size is supported. 
All other values are reserved. 
ARMv8.4-TTRem implements the functionality identified by the values 0b0000, 0b0001, and 0b0019. 
From Armv8.4, the permitted values are 0b0000, 0b0001, and 0b0010. 
Otherwise: 


Reserved, RESO. 


TTL, bits [51:48] 
From ARMv8.4: 
Indicates support for TTL field in address operations. Defined values are: 
0b0000 TLB maintenance instructions by address have bits[47:44] as RESO. 
0b0001 TLB maintenance instructions by address have bits[47:44] holding the TTL field. 
All other values are reserved. 
ARMv8.4-TTL implements the functionality identified by the value 0b0001. 


This field affects TLBI IPAS2E1, TLBI IPAS2E1IS, TLBI IPAS2E10S, TLBI IPAS2LE1, TLBI 
IPAS2LE1IS, TLBI IPAS2LE10S, TLBI VAAE1, TLBI VAAEIIS, TLBI VAAE10S, TLBI 
VAALE]1, TLBI VAALEIIS, TLBI VAALEIOS, TLBI VAE1, TLBI VAEIIS, TLBI VAE1OS, 
TLBI VAE2, TLBI VAE2IS, TLBI VAE20S, TLBI VAE3, TLBI VAE3IS, TLBI VAE30S,TLBI 
VALE1, TLBI VALEIIS, TLBI VALEIOS, TLBI VALE2, TLBI VALE2IS, TLBI VALE20S, 
TLBI VALE3, TLBI VALE3IS, TLBI VALE30S. 


From Armv8.4, the only permitted value is 0b0001. 
Otherwise: 


Reserved, RESO. 


Bits [47:44] 


Reserved, RESO. 


FWB, bits [43:40] 
From ARMv8.4: 
Indicates support for HCR_EL2.FWB 
0b0000 HCR_EL2.FWB bit is not supported and the field is RESO 
0b0001 HCR_EL2.FWB is supported. 
If ARMv8.4-SecEL2 is implemented the only permitted value is 0b0001 
All other values reserved. 


This field resets to an architecturally UNKNOWN value. 
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Otherwise: 


Reserved, RESO. 


IDS, bits [39:36] 
From ARMV8.4: 


Indicates the value of ESR_ELx.EC that reports an exception generated by a read access to the 
feature ID space. Defined values are: 


0b0000 An exception which is generated by a read access to the feature ID space, other than a 
trap caused by HCR_EL2.TIDx, SCTLR_EL1.UCT, or SCTLR_EL2.UCT, is reported 
by ESR_ELx.EC == 0x0. 


0b0001 All exceptions generated by an AArch64 read access to the feature ID space are reported 
by ESR_ELx.EC == 0x18. 


All other values are reserved. 


The Feature ID space is defined as the System register space in AArch64 with op0==3, op1=={0, 
1, 3}, CRn==0, CRm=={0-7}, op2=={0-7}. 


ARMv8.4-IDST implements the functionality identified by the value 0b0001. 
From Armv8.4, the only permitted value is 0b0001. 
Otherwise: 


Reserved, RESO. 


AT, bits [35:32] 
From ARMv8.4: 
Identifies support for unaligned single-copy atomicity and atomic functions. Defined values are: 
0b0000 Unaligned single-copy atomicity and atomic functions are not supported. 


0b0001 Unaligned single-copy atomicity and atomic functions with a 16-byte address range 
aligned to 16-bytes are supported. 


All other values are reserved. 
ARMv8.4-LSE implements the functionality identified by the value @b0001. 
From Armv8.4, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 


ST, bits [31:28] 
From ARMv8.4: 
Identifies support for small translation tables. Defined values are: 


0b0000 The maximum value of the TCR_ELx.{T0SZ,T1SZ} and VTCR_EL2.TOSZ fields is 
39. 


0b0001 The maximum value of the TCR_ELx. {TOSZ,T1SZ} and VTCR_EL2.TOSZ fields is 48 
for 4KB and 16KB granules, and 47 for 64KB granules. 


All other values are reserved. 
ARMv8.4-TTST implements the functionality identified by the value 0b0001. 
If ARMv8.4-SecEL2 is implemented the only permitted value is 0b0001. 


In an implementation which does not support Secure EL2, the permitted values are 0b0000 and 
0b0001. 


Otherwise: 


Reserved, RESO. 
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NV, bits [27:24] 
From ARMV8.4: 


Nested Virtualization. If EL2 is implemented, indicates support for the use of nested virtualization. 
Defined values are: 


0b0000 Nested virtualization is not supported. 
0b0001 The HCR_EL2.NV, HCR_EL2.NV1, HCR_EL2.AT bits are implemented. 


0b0010 The VNCR_EL2 register and the HCR_EL2.{AT, NV, NV1, NV2} bits are 
implemented. 


All other values are reserved. 

In Armv8.2, the only permitted value is 0b0000. 

In Armv8.3, the permitted values are: 

. When EL2 is not implemented, 0b0000. 

. When EL2 is implemented, 0b0001. 

The feature ARMv8.3-NV implements the functionality identified by the value 0b0001. 

In Armv8.4, the permitted values are: 

. When EL2 is not implemented, 0b0000. 

. When EL2 is implemented, 0b0010. 

The feature ARMv8.4-NV implements the functionality identified by the value 0b0010. 
From ARMv8.3: 


Nested Virtualization. If EL2 is implemented, indicates support for the use of nested virtualization. 
Defined values are: 


0b0000 Nested virtualization is not supported. 

0b0001 The HCR_EL2.NV, HCR_EL2.NV1, HCR_EL2.AT bits are implemented. 

All other values are reserved. 

In Armv8.2, the only permitted value is 0b0000. 

From Armv8.3, the permitted values are: 

. When EL2 is not implemented, 0b0000. 

. When EL2 is implemented, 0b0001. 

The feature ARMv8.3-NV implements the functionality identified by this value. 
Otherwise: 


Reserved, RESO. 


CCIDX, bits [23:20] 

From ARMv8.3: 
Support for the use of revised CCSIDR_EL1 register format. Defined values are: 
0b0000 32-bit format implemented for all levels of the CCSIDR_EL1. 
0b0001 64-bit format implemented for all levels of the CCSIDR_EL1. 
All other values are reserved. 
This feature is identified as ARMv8.3-CCIDX. 
From Armv8.3, the permitted values are 0b0000 and 0b0001. 

Otherwise: 


Reserved, RESO. 
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VARange, bits [19:16] 
From ARMv8.2: 
Indicates support for a larger virtual address. Defined values are: 
0b0000 VMSAv8-64 supports 48-bit VAs. 


0b0001 VMSAv8-64 supports 52-bit VAs when using the 64KB translation granule. The other 
translation granules support 48-bit VAs. 


All other values are reserved. 
ARMv8.2-LVA implements the functionality identified by the value 0b0001. 
From Armv8.2, the permitted values are 0b0000 and 0b0001. 

Otherwise: 


Reserved, RESO. 


TESB, bits [15:12] 
From ARMvé8.2: 
Indicates support for the IESB bit in the SCTLR_ELx registers. Defined values are: 
0b0000 TESB bit in the SCTLR_ELx registers is not supported. 
0b0001 TESB bit in the SCTLR_EL-x registers is supported. 
All other values are reserved. 
ARMv8.2-IESB implements the functionality identified by the value 0b0001. 
Otherwise: 


Reserved, RESO. 


LSM, bits [11:8] 
From ARMVv8.2: 


Indicates support for LSMAOE and nTLSMD bits in SCTLR_EL1 and SCTLR_EL2. Defined 
values are: 


0b0000 LSMAOE and nTLSMD bits not supported. 

0b0001 LSMAOE and nTLSMD bits supported. 

All other values are reserved. 

ARMv8.2-LSMAOC implements the functionality identified by the value 0b0001. 
Otherwise: 


Reserved, RESO. 


UAO, bits [7:4] 

From ARMv8.2: 
User Access Override. Defined values are: 
0b0000 UAO not supported. 
0b0001 UAO supported. 
All other values are reserved. 
ARMv8.2-UAO implements the functionality identified by the value 0b0001. 
From Armv8.2, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 
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CnP, bits [3:0] 

From ARMv8.2: 
Common not Private translations. Defined values are: 
0b0000 Common not Private translations not supported. 
0b0001 Common not Private translations supported. 
All other values are reserved. 
ARMv8.2-TTCNP implements the functionality identified by the value 0b0001. 
From Armv8.2, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 


Accessing the ID_AA64MMFR2_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_AA64MMFR2_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0111 0b010 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64MMFR2_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AAG4MMFR2_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AA64MMFR2_EL1; 
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D13.2.58 ID_AA64PFRO_EL1, AArch64 Processor Feature Register 0 


The ID AA64PFRO_ELI characteristics are: 


Purpose 
Provides additional information about implemented PE features in AArch64 state. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 
Configurations 
The external register EDPFR gives information from this register. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ID_AA64PFRO EL] is a 64-bit register. 


Field descriptions 


The ID AA64PFRO_ EL! bit assignments are: 


40 39 36 35 32 31, 28 27 24 23 2019161912 11,8 7,4 3,0 


63 60 59 56 55 52 51 48 47 44 43. 
CSV3/CSV2|RESO) DIT nr SEL2| SVE | RAS | GIC |AdvSIMD| FP ea [eu EL1 a 


CSV3, bits [63:60] 
From ARMv8.5: 
Speculative use of faulting data. Defined values are: 


0b0000 This Device does not disclose whether data loaded under speculation with a permission 
or domain fault can be used to form an address or generate condition codes or SVE 
predicate values to be used by instructions newer than the load in the speculative 
sequence 


0b0001 Data loaded under speculation with a permission or domain fault cannot be used to form 
an address or generate condition codes or SVE predicate values to be used by 
instructions newer than the load in the speculative sequence 


From Army8.5, the only permitted value is 0b0001. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


CSV2, bits [59:56] 
From ARMv8.5: 
Speculative use of out of context branch targets. Defined values are: 


0b0000 This Device does not disclose whether branch targets trained in one hardware described 
context can affect speculative execution in a different hardware described context. 


0b0001 Branch targets trained in one hardware described context can only affect speculative 
execution in a different hardware described context in a hard-to-determine way. 
Contexts do not include the SCXTNUM_ELx register contexts, and these registers are 
not supported. 


0b0010 Branch targets trained in one hardware described context can only affect speculative 
execution in a different hardware described context in a hard-to-determine way. 
Contexts include the SCXTNUM_ELx register contexts, and these registers are 
supported. 
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From Armv8.5 the only permitted values are 0b0001 or 0b0010. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


Bits [55:52] 


Reserved, RESO. 


DIT, bits [51:48] 
From ARMv8.4: 
Data Independent Timing. Defined values are: 
0b0000 AArch64 does not guarantee constant execution time of any instructions. 


0b0001 AArch64 provides the PSTATE.DIT mechanism to guarantee constant execution time 
of certain instructions. 


All other values are reserved. 
ARMv8.4-DIT implements the functionality identified by the value 0b0001. 
From Armv8.4, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 


AMU, bits [47:44] 

From ARMv8.4: 
Activity Monitors Extension. Defined values are: 
0b0000 Activity Monitors Extension is not implemented. 
0b0001 Activity Monitors Extension Version 1 is implemented. 
All other values are reserved. 
AMUv1 implements the functionality identified by the value 0b0001. 
In Armv8.0, Armv8.1, Armv8.2, and Armv8.3, the only permitted value is @b0000. 
From Armv8.4, the permitted values are 0b0000 and 0b0001. 

Otherwise: 


Reserved, RESO. 


MPAM, bits [43:40] 
From ARMv8.2: 
MPAM Extension. Defined values are: 
0b0000 MPAM is not implemented. 
0b0001 MPAM is implemented. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


SEL2, bits [39:36] 
From ARMv8.4: 
Secure EL2. Defined values are: 
0b0000 Secure EL2 is not implemented. 
0b0001 Secure EL2 is implemented. 


All other values are reserved. 
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D13-3122 


Otherwise: 


Reserved, RESO. 


SVE, bits [35:32] 
From ARMv8.2: 
Scalable Vector Extension. Defined values are: 
0b0000 SVE architectural state and programmers' model are not implemented. 
0b0001 SVE architectural state and programmers' model are implemented. 
All other values are reserved. 


If implemented, refer to ID AA64ZFRO EL! for information about which SVE instructions are 
available. 


Otherwise: 


Reserved, RESO. 


RAS, bits [31:28] 
RAS Extension version. The defined values of this field are: 
0b0000 No RAS Extension. 
0b0001 RAS Extension present. 
0b0010 ARMv8.4-RAS present. As @b0001, and adds support for: 
s If EL3 is implemented, ARMv8.4-DFE. 
s Additional ERXMISC<m>_EL1 System registers. 


s Additional System registers ERXPFGCDN_EL1, ERXPFGCTL_EL1, and 
ERXPFGF_EL1, and the SCR_EL3.FIEN and HCR_EL2.FIEN trap controls, to 
support the optional RAS Common Fault Injection Model Extension. 


Error records accessed through System registers conform to RAS System Architecture 
v1.1, which includes simplifications to ERR<n>STATUS and support for the optional 
RAS Timestamp and RAS Common Fault Injection Model Extensions. 


All other values are reserved. 


From Armv8.4, when ARMVv8.4-DFE is not implemented, and ERRIDR_EL1.NUM is zero, the 
permitted values are IMPLEMENTATION DEFINED 0b0001 or @b0010. Otherwise from Armv8.4 the only 
permitted value is 0b0010. 


ARMv8.4-RAS implements the functionality identified by the value 0b0010. 
In Armv8.2, the only permitted value is 0b0001. 
In Armv8.1 and Armv8.0, the permitted values are b0000 and 0b0001. 


GIC, bits [27:24] 
System register GIC interface support. Defined values are: 
0b0000 No System register interface to the GIC is supported. 
0b0001 System register interface to versions 3.0 and 4.0 of the GIC CPU interface is supported. 


All other values are reserved. 
AdvSIMD, bits [23:20] 


Advanced SIMD. Defined values are: 
0b0000 Advanced SIMD is implemented, including support for the following SISD and SIMD 


operations: 

° Integer byte, halfword, word and doubleword element operations. 

G Single-precision and double-precision floating-point arithmetic. 

e Conversions between single-precision and half-precision data types, and 


double-precision and half-precision data types. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


0b0001 As for 0b0000, and also includes support for half-precision floating-point arithmetic. 
Qb1111 Advanced SIMD is not implemented. 

All other values are reserved. 

This field must have the same value as the FP field. 

The permitted values are: 


è 0b0000 in an implementation with Advanced SIMD support that does not include the 
ARMv8.2-FP16 extension. 


g 0b0001 in an implementation with Advanced SIMD support that includes the ARMv8.2-FP16 
extension. 


s 0b1111 in an implementation without Advanced SIMD support. 


FP, bits [19:16] 
Floating-point. Defined values are: 
0b0000 Floating-point is implemented, and includes support for: 
° Single-precision and double-precision floating-point types. 


â Conversions between single-precision and half-precision data types, and 
double-precision and half-precision data types. 


0b0001 As for 0b0000, and also includes support for half-precision floating-point arithmetic. 
Qb1111 Floating-point is not implemented. 

All other values are reserved. 

This field must have the same value as the AdvSIMD field. 

The permitted values are: 


. 0b0000 in an implementation with floating-point support that does not include the 
ARMv8.2-FP16 extension. 


s 0b0001 in an implementation with floating-point support that includes the ARMv8.2-FP16 
extension. 


° 0b1111 in an implementation without floating-point support. 


EL3, bits [15:12] 
EL3 Exception level handling. Defined values are: 
0b0000 EL3 is not implemented. 
0b0001 EL3 can be executed in AArch64 state only. 
0b0010 EL3 can be executed in either AArch64 or AArch32 state. 


All other values are reserved. 


EL2, bits [11:8] 
EL2 Exception level handling. Defined values are: 
0b0000 EL2 is not implemented. 
0b0001 EL2 can be executed in AArch64 state only. 
0b0010 EL2 can be executed in either AArch64 or AArch32 state. 
All other values are reserved. 
EL1, bits [7:4] 
EL1 Exception level handling. Defined values are: 
0b0001 ELI can be executed in AArch64 state only. 
0b0010 ELI can be executed in either AArch64 or AArch32 state. 


All other values are reserved. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3123 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


ELO, bits [3:0] 
ELO Exception level handling. Defined values are: 
0b0001 ELO can be executed in AArch64 state only. 
0b0010 ELO can be executed in either AArch64 or AArch32 state. 


All other values are reserved. 


Accessing the ID_AA64PFRO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_AA64PFRO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0100 0b000 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64PFRO_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AA64PFRQ_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AA64PFRQ_EL1; 
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D13.2.59 ID_AA64PFR1_EL1, AArch64 Processor Feature Register 1 


The ID AA64PFR1_ ELI characteristics are: 


Purpose 
Reserved for future expansion of information about implemented PE features in AArch64 state. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ID_AA64PFRI EL] is a 64-bit register. 


Field descriptions 


The ID AA64PFR1 EL! bit assignments are: 


16 15 12 11 


63 8 7 4 3 0 
| RESO | nase | MTE | SSBS BT 


Bits [63:16] 


Reserved, RESO. 


RAS frac, bits [15:12] 
When ARMV8.4-RAS is implemented: 
RAS Extension fractional field. 
0b0000 If ID_AA64PFRO_EL1.RAS == 0b0001, RAS Extension implemented. 
0b0001 If ID_AA64PFRO_EL1.RAS == 0b0001, as 0b0000 and adds support for: 
e Additional ERXMISC<m>_EL1 System registers. 


a Additional System registers ERXPFGCDN_EL1, ERXPFGCTL_EL1, and 
ERXPFGF_EL1, and the SCR_EL3.FIEN and HCR_EL2.FIEN trap controls, to 
support the optional RAS Common Fault Injection Model Extension. 


Error records accessed through System registers conform to RAS System Architecture 
v1.1, which includes simplifications to ERR<n>STATUS, and support for the optional 
RAS Timestamp and RAS Common Fault Injection Model Extensions. 


All other values are reserved. 


This field is valid only if ID AA64PFRO_EL1.RAS == 0b0001. 
Otherwise: 


Reserved, RESO. 


MTE, bits [11:8] 
When ARMv8.5-MemTag is implemented: 
Support for the Tagged Memory Extension. 
0b0000 Tagged Memory Extension is not implemented. 


0b0001 Tagged Memory Instructions accessible at ELO are implemented. Instructions and 
System Registers defined by the extension not configurably accessible at ELO are 
Unallocated and other System Register fields defined by the extension are RESO. 
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0b0010 Tagged Memory Extension is implemented. 
When only Memory Tagging Extension Instructions accessible at ELO are implemented: 


. All register fields added to existing System Registers as part of the extension are RESO and 
treated as 0. 


: The following System Registers are Unallocated: 
— GMID_EL1, GCR_EL1, RGSR_EL1, TFSRE0_EL1, and TFSR_ELx. 
° The following System instructions are Unallocated: 


— DC CGSW, DC CIGSW, DC IGSW, DC CGDSW, DC CIGSW, DC IGDSW, DC 
IGVAC, and DC IGDVAC. 


s The following instructions are Unallocated: 
= LDGM, STGM, and STZGM. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


SSBS, bits [7:4] 
From ARMv8.5: 
Speculative Store Bypassing controls in AArch64 state. Defined values are: 
0b0000 AArch64 provides no mechanism to control the use of Speculative Store Bypassing. 


0b0001 AArch64 provides the PSTATE.SSBS mechanism to mark regions that are Speculative 
Store Bypass Safe. 


0b0010 AArch64 provides the PSTATE.SSBS mechanism to mark regions that are Speculative 
Store Bypassing Safe, and the MSR and MRS instructions to directly read and write the 
PSTATE.SSBS field 


All other values are reserved. 
Otherwise: 


Reserved, RESO. 


BT, bits [3:0] 

From ARMvs.5: 
Branch Target Identification mechanism support in AArch64 state. Defined values are: 
0b0000 The Branch Target Identification mechanism is not implemented. 
0b0001 The Branch Target Identification mechanism is implemented. 
All other values are reserved. 
ARMv8.5-BTI implements the functionality identified by the value 0b0001. 
From Armvs.5, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 


Accessing the ID_AA64PFR1_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, ID_AA64PFR1_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0000 0b0100 0b001 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AA64PFR1_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AA64PFR1_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AA64PFR1_EL1; 
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D13.2.60 ID _AFRO_EL1, AArch32 Auxiliary Feature Register 0 
The ID_AFRO ELI characteristics are: 


Purpose 
Provides information about the IMPLEMENTATION DEFINED features of the PE in AArch32 state. 
Must be interpreted with the Main ID Register, MIDR_EL1. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 


for fields in ID registers on page D13-2823. 


Configurations 


AArch64 System register ID AFRO EL1[31:0] is architecturally mapped to AArch32 System 
register ID_AFRO[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_AFRO_ EL] is a 64-bit register. 


Field descriptions 


The ID_AFRO EL! bit assignments are: 


63 1615 12 11 8 7 4 3 0 


RESO 


IMP DEF 
IMP DEF 
IMP DEF 
IMP DEF 


Bits [63:16] 
Reserved, RESO. 


IMPLEMENTATION DEFINED, bits [15:12] 


IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [11:8] 


IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [7:4] 


IMPLEMENTATION DEFINED. 

















IMPLEMENTATION DEFINED, bits [3:0] 


IMPLEMENTATION DEFINED. 


Accessing the ID_AFRO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, ID_AFRO_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b0000 0b0001 0b011 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID1 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_AFRQ_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_AFROQ_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_AFRQ_EL1; 
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D13.2.61 


D13-3130 


63 


ID_DFRO_EL1, AArch32 Debug Feature Register 0 


The ID_DFRO ELI characteristics are: 


Purpose 


Provides top level information about the debug system in AArch32 state. 
Must be interpreted with the Main ID Register, MIDR_EL1. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 


for fields in ID registers on page D13-2823. 


Configurations 


Attributes 


AArch64 System register ID _DFRO_EL1[31:0] is architecturally mapped to AArch32 System 
register ID DFRO[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


ID_DFRO_EL]1 is a 64-bit register. 


Field descriptions 


The ID _DFRO EL! bit assignments are: 


32 31 


28 27 24 23 20 19 1615 .. 12 11 


RESO TraceFilt | PerfMon MP MMapTrc | CopTrc | MMapDbg Te 


Bits [63:32] 


Reserved, RESO. 


TraceFilt, bits [31:28] 


Armv8.4 Self-hosted Trace Extension version. Defined values are: 
0b0000 Armv8.4 Self-hosted Trace Extension not implemented. 
0b0001 Armv8.4 Self-hosted Trace Extension implemented. 

All other values are reserved. 

ARMv8.4-Trace implements the functionality added by the value 0b0001. 
From Armv8.3, the permitted values are 0b0000 and 0b0001. 


PerfMon, bits [27:24] 


Performance Monitors Extension version. 


This field does not follow the standard ID scheme, but uses the Alternative ID scheme described in 
Alternative ID scheme used for the Performance Monitors Extension version on page D13-2825. 


Defined values are: 


0b0000 Performance Monitors Extension not implemented. 

0b0001 Performance Monitors Extension version 1 implemented, PMUv1. 
0b0010 Performance Monitors Extension version 2 implemented, PMUv2. 
Qb0011 Performance Monitors Extension version 3 implemented, PMUv3. 


0b0100 PMUVv3 for Armv8.1. As @b0011, and also includes support for: 
s Extended 16-bit PMEVTYPER<n>.evtCount field. 
s If EL2 is implemented, the HDCR.HPMD control bit. 
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0b0101 PMUV3 for Armv8.4. As @b0100 and also includes support for the PMMIR register. 
0b0110 PMUV3 for Armv8.5. As 0b0101 and also includes support for: 

$ 64-bit event counters. 

3 If EL2 is implemented, the HDCR.HCCD control bit. 

a If EL3 is implemented, the SDCR.SCCD control bit. 


0b1111 IMPLEMENTATION DEFINED form of performance monitors supported, PMUv3 not 
supported. Arm does not recommend this value in new implementations. 


ARMv8.1-PMU implements the functionality added by the value 0b0100. 
ARMv8.4-PMU implements the functionality added by the value 0b0101. 
ARMv8.5-PMU implements the functionality added by the value 0b0110. 

All other values are reserved. 

In any Armv8 implementation, the values 0b0001 and 0b0010 are not permitted. 
From Armv8.1, the value 0b0011 is not permitted. 

From Armv8.4, the value 0b0100 is not permitted. 

From Armvs.5, the value 0b0101 is not permitted. 


— Note 


In Armv7, the value 0b0000 can mean that PMUv1 is implemented. PMUv1 is not permitted in an 
Armv8 implementation. 





MProfDbg, bits [23:20] 


M Profile Debug. Support for memory-mapped debug model for M profile processors. Defined 
values are: 


0b0000 Not supported. 
0b0001 Support for M profile Debug architecture, with memory-mapped access. 
All other values are reserved. 


In Armv8-A, the only permitted value is 0b0000. 


MMaptTre, bits [19:16] 
Memory Mapped Trace. Support for memory-mapped trace model. Defined values are: 
0b0000 Not supported. 
0b0001 Support for Arm trace architecture, with memory-mapped access. 
All other values are reserved. 
In Armv8-A, the permitted values are 0b0000 and 0b0001. 


See the ETM Architecture Specification for more information. 


CopTre, bits [15:12] 


Support for System registers-based trace model, using registers in the coproc == 0b1110 encoding 
space. Defined values are: 


0b0000 Not supported. 

0b0001 Support for Arm trace architecture, with System registers access. 
All other values are reserved. 

In Armv8-A, the permitted values are 0b0000 and 0b0001. 


See the ETM Architecture Specification for more information. 


MMapDbg, bits [11:8] 


Memory Mapped Debug. Support for v7 memory-mapped debug model, for A and R profile 
processors. 
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In Armv8-A, this field is RESO. 
The optional memory map defined by Armv8 is not compatible with Armv7. 


CopSDbg, bits [7:4] 


Support for a System registers-based Secure debug model, using registers in the coproc = 0b1110 
encoding space, for an A profile processor that includes EL3. 


If EL3 is not implemented and the implemented Security state is Non-secure state, this field is RESO. 
Otherwise, this field reads the same as bits [3:0]. 


CopDbg, bits [3:0] 


Support for System registers-based debug model, using registers in the coproc == 0b1110 encoding 
space, for A and R profile processors. Defined values are: 


0b0000 
0b0010 
0b0011 
0b0100 
0b0101 
0b0110 
0b0111 


0b1000 
0b1001 


Not supported. 

Support for Armv6, v6 Debug architecture, with System registers access. 
Support for Armv6, v6.1 Debug architecture, with System registers access. 
Support for Armv7, v7 Debug architecture, with System registers access. 
Support for Armv7, v7.1 Debug architecture, with System registers access. 
Support for Armv8 debug architecture, with System registers access. 


Support for Armv8 debug architecture, with System registers access, and Virtualization 
Host extensions. 


Support for Armv8.2 debug architecture. 
Support for Armv8.4 debug architecture. 


All other values are reserved. 


In any Armv8 implementation, the values 0b0000, 0b0010, @b0011, @b0100, and 0b0101 are not 


permitted. 


If ARMv8.1-VHE is not implemented, the only permitted value is 0b0110. 


In an Armv8.0 implementation, the value 0b1000 is not permitted. 


Accessing the ID_DFRO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_DFRO_EL1 


if PSTATE.EL == EL@ then 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0001 0b010 





if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 


AArch64.SystemAccessTrap(EL1, 0x18); 


else 
UNDEFINED; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 


return ID_DFRQ_EL1; 
elsif PSTATE.EL == EL2 then 


return ID_DFROQ_EL1; 
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elsif PSTATE.EL == EL3 then 
return ID_DFROQ_EL1; 
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D13.2.62 


D13-3134 


ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0 


The ID ISARO_EL1 characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 


Must be interpreted with ID_ISAR1_EL1,ID_ISAR2_EL1,ID_ISAR3 ELI, ID_ISAR4 ELI, and 
ID_ISARS_ELI. 





For general information about the interpretation of the ID registers, see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 


AArch64 System register ID ISARO_EL1[31:0] is architecturally mapped to AArch32 System 
register ID ISARO[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_ISARO_ ELI! is a 64-bit register. 


Field descriptions 


The ID_ISARO_EL1 bit assignments are: 


28 27 .. 24 23 ,, 2019 16 15 12 11 


63 8 7 4 3 0 
| RESO Divide | Debug | Coproc | CmpBranch | BitField | al Swap 





Bits [63:28] 


Reserved, RESO. 


Divide, bits [27:24] 
Indicates the implemented Divide instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds SDIV and UDIV in the T32 instruction set. 
0b0010 As for 0b@001, and adds SDTV and UDIV in the A32 instruction set. 
All other values are reserved. 


In Armv8-A, the only permitted value is @b0010. 


Debug, bits [23:20] 
Indicates the implemented Debug instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds BKPT. 
All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 


Coproc, bits [19:16] 
Indicates the implemented System register access instructions. Defined values are: 


0b0000 None implemented, except for instructions separately attributed by the architecture to 
provide access to AArch32 System registers and System instructions. 


0b0001 Adds generic CDP, LDC, MCR, MRC, and STC. 
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0b0010 As for 0b0001, and adds generic CDP2, LDC2, MCR2, MRC2, and STC2. 
Qb0011 As for 0b0010, and adds generic MCRR and MRRC. 

0b0100 As for 0b0011, and adds generic MCRR2 and MRRC2. 

All other values are reserved. 


In Armv8-A, the only permitted value is @b0000. 


CmpBranch, bits [15:12] 


Indicates the implemented combined Compare and Branch instructions in the T32 instruction set. 
Defined values are: 


0b0000 None implemented. 
Qb0001 Adds CBNZ and CBZ. 
All other values are reserved. 


In Armv8-A, the only permitted value is @b0001. 


BitField, bits [11:8] 


Indicates the implemented BitField instructions. Defined values are: 
0b0000 None implemented. 

0b0001 Adds BFC, BFI, SBFX, and UBFX. 

All other values are reserved. 


In Armv8-A, the only permitted value is @b0001. 


BitCount, bits [7:4] 


Indicates the implemented Bit Counting instructions. Defined values are: 
0b0000 None implemented. 

0b0001 Adds CLZ. 

All other values are reserved. 


In Armv8-A, the only permitted value is @b0001. 


Swap, bits [3:0] 


Indicates the implemented Swap instructions in the A32 instruction set. Defined values are: 
0b0000 None implemented. 

0b0001 Adds SWP and SWPB. 

All other values are reserved. 


In Armv8-A, the only permitted value is @b0000. 


Accessing the ID_ISARO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_ISARO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0010 0b000 


if PSTATE.EL == ELO then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


AArch64.SystemAccessTrap(EL1, 0x18); 
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else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_ISARQ_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_ISARQ_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_ISARQ_EL1; 
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D13.2.63 ID_ISAR1_EL1, AArch32 Instruction Set Attribute Register 1 
The ID _ISAR1_ ELI characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 


Must be interpreted with ID_ISARO EL1,ID_ISAR2_ EL1,ID_ISAR3 ELI, ID_ISAR4 ELI, and 
ID_ISARS_ELI. 





For general information about the interpretation of the ID registers, see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 


AArch64 System register ID ISAR1_EL1[31:0] is architecturally mapped to AArch32 System 
register ID ISAR1[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_ISAR1_EL1 is a 64-bit register. 


Field descriptions 


The ID_ISAR1_ EL] bit assignments are: 


63 32 31 |. 28 27 24 23 2019..1615 .. 12 11 8 7 


4 3 0 
RESO Jazelle | Interwork | Immediate | IfThen | Extend | Except_AR | Except | Endian 


Bits [63:32] 





Reserved, RESO. 


Jazelle, bits [31:28] 
Indicates the implemented Jazelle extension instructions. Defined values are: 
0b0000 No support for Jazelle. 


0b0001 Adds the BXJ instruction and the J bit in the PSR. This setting might indicate a trivial 
implementation of the Jazelle extension. 


All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 


Interwork, bits [27:24] 
Indicates the implemented Interworking instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the BX instruction, and the T bit in the PSR. 
0b0010 As for 0b0001, and adds the BLX instruction. PC loads have BX-like behavior. 


Qb0011 As for 0b0010, and guarantees that data-processing instructions in the A32 instruction 
set with the PC as the destination and the S bit clear have BX-like behavior. 


All other values are reserved. 


In Armv8-A, the only permitted value is @b0011. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3137 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


Immediate, bits [23:20] 
Indicates the implemented data-processing instructions with long immediates. Defined values are: 
0b0000 None implemented. 
0b0001 Adds: 
° The MOVT instruction. 
° The MOV instruction encodings with zero-extended 16-bit immediates. 


° The T32 ADD and SUB instruction encodings with zero-extended 12-bit 
immediates, and the other ADD, ADR, and SUB encodings cross-referenced by 
the pseudocode for those encodings. 


All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 


IfThen, bits [19:16] 
Indicates the implemented If-Then instructions in the T32 instruction set. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the IT instructions, and the IT bits in the PSRs. 
All other values are reserved. 


In Armv8-A, the only permitted value is @b0001. 


Extend, bits [15:12] 
Indicates the implemented Extend instructions. Defined values are: 


0b0000 No scalar sign-extend or zero-extend instructions are implemented, where scalar 
instructions means non-Advanced SIMD instructions. 


0b0001 Adds the SXTB, SXTH, UXTB, and UXTH instructions. 


0b0010 As for @b0001, and adds the SXTB16, SXTAB, SXTAB16, SXTAH, UXTB16, UXTAB, 
UXTABI6, and UXTAH instructions. 


All other values are reserved. 


In Armv8-A, the only permitted value is @b0010. 


Except_AR, bits [11:8] 
Indicates the implemented A and R profile exception-handling instructions. Defined values are: 
0b0000 None implemented. 


0b0001 Adds the SRS and RFE instructions, and the A and R profile forms of the CPS 
instruction. 


All other values are reserved. 


In Armv8-A, the only permitted value is @b0001. 


Except, bits [7:4] 


Indicates the implemented exception-handling instructions in the A32 instruction set. Defined 
values are: 


0b0000 Not implemented. This indicates that the User bank and Exception return forms of the 
LDM and STM instructions are not implemented. 


0b0001 Adds the LDM (exception return), LDM (user registers), and STM (user registers) 
instruction versions. 


All other values are reserved. 


In Armv8-A, the only permitted value is @b0001. 
Endian, bits [3:0] 
Indicates the implemented Endian instructions. Defined values are: 


0b0000 None implemented. 
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0b0001 Adds the SETEND instruction, and the E bit in the PSRs. 
All other values are reserved. 


In Armv8-A, the permitted values are 0b0000 and 0b0001. 


Accessing the ID_ISAR1_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_ISAR1_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0010 0b001 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_ISAR1_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR1_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR1_EL1; 
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D13.2.64 ID_ISAR2_EL1, AArch32 Instruction Set Attribute Register 2 
The ID ISAR2_ ELI characteristics are: 
Purpose 


Provides information about the instruction sets implemented by the PE in AArch32 state. 


Must be interpreted with ID_ISARO_EL1,ID_ISAR1_EL1,ID_ISAR3 ELI, ID_ISAR4 ELI, and 
ID_ISARS ELI. 





For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 
Configurations 


AArch64 System register ID ISAR2_EL1[31:0] is architecturally mapped to AArch32 System 
register ID ISAR2[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_ISAR2_ EL] is a 64-bit register. 


Field descriptions 


The ID _ISAR2_ EL] bit assignments are: 


32 31 28 27 24 23., 2019..1615..12 11 


i RESO ee PSR_AR | MultU | MultS | el feeder LoadStore 


a e eT 


Bits [63:32] 


Reserved, RESO. 


Reversal, bits [31:28] 
Indicates the implemented Reversal instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the REV, REV16, and REVSH instructions. 
0b0010 As for 0b0001, and adds the RBIT instruction. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


PSR_AR, bits [27:24] 
Indicates the implemented A and R profile instructions to manipulate the PSR. Defined values are: 
0b0000 None implemented. 


0b0001 Adds the MRS and MSR instructions, and the exception return forms of data-processing 
instructions. 


All other values are reserved. 
In Armv8-A the only permitted value is 0b0001. 
The exception return forms of the data-processing instructions are: 


a In the A32 instruction set, data-processing instructions with the PC as the destination and the 
S bit set. These instructions might be affected by the WithShifts attribute. 
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. In the T32 instruction set, the SUBS PC,LR,#N instruction. 


MultU, bits [23:20] 
Indicates the implemented advanced unsigned Multiply instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the UMULL and UMLAL instructions. 
0b0010 As for 0b0001, and adds the UMAAL instruction. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


Mulls, bits [19:16] 
Indicates the implemented advanced signed Multiply instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the SMULL and SMLAL instructions. 


0b0010 As for 0b0001, and adds the SMLABB, SMLABT, SMLALBB, SMLALBT, 
SMLALTB, SMLALTT, SMLATB, SMLATT, SMLAWB, SMLAWT, SMULBB, 
SMULBT, SMULTB, SMULTT, SMULWB, and SMULWT instructions. Also adds the 
Q bit in the PSRs. 


0b0011 As for 0b0010, and adds the SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, 
SMLSDX, SMLSLD, SMLSLDX, SMMLA, SMMLAR, SMMLS, SMMLSR, 
SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, and SMUSDX instructions. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0011. 


Mult, bits [15:12] 
Indicates the implemented additional Multiply instructions. Defined values are: 
0b0000 No additional instructions implemented. This means only MUL is implemented. 
0b0001 Adds the MLA instruction. 
0b0010 As for 0b0001, and adds the MLS instruction. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


MultiAccessInt, bits [11:8] 
Indicates the support for interruptible multi-access instructions. Defined values are: 
0b0000 No support. This means the LDM and STM instructions are not interruptible. 
0b0001 LDM and STM instructions are restartable. 
0b0010 LDM and STM instructions are continuable. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


MemHint, bits [7:4] 
Indicates the implemented Memory Hint instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the PLD instruction. 
0b0010 Adds the PLD instruction. (0b0001 and @b0010 have identical effects.) 
0b0011 As for 0b0001 (or 0b0010), and adds the PLI instruction. 
0b0100 As for 0b0011, and adds the PLDW instruction. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0100. 
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LoadStore, bits [3:0] 
Indicates the implemented additional load/store instructions. Defined values are: 
0b0000 No additional load/store instructions implemented. 
0b0001 Adds the LDRD and STRD instructions. 


0b0010 As for 0b0001, and adds the Load Acquire (LDAB, LDAH, LDA, LDAEXB, LDAEXH, 
LDAEX, LDAEXD) and Store Release (STLB, STLH, STL, STLEXB, STLEXH, 
STLEX, STLEXD) instructions. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


Accessing the ID_ISAR2_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_ISAR2_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0010 0b010 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_ISAR2_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR2_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR2_EL1; 
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D13.2.65 ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3 


63 


ARM DDI 0487E.a 
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The ID _ISAR3_ ELI characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 


Must be interpreted with ID_ISARO_EL1,ID_ISAR1_EL1,ID_ISAR2 ELI, ID_ISAR4 ELI, and 
ID_ISARS_ELI. 





For general information about the interpretation of the ID registers, see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 


AArch64 System register ID ISAR3_EL1[31:0] is architecturally mapped to AArch32 System 
register ID ISAR3[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_ISAR3_EL1 is a 64-bit register. 


Field descriptions 


The ID_ISAR3_ EL] bit assignments are: 


32 31 28 27 24 23 20 19 1615 12 11 


8 7..4 3 0 
RESO T32EE nor T32Copy | TabBranch | SynchPrim | SVC so Saturate 


Bits [63:32] 
Indicates the implemented T32EE instructions. Defined values are: 





Reserved, RESO. 


T32EE, bits [31:28] 


0b0000 None implemented. 


0b0001 Adds the ENTERX and LEAVEX instructions, and modifies the load behavior to 
include null checking. 


All other values are reserved. 


In Armv8-A, the only permitted value is 0b0000. 


TrueNOP, bits [27:24] 
Indicates the implemented true NOP instructions. Defined values are: 


0b0000 None implemented. This means there are no NOP instructions that do not have any 
register dependencies. 


0b0001 Adds true NOP instructions in both the T32 and A32 instruction sets. This also permits 
additional NOP-compatible hints. 


All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 


T32Copy, bits [23:20] 
Indicates the support for T32 non flag-setting MOV instructions. Defined values are: 


0b0000 Not supported. This means that in the T32 instruction set, encoding T1 of the MOV 
(register) instruction does not support a copy from a low register to a low register. 
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0b0001 Adds support for T32 instruction set encoding T1 of the MOV (register) instruction, 
copying from a low register to a low register. 


All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 


TabBranch, bits [19:16] 


Indicates the implemented Table Branch instructions in the T32 instruction set. Defined values are: 
0b0000 None implemented. 

0b0001 Adds the TBB and TBH instructions. 

All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 


SynchPrim, bits [15:12] 


Used in conjunction with ID_ISAR4.SynchPrim_frac to indicate the implemented Synchronization 
Primitive instructions. Defined values are: 


0b0000 If SynchPrim_frac == @b0000, no Synchronization Primitives implemented. 


0b0001 If SynchPrim_frac == 0b0000, adds the LDREX and STREX instructions. 


If SynchPrim_frac == b0011, also adds the CLREX, LDREXB, STREXB, and 
STREXH instructions. 


0b0010 If SynchPrim_frac == 0b0000, as for [0b0001, 0b0011] and also adds the LDREXD and 
STREXD instructions. 


All other combinations of SynchPrim and SynchPrim_frac are reserved. 


In Armv8-A, the only permitted value is 0b0010. 


SVC, bits [11:8] 


Indicates the implemented SVC instructions. Defined values are: 
0b0000 Not implemented. 

0b0001 Adds the SVC instruction. 

All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 


SIMD, bits [7:4] 


Indicates the implemented SIMD instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the SSAT and USAT instructions, and the Q bit in the PSRs. 


0b0011 As for 0b0001, and adds the PKHBT, PKHTB, QADD16, QADD8, QASX, QSUB16, 
QSUB8, QSAX, SADD16, SADD8, SASX, SEL, SHADD16, SHADD8, SHASX, 
SHSUB16, SHSUB8, SHSAX, SSAT16, SSUB16, SSUB8, SSAX, SXTAB16, 
SXTB16, UADD16, UADD8, UASX, UHADD16, UHADD8, UHASX, UHSUB16, 
UHSUB8, UHSAX, UQADD16, UQADD8, UQASX, UQSUB16, UQSUB8, UQSAX, 
USAD8, USADA8, USAT16, USUB16, USUB8, USAX, UXTAB16, and UXTB16 
instructions. Also adds support for the GE[3:0] bits in the PSRs. 


All other values are reserved. 
In Armv8-A the only permitted value is 0b0011. 


The SIMD field relates only to implemented instructions that perform SIMD operations on the 
general-purpose registers. In an implementation that supports floating-point and Advanced SIMD 
instructions, MVFRO, MVFR1, and MVFR2 give information about the implemented Advanced 
SIMD instructions. 
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Saturate, bits [3:0] 
Indicates the implemented Saturate instructions. Defined values are: 


0b0000 None implemented. This means no non-Advanced SIMD saturate instructions are 
implemented. 


0b0001 Adds the QADD, QDADD, QDSUB, and QSUB instructions, and the Q bit in the PSRs. 
All other values are reserved. 


In Armv8-A, the only permitted value is @b0001. 


Accessing the ID_ISAR3_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_ISAR3_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0010 0b011 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_ISAR3_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR3_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR3_EL1; 
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D13.2.66 


SynchPrim_frac 


D13-3146 


ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4 
The ID ISAR4 ELI characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 


Must be interpreted with ID_ISARO EL1,1D_ISAR1_EL1,ID_ISAR2 ELI, ID_ISAR3 ELI, and 
ID_ISARS_ELI. 





For general information about the interpretation of the ID registers, see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 


AArch64 System register ID ISAR4_ EL1[31:0] is architecturally mapped to AArch32 System 
register ID ISAR4[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_ISAR4 EL] is a 64-bit register. 


Field descriptions 


The ID_ISAR4 EL] bit assignments are: 


63 32 31 28 27 24 23 20 19., 16 15.,,12 11 8 7 


4 3...0 
RESO wr ven] [e SMC | Writeback | WithShifts | Unpriv 


Bits [63:32] 








Reserved, RESO. 


SWP frac, bits [31:28] 


Indicates support for the memory system locking the bus for SWP or SWPB instructions. Defined 
values are: 


0b0000 SWP or SWPB instructions not implemented. 


0b0001 SWP or SWPB implemented but only in a uniprocessor context. SWP and SWPB do not 
guarantee whether memory accesses from other masters can come between the load 
memory access and the store memory access of the SWP or SWPB. 


All other values are reserved. This field is valid only if the ID ISARO.Swap_instrs field is @b0000. 
In Armv8-A, the only permitted value is 0b0000. 


PSR_M, bits [27:24] 
Indicates the implemented M profile instructions to modify the PSRs. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the M profile forms of the CPS, MRS, and MSR instructions. 
All other values are reserved. 


In Armv8-A, the only permitted value is 0b0000. 
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SynchPrim_frac, bits [23:20] 


Used in conjunction with ID_ISAR3.SynchPrim to indicate the implemented Synchronization 
Primitive instructions. Possible values are: 


0b0000 If SynchPrim == @b0000, no Synchronization Primitives implemented. If SynchPrim == 
0b0001, adds the LDREX and STREX instructions. If SynchPrim == 0b0010, also adds 
the CLREX, LDREXB, LDREXH, STREXB, STREXH, LDREXD, and STREXD 
instructions. 


0b0011 If SynchPrim == 0b0001, adds the LDREX, STREX, CLREX, LDREXB, LDREXH, 
STREXB, and STREXH instructions. 


All other combinations of SynchPrim and SynchPrim_frac are reserved. 


In Armv8-A, the only permitted value is 0b0000. 


Barrier, bits [19:16] 


Indicates the implemented Barrier instructions in the A32 and T32 instruction sets. Defined values 
are: 


0b0000 None implemented. Barrier operations are provided only as System instructions in the 
(coproc==0b1111) encoding space. 


Qb0001 Adds the DMB, DSB, and ISB barrier instructions. 
All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 


SMC, bits [15:12] 
Indicates the implemented SMC instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the SMC instruction. 
All other values are reserved. 
In Armv8-A, the permitted values are 0b0001 and 0b0000. 
If EL1 cannot use AArch32, then this field has the value 0b0000. 


Writeback, bits [11:8] 
Indicates the support for Writeback addressing modes. Defined values are: 


0b0000 Basic support. Only the LDM, STM, PUSH, POP, SRS, and RFE instructions support 
writeback addressing modes. These instructions support all of their writeback 
addressing modes. 


0b0001 Adds support for all of the writeback addressing modes. 
All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 


WithShifts, bits [7:4] 
Indicates the support for instructions with shifts. Defined values are: 
0b0000 Nonzero shifts supported only in MOV and shift instructions. 
0b0001 Adds support for shifts of loads and stores over the range LSL 0-3. 


0b0011 As for 0b0001, and adds support for other constant shift options, both on load/store and 
other instructions. 


0b0100 As for 0b0011, and adds support for register-controlled shift options. 
All other values are reserved. 


In Armv8-A, the only permitted value is 0b0100. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3147 
Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


Unpriv, bits [3:0] 
Indicates the implemented unprivileged instructions. Defined values are: 
0b0000 None implemented. No T variant instructions are implemented. 
0b0001 Adds the LDRBT, LDRT, STRBT, and STRT instructions. 
0b0010 As for 0b0001, and adds the LDRHT, LDRSBT, LDRSHT, and STRHT instructions. 
All other values are reserved. 


In Armv8-A, the only permitted value is 0b0010. 


Accessing the ID_ISAR4_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_ISAR4_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0010 0b100 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_ISAR4_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR4_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR4_EL1; 
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D13.2.67 ID_ISAR5_EL1, AArch32 Instruction Set Attribute Register 5 


The ID ISAR5_EL1 characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 


Must be interpreted with ID_ISARO EL1,ID_ISAR1_EL1,ID_ISAR2 ELI, ID_ISAR3 ELI, and 
ID_ISAR4 ELI. 


For general information about the interpretation of the ID registers, see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 





Configurations 


AArch6é4 System register ID ISAR5_EL1[31:0] is architecturally mapped to AArch32 System 
register ID ISARS5[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_ISARS_EL1 is a 64-bit register. 


Field descriptions 


The ID_ISAR5_ EL] bit assignments are: 


32 31 28 27 ., 2423 .. 2019 1615 .. 12 11 


ARM DDI 0487E.a 
ID070919 


Bits [63:32] 


Reserved, RESO. 


VCMA, bits [31:28] 
From ARMV8.3: 


Indicates AArch32 support for complex number addition and multiplication where numbers are 
stored in vectors. Defined values are: 


0b0000 The VCMLA and VCADD instructions are not implemented in AArch32. 
0b0001 The VCMLA and VCADD instructions are implemented in AArch32. 
All other values are reserved. 
ARMv8.3-CompNum implements the functionality identified by 0b0001. 
In Armv8.0, Armv8.1, and Armv8.2, the only permitted value is 0b0000. 
From Armv8.3, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 


RDM, bits [27:24] 
From ARMVv8.1: 


Indicates whether the VQRDMLAH and VQRDMLSH instructions are implemented in AArch32 
state. Defined values are: 


0b0000 No VQRDMLAH and VQRDMLSH instructions implemented. 
0b0001 VQRDMLAH and VQRDMLSH instructions implemented. 
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All other values are reserved. 
implements the functionality identified by the value 0b0001. 
In Armv8.0, the only permitted value is 0b0000. 
From Armv8.1, the only permitted value is 0b0001. 
Otherwise: 


Reserved, RESO. 


Bits [23:20] 


Reserved, RESO. 


CRC32, bits [19:16] 
Indicates whether the CRC32 instructions are implemented in AArch32 state. 
0b0000 No CRC32 instructions implemented. 


0b0001 CRC32B, CRC32H, CRC32W, CRC32CB, CRC32CH, and CRC32CW instructions 
implemented. 


All other values are reserved. 
In Armv8.0, the permitted values are 0b0000 and 0b0001. 
From Armv8.1, the only permitted value is 0b0001. 


SHA2, bits [15:12] 
Indicates whether the SHA2 instructions are implemented in AArch32 state. 
0b0000 No SHA2 instructions implemented. 
0b0001 SHA256H, SHA256H2, SHA256SU0, and SHA256SU1 implemented. 
All other values are reserved. 


In Armv8-A, the permitted values are 0b0000 and 0b0001. 


SHA1, bits [11:8] 
Indicates whether the SHA1 instructions are implemented in AArch32 state. 
0b0000 No SHA1 instructions implemented. 
0b0001 SHAIC, SHA1P, SHAIM, SHAIH, SHA1SU0, and SHA1SU1 implemented. 
All other values are reserved. 
In Armv8-A, the permitted values are 0b0000 and 0b0001. 


AES, bits [7:4] 
Indicates whether the AES instructions are implemented in AArch32 state. 
0b0000 No AES instructions implemented. 
0b0001 AESE, AESD, AESMC, and AESIMC implemented. 


0b0010 As for 0b0001, plus VMULL (polynomial) instructions operating on 64-bit data 
quantities. 


All other values are reserved. 
In Armv8-A, the permitted values are 0b0000 and 0b0010. 


SEVL, bits [3:0] 
Indicates whether the SEVL instruction is implemented in AArch372 state. 
0b0000 SEVL is implemented as a NOP. 
0b0001 SEVL is implemented as Send Event Local. 
All other values are reserved. 


In Armv8-A, the only permitted value is 0b0001. 
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Accessing the ID_ISAR5_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_ISAR5_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0010 0b101 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_ISAR5_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR5_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR5_EL1; 
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D13.2.68 


D13-3152 


ID_ISAR6_EL1, AArch32 Instruction Set Attribute Register 6 


The ID ISAR6_EL1 characteristics are: 





Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 
Must be interpreted with ID ISARO EL1, ID ISARI EL1,ID ISAR2 EL1,ID ISAR3 EL], 
ID_ISAR4 EL1 and ID_ISAR5_EL1. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 
AArch64 System register ID ISAR6_EL1[31:0] is architecturally mapped to AArch32 System 
register ID ISAR6[31:0]. 
This register is present only from ARMv8.2. Otherwise, direct accesses to ID ISAR6_ EL] are 
RESO. 
In an implementation that supports only AArch64 state, this register is UNKNOWN. 
RW fields in this register reset to architecturally UNKNOWN values. 
This register is introduced in ARMV8.2. 

Attributes 


ID_ISAR6_ EL] is a 64-bit register. 


Field descriptions 


The ID ISAR6_EL1 bit assignments are: 


20 19 16 15 12 11 


63 8 7 4 3 0 
| RESO | seors | SB FHM DP JSCVT 


Bits [63:20] 


Reserved, RESO. 


SPECRES, bits [19:16] 


Speculation invalidation instruction support in AArch32 state. Defined values are: 


0b0000 CFPRCTX, DVPRCTX, and CPPRCTX instructions are not implemented. 


0b0001 CFPRCTX, DVPRCTX, and CPPRCTX instructions are implemented. 
All other values are reserved. 


From Armv8.5, the only permitted value is 0b0001. 


SB, bits [15:12] 


SB instruction support in AArch64 state. Defined values are: 
0b0000 SB instruction is not implemented. 

0b0001 SB instruction is implemented. 

All other values are reserved. 


From Armv8.5, the only permitted value is 0b0001. 


FHM, bits [11:8] 
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0b0001 VFMAL and VMEFSL instructions are implemented. 


ARMv8.2-FHM implements the functionality identified by the value 0b0001. 


In Armv8.0 and Armv8.1, the only permitted value is 0b0000. 
In Armv8.2, the permitted values are 0b0000 and 0b0001. 
DP, bits [7:4] 
Indicates the support for dot product instructions in AArch32 state. 
0b0000 No dot product instructions are implemented. 
0b0001 VUDOT and VSDOT instructions are implemented. 


All other values are reserved. 


ARMv8.2-DotProd implements the functionality identified by the value 0b0001. 


In Armv8.0 and Armv8.1, the only permitted value is 0b0000. 
In Armv8.2, the permitted values are 0b0000 and 0b0001. 
JSCVT, bits [3:0] 
From ARMv8.3: 


Indicates whether the Javascript conversion instruction is implemented in AArch32 state. Defined 


values are: 
0b0000 The VJCVT instruction is not implemented. 
0b0001 The VJCVT instruction is implemented. 


All other values are reserved. 


ARMVv8.3-JSConv implements the functionality identified by 0b0001. 
In Armv8.0, Armv8.1, and Armv8.2, the only permitted value is 0b0000. 


From Armv8.3, the only permitted value is 0b0001. 
Otherwise: 


Reserved, RESO. 


Accessing the ID_ISAR6_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_ISAR6_EL1 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b0000 


0b0010 


0b111 





if PSTATE.EL == EL@ then 
if IsFeatureImp]lemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_ISAR6_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR6_EL1; 
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elsif PSTATE.EL == EL3 then 
return ID_ISAR6_EL1; 
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D13.2.69 ID_MMFRO_EL1, AArch32 Memory Model Feature Register 0 


The ID MMFRO ELI characteristics are: 


63 


ARM DDI 0487E.a 
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Purpose 


Provides information about the implemented memory model and memory management support in 
AArch32 state. 


Must be interpreted with ID. MMFR1_EL1, ID MMFR2 ELI, ID_MMFR3 ELI, and 
ID MMFR4 ELI. 





For general information about the interpretation of the ID registers see Principles of the ID scheme 


for fields in ID registers on page D13-2823. 


Configurations 


Attributes 


AArch64 System register ID MMFRO_EL1[31:0] is architecturally mapped to AArch32 System 
register ID MMFRO[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 
RW fields in this register reset to architecturally UNKNOWN values. 


ID_MMFRO EL] is a 64-bit register. 


Field descriptions 


The ID MMFRO EL] bit assignments are: 


32 31 28 27 .. 24 23 20 19., 1615 12 11 


RESO ona FCSE notes TCM | ShareLvi | OuterShr | PMSA ale VMSA 


Bits [63:32] 


Reserved, RESO. 


InnerShr, bits [31:28] 


Innermost Shareability. Indicates the innermost shareability domain implemented. Defined values 
are: 


0b0000 Implemented as Non-cacheable. 

0b0001 Implemented with hardware coherency support. 
Qb1111 Shareability ignored. 

All other values are reserved. 

From Armv8 the permitted values are 0b0000, 0b0001, and 0b1111. 


This field is valid only if the implementation supports two levels of shareability, as indicated by 
ID_MMFRO_EL1.ShareLvl having the value b0001. 


When ID_ MMFRO EL1.ShareLvl is zero, this field is UNK. 


FCSE, bits [27:24] 


Indicates whether the implementation includes the FCSE. Defined values are: 
0b0000 Not supported. 

0b0001 Support for FCSE. 

All other values are reserved. 


From Armv8 the only permitted value is 0b0000. 
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AuxReg, bits [23:20] 
Auxiliary Registers. Indicates support for Auxiliary registers. Defined values are: 
0b0000 None supported. 
0b0001 Support for Auxiliary Control Register only. 


0b0010 Support for Auxiliary Fault Status Registers (AIFSR and ADFSR) and Auxiliary 
Control Register. 


All other values are reserved. 


From Armvé the only permitted value is 0b0019. 





Note 


Accesses to unimplemented Auxiliary registers are UNDEFINED. 





TCM, bits [19:16] 
Indicates support for TCMs and associated DMAs. Defined values are: 
0b0000 Not supported. 
0b0001 Support is IMPLEMENTATION DEFINED. Armv7 requires this setting. 
0b0010 Support for TCM only, Armv6 implementation. 
0b0011 Support for TCM and DMA, Armv6 implementation. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


ShareLvl, bits [15:12] 
Shareability Levels. Indicates the number of shareability levels implemented. Defined values are: 
0b0000 One level of shareability implemented. 
0b0001 Two levels of shareability implemented. 
All other values are reserved. 


From Armvé the only permitted value is 0b0001. 


OuterShr, bits [11:8] 


Outermost Shareability. Indicates the outermost shareability domain implemented. Defined values 
are: 


0b0000 Implemented as Non-cacheable. 

0b0001 Implemented with hardware coherency support. 
Qb1111 Shareability ignored. 

All other values are reserved. 


From Armv8 the permitted values are 0b0000, 0b0001, and 0b1111. 


PMSA, bits [7:4] 
Indicates support for a PMSA. Defined values are: 
0b0000 Not supported. 
0b0001 Support for IMPLEMENTATION DEFINED PMSA. 
0b0010 Support for PMSAv6, with a Cache Type Register implemented. 
Qb0011 Support for PMSAv7, with support for memory subsections. Armv7-R profile. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 
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VMSA, bits [3:0] 
Indicates support fora VMSA. Defined values are: 
0b0000 Not supported. 
0b0001 Support for IMPLEMENTATION DEFINED VMSA. 
0b0010 Support for VMSAv6, with Cache and TLB Type Registers implemented. 


0b0011 Support for VMSAv7, with support for remapping and the Access flag. Armv7-A 
profile. 


0b0100 As for 0b0011, and adds support for the PXN bit in the Short-descriptor translation table 
format descriptors. 


0b0101 As for @b0100, and adds support for the Long-descriptor translation table format. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0101. 


Accessing the ID_MMFRO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_MMFRO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0001 0b100 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_MMFROQ_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_MMFROQ_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_MMFROQ_EL1; 
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D13.2.70 ID_MMFR1_EL1, AArch32 Memory Model Feature Register 1 


The ID MMFR1 ELI characteristics are: 





Purpose 
Provides information about the implemented memory model and memory management support in 
AArch32 state. 
Must be interpreted with ID MMFRO_EL1, ID MMFR2 EL1, ID MMFR3_ ELI, and 
ID_MMFR4 ELI. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 
AArch64 System register ID MMFR1_EL1[31:0] is architecturally mapped to AArch32 System 
register ID MMFR1[31:0]. 
In an implementation that supports only AArch64 state, this register is UNKNOWN. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ID_MMEFR1 EL] is a 64-bit register. 


Field descriptions 


The ID MMFRI1 EL] bit assignments are: 


63 32 31.28 27 24 23.2019. 1615 12 11 7 


RESO BPred | L1TstCIn | L1Uni | L1Hvd | L1UniSW | L1HvdSW | L1UniVA i L1HvdVA 


Bits [63:32] 
Reserved, RESO. 

BPred, bits [31:28] 
Branch Predictor. Indicates branch predictor management requirements. Defined values are: 
0b0000 No branch predictor, or no MMU present. Implies a fixed MPU configuration. 
0b0001 Branch predictor requires flushing on: 


7 Enabling or disabling a stage of address translation. 
. Writing new data to instruction locations. 
. Writing new mappings to the translation tables. 


: Changes to the TTBRO, TTBR1, or TTBCR registers. 
e Changes to the ContextID or ASID, or to the FCSE ProcessID if this is supported. 
0b0010 Branch predictor requires flushing on: 


š Enabling or disabling a stage of address translation. 
s Writing new data to instruction locations. 
. Writing new mappings to the translation tables. 


a Any change to the TTBRO, TTBR1, or TTBCR registers without a change to the 
corresponding ContextID or ASID, or FCSE ProcessID if this is supported. 


0b0011 Branch predictor requires flushing only on writing new data to instruction locations. 
0b0100 For execution correctness, branch predictor requires no flushing at any time. 


All other values are reserved. 
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In Armv8-A the permitted values are 0b0010, 0b0011, or 0b0100. For values other than @b0000 and 
0b0100 the Arm Architecture Reference Manual, or the product documentation, might give more 
information about the required maintenance. 


L1TstCln, bits [27:24] 


Level 1 cache Test and Clean. Indicates the supported Level 1 data cache test and clean operations, 
for Harvard or unified cache implementations. Defined values are: 


0b0000 None supported. 

0b0001 Supported Level 1 data cache test and clean operations are: 
. Test and clean data cache. 

0b0010 As for 0001, and adds: 
° Test, clean, and invalidate data cache. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


L1Uni, bits [23:20] 


Level 1 Unified cache. Indicates the supported entire Level 1 cache maintenance operations for a 
unified cache implementation. Defined values are: 


0b0000 None supported. 


0b0001 Supported entire Level 1 cache operations are: 
° Invalidate cache, including branch predictor if appropriate. 
° Invalidate branch predictor, if appropriate. 


Qb0010 As for 0001, and adds: 


° Clean cache, using a recursive model that uses the cache dirty status bit. 
° Clean and invalidate cache, using a recursive model that uses the cache dirty 
status bit. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


L1Hvd, bits [19:16] 


Level 1 Harvard cache. Indicates the supported entire Level 1 cache maintenance operations for a 
Harvard cache implementation. Defined values are: 


0b0000 None supported. 


0b0001 Supported entire Level 1 cache operations are: 
e Invalidate instruction cache, including branch predictor if appropriate. 
° Invalidate branch predictor, if appropriate. 


0b0010 As for 0001, and adds: 


e Invalidate data cache. 
° Invalidate data cache and instruction cache, including branch predictor if 
appropriate. 


0b0011 As for 0010, and adds: 


. Clean data cache, using a recursive model that uses the cache dirty status bit. 
° Clean and invalidate data cache, using a recursive model that uses the cache dirty 
status bit. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 
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D13-3160 


L1UniSW, bits [15:12] 


Level 1 Unified cache by Set/Way. Indicates the supported Level 1 cache line maintenance 
operations by set/way, for a unified cache implementation. Defined values are: 


0b0000 None supported. 

0b0001 Supported Level 1 unified cache line maintenance operations by set/way are: 
° Clean cache line by set/way. 

0b0010 As for 0001, and adds: 
e Clean and invalidate cache line by set/way. 

0b0011 As for 0010, and adds: 
° Invalidate cache line by set/way. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


L1HvdSW, bits [11:8] 


Level 1 Harvard cache by Set/Way. Indicates the supported Level 1 cache line maintenance 
operations by set/way, for a Harvard cache implementation. Defined values are: 


0b0000 None supported. 


0b0001 Supported Level 1 Harvard cache line maintenance operations by set/way are: 
° Clean data cache line by set/way. 
. Clean and invalidate data cache line by set/way. 


0b0010 As for 0001, and adds: 

° Invalidate data cache line by set/way. 
Qb0011 As for 0010, and adds: 

° Invalidate instruction cache line by set/way. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


L1UniVA, bits [7:4] 


Level 1 Unified cache by Virtual Address. Indicates the supported Level 1 cache line maintenance 
operations by VA, for a unified cache implementation. Defined values are: 


0b0000 None supported. 
0b0001 Supported Level 1 unified cache line maintenance operations by VA are: 
. Clean cache line by VA. 
° Invalidate cache line by VA. 
° Clean and invalidate cache line by VA. 
0b0010 As for 0001, and adds: 
. Invalidate branch predictor by VA, if branch predictor is implemented. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


L1HvdVA, bits [3:0] 


Level 1 Harvard cache by Virtual Address. Indicates the supported Level 1 cache line maintenance 
operations by VA, for a Harvard cache implementation. Defined values are: 


0b0000 None supported. 

0b0001 Supported Level 1 Harvard cache line maintenance operations by VA are: 
° Clean data cache line by VA. 
° Invalidate data cache line by VA. 
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. Clean and invalidate data cache line by VA. 

e Clean instruction cache line by VA. 
0b0010 As for 0001, and adds: 

° Invalidate branch predictor by VA, if branch predictor is implemented. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


Accessing the ID_MMFR1_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_MMFR1_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0001 0b101 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_MMFR1_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_MMFR1_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_MMFR1_EL1; 
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D13.2.71 


D13-3162 


63 
| RESO 


ID_MMFR2_EL1, AArch32 Memory Model Feature Register 2 


The ID MMFR2 ELI characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch32 state. 


Must be interpreted with ID. MMFRO_EL1,ID_MMFRI_ELI, ID_MMFR3 ELI, and 
ID MMFR4 ELI. 





For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 


AArch64 System register ID MMFR2_EL1[31:0] is architecturally mapped to AArch32 System 
register ID MMFR2[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_MMFR2 EL] is a 64-bit register. 


Field descriptions 


The ID MMFR2 EL] bit assignments are: 


32 31 28 27 24 23 2019. 1615 .. 12 11 


HWAccFlg | WFIStall | MemBarr | UniTLB | HvdTLB | L1HvdRng | L1HvdBG | L1HvdFG 


Bits [63:32] 





Reserved, RESO. 


HWAccFlg, bits [31:28] 


Hardware Access Flag. In earlier versions of the Arm Architecture, this field indicates support for 
a Hardware Access flag, as part of the VMSAv7 implementation. Defined values are: 


0b0000 Not supported. 
0b0001 Support for VMSAv7 Access flag, updated in hardware. 
All other values are reserved. 


From Armvé8 the only permitted value is 0b0000. 


WFEIStall, bits [27:24] 


Wait For Interrupt Stall. Indicates the support for Wait For Interrupt (WFI) stalling. Defined values 
are: 


0b0000 Not supported. 
0b0001 Support for WFI stalling. 
All other values are reserved. 


From Armv8 the permitted values are 0b0000 and 0b0001. 


MemBarr, bits [23:20] 


Memory Barrier. Indicates the supported memory barrier System instructions in the 
(coproc==0b1111) encoding space: 


0b0000 None supported. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


0b0001 Supported memory barrier System instructions are: 
€ Data Synchronization Barrier (DSB). 
0b0010 As for 0001, and adds: 
a Instruction Synchronization Barrier (ISB). 
a Data Memory Barrier (DMB). 
All other values are reserved. 
From Armv8 the only permitted value is 0b0010. 
Arm deprecates the use of these operations. ID_ISAR4.Barrier_instrs indicates the level of support 
for the preferred barrier instructions. 
UniTLB, bits [19:16] 


Unified TLB. Indicates the supported TLB maintenance operations, for a unified TLB 
implementation. Defined values are: 


0b0000 Not supported. 
0b0001 Supported unified TLB maintenance operations are: 
a Invalidate all entries in the TLB. 
, Invalidate TLB entry by VA. 
0b0010 As for 0001, and adds: 
od Invalidate TLB entries by ASID match. 
0b0011 As for 0010, and adds: 


? Invalidate instruction TLB and data TLB entries by VA All ASID. This is a 
shared unified TLB operation. 


0b0100 As for 0011, and adds: 
s Invalidate Hyp mode unified TLB entry by VA. 
8 Invalidate entire Non-secure PL1&0 unified TLB. 
â Invalidate entire Hyp mode unified TLB. 


0b0101 As for 0b0100, and adds the following operations: TLBIMVALIS, TLBIMVAALIS, 
TLBIMVALHIS, TLBIMVAL, TLBIMVAAL, TLBIMVALH. 


0b0110 As for 0b0101, and adds the following operations: TLBIIPAS2IS, TLBIIPAS2LIS, 
TLBIIPAS2, TLBIIPAS2L. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0110. 


HvdTLB, bits [15:12] 
If the Unified TLB field (UniTLB, bits [19:16]) is not 0000, then the meaning of this field is 
IMPLEMENTATION DEFINED. Arm deprecates the use of this field by software. 

L1HvdRng, bits [11:8] 


Level 1 Harvard cache Range. Indicates the supported Level 1 cache maintenance range operations, 
for a Harvard cache implementation. Defined values are: 


0b0000 Not supported. 
0b0001 Supported Level 1 Harvard cache maintenance range operations are: 
s Invalidate data cache range by VA. 
s Invalidate instruction cache range by VA. 
s Clean data cache range by VA. 
e Clean and invalidate data cache range by VA. 
All other values are reserved. 


From Armvé8 the only permitted value is 0b0000. 
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L1HvdBG, bits [7:4] 


Level 1 Harvard cache Background fetch. Indicates the supported Level 1 cache background fetch 
operations, for a Harvard cache implementation. When supported, background fetch operations are 
non-blocking operations. Defined values are: 


0b0000 Not supported. 

0b0001 Supported Level 1 Harvard cache background fetch operations are: 
e Fetch instruction cache range by VA. 
° Fetch data cache range by VA. 

All other values are reserved. 


From Armyv8 the only permitted value is 0b0000. 


L1HvdFG, bits [3:0] 


Level 1 Harvard cache Foreground fetch. Indicates the supported Level 1 cache foreground fetch 
operations, for a Harvard cache implementation. When supported, foreground fetch operations are 
blocking operations. Defined values are: 


0b0000 Not supported. 

0b0001 Supported Level 1 Harvard cache foreground fetch operations are: 
e Fetch instruction cache range by VA. 
° Fetch data cache range by VA. 

All other values are reserved. 


From Armv8 the only permitted value is 0b0000. 


Accessing the ID_MMFR2_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_MMFR2_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0001 0b110 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_MMFR2_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_MMFR2_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_MMFR2_EL1; 
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63 
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The ID MMFR3_ELI characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch32 state. 


Must be interpreted with ID. MMFRO_EL1,ID_MMFRI_ELI, ID. MMFR2 ELI, and 
ID MMFR4 ELI. 





For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 
Configurations 


AArch64 System register ID MMFR3_EL1[31:0] is architecturally mapped to AArch32 System 
register ID MMFR3[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_MMFR3_ EL] is a 64-bit register. 


Field descriptions 


The ID MMFR3 EL] bit assignments are: 


32 31 28 27 24 23 20 19, 16 15 12 11 8 3 


0 
RESO sre ewes [eon PAN [ranees BPMaint | CMaintSW | CMaintVA 


Bits [63:32] 


Reserved, RESO. 


Supersec, bits [31:28] 


Supersections. On a VMSA implementation, indicates whether Supersections are supported. 
Defined values are: 


0b0000 Supersections supported. 
0b1111 Supersections not supported. 
All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b1111. 


CMems&z, bits [27:24] 


Cached Memory Size. Indicates the physical memory size supported by the caches. Defined values 
are: 


0b0000 4GB, corresponding to a 32-bit physical address range. 

0b0001 64GB, corresponding to a 36-bit physical address range. 

0b0010 1TB or more, corresponding to a 40-bit or larger physical address range. 
All other values are reserved. 

In Armv8-A the permitted values are 0b0000, 0b0001, and 0b0010. 
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CohWalk, bits [23:20] 


Coherent Walk. Indicates whether Translation table updates require a clean to the Point of 
Unification. Defined values are: 


0b0000 Updates to the translation tables require a clean to the Point of Unification to ensure 
visibility by subsequent translation table walks. 


0b0001 Updates to the translation tables do not require a clean to the Point of Unification to 
ensure visibility by subsequent translation table walks. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


PAN, bits [19:16] 
From ARMV8.1: 


Privileged Access Never. Indicates support for the PAN bit in CPSR, SPSR, and DSPSR in AArch32 
state. Defined values are: 


0b0000 PAN not supported. 
0b0001 PAN supported. 
0b0010 PAN supported and ATS1CPRP and ATS1CPWP instructions supported. 
All other values are reserved. 
ARMv8.1-PAN implements the functionality identified by the value 0b0001. 
ARMv8.2-ATS1E1 implements the functionality added by the value 0b0019. 
In Armv8.1 the value @b0000 is not permitted. 
From Armv8.2, the only permitted value is 0b0010. 
Otherwise: 


Reserved, RESO. 


MaintBest, bits [15:12] 


Maintenance Broadcast. Indicates whether Cache, TLB, and branch predictor operations are 
broadcast. Defined values are: 


0b0000 Cache, TLB, and branch predictor operations only affect local structures. 


0b0001 Cache and branch predictor operations affect structures according to shareability and 
defined behavior of instructions. TLB operations only affect local structures. 


0b0010 Cache, TLB, and branch predictor operations affect structures according to shareability 
and defined behavior of instructions. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


BPMaint, bits [11:8] 


Branch Predictor Maintenance. Indicates the supported branch predictor maintenance operations in 
an implementation with hierarchical cache maintenance operations. Defined values are: 


0b0000 None supported. 

0b0001 Supported branch predictor maintenance operations are: 
. Invalidate all branch predictors. 

0b0010 As for 0001, and adds: 
: Invalidate branch predictors by VA. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 
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CMaintSW, bits [7:4] 


Cache Maintenance by Set/Way. Indicates the supported cache maintenance operations by set/way, 
in an implementation with hierarchical caches. Defined values are: 


0b0000 None supported. 


0b0001 Supported hierarchical cache maintenance instructions by set/way are: 
° Invalidate data cache by set/way. 
° Clean data cache by set/way. 
e Clean and invalidate data cache by set/way. 


All other values are reserved. 
In Armv8-A the only permitted value is 0b0001. 
In a unified cache implementation, the data cache maintenance operations apply to the unified 
caches. 
CMaintVA, bits [3:0] 


Cache Maintenance by Virtual Address. Indicates the supported cache maintenance operations by 
VA, in an implementation with hierarchical caches. Defined values are: 


0b0000 None supported. 
0b0001 Supported hierarchical cache maintenance operations by VA are: 
° Invalidate data cache by VA. 
° Clean data cache by VA. 
e Clean and invalidate data cache by VA. 
° Invalidate instruction cache by VA. 
. Invalidate all instruction cache entries. 
All other values are reserved. 
In Armv8-A the only permitted value is 0b0001. 


In a unified cache implementation, data cache maintenance operations apply to the unified caches, 
and the instruction cache maintenance instructions are not implemented. 


Accessing the ID_MMFR3_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_LMMFR3_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0001 0b111 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_MMFR3_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_MMFR3_EL1; 
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elsif PSTATE.EL == EL3 then 
return ID_MMFR3_EL1; 
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D13.2.73 ID_MMFR4_EL1, AArch32 Memory Model Feature Register 4 
The ID MMFR4 ELI characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch32 state. 


Must be interpreted with ID. MMFRO_EL1,ID_MMFRI_ELI, ID. MMFR2_ ELI, and 
ID MMFR3 ELI. 





For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 
Configurations 


AArch64 System register ID MMFR4_ EL1[31:0] is architecturally mapped to AArch32 System 
register ID MMFR4{[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_MMFR4 EL] isa 64-bit register. 


Field descriptions 


The ID MMFR4 EL] bit assignments are: 


63 32 31 |, 28 27 24 23 ., 2019 .. 1615 .. 12 11 


Bits [63:32] 


Reserved, RESO. 


EVT, bits [31:28] 
When ARMV8.2-EVT is implemented: 


Enhanced Virtualization Traps. If EL2 is implemented, indicates support for the HCR2.{TTLBIS, 
TOCU, TICAB, TID4} traps. Defined values are: 


0b0000 HCR2.{TTLBIS, TOCU, TICAB, TID4} traps are not supported. 


0b0001 HCR2.{TOCU, TICAB, TID4} traps are supported. HCR2.TTLBIS trap is not 
supported. 


0b0010 HCR2.{TTLBIS, TOCU, TICAB, TID4} traps are supported. 

All other values are reserved. 

In Armv8.0, the only permitted value is 0b0000. 

From Armv8.1, the permitted values are 0b0000, 0b0001, and 0b0010. 

From Armv8.5 the permitted values are: 

° 0b0000 when EL2 is not implemented. 

° 0b0001 when EL2 is implemented. This feature is identified as ARMv8.2-EVT. 
Otherwise: 


Reserved, RESO. 
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CCIDX, bits [27:24] 


From ARMV8.3: 


Support for use of the revised CCSIDR format and the presence of the CCSIDR2 is indicated. 
Defined values are: 


0b0000 32-bit format implemented for all levels of the CCSIDR, and the CCSIDR2 register is 
not implemented. 


0b0001 64-bit format implemented for all levels of the CCSIDR, and the CCSIDR2 register is 
implemented. 


All other values are reserved. 


From Armv8.3, the permitted values are 0b0000 and 0b0001. This feature is identified as 
ARMv8.3-CCIDX. 


Otherwise: 


Reserved, RAZ. 


LSM, bits [23:20] 


From ARMvé8.2: 
Indicates support for LSMAOE and nTLSMD bits in HSCTLR and SCTLR. Defined values are: 
0b0000 LSMAOE and nTLSMD bits not supported. 
0b0001 LSMAOE and nTLSMD bits supported. 
All other values are reserved. 
ARMv8.2-LSMAOC implements the functionality identified by the value 0b0001. 
Otherwise: 


Reserved, RAZ. 


HPDS, bits [19:16] 


From ARMvé8.2: 
Hierarchical permission disables bits in translation tables. Defined values are: 
0b0000 Disabling of hierarchical controls not supported. 


0b0001 Supports disabling of hierarchical controls using the TTBCR2.HPDO, TTBCR2.HPD1, 
and HTCR.HPD bits. 


0b0010 As for value @b0001, and adds possible hardware allocation of bits[62:59] of the 
translation table descriptors from the final lookup level for IMPLEMENTATION DEFINED 
use. 


All other values are reserved. 
ARMv8.2-AA32HPD implements the functionality identified by the value 0b0001. 
ARMv8.2-TTPBHA implements the functionality added by the value 0b0010. 


Note 
The value 0b0000 implies that the encoding for TTBCR2 is UNDEFINED. 








Otherwise: 


Reserved, RAZ. 


CnP, bits [15:12] 


From ARMV8.2: 
Common not Private translations. Defined values are: 
0b0000 Common not Private translations not supported. 
0b0001 Common not Private translations supported. 


All other values are reserved. 
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ARMv8.2-TTCNP implements the functionality identified by the value 0b0001. 
From Armv8.2 the only permitted value is @b0001. 
Otherwise: 


Reserved, RAZ. 


XNX, bits [11:8] 
From ARMv8.2: 
Support for execute-never control distinction by Exception level at stage 2. Defined values are: 
0b0000 Distinction between ELO and EL1 execute-never control at stage 2 not supported. 
0b0001 Distinction between ELO and EL1 execute-never control at stage 2 supported. 
All other values are reserved. 
ARMv8.2-TTS2UXN implements the functionality identified by the value 0b0001. 
When ARMv8.2-TTS2UXN is implemented: 


è If all of the following conditions are true it is IMPLEMENTATION DEFINED whether the value 
of ID_MMFR4_EL1.XNX is 0b0000 or 0b0001: 


— ID _AA64MMFRI ELI.XNX ==1. 
—  EL2 cannot use AArch32. 
— ELl can use AArch32. 
° If EL2 can use AArch32 then the only permitted value is 0b0001. 
Otherwise: 


Reserved, RAZ. 


AC2, bits [7:4] 


Indicates the extension of the ACTLR and HACTLR registers using ACTLR2 and HACTLR2. 
Defined values are: 


0b0000 ACTLR2 and HACTLR2 are not implemented. 

0b0001 ACTLR2 and HACTLR2 are implemented. 

All other values are reserved. 

In Armv8.0 and Armv8.1 the permitted values are 0b0000 and 0b0001. 
From Armv8.2, the only permitted value is 0b0001. 


SpecSEI, bits [3:0] 
When RAS is implemented: 


Describes whether the PE can generate SError interrupt exceptions from speculative reads of 
memory, including speculative instruction fetches. The defined values of this field are: 


0b0000 The PE never generates an SError interrupt due to an External abort on a speculative 
read. 

0b0001 The PE might generate an SError interrupt due to an External abort on a speculative 
read. 


All other values are reserved. 
Otherwise: 


Reserved, RESO. This provides no information about whether the PE generates a speculative SError 
interrupt. 


Accessing the ID_MMFR4_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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D13-3172 


MRS <Xt>, ID_MMFR4_EL1 





op0 op1 CRn CRm 


0b11 0b000 0b0000 0b0010 


op2 


0b110 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && (!IsZero(ID_MMFR4_EL1) || boolean IMPLEMENTATION_DEFINED 
"ID_MMFR4_EL1 trapped by HCR_EL2.TID3 and ID_MMFR4 trapped by HCR_EL2.TID3 and HCR.TID3") && HCR_EL2.TID3 


== '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_MMFR4_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_MMFR4_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_MMFR4_EL1; 
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D13.2.74 ID_PFRO_EL1, AArch32 Processor Feature Register 0 
The ID_PFRO ELI characteristics are: 


Purpose 
Gives top-level information about the instruction sets supported by the PE in AArch32 state. 
Must be interpreted with ID PFR1_ ELI. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 


AArch64 System register ID_PFRO_EL1[31:0] is architecturally mapped to AArch32 System 
register [D_PFRO[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_PFRO_EL1 is a 64-bit register. 


Field descriptions 


The ID_PFRO_EL1 bit assignments are: 


32 31 |. 2827 |. 2423 .. 2019 .. 1615 12 11 


i RESO | ras CSV2 | State3 | State2 ie State1 Stated 


Bits [63:32] 


Reserved, RESO. 


RAS, bits [31:28] 
RAS Extension version. 
0b0000 No RAS Extension. 
0b0001 RAS Extension present. 


0b0010 ARMv8.4-RAS present. As @b0001, and adds support for additional ERXMISC<m> 
System registers. 


Error records accessed through System registers conform to RAS System Architecture 
v1.1, which includes simplifications to ERR<n>STATUS, and support for the optional 
RAS Timestamp Extension. 


All other values are reserved. 


From Armv8.4, when ARMv8.4-DFE is not implemented, and ERRIDR.NUM is zero, the 
permitted values are IMPLEMENTATION DEFINED 0b0001 or @b0010. Otherwise from Armv8.4 the only 
permitted value is 0b0010. 


ARMv8.4-RAS implements the functionality identified by the value 0b0019. 
In Armv8.2, the only permitted value is 0b0001. 
In Armv8.1 and Armv8.0, the permitted values are b0000 and 0b0001. 
DIT, bits [27:24] 
From ARMv8.4: 


Data Independent Timing. Defined values are: 


0b0000 AArch32 does not guarantee constant execution time of any instructions. 
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0b0001 AArch32 provides the CPSR.DIT mechanism to guarantee constant execution time of 
certain instructions. 


All other values are reserved. 
ARMv8.4-DIT implements the functionality identified by the value 0b0001. 
From Armv8.4, the only permitted value is 0b0001. 

Otherwise: 


Reserved, RESO. 


AMU, bits [23:20] 

From ARMv8.4: 
Activity Monitors Extension. Defined values are: 
0b0000 Activity Monitors Extension is not implemented. 
0b0001 Activity Monitors Extension Version 1 is implemented. 
All other values are reserved. 
AMUv1 implements the functionality identified by the value 0b0001. 
In Armv8.0, Armv8.1, Armv8.2, and Armv8.3, the only permitted value is 0b0000. 
From Armv8.4, the permitted values are 0b0000 and 0b0001. 

Otherwise: 


Reserved, RESO. 


CSV2, bits [19:16] 
From ARMv8.5: 
Speculative use of out of context branch targets. Defined values are: 


0b0000 This Device does not disclose whether branch targets trained in one hardware described 
context can affect speculative execution in a different hardware described context. 


0b0001 Branch targets trained in one hardware described context can only affect speculative 
execution in a different hardware described context in a hard-to-determine way. 


From Armvs.5 the only permitted value is 0b0001. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


State3, bits [15:12] 
T32EE instruction set support. Defined values are: 
0b0000 Not implemented. 
0b0001 T32EE instruction set implemented. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


State2, bits [11:8] 
Jazelle extension support. Defined values are: 
0b0000 Not implemented. 
0b0001 Jazelle extension implemented, without clearing of JOSCR.CV on exception entry. 
0b0010 Jazelle extension implemented, with clearing of JOSCR.CV on exception entry. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 
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Statel, bits [7:4] 
T32 instruction set support. Defined values are: 
0b0000 T32 instruction set not implemented. 
0b0001 T32 encodings before the introduction of Thumb-2 technology implemented: 
e All instructions are 16-bit. 
. A BL or BLX is a pair of 16-bit instructions. 
° 32-bit instructions other than BL and BLX cannot be encoded. 


0b0011 T32 encodings after the introduction of Thumb-2 technology implemented, for all 
16-bit and 32-bit T32 basic instructions. 


All other values are reserved. 

In Armv8-A the only permitted value is 0b0011. 
State0, bits [3:0] 

A32 instruction set support. Defined values are: 

0b0000 A32 instruction set not implemented. 

0b0001 A32 instruction set implemented. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Accessing the ID_PFRO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_PFRO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0001 0b000 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_PFROQ_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_PFROQ_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_PFROQ_EL1; 
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D13.2.75 ID_PFR1_EL1, AArch32 Processor Feature Register 1 
The ID_PFR1_EL1 characteristics are: 
Purpose 
Gives information about the AArch32 programmers’ model. 
Must be interpreted with ID PFRO ELI. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 


AArch64 System register ID_PFR1_EL1[31:0] is architecturally mapped to AArch32 System 
register ID_PFR1[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_PFR1_EL1 is a 64-bit register. 


Field descriptions 


The ID_PFR1_EL1 bit assignments are: 


63 32 31,28 27 24 23 20 19 16 15 12 11 


RESO GIC | Virt_frac | Sec_frac cm] fi Security | ProgMod 


Bits [63:32] 





Virtualization 


Reserved, RESO. 


GIC, bits [31:28] 
System register GIC CPU interface. Defined values are: 
0b0000 No System register interface to the GIC CPU interface is supported. 
0b0001 System register interface to versions 3.0 and 4.0 of the GIC CPU interface is supported. 


All other values are reserved. 


Virt_frac, bits [27:24] 


Virtualization fractional field. When the Virtualization field is 0b0000, determines the support for 
features from the ARMv7 Virtualization Extensions. Defined values are: 


0b0000 No features from the ARMv7 Virtualization Extensions are implemented. 
0b0001 The following features of the ARMv7 Virtualization Extensions are implemented: 
a The SCR.SIF bit, if EL3 is implemented. 


e The modifications to the SCR.AW and SCR.FW bits described in the 
Virtualization Extensions, if EL3 is implemented. 


e The MSR (banked register) and MRS (banked register) instructions. 
. The ERET instruction. 

All other values are reserved. 

In Armv8-A the permitted values are: 


a 0b0000 when EL2 is implemented. 
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° 0b0001 when EL2 is not implemented. 

This field is only valid when the value of ID_PFR1_EL1.Virtualization is 0, otherwise it holds the 
value 0b0000. 

Note 


The ID_ISAR registers do not identify whether the instructions added by the ARMv7 Virtualization 
Extensions are implemented. 








Sec_frac, bits [23:20] 


Security fractional field. When the Security field is 0b0000, determines the support for features from 
the ARMv7 Security Extensions. Defined values are: 


0b0000 No features from the ARMv7 Security Extensions are implemented. 

0b0001 The following features from the ARMv7 Security Extensions are implemented: 
. The VBAR register. 
. The TTBCR.PDO and TTBCR.PD1 bits. 


0b0010 As for 0b0001, plus the ability to access Secure or Non-secure physical memory is 
supported. 


All other values are reserved. 
In Armv8-A the permitted values are: 
° 0b0000 when EL3 is implemented. 
s 0b0001 or 0b0010 when EL3 is not implemented. 
This field is only valid when the value of ID_PFR1_EL1.Security is 0, otherwise it holds the value 
0b0000. 
GenTimer, bits [19:16] 
Generic Timer support. Defined values are: 
0b0000 Not implemented. 
Qb0001 Generic Timer implemented. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Virtualization, bits [15:12] 
Virtualization support. Defined values are: 
0b0000 EL2, Hyp mode, and the HVC instruction not implemented. 


0b0001 EL2, Hyp mode, the HVC instruction, and all the features described by Virt_frac == 
0b0001 implemented. 


All other values are reserved. 

In Armv8-A the permitted values are: 

° 0b0000 when EL2 is not implemented. 
à 0b0001 when EL2 is implemented. 


In an implementation that includes EL2, if EL2 cannot use AArch32 but EL1 can use AArch32 then 
this field has the value 0b0001. 


If EL1 cannot use AArch32 then this field has the value 0b0000. 


Note 
The ID_ISARs do not identify whether the HVC instruction is implemented. 
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MProgMod, bits [11:8] 
M profile programmers' model support. Defined values are: 
0b0000 Not supported. 
0b0010 Support for two-stack programmers' model. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


Security, bits [7:4] 
Security support. Defined values are: 
0b0000 EL3, Monitor mode, and the SMC instruction not implemented. 


0b0001 EL3, Monitor mode, the SMC instruction, and all the features described by Sec_ frac == 
0b0001 implemented. 


0b0010 As for 0b0001, and adds the ability to set the NSACR.RFR bit. Not permitted in Armv8 
as the NSACR.RER bit is RESO. 


All other values are reserved. 

In Armv8-A the permitted values are: 

° 0b0000 when EL3 is not implemented. 
- 0b0001 when EL3 is implemented. 


In an implementation that includes EL3, if EL3 cannot use AArch32 but EL1 can use AArch32 then 
this field has the value 0b0001. 


If EL1 cannot use AArch32 then this field has the value 0b0000. 


ProgMod, bits [3:0] 


Support for the standard programmers' model for Armv4 and later. Model must support User, FIQ, 
IRQ, Supervisor, Abort, Undefined, and System modes. Defined values are: 


0b0000 Not supported. 

0b0001 Supported. 

All other values are reserved. 

In Armv8-A the permitted values are 0b0001 and 0b0000. 

If EL1 cannot use AArch32 then this field has the value 0b0000. 


Accessing the ID_PFR1_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_PFR1_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0001 0b001 





if PSTATE.EL == EL@ then 
if IsFeatureImp]lemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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return ID_PFR1_EL1; 

elsif PSTATE.EL == EL2 then 
return ID_PFR1_EL1; 

elsif PSTATE.EL == EL3 then 
return ID_PFR1_EL1; 
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D13.2.76 ID_PFR2_EL1, AArch32 Processor Feature Register 2 
The ID_PFR2_ ELI characteristics are: 
Purpose 
Gives information about the AArch32 programmers’ model. 


Must be interpreted with ID PFRO EL! and ID PFRI ELI. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 


AArch64 System register ID_PFR2_EL1[31:0] is architecturally mapped to AArch32 System 
register ID_PFR2[31:0]. 


In an implementation that supports only AArch64 state, this register is UNKNOWN. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_PFR2_EL1 is a 64-bit register. 


Field descriptions 


The ID_PFR2_ EL] bit assignments are: 


63 12 11 


8 7 4 3 0 
RESO | rase | SSBS CSV3 


Reserved, RESO. 


Bits [63:12] 


RAS frac, bits [11:8] 
When ARMVv%8.4-RAS is implemented: 
RAS Extension fractional field. 
0b0000 If ID_PFRO_EL1.RAS == 0b0001, RAS Extension implemented. 


0b0001 If ID_PFRO_EL1.RAS == 0b0001, as @b0000 and adds support for additional 
ERXMISC<m> System registers. 


Error records accessed through System registers conform to RAS System Architecture 
v1.1, which includes simplifications to ERR<n>STATUS and support for the optional 
RAS Timestamp Extension. 


All other values are reserved. 
This field is valid only if ID _PFRO_EL1.RAS == 0b0001. 
Otherwise: 


Reserved, RESO. 


SSBS, bits [7:4] 
From ARMv8.5: 
Speculative Store Bypassing controls in AArch64 state. Defined values are: 
0b0000 AArch32 provides no mechanism to control the use of Speculative Store Bypassing. 


0b0001 AArch32 provides the PSTATE.SSBS mechanism to mark regions that are Speculative 
Store Bypass Safe. 


From Armv8.0, the permitted values are 0b0000 and 0b0001. 
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All other values are reserved. 
Otherwise: 


Reserved, RESO. 


CSV3, bits [3:0] 
From ARMV8.5: 
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0b0000 This Device does not disclose whether data loaded under speculation with a permission 
or domain fault can be used to form an address or generate condition codes or SVE 
predicate values to be used by instructions newer than the load in the speculative 


sequence 


0b0001 Data loaded under speculation with a permission or domain fault cannot be used to form 
an address or generate condition codes or SVE predicate values to be used by 
instructions newer than the load in the speculative sequence 


From Armv8.0, the permitted values are 0b0000 and 0b0001. 
From Armvs.5, the only permitted value is 0b0001. 


All other values are reserved. 
Otherwise: 


Reserved, RESO. 


Accessing the ID_PFR2_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ID_PFR2_EL1 











op0 op1 CRm op2 
0b11 0b000 0b0000 0b0011 0b100 
if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return ID_PFR2_EL1; 
elsif PSTATE.EL == EL2 then 
return ID_PFR2_EL1; 
elsif PSTATE.EL == EL3 then 
return ID_PFR2_EL1; 
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D13.2.77  IFSR32_EL2, Instruction Fault Status Register (EL2) 
The IFSR32_EL2 characteristics are: 


Purpose 


Allows access to the AArch32 IFSR register from AArch64 state only. Its value has no effect on 
execution in AArch64 state. 


Configurations 


AArch64 System register IFSR32_EL2[31:0] is architecturally mapped to AArch32 System register 
IFSR[31:0]. 


If EL1 is AArch64 only, this register is UNDEFINED. 


If EL2 is not implemented but EL3 is implemented, and EL! is capable of using AArch32, then this 
register is not RESO. 


This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
IFSR32_EL2 is a 64-bit register. 


Field descriptions 


The IFSR32_EL2 bit assignments are: 


When TTBCR.EAE == 0: 


63 171615 131211109 8 4 3 0 


RESO 





Bits [63:17] 


Reserved, RESO. 


FnV, bit [16] 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd IFAR is valid. 
Qb1 IFAR is not valid, and holds an UNKNOWN value. 


This field is only valid for a synchronous External abort other than a synchronous External abort on 
a translation table walk. It is RESO for all other Prefetch Abort exceptions. 


This field resets to an architecturally UNKNOWN value. 
Bits [15:13] 


Reserved, RESO. 
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EXT, bit [12] 


External abort type. This bit can be used to provide an IMPLEMENTATION DEFINED classification of 
External aborts. 


In an implementation that does not provide any classification of External aborts, this bit is RESO. 
For aborts other than External aborts this bit always returns 0. 


This field resets to an architecturally UNKNOWN value. 


Bit [11] 


Reserved, RESO. 


FS[4], bit [10] 
This field is bit[4] of FS[4:0]. 
Fault Status bits. Bits [10] and [3:0] are interpreted together. 
0b00001 PC alignment fault. 
0b00010 Debug exception. 
0b00011 Access flag fault, level 1. 
0b00101 Translation fault, level 1. 
0b00110 Access flag fault, level 2. 
0b00111 Translation fault, level 2. 
0b01000 Synchronous External abort, not on translation table walk. 
0b01001 Domain fault, level 1. 
0b01011 Domain fault, level 2. 
0b01100 Synchronous External abort, on translation table walk, level 1. 
0b01101 Permission fault, level 1. 


0b01110 Synchronous External abort, on translation table walk, level 2. 





Qb01111 Permission fault, level 2. 

0b10000 TLB conflict abort. 

@b10100 IMPLEMENTATION DEFINED fault (Lockdown fault). 

0b11001 Synchronous parity or ECC error on memory access, not on translation table walk. 
0b11100 Synchronous parity or ECC error on translation table walk, level 1. 
0b11110 Synchronous parity or ECC error on translation table walk, level 2. 

All other values are reserved. 

When the RAS Extension is implemented, 0b11001, 0b11100, and 0b11110 are reserved. 
The FS field is split as follows: 

. FS[4] is IFSR32_EL2[10]. 

° FS[3:0] is IFSR32_EL2[3:0]. 


This field resets to an architecturally UNKNOWN value. 


LPAE, bit [9] 
On taking a Data Abort exception, this bit is set as follows: 
Qbd Using the Short-descriptor translation table formats. 
Qb1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore 
software can set this bit to 0 or 1 without affecting operation. 


This field resets to an architecturally UNKNOWN value. 
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Bits [8:4] 


Reserved, RESO. 


FS[3:0], bits [3:0] 
This field is bits[3:0] of FS[4:0]. 
See FS[4] for the field description. 


When TTBCR.EAE == 


63 171615 131211109 8 5 0 


RESO 





Bits [63:17] 


Reserved, RESO. 


FnV, bit [16] 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd IFAR is valid. 
Qb1 IFAR is not valid, and holds an UNKNOWN value. 


This field is only valid for a synchronous External abort other than a synchronous External abort on 
a translation table walk. It is RESO for all other Prefetch Abort exceptions. 


This field resets to an architecturally UNKNOWN value. 


Bits [15:13] 


Reserved, RESO. 


EXT, bit [12] 


External abort type. This bit can be used to provide an IMPLEMENTATION DEFINED classification of 
External aborts. 


In an implementation that does not provide any classification of External aborts, this bit is RESO. 
For aborts other than External aborts this bit always returns 0. 


This field resets to an architecturally UNKNOWN value. 


Bits [11:10] 


Reserved, RESO. 


LPAE, bit [9] 
On taking a Data Abort exception, this bit is set as follows: 
Qbd Using the Short-descriptor translation table formats. 
Qb1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore 
software can set this bit to 0 or 1 without affecting operation. 


This field resets to an architecturally UNKNOWN value. 
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Reserved, RESO. 


STATUS, bits [5:0] 


Fault status bits. All encodings not shown below are reserved: 


0b000000 
0b000001 
0b000010 
0b000011 
0b000101 
0b000110 
0b000111 
0b001001 
0b001010 
0b001011 
0b001101 
0b001110 
0b001111 
0b010000 
0b010101 
0b010110 
0b010111 
0b011000 
0b011101 
0b011110 
0b011111 
0b100001 
0b100010 
0b110000 





Address size fault in TTBRO or TTBR1. 

Address size fault, level 1. 

Address size fault, level 2. 

Address size fault, level 3. 

Translation fault, level 1. 

Translation fault, level 2. 

Translation fault, level 3. 

Access flag fault, level 1. 

Access flag fault, level 2. 

Access flag fault, level 3. 

Permission fault, level 1. 

Permission fault, level 2. 

Permission fault, level 3. 

Synchronous External abort, not on translation table walk. 

Synchronous External abort, on translation table walk, level 1. 

Synchronous External abort, on translation table walk, level 2. 

Synchronous External abort, on translation table walk, level 3. 

Synchronous parity or ECC error on memory access, not on translation table walk. 
Synchronous parity or ECC error on memory access on translation table walk, level 1. 
Synchronous parity or ECC error on memory access on translation table walk, level 2. 
Synchronous parity or ECC error on memory access on translation table walk, level 3. 
PC alignment fault. 

Debug exception. 

TLB conflict abort. 


All other values are reserved. 


When the RAS Extension is implemented, 0b011000, 0b011101, 0b011110, and 0b011111, are reserved. 


The lookup level associated with a fault is: 


° For a fault generated on a translation table walk, the lookup level of the walk being 
performed. 
a For a Translation fault, the lookup level of the translation table that gave the fault. If a fault 


occurs because a stage of address translation is disabled, or because the input address is 
outside the range specified by the appropriate base address register or registers, the fault is 
reported as a fault at level 1. 


° For an Access flag fault, the lookup level of the translation table that gave the fault. 


° For a Permission fault, including a Permission fault caused by hierarchical permissions, the 
lookup level of the final level of translation table accessed for the translation. That is, the 
lookup level of the translation table that returned a Block or Page descriptor. 


This field resets to an architecturally UNKNOWN value. 


Accessing the IFSR32_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, IFSR32_EL2 














op0 op1 CRn CRm op2 
0b11 0b100 0b0101 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return IFSR32_EL2; 
elsif PSTATE.EL == EL3 then 
return IFSR32_EL2; 
MSR IFSR32_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0101 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
IFSR32_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
IFSR32_EL2 = X[t]; 
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D13.2.78 ISR_EL1, Interrupt Status Register 
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The ISR_EL1 characteristics are: 


Purpose 
Shows the pending status of the IRQ, FIQ, or SError interrupt. 
When executing at EL2, EL3 or Secure EL1 when SCR_EL3.EEL2 == 0b8, this shows the pending 
status of the physical IRQ, FIQ, or SError interrupts. 
When executing at either Non-secure EL1 or at Secure EL1 when SCR_EL3.EEL2 == 0b1: 
° If the HCR_EL2.{IMO,FMO,AMO} bit has a value of 1, the corresponding 
ISR_EL1.{I,F,A} bit shows the pending status of the virtual IRQ, FIQ, or SError. 
. If the HCR_EL2.{IMO,FMO,AMO} bit has a value of 0, the corresponding 
ISR_EL1.{I,F,A} bit shows the pending status of the physical IRQ, FIQ, or SError. 
Configurations 
AArch64 System register ISR_EL1[31:0] is architecturally mapped to AArch32 System register 
ISR[3 1:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ISR_ELI is a 64-bit register. 


Field descriptions 


The ISR_EL1 bit assignments are: 


98765 0 


RESO 4) fe RESO 


Reserved, RESO. 


Bits [63:9] 


A, bit [8] 
SError interrupt pending bit. 
Qbd No pending SError. 
Qb1 An SError interrupt is pending. 
If the SError interrupt is edge-triggered, this field is cleared to zero when the physical SError 
interrupt is taken. 
I, bit [7] 
IRQ pending bit. Indicates whether an IRQ interrupt is pending: 
Qbd No pending IRQ. 
Qb1 An IRQ interrupt is pending. 
F, bit [6] 
FIQ pending bit. Indicates whether an FIQ interrupt is pending. 
Qbd No pending FIQ. 
Qb1 An FIQ interrupt is pending. 
Bits [5:0] 


Reserved, RESO. 
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Accessing the ISR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ISR_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b1100 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
return ISR_EL1; 

elsif PSTATE.EL == EL2 then 
return ISR_EL1; 

elsif PSTATE.EL == EL3 then 
return ISR_EL1; 
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D13.2.79 LORC_EL1, LORegion Control (EL1) 


The LORC_EL! characteristics are: 
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Purpose 


Enables and disables LORegions, and selects the current LORegion descriptor. 


Configurations 


Attributes 


This register is present only when ARMvV8.1-LOR is implemented. Otherwise, direct accesses to 
LORC_EL1 are UNDEFINED. 


If no LORegion descriptors are supported by the PE, then this register is RESO. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


LORC_EL1 is a 64-bit register. 


Field descriptions 


The LORC_EL1 bit assignments are: 


Bits [63:10] 


DS, bits [9:2] 


Bit [1] 


EN, bit [0] 


10 9 210 


ENES EN 
RESO 


RESO DS 


Reserved, RESO. 


Descriptor Select. Selects the current LORegion descriptor accessed by LORSA_EL1, 
LOREA_EL1, and LORN_ ELI. 


The number of LORegion descriptors in IMPLEMENTATION DEFINED. The maximum number of 
LORegion descriptors supported is 256. If the number is less than 256, then bits[63:M+2] are RESO, 
where M is Logo(Number of LORegion descriptors supported by the implementation). 


If this field points to an LORegion descriptor that is not supported by an implementation, then the 
registers LORN_EL1, LOREA_EL1, and LORSA_ EL] are RESO. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Enable. Indicates whether LORegions are enabled. 

Qbe Disabled. Memory accesses do not match any LORegions. 
Qb1 Enabled. Memory accesses may match a LORegion. 

This bit is permitted to be cached in a TLB. 

This field resets to 0. 
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Accessing the LORC_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, LORC_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0100 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TLOR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return LORC_EL1; 
elsif PSTATE.EL == EL2 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return LORC_EL1; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
else 
return LORC_EL1; 


MSR LORC_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0100 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TLOR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
LORC_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
LORC_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.NS == '@' then 
UNDEFINED; 
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else 
LORC_EL1 = X[t]; 
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D13.2.80 LOREA_EL1, LORegion End Address (EL1) 
The LOREA_ EL! characteristics are: 


Purpose 


Holds the physical address of the end of the LORegion described in the current LORegion descriptor 
selected by LORC_EL1.DS. 


Configurations 


This register is present only when ARMvV8.1-LOR is implemented. Otherwise, direct accesses to 
LOREA_ ELI are UNDEFINED. 


This register is RESO if any of the following apply: 
. No LORegion descriptors are supported by the PE. 
; LORC_EL1.DS points to a LORegion that is not supported by the PE. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
LOREA ELI is a 64-bit register. 


Field descriptions 


The LOREA_ELI! bit assignments are: 


63 52 51 48 47 16 15 0 


RESO EA[51:48] 


Any of the fields in this register are permitted to be cached in a TLB. 






EA[47:16] RESO 





Bits [63:52] 


Reserved, RESO. 


EA[51:48], bits [51:48] 
When ARMVv%8.2-LPA is implemented: 
Extension to EA[47:16]. See EA[47:16] for more details. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


EA[47:16], bits [47:16] 


Bits [47:16] of the end physical address of an LORegion described in the current LORegion 
descriptor selected by LORC_EL1.DS. Bits[15:0] of this address are defined to be @xFFFF. For 
implementations with fewer than 48 bits, the upper bits of this field are RESO. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use, EA[51:48] form the upper part of the address value. Otherwise, for implementations with fewer 
than 52 physical address bits, EA[51:48] are RESO. 


This field resets to an architecturally UNKNOWN value. 
Bits [15:0] 


Reserved, RESO. 
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Accessing the LOREA_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, LOREA_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0100 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TLOR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return LOREA_EL1; 
elsif PSTATE.EL == EL2 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





return LOREA_EL1; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
else 
return LOREA_EL1; 


MSR LOREA_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0100 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TLOR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
LOREA_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
LOREA_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.NS == '@' then 
UNDEFINED; 
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else 
LOREA_EL1 = X[t]; 
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D13.2.81 LORID_EL1, LORegionID (EL1) 


The LORID ELI characteristics are: 
Purpose 
Indicates the number of LORegions and LORegion descriptors supported by the PE. 


Configurations 


This register is present only when ARMvV8.1-LOR is implemented. Otherwise, direct accesses to 
LORID_EL1 are UNDEFINED. 


If no LORegion descriptors are implemented, then the registers LORC_EL1, LORN_EL1, 
LOREA_EL1, and LORSA_ ELI are RESO. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
LORID_EL1 is a 64-bit register. 


Field descriptions 


The LORID ELI bit assignments are: 


24 23 16 15 8 7 


63 
| RESO LD RESO LR 


ARM DDI 0487E.a 
ID070919 


Bits [63:24] 
Reserved, RESO. 
LD, bits [23:16] 
Number of LORegion descriptors supported by the PE. This is an 8-bit binary number. 
Bits [15:8] 
Reserved, RESO. 
LR, bits [7:0] 
Number of LORegions supported by the PE. This is an 8-bit binary number. 


Note 


If LORID_EL1 indicates that no LORegions are implemented, then LoadLOAcquire and 
StoreLORelease will behave as LoadAcquire and StoreRelease. 








Accessing the LORID_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, LORID_EL1 





op0 op1 CRn CRm op2 
0b11 0b000 0b1010 0b0100 0b111 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TLOR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return LORID_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return LORID_EL1; 
elsif PSTATE.EL == EL3 then 
return LORID_EL1; 
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D13.2.82 LORN_EL1, LORegion Number (EL1) 

The LORN_EL1 characteristics are: 

Purpose 
Holds the number of the LORegion described in the current LORegion descriptor selected by 
LORC_EL1.DS. 

Configurations 
This register is present only when ARMV8.1-LOR is implemented. Otherwise, direct accesses to 
LORN_EL]I are UNDEFINED. 
This register is RESO if any of the following apply: 
° No LORegion descriptors are supported by the PE. 
; LORC_EL1.DS points to a LORegion that is not supported by the PE. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 
LORN_ ELI is a 64-bit register. 

Field descriptions 

The LORN_EL1 bit assignments are: 

63 8 7 0 
RESO Num 

Any of the fields in this register are permitted to be cached in a TLB. 

Bits [63:8] 
Reserved, RESO. 

Num, bits [7:0] 
Number of the LORegion described in the current LORegion descriptor selected by 
LORC_EL1.DS. 
The maximum number of LORegions supported by the PE is 256. If the maximum number is less 
than 256, then bits[8:N] are RESO, where N is (Log2(Number of LORegions supported by the PE)). 
If this field points to a LORegion that is not supported by the PE, then the current LORegion 
descriptor does not match any LORegion. 
This field resets to an architecturally UNKNOWN value. 

Accessing the LORN_EL1 

Accesses to this register use the following encodings in the System instruction encoding space: 

MRS <Xt>, LORN_EL1 

op0 op1 CRn CRm op2 
0b11 0b000 0b1010 0b0100 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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if SCR_EL3.NS == 'Q' then 
UNDEFINED; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TLOR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

else 
return LORN_EL1; 

elsif PSTATE.EL == EL2 then 

if SCR_EL3.NS == 'Q' then 
UNDEFINED; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

else 
return LORN_EL1; 

elsif PSTATE.EL == EL3 then 

if SCR_EL3.NS == '@' then 
UNDEFINED; 

else 
return LORN_EL1; 


MSR LORN_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0100 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if SCR_EL3.NS == '@' then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TLOR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
LORN_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if SCR_EL3.NS == '@' then 
UNDEFINED; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
LORN_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.NS == '@' then 
UNDEFINED; 
else 
LORN_EL1 = X[t]; 
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D13.2.83 LORSA_EL1, LORegion Start Address (EL1) 
The LORSA_EL1 characteristics are: 


Purpose 


Indicates whether the current LORegion descriptor selected by LORC_EL1.DS is enabled, and 
holds the physical address of the start of the LORegion. 


Configurations 


This register is present only when ARMvV8.1-LOR is implemented. Otherwise, direct accesses to 
LORSA_EL]1 are UNDEFINED. 


This register is RESO if any of the following apply: 
. No LORegion descriptors are supported by the PE. 
` LORC_EL1.DS points to a LORegion that is not supported by the PE. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
LORSA_EL1 is a 64-bit register. 


Field descriptions 


The LORSA_EL1 bit assignments are: 


63 52 51 48 47 1615 1 0 


RESO SA[51:48] SA[47:16] RESO 


Any of the fields in this register are permitted to be cached in a TLB. 






— Valid 


Bits [63:52] 


Reserved, RESO. 


SA[51:48], bits [51:48] 
When ARMv%8.2-LPA is implemented: 
Extension to SA[47:16]. See SA[47:16] for more details. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SA[47:16], bits [47:16] 


Bits [47:16] of the start physical address of the LORegion described in the current LORegion 
descriptor selected by LORC_EL1.DS. Bits[15:0] of this address are defined to be 0x0000. For 
implementations with fewer than 48 bits, the upper bits of this field are RESO. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use, SA[51:48] form the upper part of the address value. Otherwise, for implementations with fewer 
than 52 physical address bits, SA[51:48] are RESO. 


This field resets to an architecturally UNKNOWN value. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3199 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


Bits [15:1] 
Reserved, RESO. 
Valid, bit [0] 
Indicates whether the current LORegion Descriptor is enabled. 
0b0 Disabled 
Qb1 Enabled 
This field resets to 0. 


Accessing the LORSA_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, LORSA_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0100 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TLOR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return LORSA_EL1; 
elsif PSTATE.EL == EL2 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return LORSA_EL1; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
else 
return LORSA_EL1; 


MSR LORSA_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0100 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TLOR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
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LORSA_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TLOR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
LORSA_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.NS == 'Q' then 
UNDEFINED; 
else 
LORSA_EL1 = X[t]; 
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D13.2.84 MAIR_EL1, Memory Attribute Indirection Register (EL1) 
The MAIR _EL1 characteristics are: 


Purpose 
Provides the memory attribute encodings corresponding to the possible AttrIndx values in a 
Long-descriptor format translation table entry for stage 1 translations at EL1. 
Configurations 


AArch64 System register MAIR_EL1[31:0] is architecturally mapped to AArch32 System register 
PRRR[31:0] when TTBCR.EAE == 


AArch6é4 System register MAIR_EL1[31:0] is architecturally mapped to AArch32 System register 
MAIRO[31:0] when TTBCR.EAE == 


AArch64 System register MAIR_EL1[63:32] is architecturally mapped to AArch32 System register 
NMRR[31:0] when TTBCR.EAE == 


AArch64 System register MAIR_EL1[63:32] is architecturally mapped to AArch32 System register 
MAIR1[31:0] when TTBCR.EAE == 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MAIR ELI! is a 64-bit register. 


Field descriptions 


The MAIR EL] bit assignments are: 


56 55 48 47 40 39 32 31 24 23 16 15 


i Attr7 | Attr6 Attr5 Attr4 Attr3 | Attr2 | Attr1 AttrO 


MAIR ELl! is permitted to be cached in a TLB. 


Attr<n>, bits [8n+7:8n], for n = 0 to 7 


The memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format translation 
table entry, where AttrIndx[2:0] gives the value of <n> in Attr<n>. 


Attr is encoded as follows: 














Attr Meaning 

0b0000dd00 Device memory. See encoding of 'dd' for the type of Device memory. 
0b0000ddxx, (xx != 00) UNPREDICTABLE 

Obooooiiii, (0000 != 0000 and iii != 0000) Normal memory. See encoding of 'oooo' and 'iiii' for the type of Normal Memory. 
0b11110000 Tagged Normal Memory. Inner+Outer Write-Back Non-Transient memory, 


Inner+Outer Read-Allocate, Inner+Outer Write-Allocate. 





Qbxxxx0000, (xxxx != 0000 and xxxx != 1111) | UNPREDICTABLE 
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'dd' is encoded as follows: 





dd | Meaning 


0b00 | Device-nGnRnE memory 





0b01 | Device-nGnRE memory 





0b10 | Device-nGRE memory 





0b11 | Device-GRE memory 





‘oooo' is encoded as follows: 





‘0000' Meaning 





Qb0000 See encoding of Attr 





ObOORW, RW not 0b00 Normal memory, Outer Write-Through Transient 





0b0100 Normal memory, Outer Non-cacheable 





ObOIRW, RW not 0b00 Normal memory, Outer Write-Back Transient 





0b10RW Normal memory, Outer Write-Through Non-transient 











0b11RW Normal memory, Outer Write-Back Non-transient 





R = Outer Read-Allocate policy, W = Outer Write-Allocate policy. 





‘iii’ Meaning 





0b0000 See encoding of Attr 





ObOORW, RW not @b00 Normal memory, Inner Write-Through Transient 





0b0100 Normal memory, Inner Non-cacheable 





ObOIRW, RW not 0b00 Normal memory, Inner Write-Back Transient 





0b10RW Normal memory, Inner Write-Through Non-transient 











0b11RW Normal memory, Inner Write-Back Non-transient 





R = Inner Read-Allocate policy, W = Inner Write-Allocate policy. 


The R and W bits in 'oooo' and 'iiii' fields have the following meanings: 











R or W Meaning 
Qbd No Allocate 
Qb1 Allocate 
This field resets to an architecturally UNKNOWN value. 
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D13-3204 


Accessing the MAIR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic MAIR_EL]1 or 
MAIR _ EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MAIR_EL1 











op0 op1 CRn CRm op2 
0b11 0b000 0b1010 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x140]; 
else 
return MAIR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return MAIR_EL2; 
else 
return MAIR_EL1; 
elsif PSTATE.EL == EL3 then 
return MAIR_EL1; 
MSR MAIR_EL1, <Xt> 
op0 op1 CRn CRm op2 
Ob11 0b000 0b1010 0b0010 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x140] = X[t]; 
else 
MAIR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
MAIR_EL2 = X[t]; 
else 
MAIR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
MAIR_EL1 = X[t]; 
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MRS <Xt>, MAIR_EL12 





op0 op1 CRn CRm op2 


0b11 0b101 0b1010 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x140]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return MAIR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return MAIR_EL1; 
else 
UNDEFINED; 


MSR MAIR_EL12, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b1010 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x140] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
AIR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
AIR_EL1 = X[t]; 
else 





UNDEFINED; 
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D13.2.85 MAIR_EL2, Memory Attribute Indirection Register (EL2) 


The MAIR _EL2 characteristics are: 


Purpose 
Provides the memory attribute encodings corresponding to the possible AttrIndx values in a 
Long-descriptor format translation table entry for stage 1 translations at EL2. 

Configurations 
AArch6é4 System register MAIR_EL2[31:0] is architecturally mapped to AArch32 System register 
HMAIRO[3 1:0]. 
AArch64 System register MAIR_EL2[63:32] is architecturally mapped to AArch32 System register 
HMAIR1[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


MAIR EL2 is a 64-bit register. 


Field descriptions 


The MAIR EL2 bit assignments are: 


56 55 48 47 40 39 32 31 24 23 16 15 


i Attr7 | Attr6 Attr5 Attr4 Attr3 | Attr2 | Attr1 AttrO 


MAIR EL2 is permitted to be cached in a TLB. 


Attr<n>, bits [8n+7:8n], for n = 0 to 7 


The memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format translation 
table entry, where AttrIndx[2:0] gives the value of <n> in Attr<n>. 


Attr is encoded as follows: 

















Attr Meaning 

0b0000dd00 Device memory. See encoding of 'dd' for the type of Device memory. 
0b0000ddxx, (xx != 00) UNPREDICTABLE 

Obooooiili, (0000 != 0000 and iiii != 0000) Normal memory. See encoding of 'oooo' and 'iiii' for the type of Normal Memory. 
0b11110000 Tagged Normal Memory. Inner+Outer Write-Back Non-Transient memory, 


Inner+Outer Read-Allocate, Inner+Outer Write-Allocate. 





Obxxxx0000, (xxxx != 0000 and xxxx != 1111) | UNPREDICTABLE 
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'dd' is encoded as follows: 





dd | Meaning 


0b00 | Device-nGnRnE memory 





0b01 | Device-nGnRE memory 





0b10 | Device-nGRE memory 





0b11 | Device-GRE memory 





‘oooo' is encoded as follows: 





‘0000' Meaning 





Qb0000 See encoding of Attr 





ObOORW, RW not 0b00 Normal memory, Outer Write-Through Transient 





0b0100 Normal memory, Outer Non-cacheable 





ObOIRW, RW not 0b00 Normal memory, Outer Write-Back Transient 





0b10RW Normal memory, Outer Write-Through Non-transient 











0b11RW Normal memory, Outer Write-Back Non-transient 





R = Outer Read-Allocate policy, W = Outer Write-Allocate policy. 





‘iii’ Meaning 





0b0000 See encoding of Attr 





ObOORW, RW not @b00 Normal memory, Inner Write-Through Transient 





0b0100 Normal memory, Inner Non-cacheable 





ObOIRW, RW not 0b00 Normal memory, Inner Write-Back Transient 





0b10RW Normal memory, Inner Write-Through Non-transient 











0b11RW Normal memory, Inner Write-Back Non-transient 





R = Inner Read-Allocate policy, W = Inner Write-Allocate policy. 


The R and W bits in 'oooo' and 'iiii' fields have the following meanings: 











R or W Meaning 
Qbd No Allocate 
Qb1 Allocate 
This field resets to an architecturally UNKNOWN value. 
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Accessing the MAIR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic MAIR_EL2 or 
MAIR ELI! are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MAIR_EL2 





op0 op1 


CRn 


CRm 


op2 





0b11 0b100 


0b1010 


0b0010 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return MAIR_EL2; 
elsif PSTATE.EL == EL3 then 
return MAIR_EL2; 


MSR MAIR_EL2, <Xt> 


op0 op1 


CRn 


CRm 


op2 





0b11 0b100 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
MAIR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
MAIR_EL2 = X[t]; 


MRS <Xt>, MAIR_EL1 


0b1010 


0b0010 


0b000 





op0 op1 


CRn 


CRm 


op2 





0b11 0b000 


0b1010 


0b0010 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == 
AArch64.SystemAccessTrap(EL2, 0x18); 


'1' then 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


return NVMem[0x140] ; 
else 
return MAIR_EL1; 
elsif PSTATE.EL == EL2 then 
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if HCR_EL2.E2H == '1' then 
return MAIR_EL2; 
else 
return MAIR_EL1; 
elsif PSTATE.EL == EL3 then 
return MAIR_EL1; 


MSR MAIR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1010 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x140] = X[t]; 
else 
MAIR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
MAIR_EL2 = X[t]; 
else 
MAIR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
MAIR_EL1 = X[t]; 
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D13.2.86 MAIR_EL3, Memory Attribute Indirection Register (EL3) 


The MAIR _EL3 characteristics are: 


Purpose 
Provides the memory attribute encodings corresponding to the possible AttrIndx values in a 
Long-descriptor format translation table entry for stage 1 translations at EL3. 
Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


MAIR EL3 is a 64-bit register. 


Field descriptions 


The MAIR _ EL3 bit assignments are: 


56 55 48 47 40 39 32 31 24 23 16 15 


i Attr7 | Attr6 Attr5 Attr4 Attr3 | Attr2 | Attr1 AttrO 


MAIR EL3 is permitted to be cached in a TLB. 


Attr<n>, bits [8n+7:8n], for n = 0 to 7 


The memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format translation 
table entry, where AttrIndx[2:0] gives the value of <n> in Attr<n>. 


Attr is encoded as follows: 

















Attr Meaning 

0b0000dd00 Device memory. See encoding of 'dd' for the type of Device memory. 
0b0000ddxx, (xx != 00) UNPREDICTABLE 

Obooooiiii, (0000 != 0000 and iiii != 0000) Normal memory. See encoding of 'oooo' and 'iiii' for the type of Normal Memory. 
0b11110000 Tagged Normal Memory. Inner+Outer Write-Back Non-Transient memory, 


Inner+Outer Read-Allocate, Inner+Outer Write-Allocate. 





Obxxxx0000, (xxxx != 0000 and xxxx != 1111) | UNPREDICTABLE 





'dd' is encoded as follows: 





dd | Meaning 





0b00 | Device-nGnRnE memory 





0b01 | Device-nGnRE memory 





0b10 | Device-nGRE memory 





0b11 | Device-GRE memory 
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‘oooo' is encoded as follows: 





‘0000' Meaning 


0b0000 See encoding of Attr 





ObOORW, RW not 0b00 Normal memory, Outer Write-Through Transient 





0b0100 Normal memory, Outer Non-cacheable 





ObOIRW, RW not 0b00 Normal memory, Outer Write-Back Transient 





0b10RW Normal memory, Outer Write-Through Non-transient 











0b11RW Normal memory, Outer Write-Back Non-transient 





R = Outer Read-Allocate policy, W = Outer Write-Allocate policy. 





‘iii Meaning 





0b0000 See encoding of Attr 





ObOORW, RW not @b00 Normal memory, Inner Write-Through Transient 





0b0100 Normal memory, Inner Non-cacheable 





ObOIRW, RW not @b00 Normal memory, Inner Write-Back Transient 





0b10RW Normal memory, Inner Write-Through Non-transient 











0b11RW Normal memory, Inner Write-Back Non-transient 





R = Inner Read-Allocate policy, W = Inner Write-Allocate policy. 


The R and W bits in 'oooo' and 'iiii' fields have the following meanings: 











R or W Meaning 
Qbd No Allocate 
Qb1 Allocate 





This field resets to an architecturally UNKNOWN value. 


Accessing the MAIR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MAIR_EL3 








op0 op1 CRn CRm op2 
0b11 0b110 0b1010 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
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elsif PSTATE.EL == EL2 then 
UNDEFINED; 

elsif PSTATE.EL == EL3 then 
return MAIR_EL3; 


MSR MAIR_EL3, <Xt> 





op0 op1 CRn CRm op2 
0b11 0b110 0b1010 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
MAIR_EL3 = X[t]; 
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Provides identification information for the PE, including an implementer code for the device and a 


device ID number. 


Configurations 


AArch64 System register MIDR_EL1[31:0] is architecturally mapped to AArch32 System register 


MIDR{31:0]. 


AArch64 System register MIDR_EL1[31:0] is architecturally mapped to External register 


MIDR_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MIDR_ EL! is a 64-bit register. 


Field descriptions 


The MIDR_ EL] bit assignments are: 


32 31 24 23 20 19 16 15 


63 4 3 0 
| RESO | Implementer Varia um Revision 


nt PartN 
= Architecture 


Bits [63:32] 


Reserved, RESO. 


Implementer, bits [31:24] 


The Implementer code. This field must hold an implementer code that has been assigned by Arm. 


Assigned codes include the following: 


Hex representation 


Implementer 
































0x00 Reserved for software use 
OxC0 Ampere Computing 
0x41 Arm Limited 
0x42 Broadcom Corporation 
0x43 Cavium Inc. 
0x44 Digital Equipment Corporation 
0x49 Infineon Technologies AG 
0x4D Motorola or Freescale Semiconductor Inc. 
0x4E NVIDIA Corporation 
0x50 Applied Micro Circuits Corporation 
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D13-3214 





Hex representation Implementer 











0x51 Qualcomm Inc. 
0x56 Marvell International Ltd. 
0x69 Intel Corporation 





Arm can assign codes that are not published in this manual. All values not assigned by Arm are 
reserved and must not be used. 


Variant, bits [23:20] 


An IMPLEMENTATION DEFINED variant number. Typically, this field is used to distinguish between 
different product variants, or major revisions of a product. 


Architecture, bits [19:16] 


The permitted values of this field are: 


0b0001 
0b0010 
Qb0011 
0b0100 
0b0101 
0b0110 
0b0111 
Qb1111 


Armv4. 

Armv4T. 

Army5S (obsolete). 
Armv5T. 
Armv5TE. 
Armv5TEJ. 
Armv6. 


Architectural features are individually identified in the ID_* registers, see ZD registers 
on page K 14-7832. 


All other values are reserved. 


PartNum, bits [15:4] 


An IMPLEMENTATION DEFINED primary part number for the device. 


On processors implemented by Arm, if the top four bits of the primary part number are 0x0 or 0x7, 
the variant and architecture are encoded differently. 


Revision, bits [3:0] 


An IMPLEMENTATION DEFINED revision number for the device. 


Accessing the MIDR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MIDR_EL1 


if PSTATE.EL == EL@ then 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0000 0b000 





if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 


AArch64.SystemAccessTrap(EL1, 0x18); 


else 
UNDEFINED; 


elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && !ELUsingAArch32(EL2) then 
return VPIDR_EL2; 
else 
return MIDR_EL1; 
elsif PSTATE.EL == EL2 then 
return MIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return MIDR_EL1; 
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D13.2.88 


MPIDR_EL1, Multiprocessor Affinity Register 


The MPIDR_ EL] characteristics are: 


Purpose 


In a multiprocessor system, provides an additional PE identification mechanism for scheduling 
purposes. 


Configurations 


Attributes 


AArch64 System register MPIDR_EL1[31:0] is architecturally mapped to AArch32 System register 
MPIDR[31:0]. 


In a uniprocessor system Arm recommends that each Aff<n> field of this register returns a value of 
0. 


RW fields in this register reset to architecturally UNKNOWN values. 


MPIDR_EL1 is a 64-bit register. 


Field descriptions 


The MPIDR_EL! bit assignments are: 


40 39 32 31 30 29 25 24 23 1615 8 7 0 


Aff3 it RESO Aff2 Aff1 AffO 


RES1 sooo o S MT 


D13-3216 


Bits [63:40] 


Reserved, RESO. 


Af?3, bits [39:32] 


Bit [31] 


U, bit [30] 


Bits [29:25] 


MT, bit [24] 


Affinity level 3. See the description of Aff0 for more information. 


Aff3 is not supported in AArch32 state. 


Reserved, RES1. 


Indicates a Uniprocessor system, as distinct from PE 0 in a multiprocessor system. The possible 
values of this bit are: 


Qbd Processor is part of a multiprocessor system. 


Qb1 Processor is part of a uniprocessor system. 


Reserved, RESO. 


Indicates whether the lowest level of affinity consists of logical PEs that are implemented using a 
multithreading type approach. See the description of Aff0 for more information about affinity 
levels. The possible values of this bit are: 


Qbd Performance of PEs at the lowest affinity level, or PEs with MPIDR_ EL1.MT set to 1, 
different affinity level 0 values, and the same values for affinity level 1 and higher, is 
largely independent. 
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Qb1 Performance of PEs at the lowest affinity level, or PEs with MPIDR_EL1.MT set to 1, 
different affinity level 0 values, and the same values for affinity level 1 and higher, is 
very interdependent. 


Aff2, bits [23:16] 
Affinity level 2. See the description of Aff0 for more information. 

Aff1, bits [15:8] 
Affinity level 1. See the description of Aff0 for more information. 

Aff0, bits [7:0] 
Affinity level 0. This is the affinity level that is most significant for determining PE behavior. Higher 
affinity levels are increasingly less significant in determining PE behavior. The assigned value of 
the MPIDR. {Aff2, Affl, Aff0} or MPIDR EL1.{Aff3, Aff2, Affl, Aff0} set of fields of each PE 
must be unique within the system as a whole. 


Accessing the MPIDR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MPIDR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0000 0b101 





if PSTATE.EL == EL@ then 
if IsFeatureImp]lemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) then 
return VMPIDR_EL2; 
else 
return MPIDR_EL1; 
elsif PSTATE.EL == EL2 then 
return MPIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return MPIDR_EL1; 
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D13.2.89 MVFRO_EL1, AArch32 Media and VFP Feature Register 0 


The MVFRO EL! characteristics are: 


Purpose 


Describes the features provided by the AArch32 Advanced SIMD and Floating-point 
implementation. 


Must be interpreted with MVFR1_EL1 and MVFR2 ELI. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 


for fields in ID registers on page D13-2823. 


Configurations 


Attributes 


AArch6é4 System register MVFRO_EL1[31:0] is architecturally mapped to AArch32 System 
register MVFRO[31:0]. 


In an implementation where at least one Exception level supports execution in AArch32 state, but 
there is no support for Advanced SIMD and floating-point operation, this register is RAZ. 


In an AArch64 only implementation, this register is UNKNOWN. 
RW fields in this register reset to architecturally UNKNOWN values. 


MVFRO ELI is a 64-bit register. 


Field descriptions 


The MVFRO EL! bit assignments are: 


63 


32 31 28 27 24 23 ., 20 19 16 15 12 11 


RESO [EPren FPShVec | FPSqrt | FPDivide | FPTrap | FPDP FPSP l SIMDReg 


Bits [63:32] 


Reserved, RESO. 


FPRound, bits [31:28] 


Floating-Point Rounding modes. Indicates whether the floating-point implementation provides 
support for rounding modes. Defined values are: 


0b0000 Not implemented, or only Round to Nearest mode supported, except that Round towards 
Zero mode is supported for VCVT instructions that always use that rounding mode 
regardless of the FPSCR setting. 


0b0001 All rounding modes supported. 
All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b0001. 


FPShVec, bits [27:24] 


D13-3218 


Short Vectors. Indicates whether the floating-point implementation provides support for the use of 
short vectors. Defined values are: 


0b0000 Short vectors not supported. 
0b0001 Short vector operation supported. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 
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FPSart, bits [23:20] 


Square Root. Indicates whether the floating-point implementation provides support for the ARMv6 
VFP square root operations. Defined values are: 


0b0000 Not supported in hardware. 

0b0001 Supported. 

All other values are reserved. 

In Armv8-A the permitted values are 0b0000 and 0b0001. 


The VSQRT.F32 instruction also requires the single-precision floating-point attribute, bits [7:4], 
and the VSQRT.F64 instruction also requires the double-precision floating-point attribute, bits 
[11:8]. 

FPDivide, bits [19:16] 


Indicates whether the floating-point implementation provides support for VFP divide operations. 
Defined values are: 


0b0000 Not supported in hardware. 

0b0001 Supported. 

All other values are reserved. 

In Armv8-A the permitted values are 0b0000 and 0b0001. 

The VDIV.F32 instruction also requires the single-precision floating-point attribute, bits [7:4], and 

the VDIV.F64 instruction also requires the double-precision floating-point attribute, bits [11:8]. 
FPTrap, bits [15:12] 


Floating Point Exception Trapping. Indicates whether the floating-point implementation provides 
support for exception trapping. Defined values are: 


0b0000 Not supported. 
0b0001 Supported. 
All other values are reserved. 
A value of 0b0001 indicates that, when the corresponding trap is enabled, a floating-point exception 
generates an exception. 
FPDP, bits [11:8] 


Double Precision. Indicates whether the floating-point implementation provides support for 
double-precision operations. Defined values are: 


0b0000 Not supported in hardware. 
0b0001 Supported, VFPv2. 


0b0010 Supported, VFPv3, VFPv4, or Armv8. VFPv3 and Armv8 add an instruction to load a 
double-precision floating-point constant, and conversions between double-precision 
and fixed-point values. 


All other values are reserved. 
In Armv8-A the permitted values are 0b0000 and 0b0010. 


A value of @b0001 or @b0010 indicates support for all VFP double-precision instructions in the 
supported version of VFP, except that, in addition to this field being nonzero: 


° VSQRT.F64 is only available if the Square root field is 0b0001. 
° VDIV.F64 is only available if the Divide field is 0b0001. 


° Conversion between double-precision and single-precision is only available if the 
single-precision field is nonzero. 
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FPSP, bits [7:4] 


Single Precision. Indicates whether the floating-point implementation provides support for 
single-precision operations. Defined values are: 


0b0000 Not supported in hardware. 
0b0001 Supported, VFPv2. 


0b0010 Supported, VFPv3 or VFPv4. VFPv3 adds an instruction to load a single-precision 
floating-point constant, and conversions between single-precision and fixed-point 
values. 


All other values are reserved. 
In Armv8-A the permitted values are 0b0000 and 0b0010. 


A value of 0b0001 or 0b0010 indicates support for all VFP single-precision instructions in the 
supported version of VFP, except that, in addition to this field being nonzero: 


° VSQRT.F32 is only available if the Square root field is 0b0001. 
° VDIV.F32 is only available if the Divide field is 0b0001. 
° Conversion between double-precision and single-precision is only available if the 
double-precision field is nonzero. 
SIMDReg, bits [3:0] 


Advanced SIMD registers. Indicates whether the Advanced SIMD and floating-point 
implementation provides support for the Advanced SIMD and floating-point register bank. Defined 
values are: 


0b0000 The implementation has no Advanced SIMD and floating-point support. 
0b0001 The implementation includes floating-point support with 16 x 64-bit registers. 


0b0010 The implementation includes Advanced SIMD and floating-point support with 32 x 
64-bit registers. 


All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b0010. 


Accessing the MVFRO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MVFRO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0011 0b000 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return MVFRQ_EL1; 
elsif PSTATE.EL == EL2 then 
return MVFRQ_EL1; 
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elsif PSTATE.EL == EL3 then 
return MVFRQ_EL1; 
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D13.2.90 MVFR1_EL1, AArch32 Media and VFP Feature Register 1 
The MVFRI EL! characteristics are: 


Purpose 


Describes the features provided by the AArch32 Advanced SIMD and Floating-point 
implementation. 


Must be interpreted with MVFRO_EL1 and MVFR2 ELI. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 


AArch6é4 System register MVFR1_EL1[31:0] is architecturally mapped to AArch32 System 
register MVFR1[31:0]. 


In an implementation where at least one Exception level supports execution in AArch32 state, but 
there is no support for Advanced SIMD and floating-point operation, this register is RAZ. 


In an AArch64 only implementation, this register is UNKNOWN. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MVFR1 ELI is a 64-bit register. 


Field descriptions 


The MVFRI_ ELI bit assignments are: 


32 31 28 27 ,, 24 23 20 19 16 15 12 11 


[= RESO | | FPHP | SIMDHP | SIMDSP | SIMDInt | SIMDLS i FPDNaN | FPFtZ 


SIMDFMAC 
Bits [63:32] 
Reserved, RESO. 
SIMDFMAC, bits [31:28] 
Advanced SIMD Fused Multiply-Accumulate. Indicates whether the Advanced SIMD 
implementation provides fused multiply accumulate instructions. Defined values are: 
0b0000 Not implemented. 
0b0001 Implemented. 
All other values are reserved. 
In Armv8-A, the permitted values are 0b0000 and 0b0001. 
The Advanced SIMD and floating-point implementations must provide the same level of support 
for these instructions. 
FPHP, bits [27:24] 
Floating Point Half Precision. Indicates the level of half-precision floating-point support. Defined 
values are: 
0b0000 Not supported. 
0b0001 Floating-point half-precision conversion instructions are supported for conversion 
between single-precision and half-precision. 
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0b0010 As for 0b0001, and adds instructions for conversion between double-precision and 


half-precision. 


Qb0011 As for 0b0010, and adds support for half-precision floating-point arithmetic. 


All other values are reserved. 
In Armv8-A the permitted values are: 


è 0b0000 in an implementation without floating-point support. 


è 0b0010 in an implementation with floating-point support that does not include the 


ARMv8.2-FP16 extension. 


a 0b0011 in an implementation with floating-point support that includes the ARMv8.2-FP16 


extension. 


The level of support indicated by this field must be equivalent to the level of support indicated by 


the SIMDHP field, meaning the permitted values are: 














Half Precision instructions supported PHP SIMDHP 
No support Qb0000 0b0000 
Conversions only 0b0010 0b0001 
Conversions and arithmetic Qb0011 0b0010 





SIMDHP, bits [23:20] 


Advanced SIMD Half Precision. Indicates the level of half-precision floating-point support. 


Defined values are: 


0b0000 Not supported. 


0b0001 SIMD half-precision conversion instructions are supported for conversion between 


single-precision and half-precision. 


0b0010 As for 0b0001, and adds support for half-precision floating-point arithmetic. 


All other values are reserved. 
In Armv8-A the permitted values are: 


. 0b0000 in an implementation without SIMD floating-point support. 


$ 0b0010 in an implementation with SIMD floating-point support that does not include the 


ARMv8.2-FP16 extension. 


è 0b0011 in an implementation with SIMD floating-point support that includes the 


ARMv8.2-FP16 extension. 


The level of support indicated by this field must be equivalent to the level of support indicated by 


the FPHP field, meaning the permitted values are: 














Half Precision instructions supported FPHP SIMDHP 
No support Qb0000  Ob0000 
Conversions only Qb0010 0b0001 
Conversions and arithmetic Qb0011 0b0010 





SIMDSP, bits [19:16] 


Advanced SIMD Single Precision. Indicates whether the Advanced SIMD and floating-point 
implementation provides single-precision floating-point instructions. Defined values are: 


0b0000 Not implemented. 


0b0001 Implemented. This value is permitted only if the SIMDInt field is 0b0001. 
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SIMDInt, bits 


All other values are reserved. 
In Armv8-A, the permitted values are 0b0000 and 0b0001. 


[15:12] 


Advanced SIMD Integer. Indicates whether the Advanced SIMD and floating-point implementation 
provides integer instructions. Defined values are: 


0b0000 Not implemented. 

0b0001 Implemented. 

All other values are reserved. 

In Armv8-A, the permitted values are 0b0000 and 0b0001. 


SIMDLS, bits [11:8] 


FPDNaN, bits 


FPFtZ, bits [3: 


Advanced SIMD Load/Store. Indicates whether the Advanced SIMD and floating-point 
implementation provides load/store instructions. Defined values are: 


0b0000 Not implemented. 

0b0001 Implemented. 

All other values are reserved. 

In Armv8-A, the permitted values are 0b0000 and 0b0001. 


[7:4] 


Default NaN mode. Indicates whether the floating-point implementation provides support only for 
the Default NaN mode. Defined values are: 


0b0000 Not implemented, or hardware supports only the Default NaN mode. 
0b0001 Hardware supports propagation of NaN values. 

All other values are reserved. 

In Armv8-A, the permitted values are 0b0000 and 0b0001. 


0] 


Flush to Zero mode. Indicates whether the floating-point implementation provides support only for 
the Flush-to-Zero mode of operation. Defined values are: 


0b0000 Not implemented, or hardware supports only the Flush-to-Zero mode of operation. 
0b0001 Hardware supports full denormalized number arithmetic. 

All other values are reserved. 

In Armv8-A, the permitted values are 0b0000 and 0b0001. 


Accessing the MVFR1_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MVFR1_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0011 0b001 


if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 


AArch64.SystemAccessTrap(EL1, 0x18); 


else 


UNDEFINED; 
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elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return MVFR1_EL1; 
elsif PSTATE.EL == EL2 then 
return MVFR1_EL1; 
elsif PSTATE.EL == EL3 then 
return MVFR1_EL1; 
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D13.2.91 MVFR2_EL1, AArch32 Media and VFP Feature Register 2 
The MVFR2_ EL! characteristics are: 


Purpose 


Describes the features provided by the AArch32 Advanced SIMD and Floating-point 
implementation. 


Must be interpreted with MVFRO_EL1 and MVFRI ELI. 
For general information about the interpretation of the ID registers, see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 


AArch64 System register MVFR2_EL1[31:0] is architecturally mapped to AArch32 System 
register MVFR2[31:0]. 


In an implementation where at least one Exception level supports execution in AArch32 state, but 
there is no support for Advanced SIMD and floating-point operation, this register is RAZ. 


In an AArch64 only implementation, this register is UNKNOWN. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MVFR2 ELI is a 64-bit register. 


Field descriptions 


The MVFR2_ EL! bit assignments are: 





63 

Bits [63:8] 
Reserved, RESO. 

FPMisc, bits [7:4] 
Indicates whether the floating-point implementation provides support for miscellaneous VFP 
features. 
0b0000 Not implemented, or no support for miscellaneous features. 
0b0001 Support for Floating-point selection. 
0b0010 As 0b0001, and Floating-point Conversion to Integer with Directed Rounding modes. 
Qb0011 As 0b0010, and Floating-point Round to Integer Floating-point. 
0b0100 As 0b0011, and Floating-point MaxNum and MinNum. 
All other values are reserved. 
In Armv8-A, the permitted values are 0b0000 and 0b0100. 

SIMDMisc, bits [3:0] 
Indicates whether the Advanced SIMD implementation provides support for miscellaneous 
Advanced SIMD features. 
0b0000 Not implemented, or no support for miscellaneous features. 
0b0001 Floating-point Conversion to Integer with Directed Rounding modes. 
0b0010 As 0b0001, and Floating-point Round to Integer Floating-point. 
Qb0011 As 0b0010, and Floating-point MaxNum and MinNum. 
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All other values are reserved. 


In Armv8-A, the permitted values are 0b0000 and 0b0011. 


Accessing the MVFR2_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MVFR2_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0011 0b010 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return MVFR2_EL1; 
elsif PSTATE.EL == EL2 then 
return MVFR2_EL1; 
elsif PSTATE.EL == EL3 then 
return MVFR2_EL1; 
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D13.2.92 


D13-3228 


ATTR | RESO | PA[51:48] PA[47:12] 


PAR_EL1, Physical Address Register 


The PAR_ELI characteristics are: 


Purpose 
Returns the output address (OA) from an Address translation instruction that executed successfully, 
or fault information if the instruction did not execute successfully. 

Configurations 
AArch64 System register PAR_EL1[63:0] is architecturally mapped to AArch32 System register 
PAR[63:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


PAR_ ELI is a 64-bit register. 


Field descriptions 


The PAR_EL1 bit assignments are: 


When PAR_EL1.F == 0b0: 


56 55 |, 52 51 48 47 






| e IMP DEF 
RES1 


This section describes the register value returned by the successful execution of an Address translation instruction. 
Software might subsequently write a different value to the register, and that write does not affect the operation of 
the PE. 


On a successful conversion, the PAR_EL1 can return a value that indicates the resulting attributes, rather than the 
values that appear in the translation table descriptors. More precisely: 


° The PAR_EL1.{ATTR, SH} fields are permitted to report the resulting attributes, as determined by any 
permitted implementation choices and any applicable configuration bits, instead of reporting the values that 
appear in the translation table descriptors. 


$ See the PAR_EL1.NS bit description for constraints on the value it returns. 


ATTR, bits [63:56] 


Memory attributes for the returned output address. This field uses the same encoding as the Attr<n> 
fields in MAIR_EL1, MAIR_EL2, and MAIR_EL3. 


The value returned in this field can be the resulting attribute, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of the value that appears in 
the translation table descriptor. 


This field resets to an architecturally UNKNOWN value. 
Bits [55:52] 
Reserved, RESO. 
PA[51:48], bits [51:48] 
When ARMv%8.2-LPA is implemented: 
Extension to PA[47:12]. See PA[47:12] for more details. 
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This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PA[47:12], bits [47:12] 


Output address. The output address (OA) corresponding to the supplied input address. This field 
returns address bits[47:12]. 


When ARMv8.2-LPA is implemented, and 52-bit addresses and a 64KB translation granule are in 
use, the PA[51:48] bits form the upper part of the address value. Otherwise the PA[51:48] bits are 
RESO. 


For implementations with fewer than 48 physical address bits, the corresponding upper bits in this 
field are RESO. 


This field resets to an architecturally UNKNOWN value. 


Bit [11] 


Reserved, RES1. 


IMPLEMENTATION DEFINED, bit [10] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


NS, bit [9] 
Non-secure. The NS attribute for a translation table entry from a Secure translation regime. 


For a result from a Secure translation regime, when SCR_EL3.EEL2 is 1, this bit reflects the 
Security state of the intermediate physical address space of the translation for the instructions: 


à In AArch64 state: AT SIEIR, AT S1E1W, AT S1E1RP, AT S1E1WP, AT SIEOR, and AT 
S1E0W. 


à In AArch32 state: ATSICPR, ATSICPW, ATSICPRP, ATS1CPWP, ATSICUR, and 
ATSICUW. 


Otherwise, this bit reflects the Security state of the physical address space of the translation. This 
means it reflects the effect of the NSTable bits of earlier levels of the translation table walk if those 
NSTable bits have an effect on the translation. 


For a result from a Non-secure translation regime, this bit is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


SH, bits [8:7] 
Shareability attribute, for the returned output address. Permitted values are: 
0b00 Non-shareable. 
0b10 Outer Shareable. 
0b11 Inner Shareable. 
The value 0b01 is reserved. 


Note 
This field returns the value @b10 for: 





. Any type of Device memory. 


s Normal memory with both Inner Non-cacheable and Outer Non-cacheable attributes. 





The value returned in this field can be the resulting attribute, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of the value that appears in 
the translation table descriptor. 


This field resets to an architecturally UNKNOWN value. 
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IMP DEF 
IMP DEF 
IMP DEF 


D13-3230 


Bits [6:1] 


F, bit [0] 


Reserved, RESO. 


Indicates whether the instruction performed a successful address translation. 
Qbe Address translation completed successfully. 


This field resets to an architecturally UNKNOWN value. 


When PAR_EL1.F == 0b1: 


63 


56 55 52 51 48 47 





This section describes the register value returned by a fault on the execution of an Address translation instruction. 
Software might subsequently write a different value to the register, and that write does not affect the operation of 


the PE. 


IMPLEMENTATION DEFINED, bits [63:56] 


IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bits [55:52] 


IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bits [51:48] 


Bits [47:12] 


Bit [11] 


Bit [10] 


S, bit [9] 


PTW, bit [8] 


IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Reserved, RES1. 


Reserved, RESO. 


Indicates the translation stage at which the translation aborted: 
Qbd Translation aborted because of a fault in the stage 1 translation. 
Qb1 Translation aborted because of a fault in the stage 2 translation. 


This field resets to an architecturally UNKNOWN value. 


If this bit is set to 1, it indicates the translation aborted because of a stage 2 fault during a stage 1 
translation table walk. 
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This field resets to an architecturally UNKNOWN value. 


Bit [7] 
Reserved, RESO. 


FST, bits [6:1] 


Fault status code, as shown in the Data Abort ESR encoding. 


This field resets to an architecturally UNKNOWN value. 


F, bit [0] 


Indicates whether the instruction performed a successful address translation. 


Qb1 Address translation aborted. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PAR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PAR_EL1 





op0 op1 


CRn CRm op2 





0b11 0b000 


Ob0111 0b0100 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
return PAR_EL1; 

elsif PSTATE.EL == EL2 then 
return PAR_EL1; 

elsif PSTATE.EL == EL3 then 
return PAR_EL1; 


MSR PAR_EL1, <Xt> 





op0 op1 


CRn CRm op2 





0b11 0b000 


0b0111 0b0100 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
PAR_EL1 = X[t]; 

elsif PSTATE.EL == EL2 then 
PAR_EL1 = X[t]; 

elsif PSTATE.EL == EL3 then 
PAR_EL1 = X[t]; 
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D13.2.93 REVIDR_EL1, Revision ID Register 


The REVIDR_ELI characteristics are: 


Purpose 
Provides implementation-specific minor revision information. 

Configurations 
AArch64 System register REVIDR_EL1[31:0] is architecturally mapped to AArch32 System 
register REVIDR[31:0]. 
If REVIDR_EL1 has the same value as MIDR_EL1, then its contents have no significance. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


REVIDR_EL1 is a 64-bit register. 


Field descriptions 


The REVIDR_EL1 bit assignments are: 


63 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


Accessing the REVIDR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, REVIDR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0000 0b110 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID1 == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return REVIDR_EL1; 
elsif PSTATE.EL == EL2 then 
return REVIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return REVIDR_EL1; 
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D13.2.94 RGSR_EL1, Random Allocation Tag Seed Register. 
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The RGSR_EL1 characteristics are: 


Purpose 
Random Allocation Tag Seed Register. 

Configurations 
This register is present only when ARMVv8.5-MemtTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to RGSR_EL1 are UNDEFINED. 
When GCR_EL1.RRND==0b1, the value of RGSR_EL1 is UNKNOWN. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


RGSR_EL1 is a 64-bit register. 


Field descriptions 


The RGSR_EL1 bit assignments are: 


24 23 8 7 4 3 


RESO SEED RESO TAG 


Bits [63:24] 
Reserved, RESO. 
SEED, bits [23:8] 
Seed register used for generating values returned by RandomAllocationTag(). 


This field resets to an architecturally UNKNOWN value. 


Bits [7:4] 


Reserved, RESO. 


TAG bits [3:0] 
Tag generated by the most recent IRG instruction. 


This field resets to an architecturally UNKNOWN value. 


Accessing the RGSR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, RGSR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0000 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
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else 
return RGSR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return RGSR_EL1; 
elsif PSTATE.EL == EL3 then 
return RGSR_EL1; 


MSR RGSR_EL1, <Xt> 


op0 op1 CRn CRm 


op2 





0b11 0b000 0b0001 0b0000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
RGSR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
RGSR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
RGSR_EL1 = X[t]; 
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D13.2.95 RMR_EL1, Reset Management Register (EL1) 
The RMR_ELI characteristics are: 


Purpose 
If EL1 is the highest implemented Exception level and this register is implemented: 
$ A write to the register at EL1 can request a Warm reset. 


° If EL1 can use AArch32 and AArch64, this register specifies the Execution state that the PE 
boots into on a Warm reset. 


Configurations 


AArch64 System register RMR_EL1[31:0] is architecturally mapped to AArch32 System register 
RMR[31:0] when IsHighestEL(EL1). 


Only implemented if EL1 is the highest implemented Exception level. In this case: 
è If EL1 can use AArch32 and AArch64 then this register must be implemented. 


è If EL1 cannot use AArch32 then it is IMPLEMENTATION DEFINED whether the register is 
implemented. 


See the field descriptions for the reset values. These apply whenever the register is implemented. 


Attributes 
RMR _ EL! is a 64-bit register. 


Field descriptions 


The RMR_ELI bit assignments are: 


63 21 0 


RESO 


= AA64 


Bits [63:2] 
Reserved, RESO. 
RR, bit [1] 
Reset Request. Setting this bit to 1 requests a Warm reset. 
This field resets to 0. 
AA64, bit [0] 
When EL1 can use AArch32, determines which Execution state the PE boots into after a Warm 


reset: 
Qbd AArch32. 
Qb1 AArch64. 


On coming out of the Warm reset, execution starts at the IMPLEMENTATION DEFINED reset vector 
address of the specified Execution state. 


If EL1 cannot use AArch32 this bit is RAO/WI. 
When implemented as a RW field, this field resets to 1 on a Cold reset. 


Accessing the RMR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, RMR_EL1 














op0 op1 CRn CRm op2 
0b11 0b000 0b1100 0b0000 0b010 
if PSTATE.EL == EL1 && IsHighestEL(EL1) then 
return RMR_EL1; 
else 
UNDEFINED; 
MSR RMR_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b1100 0b0000 0b010 





if PSTATE.EL == EL1 && IsHighestEL(EL1) then 
RMR_EL1 = X[t]; 

else 
UNDEFINED; 
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D13.2.96 RMR_EL2, Reset Management Register (EL2) 
The RMR_EL2 characteristics are: 


Purpose 
If EL2 is the highest implemented Exception level and this register is implemented: 
$ A write to the register at EL2 can request a Warm reset. 


° If EL2 can use AArch32 and AArch64, this register specifies the Execution state that the PE 
boots into on a Warm reset. 


Configurations 


AArch64 System register RMR_EL2[31:0] is architecturally mapped to AArch32 System register 
HRMR[31:0] when IsHighestEL(EL2). 


Only implemented if EL2 is the highest implemented Exception level. In this case: 
a If EL2 can use AArch32 and AArch64 then this register must be implemented. 


è If EL2 cannot use AArch32 then it is IMPLEMENTATION DEFINED whether the register is 
implemented. 


This register has no effect if EL2 is not enabled in the current Security state. 


See the field descriptions for the reset values. These apply whenever the register is implemented. 


Attributes 
RMR _ EL2 is a 64-bit register. 


Field descriptions 


The RMR_EL2 bit assignments are: 


63 210 


RESO 


= AA64 


Bits [63:2] 
Reserved, RESO. 
RR, bit [1] 
Reset Request. Setting this bit to 1 requests a Warm reset. 
This field resets to 0. 
AA64, bit [0] 
When EL2 can use AArch32, determines which Execution state the PE boots into after a Warm 


reset: 
Qbd AArch32. 
Qb1 AArché4. 


On coming out of the Warm reset, execution starts at the IMPLEMENTATION DEFINED reset vector 
address of the specified Execution state. 


If EL2 cannot use AArch32 this bit is RAO/WI. 
When implemented as a RW field, this field resets to 1 on a Cold reset. 
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Accessing the RMR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, RMR_EL2 











op0 op1 CRn CRm op2 
0b11 0b100 0b1100 0b0000 0b010 
if PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, x18); 
elsif PSTATE.EL == EL2 && IsHighestEL(EL2) then 
return RMR_EL2; 
else 
UNDEFINED; 
MSR RMR_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b1100 0b0000 0b010 





if PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 

elsif PSTATE.EL == EL2 && IsHighestEL(EL2) then 
RMR_EL2 = X[t]; 

else 
UNDEFINED; 
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D13.2.97 RMR_EL3, Reset Management Register (EL3) 
The RMR _EL3 characteristics are: 


Purpose 
If EL3 is the implemented and this register is implemented: 
$ A write to the register at EL3 can request a Warm reset. 


° If EL3 can use AArch32 and AArch64, this register specifies the Execution state that the PE 
boots into on a Warm reset. 


Configurations 


AArch64 System register RMR_EL3[31:0] is architecturally mapped to AArch32 System register 
RMR[31:0] when HaveEL(EL3). 


When EL3 is implemented: 
è If EL3 can use AArch32 and AArch64 then this register must be implemented. 


è If EL3 cannot use AArch32 then it is IMPLEMENTATION DEFINED whether the register is 
implemented. 


See the field descriptions for the reset values. These apply whenever the register is implemented. 


Attributes 
RMR EL3 is a 64-bit register. 


Field descriptions 


The RMR _EL3 bit assignments are: 


63 21 0 


RESO 


= AA64 


Bits [63:2] 
Reserved, RESO. 
RR, bit [1] 
Reset Request. Setting this bit to 1 requests a Warm reset. 
This field resets to 0. 
AA64, bit [0] 
When EL3 can use AArch32, determines which Execution state the PE boots into after a Warm 


reset: 
Qbd AArch32. 
Qb1 AArché4. 


On coming out of the Warm reset, execution starts at the IMPLEMENTATION DEFINED reset vector 
address of the specified Execution state. 


If EL3 cannot use AArch32 this bit is RAO/WI. 
When implemented as a RW field, this field resets to 1 on a Cold reset. 


Accessing the RMR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, RMR_EL3 














op0 op1 CRn CRm op2 
0b11 0b110 0b1100 0b0000 0b010 
if PSTATE.EL == EL3 && IsHighestEL(EL3) then 
return RMR_EL3; 
else 
UNDEFINED; 
MSR RMR_EL3, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b110 0b1100 0b0000 0b010 





if PSTATE.EL == EL3 && IsHighestEL(EL3) then 
RMR_EL3 = X[t]; 

else 
UNDEFINED; 
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D13.2.98 RNDR, Random Number 
The RNDR characteristics are: 


Purpose 


Random Number. Returns a 64-bit random number which is reseeded from the True Random 


Number source at an IMPLEMENTATION DEFINED rate. 


If the hardware returns a genuine random number, PSTATE.NZCYV is set to 0b0000. 


If the instruction cannot return a genuine random number in a reasonable period of time, 
PSTATE.NZCV is set to 0b0100 and the data value returned in UNKNOWN. 


Configurations 


This register is present only when ARMVv8.5-RNG is implemented. Otherwise, direct accesses to 


RNDR are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
RNDR is a 64-bit register. 


Field descriptions 


The RNDR bit assignments are: 











63 0 
RNDR 
RNDR, bits [63:0] 
Random Number. Returns a 64-bit Random Number which is reseeded from the True Random 
Number source at an IMPLEMENTATION DEFINED rate. 
This field resets to an architecturally UNKNOWN value. 
Accessing the RNDR 
Accesses to this register use the following encodings in the System instruction encoding space: 
MRS <Xt>, RNDR 
op0 op1 CRn CRm op2 
0b11 0b011 0b0010 0b0100 0b000 
if PSTATE.EL == ELO then 
return RNDR; 
elsif PSTATE.EL == EL1 then 
return RNDR; 
elsif PSTATE.EL == EL2 then 
return RNDR; 
elsif PSTATE.EL == EL3 then 
return RNDR; 
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D13.2.99 
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RNDRRS, Reseeded Random Number 


The RNDRRS characteristics are: 


Purpose 


Reseeded Random Number. Returns a 64-bit random number which is reseeded from the True 
Random Number source at an IMPLEMENTATION DEFINED rate. 


If the hardware returns a genuine random number, PSTATE.NZCYV is set to 0b0000. 


If the instruction cannot return a genuine random number in a reasonable period of time, 
PSTATE.NZCV is set to 0b0100 and the data value returned in UNKNOWN. 


Configurations 


This register is present only when ARMVv8.5-RNG is implemented. Otherwise, direct accesses to 
RNDRRS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
RNDRRS is a 64-bit register. 


Field descriptions 


The RNDRRS bit assignments are: 


RNDRRS 


RNDRRS, bits [63:0] 


Reseeded Random Number. Returns a 64-bit Random Number which is reseeded from the True 
Random Number source immediately before this read. 


This field resets to an architecturally UNKNOWN value. 


Accessing the RNDRRS 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, RNDRRS 











op0 op1 CRn CRm op2 
0b11 0b011 0b0010 0b0100 0b001 
if PSTATE.EL == ELO then 
return RNDRRS; 
elsif PSTATE.EL == EL1 then 
return RNDRRS; 
elsif PSTATE.EL == EL2 then 
return RNDRRS; 
elsif PSTATE.EL == EL3 then 
return RNDRRS; 
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The RVBAR_ ELI characteristics are: 


Purpose 
If EL1 is the highest Exception level implemented, contains the IMPLEMENTATION DEFINED address 
that execution starts from after reset when executing in AArch64 state. 
Configurations 
Only implemented if the highest Exception level implemented is EL1. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


RVBAR ELI is a 64-bit register. 


Field descriptions 


The RVBAR_ ELI bit assignments are: 


Reset Address 


Bits [63:0] 


Reset Address. The IMPLEMENTATION DEFINED address that execution starts from after reset when 
executing in 64-bit state. Bits[1:0] of this register are 00, as this address must be aligned, and the 
address must be within the physical address size supported by the PE. 


Accessing the RVBAR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, RVBAR_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b1100 0b0000 0b001 





if PSTATE.EL == EL1 && IsHighestEL(EL1) then 
return RVBAR_EL1; 

else 
UNDEFINED; 
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D13.2.101 RVBAR_EL2, Reset Vector Base Address Register (if EL3 not implemented) 


The RVBAR_EL2 characteristics are: 


Purpose 
If EL2 is the highest Exception level implemented, contains the IMPLEMENTATION DEFINED address 
that execution starts from after reset when executing in AArch64 state. 
Configurations 
Only implemented if the highest Exception level implemented is EL2. 
This register has no effect if EL2 is not enabled in the current Security state. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


RVBAR EL2 is a 64-bit register. 


Field descriptions 


The RVBAR_EL2 bit assignments are: 


63 0 


Reset Address 


Bits [63:0] 


Reset Address. The IMPLEMENTATION DEFINED address that execution starts from after reset when 
executing in 64-bit state. Bits[1:0] of this register are 00, as this address must be aligned, and the 
address must be within the physical address size supported by the PE. 


Accessing the RVBAR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, RVBAR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b1100 0b0000 0b001 





if PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 

elsif PSTATE.EL == EL2 && IsHighestEL(EL2) then 
return RVBAR_EL2; 

else 
UNDEFINED; 
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D13.2.102 RVBAR_EL3, Reset Vector Base Address Register (if EL3 implemented) 


The RVBAR_EL3 characteristics are: 


Purpose 
If EL3 is the highest Exception level implemented, contains the IMPLEMENTATION DEFINED address 
that execution starts from after reset when executing in AArch64 state. 
Configurations 
Only implemented if the highest Exception level implemented is EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


RVBAR EL3 is a 64-bit register. 


Field descriptions 


The RVBAR_EL3 bit assignments are: 


63 0 


Reset Address 


Bits [63:0] 


Reset Address. The IMPLEMENTATION DEFINED address that execution starts from after reset when 
executing in 64-bit state. Bits[1:0] of this register are 00, as this address must be aligned, and the 
address must be within the physical address size supported by the PE. 


Accessing the RVBAR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, RVBAR_EL3 


op0 op1 CRn CRm op2 





0b11 0b110 0b1100 0b0000 0b001 





if PSTATE.EL == EL3 && IsHighestEL(EL3) then 
return RVBAR_EL3; 

else 
UNDEFINED; 
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D13.2.103 S3_<op1>_<Cn>_<Cm>_<op2>, IMPLEMENTATION DEFINED registers 


The $3_<opl>_<Cn>_<Cm>_<op2> characteristics are: 





Purpose 

This area of the instruction set space is reserved for IMPLEMENTATION DEFINED registers. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


S3_<op1>_<Cn>_<Cm>_<op2> is a 64-bit register. 





Field descriptions 


The $3 _<opl>_<Cn>_<Cm>_<op2> bit assignments are: 





63 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 


IMPLEMENTATION DEFINED. 


Accessing the S3_<op1>_<Cn>_<Cm>_<op2> 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, S3_<op1>_C<Cn>_C<Cm>_<op2> 





op0 op1 CRn CRm op2 





0b11 op1[2:0] 0b1x11 Cm{[3:0] op2[2:0] 





if PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.TIDCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
IMPLEMENTATION_DEFINED ""; 
else 
IMPLEMENTATION_DEFINED ""; 


MSR S3_<op1>_C<Cn>_C<Cm>_<op2>, <Xt> 





op0 op1 CRn CRm op2 





0b11 op1[2:0] 0b1x11 Cm{[3:0] op2[2:0] 





if PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.TIDCP == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
IMPLEMENTATION_DEFINED ""; 
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else 
IMPLEMENTATION_DEFINED ""; 
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D13.2.104 SCR_EL3, Secure Configuration Register 


The SCR_EL3 characteristics are: 


Purpose 
Defines the configuration of the current Security state. It specifies: 
s The Security state of ELO, EL1, and EL2. The Security state is either Secure or Non-secure. 
° The Execution state at lower Exception levels. 
. Whether IRQ, FIQ, SError interrupts, and External abort exceptions are taken to EL3. 
= Whether various operations are trapped to EL3. 

Configurations 
AArch64 System register SCR_EL3[31:0] can be mapped to AArch32 System register SCR[31:0], 
but this is not architecturally mandated. 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


SCR_EL3 is a 64-bit register. 


Field descriptions 


The SCR_EL3 bit assignments are: 


27 26 25 24, 22 21 2019181716 1514131211109 8 76543 2 1 0 


63 

| RESO RESO 
ATA Td | — IRQ 
EnSCxXT FIQ 


FIEN EA 
NMEA RES1 
EASE RESO 
EEL2 SMD 
API HCE 





Bits [63:27] 


Reserved, RESO. 


ATA, bit [26] 
When ARMVv8.5-MemTag is implemented: 
Allocation Tag Access. Controls access at EL2, EL1 and ELO to Allocation Tags. 
When access is prevented: 
° Instructions which Load or Store data are Unchecked. 


à Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI. 
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à Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used 
to generate the Logical Address Tag as 0. 


è Cache maintenance instructions which invalidate Allocation Tags from caches behave as the 
equivalent Clean and Invalidate operation on Allocation Tags. 


è MRS and MSR instructions at EL1 and EL2 using GCR_EL1, RGSR_EL1, TFSR_EL1, 
TFSR_EL2 or TFSREO EL! that are not UNDEFINED or trapped to a lower Exception level 


are trapped to EL3. 

s MRS and MSR instructions at EL2 using TFSR_EL1 that are not UNDEFINED are trapped to 
EL3. 

0bd Access is prevented. 

Qb1 Access is not prevented. 


This field is permitted to be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


EnSCXT, bit [25] 
When ARMV8.0-CSV2 is implemented: 


Enable access to the SCKTNUM_EL2, SCXTNUM_EL1, and SCXTNUM_ELO registers. The 
defined values are: 


Qbd EL2, EL1 and ELO access to SCXTNUM_ELO, EL2 and EL1 access to 
SCXTNUM_ ELI, EL2 access to SCXTNUM_EL2 registers are disabled by this 
mechanism, causing an exception to EL3, and the values of these registers to be treated 
as 0. 


Qb1 This control does not cause accesses to SCXTNUM_EL0, SCXTNUM_EL1, 
SCXTNUM_EL2? to be trapped. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
Bits [24:22] 
Reserved, RESO. 
FIEN, bit [21] 
When ARMV8.4-RAS is implemented: 


Fault Injection enable. Trap accesses to the RAS ERX* registers ERXPFGCDN_EL1, 
ERXPFGCTL_EL1, and ERXPFGF_EL1 from EL1 and EL2 to EL3, reported using EC syndrome 


value 0x18. 
ObO Accesses to the specified registers from EL1 and EL2 generate a Trap exception to EL3. 
Qb1 This control does not cause any instructions to be trapped. 


If EL3 is not implemented, the Effective value of SCR_EL3.FIEN is @b1. 


If ERRIDR_EL1.NUM is zero, meaning no error records are implemented, or no error record 
accessible using System registers is owned by a node that implements the RAS Common Fault 
Injection Model Extension, then this bit might be RESO. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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NMEA, bit [20] 
When ARMV8.4-DFE is implemented: 


Non-maskable External Aborts. When SCR_EL3.EA == 1, controls whether PSTATE.A masks 
SError interrupts at EL3. 


Qbd If SCR_EL3.EA == 1, asserted SError interrupts are not taken at EL3 if PSTATE.A == 
1. 

Qb1 IfSCR_EL3.EA == 1, asserted SError interrupts are taken at EL3 regardless of the value 
of PSTATE.A. 


When SCR_EL3.EA == 0: 


à Asserted SError interrupts are not taken at EL3 regardless of the value of PSTATE.A and this 
field. 


° This field is ignored and its Effective value is 0. 
This field resets to 0. 
Otherwise: 


Reserved, RESO. 


EASE, bit [19] 
When ARMV8.4-DFE is implemented: 
External aborts to SError interrupt vector. 


Obd Synchronous External abort exceptions taken to EL3 are taken to the appropriate 
synchronous exception vector offset from VBAR_EL3. 


Qb1 Synchronous External abort exceptions taken to EL3 are taken to the appropriate SError 
interrupt vector offset from VBAR_EL3. 


This field resets to Q. 
Otherwise: 


Reserved, RESO. 


EEL, bit [18] 
When ARMV8.4-SecEL2 is implemented: 
Secure EL2 Enable. 


ObO All behaviors associated with Secure EL2 are disabled. All registers, including timer 
registers, defined by ARMv8.4-SecEL2 are UNDEFINED, and those timers are disabled. 


0b1 All behaviors associated with Secure EL2 are enabled. 
When the value of this bit is 1, then: 


: When SCR_EL3.NS == 0, the SCR_EL3.RW bit is treated as 1 for all purposes other than 
reading or writing the register. 


° If Secure EL1 is using AArch32, then any of the following operations, executed in Secure 
EL1, is trapped to Secure EL2, using the EC value of ESR_EL2.EC== 0x3 : 


— A read or write of the SCR. 

— A read or write of the NSACR. 

— A read or write of the MVBAR. 

— A read or write of the SDCR. 

— Execution of an ATS12NSO** instruction. 


a If Secure EL1 is using AArch32, then any of the following operations, executed in Secure 
EL1, is trapped to Secure EL2 using the EC value of ESR_EL2.EC== 0x0: 


— Execution of an SRS instruction that uses R13_mon. 


— Execution of an MRS (Banked register) or MSR (Banked register) instruction that 
would access SPSR_mon, R13_mon, or R14_mon. 
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Note 


If the Effective value of SCR_EL3.EEL2 is 0, then these operations executed in Secure EL1 using 
AAtrch32 are trapped to EL3. 





In a Secure only implementation that does not implement EL3 but implements EL2, behaves as if 
SCR_EL3.EEL2 == 1. 


This bit is permitted to be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


API, bit [17] 
When ARMv%8.4-SecEL2 is implemented and ARMv8.3-PAuth is implemented: 


Controls the use of the following instructions related to Pointer Authentication. Traps are reported 
using EC syndrome value 0x09: 


è PACGA, which is always enabled. 


. AUTDA, AUTDB, AUTDZA, AUTDZB, AUTIA, AUTIA1716, AUTIASP, AUTIAZ, 
AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZA, AUTIZB, PACDA, PACDB, 
PACDZA, PACDZB, PACIA, PACIA1716, PACIASP, PACIAZ, PACIB, PACIB1716, 
PACIBSP, PACIBZ, PACIZA, PACIZB, RETAA, RETAB, BRAA, BRAB, BLRAA, 
BLRAB, BRAAZ, BRABZ, BLRAAZ, BLRABZ, ERETAA, ERETAB, LDRAA and 
LDRAB when: 


— In ELO, when HCR_EL2.TGE==0 or HCR_EL2.E2H==0, and the associated 
SCTLR_EL1.En<N><M> == 1. 


— In ELO, when HCR_EL2.TGE==1 and HCR_EL2.E2H==1, and the associated 
SCTLR_EL2.En<N><M> == 1. 


— In EL1, when the associated SCTLR_EL1.En<N><M> == 1. 
— In EL2, when the associated SCTLR_EL2.En<N><M> == 1. 


Qbd The use of any instruction related to pointer authentication in any Exception level 
except EL3 when the instructions are enabled are trapped to EL3 unless they are trapped 
to EL2 as a result of the HCR_EL2.API bit. 


Qb1 This control does not cause any instructions to be trapped. 

An instruction is trapped only if Pointer Authentication is enabled for that instruction, for more 
information, see System register control of pointer authentication on page D5-2510. 

Note 


If ARMv8.3-PAuth is implemented but EL3 is not implemented, the system behaves as if this bit is 
1. 








This field resets to an architecturally UNKNOWN value. 

When ARMVv%8.4-SecEL2 is not implemented and ARMv8.3-PAuth is implemented: 
Controls the use of instructions related to Pointer Authentication: 
° PACGA. 


e AUTDA, AUTDB, AUTDZA, AUTDZB, AUTIA, AUTIA1716, AUTIASP, AUTIAZ, 
AUTIB, AUTIBI716, AUTIBSP, AUTIBZ, AUTIZA, AUTIZB, PACDA, PACDB, 
PACDZA, PACDZB, PACIA, PACIA1716, PACIASP, PACIAZ, PACIB, PACIBI716, 
PACIBSP, PACIBZ, PACIZA, PACIZ, RETAA, RETAB, BRAA, BRAB, BLRAA, BLRAB, 
BRAAZ, BRABZ, BLRAAZ, BLRABZ, ERETAA, ERETAB, LDRAA and LDRAB when: 


— In Non-secure ELO, when HCR_EL2.TGE==0 or HCR_EL2.E2H==0, and the 
associated SCTLR_EL1.En<N><M>== 1. 
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— In Non-secure ELO, when HCR_EL2.TGE==1 and HCR_EL2.E2H==1, and the 
associated SCTLR_EL2.En<N><M> == 1. 


— In Secure ELO, when the associated SCTLR_EL2.En<N><M> == 1. 
— In Secure or Non-secure EL1, when the associated SCTLR_EL1.En<N><M> == 1. 
— In EL2, when the associated SCTLR_EL2.En<N><M> == 1. 


Qbd The use of any instruction related to pointer authentication in any Exception level 
except EL3 when the instructions are enabled are trapped to EL3 unless they are trapped 
to EL2 as a result of the HCR_EL2.API bit. 


Qb1 This control does not cause any instructions to be trapped. 


Note 


If ARMv8.3-PAuth is implemented but EL3 is not implemented, the system behaves as if this bit is 
l. 








This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


APK, bit [16] 
When ARMV8.3-PAuth is implemented: 


Trap registers holding "key" values for Pointer Authentication. Traps accesses to the following 
registers, using EC syndrome value 0x18, from EL1 or EL2 to EL3 unless they are trapped to EL2 
as aresult of the HCR_EL2.APK bit or other traps: 


e APIAKeyLo_EL1, APIAKeyHi_EL1, APIBKeyLo_EL1, APIBKeyHi_EL1. 
*  APDAKeyLo_EL1, APDAKeyHi_EL1, APDBKeyLo_EL1, APDBKeyHi_EL1. 
+ APGAKeyLo_ ELI, and APGAKeyHi_EL1. 


ObO Access to the registers holding "key" values for pointer authentication from EL1 or EL2 
are trapped to EL3 unless they are trapped to EL2 as a result of the HCR_EL2.APK bit 
or other traps. 


0b1 This control does not cause any instructions to be trapped. 
For more information, see System register control of pointer authentication on page D5-2510. 


Note 


If ARMv8.3-PAuth is implemented but EL3 is not implemented, the system behaves as if this bit is 
l. 





This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TERR, bit [15] 
When RAS is implemented: 


Trap Error record accesses. Accesses to the RAS ERR and RAS ERX registers from EL1 and EL2 
to EL3 are trapped as follows: 


: If EL1 is using AArch64, ERRIDR_EL1, ERRSELR_EL1, ERXADDR ELl, 
ERXCTLR_EL1, ERXFR_EL1, ERXMISCO_EL1, ERXMISC1_EL1, and 
ERXSTATUS ELI, are trapped and reported using EC syndrome value 0x18. 


° If ARMv8.4-RAS is implemented, ERXMISC2_EL1, and ERXMISC3_EL1, are trapped and 
reported using EC syndrome value 0x18. 
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e If EL1 is using AArch32, accesses by MCR or MRC to the following registers are reported 
using EC syndrome value 0x03, accesses by MCRR or MRRC are reported using EC 
syndrome value 0x04: 


—  ERRIDR, ERRSELR, ERXADDR, ERXADDR2, ERXCTLR, ERXCTLR2, ERXFR, 
ERXFR2, ERXMISCO, ERXMISC1, ERXMISC2, ERXMISC3, and ERXSTATUS. 


3 If ARMv8.4-RAS is implemented, accesses by MCR or MRC to the following registers are 
reported using EC syndrome value 0x03, accesses by MCRR or MRRC are reported using EC 
syndrome value 0x04: 


—  ERXMISC4, ERXMISC5, ERXMISC6, and ERXMISC7. 
0bd This control does not cause any instructions to be trapped. 
Qb1 Accesses to the specified registers from EL1 and EL2 generate a Trap exception to EL3. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TLOR, bit [14] 
When ARMv8.1-LOR is implemented: 


Trap LOR registers. Traps accesses to the LORSA_EL1, LOREA EL1,LORN_EL1, LORC_EL1, 
and LORID EL] registers from EL1 and EL2 to EL3, unless the access has been trapped to EL2. 


0bd This control does not cause any instructions to be trapped. 


Qb1 ELI and EL2 accesses to the LOR registers that are not UNDEFINED are trapped to EL3, 
unless it is trapped HCR_EL2.TLOR. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TWE, bit [13] 


Traps EL2, EL1, and ELO execution of WFE instructions to EL3, from both Security states and both 
Execution states, reported using EC syndrome value 0x01. 


0bd This control does not cause any instructions to be trapped. 


Qb1 Any attempt to execute a WFE instruction at any Exception level lower than EL3 is 
trapped to EL3, if the instruction would otherwise have caused the PE to enter a 
low-power state and it is not trapped by SCTLR.nTWE, HCR.TWE, 
SCTLR_EL1.nTWE, SCTLR_EL2.nTWE, or HCR_EL2.TWE. 


In AArch32 state, the attempted execution of a conditional WFE instruction is only trapped if the 
instruction passes its condition code check. 


Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 





For more information about when WFE instructions can cause the PE to enter a low-power state, 
see Wait for Event mechanism and Send event on page D1-2372. 


This field resets to an architecturally UNKNOWN value. 


TWI, bit [12] 


Traps EL2, EL1, and ELO execution of WFI instructions to EL3, from both Security states and both 
Execution states, reported using EC syndrome value 0x01. 


0bd This control does not cause any instructions to be trapped. 
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ST, bit [11] 


RW, bit [10] 


Qb1 Any attempt to execute a WFI instruction at any Exception level lower than EL3 is 
trapped to EL3, if the instruction would otherwise have caused the PE to enter a 
low-power state and it is not trapped by SCTLR.nTWI, HCR.TWI, SCTLR_EL1.nTWI, 
SCTLR_EL2.nTWI, or HCR_EL2.TWI. 


In AArch32 state, the attempted execution of a conditional WFI instruction is only trapped if the 
instruction passes its condition code check. 


Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 





For more information about when WFI instructions can cause the PE to enter a low-power state, see 
Wait For Interrupt on page D1-2375. 


This field resets to an architecturally UNKNOWN value. 


Traps Secure EL1 accesses to the Counter-timer Physical Secure timer registers to EL3, from 
AArch64 state only, reported using EC syndrome value 0x18. 


Qbd Secure EL1 using AArch64 accesses to the CNTPS_TVAL EL1, CNTPS_CTL_EL1, 
and CNTPS_CVAL_EL] are trapped to EL3 when Secure EL2 is disabled. If Secure 
EL2 is enabled, the behavior is as if the value of this field was 0b1. 


Qb1 This control does not cause any instructions to be trapped. 





Note 


Accesses to the Counter-timer Physical Secure timer registers are always enabled at EL3. These 
registers are not accessible at ELO. 





This field resets to an architecturally UNKNOWN value. 


Execution state control for lower Exception levels. 
Qbd Lower levels are all AArch32. 


Qb1 The next lower level is AArch64. 
If EL2 is present: 


: EL2 is AArch64. 


° EL2 controls EL1 and ELO behaviors. 
If EL2 is not present: 


s EL1 is AArch64. 


° ELO is determined by the Execution state described in the current process state 
when executing at ELO. 


If AArch32 state is not supported by the implementation at EL2 and AArch32 state is not supported 
by the implementation at EL1, then this bit is RAO/WI. 


If AArch32 state is supported by the implementation at EL1, SCR_EL3.NS == 1 and AArch32 state 
is not supported by the implementation at EL2, the Effective value of this bit is 1. 


If AArch32 state is supported by the implementation at EL1, ARMv8.4-SecEL2 is implemented and 
SCR_EL3.{EEL2, NS} == {1, 0}, the Effective value of this bit is 1. 


This bit is permitted to be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 
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SIF, bit [9] 
When ARMV8.4-SecEL2 is implemented: 


Secure instruction fetch. When the PE is in Secure state, this bit disables instruction fetch from 
memory marked in the first stage of translation as being Non-secure. The possible values for this bit 


are: 

Obd Secure state instruction fetches from memory marked in the first stage of translation as 
being Non-secure are permitted. 

Qb1 Secure state instruction fetches from memory marked in the first stage of translation as 


being Non-secure are not permitted. 
This bit is permitted to be cached in a TLB. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Secure instruction fetch. When the PE is in Secure state, this bit disables instruction fetch from 
Non-secure memory. 


ObO Secure state instruction fetches from Non-secure memory are permitted. 
0b1 Secure state instruction fetches from Non-secure memory are not permitted. 
This bit is permitted to be cached in a TLB. 


This field resets to an architecturally UNKNOWN value. 


HCE, bit [8] 


Hypervisor Call instruction enable. Enables HVC instructions at EL3 and, if EL2 is enabled in the 
current Security state, at EL2 and EL1, in both Execution states, reported using EC syndrome value 


0x00. 
ObO HVC instructions are UNDEFINED. 
Ob1 HVC instructions are enabled at EL3, EL2, and EL1. 


Note 


HVC instructions are always UNDEFINED at ELO and, if Secure EL2 is disabled, at Secure EL1. Any 
resulting exception is taken from the current Exception level to the current Exception level. 





If EL2 is not implemented, this bit is RESO. 
This field resets to an architecturally UNKNOWN value. 
SMD, bit [7] 


Secure Monitor Call disable. Disables SMC instructions at EL1 and above, from both Security states 
and both Execution states, reported using EC syndrome value 0x00. 





Qbd SMC instructions are enabled at EL3, EL2 and EL1. 
Qb1 SMC instructions are UNDEFINED. 
Note 


SMC instructions are always UNDEFINED at ELO. Any resulting exception is taken from the current 
Exception level to the current Exception level. 


If HCR_EL2.TSC or HCR.TSC traps attempted EL1 execution of SMC instructions to EL2, that trap 
has priority over this disable. 





This field resets to an architecturally UNKNOWN value. 


Bit [6] 
Reserved, RESO. 
Bits [5:4] 
Reserved, RES1. 
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EA, bit [3] 


FIQ, bit [2] 


IRQ, bit [1] 


NS, bit [0] 


External Abort and SError interrupt routing. 


Ob When executing at Exception levels below EL3, External aborts and SError interrupts 
are not taken to EL3. 


In addition, when executing at EL3: 
š SError interrupts are not taken. 
° External aborts are taken to EL3. 


Qb1 When executing at any Exception level, External aborts and SError interrupts are taken 
to EL3. 


For more information, see Asynchronous exception routing on page D1-2317. 


This field resets to an architecturally UNKNOWN value. 


Physical FIQ Routing. 
Qbd When executing at Exception levels below EL3, physical FIQ interrupts are not taken 
to EL3. 


When executing at EL3, physical FIQ interrupts are not taken. 
Qb1 When executing at any Exception level, physical FIQ interrupts are taken to EL3. 
For more information, see Asynchronous exception routing on page D1-2317. 


This field resets to an architecturally UNKNOWN value. 


Physical IRQ Routing. 
Qbd When executing at Exception levels below EL3, physical IRQ interrupts are not taken 
to EL3. 


When executing at EL3, physical IRQ interrupts are not taken. 
Qb1 When executing at any Exception level, physical IRQ interrupts are taken to EL3. 
For more information, see Asynchronous exception routing on page D1-2317. 


This field resets to an architecturally UNKNOWN value. 


Non-secure bit. 
Oba Indicates that ELO and EL] are in Secure state. 


Qb1 Indicates that Exception levels lower than EL3 are in Non-secure state, and so memory 
accesses from those Exception levels cannot access Secure memory. 


When SCR_EL3.{EEL2, NS} == {1, 0}, then EL2 is using AArch64 and in Secure state. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SCR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SCR_EL3 











op0 op1 CRn CRm op2 
Ob11 0b110 0b0001 0b0001 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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UNDEFINED; 
elsif PSTATE.EL 

UNDEFINED; 
elsif PSTATE.EL 


== EL2 then 


== EL3 then 


return SCR_EL3; 


MSR SCR_EL3, <Xt> 


if PSTATE.EL == 
UNDEFINED; 
elsif PSTATE.EL 
UNDEFINED; 
elsif PSTATE.EL 
UNDEFINED; 
elsif PSTATE.EL 
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SCR_EL3 = X[t]; 


op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0001 0b000 
ELO then 
== EL1 then 
== EL2 then 
== EL3 then 
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D13.2.105 SCTLR_EL1, System Control Register (EL1) 


i 


Reso T | 


=A 


paa 
TCFO 
ITFSB 
BT1 

BTO 
RESO 
EnlA 
EnlB 
LSMAOE 
nTLSMD 
EnDA 
UCI 


45 44 43 42 41 40 39 38 37 36 35 34 


The SCTLR_EL1 characteristics are: 


Provides top level control of the system, including its memory system, at EL1 and ELO. 


AArch64 System register SCTLR_EL1[31:0] is architecturally mapped to AArch32 System register 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL1 using AArch64. Otherwise, RW fields in this register reset to architecturally UNKNOWN 


Purpose 
Configurations 
SCTLR{3 1:0]. 
values. 
Attributes 


SCTLR_EL1 is a 64-bit register. 


Field descriptions 


The SCTLR_EL1 bit assignments are: 








EE 
EOE 








SPAN 


D13-3258 








32 31 30 29 28 27 26 25 24 23 22 21 2019 18 17 16 1514131211109 8 76543210 





= 


CP15BEN 
nAA 
ITD 
SED 
UMA 
EnRCTX 
EOS 
EnDB 
DZE 
UCT 
nTWI 
RESO 





nTWE 
WXN 
TSCXT 








Bits [63:45] 
Reserved, RESO. 
DSSBS, bit [44] 
When ARMVv8.0-SSBS is implemented: 


Default PSTATE.SSBS value on Exception Entry. The defined values are: 
Qbd PSTATE.SSBS is set to 0 on an exception to EL1 
Qb1 PSTATE.SSBS is set to 1 on an exception to EL1 


IESB 
EIS 


In a system where the PE resets into ELI, this field resets to an IMPLEMENTATION DEFINED value. 


Otherwise: 


Reserved, RESO. 
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ATA, bit [43] 
When ARMV8.5-MemTag is implemented: 


Allocation Tag Access in EL1. When SCR_EL3.ATA=1 and HCR_EL2.ATA=1, controls EL1 
access to Allocation Tags. 


When access to Allocation Tags is prevented: 


° Instructions which Load or Store data are Unchecked. 

° Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI. 

. Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used 
to generate the Logical Address Tag as 0. 

° Cache maintenance instructions which invalidate Allocation Tags from caches behave as the 
equivalent Clean and Invalidate operation on Allocation Tags. 

ObO Access to Allocation Tags is prevented. 

Qb1 Access to Allocation Tags is not prevented. 


This bit is permitted to be cached in a TLB. 
In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


ATAQ, bit [42] 
When ARMV8.5-MemTag is implemented: 


Allocation Tag Access in ELO. When SCR_EL3.ATA=1, HCR_EL2.ATA=1, and 
HCR_EL2.{E2H,TGE} != {1,1}, controls ELO access to Allocation Tags. 


When access to Allocation Tags is prevented: 


° Instructions which Load or Store data are Unchecked. 

$ Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI. 

° Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used 
to generate the Logical Address Tag as 0. 

s Cache maintenance instructions which invalidate Allocation Tags from caches behave as the 
equivalent Clean and Invalidate operation on Allocation Tags. 

Qbd Access to Allocation Tags is prevented. 

Qb1 Access to Allocation Tags is not prevented. 


This field is permitted to be cached in a TLB. 





Note 


Software may change this control bit on a context switch. 





In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
TCE, bits [41:40] 
When ARMV8.5-MemTag is implemented: 
Tag Check Fail in EL1. Controls the effect of tag check fails due to Loads and Stores in EL1. 


0b00 Tag check fails have no effect on the PE. 
0b01 Tag check fails causes a synchronous exception. 
0b10 Tag check fails are asynchronously accumulated. 


The value 0b11 is reserved. 


This field is permitted to be cached in a TLB. 
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In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TCFO0, bits [39:38] 
When ARMV8.5-MemTag is implemented: 


Tag Check Fail in ELO. When HCR_EL2.{E2H,TGE} != {1,1}, controls the effect of tag check fails 
due to Loads and Stores in ELO. 


0b00 Tag check fails have no effect on the PE. 
0b01 Tag check fails causes a synchronous exception. 
0b10 Tag check fails are asynchronously accumulated. 


The value 0b11 is reserved. 


This field is permitted to be cached in a TLB. 
Note 


Software may change this control bit on a context switch. 








In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


ITFSB, bit [37] 
When ARMV8.5-MemTag is implemented: 


When synchronous exceptions are not being generated by Tag Check fails which are generated for 
Loads and Stores in ELO or EL1, controls the auto-synchronization of Tag Check fails into 
TFSREO EL1 and TFSR_EL1. 


Qbd Tag check fails are not synchronized on entry to EL1. 
Qb1 Tag check fails are synchronized on entry to EL1. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
BT1, bit [36] 
When ARMV8.5-BTI is implemented: 
PAC Branch Type compatibility at EL1. 


Qbd When the PE is executing at EL1, PACIASP and PACIBSP are compatible with 
PSTATE.BTYPE == 0b11. 
Qb1 When the PE is executing at EL1, PACIASP and PACIBSP are not compatible with 


PSTATE.BTYPE == 0b11. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
BTO, bit [35] 
When ARMV8.5-BTI is implemented: 
PAC Branch Type compatibility at ELO. 


Qbd When the PE is executing at ELO, PACIASP and PACIBSP are compatible with 
PSTATE.BTYPE == 0b11. 
Qb1 When the PE is executing at ELO, PACIASP and PACIBSP are not compatible with 


PSTATE.BTYPE == 0b11. 
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When HCR_EL2.E2H == 1 && HCR_EL2.TGE == 1, the value of the SCTLR_EL1.BTO0 has no 
effect on execution at ELO 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
Bits [34:32] 
Reserved, RESO. 
EnlA, bit [31] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APIAKey_EL1 key) of instruction addresses 
in the EL1&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


Qbd Pointer authentication (using the APIAKey_EL1 key) of instruction addresses is not 
enabled. 
Qb1 Pointer authentication (using the API[AKey_EL1 key) of instruction addresses is 
enabled. 
Note 





This field controls the behavior of the AddPACIA and AuthIA pseudocode functions. Specifically, 
when the field is 1, AddPACIA returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthIA returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 





In a system where the PE resets into ELI, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


EnIB, bit [30] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APIBKey_EL1 key) of instruction addresses 
in the EL1&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


Qbe Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is not 
enabled. 
Qb1 Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is 
enabled. 
Note 





This field controls the behavior of the AddPACIB and AuthIB pseudocode functions. Specifically, 
when the field is 1, AddPACIB returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthIB returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 





In a system where the PE resets into ELI, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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LSMAOE, bit [29] 
When ARMV8.2-LSMAOC is implemented: 
Load Multiple and Store Multiple Atomicity and Ordering Enable. 


Ob For all memory accesses at ELO, A32 and T32 Load Multiple and Store Multiple can 
have an interrupt taken during the sequence memory accesses, and the memory accesses 
are not required to be ordered. 


Qb1 The ordering and interrupt behavior of A32 and T32 Load Multiple and Store Multiple 
at ELO is as defined for Armv8.0. 


This bit is permitted to be cached in a TLB. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1,1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES]. 
nTLSMD, bit [28] 
When ARMV8.2-LSMAOC is implemented: 
No Trap Load Multiple and Store Multiple to Device-nGRE/Device-nGnRE/Device-nGnRnE 


memory. 

Qbd All memory accesses by A32 and T32 Load Multiple and Store Multiple at ELO that are 
marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are 
trapped and generate a stage 1 Alignment fault. 

Qb1 All memory accesses by A32 and T32 Load Multiple and Store Multiple at ELO that are 
marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not 
trapped. 


This bit is permitted to be cached in a TLB. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1,1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES]. 


EnDA, bit [27] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APDAKey_ ELI key) of instruction addresses 
in the EL1&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 





ObO Pointer authentication (using the APDAKey_EL1 key) of data addresses is not enabled. 
Qb1 Pointer authentication (using the APDAKey_ ELI key) of data addresses is enabled. 
Note 


This field controls the behavior of the AddPACDA and AuthDA pseudocode functions. Specifically, 
when the field is 1, AddPACDA returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthDA returns an authenticated copy of a pointer. When the field is 0, both 
of these functions are NOP. 





In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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UCI, bit [26] 


Traps ELO execution of cache maintenance instructions, to EL1, or to EL2 when it is implemented 
and enabled for the current Security state and HCR_EL2.TGE is 1, from AArch64 state only, 
reported using EC syndrome value 0x18. 


This applies to DC CVAU, DC CIVAC, DC CVAC, DC CVAP, and IC IVAU. 
If ARMv8.2-DCCVADP is implemented, this trap also applies to DC CVADP. 


If ARMv8.5-MemTag is implemented, this trap also applies to DC CIGVAC, DC CIGDVAC, DC 
CGVAC, DC CGDVAC, DC CGVAP, and DC CGDVAP. 


If ARMv8.2-DCCVADP and ARMv8.5-MemTag are implemented, this trap also applies to DC 
CGVADP and DC CGDVADP. 


Qbd Execution of the specified instructions at ELO using AArch64 is trapped. 
Qb1 This control does not cause any instructions to be trapped. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean, or clean and invalidate instruction that operates by 
VA to the point of coherency can be trapped when the value of this control is 1. 


If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean by VA to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED 
whether the execution of any instruction cache invalidate by VA to the Point of Unification 
instruction can be trapped when the value of this control is 1. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


EE, bit [25] 


Endianness of data accesses at EL1, and stage 1 translation table walks in the EL1&0 translation 
regime. 


The possible values of this bit are: 


Qbd Explicit data accesses at EL1, and stage 1 translation table walks in the EL1&0 
translation regime are little-endian. 


Qb1 Explicit data accesses at EL1, and stage 1 translation table walks in the EL1&0 
translation regime are big-endian. 


Ifan implementation does not provide Big-endian support at Exception Levels higher than ELO, this 
bit is RESO. 


If an implementation does not provide Little-endian support at Exception Levels higher than ELO, 
this bit is RES1. 


The EE bit is permitted to be cached in a TLB. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on the PE. 


In a system where the PE resets into EL1, this field resets to an IMPLEMENTATION DEFINED value. 


EOE, bit [24] 
Endianness of data accesses at ELO. 
The possible values of this bit are: 
0b0 Explicit data accesses at ELO are little-endian. 
Qb1 Explicit data accesses at ELO are big-endian. 


If an implementation only supports Little-endian accesses at ELO then this bit is RESO. This option 
is not permitted when SCTLR_EL1.EE is RES1. 
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SPAN, bit [23] 
When ARMV8.1-PAN is implemented: 


TESB, bit [21] 
When ARMV8.2-IESB is implemented: 


If an implementation only supports Big-endian accesses at ELO then this bit is RES1. This option is 
not permitted when SCTLR_EL1.EE is RESO. 


This bit has no effect on the endianness of LDTR, LDTRH, LDTRSH, LDTRSW, STTR, and STTRH instructions 
executed at EL1. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


Set Privileged Access Never, on taking an exception to EL1. 
Qbd PSTATE.PAN is set to 1 on taking an exception to EL1. 
Qb1 The value of PSTATE.PAN is left unchanged on taking an exception to EL1. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RES]. 


When ARMV8.5-CSEH is implemented: 


Exception Entry is Context Synchronizing. The defined values are: 
Qbd The taking of an exception to EL1 is not a context synchronizing event. 
Qb1 The taking of an exception to EL1 is a context synchronizing event. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1,1}, this bit 
has no effect on execution at ELO. 


If SCTLR_EL1.EIS is set to 0b0: 


s Indirect writes to ESR_EL1, FAR_EL1, SPSR_EL1, ELR_EL1 are synchronized on 
exception entry to EL1, so that a direct read of the register after exception entry sees the 
indirectly written value caused by the exception entry. 


a Memory transactions, including instruction fetches, from an Exception level always use the 
translation resources associated with that translation regime. 

. Exception Catch debug events are synchronous debug events. 

. DCPS* and DRPS instructions are context synchronization events. 


The following are not affected by the value of SCTLR_EL1.EIS: 
. Changes to the PSTATE information on entry to EL1. 


. Behavior of accessing the banked copies of the stack pointer using the SP register name for 
loads, stores and data processing instructions. 


. Exit from Debug state. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RES1. 


Implicit Error Synchronization event enable. Possible values are: 
Qbd Disabled. 
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Qb1 An implicit error synchronization event is added: 
g At each exception taken to EL1. 
. Before the operational pseudocode of each ERET instruction executed at EL1. 


When the PE is in Debug state, the effect of this field is CONSTRAINED UNPREDICTABLE, and its 
Effective value might be 0 or 1 regardless of the value of the field. If the Effective value of the field 
is 1, then an implicit error synchronization event is added after each DCPSx instruction taken to EL1 
and before each DRPS instruction executed at EL1, in addition to the other cases where it is added. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
TSCXT, bit [20] 
When ARMV8.0-CSV2 is implemented: 
Trap ELO Access to the SCXTNUM _ELO register, when ELO is using AArch64. The defined values 


are: 

Qbd ELO access to SCXTNUM_ELO is not disabled by this mechanism. 

Qb1 ELO access to SCXTNUM_ELO is disabled, causing an exception to EL1, or to EL2 
when it is implemented and enabled for the current Security state and HCR_EL2.TGE 
is 1. 





The value of SCXTNUM_ ELO is treated as 0. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1,1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into ELI, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES1. 


WXN, bit [19] 


Write permission implies XN (Execute-never). For the EL1&0 translation regime, this bit can force 
all memory regions that are writable to be treated as XN. The possible values of this bit are: 


0bd This control has no effect on memory access permissions. 


Qb1 Any region that is writable in the EL1&0 translation regime is forced to XN for accesses 
from software executing at EL1 or ELO. 


The WXN bit is permitted to be cached in a TLB. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on the PE. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


nTWE, bit [18] 


Traps ELO execution of WFE instructions to EL1, or to EL2 when it is implemented and enabled for 
the current Security state and HCR_EL2.TGE is 1, from both Execution states, reported using EC 
syndrome value 0x01. 


Qbd Any attempt to execute a WFE instruction at ELO is trapped, if the instruction would 
otherwise have caused the PE to enter a low-power state. 


Qb1 This control does not cause any instructions to be trapped. 


In AArch32 state, the attempted execution of a conditional WFE instruction is only trapped if the 
instruction passes its condition code check. 
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Bit [17] 


nTWI, bit [16] 


UCT, bit [15] 


DZE, bit [14] 


Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 








When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Traps ELO execution of WFI instructions to EL1, or to EL2 when it is implemented and enabled for 
the current Security state and HCR_EL2.TGE is 1, from both Execution states, reported using EC 
syndrome value 0x01. 


Qbd Any attempt to execute a WFI instruction at ELO is trapped, if the instruction would 
otherwise have caused the PE to enter a low-power state. 


Qb1 This control does not cause any instructions to be trapped. 

In AArch32 state, the attempted execution of a conditional WFI instruction is only trapped if the 
instruction passes its condition code check. 

Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 








When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


Traps ELO accesses to the CTR_ELO to EL1, or to EL2 when it is implemented and enabled for the 
current Security state and HCR_EL2.TGE is 1, from AArch64 state only, reported using EC value 
0x18. 


Qbd Accesses to the CTR_ELO from ELO using AArch64 are trapped. 
Qb1 This control does not cause any instructions to be trapped. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


Traps ELO execution of DC ZVA instructions to EL1, or to EL2 when it is implemented and enabled 
for the current Security state and HCR_EL2.TGE is 1, from AArch64 state only, reported using EC 
syndrome value 0x18. 


If ARMv8.5-MemTag is implemented, this trap also applies to DC GVA and DC GZVA. 


Qbd Any attempt to execute an instruction that this trap applies to at ELO using AArch64 is 
trapped. 
Reading DCZID_ELO0.DZP from ELO returns 1, indicating that the instructions this trap 
applies to are not supported. 


Qb1 This control does not cause any instructions to be trapped. 
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When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


EnDB, bit [13] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APDBKey_EL1 key) of instruction addresses 
in the EL1&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 





0b0 Pointer authentication (using the APDBKey_EL1 key) of data addresses is not enabled. 
Qb1 Pointer authentication (using the APDBKey_EL1 key) of data addresses is enabled. 
Note 


This field controls the behavior of the AddPACDB and AuthDB pseudocode functions. Specifically, 
when the field is 1, AddPACDB returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthDB returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 





In a system where the PE resets into ELI, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


I, bit [12] 
Instruction access Cacheability control, for accesses at ELO and EL1: 


Qbd All instruction access to Normal memory from ELO and EL1 are Non-cacheable for all 
levels of instruction and unified cache. 


If the value of SCTLR_EL1.M is 0, instruction accesses from stage 1 of the EL1&0 
translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer 
Non-cacheable memory. 


Qb1 This control has no effect on the Cacheability of instruction access to Normal memory 
from ELO and EL1. 


If the value of SCTLR_EL1.M is 0, instruction accesses from stage 1 of the EL1&0 
translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer 
Write-Through memory. 


When the value of the HCR_EL2.DC bit is 1, then instruction access to Normal memory from ELO 
and EL1 are Cacheable regardless of the value of the SCTLR_EL1.1 bit. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on the PE. 


In a system where the PE resets into ELI, this field resets to 0. 


EOS, bit [11] 
When ARMVv8.5-CSEH is implemented: 
Exception Exit is Context Synchronizing. The defined values are: 
Qbd An exception return from EL1 is not a context synchronizing event 
Qb1 An exception return from EL] is a context synchronizing event 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1,1}, this bit 
has no effect on execution at ELO. 


If SCTLR_EL1.EOS is set to 0b0: 


è Memory transactions, including instruction fetches, from an Exception level always use the 
translation resources associated with that translation regime. 


° Exception Catch debug events are synchronous debug events. 
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è DCPS* and DRPS instructions are context synchronization events. 
The following are not affected by the value of SCTLR_EL1.EOS: 


° The indirect write of the PSTATE and PC values from SPSR_EL1 and ELR EL1 on 
exception return is synchronized. 


° Behavior of accessing the banked copies of the stack pointer using the SP register name for 
loads, stores and data processing instructions. 


. Exit from Debug state. 
In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES1. 


EnRCTX, bit [10] 
When ARMV8.0-PredInv is implemented: 


Enable ELO Access to the AArch32 CFPRCTX, DVPRCTX and CPPRCTX instructions, and the 
AArch64 CFP RCTX, DVP RCT and CPP RCTX instructions. The defined values are: 


ObO ELO access to these instructions is disabled, and these instructions are trapped to EL1, 
or to EL2 when it is implemented and enabled for the current Security state and 
HCR_EL2.TGE is 1. 


Qb1 ELO access to these instructions is enabled. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1,1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
UMA, bit [9] 


User Mask Access. Traps ELO execution of MSR and MRS instructions that access the PSTATE. {D, 
A, I, F} masks to EL1, or to EL2 when it is implemented and enabled for the current Security state 
and HCR_EL2.TGE is 1, from AArch64 state only, reported using EC syndrome value 0x18. 


Ob Any attempt at ELO using AArch64 to execute an MRS, MSR(register), or MSR( immediate) 
instruction that accesses the DAIF is trapped. 


Qb1 This control does not cause any instructions to be trapped. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


SED, bit [8] 
SETEND instruction disable. Disables SETEND instructions at ELO using AArch32. 
Qbd SETEND instruction execution is enabled at ELO using AArch32. 


Qb1 SETEND instructions are UNDEFINED at ELO using AArch32 and any attempt at ELO to 
access a SETEND instruction generates an exception to EL1, or to EL2 when it is 
implemented and enabled for the current Security state and HCR_EL2.TGE is 1, 
reported using EC syndrome value 0x00. 


If the implementation does not support mixed-endian operation at any Exception level, this bit is 
RES1. 


If ELO cannot use AArch32, this bit is RES1. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
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Disables some uses of IT instructions at ELO using AArch32. 
All IT instruction functionality is enabled at ELO using AArch32. 


Any attempt at ELO using AArch32 to execute any of the following is UNDEFINED and 
generates an exception, reported using EC syndrome value 0x00, to EL1 or to EL2 when 
it is implemented and enabled for the current Security state and HCR_EL2.TGE is 1: 


s All encodings of the IT instruction with hw1[3:0]!=1000. 
s All encodings of the subsequent instruction with the following values for hw1: 
— — Ob11xxxxxxxxxxxxxx: All 32-bit instructions, and the 16-bit instructions B, 


UDF, SVC, LDM, and STM. 


— 0b1011xxxxxxxxxxxx: All instructions in 'Miscellaneous 16-bit instructions' 
in the Arm® Architecture Reference Manual, Armv8, for Armv8-A 
architecture profile, section F3.2.5. 


— — 0b10100xxxxxxxxxxx: ADD Rd, PC, #imm 
— — 0b01001xxxxxxxxxxx: LDR Rd, [PC, #imm] 


— 0b0100x1xxx1111xxx: ADD Rdn, PC; CMP Rn, PC; MOV Rd, PC; BX PC; 
BLX PC. 


— 0b010001xx1xxxx111: ADD PC, Rm; CMP PC, Rm; MOV PC, Rm. This 
pattern also covers unpredictable cases with BLX Rn. 


These instructions are always UNDEFINED, regardless of whether they would pass or fail 
the condition code check that applies to them as a result of being in an IT block. 


It is IMPLEMENTATION DEFINED whether the IT instruction is treated as: 
. A 16-bit instruction, that can only be followed by another 16-bit instruction. 


° The first half of a 32-bit instruction. 

This means that, for the situations that are UNDEFINED, either the second 16-bit 
instruction or the 32-bit instruction is UNDEFINED. 

An implementation might vary dynamically as to whether IT is treated as a 16-bit 
instruction or the first half of a 32-bit instruction. 


If an instruction in an active IT block that would be disabled by this field sets this field to 1 then 
behavior is CONSTRAINED UNPREDICTABLE. For more information see Changes to an ITD control by 
an instruction in an IT block on page E1-3792 


If ELO cannot use AArch32, this bit is RES1. 


ITD is optional, but if it is implemented in the SCTLR then it must also be implemented in the 
SCTLR_ELl1. If it is not implemented then this bit is RAZ/WI. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


nAA, bit [6] 


When ARMV%8.4-LSE is implemented: 


Non-aligned access. This bit controls generation of Alignment faults at EL1 and ELO under certain 


conditions. 


bo 


Qb1 


LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAPURW, 
LDAR, LDARH, LDLAR, LDLARH, STLLR, STLLRH, STLR, STLRH, STLUR, and 
STLURH generate an Alignment fault if all bytes being accessed are not within a single 
16-byte quantity, aligned to 16 bytes for accesses. 


This control bit does not cause LDAPR, LDAPRH, LDAPUR, LDAPURH, 
LDAPURSH, LDAPURSW, LDAPURW, LDAR, LDARH, LDLAR, LDLARH, 
STLLR, STLLRH, STLR, STLRH, STLUR, or STLURH to generate an Alignment 
fault if all bytes being accessed are not within a single 16-byte quantity, aligned to 16 
bytes. 
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When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


CP15BEN, bit [5] 


SAO, bit [4] 


System instruction memory barrier enable. Enables accesses to the DMB, DSB, and ISB System 
instructions in the (coproc==0b1111) encoding space from ELO: 


ObO ELO using AArch32: ELO execution of the CP15DMB, CP15DSB, and CP15ISB 
instructions is UNDEFINED and generates an exception to EL1, or to EL2 when it is 
implemented and enabled for the current Security state and HCR_EL2.TGE is 1. The 
exception is reported using EC syndrome value 0x00. 


Qb1 ELO using AArch32: ELO execution of the CP1S5DMB, CP15DSB, and CP15ISB 
instructions is enabled. 


If ELO cannot use AArch32, this bit is RESO. 


CP15BEN is optional, but if it is implemented in the SCTLR then it must also be implemented in 
the SCTLR_EL1. If it is not implemented then this bit is RAO/WI. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


SP Alignment check enable for ELO. When set to 1, if a load or store instruction executed at ELO 
uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment 
fault exception is generated. For more information, see SP alignment checking on page D1-2287. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 


In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 


SA, bit [3] 

SP Alignment check enable. When set to 1, if a load or store instruction executed at EL1 uses the 

SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault 

exception is generated. For more information, see SP alignment checking on page D1-2287. 

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 

has no effect on the PE. 

In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 

C, bit [2] 

Cacheability control, for data accesses. 

Obd All data access to Normal memory from ELO and EL1, and all Normal memory accesses 
to the EL1&0 stage 1 translation tables, are Non-cacheable for all levels of data and 
unified cache. 

Qb1 This control has no effect on the Cacheability of: 

s Data access to Normal memory from ELO and EL1. 
a Normal memory accesses to the EL1&0 stage 1 translation tables. 

When the value of the HCR_EL2.DC bit is 1, the PE ignores SCLTR.C. This means that Non-secure 

ELO and Non-secure EL1 data accesses to Normal memory are Cacheable. 

When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 

has no effect on the PE. 

In a system where the PE resets into ELI, this field resets to 0. 
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A, bit [1] 
Alignment check enable. This is the enable bit for Alignment fault checking at EL1 and ELO. 
Qbd Alignment fault checking disabled when executing at EL1 or ELO. 
Instructions that load or store one or more registers, other than load/store exclusive and 
load-acquire/store-release, do not check that the address being accessed is aligned to the 
size of the data element(s) being accessed. 
Qb1 Alignment fault checking enabled when executing at EL1 or ELO. 
All instructions that load or store one or more registers have an alignment check that the 
address being accessed is aligned to the size of the data element(s) being accessed. If 
this check fails it causes an Alignment fault, which is taken as a Data Abort exception. 
Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless 
of the value of the A bit. 
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on execution at ELO. 
In a system where the PE resets into EL1, this field resets to an architecturally UNKNOWN value. 
M, bit [0] 
MMU enable for EL1 and ELO stage 1 address translation. Possible values of this bit are: 
Qbd ELI and ELO stage 1 address translation disabled. 
See the SCTLR_EL1.I field for the behavior of instruction accesses to Normal memory. 
Qb1 ELI and ELO stage 1 address translation enabled. 


If the value of HCR_EL2.{DC, TGE} is not {0, 0} then in Non-secure state the PE behaves as if the 
value of the SCTLR_EL1.M field is 0 for all purposes other than returning the value of a direct read 
of the field. 


When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this bit 
has no effect on the PE. 


In a system where the PE resets into ELI, this field resets to 0. 


Accessing the SCTLR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic SCTLR_EL1 
or SCTLR_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SCTLR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x110] ; 
else 
return SCTLR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.£2H == '1' then 
return SCTLR_EL2; 
else 
return SCTLR_EL1; 
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elsif PSTATE.EL == EL3 then 
return SCTLR_EL1; 


MSR SCTLR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x110] = X[t]; 
else 
SCTLR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
SCTLR_EL2 = X[t]; 
else 
SCTLR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
SCTLR_EL1 = X[t]; 


MRS <Xt>, SCTLR_EL12 





op0 op1 CRn CRm op2 





0b11 0b101 0b0001 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x110] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return SCTLR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return SCTLR_EL1; 
else 
UNDEFINED; 
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MSR SCTLR_EL12, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b101 0b0001 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x110] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
SCTLR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
SCTLR_EL1 = X[t]; 
else 
UNDEFINED; 
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D13.2.106 SCTLR_EL2, System Control Register (EL2) 
The SCTLR_EL2 characteristics are: 


Purpose 
Provides top level control of the system, including its memory system, at EL2. 
When ARMv8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, these 
controls apply also to execution at ELO. 

Configurations 


AArch64 System register SCTLR_EL2[3 1:0] is architecturally mapped to AArch32 System register 
HSCTLR{31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 using AArch64. Otherwise, RW fields in this register reset to architecturally UNKNOWN 
values. 


Attributes 
SCTLR_EL2 is a 64-bit register. 


Field descriptions 


The SCTLR_EL2 bit assignments are: 


When HCR_EL2.E2H != 0b1 or HCR_EL2.TGE != 0b1: 


63 45 44 43 42 41 40 39 38 37 36 35 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 1 


RESO i | 
DSSBS 


76543210 


T a 
RES1 














ATA nAA 
RESO RESO 
RESO EOS 
ITFSB EnDB 
RESO RESO 
EnlA RES1 
EnlB RESO 
RES1 RES1 
EnDA WXN 
RESO RESO 
EE IESB 
RESO EIS 
RES1 
This format applies in all Armv8.0 implementations, and from Armv8.1 when the Effective value of 
HCR_EL2. {E2H, TGE} != {1, 1}. 
Bits [63:45] 
Reserved, RESO. 
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DSSBS, bit [44] 
When ARMV8.0-SSBS is implemented: 
Default PSTATE.SSBS value on Exception Entry. 
Qbd PSTATE.SSBS is set to 0 on an exception to EL2. 
Qb1 PSTATE.SSBS is set to 1 on an exception to EL2. 
In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value. 
Otherwise: 
Reserved, RESO. 
ATA, bit [43] 
When ARMV8.5-MemTag is implemented: 
Allocation Tag Access. When SCR_EL3.ATA=1, controls EL2 access to Allocation Tags. 


When access to Allocation Tags is prevented: 


° Instructions which Load or Store data are Unchecked. 
s Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI. 
$ Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used 


to generate the Logical Address Tag as 0. 


è Cache maintenance instructions which invalidate Allocation Tags from caches behave as the 
equivalent Clean and Invalidate operation on Allocation Tags. 


0b0 Access to Allocation Tags is prevented. 

0b1 Access to Allocation Tags is not prevented. 

This bit is permitted to be cached in a TLB. 

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
Bit [42] 
Reserved, RESO. 
TCE, bits [41:40] 
When ARMV8.5-MemTag is implemented: 
Tack Check Fail in EL2. Controls the effect of tag check fails due to Loads and Stores in EL2. 


0b00 Tag check fails have no effect on the PE. 
0b01 Tag check fails causes a synchronous exception. 
0b10 Tag check fails are asynchronously accumulated. 


The value 0b11 is reserved. 

This field is permitted to be cached in a TLB. 

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [39:38] 


Reserved, RESO. 
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ITFSB, bit [37] 
When ARMV8.5-MemTag is implemented: 


When synchronous exceptions are not being generated by Tag Check fails which are generated for 
Loads and Stores in ELO, EL1 or EL2, controls the auto-synchronization of Tag Check fails into 
TFSREO EL1, TFSR_EL1 and TFSR_EL2. 


Obd Tag check fails are not synchronized on entry to EL2. 
Qb1 Tag check fails are synchronized on entry to EL2. 
Otherwise: 


Reserved, RESO. 


BT, bit [36] 
When ARMV8.5-BTI is implemented: 
PAC Branch Type compatibility at EL2. 


Qbd When the PE is executing at EL2, PACIASP and PACIBSP are compatible with 
PSTATE.BTYPE == 0b11. 
Qb1 When the PE is executing at EL2, PACIASP and PACIBSP are not compatible with 


PSTATE.BTYPE == 0b11. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
Bits [35:32] 
Reserved, RESO. 
EnlIA, bit [31] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APIAKey_EL1 key) of instruction addresses 
in the EL2&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


Ob Pointer authentication (using the APIAKey_EL1 key) of instruction addresses is not 
enabled. 
Qb1 Pointer authentication (using the API[AKey_EL1 key) of instruction addresses is 
enabled. 
Note 





This field controls the behavior of the AddPACIA and AuthIA pseudocode functions. Specifically, 
when the field is 1, AddPACIA returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthIA returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 





In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


EnJB, bit [30] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APIBKey_EL1 key) of instruction addresses 
in the EL2&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


ObO Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is not 
enabled. 
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Qb1 Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is 
enabled. 


Note 
This field controls the behavior of the AddPACIB and AuthIB pseudocode functions. Specifically, 
when the field is 1, AddPACIB returns a copy of a pointer to which a pointer authentication code 


has been added, and AuthIB returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 





In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
Bits [29:28] 
Reserved, RES1. 
EnDA, bit [27] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APDAKey_EL]1 key) of instruction addresses 
in the EL2&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


Obd Pointer authentication (using the APDAKey_ EL! key) of instruction addresses is not 
enabled. 
0b1 Pointer authentication (using the APDAKey_EL1 key) of instruction addresses is 
enabled. 
Note 





This field controls the behavior of the AddPACDA and AuthDA pseudocode functions. Specifically, 
when the field is 1, AddPACDA returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthDA returns an authenticated copy of a pointer. When the field is 0, both 
of these functions are NOP. 





In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bit [26] 


Reserved, RESO. 


EE, bit [25] 
Endianness of data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation 
regime, and stage 2 translation table walks in the EL1&0 translation regime. 


The possible values of this bit are: 


Qbd Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 
translation regime, and stage 2 translation table walks in the EL1&0 translation regime 
are little-endian. 


Qb1 Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 
translation regime, and stage 2 translation table walks in the EL1&0 translation regime 
are big-endian. 


Ifan implementation does not provide Big-endian support at Exception Levels higher than ELO, this 
bit is RESO. 


If an implementation does not provide Little-endian support at Exception Levels higher than ELO, 
this bit is RES1. 
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D13-3278 


Bit [24] 


Bit [23] 


The EE bit is permitted to be cached in a TLB. 


In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value. 


Reserved, RESO. 


Reserved, RES1. 


EIS, bit [22] 


When ARMv8.5-CSEH is implemented: 
Exception entry is a context synchronization event. The defined values are: 
Qbd The taking of an exception to EL2 is not a context synchronization event. 
Qb1 The taking of an exception to EL2 is a context synchronization event. 
If SCTLR_EL2.EIS is set to 0b0: 


° Indirect writes to ESR_EL2, FAR_EL2, SPSR_EL2, ELR_EL2, HPFAR_EL2 are 
synchronized on exception entry to EL2, so that a direct read of the register after exception 
entry sees the indirectly written value caused by the exception entry. 


° Memory transactions, including instruction fetches, from an Exception level always use the 
translation resources associated with that translation regime. 

. Exception Catch debug events are synchronous debug events. 

. DCPS* and DRPS instructions are context synchronization events. 


The following are not affected by the value of SCTLR_EL2.EIS: 
a Changes to the PSTATE information on entry to EL2. 


à Behavior of accessing the banked copies of the stack pointer using the SP register name for 
loads, stores and data processing instructions. 


° Exit from Debug state. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES1. 


IESB, bit [21] 


Bit [20] 


When ARMv%8.2-IESB is implemented: 
Implicit Error Synchronization event enable. 
0b0 Disabled. 
0b1 An implicit error synchronization event is added: 
s At each exception taken to EL2. 
e Before the operational pseudocode of each ERET instruction executed at EL2. 


When the PE is in Debug state, the effect of this field is CONSTRAINED UNPREDICTABLE, and its 
Effective value might be 0 or 1 regardless of the value of the field. If the Effective value of the field 
is 1, then an implicit error synchronization event is added after each DCPSx instruction taken to EL2 
and before each DRPS instruction executed at EL2, in addition to the other cases where it is added. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Reserved, RESO. 
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WXN, bit [19] 


Write permission implies XN (Execute-never). For the EL2 or EL2&0 translation regime, this bit 
can force all memory regions that are writable to be treated as XN: 


0bd This control has no effect on memory access permissions. 


Qb1 Any region that is writable in the EL2 or EL2&0 translation regime is forced to XN for 
accesses from software executing at EL2. 


The WXN bit is permitted to be cached in a TLB. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Bit [18] 

Reserved, RES]. 
Bit [17] 

Reserved, RESO. 
Bit [16] 


Reserved, RES1. 


Bits [15:14] 


Reserved, RESO. 


EnDB, bit [13] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APDBKey_EL1 key) of instruction addresses 
in the EL2&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


Qbe Pointer authentication (using the APDBKey_EL1 key) of data addresses is not enabled. 
Qb1 Pointer authentication (using the APDBKey_EL1 key) of data addresses is enabled. 
Note 





This field controls the behavior of the AddPACDB and AuthDB pseudocode functions. Specifically, 
when the field is 1, AddPACDB returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthDB returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 





In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


I, bit [12] 

Instruction access Cacheability control, for accesses at EL2: 

Qbd All instruction access to Normal memory from EL2 are Non-cacheable for all levels of 
instruction and unified cache. 
If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2 or 
EL2&0 translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer 
Non-cacheable memory. 

Qb1 This control has no effect on the Cacheability of instruction access to Normal memory 
from EL2. 
If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2 or 
EL2&0 translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer 
Write-Through memory. 

This bit has no effect on the EL1&0 or EL3 translation regimes. 

In a system where the PE resets into EL2, this field resets to 0. 
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EOS, bit [11] 


When ARMV8.5-CSEH is implemented: 


Exception exit is a context synchronization Event. 

Qbd An exception return from EL2 is not a context synchronization event. 
Qb1 An exception return from EL2 is a context synchronization event. 

If SCTLR_EL2.EOS is set to 0b0: 


$ Memory transactions, including instruction fetches, from an Exception level always use the 
translation resources associated with that translation regime. 

. Exception Catch debug events are synchronous debug events. 

° DCPS* and DRPS instructions are context synchronization events. 


The following are not affected by the value of SCTLR_EL2.EOS: 


° The indirect write of the PSTATE and PC values from SPSR_EL2 and ELR EL2 on 
exception return is synchronized. 


° Behavior of accessing the banked copies of the stack pointer using the SP register name for 
loads, stores and data processing instructions. 


° Exit from Debug state. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Bits [10:7] 


nAA, bit [6] 


Reserved, RES1. 


Reserved, RESO. 


When ARMV8.4-LSE is implemented: 


Non-aligned access. This bit controls generation of Alignment faults at EL2 under certain 
conditions. 


ObO LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAPURW, 
LDAR, LDARH, LDLAR, LDLARH, STLLR, STLLRH, STLR, STLRH, STLUR, and 
STLURH generate an Alignment fault if all bytes being accessed are not within a single 
16-byte quantity, aligned to 16 bytes for accesses. 


0b1 This control bit does not cause LDAPR, LDAPRH, LDAPUR, LDAPURH, 
LDAPURSH, LDAPURSW, LDAPURW, LDAR, LDARH, LDLAR, LDLARH, 
STLLR, STLLRH, STLR, STLRH, STLUR, or STLURH to generate an Alignment 
fault if all bytes being accessed are not within a single 16-byte quantity, aligned to 16 
bytes. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Bits [5:4] 


SA, bit [3] 


Reserved, RESO. 


Reserved, RES1. 


SP Alignment check enable. When set to 1, if a load or store instruction executed at EL2 uses the 
SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault 
exception is generated. For more information, see SP alignment checking on page D1-2287. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
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Cacheability control, for data accesses. 
Qbd All data access to Normal memory from EL2, and all Normal memory accesses to the 
EL2 translation tables, are Non-cacheable for all levels of data and unified cache. 
Qb1 This control has no effect on the Cacheability of: 
° Data access to Normal memory from EL2. 
° Normal memory accesses to the EL2 translation tables. 
This bit has no effect on the EL1&0 or EL3 translation regimes. 
In a system where the PE resets into EL2, this field resets to 0. 
Alignment check enable. This is the enable bit for Alignment fault checking at EL2: 
Qbd Alignment fault checking disabled when executing at EL2. 
Instructions that load or store one or more registers, other than load/store exclusive and 
load-acquire/store-release, do not check that the address being accessed is aligned to the 
size of the data element(s) being accessed. 
Qb1 Alignment fault checking enabled when executing at EL2. 
All instructions that load or store one or more registers have an alignment check that the 
address being accessed is aligned to the size of the data element(s) being accessed. If 
this check fails it causes an Alignment fault, which is taken as a Data Abort exception. 
Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless 
of the value of the A bit. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
MMU enable for EL2 stage | address translation. Possible values of this bit are: 
Qbe EL2 stage 1 address translation disabled. 
See the SCTLR_EL2.I field for the behavior of instruction accesses to Normal memory. 
Qb1 EL2 stage 1 address translation enabled. 
In a system where the PE resets into EL2, this field resets to 0. 
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When HCR_EL2.E2H == 0b1 and HCR_EL2.TGE == 0b1: 











































ATAO nAA 
TCFO ITD 
ITFSB SED 
BT1 RESO 
BTO EnRCTX 
RESO EOS 
EnlA EnDB 
EnlB DZE 
LSMAOE UCT 
nTLSMD nTWI 
EnDA RESO 
UCI nTWE 
EE WXN 
EOE TSCXT 
SPAN IESB 

EIS 


This format applies only from Armv8.1 when EL2 is enabled in the current Security state and HCR_EL2.{E2H, 
TGE} = {1, 1}. 
Bits [63:45] 


Reserved, RESO. 


DSSBS, bit [44] 
When ARMVv%8.0-SSBS is implemented: 
Default PSTATE.SSBS value on Exception Entry. 
Qbd PSTATE.SSBS is set to 0 on an exception to EL2. 
Qb1 PSTATE.SSBS is set to 1 on an exception to EL2. 
In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value. 
Otherwise: 


Reserved, RESO. 


ATA, bit [43] 
When ARMv8.5-MemTag is implemented: 
Allocation Tag Access in EL2. When SCR_EL3.ATA=1, controls EL2 access to Allocation Tags. 
When access to Allocation Tags is prevented: 
- Instructions which Load or Store data are Unchecked. 
. Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI. 


: Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used 
to generate the Logical Address Tag as 0. 


s Cache maintenance instructions which invalidate Allocation Tags from caches behave as the 
equivalent Clean and Invalidate operation on Allocation Tags. 


Qbd Access to Allocation Tags is prevented. 
Qb1 Access to Allocation Tags is not prevented. 


This bit is permitted to be cached in a TLB. 
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In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


ATAQ, bit [42] 
When ARMV8.5-MemTag is implemented: 
Allocation Tag Access in ELO. When SCR_EL3.ATA=1, controls ELO access to Allocation Tags. 
When access to Allocation Tags is prevented: 
° Instructions which Load or Store data are Unchecked. 


- Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI. 


G Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used 
to generate the Logical Address Tag as 0. 

° Cache maintenance instructions which invalidate Allocation Tags from caches behave as the 
equivalent Clean and Invalidate operation on Allocation Tags. 

Qbd Access to Allocation Tags is prevented. 

Qb1 Access to Allocation Tags is not prevented. 


This field is permitted to be cached in a TLB. 





Note 


Software may change this control bit on a context switch. 





In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
TCE, bits [41:40] 
When ARMV8.5-MemTag is implemented: 
Tag Check Fail in EL2. Controls the effect of tag check fails due to Loads and Stores in EL2. 


0b00 Tag check fails have no effect on the PE. 
0b01 Tag check fails causes a synchronous exception. 
0b10 Tag check fails are asynchronously accumulated. 


The value 0b11 is reserved. 

This field is permitted to be cached in a TLB. 

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
TCFO0, bits [39:38] 
When ARMV8.5-MemTag is implemented: 
Tag Check Fail in ELO. Controls the effect of tag check fails due to Loads and Stores in ELO. 


0b00 Tag check fails have no effect on the PE. 
0b01 Tag check fails causes a synchronous exception. 
0b10 Tag check fails are asynchronously accumulated. 


The value 0b11 is reserved. 


This field is permitted to be cached in a TLB. 
Note 


Software may change this control bit on a context switch. 
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In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


ITFSB, bit [37] 
When ARMV8.5-MemTag is implemented: 


When synchronous exceptions are not being generated by Tag Check fails which are generated for 
Loads and Stores in ELO, EL1 or EL2, controls the auto-synchronization of Tag Check fails into 
TFSREO EL1, TFSR_EL1 and TFSR_EL2. 


Qbd Tag check fails are not synchronized on entry to EL2. 

Qb1 Tag check fails are synchronized on entry to EL2. 

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
BT1, bit [36] 
When ARMV8.5-BTI is implemented: 
PAC Branch Type compatibility at EL2. 


Qbd When the PE is executing at EL2, PACIASP and PACIBSP are compatible with 
PSTATE.BTYPE == 0b11. 
Qb1 When the PE is executing at EL2, PACIASP and PACIBSP are not compatible with 


PSTATE.BTYPE == 0b11. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
BTO, bit [35] 
When ARMV8.5-BTI is implemented: 
PAC Branch Type compatibility at ELO. 


Qbd When the PE is executing at ELO, PACIASP and PACIBSP are compatible with 
PSTATE.BTYPE == 0b11. 
Qb1 When the PE is executing at ELO, PACIASP and PACIBSP are not compatible with 


PSTATE.BTYPE == 0b11. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
Bits [34:32] 
Reserved, RESO. 
EnlIA, bit [31] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APIAKey_EL1 key) of instruction addresses 
in the EL2&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


Qbd Pointer authentication (using the APIAKey_EL1 key) of instruction addresses is not 
enabled. 
Qb1 Pointer authentication (using the API[AKey_EL1 key) of instruction addresses is 
enabled. 
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Note 

This field controls the behavior of the AddPACIA and AuthIA pseudocode functions. Specifically, 
when the field is 1, AddPACIA returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthIA returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 








In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


EnJB, bit [30] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APIBKey_EL1 key) of instruction addresses 
in the EL2&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


Qbo Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is not 
enabled. 
Qb1 Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is 
enabled. 
Note 





This field controls the behavior of the AddPACIB and AuthIB pseudocode functions. Specifically, 
when the field is 1, AddPACIB returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthIB returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 





In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


LSMAOE, bit [29] 
When ARMv8.2-LSMAOC is implemented: 
Load Multiple and Store Multiple Atomicity and Ordering Enable. 


Ob For all memory accesses at ELO, A32 and T32 Load Multiple and Store Multiple can 
have an interrupt taken during the sequence memory accesses, and the memory accesses 
are not required to be ordered. 


Qb1 The ordering and interrupt behavior of A32 and T32 Load Multiple and Store Multiple 
at ELO is as defined for Armv8.0. 


This bit is permitted to be cached in a TLB. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES1. 
nTLSMD, bit [28] 


When ARMV8.2-LSMAOC is implemented: 
No Trap Load Multiple and Store Multiple to Device-nGRE/Device-nGnRE/Device-nGnRnE 


memory. 
ObO All memory accesses by A32 and T32 Load Multiple and Store Multiple at ELO that are 
marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are 
trapped and generate a stage 1 Alignment fault. 
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Qb1 All memory accesses by A32 and T32 Load Multiple and Store Multiple at ELO that are 
marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not 
trapped. 


This bit is permitted to be cached in a TLB. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES1. 


EnDA, bit [27] 
When ARMv8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APDAKey_EL]1 key) of instruction addresses 
in the EL2&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


Qbe Pointer authentication (using the APDAKey_ EL] key) of data addresses is not enabled. 
Qb1 Pointer authentication (using the APDAKey_ ELI key) of data addresses is enabled. 
— Note 


This field controls the behavior of the AddPACDA and AuthDA pseudocode functions. Specifically, 
when the field is 1, AddPACDA returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthDA returns an authenticated copy of a pointer. When the field is 0, both 
of these functions are NOP. 





In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


UCI, bit [26] 


Traps ELO execution of cache maintenance instructions to EL2, from AArch64 state only. This 
applies to DC CVAU, DC CIVAC, DC CVAC, DC CVAP, and IC IVAU. 


If ARMv8.2-DCCVADP is implemented, this trap also applies to DC CVADP. 


If ARMv8.5-MemTag is implemented, this trap also applies to DC CIGVAC, DC CIGDVAC, DC 
CGVAC, DC CGDVAC, DC CGVAP, and DC CGDVAP. 


If ARMv8.2-DCCVADP and ARMv8.5-MemTag are implemented, this trap also applies to DC 
CGVADP and DC CGDVADP. 


Qbd Any attempt to execute an instruction that this trap applies to at ELO using AArch64 is 
trapped to EL2. 
Qb1 This control does not cause any instructions to be trapped. 


If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean, or clean and invalidate instruction that operates by 
VA to the point of coherency can be trapped when the value of this control is 1. 


If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean by VA to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED 
whether the execution of any instruction cache invalidate by VA to the Point of Unification 
instruction can be trapped when the value of this control is 1. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
EE, bit [25] 


Endianness of data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 translation 
regime, and stage 2 translation table walks in the EL2&0 translation regime. 
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The possible values of this bit are: 


Qbd Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 
translation regime, and stage 2 translation table walks in the EL2&0 translation regime 
are little-endian. 


Qb1 Explicit data accesses at EL2, stage 1 translation table walks in the EL2 or EL2&0 
translation regime, and stage 2 translation table walks in the EL2&0 translation regime 
are big-endian. 


Ifan implementation does not provide Big-endian support at Exception Levels higher than ELO, this 
bit is RESO. 


If an implementation does not provide Little-endian support at Exception Levels higher than ELO, 
this bit is RES1. 


The EE bit is permitted to be cached in a TLB. 


In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value. 


EOE, bit [24] 
Endianness of data accesses at ELO. 
Ob Explicit data accesses at ELO are little-endian. 
Qb1 Explicit data accesses at ELO are big-endian. 


If an implementation only supports Little-endian accesses at ELO then this bit is RESO. This option 
is not permitted when SCTLR_EL1.EE is RES1. 


If an implementation only supports Big-endian accesses at ELO then this bit is RES1. This option is 
not permitted when SCTLR_EL1.EE is RESO. 


This bit has no effect on the endianness of LDTR, LDTRH, LDTRSH, LDTRSW, STTR, and STTRH instructions 
executed at EL1. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


SPAN, bit [23] 
Set Privileged Access Never, on taking an exception to EL2. 
Qbd PSTATE.PAN is set to 1 on taking an exception to EL2. 
Qb1 The value of PSTATE.PAN is left unchanged on taking an exception to EL2. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


EIS, bit [22] 
When ARMV8.5-CSEH is implemented: 
Exception Entry is a context synchronization event. 
Qbd The taking of an exception to EL2 is not a context synchronization event. 
Qb1 The taking of an exception to EL2 is a context synchronization event. 
If SCTLR_EL2.EIS is set to 0b0: 


° Indirect writes to ESR_EL2, FAR_EL2, SPSR_EL2, ELR_EL2, HPFAR_EL2 are 
synchronized on exception entry to EL2, so that a direct read of the register after exception 
entry sees the indirectly written value caused by the exception entry. 


° Memory transactions, including instruction fetches, from an Exception level always use the 
translation resources associated with that translation regime. 


° Exception Catch debug events are synchronous debug events. 

- DCPS* and DRPS instructions are context synchronization events. 
The following are not affected by the value of SCTLR_EL2.EIS: 

: Changes to the PSTATE information on entry to EL2. 


` Behavior of accessing the banked copies of the stack pointer using the SP register name for 
loads, stores and data processing instructions. 
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° Exit from Debug state. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES1. 
TESB, bit [21] 
When ARMV8.2-IESB is implemented: 


Implicit Error Synchronization event Enable. 


Qbd Disabled. 
Qb1 An implicit error synchronization event is added: 
s After each exception taken to EL2. 
. Before the operational pseudocode of each ERET instruction executed at EL2. 


When the PE is in Debug state, the effect of this field is CONSTRAINED UNPREDICTABLE, and its 

Effective value might be 0 or 1 regardless of the value of the field. If the Effective value of the field 
is 1, then an implicit error synchronization event is added after each DCPSx instruction taken to EL2 
and before each DRPS instruction executed at EL2, in addition to the other cases where it is added. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TSCXT, bit [20] 
When ARMV8.0-CSV2 is implemented: 
Trap ELO Access to the SCXTNUM_ELO register, when ELO is using AArch64. 
Qbd ELO access to SCXTNUM_ELO is not disabled by this mechanism. 


Qb1 ELO access to SCXTNUM_ELO is disabled, causing an exception to EL2, and the 
SCXTNUM_ELO value is treated at 0. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES1. 


WXN, bit [19] 


Write permission implies XN (Execute-never). For the EL2 or EL2&0 translation regime, this bit 
can force all memory regions that are writable to be treated as XN. The possible values of this bit 


are: 
0bd This control has no effect on memory access permissions. 
Qb1 Any region that is writable in the EL2 or EL2&0 translation regime is forced to XN for 


accesses from software executing at EL2. 
The WXN bit is permitted to be cached in a TLB. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


nTWE, bit [18] 
Traps ELO execution of WFE instructions to EL2, from both Execution states. 


Qbd Any attempt to execute a WFE instruction at ELO is trapped to EL2, if the instruction 
would otherwise have caused the PE to enter a low-power state. 


Qb1 This control does not cause any instructions to be trapped. 


In AArch32 state, the attempted execution of a conditional WFE instruction is only trapped if the 
instruction passes its condition code check. 
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Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 








In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Bit [17] 
Reserved, RESO. 


nTWI, bit [16] 
Traps ELO execution of WFI instructions to EL2, from both Execution states. 


Obd Any attempt to execute a WFI instruction at ELO is trapped EL2, if the instruction would 
otherwise have caused the PE to enter a low-power state. 


Qb1 This control does not cause any instructions to be trapped. 

In AArch32 state, the attempted execution of a conditional WFI instruction is only trapped if the 
instruction passes its condition code check. 

Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 








In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


UCT, bit [15] 
Traps ELO accesses to the CTR_ELO to EL2, from AArch64 state only. 
Qbd Accesses to the CTR_ELO from ELO using AArch64 are trapped to EL2. 
Qb1 This control does not cause any instructions to be trapped. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


DZE, bit [14] 
Traps ELO execution of DC ZVA instructions to EL2, from AArch6é4 state only. 
If ARMv8.5-MemTag is implemented, this trap also applies to DC GVA and DC GZVA. 


Obd Any attempt to execute an instruction that this trap applies to at ELO using AArch64 is 
trapped to EL2. Reading DCZID_EL0.DZP from ELO returns 1, indicating that the 
instructions that this trap applies to are not supported. 


Qb1 This control does not cause any instructions to be trapped. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


EnDB, bit [13] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APDBKey_EL1 key) of instruction addresses 
in the EL2&0 translation regime. 


For more information, see System register control of pointer authentication on page D5-2510. 


Qbd Pointer authentication (using the APDBKey_EL1 key) of instruction addresses is not 
enabled. 
Qb1 Pointer authentication (using the APDBKey_EL1 key) of instruction addresses is 
enabled. 
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Note 

This field controls the behavior of the AddPACDB and AuthDB pseudocode functions. Specifically, 
when the field is 1, AddPACDB returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthDB returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 








In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


I, bit [12] 


EOS, bit [11] 


Reserved, RESO. 


Instruction access Cacheability control, for accesses at EL2 and ELO: 
Qbd All instruction access to Normal memory from EL2 and ELO are Non-cacheable for all 
levels of instruction and unified cache. 


If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2&0 
translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer 
Non-cacheable memory. 


Qb1 This control has no effect on the Cacheability of instruction access to Normal memory 
from EL2 and ELO. 


If the value of SCTLR_EL2.M is 0, instruction accesses from stage 1 of the EL2&0 
translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer 
Write-Through memory. 


This bit has no effect on the EL3 translation regimes. 


In a system where the PE resets into EL2, this field resets to 0. 


When ARMV8.5-CSEH is implemented: 


Exception exit is a context synchronization event. 

Qbd An exception return from EL2 is not a context synchronization event. 
Qb1 An exception return from EL2 is a context synchronization event. 

If SCTLR_EL2.EOS is set to @b0: 


- Memory transactions, including instruction fetches, from an Exception level always use the 
translation resources associated with that translation regime. 

. Exception Catch debug events are synchronous debug events. 

. DCPS* and DRPS instructions are context synchronization events. 


The following are not affected by the value of SCTLR_EL2.EOS: 


° The indirect write of the PSTATE and PC values from SPSR_EL2 and ELR EL2 on 
exception return is synchronized. 


$ Behavior of accessing the banked copies of the stack pointer using the SP register name for 
loads, stores and data processing instructions. 


° Exit from Debug state. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RES1. 


EnRCTX, bit [10] 
When ARMV8.0-PredInv is implemented: 


Enable ELO Access to the AArch32 CFPRCTX, DVPRCTX and CPPRCTX instructions, and the 
AArch64 CFP RCTX, DVP RCT and CPP RCTX System instructions. 


Qbd ELO access to these instructions is disabled, and these instructions are trapped to EL1. 
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Qb1 ELO access to these instructions is enabled. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bit [9] 


Reserved, RESO. 


SED, bit [8] 
SETEND instruction disable. Disables SETEND instructions at ELO using AArch32. 
Qbd SETEND instruction execution is enabled at ELO using AArch32. 
Qb1 SETEND instructions are UNDEFINED at ELO using AArch32. 


If the implementation does not support mixed-endian operation at any Exception level, this bit is 
RESİ. 


If ELO cannot use AArch32, this bit is RES1. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


ITD, bit [7] 
IT Disable. Disables some uses of IT instructions at ELO using AArch32. 
Qbd All IT instruction functionality is enabled at ELO using AArch32. 
Qb1 Any attempt at ELO using AArch32 to execute any of the following is UNDEFINED: 
g All encodings of the IT instruction with hw1[3:0]!=1000. 
° All encodings of the subsequent instruction with the following values for hw1: 


— — Ob11xxxxxxxxxxxxxx: All 32-bit instructions, and the 16-bit instructions B, 
UDF, SVC, LDM, and STM. 


— — 0b1011xxxxxxxxxxxx: All instructions in 'Miscellaneous 16-bit instructions' 
in the Arm® Architecture Reference Manual, Armv8, for Armv8-A 
architecture profile, section F3.2.5. 


— — 0b10100xxxxxxxxxxx: ADD Rd, PC, #imm 
— — 0b01001xxxxxxxxxxx: LDR Rd, [PC, #imm] 


— — 0b0100x1xxx1111xxx: ADD Rdn, PC; CMP Rn, PC; MOV Rd, PC; BX PC; 
BLX PC. 


—  0b010001xx1xxxx111: ADD PC, Rm; CMP PC, Rm; MOV PC, Rm. This 
pattern also covers UNPREDICTABLE cases with BLX Rn. 


These instructions are always UNDEFINED, regardless of whether they would pass or fail 
the condition code check that applies to them as a result of being in an IT block. 


It is IMPLEMENTATION DEFINED whether the IT instruction is treated as: 
. A 16-bit instruction, that can only be followed by another 16-bit instruction. 


. The first half of a 32-bit instruction. 


This means that, for the situations that are UNDEFINED, either the second 16-bit 
instruction or the 32-bit instruction is UNDEFINED. 

An implementation might vary dynamically as to whether IT is treated as a 16-bit 
instruction or the first half of a 32-bit instruction. 


If an instruction in an active IT block that would be disabled by this field sets this field to 1 then 
behavior is CONSTRAINED UNPREDICTABLE. For more information see Changes to an ITD control by 
an instruction in an IT block on page E1-3792 


If ELO cannot use AArch32, this bit is RES1. 


ITD is optional, but if it is implemented in the SCTLR then it must also be implemented in the 
SCTLR_ELl1. If it is not implemented then this bit is RAZ/WI. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
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nAA, bit [6] 


When ARMV8.4-LSE is implemented: 


Non-aligned access. This bit controls generation of Alignment faults at EL2 and ELO under certain 
conditions. 


ObO LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAPURW, 
LDAR, LDARH, LDLAR, LDLARH, STLLR, STLLRH, STLR, STLRH, STLUR, and 
STLURH generate an Alignment fault if all bytes being accessed are not within a single 
16-byte quantity, aligned to 16 bytes for accesses. 


Qb1 This control bit does not cause LDAPR, LDAPRH, LDAPUR, LDAPURH, 
LDAPURSH, LDAPURSW, LDAPURW, LDAR, LDARH, LDLAR, LDLARH, 
STLLR, STLLRH, STLR, STLRH, STLUR, or STLURH to generate an Alignment 
fault if all bytes being accessed are not within a single 16-byte quantity, aligned to 16 
bytes. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


CP15BEN, bit [5] 


SAO, bit [4] 


SA, bit [3] 


C, bit [2] 


System instruction memory barrier enable. Enables accesses to the DMB, DSB, and ISB System 
instructions in the (coproc==0b1111) encoding space from ELO: 


Qbd ELO using AArch32: ELO execution of the CP15DMB, CP15DSB, and CP15ISB 
instructions is UNDEFINED. 
Qb1 ELO using AArch32: ELO execution of the CP15DMB, CP15DSB, and CP15ISB 


instructions is enabled. 
If ELO cannot use AArch32, this bit is RESO. 


CP15BEN is optional, but if it is implemented in the SCTLR then it must also be implemented in 
the SCTLR_EL1. If it is not implemented then this bit is RAO/WI. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


SP Alignment check enable for ELO. When set to 1, if a load or store instruction executed at ELO 
uses the SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment 
fault exception is generated. For more information, see SP alignment checking on page D1-2287. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


SP Alignment check enable. When set to 1, if a load or store instruction executed at EL2 uses the 
SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault 
exception is generated. For more information, see SP alignment checking on page D1-2287. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Cacheability control, for data accesses. 


Qbd All data access to Normal memory from EL2 and ELO, and all Normal memory accesses 
to the EL2&0 translation tables, are Non-cacheable for all levels of data and unified 
cache. 


Qb1 This control has no effect on the Cacheability of: 

- Data access to Normal memory from EL2 and ELO. 

s Normal memory accesses to the EL2&0 translation tables. 
This bit has no effect on the EL3 translation regimes. 


In a system where the PE resets into EL2, this field resets to 0. 
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A, bit [1] 
Alignment check enable. This is the enable bit for Alignment fault checking at EL2 and ELO. 
Qbd Alignment fault checking disabled when executing at EL2 and ELO. 
Instructions that load or store one or more registers, other than load/store exclusive and 
load-acquire/store-release, do not check that the address being accessed is aligned to the 
size of the data element(s) being accessed. 
Qb1 Alignment fault checking enabled when executing at EL2 and ELO. 
All instructions that load or store one or more registers have an alignment check that the 
address being accessed is aligned to the size of the data element(s) being accessed. If 
this check fails it causes an Alignment fault, which is taken as a Data Abort exception. 
Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless 
of the value of the A bit. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
M, bit [0] 
MMU enable for EL2&0 stage 1 address translation. Possible values of this bit are: 
0bd EL2&0 stage 1 address translation disabled. 
See the SCTLR_EL2.I field for the behavior of instruction accesses to Normal memory. 
Qb1 EL2&0 stage 1 address translation enabled. 


In a system where the PE resets into EL2, this field resets to 0. 


Accessing the SCTLR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic SCTLR_EL2 
or SCTLR_ELI are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SCTLR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0001 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return SCTLR_EL2; 
elsif PSTATE.EL == EL3 then 
return SCTLR_EL2; 


MSR SCTLR_EL2, <Xt> 





op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
SCTLR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
SCTLR_EL2 = X[t]; 


MRS <Xt>, SCTLR_EL1 

















op0 op1 CRn CRm op2 
0b11 0b000 0b0001 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x110] ; 
else 
return SCTLR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return SCTLR_EL2; 
else 
return SCTLR_EL1; 
elsif PSTATE.EL == EL3 then 
return SCTLR_EL1; 
MSR SCTLR_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0001 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x110] = X[t]; 
else 
SCTLR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
SCTLR_EL2 = X[t]; 
else 
SCTLR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
SCTLR_EL1 = X[t]; 
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D13.2.107 SCTLR_EL3, System Control Register (EL3) 


The SCTLR_EL3 characteristics are: 


Purpose 
Provides top level control of the system, including its memory system, at EL3. 

Configurations 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL3 using AArch64. Otherwise, RW fields in this register reset to architecturally UNKNOWN 
values. 

Attributes 


SCTLR_EL3 is a 64-bit register. 


Field descriptions 


The SCTLR_EL3 bit assignments are: 


63 45 44 43 42 41 40 39 38 37 36 35 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 1 


RESO J | 
DSSBS 


76543210 


Tha 
RES1 














ATA nAA 
RESO RESO 
RESO EOS 
ITFSB EnDB 
RESO RESO 
EnlA RES1 
EnlB RESO 
RES1 RES1 
EnDA WXN 
RESO RESO 
EE IESB 
RESO EIS 
RES1 


Bits [63:45] 


Reserved, RESO. 


DSSBS, bit [44] 
When ARMVv8.0-SSBS is implemented: 
Default PSTATE.SSBS value on Exception Entry. The defined values are: 
Qbd PSTATE.SSBS is set to 0 on an exception to EL3 
Qb1 PSTATE.SSBS is set to 1 on an exception to EL3 
In a system where the PE resets into EL3, this field resets to an IMPLEMENTATION DEFINED value. 
Otherwise: 


Reserved, RESO. 
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ATA, bit [43] 
When ARMV8.5-MemTag is implemented: 
Allocation Tag Access in EL3. Controls EL3 access to Allocation Tags. 
When access to Allocation Tags is prevented: 
. Instructions which Load or Store data are Unchecked. 


a Instructions which Load or Store Allocation Tags treat the Allocation Tag as RAZ/WI. 


$ Instructions which insert Logical Address Tags into addresses treat the Allocation Tag used 
to generate the Logical Address Tag as 0. 

s Cache maintenance instructions which invalidate Allocation Tags from caches behave as the 
equivalent Clean and Invalidate operation on Allocation Tags. 

ObO Access to Allocation Tags is prevented. 

0b1 Access to Allocation Tags is not prevented. 


This bit is permitted to be cached in a TLB. 
In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
Bit [42] 
Reserved, RESO. 
TCE, bits [41:40] 
When ARMV8.5-MemTag is implemented: 
Tag Check Fail in EL3. Controls the effect of tag check fails due to Loads and Stores in EL3. 


0b00 Tag check fails have no effect on the PE. 
0b01 Tag check fails causes a synchronous exception. 
0b10 Tag check fails are asynchronously accumulated. 


The value 0b11 is reserved. 

This field is permitted to be cached in a TLB. 

In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [39:38] 


Reserved, RESO. 


ITFSB, bit [37] 
When ARMV8.5-MemTag is implemented: 


When asynchronous exceptions are being generated by Tag Check fails which are generated for 
Loads and Stores at any exception level, controls the auto-synchronization of Tag Check fails into 
TFSREO EL! and TFSR_ELx. 


Qbd Tag check fails are not synchronized on entry to EL3. 

Qb1 Tag check fails are synchronized on entry to EL3. 

In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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BT, bit [36] 
When ARMV8.5-BTI is implemented: 
PAC Branch Type compatibility at EL3. 


Qbd When the PE is executing at EL3, PACIASP and PACIBSP are compatible with 
PSTATE.BTYPE == 0b11. 
Qb1 When the PE is executing at EL3, PACIASP and PACIBSP are not compatible with 


PSTATE.BTYPE == 0b11. 
In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
Bits [35:32] 
Reserved, RESO. 
EnlA, bit [31] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APIAKey_EL1 key) of instruction addresses 
in the EL3 translation regime. 


Possible values of this bit are: 


Qbd Pointer authentication (using the API[AKey_EL1 key) of instruction addresses is not 
enabled. 

Qb1 Pointer authentication (using the API[AKey_EL1 key) of instruction addresses is 
enabled. 


For more information, see System register control of pointer authentication on page D5-2510. 





Note 

This field controls the behavior of the AddPACIA and AuthIA pseudocode functions. Specifically, 
when the field is 1, AddPACIA returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthIA returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 





In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


EnJB, bit [30] 
When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APIBKey_EL1 key) of instruction addresses 
in the EL3 translation regime. 


Possible values of this bit are: 


Qbd Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is not 
enabled. 

Qb1 Pointer authentication (using the APIBKey_EL1 key) of instruction addresses is 
enabled. 


For more information, see System register control of pointer authentication on page D5-2510. 


Note 
This field controls the behavior of the AddPACIB and AuthIB pseudocode functions. Specifically, 
when the field is 1, AddPACIB returns a copy of a pointer to which a pointer authentication code 


has been added, and AuthIB returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 
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In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Bits [29:28] 


EnDA, bit [27] 


Reserved, RESO. 


Reserved, RES]. 


When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APDAKey_EL]1 key) of instruction addresses 
in the EL3 translation regime. 


ObO Pointer authentication (using the APDAKey_EL1 key) of data addresses is not enabled. 
Qb1 Pointer authentication (using the APDAKey_ ELI key) of data addresses is enabled. 


For more information, see System register control of pointer authentication on page D5-2510. 





Note 

This field controls the behavior of the AddPACDA and AuthDA pseudocode functions. Specifically, 
when the field is 1, AddPACDA returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthDA returns an authenticated copy of a pointer. When the field is 0, both 
of these functions are NOP. 





In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Bit [26] 


EE, bit [25] 


Reserved, RESO. 


Reserved, RESO. 


Endianness of data accesses at EL3, and stage 1 translation table walks in the EL3 translation 
regime. 


The possible values of this bit are: 


Obd Explicit data accesses at EL3, and stage | translation table walks in the EL3 translation 
regime are little-endian. 


Qb1 Explicit data accesses at EL3, and stage | translation table walks in the EL3 translation 
regime are big-endian. 


Ifan implementation does not provide Big-endian support at Exception Levels higher than ELO, this 
bit is RESO. 


If an implementation does not provide Little-endian support at Exception Levels higher than ELO, 
this bit is RES1. 


The EE bit is permitted to be cached in a TLB. 


In a system where the PE resets into EL3, this field resets to an IMPLEMENTATION DEFINED value. 


Bit [24] 
Reserved, RESO. 
Bit [23] 
Reserved, RES]. 
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EIS, bit [22] 
When ARMV8.5-CSEH is implemented: 
Exception Entry is Context Synchronizing. 
Qbd The taking of an exception to EL3 is not a context synchronizing event. 
Qb1 The taking of an exception to EL3 is a context synchronizing event. 
If SCTLR_EL3.EIS is set to 0b0: 


= Indirect writes to ESR_EL3, FAR_EL3, SPSR_EL3, ELR_EL3 are synchronized on 
exception entry to EL3, so that a direct read of the register after exception entry sees the 
indirectly written value caused by the exception entry. 


s Memory transactions, including instruction fetches, from an Exception level always use the 
translation resources associated with that translation regime. 

° Exception Catch debug events are synchronous debug events. 

- DCPS* and DRPS instructions are context synchronization events. 


The following are not affected by the value of SCTLR_EL3.EIS: 
- Changes to the PSTATE information on entry to EL3. 


- Behavior of accessing the banked copies of the stack pointer using the SP register name for 
loads, stores and data processing instructions. 


° Debug state exit. 
In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES1. 
IESB, bit [21] 
When ARMV8.2-IESB is implemented: 


Implicit Error Synchronization event enable. 


Qbd Disabled. 
Qb1 An implicit error synchronization event is added: 
í At each exception taken to EL3. 
. Before the operational pseudocode of each ERET instruction executed at EL3. 


When the PE is in Debug state, the effect of this field is CONSTRAINED UNPREDICTABLE, and its 
Effective value might be 0 or 1 regardless of the value of the field. If the Effective value of the field 
is 1, then an implicit error synchronization event is added after each DCPSx instruction taken to EL3 
and before each DRPS instruction executed at EL3, in addition to the other cases where it is added. 


When ARMv8.4-DFE is implemented, and the Effective value of SCR_EL3.NMEA is 1, this field 
is ignored and its Effective value is 1. 


In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bit [20] 


Reserved, RESO. 


WXN, bit [19] 


Write permission implies XN (Execute-never). For the EL3 translation regime, this bit can force all 
memory regions that are writable to be treated as XN. The possible values of this bit are: 


0bd This control has no effect on memory access permissions. 


Qb1 Any region that is writable in the EL3 translation regime is forced to XN for accesses 
from software executing at EL3. 


The WXN bit is permitted to be cached in a TLB. 
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D13-3300 


Bit [18] 


Bit [17] 


Bit [16] 


Bits [15:14] 


EnDB, bit [13] 


In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 


Reserved, RES1. 


Reserved, RESO. 


Reserved, RES1. 


Reserved, RESO. 


When ARMV8.3-PAuth is implemented: 


Controls enabling of pointer authentication (using the APDBKey_EL1 key) of instruction addresses 
in the EL3 translation regime. 


ObO Pointer authentication (using the APDBKey_EL1 key) of data addresses is not enabled. 
0b1 Pointer authentication (using the APDBKey_EL1 key) of data addresses is enabled. 


For more information, see System register control of pointer authentication on page D5-2510. 


Note 

This field controls the behavior of the AddPACDB and AuthDB pseudocode functions. Specifically, 
when the field is 1, AddPACDB returns a copy of a pointer to which a pointer authentication code 
has been added, and AuthDB returns an authenticated copy of a pointer. When the field is 0, both of 
these functions are NOP. 








In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


I, bit [12] 


EOS, bit [11] 


Reserved, RESO. 


Instruction access Cacheability control, for accesses at EL3: 
Qbd All instruction access to Normal memory from EL3 are Non-cacheable for all levels of 
instruction and unified cache. 


If the value of SCTLR_EL3.M is 0, instruction accesses from stage 1 of the EL3 
translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer 
Non-cacheable memory. 


Qb1 This control has no effect on the Cacheability of instruction access to Normal memory 
from EL3. 


If the value of SCTLR_EL3.M is 0, instruction accesses from stage 1 of the EL3 
translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer 
Write-Through memory. 


This bit has no effect on the EL1&0, EL2, or EL2&0 translation regimes. 


In a system where the PE resets into EL3, this field resets to 0. 


When ARMVv8.5-CSEH is implemented: 


Exception Exit is Context Synchronizing. 


Qbd An exception return from EL3 is not a context synchronizing event 
Qb1 An exception return from EL3 is a context synchronizing event 
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If SCTLR_EL3.EOS is set to @b0: 


Memory transactions, including instruction fetches, from an Exception level always use the 
translation resources associated with that translation regime. 


Exception Catch debug events are synchronous debug events. 


DCPS* and DRPS instructions are context synchronization events. 


The following are not affected by the value of SCTLR_EL3.EOS: 


The indirect write of the PSTATE and PC values from SPSR_EL3 and ELR_EL3 on 
exception return is synchronized. 


If the PE enters Debug state before the first instruction after an Exception return from EL3 
to Non-secure state, any pending Halting debug event completes execution. 


The GIC behavior that allocates interrupts to FIQ or IRQ changes simultaneously with 
leaving the EL3 Exception level. 


Behavior of accessing the banked copies of the stack pointer using the SP register name for 
loads, stores and data processing instructions. 


Exit from Debug state. 


In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RES1. 


Bits [10:7] 


Reserved, RESO. 


nAA, bit [6] 


When ARMV8.4-LSE is implemented: 


Non-aligned access. This bit controls generation of Alignment faults at EL3 under certain 


conditions. 

ObO LDAPR, LDAPRH, LDAPUR, LDAPURH, LDAPURSH, LDAPURSW, LDAPURW, 
LDAR, LDARH, LDLAR, LDLARH, STLLR, STLLRH, STLR, STLRH, STLUR, and 
STLURH generate an Alignment fault if all bytes being accessed are not within a single 
16-byte quantity, aligned to 16 bytes for accesses. 

0b1 This control bit does not cause LDAPR, LDAPRH, LDAPUR, LDAPURH, 


LDAPURSH, LDAPURSW, LDAPURW, LDAR, LDARH, LDLAR, LDLARH, 
STLLR, STLLRH, STLR, STLRH, STLUR, or STLURH to generate an Alignment 
fault if all bytes being accessed are not within a single 16-byte quantity, aligned to 16 
bytes. 


In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Bits [5:4] 


Reserved, RES]. 


SA, bit [3] 


SP Alignment check enable. When set to 1, if a load or store instruction executed at EL3 uses the 
SP as the base address and the SP is not aligned to a 16-byte boundary, then a SP alignment fault 
exception is generated. For more information, see SP alignment checking on page D1-2287. 


In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 


C, bit [2] 


Cacheability control, for data accesses. 


Obed 


All data access to Normal memory from EL3, and all Normal memory accesses to the 
EL3 translation tables, are Non-cacheable for all levels of data and unified cache. 
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Qb1 This control has no effect on the Cacheability of: 
. Data access to Normal memory from EL3. 
° Normal memory accesses to the EL3 translation tables. 


This bit has no effect on the EL1&0, EL2, or EL2&0 translation regimes. 


In a system where the PE resets into EL3, this field resets to 0. 


A, bit [1] 
Alignment check enable. This is the enable bit for Alignment fault checking at EL3. 
Qbd Alignment fault checking disabled when executing at EL3. 
Instructions that load or store one or more registers, other than load/store exclusive and 
load-acquire/store-release, do not check that the address being accessed is aligned to the 
size of the data element(s) being accessed. 
Qb1 Alignment fault checking enabled when executing at EL3. 
All instructions that load or store one or more registers have an alignment check that the 
address being accessed is aligned to the size of the data element(s) being accessed. If 
this check fails it causes an Alignment fault, which is taken as a Data Abort exception. 
Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless 
of the value of the A bit. 
In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 
M, bit [0] 


MMU enable for EL3 stage | address translation. Possible values of this bit are: 


ObO EL3 stage 1 address translation disabled. 
See the SCTLR_EL3.I field for the behavior of instruction accesses to Normal memory. 


0b1 EL3 stage 1 address translation enabled. 


In a system where the PE resets into EL3, this field resets to 0. 


Accessing the SCTLR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SCTLR_EL3 








op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return SCTLR_EL3; 
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MSR SCTLR_EL3, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
SCTLR_EL3 = X[t]; 
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D13.2.108 SCXTNUM_ELO, ELO Read/Write Software Context Number 
The SCXTNUM_ELO characteristics are: 


Purpose 


Provides a number that can be used to separate out different context numbers with the ELO exception 
level, for the purpose of protecting against side-channels using branch prediction and similar 
resources. 


Configurations 
This register is present only when ARMVv8.0-CSV2 is implemented. Otherwise, direct accesses to 
SCXTNUM_ELO are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 
SCXTNUM_ELO is a 64-bit register. 


Field descriptions 


The SCXTNUM_ELO bit assignments are: 


63 0 


Software Context Number 


Bits [63:0] 
Software Context Number. A number to identify the context within the ELO exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SCXTNUM_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SCXTNUM_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1101 0b0000 0b111 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.TSCXT == '1' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.TSCXT == '1' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return SCXTNUM_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.EnSCXT == 'Q' then 
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AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return SCXTNUM_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return SCXTNUM_ELQ; 
elsif PSTATE.EL == EL3 then 
return SCXTNUM_ELO; 


MSR SCXTNUM_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1101 0b0000 0b111 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.TSCXT == '1' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.TSCXT == '1' 


then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
SCXTNUM_EL®@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
SCXTNUM_EL®@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 





else 

SCXTNUM_EL® = X[t]; 

elsif PSTATE.EL == EL3 then 
SCXTNUM_EL® = X[t]; 
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D13.2.109 SCXTNUM_EL1, EL1 Read/Write Software Context Number 
The SCXTNUM_ELI characteristics are: 


Purpose 


Provides a number that can be used to separate out different context numbers with the EL1 exception 
level, for the purpose of protecting against side-channels using branch prediction and similar 
resources. 


Configurations 


This register is present only when ARMVv8.0-CSV2 is implemented. Otherwise, direct accesses to 
SCXTNUM_ ELI are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
SCXTNUM_EL1 is a 64-bit register. 


Field descriptions 


The SCXTNUM_ ELI bit assignments are: 


63 0 


Software Context Number 


Bits [63:0] 
Software Context Number. A number to identify the context within the EL1 exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SCXTNUM_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SCXTNUM_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1101 0b0000 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x188] ; 
else 
return SCXTNUM_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
return SCXTNUM_EL2; 
else 
return SCXTNUM_EL1; 
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elsif PSTATE.EL == EL3 then 
return SCXTNUM_EL1; 


MSR SCXTNUM_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1101 0b0000 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x188] = X[t]; 
else 
SCXTNUM_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
SCXTNUM_EL2 = X[t]; 
else 





SCXTNUM_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
SCXTNUM_EL1 = X[t]; 


MRS <Xt>, SCXTNUM_EL12 





op0 op1 CRn CRm op2 





0b11 0b101 0b1101 0b0000 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x188] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return SCXTNUM_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return SCXTNUM_EL1; 
else 
UNDEFINED; 
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D13-3308 


MSR SCXTNUM_EL12, <Xt> 





op0 op1 CRn CRm 


0b11 0b101 0b1101 0b0000 


op2 


0b111 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x188] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
SCXTNUM_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
SCXTNUM_EL1 = X[t]; 
else 
UNDEFINED; 
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D13.2.110 SCXTNUM_EL2, EL2 Read/Write Software Context Number 
The SCXTNUM_EL2 characteristics are: 


Purpose 


Provides a number that can be used to separate out different context numbers with the EL2 exception 
level, for the purpose of protecting against side-channels using branch prediction and similar 
resources. 


Configurations 


This register is present only when ARMVv8.0-CSV2 is implemented. Otherwise, direct accesses to 
SCXTNUM_EL2 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
SCXTNUM_EL2 is a 64-bit register. 


Field descriptions 


The SCXTNUM_EL2 bit assignments are: 


63 0 


Software Context Number 


Bits [63:0] 
Software Context Number. A number to identify the context within the EL2 exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SCXTNUM_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic 
SCXTNUM_EL2 or SCXTNUM_ EL] are not guaranteed to be ordered with respect to accesses using the other 
mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SCXTNUM_EL2 





op0 op1 CRn CRm op2 


0b11 0b100 0b1101 0b0000 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return SCXTNUM_EL2; 
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elsif PSTATE.EL == EL3 then 
return SCXTNUM_EL2; 


MSR SCXTNUM_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b1101 0b0000 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
SCXTNUM_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
SCXTNUM_EL2 = X[t]; 


MRS <Xt>, SCXTNUM_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1101 0b0000 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x188] ; 
else 
return SCXTNUM_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
return SCXTNUM_EL2; 
else 
return SCXTNUM_EL1; 
elsif PSTATE.EL == EL3 then 
return SCXTNUM_EL1; 
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MSR SCXTNUM_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b1101 0b0000 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.EnSCXT == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x188] = X[t]; 
else 
SCXTNUM_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.EnSCXT == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
SCXTNUM_EL2 = X[t]; 
else 
SCXTNUM_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
SCXTNUM_EL1 = X[t]; 
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D13.2.111 SCXTNUM_EL3, EL3 Read/Write Software Context Number 
The SCXTNUM_EL3 characteristics are: 


Purpose 


Provides a number that can be used to separate out different context numbers with the EL3 exception 
level, for the purpose of protecting against side-channels using branch prediction and similar 
resources. 


Configurations 


This register is present only when ARMVv8.0-CSV2 is implemented. Otherwise, direct accesses to 
SCXTNUM_EL3 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
SCXTNUM _EL3 is a 64-bit register. 


Field descriptions 


The SCXTNUM EL3 bit assignments are: 


63 0 


Software Context Number 


Bits [63:0] 
Software Context Number. A number to identify the context within the EL3 exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SCXTNUM_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, SCXTNUM_EL3 











op0 op1 CRn CRm op2 
0b11 0b110 0b1101 0b0000 0b111 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return SCXTNUM_EL3; 
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MSR SCXTNUM_EL3, <Xt> 


if PSTATE.EL == 
UNDEFINED; 
elsif PSTATE.EL 
UNDEFINED; 
elsif PSTATE.EL 
UNDEFINED; 
elsif PSTATE.EL 
SCXTNUM_EL3 


EL@ then 
== EL1 then 
== EL2 then 


== EL3 then 
= X[t]; 
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op0 op1 


0b11 0b110 


CRn 


0b1101 


CRm 


0b0000 


op2 


0b111 
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D13.2.112 TCR_EL41, Translation Control Register (EL1) 


The TCR_EL1 characteristics are: 


RESO 


EOPD1 


Purpose 


The control register for stage 1 of the EL1&0 translation regime. 


Configurations 


Attributes 


AArch6é4 System register TCR_EL1[31:0] is architecturally mapped to AArch32 System register 
TTBCR[{31:0]. 


AArch64 System register TCR_EL1[63:32] is architecturally mapped to AArch32 System register 
TTBCR2[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


TCR_EL1 is a 64-bit register. 


Field descriptions 


The TCR_EL1 bit assignments are: 


BER? B.S Seine Silas 82 31 50 49 48 47 46 45 44 43 42 41 20 $998 37 38 2 r St 80 29:28, AT AD 2028 A ie 1514131211109 8 7 6 5,0 
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4 


Any of the bits in TCR_EL1, other than the A1 bit and the EPDx bits when they have the value 1, are permitted to 
be cached in a TLB. 


Bits [63:59] 


Reserved, RESO. 


TCMAL, bit [58] 
When ARMVv8.5-MemTag is implemented: 


Controls the generation of Unchecked accesses at EL1, and at ELO if 
HCR_EL2.{E2H,TGE}!={1,1}, when address[59:55] = @b11111. 


Qbd This control has no effect on the generation of Unchecked accesses at EL1 or ELO. 
Qb1 All accesses at EL1 and ELO are Unchecked. 
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Note 


Software may change this control bit on a context switch. 





This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
TCMADO, bit [57] 
When ARMV8.5-MemTag is implemented: 


Controls the generation of Unchecked accesses at EL1, and at ELO if 
HCR_EL2.{E2H,TGE}!={1,1}, when address[59:55] = @b00000. 





Qbd This control has no effect on the generation of Unchecked accesses at EL1 or ELO. 
Qb1 All accesses at EL1 and ELO are Unchecked. 
Note 


Software may change this control bit on a context switch. 





This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
EOPD1, bit [56] 
When ARMv8.5-E0PD is implemented: 
Faulting control for ELO access to any address translated by TTBR1_EL1. 


Qbd ELO access to any address translated by TTBR1_EL1 will not generate a fault by this 
mechanism. 

Qb1 ELO access to any address translated by TTBR1_EL1 will generate a level 0 translation 
fault 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
EOPDO, bit [55] 
When ARMV8.5-EOPD is implemented: 
Faulting control for ELO access to any address translated by TTBRO_EL1. 


Qbd ELO access to any address translated by TTBRO_EL1 will not generate a fault by this 
mechanism. 

Qb1 ELO access to any address translated by TTBRO_EL1 will generate a level 0 translation 
fault 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


NFD1, bit [54] 
When SVE is implemented: 
Non-fault translation table walk disable for stage 1 translations using TTBR1_EL1. 


This bit controls whether to perform a stage | translation table walk in response to a non-fault access 
from ELO for a virtual address that is translated using TTBR1_EL1. 


If SVE is implemented, the affected access types include: 


. All accesses due to an SVE non-fault contiguous load instruction. 
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NFDO, bit [53] 
When SVE is implemented: 


è Accesses due to an SVE first-fault gather load instruction that are not for the First active 
element. Accesses due to an SVE first-fault contiguous load instruction are not affected. 

° Accesses due to prefetch instructions might be affected, but the effect is not architecturally 
visible. 


See The Scalable Vector Extension (SVE) on page A2-92 for more information. 
Defined values are: 
ObO Does not disable stage 1 translation table walks using TTBR1_EL1. 


Qb1 A TLB miss on a virtual address that is translated using TTBR1_EL1 due to the 
specified access types causes the access to fail without taking an exception. No stage 1 
translation table walk is performed. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Non-fault translation table walk disable for stage 1 translations using TTBRO_EL1. 


This bit controls whether to perform a stage | translation table walk in response to a non-fault access 
from ELO for a virtual address that is translated using TTBRO_EL1. 


If SVE is implemented, the affected access types include: 


° All accesses due to an SVE non-fault contiguous load instruction. 

. Accesses due to an SVE first-fault gather load instruction that are not for the First active 
element. Accesses due to an SVE first-fault contiguous load instruction are not affected. 

° Accesses due to prefetch instructions might be affected, but the effect is not architecturally 
visible. 


See The Scalable Vector Extension (SVE) on page A2-92 for more information. 
Defined values are: 
ObO Does not disable stage | translation table walks using TTBRO_EL1. 


Qb1 A TLB miss on a virtual address that is translated using TTBRO_EL1 due to the 
specified access types causes the access to fail without taking an exception. No stage 1 
translation table walk is performed. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


TBID1, bit [52] 
When ARMV8.3-PAuth is implemented: 


Controls the use of the top byte of instruction addresses for address matching. 

For more information, see Address tagging in AArch64 state on page D5-2506. 

Qbd TCR_EL1.TBI1 applies to Instruction and Data accesses. 

Qb1 TCR_EL1.TBI1 applies to Data accesses only. 

This affects addresses where the address would be translated by tables pointed to by TTBR1_EL1. 
This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 
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TBIDO, bit [51] 

When ARMV8.3-PAuth is implemented: 
Controls the use of the top byte of instruction addresses for address matching. 
For more information, see Address tagging in AArch64 state on page D5-2506. 
Qbd TCR_EL1.TBIO applies to Instruction and Data accesses. 
Qb1 TCR_EL1.TBIO applies to Data accesses only. 
This affects addresses where the address would be translated by tables pointed to by TTBRO_EL1. 
This field resets to an architecturally UNKNOWN value. 

Otherwise: 


Reserved, RESO. 


HWU162, bit [50] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 
translation table Block or Page entry for translations using TTBR1_EL1. 


Qbd For translations using TTBR1_EL1, bit[62] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBR1_EL1, bit[62] of each stage 1 translation table Block or 


Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL1.HPD1 is 1. 


The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
HWU161, bit [49] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 
translation table Block or Page entry for translations using TTBR1_EL1. 


Qbd For translations using TTBR1_EL1, bit[61] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBR1_EL1, bit[61] of each stage 1 translation table Block or 


Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL1.HPD1 is 1. 


The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU160, bit [48] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 
translation table Block or Page entry for translations using TTBR1_EL1. 


Qbd For translations using TTBR1_EL1, bit[60] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBR1_EL1, bit[60] of each stage 1 translation table Block or 


Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL1.HPD1 is 1. 


The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0. 
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This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU159, bit [47] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 
translation table Block or Page entry for translations using TTBR1_EL1. 


Qbd For translations using TTBR1_EL1, bit[59] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBR1_EL1, bit[59] of each stage 1 translation table Block or 
Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL1.HPD1 is 1. 


The Effective value of this field is 0 if the value of TCR_EL1.HPD1 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU062, bit [46] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 
translation table Block or Page entry for translations using TTBRO_EL1. 


Qbd For translations using TTBRO_EL1, bit[62] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBRO_EL1, bit[62] of each stage 1 translation table Block or 
Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL1.HPD0 is 1. 


The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU061, bit [45] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 
translation table Block or Page entry for translations using TTBRO_EL1. 


Qbd For translations using TTBRO_EL1, bit[61] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBRO_EL1, bit[61] of each stage 1 translation table Block or 
Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL1.HPD0 is 1. 


The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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HWU060, bit [44] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 
translation table Block or Page entry for translations using TTBRO_EL1. 


Qbd For translations using TTBRO_EL1, bit[60] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBRO_EL1, bit[60] of each stage 1 translation table Block or 


Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL1.HPD0 is 1. 


The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU059, bit [43] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 
translation table Block or Page entry for translations using TTBRO_EL1. 


Qbd For translations using TTBRO_EL1, bit[59] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBRO_EL1, bit[59] of each stage 1 translation table Block or 


Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL1.HPD0 is 1. 


The Effective value of this field is 0 if the value of TCR_EL1.HPD0 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HPD1, bit [42] 
When ARMV8.1-HPD is implemented: 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, 
and UXNTable, except NSTable, in the translation tables pointed to by TTBR1_EL1. 


Obed Hierarchical permissions are enabled. 

Qb1 Hierarchical permissions are disabled. 

When disabled, the permissions are treated as if the bits are zero. 

This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HPDO, bit [41] 
When ARMV8.1-HPD is implemented: 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, 
and UXNTable, except NSTable, in the translation tables pointed to by TTBRO_EL1. 


Obd Hierarchical permissions are enabled. 

Qb1 Hierarchical permissions are disabled. 

When disabled, the permissions are treated as if the bits are zero. 

This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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HD, bit [40] 


When ARMV8.1-TTHM is implemented: 


Hardware management of dirty state in stage 1 translations from ELO and EL1. 

Qbd Stage 1 hardware management of dirty state disabled. 

Qb1 Stage 1 hardware management of dirty state enabled, only if the HA bit is also set to 1. 
This field resets to an architecturally UNKNOWN value. 


Otherwise: 


HA, bit [39] 


Reserved, RESO. 


When ARMV8.1-TTHM is implemented: 


Hardware Access flag update in stage 1 translations from ELO and EL1. 
Qbe Stage 1 Access flag update disabled. 
Qb1 Stage 1 Access flag update enabled. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


TBII, bit [38] 


TBIO, bit [37] 


Reserved, RESO. 


Top Byte ignored - indicates whether the top byte of an address is used for address match for the 
TTBR1_ELI region, or ignored and used for tagged addresses. Defined values are: 


0bd Top Byte used in the address calculation. 
Qb1 Top Byte ignored in the address calculation. 


This affects addresses generated in ELO and EL1 using AArch64 where the address would be 
translated by tables pointed to by TTBR1_EL1. It has an effect whether the EL1&0 translation 
regime is enabled or not. 


If ARMv8.3-PAuth is implemented and TCR_EL1.TBID1 is 1, then this field only applies to Data 
accesses. 


Otherwise, if the value of TBI] is 1 and bit [55] of the target address to be stored to the PC is 1, then 
bits[63:56] of that target address are also set to 1 before the address is stored in the PC, in the 
following cases: 


e A branch or procedure return within ELO or EL1. 
à An exception taken to EL1. 
3 An exception return to ELO or EL1. 


This field resets to an architecturally UNKNOWN value. 


Top Byte ignored - indicates whether the top byte of an address is used for address match for the 
TTBRO_ELI region, or ignored and used for tagged addresses. Defined values are: 


0bd Top Byte used in the address calculation. 
Qb1 Top Byte ignored in the address calculation. 


This affects addresses generated in ELO and EL1 using AArch64 where the address would be 
translated by tables pointed to by TTBRO_EL1. It has an effect whether the EL1&0 translation 
regime is enabled or not. 


If ARMv8.3-PAuth is implemented and TCR_EL1.TBIDO is 1, then this field only applies to Data 
accesses. 
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Otherwise, if the value of TBIO is 1 and bit [55] of the target address to be stored to the PC is 0, then 
bits[63:56] of that target address are also set to 0 before the address is stored in the PC, in the 
following cases: 


° A branch or procedure return within ELO or EL1. 
è An exception taken to EL1. 

- An exception return to ELO or EL1. 

This field resets to an architecturally UNKNOWN value. 


AS, bit [36] 
ASID Size. Defined values are: 


Qbd 8 bit - the upper 8 bits of TTBRO_EL1 and TTBR1_ ELI are ignored by hardware for 
every purpose except reading back the register, and are treated as if they are all zeros for 
when used for allocation and matching entries in the TLB. 


Qb1 16 bit - the upper 16 bits of TTBRO_EL1 and TTBR1_ ELI are used for allocation and 
matching in the TLB. 


If the implementation has only 8 bits of ASID, this field is RESO. 


This field resets to an architecturally UNKNOWN value. 


Bit [35] 


Reserved, RESO. 


IPS, bits [34:32] 
Intermediate Physical Address Size. 
0b000 32 bits, 4GB. 
0b001 36 bits, 64GB. 
0b010 40 bits, 1TB. 
0b011 42 bits, 4TB. 
0b100 44 bits, 16TB. 
0b101 48 bits, 256TB. 
0b110 52 bits, 4PB. 
Other values are reserved. 


The reserved values behave in the same way as the 0b101 or 0b110 encoding, but software must not 
rely on this property as the behavior of the reserved values might change in a future revision of the 
architecture. 


The value 0b110 is permitted only if ARMv8.2-LPA is implemented and the translation granule size 
is 64KB. 


In an implementation that supports 52-bit PAs, if the value of this field is not 0b110 or a value treated 
as 0b110, then bits[51:48] of every translation table base address for the stage of translation 
controlled by TCR_EL1 are @b0000. 


This field resets to an architecturally UNKNOWN value. 
TG1, bits [31:30] 
Granule size for the TTBR1_EL1. 


0b01 16KB. 
0b10 4KB. 
0b11 64KB. 


Other values are reserved. 
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If the value is programmed to either a reserved value, or a size that has not been implemented, then 
the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED 
choice of the sizes that has been implemented for all purposes other than the value read back from 
this register. 


It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value 
that corresponds to the size chosen. 


This field resets to an architecturally UNKNOWN value. 
SH1, bits [29:28] 
Shareability attribute for memory associated with translation table walks using TTBR1_EL1. 


0b00 Non-shareable. 
0b10 Outer Shareable. 
Qb11 Inner Shareable. 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7644. 


This field resets to an architecturally UNKNOWN value. 
ORGNI, bits [27:26] 


Outer cacheability attribute for memory associated with translation table walks using TTBR1_EL1. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IRGN1, bits [25:24] 


Inner cacheability attribute for memory associated with translation table walks using TTBR1_EL1. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


EPD1, bit [23] 


Translation table walk disable for translations using TTBR1_EL1. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 
TTBR1_EL1. The encoding of this bit is: 


Qbd Perform translation table walks using TTBR1_EL1. 


Qb1 A TLB miss on an address that is translated using TTBR1_EL1 generates a Translation 
fault. No translation table walk is performed. 


This field resets to an architecturally UNKNOWN value. 
A1, bit [22] 
Selects whether TTBRO_EL1 or TTBR1_EL1 defines the ASID. The encoding of this bit is: 
ObO TTBRO0_EL1.ASID defines the ASID. 
0b1 TTBR1_EL1.ASID defines the ASID. 


This field resets to an architecturally UNKNOWN value. 
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TISZ, bits [21:16] 
The size offset of the memory region addressed by TTBR1_EL1. The region size is 2(64-T!SZ) bytes. 


The maximum and minimum possible values for T1SZ depend on the level of translation table and 
the memory translation granule size, as described in the AArch64 Virtual Memory System 
Architecture chapter. 


This field resets to an architecturally UNKNOWN value. 
TGO, bits [15:14] 
Granule size for the TTBRO_EL1. 


Oboe 4KB 
0b01 64KB 
0b10 16KB 


Other values are reserved. 


If the value is programmed to either a reserved value, or a size that has not been implemented, then 
the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED 
choice of the sizes that has been implemented for all purposes other than the value read back from 
this register. 


It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value 
that corresponds to the size chosen. 


This field resets to an architecturally UNKNOWN value. 
SHO, bits [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO_EL1. 


0b00 Non-shareable 
0b10 Outer Shareable 
0b11 Inner Shareable 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7644. 


This field resets to an architecturally UNKNOWN value. 


ORGNO, bits [11:10] 
Outer cacheability attribute for memory associated with translation table walks using TTBRO_EL1. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IRGNO, bits [9:8] 


Inner cacheability attribute for memory associated with translation table walks using TTBRO_EL1. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 
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EPDO, bit [7] 


Bit [6] 


Translation table walk disable for translations using TTBRO_ EL1. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 
TTBRO_EL1. The encoding of this bit is: 


Qbd Perform translation table walks using TTBRO_EL1. 


Qb1 A TLB miss on an address that is translated using TTBRO_EL1 generates a Translation 
fault. No translation table walk is performed. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


TOSZ, bits [5:0] 


The size offset of the memory region addressed by TTBRO_EL1. The region size is 2(64-TSZ) bytes. 


The maximum and minimum possible values for TOSZ depend on the level of translation table and 
the memory translation granule size, as described in the AArch64 Virtual Memory System 
Architecture chapter. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TCR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic TCR_EL1 or 
TCR_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TCR_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b0010 0b0000 0b010 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x120]; 


else 


return TCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return TCR_EL2; 


else 


return TCR_EL1; 
elsif PSTATE.EL == EL3 then 
return TCR_EL1; 
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MSR TCR_EL1, <Xt> 





op0 op1 CRn CRm op2 


Ob11 0b000 0b0010 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x120] = X[t]; 
else 
TCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
TCR_EL2 = X[t]; 
else 





TCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TCR_EL1 = X[t]; 





MRS <Xt>, TCR_EL12 





op0 op1 CRn CRm op2 





0b11 0b101 0b0010 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x120]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return TCR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return TCR_EL1; 
else 
UNDEFINED; 


MSR TCR_EL12, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b0010 0b0000 0b010 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x120] = X[t]; 
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elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 


else 


TCR_EL1 = X[t]; 


UNDEFINED; 


elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 


else 





TCR_EL1 = X[t]; 


UNDEFINED; 
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D13.2.113 TCR_EL2, Translation Control Register (EL2) 


RES1 
mest oel) 
TBID 
HWU62 
HWU61 
HWU60 
HWU59 
HPD 
RES1 


The TCR_EL2 characteristics are: 


Purpose 
The control register for stage 1 of the EL2, or EL2&0, translation regime: 


s When the Effective value of HCR_EL2.E2H is 0, this register controls stage 1 of the EL2 
translation regime, that supports a single VA range, translated using TTBRO_EL2. 


$ When the value of HCR_EL2.E2H is 1, this register controls stage 1 of the EL2&0 translation 
regime, that supports both: 


— A lower VA range, translated using TTBRO_EL2. 
— A higher VA range, translated using TTBR1_EL2. 
Configurations 


AArch6é4 System register TCR_EL2[31:0] is architecturally mapped to AArch32 System register 
HTCR[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TCR_EL2 is a 64-bit register. 


Field descriptions 


The TCR_EL2 bit assignments are: 


When HCR_EL2.E2H == 


32 31 30 29 28 27 26 25 24 23 22 21 20 19 18, 161514131211109 8 7 6 5 





RESO 
IRGNO 
ORGNO 
RESO 
TBI 
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Any of the bits in TCR_EL2, other than the A1 bit and the EPDx bits when they have the value 1, are permitted to 
be cached in a TLB. 


Bits [63:32] 
Reserved, RESO. 
Bit [31] 


Reserved, RES1. 
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TCMA, bit [30] 
When ARMV8.5-MemTag is implemented: 
Controls the generation of Unchecked accesses at EL2 when address [59:56] = 0b0000. 
Qbd This control has no effect on the generation of Unchecked accesses. 
Qb1 All accesses are Unchecked. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TBID, bit [29] 

When ARMv8.3-PAuth is implemented: 
Controls the use of the top byte of instruction addresses for address matching. 
For more information, see Address tagging in AArch64 state on page D5-2506. 
Qbd TCR_EL2.TBI applies to Instruction and Data accesses. 
Qb1 TCR_EL2.TBI applies to Data accesses only. 
This affects addresses where the address would be translated by tables pointed to by TTBRO_EL2. 
This field resets to an architecturally UNKNOWN value. 

Otherwise: 


Reserved, RESO. 


HWU62, bit [28] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 
translation table Block or Page entry. 


ObO Bit[62] ofeach stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[62] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU61, bit [27] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 
translation table Block or Page entry. 


Qbd Bit[61] ofeach stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[61] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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HWU60, bit [26] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 
translation table Block or Page entry. 


ObO Bit[60] ofeach stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


0b1 Bit[60] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWUSS9, bit [25] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 
translation table Block or Page entry. 


Qbd Bit[59] ofeach stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[59] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL2.HPD is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HPD, bit [24] 
When ARMV8.1-HPD is implemented: 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, 
and UXNTable, except NSTable, in the translation tables pointed to by TTBRO_EL2. 


Qbe Hierarchical permissions are enabled. 
Qb1 Hierarchical permissions are disabled. 
Note 





In this case bit[61] (APTable[0]) and bit[59] (PXNTable) of the next level descriptor 
attributes are required to be ignored by the PE, and are no longer reserved, allowing 
them to be used by software. 





When disabled, the permissions are treated as if the bits are zero. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
Bit [23] 
Reserved, RES1. 
HD, bit [22] 
When ARMv8.1-TTHM is implemented: 


Hardware management of dirty state in stage | translations from EL2. 


Qbd Stage 1 hardware management of dirty state disabled. 
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Qb1 Stage 1 hardware management of dirty state enabled, only if the HA bit is also set to 1. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HA, bit [21] 
When ARMV8.1-TTHM is implemented: 
Hardware Access flag update in stage 1 translations from EL2. 
Qbe Stage 1 Access flag update disabled. 
Qb1 Stage 1 Access flag update enabled. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TBI, bit [20] 


Top Byte Ignored. Indicates whether the top byte of an address is used for address match for the 
TTBRO_EL2 region, or ignored and used for tagged addresses. 


For more information, see Address tagging in AArch64 state on page D5-2506. 
0bd Top Byte used in the address calculation. 
Qb1 Top Byte ignored in the address calculation. 


This affects addresses generated in EL2 using AArch64 where the address would be translated by 
tables pointed to by TTBRO_EL2. It has an effect whether the EL2, or EL2&0, translation regime 
is enabled or not. 


If ARMv8.3-PAuth is implemented and TCR_EL2.TBID is 1, then this field only applies to Data 
accesses. 


If the value of TBI is 1, then bits[63:56] of that target address are also set to 0 before the address is 
stored in the PC, in the following cases: 


° A branch or procedure return within EL2. 
s An exception taken to EL2. 
An exception return to EL2. 


This field resets to an architecturally UNKNOWN value. 


Bit [19] 


Reserved, RESO. 


PS, bits [18:16] 
Physical Address Size. 
0b000 32 bits, 4GB. 
0b001 36 bits, 64GB. 
0b010 40 bits, 1TB. 
0b011 42 bits, 4TB. 
0b100 44 bits, 16TB. 
0b101 48 bits, 256TB. 
0b110 52 bits, 4PB. 
Other values are reserved. 


The reserved values behave in the same way as the 0b101 or 0b110 encoding, but software must not 
rely on this property as the behavior of the reserved values might change in a future revision of the 
architecture. 
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The value 0b110 is permitted only if ARMv8.2-LPA is implemented and the translation granule size 
is 64KB. 


In an implementation that supports 52-bit PAs, if the value of this field is not 0b110 or a value treated 
as 0b110, then bits[51:48] of every translation table base address for the stage of translation 
controlled by TCR_EL2 are 0b0000. 


This field resets to an architecturally UNKNOWN value. 
TGO, bits [15:14] 
Granule size for the TTBRO_EL2. 


0b00 4KB. 
0b01 64KB. 
0b10 16KB. 


Other values are reserved. 


If the value is programmed to either a reserved value, or a size that has not been implemented, then 
the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED 
choice of the sizes that has been implemented for all purposes other than the value read back from 
this register. 


It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value 
that corresponds to the size chosen. 


This field resets to an architecturally UNKNOWN value. 
SHO, bits [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO_EL2. 


Oboe Non-shareable. 
Qb10 Outer Shareable. 
Qb11 Inner Shareable. 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7644. 


This field resets to an architecturally UNKNOWN value. 


ORGNQO, bits [11:10] 
Outer cacheability attribute for memory associated with translation table walks using TTBRO_EL2. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IRGNO, bits [9:8] 


Inner cacheability attribute for memory associated with translation table walks using TTBRO_EL2. 


0bd0 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


Bits [7:6] 


Reserved, RESO. 
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9g 


TOSZ, bits [5:0] 
The size offset of the memory region addressed by TTBRO_EL2. The region size is 2(64-T0SZ) bytes. 


The maximum and minimum possible values for TOSZ depend on the level of translation table and 
the memory translation granule size, as described in the AArch64 Virtual Memory System 
Architecture chapter. 


This field resets to an architecturally UNKNOWN value. 


When ARMv8.1-VHE is implemented and HCR_EL2.E2H == 1: 
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This view of the register is only valid from Armv8.1 when HCR_EL2.E2H is 1. 
Any of the bits in TCR_EL2 are permitted to be cached in a TLB. 
Bits [63:59] 
Reserved, RESO. 
TCMAL, bit [58] 
When ARMv8.5-MemTag is implemented: 


Controls the generation of Unchecked accesses at EL2, and at ELO if HCR_EL2.TGE=1, when 
address[59:55] = @b11111. 


Qbd This control has no effect on the generation of Unchecked accesses at EL2 or ELO. 
Qb1 All accesses are Unchecked. 
Note 





Software may change this control bit on a context switch. 





This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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TCMAO, bit [57] 
When ARMV8.5-MemTag is implemented: 


Controls the generation of Unchecked accesses at EL2, and at ELO if HCR_EL2.TGE=1, when 
address[59:55] = @b00000. 


Qbd This control has no effect on the generation of Unchecked accesses at EL2 or ELO. 
Qb1 All accesses are Unchecked. 
Note 





Software may change this control bit on a context switch. 





This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
EOPD1, bit [56] 
When ARMV8.5-EOPD is implemented: 
Faulting control for ELO access to any address translated by TTBR1_EL2. 


Qbd ELO access to any address translated by TTBR1_EL2 will not generate a fault by this 
mechanism. 

Qb1 ELO access to any address translated by TTBR1_EL2 will generate a level 0 translation 
fault 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
EOPDO, bit [55] 
When ARMv%8.5-E0PD is implemented: 
Faulting control for ELO access to any address translated by TTBRO_EL2. 


Qbd ELO access to any address translated by TTBRO_EL2 will not generate a fault by this 
mechanism. 

Qb1 ELO access to any address translated by TTBRO_EL2 will generate a level 0 translation 
fault 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


NFD1, bit [54] 
When SVE is implemented: 
Non-fault translation table walk disable for stage 1 translations using TTBR1_EL2. 


This bit controls whether to perform a stage | translation table walk in response to a non-fault access 
from ELO for a virtual address that is translated using TTBR1_EL2. 


If SVE is implemented, the affected access types include: 


. All accesses due to an SVE non-fault contiguous load instruction. 

s Accesses due to an SVE first-fault gather load instruction that are not for the First active 
element. Accesses due to an SVE first-fault contiguous load instruction are not affected. 

° Accesses due to prefetch instructions might be affected, but the effect is not architecturally 
visible. 


See The Scalable Vector Extension (SVE) on page A2-92 for more information. 
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NFDO, bit [53] 
When SVE is implemented: 


Defined values are: 
Qbd Does not disable stage 1 translation table walks using TTBR1_EL2. 


Qb1 A TLB miss on a virtual address that is translated using TTBR1_EL2 due to the 
specified access types causes the access to fail without taking an exception. No stage 1 
translation table walk is performed. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Non-fault translation table walk disable for stage 1 translations using TTBRO_EL2. 


This bit controls whether to perform a stage | translation table walk in response to a non-fault access 
from ELO for a virtual address that is translated using TTBRO_EL2. 


If SVE is implemented, the affected access types include: 


° All accesses due to an SVE non-fault contiguous load instruction. 

a Accesses due to an SVE first-fault gather load instruction that are not for the First active 
element. Accesses due to an SVE first-fault contiguous load instruction are not affected. 

° Accesses due to prefetch instructions might be affected, but the effect is not architecturally 
visible. 


See The Scalable Vector Extension (SVE) on page A2-92 for more information. 
Defined values are: 
Qbd Does not disable stage 1 translation table walks using TTBRO_EL2. 


Qb1 A TLB miss on a virtual address that is translated using TTBRO_EL2 due to the 
specified access types causes the access to fail without taking an exception. No stage 1 
translation table walk is performed. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


TBID1, bit [52] 
When ARMV8.3-PAuth is implemented: 


Controls the use of the top byte of instruction addresses for address matching. 

For more information, see Address tagging in AArch64 state on page D5-2506. 

Qbd TCR_EL2.TBI1 applies to Instruction and Data accesses. 

Qb1 TCR_EL2.TBI1 applies to Data accesses only. 

This affects addresses where the address would be translated by tables pointed to by TTBR1_EL2. 
This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


TBIDO, bit [51] 
When ARMv8.3-PAuth is implemented: 


Controls the use of the top byte of instruction addresses for address matching. 

For more information, see Address tagging in AArch64 state on page D5-2506. 

Qbd TCR_EL2.TBIO applies to Instruction and Data accesses. 

Qb1 TCR_EL2.TBIO applies to Data accesses only. 

This affects addresses where the address would be translated by tables pointed to by TTBRO_EL2. 
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This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU162, bit [50] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 
translation table Block or Page entry for translations using TTBR1_EL2. 


Qbd For translations using TTBR1_EL2, bit[62] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBR1_EL2, bit[62] of each stage 1 translation table Block or 
Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL2.HPD1 is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD1 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU161, bit [49] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 
translation table Block or Page entry for translations using TTBR1_EL2. 


Qbd For translations using TTBR1_EL2, bit[61] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBR1_EL2, bit[61] of each stage 1 translation table Block or 
Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL2.HPD1 is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD1 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU160, bit [48] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 
translation table Block or Page entry for translations using TTBR1_EL2. 


Qbd For translations using TTBR1_EL2, bit[60] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBR1_EL2, bit[60] of each stage 1 translation table Block or 
Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL2.HPD1 is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD1 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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HWU159, bit [47] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 
translation table Block or Page entry for translations using TTBR1_EL2. 


Qbd For translations using TTBR1_EL2, bit[59] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBR1_EL2, bit[59] of each stage 1 translation table Block or 


Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL2.HPD1 is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD1 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU062, bit [46] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 
translation table Block or Page entry for translations using TTBRO_EL1. 


Qbd For translations using TTBRO_EL1, bit[62] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBRO_EL1, bit[62] of each stage 1 translation table Block or 


Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL2.HPD0 is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD0 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU061, bit [45] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 
translation table Block or Page entry for translations using TTBRO_EL1. 


Qbd For translations using TTBRO_EL1, bit[61] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBRO_EL1, bit[61] of each stage 1 translation table Block or 


Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL2.HPD0 is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD0 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU060, bit [44] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 
translation table Block or Page entry for translations using TTBRO_EL1. 


Qbd For translations using TTBRO_EL1, bit[60] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
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Qb1 For translations using TTBRO_EL1, bit[60] of each stage 1 translation table Block or 
Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL2.HPD0 is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD0 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU0S9, bit [43] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 
translation table Block or Page entry for translations using TTBRO_EL1. 


Qbd For translations using TTBRO_EL1, bit[59] of each stage 1 translation table Block or 
Page entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBRO_EL1, bit[59] of each stage 1 translation table Block or 


Page entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the 
value of TCR_EL2.HPD0 is 1. 


The Effective value of this field is 0 if the value of TCR_EL2.HPD0 is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HPD1, bit [42] 
When ARMV8.1-HPD is implemented: 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, 
and UXNTable, except NSTable, in the translation tables pointed to by TTBR1_EL2. 


Qbe Hierarchical permissions are enabled. 

Qb1 Hierarchical permissions are disabled. 

When disabled, the permissions are treated as if the bits are zero. 

This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HPDO, bit [41] 
When ARMV8.1-HPD is implemented: 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, 
and UXNTable, except NSTable, in the translation tables pointed to by TTBRO_EL2. 


Qbd Hierarchical permissions are enabled. 

Qb1 Hierarchical permissions are disabled. 

When disabled, the permissions are treated as if the bits are zero. 

This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
HD, bit [40] 
When ARMV8.1-TTHM is implemented: 


Hardware management of dirty state in stage | translations from EL2. 


Qbd Stage 1 hardware management of dirty state disabled. 
Qb1 Stage 1 hardware management of dirty state enabled, only if the HA bit is also set to 1. 
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This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HA, bit [39] 
When ARMV8.1-TTHM is implemented: 
Hardware Access flag update in stage 1 translations from EL2. 
ObO Stage 1 Access flag update disabled. 
Qb1 Stage 1 Access flag update enabled. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


TBII, bit [38] 


Top Byte Ignored. Indicates whether the top byte of an address is used for address match for the 
TTBR1_EL2 region, or ignored and used for tagged addresses. 


For more information, see Address tagging in AArch64 state on page D5-2506. 
0bd Top Byte used in the address calculation. 
Qb1 Top Byte ignored in the address calculation. 


This affects addresses generated in ELO and EL2 using AArch64 where the address would be 
translated by tables pointed to by TTBR1_EL2. It has an effect whether the EL2, or EL2&0, 
translation regime is enabled or not. 


If ARMv8.3-PAuth is implemented and TCR_EL2.TBID1 is 1, then this field only applies to Data 
accesses. 


If the value of TBI] is 1 and bit [55] of the target address to be stored to the PC is 1, then bits[63:56] 
of that target address are also set to 1 before the address is stored in the PC, in the following cases: 


° A branch or procedure return within ELO or EL1. 
à An exception taken to EL1. 

- An exception return to ELO or EL1. 

This field resets to an architecturally UNKNOWN value. 


TBIO, bit [37] 


Top Byte Ignored. Indicates whether the top byte of an address is used for address match for the 
TTBRO_EL2 region, or ignored and used for tagged addresses. 


For more information, see Address tagging in AArch64 state on page D5-2506. 
0bd Top Byte used in the address calculation. 
Qb1 Top Byte ignored in the address calculation. 


This affects addresses generated in ELO and EL2 using AArch64 where the address would be 
translated by tables pointed to by TTBRO_EL2. It has an effect whether the EL2, or EL2&0, 
translation regime is enabled or not. 


If ARMv8.3-PAuth is implemented and TCR_EL2.TBIDO is 1, then this field only applies to Data 
accesses. 


If the value of TBIO is 1 and bit [55] of the target address to be stored to the PC is 0, then bits[63:56] 
of that target address are also set to 0 before the address is stored in the PC, in the following cases: 


° A branch or procedure return within ELO or EL1. 
à An exception taken to EL1. 

3 An exception return to ELO or EL1. 

This field resets to an architecturally UNKNOWN value. 
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AS, bit [36] 
ASID Size. Defined values are: 


Qbd 8 bit - the upper 8 bits of TTBRO_EL2 and TTBR1_EL2 are ignored by hardware for 
every purpose except reading back the register, and are treated as if they are all zeros for 
when used for allocation and matching entries in the TLB. 


Qb1 16 bit - the upper 16 bits of TTBRO_EL2 and TTBR1_EL2 are used for allocation and 
matching in the TLB. 


If the implementation has only 8 bits of ASID, this field is RESO. 


This field resets to an architecturally UNKNOWN value. 


Bit [35] 


Reserved, RESO. 


IPS, bits [34:32] 
Intermediate Physical Address Size. 
0b000 32 bits, 4GB. 
0b001 36 bits, 64GB. 
0b010 40 bits, 1TB. 
0b011 42 bits, 4TB. 
0b100 44 bits, 16TB. 
0b101 48 bits, 256TB. 
0b110 When ARMv8.2-LPA is implemented 52 bits, 4PB. 
Other values are reserved. 


The reserved values behave in the same way as the 0b101 or 0b110 encoding, but software must not 
rely on this property as the behavior of the reserved values might change in a future revision of the 
architecture. 


The value 0b110 is permitted only if ARMv8.2-LPA is implemented and the translation granule size 
is 64KB. 


In an implementation that supports 52-bit PAs, if the value of this field is not 0b110 or a value treated 
as 0b110, then bits[51:48] of every translation table base address for the stage of translation 
controlled by TCR_EL2 are 0b0000. 


This field resets to an architecturally UNKNOWN value. 
TG1, bits [31:30] 
Granule size for the TTBR1_EL2. 


Qb01 16KB. 
0b10 4KB. 
Qb11 64KB. 


Other values are reserved. 


If the value is programmed to either a reserved value, or a size that has not been implemented, then 
the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED 
choice of the sizes that has been implemented for all purposes other than the value read back from 
this register. 


It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value 
that corresponds to the size chosen. 


This field resets to an architecturally UNKNOWN value. 
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SH1, bits [29:28] 


Shareability attribute for memory associated with translation table walks using TTBR1_EL2. 
Defined values are: 


Oboe Non-shareable. 
0b10 Outer Shareable. 
Qb11 Inner Shareable. 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7644. 


This field resets to an architecturally UNKNOWN value. 


ORGNI, bits [27:26] 


Outer cacheability attribute for memory associated with translation table walks using TTBR1_EL2. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IRGN1, bits [25:24] 


EPD1, bit [23] 


A1, bit [22] 


Inner cacheability attribute for memory associated with translation table walks using TTBR1_EL2. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


Translation table walk disable for translations using TTBR1_EL2. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 
TTBR1_EL2. The encoding ofthis bit is: 


Qbd Perform translation table walks using TTBR1_EL2. 


Qb1 A TLB miss on an address that is translated using TTBR1_EL2 generates a Translation 
fault. No translation table walk is performed. 


This field resets to an architecturally UNKNOWN value. 


Selects whether TTBRO_EL2 or TTBR1_EL2 defines the ASID. The encoding of this bit is: 
ObO TTBRO_EL2.ASID defines the ASID. 
Qb1 TTBRI1_EL2.ASID defines the ASID. 


This field resets to an architecturally UNKNOWN value. 


TISZ, bits [21:16] 


The size offset of the memory region addressed by TTBR1_EL2. The region size is 2(64-T!SZ) bytes. 


The maximum and minimum possible values for T1SZ depend on the level of translation table and 
the memory translation granule size, as described in the AArch64 Virtual Memory System 
Architecture chapter. 


This field resets to an architecturally UNKNOWN value. 


D13-3340 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


TGO, bits [15:14] 
Granule size for the TTBRO_EL2. 


0b00 4KB. 
0b01 64KB. 
0b10 16KB. 


Other values are reserved. 


If the value is programmed to either a reserved value, or a size that has not been implemented, then 
the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED 
choice of the sizes that has been implemented for all purposes other than the value read back from 
this register. 


It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value 
that corresponds to the size chosen. 


This field resets to an architecturally UNKNOWN value. 
SHO, bits [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO_EL2. 


Qbe0 Non-shareable. 
0b10 Outer Shareable. 
Qb11 Inner Shareable. 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7644. 


This field resets to an architecturally UNKNOWN value. 


ORGNO, bits [11:10] 
Outer cacheability attribute for memory associated with translation table walks using TTBRO_EL2. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IRGNO, bits [9:8] 


Inner cacheability attribute for memory associated with translation table walks using TTBRO_EL2. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


EPDO, bit [7] 


Translation table walk disable for translations using TTBRO_ EL2. This bit controls whether a 
translation table walk is performed on a TLB miss, for an address that is translated using 
TTBRO_EL2. The encoding of this bit is: 


Qbd Perform translation table walks using TTBRO_EL2. 


Qb1 A TLB miss on an address that is translated using TTBRO_EL2 generates a Translation 
fault. No translation table walk is performed. 


This field resets to an architecturally UNKNOWN value. 
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Bit [6] 


Reserved, RESO. 


TOSZ, bits [5:0] 


The size offset of the memory region addressed by TTBRO_EL2. The region size is 2(64-TSZ) bytes. 


The maximum and minimum possible values for TOSZ depend on the level of translation table and 
the memory translation granule size, as described in the AArch64 Virtual Memory System 


Architecture chapter. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TCR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic TCR_EL2 or 
TCR_ELI are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TCR_EL2 

















op0 op1 CRn CRm op2 
Ob11 0b100 0b0010 0b0000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return TCR_EL2; 
elsif PSTATE.EL == EL3 then 
return TCR_EL2; 
MSR TCR_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0010 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TCR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
TCR_EL2 = X[t]; 
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MRS <Xt>, TCR_EL1 





op0 op1 CRn CRm 


0b11 0b000 0b0010 0b0000 


op2 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x120]; 
else 
return TCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return TCR_EL2; 
else 
return TCR_EL1; 
elsif PSTATE.EL == EL3 then 
return TCR_EL1; 


MSR TCR_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b0010 0b0000 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x120] = X[t]; 
else 
TCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
TCR_EL2 = X[t]; 
else 








TCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TCR_EL1 = X[t]; 
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D13.2.114 TCR_EL3, Translation Control Register (EL3) 


The TCR_EL3 characteristics are: 


Purpose 

The control register for stage 1 of the EL3 translation regime. 
Configurations 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TCR_EL3 is a 64-bit register. 


Field descriptions 


The TCR_EL3 bit assignments are: 


32 31 30 29 28 27 26 25 24 23 22 21 20 19 18, 161514131211109 8 7 6 5 0 





RES1 RESO 
mest —— | IRGNO 
TBID ORGNO 
HWU62 RESO 
HWU61 TBI 
HWU60 

HWU59 

HPD 

RES1 





Any of the bits in TCR_EL3 are permitted to be cached in a TLB. 
Bits [63:32] 
Reserved, RESO. 
Bit [31] 
Reserved, RES1. 
TCMA, bit [30] 
When ARMv8.5-MemTag is implemented: 
Controls the generation of Unchecked accesses at EL3 when address [59:56] = 0b0000. 
Obd This control has no effect on the generation of Unchecked accesses. 
Qb1 All accesses are Unchecked. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
TBID, bit [29] 
When ARMv8.3-PAuth is implemented: 
Controls the use of the top byte of instruction addresses for address matching. 


Qbd TCR_EL3.TBI applies to Instruction and Data accesses. 
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Qb1 TCR_EL3.TBI applies to Data accesses only. 
This affects addresses where the address would be translated by tables pointed to by TTBRO_EL3. 
This field resets to an architecturally UNKNOWN value. 

Otherwise: 


Reserved, RESO. 


HWU6®2, bit [28] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 
translation table Block or Page entry. 


Qbd Bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[62] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1. 


The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU6l1, bit [27] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 
translation table Block or Page entry. 


ObO Bit[61] ofeach stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


0b1 Bit[61] ofeach stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1. 


The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU60, bit [26] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 
translation table Block or Page entry. 


Qbd Bit[60] of each stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[60] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1. 


The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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HWUSS9, bit [25] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 


translation table Block or Page entry. 


ObO Bit[59] ofeach stage 1 translation table Block or Page entry cannot be used by hardware 


for an IMPLEMENTATION DEFINED purpose. 


0b1 Bit[59] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of TCR_EL3.HPD is 1. 


The Effective value of this field is 0 if the value of TCR_EL3.HPD is 0. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HPD, bit [24] 
When ARMv%8.1-HPD is implemented: 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, PXNTable, 
and UXNTable, except NSTable, in the translation tables pointed to by TTBRO_EL3. 


ObO Hierarchical permissions are enabled. 
Qb1 Hierarchical permissions are disabled. 
Note 





In this case bit[61] (APTable[0]) and bit[59] (PXNTable) of the next level descriptor 
attributes are required to be ignored by the PE, and are no longer reserved, allowing 


them to be used by software. 





When disabled, the permissions are treated as if the bits are zero. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
Bit [23] 
Reserved, RES1. 
HD, bit [22] 
When ARMV8.1-TTHM is implemented: 


Hardware management of dirty state in stage | translations from EL3. 


Qbd Stage 1 hardware management of dirty state disabled. 


Qb1 Stage 1 hardware management of dirty state enabled, only if the HA bit is also set to 1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HA, bit [21] 
When ARMv8.1-TTHM is implemented: 
Hardware Access flag update in stage 1 translations from EL3. 
Qbe Stage 1 Access flag update disabled. 
Qb1 Stage 1 Access flag update enabled. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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TBI, bit [20] 


Top Byte Ignored. Indicates whether the top byte of an address is used for address match for the 
TTBRO_EL3 region, or ignored and used for tagged addresses. 


0bd Top Byte used in the address calculation. 
Qb1 Top Byte ignored in the address calculation. 


This affects addresses generated in EL3 using AArch64 where the address would be translated by 
tables pointed to by TTBRO_EL3. It has an effect whether the EL3 translation regime is enabled or 
not. 


If ARMv8.3-PAuth is implemented and TCR_EL3.TBID is 1, then this field only applies to Data 
accesses. 


Otherwise, if the value of TBI is 1, then bits[63:56] of that target address are also set to 0 before the 
address is stored in the PC, in the following cases: 


e A branch or procedure return within EL3. 

° A exception taken to EL3. 

- An exception return to EL3. 

For more information, see Address tagging in AArch64 state on page D5-2506. 





Note 


This control determines the scope of address tagging. It never causes an exception to be generated. 





This field resets to an architecturally UNKNOWN value. 


Bit [19] 


Reserved, RESO. 


PS, bits [18:16] 
Physical Address Size. 
0b000 32 bits, 4GB. 
Qb001 36 bits, 64GB. 
0b010 40 bits, 1TB. 
0b011 42 bits, 4TB. 
0b100 44 bits, 16TB. 
0b101 48 bits, 256TB. 
0b110 52 bits, 4PB. 
Other values are reserved. 


The reserved values behave in the same way as the 0b101 or 0b110 encoding, but software must not 
rely on this property as the behavior of the reserved values might change in a future revision of the 
architecture. 


The value 0b110 is permitted only if ARMv8.2-LPA is implemented and the translation granule size 
is 64KB. 


In an implementation that supports 52-bit PAs, if the value of this field is not 0b110 or a value treated 
as 0b110, then bits[51:48] of every translation table base address for the stage of translation 
controlled by TCR_EL3 are 0b0000. 


This field resets to an architecturally UNKNOWN value. 


TGO, bits [15:14] 
Granule size for the TTBRO_EL3. 


0b00 4KB. 
0b01 64KB. 
0b10 16KB. 
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Other values are reserved. 


If the value is programmed to either a reserved value, or a size that has not been implemented, then 
the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED 
choice of the sizes that has been implemented for all purposes other than the value read back from 
this register. 


It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value 
that corresponds to the size chosen. 


This field resets to an architecturally UNKNOWN value. 
SHO, bits [13:12] 
Shareability attribute for memory associated with translation table walks using TTBRO_EL3. 


Oboe Non-shareable. 
0b10 Outer Shareable. 
Qb11 Inner Shareable. 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7644. 


This field resets to an architecturally UNKNOWN value. 


ORGNQO, bits [11:10] 
Outer cacheability attribute for memory associated with translation table walks using TTBRO_EL3. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IRGNO, bits [9:8] 


Inner cacheability attribute for memory associated with translation table walks using TTBRO_EL3. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 
Bits [7:6] 
Reserved, RESO. 
TOSZ, bits [5:0] 
The size offset of the memory region addressed by TTBRO_EL3. The region size is 2(64-T0SZ) bytes. 


The maximum and minimum possible values for TOSZ depend on the level of translation table and 
the memory translation granule size, as described in the AArch64 Virtual Memory System 
Architecture chapter. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TCR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, TCR_EL3 

















op0 op1 CRn CRm op2 
0b11 0b110 0b0010 0b0000 0b010 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return TCR_EL3; 
MSR TCR_EL3, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b110 0b0010 0b0000 0b010 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TCR_EL3 = X[t]; 
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D13.2.115 TFSREO_EL1, Tag Fail Status Register (ELO). 


The TFSREO EL] characteristics are: 


Purpose 
Holds accumulated Tag Check Fails occurring in ELO which are not taken precisely. 
Configurations 
This register is present only when ARMVv8.5-MemTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to TFSREO_EL1 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TFSREO_ EL! is a 64-bit register. 


Field descriptions 


The TFSREO_EL1 bit assignments are: 


63 2 10 


RESO 


Bits [63:2] 
Reserved, RESO. 
TF1, bit [1] 


Tag Check Fail. Asynchronously set to 1 when a Tag Check fail using a virtual address with 
bit<55>==0b1 occurs. 


This field resets to an architecturally UNKNOWN value. 


TFO, bit [0] 


Tag Check Fail. Asynchronously set to 1 when a Tag Check fail using a virtual address with 
bit<55>==0b0 occurs. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TFSREO_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TFSREO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0101 0b0110 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
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AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return TFSREQ_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return TFSREQ_EL1; 
elsif PSTATE.EL == EL3 then 
return TFSREQ_EL1; 


MSR TFSREO_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b0101 0b0110 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
TFSREQ@_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
TFSREQ_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TFSREQ_EL1 = X[t]; 
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D13.2.116 TFSR_EL1, Tag Fail Status Register (EL1). 


The TFSR_EL1 characteristics are: 


Purpose 
Holds accumulated Tag Check Fails occurring in EL1 which are not taken precisely. 
Configurations 
This register is present only when ARMVv8.5-MemtTag is implemented and 
ID_AA64PFRI_EL1 EL1.MTE != 0b0001. Otherwise, direct accesses to TFSR_EL1 are 
UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TFSR_EL1 is a 64-bit register. 


Field descriptions 


The TFSR_EL1 bit assignments are: 











63 210 
RESO 
== TFO 
TF1 
Bits [63:2] 
Reserved, RESO. 
TF1, bit [1] 
Tag Check Fail. Asynchronously set to 1 when a Tag Check fail using a virtual address with 
bit<55>==0b1 occurs. 
This field resets to an architecturally UNKNOWN value. 
TFO, bit [0] 
Tag Check Fail. Asynchronously set to 1 when a Tag Check fail using a virtual address with 
bit<55>==0b0 occurs. 
This field resets to an architecturally UNKNOWN value. 
Accessing the TFSR_EL1 
Accesses to this register use the following encodings in the System instruction encoding space: 
MRS <Xt>, TFSR_EL1 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0110 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
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elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x190] ; 
else 
return TFSR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
return TFSR_EL2; 
else 
return TFSR_EL1; 
elsif PSTATE.EL == EL3 then 
return TFSR_EL1; 


MSR TFSR_EL1, <Xt> 





op0 op1 CRn CRm op2 





Ob11 0b000 0b0101 0b0110 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x190] = X[t]; 
else 
TFSR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
TFSR_EL2 = X[t]; 
else 
TFSR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TFSR_EL1 = X[t]; 


MRS <Xt>, TFSR_EL12 





op0 op1 CRn CRm op2 





Ob11 0b101 0b0101 0b0110 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x190]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
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elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return TFSR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return TFSR_EL1; 
else 
UNDEFINED; 


MSR TFSR_EL12, <Xt> 














op0 op1 CRn CRm op2 
0b11 0b101 0b0101 0b0110 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x190] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
TFSR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
TFSR_EL1 = X[t]; 
else 
UNDEFINED; 
MRS <Xt>, TFSR_EL2 
op0 op1 CRn CRm op2 
0b11 0b100 0b0101 0b0110 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return TFSR_EL1; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return TFSR_EL2; 
elsif PSTATE.EL == EL3 then 
return TFSR_EL2; 


MSR TFSR_EL2, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b100 0b0101 0b0110 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
TFSR_EL1 = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
TFSR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
TFSR_EL2 = X[t]; 
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D13.2.117  TFSR_EL2, Tag Fail Status Register (EL2). 


The TFSR_EL2 characteristics are: 


Purpose 
Holds accumulated Tag Check Fails occurring in EL2 which are not taken precisely. 
Configurations 
This register is present only when ARMVv8.5-MemTag is implemented and 
ID_AA64PFRI_EL1.MTE != 0b0001. Otherwise, direct accesses to TFSR_EL2 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TFSR_EL2 is a 64-bit register. 


Field descriptions 


The TFSR_EL2 bit assignments are: 


63 210 


RESO 


Bits [63:2] 
Reserved, RESO. 
TF1, bit [1] 


Tag Check Fail. Asynchronously set to 1 when a Tag Check fail using a virtual address with 
bit<55>==0b1 occurs. 


When HCR_EL2.E2H==0b8, this field is RESO. 
This field resets to an architecturally UNKNOWN value. 
TFO, bit [0] 


Tag Check Fail. Asynchronously set to 1 when a Tag Check fail using a virtual address with 
bit<55>==0b0 occurs. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TFSR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic TFSR_EL2 or 
TFSR_EL1 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, TFSR_EL2 





op0 op1 CRn CRm 


Ob11 0b100 0b0101 0b0110 


op2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return TFSR_EL1; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return TFSR_EL2; 
elsif PSTATE.EL == EL3 then 
return TFSR_EL2; 


MSR TFSR_EL2, <Xt> 





op0 op1 CRn CRm 


op2 





Ob11 0b100 0b0101 0b0110 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == '@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
TFSR_EL1 = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
TFSR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
TFSR_EL2 = X[t]; 
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MRS <Xt>, TFSR_EL1 





op0 op1 CRn 


Ob11 0b000 0b0101 


CRm 


0b0110 


op2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == 
return NVMem[0x190] ; 
else 
return TFSR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
return TFSR_EL2; 
else 
return TFSR_EL1; 
elsif PSTATE.EL == EL3 then 
return TFSR_EL1; 


MSR TFSR_EL1, <Xt> 


'111' then 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b0101 


0b0110 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.ATA == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == 
NVMem[@x190] = X[t]; 
else 
TFSR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.ATA == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
TFSR_EL2 = X[t]; 
else 
TFSR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TFSR_EL1 = X[t]; 


'111' then 
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D13.2.118 TFSR_EL3, Tag Fail Status Register (EL3). 


63 


ARM DDI 0487E.a 
ID070919 


The TFSR_EL3 characteristics are: 


Purpose 
Holds accumulated Tag Check Fails occurring in EL3 which are not taken precisely. 
Configurations 
This register is present only when ARMVv8.5-MemTag is implemented and 
IID_AA64PFR1_EL1.MTE != 0b0001. Otherwise, direct accesses to TFSR_EL3 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TFSR_EL3 is a 64-bit register. 


Field descriptions 


The TFSR_EL3 bit assignments are: 


RESO 


| TFO 


Bits [63:1] 


Reserved, RESO. 


TFO, bit [0] 


Tag Check Fail. Asynchronously set to 1 when a Tag Check fail using a virtual address with 
bit<55>==0b0 occurs. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TFSR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TFSR_EL3 











op0 op1 CRn CRm op2 
0b11 0b110 0b0101 0b0110 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return TFSR_EL3; 
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MSR TFSR_EL3, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b110 0b0101 0b0110 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TFSR_EL3 = X[t]; 
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D13.2.119 TPIDR_ELO, ELO Read/Write Software Thread ID Register 


ARM DDI 0487E.a 


The TPIDR_ELO characteristics are: 


Purpose 


Provides a location where software executing at ELO can store thread identifying information, for 
OS management purposes. 


The PE makes no use of this register. 


Configurations 


AArch64 System register TPIDR_ELO[31:0] is architecturally mapped to AArch32 System register 
TPIDRURW{[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TPIDR_ELO is a 64-bit register. 


Field descriptions 


The TPIDR_ELO bit assignments are: 


Thread ID 


Bits [63:0] 
Thread ID. Thread identifying information stored by software running at this Exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TPIDR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TPIDR_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1101 0b0000 0b010 





if PSTATE.EL == EL@ then 
return TPIDR_ELQ; 

elsif PSTATE.EL == EL1 then 
return TPIDR_ELQ; 

elsif PSTATE.EL == EL2 then 
return TPIDR_ELQ; 

elsif PSTATE.EL == EL3 then 
return TPIDR_ELQ; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3361 
Non-Confidential 


AArch64 System Register Descriptions 
D13.2 General system control registers 


MSR TPIDR_ELO, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0000 0b010 
if PSTATE.EL == EL@ then 
TPIDR_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
TPIDR_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
TPIDR_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
TPIDR_ELO = X(t]; 
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D13.2.120 TPIDR_EL1, EL1 Software Thread ID Register 


ARM DDI 0487E.a 


The TPIDR_EL1 characteristics are: 


Purpose 


Provides a location where software executing at EL1 can store thread identifying information, for 
OS management purposes. 


The PE makes no use of this register. 


Configurations 


AArch64 System register TPIDR_EL1[31:0] is architecturally mapped to AArch32 System register 
TPIDRPRW/[3 1:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TPIDR_EL1 is a 64-bit register. 


Field descriptions 


The TPIDR_EL1 bit assignments are: 


Thread ID 


Bits [63:0] 
Thread ID. Thread identifying information stored by software running at this Exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TPIDR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TPIDR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1101 0b0000 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
return TPIDR_EL1; 

elsif PSTATE.EL == EL2 then 
return TPIDR_EL1; 

elsif PSTATE.EL == EL3 then 
return TPIDR_EL1; 
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MSR TPIDR_EL1, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b000 0b1101 0b0000 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
TPIDR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
TPIDR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TPIDR_EL1 = X[t]; 
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TPIDR_EL2, EL2 Software Thread ID Register 


ARM DDI 0487E.a 


The TPIDR_EL2 characteristics are: 


Purpose 


Provides a location where software executing at EL2 can store thread identifying information, for 
OS management purposes. 


The PE makes no use of this register. 


Configurations 


AArch64 System register TPIDR_EL2[31:0] is architecturally mapped to AArch32 System register 
HTPIDR{31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TPIDR_EL2 is a 64-bit register. 


Field descriptions 


The TPIDR_EL2 bit assignments are: 


Thread ID 


Bits [63:0] 
Thread ID. Thread identifying information stored by software running at this Exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TPIDR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TPIDR_EL2 





op0 op1 CRn CRm op2 


0b11 0b100 0b1101 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x090] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return TPIDR_EL2; 
elsif PSTATE.EL == EL3 then 
return TPIDR_EL2; 
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MSR TPIDR_EL2, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b100 0b1101 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x090] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TPIDR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
TPIDR_EL2 = X[t]; 
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D13.2.122 TPIDR_EL3, EL3 Software Thread ID Register 


ARM DDI 0487E.a 


The TPIDR_EL3 characteristics are: 


Purpose 
Provides a location where software executing at EL3 can store thread identifying information, for 
OS management purposes. 
The PE makes no use of this register. 
Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TPIDR_EL3 is a 64-bit register. 


Field descriptions 


The TPIDR_EL3 bit assignments are: 


Thread ID 


Bits [63:0] 
Thread ID. Thread identifying information stored by software running at this Exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TPIDR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TPIDR_EL3 











op0 op1 CRn CRm op2 
0b11 0b110 0b1101 0b0000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return TPIDR_EL3; 
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MSR TPIDR_EL3, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b110 0b1101 0b0000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TPIDR_EL3 = X(t]; 
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D13.2.123 TPIDRRO_ELO, ELO Read-Only Software Thread ID Register 


ARM DDI 0487E.a 


The TPIDRRO_ELO characteristics are: 


Purpose 


Provides a location where software executing at EL1 or higher can store thread identifying 
information that is visible to software executing at ELO, for OS management purposes. 


The PE makes no use of this register. 


Configurations 


AArch64 System register TPIDRRO_EL0[31:0] is architecturally mapped to AArch32 System 
register TPIDRURO[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TPIDRRO_ELO is a 64-bit register. 


Field descriptions 


The TPIDRRO_ELO bit assignments are: 


Thread ID 


Bits [63:0] 


Thread ID. Thread identifying information stored by software running at this Exception level. 


Accessing the TPIDRRO_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TPIDRRO_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1101 0b0000 0b011 





if PSTATE.EL == EL@ then 
return TPIDRRO_ELQ; 
elsif PSTATE.EL == EL1 then 
return TPIDRRO_ELQ; 
elsif PSTATE.EL == EL2 then 
return TPIDRRO_ELQ; 
elsif PSTATE.EL == EL3 then 
return TPIDRRO_ELQ; 
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D13-3370 


MSR TPIDRRO_ELO, <Xt> 


if PSTATE.EL == 
UNDEFINED; 
elsif PSTATE.EL 
TPIDRRO_ELO 
elsif PSTATE.EL 
TPIDRRO_ELO 
elsif PSTATE.EL 
TPIDRRO_ELO 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 





op0 op1 


0b11 0b011 


CRn 


0b1101 


CRm 


0b0000 


op2 


0b011 





ELO then 


== EL1 then 
= X[t]; 
== EL2 then 
= X[t]; 
== EL3 then 
= X[t]; 
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D13.2.124 TTBRO_EL1, Translation Table Base Register 0 (EL1) 
The TTBRO_ ELI characteristics are: 


Purpose 


Holds the base address of the translation table for the initial lookup for stage 1 of the translation of 
an address from the lower VA range in the EL1&0 translation regime, and other information for this 
translation regime. 


Configurations 


AArch64 System register TTBRO_EL1[63:0] is architecturally mapped to AArch32 System register 
TTBRO[63:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TTBRO_EL1 is a 64-bit register. 


Field descriptions 


The TTBRO_ EL! bit assignments are: 


63 48 47 1 0 


ASID BADDR 


== CnP 


ASID, bits [63:48] 


An ASID for the translation table base address. The TCR_EL1.A1 field selects either 
TTBRO_EL1.ASID or TTBR1_EL1.ASID. 


If the implementation has only 8 bits of ASID, then the upper 8 bits of this field are RESO. 


This field resets to an architecturally UNKNOWN value. 
BADDR, bits [47:1] 

Translation table base address, A[47:x] or A[51:x], bits[47:1]. 
Note 


° Translation table base addresses of 52 bits, A[51:x], are supported only in an implementation 
that includes ARMv8.2-LPA and is using the 64KB translation granule. 





g A translation table must be aligned to the size of the table, except that when using a 
translation table base address larger than 48 bits the minimum alignment of a table containing 
fewer than eight entries is 64 bytes. 





In an implementation that includes ARMv8.2-LPA, if the value of TCR_EL1.IPS is 0b110, then: 


° Register bits[47:z] hold bits[47:z] of the stage 1 translation table base address, where z is 
determined as follows: 


— Ifx>=6 then z=x. 
— Otherwise, z=6. 
a Register bits[5:2] hold bits[51:48] of the stage 1 translation table base address. 


s When z>x register bits[(z-1):x] are RESO, and bits[(z-1):x] of the translation table base 
address are zero. 


- When x>6 register bits[(x-1):6] are RESO. 
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è Register bit[1] is RESO. 
° Bits[5:2] of the stage 1 translation table base address are zero. 


. In an implementation that includes ARMv8.2-TTCNP bit[0] of the stage 1 translation table 
base address is zero. 


— Note 
è In an implementation that includes ARMv8.2-LPA a TCR_EL1.IPS value of 0b110, that 
selects an IPA size of 52 bits, is permitted only when using the 64KB translation granule. 


à When the value of ID AA64MMFRO_EL1.PARange indicates that the implementation does 
not support a 52 bit PA size, if a translation table lookup uses this register with the 64KB 
translation granule when the value of TCR_EL1.IPS is @b110 and the value of register 
bits[5:2] is nonzero, an Address size fault is generated. 





If the Effective value of TCR_EL1.IPS is not 0b110 then: 
s Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address. 
s Register bits[(x-1):1] are RESO. 


a If the implementation supports 52-bit PAs and IPAs, then bits[51:48] of the translation table 
base addresses used in this stage of translation are 0b0000. 





Note 
This definition applies: 
è To an implementation that includes ARMv8.2-LPA and is using a translation granule smaller 
than 64KB. 


° To any implementation that does not include ARMv8.2-LPA. 





If any TTBRO_EL1[47:0] bit that is defined as RESO has the value 1 when a translation table walk 
is performed using TTBRO_EL1, then the translation table base address might be misaligned, with 
effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following: 


$ Bits[x-1:0] ofthe translation table base address are treated as ifall the bits are zero. The value 
read back from the corresponding register bits is either the value written to the register or 
zero. 

° The result of the calculation of an address for a translation table walk using this register can 


be corrupted in those bits that are nonzero. 


The AArch64 Virtual Memory System Architecture chapter describes how x is calculated based on 
the value of TCR_EL1.TOSZ, the stage of translation, and the translation granule size. 


This field resets to an architecturally UNKNOWN value. 


CnP, bit [0] 
When ARMV8.2-TTCNP is implemented: 


Common not Private. This bit indicates whether each entry that is pointed to by TTBRO_EL1 isa 
member of a common set that can be used by every PE in the Inner Shareable domain for which the 
value of TTBRO_EL1.CnP is 1. 

Qbd The translation table entries pointed to by TTBRO_EL1, for the current translation 
regime and ASID, are permitted to differ from corresponding entries for TTBRO_EL1 
for other PEs in the Inner Shareable domain. This is not affected by: 

g The value of TTBRO_EL1.CnP on those other PEs. 


. The value of the current ASID. 


° If EL2 is implemented and enabled in the current Security state, the value of the 
current VMID. 
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Qb1 The translation table entries pointed to by TTBRO_EL1 are the same as the translation 
table entries for every other PE in the Inner Shareable domain for which the value of 
TTBRO_EL1.CnP is 1 and all of the following apply: 


a The translation table entries are pointed to by TTBRO_EL1. 
e The translation tables relate to the same translation regime. 
‘ The ASID is the same as the current ASID. 


° If EL2 is implemented and enabled in the current Security state, the value of the 
current VMID. 


This field is permitted to be cached in a TLB. 


When a TLB combines entries from stage 1 translation and stage 2 translation into a single entry, 
that entry can only be shared between different PEs if the value of the CnP bit is 1 for both stage 1 
and stage 2. 


Note 


If the value of the TTBRO_EL1.CnP bit is 1 on multiple PEs in the same Inner Shareable domain 
and those TTBRO_EL1s do not point to the same translation table entries when the other conditions 
specified for the case when the value of CnP is 1 apply, then the results of translations are 
CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching 
of control or data values on page K1-7630. 








This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Accessing the TTBRO_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic TTBRO_EL1 
or TTBRO_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TTBRO_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b0010 0b0000 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x200] ; 
else 
return TTBRO_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return TIBRQ_EL2; 
else 
return TIBRO_EL1; 
elsif PSTATE.EL == EL3 then 
return TIBRQ_EL1; 
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MSR TTBRO_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x200] = X[t]; 
else 
TTBRO_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
TTBRO_EL2 = X[t]; 
else 
TTBRO_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TTBRO_EL1 = X[t]; 


MRS <Xt>, TTBRO_EL12 





op0 op1 CRn CRm op2 





0b11 0b101 0b0010 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x200] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return TIBRO_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return TTBRO_EL1; 
else 
UNDEFINED; 


MSR TTBRO_EL12, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b0010 0b0000 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x200] = X[t]; 
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elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
TTBRO_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
TTBRO_EL1 = X[t]; 





else 
UNDEFINED; 
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D13.2.125 TTBRO_EL2, Translation Table Base Register 0 (EL2) 
The TTBRO_EL2 characteristics are: 


Purpose 


When HCR_EL2.E2H is 0, holds the base address of the translation table for the initial lookup for 
stage 1 of an address translation in the EL2 translation regime, and other information for this 
translation regime. 


When HCR_EL2.E2H is 1, holds the base address of the translation table for the initial lookup for 
stage 1 of the translation of an address from the lower VA range in the EL2&0 translation regime, 
and other information for this translation regime. 


Configurations 


AArch64 System register TTBRO_EL2[47:1] is architecturally mapped to AArch32 System register 
HTTBR[47:1]. 


If EL2 is not implemented, this register is RESO from EL3. 

This register has no effect if EL2 is not enabled in the current Security state. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 

TTBRO_EL2 is a 64-bit register. 


Field descriptions 


The TTBRO_EL2 bit assignments are: 


63 48 47 1 0 


ASID BADDR 


| CnP 


ASID, bits [63:48] 
When ARMv8.1-VHE is implemented: 
When HCR_EL2.E2H is 0, this field is RESO. 


When HCR_EL2.E2H is 1, it holds an ASID for the translation table base address. The 
TCR_EL2.A1 field selects either TTBRO_EL2.ASID or TTBR1_EL2.ASID. 


If the implementation has only 8 bits of ASID, then the upper 8 bits of this field are RESO. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
BADDR, bits [47:1] 

Translation table base address, A[47:x] or A[51:x], bits[47:1]. 
Note 


° Translation table base addresses of 52 bits, A[51:x], are supported only in an implementation 
that includes ARMv8.2-LPA and is using the 64KB translation granule. 





. A translation table must be aligned to the size of the table, except that when using a 
translation table base address larger than 48 bits the minimum alignment of a table containing 
fewer than eight entries is 64 bytes. 
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In an implementation that includes ARMv8.2-LPA, if the value of TCR_EL2.{I}PS is 0b110, then: 


° Register bits[47:z] hold bits[47:z] of the stage 1 translation table base address, where z is 
determined as follows: 


— Ifx>=6 then z=x. 
— Otherwise, z=6. 
è Register bits[5:2] hold bits[51:48] of the stage 1 translation table base address. 


è When z>x register bits[(z-1):x] are RESO, and bits[(z-1):x] of the translation table base 
address are zero. 


° When x>6 register bits[(x-1):6] are RESO. 
: Register bit[1] is RESO. 
. Bits[5:2] of the stage 1 translation table base address are zero. 


° In an implementation that includes ARMv8.2-TTCNP bit[0] of the stage 1 translation table 
base address is zero. 





Note 
In an implementation that includes ARMv8.2-LPA: 


° A TCR_EL2.{I}PS value of 0b110, that selects an OA size of 52 bits, is permitted only when 
using the 64KB translation granule. 


° The OA size is specified by: 
— The value of TCR_EL2.PS when the value of HCR_EL2.E2H is 0. 
— The value of TCR_EL2.IPS when the value of HCR_EL2.E2H is 1. 


When the value of ID AA64MMFRO_EL1.PARange indicates that the implementation does not 
support a 52 bit PA size, if a translation table lookup uses this register with the 64KB translation 
granule when the value of TCR_EL2.{I}PS is 0b110 and the value of register bits[5:2] is nonzero, 
an Address size fault is generated. 





If the Effective value of TCR_EL2.{I}PS is not 0b110 then: 
- Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address. 
$ Register bits[(x-1):1] are RESO. 


s If the implementation supports 52-bit PAs and IPAs, then bits[51:48] of the translation table 
base addresses used in this stage of translation are 0b0000. 


— Note 

This definition applies: 

$ To an implementation that includes ARMv8.2-LPA and is using a translation granule smaller 
than 64KB. 


° To any implementation that does not include ARMv8.2-LPA. 





If any TTBRO_EL2[47:0] bit that is defined as RESO has the value 1 when a translation table walk 
is performed using TTBRO_EL2, then the translation table base address might be misaligned, with 
effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following: 


è Bits[x-1:0] ofthe translation table base address are treated as ifall the bits are zero. The value 
read back from the corresponding register bits is either the value written to the register or 
zero. 

° The result of the calculation of an address for a translation table walk using this register can 


be corrupted in those bits that are nonzero. 


The AArch64 Virtual Memory System Architecture chapter describes how x is calculated based on 
the value of TCR_EL2.TOSZ, the stage of translation, and the translation granule size. 


This field resets to an architecturally UNKNOWN value. 
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CnP, bit [0] 
When ARMV8.2-TTCNP is implemented: 


Common not Private. This bit indicates whether each entry that is pointed to by TTBRO_EL2 is a 
member of a common set that can be used by every PE in the Inner Shareable domain for which the 
value of TTBRO_EL2.CnP is 1. 


Qbd The translation table entries pointed to by TTBRO_EL2 for the current translation 
regime, and ASID if applicable, are permitted to differ from corresponding entries for 
TTBRO_EL2 for other PEs in the Inner Shareable domain. This is not affected by: 


: The value of TTBRO_EL2.CnP on those other PEs. 


7 When the current translation regime is the EL2&0 regime, the value of the 
current ASID. 
Qb1 The translation table entries pointed to by TTBRO_EL2 are the same as the translation 


table entries for every other PE in the Inner Shareable domain for which the value of 
TTBRO_EL2.CnP is 1 and all of the following apply: 


e The translation table entries are pointed to by TTBRO_EL2. 


° The translation tables relate to the same translation regime. 
š If that translation regime is the EL2&0 regime, the ASID is the same as the 
current ASID. 


This field is permitted to be cached in a TLB. 


Note 


If the value of the TTBRO_EL2.CnP bit is 1 on multiple PEs in the same Inner Shareable domain 
and those TTBRO_EL2s do not point to the same translation table entries when the other conditions 
specified for the case when the value of CnP is 1 apply, then the results of translations are 
CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching 
of control or data values on page K1-7630. 








This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Accessing the TTBRO_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic TTBRO_EL2 
or TTBRO_EL1 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TTBRO_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0010 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return TIBRQ_EL2; 
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elsif PSTATE.EL == EL3 then 
return TIBRQ_EL2; 


MSR TTBRO_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b0010 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TTBRO_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
TTBRO_EL2 = X[t]; 


MRS <Xt>, TTBRO_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0010 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x200] ; 
else 
return TTBRO_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return TIBRQ_EL2; 
else 
return TIBRO_EL1; 
elsif PSTATE.EL == EL3 then 
return TIBRQ_EL1; 


MSR TTBRO_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x200] = X[t]; 
else 
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TTBRO_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
TTBRO_EL2 = X[t]; 
else 
TTBRO_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TTBRO_EL1 = X[t]; 
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D13.2.126 TTBRO_EL3, Translation Table Base Register 0 (EL3) 


The TTBRO_EL3 characteristics are: 


Purpose 


Holds the base address of the translation table for the initial lookup for stage 1 of an address 
translation in the EL3 translation regime, and other information for this translation regime. 


Configurations 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TTBRO_EL3 is a 64-bit register. 


Field descriptions 


The TTBRO_EL3 bit assignments are: 


63 


RESO 


Bits [63:48] 


48 47 1 0 


BADDR 


— CnP 


Reserved, RESO. 


BADDR, bits [47:1] 


Translation table base address, A[47:x] or A[51:x]. 





Note 


Translation table base addresses of 52 bits, A[51:x], are supported only in an implementation 
that includes ARMv8.2-LPA and is using the 64KB translation granule. 


A translation table must be aligned to the size of the table, except that when using translation 
table base address larger than 48 bits the minimum alignment of a table containing fewer than 
eight entries is 64 bytes. 


In an implementation that includes ARMv8.2-LPA, if the value of TCR_EL3.PS is 0b110 then: 


Register bits[47:z] hold bits[47:z] of the stage 1 translation table base address, where z is 
determined as follows: 


—  Ifx>=6 then z=x. 
— Otherwise, z=6. 
Register bits[5:2] hold bits[51:48] of the stage 1 translation table base address. 


When z>x register bits[(z-1):x] are RESO, and bits[(z-1):x] of the translation table base 
address are zero. 


When x>6 register bits[(x-1):6] are RESO. 
Register bit[1] is RESO. 
Bits[5:2] of the stage 1 translation table base address are zero. 


In an implementation that includes ARMv8.2-TTCNP bit[0] of the stage 1 translation table 
base address is zero. 
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CnP, bit [0] 


Note 
s In an implementation that includes ARMv8.2-LPA a TCR_EL3.PS value of 0b110, that 
selects a PA size of 52 bits, is permitted only when using the 64KB translation granule. 


$ When the value of ID AA64MMFRO_EL1.PARange indicates that the implementation does 
not support a 52 bit PA size, if a translation table lookup uses this register with the 64KB 
translation granule when the value of TCR_EL3.PS is 0b110 and the value of register bits[5:2] 
is nonzero, an Address size fault is generated. 





If the Effective value of TCR_EL3.PS is not 0b110 then: 
. Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address. 
a Register bits[(x-1):1] are RESO. 


. If the implementation supports 52-bit PAs and IPAs, then bits[51:48] of the translation table 
base addresses used in this stage of translation are 0b0000. 


— Note 

This definition applies: 

od To an implementation that includes ARMv8.2-LPA and is using a translation granule smaller 
than 64KB. 


° To any implementation that does not include ARMv8.2-LPA. 





If any TTBRO_EL3[47:0] bit that is defined as RESO has the value 1 when a translation table walk 
is performed using TTBRO_EL3, then the translation table base address might be misaligned, with 
effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following: 


. Bits[x-1:0] of the translation table base address are treated as if all the bits are zero. The value 
read back from the corresponding register bits is either the value written to the register or 
zero. 

° The result of the calculation of an address for a translation table walk using this register can 


be corrupted in those bits that are nonzero. 


The AArch64 Virtual Memory System Architecture chapter describes how x is calculated based on 
the value of TCR_EL3.TOSZ, the stage of translation, and the translation granule size. 


This field resets to an architecturally UNKNOWN value. 


When ARMV8.2-TTCNP is implemented: 


Common not Private. This bit indicates whether each entry that is pointed to by TTBRO_EL3 is a 
member of a common set that can be used by every PE in the Inner Shareable domain for which the 
value of TTBRO_EL3.CnP is 1. 


Qbd The translation table entries pointed to by TTBRO_EL3, for the current translation 
regime, are permitted to differ from corresponding entries for TTBRO_EL3 for other 
PEs in the Inner Shareable domain. This is not affected by the value of 
TTBRO_EL3.CnP on those other PEs. 


Qb1 The translation table entries pointed to by TTBRO_EL3 are the same as the translation 
table entries for every other PE in the Inner Shareable domain for which the value of 
TTBRO_EL3.CnP is 1 and the translation table entries are pointed to by TTBRO_EL3. 


This field is permitted to be cached in a TLB. 


Note 


If the value of the TTBRO_EL3.CnP bit is 1 on multiple PEs in the same Inner Shareable domain 
and those TTBRO_EL3s do not point to the same translation table entries the results of translations 
using TTBRO_EL3 are CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE 
behaviors due to caching of control or data values on page K1-7630. 








This field resets to an architecturally UNKNOWN value. 
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Otherwise: 


Reserved, RESO. 


Accessing the TTBRO_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TTBRO_EL3 




















op0 op1 CRn CRm op2 
0b11 0b110 0b0010 0b0000 0b000 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return TTBRO_EL3; 
MSR TTBRO_EL3, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b110 0b0010 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
TTBRO_EL3 = X[t]; 
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D13.2.127 TTBR1_EL1, Translation Table Base Register 1 (EL1) 
The TTBR1_EL1 characteristics are: 


Purpose 


Holds the base address of the translation table for the initial lookup for stage 1 of the translation of 
an address from the higher VA range in the EL1 &0 stage 1 translation regime, and other information 
for this translation regime. 


Configurations 


AArch64 System register TTBR1_EL1[63:0] is architecturally mapped to AArch32 System register 
TTBR1[63:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TTBR1_ EL! is a 64-bit register. 


Field descriptions 


The TTBR1_ EL! bit assignments are: 


63 48 47 1 0 


ASID BADDR 


Lo CnP 


ASID, bits [63:48] 


An ASID for the translation table base address. The TCR_EL1.A1 field selects either 
TTBRO_EL1.ASID or TTBR1_EL1.ASID. 


If the implementation has only 8 bits of ASID, then the upper 8 bits of this field are RESO. 


This field resets to an architecturally UNKNOWN value. 
BADDR, bits [47:1] 

Translation table base address, A[47:x] or A[51:x], bits[47:1]. 
Note 


° Translation table base addresses of 52 bits, A[51:x], are supported only in an implementation 
that includes ARMv8.2-LPA and is using the 64KB translation granule. 





g A translation table must be aligned to the size of the table, except that when using a 
translation table base address larger than 48 bits the minimum alignment of a table containing 
fewer than eight entries is 64 bytes. 





In an implementation that includes ARMv8.2-LPA, if the value of TCR_EL1.IPS is 0b110, then: 


° Register bits[47:z] hold bits[47:z] of the stage 1 translation table base address, where z is 
determined as follows: 


—  Ifx>=6 then z=x. 
— Otherwise, z=6. 


a Register bits[5:2] hold bits[51:48] of the stage 1 translation table base address. 


s When z>x register bits[(z-1):x] are RESO, and bits[(z-1):x] of the translation table base 
address are zero. 
- When x>6 register bits[(x-1):6] are RESO. 
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è Register bit[1] is RESO. 
° Bits[5:2] of the stage 1 translation table base address are zero. 


. In an implementation that includes ARMv8.2-TTCNP bit[0] of the stage 1 translation table 
base address is zero. 


— Note 
è In an implementation that includes ARMv8.2-LPA a TCR_EL1.IPS value of 0b110, that 
selects an IPA size of 52 bits, is permitted only when using the 64KB translation granule. 


à When the value of ID AA64MMFRO_EL1.PARange indicates that the implementation does 
not support a 52 bit PA size, if a translation table lookup uses this register with the 64KB 
translation granule when the value of TCR_EL1.IPS is @b110 and the value of register 
bits[5:2] is nonzero, an Address size fault is generated. 





If the Effective value of TCR_EL1.IPS is not 0b110 then: 
s Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address. 
s Register bits[(x-1):1] are RESO. 


a If the implementation supports 52-bit PAs and IPAs, then bits[51:48] of the translation table 
base addresses used in this stage of translation are 0b0000. 





Note 
This definition applies: 
è To an implementation that includes ARMv8.2-LPA and is using a translation granule smaller 
than 64KB. 


° To any implementation that does not include ARMv8.2-LPA. 





If any TTBR1_EL1[47:0] bit that is defined as RESO has the value 1 when a translation table walk 
is performed using TTBR1_EL1, then the translation table base address might be misaligned, with 
effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following: 


$ Bits[x-1:0] ofthe translation table base address are treated as ifall the bits are zero. The value 
read back from the corresponding register bits is either the value written to the register or 
zero. 

° The result of the calculation of an address for a translation table walk using this register can 


be corrupted in those bits that are nonzero. 


The AArch64 Virtual Memory System Architecture chapter describes how x is calculated based on 
the value of TCR_EL1.T1SZ, the stage of translation, and the translation granule size. 


This field resets to an architecturally UNKNOWN value. 


CnP, bit [0] 
When ARMV8.2-TTCNP is implemented: 


Common not Private. This bit indicates whether each entry that is pointed to by TBR1_EL1 is a 
member of a common set that can be used by every PE in the Inner Shareable domain for which the 
value of TTBR1_EL1.CnP is 1. 


Qbd The translation table entries pointed to by TTBR1_EL1, for the current translation 
regime and ASID, are permitted to differ from corresponding entries for TTBR1_EL1 
for other PEs in the Inner Shareable domain. This is not affected by: 


g The value of TTBR1_EL1.CnP on those other PEs. 
° The value of the current ASID. 


° If EL2 is implemented and enabled in the current Security state, the value of the 
current VMID. 
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Qb1 The translation table entries pointed to by TTBR1_EL1 are the same as the translation 
table entries for every other PE in the Inner Shareable domain for which the value of 
TTBR1_EL1.CnP is 1 and all of the following apply: 


a The translation table entries are pointed to by TTBR1_EL1. 
e The translation tables relate to the same translation regime. 
‘ The ASID is the same as the current ASID. 


° If EL2 is implemented and enabled in the current Security state, the value of the 
current VMID. 


This field is permitted to be cached in a TLB. 


When a TLB combines entries from stage 1 translation and stage 2 translation into a single entry, 
that entry can only be shared between different PEs if the value of the CnP bit is 1 for both stage 1 
and stage 2. 


Note 


If the value of the TTBR1_EL1.CnP bit is 1 on multiple PEs in the same Inner Shareable domain 
and those TTBR1_EL1s do not point to the same translation table entries when the other conditions 
specified for the case when the value of CnP is 1 apply, then the results of translations are 
CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching 
of control or data values on page K1-7630. 








This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Accessing the TTBR1_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic TTBR1_EL1 
or TTBR1_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TTBR1_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b0010 0b0000 0b001 


if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x210]; 


else 


return TTBR1_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return TIBR1_EL2; 


else 


return TIBR1_EL1; 
elsif PSTATE.EL == EL3 then 
return TIBR1_EL1; 
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MSR TTBR1_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b0010 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x210] = X[t]; 
else 
TTBR1_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
TTBR1_EL2 = X[t]; 
else 
TTBR1_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TTBR1_EL1 = X[t]; 


MRS <Xt>, TTBR1_EL12 





op0 op1 CRn CRm op2 





0b11 0b101 0b0010 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x210]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return TIBR1_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return TIBR1_EL1; 
else 
UNDEFINED; 


MSR TTBR1_EL12, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b0010 0b0000 0b001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x210] = X[t]; 
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elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
TTBR1_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
TTBR1_EL1 = X[t]; 





else 
UNDEFINED; 
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D13.2.128 TTBR1_EL2, Translation Table Base Register 1 (EL2) 


63 
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The TTBR1_EL2 characteristics are: 


Purpose 


When HCR_EL2.E2H is 1, holds the base address of the translation table for the initial lookup for 
stage 1 of the translation of an address from the higher VA range in the EL2&0 translation regime, 
and other information for this translation regime. 


Note 


When HCR_EL2.E2H is 0, the contents of this register are ignored by the PE, except for a direct 
read or write of the register. 





Configurations 


This register is present only when ARMV8.1-VHE is implemented. Otherwise, direct accesses to 
TTBR1_EL2 are UNDEFINED. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TTBR1_EL2 is a 64-bit register. 


Field descriptions 


The TTBR1_EL2 bit assignments are: 


48 47 1 0 


ASID BADDR 
[= CnP 


ASID, bits [63:48] 


An ASID for the translation table base address. The TCR_EL2.A1 field selects either 
TTBRO_EL2.ASID or TTBR1_EL2.ASID. 


If the implementation has only 8 bits of ASID, then the upper 8 bits of this field are RESO. 
This field resets to an architecturally UNKNOWN value. 

BADDR, bits [47:1] 
Translation table base address, A[47:x] or A[51:x], bits[47:1]. 





Note 
° Translation table base addresses of 52 bits, A[51:x], are supported only in an implementation 
that includes ARMv8.2-LPA and is using the 64KB translation granule. 
° A translation table must be aligned to the size of the table, except that when using a 


translation table base address larger than 48 bits the minimum alignment of a table containing 
fewer than eight entries is 64 bytes. 
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In an implementation that includes ARMv8.2-LPA, if the value of TCR_EL2.{I}PS is 0b110, then: 


è Register bits[47:z] hold bits[47:z] of the stage 1 translation table base address, where z is 
determined as follows: 


— Ifx>=6 then z=x. 
— Otherwise, z=6. 
è Register bits[5:2] hold bits[51:48] of the stage 1 translation table base address. 


è When z>x register bits[(z-1):x] are RESO, and bits[(z-1):x] of the translation table base 
address are zero. 


° When x>6 register bits[(x-1):6] are RESO. 
: Register bit[1] is RESO. 
. Bits[5:2] of the stage 1 translation table base address are zero. 


° In an implementation that includes ARMv8.2-TTCNP bit[0] of the stage 1 translation table 
base address is zero. 





Note 
: In an implementation that includes ARMv8.2-LPA a TCR_EL2.IPS value of 0b110, that 
selects an OA size of 52 bits, is permitted only when using the 64KB translation granule. 


` When the value of [ID AA64MMFRO_EL1.PARange indicates that the implementation does 
not support a 52 bit PA size, if a translation table lookup uses this register with the 64KB 
translation granule when the value of TCR_EL2.IPS is @b110 and the value of register 
bits[5:2] is nonzero, an Address size fault is generated. 





If the Effective value of TCR_EL2.IPS is not 0b110 then: 
° Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address. 
s Register bits[(x-1):1] are RESO. 


= If the implementation supports 52-bit PAs and IPAs, then bits[51:48] of the translation table 
base addresses used in this stage of translation are 0b0000. 





Note 
This definition applies: 
. To an implementation that includes ARMv8.2-LPA and is using a translation granule smaller 
than 64KB. 


° To any implementation that does not include ARMv8.2-LPA. 





If any TTBR1_EL2[47:0] bit that is defined as RESO has the value 1 when a translation table walk 
is performed using TTBR1_EL2, then the translation table base address might be misaligned, with 
effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following: 


- Bits[x-1:0] of the translation table base address are treated as if all the bits are zero. The value 
read back from the corresponding register bits is either the value written to the register or 
zero. 

° The result of the calculation of an address for a translation table walk using this register can 


be corrupted in those bits that are nonzero. 


The AArch64 Virtual Memory System Architecture chapter describes how x is calculated based on 
the value of TCR_EL2.T1SZ, the stage of translation, and the translation granule size. 


This field resets to an architecturally UNKNOWN value. 
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CnP, bit [0] 
When ARMV8.2-TTCNP is implemented: 


Common not Private. This bit indicates whether each entry that is pointed to by TBR1_EL2 is a 
member of a common set that can be used by every PE in the Inner Shareable domain for which the 


value of TTBR1_EL2.CnP is 1. 


Qbd The translation table entries pointed to by TTBR1_EL2 for the current ASID are 
permitted to differ from corresponding entries for TTBR1_EL2 for other PEs in the 


Inner Shareable domain. This is not affected by: 


, The value of TTBR1_EL2.CnP on those other PEs. 


. The value of the current ASID. 


Qb1 The translation table entries pointed to by TTBR1_EL2 are the same as the translation 
table entries for every other PE in the Inner Shareable domain for which the value of 


TTBR1_EL2.CnP is 1 and all of the following apply: 


e The translation table entries are pointed to by TTBR1_EL2. 


. The ASID is the same as the current ASID. 
This field is permitted to be cached in a TLB. 


Note 





à TTBR1_EL2 is accessible only when the value of HCR_EL2.E2H is 1, meaning the current 


translation regime is the EL2&0 regime. 


$ If the value of the TTBR1_EL2.CnP bit is 1 on multiple PEs in the same Inner Shareable 
domain and those TTBR1_EL2s do not point to the same translation table entries when the 
other conditions specified for the case when the value of CnP is 1 apply, then the results of 
translations are CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE 
behaviors due to caching of control or data values on page K 1-7630. 





This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Accessing the TTBR1_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic TTBR1_EL2 
or TTBR1_EL1 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TTBR1_EL2 











op0 op1 CRn CRm op2 
0b11 0b100 0b0010 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return TIBR1_EL2; 
elsif PSTATE.EL == EL3 then 
return TIBR1_EL2; 
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MSR TTBR1_EL2, <Xt> 














op0 op1 CRn CRm op2 
0b11 0b100 0b0010 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TTBR1_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
TTBR1_EL2 = X[t]; 
MRS <Xt>, TTBR1_EL1 
op0 op1 CRn CRm op2 
0b11 0b000 0b0010 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x210]; 
else 
return TIBR1_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return TIBR1_EL2; 
else 
return TIBR1_EL1; 
elsif PSTATE.EL == EL3 then 
return TIBR1_EL1; 


MSR TTBR1_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b0010 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x210] = X[t]; 
else 
TTBR1_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
TTBR1_EL2 = X[t]; 
else 
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TTBR1_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TTBR1_EL1 = X[t]; 
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D13.2.129 VBAR_EL1, Vector Base Address Register (EL1) 


The VBAR ELI characteristics are: 


Purpose 
Holds the vector base address for any exception that is taken to EL1. 
Configurations 
AArch64 System register VBAR_EL1[31:0] is architecturally mapped to AArch32 System register 
VBAR[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


VBAR_ EL] is a 64-bit register. 


Field descriptions 


The VBAR_EL1 bit assignments are: 


63 11 10 0 


Vector Base Address RESO 


Bits [63:11] 
Vector Base Address. Base address of the exception vectors for exceptions taken to EL1. 
If the implementation does not support ARMv8.2-LVA, then: 


° If tagged addresses are being used, bits [55:48] of VBAR_EL1 must be the same or else the 
use of the vector address will result in a recursive exception. 


s If tagged addresses are not being used, bits [63:48] of VBAR_EL1 must be the same or else 
the use of the vector address will result in a recursive exception. 


If the implementation supports ARMv8.2-LVA, then: 


° If tagged addresses are being used, bits [55:52] of VBAR_EL1 must be the same or else the 
use of the vector address will result in a recursive exception. 


. If tagged addresses are not being used, bits [63:52] of VBAR_EL1 must be the same or else 
the use of the vector address will result in a recursive exception. 


This field resets to an architecturally UNKNOWN value. 


Bits [10:0] 


Reserved, RESO. 


Accessing the VBAR_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic VBAR_EL1 or 
VBAR_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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op0 


0b11 


op1 CRn CRm op2 


0b000 0b1100 0b0000 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


return NVMem[0x250]; 
else 
return VBAR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return VBAR_EL2; 
else 
return VBAR_EL1; 
elsif PSTATE.EL == EL3 then 
return VBAR_EL1; 


MSR VBAR_EL1, <Xt> 





op0 


op1 CRn CRm op2 





0b11 


0b000 0b1100 0b0000 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


NVMem[@x250] = X[t]; 
else 
VBAR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
VBAR_EL2 = X[t]; 
else 
VBAR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
VBAR_EL1 = X[t]; 


MRS <Xt>, VBAR_EL12 





op0 


op1 CRn CRm op2 





0b11 


0b101 0b1100 0b0000 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 


return NVMem[0x250]; 


elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 
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UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return VBAR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return VBAR_EL1; 
else 
UNDEFINED; 


MSR VBAR_EL12, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b101 0b1100 0b0000 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x250] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
VBAR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
VBAR_EL1 = X[t]; 
else 
UNDEFINED; 
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D13.2.130 VBAR_EL2, Vector Base Address Register (EL2) 
The VBAR_EL2 characteristics are: 


Purpose 


Holds the vector base address for any exception that is taken to EL2. 


Configurations 


AArch6é4 System register VBAR_EL2[31:0] is architecturally mapped to AArch32 System register 
HVBAR{31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
VBAR_EL2 is a 64-bit register. 


Field descriptions 


The VBAR_EL2 bit assignments are: 


63 11 10 0 


Vector Base Address RESO 


Bits [63:11] 
Vector Base Address. Base address of the exception vectors for exceptions taken to EL2. 
If the implementation does not support ARMv8.2-LVA, then: 


° If tagged addresses are being used, bits [55:48] of VBAR_EL2 must be 0 or else the use of 
the vector address will result in a recursive exception. 


a If tagged addresses are not being used, bits [63:48] of VBAR_EL2 must be 0 or else the use 
of the vector address will result in a recursive exception. 


If the implementation supports ARMv8.2-LVA, then: 


$ If tagged addresses are being used, bits [55:52] of VBAR_EL2 must be the same or else the 
use of the vector address will result in a recursive exception. 


- If tagged addresses are not being used, bits [63:52] of VBAR_EL2 must be the same or else 
the use of the vector address will result in a recursive exception. 


This field resets to an architecturally UNKNOWN value. 


Bits [10:0] 


Reserved, RESO. 


Accessing the VBAR_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic VBAR_EL2 or 
VBAR _ EL] are not guaranteed to be ordered with respect to accesses using the other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, VBAR_EL2 














op0 op1 CRn CRm op2 
0b11 0b100 0b1100 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VBAR_EL2; 
elsif PSTATE.EL == EL3 then 
return VBAR_EL2; 
MSR VBAR_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b1100 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VBAR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
VBAR_EL2 = X[t]; 


MRS <Xt>, VBAR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1100 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == '@1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x250]; 
else 
return VBAR_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return VBAR_EL2; 
else 
return VBAR_EL1; 
elsif PSTATE.EL == EL3 then 
return VBAR_EL1; 
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MSR VBAR_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b1100 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1> == 'Q1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x250] = X[t]; 
else 
VBAR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
VBAR_EL2 = X[t]; 
else 
VBAR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
VBAR_EL1 = X[t]; 
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D13.2.131 


D13-3400 


VBAR_EL3, Vector Base Address Register (EL3) 


The VBAR _EL3 characteristics are: 


Purpose 

Holds the vector base address for any exception that is taken to EL3. 
Configurations 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


VBAR _ EL3 is a 64-bit register. 


Field descriptions 


The VBAR_EL3 bit assignments are: 


63 


Bits [63:11] 


Bits [10:0] 


11 10 0 


Vector Base Address RESO 


Vector Base Address. Base address of the exception vectors for exceptions taken to EL3. 
If the implementation does not support ARMv8.2-LVA, then: 


° If tagged addresses are being used, bits [55:48] of VBAR_EL3 must be 0 or else the use of 
the vector address will result in a recursive exception. 


. If tagged addresses are not being used, bits [63:48] of VBAR_EL3 must be 0 or else the use 
of the vector address will result in a recursive exception. 


If the implementation supports ARMv8.2-LVA, then: 


- If tagged addresses are being used, bits [55:52] of VBAR_EL3 must be the same or else the 
use of the vector address will result in a recursive exception. 


è If tagged addresses are not being used, bits [63:52] of VBAR_EL3 must be the same or else 
the use of the vector address will result in a recursive exception. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Accessing the VBAR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, VBAR_EL3 











op0 op1 CRn CRm op2 
0b11 0b110 0b1100 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
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elsif PSTATE.EL == EL3 then 
return VBAR_EL3; 


MSR VBAR_EL3, <Xt> 


if PSTATE.EL == EL@ then 


UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
UNDEFINED; 


elsif PSTATE.EL == EL3 then 
VBAR_EL3 = X[t]; 
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op0 op1 


CRn 


CRm 


op2 





0b11 0b110 


0b1100 


0b0000 


0b000 





Non-Confidential 


D13-3401 


AArch64 System Register Descriptions 
D13.2 General system control registers 


D13.2.132 VMPIDR_EL42, Virtualization Multiprocessor ID Register 
The VMPIDR_EL2 characteristics are: 


Purpose 


Holds the value of the Virtualization Multiprocessor ID. This is the value returned by EL1 reads of 
MPIDR ELI. 


Configurations 


AArch6é4 System register VMPIDR_EL2[31:0] is architecturally mapped to AArch32 System 
register VMPIDR{3 1:0]. 


If EL2 is not implemented, reads of this register return the value of the MPIDR_EL1, and writes to 
the register are ignored. 


This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
VMPIDR_EL2 is a 64-bit register. 


Field descriptions 


The VMPIDR_EL2 bit assignments are: 


63 40 39 32 31 30 29 25 24 23 1615 8 7 0 


RESO Aff3 ii RESO Aff2 Aff1 AffO 


RES1 es O a Ca a MT 


Bits [63:40] 
Reserved, RESO. 
Aff3, bits [39:32] 
Affinity level 3. See the description of Aff0 for more information. 
Aff3 is not supported in AArch32 state. 
This field resets to an architecturally UNKNOWN value. 
Bit [31] 
Reserved, RES1. 
U, bit [30] 


Indicates a Uniprocessor system, as distinct from PE 0 in a multiprocessor system. The possible 
values of this bit are: 


Ob Processor is part of a multiprocessor system. 

Qb1 Processor is part of a uniprocessor system. 

This field resets to an architecturally UNKNOWN value. 
Bits [29:25] 


Reserved, RESO. 
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MT, bit [24] 


Indicates whether the lowest level of affinity consists of logical PEs that are implemented using a 
multithreading type approach. See the description of Aff0 for more information about affinity 
levels. The possible values of this bit are: 


Qbd Performance of PEs at the lowest affinity level is largely independent. 
Qb1 Performance of PEs at the lowest affinity level is very interdependent. 


This field resets to an architecturally UNKNOWN value. 

Aff2, bits [23:16] 
Affinity level 2. See the description of Aff0 for more information. 
This field resets to an architecturally UNKNOWN value. 

Aff, bits [15:8] 
Affinity level 1. See the description of Aff0 for more information. 
This field resets to an architecturally UNKNOWN value. 

Aff0, bits [7:0] 


Affinity level 0. This is the affinity level that is most significant for determining PE behavior. Higher 
affinity levels are increasingly less significant in determining PE behavior. The assigned value of 
the MPIDR. {Aff2, Affl, Aff0} or MPIDR_ EL1.{Aff3, Aff2, Affl, Aff0} set of fields of each PE 
must be unique within the system as a whole. 


This field resets to an architecturally UNKNOWN value. 


Accessing the VMPIDR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, VMPIDR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0000 0b0000 0b101 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x050]; 


elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
return VMPIDR_EL2; 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
return MPIDR_EL1; 
else 
return VMPIDR_EL2; 
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D13-3404 


MSR VMPIDR_EL2, <Xt> 


























op0 op1 CRn CRm op2 
0b11 0b100 0b0000 0b0000 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x@50] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VMPIDR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
NOP = X[t]; 
else 
VMPIDR_EL2 = X[t]; 
MRS <Xt>, MPIDR_EL1 
op0 op1 CRn CRm op2 
0b11 0b000 0b0000 0b0000 0b101 
if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) then 
return VMPIDR_EL2; 
else 
return MPIDR_EL1; 
elsif PSTATE.EL == EL2 then 
return MPIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return MPIDR_EL1; 
MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
coproc opc1 CRn CRm opc2 
0b1111 0b000 0b0000 0b0000 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
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elsif EL2Enabled() && !ELUsingAArch32(EL2) then 
return VMPIDR_EL2<31:0>; 
elsif EL2Enabled() && ELUsingAArch32(EL2) then 
return VMPIDR<31:0>; 
else 
return MPIDR<31:0>; 
elsif PSTATE.EL == EL2 then 
return MPIDR<31:0>; 
elsif PSTATE.EL == EL3 then 
return MPIDR<31:0>; 
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D13.2.133  VNCR_EL2, Virtual Nested Control Register 


The VNCR_EL2 characteristics are: 


D13-3406 


Purpose 


When ARMv8.4-NV is implemented, holds the base address that is used to define the memory 
location that is accessed by transformed reads and writes of System registers. 


Configurations 


Attributes 


This register is present only when ARMV8.4-NV is implemented. Otherwise, direct accesses to 
VNCR_EL2 are UNDEFINED. 


This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


VNCR_EL2 is a 64-bit register. 


Field descriptions 


The VNCR_EL2 bit assignments are: 


63 


RESS 


53 52 12 11 0 


BADDR RESO 


RESS, bits [63:53] 


Reserved, Sign extended. If the bits marked as RESS do not all have the same value, then there is a 
CONSTRAINED UNPREDICTABLE choice between: 


` Generating an EL2 translation regime Translation abort on use of the VNCR_EL2 register. 


s Bits[63:49] of VNCR_EL2 are treated as the same value as bit[48] for all purposes other than 
reading back the register. 
. Bits[63:49] of VNCR_EL2 are treated as the same value as bit[48] for all purposes. 


à If the virtual address space for EL2 supports more than 48 bits, bits[63:53] of VNCR_EL2 
are treated as the same value as bit[52] for all purposes other than reading back the register. 


è If the virtual address space for EL2 supports more than 48 bits, bits[63:53] of VNCR_EL2 
are treated as the same value as bit[52]. 


Where the EL2 translation regime has upper and lower address ranges, bit[52] is used to select 
between those address ranges to determine if the address space supports more than 48 bits. 


BADDR, bits [52:12] 


Bits [11:0] 


Base Address. If the virtual address space for EL2 does not support more than 48 bits, then bits 
[52:49] are RESS. 


When a register read/write is transformed to be a Load or Store, the address of the load/store is to 
SignOffset(VNCR.BADDR:Offset<11:0>, 64). 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Accessing the VNCR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, VNCR_EL2 





op0 op1 CRn CRm op2 


0b11 0b100 0b0010 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[QxQBQ] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VNCR_EL2; 
elsif PSTATE.EL == EL3 then 
return VNCR_EL2; 


MSR VNCR_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b0010 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x@BQ] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VNCR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
VNCR_EL2 = X[t]; 
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D13.2.134 VPIDR_EL2, Virtualization Processor ID Register 
The VPIDR_EL2 characteristics are: 


Purpose 
Holds the value of the Virtualization Processor ID. This is the value returned by EL1 reads of 
MIDR_ELI. 

Configurations 


AArch64 System register VPIDR_EL2[3 1:0] is architecturally mapped to AArch32 System register 
VPIDR{3 1:0]. 


If EL2 is not implemented, reads of this register return the value of the MIDR_EL1, and writes to 
the register are ignored. 


This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
VPIDR_EL2 is a 64-bit register. 


Field descriptions 


The VPIDR_EL2 bit assignments are: 


32 31 24 23 20 19 16 15 


63 4 3 0 
| RESO | Implementer Varia um Revision 


nt PartN 
ag a e a Architecture 


Bits [63:32] 
Reserved, RESO. 


Implementer, bits [31:24] 


The Implementer code. This field must hold an implementer code that has been assigned by Arm. 
Assigned codes include the following: 





Hex representation ASCII representation Implementer 


























0x41 A Arm Limited 

0x42 B Broadcom Corporation 

0x43 C Cavium Inc. 

0x44 D Digital Equipment Corporation 

0x49 I Infineon Technologies AG 

0x4D M Motorola or Freescale Semiconductor Inc. 

Ox4E N NVIDIA Corporation 

0x50 P Applied Micro Circuits Corporation 
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Hex representation ASCII representation Implementer 











0x51 Q Qualcomm Inc. 
0x56 V Marvell International Ltd. 
0x69 i Intel Corporation 





Arm can assign codes that are not published in this manual. All values not assigned by Arm are 
reserved and must not be used. 


This field resets to an architecturally UNKNOWN value. 


Variant, bits [23:20] 


An IMPLEMENTATION DEFINED variant number. Typically, this field is used to distinguish between 
different product variants, or major revisions of a product. 


This field resets to an architecturally UNKNOWN value. 


Architecture, bits [19:16] 
The permitted values of this field are: 
0b0001 Armv4. 
0b0010 Armv4T. 
0b0011 Armyv5 (obsolete). 
0b0100 Armv5T. 
0b0101 Armv5TE. 
0b0110 Armv5TEJ. 
0b0111 Armv6. 


0b1111 Architectural features are individually identified in the ID_* registers, see ZD registers 
on page K 14-7832. 


All other values are reserved. 


This field resets to an architecturally UNKNOWN value. 
PartNum, bits [15:4] 


An IMPLEMENTATION DEFINED primary part number for the device. 


On processors implemented by Arm, if the top four bits of the primary part number are 0x0 or 0x7, 
the variant and architecture are encoded differently. 


This field resets to an architecturally UNKNOWN value. 


Revision, bits [3:0] 
An IMPLEMENTATION DEFINED revision number for the device. 


This field resets to an architecturally UNKNOWN value. 


Accessing the VPIDR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, VPIDR_EL2 





op0 op1 CRn CRm op2 


0b11 0b100 0b0000 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x088] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VPIDR_EL2; 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
return MIDR_EL1; 
else 
return VPIDR_EL2; 


MSR VPIDR_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b0000 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x088] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VPIDR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
//no operation 
else 
VPIDR_EL2 = X[t]; 


MRS <Xt>, MIDR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0000 0b0000 0b000 





if PSTATE.EL == EL@ then 
if IsFeatureImplemented("ARMv8.4-IDST") then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
else 
UNDEFINED; 
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elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) then 
return VPIDR_EL2; 
else 
return MIDR_EL1; 
elsif PSTATE.EL == EL2 then 
return MIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return MIDR_EL1; 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 CRn CRm opc2 
0b1111 0b000 0b0000 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) then 
return VPIDR_EL2<31:0>; 
elsif EL2Enabled() && ELUsingAArch32(EL2) then 
return VPIDR<31:0>; 
else 
return MIDR<31:0>; 
elsif PSTATE.EL == EL2 then 
return MIDR<31:0>; 
elsif PSTATE.EL == EL3 then 
return MIDR<31:0>; 
D13-3411 
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D13.2.135 VSTCR_EL2, Virtualization Secure Translation Control Register 


D13-3412 


The VSTCR_EL2 characteristics are: 


Purpose 
The control register for stage 2 of the Secure EL1&0 translation regime. 
Configurations 
This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
VSTCR_EL2 are UNDEFINED. 
This register has no effect if EL2 is not enabled in the current Security state. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


VSTCR_EL2 is a 64-bit register. 


Field descriptions 


The VSTCR_EL2 bit assignments are: 


32 31 30 29 28 16 15 14 13 8765 


—_ RESO | | RESO reo RESO fso] TOSZ 


Any of the bits in VSTCR_EL2 are permitted to be cached in a TLB. 


Bits [63:32] 


Bit [31] 


SA, bit [30] 


SW, bit [29] 


Bits [28:16] 


Reserved, RESO. 


Reserved, RES]. 


Secure stage 2 translation output address space. 
Qbd All stage 2 translations for the Secure IPA space access the Secure PA space. 
Qb1 All stage 2 translations for the Secure IPA space access the Non-secure PA space. 


When the value of VSTCR_EL2.SW is 1, this bit behaves as 1 for all purposes other than reading 
back the value of the bit. 


This field resets to an architecturally UNKNOWN value. 


Secure stage 2 translation address space. 


Qbd All stage 2 translation table walks for the Secure IPA space are to the Secure PA space. 
Qb1 All stage 2 translation table walks for the Secure IPA space are to the Non-secure PA 
space. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 
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TGO, bits [15:14] 
Secure stage 2 granule size for VSTTBR_EL2. 


Oboe 4KB. 
0b01 64KB. 
0b10 16KB. 


Other values are reserved. 


If ARMv8.5-GTG is implemented, ID_AA64MMFR0 _EL1.{TGran4_2, TGran16_2, TGran64_2} 
indicate which granule sizes are supported for Level 2 translation. 


If ARMv8.5-GTG is not implemented, ID AA64MMFRO_EL1.{TGran4, TGran16, TGran64} 
indicate which granule sizes are supported. 


If the value is programmed to either a reserved value, or a size that has not been implemented, then 
for all purposes other than read back from this register, the hardware will treat the field as if it has 
been programmed to an IMPLEMENTATION DEFINED choice of the sizes that has been implemented. 


It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value 
that corresponds to the size chosen. 


This field resets to an architecturally UNKNOWN value. 
Bits [13:8] 
Reserved, RESO. 
SLO, bits [7:6] 
When ARMVv8.4-TTST is implemented: 


Starting level of the Secure stage 2 translation lookup, controlled by VSTCR_EL2. The meaning of 
this field depends on the value of VSTCR_EL2.TGO. 


0b00 IfVSTCR_EL2.TG0 is 0b00 (4KB granule), start at level 2. If VSTCR_EL2.TG0 is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 3. 

QbO1 If VSTCR_EL2.TGO is 0b00 (4KB granule), start at level 1. If VSTCR_EL2.TG0 is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 2. 

0b10 If VSTCR_EL2.TGO is 0b00 (4KB granule), start at level 0. If VSTCR_EL2.TG0 is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 1. 

Qb11 If VSTCR_EL2.TGO is 0b00 (4KB granule), start at level 3. 


All other values are reserved. If this field is programmed to a reserved value, or to a value that is not 
consistent with the programming of VSTCR_EL2.TOSZ, then a stage 2 level 0 Translation fault is 
generated. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Starting level of the Secure stage 2 translation lookup, controlled by VSTCR_EL2. The meaning of 
this field depends on the value of VSTCR_EL2.TGO. 


0b00 IfVSTCR_EL2.TG0 is 0b00 (4KB granule), start at level 2. If VSTCR_EL2.TG0 is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 3. 

0b01 IfVSTCR_EL2.TG0 is 0b00 (4KB granule), start at level 1. If VSTCR_EL2.TG0 is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 2. 

0b10 If VSTCR_EL2.TGO is 0b00 (4KB granule), start at level 0. If VSTCR_EL2.TG0 is 0b10 


(16KB granule) or 0b01 (64KB granule), start at level 1. 


All other values are reserved. If this field is programmed to a reserved value, or to a value that is not 
consistent with the programming of VSTCR_EL2.TOSZ, then a stage 2 level 0 Translation fault is 
generated. 


This field resets to an architecturally UNKNOWN value. 
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D13-3414 


TOSZ, bits [5:0] 


The size offset of the memory region addressed by VSTTBR_EL2. The region size is 


2(64-VSTCR_EL2.T0SZ) bytes. 


The maximum and minimum possible values for this field depend on the level of translation table 
and the memory translation granule size, as described in the AArch64 Virtual Memory System 


Architecture chapter. 


If this field is programmed to a value that is not consistent with the programming of SLO, then a 


stage 2 level 0 Translation fault is generated. 


This field resets to an architecturally UNKNOWN value. 


Accessing the VSTCR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, VSTCR_EL2 





op0 op1 CRn 


CRm 


op2 





0b11 0b100 0b0010 


if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x048] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsereturn VSTCR_EL2; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 





else 
return VSTCR_EL2; 


MSR VSTCR_EL2, <Xt> 


op0 op1 CRn 


0b0110 


CRm 


0b010 


op2 





0b11 0b100 0b0010 


0b0110 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x048] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 

else 
VSTCR_EL2 = X[t]; 

elsif PSTATE.EL == EL3 then 

if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 

else 
VSTCR_EL2 = X[t]; 
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D13.2.136 VSTTBR_EL42, Virtualization Secure Translation Table Base Register 


The VSTTBR_EL2 characteristics are: 


Purpose 


The base register for stage 2 of the Secure EL1&0 translation regime. Holds the base address of the 
translation table for the initial lookup for stage 2 of an address translation in the Secure EL1&0 
translation regime, and other information for this translation stage. 


Configurations 


Attributes 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
VSTTBR_EL2 are UNDEFINED. 


This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


VSTTBR_EL2 is a 64-bit register. 


Field descriptions 


The VSTTBR_EL2 bit assignments are: 


63 


RESO 


48 47 1 0 


BADDR 


E; CnP 


Any of the bits in VSTTBR_EL2 are permitted to be cached in a TLB. 


Bits [63:48] 


Reserved, RESO. 


BADDR, bits [47:1] 


D13-3416 


Translation table base address, A[47:x] or A[51:x]. 
Note 


° Translation table base addresses of 52 bits, A[51:x], are supported only in an implementation 
that includes ARMv8.2-LPA and is using the 64KB translation granule. 





. A translation table must be aligned to the size of the table, except that when using a 
translation table base address larger than 48 bits the minimum alignment of a table containing 
fewer than eight entries is 64 bytes. 





If the value of VTCR_EL2.PS is 0b110, then: 


° Register bits[47:z] hold bits[47:z] of the stage 1 translation table base address, where z is 
determined as follows: 


— Ifx>=6 then z=x. 
— Otherwise, z=6. 
. Register bits[5:2] hold bits[51:48] of the stage 1 translation table base address. 


s When z>x register bits[(z-1):x] are RESO, and bits[(z-1):x] of the translation table base 
address are zero. 


è When x>6 register bits[(x-1):6] are RESO. 
è Register bit[1] is RESO. 
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° Bits[5:2] of the stage 1 translation table base address are zero. 


Note 

When the value of ID AA64MMFRO_EL1.PARange indicates that the implementation does not 
support a 52 bit PA size, if a translation table lookup uses this register with the 64KB translation 
granule when the value of VTCR_EL2.PS is 0b110 and the value of register bits[5:2] is nonzero, an 
Address size fault is generated. 





If the Effective value of VTCR_EL2.PS is not 0b110 then: 
° Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address. 
è Register bits[(x-1):1] are RESO. 


- If the implementation supports 52-bit PAs and IPAs then bits[51:48] of the translation table 
base addresses used in this stage of translation are 0b0000. 


Ifany VSTTBR_EL2[47:1] bit that is defined as RESO has the value 1 when a translation table walk 
is performed using VSTTBR_EL2, then the translation table base address might be misaligned, with 
effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following: 


. Bits[x-1:0] of the translation table base address are treated as if all the bits are zero. The value 
read back from the corresponding register bits is either the value written to the register or 
zero. 

° The result of the calculation of an address for a translation table walk using this register can 


be corrupted in those bits that are nonzero. 


The AArch64 Virtual Memory System Architecture chapter describes how x is calculated based on 
the value of VSTCR_EL2.TOSZ, the stage of translation, and the translation granule size. 


This field resets to an architecturally UNKNOWN value. 


Common not Private, for stage 2 of the Secure EL1&0 translation regime. In an implementation that 
includes ARMv8.2-TTCNP, indicates whether each entry that is pointed to by VSTTBR_EL2 is a 
member of a common set that can be used by every PE in the Inner Shareable domain for which the 
value of VSTTBR_EL2.CnP is 1. 


Qbd The translation table entries pointed to by VSTTBR_EL2 are permitted to differ from 
the entries for VSTTBR_EL2 for other PEs in the Inner Shareable domain. This is not 
affected by the value of the current VMID. 


Qb1 The translation table entries pointed to by VSTTBR_EL2 are the same as the translation 
table entries for every other PE in the Inner Shareable domain for which the value of 
VSTTBR_EL2.CnP is 1 and the VMID is the same as the current VMID. 





Note 

If the value of VSTTBR_EL2.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and 
those VSTTBR_EL2s do not point to the same translation table entries when using the current 
VMID, then the results of translations using VSTTBR_EL2 are CONSTRAINED UNPREDICTABLE, see 
CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values on page K1-6254. 





When this register has an architecturally-defined reset value, this field resets to a value that is 
architecturally UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Accessing the VSTTBR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, VSTTBR_EL2 





op0 op1 


0b11 0b100 


CRn 


0b0010 


CRm 


0b0110 


op2 


0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x030] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsereturn VSTTBR_EL2; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 





else 
return VSTTBR_EL2; 


MSR VSTTBR_EL2, <Xt> 





op0 op1 


0b11 0b100 


CRn 


0b0010 


CRm 


0b0110 


op2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x030] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
else 
VSTTBR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
VSTTBR_EL2 = X[t]; 
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D13.2.137  VTCR_EL2, Virtualization Translation Control Register 
The VTCR_EL2 characteristics are: 


Purpose 


The control register for stage 2 of the EL1&0 translation regime. 


Configurations 


AArch64 System register VTCR_EL2[31:0] is architecturally mapped to AArch32 System register 
VTCR[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
VTCR_EL2 is a 64-bit register. 


Field descriptions 


The VTCR_EL2 bit assignments are: 


63 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18, 161514131211109 8 7 6 5 


RES1 _ i åġ | 
NSA 


NSW 

HWU62 
HWU61 
HWU60 
HWU59 
RESO 

HD 















Any of the bits in VTCR_EL2 are permitted to be cached in a TLB. 


Bits [63:32] 


Reserved, RESO. 


Bit [31] 


Reserved, RES1. 


NSA, bit [30] 
When ARMv8.4-SecEL2 is implemented: 
Non-secure stage 2 translation output address space. 


Qbd All stage 2 translations for the Non-secure IPA space of the Secure EL1&0 translation 
regime access the Secure PA space. 


Qb1 All stage 2 translations for the Non-secure IPA space of the Secure EL1&0 translation 
regime access the Non-secure PA space. 


This bit behaves as 1 for all purposes other than reading back the value of the bit when one of the 
following is true: 


- The PE is executing in Non-secure state. 
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à The value of VTCR_EL2.NSW is 1. 
è The value of VSTCR_EL2.SA is 1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
NSW, bit [29] 
When ARMV8.4-SecEL2 is implemented: 


Non-secure stage 2 translation table address space. 
Qbd All stage 2 translation table walks for the Non-secure IPA space of the Secure EL1&0 
translation regime are to the Secure PA space. 

Qb1 All stage 2 translation table walks for the Non-secure IPA space of the Secure EL1&0 


translation regime are to the Non-secure PA space. 


When the PE is executing in Non-secure state, this bit behaves as 1 for all purposes other than 
reading back the value of the bit. 
This field resets to an architecturally UNKNOWN value. 

Otherwise: 


Reserved, RESO. 
HWU62, bit [28] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 2 
translation table Block or Page entry. 


ObO Bit[62] ofeach stage 2 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 

0b1 Bit[62] of each stage 2 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 

This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 
HWU61, bit [27] 
When ARMV8.2-TTPBHA is implemented: 
Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 2 
translation table Block or Page entry. 
ObO Bit[61] ofeach stage 2 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 
0b1 Bit[61] of each stage 2 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
HWU60, bit [26] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 2 
translation table Block or Page entry. 


ObO Bit[60] ofeach stage 2 translation table Block or Page entry cannot be used by hardware 


for an IMPLEMENTATION DEFINED purpose. 
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Qb1 Bit[60] of each stage 2 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWUSSY, bit [25] 
When ARMVv%8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 2 
translation table Block or Page entry. 


Qbd Bit[59] of each stage 2 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[59] of each stage 2 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
Bits [24:23] 
Reserved, RESO. 
HD, bit [22] 
When ARMV8.1-TTHM is implemented: 


Hardware management of dirty state in stage 2 translations when EL2 is enabled in the current 
Security state. 


Qbd Stage 2 hardware management of dirty state disabled. 


Qb1 Stage 2 hardware management of dirty state enabled, only if the VTCR_EL2.HA bit is 
also set to 1. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
HA, bit [21] 
When ARMV8.1-TTHM is implemented: 


Hardware Access flag update in Non-secure and Secure stage 2 translations when EL2 is enabled in 
the current Security state. 


Obed Stage 2 Access flag update disabled. 
Qb1 Stage 2 Access flag update enabled. 
Otherwise: 


Reserved, RESO. 
Bit [20] 
Reserved, RESO. 
VS, bit [19] 
When ARMv8.1-VMID16 is implemented: 
VMID Size. 


Qbd 8 bit - the upper 8 bits of VTTBR_EL2 and VSTTBR_EL2 are ignored by the hardware, 


and treated as if they are all zeros, for every purpose except when reading back the 
register. 
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Qb1 16 bit - the upper 8 bits of VTTBR_EL2 and VSTTBR_EL2 are used for allocation and 
matching in the TLB. 


If the implementation only supports an 8-bit VMID, this field is RESO. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PS, bits [18:16] 
Physical address Size for the Second Stage of translation. 
0b000 32 bits, 4GB. 
0b001 36 bits, 64GB. 
0b010 40 bits, 1TB. 
0b011 42 bits, 4TB. 
0b100 44 bits, 16TB. 
0b101 48 bits, 256TB. 
0b110 52 bits, 4PB. 
Other values are reserved. 


The reserved values behave in the same way as the 0b101 or 0b110 encoding, but software must not 
rely on this property as the behavior of the reserved values might change in a future revision of the 
architecture. 


The value 0b110 is permitted only if ARMv8.2-LPA is implemented and the translation granule size 
is 64KB. 


In an implementation that supports 52-bit PAs, if the value of this field is not 0b110 or a value treated 
as 0b110, then bits[51:48] of every translation table base address for the stage of translation 
controlled by VTCR_EL2 are 0b0000. 


This field resets to an architecturally UNKNOWN value. 
TGO, bits [15:14] 
Granule size for the VTTBR_EL2. 


0b00 4KB. 
0b01 64KB. 
0b10 16KB. 


Other values are reserved. 

If ARMv8.5-GTG is implemented, ID_AA64MMFR0 _EL1.{TGran4_2, TGran16_2, TGran64_2} 
indicate which granule sizes are supported for Level 2 translation. 

If ARMv8.5-GTG is not implemented, ID AA64MMFRO_EL1.{TGran4, TGran16, TGran64} 
indicate which granule sizes are supported. 


If the value is programmed to either a reserved value, or a size that has not been implemented, then 
the hardware will treat the field as if it has been programmed to an IMPLEMENTATION DEFINED 
choice of the sizes that has been implemented for all purposes other than the value read back from 
this register. 


It is IMPLEMENTATION DEFINED whether the value read back is the value programmed or the value 
that corresponds to the size chosen. 


This field resets to an architecturally UNKNOWN value. 


SHO, bits [13:12] 


Shareability attribute for memory associated with translation table walks using VITTBR_EL2 or 
VSTTBR_EL2. 


b00 Non-shareable. 
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0b10 Outer Shareable. 
Qb11 Inner Shareable. 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7644. 


This field resets to an architecturally UNKNOWN value. 


ORGNO, bits [11:10] 


Outer cacheability attribute for memory associated with translation table walks using VTTBR_EL2 
or VSTTBR_EL2. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IRGNO, bits [9:8] 


Inner cacheability attribute for memory associated with translation table walks using VTTBR_EL2 
or VSTTBR_EL2. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 
SLO, bits [7:6] 
When ARMV8.4-TTST is implemented: 


Starting level of the Secure stage 2 translation lookup, controlled by VTCR_EL2. The meaning of 
this field depends on the value of VTCR_EL2.TGO. 


0b00 If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 2. If VTCR_EL2.TG0 is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 3. 

0b01 If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 1. If VTCR_EL2.TG0 is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 2. 

0b10 If VITCR_EL2.TGO is @b00 (4KB granule), start at level 0. If VTCR_EL2.TGO is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 1. 

Qb11 If VITCR_EL2.TGO is @b00 (4KB granule), start at level 3. 


All other values are reserved. If this field is programmed to a reserved value, or to a value that is not 
consistent with the programming of VTCR_EL2.TOSZ, then a stage 2 level 0 Translation fault is 
generated. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Starting level of the Secure stage 2 translation lookup, controlled by VTCR_EL2. The meaning of 
this field depends on the value of VTCR_EL2.TGO. 


0b00 If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 2. If VTCR_EL2.TG0 is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 3. 

0b01 If VTCR_EL2.TG0 is 0b00 (4KB granule), start at level 1. If VTCR_EL2.TG0 is 0b10 
(16KB granule) or 0b01 (64KB granule), start at level 2. 

0b10 If VICR_EL2.TGO is @b00 (4KB granule), start at level 0. If VTCR_EL2.TGO is 0b10 


(16KB granule) or 0b01 (64KB granule), start at level 1. 
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All other values are reserved. If this field is programmed to a reserved value, or to a value that is not 
consistent with the programming of VTCR_EL2.TOSZ, then a stage 2 level 0 Translation fault is 


generated. 


This field resets to an architecturally UNKNOWN value. 


TOSZ, bits [5:0] 


The size offset of the memory region addressed by VITBR_EL2. The region size is 2(64-T0SZ) bytes. 


The maximum and minimum possible values for TOSZ depend on the level of translation table and 
the memory translation granule size, as described in the AArch64 Virtual Memory System 


Architecture chapter. 


If this field is programmed to a value that is not consistent with the programming of SLO then a stage 


2 level 0 Translation fault is generated. 


This field resets to an architecturally UNKNOWN value. 


Accessing the VTCR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, VTCR_EL2 

















op0 op1 CRn CRm op2 
0b11 0b100 0b0010 0b0001 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x040] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VICR_EL2; 
elsif PSTATE.EL == EL3 then 
return VTICR_EL2; 
MSR VTCR_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0010 0b0001 0b010 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x040] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VTCR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
VTCR_EL2 = X[t]; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.2 General system control registers 


D13.2.138 VTTBR_EL42, Virtualization Translation Table Base Register 
The VITBR_EL2 characteristics are: 


Purpose 


Holds the base address of the translation table for the initial lookup for stage 2 of an address 
translation in the EL1&0 translation regime, and other information for this translation regime. 


Configurations 


AArch64 System register VTTBR_EL2[63:0] is architecturally mapped to AArch32 System 
register VTTBR[63:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
VTTBR_EL2 is a 64-bit register. 


Field descriptions 


The VITBR_EL2 bit assignments are: 


63 56 55 48 47 1 0 
| VMID[15:8] VMID[7:0] | BADDR 
L CnP 


VMID[15:8], bits [63:56] 
When ARMv8.1-VMID16 is implemented: 
Extension to VMID[7:0]. See VMID[7:0] for more details. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


VMID[7:0], bits [55:48] 
The VMID for the translation table. 
It is IMPLEMENTATION DEFINED whether the VMID is 8 bits or 16 bits. 
If the implementation has an 8-bit VMID, then VMID[15:8] are RESO. 
If the implementation has a 16-bit VMID, then: 


. The VTCR_EL2.VS bit selects whether VMID[15:8] are ignored by the hardware for every 
purpose except reading back the register, or whether these bits are used for allocation and 
matching in the TLB. 


- The 16-bit VMID is only supported when EL2 is using AArch64. This means the hardware 
must ignore VMID[15:8] when EL2 is using AArch32. 


This field resets to an architecturally UNKNOWN value. 
BADDR, bits [47:1] 
Translation table base address, A[47:x] or A[51:x], bits[47:1]. 
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Note 


° Translation table base addresses of 52 bits, A[51:x], are supported only in an implementation 
that includes ARMv8.2-LPA and is using the 64KB translation granule. 





s A translation table must be aligned to the size of the table, except that when using a 
translation table base address larger than 48 bits the minimum alignment of a table containing 
fewer than eight entries is 64 bytes. 


In an implementation that includes ARMv8.2-LPA, if the value of VTCR_EL2.PS is 0b110, then: 


° Register bits[47:z] hold bits[47:z] of the stage 1 translation table base address, where z is 
determined as follows: 


—  Ifx>=6 then z=x. 
— Otherwise, z=6. 
è Register bits[5:2] hold bits[51:48] of the stage 1 translation table base address. 


è When z>x register bits[(z-1):x] are RESO, and bits[(z-1):x] of the translation table base 
address are zero. 


è When x>6 register bits[(x-1):6] are RESO. 
` Register bit[1] is RESO. 
$ Bits[5:2] of the stage 1 translation table base address are zero. 


° In an implementation that includes ARMv8.2-TTCNP, bit[0] of the stage 1 translation table 
base address is zero. 





Note 


. In an implementation that includes ARMv8.2-LPA a VTCR_EL2.PS value of 0b110, that 
selects a PA size of 52 bits, is permitted only when using the 64KB translation granule. 


s When the value of ID AA64MMFRO_EL1.PARange indicates that the implementation does 
not support a 52 bit PA size, if a translation table lookup uses this register with the 64KB 
translation granule when the value of VTCR_EL2.PS is 0b110 and the value of register 
bits[5:2] is nonzero, an Address size fault is generated. 


If the Effective value of VTCR_EL2.PS is not 0b110 then: 
è Register bits[47:x] hold bits[47:x] of the stage 1 translation table base address. 
= Register bits[(x-1):1] are RESO. 


$ If the implementation supports 52-bit PAs and IPAs then bits[51:48] of the translation table 
base addresses used in this stage of translation are 0b0000. 





Note 
This definition applies: 
- To an implementation that includes ARMv8.2-LPA and is using a translation granule smaller 
than 64KB. 


° To any implementation that does not include ARMv8.2-LPA. 





If any VITBR_EL2[47:0] bit that is defined as RESO has the value 1 when a translation table walk 
is performed using VTTBR_EL2, then the translation table base address might be misaligned, with 
effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following: 


s Bits[x-1:0] ofthe translation table base address are treated as ifall the bits are zero. The value 
read back from the corresponding register bits is either the value written to the register or 
zero. 

e The result of the calculation of an address for a translation table walk using this register can 


be corrupted in those bits that are nonzero. 


The AArch64 Virtual Memory System Architecture chapter describes how x is calculated based on 
the value of VTCR_EL2.T0SZ, the stage of translation, and the translation granule size. 
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This field resets to an architecturally UNKNOWN value. 


CnP, bit [0] 
When ARMv8.2-TTCNP is implemented: 


Common not Private. This bit indicates whether each entry that is pointed to by VITTBR_EL2 is a 
member of a common set that can be used by every PE in the Inner Shareable domain for which the 
value of VTTBR_EL2.CnP is 1. 


Qbd The translation table entries pointed to by VITBR_EL2 are permitted to differ from the 
entries for VTTBR_EL2 for other PEs in the Inner Shareable domain. This is not 
affected by the value of the current VMID. 


Qb1 The translation table entries pointed to by VITTBR_EL2 are the same as the translation 
table entries for every other PE in the Inner Shareable domain for which the value of 
VTTBR_EL2.CnP is 1 and the VMID is the same as the current VMID. 


This field is permitted to be cached in a TLB. 


Note 


If the value of VTTBR_EL2.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and 
those VITTBR_EL2s do not point to the same translation table entries when using the current VMID 
then the results of translations using VTTBR_EL2 are CONSTRAINED UNPREDICTABLE, see 
CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values on 

page K1-7630. 








This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Accessing the VITBR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, VITBR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0010 0b0001 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x020] ; 


elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
return VTTBR_EL2; 

elsif PSTATE.EL == EL3 then 
return VTTBR_EL2; 
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MSR VTTBR_EL2, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b100 0b0010 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x20] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VTTBR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
VTTBR_EL2 = X[t]; 
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D13.3 Debug registers 
This section lists the Debug System registers in AArch64 state, in alphabetic order: 
è The principal encoding space for debug registers is op0==0b10, op1== {0, 3, 4}. Instructions for accessing 


debug System registers on page D12-2801 summarizes the registers in this encoding space and lists them in 
order of their encodings. 


. In addition, the following registers in the op0==0b11 encoding space are classified as Debug registers: 
— DLR ELO. 
—  DSPSR_ELO. 
—  MDCR EL2. 
—  MDCR EL3. 
— SDER32_EL3. 
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D13.3.1 


D13-3430 


DBGAUTHSTATUS_EL1, Debug Authentication Status register 
The DBGAUTHSTATUS_ELI characteristics are: 


Purpose 


Provides information about the state of the IMPLEMENTATION DEFINED authentication interface for 
debug. 


Configurations 


AArch64 System register DBGAUTHSTATUS_EL1[31:0] is architecturally mapped to AArch32 
System register DBGAUTHSTATUS[31:0]. 


AArch64 System register DBGAUTHSTATUS_EL1[31:0] is architecturally mapped to External 
register DBGAUTHSTATUS _EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DBGAUTHSTATUS EL! is a 64-bit register. 


Field descriptions 


The DBGAUTHSTATUS_EL1 bit assignments are: 


63 876543210 


RESO SNID js] NSID 


io NSNID 





Bits [63:8] 


Reserved, RESO. 


SNID, bits [7:6] 
When ARMV8.4-Debug is implemented: 
Secure non-invasive debug. 
This field has the same value as DBGAUTHSTATUS _EL1.SID. 
Otherwise: 


Secure non-invasive debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 1. 
0b10 Implemented and disabled. ExternalSecureNoninvasiveDebugEnabled() == FALSE. 
0b11 Implemented and enabled. ExternalSecureNoninvasiveDebugEnabled() == TRUE. 


All other values are reserved. 


SID, bits [5:4] 


Secure invasive debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 1. 
0b10 Implemented and disabled. ExternalSecureInvasiveDebugEnabled() == FALSE. 
Qb11 Implemented and enabled. ExternalSecureInvasiveDebugEnabled() == TRUE. 


All other values are reserved. 
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NSNID, bits [3:2] 
When ARMV8.4-Debug is implemented: 
Non-secure non-invasive debug. 
0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 0 
Qb11 Implemented and enabled. EL3 is implemented or the Effective value of SCR_EL3.NS 
is 1. 
All other values are reserved. 
Otherwise: 
Non-secure non-invasive debug. 
0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 0. 
0b10 Implemented and disabled. ExternalNoninvasiveDebugEnabled() == FALSE. 
Qb11 Implemented and enabled. ExternalNoninvasiveDebugEnabled() == TRUE. 
All other values are reserved. 
NSID, bits [1:0] 
Non-secure invasive debug. 
0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 0. 
0b10 Implemented and disabled. ExternalInvasiveDebugEnabled() == FALSE. 
0b11 Implemented and enabled. ExternalInvasiveDebugEnabled() == TRUE. 


All other values are reserved. 


Accessing the DBGAUTHSTATUS_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DBGAUTHSTATUS_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0111 0b1110 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGAUTHSTATUS_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGAUTHSTATUS_EL1; 
elsif PSTATE.EL == EL3 then 
return DBGAUTHSTATUS_EL1; 
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D13.3.2 DBGBCR<n>_EL1, Debug Breakpoint Control Registers, n = 0 - 15 


The DBGBCR<n>_EL1 characteristics are: 


Purpose 


Holds control information for a breakpoint. Forms breakpoint n together with value register 
DBGBVR<n>_EL1. 


Configurations 


AArch64 System register DBGBCR<n>_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGBCR<n>[31:0]. 


AArch64 System register DBGBCR<n>_EL1[31:0] is architecturally mapped to External register 
DBGBCR<n>_EL1[31:0]. 


If breakpoint n is not implemented then accesses to this register are UNDEFINED. 


This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 


Attributes 


DBGBCR<n>_EL] is a 64-bit register. 


Field descriptions 


The DBGBCR<n>_EL] bit assignments are: 


24 23 20 19 16 15 14 13 12 5 43 2 1 R 


i RESO LBN sso] | RESO ele Le BAS Ze 


Bits [63:24] 


SS 
HMC 


Reserved, RESO. 


BT, bits [23:20] 


Breakpoint Type. Possible values are: 


0b0000 Unlinked instruction address match. DBGBVR<n>_EL] is the address of an 
instruction. 

0b0001 As 0b0000, but linked to a Context matching breakpoint. 

0b0010 Unlinked Context ID match. When ARMv8.1-VHE is implemented, EL2 is using 
AArché4, and the Effective value of HCR_EL2.E2H is 1, if either the PE is executing 
at ELO with HCR_EL2.TGE set to 1 or the PE is executing at EL2, then 
DBGBVR<n>_EL1.ContextID must match the CONTEXTIDR_EL2 value. Otherwise, 
DBGBVR<n>_EL1.ContextID must match the CONTEXTIDR_EL1 value 

0b0011 As 0b0010, with linking enabled. 

0b0110 Unlinked CONTEXTIDR_EL1 match. DBGBVR<n>_EL1.ContextID is a Context ID 
compared against CONTEXTIDR ELI. 

0b0111 As 0b0110, with linking enabled. 

0b1000 Unlinked VMID match. DBGBVR<n>_EL1.VMID is a VMID compared against 
VTTBR_EL2.VMID. 

0b1001 As 0b1000, with linking enabled. 

D13-3432 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.3 Debug registers 


0b1010 Unlinked VMID and Context ID match. DBGBVR<n>_EL1.ContextID is a Context ID 
compared against CONTEXTIDR_EL1, and DBGBVR<n>_EL1.VMID is a VMID 
compared against VITTBR_EL2.VMID. 


0b1011 As 0b1010, with linking enabled. 


0b1100 Unlinked CONTEXTIDR_EL2 match. DBGBVR<n>_EL1.ContextID2 is a Context ID 
compared against CONTEXTIDR_EL2. 


0b1101 As 0b1100, with linking enabled. 


0b1110 Unlinked Full Context ID match. DBGBVR<n>_EL1.ContextID is compared against 
CONTEXTIDR_ ELI, and DBGBVR<n>_EL1.ContextID2 is compared against 
CONTEXTIDR_ EL2. 


Qb1111 As 0b1110, with linking enabled. 


All other values are reserved. Constraints on breakpoint programming mean other values are 
reserved under some conditions. 


For more information on the operation of the SSC, HMC, and PMC fields, and on the effect of 
programming this field to a reserved value, see Execution conditions for which a breakpoint 
generates Breakpoint exceptions on page D2-2422 and Reserved DBGBCR<n>_EL1.BT values on 
page D2-2427. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


LBN, bits [19:16] 


Linked breakpoint number. For Linked address matching breakpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


For all other breakpoint types this field is ignored and reads of the register return an UNKNOWN 
value. 


This field is ignored when the value of DBGBCR<n>_EL1.E is 0. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


SSC, bits [15:14] 


HMC, bit [13] 


Bits [12:9] 


BAS, bits [8:5] 


Security state control. Determines the Security states under which a Breakpoint debug event for 
breakpoint n is generated. This field must be interpreted along with the HMC and PMC fields, and 
there are constraints on the permitted values of the {HMC, SSC, PMC} fields. 


For more information on the operation of the SSC, HMC, and PMC fields, and the effect of 
programming the fields to a reserved set of values, see Execution conditions for which a breakpoint 
generates Breakpoint exceptions on page D2-2422 and Reserved DBGBCR<n>_EL1.{SSC, HMC, 
PMC} values on page D2-2427. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Higher mode control. Determines the debug perspective for deciding when a Breakpoint debug 
event for breakpoint n is generated. This field must be interpreted along with the SSC and PMC 
fields, and there are constraints on the permitted values of the {HMC, SSC, PMC} fields. For more 
information see the SSC, bits [15:14] description. 


For more information on the operation of the SSC, HMC, and PMC fields, see Execution conditions 


for which a breakpoint generates Breakpoint exceptions on page D2-2422. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Byte address select. Defines which half-words an address-matching breakpoint matches, regardless 
of the instruction set and Execution state. In an AArch64 only implementation, this field is reserved, 
RES1. 
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The permitted values depend on the breakpoint type. 
For Address match breakpoints, the permitted values are: 
BAS Match instruction at Constraint for debuggers 
0b0011 DBGBVR<n>_EL1 Use for T32 instructions 
0b1100 =DBGBVR<n>_EL1+2 Use for T32 instructions 
0b1111 DBGBVR<n>_EL1 Use for A64 and A32 instructions 
All other values are reserved. For more information, see Reserved DBGBCR<n>_EL1.BAS values 
on page D2-2428. 
For more information on using the BAS field in address match breakpoints, see Using the BAS field 
in Address Match breakpoints on page G2-5641. 
For Context matching breakpoints, this field is RES] and ignored. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Bits [4:3] 


Reserved, RESO. 


PMC, bits [2:1] 


Privilege mode control. Determines the Exception level or levels at which a Breakpoint debug event 
for breakpoint n is generated. This field must be interpreted along with the SSC and HMC fields, 
and there are constraints on the permitted values of the {HMC, SSC, PMC} fields. For more 
information see the DBGBCR<n>_EL1.SSC description. 


For more information on the operation of the SSC, HMC, and PMC fields, see Execution conditions 
for which a breakpoint generates Breakpoint exceptions on page D2-2422. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


E, bit [0] 
Enable breakpoint DBGBVR<n>_ELI. Possible values are: 
0bd Breakpoint disabled. 
Qb1 Breakpoint enabled. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGBCR<n>_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DBGBCR<n>_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0000 n[3:0] 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.0SLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
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else 
return DBGBCR_EL1[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 





return DBGBCR_EL1[UInt(CRm<3:0>) ]; 
elsif PSTATE.EL == EL3 then 
if !ELUsingAArch32(EL1) && OSLSR_EL1.0SLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBCR_EL1[UInt(CRm<3:0>)]; 


MSR DBGBCR<n>_EL1, <Xt> 


op0 op1 CRn CRm op2 





0b10 0b000 0b0000 n[3:0] 0b101 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGBCR_EL1[UInt(CRm<3:0@>)] = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 








DBGBCR_EL1[UInt(CRm<3:0>)] = X[t]; 
elsif PSTATE.EL == EL3 then 
if !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGBCR_EL1[UInt(CRm<3:0@>)] = X[t]; 
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DBGBVR<n>_EL1, Debug Breakpoint Value Registers, n = 0 - 15 


The DBGBVR<n>_EL1 characteristics are: 


Purpose 


Holds a virtual address, or a VMID and/or a context ID, for use in breakpoint matching. Forms 
breakpoint n together with control register DBGBCR<n>_EL1. 


Configurations 


Attributes 


AArch64 System register DBGBVR<n>_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGBVR<n>[31:0]. 


If the breakpoint is context-aware and EL2 is implemented then AArch64 System register 
DBGBVR<n>_EL1[63:32] is architecturally mapped to AArch32 System register 
DBGBXVR<n>[31:0]. Otherwise there is no System register access to DBGBVR<n>_EL1[63:32] 
from AArch32 state. 


AArch64 System register DBGBVR<n>_EL1[63:0] is architecturally mapped to External register 
DBGBVR<n>_EL1[63:0]. 


If breakpoint n is not implemented then accesses to this register are UNDEFINED. 


This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 


How this register is interpreted depends on the value of DBGBCR<n>_EL1.BT. 

° When DBGBCR<n>_EL1.BT is 0b000x, this register holds a virtual address. 

° When DBGBCR<n>_EL1.BT is 0b001x, 0b011x, or 0b110x, this register holds a Context ID. 
è When DBGBCR<n>_EL1.BT is 0b100x, this register holds a VMID. 

` When DBGBCR<n>_EL1.BT is 0b101x, this register holds a VMID and a Context ID. 

s When DBGBCR<n>_EL1.BT is 0b111x, this register holds two Context ID values. 

For other values of DBGBCR<n>_EL1.BT, this register is RESO. 


Field descriptions 


The DBGBVR<n>_EL]1 bit assignments are: 


When DBGBCR<n>_EL1.BT == 0b000x: 


63 


RESS[14:4] 


53 52 49 48 2 1 0 





RESS[14:4], bits [63:53] 


Reserved, Sign extended. Software must treat this field as RESO if the most significant bit of VA is 
0 or RESO, and as RES1 if the most significant bit of VA is 1. 


It is IMPLEMENTATION DEFINED whether: 

: Reads return the value of the most significant bit of the VA for every bit in this field. 
$ Reads return the last value written. 

The PE ignores this field. 
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VA[52:49], bits [52:49] 
When ARMv%8.2-LVA is implemented: 
Extension to VA[48:2]. See VA[48:2] for more details. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 
Extension to RESS[14:4]. See RESS[14:4] for more details. 
VA[48:2], bits [48:2] 
Bits[48:2] of the address value for comparison. 


When ARMv8.2-LVA is implemented, VA[52:49] forms the upper part of the address value. 
Otherwise, VA[52:49] are RESS. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Bits [1:0] 


Reserved, RESO. 


When DBGBCR<n>_EL1.BT == 0b001x: 


63 32 31 0 


RESO ContextID 


Bits [63:32] 
Reserved, RESO. 
ContextID, bits [31:0] 
Context ID value for comparison. 


The value is compared against CONTEXTIDR_EL2 when ARMv8.1-VHE is implemented, 
HCR_EL2.E2H is 1, and either: 


è The PE is executing at EL2. 


s HCR_EL2.TGE is 1, the PE is executing at ELO, and EL2 is enabled in the current Security 
state. 


Otherwise, the value is compared against CONTEXTIDR_ ELI. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When DBGBCR<n>_EL1.BT == 0b011x: 


63 32 31 0 


RESO ContextID 


Bits [63:32] 
Reserved, RESO. 
ContextID, bits [31:0] 
Context ID value for comparison against CONTEXTIDR_EL1. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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When DBGBCR<n>_EL1.BT == 0b100x and HaveEL(EL2): 


48 47 40 39 32 31 


i RESO VMID[15:8] VMID[7:0] RESO 


Bits [63:48] 


Reserved, RESO. 


VMID[15:8], bits [47:40] 
When ARMv8.1-VMID16 is implemented: 
Extension to VMID[7:0]. See VMID[7:0] for more details. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


VMID[7:0], bits [39:32] 
VMID value for comparison. 
The VMID is 8 bits in the following cases. 
s EL2 is using AArch32. 
° ARMv8.1-VMID16 is not implemented. 


When ARMv8.1-VMID16 is implemented and EL2 is using AArch64, it is IMPLEMENTATION 
DEFINED whether the VMID is 8 bits or 16 bits. 


VMID[15:8] is RESO if any of the following applies: 

à The implementation has an 8-bit VMID. 

è VTCR_EL2.VS has a value of 0. 

EL2 is using AArch32. 

On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Bits [31:0] 


Reserved, RESO. 


When DBGBCR<n>_EL1.BT == 0b101x and HaveEL(EL2): 


63 48 47 40 39 32 31 


RESO | VMID[15:8] | VMID[7:0] | ContextID 


Bits [63:48] 


Reserved, RESO. 


VMID/[15:8], bits [47:40] 
When ARMv8.1-VMID16 is implemented: 
Extension to VMID[7:0]. See VMID[7:0] for more details. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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VMID[7:0], bits [39:32] 
VMID value for comparison. 
The VMID is 8 bits in the following cases. 
$ EL2 is using AArch32. 
° ARMv8.1-VMID16 is not implemented. 


When ARMv8.1-VMID16 is implemented and EL2 is using AArch64, it is IMPLEMENTATION 
DEFINED whether the VMID is 8 bits or 16 bits. 


VMID[15:8] is RESO if any of the following applies: 
s The implementation has an 8-bit VMID. 

` VTCR_EL2.VS has a value of 0. 

a EL2 is using AArch32. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
ContextID, bits [31:0] 
Context ID value for comparison against CONTEXTIDR_EL1. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When DBGBCR<n>_EL1.BT == 0b110x and HaveEL(EL2): 


63 32 31 0 


ContextID2 RESO 


ContextID2, bits [63:32] 
When ARMv8.1-VHE is implemented: 
Context ID value for comparison against CONTEXTIDR_EL2. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [31:0] 


Reserved, RESO. 


When DBGBCR<n>_EL1.BT == 06111x, HaveEL(EL2) and ARMv8.1-VHE is implemented: 


63 32 31 0 


ContextID2 ContextID 


ContextID2, bits [63:32] 
When ARMv%8.1-VHE is implemented: 
Context ID value for comparison against CONTEXTIDR_EL2. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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ContextID, bits [31:0] 
Context ID value for comparison against CONTEXTIDR_EL1. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGBVR<n>_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DBGBVR<n>_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0000 n[3:0] 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBVR_EL1[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 








return DBGBVR_EL1[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL3 then 
if !ELUsingAArch32(EL1) && OSLSR_EL1.0SLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBVR_EL1[UInt(CRm<3:0>)]; 


MSR DBGBVR<n>_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b10 0b000 0b0000 n[3:0] 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@Q@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGBVR_EL1[UInt(CRm<3:0@>)] = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.0SLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
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DBGBVR_EL1[UInt(CRm<3:0@>)] = X[t]; 
elsif PSTATE.EL == EL3 then 
if !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGBVR_EL1[UInt(CRm<3:@>)] = X[t]; 
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D13.3.4 DBGCLAIMCLR_EL1, Debug Claim Tag Clear register 
The DBGCLAIMCLR_ EL! characteristics are: 
Purpose 


Used by software to read the values of the CLAIM tag bits, and to clear these bits to 0. 
The architecture does not define any functionality for the CLAIM tag bits. 


Note 
CLAIM tags are typically used for communication between the debugger and target software. 





Used in conjunction with the DBGCLAIMSET ELI register. 


Configurations 


AArch64 System register DBGCLAIMCLR_EL1[31:0] is architecturally mapped to AArch32 
System register DBGCLAIMCLR[31:0]. 


AArch64 System register DBGCLAIMCLR_EL1[31:0] is architecturally mapped to External 
register DBGCLAIMCLR_EL1[31:0]. 


An implementation must include 8 CLAIM tag bits. 


This register is in the Cold reset domain. See the CLAIM field description for the effect of a Cold 
reset on the value returned by this register. This register is not affected by a Warm reset. 


Attributes 
DBGCLAIMCLR_ EL] is a 64-bit register. 


Field descriptions 


The DBGCLAIMCLR _ ELI! bit assignments are: 


63 32 31 


8 7 0 
RESO RAZ/SBZ | CLAIM 


Bits [63:32] 
Reserved, RESO. 


Bits [31:8] 


Reserved, RAZ/SBZ. Software can rely on these bits reading as zero, and must use a should-be-zero 
policy on writes. Implementations must ignore writes. 


CLAIM, bits [7:0] 
Read or clear CLAIM tag bits. Reading this field returns the current value of the CLAIM tag bits. 


Writing a | to one of these bits clears the corresponding CLAIM tag bit to 0. This is an indirect write 
to the CLAIM tag bits. A single write operation can clear multiple CLAIM tag bits to 0. 


Writing 0 to one of these bits has no effect. 


On a Cold reset, this field resets to 0. 


Accessing the DBGCLAIMCLR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, DBGCLAIMCLR_EL1 


D13.3 Debug registers 





op0 op1 CRn CRm 


0b10 0b000 0b0111 0b1001 


op2 


0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGCLAIMCLR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGCLAIMCLR_EL1; 
elsif PSTATE.EL == EL3 then 
return DBGCLAIMCLR_EL1; 


MSR DBGCLAIMCLR_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b10 0b000 0b0111 0b1001 


0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGCLAIMCLR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGCLAIMCLR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
DBGCLAIMCLR_EL1 = X[t]; 
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D13.3.5 DBGCLAIMSET_EL1, Debug Claim Tag Set register 
The DBGCLAIMSET_EL1 characteristics are: 
Purpose 


Used by software to set the CLAIM tag bits to 1. 
The architecture does not define any functionality for the CLAIM tag bits. 


Note 
CLAIM tags are typically used for communication between the debugger and target software. 





Used in conjunction with the DBGCLAIMCLR_ ELI register. 


Configurations 


AArch64 System register DBGCLAIMSET_EL1[31:0] is architecturally mapped to AArch32 
System register DBGCLAIMSET[31:0]. 


AArch64 System register DBGCLAIMSET_EL1[31:0] is architecturally mapped to External 
register DBGCLAIMSET _EL1[31:0]. 


An implementation must include 8 CLAIM tag bits. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DBGCLAIMSET EL] is a 64-bit register. 


Field descriptions 


The DBGCLAIMSET EL] bit assignments are: 


32 31 


63 8 7 0 
| RESO RAZ/SBZ | CLAIM 


Bits [63:32] 
Reserved, RESO. 
Bits [31:8] 


Reserved, RAZ/SBZ. Software can rely on these bits reading as zero, and must use a should-be-zero 
policy on writes. Implementations must ignore writes. 


CLAIM, bits [7:0] 
Set CLAIM tag bits. RAO. 


Writing a 1 to one of these bits sets the corresponding CLAIM tag bit to 1. This is an indirect write 
to the CLAIM tag bits. A single write operation can set multiple CLAIM tag bits to 1. 


Writing 0 to one of these bits has no effect. 


Accessing the DBGCLAIMSET_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, DBGCLAIMSET_EL1 


D13.3 Debug registers 





op0 op1 CRn CRm 


0b10 0b000 0b0111 0b1000 


op2 


0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGCLAIMSET_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGCLAIMSET_EL1; 
elsif PSTATE.EL == EL3 then 
return DBGCLAIMSET_EL1; 


MSR DBGCLAIMSET_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b10 0b000 0b0111 0b1000 


0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGCLAIMSET_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGCLAIMSET_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
DBGCLAIMSET_EL1 = X[t]; 
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D13.3.6 DBGDTR_ELO, Debug Data Transfer Register, half-duplex 
The DBGDTR_ELO characteristics are: 


Purpose 
Transfers 64 bits of data between the PE and an external debugger. Can transfer both ways using 
only a single register. 

Configurations 


AArch64 System register DBGDTR_EL0[63:32] is architecturally mapped to AArch32 System 
register DBGDTRRXint[3 1:0] when written. 


AArch64 System register DBGDTR_EL0[63:32] is architecturally mapped to External register 
DBGDTRRX_ELO[31:0] when written. 


AArch64 System register DBGDTR_EL0[63:32] is architecturally mapped to AArch64 System 
register DBGDTRRX_ELO[31:0] when written. 


AArch6é4 System register DBGDTR_ELO0[31:0] is architecturally mapped to AArch32 System 
register DBGDTRT Xint[3 1:0] when written. 


AArch64 System register DBGDTR_EL0[31:0] is architecturally mapped to External register 
DBGDTRTX_ELO0[31:0] when written. 


AArch64 System register DBGDTR_ELO0[31:0] is architecturally mapped to AArch64 System 
register DBGDTRTX_ELO0[31:0] when written. 


AArch64 System register DBGDTR_EL0[63:32] is architecturally mapped to AArch32 System 
register DBGDTRTXint[31:0] when read. 


AArch64 System register DBGDTR_EL0[63:32] is architecturally mapped to External register 
DBGDTRTX_ELO[31:0] when read. 


AArch64 System register DBGDTR_EL0[63:32] is architecturally mapped to AArch64 System 
register DBGDTRTX_ELO0[31:0] when read. 


AArch64 System register DBGDTR_EL0[31:0] is architecturally mapped to AArch32 System 
register DBGDTRRXint[3 1:0] when read. 


AArch64 System register DBGDTR_EL0[31:0] is architecturally mapped to External register 
DBGDTRRX_ELO[31:0] when read. 


AArch6é4 System register DBGDTR_EL0[31:0] is architecturally mapped to AArch64 System 
register DBGDTRRX_ELO[31:0] when read. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DBGDTR_ELO is a 64-bit register. 


Field descriptions 


The DBGDTR_ELO bit assignments are: 


63 32 31 0 


HighWord LowWord 


HighWord, bits [63:32] 
Writes to this register set DTRRX to the value in this field and do not change RXfull. 
Reads of this register: 
. If RXfull is set to 1, return the last value written to DTRTX. 
° If RXfull is set to 0, return an UNKNOWN value. 
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After the read, RXfull is cleared to 0. 


LowWord, bits [31:0] 
Writes to this register set DTRTX to the value in this field and set TXfull to 1. 


Reads of this register: 

. If RXfull is set to 1, return the last value written to DTRRX. 
° If RXfull is set to 0, return an UNKNOWN value. 

After the read, RXfull is cleared to 0. 


Accessing the DBGDTR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DBGDTR_ELO 





op0 op1 CRn CRm op2 





0b10 0b011 0b0000 0b0100 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDA> != 'Q0') then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGDTR_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGDTR_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGDTR_ELO; 
elsif PSTATE.EL == EL3 then 
return DBGDTR_ELO; 


MSR DBGDTR_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b10 0b011 0b0000 0b0100 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDA> != 'Q0') then 
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AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGDTR_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGDTR_EL®@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGDTR_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
DBGDTR_ELO = X[t]; 
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D13.3.7 DBGDTRRX_ELO, Debug Data Transfer Register, Receive 
The DBGDTRRX_ELO characteristics are: 


Purpose 


Transfers data from an external debugger to the PE. For example, it is used by a debugger 
transferring commands and data to a debug target. See DBGDTR_ELO for additional architectural 
mappings. It is a component of the Debug Communications Channel. 

Configurations 


AArch64 System register DBGDTRRX_ELO[31:0] is architecturally mapped to AArch32 System 
register DBGDTRRXint[3 1:0]. 


AArch64 System register DBGDTRRX_ELO[31:0] is architecturally mapped to External register 
DBGDTRRX_ELO[31:0]. 


This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 


Attributes 
DBGDTRRX_ELO is a 64-bit register. 


Field descriptions 


The DBGDTRRX_ELO bit assignments are: 


63 32 31 0 


RESO Update DTRRX 


Bits [63:32] 


Reserved, RESO. 


Bits [31:0] 
Update DTRRX. 
Reads of this register: 
° If RXfull is set to 1, return the last value written to DTRRX. 
. If RXfull is set to 0, return an UNKNOWN value. 
After the read, RXfull is cleared to 0. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGDTRRX_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, DBGDTRRX_ELO 





op0 op1 CRn CRm 


0b10 0b011 0b0000 0b0101 


op2 


0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE, TDA> 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGDTRRX_ELO; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 


else 
return DBGDTRRX_ELQ; 


elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGDTRRX_ELQ; 
elsif PSTATE.EL == EL3 then 
return DBGDTRRX_ELO; 


'00') then 
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D13.3.8 DBGDTRTX_ELO, Debug Data Transfer Register, Transmit 
The DBGDTRTX_ELO characteristics are: 


Purpose 


Transfers data from the PE to an external debugger. For example, it is used by a debug target to 
transfer data to the debugger. See DBGDTR_ELO for additional architectural mappings. It is a 
component of the Debug Communication Channel. 

Configurations 


AArch6é4 System register DBGDTRTX_ELO[31:0] is architecturally mapped to AArch32 System 
register DBGDTRT Xint[31:0]. 


AArch64 System register DBGDTRTX_ELO0[31:0] is architecturally mapped to External register 
DBGDTRTX_EL0[31:0]. 


This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 


Attributes 
DBGDTRTX_ELO is a 64-bit register. 


Field descriptions 


The DBGDTRTX_ELO bit assignments are: 


63 32 31 0 


RESO Return DTRTX 


Bits [63:32] 


Reserved, RESO. 


Bits [31:0] 
Return DTRTX. 
Writes to this register: 
° If TXfull is set to 1, set DTRRX and DTRTX to UNKNOWN. 
s If TXfull is set to 0, update the value in DTRTX. 
After the write, TXfull is set to 1. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGDTRTX_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MSR DBGDTRTX_ELO, <Xt> 





op0 op1 CRn CRm 


0b10 0b011 0b0000 0b0101 


op2 


0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE, TDA> 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGDTRTX_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGDTRTX_EL@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGDTRTX_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
DBGDTRTX_EL@ = X[t]; 


'00') then 
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D13.3.9 DBGPRCR_EL1, Debug Power Control Register 


The DBGPRCR_ELI characteristics are: 


Purpose 


Controls behavior of the PE on powerdown request. 


Configurations 


Attributes 


AArch64 System register DBGPRCR_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGPRCR[31:0]. 


Bit [0] of this register is mapped to EDPRCR.CORENPDRQ, bit [0] of the external view of this 
register. 


The other bits in these registers are not mapped to each other. 


This register is in the Cold reset domain. Some or all RW fields of this register have defined reset 
values. On a Cold reset these apply only if the PE resets into an Exception level that is using 
AArch64. Otherwise, on a Cold reset RW fields in this register reset to architecturally UNKNOWN 
values. The register is not affected by a Warm reset. 


DBGPRCR_EL1 is a 64-bit register. 


Field descriptions 


The DBGPRCR_ ELI bit assignments are: 


63 


Bits [63:1] 


RESO 


| CORENPDRQ 


Reserved, RESO. 


CORENPDRQ, bit [0] 


ARM DDI 0487E.a 
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Core no powerdown request. Requests emulation of powerdown. 


This request is typically passed to an external power controller. This means that whether a request 
causes power up is dependent on the IMPLEMENTATION DEFINED nature of the system. The power 
controller must not allow the Core power domain to switch off while this bit is 1. 


Qbd If the system responds to a powerdown request, it powers down Core power domain. 


Qb1 If the system responds to a powerdown request, it does not powerdown the Core power 
domain, but instead emulates a powerdown of that domain. 


In an implementation that includes the recommended external debug interface, this bit drives the 
DBGNOPWRDWN signal. 


It is IMPLEMENTATION DEFINED whether this bit is reset to the value of EDPRCR.COREPURQ on 
exit from an IMPLEMENTATION DEFINED software-visible retention state. For more information 
about retention states see Core power domain power states on page H6-6808. 





Note 

Writes to this bit are not prohibited by the IMPLEMENTATION DEFINED authentication interface. This 
means that a debugger can request emulation of powerdown regardless of whether invasive debug 
is permitted. 
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On a Cold reset, this field resets to the value in EDPRCR.COREPURQ. 


Accessing the DBGPRCR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DBGPRCR_EL1 

















op0 op1 CRn CRm op2 
0b10 0b000 0b0001 0b0100 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != 'Q@Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGPRCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGPRCR_EL1; 
elsif PSTATE.EL == EL3 then 
return DBGPRCR_EL1; 
MSR DBGPRCR_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b10 0b000 0b0001 0b0100 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != 'Q@Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGPRCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGPRCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
DBGPRCR_EL1 = X[t]; 
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The DBGVCR32_EL2 characteristics are: 
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Allows access to the AArch32 register DBGVCR from AArch64 state only. Its value has no effect 


AArch6é4 System register DBGVCR32_EL2[31:0] is architecturally mapped to AArch32 System 


If EL1 does not support AArch32, this register is UNDEFINED. 


If EL2 is not implemented but EL3 is implemented, and EL! is capable of using AArch32, then this 


This register has no effect if EL2 is not enabled in the current Security state. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 


Purpose 

on execution in AArch64 state. 
Configurations 

register DBGVCR[31:0]. 

register is not RESO. 

to architecturally UNKNOWN values. 
Attributes 


DBGVCR32_EL2 is a 64-bit register. 


Field descriptions 


The DBGVCR32_EL2 bit assignments are: 


When HaveEL(EL3) and !ELUsingAArch32(EL3): 


63 22 


32 31 30 29 28 27 26 25 24 








RESO 














22 
RESO 




















NSF 





NSI 





RESO 





NSD 





NSP 


22 








Bits [63:32] 


Reserved, RESO. 


NSF, bit [31] 





FIQ vector catch enable in Non-secure state. 


The exception vector 


offset is @x1C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


NSI, bit [30] 


IRQ vector catch enable in Non-secure state. 


The exception vector 


offset is 0x18. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Bit [29] 


Reserved, RESO. 


NSD, bit [28] 


Data Abort vector catch enable in Non-secure state. 


The exception vector offset is 0x10. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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NSP, bit [27] 


NSS, bit [26] 


NSU, bit [25] 


Bits [24:8] 


SF, bit [7] 


SI, bit [6] 


Bit [5] 


SD, bit [4] 


SP, bit [3] 


SS, bit [2] 


SU, bit [1] 


Prefetch Abort vector catch enable in Non-secure state. 
The exception vector offset is @x@C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Supervisor Call (SVC) vector catch enable in Non-secure state. 
The exception vector offset is 0x08. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Undefined Instruction vector catch enable in Non-secure state. 
The exception vector offset is 0x04. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


FIQ vector catch enable in Secure state. 
The exception vector offset is @x1C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


IRQ vector catch enable in Secure state. 
The exception vector offset is 0x18. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Data Abort vector catch enable in Secure state. 
The exception vector offset is 0x10. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Prefetch Abort vector catch enable in Secure state. 
The exception vector offset is 0x0C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Supervisor Call (SVC) vector catch enable in Secure state. 
The exception vector offset is 0x08. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Undefined Instruction vector catch enable in Secure state. 
The exception vector offset is 0x04. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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Bit [0] 
Reserved, RESO. 
When !HaveEL(EL3): 
63 22 876543 210 
RESO Fil D|P|S|U 
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Bits [63:8] 

Reserved, RESO. 
F, bit [7] 

FIQ vector catch enable. 

The exception vector offset is @x1C. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
I, bit [6] 

IRQ vector catch enable. 

The exception vector offset is 0x18. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bit [5] 

Reserved, RESO. 
D, bit [4] 

Data Abort vector catch enable. 

The exception vector offset is 0x10. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
P, bit [3] 

Prefetch Abort vector catch enable. 

The exception vector offset 0x@C. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
S, bit [2] 

Supervisor Call (SVC) vector catch enable. 

The exception vector offset is 0x08. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
U, bit [1] 

Undefined Instruction vector catch enable. 

The exception vector offset is 0x04. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bit [0] 


Reserved, RESO. 


Accessing the DBGVCR32_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, DBGVCR32_EL2 











op0 op1 CRn CRm op2 
0b10 0b100 0b0000 0b0111 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return DBGVCR32_EL2; 
elsif PSTATE.EL == EL3 then 
return DBGVCR32_EL2; 
MSR DBGVCR32_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b10 0b100 0b0000 0b0111 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
DBGVCR32_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
DBGVCR32_EL2 = X[t]; 
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D13.3.11 DBGWCR<n>_EL1, Debug Watchpoint Control Registers, n = 0 - 15 
The DBGWCR<n>_EL1 characteristics are: 


Purpose 
Holds control information for a watchpoint. Forms watchpoint n together with value register 
DBGWVR<n>_EL1. 

Configurations 


AArch6é4 System register DBGWCR<n>_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGWCR<n>[3 1:0]. 


AArch64 System register DBGWCR<n>_EL1[31:0] is architecturally mapped to External register 
DBGWCR<n>_EL1[31:0]. 


If watchpoint n is not implemented then accesses to this register are UNDEFINED. 
This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 
Attributes 
DBGWCR<n>_EL1 is a 64-bit register. 


Field descriptions 


The DBGWCR<n>_EL1 bit assignments are: 


29 28 24 23 ., 21 20 19 16 15 14 13 12 5 43 2 1 R 


i RESO MASK eso LBN [sse] | es 
a H a 


Bits [63:29] 


Reserved, RESO. 


MASK, bits [28:24] 
Address mask. Only objects up to 2GB can be watched using a single mask. 
0b00000 No mask. 
0b00001 Reserved. 
0b00010 Reserved. 
If programmed with a reserved value, a watchpoint must behave as if either: 


à MASK has been programmed with a defined value, which might be 0 (no mask), other than 
for a direct read of DBGWCRn_EL1. 


° The watchpoint is disabled. 


Software must not rely on this property because the behavior of reserved values might change in a 
future revision of the architecture. 


Other values mask the corresponding number of address bits, from 0b00011 masking 3 address bits 
(0x00000007 mask for address) to 0b11111 masking 31 address bits (0x7FFFFFFF mask for address). 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Bits [23:21] 


Reserved, RESO. 
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WT, bit [20] 
Watchpoint type. Possible values are: 
Qbd Unlinked data address match. 
Qb1 Linked data address match. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


LBN, bits [19:16] 


Linked breakpoint number. For Linked data address watchpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


SSC, bits [15:14] 


Security state control. Determines the Security states under which a Watchpoint debug event for 
watchpoint n is generated. This field must be interpreted along with the HMC and PAC fields. 


For more information, see Execution conditions for which a breakpoint generates Breakpoint 
exceptions on page D2-2422, and Reserved DBGBCR<n>_EL1.{SSC, HMC, PMC} values on 
page D2-2427. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


HMC, bit [13] 


Higher mode control. Determines the debug perspective for deciding when a Watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and PAC 
fields. 


For more information on the operation of the SSC, HMC, and PAC fields, see Execution conditions 
for which a watchpoint generates Watchpoint exceptions on page D2-2433. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


BAS, bits [12:5] 


Byte address select. Each bit of this field selects whether a byte from within the word or 
double-word addressed by DBGWVR<n>_EL1 is being watched. 





BAS Description 





Xxxxxxxl Match byte at DBGWVR<n>_EL1 





XxXXxxxlx Match byte at DBGWVR<n>_EL1 +1 





xxxxxlxx Match byte at DBGWVR<n>_EL1 +2 








xxxxlxxx Match byte at DBGWVR<n>_EL1 +3 





In cases where DBGWVR<n>_EL1 addresses a double-word: 





BAS Description, if DBGWVR<n>_EL1[2] == 





xxxIxxxx Match byte at DBGWVR<n>_EL1 +4 





xx1xxxxx Match byte at DBGWVR<n>_EL1 +5 





x1xxxxxx Match byte at DBGWVR<n>_EL1 +6 








1xxxxxxx Match byte at DBGWVR<n>_EL1 +7 


If DBGWVR<n>_EL1[2] == 1, only BAS[3:0] are used and BAS[7:4] are ignored. Arm deprecates 
setting DBGWVR<n>_EL1[2] == 1. 
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The valid values for BAS are non-zero binary numbers all of whose set bits are contiguous. All other 
values are reserved and must not be used by software. See Reserved DBGWCR<n>_EL1.BAS 
values on page D2-2442. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
LSC, bits [4:3] 


Load/store control. This field enables watchpoint matching on the type of access being made. 
Possible values of this field are: 


QbO1 Match instructions that load from a watchpointed address. 
0b10 Match instructions that store to a watchpointed address. 
Qb11 Match instructions that load from or store to a watchpointed address. 


All other values are reserved, but must behave as if the watchpoint is disabled. Software must not 
rely on this property as the behavior of reserved values might change in a future revision of the 
architecture. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


PAC, bits [2:1] 


Privilege of access control. Determines the Exception level or levels at which a Watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and HMC 
fields. 


For more information on the operation of the SSC, HMC, and PAC fields, see Execution conditions 
for which a watchpoint generates Watchpoint exceptions on page D2-2433. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


E, bit [0] 
Enable watchpoint n. Possible values are: 
0bd Watchpoint disabled. 
Qb1 Watchpoint enabled. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGWCR<n>_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DBGWCR<n>_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0000 n[3:0] 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGWCR_EL1[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif !ELUsingAArch32(EL1) && OSLSR_EL1.0SLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
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else 
return DBGWCR_EL1[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL3 then 


if !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGWCR_EL1[UInt(CRm<3:@>)]; 


MSR DBGWCR<n>_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b10 0b000 0b0000 n[3:0] 


0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 


elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWCR_EL1[UInt(CRm<3:0@>)] = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 





elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 





DBGWCR_EL1[UInt(CRm<3:0@>)] = X[t]; 
elsif PSTATE.EL == EL3 then 


if !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWCR_EL1[UInt(CRm<3:0@>)] = X[t]; 
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D13.3.12 DBGWVR<n>_EL1, Debug Watchpoint Value Registers, n = 0-15 
The DBGWVR<n>_EL1 characteristics are: 


Purpose 


Holds a data address value for use in watchpoint matching. Forms watchpoint n together with 
control register DBGWCR<n>_EL1. 


Configurations 


AArch64 System register DBGWVR<n>_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGWVR<n>[31:0]. 


AArch6é4 System register DBGWVR<n>_EL1[63:0] is architecturally mapped to External register 
DBGWVR<n>_EL1[63:0]. 


If watchpoint n is not implemented then accesses to this register are UNDEFINED. 


This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 


Attributes 
DBGWVR<n>_EL1 is a 64-bit register. 


Field descriptions 


The DBGWVR<n>_EL1 bit assignments are: 


63 53 52 49 48 2 1 0 


RESS[14:4] VA[52:49] VA[48:2] 


RESS[14:4], bits [63:53] 





i ees 


Reserved, Sign extended. Hardware and software must treat this field as RESO if the most significant 
bit of VA is 0 or RESO, and as RES1 if the most significant bit of VA is 1. 


Hardware always ignores the value of these bits and it is IMPLEMENTATION DEFINED whether: 


. The bits are hardwired to a copy of the most significant bit of VA, meaning writes to these 
bits are ignored, and reads to the bits always return the hardwired value. 


. The value in those bits can be written, and reads will return the last value written. The value 
held in those bits is ignored by hardware. 
VA[52:49], bits [52:49] 

When ARMv8.2-LVA is implemented: 
Extension to VA[48:2]. See VA[48:2] for more details. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 

Otherwise: 
Extension to RESS[14:4]. See RESS[14:4] for more details. 


VA[48:2], bits [48:2] 
Bits[48:2] of the address value for comparison. 


When ARMv8.2-LVA is implemented, VA[52:49] forms the upper part of the address value. 
Otherwise, VA[52:49] are RESS. 


Arm deprecates setting DBGWVR<n>_EL1[2] == 1. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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Bits [1:0] 
Reserved, RESO. 


Accessing the DBGWVR<n>_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DBGWVR<n>_EL1 





op0 op1 CRn 


CRm 


op2 





0b10 0b000 0b0000 n[3:0] 


0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 


elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGWVR_EL1[UInt(CRm<3:0>) ]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 





elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 





return DBGWVR_EL1[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL3 then 


if !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGWVR_EL1[UInt(CRm<3:0>)]; 


MSR DBGWVR<n>_EL1, <Xt> 





op0 op1 CRn 


op2 





0b10 0b000 0b0000 


0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 


elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWVR_EL1[UInt(CRm<3:0@>)] = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 


elsif !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 





DBGWVR_EL1[UInt(CRm<3:@>)] = X[t]; 
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elsif PSTATE.EL == EL3 then 
if !ELUsingAArch32(EL1) && OSLSR_EL1.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWVR_EL1[UInt(CRm<3:@>)] = X[t]; 
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D13.3.13 DLR_ELO, Debug Link Register 


The DLR_ELO characteristics are: 


Purpose 
In Debug state, holds the address to restart from. 
Configurations 
AArch64 System register DLR_ELO0[31:0] is architecturally mapped to AArch32 System register 
DLR[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DLR_ELO is a 64-bit register. 


Field descriptions 


The DLR_ELO bit assignments are: 


63 0 
Restart address 


Bits [63:0] 
Restart address. 


Accessing the DLR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DLR_ELO 

















op0 op1 CRn CRm op2 
0b11 0b011 0b0100 0b0101 0b001 
if !Halted() then 
UNDEFINED; 
else 
return DLR_ELQ; 
MSR DLR_ELO, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b011 0b0100 0b0101 0b001 
if !Halted() then 
UNDEFINED; 
else 
DLR_ELO = X[t]; 
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DSPSR_ELO, Debug Saved Program Status Register 


The DSPSR_ELO characteristics are: 


Purpose 
Holds the saved process state for Debug state. On entering Debug state, PSTATE information is 
written to this register. On exiting Debug state, values are copied from this register to PSTATE. 
Configurations 
AArch64 System register DSPSR_ELO0[31:0] is architecturally mapped to AArch32 System register 
DSPSR[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DSPSR_ELO is a 64-bit register. 


Field descriptions 


The DSPSR_ELO bit assignments are: 


When exiting Debug state to AArch32 state: 


63 32 31 30 29 28 27 26 25 24 23 22 21 2019, 1615 1098765 4 3 0 


RESO GE | IT[7:2] M[3:0] 









DIT 


SSBS 
PAN 

Bits [63:32] 
Reserved, RESO. 

N, bit [31] 
Negative Condition flag. Copied to PSTATE.N on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

Z, bit [30] 
Zero Condition flag. Copied to PSTATE.Z on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

C, bit [29] 
Carry Condition flag. Copied to PSTATE.C on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

V, bit [28] 
Overflow Condition flag. Copied to PSTATE.V on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

Q, bit [27] 
Overflow or saturation flag. Copied to PSTATE.Q on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 
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D13-3468 


IT[1:0], bits [26:25] 


If-Then. Copied to PSTATE.IT[1:0] on exiting Debug state. 


On exiting Debug state DSPSR_ELO.IT must contain a value that is valid for the instruction being 
returned to. 


This field resets to an architecturally UNKNOWN value. 


DIT, bit [24] 


When ARMV8.4-DIT is implemented: 
Data Independent Timing. Copied to PSTATE.DIT on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

Otherwise: 


Reserved, RESO. 


SSBS, bit [23] 


When ARMV8.0-SSBS is implemented: 
Speculative Store Bypass. Copied to PSTATE.SSBS on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

Otherwise: 


Reserved, RESO. 


PAN, bit [22] 


When ARMv%8.1-PAN is implemented: 
Privileged Access Never. Copied to PSTATE.PAN on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

Otherwise: 


Reserved, RESO. 


SS, bit [21] 


IL, bit [20] 


Software Step. Copied to PSTATE.SS on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


Illegal Execution state. Copied to PSTATE.IL on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Copied to PSTATE.GE on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


E, bit [9] 


If-Then. Copied to PSTATE.IT[7:2] on exiting Debug state. 
DSPSR_ELO.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


Endianness. Copied to PSTATE.E on exiting Debug state. 


If the implementation does not support big-endian operation, DSPSR_ELO.E is RESO. If the 
implementation does not support little-endian operation, DSPSR_ELO.E is RES1. On exiting Debug 
state, if the implementation does not support big-endian operation at the Exception level being 
returned to, DSPSR_ELO.E is RESO, and if the implementation does not support little-endian 
operation at the Exception level being returned to, DSPSR_ELO.E is RES1. 
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This field resets to an architecturally UNKNOWN value. 


A, bit [8] 
SError interrupt mask. Copied to PSTATE.A on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

I, bit [7] 
IRQ interrupt mask. Copied to PSTATE.I on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

F, bit [6] 
FIQ interrupt mask. Copied to PSTATE.F on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

T, bit [5] 


T32 Instruction set state. Copied to PSTATE.T on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


M[4], bit [4] 
Execution state. Copied to PSTATE.nRW on exiting Debug state. 
Qb1 AArch32 execution state. 


This field resets to an architecturally UNKNOWN value. 


M[3:0], bits [3:0] 
AArch32 Mode. Copied to PSTATE.M[3:0] on exiting Debug state. 
0b0000 User. 
0b0001 FIQ. 
0b0010 IRQ. 
0b0011 Supervisor. 
0b0110 Monitor. 
0b0111 Abort. 
0b1010 Hyp. 
0b1011 Undefined. 
0b1111 System. 


Other values are reserved. If DSPSR_EL0.M[3:0] has a Reserved value, or a value for an 
unimplemented Exception level, exiting Debug state is an illegal return event, as described in ///egal 
return events from AArch64 state on page D1-2304. 


This field resets to an architecturally UNKNOWN value. 


When entering Debug state from AArch64 state and exiting Debug state to AArch64 state: 


63 32 31 30 29 28 27 26 25 24 23 22 21 2019 .. 131211109 8 7 6 5 4 3 0 












RESO 
RESO | 
TCO 
DIT 
UAO 
PAN 
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Bits [63:32] 


Reserved, RESO. 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on entering Debug state, and copied to 
PSTATE.N on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on entering Debug state, and copied to 
PSTATE.Z on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on entering Debug state, and copied to 
PSTATE.C on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on entering Debug state, and copied to 
PSTATE.V on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


Bits [27:26] 


Reserved, RESO. 


TCO, bit [25] 
When ARMV8.5-MemTag is implemented: 


Tag Check Override. Set to the value of PSTATE.TCO on entering Debug state, and copied to 
PSTATE.TCO on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [24] 
When ARMV8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on entering Debug state, and copied to 
PSTATE.DIT on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


UAO, bit [23] 
When ARMV8.2-UAO is implemented: 


User Access Override. Set to the value of PSTATE.UAO on entering Debug state, and copied to 
PSTATE.UAO on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on entering Debug state, and copied to 
PSTATE.PAN on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SS, bit [21] 


Software Step. Set to the value of PSTATE.SS on entering Debug state, and conditionally copied to 
PSTATE.SS on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on entering Debug state, and copied to 
PSTATE.IL on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


Bits [19:13] 


Reserved, RESO. 


SSBS, bit [12] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on entering Debug state, and copied to 
PSTATE.SSBS on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


BTYPE, bits [11:10] 
When ARMV8.5-BTI is implemented: 


Branch Type Indicator. Set to the value of PSTATE.BTYPE on entering Debug state, and copied to 
PSTATE.BTYPE on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


D, bit [9] 


Debug exception mask. Set to the value of PSTATE.D on entering Debug state, and copied to 
PSTATE.D on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on entering Debug state, and copied to 
PSTATE.A on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on entering Debug state, and copied to PSTATE.I 
on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
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F, bit [6] 


Bit [5] 


M{4], bit [4] 


FIQ interrupt mask. Set to the value of PSTATE.F on entering Debug state, and copied to PSTATE.F 
on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Execution state. Set to 0b0, the value of PSTATE.nRW, on entering Debug state from AArch64 state, 
and copied to PSTATE.nRW on exiting Debug state. 


Qbd AArch64 execution state. 
If AArch32 is not supported at any Exception level, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


M[3:0], bits [3:0] 


AArch64 Exception level and selected Stack Pointer. 
0b0000 ELOt. 
0b0100 ELIt. 
0b0101 ELth. 
0b1000 EL2t. 
0b1001 EL2h. 
0b1100 EL3t. 
0b1101 EL3h. 


Other values are reserved. If DSPSR_ELO.M[3:0] has a Reserved value, or a value for an 
unimplemented Exception level, exiting Debug state is an illegal return event, as described in ///egal 
return events from AArch64 state on page D1-2304. 


The bits in this field are interpreted as follows: 


° M[3:2] is set to the value of PSTATE.EL on entering Debug state and copied to PSTATE.EL 
on exiting Debug state. 


3 M[1] is unused and is 0 for all non-reserved values. 


$ M[0] is set to the value of PSTATE.SP on entering Debug state and copied to PSTATE.SP on 
exiting Debug state 


This field resets to an architecturally UNKNOWN value. 


Accessing the DSPSR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DSPSR_ELO 


D13-3472 











op0 op1 CRn CRm op2 
Ob11 0b011 0b0100 0b0101 0b000 
if !Halted() then 
UNDEFINED; 
else 
return DSPSR_ELQ; 
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MSR DSPSR_ELO, <Xt> 


if !Halted() then 
UNDEFINED; 

else 
DSPSR_ELO = X[t]; 
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D13.3.15 


D13-3474 


MDCCINT_EL1, Monitor DCC Interrupt Enable Register 


The MDCCINT_EL1 characteristics are: 


Purpose 


Enables interrupt requests to be signaled based on the DCC status flags. 


Configurations 


Attributes 


AArch64 System register MDCCINT_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGDCCINT[31:0]. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch64. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


MDCCINT_ EL] is a 64-bit register. 


Field descriptions 


The MDCCINT_EL] bit assignments are: 


63 


Bits [63:31] 


RX, bit [30] 


TX, bit [29] 


Bits [28:0] 


31 30 29 28 0 


RESO Pn RESO 


Reserved, RESO. 


DCC interrupt request enable control for DTRRX. Enables a common COMMIRQ interrupt 
request to be signaled based on the DCC status flags. 


Qbd No interrupt request generated by DTRRX. 
Qb1 Interrupt request will be generated on RXfull == 1. 


If legacy COMMRX and COMMTX signals are implemented, then these are not affected by the 
value of this bit. 


On a Warm reset, this field resets to 0. 


DCC interrupt request enable control for DTRTX. Enables a common COMMIRQ interrupt 
request to be signaled based on the DCC status flags. 


Qbd No interrupt request generated by DTRTX. 
Qb1 Interrupt request will be generated on TXfull == 0. 


If legacy COMMRX and COMMTX signals are implemented, then these are not affected by the 
value of this bit. 


On a Warm reset, this field resets to 0. 


Reserved, RESO. 


Accessing the MDCCINT_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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D13.3 Debug registers 
MRS <Xt>, MDCCINT_EL1 
op0 op1 CRn CRm op2 
0b10 0b000 0b0000 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return MDCCINT_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return MDCCINT_EL1; 
elsif PSTATE.EL == EL3 then 
return MDCCINT_EL1; 
MSR MDCCINT_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b10 0b000 0b0000 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
MDCCINT_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
MDCCINT_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
MDCCINT_EL1 = X[t]; 
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D13.3.16 © MDCCSR_ELO, Monitor DCC Status Register 
The MDCCSR_ELO characteristics are: 


Purpose 


Read-only register containing control status flags for the DCC. 


Configurations 


AArch6é4 System register MDCCSR_ELO[30:29] is architecturally mapped to External register 
EDSCR[30:29]. 


AArch64 System register MDCCSR_ELO[30:29] is architecturally mapped to AArch32 System 
register DBGDSCRint[30:29]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MDCCSR FLO is a 64-bit register. 


Field descriptions 


The MDCCSR_ELO bit assignments are: 


31 30 29 28 19 18 15 14 13 12 11 


= = RESO | RESO ea | RESO EL) 
RXfull — || = es 
TXfull RAZ 


RESO 
Bits [63:31] 
Reserved, RESO. 
RXfull, bit [30] 
DTRRX full. Read-only view of the equivalent bit in the EDSCR. 
TXfull, bit [29] 
DTRTX full. Read-only view of the equivalent bit in the EDSCR. 
Bits [28:19] 
Reserved, RESO. 
Bits [18:15] 
Reserved, RAZ. 
Bits [14:13] 
Reserved, RESO. 
Bit [12] 
Reserved, RAZ. 
Bits [11:6] 
Reserved, RESO. 
Bits [5:2] 
Reserved, RAZ. 
D13-3476 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.3 Debug registers 


Bits [1:0] 
Reserved, RESO. 


Accessing the MDCCSR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MDCCSR_ELO 





op0 op1 CRn CRm 





0b10 0b011 0b0000 0b0001 


0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDA> != 'Q@') then 


AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return MDCCSR_ELQ; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return MDCCSR_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return MDCCSR_ELQ; 
elsif PSTATE.EL == EL3 then 
return MDCCSR_ELQ; 
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D13.3.17 MDCR_EL2, Monitor Debug Configuration Register (EL2) 
The MDCR_EL2 characteristics are: 


Purpose 


Provides EL2 configuration options for self-hosted debug and the Performance Monitors Extension. 


Configurations 
AArch64 System register MDCR_EL2[31:0] is architecturally mapped to AArch32 System register 
HDCR{31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch64. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
MDCR_EL2 is a 64-bit register. 


Field descriptions 


The MDCR_EL2 bit assignments are: 


27 26 25 24 23 22., 20 19 18 17 16 15 14 13 12 1110 9 8 7 6 5 4 0 


RESO a | RESO 
fe a | a TPMCR 
e—a TPM 


HCCD HPME 
TTRF TDE 
TDA 

TDOSA 

TDRA 

TPMS 

RESO 

HPMD 

RESO 





Bits [63:27] 


Reserved, RESO. 


HLP, bit [26] 
When ARMv8.5-PMU is implemented: 


Hypervisor Long event counter enable. Determines when unsigned overflow is recorded by a 
counter overflow bit. 


Ob Event counter overflow on increment that causes unsigned overflow of 
PMEVCNTR<n>_ELO0[31:0]. 


Qb1 Event counter overflow on increment that causes unsigned overflow of 
PMEVCNTR<n>_ELO0[63:0]. 
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If MDCR_EL2.HPMN is less than PMCR_ELO.N or PMCR.N, this bit affects the operation of 
event counters in the range [MDCR_EL2.HPMN..(PMCR_ELO.N-1)] or 
[MDCR_EL2.HPMN..(PMCR.N-1)]. Otherwise this bit has no effect on the operation of the event 
counters. 


Note 


The effect of MDCR_EL2.HPMN on the operation of this bit always applies if EL2 is implemented, 
at all Exception levels including EL2 and EL3, and regardless of whether EL2 is enabled in the 
current Security state. 








For more information see the description of the MDCR_EL2.HPMN field. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [25:24] 


Reserved, RESO. 


HCCD, bit [23] 

When ARMV8.5-PMU is implemented: 
Hypervisor Cycle Counter Disable. Prohibits PMCCNTR_ELO from counting at EL2. 
0bd Cycle counting by PMCCNTR_ELO is not affected by this bit. 
Qb1 Cycle counting by PMCCNTR_ELO is prohibited at EL2. 
This bit does not affect the CPU_CYCLES event or any other event that counts cycles. 
This field resets to 0. 

Otherwise: 


Reserved, RESO. 


Bits [22:20] 


Reserved, RESO. 


TTREF, bit [19] 
When ARMV8.4-Trace is implemented: 
Traps use of the Trace Filter Control registers at EL1 to EL2, as follows: 
° Access to TRFCR_ELI is trapped to EL2, reported using EC syndrome value 0x18. 
° Access to TRFCR is trapped to EL2, reported using EC syndrome value 0x03. 
Qbd Accesses to TRFCR_EL1 and TRFCR at EL] are not affected by this control. 


Qb1 Accesses to TRFCR_EL1 and TRFCR at EL1 generate a trap exception to EL2 when 
EL2 is enabled in the current Security state. 


Otherwise: 
Reserved, RESO. 
Bit [18] 
Reserved, RESO. 
HPMD, bit [17] 
When ARMV8.1-PMU is implemented: 


Guest Performance Monitors Disable. This control prohibits event counting at EL2. 


Qbd Event counting allowed at EL2. 
Qb1 Event counting prohibited at EL2. 
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If ARMv8.2-Debug is not implemented, event counting is prohibited unless enabled by 
the IMPLEMENTATION DEFINED authentication interface 
ExternalSecureNoninvasiveDebugEnabled(). 


This control applies only to: 
à The event counters in the range [0..(MDCR_EL2.HPMN-1)]. 
° If PMCR_ELO.DP is set to 1, PMCCNTR_ELO. 


The other event counters are unaffected, and when PMCR_ELO.DP is set to 0, PMCCNTR_ELO is 
unaffected. 


On a Warm reset, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


Bits [16:15] 


Reserved, RESO. 


TPMS, bit [14] 
When SPE is implemented: 


Trap Performance Monitor Sampling. When EL2 is enabled in the current Security state, this field 
controls access to Statistical Profiling control registers from EL1. 


Qbd Do not trap Statistical Profiling controls to EL2. 


Qb1 Accesses to Statistical Profiling controls at EL1 generate a Trap exception to EL2 when 
EL2 is enabled in the current Security state. 


The Statistical Profiling control registers trapped by this control are: PMSCR_EL1, 
PMSEVFR_EL1, PMSFCR_EL1, PMSICR_EL1, PMSIDR_EL1, PMSIRR_EL1, and 
PMSLATFR _EL1. 


Otherwise: 


Reserved, RESO. 


E2PB, bits [13:12] 
When SPE is implemented: 


EL2 Profiling Buffer. When EL2 is enabled in the current Security state, this field controls the 
owning translation regime and access to Profiling Buffer control registers from EL1. 


0b00 Profiling Buffer uses the EL2 stage 1 translation regime. Accesses to Profiling Buffer 
controls at EL1 generate a Trap exception to EL2 when EL2 is enabled in the current 
Security state. 


0b10 Profiling Buffer uses the EL1&0 stage 1 translation regime. Accesses to Profiling 
Buffer controls at EL1 generate a Trap exception to EL2 when EL2 is enabled in the 
current Security state. 


Qb11 Profiling Buffer uses the EL1&0 stage 1 translation regime. Accesses to Profiling 
Buffer controls at EL1 are not trapped. 


All other values are reserved. 


The Profiling Buffer control registers trapped by this control are: PMBLIMITR_EL1, 
PMBPTR ELI, and PMBSR ELI. 


If EL2 is not implemented, or is disabled in the current Security State, the PE behaves as if E2PB 
== 0b11, other than for a direct read of the register. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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TDRA, bit [11] 
Trap Debug ROM Address register access. Traps System register accesses to the Debug ROM 
registers to EL2 when EL2 is enabled in the current Security state as follows: 


s IfEL1 is using AArch64 state, accesses to MDRAR_EL!1 are trapped to EL2, reported using 
EC syndrome value 0x18. 


. If ELO or EL] is using AArch32 state, MRC or MCR accesses to the following registers are 
trapped to EL2, reported using EC syndrome value 0x05 and MRRC or MCRR accesses are 
trapped to EL2, reported using EC syndrome value 0x0C: 


— DBGDRAR, DBGDSAR. 
0bd This control does not cause any instructions to be trapped. 


Qb1 ELO and EL1 System register accesses to the Debug ROM registers are trapped to EL2 
when EL2 is enabled in the current Security state, unless it is trapped by 
DBGDSCRext.UDCCdis or MDSCR_EL1.TDCC. 


This field is treated as being 1 for all purposes other than a direct read when one or more of the 
following are true: 


. MDCR_EL2.TDE = 1. 
$ HCR_EL2.TGE = 1. 


Note 


EL2 does not provide traps on debug register accesses through the optional memory-mapped 
external debug interfaces. 








System register accesses to the debug registers might have side-effects. When a System register 
access is trapped to EL2, no side-effects occur before the exception is taken to EL2. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


TDOSA, bit [10] 
When ARMV8.0-DoubleLock is implemented: 


Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug 
registers to EL2, from both Execution states as follows: 


° In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC 
syndrome value 0x18: 


— OSLAR ELl, OSLSR_EL1, OSDLR_EL1, and DBGPRCR_EL1. 


— Any IMPLEMENTATION DEFINED register with similar functionality that the 
implementation specifies as trapped by this bit. 


° In AArch32 state, accesses to the following registers are trapped to EL2, reported using EC 
syndrome value 0x05: 


—  DBGOSLSR, DBGOSLAR, DBGOSDLR, and DBGPRCR. 


— Any IMPLEMENTATION DEFINED register with similar functionality that the 
implementation specifies as trapped by this bit. 


0bd This control does not cause any instructions to be trapped. 


Qb1 ELI System register accesses to the powerdown debug registers are trapped to EL2 
when EL2 is enabled in the current Security state. 


— Note 


These registers are not accessible at ELO. 





This field is treated as being 1 for all purposes other than a direct read when one or more of the 
following are true: 


. MDCR_EL2.TDE = 1. 
. HCR_EL2.TGE = 1. 
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System register accesses to the debug registers might have side-effects. When a System register 
access is trapped to EL2, no side-effects occur before the exception is taken to EL2. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


TDA, bit [9] 


Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug 
registers to EL2, from both Execution states as follows: 


° In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC 
syndrome value 0x18: 


— OSLAR ELl, OSLSR_EL1, and DBGPRCR ELI. 


— Any IMPLEMENTATION DEFINED register with similar functionality that the 
implementation specifies as trapped by this bit. 


° In AArch32 state, accesses to the following registers are trapped to EL2, reported using EC 
syndrome value 0x05: 


— DBGOSLSR, DBGOSLAR, and DBGPRCR. 


— Any IMPLEMENTATION DEFINED register with similar functionality that the 
implementation specifies as trapped by this bit. 


It is IMPLEMENTATION DEFINED whether accesses to OSDLR_EL1 are trapped and DBGOSDLR are 
trapped. 


0bd This control does not cause any instructions to be trapped. 


Qb1 ELI System register accesses to the powerdown debug registers are trapped to EL2 
when EL2 is enabled in the current Security state. 


— Note 
These registers are not accessible at ELO. 





This field is treated as being 1 for all purposes other than a direct read when one or more of the 
following are true: 


s MDCR_EL2.TDE = 1. 
s HCR_EL2.TGE = 1. 


Note 


EL2 does not provide traps on debug register accesses through the optional memory-mapped 
external debug interfaces. 








System register accesses to the debug registers might have side-effects. When a System register 
access is trapped to EL2, no side-effects occur before the exception is taken to EL2. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Trap Debug Access. Traps ELO and EL1 System register accesses to debug System registers that are 
not trapped by MDCR_EL2.TDRA or MDCR_EL2.TDOSA, as follows: 


e In AArch64 state, accesses to the following registers are trapped to EL2 reported using EC 
syndrome value 0x18: 

—  MDCCSR EL0, MDCCINT_EL1, OSDTRRX_EL1, MDSCR_EL1, 
OSDTRTX_EL1, OSECCR_EL1, DBGBVR<n>_EL1, DBGBCR<n>_EL1, 
DBGWVR<n>_EL1, DBGWCR<n>_EL1, DBGCLAIMSET ELI, 
DBGCLAIMCLR_EL1, DBGAUTHSTATUS ELI. 


— When not in Debug state, DBGDTR_EL0, DBGDTRRX_ELO, DBGDTRTX_ELO. 
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s In AArch32 state, MRC or MCR accesses to the following registers are trapped to EL2, 
reported using EC syndrome value 0x05. 


— DBGDIDR, DBGDSCRint, DBGDCCINT, DBGWFAR, DBGVCR, DBGDSCRext, 
DBGDTRTXext, DBGDTRRXext, DBGBVR<n>, DBGBCR<n>, DBGBXVR<p>, 
DBGWCR<n>, DBGWVR<n>, DBGCLAIMSET, DBGCLAIMCLR, 
DBGAUTHSTATUS, DBGDEVID, DBGDEVID1, DBGDEVID2, DBGOSECCR. 


— When not in Debug state, DBGDTRRXint and DBGDTRTXint. 


. In AArch32 state, STC accesses to DBGDTRRXint and LDC accesses to DBGDTRTXint are 
trapped to EL2, reported using EC syndrome value 0x06. 


0bd This control does not cause any instructions to be trapped. 


Qb1 ELO or EL1 System register accesses to the debug registers are trapped from both 
Execution states to EL2 when EL2 is enabled in the current Security state, unless the 
access generates a higher priority exception. 


Traps of AArch32 accesses to DBGDTRRXint and DBGDTRTXint are ignored in Debug state. 


Traps of AArch64 accesses to DBGDTR_ELO, DBGDTRRX_ELO, and DBGDTRTX_ELO are 
ignored in Debug state. 


This field is treated as being 1 for all purposes other than a direct read when one or more of the 
following are true: 


: MDCR_EL2.TDE == 
$ HCR_EL2.TGE = 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


TDE, bit [8] 
Trap Debug exceptions. 


Qbd This control has no effect on the routing of debug exceptions, and has no effect on 
accesses to debug registers. 


Qb1 Debug exceptions generated at EL1 or ELO are routed to EL2 when EL2 is enabled in 
the current Security state. The MDCR_EL2.{TDRA, TDOSA, TDA} fields are treated 
as being 1 for all purposes other than returning the result of a direct read of the register. 


This field is treated as being 1 for all purposes other than a direct read when HCR_EL2.TGE == 1. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


HPME, bit [7] 
When PMUY3 is implemented: 
[MDCR_EL2.HPMN..(N-1)] event counters enable. 
Qbd Event counters in the range [MDCR_EL2.HPMN..(PMCR_ELO.N-1)] are disabled. 


Qb1 Event counters in the range [MDCR_EL2.HPMN..(PMCR_ELO.N-1)] are enabled by 
PMCNTENSET ELO. 


If MDCR_EL2.HPMN is less than PMCR_ELO.N or PMCR.N, the event counters in the range 
[MDCR_EL2.HPMN..(PMCR_ELO.N-1)] or [HDCR.HPMN..(PMCR.N-1)], are enabled and 
disabled by this bit. Otherwise this bit has no effect on the operation of the event counters. 


— Note 


The effect of MDCR_EL2.HPMN on the operation of this bit applies regardless of whether EL2 is 
enabled in the current Security state. 





For more information see the description of the HPMN field. 
On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3483 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 


D13.3 Debug registers 


D13-3484 


TPM, bit [6] 


When PMUV3 is implemented: 


Trap Performance Monitors accesses. Traps ELO and EL1 accesses to all Performance Monitor 
registers to EL2 when EL2 is enabled in the current Security state, from both Execution states, as 
follows: 


° In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC 
syndrome value 0x18: 


—  PMCR_ ELO, PMCNTENSET_EL0, PMCNTENCLR_ELO, PMOVSCLR_ELO, 
PMSWINC_EL0, PMSELR_EL0, PMCEIDO ELO, PMCEID1 ELO, 
PMCCNTR_ELO,PMXEVTYPER ELO,PMXEVCNTR_ELO, PMUSERENR ELO, 
PMINTENSET_EL1, PMINTENCLR EL1, PMOVSSET ELO, 
PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMCCFILTR_ELO. 


° In AArch32 state, MRC or MCR accesses to the following registers are trapped to EL2 and 
reported using EC syndrome value 0x03, MRRC or MCRR accesses are trapped to EL2 and 
reported using EC syndrome value 0x04: 


—  PMCR, PMCNTENSET, PMCNTENCLR, PMOVSR, PMSWINC, PMSELR, 
PMCEIDO, PMCEID1, PMCCNTR, PMXEVTYPER, PMXEVCNTR, 
PMUSERENR, PMINTENSET, PMINTENCLR, PMOVSSET, PMEVCNTR<n>, 
PMEVTYPER<n>, PMCCFILTR. 


$ If ARMv8.4-PMU is implemented, in AArch64 state, PMMIR_EL1 and in AArch32 state, 
PMMIR. 


° If ARMv8.1-PMU is implemented, in AArch32 state, PMCEID2 and PMCEID3. 

0b0ð This control does not cause any instructions to be trapped. 

0b1 ELO and EL1 accesses to all Performance Monitor registers are trapped to EL2 when 
EL2 is enabled in the current Security state. 

— Note 


EL2 does not provide traps on Performance Monitor register accesses through the optional 
memory-mapped external debug interface. 





On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


TPMCR, bit [5] 
When PMUV3 is implemented: 


Trap PMCR_ELO or PMCR accesses. Traps ELO and EL1 accesses to EL2, when EL2 is enabled in 
the current Security state, as follows: 


. In AArch64 state, accesses to PMCR_ELO are trapped to EL2, reported using EC syndrome 
value 0x18. 


. In AArch32 state, accesses to PMCR are trapped to EL2, reported using EC syndrome value 


0x03. 
0b0ð This control does not cause any instructions to be trapped. 
0b1 ELO and EL1 accesses to the PMCR_ELO or PMCR are trapped to EL2 when EL2 is 
enabled in the current Security state, unless it is trapped by PMUSERENR.EN or 
PMUSERENR ELO.EN. 
— Note 


EL2 does not provide traps on Performance Monitor register accesses through the optional 
memory-mapped external debug interface. 





On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.3 Debug registers 


Otherwise: 


Reserved, RESO. 


HPMN, bits [4:0] 
When PMUV3 is implemented: 


Defines the number of event counters that are accessible from EL3, EL2, EL1, and from ELO if 
permitted. 


If HPMN is less than PMCR_ELO.N, HPMN divides the Performance Monitors into two ranges: 
[0..dHPMN-1)] and [HPMN..(PMCR_ELO.N-1)]. 


For an event counter in the range [0..cHPMN-1)]: 


° The counter is accessible from EL3, EL2, and EL1, and from ELO if permitted by 
PMUSERENR_ELO or PMUSERENR. 


è If ARMv8.5-PMU is implemented, PMCR_ELO.LP or PMCR.LP determines whether the 
counter overflow flag is set on unsigned overflow of PMEVCNTR<n>_EL0[31:0] or 
PMEVCNTR<n>_EL0[63:0]. 


è The counter is enabled by PMCR_ELO.E or PMCR.E and bit <n> of PMCNTENSET ELO. 


—— Note 
If HPMN is equal to PMCR_ELO.N, this applies to all event counters. 





If HPMN is less than PMCR_ELO.N, for an event counter in the range [HPMN..(PMCR_ELO.N-1)]: 
. The counter is accessible from EL2 and EL3. 


. If ARMv8.4-SecEL2 is disabled or is not implemented, the counter is also accessible from 
Secure EL1 and from Secure ELO if permitted by PMUSERENR_ELO. 


. If ARMv8.5-PMU is implemented, MDCR_EL2.HLP or HDCR.HLP determines whether 
the counter overflow flag is set on unsigned overflow of PMEVCNTR<n>_EL0[31:0] or 
PMEVCNTR<n>_EL0[63:0]. 


a The counter is enabled by MDCR_EL2.HPME or HDCR.HPME and bit <n> of 
PMCNTENSET_ELO. 


If this field is set to 0, or to a value larger than PMCR_ELO.N, then the following CONSTRAINED 
UNPREDICTABLE behaviors apply: 


° The value returned by a direct read of MDCR_EL2.HPMN is UNKNOWN. 
° Either: 


— An UNKNOWN number of counters are reserved for EL2 and EL3 use. That is, the PE 
behaves as if MDCR_EL2.HPMN is set to an UNKNOWN non-zero value less than or 
equal to PMCR_ELO.N. 


— All counters are reserved for EL2 and EL3 use, meaning no counters are accessible 
from EL1 and ELO. 


On a Warm reset, this field resets to the value in PMCR_ELO.N. 
Otherwise: 


Reserved, RESO. 


Accessing the MDCR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, MDCR_EL2 











op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0001 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return MDCR_EL2; 
elsif PSTATE.EL == EL3 then 
return MDCR_EL2; 
MSR MDCR_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0001 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
MDCR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
MDCR_EL2 = X[t]; 
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D13.3.18 ©MDCR_EL3, Monitor Debug Configuration Register (EL3) 
The MDCR_EL3 characteristics are: 


Purpose 


Provides EL3 configuration options for self-hosted debug and the Performance Monitors Extension. 


Configurations 


AArch64 System register MDCR_EL3[31:0] can be mapped to AArch32 System register 
SDCR[31:0], but this is not architecturally mandated. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch64. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
MDCR _ EL3 is a 64-bit register. 


Field descriptions 


The MDCR_EL3 bit assignments are: 


63 24 23 22 21 20191817 16 1514131211109 8 7 6 5 0 






RESO 
SCCD L | | [eats TPM 
RESO RESO 
EPMAD TDA 
EDAD TDOSA 
TTRF RESO 
SPD32 
SDD 
SPME 
STE 


Bits [63:24] 


Reserved, RESO. 


SCCD, bit [23] 

When ARMv8.5-PMU is implemented: 
Secure Cycle Counter Disable. Prohibits PMCCNTR_ELO from counting in Secure state. 
Qbd Cycle counting by PMCCNTR_ELO is not affected by this bit. 
Qb1 Cycle counting by PMCCNTR_ELO is prohibited in Secure state. 
This bit does not affect the CPU_CYCLES event or any other event that counts cycles. 
This field resets to 0. 

Otherwise: 


Reserved, RESO. 


Bit [22] 


Reserved, RESO. 
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EPMAD, bit [21] 
When ARMv8.4-Debug is implemented and PMUV3 is implemented: 


External Performance Monitors Non-secure Access Disable. Controls Non-secure access to 
Performance Monitor registers by an external debugger. 


Qbd Non-secure access to Performance Monitor registers from external debugger is 
permitted. 

Qb1 Non-secure access to Performance Monitor registers from external debugger is not 
permitted. 


If the Performance Monitors Extension does not support external debug interface accesses this bit 
is RESO. 


Otherwise, if EL3 is not implemented and the Effective value of SCR_EL3.NS is 0b@, then the 
Effective value of this bit is @b1. 


On a Warm reset, this field resets to 0. 
When PMUV3 is implemented: 


External Performance Monitors Access Disable. Controls access to Performance Monitor registers 
by an external debugger. 


Ob Access to Performance Monitor registers from external debugger is permitted. 


Qb1 Access to Performance Monitor registers from external debugger is not permitted, 
unless overridden by the IMPLEMENTATION DEFINED authentication interface. 


If the Performance Monitors Extension does not support external debug interface accesses this bit 
is RESO. 


Otherwise, if EL3 is not implemented and the Effective value of SCR_EL3.NS is 0b@, then the 
Effective value of this bit is 0b1. 


On a Warm reset, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


EDAD, bit [20] 
When ARMV8.4-Debug is implemented: 


External Debug Non-secure Access Disable. Controls Non-secure access to breakpoint, watchpoint, 
and OSLAR_ELI registers by an external debugger. 


ObO Non-secure access to debug registers from external debugger is permitted. 


Qb1 Non-secure access to breakpoint and watchpoint registers, and OSLAR_EL1 from 
external debugger is not permitted. 


If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0b@, then the Effective value 
of this field is 0b1. 


On a Warm reset, this field resets to 0. 
When ARMV8.2-Debug is implemented: 


External Debug Access Disable. Controls access to breakpoint, watchpoint, and OSLAR_EL1 
registers by an external debugger. 


ObO Access to debug registers, and to OSLAR_EL1 from external debugger is permitted. 


Qb1 Access to breakpoint and watchpoint registers, and to OSLAR_EL1 from external 
debugger is not permitted, unless overridden by the IMPLEMENTATION DEFINED 
authentication interface. 


If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0b, then the Effective value 
of this field is 0b1. 


On a Warm reset, this field resets to 0. 
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Otherwise: 


External Debug Access disable. Controls access to breakpoint, watchpoint, and optionally 
OSLAR_ ELI registers by an external debugger. 


ObO Access to debug registers from external debugger is permitted. 


Qb1 Access to breakpoint and watchpoint registers from an external debugger is not 
permitted, unless overridden by the IMPLEMENTATION DEFINED authentication interface. 


It is IMPLEMENTATION DEFINED whether access to the OSLAR_ EL] register from an 
external debugger is permitted or not permitted. 


If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0b@, then the Effective value 
of this field is 0b1. 


On a Warm reset, this field resets to 0. 


TTRF, bit [19] 
When ARMV8.4-Trace is implemented: 
Trap Trace Filter controls. Traps use of the Trace Filter control registers at EL2 and EL1 to EL3. 
The Trace Filter registers trapped by this control are: 
: TRFCR_EL2, TRFCR_EL12, TRFCR_EL1, reported using EC syndrome value 0x18. 
° HTRFCR and TRFCR, reported using EC syndrome value 0x03. 
Qbd Accesses to Trace Filter registers at EL2 and EL] are not affected by this bit. 


Qb1 Accesses to Trace Filter registers at EL2 and EL1 generate a Trap exception to EL3, 
unless the access generates a higher priority exception. 


Otherwise: 


Reserved, RESO. 


STE, bit [18] 
When ARMV8.4-Trace is implemented: 
Secure Trace enable. Enables tracing in Secure state. 


ObO Trace prohibited in Secure state unless overridden by the IMPLEMENTATION DEFINED 
authentication interface. 


0b1 Trace in Secure state is not affected by this bit. 


This bit also controls the level of authentication required by an external debugger to enable external 
tracing. See Register controls to enable self-hosted trace on page D3-2462. If EL3 is not 
implemented the Effective value of SCR_EL3.NS is 0b0, the Effective value of this bit is 0b1. 


On a Warm reset, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


SPME, bit [17] 
When ARMv%8.2-Debug is implemented and PMUv3 is implemented: 
Secure Performance Monitors enable. This allows event counting in Secure state. 
Qbd Event counting prohibited in Secure state. 
Qb1 Event counting in Secure state not affected by this bit. 


If EL3 is not implemented the Effective value of SCR_EL3.NS is 0b@, then the Effective value of 
this bit is 0b1. 


This field resets to 0. 
When PMUV3 is implemented: 
Secure Performance Monitors enable. This allows event counting in Secure state. 


ObO Event counting prohibited in Secure state, unless 
ExternalSecureNoninvasiveDebugEnabled() is TRUE. 
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Qb1 Event counting in Secure state not affected by this bit. 


If EL3 is not implemented the Effective value of SCR_EL3.NS is 0b@, then the Effective value of 
this bit is 0b1. 


This field resets to Q. 


Otherwise: 


SDD, bit [16] 


Reserved, RESO. 


AArch64 Secure Self-hosted invasive debug disable. Disables Software debug exceptions in Secure 
state, other than Breakpoint Instruction exceptions. 


ObO Debug exceptions from Secure ELO are enabled, and debug exceptions from Secure 
ELI are not affected by this bit. 


Qb1 Debug exceptions, other than Breakpoint Instruction exceptions, are disabled from all 
Exception levels in Secure state. 


The SDD bit is ignored unless both of the following are true: 
° The PE is in Secure state. 
° The Effective value of SCR_EL3.RW is 0b1. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


SPD32, bits [15:14] 


AArch32 Secure self-hosted privileged debug. Enables or disables debug exceptions from Secure 
EL1 using AArch32, other than Breakpoint Instruction exceptions. 


0bd0 Legacy mode. Debug exceptions from Secure EL1 are enabled by the IMPLEMENTATION 
DEFINED authentication interface. 

0b10 Secure privileged debug disabled. Debug exceptions from Secure EL] are disabled. 

Qb11 Secure privileged debug enabled. Debug exceptions from Secure EL1 are enabled. 


Other values are reserved, and have the CONSTRAINED UNPREDICTABLE behavior that they must 
have the same behavior as 0b00. Software must not rely on this property as the behavior of reserved 
values might change in a future revision of the architecture. 


This field has no effect on Breakpoint Instruction exceptions. These are always enabled. 
This field is: 
à Ignored if the PE is either: 
— In Non-secure state. 
— In Secure state and Secure EL1 is using AArch64. 
à RESO if the implementation does not support EL1 using AArch32. 
If Secure EL1 is using AArch32 then: 


° If debug exceptions from Secure EL1 are enabled, then debug exceptions from Secure ELO 
are also enabled. 


. Otherwise, debug exceptions from Secure ELO are enabled only if the value of 
SDER32_EL3.SUIDEN is 0b1. 


If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0b@, then the Effective value 
of this field is @b11. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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NSPB, bits [13:12] 
When SPE is implemented: 


Non-secure Profiling Buffer. This field controls the owning translation regime and accesses to 
Statistical Profiling and Profiling Buffer control registers. 


0b00 Profiling Buffer uses Secure Virtual Addresses. Statistical Profiling enabled in Secure 
state and disabled in Non-secure state. Accesses to Statistical Profiling and Profiling 
Buffer control registers at EL2 and EL1 in both security states generate Trap exceptions 
to EL3. 


0b01 Profiling Buffer uses Secure Virtual Addresses. Statistical Profiling enabled in Secure 
state and disabled in Non-secure state. Accesses to Statistical Profiling and Profiling 
Buffer control registers in Non-secure state generate Trap exceptions to EL3. 


0b10 Profiling Buffer uses Non-secure Virtual Addresses. Statistical Profiling enabled in 
Non-secure state and disabled in Secure state. Accesses to Statistical Profiling and 
Profiling Buffer control registers at EL2 and EL1 in both security states generate Trap 
exceptions to EL3. 


0b11 Profiling Buffer uses Non-secure Virtual Addresses. Statistical Profiling enabled in 
Non-secure state and disabled in Secure state. Accesses to Statistical Profiling and 
Profiling Buffer control registers in Secure state generate Trap exceptions to EL3. 


The Statistical Profiling and Profiling Buffer control registers trapped by this control are: 
PMBLIMITR_ EL1, PMBPTR_EL1, PMBSR_EL1, PMSCR_EL1, PMSCR_EL2, 
PMSEVFR_EL1, PMSFCR_EL1, PMSICR_EL1, PMSIDR_EL1, PMSIRR_EL1, and 
PMSLATFR _EL1. 


If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0b1, the Effective value of 
this field is 0b11. If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0b@, the 
Effective value of this field is 0b01. 


Otherwise: 


Reserved, RESO. 


Bit [11] 


Reserved, RESO. 


TDOSA, bit [10] 
When ARMV8.0-DoubleLock is implemented: 
Trap debug OS-related register access. Traps EL2 and EL1 System register accesses to the 
powerdown debug registers to EL3. 
Accesses to the registers are trapped as follows: 
° Accesses from AArch64 state, OSLAR_EL1,OSLSR_EL1,OSDLR_EL1,DBGPRCR_EL1 
and any IMPLEMENTATION DEFINED register with similar functionality that the 


implementation specifies as trapped by this bit, are trapped to EL3 and reported using EC 
syndrome value 0x18. 


. Accesses using MCR or MRC to DBGOSLAR, DBGOSLSR, DBGOSDLR, and 
DBGPRCR, are trapped to EL3 and reported using EC syndrome value 0x05. 


- Accesses to any IMPLEMENTATION DEFINED register with similar functionality that the 
implementation specifies as trapped by this bit. 

0bd This control does not cause any instructions to be trapped. 

Qb1 EL2 and EL1 System register accesses to the powerdown debug registers are trapped to 


EL3, unless it is trapped by HDCR.TDOSA or MDCR_EL2.TDOSA. 
Note 


The powerdown debug registers are not accessible at ELO. 








On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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TDA, bit [9] 


Trap debug OS-related register access. Traps EL2 and EL1 System register accesses to the 
powerdown debug registers to EL3. 


The following registers are affected by this trap: 
° AArch64: OSLAR_EL1, OSLSR_EL1, and DBGPRCR_EL1. 
° AArch32: DBGOSLAR, DBGOSLSR, and DBGPRCR. 


è AArch64 and AArch32: Any IMPLEMENTATION DEFINED register with similar functionality 
that the implementation specifies as trapped by this bit. 


` It is IMPLEMENTATION DEFINED whether accesses to OSDLR_EL1 and DBGOSDLR are 
trapped. 

0bd This control does not cause any instructions to be trapped. 

Qb1 EL2 and EL1 System register accesses to the powerdown debug registers are trapped to 


EL3, unless it is trapped by HDCR.TDOSA or MDCR_EL2.TDOSA. 


Note 
The powerdown debug registers are not accessible at ELO. 








On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Trap Debug Access. Traps EL2, EL1, and ELO System register accesses to those debug System 
registers that cannot be trapped using the MDCR_EL3.TDOSA field. 


Accesses to the debug registers are trapped as follows: 


° In AArch64 state, the following registers are trapped to EL3 and reported using EC syndrome 
value 0x18: 
—  DBGBVR<n>_EL1,DBGBCR<n>_EL1, DBGWVR<n>_EL1,DBGWCR<n>_EL1, 
DBGCLAIMSET_EL1, DBGCLAIMCLR_EL1, DBGAUTHSTATUS ELI, 
DBGVCR32_EL2. 


—  AArch64: MDCR_EL2, MDRAR_EL1, MDCCSR_ELO, MDCCINT_EL1, 
MDSCR_EL1, OSDTRRX_EL1, OSDTRTX_EL1, OSECCR_EL1. 


° In AArch32 state, SDER is trapped to EL3 and reported using EC syndrome value 0x03. 


. In AArch32 state, accesses using MCR or MRC to the following registers are reported using 
EC syndrome value 0x05, accesses using MCRR or MRRC are reported using EC syndrome 
value 0x0C: 


—  HDCR, DBGDRAR, DBGDSAR, DBGDIDR, DBGDCCINT, DBGWFAR, 
DBGVCR, DBGBVR<n>, DBGBCR<n>, DBGBXVR<n>, DBGWCR<n>, 
DBGWVR<n>. 


—  DBGCLAIMSET, DBGCLAIMCLR, DBGAUTHSTATUS, DBGDEVID, 
DBGDEVID1, DBGDEVID2, DBGOSECCR. 
. In AArch32 state, STC accesses to DBGDTRR Xint and LDC accesses to DBGDTRTXint are 
reported using EC syndrome value 0x06. 


- When not in Debug state, the following registers are also trapped to EL3: 


—  AdArch64 accesses to DBGDTR_ELO, DBGDTRRX_ELO, and DBGDTRTX_ELO, 
reported using EC syndrome value 0x18. 


—  AArch32 accesses using MCR or MRC to DBGDTRRXint and DBGDTRT Xint, 
reported using EC syndrome value 0x05. 


0bd This control does not cause any instructions to be trapped. 


Qb1 ELO, EL1, and EL2 accesses to the debug registers, other than the registers that can be 
trapped by MDCR_EL3.TDOSA, are trapped to EL3, from both Security states and 
both Execution states, unless it is trapped by DBGDSCRext.UDCCadis, 
MDSCR_EL1.TDCC, HDCR.TDA or MDCR_EL2.TDA. 
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On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Bits [8:7] 


Reserved, RESO. 


TPM, bit [6] 


When PMUV3 is implemented: 


Trap Performance Monitor register accesses. Accesses to all Performance Monitor registers from 
ELO, EL1 and EL2 to EL3, from both Security states and both Execution states are trapped as 
follows: 


In AArch64 state, accesses to the following registers are trapped to EL3 and are reported 
using EC syndrome value 0x18: 


—  PMCR ELO, PMCNTENSET ELO, PMCNTENCLR_ELO, PMOVSCLR_ELO, 
PMSWINC_ELO, PMSELR ELO, PMCEIDO ELO, PMCEID1 ELO, 
PMCCNTR_ELO,PMXEVTYPER ELO,PMXEVCNTR_ ELO, PMUSERENR ELO, 
PMINTENSET EL1, PMINTENCLR_ ELI, PMOVSSET ELO, 
PMEVCNTR<n>_ELO, PMEVTYPER<n>_EL0, PMCCFILTR_ELO. 


In AArch32 state, accesses using MCR or MRC to the following registers are reported using 
EC syndrome value 0x03, accesses using MCRR or MRRC are reported using EC syndrome 
value 0x04: 


—  PMCR, PMCNTENSET, PMCNTENCLR, PMOVSR, PMSWINC, PMSELR, 
PMCEIDO, PMCEID1, PMCCNTR, PMXEVTYPER, PMXEVCNTR, 
PMUSERENR, PMINTENSET, PMINTENCLR, PMOVSSET, PMEVCNTR<n>, 
PMEVTYPER<n>, PMCCFILTR. 


If ARMv8.4-PMU is implemented, in AArch64 state, PMMIR_EL1 and in AArch32 state, 
PMMIR. 


If ARMv8.1-PMU is implemented, in AArch32 state, PMCEID2 and PMCEID3. 


Qbd This control does not cause any instructions to be trapped. 


Qb1 EL2, EL1, and ELO System register accesses to all Performance Monitor registers are 


trapped to EL3, unless it is trapped by HDCR.TPM or MDCR_EL2.TPM. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Bits [5:0] 


Reserved, RESO. 


Accessing the MDCR_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MDCR_EL3 











op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0011 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
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elsif PSTATE.EL == EL3 then 
return MDCR_EL3; 


MSR MDCR_EL3, <Xt> 











op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0011 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
MDCR_EL3 = X[t]; 
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MDRAR_EL1, Monitor Debug ROM Address Register 
The MDRAR ELI characteristics are: 


Purpose 


Defines the base physical address of a 4K B-aligned memory-mapped debug component, usually a 
ROM table that locates and describes the memory-mapped debug components in the system. Armv8 
deprecates any use of this register. 


Configurations 


AArch6é4 System register MDRAR_EL1[63:0] is architecturally mapped to AArch32 System 
register DBGDRAR[63:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MDRAR ELI is a 64-bit register. 


Field descriptions 


The MDRAR EL! bit assignments are: 


63 52 51 48 47 12 11 210 


RESO ROMADDRJ47:12] | RESO g 


ROMADDR[51:48] — r 


Bits [63:52] 


Reserved, RESO. 


ROMADDRJ51:48], bits [51:48] 
When ARMV%8.2-LPA is implemented: 
Extension to ROMADDR[47:12]. See ROMADDR[47:12] for more details. 
Otherwise: 


Reserved, RESO. 


ROMADDR(47:12], bits [47:12] 
Bits[47:12] of the ROM table physical address. 


When ARMv8.2-LPA is implemented, ROMADDR[51:48] forms the upper part of the address 
value. Otherwise, ROMADDR[51:48] is RESO. 


If the physical address size in bits (PAsize) is less than 52, then the register bits corresponding to 
ROMADDR [51:PAsize] are RESO. 


Bits [11:0] of the ROM table physical address are zero. 


Arm strongly recommends that bits ROMADDR[(PAsize-1):32] are zero in any system that 
supports AArch32 at the highest implemented Exception level. 


In an implementation that includes EL3, ROMADDR is an address in Non-secure memory. It is 
IMPLEMENTATION DEFINED whether the ROM table is also accessible in Secure memory. 


Bits [11:2] 


Reserved, RESO. 
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Valid, bits [1:0] 
This field indicates whether the ROM Table address is valid. The permitted values of this field are: 
0b00 ROM Table address is not valid. Software must ignore ROMADDR. 
0b11 ROM Table address is valid. 


Other values are reserved. 


Accessing the MDRAR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MDRAR_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0001 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDRA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return MDRAR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return MDRAR_EL1; 
elsif PSTATE.EL == EL3 then 
return MDRAR_EL1; 
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D13.3.20 MDSCR_EL1, Monitor Debug System Control Register 
The MDSCR_EL1 characteristics are: 


Purpose 


Main control register for the debug implementation. 


Configurations 


AArch64 System register MDSCR_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGDSCRext[3 1:0]. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch64. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
MDSCR_ ELI is a 64-bit register. 


Field descriptions 


The MDSCR_ELI bit assignments are: 


63 32 31 30 29 28 27 26 25 24 23 22 21 2019 18 16 15 14 13 12 11 765 1 0 
RESO RESO RESO 
TFO ee | a ERR 
RXfull TDCC 
TXfull KDE 
RESO HDE 
RXO MDE 
TXU RAZ/WI 
RESO SC2 
INTdis RESO 
TDA 
Bits [63:32] 
Reserved, RESO. 
TFO, bit [31] 
When ARMV%8.4-Trace is implemented: 
Trace Filter override. Used for save/restore of EDSCR.TFO. 
When the OS Lock is unlocked, OSLSR_EL1.OSLK == 0, this bit ignores writes, and software must 
treat it as UNK/SBZP. 
When the OS Lock is locked, OSLSR_EL1.OSLK == 1, this bit is RW, and holds the value of 
EDSCR.TFO. 
Reads and writes of this bit are indirect accesses to EDSCR.TFO. 
Otherwise: 
Reserved, RESO. 
RXfull, bit [30] 
Used for save/restore of EDSCR.RXfull. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
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When OSLSR_EL1.OSLK == 1, this bit is RW and holds the value of EDSCR.RXfull. 
Reads and writes of this bit are indirect accesses to EDSCR.RXfull. 


The architected behavior of this field determines the value it returns after a reset. 


TXfull, bit [29] 
Used for save/restore of EDSCR.TXfull. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When OSLSR_EL1.OSLK == 1, this bit is RW and holds the value of EDSCR.TXfull. 
Reads and writes of this bit are indirect accesses to EDSCR.TXfull. 
The architected behavior of this field determines the value it returns after a reset. 

Bit [28] 
Reserved, RESO. 

RXO, bit [27] 
Used for save/restore of EDSCR.RXO. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When OSLSR_EL1.OSLK == 1, this bit is RW and holds the value of EDSCR.RXO. 
Reads and writes of this bit are indirect accesses to EDSCR.RXO. 
The architected behavior of this field determines the value it returns after a reset. 

TXU, bit [26] 
Used for save/restore of EDSCR.TXU. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When OSLSR_EL1.O0SLK == 1, this bit is RW and holds the value of EDSCR.TXU. 
Reads and writes of this bit are indirect accesses to EDSCR.TXU. 
The architected behavior of this field determines the value it returns after a reset. 

Bits [25:24] 
Reserved, RESO. 

INTdis, bits [23:22] 
Used for save/restore of EDSCR.INTdis. 
When OSLSR_EL1.OSLK == 0, this field is RO, and software must treat it as UNK/SBZP. 
When OSLSR_EL1.OSLK == 1, this field is RW and holds the value of EDSCR.INTdis. 
Reads and writes of this field are indirect accesses to EDSCR.INTdis. 
The architected behavior of this field determines the value it returns after a reset. 

TDA, bit [21] 
Used for save/restore of EDSCR.TDA. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When OSLSR_EL1.OSLK == 1, this bit is RW and holds the value of EDSCR.TDA. 
Reads and writes of this bit are indirect accesses to EDSCR.TDA. 
The architected behavior of this field determines the value it returns after a reset. 

Bit [20] 


Reserved, RESO. 
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SC2, bit [19] 


When ARMV8.0-PCSample is implemented, ARMv8.1-VHE is implemented and 
ARMv8.2-PCSample is not implemented: 


Used for save/restore of EDSCR.SC2. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When OSLSR_EL1.OSLK == 1, this bit is RW and holds the value of EDSCR.SC2. 
Reads and writes of this bit are indirect accesses to EDSCR.SC2. 

Otherwise: 


Reserved, RESO. 


Bits [18:16] 
Reserved, RAZ/WI. 
Hardware must implement this field as RAZ/WI. Software must not rely on the register reading as 
zero, and must use a read-modify-write sequence to write to the register. 
MDE, bit [15] 
Monitor debug events. Enable Breakpoint, Watchpoint, and Vector Catch exceptions. 
0bd Breakpoint, Watchpoint, and Vector Catch exceptions disabled. 
Qb1 Breakpoint, Watchpoint, and Vector Catch exceptions enabled. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


HDE, bit [14] 
Used for save/restore of EDSCR.HDE. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When OSLSR_EL1.OSLK == 1, this bit is RW and holds the value of EDSCR.HDE. 
Reads and writes of this bit are indirect accesses to EDSCR.HDE. 


The architected behavior of this field determines the value it returns after a reset. 


KDE, bit [13] 


Local (kernel) debug enable. If ELp is using AArch64, enable debug exceptions within ELp. 
Permitted values are: 


Qbd Debug exceptions, other than Breakpoint Instruction exceptions, disabled within ELp. 
Qb1 All debug exceptions enabled within ELp. 
RESO if ELp is using AArch32. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


TDCC, bit [12] 


Traps ELO accesses to the Debug Communication Channel (DCC) registers to EL1, or to EL2 when 
it is implemented and enabled for the current Security state and HCR_EL2.TGE is 1, from both 
Execution states, as follows: 


. In AArch64 state, MRS or MSR accesses to the following DCC registers are trapped, 
reported using EC syndrome value 0x18: 


—  MDCCSR ELO. 
— Ifnot in Debug state, DBGDTR_EL0, DBGDTRTX_EL0, and DBGDTRRX_ELO. 


. In AArch32 state, MRC or MCR accesses to the following registers are trapped, reported 
using EC syndrome value 0x05. 


— DBGDSCRint, DBGDIDR, DBGDSAR, DBGDRAR,. 
—  Ifnot in Debug state, DBGDTRRXint, and DBGDTRTXint. 
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° In AArch32 state, LDC access to DBGDTRRXint and STC access to DBGDTRTXint are 
trapped, reported using EC syndrome value 0x06. 


e In AArch32 state, MRRC accesses to DBGDSAR and DBGDRAR are trapped, reported 
using EC syndrome value 0x0C. 


Qbd This control does not cause any instructions to be trapped. 


Qb1 ELO using AArch64: ELO accesses to the AArch64 DCC registers are trapped. 
ELO using AArch32: ELO accesses to the AArch32 DCC registers are trapped. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bits [11:7] 
Reserved, RESO. 
ERR, bit [6] 
Used for save/restore of EDSCR.ERR. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When OSLSR_EL1.OSLK == 1, this bit is RW and holds the value of EDSCR.ERR. 
Reads and writes of this bit are indirect accesses to EDSCR.ERR. 
The architected behavior of this field determines the value it returns after a reset. 
Bits [5:1] 


Reserved, RESO. 


SS, bit [0] 
Software step control bit. If ELp is using AArch64, enable Software step. Permitted values are: 
0bd Software step disabled 
Qb1 Software step enabled. 


RESO if ELp is using AArch32. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Accessing the MDSCR_EL1 


Individual fields within this register might have restricted accessibility when OSLSR_EL1.O0SLK == 0 (the OS lock 
is unlocked). See the field descriptions for more detail. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, MDSCR_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0000 0b0010 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@Q@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
return NVMem[0x158]; 
else 
return MDSCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
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D13.3 Debug registers 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return MDSCR_EL1; 
elsif PSTATE.EL == EL3 then 
return MDSCR_EL1; 
MSR MDSCR_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b10 0b000 0b0000 0b0010 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
NVMem[@x158] = X[t]; 
else 
MDSCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
MDSCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
MDSCR_EL1 = X[t]; 
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D13.3.21 ©OSDLR_EL1, OS Double Lock Register 
The OSDLR_EL1 characteristics are: 


Purpose 
Used to control the OS Double Lock. 


Configurations 


AArch64 System register OSDLR_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGOSDLR[31:0]. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch64. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
OSDLR_EL1 is a 64-bit register. 


Field descriptions 


The OSDLR_EL] bit assignments are: 


63 1 0 


RESO 


fe DLK 


Bits [63:1] 


Reserved, RESO. 


DLK, bit [0] 
When ARMV8.0-DoubleLock is implemented: 
OS Double Lock control bit. 
Qbe OS Double Lock unlocked. 


Qb1 OS Double Lock locked, if DBGPRCR_EL1.CORENPDRQ (Core no powerdown 
request) bit is set to 0 and the PE is in Non-debug state. 


On a Warm reset, this field resets to 0. 
Otherwise: 


Reserved, RAZ/WI. 


Accessing the OSDLR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, OSDLR_EL1 
op0 op1 CRn CRm op2 
0b10 0b000 0b0001 0b0011 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != '00' && 
(IsFeatureImplemented("ARMv8.0-DoubleLock") || boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL2.TDOSA") then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' && 
(IsFeatureImplemented("ARMv8.0-DoubleLock") || boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL3.TDOSA") then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return OSDLR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' && 
(IsFeatureImp]lemented("ARMv8.0-DoubleLock") || boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL3.TDOSA") then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return OSDLR_EL1; 
elsif PSTATE.EL == EL3 then 
return OSDLR_EL1; 


MSR OSDLR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b10 0b000 0b0001 0b0011 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != 'Q0' && 
(IsFeatureImplemented("ARMv8.0-DoubleLock") || boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL2.TDOSA") then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' && 
(IsFeatureImp]lemented("ARMv8.0-DoubleLock") || boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL3.TDOSA") then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
OSDLR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' && 
(IsFeatureImplemented("ARMv8.0-DoubleLock") || boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL3.TDOSA") then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
OSDLR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
OSDLR_EL1 = X[t]; 
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D13.3.22 ©OSDTRRX_EL1, OS Lock Data Transfer Register, Receive 


The OSDTRRX_ELI characteristics are: 


Purpose 
Used for save/restore of DBGDTRRX_ELO. It is a component of the Debug Communications 
Channel. 

Configurations 
AArch64 System register OSDTRRX_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGDTRR Xext[3 1:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


OSDTRRX_ ELI is a 64-bit register. 


Field descriptions 


The OSDTRRX_ELI bit assignments are: 


63 32 31 0 


RESO Update DTRRX without side-effect 





Bits [63:32] 
Reserved, RESO. 
Bits [31:0] 
Update DTRRX without side-effect. 
Writes to this register update the value in DTRRX and do not change RXfull. 
Reads of this register return the last value written to DTRRX and do not change RXfull. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


Accessing the OSDTRRX_EL1 
Arm deprecates reads and writes of OSDTRRX_EL1 when the OS Lock is unlocked. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, OSDTRRX_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0000 0b0000 0b010 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return OSDTRRX_EL1; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return OSDTRRX_EL1; 
elsif PSTATE.EL == EL3 then 
return OSDTRRX_EL1; 


MSR OSDTRRX_EL1, <Xt> 


D13.3 Debug registers 





op0 op1 CRn CRm 


op2 





0b10 0b000 0b0000 0b0000 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
OSDTRRX_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
OSDTRRX_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
OSDTRRX_EL1 = X[t]; 
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D13.3.23 OSDTRTX_EL1, OS Lock Data Transfer Register, Transmit 


The OSDTRTX_ELI characteristics are: 


Purpose 
Used for save/restore of DBGDTRTX_ELO. It is a component of the Debug Communications 
Channel. 

Configurations 
AArch64 System register OSDTRTX_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGDTRT Xext[3 1:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


OSDTRTX_ELI is a 64-bit register. 


Field descriptions 


The OSDTRTX_EL1 bit assignments are: 


63 32 31 0 


RESO Return DTRTX without side-effect 





Bits [63:32] 
Reserved, RESO. 
Bits [31:0] 
Return DTRTX without side-effect. 
Reads of this register return the value in DTRTX and do not change TXfull. 
Writes of this register update the value in DTRTX and do not change TXfull. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


Accessing the OSDTRTX_EL1 
Arm deprecates reads and writes of OSDTRTX_EL1 when the OS Lock is unlocked. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, OSDTRTX_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0000 0b0011 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return OSDTRTX_EL1; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return OSDTRTX_EL1; 
elsif PSTATE.EL == EL3 then 
return OSDTRTX_EL1; 


MSR OSDTRTX_EL1, <Xt> 


D13.3 Debug registers 





op0 op1 CRn CRm 


op2 





0b10 0b000 0b0000 0b0011 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
OSDTRTX_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
OSDTRTX_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
OSDTRTX_EL1 = X[t]; 
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D13.3.24 OSECCR_EL1, OS Lock Exception Catch Control Register 
The OSECCR_ELI characteristics are: 


Purpose 


Provides a mechanism for an operating system to access the contents of EDECCR that are otherwise 
invisible to software, so it can save/restore the contents of EDECCR over powerdown on behalf of 
the external debugger. 


Configurations 


AArch64 System register OSECCR_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGOSECCR[3 1:0]. 


AArch64 System register OSECCR_EL1[31:0] is architecturally mapped to External register 
EDECCR{31:0]. 


If OSLSR_EL1.OSLK == 0, then OSECCR_EL1 returns an UNKNOWN value on reads and ignores 
writes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
OSECCR_EL1 is a 64-bit register. 


Field descriptions 


The OSECCR_EL1 bit assignments are: 


When DBGOSLSR.OSLK == 1: 


63 32 31 0 


RESO EDECCR 


Bits [63:32] 


Reserved, RESO. 


EDECCR, bits [31:0] 
Used for save/restore to EDECCR over powerdown. 


Reads or writes to this field are indirect accesses to EDECCR. 


Accessing the OSECCR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, OSECCR_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0000 0b0110 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
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else 
return OSECCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return OSECCR_EL1; 
elsif PSTATE.EL == EL3 then 
return OSECCR_EL1; 
MSR OSECCR_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b10 0b000 0b0000 0b0110 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
OSECCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
OSECCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
OSECCR_EL1 = X[t]; 
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D13.3.25 OSLAR_EL1, OS Lock Access Register 


63 


D13-3510 


The OSLAR_EL1 characteristics are: 


Purpose 
Used to lock or unlock the OS Lock. 


Configurations 


AArch6é4 System register OSLAR_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGOSLAR[31:0]. 


AArch64 System register OSLAR_EL1[31:0] is architecturally mapped to External register 
OSLAR_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
OSLAR_EL1 is a 64-bit register. 


Field descriptions 


The OSLAR_EL1 bit assignments are: 


RESO 


E OSLK 


Bits [63:1] 


Reserved, RESO. 


OSLK, bit [0] 
On writes to OSLAR_ELI, bit[0] is copied to the OS Lock. 
Use OSLSR_EL1.OSLK to check the current status of the lock. 


Accessing the OSLAR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MSR OSLAR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b10 0b000 0b0001 0b0000 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != 'Q@Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
OSLAR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
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else 
OSLAR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
OSLAR_EL1 = X[t]; 
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D13.3.26 OSLSR_EL1, OS Lock Status Register 
The OSLSR_EL1 characteristics are: 


Purpose 


Provides the status of the OS Lock. 


Configurations 


AArch64 System register OSLSR_EL1[31:0] is architecturally mapped to AArch32 System register 
DBGOSLSRJ3 1:0]. 


This register is in the Cold reset domain. Some or all RW fields of this register have defined reset 
values. On a Cold reset these apply only if the PE resets into an Exception level that is using 
AArch64. Otherwise, on a Cold reset RW fields in this register reset to architecturally UNKNOWN 
values.The register is not affected by a Warm reset. 


Attributes 
OSLSR_ EL] is a 64-bit register. 


Field descriptions 


The OSLSR_ELI bit assignments are: 


63 43210 
RESO 
ae 
OSLK 
nTT 
OSLM[1] 
Bits [63:4] 


Reserved, RESO. 


OSLM[1], bit [3] 
This field is bit[1] of OSLM[1:0]. 
OS lock model implemented. Identifies the form of OS save and restore mechanism implemented. 
0bd0 OS Lock not implemented. 
0b10 OS Lock implemented. 
All other values are reserved. In an Armv8 implementation the value 0b00 is not permitted. 
The OSLM field is split as follows: 
$ OSLM[1] is OSLSR_EL1[3]. 
: OSLM[0] is OSLSR_EL1[0]. 


nTT, bit [2] 
Not 32-bit access. This bit is always RAZ. It indicates that a 32-bit access is needed to write the key 
to the OS Lock Access Register. 
OSLK, bit [1] 
OS Lock Status. 
Qbd OS Lock unlocked. 
Qb1 OS Lock locked. 
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The OS Lock is locked and unlocked by writing to the OS Lock Access Register. 
On a Cold reset, this field resets to 1. 


OSLM[0], bit [0] 
This field is bit[0] of OSLM[1:0]. 
See OSLM[1] for the field description. 


Accessing the OSLSR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, OSLSR_EL1 





op0 op1 CRn CRm op2 





0b10 0b000 0b0001 0b0001 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != '00' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return OSLSR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return OSLSR_EL1; 
elsif PSTATE.EL == EL3 then 
return OSLSR_EL1; 
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D13.3.27 SDER32_EL2, AArch32 Secure Debug Enable Register 


The SDER32_EL2 characteristics are: 


Purpose 
Allows access to the AArch32 register SDER from Secure EL2 and EL3 only. 
Configurations 
This register is present only when ARMv8.4-SecEL2 is implemented, EL1 supports AArch32 and 
(HaveEL(EL3) or the implemented Security state is Secure state). Otherwise, direct accesses to 
SDER32_EL2 are UNDEFINED. 
This register is ignored by the PE when one or more of the following are true: 
° The PE is in Non-secure state. 
: EL1 is using AArch64. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SDER32_EL2 is a 64-bit register. 


Field descriptions 


The SDER32_EL2 bit assignments are: 


63 21 0 


= SUIDEN 
SUNIDEN 


RESO 


Bits [63:2] 
Reserved, RESO. 


SUNIDEN, bit [1] 


Secure User Non-Invasive Debug Enable. 


Qbd This bit does not affect Performance Monitors event counting at Secure ELO. 
Qb1 If EL1 is using AArch32, Performance Monitors event counting is allowed in Secure 
ELO. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


SUIDEN, bit [0] 
Secure User Invasive Debug Enable. 
0bd This bit does not affect the generation of debug exceptions at Secure ELO. 
Qb1 If EL1 is using AArch32, debug exceptions from Secure ELO are enabled. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Accessing the SDER32_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, SDER32_EL2 














op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0011 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return SDER32_EL2; 
elsif PSTATE.EL == EL3 then 
return SDER32_EL2; 
MSR SDER32_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0011 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
SDER32_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
SDER32_EL2 = X[t]; 
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D13.3.28 


D13-3516 


SDER32_EL3, AArch32 Secure Debug Enable Register 
The SDER32_EL3 characteristics are: 


Purpose 


Allows access to the AArch32 register SDER from AArch64 state only. Its value has no effect on 
execution in AArch64 state. 


Configurations 


AArch64 System register SDER32_EL3[31:0] is architecturally mapped to AArch32 System 
register SDER[3 1:0]. 


This register is present only when EL1 supports AArch32. Otherwise, direct accesses to 
SDER32_EL3 are UNDEFINED. 


This register is ignored by the PE when one or more of the following are true: 
° The PE is in Non-secure state. 
. EL1 is using AArch64. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
SDER32_EL3 is a 64-bit register. 


Field descriptions 


The SDER32_EL3 bit assignments are: 


63 210 


L SUIDEN 
SUNIDEN 


RESO 


Bits [63:2] 
Reserved, RESO. 


SUNIDEN, bit [1] 


Secure User Non-Invasive Debug Enable. 


Obd This bit does not affect Performance Monitors event counting at Secure ELO. 
Qb1 If EL1 is using AArch32, Performance Monitors event counting is allowed in Secure 
ELO. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


SUIDEN, bit [0] 
Secure User Invasive Debug Enable. 
Ob This bit does not affect the generation of debug exceptions at Secure ELO. 
Qb1 If EL1 is using AArch32, debug exceptions from Secure ELO are enabled. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Accessing the SDER32_EL3 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, SDER32_EL3 
op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0001 0b001 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return SDER32_EL3; 
MSR SDER32_EL3, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b110 0b0001 0b0001 0b001 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
SDER32_EL3 = X[t]; 
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D13.3.29 TRFCR_EL1, Trace Filter Control Register (EL1) 
The TRFCR_EL1 characteristics are: 
Purpose 
Provides EL1 controls for Trace. 


Configurations 


AArch64 System register TRFCR_EL1[31:0] is architecturally mapped to AArch32 System 
register TRFCR[31:0]. 


This register is present only when ARMV8.4-Trace is implemented. Otherwise, direct accesses to 
TRFCR_EL1 are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
TRFCR_EL1 is a 64-bit register. 


Field descriptions 


The TRFCR_EL1 bit assignments are: 


63 


RESO 





Bits [63:7] 

Reserved, RESO. 
TS, bits [6:5] 

Timestamp Control 


0b01 Virtual timestamp. The traced timestamp is the physical counter value, minus the value 
of CNTVOFF _EL2. 


0b11 Physical timestamp. The traced timestamp is the physical counter value. 


All other values are reserved 

This field is ignored if any of the following are true: 

° SelfHostedTraceEnabled() == FALSE. 

° EL2 is implemented and TRFCR_EL2.TS != 0b00. 
Bits [4:2] 

Reserved, RESO. 
E1TRE, bit [1] 

EL1 Trace Enable. 

Qbd Trace is prohibited at EL1. 

Qb1 Trace is allowed at EL1. 

When SelfHostedTraceEnabled() == FALSE, this field is ignored. 


On a Warm reset, this field resets to 0. 
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EOTRE, bit [0] 


ELO Trace Enable. 
Qbd Trace is prohibited at ELO. 
Ob1 Trace is allowed at ELO. 


This field is ignored if any of the following are true: 
° SelfHostedTraceEnabled() == FALSE. 
- EL2 is implemented and enabled in the current Security state and HCR_EL2.TGE == 1. 


On a Warm reset, this field resets to 0. 


Accessing the TRFCR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TRFCR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0010 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TTRF == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x880] ; 
else 
return TRFCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
return TRFCR_EL2; 
else 
return TRFCR_EL1; 
elsif PSTATE.EL == EL3 then 
return TRFCR_EL1; 


MSR TRFCR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0010 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TTRF == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x880] = X[t]; 
else 
TRFCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
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D13-3520 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

elsif HCR_EL2.E2H == '1' then 
TRFCR_EL2 = X[t]; 

else 
TRFCR_EL1 = X[t]; 

elsif PSTATE.EL == EL3 then 
TRFCR_EL1 = X[t]; 


MRS <Xt>, TRFCR_EL12 

















op0 op1 CRn CRm op2 
0b11 0b101 0b0001 0b0010 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x880] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return TRFCR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return TRFCR_EL1; 
else 
UNDEFINED; 
MSR TRFCR_EL12, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b101 0b0001 0b0010 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[0x880] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
TRFCR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
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if EL2Enabled() && HCR_EL2.E2H == '1' then 
TRFCR_EL1 = X[t]; 
else 
UNDEFINED; 
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D13.3.30  TRFCR_EL2, Trace Filter Control Register (EL2) 
The TRFCR_EL2 characteristics are: 


Purpose 


Provides EL2 controls for Trace. 


Configurations 


AArch64 System register TRFCR_EL2[31:0] is architecturally mapped to AArch32 System 
register HTRFCR[3 1:0]. 


This register is present only when ARMV8.4-Trace is implemented. Otherwise, direct accesses to 
TRFCR_EL2 are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
TRFCR_EL2 is a 64-bit register. 


Field descriptions 


The TRFCR_EL2 bit assignments are: 


63 






RESO 


L EOHTRE 
E2TRE 


RESO 
CX 
RESO 


Bits [63:7] 


Reserved, RESO. 


TS, bits [6:5] 
Timestamp Control. Controls which timebase is used for trace timestamps. 
0b00 Timestamp controlled by TRFCR_EL1.TS or TRFCR.TS. 


0b01 Virtual timestamp. The traced timestamp is the physical counter value, minus the value 
of CNTVOFF_EL2. 


0b11 Physical timestamp. The traced timestamp is the physical counter value. 
This field is ignored if SelfHostedTraceEnabled() == FALSE. 


On a Warm reset, this field resets to 0. 

Bit [4] 
Reserved, RESO. 

CX, bit [3] 
CONTEXTIDR_EL2 and VMID trace enable. 
Obd CONTEXTIDR_EL2 and VMID trace prohibited. 
Qb1 CONTEXTIDR_EL2 and VMID trace allowed. 
This field is ignored if SelfHostedTraceEnabled() == FALSE. 
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On a Warm reset, this field resets to 0. 
Bit [2] 
Reserved, RESO. 


E2TRE, bit [1] 


EL2 Trace Enable. 
Qbd Trace is prohibited at EL2. 
Qb1 Trace is allowed at EL2. 


When SelfHostedTraceEnabled() == FALSE, this field is ignored. 


On a Warm reset, this field resets to 0. 


EOHTRE, bit [0] 


ELO Trace Enable. 
Qbd Trace is prohibited at ELO when HCR_EL2.TGE == 1. 
Qb1 Trace is allowed at ELO when HCR_EL2.TGE == 1. 


This field is ignored if any of the following are true: 
° HCR_EL2.TGE == 0. 

° SelfHostedTraceEnabled() == FALSE. 

° EL2 is disabled in the current security state. 


On a Warm reset, this field resets to 0. 


Accessing the TRFCR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, TRFCR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0001 0b0010 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return TRFCR_EL2; 
elsif PSTATE.EL == EL3 then 
return TRFCR_EL2; 
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MSR TRFCR_EL2, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b100 0b0001 0b0010 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
TRFCR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
TRFCR_EL2 = X[t]; 


MRS <Xt>, TRFCR_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0010 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TTRF == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x88Q] ; 
else 
return TRFCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
return TRFCR_EL2; 
else 
return TRFCR_EL1; 
elsif PSTATE.EL == EL3 then 
return TRFCR_EL1; 


MSR TRFCR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b0001 0b0010 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TTRF == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
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AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x880] = X[t]; 
else 
TRFCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
TRFCR_EL2 = X[t]; 
else 
TRFCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
TRFCR_EL1 = X[t]; 
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D13.4 Performance Monitors registers 


This section lists the Performance Monitoring registers in AArch64. 
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D13.4.1 PMCCFILTR_ELO, Performance Monitors Cycle Count Filter Register 
The PMCCFILTR_ELO characteristics are: 


Purpose 
Determines the modes in which the Cycle Counter, PMCCNTR_ELO, increments. 


Configurations 


AArch64 System register PMCCFILTR_ELO0[3 1:0] is architecturally mapped to AArch32 System 
register PMCCFILTR[31:0]. 


AArch64 System register PMCCFILTR_ELO0[31:0] is architecturally mapped to External register 
PMCCFILTR_EL0[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMCCFILTR_ELO is a 64-bit register. 


Field descriptions 


The PMCCFILTR_ELO bit assignments are: 


63 32 31 30 29 28 27 26 25 24 23 0 


RESO 





Bits [63:32] 


Reserved, RESO. 


P, bit [31] 


Privileged filtering bit. Controls counting in EL1. If EL3 is implemented, then counting in 
Non-secure EL] is further controlled by the PMCCFILTR_ELO.NSK bit. The possible values of this 
bit are: 


Obd Count cycles in EL1. 
Qb1 Do not count cycles in EL1. 


This field resets to an architecturally UNKNOWN value. 


U, bit [30] 


User filtering bit. Controls counting in ELO. If EL3 is implemented, then counting in Non-secure 
ELO is further controlled by the PMCCFILTR_ELO.NSU bit. The possible values of this bit are: 


Qbd Count cycles in ELO. 
Qb1 Do not count cycles in ELO. 


This field resets to an architecturally UNKNOWN value. 


NSK, bit [29] 


Non-secure EL1 (kernel) modes filtering bit. Controls counting in Non-secure EL1. If EL3 is not 
implemented, this bit is RESO. 
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NSU, bit [28] 


NSH, bit [27] 


M, bit [26] 


Bit [25] 


SH, bit [24] 


Ifthe value of this bit is equal to the value of the PMCCFILTR_ELO.P bit, cycles in Non-secure EL1 
are counted. 


Otherwise, cycles in Non-secure EL1 are not counted. 


This field resets to an architecturally UNKNOWN value. 


Non-secure ELO (Unprivileged) filtering bit. Controls counting in Non-secure ELO. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMCCFILTR_ELO.U bit, cycles in Non-secure 
ELO are counted. 


Otherwise, cycles in Non-secure ELO are not counted. 


This field resets to an architecturally UNKNOWN value. 


EL2 (Hypervisor) filtering bit. Controls counting in EL2. If EL2 is not implemented, this bit is RESO. 
If Secure EL2 is implemented, counting in Secure EL2 is further controlled by the 
PMCCFILTR_ELO.SH bit. 


Qbd Do not count cycles in EL2. 
Qb1 Count cycles in EL2. 
This field resets to an architecturally UNKNOWN value. 


Secure EL3 filtering bit. If EL3 is not implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMCCFILTR_ELO.P bit, cycles in Secure EL3 are 
counted. 


Otherwise, cycles in Secure EL3 are not counted. 


Most applications can ignore this field and set its value to 0. 





Note 
This field is not visible in the AArch32 PMCCFILTR System register. 





This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


When ARMV8.4-SecEL2 is implemented: 


Secure EL2 filtering. 


If the value of this bit is not equal to the value of the PMCCFILTR_ELO.NSH bit, cycles in Secure 
EL2 are counted. 


Otherwise, cycles in Secure EL2 are not counted. 


If Secure EL2 is not implemented or is disabled, this field is RESO. 


Note 
This field is not visible in the AArch32 PMCCFILTR System register. 








This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 
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Bits [23:0] 


Reserved, RESO. 


Accessing the PMCCFILTR_ELO 
PMCCFILTR_ELO can also be accessed by using PMXEVTYPER ELO with PMSELR_ELO.SEL set to 0b11111. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMCCFILTR_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 Ob1111 0b111 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCCFILTR_ELQ; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCCFILTR_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCCFILTR_ELO; 
elsif PSTATE.EL == EL3 then 
return PMCCFILTR_ELQ; 


MSR PMCCFILTR_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 Ob1111 0b111 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCCFILTR_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCCFILTR_EL@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCCFILTR_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
PMCCFILTR_EL@ = X[t]; 
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D13.4.2 PMCCNTR_ELO, Performance Monitors Cycle Count Register 


The PMCCNTR_ELO characteristics are: 


63 


ARM DDI 0487E.a 
ID070919 


Purpose 


Holds the value of the processor Cycle Counter, CCNT, that counts processor clock cycles. See Time 
as measured by the Performance Monitors cycle counter on page D7-2671 for more information. 


PMCCFILTR_ELO determines the modes and states in which the PMCCNTR_ELO can increment. 


Configurations 


Attributes 


AArch64 System register PMCCNTR_EL0[63:0] is architecturally mapped to AArch32 System 
register PMCCNTR[63:0]. 


AArch64 System register PMCCNTR_EL0[63:0] is architecturally mapped to External register 
PMCCNTR_ELO[63:0]. 


All counters are subject to any changes in clock frequency, including clock stopping caused by the 
WFI and WFE instructions. This means that it is CONSTRAINED UNPREDICTABLE whether or not 
PMCCNTR_ELO continues to increment when clocks are stopped by WFI and WFE instructions. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


PMCCNTR_ELO is a 64-bit register. 


Field descriptions 


The PMCCNTR_ELO bit assignments are: 


CCNT 


CCNT, bits [63:0] 


Cycle count. Depending on the values of PMCR_ELO.{LC,D}, this field increments in one of the 
following ways: 


° Every processor clock cycle. 
° Every 64th processor clock cycle. 
Writing 1 to PMCR_ELO.C sets this field to 0. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMCCNTR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMCCNTR_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1001 0b1101 0b000 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.<CR,EN> == '00' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
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else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCCNTR_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCCNTR_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCCNTR_ELO; 
elsif PSTATE.EL == EL3 then 
return PMCCNTR_ELO; 


MSR PMCCNTR_ELO, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b011 0b1001 0b1101 


0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCCNTR_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCCNTR_EL@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCCNTR_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
PMCCNTR_EL@ = X[t]; 
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D13.4.3 PMCEIDO_ELO, Performance Monitors Common Event Identification register 0 


ARM DDI 0487E.a 
ID070919 


The PMCEIDO_ELO characteristics are: 











Purpose 
Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the ranges 0x0000 to 0x001F and 0x4000 to 0x401F. 
When the value of a bit in the register is 1 the corresponding common event is implemented and 
counted. 

Note 

Arm recommends that, if a common event is never counted, the value of the corresponding register 
bit is 0. 
For more information about the common events and the use of the PMCEID<n>_EL0 registers see 
The PMU event number space and common events on page D7-2693. 

Configurations 
AArch64 System register PMCEIDO_ EL0[31:0] is architecturally mapped to AArch32 System 
register PMCEIDO[31:0]. 
AArch64 System register PMCEIDO_ EL0[63:32] is architecturally mapped to AArch32 System 
register PMCEID2[31:0]. 
AArch64 System register PMCEIDO_EL0[31:0] is architecturally mapped to External register 
PMCEIDO[31:0]. 
AArch64 System register PMCEIDO_EL0[63:32] is architecturally mapped to External register 
PMCEID2[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


PMCEIDO ELO is a 64-bit register. 


Field descriptions 


The PMCEIDO_ELO bit assignments are: 
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32 31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 12 11109876543210 








— E 
— 
=e | | IDO 
ID1 
ID2 
ID3 
ID4 
ID5 
ID6 
ID7 
ID8 
ID9 
ID10 
ID11 
ID12 
ID13 
ID14 
ID15 
ID16 
ID17 
ID18 
ID19 
ID20 
IDhi<n>, bit [n+32], for n = 0 to 31 
When ARMv8.1-PMU is implemented: 
IDhi[n] corresponds to common event (0x4000 + n). 
For each bit: 
Qbd The common event is not implemented, or not counted. 
Qb1 The common event is implemented. 
A bit that corresponds to a reserved event number is reserved. The value might be used in a future 
revision of the architecture to identify an additional common event. 
Note 
Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n>_ELO registers of that earlier version of the PMU architecture. 
Otherwise: 
Reserved, RESO. 
ID<n>, bit [n], for n = 0 to 31 
ID[n] corresponds to common event n. 
For each bit: 
Qbd The common event is not implemented, or not counted. 
Qb1 The common event is implemented. 
A bit that corresponds to a reserved event number is reserved. The value might be used in a future 
revision of the architecture to identify an additional common event. 
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Note 


Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n>_EL0 registers of that earlier version of the PMU architecture. 








Accessing the PMCEIDO_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMCEIDO_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1001 0b1100 0b110 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCEIDQ_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





return PMCEIDQ_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCEIDQ_ELQ; 
elsif PSTATE.EL == EL3 then 
return PMCEIDQ_ELQ; 
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D13.4.4 


D13-3536 


PMCEID1_ELO, Performance Monitors Common Event Identification register 1 


The PMCEID1_ELO characteristics are: 











Purpose 
Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the ranges 0x0020 to 0x003F and 0x4020 to 0x403F. 
When the value of a bit in the register is 1 the corresponding common event is implemented and 
counted. 

Note 

Arm recommends that, if a common event is never counted, the value of the corresponding register 
bit is 0. 
For more information about the common events and the use of the PMCEID<n>_EL0 registers see 
The PMU event number space and common events on page D7-2693. 

Configurations 
AArch64 System register PMCEID1_ EL0[31:0] is architecturally mapped to AArch32 System 
register PMCEID1[31:0]. 
AArch64 System register PMCEID1_ EL0[63:32] is architecturally mapped to AArch32 System 
register PMCEID3[31:0]. 
AArch64 System register PMCEID1_ EL0[31:0] is architecturally mapped to External register 
PMCEID1[31:0]. 
AArch64 System register PMCEID1_ EL0[63:32] is architecturally mapped to External register 
PMCEID3[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


PMCEID1 ELO is a 64-bit register. 


Field descriptions 


The PMCEID1_ELO bit assignments are: 
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32 31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 12 11109876543210 








— E 
— 
=e | | IDO 
ID1 
ID2 
ID3 
ID4 
ID5 
ID6 
ID7 
ID8 
ID9 
ID10 
ID11 
ID12 
ID13 
ID14 
ID15 
ID16 
ID17 
ID18 
ID19 
ID20 
IDhi<n>, bit [n+32], for n = 0 to 31 
When ARMv8.1-PMU is implemented: 
IDhi[n] corresponds to common event (0x4020 + n). 
For each bit: 
Qbd The common event is not implemented, or not counted. 
Qb1 The common event is implemented. 
A bit that corresponds to a reserved event number is reserved. The value might be used in a future 
revision of the architecture to identify an additional common event. 
Note 
Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n>_ELO registers of that earlier version of the PMU architecture. 
Otherwise: 
Reserved, RESO. 
ID<n>, bit [n], for n = 0 to 31 
ID[n] corresponds to common event (0x0020 + n). 
For each bit: 
Qbd The common event is not implemented, or not counted. 
Qb1 The common event is implemented. 
A bit that corresponds to a reserved event number is reserved. The value might be used in a future 
revision of the architecture to identify an additional common event. 
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Note 


Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n>_EL0 registers of that earlier version of the PMU architecture. 








Accessing the PMCEID1_EL0O 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMCEID1_EL0O 





op0 op1 CRn CRm op2 





0b11 0b011 0b1001 0b1100 0b111 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCEID1_EL0; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





return PMCEID1_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCEID1_ELQ; 
elsif PSTATE.EL == EL3 then 
return PMCEID1_ELQ; 
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D13.4.5 PMCNTENCLR_ELO, Performance Monitors Count Enable Clear register 
The PMCNTENCLR_ELO characteristics are: 


Purpose 


Disables the Cycle Count Register, PMCCNTR_ELO, and any implemented event counters 
PMEVCNTR<n>. Reading this register shows which counters are enabled. 


Configurations 


AArch64 System register PMCNTENCLR_ELO[31:0] is architecturally mapped to AArch32 
System register PMCNTENCLRJ3 1:0]. 


AArch64 System register PACNTENCLR_ELO[31:0] is architecturally mapped to External 
register PMCNTENCLR_ELO[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMCNTENCLR _ ELO is a 64-bit register. 


Field descriptions 


The PMCNTENCLR ELO bit assignments are: 


63 32 31 30 0 


RESO P<n>, bit [n] 


Reserved, RESO. 


Bits [63:32] 


C, bit [31] 
PMCCNTR_ELO disable bit. Disables the cycle counter register. Possible values are: 
Qbd When read, means the cycle counter is disabled. When written, has no effect. 
Qb1 When read, means the cycle counter is enabled. When written, disables the cycle 
counter. 


This field resets to an architecturally UNKNOWN value. 
P<n>, bit [n], for n = 0 to 30 
Event counter disable bit for PMEVCNTR<n>_ELO0. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN. Otherwise, N is the 
value in PMCR_ELO.N. 


Qbd When read, means that PMEVCNTR<n>_ELO is disabled. When written, has no effect. 


Qb1 When read, means that PMEVCNTR<n>_EL0 is enabled. When written, disables 
PMEVCNTR<n>_ELO. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMCNTENCLR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, PMCNTENCLR_ELO 














op0 op1 CRn CRm op2 
0b11 0b011 0b1001 0b1100 0b010 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCNTENCLR_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCNTENCLR_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCNTENCLR_ELO; 
elsif PSTATE.EL == EL3 then 
return PMCNTENCLR_ELQ; 
MSR PMCNTENCLR_ELO, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b011 0b1001 0b1100 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCNTENCLR_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCNTENCLR_EL@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





PMCNTENCLR_EL® = X[t]; 
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elsif PSTATE.EL == EL3 then 
PMCNTENCLR_ELO = X[t]; 
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D13.4.6 PMCNTENSET_ELO, Performance Monitors Count Enable Set register 


The PMCNTENSET ELO characteristics are: 


Purpose 
Enables the Cycle Count Register, PMCCNTR_ELO, and any implemented event counters 
PMEVCNTR<n>. Reading this register shows which counters are enabled. 

Configurations 
AArch64 System register PMCNTENSET_ELO[31:0] is architecturally mapped to AArch32 
System register PMCNTENSET{[31:0]. 
AArch64 System register PMCNTENSET_EL0[31:0] is architecturally mapped to External register 
PMCNTENSET_ELO[31:0]. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 


PMCNTENSET ELO is a 64-bit register. 


Field descriptions 


The PMCNTENSET ELO bit assignments are: 


63 32 31 30 0 


RESO P<n>, bit [n] 


Reserved, RESO. 


Bits [63:32] 


C, bit [31] 
PMCCNTR_ELO enable bit. Enables the cycle counter register. Possible values are: 
Qbd When read, means the cycle counter is disabled. When written, has no effect. 
Qb1 When read, means the cycle counter is enabled. When written, enables the cycle 
counter. 


This field resets to an architecturally UNKNOWN value. 
P<n>, bit [n], for n = 0 to 30 
Event counter enable bit for PMEVCNTR<n>_EL0. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN. Otherwise, N is the 
value in PMCR_ELO.N. 


Qbd When read, means that PMEVCNTR<n>_ELO is disabled. When written, has no effect. 


Qb1 When read, means that PMEVCNTR<n>_EL0 event counter is enabled. When written, 
enables PMEVCNTR<n>_ELO. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMCNTENSET_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, PMCNTENSET_ELO 





op0 op1 CRn 


0b11 0b011 0b1001 


CRm 


0b1100 


op2 


0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCNTENSET_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCNTENSET_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCNTENSET_ELO; 
elsif PSTATE.EL == EL3 then 
return PMCNTENSET_ELQ; 


MSR PMCNTENSET_ELO, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b011 0b1001 


0b1100 


0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCNTENSET_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCNTENSET_EL@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





PMCNTENSET_EL® = X[t]; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


ID070919 Non-Confidential 


D13-3543 


AArch64 System Register Descriptions 
D13.4 Performance Monitors registers 


elsif PSTATE.EL == EL3 then 
PMCNTENSET_ELO = X[t]; 
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D13.4.7 PMCR_ELO, Performance Monitors Control Register 
The PMCR_ELO characteristics are: 


Purpose 


Provides details of the Performance Monitors implementation, including the number of counters 
implemented, and configures and controls the counters. 


Configurations 


AArch64 System register PMCR_EL0[31:0] is architecturally mapped to AArch32 System register 
PMCR{31:0]. 


AArch64 System register PMCR_EL0[7:0] is architecturally mapped to External register 
PMCR_ELO[7:0]. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch64. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
PMCR _ ELO is a 64-bit register. 


Field descriptions 


The PMCR_ELO bit assignments are: 


32 31 24 23 1615 1110,8 76543210 


63 
| RESO IMP | IDCODE | N eso 


Bits [63:32] 





Reserved, RESO. 


IMP, bits [31:24] 
Implementer code. This field is RO with an IMPLEMENTATION DEFINED value. 


If this field is zero, then PMCR_ELO.IDCODE is RESO and software must use the MIDR_EL1 to 
identify the PE. 


Otherwise, this field and PMCR_ELO.IDCODE identifies the PMU implementation to software. 


The implementer codes are allocated by Arm. A non-zero value has the same interpretation as 
MIDR_EL1.Implementer. 


IDCODE, bits [23:16] 
When PMCR_ELO.IMP != 0x00: 
Identification code. This field is RO with an IMPLEMENTATION DEFINED value. 


Each implementer must maintain a list of identification codes that are specific to the implementer. 
A specific implementation is identified by the combination of the implementer code and the 
identification code. 


Otherwise: 


Reserved, RESO. 


N, bits [15:11] 


An RO field that indicates the number of event counters implemented. This value is in the range of 
0b00000-0b111111. If the value is @b00000 then only PMCCNTR_ELO is implemented. If the value is 
0b111111 PMCCNTR_ELO and 31 event counters are implemented. 
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Bits [10:8] 


LP, bit [7] 


LC, bit [6] 


DP, bit [5] 


D13-3546 


When EL2 is implemented and enabled for the current Security state, reads of this field from EL1 
and ELO return the value of MDCR_EL2.HPMN. 


Access to this field is RO. 


Reserved, RESO. 


When ARMV8.5-PMU is implemented: 


Long event counter enable. Determines when unsigned overflow is recorded by a counter overflow 
bit. 


Ob Event counter overflow on increment that causes unsigned overflow of 
PMEVCNTR<n>_EL0[3 1:0]. 


Qb1 Event counter overflow on increment that causes unsigned overflow of 
PMEVCNTR<n>_EL0[63:0]. 


If EL2 is implemented and MDCR_EL2.HPMN or HDCR.HPMN is less than PMCR_ELO.N, this 


bit does not affect the operation of event counters in the range [HDCR.HPMN..(PMCR_ELO.N-1)] 
or [MDCR_EL2.HPMN..(PMCR_ELO.N-1)]. 


Note 
The effect of MDCR_EL2.HPMN or HDCR.HPMN on the operation of this bit always applies if 
EL2 is implemented, at all Exception levels including EL2 and EL3, and regardless of whether EL2 


is enabled in the current Security state. For more information, see the description of 
MDCR_EL2.HPMN or HDCR.HPMN. 








This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


Long cycle counter enable. Determines when unsigned overflow is recorded by the cycle counter 
overflow bit. 


ObO Cycle counter overflow on increment that causes unsigned overflow of 
PMCCNTR_ELO[31:0]. 


Qb1 Cycle counter overflow on increment that causes unsigned overflow of 
PMCCNTR_ELO[63:0]. 


Arm deprecates use of PMCR_ELO.LC = 0. 
In an AArch64 only implementation, this field is RES]. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Disable cycle counter when event counting is prohibited. The possible values of this bit are: 
0bd Cycle counting by PMCCNTR_ELO is not affected by this bit. 


Qb1 When event counting for counters in the range [0.(MDCR_EL2.HPMN-1)] is 
prohibited, cycle counting by PMCCNTR_ EL is disabled. 


For more information about the interaction between the Performance Monitors and EL3, see Effect 
of EL3 and EL2 on page D7-2679. 


When EL3 is not implemented, this field is RESO: 

. When ARMv8.1-PMU is not implemented. 

. When ARMv8.1-PMU is implemented, only if EL2 is not implemented. 
Otherwise this field is RW. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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X, bit [4] 


Enable export of events in an IMPLEMENTATION DEFINED event stream. The possible values of this 
bit are: 


Qbd Do not export events. 
Qb1 Export events where not prohibited. 


This field enables the exporting of events over an event bus to another device, for example to an 
OPTIONAL PE trace unit. If the implementation does not include such an event bus then this field is 
RAZ/WI, otherwise it is an RW field. 


In an implementation that includes an event bus, no events are exported when counting is prohibited. 


This field does not affect the generation of Performance Monitors overflow interrupt requests or 
signaling to a cross-trigger interface (CTI) that can be implemented as signals exported from the PE. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


D, bit [3] 
Clock divider. The possible values of this bit are: 
0bd When enabled, PMCCNTR_ELO counts every clock cycle. 
Qb1 When enabled, PMCCNTR_ELO counts once every 64 clock cycles. 


In an AArch64 only implementation this field is RESO, otherwise it is an RW field. If 
PMCR_ELO.LC == 1, this bit is ignored and the cycle counter counts every clock cycle. 


Arm deprecates use of PMCR_ELO.D = 1. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


C, bit [2] 
Cycle counter reset. This bit is WO. The effects of writing to this bit are: 
Qbd No action. 
Qb1 Reset PMCCNTR_ELO to zero. 
This bit is always RAZ. 





Note 
Resetting PMCCNTR_ELO does not change the cycle counter overflow bit. 
The value of PMCR_ELO.LC is ignored, and bits [63:0] of all affected event counters are reset. 





P, bit [1] 
Event counter reset. This bit is WO. The effects of writing to this bit are: 
Qbd No action. 


Qb1 Reset all event counters accessible in the current Exception level, not including 
PMCCNTR_ ELO, to zero. 


This bit is always RAZ. 
In ELO and EL1: 


s If EL2 is implemented and enabled in the current Security state, and MDCR_EL2.HPMN is 
less than PMCR_ELO.N, a write of 1 to this bit does not reset event counters in the range 
[MDCR_EL2.HPMN..(PMCR_ELO.N-1)]. 


` If EL2 is not implemented, EL2 is disabled in the current Security state, or 
MDCR_EL2.HPMN equals PMCR_ELO.N, a write of 1 to this bit resets all the event 
counters. 


In EL2 and EL3, a write of | to this bit resets all the event counters. 





Note 


Resetting the event counters does not change the event counter overflow bits. 
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If ARMv8.5-PMU is implemented, the values of MDCR_EL2.HLP and PMCR_ELO.LP are 
ignored, and bits [63:0] of all affected event counters are reset. 


E, bit [0] 


Enable. 

Qbd All event counters in the range [0..(PMN-1)] and PMCCNTR_ELO, are disabled. 

Qb1 All event counters in the range [0..(PMN-1)] and PMCCNTR_ELO, are enabled by 
PMCNTENSET ELO. 

This bit is RW. 


If EL2 is implemented then: 
° If EL2 is using AArch32, PMN is HDCR.HPMN. 
° If EL2 is using AArch64, PMN is MDCR_EL2.HPMN. 


è If PMN is less than PMCR_ELO.N, this bit does not affect the operation of event counters in 
the range [PMN..(PMCR_ELO.N-1)]. 


If EL2 is not implemented, PMN is PMCR_ELO.N. 


Note 


The effect of MDCR_EL2.HPMN or HDCR.HPMN on the operation of this bit applies if EL2 is 
implemented including EL2 and EL3, and regardless of whether EL2 is enabled in the current 
Security state. For more information, see the description of MDCR_EL2.HPMN or HDCR.HPMN. 








On a Warm reset, this field resets to 0. 


Accessing the PMCR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMCR_ELO 





op0 op1 CRn 


op2 





0b11 0b011 0b1001 


0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMCR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCR_ELQ; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMCR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCR_ELQ; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMCR_ELQ; 
elsif PSTATE.EL == EL3 then 
return PMCR_ELQ; 


MSR PMCR_ELO, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b011 0b1001 0b1100 


0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMCR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCR_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMCR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCR_EL®@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMCR_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
PMCR_EL@ = X[t]; 
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D13.4.8 PMEVCNTR<n>_ELO, Performance Monitors Event Count Registers, n = 0 - 30 
The PMEVCNTR<n>_ELO characteristics are: 


Purpose 


Holds event counter n, which counts events, where n is 0 to 30. 


Configurations 


AArch64 System register PMEVCNTR<n>_EL0[31:0] is architecturally mapped to AArch32 
System register PMEVCNTR<n>[31:0]. 


AArch6é4 System register PMEVCNTR<n>_EL0[31:0] is architecturally mapped to External 
register PMEVCNTR<n>_ELO0[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMEVCNTR<n>_EL0 is a 64-bit register. 


Field descriptions 


The PMEVCNTR<n>_ELO bit assignments are: 


When ARMv8.5-PMU is implemented: 


63 0 


Event counter n 


Bits [63:0] 
Event counter n. Value of event counter n, where n is the number of this register and is a number 
from 0 to 30. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 
63 32 31 


0 
RESO | Event counter n 


Reserved, RESO. 


Bits [63:32] 


Bits [31:0] 


Event counter n. Value of event counter n, where n is the number of this register and is a number 
from 0 to 30. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMEVCNTR<n>_EL0 


PMEVCNTR<n>_ELO can also be accessed by using PMXEVCNTR_ELO with PMSELR_ELO.SEL set to the 
value of <n>. 
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If <n> is greater than or equal to the number of accessible counters, reads and writes of PAEVCNTR<n>_ELO are 
CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


7 Accesses to the register are UNDEFINED. 
. Accesses to the register behave as RAZ/WI. 
. Accesses to the register execute as a NOP. 


` If EL2 is implemented and enabled in the current Security state, and <n> is less than the number of 
implemented counters, accesses from EL1 or permitted accesses from ELO are trapped to EL2. 





Note 
In ELO, an access is permitted if it is enabled by PMUSERENR_ELO.{ER,EN}. 


If EL2 is implemented and enabled in the current Security state, in EL1 and ELO, MDCR_EL2.HPMN identifies 
the number of accessible counters. Otherwise, the number of accessible counters is the number of implemented 
counters. See MDCR_EL2.HPMN for more details. 





Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMEVCNTR<n>_EL0O 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b10:n[4:3]  n[2:0] 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<ER,EN> == 'Q@Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMEVCNTR_ELO[UInt(CRm<1:0>:0p2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 








return PMEVCNTR_ELO[UInt(CRm<1:0>:0p2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMEVCNTR_ELO[UInt(CRm<1:0>:0p2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return PMEVCNTR_ELO[UInt(CRm<1:0>:0p2<2:0>)]; 
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MSR PMEVCNTR<n>_ELO, <Xt> 





op0 op1 CRn CRm 


0b11 0b011 0b1110 0b10:n[4:3] 


op2 


n[2:0] 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMEVCNTR_EL@[UInt (CRm<1:0>:0p2<2:0>)] = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMEVCNTR_EL@[UInt(CRm<1:0>:0p2<2:0>)] = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMEVCNTR_EL@[UInt (CRm<1:0>:0p2<2:0>)] = X[t]; 
elsif PSTATE.EL == EL3 then 
PMEVCNTR_EL@[UInt (CRm<1:0>:0p2<2:0>)] = X[t]; 
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D13.4.9 PMEVTYPER<n>_EL0O, Performance Monitors Event Type Registers, n = 0 - 30 
The PMEVTYPER<n>_ELO characteristics are: 


Purpose 


Configures event counter n, where n is 0 to 30. 


Configurations 


AArch64 System register PMEVTYPER<n>_EL0[31:0] is architecturally mapped to AArch32 
System register PMEVTYPER<n>[31:0]. 


AArch64 System register PMEVTYPER<n>_EL0[31:0] is architecturally mapped to External 
register PMEVTYPER<n>_EL0[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMEVTYPER<n>_ELO is a 64-bit register. 


Field descriptions 


The PMEVTYPER<n>_ELO bit assignments are: 


10 9 





0 
evtCount[9:0] 


Bits [63:32] 


Reserved, RESO. 


P, bit [31] 


Privileged filtering bit. Controls counting in EL1. If EL3 is implemented, then counting in 
Non-secure EL] is further controlled by the PMEVTYPER<n>_ELO.NSK bit. The possible values 
of this bit are: 


ObO Count events in EL1. 
b1 Do not count events in EL1. 


This field resets to an architecturally UNKNOWN value. 


U, bit [30] 


User filtering bit. Controls counting in ELO. If EL3 is implemented, then counting in Non-secure 
ELO is further controlled by the PMEVTYPER<n>_ELO.NSU bit. The possible values of this bit 
are: 


Qbd Count events in ELO. 
Qb1 Do not count events in ELO. 


This field resets to an architecturally UNKNOWN value. 
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NSK, bit [29] 


NSU, bit [28] 


NSH, bit [27] 


M, bit [26] 


MT, bit [25] 


Non-secure EL1 (kernel) modes filtering bit. Controls counting in Non-secure EL1. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMEVTYPER<n>_EL0.P bit, events in 
Non-secure EL1 are counted. 


Otherwise, events in Non-secure EL1 are not counted. 


This field resets to an architecturally UNKNOWN value. 


Non-secure ELO (Unprivileged) filtering bit. Controls counting in Non-secure ELO. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMEVTYPER<n>_EL0.U bit, events in 
Non-secure ELO are counted. 


Otherwise, events in Non-secure ELO are not counted. 


This field resets to an architecturally UNKNOWN value. 


EL2 (Hypervisor) filtering bit. Controls counting in EL2. If EL2 is not implemented, this bit is RESO. 
If Secure EL2 is implemented, counting in Secure EL2 is further controlled by the 
PMEVTYPER<n>_EL0.SH bit. 


Qbd Do not count events in EL2. 
Qb1 Count events in EL2. 


This field resets to an architecturally UNKNOWN value. 


Secure EL3 filtering bit. If EL3 is not implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMEVTYPER<n>_EL0.P bit, cycles in Secure 
EL3 are counted. 


Otherwise, cycles in Secure EL3 are not counted. 
Most applications can ignore this field and set its value to @bQ. 


Note 
This field is not visible in the AArch32 PMEVTY PER<n> System register. 








This field resets to an architecturally UNKNOWN value. 


Multithreading. When the implementation is multi-threaded, the valid values for this bit are: 
Qbd Count events only on controlling PE. 
Qb1 Count events from any PE with the same affinity at level 1 and above as this PE. 


When the implementation is not multi-threaded, this bit is RESO. 





Note 


. When the lowest level of affinity consists of logical PEs that are implemented using a 
multi-threading type approach, an implementation is described as multi-threaded. That is, the 
performance of PEs at the lowest affinity level is highly interdependent. On such an 
implementation, when read at the highest implemented Exception level, the value of the 
MPIDR_ELI.MT bit is 0b1. 


à Events from a different thread of a multithreaded implementation are not Attributable to the 
thread counting the event. 


This field resets to an architecturally UNKNOWN value. 
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SH, bit [24] 
When ARMV8.4-SecEL2 is implemented: 


Secure EL2 filtering. 


If the value of this bit is not equal to the value of the PMEVTYPER<n>_ELO.NSH bit, events in 
Secure EL2 are counted. 


Otherwise, events in Secure EL2 are not counted. 


If Secure EL2 is not implemented or is disabled, this field is RESO. 





Note 
This field is not visible in the AArch32 PMEVTY PER<n> System register. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [23:16] 


Reserved, RESO. 


evtCount([15:10], bits [15:10] 
When ARMv8.1-PMU is implemented: 
Extension to evtCount[9:0]. See evtCount[9:0] for more details. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


evtCount[9:0], bits [9:0] 


Event to count. The event number of the event that is counted by event counter 
PMEVCNTR<n>_ELO. 


If evtCount is programmed to an event that is reserved or not supported by the PE, the behavior 
depends on the value written: 


. For the range 0x000 to 0x03F, no events are counted, and the value returned by a direct or 
external read of the evtCount field is the value written to the field. 

. If 16-bit evtCount is implemented, for the range 0x4000 to 0x403F, no events are counted, and 
the value returned by a direct or external read of the evtCount field is the value written to the 
field. 

. For IMPLEMENTATION DEFINED events, it is UNPREDICTABLE what event, if any, is counted, 


and the value returned by a direct or external read of the evtCount field is UNKNOWN. 


Note 
UNPREDICTABLE means the event must not expose privileged information. 








Arm recommends that the behavior across a family of implementations is defined such that if a 
given implementation does not include an event from a set of common IMPLEMENTATION DEFINED 
events, then no event is counted and the value read back on evtCount is the value written. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMEVTYPER<n>_EL0 


PMEVTYPER<n>_ELO can also be accessed by using PMXEVTYPER ELO with PMSELR_ELO.SEL set to n. 
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D13-3556 


If <n> is greater than or equal to the number of accessible counters, reads and writes of PMEVTYPER<n>_EL0 are 
CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


s Accesses to the register are UNDEFINED. 
. Accesses to the register behave as RAZ/WI. 
. Accesses to the register execute as a NOP. 


` If EL2 is implemented and enabled in the current Security state, and <n> is less than the number of 
implemented counters, accesses from EL1 or permitted accesses from ELO are trapped to EL2. 





Note 
In ELO, an access is permitted if it is enabled by PMUSERENR_ELO.EN. 


If EL2 is implemented and enabled in the current Security state, in EL1 and ELO, MDCR_EL2.HPMN identifies 
the number of accessible counters. Otherwise, the number of accessible counters is the number of implemented 
counters. See MDCR_EL2.HPMN for more details. 





Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMEVTYPER<n>_EL0 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b11:n[4:3]  n[2:0] 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMEVTYPER_ELO[UInt(CRm<1:0>:0p2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMEVTYPER_ELO[UInt(CRm<1:0>:0p2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





return PMEVTYPER_ELO[UInt(CRm<1:0>:0p2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return PMEVTYPER_ELO[UInt(CRm<1:0>:0p2<2:0>)]; 
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MSR PMEVTYPER<n>_ELO, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 Obl 1:n[4:3] — n[2:0] 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMEVTYPER_EL@[UInt(CRm<1:0>:0p2<2:0>)] = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





PMEVTYPER_EL@[UInt(CRm<1:0>:0p2<2:0>)] = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMEVTYPER_EL@[UInt(CRm<1:0>:0p2<2:0>)] = X[t]; 
elsif PSTATE.EL == EL3 then 
PMEVTYPER_EL@[UInt(CRm<1:0>:0p2<2:0>)] = X[t]; 
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D13.4.10 ©PMINTENCLR_EL1, Performance Monitors Interrupt Enable Clear register 
The PMINTENCLR_ELI characteristics are: 


Purpose 


Disables the generation of interrupt requests on overflows from the Cycle Count Register, 
PMCCNTR_ELO, and the event counters PMEVCNTR<n>_ELO. Reading the register shows which 
overflow interrupt requests are enabled. 


Configurations 


AArch64 System register PMINTENCLR_EL1[31:0] is architecturally mapped to AArch32 
System register PMINTENCLR{3 1:0]. 


AArch64 System register PMINTENCLR_EL1[31:0] is architecturally mapped to External register 
PMINTENCLR_EL1[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMINTENCLR_ EL] is a 64-bit register. 


Field descriptions 


The PMINTENCLR_ EL! bit assignments are: 


63 32 31 30 0 


RESO P<n>, bit [n] 


Reserved, RESO. 


Bits [63:32] 


C, bit [31] 
PMCCNTR_ELO overflow interrupt request disable bit. Possible values are: 


0bd When read, means the cycle counter overflow interrupt request is disabled. When 
written, has no effect. 


Qb1 When read, means the cycle counter overflow interrupt request is enabled. When 
written, disables the cycle count overflow interrupt request. 
P<n>, bit [n], for n = 0 to 30 
Event counter overflow interrupt request disable bit for PMEVCNTR<n>_EL0. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1, N is the value in MDCR_EL2.HPMN. Otherwise, N is the value in 
PMCR_ELO.N. 


0b0 When read, means that the PMEVCNTR<n>_ELO event counter interrupt request is 
disabled. When written, has no effect. 


Qb1 When read, means that the PMEVCNTR<n>_ELO event counter interrupt request is 
enabled. When written, disables the PMEVCNTR<n>_ELO interrupt request. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMINTENCLR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, PMINTENCLR_EL1 





op0 op1 CRn CRm 


0b11 0b000 0b1001 0b1110 


op2 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMINTENCLR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMINTENCLR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMINTENCLR_EL1; 


MSR PMINTENCLR_EL1, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b000 0b1001 0b1110 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMINTENCLR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





PMINTENCLR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMINTENCLR_EL1 = X[t]; 
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D13.4.11 PMINTENSET_EL1, Performance Monitors Interrupt Enable Set register 
The PMINTENSET_EL1 characteristics are: 


Purpose 


Enables the generation of interrupt requests on overflows from the Cycle Count Register, 
PMCCNTR_ELO, and the event counters PMEVCNTR<n>_ELO. Reading the register shows which 
overflow interrupt requests are enabled. 


Configurations 


AArch64 System register PMINTENSET_EL1[31:0] is architecturally mapped to AArch32 System 
register PMINTENSET[31:0]. 


AArch64 System register PMINTENSET_EL1[31:0] is architecturally mapped to External register 
PMINTENSET EL1[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMINTENSET EL] is a 64-bit register. 


Field descriptions 


The PMINTENSET EL] bit assignments are: 


63 32 31 30 0 


RESO P<n>, bit [n] 


Reserved, RESO. 


Bits [63:32] 


C, bit [31] 
PMCCNTR_ELO overflow interrupt request enable bit. Possible values are: 


Qbd When read, means the cycle counter overflow interrupt request is disabled. When 
written, has no effect. 


Qb1 When read, means the cycle counter overflow interrupt request is enabled. When 
written, enables the cycle count overflow interrupt request. 


This field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter overflow interrupt request enable bit for PMEVCNTR<n>_EL0. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1, N is the value in MDCR_EL2.HPMN. Otherwise, N is the value in 
PMCR_ELO.N. 


Ob When read, means that the PMEVCNTR<n>_ELO event counter interrupt request is 
disabled. When written, has no effect. 


0b1 When read, means that the PMEVCNTR<n>_ELO event counter interrupt request is 
enabled. When written, enables the PMEVCNTR<n>_ELO interrupt request. 


This field resets to an architecturally UNKNOWN value. 
Accessing the PMINTENSET_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


D13-3560 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.4 Performance Monitors registers 


MRS <Xt>, PMINTENSET_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b1001 0b1110 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMINTENSET_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMINTENSET_EL1; 
elsif PSTATE.EL == EL3 then 
return PMINTENSET_EL1; 


MSR PMINTENSET_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1110 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMINTENSET_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





PMINTENSET_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMINTENSET_EL1 = X[t]; 
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D13.4.12 ©PMMIR_EL1, Performance Monitors Machine Identification Register 


The PMMIR_ EL! characteristics are: 


Purpose 
Describes Performance Monitors parameters specific to the implementation to software. 
Configurations 
This register is present only when ARMVv8.4-PMU is implemented. Otherwise, direct accesses to 
PMMIR_ELI are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


PMMIR ELI is a 64-bit register. 


Field descriptions 


The PMMIR_ EL! bit assignments are: 


63 8 7 0 


RESO SLOTS 


Bits [63:8] 


Reserved, RESO. 


SLOTS, bits [7:0] 


Operation width. The largest value by which the STALL_SLOT event might increment by in a 
single cycle. If the STALL SLOT event is not implemented, this field might read as zero. 


Accessing the PMMIR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMMIR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1110 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMMIR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMMIR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMMIR_EL1; 
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D13.4.13 © PMOVSCLR_ELO, Performance Monitors Overflow Flag Status Clear Register 


The PMOVSCLR_ELO characteristics are: 


Purpose 
Contains the state of the overflow bit for the Cycle Count Register, PMCCNTR_ELO, and each of 
the implemented event counters PMEVCNTR<n>. Writing to this register clears these bits. 
Configurations 
AArch6é4 System register PMOVSCLR_ELO[31:0] is architecturally mapped to AArch32 System 
register PMOVSR[31:0]. 
AArch64 System register PMOVSCLR_ELO0[31:0] is architecturally mapped to External register 
PMOVSCLR_ELO[31:0]. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 
Attributes 


PMOVSCLR_ELO is a 64-bit register. 


Field descriptions 


The PMOVSCLR_ELO bit assignments are: 


63 32 31 30 0 


RESO P<n>, bit [n] 


Reserved, RESO. 


Bits [63:32] 


C, bit [31] 
Cycle counter overflow clear bit. 


Qbd When read, means the cycle counter has not overflowed since this bit was last cleared. 
When written, has no effect. 


Qb1 When read, means the cycle counter has overflowed since this bit was last cleared. 
When written, clears the cycle counter overflow bit to 0. 


PMCR_ELO.LC controls whether an overflow is detected from unsigned overflow of 
PMCCNTR_ELO[31:0] or unsigned overflow of PMCCNTR_ELO[63:0]. 


This field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter overflow clear bit for PMEVCNTR<n>_ELO. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN. Otherwise, N is the 
value in PMCR_ELO.N. 


Obd When read, means that PMEVCNTR<n>_EL0 has not overflowed since this bit was last 
cleared. When written, has no effect. 
Qb1 When read, means that PMEVCNTR<n>_EL0 has overflowed since this bit was last 


cleared. When written, clears the PMEVCNTR<n>_ELO overflow bit to 0. 


If ARMv8.5-PMU is implemented, MDCR_EL2.HLP and PMCR_ELO.LP control whether an 
overflow is detected from unsigned overflow of PMEVCNTR<n>_EL0[31:0] or unsigned overflow 
of PMEVCNTR<n>_ELO0[63:0]. 


This field resets to an architecturally UNKNOWN value. 
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Accessing the PMOVSCLR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMOVSCLR_ELO 














op0 op1 CRn CRm op2 
0b11 0b011 0b1001 0b1100 0b011 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMOVSCLR_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMOVSCLR_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMOVSCLR_ELQ; 
elsif PSTATE.EL == EL3 then 
return PMOVSCLR_ELO; 
MSR PMOVSCLR_ELO, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b011 0b1001 0b1100 0b011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMOVSCLR_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





PMOVSCLR_EL@ = X[t]; 
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elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMOVSCLR_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
PMOVSCLR_EL®@ = X[t]; 
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D13.4.14 PMOVSSET_ELO, Performance Monitors Overflow Flag Status Set register 
The PMOVSSET ELO characteristics are: 


Purpose 


Sets the state of the overflow bit for the Cycle Count Register, PMCCNTR_ELO, and each of the 
implemented event counters PMEVCNTR<n>. 


Configurations 


AArch6é4 System register PMOVSSET_ELO[31:0] is architecturally mapped to AArch32 System 
register PMOVSSET[3 1:0]. 


AArch64 System register PMOVSSET_ELO[31:0] is architecturally mapped to External register 
PMOVSSET_ELO[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMOVSSET_ ELO is a 64-bit register. 


Field descriptions 


The PMOVSSET ELO bit assignments are: 


63 32 31 30 0 


RESO P<n>, bit [n] 


Reserved, RESO. 


Bits [63:32] 


C, bit [31] 
Cycle counter overflow set bit. 


Qbd When read, means the cycle counter has not overflowed since this bit was last cleared. 
When written, has no effect. 


Qb1 When read, means the cycle counter has overflowed since this bit was last cleared. 
When written, sets the cycle counter overflow bit to 1. 


PMCR_ELO.LC controls whether an overflow is detected from unsigned overflow of 
PMCCNTR_ELO[31:0] or unsigned overflow of PMCCNTR_ELO[63:0]. 


This field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter overflow set bit for PMEVCNTR<n>_EL0. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN. Otherwise, N is the 
value in PMCR_ELO.N. 


Obd When read, means that PMEVCNTR<n>_EL0 has not overflowed since this bit was last 
cleared. When written, has no effect. 
Qb1 When read, means that PMEVCNTR<n>_EL0 has overflowed since this bit was last 


cleared. When written, sets the PMEVCNTR<n>_EL0 overflow bit to 1. 


If ARMv8.5-PMU is implemented, MDCR_EL2.HLP and PMCR_ELO.LP control whether an 
overflow is detected from unsigned overflow of PMEVCNTR<n>_EL0[31:0] or unsigned overflow 
of PMEVCNTR<n>_ELO[63:0]. 


This field resets to an architecturally UNKNOWN value. 
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Accessing the PMOVSSET_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMOVSSET_ELO 


op0 op1 CRn CRm op2 





0b11 0b011 0b1001 0b1110 0b011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMOVSSET_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMOVSSET_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMOVSSET_ELQ; 
elsif PSTATE.EL == EL3 then 
return PMOVSSET_ELO; 


MSR PMOVSSET_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1001 0b1110 0b011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMOVSSET_EL®@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





PMOVSSET_EL® = X[t]; 
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elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMOVSSET_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
PMOVSSET_EL®@ = X[t]; 
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D13.4.15 ©PMSELR_ELO, Performance Monitors Event Counter Selection Register 


The PMSELR_ELO characteristics are: 


Purpose 


Selects the current event counter PMEVCNTR<n>_ELO or the cycle counter, CCNT. 


PMSELR_ELO is used in conjunction with PMXEVTYPER_ELO to determine the event that 
increments a selected event counter, and the modes and states in which the selected counter 
increments. 


It is also used in conjunction with PMXEVCNTR_ELO, to determine the value of a selected event 
counter. 


Configurations 


Attributes 


AArch64 System register PMSELR_ELO0[31:0] is architecturally mapped to AArch32 System 
register PMSELR[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


PMSELR_ELO is a 64-bit register. 


Field descriptions 


The PMSELR_ELO bit assignments are: 


63 


Bits [63:5] 


SEL, bits [4:0] 


ARM DDI 0487E.a 
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RESO SEL 


Reserved, RESO. 


Selects event counter, PMEVCNTR<n>_ELO, where n is the value held in this field. This value 
identifies which event counter is accessed when a subsequent access to PMXEVTYPER_ELO or 
PMXEVCNTR_ELO occurs. 


This field can take any value from 0 (@b00000) to (PMCR.N)-1, or 31 (0b11111). 
When PMSELR _ELO.SEL is 0b11111, it selects the cycle counter and: 

$ A read of the PMXEVTYPER_ELO returns the value of PMCCFILTR_ELO. 
° A write of the PMXEVTYPER ELO writes to PMCCFILTR_ELO. 


a A read or write of PMXEVCNTR_ELO has CONSTRAINED UNPREDICTABLE effects. See 
PMXEVCNTR_ELO for more details. 


If this field is set to a value greater than or equal to the number of counters accessible at the current 
Exception level, but not equal to 31: 


. Direct reads of this field return an UNKNOWN value. 


$ The results of access to PMXEVTYPER_EL0 or PMXEVCNTR_ELO are CONSTRAINED 
UNPREDICTABLE. See PMXEVTYPER_ELO or PMXEVCNTR_ELO for more details. 


For information about the number of counters accessible at each Exception level, see 
MDCR_EL2.HPMN. 


This field resets to an architecturally UNKNOWN value. 
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Accessing the PMSELR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMSELR_ELO 


op0 op1 CRn CRm 


op2 





0b11 0b011 0b1001 0b1100 


0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<ER,EN> == 'QQ' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSELR_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





return PMSELR_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSELR_ELO; 
elsif PSTATE.EL == EL3 then 
return PMSELR_ELO; 


MSR PMSELR_ELO, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b011 0b1001 0b1100 


0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<ER,EN> == 'Q0' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSELR_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSELR_EL@ = X[t]; 
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elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSELR_EL® = X[t]; 
elsif PSTATE.EL == EL3 then 
PMSELR_EL® = X[t]; 
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D13.4.16 PMSWINC_ELO, Performance Monitors Software Increment register 
The PMSWINC_ELO characteristics are: 


Purpose 


Increments a counter that is configured to count the Software increment event, event 0x00. For more 
information, see SW_INCR. 


Configurations 


AArch64 System register PMSWINC_ELO[31:0] is architecturally mapped to AArch32 System 
register PMSWINC[31:0]. 


AArch64 System register PMSWINC_ELO0[31:0] is architecturally mapped to External register 
PMSWINC_ELO[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
PMSWINC ELO is a 64-bit register. 


Field descriptions 


The PMSWINC ELO bit assignments are: 


63 31 30 0 


RESO P<n>, bit [n] 


Bits [63:31] 


Reserved, RESO. 


P<n>, bit [n], for n = 0 to 30 
Event counter software increment bit for PMEVCNTR<n>_EL0. 


If N is less than 31, then bits [30:N] are WI. When EL2 is implemented and enabled in the current 
Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN. Otherwise, N is the value in 


PMCR_ELO.N. 
Ob No action. The write to this bit is ignored. 
Qb1 If PMEVCNTR<n>_EL0 is enabled and configured to count the software increment 


event, increments PMEVCNTR<n>_ELO by 1. FPMEVCNTR<n>_EL0 is disabled, or 
not configured to count the software increment event, the write to this bit is ignored. 


Accessing the PMSWINC_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MSR PMSWINC_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1001 0b1100 0b100 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<SW,EN> == 'QQ' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSWINC_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSWINC_EL@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSWINC_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
PMSWINC_EL@ = X[t]; 
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D13.4.17 


D13-3574 


PMUSERENR_ELO, Performance Monitors User Enable Register 


The PMUSERENR_ELO characteristics are: 


Purpose 
Enables or disables ELO access to the Performance Monitors. 

Configurations 
AArch64 System register PMUSERENR_ELO[31:0] is architecturally mapped to AArch32 System 
register PMUSERENR[31:0]. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 


PMUSERENR ELO is a 64-bit register. 


Field descriptions 


The PMUSERENR ELO bit assignments are: 


63 


Bits [63:4] 


ER, bit [3] 


CR, bit [2] 


43210 
RESO 
— EN 
SW 
CR 
ER 
Reserved, RESO. 
Event counter Read. Traps ELO access to event counters to EL1, or to EL2 when it is implemented 
and enabled for the current Security state and HCR_EL2.TGE is 1. 
In AArch64 state, trapped accesses are reported using EC syndrome value 0x18. 
In AArch64 state, trapped accesses are reported using EC syndrome value 0x03. 
Qbd ELO using AArch64: ELO reads of the PMXEVCNTR_ELO and 
PMEVCNTR<n>_ELO, and ELO read/write accesses to the PMSELR_ELO, are trapped 
if PMUSERENR_ELO.EN is also 0. 
ELO using AArch32: ELO reads of the PMXEVCNTR and PMEVCNTR<n>, and ELO 
read/write accesses to the PMSELR, are trapped if PMUSERENR_ELO.EN is also 0. 
Qb1 Overrides PMUSERENR_ELO.EN and enables RO access to PMXEVCNTR_ELO and 
PMEVCNTR<n>_ELO, and RW access to PMSELR_ELO and PMSELR at ELO. 
This field resets to an architecturally UNKNOWN value. 
Cycle counter Read. Traps ELO access to cycle counter reads to EL1, or to EL2 when it is 
implemented and enabled for the current Security state and HCR_EL2.TGE is 1. 
In AArch64 state, trapped accesses are reported using EC syndrome value 0x18. 
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In AArch32 state, trapped MRC accesses are reported using EC syndrome value 0x03, trapped 

MRRC accesses are reported using EC syndrome value 0x04. 

Qbd ELO using AArch64: ELO read accesses to the PMCCNTR_ELO are trapped if 
PMUSERENR_ELO.EN is also 0. 


ELO using AArch32: ELO read accesses to the PMCCNTR are trapped if 
PMUSERENR _ ELO.EN is also 0. 


Qb1 Overrides PMUSERENR_ELO.EN and enables access to PMCCNTR_ELO and 

PMCCNTR at ELO. 
SW, bit [1] 

Traps Software Increment writes to EL1, or to EL2 when it is implemented and enabled for the 

current Security state and HCR_EL2.TGE is 1. 

In AArch64 state, trapped accesses are reported using EC syndrome value 0x18. 

In AArch32 state, trapped accesses are reported using EC syndrome value 0x03. 

Qbd ELO using AArch64: ELO writes to the PMSWINC_ELO are trapped if 
PMUSERENR _ELO.EN is also 0. 
ELO using AArch32: ELO writes to the PMSWINC are trapped if 
PMUSERENR _ELO.EN is also 0. 

Qb1 Overrides PMUSERENR_ELO.EN and enables access to PMSWINC_ELO and 
PMSWINC at ELO. 

This field resets to an architecturally UNKNOWN value. 

EN, bit [0] 

Traps ELO accesses to the Performance Monitor registers to EL1, or to EL2 when it is implemented 

and enabled for the current Security state and HCR_EL2.TGE is 1, from both Execution states as 

follows: 

. In AArch64 state, accesses to the following registers are reported using EC syndrome value 

0x18. 

— PMCR ELO. PMOVSCLR_EL0, PMSELR_EL0, PMCEIDO_EL0, PMCEID1_EL0, 
PMCCNTR_EL0, PMXEVTYPER_EL0, PMXEVCNTR_EL0, PMUSERENR_ELO, 
PMCNTENSET_EL0, PMOVSSET_EL0, PMEVCNTR<n>_EL0, 
PMEVTYPER<n>_EL0, PMCCFILTR_ELO. 

—  PMSWINC ELO, MSR accesses only. 

. In AArch32 state, MRC or MCR accesses to the following registers are reported using EC 
syndrome value 0x03 and MCRR or MRRC accesses are trapped to EL2 and reported using 

EC syndrome value 0x04 

— PMCR, PMOVSR, PMSELR, PMCEIDO, PMCEID1, PMCCNTR, PMXEVTYPER, 
PMXEVCNTR, PMUSERENR, PMCNTENSET, PMCNTENCLR, PMOVSSET, 
PMEVCNTR<n>, PMEVTYPER<n>, PMCCFILTR. 

—  PMSWINC, MCR accesses only. 

. In Aarch32 state, MCRR or MRRC accesses to PMCCNTR are reported using EC syndrome 
value 0x04. 

è If ARMv8.4-PMU is implemented, in Aarch64 state, PMMIR_EL1 and in AArch32 state, 
PMMIR. 

. If ARMv8.1-PMU is implemented, in AArch32 state, PMCEID2, and PMCEID3. 

Qbd While at ELO, Accesses to the specified registers at ELO are trapped, unless overridden 

by one of PMUSERENR_ELO. {ER, CR, SW}. 
Qb1 While at ELO, software can access all of the specified registers. 
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Note 


The ELO access is trapped only if the corresponding EL] access is permitted. If 
PMUSERENR ELO.EN is 0, write access to PMSWINC_ELO and PMSWINC from ELO are 
trapped, but read access is UNDEFINED. 


The affected registers do not include PMINTENSET_EL1, PMINTENCLR_EL1, PMINTENSET, 
PMINTENCLR. 





This field resets to an architecturally UNKNOWN value. 


Accessing the PMUSERENR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMUSERENR_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1001 0b1110 0b000 


if PSTATE.EL == EL@ then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMUSERENR_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMUSERENR_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMUSERENR_ELQ; 
elsif PSTATE.EL == EL3 then 
return PMUSERENR_ELQ; 


MSR PMUSERENR_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1001 0b1110 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMUSERENR_EL® = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
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else 
PMUSERENR_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
PMUSERENR_EL® = X[t]; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3577 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.4 Performance Monitors registers 


D13.4.18 ©PMXEVCNTR_ELO, Performance Monitors Selected Event Count Register 
The PMXEVCNTR_ELO characteristics are: 


Purpose 


Reads or writes the value of the selected event counter, PMEVCNTR<n>_ELO. 
PMSELR_ELO.SEL determines which event counter is selected. 


Configurations 


AArch64 System register PMXEVCNTR_ELO[31:0] is architecturally mapped to AArch32 System 


register PMXEVCNTR[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 


to architecturally UNKNOWN values. 


Attributes 
PMXEVCNTR_ ELO is a 64-bit register. 


Field descriptions 


The PMXEVCNTR _ ELO bit assignments are: 


When ARMv8.5-PMU is implemented: 


63 0 


PMEVCNTR<n> 


PMEVCNTR<n>, bits [63:0] 


Value of the selected event counter, PMEVCNTR<n>_ELO, where n is the value stored in 
PMSELR_ELO.SEL. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 


63 32 31 0 


RESO PMEVCNTR<n> 


Bits [63:32] 
Reserved, RESO. 
PMEVCNTR<n>, bits [31:0] 


Value of the selected event counter, PMEVCNTR<n>_ELO, where n is the value stored in 
PMSELR_ELO.SEL. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMXEVCNTR_ELO 


If PMSELR_ELO.SEL is greater than or equal to the number of accessible counters then reads and writes of 
PMXEVCNTR_ELO are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


: Accesses to the register are UNDEFINED. 
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. Accesses to the register behave as RAZ/WI. 


. Accesses to the register execute as a NOP 


è Accesses to the register behave as if PMSELR_ELO.SEL has an UNKNOWN value less than the number of 


counters accessible at the current Exception level and Security state. 


$ If EL2 is implemented and enabled in the current Security state, and PMSELR_ELO.SEL is less than the 
number of implemented counters, accesses from EL1 or permitted accesses from ELO are trapped to EL2. 


Note 
In ELO, an access is permitted if it is enabled by PMUSERENR_ELO.{ER,EN}. 





If EL2 is implemented and enabled in the current Security state, in EL1 and ELO, MDCR_EL2.HPMN identifies 
the number of accessible counters. Otherwise, the number of accessible counters is the number of implemented 


counters. See MDCR_EL2.HPMN for more details. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMXEVCNTR_ELO 





op0 op1 CRn 


CRm op2 





0b11 0b011 0b1001 


0b1101 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<ER,EN> == 'Q@Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMXEVCNTR_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMXEVCNTR_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMXEVCNTR_ELO; 
elsif PSTATE.EL == EL3 then 
return PMXEVCNTR_ELQ; 
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MSR PMXEVCNTR_ELO, <Xt> 





op0 op1 CRn CRm 


0b11 0b011 0b1001 0b1101 


op2 


0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMXEVCNTR_EL@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





PMXEVCNTR_EL@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMXEVCNTR_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
PMXEVCNTR_EL@ = X[t]; 
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D13.4.19 PMXEVTYPER_ELO, Performance Monitors Selected Event Type Register 
The PMXEVTYPER_ELO characteristics are: 


Purpose 


When PMSELR_ELO.SEL selects an event counter, this accesses a PMEVTYPER<n>_ELO 
register. When PMSELR_ELO.SEL selects the cycle counter, this accesses PMCCFILTR_ELO. 


Configurations 


AArch64 System register PAXEVTYPER_ELO[31:0] is architecturally mapped to AArch32 
System register PMXEVTYPER[3 1:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMXEVTYPER ELO is a 64-bit register. 


Field descriptions 


The PMXEVTYPER ELO bit assignments are: 


63 32 31 0 






RESO Event type register or PMCCFILTR_ELO 


Bits [63:32] 


Reserved, RESO. 


Event type register or PMCCFILTR_ELO, bits [31:0] 
When PMSELR_ELO.SEL == 31, this register accesses PMCCFILTR_ELO. 


Otherwise, this register accesses PMEVTYPER<n>_ELO where n is the value in 
PMSELR_ELO.SEL. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMXEVTYPER_ELO 


If PMSELR_ELO.SEL is greater than or equal to the number of accessible counters then reads and writes of 
PMXEVTYPER_ ELO are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 
: Accesses to the register behave as RAZ/WI. 
. Accesses to the register execute as a NOP 


$ Accesses to the register behave as if PMSELR_ELO.SEL has an UNKNOWN value less than the number of 
counters accessible at the current Exception level and Security state. 


° Accesses to the register behave as if PMSELR_ELO.SEL is 31. 


s If EL2 is implemented and enabled in the current Security state, PMSELR_ELO is less than the number of 
implemented counters, accesses from EL1 or permitted accesses from ELO are trapped to EL2. 


Note 
In ELO, an access is permitted if it is enabled by PMUSERENR_ELO.EN. 
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If EL2 is implemented and enabled in the current Security state, in EL1 and ELO, MDCR_EL2.HPMN identifies 
the number of accessible counters. Otherwise, the number of accessible counters is the number of implemented 


counters. See MDCR_EL2.HPMN for more details. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMXEVTYPER_ELO 





op0 op1 CRn CRm 


op2 





0b11 0b011 0b1001 0b1101 


0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMXEVTYPER_ELQ; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMXEVTYPER_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMXEVTYPER_ELQ; 
elsif PSTATE.EL == EL3 then 
return PMXEVTYPER_ELQ; 


MSR PMXEVTYPER_ELO, <Xt> 


op0 op1 CRn CRm 


op2 





0b11 0b011 0b1001 0b1101 


0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMXEVTYPER_EL®@ = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
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AArch64.SystemAccessTrap(EL3, 0x18); 

else 

PMXEVTYPER_EL®@ = X[t]; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

else 





PMXEVTYPER_ELO = X[t] 
elsif PSTATE.EL == EL3 then 
PMXEVTYPER_ELO = X[t]; 
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D13.5 Activity Monitors registers 


This section lists the Activity Monitors registers in AArch64. 


D13-3584 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.5 Activity Monitors registers 


D13.5.1 AMCFGR_ELO, Activity Monitors Configuration Register 


ARM DDI 0487E.a 
ID070919 


The AMCFGR_ELO characteristics are: 


Purpose 


Global configuration register for the activity monitors. 


Provides information on supported features, the number of counter groups implemented, the total 
number of activity monitor event counters implemented, and the size of the counters. 
AMCFGR_ELO is applicable to both the architected and the auxiliary counter groups. 


Configurations 


Attributes 


AArch64 System register AMCFGR_ELO0[31:0] is architecturally mapped to AArch32 System 
register AMCFGR[31:0]. 


AArch64 System register AMCFGR_ELO0[31:0] is architecturally mapped to External register 
AMCFGR{[31:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCFGR _ELO are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


AMCFGR _ ELO is a 64-bit register. 


Field descriptions 


The AMCFGR_ELO bit assignments are: 


RESO 


Bits [63:32] 


32 31 2827 2524 23 14 13 8 7 0 


NCG RESO i RAZ SIZE N 


a a HDBG 


Reserved, RESO. 


NGG bits [31:28] 


Bits [27:25] 


Defines the number of counter groups. 
The number of implemented counter groups is defined as [AMCFGR_ELO.NCG + 1]. 


If the number of implemented auxiliary activity monitor event counters is zero, this field has a value 
of @b0000. Otherwise, this field has a value of @b0001. 


Reserved, RESO. 


HDBG, bit [24] 


Bits [23:14] 


Halt-on-debug supported. 

From Armvé8, this feature must be supported, and so this bit is 0b1. 
Qbe AMCR_ELO.HDBG is RESO. 

Qb1 AMCR_ELO.HDBG is read/write. 


Reserved, RAZ. 
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SIZE, bits [13:8] 
Defines the size of activity monitor event counters. 


The size of the activity monitor event counters implemented by the activity monitors Extension is 
defined as [AMCFGR_ELO.SIZE + 1]. 


From Armv8, the counters are 64-bit, and so this field is @b111111. 





Note 


Software also uses this field to determine the spacing of counters in the memory-map. From Armv8, 
the counters are at doubleword-aligned addresses. 





N, bits [7:0] 
Defines the number of activity monitor event counters. 


The total number of counters implemented in all groups by the Activity Monitors Extension is 
defined as [AMCFGR_ELO.N + 1]. 


Accessing the AMCFGR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMCFGR_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1101 0b0010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCFGR_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCFGR_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCFGR_ELO; 
elsif PSTATE.EL == EL3 then 
return AMCFGR_ELO; 
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D13.5.2 AMCGCR_ELO, Activity Monitors Counter Group Configuration Register 
The AMCGCR_ELO characteristics are: 


Purpose 


Provides information on the number of activity monitor event counters implemented within each 
counter group. 


Configurations 


AArch64 System register AMCGCR_ELO[31:0] is architecturally mapped to AArch32 System 
register AMCGCR[31:0]. 


AArch64 System register AMCGCR_ELO[31:0] is architecturally mapped to External register 
AMCGCRJ3 1:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCGCR_ELO are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMCGCR_ELO is a 64-bit register. 


Field descriptions 


The AMCGCR_ELO bit assignments are: 


1615 


63 8 7 0 
| RESO CG1NC | CGONC 


Bits [63:16] 
Reserved, RESO. 
CGINC, bits [15:8] 
Counter Group 1 Number of Counters. The number of counters in the auxiliary counter group. 


In AMUVI, the permitted range of values is 0x0 to 0x10. 


CGONC, bits [7:0] 
Counter Group 0 Number of Counters. The number of counters in the architected counter group. 
In AMUVI, the value of this field is 0x4. 


Accessing the AMCGCR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMCGCR_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1101 0b0010 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCGCR_ELQ; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCGCR_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCGCR_ELQ; 
elsif PSTATE.EL == EL3 then 
return AMCGCR_ELQ; 
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D13.5.3 AMCNTENCLRO_ELO, Activity Monitors Count Enable Clear Register 0 
The AMCNTENCLRO_ELO characteristics are: 


Purpose 


Disable control bits for the architected activity monitors event counters, AMEVCNTRO<n>_ELO. 


Configurations 


AArch6é4 System register AMCNTENCLRO_ELO[31:0] is architecturally mapped to AArch32 
System register AMCNTENCLRO[31:0]. 


AArch64 System register AMCNTENCLRO_ELO[31:0] is architecturally mapped to External 
register AMCNTENCLRO[31:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENCLRO_ELO are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMCNTENCLRO ELO is a 64-bit register. 


Field descriptions 


The AMCNTENCLRO_ELO bit assignments are: 


63 16 15 0 


RESO P<n>, bit [n] 


Bits [63:16] 
Reserved, RESO. 
P<n>, bit [n], for n = 0 to 15 
Activity monitor event counter disable bit for AMEVCNTRO<n>_EL0. 
Bits [31:16] are RESO. Bits [15:N] are RAZ/WI. N is the value in AMCGCR_ELO.CGONC. 


Possible values of each bit are: 


Qbd When read, means that AMEVCNTRO<n>_EL0 is disabled. When written, has no 
effect. 
Qb1 When read, means that AMEVCNTRO<n>_EL0O is enabled. When written, disables 


AMEVCNTRO<n>_ELO. 
On a Cold reset, this field resets to 0. 


Accessing the AMCNTENCLRO_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, AMCNTENCLRO_ELO 




















op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0010 0b100 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENCLRO_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENCLRO_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENCLRO_ELO; 
elsif PSTATE.EL == EL3 then 
return AMCNTENCLRO_ELO; 
MSR AMCNTENCLRO_ELO, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0010 0b100 
if IsHighestEL(PSTATE.EL) then 
AMCNTENCLRO_ELO = X[t]; 
else 
UNDEFINED; 
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D13.5.4 AMCNTENCLR1_ELO, Activity Monitors Count Enable Clear Register 1 
The AMCNTENCLRI1_ELO characteristics are: 


63 


ARM DDI 0487E.a 
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Purpose 


Disable control bits for the auxiliary activity monitors event counters, AMEVCNTRI<n>_EL0. 


Configurations 


Attributes 


AArch6é4 System register AMCNTENCLR1_ ELO[31:0] is architecturally mapped to AArch32 
System register AMCNTENCLR1[31:0]. 


AArch64 System register AMCNTENCLR1_ ELO[31:0] is architecturally mapped to External 
register AMCNTENCLR1[31:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENCLRI1_ELO are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


AMCNTENCLRI ELO is a 64-bit register. 


Field descriptions 


The AMCNTENCLR1_ELO bit assignments are: 


Bits [63:16] 


16 15 0 


RESO P<n>, bit [n] 


Reserved, RESO. 


P<n>, bit [n], for n = 0 to 15 


Activity monitor event counter disable bit for AMEVCNTRI<n>_EL0. 
Bits [31:16] are RESO. Bits [15:N] are RAZ/WI. N is the value in AMCGCR_ELO.CGINC. 


Possible values of each bit are: 


Qbd When read, means that AMEVCNTR1<n>_EL0 is disabled. When written, has no 
effect. 
Qb1 When read, means that AMEVCNTR1<n>_EL0 is enabled. When written, disables 


AMEVCNTRI<n>_ELO. 
On a Cold reset, this field resets to 0. 


Accessing the AMCNTENCLR1_ELO 


If the number of auxiliary activity monitor event counters implemented is zero, reads and writes of 
AMCNTENCLR1_ELO are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 


à Accesses to the register behave as RAZ/WI. 


. Accesses to the register execute as a NOP. 
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Note 


The number of auxiliary activity monitor event counters implemented is zero exactly when AMCFGR_ELO.NCG 
== 0b0000. 





Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMCNTENCLR1_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1101 0b0011 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENCLR1_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





return AMCNTENCLR1_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENCLR1_ELO; 
elsif PSTATE.EL == EL3 then 
return AMCNTENCLR1_ELO; 


MSR AMCNTENCLR1_ELO, <Xt> 





op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0011 0b000 
if IsHighestEL(PSTATE.EL) then 
AMCNTENCLR1_EL® = X[t]; 
else 
UNDEFINED; 
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D13.5.5 AMCNTENSET0O_ELO, Activity Monitors Count Enable Set Register 0 
The AMCNTENSETO0_ELO characteristics are: 


Purpose 


Enable control bits for the architected activity monitors event counters, AMEVCNTRO<n>_ELO. 


Configurations 


AArch64 System register AMCNTENSETO_ELO[31:0] is architecturally mapped to AArch32 
System register AMCNTENSETO[3 1:0]. 


AArch64 System register AMCNTENSETO_ELO[31:0] is architecturally mapped to External 
register AMCNTENSETO[3 1:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENSETO0_ELO are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMCNTENSET0_ELO is a 64-bit register. 


Field descriptions 


The AMCNTENSET0_ELO bit assignments are: 


63 16 15 0 


RESO P<n>, bit [n] 


Bits [63:16] 
Reserved, RESO. 
P<n>, bit [n], for n = 0 to 15 
Activity monitor event counter enable bit for AMEVCNTRO<n>_EL0. 
Bits [31:16] are RESO. Bits [15:N] are RAZ/WI. N is the value in AMCGCR_ELO0.CGONC. 


Possible values of each bit are: 


Qbd When read, means that AMEVCNTRO<n>_EL0 is disabled. When written, has no 
effect. 
Qb1 When read, means that AMEVCNTRO<n>_EL0 is enabled. When written, enables 


AMEVCNTRO<n>_ELO. 
On a Cold reset, this field resets to 0. 


Accessing the AMCNTENSET0_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, AMCNTENSETO_ELO 




















op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0010 0b101 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENSETQ_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENSETQ_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENSETQ_ELO; 
elsif PSTATE.EL == EL3 then 
return AMCNTENSETQ_ELO; 
MSR AMCNTENSET0O_ELO, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0010 0b101 
if IsHighestEL(PSTATE.EL) then 
AMCNTENSETO_ELO = X[t]; 
else 
UNDEFINED; 
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D13.5.6 AMCNTENSET1_ELO, Activity Monitors Count Enable Set Register 1 
The AMCNTENSET1_ ELO characteristics are: 


63 
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Purpose 


Enable control bits for the auxiliary activity monitors event counters, AMEVCNTRI<n>_EL0. 


Configurations 


Attributes 


AArch64 System register AMCNTENSET1 ELO[31:0] is architecturally mapped to AArch32 
System register AMCNTENSET1[31:0]. 


AArch64 System register AMCNTENSET1 ELO[31:0] is architecturally mapped to External 
register AMCNTENSET1[31:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENSET1_ELO are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


AMCNTENSET1_ELO is a 64-bit register. 


Field descriptions 


The AMCNTENSET1_ELO bit assignments are: 


Bits [63:16] 


16 15 0 


RESO P<n>, bit [n] 


Reserved, RESO. 


P<n>, bit [n], for n = 0 to 15 


Activity monitor event counter enable bit for AMEVCNTRI1<n>_EL0. 
Bits [31:16] are RESO. Bits [15:N] are RAZ/WI. N is the value in AMCGCR_ELO.CGINC. 


Possible values of each bit are: 


Qbd When read, means that AMEVCNTR1<n>_EL0 is disabled. When written, has no 
effect. 
Qb1 When read, means that AMEVCNTR1<n>_EL0 is enabled. When written, enables 


AMEVCNTRI<n>_ELO. 
On a Cold reset, this field resets to 0. 


Accessing the AMCNTENSET1_EL0 


If the number of auxiliary activity monitor event counters implemented is zero, reads and writes of 
AMCNTENSET1_ELO are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 


à Accesses to the register behave as RAZ/WI. 


. Accesses to the register execute as a NOP. 
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Note 
The number of auxiliary activity monitor counters implemented is zero when AMCFGR_ELO.NCG == 0b0000. 








Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMCNTENSET1_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1101 0b0011 0b001 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENSET1_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





return AMCNTENSET1_ELO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCNTENSET1_ELO; 
elsif PSTATE.EL == EL3 then 
return AMCNTENSET1_ELO; 


MSR AMCNTENSET1_ELO, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0011 0b001 
if IsHighestEL(PSTATE.EL) then 
AMCNTENSET1_EL® = X[t]; 
else 
UNDEFINED; 
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D13.5.7 AMCR_ELO, Activity Monitors Control Register 
The AMCR_ELO characteristics are: 


Purpose 


Global control register for the activity monitors implementation. AMCR_ELO is applicable to both 
the architected and the auxiliary counter groups. 


Configurations 


AArch6é4 System register AMCR_EL0[31:0] is architecturally mapped to AArch32 System register 
AMCR{J31:0]. 


AArch64 System register AMCR_ELO0[31:0] is architecturally mapped to External register 
AMCRJ3 1:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCR_ELO are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMCR ELO is a 64-bit register. 


Field descriptions 


The AMCR_ELO bit assignments are: 


63 1110 9 0 


RESO RESO 


Bits [63:11] 
Reserved, RESO. 
HDBG, bit [10] 
This bit controls whether activity monitor counting is halted when the PE is halted in Debug state. 
Qbd Activity monitors do not halt counting when the PE is halted in Debug state. 
Qb1 Activity monitors halt counting when the PE is halted in Debug state. 


Bits [9:0] 


Reserved, RESO. 


Accessing the AMCR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMCR_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1101 0b0010 0b000 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
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AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCR_ELQ; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCR_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMCR_ELQ; 
elsif PSTATE.EL == EL3 then 
return AMCR_ELQ; 


MSR AMCR_ELO, <Xt> 








op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0010 0b000 
if IsHighestEL(PSTATE.EL) then 
AMCR_ELO = X[t]; 
else 
UNDEFINED; 
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D13.5.8 AMEVCNTRO<n>_ELO, Activity Monitors Event Counter Registers 0, n = 0 - 15 
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The AMEVCNTRO<n>_ELO characteristics are: 


Purpose 


Provides access to the architected activity monitor event counters. 


Configurations 


AArch64 System register AMEVCNTRO<n>_EL0[63:0] is architecturally mapped to AArch32 
System register AMEVCNTRO<n>[63:0]. 


AArch64 System register AMEVCNTRO<n>_EL0[63:0] is architecturally mapped to External 
register AMEVCNTRO<n>[63:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMEVCNTROK<n>_ELO are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMEVCNTRO<n>_EL0 is a 64-bit register. 


Field descriptions 


The AMEVCNTRO<n>_ELO bit assignments are: 


ACNT 


ACNT, bits [63:0] 
Architected activity monitor event counter n. 


Value of architected activity monitor event counter n, where n is the number of this register and is 
a number from 0 to 15. 


If the counter is enabled, writes to this register have UNPREDICTABLE results. 
On a Cold reset, this field resets to 0. 


Accessing the AMEVCNTRO<n>_EL0 


If <n> is greater than or equal to the number of architected activity monitor event counters, reads and writes of 
AMEVCNTRO<n>_EL0O are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 
è Accesses to the register behave as RAZ/WI. 


° Accesses to the register execute as a NOP. 


Note 
AMCGCR_EL0.CGONC identifies the number of architected activity monitor event counters. 








Accesses to this register use the following encodings in the System instruction encoding space: 
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D13-3600 


MRS <Xt>, AMEVCNTRO<n>_ELO 

















op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b010:n[3] n[2:0] 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVCNTRO_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVCNTRO_ELO[UInt(CRm<@>:0p2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVCNTRO_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return AMEVCNTRO_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
MSR AMEVCNTRO<n>_EL0O, <Xt> 
op0 op1 CRn CRm op2 
Ob11 0b011 0b1101 0b010:n[3] n[2:0] 





if IsHighestEL(PSTATE.EL) then 
AMEVCNTRO_ELO[UInt(CRm<0>:0p2<2:0>)] = X[t]; 
else 
UNDEFINED; 
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The AMEVCNTRI<n>_ELO characteristics are: 


Purpose 


Provides access to the auxiliary activity monitor event counters. 


Configurations 


AArch64 System register AMEVCNTR1<n>_EL0[63:0] is architecturally mapped to AArch32 
System register AMEVCNTR1<n>[63:0]. 


AArch64 System register AMEVCNTR1<n>_EL0[63:0] is architecturally mapped to External 
register AMEVCNTR1<n>[63:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMEVCNTRI1<n>_EL0 are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMEVCNTRI<n>_EL0 is a 64-bit register. 


Field descriptions 


The AMEVCNTRI<n>_ELO bit assignments are: 


ACNT 


ACNT, bits [63:0] 
Auxiliary activity monitor event counter n. 


Value of auxiliary activity monitor event counter n, where n is the number of this register and is a 
number from 0 to 15. 


If the counter is enabled, writes to this register have UNPREDICTABLE results. 
On a Cold reset, this field resets to 0. 


Accessing the AMEVCNTR1<n>_EL0 


If <n> is greater than or equal to the number of auxiliary activity monitor event counters, reads and writes of 
AMEVCNTR1<n>_EL0 are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 
è Accesses to the register behave as RAZ/WI. 


° Accesses to the register execute as a NOP. 


Note 
AMCGCR_ELO.CGINC identifies the number of auxiliary activity monitor event counters. 








Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, AMEVCNTR1<n>_ELO 

















op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b110:n[3] n[2:0] 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVCNTR1_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVCNTR1_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVCNTR1_ELO[UInt(CRm<@>:0p2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return AMEVCNTR1_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
MSR AMEVCNTR1<n>_EL0O, <Xt> 
op0 op1 CRn CRm op2 
Ob11 0b011 0b1101 0b110:n[3] n[2:0] 





if IsHighestEL(PSTATE.EL) then 
AMEVCNTR1_ELO[UInt(CRm<@>:0p2<2:0>)] = X[t]; 
else 
UNDEFINED; 
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The AMEVTYPERO<n>_ELO characteristics are: 


Purpose 


Provides information on the events that an architected activity monitor event counter 
AMEVCNTRO<n>_ELO counts. 


Configurations 


Attributes 


AArch64 System register AMEVTYPERO<n>_EL0[31:0] is architecturally mapped to AArch32 
System register AMEVTYPERO<n>[31:0]. 


AArch64 System register AMEVTYPERO<n>_EL0[31:0] is architecturally mapped to External 
register AMEVTY PERO<n>[3 1:0]. 


This register is present only when AMUVI1 is implemented. Otherwise, direct accesses to 
AMEVTYPERO<n>_ELO are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


AMEVTYPERO<n>_ELO is a 64-bit register. 


Field descriptions 


The AMEVTYPERO<n>_ELO bit assignments are: 


Bits [63:16] 


16 15 0 


RESO evtCount 


Reserved, RESO. 


evtCount, bits [15:0] 


Event to count. The event number of the event that is counted by the architected activity monitor 
event counter AMEVCNTRO<n>_ELO. The value of this field is architecturally mandated for each 
architected counter. 


The following table shows the mapping between required event numbers and the corresponding 
counters: 


0x0011 When n == 0 Processor frequency cycles 
0x4004 When n == 1 Constant frequency cycles 
0x0008 When n == 2 Instructions retired 

0x4005 When n == 3 Memory stall cycles 


Accessing the AMEVTYPERO<n>_EL0 


If <n> is greater than or equal to the number of architected activity monitor event counters, reads and writes of 
AMEVTYPERO<n>_EL0 are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 


$ Accesses to the register behave as RAZ/WI. 


. Accesses to the register execute as a NOP. 
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Note 
AMCGCR_ELO.CGONC identifies the number of architected activity monitor event counters. 








Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMEVTYPERO<n>_ELO 





op0 op1 CRn CRm 


op2 





0b11 0b011 0b1101 0b011:n[3] 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVTYPERO_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





return AMEVTYPERQ_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVTYPERO_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return AMEVTYPERO_ELO[UInt(CRm<Q>:o0p2<2:0>)]; 
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D13.5.11 AMEVTYPER1<n>_EL0, Activity Monitors Event Type Registers 1,n = 0-15 
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The AMEVTYPER1<n>_ELO characteristics are: 


Purpose 
Provides information on the events that an auxiliary activity monitor event counter 
AMEVCNTRI<n>_EL0 counts. 

Configurations 
AArch6é4 System register AMEVTYPER1<n>_EL0[31:0] is architecturally mapped to AArch32 
System register AMEVTYPER1<n>[31:0]. 
AArch6é4 System register AMEVTYPERI1<n>_EL0[31:0] is architecturally mapped to External 
register AMEVTY PER1<n>[31:0]. 
This register is present only when AMUVI1 is implemented. Otherwise, direct accesses to 
AMEVTYPER1<n>_ELO are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


AMEVTYPERI<n>_ELO is a 64-bit register. 


Field descriptions 


The AMEVTYPER1<n>_ELO bit assignments are: 


Bits [63:16] 


16 15 0 


RESO evtCount 


Reserved, RESO. 


evtCount, bits [15:0] 


Event to count. The event number of the event that is counted by the auxiliary activity monitor event 
counter AMEVCNTRI1<n>_EL0. 


It is IMPLEMENTATION DEFINED what values are supported by each counter. 


If software writes a value to this field which is not supported by the corresponding counter 
AMEVCNTRI<n>_EL0O, then: 


. It is UNPREDICTABLE which event will be counted. 
. The value read back is UNKNOWN. 


The event counted by AMEVCNTR1<n>_ELO might be fixed at implementation. In this case, the 
field is read-only and writes are UNDEFINED. 


If the corresponding counter AMEVCNTR1<n>_ELO is enabled, writes to this register have 
UNPREDICTABLE results. 


Accessing the AMEVTYPER1<n>_EL0 


If <n> is greater than or equal to the number of auxiliary activity monitor event counters, reads and writes of 
AMEVTYPER1<n>_EL0 are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


s Accesses to the register are UNDEFINED. 


. Accesses to the register behave as RAZ/WI. 


° Accesses to the register execute as a NOP. 
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Note 
AMCGCR_ELO.CGINC identifies the number of auxiliary activity monitor event counters. 








Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMEVTYPER1<n>_EL0O 





op0 op1 CRn CRm op2 





0b11 0b011 0b1101 0b111:n[3] n[2:0] 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVTYPER1_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 





return AMEVTYPER1_ELO[UInt(CRm<@>:0p2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMEVTYPER1_ELO[UInt(CRm<Q>:0p2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return AMEVTYPER1_ELO[UInt(CRm<Q>:o0p2<2:0>)]; 


MSR AMEVTYPER1<n>_ELO, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b011 0b1101 0b111:n[3] n[2:0] 





if IsHighestEL(PSTATE.EL) then 
AMEVTYPER1_ELO[UInt(CRm<0>:0p2<2:0>)] = X[t]; 
else 
UNDEFINED; 
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D13.5.12 AMUSERENR_ELO, Activity Monitors User Enable Register 
The AMUSERENR ELO characteristics are: 


Purpose 


Global user enable register for the activity monitors. Enables or disables ELO access to the activity 
monitors. AMUSERENR ELO is applicable to both the architected and the auxiliary counter 
groups. 

Configurations 


AArch64 System register AMUSERENR_ELO[31:0] is architecturally mapped to AArch32 System 
register AMUSERENR[3 1:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMUSERENR ELO are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMUSERENR ELO is a 64-bit register. 


Field descriptions 


The AMUSERENR ELO bit assignments are: 


63 1 0 


RESO 


ar 


Bits [63:1] 


Reserved, RESO. 


EN, bit [0] 


Traps ELO accesses to the activity monitors registers to EL1, or to EL2 when it is implemented and 
enabled for the current Security state and HCR_EL2.TGE is 1, as follows: 


° In AArch64 state, accesses to the following registers are trapped, reported using EC 
syndrome value 0x18: 


—  AMCFGR _ELO0, AMCGCR_EL0, AMCNTENCLRO0_EL0, AMCNTENCLR1 ELO, 
AMCNTENSETO_ELO, AMCNTENSET1 ELO, AMCR_ELO, 


AMEVCNTRO<n>_EL0, AMEVCNTR1<n>_EL0, AMEVTYPERO<n>_ELO, and 
AMEVTYPER1<n>_EL0. 


e In AArch32 state, MRC and MCR accesses to the following registers are trapped and 
reported using EC syndrome value 0x03, MRRC and MCRR accesses are trapped and 
reported using EC syndrome value 0x04: 


— AMCFGR, AMCGCR, AMCNTENCLRO, AMCNTENCLR1, AMCNTENSETO, 
AMCNTENSET1, AMCR, AMEVCNTRO<n>, AMEVCNTR1<n>, 
AMEVTYPERO<n>, and AMEVTYPERI1<n>. 


Qbd ELO accesses to the activity monitors registers are trapped. 


Qb1 This control does not cause any instructions to be trapped. Software can access all 
activity monitor registers at ELO. 


Note 
à AMUSERENR ELO can always be read at ELO and is not governed by this bit. 
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D13-3608 


Accessing the AMUSERENR_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, AMUSERENR_ELO 














op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0010 0b011 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMUSERENR_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMUSERENR_ELQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return AMUSERENR_ELQ; 
elsif PSTATE.EL == EL3 then 
return AMUSERENR_ELQ; 
MSR AMUSERENR_ELO, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b011 0b1101 0b0010 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
AMUSERENR_EL@ = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
AMUSERENR_EL@ = X[t]; 
elsif PSTATE.EL == EL3 then 
AMUSERENR_ELO = X[t]; 
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D13.6 Statistical Profiling Extension registers 


This section lists the Statistical Profiling Extension registers in AArch64. 
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D13.6.1 PMBIDR_EL41, Profiling Buffer ID Register 


The PMBIDR_ ELI characteristics are: 


Purpose 
Provides information to software as to whether the buffer can be programmed at the current 
Exception level. 

Configurations 
This register is present only when SPE is implemented. Otherwise, direct accesses to 
PMBIDR_ELI are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


PMBIDR_ EL] is a 64-bit register. 


Field descriptions 


The PMBIDR_ EL! bit assignments are: 


63 





Bits [63:6] 


Reserved, RESO. 


F, bit [5] 


Flag Updates. Defines whether the address translation performed by the Profiling Buffer manages 
the Access Flag and dirty state. 


ObO Hardware management of the Access Flag and dirty state for accesses made by the 
Statistical Profiling Extension is always disabled for all translation stages. 


0b1 Hardware management for the Access Flag and dirty state for accesses made by the 
Statistical Profiling Extension is controlled in the same way as explicit memory 
accesses in the owning translation regime. 


If hardware management of the Access Flag is disabled for a stage of translation, an access to Page 
or Block with the Access flag bit not set in the descriptor will generate an Access Flag fault. 


If hardware management of the dirty state is disabled for a stage of translation, an access to a Page 
or Block will ignore the Dirty Bit Modifier in the descriptor might generate a Permission fault, 
depending on the values of the access permission bits in the descriptor. 
P, bit [4] 
When ARMV8.4-SecEL2 is implemented: 


Programming not allowed. The Profiling Buffer is owned by a higher Exception level or the other 
Security state. 


Qbd Profiling Buffer is owned by the current or a lower Exception level in the current 
Security state. 


Qb1 Profiling Buffer is owned by a higher Exception level or the other Security state. 


The value read from this field depends on the current Exception level and the values of 
MDCR_EL3.NSPB and MDCR_EL2.E2PB: 


° If MDCR_EL3.NSPB == 0b00 or MDCR_EL3.NSPB == 0b01, this bit reads as one from 
Non-secure EL2 and Non-secure EL1. 
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G If MDCR_EL3.NSPB == 0b10 or MDCR_EL3.NSPB == 0b11, this bit reads as one from 
Secure EL1 and, if Secure EL2 is implemented and enabled, Secure EL2. 


. If MDCR_EL2.E2PB == 0b00, this bit reads as one from Non-secure EL1, and if Secure EL2 
is implemented and enabled, also from Secure EL1. 


° Otherwise, this bit reads as zero. 


Otherwise: 


Programming not allowed. The Profiling Buffer is owned by a higher Exception level or the other 
Security state. 


Qbd Profiling Buffer is owned by the current or a lower Exception level in the current 
Security state. 


Qb1 Profiling Buffer is owned by a higher Exception level or the other Security state. 


The value read from this field depends on the current Exception level and the values of 
MDCR_EL3.NSPB and MDCR_EL2.E2PB: 


s If MDCR_EL3.NSPB == 0b00 or MDCR_EL3.NSPB == 0b01, this bit reads as one from EL2 
and Non-secure EL1. 


s If MDCR_EL3.NSPB == 0b10 or MDCR_EL3.NSPB == 0b11, this bit reads as one from 
Secure ELI. 


a If MDCR_EL2.E2PB == 0b00, this bit reads as one from Non-secure EL1. 


° Otherwise, this bit reads as zero. 


Align, bits [3:0] 


Defines the minimum alignment constraint for PMBPTR_EL1. If this field is non-zero, then the PE 
must pad every record up to a multiple of this size. 


0b0000 Byte 
0b0001 Halfword. 
0b0010 Word. 
Qb0011 Doubleword. 
0b0100 16 Bytes. 
0b0101 32 Bytes. 
0b0110 64 Bytes. 
0b0111 128 Bytes. 
0b1000 256 Bytes. 
0b1001 512 Bytes. 
0b1010 1KB. 
0b1011 2KB. 


For more information, see Restrictions on the current write pointer on page D9-2750. 


Accessing the PMBIDR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMBIDR_EL1 








if PSTATE.EL == EL@ then 


op0 op1 CRn CRm op2 
0b11 0b000 0b1001 0b1010 0b111 
elsif PSTATE.EL == EL1 then 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3611 


Non-Confidential 


AArch64 System Register Descriptions 
D13.6 Statistical Profiling Extension registers 


return PMBIDR_EL1; 
elsif PSTATE.EL == EL2 then 

return PMBIDR_EL1; 
elsif PSTATE.EL == EL3 then 

return PMBIDR_EL1; 
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D13.6.2 PMBLIMITR_EL1, Profiling Buffer Limit Address Register 
The PMBLIMITR_EL1I characteristics are: 


Purpose 


Defines the upper limit for the profiling buffer, and enables the profiling buffer 


Configurations 


This register is present only when SPE is implemented. Otherwise, direct accesses to 
PMBLIMITR_ELI are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


PMBLIMITR EL] is a 64-bit register. 


Field descriptions 


The PMBLIMITR_EL1 bit assignments are: 


63 12 11 3210 


LIMIT RESO m fe 
LIMIT, bits [63:12] 


Limit address. PMBLIMITR_EL1.LIMIT:Zeros(12) is the address of the first byte in memory after 
the last byte in the profiling buffer. If the smallest implemented translation granule is not 4KB, then 
bits[N-1:12] are RESO, where N is the IMPLEMENTATION DEFINED value, Log2(smallest implemented 
translation granule). 


This field resets to an architecturally UNKNOWN value. 


Bits [11:3] 


Reserved, RESO. 


FM, bits [2:1] 
Fill mode 
0b00 Stop collection and raise maintenance interrupt on buffer fill. 


All other values are reserved. If this field is programmed with a reserved value, the PE behaves as 
if this field has a defined value, other than for a direct read of the register. Software must not rely 
on the behavior of reserved values, as they might change in a future version of the architecture. 


This field resets to an architecturally UNKNOWN value. 


E, bit [0] 
Profiling Buffer enable 
0bd All output is discarded. 
Qb1 Profiling buffer enabled. 


On a Warm reset, this field resets to 0. 


Accessing the PMBLIMITR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3613 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.6 Statistical Profiling Extension registers 


MRS <Xt>, PMBLIMITR_EL1 





op0 op1 CRn 


0b11 0b000 0b1001 


CRm op2 


0b1010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.E2PB == 'x@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 


return NVMem[0x800] ; 
else 
return PMBLIMITR_EL1; 
elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMBLIMITR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMBLIMITR_EL1; 


MSR PMBLIMITR_EL1, <Xt> 





op0 op1 CRn 


CRm op2 





0b11 0b000 0b1001 


0b1010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.E2PB == 'x@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 


NVMem[@x800] = X[t]; 
else 
PMBLIMITR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '01' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 





PMBLIMITR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMBLIMITR_EL1 = X[t]; 
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D13.6.3 PMBPTR_EL41, Profiling Buffer Write Pointer Register 


63 


ARM DDI 0487E.a 
ID070919 


The PMBPTR_EL1 characteristics are: 


Purpose 
Defines the current write pointer for the profiling buffer. 
Configurations 
This register is present only when SPE is implemented. Otherwise, direct accesses to 
PMBPTR_EL!1 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


PMBPTR_ EL] is a 64-bit register. 


Field descriptions 


The PMBPTR_ EL] bit assignments are: 


PTR 


PTR, bits [63:0] 
Current write address. Defines the virtual address of the next entry to be written to the buffer. 


The architecture places restrictions on the values software can write to the pointer. For more 
information see Restrictions on the current write pointer on page D9-2750. 





Note 


As a result, an implementation might treat some of bits[M:0], where M is defined by 
PMBIDR EL1.Align, as RESO. 





On a management interrupt, PMBPTR_EL1 is frozen. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Accessing the PMBPTR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMBPTR_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1010 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.E2PB == 'x0' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
return NVMem[0x810] ; 
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else 
return PMBPTR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == 'O 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMBPTR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMBPTR_EL1; 


MSR PMBPTR_EL1, <Xt> 


' && MDCR_EL3.NSPB != 'Q1' then 


"1' && MDCR_EL3.NSPB != '11' then 





op0 op1 


CRn CRm op2 





0b11 0b000 


0b1001 0b1010 0b001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.E2PB == 'xQ' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2 
NVMem[@x810] = X[t]; 
else 
PMBPTR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == 'O 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMBPTR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMBPTR_EL1 = X[t]; 


'O' && MDCR_EL3.NSPB != 'Q1' then 
"1' && MDCR_EL3.NSPB != '11' then 


yNV1,NV> == '1x1' then 


' && MDCR_EL3.NSPB != 'Q1' then 


'1' && MDCR_EL3.NSPB != '11' then 
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D13.6.4 PMBSR_EL1, Profiling Buffer Status/syndrome Register 


The PMBSR_EL1 characteristics are: 


Purpose 
Provides syndrome information to software when the buffer is disabled because the management 
interrupt has been raised. 

Configurations 
This register is present only when SPE is implemented. Otherwise, direct accesses to PMBSR_EL1 
are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


PMBSR_EL1 is a 64-bit register. 


Field descriptions 


The PMBSR_ EL! bit assignments are: 


| RESO EC 


Bits [63:32] 





| Po COLL 
EA 


Reserved, RESO. 


EC, bits [31:26] 
Exception class 
Top-level description of the cause of the buffer management event 
EC == 0b100100 
Stage 1 Data Abort on write to Profiling Buffer. 
See MSS encoding for a Data Abort or stage 2 Data Abort on write to buffer. 
EC == 0b100101 
Stage 2 Data Abort on write to Profiling Buffer. 
See MSS encoding for a Data Abort or stage 2 Data Abort on write to buffer. 
EC = 0b000000 


Other buffer management event. All buffer management events other than those 
described by other defined Exception class codes. 


See MSS encoding for other buffer management event. 


All other values are reserved. Reserved values might be defined in a future version of the 
architecture. 


Writing a reserved value to this field will make the value of this field UNKNOWN. Values that are not 
supported act as reserved values when writing to this register. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bits [25:20] 


Reserved, RESO. 
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DL, bit [19] 
Partial record lost. 


Following a buffer management event other than an asynchronous External abort, indicates whether 
the last record written to the Profiling Buffer is complete. 


Qbd PMBPTR_ EL] points to the first byte after the last complete record written to the 
Profiling Buffer. 
Qb1 Part of a record was lost because of a buffer management event or synchronous External 


abort. PMBPTR_EL1 might not point to the first byte after the last complete record 
written to the buffer, and so restarting collection might result in a data record stream that 
software cannot parse. All records prior to the last record have been written to the buffer. 


When the buffer management event was because of an asynchronous external abort, this bit is set to 
1 and software must not assume that any valid data has been written to the Profiling Buffer. 


This bit is RESO if the PE never sets this bit as a result of a buffer management event caused by an 
asynchronous External abort. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


EA, bit [18] 
External abort. 
ObO An external abort has not been asserted. 
Qb1 An external abort has been asserted and detected by the Statistical Profiling Extension. 
This bit is RESO if the PE never sets this bit as the result of an External abort. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


S, bit [17] 
Service 
Obd PMBIRQ is not asserted. 
Qb1 PMBIRQ is asserted. All profiling data has either been written to the buffer or 


discarded. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


COLL, bit [16] 
Collision detected. 
0bd No collision events detected. 
Qb1 At least one collision event was recorded. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


MSS, bits [15:0] 
Management Event Specific Syndrome. 
Contains syndrome specific to the management event. 
The syndrome contents for each management event are described in the following sections. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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MSS encoding for a Data Abort or stage 2 Data Abort on write to buffer 


Bits [15:6] 


Reserved, RESO. 


FSC, bits [5:0] 
Fault status code 
0b0000xx Address Size fault. Bits [1:0] encode the level. 
Qb0001xx Translation fault. Bits [1:0] encode the level. 
Qb0010xx Access Flag fault. Bits [1:0] encode the level. 
@b0011xx Permission fault. Bits [1:0] encode the level. 
0b010000 Synchronous External abort on write. 


@b0101xx Synchronous External abort on translation table walk or hardware update of translation 
table. Bits [1:0] encode the level. 


0b010001 Asynchronous External abort on write. 
0b100001 Alignment fault. 
0b110000 TLB Conflict fault. 


All other values are reserved. Reserved values might be defined in a future version of the 
architecture. 


Writing a reserved value to this field will make the value of this field UNKNOWN. Values that are not 
supported act as reserved values when writing to this register. 


It is IMPLEMENTATION DEFINED whether each of the Access Flag fault, asynchronous External abort 
and synchronous External abort, Alignment fault, and TLB Conflict abort values can be generated 
by the PE. For more information see Faults and watchpoints on page D9-2755. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


MSS encoding for other buffer management event 


Bits [15:6] 


Reserved, RESO. 


BSC, bits [5:0] 
Buffer status code 
0b000000 Buffer not filled 
0b000001 Buffer filled 


All other values are reserved. Reserved values might be defined in a future version of the 
architecture. 


Writing a reserved value to this field will make the value of this field UNKNOWN. Values that are not 
supported act as reserved values when writing to this register. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3619 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.6 Statistical Profiling Extension registers 


Accessing the PMBSR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMBSR_EL1 


op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1010 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.E2PB == 'xQ' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '01' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
return NVMem[0x820] ; 
else 
return PMBSR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMBSR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMBSR_EL1; 


MSR PMBSR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1010 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.E2PB == 'xQ' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
NVMem[@x820] = X[t]; 
else 
PMBSR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMBSR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMBSR_EL1 = X[t]; 
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D13.6.5 PMSCR_EL41, Statistical Profiling Control Register (EL1) 


The PMSCR_EL1 characteristics are: 


Purpose 
Provides EL1 controls for Statistical Profiling 

Configurations 
This register is present only when SPE is implemented. Otherwise, direct accesses to PMSCR_EL1 
are UNDEFINED. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 


PMSCR_EL1 is a 64-bit register. 


Field descriptions 


The PMSCR_EL1 bit assignments are: 


63 


RESO 


Bits [63:7] 
Reserved, RESO. 
PCT, bit [6] 
When HaveEL(EL2): 
Physical Timestamp. 


If timestamp sampling is enabled, determines which counter is collected. 


Qbd Virtual counter, CNTVCT_ELO, is collected. 
Qb1 Physical counter, CNTPCT_ELO, is collected. 


If EL2 is implemented and enabled in the current Security state: 





a If MDCR_EL2.E2PB != 0b00, this bit is combined with PMSCR_EL2.PCT to determine 
which counter is collected. For more information, see Controlling the data that is collected 


on page D9-2748 


a If MDCR_EL2.E2PB == 0b09, this bit is ignored by the PE. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RES1. 
TS, bit [5] 
Timestamp Enable. 
Qbd Timestamp sampling disabled. 


Qb1 Timestamp sampling enabled. 
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If EL2 is implemented and enabled in the current Security state, this bit is ignored by the PE when 
MDCR_EL2.E2PB == 0b00. 


This field resets to an architecturally UNKNOWN value. 


PA, bit [4] 

Physical Address Sample Enable. 

Qbd Physical addresses are not collected. 

Qb1 Physical addresses are collected. 

If EL2 is implemented and enabled in the current Security state: 

: IfMDCR_EL2.E2PB != 0b00, this bit is combined with PMSCR_EL2.PA to determine which 
address is collected. For more information, see Controlling the data that is collected on 
page D9-2748. 

° If MDCR_EL2.E2PB == 0b00, this bit is ignored by the PE. 

This field resets to an architecturally UNKNOWN value. 

CX, bit [3] 

CONTEXTIDR_EL1 Sample Enable. 

Qbd CONTEXTIDR_ ELI is not collected. 

Qb1 CONTEXTIDR_ ELI! is collected. 

If EL2 is implemented and enabled in the current Security state: 

s If the PE is at EL2, this bit is ignored by the PE. 

$ If HCR_EL2.TGE == 1, this bit is ignored by the PE. 

This field resets to an architecturally UNKNOWN value. 

Bit [2] 


Reserved, RESO. 


E1SPE, bit [1] 
EL1 Statistical Profiling Enable. 
Qbd Sampling disabled at EL1. 
Qb1 Sampling enabled at EL1. 


If EL2 is implemented and enabled in the current Security state, this bit is ignored by the PE when 
HCR_EL2.TGE = 1. 


This field resets to an architecturally UNKNOWN value. 


EOSPE, bit [0] 


ELO Statistical Profiling Enable. Controls sampling at ELO when HCR_EL2.TGE == 0 or if EL2 is 
disabled or not implemented. 


Qbd Sampling disabled at ELO. 
Qb1 Sampling enabled at ELO. 


If EL2 is implemented and enabled in the current Security state, this bit is ignored by the PE when 
HCR_EL2.TGE = 1. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMSCR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, PMSCR_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b1001 0b1001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x828] ; 
else 
return PMSCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
return PMSCR_EL2; 
else 
return PMSCR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMSCR_EL1; 


MSR PMSCR_EL1, <Xt> 


op0 op1 CRn CRm op2 


0b11 0b000 0b1001 0b1001 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x828] = X[t]; 
else 
PMSCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
PMSCR_EL2 = X[t]; 
else 
PMSCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMSCR_EL1 = X[t]; 
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MRS <Xt>, PMSCR_EL12 





op0 op1 


0b11 0b101 


CRn CRm op2 


0b1001 0b1001 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x828]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS = 


AArch64.SystemAccessTrap(EL3, 0x18); 


= 'Q' && MDCR_EL3.NSPB != 'Q1' then 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 


return PMSCR_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return PMSCR_EL1; 
else 


UNDEFINED; 


MSR PMSCR_EL12, <Xt> 


op0 op1 
0b11 0b101 


if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x828] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 


CRn CRm op2 


0b1001 0b1001 0b000 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSCR_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
PMSCR_EL1 = X[t]; 
else 
UNDEFINED; 
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D13.6.6 PMSCR_EL42, Statistical Profiling Control Register (EL2) 


The PMSCR_EL2 characteristics are: 


63 
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Purpose 


Provides EL2 controls for Statistical Profiling 


Configurations 


Attributes 


This register is present only when SPE is implemented. Otherwise, direct accesses to PMSCR_EL2 
are UNDEFINED. 


This register has no effect if EL2 is not enabled in the current Security state. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


PMSCR_EL2 is a 64-bit register. 


Field descriptions 


The PMSCR_EL2 bit assignments are: 


Bits [63:7] 


PCT, bit [6] 


TS, bit [5] 


RESO 





Reserved, RESO. 


Physical Timestamp. 

If timestamp sampling is enabled, determines which counter is collected. 
Qbd Virtual counter, CNTVCT_ELO, is collected. 

Qb1 Physical counter, CNTPCT_ELO, is collected. 


If MDCR_EL2.E2PB != 0b00, this bit is combined with PMSCR_EL1.PCT to determine which 
counter is collected. For more information, see Controlling the data that is collected on 
page D9-2748. 


If EL2 is disabled in the current Security state, this bit is ignored. If EL2 is not implemented, the PE 
behaves as if this bit is set to 1, other than for a direct read of the register. 


This field resets to an architecturally UNKNOWN value. 


Timestamp Enable. 

Qbd Timestamp sampling disabled. 

Qb1 Timestamp sampling enabled. 

If EL2 is disabled in the current Security state, or if MDCR_EL2.E2PB != 0bQQ, this bit is ignored. 


This field resets to an architecturally UNKNOWN value. 
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PA, bit [4] 


CX, bit [3] 


Bit [2] 


E2SPE, bit [1] 


Physical Address Sample Enable. 
ObO Physical addresses are not collected. 
0b1 Physical addresses are collected. 


If MDCR_EL2.E2PB != 0b00, this bit is combined with PMSCR_EL1.PA to determine which 
address is collected. For more information, see Controlling the data that is collected on 
page D9-2748. 


If EL2 is disabled in the current Security state, this bit is ignored. If EL2 is not implemented, the PE 
behaves as if this bit is set to 1, other than for a direct read of the register. 


This field resets to an architecturally UNKNOWN value. 


CONTEXTIDR_EL2 Sample Enable. 

Qbd CONTEXTIDR_EL2 is not collected. 

Qb1 CONTEXTIDR_EL2 is collected. 

If EL2 is disabled in the current Security state, this bit is ignored by the PE. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


EL2 Statistical Profiling Enable. 

Qbd Sampling disabled at EL2. 

Qb1 Sampling enabled at EL2. 

This bit is RESO if MDCR_EL2.E2PB != 0b00. 

If EL2 is disabled in the current Security state, this bit is ignored by the PE. 


This field resets to an architecturally UNKNOWN value. 


EOHSPE, bit [0] 


ELO Statistical Profiling Enable. 

Qbd Sampling disabled at ELO. 

Qb1 Sampling enabled at ELO. 

If MDCR_EL2.E2PB != 0b00, this bit is RESO. 


If EL2 is implemented and enabled in the current Security state, this bit is ignored by the PE when 
HCR_EL2.TGE = 0. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMSCR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMSCR_EL2 











if PSTATE.EL == EL@ then 


UNDEFINED; 


op0 op1 CRn CRm op2 
0b11 0b100 0b1001 0b1001 0b000 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSCR_EL2; 
elsif PSTATE.EL == EL3 then 
return PMSCR_EL2; 


MSR PMSCR_EL2, <Xt> 


op0 op1 CRn CRm op2 





0b11 0b100 0b1001 0b1001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSCR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMSCR_EL2 = X[t]; 


MRS <Xt>, PMSCR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x828] ; 
else 
return PMSCR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3627 
Non-Confidential 


AArch64 System Register Descriptions 
D13.6 Statistical Profiling Extension registers 


return PMSCR_EL2; 
else 
return PMSCR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMSCR_EL1; 


MSR PMSCR_EL1, <Xt> 





op0 op1 CRn 


CRm op2 





0b11 0b000 0b1001 


0b1001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '01' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


NVMem[@x828] = X[t]; 
else 
PMSCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HCR_EL2.E2H == '1' then 
PMSCR_EL2 = X[t]; 
else 
PMSCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMSCR_EL1 = X[t]; 
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D13.6.7 PMSEVFR_EL1, Sampling Event Filter Register 
The PMSEVFR_ ELI characteristics are: 


Purpose 


Controls sample filtering by events. The overall filter is the logical AND of these filters. For 
example, if E[3] and E[5] are both set to 1, only samples that have both event 3 (Level 1 unified or 
data cache refill) and event 5 set (TLB walk) are recorded 


Configurations 


This register is present only when SPE is implemented. Otherwise, direct accesses to 
PMSEVFR_EL1 are UNDEFINED. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMSEVFR _ EL1 is a 64-bit register. 


Field descriptions 


The PMSEVFR_ EL! bit assignments are: 


30 59 58 57 56 55 54 53 52 51 50 49 48 47 |. 32 31 30 29 28 27 26 25 24 23 19 18 17 16 15 14 13 12 11 10 876543 2 1 0 


E[3] 
RAZWI 
E[5] 
RAZ/WI 
E[7] 
RAZ/WI 
E[11] 
E[12 
E[13 
E[14 
E[15 
RAZ/WI 
E[17] 
E[18] 
RAZ/WI 
E[24 
E[25 


E[<z>], bit [z], for z = 48 to 63 


E[<z>] is the event filter for event <z>. If event <z> is not implemented, or filtering on event <z> 
is not supported, the corresponding bit is RAZ/WI. 


Qbd Event <z> is ignored. 
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Qb1 Do not record samples that have event <z> == 0. 


An IMPLEMENTATION DEFINED event might be recorded as a multi-bit field. In this case, if the 
corresponding bits of PMSEVFR_EL1 define an IMPLEMENTATION DEFINED filter for the event. 


This field is ignored by the PE when PMSFCR_EL1.FE == 0 
This field resets to an architecturally UNKNOWN value. 


Bits [47:32] 


Reserved, RAZ/WI. 


E|<y>], bit [y], for y = 24 to 31 


E[<y>] is the event filter for event <y>. If event <y> is not implemented, or filtering on event <y> 


is not supported, the corresponding bit is RAZ/WI. 
Qbd Event <y> is ignored. 


Qb1 Do not record samples that have event <y> == 0. 


An IMPLEMENTATION DEFINED event might be recorded as a multi-bit field. In this case, if the 
corresponding bits of PMSEVFR_EL1 define an IMPLEMENTATION DEFINED filter for the event. 


This field is ignored by the PE when PMSFCR_EL1.FE == 


This field resets to an architecturally UNKNOWN value. 


Bits [23:19] 


Reserved, RAZ/WI. 


E[18], bit [18] 


When ARMv%8.3-SPE is implemented and SVE is implemented: 


Empty predicate. 
Ob Empty predicate event is ignored. 
Qb1 Do not record samples that have the Empty predicate event == 0. 


This bit is ignored by the PE when PMSFCR_EL1.FE == 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RAZ/WI. 


E[17], bit [17] 


Bit [16] 


When ARMVv%8.3-SPE is implemented and SVE is implemented: 
Partial predicate. 


Qbd Partial predicate event is ignored. 


Qb1 Do not record samples that have the Partial predicate event == 0. 


This bit is ignored by the PE when PMSFCR_EL1.FE == 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RAZ/WI. 


Reserved, RAZ/WI. 


E[<x>], bit [x], for x = 12 to 15 


E[<x>] is the event filter for event <x>. If event <x> is not implemented, or filtering on event <x> 


is not supported, the corresponding bit is RAZ/WI. 
Qbe Event <x> is ignored. 


Qb1 Do not record samples that have event <x> == 0. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.6 Statistical Profiling Extension registers 


An IMPLEMENTATION DEFINED event might be recorded as a multi-bit field. In this case, if the 
corresponding bits of PMSEVFR_EL1 define an IMPLEMENTATION DEFINED filter for the event. 


This field is ignored by the PE when PMSFCR_EL1.FE == 
This field resets to an architecturally UNKNOWN value. 
E[11], bit [11] 
When ARMVv8.3-SPE is implemented: 


Alignment. 
Qbd Alignment event is ignored. 
Qb1 Do not record samples that have the Alignment event == 0. 


This bit is ignored by the PE when PMSFCR_EL1.FE == 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RAZ/WI. 
Bits [10:8] 


Reserved, RAZ/WI. 


E[7], bit [7] 


Mispredicted. 
Qbe Mispredicted event is ignored. 
Qb1 Do not record samples that have the Mispredicted event == 0. 


This bit is ignored by the PE when PMSFCR_EL1.FE == 0. 


This field resets to an architecturally UNKNOWN value. 
Bit [6] 
Reserved, RAZ/WI. 


E[5], bit [5] 


TLB walk. 
Qbd TLB walk event is ignored. 
Qb1 Do not record samples that have the TLB walk event == 0. 


This bit is ignored by the PE when PMSFCR_EL1.FE == 0. 
This field resets to an architecturally UNKNOWN value. 

Bit [4] 
Reserved, RAZ/WI. 

E[3], bit [3] 
Level 1 data or unified cache refill. 
Ob Level 1 data or unified cache refill event is ignored. 
Qb1 Do not record samples that have the Level 1 data or unified cache refill event == 0. 
This bit is ignored by the PE when PMSFCR_EL1.FE == 0. 
This field resets to an architecturally UNKNOWN value. 

Bit [2] 
Reserved, RAZ/WI. 

E[1], bit [1] 

When the PE supports sampling of speculative instructions: 


Architecturally retired. 
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When the PE supports sampling of speculative instructions: 

Qbd Architecturally retired event is ignored. 

Qb1 Do not record samples that have the Architecturally retired event == 0. 
This bit is ignored by the PE when PMSFCR_EL1.FE == 0. 


If the PE does not support the sampling of speculative instructions, or always discards the sample 
record for speculative instructions, this bit reads as an UNKNOWN value and the PE ignores its value. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, UNKNOWN. 
Bit [0] 


Reserved, RAZ/WI. 


Accessing the PMSEVFR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMSEVFR_EL1 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b1001 


0b1001 


0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 


return NVMem[0x830] ; 
else 
return PMSEVFR_EL1; 
elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSEVFR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMSEVFR_EL1; 


MSR PMSEVFR_EL1, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b1001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
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elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '01' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
NVMem[@x830] = X[t]; 

else 
PMSEVFR_EL1 = X[t]; 


elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

else 
PMSEVFR_EL1 = X[t]; 


elsif PSTATE.EL == EL3 then 


PMSEVFR_EL1 = X[t]; 
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D13.6.8 PMSFCR_EL1, Sampling Filter Control Register 


The PMSFCR_ELI characteristics are: 


Purpose 
Controls sample filtering. The filter is the logical AND of the FL, FT and FE bits. For example, if 
FE == 1 and FT = 1 only samples including the selected operation types and the selected events 
will be recorded 

Configurations 
This register is present only when SPE is implemented. Otherwise, direct accesses to 
PMSFCR_ELI are UNDEFINED. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 


PMSFCR_EL1 is a 64-bit register. 
Field descriptions 


The PMSFCR_ELI bit assignments are: 


63 19 18 17 16 15 





RESO 


Bits [63:19] 


Reserved, RESO. 


ST, bit [18] 
Store filter enable 
Ob Do not record store operations 
Qb1 Record all store operations, including vector stores and all atomic operations 
This bit is ignored by the PE when PMSFCR_EL1.FT == 0. 
This field resets to an architecturally UNKNOWN value. 
LD, bit [17] 
Load filter enable 
ObO Do not record load operations 
Qb1 Record all load operations, including vector loads and atomic operations that return data 
This bit is ignored by the PE when PMSFCR_EL1.FT == 0. 
This field resets to an architecturally UNKNOWN value. 
B, bit [16] 
Branch filter enable 
Qbd Do not record branch and exception return operations 
Qb1 Record all branch and exception return operations 
This bit is ignored by the PE when PMSFCR_EL1.FT == 0. 


This field resets to an architecturally UNKNOWN value. 
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Bits [15:3] 


Reserved, RESO. 


FL, bit [2] 
Filter by latency 
Ob Latency filtering disabled 


Qb1 Latency filtering enabled. Samples with a total latency less than 
PMSLATFR_EL1.MINLAT will not be recorded 


If this field is set to 1 and PMSLATFR_EL1.MINLAT is set to zero, it is CONSTRAINED 
UNPREDICTABLE whether no samples are recorded or the PE behaves as if PMSFCR_EL1.FL is set 
to 0 


This field resets to an architecturally UNKNOWN value. 


FT, bit [1] 


Filter by operation type. The filter is the logical OR of the ST, LD and B bits. For example, if LD 
and ST are both set, both load and store operations are recorded 


Qbd Type filtering disabled 


Qb1 Type filtering enabled. Samples not one of the selected operation types will not be 
recorded 


If this field is set to 1 and the PMSFCR_EL1.{ST, LD, B} bits are all set to zero, it is CONSTRAINED 
UNPREDICTABLE whether no samples are recorded or the PE behaves as if PMSFCR_EL1.FT is set 
to 0 


This field resets to an architecturally UNKNOWN value. 
FE, bit [0] 

Filter by event 

Qbd Event filtering disabled 


Qb1 Event filtering enabled. Samples not including the events selected by PMSEVFR_EL1 
will not be recorded 


If this field is set to 1 and PMSEVFR_EL1 is set to zero, it is CONSTRAINED UNPREDICTABLE 
whether no samples are recorded or the PE behaves as if PMSFCR_EL1.FE is set to 0 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMSFCR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMSFCR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1001 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSFCR_EL1; 
elsif PSTATE.EL == EL2 then 
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D13-3636 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSFCR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMSFCR_EL1; 


MSR PMSFCR_EL1, <Xt> 











op0 op1 CRn CRm op2 
0b11 0b000 0b1001 0b1001 0b100 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSFCR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSFCR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMSFCR_EL1 = X[t]; 
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D13.6.9 PMSICR_EL1, Sampling Interval Counter Register 
The PMSICR_EL1 characteristics are: 


Purpose 
Software must write zero to PMSICR_EL1 before enabling sample profiling for a sampling session. 
Software must then treat PMSICR_EL]1 as an opaque, 64-bit, read/write register used for context 
switches only. 

Configurations 


This register is present only when SPE is implemented. Otherwise, direct accesses to PMSICR_EL1 
are UNDEFINED. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 
The value of PMSICR_EL1 does not change whilst profiling is disabled. 


Field descriptions 


The PMSICR_EL1 bit assignments are: 


56 55 32 31 


63 0 
| ECOUNT | RESO COUNT 


ECOUNT, bits [63:56] 
When PMSIDR_EL1.ERnd == 0b1: 
Secondary sample interval counter. 


When PMSIDR_EL1.ERnd is 1, this field provides the secondary counter used after the primary 
counter reaches zero. Whilst the secondary counter is nonzero and profiling is enabled, the 
secondary counter decrements by 1 for each member of the sample population. The primary counter 
also continues to decrement since it is also nonzero. When the secondary counter reaches zero, a 
member of the sampling population is selected for sampling. 


When PMSIDR_EL1.ERnd is 0, this field is RES1. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [55:32] 


Reserved, RESO. 


COUNT, bits [31:0] 
Primary sample interval counter 
Provides the primary counter used for sampling. 


The primary counter is reloaded when the value of this register is zero and the PE moves from a state 
or Exception level where profiling is disabled to a state or Exception level where profiling is enabled 


Whilst the primary counter is nonzero and sampling is enabled, the primary counter decrements by 
1 for each member of the sample population 
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When the counter reaches zero, the behavior depends on the values of PMSIDR_EL1.ERnd and 
PMSIRR_EL1.RND 


. If PMSIRR_EL1.RND == 0 or PMSIDR_EL1.ERnd == 0: 
— A member of the sampling population is selected for sampling 
— The primary counter is reloaded 

° If PMSIRR_EL1.RND == 1 and PMSIDR_EL1.ERnd == 1: 


— The secondary counter is set to a random or pseudorandom value in the range 0x00 to 
OxFF 


— The primary counter is reloaded 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMSICR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMSICR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1001 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
return NVMem[0x838] ; 
else 
return PMSICR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSICR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMSICR_EL1; 


MSR PMSICR_EL1, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1001 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
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AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
NVMem[@x838] = X[t]; 
else 
PMSICR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSICR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMSICR_EL1 = X[t]; 
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D13.6.10 PMSIDR_EL1, Sampling Profiling ID Register 


The PMSIDR_ ELI characteristics are: 


Purpose 
Describes the Statistical Profiling implementation to software 
Configurations 
This register is present only when SPE is implemented. Otherwise, direct accesses to PMSIDR_EL1 
are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


PMSIDR_EL1 is a 64-bit register. 
Field descriptions 


The PMSIDR_ EL! bit assignments are: 


20 19 1615 12 11 876543210 


63 
| RESO MaxSize Interval 
| = 
Archinst 


LDS 
ERnd 
RESO 





Bits [63:20] 


Reserved, RESO. 


CountsSize, bits [19:16] 
Defines the size of the counters 
0b0010 12-bit saturating counters 
All other values are reserved. Reserved values might be defined in a future version of the 
architecture. 
MaxSize, bits [15:12] 


Defines the largest size for a single record, rounded up to a power-of-two. If this is the same as the 
minimum alignment (PMBIDR_EL1.Align), then each record is exactly this size 


0b0100 16 bytes 
0b0101 32 bytes 
0b0110 64 bytes 
0b0111 128 bytes 
0b1000 256 bytes 
0b1001 512 bytes 
0b1010 1024 bytes 


0b1011 2KB 
All other values are reserved. Reserved values might be defined in a future version of the 
architecture. 
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Interval, bits [11:8] 


Bits [7:6] 


ERnd, bit [5] 


LDS, bit [4] 


Recommended minimum sampling interval. This provides guidance from the implementer to the 
smallest minimum sampling interval, N. 


0b0000 256 
0b0010 512 
0b0011 768 


0b0100 1,024 
0b0101 1,536 
0b0110 2,048 
0b0111 3,072 
0b1000 4,096 


All other values are reserved. Reserved values might be defined in a future version of the 
architecture. 


Reserved, RESO. 


Defines how the random number generator is used in determining the interval between samples, 
when enabled by PMSIRR_EL1.RND. 


Qbd The random number is added at the start of the interval, and the sample is taken and a 
new interval started when the combined interval expires. 


Qb1 The random number is added and the new interval started after the interval programmed 
in PMSIRR_EL1.INTERVAL expires, and the sample is taken when the random 
interval expires. 


Data source indicator for sampled load instructions 
Qbe Loaded data source not implemented 


Qb1 Loaded data source implemented 


ArchInst, bit [3] 


FL, bit [2] 


FT, bit [1] 


FE, bit [0] 


Architectural instruction profiling 
Qbd Micro-op sampling implemented 


Qb1 Architecture instruction sampling implemented 


Filtering by latency. This bit is RAO. 


Filtering by operation type. This bit is RAO. 


Filtering by events. This bit is RAO. 


Accessing the PMSIDR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, PMSIDR_EL1 





op0 op1 CRn CRm op2 


0b11 0b000 0b1001 0b1001 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '01' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSIDR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMSIDR_EL1; 
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D13.6.11 PMSIRR_EL1, Sampling Interval Reload Register 


The PMSIRR_ ELI characteristics are: 


Purpose 
Defines the interval between samples 

Configurations 
This register is present only when SPE is implemented. Otherwise, direct accesses to PMSIRR_EL1 
are UNDEFINED. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 


PMSIRR_EL1 is a 64-bit register. 


Field descriptions 


The PMSIRR_EL1 bit assignments are: 


63 32 31 


8 7 1 0 
RESO INTERVAL RESO 
— RND 


Reserved, RESO. 


Bits [63:32] 


INTERVAL, bits [31:8] 


Bits [31:8] of the PMSICR_ EL! interval counter reload value. Software must set this to a non-zero 
value. If software sets this to zero, an UNKNOWN sampling interval is used. Software should set this 
to a value greater than the minimum indicated by PMSIDR_EL1.Interval 


This field resets to an architecturally UNKNOWN value. 


Bits [7:1] 
Reserved, RESO. 
RND, bit [0] 
Controls randomization of the sampling interval 
Qbd Disable randomization of sampling interval 
Qb1 Add (pseudo-)random jitter to sampling interval 


The random number generator is not architected. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMSIRR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, PMSIRR_EL1 





op0 op1 CRn 


0b11 0b000 0b1001 


CRm op2 


0b1001 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 


return NVMem[0x840] ; 
else 
return PMSIRR_EL1; 
elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSIRR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMSIRR_EL1; 


MSR PMSIRR_EL1, <Xt> 





op0 op1 CRn 


CRm op2 





0b11 0b000 0b1001 


0b1001 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 


NVMem[@x840] = X[t]; 
else 
PMSIRR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '01' then 


AArch64.SystemAccessTrap(EL3, 0x18); 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 


AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSIRR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMSIRR_EL1 = X[t]; 
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D13.6.12 © PMSLATFR_EL1, Sampling Latency Filter Register 
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The PMSLATFR_ ELI characteristics are: 


Purpose 
Controls sample filtering by latency 

Configurations 
This register is present only when SPE is implemented. Otherwise, direct accesses to 
PMSLATFR_EL1 are UNDEFINED. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 


PMSLATFR_EL1 is a 64-bit register. 


Field descriptions 


The PMSLATFR_ EL] bit assignments are: 


Bits [63:12] 


12 11 0 


RESO MINLAT 


Reserved, RESO. 


MINLAT, bits [11:0] 


Minimum latency. When PMSFCR_EL1.FL == 1, defines the minimum total latency for filtered 
operations. Samples with a total latency less than MINLAT will not be recorded 


This field is ignored by the PE when PMSFCR_EL1.FL == 0. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMSLATFR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, PMSLATFR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1001 0b110 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
return NVMem[0x848] ; 


else 


return PMSLATFR_EL1; 
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elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != '@1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return PMSLATFR_EL1; 
elsif PSTATE.EL == EL3 then 
return PMSLATFR_EL1; 


MSR PMSLATFR_EL1, <Xt> 


op0 op1 CRn CRm op2 





0b11 0b000 0b1001 0b1001 0b110 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMS == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '1x1' then 
NVMem[@x848] = X[t]; 
else 
PMSLATFR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' && MDCR_EL3.NSPB != 'Q1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.NS == '1' && MDCR_EL3.NSPB != '11' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
PMSLATFR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
PMSLATFR_EL1 = X[t]; 
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D13.7 RAS registers 


This section lists the RAS Extension registers in AArch64. 
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D13.7.1 


D13-3648 


DISR_EL1, Deferred Interrupt Status Register 


The DISR_ELI characteristics are: 


Purpose 


Records that an SError interrupt has been consumed by an ESB instruction. 


Configurations 


Attributes 


AArch64 System register DISR_EL1[31:0] is architecturally mapped to AArch32 System register 
DISR[3 1:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to DISR_EL1 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


DISR_EL1 is a 64-bit register. 


Field descriptions 


The DISR_EL1 bit assignments are: 


When DISR_EL1.IDS == 0: 


RESO 


Bits [63:32] 


A, bit [31] 


Bits [30:25] 


IDS, bit [24] 


Bits [23:13] 


32 31 30 25 24 23 1312., 109 8 6 5 0 


RESO RESO AET RESO DFSC 
Po EA 
IDS 


Reserved, RESO. 


Set to 1 when an ESB instruction defers an asynchronous SError interrupt. If the implementation does 
not include any sources of SError interrupt that can be synchronized by an Error Synchronization 
Barrier, then this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 
Reserved, RESO. 


Indicates the deferred SError interrupt type. 
ObO Deferred error uses architecturally-defined format. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


AET, bits [12:10] 


Asynchronous Error Type. See the description of ESR_ELx.AET for an SError interrupt. 


This field resets to an architecturally UNKNOWN value. 
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EA, bit [9] 
External abort Type. See the description of ESR_ELx.EA for an SError interrupt. 
This field resets to an architecturally UNKNOWN value. 
Bits [8:6] 
Reserved, RESO. 
DFSC, bits [5:0] 
Fault Status Code. See the description of ESR_ELx.DFSC for an SError interrupt. 


This field resets to an architecturally UNKNOWN value. 


When DISR_EL1.IDS == 1: 


32 31 30 25 24 23 0 


RESO RESO ISS 


Bits [63:32] 
Reserved, RESO. 
A, bit [31] 


Set to 1 when an ESB instruction defers an asynchronous SError interrupt. If the implementation does 
not include any sources of SError interrupt that can be synchronized by an Error Synchronization 
Barrier, then this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Bits [30:25] 


Reserved, RESO. 


IDS, bit [24] 
Indicates the deferred SError interrupt type. 
Qb1 Deferred error uses IMPLEMENTATION DEFINED format. 


This field resets to an architecturally UNKNOWN value. 


ISS, bits [23:0] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. See the description of ESR_ELx[23:0] for an SError 
interrupt. 


This field resets to an architecturally UNKNOWN value. 


The following subsections describe each ISS format. 


Accessing the DISR_EL1 


An indirect write to DISR_EL1 made by an ESB instruction does not require an explicit synchronization operation 
for the value that is written to be observed by a direct read of DISR_EL1 occurring in program order after the ESB 
instruction. 


DISR_EL1 is RAZ/WI if EL3 is implemented, the PE is in Non-debug state, SCR_EL3.EA == 1, and any of the 
following apply: 


© At EL2. 
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* AtELI and ((SCR_EL3.NS == 0 && SCR_EL3.EEL2 == 0) || HCR_EL2.AMO == 0). 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, DISR_EL1 














op0 op1 CRn CRm op2 
0b11 0b000 0b1100 0b0001 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AMO == '1' then 
return VDISR_EL2; 
else 
return DISR_EL1; 
elsif PSTATE.EL == EL2 then 
return DISR_EL1; 
elsif PSTATE.EL == EL3 then 
return DISR_EL1; 
MSR DISR_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b1100 0b0001 0b001 


if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AMO == '1' then 
VDISR_EL2 = X[t]; 
else 
DISR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
DISR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
DISR_EL1 = X[t]; 
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D13.7.2 ERRIDR_EL1, Error Record ID Register 
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The ERRIDR_EL1 characteristics are: 


Purpose 


Defines the highest numbered index of the error records that can be accessed through the Error 
Record System registers. 


Configurations 


AArch6é4 System register ERRIDR_EL1[31:0] is architecturally mapped to AArch32 System 
register ERRIDR[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERRIDR_ELI are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERRIDR_EL1 is a 64-bit register. 


Field descriptions 


The ERRIDR_EL1 bit assignments are: 


16 15 0 


RESO NUM 


Bits [63:16] 
Reserved, RESO. 
NUM, bits [15:0] 


Highest numbered index of the records that can be accessed through the Error Record System 
registers plus one. Zero indicates that no records can be accessed through the Error Record System 
registers. 


Each implemented record is owned by a node. A node might own multiple records. 


Accessing the ERRIDR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ERRIDR_EL1 





op0 op1 CRn CRm op2 





0b11 0b000 0b0101 0b0011 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERRIDR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
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AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERRIDR_EL1; 
elsif PSTATE.EL == EL3 then 
return ERRIDR_EL1; 
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D13.7.3 ERRSELR_EL1, Error Record Select Register 
The ERRSELR_ELI characteristics are: 


Purpose 


Selects an error record to be accessed through the Error Record System registers. 


Configurations 


AArch64 System register ERRSELR_EL1[31:0] is architecturally mapped to AArch32 System 
register ERRSELR[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERRSELR_EL]1 are UNDEFINED. 


If ERRIDR_ELI indicates that zero records are implemented, then it is IMPLEMENTATION DEFINED 
whether ERRSELR_EL1 is UNDEFINED or RESO. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERRSELR_EL1 is a 64-bit register. 


Field descriptions 


The ERRSELR_EL! bit assignments are: 


63 1615 0 


RESO SEL 


Bits [63:16] 


Reserved, RESO. 


SEL, bits [15:0] 
Selects the record accessed through the ERX registers. 


For example, if ERRSELR_EL1.SEL is set to 0x4, then direct reads and writes of 
ERXSTATUS ELI access ERR4STATUS. 


If ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, then all of 
the following apply: 


$ The value read back from ERRSELR_EL1.SEL is UNKNOWN. 
° One of the following occurs: 

— An UNKNOWN error record is selected. 

— The ERX* registers are RAZ/WI. 

—  ERX* register reads and writes are NOPs. 

—  ERX* register reads and writes are UNDEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the ERRSELR_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, ERRSELR_EL1 














op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0011 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERRSELR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERRSELR_EL1; 
elsif PSTATE.EL == EL3 then 
return ERRSELR_EL1; 
MSR ERRSELR_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0011 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERRSELR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERRSELR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERRSELR_EL1 = X[t]; 
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D13.7.4 ERXADDR_EL41, Selected Error Record Address Register 
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The ERXADDR_ ELI characteristics are: 


Purpose 
Accesses ERR<n>ADDR for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


AArch64 System register ERXADDR_EL1[31:0] is architecturally mapped to AArch32 System 
register ERXADDR{[3 1:0]. 


AArch6é4 System register ERXADDR_EL1[63:32] is architecturally mapped to AArch32 System 
register ERXADDR2[3 1:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERXADDR_EL]I are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXADDR ELI is a 64-bit register. 


Field descriptions 


The ERXADDR _ EL! bit assignments are: 


ERR<n>ADDR 


Bits [63:0] 
ERXADDR EL! accesses ERR<n>ADDR, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXADDR_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


° An UNKNOWN record is selected. 

° ERXADDR EL! is RAZ/WI. 

° Direct reads and writes of ERXADDR_EL1 are NOPs. 

° Direct reads and writes of ERXADDR_EL1 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ERXADDR_EL1 








op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0100 0b011 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXADDR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXADDR_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXADDR_EL1; 


MSR ERXADDR_EL1, <Xt> 


op0 op1 CRn CRm 


op2 





0b11 0b000 0b0101 0b0100 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXADDR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXADDR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERXADDR_EL1 = X[t]; 
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D13.7.5 ERXCTLR_EL1, Selected Error Record Control Register 
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The ERXCTLR_ELI characteristics are: 


Purpose 
Accesses ERR<n>CTLR for the error record selected by ERRSELR_EL1.SEL. 
For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 

Configurations 
AArch64 System register ERXCTLR_EL1[31:0] is architecturally mapped to AArch32 System 
register ERXCTLR[31:0]. 
AArch6é4 System register ERXCTLR_EL1[63:32] is architecturally mapped to AArch32 System 
register ERXCTLR2[31:0]. 
This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERXCTLR_EL1 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ERXCTLR_EL1 is a 64-bit register. 


Field descriptions 


The ERXCTLR_ELI bit assignments are: 


ERR<n>CTLR 


Bits [63:0] 
ERXCTLR_EL1 accesses ERR<n>CTLR, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXCTLR_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


° An UNKNOWN record is selected. 

° ERXCTLR_ELI is RAZ/WI. 

° Direct reads and writes of ERXCTLR_EL1 are NOPs. 

° Direct reads and writes of ERXCTLR_EL1 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ERXCTLR_EL1 








op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0100 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXCTLR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXCTLR_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXCTLR_EL1; 


MSR ERXCTLR_EL1, <Xt> 


op0 op1 CRn CRm 


op2 





0b11 0b000 0b0101 0b0100 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXCTLR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXCTLR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERXCTLR_EL1 = X[t]; 
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D13.7.6 ERXFR_EL1, Selected Error Record Feature Register 
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The ERXFR_ELI characteristics are: 


Purpose 
Accesses ERR<n>FR for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv8, for the Armv8-A architecture profile. 


Configurations 


AArch6é4 System register ERXFR_EL1[31:0] is architecturally mapped to AArch32 System 
register ERXFR[3 1:0]. 


AArch64 System register ERXFR_EL1[63:32] is architecturally mapped to AArch32 System 
register ERXFR2[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXFR_EL1 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXFR_EL1 is a 64-bit register. 


Field descriptions 


The ERXFR_ELI bit assignments are: 


ERR<n>FR 


Bits [63:0] 
ERXFR_ELI accesses ERR<n>FR, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXFR_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


° An UNKNOWN record is selected. 

° ERXFR_ELl1 is RAZ. 

$ Direct reads of ERXFR_EL1 are NOPs. 

° Direct reads of ERXFR_EL1 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ERXFR_EL1 








op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0100 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXFR_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXFR_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXFR_EL1; 
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D13.7.7 ERXMISCO_EL1, Selected Error Record Miscellaneous Register 0 


The ERXMISCO_EL1 characteristics are: 
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Purpose 


Accesses ERR<n>MISCO for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


Attributes 


AArch64 System register ERXMISCO_EL1[31:0] is architecturally mapped to AArch32 System 
register ERXMISCO[31:0]. 


AArch64 System register ERXMISCO_EL1[63:32] is architecturally mapped to AArch32 System 
register ERXMISC1[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERXMISCO_EL1 are UNDEFINED. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 





Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 





RW fields in this register reset to architecturally UNKNOWN values. 


ERXMISCO0 _ EL] is a 64-bit register. 


Field descriptions 


The ERXMISCO_EL1 bit assignments are: 


Bits [63:0] 


ERR<n>MISCO 


ERXMISCO_EL1 accesses ERR<n>MISCO, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXMISCO_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


. An UNKNOWN record is selected. 


a ERXMISCO0_EL1 is RAZ/WI. 


° Direct reads and writes of ERXMISC0_EL1 are NOPs. 
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° Direct reads and writes of ERXMISC0_EL1 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ERXMISCO_EL1 











op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0101 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXMISCQ_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXMISCQ_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXMISCQ_EL1; 
MSR ERXMISCO0O_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0101 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXMISC@_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXMISCQ@_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERXMISCQ@_EL1 = X[t]; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.7 RAS registers 


D13.7.8 ERXMISC1_EL1, Selected Error Record Miscellaneous Register 1 


The ERXMISC1_EL1 characteristics are: 
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Purpose 


Accesses ERR<n>MISC1 for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


Attributes 


AArch64 System register ERXMISC1_EL1[31:0] is architecturally mapped to AArch32 System 
register ERXMISC2[31:0]. 


AArch64 System register ERXMISC1_EL1[63:32] is architecturally mapped to AArch32 System 
register ERXMISC3[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERXMISC1_ELI1 are UNDEFINED. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 





Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 





RW fields in this register reset to architecturally UNKNOWN values. 


ERXMISC1 EL] is a 64-bit register. 


Field descriptions 


The ERXMISC1_ EL! bit assignments are: 


Bits [63:0] 


ERR<n>MISC1 


ERXMISC1_EL1 accesses ERR<n>MISC1, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXMISC1_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


. An UNKNOWN record is selected. 


a ERXMISC1_EL1 is RAZ/WI. 


° Direct reads and writes of ERXMISC1_EL1 are NOPs. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3663 


Non-Confidential 


AArch64 System Register Descriptions 


D13.7 RAS registers 


D13-3664 


° Direct reads and writes of ERXMISC1_EL1 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ERXMISC1_EL1 











op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0101 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXMISC1_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXMISC1_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXMISC1_EL1; 
MSR ERXMISC1_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0101 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXMISC1_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXMISC1_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERXMISC1_EL1 = X[t]; 
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D13.7.9 ERXMISC2_EL1, Selected Error Record Miscellaneous Register 2 


The ERXMISC2_EL1 characteristics are: 
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Purpose 


Accesses ERR<n>MISC2 for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


Attributes 


AArch64 System register ERXMISC2_EL1[31:0] is architecturally mapped to AArch32 System 
register ERXMISC4[31:0]. 


AArch64 System register ERXMISC2_EL1[63:32] is architecturally mapped to AArch32 System 
register ERXMISCS5[31:0]. 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERXMISC2_EL1 are UNDEFINED. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 





Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 





RW fields in this register reset to architecturally UNKNOWN values. 


ERXMISC2_ EL] is a 64-bit register. 


Field descriptions 


The ERXMISC2_EL1 bit assignments are: 


Bits [63:0] 


ERR<n>MISC2 


ERXMISC2_EL1 accesses ERR<n>MISC2, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXMISC2_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


. An UNKNOWN record is selected. 


a ERXMISC2_EL1 is RAZ/WI. 


° Direct reads and writes of ERXMISC2_EL1 are NOPs. 
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° Direct reads and writes of ERXMISC2_EL1 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ERXMISC2_EL1 











op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0101 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXMISC2_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXMISC2_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXMISC2_EL1; 
MSR ERXMISC2_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0101 0b010 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXMISC2_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXMISC2_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERXMISC2_EL1 = X[t]; 
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D13.7.10 ERXMISC3_EL1, Selected Error Record Miscellaneous Register 3 


The ERXMISC3_EL1 characteristics are: 
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Purpose 


Accesses ERR<n>MISC3 for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv6, for the Armv8-A architecture profile. 


Configurations 


Attributes 


AArch64 System register ERXMISC3_EL1[31:0] is architecturally mapped to AArch32 System 
register ERXMISC6[31:0]. 


AArch64 System register ERXMISC3_EL1[63:32] is architecturally mapped to AArch32 System 
register ERXMISC7[31:0]. 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERXMISC3_EL1 are UNDEFINED. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 





Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 





RW fields in this register reset to architecturally UNKNOWN values. 


ERXMISC3_EL1 is a 64-bit register. 


Field descriptions 


The ERXMISC3_EL1 bit assignments are: 


Bits [63:0] 


ERR<n>MISC3 


ERXMISC3_EL1 accesses ERR<n>MISC3, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXMISC3_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


. An UNKNOWN record is selected. 


a ERXMISC3_EL1 is RAZ/WI. 


° Direct reads and writes of ERXMISC3_EL1 are NOPs. 
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° Direct reads and writes of ERXMISC3_EL1 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ERXMISC3_EL1 











op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0101 0b011 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXMISC3_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXMISC3_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXMISC3_EL1; 
MSR ERXMISC3_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0101 0b011 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXMISC3_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXMISC3_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERXMISC3_EL1 = X[t]; 
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D13.7.11 ERXPFGCDN_EL1, Selected Pseudo-fault Generation Countdown Register 
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The ERXPFGCDN_EL1 characteristics are: 


Purpose 
Accesses the ERR<n>PFGCDN register for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERXPFGCDN_ ELI are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXPFGCDN_EL1 is a 64-bit register. 


Field descriptions 


The ERXPFGCDN_EL] bit assignments are: 


ERR<n>PFGCDN 


Bits [63:0] 
ERXPFGCDN_EL1 accesses ERR<n>PFGCDN, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXPFGCDN_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


e An UNKNOWN record is selected. 

° ERXPFGCDN_ EL! is RAZ/WI. 

° Direct reads and writes of ERXPFGCDN_EL1 are NOPs. 

s Direct reads and writes of ERXPFGCDN_EL1 are UNDEFINED. 


If ERRSELR_EL1.SEL selects an error record that does not implement the RAS Common Fault Injection Model 
Extension, then one of the following occurs: 


. ERXPFGCDN_EL! is RAZ/WI. 
° Direct reads and writes of ERXPFGCDN_ELI are NOPs. 


$ Direct reads and writes of ERXPFGCDN_EL1 are UNDEFINED. 


Note 


An error record does not implement the RAS Common Fault Injection Model Extension when ERR<n>FR.INJ == 
0b00. 








Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, ERXPFGCDN_EL1 














op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0100 0b110 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXPFGCDN_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXPFGCDN_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXPFGCDN_EL1; 
MSR ERXPFGCDN_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0100 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXPFGCDN_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXPFGCDN_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERXPFGCDN_EL1 = X[t]; 
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D13.7.12 ERXPFGCTL_EL1, Selected Pseudo-fault Generation Control Register 
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The ERXPFGCTL_EL1 characteristics are: 


Purpose 
Accesses the ERR<n>PFGCTL register for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERXPFGCTL_EL1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXPFGCTL_EL1 is a 64-bit register. 


Field descriptions 


The ERXPFGCTL_EL! bit assignments are: 


ERR<n>PFGCTL 


Bits [63:0] 
ERXPFGCTL_EL]1 accesses ERR<n>PFGCTL, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXPFGCTL_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


e An UNKNOWN record is selected. 

° ERXPFGCTL_EL1 is RAZ/WI. 

° Direct reads and writes of ERXPFGCTL_EL1 are NOPs. 

s Direct reads and writes of ERXPFGCTL_EL1 are UNDEFINED. 


If ERRSELR_EL1.SEL selects an error record that does not implement the RAS Common Fault Injection Model 
Extension, then one of the following occurs: 


. ERXPFGCTL EL! is RAZ/WI. 
° Direct reads and writes of ERXPFGCTL_EL1 are NOPs. 


$ Direct reads and writes of ERXPFGCTL_EL1 are UNDEFINED. 


Note 


An error record does not implement the RAS Common Fault Injection Model Extension when ERR<n>FR.INJ == 
0b00. 








Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, ERXPFGCTL_EL1 














op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0100 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXPFGCTL_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXPFGCTL_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXPFGCTL_EL1; 
MSR ERXPFGCTL_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0100 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXPFGCTL_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXPFGCTL_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERXPFGCTL_EL1 = X[t]; 
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D13.7.13 ERXPFGF_EL1, Selected Pseudo-fault Generation Feature Register 
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The ERXPFGF_ ELI characteristics are: 


Purpose 
Accesses the ERR<n>PFGF register for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERXPFGF_EL]1 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXPFGF_ EL] is a 64-bit register. 


Field descriptions 


The ERXPFGF_EL1 bit assignments are: 


ERR<n>PFGF 


Bits [63:0] 
ERXPFGF_EL]1 accesses ERR<n>PFGF, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXPFGF_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


e An UNKNOWN record is selected. 

° ERXPFGF_EL1 is RAZ. 

è Direct reads of ERXPFGF_EL1 are NOPs. 

s Direct reads of ERXPFGF_EL1 are UNDEFINED. 


If ERRSELR_EL1.SEL selects an error record that does not implement the RAS Common Fault Injection Model 
Extension, then one of the following occurs: 


° ERXPFGF EL! is RAZ. 
$ Direct reads of ERXPFGF_EL1 are NOPs. 


$ Direct reads of ERXPFGF_EL1 are UNDEFINED. 


Note 


An error record does not implement the RAS Common Fault Injection Model Extension when ERR<n>FR.INJ == 
0b00. 








Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, ERXPFGF_EL1 





op0 op1 CRn CRm 


0b11 0b000 0b0101 0b0100 


op2 


0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == 'Q' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXPFGF_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.FIEN == '@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXPFGF_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXPFGF_EL1; 
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D13.7.14 ERXSTATUS_EL1, Selected Error Record Primary Status Register 


The ERXSTATUS_EL1 characteristics are: 
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Purpose 


Accesses ERR<n>STATUS for the error record selected by ERRSELR_EL1.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


Attributes 


AArch6é4 System register ERXSTATUS_EL1[31:0] is architecturally mapped to AArch32 System 
register ERXSTATUS[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERXSTATUS_EL1 are UNDEFINED. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 


Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 








RW fields in this register reset to architecturally UNKNOWN values. 


ERXSTATUS ELI is a 64-bit register. 


Field descriptions 


The ERXSTATUS_EL] bit assignments are: 


Bits [63:0] 


ERR<n>STATUS 


ERXSTATUS_EL1 accesses ERR<n>STATUS, where n is the value in ERRSELR_EL1.SEL. 


Accessing the ERXSTATUS_EL1 


IfERRIDR_EL1.NUM ==0 or ERRSELR_EL1.SEL is set to a value greater than or equal to ERRIDR_EL1.NUM, 
then one of the following occurs: 


. An UNKNOWN record is selected. 


s ERXSTATUS_EL1 is RAZ/WI. 


° Direct reads and writes of ERXSTATUS_EL1 are NOPs. 


è Direct reads and writes of ERXSTATUS_EL1 are UNDEFINED. 
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Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, ERXSTATUS_EL1 











op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0100 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXSTATUS_EL1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return ERXSTATUS_EL1; 
elsif PSTATE.EL == EL3 then 
return ERXSTATUS_EL1; 
MSR ERXSTATUS_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b000 0b0101 0b0100 0b010 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXSTATUS_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
ERXSTATUS_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
ERXSTATUS_EL1 = X[t]; 
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The VDISR_EL2 characteristics are: 


Purpose 
Records that a virtual SError interrupt has been consumed by an ESB instruction executed at EL1. 
An indirect write to VDISR_EL2 made by an ESB instruction does not require an explicit 
synchronization operation for the value written to be observed by a direct read of DISR_EL1 or 
DISR occurring in program order after the ESB instruction. 

Configurations 


AArch64 System register VDISR_EL2[31:0] is architecturally mapped to AArch32 System register 
VDISR{3 1:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to VDISR_EL2 
are UNDEFINED. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
VDISR_EL2 is a 64-bit register. 


Field descriptions 


The VDISR_EL2 bit assignments are: 


When !/ELUsingAArch32(EL1): 


63 32 31 30 25 24 23 0 


zt | 2 





RESO 
22 


A 

















2 
| IDS 








Bits [63:32] 
Reserved, RESO. 
A, bit [31] 
Set to 1 when an ESB instruction defers a virtual SError interrupt. 
This field resets to an architecturally UNKNOWN value. 
Bits [30:25] 
Reserved, RESO. 
IDS, bit [24] 
The value copied from VSESR_EL2.IDS. 
This field resets to an architecturally UNKNOWN value. 
ISS, bits [23:0] 
The value copied from VSESR_EL2.ISS. 
This field resets to an architecturally UNKNOWN value. 
The following subsections describe each ISS format. 
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When ELUsingAArch32(EL1) and VDISR_EL2.LPAE == 0: 


32 31 30 


63 
| RESO A RESO 





Bits [63:32] 


Reserved, RESO. 


A, bit [31] 
Set to 1 when an ESB instruction defers a virtual SError interrupt. 


This field resets to an architecturally UNKNOWN value. 


Bits [30:16] 


Reserved, RESO. 


AET, bits [15:14] 
The value copied from VSESR_EL2.AET. 


This field resets to an architecturally UNKNOWN value. 


Bit [13] 


Reserved, RESO. 


EXT, bit [12] 
The value copied from VSESR_EL2.ExT. 


This field resets to an architecturally UNKNOWN value. 


Bit [11] 


Reserved, RESO. 


FS[4], bit [10] 
This field is bit[4] of FS[4:0]. 
Fault status code. Set to @b10110 when an ESB instruction defers a virtual SError interrupt. 
0b10110 Asynchronous SError interrupt. 
All other values are reserved. 
The FS field is split as follows: 
° FS[4] is VDISR_EL2[10]. 
° FS[3:0] is VDISR_EL2[3:0]. 
This field resets to an architecturally UNKNOWN value. 
LPAE, bit [9] 
Format. 
Set to TTBCR.EAE when an ESB instruction defers a virtual SError interrupt. 
Qbd Using the Short-descriptor translation table format. 


This field resets to an architecturally UNKNOWN value. 
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Bits [8:4] 


Reserved, RESO. 


FS[3:0], bits [3:0] 
This field is bits[3:0] of FS[4:0]. 
See FS[4] for the field description. 


When ELUsingAArch32(EL1) and VDISR_EL2.LPAE == 1: 


63 32 31 30 16151413121110 9 8 


6 5 0 
RESO A RESO RESO STATUS 
pa LPAE 
RESO 







ExT 
RESO 
Bits [63:32] 
Reserved, RESO. 
A, bit [31] 
Set to 1 when an ESB instruction defers a virtual SError interrupt. 
This field resets to an architecturally UNKNOWN value. 
Bits [30:16] 
Reserved, RESO. 
AET, bits [15:14] 
The value copied from VSESR_EL2.AET. 
This field resets to an architecturally UNKNOWN value. 
Bit [13] 
Reserved, RESO. 
ExT, bit [12] 
The value copied from VSESR_EL2.ExT. 
This field resets to an architecturally UNKNOWN value. 
Bits [11:10] 
Reserved, RESO. 
LPAE, bit [9] 
Format. 
Set to TTBCR.EAE when an ESB instruction defers a virtual SError interrupt. 
Qb1 Using the Long-descriptor translation table format. 
This field resets to an architecturally UNKNOWN value. 
Bits [8:6] 
Reserved, RESO. 
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STATUS, bits [5:0] 
Fault status code. Set to @b010001 when an ESB instruction defers a virtual SError interrupt. 
0b010001 Asynchronous SError interrupt. 
All other values are reserved. 


This field resets to an architecturally UNKNOWN value. 


Accessing the VDISR_EL2 


An indirect write to VDISR_EL2 made by an ESB instruction does not require an explicit synchronization operation 
for the value that is written to be observed by a direct read of DISR_EL1 or DISR occurring in program order after 
the ESB instruction. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, VDISR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b1100 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x500]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VDISR_EL2; 
elsif PSTATE.EL == EL3 then 
return VDISR_EL2; 


MSR VDISR_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b1100 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x500] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VDISR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
VDISR_EL2 = X[t]; 
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op0 op1 CRn 


0b11 0b000 0b1100 


CRm 


0b0001 


op2 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AMO == '1' then 
return VDISR_EL2; 
else 
return DISR_EL1; 
elsif PSTATE.EL == EL2 then 
return DISR_EL1; 
elsif PSTATE.EL == EL3 then 
return DISR_EL1; 


MSR DISR_EL1, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b000 0b1100 


0b0001 


0b001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AMO == '1' then 
VDISR_EL2 = X[t]; 
else 
DISR_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
DISR_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
DISR_EL1 = X[t]; 
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VSESR_EL42, Virtual SError Exception Syndrome Register 


The VSESR_EL2 characteristics are: 


Purpose 


Provides the syndrome value reported to software on taking a virtual SError interrupt exception to 
EL1, or on executing an ESB instruction at EL1. 


When the virtual SError interrupt is taken to EL1 using AArch64, then the syndrome value is 
reported in ESR_EL1. 


When the virtual SError interrupt is taken to EL1 using AArch32, then the syndrome value is 
reported in DFSR. {AET, ExT} and the remainder of DFSR is set as defined by VMSAv8-32. For 
more information, see Chapter G5 The AArch32 Virtual Memory System Architecture. 


When the virtual SError interrupt is deferred by an ESB instruction, then the syndrome value is 
written to VDISR_EL2. 


Configurations 


Attributes 


AArch64 System register VSESR_EL2[31:0] is architecturally mapped to AArch32 System register 
VDFSR[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to VSESR_EL2 
are UNDEFINED. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


RW fields in this register reset to architecturally UNKNOWN values. 


VSESR_EL2 is a 64-bit register. 


Field descriptions 


The VSESR_EL2 bit assignments are: 


When ELUsingAArch32(EL1): 


63 


Bits [63:16] 


16 15 14 13 12 11 0 


RESO eer] | | RESO 


Reserved, RESO. 


AET, bits [15:14] 


Bit [13] 


When a virtual SError interrupt is taken to EL1 using AArch32, DFSR[15:4] is set to 
VSESR_EL2.AET. 


When a virtual SError interrupt is deferred by an ESB instruction, VDISR_EL2[15:4] is set to 
VSESR_EL2.AET. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.7 RAS registers 


EXT, bit [12] 


When a virtual SError interrupt is taken to EL1 using AArch32, DFSR[12] is set to 
VSESR_EL2.ExT. 


When a virtual SError interrupt is deferred by an ESB instruction, VDISR_EL2[12] is set to 
VSESR_EL2.ExT. 


This field resets to an architecturally UNKNOWN value. 


Bits [11:0] 


Reserved, RESO. 


When !ELUsingAArch32(EL1): 


63 25 24 23 0 


RESO ISS 
22 22 


| IDS 








Bits [63:25] 
Reserved, RESO. 
IDS, bit [24] 


When a virtual SError interrupt is taken to EL1 using AArch64, ESR_EL1[24] is set to 
VSESR_EL2.IDS. 


When a virtual SError interrupt is deferred by an ESB instruction, VDISR_EL2[24] is set to 
VSESR_EL2.IDS. 


This field resets to an architecturally UNKNOWN value. 
ISS, bits [23:0] 


When a virtual SError interrupt is taken to EL1 using AArch64, ESR_EL1[23:0] is set to 
VSESR_EL2.ISS. 


When a virtual SError interrupt is deferred by an ESB instruction, VDISR_EL2[23:0] is set to 
VSESR_EL2.ISS. 


This field resets to an architecturally UNKNOWN value. 


The following subsections describe each ISS format. 


Accessing the VSESR_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, VSESR_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b0101 0b0010 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x508]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
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return VSESR_EL2; 
elsif PSTATE.EL == EL3 then 
return VSESR_EL2; 


MSR VSESR_EL2, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b100 0b0101 


0b0010 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x508] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VSESR_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
VSESR_EL2 = X[t]; 
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D13.8 Generic Timer registers 


This section lists the Generic Timer registers in AArch64. 
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D13.8.1 CNTFRQ_ELO, Counter-timer Frequency register 
The CNTFRQ ELO characteristics are: 


Purpose 


This register is provided so that software can discover the frequency of the system counter. It must 
be programmed with this value as part of system initialization. The value of the register is not 
interpreted by hardware. 


Configurations 


AArch64 System register CNTFRQ_ ELO0[31:0] is architecturally mapped to AArch32 System 
register CNTFRQJ[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTFRQ ELO is a 64-bit register. 


Field descriptions 


The CNTFRQ ELO bit assignments are: 


63 32 31 0 


RESO Clock frequency 


Bits [63:32] 


Reserved, RESO. 


Bits [31:0] 
Clock frequency. Indicates the system counter clock frequency, in Hz. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTFRQ_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTFRQ_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0000 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && 
CNTKCTL_EL1.<EL@PCTEN, ELQVCTEN> == '@@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && 
CNTHCTL_EL2.<EL@PCTEN, EL@VCTEN> == '00' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CNTFRQ_ELO; 
elsif PSTATE.EL == EL1 then 
return CNTFRQ_ELO; 
elsif PSTATE.EL == EL2 then 
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return CNTFRQ_ELQ; 
elsif PSTATE.EL == EL3 then 
return CNTFRQ_ELQ; 


MSR CNTFRQ_ELO, <Xt> 











op0 op1 CRn CRm op2 
Ob11 0b011 0b1110 0b0000 0b000 
if IsHighestEL(PSTATE.EL) then 
CNTFRQ_EL@ = X[t]; 
else 
UNDEFINED; 
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D13.8.2 CNTHCTL_EL2, Counter-timer Hypervisor Control register 
The CNTHCTL_EL2 characteristics are: 


Purpose 
Controls the generation of an event stream from the physical counter, and access from EL1 to the 
physical counter and the EL1 physical timer. 

Configurations 


AArch64 System register CNTHCTL_EL2[31:0] is architecturally mapped to AArch32 System 
register CNTHCTL[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
This register has no effect if EL2 is not enabled in the current Security state. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
CNTHCTL_EL2 is a 64-bit register. 


Field descriptions 


The CNTHCTL_EL2 bit assignments are: 


When ARMv8.1-VHE is implemented and HCR_EL2.E2H == 1: 


63 1211109 8 7 43210 


RESO EVNTI 


ELOPCTEN 
ELOVCTEN 
EVNTEN 
EVNTDIR 
ELOVTEN 
ELOPTEN 
EL1PCTEN 
EL1PTEN 


= 


Bits [63:12] 


Reserved, RESO. 


ELIPTEN, bit [11] 


When HCR_EL2.TGE is 0, traps ELO and EL1 accesses to the E1 physical timer registers to EL2 
when EL2 is enabled in the current Security state. 


Obd From AArch64 state: ELO and EL1 accesses to the CNTP_CTL_ELO, 
CNTP_CVAL _ELO, and CNTP_TVAL_EL0 are trapped to EL2 when EL2 is enabled 
in the current Security state, unless they are trapped by CNTKCTL_EL1.ELOPTEN. 


From AArch32 state: ELO and EL1 accesses to the CNTP_CTL, CNTP_CVAL, and 
CNTP_TVAL are trapped to EL2 when EL2 is enabled in the current Security state, 
unless they are trapped by CNTKCTL_EL1.ELOPTEN or CNTKCTL.PLOPTEN. 


0b1 This control does not cause any instructions to be trapped. 
When HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


D13-3688 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.8 Generic Timer registers 


ELIPCTEN, bit [10] 


When HCR_EL2.TGE is 0, traps ELO and EL 1 accesses to the EL1 physical counter register to EL2 
when EL2 is enabled in the current Security state, as follows: 


° In AArch64 state, accesses to CNTPCT_ELO are trapped to EL2, reported using EC 
syndrome value 0x18. 


s In AArch32 state, MRRC or MCRR accesses to CNTPCT are trapped to EL2, reported using 
EC syndrome value 0x04. 


0b0ð From AArch64 state: ELO and EL1 accesses to the CNTPCT_EL0 are trapped to EL2 
when EL2 is enabled in the current Security state, unless they are trapped by 
CNTKCTL_EL1.ELOPCTEN. 


From AArch32 state: ELO and EL1 accesses to the CNTPCT are trapped to EL2 when 
EL2 is enabled in the current Security state, unless they are trapped by 
CNTKCTL_EL1.ELOPCTEN or CNTKCTL.PLOPCTEN. 


Qb1 This control does not cause any instructions to be trapped. 
When HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped. 
This field resets to an architecturally UNKNOWN value. 


ELOPTEN, bit [9] 
When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped. 
When HCR_EL2.TGE is 1, traps ELO accesses to the physical timer registers to EL2. 


Qbd ELO using AArch64: ELO accesses to the CNTP_CTL_EL0, CNTP_CVAL_ELO, and 
CNTP_TVAL_ELO registers are trapped to EL2. 


ELO using AArch32: ELO accesses to the CNTP_CTL, CNTP_CVAL and 
CNTP_TVAL registers are trapped to EL2. 


Qb1 This control does not cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


ELOVTEN, bit [8] 
When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped. 
When HCR_EL2.TGE is 1, traps ELO accesses to the virtual timer registers to EL2. 


Qbd ELO using AArch64: ELO accesses to the CNTV_CTL_EL0, CNTV_CVAL _ELO, and 
CNTV_TVAL _ELO registers are trapped to EL2. 


ELO using AArch32: ELO accesses to the CNTV_CTL, CNTV_CVAL, and 
CNTV_TVAL registers are trapped to EL2. 


Qb1 This control does not cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


EVNTI, bits [7:4] 


Selects which bit (0 to 15) of the counter register CNTPCT_ELO is the trigger for the event stream 
generated from that counter, when that stream is enabled. 


This field resets to an architecturally UNKNOWN value. 


EVNTDIR, bit [3] 


Controls which transition of the counter register CNTPCT_ELO trigger bit, defined by EVNTI, 
generates an event when the event stream is enabled: 


Qbd A 0 to 1 transition of the trigger bit triggers an event. 
Qb1 A 1 to 0 transition of the trigger bit triggers an event. 
This field resets to an architecturally UNKNOWN value. 
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EVNTEN, bit [2] 
Enables the generation of an event stream from the counter register CNTPCT_EL0: 
0bd Disables the event stream. 
Qb1 Enables the event stream. 


This field resets to an architecturally UNKNOWN value. 
ELOVCTEN, bit [1] 


When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped. 


When HCR_EL2.TGE is 1, traps ELO accesses to the frequency register and virtual counter register 
to EL2. 


Qbd ELO using AArch64: ELO accesses to the CNTVCT_ELO are trapped to EL2. 


ELO using AArch64: ELO accesses to the CNTFRQ ELO register are trapped to EL2, if 
CNTHCTL_EL2.ELOPCTEN is also 0. 


ELO using AArch32: ELO accesses to the CNTVCT are trapped to EL2. 


ELO using AArch32: ELO accesses to the CNTFRQ register are trapped to EL2, if 
CNTHCTL.ELOPCTEN is also 0. 


Qb1 This control does not cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 
ELOPCTEN, bit [0] 


When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped. 


When HCR_EL2.TGE is 1, traps ELO accesses to the frequency register and physical counter 
register to EL2. 
Qbd ELO using AArch64: ELO accesses to the CNTPCT_ELO are trapped to EL2. 


ELO using AArch64: ELO accesses to the CNTFRQ ELO register are trapped to EL2, if 
CNTHCTL_EL2.ELOVCTEN is also 0. 


ELO using AArch32: ELO accesses to the CNTPCT are trapped to EL2. 


ELO using AArch32: ELO accesses to the CNTFRQ and register are trapped to EL2, if 
CNTHCTL_EL2.ELOVCTEN is also 0. 


Qb1 This control does not cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


Otherwise: 
63 8 7 43210 
RESO EVNTI 
Leen 
EL1PCEN 
EVNTEN 
EVNTDIR 


This format applies in all Armv8.0 implementations, and it also contains a description of the behavior when EL3 is 
implemented and EL2 is not implemented. 


Bits [63:8] 


Reserved, RESO. 
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EVNTI, bits [7:4] 


Selects which bit (0 to 15) of the counter register CNTPCT_ELO is the trigger for the event stream 
generated from that counter, when that stream is enabled. 


This field resets to an architecturally UNKNOWN value. 


EVNTDIR, bit [3] 
Controls which transition of the counter register CNTPCT_EL0 trigger bit, defined by EVNTI, 
generates an event when the event stream is enabled: 
Qbd A 0 to 1 transition of the trigger bit triggers an event. 
Qb1 A 1 to 0 transition of the trigger bit triggers an event. 


This field resets to an architecturally UNKNOWN value. 


EVNTEN, bit [2] 
Enables the generation of an event stream from the counter register CNTPCT_ELO: 
0b0 Disables the event stream. 
0b1 Enables the event stream. 


This field resets to 0. 


EL1PCEN, bit [1] 
Traps ELO and EL1 accesses to the EL1 physical timer registers to EL2 when EL2 is enabled in the 
current Security state, as follows: 


° In AArch64 state, accesses to CNTP_CTL_EL0, CNTP_CVAL_EL0, CNTP_TVAL_ELO 
are trapped to EL2, reported using EC syndrome value 0x18. 


. In AArch32 state, MRC or MCR accesses to the following registers are trapped to EL2 
reported using EC syndrome value 0x3 and MRRC and MCRR accesses are trapped to EL2, 
reported using EC syndrome value 0x04: 


— CNTP CTL, CNTP_CVAL, CNTP TVAL. 


Qbd From AArch64 state: ELO and EL1 accesses to the CNTP_CTL_ELO, 
CNTP_CVAL _ELO, and CNTP_TVAL _EL0 are trapped to EL2 when EL2 is enabled 
in the current Security state, unless they are trapped by CNTKCTL_EL1.ELOPTEN. 


From AArch32 state: ELO and EL1 accesses to the CNTP_CTL, CNTP_CVAL, and 
CNTP_TVAL are trapped to EL2 when EL2 is enabled in the current Security state, 
unless they are trapped by CNTKCTL_EL1.ELOPTEN or CNTKCTL.PLOPTEN. 


Qb1 This control does not cause any instructions to be trapped. 
If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 1 other than for the 


purpose of a direct read. 


This field resets to an architecturally UNKNOWN value. 


ELIPCTEN, bit [0] 


Traps ELO and EL] accesses to the EL1 physical counter register to EL2 when EL2 is enabled in 
the current Security state, as follows: 


° In AArch64 state, accesses to CNTPCT_ELO are trapped to EL2, reported using EC 
syndrome value 0x18. 


s In AArch32 state, MRRC or MCRR accesses to CNTPCT are trapped to EL2, reported using 
EC syndrome value 0x04. 


0b0ð From AArch64 state: ELO and EL1 accesses to the CNTPCT_EL0 are trapped to EL2 
when EL2 is enabled in the current Security state, unless they are trapped by 
CNTKCTL_EL1.ELOPCTEN. 


From AArch32 state: ELO and EL1 accesses to the CNTPCT are trapped to EL2 when 
EL2 is enabled in the current Security state, unless they are trapped by 
CNTKCTL_EL1.ELOPCTEN or CNTKCTL.PLOPCTEN. 


Qb1 This control does not cause any instructions to be trapped. 
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If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 1 other than for the 


purpose of a direct read. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHCTL_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic 
CNTHCTL_EL2 or CNTKCTL_ELI are not guaranteed to be ordered with respect to accesses using the other 


mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTHCTL_EL2 























op0 op1 CRn CRm op2 
0b11 0b100 0b1110 0b0001 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return CNTHCTL_EL2; 
elsif PSTATE.EL == EL3 then 
return CNTHCTL_EL2; 
MSR CNTHCTL_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b1110 0b0001 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CNTHCTL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTHCTL_EL2 = X[t]; 
MRS <Xt>, CNTKCTL_EL1 
op0 op1 CRn CRm op2 
0b11 0b000 0b1110 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
return CNTKCTL_EL1; 
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elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return CNTHCTL_EL2; 
else 
return CNTKCTL_EL1; 
elsif PSTATE.EL == EL3 then 
return CNTKCTL_EL1; 


MSR CNTKCTL_EL1, <Xt> 
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op0 op1 


CRm op2 





0b11 0b000 


0b1110 0b0001 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
CNTKCTL_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
CNTHCTL_EL2 = X[t]; 
else 
CNTKCTL_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTKCTL_EL1 = X[t]; 
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D13.8.3 


D13-3694 


CNTHP_CTL_EL2, Counter-timer Hypervisor Physical Timer Control register 


The CNTHP_CTL_EL2 characteristics are: 


Purpose 
Control register for the EL2 physical timer. 
Configurations 
AArch64 System register CNTHP_CTL_EL2[31:0] is architecturally mapped to AArch32 System 
register CNTHP_CTL[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTHP_CTL_EL2 is a 64-bit register. 


Field descriptions 


The CNTHP_CTL_EL2 bit assignments are: 


63 


Bits [63:3] 


3.2 1 0 


L ENABLE 
IMASK 


ISTATUS 


RESO 


Reserved, RESO. 


ISTATUS, bit [2] 


The status of the timer. This bit indicates whether the timer condition is met: 
b0 Timer condition is not met. 
b1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the Compare Value views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 


Timer interrupt mask bit. Permitted values are: 

Obd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 

For more information, see the description of the ISTATUS bit. 


This field resets to an architecturally UNKNOWN value. 
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ENABLE, bit [0] 
Enables the timer. Permitted values are: 
Ob Timer disabled. 
Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 


CNTHP_TVAL_EL2 continues to count down. 
Note 


Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHP_CTL_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic 


CNTHP_CTL_EL2 or CNTP_CTL_ELO are not guaranteed to be ordered with respect to accesses using the other 


mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTHP_CTL_EL2 


op0 op1 CRn CRm 


op2 





0b11 0b100 0b1110 0b0010 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return CNTHP_CTL_EL2; 
elsif PSTATE.EL == EL3 then 
return CNTHP_CTL_EL2; 


MSR CNTHP_CTL_EL2, <Xt> 


0b001 





op0 op1 CRn CRm 


op2 





0b11 0b100 0b1110 0b0010 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CNTHP_CTL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTHP_CTL_EL2 = X[t]; 
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MRS <Xt>, CNTP_CTL_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELO@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQPTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CTL_EL2; 
else 
return CNTP_CTL_ELQ; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x180] ; 
else 
return CNTP_CTL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CTL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHP_CTL_EL2; 
else 
return CNTP_CTL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTP_CTL_ELO; 

















MSR CNTP_CTL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
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AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 
then 


s 


AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_CTL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_CTL_EL2 = X[t]; 
else 
CNTP_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x180] = X[t]; 
else 
CNTP_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
CNTHPS_CTL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHP_CTL_EL2 = X[t]; 
else 
CNTP_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTP_CTL_ELO = X[t]; 
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D13.8.4 CNTHP_CVAL_EL2, Counter-timer Physical Timer CompareValue register (EL2) 
The CNTHP_CVAL_EL2 characteristics are: 


Purpose 
Holds the compare value for the EL2 physical timer. 
Configurations 
AArch64 System register CNTHP_CVAL EL2[63:0] is architecturally mapped to AArch32 
System register CNTHP_CVAL[63:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTHP_CVAL EL2 is a 64-bit register. 


Field descriptions 


The CNTHP_CVAL _EL2 bit assignments are: 


63 0 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL2 physical timer CompareValue. 


When CNTHP_CTL_EL2.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
CompareValue) is greater than or equal to zero. This means that CompareValue acts like a 64-bit 
upcounter timer. When the timer condition is met: 


° CNTHP_CTL_EL2.ISTATUS is set to 1. 
. If CNTHP_CTL_EL2.IMASK is 0, an interrupt is generated. 


When CNTHP_CTL_EL2.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO 
continues to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHP_CVAL_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic 
CNTHP_CVAL EL2 or CNTP_CVAL ELO are not guaranteed to be ordered with respect to accesses using the 
other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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op0 op1 CRn CRm op2 
0b11 0b100 0b1110 0b0010 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return CNTHP_CVAL_EL2; 
elsif PSTATE.EL == EL3 then 
return CNTHP_CVAL_EL2; 
MSR CNTHP_CVAL_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b1110 0b0010 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CNTHP_CVAL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTHP_CVAL_EL2 = X[t]; 
MRS <Xt>, CNTP_CVAL_ELO 
op0 op1 CRn CRm op2 
0b11 0b011 0b1110 0b0010 0b010 





if PSTATE.EL == EL@ then 


if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == 


then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 
return CNTHPS_CVAL_EL2; 


(CR_EL2. 








elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 





(CR_EL2. 


.<E2H,TGE> == 


<E2H,TGE> == 


<E2H,TGE> == 





<E2H,TGE> == 


"11') && CNTKCTL_EL1.EL@PTEN == 'Q' 


.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 


'10' && CNTHCTL_EL2.ELIPTEN == 'Q' 


'11' && CNTHCTL_EL2.ELOPTEN == 'Q' 


"11" && SCR_EL3.NS 


"11" && SCR_EL3.NS 
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return CNTHP_CVAL_EL2; 
else 
return CNTP_CVAL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x178]; 
else 
return CNTP_CVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
return CNTHPS_CVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHP_CVAL_EL2; 
else 
return CNTP_CVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTP_CVAL_ELQ; 


MSR CNTP_CVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0010 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELO@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_CVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_CVAL_EL2 = X[t]; 
else 
CNTP_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x178] = X[t]; 
else 
CNTP_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
CNTHPS_CVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHP_CVAL_EL2 = X[t]; 

















else 





CNTP_CVAL_EL® = X[t]; 
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elsif PSTATE.EL == EL3 then 
CNTP_CVAL_ELO = X[t]; 
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D13.8.5 
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CNTHP_TVAL_EL2, Counter-timer Physical Timer TimerValue register (EL2) 


The CNTHP_TVAL EL2 characteristics are: 


Purpose 
Holds the timer value for the EL2 physical timer. 
Configurations 
AArch64 System register CNTHP_TVAL EL2[31:0] is architecturally mapped to AArch32 System 
register CNTHP_TVAL[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTHP_TVAL_EL2 is a 64-bit register. 


Field descriptions 


The CNTHP_TVAL EL2 bit assignments are: 


32 31 0 


RESO TimerValue 


Bits [63:32] 


Reserved, RESO. 


Timer Value, bits [31:0] 
The TimerValue view of the EL2 physical timer. 
On a read of this register: 
s If CNTHP_CTL_EL2.ENABLE is 0, the value returned is UNKNOWN. 


+ If CNTHP_CTL_EL2.ENABLE is 1, the value returned is (CNTHP_CVAL_EL2 - 
CNTPCT_ELO). 


On a write of this register, CNTHP_CVAL_EL2 is set to (CNTPCT_ELO + TimerValue), where 
TimerValue is treated as a signed 32-bit integer. 


When CNTHP_CTL_EL2.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
CNTHP_CVAL_EL2) is greater than or equal to zero. This means that TimerValue acts like a 32-bit 
downcounter timer. When the timer condition is met: 


° CNTHP_CTL_EL2.ISTATUS is set to 1. 
. If CNTHP_CTL_EL2.IMASK is 0, an interrupt is generated. 


When CNTHP_CTL_EL2.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO 
continues to count, so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHP_TVAL_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic 
CNTHP_TVAL _EL2 or CNTP_TVAL ELO are not guaranteed to be ordered with respect to accesses using the 
other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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op0 op1 CRn CRm op2 
0b11 0b100 0b1110 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return CNTHP_TVAL_EL2; 
elsif PSTATE.EL == EL3 then 
return CNTHP_TVAL_EL2; 
MSR CNTHP_TVAL_EL2, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b100 0b1110 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CNTHP_TVAL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTHP_TVAL_EL2 = X[t]; 
MRS <Xt>, CNTP_TVAL_ELO 
op0 op1 CRn CRm op2 
0b11 0b011 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 


if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == 


then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 
return CNTHPS_TVAL_EL2; 


(CR_EL2. 








elsif EL2Enabled() && !ELUsingAArch32(EL2) && H 





(CR_EL2. 


.<E2H,TGE> == 


<E2H,TGE> == 


<E2H,TGE> == 





<E2H,TGE> == 


'11') && CNTKCTL_EL1.EL@PTEN == 'Q' 


.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 


'10' && CNTHCTL_EL2.ELIPTEN == 'Q' 


'11' && CNTHCTL_EL2.ELOPTEN == 'Q' 


"11" && SCR_EL3.NS 


"11" && SCR_EL3.NS 
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return CNTHP_TVAL_EL2; 
else 
return CNTP_TVAL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CNTP_TVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
return CNTHPS_TVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHP_TVAL_EL2; 
else 
return CNTP_TVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTP_TVAL_ELO; 


MSR CNTP_TVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_TVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_TVAL_EL2 = X[t]; 
else 
CNTP_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
CNTP_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
CNTHPS_TVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHP_TVAL_EL2 = X[t]; 

















else 





CNTP_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTP_TVAL_ELO = X[t]; 
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D13.8.6 CNTHPS_CTL_EL2, Counter-timer Secure Physical Timer Control register (EL2) 


63 
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The CNTHPS CTL _EL2 characteristics are: 


Purpose 


Control register for the Secure EL2 physical timer. 


Configurations 


AArch64 System register CNTHPS_CTL_EL2[31:0] is architecturally mapped to AArch32 System 
register CNTHPS_CTL[31:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHPS_CTL_EL2 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHPS_CTL_EL2 is a 64-bit register. 


Field descriptions 


The CNTHPS CTL _EL2 bit assignments are: 


RESO 


Le ENABLE 
IMASK 
ISTATUS 


Bits [63:3] 


Reserved, RESO. 


ISTATUS, bit [2] 
The status of the timer. This bit indicates whether the timer condition is met: 
Ob Timer condition is not met. 
Qb1 Timer condition is met. 


When the value of the CNTHPS_CTL_EL2.ENABLE bit is 1, ISTATUS indicates whether the timer 
condition is met. ISTATUS takes no account of the value of the IMASK bit. If the value of STATUS 
is 1 and the value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the CNTHPS_CTL_EL2.ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 
Timer interrupt mask bit. Permitted values are: 
Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 
For more information, see the description of the ISTATUS bit. 


This field resets to an architecturally UNKNOWN value. 
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ENABLE, bit [0] 
Enables the timer. Permitted values are: 
Ob Timer disabled. 
Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTHPS_TVAL_EL2 continues to count down. 


Note 


Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHPS_CTL_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTHPS_CTL_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0101 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
else 
return CNTHPS_CTL_EL2; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == 'Q' then 
UNDEFINED; 
else 
return CNTHPS_CTL_EL2; 


MSR CNTHPS_CTL_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0101 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
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UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
else 
CNTHPS_CTL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
CNTHPS_CTL_EL2 = X[t]; 


MRS <Xt>, CNTP_CTL_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQPTEN == 'Q' 








then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 











return CNTHP_CTL_EL2; 
else 
return CNTP_CTL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x180] ; 
else 
return CNTP_CTL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CTL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHP_CTL_EL2; 
else 
return CNTP_CTL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTP_CTL_ELO; 
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MSR CNTP_CTL_ELO, <Xt> 





op0 op1 CRn 


0b11 0b011 0b1110 


op2 


0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELØPTEN == 'Q' 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
!ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 


AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQPTEN == 'Q' 


AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS 


then 
else 
elsif EL2Enabled() && 
then 
then 
CNTHPS_CTL_EL2 = X[t 





elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS 




















CNTHP_CTL_EL2 = X[t]; 


else 
CNTP_CTL_E 
elsif PSTATE.EL == 


LQ = X[t]; 
EL1 then 


== 'Q' then 


== '1' then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 


NVMem[@x180] = X[t]; 


else 
CNTP_CTL_E 
elsif PSTATE.EL == 
if HCR_EL2.E2H 


LQ = X[t]; 
EL2 then 
== '1' && SCR_EL3.NS == 'Q' then 


CNTHPS_CTL_EL2 = X[t]; 


elsif HCR_EL2. 
CNTHP_CTL_ 

else 
CNTP_CTL_E 
elsif PSTATE.EL == 
CNTP_CTL_EL@ = 
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D13.8.7 CNTHPS_CVAL_EL2, Counter-timer Secure Physical Timer CompareValue register (EL2) 


63 


ARM DDI 0487E.a 
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The CNTHPS CVAL_EL2 characteristics are: 


Purpose 


Holds the compare value for the Secure EL2 physical timer. 


Configurations 


AArch64 System register CNTHPS_CVAL_EL2[31:0] is architecturally mapped to AArch32 
System register CNTHPS_ CVAL[31:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHPS_CVAL _EL2 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHPS_CVAL EL2 is a 64-bit register. 


Field descriptions 


The CNTHPS CVAL _EL2 bit assignments are: 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL2 physical timer Compare Value. 


When CNTHPS CTL _EL2.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
CompareValue) is greater than or equal to zero. This means that Compare Value acts like a 64-bit 
upcounter timer. When the timer condition is met: 


° CNTHPS_CTL_EL2.ISTATUS is set to 1. 
. If CNTHPS CTL _EL2.IMASK is 0, an interrupt is generated. 


When CNTHPS CTL _EL2.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO 
continues to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHPS_CVAL_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTHPS_CVAL_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0101 0b010 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
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UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
else 
return CNTHPS_CVAL_EL2; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
return CNTHPS_CVAL_EL2; 


MSR CNTHPS_CVAL_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0101 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
else 
CNTHPS_CVAL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
CNTHPS_CVAL_EL2 = X[t]; 


MRS <Xt>, CNTP_CVAL_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0010 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
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AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CVAL_EL2; 
else 
return CNTP_CVAL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x178]; 
else 
return CNTP_CVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHP_CVAL_EL2; 
else 
return CNTP_CVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTP_CVAL_ELQ; 


MSR CNTP_CVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0010 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_CVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_CVAL_EL2 = X[t]; 
else 
CNTP_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x178] = X[t]; 
else 
CNTP_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
CNTHPS_CVAL_EL2 = X[t]; 
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elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHP_CVAL_EL2 = X[t]; 
else 
CNTP_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTP_CVAL_ELO = X[t]; 
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D13.8.8 CNTHPS_TVAL_EL2, Counter-timer Secure Physical Timer TimerValue register (EL2) 
The CNTHPS TVAL EL2 characteristics are: 


Purpose 


Holds the timer value for the Secure EL2 physical timer. 


Configurations 


AArch64 System register CNTHPS_TVAL_ EL2[31:0] is architecturally mapped to AArch32 
System register CNTHPS_TVAL[31:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHPS_TVAL_ EL2 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHPS_TVAL _ EL2 is a 64-bit register. 


Field descriptions 


The CNTHPS TVAL EL2 bit assignments are: 


63 32 31 0 


RESO TimerValue 


Bits [63:32] 


Reserved, RESO. 


Timer Value, bits [31:0] 
The TimerValue view of the EL2 physical timer. 
On a read of this register: 
i If CNTHPS_CTL_EL2.ENABLE is 0, the value returned is UNKNOWN. 


+ If CNTHPS_CTL_EL2.ENABLE is 1, the value returned is (CNTHPS_CVAL_EL2 - 
CNTPCT_ELO). 


On a write of this register, CNTHPS CVAL_EL2 is set to (CNTPCT_ELO + TimerValue), where 
TimerValue is treated as a signed 32-bit integer. 


When CNTHPS CTL _EL2.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
CNTHPS_ CVAL EL2) is greater than or equal to zero. This means that TimerValue acts like a 
32-bit downcounter timer. When the timer condition is met: 


° CNTHPS_CTL_EL2.ISTATUS is set to 1. 
è If CNTHPS_CTL_EL2.IMASK is 0, an interrupt is generated. 


When CNTHPS CTL _EL2.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO 
continues to count, so the Timer Value view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHPS_TVAL_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CNTHPS_TVAL_EL2 





op0 op1 


0b11 0b100 


CRn 


0b1110 


CRm 


0b0101 


op2 


0b000 





if PSTATE.EL == EL@ then 

UNDEFINED; 
elsif PSTATE.EL == EL1 then 

if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 





else 
return CNTHPS_TVAL_EL2; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
return CNTHPS_TVAL_EL2; 


MSR CNTHPS_TVAL_EL2, <Xt> 





op0 op1 


CRn 


CRm 


op2 





0b11 0b100 


0b1110 


0b0101 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
else 
CNTHPS_TVAL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
CNTHPS_TVAL_EL2 = X[t]; 
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MRS <Xt>, CNTP_TVAL_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELO@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_TVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_TVAL_EL2; 
else 
return CNTP_TVAL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CNTP_TVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
return CNTHPS_TVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHP_TVAL_EL2; 
else 
return CNTP_TVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTP_TVAL_EL®; 

















MSR CNTP_TVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQPTEN == 'Q' 





then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
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then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_TVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_TVAL_EL2 = X[t]; 
else 
CNTP_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
CNTP_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
CNTHPS_TVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHP_TVAL_EL2 = X[t]; 
else 





CNTP_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTP_TVAL_ELO = X[t]; 
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D13.8.9 CNTHV_CTL_EL2, Counter-timer Virtual Timer Control register (EL2) 


63 


ARM DDI 0487E.a 
ID070919 


The CNTHV_CTL_EL2 characteristics are: 


Purpose 


Control register for the EL2 virtual timer. 


Configurations 


Attributes 


AArch64 System register CNTHV_CTL_EL2[31:0] is architecturally mapped to AArch32 System 
register CNTHV_CTL[31:0]. 


This register is present only when ARMV8.1-VHE is implemented. Otherwise, direct accesses to 
CNTHV_CTL_EL2 are UNDEFINED. 


If EL2 is not implemented, this register is RESO from EL3. 


RW fields in this register reset to architecturally UNKNOWN values. 


CNTHV_CTL_EL2 is a 64-bit register. 


Field descriptions 


The CNTHV_CTL_EL2 bit assignments are: 


Bits [63:3] 


3210 


L ENABLE 
IMASK 


ISTATUS 


RESO 


Reserved, RESO. 


ISTATUS, bit [2] 


The status of the timer. This bit indicates whether the timer condition is met: 
Qbd Timer condition is not met. 
Qb1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 


Timer interrupt mask bit. Permitted values are: 

Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 

For more information, see the description of the ISTATUS bit. 


This field resets to an architecturally UNKNOWN value. 
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ENABLE, bit [0] 
Enables the timer. Permitted values are: 
Ob Timer disabled. 
Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTHV_TVAL _EL2 continues to count down. 


Note 


Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHV_CTL_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic 
CNTHV_CTL_EL2 or CNTV_CTL_ELO are not guaranteed to be ordered with respect to accesses using the other 
mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTHV_CTL_EL2 


op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0011 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return CNTHV_CTL_EL2; 
elsif PSTATE.EL == EL3 then 
return CNTHV_CTL_EL2; 


MSR CNTHV_CTL_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0011 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CNTHV_CTL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTHV_CTL_EL2 = X[t]; 
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MRS <Xt>, CNTV_CTL_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0011 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CTL_EL2; 
else 
return CNTV_CTL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x170] ; 
else 
return CNTV_CTL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CTL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHV_CTL_EL2; 
else 
return CNTV_CTL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTV_CTL_ELO; 


MSR CNTV_CTL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CTL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CTL_EL2 = X[t]; 
else 
CNTV_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x170] = X[t]; 
else 
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CNTV_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
CNTHVS_CTL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHV_CTL_EL2 = X[t]; 
else 
CNTV_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CTL_ELO = X[t]; 
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D13.8.10 CNTHV_CVAL_EL2, Counter-timer Virtual Timer CompareValue register (EL2) 
The CNTHV_CVAL_EL2 characteristics are: 


Purpose 


Holds the compare value for the EL2 virtual timer. 


Configurations 


AArch64 System register CNTHV_CVAL_EL2[63:0] is architecturally mapped to AArch32 
System register CNTHV_CVAL[63:0]. 


This register is present only when ARMV8.1-VHE is implemented. Otherwise, direct accesses to 
CNTHV_CVAL_EL2 are UNDEFINED. 


If EL2 is not implemented, this register is RESO from EL3. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHV_CVAL EL2 is a 64-bit register. 


Field descriptions 


The CNTHV_CVAL _EL2 bit assignments are: 


63 0 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL2 virtual timer CompareValue. 


When CNTHV_CTL_EL2.ENABLE is 1, the timer condition is met when (CNTVCT_ELO - 
Compare Value) is greater than or equal to zero. This means that CompareValue acts like a 64-bit 
upcounter timer. When the timer condition is met: 


° CNTHV_CTL_EL2.ISTATUS is set to 1. 
à If CNTHV_CTL_EL2.IMASK is 0, an interrupt is generated. 


When CNTHV_CTL_EL2.ENABLE is 0, the timer condition is not met, but CNTVCT_ELO 
continues to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHV_CVAL_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic 
CNTHV_CVAL_EL2 or CNTV_CVAL _EL0 are not guaranteed to be ordered with respect to accesses using the 
other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CNTHV_CVAL_EL2 








op0 op1 CRn CRm op2 
0b11 0b100 0b1110 0b0011 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
return CNTHV_CVAL_EL2; 

elsif PSTATE.EL == EL3 then 
return CNTHV_CVAL_EL2; 


MSR CNTHV_CVAL_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0011 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CNTHV_CVAL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTHV_CVAL_EL2 = X[t]; 


MRS <Xt>, CNTV_CVAL_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 


AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CVAL_EL2; 
else 
return CNTV_CVAL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
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return NVMem[0x168] ; 
else 
return CNTV_CVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
return CNTHVS_CVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHV_CVAL_EL2; 
else 
return CNTV_CVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTV_CVAL_ELO; 


MSR CNTV_CVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 


AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CVAL_EL2 = X[t]; 
else 
CNTV_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x168] = X[t]; 
else 
CNTV_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
CNTHVS_CVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHV_CVAL_EL2 = X[t]; 





else 





CNTV_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CVAL_ELO = X[t]; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3723 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.8 Generic Timer registers 


D13.8.11 


D13-3724 


CNTHV_TVAL_EL2, Counter-timer Virtual Timer TimerValue Register (EL2) 


The CNTHV_TVAL_EL2 characteristics are: 


Purpose 


Holds the timer value for the EL2 virtual timer. 


Configurations 


Attributes 


AArch64 System register CNTHV_TVAL_EL2[31:0] is architecturally mapped to AArch32 
System register CNTHV_TVAL[31:0]. 


This register is present only when ARMV8.1-VHE is implemented. Otherwise, direct accesses to 
CNTHV_TVAL_EL2 are UNDEFINED. 


If EL2 is not implemented, this register is RESO from EL3. 


RW fields in this register reset to architecturally UNKNOWN values. 


CNTHV_TVAL EL2 is a 64-bit register. 


Field descriptions 


The CNTHV_TVAL_EL2 bit assignments are: 


63 


Bits [63:32] 


32 31 0 


RESO TimerValue 


Reserved, RESO. 


Timer Value, bits [31:0] 


The TimerValue view of the EL2 virtual timer. 
On a read of this register: 
$ If CNTHV_CTL_EL2.ENABLE is 0, the value returned is UNKNOWN. 


` If CNTHV_CTL_EL2.ENABLE is 1, the value returned is (CNTHV_CVAL_EL2 - 
CNTVCT_ELO0). 


On a write of this register, CNTHV_CVAL _EL2 is set to (CNTVCT_ELO + TimerValue), where 
TimerValue is treated as a signed 32-bit integer. 


When CNTHV_CTL_EL2.ENABLE is 1, the timer condition is met when (CNTVCT_ELO - 
CNTHV_CVAL _EL2) is greater than or equal to zero. This means that TimerValue acts like a 32-bit 
downcounter timer. When the timer condition is met: 


° CNTHV_CTL_EL2.ISTATUS is set to 1. 
. If CNTHV_CTL_EL2.IMASK is 0, an interrupt is generated. 


When CNTHV_CTL_EL2.ENABLE is 0, the timer condition is not met, but CNTVCT_ELO 
continues to count, so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHV_TVAL_EL2 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic 
CNTHV_TVAL EL2 or CNTV_TVAL_ELO are not guaranteed to be ordered with respect to accesses using the 
other mnemonic. 
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Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTHV_TVAL_EL2 











op0 op1 CRn CRm op2 
0b11 0b100 0b1110 0b0011 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
return CNTHV_TVAL_EL2; 

elsif PSTATE.EL == EL3 then 
return CNTHV_TVAL_EL2; 


MSR CNTHV_TVAL_EL2, <Xt> 


op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0011 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CNTHV_TVAL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTHV_TVAL_EL2 = X[t]; 


MRS <Xt>, CNTV_TVAL_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 


AArch64.SystemAccessTrap(EL2, 0x18); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_TVAL_EL2; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_TVAL_EL2; 

else 
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return CNTV_TVAL_ELO; 
elsif PSTATE.EL == EL1 then 
return CNTV_TVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
return CNTHVS_TVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHV_TVAL_EL2; 
else 
return CNTV_TVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTV_TVAL_EL®@; 


MSR CNTV_TVAL_ELO, <Xt> 





op0 op1 


CRn CRm op2 





0b11 0b011 


0b1110 0b0011 0b000 





if PSTATE.EL == EL@ then 


if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_ 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 


EL2.TGE == '1' then 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 


then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_E 
CNTHVS_TVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_E 
CNTHV_TVAL_EL2 = X[t]; 
else 
CNTV_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
CNTHVS_TVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHV_TVAL_EL2 = X[t]; 
else 
CNTV_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_TVAL_ELO = X[t]; 
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D13.8.12 CNTHVS_CTL_EL2, Counter-timer Secure Virtual Timer Control register (EL2) 


63 
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The CNTHVS CTL _EL2 characteristics are: 


Purpose 


Control register for the Secure EL2 virtual timer. 


Configurations 


Attributes 


AArch64 System register CNTHVS_CTL_EL2[31:0] is architecturally mapped to AArch32 
System register CNTHVS_CTL[31:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHVS_CTL_EL2 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


CNTHVS_CTL_EL2 is a 64-bit register. 


Field descriptions 


The CNTHVS CTL_EL2 bit assignments are: 


Bits [63:3] 


3210 


[Z ENABLE 
IMASK 


ISTATUS 


RESO 


Reserved, RESO. 


ISTATUS, bit [2] 


The status of the timer. This bit indicates whether the timer condition is met: 
Oba Timer condition is not met. 
Qb1 Timer condition is met. 


When the value of the CNTHVS_CTL_EL2.ENABLE bit is 1, ISTATUS indicates whether the 
timer condition is met. ISTATUS takes no account of the value of the IMASK bit. If the value of 
ISTATUS is 1 and the value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 


Timer interrupt mask bit. Permitted values are: 

Qbd Timer interrupt is not masked by the IMASK bit. 

Qb1 Timer interrupt is masked by the IMASK bit. 

For more information, see the description of the CNTHVS_CTL_EL2.ISTATUS bit. 


This field resets to an architecturally UNKNOWN value. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3727 


Non-Confidential 


AArch64 System Register Descriptions 
D13.8 Generic Timer registers 


D13-3728 


ENABLE, bit [0] 
Enables the timer. Permitted values are: 
Ob Timer disabled. 
0b1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 


CNTHVS_TVAL_ EL2 continues to count down. 
Note 


Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHVS_CTL_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTHVS_CTL_EL2 





op0 op1 CRn 


CRm 


op2 





0b11 0b100 0b1110 


0b0100 


0b001 





if PSTATE.EL == EL@ then 

UNDEFINED; 
elsif PSTATE.EL == EL1 then 

if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 





else 
return CNTHVS_CTL_EL2; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
return CNTHVS_CTL_EL2; 


MSR CNTHVS_CTL_EL2, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b100 0b1110 


0b0100 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 

else 
CNTHVS_CTL_EL2 = X[t]; 

elsif PSTATE.EL == EL3 then 

if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 

else 
CNTHVS_CTL_EL2 = X[t]; 


MRS <Xt>, CNTV_CTL_ELO 


op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b001 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CTL_EL2; 
else 
return CNTV_CTL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x170]; 
else 
return CNTV_CTL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CTL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHV_CTL_EL2; 
else 
return CNTV_CTL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTV_CTL_ELO; 


MSR CNTV_CTL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
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AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CTL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CTL_EL2 = X[t]; 
else 
CNTV_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x170] = X[t]; 
else 
CNTV_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
CNTHVS_CTL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHV_CTL_EL2 = X[t]; 
else 
CNTV_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CTL_ELO = X[t]; 
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D13.8.13 CNTHVS_CVAL_EL2, Counter-timer Secure Virtual Timer CompareValue register (EL2) 
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The CNTHVS_CVAL_EL2 characteristics are: 


Purpose 


Holds the compare value for the Secure EL2 virtual timer. 


Configurations 


AArch64 System register CNTHVS_CVAL_EL2[63:0] is architecturally mapped to AArch32 
System register CNTHVS_CVAL[63:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHVS_CVAL_EL2 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHVS _CVAL _EL2 is a 64-bit register. 


Field descriptions 


The CNTHVS CVAL EL2 bit assignments are: 


CompareValue 


CompareValue, bits [63:0] 
Holds the Secure EL2 virtual timer CompareValue. 


When CNTHVS_CTL_EL2.ENABLE is 1, the timer condition is met when (CNTVCT_ELO - 
CompareValue) is greater than or equal to zero. This means that CompareValue acts like a 64-bit 
upcounter timer. When the timer condition is met: 


° CNTHVS_CTL_EL2.ISTATUS is set to 1. 
: If CNTHVS_CTL_EL2.IMASK is 0, an interrupt is generated. 


When CNTHVS_CTL_EL2.ENABLE is 0, the timer condition is not met, but CNTVCT_ELO 
continues to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHVS_CVAL_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTHVS_CVAL_EL2 





op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0100 0b010 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
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UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 





else 
return CNTHVS_CVAL_EL2; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
return CNTHVS_CVAL_EL2; 


MSR CNTHVS_CVAL_EL2, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b100 0b1110 


0b0100 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
else 
CNTHVS_CVAL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
CNTHVS_CVAL_EL2 = X[t]; 


MRS <Xt>, CNTV_CVAL_ELO 





op0 op1 CRn 


0b11 0b011 0b1110 


CRm 


0b0011 


op2 


0b010 





if PSTATE.EL == EL@ then 


if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
then 


AArch64.SystemAccessTrap(EL2, 0x18); 


'11' && CNTHCTL_EL2.ELQVTEN == 'Q' 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 


return CNTHVS_CVAL_EL2; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 


return CNTHV_CVAL_EL2; 
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else 
return CNTV_CVAL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x168] ; 
else 
return CNTV_CVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHV_CVAL_EL2; 
else 
return CNTV_CVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTV_CVAL_EL®; 


MSR CNTV_CVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 


AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CVAL_EL2 = X[t]; 
else 
CNTV_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x168] = X[t]; 
else 
CNTV_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
CNTHVS_CVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHV_CVAL_EL2 = X[t]; 
else 





CNTV_CVAL_EL® = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CVAL_ELO = X[t]; 
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D13.8.14 CNTHVS_TVAL_EL2, Counter-timer Secure Virtual Timer TimerValue register (EL2) 


The CNTHVS TVAL_EL2 characteristics are: 


Purpose 


Holds the timer value for the Secure EL2 virtual timer. 


Configurations 


Attributes 


AArch64 System register CNTHVS_TVAL_ EL2[31:0] is architecturally mapped to AArch32 
System register CNTHVS_TVAL[31:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHVS_TVAL_EL2 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


CNTHVS_TVAL EL2 is a 64-bit register. 


Field descriptions 


The CNTHVS TVAL EL2 bit assignments are: 


63 


Bits [63:32] 


32 31 0 


RESO TimerValue 


Reserved, RESO. 


Timer Value, bits [31:0] 


The TimerValue view of the EL2 virtual timer. 
On a read of this register: 
If CNTHVS_ CTL_EL2.ENABLE is 0, the value returned is UNKNOWN. 


+ IfCNTHVS_CTL_EL2.ENABLE is 1, the value returned is (CNTHVS_CVAL_EL2 - 
CNTVCT_ELO). 


On a write of this register, CNTHVS_CVAL_EL2 is set to (CNTVCT_ELO + TimerValue), where 
TimerValue is treated as a signed 32-bit integer. 


When CNTHVS_CTL_EL2.ENABLE is 1, the timer condition is met when ((CNTVCT_ELO - 
CNTHVS_CVAL_ EL2) is greater than or equal to zero. This means that TimerValue acts like a 
32-bit downcounter timer. When the timer condition is met: 


° CNTHVS_CTL_EL2.ISTATUS is set to 1. 
a If CNTHVS_CTL_EL2.IMASK is 0, an interrupt is generated. 


When CNTHVS_CTL_EL2.ENABLE is 0, the timer condition is not met, but CNTVCT_ELO 
continues to count, so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHVS_TVAL_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CNTHVS_TVAL_EL2 








op0 op1 CRn CRm op2 
0b11 0b100 0b1110 0b0100 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 


elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 





else 
return CNTHVS_TVAL_EL2; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
return CNTHVS_TVAL_EL2; 


MSR CNTHVS_TVAL_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0100 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && SCR_EL3.NS == '1' then 
UNDEFINED; 
else 
CNTHVS_TVAL_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
if SCR_EL3.EEL2 == '@' then 
UNDEFINED; 
else 
CNTHVS_TVAL_EL2 = X[t]; 
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MRS <Xt>, CNTV_TVAL_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0011 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_TVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_TVAL_EL2; 
else 
return CNTV_TVAL_ELO; 
elsif PSTATE.EL == EL1 then 
return CNTV_TVAL_EL®@; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHVS_TVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHV_TVAL_EL2; 
else 
return CNTV_TVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTV_TVAL_EL®@; 


MSR CNTV_TVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_TVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_TVAL_EL2 = X[t]; 
else 
CNTV_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
CNTHVS_TVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHV_TVAL_EL2 = X[t]; 





D13-3736 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch64 System Register Descriptions 
D13.8 Generic Timer registers 


else 
CNTV_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_TVAL_ELO = X[t]; 
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D13.8.15 CNTKCTL_EL1, Counter-timer Kernel Control register 
The CNTKCTL_EL1 characteristics are: 
Purpose 


When ARMv8.1-VHE is not implemented, or when HCR_EL2.{E2H, TGE} is not {1, 1}, this 
register controls the generation of an event stream from the virtual counter, and access from ELO to 
the physical counter, virtual counter, EL1 physical timers, and the virtual timer. 


When ARMv8.1-VHE is implemented and HCR_EL2.{E2H, TGE} is {1, 1}, this register does not 
cause any event stream from the virtual counter to be generated, and does not control access to the 
counters and timers. The access to counters and timers at ELO is controlled by CNTHCTL_EL2. 


Configurations 


AArch64 System register CNTKCTL_EL1[31:0] is architecturally mapped to AArch32 System 
register CNTKCTL[31:0]. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 


into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
CNTKCTL _EL1 is a 64-bit register. 


Field descriptions 


The CNTKCTL_EL] bit assignments are: 


63 109 8 7 43210 
RESO EVNTI 

ae 

ELOVCTEN 

EVNTEN 

EVNTDIR 

ELOVTEN 

ELOPTEN 


Bits [63:10] 
Reserved, RESO. 
ELOPTEN, bit [9] 


Traps ELO accesses to the physical timer registers to EL1, or to EL2 when it is implemented and 
enabled for the current Security state and HCR_EL2.TGE is 1, as follows: 


In AArch64 state, the following registers are trapped, reported using EC syndrome value 
0x18: 


— CNTP_CTL_EL0, CNTP_CVAL_ELO, and CNTP_TVAL ELO. 


In AArch32 state, MRC and MCR accesses to the following registers are trapped, reported 


using EC syndrome value 0x03, MRRC and MCRR accesses are trapped, reported using EC 
syndrome value 0x04: 


— CNTP CTL, CNIP CVAL, CNTP_TVAL. 


Qbd ELO accesses to the physical timer registers are trapped to EL1. 
Qb1 This control does not cause any instructions to be trapped. 
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When ARMv8.1-VHE is implemented and HCR_EL2.{E2H, TGE} is {1, 1}, this control does not 
cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


ELOVTEN, bit [8] 


Traps ELO accesses to the virtual timer registers to EL1, or to EL2 when it is implemented and 
enabled for the current Security state and HCR_EL2.TGE is 1, as follows: 


° In AArch64 state, accesses to the following registers are trapped, reported using EC 
syndrome value 0x18: 


— CNTV_CTL EL0, CNTV_CVAL_ELO, and CNTV_TVAL_ELO. 


° In AArch32 state, MRC and MCR accesses to the following registers are trapped and 
reported using EC syndrome value 0x03, MRRC and MCRR accesses are trapped using EC 
syndrome value 0x04: 


—  CNTV_CTL, CNTV_CVAL, and CNTV_TVAL. 
Qbd ELO accesses to the virtual timer registers are trapped. 
Qb1 This control does not cause any instructions to be trapped. 


When ARMv8.1-VHE is implemented and HCR_EL2. {E2H, TGE} is {1, 1}, this control does not 
cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


EVNTI, bits [7:4] 


Selects which bit (0 to 15) of the counter register CNT VCT_ELO is the trigger for the event stream 
generated from that counter, when that stream is enabled. 


This field resets to an architecturally UNKNOWN value. 


EVNTDIR, bit [3] 


Controls which transition of the counter register CNT VCT_EL0 trigger bit, defined by EVNTI, 
generates an event when the event stream is enabled: 


Obd A 0 to | transition of the trigger bit triggers an event. 
Qb1 A 1 to 0 transition of the trigger bit triggers an event. 


This field resets to an architecturally UNKNOWN value. 


EVNTEN, bit [2] 


When ARMv8.1-VHE is not implemented, or when HCR_EL2.{E2H, TGE} is not {1, 1}, enables 
the generation of an event stream from the counter register CNT VCT_ELO: 


Ob Disables the event stream. 
Qb1 Enables the event stream. 


When ARMv8.1-VHE is implemented and HCR_EL2. {E2H, TGE} is {1, 1}, this control does not 
enable the event stream. 


This field resets to Q. 


ELOVCTEN, bit [1] 


Traps ELO accesses to the frequency register and virtual counter register to EL1, or to EL2 when it 
is implemented and enabled for the current Security state and HCR_EL2.TGE is 1, as follows: 


. In AArch64 state, accesses to the following registers are trapped and reported using EC 
syndrome value 0x18: 


— CNTVCT_EL0 and if CNTKCTL_EL1.ELOPCTEN is 0, CNTFRQ ELO. 
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e In AArch32 state, MRC and MCR accesses to the following registers are trapped and 
reported using EC syndrome value 0x03, MRRC and MCRR accesses are trapped and 


reported using EC syndrome value 0x04: 
— CNTVCT and if CNTKCTL_EL1.ELOPCTEN is 0, CNTFRQ. 


Qbd ELO accesses to the frequency register and virtual counter registers are trapped. 


Qb1 This control does not cause any instructions to be trapped. 


When ARMv8.1-VHE is implemented and HCR_EL2. {E2H, TGE} is {1, 1}, this control does not 


cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


ELOPCTEN, bit [0] 


Traps ELO accesses to the frequency register and physical counter register to EL1, or to EL2 when 
it is implemented and enabled for the current Security state and HCR_EL2.TGE is 1, as follows: 


° In AArch64 state, the following registers are trapped, reported using EC syndrome value 


0x18: 


— CNTPCT_EL0 and if CNTKCTL_EL1.ELOVCTEN is 0, CNTFRQ ELO. 


° In AArch32 state, MCR or MRC accesses the following registers are trapped, reported using 
EC syndrome value 0x03, MCRR or MRRC accesses are trapped and reported using EC 


syndrome value 0x04: 
—  CNTPCT and if CNTKCTL_EL1.ELOVCTEN is 0, CNTFRQ. 


Ob ELO accesses to the frequency register and physical counter register are trapped. 


Qb1 This control does not cause any instructions to be trapped. 


When ARMv8.1-VHE is implemented and HCR_EL2. {E2H, TGE} is {1, 1}, this control does not 


cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTKCTL_EL1 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic 


CNTKCTL_EL1 or CNTKCTL_EL12 are not guaranteed to be ordered with respect to accesses using the other 


mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTKCTL_EL1 


op0 op1 CRn CRm 


op2 





0b11 0b000 0b1110 0b0001 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
return CNTKCTL_EL1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
return CNTHCTL_EL2; 
else 
return CNTKCTL_EL1; 
elsif PSTATE.EL == EL3 then 
return CNTKCTL_EL1; 
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MSR CNTKCTL_EL1, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b000 0b1110 0b0001 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
CNTKCTL_EL1 = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' then 
CNTHCTL_EL2 = X[t]; 
else 
CNTKCTL_EL1 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTKCTL_EL1 = X[t]; 


MRS <Xt>, CNTKCTL_EL12 





op0 op1 CRn CRm op2 





0b11 0b101 0b1110 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTKCTL_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTKCTL_EL1; 
else 
UNDEFINED; 


MSR CNTKCTL_EL12, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b1110 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTKCTL_EL1 = X[t]; 
else 
UNDEFINED; 
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elsif PSTATE.EL == EL3 then 


if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTKCTL_EL1 = X[t]; 
else 
UNDEFINED; 
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D13.8.16 CNTP_CTL_ELO, Counter-timer Physical Timer Control register 


63 


ARM DDI 0487E.a 
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The CNTP_CTL_EL0 characteristics are: 


Purpose 
Control register for the EL1 physical timer. 
Configurations 
AArch64 System register CNTP_CTL_EL0[31:0] is architecturally mapped to AArch32 System 
register CNTP_CTL[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTP_CTL_ELO is a 64-bit register. 


Field descriptions 


The CNTP_CTL_ELO bit assignments are: 


3210 


e ENABLE 
IMASK 


ISTATUS 


RESO 


Bits [63:3] 


Reserved, RESO. 


ISTATUS, bit [2] 
The status of the timer. This bit indicates whether the timer condition is met: 
Ob Timer condition is not met. 
0b1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 
IMASK, bit [1] 
Timer interrupt mask bit. Permitted values are: 
Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 
For more information, see the description of the ISTATUS bit. 


This field resets to an architecturally UNKNOWN value. 
ENABLE, bit [0] 

Enables the timer. Permitted values are: 

Qbd Timer disabled. 
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Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTP_TVAL ELO continues to count down. 


Note 


Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTP_CTL_ELO 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic 
CNTP_CTL_ELO or CNTP_CTL_ELO2 are not guaranteed to be ordered with respect to accesses using the other 
mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTP_CTL_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CTL_EL2; 
else 
return CNTP_CTL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x180] ; 
else 
return CNTP_CTL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
return CNTHPS_CTL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHP_CTL_EL2; 
else 
return CNTP_CTL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTP_CTL_ELO; 














D13-3744 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.8 Generic Timer registers 


MSR CNTP_CTL_ELO, <Xt> 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELOPTEN == 'Q' 





then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_CTL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 














CNTHP_CTL_EL2 = X[t]; 
else 
CNTP_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x180] = X[t]; 
else 
CNTP_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
CNTHPS_CTL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHP_CTL_EL2 = X[t]; 
else 





CNTP_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTP_CTL_ELO = X[t]; 


MRS <Xt>, CNTP_CTL_EL02 





op0 op1 CRn CRm op2 





0b11 0b101 0b1110 0b0010 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x180] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
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return CNTP_CTL_ELO; 

else 
UNDEFINED; 

elsif PSTATE.EL == EL3 then 

if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTP_CTL_ELO; 

else 
UNDEFINED; 


MSR CNTP_CTL_ELO2, <Xt> 





op0 op1 CRn CRm 


op2 





0b11 0b101 0b1110 0b0010 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x180] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTP_CTL_ELO = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTP_CTL_ELO = X[t]; 
else 
UNDEFINED; 
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D13.8.17 CNTP_CVAL_ELO, Counter-timer Physical Timer CompareValue register 


The CNTP_CVAL ELO characteristics are: 


Purpose 
Holds the compare value for the EL1 physical timer. 
Configurations 
AArch64 System register CNTP_CVAL_EL0[63:0] is architecturally mapped to AArch32 System 
register CNTP_CVAL[63:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTP_CVAL_ELO is a 64-bit register. 


Field descriptions 


The CNTP_CVAL _ELO bit assignments are: 


63 0 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL1 physical timer CompareValue. 


When CNTP_CTL_ELO.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
CompareValue) is greater than or equal to zero. This means that CompareValue acts like a 64-bit 
upcounter timer. When the timer condition is met: 


° CNTP_CTL_ELO.ISTATUS is set to 1. 
. If CNTP_CTL_ELO.IMASK is 0, an interrupt is generated. 


When CNTP_CTL_ELO.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO continues 
to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTP_CVAL_ELO 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic 
CNTP_CVAL_ELO or CNTP_CVAL_EL02 are not guaranteed to be ordered with respect to accesses using the 
other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CNTP_CVAL_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0010 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELO@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CVAL_EL2; 
else 
return CNTP_CVAL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x178]; 
else 
return CNTP_CVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHP_CVAL_EL2; 
else 
return CNTP_CVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTP_CVAL_ELO; 

















MSR CNTP_CVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0010 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
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AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELOPTEN == 


then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS 
CNTHPS_CVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS 
CNTHP_CVAL_EL2 = X[t]; 
else 
CNTP_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 





s 


== '@0' then 


== '1' then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == '@' then 


AArch64.SystemAccessTrap(EL2, 0x18); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 


AArch64.SystemAccessTrap(EL2, 0x18); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
NVMem[@x178] = X[t]; 

else 
CNTP_CVAL_ELO = X[t]; 

elsif PSTATE.EL == EL2 then 

if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
CNTHPS_CVAL_EL2 = X[t]; 

elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHP_CVAL_EL2 = X[t]; 





else 





CNTP_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTP_CVAL_ELO = X[t]; 


MRS <Xt>, CNTP_CVAL_EL02 


op0 op1 CRn CRm 


op2 





0b11 0b101 0b1110 0b0010 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x178]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTP_CVAL_ELO; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTP_CVAL_ELO; 
else 
UNDEFINED; 
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D13-3750 


MSR CNTP_CVAL_ELO2, <Xt> 





op0 op1 CRn CRm 


0b11 0b101 0b1110 0b0010 


op2 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x178] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTP_CVAL_ELO = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTP_CVAL_ELO = X[t]; 
else 
UNDEFINED; 
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D13.8.18 ©CNTP_TVAL_ELO, Counter-timer Physical Timer TimerValue register 


63 
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The CNTP_TVAL_ELO characteristics are: 


Purpose 
Holds the timer value for the EL1 physical timer. 
Configurations 
AArch64 System register CNTP_TVAL ELO[31:0] is architecturally mapped to AArch32 System 
register CNTP_TVAL[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTP_TVAL ELO is a 64-bit register. 


Field descriptions 


The CNTP_TVAL_ELO bit assignments are: 


32 31 0 


RESO TimerValue 


Bits [63:32] 


Reserved, RESO. 


Timer Value, bits [31:0] 
The TimerValue view of the EL1 physical timer. 
On a read of this register: 
d If CNTP_CTL_EL0.ENABLE is 0, the value returned is UNKNOWN. 


$ If CNTP_CTL_EL0.ENABLE is 1, the value returned is (CNTP_CVAL_ELO - 
CNTPCT_EL0O). 


On a write of this register, CNTP_CVAL_ELO is set to (CNTPCT_ELO + TimerValue), where 
TimerValue is treated as a signed 32-bit integer. 


When CNTP_CTL_ELO.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
CNTP_CVAL_EL0) is greater than or equal to zero. This means that TimerValue acts like a 32-bit 
downcounter timer. When the timer condition is met: 


° CNTP_CTL_ELO.ISTATUS is set to 1. 
. If CNTP_CTL_ELO.IMASK is 0, an interrupt is generated. 


When CNTP_CTL_ELO.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO continues 
to count, so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTP_TVAL_ELO 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic 
CNTP_TVAL ELO or CNTP_TVAL EL02 are not guaranteed to be ordered with respect to accesses using the other 
mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CNTP_TVAL_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELØPTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_TVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 

















return CNTHP_TVAL_EL2; 
else 
return CNTP_TVAL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CNTP_TVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
return CNTHPS_TVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHP_TVAL_EL2; 
else 
return CNTP_TVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTP_TVAL_EL®; 


MSR CNTP_TVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
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then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_TVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_TVAL_EL2 = X[t]; 
else 
CNTP_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
CNTP_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
CNTHPS_TVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHP_TVAL_EL2 = X[t]; 
else 





CNTP_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTP_TVAL_ELO = X[t]; 


MRS <Xt>, CNTP_TVAL_EL02 








op0 op1 CRn CRm op2 
0b11 0b101 0b1110 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 


elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTP_TVAL_ELO; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTP_TVAL_ELO; 
else 
UNDEFINED; 


MSR CNTP_TVAL_ELO2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
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elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTP_TVAL_ELO = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTP_TVAL_ELO = X[t]; 
else 
UNDEFINED; 
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D13.8.19 CNTPCT_ELO, Counter-timer Physical Count register 


The CNTPCT_ELO characteristics are: 


Purpose 
Holds the 64-bit physical count value. 
Configurations 
AArch64 System register CNTPCT_EL0[63:0] is architecturally mapped to AArch32 System 
register CNTPCT[63:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTPCT_ELO is a 64-bit register. 


Field descriptions 


The CNTPCT_ELO bit assignments are: 


63 0 
Physical count value 


Bits [63:0] 


Physical count value. 


Accessing the CNTPCT_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTPCT_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0000 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQPCTEN == 
'@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PCTEN == 
'@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PCTEN == 
'@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CNTPCT_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && CNTHCTL_EL2.EL1PCTEN == 'Q' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CNTPCT_ELO; 
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elsif PSTATE.EL == EL2 then 
return CNTPCT_ELQ; 

elsif PSTATE.EL == EL3 then 
return CNTPCT_ELQ; 
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D13.8.20 CNTPS_CTL_EL1, Counter-timer Physical Secure Timer Control register 


The CNTPS_CTL_EL1 characteristics are: 


Purpose 
Control register for the secure physical timer, usually accessible at EL3 but configurably accessible 
at EL1 in Secure state. 

Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


CNTPS_CTL_ELI is a 64-bit register. 


Field descriptions 


The CNTPS_CTL_EL] bit assignments are: 


63 3210 
RESO 
eee 
IMASK 
ISTATUS 
Bits [63:3] 


Reserved, RESO. 


ISTATUS, bit [2] 
The status of the timer. This bit indicates whether the timer condition is met: 
Ob Timer condition is not met. 
0b1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is | and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 
IMASK, bit [1] 
Timer interrupt mask bit. Permitted values are: 
Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 
For more information, see the description of the ISTATUS bit. 
This field resets to an architecturally UNKNOWN value. 
ENABLE, bit [0] 


Enables the timer. Permitted values are: 


0bd Timer disabled. 
Qb1 Timer enabled. 
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Setting this bit to 0 disables the timer output signal, but the timer value accessible from 


CNTPS_TVAL ELI continues to count down. 
Note 


Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTPS_CTL_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTPS_CTL_EL1 

















op0 op1 CRn CRm op2 
0b11 0b111 0b1110 0b0010 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == 'Q' then 
if SCR_EL3.EEL2 == '1' then 
UNDEFINED; 
elsif SCR_EL3.ST == 'Q@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return CNTPS_CTL_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return CNTPS_CTL_EL1; 
MSR CNTPS_CTL_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b111 0b1110 0b0010 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '@' then 
if SCR_EL3.EEL2 == '1' then 
UNDEFINED; 
elsif SCR_EL3.ST == 'Q@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
CNTPS_CTL_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
CNTPS_CTL_EL1 = X[t]; 
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D13.8.21 CNTPS_CVAL_EL1, Counter-timer Physical Secure Timer CompareValue register 
The CNTPS _CVAL ELI characteristics are: 


Purpose 
Holds the compare value for the secure physical timer, usually accessible at EL3 but configurably 
accessible at EL1 in Secure state. 

Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


CNTPS_CVAL ELI is a 64-bit register. 


Field descriptions 


The CNTPS _CVAL EL] bit assignments are: 


63 0 


CompareValue 


CompareValue, bits [63:0] 
Holds the secure physical timer Compare Value. 


When CNTPS_CTL_EL1.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
Compare Value) is greater than or equal to zero. This means that CompareValue acts like a 64-bit 
upcounter timer. When the timer condition is met: 


° CNTPS_CTL_EL1.ISTATUS is set to 1. 
` If CNTPS_CTL_EL1.IMASK is 0, an interrupt is generated. 


When CNTPS_CTL_EL1.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO 
continues to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTPS_CVAL_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTPS_CVAL_EL1 





op0 op1 CRn CRm op2 





0b11 0b111 0b1110 0b0010 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '@' then 
if SCR_EL3.EEL2 == '1' then 
UNDEFINED; 
elsif SCR_EL3.ST == 'Q@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
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else 


return CNTPS_CVAL_EL1; 


else 
UNDEFINED; 
elsif PSTATE.EL == 
UNDEFINED; 
elsif PSTATE.EL == 


EL2 then 


EL3 then 


return CNTPS_CVAL_EL1; 


MSR CNTPS_CVAL_EL1, <Xt> 





op0 op1 CRn 


CRm 


op2 





0b11 0b111 0b1110 


0b0010 


0b010 





if PSTATE.EL == EL@ then 


UNDEFINED; 
elsif PSTATE.EL == 


EL1 then 


if HaveEL(EL3) && SCR_EL3.NS == 'Q' then 


if SCR_EL3. 


EEL2 == '1' then 


UNDEFINED; 
elsif SCR_EL3.ST == 'Q@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 


else 


CNTPS_CVAL_EL1 = X[t]; 


else 
UNDEFINED; 
elsif PSTATE.EL == 
UNDEFINED; 
elsif PSTATE.EL == 


EL2 then 


EL3 then 


CNTPS_CVAL_EL1 = X[t]; 
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D13.8.22 CNTPS_TVAL_EL1, Counter-timer Physical Secure Timer TimerValue register 


The CNTPS_TVAL_EL1 characteristics are: 


Purpose 
Holds the timer value for the secure physical timer, usually accessible at EL3 but configurably 
accessible at EL1 in Secure state. 

Configurations 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


CNTPS_TVAL EL] is a 64-bit register. 


Field descriptions 


The CNTPS_TVAL _ ELI bit assignments are: 


63 32 31 0 


RESO TimerValue 


Bits [63:32] 


Reserved, RESO. 


Timer Value, bits [31:0] 
The TimerValue view of the secure physical timer. 
On a read of this register: 
a If CNTPS_CTL_EL1.ENABLE is 0, the value returned is UNKNOWN. 


+ IfCNTPS_CTL _EL1.ENABLE is 1, the value returned is (CNTPS_CVAL_ELI - 
CNTPCT_ELO). 


On a write of this register, CNTPS_ CVAL EL] is set to (CNTPCT_ELO + TimerValue), where 
TimerValue is treated as a signed 32-bit integer. 


When CNTPS_CTL_EL1.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
CNTPS_CVAL_EL]1) is greater than or equal to zero. This means that TimerValue acts like a 32-bit 
downcounter timer. When the timer condition is met: 


° CNTPS_CTL_EL1.ISTATUS is set to 1. 
è If CNTPS_CTL_EL1.IMASK is 0, an interrupt is generated. 


When CNTPS_CTL_EL1.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO 
continues to count, so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTPS_TVAL_EL1 


Accesses to this register use the following encodings in the System instruction encoding space: 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. D13-3761 
ID070919 Non-Confidential 


AArch64 System Register Descriptions 
D13.8 Generic Timer registers 


MRS <Xt>, CNTPS_TVAL_EL1 














op0 op1 CRn CRm op2 
0b11 0b111 0b1110 0b0010 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '@' then 
if SCR_EL3.EEL2 == '1' then 
UNDEFINED; 
elsif SCR_EL3.ST == 'Q@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
return CNTPS_TVAL_EL1; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return CNTPS_TVAL_EL1; 
MSR CNTPS_TVAL_EL1, <Xt> 
op0 op1 CRn CRm op2 
0b11 0b111 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if HaveEL(EL3) && SCR_EL3.NS == '@' then 
if SCR_EL3.EEL2 == '1' then 
UNDEFINED; 
elsif SCR_EL3.ST == 'Q@' then 
AArch64.SystemAccessTrap(EL3, 0x18); 
else 
CNTPS_TVAL_EL1 = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
CNTPS_TVAL_EL1 = X[t]; 
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D13.8.23 CNTV_CTL_ELO, Counter-timer Virtual Timer Control register 


63 
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The CNTV_CTL_ELO characteristics are: 


Purpose 
Control register for the virtual timer. 
Configurations 
AArch64 System register CNTV_CTL_ELO[31:0] is architecturally mapped to AArch32 System 
register CNTV_CTL[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTV_CTL_ELO0 is a 64-bit register. 


Field descriptions 


The CNTV_CTL_ELO bit assignments are: 


3210 


e ENABLE 
IMASK 


ISTATUS 


RESO 


Bits [63:3] 


Reserved, RESO. 


ISTATUS, bit [2] 
The status of the timer. This bit indicates whether the timer condition is met: 
Ob Timer condition is not met. 
0b1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 
IMASK, bit [1] 
Timer interrupt mask bit. Permitted values are: 
Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 
For more information, see the description of the ISTATUS bit. 


This field resets to an architecturally UNKNOWN value. 
ENABLE, bit [0] 

Enables the timer. Permitted values are: 

Qbd Timer disabled. 
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Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTV_TVAL _EL0O continues to count down. 


Note 
Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTV_CTL_ELO 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic 
CNTV_CTL_ELO or CNTV_CTL_EL02 are not guaranteed to be ordered with respect to accesses using the other 
mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTV_CTL_ELO 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CTL_EL2; 
else 
return CNTV_CTL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then 
return NVMem[0x170]; 
else 
return CNTV_CTL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CTL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHV_CTL_EL2; 
else 
return CNTV_CTL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTV_CTL_ELO; 
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op0 op1 CRn 


0b11 0b011 


0b1110 


CRm op2 


0b0011 0b001 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H, TGE> 
then 


"11') && CNTKCTL_EL1. ELOVTEN 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
CNTHVS_CTL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
CNTHV_CTL_EL2 = X[t]; 
else 
CNTV_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == 
NVMem[@x170] = X[t]; 
else 
CNTV_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
CNTHVS_CTL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHV_CTL_EL2 = X[t]; 
else 
CNTV_CTL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CTL_ELO = X[t]; 


MRS <Xt>, CNTV_CTL_ELO02 


'11' && CNTHCTL_EL2.ELOVTEN 


"11' && SCR_EL3.NS == 'Q' then 


"11" && SCR_EL3.NS == '1' then 


"111' then 





op0 op1 CRn 


CRm op2 





0b11 0b101 0b1110 


0b0011 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x170]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == 
return CNTV_CTL_ELO; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == 
return CNTV_CTL_ELO; 
else 
UNDEFINED; 


'1' then 


'1' then 
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MSR CNTV_CTL_EL02, <Xt> 





op0 op1 CRn CRm 


0b11 0b101 0b1110 0b0011 


op2 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x170] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTV_CTL_ELO = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTV_CTL_ELO = X[t]; 
else 
UNDEFINED; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


AArch64 System Register Descriptions 
D13.8 Generic Timer registers 


D13.8.24 CNTV_CVAL_ELO, Counter-timer Virtual Timer CompareValue register 


The CNTV_CVAL_ELO characteristics are: 


Purpose 
Holds the compare value for the virtual timer. 
Configurations 
AArch64 System register CNTV_CVAL_EL0[63:0] is architecturally mapped to AArch32 System 
register CNTV_CVAL[63:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTV_CVAL ELO is a 64-bit register. 


Field descriptions 


The CNTV_CVAL ELO bit assignments are: 


63 0 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL1 virtual timer CompareValue. 


When CNTV_CTL_ELO.ENABLE is 1, the timer condition is met when (CNTVCT_ELO - 
CompareValue) is greater than or equal to zero. This means that CompareValue acts like a 64-bit 
upcounter timer. When the timer condition is met: 


° CNTV_CTL_ELO.ISTATUS is set to 1. 
. If CNTV_CTL_EL0.IMASK is 0, an interrupt is generated. 


When CNTV_CTL_EL0.ENABLE is 0, the timer condition is not met, but CNTVCT_ELO 
continues to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTV_CVAL_ELO 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic 
CNTV_CVAL ELO or CNTV_CVAL _ELO2 are not guaranteed to be ordered with respect to accesses using the 
other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CNTV_CVAL_ELO 





op0 op1 CRn 


CRm op2 


0b1110 


0b11 0b011 


0b0011 0b010 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H, TGE> 
then 


"11') && CNTKCTL_EL1.ELOVTEN 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
return CNTHVS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
return CNTHV_CVAL_EL2; 
else 
return CNTV_CVAL_ELO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == 
return NVMem[0x168] ; 
else 
return CNTV_CVAL_ELO; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHV_CVAL_EL2; 
else 
return CNTV_CVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTV_CVAL_ELO; 


MSR CNTV_CVAL_ELO, <Xt> 


'11' && CNTHCTL_EL2.ELOVTEN 


"11' && SCR_EL3.NS == 'Q' then 


"11" && SCR_EL3.NS == '1' then 


"111' then 





op0 op1 CRn 


CRm op2 





0b11 0b011 0b1110 


0b0011 0b010 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H, TGE> 
then 


'11') && CNTKCTL_EL1.ELOVTEN 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
CNTHVS_CVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == 
CNTHV_CVAL_EL2 = X[t]; 
else 
CNTV_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> 
NVMem[@x168] = X[t]; 
else 
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CNTV_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == '@' then 
CNTHVS_CVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHV_CVAL_EL2 = X[t]; 
else 





CNTV_CVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CVAL_ELO = X[t]; 


MRS <Xt>, CNTV_CVAL_EL02 





op0 op1 CRn CRm op2 


0b11 0b101 0b1110 0b0011 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
return NVMem[0x168] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTV_CVAL_ELO; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTV_CVAL_ELO; 
else 
UNDEFINED; 


MSR CNTV_CVAL_ELO2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b101 0b1110 0b0011 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then 
NVMem[@x168] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTV_CVAL_ELO = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTV_CVAL_ELO = X[t]; 
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else 
UNDEFINED; 
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The CNTV_TVAL _ELO characteristics are: 


Purpose 
Holds the timer value for the EL1 virtual timer. 
Configurations 
AArch64 System register CNTV_TVAL ELO[31:0] is architecturally mapped to AArch32 System 
register CNTV_TVAL[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTV_TVAL_ELO is a 64-bit register. 


Field descriptions 


The CNTV_TVAL _ELO bit assignments are: 


32 31 0 


RESO TimerValue 


Bits [63:32] 


Reserved, RESO. 


Timer Value, bits [31:0] 
The TimerValue view of the EL1 virtual timer. 
On a read of this register: 
. If CNTV_CTL_EL0.ENABLE is 0, the value returned is UNKNOWN. 


+ If CNTV_CTL_ELO.ENABLE is 1, the value returned is (CNTV_CVAL_ELO - 
CNTVCT_ELO). 


On a write of this register, CNTV_CVAL_ELO is set to (CNTVCT_ELO + TimerValue), where 
TimerValue is treated as a signed 32-bit integer. 


When CNTV_CTL_ELO.ENABLE is 1, the timer condition is met when (CNTVCT_ELO - 
CNTV_CVAL_EL0O) is greater than or equal to zero. This means that TimerValue acts like a 32-bit 
downcounter timer. When the timer condition is met: 


° CNTV_CTL_ELO.ISTATUS is set to 1. 
. If CNTV_CTL_EL0.IMASK is 0, an interrupt is generated. 


When CNTV_CTL_EL0.ENABLE is 0, the timer condition is not met, but CNTVCT_ELO 
continues to count, so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTV_TVAL_ELO 


When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic 
CNTV_TVAL_ELO or CNTV_TVAL ELO02 are not guaranteed to be ordered with respect to accesses using the 
other mnemonic. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CNTV_TVAL_ELO 





op0 op1 CRn CRm op2 


0b11 0b011 0b1110 0b0011 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_TVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_TVAL_EL2; 
else 
return CNTV_TVAL_ELO; 
elsif PSTATE.EL == EL1 then 
return CNTV_TVAL_EL®@; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
return CNTHVS_TVAL_EL2; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
return CNTHV_TVAL_EL2; 
else 
return CNTV_TVAL_ELO; 
elsif PSTATE.EL == EL3 then 
return CNTV_TVAL_EL®@; 


MSR CNTV_TVAL_ELO, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0011 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.SystemAccessTrap(EL2, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_TVAL_EL2 = X[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_TVAL_EL2 = X[t]; 
else 
CNTV_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '1' && SCR_EL3.NS == 'Q' then 
CNTHVS_TVAL_EL2 = X[t]; 
elsif HCR_EL2.E2H == '1' && SCR_EL3.NS == '1' then 
CNTHV_TVAL_EL2 = X[t]; 
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else 
CNTV_TVAL_ELO = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_TVAL_ELO = X[t]; 


MRS <Xt>, CNTV_TVAL_EL02 


op0 op1 


CRn 
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CRm 


op2 





0b11 0b101 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTV_TVAL_ELO; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
return CNTV_TVAL_ELO; 
else 
UNDEFINED; 


MSR CNTV_TVAL_ELO2, <Xt> 


0b1110 


0b0011 


0b000 





op0 op1 


CRn 


CRm 


op2 





0b11 0b101 


0b1110 


0b0011 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTV_TVAL_ELO = X[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if EL2Enabled() && HCR_EL2.E2H == '1' then 
CNTV_TVAL_ELO = X[t]; 
else 





UNDEFINED; 
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D13.8.26 CNTVCT_ELO, Counter-timer Virtual Count register 
The CNTVCT_ELO characteristics are: 


Purpose 


Holds the 64-bit virtual count value. The virtual count value is equal to the physical count value 
visible in CNTPCT_ELO minus the virtual offset visible in CNTVOFF_EL2. 


Configurations 


AArch64 System register CNTVCT_EL0[63:0] is architecturally mapped to AArch32 System 
register CNT VCT[63:0]. 


The value of this register is the same as the value of CNTPCT_ELO in the following conditions: 
. When EL2 is not implemented. 
: When EL2 is implemented, HCR_EL2.E2H is 1, and this register is read from EL2. 


è When EL2 is implemented and enabled in the current Security state, HCR_EL2.{E2H, TGE} 
is {1, 1}, and this register is read from ELO or EL2. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTVCT_ELO is a 64-bit register. 


Field descriptions 


The CNTVCT_ELO bit assignments are: 


63 0 


Virtual count value 


Bits [63:0] 


Virtual count value. 


Accessing the CNTVCT_ELO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS <Xt>, CNTVCT_ELO 


op0 op1 CRn CRm op2 





0b11 0b011 0b1110 0b0000 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVCTEN == 
'@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
AArch64.SystemAccessTrap(EL1, 0x18); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@VCTEN == 
'@' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
return CNTVCT_ELO; 
elsif PSTATE.EL == EL1 then 
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return CNTVCT_ELQ; 
elsif PSTATE.EL == EL2 then 

return CNTVCT_ELQ; 
elsif PSTATE.EL == EL3 then 

return CNTVCT_ELQ; 
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D13.8.27 


D13-3776 


CNTVOFF_EL2, Counter-timer Virtual Offset register 


The CNTVOFF_EL2 characteristics are: 


Purpose 


Holds the 64-bit virtual offset. This is the offset between the physical count value visible in 
CNTPCT_EL0 and the virtual count value visible in CNTVCT_ELO. 


Configurations 


Attributes 


AArch64 System register CNTVOFF_EL2[63:0] is architecturally mapped to AArch32 System 
register CNT VOFF[63:0]. 


If EL2 is not implemented, this register is RESO from EL3 and the virtual counter uses a fixed virtual 
offset of zero. 


Note 


When EL2 is implemented and enabled in the current Security state, and is using AArch64, the 
virtual counter uses a fixed virtual offset of zero in the following situations: 


: HCR_EL2.E2H is 1, and CNTVCT_ELO is read from EL2. 
° HCR_EL2.{E2H, TGE} is {1, 1}, and either: 

—  CNTVCT_ELO is read from ELO or EL2. 

—  CNTVCT is read from ELO. 








RW fields in this register reset to architecturally UNKNOWN values. 


CNTVOFF EL2 is a 64-bit register. 


Field descriptions 


The CNTVOFF EL2 bit assignments are: 


63 


Bits [63:0] 


Virtual offset 


Virtual offset. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTVOFF_EL2 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS <Xt>, CNTVOFF_EL2 





op0 op1 CRn CRm op2 


0b11 0b100 0b1110 0b0000 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
return NVMem[0x060] ; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return CNTVOFF_EL2; 
elsif PSTATE.EL == EL3 then 
return CNTVOFF_EL2; 


MSR CNTVOFF_EL2, <Xt> 





op0 op1 CRn CRm op2 





0b11 0b100 0b1110 0b0000 0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then 
NVMem[@x060] = X[t]; 
elsif EL2Enabled() && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x18); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CNTVOFF_EL2 = X[t]; 
elsif PSTATE.EL == EL3 then 
CNTVOFF_EL2 = X[t]; 
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Part E 


The AArch32 Application Level Architecture 


Chapter E1 
The AArch32 Application Level Programmers’ Model 


This chapter gives an Application level description of the programmers’ model for software executing in AArch32 
state. This means it describes execution in ELO when ELO is using AArch32. It contains the following sections: 


. About the Application level programmers’ model on page E1-3782. 

. The Application level programmers’ model in AArch32 state on page E1-3783. 
of Advanced SIMD and floating-point instructions on page E1-3794. 

. About the AArch32 System register interface on page E1-3805. 

° Exceptions on page E1-3806. 
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E1.1 


E1-3782 


About the Application level programmers’ model 


This chapter contains the programmers’ model information required for the development of applications that will 
execute in AArch32 state. 


The information in this chapter is distinct from the system information required to service and support application 
execution under an operating system, or higher level of system software. However, some knowledge of that system 
information is needed to put the Application level programmers' model into context. 


Depending on the implementation, the architecture supports multiple levels of execution privilege. These privilege 
levels are indicated by different Exception levels that number upwards from ELO, where ELO corresponds to the 
lowest privilege level and is often described as unprivileged. The Application level programmers’ model is the 
programmers’ model for software executing at ELO. For more information see Armv8 architectural concepts on 
page A1-38. 


System software determines the Exception level, and therefore the level of privilege, at which application software 
runs. When an operating system supports execution at both EL1 and ELO, an application usually runs unprivileged. 
This has the following effects: 


s It means that the operating system can allocate system resources to an application in a unique or shared 
manner. 
. It provides a degree of protection from other processes, and so helps protect the operating system from 


malfunctioning software. 


This chapter indicates where some System level understanding is helpful, and if appropriate it gives a reference to 
the System level description. 


Application level software is generally unaware of its Security state, and of any virtualization. For more 
information, see The Armv8-A security model on page G1-5477 and The effect of implementing EL2 on the 
Exception model on page G1-5482. 


Note 


$ When an implementation includes EL3, application and operating system software normally executes in 
Non-secure state. 





° Older documentation, describing implementations or architecture versions that support only two privilege 
levels, often refers to execution at EL1 as privileged execution. 


° In this manual, the terms CONSTRAINED UNPREDICTABLE, IMPLEMENTATION DEFINED. 
OPTIONAL, RES0, RES1, UNDEFINED, UNKNOWN, and UNPREDICTABLE have Arm-specific 
meanings, as defined in the Glossary. In body text, these terms are shown in SMALL CAPS, for example 
IMPLEMENTATION DEFINED. 
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E1.2 The Application level programmers’ model in AArch32 state 


The following sections give more information about the Application level programmers’ model in AArch32 state: 
7 Instruction sets, arithmetic operations, and register files. 

à Core data types and arithmetic in AArch32 state. 

° The general-purpose registers, and the PC, in AArch32 state on page E1-3785. 

° Process state, PSTATE on page E1-3787. 

s Jazelle support on page E1-3793. 


E1.2.1 Instruction sets, arithmetic operations, and register files 


The A32 and T32 instruction sets both provide a wide range of integer arithmetic and logical operations, that operate 
on a register file of sixteen 32-bit registers, that are comprised of the AArch32 general-purpose registers and the 
PC. As described in The general-purpose registers, and the PC, in AArch32 state on page E1-3785, these registers 
include the registers SP (R13) and LR (R14), which have specialized uses. Core data types and arithmetic in 
AArch32 state gives more information about these operations. 


In addition, an implementation that implements the T32 and A32 instruction sets includes both: 
s Scalar floating-point instructions. 


. The Advanced SIMD vector instructions. 


Floating-point and vector instructions operate on a separate common register file, described in The SIMD and 


floating-point register file on page E1-3794. Advanced SIMD and floating-point instructions on page E1-3794 gives 


more information about these instructions. 


E1.2.2 Core data types and arithmetic in AArch32 state 
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When executing in AArch32 state, a PE supports the following data types in memory: 


Byte 8 bits. 
Halfword 16 bits. 
Word 32 bits. 


Doubleword 64 bits. 


PE registers are 32 bits in size. The instruction sets provide instructions that use the following data types for data 
held in registers: 


° 32-bit pointers. 
° Unsigned or signed 32-bit integers. 


$ Unsigned 16-bit or 8-bit integers, held in zero-extended form. 
7 Signed 16-bit or 8-bit integers, held in sign-extended form. 

è Two 16-bit integers packed into a register. 

$ Four 8-bit integers packed into a register. 

. Unsigned or signed 64-bit integers held in two registers. 


Load and store operations can transfer bytes, halfwords, or words to and from memory. Loads of bytes or halfwords 
zero-extend or sign-extend the data as it is loaded, as specified in the appropriate load instruction. 


The instruction sets include load and store operations that transfer two or more words to and from memory. Software 
can load and store doublewords using these instructions. 


Note 


For information about the atomicity of memory accesses see Atomicity in the Arm architecture on page E2-3810. 








When any of the data types is described as unsigned, the N-bit data value represents a non-negative integer in the 
range 0 to 2N-1, using normal binary format. 


When any of these types is described as signed, the N-bit data value represents an integer in the range -2(\-) to 
+2(N-1)-1, using two's complement format. 
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E1-3784 


The instructions that operate on packed halfwords or bytes include some multiply instructions that use only one of 
two halfwords, and SIMD instructions that perform parallel addition or subtraction on all of the halfwords or bytes. 


Note 


These SIMD instructions operate on values held in the general-purpose registers, and must not be confused with the 
Advanced SIMD instructions that operate on a separate register file that provides registers of up 128 bits. 








Direct instruction support for 64-bit integers is limited, and most 64-bit operations require sequences of two or more 
instructions to synthesize them. 


Integer arithmetic 


The instruction set provides a wide range of operations on the values in registers, including bitwise logical 
operations, shifts, additions, subtractions, multiplications, and divisions. The pseudocode described in 
Appendix K13 Arm Pseudocode Definition defines these operations, usually in one of three ways: 


° By direct use of the pseudocode operators and built-in functions defined in Operators on page K13-7790. 
° By use of pseudocode helper functions defined in the main text. See Appendix K12 Pseudocode Index. 
s By a sequence of the form: 
l. Use of the SInt(), UInt(), and Int() built-in functions defined in Converting bitstrings to integers on 


page K13-7802 to convert the bitstring contents of the instruction operands to the unbounded integers 
that they represent as two's complement or unsigned integers. 


2. Use of mathematical operators, built-in functions and helper functions on those unbounded integers to 
calculate other such integers. 


3; Use of either the bitstring extraction operator defined in Bitstring concatenation and slicing on 
page K13-7791 or of the saturation helper functions described in Pseudocode description of saturation 
on page E1-3785 to convert an unbounded integer result into a bitstring result that can be written to a 
register. 


Shift and rotate operations 
The following types of shift and rotate operations are used in instructions: 


Logical Shift Left 


The LSL() pseudocode function moves each bit of a bitstring left by a specified number of bits. Zeros 
are shifted in at the right end of the bitstring. Bits that are shifted off the left end of the bitstring are 
discarded, except that the last such bit can be produced as a carry output. 


Logical Shift Right 


The LSR() pseudocode function moves each bit of a bitstring right by a specified number of bits. 
Zeros are shifted in at the left end of the bitstring. Bits that are shifted off the right end of the 
bitstring are discarded, except that the last such bit can be produced as a carry output. 


Arithmetic Shift Right 


The ASR() pseudocode function moves each bit of a bitstring right by a specified number of bits. 
Copies of the leftmost bit are shifted in at the left end of the bitstring. Bits that are shifted off the 
right end of the bitstring are discarded, except that the last such bit can be produced as a carry output. 


Rotate Right The ROR() pseudocode function moves each bit of a bitstring right by a specified number of bits. 
Each bit that is shifted off the right end of the bitstring is re-introduced at the left end. The last bit 
shifted off the right end of the bitstring can be produced as a carry output. 


Rotate Right with Extend 


The RRX() pseudocode function moves each bit of a bitstring right by one bit. A carry input is shifted 
in at the left end of the bitstring. The bit shifted off the right end of the bitstring can be produced as 
a carry output. 
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Pseudocode description of addition and subtraction 


In pseudocode, addition and subtraction can be performed on any combination of unbounded integers and bitstrings, 
provided that if they are performed on two bitstrings, the bitstrings must be identical in length. The result is another 
unbounded integer if both operands are unbounded integers, and a bitstring of the same length as the bitstring 
operand or operands otherwise. For the definition of these operations, see Addition and subtraction on 

page K13-7792. 


The main addition and subtraction instructions can produce status information about both unsigned carry and signed 
overflow conditions. When necessary, multi-word additions and subtractions can be synthesized from this status 
information. In pseudocode the AddwithCarry() function provides an addition with a carry input and a set of output 
Condition flags including carry output and overflow: 


An important property of the AddwithCarry() function is that if: 


(result, nzcv) = AddWithCarry(x, NOT(y), carry_in) 


Then: 
. If carry_in == ‘1’, then result == x-y with: 

— _nzcv<@> == ‘1’ if signed overflow occurred during the subtraction. 

— nzcv<1> == ‘1’ if unsigned borrow did not occur during the subtraction, that is, if xy. 
° If carry_in == ‘0’, then result == x-y-1 with: 

— _ nzcv<@> == ‘1’ if signed overflow occurred during the subtraction. 

— nzcv<l> == ‘1’ if unsigned borrow did not occur during the subtraction, that is, if x>y. 


Taken together, this means that the carry_in and nzcv<1> output in AddwWithCarry() calls can act as NOT borrow flags 
for subtractions as well as carry flags for additions. 


Pseudocode description of saturation 


Some instructions perform saturating arithmetic, that is, if the result of the arithmetic overflows the destination 
signed or unsigned N-bit integer range, the result produced is the largest or smallest value in that range, rather than 
wrapping around modulo 2N. This is supported in pseudocode by: 


° The SignedSatQ() and UnsignedSatQ() functions when an operation requires, in addition to the saturated 
result, a Boolean argument that indicates whether saturation occurred. 


° The SignedSat() and UnsignedSat() functions when only the saturated result is required. 


SatQ(i, N, unsigned) returns either UnsignedSatQ(i, N) or SignedSatQ(i, N) depending on the value of its third 
argument, and Sat(i, N, unsigned) returns either UnsignedSat(i, N) or SignedSat(i, N) depending on the value of 
its third argument. 


The general-purpose registers, and the PC, in AArch32 state 


In the AArch32 Application level view, a PE has: 


s Fifteen general-purpose 32-bit registers, RO to R14, of which R13 and R14 have alternative names reflecting 
how they are, or can be, used: 
— R13 is usually identified as SP. 
— R14 is usually identified as LR. 


e The PC (program counter), that can be described as R15. 
The specialized uses of the SP (R13), LR (R14), and PC (R15) are: 


SP, the stack pointer 
The PE uses SP as a pointer to the active stack. 


In the T32 instruction set, some instructions cannot access SP. Instructions that can access SP can 
use SP as a general-purpose register. 
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E1-3786 


The A32 instruction set provides more general access to SP, and it can be used as a general-purpose 
register. 
Note 


Using SP for any purpose other than as a stack pointer might break the requirements of operating 
systems, debuggers, and other software systems, causing them to malfunction. 








Software can refer to SP as R13. 


LR, the link register 


The link register can be used to hold return link information, and some cases described in this 
manual require this use of the LR. When software does not require the LR for linking, it can use it 
for other purposes. Software can refer to LR as R14. 


PC, the program counter 


s When executing an A32 instruction, PC reads as the address of the current instruction plus 8. 
s When executing a T32 instruction, PC reads as the address of the current instruction plus 4. 
a Writing an address to PC causes a branch to that address. 


Most T32 instructions cannot access PC. 


The A32 instruction set provides more general access to the PC, and many A32 instructions can use 
the PC as a general-purpose register. However, Arm deprecates the use of PC for any purpose other 
than as the program counter. See Writing to the PC for more information. 


Software can refer to PC as R15. 


See AArch32 general-purpose registers, the PC, and the Special-purpose registers on page G1-5489 for the system 
level view of these registers. 


Note 


In general, Arm strongly recommends using the names SP, LR and PC instead of R13, R14 and R15. However, 
sometimes it is simpler to use the R13-R15 names when referring to a group of registers. For example, it is simpler 
to refer to registers R8 to R15, rather than to registers R8 to R12, the SP, LR and PC. These two descriptions of the 
group of registers have exactly the same meaning. 








Writing to the PC 


In the A32 and T32 instruction sets, many data-processing instructions can write to the PC. Writes to the PC are 
handled as follows: 


$ In T32 state, the following 16-bit T32 instruction encodings branch to the value written to the PC: 
— Encoding T2 of ADD, ADDS (register) on page F5-4082. 
— Encoding T1 of MOV, MOVS (register) on page F5-4343. 


The value written to the PC is forced to be halfword-aligned by ignoring its least significant bit, treating that 
bit as being 0. 


. The B, BL, CBNZ, CBZ, CHKA, HB, HBL, HBLP, HBP, TBB, and TBH instructions remain in the same instruction set state 
and branch to the value written to the PC. 


The definition of each of these instructions ensures that the value written to the PC is correctly aligned for 
the current instruction set state. 


s The BLX (immediate) instruction switches between A32 and T32 states and branches to the value written to 
the PC. Its definition ensures that the value written to the PC is correctly aligned for the new instruction set 
state. 

à The following instructions write a value to the PC, treating that value as an interworking address to branch 


to, with low-order bits that determine the new instruction set state: 


— BLX (register), BX, and BXJ. 
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— LDR instructions with <Rt> equal to the PC. 
— POP and all forms of LDM except LDM (exception return), when the register list includes the PC. 


— In A32 state only, ADC, ADD, ADR, AND, ASR (immediate), BIC, EOR, LSL (immediate), LSR (immediate), MOV, 
MVN, ORR, ROR (immediate), RRX, RSB, RSC, SBC, and SUB instructions with <Rd> equal to the PC and without 
flag-setting specified. 

For details of how an interworking address specifies the new instruction set state and instruction address, see 

Pseudocode description of operations on the AArch32 general-purpose registers and the PC. 





Note 
The register-shifted register instructions, that are available only in the A32 instruction set and are 
summarized in Data-processing register (register shift) on page F4-4017, are CONSTRAINED UNPREDICTABLE 
if they attempt to write to the PC, see Using R15 on page K1-7607. 





° Some instructions are treated as exception return instructions, and write both the PC and the CPSR. For more 
information, including which instructions are exception return instructions, see Exception return to an 
Exception level using AArch32 on page G1-5523. 


a Some instructions cause an exception, and the exception handler address is written to the PC as part of the 
exception entry. 


Pseudocode description of operations on the AArch32 general-purpose registers and 
the PC 


In pseudocode, the uses of the R[] function, with an index parameter n, are: 
° Reading or writing RO-R12, SP, and LR, using n = 0-12, 13, and 14 respectively. 
- Reading the PC, using n = 15. 


Pseudocode description of general-purpose register and PC operations on page G1-5491 describes accesses to 
these registers. 


Descriptions of A32 store instructions that store the PC value use the PCStoreValue() pseudocode function to specify 
the PC value stored by the instruction. 


Writing an address to the PC causes either a simple branch to that address or an interworking branch that also selects 
the instruction set to execute after the branch. A simple branch is performed by the BranchWritePC() function. 


An interworking branch is performed by the BXWritePC() function. 


The LoadwWritePC() and ALUWritePC() functions are used for two cases where the behavior was systematically 
modified between architecture versions. 
E1.2.4 Process state, PSTATE 


Process state or PSTATE is an abstraction of process state information. All of the instruction sets provide 
instructions that operate on elements of PSTATE. 


Note 
In this chapter, references to PSTATE link to the more appropriate of: 





7 The Application-level view of PSTATE given in this section. 
a The System-level description in Process state, PSTATE on page G1-5493. 
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The following PSTATE information is accessible at ELO: 


The Condition flags 

Flag-setting instructions set these. They are: 

N Negative Condition flag. If the result of the instruction is regarded as a two's 
complement signed integer, the PE sets this to: 
â 1 if the result is negative. 
od 0 if the result is positive or zero. 

Z Zero Condition flag. Set to: 
s 1 if the result of the instruction is zero. 
s 0 otherwise. 


A result of zero often indicates an equal result from a comparison. 


C Carry Condition flag. Set to: 
° 1 if the instruction results in a carry condition, for example an unsigned overflow 
that is the result of an addition. 
° 0 otherwise. 
v Overflow Condition flag. Set to: 
° 1 if the instruction results in an overflow condition, for example a signed 


overflow that is the result of an addition. 
. 0 otherwise. 


Conditional instructions test the N, Z, C, and V Condition flags, combining them with the Condition 
code for the instruction, to determine whether the instruction must be executed. In this way, 
execution of the instruction is conditional on the result of a previous operation. For more 
information about conditional execution, see Conditional execution on page F2-3909. 


The overflow or saturation flag 


Q Some instructions can set this. For those instructions that can, the PE: 
. Sets it to 1 if the instruction indicates overflow or saturation. 
. Leaves it unchanged otherwise. 


For more information, see Pseudocode description of saturation on page E1-3785. 


The greater than or equal flags 


GE[3:0] The instructions described in Parallel addition and subtraction instructions on 
page F1-3876 update these to indicate the results from individual bytes or halfwords of 
the operation. These flags can control a later SEL instruction. For more information, see 
SEL on page F5-4500. 


PSTATE also contains PE state controls. There is no direct access to these from application level instructions, but 
they can be changed by side-effects of application level instructions. They are: 


Instruction set state 


J, T The current instruction set state, as shown in Table El-1. In Armv8, the J bit is RESO, 
see the Note in this section. 


Table E1-1 PSTATE.{J, T} encoding 





J T Instruction set state 











0 0 432 
0 1 T32 
A32 The PE is executing the A32 instruction set, summarized in Chapter F4 432 
Instruction Set Encoding. 
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The IT block state 
IT[7:0] 


Endianness mapping 
E 


Timing control bits 
DIT 
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T32 The PE is executing the T32 instruction set, summarized in Chapter F3 T32 
Instruction Set Encoding. 


Note 


Encoding with J==1 before Armv8, Jazelle and T32EE states 


In previous versions of the Arm architecture, the encoding {1, 0} selected 
Jazelle state, and encoding {1, 1} selected T32EE state. Armv8 does not 
support either of these states, and these are encodings for unimplemented 
instruction set states, see Unimplemented instruction sets on page G1-5499. 





Armv8 AArch32 state requires a Trivial Jazelle implementation, see Trivial 
implementation of the Jazelle extension on page G1-5499. 





The If-Then controls for the T32 IT instruction, that applies to the /T block of 
instructions that immediately follow the IT instruction. See /7 on page F5-4204 for a 
description of the IT instruction and its associated IT block. 

For more information about the use of PSTATE.IT see Use of PSTATE.IT on 

page E1-3791. 


For data accesses, controls the endianness: 


0 Little-endian. 

1 Big-endian. 

If an implementation does not provide: 

° Big-endian support for data accesses, this bit is RESO. 

s Little-endian support for data accesses, this bit is RES1. 


Instruction fetches are always little-endian, and ignore PSTATE.E. 


Data Independent Timing (DIT) bit. For more information, see About the DIT bit on 
page E1-3793. 


This bit is implemented only when ARMxv8.4-DIT is implemented. 
On a reset to AArch32 state, this bit is set to 0. 


Accessing PSTATE fields at ELO 


The following sections describe which PSTATE fields can be directly accessed at ELO, and how they can be 


accessed: 


° The Application Program Status Register, APSR. 
. The SETEND instruction on page E1-3790. 


The Application Program Status Register, APSR 


At ELO, some PSTATE fields can be accessed using the Special-purpose Application Program Status Register 
(APSR). The APSR can be directly read using the MRS instruction, and directly written using the MSR (register) 
and MSR (immediate) instructions. 
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The APSR bit assignments are: 


31 30 29 28 27 26 2423 20 19 16 15 5 4 3 





a flags RES1 


N, Z, C, V, bits [31:28] 
The PSTATE Condition flags. 


Q, bit [27] The PSTATE overflow or saturation flag. 


Bits[26:24] Reserved, RESO. Software can use MSR instructions that write the top byte of the APSR without using 
a read-modify-write sequence. If it does this, it must write zeros to bits[26:24]. 
Bits[23:20, 15:0] 


Reserved bits that are allocated to system features, or are available for future expansion. 
Unprivileged execution ignores writes to fields that are accessible only at EL1 or higher. However, 
application level software that writes to the APSR must treat reserved bits as Do-Not-Modify 
(DNM) bits. For more information about the reserved bits, see The Current Program Status Register, 
CPSR on page G1-5495. 


These bits are UNKNOWN on a Read, and it is permitted that, on a read of APSR: 
s Bit[22] returns the value of PSTATE.PAN. 

s Bit[9] returns the value of PSTATE.E. 

. Bits[8:6] return the value of PSTATE. {A,LF}, the mask bits. 


à Bits[4:0] return the value of PSTATE.M[4:0]. Bit[4] is RES1 indicating that the PE is in 
AArch32 state. 





Note 


This is an exception to the general rule that an UNKNOWN field must not return information that 
cannot be obtained, at the current Privilege level, by an architected mechanism. 





GE[3:0], bits [19:16] 
The PSTATE greater than or equal flags. 


The other PSTATE fields cannot be accessed by using the APSR. 


The system level alias for the APSR is the CPSR. The CPSR is a superset of the APSR. See The Current Program 
Status Register, CPSR on page G1-5495. 


Writes to the PSTATE fields have side-effects on various aspects of PE operation. All of these side-effects, except 
side-effects on memory accesses associated with fetching instructions, are synchronous to the APSR write. This 
means they are guaranteed: 


. Not to be visible to earlier instructions in the execution stream. 
. To be visible to later instructions in the execution stream. 
The SETEND instruction 


The A32 and T32 instruction sets both include an instruction to manipulate PSTATE.E: 
SETEND BE Sets PSTATE.E to 1, for big-endian operation. 
SETEND LE Sets PSTATE.E to 0, for little-endian operation. 


The SETEND instruction is unconditional. For more information, see SETEND on page F5-4502. Arm deprecates use 
of the SETEND instruction. 
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Use of PSTATE.IT 


PSTATE.IT provides the If-Then controls for the T32 IT instruction, that applies to the /T block of instructions that 
immediately follow the IT instruction. 


PSTATE.IT divides into two subfields: 


IT[7:5] Holds the base condition for the current IT block. The base condition is the top three bits of the 
Condition code specified by the <firstcond> field of the IT instruction. 

IT[4:0] Encodes: 
° Implicitly, the size of the IT block. This is the number of instructions that are to be 


conditionally executed. The size of the block is indicated by the position of the least 
significant 1 in this field, as shown in Table E1-2. 


$ For each instruction in the IT block, the least significant bit of the Condition code. This is 
encoded in the IT block entries that Table E1-2 shows as Nx. 
Note 


Changing the least significant bit of a Condition code from 0 to 1 has the effect of inverting 
the Condition code. 








Both subfields are all zeros when no IT block is active. 


When an IT instruction is executed, PSTATE.IT is set according to the <firstcond> field of the instruction and the 
Then and Else (T and E) parameters in the instruction, see ZT on page F5-4204. This means that, on executing an IT 
instruction, the initial state of PSTATE.IT depends on the number of instructions in the IT block, as Table E1-2 

















shows: 
Table E1-2 Initial state of PSTATE.IT on executing an IT instruction 
PSTATE.IT bits 
Number of instructions in IT block Notes 
[7:5] [4] [3] [2] [1] [0] 
4 cond base NI N2 N3 N4 1 - 
3 cond base NI N2 N3 1 0 - 
2 cond base NI N2 1 0 0 - 
1 cond base NI 1 0 0 0 - 
Not executing an IT instruction 000 0 0 0 0 0 No IT block is active 





a. Combinations of the IT bits not shown in this table are reserved. 


In Table El-2, N1 refers to the first instruction in the IT block, and N2, N3, and N4 refer to the second, third, and 
fourth instructions in the IT block if they are present, 


When permitted, an instruction in an IT block is conditional, see Conditional instructions on page F1-3867 and 
Conditional execution on page F2-3909. The Condition code used is the current value of IT[7:4]. When an 
instruction in an IT block completes its execution normally, PSTATE.IT[4:0] is left-shifted by one bit, so that 
PSTATE[4] always relates to the next instruction to be executed. Table E1-3 on page E1-3792 shows how 
PSTATE.IT during the execution of an IT instruction with four instructions in the IT block. 
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Table E1-3 Updates to PSTATE.IT when executing an IT instruction with a four-instruction IT 




















block 
PSTATE.IT bits 
IT block instruction being executed Notes 
[7:5] [4] [3] [2] [1] [0] 
First cond base NI N2 N3 N4 1 - 
Second cond base N2 N3 N4 1 0 - 
Third cond base N3 N4 1 0 0 - 
Fourth cond base N4 1 0 0 0 - 
Not executing an IT instruction 000 0 0 0 0 0 No IT block is active 





A few instructions, for example BKPT, cannot be conditional and therefore are always executed ignoring the current 
value of PSTATE.IT. 


For details of what happens if an instruction in an IT block takes an exception, see Overview of exception entry on 
page G1-5508. 


An instruction that might complete its normal execution by branching is only permitted in an IT block as the last 
instruction in the block. This means that normal execution of the instruction always results in PSTATE.IT advancing 
to execution where no IT block is active. 


For performance reasons, Armv8 deprecates the use of IT other than with a single 16-bit T32 instruction from a 
specified subset of the 16-bit T32 instructions, see Partial deprecation of IT on page F1-3884. In addition, 
implementations can provide a set of ITD control fields, SCTLR.ITD, SCTLR_EL1.ITD, and HSCTLR.ITD, to 
disable these deprecated uses, making them UNDEFINED. When an implementation includes ITD control fields, 
Changes to an ITD control by an instruction in an IT block describes the permitted CONSTRAINED UNPREDICTABLE 
behaviors if an instruction in an IT block changes the value of an ITD control to disable the use of the IT instruction. 


On a branch or an exception return, if PSTATE.IT is set to a value that is not consistent with the instruction stream 
being branched to or returned to, then instruction execution is CONSTRAINED UNPREDICTABLE. 


PSTATE.IT affects instruction execution only in T32 state. In A32 state, PSTATE.IT must be 0b00000000, otherwise 
the behavior is CONSTRAINED UNPREDICTABLE. 


For more information see CONSTRAINED UNPREDICTABLE behavior associated with IT instructions and 
PSTATE_IT on page K1-7608. 


Changes to an ITD control by an instruction in an IT block 


In an implementation that includes SCTLR.ITD, SCTLR_EL1.ITD, and HSCTLR.ITD controls, if an instruction in 
an IT block changes an ITD control so that the IT instruction using the IT block would be disabled, then one of the 
following behaviors applies: 


à The change to the ITD field, once synchronized, has no effect on the execution of instructions in the current 
IT block, but applies only to any subsequent execution of an IT instruction to which the control applies. 


à Synchronizing the change to the ITD field guarantees that all bits of PSTATE.IT are cleared to 0. 


In addition, after the change to the ITD field has been synchronized, any remaining instructions in the IT block that 
would be made UNDEFINED by the new value of ITD are either: 


$ Executed normally. 
° Treated as UNDEFINED. 


The choice between the options described in this section is determined by the implementation, and any choice can 
vary between different changes to an ITD control by an instruction in an IT block. 
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Pseudocode description of PSTATE PE state fields 


The pseudocode function CurrentInstrSet() returns the current instruction set. The pseudocode function 
SelectInstrSet() selects a new instruction set. 


PSTATE.IT advances after normal execution of an IT block instruction. This is described by the 
AArch32.1TAdvance() pseudocode function. 


The pseudocode function InITBlock() tests whether the current instruction is in an IT block. The pseudocode 
function LastInITBlock() tests whether the current instruction is the last instruction in an IT block. 


The BigEndian() pseudocode function tests whether big-endian data memory accesses are currently selected. 


E1.2.5 About the DIT bit 


When the value of CPSR.DIT is 1: 


e The instructions listed in CPSR are required to have; 


— Timing which is independent of the values of the data supplied in any of its registers, and the values 
of the NZCV flags. 


— Responses to asynchronous exceptions which do not vary based on the values supplied in any of their 
registers, or the values of the NZCV flags. 


° All loads and stores have their timing insensitive to the value of the data being loaded or stored. 


Note 


When the value of CPSR.DIT is 0, the architecture makes no statement about the timing properties of any 
instructions. 








A corresponding DIT bit is added to PSTATE in AArch64 state, and to CPSR in AArch32 state. 

When an exception is taken from AArch32 state to AArch32 state, CPSR.DIT is copied to SPSR.DIT. 
When an exception is taken from AArch32 state to AArch64 state, CPSR.DIT is copied to SPSR_ELx.DIT. 
When an exception returns to AArch32 state from AArch32 state, SPSR.DIT is copied to CPSR.DIT. 
When an exception returns to AArch32 state from AArch64 state, SPSR_ELx.DIT is copied to CPSR.DIT. 


CPSR.DIT bit can be written using an MSR instruction at any exception level in AArch32 state, and read using an MRS 
instruction at any exception level. 


E1.2.6 Jazelle support 
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Armv§8 requires AArch32 state to include a trivial implementation of the Jazelle extension, as described in Trivial 
implementation of the Jazelle extension on page G1-5499. 
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E1.3 Advanced SIMD and floating-point instructions 


In general, Armv8 requires implementation of Advanced SIMD and floating-point instructions in the T32 and A32 
instruction sets, but see Jmplications of not including Advanced SIMD and floating-point support on page E1-3800. 


The Advanced SIMD instructions perform packed Single Instruction Multiple Data (SIMD) operations, either 
integer or single-precision floating-point. The floating-point instructions perform single-precision or 
double-precision scalar floating-point operations. When ARMv8.2-FP16 is implemented, half-precision 
floating-point can also be used for data processing. 


These instructions permit floating-point exceptions, such as Overflow or Divide by Zero, to be handled without 
trapping. When handled in this way, a floating-point exception causes a cumulative status register bit to be set to 1 
and a default result to be produced by the operation. Armv8 also optionally supports the trapping of floating-point 
exceptions, see Floating-point exceptions and exception traps on page G1-5574. For more information about 
floating-point exceptions see Floating-point exceptions and exception traps on page E1-3797. 


The Advanced SIMD and floating-point instructions also provide the following conversion functions: 
7 Between half-precision floating-point and single-precision floating point, in both directions. 
è From double-precision, floating point to a signed single precision integer. 


Some Advanced SIMD instructions support polynomial arithmetic over {0, 1}, as described in Polynomial 
arithmetic over {0, 1} on page A1-50. 


For system level information about the Advanced SIMD and Floating-point implementation see Advanced SIMD 
and floating-point support on page G1-5570. 


The following sections give more information about the Advanced SIMD and floating-point instructions: 

. Floating-point standards, and terminology on page A1-53. 

. The SIMD and floating-point register file. 

. Data types supported by the Advanced SIMD implementation on page E1-3796. 

. Advanced SIMD and floating-point System registers on page E1-3796. 

. Floating-point data types and arithmetic on page E1-3796. 

° Floating-point exceptions and exception traps on page E1-3797. 

$ Controls of Advanced SIMD operation that do not apply to floating-point operation on page E1-3800. 
° Implications of not including Advanced SIMD and floating-point support on page E1-3800. 

$ Pseudocode description of floating-point operations on page E1-3800. 


E1.3.1 The SIMD and floating-point register file 


The Advanced SIMD and floating-point instructions use the same register file, that comprises 32 registers. This is 
distinct from the register file that holds the general-purpose registers and the PC. 


The Advanced SIMD and floating-point views of the register file are different. The following sections describe these 
different views. Figure E1-1 on page E1-3795 shows the views of the register file, and the way the word, 
doubleword, and quadword registers overlap. 


Advanced SIMD views of the register file 


Advanced SIMD can view this register file as: 
° Sixteen 128-bit quadword registers, Q0-Q15. 
° Thirty-two 64-bit doubleword registers, D0-D31. 


These views can be used simultaneously. For example, a program might hold 64-bit vectors in D@ and D1 and a 
128-bit vector in Q1. 
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Floating-point views of the register file 


The Advanced SIMD and floating-point register file consists of thirty-two doubleword registers, that can be viewed 
as: 


$ Thirty-two 64-bit doubleword registers, D0-D31. This view is also available to Advanced SIMD instructions. 
° Thirty-two 32-bit single word registers, S0-S31. Only half of the set is accessible in this view. 


Note 


In AArch32 state, half-precision floating point values are always represented using the bottom 16 bits of a single 
word register, S0-S31. When a half-precision value is written to a single word register, the top 16 bits of that register 
are set to 0. 








The two views can be used simultaneously. 


SIMD and Floating-point register file mapping onto registers 


Figure El-1 shows the different views of the SIMD and floating-point register file, and the relationship between 
them. 
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Figure E1-1 SIMD and floating-point register file, AArch32 operation 


The mapping between the registers is as follows: 


$ S<2n> maps to the least significant half of D<n>. 
S<2n+1> maps to the most significant half of D<n>. 
. D<2n> maps to the least significant half of Q<n>. 
7 D<2n+1> maps to the most significant half of Q<n>. 
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E1.3.2 


E1.3.3 


E1.3.4 


E1-3796 


For example, software can access the least significant half of the elements of a vector in Q6 by referring to D12, and 
the most significant half of the elements by referring to D13. 


Pseudocode description of the SIMD and Floating-point register file 


The functions _Dclone, S[], and D[] provide the S@-S31, D0-D31, and Q0-Q15 views of the Advanced SIMD and 
floating-point registers: 


The Din[] function returns a Doubleword register from the _Dclone[] copy of the SIMD and Floating-point register 
file, and the Qin[] function returns a Quadword register from that register file. 


Note 


The CheckAdvSIMDEnabled() function copies the D[] register file to _Dclone[], see Pseudocode description of 
enabling SIMD and floating-point functionality on page G1-5609. 








Data types supported by the Advanced SIMD implementation 


Advanced SIMD instructions can operate on integer and floating-point data, and the implementation defines a set 
of data types that support the required data formats. Vector formats in AArch32 state on page A1-43 describes these 
formats. 


Advanced SIMD vectors 


In an implementation that includes support for Advanced SIMD operation, a register can hold one or more packed 
elements, all of the same size and type. The combination of a register and a data type describes a vector of elements. 
The vector is considered to be an array of elements of the data type specified in the instruction. The number of 
elements in the vector is implied by the size of the data elements and the size of the register. 


Vector indices are in the range 0 to (number of elements — 1). An index of 0 refers to the least significant end of the 
vector. In Vector formats in AArch32 state on page A1-43, Figure Al-3 on page A1-45 shows the Advanced SIMD 
vector formats. 


Pseudocode description of Advanced SIMD vectors 


The pseudocode function Elem[] accesses the element of a specified index and size in a vector. 


Advanced SIMD and floating-point System registers 


The Advanced SIMD and floating-point instructions have a shared register space for System registers. The only 
register in this space that is accessible at the Application level is the FPSCR. 


Writes to the FPSCR can have side-effects on various aspects of PE operation. All of these side-effects are 
synchronous to the FPSCR write. This means they are guaranteed not to be visible to earlier instructions in the 
execution stream, and they are guaranteed to be visible to later instructions in the execution stream. 


See Advanced SIMD and floating-point System registers on page G1-5572 for the system level view of the registers. 


These registers can be described as the SIMD and floating-point System registers. 


Floating-point data types and arithmetic 


The T32 and A32 floating-point instructions support single-precision (32-bit) and double-precision (64-bit) data 
types and arithmetic as defined by the IEEE 754 floating-point standard. They also support the half-precision 
(16-bit) floating-point data type for data storage, by supporting conversions between single-precision and 
half-precision data types. When ARMv8.2-FP 16 is implemented, it also supports the half-precision floating-point 
data type for data processing operations. 


Arm standard floating-point arithmetic means IEEE 754 floating-point arithmetic with the restrictions described in 
Advanced SIMD and floating-point support on page A1-51, including supporting only the input and output values 
described in Arm standard floating-point input and output values on page A1-53. 
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The AArch32 Advanced SIMD instructions support only single-precision and, when ARMv8.2-FP 16 is 
implemented, half-precision Arm standard floating-point arithmetic. 


The following sections describe the Advanced SIMD and floating-point formats: 
. Half-precision floating-point formats on page A1-45. 

s Single-precision floating-point format on page A1-47. 

s Double-precision floating-point format on page A1-48. 


The following sections describe features of Advanced SIMD and floating-point processing: 
à Flush-to-zero on page A1-54. 
. NaN handling and the Default NaN on page A1-55. 


E1.3.5 Floating-point exceptions and exception traps 


Arm Advanced SIMD and floating-point instructions record the following floating-point exceptions in the FPSCR 
cumulative bits, unless the floating-point exception is trapped and generates an exception: 


FPSCR.IOC Invalid Operation. The bitis set to 1 ifthe result of an operation has no mathematical value or cannot 
be represented. Cases include, for example: 
$ (infinity) x 0. 
. (+infinity) + (—infinity). 


These tests are made after flush-to-zero processing. For example, if flush-to-zero mode is selected, 
multiplying a denormalized number and an infinity is treated as (0 x infinity), and causes an Invalid 
Operation floating-point exception. 


IOC is also set on any floating-point operation with one or more signaling NaNs as operands, except 
for negation and absolute value, as described in Floating-point negation and absolute value on 
page E1-3801. 


FPSCR.DZC Divide by Zero. The bit is set to 1 if a divide operation has a zero divisor and a dividend that is not 
zero, an infinity or a NaN. These tests are made after flush-to-zero processing, so if flush-to-zero 
processing is selected, a denormalized dividend is treated as zero and prevents Divide by Zero from 
occurring, and a denormalized divisor is treated as zero and causes Divide by Zero to occur if the 
dividend is a normalized number. 


For the reciprocal and reciprocal square root estimate functions the dividend is assumed to be +1.0. 
This means that a zero or denormalized operand to these functions sets the DZC bit. 


FPSCR.OFC Overflow. The bit is set to 1 if the absolute value of the result of an operation, produced after 
rounding, is greater than the maximum positive normalized number for the destination precision. 


FPSCR.UFC Underflow. The bit is set to 1 if the absolute value of the result of an operation, produced before 
rounding, is less than the minimum positive normalized number for the destination precision, and 
the rounded result is inexact. 


The criteria for the Underflow floating-point exception to occur are different in Flush-to-zero mode. 
For details, see Flush-to-zero on page A1-54. 


FPSCR.IXC Inexact. The bit is set to 1 if the result of an operation is not equivalent to the value that would be 
produced if the operation were performed with unbounded precision and exponent range. 


The criteria for the Inexact floating-point exception to occur are different in Flush-to-zero mode. 
For details, see F/ush-to-zero on page A1-54. 


FPSCR.IDC Input Denormal. The bit is set to 1 if a denormalized input operand is replaced in the computation 
by a zero, as described in Flush-to-zero on page A1-54. 


For Advanced SIMD instructions, and for floating-point instructions when floating-point exception trapping is not 
supported, these are non-trapping exceptions and the data-processing instructions do not generate any trapped 
exceptions. 
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For floating-point instructions when floating-point exception trapping is supported: 


The floating-point exceptions can be trapped, by setting trap enable bits in the FPSCR, see Floating-point 
exceptions and exception traps on page G1-5574, and: 


— When a trap is not enabled the corresponding floating-point exception updates the corresponding 
FPSCR cumulative bit does not generate an exception. 


— Whena trap is enabled the corresponding floating-point exception does not update the FPSCR, but 
generates an exception. In this case, bits in the FPEXC indicate which floating-point exceptions have 
occurred. 


The definition of the Underflow floating-point exception is different in the trapped and cumulative exception 
cases. In the trapped case the definition is: 


— The trapped Underflow floating-point exception occurs if the absolute value of the result of an 
operation, produced before rounding, is less than the minimum positive normalized number for the 
destination precision, regardless of whether the rounded result is inexact. 


As with cumulative exceptions, higher priority trapped exceptions can prevent lower priority exceptions from 
occurring, as described in Combinations of floating-point exceptions. 


For Invalid Operation floating-point exceptions, for details of which quiet NaN is produced as the default 
result see NaN handling and the Default NaN on page A1-55. 


For Overflow floating-point exceptions, the sign bit of the default result is determined normally for the 
overflowing operation. 


For Divide by Zero floating-point exceptions, the sign bit of the default result is determined normally for a 
division. This means it is the exclusive OR of the sign bits of the two operands. 


Table E1-4 shows the results of untrapped floating-point exceptions. That table uses the following abbreviations: 


MaxNorm The maximum normalized number of the destination precision. 


RM 
RN 
RP 
RZ 


Round towards Minus Infinity mode, as defined in the IEEE 754 standard. 
Round to Nearest mode, as defined in the IEEE 754 standard. 

Round towards Plus Infinity mode, as defined in the IEEE 754 standard. 
Round towards Zero mode, as defined in the IEEE 754 standard. 


For more information about the IEEE 754 descriptions of the rounding modes see Floating-point standards, and 
terminology on page A1-53. 


Table E1-4 Results of untrapped floating-point exceptions 























Exception type Default result for positive sign Default result for negative sign 
IOC, Invalid Operation Quiet NaN Quiet NaN 
DZC, Divide by Zero +infinity -infinity 
OFC, Overflow RN, RP: +infinity RN, RM: -infinity 
RM, RZ: +MaxNorm RP, RZ: -MaxNorm 
UFC, Underflow Normal rounded result Normal rounded result 
IXC, Inexact Normal rounded result Normal rounded result 
IDC, Input Denormal Normal rounded result Normal rounded result 


Combinations of floating-point exceptions 


Many pseudocode functions perform floating-point operations, including FixedToFP(), FPAdd(), FPCompare(), 
FPCompareEQ(), FPCompareGE(), FPCompareGT(), FPDiv(), FPMax(), FPMin(), FPMul(), FPMulAdd(), FPRecipEstimate(), 
FPRecipStep(), FPRSqrtEstimate(), FPRSqrtStep(), FPSqrt(), FPSub(), and FPToFixed(). All of these operations can 
generate floating-point exceptions. 
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Note 
FPAbs() and FPNeg() are not classified as floating-point operations because: 
s They cannot generate floating-point exceptions. 
° The floating-point operation behavior described in the following sections does not apply to them: 


— Flush-to-zero on page A1-54. 
— NaN handling and the Default NaN on page A1-55. 





More than one exception can occur on the same operation. The only combinations of floating-point exceptions that 
can occur are: 


s Overflow with Inexact. 
2 Underflow with Inexact. 
š Input Denormal with other floating-point exceptions. 


The priority order of these floating-point exceptions is that the Inexact exception is treated as lowest priority, and 
the Input Denormal exception is treated as highest priority. 


When none of the floating-point exceptions caused by an operation is trapped, any floating-point exception that 
occurs causes the associated cumulative bit in the FPSCR to be set. 


When one or more floating-point exceptions caused by an operation is trapped, the behavior of the instruction 
depends on the priority of the exceptions: 


è If the higher priority floating-point exception is trapped, its trap handler is called. It is IMPLEMENTATION 
DEFINED whether any information about the lower priority floating-point exception is provided. 





Note 
Information about the lower priority floating-point exception might be provided in: 


— The FPEXC, if the exception generated by the trap is taken to an Exception level that is using 
AArch32. 


— The ESR_ELx.ISS field, if the exception generated by the trap is taken to an Exception level that is 
using AArch64. 


However, information might be provided in another IMPLEMENTATION DEFINED way, for example using an 
IMPLEMENTATION DEFINED register. 





Apart from this, the lower priority floating-point exception is ignored in this case. 


. If the higher priority floating-point exception is untrapped, its cumulative bit is set to 1 and its default result 
is evaluated. Then the lower priority floating-point exception is handled normally, using this default result. 


Some floating-point instructions specify more than one floating-point operation, as indicated by the pseudocode 
descriptions of the instruction. In such cases, a floating-point exception on one operation is treated as higher priority 
than a floating-point exception on another operation if the occurrence of the second floating-point exception 
depends on the result of the first operation. Otherwise, it is CONSTRAINED UNPREDICTABLE which floating-point 
exception is treated as higher priority. 


For example, a VMLA.F32 instruction specifies a floating-point multiplication followed by a floating-point addition. 
The addition can generate Overflow, Underflow and Inexact floating-point exceptions, all of which depend on both 
operands to the addition and so are treated as lower priority than any floating-point exception on the multiplication. 
The same applies to Invalid Operation floating-point exceptions on the addition caused by adding opposite-signed 
infinities. The addition can also generate an Input Denormal floating-point exception, caused by the addend being 
a denormalized number while in Flush-to-zero mode. It is CONSTRAINED UNPREDICTABLE which of an Input 
Denormal floating-point exception on the addition and a floating-point exception on the multiplication is treated as 
higher priority, because the occurrence of the Input Denormal floating-point exception does not depend on the result 
of the multiplication. The same applies to an Invalid Operation floating-point exception on the addition caused by 
the addend being a signaling NaN. 
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Note 


The VFMA instruction performs a vector addition and a vector multiplication as a single operation. The VFMS 
instruction performs a vector subtraction and a vector multiplication as a single operation. 





E1.3.6 Controls of Advanced SIMD operation that do not apply to floating-point operation 


Armv7 permitted implementation of either, both, or neither of the Advanced SIMD and floating-point additions to 
the base instruction set, and provided some controls that applied to the Advanced SIMD functionality but not to the 
floating-point functionality. In Armv8, Advanced SIMD functionality cannot be separated from floating-point 
functionality, but in AArch32 state these controls function as they did in Armv7. This means they apply only to the 
following instructions and instruction encodings: 


s All instructions with encodings defined in: 
— Advanced SIMD data-processing on page F3-3962, for the T32 instruction set. 
— Advanced SIMD data-processing on page F4-4049, for the A32 instruction set. 


à All instructions with encodings defined in: 
— Advanced SIMD element or structure load/store on page F3-3985, for the T32 instruction set. 
— Advanced SIMD element or structure load/store on page F4-4061, for the A32 instruction set. 


à The form of the VDUP instruction described in VDUP (general-purpose register) on page F6-4971. 


. The byte and halfword forms of the VMOV instructions described in each of: 
= VMOV (general-purpose register to scalar) on page F6-5141. 
= VMOV (scalar to general-purpose register) on page F6-5145. 


The controls of this functionality are: 
° The CPACR.ASEDIS field. 
. The HCPTR.TASE field. 


In an implementation that supports Advanced SIMD functionality, support for each of these controls is optional: 


7 If the CPACR.ASEDIS control is not supported then the CPACR.ASEDIS field is RAZ/WI. This is 
equivalent to the control permitting the execution of Advanced SIMD instructions at EL1 and ELO. 


° If the HCPTR.TASE control is not supported then the HCPTR.TASE field is RAZ/WI. This means the 
HCPTR does not provide a control that can trap Non-secure execution of Advanced SIMD instructions to 
Hyp mode. 


E1.3.7 Implications of not including Advanced SIMD and floating-point support 


In general, Armv8 requires the inclusion of the Advanced SIMD and floating-point instructions in all instruction 
sets. Exceptionally, for implementation targeting specialized markets, Arm might produce or license an Armv8-A 
implementation that does not provide any support for Advanced SIMD and floating-point instructions. In such an 
implementation, in AArch32 state: 


7 Each of the CPACR. {cp10, cp11} fields is RESO. 

° The CPACR.ASEDIS bit is RESO. 

° Each of the HCPTR. {TASE, TCP10, TCP11} fields is RES1. 

° Each of the NSACR.{NSASEDIS, cp10, cp11} fields is RESO. 
° The FPEXC register is UNDEFINED. 


E1.3.8 Pseudocode description of floating-point operations 


The following subsections contain pseudocode definitions of the floating-point functionality supported by the 
Armyv8 architecture: 


è Generation of specific floating-point values on page E1-3801. 
$ Floating-point negation and absolute value on page E1-3801. 
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. Floating-point value unpacking. 

. Floating-point exception and NaN handling. 

. Floating-point rounding. 

. Selection of Arm standard floating-point arithmetic on page E1-3802. 
s Floating-point comparisons on page E1-3802. 

. Floating-point maximum and minimum on page E1-3802. 

. Floating-point addition and subtraction on page E1-3802. 

. Floating-point multiplication and division on page E1-3802. 

. Floating-point fused multiply-add on page E1-3802. 

$ Floating-point reciprocal estimate and step on page E1-3802. 

° Floating-point square root on page E1-3803. 

. Floating-point reciprocal square root estimate and step on page E1-3803. 
° Floating-point conversions on page E1-3804. 


Generation of specific floating-point values 


The following pseudocode functions generate specific floating-point values. The sign argument is '0' for the 
positive version and '1' for the negative version: 


. FPInfinity(). 

. FPMaxNormal(). 
. FPZero(). 

. FPTwo(). 

. FPThree(). 

. FPDefaultNaN(). 


Floating-point negation and absolute value 


The floating-point negation and absolute value operations only affect the sign bit. They do not treat NaN operands 
specially, nor denormalized number operands when flush-to-zero is selected. 


The floating-point negation operation is described by the pseudocode function FPNeg(). The floating-point absolute 
value operation is described by the pseudocode function FPAbs(). 


Floating-point value unpacking 


The FPUnpack() function determines the type of a floating-point number, defined by FPType{}, and its numerical 
value. It also does flush-to-zero processing on input operands. 


Floating-point exception and NaN handling 


The FPProcessException() procedure checks whether a floating-point exception is trapped, and handles it 
accordingly. The floating-point exception types are defined by FPExc{}. 


The FPProcessNaN() function processes a NaN operand, producing the correct result value and generating an Invalid 
Operation floating-point exception if necessary. The FPProcessNaNs() function performs the standard NaN 
processing for a two-operand operation. The FPProcessNaNs3() function performs the standard NaN processing for 
a three-operand operation. 


Floating-point rounding 


The FPRound() function rounds and encodes a floating-point result to a specified destination format. This includes 
processing Overflow, Underflow and Inexact floating-point exceptions and performing flush-to-zero processing on 
result values. 
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Selection of Arm standard floating-point arithmetic 


The StandardFPSCRValue() function returns the FPSCR value that selects Arm standard floating-point arithmetic. 
Most of the arithmetic functions have a Boolean fpscr_controlled argument that is TRUE for Floating-point 
operations and FALSE for Advanced SIMD operations, and that selects between using the real FPSCR value and this 
value. 


Floating-point comparisons 


The FPCompare() function compares two floating-point numbers, producing a {N, Z, C, V} Condition flags result as 
shown in Table E1-5: 


Table E1-5 Effect of a Floating-point comparison on the Condition flags 





Comparison resut N Z C V 














Equal 0 1 1 0 
Less than 1 0 0 0 
Greater than 0 0 1 0 
Unordered 0 0 1 1 





This result defines the operation of the VCMP floating-point instruction. The VCMP instruction writes these flag values 
in the FPSCR. After using a VMRS instruction to transfer them to the APSR, they can control conditional execution 
as shown in Table F2-1 on page F2-3909. 


The FPCompareEQ(), FPCompareGE(), and FPCompareGT() functions describe the operation of Advanced SIMD 
instructions that perform floating-point comparisons. 


Floating-point maximum and minimum 


The FPMax() function returns the maximum of two floating-point numbers. The FPMin() function returns the 
minimum of two floating-point numbers. 


Floating-point addition and subtraction 


The FPAdd() function adds two floating-point numbers. The FPSub() function subtracts one floating-point number 
from another floating-point number. 


Floating-point multiplication and division 


The FPMul() function multiplies two floating-point numbers. The FPDiv() function divides one floating-point 
number by another floating-point number. 


Floating-point fused multiply-add 


The FPMulAdd() function performs a floating-point fused multiply-add. 


Floating-point reciprocal estimate and step 


The Advanced SIMD implementation includes instructions that support Newton-Raphson calculation of the 
reciprocal of a number. 


The VRECPE instruction produces the initial estimate of the reciprocal. It uses the pseudocode functions: 


. FPRecipEstimate(). 
. UnsignedRecipEstimate(). 
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Table E1-6 shows the results where input values are out of range. 


Table E1-6 VRECPE results for out of range inputs 


























Number type Input Vii] Result Vd[i] 
Integer <= Qx7FFFFFFF OxFFFFFFFF 
Floating-point NaN Default NaN 
Floating-point 0 ordenormalized number infinity è 
Floating-point +infinity +0 
Floating-point Absolute value >= 2!26 +0 





a. FPSCR.DZC is set to 1 


The Newton-Raphson iteration: 
Xml = Xn(2-dXxn) 
converges to (1/d) if xo is the result of VRECPE applied to d. 


The VRECPS instruction performs a (2 - opl xop2) calculation and can be used with a multiplication to perform a step 
of this iteration. The functionality of this instruction is defined by the FPRecipStep() pseudocode function. 


Table E1-7 shows the results where input values are out of range. 


Table E1-7 VRECPS results for out of range inputs 























Input Vn{[i] Input Vim[i] Result Vd[i] 
Any NaN - Default NaN 
- Any NaN Default NaN 
+0.0 or denormalized number infinity 2.0 

+infinity +0.0 or denormalized number 2.0 


Floating-point square root 


The FPSqrt() function returns the square root of a floating-point number. 


Floating-point reciprocal square root estimate and step 


The Advanced SIMD implementation includes instructions that support Newton-Raphson calculation of the 
reciprocal of the square root of a number. 


The VRSQRTE instruction produces the initial estimate of the reciprocal of the square root. It uses the pseudocode 


functions: 
. FPRSqrtEstimate(). 
° UnsignedRSqrtEstimate(). 
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Table E1-8 shows the results where input values are out of range. 


Table E1-8 VRSQRTE results for out of range inputs 





Number type Input Vm{[i] Result Vd[i] 





Integer <= 0x3FFFFFFF OxFFFFFFFF 





Floating-point NaN, —(normalized number), —-infinity Default NaN 











Floating-point —0 or -(denormalized number) — infinity è 
Floating-point +0 or +(denormalized number) +infinity è 
Floating-point +infinity +0 











a. FPSCR.DZC is set to 1. 


The Newton-Raphson iteration: 
Xm = Xn(3-dXn?)/2 
converges to (1/Vd) if xo is the result of VRSQRTE applied to d. 


The VRSQRTS instruction performs a (3 — op1 xop2)/2 calculation and can be used with two multiplications to perform 
a step of this iteration. The functionality of this instruction is defined by the FPRSqrtStep() pseudocode function. 


Table E1-9 shows the results where input values are out of range. 


Table E1-9 VRSQRTS results for out of range inputs 























Input Vn{i] Input Vim[i] Result Vd[i] 
Any NaN - Default NaN 
- Any NaN Default NaN 
+0.0 or denormalized number infinity 1.5 

+infinity +0.0 or denormalized number 1.5 





FPRSqrtStep() calls the FPHalvedSub() pseudocode function. 


Floating-point conversions 


The FPConvert() pseudocode function performs conversions between half-precision, single-precision, and 
double-precision floating-point numbers. 


The FPToFixed() and FixedToFP() functions perform conversions between floating-point numbers and integers or 
fixed-point numbers. 
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AArch32 state provides a System register encoding space, that is indexed by the parameter set {coproc, opcl, CRn, 
CRm, opc2}, and a set of System register access instructions. This encoding space is used for: 


s System registers. 

° System instructions, for: 
— Cache and branch predictor maintenance. 
— Address translation. 


— TLB maintenance. 
In Armv8, this encoding space uses only the coproc values 0b111x. 


Note 


The encoding space with coproc values 0b101x is redefined to provide Advanced SIMD and floating-point 
functionality. 








In Armvs: 


. The (coproc==0b1111) encodings provide system control functionality, by providing access to System 
registers and System instructions. This includes architecture and feature identification, as well as control, 
status information and configuration support. 

The following sections give a general description of these encodings: 

— About the System registers for VMSAv8-32 on page G5-5850. 

— VMSAv8-32 organization of registers in the (coproc==0b1111) encoding space on page G7-5874. 

— Functional grouping of VMUSAv8-32 System registers on page G5-5856. 

These encodings also provide: 

— The Performance Monitor registers. For more information, see Chapter D7 The Performance Monitors 
Extension. 


The Activity Monitor registers. For more information, see Chapter D8 The Activity Monitors 
Extension. 


e The (coproc==0b1110) encodings provide access to additional registers, that support: 
— Debug, see Chapter G2 AArch32 Self-hosted Debug. 
— The Jazelle identification registers, see Jazelle support on page E1-3793. 


UNPREDICTABLE, CONSTRAINED UNPREDICTABLE, and UNDEFINED behavior for AArch32 System 
register accesses on page G8-5893 gives information more information about permitted accesses to the System 
registers in AArch32 state. 


Most functionality in the (coproc==0b111x) encoding space cannot be accessed by software executing at ELO. This 
manual clearly identifies those functions that can be accessed at ELO. 


For more information: 


è About this encoding space, including the naming of the parameters that index the space, see The AArch32 
System register interface on page G1-5567. 


7 About the System interface access instructions, see System register access instructions on page F1-3887. 
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E1.5 Exceptions 


The Arm architecture uses the following terms to describe various types of exceptional condition: 


Exceptions 


In the Arm architecture, an exception causes entry to EL1, EL2, or EL3. If the Exception level that 
is entered is using AArch32, it also causes entry to the PE mode in which the exception must be 
taken. A software handler for the exception is then executed. 


— Note 


The term floating-point exception does not use this meaning of exception. This term is described 
later in this list. 





Exceptions include: 


è Reset. 

° Interrupts. 

° Memory system aborts. 
. Undefined instructions. 


° Supervisor calls (SVCs), Secure Monitor calls (SMCs), and hypervisor calls (HVCs). 
° Debug exceptions. 


Most details of exception handling are not visible to application level software, and are described in 
Handling exceptions that are taken to an Exception level using AArch32 on page G1-5501. In an 
Armv8 implementation that includes all the Exception levels, aspects that are visible to application 
level software are: 


è The SVC instruction causes a Supervisor Call exception. This provides a mechanism for 
unprivileged software to make a call to the operating system, or other system component that 
is accessible only at EL1. 


a The SMC instruction causes a Secure Monitor Call exception, but only if software execution is 
at EL1 or higher. Unprivileged software can only cause a Secure Monitor Call exception by 
methods defined by the operating system, or by another component of the software system 
that executes at EL1 or higher. 


à The HVC instruction causes a Hypervisor Call exception, but only if software execution is at 
EL1 or higher. Unprivileged software can only cause a Hypervisor Call exception by methods 
defined by the hypervisor, or by another component of the software system that executes at 
EL1 or higher. 


è The BKPT instruction causes a Breakpoint Instruction exception, that is taken as a Prefetch 
Abort exception. This provides a mechanism for a debugger to insert breakpoints into 
unprivileged software, or for unprivileged software to make a call into a debugger that is 
accessible at EL1. 


. The WFI (Wait for Interrupt) instruction provides a hint that nothing needs to be done until an 
interrupt or another WFI wake-up event occurs, see Wait For Interrupt on page G1-5565. 
This means the hardware might enter a low-power state until the wake-up event occurs. 


` The WFE (Wait for Event) instruction provides a hint that nothing needs to be done until either 
an SEV instruction generates an event, or another WFE wake-up event occurs, see Wait For 
Event and Send Event on page G1-5562. This means the hardware might enter a low-power 
state until the wake-up event occurs. 


Floating-point exceptions 


These relate to exceptional conditions encountered during floating-point arithmetic, such as Divide 
by Zero or Overflow. For more information see: 


° Floating-point exceptions and exception traps on page E1-3797. 
s The FPEXC and FPSCR register descriptions. 
- ANSI/IEEE Std. 754, IEEE Standard for Binary Floating-Point Arithmetic. 
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This chapter gives an application level description of the memory model for software executing in AArch32 state. 
This means it describes the memory model for execution in ELO when ELO is using AArch32 in the following 
sections: 


About the Arm memory model on page E2-3808. 
Atomicity in the Arm architecture on page E2-3810. 
Definition of the Armv8 memory model on page E2-3814. 
Caches and memory hierarchy on page E2-3829. 
Alignment support on page E2-3834. 

Endian support on page E2-3836. 

Memory types and attributes on page E2-3840. 
Mismatched memory attributes on page E2-3850. 
Synchronization and semaphores on page E2-3853 


Note 





In this chapter, System register names usually link to the description of the register in Chapter G8 AArch32 System 
Register Descriptions, for example SCTLR. 
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E2.1 About the Arm memory model 


The Arm architecture is a weakly ordered memory architecture that permits the observation and completion of 
memory accesses in a different order from the program order. The following sections of this chapter provide the 
complete definition of the Armv8 memory model, this introduction is not intended to contradict the definition found 
in those sections. In general, the basic principles of the Armv8 memory model are: 


° To provide a memory model that has similar weaknesses to those found in the memory models used by 
high-level programming languages such as C or Java. For example, by permitting independent memory 
accesses to be re-ordered as seen by other observers. 


s To avoid the requirement for multi-copy atomicity in the majority of memory types. 


- The provision of instructions and memory barriers to compensate for the lack of multi-copy atomicity in the 
cases where it would be needed. 


. The use of address, data, and control dependencies in the creation of order so as to avoid having excessive 
numbers of barriers or other explicit instructions in common situations where some order is required by the 
programmer or the compiler. 


This section contains: 
. Address space. 


e Memory type overview. 


E2.1.1 Address space 
Address calculations are performed using 32-bit registers. Supervisory software determines the valid address range. 
Attempting to access an address that is not valid generates an MMU fault. 
Address calculations are performed modulo 232, 
The result of an address calculation is UNKNOWN if it overflows or underflows the 32-bit address range A[31:0]. 


Memory accesses use the MemA[], MemO[], MemU[], and MemU_unpriv[] pseudocode functions: 


. The MemA[] function makes an aligned access of the required type. 

. The MemO[] function makes an ordered access of the required type. 

. The MemU[] function makes an unaligned access of the required type 

. The MemU_unpriv[] function makes an unaligned, unprivileged access of the required type. 


Each of these functions calls Mem_with_type[] function, that specifies the required access. This calls 
AArch32.MemSingle[], which performs an atomic, little-endian read of size bytes. 


The AccType enumeration defines the different access types. 


Note 
: Chapter G4 The AArch32 System Level Memory Model and Chapter G5 The AArch32 Virtual Memory System 
Architecture include descriptions of memory system features that are transparent to the application, including 
memory access, address translation, memory maintenance instructions, and alignment checking and the 
associated fault handling. These chapters also reference pseudocode descriptions of these operations. 





° For references to the pseudocode that relates to memory accesses, see Basic memory access on 
page G4-5715, Unaligned memory access on page G4-5716, and Aligned memory access on page G4-5715. 





E2.1.2 Memory type overview 
Armv8 provides the following mutually-exclusive memory types: 


Normal This is generally used for bulk memory operations, both read-write and read-only operations. 
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Device The Arm architecture forbids speculative reads of any type of Device memory. This means Device 
memory types are suitable attributes for read-sensitive locations. 


Locations of the memory map that are assigned to peripherals are usually assigned the Device 
memory attribute. 


Device memory has additional attributes that have the following effects: 


- They prevent aggregation of reads and writes, maintaining the number and size of the 
specified memory accesses. See Gathering on page E2-3846. 


° They preserve the access order and synchronization requirements, both for accesses to a 
single peripheral and where there is a synchronization requirement on the observability of 
one or more memory write and read accesses. See Reordering on page E2-3847 


5 They indicate whether a write can be acknowledged other than at the end point. See Early 
Write Acknowledgement on page E2-3848. 


For more information on Normal memory and Device memory, see Memory types and attributes on page E2-3840. 


Note 


Earlier versions of the Arm architecture defined a single Device memory type and a Strongly-Ordered memory type. 
A Note in Device memory on page E2-3844 describes how these memory types map onto the Armv8 memory types. 
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E2.2 


E2.2.1 


E2-3810 


Atomicity in the Arm architecture 


Atomicity is a feature of memory accesses, described as atomic accesses. The Arm architecture description refers to 
two types of atomicity, single-copy atomicity and multi-copy atomicity. In the Armv8 architecture, the atomicity 
requirements for memory accesses depend on the memory type, and whether the access is explicit or implicit. For 
more information see: 


$ Requirements for single-copy atomicity. 

° Properties of single-copy atomic accesses on page E2-3811. 
: Multi-copy atomicity on page E2-3811. 

7 Requirements for multi-copy atomicity on page E2-3812. 


è Concurrent modification and execution of instructions on page E2-3812. 


For more information about the memory types, see Memory type overview on page E2-3808. 


Requirements for single-copy atomicity 


In AArch32 state, the single-copy atomic PE accesses are: 


. All byte accesses. 

° All halfword accesses to halfword-aligned locations. 

. All word accesses to word-aligned locations. 

. Memory accesses caused by LDREXD and STREXD instructions to doubleword-aligned locations. 


LDM, LDC, LDRD, STM, STC, STRD, PUSH, POP, RFE, SRS, VLDM, VLDR, VSTM, and VSTR instructions are executed as a sequence 
of word-aligned word accesses. Each 32-bit word access is guaranteed to be single-copy atomic. The architecture 
does not require subsequences of two or more word accesses from the sequence to be single-copy atomic. 


LDRD and STRD accesses to 64-bit aligned locations are 64-bit single-copy atomic as seen by translation table walks 
and accesses to translation tables. 





Note 


This requirement has been added to avoid the need for complex measures to avoid atomicity issues when changing 
translation table entries, without creating a requirement that all locations in the memory system are 64-bit 
single-copy atomic. This addition means: 


: The system designer must ensure that all writable memory locations that might be used to hold translations, 
such as bulk SDRAM, can be accessed with 64-bit single-copy atomicity. 


s Software must ensure that translation tables are not held in memory locations that cannot meet this atomicity 
requirement, such as peripherals that are typically accessed using a narrow bus. 


This requirement places no burden on read-only memory locations for which reads have no side effects, since it is 
impossible to detect the size of memory accesses to such locations. 





Advanced SIMD element and structure loads and stores are executed as a sequence of accesses of the element or 
structure size. The architecture requires the element accesses to be single-copy atomic if and only if both: 

. The element size is 32 bits, or smaller. 

. The elements are naturally aligned. 


Accesses to 64-bit elements or structures that are 32-bit aligned are executed as a sequence of 32-bit accesses, each 
of which is single-copy atomic. The architecture does not require subsequences of two or more 32-bit accesses from 
the sequence to be single-copy atomic. 


When an access is not single-copy atomic by the rules described in this section, it is executed as a sequence of one 
or more accesses that aggregate to the size of the original access. Each of the accesses in this sequence is single-copy 
atomic, at least at the byte level. 
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Note 


In this section, the terms before the write operation and after the write operation mean before or after the write 
operation has had its effect on the coherence order of the bytes of the memory location accessed by the write 
operation. 








If, according to these rules, an instruction is executed as a sequence of accesses, a synchronous Data Abort exception 
or Debug state entry can be taken during that sequence. This causes execution of the instruction to be abandoned. 
See Data Abort exception on page G1-5547 and, when ARMv8.2-LSMAOC is implemented, Taking an interrupt 
or other exception during a multiple-register load or store on page G1-5535. 


If the synchronous Data Abort exception is returned from using the preferred return address, the instruction that 
generated the sequence of accesses is re-executed and so any access that was performed before the exception was 
taken is repeated. This also applies to an exit from Debug state. 


Note 


The exception behavior for these multiple access instructions means they are not suitable for use for writes to 
memory for the purpose of software synchronization. 








For implicit accesses: 


a Cache linefills and evictions have no effect on the single-copy atomicity of explicit transactions or instruction 
fetches. 
° Instruction fetches are single-copy atomic: 


— At 32-bit granularity in A32 state. 
— At 16-bit granularity in T32 state. 


Concurrent modification and execution of instructions on page E2-3812 describes additional constraints on 
the behavior of instruction fetches. 


° Translation table walks are performed using accesses that are single-copy atomic: 
— At32-bit granularity when using Short-descriptor format translation tables. 
— At 64-bit granularity when using Long-descriptor format translation tables. 


E2.2.2 Properties of single-copy atomic accesses 


A memory access instruction that is single-copy atomic has the following properties: 


l. For a pair of overlapping single-copy atomic store instructions, all of the overlapping writes generated by one 
of the stores are Coherence-after the corresponding overlapping writes generated by the other store. 


2% For a single-copy atomic load instruction L; that overlaps a single-copy atomic store instruction S2, if one of 
the overlapping reads generated by Lı Reads-from one of the overlapping writes generated by S2, then none 
of the overlapping writes generated by S2 are Coherence-after the corresponding overlapping reads generated 
by Lı. 


For more information, see Definition of the Armv8 memory model on page E2-3814. 


E2.2.3 Multi-copy atomicity 


In a multiprocessing system, writes to a memory location are multi-copy atomic if the following conditions are both 
true: 


° All writes to the same location are serialized, meaning they are observed in the same order by all observers, 
although some observers might not observe all of the writes. 


° A read of a location does not return the value of a write until all observers observe that write. 
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E2.2.4 


E2.2.5 


E2-3812 


Note 


Writes that are not coherent are not multi-copy atomic. 








Requirements for multi-copy atomicity 


For Normal memory, writes are not required to be multi-copy atomic. 
For Device memory, writes are not required to be multi-copy atomic. 


The Armv8 memory model is Other-multi-copy atomic. For more information, see Ordering constraints on 
page E2-3818. 


Concurrent modification and execution of instructions 


The Armv8 architecture limits the set of instructions that can be executed by one thread of execution as they are 
being modified by another thread of execution without requiring explicit synchronization. 


Concurrent modification and execution of instructions can lead to the resulting instruction performing any behavior 
that can be achieved by executing any sequence of instructions that can be executed from the same Exception level, 
except where the instruction before modification and the instruction after modification are: 


° When executing the A32 instruction set, a B, BKPT, BL, HVC, ISB, NOP, SMC, or SVC instruction. 
° When executing the T32 instruction set. a 16-bit B, BKPT, BLX, BX, NOP, or SVC instruction. 


In addition, for the 32-bit T32 instructions, for which Jnstruction encodings on page F2-3904 describes the meaning 
of {hw1, hw2}: 


s hw1 of a 32-bit BL (immediate) instruction can be concurrently modified to hw1 of another BL (immediate) 
instruction: 
— This means that some of the most significant bits of the immediate value can be modified. 

s hw1 of a 32-bit BLX (immediate) instruction can be concurrently modified to hw1 of another BLX immediate 
instruction: 
— This means that some of the most significant bits of the immediate value can be modified. 


° hw1 of a 32-bit BL (immediate) or BLX (immediate) instruction can be concurrently modified to a T32 16-bit B, 
BX, BLX, BKPT, or SVC instruction. This modification also works in reverse. 


° hw2 of a 32-bit BL (immediate) instruction can be concurrently modified to hw2 of another BL (immediate) 
instruction with a different immediate: 
— This means that some bits of the immediate value, including the least significant bits, can be modified. 
: hw2 of a 32-bit BLX (immediate) instruction can be concurrently modified to hw2 of another BLX (immediate) 
instruction with a different immediate: 
— This means that some bits of the immediate value, including the least significant bits, can be modified. 
e hw2 of a 32-bit B (immediate) instruction with a condition field can be concurrently modified to hw2 of another 
32-bit B (immediate) instruction with a condition field with a different immediate: 
— This means that some bits of the immediate value, including the least significant bits, can be modified. 
° hw2 of a 32-bit B (immediate) instruction without a condition field can be concurrently modified to hw2 of 
another 32-bit B (immediate) instruction without a condition field: 


— This means that some bits of the immediate value, including the least significant bits, can be modified. 


Note 
. In the T32 instruction set: 
— The only encodings of BKPT and SVC are 16-bit. 
— The only encoding of BL is 32-bit. 
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è The ISB instruction can be concurrently modified and executed in the A32 and A64 instruction sets, but not 
in the T32 instruction set. 





For the instructions explicitly identified in this section, the architecture guarantees that, after modification of the 
instruction, behavior is consistent with execution of either: 


è The instruction originally fetched. 
? A fetch of the modified instruction. 


The instructions to which this applies are the B, BL, NOP, BKPT, SVC, HVC, and SMC instructions. 


For both instruction sets, if one thread of execution changes a conditional branch instruction to another conditional 
branch instruction, and the change affects both the condition field and the branch target, execution of the changed 
instruction by another thread of execution before the change is synchronized can lead to either: 

è The old condition being associated with the new target address. 

$ The new condition being associated with the old target address. 


These possibilities apply regardless of whether the condition, either before or after the change to the branch 
instruction, is the always condition. 


For all other instructions, to avoid UNPREDICTABLE or CONSTRAINED UNPREDICTABLE behavior, instruction 
modifications must be explicitly synchronized before they are executed. The required synchronization is as follows: 


l. No PE must be executing an instruction when another PE is modifying that instruction. 


2, To ensure that the modified instructions are observable, a PE that is writing the instructions must issue the 
following sequence of instructions and operations: 


; Coherency example for self-modifying code 

; Enter this code with <Rt> containing a new 32-bit instruction, 

; to be held in Cacheable space at a location pointed to by Rn. Use STRH in the first 
; line instead of STR for a 16-bit instruction. 

STR <Rt>, [Rn] 





DCCMVAU Rn ; Clean data cache by MVA to point of unification (PoU) 
DSB ; Ensure visibility of the data stored 
ICIMVAU Rn ; Invalidate instruction cache by VA to PoU 
BPIMVA Rn ; Invalidate branch predictor by MVA to PoU 
DSB 
Note 
. The DCCMVAU operation is not required if the area of memory is either Non-cacheable or Write-Through 
Cacheable. 


À: If the contents of physical memory differ between the mappings, changing the mapping of VAs to PAs 
can cause the instructions to be concurrently modified by one PE and executed by another PE. If the 
modifications affect instructions other than those listed as being acceptable for modification, 
synchronization must be used to avoid UNPREDICTABLE or CONSTRAINED UNPREDICTABLE behavior. 





3. In a multiprocessor system, the ICIMVAU and BPIMVA are broadcast to all PEs within the Inner Shareable domain 
of the PE running this sequence. However, once the modified instructions are observable, each PE that is 
executing the modified instructions must issue the following instruction to ensure execution of the modified 
instructions: 


ISB ; Synchronize fetched instruction stream 


For more information about the required synchronization operation, see Synchronization and coherency issues 
between data and instruction accesses on page E2-3831. 


For information about memory accesses caused by instruction fetches, see Ordering constraints on page E2-3818. 





ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. E2-3813 
ID070919 Non-Confidential 


The AArch32 Application Level Memory Model 
E2.3 Definition of the Armv8 memory model 


E2.3 Definition of the Armv8 memory model 


This section describes observation and ordering in the Armv8 memory model. It contains the following subsections: 
. Locations. 

. Ordering and observability on page E2-3815. 

E Ordering constraints on page E2-3818. 

° Completion and endpoint ordering on page E2-3819. 

. Ordering of instruction fetches on page E2-3820. 

. Restrictions on the effects of speculation on page E2-3821. 

e Memory barriers on page E2-3823. 


For more information on endpoint ordering of memory accesses, see Reordering on page E2-3847. 


In the Armv8 memory model, the Shareability memory attribute indicates the degree to which hardware must ensure 
memory coherency between a set of observers, see Memory types and attributes on page E2-3840. 


The Armv8 architecture defines additional memory attributes and associated behaviors, which are defined in the 
system level section of this manual. See: 


s Chapter G4 The AArch32 System Level Memory Model. 
s Chapter G5 The AArch32 Virtual Memory System Architecture. 


See also Mismatched memory attributes on page E2-3850. 


E2.3.1 Locations 


The Armv8 memory model provides a set of definitions that are used to construct conditions on the permitted 
sequences of accesses to memory. The Armv8 memory model defines: 


° The ordering of observation of memory accesses between different observers. 
° The ordering of arrival of memory accesses arriving at an endpoint. 
° The mechanisms to control the ordering of observation of memory accesses and the arrival of memory 


accesses at an endpoint. 


Locations, Memory effects, and Observers 
The Armv8 memory model provides the following definition of a Location in memory: 


Location 

A Location refers to a single byte in memory. 
As part of its execution an instruction might generate a Memory effect. Observers in the system might observe the 
Memory effects of that instruction on a Location. The Armv8 memory model provides the following definitions of 
a Memory effect and an Observer: 
Memory effect 


The Memory effects of an instruction are the read, write, or barrier effects of that instruction. For an 
instruction that accesses memory: 


. A read effect is generated for each Location that is read by the instruction. 
à A write effect is generated for each Location that is written by the instruction. 
An instruction can generate both read and write effects. 


The memory effects of an instruction I; are said to appear in program order before the Memory 
effects of instruction Ip if and only if I; occurs before Ip in program order. 


For the purposes of describing the Armv8 memory model, all read and write effects access only 
Normal memory locations in a Common Shareability Domain. Where this section refers to a read, 
write, or memory barrier without any qualification, then it is referring to the corresponding Memory 
effect. 
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Observer 
An Observer refers to either a processing element, or some other memory accessing agent that can 
generate reads from or writes to memory. 

Common Shareability Domain 


A Common Shareability Domain for a program is the smallest Shareability domain that contains all 
of the active Observers of the Memory effects generated by a program. 


E2.3.2 Ordering and observability 


The Armv8 memory model permits reordering of memory accesses. This section defines the permitted reordering 
of memory accesses using the following: 


. Register value dependencies to establish order between instructions on a PE. 


. Ordering constraints to establish order between accesses to a Location. 


Register value dependencies 
The Armv8 memory model defines the following dependencies between instructions: 


Register dependency 


A Register dependency from a first data value V1 to a second data value V2 exists within a PE if and 
only if either: 


g The register, excluding the AArch64 zero register (XZR or WZR), that is used to hold Vj is 
used in the calculation of V2. 


: There is a Register dependency from V; to a third data value V3 and there is a register 
dependency from V3 to V2. 
Register data dependency 


A Register data dependency from a first data value V4 to a second data value V> exists within a PE 
if and only if either: 


è The register, excluding the AArch64 zero register (XZR or WZR) and the AArch32 PC, that 
is used to hold V4 and is used in the calculation of V2, and the calculation between V; and 
the Vz does not consist of either: 


— A conditional branch whose condition is determined by V1. 


— A conditional selection, move, or computation whose condition is determined by V4, 
where the input data values for the selection, move, or computation do not have a data 
dependency on V1. 


. There is a Register data dependency from Vj to a third data value V3, and there is a Register 
data dependency from V3 to Vo. 
Address dependency 


An Address dependency from a read R; to a subsequent read R3 exists if and only if there is a 
Register data dependency from the data value that is returned by Rj to the address used by Ro. 


An Address dependency from a read R; to a subsequent write W2 exists if and only if there is a 
Register dependency from the data value that is returned by R to the address used by W2. 
Data dependency 


A Data dependency from a read R; to a subsequent write W3 exists if and only if there is a Register 
dependency from the data value returned by R; to the data value written by W2. 
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Control dependency 
A Control dependency from a read R; to a subsequent instruction Ip exists if and only if either: 


° There is a Register dependency from the data value returned by R; to the data value used in 
the evaluation of a conditional branch, and Iz is only executed as a result of one of the 
possible outcomes of that conditional branch. 


è There is a Register dependency from the data value returned by R, to the data value used in 
the determination of a synchronous exception on an instruction I3, and Iz appears in program 
order after I}. 


Ordering and observability at a Location 
Memory effects on a Location are related by the following relations: 


Reads-from 


A Reads-from relation that couples reads and writes to the same Location such that each read is 
paired with a single write in the program. If a read R2 of a Location Reads-from a write W to the 
same Location if and only if R3 takes its data from W1. 


Note 


The Reads-from relation represents a read being satisfied by a write and then returning the written 
data. 








Coherence order 


A Coherence order relation for each Location in the program that provides a total order on all writes 
from all coherent Observers to that Location, starting with a notional write of the initial value. 


Note ——————— 


The Coherence order of a Location represents the order in which writes to the Location arrive at 
memory. 








Coherence-after 


A write W2 to a Location is Coherence-after another write W to the same Location if and only if 
W2 is sequenced after W, in the Coherence order of the Location. 


A write W2 to a Location is Coherence-after a read R; of the same location if and only if Ry 
Reads-from a write W3 to the same Location and W3 is Coherence-after W3. 
Overlapping accesses 


Two Memory effect overlap if and only if they access the same Location. Two instructions overlap 
if and only if one or more of their generated Memory effects overlap. 


Observed-by 


A read or a write RW, from an Observer is Observed-by a write W2 from a different Observer if and 
only if W2 is coherence-after RW}. 


A write W, from an Observer is Observed-by a read R3 from a different Observer if and only if R2 
Reads-from W1. 





Note ——————_— 


The Observed-by relation only relates accesses generated by different Observers. 





DMB FULL 
A DMB FULL is a DMB with neither the LD or the ST qualifier. 


Where this section refers to DMB without any qualification, then it is referring to all types of DMB. 
Unless a specific shareability domain is defined, a DMB applies to the Common Shareability Domain. 
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All properties that apply to DMB also apply to the corresponding DSB. 


Ordering relations 


In addition to the ordering relations that describe order at a location, the Armv8 memory model also provides 
ordering relations to describe the ordering of instructions. These are as follows: 


Dependency-ordered-before 


A dependency creates externally-visible order between a read and another Memory effect generated 
by the same Observer. A read Rj is Dependency-ordered-before a read or write RW2 from the same 
Observer if and only if R; appears in program order before RW? and any of the following cases 
apply: 

- There is an Address dependency or a Data dependency from R; to RW. 


° RW? is a write W2 and there is a Control dependency from R; to W2. 

. RW> is a read R3 generated by an instruction appearing in program order after an instruction 
I; that generates a Context synchronization event, and there is a Control dependency from Ry 
to Iz. 

$ RW)? is a write W2 appearing in program order after a read or a write RW3 and there is an 


Address dependency from R; to RW3. 


° RW; is a write W3 that is Coherence-after a write W3 and there is a Control dependency or a 
Data dependency from R, to W3. 


. RW; is a read R3 that Reads-from a write W3 and there is an Address dependency or a Data 
dependency from R; to W3. 


Atomic-ordered-before 


Load-Exclusive and Store-Exclusive instructions provide some ordering guarantees, even in the 
absence of dependencies. A read or a write RW, is Atomic-ordered-before a read or a write RW2 
from the same Observer if and only if RW appears in program order before RW? and either of the 
following cases apply: 


. RW; is a read Ry and RW; is a write W2 such that R; and W2 are generated by an atomic 
instruction or a successful Load-Exclusive/Store-Exclusive instruction pair to the same 
Location. 

° RW; is a write W4 generated by an atomic instruction or a successful Store-Exclusive 


instruction and RW? is a read R2 generated by an instruction with Acquire semantics such 
that Ry Reads-from W). 


For more information, see Synchronization and semaphores on page E2-3853. 


Barrier-ordered-before 


Barrier instructions order prior Memory effects before subsequent Memory effects generated by the 
same Observer. A read or a write RW1 is Barrier-ordered-before a read or a write RW2 from the 
same Observer if and only if RW1 appears in program order before RW> and any of the following 
cases apply: 


s RW; appears in program order before a DMB FULL that appears in program order before RW2. 


° At least one of RW; and RW? is generated by an atomic instruction with both Acquire and 
Release semantics. 

. RW; is a write W generated by an instruction with Release semantics and RW? is a read R2 
generated by an instruction with Acquire semantics. 

. RW, is a read R, and either: 
— Rįappears in program order before a DMB LD that appears in program order before RW2. 


— Ri is generated by an instruction with Acquire semantics. 
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° RW? is a write W2 and either: 


— RW;įisa write W, appearing in program order before a DMB ST that appears in program 
order before W2. 


—  Waħ2is generated by an instruction with Release semantics. 
— RW; appears in program order before a write W3 generated by an instruction with 
Release semantics and W3 is Coherence-after W3. 


Ordered-before 


An arbitrary pair of Memory effects is ordered if it can be linked by a chain of ordered accesses 
consistent with external observation. A read or a write RW, is Ordered-before a read or a write RW 
if and only if any of the following cases apply: 


. RW; is Observed-by RW2. 

è RW, is Dependency-ordered-before RW2. 

° RW, is Atomic-ordered-before RW2. 

° RW, is Barrier-ordered-before RW2. 

. RW; is Ordered-before a read or a write that is Ordered-before RW>. 


E2.3.3 Ordering constraints 


The Armv8 memory model is described as being Other-multi-copy atomic. The definition of Other-multi-copy 
atomic is as follows: 
Other-multi-copy atomic 


In an Other-multi-copy atomic system, it is required that a write from an Observer, if observed by a 
different Observer, is then observed by all other Observers that access the Location coherently. It is, 
however, permitted for an Observer to observe its own writes prior to making them visible to other 
observers in the system. 


The Other-multi-copy atomic property of the Armv8 memory model is enforced by placing constraints on the 
possible executions of a program. Those executions that meet the constraints given by the ordering model are said 
to be architecturally well-formed. An implementation that is executing a program is only permitted to exhibit 
behavior consistent with an architecturally well-formed execution. 


Architecturally well-formed 
An architecturally well-formed execution must satisfy both of the following requirements: 
Internal visibility requirement 
For a read or a write RW, that appears in program order before a read or a write RW2 to 


the same Location, the internal visibility requirement requires that exactly one of the 
following statements is true: 


. RW? is a write W2 that is Coherence-after RW . 
° RW, is a write W; and RW; is a read R32 such that either: 
— R Reads-from W}. 
— R2 Reads-from another write that is Coherence-after W1. 


° RW, and RW? are both reads Ry and R3 such that R; Reads-from a write W3 and 
either: 


— R2 Reads-from W3. 
— Rz Reads-from another write that is Coherence-after W3. 


Note 


Informally, if a Memory effect Mı from an Observer appears in program order before a 
Memory effect M2 from the same Observer, then M, will be seen to occur before M3 by 
that Observer. 
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External visibility requirement 
For a read or a write RW, from an Observer that is Ordered-before a read or a write RW2 
from a different Observer, the external visibility constraint requires that RW? is not 
Observed-by RW}. This means that an Architecturally well-formed execution must not 
exhibit a cycle in the Ordered-before relation. 


— Note 


If a Memory effect Mı from an Observer is Ordered-before another Memory effect M2, 
from a different Observer, then M; will be seen to occur before M3 by all Observers in 
the system. 





E2.3.4 Completion and endpoint ordering 


Interaction between Observers in a system is not restricted to communication via shared variables in coherent 
memory. For example, an Observer could configure an interrupt controller to raise an interrupt on another Observer 
as a form of message passing. These interactions typically involve an additional agent, which defines the instruction 
sequence that is required to establish communication links between different Observers. When these forms of 
interaction are used in conjunction with shared variables, a DSB instruction can be used to enforce ordering between 
them. 


For all memory, the completion rules are defined as: 


- A read R; to a Location is complete for a shareability domain when all of the following are true: 


— Any write to the same Location by an Observer within the shareability domain will be Coherence-after 
Rj. 


— Any translation table walks associated with R; are complete for that shareability domain. 


è A write W, to a Location is complete for a shareability domain when all of the following are true: 


— Any write to the same Location by an Observer within the shareability domain will be Coherence-after 
Wi. 


— Any read to the same Location by an Observer within the shareability domain will either Reads-from 
W; or Reads-from a write that is Coherence-after W1. 


— Any translation table walks associated with the write are complete for that shareability domain. 


° A translation table walk is complete for a shareability domain when the memory accesses, including the 
updates to translation table entries, associated with the translation table walk are complete for that 
shareability domain, and the TLB is updated. 


$ A cache or branch predictor maintenance instruction is complete for a shareability domain when the memory 
effects of the instruction are complete for that shareability domain, and any translation table walks that arise 
from the instruction are complete for that shareability domain. 


s A TLB invalidate instruction is complete when all memory accesses using the TLB entries that have been 
invalidated are complete. 


The completion of any cache, branch predictor, or TLB maintenance instruction includes its completion on all PEs 
that are affected by both the instruction and the DSB operation that is required to guarantee visibility of the 
maintenance instruction. 


Note 


These completion rules mean that, for example, a cache maintenance instruction that operates by VA to the PoC 
completes only after memory at the PoC has been updated. 








Additionally, for Device-nGnRnE memory, a read or write of a Location in a Memory-mapped peripheral that 
exhibits side-effects is complete only when the read or write both: 


: Can begin to affect the state of the Memory-mapped peripheral. 
a Can trigger all associated side-effects, whether they affect other peripheral devices, PEs, or memory. 





ARM DDI 0487E.a 
ID070919 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. E2-3819 
Non-Confidential 


The AArch32 Application Level Memory Model 
E2.3 Definition of the Armv8 memory model 


E2.3.5 


E2-3820 


Note 


This requirement for Device-nGnRnE memory is consistent with the memory access having reached the peripheral 
endpoint. 





Peripherals 


This section defines a Memory-mapped peripheral and the total order of reads and write to a peripheral which is 
defined as the Peripheral coherence order: 


Memory-mapped peripheral 


A Memory-mapped peripheral occupies a memory region of IMPLEMENTATION DEFINED size and 
can be accessed using load and store instructions. Memory effects to a Memory-mapped peripheral 
can have side-effects, such as causing the peripheral to perform an action. Values that are read from 
addresses within a Memory-mapped peripheral might not correspond to the last data value written 
to those addresses. As such, Memory effects to a Memory-mapped peripheral might not appear in 
the Reads-from or Coherence order relations. 


Peripheral coherence order 
The Peripheral coherence order of a Memory-mapped peripheral is a total order on all reads and 
writes to that peripheral. 

Note 


The Peripheral coherence order for a Memory-mapped peripheral signifies the order in which 
accesses atrive at the endpoint. 








For a read or a write RW, and a read or a write RW? to the same peripheral, then RW, will appear 
in the Peripheral coherence order for the peripheral before RW? if either of the following cases 


apply: 
. RW; and RW? are accesses using Non-cacheable or Device attributes and RW is 
Ordered-before RW2. 


. RW, and RW? are accesses using Device-nGnRE or Device-nGnRnE attributes and RW, 
appears in program order before RW2. 
Out-of-band-ordered-before 


A read or a write RW, is Out-of-band-ordered-before a read or a write RW? if and only if either of 
the following cases apply: 


è RW; appears in program order before a DSB instruction that begins an IMPLEMENTATION 
DEFINED instruction sequence indirectly leading to the generation of RW2. 


. RW, is Ordered-before a read or a write RW3 and RW; is Out-of-band-ordered-before RW2. 


Ifa Memory effect Mı is Out-of-band-ordered-before a read or a write Mo, then M; is seen to occur 
before M? by all Observers. 


Ordering of instruction fetches 


For two memory locations A and B, if A has been written to and been made coherent with the instruction fetches of 
the shareability domain, before an update to B by an observer in the same shareability domain, then the instruction 
stream of each observer in the shareability domain will not see the updated value of B without also seeing the 
updated value of A. 


A write has been made coherent with an instruction fetch of a shareability domain when: 


CTR.{DIC, IDC} == {0, 0} 
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The location written to has been cleaned to the Point of unification (PoU) from the data cache, and 
that clean is complete for the shareability domain. Subsequently the location has been invalidated 
to the Point of unification (PoU) from the instruction cache, and that invalidation is complete for 
the shareability domain. 


CTR.{DIC, IDC} == {1, 0} 


The location written to has been cleaned to the Point of unification (PoU) from the data cache, and 
that clean is complete for the shareability domain. 


CTR.{DIC, IDC} == {0, 1} 


The write is complete for the shareability domain. Subsequently the location has been invalidated 
to the Point of unification (PoU) from the instruction cache, and that invalidation is complete for 
the shareability domain. 


CTR.{DIC, IDC} == (1, 1} 


The write is complete for the shareability domain. 


Note 


Microarchitecturally, this means that these situations cannot both be true in an implementation: 





s After delays in fetching from memory, the instruction queue can have entries written into it out of order. 


. For an implementation: 


— When CTR.DIC ==0, if there is an outstanding entry in the instruction queue, then later entries in the 
instruction queue are not impacted by the ICIMVAU instructions of a different core. 


— When CTR.DIC == 1, if there is a write to the location that is held in the queue when there is an 
outstanding entry in the instruction queue for an older entry, then the instruction queue does not have 
entries invalidated from it. 





E2.3.6 Restrictions on the effects of speculation 
This section covers restrictions on speculation effects, including: 
$ Restrictions on the effects of speculation in Armv8.0. 
: Speculative Store Bypass Safe (SSBS) on page E2-3822. 


. Further restrictions on the effects of speculation in Armv8.5 on page E2-3822. 


Restrictions on the effects of speculation in Armv8.0 
The Armv8.0 architecture places certain restrictions on the effects of speculation. These are: 


s Each load from a location using a particular VA after an exception return that is a Context synchronization 
event will not speculatively read an entry from earlier in the coherence order for the location being loaded 
from than the entry generated by the latest store to that location using the same VA before the exception exit. 


$ Each load from a location using a particular VA after an exception entry that is a Context synchronization 
event will not speculatively read an entry from earlier in the coherence order for the location being loaded 
from than the entry generated by the latest store to that location using the same VA before the exception 
entry. 


Any load from a location using a particular VA before an exception entry that is a Context synchronization 
event will not speculatively read data from a store to the same location using the same VA after the exception 
entry. 
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è Any load from a location using a particular VA before an exception return that is a Context synchronization 
event will not speculatively read data from a store to the same location using the same VA after the exception 
exit. 

è When data is loaded under speculation with a translation fault, it cannot be used to form an address or 


generate condition codes to be used by instructions newer than the load in the speculative sequence. 


$ When data is loaded under speculation from a location without a translation for the translation regime being 
speculated in, the data cannot be used to form an address or generate condition codes to be used by 
instructions newer than the load in the speculative sequence. 


Speculative Store Bypass Safe (SSBS) 


When ARMv8.0-SSBS is implemented, CPSR.SSBS is a control that can be set by software to indicate whether 
hardware is permitted to load or store speculatively in such a manner that could be exploited to produce a cache 
timing side channel, which uses an address derived from a register value that has been loaded from memory using 
a load instruction that speculatively read an entry for the location being loaded from, where the entry that is 
speculatively read is from earlier in the coherence order than the entry generated by the latest store to that location 
using the same virtual address as the load instruction. 


When the value of CPSR.SSBS is 0, hardware is not permitted to load or store speculatively in this way. 


When the value of CPSR.SSBS is 1, hardware is permitted to load or store speculatively in this way. 


Note 


° If speculation is permitted, then cache timing side channels can lead to addresses being derived using reads 
of address values that have been speculatively loaded from memory to a register. 





7 Software written for architectures from Armv8.0 to Armv8.4 will set SPSR.SSBS to 0. This means that 
CPSR.SSBS will not set, so hardware will not be permitted to use speculative loads with outstanding memory 
disambiguation issues for any subsequent speculative memory accesses if there is any possibility of those 
subsequent memory accesses creating a cache timing side channel. 





Further restrictions on the effects of speculation in Armv8.5 
From Armv8.5 there are some further restrictions on the effects of speculation in addition to those in Armv8.0: 


7 Data loaded under speculation with a permission or domain fault cannot be used to form an address or to 
generate condition codes to be used by instructions newer than the load in the speculative sequence. 


è Any System register read under speculation to a register that is not architecturally accessible from the current 
Exception level cannot be used to form an address or to generate condition codes to be used by instructions 
newer than the load in the speculative sequence. 


Note 


As the effects of speculation are not architecturally visible, this restriction level requires that the effect of any 
speculation cannot give rise to side channels that will leak the values of memory locations, System registers, 
or Special-purpose registers to a level of privilege that would otherwise not be able to determine those values. 








° For all execution prediction resources that predict address or register values, speculative execution at one 
hardware defined context should be separated in a hard-to-determine manner from the predictions trained in 
a different hardware defined context. In the case of this definition, the hardware defined context is determined 


by: 

— The Exception level. 

— The Security state. 

— When executing at EL1, the VMID. 

— When executing at ELO and using the EL1&0 translation regime, the ASID and the VMID. 
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— When executing at ELO and using the EL2&0 translation regime, the ASID. 


Note 


è The definition of “hard-to-determine manner” is left open to implementations. Examples could include the 
complete separation of prediction resources, or the isolation of the predictions using a cryptographic or 
pseudo-random mechanism to separate each context. 





e The architecture does not require that prediction resources that simply predict the direction of a branch are 
separated in this way. 





E2.3.7 Memory barriers 


The Arm architecture is a weakly ordered memory architecture that supports out of order completion. Memory 
barrier is the general term applied to an instruction, or sequence of instructions, that forces synchronization events 
by a PE with respect to retiring Load/Store instructions. The memory barriers defined by the Armv8 architecture 
provide a range of functionality, including: 


° Ordering of Load/Store instructions. 
° Completion of Load/Store instructions. 
` Context synchronization. 


The following subsections describe the Armv8 memory barrier instructions: 
° Instruction Synchronization Barrier (ISB) on page E2-3824. 

° Data Memory Barrier (DMB) on page E2-3824. 

7 Data Synchronization Barrier (DSB) on page E2-3824. 

° Speculation Barrier (SB) on page E2-3825. 

. Consumption of Speculative Data Barrier (CSDB) on page E2-3825. 
à Speculative Store Bypass Barrier (SSBB) on page E2-3826. 

. Speculative Store Bypass Barrier (PSSBB) on page E2-3826. 

° Trace Synchronization Barrier (TSB CSYNC) on page E2-3826. 

. Shareability and access limitations on the data barrier operations on page E2-3827. 
. Load-Acquire, Store-Release on page E2-3828. 


Note 


Depending on the required synchronization, a program might use memory barriers on their own, or it might use them 
in conjunction with cache maintenance and memory management instructions that in general are only available 
when software execution is at EL1 or higher. 








The DMB and DSB memory barriers affect reads and writes to the memory system generated by Load/Store instructions 
and data or unified cache maintenance instructions being executed by the PE. Instruction fetches or accesses caused 
by a hardware translation table access are not explicit accesses. 


AArch32 state also supports the legacy barrier instructions CP1SDMB, CP15DSB, and CP15ISB. These 
instructions are executed as MCRs using the appropriate encoding, and are accessible from ELO. However, for 
performance reasons Arm deprecates any use of these operations, and strongly recommends that software uses the 
DMB, DSB, and ISB instructions described in this section instead. Optionally, an implementation can support a 
CP15BEN control that supervisory software can use to disable use of these instructions, meaning the corresponding 
MCR encodings are UNDEFINED. When the CP15BEN control is supported, setting one of the following CP15BEN 
fields to 0 makes execution of CP15DMB, CP15DSB, and CP15ISB UNDEFINED: 


ot SCTLR_EL1.CP15BEN, for execution of these instructions at ELO using AArch32 when EL] is using 
AArché4. 


$ SCTLR.CP15BEN, for execution of these instructions at ELO or EL1 when EL1 is using AArch32. 


° HSCTLR.CP15BEN, for execution of these instructions at EL2 when EL2 is using AArch32. 
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Instruction Synchronization Barrier (ISB) 


An ISB instruction ensures that all instructions that come after the ISB instruction in program order are fetched from 
the cache or memory after the ISB instruction has completed. Using an ISB ensures that the effects of 
context-changing operations executed before the ISB are visible to the instructions fetched after the ISB instruction. 
Examples of context-changing operations that require the insertion of an ISB instruction to ensure the effects of the 
operation are visible to instructions fetched after the ISB instruction are: 


° Completed cache and TLB maintenance instructions. 


. Changes to System registers. 


Any context-changing operations appearing in program order after the ISB instruction only take effect after the ISB 
has been executed. 


The pseudocode function for the operation ofan ISB is InstructionSynchronizationBarrier(). 


See also Memory barriers on page G4-5717. 


Data Memory Barrier (DMB) 


The DMB instruction is a memory barrier instruction that ensures the relative order of memory accesses before the 
barrier with memory accesses after the barrier. The DMB instruction does not ensure the completion of any of the 
memory accesses for which it ensures relative order. 


The full definition of the DMB is covered formally in the Definition of the Armv8 memory model on page E2-3814 
and this introduction to the DMB instruction is not intended to contradict that section. 


The basic principle of a DMB instruction is to introduce order between memory accesses that are specified to be 
affected by the DMB options supplied as arguments to the DMB instruction. The DMB instruction ensures that all 
affected memory accesses by the PE executing the DMB that appear in program order before the DMB and those 
which originate from a different PE, to the extent required by the DMB options, which have been Observed-by the 
PE before the DMB is executed, are Observed-by each PE, to the extent required by the DMB options, before any 
affected memory accesses that appear in program order after the DMB are Observed-by that PE. 


The use of a DMB creates order between the Memory effects of instructions as described in the definition of 
Barrier-ordered-before. 


The pseudocode function for the operation of a DMB is DataMemoryBarrier(). 


Data Synchronization Barrier (DSB) 


A DSB is a memory barrier that ensures that memory accesses that occur before the DSB have completed before 
the completion of the DSB instruction. In doing this, it acts as a stronger barrier than a DMB and all ordering that 
is created by a DMB with specific options is also generated by a DSB with the same options. 


Execution of a DSB at EL2 ensures that any memory accesses caused by speculative translation table walks from the 
Non-secure PL1&0 translation regime have been observed. 


For more information, see Use of out-of-context translation regimes on page G5-5726. 
A DSB executed by a PE, PEe, completes when all of the following apply: 


° All explicit memory accesses of the required access types appearing in program order before the DSB are 
complete for the set of observers in the required shareability domain. 


° If the required access types of the DSB is reads and writes, then all cache maintenance instructions, all TLB 
maintenance instructions, and all PSB CYNC instructions issued by PEe before the DSB are complete for the 
required shareability domain. 


In addition, no instruction that appears in program order after the DSB instruction can alter any state of the system 
or perform any part of its functionality until the DSB completes, other than: 


° Being fetched from memory and decoded. 
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: Reading the general-purpose, SIMD and floating-point, Special-purpose, or System registers that are directly 
or indirectly read without causing side-effects. 


The pseudocode function for the operation of a DSB is DataSynchronizationBarrier(). 


See also Memory barrier instructions on page G4-5714 and Memory barriers on page G4-5717. 


Speculation Barrier (SB) 


An SB is a memory barrier that prevents speculative execution of instructions until after the barrier has completed 
when those instructions could be observed through side-channels. 


Until the barrier completes, the speculative execution of any instruction appearing later in the program order than 
the barrier: 


. Cannot be performed to the extent that such speculation can be observed through side-channels as a result of 
control flow speculation or data value speculation. 


: Can be performed when predicting that a instruction that could generate an exception does not generate an 
exception. 


Speculative execution of an SB instruction: 


è Cannot be as a result of control flow speculation. 

7 Cannot be as a result of data value speculation. 

$ Can be as a result of predicting that an instruction that could generate an exception does not generate an 
exception. 


An SB instruction can complete when: 
. It is known that it is not speculative. 


a All the predicted data values generated by instructions appearing in program order before the SB instruction 
have their predicted values confirmed. 





Note 
The SB instruction has no effect on the use of prediction resources to predict the instruction stream that is being 
fetched, so long as the prediction of the instruction stream is not informed by data taken from the register outputs 
of the speculative execution of instructions appearing in program order after an uncompleted SB instruction. 





Consumption of Speculative Data Barrier (CSDB) 


The CSDB instruction is a memory barrier instruction that controls speculative execution and data value prediction. 
This includes: 


a Data value predictions of any instructions. 


. PSTATE. {N,Z,C,V} predictions of any instructions other than conditional branch instructions appearing in 
program order before the CSDB that have not been architecturally resolved. 


è Predictions of SVE prediction state for any SVE instructions. 
For purposes of the definition of CSDB, PSTATE.{N,Z,C,V} is not considered a data value. This definition permits: 
. Control flow speculation before and after the CSDB. 


° Speculative execution of conditional data processing instructions after the CSDB, unless they use the results 
of data value or PSTATE. {N,Z,C,V} predictions of instructions appearing in program order before the CSDB 
that have not been architecturally resolved. 
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Speculative Store Bypass Barrier (SSBB) 


The SSBB is a memory barrier that prevents speculative loads from bypassing earlier stores to the same virtual 
address under certain conditions. 


The semantics of the Speculative Store Bypass Barrier are: 


° When a load to a location appears in program order after the SSBB, then the load does not speculatively read 
an entry earlier in the coherence order for that location than the entry generated by the latest store satisfying 
all of the following conditions: 


— The store is to the same location as the load. 
— The store uses the same virtual address as the load. 
— The store appears in program order before the SSBB. 
° When a load to a location appears in program order before the SSBB, then the load does not speculatively read 
data from any store satisfying all of the following conditions: 
— The store is to the same location as the load. 
— The store uses the same virtual address as the load. 


— The store appears in program order before the SSBB. 


Physical Speculative Store Bypass Barrier (PSSBB) 


The PSSBB is a memory barrier that prevents speculative loads from bypassing earlier stores to the same physical 
address under certain conditions. 


The semantics of the Speculative Store Bypass Barrier are: 


š When a load to a location appears in program order after the PSSBB, then the load does not speculatively read 
an entry earlier in the coherence order for that location than the entry generated by the latest store satisfying 
all of the following conditions: 


— The store is to the same location as the load. 
— The store appears in program order before the PSSBB. 
° When a load to a location appears in program order before the PSSBB, then the load does not speculatively read 
data from any store satisfying all of the following conditions: 
— The store is to the same location as the load. 


— The store appears in program order before the PSSBB. 


Trace Synchronization Barrier (TSB CSYNC) 


The TSB CSYNC is a memory barrier instruction that preserves the relative order of memory accesses to System 
registers due to trace operations and other memory accesses to the same registers. 


A trace operation is an operation of the PE Trace Unit generating trace for an instruction when ARMv8.4-Trace is 
implemented and enabled. 


A TSB CSYNC is not required to execute in program order with respect to other instructions. This includes being 
reordered with respect to other trace instructions. One or more context synchronization events are required to ensure 
that TSB CSYNC is executed in the necessary order. 


If trace is generated between a context synchronization event and a TSB CSYNC operation, these trace operations may 
be reordered with respect to the TSB CSYNC operation, and therefore may not be synchronized. 


The following situations are synchronized using a TSB CSYNC: 


$ A direct write B to a System register is ordered after an indirect read or indirect write of the same register by 
a trace operation A, if all of the following are true: 
— Ais executed in program order before a context synchronization event C. 


— Cis in program order before a TSB CSYNC operation T. 
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— Bis executed in program order after T. 


s A direct read B ofa System register is ordered after an indirect write to the same register by a trace operation 
if all the following are true: 


— Ais executed in program order before a context synchronization event C1. 
— Cl isin program order before TSB CSYNC operation T. 
— Tis executed in program order before a second context synchronization event C2. 
— Bis executed in program order after C2. 
ATSB CSYNC is not needed when a direct write to a System register is ordered before an indirect read or indirect write 


of the same register by a trace operation if a context synchronization event is executed in program order between 
them. 


The pseudocode function for the operation of a TSB CSYNC is TraceSynchronizationBarrier(). 


Shareability and access limitations on the data barrier operations 


The DMB and DSB instructions can each take an optional limitation argument that specifies: 
: The shareability domain over which the instruction must operate. This is one of: 
— Full system. 
— Outer Shareable. 
— Inner Shareable. 
— Non-shareable. 
7 The accesses for which the instruction operates. This is one of: 
— Read and write accesses, both before and after the barrier instruction. 
— Write accesses only, before and after the barrier instruction. 


— Read accesses before the barrier instruction, and read and write accesses after the barrier instruction. 


Note 


This form of a DMB or DSB instruction can be described as a Load-Load/Store barrier. 








For more information on whether an access is before or after a barrier instruction, see Data Memory Barrier (DMB) 
on page E2-3824 or Data Synchronization Barrier (DSB) on page E2-3824. 


Table E2-1 shows how these options are encoded in the <option> field of the instruction. 


Table E2-1 Encoding of the DMB and DSB <option> parameter 





Accesses 


Shareability domain 


Before the barrier After the barrier Full system Outer Shareable Inner Shareable Non-shareable 











Reads and writes Reads and writes SY OSH ISH NSH 
Writes Writes ST OSHST ISHST NSHST 
Reads Reads and writes LD OSHLD ISHLD NSHLD 





If no <option> is specified then the instruction operates for read and write accesses, over the full system, meaning 
the operation is the same as for the SY option. See the instruction descriptions for more information: 


° DMB on page F5-4180. 
$ DSB on page F5-4183. 


Note 


ISB also supports an optional limitation argument that can only contain one value that corresponds to full system 
operation, see ZSB on page F5-4203. 
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E2-3828 


Load-Acquire, Store-Release 
Armv8 provides a set of instructions with Acquire semantics for loads, and Release semantics for stores. 


The full definition of the Load-Acquire instruction is covered formally in the Definition of the Armv8 memory model 
on page E2-3814 and this introduction to the Load-Acquire instruction is not intended to contradict that section. 


The basic principle of a Load-Acquire instruction is to introduce order between the memory access generated by the 
Load-Acquire instruction and the memory accesses appearing in program order after the Load-Acquire instruction, 
such that the memory access generated by the Load-Acquire instruction is Observed-by each PE, to the extent that 
that PE is required to observe the access coherently, before any of the memory accesses appearing in program order 
after the Load-Acquire instruction are Observed-by that PE, to the extent that the PE is required to observe the 
accesses coherently. 


The use of a Load-Acquire instruction creates order between the Memory effects of instructions as described in the 
definition of Barrier-ordered-before. 


The full definition of the Store-Release instruction is covered formally in the Definition of the Armv8 memory model 
on page E2-3814 and this introduction to the Store-Release instruction is not intended to contradict that section. 


The basic principle of a Store-Release instruction is to introduce order between the memory accesses generated by 
the PEe executing the Store-Release instruction, together with those which originate from a different PE, to the 
extent that the PEe is required to observe them coherently, Observed-by the PEe before executing the Store-release. 


The use of a Store-Release instruction creates order between the Memory effects of instructions as described in the 
definition of Barrier-ordered-before. 


In addition, the use of a Load-Acquire or a Store-Release instruction on accesses to a Memory-mapped peripheral 
introduces order between the Memory effects of the instructions that access that peripheral, as described in the 
definition of Peripheral coherence order. 


Load-Acquire and Store-Release, other than LDAEXD and STLEXD, access only a single data element. This access is 
single-copy atomic. The address of the data object must be aligned to the size of the data element being accessed, 
otherwise the access generates an Alignment fault. 


LDAEXD and STLEXD access two data elements. The address supplied to the instructions must be doubleword aligned, 
otherwise the access generates an Alignment fault. 


A Store-Release Exclusive instruction only has the release semantics if the store is successful. 


Note 


s Each Load-Acquire Exclusive and Store-Release Exclusive instruction is essentially a variant of the 
equivalent Load-Exclusive or Store-Exclusive instruction. All usage restrictions and single-copy atomicity 
properties: 





— That apply to the Load-Exclusive instructions also apply to the Load-Acquire Exclusive instructions. 


— That apply to the Store-Exclusive instructions also apply to the Store-Release Exclusive instructions. 


à The Load-Acquire/Store-Release instructions can remove the requirement to use the explicit DMB memory 
barrier instruction. 





Table E2-2 summarizes the Load-Acquire/Store-release instructions. 


Table E2-2 Load-Acquire/Store-Release instructions 

















Data type Load-Acquire Store-Release Load-Acquire Exclusive Store-Release Exclusive 
32-bit word LDA STL LDAEX STLEX 

16-bit halfword LDAH STLH LDAEXH STLEXH 

8-bit byte LDAB STLB LDAEXB STLEXB 

64-bit doubleword - - LDAEXD STLEXD 
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E2.4 Caches and memory hierarchy 


The implementation of a memory system depends heavily on the microarchitecture and therefore many details of 
the memory system are IMPLEMENTATION DEFINED. Armv8 defines the application level interface to the memory 
system, including a hierarchical memory system with multiple levels of cache. This section describes an application 
level view of this system. It contains the subsections: 


$ Introduction to caches. 

7 Memory hierarchy. 

$ Implication of caches for the application programmer on page E2-3830. 
s Preloading caches on page E2-3832. 


E2.4.1 Introduction to caches 


A cache is a block of high-speed memory that contains a number of entries, each consisting of: 
: Main memory address information, commonly known as a tag. 
° The associated data. 


Caches increase the average speed of a memory access and take account of two principles of locality: 


Spatial locality 


An access to one location is likely to be followed by accesses to adjacent locations. Examples of this 
principle are: 


e Sequential instruction execution. 


è Accessing a data structure. 


Temporal locality 


An access to an area of memory is likely to be repeated in a short time period. An example of this 
principle is the execution of a software loop. 


To minimize the quantity of control information stored, the spatial locality property groups several locations 
together under the same tag. This logical block is commonly known as a cache line. When data is loaded into a 
cache, access times for subsequent loads and stores are reduced, resulting in overall performance benefits. An access 
to information already in a cache is known as a cache hit, and other accesses are called cache misses. 


Normally, caches are self-managing, with the updates occurring automatically. Whenever the PE accesses a 
cacheable memory location, the cache is checked. If the access is a cache hit, the access occurs in the cache. 
Otherwise, the access is made to memory. Typically, when making this access, a cache location is allocated and the 
cache line loaded from memory. Armv8 permits different cache topologies and access policies, provided they 
comply with the memory coherency model described in this manual. 


Caches introduce a number of potential problems, mainly because: 
s Memory accesses can occur at times other than when the programmer would expect them. 
° A data item can be held in multiple physical locations. 


E2.4.2 Memory hierarchy 


Typically memory close to a PE has very low latency, but is limited in size and expensive to implement. Further 
from the PE it is common to implement larger blocks of memory but these have increased latency. To optimize 
overall performance, an Armv8 memory system can include multiple levels of cache in a hierarchical memory 
system that exploits this trade-off between size and latency. Figure E2-1 on page E2-3830 shows an example of such 
a system in an Armv8-A system that supports virtual addressing. 
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E2.4.3 
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In this manual, in a hierarchical memory system, Level 1 refers to the level closest to the PE, as shown in 
Figure E2-1. 





Instructions and data can be held in separate caches or in a unified cache. A cache hierarchy can have one or more 
levels of separate instruction and data caches, with one or more unified caches located at the levels closest to the 
main memory. Memory coherency for cache topologies can be defined using the conceptual points Point of 
Unification (PoU) and Point of Coherency (PoC). For more information, including the definitions of PoU and PoC, 
see About cache maintenance in AArch32 state on page G4-5693. 


Note 


Armv8 ARMv8.2-DCPoP adds architectural support for an additional conceptual point, Point of Persistence, but 
this support is provided only in AArch64 state. For more information see About cache maintenance in AArch64 state 
on page D4-2478. 








The Cacheability and Shareability memory attributes 
Cacheability and Shareability are two attributes that describe the memory hierarchy in a multiprocessing system: 


Cacheability This term defines whether memory locations are allowed to be allocated into a cache or not. 
Cacheability is defined independently for Inner and Outer Cacheability locations. 


Shareability This term defines whether memory locations are shareable between different agents in a system. 
Marking a memory location as shareable for a particular domain requires hardware to ensure that 
the location is coherent for all agents in that domain. Shareability is defined independently for Inner 
and Outer Shareability domains. 


For more information about the Cacheability and Shareability attributes see Memory types and attributes on 
page E2-3840. 


Implication of caches for the application programmer 


In normal operation, the caches are largely invisible to the application programmer. However they can become 
visible when there is a breakdown in the coherency of the caches. Such a breakdown can occur: 


$ When memory locations are updated by other agents in the system that do not use hardware management of 
coherency. 
7 When memory updates made from the application software must be made visible to other agents in the 


system, without the use of hardware management of coherency. 
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For example: 


: In the absence of hardware management of coherency of DMA accesses, in a system with a DMA controller 
that reads memory locations that are held in the data cache of a PE, a breakdown of coherency occurs when 
the PE has written new data in the data cache, but the DMA controller reads the old data held in memory. 


è In a Harvard cache implementation, where there are separate instruction and data caches, a breakdown of 
coherency occurs when new instruction data has been written into the data cache, but the instruction cache 
still contains the old instruction data. 


Data coherency issues 


Software can ensure the data coherency of caches in the following ways: 


s By not using the caches in situations where coherency issues can arise. This can be achieved by: 
— Using Non-cacheable or, in some cases, Write-Through Cacheable memory. 
— Not enabling caches in the system. 


è By using system calls to functions using cache maintenance instructions that execute at a higher Exception 
level. 
° By using hardware coherency mechanisms to ensure the coherency of data accesses to memory for cacheable 


locations by observers within the different shareability domains, see Non-shareable Normal memory on 
page E2-3842 and Shareable, Inner Shareable, and Outer Shareable Normal memory on page E2-3841. 


Note 


The performance of these hardware coherency mechanisms is highly implementation-specific. In some 
implementations the mechanism suppresses the ability to cache shareable locations. In other 
implementations, cache coherency hardware can hold data in caches while managing coherency between 
observers within the shareability domains. 








Synchronization and coherency issues between data and instruction accesses 


How far ahead of the current point of execution instructions are fetched from is IMPLEMENTATION DEFINED. Such 
prefetching can be either a fixed or a dynamically varying number of instructions, and can follow any or all possible 
future execution paths. For all types of memory: 


è The PE might have fetched the instructions from memory at any time since the last Context synchronization 
event on that PE. 


7 Any instructions fetched in this way might be executed multiple times, if this is required by the execution of 
the program, without being re-fetched from memory. 


The Arm architecture does not require the hardware to ensure coherency between instruction caches and memory, 
even for locations of shared memory. 


If software requires coherency between instruction execution and memory, it must manage this coherency using 
Context synchronization events and cache maintenance instructions. These can only be accessed from an Exception 
level that is higher than ELO, and therefore require a system call, see Exception-generating and exception-handling 
instructions on page F1-3885. The following code sequence can be used for this purpose: 


; Coherency example for data and instruction accesses within the same Inner Shareable domain. 
; Enter this code with <Rt> containing a new 32-bit instruction, 

; to be held in Cacheable space at a location pointed to by Rn. Use STRH in the first line 

; instead of STR for a 16-bit instruction. 


STR Rt, [Rn] 
DCCMVAU Rn ; Clean data cache by MVA to point of unification (PoU) 
DSB ; Ensure visibility of the data cleaned from cache 
ICIMVAU Rn ; Invalidate instruction cache by MVA to PoU 
BPIMVA Rn ; Invalidate branch predictor by MVA to PoU 
DSB ; Ensure completion of the invalidations 
ISB ; Synchronize the fetched instruction stream 
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E2.4.4 


E2-3832 


A write has been made coherent with an instruction fetch of a shareability domain when: 


CTR.{DIC, IDC} == {0, 0} 
The location written to has been cleaned to the Point of unification (PoU) from the data cache, and 
that clean is complete for the shareability domain. Subsequently the location has been invalidated 
to the Point of unification (PoU) from the instruction cache, and that invalidation is complete for 
the shareability domain. 

CTR.{DIC, IDC} == {1, 0} 
The location written to has been cleaned to the Point of unification (PoU) from the data cache, and 
that clean is complete for the shareability domain. 

CTR.{DIC, IDC} == {0, 1} 
The write is complete for the shareability domain. Subsequently the location has been invalidated 
to the Point of unification (PoU) from the instruction cache, and that invalidation is complete for 
the shareability domain. 

CTR.{DIC, IDC} == {1, 1} 


The write is complete for the shareability domain. 


Note 


s For accesses that are Non-cacheable or Write-Through, the clean data cache instruction is not required. For 
accesses that are Non-cacheable, the invalidate instruction cache is not required, because in AArch32 state 
these accesses are not permitted to be held in an instruction cache. 





° This code can be used when the thread of execution modifying the code is the same thread of execution that 
is executing the code. The Armv8 architecture limits the set of instructions that can be executed by one thread 
of execution as they are being modified by another thread of execution without requiring explicit 
synchronization. See Concurrent modification and execution of instructions on page E2-3812. 





Preloading caches 


The Arm architecture provides the memory system hints PLD (Preload Data), PLDW (Preload Data With Intent To 
Write) and PLI (Preload Instruction) that software can use to communicate the expected use of memory locations to 
the hardware. The memory system can respond by taking actions that are expected to speed up the memory accesses 
if they occur. The effect of these memory system hints is IMPLEMENTATION DEFINED. Typically, implementations 
use this information to bring data or instruction locations into caches. 


The Preload instructions are hints, and so implementations can treat them as NOPs without affecting the functional 
behavior of the device. The instructions cannot generate synchronous Data Abort exceptions, but the resulting 
memory system operations might, under exceptional circumstances, generate an asynchronous External abort, 
which is reported using an SError interrupt and taken using an asynchronous Data Abort exception. For more 
information, see Data Abort exception on page G1-5547. 


A PLD, PLDW, or PLI instruction can only cause allocation to software-visible caching structures such caches or TLBs 
for memory locations that can be accessed, according to the permissions defined by the current translation regime 
or a translation regime for a higher Exception level in the current Security state, by any of: 

° Reads. 

° Writes. 

° Instruction fetches. 


A PLD, PLDW, or PLI instruction can access any memory location in Normal memory that can be accessed, according 
to the permissions defined by the current translation regime or a translation regime for a higher Exception level in 
the current Security state, by any of: 


. Reads. 
. Writes. 
° Instruction fetches. 
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Note 
In each case, the entire list applies to each of PLD, PLDW, and PLI. 





A PLD, PLDW, or PLI instruction is guaranteed not to access any type of Device memory. 


A PLI instruction must not perform any access that cannot be performed by a speculative instruction fetch by the 
processor. Therefore in a VMSA implementation, if all associated MMUs are disabled, a PLI instruction cannot 
access any memory location that cannot be accessed by instruction fetches. 


The pseudocode enumeration PrefetchHint defines the prefetch hint types. 


The Hint_Prefetch() pseudocode function signals to the memory system that memory accesses of the type hint to 
or from the specified address are likely to occur in the near future. The memory system might take some action to 
speed up the memory accesses when they do occur, such as preloading the specified address into one or more caches 
as indicated by the innermost cache level target and non-temporal hint stream. 


For more information on PLD, PLI, and PLDW, see: 

° PLD, PLDW (immediate) on page F5-4400. 
° PLD (literal) on page F5-4402. 

° PLD, PLDW (register) on page F5-4404. 

. PLI (immediate, literal) on page F5-4406. 

° PLI (register) on page F5-4409. 
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E2.5 Alignment support 


This section describes alignment support. It contains the following subsections: 


. Instruction alignment. 

à Unaligned data access. 

° Cases where unaligned accesses are CONSTRAINED UNPREDICTABLE on page E2-3835. 

s Unaligned data access restrictions on page E2-3835. 

: Generation of Alignment faults by Load/store multiple accesses to Device memory on page E2-3835. 


For more information about Alignment faults see Alignment faults on page G5-5818. 


E2.5.1 Instruction alignment 
A32 instructions are word-aligned. 


T32 instructions are halfword-aligned. 


E2.5.2 Unaligned data access 


An Armv8 implementation must support unaligned data accesses to Normal memory by some load and store 


instructions. As Table E2-3 shows, software can control whether a misaligned access to Normal memory by one of 
these instructions causes an Alignment fault Data Abort exception: 


s By setting SCTLR.A, for unaligned accesses from any mode other than Hyp mode. 


° By setting HSCTLR.A, for unaligned accesses from Hyp mode. 


Table E2-3 Alignment requirements of load/store instructions 





Result if check fails when: 





























Instructions Alignment 

check SCTLR.A or SCTLR.A or 

HSCTLR.A is 0 HSCTLR.A is 1 

LDRB, LDREXB, LDRBT, LDRSB, LDRSBT, STRB, STREXB, STRBT, TBB None : : 
LDRH, LDRHT, LDRSH, LDRSHT, STRH, STRHT, TBH Halfword Unaligned access Alignment fault 
LDREXH, STREXH, LDAH, STLH, LDAEXH, STLEXH Halfword Alignment fault Alignment fault 
LDR, LDRT, STR, STRT Word Unaligned access Alignment fault 
PUSH, encodings T3 and A2 only 
POP, encodings T3 and A2 only 
LDREX, STREX, LDA, STL, LDAEX, STLEX Word Alignment fault Alignment fault 
LDREXD, STREXD, LDAEXD, STLEXD Doubleword Alignment fault Alignment fault 
All forms of LDM and STM, LDRD, RFE, SRS, STRD Word Alignment fault Alignment fault 
LDC, STC Word Alignment fault Alignment fault 
VLDM, VLDR, VPOP, VPUSH, VSTM, VSTR Word Alignment fault Alignment fault 





VLD1, VLD2, VLD3, VLD4, VST1, VST2, VST3, VST4, all with standard alignment 


Element size 


Unaligned access 


Alignment fault 





VLD1, VLD2, VLD3, VLD4, VST1, VST2, VST3, VST4, all with :<align> specified 


As specified 
by :<align> 


Alignment fault 


Alignment fault 


a. Previous versions of this manual used @<align> to specify alignment. Both forms are supported, see Chapter F6 732 and A32 Advanced 
SIMD and Floating-point Instruction Descriptionsfor more information. 
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Note 


Any unaligned access to any type of Device memory generates an Alignment fault, see Alignment faults on 
page G5-5818. 





E2.5.3 Cases where unaligned accesses are CONSTRAINED UNPREDICTABLE 


Any load instruction that is not faulted by the alignment restrictions shown in Table E2-3 on page E2-3834 and that 
loads the PC has CONSTRAINED UNPREDICTABLE behavior if the address it loads from is not word-aligned, see Loads 
and Stores to unaligned locations on page K1-7608. This overrules any permitted Load/Store behavior shown in 
Table E2-3 on page E2-3834. 


E2.5.4 Unaligned data access restrictions 


The following points apply to unaligned data accesses in Armv8: 


. Accesses are not guaranteed to be single-copy atomic except at the byte access level, see Atomicity in the Arm 
architecture on page E2-3810. 


$ Unaligned accesses typically take a number of additional cycles to complete compared to a naturally-aligned 
access. 
7 An operation that performs an unaligned access can abort on any memory access that it makes, and can abort 


on more than one access. This means that an unaligned access that occurs across a page boundary can 
generate an abort on either side of the boundary. 


E2.5.5 Generation of Alignment faults by Load/store multiple accesses to Device memory 
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When ARMv8.2-LSMAOC is implemented and the value of the applicable nNTLSMD field is 0, any memory access 
by an AArch32 Load Multiple or Store Multiple instruction to an address that the stage | translation assigns as 
Device-nGRE, Device-nGnRE, or Device-nGnRnE generates an Alignment fault. 


The applicable nTLSMD field is the field in the SCTLR_EL1, SCTLR_EL2, HSCTLR, or SCTLR register that 
applies to the Exception level and Security state at which the LDM or STM instruction is executed. 
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E2.6 Endian support 


General description of endianness in the Arm architecture describes the relationship between endianness and 
memory addressing in the Arm architecture. 


The following subsections then describe the endianness schemes supported by the architecture: 
. Instruction endianness. 

° Data endianness on page E2-3837. 

° Endianness of memory-mapped peripherals on page E2-3838. 


E2.6.1 General description of endianness in the Arm architecture 


This section only describes memory addressing and the effects of endianness for data elements up to doubleword 
of 64 bits. However, this description can be extended to apply to larger data elements. 


For an address A, Figure E2-2 shows, for big-endian and little-endian memory systems, the relationship between: 
s The doubleword at address A. 

° The words at addresses A and A+4. 

. The halfwords at addresses A, A+2, A+4, and A+6. 

. The bytes at addresses A, A+1, A+2, A+3, A+4, A+5, A+6, and A+7. 





The terms in Figure E2-2 have the following definitions: 
MSByte Most-significant byte. 
LSByte Least-significant byte. 


Big-endian memory system 








MSByte Incrementing byte address > LSByte 


Doubleword at address A 
Word at aa A a Word at address A+4 
at address A Haiwan at address A+2 ae at address A+4 Halfword W address A+6 
Byte, A+1 ae A+2 Byte, A+3 Beka Byte, A+5 Byte, A+6 i Byte, A+7 




























































































































































































Little-endian memory system 








MSByte <4 Incrementing byte address LSByte 


Doubleword at address A 
Word at adres A+4 ai Wo 
Halfword at address A+6 APER at address A+4 PIR at address A+2 as 
Byte, A+7 Byte, A+6 Len A+5 Byte, A+4 Byte, A+2 Byte, E 




























































































































































































In this figure, Byte, A+1 is an abbreviation for Byte at address A+1 
Figure E2-2 Endianness relationships in AArch32 state 
E2.6.2 Instruction endianness 


In Armv8-A, the mapping of instruction memory is always little-endian. 


E2-3836 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


E2.6.3 Data endianness 


The AArch32 Application Level Memory Model 
E2.6 Endian support 


The size of the data value that is loaded or stored is the size that is used for the purpose of endian conversion for 
floating-point, Advanced SIMD, and general-purpose register loads and stores. 


Table E2-4 shows the element sizes of all the load/store instructions, for all instruction sets. 


Table E2-4 Element size of load/store instructions 





Instructions 


Element size 




















LDRB, LDREXB, LDRBT, LDRSB, LDRSBT, STRB, STREXB, STRBT, TBB Byte 
LDRH, LDREXH, LDRHT, LDRSH, LDRSHT, STRH, STREXH, STRHT, TBH Halfword 
LDR, LDRT, LDREX, STR, STRT, STREX Word 
LDRD, LDREXD, STRD, STREXD Word 
All forms of LDM, PUSH, POP, RFE, SRS, all forms of STM, Word 
LDC, STC Word 





Forms of VLDM, VLDR, VPOP, VPUSH, VSTM, VSTR that transfer 32-bit Si registers Word 





Forms of VLDM, VLDR, VPOP, VPUSH, VSTM, VSTR that transfer 64-bit Di registers | Doubleword 





VLD1, VLD2, VLD3, VLD4, VST1, VST2, VST3, VST4 


Element size of the Advanced SIMD access 





CPSR.E determines the data endianness. 


The data size used for endianness conversions: 


a Is the size of the data value that is loaded or stored for Advanced SIMD and floating-point register and 
general-purpose register loads and stores. 


° Is the size of the data element that is loaded or stored for Advanced SIMD element and data structure loads 
and stores. For more information see Endianness in Advanced SIMD on page E2-3838. 


Instructions to reverse bytes in registers 


An application or device driver might have to interface to memory-mapped peripheral registers or shared memory 
structures that are not the same endianness as the internal data structures. Similarly, the endianness of the operating 
system might not match that of the peripheral registers or shared memory. In these cases, the PE requires an efficient 
method to transform explicitly the endianness of the data. 


Table E2-5 shows the instructions that provide this functionality in the A32 and T32 instruction sets. 


Table E2-5 Byte reversal instructions 























Function A Notes 

Reverse bytes in whole register REV For use with general purpose registers. 

Reverse bytes in 16-bit halfwords REV16 For use with general purpose registers. 

Reverse bytes in halfword and sign-extend REVSH For use with general purpose registers. 

Reverse elements in doublewords, vector VREV64 For use with registers in the SIMD and floating-point register file 
Reverse elements in words, vector VREV32 For use with registers in the SIMD and floating-point register file 
Reverse elements in halfwords, vector VREV16 For use with registers in the SIMD and floating-point register file 
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Endianness in Advanced SIMD 


Advanced SIMD element Load/Store instructions transfer vectors of elements between memory and the SIMD and 
floating-point register file. An instruction specifies both the length of the transfer and the size of the data elements 
being transferred. This information is used by the PE to load and store data correctly in both big-endian and 
little-endian systems. 


Consider, for example, the A32 or T32 instruction: 
VLD1.16 {DQ}, [R1] 


This loads a 64-bit register with four 16-bit values. The four elements appear in the register in array order, with the 
lowest indexed element fetched from the lowest address. The order of bytes in the elements depends on the 
endianness configuration, as shown in Figure E2-3. Therefore, the order of the elements in the registers is the same 
regardless of the endianness configuration. 


64-bit register containing four 16-bit elements 





o [A[15:8] 
1 |A[7:0] 
2 |B[15:8] 
3 |B[7:0] 
4 
5 
6 

















C[15:8] 
C[7:0] 
D[15:8] 
7 |D[7:0] 


VLD1.16 {D0}, [R1] VLD1.16 {D0}, [R1] 


























0 
1 
2 
3 
4 
5 
6 
7 


Memory system with Memory system with 
little-endian addressing (LE) big-endian addressing (BE) 





Figure E2-3 Advanced SIMD byte order example for AArch32 state 
For information about the alignment of Advanced SIMD instructions see Alignment support on page E2-3834. 
The BigEndian() pseudocode function determines the current endianness of the data. 
The BigEndianReverse() pseudocode function reverses the endianness of a bitstring. 


The BigEndian() and BigEndianReverse() functions are defined in Chapter J1 Armv8 Pseudocode. 


E2.6.4 Endianness of memory-mapped peripherals 


E2-3838 


All memory-mapped peripherals defined in the Arm architecture must be little-endian. 
Peripherals to which this requirement applies include: 


e Memory-mapped register interfaces to a debugger, or to a cross-trigger interface, see Chapter H8 About the 
External Debug Registers. 


à The memory-mapped register interface to the system level implementation of the Generic Timer, see 
Chapter I2 System Level Implementation of the Generic Timer. 


è A memory-mapped register interface to the Performance Monitors, see Chapter 13 Recommended External 
Interface to the Performance Monitors. 


7 A memory-mapped register interface to the Activity Monitors, see Chapter 14 Recommended External 
Interface to the Activity Monitors. 


° Memory-mapped register interfaces to an Arm Generic Interface Controller, see the ARM* Generic Interrupt 
Controller Architecture Specification, GIC architecture version 3.0 and version 4.0. 
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° The memory-mapped register interface to an Arm trace component. See, for example, the ARM® Embedded 
Trace Macrocell Architecture Specification, ETMv4. 
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E2.7 Memory types and attributes 


In Armv8 the ordering of accesses for addresses in memory, referred to as the memory order model, is defined by 
the memory attributes. The following sections describe this model: 


Normal memory. 
Device memory on page E2-3844. 
Memory access restrictions on page E2-3849. 


E2.7.1 Normal memory 


The Normal memory type attribute applies to most memory in a system. It indicates that the hardware is permitted 
by the architecture to perform speculative data read accesses to these locations, regardless of the access permissions 
for these locations. 


The Normal memory type has the following properties: 


A write to a memory location with the Normal attribute completes in finite time. This means that it is globally 
observed for the shareability domain of the memory location in finite time. For a Non-cacheable location, the 
location is observed by all observers in finite time. 


A completed write to a memory location with the Normal attribute is globally observed for the shareability 
domain of the memory location in finite time without the need for explicit cache maintenance instructions or 
barriers. For a Non-cacheable location, the completed write is globally observed for all observers in finite 
time without the need for explicit cache maintenance instructions or barriers. 


Writes to a memory location with the Normal memory attribute that is Non-cacheable must reach the 
endpoint for that location in the memory system in finite time. 


Unaligned memory accesses can access Normal memory if the system is configured to generate such 
accesses. 


There is no requirement for the memory system beyond the PE to be able to identify the elements accessed 
by multi-register Load/Store instructions. See Multi-register loads and stores that access Normal memory on 
page E2-3844. 


Note 





The Normal memory attribute is appropriate for locations of memory that are idempotent, meaning that they 
exhibit all of the following properties: 


— Read accesses can be repeated with no side-effects. 
— Repeated read accesses return the last value written to the resource being read. 
— Read accesses can fetch additional memory locations with no side-effects. 


— Write accesses can be repeated with no side-effects if the contents of the location accessed are 
unchanged between the repeated writes or as the result of an exception, as described in this section. 


— Unaligned accesses can be supported. 


— Accesses can be merged before accessing the target memory system. 


An instruction that generates a sequence of accesses as described in Atomicity in the Arm architecture on 
page E2-3810 might be abandoned as a result of an exception being taken during the sequence of accesses. 
On return from the exception the instruction is restarted, and therefore one or more of the memory locations 
might be accessed multiple times. This can result in repeated write accesses to a location that has been 
changed between the write accesses. 





The following sections describe the other attributes for Normal memory: 


E2-3840 


Shareable Normal memory on page E2-3841. 


Non-shareable Normal memory on page E2-3842. 


Cacheability attributes for Normal memory on page E2-3842. 
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See also: 
ʻ Multi-register loads and stores that access Normal memory on page E2-3844. 
. Atomicity in the Arm architecture on page E2-3810. 


7 Memory barriers on page E2-3823. For accesses to Normal memory, a DMB instruction is required to ensure 
the required ordering. 


° Concurrent modification and execution of instructions on page E2-3812. 


Shareable Normal memory 


A Normal memory location has a Shareability attribute that is defined as one of: 


. Inner Shareable. 
° Outer Shareable. 
. Non-shareable. 


The shareability attributes define the data coherency requirements of the location, that hardware must enforce. They 
do not affect the coherency requirements of instruction fetches, see Synchronization and coherency issues between 
data and instruction accesses on page E2-3831. 





Note 


. System designers can use the Shareability attribute to specify the locations in Normal memory for which 
coherency must be maintained. However, software developers must not assume that specifying a memory 
location as Non-shareable permits software to make assumptions about the incoherency of the location 
between different PEs in a shared memory system. Such assumptions are not portable between different 
multiprocessing implementations that might use the Shareability attribute. Any multiprocessing 
implementation might implement caches that are shared, inherently, between different PEs. 


$ This architecture assumes that all PEs that use the same operating system or hypervisor are in the same Inner 
Shareable shareability domain. 





Shareable, Inner Shareable, and Outer Shareable Normal memory 
The Arm architecture abstracts the system as a series of Inner and Outer Shareability domains. 


Each Inner Shareability domain contains a set of observers that are data coherent for each member of that set for 
data accesses with the Inner Shareable attribute made by any member of that set. 


Each Outer Shareability domain contains a set of observers that are data coherent for each member of that set for 
data accesses with the Outer Shareable attribute made by any member of that set. 


The following properties also hold: 


s Each observer is only a member of a single Inner Shareability domain. 
° Each observer is only a member of a single Outer Shareability domain. 
z All observers in an Inner Shareability domain are always members of the same Outer Shareability domain. 


This means that an Inner Shareability domain is a subset of an Outer Shareability domain, although it is not 
required to be a proper subset. 


Note 


. Because all data accesses to Non-cacheable locations are data coherent to all observers, Non-cacheable 
locations are always treated as Outer Shareable. 








. The Inner Shareable domain is expected to be the set of PEs controlled by a single hypervisor or operating 
system. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. E2-3841 


Non-Confidential 


The AArch32 Application Level Memory Model 
E2.7 Memory types and attributes 


E2-3842 


The details of the use of the Shareability attributes are system-specific. Example E2-1 shows how they might be 
used. 


Example E2-1 Use of shareability attributes 


In an implementation, a particular subsystem with two clusters of PEs has the requirement that: 


e In each cluster, the data caches or unified caches of the PEs in the cluster are transparent for all data accesses 
to memory locations with the Inner Shareable attribute. 


° However, between the two clusters, the caches: 
— Are not required to be coherent for data accesses that have only the Inner Shareable attribute. 
— Are coherent for data accesses that have the Outer Shareable attribute. 


In this system, each cluster is in a different Shareability domain for the Inner Shareable attribute, but all components 
of the subsystem are in the same Shareability domain for the Outer Shareable attribute. 


A system might implement two such subsystems. If the data caches or unified caches of one subsystem are not 
transparent to the accesses from the other subsystem, this system has two Outer Shareable Shareability domains. 


Having two levels of shareability means system designers can reduce the performance and power overhead for 
shared memory locations that do not need to be part of the Outer Shareable Shareability domain. 


For Shareable Normal memory, the Load-Exclusive and Store-Exclusive synchronization primitives take account 
of the possibility of accesses by more than one observer in the same Shareability domain. 


Non-shareable Normal memory 


For Normal memory locations, the Non-shareable attribute identifies Normal memory that is likely to be accessed 
only by a single PE. 


A location in Normal memory with the Non-shareable attribute does not require the hardware to make data accesses 
by different observers coherent, unless the memory is Non-cacheable. For a Non-shareable location, if other 
observers share the memory system, software must use cache maintenance instructions, if the presence of caches 
might lead to coherency issues when communicating between the observers. This cache maintenance requirement 
is in addition to the barrier operations that are required to ensure memory ordering. 


For Non-shareable Normal memory, it is IMPLEMENTATION DEFINED whether the Load-Exclusive and 
Store-Exclusive synchronization primitives take account of the possibility of accesses by more than one observer. 


Cacheability attributes for Normal memory 


In addition to being Outer Shareable, Inner Shareable or Non-shareable, each region of Normal memory is assigned 
a Cacheability attribute that is one of: 


. Write-Through Cacheable. 
. Write-Back Cacheable. 
. Non-cacheable. 


Also, for Write-Through Cacheable and Write-Back Cacheable Normal memory regions: 
s A region might be assigned cache allocation hints for read and write accesses. 


° It is IMPLEMENTATION DEFINED whether the cache allocation hints can have an additional attribute of 
Transient or Non-transient. 


For more information see Cacheability, cache allocation hints, and cache transient hints on page G4-5690. 
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A memory location can be marked as having different cacheability attributes, for example when using aliases in a 


VA to PA mapping: 

° If the attributes differ only in the cache allocation hint this does not affect the behavior of accesses to that 
location. 

è For other cases see Mismatched memory attributes on page E2-3850. 


The cacheability attributes provide a mechanism of coherency control with observers that lie outside the 
Shareability domain of a region of memory. In some cases, the use of Write-Through Cacheable or Non-cacheable 
regions of memory might provide a better mechanism for controlling coherency than the use of hardware coherency 
mechanisms or the use of cache maintenance routines. To this end, the architecture requires the following properties 
for Non-cacheable or Write-Through Cacheable memory: 


° A completed write to a memory location that is Non-cacheable or Write-Through Cacheable for a level of 
cache made by an observer accessing the memory system inside the level of cache is visible to all observers 
accessing the memory system outside the level of cache without the need of explicit cache maintenance. 


à A completed write to a memory location that is Non-cacheable for a level of cache made by an observer 
accessing the memory system outside the level of cache is visible to all observers accessing the memory 
system inside the level of cache without the need of explicit cache maintenance. 


Note 


Implementations can use the cache allocation hints to indicate a probable performance benefit of caching. For 
example, a programmer might know that a piece of memory is not going to be accessed again and would be better 
treated as Non-cacheable. The distinction between memory regions with attributes that differ only in the cache 
allocation hints exists only as a hint for performance. 








For Normal memory, the Arm architecture provides cacheability attributes that are defined independently for each 
of two conceptual levels of cache, the inner and the outer cache. The relationship between these conceptual levels 
of cache and the implemented physical levels of cache is IMPLEMENTATION DEFINED, and can differ from the 
boundaries between the Inner and Outer Shareability domains. However: 


s Inner refers to the innermost caches, meaning the caches that are closest to the PE, and always includes the 
lowest level of cache. 

: No cache that is controlled by the Inner cacheability attributes can lie outside a cache that is controlled by the 
Outer cacheability attributes. 

. An implementation might not have any outer cache. 


Example E2-2, Example E2-3 on page E2-3844, and Example E2-4 on page E2-3844 describe the possible ways of 
implementing a system with three levels of cache, level 1 (L1) to level 3 (L3). 





Note 
° L1 cache is the level closest to the PE, see Memory hierarchy on page E2-3829. 
- When managing coherency, system designs must consider both the inner and outer cacheability attributes, as 


well as the Shareability attributes. This is because hardware might have to manage the coherency of caches 
at one conceptual level, even when another conceptual level has the Non-cacheable attribute. 





Example E2-2 Implementation with two inner and one outer cache levels 


Implement the three levels of cache in the system, L1 to L3, with: 
s The Inner cacheability attribute applied to L1 and L2 cache. 
` The Outer cacheability attribute applied to L3 cache. 
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Example E2-3 Implementation with three inner and no outer cache levels 


Implement the three levels of cache in the system, L1 to L3, with the Inner cacheability attribute applied to L1, L2, 
and L3 cache. Do not use the Outer cacheability attribute. 


Example E2-4 Implementation with one inner and two outer cache levels 


Implement the three levels of cache in the system, L1 to L3, with: 
: The Inner cacheability attribute applied to L1 cache. 
è The Outer cacheability attribute applied to L2 and L3 cache. 


Multi-register loads and stores that access Normal memory 


For all instructions that load or store more than one general-purpose register from an Exception level there is no 
requirement for the memory system beyond the PE to be able to identify the size of the elements accessed by these 
load or store instructions. 


For all instructions that load or store more than one general-purpose register from an Exception level the order in 
which the registers are accessed is not defined by the architecture. 


For all instructions that load or store one or more registers from the SIMD and floating-point register file from an 
Exception level there is no requirement for the memory system beyond the PE to be able to identify the size of the 
element accessed by these load or store instructions. 


Device memory 


The Device memory type attributes define memory locations where an access to the location can cause side-effects, 
or where the value returned for a load can vary depending on the number of loads performed. Typically, the Device 
memory attributes are used for memory-mapped peripherals and similar locations. 


The attributes for Armv8 Device memory are: 
Gathering Identified as G or nG, see Gathering on page E2-3846. 
Reordering Identified as R or nR, see Reordering on page E2-3847. 


Early Write Acknowledgement 
Identified as E or nE, see Early Write Acknowledgement on page E2-3848. 


The Armv8 Device memory types are: 


Device-nGnRnE Device non-Gathering, non-Reordering, No Early write acknowledgement. 


Equivalent to the Strongly-ordered memory type in earlier versions of the architecture. 


Device-nGnRE Device non-Gathering, non-Reordering, Early Write Acknowledgement. 


Equivalent to the Device memory type in earlier versions of the architecture. 


Device-nGRE Device non-Gathering, Reordering, Early Write Acknowledgement. 


Armv§8 adds this memory type to the translation table formats found in earlier versions of 
the architecture. The use of barriers is required to order accesses to Device-nGRE memory. 


The Device-nGRE memory type is introduced into the AArch32 translation table formats 
when the PE is using the Long Descriptor Translation Table format. 


Device-GRE Device Gathering, Reordering, Early Write Acknowledgement. 
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Armv§8 adds this memory type to the translation table formats found in earlier versions of 
the architecture. Device-GRE memory has the fewest constraints. It behaves similar to 
Normal memory, with the restriction that speculative accesses to Device-GRE memory is 
forbidden. 


The Device-GRE memory type is introduced into the AArch32 translation table formats 
when the PE is using the Long Descriptor Translation Table format. 


Collectively these are referred to as any Device memory type. Going down the list, the memory types are described 
as getting weaker; conversely the going up the list the memory types are described as getting stronger. 


Note 





As the list of types shows, these additional attributes are hierarchical. For example, a memory location that 
permits Gathering must also permit Reordering and Early Write Acknowledgement. 


The architecture does not require an implementation to distinguish between each of these memory types and 
Arm recognizes that not all implementations will do so. The subsection that describes each of the attributes, 
describes the implementation rules for the attribute. 


Earlier versions of the Arm architecture defined the following memory types: 
—  Strongly-ordered memory. This is the equivalent of the Device-nGnRnE memory type. 
— Device memory. This is the equivalent of the Device-nGnRE memory type. 





All of these memory types have the following properties: 


Speculative data accesses are not permitted to any memory location with any Device memory attribute. This 
means that each memory access to any Device memory type must be one that would be generated by a simple 
sequential execution of the program. 


An exception to this applies: 


— Reads generated by the Advanced SIMD and floating-point instructions can access bytes that are not 
explicitly accessed by the instruction if the bytes accessed are in a 16-byte window, aligned to 
16-bytes, that contains at least one byte that is explicitly accessed by the instruction. 


Note 


— Aninstruction that generates a sequence of accesses as described in Atomicity in the Arm architecture 
on page E2-3810 might be abandoned as a result of an exception being taken during the sequence of 
accesses. On return from the exception the instruction is restarted, and therefore one or more of the 
memory locations might be accessed multiple times. This can result in repeated accesses to a location 
where the program only defines a single access. For this reason, Arm strongly recommends that no 
accesses to Device memory are performed from a single instruction that spans the boundary of a 
translation granule or which in some other way could lead to some of the accesses being aborted. 





— Write speculation that is visible to other observers is prohibited for all memory types. 





A write to a memory location with any Device memory attribute completes in finite time. This means that it 
is globally observed for all observers in the system in finite time. 


Ifa location with any Device memory attribute changes without an explicit write by an observer, this change 
must also be globally observed for all observers in the system in finite time. Such a change might occur in a 
peripheral location that holds status information. 


A completed write to a memory location with any Device memory attribute is globally observed for all 
observers in finite time without the need for explicit maintenance. 


Data accesses to memory locations are coherent for all observers in the system, and correspondingly are 
treated as being Outer Shareable. 


A memory location with any Device memory attribute cannot be allocated into a cache. 


Writes to a memory location with any Device memory attribute must reach the endpoint for that address in 
the memory system in finite time. Typically, the endpoint is a peripheral or some physical memory. 
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° All accesses to memory with any Device memory attribute must be aligned. Any unaligned access generates 
an Alignment fault at the first stage of translation that defined the location as being Device. 


Note 


In the Non-secure PL1&0 translation regime in systems where HCR.TGE==1 and HCR.DC==0, any 
Alignment fault that results from the fact that all locations are treated as Device is a fault at the first stage of 
translation. This causes the value of HSR.ISS.[24] to be 0. 





s Hardware does not prevent speculative instruction fetches from a memory location with any of the Device 
memory attributes unless the memory location is also marked as Execute-never for all Exception levels. 


Note 


This means that to prevent speculative instruction fetches from memory locations with Device memory 
attributes, any location that is assigned any Device memory type must also be marked as Execute-never for 
all Exception levels. Failure to mark a memory location with any Device memory attribute as Execute-never 
for all Exception levels is a programming error. 








See also Memory access restrictions on page E2-3849. 


The memory types for Translation table walks cannot be defined as any Device memory type within the TCR. For 
the Non-secure EL1&0 translation regime, the memory accesses made during a stage 1 translation table walk are 
subject to a stage 2 translation, and as a result of this second stage of translation, the accesses from the first stage 
translation table walk might be made to memory locations with any Device memory type. These accesses might be 
made speculatively. When the value of the HCR.PTW bit is 1, a stage 2 permission fault is generated if a first stage 
translation table walk is made to any Device memory type. 


For instruction fetches, if branches cause the program counter to point to an area of memory with the Device 
attribute which is not marked as Execute-never for the current Exception level, an implementation can either: 


è Treat the instruction fetch as if it were to a memory location with the Normal Non-cacheable attribute. 
$ Take a Permission fault. 

Gathering 

In the Device memory attribute: 

G Indicates that the location has the Gathering attribute. 

nG Indicates that the location does not have the Gathering attribute, meaning it is non-Gathering. 


The Gathering attribute determines whether it is permissible for either: 


° Multiple memory accesses of the same type, read or write, to the same memory location to be merged into a 
single transaction. 


è Multiple memory accesses of the same type, read or write, to different memory locations to be merged into 
a single memory transaction on an interconnect. 


For memory types with the Gathering attribute, either of these behaviors is permitted, provided that the ordering and 
coherency rules of the memory location are followed. 


For memory types with the non-Gathering attribute, neither of these behaviors is permitted. As a result: 


. The number of memory accesses that are made corresponds to the number that would be generated by a 
simple sequential execution of the program. 


s All access occur at their programmed size, except that there is no requirement for the memory system beyond 
the PE to be able to identify the elements accessed by multi-register Load/Store instructions. See 
Multi-register loads and stores that access Device memory on page E2-3848. 


Gathering between memory accesses separated by a memory barrier that affects those memory accesses is not 
permitted. 


Gathering between two memory accesses generated by a Load-Acquire/Store-Release is not permitted. 
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A read from a memory location with the non-Gathering attribute cannot come from a cache or a buffer, but must 
come from the endpoint for that address in the memory system. Typically this is a peripheral or physical memory. 


Note 


° A read from a memory location with the Gathering attribute can come from intermediate buffering of a 
previous write, provided that: 





— The accesses are not separated by a DMB or DSB barrier that affects both of the accesses. 


— The accesses are not separated by other ordering constructions that require that the accesses are in 
order. Such a construction might be a combination of Load-Acquire and Store-Release. 


— The accesses are not generated by a Store-Release instruction. 


° The Arm architecture only defines programmer visible behavior. Therefore, gathering can be performed if a 
programmer cannot tell whether gathering has occurred. 





An implementation is permitted to perform an access with the Gathering attribute in a manner consistent with the 
requirements specified by the non-Gathering attribute. 


An implementation is not permitted to perform an access with the non-Gathering attribute in a manner consistent 
with the relaxations allowed by the Gathering attribute. 


Reordering 


In the Device memory attribute: 
R Indicates that the location has the Reordering attribute. 
nR Indicates that the location does not have the Reordering attribute, meaning it is non-Reordering. 


For all memory types with the non-Reordering attribute, the order of memory accesses arriving at a single peripheral 
of IMPLEMENTATION DEFINED size, as defined by the peripheral, must be the same order that occurs in a simple 
sequential execution of the program. That is, the accesses appear in program order. This ordering applies to all 
accesses using any of the memory types with the non-Reordering attribute. As a result, if there is a mixture of 
Device-nGnRE and Device-nGnRnE accesses to the same peripheral, these occur in program order. If the memory 
accesses are not to a peripheral, then this attribute imposes no restrictions. 





Note 


° The IMPLEMENTATION DEFINED size of the single peripheral is the same as applies for the ordering guarantee 
provided by the DMB instruction. 


° The Arm architecture only defines programmer visible behavior. Therefore, reordering can be performed if 
a programmer cannot tell whether reordering has occurred. 


An implementation is permitted to perform an access with the Reordering attribute in a manner consistent with the 
requirements specified by the non-Reordering attribute. 


An additional relaxation is that an implementation is not permitted to perform an access with the non-Reordering 
attribute in a manner consistent with the relaxations allowed by the Reordering attribute. 


The non-Reordering attribute does not require any additional ordering, other than that which applies to Normal 

memory, between: 

° Accesses to one physical address with the non-Reordering attribute and accesses to a different physical 
address with the Reordering attribute. 

° Access to one physical address with the non-Reordering attribute and access to a different physical address 
to Normal memory. 

° Accesses with the non-Reordering attribute and accesses to different peripherals of IMPLEMENTATION 
DEFINED size. 
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Early Write Acknowledgement 


In the Device memory attribute: 
E Indicates that the location has the Early Write Acknowledgement attribute. 
nE Indicates that the location has the No Early Write Acknowledgement attribute. 


For memory system endpoints where the system architecture in which the PE is operating requires that 
acknowledgement of a write comes from the endpoint, assigning the No Early Write Acknowledgement attribute to 
a Device memory location guarantees that: 


° Only the endpoint of the write access returns a write acknowledgement of the access. 
a No earlier point in the memory system returns a write acknowledgement. 


This means that a DSB barrier instruction, executed by the PE that performed the write to the No Early Write 
Acknowledgement Location, completes only after the write has reached its endpoint in the memory system. 


Peripherals are an example of system endpoints that require that the acknowledgement of a write comes from the 
endpoint. 





Note 


` The Early Write Acknowledgement attribute only affects where the endpoint acknowledgement is returned 
from, and does not affect the ordering of arrival at the endpoint between accesses, which is determined by 
either the Device Reordering attribute, or the use of barriers to create order. 


$ The areas of the physical memory map for which write acknowledgement from the endpoint is required is 
outside the scope of the Arm Architecture definition and must be defined as part of the system architecture 
in which the PE is operating. In particular, regions of memory handled as PCIe configuration writes are 
expected to support write acknowledgement from the endpoint. 


7 Arm recognizes that not all areas of a physical memory map will be capable of supporting write 
acknowledgement from the endpoint. In particular, Arm expects that regions of memory handled as posted 
writes under PCIe will not support write acknowledgement from the endpoint. 


s For maximum software compatibility, Arm strongly recommends that all peripherals for which standard 
software drivers expect that the use of a DSB instruction will determine that a write has reached its endpoint 
are placed in areas of the physical memory map that support write acknowledgement from the endpoint. 





Multi-register loads and stores that access Device memory 


For all instructions that load or store more than one general-purpose register there is no requirement for the memory 
system beyond the PE to be able to identify the size of the elements accessed by these load and store instructions. 


For all instructions that load or store one or more registers from the SIMD and floating-point register file there is 
no requirement for the memory system beyond the PE to be able to identify the size of the element accessed by these 
load and store instructions. 


For an LDRD, STRD, or LDM instruction with a register list that includes the PC, or an STM instruction with a register list 
that includes the PC, the order in which the registers are accessed is not defined by the architecture. 


For a load or store of an Advanced SIMD element or structure, the order in which the registers are accessed is not 
defined by the architecture. 


For a VLDM and VSTM instruction with a register list that does not include the PC, all registers are accessed in ascending 
address order for accesses to Device memory with the non-Reordering attribute. 


For a LDM or STM instruction with a register list that does not include the PC: 


è When ARMv8.2-LSMAOC is not implemented, and when ARMv8.2-LSMAOC is implemented and the 
value of the applicable LSMAOE field is 1, all registers are accessed in ascending address order for accesses 
to Device memory with the non-Reordering attribute. 


. When ARMv8.2-LSMAOC is implemented and the value of the applicable LSMAOE field is 0, no memory 
accesses are required to be ordered. 
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è When ARMv8.2-LSMAOC is implemented and the value of the applicable nTLSMD field is 0, any memory 
access to an address that the stage 1 translation assigns as Device-nGRE, Device-nGnRE, or Device-nGnRnE 
generates an Alignment fault. 


The applicable LSMAOE or nTLSMD field is the field in the SCTLR_EL1, SCTLR_EL2, HSCTLR, or SCTLR 
register that applies to the Exception level and Security state at which the LDM or STM instruction is executed. 


Armv8.2 deprecates software relying on accesses to Device memory made by a single LDM or STM instruction not 
being reordered. 


E2.7.3 Memory access restrictions 


ARM DDI 0487E.a 
ID070919 


The following restrictions apply to memory accesses: 


° For accesses to any two bytes, p and q, that are generated by the same instruction: 


— The bytes p and q must have the same memory type and Shareability attributes. otherwise the results 
are CONSTRAINED UNPREDICTABLE. For example, an LDC, LDM, LDRD STC, STM or STRD instruction, or an 
unaligned load or store that spans the boundary between Normal memory and Device memory is 
CONSTRAINED UNPREDICTABLE. 


— Except for possible differences in the cache allocation hints, Arm deprecates having different 
cacheability attributes for bytes p and q. 


For the permitted CONSTRAINED UNPREDICTABLE behavior, see Crossing a page boundary with different 
memory types or Shareability attributes on page K1-7617. 


e If the accesses of an instruction that causes multiple accesses to any type of Device memory cross a 4KB 
address boundary then behavior is CONSTRAINED UNPREDICTABLE and Crossing a 4KB boundary with a 
Device access on page K1-7617 describes the permitted behaviors. 





Note 


— The boundary referred to is between two Device memory regions that are both of 4KB and aligned to 
4KB. 


— This restriction means it is important that an access to a volatile memory device is not made using a 
single instruction that crosses a 4KB address boundary. 


—  Armexpects this restriction to constrain the placing of volatile memory devices in the system memory 
map, rather than expecting a compiler to be aware of the alignment of memory accesses. 
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Mismatched memory attributes 


In the Armv8 architecture mismatched memory attributes are controlled by privileged software. For more 
information, see Chapter G5 The AArch32 Virtual Memory System Architecture. 


Physical memory Locations are accessed with mismatched attributes if all accesses to the Location do not use a 
common definition of all of the following attributes of that Location: 


° Memory type, Device or Normal. 
7 Shareability. 
: Cacheability, for the same level of the inner or outer cache, but excluding any cache allocation hints. 


Collectively these are referred to as memory attributes. 





Note 


In this document, the terms location and memory location refer to any byte within the current coherency granule 
and are used interchangeably. 





When a memory Location is accessed with mismatched attributes the only software visible effects are one or more 
of the following: 
š Uniprocessor semantics for reads and writes to that memory Location might be lost. This means: 


— Aread of the memory Location by one agent might not return the value most recently written to that 
memory Location by the same agent. 


— Multiple writes to the memory Location by one agent with different memory attributes might not be 
ordered in program order. 


s There might be a loss of coherency when multiple agents attempt to access a memory Location. 
à There might be a loss of properties derived from the memory type, as described in later bullets in this section. 
. If all Load-Exclusive/Store-Exclusive instructions executed across all threads to access a given memory 


Location do not use consistent memory attributes, the Exclusives monitor state becomes UNKNOWN. 


° Bytes written without the Write-Back cacheable attribute within the same Write-Back granule as bytes 
written with the Write-Back cacheable attribute might have their values reverted to the old values as a result 
of cache Write-Back. 


The loss of properties associated with mismatched memory type attributes refers only to the following properties of 
Device memory that are additional to the properties of Normal memory: 


° Prohibition of speculative read accesses. 
7 Prohibition on Gathering. 
. Prohibition on Re-ordering. 


For the following situations, when a physical memory Location is accessed with mismatched attributes, a more 
restrictive set of behaviors applies. The description of each situation also describes the behaviors that apply: 


1. If the only memory type mismatch associated with a memory Location across all users of the memory 
Location is between different types of Device memory, then all accesses might take the properties of the 
weakest Device memory type. 


2. Any agent that reads that memory Location using the same common definition of the Memory type, 
Shareability and Cacheability attributes is guaranteed to access it coherently, to the extent required by that 
common definition of the memory attributes, only if all the following conditions are met: 


s All writes are performed to an alias of the memory Location that uses the same definition of the 
Memory type, Shareability and Cacheability attributes. 
. Either: 


— Inthe Non-secure PL1&0 translation regime, HCR2. MIOCNCE has a value of 0. 


— Allaliases with write permission have the Inner Cacheability attribute the same as the Outer 
Cacheability attribute. 
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. Either: 


— All writes are performed to an alias of the memory Location that has Inner Cacheability and 
Outer Cacheability attributes both as Non-cacheable. 


—  Allaliases to a memory Location use a definition of the Shareability attributes that encompasses 
all the agents with permission to access the Location. 


3. The possible software-visible effects caused by mismatched attributes for a memory Location are defined 
more precisely if all of the mismatched attributes define the memory Location as one of: 


° Any Device memory type. 
. Normal Inner Non-cacheable, Outer Non-cacheable memory. 


In these cases, the only permitted software-visible effects of the mismatched attributes are one or more of the 
following: 


° Possible loss of properties derived from the memory type when multiple agents attempt to access the 
memory Location. 


° Possible reordering of memory transactions to the same memory Location with different memory 
attributes, potentially leading to a loss of coherency or uniprocessor semantics. Any possible loss of 
coherency or uniprocessor semantics can be avoided by inserting DMB barrier instructions between 
accesses to the same memory Location that might use different attributes. 


Where there is a loss of the uniprocessor semantics, ordering, or coherency, the following approaches can be used: 


1. If the mismatched attributes for a memory Location all assign the same Shareability attribute to a Location 
that has a cacheable attribute, any loss of uniprocessor semantics, ordering, or coherency within a 
Shareability domain can be avoided by use of software cache management. To do so, software must use the 
techniques that are required for the software management of the ordering or coherency of cacheable 
Locations between agents in different shareability domains. This means: 


a Before writing to a cacheable Location not using the Write-Back attribute, software must invalidate, 
or clean, a Location from the caches if any agent might have written to the Location with the 
Write-Back attribute. This avoids the possibility of overwriting the Location with stale data. 


. After writing to a cacheable Location with the Write-Back attribute, software must clean the Location 
from the caches, to make the write visible to external memory. 


° Before reading the Location with a cacheable attribute, software must invalidate, or clean and 
invalidate, the Location from the caches, to ensure that any value held in the caches reflects the last 
value made visible in external memory. 


° Executing a DMB barrier instruction, with scope that applies to the common Shareability of the accesses, 
between any accesses to the same cacheable Location that use different attributes. 





Note 


In AArch32 state, cache maintenance instructions can only be accessed from an Exception level that is higher 
than ELO, and therefore require a system call. For information on system calls, see Exception-generating and 
exception-handling instructions on page F 1-3885. For information about the AArch32 cache maintenance 
instructions, see AArch32 cache and branch predictor support on page G4-5687. 





In all cases: 


$ Location refers to any byte within the current coherency granule. 

. A clean and invalidate instruction can be used instead of a clean instruction, or instead of an invalidate 
instruction. 

- In the sequences outlined in this section, all cache maintenance instructions and memory transactions 


must be completed, or ordered by the use of barrier operations, if they are not naturally ordered by the 
use of a common address, see Ordering of cache and branch predictor maintenance instructions on 
page G4-5705. 
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Note 


With software management of coherency, race conditions can cause loss of data. A race condition occurs 
when different agents write simultaneously to bytes that are in the same Location, and the invalidate, write, 
clean sequence of one agent overlaps with the equivalent sequence of another agent. A race condition also 
occurs if the first operation of either sequence is a clean, rather than an invalidate. 





2. If the mismatched attributes for a Location mean that multiple cacheable accesses to the Location might be 
made with different Shareability attributes, then ordering and coherency are guaranteed only if: 


° Each PE that accesses the Location with a cacheable attribute performs a clean and invalidate of the 
Location before and after accessing that Location. 


° A DMB barrier with scope that covers the full Shareability of the accesses is placed between any accesses 
to the same memory Location that use different attributes. 


Note 


The Note in rule 1 of this list, about possible race conditions, also applies to this rule. 








In addition, if multiple agents attempt to use Load-Exclusive or Store-Exclusive instructions to access a Location, 
and the accesses from the different agents have different memory attributes associated with the Location, the 
Exclusives monitor state becomes UNKNOWN. 


Arm strongly recommends that software does not use mismatched attributes for aliases of the same Location. An 
implementation might not optimize the performance of a system that uses mismatched aliases. 
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Armv8 provides non-blocking synchronization of shared memory, using synchronization primitives. The 
information in this section about memory accesses by synchronization primitives applies to accesses to both Normal 
and Device memory. 


Note 


Use of the Armv8 synchronization primitives scales for multiprocessing system designs. 








Table E2-6 shows the synchronization primitives and the associated CLREX instruction. 


Table E2-6 Synchronization primitives and associated instruction, T32 and A32 instruction sets 
































Transaction size Additional semantics Load-Exclusive4 Store-Exclusive2 Other@ 

Byte - LDREXB STREXB - 
Load-Acquire/Store-Release LDAEXB STLEXB - 

Halfword - LDREXH STREXH - 
Load-Acquire/Store-Release LDAEXH STLEXH - 

Word = LDREX STRE 7 
Load-Acquire/Store-Release — LDAEX STLEX - 

Doubleword - LDREXD STREXD - 
Load-Acquire/Store-Release — LDAEXD STLEXD - 

None Clear-Exclusive - - CLREX 





a. Instruction in the T32 and A32 instruction sets. 


Except for the row showing the CLREX instruction, the two instructions in a single row are a 
Load-Exclusive/Store-Exclusive instruction pair. The model for the use of a Load-Exclusive/Store-Exclusive 
instruction pair accessing a non-aborting memory address x is: 


e The Load-Exclusive instruction reads a value from memory address x. 


. The corresponding Store-Exclusive instruction succeeds in writing back to memory address x only ifno other 
observer, process, or thread has performed a more recent store to address x. The Store-Exclusive instruction 
returns a status bit that indicates whether the memory write succeeded. 


A Load-Exclusive instruction marks a small block of memory for exclusive access. The size of the marked block is 
IMPLEMENTATION DEFINED, see Marking and the size of the marked memory block on page E2-3859. A 
Store-Exclusive instruction to any address in the marked block clears the marking. 


Note 


In this section, the term PE includes any observer that can generate a Load-Exclusive or a Store-Exclusive 
instruction. 








The following sections give more information: 

$ Exclusive access instructions and Non-shareable memory locations on page E2-3854. 
7 Exclusive access instructions and shareable memory locations on page E2-3855. 

. Marking and the size of the marked memory block on page E2-3859. 

7 Context switch support on page E2-3859. 

è Load-Exclusive and Store-Exclusive instruction usage restrictions on page E2-3859. 

` Use of WFE and SEV instructions by spin-locks on page E2-3862. 
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Exclusive access instructions and Non-shareable memory locations 


For memory locations for which the Shareability attribute is Non-shareable, the exclusive access instructions rely 
on a local Exclusives monitor, or local monitor, that marks any address from which the PE executes a 
Load-Exclusive instruction. Any non-aborted attempt by the same PE to use a Store-Exclusive instruction to modify 
any address is guaranteed to clear the marking. 

A Load-Exclusive instruction performs a load from memory, and: 

° The executing PE marks the physical memory address for exclusive access. 

è The local monitor of the executing PE transitions to the Exclusive Access state. 


A Store-Exclusive instruction performs a conditional store to memory that depends on the state of the local monitor: 


If the local monitor is in the Exclusive Access state 


. If the address of the Store-Exclusive instruction is the same as the address that has been 
marked in the monitor by an earlier Load-Exclusive instruction, then the store occurs. 
Otherwise, it is IMPLEMENTATION DEFINED whether the store occurs. 


$ A status value is returned to a register: 
— Ifthe store took place the status value is 0. 
— Otherwise, the status value is 1. 


. The local monitor of the executing PE transitions to the Open Access state. 


When an Exclusives monitor is in the Exclusive Access state the monitor is set. 


If the local monitor is in the Open Access state 


: No store takes place. 
- A status value of 1 is returned to a register. 
s The local monitor remains in the Open Access state. 


When an Exclusives monitor is in the Exclusive Access state the monitor is clear. 
The Store-Exclusive instruction defines the register to which the status value is returned. 


When a PE writes using any instruction other than a Store-Exclusive instruction: 


. If the write is to a PA that is not marked as Exclusive Access by its local monitor and that local monitor is in 
the Exclusive Access state it is IMPLEMENTATION DEFINED whether the write affects the state of the local 
monitor. 

s If the write is to a PA that is marked as Exclusive Access by its local monitor it is IMPLEMENTATION DEFINED 


whether the write affects the state of the local monitor. 


It is IMPLEMENTATION DEFINED whether a store to a marked PA causes a mark in the local monitor to be cleared if 
that store is by an observer other than the one that caused the PA to be marked. 


Figure E2-4 on page E2-3855 shows the state machine for the local monitor and the effect of each of the operations 
shown in the figure. 
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LoadExc]l (x) LoadExc] (x) 
y 
Open Exclusive }¢«— 
ie Access Access 
x x 
StoreExcl (x) Store(Marked_address) * Store(Marked_address) * 
Store(x) Store(!Marked_address) * Store(!Marked_address) * 

CLREX StoreExcl (Marked_address) 

StoreExcl (!Marked_address) 

CLREX 


Operations marked * are possible alternative IMPLEMENTATION DEFINED options. 

In the diagram: LoadExcl represents any Load-Exclusive instruction 
StoreExcl represents any Store-Exclusive instruction 
Store represents any other store instruction. 


Any LoadExcl operation updates the marked address to the most significant bits of the address x used for the operation. 


Figure E2-4 Local monitor state machine diagram 


For more information about marking see Marking and the size of the marked memory block on page E2-3859. 


Note 
For the local monitor state machine, as shown in Figure E2-4: 





. The IMPLEMENTATION DEFINED options for the local monitor are consistent with the local monitor being 
constructed so that it does not hold any PA, but instead treats any access as matching the address of the 
previous Load-Exclusive instruction. 


© A local monitor implementation can be unaware of Load-Exclusive and Store-Exclusive instructions from 
other PEs. 
` The architecture does not require a load instruction, by another PE, that is not a Load-Exclusive instruction, 


to have any effect on the local monitor. 


° It is IMPLEMENTATION DEFINED whether the transition from Exclusive Access to Open Access state occurs 
when the Store or StoreExc] is from another observer. 





Changes to the local monitor state resulting from speculative execution 


The architecture permits a local monitor to transition to the Open Access state as a result of speculation, or from 
some other cause. This is in addition to the transitions to Open Access state caused by the architectural execution 
of an operation shown in Figure E2-4. 


An implementation must ensure that: 


° The local monitor cannot be seen to transition to the Exclusive Access state except as a result of the 
architectural execution of one of the operations shown in Figure E2-4. 


è Any transition of the local monitor to the Open Access state not caused by the architectural execution of an 
operation shown in Figure E2-4 must not indefinitely delay forward progress of execution. 
E2.9.2 Exclusive access instructions and shareable memory locations 


In the context of this section, a shareable memory location is a memory location that has, or is treated as if it has, a 
Shareability attribute of Inner Shareable or Outer Shareable. 
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For shareable memory locations, exclusive access instructions rely on: 


$ A local monitor for each PE in the system, that marks any address from which the PE executes a 
Load-Exclusive. The local monitor operates as described in Exclusive access instructions and Non-shareable 
memory locations on page E2-3854, except that for shareable memory any Store-Exclusive is then subject to 
checking by the global monitor if it is described in that section as doing at least one of the following: 


— Updating memory. 
— Returning a status value of 0. 


The local monitor can ignore accesses from other PEs in the system. 


a A global monitor that marks a PA as exclusive access for a particular PE. This marking is used later to 
determine whether a Store-Exclusive to that address that has not been failed by the local monitor can occur. 
Any successful write to the marked block by any other observer in the Shareability domain of the memory 
location is guaranteed to clear the marking. For each PE in the system, the global monitor: 
— Can hold at least one marked block. 


— Maintains a state machine for each marked block it can hold. 


Note 


For each PE, the architecture only requires global monitor support for a single marked address. Any situation 
that might benefit from the use of multiple marked addresses on a single PE is CONSTRAINED 
UNPREDICTABLE, see Load-Exclusive and Store-Exclusive instruction usage restrictions on page E2-3859. 








Note 


The global monitor can either reside in a block that is part of the hardware on which the PE executes or exist as a 
secondary monitor at the memory interfaces. The IMPLEMENTATION DEFINED aspects of the monitors mean that the 
global monitor and local monitor can be combined into a single unit, provided that the unit performs the global 
monitor and local monitor functions defined in this manual. 








For shareable memory locations, in some implementations and for some memory types, the properties of the global 
monitor require functionality outside the PE. Some system implementations might not implement this functionality 
for all locations of memory. In particular, this can apply to: 


a Any type of memory in the system implementation that does not support hardware cache coherency. 


° Non-cacheable memory, or memory treated as Non-cacheable, in an implementation that does support 
hardware cache coherency. 


In such a system, it is defined by the system: 





s Whether the global monitor is implemented. 
7 If the global monitor is implemented, which address ranges or memory types it monitors. 
Note 


To support the use of the Load-Exclusive/Store-Exclusive mechanism when address translation is disabled, a system 
might define at least one location of memory, of at least the size of the translation granule, in the system memory 
map to support the global monitor for all PEs within a common Inner Shareable domain. However, this is not an 
architectural requirement. Therefore, architecturally-compliant software that requires mutual exclusion must not 
rely on using the Load-Exclusive/Store-Exclusive mechanism, and must instead use a software algorithm such as 
Lamport’s Bakery algorithm to achieve mutual exclusion. 





Because implementations can choose which memory types are treated as Non-cacheable, the only memory types for 
which it is architecturally guaranteed that a global Exclusives monitor is implemented are: 


° Inner Shareable, Inner Write-Back, Outer Write-Back Normal memory with Read allocation hint and Write 
allocation hint and not transient. 


à Outer Shareable, Inner Write-Back, Outer Write-Back Normal memory with Read allocation hint and Write 
allocation hints and not transient. 
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If the global monitor is not implemented for an address range or memory type, then performing a 
Load-Exclusive/Store-Exclusive instruction to such a location has one or more of the following effects: 


à The instruction generates an External abort. 
- The instruction generates an IMPLEMENTATION DEFINED MMU fault. This is reported using the Fault status 
code of: 


—  DFSR.STATUS = 0b110101 when using the Long-descriptor translation table format. The fault can also 
be reported in the HSR.ISS[5:0] field for exceptions to Hyp mode. 


—  DFSR.FS = 0b10101 when using the Short-descriptor translation table format. 
If the IMPLEMENTATION DEFINED MMU fault is generated for the Non-secure PL1&0 translation regime then: 


— Ifthe fault is generated because of the memory type defined in the first stage of translation, or if the 
second stage of translation is disabled, then this is a first stage fault and the exception is taken to EL1. 


— Otherwise, the fault is a second stage fault and the exception is taken to EL2. 
The priority of this fault is IMPLEMENTATION DEFINED. 
$ The instruction is treated as a NOP. 


7 The Load-Exclusive instruction is treated as if it were accessing a Non-shareable location, but the state of the 
local monitor becomes UNKNOWN. 


$ The Store-Exclusive instruction is treated as if it were accessing a Non-shareable location, but the state of the 
local monitor becomes UNKNOWN. 


s The value held in the result register of the Store-Exclusive instruction becomes UNKNOWN. 
In addition, for write transactions generated by non-PE observers that do not implement exclusive accesses or other 


atomic access mechanisms, the effect that writes have on the global and local monitors used by an Arm PE is 
IMPLEMENTATION DEFINED. The writes might not clear the global monitors of other PEs for: 


° Some address ranges. 
° Some memory types. 


Operation of the global Exclusives monitor 


A Load-Exclusive instruction from shareable memory performs a load from memory, and causes the PA of the 
access to be marked as exclusive access for the requesting PE. This access can also cause the exclusive access mark 
to be removed from any other PA that has been marked by the requesting PE. 


Note 


The global monitor only supports a single outstanding exclusive access to shareable memory for each PE. 








A Load-Exclusive instruction by one PE has no effect on the global monitor state for any other PE. 
A Store-Exclusive instruction performs a conditional store to memory: 


è The store is guaranteed to succeed only if the PA accessed is marked as exclusive access for the requesting 
PE and both the local monitor and the global monitor state machines for the requesting PE are in the 
Exclusive Access state. In this case: 


— A status value of 0 is returned to a register to acknowledge the successful store. 
— The final state of the global monitor state machine for the requesting PE is IMPLEMENTATION DEFINED. 
— Ifthe address accessed is marked for exclusive access in the global monitor state machine for any other 


PE then that state machine transitions to Open Access state. 


. If no address is marked as exclusive access for the requesting PE, the store does not succeed: 
— A status value of 1 is returned to a register to indicate that the store failed. 
— The global monitor is not affected and remains in Open Access state for the requesting PE. 

$ Ifa different PA is marked as exclusive access for the requesting PE, it is IMPLEMENTATION DEFINED whether 
the store succeeds or not: 


— Ifthe store succeeds a status value of 0 is returned to a register, otherwise a value of 1 is returned. 
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— Ifthe global monitor state machine for the PE was in the Exclusive Access state before the 
Store-Exclusive instruction it is IMPLEMENTATION DEFINED whether that state machine transitions to 
the Open Access state. 


The Store-Exclusive instruction defines the register to which the status value is returned. 


Ina shared memory system, the global monitor implements a separate state machine for each PE in the system. The 
state machine for accesses to shareable memory by PE(n) can respond to all the shareable memory accesses visible 
to it. This means it responds to: 


z Accesses generated by PE(n). 


° Accesses generated by the other observers in the Shareability domain of the memory location. These accesses 
are identified as (!n). 


In a shared memory system, the global monitor implements a separate state machine for each observer that can 
generate a Load-Exclusive or a Store-Exclusive instruction in the system. 


A global monitor: 
š In the Exclusive Access state is set. 
s In the Open Access state is clear. 


Clear global monitor event 


Whenever the global monitor state for a PE changes from Exclusive access to Open access, an event is generated 
and held in the Event register for that PE. This register is used by the Wait for Event mechanism, see Wait For Event 
and Send Event on page G1-5562. 


Figure E2-5 shows the state machine for PE(n) in a global monitor. 
























































LoadExcl (x,n) LoadExcl (x,n) 
Y 
Open Exclusive }¢— 
m>] Access Access 
x x 
CLREX (n) StoreExcl (Marked_address, !n)ł StoreExcl (Marked_address, !n)+ 
CLREXC!n) Store(Marked_address, !n) Store(!Marked_address,n) 
LoadExcl (x, !n) StoreExcl (Marked_address,n)* StoreExcl (Marked_address,n)* 
StoreExcl (x,n) StoreExcl (!Marked_address,n)* StoreExcl (!Marked_address,n)* 
StoreExcl (x, !n) Store(Marked_address,n)* Store(Marked_address,n)* 
Store(x,n) CLREX(n) * CLREX(n)* 
Store (x, !n) StoreExcl (!Marked_address, !n) 
Store(!Marked_address, !n) 
CLREXC!n) 


+StoreExc1(Marked_address,!n) clears the monitor only if the StoreExcl updates memory 
Operations marked * are possible alternative IMPLEMENTATION DEFINED options. 
In the diagram: LoadExc] represents any Load-Exclusive instruction 
StoreExcl represents any Store-Exclusive instruction 
Store represents any other store instruction. 


Any LoadExc]l operation updates the marked address to the most significant bits of the address x used for the operation. 


Figure E2-5 Global monitor state machine diagram for PE(n) in a multiprocessor system 


For more information about marking see Marking and the size of the marked memory block on page E2-3859. 





Note 


For the global monitor state machine, as shown in Figure E2-5: 


$ The architecture does not require a load instruction by another PE, that is not a Load-Exclusive instruction, 
to have any effect on the global monitor. 
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° Whether a Store-Exclusive instruction successfully updates memory or not depends on whether the address 
accessed matches the marked shareable memory address for the PE issuing the Store-Exclusive instruction, 
and whether the local and global monitors are in the exclusive state. For this reason, Figure E2-5 on 
page E2-3858 only shows how the operations by (!n) cause state transitions of the state machine for PE(n). 


è A Load-Exclusive instruction can only update the marked shareable memory address for the PE issuing the 
Load-Exclusive instruction. 


s When the global monitor is in the Exclusive Access state, it is IMPLEMENTATION DEFINED whether a CLREX 
instruction causes the global monitor to transition from Exclusive Access to Open Access state. 
K It is IMPLEMENTATION DEFINED: 


— Whether a modification to a Non-shareable memory location can cause a global monitor to transition 
from Exclusive Access to Open Access state. 


— Whether a Load-Exclusive instruction to a Non-shareable memory location can cause a global monitor 
to transition from Open Access to Exclusive Access state. 





E2.9.3 Marking and the size of the marked memory block 


When a Load-Exclusive instruction is executed, the resulting marked block ignores the least significant bits of the 
64-bit memory address. 


When a Load-Exclusive instruction is executed, a marked block of size 2¢ bytes is created by ignoring the least 
significant bits of the memory address. A marked address is any address within this marked block. The size of the 
marked memory block is called the Exclusives reservation granule. The Exclusives reservation granule is 
IMPLEMENTATION DEFINED in the range 4 - 512 words. 





Note 
This definition means that the Exclusives reservation granule is: 
. 4 words in an implementation where a is 4. 
7 512 words in an implementation where a is 11. 


For example, in an implementation where a is 4, a successful LDREXB of address 0x341B4 defines a marked block 
using bits[47:4] of the address. This means that the four words of memory from 0x341B0 to 0x341BF are marked for 
exclusive access. 





In some implementations the CTR identifies the Exclusives reservation granule, see CTR. Otherwise, software must 
assume that the maximum Exclusives reservation granule, 512 words, is implemented. 


E2.9.4 Context switch support 


An exception return clears the local monitor. As a result, performing a CLREX instruction as part of a context switch 
is not required in most situations. 


Note 


Context switching is not an application level operation. However, this information is included here to complete the 
description of the exclusive operations. 





E2.9.5 Load-Exclusive and Store-Exclusive instruction usage restrictions 
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The Load-Exclusive and Store-Exclusive instructions are intended to work together as a pair, for example a 
LDREX/STREX pair or a LDREXB/STREXB pair. To support different implementations of these functions, software must 
follow the notes and restrictions given in this subsection. 
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The following notes describe use of a Load-Exclusive/ Store-Exclusive instruction pair, LoadExc1/StoreExcl, to 
indicate the use of any of the Load-Exclusive/Store-Exclusive instruction pairs shown in Table E2-6 on 
page E2-3853. In this context, a LoadExcl/StoreExcl pair comprises two instructions in the same thread of execution: 


E2-3860 


The exclusives support a single outstanding exclusive access for each PE thread that is executed. The 
architecture makes use of this by not requiring an address or size check as part of the IsExclusiveLocal() 
function. If the target VA of a StoreExcl is different from the VA of the preceding LoadExcl instruction in the 
same thread of execution, behavior can be CONSTRAINED UNPREDICTABLE with the following behavior: 


— The StoreExcl either passes or fails, the status value returned by the StoreExcl is UNKNOWN, and the 
states of the local and global monitors for that PE are UNKNOWN. 


Note 


This means the StoreExcl might pass for some instances of a LoadExc1/StoreExcl pair with mismatched 
addresses, and fail for other instances of a LoadExcl/StoreExcl pair with mismatched addresses. 








— The data at the address accessed by the LoadExcl, and at the address accessed by the StoreExcl, is 
UNKNOWN. 


This means software can rely on a LoadExcl/StoreExcl pair to eventually succeed only if the LoadExcl and the 
StoreExcl are executed with the same VA. 


An implementation of the Load-Exclusive and Store-Exclusive instructions can require that, in any thread of 
execution, the transaction size of a StoreExcl instruction is the same as the transaction size of the preceding 
LoadExcl instruction executed in that thread. If the transaction size of a StoreExc] instruction is different from 
the preceding LoadExcl instruction in the same thread of execution, behavior can be CONSTRAINED 
UNPREDICTABLE with the following behavior: 


— The StoreExcl either passes or fails, and the status value returned by the StoreExcl is UNKNOWN. 


Note 


This means the StoreExcl might pass for some instances of a LoadExc1/StoreExcl pair with mismatched 
transaction sizes, and fail for other instances of a LoadExc1/StoreExcl pair with mismatched transaction 
sizes. 








— The block of data of the size of the larger of the transaction sizes used by the LoadExcl/StoreExcl pair 
at the address accessed by the LoadExc1/StoreExcl pair, is UNKNOWN. 


This means software can rely on a LoadExcl/StoreExcl pair to eventually succeed only if the LoadExcl and the 
StoreExcl have the same transaction size. 


LoadExcl/StoreExcl loops are guaranteed to make forward progress only if, for any LoadExcl/StoreExcl loop 
within a single thread of execution, the software meets all of the following conditions: 


1 Between the Load-Exclusive and the Store-Exclusive, there are no explicit memory accesses, 
preloads, direct or indirect System register writes, address translation instructions, cache or TLB 
maintenance instructions, exception generating instructions, exception returns, or indirect 
branches. 


2 Between the Store-Exclusive returning a failing result and the retry of the corresponding 
Load-Exclusive: 


. There are no stores or PLDW instructions to any address within the Exclusives reservation 
granule accessed by the Store-Exclusive. 


° There are no loads or preloads to any address within the Exclusives reservation granule 
accessed by the Store-Exclusive that use a different VA alias to that address. 


. There are no direct or indirect System register writes, other than changes to the flag fields 
in the CPSR or FPSCR, caused by data processing or comparison instructions. 


. There are no direct or indirect address translation instructions, cache or TLB maintenance 
instructions, exception generating instructions, exception returns, or indirect branches. 


i All loads and stores are to a block of contiguous virtual memory of not more than 512 
bytes in size. 
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The Exclusives monitor can be cleared at any time without an application-related cause, provided that such 
clearing is not systematically repeated so as to prevent the forward progress in finite time of at least one of 
the threads that is accessing the Exclusives monitor. However, it is permissible for the LoadExcl/StoreExc] 

loop not to make forward progress if a different thread is repeatedly doing any of the following in a tight loop: 


— Performing stores to a PA covered by the Exclusives monitor. 
—  Prefetching with intent to write to a PA covered by the Exclusives monitor. 


— Executing data cache clean, data cache invalidate, or data cache clean and invalidate instructions to a 
PA covered by the Exclusives monitor. 


— Executing instruction cache invalidate all instructions. 


— Executing instruction cache invalidate by VA instructions to a PA covered by the Exclusives monitor. 


Implementations can benefit from keeping the LoadExc] and StoreExcl operations close together in a single 
thread of execution. This minimizes the likelihood of the Exclusives monitor state being cleared between the 
LoadExcl instruction and the StoreExcl instruction. Therefore, for best performance, Arm strongly 
recommends a limit of 128 bytes between LoadExcl and StoreExc] instructions in a single thread of execution. 


The architecture sets an upper limit of 2048 bytes on the Exclusives reservation granule that can be marked 
as exclusive. For performance reasons, Arm recommends that objects that are accessed by exclusive accesses 
are separated by the size of the Exclusives reservation granule. This is a performance guideline rather than a 
functional requirement. 


After taking a Data Abort exception, the state of the Exclusives monitors is UNKNOWN. 


For the memory location accessed by a LoadExcl/StoreExc] pair, if the memory attributes for a StoreExcl 
instruction are different from the memory attributes for the preceding LoadExc] instruction in the same thread 
of execution, behavior is CONSTRAINED UNPREDICTABLE. Where this occurs because the translation of the 
accessed address changes between the LoadExcl instruction and the StoreExcl instruction, the CONSTRAINED 
UNPREDICTABLE behavior is as follows: 


— The StoreExcl either passes or fails, and the status value returned by the StoreExcl is UNKNOWN. 


Note 


This means the StoreExcl might pass for some instances of a LoadExcl/StoreExcl pair with changed 
memory attributes, and fail for other instances of a LoadExc1/StoreExcl pair with changed memory 
attributes. 








— The data at the address accessed by the StoreExc] is UNKNOWN. 


— Note 


Another bullet point in this list covers the case where the memory attributes of a LoadExcl/StoreExcl pair 
differ as a result of using different VAs with different attributes that point to the same PA. 





The effect of a data or unified cache invalidate, clean, or clean and invalidate instruction on a local or global 
Exclusives monitor that is in the Exclusive Access state is CONSTRAINED UNPREDICTABLE, and the instruction 
might clear the monitor, or it might leave it in the Exclusive Access state. For address-based maintenance 
instructions, this also applies to the monitors of other PEs in the same Shareability domain as the PE 
executing the cache maintenance instruction, as determined by the Shareability domain of the address being 
maintained. 


Note 


Arm strongly recommends that implementations ensure that the use of such maintenance instructions by a 
PE in the Non-secure state cannot cause a denial of service on a PE in the Secure state. 








If the mapping of the VA to PA is changed between the LoadExc] instruction and the StoreExcl instruction, 
and the change is performed using a break-before-make sequence as described in Using break-before-make 
when updating translation table entries on page G5-5794, if the StoreExcl is performed after another write 
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to the same PA as the StoreExcl, and that other write was performed after the old translation was properly 
invalidated and that invalidation was properly synchronized, then the StoreExc] will not pass its monitor 
check. 

Note 


Arm expects that, in many implementations, either: 





— The TLB invalidation will clear either the local or global monitor. 
— The PA will be checked between the LoadExcl and StoreExcl. 





g The Exclusive Access state for an address accessed by a PE can be lost as a result of a PLDW instruction to the 
same PA executed by another PE. This means that a very high rate of repeated PLDW accesses to a memory 
location might impede the forward progress of another PE. 





Note 


In the event of repeatedly-contending LoadExcl/StoreExcl instruction sequences from multiple PEs, an 
implementation must ensure that forward progress is made by at least one PE. 





Use of WFE and SEV instructions by spin-locks 


Armv8 provides Wait For Event, Send Event, and Send Event Local instructions, WFE, SEV, SEVL, that can assist with 
reducing power consumption and bus contention caused by PEs repeatedly attempting to obtain a spin-lock. These 
instructions can be used at the application level, but a complete understanding of what they do depends on a system 
level understanding of exceptions. They are described in Wait For Event and Send Event on page G1-5562. 
However, in Armv8, when the global monitor for a PE changes from Exclusive Access state to Open Access state, 
an event is generated. 





Note 


This is equivalent to issuing an SEVL instruction on the PE for which the monitor state has changed. It removes the 
need for spinlock code to include an SEV instruction after clearing a spinlock. 
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This chapter describes the T32 and A32 instruction sets. It contains the following sections: 


Support for instructions in different versions of the Arm architecture on page F1-3866. 
Unified Assembler Language on page F1-3867. 

Branch instructions on page F1-3869. 

Data-processing instructions on page F1-3870. 

PSTATE and banked register access instructions on page F1-3878. 

Load/store instructions on page F 1-3879. 

Load/store multiple instructions on page F1-3882. 

Miscellaneous instructions on page F1-3883. 

Exception-generating and exception-handling instructions on page F1-3885. 
System register access instructions on page F1-3887. 

Advanced SIMD and floating-point load/store instructions on page F 1-3888. 
Advanced SIMD and floating-point register transfer instructions on page F1-3890. 
Advanced SIMD data-processing instructions on page F1-3891. 

Floating-point data-processing instructions on page F1-3901. 
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F1.1 Support for instructions in different versions of the Arm architecture 


This manual describes the Arm AArch32 instruction sets, T32 and A32, for the Armv8 architecture. Therefore, it 
indicates how any options or extensions in the Armv8 architecture affect the available instructions. 
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F1.2 Unified Assembler Language 


This manual uses the Arm Unified Assembler Language (UAL). This assembly language syntax provides a 
canonical form for all T32 and A32 instructions. 


UAL describes the syntax for the mnemonic and the operands of each instruction. In addition, it assumes that 
instructions and data items can be given labels. It does not specify the syntax to be used for labels, nor what 
assembler directives and options are available. See your assembler documentation for these details. 


Most earlier Arm assembly language mnemonics are still supported as synonyms, as described in the instruction 
details. 





Note 
Most earlier T32 assembly language mnemonics are not supported. 


UAL includes instruction selection rules that specify which instruction encoding is selected when more than one 
can provide the required functionality. For example, both 16-bit and 32-bit encodings exist for an ADD RQ, R1, R2 
instruction. The most common instruction selection rule is that when both a 16-bit encoding and a 32-bit encoding 
are available, the 16-bit encoding is selected, to optimize code density. 


Syntax options exist to override the normal instruction selection rules and ensure that a particular encoding is 
selected. These are useful when disassembling code, to ensure that subsequent assembly produces the original code, 
and in some other situations. 


F1.2.1 Conditional instructions 


For maximum portability of UAL assembly language between the T32 and A32 instruction sets, Arm recommends 
that: 


7 IT instructions are written before conditional instructions in the correct way for the T32 instruction set. 


s When assembling to the A32 instruction set, assemblers check that any IT instructions are correct, but do not 
generate any code for them. 


Although other T32 instructions are unconditional, all instructions that are made conditional by an IT instruction 
must be written with a condition. These conditions must match the conditions imposed by the IT instruction. For 
example, an ITTEE EQ instruction imposes the EQ condition on the first two following instructions, and the NE 

condition on the next two. Those four instructions must be written with EQ, EQ, NE and NE conditions respectively. 


Some instructions cannot be made conditional by an IT instruction. Some instructions can be conditional if they are 
the last instruction in the IT block, but not otherwise. 


The branch instruction encodings that include a Condition code field cannot be made conditional by an IT 
instruction. If the assembler syntax indicates a conditional branch that correctly matches a preceding IT instruction, 
it is assembled using a branch instruction encoding that does not include a Condition code field. 





Note 
For performance reasons Armv8 deprecates many uses of IT, see Partial deprecation of IT on page F1-3884. As 
described in that section, an implementation can include ITD controls that disable those uses of IT, making them 
UNDEFINED. 





F1.2.2 Use of labels in UAL instruction syntax 
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The UAL syntax for some instructions includes the label of an instruction or a literal data item that is at a fixed offset 
from the instruction being specified. The assembler must: 


1. Calculate the PC or Align(PC, 4) value of the instruction. The PC value of an instruction is its address plus 4 
for a T32 instruction, or plus 8 for an A32 instruction. The Align(PC, 4) value of an instruction is its PC value 
ANDed with OxFFFFFFFC to force it to be word-aligned. There is no difference between the PC and 
Align(PC, 4) values for an A32 instruction, but there can be for a T32 instruction. 
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Calculate the offset from the PC or Align(PC, 4) value of the instruction to the address of the labeled 
instruction or literal data item. 


Assemble a PC-relative encoding of the instruction, that is, one that reads its PC or Align(PC, 4) value and 
adds the calculated offset to form the required address. 


Note 


For instructions that can encode a subtraction operation, if the instruction cannot encode the calculated offset 
but can encode minus the calculated offset, the instruction encoding specifies a subtraction of minus the 
calculated offset. 








The syntax of the following instructions includes a label: 


B, BL, and BLX (immediate). The assembler syntax for these instructions always specifies the label of the 
instruction that they branch to. Their encodings specify a sign-extended immediate offset that is added to the 
PC value of the instruction to form the target address of the branch. 


CBNZ and CBZ. The assembler syntax for these instructions always specifies the label of the instruction that they 
branch to. Their encodings specify a zero-extended immediate offset that is added to the PC value of the 
instruction to form the target address of the branch. They do not support backward branches. 


LDR, LDRB, LDRD, LDRH, LDRSB, LDRSH, PLD, PLDW, PLI, and VLDR. The normal assembler syntax of these load 
instructions can specify the label of a literal data item that is to be loaded. The encodings of these instructions 
specify a zero-extended immediate offset that is either added to or subtracted from the Align(PC, 4) value of 
the instruction to form the address of the data item. A few such encodings perform a fixed addition or a fixed 
subtraction and must only be used when that operation is required, but most contain a bit that specifies 
whether the offset is to be added or subtracted. 


When the assembler calculates an offset of 0 for the normal syntax of these instructions, it must assemble an 
encoding that adds 0 to the Align(PC, 4) value of the instruction. Encodings that subtract 0 from the Align(PC, 
4) value cannot be specified by the normal syntax. 


There is an alternative syntax for these instructions that specifies the addition or subtraction and the 
immediate offset explicitly. In this syntax, the label is replaced by [PC, #+/-<imm>], where: 


+/- Is + or omitted to specify that the immediate offset is to be added to the Align(PC, 4) value, or - 
if it is to be subtracted. 


<imm> Is the immediate offset. 


This alternative syntax makes it possible to assemble the encodings that subtract 0 from the Align(PC, 4) 
value, and to disassemble them to a syntax that can be re-assembled correctly. 


ADR. The normal assembler syntax for this instruction can specify the label ofan instruction or literal data item 
whose address is to be calculated. Its encoding specifies a zero-extended immediate offset that is either added 
to or subtracted from the Align(PC, 4) value of the instruction to form the address of the data item, and some 
opcode bits that determine whether it is an addition or subtraction. 


When the assembler calculates an offset of 0 for the normal syntax of this instruction, it must assemble the 
encoding that adds 0 to the Align(PC, 4) value of the instruction. The encoding that subtracts 0 from the 
Align(PC, 4) value cannot be specified by the normal syntax. 


There is an alternative syntax for this instruction that specifies the addition or subtraction and the immediate 
value explicitly, by writing them as additions ADD <Rd>, PC, #<imm> or subtractions SUB <Rd>, PC, #<imm>. 
This alternative syntax makes it possible to assemble the encoding that subtracts 0 from the Align(PC, 4) 
value, and to disassemble it to a syntax that can be re-assembled correctly. 





Note 


Arm recommends that where possible, software avoids using: 


The alternative syntax for the ADR, LDC, LDR, LDRB, LDRD, LDRH, LDRSB, LDRSH, PLD, PLI, PLDW, and VLDR instructions. 
The encodings of these instructions that subtract 0 from the Align(PC, 4) value. 





F1-3868 
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F1.3 Branch instructions 


Table F1-1 summarizes the branch instructions in the T32 and A32 instruction sets. In addition to providing for 
changes in the flow of execution, some branch instructions can change instruction set. 


Table F1-1 Branch instructions 






































Instruction See Range, T32 Range, A32 
Branch to target address B on page F5-4117 +16MB +432MB 
Compare and Branch on Nonzero, Compare and Branch CBNZ, CBZ on page F5-4142 0-126 bytes a 

on Zero 

Call a subroutine BL, BLX (immediate) on page F5-4135 +16MB +432MB 

Call a subroutine, change instruction set? +16MB +32MB 

Call a subroutine, optionally change instruction set BLX (register) on page F5-4137 Any Any 

Branch to target address, change instruction set BX on page F5-4139 Any Any 

Change to Jazelle state BXJ on page F5-4141 - - 

Table Branch (byte offsets) TBB, TBH on page F5-4687 0-510 bytes a 


Table Branch (halfword offsets) 


0-131070 bytes 





a. These instructions do not exist in the A32 instruction set. 


b. The range is determined by the instruction set of the BLX instruction, not of the instruction it branches to. 
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Branches to loaded and calculated addresses can be performed by LDR, LDM and data-processing instructions. For 
details see Load/store instructions on page F1-3879, Load/store multiple instructions on page F1-3882, Standard 


data-processing instructions on page F1-3870, and Shift instructions on page F1 


In addition to the branch instructions shown in Table F1-1: 


-3872. 


: In the A32 instruction set, a data-processing instruction that targets the PC behaves as a branch instruction. 


For more information, see Data-processing instructions on page F1-3870 


à In the T32 and A32 instruction sets, a load instruction that targets the PC behaves as a branch instruction. For 


more information, see Load/store instructions on page F1-3879. 
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F1.4 


F1.4.1 
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Data-processing instructions 


Core data-processing instructions belong to one of the following groups: 
s Standard data-processing instructions. 


These instructions perform basic data-processing operations, and share a common format with some 
variations. 


. Shift instructions on page F1-3872. 

. Multiply instructions on page F1-3872. 

e Saturating instructions on page F1-3874. 

è Saturating addition and subtraction instructions on page F1-3874. 
. Packing and unpacking instructions on page F1-3875. 

. Parallel addition and subtraction instructions on page F1-3876. 

° Divide instructions on page F1-3877. 


. Miscellaneous data-processing instructions on page F1-3877. 


For related Advanced SIMD and floating-point instructions see Advanced SIMD data-processing instructions on 
page F1-3891 and Floating-point data-processing instructions on page F1-3901. 


Standard data-processing instructions 


These instructions generally have a destination register Rd, a first operand register Rn, and a second operand. The 
second operand can be another register Rm, or an immediate constant. 


If the second operand is an immediate constant, it can be: 
° Encoded directly in the instruction. 


è A modified immediate constant that uses 12 bits of the instruction to encode a range of constants. T32 and 
A32 instructions have slightly different ranges of modified immediate constants. For more information, see 
Modified immediate constants in T32 instructions on page F2-3923 and Modified immediate constants in A32 
instructions on page F2-3924. 


If the second operand is another register, it can optionally be shifted in any of the following ways: 
LSL Logical Shift Left by 1-31 bits. 


LSR Logical Shift Right by 1-32 bits. 

ASR Arithmetic Shift Right by 1-32 bits. 

ROR Rotate Right by 1-31 bits. 

RRX Rotate Right with Extend. For details see Shift and rotate operations on page E1-3784. 


In T32 code, the amount to shift by is always a constant encoded in the instruction. In A32 code, the amount to shift 
by is either a constant encoded in the instruction, or the value of a register, Rs. 


For instructions other than CMN, CMP, TEQ, and TST, the result of the data-processing operation is placed in the 
destination register. In the A32 instruction set, the destination register can be the PC, causing the result to be treated 
as a branch address. In the T32 instruction set, this is only permitted for some 16-bit forms of the ADD and MOV 
instructions. 


These instructions can optionally set the Condition flags, according to the result of the operation. If they do not set 
the flags, existing flag settings from a previous instruction are preserved. 


Table F1-2 on page F1-3871 summarizes the main data-processing instructions in the T32 and A32 instruction sets. 
Generally, each of these instructions is described in three sections in Chapter F2 About the T32 and A32 Instruction 
Descriptions, one section for each of the following: 


° INSTRUCTION (immediate) where the second operand is a modified immediate constant. 
$ INSTRUCTION (register) where the second operand is a register, or a register shifted by a constant. 
e INSTRUCTION (register-shifted register) where the second operand is a register shifted by a value obtained from 


another register. These are only available in the A32 instruction set. 
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Table F1-2 Standard data-processing instructions 



























































Instruction Mnemonic Notes 

Add with Carry ADC = 

Add ADD T32 instruction set permits use of a modified immediate constant or a zero-extended 
12-bit immediate constant. 

Form PC-relative Address ADR First operand is the PC. Second operand is an immediate constant. T32 instruction set 
uses a zero-extended 12-bit immediate constant. Operation is an addition or a 
subtraction. 

Bitwise AND AND - 

Bitwise Bit Clear BIC - 

Compare Negative CMN Sets flags. Like ADD but with no destination register. 

Compare CMP Sets flags. Like SUB but with no destination register. 

Bitwise Exclusive OR EOR - 

Copy operand to destination MOV Has only one operand, with the same options as the second operand in most of these 
instructions. If the operand is a shifted register, the instruction is an LSL, LSR, ASR, or ROR 
instruction instead. For details see Shift instructions on page F 1-3872. 

The T32 and A32 instruction sets permit use of a modified immediate constant or a 
zero-extended 16-bit immediate constant. 

Bitwise NOT MVN Has only one operand, with the same options as the second operand in most of these 
instructions. 

Bitwise OR NOT ORN Not available in the A32 instruction set. 

Bitwise OR ORR - 

Reverse Subtract RSB Subtracts first operand from second operand. This permits subtraction from constants 
and shifted registers. 

Reverse Subtract with Carry RSC Not available in the T32 instruction set. 

Subtract with Carry SBC - 

Subtract SUB T32 instruction set permits use of a modified immediate constant or a zero-extended 
12-bit immediate constant. 

Test Equivalence TEQ Sets flags. Like EOR but with no destination register. 

Test TST Sets flags. Like AND but with no destination register. 
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F1.4.2 Shift instructions 


Table F1-3 lists the shift instructions in the T32 and A32 instruction sets. 


Table F1-3 Shift instructions 





Instruction See 





Arithmetic Shift Right ASR (immediate) on page F5-4109 
ASR (register) on page F5-4111 
ASRS (immediate) on page F5-4113 
ASRS (register) on page F5-4115 





Logical Shift Left LSL (immediate) on page F5-4315 
LSL (register) on page F5-4317 
LSLS (immediate) on page F5-4319 
LSLS (register) on page F5-4321 





Logical Shift Right LSR (immediate) on page F5-4323 
LSR (register) on page F5-4325 
LSRS (immediate) on page F5-4327 
LSRS (register) on page F5-4329 





Rotate Right ROR (immediate) on page F5-4453 
ROR (register) on page F5-4455 
RORS (immediate) on page F5-4457 
RORS (register) on page F5-4459 





Rotate Right with Extend RRX on page F5-4461 
RRXS on page F5-4463 





In the A32 instruction set only, the destination register of these instructions can be the PC, causing the result to be 
treated as an address to branch to. 
F1.4.3 Multiply instructions 


These instructions can operate on signed or unsigned quantities. In some types of operation, the results are the same 
whether the operands are signed or unsigned. 


° Table F1-4 summarizes the multiply instructions where there is no distinction between signed and unsigned 
quantities. 


The least significant 32 bits of the result are used. More significant bits are discarded. 
$ Table F1-5 on page F1-3873 summarizes the signed multiply instructions. 


è Table F1-6 on page F1-3873 summarizes the unsigned multiply instructions. 


Table F1-4 General multiply instructions 





Instruction See Operation (number of bits) 


Multiply Accumulate MLA, MLAS on page F5-4335 32 =32 +32 x 32 











Multiply and Subtract MLS on page F5-4337 32 = 32 —32 x 32 
Multiply MUL, MULS on page F5-4373 32 =32 x 32 
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Table F1-5 Signed multiply instructions 



























































Instruction See Operation (number of bits) 
Signed Multiply Accumulate (halfwords) SMLABB, SMLABT, SMLATB, SMLATT 32 =32+ 16 16 
on page F5-4522 
Signed Multiply Accumulate Dual SMLAD, SMLADX on page F5-4524 32 =32+16x 16+ 16 16 
Signed Multiply Accumulate Long SMLAL, SMLALS on page F5-4526 64 = 64 + 32 x 32 
Signed Multiply Accumulate Long (halfwords) SMLALBB, SMLALBT, SMLALTB, 64 = 64+ 16x 16 
SMLALTT on page F5-4528 
Signed Multiply Accumulate Long Dual SMLALD, SMLALDX on page F5-4531 64= 64+ 16x 16+ 16 x 16 
Signed Multiply Accumulate (word by halfword) SMLAWB, SMLAWT on page F5-4533 32 =32 +32 x 164 
Signed Multiply Subtract Dual SMLSD, SMLSDX on page F5-4535 32 =32+ 16 x 16-16 16 
Signed Multiply Subtract Long Dual SMLSLD, SMLSLDX on page F5-4537 64= 64+ 16x 16-16 x 16 
Signed Most Significant Word Multiply Accumulate SMMLA, SMMLAR on page F5-4539 32 =32+32x 326 
Signed Most Significant Word Multiply Subtract SMMLS, SMMLSR on page F5-4541 32 = 32-32 x 326 
Signed Most Significant Word Multiply SMMUL, SMMULR on page F5-4543 32 =32 x 326 
Signed Dual Multiply Add SMUAD, SMUADX on page F5-4545 32=16x 16+ 16x 16 
Signed Multiply (halfwords) SMULBB, SMULBT, SMULTB, SMULTT =32=16 16 
on page F5-4547 
Signed Multiply Long SMULL, SMULLS on page F5-4549 64 = 32 x 32 
Signed Multiply (word by halfword) SMULWB, SMULWT on page F5-4551 32 =32 x 164 
Signed Dual Multiply Subtract SMUSD, SMUSDX on page F5-4553 32=16 =x 16-16 x 16 





a. The most significant 32 bits of the 48-bit product are used. Less significant bits are discarded. 
b. The most significant 32 bits of the 64-bit product are used. Less significant bits are discarded. 


Table F1-6 Unsigned multiply instructions 




















Instruction See Operation (number of bits) 
Unsigned Multiply Accumulate Accumulate Long UMAAL on page F5-4727 64 = 32 +32 + 32 x 32 
Unsigned Multiply Accumulate Long UMLAL, UMLALS on page F5-4729 = 64 = 64 + 32 x 32 
Unsigned Multiply Long UMULL, UMULLS on page F5-4731 64=32 x 32 
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F1.4.4 Saturating instructions 


Table F1-7 lists the saturating instructions in the T32 and A32 instruction sets. For more information, see 
Pseudocode description of saturation on page E1-3785. 


Table F1-7 Saturating instructions 





Instruction See 


Operation 





Signed Saturate 


SSAT on page F5-4559 Saturates optionally shifted 32-bit value to selected range 





Signed Saturate 16 


SSAT16 on page F5-4561 Saturates two 16-bit values to selected range 





Unsigned Saturate 


USAT on page F5-4749 Saturates optionally shifted 32-bit value to selected range 





Unsigned Saturate 16 


USAT16 on page F5-4751 Saturates two 16-bit values to selected range 





F1.4.5 Saturating addition and subtraction instructions 


Table F1-8 lists the saturating addition and subtraction instructions in the T32 and A32 instruction sets. For more 
information, see Pseudocode description of saturation on page E1-3785. 


Table F1-8 Saturating addition and subtraction instructions 





Instruction 


See 


Operation 





Saturating Add 


QADD on page F5-4423 


Add, saturating result to the 32-bit signed integer range 





Saturating Subtract 


OSUB on page F5-4436 


Subtract, saturating result to the 32-bit signed integer range 





Saturating Double and Add 


QADD on page F5-4423 


Doubles one value and adds a second value, saturating the doubling and 
the addition to the 32-bit signed integer range 





Saturating Double and 
Subtract 


QODSUB on page F5-4432 


Doubles one value and subtracts the result from a second value, saturating 
the doubling and the subtraction to the 32-bit signed integer range 
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Table F1-9 lists the packing and unpacking instructions in the T32 and A32 instruction sets. 


Table F1-9 Packing and unpacking instructions 





Instruction 


See 


Operation 





Pack Halfword 


PKHBT, PKHTB on page F5-4397 


Combine halfwords 





Signed Extend and Add Byte 


SXTAB on page F5-4675 


Extend 8 bits to 32 and add 





Signed Extend and Add Byte 16 


SXTAB16 on page F5-4677 


Dual extend 8 bits to 16 and add 





Signed Extend and Add Halfword 


SXTAH on page F5-4679 


Extend 16 bits to 32 and add 





Signed Extend Byte 


SXTB on page F5-4681 


Extend 8 bits to 32 





Signed Extend Byte 16 


SXTB16 on page F5-4683 


Dual extend 8 bits to 16 























Signed Extend Halfword SXTH on page F5-4685 Extend 16 bits to 32 

Unsigned Extend and Add Byte UXTAB on page F5-4759 Extend 8 bits to 32 and add 
Unsigned Extend and Add Byte 16 UXTAB16 on page F5-4761 Dual extend 8 bits to 16 and add 
Unsigned Extend and Add Halfword UXTAH on page F5-4763 Extend 16 bits to 32 and add 
Unsigned Extend Byte UXTB on page F5-4765 Extend 8 bits to 32 

Unsigned Extend Byte 16 UXTB16 on page F5-4767 Dual extend 8 bits to 16 
Unsigned Extend Halfword UXTH on page F5-4769 Extend 16 bits to 32 
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F1.4.7 Parallel addition and subtraction instructions 


These instructions perform additions and subtractions on the values of two registers and write the result to a 
destination register, treating the register values as sets of two halfwords or four bytes. That is, they perform SIMD 
additions or subtractions on the general-purpose registers. 


These instructions consist of a prefix followed by a main instruction mnemonic. The prefixes are as follows: 


S Signed arithmetic modulo 28 or 216, 

Q Signed saturating arithmetic. 

SH Signed arithmetic, halving the results. 

U Unsigned arithmetic modulo 28 or 216. 
UQ Unsigned saturating arithmetic. 

UH Unsigned arithmetic, halving the results. 


The main instruction mnemonics are as follows: 


ADD16 Adds the top halfwords of two operands to form the top halfword of the result, and the bottom 
halfwords of the same two operands to form the bottom halfword of the result. 

ASX Exchanges halfwords of the second operand, and then adds top halfwords and subtracts bottom 
halfwords. 

SAX Exchanges halfwords of the second operand, and then subtracts top halfwords and adds bottom 
halfwords. 

SUB16 Subtracts each halfword of the second operand from the corresponding halfword of the first operand 


to form the corresponding halfword of the result. 


ADD8 Adds each byte of the second operand to the corresponding byte of the first operand to form the 
corresponding byte of the result. 


SUB8 Subtracts each byte of the second operand from the corresponding byte of the first operand to form 
the corresponding byte of the result. 


The instruction set permits all 36 combinations of prefix and main instruction operand, as Table F1-10 shows. 


See also Advanced SIMD parallel addition and subtraction on page F1-3892. 


Table F1-10 Parallel addition and subtraction instructions 
































Main instruction Signed Saturating ui Unsigned ca havea” 

ADD16, add, two halfwords SADD16 QADD16 SHADD16 UADD16 UQADD16 UHADD16 

ASX, add and subtract with exchange SASX QASX SHASX UASX UQASX UHASX 

SAX, subtract and add with exchange = SSAX QSAX SHSAX USAX UQSAX UHSAX 

SUB16, subtract, two halfwords SSUB16 QSUB16 SHSUB16 USUB16 UQSUB16 UHSUB16 

ADD8, add, four bytes SADD8 QADD8 SHADD8 UADD8 UQADD8 UHADD8 

SUB8, subtract, four bytes SSUB8 QSUB8 SHSUB8 USUB8 UQSUB8 UHSUB8 
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In Armv8, signed and unsigned integer divide instructions are included in both the T32 instruction set and the A32 


instruction set. 


For descriptions of the instructions see: 


S SDIV on page F5-4498. 
7 UDIV on page F5-4713. 


For the SDIV and UDIV instructions, division by zero always returns a zero result. 


The ID_ISARO.Divide_instrs field indicates the level of support for these instructions. The field value of 0b0010 
indicates they are implemented in both the T32 and A32 instruction sets. 


F1.4.9 Miscellaneous data-processing instructions 


Table F1-11 lists the miscellaneous data-processing instructions in the T32 and A32 instruction sets. Immediate 
values in these instructions are simple binary numbers. 


Table F1-11 Miscellaneous data-processing instructions 











Instruction See Notes 
BitField Clear BFC on page F5-4120 - 
BitField Insert BFI on page F5-4122 - 





Count Leading Zeros 


CLZ on page F5-4144 





Move Top 


MOVT on page F5-4352 


Moves 16-bit immediate value to top 
halfword. Bottom halfword unchanged. 





Reverse Bits 


RBIT on page F5-4442 





Byte-Reverse Word 


REV on page F5-4444 





Byte-Reverse Packed Halfword 


REV 16 on page F5-4446 





Byte-Reverse Signed Halfword 


REVSH on page F5-4448 





Signed BitField Extract 


SBFX on page F5-4496 





Select Bytes using GE flags 


SEL on page F5-4500 





Unsigned BitField Extract 


UBFX on page F5-4709 





Unsigned Sum of Absolute Differences USADS on page F5-4745 - 





Unsigned Sum of Absolute Differences and Accumulate USADAS on page F5-4747 - 
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F1.5 


F1.5.1 


F1.5.2 


F1-3878 


PSTATE and banked register access instructions 


These instructions transfer PE state information to or from a general-purpose register. 


PSTATE access instructions 


PSTATE holds process state information, see Process state, PSTATE on page E1-3787. In AArch32 state: 
` At EL1 or higher, PSTATE is accessible using the Current Program Status Register (CPSR). 
s At ELO, a subset of the CPSR is accessible as the Application Program Status Register (APSR). 


° On taking an exception, the contents of the CPSR are copied to the Saved Program Status Register (SPSR) 
of the mode from which the exception is taken. 


The MRS and MSR instructions move the contents of the CPSR, APSR, or the SPSR of the current mode to or from a 
general-purpose register, see: 


7 MRS on page F5-4358. 
$ MSR (immediate) on page F5-4368. 
° MSR (register) on page F5-4370. 


When executed at ELO, MRS and MSR instructions can only access the APSR. 


The PSTATE Condition flags, PSTATE.{N, Z, C, V} are set by the execution of data-processing instructions, and 
can control the execution of conditional instructions. However, software can set the Condition flags explicitly using 
the MSR instruction, and can read the current state of the Condition flags explicitly using the MRS instruction. 


In addition, at EL1 or higher, software can use the CPS instruction to change the PSTATE.M field and the 
PSTATE. {A, I, F} interrupt mask bits, see CPS, CPSID, CPSIE on page F5-4160. 


Banked register access instructions 


At EL1 or higher, the MRS (banked register) and MSR (banked register) instructions move the contents of a banked 
general-purpose register, the SPSR, or the ELR_hyp, to or from a general-purpose register. See: 


à MRS (Banked register) on page F5-4360. 
è MSR (Banked register) on page F5-4364. 
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Table F1-12 summarizes the general-purpose register load/store instructions in the T32 and A32 instruction sets. 


Some of these instructions can also operate on the PC. See also: 


è Load/store multiple instructions on page F1-3882. 


à Synchronization and semaphores on page E2-3853, for more information about the Load-Exclusive and 
Store-Exclusive instructions. 


. Load-Acquire, Store-Release on page E2-3828, for more information about the Load-Acquire/Store-Release 
and Load-Acquire Exclusive/Store-Release Exclusive instructions. 


s Advanced SIMD and floating-point load/store instructions on page F1-3888. 


Load/store instructions have several options for addressing memory. For more information, see Addressing modes 
on page F1-3880. 


Table F1-12 Load/store instructions 



































Unprivileged Exclusive Exclusive 
Data type Load Store Load: Store- 
Acquire Release Load- Store- 
Load Store Load Store : 

Acquire Release 
32-bit word LDR STR LDRT STRT LDREX STREX LDA STL LDAEX STLEX 
16-bit halfword - STRH - STRHT - STREXH LDAH STLH LDAEXH STLEXH 
16-bit unsigned LDRH - LDRHT - LDREXH - - - - - 
halfword 
16-bit signed LDRSH ž - LDRSHT - - - - - - - 
halfword 
8-bit byte - STRB - STRBT - STREXB LDAB STLB LDAEXB STLEXB 
8-bit unsigned byte LDRB - LDRBT - LDREXB - - - - - 
8-bit signed byte LDRSBE Žž - LDRSBT - - - - - - - 

Two 32-bit words LDRD STRD - - - - - - - - 
64-bit doubleword - - - - LDREXD  STREXD - - LDAEXD STLEXD 
F1.6.1 Loads to the PC 


The LDR instruction can load a value into the PC. The value loaded is treated as an interworking address, as described 
by the LoadwritePC() pseudocode function in Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


F1.6.2 Halfword and byte loads and stores 
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Halfword and byte stores store the least significant halfword or byte from the register, to 16 or 8 bits of memory 
respectively. There is no distinction between signed and unsigned stores. 


Halfword and byte loads load 16 or 8 bits from memory into the least significant halfword or byte of a register. 
Unsigned loads zero-extend the loaded value to 32 bits, and signed loads sign-extend the value to 32 bits. 
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F1.6.3 Load unprivileged and Store unprivileged 


When executing at ELO, a Load unprivileged or Store unprivileged instruction operates in exactly the same way as 
the corresponding ordinary load or store instruction. For example, an LDRT instruction executes in exactly the same 
way as the equivalent LDR instruction. When executed at PL1, Load unprivileged and Store unprivileged instructions 
behave as they would if they were executed at ELO. For example, an LDRT instruction executes in exactly the way 
that the equivalent LDR instruction would execute at ELO. In particular, the instructions make unprivileged memory 
accesses. 


Note 


As described in Security state, Exception levels, and AArch32 execution privilege on page G1-5480, execution at 
PL1 describes all of the following: 


e Execution at Non-secure EL1 using AArch32. 





è Execution at Secure EL1 using AArch32 when EL3 is not implemented. 
e Execution at Secure EL1 using AArch32 when EL3 is implemented and is using AArch64. 
° Execution at Secure EL3 when EL3 is implemented and is using AArch32. 


The Load unprivileged and Store unprivileged instructions are CONSTRAINED UNPREDICTABLE if executed at EL2, 
see Execution of Load/Store unprivileged instructions in Hyp mode on page K1-7626. 


For more information about execution privilege, see About access permissions on page G5-5766. 


F1.6.4 Load-Exclusive and Store-Exclusive 


Load-Exclusive and Store-Exclusive instructions provide shared memory synchronization. For more information, 
see Synchronization and semaphores on page E2-3853. 


F1.6.5 Load-Acquire and Store-Release 


Load-Acquire and Store-Release instructions provide memory barriers. Load-Acquire Exclusive and Store-Release 
Exclusive instructions provide memory barriers with shared memory synchronization. For more information, see 
Load-Acquire, Store-Release on page E2-3828. 


F1.6.6 Addressing modes 


The address for a load or store is formed from two parts: a value from a base register, and an offset. 
The base register can be any one of the general-purpose registers RO-R12, SP, or LR. 


For loads, the base register can be the PC. This provides PC-relative addressing for position-independent code. 
Instructions marked (literal) in their title in Chapter F2 About the T32 and A32 Instruction Descriptions are 
PC-relative loads. 


The offset takes one of three formats: 


Immediate The offset is an unsigned number that can be added to or subtracted from the base register 
value. Immediate offset addressing is useful for accessing data elements that are a fixed 
distance from the start of the data object, such as structure fields, stack offsets and 
input/output registers. 


Register The offset is a value from a general-purpose register. The value can be added to, or 
subtracted from, the base register value. Register offsets are useful for accessing arrays or 
blocks of data. 

Scaled register The offset is a general-purpose register, shifted by an immediate value, then added to or 


subtracted from the base register. This means an array index can be scaled by the size of each 
array element. 
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The offset and base register can be used in three different ways to form the memory address. The addressing modes 
are described as follows: 


Offset The offset is added to or subtracted from the base register to form the memory address. 


Pre-indexed The offset is added to or subtracted from the base register to form the memory address. The 
base register is then updated with this new address, to permit automatic indexing through an 
array or memory block. 


Post-indexed The value of the base register alone is used as the memory address. The offset is then added 
to or subtracted from the base register. The result is stored back in the base register, to permit 
automatic indexing through an array or memory block. 


Note 
Not every variant is available for every instruction, and the range of permitted immediate values and the options for 
scaled registers vary from instruction to instruction. See Chapter F2 About the T32 and A32 Instruction Descriptions 
for full details for each instruction. 
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F1.7 


F1.7.1 


F1-3882 


Load/store multiple instructions 
Load Multiple instructions load from memory a subset, or possibly all, of the general-purpose registers and the PC. 
Store Multiple instructions store to memory a subset, or possibly all, of the general-purpose registers. 


The memory locations are consecutive word-aligned words. The addresses used are obtained from a base register, 
and can be either above or below the value in the base register. The base register can optionally be updated by the 
total size of the data transferred. 


Table F1-13 summarizes the load/store multiple instructions in the T32 and A32 instruction sets. 


Table F1-13 Load/store multiple instructions 











Instruction See 
Load Multiple, Increment After or Full Descending LDM, LDMIA, LDMFD on page F5-4224 
Load Multiple, Decrement After or Full Ascending è LDMDA, LDMFA on page F5-4232 





Load Multiple, Decrement Before or Empty Ascending LDMDB, LDMEA on page F5-4234 





Load Multiple, Increment Before or Empty Descending LDMIB, LDMED on page F5-4237 











Pop multiple registers off the stack > POP on page F5-4411 
Push multiple registers onto the stack ¢ PUSH on page F5-4418 
Store Multiple, Increment After or Empty Ascending STM, STMIA, STMEA on page F5-4591 





Store Multiple, Decrement After or Empty Descending STMDA, STMED on page F5-4597 





Store Multiple, Decrement Before or Full Descending STMDB, STMFD on page F5-4599 





Store Multiple, Increment Before or Full Ascending è STMIB, STMFA on page F5-4602 


a. Not available in the T32 instruction set. 
b. This instruction is equivalent to an LDM instruction with the SP as base register, and base register updating. 


c. This instruction is equivalent to an STMDB instruction with the SP as base register, and base register 
updating. 


When executing at EL1, variants of the LDM and STM instructions load and store User mode registers. Another 
system level variant of the LDM instruction performs an exception return. 


Loads to the PC 


The LDM, LDMDA, LDMDB, LDMIB, and POP instructions can load a value into the PC. The value loaded is treated as an 
interworking address, as described by the LoadWritePC() pseudocode function in Pseudocode description of 
operations on the AArch32 general-purpose registers and the PC on page E1-3787. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


F1.8 Miscellaneous instructions 


The AArch32 Instruction Sets Overview 
F1.8 Miscellaneous instructions 


Table F1-14 summarizes the miscellaneous instructions in the T32 and A32 instruction sets. 


Table F1-14 Miscellaneous instructions 





Instruction 


See 





Clear-Exclusive 


CLREX on page F5-4143 





Data Memory Barrier 


DMB on page F5-4180 





Data Synchronization Barrier 


DSB on page F5-4183 





Error Synchronization Barrier 


ESB on page F5-4197 





Instruction Synchronization Barrier 


ISB on page F5-4203 





If-Then 


IT on page F5-42044 





No Operation 


NOP on page F5-4382 





Preload Data 


PLD, PLDW (immediate) on page F5-4400 
PLD (literal) on page F5-4402 
PLD, PLDW (register) on page F5-4404 





Preload Instruction 


PLI (immediate, literal) on page F5-4406 
PLI (register) on page F5-4409 





Speculation Barrier 


SB on page F5-4485 





Set Endianness 


SETEND on page F5-4502° 





Set Privileged Access Never 


SETPAN on page F5-4503 





Send Event 


SEV on page F5-4504 





Send Event Local 


SEVL on page F5-4506 





Wait For Event 


WFE on page F5-4771 





Wait For Interrupt 


WFI on page F5-4773 





Yield 


YIELD on page F5-4775¢ 





a. For performance reasons, Arm deprecates many uses of the IT instruction, see 
Partial deprecation of IT on page F 1-3884. 


b. Arm deprecates any use of the SETEND instruction. 


c. See also The Yield instruction. 


Note 





Previous versions of the architecture defined the DBG instruction, that could provide a hint to the debug system, in 
this group. In Armv§8, this instruction executes as a NOP. Arm deprecates any use of the DBG instruction. 





F1.8.1 The Yield instruction 


In a Symmetric Multithreading (SMT) design, a thread can use the YIELD instruction to give a hint to the PE that it 
is running on. The YIELD hint indicates that whatever the thread is currently doing is of low importance, and so could 
yield. For example, the thread might be sitting in a spin-lock. A similar use might be in modifying the arbitration 

priority of the snoop bus in a multiprocessor (MP) system. Defining such an instruction permits binary compatibility 


between SMT and SMP systems. 
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AArch32 state defines a YIELD instruction as a specific NOP (No Operation) hint instruction. 


The YIELD instruction has no effect in a single-threaded system, but developers of such systems can use the 
instruction to flag its intended use on migration to a multiprocessor or multithreading system. Operating systems 
can use YIELD in places where a yield hint is wanted, knowing that it will be treated as a NOP if there is no 
implementation benefit. 


F1.8.2 Partial deprecation of IT 


Armv8-A deprecates some uses of the T32 IT instruction, for performance reasons. All uses of IT that apply to 
instructions other than a single subsequent 16-bit instruction from a restricted set are deprecated, as are explicit 
references to the PC within that single 16-bit instruction. This permits the non-deprecated forms of IT and 
subsequent instructions to be treated as a single 32-bit conditional instruction. Table F1-15 shows the restricted set 
of 16-bit instructions that are not deprecated when used in conjunction with IT. 


Table F1-15 Non-deprecated IT 16-bit conditional instructions 



































Non-deprecated 16-bit instructions Class Notes 
MOV, MVN Move Deprecated when Rm or Rd is the PC. 
LDR, LDRB, LDRH, LDRSB, LDRSH Load Deprecated for PC-relative load literal forms 
STR, STRB, STRH Store - 
ADD, ADC, RSB, SBC, SUB Add/Subtract Deprecated for ADD SP,SP,#imm, SUB SP,SP,#imm, and when Rm, Rdn, 
or Rdm is the PC 
CMP, CMN Compare Deprecated when Rm or Rn is the PC 
MUL Multiply - 
ASR, LSL, LSR, ROR Shift - 
AND, BIC, EOR, ORR, TST Logical = 
BX, BLX Branch to register Deprecated when Rm is the PC 
The full Armv7 IT instruction functionality remains available in order to execute legacy T32 code. It is 
IMPLEMENTATION DEFINED whether an Armv8 implementation provides an ITD control, that software can use to 
disable the deprecated uses of the IT instruction. In an implementation that included the ITD control, setting an ITD 
field to 1 disables the deprecated uses of the IT instruction, making those uses of the IT instruction UNDEFINED. The 
ITD control fields are: 
HSCTLR.ITD When EL2 is using AArch32, makes execution of the deprecated uses of the IT UNDEFINED at EL2. 
SCTLR.ATD When EL! is using AArch32, makes execution of the deprecated uses of the IT UNDEFINED at ELO 
and ELI. 
SCTLR_EL1.ITD 
When EL] is using AArch64, makes execution of the deprecated uses of the IT UNDEFINED at ELO 
when ELO is using AArch32. 
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F1.9 Exception-generating and exception-handling instructions 
The following instructions are intended specifically to cause a synchronous exception to occur: 


. The SVC instruction generates a Supervisor Call exception. For more information, see Supervisor Call (SVC) 
exception on page G1-5540. 


è The Breakpoint instruction BKPT provides software breakpoints. For more information, see Breakpoint 
Instruction exceptions on page G2-5625. 


è In an implementation that includes EL3 the SMC instruction generates a Secure Monitor Call exception. For 
more information, see Secure Monitor Call (SMC) exception on page G1-5541. 


7 In an implementation that includes EL2 the HVC instruction generates a Hypervisor Call exception. For more 
information, see Hypervisor Call (HVC) exception on page G1-5542. 


Debug state on page F1-3886 summarizes the Debug state instructions. 
For an exception taken to an EL1 mode: 
s The system level variants of the SUBS and LDM instructions can perform a return from an exception. 


Note 


The variants of SUBS include MOVS. See the references to Subtract (exception return), Move (exception return), 
and Load Multiple (exception return) in Table F1-16 for more information. 








. The SRS instruction can be used near the start of the handler, to store return information. The RFE instruction 
can then perform a return from the exception using the stored return information. 


In an implementation that includes EL2, the ERET instruction performs a return from an exception taken to Hyp 
mode. 


For more information, see Exception return to an Exception level using AArch32 on page G1-5523. 


Table F1-16 summarizes the instructions, in the T32 and A32 instruction sets, for generating or handling an 
exception. Except for BKPT and SVC, these are system level instructions. 


Table F1-16 Exception-generating and exception-handling instructions 





























Instruction See 

Supervisor Call SVC on page F5-4673 

Breakpoint BKPT on page F5-4133 

Secure Monitor Call SMC on page F5-4520 

Return From Exception RFE, RFEDA, RFEDB, RFEIA, RFEIB on page F5-4450 
Subtract (exception return)? SUB, SUBS (immediate) on page F5-46574 

Move (exception return)@ MOV, MOVS (register) on page F5-43434 

Hypervisor Call HVC on page F5-4201 

Exception Return ERET on page F5-4195 





Load Multiple (exception return) LDM (exception return) on page F5-4228 





Store Return State SRS, SRSDA, SRSDB, SRSIA, SRSIB on page F5-4555 





a. The A32 instruction set includes other instruction forms that can be used for an exception 
return, that have previously been described as variants of SUBS PC, LR. Arm deprecates any use 
of these instruction forms. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F1-3885 
ID070919 Non-Confidential 


The AArch32 Instruction Sets Overview 
F1.9 Exception-generating and exception-handling instructions 


F1.9.1 Debug state 


Table F1-17 shows the Debug state instructions that are implemented in the T32 instruction set: 


Table F1-17 T32 Debug state instructions 














Mnemonic Instruction See Note 
DCPSn Debug switch to ELn DCPSI on page F5-4174, DCPS2 on - 
page F5-4176, DCPS3 on page F5-4178 
ERET Debug restore PE ERET on page F5-4195 When executed in Debug state, the T1 
state (DRPS) encoding of ERET performs the DRPS operation 
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F1.10 System register access instructions 
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The System register encoding space is indexed using the parameters {coproc, opc1, CRn, CRm, opc2}, see The AArch32 
System register interface on page G1-5567. This encoding space provides System registers and System instructions. 
In Armv8, the only permitted values of coproc are b1110 and 0b1111, and the following instructions give access to 
this encoding space: 


. Instructions that transfer data between general-purpose registers and System registers. See: 
— MCR on page F5-4331. 
— MCRR on page F5-4333. 
— MRC on page F5-4354. 
— MRRC on page F5-4356. 


e Instructions that load or store from memory to a System register. See: 
— LDC (immediate) on page F5-4220. 
— LDC (literal) on page F5-4222. 
— STC on page F5-4571. 


Note 


The System register encoding space with coproc==0b101x is redefined to provide some of the Advanced SIMD and 
floating-point functionality. That is, to: 





- Initiate a floating-point data-processing operation, see Floating-point data-processing instructions on 
page F1-3901. 


s Transfer data between general-purpose registers and the Advanced SIMD and floating-point registers, see 
Advanced SIMD and floating-point register transfer instructions on page F1-3890. 


è Load or store data to the Advanced SIMD and floating-point registers, see Advanced SIMD and floating-point 
load/store instructions on page F1-3888. 





System register access instructions are part of the instruction stream executed by the PE, and therefore any System 
register access instruction that cannot be executed by the implementation causes an Undefined Instruction 
exception. In Armv8-A and Armv8-R, the instruction encodings in the System register access instruction encoding 
space are unallocated, and generate Undefined Instruction exceptions, except for: 


° The instructions summarized in this section that access the coproc==0b111x encoding space. 


$ The instructions in the coproc==0b101x encoding space that are redefined to provide Advanced SIMD and 
floating-point functionality, as summarized in the Note in this section. 
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F1.11 Advanced SIMD and floating-point load/store instructions 


Table F1-18 summarizes the SIMD and floating-point register file load/store instructions in the Advanced SIMD 
and floating-point instruction sets. 


Advanced SIMD also provides instructions for loading and storing multiple elements, or structures of elements, see 
Element and structure load/store instructions. 


Table F1-18 SIMD and floating-point register file load/store instructions 








Instruction See Operation 
Vector Load VLDM, VLDMDB, VLDMIA on page F6-5071 Load 1-16 consecutive 64-bit registers, Advanced SIMD and 
Multiple floating-point. 


Load 1-16 consecutive 32-bit registers, floating-point only. 














Vector Load VLDR (immediate) on page F6-5076 Load one 64-bit register, Advanced SIMD and floating-point. 
Register VLDR (literal) on page F6-5079 Load one 32-bit register, floating-point only. 

Vector Store VSTM, VSTMDB, VSTMIA on page F6-5425 Store 1-16 consecutive 64-bit registers, Advanced SIMD and 
Multiple floating-point. 

Store 1-16 consecutive 32-bit registers, floating-point only. 
Vector Store VSTR on page F6-5430 Store one 64-bit register, Advanced SIMD and floating-point. 
Register Store one 32-bit register, floating-point only. 
F1.11.1 Element and structure load/store instructions 


Table F1-19 shows the element and structure load/store instructions available in the Advanced SIMD instruction 
set. Loading and storing structures of more than one element automatically de-interleaves or interleaves the 
elements, see Figure F1-1 on page F1-3889 for an example of de-interleaving. Interleaving is the inverse process. 


Table F1-19 Element and structure load/store instructions 





Instruction See 





Load single element 





Multiple elements VLD1 (multiple single elements) on page F6-5025 





To one lane VLD] (single element to one lane) on page F6-5017 





To all lanes VLD] (single element to all lanes) on page F6-5022 





Load 2-element structure 





Multiple structures VLD2 (multiple 2-element structures) on page F6-5042 





To one lane VLD2 (single 2-element structure to one lane) on page F6-5033 





To all lanes VLD2 (single 2-element structure to all lanes) on page F6-5039 





Load 3-element structure 





Multiple structures VLD3 (multiple 3-element structures) on page F6-5056 








To one lane VLD3 (single 3-element structure to one lane) on page F6-5047 
To all lanes VLD3 (single 3-element structure to all lanes) on page F6-5053 
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Table F1-19 Element and structure load/store instructions (continued) 





Instruction See 


Load 4-element structure 





Multiple structures VLD4 (multiple 4-element structures) on page F6-5068 





To one lane VLD4 (single 4-element structure to one lane) on page F6-5059 





To all lanes VLD4 (single 4-element structure to all lanes) on page F6-5065 





Store single element 





Multiple elements VSTI (multiple single elements) on page F6-5388 





From one lane VSTI (single element from one lane) on page F6-5383 





Store 2-element structure 





Multiple structures VST2 (multiple 2-element structures) on page F6-5402 





From one lane VST2 (single 2-element structure from one lane) on page F6-5396 





Store 3-element structure 





Multiple structures VST3 (multiple 3-element structures) on page F6-5413 





From one lane VST3 (single 3-element structure from one lane) on page F6-5407 





Store 4-element structure 





Multiple structures VST4 (multiple 4-element structures) on page F6-5422 





From one lane VST4 (single 4-element structure from one lane) on page F6-5416 





Figure F1-1 shows the de-interleaving of a VLD3.16 (multiple 3-element structures) instruction: 
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A[0].x 
AlOl.y 
A(O].z 
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Al2].z \ | 
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A[3].z Y3|Y2/Y1|Yo|D1 Registers 
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Figure F1-1 De-interleaving an array of 3-element structures 
Figure F1-1 shows the VLD3.16 instruction operating to three 64-bit registers that comprise four 16-bit elements: 


° Different instructions in this group would produce similar figures, but operate on different numbers of 
registers. For example, VLD4 and VST4 instructions operate on four registers. 


7 Different element sizes would produce similar figures but with 8-bit or 32-bit elements. 
. These instructions operate only on doubleword (64-bit) registers. 
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F1.12 Advanced SIMD and floating-point register transfer instructions 


Table F 1-20 summarizes the SIMD and floating-point register file transfer instructions in the Advanced SIMD and 


floating-point instruction sets. These instructions transfer data between the general-purpose registers and the 


registers in the SIMD and floating-point register file. 


Advanced SIMD vectors, and single-precision and double-precision floating-point registers, are all views of the 
same register file. For details see The SIMD and floating-point register file on page E1-3794. 


Table F1-20 SIMD and floating-point register file transfer instructions 





Instruction 


See 





Copy element from general-purpose register to every element of an Advanced 
SIMD vector 


VDUP (general-purpose register) on 
page F6-4971 





Copy byte, halfword, or word from general-purpose register to a register in the 
SIMD and floating-point register file 


VMOV (general-purpose register to scalar) on 
page F6-5141 





Copy byte, halfword, or word from a register in the SIMD and floating-point 
register file to a general-purpose register 


VMOV (scalar to general-purpose register) on 
page F6-5145 





Copy from half-precision floating-point register to general-purpose register, or 
from general-purpose register to half-precision floating-point register 


Only supported if ARMv8.2-FP16 is implemented 


VMOV (between general-purpose register and 
half-precision) on page F6-5128 





Copy from single-precision floating-point register to general-purpose register, or 
from general-purpose register to single-precision floating-point register 


VMOV (between general-purpose register and 
single-precision) on page F6-5143 





Copy two words from general-purpose registers to consecutive single-precision 
floating-point registers, or from consecutive single-precision floating-point 
registers to general-purpose registers 


VMOV (between two general-purpose registers 
and two single-precision registers) on 
page F6-5147 





Copy two words from general-purpose registers to a doubleword register in the 
SIMD and floating-point register file, or from a doubleword register in the SIMD 
and floating-point register file to general-purpose registers 


VMOV (between two general-purpose registers 
and a doubleword floating-point register) on 
page F6-5126 





Copy from an Advanced SIMD and floating-point System Register to a 
general-purpose register 


VMRS on page F6-5156 





Copy from a general-purpose register to an Advanced SIMD and floating-point 
System Register 


VMSR on page F6-5159 
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F1.13 Advanced SIMD data-processing instructions 


Advanced SIMD data-processing instructions process registers containing vectors of elements of the same type 
packed together, enabling the same operation to be performed on multiple items in parallel. 


Instructions operate on vectors held in 64-bit or 128-bit registers. Figure F 1-2 shows an operation on two 64-bit 
operand vectors, generating a 64-bit vector result. 


Note 


Figure F1-2 and other similar figures show 64-bit vectors that consist of four 16-bit elements, and 128-bit vectors 
that consist of four 32-bit elements. Other element sizes produce similar figures, but with one, two, eight, or sixteen 
operations performed in parallel instead of four. 
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Figure F1-2 Advanced SIMD instruction operating on 64-bit registers 


Many Advanced SIMD instructions have variants that produce vectors of elements double the size of the inputs. In 
this case, the number of elements in the result vector is the same as the number of elements in the operand vectors, 
but each element, and the whole vector, is double the size. 


Figure F1-3 shows an example of an Advanced SIMD instruction operating on 64-bit registers, and generating a 
128-bit result. 
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Figure F1-3 Advanced SIMD instruction producing wider result 
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There are also Advanced SIMD instructions that have variants that produce vectors containing elements half the 
size of the inputs. Figure F1-4 on page F1-3892 shows an example of an Advanced SIMD instruction operating on 
one 128-bit register, and generating a 64-bit result. 
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Figure F1-4 Advanced SIMD instruction producing narrower result 
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Some Advanced SIMD instructions do not conform to these standard patterns. Their operation patterns are 
described in the individual instruction descriptions. 


Advanced SIMD instructions that perform floating-point arithmetic use the Arm standard floating-point arithmetic 
defined in Advanced SIMD and floating-point support on page A1-51. 


The following sections summarize the Advanced SIMD data-processing instructions: 


Advanced SIMD parallel addition and subtraction. 

Bitwise Advanced SIMD data-processing instructions on page F1-3893. 
Advanced SIMD comparison instructions on page F1-3894. 

Advanced SIMD shift instructions on page F1-3895. 

Advanced SIMD multiply instructions on page F1-3896. 

Advanced SIMD dot product instructions on page F1-3897. 

Miscellaneous Advanced SIMD data-processing instructions on page F1-3898. 
The Cryptographic Extension in AArch32 state on page F1-3899. 


F1.13.1 Advanced SIMD parallel addition and subtraction 


Table F1-21 shows the Advanced SIMD parallel add and subtract instructions. 


F1-3892 


Table F1-21 Advanced SIMD parallel add and subtract instructions 
































Instruction See 

Vector Add VADD (integer) on page F6-4845 
VADD (floating-point) on page F6-4841 

Vector Add and Narrow, returning High Half VADDHN on page F6-4847 

Vector Add Long VADDL on page F6-4849 

Vector Add Wide VADDW on page F6-4851 

Vector Halving Add VHADD on page F6-5007 

Vector Halving Subtract VHSUB on page F6-5010 

Vector Pairwise Add and Accumulate Long VPADAL on page F6-5205 

Vector Pairwise Add VPADD (integer) on page F6-5210 
VPADD (floating-point) on page F6-5208 

Vector Pairwise Add Long VPADDL on page F6-5212 

Vector Rounding Add and Narrow, returning High Half VRADDHN on page F6-5281 

Vector Rounding Halving Add VRHADD on page F6-5296 





Vector Rounding Subtract and Narrow, returning High Half VRSUBHN on page F6-5344 
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Table F1-21 Advanced SIMD parallel add and subtract instructions (continued) 























Instruction See 
Vector Saturating Add VOADD on page F6-5229 
Vector Saturating Subtract VOSUB on page F6-5279 
Vector Subtract VSUB (integer) on page F6-5437 
VSUB (floating-point) on page F6-5433 
Vector Subtract and Narrow, returning High Half VSUBHN on page F6-5439 
Vector Subtract Long VSUBL on page F6-5441 
Vector Subtract Wide VSUBW on page F6-5443 
F1.13.2 Bitwise Advanced SIMD data-processing instructions 


Table F1-22 shows bitwise Advanced SIMD data-processing instructions. These operate on the doubleword (64-bit) 
or quadword (128-bit) registers in the SIMD and floating-point register file, and there is no division into vector 






































elements. 
Table F1-22 Bitwise Advanced SIMD data-processing instructions 
Instruction See 
Vector Bitwise AND VAND (register) on page F6-4856 
Vector Bitwise Bit Clear (AND complement) VBIC (immediate) on page F6-4858 
VBIC (register) on page F6-4861 
Vector Bitwise Exclusive OR VEOR on page F6-4975 
Vector Bitwise Insert if False VBIF on page F6-4863 
Vector Bitwise Insert if True VBIT on page F6-4865 
Vector Bitwise Move VMOV (immediate) on page F6-5130 
VMOV (register) on page F6-5137 
Vector Bitwise NOT VMVN (immediate) on page F6-5176 
VMVN (register) on page F6-5180 
Vector Bitwise OR VORR (immediate) on page F6-5200 
VORR (register) on page F6-5203 
Vector Bitwise OR NOT VORN (register) on page F6-5198 
Vector Bitwise Select VBSL on page F6-4867 
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F1.13.3 Advanced SIMD comparison instructions 


Table F1-23 shows Advanced SIMD comparison instructions. 


Table F1-23 Advanced SIMD comparison instructions 





Instruction See 





Vector Absolute Compare Greater Than or Equal VACGE on page F6-4831 














Vector Absolute Compare Greater Than VACGT on page F6-4836 

Vector Compare Equal VCEQ (register) on page F6-4873 
Vector Compare Equal to Zero VCEQ (immediate #0) on page F6-4871 
Vector Compare Greater Than or Equal VCGE (register) on page F6-4879 





Vector Compare Greater Than or Equal to Zero VCGE (immediate #0) on page F6-4876 




















Vector Compare Greater Than VCGT (register) on page F6-4886 
Vector Compare Greater Than Zero VCGT (immediate #0) on page F6-4883 
Vector Compare Less Than or Equal to Zero VCLE (immediate #0) on page F6-4890 
Vector Compare Less Than Zero VCLT (immediate #0) on page F6-4898 
Vector Test Bits VTST on page F6-5453 
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Table F1-24 lists the shift instructions in the Advanced SIMD instruction set. 


Table F1-24 Advanced SIMD shift instructions 





Instruction 


See 





Vector Saturating Rounding Shift Left 


VORSHL on page F6-5258 





Vector Saturating Rounding Shift Right and Narrow 


VORSHRN, VORSHRUN on page F6-5262 





Vector Saturating Shift Left 


VOSHL (register) on page F6-5270 
VOSHL, VOSHLU (immediate) on page F6-5267 





Vector Saturating Shift Right and Narrow 


VOSHRN, VOSHRUN on page F6-5274 





Vector Rounding Shift Left 


VRSHL on page F6-5325 





Vector Rounding Shift Right 


VRSHR on page F6-5328 





Vector Rounding Shift Right and Accumulate 


VRSRA on page F6-5341 





Vector Rounding Shift Right and Narrow 


VRSHRN on page F6-5333 











Vector Shift Left VSHL (immediate) on page F6-5354 
VSHL (register) on page F6-5357 

Vector Shift Left Long VSHLL on page F6-5360 

Vector Shift Right VSHR on page F6-5363 





Vector Shift Right and Narrow 


VSHRN on page F6-5368 





Vector Shift Left and Insert 


VSLI on page F6-5372 





Vector Shift Right and Accumulate 


VSRA on page F6-5377 





Vector Shift Right and Insert 


VSRI on page F6-5380 
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F1.13.5 Advanced SIMD multiply instructions 


Table F1-25 summarizes the Advanced SIMD multiply instructions. 


Table F1-25 Advanced SIMD multiply instructions 





Instruction See 





Vector Multiply Accumulate VMLA (integer) on page F6-5104 
VMLA (floating-point) on page F6-5100 
VMLA (by scalar) on page F6-5106 





Vector Multiply Accumulate Long VMLAL (integer) on page F6-5109 
VMLAL (by scalar) on page F6-5111 





Vector Multiply Subtract VMLS (integer) on page F6-5117 
VMLS (floating-point) on page F6-5113 
VMLS (by scalar) on page F6-5119 





Vector Multiply Subtract Long VMLSL (integer) on page F6-5122 
VMLSL (by scalar) on page F6-5124 





Vector Multiply VMUL (integer and polynomial) on page F6-5165 
VMUL (floating-point) on page F6-5161 
VMUL (by scalar) on page F6-5168 





























Vector Multiply Long VMULL (integer and polynomial) on page F6-5171 
VMULL (by scalar) on page F6-5174 
Vector Fused Multiply Accumulate VFMA on page F6-4981 
Vector Floating-Point Multiply-Add Long VFMAL (vector) on page F6-4985 
VF MAL (by scalar) on page F6-4988 
Vector Fused Multiply Subtract VFMS on page F6-4991 
Vector Floating-Point Multiply-Subtract Long VF MSL (vector) on page F6-4995 
VF MSL (by scalar) on page F6-4998 
Vector Saturating Doubling Multiply Accumulate Long VODMLAL on page F6-5231 
Vector Saturating Doubling Multiply Subtract Long VODMLSL on page F6-5234 
Vector Saturating Doubling Multiply Returning High Half VODMULH on page F6-5237 
Vector Saturating Doubling Multiply Long VODMULL on page F6-5240 





Vector Saturating Rounding Doubling Multiply Accumulate Returning High VORDMLAH on page F6-5247 
Half 





Vector Saturating Rounding Doubling Multiply Subtract Returning High Half VORDMLSH on page F6-5251 





Vector Saturating Rounding Doubling Multiply Returning High Half VORDMULH on page F6-5255 





Advanced SIMD multiply instructions can operate on vectors of: 
7 8-bit, 16-bit, or 32-bit unsigned integers. 
8-bit, 16-bit, or 32-bit signed integers. 


è 8-bit polynomials over {0, 1}. VMUL and VMULL are the only instructions that operate on polynomials. VMULL 
produces a 16-bit polynomial over {0, 1}. 
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e Single-precision (32-bit) or half-precision (16-bit) floating-point numbers. 
They can also act on one vector and one scalar. 


Long instructions have doubleword (64-bit) operands, and produce quadword (128-bit) results. Other Advanced 
SIMD multiply instructions can have either doubleword or quadword operands, and produce results of the same 
size. 


Floating-point multiply instructions can operate on: 


è Half-precision (16-bit) floating-point numbers. 
è Single-precision (32-bit) floating-point numbers. 
. Double-precision (64-bit) floating-point numbers. 


F1.13.6 Advanced SIMD dot product instructions 


ARMv8.2-DotProd provides SIMD instructions that perform the dot product of the four 8-bit subelements of the 
32-bit elements of one vector with the four 8-bit subelements of a second vector. It provides two forms of the 
instructions, each with signed and unsigned versions: 


Vector form The dot product is calculated for each element of the first vector with the corresponding element of 
the second element. 


Indexed form The dot product is calculated for each element of the first vector with the element of the second 
vector that is indicated by the index argument to the instruction. 





Note 


That is, a single element from the second vector is used, and a the dot product is calculated between 
each element of the first vector and this single element from the second vector. 





Table F1-26 Advanced SIMD dot product instructions 














Mnemonic Instruction See 

VSDOT Signed dot product (vector form) VSDOT (vector) on page F6-5348 

VUDOT Unsigned dot product (vector form) VUDOT (vector) on page F6-5457 

VSDOT Signed dot product (indexed form) VSDOT (by element) on page F6-5346 

VUDOT Unsigned dot product (indexed form) | VUDOT (by element) on page F6-5455 
F1.13.7 Advanced SIMD complex number arithmetic instructions 


ARMv8.3-CompNum provides AArch32 Advanced SIMD instructions that perform arithmetic on complex 
numbers held in element pairs in vector registers, where the less significant element of the pair contains the real 
component and the more significant element contains the imaginary component. 


These instructions provide single-precision versions. If ARMv8.2-FP16 is implemented they also provide 
half-precision versions, otherwise the half-precision encodings are UNDEFINED. 
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Table F1-27 shows the ARMv8.3-CompNum AArch32 Advanced SIMD instructions: 


Table F1-27 Advanced SIMD complex number arithmetic instructions 














Mnemonic Instruction See 

VCADD Floating-point complex add VCADD on page F6-4869 

VCMLA Floating-point complex multiply accumulate (vector form) VCMLA on page F6-4906 

VCMLA Floating-point complex multiply accumulate (indexed form) VCMLA (by element) on page F6-4909 





A pair of VCMLA instructions can be used to perform a complex number multiplication. In Complex multiplication on 
page K10-7730, this is demonstrated for the similar AArch64 instruction FCMLA. The usage of VCMLA in this manner 


is identical. 





F1.13.8 Miscellaneous Advanced SIMD data-processing instructions 
Table F1-28 shows miscellaneous Advanced SIMD data-processing instructions. 
Table F1-28 Miscellaneous Advanced SIMD data-processing instructions 
Instruction See 





Vector Absolute Difference and Accumulate 


VABA on page F6-4817 





Vector Absolute Difference and Accumulate Long 


VABAL on page F6-4819 





Vector Absolute Difference 


VABD (integer) on page F6-4823 
VABD (floating-point) on page F6-4821 





Vector Absolute Difference Long 


VABDL (integer) on page F6-4825 





Vector Absolute 


VABS on page F6-4827 





Vector Convert between floating-point and fixed 
point 


VCVT (between floating-point and fixed-point, Advanced SIMD) on 
page F6-4936 





Vector Convert between floating-point and integer 


VCVT (between floating-point and integer, Advanced SIMD) on page F6-4926 





Vector Convert between half-precision and 
single-precision 


VCVT (between half-precision and single-precision, Advanced SIMD) on 
page F6-4924 





Vector Count Leading Sign Bits 


VCLS on page F6-4896 





Vector Count Leading Zeros 


VCLZ on page F6-4904 





Vector Count Set Bits 


VCNT on page F6-4920 





Vector Duplicate scalar 


VDUP (scalar) on page F6-4973 





Vector Extract 


VEXT (byte elements) on page F6-4977 





Vector move Insertion 


VINS on page F6-5013 





Vector Move and Narrow 


VMOVN on page F6-5152 





Vector Move Long 


VMOVL on page F6-5150 





Vector Move extraction 


VMOVX on page F6-5154 





Vector Maximum 


F1-3898 
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Table F1-28 Miscellaneous Advanced SIMD data-processing instructions (continued) 





Instruction 


Vector Minimum 


See 


VMIN (integer) on page F6-5093 
VMIN (floating-point) on page F6-5091 





Vector Negate 


VNEG on page F6-5182 





Vector Pairwise Maximum 


VPMAX (integer) on page F6-5217 
VPMAX (floating-point) on page F6-5215 





Vector Pairwise Minimum 


VPMIN (integer) on page F6-5221 
VPMIN (floating-point) on page F6-5219 





Vector Reciprocal Estimate 


VRECPE on page F6-5283 





Vector Reciprocal Step 


VRECPS on page F6-5285 





Vector Reciprocal Square Root Estimate 


VRSQRTE on page F6-5337 





Vector Reciprocal Square Root Step 


VRSORTS on page F6-5339 





Vector Reverse in halfwords 


VREV16 on page F6-5287 





Vector Reverse in words 


VREV32 on page F6-5290 





Vector Reverse in doublewords 


VREV64 on page F6-5293 





Vector Saturating Absolute 


VOABS on page F6-5227 





Vector Saturating Move and Narrow 


VOMOVN, VOMOVUN on page F6-5243 





Vector Saturating Negate 


VONEG on page F6-5245 





Vector Swap 


VSWP on page F6-5445 





Vector Table Lookup 


VTBL, VTBX on page F6-5447 





Vector Transpose 


VTRN on page F6-5450 





Vector Unzip 


VUZP on page F6-5459 





Vector Zip 


VZIP on page F6-5463 





F1.13.9 The Cryptographic Extension in AArch32 state 


The instructions provided by the optional Cryptographic Extension use the Advanced SIMD and floating-point 
register file. For more information about the functions they provide see: 


° Announcing the Advanced Encryption Standard. 
$ The Galois/Counter Mode of Operation. 
$ Announcing the Secure Hash Standard. 


Table F1-29 shows the AArch32 Cryptographic Extension instructions. 


Table F1-29 AArch32 Cryptographic Extension instructions 














Mnemonic Instruction See 
AESD AES single round decryption AESD on page F6-4783 
AESE AES single round encryption AESE on page F6-4785 
AESIMC AES inverse mix columns AESIMC on page F6-4787 
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Table F1-29 AArch32 Cryptographic Extension instructions (continued) 






































Mnemonic Instruction See 

AESMC AES mix columns AESMC on page F6-4789 
VMULL Polynomial multiply long VMULL (integer and polynomial) on page F6-51712 
SHA1C SHA1 hash update (choose) SHAIC on page F6-4797 
SHA1H SHA1 fixed rotate SHA1H on page F6-4799 
SHAM SHA1 hash update (majority) SHA/M on page F6-4801 
SHA1P SHA1 hash update (parity) SHAIP on page F6-4803 
SHA1SUQ SHA1 schedule update 0 SHA1SUO0 on page F6-4805 
SHA1SU1 SHA1 schedule update 1 SHAISUI on page F6-4807 
SHA256H SHA256 hash update (part 1) SHA256H on page F6-4809 
SHA256H2 SHA256 hash update (part 2) SHA256H2 on page F6-4811 
SHA256SUQ SHA256 schedule update 0 SHA256SU0 on page F6-48 13 
SHA256SU1 SHA256 schedule update 1 SHA256SU1 on page F6-4815 





a. The Cryptographic Extension adds the variant of the instruction that operates on two 64-bit polynomials. 


See The Armv8 Cryptographic Extension on page A2-66 for information about the permitted implementation 
options for the Cryptographic Extension. 
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F1.14 Floating-point data-processing instructions 


Table F1-30 summarizes the data-processing instructions in the floating-point instruction set. In this table, 


floating-point register means a register in the SIMD and floating-point register file. 


For details of the floating-point arithmetic used by floating-point instructions, see Advanced SIMD and 


floating-point support on page A1-51. 


Table F1-30 Floating-point data-processing instructions 





Instruction 


See 





Convert between double-precision and single-precision 


VCVT (between double-precision and single-precision) on page F6-4922 





Convert between floating-point and fixed-point 


VCVT (between floating-point and fixed-point, floating-point) on 
page F6-4939 





Convert between half-precision and single-precision, 
writing to bottom half of single-precision register 


VCVTB on page F6-4947 





Convert between half-precision and single-precision, 
writing to top half of single-precision register 


VCVTT on page F6-4966 





Convert from floating-point to integer 


VCVT (floating-point to integer, floating-point) on page F6-4929 





Convert from floating-point to integer using FPSCR 
rounding mode 


VCVTR on page F6-4962 





Convert from integer to floating-point 


VCVT (integer to floating-point, floating-point) on page F6-4933 





Floating-point Javascript convert to signed fixed-point, 
rounding toward zero 


VICVT on page F6-5015 





Copy from one floating-point register to another 


VMOV (register) on page F6-5137 





Divide 


VDIV on page F6-4969 





Move immediate value to a floating-point register 


VMOV (immediate) on page F6-5130 





Square Root 


VSORT on page F6-5375 





Vector Absolute value 


VABS on page F6-4827 





Vector Add 


VADD (floating-point) on page F6-4841 





Vector Compare with exceptions disabled 


VCMPE on page F6-4916 





Vector Compare with exceptions enabled 


VCMP on page F6-4912 





Vector Fused Multiply Accumulate 


VFMA on page F6-4981 





Vector Fused Multiply Subtract 


VFMS on page F6-4991 





Vector Fused Negate Multiply Accumulate 


VFNMA on page F6-5001 





Vector Fused Negate Multiply Subtract 


VFNMS on page F6-5004 





Vector Multiply 


VMUL (floating-point) on page F6-5161 





Vector Multiply Accumulate 


VMLA (floating-point) on page F6-5100 





Vector Multiply Subtract 


VMLS (floating-point) on page F6-5113 





Vector Negate Multiply 


VNMUL on page F6-5192 








Vector Negate Multiply Accumulate 


VNMLA on page F6-5186 
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The AArch32 Instruction Sets Overview 
F1.14 Floating-point data-processing instructions 


Table F1-30 Floating-point data-processing instructions (continued) 














Instruction See 
Vector Negate Multiply Subtract VNMLS on page F6-5189 
Vector Negate, by inverting the sign bit VNEG on page F6-5182 
Vector Subtract VSUB (floating-point) on page F6-5433 
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Chapter F2 


About the T32 and A32 Instruction Descriptions 


This chapter describes each instruction. It contains the following sections: 
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Format of instruction descriptions on page F2-3904. 

Standard assembler syntax fields on page F2-3908. 

Conditional execution on page F2-3909. 

Shifts applied to a register on page F2-3911. 

Memory accesses on page F2-3913. 

Encoding of lists of general-purpose registers and the PC on page F2-3914. 

General information about the T32 and A32 instruction descriptions on page F2-3915. 
Additional pseudocode support for instruction descriptions on page F2-3928. 

Additional information about Advanced SIMD and floating-point instructions on page F2-3929. 
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F2.1 Format of instruction descriptions 


The instruction descriptions in Chapter F5 732 and A32 Base Instruction Set Instruction Descriptions and 
Chapter F6 732 and A32 Advanced SIMD and Floating-point Instruction Descriptions normally use the following 
format: 


Instruction section title. 

Introduction to the instruction. 

A description of each encoding of the instruction. 
Assembler syntax. 

Pseudocode describing how the instruction operates. 
Notes, if applicable. 


Each of these items is described in more detail in the following subsections. 


F2.1.1 Instruction section title 


The instruction section title gives the base mnemonic for the instruction or instructions described in the section. 
When one mnemonic has multiple forms described in separate instruction sections, this is followed by a short 
description of the form in parentheses. The most common use of this is to distinguish between forms of an 
instruction in which one of the operands is an immediate value and forms in which it is a register. 


F2.1.2 Introduction to the instruction 


The introduction to the instruction briefly describes the main features of the instruction. This description is not 
necessarily complete and is not definitive. If there is any conflict between it and the more detailed information that 
follows, the latter takes priority. 


F2.1.3 Instruction encodings 


This is a list of one or more instruction encodings. Each instruction encoding is labelled as: 


Al, A2, A3 ... for the first, second, third and any additional A32 encodings. 
T1, T2, T3 ... for the first, second, third and any additional T32 encodings. 


Each instruction encoding description consists of: 


F2-3904 


An assembly syntax that ensures that the assembler selects the encoding in preference to any other encoding. 
In some cases, multiple syntax variants are given. These are written in a typewriter font using the 
conventions described in Assembler syntax prototype line conventions on page F2-3906. The correct one to 
use can be indicated by: 


— A subheading that identifies the encodings that correspond to the syntax. See, for example, the 
subheading Flag setting, rotate right with extend variant in the description of the Al encoding of the 
ADC, ADCS (register) instructions in A/ on page F5-4072. 


— Anannotation to the syntax, such as Inside IT block or Outside IT block. See, for example, the syntax 
descriptions of the T1 encoding of the ADC, ADCS (register) instructions in TZ on page F5-4073. 


In other cases, the correct one to use can be determined by looking at the assembler syntax description and 
using it to determine which syntax corresponds to the instruction being disassembled. 


There is usually more than one syntax variant that ensures re-assembly to any particular encoding, and the 
exact set of syntaxes that do so usually depends on the register numbers, immediate constants and other 
operands to the instruction. For example, when assembling to the T32 instruction set, the syntax AND RQ, RQ, 
R8 ensures selection of a 32-bit encoding but AND RO, RQ, R1 selects a 16-bit encoding. 
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For each instruction encoding belonging to a target instruction set, an assembler can use this information to 
determine whether it can use that encoding to encode the instruction requested by the UAL source. If multiple 
encodings can encode the instruction then: 


—  Ifbotha 16-bit encoding and a 32-bit encoding can encode the instruction, the architecture prefers the 
16-bit encoding. This means the assembler must use the 16-bit encoding rather than the 32-bit 
encoding. 

Software can use the .W and .N qualifiers to specify the required encoding width, see Standard 
assembler syntax fields on page F2-3908. 


— If multiple encodings of the same length can encode the instruction, the Assembler syntax subsection 
says which encoding is preferred, and how software can, instead, select the other encodings. 


Each encoding also documents UAL syntax that selects it in preference to any other encoding. 


Ifno encodings of the target instruction set can encode the instruction requested by the UAL source, normally 
the assembler generates an error saying that the instruction is not available in that instruction set. 


Note 


In some cases, an instruction is available in one instruction set but not in another. The Assembler syntax 
subsection identifies many of these cases. For example, the A32 instructions with bits<3 1:28> == 0b1111 
described in Branch, branch with link, and block data transfer on page F4-4032, System register access, 
Advanced SIMD, floating-point, and Supervisor call on page F4-4034, and Unconditional instructions on 
page F4-4048 cannot have a Condition code, but the equivalent T32 instructions often can, and this usually 
appears in the Assembler syntax subsection as a statement that the A32 instruction cannot be conditional. 





However, some such cases are too complex to describe in the available space, so the definitive test of whether 
an instruction is available in a given instruction set is whether there is an available encoding for it in that 
instruction set. 





The assembly syntax given for an encoding is therefore a suitable one for a disassembler to disassemble that 
encoding to. However, disassemblers might wish to use simpler syntaxes when they are suitable for the 
operand combination, in order to produce more readable disassembled code. 


An encoding diagram, where: 
— Fora 32-bit A32 encoding diagram, the bits are numbered from 31 to 0. 


— Fora 16-bit T32 encoding diagram, the bits are numbered from 15 to 0. 
This halfword can be described as hw1 of the instruction. 


— Fora 32-bit T32 encoding diagram, the bits are numbered from 15 to 0 for each halfword, as a 
reminder that a 32-bit T32 instruction consists of two consecutive halfwords rather than a word. 


In this case, the left-hand halfword in the diagram is identified as hw1, and the right-hand halfword is 
identified as hw2. 


Where instructions are stored using the standard little-endian instruction endianness: 


— The encoding diagram for an A32 instruction at address A shows, from left to right, the bytes at 
addresses A+3, A+2, A+1, A. 


— The encoding diagram for a 32-bit T32 instruction shows bytes in the order A+1, A for hw1, followed 
by bytes A+3, A+2 for hw2. 


Encoding-specific pseudocode. This is pseudocode that translates the encoding-specific instruction fields 
into inputs to the encoding-independent pseudocode in the Operation subsection, and that picks out any 
special cases in the encoding. For a detailed description of the pseudocode used and of the relationship 
between the encoding diagram, the encoding-specific pseudocode and the encoding-independent 
pseudocode, see Appendix K13 Arm Pseudocode Definition. 


F2.1.4 Assembler symbols 
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The Assembly symbols describes the standard UAL syntax for the instruction. 


Each syntax description consists of the following elements: 


Descriptions of all of the variable or optional fields of the syntax. 
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Asse 


The fo 


<> 


{3} 


spaces 
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Some syntax fields are standardized across all or most instructions. Standard assembler syntax fields on 
page F2-3908 describes these fields. 


By default, syntax fields that specify registers, such as <Rd>, <Rn>, or <Rt>, can be any of RO-R12 or LR in 
T32 instructions, and any of RO-R12, SP or LR in A32 instructions. These require that the encoding-specific 
pseudocode set the corresponding integer variable (such as d, n, or t) to the corresponding register number, 
using 0-12 for RO-R12, 13 for SP, or 14 for LR: 


— Normally, software can do this by setting the corresponding field in the instruction, typically named 
Rd, Rn, Rt, to the binary encoding of that number. 


— In the case of 16-bit T32 encodings, the field is normally of length 3, and so the encoding is only 
available when the assembler syntax specifies one of RO-R7. Such encodings often use a register field 
name like Rdn. This indicates that the encoding is only available if <Rd> and <Rn> specify the same 
register, and that the register number of that register is encoded in the field if they do. 


The description of a syntax field that specifies a register sometimes extends or restricts the permitted range 
of registers or documents other differences from the default rules for such fields. Examples of extensions are 
permitting the use of the SP in a T32 instruction, or permitting the use of the PC, identified using register 
number 15. 


Where appropriate, text that briefly describes changes from the pre-UAL assembler syntax. Where present, 
this usually consists of an alternative pre-UAL form of the assembler mnemonic. The pre-UAL assembler 
syntax does not conflict with UAL. Arm recommends that it is supported, as an optional extension to UAL, 
so that pre-UAL assembler source files can be assembled. 


mbler syntax prototype line conventions 
llowing conventions are used in assembler syntax prototype lines and their subfields: 


Any item bracketed by < and > is a short description of a type of value to be supplied by the user in 
that position. A longer description of the item is normally supplied by subsequent text. Such items 
often correspond to a similarly named field in an encoding diagram for an instruction. When the 
correspondence only requires the binary encoding of an integer value or register number to be 
substituted into the instruction encoding, it is not described explicitly. For example, if the assembler 
syntax for an instruction contains an item <Rn> and the instruction encoding diagram contains a 4-bit 
field named Rn, the number of the register specified in the assembler syntax is encoded in binary in 
the instruction field. 


If the correspondence between the assembler syntax item and the instruction encoding is more 
complex than simple binary encoding of an integer or register number, the item description indicates 
how it is encoded. This is often done by specifying a required output from the encoding-specific 
pseudocode, such as add = TRUE. The assembler must only use encodings that produce that output. 


Any item bracketed by { and } is optional. A description of the item and of how its presence or 
absence is encoded in the instruction is normally supplied by subsequent text. 


Many instructions have an optional destination register. Unless otherwise stated, if such a 
destination register is omitted, it is the same as the immediately following source register in the 
instruction syntax. 


In the assembler syntax, numeric constants are normally preceded by a #. Some UAL instruction 
syntax descriptions explicitly show this # as optional. Any UAL assembler: 
s Must treat the # as optional where an instruction syntax description shows it as optional. 


° Can treat the # either as mandatory or as optional where an instruction syntax description does 
not show it as optional. 





Note 


Arm recommends that UAL assemblers treat all uses of # shown in this manual as optional. 





Single spaces are used for clarity, to separate items. When a space is obligatory in the assembler 
syntax, two or more consecutive spaces are used. 
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+/- This indicates an optional + or - sign. If neither is coded, + is assumed. 


All other characters must be encoded precisely as they appear in the assembler syntax. Apart from { and }, the 
special characters described above do not appear in the basic forms of assembler instructions documented in this 
manual. In a few places, the { and } characters must be encoded as part of a variable item. When this happens, the 
long description of the variable item indicates how they must be used. 


F2.1.5 Pseudocode describing how the instruction operates 
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The Operation for all classes subsection contains encoding-independent pseudocode that describes the main 
operation of the instruction. For a detailed description of the pseudocode used and of the relationship between the 
encoding diagram, the encoding-specific pseudocode and the encoding-independent pseudocode, see 

Appendix K13 Arm Pseudocode Definition. 
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F2.2 Standard assembler syntax fields 


F2.2 
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Standard assembler syntax fields 


The following assembler syntax fields are standard across all or most instructions: 


<c> 


<q> 


Is an optional field. It specifies the condition under which the instruction is executed. See 
Conditional execution on page F2-3909 for the range of available conditions and their encoding. If 
<c> is omitted, it defaults to always (AL). 


Specifies optional assembler qualifiers on the instruction. The following qualifiers are defined: 


-N Meaning narrow, specifies that the assembler must select a 16-bit encoding for the 
instruction. If this is not possible, an assembler error is produced. 


W Meaning wide, specifies that the assembler must select a 32-bit encoding for the 
instruction. If this is not possible, an assembler error is produced. 


If neither .W nor .N is specified, the assembler can select either 16-bit or 32-bit encodings. If both 
are available, it must select a 16-bit encoding. In a few cases, more than one encoding of the same 
length can be available for an instruction. The rules for selecting between such encodings are 
instruction-specific and are part of the instruction description. The assembler syntax includes a 
mandatory .W qualifier, along with a note describing the cases in which it applies, where this 
qualifier is required to select a particular encoding for an instruction. Additional assembler syntax 
will describe the syntax when the conditions are not met. 





Note 


When assembling to the A32 instruction set, the .N qualifier produces an assembler error and the .W 
qualifier has no effect. 
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About the T32 and A32 Instruction Descriptions 
F2.3 Conditional execution 


Most T32 and A32 instructions can be executed conditionally, based on the values of the APSR Condition flags. 
Table F2-1 lists the available conditions. 


Table F2-1 Condition codes 





cond Mnemonic extension 


Meaning (integer) 


Meaning (floating-point) a 


Condition flags 















































0000 EQ Equal Equal Z== 

0001 NE Not equal Not equal, or unordered Z== 

0010 cs b Carry set Greater than, equal, or unordered C == 

0011 cce Carry clear Less than C= 

0100 MI Minus, negative Less than N= 

0101 PL Plus, positive or zero Greater than, equal, or unordered N == 

0110 VS Overflow Unordered V == 

0111 VC No overflow Not unordered V= 

1000 HI Unsigned higher Greater than, or unordered C= ] ad Z= 0 
1001 LS Unsigned lower or same Less than or equal C= 0 or Z = 
1010 GE Signed greater than or equal Greater than or equal N = 

1011 LT Signed less than Less than, or unordered N!=V 

1100 GT Signed greater than Greater than == 0 and N == V 
1101 LE Signed less than or equal Less than, equal, or unordered Z==lorN!=V 
1110 None (AL) 4 Always (unconditional) Always (unconditional) Any 





asc FS ® 


Unordered means at least one NaN operand. 


HS (unsigned higher or same) is a synonym for CS. 


LO (unsigned lower) is a synonym for CC. 


AL is an optional mnemonic extension for always, except in IT instructions. For details see ZT on page F5-4204. 
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In T32 instructions, the condition, if it is not AL, is normally encoded in a preceding IT instruction. For more 
information see Conditional instructions on page F1-3867 and IT on page F5-4204. Some conditional branch 
instructions do not require a preceding IT instruction, because they include a Condition code in their encoding. 


For performance reasons, Armv8 deprecates the use of IT other than with a single 16-bit T32 instruction from a 
specified subset of the 16-bit T32 instructions, see Partial deprecation of IT on page F1-3884. In addition, 

implementations can provide a set of ITD control fields, SCTLR.ITD, SCTLR_EL1.ITD, and HSCTLR.ITD, to 
disable these deprecated uses, making them UNDEFINED. For more information see: 


In A32 instructions, bits[31:28] of the instruction contain either: 
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0b1111 for some A32 instructions that can only be executed unconditionally. 
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Disabling or enabling PLO and PL1 use of AArch32 deprecated functionality on page G1-5579. 
Disabling or enabling EL2 use of AArch32 deprecated functionality on page G1-5588. 


The Condition code, see The Condition code field in A32 instruction encodings on page F2-3910. 
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F2.3.1 


F2.3.2 
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The Condition code field in A32 instruction encodings 


Every conditional A32 instruction contains a 4-bit Condition code field, the cond field, in bits 31 to 28: 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 1211 109 8 76543210 


A | 


This field contains one of the values 0b0000-0b1110, as shown in Table F2-1 on page F2-3909. Most instruction 
mnemonics can be extended with the letters defined in the Mnemonic extension on page F2-3909 column of that 


table. 


If the always (AL) condition is specified, the instruction is executed irrespective of the value of the Condition flags. 
The absence of a Condition code on an instruction mnemonic implies the AL Condition code. 


Pseudocode description of conditional execution 


The AArch32.CurrentCond() function returns a 4-bit condition specifier as follows: 
$ For A32 instructions, it returns bits[31:28] of the instruction. 


: For the T1 and T3 encodings of the Branch instruction (see B on page F5-4117), it returns the 4-bit cond field 
of the encoding. 


. For all other T32 instructions: 
= If PSTATE.IT<3:0> != '0000' it returns PSTATE.IT<7:4>. 
= If PSTATE.1IT<7:0> == '00000000' it returns '1110'. 
— Otherwise, execution of the instruction is CONSTRAINED UNPREDICTABLE. 


For more information, see Process state, PSTATE on page E1-3787. 


The ConditionPassed() function uses this condition specifier and the Condition flags to determine whether the 
instruction must be executed, by calling the ConditionHolds() function. 


Chapter JI Armv8 Pseudocode includes the definitions of these functions. 


Undefined Instruction exception on page G1-5536 describes the handling of conditional instructions that are 
UNDEFINED, UNPREDICTABLE, or CONSTRAINED UNPREDICTABLE. The pseudocode in the manual, as a sequential 
description of the instructions, has limitations in this respect. For more information, see Limitations of the 
instruction pseudocode on page K13-7784. 
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F2.4 Shifts applied to a register 


A32 register offset load/store word and unsigned byte instructions can apply a wide range of different constant shifts 
to the offset register. Both T32 and A32 data-processing instructions can apply the same range of different constant 
shifts to the second operand register. For details see Constant shifts. 


A32 data-processing instructions can apply a register-controlled shift to the second operand register. 


F2.4.1 Constant shifts 
These are the same in T32 and A32 instructions, except that the input bits come from different positions. 
<shift> is an optional shift to be applied to <Rm>. It can be any one of: 
(omitted) No shift. 
LSL #<n> Logical shift left <n> bits. 1 <= <n> <= 31. 
LSR #<n> Logical shift right <n> bits. 1 <= <n> <= 32. 
ASR #<n> Arithmetic shift right <n> bits. 1 <= <n> <= 32. 
ROR #<n> Rotate right <n> bits. 1 <= <n> <= 31. 


RRX Rotate right one bit, with extend. Bit[0] is written to shifter_carry_out, bits[31:1] are shifted right 
one bit, and the Carry flag is shifted into bit[31]. 


Note 


Assemblers can permit the use of some or all of ASR #0, LSL #0, LSR #0, and ROR #0 to specify that no shift is to be 
performed. This is not standard UAL, and the encoding selected for T32 instructions might vary between UAL 
assemblers if it is used. To ensure disassembled code assembles to the original instructions, disassemblers must omit 
the shift specifier when the instruction specifies no shift. 





Similarly, assemblers can permit the use of #0 in the immediate forms of ASR, LSL, LSR, and ROR instructions to specify 
that no shift is to be performed, that is, that a MOV (register) instruction is wanted. Again, this is not standard UAL, 
and the encoding selected for T32 instructions might vary between UAL assemblers if it is used. To ensure 
disassembled code assembles to the original instructions, disassemblers must use the MOV (register) syntax when the 
instruction specifies no shift. 





Encoding 

The assembler encodes <shift> into two type bits and five immediate bits, as follows: 
(omitted) type = 0b00, immediate = 0. 

LSL #<n> type = 0b00, immediate = <n>. 


LSR #<n> type = 0b01. 
If <n> < 32, immediate = <n>. 


If <n> == 32, immediate = 0. 


ASR #<n> type = 0b10. 
If <n> < 32, immediate = <n>. 


If <n> == 32, immediate = 0. 
ROR #<n> type = 0b11, immediate = <n>. 


RRX type = 0b11, immediate = 0. 
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F2.4.2 Register controlled shifts 
These are only available in A32 instructions. 


<type> is the type of shift to apply to the value read from <Rm>. It must be one of: 


ASR Arithmetic shift right, encoded as type = 0b10. 
LSL Logical shift left, encoded as type = 0b00. 

LSR Logical shift right, encoded as type = 0b01. 
ROR Rotate right, encoded as type = 0b11. 


The bottom byte of <Rs> contains the shift amount. 


F2.4.3 Pseudocode description of instruction-specified shifts and rotates 


The pseudocode enumeration SRType{} defines the shift types. Shift and rotate instruction decode is described by 
the pseudocode function: 


. DecodeImmShift() for a constant shift. 
. DecodeRegShift() for a register controlled shift. 


Shift and rotate operations are made by the pseudocode function Shift(). 
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F2.5 Memory accesses 
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Commonly, the following addressing modes are permitted for memory access instructions: 


Offset addressing 


The offset value is applied to an address obtained from the base register. The result is used as the 
address for the memory access. The value of the base register is unchanged. 


The assembly language syntax for this mode is: 


[<Rn>, <offset>] 


Pre-indexed addressing 


The offset value is applied to an address obtained from the base register. The result is used as the 
address for the memory access, and written back into the base register. 


The assembly language syntax for this mode is: 


[<Rn>, <offset>] ! 


Post-indexed addressing 


The address obtained from the base register is used, unchanged, as the address for the memory 
access. The offset value is applied to the address, and written back into the base register 


The assembly language syntax for this mode is: 


[<Rn>], <offset> 


In each case, <Rn> is the base register. <offset> can be: 


° An immediate constant, such as <imm8> or <imm12>. 
$ An index register, <Rm>. 
. A shifted index register, such as <Rm>, LSL #<shift>. 


For information about unaligned access, endianness, and exclusive access, see: 
s Alignment support on page E2-3834. 

° Endian support on page E2-3836. 

° Synchronization and semaphores on page E2-3853. 
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F2.6 Encoding of lists of general-purpose registers and the PC 


A number of instructions operate on lists of general-purpose registers. For some load instructions, the list of 
registers to be loaded can include the PC. For these instructions, the assembler syntax includes a <registers> field, 
that provides a list of the registers to be operated on, with list entries separated by commas. 


The registers list is encoded in the instruction encoding. Most often, this is done using an 8-bit, 13-bit, or 16-bit 
register_list field. This section gives more information about these and other possible register list encodings. 


In a register_list field, each bit corresponds to a single register, and if the <registers> field of the assembler 
instruction includes Rt then register_list<t> is set to 1, otherwise it is set to 0. 


The full rules for the encoding of lists of general-purpose registers, and possibly the PC, are: 

° Except for the cases listed here, 16-bit T32 encodings use an 8-bit register list, and can access only registers 
RO-R7. 
The exceptions to this rule are: 


— The T1 encoding of POP uses an 8-bit register list, and an additional bit, P, that corresponds to the PC. 
This means it can access any of RO-R7 and the PC. 


— The T1 encoding of PUSH uses an 8-bit register list, and an additional bit, M, that corresponds to the LR. 
This means it can access any of RO-R7 and the LR. 


è 32-bit T32 encodings of load operations use a 13-bit register list, and two additional bits, M, corresponding to 
the LR, and P, corresponding to the PC. This means these instructions can access any of RO-R12 and the LR 
and PC. 

` 32-bit T32 encodings of store operations use a 13-bit register list, and one additional bit, M, corresponding to 


the LR. This means these instructions can access any of RO-R12 and the LR. 


$ Except for the case listed here, A32 encodings use a 16-bit register list. This means these instructions can 
access any of RO-R12 and the SP, LR, and PC. 
The exception to this rule is: 
— The System instructions LDM (exception return) and LDM (User registers) use a 15-bit register list. This 
means these instructions can access any of RO-R12 and the SP and LR. 


° The T3 and A2 encodings of POP, and the T3 and A2 encodings of PUSH, access a single register from the set 
of registers {R0-R12, LR, PC} and encode the register number in the Rt field. 





Note 


POP is a load operation, and PUSH is a store operation. 





In every case, the encoding-specific pseudocode converts the register list into a 32-bit variable, registers, with a 
bit corresponding to each of the registers RO-R12, SP, LR, and PC. 





Note 


Some Advanced SIMD and floating-point instructions operate on lists of SIMD and floating-point registers. The 
assembler syntax of these instructions includes a <list> field that specifies the registers to be operated on, and the 
description of the instruction in Alphabetical list of T32 and A32 base instruction set instructions on page F5-4068 
defines the use and encoding of this field. 
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F2.7 General information about the T32 and A32 instruction descriptions 


Chapter F3 732 Instruction Set Encoding describes the T32 instruction encodings, and Chapter F4 432 Instruction 
Set Encoding describes the A32 instruction encodings. The following subsections give more information about the 
descriptions of these instructions and their encodings: 


$ Execution of instructions in debug state. 
$ Fixed values in AArch32 instruction and System register descriptions. 


7 UNDEFINED, UNPREDICTABLE, and CONSTRAINED UNPREDICTABLE instruction set space on 
page F2-3916. 


s T32 and A32 Advanced SIMD and floating-point instruction encodings on page F2-3917. 

. The PC and the use of 0b1111 as a register specifier in T32 and A32 instructions on page F2-3921. 
k The SP and the use of 0b1101 as a register specifier in T32 and 432 instructions on page F2-3922. 
. Modified immediate constants in T32 and A32 instructions on page F2-3922. 


F2.7.1 Execution of instructions in debug state 


In general, except for the instructions described in Debug state on page F1-3886, the T32 instruction descriptions 
do not indicate any differences in the behavior of the instruction if it is executed in Debug state. For this information, 
see Executing instructions in Debug state on page H2-6715. 





Note 
° A32 instructions cannot be executed in Debug state. 
$ For many T32 instructions, execution is unchanged in Debug state. Executing instructions in Debug state on 


page H2-6715 identifies these instructions, 





F2.7.2 Fixed values in AArch32 instruction and System register descriptions 


This section summarizes the terms used to describe fixed values in AArch64 register and instruction descriptions. 
The Glossary gives full descriptions of these terms, and each entry in this section includes a link to the 
corresponding Glossary entry. 


Note 


In register descriptions, the meaning of some bits depends on the PE state. This affects the definitions of RESO and 
RES1, as shown in the Glossary. 





The following terms are used to describe bits or fields with fixed values: 
RAZ Read-As-Zero. See Read-As-Zero (RAZ). 

In diagrams, a RAZ bit can be shown as 0. 
(0), RESO Reserved, Should-Be-Zero (SBZ) or RESO. 


In instruction encoding diagrams, and sometimes in other descriptions, (0) indicates an SBZ bit. If 
the bit is set to 1, behavior is CONSTRAINED UNPREDICTABLE, and must be one of the following: 


s The instruction is UNDEFINED. 

° The instruction is treated as a NOP. 

e The instruction executes as if the value of the bit was 0. 

è Any destination registers of the instruction become UNKNOWN. 

This notation can be expanded for fields, so a three-bit field can be shown as either (0) (0) (0) or as 
(000). 


In register diagrams, but not in the A64 encoding and instruction descriptions, bits or fields can be 
shown as RESO. See the Glossary definition of RESO for more information. 


Note 


Some of the System instruction descriptions in this chapter are based on the field description of the 
input value for the instruction. These are register descriptions and therefore can include RESO fields, 
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RAO 


(1), RES1 


Note 


The (0) and RESO descriptions can be applied to bits or bitfields that are read-only, or are write-only. 
The Glossary definitions cover these cases. 


Read-As-One. See Read-As-One (RAO). 
In diagrams, a RAO bit can be shown as 1. 
Reserved, Should-Be-One (SBO) or RES1. 


In instruction encoding diagrams, and sometimes in other descriptions, (1) indicates a SBO bit. If 
the bit is set to 0, behavior is CONSTRAINED UNPREDICTABLE, and must be one of the following: 


. The instruction is UNDEFINED. 


. The instruction is treated as a NOP. 
° The instruction executes as if the value of the bit was 1. 
$ Any destination registers of the instruction become UNKNOWN. 


This notation can be expanded for fields, so a three-bit field can be shown as either (1) (1) (1) or as 
(111). 


In register diagrams, but not in the A64 encoding and instruction descriptions, bits or fields can be 
shown as RES1. See the Glossary definition of RES1 for more information. 


Note 


Some of the System instruction descriptions in this chapter are based on the field description of the 
input value for the instruction. These are register descriptions and therefore can include RES1 fields, 








The (1) and RES! descriptions can be applied to bits or bitfields that are read-only, or are write-only. 
The Glossary definitions cover these cases. 





In register diagrams, (0) is a synonym for RESO, and (1) is a synonym for RES1, where RESO and RES1 are defined in 
the Glossary. However, when used in an instruction encoding diagram, (0) and (1) have the narrower definition that 
behavior is UNPREDICTABLE or CONSTRAINED UNPREDICTABLE if either: 


A bit marked as (0) has the value 1. 
A bit marked as (1) has the value 0. 





UNDEFINED, UNPREDICTABLE, and CONSTRAINED UNPREDICTABLE instruction set space 


An attempt to execute an unallocated instruction results in either: 


Unpredictable behavior. The instruction is described as UNPREDICTABLE or CONSTRAINED UNPREDICTABLE. 


Armv8-A greatly reduces the architecturally UNPREDICTABLE behavior in AArch32 state. Most cases that 
earlier versions of the architecture describe as UNPREDICTABLE become either: 


CONSTRAINED UNPREDICTABLE, meaning the architecture defines a limited range of permitted 
behaviors. 


Fully predictable. 


For more information see Appendix K1 Architectural Constraints on UNPREDICTABLE behaviors. 


An Undefined Instruction exception. The instruction is described as UNDEFINED. 


An instruction is UNDEFINED if it is declared as UNDEFINED in an instruction description, or in Chapter F3 732 
Instruction Set Encoding or Chapter F4 A32 Instruction Set Encoding. 


An instruction is UNPREDICTABLE only if: 


It is declared as UNPREDICTABLE in an instruction description or in Chapter F3 or Chapter F4, and 
Appendix K1 does not redefine the behavior as CONSTRAINED UNPREDICTABLE. 


The pseudocode for that encoding does not indicate that a different special case applies, and a bit marked (0) 
or (1) in the encoding diagram of an instruction is not 0 or 1 respectively. In most cases, Armv8 makes these 
cases CONSTRAINED UNPREDICTABLE, as described in SBZ or SBO fields T32 and A32 in instructions on 


page K1-7610. 
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Unless otherwise specified, T32 and A32 instructions provided as part of an architectural extension, or by an 
optional feature of the architecture, are UNDEFINED in an implementation that does not include that extension or 
feature. 


Note 


Examples of where this rule applies are: 





° The instructions provided by the Cryptographic Extension. 
° The System instructions that provide access to the System registers of the OPTIONAL Performance Monitors 
Extension. 


: The Advanced SIMD and floating-point instructions. 





For more information about UNDEFINED, UNPREDICTABLE, and CONSTRAINED UNPREDICTABLE instruction behavior, 
see Undefined Instruction exception on page G1-5536. 


F2.7.4 T32 and A32 Advanced SIMD and floating-point instruction encodings 


ARM DDI 0487E.a 
ID070919 


The T32 and A32 encodings of Advanced SIMD and floating-point instructions that are described in Chapter F3 
T32 Instruction Set Encoding and in Chapter F4 432 Instruction Set Encoding are common to the T32 and A32 
instruction sets. This means: 


$ The instruction groups, and the set of instructions in each group, are identical for T32 and A32. 
: For each instruction: 
— Each T32 encoding is exactly equivalent to an A32 encoding. 


— There is no T32 encoding without an equivalent A32 encoding, and no A32 encoding without an 
equivalent T32 encoding. 





Note 
$ In the T32 instruction sets, the Advanced SIMD and floating-point instructions have 32-bit encodings. 
° In the base instruction sets, some instructions are common to the T32 and A32 instruction sets, whereas other 


instructions have equivalent but not identical functionality in the two instruction sets. 


32-bit T32 encodings are described as two contiguous halfwords, {hw1:hw2}, as described in Jnstruction encodings 
on page F2-3904. In general: 


. hw1 of a T32 encoding maps onto bits[31:16] of an equivalent A32 encoding. 
a hw2 of a T32 encoding maps onto bits[15:0] of an equivalent A32 encoding. 


However, the different structures of the T32 instruction encoding space and the A32 instruction encoding space 
mean that: 
s For a given Advanced SIMD and floating-point instruction group: 


— The positions of the fields that identify the instruction, or instruction encoding, within the instruction 
group might differ between the T32 encodings and the A32 encodings. 


— However, the field values that identify the instruction of instruction encoding are identical for the T32 
encoding and the A32 encoding. 


The remainder of this section describes the equivalence of the T32 and A32 encodings for each of the Advanced 
SIMD and floating-point instruction groups. 
Advanced SIMD data-processing 


The T32 encoding of the Advanced SIMD data-processing group is: 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F2-3917 
Non-Confidential 


About the T32 and A32 Instruction Descriptions 
F2.7 General information about the T32 and A32 instruction descriptions 


F2-3918 


|15 12|11 7 6 | 015 | | 5 4]3 0 | 
|11 @ 1 | Á | 
e a l [| 


The A32 encoding of the Advanced SIMD data-processing group is: 


op 


31 | 24|23 22 | | | | 5 4|3 0 | 


p moi [D i i y ST 
op0 = — _ = — o 


The encodings in this group are identified by: 


d hw1[15:13] of the T32 encoding is equivalent to bits[27:25] of the A32 encoding, and: 
— Has the value 0b111 in the T32 encoding. 
— Has the value 0b001 in the A32 encoding. 


a hw1[11:8] of the T32 encoding is equivalent to bits[31:28] of the A32 encoding, and has the value 0b111. 
This table shows the equivalence of the fields that identify the instructions, or instruction encodings, within this 


group: 


T32 encoding A32 encoding Field size 














op0:op1 opd 2 bits 
op2 op1 15 bits 
op3 op2 1 bit 
op4 op3 1 bit 





Advanced SIMD element or structure load/store 


The T32 encoding of the Advanced SIMD element or structure load/store group is: 


[15 | |7 6 5 4|3 0 |15 12/1110 9 | | 0 


[C moo |_|] 0 ET or 
opO ee 


The A32 encoding of the Advanced SIMD element or structure load/store group is: 


31 | |23 22 21 20|19 | 12\11109 | | 0 


[moo | | 0 opt | 
op0 — o ë | 


The encodings in this group are identified by: 


: hw1[15:12] of the T32 encoding is equivalent to bits[31:28] of the A32 encoding, and has the value 0b1111. 
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s hw1[11:8] of the T32 encoding is equivalent to bits[27:24] of the A32 encoding, and: 
— Has the value 0b1001 in the T32 encoding. 
— Has the value 0b0100 in the A32 encoding. 


s hw1[4] of the T32 encoding is equivalent to bit[20] of the A32 encoding, and has the value 0b0. 

op, op1, and op2 are the fields that identify the instructions, or instruction encodings, within this group, and they are 
in equivalent positions in the T32 and A32 encodings. 

Floating-point and Advanced SIMD load/store and 64-bit register moves 


The T32 encoding of the Floating-point and Advanced SIMD load/store and 64-bit register moves group is: 


15 | 8 | 5 4| 0 |15 12\11 8 | | 0 


1110110 | op tt 


The A32 encoding of the Floating-point and Advanced SIMD load/store and 64-bit register moves group is: 


31 |27 24| 21 20| | 12\11 8 | | 0 


er | 10 | op) [=n] 107 


The encodings in the group are identified by: 


: hw1[15:12] of the T32 encoding is equivalent to bits[31:28] of the A32 encoding, and: 
— Has the value 0b1110 in the T32 encoding. 


— Can have any value other than 0b1111 in the A32 encoding. 


This range of values is required because A32 instructions in this group can be executed conditionally, 
see Conditional execution on page F2-3909. 


$ hw1[11:9] of the T32 encoding is equivalent to bits[27:25] of the A32 encoding, and has the value 0b110. 
5 hw2[11:9] of the T32 encoding is equivalent to bits[11:9] of the A32 encoding, and has the value 0b101. 
op@ is the field that identifies the instructions, or instruction encodings, within this group, and is in equivalent 
positions in the T32 and A32 encodings. 

Floating-point and Advanced SIMD 32-bit register moves 


The T32 encoding of the Floating-point and Advanced SIMD 32-bit register moves group is: 


15 | 7 5 4| 0 |15 12\11 8/7 54] 0 | 
C momo | op0 [En 107 | [nn] 
I gs 


The A32 encoding of the Advanced SIMD 32-bit register moves group is: 


31 |27 |23 2120| | 12111 8/7 54] 0| 


Cem | mo | p0 a 107 | a 
| op1 
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The encodings in this group are identified by: 


à hw1[15:12] of the T32 encoding is equivalent to bits[31:28] of the A32 encoding, and: 
— Has the value 0b1110 in the T32 encoding. 


— Can have any value other than 0b1111 in the A32 encoding. 


This range of values is required because A32 instructions in this group can be executed conditionally, 
see Conditional execution on page F2-3909. 


s hw1[11:8] of the T32 encoding is equivalent to bits[27:24] of the A32 encoding, and has the value 0b1110. 
è hw2[11:9] of the T32 encoding is equivalent to bits[11:9] of the A32 encoding, and has the value 0b101. 
7 hw2[4] of the T32 encoding is equivalent to bit[4] of the A32 encoding, and has the value 0b1. 


op0 is the field that identifies the instructions, or instruction encodings, within this group, and is in equivalent 
positions in the T32 and A32 encodings. 


Floating-point data-processing 


The T32 encoding of the Floating-point data-processing group is: 


15 12/11 |7 4|3 0 |15 12/11 9 8|7 6 5 4/3 0 | 
[mm || 1mo | opt | o2 Tt foe | | | fol 
pe [ee 


The A32 encoding of the Floating-point data-processing group is: 


31 28|27 |23 20|19 16/15 12411 9 8|7 6 5 4/3 0 | 
| cond | 1mo | oo | o | | tofop2] | [| fof | 
= 


The encodings in this group are identified by: 


. hw1[15:12] of the T32 encoding is equivalent to bits[3 1:28] of the A32 encoding, and: 


— Inthe T32 encoding, hw1[15:13] has the value 0b111, and hw1[12] is the op@ parameter used in 
identifying instruction encodings within this group. 


— Inthe A32 encoding, is the cond field and also implies the value of bit[28] of some A32 instruction 
encodings within this group, as the following table shows: 





cond Significance of bit[28] in A32 encodings 





'= Qb1111 Part of the cond field. 





Qb1111 Has fixed value of 1. 





The range of cond values other than 0b1111 is required because A32 instructions in this group can be 
executed conditionally, see Conditional execution on page F2-3909. 


7 hw1[11:8] of the T32 encoding is equivalent to bits[27:24] of the A32 encoding, and has the value 0b1119. 
s hw2[11:9] of the T32 encoding is equivalent to bits[11:9] of the A32 encoding, and has the value 0b101. 


è hw2[4] of the T32 encoding is equivalent to bit[4] of the A32 encoding, and has the value 0bQ. 
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This table shows the equivalence of the fields that identify the instructions, or instruction encodings, within this 


group: 


T32 encoding A32 encoding 














opô Bit[28] of the instruction encoding is 1 when cond is 0b1111. 
op1 ope 
op2 op1 
op3 op2 





F2.7.5 The PC and the use of 0b1111 as a register specifier in T32 and A32 instructions 
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Restrictions on the use of PC or 0b1111 as a register specifier differ between the T32 and the A32 instruction sets, 
as described in: 


T32 restrictions on the use of the PC, and use of 0b1111 as a register specifier. 
A32 restrictions on the use of PC or 0b1111 as a register specifier on page F2-3922. 


T32 restrictions on the use of the PC, and use of 0b1111 as a register specifier 


The use of 0b1111 as a register specifier is not normally permitted in T32 instructions. When a value of 0b1111 is 
permitted, a variety of meanings is possible. For register reads, these meanings include: 


Read the PC value, that is, the address of the current instruction + 4. The base register of the table branch 
instructions TBB and TBH can be the PC. This means branch tables can be placed in memory immediately after 
the instruction. 

Note 


Arm deprecates use of the PC as the base register in the STC instruction. 





Read the word-aligned PC value, that is, the address of the current instruction + 4, with bits[1:0] forced to 
zero. The base register of LDC, LDR, LDRB, LDRD (pre-indexed, no writeback), LDRH, LDRSB, and LDRSH instructions 
can be the word-aligned PC. This provides PC-relative data addressing. In addition, some encodings of the 
ADD and SUB instructions permit their source registers to be 0b1111 for the same purpose. 


Read zero. This is done in some cases when one instruction is a special case of another, more general 
instruction, but with one operand zero. In these cases, the instructions are listed on separate pages, with a 
special case in the pseudocode for the more general instruction cross-referencing the other page. 


For register writes, these meanings include: 


The PC can be specified as the destination register of an LDR instruction. This is done by encoding Rt as 
0b1111. The loaded value is treated as an address, and the effect of execution is a branch to that address. Bit[0] 
of the loaded value selects whether to execute A32 or T32 instructions after the branch. 


Some other instructions write the PC in similar ways. An instruction can specify that the PC is written: 
— Implicitly, for example, branch instructions. 

— Explicitly by a register specifier of 0b1111, for example 16-bit MOV (register) instructions. 

— Explicitly by using a register mask, for example LDM instructions. 

The address to branch to can be: 

— A loaded value, for example, RFE. 

— A register value, for example, BX. 

— The result of a calculation, for example, TBB or TBH. 
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The method of choosing the instruction set used after the branch can be: 

— Similar to the LDR case, for example, LDM or BX. 

— A fixed instruction set other than the one currently being used, for example, the immediate form of BLX. 
— Unchanged, for example, branch instructions or 16-bit MOV (register) instructions. 

— Set from the SPSR.T bit, for RFE and SUBS PC, LR, #imm8. 

Discard the result of a calculation. This is done in some cases when one instruction is a special case of 
another, more general instruction, but with the result discarded. In these cases, the instructions are listed on 


separate pages, with a special case in the pseudocode for the more general instruction cross-referencing the 
other page. 


If the destination register specifier of an LDRB, LDRH, LDRSB, or LDRSH instruction is 0b1111, the instruction is a 
memory hint instead of a load operation. 


If the destination register specifier of an MRC instruction is @b1111, bits[31:28] of the value transferred from 
the System register are written to the N, Z, C, and V Condition flags in the APSR, and bits[27:0] are 
discarded. 


A32 restrictions on the use of PC or 0b1111 as a register specifier 


In A32 instructions, the use of @b1111 as a register specifier specifies the PC. 


Many instructions are CONSTRAINED UNPREDICTABLE if they use 0b1111 as a register specifier. This is specified by 
pseudocode in the instruction description. Armv8-A constrains the resulting CONSTRAINED UNPREDICTABLE 
behavior, see Using R15 on page K1-7607. 





Note 


Arm deprecates use of the PC as the base register in any store instruction. 





F2.7.6 The SP and the use of 0b1101 as a register specifier in T32 and A32 instructions 


In the T32 and A32 instruction sets, Arm recommends that the use of 0b1101 as a register specifier specifies the SP. 


Note 





The recommendation that the register specifier 0b1101 is only used to specify the SP applies to both the T32 
and the A32 instruction sets. 


Despite this recommendation, T32 instructions that can access R13, or the SP, behave predictably in Armv8. 
This differs from Armv7, where many uses of R13 are defined as UNPREDICTABLE. For more information 
about these cases see the ARM® Architecture Reference Manual, ARMv7-A and ARMv7-R edition. 





F2.7.7 Modified immediate constants in T32 and A32 instructions 


The following sections describe the encoding of modified immediate constants: 


F2-3922 


Modified immediate constants in T32 instructions on page F2-3923. 

Modified immediate constants in A32 instructions on page F2-3924. 

Modified immediate constants in T32 and A32 Advanced SIMD instructions on page F2-3925. 
Modified immediate constants in T32 and A32 floating-point instructions on page F2-3926. 
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Modified immediate constants in T32 instructions 
The encoding of a modified immediate constant in a 32-bit T32 instruction is: 


1514131211109 8 765 4 3 2 1 0/1514131211109 8 7 6 5 3 2 
b c e f 


4 1 0 
pO imma bh de tg hh 


Table F2-2 shows the range of modified immediate constants available in T32 data-processing instructions, and 
their encoding in the a, b, c, d, e, f, g, h, and i bits, and the imm3 field, in the instruction. 


Table F2-2 Encoding of modified immediates in T32 data-processing instructions 





























isimm3:a <const> 2 

0000x 00000000 00000000 00000000 abcdefgh 
0001x 00000000 abcdefgh 00000000 abcdefgh > 
0010x abcdefgh 00000000 abcdefgh 00000000 > 
0011x abcdefgh abcdefgh abcdefgh abcdefgh > 
01000 1bcdefgh 00000000 00000000 00000000 
01001 Olbcdefg h0000OOO 00000000 02000000 € 
01010 Q01lbcdef gh00000O 00000000 02000000 
01011 Q001bcde fgh®0000 00000000 02000000 © 





8-bit values shifted to other positions 











11101 00000000 00000000 000001bc defgha00d ° 
11110 00000000 00000000 0000001b cdefghdoa 
11111 00000000 20000000 00000001 bcdefghd ¢ 





a. This table shows the immediate constant value in binary form, to relate abcdefgh to the 
encoding diagram. In assembly syntax, the immediate value is specified in the usual 
way (a decimal number by default). 

b. Arm deprecates using a modified immediate with abcdefgh == 00000000, and these 
cases are CONSTRAINED UNPREDICTABLE, see UNPREDICTABLE cases in immediate 
constants in T32 data-processing instructions on page K1-7610. 


c. Not available in A32 instructions if h == 1. 


Note 
As the footnotes to Table F2-2 show, the range of values available in T32 modified immediate constants is slightly 
different from the range of values available in A32 instructions. See Modified immediate constants in A32 
instructions on page F2-3924 for the A32 values. 








Carry out 


A logical instruction with i:imm3:a == '00xxx' does not affect the Carry flag. Otherwise, a logical flag-setting 
instruction sets the Carry flag to the value of bit[31] of the modified immediate constant. 


Operation of modified immediate constants, T32 instructions 


For a T32 data-processing instruction, the T32ExpandImm() pseudocode function returns the value of the 32-bit 
immediate constant, calling T32ExpandImm_C() to evaluate the constant. 
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Modified immediate constants in A32 instructions 


The encoding of a modified immediate constant in an A32 instruction is: 


Table F2-3 shows the range of modified immediate constants available in A32 data-processing instructions, and 
their encoding in the a, b, c, d, e, f, g, and h bits and the rotation field in the instruction. 


Table F2-3 Encoding of modified immediates in A32 processing instructions 


rotation <const> a 

















0000 00000000 00000000 00000000 abcdefgh 
0001 gh000002 20000000 00000000 Odabcdef 
0010 efgh0000 00000000 00000000 0000abcd 
0011 cdefgh®0 00000000 00000000 200000ab 
0100 abcdefgh 00000000 00000000 02000000 





8-bit values shifted to other even-numbered positions 





1001 00000000 @@abcdef gh000000 02000000 





8-bit values shifted to other even-numbered positions 





1110 00000000 00000000 O000abcd efgh0000 





1111 00000000 00000000 000000ab cdefghdd 





a. This table shows the immediate constant value in binary form, to 
relate abcdefgh to the encoding diagram. In assembly syntax, the 
immediate value is specified in the usual way (a decimal number by 
default). 


Note 


The range of values available in A32 modified immediate constants is slightly different from the range of values 
available in 32-bit T32 instructions. See Modified immediate constants in T32 instructions on page F2-3923. 








Carry out 


A logical instruction with the rotation field set to 0b0000 does not affect APSR.C. Otherwise, a logical flag-setting 
instruction sets APSR.C to the value of bit[31] of the modified immediate constant. 


Constants with multiple encodings 


Some constant values have multiple possible encodings. In this case, a UAL assembler must select the encoding 
with the lowest unsigned value of the rotation field. This is the encoding that appears first in Table F2-3. For 
example, the constant #3 must be encoded with (rotation, abcdefgh) == (0b0000, 0b00000011), not (0b0001, 
0b00001100), (0b0010, 0b00110000), or (0b0011, 0b11000000). 
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In particular, this means that all constants in the range 0-255 are encoded with rotation == 0b0000, and permitted 
constants outside that range are encoded with rotation != 0b0000. A flag-setting logical instruction with a modified 
immediate constant therefore leaves APSR.C unchanged if the constant is in the range 0-255 and sets it to the most 
significant bit of the constant otherwise. This matches the behavior of T32 modified immediate constants for all 
constants that are permitted in both the A32 and T32 instruction sets. 


An alternative syntax is available for a modified immediate constant that permits the programmer to specify the 
encoding directly. In this syntax, #<const> is instead written as #<byte>, #<rot>, where: 


<byte> Is the numeric value of abcdefgh, in the range 0-255. 
<rot> Is twice the numeric value of rotation, an even number in the range 0-30. 


This syntax permits all A32 data-processing instructions with modified immediate constants to be disassembled to 
assembler syntax that assembles to the original instruction. 


This syntax also makes it possible to write variants of some flag-setting logical instructions that have different 
effects on APSR.C to those obtained with the normal #<const> syntax. For example, ANDS R1, R2, #12, #2 has the 
same behavior as ANDS R1, R2, #3 except that it sets APSR.C to 0 instead of leaving it unchanged. Such variants of 
flag-setting logical instructions do not have equivalents in the T32 instruction set, and Arm deprecates their use. 


Operation of modified immediate constants, A32 instructions 

For an A32 data-processing instruction, the A32ExpandImm() pseudocode function returns the value of the 32-bit 
immediate constant, calling A32ExpandImm_C() to evaluate the constant. 

Modified immediate constants in T32 and A32 Advanced SIMD instructions 


Table F2-4 shows the modified immediate constants available with Advanced SIMD instructions, and how they are 
encoded. 


Table F2-4 Modified immediate values for Advanced SIMD instructions 












































op cmode_ Constanta <dt>> Notes 
000x 00000000 00000000 00000000 abcdefgh 20000000 00000000 00000000 abcdefgh 132 c 
001x 00000000 20000000 abcdefgh 00000000 20000000 00000000 abcdefgh 90000000 132 c,d 
010x 00000000 abcdefgh 00000000 00000000 20000000 abcdefgh 00000000 90000000 132 c,d 
Ollx abcdefgh 00000000 00000000 00000000 abcdefgh 00000000 20000000 00000000 132 c,d 
100x 00000000 abcdefgh 00000000 abcdefgh 00000000 abcdefgh 00000000 abcdefgh 116 c 
101x abcdefgh 00000000 abcdefgh 00000000 abcdefgh 00000000 abcdefgh 00000000 116 cd 
1100 00000000 00000000 abcdefgh 11111111 00000000 00000000 abcdefgh 11111111 132 d, e 
1101 00000000 abcdefgh 11111111 11111111 00000000 abcdefgh 11111111 11111111 132 d, e 
1110 abcdefgh abcdefgh abcdefgh abcdefgh abcdefgh abcdefgh abcdefgh abcdefgh 18 f 
1111 aBbbbbbc defgh®00 00000000 00000000 aBbbbbbc defgh000 20000000 00000000 F32 fg 
1110 aaaaaaaa bbbbbbbb cccccccc dddddddd eeeeeeee ffffffff gggggggg hhhhhhhh 164 f 
1111 UNDEFINED - = 


a. In this table, the immediate value is shown in binary form, to relate abcdefgh to the encoding diagram. In assembler 
syntax, the constant is specified by a data type and a value of that type. That value is specified in the normal way (a 
decimal number by default) and is replicated enough times to fill the 64-bit immediate. For example, a data type of 132 
and a value of 10 specify the 64-bit constant 0x0000000A0000000A. 
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This specifies the data type used when the instruction is disassembled. On assembly, the data type must be matched in 
the table if possible. Other data types are permitted as pseudo-instructions when a program is assembled, provided the 
64-bit constant specified by the data type and value is available for the instruction. If a constant is available in more 
than one way, the first entry in this table that can produce it is used. For example, VMOV.164 DQ, #0x8000000080000000 
does not specify a 64-bit constant that is available from the 164 line of the table, but does specify one that is available 
from the fourth 132 line or the F32 line. It is assembled to the first of these, and therefore is disassembled as 

VMOV.132 DO, #0x80000000. 


This constant is available for the VBIC, VMOV, VMVN, and VORR instructions. 


. CONSTRAINED UNPREDICTABLE if abcdefgh == @b00000000, see UNPREDICTABLE cases in immediate constants in 


Advanced SIMD instructions on page K1-7611. The required behavior is that these encodings produce an immediate 
constant of zero. 


This constant is available for the VMOV and VMVN instructions only. 
This constant is available for the VMOV instruction only. 


In this entry, B= NOT(b). The bit pattern represents the floating-point number (—1)S x 2¢xP x mantissa, where 
S = UInt(a), exp = UInt(NOT(b) :c:d)-3 and mantissa = (16+UInt(e:f:g:h))/16. 


Operation of modified immediate constants, Advanced SIMD instructions 


For a T32 or A32 Advanced SIMD instruction that uses a modified immediate constant, the operation described by 


the AdvSIMDExpandImm() pseudocode function returns the value of the 64-bit immediate constant. 


Modified immediate constants in T32 and A32 floating-point instructions 


Table F2-5 shows the immediate constants available in the VMOV (immediate) floating-point instruction, and 
Table F2-6 shows the resulting floating-point values. 


Table F2-5 Floating-point modified immediate constants 


Datatype imm4H imm4L_ Constant 2 











F16 abcd efgh aBbbcdef gh000000 
F32 abcd efgh aBbbbbbc defgh®00 00000000 20000000 
F64 abcd efgh aBbbbbbb bbcdefgh 00000000 00000000 20000000 00000000 02000000 20000000 
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. In this column, B = NOT(b). The bit pattern represents the floating-point number (—1)S x 2¢xP x mantissa, where 


S =UInt(a), exp = UInt(NOT(b):c:d)-3 and mantissa = (16+UInt(e:f:g:h))/16. 


Table F2-6 Floating-point constant values 





bed 
efgh 

000 001 010 11 100 101 110 111 
0000 2.0 4.0 8.0 16.0 0.125 0.25 0.5 1.0 





0001 2.125 425 85 17.0 0.1328125 0.265625 0.53125 1.0625 





0010 2.25 4.5 9.0 18.0 0.140625 0.28125 0.5625 1.125 





0011 2.375 475 95 19.0 0.1484375 0.296875 0.59375 1.1875 





0100 2.5 5.0 10.0 20.0 0.15625 0.3125 0.625 1.25 





0101 2.625 5.25 10.5 21.0 0.1640625 0.328125 0.65625 1.3125 





0110 2.75 59 11.0 22.0 0.171875 0.34375 0.6875 1.375 





0111 2.875 5.75 11.5 23.0 0.1796875 0.359375 0.71875 1.4375 





1000 3.0 6.0 12.0 24.0 0.1875 0.375 0.75 1:5 
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Table F2-6 Floating-point constant values (continued) 


























bed 
efgh 

000 001 010 011 100 101 110 111 
1001 3.125 6.25 12.55 25.0 0.1953125 0.390625 0.78125 1.5625 
1010 3.25 6.5 13.0 26.0 0.203125 0.40625 0.8125 1.625 
1011 3.375 6.75 13.5 27.0 0.2109375 0.421875 0.84375 1.6875 
1100 3.5 7.0 14.0 28.0 0.21875 0.4375 0.875 1.75 
1101 3.625 7.25 14.5 29.0 0.2265625 0.453125 0.90625 1.8125 
1110 3.75 hə 15.0 30.0 0.234375 0.46875 0.9375 1.875 
1111 3.875 7.75 15.5 31.0 0.2421875 0.484375 0.96875 1.9375 








Operation of modified immediate constants, floating-point instructions 


For a T32 or A32 floating-point instruction that uses a modified immediate constant, the operation described by the 
VFPExpandImm() pseudocode function returns the value of the immediate constant. 
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F2.8.1 


F2.8.2 
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Additional pseudocode support for instruction descriptions 


Earlier sections of this chapter include pseudocode that describes features of the execution of A32 and T32 
instructions, see: 

$ Pseudocode description of conditional execution on page F2-3910. 

$ Pseudocode description of instruction-specified shifts and rotates on page F2-3912 


The following subsection gives additional pseudocode support functions for some of the instructions described in 
Alphabetical list of T32 and 432 base instruction set instructions on page F5-4068. See also Pseudocode support 
for the banked register transfer instructions on page F5-4780. 


Pseudocode description of operations for System register access instructions 


The AArch32.SysRegRead() function obtains the word for an MRC instruction from the System register. 


The AArch32.SysRegRead64() function obtains the two words for an MRRC instruction from the System register. 





Note 


The relative significance of the two words returned is IMPLEMENTATION DEFINED, but all uses within this manual 
present the two words in the order (most significant, least significant). 





The AArch32.SysRegWrite() procedure sends the word for an MCR instruction to the System register. 


The AArch32.SysRegWrite64() procedure sends the two words for an MCRR instruction to the System register. 





Note 


The relative significance of word2 and word1 is IMPLEMENTATION DEFINED, but all uses within this manual treat word2 
as more significant than word1. 


Pseudocode details of system calls 


The AArch32.CallSupervisor() pseudocode function generates a Supervisor Call exception. Valid execution of the 
SVC instruction calls this function. 


The AArch32.CallHypervisor() pseudocode function generates an HVC exception. Valid execution of the HVC 
instruction calls this function. 
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F2.9 Additional information about Advanced SIMD and floating-point instructions 


The following subsections give additional information about the Advanced SIMD and floating-point instructions: 
s Advanced SIMD and floating-point instruction syntax. 

à The Advanced SIMD addressing mode. 

. Advanced SIMD instruction modifiers on page F2-3930. 

° Advanced SIMD operand shapes on page F2-3930. 

e Data type specifiers on page F2-3931. 

7 Register specifiers on page F2-3932. 

e Register lists on page F2-3933. 

s Register encoding on page F2-3933. 

$ Advanced SIMD scalars on page F2-3934. 


Note 


The Advanced SIMD architecture, its associated implementations, and supporting software, are commonly referred 
to as NEON™ technology. 








F2.9.1 Advanced SIMD and floating-point instruction syntax 
Advanced SIMD and floating-point instructions use the general conventions of the T32 and A32 instruction sets. 
Advanced SIMD and floating-point data-processing instructions use the following general format: 
V{<modifier>}<operation>{<shape>}{<c>}{<q>}{.<dt>} {<dest>,} <srcl>, <src2> 


All Advanced SIMD and floating-point instructions begin with a V. This distinguishes Advanced SIMD vector and 
floating-point instructions from scalar instructions. 


The main operation is specified in the <operation> field. It is usually a three letter mnemonic the same as or similar 
to the corresponding scalar integer instruction. 


The <c> and <q> fields are standard assembler syntax fields. For details see Standard assembler syntax fields on 
page F2-3908. 


F2.9.2 The Advanced SIMD addressing mode 
All the element and structure load/store instructions use this addressing mode. There is a choice of three formats: 


[<Rn>{:<align>}] The address is contained in general-purpose register Rn. 
Rn is not updated by this instruction. 
Encoded as Rm = 0b1111. 
If Rn is encoded as 0b1111, the instruction is CONSTRAINED UNPREDICTABLE. 


[<Rn>{:<align>}]! The address is contained in general-purpose register Rn. 
Rn is updated by this instruction: Rn = Rn + transfer_size 
Encoded as Rm = 0b1101. 


transfer_size is the number of bytes transferred by the instruction. This means that, after 
the instruction is executed, Rn points to the address in memory immediately following the 
last address loaded from or stored to. 


If Rn is encoded as 0b1111, the instruction is CONSTRAINED UNPREDICTABLE. 
This addressing mode can also be written as: 
[<Rn>{:align}], #<transfer_size> 


However, disassembly produces the [<Rn>{:align}]! form. 
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[<Rn>{:<align>}], <Rm> 
The address is contained in general-purpose register <Rn>. 
Rn is updated by this instruction: Rn = Rn + Rm 
Encoded as Rm = Rm. Rm must not be encoded as 0b1111 or 0b1101, the PC or the SP. 
If Rn is encoded as 0b1111, the instruction is CONSTRAINED UNPREDICTABLE. 


The CONSTRAINED UNPREDICTABLE behavior of encodings where Rn is 0b1111 is described in the section: Using 
R15 on page K1-7607. 


In all cases, <align> specifies an alignment, as specified by the individual instruction descriptions. 


Previous versions of the manual used the @ character for alignment. So, for example, the first format in this section 
was shown as [<Rn>{@<align>}]. Both @ and : are supported. However, to ensure portability of code to assemblers 
that treat @ as a comment character, : is preferred. 


F2.9.3 Advanced SIMD instruction modifiers 


The <modifier> field provides additional variants of some instructions. Table F2-7 provides definitions of the 
modifiers. Modifiers are not available for every instruction. 


Table F2-7 Advanced SIMD instruction modifiers 





<modifier> Meaning 





The operation uses saturating arithmetic. 











R The operation performs rounding. 
D The operation doubles the result (before accumulation, if any). 
H The operation halves the result. 





F2.9.4 Advanced SIMD operand shapes 


The <shape> field provides additional variants of some instructions. Table F2-8 provides definitions of the shapes. 
Operand shapes are not available for every instruction. 


Table F2-8 Advanced SIMD operand shapes 




















<shape> Meaning Typical register shape 
(none) The operands and result are all the same width. Dd, Dn Dm Qd, Qn, Qm 
L Long operation - result is twice the width of both operands Qd, Dn, Dm 
N Narrow operation - result is half the width of both operands Dd, Qn, Qm 
W Wide operation - result and first operand are twice the width of the second operand Qd, Qn, Dm 
Note 
° Some assemblers support a Q shape specifier, that requires all operands to be Q registers. An example of 
using this specifier is VADDQ.S32 q0, ql, q2. This is not standard UAL, and Arm recommends that 
programmers do not use a Q shape specifier. 
° A disassembler must not generate any shape specifier not shown in Table F2-8. 
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F2.9.5 Data type specifiers 
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The <dt> field normally contains one data type specifier. Unless the assembler syntax description for the instruction 
indicates otherwise, this indicates the data type contained in: 


. The second operand, if any. 
° The operand, if there is no second operand. 
$ The result, if there are no operand registers. 


The data types of the other operand and result are implied by the <dt> field combined with the instruction shape. For 
information about data type formats see Data types supported by the Advanced SIMD implementation on 
page E1-3796. 


In the instruction syntax descriptions in Chapter F2 About the T32 and 432 Instruction Descriptions, the <dt> field 
is usually specified as a single field. However, where more convenient, it is sometimes specified as a concatenation 
of two fields, <type><size>. 

Syntax flexibility 


There is some flexibility in the data type specifier syntax: 


s Software can specify three data types, specifying the result and both operand data types. For example: 


VSUBW.116.116.S8 Q3, Q5, DQ instead of VSUBW.S8 Q3, Q5, DO 


. Software can specify two data types, specifying the data types of the two operands. The data type of the result 
is implied by the instruction shape. For example: 


VSUBW.116.S8 Q3, Q5, D@ instead of VSUBW.S8 Q3, Q5, DO 


. Software can specify two data types, specifying the data types of the single operand and the result. For 
example: 


VMOVN.116.132 DQ, Q1 instead of VMOVN.I32 DQ, Q1 


s Where an instruction requires a less specific data type, software can instead specify a more specific type, as 
shown in Table F2-9. 


° Where an instruction does not require a data type, software can provide one. 
è The F32 data type can be abbreviated to F. 
s The F64 data type can be abbreviated to D. 


In all cases, if software provides additional information, the additional information must match the instruction 
shape. Disassembly does not regenerate this additional information. 


Table F2-9 Data type specification flexibility 





Specified data type Permitted more specific data types 




















None Any 

.I<size> - .S<size> .U<size> - - 

8 .18 „S8 .U8 .P8 - 

.16 .I16 .S16 .U16 .P16 .F16 

:32 .132 S32 .U32 - «F32 or .F 

64 . 164 . S64 .U64 - .F64 or .D 
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F2.9.6 


F2-3932 


Register specifiers 


The <dest>, <srcl>, and <src2> fields contain register specifiers, or in some cases scalar specifiers or register lists. 
Table F2-10 shows the register and scalar specifier formats that appear in the instruction descriptions. 


If <dest> is omitted, it is the same as <srcl>. 


Table F2-10 Advanced SIMD and floating-point register specifier formats 





















































<specifier> Usual meaning ê Used in 

<Qd> A quadword destination register for the result vector. Advanced SIMD 
<Qn> A quadword source register for the first operand vector. Advanced SIMD 
<Qm> A quadword source register for the second operand vector. Advanced SIMD 
<Dd> A doubleword destination register for the result vector. Both 

<Dn> A doubleword source register for the first operand vector. Both 

<Dm> A doubleword source register for the second operand vector. Both 

<Sd> A singleword destination register for the result vector. Floating-point 
<Sn> A singleword source register for the first operand vector. Floating-point 
<Sm> A singleword source register for the second operand vector. Floating-point 
<Dd[x]> A destination scalar for the result. Element x of vector <Dd>. Advanced SIMD 
<Dn[x]> A source scalar for the first operand. Element x of vector <Dn>. Both? 

<Dm[x]> A source scalar for the second operand. Element x of vector <Dm>. Advanced SIMD 
<Rt> A general-purpose register, used for a source or destination address. Both 

<Rt2> A general-purpose register, used for a source or destination address. Both 

<Rn> A general-purpose register, used as a load or store base address. Both 

<Rm> A general-purpose register, used as a post-indexed address source. Both 





a. In some instructions the roles of registers are different. 


b. Inthe floating-point instructions, <Dn[x]> is used only in VMOV (scalar to general-purpose register), see VMOV 
(scalar to general-purpose register) on page F6-5145. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


About the T32 and A32 Instruction Descriptions 
F2.9 Additional information about Advanced SIMD and floating-point instructions 


F2.9.7 Register lists 


A register list is a list of register specifiers separated by commas and enclosed in brackets { and }. There are 
restrictions on what registers can appear in a register list. These restrictions are described in the individual 
instruction descriptions. Table F2-11 shows some register list formats, with examples of actual register lists 
corresponding to those formats. 


Note 


Register lists must not wrap around the end of the register bank. 








Syntax flexibility 
There is some flexibility in the register list syntax: 


° Where a register list contains consecutive registers, they can be specified as a range, instead of listing every 
register, for example {D0-D3} instead of {D0, D1, D2, D3}. 


° Where a register list contains an even number of consecutive doubleword registers starting with an even 
numbered register, it can be written as a list of quadword registers instead, for example {Q1, Q2} instead of 
{D2-D5}. 

s Where a register list contains only one register, the enclosing braces can be omitted, for example 


VLD1.8 DQ, [RQ] instead of VLD1.8 {DQ}, [RQ]. 


Table F2-11 Example register lists 





Format Example Alternative 





{<Dd>} {D3} D3 





{<Dd>, <Dd+1>, <Dd+2>}  {D3, D4, D5} {D3-D5} 











F2.9.8 Register encoding 
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{<Dd[x]>, <Dd+2[x]} {D@[3], D2[3]} - 
{<Dd[]>} {D7[]} D7[] 
An Advanced SIMD register is either: 
° Quadword, meaning it is 128 bits wide. 
. Doubleword, meaning it is 64 bits wide. 


Some instructions have options for either doubleword or quadword registers. This is normally encoded in Q, bit[6], 
as Q = 0 for doubleword operations, or Q = 1 for quadword operations. 


A floating-point register is either: 
s Double-precision, meaning it is 64 bits wide. 


° Single-precision, meaning it is 32 bits wide. 


This is encoded in the sz field, bit[8], as sz = 1 for double-precision operations, or sz = 0 for single-precision 
operations. 


The T32 instruction encoding of Advanced SIMD or floating-point registers is: 


1514131211109 8 765 4 3 2 1 041514131211109 8 7 65 43 21 0 


po PsN | vm 


The A32 instruction encoding of Advanced SIMD or floating-point registers is: 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 1211 109 8 76543 210 


po sz {NJ | wm | 
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Some instructions use only one or two registers, and use the unused register fields as additional opcode bits. 


Table F2-12 shows the encodings for the registers. 


Table F2-12 Encoding of register numbers 
































Scie Usual usage iar a ber Notesa Used in 

<Qd> Destination (quadword) D, Vd (bits[22, 15:13]) bit[12] == 0? Advanced SIMD 
<Qn> First operand (quadword) N, Vn (bits[7, 19:17]) bit[16] == 0> Advanced SIMD 
<Qm> Second operand (quadword) M, Vm (bits[5, 3:1]) bit[0] == 0? Advanced SIMD 
<Dd> Destination (doubleword) D, Vd (bits[22, 15:12]) - Both 

<Dn> First operand (doubleword) N, Vn (bits[7, 19:16]) - Both 

<Dm> Second operand (doubleword) M, Vm (bits[5, 3:0]) - Both 

<Sd> Destination (single-precision) Vd, D (bits[15:12, 22]) - Floating-point 
<Sn> First operand (single-precision) Vn, N (bits[19:16, 7]) - Floating-point 
<Sm> Second operand (single-precision) Vm, M (bits[3:0, 5]) - Floating-point 





F2.9.9 


a. Bit numbers given for the A32 instruction encoding. See the figures in this section for the equivalent bits in the T32 encoding. 


b. If this bit is 1, the instruction is UNDEFINED. 


Advanced SIMD scalars 


Advanced SIMD scalars can be 8-bit, 16-bit, 32-bit, or 64-bit. Instructions other than multiply instructions can 
access any element in the register set. The instruction syntax refers to the scalars using an index into a doubleword 
vector. The descriptions of the individual instructions contain details of the encodings. 


Table F2-13 shows the form of encoding for scalars used in multiply instructions. These instructions cannot access 
scalars in some registers. The descriptions of the individual instructions contain cross references to this section 
where appropriate. 


32-bit Advanced SIMD scalars, when used as single-precision floating-point numbers, are equivalent to 
Floating-point single-precision registers. That is, Dm[x] in a 32-bit context (0 <= m <= 15, 0 <= x <=1) is equivalent 
to S[2m + x]. 








Table F2-13 Encoding of scalars in multiply instructions 














Scalar mnemonic Usual usage Scalar size Register specifier Index specifier Accessible registers 
<Dm[x]> Second operand 16-bit Vm[2:0] M, Vm[3] D0-D7 
32-bit Vm[3:0] M D0-D15 
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Chapter F3 
T32 Instruction Set Encoding 


This chapter describes the encoding of the T32 instruction set. It contains the following sections: 
° T32 instruction set encoding on page F3-3936. 
. About the T32 Advanced SIMD and floating-point instructions and their encoding on page F3-4003. 


In this chapter: 


: In the decode tables, an entry of - for a field value means the value of the field does not affect the decoding. 
: In the decode diagrams, a shaded field indicates that the bits in that field are not used in that level of decode. 
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F3.1 


F3.1.1 


F3-3936 


T32 instruction set encoding 


The T32 instruction stream is a sequence of halfword-aligned halfwords. Each T32 instruction is either a single 
16-bit halfword in that stream, or a 32-bit instruction consisting of two consecutive halfwords in that stream. 


If the value of bits[15:11] of the halfword being decoded is one of the following, the halfword is the first halfword 
of a 32-bit instruction: 


° 0b11101. 
g 0b11110. 
s 0b11111. 


Otherwise, the halfword is a 16-bit instruction. 


The T32 instruction encoding is: 


45 13 12/11 10 | | 0 |15 | | | 0 | 


Table F3-1 Main encoding table for the T32 instruction set 





Decode fields 
Decode group or instruction page 








op0 op1 

l= 111 - 16-bit 

111 00 B - T2 variant 

111 != 00 32-bit on page F3-3947 





16-bit 


This section describes the encoding of the 16-bit group. The encodings in this section are decoded from 732 
instruction set encoding. 


This decode also imposes the constraint: 
. op0<5:3> != 111. 


Table F3-2 Encoding table for the 16-bit group 





Decode fields 
Decode group or instruction page 

















op0 
QOxxxx Shift (immediate), add, subtract, move, and compare on page F3-3940 
010000 Data-processing (two low registers) on page F3-3937 
010001 Special data instructions and branch and exchange on page F3-3942 
01001x LDR (literal) - T/ variant on page F5-4243 
0101xx Load/store (register offset) on page F3-3938 
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Table F3-2 Encoding table for the 16-bit group (continued) 





Decode fields 
Decode group or instruction page 























op0 

Q11xxx Load/store word/byte (immediate offset) on page F3-3938 
1000xx Load/store halfword (immediate offset) on page F3-3939 
1001xx Load/store (SP-relative) on page F3-3939 

1010xx Add PC/SP (immediate) on page F3-3939 

1011xx Miscellaneous 16-bit instructions on page F3-3943 

1100xx Load/store multiple on page F3-3940 

1101xx Conditional branch, and Supervisor Call on page F3-3946 





Data-processing (two low registers) 


This section describes the encoding of the Data-processing (two low registers) instruction class. The encodings in 
this section are decoded from /6-bit on page F3-3936. 


115141312411109 | 65 |32 ol] 


[oT 0000] o | Rs | Ra | 





Decode fields 


Instruction page 















































op 

0000 AND, ANDS (register) 

0001 EOR, EORS (register) 

0010 MOV, MOVS (register-shifted register) - Logical shift left variant on page F5-4348 
0011 MOV, MOVS (register-shifted register) - Logical shift right variant on page F5-4348 
0100 MOV, MOVS (register-shifted register) - Arithmetic shift right variant on page F5-4348 
0101 ADC, ADCS (register) 

0110 SBC, SBCS (register) 

0111 MOV, MOVS (register-shifted register) - Rotate right variant on page F5-4349 

1000 TST (register) 

1001 RSB, RSBS (immediate) 

1010 CMP (register) 

1011 CMN (register) 

1100 ORR, ORRS (register) 
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Decode fields 
Instruction page 











op 

1101 MUL, MULS 

1110 BIC, BICS (register) 
1111 MVN, MVNS (register) 





Load/store (register offset) 


This section describes the encoding of the Load/store (register offset) instruction class. The encodings in this section 
are decoded from /6-bit on page F3-3936. 


|15 14 13 1211110 9 8| 65 132 ol] 


or onie] km | Rn] Rt | 


Decode fields 
Instruction page 





Q () ) STR (register) 





0 0 1 STRH (register) 





Q 1 ( STRB (register) 





0 1 1 LDRSB (register) 





1 () ) LDR (register) 





1 () 1 LDRH (register) 





1 il 0 LDRB (register) 





1 1 1 LDRSH (register) 





Load/store word/byte (immediate offset) 


This section describes the encoding of the Load/store word/byte (immediate offset) instruction class. The encodings 
in this section are decoded from /6-bit on page F3-3936. 








|15 14 13 12|11 10 | 65 |3 2 0 | 
[o 1 1jB[L| imm5s | Rn | Rt | 
Decode fields 
Instruction page 
B L 
(2 Q STR (immediate) 
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Decode fields 
Instruction page 











B L 

(2 1 LDR (immediate) 
1 Q STRB (immediate) 
1 1 LDRB (immediate) 





Load/store halfword (immediate offset) 
This section describes the encoding of the Load/store halfword (immediate offset) instruction class. The encodings 


in this section are decoded from /6-bit on page F3-3936. 


|15 14 13 12/11 10 | 65 |32 ol 


Decode fields 
Instruction page 





L 
Q STRH (immediate) 





1 LDRH (immediate) 


Load/store (SP-relative) 
This section describes the encoding of the Load/store (SP-relative) instruction class. The encodings in this section 


are decoded from /6-bit on page F3-3936. 


|15 14 13 12|1110 8|7 | 0 | 





Decode fields 
Instruction page 








L 
i) STR (immediate) 
1 LDR (immediate) 





Add PC/SP (immediate) 


This section describes the encoding of the Add PC/SP (immediate) instruction class. The encodings in this section 
are decoded from /6-bit on page F3-3936. 
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15141312/1110 8|7 | 0| 
1010o Ra | me —i 





Decode fields 
Instruction page 








SP 
0 ADR 
1 ADD, ADDS (SP plus immediate) 





Load/store multiple 


This section describes the encoding of the Load/store multiple instruction class. The encodings in this section are 
decoded from 76-bit on page F3-3936. 


|15 14 13 12|1110 8|7 | 0| 


11 0 olL] Rn | register_list 





Decode fields 
Instruction page 








L 
0 STM, STMIA, STMEA 
1 LDM, LDMIA, LDMFD 





F3.1.2 Shift (immediate), add, subtract, move, and compare 


This section describes the encoding of the Shift (immediate), add, subtract, move, and compare group. The 
encodings in this section are decoded from /6-bit on page F3-3936. 


1145 1312/11109 | | 0 | 


| oo} foot? [oO 
op0 _ 
op2 


Table F3-3 Encoding table for the Shift (immediate), add, subtract, move, and compare group 





Decode fields 
Decode group or instruction page 
op0 opi op2 

















) 11 0 Add, subtract (three low registers) on page F3-3941 

) 11 1 Add, subtract (two low registers and immediate) on page F3-3941 

0 != 11 - MOV, MOVS (register) - 72 variant on page F5-4344 

1 - - Add, subtract, compare, move (one low register and immediate) on page F3-3941 
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Add, subtract (three low registers) 


This section describes the encoding of the Add, subtract (three low registers) instruction class. The encodings in this 
section are decoded from Shift (immediate), add, subtract, move, and compare on page F3-3940. 


15 14 13 1241110 9 8| 65 132 ol] 


foo 0770s] Rm | Rn | Ra | 





Decode fields 
Instruction page 








S 
() ADD, ADDS (register) 
1 SUB, SUBS (register) 





Add, subtract (two low registers and immediate) 


This section describes the encoding of the Add, subtract (two low registers and immediate) instruction class. The 
encodings in this section are decoded from Shift (immediate), add, subtract, move, and compare on page F3-3940. 


|15 1413 12/1110 9 8| 65 |32 0l] 


[o oo 1 1 44s} imms | Rn | Ra | 





Decode fields 
Instruction page 








S 
Q ADD, ADDS (immediate) 
1 SUB, SUBS (immediate) 





Add, subtract, compare, move (one low register and immediate) 


This section describes the encoding of the Add, subtract, compare, move (one low register and immediate) 
instruction class. The encodings in this section are decoded from Shift (immediate), add, subtract, move, and 
compare on page F3-3940. 








|15 14 13 12|11 10 8|7 | 0| 
foo t,o] a | me] 
Decode fields 
Instruction page 
op 
00 MOV, MOVS (immediate) 
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Decode fields 
Instruction page 











op 

Q1 CMP (immediate) 

10 ADD, ADDS (immediate) 
11 SUB, SUBS (immediate) 





F3.1.3 Special data instructions and branch and exchange 


This section describes the encoding of the Special data instructions and branch and exchange group. The encodings 
in this section are decoded from /6-bit on page F3-3936. 


|15 | 9 8|7 | 0 | 


[070001 Jopo [nn 


Table F3-4 Encoding table for the Special data instructions and branch and exchange group 





Decode fields 
Decode group or instruction page 
op0 





11 Branch and exchange 





l= 11 Add, subtract, compare, move (two high registers) 





Branch and exchange 
This section describes the encoding of the Branch and exchange instruction class. The encodings in this section are 


decoded from Special data instructions and branch and exchange. 


|15 1413 12|11 10 9 8|7 6 |3 21 0| 


oT oOooT TIL] Rm Ooo) 





Decode fields 
Instruction page 








L 
() BX 
1 BLX (register) 





Add, subtract, compare, move (two high registers) 


This section describes the encoding of the Add, subtract, compare, move (two high registers) instruction class. The 
encodings in this section are decoded from Special data instructions and branch and exchange. 
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|15 14 13 12/11 10 9 8|7 6 3 2 ol 
oroo oren] Rs | Ra | 
op 





Decode fields 
Instruction page 
op D:Rd Rs 




















00 l= 1101 != 1101 ADD, ADDS (register) 
eo C- 1101 ADD, ADDS (SP plus register) - TZ on page F5-4092 
o0 1101 != 1101 ADD, ADDS (SP plus register) - 72 on page F5-4092 
Q1 - - CMP (register) 
10 - - MOV, MOVS (register) 

F3.1.4 Miscellaneous 16-bit instructions 


This section describes the encoding of the Miscellaneous 16-bit instructions group. The encodings in this section 
are decoded from /6-bit on page F3-3936. 


15 |11 8|7 6 5 4|3 0| 
| 101 | oo [o| || 3 
er: 


Table F3-5 Encoding table for the Miscellaneous 16-bit instructions group 


Decode fields 
Decode group or instruction page Architecture version 
op0 op op2 op3 









































0000s - - - Adjust SP (immediate) on page F3-3944 - 
0010 Žž - - - Extend on page F3-3944 - 
0110 00 0 - SETPAN Armv8.1 
0110 00 1 - Unallocated. - 
0110 01 - - Change Processor State on page F3-3944 - 
0110 1x - - Unallocated. - 
0111 Žž - - - Unallocated. - 
1000 - - - Unallocated. - 
1010 10 - z HET š 
1010 !=10 - - Reverse bytes on page F3-3945 - 
1110 - - - BKPT 3 
1111 - - 0000 Hints on page F3-3945 - 
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Table F3-5 Encoding table for the Miscellaneous 16-bit instructions group (continued) 





Decode fields 
Decode group or instruction page Architecture version 
op0 op1 op2 op3 











1111 - z != 0000 IT - 
xðx1 á - - - CBNZ, CBZ - 
xl0x- - - Push and Pop on page F3-3946 - 





Adjust SP (immediate) 


This section describes the encoding of the Adjust SP (immediate) instruction class. The encodings in this section 
are decoded from Miscellaneous 16-bit instructions on page F3-3943. 


|15 14 13 12|11 10 9 8|7 6 | 0| 


1011000 0s| mm? | 





Decode fields 
Instruction page 








S 
) ADD, ADDS (SP plus immediate) 
1 SUB, SUBS (SP minus immediate) 





Extend 


This section describes the encoding of the Extend instruction class. The encodings in this section are decoded from 
Miscellaneous 16-bit instructions on page F3-3943. 


15 14 13 1211110 9 8/7 65 |32 ol] 


[o71007 oufe] Rm | Ra | 





Decode fields 
Instruction page 














U B 

0 0 SXTH 
0 1 SXTB 

1 0 UXTH 
1 1 UXTB 





Change Processor State 


This section describes the encoding of the Change Processor State instruction class. The encodings in this section 
are decoded from Miscellaneous 16-bit instructions on page F3-3943. 
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|15 141312|11109 8/7 6 5 4| 0 | 


1011011001] fags | 





Decode fields 
Instruction page 








op flags 
i) - SETEND 
1 - CPS, CPSID, CPSIE 





Reverse bytes 
This section describes the encoding of the Reverse bytes instruction class. The encodings in this section are decoded 


from Miscellaneous 16-bit instructions on page F3-3943. 


|15 14 13 121110 9 8|7 65 |32 O| 


10 1110 1 o|10| Rm | Ra | 
op 





Decode fields 
Instruction page 











op 
00 REV 

01 REV16 
11 REVSH 





Hints 
This section describes the encoding of the Hints instruction class. The encodings in this section are decoded from 


Miscellaneous 16-bit instructions on page F3-3943. 


|15 14 13 12|11 10 9 8|7 4|3 2 1 0] 


To77ti1177] hm [0000 





Decode fields 
Instruction page 

















hint 
0000 NOP 
0001 YIELD 
0010 WFE 
0011 WFI 
0100 SEV 
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F3.1.5 


F3-3946 


Push and Pop 





Decode fields 


Instruction page 











hint 

0101 SEVL 

011x Reserved hint, behaves as NOP. 
1xxx Reserved hint, behaves as NOP. 





This section describes the encoding of the Push and Pop instruction class. The encodings in this section are decoded 


from Miscellaneous 16-bit instructions on page F3-3943. 


|15 14 13 12|11 10 9 8|7 | 0| 


mona o] ease | 


Conditional branch, and Supervisor Call 


Decode fields 
Instruction page 








L 
0 PUSH 
1 POP 


This section describes the encoding of the Conditional branch, and Supervisor Call group. The encodings in this 


section are decoded from /6-bit on page F3-3936. 


15 |11 8|7 | 0| 


Table F3-6 Encoding table for the Conditional branch, and Supervisor Call group 





Decode fields 


op0 


Decode group or instruction page 





111x 


Exception generation 





l= 111x 


B - TI variant on page F5-4117 





Exception generation 


This section describes the encoding of the Exception generation instruction class. The encodings in this section are 


decoded from Conditional branch, and Supervisor Call. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


|15 14 1312/1110 9 8|7 | 0| 


Tioti1 is] imme _| 





Decode fields 
Instruction page 





















































S 
0 UDF 
1 SVC 
F3.1.6 32-bit 
This section describes the encoding of the 32-bit group. The encodings in this section are decoded from 732 
instruction set encoding on page F3-3936. 
15 12] 9 8| 4|3 0 |1514 | | | 0| 
op3 EE 
This decode also imposes the constraint: 
: op0<3:2> != 00. 
Table F3-7 Encoding table for the 32-bit group 
Decode fields 
Decode group or instruction page 
op0 opt op3 
xlix - - System register access, Advanced SIMD, and floating-point on page F3-3953 
0100 xx0xx - Load/store multiple on page F3-3948 
0100 xx1xx - Load/store dual, load/store exclusive, load-acquire/store-release, and table branch on 
page F3-3975 
0101 Žž - - Data-processing (shifted register) on page F3-3948 
10xx - 1 Branches and miscellaneous control on page F3-3979 
10x0 - 0 Data-processing (modified immediate) on page F3-3950 
10x1 Žž - 0 Data-processing (plain binary immediate) on page F3-3983 
1100 1xxx0 - Advanced SIMD element or structure load/store on page F3-3985 
1100  != 1xxxð - Load/store single on page F3-3988 
1101 0xxxx - Data-processing (register) on page F3-3996 
1101 10xxx - Multiply, multiply accumulate, and absolute difference on page F3-4000 
1101 11xxx - Long multiply and divide on page F3-3951 
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Load/store multiple 


This section describes the encoding of the Load/store multiple instruction class. The encodings in this section are 
decoded from 32-bit on page F3-3947. 


[15 141312/11109 8|7 6 5 4|3 0/151413 | | | 0 | 


77040 ojojo] Rn eM reos E 





Decode fields 
Instruction page 


























opc L 

00 i) SRS, SRSDA, SRSDB, SRSIA, SRSIB - T7 on page F5-4555 
00 I RFE, RFEDA, RFEDB, RFEIA, RFEIB - 77 on page F5-4450 
01 () STM, STMIA, STMEA 

01 1 LDM, LDMIA, LDMFD 

10 () STMDB, STMFD 

10 l LDMDB, LDMEA 

11 () SRS, SRSDA, SRSDB, SRSIA, SRSIB - T2 on page F5-4556 
11 1 RFE, RFEDA, RFEDB, RFEIA, RFEIB - 72 on page F5-4451 





Data-processing (shifted register) 


This section describes the encoding of the Data-processing (shifted register) instruction class. The encodings in this 
section are decoded from 32-bit on page F3-3947. 


|15 14 13 12/1110 9 8| 5 413 0/1514 12\11 8|7 6 5 4|3 0 | 


1110101] opt [s| Rn [of imma | Rd imma|stype] Rm | 





Decode fields 
Instruction page 























opi S Rn imm3:imm2:stype Rd 

0000 O - - - AND, ANDS (register) - AND, rotate right with extend variant on 
page F5-4104 

0000 1 - != 0000011 != 1111 AND, ANDS (register) - ANDS, shift or rotate by value variant on 
page F5-4104 

0000 1 - != 0000011 1111 TST (register) - Shift or rotate by value variant on page F5-4698 

e000 1 - 0000011 != 1111 AND, ANDS (register) - ANDS, rotate right with extend variant 
on page F5-4104 

0000 1 - 0000011 1111 TST (register) - Rotate right with extend variant on page F5-4698 

ol - - - - BIC, BICS (register) 

0010 0 != 1111 ž - - ORR, ORRS (register) - ORR, rotate right with extend variant on 
page F5-4392 
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Decode fields 


Instruction page 






















































































opi S Rn imm3:imm2:stype Rd 

0010 © 1111 - - MOV, MOVS (register) - MOV, rotate right with extend variant on 
page F5-4344 

0010 1 != 1111 - - ORR, ORRS (register) - ORRS, rotate right with extend variant on 
page F5-4392 

0010 1 1111 - - MOV, MOVS (register) - MOVS, rotate right with extend variant 
on page F5-4345 

0011 0 != 1111 - - ORN, ORNS (register) - ORN, rotate right with extend variant on 
page F5-4386 

0011 © 1111 - - MVN, MVNS (register) - MVN, rotate right with extend variant 
on page F5-4378 

0011 1 != 1111 - - ORN, ORNS (register) - ORNS, rotate right with extend variant 
on page F5-4386 

0011 1 1111 - - MVN, MVNS (register) - MVNS, rotate right with extend variant 
on page F5-4378 

0100 0 - - - EOR, EORS (register) - EOR, rotate right with extend variant on 
page F5-4190 

0100 1 - != 0000011 != 1111 EOR, EORS (register) - EORS, shift or rotate by value variant on 
page F5-4190 

0100 1 - != 0000011 1111 TEQ (register) - Shift or rotate by value variant on page F5-4690 

0100 1 - 0000011 != 1111 EOR, EORS (register) - FORS, rotate right with extend variant on 
page F5-4190 

0100 1 - 0000011 1111 TEQ (register) - Rotate right with extend variant on page F5-4690 

010l - - - - Unallocated. 

0110 0 - XXXXX00 - PKHBT, PKHTB - PKHBT variant on page F5-4397 

0110 0 - XXXXXO1 - Unallocated. 

0110 0 - XXXXX10 - PKHBT, PKHTB - PKHTB variant on page F5-4397 

0110 0 - XXXXX11 - Unallocated. 

011l - - - - Unallocated. 

1000 © !=1101 - - ADD, ADDS (register) - ADD, rotate right with extend variant on 
page F5-4083 

1000 © 1101 - - ADD, ADDS (SP plus register) - ADD, rotate right with extend 
variant on page F5-4092 

1000 1 !=11001 - != 1111 ADD, ADDS (register) - ADDS, rotate right with extend variant 
on page F5-4084 

1000 1 1101 - != 1111 ADD, ADDS (SP plus register) - ADDS, rotate right with extend 
variant on page F5-4092 

1000 1 - - 1111 CMN (register) 

1001 - - - - Unallocated. 
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Decode fields 


Instruction page 




























































































op1 S Rn imm3:imm2:stype Rd 
1010 - - - - ADC, ADCS (register) 
1011 - - - - SBC, SBCS (register) 
1100 - - - - Unallocated. 
1101 0 = 1101 - - SUB, SUBS (register) - SUB, rotate right with extend variant on 
page F5-4662 
1101 © 1101 - - SUB, SUBS (SP minus register) - SUB, rotate right with extend 
variant on page F5-4671 
1101 1 !=1101 - != 1111 SUB, SUBS (register) - SUBS, rotate right with extend variant on 
page F5-4662 
1101 1 = 1101 - != 1111 SUB, SUBS (SP minus register) - SUBS, rotate right with extend 
variant on page F5-4671 
1101 1 - - 1111 CMP (register) 
1110 - - - - RSB, RSBS (register) 
1111 - - - - Unallocated. 
Data-processing (modified immediate) 
This section describes the encoding of the Data-processing (modified immediate) instruction class. The encodings 
in this section are decoded from 32-bit on page F3-3947. 
|15 14 13 12/1110 9 8| 5 4|3 0/1514 12|11 8/7 | 0| 
+41 of fol o s| eno] mma | Ra | me 
Decode fields 
Instruction page 
op1 Rn Rd 
0000 - - AND, ANDS (immediate) - AND variant on page F5-4100 
0000 - != 1111 AND, ANDS (immediate) - ANDS variant on page F5-4100 
0000 - 1111 TST (immediate) 
0001 - - BIC, BICS (immediate) 
0010 = 1111 - ORR, ORRS (immediate) - ORR variant on page F5-4388 
0010 1111 - MOV, MOVS (immediate) - MOV variant on page F5-4340 
0010 = 1111 - ORR, ORRS (immediate) - ORRS variant on page F5-4388 
0010 1111 - MOV, MOVS (immediate) - MOVS variant on page F5-4340 
0011 = 1111 - ORN, ORNS (immediate) - Not flag setting variant on page F5-4384 
0011 1111 - MVN, MVNS (immediate) - MVN variant on page F5-4375 
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Decode fields 


Instruction page 










































































op1 Rn Rd 

0011 l= 1111 - ORN, ORNS (immediate) - Flag setting variant on page F5-4384 
0011 1111 - MVN, MVNS (immediate) - MVNS variant on page F5-4375 

0100 - - EOR, EORS (immediate) - EOR variant on page F5-4186 

0100 - l= 1111 EOR, EORS (immediate) - EORS variant on page F5-4186 

0100 - 1111 TEQ (immediate) 

0101 - - Unallocated. 

011x - - Unallocated. 

1000 != 1101 - ADD, ADDS (immediate) - ADD variant on page F5-4079 

1000 1101 - ADD, ADDS (SP plus immediate) - ADD variant on page F5-4089 
1000 != 1101 != 1111 ADD, ADDS (immediate) - ADDS variant on page F5-4079 

1000 1101 != 1111 ADD, ADDS (SP plus immediate) - ADDS variant on page F5-4089 
1000 - 1111 CMN (immediate) 

1001 - - Unallocated. 

1010 - - ADC, ADCS (immediate) 

1011 - - SBC, SBCS (immediate) 

1100 - - Unallocated. 

1101 != 1101 - SUB, SUBS (immediate) - SUB variant on page F5-4658 

1101 1101 - SUB, SUBS (SP minus immediate) - SUB variant on page F5-4668 
1101 != 1101 != 1111 SUB, SUBS (immediate) - SUBS variant on page F5-4658 

1101 1101 != 1111 SUB, SUBS (SP minus immediate) - SUBS variant on page F5-4668 
1101 - 1111 CMP (immediate) 

1110 - - RSB, RSBS (immediate) 

1111 - - Unallocated. 








Long multiply and divide 


This section describes the encoding of the Long multiply and divide instruction class. The encodings in this section 


are decoded from 32-bit on page F3-3947. 
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[15 14 13 1211110 9 8|7 6 43 0 |15 12\11 8|7 4|3 0 | 


Toit 70777) of | Ra | Rao | Raw | op | Rm | 





Decode fields 


Instruction page 











































































































opi op2 
000 != 0000 Unallocated. 
000 0000 SMULL, SMULLS 
001 != 1111 Unallocated. 
001 1111 SDIV 
010 != 0000 Unallocated. 
010 0000 UMULL, UMULLS 
011 != 1111 Unallocated. 
011 1111 UDIV 
100 0000 SMLAL, SMLALS 
100 0001 Unallocated. 
100 001x Unallocated. 
100 01xx Unallocated. 
100 1000 SMLALBB, SMLALBT, SMLALTB, SMLALTT - SMLALBB variant on page F5-4529 
100 1001 SMLALBB, SMLALBT, SMLALTB, SMLALTT - SMLALBT variant on page F5-4529 
100 1010 SMLALBB, SMLALBT, SMLALTB, SMLALTT - SMLALTB variant on page F5-4529 
100 1011 SMLALBB, SMLALBT, SMLALTB, SMLALTT - SMLALTT variant on page F5-4529 
100 1100 SMLALD, SMLALDX - SMLALD variant on page F5-4531 
100 1101 SMLALD, SMLALDX - SMLALDX variant on page F5-4531 
100 111x Unallocated. 
101 Oxxx Unallocated. 
101 10xx Unallocated. 
101 1100 SMLSLD, SMLSLDX - SMLSLD variant on page F5-4537 
101 1101 SMLSLD, SMLSLDX - SMLSLDX variant on page F5-4537 
101 111x Unallocated. 
110 0000 UMLAL, UMLALS 
110 0001 Unallocated. 
110 001x Unallocated. 
110 010x Unallocated. 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 





Decode fields 
Instruction page 

















op1 op2 
110 0110 UMAAL 
110 0111 Unallocated. 
110 1xxx Unallocated. 
111 - Unallocated. 
F3.1.7 System register access, Advanced SIMD, and floating-point 


ARM DDI 0487E.a 
ID070919 


This section describes the encoding of the System register access, Advanced SIMD, and floating-point group. The 
encodings in this section are decoded from 32-bit on page F3-3947. 


|15 12|11 9 8|7 | 0|15 12|11 9 8| 5 4|3 0| 
Lm | ft opt Pope? PT aTr 
pa fs 


Table F3-8 Encoding table for the System register access, Advanced SIMD, and floating-point 


























group 
Decode fields 
Decode group or instruction page 
op0 opt ©op2 op3 
- 0x 111 - System register load/store and 64-bit move on page F3-3956 
- 10 10x 0 Floating-point data-processing on page F3-3958 
- 10 111 1 System register 32-bit move 
- 11 - - Advanced SIMD data-processing on page F3-3962 
) 0x 10x - Advanced SIMD load/store and 64-bit move on page F3-3972 
0 10 10x 1 Advanced SIMD and floating-point 32-bit move on page F3-3974 
1 0x 1x0 - Advanced SIMD three registers of the same length extension on page F3-3954 
1 10 1x0 - Advanced SIMD two registers and a scalar extension on page F3-3955 


System register 32-bit move 


This section describes the encoding of the System register 32-bit move instruction class. The encodings in this 
section are decoded from System register access, Advanced SIMD, and floating-point. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F3-3953 
Non-Confidential 


T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


[15 14 13 1211110 9 8|7 5 4|3 0 |15 12/1110 9 8|7 


5 4|3 0 | 


7 afoot 71 0] opt [cL] Rn [Rt [117] | ope [i] cm | 
EE cp15 





Decode fields 


Instruction page 











o0 L 

() 0 MCR 

0 1 MRC 

1 - Unallocated. 





Advanced SIMD three registers of the same length extension 


This section describes the encoding of the Advanced SIMD three registers of the same length extension instruction 
class. The encodings in this section are decoded from System register access, Advanced SIMD, and floating-point 


on page F3-3953. 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 


5 4|3 0| 








Decode fields 


Instruction page 


Architecture version 















































op1 op2 op3 op4 Q U 

x1 Ox 7) Q 0 ©  VCADD - 64-bit SIMD vector variant on page F6-4869 Armv8s.3 
x1 Ox ) i) () 1 Unallocated. - 

x1 Ox ) 0 1  @  VCADD - 128-bit SIMD vector variant on page F6-4870 Armv8s.3 
x1 Ox ( 0 1 1 Unallocated. - 

00 0x ) 0 - - Unallocated. - 

00 0x ) 1 - - Unallocated. - 

00 00 1 0 0 © Unallocated. - 

00 00 1 ) Q 1 Unallocated. - 

00 00 1 0 1 1 Unallocated. - 

00 00 1 1 0 1 Unallocated. - 

00 00 1 1 1 1 Unallocated. - 

00 01 1 0 - - Unallocated. - 

00 01 1 1 - - Unallocated. - 

00 10 Q 0 0 1  VFMAL (vector) - 64-bit SIMD vector variant on page F6-4986 Armv8.2 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 





Decode fields 















































Instruction page Architecture version 

op1 op2 op3 op4 Q U 

00 10 Q 1 - - Unallocated. - 

00 10 1 0 - - Unallocated. - 

00 10 1 1 0 ©  VSDOT (vector) - 64-bit SIMD vector variant on page F6-5348 Armv8.2 
00 10 1 1 (] 1  VUDOT (vector) - 64-bit SIMD vector variant on page F6-5457 Armv8.2 
00 10 1 1 1 @  VSDOT (vector) - /28-bit SIMD vector variant on page F6-5349 = Armv8.2 
00 10 1 1 1 1  VUDOT (vector) - 128-bit SIMD vector variant on page F6-5458 Armv8.2 
00 11 ) 0 1 1 VFMAL (vector) - 128-bit SIMD vector variant on page F6-4986 Armv8.2 
00 11 0 1 - - Unallocated. - 

00 11 1 0 - - Unallocated. - 

00 11 1 1 - - Unallocated. - 

01 10 (] () - 1 VFMSL (vector) Armvs.2 
01 11 - - - - Unallocated. - 

- 1x () 0 - 0 VCMLA Armv8.3 
10 11 - - - - Unallocated. - 

11 11 - - - - Unallocated. - 











Advanced SIMD two registers and a scalar extension 


This section describes the encoding of the Advanced SIMD two registers and a scalar extension instruction class. 
The encodings in this section are decoded from System register access, Advanced SIMD, and floating-point on 
page F3-3953. 




















|15 14 13 12|11 10 9 8|7 6 5 4]|3 o |15 12|1110 9 8|7 6 5 4|3 0| 
op1 dt fo op4 
op3 
Decode fields 
Instruction page Architecture version 
opi op2 op3 op4 Q U 
) - 0 0 - @  VCMLA (by element) - 128-bit SIMD vector of Armv8.3 
half-precision floating-point variant on page F6-4910 
) 00 i) () - 1 VFMAL (by scalar) Armv8.2 
( 01 i) Q - 1 VFMSL (by scalar) Armv8.2 
) 10 1 1 @ ©  VSDOT (by element) - 64-bit SIMD vector variant on Armv8.2 


ARM DDI 0487E.a 
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page F6-5346 
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F3.1 T32 instruction set encoding 





Decode fields 
Instruction page Architecture version 
op1 op2 op3 op4 Q U 





) 10 1 1 ) 1 VUDOT (by element) - 64-bit SIMD vector variant on Armv8.2 
page F6-5455 





) 10 1 1 1 ©  VSDOT (by element) - /28-bit SIMD vector variant on Armv8.2 
page F6-5347 





) 10 1 1 1 1 VUDOT (by element) - /28-bit SIMD vector variant on Armv8.2 
page F6-5456 





1 - i) () - 0 VCMLA (by element) - /28-bit SIMD vector of Armv8s.3 
single-precision floating-point variant on page F6-4910 





F3.1.8 System register load/store and 64-bit move 


This section describes the encoding of the System register load/store and 64-bit move group. The encodings in this 
section are decoded from System register access, Advanced SIMD, and floating-point on page F3-3953. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the T32 Advanced SIMD and floating-point instructions and their encoding on 
page F3-4003 


15 12111 8 | 5 4| 0 |15 12\11 8 | | 0 | 


= Slee 


Table F3-9 Encoding table for the System register load/store and 64-bit move group 





Decode fields 
Decode group or instruction page 








op0 
00x0 System register 64-bit move 
!= 00x0 System register Load/Store on 


page F3-3957 





System register 64-bit move 


This section describes the encoding of the System register 64-bit move instruction class. The encodings in this 
section are decoded from System register load/store and 64-bit move. 
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[15 14 1312/1110 9 8|7 6 5 4/3 


System register Load/Store 


T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


0 |15 12/1110 9 8|7 4|3 0 | 


7 tpt o o oppo] Re | R [117] | opi | cRm | 


j == —- = 





Decode fields 
Instruction page 

















o0 D L 

0 Q - Unallocated. 
Q 1 0 MCRR 

0 1 1 MRRC 

1 0 - Unallocated. 
1 1 - Unallocated. 


This section describes the encoding of the System register Load/Store instruction class. The encodings in this 
section are decoded from System register load/store and 64-bit move on page F3-3956. 


|15 14 13 12\11109 8|7 6 5 4|3 


0 |15 12/1110 9 8|7 | 0 | 





fe ae 





Decode fields 


Instruction page 


















































o0 P:U:W Rn CRd cp15 
- != 000 - != 0101 0 Unallocated. 
- != 000 - - 1 Unallocated. 
- != 000 - 0101 0 Unallocated. 
Q l= 000 1111 0101 o LDC (literal) 
Q 0x1 - 0101 0 STC - Post-indexed variant on page F5-4572 
Q 0x1 = 1111 0101 0 LDC (immediate) - Post-indexed variant on page F5-4221 
Q 010 - 0101 0 STC - Unindexed variant on page F5-4572 
Q 010 = 1111 0101 0 LDC (immediate) - Unindexed variant on page F5-4221 
Q 1x0 - 0101 0 STC - Offset variant on page F5-4572 
Q 1x0 = 1111 0101 0 LDC (immediate) - Offset variant on page F5-4220 
Q 1x1 - 0101 0 STC - Pre-indexed variant on page F5-4572 
Q 1x1 = 1111 0101 0 LDC (immediate) - Pre-indexed variant on page F5-4221 
1 != 000 - 0101 0 Unallocated. 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F3-3957 


ID070919 


Non-Confidential 


T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


F3.1.9 


Floating-point data-processing 


This section describes the encoding of the Floating-point data-processing group. The encodings in this section are 
decoded from System register access, Advanced SIMD, and floating-point on page F3-3953. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the T32 Advanced SIMD and floating-point instructions and their encoding on 
page F3-4003 


15 12111 |7 4|3 0 |15 12/11 9 8|7 6 5 4/3 0 | 
Pat | | 1mo | o | o2 | 10 fop3 | | | fol] 
"E OO o 


Table F3-10 Encoding table for the Floating-point data-processing group 





Decode fields 
Decode group or instruction page 
op0 opt op2 op3 op4 























) 1x11 - - 1 Floating-point data-processing (two registers) 

) 1x11 - - 0 Floating-point move immediate on page F3-3959 

) l= 1x11 - - - Floating-point data-processing (three registers) on page F3-3960 
1 Oxxx - 1= @ 0 Floating-point conditional select on page F3-3961 

1 1x00 - l=00 - Floating-point minNum/maxNum on page F3-3961 

1 1x11 0000 !=00 1 Floating-point extraction and insertion on page F3-3961 

1 1x11 1xxx !=00 1 Floating-point directed convert to integer on page F3-3962 





Floating-point data-processing (two registers) 


This section describes the encoding of the Floating-point data-processing (two registers) instruction class. The 
encodings in this section are decoded from Floating-point data-processing. 


|15 14 13 1211110 9 8|7 6 5 4/3 2 of5 12/1110 9 8|7 6 5 4|3 0| 





7704770 rph toi] oa] va [1 Of swe oxt[mo] vm _| 





Decode fields 




















Instruction page Architecture version 

o1 opc2. size 03 

- - 00 - Unallocated. - 
i) 000 01 ) Unallocated. - 
0 000 - 1 VABS - 
0 000 10 ) VMOV (register) - Single-precision scalar variant on page F6-5137 - 
0 000 11 ) VMOV (register) - Double-precision scalar variant on page F6-5137 - 
0 001 - ( VNEG - 
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F3.1 T32 instruction set encoding 





Decode fields 







































































Instruction page Architecture version 
01 opc2_ size 03 
0 001 - 1 VSQRT & 
0 010 - ) VCVTB - Half-precision to double-precision variant on page F6-4948 - 
0 010 01 - Unallocated. - 
0 010 - 1 VCVTT - Half-precision to double-precision variant on page F6-4967 - 
0 011 - Q VCVTB - Double-precision to half-precision variant on page F6-4948 - 
0 011 - 1 VCVTT - Double-precision to half-precision variant on page F6-4967 - 
0 100 - 0 VCMP - T1 on page F6-4913 - 
0 100 - 1 VCMPE - TI on page F6-4917 - 
i) 101 - 0 VCMP - T2 on page F6-4914 - 
i) 101 - 1 VCMPE - 72 on page F6-4918 - 
0 110 - ( VRINTR - 
0 110 - 1 VRINTZ (floating-point) - 
0 111 - ) VRINTX (floating-point) - 
0 111 01 1 Unallocated. - 
0 111 10 i; VCVT (between double-precision and single-precision) - Single-precision  - 

to double-precision variant on page F6-4922 
0 111 11 1 VCVT (between double-precision and single-precision) - Double-precision —- 

to single-precision variant on page F6-4922 
1 000 - - VCVT (integer to floating-point, floating-point) - 
1 001 01 - Unallocated. = 
1 001 10 - Unallocated. 





1 001 11 0 Unallocated. - 























1 001 11 1 VICVT Armv8.3 
1 01x - - VCVT (between floating-point and fixed-point, floating-point) - 
1 100 - ) VCVTR - 
1 100 - 1 VCVT (floating-point to integer, floating-point) - 
1 101 - () VCVTR - 
1 101 - 1 VCVT (floating-point to integer, floating-point) - 
1 11x - - VCVT (between floating-point and fixed-point, floating-point) - 





Floating-point move immediate 


This section describes the encoding of the Floating-point move immediate instruction class. The encodings in this 
section are decoded from Floating-point data-processing on page F3-3958. 
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[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


Tit 01170 1)0[1 1] mma | va [1 ofsi Oo Oo mma 





Decode fields 














Instruction page Architecture version 
size 
00 Unallocated. - 
01 VMOV (immediate) - Half-precision scalar variant on page F6-5133 Armv8.2 
10 VMOV (immediate) - Single-precision scalar variant on page F6-5133 - 
11 VMOV (immediate) - Double-precision scalar variant on page F6-5133 - 





Floating-point data-processing (three registers) 


This section describes the encoding of the Floating-point data-processing (three registers) instruction class. The 
encodings in this section are decoded from Floating-point data-processing on page F3-3958. 


[15 1413 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


Tit 0111 opolo] vn | va [i ofsze inpo] vm 





Decode fields 
Instruction page 
00:01 size 02 
























































l= 111 00 - Unallocated. 
000 - ) VMLA (floating-point) 
000 - 1 VMLS (floating-point) 
001 - () VNMLS 
001 - 1 VNMLA 
010 - 0 VMUL (floating-point) 
010 - 1 VNMUL 
011 - ) VADD (floating-point) 
011 - 1 VSUB (floating-point) 
100 - ( VDIV 
101 - () VFNMS 
101 - 1 VFNMA 
110 - ) VFMA 
110 - 1 VFMS 
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F3.1 T32 instruction set encoding 


Floating-point conditional select 


This section describes the encoding of the Floating-point conditional select instruction class. The encodings in this 
section are decoded from Floating-point data-processing on page F3-3958. 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0|15 12/1110 9 8|7 6 5 4|3 0| 
111111100] e] vn | va [1 oeo omo] vm | 
size 





Decode fields 
Instruction page 

















cc size 

00 - VSELEQ, VSELGE, VSELGT, VSELVS - VSELEQ,doubleprec variant on page F6-5351 
01 - VSELEQ, VSELGE, VSELGT, VSELVS - VSELVS,doubleprec variant on page F6-5352 
- 01 Unallocated. 

10 - VSELEQ, VSELGE, VSELGT, VSELVS - VSELGE,doubleprec variant on page F6-5351 
11 - VSELEQ, VSELGE, VSELGT, VSELVS - VSELGT doubleprec variant on page F6-5352 





Floating-point minNum/maxNum 


This section describes the encoding of the Floating-point minNum/maxNum instruction class. The encodings in this 
section are decoded from Floating-point data-processing on page F3-3958. 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0|15 12/1110 9 8|7 6 5 4|3 0| 
14111110 1{Dfo of vn | va [1 Of00[Nfop[mjo] vm | 
size 





Decode fields 
Instruction page 











size op 

- 0 VMAXNM 
01 - Unallocated. 
- 1 VMINNM 





Floating-point extraction and insertion 


This section describes the encoding of the Floating-point extraction and insertion instruction class. The encodings 
in this section are decoded from Floating-point data-processing on page F3-3958. 
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|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4/3 0 | 


Toit itio pr 71000 0] va [i ofco Mo] vm _| 


size 





Decode fields 
Instruction page 


Architecture version 














size op 

01 - Unallocated. - 

10 0 VMOVX Armv8.2 
10 1 VINS Armv8.2 
11 - Unallocated. - 





Floating-point directed convert to integer 


This section describes the encoding of the Floating-point directed convert to integer instruction class. The encodings 


in this section are decoded from Floating-point data-processing on page F3-3958. 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4/3 0 | 


Titti170 api 7 oem] va [1 oeo Mo] vm _| 


size 





Decode fields 


o1 RM size 


Instruction page 





VRINTA (floating-point) 





VRINTN (floating-point) 





Unallocated. 





VRINTP (floating-point) 











VRINTM (floating-point) 





VCVTA (floating-point) 





VCVTN (floating-point) 





VCVTP (floating-point) 





o oOo - 
o oo - 
S - 0l 
o Ww - 
1) 11 - 
1 o - 
1 01 - 
1 10 - 
1 11 - 


VCVTM (floating-point) 





F3.1.10 Advanced SIMD data-processing 


This section describes the encoding of the Advanced SIMD data-processing group. The encodings in this section 
are decoded from System register access, Advanced SIMD, and floating-point on page F3-3953. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the T32 Advanced SIMD and floating-point instructions and their encoding on 


page F3-4003 
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[15 12111 


7 6 


F3. 


0|15 | | 


T32 Instruction Set Encoding 
1 T32 instruction set encoding 


5 413 0| 


E 
op0 E l 


Table F3-11 Encoding table for the Advanced SIMD data-processing group 


p= ==: op1 





Decode fields 


Decode group or instruction page 





Advanced SIMD three registers of the same length 





Advanced SIMD two registers, or three registers of different lengths on page F3-3965 





op0 op1 
o - 
1 ( 
1 1 


Advanced SIMD shifts and immediate generation on page F3-3970 





Advanced SIMD three registers of the same length 


This section describes the encoding of the Advanced SIMD three registers of the same length instruction class. The 
encodings in this section are decoded from Advanced SIMD data-processing on page F3-3962. 


|15 14 13 121110 9 8|7 6 5 4|3 


1 1juji 1 1 1 ojofsize] vn | va | oe [njajmþori] vm | 


0 |15 12|11 8|7 6 


5 4]3 0| 





Decode fields 


Instruction page 


Architecture version 


















































U size opc 01 

O ex 1100 1 VFMA - 
O ex 1101 ) VADD (floating-point) - 
O ex 1101 1 VMLA (floating-point) - 
o ex 1110 ) VCEQ (register) - T2 on page F6-4874 - 
O ex 1111 ) VMAX (floating-point) - 
o ex 1111 1 VRECPS - 
Hy 0000 0 VHADD - 
O 00 0001 1 VAND (register) - 
- =- 0000 1 VQADD - 
- = 0001 ) VRHADD - 
O 00 1100 ) SHA1C - 
- =- 0010 0 VHSUB - 
o 1 0001 1 VBIC (register) - 
= 0010 1 VQSUB 3 
- - 0011 0 VCGT (register) - T7 on page F6-4887 - 

ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F3-3963 


ID070919 


Non-Confidential 


T32 Instruction Set Encoding 
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F3-3964 





Decode fields 


Instruction page 


Architecture version 


























































































































U size opc 01 

- - 0011 1 VCGE (register) - TZ on page F6-4880 
o 1 1100 ( SHAIP 

() 1x 1100 1 VFMS 

O ix 1101 ) VSUB (floating-point) 
O 1x 1101 1 VMLS (floating-point) 
O ix 1110 0 Unallocated. 

O ix 1111 0 VMIN (floating-point) 
O 1x 1111 1 VRSQRTS 

- - 0100 ) VSHL (register) 

) - 1000 (2 VADD (integer) 

i) 10 0001 1 VORR (register) 

o - 1000 1 VTST 

- - 0100 1 VQSHL (register) 

) - 1001 (2 VMLA (integer) 

- =- 0101 (0 VRSHL 

- =- 0101 1 VQRSHL 

o - 1011 t) VQDMULH 

o 10 1100 ) SHAIM 

) - 1011 1 VPADD (integer) 

- - 0110 (2 VMAX (integer) 

() 11 0001 1 VORN (register) 

- - 0110 1 VMIN (integer) 

- - 0111 (2 VABD (integer) 

- =- 0111 1 VABA 

o 1 1100 ( SHA1SU0 

1 x 1101 ) VPADD (floating-point) 
1 x 1101 1 VMUL (floating-point) 
1 0x 1110 0 VCGE (register) - T2 on page F6-4880 
I Ox 1110 1 VACGE 

1 0x 1111 ) VPMAX (floating-point) 
1 Ox 1111 1 VMAXNM 

1 00 0001 1 VEOR 
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F3.1 T32 instruction set encoding 





Decode fields 








Instruction page Architecture version 
U size opc Q 01 
- - 1001 - 1 VMUL (integer and polynomial) - 
1 00 1100 - 0 SHA256H - 





- - 1010 80 20 VPMAX (integer) - 





1 01 0001 á- 1 VBSL = 





- - 1010 0 1 VPMIN (integer) - 




































































- - 1010 1 - Unallocated. = 
1 @1 1100 - @ SHA256H2 - 
1 ix 1101 - 20 VABD (floating-point) - 
1 1x 1110 - 0 VCGT (register) - T2 on page F6-4887 - 
I 1x 1110 - 1 VACGT = 
1 1x 1111 0 20 VPMIN (floating-point) - 
1 1x 1111 - 1 VMINNM - 
1 - 1000 - (2 VSUB (integer) - 
1 1 o1 - 1 VBIT - 
1 - 1000 - 1 VCEQ (register) - T7 on page F6-4874 - 
1 - 1001 - ) VMLS (integer) - 
1 - 1011 - @ VQRDMULH - 
1 10 1100 - @ SHA256SU1 - 
I - 1011 - 1 VQRDMLAH Armvs.1 
I 11 0001 Žž - 1 VBIF = 
1 - 1100 - 1 VQRDMLSH Armvs.1 
1 - 1111 1 @ Unallocated. - 





F3.1.11 Advanced SIMD two registers, or three registers of different lengths 


This section describes the encoding of the Advanced SIMD two registers, or three registers of different lengths 
group. The encodings in this section are decoded from Advanced SIMD data-processing on page F3-3962. 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


[15 12111 | 65 4|3 0 |15 12/1110 9 |7 65 4/3 0| 





Table F3-12 Encoding table for the Advanced SIMD two registers, or three registers of different 
lengths group 





Decode fields 
Decode group or instruction page 
op0 op1 op2 op3 























Q 11 - - VEXT (byte elements) 

it 11 Ox - Advanced SIMD two registers misc 

1 11 10 - VTBL, VTBX 

1 11 11 - Advanced SIMD duplicate (scalar) on page F3-3968 

- l= 11 - 0 Advanced SIMD three registers of different lengths on page F3-3968 
- l= 11 - 1 Advanced SIMD two registers and a scalar on page F3-3969 





Advanced SIMD two registers misc 


This section describes the encoding of the Advanced SIMD two registers misc instruction class. The encodings in 
this section are decoded from Advanced SIMD two registers, or three registers of different lengths on page F3-3965. 


|15 14 13 1211110 9 8/7 6 5 4/3 2 14 0|15 12|11 10 7 6 5 4|3 0| 


iaa aaa ap isejo] va Jo] ope? Jomo] wm | 


Decode fields 


Instruction page 



































size opci1 opc2 Q 

= 00 0000 - — VREV64 

- 00 0001 -  VREV32 

- 00 0010 -  VREV16 

- 00 0011 - Unallocated. 

- 00 010x -  VPADDL 

- 00 0110 0  AESE 

- 00 0110 1  AESD 

- 00 0111 0 AESMC 

- 00 0111 1 — AESIMC 

- 00 1000 -  VCLS 

00 10 0000 -  VSWP 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 





Decode fields 
Instruction page 
size opci1 opc2 Q 





































































































- 00 1001 -  VCLZ 
- 00 1010 -  VCNT 
- 00 1011 - VMVN (register) 
00 10 1100 1 Unallocated. 
- 00 110x - — VPADAL 
- 00 1110 -  VQABS 
- 00 1111 - VQNEG 
- 01 x000 - VCGT (immediate #0) 
- 01 x001 - VCGE (immediate #0) 
- 01 x010 - VCEQ (immediate #0) 
- 01 x011 - | VCLE (immediate #0) 
- 01 x100 - VCLT (immediate #0) 
- 01 x110 - VABS 
= o1 x111 = VNEG 
- 01 0101 1  SHAIH 
- 10 0001 - VTRN 
- 10 0010 - VUZP 
- 10 0011 =  VZIP 
- 10 0100 @ VMOVN 
- 10 0100 1 VQMOVN, VQMOVUN - Unsigned result variant on page F6-5244 
- 10 0101 - VQMOVN, VQMOVUN - Signed result variant on page F6-5243 
- 10 0110 0 VSHLL 
- 10 0111 @  SHAISUI 
- 10 0111 1  SHA256SU0 
- 10 1000 -  VRINTN (Advanced SIMD) 
- 10 1001 - | VRINTX (Advanced SIMD) 
- 10 1010 - VRINTA (Advanced SIMD) 
- 10 1011 - VRINTZ (Advanced SIMD) 
10 10 1100 1 Unallocated. 
- 10 1100 @ VCVT (between half-precision and single-precision, Advanced SIMD) - Single-precision to 
half-precision variant on page F6-4924 
- 10 1101 - VRINTM (Advanced SIMD) 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 





Decode fields 
Instruction page 
size opc1 opc2 Q 



































- 10 1110 @ VCVT (between half-precision and single-precision, Advanced SIMD) - Half-precision to 
single-precision variant on page F6-4924 

- 10 1110 1 Unallocated. 

- 10 1111 - VRINTP (Advanced SIMD) 

- 11 000x - VCVTA (Advanced SIMD) 

- 11 001x - VCVTN (Advanced SIMD) 

- 11 010x - VCVTP (Advanced SIMD) 

- 11 011x - VCVTM (Advanced SIMD) 

- 11 10x0 - | VRECPE 

- 11 10x1 - VRSQRTE 

11 10 1100 1 Unallocated. 

- 11 11xx -  VCVT (between floating-point and integer, Advanced SIMD) 





Advanced SIMD duplicate (scalar) 
This section describes the encoding of the Advanced SIMD duplicate (scalar) instruction class. The encodings in 


this section are decoded from Advanced SIMD two registers, or three registers of different lengths on page F3-3965. 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1109 |7 65 4|3 0 | 


11111111 1{0]1 af imm | va [1 1| oc jajmjo] vm | 





Decode fields 
Instruction page 














opc 
000 VDUP (scalar) 
001 Unallocated. 
01x Unallocated. 
1xx Unallocated. 





Advanced SIMD three registers of different lengths 


This section describes the encoding of the Advanced SIMD three registers of different lengths instruction class. The 
encodings in this section are decoded from Advanced SIMD two registers, or three registers of different lengths on 
page F3-3965. 


F3-3968 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12\11 


T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


81/7 6 5 4|3 0 | 


maapu pen] ve [va j ope Noo vm _ 


size 





Decode fields 


Instruction page 

































































U opc 

= 0000 VADDL 

- 0001 VADDW 

- 0010 VSUBL 

0 0100 VADDHN 

- 0011 VSUBW 

0 0110 VSUBHN 

0 1001 VQDMLAL 

- 0101 VABAL 

0 1011 VQDMLSL 

0 1101 VQDMULL 

- 0111 VABDL (integer) 
- 1000 VMLAL (integer) 
- 1010 VMLSL (integer) 
1 0100 VRADDHN 

1 0110 VRSUBHN 

- 11x0 VMULL (integer and polynomial) 
it 1001 Unallocated. 

1 1011 Unallocated. 

1 1101 Unallocated. 

- 1111 Unallocated. 








Advanced SIMD two registers and a scalar 


This section describes the encoding of the Advanced SIMD two registers and a scalar instruction class. The 
encodings in this section are decoded from Advanced SIMD two registers, or three registers of different lengths on 


page F3-3965. 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12\11 81/7 6 5 4|3 0 | 


7 ajet pen] va | va j ope No vm _ 


size 





Decode fields 
Instruction page Architecture version 



























































Q opc 

- 000x VMLA (by scalar) - 

) 0011 VQDMLAL - 

- 0010 VMLAL (by scalar) - 

V) 0111 VQDMLSL - 

- 010x VMLS (by scalar) - 

() 1011 VQDMULL - 

- 0110 VMLSL (by scalar) - 

- 100x VMUL (by scalar) - 

1 0011 Unallocated. - 

- 1010 VMULL (by scalar) - 

1 0111 Unallocated. - 

- 1100 VQDMULH - 

- 1101 VQRDMULH - 

1 1011 Unallocated. - 

- 1110 VQRDMLAH Armvs.1 
- 1111 VQRDMLSH Armvs.1 








F3.1.12 Advanced SIMD shifts and immediate generation 


This section describes the encoding of the Advanced SIMD shifts and immediate generation group. The encodings 
in this section are decoded from Advanced SIMD data-processing on page F3-3962. 


15 12111 | 65 | 0 |15 | 7 6 5 4|3 0 | 


Cam p o S o Nd 


Table F3-13 Encoding table for the Advanced SIMD shifts and immediate generation group 





Decode fields 
Decode group or instruction page 
op0 





000XXXXXXXXXXXŐ Advanced SIMD one register and modified immediate on 
page F3-3971 





l= 000xxxxxxxxxxxð Advanced SIMD two registers and shift amount on page F3-3971 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


Advanced SIMD one register and modified immediate 


This section describes the encoding of the Advanced SIMD one register and modified immediate instruction class. 
The encodings in this section are decoded from Advanced SIMD shifts and immediate generation on page F3-3970. 


[15 141312/11109 8/7 6 5 4/3 2 0|15 12\11 81/7 6 5 4|3 0 | 


apt 117 oo o of mms [va | omode [o[afoo[7] mma 





Decode fields 
Instruction page 
cmode op 









































Oxxd ) VMOV (immediate) - 77 on page F6-5132 
Oxxd 1 VMVN (immediate) - 77 on page F6-5177 
Oxx1 ) VORR (immediate) - 7/7 on page F6-5201 
Oxx1 1 VBIC (immediate) - 77 on page F6-4859 
10x0 0 VMOV (immediate) - 73 on page F6-5133 
10x0 1 VMVN (immediate) - 72 on page F6-5177 
10x1 ) VORR (immediate) - 72 on page F6-5201 
10x1 1 VBIC (immediate) - 72 on page F6-4859 
11xx 0 VMOV (immediate) - 74 on page F6-5134 
110x 1 VMVN (immediate) - 73 on page F6-5178 
1110 1 VMOV (immediate) - 75 on page F6-5134 
1111 1 Unallocated. 








Advanced SIMD two registers and shift amount 


This section describes the encoding of the Advanced SIMD two registers and shift amount instruction class. The 
encodings in this section are decoded from Advanced SIMD shifts and immediate generation on page F3-3970. 


|15 14 13 12/1110 9 8|7 65 |3 2 O15 12\11 8|7 6 5 4|3 0 | 





7 afoul 711 o mmn [imma [va [ ope ioa vm _ 





Decode fields 
Instruction page 
U  imm3H:L imm3L opc Q 

















- != 0000 - 0000 - — VSHR 
- != 0000 - 0001 - VSRA 
- != 0000 000 1010 0 VWMOVL 
- != 0000 - 0010 - VRSHR 
- != 0000 - 0011 -  VRSRA 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 





Decode fields 


Instruction page 



























































U imm3H:L imm3L opc Q 
- '= 0000 - 0111 - VQSHL, VQSHLU (immediate) - VOSHL,quad,signed-result variant on 
page F6-5268 
- = 0000 - 1001 0 #$VQSHRN, VQSHRUN - Signed result variant on page F6-5274 
- = 0000 - 1001 1 VQRSHRN, VQRSHRUN - Signed result variant on page F6-5262 
- != 0000 - 1010 @ VSHLL 
- = 0000 - lixx - VCVT (between floating-point and fixed-point, Advanced SIMD) 
0 '= 0000 - 0101 -  VSHL (immediate) 
0 = 0000 - 1000 0 — VSHRN 
0 != 0000 - 1000 1 VRSHRN 
1 '= 0000 = 0100 - VSRI 
1  != 0000 - 0101 - VSLI 
1 '= 0000 - 0110 - VQSHL, VQSHLU (immediate) - VOSHLU,quad,unsigned-result variant on 
page F6-5268 
1 != 0000 - 1000 0 — VQSHRN, VQSHRUN - Unsigned result variant on page F6-5275 
1 '= 0000 - 1000 1 VQRSHRN, VQRSHRUN - Unsigned result variant on page F6-5263 
F3.1.13 Advanced SIMD load/store and 64-bit move 
This section describes the encoding of the Advanced SIMD load/store and 64-bit move group. The encodings in this 
section are decoded from System register access, Advanced SIMD, and floating-point on page F3-3953. 
This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the T32 Advanced SIMD and floating-point instructions and their encoding on 
page F3-4003 
15 | 8 | 5 4| 0|15 12/11 9 | | 0| 
mono | _op0 p o E 
Table F3-14 Encoding table for the Advanced SIMD load/store and 64-bit move group 
Decode fields 
Decode group or instruction page 
op0 
00x0 Advanced SIMD and floating-point 64-bit move 
!= 00x0 Advanced SIMD and floating-point load/store on page F3-3973 
Advanced SIMD and floating-point 64-bit move 
This section describes the encoding of the Advanced SIMD and floating-point 64-bit move instruction class. The 
encodings in this section are decoded from Advanced SIMD load/store and 64-bit move. 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


7704700 0[pjofel Re | Ri [1 0] size [opca|mfoa]_ vm | 





Decode fields 


Instruction page 
































D op size opc2 03 

0 - - - - Unallocated. 

1 - - - 0 Unallocated. 

1 - 0x 00 1 Unallocated. 

1 - - 01 - Unallocated. 

1 0 10 00 a VMOV (between two general-purpose registers and two single-precision registers) - From 
general-purpose registers variant on page F6-5148 

1 0 11 00 1 VMOV (between two general-purpose registers and a doubleword floating-point register) - From 
general-purpose registers variant on page F6-5126 

Io = - 1x - Unallocated. 

1 1 10 00 1 VMOV (between two general-purpose registers and two single-precision registers) - To 
general-purpose registers variant on page F6-5148 

a re | 11 00 1 VMOV (between two general-purpose registers and a doubleword floating-point register) - To 


general-purpose registers variant on page F6-5126 





Advanced SIMD and floating-point load/store 


This section describes the encoding of the Advanced SIMD and floating-point load/store instruction class. The 
encodings in this section are decoded from Advanced SIMD load/store and 64-bit move on page F3-3972. 


[15 1413 12/1110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0| 


77047 opPlupppwt] e | va [i ojs) — me | 





Decode fields 


Instruction page 





























P U W L Rn size imm8 

o ð 1 - - - - Unallocated. 

® 1 - - - 0x - Unallocated. 

0 1 - 0 - 10 - VSTM, VSTMDB, VSTMIA - Increment After variant on page F6-5427 
® 1 - 0 - 11 xxxxxxxð  VSTM, VSTMDB, VSTMIA - Increment After variant on page F6-5427 
0 1 - 0 - 11 XXXXXxxl FSTMDBX, FSTMIAX - Increment After variant on page F6-4795 

0 1 - 1 - 10 - VLDM, VLDMDB, VLDMIA- Increment After variant on page F6-5073 
6 1 - 1 - 11 xxxxxxxð VLDM, VLDMDB, VLDMIA- Increment After variant on page F6-5073 
O 1 - 1 - 11 xxxxxxx] FLDM*X (FLDMDBX, FLDMIAX) - Increment After variant on 
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page F6-4792 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 





Decode fields 
Instruction page 












































P U W L Rn size imm8 
1 - @ eo - - - VSTR 
1 - @ - - 00 - Unallocated. 
1 - i) 1 != 1111 - - VLDR (immediate) 
1 0 1 - - 0x - Unallocated. 
1 0 1 0 - 10 - VSTM, VSTMDB, VSTMIA - Decrement Before variant on page F6-5427 
1 0 1 0 - 11 XxXxxxxx@  VSTM, VSTMDB, VSTMIA - Decrement Before variant on page F6-5427 
1 0 1 0 - 11 XXXXXxxl  FSTMDBX, FSTMIAX - Decrement Before variant on page F6-4795 
1 0 1 1 - 10 - VLDM, VLDMDB, VLDMIA - Decrement Before variant on page F6-5072 
1 0 1 1 - 11 XXXxxxx@  VLDM, VLDMDB, VLDMIA- Decrement Before variant on page F6-5072 
1 0 1 1 - 11 XXXXxxx1l  FLDM*X (FLDMDBX, FLDMIAX) - Decrement Before variant on 

page F6-4792 
1 - 0 1 1111 - - VLDR (literal) 
1 1 1 - - - - Unallocated. 





F3.1.14 Advanced SIMD and floating-point 32-bit move 


This section describes the encoding of the Advanced SIMD and floating-point 32-bit move group. The encodings 
in this section are decoded from System register access, Advanced SIMD, and floating-point on page F3-3953. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the T32 Advanced SIMD and floating-point instructions and their encoding on 
page F3-4003 


15 | 7 5 4| 0 |15 12\11 8/7 54] | 


C momo | 0 [in| 7 | [oy in 
[oo op1 


Table F3-15 Encoding table for the Advanced SIMD and floating-point 32-bit move group 





Decode fields 
Decode group or instruction page 











op0 op1 

000 0 VMOV (between general-purpose register and single-precision) 
111 0 Floating-point move special register 

- 1 Advanced SIMD 8/16/32-bit element move/duplicate on 


page F3-3975 





Floating-point move special register 


This section describes the encoding of the Floating-point move special register instruction class. The encodings in 
this section are decoded from Advanced SIMD and floating-point 32-bit move. 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 








Decode fields 
Instruction page 








L 
0 VMSR 
1 VMRS 





Advanced SIMD 8/16/32-bit element move/duplicate 


This section describes the encoding of the Advanced SIMD 8/16/32-bit element move/duplicate instruction class. 
The encodings in this section are decoded from Advanced SIMD and floating-point 32-bit move on page F3-3974. 


|15 14 13 12/1110 9 8|7 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 








Decode fields 
Instruction page 
opci L opc2 














Oxx 0 - VMOV (general-purpose register to scalar) 
- 1 - VMOV (scalar to general-purpose register) 
1xx o ex VDUP (general-purpose register) 
1xx O 1x Unallocated. 

F3.1.15 Load/store dual, load/store exclusive, load-acquire/store-release, and table branch 


This section describes the encoding of the Load/store dual, load/store exclusive, load-acquire/store-release, and 
table branch group. The encodings in this section are decoded from 32-bit on page F3-3947. 


|15 | 8 | 5 4/3 0 |15 8|7 54| 0 | 


C moo j o ‘| op [op 
pe 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


This decode also imposes the constraint: 


$ op0<1> == 


Table F3-16 Encoding table for the Load/store dual, load/store exclusive, 
load-acquire/store-release, and table branch group 





Decode fields 
Decode group or instruction page 
op0 op1 op2 op3 





























0010 - - - Load/store exclusive 

0110 0 - 000 Unallocated. 

0110 1 - 000 TBB, TBH 

0110 - - olx Load/store exclusive byte/half/dual 

0110 - - 1xx Load-acquire / Store-release on page F3-3977 

0x11 - l= 1111 Žž - Load/store dual (immediate, post-indexed) on page F3-3978 
1x10 - l= 1111 - Load/store dual (immediate) on page F3-3978 

1x11 - l= 1111 - Load/store dual (immediate, pre-indexed) on page F3-3978 
l= 0xxð Žž - 1111 - LDRD (literal) 





Load/store exclusive 


This section describes the encoding of the Load/store exclusive instruction class. The encodings in this section are 
decoded from Load/store dual, load/store exclusive, load-acquire/store-release, and table branch on page F3-3975. 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11 8|7 | 0 | 


11101000010] Re | Rt | Rd | mwe | 





Decode fields 
Instruction page 








L 
0 STREX 
1 LDREX 





Load/store exclusive byte/half/dual 


This section describes the encoding of the Load/store exclusive byte/half/dual instruction class. The encodings in 
this section are decoded from Load/store dual, load/store exclusive, load-acquire/store-release, and table branch 
on page F3-3975. 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12\11 81/7 6 5 4|3 0 | 


11101000110] Re | Rt | Re Joi s| Ri 





Decode fields 
Instruction page 


























L sz 

0 00 STREXB 

0 01 STREXH 

0 10 Unallocated. 
0 11 STREXD 

1 00 LDREXB 

1 01 LDREXH 

1 10 Unallocated. 
1 11 LDREXD 





Load-acquire / Store-release 


This section describes the encoding of the Load-acquire / Store-release instruction class. The encodings in this 
section are decoded from Load/store dual, load/store exclusive, load-acquire/store-release, and table branch on 
page F3-3975. 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11 8|7 6 5 4|3 0 | 


Tt totoooti ot] em | n | Re [os| Ro 





Decode fields 
Instruction page 
L op sz 





0 0 00 STLB 





0 7) 01 STLH 





0 7) 10 STL 





(1) ) 11 Unallocated. 





0 1 00 STLEXB 





0 1 01 STLEXH 





0 1 10 STLEX 





0 1 11 STLEXD 





1 ) 00 LDAB 





1 ) 01 LDAH 





1 Q 10 LDA 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 





Decode fields 
Instruction page 
L op sz 





1 (] 11 Unallocated. 





1 1 00 LDAEXB 





1 1 01 LDAEXH 





1 1 10 LDAEX 





1 1 11 LDAEXD 





Load/store dual (immediate, post-indexed) 


This section describes the encoding of the Load/store dual (immediate, post-indexed) instruction class. The 
encodings in this section are decoded from Load/store dual, load/store exclusive, load-acquire/store-release, and 
table branch on page F3-3975. 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11 8|7 | 0 | 


Rn 





Decode fields 
Instruction page 








L 
Q STRD (immediate) 
1 LDRD (immediate) 





Load/store dual (immediate) 


This section describes the encoding of the Load/store dual (immediate) instruction class. The encodings in this 
section are decoded from Load/store dual, load/store exclusive, load-acquire/store-release, and table branch on 
page F3-3975. 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12\11 8|7 | 0 | 


1110700 4fUlt of] 11 | R | R2 | imm | 
Rn 





Decode fields 
Instruction page 








L 
0 STRD (immediate) 
1 LDRD (immediate) 





Load/store dual (immediate, pre-indexed) 


This section describes the encoding of the Load/store dual (immediate, pre-indexed) instruction class. The 
encodings in this section are decoded from Load/store dual, load/store exclusive, load-acquire/store-release, and 
table branch on page F3-3975. 


F3-3978 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 12111 8|7 | 0 | 


Titoroo ui my =m | R | Re | me ] 
Rn 





Decode fields 
Instruction page 








L 
Q STRD (immediate) 
1 LDRD (immediate) 





F3.1.16 Branches and miscellaneous control 


ARM DDI 0487E.a 
ID070919 


This section describes the encoding of the Branches and miscellaneous control group. The encodings in this section 
are decoded from 32-bit on page F3-3947. 


|15 | 109 | 65 4|3 0\/1514 12/1110 8|7 65 4| 0 | 
[ 1mo | | om —fop2 Jil op | | opt | oT | 
ape EY 


Table F3-17 Encoding table for the Branches and miscellaneous control group 





Decode fields 
Decode group or instruction page 
op0 op op2 op3 op4 op5 















































0 1110 Ox 0x0 - ( MSR (register) 

0 1110 Ox 0x0 - 1 MSR (Banked register) 

i) 1110 10 0x0 000 - Hints on page F3-3980 

0 1110 10 0x0 != 000 - Change processor state on page F3-3981 

0 1110 11 0x0 - - Miscellaneous system on page F3-3981 

( 1111 00 0x0 - = BXJ 

i) 1111 01 0x0 - - Exception return on page F3-3982 

0 1111 1x 0x0 - ) MRS 

0 1111 1x 0x0 - 1 MRS (Banked register) 

1 1110 00 000 - - DCPS on page F3-3982 

1 1110 00 010 - - Unallocated. 

1 1110 01 0x0 - - Unallocated. 

1 1110 1x 0x0 - - Unallocated. 

1 1111 Ox 0x0 - - Unallocated. 

1 1111 1x 0x0 - - Exception generation on page F3-3982 

- l= 111x - 0x0 - - B - T3 variant on page F5-4118 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


Table F3-17 Encoding table for the Branches and miscellaneous control group (continued) 





Decode fields 
Decode group or instruction page 
op0 op1 op2 op3 op4 op5 











- - - 0x1 - - B - T4 variant on page F5-4118 
- - - 1x0 - - BL, BLX (immediate) - T2 variant on page F5-4136 
- - - 1x1 - - BL, BLX (immediate) - T7 variant on page F5-4135 





Hints 


This section describes the encoding of the Hints instruction class. The encodings in this section are decoded from 
Branches and miscellaneous control on page F3-3979. 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0|15141312/1110 9 8|7 4|3 0 | 





tt 01 4110 1 Offa okooko o of hint | option | 





Decode fields 




































































Instruction page Architecture version 

hint option 

0000 0000 NOP - 

0000 0001 YIELD - 

0000 0010 WFE - 

0000 0011 WFI - 

0000 0100 SEV - 

0000 0101 SEVL - 

0000 011x Reserved hint, behaves as NOP. - 

0000  1xxx Reserved hint, behaves as NOP. - 

0001 0000 ESB Armv8.2 
0001 0001 Reserved hint, behaves as NOP. - 

0001 0010 TSB CSYNC Armvs.4 
0001 0011 Reserved hint, behaves as NOP. - 

0001 0100 CSDB - 

0001 0101 Reserved hint, behaves as NOP. - 

0001 011x Reserved hint, behaves as NOP. - 

0001 = 1xxx Reserved hint, behaves as NOP. - 

olx = - Reserved hint, behaves as NOP. - 

lxx á - Reserved hint, behaves as NOP. - 

10xx Žž - Reserved hint, behaves as NOP. - 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 





Decode fields 











Instruction page Architecture version 
hint option 
110x - Reserved hint, behaves as NOP. - 
1110 - Reserved hint, behaves as NOP. - 
1111 - DBG - 





Change processor state 


This section describes the encoding of the Change processor state instruction class. The encodings in this section 
are decoded from Branches and miscellaneous control on page F3-3979. 


|15 141312/11109 8/7 6 5 4/3 2 1 0|15141312/11109 8|7 6 5 4| 0 | 





7710077107 Of t ofoololimod[ MAT [FT mode 


Decode fields 
Instruction page 














imod M 

00 1 CPS, CPSID, CPSIE - CPS variant on page F5-4162 
01 - Unallocated. 

10 - CPS, CPSID, CPSIE - CPSIE variant on page F5-4162 
11 - CPS, CPSID, CPSIE - CPSID variant on page F5-4162 





Miscellaneous system 


This section describes the encoding of the Miscellaneous system instruction class. The encodings in this section are 
decoded from Branches and miscellaneous control on page F3-3979. 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|15141312|11 10 9 8|7 4|3 0 | 


pt tootrt to taal t okoo o] ope | option | 








Decode fields 
Instruction page 
opc option 























Q00x Žž - Unallocated. 
0010 Žž - CLREX 
0011 Žž - Unallocated. 
0100  != 0x00 DSB 
0100 0000 SSBB 
0100 0100 PSSBB 
0101 Žž - DMB 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F3-3981 


Non-Confidential 
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F3.1 T32 instruction set encoding 





Decode fields 
Instruction page 
opc option 











0110 Žž - ISB 
0111 - SB 
1xxx - Unallocated. 





Exception return 


This section describes the encoding of the Exception return instruction class. The encodings in this section are 
decoded from Branches and miscellaneous control on page F3-3979. 


|15 1413 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12/1110 9 8|7 | 0 | 


TittoOotit oO Re a oo mms 


Decode fields 
Instruction page 
Rn imms 





- != 00000000 SUB, SUBS (immediate) 





1110 00000000 ERET 


DCPS 


This section describes the encoding of the DCPS instruction class. The encodings in this section are decoded from 
Branches and miscellaneous control on page F3-3979. 


|15 14 13 12\11109 8|7 6 5 4|3 0 [15 14 13 12/11 | | 210] 
11110111100 0| imm [1000] immo [opt 





Decode fields 
Instruction page 




















imm4 imm10 opt 

l= 1111 - - Unallocated. 
1111 != 0000000000 - Unallocated. 
1111 0000000000 00 Unallocated. 
1111 0000000000 01 DCPS1 

1111 0000000000 10 DCPS2 

1111 0000000000 11 DCPS3 








Exception generation 


This section describes the encoding of the Exception generation instruction class. The encodings in this section are 
decoded from Branches and miscellaneous control on page F3-3979. 
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[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 14 13 12|11 | | 0 | 


Tit totiit1 tp] mm [1 oqo] imma | 





Decode fields 
Instruction page 














o1 02 

0 0 HVC 

0 1 Unallocated. 
1 0 SMC 

1 1 UDF 





F3.1.17 Data-processing (plain binary immediate) 


This section describes the encoding of the Data-processing (plain binary immediate) group. The encodings in this 
section are decoded from 32-bit on page F3-3947. 


15 | 109 8|7 6 54|3 0 |1514 | | | 0 | 
[amo |i] | foot fof OP 
ae 


Table F3-18 Encoding table for the Data-processing (plain binary immediate) group 





Decode fields 
Decode group or instruction page 














op0 op1 

0 Ox Data-processing (simple immediate) 

0 10 Move Wide (16-bit immediate) on page F3-3984 
0 11 Unallocated. 

1 - Saturate, Bitfield on page F3-3984 





Data-processing (simple immediate) 


This section describes the encoding of the Data-processing (simple immediate) instruction class. The encodings in 
this section are decoded from Data-processing (plain binary immediate). 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F3-3983 
ID070919 Non-Confidential 


T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 


[15 14 1312/1110 9 8|7 6 5 4/3 0/1514 12\11 8|7 | 0 | 


771 Ofi[t opopo] Rn Jo) mma | Ra | me | 





Decode fields 
Instruction page 





























o1 o2 Rn 

0 ) l= 11x1 ADD, ADDS (immediate) 

(2 ( 1101 ADD, ADDS (SP plus immediate) 
0 0 1111 ADR - T3 on page F5-4098 

) dl - Unallocated. 

1 Q - Unallocated. 

1 1 l= 11x1 SUB, SUBS (immediate) 

1 1 1101 SUB, SUBS (SP minus immediate) 
1 1 1111 ADR - T2 on page F5-4097 





Move Wide (16-bit immediate) 


This section describes the encoding of the Move Wide (16-bit immediate) instruction class. The encodings in this 
section are decoded from Data-processing (plain binary immediate) on page F3-3983. 


|15 14 1312/1110 9 8|7 6 5 4|3 0/1514 12\11 8|7 | 0 | 


[11.14 ofits ofot}1 o of imma fof imma | Ra | imma | 





Decode fields 
Instruction page 








01 
() MOV, MOVS (immediate) 
1 MOVT 





Saturate, Bitfield 


This section describes the encoding of the Saturate, Bitfield instruction class. The encodings in this section are 
decoded from Data-processing (plain binary immediate) on page F3-3983. 
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[15 14 13 1211110 9 8|7 5 4|3 0/1514 12\11 8/7 6 5 4| 0 | 





741 oft a] opt [oy Rn [0] mma | Ra [imma oy _wiethmt 





Decode fields 
Instruction page 












































opi Rn imm3:imm2 
000 - - SSAT - Logical shift left variant on page F5-4559 
001 - != 00000 SSAT - Arithmetic shift right variant on page F5-4559 
001 - 00000 SSAT16 
010 - - SBFX 
011 l= 1111 - BFI 
011 1111 = BFC 
100 - - USAT - Logical shift left variant on page F5-4749 
101 - != 00000 USAT - Arithmetic shift right variant on page F5-4749 
101 - 00000 USAT16 
110 - - UBFX 
111 - - Unallocated. 
F3.1.18 Advanced SIMD element or structure load/store 


ARM DDI 0487E.a 
ID070919 


This section describes the encoding of the Advanced SIMD element or structure load/store group. The encodings in 
this section are decoded from 32-bit on page F3-3947. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the T32 Advanced SIMD and floating-point instructions and their encoding on 
page F3-4003 


[15 | 7 6 5 4|3 0 |15 12/1110 9 | | 0| 


[mon EO o PO 
op0 — o ë | 


Table F3-19 Encoding table for the Advanced SIMD element or structure load/store group 





Decode fields 
Decode group or instruction page 














op0 op1 

0 - Advanced SIMD load/store multiple structures on page F3-3986 

1 11 Advanced SIMD load single structure to all lanes on page F3-3986 

1 t= 11 Advanced SIMD load/store single structure to one lane on page F3-3987 
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Advanced SIMD load/store multiple structures 


This section describes the encoding of the Advanced SIMD load/store multiple structures instruction class. The 
encodings in this section are decoded from Advanced SIMD element or structure load/store on page F3-3985. 


[15 141312/11109 8|7 6 5 4|3 


Tii77007 0[p[tfo] Ra | va | type [swe Jalen] Rm | 


0 |15 12\11 81/7 6 5 4|3 0 | 





Decode fields 


Instruction page 
























































L itype 

) 000x VST4 (multiple 4-element structures) 

0 0010 VST1 (multiple single elements) - T4 on page F6-5393 

Q 0011 VST2 (multiple 2-element structures) - T2 on page F6-5404 
) 010x VST3 (multiple 3-element structures) 

) 0110 VST1 (multiple single elements) - 73 on page F6-5392 

Q 0111 VST1 (multiple single elements) - T7 on page F6-5391 

) 100x VST2 (multiple 2-element structures) - T7 on page F6-5403 
Q 1010 VST1 (multiple single elements) - T2 on page F6-5391 

1 000x VLD4 (multiple 4-element structures) 

1 0010 VLD1 (multiple single elements) - T4 on page F6-5030 

1 0011 VLD2 (multiple 2-element structures) - T2 on page F6-5044 
1 010x VLD3 (multiple 3-element structures) 

- 1011 Unallocated. 

1 0110 VLD1 (multiple single elements) - T3 on page F6-5029 

1 0111 VLD1 (multiple single elements) - 77 on page F6-5028 

- 11xx Unallocated. 

1 100x VLD2 (multiple 2-element structures) - T7 on page F6-5043 
1 1010 VLD1 (multiple single elements) - 72 on page F6-5028 





Advanced SIMD load single structure to all lanes 


This section describes the encoding of the Advanced SIMD load single structure to all lanes instruction class. The 
encodings in this section are decoded from Advanced SIMD element or structure load/store on page F3-3985. 
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[15 141312/11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





1111001 tfoftjof Rn | va fi 1] N |size}Tfa} Rm | 





Decode fields 
Instruction page 











L N a 

0 - - Unallocated. 

1 00 - VLD! (single element to all lanes) 

1 01 - VLD2 (single 2-element structure to all lanes) 





1 10 ) VLD3 (single 3-element structure to all lanes) 





1 10 1 Unallocated. 





1 11 - VLD4 (single 4-element structure to all lanes) 





Advanced SIMD load/store single structure to one lane 


This section describes the encoding of the Advanced SIMD load/store single structure to one lane instruction class. 
The encodings in this section are decoded from Advanced SIMD element or structure load/store on page F3-3985. 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 4|3 0 | 





77717007 pijo] Rn | va [=i] N index align] Rm 


size 





Decode fields 


Instruction page 






































L size N 
O 2 00 VSTI (single element from one lane) - TZ on page F6-5384 
0 2 01 VST2 (single 2-element structure from one lane) - T/ on page F6-5398 
O 00 10  VST3 (single 3-element structure from one lane) - TZ on page F6-5409 
O 00 11 VST4 (single 4-element structure from one lane) - TZ on page F6-5418 
O 1 00 VSTI (single element from one lane) - 72 on page F6-5385 
O 1 01 VST2 (single 2-element structure from one lane) - T2 on page F6-5399 
O 1 10 VST3 (single 3-element structure from one lane) - T2 on page F6-5410 
o 1 11  VST4 (single 4-element structure from one lane) - T2 on page F6-5419 
o 10 00 VSTI (single element from one lane) - 73 on page F6-5385 
o 10 01 VST2 (single 2-element structure from one lane) - T3 on page F6-5399 
o 10 10  VST3 (single 3-element structure from one lane) - T3 on page F6-5410 
o 10 11 VST4 (single 4-element structure from one lane) - T3 on page F6-5419 
1 0 00 VLD! (single element to one lane) - TZ on page F6-5018 
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F3.1 T32 instruction set encoding 





Decode fields 
Instruction page 
L size N 





1 0 01 VLD2 (single 2-element structure to one lane) - T/ on page F6-5035 





1 0 10  VLD3 (single 3-element structure to one lane) - 77 on page F6-5049 





1 0 11 VLD4 (single 4-element structure to one lane) - TZ on page F6-5061 





1 @1 00 VLD! (single element to one lane) - T2 on page F6-5019 





1 @1 01 VLD2 (single 2-element structure to one lane) - T2 on page F6-5036 





1 @1 10 VLD3 (single 3-element structure to one lane) - 72 on page F6-5050 





1 @1 11 VLD4 (single 4-element structure to one lane) - 72 on page F6-5062 





1 10 00 VLD! (single element to one lane) - T3 on page F6-5019 





1 10 01 VLD2 (single 2-element structure to one lane) - T3 on page F6-5036 





1 10 10 VLD3 (single 3-element structure to one lane) - T3 on page F6-5050 








1 10 11 VLD4 (single 4-element structure to one lane) - 73 on page F6-5062 





F3.1.19 Load/store single 
This section describes the encoding of the Load/store single group. The encodings in this section are decoded from 


32-bit on page F3-3947. 


[15 | 81/7 6 5 4|3 0 |15 12\11 | 0 | 


Pe oo — 
op1 S åy 


This decode also imposes the constraint: 
: op0<1>:op1 != 10. 


Table F3-20 Encoding table for the Load/store single group 





Decode fields 
Decode group or instruction page 
op0 opi op2 op3 



































00 - = 1111 000000 Load/store, unsigned (register offset) on page F3-3989 

00 - != 1111 000001 Unallocated. 

00 - != 1111 00001x Unallocated. 

00 - != 1111 0001xx Unallocated. 

00 - l= 1111 QQ1xxx Unallocated. 

00 - != 1111 @1xxxx Unallocated. 

00 - l= 1111 10x0xx Unallocated. 

00 - != 1111 10xlxx Load/store, unsigned (immediate, post-indexed) on page F3-3990 
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Table F3-20 Encoding table for the Load/store single group (continued) 





Decode fields 


Decode group or instruction page 




































































op0 opi op2 op3 

00 - != 1111 1100xx Load/store, unsigned (negative immediate) on page F3-3990 
00 - != 1111 1110xx Load/store, unsigned (unprivileged) on page F3-3991 

00 - {= 1111 11xlxx = Load/store, unsigned (immediate, pre-indexed) on page F3-3991 
01 - l= 1111 - Load/store, unsigned (positive immediate) on page F3-3992 

Ox - 1111 - Load, unsigned (literal) on page F3-3992 

10 1 != 1111 000000 Load/store, signed (register offset) on page F3-3993 

10 1 != 1111 000001 Unallocated. 

10 1 != 1111 00001x Unallocated. 

10 1 != 1111 0001xx Unallocated. 

10 1 != 1111 QQ1xxx Unallocated. 

10 1 != 1111 @1xxxx Unallocated. 

10 1 != 1111  10x@xx Unallocated. 

10 1 != 1111 10xlxx Load/store, signed (immediate, post-indexed) on page F3-3993 
10 1 != 1111 1100xx Load/store, signed (negative immediate) on page F3-3994 

10 1 != 1111 1110xx Load/store, signed (unprivileged) on page F3-3994 

10 1 != 1111 11xlxx Load/store, signed (immediate, pre-indexed) on page F3-3995 
11 1 l= 1111 - Load/store, signed (positive immediate) on page F3-3995 

1x 1 1111 - Load, signed (literal) on page F3-3996 








Load/store, unsigned (register offset) 


This section describes the encoding of the Load/store, unsigned (register offset) instruction class. The encodings in 
this section are decoded from Load/store single on page F3-3988. 


[15 14 1312/1110 9 8|7 6 5 4|3 





0 |15 


Rn 


12/1110 9 8|7 6 5 4/3 0 | 





Decode fields 


Instruction page 














size L Rt 
00 o - STRB (register) 
00 1 !=1111 LDRB (register) 
00 1 1111 PLD, PLDW (register) - Preload read variant on page F5-4404 
01 0 - STRH (register) 
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F3.1 T32 instruction set encoding 


F3-3990 





Decode fields 


Instruction page 

















size L Rt 

01 1  != 1111 LDRH (register) 

01 1 1111 PLD, PLDW (register) - Preload write variant on page F5-4404 
10 0 - STR (register) 

10 1 - LDR (register) 

11 - - Unallocated. 





Load/store, unsigned (immediate, post-indexed) 


This section describes the encoding of the Load/store, unsigned (immediate, post-indexed) instruction class. The 
encodings in this section are decoded from Load/store single on page F3-3988. 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 





Load/store, unsigned (negative immediate) 


12/1110 9 8|7 


Rn 


o | 








Decode fields 


Instruction page 




















size L 

00 ) STRB (immediate) 
00 1 LDRB (immediate) 
01 ) STRH (immediate) 
01 1 LDRH (immediate) 
10 ) STR (immediate) 
10 1 LDR (immediate) 
11 - Unallocated. 





This section describes the encoding of the Load/store, unsigned (negative immediate) instruction class. The 
encodings in this section are decoded from Load/store single on page F3-3988. 
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[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 12\1110 9 8|7 | 0 | 


TT1171000 0feefi] =m | R ioo) mwe | 
Rn 





Decode fields 
Instruction page 





























size L Rt 

00 o - STRB (immediate) 

00 1 !=1111 LDRB (immediate) 

00 1 1111 PLD, PLDW (immediate) - Preload read variant on page F5-4401 
01 0 - STRH (immediate) 

01 1 !=1111 LDRH (immediate) 

01 1 1111 PLD, PLDW (immediate) - Preload write variant on page F5-4401 
10 o - STR (immediate) 

10 1 - LDR (immediate) 

14 - - Unallocated. 





Load/store, unsigned (unprivileged) 
This section describes the encoding of the Load/store, unsigned (unprivileged) instruction class. The encodings in 


this section are decoded from Load/store single on page F3-3988. 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


Rn 








Decode fields 
Instruction page 


























size L 

00 0 STRBT 

00 1 LDRBT 

01 ( STRHT 

01 1 LDRHT 

10 ( STRT 

10 1 LDRT 

11 - Unallocated. 





Load/store, unsigned (immediate, pre-indexed) 


This section describes the encoding of the Load/store, unsigned (immediate, pre-indexed) instruction class. The 
encodings in this section are decoded from Load/store single on page F3-3988. 
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[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 12\1110 9 8|7 | 0 | 


Rn 








Decode fields 
Instruction page 























size L 

00 ) STRB (immediate) 
00 1 LDRB (immediate) 
01 Q STRH (immediate) 
Q1 1 LDRH (immediate) 
10 ) STR (immediate) 
10 1 LDR (immediate) 
11 - Unallocated. 


Load/store, unsigned (positive immediate) 


This section describes the encoding of the Load/store, unsigned (positive immediate) instruction class. The 
encodings in this section are decoded from Load/store single on page F3-3988. 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12\11 | | 0 | 


Rn 





Decode fields 
Instruction page 


























size L Rt 

00 o - STRB (immediate) 

00 1 !=1111 LDRB (immediate) 

00 1 1111 PLD, PLDW (immediate) - Preload read variant on page F5-4400 
01 o - STRH (immediate) 

01 1 !=1111 LDRH (immediate) 

01 1 1111 PLD, PLDW (immediate) - Preload write variant on page F5-4400 
10 0 - STR (immediate) 

10 1 - LDR (immediate) 





Load, unsigned (literal) 


This section describes the encoding of the Load, unsigned (literal) instruction class. The encodings in this section 
are decoded from Load/store single on page F3-3988. 
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| o | 


Tiitio00vjmel[iiii] R | mmm E 


Load/store, signed (register offset) 





Decode fields 


Instruction page 

















size L Rt 

Ox 1 1111 PLD (literal) 
00 1  != 1111  LDRB (literal) 
01 1  !=1111 LDRH (literal) 
10 1 - LDR (literal) 
11 - - Unallocated. 





This section describes the encoding of the Load/store, signed (register offset) instruction class. The encodings in 


this section are decoded from Load/store single on page F3-3988. 


[15 141312/11109 8|7 6 5 4/3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





Rn 








Decode fields 


Instruction page 

















size Rt 

00 != 1111 LDRSB (register) 

00 1111 PLI (register) 

01 != 1111 LDRSH (register) 

01 1111 Reserved hint, behaves as NOP. 
1x - Unallocated. 





Load/store, signed (immediate, post-indexed) 


This section describes the encoding of the Load/store, signed (immediate, post-indexed) instruction class. The 


encodings in this section are decoded from Load/store single on page F3-3988. 
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[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 12\1110 9 8|7 | 0 | 


Rn 








Decode fields 
Instruction page 











size 

00 LDRSB (immediate) 
01 LDRSH (immediate) 
1x Unallocated. 





Load/store, signed (negative immediate) 
This section describes the encoding of the Load/store, signed (negative immediate) instruction class. The encodings 


in this section are decoded from Load/store single on page F3-3988. 


[15 141312/11109 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0 | 


111770017 Ofsze|1] mn | Rt [1100] imme | 
Rn 





Decode fields 
Instruction page 

















size Rt 

00 != 1111 LDRSB (immediate) 

00 1111 PLI (immediate, literal) 

01 != 1111 LDRSH (immediate) 

01 1111 Reserved hint, behaves as NOP. 
1x - Unallocated. 





Load/store, signed (unprivileged) 


This section describes the encoding of the Load/store, signed (unprivileged) instruction class. The encodings in this 
section are decoded from Load/store single on page F3-3988. 
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[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 12\1110 9 8|7 | 0 | 


Rn 








Decode fields 
Instruction page 











size 

00 LDRSBT 

01 LDRSHT 

1x Unallocated. 





Load/store, signed (immediate, pre-indexed) 
This section describes the encoding of the Load/store, signed (immediate, pre-indexed) instruction class. The 


encodings in this section are decoded from Load/store single on page F3-3988. 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0 | 


Rn 








Decode fields 
Instruction page 











size 

00 LDRSB (immediate) 
01 LDRSH (immediate) 
1x Unallocated. 


Load/store, signed (positive immediate) 
This section describes the encoding of the Load/store, signed (positive immediate) instruction class. The encodings 


in this section are decoded from Load/store single on page F3-3988. 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/11 | | 0 | 


Titt1001 tool] =m | R | m ë] 
Rn 





Decode fields 
Instruction page 

















size Rt 

00 != 1111 LDRSB (immediate) 

00 1111 PLI (immediate, literal) 

01 != 1111 LDRSH (immediate) 

01 1111 Reserved hint, behaves as NOP. 
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Load, signed (literal) 


This section describes the encoding of the Load, signed (literal) instruction class. The encodings in this section are 


decoded from Load/store single on page F3-3988. 


[15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12\11 


Tiiti00iUjmeliii7i] R | mmm i 


| o | 





Decode fields 


Instruction page 





LDRSSB (literal) 





PLI (immediate, literal) 





LDRSH (literal) 





Reserved hint, behaves as NOP. 





size Rt 

00 l= 1111 
00 1111 

01 l= 1111 
01 1111 

1x - 


Unallocated. 





F3.1.20 Data-processing (register) 


This section describes the encoding of the Data-processing (register) group. The encodings in this section are 


decoded from 32-bit on page F3-3947. 


15 | 7 6 | 0 |15 


[11 8|7 


4|3 0 | 


[aot | [nn o a opt 


op0 _ i ġ 


Table F3-21 Encoding table for the Data-processing (register) group 


Decode fields 


Decode group or instruction page 


























op0 op1 

0 0000 MOV, MOVS (register-shifted register) - Flag setting variant on page F5-4349 
0 0001 Unallocated. 

0 001x Unallocated. 

) Q1xx Unallocated. 

0 1xxx Register extends 

1 Oxxx Parallel add-subtract on page F3-3997 

1 10xx Data-processing (two source registers) on page F3-3999 

1 11xx Unallocated. 





Register extends 


This section describes the encoding of the Register extends instruction class. The encodings in this section are 


decoded from Data-processing (register). 
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[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 14 13 12|11 81/7 6 5 4|3 0 | 


Ti 777070 Ofopiful Ra [i177] Rd ooa Rm | 





Decode fields 
Instruction page 












































op1 U Rn 

00 0 !=1111 SXTAH 
00 0 1111 SXTH 

00 1 !=1111 UXTAH 
00 1 1111 UXTH 

01 0  !=1111 SXTABI6 
01 0 1111 SXTB16 
01 1 !=1111 UXTABI6 
01 1 1111 UXTB16 
10 (] != 1111 SXTAB 
10 0 1111 SXTB 

10 1 != 1111 UXTAB 
10 1 1111 UXTB 

11 - - Unallocated. 


Parallel add-subtract 
This section describes the encoding of the Parallel add-subtract instruction class. The encodings in this section are 


decoded from Data-processing (register) on page F3-3996. 


|15 14 13 12/1110 9 8|7 6 413 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


14471101701] o | Rn [11171] Rd Jojujhjs| Rm | 





Decode fields 
Instruction page 





000 o ® 6 SADD8 





000 o © 1ı QADD8 





000 o 1 ©  SHADD8 





000 (] 1 1 Unallocated. 





000 1 0 @ UADD8& 





000 1 0 1 UQADD8 
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F3-3998 





Decode fields 


Instruction page 














































































































op1 U H 

000 1 1 UHADD8 
000 1 1 Unallocated. 
001 0o ð SADD16 
ol o ð QADD16 
o1 ð 1 SHADD16 
001 O 1 Unallocated. 
0l 1 9 UADD16 
01 1 9 UQADD16 
ol 1 1 UHADD16 
001 1I- F Unallocated. 
0o 0o 9 SASX 

0o 0o 9 QASX 

00 0 1 SHASX 

010 O 1 Unallocated. 
010 1 0 UASX 

010 1 0 UQASX 

010 1 1 UHASX 

010 1 1 Unallocated. 
10 0O 9 SSUB8 

10 0O 9 QSUB8 

100 © 1 SHSUB8 
100 O 1 Unallocated. 
100 1 0 USUB8 

100 1 0 UQSUB8 
100 1 1 UHSUB8 
100 1 1 Unallocated. 
101 0 9 SSUB16 

1091 0 OO QSUB16 
101 0 1 SHSUB16 
101 O 1 Unallocated. 
101 1 9 USUB16 
101 1 9 UQSUB16 
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T32 Instruction Set Encoding 
F3.1 T32 instruction set encoding 





Decode fields 


Instruction page 



































op1 U H S 

101 1 1 ® UHSUB16 
101 1 1 1 Unallocated. 
110 0 1) Q SSAX 

10 0 © 1 QSAX 

110 (] 1 0 SHSAX 

110 O 1 1 Unallocated. 
110 1 ) Q USAX 

110 1 @ 1 + UQSAX 

110 1 1 © UHSAX 

110 1 1 1 Unallocated. 
111 - - - Unallocated. 











This section describes the encoding of the Data-processing (two source registers) instruction class. The encodings 
in this section are decoded from Data-processing (register) on page F3-3996. 


|15 14 13 12/1110 9 8|7 6 413 


0 [15 14 13 12|11 


8|7 6 5 4|3 


o | 


Toit 70707] of | Ra [i177] Rd [1 ofop2] Rm | 





Decode fields 


Instruction page 






































op1 op2 

000 00 QADD 

000 01 QDADD 

000 10 QSUB 

000 11 QDSUB 

001 00 REV 

001 01 REV16 

001 10 RBIT 

001 11 REVSH 

010 00 SEL 

010 01 Unallocated. 
010 1x Unallocated. 
011 00 CLZ 
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Decode fields 
Instruction page 



































op1 op2 

011 01 Unallocated. 

011 1x Unallocated. 

100 00 CRC32 - CRC32B variant on page F5-4166 
100 01 CRC32 - CRC32H variant on page F5-4166 
100 10 CRC32 - CRC32W variant on page F5-4166 
100 11 CONSTRAINED UNPREDICTABLE 

101 00 CRC32C - CRC32CB variant on page F5-4169 
101 01 CRC32C - CRC32CH variant on page F5-4169 
101 10 CRC32C - CRC32CW variant on page F5-4169 
101 11 CONSTRAINED UNPREDICTABLE 

11x - Unallocated. 





The behavior of the CONSTRAINED UNPREDICTABLE encodings in this table is described in CONSTRAINED 
UNPREDICTABLE behavior for A32 and T32 instruction encodings on page K1-7618. 


F3.1.21 Multiply, multiply accumulate, and absolute difference 


This section describes the encoding of the Multiply, multiply accumulate, and absolute difference group. The 
encodings in this section are decoded from 32-bit on page F3-3947. 


15 | | 6 | 0 |15 | 8|7 65 | 0 | 


maono E 0 [EE 


Table F3-22 Encoding table for the Multiply, multiply accumulate, and absolute difference group 





Decode fields 
Decode group or instruction page 











op0 

00 Multiply and absolute difference 
01 Unallocated. 

1x Unallocated. 





Multiply and absolute difference 


This section describes the encoding of the Multiply and absolute difference instruction class. The encodings in this 
section are decoded from Multiply, multiply accumulate, and absolute difference. 
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[15 14 13 1211110 9 8|7 6 43 0 |15 12\11 81/7 6 5 4|3 0 | 


Tiit70%70] of | Ra | Ra | Rd [0 0fop2] Rm | 





Decode fields 
Instruction page 











opi Ra op2 

000 != 1111 00 MLA, MLAS 
000 - 01 MLS 

000 - 1x Unallocated. 





000 1111 00 MUL, MULS 














001 l= 1111 00 SMLABB, SMLABT, SMLATB, SMLATT - SMLABB variant on page F5-4522 
001 l= 1111 @1 SMLABB, SMLABT, SMLATB, SMLATT - SMLABT variant on page F5-4522 
001 l= 1111 10 SMLABB, SMLABT, SMLATB, SMLATT - SMLATB variant on page F5-4523 
001 l= 1111 11 SMLABB, SMLABT, SMLATB, SMLATT - SMLATT variant on page F5-4523 





001 1111 00 SMULBB, SMULBT, SMULTB, SMULTT - SMULBB variant on page F5-4547 








001 1111 o1 SMULBB, SMULBT, SMULTB, SMULTT - SMULBT variant on page F5-4547 
































001 1111 10 SMULBB, SMULBT, SMULTB, SMULTT - SMULTB variant on page F5-4548 
001 1111 11 SMULBB, SMULBT, SMULTB, SMULTT - SMULTT variant on page F5-4548 
010 l= 1111 00 SMLAD, SMLADX - SMLAD variant on page F5-4524 

010 != 1111 01 SMLAD, SMLADX - SMLADX variant on page F5-4524 

010 - 1x Unallocated. 





010 1111 00 SMUAD, SMUADX - SMUAD variant on page F5-4545 





010 1111 Q1 SMUAD, SMUADX - SMUADX variant on page F5-4545 











011 '= 1111 00 SMLAWB, SMLAWT - SMLAWB variant on page F5-4533 
011 l= 1111 01 SMLAWB, SMLAWT - SMLAWT variant on page F5-4533 
011 - 1x Unallocated. 





011 1111 00 SMULWB, SMULWT - SMULWB variant on page F5-4551 




















011 1111 01 SMULWB, SMULWT - SMULWT variant on page F5-4551 
100 != 1111 00 SMLSD, SMLSDX - SMLSD variant on page F5-4535 

100 != 1111 01 SMLSD, SMLSDX - SMLSDX variant on page F5-4535 
100 - 1x Unallocated. 





100 1111 00 SMUSD, SMUSDX - SMUSD variant on page F5-4553 





100 1111 Q1 SMUSD, SMUSDX - SMUSDX variant on page F5-4553 














101 l= 1111 00 SMMLA, SMMLAR - SMMLA variant on page F5-4539 
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Decode fields 
Instruction page 


















































op1 Ra op2 
101 l= 1111 01 SMMLA, SMMLAR - SMMLAR variant on page F5-4539 
101 - 1x Unallocated. 
101 1111 00 SMMUL, SMMULR - SMMUL variant on page F5-4543 
101 1111 01 SMMUL, SMMULR - SMMULR variant on page F5-4543 
110 - 00 SMMLS, SMMLSR - SMMLS variant on page F5-4541 
110 - 01 SMMLS, SMMLSR - SMMLSR variant on page F5-4541 
110 - 1x Unallocated. 
111 l= 1111 00 USADAS 
111 - 01 Unallocated. 
111 - 1x Unallocated. 
111 1111 00 USAD8 
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F3.2 About the T32 Advanced SIMD and floating-point instructions and their 


encoding 


The Advanced SIMD and floating-point instructions are common to the T32 and A32 instruction sets. These 
instructions perform Advanced SIMD and floating-point operations on a common register file, the SIMD&FP 
register file. This means: 


. In general, the instructions that load or store registers in this file, or move data between general-purpose 
registers and this register file, are common to the Advanced SIMD and floating-point instructions. 

: There are distinct Advanced SIMD data-processing instructions and floating-point data-processing 
instructions. 


All T32 Advanced SIMD and floating-point instructions have 32-bit encodings. Different groups of these 
instructions are decoded from different points in the 32-bit T32 instruction decode structure. Table F3-23 shows 
these instruction groups, and where each group is decoded from the overall T32 decode structure: 


Table F3-23 Advanced SIMD and floating-point instructions in the T32 decode structure 





Advanced SIMD and floating-point instruction 


group 


T32 decode is from 


Advanced SIMD load/store and 64-bit move on System register access, Advanced SIMD, and floating-point on 


page F3-3972 


page F3-3953 


Floating-point data-processing on page F3-3958 System register access, Advanced SIMD, and floating-point on 


page F3-3953 


Advanced SIMD and floating-point 32-bit move on System register access, Advanced SIMD, and floating-point on 


page F3-3974 


page F3-3953 


Advanced SIMD data-processing on page F3-3962 System register access, Advanced SIMD, and floating-point on 


page F3-3953 


Advanced SIMD element or structure load/store on 32-bit on page F3-3947 


page F3-3985 
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Chapter F4 
A32 Instruction Set Encoding 


This chapter describes the encoding of the A32 instruction set. It contains the following sections: 
’ A32 instruction set encoding on page F4-4006. 
è About the A32 Advanced SIMD and floating-point instructions and their encoding on page F4-4065. 


In this chapter: 


: In the decode tables, an entry of - for a field value means the value of the field does not affect the decoding. 
: In the decode diagrams, a shaded field indicates that the bits in that field are not used in that level of decode. 
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F4.1 A32 instruction set encoding 


F4.1 


F4.1.1 


F4-4006 


A32 instruction set encoding 


The A32 instruction stream is a sequence of word-aligned words. Each A32 instruction is either a single 32-bit word 
in that stream. 


Most A32 instructions can be conditional, with a condition determined by bits[31:28] of the instruction, the cond 
field. For more information see The Condition code field in A32 instruction encodings on page F2-3910. This 
applies to all instructions except those with the cond field equal to 0b111. 


The behavior of an attempt to execute an unallocated instruction is described in UNDEFINED, UNPREDICTABLE, 
and CONSTRAINED UNPREDICTABLE instruction set space on page F2-3916. 


For more information on A32 instruction encodings see Chapter F2 About the T32 and A32 Instruction 
Descriptions. 


The A32 instruction encoding is: 


31 


28/27 2524| | | | | 5 413 0 | 


| cond | o0 Pd n 


— op1 


Table F4-1 Main encoding table for the A32 instruction set 





Decode fields 


Decode group or instruction page 























cond op0 opi 

!= 1111 00x - Data-processing and miscellaneous instructions 

!= 1111 010 - Load/Store Word, Unsigned Byte (immediate, literal) on page F4-4022 

!= 1111 011 ) Load/Store Word, Unsigned Byte (register) on page F4-4023 

!= 1111 011 1 Media instructions on page F4-4024 

- 10x - Branch, branch with link, and block data transfer on page F4-4032 

- 11x - System register access, Advanced SIMD, floating-point, and Supervisor call on page F4-4034 
1111 Oxx - Unconditional instructions on page F4-4048 





Data-processing and miscellaneous instructions 


This section describes the encoding of the Data-processing and miscellaneous instructions group. The encodings in 
this section are decoded from 432 instruction set encoding. 
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31 |27 2524| 20|19 | | 81/7 6 5 4|3 0 | 


[mm foo fT | opt fo | SS 
op0 = | = op4 
op2 


Table F4-2 Encoding table for the Data-processing and miscellaneous instructions group 





Decode fields 


Decode group or instruction page 





























op0 = op op2 op3 op4 

0 - 1 l=00 1 Extra load/store on page F4-4008 

0 OXxxx 1 00 1 Multiply and Accumulate 

0 1xxxx 1 00 1 Synchronization primitives and Load-Acquire/Store-Release on page F4-4011 
0 10xx0 0 - - Miscellaneous on page F4-4012 

0 10xx0 1 - Q Halfword Multiply and Accumulate on page F4-4008 

0 != 10xx0 Žž - - Q Data-processing register (immediate shift) on page F4-4015 

Q l= 10xx® 0 - 1 Data-processing register (register shift) on page F4-4017 

1 - - - - Data-processing immediate on page F4-4019 





Multiply and Accumulate 


This section describes the encoding of the Multiply and Accumulate instruction class. The encodings in this section 
are decoded from Data-processing and miscellaneous instructions on page F4-4006. 


|31 28|27 26 25 2423 21 20/19 16/15 12\11 8|7 6 5 4|3 0 | 


cond 





Decode fields 
Instruction page 


























opc S 

000 - MUL, MULS 

001 - MLA, MLAS 

010 ) UMAAL 

010 1 Unallocated. 

011 ) MLS 

011 1 Unallocated. 

100 - UMULL, UMULLS 
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Decode fields 
Instruction page 











opc S 

101 - UMLAL, UMLALS 
110 - SMULL, SMULLS 
111 - SMLAL, SMLALS 





Halfword Multiply and Accumulate 


This section describes the encoding of the Halfword Multiply and Accumulate instruction class. The encodings in 
this section are decoded from Data-processing and miscellaneous instructions on page F4-4006. 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8/7 6 5 4|3 0 | 


| 111 jooo 14 Ofopcjof Ra | Ra | Rm j|ijlmjNnjo] Rn | 


cond 


Decode fields 
Instruction page 























opp M N 

00 - - SMLABB, SMLABT, SMLATB, SMLATT 

01 (/ 0 SMLAWB, SMLAWT - SMLAWB variant on page F5-4533 
01 Q 1 SMULWB, SMULWT - SMULWB variant on page F5-4551 
01 ĮI 0 SMLAWB, SMLAWT - SMLAWT variant on page F5-4533 
01 1 1 SMULWB, SMULWT - SMULWT variant on page F5-4551 
10 - - SMLALBB, SMLALBT, SMLALTB, SMLALTT 

11 - - SMULBB, SMULBT, SMULTB, SMULTT 














F4.1.2 Extra load/store 


This section describes the encoding of the Extra load/store group. The encodings in this section are decoded from 
Data-processing and miscellaneous instructions on page F4-4006. 


31 |27 24|23 2221 | | | 8|7 6 4/3 0 | 


[sm | o0 [ | Pt oot 
op0 T _ =] 


Table F4-3 Encoding table for the Extra load/store group 





Decode fields 
Decode group or instruction page 








op0 

0 Load/Store Dual, Half, Signed Byte (register) on page F4-4009 

1 Load/Store Dual, Half, Signed Byte (immediate, literal) on page F4-4009 
F4-4008 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


Load/Store Dual, Half, Signed Byte (register) 


This section describes the encoding of the Load/Store Dual, Half, Signed Byte (register) instruction class. The 
encodings in this section are decoded from Extra load/store on page F4-4008. 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


erm [o o o[P[upo[wpet] en | Rt [olofoyol 700.7] Rm 





cond op2 





Decode fields 
Instruction page 





o 0 0 01 STRH (register) - Post-indexed variant on page F5-4645 





o 20 ) 10 LDRD (register) - Post-indexed variant on page F5-4267 





o 0 ) 11 STRD (register) - Post-indexed variant on page F5-4627 





o 0 1 01 LDRH (register) - Post-indexed variant on page F5-4284 





o 0 1 10 LDRSB (register) - Post-indexed variant on page F5-4295 





o 0 1 11 LDRSH (register) - Post-indexed variant on page F5-4306 





0 1 0 01 STRHT 





(/ 1 0 10 Unallocated. 








0 al 0 11 Unallocated. 








o 1 1 01 LDRHT 





o 1 1 10 LDRSBT 



































® 1 1 11 LDRSHT 

1 - ) 01 STRH (register) - Pre-indexed variant on page F5-4645 

1 - () 10 LDRD (register) - Pre-indexed variant on page F5-4267 
1 - ) 11 STRD (register) - Pre-indexed variant on page F5-4627 

1 - 1 01 LDRH (register) - Pre-indexed variant on page F5-4284 
1 - 1 10 LDRSB (register) - Pre-indexed variant on page F5-4295 
1 - 1 11 LDRSH (register) - Pre-indexed variant on page F5-4306 





Load/Store Dual, Half, Signed Byte (immediate, literal) 


This section describes the encoding of the Load/Store Dual, Half, Signed Byte (immediate, literal) instruction class. 
The encodings in this section are decoded from Extra load/store on page F4-4008. 
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31 28/27 26 25 24|23 22 21 20/19 


16/15 12\11 81/7 6 5 4|3 0 | 


er [o o o[Pluli [wei] Rn | Ri | mma [ajoo a| mma 


cond 


op2 





Decode fields 


Instruction page 































































































P:W 01 Rn op2 

- i) 1111 10 LDRD (literal) 

l= @1 1 1u 01 LDRH (literal) 

f= @1 1 1111 10 LDRSB (literal) 

l=@1 1 ll 11 LDRSH (literal) 

00 0 != 1111 10 LDRD (immediate) - Post-indexed variant on page F5-4261 
00 0 - 01 STRH (immediate) - Post-indexed variant on page F5-4641 
00 0 - 11 STRD (immediate) - Post-indexed variant on page F5-4623 
00 1 != 1111 01 LDRH (immediate) - Post-indexed variant on page F5-4278 
00 1 != 1111 10 LDRSB (immediate) - Post-indexed variant on page F5-4290 
00 1 f= 1111 11 LDRSH (immediate) - Post-indexed variant on page F5-4301 
01 0 != 1111 10 Unallocated. 

01 0 - 01 STRHT 

01 0 - 11 Unallocated. 

01 1 7 01 LDRHT 

01 1 - 10 LDRSBT 

01 1 - 11 LDRSHT 

10 0 != 1111 10 LDRD (immediate) - Offset variant on page F5-4261 

10 0 - 01 STRH (immediate) - Offset variant on page F5-4641 

10 0 - 11 STRD (immediate) - Offset variant on page F5-4623 

10 1 != 1111 01 LDRH (immediate) - Offset variant on page F5-4278 

10 1 l= 1111 10 LDRSB (immediate) - Offset variant on page F5-4290 

10 1 != 1111 11 LDRSH (immediate) - Offset variant on page F5-4301 

11 0 != 1111 10 LDRD (immediate) - Pre-indexed variant on page F5-4261 
11 0 - 01 STRH (immediate) - Pre-indexed variant on page F5-4641 
11 0 - 11 STRD (immediate) - Pre-indexed variant on page F5-4623 
11 1 != 1111 01 LDRH (immediate) - Pre-indexed variant on page F5-4278 
11 1 != 1111 10 LDRSB (immediate) - Pre-indexed variant on page F5-4290 
11 1 l= 1111 11 LDRSH (immediate) - Pre-indexed variant on page F5-4301 





F4-4010 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


F4.1.3 Synchronization primitives and Load-Acquire/Store-Release 


This section describes the encoding of the Synchronization primitives and Load-Acquire/Store-Release group. The 
encodings in this section are decoded from Data-processing and miscellaneous instructions on page F4-4006. 


31 |27 |23 22 | | 12/11 9 8|7 |3 0 | 


[em | 001 | [nnn] 1 [ne 1007 [En 
opO === 4 


Table F4-4 Encoding table for the Synchronization primitives and Load-Acquire/Store-Release 











group 
Decode fields 
Decode group or instruction page 
op0 
0 Unallocated. 
1 Load/Store Exclusive and Load-Acquire/Store-Release 





Load/Store Exclusive and Load-Acquire/Store-Release 


This section describes the encoding of the Load/Store Exclusive and Load-Acquire/Store-Release instruction class. 
The encodings in this section are decoded from Synchronization primitives and Load-Acquire/Store-Release. 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11109 8|7 6 5 4/3 0 | 


cond 





Decode fields 
Instruction page 
size L ex ord 


00 o 0 ) STL 





00 o 9 1 Unallocated. 





00 o 1 0 STLEX 





00 o 1 1 STREX 





00 1 @ 0 LDA 



































00 1 0 1 Unallocated. 
00 OE ) LDAEX 

00 1 1 1 LDREX 

01 o 0 - Unallocated. 
01 O 1 ) STLEXD 

01 0 1 1 STREXD 

01 1 0 - Unallocated. 
01 1 1 ( LDAEXD 

ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F4-4011 


ID070919 Non-Confidential 


A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


F4.1.4 Miscellaneous 





Decode fields 


Instruction page 





















































size L ex ord 

01 1 1 1 LDREXD 
10 o 0 0 STLB 

10 0 0 1 Unallocated. 
10 o 1 (] STLEXB 

10 @ 1 1 STREXB 

10 1 0 () LDAB 

10 1 0 1 Unallocated. 
10 1 1 (] LDAEXB 

10 1 1 1 LDREXB 

11 o 9 (] STLH 

11 0 0 1 Unallocated. 
11 @ 1 (] STLEXH 

11 @ 1 1 STREXH 

11 1 9 () LDAH 

11 1 0 1 Unallocated. 
11 1 ~i () LDAEXH 
11 1 1 1 LDREXH 








This section describes the encoding of the Miscellaneous group. The encodings in this section are decoded from 
Data-processing and miscellaneous instructions on page F4-4006. 


|31 |27 | 22 21 20/19 


8|7 6 


413 


o| 


[m11 | oo010 [ooj of opt PO 


Table F4-5 Encoding table for the Miscellaneous group 





Decode fields 


Decode group or instruction page 

















op0 op1 
00 001 Unallocated. 
00 010 Unallocated. 
00 011 Unallocated. 
00 110 Unallocated. 
01 001 BX 
F4-4012 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


Table F4-5 Encoding table for the Miscellaneous group (continued) 





Decode fields 
Decode group or instruction page 


















































op0 op1 

01 010 BXJ 

01 011 BLX (register) 

01 110 Unallocated. 

10 001 Unallocated. 

10 010 Unallocated. 

10 011 Unallocated. 

10 110 Unallocated. 

11 001 CLZ 

11 010 Unallocated. 

11 011 Unallocated. 

11 110 ERET 

- 111 Exception Generation 

- 000 Move special register (register) 
- 100 Cyclic Redundancy Check on page F4-4014 





- 101 Integer Saturating Arithmetic on page F4-4014 





Exception Generation 


This section describes the encoding of the Exception Generation instruction class. The encodings in this section are 
decoded from Miscellaneous on page F4-4012. 


|31 28|27 26 25 24|23 22 21 20|19 | | 8|7 6 5 4|3 0 | 
!=1111 [o o o 1 ofopeļo]  imm2 |o111| mm | 
cond 





Decode fields 
Instruction page 














opc 
00 HET 
01 BKPT 
10 HVC 
11 SMC 





Move special register (register) 


This section describes the encoding of the Move special register (register) instruction class. The encodings in this 
section are decoded from Miscellaneous on page F4-4012. 
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31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[eri [0007 O]ope[o| mask | Rd KOB] o o o) Rn | 


cond 





Decode fields 
Instruction page 














opc B 

x0 0 MRS 

x0 1 MRS (Banked register) 
x1 Q MSR (register) 

x1 1 MSR (Banked register) 





Cyclic Redundancy Check 


This section describes the encoding of the Cyclic Redundancy Check instruction class. The encodings in this section 
are decoded from Miscellaneous on page F4-4012. 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[erm [oo 07 0] eo] rn | Rd Oco 1 oo] Rm | 


cond 





Decode fields 
Instruction page 


























SZ Cc 

00 0 CRC32 - CRC32B variant on page F5-4165 

00 1 CRC32C - CRC32CB variant on page F5-4168 
01 0 CRC32 - CRC32H variant on page F5-4165 

01 1 CRC32C - CRC32CH variant on page F5-4168 
10 0 CRC32 - CRC32W variant on page F5-4165 

10 1 CRC32C - CRC32CW variant on page F5-4168 
11 = CONSTRAINED UNPREDICTABLE 





The behavior of the CONSTRAINED UNPREDICTABLE encodings in this table is described in CONSTRAINED 
UNPREDICTABLE behavior for A32 and T32 instruction encodings on page K1-7618. 
Integer Saturating Arithmetic 


This section describes the encoding of the Integer Saturating Arithmetic instruction class. The encodings in this 
section are decoded from Miscellaneous on page F4-4012. 
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31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


eri [0007 Ofope[o] Rn | Rd OOo 107] Rm | 


cond 





Decode fields 
Instruction page 














opc 

00 QADD 
01 QSUB 
10 QDADD 
11 QDSUB 





F4.1.5 Data-processing register (immediate shift) 


This section describes the encoding of the Data-processing register (immediate shift) group. The encodings in this 
section are decoded from Data-processing and miscellaneous instructions on page F4-4006. 


31 |27 24|23 22 21 20/19 | | | 5 4|3 0 | 


[1m | 000 [o0 of Po 
op _ S ë 


This decode also imposes the constraint: 
7 op@:opl != 100. 
Table F4-6 Encoding table for the Data-processing register (immediate shift) group 


Decode fields 
Decode group or instruction page 











op0 op1 

0x - Integer Data Processing (three register, immediate shift) 

10 1 Integer Test and Compare (two register, immediate shift) on page F4-4016 
11 - Logical Arithmetic (three register, immediate shift) on page F4-4017 


Integer Data Processing (three register, immediate shift) 


This section describes the encoding of the Integer Data Processing (three register, immediate shift) instruction class. 
The encodings in this section are decoded from Data-processing register (immediate shift). 
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A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


F4-4016 


31 28/27 26 25 24|23 21 20/19 16/15 12|11 7 6 5 4|3 0| 


Cem [oo oo| op [s| Rn | Rd | mms Joyoejo| Rm | 


cond 





Decode fields 


Instruction page 


















































opc S Rn 

000 - - AND, ANDS (register) 

001 - = EOR, EORS (register) 

010 © != 1101 SUB, SUBS (register) - SUB, rotate right with extend variant on page F5-4661 

010 o 1101 SUB, SUBS (SP minus register) - SUB, rotate right with extend variant on page F5-4670 
010 1 != 1101 SUB, SUBS (register) - SUBS, rotate right with extend variant on page F5-4661 

010 1 1101 SUB, SUBS (SP minus register) - SUBS, rotate right with extend variant on page F5-4670 
011 - - RSB, RSBS (register) 

100 o != 1101 ADD, ADDS (register) - ADD, rotate right with extend variant on page F5-4082 

100 O 1101 ADD, ADDS (SP plus register) - ADD, rotate right with extend variant on page F5-4091 
100 1 != 1101 ADD, ADDS (register) - ADDS, rotate right with extend variant on page F5-4082 

100 1 1101 ADD, ADDS (SP plus register) - ADDS, rotate right with extend variant on page F5-4091 
101 - - ADC, ADCS (register) 

110 - - SBC, SBCS (register) 

111 - - RSC, RSCS (register) 








Integer Test and Compare (two register, immediate shift) 


This section describes the encoding of the Integer Test and Compare (two register, immediate shift) instruction class. 
The encodings in this section are decoded from Data-processing register (immediate shift) on page F4-4015. 


31 28|27 26 25 24|23 22 21 20/19 16|15 14 13 12|11 7 6 5 4|3 0 | 


[111 jooo 4 Ofopc} it Rn  kokokoko]  imm5 _ [styejo] Rm | 


cond 





Decode fields 
Instruction page 














opc 
00 TST (register) 
01 TEQ (register) 
10 CMP (register) 
11 CMN (register) 
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F4.1 A32 instruction set encoding 


Logical Arithmetic (three register, immediate shift) 


This section describes the encoding of the Logical Arithmetic (three register, immediate shift) instruction class. The 
encodings in this section are decoded from Data-processing register (immediate shift) on page F4-4015. 


31 28/27 26 25 24|23 22 21 20|19 16/15 12\11 7 6 5 4|3 0 | 


[eri [oo 07 t[ope[s] Rn | Ro | mms _[stype]o] Rm | 


cond 





Decode fields 
Instruction page 














opc 
00 ORR, ORRS (register) 
01 MOV, MOVS (register) 
10 BIC, BICS (register) 

11 MVN, MVNS (register) 





F4.1.6 Data-processing register (register shift) 


This section describes the encoding of the Data-processing register (register shift) group. The encodings in this 
section are decoded from Data-processing and miscellaneous instructions on page F4-4006. 


31 |27 24|23 22 21 20/19 | | 8/7 6 5 4|3 0 | 


[m | ooo [o0 V ee © [| | 
op1 S åy 


This decode also imposes the constraint: 
$ op@:op1 != 100. 
Table F4-7 Encoding table for the Data-processing register (register shift) group 


Decode fields 
Decode group or instruction page 











op0 op1 

0x - Integer Data Processing (three register, register shift) 

10 1 Integer Test and Compare (two register, register shift) on page F4-4018 
11 - Logical Arithmetic (three register, register shift) on page F4-4018 





Integer Data Processing (three register, register shift) 


This section describes the encoding of the Integer Data Processing (three register, register shift) instruction class. 
The encodings in this section are decoded from Data-processing register (register shift). 
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F4.1 A32 instruction set encoding 


31 28|27 26 25 24|23 21 20/19 16/15 12\11 81/7 6 5 4|3 0 | 


[eri [oo 0 0] op [s| Rn | Rd | rs [O|stype]7] Rm | 


cond 





Decode fields 
Instruction page 


























opc 
000 AND, ANDS (register-shifted register) 
001 EOR, EORS (register-shifted register) 
010 SUB, SUBS (register-shifted register) 
011 RSB, RSBS (register-shifted register) 
100 ADD, ADDS (register-shifted register) 
101 ADC, ADCS (register-shifted register) 
110 SBC, SBCS (register-shifted register) 
111 RSC, RSCS (register-shifted register) 





Integer Test and Compare (two register, register shift) 


This section describes the encoding of the Integer Test and Compare (two register, register shift) instruction class. 
The encodings in this section are decoded from Data-processing register (register shift) on page F4-4017. 


31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 8|7 6 5 4|3 0 | 


[1m1 jooo 1 ojoj] Rn  kokokoko] Rs  [o]sypeeji] Rm | 


cond 





Decode fields 
Instruction page 














opc 
00 TST (register-shifted register) 
01 TEQ (register-shifted register) 
10 CMP (register-shifted register) 
11 CMN (register-shifted register) 





Logical Arithmetic (three register, register shift) 


This section describes the encoding of the Logical Arithmetic (three register, register shift) instruction class. The 
encodings in this section are decoded from Data-processing register (register shift) on page F4-4017. 
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F4.1 A32 instruction set encoding 


31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 8|7 6 5 4|3 0 | 


[eri [oo 07 t)ope[s] Rn | ro | Rs _[O]stype]7] Rm | 


cond 





Decode fields 
Instruction page 














opc 
00 ORR, ORRS (register-shifted register) 
01 MOV, MOVS (register-shifted register) 
10 BIC, BICS (register-shifted register) 

11 MVN, MVNS (register-shifted register) 





F4.1.7 Data-processing immediate 


This section describes the encoding of the Data-processing immediate group. The encodings in this section are 
decoded from Data-processing and miscellaneous instructions on page F4-4006. 


31 |27 24|23 22 21 20/19 | | | | 0 | 


[ert | o Joo [oy opt [mn MD E 


Table F4-8 Encoding table for the Data-processing immediate group 





Decode fields 
Decode group or instruction page 

















op0 op1 

Ox - Integer Data Processing (two register and immediate) 

10 00 Move Halfword (immediate) on page F4-4020 

10 10 Move Special Register and Hints (immediate) on page F4-4021 

10 x1 Integer Test and Compare (one register and immediate) on page F4-4021 
11 - Logical Arithmetic (two register and immediate) on page F4-4022 





Integer Data Processing (two register and immediate) 


This section describes the encoding of the Integer Data Processing (two register and immediate) instruction class. 
The encodings in this section are decoded from Data-processing immediate. 
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|31 28|27 26 25 24|23 21 20|19 16|15 12|11 | | 0| 
emn [0.01 0] op [S| Rn | Rd | mma —i«d| 
cond 





Decode fields 
Instruction page 



























































ope S Rn 

000 - - AND, ANDS (immediate) 

001 - - EOR, EORS (immediate) 

010 @ !=11x1 SUB, SUBS (immediate) - SUB variant on page F5-4657 

010 o 1101 SUB, SUBS (SP minus immediate) - SUB variant on page F5-4667 
010 o 1111 ADR - 42 on page F5-4097 

010 1 != 1101 SUB, SUBS (immediate) - SUBS variant on page F5-4657 

010 1 1101 SUB, SUBS (SP minus immediate) - SUBS variant on page F5-4667 
011 - - RSB, RSBS (immediate) 

100 @ !=11x1 ADD, ADDS (immediate) - ADD variant on page F5-4078 

100 o 1101 ADD, ADDS (SP plus immediate) - ADD variant on page F5-4088 
100 o 1111 ADR - A1 on page F5-4097 

100 1 != 1101 ADD, ADDS (immediate) - ADDS variant on page F5-4078 

100 1 1101 ADD, ADDS (SP plus immediate) - ADDS variant on page F5-4088 
101 - - ADC, ADCS (immediate) 

110 - - SBC, SBCS (immediate) 

111 - - RSC, RSCS (immediate) 








Move Halfword (immediate) 


This section describes the encoding of the Move Halfword (immediate) instruction class. The encodings in this 
section are decoded from Data-processing immediate on page F4-4019. 


|31 28|27 26 25 24|23 22 21 20|19 16|15 12111 | | 0| 
ent [0.011 ojoo) mm | Rd | imma  ě 
cond 





Decode fields 
Instruction page 








H 
(2 MOV, MOVS (immediate) 
1 MOVT 
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F4.1 A32 instruction set encoding 


Move Special Register and Hints (immediate) 


This section describes the encoding of the Move Special Register and Hints (immediate) instruction class. The 
encodings in this section are decoded from Data-processing immediate on page F4-4019. 


|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 | | 0| 
EAM [00171 O[R[1 0] mm (NO imma E 
cond 





Decode fields 



















































































Instruction page Architecture version 

R:imm4 imm12 

!= 00000 - MSR (immediate) - 

00000 xxxx00000000 NOP - 

00000 xxxx00000001 YIELD - 

00000 Xxxx00000010 WFE - 

00000 Xxxx00000011 WFI - 

00000 XxXxx00000100 SEV - 

00000 Xxxx00000101 SEVL - 

00000 xxxx0000011x Reserved hint, behaves as NOP. - 

00000 xxxx00001xxx Reserved hint, behaves as NOP. - 

00000 Xxxx00010000 ESB Armv8.2 
00000 xxxx00010001 Reserved hint, behaves as NOP. - 

00000 Xxxx00010010 TSB CSYNC Armv8.4 
00000 xxxx00010011 Reserved hint, behaves as NOP. - 

00000 Xxxx00010100 CSDB - 

00000 xxxx00010101 Reserved hint, behaves as NOP. - 

00000 Xxxx00011xxx Reserved hint, behaves as NOP. - 

00000 xxxx0001111x Reserved hint, behaves as NOP. - 

00000 XxxxQ@1xxxxx Reserved hint, behaves as NOP. - 

00000 XXxX@1xxxxxx Reserved hint, behaves as NOP. - 

00000 XXXxX1Oxxxxxx Reserved hint, behaves as NOP. - 

00000 xxxx110xxxxx Reserved hint, behaves as NOP. - 

00000 xxxx1110xxxx Reserved hint, behaves as NOP. - 

00000 XXxx1111xxxx DBG - 








Integer Test and Compare (one register and immediate) 


This section describes the encoding of the Integer Test and Compare (one register and immediate) instruction class. 
The encodings in this section are decoded from Data-processing immediate on page F4-4019. 
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|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 | | 0| 
EMM [0011 ojoj] Rn [OLOKOO] m E 
cond 





Decode fields 
Instruction page 














opc 
00 TST (immediate) 
01 TEQ (immediate) 
10 CMP (immediate) 
11 CMN (immediate) 





Logical Arithmetic (two register and immediate) 


This section describes the encoding of the Logical Arithmetic (two register and immediate) instruction class. The 
encodings in this section are decoded from Data-processing immediate on page F4-4019. 


|31 28|27 26 25 24|23 22 21 20|19 16|15 12/11 | | 0| 
emm [0011 tJopc[s] Rn | Rd | — mma  ě | 
cond 





Decode fields 
Instruction page 














opc 
00 ORR, ORRS (immediate) 
Q1 MOV, MOVS (immediate) 
10 BIC, BICS (immediate) 

11 MVN, MVNS (immediate) 





F4.1.8 Load/Store Word, Unsigned Byte (immediate, literal) 


This section describes the encoding of the Load/Store Word, Unsigned Byte (immediate, literal) instruction class. 
The encodings in this section are decoded from A32 instruction set encoding on page F4-4006. 
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31 


28|27 26 25 24|23 22 21 20|19 


16/15 


A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


12\11 | | 0 | 


[111 fo 1 ofPfufoa{wiof Rn | R fim 


cond 





Decode fields 


Instruction page 

































































P:W o2 o1 Rn 

I-01 0 1 11m1 LDR (literal) 

=0 1 1 du LDRB (literal) 

00 0 0 - STR (immediate) - Post-indexed variant on page F5-4604 
00 0 1 != 1111 LDR (immediate) - Post-indexed variant on page F5-4239 
00 1 0 - STRB (immediate) - Post-indexed variant on page F5-4612 
00 1 1 != 1111 LDRB (immediate) - Post-indexed variant on page F5-4249 
01 0 0 - STRT 

01 0 1 - LDRT 

01 1 0 - STRBT 

01 1 1 - LDRBT 

10 0 0 - STR (immediate) - Offset variant on page F5-4604 

10 0 1 != 1111 LDR (immediate) - Offset variant on page F5-4239 

10 1 0 - STRB (immediate) - Offset variant on page F5-4612 

10 1 1 != 1111 LDRB (immediate) - Offset variant on page F5-4249 

11 0 0 - STR (immediate) - Pre-indexed variant on page F5-4604 
11 0 1 != 1111 LDR (immediate) - Pre-indexed variant on page F5-4239 
11 1 0 - STRB (immediate) - Pre-indexed variant on page F5-4612 
11 1 1 != 1111 LDRB (immediate) - Pre-indexed variant on page F5-4249 











F4.1.9 


Load/Store Word, Unsigned Byte (register) 


This section describes the encoding of the Load/Store Word, Unsigned Byte (register) instruction class. The 
encodings in this section are decoded from 432 instruction set encoding on page F4-4006. 
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F4.1 A32 instruction set encoding 


31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 7 6 5 4|3 0| 


Cem [o iP lupAwe Rn | Ri | mms _[stype]o. Rm | 


cond 





Decode fields 
Instruction page 
P o2 W o 





0 0 0 ) STR (register) - Post-indexed variant on page F5-4609 





o 20 0 ik LDR (register) - Post-indexed variant on page F5-4246 





o 0 1 0 STRT 





o 0 1 L LDRT 





® 1 0 Q STRB (register) - Post-indexed variant on page F5-4616 





® 1 0 1 LDRB (register) - Post-indexed variant on page F5-4255 





o 1 1 0 STRBT 





o 1 1 1 LDRBT 














1 0 - ) STR (register) - Pre-indexed variant on page F5-4609 
1 0 - 1 LDR (register) - Pre-indexed variant on page F5-4246 
1 1 - 0 STRB (register) - Pre-indexed variant on page F5-4616 
1 1 - 1 LDRB (register) - Pre-indexed variant on page F5-4255 





F4.1.10 Media instructions 


This section describes the encoding of the Media instructions group. The encodings in this section are decoded from 
A32 instruction set encoding on page F4-4006. 


|31 |27 24| 20|19 | | 8|7 5 4|3 0 | 


Perm | on | op [| opt _[ 1 [NN 


Table F4-9 Encoding table for the Media instructions group 





Decode fields 
Decode group or instruction page 
op0 op1 





QOxxx - Parallel Arithmetic on page F4-4025 





01000 101 SEL 





01000 001 nallocated. 





01000 xx KHBT, PKHTB 








01001 xxO nallocated. 








U 
P 
01001 x01 Unallocated. 
U 
U 


0110x x01 nallocated. 
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F4.1 A32 instruction set encoding 


Table F4-9 Encoding table for the Media instructions group (continued) 





Decode fields 


Decode group or instruction page 




































































op0 op1 

0110x xxO Unallocated. 

01x10 001 Saturate 16-bit on page F4-4027 

01x10 101 Unallocated. 

01x11 x01 Reverse Bit/Byte on page F4-4028 

01x1x xx Saturate 32-bit on page F4-4028 

Q1xxx 111 Unallocated. 

Q1xxx 011 Extend and Add on page F4-4029 

10xxx - Signed multiply, Divide on page F4-4029 
11000 000 Unsigned Sum of Absolute Differences on page F4-4030 
11000 100 Unallocated. 

11001 x00 Unallocated. 

1101x x00 Unallocated. 

110xx 111 Unallocated. 

1110x 111 Unallocated. 

1110x x00 Bitfield Insert on page F4-4031 

11110 111 Unallocated. 

11111 111 Permanently UNDEFINED on page F4-403 1 
1111x x00 Unallocated. 

11x0x x10 Unallocated. 

11x1x x10 Bitfield Extract on page F4-4032 

11xxx 011 Unallocated. 

11xxx x01 Unallocated. 








Parallel Arithmetic 


This section describes the encoding of the Parallel Arithmetic instruction class. The encodings in this section are 


decoded from Media instructions on page F4-4024. 
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A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


F4-4026 


31 


28|27 26 25 24|23 22 20/19 16/15 


12/1110 9 8|7 6 5 4/3 


0| 


[ 111 fo 1100| opt | Rn | Rai kooke] op2 [1] Rm _ 


cond 
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Decode fields 


Instruction page 

























































































op1 op2 

000 - Unallocated. 
001 00 SADD16 
001 01 SASX 

001 10 SSAX 

001 11 SSUB16 

001 00 SADD8 

001 01 Unallocated. 
001 10 Unallocated. 
001 11 SSUB8 

010 00 QADD16 
010 01 QASX 

010 10 QSAX 

010 11 QSUB16 
010 00 QADD8 

010 01 Unallocated. 
010 10 Unallocated. 
010 11 QSUB8 

011 00 SHADD16 
011 01 SHASX 

011 10 SHSAX 

011 11 SHSUB16 
011 00 SHADD8 
011 01 Unallocated. 
011 10 Unallocated. 
011 11 SHSUB8 
100 - Unallocated. 
101 00 UADD16 
101 01 UASX 


ARM DDI 0487E.a 
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A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 





Decode fields 
Instruction page 





SAX 





SUB16 





ADD8 





nallocated. 





nallocated. 





SUB8 





110 o 00 QADD16 








10 0 1 QSAX 





10 0 1n QSUB16 





110 1 0 QADD8 





110 1 01 nallocated. 





110 1 10 nallocated. 





10 1 1 QSUB8 





111 o 00 HADD16 





U 
U 
U 
U 
U 
U 
U 
110 o al UQASX 
U 
U 
U 
U 
U 
U 
U 
U 


111 0 01 HASX 





111 Q 10 UHSAX 





111 0 11 HSUB16 





111 1 00 HADD8 








111 1 10 nallocated. 








U 
U 
111 1 0l Unallocated. 
U 
U 


111 1 11 HSUB8 





Saturate 16-bit 


This section describes the encoding of the Saturate 16-bit instruction class. The encodings in this section are 
decoded from Media instructions on page F4-4024. 
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F4.1 A32 instruction set encoding 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Perm [0710 1[U]1 0] satimm | Ra (foo 17] Rn 


cond 





Decode fields 
Instruction page 








U 
0 SSAT16 
1 USAT16 





Reverse Bit/Byte 


This section describes the encoding of the Reverse Bit/Byte instruction class. The encodings in this section are 
decoded from Media instructions on page F4-4024. 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 121110 9 8|7 6 5 4/3 0 | 


[m fo 4 1 0 tot afta) Ra ooo a 1] Rm | 





cond 





Decode fields 
Instruction page 














01 02 

0 Q REV 

Q 1 REV16 
1 () RBIT 

1 1 REVSH 


Saturate 32-bit 


This section describes the encoding of the Saturate 32-bit instruction class. The encodings in this section are 
decoded from Media instructions on page F4-4024. 


31 28|27 26 25 24|23 22 21 20| 16/15 12\11 |7 6 5 4|3 0 | 


Derm [0770 1U] satimm | Ro | mms fojo 7] Rn 


cond 





Decode fields 
Instruction page 











U 
0 SSAT 
1 USAT 
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A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


Extend and Add 


This section describes the encoding of the Extend and Add instruction class. The encodings in this section are 
decoded from Media instructions on page F4-4024. 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Derm [0770 1[Upo | Rn | Rd fotatcfoyofo 117] Rm 


cond 





Decode fields 
Instruction page 






































U op Rn 

Q 00 != 1111 SXTABI6 
Q 00 1111 SXTB16 
(] 10 l= 1111 SXTAB 

0 10 1111 SXTB 

0 11 l= 1111 SXTAH 

0 11 1111 SXTH 

1 00 != 1111 UXTABI16 
1 00 1111 UXTBI16 
1 10 != 1111 UXTAB 
1 10 1111 UXTB 

1 11 != 1111 UXTAH 
1 11 1111 UXTH 











Signed multiply, Divide 


This section describes the encoding of the Signed multiply, Divide instruction class. The encodings in this section 
are decoded from Media instructions on page F4-4024. 


31 28|27 26 25 24|23 22 © 20|19 16/15 12\11 8|7 5 4|3 0 | 


[erm [o777 0] opt | Rd | Ra | Rm | op [i] Rn 


cond 





Decode fields 
Instruction page 

















op1 Ra op2 

000 l= 1111 000 SMLAD, SMLADX - SMLAD variant on page F5-4524 
000 l= 1111 001 SMLAD, SMLADX - SMLADX variant on page F5-4524 
000 {= 1111 010 SMLSD, SMLSDX - SMLSD variant on page F5-4535 
000 l= 1111 011 SMLSD, SMLSDX - SMLSDX variant on page F5-4535 
000 - 1xx Unallocated. 
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F4.1 A32 instruction set encoding 





Decode fields 
Instruction page 








opi Ra op2 
000 1111 000 SMUAD, SMUADX - SMUAD variant on page F5-4545 
000 1111 001 SMUAD, SMUADX - SMUADX variant on page F5-4545 





000 1111 010 SMUSD, SMUSDX - SMUSD variant on page F5-4553 





000 1111 011 SMUSD, SMUSDX - SMUSDX variant on page F5-4553 






























































001 - 000 SDIV 

ol Žž - != 000 Unallocated. 

010 - - Unallocated. 

011 - 000 UDIV 

oll Žž - != 000 Unallocated. 

100 - 000 SMLALD, SMLALDX - SMLALD variant on page F5-4531 
100 - 001 SMLALD, SMLALDX - SMLALDX variant on page F5-4531 
100 - 010 SMLSLD, SMLSLDX - SMLSLD variant on page F5-4537 
100 - 011 SMLSLD, SMLSLDX - SMLSLDX variant on page F5-4537 
100 - 1xx Unallocated. 

101 != 1111 000 SMMLA, SMMLAR - SMMLA variant on page F5-4539 

101 != 1111 001 SMMLA, SMMLAR - SMMLAR variant on page F5-4539 
101 - 01x Unallocated. 

101. - 10x Unallocated. 

101 - 110 SMMLS, SMMLSR - SMMLS variant on page F5-4541 

101 - 111 SMMLS, SMMLSR - SMMLSR variant on page F5-4541 
101 1111 000 SMMUL, SMMULR - SMMUL variant on page F5-4543 
101 1111 001 SMMUL, SMMULR - SMMULR variant on page F5-4543 
11x - - Unallocated. 








Unsigned Sum of Absolute Differences 


This section describes the encoding of the Unsigned Sum of Absolute Differences instruction class. The encodings 
in this section are decoded from Media instructions on page F4-4024. 
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F4.1 A32 instruction set encoding 


|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 8|7 6 5 4|3 0| 
enn [o+117000| Rd | Ra | Am [O00%] Rn | 
cond 





Decode fields 
Instruction page 
Ra 





l= 1111 USADA8 





1111 USAD8 





Bitfield Insert 


This section describes the encoding of the Bitfield Insert instruction class. The encodings in this section are decoded 
from Media instructions on page F4-4024. 


|31 28|27 26 25 24|23 22 21 20| 16|15 12|11 |7 6 5 4|3 0| 
1171 [o 111110] mb | Ra | i» fo oi] Rn | 
cond 





Decode fields 
Instruction page 
Rn 





l= 1111 BFI 





1111 BFC 





Permanently UNDEFINED 


This section describes the encoding of the Permanently UNDEFINED instruction class. The encodings in this 
section are decoded from Media instructions on page F4-4024. 


|31 28|27 26 25 24|23 22 21 20|19 | | 8|7 6 5 4|3 0| 
ean oasa aa mma (1114) mm | 
cond 





Decode fields 
Instruction page 

















cond 
Oxxx Unallocated. 
10xx Unallocated. 
110x Unallocated. 
1110 UDF 
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F4.1 A32 instruction set encoding 


Bitfield Extract 


This section describes the encoding of the Bitfield Extract instruction class. The encodings in this section are 
decoded from Media instructions on page F4-4024. 


31 28|27 26 25 24|23 22 21 20| 16/15 12\11 7 6 5 4|3 0| 


Cen [o1 U] wa | R [| o o [107] a 


cond 





Decode fields 
Instruction page 








U 
0 SBFX 
1 UBFX 





F4.1.11 Branch, branch with link, and block data transfer 


This section describes the encoding of the Branch, branch with link, and block data transfer group. The encodings 
in this section are decoded from 432 instruction set encoding on page F4-4006. 


|31 28|27 25 24| | | | | | 0 | 
| cen [o] | 
op0 22 


Table F4-10 Encoding table for the Branch, branch with link, and block data transfer group 





Decode fields 
Decode group or instruction page 








cond op0 

1111 ) Exception Save/Restore 

l= 1111 ð Load/Store Multiple on page F4-4033 
- 1 Branch (immediate) on page F4-4034 





Exception Save/Restore 


This section describes the encoding of the Exception Save/Restore instruction class. The encodings in this section 
are decoded from Branch, branch with link, and block data transfer. 
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A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 | | 5 4| 0 | 


771740 opus] en | S — 





Decode fields 
Instruction page 
P U S L 





- - o @ Unallocated. 





@ 0 0 1 RFE, RFEDA, RFEDB, RFEIA, RFEIB - Decrement After variant on page F5-4450 





@ @® 1 @ _ SRS, SRSDA, SRSDB, SRSIA, SRSIB - Decrement After variant on page F5-4555 





@ 1 @ 1 RFE, RFEDA, RFEDB, RFEIA, RFEIB - Increment After variant on page F5-4450 





0O 1 1 @ SRS, SRSDA, SRSDB, SRSIA, SRSIB - Increment After variant on page F5-4555 





1 0 0 1 RFE, RFEDA, RFEDB, RFEIA, RFEIB - Decrement Before variant on page F5-4450 





1 0 1 @ SRS, SRSDA, SRSDB, SRSIA, SRSIB - Decrement Before variant on page F5-4555 





- - 1 1 Unallocated. 





1 1 0 1 RFE, RFEDA, RFEDB, RFEIA, RFEIB - Increment Before variant on page F5-4450 





1 1 1 @ SRS, SRSDA, SRSDB, SRSIA, SRSIB - Increment Before variant on page F5-4555 





Load/Store Multiple 


This section describes the encoding of the Load/Store Multiple instruction class. The encodings in this section are 
decoded from Branch, branch with link, and block data transfer on page F4-4032. 


|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | 0| 
Tem [10 ojPlujopwitl An | oser ý OE 
cond 





Decode fields 
Instruction page 
P U op L register_list 





























o 0 20 o - STMDA, STMED 

o 0 20 1 - LDMDA, LDMFA 

O 1 0 eo - STM, STMIA, STMEA 

O 1 0 1 - LDM, LDMIA, LDMFD 

- - 1 o - STM (User registers) 

1 0 20 0 - STMDB, STMFD 

1 0 20 1 - LDMDB, LDMEA 

- ž - 1 1  0XXXXXXXXXXXXXXX%X LDM (User registers) 
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A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 





Decode fields 
Instruction page 
P U op L register_list 











1 1 0 o - STMIB, STMFA 
1 1 0 1 - LDMIB, LDMED 
- - 1 1 1Xxxxxxxxxxxxxxx LDM (exception return) 





Branch (immediate) 


This section describes the encoding of the Branch (immediate) instruction class. The encodings in this section are 
decoded from Branch, branch with link, and block data transfer on page F4-4032. 


|31 28|27 26 25 24|23 | | | | | o| 


Decode fields 
Instruction page 
cond H 





l= 1111 ( B 





!= 1111 a BL, BLX (immediate) - A/ on page F5-4135 





1111 - BL, BLX (immediate) - A2 on page F5-4135 





F4.1.12 System register access, Advanced SIMD, floating-point, and Supervisor call 
This section describes the encoding of the System register access, Advanced SIMD, floating-point, and Supervisor 


call group. The encodings in this section are decoded from 432 instruction set encoding on page F4-4006. 


31 28/27 25 24|23 | | 12\11 9 8| 5 4/3 0 | 


| cond | 1 fopf et TO TS 
— op2 


Table F4-11 Encoding table for the System register access, Advanced SIMD, floating-point, and 
Supervisor call group 





Decode fields 
Decode group or instruction page 
cond op0 opt op2 

















- Ox 111 - System register load/store and 64-bit move on page F4-4037 

- 10 10x 0 Floating-point data-processing on page F4-4039 

- 10 111 1 System register 32-bit move on page F4-4035 

- 11 - - SVC 

1111 Ox 1x0 - Advanced SIMD three registers of the same length extension on page F4-4035 
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F4.1 A32 instruction set encoding 


Table F4-11 Encoding table for the System register access, Advanced SIMD, floating-point, and 
Supervisor call group (continued) 


Decode fields 
Decode group or instruction page 
cond op0 opt op2 





1111 10 1x0 - Advanced SIMD two registers and a scalar extension on page F4-4036 





l= 1111 0x 10x - Advanced SIMD load/store and 64-bit move on page F4-4044 





!= 1111 10 10x 1 Advanced SIMD and floating-point 32-bit move on page F4-4046 





System register 32-bit move 


This section describes the encoding of the System register 32-bit move instruction class. The encodings in this 
section are decoded from System register access, Advanced SIMD, floating-point, and Supervisor call on 
page F4-4034. 


|31 28|27 26 25 24|23 21 20|19 16115 12/1110 9 8|7 5 4/3 0| 
[cond [17 1 0] oe | een | Rt [117] | oe [i] cRm | 
>> 





Decode fields 
Instruction page 
cond L 


l= 1111 0 MCR 





l= 1111 1 MRC 





1111 - Unallocated. 





Advanced SIMD three registers of the same length extension 


This section describes the encoding of the Advanced SIMD three registers of the same length extension instruction 
class. The encodings in this section are decoded from System register access, Advanced SIMD, floating-point, and 
Supervisor call on page F4-4034. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12\11109 8|7 6 5 4/3 0 | 


11141 ojoro] va | va M] Jo] Nemo vm _| 


Po op4 
op3 





Decode fields 








Instruction page Architecture version 
op1 op2 op3 op4 Q U 
x1 0x i) () @ @  VCADD - 64-bit SIMD vector variant on page F6-4869 Armv8.3 
x1 Ox i) () 0 1 Unallocated. - 
x1 0x 0 a 1 ©  VCADD - 128-bit SIMD vector variant on page F6-4869 Armv8.3 
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A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 





Decode fields 


Instruction page 


Architecture version 

























































































op1 op2 op3 op4 Q U 
x1 0x 0 0 1 1 Unallocated. = 
00 0x 0 0 - - Unallocated. - 
00 0x 0 il - - Unallocated. - 
00 00 1 0 o @ Unallocated. - 
00 00 1 0 @ 1 Unallocated. - 
00 00 1 0 1 1 Unallocated. - 
00 00 1 1 @ 1 Unallocated. - 
00 00 1 1 1 1 Unallocated. - 
00 01 1 0 - - Unallocated. - 
00 01 1 1 - - Unallocated. - 
00 10 0 Q - 1 VFMAL (vector) Armvs.2 
00 10 0 1 - - Unallocated. - 
00 10 1 0 - - Unallocated. - 
00 10 1 1 © @  VSDOT (vector) - 64-bit SIMD vector variant on Armv8.2 
page F6-5348 
00 10 1 1 0 1 VUDOT (vector) - 64-bit SIMD vector variant on Armv8.2 
page F6-5457 
00 10 1 1 1 Q VSDOT (vector) - 128-bit SIMD vector variant on Armvs.2 
page F6-5348 
00 10 1 1 1 1 VUDOT (vector) - /28-bit SIMD vector variant on Armv8.2 
page F6-5457 
00 11 0 1 - - Unallocated. - 
00 11 1 0 - - Unallocated. - 
00 11 1 1 - - Unallocated. - 
01 10 i) Q - 1 VFMSL (vector) Armv8.2 
Q1 11 - - - - Unallocated. - 
- 1x 0 0 - @ VCMLA Armv8.3 
10 11 - - - - Unallocated. - 
11 11 - - - - Unallocated. - 
Advanced SIMD two registers and a scalar extension 
This section describes the encoding of the Advanced SIMD two registers and a scalar extension instruction class. 
The encodings in this section are decoded from System register access, Advanced SIMD, floating-point, and 
Supervisor call on page F4-4034. 
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A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


11411141717 0f [Dfop2] vn | va [1| fo} [Njafmjuy vm | 


| a op4 
op3 





Decode fields 


Instruction page 


Architecture version 





























opi op2 op3 op4 Q 

) - 0 0 - VCMLA (by element) - 128-bit SIMD vector ofhalf-precision Armv8.3 
floating-point variant on page F6-4909 

0 00 ) 0 - VFMAL (by scalar) Armv8.2 

) 01 0 0 - VFMSL (by scalar) Armv8.2 

) 10 1 1 () VSDOT (by element) - 64-bit SIMD vector variant on Armv8.2 
page F6-5346 

(2 10 1 1 ") VUDOT (by element) - 64-bit SIMD vector variant on Armv8.2 
page F6-5455 

) 10 1 1 1 VSDOT (by element) - /28-bit SIMD vector variant on Armv8.2 
page F6-5346 

0 10 a 1 1 VUDOT (by element) - 128-bit SIMD vector variant on Armv8.2 
page F6-5455 

1 - Q 0 - VCMLA (by element) - 128-bit SIMD vector of Armv8.3 


single-precision floating-point variant on page F6-4909 





F4.1.13 System register load/store and 64-bit move 


This section describes the encoding of the System register load/store and 64-bit move group. The encodings in this 
section are decoded from System register access, Advanced SIMD, floating-point, and Supervisor call on 
page F4-4034. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the A32 Advanced SIMD and floating-point instructions and their encoding on 
page F4-4065 


ARM DDI 0487E.a 
ID070919 


31 28|27 


24| 21 20| | 12\11 8 | 


| o | 


EEE Sl eee 


Table F4-12 Encoding table for the System register load/store and 64-bit move group 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 





Decode fields 


Decode group or instruction page 








op0 

00x0 System register 64-bit move on 
page F4-4038 

!= 00x0 System register load/store on 


page F4-4038 
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A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


System register 64-bit move 
This section describes the encoding of the System register 64-bit move instruction class. The encodings in this 


section are decoded from System register load/store and 64-bit move on page F4-4037. 


31 ae 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 4|3 0 | 
| cond [110 0 ofpfo{t] R2 | Re [171 4] | opc | CRm | 
fs = ae 





Decode fields 
Instruction page 
cond D L 





l= 1111 1 0 MCRR 





l= 1111 1 1  MRRC 





- ) - Unallocated. 





1111 1 - Unallocated. 





System register load/store 
This section describes the encoding of the System register load/store instruction class. The encodings in this section 


are decoded from System register load/store and 64-bit move on page F4-4037. 


|31 28|27 26 25 24|23 22 21 20|19 16115 12/1110 9 8|7 | 0| 
[cond [i oP] e | er [117] O m o E 
e 





Decode fields 
Instruction page 












































cond P:UW D L Rn CRd cp15 

!= 1111 != 000 0 - - != 0101 0 Unallocated. 

l= 1111 != 000 Q 1 1111 0101 Q LDC (literal) 

l= 1111 != 000 - - - - il Unallocated. 

!= 1111 != 000 1 - - 0101 0 Unallocated. 

l= 1111 0x1 o 0 - 0101 0 STC - Post-indexed variant on page F5-4571 

l= 1111 0x1 o 1 = 1111 0101 0 LDC (immediate) - Post-indexed variant on page F5-4220 

l= 1111 010 0 0 - 0101 0 STC - Unindexed variant on page F5-4571 

!= 1111 010 0 1 = 1111 0101 0 LDC (immediate) - Unindexed variant on page F5-4220 

l= 1111 1x0 o 0 - 0101 0 STC - Offset variant on page F5-4571 

l= 1111 1x0 o 1 = 1111 0101 0 LDC (immediate) - Offset variant on page F5-4220 
F4-4038 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


F4.1.14 


A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 





Decode fields 


Instruction page 











cond P:UW D L Rn CRd cp15 

l= 1111 1x1 o 0 - 0101 0 STC - Pre-indexed variant on page F5-4571 

l= 1111 1x1 O 1 !=1111 0101 0 LDC (immediate) - Pre-indexed variant on page F5-4220 
1111 != 000 - - - - - Unallocated. 





Floating-point data-processing 


ARM DDI 0487E.a 


ID070919 


This section describes the encoding of the Floating-point data-processing group. The encodings in this section are 
decoded from System register access, Advanced SIMD, floating-point, and Supervisor call on page F4-4034. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the A32 Advanced SIMD and floating-point instructions and their encoding on 
page F4-4065 


|31 28|27 |23 20|19 16/15 12411 9 8|7 6 5 4/3 0 | 
| cond | 1mo | op? | o | | t0fop2] | {| fof 
[ss 


Table F4-13 Encoding table for the Floating-point data-processing group 





Decode fields 
Decode group or instruction page 
cond op0 op1 op2 op3 























1111 Oxxx - = @ 0 Floating-point conditional select 

1111 1x00 - l=00 - Floating-point minNum/maxNum on page F4-4040 

1111 1x11 0000 !=00 1 Floating-point extraction and insertion on page F4-4040 

1111 1x11 1xxx !=00 1 Floating-point directed convert to integer on page F4-4041 

l= 1111 1x11 - - 1 Floating-point data-processing (two registers) on page F4-4041 
l= 1111 1x11 - - 0 Floating-point move immediate on page F4-4043 

l= 1111 != 1x11 - - - Floating-point data-processing (three registers) on page F4-4043 





Floating-point conditional select 


This section describes the encoding of the Floating-point conditional select instruction class. The encodings in this 
section are decoded from Floating-point data-processing. 
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F4.1 A32 instruction set encoding 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12/1110 9 8|7 6 5 4|3 0| 
111111100] e| vn | va [i 0] =00[NJo[mjo[ vm |] 
size 





Decode fields 
Instruction page 

















cc size 

00 - VSELEQ, VSELGE, VSELGT, VSELVS - VSELEQ,doubleprec variant on page F6-5350 
01 - VSELEQ, VSELGE, VSELGT, VSELVS - VSELVS,doubleprec variant on page F6-5351 

- 01 Unallocated. 

10 - VSELEQ, VSELGE, VSELGT, VSELVS - VSELGE,doubleprec variant on page F6-5350 
11 - VSELEQ, VSELGE, VSELGT, VSELVS - VSELGT. doubleprec variant on page F6-5350 





Floating-point minNum/maxNum 


This section describes the encoding of the Floating-point minNum/maxNum instruction class. The encodings in this 
section are decoded from Floating-point data-processing on page F4-4039. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12/1110 9 8|7 6 5 4|3 0| 
Ti t1141701)0)0 0] vn | va [i 0[00[Nfop[mjo[ vm | 
size 





Decode fields 
Instruction page 











size op 

- 0 VMAXNM 
01 - Unallocated. 
- 1 VMINNM 





Floating-point extraction and insertion 


This section describes the encoding of the Floating-point extraction and insertion instruction class. The encodings 
in this section are decoded from Floating-point data-processing on page F4-4039. 
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F4.1 A32 instruction set encoding 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 
Tit11470 70110000] va [i ojoj Mo] vm | 
size 





Decode fields 
Instruction page Architecture version 














size op 

01 - Unallocated. - 

10 0 VMOVX Armv8.2 
10 1 VINS Armv8.2 
11 - Unallocated. - 





Floating-point directed convert to integer 


This section describes the encoding of the Floating-point directed convert to integer instruction class. The encodings 
in this section are decoded from Floating-point data-processing on page F4-4039. 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 
Tt 411470 1)0]11 to RM] va [a ofofo Mo] vm _| 
size 





Decode fields 
Instruction page 
o1 RM size 





0 00 - VRINTA (floating-point) 





) 01 - VRINTN (floating-point) 





- - 01 Unallocated. 


























) 10 - VRINTP (floating-point) 
Q 11 - VRINTM (floating-point) 
1 00 - VCVTA (floating-point) 
1 01 - VCVTN (floating-point) 
1 10 - VCVTP (floating-point) 
1 11 - VCVTM (floating-point) 





Floating-point data-processing (two registers) 


This section describes the encoding of the Floating-point data-processing (two registers) instruction class. The 
encodings in this section are decoded from Floating-point data-processing on page F4-4039. 
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F4.1 A32 instruction set encoding 


31 


28|27 26 25 24|23 22 2120/1918 16/15 12/1110 9 8|7 6 5 4/3 0 | 





Derm [i710 1[]1 toi] ope | va [1 of swe ooi mo vm 


cond 





Decode fields 


Instruction page 


Architecture version 






















































































o1 opc2 size 03 

= - 00 - Unallocated. - 
Q 000 01 0 Unallocated. - 
i) 000 - 1 VABS - 
0 000 10 0 VMOV (register) - Single-precision scalar variant on page F6-5137 - 
0 000 11 0 VMOV (register) - Double-precision scalar variant on page F6-5137 - 
0 001 - 0 VNEG - 
0 001 - 1 VSQRT - 
Q 010 - 0 VCVTB - Half-precision to double-precision variant on page F6-4947 - 
0 010 01 - Unallocated. - 
0 010 - 1 VCVTT - Half-precision to double-precision variant on page F6-4966 - 
Q 011 - 0 VCVTB - Double-precision to half-precision variant on page F6-4947 - 
0 011 - 1 VCVTT - Double-precision to half-precision variant on page F6-4966 - 
) 100 - 0 VCMP - A1 on page F6-4912 - 
0 100 - 1 VCMPE - A/ on page F6-4916 - 
) 101 - 0 VCMP - A2 on page F6-4912 - 
0 101 - 1 VCMPE - A2 on page F6-4916 - 
0 110 - 0 VRINTR - 
Q 110 - 1 VRINTZ (floating-point) - 
Q 111 - 0 VRINTX (floating-point) - 
0 111 01 1 Unallocated. - 
Q 111 10 1 VCVT (between double-precision and single-precision) - Single-precision —- 

to double-precision variant on page F6-4922 
Q 111 11 1 VCVT (between double-precision and single-precision) - Double-precision —- 
to single-precision variant on page F6-4922 
1 000 - - VCVT (integer to floating-point, floating-point) - 
1 001 01 - Unallocated. 7 
1 001 10 - Unallocated. 7 
I 001 11 0 Unallocated. - 
1 001 11 1 VJCVT Armv8.3 
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Decode fields 




















Instruction page Architecture version 

o1 opc2. size 03 

1 01x - - VCVT (between floating-point and fixed-point, floating-point) - 
1 100 - 0 VCVTR - 
1 100 - 1 VCVT (floating-point to integer, floating-point) - 
1 101 - 0 VCVTR - 
1 101 - 1 VCVT (floating-point to integer, floating-point) - 
1 11x - - VCVT (between floating-point and fixed-point, floating-point) - 





Floating-point move immediate 


This section describes the encoding of the Floating-point move immediate instruction class. The encodings in this 
section are decoded from Floating-point data-processing on page F4-4039. 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[nn ft 1 to 1jpj1i 1| immah | vd f1 of size (oo foo] imma | 


cond 





Decode fields 














Instruction page Architecture version 
size 
00 Unallocated. - 
01 VMOV (immediate) - Half-precision scalar variant on page F6-5130 Armv8.2 
10 VMOV (immediate) - Single-precision scalar variant on page F6-5130 - 
11 VMOV (immediate) - Double-precision scalar variant on page F6-5130 — - 
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Floating-point data-processing (three registers) 


This section describes the encoding of the Floating-point data-processing (three registers) instruction class. The 
encodings in this section are decoded from Floating-point data-processing on page F4-4039. 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[m [1 1 1 ojojo] ot | vn | va fr ofsize |NJo2}mjo] vm | 


cond 





Decode fields 
Instruction page 
o0:01 size 02 














l= 111 00 - Unallocated. 
000 - () VMLA (floating-point) 
000 - 1 VMLS (floating-point) 
001 - 0 VNMLS 
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Decode fields 
Instruction page 
00:01 size 02 






































001 - 1 VNMLA 

010 - ) VMUL (floating-point) 
010 - 1 VNMUL 

011 - ) VADD (floating-point) 

011 - 1 VSUB (floating-point) 

100 - () VDIV 

101 - () VFNMS 

101 - 1 VFNMA 

110 - () VFMA 

110 - 1 VFMS 





F4.1.15 Supervisor call 


This section describes the encoding of the Supervisor call group. The encodings in this section are decoded from 
System register access, Advanced SIMD, floating-point, and Supervisor call on page F4-4034. 


131 28/27 |23 | | | | | o | 


| cond | an [S 


Table F4-14 Encoding table for the Supervisor call group 


Decode fields 
Decode group or instruction page 








cond 
1111 Unallocated. 
l= 1111 SVC 





F4.1.16 Advanced SIMD load/store and 64-bit move 


This section describes the encoding of the Advanced SIMD load/store and 64-bit move group. The encodings in this 
section are decoded from System register access, Advanced SIMD, floating-point, and Supervisor call on 
page F4-4034. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the A32 Advanced SIMD and floating-point instructions and their encoding on 
page F4-4065 
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31 |27 24| 21 20| | 1211 9 | | 0| 


Cem | 10 | op) P o E 


Table F4-15 Encoding table for the Advanced SIMD load/store and 64-bit move group 





Decode fields 
Decode group or instruction page 








op0 
00x0 Advanced SIMD and floating-point 64-bit move 
!= 00x0 Advanced SIMD and floating-point load/store 





Advanced SIMD and floating-point 64-bit move 


This section describes the encoding of the Advanced SIMD and floating-point 64-bit move instruction class. The 
encodings in this section are decoded from Advanced SIMD load/store and 64-bit move on page F4-4044. 


31 28|27 26 25 24|23 22 21 20/19 16/15 12\11109 8|7 6 5 4/3 0 | 


Ceri [i700 oplo] Re | Rt [1 0] size [opca| moa] vm | 


cond 





Decode fields 


Instruction page 
































D op. size opc2 o3 

o - - - - Unallocated. 

1 - - - ) Unallocated. 

1 - 0x 00 1 Unallocated. 

1 - - 01 - Unallocated. 

1 0 10 00 1 VMOV (between two general-purpose registers and two single-precision registers) - From 
general-purpose registers variant on page F6-5147 

1 0 11 00 1 VMOV (between two general-purpose registers and a doubleword floating-point register) - From 
general-purpose registers variant on page F6-5126 

1 - - 1x - Unallocated. 

1 1 10 00 1 VMOV (between two general-purpose registers and two single-precision registers) - To 
general-purpose registers variant on page F6-5147 

1 1 11 00 1 VMOV (between two general-purpose registers and a doubleword floating-point register) - To 


general-purpose registers variant on page F6-5126 
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Advanced SIMD and floating-point load/store 


This section describes the encoding of the Advanced SIMD and floating-point load/store instruction class. The 
encodings in this section are decoded from Advanced SIMD load/store and 64-bit move on page F4-4044. 
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|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 | o| 
Cem [p oP upm] en | va [1 o[sze] me o 
cond 
Decode fields 
Instruction page 
P U W L Rn size imm8 
o 0 1 - - - - Unallocated. 
O 1 - - - Ox - Unallocated. 
6 1 - o - 10 - VSTM, VSTMDB, VSTMIA- Increment After variant on page F6-5426 
6 1 - Qo - 11 Xxxxxxx@ VSTM, VSTMDB, VSTMIA- Increment After variant on page F6-5427 
0 1 - o - 11 XXXxXxxxl  FSTMDBX, FSTMIAX - Increment After variant on page F6-4794 
6 1 - 1 - 10 - VLDM, VLDMDB, VLDMIA- Increment After variant on page F6-5071 
® 1 - 1 - 11 XxXxxxxx@  WLDM, VLDMDB, VLDMIA - Increment After variant on page F6-5073 
0 1 - 1 - 11 XXXXXXXL FLDM*X (FLDMDBX, FLDMIAX) - Increment After variant on page F6-4791 
1 - 0 o - - - VSTR 
1 - 0 - - 00 - Unallocated. 
1 - Q 1 != 1111 - - VLDR (immediate) 
1 0 1 - - Ox - Unallocated. 
1 0 1 o - 10 - VSTM, VSTMDB, VSTMIA - Decrement Before variant on page F6-5425 
1 @ 1 o - 11 Xxxxxxx@  WSTM, VSTMDB, VSTMIA - Decrement Before variant on page F6-5426 
1 0 1 o - 11 XXxxxxxl FSTMDBX, FSTMIAX - Decrement Before variant on page F6-4794 
1 0 1 1 - 10 - VLDM, VLDMDB, VLDMIA- Decrement Before variant on page F6-5071 
1 @ 1 1 - 11 XxXXxxxx@  WLDM, VLDMDB, VLDMIA- Decrement Before variant on page F6-5072 
1 0 1 1 - 11 XXXXXXxXl  FLDM*X (FLDMDBX, FLDMIAX) - Decrement Before variant on page F6-4791 
1 - () i 1111 - - VLDR (literal) 
1 1 1 - - - - Unallocated. 
F4.1.17 Advanced SIMD and floating-point 32-bit move 
This section describes the encoding of the Advanced SIMD and floating-point 32-bit move group. The encodings 
in this section are decoded from System register access, Advanced SIMD, floating-point, and Supervisor call on 
page F4-4034. 
This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the A32 Advanced SIMD and floating-point instructions and their encoding on 
page F4-4065 
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31 |27 |23 2120| | 12\11 8/7 54] | 


Cem | 0 | p0 [ in| 7 | [| a 
SE op1 


Table F4-16 Encoding table for the Advanced SIMD and floating-point 32-bit move group 





Decode fields 
Decode group or instruction page 











op0 op1 

000 0 VMOV (between general-purpose register and single-precision) 
111 0 Floating-point move special register 

- 1 Advanced SIMD 8/16/32-bit element move/duplicate 





Floating-point move special register 


This section describes the encoding of the Floating-point move special register instruction class. The encodings in 
this section are decoded from Advanced SIMD and floating-point 32-bit move on page F4-4046. 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 





cond 





Decode fields 
Instruction page 








L 
0 VMSR 
1 VMRS 





Advanced SIMD 8/16/32-bit element move/duplicate 


This section describes the encoding of the Advanced SIMD 8/16/32-bit element move/duplicate instruction class. 
The encodings in this section are decoded from Advanced SIMD and floating-point 32-bit move on page F4-4046. 























|31 28|27 26 25 24|23 21 20/19 16115 12/1110 9 8|7 6 5 4/3 21 0| 

mim [1110 Tot 

cond 
Decode fields 

Instruction page 
opc1 L opc2 
Oxx 0 - VMOV (general-purpose register to scalar) 
- 1 - VMOV (scalar to general-purpose register) 
1xx o ex VDUP (general-purpose register) 
1xx O 1x Unallocated. 
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F4.1 A32 instruction set encoding 


F4.1.18 Unconditional instructions 


This section describes the encoding of the Unconditional instructions group. The encodings in this section are 
decoded from A32 instruction set encoding on page F4-4006. 


31 | 262524 


21 20/19 


| | | | o | 


[L mmo Joo ID 
op1 e 


Table F4-17 Encoding table for the Unconditional instructions group 





Decode fields 


Decode group or instruction page 

















op0 op1 

00 - Miscellaneous 

01 - Advanced SIMD data-processing on page F4-4049 

1x 1 Memory hints and barriers on page F4-4059 

10 0 Advanced SIMD element or structure load/store on page F4-4061 
11 0 Unallocated. 





F4.1.19 Miscellaneous 


This section describes the encoding of the Miscellaneous group. The encodings in this section are decoded from 


Unconditional instructions. 


|31 | 24| 


20|19 


| | 8|7 4|3 0 | 


mmo | œo | | op? 


Table F4-18 Encoding table for the Miscellaneous group 





Decode fields 


Decode group or instruction page Architecture version 









































op0 op1 

0XXXX - Unallocated. - 

10000 XxOx Change Process State on page F4-4049 - 

10001 1000 Unallocated. - 

10001 x100 Unallocated. - 

10001 Xx@1 Unallocated. - 

10001 0000 SETPAN Armv8.1 
1000x 0111 Unallocated. - 

10010 0111 CONSTRAINED UNPREDICTABLE = 

10011 0111 Unallocated. - 

1001x xx0x Unallocated. - 
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Table F4-18 Encoding table for the Miscellaneous group (continued) 





Decode fields 


Decode group or instruction page 


Architecture version 

















op0 op1 

100xx 0011 Unallocated. - 
100xx 0x10 Unallocated. F 
100xx 1x1x Unallocated. s 
101xx - Unallocated. - 
11xxx - Unallocated. - 











The behavior of the CONSTRAINED UNPREDICTABLE encodings in this table is described in CONSTRAINED 
UNPREDICTABLE behavior for A32 and T32 instruction encodings on page K1-7618. 


Change Process State 


This section describes the encoding of the Change Process State instruction class. The encodings in this section are 
decoded from Miscellaneous on page F4-4048. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4| 


o | 





1111000100 0 Ofimod|MfoplofoofofofofElAlt]Flo] mode | 


F4.1.20 Advanced SIMD data-processing 





Decode fields 


Instruction page 











imod M op mode 

- - 1 0XXXX SETEND 

- - 0 - CPS, CPSID, CPSIE 
- - 1 1xxxx Unallocated. 





This section describes the encoding of the Advanced SIMD data-processing group. The encodings in this section 
are decoded from Unconditional instructions on page F4-4048. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the A32 Advanced SIMD and floating-point instructions and their encoding on 


page F4-4065 
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31 | 


24|23 22 


5 413 0 | 


a 
op0 l 


Table F4-19 Encoding table for the Advanced SIMD data-processing group 


e op1 





Decode fields 


Decode group or instruction page 





Advanced SIMD three registers of the same length 





Advanced SIMD two registers, or three registers of different lengths on page F4-4052 





op0 op1 
o - 
1 ( 
1 1 


Advanced SIMD shifts and immediate generation on page F4-4057 





Advanced SIMD three registers of the same length 


This section describes the encoding of the Advanced SIMD three registers of the same length instruction class. The 
encodings in this section are decoded from Advanced SIMD data-processing on page F4-4049. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 


16/15 12\11 8|7 6 


5 4|3 0| 


1 11 00 1fulojofsize] vn | va | ope [njajmþori] vm | 





Decode fields 


Instruction page 


Architecture version 


















































U size opc 01 

( Ox 1100 1 VFMA - 
o ex 1101 ) VADD (floating-point) - 
o ex 1101 1 VMLA (floating-point) - 
o @x 1110 ( VCEQ (register) - A2 on page F6-4873 - 
o ex 1111 0 VMAX (floating-point) - 
0 Ox 1111 1 VRECPS - 
- - 0000 () VHADD - 
0 00 0001 1 VAND (register) - 
- - 0000 1 VQADD - 
- - 0001 () VRHADD - 
Oo 00 1100 (] SHA1C - 
- =- 0010 () VHSUB - 
o O01 0001 1 VBIC (register) - 
oy 0010 1 VQSUB 3 
- - 0011 0 VCGT (register) - A/ on page F6-4886 - 
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F4.1 A32 instruction set encoding 





Decode fields 














































































































Instruction page Architecture version 

U size opc Q o1 

- - 0011 Žž - 1 VCGE (register) - A/ on page F6-4879 - 
i) 01 1100 - ) SHAIP - 
() 1x 1100 - 1 VFMS 7 
O 1x 1101 - 0 VSUB (floating-point) - 
O ix 1101 - 1 VMLS (floating-point) - 
O ix 1110 - 0 Unallocated. - 
O ix 1111 - 0 VMIN (floating-point) - 
® 1x 1111 - 1 VRSQRTS - 
- - 0100 Žž - ( VSHL (register) - 
i) - 1000 - ) VADD (integer) - 
i) 10 0001 žá - 1 VORR (register) - 
o - 1000 - 1 VTST - 
- - 0100 Žž - 1 VQSHL (register) - 
o - 1001 - 0 VMLA (integer) - 
- - 0101 - 20 VRSHL = 
- - 0101 - 1 VQRSHL - 
o - 1011 - @ VQDMULH - 
o 10 1100 - 9 SHAIM - 
i) - 1011 - 1 VPADD (integer) - 
- - 0110 - 0 VMAX (integer) - 
i) 11 0001 á - 1 VORN (register) - 
- - 0110 - 1 VMIN (integer) - 
- - 0111 Žž - ) VABD (integer) - 
- =- 0111 - 1 VABA s 
o 11 1100 - 9 SHA1SU0 - 
1 ex 1101 - 0 VPADD (floating-point) - 
1 0x 1101 - 1 VMUL (floating-point) - 
1 0x 1110 - ( VCGE (register) - A2 on page F6-4879 - 
1 Ox 1110 - 1 VACGE = 
1 x 1111 0 20 VPMAX (floating-point) - 
1 Ox 1111 - 1 VMAXNM - 
1 00 ol - 1 VEOR - 

ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F4-4051 


ID070919 Non-Confidential 


A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 


F4.1.21 


F4-4052 





Decode fields 


Instruction page 


Architecture version 










































































U size opc 01 

- =- 1001 1 VMUL (integer and polynomial) - 
1 00 1100 () SHA256H - 
- - 1010 ) VPMAX (integer) - 
1 01 0001 1 VBSL - 
- = 1010 T VPMIN (integer) - 
- - 1010 - Unallocated. - 
1 @1 1100 (] SHA256H2 - 
1 1x 1101 0 VABD (floating-point) - 
1 1x 1110 ) VCGT (register) - A2 on page F6-4886 - 
I 1x 1110 1 VACGT = 
1 1x 1111 Q VPMIN (floating-point) - 
1 1x 1111 1 VMINNM - 
1 - 1000 ) VSUB (integer) - 
1 10 0001 1 VBIT - 
1 - 1000 1 VCEQ (register) - A/ on page F6-4873 - 
1 - 1001 ) VMLS (integer) - 
1 - 1011 (] VQRDMULH - 
1 1 1100 () SHA256SU1 - 
1 - 1011 1 VQRDMLAH Armv8.1 
1 11 0001 1 VBIF = 
1 - 1100 1 VQRDMLSH Armvs.1 
1 - 1111 0 Unallocated. = 





Advanced SIMD two registers, or three registers of different lengths 


This section describes the encoding of the Advanced SIMD two registers, or three registers of different lengths 
group. The encodings in this section are decoded from Advanced SIMD data-processing on page F4-4049. 
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|31 | 24|23 22 21 20/19 | 12/11109 |7 65 4/3 0 | 


[mor | Ett opt | foe TT fot 
op0 E = | E —— = op3 


Table F4-20 Encoding table for the Advanced SIMD two registers, or three registers of different 
lengths group 





Decode fields 
Decode group or instruction page 
op0 opt op2 op3 























Q 11 - - VEXT (byte elements) 

it 11 Ox - Advanced SIMD two registers misc 

1 11 10 - VTBL, VTBX 

1 11 11 - Advanced SIMD duplicate (scalar) on page F4-4055 

- l= 11 - 0 Advanced SIMD three registers of different lengths on page F4-4055 
- l=11 - 1 Advanced SIMD two registers and a scalar on page F4-4056 





Advanced SIMD two registers misc 


This section describes the encoding of the Advanced SIMD two registers misc instruction class. The encodings in 
this section are decoded from Advanced SIMD two registers, or three registers of different lengths on page F4-4052. 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12|11 10 7 6 5 4|3 0| 


11110011 1p iszen] va Jo] ope? Jomo] wm | 


Decode fields 


Instruction page 



































size opci1 opc2 Q 
= 00 0000 - — VREV64 
- 00 0001 -  VREV32 
- 00 0010 -  VREV16 
- 00 0011 - Unallocated. 
- 00 010x -  VPADDL 
- 00 0110 0  AESE 
- 00 0110 1  AESD 
- 00 0111 0 AESMC 
- 00 0111 1 — AESIMC 
- 00 1000 -  VCLS 
00 10 0000 -  VSWP 
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F4.1 A32 instruction set encoding 





Decode fields 


Instruction page 





































































































size opci1 opc2 Q 
- 00 1001 -  VCLZ 
- 00 1010 -  VCNT 
- 00 1011 - VMVN (register) 
00 10 1100 1 Unallocated. 
- 00 110x - — VPADAL 
- 00 1110 -  VQABS 
- 00 1111 - VQNEG 
- 01 x000 - VCGT (immediate #0) 
- 01 x001 - VCGE (immediate #0) 
- 01 x010 - VCEQ (immediate #0) 
- 01 x011 -  VCLE (immediate #0) 
- 01 x100 - VCLT (immediate #0) 
- 01 x110 - VABS 
= o1 x111 = VNEG 
- 01 0101 1  SHAIH 
- 10 0001 - VTRN 
- 10 0010 - VUZP 
- 10 0011 =  VZIP 
- 10 0100 @ VMOVN 
- 10 0100 1  VQMOVN, VQMOVUN - Unsigned result variant on page F6-5243 
- 10 0101 - VQMOVN, VQMOVUN - Signed result variant on page F6-5243 
- 10 0110 0 VSHLL 
- 10 0111 @  SHAISUI 
- 10 0111 1  SHA256SU0 
- 10 1000 -  VRINTN (Advanced SIMD) 
- 10 1001 - | VRINTX (Advanced SIMD) 
- 10 1010 - VRINTA (Advanced SIMD) 
- 10 1011 - VRINTZ (Advanced SIMD) 
10 10 1100 1 Unallocated. 
- 10 1100 @ VCVT (between half-precision and single-precision, Advanced SIMD) - Single-precision to 
half-precision variant on page F6-4924 
- 10 1101 - VRINTM (Advanced SIMD) 
F4-4054 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


A32 Instruction Set Encoding 
F4.1 A32 instruction set encoding 





Decode fields 
Instruction page 
size opc1 opc2 Q 



































- 10 1110 @ VCVT (between half-precision and single-precision, Advanced SIMD) - Half-precision to 
single-precision variant on page F6-4924 

- 10 1110 1 Unallocated. 

- 10 1111 - VRINTP (Advanced SIMD) 

- 11 000x - VCVTA (Advanced SIMD) 

- 11 001x - VCVTN (Advanced SIMD) 

- 11 010x - VCVTP (Advanced SIMD) 

- 11 011x - VCVTM (Advanced SIMD) 

- 11 10x0 - | VRECPE 

- 11 10x1 - VRSQRTE 

11 10 1100 1 Unallocated. 

- 11 11xx -  VCVT (between floating-point and integer, Advanced SIMD) 





Advanced SIMD duplicate (scalar) 
This section describes the encoding of the Advanced SIMD duplicate (scalar) instruction class. The encodings in 


this section are decoded from Advanced SIMD two registers, or three registers of different lengths on page F4-4052. 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1109 |7 65 4|3 0 | 


11110011 1{0]1 4] imm | va [1 1| oc jajmjo] vm | 





Decode fields 
Instruction page 














opc 
000 VDUP (scalar) 
001 Unallocated. 
01x Unallocated. 
1xx Unallocated. 





Advanced SIMD three registers of different lengths 


This section describes the encoding of the Advanced SIMD three registers of different lengths instruction class. The 
encodings in this section are decoded from Advanced SIMD two registers, or three registers of different lengths on 
page F4-4052. 
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F4-4056 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 


12\11 


81/7 6 5 4|3 0 | 


11100 1jujijojsn| vn | va | oe [njojmjo] vm | 


size 


Advanced SIMD two registers and a scalar 





Decode fields 


Instruction page 

































































U opc 

= 0000 VADDL 

- 0001 VADDW 

- 0010 VSUBL 

0 0100 VADDHN 

- 0011 VSUBW 

0 0110 VSUBHN 

0 1001 VQDMLAL 

- 0101 VABAL 

0 1011 VQDMLSL 

0 1101 VQDMULL 

- 0111 VABDL (integer) 
- 1000 VMLAL (integer) 
- 1010 VMLSL (integer) 
1 0100 VRADDHN 

1 0110 VRSUBHN 

- 11x0 VMULL (integer and polynomial) 
it 1001 Unallocated. 

1 1011 Unallocated. 

1 1101 Unallocated. 

- 1111 Unallocated. 








This section describes the encoding of the Advanced SIMD two registers and a scalar instruction class. The 
encodings in this section are decoded from Advanced SIMD two registers, or three registers of different lengths on 


page F4-4052. 
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|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 8|7 6 5 4|3 0| 
Dara oon] va | va | ope [Nimo] vm _| 
size 





Decode fields 
Instruction page Architecture version 



























































Q opc 

- 000x VMLA (by scalar) - 

) 0011 VQDMLAL - 

- 0010 VMLAL (by scalar) - 

V) 0111 VQDMLSL - 

- 010x VMLS (by scalar) - 

() 1011 VQDMULL - 

- 0110 VMLSL (by scalar) - 

- 100x VMUL (by scalar) - 

1 0011 Unallocated. - 

- 1010 VMULL (by scalar) - 

1 0111 Unallocated. - 

- 1100 VQDMULH - 

- 1101 VQRDMULH - 

1 1011 Unallocated. - 

- 1110 VQRDMLAH Armvs.1 
- 1111 VQRDMLSH Armvs.1 








F4.1.22 Advanced SIMD shifts and immediate generation 


This section describes the encoding of the Advanced SIMD shifts and immediate generation group. The encodings 
in this section are decoded from Advanced SIMD data-processing on page F4-4049. 


31 | 24/23 2221 | | | 7 6 5 4|3 0| 


[moi [A ooo )=6Lhf 


Table F4-21 Encoding table for the Advanced SIMD shifts and immediate generation group 





Decode fields 
Decode group or instruction page 
op0 





000XXXXXXXXXXXŐ Advanced SIMD one register and modified immediate on 
page F4-4058 





l= 000xxxxxxxxxxxð Advanced SIMD two registers and shift amount on page F4-4058 
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F4.1 A32 instruction set encoding 


Advanced SIMD one register and modified immediate 


This section describes the encoding of the Advanced SIMD one register and modified immediate instruction class. 
The encodings in this section are decoded from Advanced SIMD shifts and immediate generation on page F4-4057. 


|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 


12\11 


81/7 6 5 4|3 0 | 


manao onio 0 Of mms | va | omode JoJajoo i| mma 





Decode fields 


Instruction page 






































cmode op 

Oxxd 0 VMOV (immediate) - A7 on page F6-5130 
Oxxd 1 VMVN (immediate) - A7 on page F6-5176 
Oxx1 ) VORR (immediate) - A/ on page F6-5200 
Oxx1 1 VBIC (immediate) - A/ on page F6-4858 
10x0 ) VMOV (immediate) - 43 on page F6-5131 
10x0 1 VMVN (immediate) - A2 on page F6-5176 
10x1 0 VORR (immediate) - A2 on page F6-5200 
10x1 1 VBIC (immediate) - A2 on page F6-4858 
11xx ) VMOV (immediate) - 44 on page F6-5131 
110x 1 VMVN (immediate) - 43 on page F6-5177 
1110 1 VMOV (immediate) - 45 on page F6-5132 
1111 1 Unallocated. 








Advanced SIMD two registers and shift amount 


This section describes the encoding of the Advanced SIMD two registers and shift amount instruction class. The 
encodings in this section are decoded from Advanced SIMD shifts and immediate generation on page F4-4057. 


|31 30 29 28|27 26 25 24/23 2221 |1918  16|15 


12\11 


8|7 6 5 4|3 0 | 


17100 101 [Dl imma [mma [ va | ope [ioa vm 





Decode fields 
Instruction page 
U  imm3H:L imm3L opc Q 




















- = 0000 - 0000 - — VSHR 
- = 0000 - 0001 - VSRA 
- != 0000 000 1010 0 VMOVL 
- = 0000 - 0010 - VRSHR 
- != 0000 - 0011 - — VRSRA 
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Decode fields 


Instruction page 












































U imm3H:L imm3L opc 

- = 0000 - 0111 VQSHL, VQSHLU (immediate) - VOSHL, quad,signed-result variant on page F6-5267 

- != 0000 - 1001 VQSHRN, VQSHRUN - Signed result variant on page F6-5274 

- != 0000 - 1001 VQRSHRN, VQRSHRUN - Signed result variant on page F6-5262 

- != 0000 - 1010 VSHLL 

- != 0000 - 11xx VCVT (between floating-point and fixed-point, Advanced SIMD) 

Q l= 0000 - 0101 VSHL (immediate) 

0 != 0000 - 1000 VSHRN 

0 != 0000 - 1000 VRSHRN 

1 '= 0000 - 0100 VSRI 

1 != 0000 - 0101 VSLI 

1 '= 0000 - 0110 VQSHL, VQSHLU (immediate) - VOSHLU, quad, unsigned-result variant on 
page F6-5267 

1 != 0000 - 1000 VQSHRN, VQSHRUN - Unsigned result variant on page F6-5274 

1 != 0000 - 1000 VQRSHRN, VQRSHRUN - Unsigned result variant on page F6-5262 





F4.1.23 Memory hints and barriers 


ARM DDI 0487E.a 
ID070919 


This section describes the encoding of the Memory hints and barriers group. The encodings in this section are 
decoded from Unconditional instructions on page F4-4048. 


|31 | 


| 21 20|19 | | | 5 4|3 0 | 


| mma Top aTr 


La. op1 


Table F4-22 Encoding table for the Memory hints and barriers group 





Decode fields 
Decode group or instruction page 





























op0 op1 
QOxx1 - CONSTRAINED UNPREDICTABLE 
01001 = CONSTRAINED UNPREDICTABLE 
01011 - Barriers on page F4-4060 
011x1 = CONSTRAINED UNPREDICTABLE 
0xxx0ð - Preload (immediate) on page F4-4060 
1xxx0 0 Preload (register) on page F4-4061 
1xxx1 0 CONSTRAINED UNPREDICTABLE 
1xxxx 1 Unallocated. 
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F4.1 A32 instruction set encoding 


The behavior of the CONSTRAINED UNPREDICTABLE encodings in this table is described in CONSTRAINED 
UNPREDICTABLE behavior for A32 and T32 instruction encodings on page K1-7618. 
Barriers 


This section describes the encoding of the Barriers instruction class. The encodings in this section are decoded from 
Memory hints and barriers on page F4-4059. 


|31 30 29 28/27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/1110 9 8|7 4|3 0 | 








Decode fields 
Instruction page 
opcode option 
































0000 = CONSTRAINED UNPREDICTABLE 
0001 - CLREX 

001x - CONSTRAINED UNPREDICTABLE 
0100 != 0x00 DSB 

0100 0000 SSBB 

0100 0100 PSSBB 

0101 7 DMB 

0110 = ISB 

0111 z SB 

1xxx = CONSTRAINED UNPREDICTABLE 





The behavior of the CONSTRAINED UNPREDICTABLE encodings in this table is described in CONSTRAINED 
UNPREDICTABLE behavior for A32 and T32 instruction encodings on page K1-7618. 
Preload (immediate) 


This section describes the encoding of the Preload (immediate) instruction class. The encodings in this section are 
decoded from Memory hints and barriers on page F4-4059. 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 | | 0 | 


111101 ofpfujRfo 1| Rn koko ima 





Decode fields 
Instruction page 








D R Rn 
o 0 - Reserved hint, behaves as NOP. 
(1) 1 - PLI (immediate, literal) 
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Decode fields 
Instruction page 











D R Rn 

1 - 1111 PLD (literal) 

1 0 != 1111 PLD, PLDW (immediate) - Preload write variant on page F5-4400 
1 1 != 1111 PLD, PLDW (immediate) - Preload read variant on page F5-4400 





Preload (register) 
This section describes the encoding of the Preload (register) instruction class. The encodings in this section are 


decoded from Memory hints and barriers on page F4-4059. 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16|15 14 13 12|11 7 6 5 4|3 0 | 


77107 lupo n| Rn (ND _mms__[stypefoT Rm _ 


Decode fields 
Instruction page 














D 02 

(1 ( Reserved hint, behaves as NOP. 

i) 1 PLI (register) 

1 0 PLD, PLDW (register) - Preload write, rotate right with extend variant on page F5-4404 
1 1 PLD, PLDW (register) - Preload read, rotate right with extend variant on page F5-4404 





F4.1.24 Advanced SIMD element or structure load/store 


ARM DDI 0487E.a 
ID070919 


This section describes the encoding of the Advanced SIMD element or structure load/store group. The encodings in 
this section are decoded from Unconditional instructions on page F4-4048. 


This group has encodings in both the T32 and A32 instruction sets. For information about mappings between the 
encodings of this group, see About the A32 Advanced SIMD and floating-point instructions and their encoding on 
page F4-4065 


|31 | |23 22 21 20|19 | 12/1110 9 | | 0 | 


[mono |[ oP fot PO 
op0 _ ë 


Table F4-23 Encoding table for the Advanced SIMD element or structure load/store group 





Decode fields 
Decode group or instruction page 














op0 op1 

0 - Advanced SIMD load/store multiple structures on page F4-4062 

1 11 Advanced SIMD load single structure to all lanes on page F4-4062 

1 l= 11 Advanced SIMD load/store single structure to one lane on page F4-4063 
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Advanced SIMD load/store multiple structures 


This section describes the encoding of the Advanced SIMD load/store multiple structures instruction class. The 
encodings in this section are decoded from Advanced SIMD element or structure load/store on page F4-4061. 


|31 30 29 28|27 26 25 24|23 22 21 20|19 


16/15 12\11 81/7 6 5 4|3 0 | 


Ti 770100 0)0[tfo] Ra | va | type [swe Jalen] Rm | 





Decode fields 


Instruction page 





VST4 (multiple 4-element structures) 





VST1 (multiple single elements) - 44 on page F6-5390 





VST2 (multiple 2-element structures) - 42 on page F6-5403 





VST3 (multiple 3-element structures) 





VST1 (multiple single elements) - 43 on page F6-5389 





VST1 (multiple single elements) - AZ on page F6-5388 





VST2 (multiple 2-element structures) - A/ on page F6-5402 





VST1 (multiple single elements) - 42 on page F6-5388 





VLD4 (multiple 4-element structures) 





VLD1 (multiple single elements) - 44 on page F6-5027 





VLD2 (multiple 2-element structures) - 42 on page F6-5043 





VLD3 (multiple 3-element structures) 





Unallocated. 





VLD1 (multiple single elements) - 43 on page F6-5026 





VLD1 (multiple single elements) - A/ on page F6-5025 





Unallocated. 





VLD2 (multiple 2-element structures) - A7 on page F6-5042 





L itype 
i) 000x 
i) 0010 
i) 0011 
i) 010x 
0 0110 
i) 0111 
i) 100x 
Q 1010 
1 000x 
1 0010 
1 0011 
1 010x 
- 1011 
1 0110 
1 0111 
- 11xx 
1 100x 
1 1010 


VLD1 (multiple single elements) - 42 on page F6-5025 





Advanced SIMD load single structure to all lanes 


This section describes the encoding of the Advanced SIMD load single structure to all lanes instruction class. The 
encodings in this section are decoded from Advanced SIMD element or structure load/store on page F4-4061. 
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|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


11110100 1jojijo] Rn | va [1 1| N {sze]Tla] Rm | 





Decode fields 
Instruction page 











L N a 

0 - - Unallocated. 

1 00 - VLD! (single element to all lanes) 

1 01 - VLD2 (single 2-element structure to all lanes) 





1 10 ) VLD3 (single 3-element structure to all lanes) 





1 10 1 Unallocated. 





1 11 - VLD4 (single 4-element structure to all lanes) 





Advanced SIMD load/store single structure to one lane 


This section describes the encoding of the Advanced SIMD load/store single structure to one lane instruction class. 
The encodings in this section are decoded from Advanced SIMD element or structure load/store on page F4-4061. 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 4|3 0 | 


Ti 770100 7)0[tfo] Ra | va [En] N [indexation] Rm | 


size 





Decode fields 


Instruction page 






































L size N 
O 2 00 VSTI (single element from one lane) - A/ on page F6-5383 
0 2 01  VST2 (single 2-element structure from one lane) - A/ on page F6-5396 
O 00 10  VST3 (single 3-element structure from one lane) - A/ on page F6-5407 
O 00 11 VST4 (single 4-element structure from one lane) - A/ on page F6-5416 
O 1 00 VSTI (single element from one lane) - 42 on page F6-5383 
O 1 01 VST2 (single 2-element structure from one lane) - A2 on page F6-5396 
O 1 10 VST3 (single 3-element structure from one lane) - A2 on page F6-5407 
o 1 11 VST4 (single 4-element structure from one lane) - A2 on page F6-5416 
o 10 00 VSTI (single element from one lane) - 43 on page F6-5384 
o 10 01 VST2 (single 2-element structure from one lane) - 43 on page F6-5397 
o 10 10  VST3 (single 3-element structure from one lane) - 43 on page F6-5408 
o 10 11 VST4 (single 4-element structure from one lane) - 43 on page F6-5417 
1 0 00 VLD! (single element to one lane) - A/ on page F6-5017 
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F4-4064 





Decode fields 


Instruction page 



































L size N 

1 0 01 VLD2 (single 2-element structure to one lane) - AZ on page F6-5033 
1 0 10 VLD3 (single 3-element structure to one lane) - A/ on page F6-5047 
1 0 11 VLD4 (single 4-element structure to one lane) - A/ on page F6-5059 
1 @1 00 VLD! (single element to one lane) - 42 on page F6-5017 

1 0l 01 VLD2 (single 2-element structure to one lane) - A2 on page F6-5033 
1 @1 10 VLD3 (single 3-element structure to one lane) - A2 on page F6-5047 
1 0l 11 VLD4 (single 4-element structure to one lane) - A2 on page F6-5059 
1 1 00 + VLD1 (single element to one lane) - 43 on page F6-5018 

1 10 01 VLD2 (single 2-element structure to one lane) - 43 on page F6-5034 
1 10 10 VLD3 (single 3-element structure to one lane) - A3 on page F6-5048 
1 10 11 VLD4 (single 4-element structure to one lane) - 43 on page F6-5060 
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F4.2 About the A32 Advanced SIMD and floating-point instructions and their encoding 


F4.2 About the A32 Advanced SIMD and floating-point instructions and their 


encoding 


The Advanced SIMD and floating-point instructions are common to the T32 and A32 instruction sets. These 
instructions perform Advanced SIMD and floating-point operations on a common register file, the SIMD&FP 
register file. This means: 


. In general, the instructions that load or store registers in this file, or move data between general-purpose 
registers and this register file, are common to the Advanced SIMD and floating-point instructions. 

: There are distinct Advanced SIMD data-processing instructions and floating-point data-processing 
instructions. 


All A32 Advanced SIMD and floating-point instructions have 32-bit encodings. Different groups of these 
instructions are decoded from different points in the 32-bit A32 instruction decode structure. Table F4-24 shows 
these instruction groups, and where each group is decoded from the overall A32 decode structure: 


Table F4-24 Advanced SIMD and floating-point instructions in the A32 decode structure 





Advanced SIMD and floating-point instruction group A32 decode is from 


Advanced SIMD load/store and 64-bit move on page F4-4044 System register access, Advanced SIMD, floating-point, and 


Supervisor call on page F4-4034 


Floating-point data-processing on page F4-4039 System register access, Advanced SIMD, floating-point, and 
Supervisor call on page F4-4034 

Advanced SIMD and floating-point 32-bit move on System register access, Advanced SIMD, floating-point, and 

page F4-4046 Supervisor call on page F4-4034 

Advanced SIMD data-processing on page F4-4049 Unconditional instructions on page F4-4048 

Advanced SIMD element or structure load/store on Unconditional instructions on page F4-4048 


page F4-4061 
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Chapter F5 
T32 and A32 Base Instruction Set Instruction 
Descriptions 


This chapter describes each instruction. It contains the following sections: 
. Alphabetical list of T32 and A32 base instruction set instructions on page F5-4068. 


. Encoding and use of banked register transfer instructions on page F5-4777. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


This section lists every instruction in the T32 and A32 base instruction sets. For details of the format used see 
Format of instruction descriptions on page F2-3904. 


This section is formatted so that each instruction description starts on a new page. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.1 ADC, ADCS (immediate) 


Add with Carry (immediate) adds an immediate value and the Carry flag value to a register value, and writes the 
result to the destination register. 


If the destination register is not the PC, the ADCS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


s The ADC variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

è The ADCS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

31 28|27 26 25 24|23 22 21 20|19 1615 1211 | | 0 | 
1111 |o o 1 oļ4 o afjs| Rn | Ra [| immi2_—  žăě | 
cond 

ADC variant 


Applies when S == 0. 


ADC{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


ADCS variant 
Applies when S = 1. 


ADCS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = A32ExpandImm(imm12) ; 
T1 


[15 14 13 121110 9 8|7 6 5 4|3 01514 12\11 8|7 | 0| 


11 1 1o0ļifofa o 1 ofjs| Rn [o| imm3| Ra | imma | 


ADC variant 

Applies when S == 0. 

ADC{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
ADCS variant 


Applies when S = 1. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4070 


ADCS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = T32ExpandImm(i:imm3: imm8) ; 
if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 
° For the ADC variant, the instruction is a branch to the address calculated by the operation. 


This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


s For the ADCS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 


<Rn> For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 


For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 


<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(R[n], imm32, PSTATE.C); 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.2 ADC, ADCS (register) 


Add with Carry (register) adds a register value, the Carry flag value, and an optionally-shifted register value, and 


writes the result to the destination register. 


If the destination register is not the PC, the ADCS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 


deprecates any use of these encodings. However, when the destination register is the PC: 


s The ADC variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The ADCS variant of the instruction performs an exception return without the use of the stack. In this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 


7 6 5 4|3 


o | 


| fit jo oo of1 o 1js| Rn | Ra | immS__|stypefo] Rm | 


cond 


ADC, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


ADC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ADC, shift or rotate by value variant 


Applies when S == @ && !(imm5 == 00000 && stype == 11). 


ADC{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


ADCS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


ADCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ADCS, shift or rotate by value variant 


Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


ADCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
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T1 


|15 14 13 121110 9 8|7 65 |32 o0] 


T1 variant 


ADC<c>{<q>} {<Rdn>,} <Rdn>, <Rm> // Inside IT block 
ADCS{<q>} {<Rdn>,} <Rdn>, <Rm> // Outside IT block 


Decode for this encoding 
d = UInt(Rdn); n = UInt(Rdn); m = UInt(Rm); setflags = !InITBlock(); 
(shift t, shift n) = (SRType_LSL, 0); 


T2 


[15 14 13 121110 9 8|7 6 5 4|3 01514  12|11 8|7 6 5 4|3 0| 


111010110 ofs} Rn [of imm3 | Ra _ |imm2|stye| Rm | 


ADC, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


ADC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ADC, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


ADC<c>.W {<Rd>,} <Rn>, <Rm> // Inside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
ADC{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


ADCS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && imm2 == 00 && stype == 11. 


ADCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ADCS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11). 


ADCS.W {<Rd>,} <Rn>, <Rm> // Outside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
ADCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 
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F5-4074 


Assembler symbols 


<C> 


<q> 


<Rdn> 


<Rd> 


<Rn> 


<Rm> 


<shift> 


<amount> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the first general-purpose source register and the destination register, encoded in the "Rdn" field. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 


° For the ADC variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


. For the ADCS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T2: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 

For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used, but this is deprecated. 

For encoding T2: is the first general-purpose source register, encoded in the "Rn" field. 

For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 

For encoding T1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 


Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 


LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "Iimm3:imm2" field as <amount> modulo 32. 


In T32 assembly: 


. Outside an IT block, if ADCS <Rd>, <Rn>, <Rd> has <Rd> and <Rn> both in the range RO-R7, it is assembled 
using encoding T1 as though ADCS <Rd>, <Rn> had been written. 


. Inside an IT block, if ADC<c> <Rd>, <Rn>, <Rd> has <Rd> and <Rn> both in the range RO-R7, it is assembled 
using encoding T1 as though ADC<c> <Rd>, <Rn> had been written. 


To prevent either of these happening, use the .W qualifier. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], shifted, PSTATE.C); 
if d == 15 then // Can only occur for A32 encoding 


if setflags then 
ALUExceptionReturn(result) ; 


ALUWritePC(result) ; 
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else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


s The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


` The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.3 ADC, ADCS (register-shifted register) 


Add with Carry (register-shifted register) adds a register value, the Carry flag value, and a register-shifted register 
value. It writes the result to the destination register, and can optionally update the condition flags based on the result. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 8|7 6 5 4|3 0 | 
[_!=1111 [o o o o]1 o 1js| Rn | Rd | Rs ([O|stype[1] Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


ADCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


ADC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype); 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 
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Operation 


if ConditionPassed() then 


EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], shifted, PSTATE.C); 
R[d] = result; 
if setflags then 

PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F5.1.4 


F5-4078 


ADD, ADDS (immediate) 


Add (immediate) adds an immediate value to a register value, and writes the result to the destination register. 


If the destination register is not the PC, the ADDS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. If the 


destination register is the PC: 


è The ADD variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


7 The ADDS variant of the instruction performs an exception return without the use of the stack. Arm 


deprecates use of this instruction. However, in this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See Ilegal return events from 


AArch32 state on page G1-5524. 
— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 | | 0 | 
!=1111 Jo o 10/1 o ofs| Rn | Rd _ [| immi2_— | 


cond 


ADD variant 
Applies when S == @ && Rn != 11x1. 


ADD{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


ADDS variant 
Applies when S == 1 && Rn != 1101. 


ADDS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 
if Rn == '1111' && S == '0' then SEE "ADR"; 


if Rn == '1101' then SEE "ADD (SP plus immediate)"; 
d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = A32ExpandImm(imm12) ; 


T1 


151413 1241110 9 8| 65 132 ol] 


0o 01 4 70] mma] Rn | Ra | 


T1 variant 


ADD<c>{<q>} <Rd>, <Rn>, #<imm3> // Inside IT block 
ADDS{<q>} <Rd>, <Rn>, #<imm3> // Outside IT block 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = !InITBlock(); imm32 = ZeroExtend(imm3, 32); 
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T2 
|15 14 13 12/1110 8|7 | 0 | 
T2 variant 


ADD<c>{<q>} <Rdn>, #<imm8> // Inside IT block, and <Rdn>, <imm8> can be represented in T1 
ADD<c>{<q>} {<Rdn>,} <Rdn>, #<imm8> // Inside IT block, and <Rdn>, <imm8> cannot be represented in T1 
ADDS{<q>} <Rdn>, #<imm8> // Outside IT block, and <Rdn>, <imm8> can be represented in T1 
ADDS{<q>} {<Rdn>,} <Rdn>, #<imm8> // Outside IT block, and <Rdn>, <imm8> cannot be represented in T1 


Decode for this encoding 


d = UInt(Rdn); n = UInt(Rdn); setflags = !InITBlock(); imm32 = ZeroExtend(imm8, 32); 
T3 


[15 14 13 121110 9 8|7 6 5 4|3 01514  12|11 8|7 | 0 | 


manono 00 os| Eno fo] imma Ra | me —i 
Rn 


ADD variant 
Applies when S == 0. 


ADD<c>.W {<Rd>,} <Rn>, #<const> // Inside IT block, and <Rd>, <Rn>, <const> can be represented in T1 or 
T2 
ADD{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


ADDS variant 
Applies when S == 1 && Rd != 1111. 


ADDS.W {<Rd>,} <Rn>, #<const> // Outside IT block, and <Rd>, <Rn>, <const> can be represented in T1 or T2 
ADDS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 
if Rd == '1111' && S == '1' then SEE "CMN (immediate)"; 
if Rn == '1101' then SEE "ADD (SP plus immediate)"; 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = T32ExpandImm(i:imm3: imm8) ; 
if (d == 15 && !setflags) || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


T4 


|15 14 13 121110 9 8|7 6 5 4|3 0\1514  12|11 8|7 | 0 | 


[1111 ofift ofofojojo} 1x1 Jo] imm3 | Ra | imma | 
Rn 


T4 variant 


ADD{<c>}{<q>} {<Rd>,} <Rn>, #<imm12> // <imm12> cannot be represented in T1, T2, or T3 
ADDW{<c>}{<q>} {<Rd>,} <Rn>, #<imm12> // <imm12> can be represented in T1, T2, or T3 
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Decode for this encoding 


if Rn = 


if Rn 


"1111' then SEE "ADR"; 
'1101' then SEE "ADD (SP plus immediate)"; 


d = UInt(Rd); n = UInt(Rn); setflags = FALSE; imm32 = ZeroExtend(i:imm3:imm8, 32); 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rdn> 


<imm8> 


<Rd> 


<Rn> 


<imm3> 


<imm12> 


<const> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose source and destination register, encoded in the "Rdn" field. 

Is a 8-bit unsigned immediate, in the range 0 to 255, encoded in the "imm8" field. 

For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 


this register is the same as <Rn>. If the PC is used: 


° For the ADD variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


è For the ADDS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. Arm deprecates use of this instruction. 


For encoding T1, T3 and T4: is the general-purpose destination register, encoded in the "Rd" field. 
If omitted, this register is the same as <Rn>. 

For encoding A1 and T4: is the general-purpose source register, encoded in the "Rn" field. If the SP 
is used, see ADD, ADDS (SP plus immediate). If the PC is used, see ADR. 

For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 

For encoding T3: is the general-purpose source register, encoded in the "Rn" field. If the SP is used, 
see ADD, ADDS (SP plus immediate). 

Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "imm3" field. 

Is a 12-bit unsigned immediate, in the range 0 to 4095, encoded in the "1:imm3:imm8" field. 

For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T3: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


When multiple encodings of the same length are available for an instruction, encoding T3 is preferred to encoding 
T4 (if encoding T4 is required, use the ADDW syntax). Encoding T1 is preferred to encoding T2 if <Rd> is specified 
and encoding T2 is preferred to encoding T1 if <Rd> is omitted. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 
if ConditionPassed() then 


F5-4080 


EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(R[n], imm32, '0'); 
if d == 15 then // Can only occur for A32 encoding 


if setflags then 
ALUExceptionReturn(result) ; 
else 
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ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 
else 
if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(R[n], imm32, '0'); 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.5 ADD, ADDS (register) 


Add (register) adds a register value and an optionally-shifted register value, and writes the result to the destination 


register. 


If the destination register is not the PC, the ADDS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. If the 


destination register is the PC: 


s The ADD variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The ADDS variant of the instruction performs an exception return without the use of the stack. Arm 


deprecates use of this instruction. However, in this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 7 6 5 4|3 


o | 


cond 


ADD, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


ADD{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ADD, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 


ADD{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


ADDS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


ADDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ADDS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


ADDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


if Rn == '1101' then SEE "ADD (SP plus register)"; 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
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T1 


|15 14 13 12/1110 9 8| 65 |32 o0] 


foo 017 0fo] Rm | Rn | Ra | 


T1 variant 


ADD<c>{<q>} <Rd>, <Rn>, <Rm> // Inside IT block 
ADDS{<q>} {<Rd>,} <Rn>, <Rm> // Outside IT block 


Decode for this encoding 


d = UInt(Rd); n 


= UInt(Rn); m = UInt(Rm); setflags = !InITBlock(); 
(shift_t, shift_n) = 


(SRType_LSL, 0); 
T2 


|15 14 13 1211 10 9 8|7 6 i 2 ol 


o 1000 1joo| | 101 | Ran | 
Rm 
DN = 


T2 variant 
Applies when ! (DN == 1 && Rdn == 101). 


ADD<c>{<q>} <Rdn>, <Rm> // Preferred syntax, Inside IT block 
ADD{<c>}{<q>} {<Rdn>,} <Rdn>, <Rm> 


Decode for this encoding 


if (DN:Rdn) == '1101' || Rm == '1101' then SEE "ADD (SP plus register)"; 

d = UInt(DN:Rdn); n =d; m = UInt(Rm); setflags = FALSE; (shift_t, shift_n) = (SRType_LSL, 0); 
if n == 15 && m == 15 then UNPREDICTABLE; 

if d == 15 && InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


T3 


[15 1413 12/1110 9 8|7 6 5 4|3 0/1514 12\11 8/7 6 5 4|3 0 | 


+1070 41 00 ojs) Eno O mms | Rd |imma]sype] Rm | 
Rn 





ADD, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


ADD{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ADD, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


ADD<c>.W {<Rd>,} <Rn>, <Rm> // Inside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
ADD{<c>}.W {<Rd>,} <Rn>, <Rm> // <Rd> == <Rn>, and <Rd>, <Rn>, <Rm> can be represented in T2 
ADD{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 
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ADDS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && Rd != 1111 && imm2 == 00 && stype == 11. 


ADDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ADDS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11) && Rd != 1111. 


ADDS.W {<Rd>,} <Rn>, <Rm> // Outside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 or T2 
ADDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


if Rd == '1111' && S == '1' then SEE "CMN (register)"; 

if Rn == '1101' then SEE "ADD (SP plus register)"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if (d == 15 && !setflags) || n == 15 || m == 15 then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rdn> Is the general-purpose source and destination register, encoded in the "DN:Rdn" field. If the PC is 


used, the instruction is a branch to the address calculated by the operation. This is a simple branch, 
see Pseudocode description of operations on the AArch32 general-purpose registers and the PC on 
page E1-3787. 


The assembler language allows <Rdn> to be specified once or twice in the assembler syntax. When 
used inside an IT block, and <Rdn> and <Rm> are in the range RO to R7, <Rdn> must be specified once 
so that encoding T2 is preferred to encoding T1. In all other cases there is no difference in behavior 
when <Rdn> is specified once or twice. 


<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. If the PC is used: 


° For the ADD variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


° For the ADDS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. Arm deprecates use of this instruction. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. 


When used inside an IT block, <Rd> must be specified. When used outside an IT block, <Rd> is 
optional, and: 


ë: If omitted, this register is the same as <Rn>. 
a If present, encoding T1 is preferred to encoding T2. 
For encoding T3: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 


this register is the same as <Rn>. 


<Rn> For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used. If the SP is used, see ADD, ADDS (SP plus register). 
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For encoding T1: is the first general-purpose source register, encoded in the "Rn" field. 
For encoding T3: is the first general-purpose source register, encoded in the "Rn" field. If the SP is 
used, see ADD, ADDS (SP plus register). 

<Rm> For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 
For encoding T1 and T3: is the second general-purpose source register, encoded in the "Rm" field. 


For encoding T2: is the second general-purpose source register, encoded in the "Rm" field. The PC 


can be used. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T3: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 


Inside an IT block, if ADD<c> <Rd>, <Rn>, <Rd> cannot be assembled using encoding T1, it is assembled using 
encoding T2 as though ADD<c> <Rd>, <Rn> had been written. To prevent this happening, use the .W qualifier. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], shifted, '0'); 
if d == 15 then 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result); 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.6 ADD, ADDS (register-shifted register) 


Add (register-shifted register) adds a register value and a register-shifted register value. It writes the result to the 
destination register, and can optionally update the condition flags based on the result. 


A1 
31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 
[_!=1111 [o o o o]1 o ojs| Rn | Ra | Rs [O|stype[1] Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


ADDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


ADD{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype); 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 
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Operation 


if ConditionPassed() then 


EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], shifted, '0'); 
R[d] = result; 
if setflags then 

PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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ADD, ADDS (SP plus immediate) 


Add to SP (immediate) adds an immediate value to the SP value, and writes the result to the destination register. 


If the destination register is not the PC, the ADDS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. However, 


when the destination register is the PC: 


è The ADD variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


7 The ADDS variant of the instruction performs an exception return without the use of the stack. Arm 


deprecates use of this instruction. However, in this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See Ilegal return events from 


AArch32 state on page G1-5524. 
— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|11 | | 0 | 
1111 |o o 1 0]1 o ofs[1107{ Ra | immi2_  žăě | 


cond 


ADD variant 
Applies when S == 0. 


ADD{<c>}{<q>} {<Rd>,} SP, #<const> 


ADDS variant 
Applies when S = 1. 


ADDS{<c>}{<q>} {<Rd>,} SP, #<const> 
Decode for all variants of this encoding 
d = UInt(Rd); setflags = (S == '1'); imm32 = A32ExpandImm(imm12) ; 


T1 


|15 1413 1211110 8|7 | 0 | 


[1 ot oft] Ra | imma | 


T1 variant 


ADD{<c>}{<q>} <Rd>, SP, #<imm8> 


Decode for this encoding 


d = UInt(Rd); setflags = FALSE; imm32 = ZeroExtend(imm8:'00', 32); 
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T2 


|15 14 13 12|11 10 9 8|7 6 | 0 | 


101100000) mm? | 


T2 variant 


ADD{<c>}{<q>} {SP,} SP, #<imm7> 


Decode for this encoding 


d = 13; setflags = FALSE; imm32 = ZeroExtend(imm7:'00', 32); 
T3 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0]1514 12/11 8|7 | 0 | 


741 of folt 00 ojs 10 7/0] mma] Ra [imme —s 


ADD variant 
Applies when S == 0. 


ADD{<c>}.W {<Rd>,} SP, #<const> // <Rd>, <const> can be represented in T1 or T2 
ADD{<c>}{<q>} {<Rd>,} SP, #<const> 


ADDS variant 
Applies when S == 1 && Rd != 1111. 


ADDS{<c>}{<q>} {<Rd>,} SP, #<const> 


Decode for all variants of this encoding 
if Rd == '1111' && S == '1' then SEE "CMN (immediate)"; 


d = UInt(Rd); setflags = (S == '1');  imm32 = T32ExpandImm(i:imm3:imm8) ; 
if d == 15 && !setflags then UNPREDICTABLE; 


T4 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|1514 12/11 8|7 | 0 | 


741 Of] ofofopofoyt +o toy mma [Ra | imms—s 


T4 variant 


ADD{<c>}{<q>} {<Rd>,} SP, #<imm12> // <imm12> cannot be represented in T1, T2, or T3 
ADDW{<c>}{<q>} {<Rd>,} SP, #<imm12> // <imm12> can be represented in T1, T2, or T3 


Decode for this encoding 

d = UInt(Rd); setflags = FALSE; imm32 = ZeroExtend(i:imm3:imm8, 32); 
if d == 15 then UNPREDICTABLE; 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 
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Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

SP, Is the stack pointer. 

<imm7> Is the unsigned immediate, a multiple of 4, in the range 0 to 508, encoded in the "imm7" field as 
<imm7>/4. 

<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 


this register is the SP. Arm deprecates using the PC as the destination register, but if the PC is used: 


° For the ADD variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


g For the ADDS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. 


For encoding T3 and T4: is the general-purpose destination register, encoded in the "Rd" field. If 
omitted, this register is the SP. 


<imm8> Is an unsigned immediate, a multiple of 4, in the range 0 to 1020, encoded in the "imm8" field as 
<imm8>/4. 

<imm12> Is a 12-bit unsigned immediate, in the range 0 to 4095, encoded in the "1:imm3:imm8" field. 

<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 


page F2-3924 for the range of values. 


For encoding T3: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(SP, imm32, 'Q'); 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result); 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 
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ADD, ADDS (SP plus register) 


Add to SP (register) adds an optionally-shifted register value to the SP value, and writes the result to the destination 


register. 


If the destination register is not the PC, the ADDS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 


deprecates any use of these encodings. However, when the destination register is the PC: 


s The ADD variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The ADDS variant of the instruction performs an exception return without the use of the stack. In this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See //egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12\11 7 6 5 4|3 


| 111 jo oo of1 o ojs[1 10 1| Ra | immS  |stypelo] Rm | 


cond 


ADD, rotate right with extend variant 
Applies when S == 0 && imm5 == 00000 && stype == 11. 


ADD{<c>}{<q>} {<Rd>,} SP, <Rm> , RRX 


ADD, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 


ADD{<c>}{<q>} {<Rd>,} SP, <Rm> {, <shift> #<amount>} 


ADDS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


ADDS{<c>}{<q>} {<Rd>,} SP, <Rm> , RRX 


ADDS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


ADDS{<c>}{<q>} {<Rd>,} SP, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
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F5-4092 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 0| 


fo 7000700] [110 7 Ram 
DM es! 


T1 variant 


ADD{<c>}{<q>} {<Rdm>,} SP, <Rdm> 


Decode for this encoding 
d = UInt(DM:Rdm); m = UInt(DM:Rdm); setflags = FALSE; 


(shift_t, shift_n) = (SRType_LSL, 0); 
if d == 15 && InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


T2 


|15 14 1312/1110 9 8|7 6 3 210] 


onoo onjo o| Emo [107 


Rm 


T2 variant 


ADD{<c>}{<q>} {SP,} SP, <Rm> 


Decode for this encoding 
if Rm == '1101' then SEE "encoding T1"; 


d = 13; m = UInt(Rm); setflags = FALSE; 
(shift t, shift n) = (SRType_LSL, 0); 


T3 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0]1514 12/11 8|7 6 5 4|3 0 | 


[111070 141 0 0 ojsj1 1 0 1ko] imm3 | Rd__imma]stype] Rm | 


ADD, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


ADD{<c>}{<q>} {<Rd>,} SP, <Rm>, RRX 


ADD, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


ADD{<c>}.W {<Rd>,} SP, <Rm> // <Rd>, <Rm> can be represented in T1 or T2 
ADD{<c>}{<q>} {<Rd>,} SP, <Rm> {, <shift> #<amount>} 


ADDS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && Rd != 1111 && imm2 == 00 && stype == 11. 


ADDS{<c>}{<q>} {<Rd>,} SP, <Rm>, RRX 
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ADDS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11) && Rd != 1111. 


ADDS{<c>}{<q>} {<Rd>,} SP, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 

if Rd == '1111' && S == '1' then SEE "CMN (register)"; 

d = UInt(Rd); m = UInt(Rm); setflags = (S == '1'); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if (d == 15 && !setflags) || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

SP, Is the stack pointer. 

<Rdm> Is the general-purpose destination and second source register, encoded in the "Rdm" field. If 


omitted, this register is the SP. Arm deprecates using the PC as the destination register, but if the PC 
is used, the instruction is a branch to the address calculated by the operation. This is a simple branch, 
see Pseudocode description of operations on the AArch32 general-purpose registers and the PC on 
page E1-3787. 


<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the SP. Arm deprecates using the PC as the destination register, but if the PC is used: 


e For the ADD variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


a For the ADDS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T3: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the SP. 

<Rm> For encoding A1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 
The PC can be used, but this is deprecated. 


For encoding T3: is the second general-purpose source register, encoded in the "Rm" field. 


<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T3: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(SP, shifted, '@'); 
if d == 15 then 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 
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F5.1.9 ADD (immediate, to PC) 


ARM DDI 0487E.a 
ID070919 


Add to PC adds an immediate value to the Align(PC, 4) value to form a PC-relative address, and writes the result 
to the destination register. Arm recommends that, where possible, software avoids using this alias 


This instruction is a pseudo-instruction of the ADR instruction. This means that: 


$ The encodings in this description are named to match the encodings of ADR. 

. The assembler syntax is used only for assembly, and is not used on disassembly. 

. The description of ADR gives the operational pseudocode for this instruction. 

A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12111 | | 0 | 

eit [oo 71 0]1 oooh airi] Ra | ë ë me 
cond 

A1 variant 


ADD{<c>}{<q>} <Rd>, PC, #<const> 
is equivalent to 
ADR{<c>}{<q>} <Rd>, <label> 


and is never the preferred disassembly. 


T1 


|15 14 13 1211110 817 | 0 | 


[10.1 ojo] Rd | imme | 


T1 variant 

ADD{<c>}{<q>} <Rd>, PC, #<imm8> 
is equivalent to 

ADR{<c>}{<q>} <Rd>, <label> 


and is never the preferred disassembly. 
T3 


|15 141312/11109 8/7 6 5 4/3 2 1 0/1514 12/11 8|7 | 0 | 


741 Ofi[t ofofopofoyt +4 to] mma] Ra | imms——sd 


T3 variant 

ADDW{<c>}{<q>} <Rd>, PC, #<imm12> // <Rd>, <imm12> can be represented in T1 
is equivalent to 

ADR{<c>}{<q>} <Rd>, <label> 


and is never the preferred disassembly. 
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ADD{<c>}{<q>} <Rd>, PC, #<imm12> 


is equivalent to 


ADR{<c>}{<q>} <Rd>, <label> 


and is never the preferred disassembly. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<label> 


<imm8> 


<imm12> 


<const> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If the PC is 
used, the instruction is a branch to the address calculated by the operation. This is an interworking 
branch, see Pseudocode description of operations on the AArch32 general-purpose registers and the 
PC on page E1-3787. 


For encoding T1 and T3: is the general-purpose destination register, encoded in the "Rd" field. 
For encoding A1: the label of an instruction or literal data item whose address is to be loaded into 


<Rd>. The assembler calculates the required value of the offset from the Align(PC, 4) value of the 
ADR instruction to this label. 


If the offset is zero or positive, encoding A1 is used, with imm32 equal to the offset. 


If the offset is negative, encoding A2 is used, with imm32 equal to the size of the offset. That is, the 
use of encoding A2 indicates that the required offset is minus the value of imm32. 


Permitted values of the size of the offset are any of the constants described in Modified immediate 
constants in A32 instructions on page F2-3924. 


For encoding T1: the label of an instruction or literal data item whose address is to be loaded into 

<Rd>. The assembler calculates the required value of the offset from the Align(PC, 4) value of the 

ADR instruction to this label. Permitted values of the size of the offset are multiples of 4 in the range 
0 to 1020. 


For encoding T3: the label of an instruction or literal data item whose address is to be loaded into 
<Rd>. The assembler calculates the required value of the offset from the Align(PC, 4) value of the 
ADR instruction to this label. 


If the offset is zero or positive, encoding T3 is used, with imm32 equal to the offset. 


If the offset is negative, encoding T2 is used, with imm32 equal to the size of the offset. That is, the 
use of encoding T2 indicates that the required offset is minus the value of imm32. 


Permitted values of the size of the offset are 0-4095. 


Is an unsigned immediate, a multiple of 4, in the range 0 to 1020, encoded in the "imm8" field as 
<imm8>/4. 


Is a 12-bit unsigned immediate, in the range 0 to 4095, encoded in the "1:imm3:imm8" field. 


Animmediate value. See Modified immediate constants in A32 instructions on page F2-3924 for the 
range of values. 


Operation for all encodings 


The description of ADR gives the operational pseudocode for this instruction. 


F5-4096 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


F5.1.10 ADR 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Form PC-relative address adds an immediate value to the PC value to form a PC-relative address, and writes the 
result to the destination register. 


This instruction is used by the pseudo-instructions ADD (immediate, to PC) and SUB (immediate, from PC). The 
pseudo-instruction is never the preferred disassembly. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12\11 | | 0 | 
1111 Jo o 1 0]1 o ojoj 1 11| Ra | _ —  ö mm2  ž | 
cond 

A1 variant 


ADR{<c>}{<q>} <Rd>, <label> 


Decode for this encoding 


d = UInt(Rd); imm32 = A32ExpandImm(imm12); add = TRUE; 


A2 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12111 | | 0| 
1111 Jo o 1 ojo 1 ojoj 111| Ra [| č mm2 Žž | 
cond 

A2 variant 


ADR{<c>}{<q>} <Rd>, <label> 


Decode for this encoding 


d = UInt(Rd); imm32 = A32ExpandImm(imm12); add = FALSE; 


T1 

|15 14 13 1211110 8|7 | 0| 
10 1o0ļo| Ra | imme 

T1 variant 


ADR{<c>}{<q>} <Rd>, <label> 


Decode for this encoding 


d = UInt(Rd); imm32 = ZeroExtend(imm8:'Q0', 32); add = TRUE; 
T2 


|15 14 13 1211110 9 8|7 6 5 4|3 2 1 0ļ1514 12/11 8|7 | 0 | 


141 oft oft opi poy +4 to] mma] Ra | _imms—_—sd 
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T2 variant 


ADR{<c>}{<q>} <Rd>, <label> 


Decode for this encoding 


d = UInt(Rd); | imm32 = ZeroExtend(i:imm3:imm8, 32); add = FALSE; 


if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
T3 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 1 0/1514 12|11 8|7 | 0| 


11 11 ofif{t ofojofofoji 1 1 1fo| imm3 | Ra | imma 


T3 variant 


ADR{<c>}.W <Rd>, <label> // <Rd>, <label> can be presented in T1 
ADR{<c>}{<q>} <Rd>, <label> 


Decode for this encoding 
d = UInt(Rd); | imm32 = ZeroExtend(i:imm3:imm8, 32); add = TRUE; 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 


Constraints on UNPREDICTABLE behaviors. 


Alias conditions 





Alias or pseudo-instruction of variant is preferred when 





ADD (immediate, to PC) - Never 
SUB (immediate, from PC) T2 i:imm3:imm8 == '000000000000' 
SUB (immediate, from PC) A2 imm12 == '000000000000' 
Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> For encoding A1 and A2: is the general-purpose destination register, encoded in the "Rd" field. If 


the PC is used, the instruction is a branch to the address calculated by the operation. This is an 
interworking branch, see Pseudocode description of operations on the AArch32 general-purpose 
registers and the PC on page E1-3787. 


For encoding T1, T2 and T3: is the general-purpose destination register, encoded in the "Rd" field. 
<label> For encoding A1 and A2: the label of an instruction or literal data item whose address is to be loaded 


into <Rd>. The assembler calculates the required value of the offset from the Align(PC, 4) value of 
the ADR instruction to this label. 


If the offset is zero or positive, encoding A1 is used, with imm32 equal to the offset. 


If the offset is negative, encoding A2 is used, with imm32 equal to the size of the offset. That is, the 
use of encoding A2 indicates that the required offset is minus the value of imm32. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Permitted values of the size of the offset are any of the constants described in Modified immediate 
constants in A32 instructions on page F2-3924. 


For encoding T1: the label of an instruction or literal data item whose address is to be loaded into 

<Rd>. The assembler calculates the required value of the offset from the Align(PC, 4) value of the 

ADR instruction to this label. Permitted values of the size of the offset are multiples of 4 in the range 
0 to 1020. 


For encoding T2 and T3: the label of an instruction or literal data item whose address is to be loaded 
into <Rd>. The assembler calculates the required value of the offset from the Align(PC, 4) value of 
the ADR instruction to this label. 


If the offset is zero or positive, encoding T3 is used, with imm32 equal to the offset. 


If the offset is negative, encoding T2 is used, with imm32 equal to the size of the offset. That is, the 
use of encoding T2 indicates that the required offset is minus the value of imm32. 


Permitted values of the size of the offset are 0-4095. 


The instruction aliases permit the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = if add then (Align(PC,4) + imm32) else (Align(PC,4) - imm32); 


if d == 15 then // Can only occur for A32 encodings 
ALUWritePC(result) ; 
else 
R[d] = result; 
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F5.1.11 AND, ANDS (immediate) 


Bitwise AND (immediate) performs a bitwise AND of a register value and an immediate value, and writes the result 
to the destination register. 


If the destination register is not the PC, the ANDS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


s The AND variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

è The ANDS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 | | 0 | 
1111 |o o 1 ofo o ofs| Rn | Ra | immi2_— | 


cond 


AND variant 

Applies when S == 0. 

AND{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
ANDS variant 

Applies when S = 1. 

ANDS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); 
(imm32, carry) = A32ExpandImm_C(imm12, PSTATE.C); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 01514 12\11 8|7 | 0 | 


[741 ojojo oo os] Rn Jo) imma] Ra | mme | 


AND variant 

Applies when S == 0. 

AND{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
ANDS variant 


Applies when S == 1 && Rd != 1111. 
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ANDS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


if Rd == '1111' && S == '1' then SEE "TST (immediate)"; 


d = UInt(Rd); 


n = UInt(Rn); setflags = (S == '1'); 


(imm32, carry) = T32ExpandImm_C(i:imm3:imm8, PSTATE.C); 
if (d == 15 && !setflags) || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<const> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 


° For the AND variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


s For the ANDS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 

For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 

For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 

For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = R[n] AND imm32; 
if d == 15 then // Can only occur for A32 encoding 


else 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result) ; 
PSTATE.C = carry; 
// PSTATE.V unchanged 


if setflags then 
ALUExceptionReturn(result) ; 


ALUWritePC(result) ; 
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Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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AND, ANDS (register) 


Bitwise AND (register) performs a bitwise AND of a register value and an optionally-shifted register value, and 


writes the result to the destination register. 


If the destination register is not the PC, the ANDS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 


deprecates any use of these encodings. However, when the destination register is the PC: 


s The AND variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The ANDS variant of the instruction performs an exception return without the use of the stack. In this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 7 6 5 4|3 


| 111 jo o o ofo o ojs| Rn | Rd | immS  stypefo] Rm | 


cond 


AND, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


AND{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


AND, shift or rotate by value variant 
Applies when S == 0 && !(imm5 == 00000 && stype == 11). 


AND{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


ANDS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


ANDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ANDS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


ANDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
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F5-4104 


T1 


[15 14 13 121110 9 8|7 65 |32 o0] 


T1 variant 


AND<c>{<q>} {<Rdn>,} <Rdn>, <Rm> // Inside IT block 
ANDS{<q>} {<Rdn>,} <Rdn>, <Rm> // Outside IT block 


Decode for this encoding 
d = UInt(Rdn); n = UInt(Rdn); m = UInt(Rm); setflags = !InITBlock(); 
(shift t, shift n) = (SRType_LSL, 0); 


T2 


[15 14 13 1211110 9 8|7 6 5 4|3 01514  12|11 8|7 6 5 4|3 0| 


111010100 0 ojs| Rn [of imm3 | Ra _ |imm2|stye| Rm | 


AND, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


AND{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


AND, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


AND<c>.W {<Rd>,} <Rn>, <Rm> // Inside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
AND{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


ANDS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && Rd != 1111 && imm2 == 00 && stype == 11. 


ANDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ANDS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11) && Rd != 1111. 


ANDS.W {<Rd>,} <Rn>, <Rm> // Outside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
ANDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


if Rd == '1111' && S == '1' then SEE "TST (register)"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if (d == 15 && !setflags) || n == 15 || m == 15 then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 
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Assembler symbols 


<C> 


<q> 


<Rdn> 


<Rd> 


<Rn> 


<Rm> 


<shift> 


<amount> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the first general-purpose source register and the destination register, encoded in the "Rdn" field. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 


° For the AND variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


. For the ANDS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T2: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 

For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used, but this is deprecated. 

For encoding T2: is the first general-purpose source register, encoded in the "Rn" field. 

For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 

For encoding T1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 


Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 


LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "Imm3:imm2" field as <amount> modulo 32. 


In T32 assembly: 


. Outside an IT block, if ANDS <Rd>, <Rn>, <Rd> has <Rd> and <Rn> both in the range RO-R7, it is assembled 
using encoding T1 as though ANDS <Rd>, <Rn> had been written. 


. Inside an IT block, if AND<c> <Rd>, <Rn>, <Rd> has <Rd> and <Rn> both in the range RO-R7, it is assembled 
using encoding T1 as though AND<c> <Rd>, <Rn> had been written. 


To prevent either of these happening, use the .W qualifier. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] AND shifted; 
if d == 15 then // Can only occur for A32 encoding 


if setflags then 
ALUExceptionReturn(result) ; 


ALUWritePC(result) ; 
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else 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.13 AND, ANDS (register-shifted register) 


Bitwise AND (register-shifted register) performs a bitwise AND of a register value and a register-shifted register 
value. It writes the result to the destination register, and can optionally update the condition flags based on the result. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 8|7 6 5 4|3 0 | 
[_!=1111 [o o o ofo o ojs| Rn | Ra | Rs ([O|stype[1] Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


ANDS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


AND{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype) ; 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 
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Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] AND shifted; 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


F5-4108 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.14 ASR (immediate) 


ARM DDI 0487E.a 
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Arithmetic Shift Right (immediate) shifts a register value right by an immediate number of bits, shifting in copies 
of its sign bit, and writes the result to the destination register. 


This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 


$ The encodings in this description are named to match the encodings of MOV, MOVS (register). 


s The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16/15 12|11 7 65 4/3 0| 
iit [000 4 o pO Ra O s [1 ojo R 
cond S stype 


MOV, shift or rotate by value variant 
ASR{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 

is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, ASR #<imm> 


and is always the preferred disassembly. 
T2 


|15 14 13 12|11 10 | 65 |32 ol] 


[o o of4 of imms | Rm | Ra | 
op 


T2 variant 

ASR<c>{<q>} {<Rd>,} <Rm>, #<imm> // Inside IT block 
is equivalent to 

MOV<c>{<q>} <Rd>, <Rm>, ASR #<imm> 


and is the preferred disassembly when InITBlock(). 


T3 
|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|1514 12/11 8|7 6 5 4|3 0 | 
111010100100 11 O mma] Ri fimm of Rm | 
S stype 


MOV, shift or rotate by value variant 

ASR<c>.W {<Rd>,} <Rm>, #<imm> // Inside IT block, and <Rd>, <Rm>, <imm> can be represented in T2 
is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, ASR #<imm> 

and is always the preferred disassembly. 


ASR{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 
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F5-4110 


is equivalent to 


MOV{<c>}{<q>} <Rd>, <Rm>, ASR #<imm> 


and is always the preferred disassembly. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rm> 


<imm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 
deprecates using the PC as the destination register, but if the PC is used, the instruction is a branch 
to the address calculated by the operation. This is an interworking branch, see Pseudocode 
description of operations on the AArch32 general-purpose registers and the PC on page E1-3787. 


For encoding T2 and T3: is the general-purpose destination register, encoded in the "Rd" field. 
For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 
used, but this is deprecated. 

For encoding T2 and T3: is the general-purpose source register, encoded in the "Rm" field. 

For encoding A1 and T2: is the shift amount, in the range 1 to 32, encoded in the "imm5" field as 
<imm> modulo 32. 


For encoding T3: is the shift amount, in the range 1 to 32, encoded in the "imm3:imm2" field as 
<imm> modulo 32. 


Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
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F5.1.15 ASR (register) 


ARM DDI 0487E.a 
ID070919 


Arithmetic Shift Right (register) shifts a register value right by a variable number of bits, shifting in copies of its 
sign bit, and writes the result to the destination register. The variable number of bits is read from the bottom byte of 
a register 


This instruction is an alias of the MOV, MOVS (register-shifted register) instruction. This means that: 


s The encodings in this description are named to match the encodings of MOV, MOVS (register-shifted 
register). 


° The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this 
instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12|11 8/7 6 5 4|3 0 | 


[m1 Jooo 4 1]o tJofoy@ oo Ra | rs Joji ofi] Rm | 


cond S stype 


Not flag setting variant 
ASR{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, ASR <Rs> 


and is always the preferred disassembly. 
T1 


15141312411109 | 65 |32 ol] 


op 


Arithmetic shift right variant 

ASR<c>{<q>} {<Rdm>,} <Rdm>, <Rs> // Inside IT block 
is equivalent to 

MOV<c>{<q>} <Rdm>, <Rdm>, ASR <Rs> 


and is the preferred disassembly when InITBlock(). 


T2 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 
1111717010 0{1 ojo] Rm [1111] Ra [ooo o}] Rs | 


stype S 


Not flag setting variant 
ASR<c>.W {<Rd>,} <Rm>, <Rs> // Inside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in T1 
is equivalent to 


MOV{<c>}{<q>} <Rd>, <Rm>, ASR <Rs> 
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and is always the preferred disassembly. 
ASR{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 

is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, ASR <Rs> 


and is always the preferred disassembly. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdm> Is the first general-purpose source register and the destination register, encoded in the "Rdm" field. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 

<Rs> Is the second general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation for all encodings 


The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this instruction. 
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F5.1.16 ASRS (immediate) 


Arithmetic Shift Right, setting flags (immediate) shifts a register value right by an immediate number of bits, 
shifting in copies of its sign bit, and writes the result to the destination register. 


If the destination register is not the PC, this instruction updates the condition flags based on the result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


e The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


$ The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from AArch32 
state on page G1-5524. 


e The instruction is UNDEFINED in Hyp mode. 
° The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 
This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 


s The encodings in this description are named to match the encodings of MOV, MOVS (register). 


s The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12111 7 6 5 4|3 0| 
1111 [o 0011o 1o] Ra | imm5 [1 ofo] Rm | 
cond S stype 


MOVS, shift or rotate by value variant 
ASRS{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 

is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, ASR #<imm> 


and is always the preferred disassembly. 


T2 


|15 14 13 12/11 10 | 65 |32 0l 


oo ojt 0] mms | Rm | Ra | 
op 


T2 variant 

ASRS{<q>} {<Rd>,} <Rm>, #<imm> // Outside IT block 
is equivalent to 

MOVS{<q>} <Rd>, <Rm>, ASR #<imm> 


and is the preferred disassembly when !InITBlock(). 
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F5-4114 


T3 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|1514 12/11 8|7 6 5 4|3 0 | 


T7070 7007 onj 17 10] mms | Rd mmaa o[ Rm | 
S 


stype 


MOVS, shift or rotate by value variant 


ASRS.W {<Rd>, 


is equivalent to 


MOVS{<c>} 
and is alw 


ASRS{<c>} 


is equivalent to 


MOVS{<c>} 


<q> 


<q> 








<q> 


<Rm>, #<imm> // Outside IT block, and <Rd>, <Rm>, <imm> can be represented in T2 


<Rd>, <Rm>, ASR #<imm> 


ays the preferred disassembly. 


{<Rd>,} <Rm>, #<imm> 


<Rd>, <Rm>, ASR #<imm> 


and is always the preferred disassembly. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rm> 


<imm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 
deprecates using the PC as the destination register, but if the PC is used, the instruction performs an 
exception return, that restores PSTATE from SPSR_<current_mode>. 


For encoding T2 and T3: is the general-purpose destination register, encoded in the "Rd" field. 
For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 
used, but this is deprecated. 

For encoding T2 and T3: is the general-purpose source register, encoded in the "Rm" field. 

For encoding A1 and T2: is the shift amount, in the range 1 to 32, encoded in the "imm5" field as 
<imm> modulo 32. 


For encoding T3: is the shift amount, in the range 1 to 32, encoded in the "imm3:imm2" field as 
<imm> modulo 32. 


Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
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F5.1.17 ASRS (register) 


ARM DDI 0487E.a 
ID070919 


Arithmetic Shift Right, setting flags (register) shifts a register value right by a variable number of bits, shifting in 
copies of its sign bit, writes the result to the destination register, and updates the condition flags based on the result. 
The variable number of bits is read from the bottom byte of a register 


This instruction is an alias of the MOV, MOVS (register-shifted register) instruction. This means that: 


s The encodings in this description are named to match the encodings of MOV, MOVS (register-shifted 
register). 


° The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this 
instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12|11 8/7 6 5 4|3 0 | 


[m1 Jooo 4 1]o t]ifoyo oo) Ra | rs Joji oft] Rm | 
S 


cond stype 


Flag setting variant 
ASRS{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, ASR <Rs> 


and is always the preferred disassembly. 


T1 


15141312411109 | 65 |32 ol] 


op 


Arithmetic shift right variant 

ASRS{<q>} {<Rdm>,} <Rdm>, <Rs> // Outside IT block 
is equivalent to 

MOVS{<q>} <Rdm>, <Rdm>, ASR <Rs> 


and is the preferred disassembly when !InITBlock(). 


T2 


|15 14 13 12\11109 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


1111010 0j oji] Rm [trai] Rd jooo of] Rs | 


stype S 


Flag setting variant 
ASRS.W {<Rd>,} <Rm>, <Rs> // Outside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in T1 
is equivalent to 


MOVS{<c>}{<q>} <Rd>, <Rm>, ASR <Rs> 
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and is always the preferred disassembly. 
ASRS{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 

is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, ASR <Rs> 


and is always the preferred disassembly. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdm> Is the first general-purpose source register and the destination register, encoded in the "Rdm" field. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 

<Rs> Is the second general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation for all encodings 


The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this instruction. 


F5-4116 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.18 B 


Branch causes a branch to a target address. 


A1 


|31 28|27 26 25 24|23 | | | | | o| 


Cem [toto] SSCS S—SCSCSCSd 


cond 


A1 variant 


B{<c>}{<q>} <label> 


Decode for this encoding 


imm32 = SignExtend(imm24:'00', 32); 
T1 


|15 14 13 12|11 8|7 | 0 | 


1i oaj et [imme o 


cond 


T1 variant 


B<c>{<q>} <label> // Not permitted in IT block 


Decode for this encoding 
if cond == '1110' then SEE "UDF"; 
if cond == '1111' then SEE "SVC"; 


imm32 = SignExtend(imm8:'@', 32); 
if InITBlock() then UNPREDICTABLE; 


T2 


|15 14 13 12/11 10 | | 0| 


11100) mmi ë E 


T2 variant 


B{<c>}{<q>} <label> // Outside or last in IT block 


Decode for this encoding 
imm32 = SignExtend(imm11:'0', 32); 
if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


T3 


151413 12411109 | 65 | 0 |15 14 13 12/11 10 | | 0| 





maaa ojs) eme | me [1 opiope] im ————s™ 


cond 
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T3 variant 


B<c>.W <label> // Not permitted in IT block, and <label> can be represented in T1 
B<c>{<q>} <label> // Not permitted in IT block 


Decode for this encoding 
if cond<3:1> == '111' then SEE "Related encodings"; 


imm32 = SignExtend(S:J2:J1:imm6:imm11:'0', 32); 
if InITBlock() then UNPREDICTABLE; 


T4 


15 14 13 1211110 9 | | 0 |15 14 13 12/11 10 | | 0 | 


Tit 7+ os] immo ——=«d oem C*' 


T4 variant 


B{<c>}.W <label> // <label> can be represented in T2 
B{<c>}{<q>} <label> 


Decode for this encoding 

I1 = NOT(J1 EOR S); I2 = NOT(J2 EOR S); imm32 = SignExtend(S:11:12:imm10:imm11:'0', 32); 
if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Related encodings: Branches and miscellaneous control on page F3-3979. 


Assembler symbols 


<c> For encoding A1, T2 and T4: see Standard assembler syntax fields on page F2-3908. 
For encoding T1: see Standard assembler syntax fields on page F2-3908. Must not be AL or omitted. 


For encoding T3: see Standard assembler syntax fields on page F2-3908. <c> must not be AL or 


omitted. 
<q> See Standard assembler syntax fields on page F2-3908. 
<label> For encoding A1: the label of the instruction that is to be branched to. The assembler calculates the 


required value of the offset from the PC value of the B instruction to this label, then selects an 
encoding that sets imm32 to that offset. 


Permitted offsets are multiples of 4 in the range —33554432 to 33554428. 


For encoding T1: the label of the instruction that is to be branched to. The assembler calculates the 
required value of the offset from the PC value of the B instruction to this label, then selects an 
encoding that sets imm32 to that offset. Permitted offsets are even numbers in the range —256 to 254. 


For encoding T2: the label of the instruction that is to be branched to. The assembler calculates the 
required value of the offset from the PC value of the B instruction to this label, then selects an 
encoding that sets imm32 to that offset. Permitted offsets are even numbers in the range —2048 to 
2046. 


For encoding T3: the label of the instruction that is to be branched to. The assembler calculates the 
required value of the offset from the PC value of the B instruction to this label, then selects an 
encoding that sets imm32 to that offset. 


Permitted offsets are even numbers in the range —1048576 to 1048574. 
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For encoding T4: the label of the instruction that is to be branched to. The assembler calculates the 
required value of the offset from the PC value of the B instruction to this label, then selects an 
encoding that sets imm32 to that offset. 


Permitted offsets are even numbers in the range -16777216 to 16777214. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
BranchWritePC(PC + imm32, BranchType_DIR); 
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F5.1.19 


F5-4120 


Bit Field Clear clears any number of adjacent bits at any position in a register, without affecting the other bits in the 
register. 


A1 

|31 28|27 26 25 24|23 22 21 20| 16115 12111 I7 65 4/3 21 0] 
iit [0 111110] mb» | Ra | ib [oo 1ļj1i 111 
cond 

A1 variant 


BFC{<c>}{<q>} <Rd>, #<Isb>, #<width> 


Decode for this encoding 
d = UInt(Rd); msbit = UInt(msb); Isbit = UInt(1sb); 
if d == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8|7 6 5 4|3 2 1 0ļ1514 12/11 8|7 6 5 4| 0 | 


741 oft tfo afi foyt 14 4 ]o] mms | Rd limmofoy mab 


T1 variant 


BFC{<c>}{<q>} <Rd>, #<Isb>, #<width> 


Decode for this encoding 
d = UInt(Rd); msbit = UInt(msb); Isbit = UInt(imm3:imm2); 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<lsb> For encoding A1: is the least significant bit to be cleared, in the range 0 to 31, encoded in the "Isb" 
field. 


For encoding T1: is the least significant bit that is to be cleared, in the range 0 to 31, encoded in the 
"imm3:imm2" field. 


<width> Is the number of bits to be cleared, in the range 1 to 32-<Isb>, encoded in the "msb" field as 
<Isb>+<width>-1. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if msbit >= Isbit then 
R[d]<msbit:]lsbit> = Replicate('@', msbit-1sbit+1); 
// Other bits of R[d] are unchanged 
else 
UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifmsbit < 1sbit, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
s The value in the destination register is UNKNOWN. 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.20 


F5-4122 


BFI 


Bit Field Insert copies any number of low order bits from a register into the same number of adjacent bits at any 
position in the destination register. 


A1 

|31 28|27 26 25 24|23 22 21 20| 16115 12111 |7 6 5 4]3 0| 
mim [ot +1110] mo | Rd | sb fooi em 
cond Rn 

A1 variant 


BFI{<c>}{<q>} <Rd>, <Rn>, #<Isb>, #<width> 


Decode for this encoding 
if Rn == '1111' then SEE "BFC"; 


d = UInt(Rd); n = UInt(Rn); msbit = UInt(msb); Isbit = UInt(1sb); 
if d == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0\1514  12|11 8|7 6 54| o| 


4111 oo o ol enn [o] mms | Ra immo ms 
Rn 





T1 variant 


BFI{<c>}{<q>} <Rd>, <Rn>, #<lsb>, #<width> 


Decode for this encoding 

if Rn == '1111' then SEE "BFC"; 

d = UInt(Rd); n = UInt(Rn); msbit = UInt(msb); Isbit = UInt(imm3:imm2); 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the general-purpose source register, encoded in the "Rn" field. 

<lsb> For encoding A1: is the least significant destination bit, in the range 0 to 31, encoded in the "Isb" 
field. 


For encoding T1: is the least significant destination bit, in the range 0 to 31, encoded in the 
"imm3:imm2" field. 


<width> Is the number of bits to be copied, in the range 1 to 32-<Isb>, encoded in the "msb" field as 
<Isb>+<width>-1. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if msbit >= Isbit then 
R[d]<msbit:]lsbit> = R[n]<(msbit-]sbit) :0>; 
// Other bits of R[d] are unchanged 
else 
UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifmsbit < 1sbit, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
s The value in the destination register is UNKNOWN. 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.21 BIC, BICS (immediate) 


Bitwise Bit Clear (immediate) performs a bitwise AND of a register value and the complement of an immediate 
value, and writes the result to the destination register. 


If the destination register is not the PC, the BICS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


s The BIC variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

è The BICS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 | | 0 | 
1111 [oo 1744/1 of/s| Rn | Rd | immi2_—  žăě | 


cond 


BIC variant 
Applies when S == 0. 


BIC{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


BICS variant 

Applies when S = 1. 

BICS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); 
(imm32, carry) = A32ExpandImm_C(imm12, PSTATE.C); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 01514 12\11 8|7 | 0 | 


[741 ojojo oo 7s] Rn Jo] imma] Ra [imme | 


BIC variant 

Applies when S == 0. 

BIC{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
BICS variant 


Applies when S = 1. 
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BICS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); 

(imm32, carry) = T32ExpandImm_C(i:imm3:imm8, PSTATE.C); 

if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 
° For the BIC variant, the instruction is a branch to the address calculated by the operation. This 


is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


: For the BICS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 


<Rn> For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 


For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 


<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = R[n] AND NOT(imm32) ; 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 
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Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.22 BIC, BICS (register) 


Bitwise Bit Clear (register) performs a bitwise AND of a register value and the complement of an optionally-shifted 
register value, and writes the result to the destination register. 


If the destination register is not the PC, the BICS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


s The BIC variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

è The BICS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 7 6 5 4|3 0 | 
1111 |o o 0 14/1 ofs| Rn | Ra | imm5 _[stypef[o] Rm | 


cond 


BIC, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


BIC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


BIC, shift or rotate by value variant 
Applies when S == 0 && !(imm5 == 00000 && stype == 11). 


BIC{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


BICS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


BICS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


BICS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


BICS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
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T1 


|15 14 13 121110 9 8|7 65 |32 0| 


T1 variant 


BIC<c>{<q>} {<Rdn>,} <Rdn>, <Rm> // Inside IT block 
BICS{<q>} {<Rdn>,} <Rdn>, <Rm> // Outside IT block 


Decode for this encoding 
d = UInt(Rdn); n = UInt(Rdn); m = UInt(Rm); setflags = !InITBlock(); 
(shift t, shift n) = (SRType_LSL, 0); 


T2 


[15 14 13 121110 9 8|7 6 5 4|3 01514  12|11 8|7 6 5 4|3 0| 


1110101000 sts} Rn [of imm3 | Ra _ |imm2|stye| Rm | 


BIC, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


BIC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


BIC, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


BIC<c>.W {<Rd>,} <Rn>, <Rm> // Inside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
BIC{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


BICS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && imm2 == 00 && stype == 11. 


BICS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


BICS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11). 


BICS.W {<Rd>,} <Rn>, <Rm> // Outside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
BICS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 
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Assembler symbols 


<C> 


<q> 


<Rdn> 


<Rd> 


<Rn> 


<Rm> 


<shift> 


<amount> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the first general-purpose source register and the destination register, encoded in the "Rdn" field. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 


° For the BIC variant, the instruction is a branch to the address calculated by the operation. This 
is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


. For the BICS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T2: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 

For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used, but this is deprecated. 

For encoding T2: is the first general-purpose source register, encoded in the "Rn" field. 

For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 

For encoding T1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 


Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 


LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "Imm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] AND NOT(shifted) ; 
if d == 15 then // Can only occur for A32 encoding 


else 


if setflags then 
ALUExceptionReturn(result) ; 


ALUWritePC(result) ; 


= result; 


if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 
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Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.23 BIC, BICS (register-shifted register) 


ARM DDI 0487E.a 
ID070919 


Bitwise Bit Clear (register-shifted register) performs a bitwise AND of a register value and the complement of a 
register-shifted register value. It writes the result to the destination register, and can optionally update the condition 
flags based on the result. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 
| !=1111 fo o o 1 1[1 ofs{ Rn | Ra | Rs [oļ]styeeļi| Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


BICS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


BIC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype); 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the general-purpose source register holding a shift amount in its bottom 8 bits, encoded in the "Rs" 
field. 
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Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] AND NOT(shifted) ; 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.24 BKPT 


ARM DDI 0487E.a 
ID070919 


Breakpoint causes a Breakpoint Instruction exception. 


Breakpoint is always unconditional, even when inside an IT block. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 | | 8|7 6 5 4|3 o| 
emm [0007 olomo] — mm2 Jori m 
cond 

A1 variant 


BKPT{<q>} {#}<imm> 


Decode for this encoding 


imm16 = imm12:imm4; 
if cond != '1110' then UNPREDICTABLE; // BKPT must be encoded with AL condition 


CONSTRAINED UNPREDICTABLE behavior 


If cond != '1110', then one of the following behaviors must occur: 
` The instruction is UNDEFINED. 
s The instruction executes as NOP. 
° The instruction executes unconditionally. 
° The instruction executes conditionally. 
T1 
|15 14 13 12|11 10 9 8|7 | 0| 


10111110] imme | 


T1 variant 


BKPT{<q>} {#}<imm> 


Decode for this encoding 


imm16 = ZeroExtend(imm8, 16); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. An BKPT instruction must be unconditional. 
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<imm> For encoding A1: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 
"imm12:imm4" field. This value: 


s Is recorded in the Comment field of ESR_ELx.ISS if the Software Breakpoint Instruction 
exception is taken to an exception level that is using AArch64. 


a Is ignored otherwise. 


For encoding T1: is a 8-bit unsigned immediate, in the range 0 to 255, encoded in the "imm8" field. 
This value: 


$ Is recorded in the Comment field of ESR_ELx.ISS if the Software Breakpoint Instruction 
exception is taken to an exception level that is using AArch64. 


a Is ignored otherwise. 


Operation for all encodings 


EncodingSpecificOperations(); 
AArch32.SoftwareBreakpoint(imm16) ; 
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F5.1.25 BL, BLX (immediate) 
Branch with Link calls a subroutine at a PC-relative address, and setting LR to the return address. 


Branch with Link and Exchange Instruction Sets (immediate) calls a subroutine at a PC-relative address, setting LR 
to the return address, and changes the instruction set from A32 to T32, or from T32 to A32. 


A1 
|31 28|27 26 25 24|23 | | | | | 0| 
1111 
cond 
A1 variant 


BL{<c>}{<q>} <label> 


Decode for this encoding 


imm32 = SignExtend(imm24:'00', 32); targetInstrSet = InstrSet_A32; 


A2 
|31 28|27 26 25 24|23 | | | | | 0| 
1111 
cond 
A2 variant 


BLX{<c>}{<q>} <label> 


Decode for this encoding 


imm32 = SignExtend(imm24:H:'0', 32); targetInstrSet = InstrSet_T32; 


T1 

|15 14 13 1211110 9. | | 0 |15 14 13 12/11 10 | | 0| 
1147 0/8] mo pipe m E) 

T1 variant 


BL{<c>}{<q>} <label> 


Decode for this encoding 


Il = NOT(J1 EOR S); I2 = NOT(J2 EOR S); imm32 = SignExtend(S:I1:I2:imm10:imm11:'0', 32); 
targetInstrSet = InstrSet_T32; 
if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


T2 
|1514 13 12/1110 9. | | 0 |15 14 13 12|11 10 | | 1 0| 
E E a toa] A 
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T2 variant 


BLX{<c>}{<q>} <label> 


Decode for this encoding 


if H == '1' then UNDEFINED; 

Il = NOT(J1 EOR S); I2 = NOT(J2 EOR S); imm32 = SignExtend(S:11:12:imm1QH:imm1@L:'Q0', 32); 
targetInstrSet = InstrSet_A32; 

if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> 


<q> 


<label> 


For encoding A1, T1 and T2: see Standard assembler syntax fields on page F2-3908. 


For encoding A2: see Standard assembler syntax fields on page F2-3908. <c> must be AL or omitted. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: the label of the instruction that is to be branched to. The assembler calculates the 
required value of the offset from the PC value of the BL instruction to this label, then selects an 
encoding that sets imm32 to that offset. 


Permitted offsets are multiples of 4 in the range —33554432 to 33554428. 


For encoding A2: the label of the instruction that is to be branched to. The assembler calculates the 
required value of the offset from the PC value of the BLX instruction to this label, then selects an 
encoding with imm32 set to that offset. 


Permitted offsets are even numbers in the range —33554432 to 33554430. 
For encoding T1: the label of the instruction that is to be branched to. 


The assembler calculates the required value of the offset from the PC value of the BL instruction to 
this label, then selects an encoding with imm32 set to that offset. 


Permitted offsets are even numbers in the range -16777216 to 16777214. 
For encoding T2: the label of the instruction that is to be branched to. 


The assembler calculates the required value of the offset from the Align(PC, 4) value of the BLX 
instruction to this label, then selects an encoding with imm32 set to that offset. 


Permitted offsets are multiples of 4 in the range —16777216 to 16777212. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if CurrentInstrSet() == InstrSet_A32 then 


LR = PC - 4; 
else 
LR = PC<31:1> : '1'; 


if targetInstrSet == InstrSet_A32 then 


targetAddress = Align(PC,4) + imm32; 
else 
targetAddress = PC + imm32; 


SelectInstrSet(targetInstrSet) ; 
BranchWritePC(targetAddress, BranchType_DIRCALL) ; 


F5-4136 
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BLX (register) 


ARM DDI 0487E.a 


Branch with Link and Exchange (register) calls a subroutine at an address specified in the register, and if necessary 
changes to the instruction set indicated by bit[0] of the register value. If the value in bit[0] is 0, the instruction set 
after the branch will be A32. If the value in bit[0] is 1, the instruction set after the branch will be T32. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4/3 0 | 
cond 

A1 variant 


BLX{<c>}{<q>} <Rm> 


Decode for this encoding 
m = UInt(Rm); 
if m == 15 then UNPREDICTABLE; 


T1 


|15 14 1312/1110 9 8|7 6 3 210] 


oT 00077111] Rm OOO 


T1 variant 


BLX{<c>}{<q>} <Rm> 


Decode for this encoding 

m = UInt(Rm); 

if m == 15 then UNPREDICTABLE; 

if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rm> Is the general-purpose register holding the address to be branched to, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
target = R[m]; 
if CurrentInstrSet() == InstrSet_A32 then 
next_instr_addr = PC - 4; 
LR = next_instr_addr; 
else 
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next_instr_addr = PC - 2; 
LR = next_instr_addr<31:1> : '1'; 
BXWritePC(target, BranchType_INDCALL) ; 
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F5.1.27 BX 


Branch and Exchange causes a branch to an address and instruction set specified by a register. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4|3 0| 
cond 

A1 variant 


BX{<c>}{<q>} <Rm> 
Decode for this encoding 
m = UInt(Rm); 


T1 


|15 14 13 12|11 10 9 8|7 6 3 210] 


0700077 7)0] Rm OOO 


T1 variant 
BX{<c>}{<q>} <Rm> 
Decode for this encoding 
m = UInt(Rm); 
if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 


Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rm> For encoding A1: is the general-purpose register holding the address to be branched to, encoded in 


the "Rm" field. The PC can be used. 

For encoding T1: is the general-purpose register holding the address to be branched to, encoded in 
the "Rm" field. The PC can be used. 

Note 


If <Rm> is the PC at a non word-aligned address, it results in UNPREDICTABLE behavior because the 
address passed to the BXwritePC() pseudocode function has bits<1:0> ='10'. 








ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4139 
ID070919 Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
BXWritePC(R[m], BranchType_INDIR) ; 
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F5.1.28 BXJ 


Branch and Exchange, previously Branch and Exchange Jazelle. 


In Armv8, BXJ behaves as a BX instruction, see BX. This means it causes a branch to an address and instruction set 
specified by a register. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4|3 0| 
cond 

A1 variant 


BXJ {<c>}{<q>} <Rm> 


Decode for this encoding 
m = UInt(Rm); 
if m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |1514 13 121110 9 8|7 6 5 4|3 2 1 0| 





1110011110 of Rm fi okolo looko okooko 


T1 variant 


BXJ{<c>}{<q>} <Rm> 


Decode for this encoding 

m = UInt(Rm); 

if m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rm> Is the general-purpose register holding the address to be branched to, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
BXWritePC(R[m], BranchType_INDIR); 
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F5.1.29 


F5-4142 


CBNZ, CBZ 


Compare and Branch on Nonzero and Compare and Branch on Zero compare the value in a register with zero, and 
conditionally branch forward a constant value. They do not affect the condition flags. 


T1 


|15 14 13 12|11 10 9 8|7 i 2 ol] 


10 1 1lolofifa] imms | Rn | 


CBNZ variant 

Applies when op = 1. 

CBNZ{<q>} <Rn>, <label> 

CBZ variant 

Applies when op == 0. 

CBZ{<q>} <Rn>, <label> 

Decode for all variants of this encoding 
n = UInt(Rn); imm32 = ZeroExtend(i:imm5:'0', 32); nonzero = (op == '1'); 
if InITBlock() then UNPREDICTABLE; 

Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 


Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose register to be tested, encoded in the "Rn" field. 
<label> Is the program label to be conditionally branched to. Its offset from the PC, a multiple of 2 and in 


the range 0 to 126, is encoded as "i:imm5" times 2. 


Operation 


EncodingSpecificOperations(); 
if nonzero != IsZero(R[n]) then 
BranchWritePC(PC + imm32, BranchType_DIR); 
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F5.1.30 CLREX 


Clear-Exclusive clears the local monitor of the executing PE. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4|3 2 14 0| 


11110101011 1AA] o o 1 MMM 


A1 variant 


CLREX{<c>} {<q>} 


Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4|3 21 0| 


tt oo 41 ot tat oko ooo o 1 o Mna 





T1 variant 
CLREX{<c>} {<q>} 


Decode for this encoding 


// No additional decoding required 


Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. Must be AL or omitted. 
For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
ClearExclusiveLocal(ProcessorID()); 
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F5.1.31 


F5-4144 


CLZ 


Count Leading Zeros returns the number of binary zero bits before the first binary one bit in a value. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4/3 0| 
Ent [OOoTOT TOMMY Re (Oooo, Rm | 
cond 

A1 variant 


CLZ{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 
d = UInt(Rd); m = UInt(Rm); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


T7itio+rotois] en [1777] Re [7 o[oo] Rm | 


T1 variant 
CLZ{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); n = UInt(Rn); 
ifm !=n || d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ifm != n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction executes as described, with no change to its behavior and no additional side effects. 
° The instruction executes with the additional decode: m = UInt(Rn);. 

: The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


<Rm> For encoding A1: is the general-purpose source register, encoded in the "Rm" field. 


For encoding T1: is the general-purpose source register, encoded in the "Rm" field. It must be 
encoded with an identical value in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = CountLeadingZeroBits(R[m] ); 
R[d] = result<31:0>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
: The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4145 
Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.32 CMN (immediate) 


Compare Negative (immediate) adds a register value and an immediate value. It updates the condition flags based 
on the result, and discards the result. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 | | 0| 
iit |o o 11 Of1 iji] Rn [OOo] imma O 
cond 

A1 variant 


CMN{<c>}{<q>} <Rn>, #<const> 


Decode for this encoding 


n = UInt(Rn); imm32 = A32ExpandImm(imm12) ; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0/1514 12|1110 9 8|7 | 0 | 


741 of foyt oo of] Rn Jo] mms [117 1[ me 


T1 variant 


CMN{<c>}{<q>} <Rn>, #<const> 


Decode for this encoding 


n = UInt(Rn); imm32 = T32ExpandImm(i:imm3:imm8) ; 
if n == 15 then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rn> 


<const> 


F5-4146 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 

For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 

For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(R[n], imm32, 'Q'); 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.33 


F5-4148 


CMN (register) 


Compare Negative (register) adds a register value and an optionally-shifted register value. It updates the condition 


flags based on the result, and discards the result. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16|15 14 13 12|11 7 6 5 4|3 0 | 
[_!=111 [o o 0 1 0of1 1/4] Rn OO(O)()]_—immd__stypefO] Rm | 


cond 


Rotate right with extend variant 
Applies when imm5 == 00000 && stype == 11. 


CMN{<c>}{<q>} <Rn>, <Rm>, RRX 


Shift or rotate by value variant 
Applies when !(imm5 == 00000 && stype == 11). 


CMN{<c>}{<q>} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


n = UInt(Rn); m = UInt(Rm); 
(shift_t, shift_n) = DecodeImmShift(stype, immS); 


T1 


|15 14 13 12/1110 9 8|7 65 |32 0] 


T1 variant 


CMN{<c>}{<q>} <Rn>, <Rm> 


Decode for this encoding 
n = UInt(Rn); m = UInt(Rm); 
(shift_t, shift n) = (SRType_LSL, 0); 


T2 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0\1514 12|1110 9 8|7 6 5 4]3 0 | 


Rotate right with extend variant 
Applies when imm3 == 000 && imm2 == 00 && stype == 11. 


CMN{<c>}{<q>} <Rn>, <Rm>, RRX 


Shift or rotate by value variant 


Applies when !(imm3 == 000 && imm2 == 00 && stype == 11). 
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CMN{<c>}.W <Rn>, <Rm> // <Rn>, <Rm> can be represented in T1 
CMN{<c>}{<q>} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 

n = UInt(Rn); m = UInt(Rm); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2) ; 

if n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 


be used, but this is deprecated. 

For encoding T1 and T2: is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 

can be used, but this is deprecated. 


For encoding T1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 


<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], shifted, '0'); 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.34 CMN (register-shifted register) 


Compare Negative (register-shifted register) adds a register value and a register-shifted register value. It updates the 
condition flags based on the result, and discards the result. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16|15 14 13 12|11 8|7 6 5 4|3 0 | 


[=m fo oo 4 oft tft] Ra kokok] Rs [olsyeeji] Rm | 


cond 


A1 variant 


CMN{<c>}{<q>} <Rn>, <Rm>, <type> <Rs> 


Decode for this encoding 
n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
shift_t = DecodeRegShift(stype) ; 
if n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 


Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<type> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], shifted, '0'); 
PSTATE.<N,Z,C,V> = nzcv; 
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Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
° The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.35 CMP (immediate) 


ARM DDI 0487E.a 
ID070919 


Compare (immediate) subtracts an immediate value from a register value. It updates the condition flags based on 
the result, and discards the result. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 | | 0| 
i111 fo o 1 1 0of1 oji] Rn OOo) immt2 O 
cond 

A1 variant 


CMP{<c>}{<q>} <Rn>, #<const> 


Decode for this encoding 


n = UInt(Rn); imm32 = A32ExpandImm(imm12) ; 


T1 
|15 14 13 1211110 8|7 | 0| 
T1 variant 


CMP{<c>}{<q>} <Rn>, #<imm8> 


Decode for this encoding 


n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); 
T2 


[15 14 13 121110 9 8|7 6 5 4|3 0/1514 12/11109 8|7 | 0 | 


manaon to apt] Rn [op mma [1171] imme 


T2 variant 


CMP{<c>}.W <Rn>, #<const> // <Rd>, <const> can be represented in T1 
CMP{<c>}{<q>} <Rn>, #<const> 


Decode for this encoding 
n = UInt(Rn); imm32 = T32ExpandImm(i:imm3: imm8) ; 
if n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 
Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 

<Rn> For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 
For encoding T1: is a general-purpose source register, encoded in the "Rn" field. 
For encoding T2: is the general-purpose source register, encoded in the "Rn" field. 

<imm8> Is a 8-bit unsigned immediate, in the range 0 to 255, encoded in the "imm&" field. 

<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 


page F2-3924 for the range of values. 


For encoding T2: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(R[n], NOT(imm32), '1'); 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
. The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.36 CMP (register) 


ARM DDI 0487E.a 
ID070919 


Compare (register) subtracts an optionally-shifted register value from a register value. It updates the condition flags 


based on the result, and discards the result. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16|15 14 13 12|11 7 6 5 4|3 


[1m fo 0 0 4 oft oft] Rn  kokokoko] mms  [styejo| Rm | 


cond 


Rotate right with extend variant 
Applies when imm5 == 00000 && stype == 11. 


CMP{<c>}{<q>} <Rn>, <Rm>, RRX 


Shift or rotate by value variant 
Applies when !(imm5 == 00000 && stype == 11). 


CMP{<c>}{<q>} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 
n = UInt(Rn); m = UInt(Rm); 
(shift_t, shift_n) = DecodeImmShift(stype, immS); 


T1 


[15 14 13 121110 9 8|7 65 |32 0] 


T1 variant 


CMP{<c>}{<q>} <Rn>, <Rm> // <Rn> and <Rm> both from RQ-R7 


Decode for this encoding 
n = UInt(Rn); m = UInt(Rm); 
(shift_t, shift n) = (SRType_LSL, 0); 


T2 


|15 14 13 12|11 10 9 8|7 6 3 2 ol] 


T2 variant 


CMP{<c>}{<q>} <Rn>, <Rm> // <Rn> and <Rm> not both from RQ-R7 


Decode for this encoding 


n = UInt(N:Rn); m = UInt(Rm); 

(shift_t, shift_n) = (SRType_LSL, Q); 

if n < 8 &&m < 8 then UNPREDICTABLE; 

if n == 15 || m == 15 then UNPREDICTABLE; 
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F5-4156 


CONSTRAINED UNPREDICTABLE behavior 


Ifn < 8 && m < 8, then one of the following behaviors must occur: 


a The instruction is UNDEFINED. 
: The instruction executes as NOP. 
s The instruction executes as described, with no change to its behavior and no additional side effects. 
° The condition flags become UNKNOWN. 
T3 
[15 1413 12/1110 9 8|7 6 5 4|3 0/1514 12/11109 8|7 6 5 4|3 0 | 


Rotate right with extend variant 
Applies when imm3 == 000 && imm2 == 00 && stype == 11. 


CMP{<c>}{<q>} <Rn>, <Rm>, RRX 


Shift or rotate by value variant 
Applies when !(imm3 == 000 && imm2 == 00 && stype == 11). 


CMP{<c>}.W <Rn>, <Rm> // <Rn>, <Rm> can be represented in T1 or T2 
CMP{<c>}{<q>} <Rn>, <Rm>, <shift> #<amount> 


Decode for all variants of this encoding 

n = UInt(Rn); m = UInt(Rm); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2) ; 

if n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 


be used, but this is deprecated. 
For encoding T1 and T3: is the first general-purpose source register, encoded in the "Rn" field. 
For encoding T2: is the first general-purpose source register, encoded in the "N:Rn" field. 

<Rm> For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 


For encoding T1, T2 and T3: is the second general-purpose source register, encoded in the "Rm" 


field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
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LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T3: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], NOT(shifted), '1'); 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.37 CMP (register-shifted register) 
Compare (register-shifted register) subtracts a register-shifted register value from a register value. It updates the 


condition flags based on the result, and discards the result. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16|15 14 13 12|11 8|7 6 5 4|3 0 | 


[=m fo 0 0 4 oft oft] Ran  kokokoko] Rs [o[syeeji] Rm | 


cond 


A1 variant 


CMP{<c>}{<q>} <Rn>, <Rm>, <type> <Rs> 


Decode for this encoding 

n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 

shift_t = DecodeRegShift(stype) ; 

if n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<type> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], NOT(shifted), '1'); 
PSTATE.<N,Z,C,V> = nzcv; 
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Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
° The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.38 


F5-4160 


CPS, CPSID, CPSIE 


Change PE State changes one or more of the PSTATE. {A, I, F} interrupt mask bits and, optionally, the PSTATE.M 
mode field, without changing any other PSTATE bits. 


CPS is treated as NOP if executed in User mode unless it is defined as being CONSTRAINED UNPREDICTABLE elsewhere 
in this section. 


The PE checks whether the value being written to PSTATE.M is legal. See ///egal changes to PSTATE.M on 
page G1-5497. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/1110 9 8|7 6 5 4| 0 | 





1111000100 0 Ofimod|Mfofofofofofofofofalt]Flo] mode | 


CPS variant 
Applies when imod == 00 && M == 


CPS{<q>} #<mode> // Cannot be conditional 


CPSID variant 
Applies when imod == 11 && M == 


CPSID{<q>} <iflags> // Cannot be conditional 


CPSID variant 
Applies when imod == 11 && M == 


CPSID{<q>} <iflags> , #<mode> // Cannot be conditional 


CPSIE variant 
Applies when imod == 10 && M == 


CPSIE{<q>} <iflags> // Cannot be conditional 


CPSIE variant 
Applies when imod == 10 && M == 


CPSIE{<q>} <iflags> , #<mode> // Cannot be conditional 


Decode for all variants of this encoding 


if mode != 'QQQ00' && M == '@' then UNPREDICTABLE; 

if (imod<1> == '1' && A:I:F == '000') || (imod<1> == 'Q' && A:I:F != 'Q00') then UNPREDICTABLE; 
enable = (imod == '10'); disable = (imod == '11'); changemode = (M == '1'); 

affectA = (A == '1'); affectI = (I == '1'); affectF = (F == '1'); 

if (imod == '00' && M == '@') || imod == 'Q@1' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If imod == 'Q1', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
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If imod == 'Q0' && M == 'Q', then one of the following behaviors must occur: 

$ The instruction is UNDEFINED. 

a The instruction executes as NOP. 

If mode != '00000' && M == '0', then one of the following behaviors must occur: 

è The instruction is UNDEFINED. 

$ The instruction executes as NOP. 

e The instruction executes with the additional decode: changemode = TRUE. 

° The instruction executes as described, and the value specified by mode is ignored. There are no additional 


side-effects. 


If imod<1> == '1' && A:I:F == '000', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 

7 The instruction executes as NOP. 

° The instruction behaves as if imod<1> == '0'. 

° The instruction behaves as if A:I:F has an UNKNOWN nonzero value. 

If imod<1> == '@' && A:I:F != '000', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

e The instruction behaves as if imod<1> == '1'. 


° The instruction behaves as if A:I:F == '000'. 
T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0] 


MEEKEEEEHODODOG 


CPSID variant 
Applies when im == 


CPSID{<q>} <iflags> // Not permitted in IT block 


CPSIE variant 
Applies when im == 


CPSIE{<q>} <iflags> // Not permitted in IT block 


Decode for all variants of this encoding 


if A:I:F == '000' then UNPREDICTABLE; 

enable = (im == '@'); disable = (im == '1'); changemode = FALSE; 
affectA = (A == '1'); affectI = (I == '1'); affectF = (F == '1'); 
if InITBlock() then UNPREDICTABLE; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4161 
Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


CONSTRAINED UNPREDICTABLE behavior 


IfA:1I:F == '000', then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
T2 
15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0151413 12|1110 9 8|7 6 5 4| 0| 


H1110 0111 01 okooko okoo koimoajm]ajijE| mode | 





CPS variant 
Applies when imod == 00 && M == 


CPS{<q>} #<mode> // Not permitted in IT block 


CPSID variant 
Applies when imod == 11 && M == 


CPSID.W <iflags> // Not permitted in IT block 


CPSID variant 
Applies when imod == 11 && M == 


CPSID{<q>} <iflags>, #<mode> // Not permitted in IT block 


CPSIE variant 
Applies when imod == 10 && M == 


CPSIE.W <iflags> // Not permitted in IT block 


CPSIE variant 
Applies when imod == 10 && M == 


CPSIE{<q>} <iflags>, #<mode> // Not permitted in IT block 


Decode for all variants of this encoding 


if imod == '00' && M == '@' then SEE "Hint instructions"; 

if mode != '00000' && M == '@' then UNPREDICTABLE; 

if (imod<1> == '1' && A:I:F == '000') || (imod<1> == 'Q' && A:I:F != 'Q00') then UNPREDICTABLE; 
enable = (imod == '10'); disable = (imod == '11'); changemode = (M == '1'); 

affectA = (A == '1'); affectI = (I == '1'); affectF = (F = '1'); 

if imod == '01' || InITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If imod == '01', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
If mode != '00000' && M == '0', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
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° The instruction executes as NOP. 
° The instruction executes with the additional decode: changemode = TRUE. 
. The instruction executes as described, and the value specified by mode is ignored. There are no additional 


side-effects. 


If imod<1> == '1' && A:I:F == '000', then one of the following behaviors must occur: 
e The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction behaves as if imod<1> == '0'. 

° The instruction behaves as if A:I:F has an UNKNOWN nonzero value. 

If imod<1> == '@' && A:I:F != '000', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction behaves as if imod<1> == '1'. 


° The instruction behaves as if A:I:F == '000'. 


Notes for all encodings 


Hint instructions: In encoding T2, if the imod field is 00 and the M bit is 0, a hint instruction is encoded. To determine 
which hint instruction, see Branches and miscellaneous control on page F3-3979. 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<iflags> Is a sequence of one or more of the following, specifying which interrupt mask bits are affected: 
a Sets the A bit in the instruction, causing the specified effect on PSTATE.A, the SError 
interrupt mask bit. 
i Sets the I bit in the instruction, causing the specified effect on PSTATE.I, the IRQ 
interrupt mask bit. 
f Sets the F bit in the instruction, causing the specified effect on PSTATE.F, the FIQ 


interrupt mask bit. 


<mode> Is the number of the mode to change to, in the range 0 to 31, encoded in the "mode" field. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 
EncodingSpecificOperations(); 
if PSTATE.EL != ELO then 
if enable then 


if affectA then PSTATE.A = '0'; 

if affectI then PSTATE.I = '0'; 

if affectF then PSTATE.F = 'Q'; 
if disable then 

if affectA then PSTATE.A = '1'; 

if affectI then PSTATE.I = '1'; 


if affectF then PSTATE.F = '1'; 
if changemode then 
// AArch32.WriteModeByInstr() sets PSTATE.IL to 1 if this is an illegal mode change. 
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AArch32.WriteModeByInstr(mode) ; 
else 
EncodingSpecificOperations(); 
if PSTATE.EL != ELO then 
if enable then 
if affectA then PSTATE.A = 'Q'; 
if affectI then PSTATE.I = 'Q'; 
if affectF then PSTATE.F = 'Q'; 
if disable then 
if affectA then PSTATE.A = '1'; 
if affectI then PSTATE.I = '1'; 
if affectF then PSTATE.F = '1'; 
if changemode then 
// AArch32.WriteModeByInstr() sets PSTATE.IL to 1 if this is an illegal mode change. 
AArch32.WriteModeByInstr(mode) ; 
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F5.1.39 CRC32 


ARM DDI 0487E.a 
ID070919 


CRC32 performs a cyclic redundancy check (CRC) calculation on a value held in a general-purpose register. It takes 
an input CRC value in the first source operand, performs a CRC on the input value in the second source operand, 

and returns the output CRC value. The second source operand can be 8, 16, or 32 bits. To align with common usage, 
the bit order of the values is reversed as part of the operation, and the polynomial 0x04C11DB7 is used for the CRC 

calculation. 


In Armv8-A, this is an OPTIONAL instruction, and in Armv8.1 it is mandatory for all implementations to implement 
it. 





Note 
ID_ISARS.CRC32 indicates whether this instruction is supported in the T32 and A32 instruction sets. 





A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Derm [oo 07 0] zo] en | Rd ofojofojo 1 oo] Rm | 


cond C 


CRC32B variant 
Applies when sz == 00. 


CRC32B{<q>} <Rd>, <Rn>, <Rm> 


CRC32H variant 
Applies when sz == 01. 


CRC32H{<q>} <Rd>, <Rn>, <Rm> 


CRC32W variant 
Applies when sz == 10. 


CRC32W{<q>} <Rd>, <Rn>, <Rm> 


Decode for all variants of this encoding 


if ! HaveCRCExt() then UNDEFINED; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

size = 8 << UInt(sz); 

crc32c = (C == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if size == 64 then UNPREDICTABLE; 

if cond != '1110' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If size == 64, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction executes with the additional decode: size = 32;. 
If cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
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F5-4166 


° The instruction executes unconditionally. 
° The instruction executes conditionally. 
T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiit707071 0] Re ira) Rd oja] Rn | 
C 


CRC32B variant 
Applies when sz == 00. 


CRC32B{<q>} <Rd>, <Rn>, <Rm> 


CRC32H variant 
Applies when sz == 01. 


CRC32H{<q>} <Rd>, <Rn>, <Rm> 


CRC32W variant 
Applies when sz == 10. 


CRC32W{<q>} <Rd>, <Rn>, <Rm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if ! HaveCRCExt() then UNDEFINED; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

size = 8 << UInt(sz); 

crc32c = (C == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if size == 64 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If size == 64, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction executes with the additional decode: size = 32;. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. An CRC32 instruction must be unconditional. 
<Rd> Is the general-purpose accumulator output register, encoded in the "Rd" field. 
<Rn> Is the general-purpose accumulator input register, encoded in the "Rn" field. 
<Rm> Is the general-purpose data source register, encoded in the "Rm" field. 
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Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 


acc = R[n]; // accumulator 

val = R[m]<size-1:0>; // input value 

poly = (if crc32c then @x1EDC6F41 else 0x04C11DB7)<31:0>; 

tempacc = BitReverse(acc) :Zeros(size); 

tempval = BitReverse(val):Zeros(32); 

// Poly32Mod2 on a bitstring does a polynomial Modulus over {0,1} operation 
R[d] = BitReverse(Poly32Mod2(tempacc EOR tempval, poly)); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.40 CRC32C 


CRC32C performs a cyclic redundancy check (CRC) calculation on a value held in a general-purpose register. It takes 
an input CRC value in the first source operand, performs a CRC on the input value in the second source operand, 

and returns the output CRC value. The second source operand can be 8, 16, or 32 bits. To align with common usage, 
the bit order of the values is reversed as part of the operation, and the polynomial 0x1EDC6F41 is used for the CRC 

calculation. 


In Armv8-A, this is an OPTIONAL instruction, and in Armv8.1 it is mandatory for all implementations to implement 
it. 





Note 
ID_ISARS.CRC32 indicates whether this instruction is supported in the T32 and A32 instruction sets. 





A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Derm [oo 07 o[ fo] en | Rd OOo 1 oo] Rm | 
C 


cond 


CRC32CB variant 
Applies when sz == 00. 


CRC32CB{<q>} <Rd>, <Rn>, <Rm> 


CRC32CH variant 
Applies when sz == 01. 


CRC32CH{<q>} <Rd>, <Rn>, <Rm> 


CRC32CW variant 
Applies when sz == 10. 


CRC32CW{<q>} <Rd>, <Rn>, <Rm> 


Decode for all variants of this encoding 


if ! HaveCRCExt() then UNDEFINED; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

size = 8 << UInt(sz); 

crc32c = (C == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if size == 64 then UNPREDICTABLE; 

if cond != '1110' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If size == 64, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction executes with the additional decode: size = 32;. 
If cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
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° The instruction executes unconditionally. 
° The instruction executes conditionally. 
T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitio70i of] em poira Rd oje] Rn | 
C 


CRC32CB variant 
Applies when sz == 00. 


CRC32CB{<q>} <Rd>, <Rn>, <Rm> 


CRC32CH variant 
Applies when sz == 01. 


CRC32CH{<q>} <Rd>, <Rn>, <Rm> 


CRC32CW variant 
Applies when sz == 10. 


CRC32CW{<q>} <Rd>, <Rn>, <Rm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if ! HaveCRCExt() then UNDEFINED; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

size = 8 << UInt(sz); 

crc32c = (C == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if size == 64 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If size == 64, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction executes with the additional decode: size = 32;. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. An CRC32C instruction must be 
unconditional. 

<Rd> Is the general-purpose accumulator output register, encoded in the "Rd" field. 

<Rn> Is the general-purpose accumulator input register, encoded in the "Rn" field. 

<Rm> Is the general-purpose data source register, encoded in the "Rm" field. 
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F5-4170 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 


acc = R[n]; // accumulator 

val = R[m]<size-1:0>; // input value 

poly = (if crc32c then @x1EDC6F41 else 0x04C11DB7)<31:0>; 

tempacc = BitReverse(acc) :Zeros(size); 

tempval = BitReverse(val):Zeros(32); 

// Poly32Mod2 on a bitstring does a polynomial Modulus over {0,1} operation 
R[d] = BitReverse(Poly32Mod2(tempacc EOR tempval, poly)); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.41 CSDB 


ARM DDI 0487E.a 
ID070919 


Consumption of Speculative Data Barrier is a memory barrier that controls speculative execution and data value 


prediction. 


No instruction other than branch instructions and instructions that write to the PC appearing in program order after 


the CSDB can be speculatively executed using the results of any: 


° Data value predictions of any instructions. 


° PSTATE. {N,Z,C,V } predictions of any instructions other than conditional branch instructions and 


conditional instructions that write to the PC appearing in program order before the CSDB that have not been 


architecturally resolved. 





Note 
For purposes of the definition of CSDB, PSTATE. {N,Z,C,V } is not considered a data value. This definition permits: 
° Control flow speculation before and after the CSDB. 
° Speculative execution of conditional data processing instructions after the CSDB, unless they use the results 


of data value or PSTATE. {N,Z,C,V} predictions of instructions appearing in program order before the CSDB 


that have not been architecturally resolved. 





A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|1110 9 8|7 6 5 4|3 2 1 0| 


| 11111 jo o 1 1 ojoļı ojo o o okoko ooo 0 0 1 0 1 0 0 


cond 


A1 variant 


CSDB{<c>}{<q>} 


Decode for this encoding 


if cond != '1110' then UNPREDICTABLE; // CSDB must be encoded with AL condition 


CONSTRAINED UNPREDICTABLE behavior 


If cond != '1110', then one of the following behaviors must occur: 
e The instruction is UNDEFINED. 

e The instruction executes as NOP. 

. The instruction executes unconditionally. 

° The instruction executes conditionally. 

T1 


15 14 13 1211110 9 8|7 6 5 4|3 2 1 0/15141312/11109 8/7 6 5 4/3 2 1 0| 


771 oOoT1 107 OM? ofopojofo co ofo oo io10 


T1 variant 


CSDB{<c>}.W 
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Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 

z The instruction executes as NOP. 

° The instruction executes unconditionally. 
° The instruction executes conditionally. 


Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 

<c> See Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 


ConsumptionOfSpeculativeDataBarrier(); 
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F5.1.42 DBG 


In Armv8, DBG executes as a NOP. Arm deprecates any use of the DBG instruction. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4|3 0| 


Cem [oo 17 ojo ojo ojo o KONONO 111 1] option | 


cond 


A1 variant 


DBG{<c>}{<q>} #<option> 


Decode for this encoding 


// DBG executes as a NOP. The 'option' field is ignored 


T1 


15 14 13 1211110 9 8|7 6 5 4/3 2 1 0151413 12|1110 9 8|7 6 5 4/3 0| 


ToT T0071 101 Of ofofofoyo oo] 111] option _| 


T1 variant 


DBG{<c>}{<q>} #<option> 


Decode for this encoding 


// DBG executes as a NOP. The 'option' field is ignored 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<option> Is a 4-bit unsigned immediate, in the range 0 to 15, encoded in the "option" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
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F5.1.43 DCPS1 


Debug Change PE State to EL1 allows the debugger to move the PE into EL1 from ELO or to a specific mode at the 


F5-4174 


current Exception Level. 
DCPS1 is UNDEFINED if any of: 
° The PE is in Non-debug state. 


k EL2 is implemented, EL2 is implemented and enabled in the current Security state, and any of: 
—  EL2 is using AArch32 and HCR.TGE is set to 1. 
—  EL2 is using AArch64 and HCR_EL2.TGE is set to 1. 


When the PE executes DCPS1 at ELO, EL1 or EL3: 


. If EL3 or EL1 is using AArch32, the PE enters SVC mode and LR_svc, SPSR_svc, DLR, and DSPSR 
become UNKNOWN. If DCPS1 is executed in Monitor mode, SCR.NS is cleared to 0. 


° If EL1 is using AArch64, the PE enters EL1 using AArch64, selects SP_EL1, and ELR_EL1, ESR_EL1, 
SPSR_EL1, DLR_ELO and DSPSR_ELO become UNKNOWN. 


When the PE executes DCPS1 at EL2 the PE does not change mode, and ELR_hyp, HSR, SPSR_hyp, DLR and 
DSPSR become UNKNOWN. 


For more information on the operation of this instruction, see DCPS<n> on page H2-6731. 
T1 


15 14 13 1211110 9 8|7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 2 1 0| 


11110111100 0|11 1 1|1000ļ00000000 0 0/0 1| 


T1 variant 


DCPS1 


Decode for this encoding 


// No additional decoding required. 


Operation 
if !Halted() then UNDEFINED; 


if EL2Enabled() && PSTATE.EL == ELO then 
tge = if ELUsingAArch32(EL2) then HCR.TGE else HCR_EL2.TGE; 
if tge == '1' then UNDEFINED; 


if PSTATE.EL != EL@ || ELUsingAArch32(EL1) then 
if PSTATE.M == M32_Monitor then SCR.NS = 'Q'; 
if PSTATE.EL != EL2 then 
AArch32.WriteMode(M32_Svc); 
PSTATE.E = SCTLR.EE; 
if HavePANExt() && SCTLR.SPAN == '@' then PSTATE.PAN = '1'; 
LR_svc = bits(32) UNKNOWN; 
SPSR_svc = bits(32) UNKNOWN; 
else 
PSTATE.E = HSCTLR.EE; 
ELR_hyp = bits(32) UNKNOWN; 
HSR = bits(32) UNKNOWN; 
SPSR_hyp = bits(32) UNKNOWN; 


DLR = bits(32) UNKNOWN; 
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DSPSR = bits(32) UNKNOWN; 

else 
AArch64.MaybeZeroRegisterUppers(); 
MaybeZeroSVEUppers(EL1) ; 
PSTATE.nRW = 'Q'; 
PSTATE.SP = '1'; 
PSTATE.EL = EL1; 
if HavePANExt() && SCTLR_EL1.SPA 
if HaveUAOExt() then PSTATE.UAO = '0'; 


ELR_EL1 = bits(64) UNKNOWN; 
ESR_EL1 = bits(32) UNKNOWN; 
SPSR_EL1 = bits(32) UNKNOWN; 


DLR_EL@ = bits(64) UNKNOWN; 
DSPSR_EL@ = bits(32) UNKNOWN; 


// Targeting EL1 using AArch64 


== 'Q' then PSTATE.PAN = '1'; 


// SCTLR_EL1.IESB might be ignored in Debug state. 


if HaveIESB() && SCTLR_EL1.IESB == '1' && 
then 
SynchronizeErrors(); 


UpdateEDSCRFields(); 
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F5.1.44 DCPS2 
Debug Change PE State to EL2 allows the debugger to move the PE into EL2 from a lower Exception level. 
DCPS2 is UNDEFINED if any of: 
. The PE is in Non-debug state. 
. EL2 is not implemented. 
$ The PE is in Secure state and any of: 


— Secure EL2 is not implemented. 


— Secure EL2 is implemented and Secure EL2 is disabled. 


When the PE executes DCPS2: 


a If EL2 is using AArch32, the PE enters Hyp mode and ELR_hyp, HSR, SPSR_hyp, DLR and DSPSR 
become UNKNOWN. 


$ If EL2 is using AArch64, the PE enters EL2 using AArch64, selects SP_EL2, and ELR_EL2, ESR_EL2, 
SPSR_EL2, DLR_ELO and DSPSR_ELO become UNKNOWN. 


For more information on the operation of this instruction, see DCPS<n> on page H2-6731. 
T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0|15141312/11109 8|7 6 5 4/3 2 10] 


11110111100 0/1 1 1 1ļ1 0 0-0/0 00 00 0.00 0 0/1 0] 


T1 variant 


DCPS2 


Decode for this encoding 


if !HaveEL(EL2) then UNDEFINED; 


Operation 
if !Halted() || IsSecure() then UNDEFINED; 


if ELUsingAArch32(EL2) then 
AArch32.WriteMode(M32_Hyp); 
PSTATE.E = HSCTLR.EE; 


ELR_hyp = bits(32) UNKNOWN; 
HSR = bits(32) UNKNOWN; 
SPSR_hyp = bits(32) UNKNOWN; 


DLR = bits(32) UNKNOWN; 
DSPSR = bits(32) UNKNOWN; 
else // Targeting EL2 using AArch64 
AArch64.MaybeZeroRegisterUppers(); 
MaybeZeroSVEUppers(EL2) ; 
PSTATE.nRW = 'Q'; 
PSTATE.SP = '1'; 
PSTATE.EL = EL2; 
if HavePANExt() && SCTLR_EL2.SPAN == '@' && HCR_EL2.E2H == '1' && HCR_EL2.TGE == '1' then 
PSTATE.PAN = '1'; 
if HaveUAOExt() then PSTATE.UAO = '0'; 


ELR_EL2 = bits(64) UNKNOWN; 
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ESR_EL2 = bits(32) UNKNOWN; 
SPSR_EL2 = bits(32) UNKNOWN; 


DLR_EL@ = bits(64) UNKNOWN; 
DSPSR_EL@ = bits(32) UNKNOWN; 


// SCTLR_EL2.IESB might be ignored in Debug state. 
if HaveIESB() && SCTLR_EL2.IESB == '1' && !ConstrainUnpredictab]eBool (Unpredictable_IESBinDebug) 


then 
SynchronizeErrors(); 
UpdateEDSCRFields(); // Update EDSCR PE state flags 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4177 


ID070919 Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.45 


F5-4178 


DCPS3 


Debug Change PE State to EL3 allows the debugger to move the PE into EL3 from a lower Exception Level or to 
a specific mode at the current Exception Level. 


DCPS3 is UNDEFINED if any of: 


The PE is in Non-debug state. 
EL3 is not implemented. 


EDSCR.SDD is set to 1. 


When the PE executes DCPS3: 


If EL3 is using AArch32, the PE enters Monitor mode and LR_mon, SPSR_mon, DLR and DSPSR become 


UNKNOWN. If DCPS3 is executed in Monitor mode, SCR.NS is cleared to 0. 


If EL3 is using AArch64, the PE enters EL3 using AArch64, selects SP_EL3, and ELR_EL3, ESR_EL3, 


SPSR_EL3, DLR_ELO and DSPSR_ELO become UNKNOWN. 


For more information on the operation of this instruction, see DCPS<n> on page H2-6731. 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0|15141312/11109 8|7 6 5 4/3 2 10] 


11110111100 0/1 11 1ļ100o0oļ0o0000000 0of1 1] 


T1 variant 


DCPS3 


Decode for this encoding 


if !HaveEL(EL3) then UNDEFINED; 


Operation 


if !Halted() || EDSCR.SDD == '1' then UNDEFINED; 


if ELUsingAArch32(EL3) then 


from_secure = IsSecure(); 
if PSTATE.M == M32_Monitor then SCR.NS = 'Q'; 
AArch32.WriteMode(M32_Monitor) ; 
if HavePANExt() then 
if !from_secure then 
PSTATE.PAN = 'Q'; 
elsif SCTLR.SPAN == 'Q@' then 
PSTATE.PAN = '1'; 
PSTATE.E = SCTLR.EE; 


LR_mon = bits(32) UNKNOWN; 
SPSR_mon = bits(32) UNKNOWN; 


DLR = bits(32) UNKNOWN; 
DSPSR = bits(32) UNKNOWN; 


else // Targeting EL3 using AArch64 


AArch64.MaybeZeroRegisterUppers(); 
MaybeZeroSVEUppers(EL3) ; 

PSTATE.nRW = 'Q'; 

PSTATE.SP = '1'; 

PSTATE.EL = EL3; 

if HaveUAOExt() then PSTATE.UAO = '0'; 
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ELR_EL3 = bits(64) UNKNOWN; 
ESR_EL3 = bits(32) UNKNOWN; 
SPSR_EL3 = bits(32) UNKNOWN; 


DLR_EL@ = bits(64) UNKNOWN; 
DSPSR_EL@ = bits(32) UNKNOWN; 


sync_errors = HavelIESB() && SCTLR_EL3.IESB == '1'; 

if HaveDoubleFaultExt() && SCR_EL3.EA == '1' && SCR_EL3.NMEA == '1' then 
sync_errors = TRUE; 

// SCTLR_EL3.IESB might be ignored in Debug state. 

if !ConstrainUnpredictableBool (Unpredictable_IESBinDebug) then 
sync_errors = FALSE; 

if sync_errors then SynchronizeErrors(); 


UpdateEDSCRFields(); // Update EDSCR PE state flags 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4179 
Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.46 DMB 


Data Memory Barrier is a memory barrier that ensures the ordering of observations of memory accesses, see Data 
Memory Barrier (DMB) on page E2-3824. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4/3 0| 





A1 variant 


DMB{<c>}{<q>} {<option>} 


Decode for this encoding 


// No additional decoding required 


T1 


15 14 13 1211110 9 8/7 6 5 4/3 2 1 0151413 12|1110 9 8|7 6 5 4/3 0| 





1110011101 At okoo kooo a o 1] option | 


T1 variant 
DMB{<c>}{<q>} {<option>} 
Decode for this encoding 


// No additional decoding required 


Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. Must be AL or omitted. 
For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<option> Specifies an optional limitation on the barrier operation. Values are: 
SY Full system is the required shareability domain, reads and writes are the required access 


types, both before and after the barrier instruction. Can be omitted. This option is 
referred to as the full system barrier. Encoded as option = 0b1111. 


ST Full system is the required shareability domain, writes are the required access type, both 
before and after the barrier instruction. SYST is a synonym for ST. Encoded as option = 
0b1110. 

LD Full system is the required shareability domain, reads are the required access type before 


the barrier instruction, and reads and writes are the required access types after the barrier 
instruction. Encoded as option = 0b1101. 
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Inner Shareable is the required shareability domain, reads and writes are the required 
access types, both before and after the barrier instruction. Encoded as option = 0b1011. 


Inner Shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as option = 0b1010. 


Inner Shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as option = 0b1001. 


Non-shareable is the required shareability domain, reads and writes are the required 
access, both before and after the barrier instruction. Encoded as option = 0b0111. 


Non-shareable is the required shareability domain, writes are the required access type 
both before and after the barrier instruction. Encoded as option = 0b0110. 


Non-shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as option = 0b0101. 


Outer Shareable is the required shareability domain, reads and writes are the required 
access types, both before and after the barrier instruction. Encoded as option = 0b0Q11. 


Outer Shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as option = 0b0010. 


Outer Shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as option = 0b0001. 


For more information on whether an access is before or after a barrier instruction, see Data Memory 
Barrier (DMB) on page E2-3824. All other encodings of option are reserved. All unsupported and 
reserved options must execute as a full system DMB operation, but software must not rely on this 
behavior. 





Note 


The instruction supports the following alternative <option> values, but Arm recommends that 
software does not use these alternative values: 


SH as an alias for ISH. 
SHST as an alias for ISHST. 
UN as an alias for NSH. 


UNST as an alias for NSHST. 





Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 


case opt 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
othe 


ion of 
"Q001' 
"0010" 
"Q011' 
"Q101' 
"Q110' 
"Q111' 
"1001" 
"1010' 
"1011' 
"1101' 
'1110' 

rwise 


domain = MBReqDomain_OuterShareable; types = MBReqlypes_Reads; 
domain = MBReqDomain_OuterShareable; types = MBReqlypes_Writes; 
domain = MBReqDomain_OuterShareable; types = MBReqlypes_All1; 
domain = MBReqDomain_Nonshareable; types = MBReqTypes_Reads; 
domain = MBReqDomain_Nonshareable; types = MBReqlypes_Writes; 
domain = MBReqDomain_Nonshareable; types = MBReqTlypes_All 
domain = MBReqDomain_InnerShareable; types = MBReqTypes_Reads; 
domain = MBReqDomain_InnerShareable; types = MBReqlypes_Writes; 
domain = MBReqDomain_InnerShareable; types = MBReqlypes_All1; 








domain = MBReqDomain_Ful1System; types = MBReqTypes_Reads; 
domain = MBReqDomain_Ful1System; types = MBReqlypes_Writes; 
domain = MBReqDomain_Ful1System; types = MBReqTypes_Al1; 


if PSTATE.EL IN {EL@, EL1} && EL2Enabled() then 


if H 


(CR.BS 
domain 


== '11' then 
= MBReqDomain_Ful1lSystem; 


if HCR.BSU == '10' && domain != MBReqDomain_FullSystem then 
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domain = MBReqDomain_OuterShareable; 
if HCR.BSU == 'Q1' && domain == MBReqDomain_Nonshareable then 
domain = MBReqDomain_InnerShareable; 


DataMemoryBarrier(domain, types); 
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F5.1.47 DSB 


Data Synchronization Barrier is a memory barrier that ensures the completion of memory accesses, see Data 
Synchronization Barrier (DSB) on page E2-3824. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4/3 0| 





option 


A1 variant 


DSB{<c>}{<q>} {<option>} 


Decode for this encoding 


// No additional decoding required 


T1 


15 14 13 1211110 9 8|7 6 5 4|3 2 1 0|15141312/11109 8|7 6 5 4/3 0| 





1110011101 AAA] okoo ookoo a o of 0x00 


option 


T1 variant 


DSB{<c>}{<q>} {<option>} 


Decode for this encoding 


// No additional decoding required 


Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. Must be AL or omitted. 
For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<option> Specifies an optional limitation on the barrier operation. Values are: 
SY Full system is the required shareability domain, reads and writes are the required access 


types, both before and after the barrier instruction. Can be omitted. This option is 
referred to as the full system barrier. Encoded as option = 0b1111. 


ST Full system is the required shareability domain, writes are the required access type, both 
before and after the barrier instruction. SYST is a synonym for ST. Encoded as option = 
0b1110. 

LD Full system is the required shareability domain, reads are the required access type before 


the barrier instruction, and reads and writes are the required access types after the barrier 
instruction. Encoded as option = 0b1101. 
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F5-4184 


ISH 


ISHST 


ISHLD 


NSH 


NSHST 


NSHLD 


OSH 


OSHST 


OSHLD 


Inner Shareable is the required shareability domain, reads and writes are the required 
access types, both before and after the barrier instruction. Encoded as option = 0b1011. 


Inner Shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as option = 0b1010. 


Inner Shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as option = 0b1001. 


Non-shareable is the required shareability domain, reads and writes are the required 
access, both before and after the barrier instruction. Encoded as option = 0b0111. 


Non-shareable is the required shareability domain, writes are the required access type 
both before and after the barrier instruction. Encoded as option = 0b0110. 


Non-shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as option = 0b0101. 


Outer Shareable is the required shareability domain, reads and writes are the required 
access types, both before and after the barrier instruction. Encoded as option = 0b0Q11. 


Outer Shareable is the required shareability domain, writes are the required access type, 
both before and after the barrier instruction. Encoded as option = 0b0010. 


Outer Shareable is the required shareability domain, reads are the required access type 
before the barrier instruction, and reads and writes are the required access types after the 
barrier instruction. Encoded as option = 0b0001. 


For more information on whether an access is before or after a barrier instruction, see Data 
Synchronization Barrier (DSB) on page E2-3824. All other encodings of option are reserved. All 
unsupported and reserved options must execute as a full system DSB operation, but software must 
not rely on this behavior. 





Note 


The instruction supports the following alternative <option> values, but Arm recommends that 
software does not use these alternative values: 


SH as an alias for ISH. 
SHST as an alias for ISHST. 
UN as an alias for NSH. 


UNST as an alias for NSHST. 





Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 


case option of 
when 'QQQ1' 
when '0010' 
when 'QQ11' 
when 'Q101' 
when 'Q110' 
when 'Q111' 
when '10Q1' 
when '1010' 
when '1011' 
when '1101' 
when '1110' 
otherwise 
if 
elsif 
else 


if PSTATE.EL IN 


domain = MBReqDomain_OuterShareable; types = MBReqTypes_Reads; 
domain = MBReqDomain_OuterShareable; types = MBReqlypes_Writes; 
domain = MBReqDomain_OuterShareable; types = MBReqTypes_All1; 

domain = MBReqDomain_Nonshareable; types = MBReqTypes_Reads; 
domain = MBReqDomain_Nonshareable; types = MBReqlypes_Writes; 
domain = MBReqDomain_Nonshareable; types = MBReqTypes_Al1; 

domain = MBReqDomain_InnerShareable; types = MBReqlypes_Reads; 
domain = MBReqDomain_InnerShareable; types = MBReqlypes_Writes; 
domain = MBReqDomain_InnerShareable; types = MBReqlypes_All; 

domain = MBReqDomain_Ful1System; types = MBReqTypes_Reads; 
domain = MBReqDomain_Ful1System; types = MBReqlypes_Writes; 





option == '0000' then SEE "SSBB"; 
option == '0100' then SEE "PSSBB"; 
domain = MBReqDomain_Ful1System; types = MBReqTypes_Al1; 


{EL@, EL1} && EL2Enabled() then 
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if HCR.BSU == '11' then 
domain = MBReqDomain_Ful1System; 

if HCR.BSU == '10' && domain != MBReqDomain_FullSystem then 
domain = MBReqDomain_OuterShareable; 

if HCR.BSU == '01' && domain == MBReqDomain_Nonshareable then 
domain = MBReqDomain_InnerShareable; 


DataSynchronizationBarrier(domain, types); 
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F5.1.48 EOR, EORS (immediate) 


Bitwise Exclusive OR (immediate) performs a bitwise Exclusive OR of a register value and an immediate value, 
and writes the result to the destination register. 


If the destination register is not the PC, the EORS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


s The EOR variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

è The EORS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

31 28|27 26 25 24|23 22 21 20|19 1615 1211 | | 0 | 
!=1111 |o o 1 ofo o 1fs| Rn | Ra [| immi2_— žăě | 
cond 

EOR variant 


Applies when S == 0. 

EOR{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
EORS variant 

Applies when S == 1. 

EORS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); 
(imm32, carry) = A32ExpandImm_C(imm12, PSTATE.C); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 01514 12\11 8|7 | 0 | 


[741 of fojo to os] Ra Jo) imma] Ra | me | 


EOR variant 

Applies when S == 0. 

EOR{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
EORS variant 


Applies when S == 1 && Rd != 1111. 
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EORS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


if Rd == '1111' && S == '1' then SEE "TEQ (immediate)"; 
d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); 
(imm32, carry) = T32ExpandImm_C(i:imm3:imm8, PSTATE.C); 
if (d == 15 && !setflags) || n == 15 then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 
e For the EOR variant, the instruction is a branch to the address calculated by the operation. 


This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


s For the EORS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 


<Rn> For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 


For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 


<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = R[n] EOR imm32; 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result) ; 
PSTATE.C = carry; 
// PSTATE.V unchanged 
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Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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EOR, EORS (register) 


Bitwise Exclusive OR (register) performs a bitwise Exclusive OR of a register value and an optionally-shifted 


register value, and writes the result to the destination register. 


If the destination register is not the PC, the EORS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 


deprecates any use of these encodings. However, when the destination register is the PC: 


s The EOR variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The EORS variant of the instruction performs an exception return without the use of the stack. In this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 7 6 5 4|3 


[ 111 jo o o ojoo 1js| Rn | Ra | imm5  [styejo] Rm | 


cond 


EOR, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


EOR{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


EOR, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 


EOR{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


EORS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


EORS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


EORS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


EORS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
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F5-4190 


T1 


[15 14 13 121110 9 8|7 65 |32 0l] 


T1 variant 


EOR<c>{<q>} {<Rdn>,} <Rdn>, <Rm> // Inside IT block 
EORS{<q>} {<Rdn>,} <Rdn>, <Rm> // Outside IT block 


Decode for this encoding 
d = UInt(Rdn); n = UInt(Rdn); m = UInt(Rm); setflags = !InITBlock(); 
(shift t, shift n) = (SRType_LSL, 0); 


T2 


[15 14 13 121110 9 8|7 6 5 4|3 01514  12|11 8|7 6 5 4|3 0| 


1110101010 ofs} Rn [of imm3 | Ra _ |imm2|stye| Rm | 


EOR, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


EOR{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


EOR, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


EOR<c>.W {<Rd>,} <Rn>, <Rm> // Inside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
EOR{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


EORS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && Rd != 1111 && imm2 == 00 && stype == 11. 


EORS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


EORS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11) && Rd != 1111. 


EORS.W {<Rd>,} <Rn>, <Rm> // Outside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
EORS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


if Rd == '1111' && S == '1' then SEE "TEQ (register)"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if (d == 15 && !setflags) || n == 15 || m == 15 then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 
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Assembler symbols 


<C> 


<q> 


<Rdn> 


<Rd> 


<Rn> 


<Rm> 


<shift> 


<amount> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the first general-purpose source register and the destination register, encoded in the "Rdn" field. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 


° For the EOR variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


. For the EORS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T2: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 

For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used, but this is deprecated. 

For encoding T2: is the first general-purpose source register, encoded in the "Rn" field. 

For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 

For encoding T1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 


Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 


LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "Imm3:imm2" field as <amount> modulo 32. 


In T32 assembly: 


. Outside an IT block, if EORS <Rd>, <Rn>, <Rd> has <Rd> and <Rn> both in the range RO-R7, it is assembled 
using encoding T1 as though EORS <Rd>, <Rn> had been written 


. Inside an IT block, if EOR<c> <Rd>, <Rn>, <Rd> has <Rd> and <Rn> both in the range RO-R7, it is assembled 
using encoding T1 as though EOR<c> <Rd>, <Rn> had been written. 


To prevent either of these happening, use the .W qualifier. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] EOR shifted; 
if d == 15 then // Can only occur for A32 encoding 


if setflags then 
ALUExceptionReturn(result) ; 


ALUWritePC(result) ; 
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else 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.50 EOR, EORS (register-shifted register) 


ARM DDI 0487E.a 
ID070919 


Bitwise Exclusive OR (register-shifted register) performs a bitwise Exclusive OR of a register value and a 
register-shifted register value. It writes the result to the destination register, and can optionally update the condition 
flags based on the result. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 
| !'=1111 fo o o ojo o [s| Rn | Ra | Rs Jofstype] 1] Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


EORS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


EOR{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype) ; 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 
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Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] EOR shifted; 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.51 ERET 


ARM DDI 0487E.a 
ID070919 


Exception Return. 


The PE branches to the address held in the register holding the preferred return address, and restores PSTATE from 
SPSR_<current_mode>. 


The register holding the preferred return address is: 
. ELR hyp, when executing in Hyp mode. 
. LR, when executing in a mode other than Hyp mode, User mode, or System mode. 


The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from AArch32 state on 
page G1-5524. 


Exception Return is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


In Debug state, the T1 encoding of ERET executes the DRPS operation. 


A1 


31 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/1110 9 8/7 6 5 4/3 2 1 0| 





cond 


A1 variant 


ERET{<c>}{<q>} 


Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0/15141312/11109 8/7 6 5 4/3 2 1 0| 


77 tootT 111071 11 Of1 COMM 0000000 


T1 variant 


ERET{<c>}{<q>} 


Decode for this encoding 


if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4195 


Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if !Halted() then 
if PSTATE.M IN {M32_User,M32_System} then 
UNPREDICTABLE; // UNDEFINED or NOP 
else 
new_pc_value = if PSTATE.EL == EL2 then ELR_hyp else R[14]; 
AArch32.ExceptionReturn(new_pc_value, SPSR[]); 


else // Perform DRPS operation in Debug state 
if PSTATE.M == M32_User then 
UNDEFINED; 
elsif PSTATE.M == M32_System then 
UNPREDICTABLE; // UNDEFINED or NOP 
else 
SynchronizeContext(); 


SetPSTATEFromPSR(SPSR[]); 

// PSTATE.{N,Z,C,V,Q,GE,SS,A,1,F} are not observable and ignored in Debug state, so 
// behave as if UNKNOWN. 

PSTATE.<N,Z,C,V,Q,GE,SS,A,I,F> = bits(13) UNKNOWN; 

// In AArch32 Debug state, all instructions are T32 and unconditional. 


PSTATE.IT = '@0000000'; PSTATE.T = '1'; // PSTATE.J is RESO 
DLR = bits(32) UNKNOWN; DSPSR = bits(32) UNKNOWN; 
UpdateEDSCRFields(); // Update EDSCR PE state flags 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.M IN {M32_User,M32_System}, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
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Error Synchronization Barrier is an error synchronization event that might also update DISR and VDISR. This 
instruction can be used at all Exception levels and in Debug state. 


In Debug state, this instruction behaves as if SError interrupts are masked at all Exception levels. See Error 
Synchronization Barrier in the ARM(R) Reliability, Availability, and Serviceability (RAS) Specification, ARMv8, 
for ARMv8-A architecture profile. 


If the RAS Extension is not implemented, this instruction executes as a NOP. 


A1 

ARMy8.2 

31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 1413 12/1110 9 8|7 6 5 4/3 2 1 0| 
=1111 [0 0 1 1 Of0]1 oflo o o 0((1)(1)1)(1)(0)(0)(0)(0) 0 0010000 
cond 

A1 variant 

ESB{<c>}{<q>} 


Decode for this encoding 


if !HaveRASExt() then EndOfInstruction(); // Instruction executes as NOP 
if cond != '1110' then UNPREDICTABLE; // ESB must be encoded with AL condition 


CONSTRAINED UNPREDICTABLE behavior 


If cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 

7 The instruction executes as NOP. 

° The instruction executes unconditionally. 

. The instruction executes conditionally. 

T1 

ARMvV8.2 


[15 14 1312/1110 9 8/7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 21 0| 


ToT TOOT 101 OM ofofofoyo o ojo oo ooo 0] 


T1 variant 


ESB{<c>}.W 


Decode for this encoding 


if !HaveRASExt() then EndOfInstruction(); // Instruction executes as NOP 
if InITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If InITBlock(), then one of the following behaviors must occur: 
g The instruction is UNDEFINED. 
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F5-4198 


: The instruction executes as NOP. 
° The instruction executes unconditionally. 
° The instruction executes conditionally. 


Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 


SynchronizeErrors(); 

AArch32.ESBOperation(); 

if PSTATE.EL IN {EL@, EL1} && EL2Enabled() then AArch32.vESBOperation(); 
TakeUnmaskedSErrorInterrupts(); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


F5.1.53 HLT 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Halting breakpoint causes a software breakpoint to occur. 


Halting breakpoint is always unconditional, even inside an IT block. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 | | 8|7 6 5 4|3 o| 
emm [0007 0]0 ojo] mm2 Jori) m| 
cond 

A1 variant 


HLT{<q>} {#}<imm> 


Decode for this encoding 


if EDSCR.HDE == '@' || !HaltingAllowed() then UNDEFINED; 
if cond != '1110' then UNPREDICTABLE; // HLT must be encoded with AL condition 


CONSTRAINED UNPREDICTABLE behavior 


If cond != '1110', then one of the following behaviors must occur: 
` The instruction is UNDEFINED. 
s The instruction executes as NOP. 
° The instruction executes unconditionally. 
° The instruction executes conditionally. 
T1 
|15 14 13 121110 9 8|7 6 5 | 0| 


1011101010] imm | 


T1 variant 
HLT{<q>} {#}<imm> 
Decode for this encoding 


if EDSCR.HDE == '@' || !HaltingAllowed() then UNDEFINED; 


Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 

<q> See Standard assembler syntax fields on page F2-3908. An HLT instruction must be unconditional. 


<imm> For encoding A1: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 
"imm12:imm4" field. This value is for assembly and disassembly only. It is ignored by the PE, but 
can be used by a debugger to store more information about the halting breakpoint. 
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For encoding T1: is a 6-bit unsigned immediate, in the range 0 to 63, encoded in the "imm6" field. 
This value is for assembly and disassembly only. It is ignored by the PE, but can be used by a 
debugger to store more information about the halting breakpoint. 


Operation for all encodings 


EncodingSpecificOperations(); 
Halt (DebugHalt_HaltInstruction) ; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.54 HVC 


Hypervisor Call causes a Hypervisor Call exception. For more information see Hypervisor Call (HVC) exception 
on page G1-5542. Non-secure software executing at EL1 can use this instruction to call the hypervisor to request a 
service. 


The HVC instruction is: 


° UNDEFINED in Secure state, and in User mode in Non-secure state. 
° When SCR.HCE is set to 0, UNDEFINED in Non-secure EL1 modes and CONSTRAINED UNPREDICTABLE in 
Hyp mode. 


On executing an HVC instruction, the HSR reports the exception as a Hypervisor Call exception, using the EC value 
0x12, and captures the value of the immediate argument, see Use of the HSR on page G5-5836. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 | | 8|7 6 5 4|3 o| 
1111 |o o o 1 oļj1ı ojo] imma ft tt mm | 
cond 

A1 variant 


HVC{<q>} {#}<imm16> 


Decode for this encoding 


if cond != '1110' then UNPREDICTABLE; 
imm16 = imm12:imm4; 


CONSTRAINED UNPREDICTABLE behavior 


If cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The instruction executes unconditionally. 
° The instruction executes conditionally. 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 14 13 12|11 | | 0 | 


Tiitotiit1 to] mm [7 ofojo] imma —=z 


T1 variant 
HVC{<q>} {#}<imm16> 
Decode for this encoding 


imm16 = imm4:imm12; 
if InITBlock() then UNPREDICTABLE; 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 
<q> See Standard assembler syntax fields on page F2-3908. An HVC instruction must be unconditional. 


<imm16> For encoding A1: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 
"imm12:imm4" field. This value is for assembly and disassembly only. It is reported in the HSR but 
otherwise is ignored by hardware. An HVC handler might interpret imm16, for example to 
determine the required service. 


For encoding T1: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 
"imm4:imm12" field. This value is for assembly and disassembly only. It is reported in the HSR but 
otherwise is ignored by hardware. An HVC handler might interpret imm16, for example to 
determine the required service. 


Operation for all encodings 


EncodingSpecificOperations(); 
if !HaveEL(EL2) || PSTATE.EL == EL@ || (IsSecure() && !IsSecureEL2Enabled()) then 
UNDEFINED; 


if HaveEL(EL3) then 
if ELUsingAArch32(EL3) && SCR.HCE == '@' && PSTATE.EL == EL2 then 
UNPREDICTABLE; 
else 
hvc_enable = SCR_GEN[].HCE; 
else 
hvc_enable = if ELUsingAArch32(EL2) then NOT(HCR.HCD) else NOT(HCR_EL2.HCD) ; 


if hvc_enable == 'Q' then 
UNDEFINED; 


else 
AArch32.Cal ]Hypervisor(imm16) ; 


CONSTRAINED UNPREDICTABLE behavior 


If ELUsingAArch32(EL3) && SCR.HCE == 'Q' && PSTATE.EL == EL2, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
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F5.1.55 


ISB 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Instruction Synchronization Barrier flushes the pipeline in the PE and is a context synchronization event. For more 
information, see Instruction Synchronization Barrier (ISB) on page E2-3824. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4/3 0| 





A1 variant 


ISB{<c>}{<q>} {<option>} 


Decode for this encoding 


// No additional decoding required 


T1 


15 14 13 1211110 9 8/7 6 5 4/3 2 1 0151413 12|1110 9 8|7 6 5 4/3 0| 





1110011101 1k okoo kooo a 1 0] option | 


T1 variant 
ISB{<c>}{<q>} {<option>} 
Decode for this encoding 


// No additional decoding required 


Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 
Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. Must be AL or omitted. 
For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<option> Specifies an optional limitation on the barrier operation. Values are: 
SY Full system barrier operation, encoded as option = 0b1111. Can be omitted. 


All other encodings of option are reserved. The corresponding instructions execute as full system 
barrier operations, but must not be relied upon by software. 


Operation for all encodings 
if ConditionPassed() then 


EncodingSpecificOperations(); 
InstructionSynchronizationBarrier(); 
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F5.1.56 


F5-4204 


IT 


If-Then makes up to four following instructions (the IT block) conditional. The conditions for the instructions in the 
IT block are the same as, or the inverse of, the condition the IT instruction specifies for the first instruction in the 
block. 


The IT instruction itself does not affect the condition flags, but the execution of the instructions in the IT block can 
change the condition flags. 


16-bit instructions in the IT block, other than CMP, CMN and TST, do not set the condition flags. An IT instruction with 
the AL condition can change the behavior without conditional execution. 


The architecture permits exception return to an instruction in the IT block only if the restoration of the CPSR 
restores ITSTATE to a state consistent with the conditions specified by the IT instruction. Any other exception return 
to an instruction in an IT block is UNPREDICTABLE. Any branch to a target instruction in an IT block is not permitted, 
and if such a branch is made it is UNPREDICTABLE what condition is used when executing that target instruction and 
any subsequent instruction in the IT block. 


Many uses of the IT instruction are deprecated for performance reasons, and an implementation might include ITD 
controls that can disable those uses of IT, making them UNDEFINED. 


For more information see Conditional execution on page F2-3909 and Conditional instructions on page F 1-3867. 
The first of these sections includes more information about the ITD controls. 


T1 
|15 14 13 12|11 10 9 8 |7 4|3 o| 
1 0 11 1 1 1 1| firstctond | !=0000 
mask 
T1 variant 


IT{<x>{<y>{<z>}}}{<q>} <cond> 


Decode for this encoding 


if mask == '0000' then SEE "Related encodings"; 
if firstcond == '1111' || (firstcond == '1110' && BitCount(mask) != 1) then UNPREDICTABLE; 
if InITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If firstcond == '1111' || (firstcond == '1110' && BitCount(mask) != 1), then one of the following behaviors must 
occur: 

- The instruction is UNDEFINED. 

. The instruction executes as NOP. 

. The '1111' condition is treated as being the same as the '1110' condition, meaning always, and the ITSTATE 


state machine is progressed in the same way as for any other cond_base value. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related encodings: Miscellaneous 16-bit instructions on page F3-3943. 
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Assembler symbols 


<X> 


<y> 


<Z> 


<q> 


<cond> 


The condition for the second instruction in the IT block. If omitted, the "mask" field is set to 0b1000. 
If present it is encoded in the "mask[3]" field: 


T firstcond[0] 

E NOT firstcond[0] 

The condition for the third instruction in the IT block. If omitted and <x> is present, the "mask[2:0]" 
field is set to 0b100. If <y> is present it is encoded in the "mask[2]" field: 

T firstcond[0] 

E NOT firstcond[0] 

The condition for the fourth instruction in the IT block. If omitted and <y> is present, the "mask[1:0]" 


field is set to @b10. If <z> is present, the "mask[0]" field is set to 1, and it is encoded in the "mask[1]" 
field: 


T firstcond[0] 
E NOT firstcond[0] 


See Standard assembler syntax fields on page F2-3908. 


The condition for the first instruction in the IT block, encoded in the "firstcond" field. See 
Table F2-1 on page F2-3909 for the range of conditions available, and the encodings. 


The conditions specified in an IT instruction must match those specified in the syntax of the instructions in its IT 
block. When assembling to A32 code, assemblers check IT instruction syntax for validity but do not generate 
assembled instructions for them. See Conditional instructions on page F1-3867. 


Operation 


EncodingSpecificOperations(); 
AArch32.CheckITEnabled(mask) ; 
PSTATE.IT<7:@> = firstcond:mask; 
ShouldAdvancelT = FALSE; 
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F5.1.57 


F5-4206 


LDA 


Load-Acquire Word loads a word from memory and writes it to a register. The instruction also has memory ordering 
semantics as described in Load-Acquire, Store-Release on page E2-3828 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 


information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


[m1 jo oo 1 tfo of1t Rn | Rr [arfofols o o tama) 


cond 


A1 variant 


LDA{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


110100011 oft R | R (Mm als}o}1 oma) 


T1 variant 
LDA{<c>}{<q>} <Rt>, [<Rn>] 
Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 


Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
R[t] = MemO[address, 4]; 
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Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.58 LDAB 


Load-Acquire Byte loads a byte from memory, zero-extends it to form a 32-bit word and writes it to a register. The 
instruction also has memory ordering semantics as described in Load-Acquire, Store-Release on page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


[m1 joo ot tft oji] Rn | Rt [airfofols o o tama) 


cond 


A1 variant 


LDAB{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


11010001101] R | R (HMM asojo ofa) 


T1 variant 


LDAB{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 


Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
R[t] = ZeroExtend(MemO[address, 1], 32); 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.59 


F5-4210 


LDAEX 


Load-Acquire Exclusive Word loads a word from memory, writes it to a register and: 


° If the address has the Shared Memory attribute, marks the physical address as exclusive access for the 
executing PE in a global monitor. 


° Causes the executing PE to indicate an active exclusive access in the local monitor. 

The instruction also has memory ordering semantics as described in Load-Acquire, Store-Release on page E2-3828. 
For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


[111 jooo 1 tfo oft] Rn | R [art fo] o o AMM) 


cond 


A1 variant 


LDAEX{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


1110100011 0f1f R | R W@o olpmaa 


T1 variant 


LDAEX{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
AArch32.SetExclusiveMonitors(address, 4); 
R[t] = MemO[address, 4]; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.60 LDAEXB 


Load-Acquire Exclusive Byte loads a byte from memory, zero-extends it to form a 32-bit word, writes it to a register 


and: 

à If the address has the Shared Memory attribute, marks the physical address as exclusive access for the 
executing PE in a global monitor. 

° Causes the executing PE to indicate an active exclusive access in the local monitor. 


The instruction also has memory ordering semantics as described in Load-Acquire, Store-Release on page E2-3828. 
For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 


information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


| tei fo oo 4 tft oft} Rao | R kojoj o o MMO 


cond 


A1 variant 


LDAEXB{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


110100011 0j] R | R wonn] oma) 


T1 variant 


LDAEXB{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
F5-4212 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
AArch32.SetExclusiveMonitors(address, 1); 
R[t] = ZeroExtend(MemO[address, 1], 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.61 LDAEXD 
Load-Acquire Exclusive Doubleword loads a doubleword from memory, writes it to two registers and: 


a If the address has the Shared Memory attribute, marks the physical address as exclusive access for the 
executing PE in a global monitor 


° Causes the executing PE to indicate an active exclusive access in the local monitor. 


The instruction also acts as a barrier instruction with the ordering requirements described in Load-Acquire, 
Store-Release on page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11109 8|7 6 5 4/3 2 1 0| 


[11 jo oo 1 1fo t{1{ Rn | R koloj o o tha) 
cond 
A1 variant 
LDAEXD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>] 
Decode for this encoding 


t = UInt(Rt); t2 =t+ 1; n = UInt(Rn); 
if Rt<@> == '1' || t2 == 15 || n == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If Rt<@> == '1', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

$ The instruction executes as NOP. 

$ The instruction executes with the additional decode: t<0> = '0'. 

° The instruction executes with the additional decode: t2 =t. 

. The instruction executes as described, with no change to its behavior and no additional side effects. 
If Rt == '1110', then one of the following behaviors must occur: 

e The instruction is UNDEFINED. 

: The instruction executes as NOP. 


e The instruction is handled as described in Using R15 on page K1-7607. 
T1 
|15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12111 8|7 6 5 4|3 210] 


Tt totoootio m | a | Re Mionna 


T1 variant 


LDAEXD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>] 
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Decode for this encoding 


t = UInt(Rt); t2 = UInt(Rt2); n = UInt(Rn); 
if t == 15 || t2 == 15 || t == t2 || n == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The load instruction executes but the destination register takes an UNKNOWN value. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 


<Rt> must be even-numbered and not R14. 


For encoding T1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 


<Rt2> For encoding A1: is the second general-purpose register to be transferred. <Rt2> must be <R(t+1)>. 


For encoding T1: is the second general-purpose register to be transferred, encoded in the "Rt2" field. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
AArch32.SetExclusiveMonitors(address, 8); 
value = MemO[address, 8]; 
// Extract words from 64-bit loaded value such that R[t] is 
// loaded from address and R[t2] from address+4. 
R[t] = if BigEndian() then value<63:32> else value<31:0>; 
R[t2] = if BigEndian() then value<31:0> else value<63:32>; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.62 LDAEXH 


Load-Acquire Exclusive Halfword loads a halfword from memory, zero-extends it to form a 32-bit word, writes it 
to a register and: 


° If the address has the Shared Memory attribute, marks the physical address as exclusive access for the 
executing PE in a global monitor. 


° Causes the executing PE to indicate an active exclusive access in the local monitor. 

The instruction also has memory ordering semantics as described in Load-Acquire, Store-Release on page E2-3828. 
For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12\11109 8|7 6 5 4/3 2 1 0] 


[mm foo ot ttt 1j] Rao | R kojoj o o MMO 


cond 


A1 variant 


LDAEXH{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


110100011 0j] R | R wonn] tama 


T1 variant 


LDAEXH{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
AArch32.SetExclusiveMonitors(address, 2); 
R[t] = ZeroExtend(MemO[address, 2], 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.63 LDAH 


Load-Acquire Halfword loads a halfword from memory, zero-extends it to form a 32-bit word and writes it to a 
register. The instruction also has memory ordering semantics as described in Load-Acquire, Store-Release on 
page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


Perm fooo7 tia] en | Rt Oe oo MMMM 


cond 


A1 variant 


LDAH{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


1101000110] R | ROMA sfofo Woo 


T1 variant 


LDAH{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior, see Appendix K1 Architectural 


Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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Operation for all encodings 
if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
R[t] = ZeroExtend(MemO[address, 2], 32); 
Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.64 


F5-4220 


LDC (immediate) 


Load data to System register (immediate) calculates an address from a base register value and an immediate offset, 
loads a word from memory, and writes it to the DBGDTRTXint System register. It can use offset, post-indexed, 
pre-indexed, or unindexed addressing. For information about memory accesses see Memory accesses on 

page F2-3913. 


In an implementation that includes EL2, the permitted LDC access to DBGDTRTXint can be trapped to Hyp mode, 
meaning that an attempt to execute an LDC instruction in a Non-secure mode other than Hyp mode, that would be 
permitted in the absence of the Hyp trap controls, generates a Hyp Trap exception. For more information, see 
Trapping general Non-secure System register accesses to debug registers on page G1-5601. 


For simplicity, the LDC pseudocode does not show this possible trap to Hyp mode. 





A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 10 9 8|7 | 0| 
Tem [1 1 opowie =m fo7o4[171)o] imme i 
cond Rn 


Offset variant 
Applies when P == 1 && W == 


LDC{<c>}{<q>} p14, c5, [<Rn>{, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == @ && W == 


LDC{<c>}{<q>} p14, c5, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 


LDC{<c>}{<q>} p14, c5, [<Rn>, #{+/-}<imm>]! 


Unindexed variant 
Applies when P == 0 && U == 1 && W == 


LDC{<c>}{<q>} p14, c5, [<Rn>], <option> 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDC (literal)"; 
if P == 'Q' && U == '@' && W == '@' then UNDEFINED; 
n = UInt(Rn); cp = 14; 


imm32 = ZeroExtend(imm8:'QQ', 32); index = (P == '1'); add = (U == '1'); whack = (W == '1'); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 14 13 12|11 10 9 8|7 | 0 | 





maipon 7 oplus ooa aao imme E 
Rn 


Offset variant 


Applies when P == 1 & W == 
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LDC{<c>}{<q>} p14, c5, [<Rn>{, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == @ && W == 


LDC{<c>}{<q>} p14, c5, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 


LDC{<c>}{<q>} p14, c5, [<Rn>, #{+/-}<imm>]! 


Unindexed variant 
Applies when P == 0 && U == 1 && W == 


LDC{<c>}{<q>} p14, c5, [<Rn>], <option> 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDC (literal)"; 

if P == 'Q' && U == '@' && W == '@' then UNDEFINED; 

n = UInt(Rn); cp = 14; 

imm32 = ZeroExtend(imm8:'QQ', 32); index = (P == '1'); add = (U == '1'); whack = (W == '1'); 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. If the PC is used, see LDC (literal). 
<option> Is an 8-bit immediate, in the range 0 to 255 enclosed in { }, encoded in the "imm8" field. The value 


of this field is ignored when executing this instruction. 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

<imm> Is the immediate offset used for forming the address, a multiple of 4 in the range 0-1020, defaulting 


to 0 and encoded in the "imm8" field, as <imm>/4. 


Operation for all encodings 

if ConditionPassed() then 
EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 


// System register write to DBGDTRTXint. 
DBGDTR_ELO[] = MemA[address,4]; 


if wback then R[n] = offset_addr; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.65 


F5-4222 


LDC (literal) 


Load data to System register (literal) calculates an address from the PC value and an immediate offset, loads a word 
from memory, and writes it to the DBGDTRTXint System register. For information about memory accesses see 
Memory accesses on page F2-3913. 


In an implementation that includes EL2, the permitted LDC access to DBGDTRTXint can be trapped to Hyp mode, 
meaning that an attempt to execute an LDC instruction in a Non-secure mode other than Hyp mode, that would be 
permitted in the absence of the Hyp trap controls, generates a Hyp Trap exception. For more information, see 
Trapping general Non-secure System register accesses to debug registers on page G1-5601. 


For simplicity, the LDC pseudocode does not show this possible trap to Hyp mode. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 | 0| 
Pen [1 1 ojPlupowii[t 11 1fo70%f171)0] imme i 
cond 
A1 variant 


Applies when !(P == @ && U == 0 && W == 0). 
LDC{<c>}{<q>} p14, c5, <label> 


LDC{<c>}{<q>} p14, c5, [PC, #{+/-}<imm>] 
LDC{<c>}{<q>} p14, c5, [PC], <option> 


Decode for this encoding 
if P == '0' && U == '0' && W == 'Q' then UNDEFINED; 


index = (P == '1'); add = (U == '1'); cp = 14; imm32 = ZeroExtend(imm8:'Q0', 32); 
if W == '1' || (P == '@' && CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


IfW == '1', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
° The instruction executes without writeback of the base address. 
° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 
T1 
|15 14 13 1211110 9 8|7 6 5 4|3 2 1 0|15141312|11 10 9 8|7 | 0| 


aao ouo eoo a o m o E 


T1 variant 
Applies when !(P == 0 & U == 0 && W == 0). 


LDC{<c>}{<q>} p14, c5, <label> 
LDC{<c>}{<q>} p14, c5, [PC, #{+/-}<imm>] 
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Decode for this encoding 
if P == '0' && U == 'Q' && W == 'Q' then UNDEFINED; 


index = (P == '1'); add = (U == '1'); cp = 14; imm32 = ZeroExtend(imm8:'Q0', 32); 
if W == '1' || (P == '@' && CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


IfW == '1' || P == '0', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

. The instruction executes without writeback of the base address. 

° The instruction executes as LDC (immediate) with writeback to the PC. The instruction is handled as described 


in Using R15 on page K1-7607. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<option> Is an 8-bit immediate, in the range 0 to 255 enclosed in { }, encoded in the "imm8" field. The value 


of this field is ignored when executing this instruction. 


<label> The label of the literal data item that is to be loaded into <Rt>. The assembler calculates the required 
value of the offset from the Align(PC, 4) value of the instruction to this label. Permitted values of 
the offset are multiples of 4 in the range -1020 to 1020. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE (encoded as U == 1). 
If the offset is negative, imm32 is equal to minus the offset and add == FALSE (encoded as U == 0). 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = @ 
+ when U = 1 

<imm> Is the immediate offset used for forming the address, a multiple of 4 in the range 0-1020, defaulting 


to 0 and encoded in the "imm8" field, as <imm>/4. 


The alternative syntax permits the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 


Operation for all encodings 
if ConditionPassed() then 
EncodingSpecificOperations(); 
offset_addr = if add then (Align(PC,4) + imm32) else (Align(PC,4) - imm32); 
address = if index then offset_addr else Align(PC,4); 
// System register write to DBGDTRTXint. 
DBGDTR_ELO[] = MemA[address,4]; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.66 


F5-4224 


LDM, LDMIA, LDMFD 


Load Multiple (Increment After, Full Descending) loads multiple registers from consecutive memory locations 
using an address from a base register. The consecutive memory locations start at this address, and the address just 
above the highest of those locations can optionally be written back to the base register. 


The lowest-numbered register is loaded from the lowest memory address, through to the highest-numbered register 
from the highest memory address. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


Armv8.2 permits the deprecation of some Load Multiple ordering behaviors in AArch3?2 state, for more information 
see ARMv8.2-LSMAOC. The registers loaded can include the PC, causing a branch to a loaded address. This is an 
interworking branch, see Pseudocode description of operations on the AArch32 general-purpose registers and the 
PC on page E1-3787. Related system instructions are LDM (User registers) and LDM (exception return). 


This instruction is used by the alias POP (multiple registers). See Alias conditions on page F5-4226 for details of 
when each alias is preferred. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | 0| 
1111 |1 0 ofoltfofwi1] Rn | register_list 
cond 
A1 variant 


LDM{TA}{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
LDMFD{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Full Descending stack 


Decode for this encoding 
n = UInt(Rn); registers = register_list; whack = (W == '1'); 


if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 
if whack && registers<n> == '1' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The instruction executes as LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers loaded. 


If wback && registers<n> == '1', then one of the following behaviors must occur: 

$ The instruction is UNDEFINED. 

. The instruction executes as NOP. 

G The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 
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T1 


15 14 13 12/1110 8|7 | 0 | 


T1 variant 


LDM{IA}{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
LDMFD{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Full Descending stack 


Decode for this encoding 


n = UInt(Rn); registers = 'Q0000000':register_list; whack = (registers<n> == 'Q'); 
if BitCount(registers) < 1 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction executes as LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers loaded. 


T2 


|15 14 13 1211110 9 8|7 6 5 4|3 0151413 | 0| 


[111070 ojo 1joflwji] Rn fejm] registerlist_ | 


T2 variant 

LDM{IA}{<c>}.W <Rn>{!}, <registers> // Preferred syntax, if <Rn>, '!' and <registers> can be represented 
in T1 

LDMFD{<c>}.W <Rn>{!}, <registers> // Alternate syntax, Full Descending stack, if <Rn>, '!' and 
<registers> can be represented in T1 

LDM{IA}{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 

LDMFD{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Full Descending stack 

Decode for this encoding 

n = UInt(Rn); registers = P:M:register_list; wback = (W == '1'); 

if n == 15 || BitCount(registers) < 2 || (P == '1' && M == '1') then UNPREDICTABLE; 

if wback && registers<n> == '1' then UNPREDICTABLE; 

if registers<13> == '1' then UNPREDICTABLE; 

if registers<15> == '1' && InITBlock() && !LastInITBlock() then UNPREDICTABLE; 

CONSTRAINED UNPREDICTABLE behavior 

If BitCount(registers) < 1, then one of the following behaviors must occur: 

. The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction executes as LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers loaded. 
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F5-4226 


If whack && registers<n> == '1', then one of the following behaviors must occur: 

$ The instruction is UNDEFINED. 

: The instruction executes as NOP. 

7 The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


If BitCount(registers) == 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

e The instruction executes as NOP. 

° The instruction loads a single register using the specified addressing modes. 

° The instruction executes as LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. 


If registers<13> == '1', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

: The instruction executes as NOP. 

$ The instruction performs all of the loads using the specified addressing mode, but R13 is UNKNOWN. 

IfP == '1' & M == '1', then one ofthe following behaviors must occur: 

è The instruction is UNDEFINED. 

- The instruction executes as NOP. 

. The instruction loads the register list and either R14 or R15, both R14 and R15, or neither of these registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Alias conditions 


Alias of variant is preferred when 
POP (multiple registers) T2 W == '1' && Rn == '1101' && BitCount(P:M:register_list) > 1 
POP (multiple registers) A1 == '1' && Rn == '1101' && BitCount(register_list) > 1 





Assembler symbols 


IA Is an optional suffix for the Increment After form. 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


! For encoding A1 and T2: the address adjusted by the size of the data loaded is written back to the 
base register. If specified, it is encoded in the "W" field as 1, otherwise this field defaults to 0. 
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For encoding T1: the address adjusted by the size of the data loaded is written back to the base 
register. It is omitted if <Rn> is included in <registers>, otherwise it must be present. 


For encoding A1: is a list of one or more registers to be loaded, separated by commas and 
surrounded by { and }. 

The PC can be in the list. 

Arm deprecates using these instructions with both the LR and the PC in the list. 


For encoding T1: is a list of one or more registers to be loaded, separated by commas and surrounded 
by { and }. The registers in the list must be in the range RO-R7, encoded in the "register_list" field. 


For encoding T2: is a list of one or more registers to be loaded, separated by commas and surrounded 
by { and }. The registers in the list must be in the range RO-R12, encoded in the "register_list" field, 
and can optionally contain one of the LR or the PC. If the LR is in the list, the "M" field is set to 1, 
otherwise it defaults to 0. If the PC is in the list, the "P" field is set to 1, otherwise it defaults to 0. 


If the PC is in the list: 
. The LR must not be in the list. 


$ The instruction must be either outside any IT block, or the last instruction in an IT block. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
for i = 0 to 14 
if registers<i> == '1' then 


R[i] = MemA[address,4]; address = address + 4; 


if registers<15> == '1' then 
LoadWritePC(MemA[address,4]); 


if wback && registers<n> == 'Q' then R[n] 
if wback && registers<n> == '1' then R[n] 


R[n] + 4«BitCount(registers) ; 
bits(32) UNKNOWN; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.67 


F5-4228 


LDM (exception return) 


Load Multiple (exception return) loads multiple registers from consecutive memory locations using an address from 
a base register. The SPSR of the current mode is copied to the CPSR. An address adjusted by the size of the data 
loaded can optionally be written back to the base register. 


The registers loaded include the PC. The word loaded for the PC is treated as an address and a branch occurs to that 
address. 


Load Multiple (exception return) is: 





: UNDEFINED in Hyp mode. 
° UNPREDICTABLE in debug state, and in User mode and System mode. 
A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 14 | | | 0 | 
1111 [1 0 ofejujijwh] Rn f1 register_list 
cond 
A1 variant 


LDM{<amode>}{<c>}{<q>} <Rn>{!}, <registers_with_pc>A 


Decode for this encoding 


n = UInt(Rn); registers = register_list; 

wback = (W == '1'); | increment = (U == '1'); wordhigher = (P == U); 
if n == 15 then UNPREDICTABLE; 

if wback && registers<n> == '1' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If whack && registers<n> == '1', then one of the following behaviors must occur: 

: The instruction is UNDEFINED. 

. The instruction executes as NOP. 

s The instruction performs all the loads using the specified addressing mode and the content of the register 


being written back is UNKNOWN. In addition, if an exception occurs during the execution of this instruction, 
the base address might be corrupted so that the instruction cannot be repeated. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<amode> is one of: 

DA Decrement After. The consecutive memory addresses end at the address in the base 
register. Encoded as P = 0, U = 0. 

FA Full Ascending. For this instruction, a synonym for DA. 

DB Decrement Before. The consecutive memory addresses end one word below the address 
in the base register. Encoded as P = 1, U = 0. 

EA Empty Ascending. For this instruction, a synonym for DB. 
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IA Increment After. The consecutive memory addresses start at the address in the base 
register. This is the default. Encoded as P = 0, U=1. 
FD Full Descending. For this instruction, a synonym for IA. 
IB Increment Before. The consecutive memory addresses start one word above the address 
in the base register. Encoded as P= 1, U=1. 
ED Empty Descending. For this instruction, a synonym for IB. 
<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


! The address adjusted by the size of the data loaded is written back to the base register. If specified, 
it is encoded in the "W" field as 1, otherwise this field defaults to 0. 


<registers_with_pc> Is a list of one or more registers, separated by commas and surrounded by { and }. It specifies 
the set of registers to be loaded. The registers are loaded with the lowest-numbered register from the 
lowest memory address, through to the highest-numbered register from the highest memory address. 
The PC must be specified in the register list, and the instruction causes a branch to the address (data) 
loaded into the PC. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


Instructions with similar syntax but without the PC included in the registers list are described in LDM (User 
registers). 
Operation 

if ConditionPassed() then 


EncodingSpecificOperations(); 
if PSTATE.EL == EL2 then 


UNDEFINED; 
elsif PSTATE.M IN {M32_User,M32_System} then 

UNPREDICTABLE; // UNDEFINED or NOP 
else 


length = 4«BitCount(registers) + 4; 
address = if increment then R[n] else R[n]-length; 
if wordhigher then address = address+4; 
for i = 0 to 14 
if registers<i> == '1' then 
R[i] = MemA[address,4]; address = address + 4; 
new_pc_value = MemA[address,4]; 


if wback && registers<n> == 'Q' then R[n] = if increment then R[n]+length else R[n]-length; 
if wback && registers<n> == '1' then R[n] = bits(32) UNKNOWN; 


AArch32.ExceptionReturn(new_pc_value, SPSR[]); 


CONSTRAINED UNPREDICTABLE behavior 
If PSTATE.M IN {M32_User,M32_System}, then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 


. The instruction executes as NOP. 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.68 


F5-4230 


LDM (User registers) 


In an EL1 mode other than System mode, Load Multiple (User registers) loads multiple User mode registers from 
consecutive memory locations using an address from a base register. The registers loaded cannot include the PC. 
The PE reads the base register value normally, using the current mode to determine the correct Banked version of 
the register. This instruction cannot writeback to the base register. 


Load Multiple (User registers) is UNDEFINED in Hyp mode, and UNPREDICTABLE in User and System modes. 


Armv8.2 permits the deprecation of some Load Multiple ordering behaviors in AArch32 state, for more information 
see ARMv8.2-LSMAOC. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 14 | | | 0 | 
Fit [4 0 ofu on] R To] register Tisi 
cond 
A1 variant 


LDM{<amode>}{<c>}{<q>} <Rn>, <registers_without_pc>A 


Decode for this encoding 


n = UInt(Rn); registers = register_list; increment = (U == '1'); wordhigher = (P == U); 
if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction operates as an LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<amode> is one of: 

DA Decrement After. The consecutive memory addresses end at the address in the base 
register. Encoded as P = 0, U = 0. 

FA Full Ascending. For this instruction, a synonym for DA. 

DB Decrement Before. The consecutive memory addresses end one word below the address 
in the base register. Encoded as P = 1, U = 0. 

EA Empty Ascending. For this instruction, a synonym for DB. 

IA Increment After. The consecutive memory addresses start at the address in the base 
register. This is the default. Encoded as P = 0, U = 1. 

FD Full Descending. For this instruction, a synonym for IA. 

IB Increment Before. The consecutive memory addresses start one word above the address 
in the base register. Encoded as P= 1, U=1. 
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ED Empty Descending. For this instruction, a synonym for IB. 
<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


<registers_without_pc> 


Is a list of one or more registers, separated by commas and surrounded by { and }. It specifies the 
set of registers to be loaded by the LDM instruction. The registers are loaded with the 
lowest-numbered register from the lowest memory address, through to the highest-numbered 
register from the highest memory address. The PC must not be in the register list. See also Encoding 
of lists of general-purpose registers and the PC on page F2-3914. 


Instructions with similar syntax but with the PC included in <registers_without_pc> are described in LDM 
(exception return). 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if PSTATE.EL == EL2 then UNDEFINED; 
elsif PSTATE.M IN {M32_User,M32_System} then UNPREDICTABLE; 
else 
length = 4«BitCount(registers); 
address = if increment then R[n] else R[n]-length; 
if wordhigher then address = address+4; 
for i =0 to 14 
if registers<i> == '1' then // Load User mode register 
Rmode[i, M32_User] = MemA[address,4]; address = address + 4; 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.M IN {M32_User,M32_System}, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as an LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.69 


F5-4232 


LDMDA, LDMFA 


Load Multiple Decrement After (Full Ascending) loads multiple registers from consecutive memory locations using 
an address from a base register. The consecutive memory locations end at this address, and the address just below 
the lowest of those locations can optionally be written back to the base register. 


The lowest-numbered register is loaded from the lowest memory address, through to the highest-numbered register 
from the highest memory address. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


Armv8.2 permits the deprecation of some Load Multiple ordering behaviors in AArch3?2 state, for more information 
see ARMv8.2-LSMAOC. The registers loaded can include the PC, causing a branch to a loaded address. This is an 
interworking branch, see Pseudocode description of operations on the AArch32 general-purpose registers and the 
PC on page E1-3787. Related system instructions are LDM (User registers) and LDM (exception return). 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | o| 
1=1111 |1 0 ojojojojw]i| Rn | register_list 
cond 
A1 variant 


LDMDA{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
LDMFA{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Full Ascending stack 


Decode for this encoding 
n = UInt(Rn); registers = register_list; wback = (W == '1'); 


if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 
if wback && registers<n> == '1' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction operates as an LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. Ifthe instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers loaded. 


If wback && registers<n> == '1', then one of the following behaviors must occur: 

: The instruction is UNDEFINED. 

° The instruction executes as NOP. 

7 The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


! The address adjusted by the size of the data loaded is written back to the base register. If specified, 
it is encoded in the "W" field as 1, otherwise this field defaults to 0. 


<registers> Is a list of one or more registers to be loaded, separated by commas and surrounded by { and }. 
The PC can be in the list. 
Arm deprecates using these instructions with both the LR and the PC in the list. 


Operation 


if ConditionPassed() then 

EncodingSpecificOperations(); 
address = R[n] - 4«BitCount(registers) + 4; 
for i = 0 to 14 

if registers<i> == '1' then 

R[i] = MemA[address,4]; address = address + 4; 

if registers<15> == '1' then 

LoadWritePC(MemA[address,4]); 
if wback && registers<n> == 'Q' then R[n] = R[n] - 4«BitCount(registers) ; 
if wback && registers<n> == '1' then R[n] = bits(32) UNKNOWN; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.70 


F5-4234 


LDMDB, LDMEA 


Load Multiple Decrement Before (Empty Ascending) loads multiple registers from consecutive memory locations 
using an address from a base register. The consecutive memory locations end just below this address, and the 
address of the lowest of those locations can optionally be written back to the base register. 


The lowest-numbered register is loaded from the lowest memory address, through to the highest-numbered register 
from the highest memory address. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


Armv8.2 permits the deprecation of some Load Multiple ordering behaviors in AArch3?2 state, for more information 
see ARMv8.2-LSMAOC. The registers loaded can include the PC, causing a branch to a loaded address. This is an 
interworking branch, see Pseudocode description of operations on the AArch32 general-purpose registers and the 
PC on page E1-3787. Related system instructions are LDM (User registers) and LDM (exception return). 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | o| 
1=1111 |1 0 ojijojojw]li| Rn | register_list 
cond 
A1 variant 


LDMDB{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
LDMEA{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Empty Ascending stack 


Decode for this encoding 
n = UInt(Rn); registers = register_list; whack = (W == '1'); 


if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 
if whack && registers<n> == '1' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If whack && registers<n> == '1', then one of the following behaviors must occur: 

` The instruction is UNDEFINED. 

. The instruction executes as NOP. 

5 The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The instruction executes as LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers loaded. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0151413 | | | 0 | 


[111070 0}14 ofofwiit Rn fejm] registerlist_ | 
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T1 variant 


LDMDB{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
LDMEA{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Empty Ascending stack 


Decode for this encoding 


n = UInt(Rn); registers = P:M:register_list; whack = (W == '1'); 

if n == 15 || BitCount(registers) < 2 || (P == '1' && M == '1') then UNPREDICTABLE; 
if whack && registers<n> == '1' then UNPREDICTABLE; 

if registers<13> == '1' then UNPREDICTABLE; 

if registers<15> == '1' && InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If whack && registers<n> == '1', then one of the following behaviors must occur: 

s The instruction is UNDEFINED. 

e The instruction executes as NOP. 

$ The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction executes as LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers loaded. 


If BitCount (registers) == 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

. The instruction loads a single register using the specified addressing modes. 

° The instruction executes as LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. 


If registers<13> == '1', then one of the following behaviors must occur: 

2 The instruction is UNDEFINED. 

a The instruction executes as NOP. 

° The instruction performs all of the loads using the specified addressing mode, but R13 is UNKNOWN. 

IfP == '1' & M == '1', then one of the following behaviors must occur: 

è The instruction is UNDEFINED. 

G The instruction executes as NOP. 

è The instruction loads the register list and either R14 or R15, both R14 and R15, or neither of these registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5-4236 


Assembler symbols 


<C> 


<registers> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose base register, encoded in the "Rn" field. 


The address adjusted by the size of the data loaded is written back to the base register. If specified, 
it is encoded in the "W" field as 1, otherwise this field defaults to 0. 


For encoding A1: is a list of one or more registers to be loaded, separated by commas and 
surrounded by { and }. 

The PC can be in the list. 

Arm deprecates using these instructions with both the LR and the PC in the list. 


For encoding T1: is a list ofone or more registers to be loaded, separated by commas and surrounded 
by { and }. The registers in the list must be in the range RO-R12, encoded in the "register _list" field, 
and can optionally contain one of the LR or the PC. If the LR is in the list, the "M" field is set to 1, 
otherwise it defaults to 0. If the PC is in the list, the "P" field is set to 1, otherwise it defaults to 0. 


If the PC is in the list: 
° The LR must not be in the list. 


d The instruction must be either outside any IT block, or the last instruction in an IT block. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n] - 4+BitCount(registers); 
for i = 0 to 14 
if registers<i> == '1' then 


R[i] = MemA[address,4]; address = address + 4; 


if registers<15> == '1' then 
LoadWritePC(MemA[address,4]); 


if wback && registers<n> == 'Q' then R[n] 
if wback && registers<n> == '1' then R[n] 


R[n] - 4«BitCount(registers) ; 
bits(32) UNKNOWN; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.71 LDMIB, LDMED 


ARM DDI 0487E.a 
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Load Multiple Increment Before (Empty Descending) loads multiple registers from consecutive memory locations 
using an address from a base register. The consecutive memory locations start just above this address, and the 
address of the last of those locations can optionally be written back to the base register. 


The lowest-numbered register is loaded from the lowest memory address, through to the highest-numbered register 
from the highest memory address. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


Armv8.2 permits the deprecation of some Load Multiple ordering behaviors in AArch32 state, for more information 
see ARMv8.2-LSMAOC. The registers loaded can include the PC, causing a branch to a loaded address. This is an 
interworking branch, see Pseudocode description of operations on the AArch32 general-purpose registers and the 
PC on page E1-3787. Related system instructions are LDM (User registers) and LDM (exception return). 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | o| 
1=1111 |1 0 ojijijojw]li| Rn | register_list 
cond 
A1 variant 


LDMIB{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
LDMED{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Empty Descending stack 


Decode for this encoding 
n = UInt(Rn); registers = register_list; whack = (W == '1'); 


if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 
if wback && registers<n> == '1' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction operates as an LDM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. Ifthe instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers loaded. 


If wback && registers<n> == '1', then one of the following behaviors must occur: 

: The instruction is UNDEFINED. 

° The instruction executes as NOP. 

7 The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


! The address adjusted by the size of the data loaded is written back to the base register. If specified, 
it is encoded in the "W" field as 1, otherwise this field defaults to 0. 


<registers> Is a list of one or more registers to be loaded, separated by commas and surrounded by { and }. 
The PC can be in the list. 
Arm deprecates using these instructions with both the LR and the PC in the list. 


Operation 


if ConditionPassed() then 

EncodingSpecificOperations(); 
address = R[n] + 4; 
for i = 0 to 14 

if registers<i> == '1' then 

R[i] = MemA[address,4]; address = address + 4; 

if registers<15> == '1' then 

LoadWritePC(MemA[address,4]); 
if wback && registers<n> == 'Q' then R[n] = R[n] + 4«BitCount(registers) ; 
if wback && registers<n> == '1' then R[n] = bits(32) UNKNOWN; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.72 LDR (immediate) 


Load Register (immediate) calculates an address from a base register value and an immediate offset, loads a word 
from memory, and writes it to a register. It can use offset, post-indexed, or pre-indexed addressing. For information 
about memory accesses see Memory accesses on page F2-3913. 


This instruction is used by the alias POP (single register). See Alias conditions on page F5-4241 for details of when 
each alias is preferred. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 | | 0 | 


enn [07 o[Plujojwyiy enn [| Rt [imma EY 
Rn 


cond 


Offset variant 
Applies when P == 1 && W == 


LDR{<c>}{<q>} <Rt>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == @ && W == 


LDR{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 


LDR{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDR (literal)"; 

if P == 'O' && W == '1' then SEE "LDRT"; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 

index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
if whack && n == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
- The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


T1 


|15 14 13 12/11 10 | 65 |32 0l 


[o 1 iloji] mm5 | Rn | R | 
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T1 variant 


LDR{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 


t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm5:'00', 32); 
index = TRUE; add = TRUE; wback = FALSE; 


T2 

|15 14 13 1211110 8|7 | 0| 
toot} R | imm | 

T2 variant 


LDR{<c>}{<q>} <Rt>, [SP{, #{+}<imm>}] 


Decode for this encoding 


t = UInt(Rt); n = 13; imm32 = ZeroExtend(imm8:'00', 32); 
index = TRUE; add = TRUE; wback = FALSE; 


T3 
|15 14 13 1211110 9 8|7 6 5 4/3 0 |15 12111 | | 0| 
Tit11000%1 0] EMM 
Rn 
T3 variant 


LDR{<c>}.W <Rt>, [<Rn> {, #{+}<imm>}] // <Rt>, <Rn>, <imm> can be represented in T1 or T2 
LDR{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 
if Rn == '1111' then SEE "LDR (literal)"; 


t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); index = TRUE; add = TRUE; 
whack = FALSE; if t == 15 && InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


T4 


[15 1413 12/1110 9 8|7 6 5 4/3 0 |15 12/1110 9 8|7 | 0 | 


111100001 oji] m1 | Rte [ijejujw imma | 
Rn 





Offset variant 

Applies when P == 1 && U == 0 && W == 
LDR{<c>}{<q>} <Rt>, [<Rn> {, #-<imm>}] 
Post-indexed variant 

Applies when P == 0 && W == 


LDR{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 
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Pre-indexed variant 
Applies when P == 1 && W == 


LDR{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDR (literal)"; 

if P == '1' & U == '1' && W == 'O' then SEE "LDRT"; 

if P == 'Q' && W == '@' then UNDEFINED; 

t = UInt(Rt); n = UInt(Rn); 

imm32 = ZeroExtend(imm8, 32); index = (P == '1'); add = (U == '1'); whback = (W == '1'); 
if (wback && n == t) || (t == 15 && InITBlock() && !LastInITBlock()) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Alias conditions 





Alias of variant is preferred when 
POP (single register) A1 (post-indexed) == 'Q' && U == '1' && W == 'O' && Rn == '1101' && imm12 == '000000000100' 


POP (single register) T4 (post-indexed) Rn == '1101' && U == '1' && imm8 == '00000100' 





Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 


can be used. If the PC is used, the instruction branches to the address (data) loaded to the PC. This 
is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


For encoding T1 and T2: is the general-purpose register to be transferred, encoded in the "Rt" field. 


For encoding T3 and T4: is the general-purpose register to be transferred, encoded in the "Rt" field. 
The PC can be used, provided the instruction is either outside an IT block or the last instruction of 
an IT block. If the PC is used, the instruction branches to the address (data) loaded to the PC. This 
is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


<Rn> For encoding A1, T3 and T4: is the general-purpose base register, encoded in the "Rn" field. For PC 
use see LDR (literal). 


For encoding T1: is the general-purpose base register, encoded in the "Rn" field. 
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F5-4242 


+/- 


<imm> 


Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 


- when U = 0 

+ when U = 1 

Specifies the offset is added to the base register. 

For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 
0 if omitted, and encoded in the "imm12" field. 


For encoding T1: is the optional positive unsigned immediate byte offset, a multiple of 4, in the 
range 0 to 124, defaulting to 0 and encoded in the "imm5" field as <imm>/4. 


For encoding T2: is the optional positive unsigned immediate byte offset, a multiple of 4, in the 
range 0 to 1020, defaulting to 0 and encoded in the "imm8" field as <imm>/4. 


For encoding T3: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 
defaulting to 0 and encoded in the "imm12" field. 


For encoding T4: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm8" field. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 


else 


if ConditionPassed() then 


EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
data = MemU[address,4]; 
if wback then R[n] = offset_addr; 
if t == 15 then 
if address<1:0> == '00' then 
LoadWritePC(data) ; 
else 
UNPREDICTABLE; 
else 
R[t] = data; 


if ConditionPassed() then 


EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
data = MemU[address,4]; 
if wback then R[n] = offset_addr; 
if t == 15 then 
if address<1:0> == '00' then 
LoadWritePC(data) ; 
else 
UNPREDICTABLE; 
else 
R[t] = data; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.73 LDR (literal) 


Load Register (literal) calculates an address from the PC value and an immediate offset, loads a word from memory, 
and writes it to a register. For information about memory accesses see Memory accesses on page F2-3913. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12111 | | 0| 
iit fo 1 of[Pjujojwi1]4 111| R | immi2 | 
cond 

A1 variant 


Applies when !(P == 0 && W == 1). 


LDR{<c>}{<q>} <Rt>, <label> // Normal form 
LDR{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative form 


Decode for this encoding 
if P == 'Q' && W == '1' then SEE "LDRT"; 
t = UInt(Rt); imm32 = ZeroExtend(imm12, 32); 


add = (U == '1'); whack = (P == '0') || (W == '1'); 
if wback then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

e The instruction executes as NOP. 

° The instruction executes with the additional decode: wback = FALSE;. 

è The instruction treats bit[24] as the P bit, and bit[21] as the writeback (W) bit, and uses the same addressing 


mode as described in LDR (immediate). The instruction uses post-indexed addressing when P == '0' and uses 
pre-indexed addressing otherwise. The instruction is handled as described in Using R15 on page K1-7607. 


T1 


|15 14 13 1211110 8|7 | 0| 


01001] R | imma | 


T1 variant 


LDR{<c>}{<q>} <Rt>, <label> // Normal form 


Decode for this encoding 


t = UInt(Rt); imm32 = ZeroExtend(imm8:'00', 32); add = TRUE; 
T2 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12111 | | 0 | 


14111100 oluji ojii ira] R | immi2 
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T2 variant 
LDR{<c>}.W <Rt>, <label> // Preferred syntax, and <Rt>, <label> can be represented in T1 


LDR{<c>}{<q>} <Rt>, <label> // Preferred syntax 
LDR{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative syntax 


Decode for this encoding 
t = UInt(Rt); imm32 = ZeroExtend(imml2, 32); add = (U == '1'); 
if t == 15 && InITBlock() && !LastInITBlock() then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 


can be used. If the PC is used, the instruction branches to the address (data) loaded to the PC. This 
is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


For encoding T1: is the general-purpose register to be transferred, encoded in the "Rt" field. 


For encoding T2: is the general-purpose register to be transferred, encoded in the "Rt" field. The SP 
can be used. The PC can be used, provided the instruction is either outside an IT block or the last 
instruction of an IT block. If the PC is used, the instruction branches to the address (data) loaded to 
the PC. This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


<label> For encoding A1 and T2: the label of the literal data item that is to be loaded into <Rt>. The 
assembler calculates the required value of the offset from the Align(PC, 4) value of the instruction 
to this label. Permitted values of the offset are -4095 to 4095. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. 
If the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 


For encoding T1: the label of the literal data item that is to be loaded into <Rt>. The assembler 
calculates the required value of the offset from the Align(PC, 4) value of the instruction to this label. 
Permitted values of the offset are Multiples of four in the range 0 to 1020. 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = @ 
+ when U = 1 

<imm> For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 


0 if omitted, and encoded in the "imm12" field. 


For encoding T2: is a 12-bit unsigned immediate byte offset, in the range 0 to 4095, encoded in the 
"imm12" field. 


The alternative syntax permits the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
base = Align(PC,4); 
address = if add then (base + imm32) else (base - imm32); 
data = MemU[address,4]; 
if t == 15 then 
if address<1:0> == 'QQ' then 
LoadwWritePC(data) ; 
else 
UNPREDICTABLE; 
else 
R[t] = data; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.74 


F5-4246 


LDR (register) 


Load Register (register) calculates an address from a base register value and an offset register value, loads a word 
from memory, and writes it to a register. The offset register value can optionally be shifted. For information about 


memory accesses, see Memory accesses on page F2-3913. 


The T32 form of LDR (register) does not support register writeback. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 7 6 5 4|3 0 | 
| sit [o 1 afPfufofwi1{ Rn | Rt | imm5 | stypefo] Rm | 


cond 


Offset variant 
Applies when P == 1 && W == 


LDR{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>{, <shift>}] 


Post-indexed variant 
Applies when P == 0 && W == 


LDR{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm>{, <shift>} 


Pre-indexed variant 
Applies when P == 1 && W == 


LDR{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>{, <shift>}]! 


Decode for all variants of this encoding 


if P == '0' && W == '1' then SEE "LDRT"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 

if m == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
à The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 


address might be corrupted so that the instruction cannot be repeated. 
T1 


15 14 13 1241110 9 8| 65 132 ol] 


ororo] km | Rn] R 
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T1 variant 


LDR{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 
(shift_t, shift_n) = (SRType_LSL, 0); 


T2 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


Rn 


T2 variant 


LDR{<c>}.W <Rt>, [<Rn>, {+}<Rm>] // <Rt>, <Rn>, <Rm> can be represented in T1 
LDR{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>{, LSL #<imm>}] 


Decode for this encoding 


if Rn == '1111' then SEE "LDR (literal)"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 

if m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
if t == 15 && InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 


can be used. If the PC is used, the instruction branches to the address (data) loaded to the PC. This 
branch is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 

For encoding T1: is the general-purpose register to be transferred, encoded in the "Rt" field. 

For encoding T2: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 
can be used, provided the instruction is either outside an IT block or the last instruction of an IT 
block. If the PC is used, the instruction branches to the address (data) loaded to the PC. This is an 


interworking branch, see Pseudocode description of operations on the AArch32 general-purpose 
registers and the PC on page E1-3787. 


<Rn> For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 
in the offset variant. 


For encoding T1 and T2: is the general-purpose base register, encoded in the "Rn" field. 


+/- Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 
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F5-4248 


+ 


<Rm> 


<shift> 


<imm> 


Specifies the index register is added to the base register. 
Is the general-purpose index register, encoded in the "Rm" field. 


The shift to apply to the value read from <Rm>. If absent, no shift is applied. Otherwise, see Shifts 
applied to a register on page F2-3911. 


If present, the size of the left shift to apply to the value from <Rm>, in the range 1-3. <imm> is encoded 
in imm2. If absent, no shift is specified and imm2 is encoded as 0b00. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 
if ConditionPassed() then 


else 


EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if index then offset_addr else R[n]; 
data = MemU[address,4]; 
if wback then R[n] = offset_addr; 
if t == 15 then 
if address<1:0> == '00' then 
LoadWritePC(data) ; 
else 
UNPREDICTABLE; 
else 
R[t] = data; 


if ConditionPassed() then 


EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
offset_addr = (R[n] + offset); 
address = offset_addr; 
data = MemU[address,4]; 
if t == 15 then 
if address<1:0> == '00' then 
LoadWritePC(data) ; 
else 
UNPREDICTABLE; 
else 
R[t] = data; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.75 LDRB (immediate) 


ARM DDI 0487E.a 
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Load Register Byte (immediate) calculates an address from a base register value and an immediate offset, loads a 
byte from memory, zero-extends it to form a 32-bit word, and writes it to a register. It can use offset, post-indexed, 
or pre-indexed addressing. For information about memory accesses see Memory accesses on page F2-3913. 


A1 


E 28|27 26 25 24|23 22 21 20|19 16/15 12\11 | 0 | 


Cen ropu M a [a | ae 





wond 


Offset variant 
Applies when P == 1 & W == 


LDRB{<c>}{<q>} <Rt>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == 0 & W == 


LDRB{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W == 


LDRB{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDRB (literal)"; 
if P == '0' && W == '1' then SEE "LDRBT"; 
= UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 
index = (P == '1'); add = (U == '1'); wback = (P == '0') || (W == '1'); 
if t == 15 || (whack && n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If whack && n == t, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
° The instruction executes as NOP. 
$ The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 


address might be corrupted so that the instruction cannot be repeated. 


T1 
|15 14 13 12/11 10 | 65 |32 0l 


T1 variant 


LDRB{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 
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F5-4250 


Decode for this encoding 


= UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm5, 32); 
index = TRUE; add = TRUE; wback = FALSE; 


T2 


ae 109 8|7 6 5 4|3 mi 12\11 | 0 | 


pee eee eo) a || ae 





T2 variant 


LDRB{<c>}.W <Rt>, [<Rn> {, #{+}<imm>}] // <Rt>, <Rn>, <imm> can be represented in T1 
LDRB{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 


if Rt == '1111' then SEE "PLD"; 
if Rn == '1111' then SEE "LDRB (literal)"; 
= UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 
index = TRUE; add = TRUE; wback = FALSE; 
// Armv8-A removes UNPREDICTABLE for R13 


T3 


[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 12/1110 9 8|7 | 0 | 


11111000 0J0 oft] 11 | Rte fJijejujw] imma | 
Rn 





Offset variant 
Applies when Rt != 1111 & P == 1 & U == 0 & W == 


LDRB{<c>}{<q>} <Rt>, [<Rn> {, #-<imm>}] 


Post-indexed variant 
Applies when P == 0 && W == 


LDRB{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W == 


LDRB{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rt == '1111' && P == '1' && U == '0' && W == '@' then SEE "PLD, PLDW (immediate)"; 
if Rn == '1111' then SEE "LDRB (literal)"; 
if P == '1' & U == '1' & W == '@' then SEE "LDRBT"; 
if P == 'Q' && W == '@' then UNDEFINED; 
= UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); 
index = (P == '1'); add = (U == '1'); whack = (W == '1'); 
if (t == 15 && W == '1') || (whack && n == t) then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 
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CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> For encoding A1, T2 and T3: is the general-purpose base register, encoded in the "Rn" field. For PC 


use see LDRB (literal). 


For encoding T1: is the general-purpose base register, encoded in the "Rn" field. 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

+ Specifies the offset is added to the base register. 

<imm> For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 


0 if omitted, and encoded in the "imm12" field. 


For encoding T1: is an optional 5-bit unsigned immediate byte offset, in the range 0 to 31, defaulting 
to 0 and encoded in the "imm5" field. 


For encoding T2: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 
defaulting to 0 and encoded in the "imm12" field. 


For encoding T3: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm8" field. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 
if ConditionPassed() then 
EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
R[t] = ZeroExtend(MemU[address,1], 32); 
if wback then R[n] = offset_addr; 
else 
if ConditionPassed() then 
EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
R[t] = ZeroExtend(MemU[address,1], 32); 
if wback then R[n] = offset_addr; 
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Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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LDRB (literal) 


ARM DDI 0487E.a 


Load Register Byte (literal) calculates an address from the PC value and an immediate offset, loads a byte from 
memory, zero-extends it to form a 32-bit word, and writes it to a register. For information about memory accesses 
see Memory accesses on page F2-3913. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 1211 | | 0 | 
121111 [|o 1 ofejujijwļlili 1 1a] R | mm2 ž 
cond 

A1 variant 


Applies when !(P == 0 && W == 1). 


LDRB{<c>}{<q>} <Rt>, <label> // Normal form 
LDRB{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative form 


Decode for this encoding 
if P == '0' && W == '1' then SEE "LDRBT"; 
t = UInt(Rt); imm32 = ZeroExtend(imm12, 32); 


add = (U == '1'); whack = (P == '@') || (W == '1'); 
if t == 15 || wback then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback, then one of the following behaviors must occur: 


a The instruction is UNDEFINED. 

. The instruction executes as NOP. 

° The instruction executes with the additional decode: wback = FALSE;. 

è The instruction treats bit[24] as the P bit, and bit[21] as the writeback (W) bit, and uses the same addressing 


mode as described in LDRB (immediate). The instruction uses post-indexed addressing when P == '0' and 
uses pre-indexed addressing otherwise. The instruction is handled as described in Using R15 on 
page K1-7607. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0ļ15 12\11 | | 0 | 


TiitioooMooiii1 i a | mma —=z 
Rt 


T1 variant 


LDRB{<c>}{<q>} <Rt>, <label> // Preferred syntax 
LDRB{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative syntax 


Decode for this encoding 


if Rt == '1111' then SEE "PLD"; 
t = UInt(Rt); imm32 = ZeroExtend(imml2, 32); add = (U == '1'); 
// Armv8-A removes UNPREDICTABLE for R13 
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F5-4254 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<label> The label of the literal data item that is to be loaded into <Rt>. The assembler calculates the required 


value of the offset from the Align(PC, 4) value of the instruction to this label. Permitted values of 
the offset are -4095 to 4095. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. 


If the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

<imm> For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 


0 if omitted, and encoded in the "imm12" field. 


For encoding T1: is a 12-bit unsigned immediate byte offset, in the range 0 to 4095, encoded in the 
"imm12" field. 


The alternative syntax permits the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
base = Align(PC,4); 
address = if add then (base + imm32) else (base - imm32); 
R[t] = ZeroExtend(MemU[address,1], 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.77 LDRB (register) 


ARM DDI 0487E.a 
ID070919 


Load Register Byte (register) calculates an address from a base register value and an offset register value, loads a 
byte from memory, zero-extends it to form a 32-bit word, and writes it to a register. The offset register value can 
optionally be shifted. For information about memory accesses see Memory accesses on page F2-3913. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 |7 6 5 4|3 0 | 
Pst fo 1 1fejujijwji] Rn | R Timms stypefo] Rm | 


cond 


Offset variant 
Applies when P == 1 & W == 


LDRB{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>{, <shift>}] 


Post-indexed variant 
Applies when P == 0 & W == 


LDRB{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm>{, <shift>} 


Pre-indexed variant 
Applies when P == 1 & W == 


LDRB{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>{, <shift>}]! 


Decode for all variants of this encoding 


if P == 'Q' && W == '1' then SEE "LDRBT"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 

if t == 15 || m == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If whack && n == t, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
° The instruction executes as NOP. 
5 The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


T1 
|15 14 13 1241110 9 8| 65 132 ol] 


or ormo] km | Rn] R 


T1 variant 


LDRB{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>] 
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F5-4256 


Decode for this encoding 


t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 
index = TRUE; add = TRUE; wback = FALSE; 
(shift_t, shift_n) = (SRType_LSL, Q); 


T2 


[15 141312/11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





[11441000 0f0 oft] 1m1 | 1111 fo 0 0 0 0 Ofimm2] Rm | 
Rn Rt 





T2 variant 


LDRB{<c>}.W <Rt>, [<Rn>, {+}<Rm>] // <Rt>, <Rn>, <Rm> can be represented in T1 
LDRB{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>{, LSL #<imm>}] 


Decode for this encoding 


if Rt = 


if Rn 


'1111' then SEE "PLD"; 
'1111' then SEE "LDRB (literal)"; 


t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = TRUE; add = TRUE; wback = FALSE; 

(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 

if m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 
<q> 
<Rt> 


<Rn> 


+/- 


+ 
<Rm> 


<shift> 


<imm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose register to be transferred, encoded in the "Rt" field. 


For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 
in the offset variant. 

For encoding T1 and T2: is the general-purpose base register, encoded in the "Rn" field. 

Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 

- when U = 0 


+ when U = 1 
Specifies the index register is added to the base register. 
Is the general-purpose index register, encoded in the "Rm" field. 


The shift to apply to the value read from <Rm>. If absent, no shift is applied. Otherwise, see Shifts 
applied to a register on page F2-3911. 


If present, the size of the left shift to apply to the value from <Rm>, in the range 1-3. <imm> is encoded 
in imm2. If absent, no shift is specified and imm2 is encoded as 0b00. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if index then offset_addr else R[n]; 
R[t] = ZeroExtend(MemU[address,1] ,32); 
if wback then R[n] = offset_addr; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.78 


F5-4258 


LDRBT 


Load Register Byte Unprivileged loads a byte from memory, zero-extends it to form a 32-bit word, and writes it to 
a register. For information about memory accesses see Memory accesses on page F2-3913. 


The memory access is restricted as if the PE were running in User mode. This makes no difference if the PE is 
actually running in User mode. 


LDRBT is UNPREDICTABLE in Hyp mode. 


The T32 instruction uses an offset addressing mode, that calculates the address used for the memory access from a 
base register value and an immediate offset, and leaves the base register unchanged. 


The A32 instruction uses a post-indexed addressing mode, that uses a base register value as the address for the 
memory access, and calculates a new address from a base register value and an offset and writes it back to the base 
register. The offset can be an immediate value or an optionally-shifted register value. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 | | o| 
Cem ot opu en | R | ë ë ë m ý Eò 
cond 
A1 variant 


LDRBT{<c>}{<q>} <Rt>, [<Rn>] {, #{+/-}<imm>} 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); postindex = TRUE; add = (U == '1'); 


register_form = FALSE; imm32 = ZeroExtend(imm12, 32); 
if t == 15 || n == 15 || n == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 
s The instruction uses immediate offset addressing with the base register as PC, without writeback. 


Ifn == t & n != 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
è The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


A2 


31 28|27 26 25 24|23 22 21 20/19 16/15 12|11 7 6 5 4|3 0 | 


Perm foou] en | R | mms __[stypeJo. Rm _| 


cond 
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A2 variant 


LDRBT{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm>{, <shift>} 


Decode for this encoding 


t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 


postindex = TRUE; add = (U == '1'); 


register_form = TRUE; (shift_t, shift_n) = DecodeImmShift(stype, imm5); 
if t == 15 || n == 15 || n == t || m == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == t && n != 15, then one of the following behaviors must occur: 


T1 


The instruction is UNDEFINED. 
The instruction executes as NOP. 


The instruction performs all of the loads using the specified addressing mode and the content of the register 
that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0 | 


11177000 0/0 oft] mmm | Rte [1110] imme | 
Rn 


T1 variant 


LDRBT{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 


if Rn == '1111' then SEE "LDRB (literal)"; 

t = UInt(Rt); n = UInt(Rn); postindex = FALSE; add = TRUE; 
register_form = FALSE; imm32 = ZeroExtend(imm8, 32); 

if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 
<q> 


<Rt> 


<Rn> 


+/- 


ARM DDI 0487E.a 
ID070919 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 
can be used, but this is deprecated. 


For encoding A2 and T1: is the general-purpose register to be transferred, encoded in the "Rt" field. 
Is the general-purpose base register, encoded in the "Rn" field. 


For encoding A1: specifies the offset is added to or subtracted from the base register, defaulting to 
+ if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 
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F5-4260 


For encoding A2: specifies the index register is added to or subtracted from the base register, 
defaulting to + if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 
<Rm> Is the general-purpose index register, encoded in the "Rm" field. 
<shift> The shift to apply to the value read from <Rm>. If absent, no shift is applied. Otherwise, see Shifts 


applied to a register on page F2-3911. 
+ Specifies the offset is added to the base register. 


<imm> For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 
0 if omitted, and encoded in the "imm12" field. 


For encoding T1: is an optional 8-bit unsigned immediate byte offset, in the range 0 to 255, 
defaulting to 0 and encoded in the "imm8" field. 


Operation for all encodings 


if ConditionPassed() then 
if PSTATE.EL == EL2 then UNPREDICTABLE; // Hyp mode 
EncodingSpecificOperations(); 
offset = if register_form then Shift(R[m], shift_t, shift_n, PSTATE.C) else imm32; 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if postindex then R[n] else offset_addr; 
R[t] = ZeroExtend(MemU_unpriv[address,1] , 32); 
if postindex then R[n] = offset_addr; 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == EL2, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction executes as LDRB (immediate). 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.79 LDRD (immediate) 


ARM DDI 0487E.a 
ID070919 


Load Register Dual (immediate) calculates an address from a base register value and an immediate offset, loads two 
words from memory, and writes them to two registers. It can use offset, post-indexed, or pre-indexed addressing. 
For information about memory accesses see Memory accesses on page F2-3913. 





A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 8|7 6 5 4|3 0 | 
| eit [o o ofejuļijw]o] 111 | Rt | imm4H_[1[1 ojij imma | 
cond Rn 


Offset variant 
Applies when P == 1 & W == 


LDRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == 0 & W == 


LDRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W == 


LDRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDRD (literal)"; 

if Rt<@> == '1' then UNPREDICTABLE; 

t = UInt(Rt); t2 = t+1; n = UInt(Rn); imm32 = ZeroExtend(imm4H:imm4L, 32); 
index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 

if P == '0' && W == '1' then UNPREDICTABLE; 

if whack && (n == t || n == t2) then UNPREDICTABLE; 

if t2 == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && (n == t || n == t2), then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
° The instruction executes as NOP. 
s The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


IfP == 'Q' && W == '1', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction executes as an LDRD using one of offset, post-indexed, or pre-indexed addressing. 
If Rt<@> == '1', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
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F5-4262 


° The instruction executes with the additional decode: t<0> = '0'. 
. The instruction executes with the additional decode: t2 = t. 
° The instruction executes as described, with no change to its behavior and no additional side-effects. This does 


not apply when Rt =='1111'. 
T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12\11 8|7 | 0 | 


manon oop we enn] Rt | Ra | imme | 
Rn 


Offset variant 
Applies when P == 1 && W == 


LDRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == @ && W == 


LDRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 


LDRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if P == '0' && W == 'Q' then SEE "Related encodings"; 

if Rn == '1111' then SEE "LDRD (literal)"; 

t = UInt(Rt); t2 = UInt(Rt2); n = UInt(Rn); imm32 = ZeroExtend(imm8:'0Q', 32); 

index = (P == '1'); add = (U == '1'); whack = (W == '1'); 

if whack && (n == t || n == t2) then UNPREDICTABLE; 

if t == 15 || t2 == 15 || t == t2 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If whack && (n == t || n == t2), then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
è The instruction executes as NOP. 
è The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


If t == t2, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The load instruction executes but the destination register takes an UNKNOWN value. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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Related encodings: Load/store dual, load/store exclusive, load-acquire/store-release, and table branch on 
page F3-3975. 


Assembler symbols 


<C> 
<q> 


<Rt> 


<Rt2> 


<Rn> 


+/- 


<imm> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

For encoding A1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 
This register must be even-numbered and not R14. 

For encoding T1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 
For encoding A1: is the second general-purpose register to be transferred. This register must be 
<R(t+1)>. 

For encoding T1: is the second general-purpose register to be transferred, encoded in the "Rt2" field. 
Is the general-purpose base register, encoded in the "Rn" field. For PC use see LDRD (literal). 
Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 

- when U = 0 

+ when U = 1 

For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is the unsigned immediate byte offset, a multiple of 4, in the range 0 to 1020, 
defaulting to 0 if omitted, and encoded in the "imm8" field as <imm>/4. 


Operation for all encodings 


if ConditionPassed() then 


Ope 


EncodingSpecificOperations(); 


offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 


if address == Align(address, 8) then 
data = MemA[address,8]; 
if BigEndian() then 
R[t] = data<63:32>; 
R[t2] = data<31:0>; 
else 
R[t] = data<31:0>; 
R[t2] = data<63:32>; 
else 
R[t] = MemA[address,4]; 
R[t2] = MemA[address+4,4]; 
if wback then R[n] = offset_addr; 


rational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


ARM DDI 0487E.a 
ID070919 
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F5.1.80 LDRD (literal) 


Load Register Dual (literal) calculates an address from the PC value and an immediate offset, loads two words from 
memory, and writes them to two registers. For information about memory accesses see Memory accesses on 
page F2-3913. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 1211 8|7 6 5 4/3 0| 

| !=1111 [o o okolujakojo]i 11 1| Rt | imma [tft ofi] imma | 
cond 

A1 variant 


LDRD{<c>}{<q>} <Rt>, <Rt2>, <label> // Normal form 
LDRD{<c>}{<q>} <Rt>, <Rt2>, [PC, #{+/-}<imm>] // Alternative form 


Decode for this encoding 
if Rt<@> == '1' then UNPREDICTABLE; 


t = UInt(Rt); t2 = t+1; | imm32 = ZeroExtend(imm4H:imm4L, 32); add = (U == '1'); 
if t2 == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If Rt<@> == '1', then one of the following behaviors must occur: 

. The instruction is UNDEFINED. 

. The instruction executes as NOP. 

. The instruction executes with the additional decode: t<0> = '0';. 

° The instruction executes with the additional decode: t2 = t;. 

° The instruction executes as described, with no change to its behavior and no additional side-effects. This does 


not apply when Rt =='1111'. 


IfP == '0' || W == '1', then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The instruction executes as if P == 1 and W == 0.' 
T1 
[15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12|11 8/7 | 0| 


Tattoo opunea ek | Re | ime 


T1 variant 
Applies when !(P == 0 && W == 0). 


LDRD{<c>}{<q>} <Rt>, <Rt2>, <label> // Normal form 
LDRD{<c>}{<q>} <Rt>, <Rt2>, [PC, #{+/-}<imm>] // Alternative form 
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Decode for this encoding 


if P == '0' && W == 'Q' then SEE "Related encodings"; 

t = UInt(Rt); t2 = UInt(Rt2); 

imm32 = ZeroExtend(imm8:'Q0', 32); add = (U == '1'); 

if t == 15 || t2 == 15 || t == t2 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
if W == '1' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 

$ The instruction executes as NOP. 

. The load instruction executes but the destination register takes an UNKNOWN value. 

IfW == '1', then one of the following behaviors must occur: 

s The instruction is UNDEFINED. 

. The instruction executes as NOP. 

° The instruction executes without writeback of the base address. 

° The instruction uses post-indexed addressing when P == '0' and uses pre-indexed addressing otherwise. The 


instruction is handled as described in Using R15 on page K1-7607. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related encodings: Load/store dual, load/store exclusive, load-acquire/store-release, and table branch on 
page F3-3975. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 


This register must be even-numbered and not R14. 

For encoding T1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 
<Rt2> For encoding A1: is the second general-purpose register to be transferred. This register must be 

<R(t+1)>. 

For encoding T1: is the second general-purpose register to be transferred, encoded in the "Rt2" field. 
<label> For encoding A1: the label of the literal data item that is to be loaded into <Rt>. The assembler 


calculates the required value of the offset from the Align(PC, 4) value of the instruction to this label. 
Any value in the range -255 to 255 is permitted. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. If 
the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 


For encoding T1: the label of the literal data item that is to be loaded into <Rt>. The assembler 
calculates the required value of the offset from the Align(PC, 4) value of the instruction to this label. 
Permitted values of the offset are multiples of 4 in the range -1020 to 1020. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. 


If the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 
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+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

<imm> For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 


if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is the optional 8-bit unsigned immediate byte offset, in the range 0 to 255, 
defaulting to 0 and encoded in the "imm8" field. 


The alternative syntax permits the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = if add then (Align(PC,4) + imm32) else (Align(PC,4) - imm32); 
if address == Align(address, 8) then 
data = MemA[address,8]; 
if BigEndian() then 
R[t] = data<63:32>; 
R[t2] = data<31:0>; 
else 
R[t] = data<31:0>; 
R[t2] = data<63:32>; 
else 
R[t] = MemA[address,4]; 
R[t2] = MemA[address+4,4]; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.81 LDRD (register) 


ARM DDI 0487E.a 
ID070919 


Load Register Dual (register) calculates an address from a base register value and a register offset, loads two words 
from memory, and writes them to two registers. It can use offset, post-indexed, or pre-indexed addressing. For 


information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[111 Jo o ofpiujofwjof Rn | Rt  kokokoko]i]i oft] Rm | 





cond 


Offset variant 
Applies when P == 1 & W == 


LDRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>, {+/-}<Rm>] 


Post-indexed variant 
Applies when P == @ && W == 


LDRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>], {+/-}<Rm> 


Pre-indexed variant 
Applies when P == 1 && W == 


LDRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>, {+/-}<Rm>]! 


Decode for all variants of this encoding 


if Rt<@> == '1' then UNPREDICTABLE; 

t = UInt(Rt); t2 = t+1; n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
if P == 'Q' && W == '1' then UNPREDICTABLE; 

if t2 == 15 || m == 15 || m == t || m == t2 then UNPREDICTABLE; 

if whack && (n == 15 || n == t || n == t2) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If whack && (n == t || n == t2), then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
° The instruction executes as NOP. 
5 The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 


address might be corrupted so that the instruction cannot be repeated. 


IfP == '0' && W == '1', then one of the following behaviors must occur: 

$ The instruction is UNDEFINED. 

a The instruction executes as NOP. 

° The instruction executes as an LDRD using one of offset, post-indexed, or pre-indexed addressing. 


Ifm == t || m == t2, then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 


° The instruction executes as NOP. 
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F5-4268 


The instruction loads register Rm with an UNKNOWN value. 


If Rt<@> == '1', then one of the following behaviors must occur: 


The instruction is UNDEFINED. 
The instruction executes as NOP. 
The instruction executes with the additional decode: t<0> = '0'. 


The instruction executes with the additional decode: t2 = t. 


The instruction executes as described, with no change to its behavior and no additional side-effects. This does 


not apply when Rt =='1111'. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Archi. 


tectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 
<q> 


<Rt> 


<Rt2> 


<Rn> 


+/- 


<Rm> 


Ope 


See Standard assembler syntax fields on page F2-3908. 


See Standard assembler syntax fields on page F2-3908. 


Is the first general-purpose register to be transferred, encoded in the "Rt" field. This register must 


be even-numbered and not R14. 


Is the second general-purpose register to be transferred. This register must be <R(t+1)>. 


Is the general-purpose base register, encoded in the "Rn" field. The PC can be used in the offset 


variant. 


Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 


and encoded in the "U" field. It can have the following values: 
- when U = 0 


+ when U = 1 


Is the general-purpose index register, encoded in the "Rm" field. 


ration 


if ConditionPassed() then 


EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + R[m]) else (R[n] - R[m]); 
address = if index then offset_addr else R[n]; 
if address == Align(address, 8) then 
data = MemA[address,8]; 
if BigEndian() then 
R[t] = data<63:32>; 
R[t2] = data<31:0>; 
else 
R[t] = data<31:0>; 
R[t2] = data<63:32>; 
else 
R[t] = MemA[address,4]; 
R[t2] = MemA[address+4,4]; 


if wback then R[n] = offset_addr; 
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Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4269 
ID070919 Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.82 LDREX 


Load Register Exclusive calculates an address from a base register value and an immediate offset, loads a word from 
memory, writes it to a register and: 


° If the address has the Shared Memory attribute, marks the physical address as exclusive access for the 
executing PE in a global monitor. 


. Causes the executing PE to indicate an active exclusive access in the local monitor. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


[=m fo oo 4 tfo oft} Rao | R aft ft o o MMMM 


cond 


A1 variant 


LDREX{<c>}{<q>} <Rt>, [<Rn> {, {#}<imm>}] 


Decode for this encoding 


t = UInt(Rt); n = UInt(Rn); imm32 = Zeros(32); // Zero offset 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


111010000100] RA | R (OMG, me | 


T1 variant 


LDREX{<c>}{<q>} <Rt>, [<Rn> {, #<imm>}] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8:'00', 32); 
if t == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 

<imm> For encoding A1: the immediate offset added to the value of <Rn> to calculate the address. <imm> can 


only be 0 or omitted. 


F5-4270 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


For encoding T1: the immediate offset added to the value of <Rn> to calculate the address. <imm> can 
be omitted, meaning an offset of 0. Values are multiples of 4 in the range 0-1020. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n] + imm32; 
AArch32.SetExclusiveMonitors(address,4); 
R[t] = MemA[address,4]; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.83 LDREXB 


Load Register Exclusive Byte derives an address from a base register value, loads a byte from memory, zero-extends 
it to form a 32-bit word, writes it to a register and: 


° If the address has the Shared Memory attribute, marks the physical address as exclusive access for the 
executing PE in a global monitor. 


. Causes the executing PE to indicate an active exclusive access in the local monitor. 
For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 


information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


[=m foo ot tft ofi] Rao | R ojij o oN MOM 


cond 


A1 variant 


LDREXB{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


[1101000171 0f4f Ro | R Woa] 1o ofa) 


T1 variant 


LDREXB{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
AArch32.SetExclusiveMonitors(address,1); 
R[t] = ZeroExtend(MemA[address,1], 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.84 LDREXD 


Load Register Exclusive Doubleword derives an address from a base register value, loads a 64-bit doubleword from 
memory, writes it to two registers and: 


od If the address has the Shared Memory attribute, marks the physical address as exclusive access for the 
executing PE in a global monitor. 


. Causes the executing PE to indicate an active exclusive access in the local monitor. 
For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 


information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


[=m fo oot tfo att} Rao | R ojij o o MMO 


cond 


A1 variant 
LDREXD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>] 


Decode for this encoding 


t = UInt(Rt); t2 =t + 1; n = UInt(Rn); 
if Rt<@> == '1' || t2 == 15 || n == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If Rt<@> == '1', then one of the following behaviors must occur: 

: The instruction is UNDEFINED. 

s The instruction executes as NOP. 

s The instruction executes with the additional decode: t<0> = '0'. 

$ The instruction executes with the additional decode: t2 =t. 

° The instruction executes as described, with no change to its behavior and no additional side effects. 
IfRt == '1110', then one of the following behaviors must occur: 

. The instruction is UNDEFINED. 

à The instruction executes as NOP. 


à The instruction is handled as described in Using R15 on page K1-7607. 
T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12111 8|7 6 5 4|3 21 0| 


fa totoootio mm | Rk | Re piion 


T1 variant 


LDREXD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>] 
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Decode for this encoding 
t = UInt(Rt); t2 = UInt(Rt2); n = UInt(Rn); 


if t == 15 || t2 == 15 || t == t2 || n == 15 then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The load instruction executes but the destination register takes an UNKNOWN value. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 


<Rt> must be even-numbered and not R14. 


For encoding T1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 


<Rt2> For encoding A1: is the second general-purpose register to be transferred. <Rt2> must be <R(t+1)>. 


For encoding T1: is the second general-purpose register to be transferred, encoded in the "Rt2" field. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
AArch32.SetExclusiveMonitors(address, 8); 
value = MemA[address, 8]; 
// Extract words from 64-bit loaded value such that R[t] is 
// loaded from address and R[t2] from address+4. 
R[t] = if BigEndian() then value<63:32> else value<31:0>; 
R[t2] = if BigEndian() then value<31:0> else value<63:32>; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.85 LDREXH 


Load Register Exclusive Halfword derives an address from a base register value, loads a halfword from memory, 
zero-extends it to form a 32-bit word, writes it to a register and: 


° If the address has the Shared Memory attribute, marks the physical address as exclusive access for the 
executing PE in a global monitor. 


. Causes the executing PE to indicate an active exclusive access in the local monitor. 
For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 


information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


pti fo oot ttt 1j] Rao | R ojij o o 1M MOM 


cond 


A1 variant 


LDREXH{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


f‘t1t101000171 0f4f R | R Woa] ilo 14a) 


T1 variant 


LDREXH{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
AArch32.SetExclusiveMonitors(address,2); 
R[t] = ZeroExtend(MemA[address,2], 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.86 


F5-4278 


LDRH (immediate) 


Load Register Halfword (immediate) calculates an address from a base register value and an immediate offset, loads 
a halfword from memory, zero-extends it to form a 32-bit word, and writes it to a register. It can use offset, 
post-indexed, or pre-indexed addressing. For information about memory accesses see Memory accesses on 

page F2-3913. 





A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 8/7 6 5 4|3 0 | 
Tem [oo ofPultwii[ =i [Rt | immat [1]0 4] 1] imma 
cond Rn 


Offset variant 


Applies when P == 1 && W == 


LDRH{<c>}{<q>} <Rt>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 


Applies when P == @ && W == 


LDRH{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 


Applies when P == 1 && W == 


LDRH{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>] ! 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDRH (literal)"; 

if P == 'Q@' && W == '1' then SEE "LDRHT"; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm4H:imm4L, 32); 

index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
if t == 15 || (whack && n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


T1 


The instruction is UNDEFINED. 
The instruction executes as NOP. 


The instruction performs all of the loads using the specified addressing mode and the content of the register 
that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


|15 14 13 12/11 10 | 65 |32 Of 


T1 variant 


LDRH{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 
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Decode for this encoding 


= UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm5:'@', 32); 
index = TRUE; add = TRUE; wback = FALSE; 


T2 


ae 109 8|7 6 5 4|3 mi 12\11 | 0 | 


peer eee ee) ee || ae 





T2 variant 


LDRH{<c>}.W <Rt>, [<Rn> {, #{+}<imm>}] // <Rt>, <Rn>, <imm> can be represented in T1 
LDRH{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 


if Rt == '1111' then SEE "PLD (immediate)"; 
if Rn == '1111' then SEE "LDRH (literal)"; 
= UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 
index = TRUE; add = TRUE; wback = FALSE; 
// Armv8-A removes UNPREDICTABLE for R13 


T3 


[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 12/1110 9 8|7 | 0 | 


11111000 o0ļjo1ji] 11 | Re [il[plulw] imma | 
Rn 





Offset variant 
Applies when Rt != 1111 & P == 1 & U == 0 & W == 


LDRH{<c>}{<q>} <Rt>, [<Rn> {, #-<imm>}] 


Post-indexed variant 
Applies when P == 0 & W == 


LDRH{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W == 


LDRH{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDRH (literal)"; 
if Rt == '1111' && P == '1' && U == 'O' && W == 'Q@' then SEE "PLDW (immediate)"; 
if P == '1' & U == '1' && W == '@' then SEE "LDRHT"; 
if P == 'Q' && W == '@' then UNDEFINED; 
= UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); 
index = (P == '1'); add = (U == '1'); whack = (W == '1'); 
if (t == 15 && W == '1') || (wback && n == t) then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 
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F5-4280 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


The instruction is UNDEFINED. 
The instruction executes as NOP. 


The instruction performs all of the loads using the specified addressing mode and the content of the register 
that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 
<q> 
<Rt> 


<Rn> 


+/- 


<imm> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose register to be transferred, encoded in the "Rt" field. 

For encoding A1, T2 and T3: is the general-purpose base register, encoded in the "Rn" field. For PC 
use see LDRH (literal). 

For encoding T1: is the general-purpose base register, encoded in the "Rn" field. 

Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 

- when U = 0 

+ when U = 1 

Specifies the offset is added to the base register. 

For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is the optional positive unsigned immediate byte offset, a multiple of 2, in the 
range 0 to 62, defaulting to 0 and encoded in the "imm5" field as <imm>/2. 


For encoding T2: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 
defaulting to 0 and encoded in the "imm12" field. 


For encoding T3: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm8" field. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 


else 


if ConditionPassed() then 


EncodingSpecificOperations(); 

offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 

data = MemU[address,2]; 

if wback then R[n] = offset_addr; 

R[t] = ZeroExtend(data, 32); 


if ConditionPassed() then 


EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
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data = MemU[address,2]; 

if wback then R[n] = offset_addr; 

R[t] = ZeroExtend(data, 32); 
Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.87 


F5-4282 


LDRH (literal) 


Load Register Halfword (literal) calculates an address from the PC value and an immediate offset, loads a halfword 
from memory, zero-extends it to form a 32-bit word, and writes it to a register. For information about memory 


accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|11 8|7 6 5 4|3 0 | 


[m11 fo o ofptujiafwiift 11 1f Rt | imma [ijo ifi] imma | 





cond 


A1 variant 
Applies when !(P == 0 && W == 1). 


LDRH{<c>}{<q>} <Rt>, <label> // Normal form 
LDRH{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative form 


Decode for this encoding 
if P == '0' && W == '1' then SEE "LDRHT"; 
t = UInt(Rt); imm32 = ZeroExtend(imm4H:imm4L, 32); 


add = (U == '1'); whack = (P == '@') || (W == '1'); 
if t == 15 || wback then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback, then one of the following behaviors must occur: 


a The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction executes with the additional decode: wback = FALSE;. 

è The instruction treats bit[24] as the P bit, and bit[21] as the writeback (W) bit, and uses the same addressing 


mode as described in LDRH (immediate). The instruction uses post-indexed addressing when P == '0' and 


uses pre-indexed addressing otherwise. The instruction is handled as described in Using R15 on 
page K1-7607. 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12\11 | | 0 | 


Tiittooouoii7 i sn | imma ——SC=~™ 
Rt 


T1 variant 


LDRH{<c>}{<q>} <Rt>, <label> // Preferred syntax 
LDRH{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative syntax 


Decode for this encoding 


if Rt == '1111' then SEE "PLD (literal)"; 
t = UInt(Rt); imm32 = ZeroExtend(imml2, 32); add = (U == '1'); 
// Armv8-A removes UNPREDICTABLE for R13 
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Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<label> For encoding A1: the label of the literal data item that is to be loaded into <Rt>. The assembler 


calculates the required value of the offset from the Align(PC, 4) value of the instruction to this label. 
Any value in the range -255 to 255 is permitted. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. If 
the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 


For encoding T1: the label of the literal data item that is to be loaded into <Rt>. The assembler 
calculates the required value of the offset from the Align(PC, 4) value of the instruction to this label. 
Permitted values of the offset are -4095 to 4095. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. 


If the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = @ 
+ when U = 1 

<imm> For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 


if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is a 12-bit unsigned immediate byte offset, in the range 0 to 4095, encoded in the 
"imm12" field. 


The alternative syntax permits the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
base = Align(PC,4); 
address = if add then (base + imm32) else (base - imm32); 
data = MemU[address,2]; 
R[t] = ZeroExtend(data, 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.88 


F5-4284 


LDRH (register) 


Load Register Halfword (register) calculates an address from a base register value and an offset register value, loads 
a halfword from memory, zero-extends it to form a 32-bit word, and writes it to a register. The offset register value 


can be shifted left by 0, 1, 2, or 3 bits. For information about memory accesses see Memory accesses on 
page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 





[111 fo o ofPfujofwiif Rn | R ooo to afi] Rm | 


cond 


Offset variant 
Applies when P == 1 & W == 


LDRH{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>] 


Post-indexed variant 
Applies when P == 0 & W == 


LDRH{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm> 


Pre-indexed variant 
Applies when P == 1 & W == 


LDRH{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>]! 


Decode for all variants of this encoding 


if P == '0' && W == '1' then SEE "LDRHT"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); wback = (P == 'Q') || (W == '1'); 
(shift_t, shift_n) = (SRType_LSL, 0); 

if t == 15 || m == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


š The instruction is UNDEFINED. 

- The instruction executes as NOP. 

è The instruction performs all of the loads using the specified addressing mode and the content of the register 
that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 

T1 

|15 14 13 12/1110 9 8| 65 |32 0] 
oroin] km | Rn | Re 

T1 variant 

LDRH{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>] 
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Decode for this encoding 


t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 
index = TRUE; add = TRUE; wback = FALSE; 
(shift_t, shift_n) = (SRType_LSL, Q); 


T2 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


Rn Rt 





T2 variant 


LDRH{<c>}.W <Rt>, [<Rn>, {+}<Rm>] // <Rt>, <Rn>, <Rm> can be represented in T1 
LDRH{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>{, LSL #<imm>}] 


Decode for this encoding 


if Rn == '1111' then SEE "LDRH (literal)"; 

if Rt == '1111' then SEE "PLDW (register)"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = TRUE; add = TRUE; wback = FALSE; 

(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 

if m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 


in the offset variant. 


For encoding T1 and T2: is the general-purpose base register, encoded in the "Rn" field. 


+/- Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

+ Specifies the index register is added to the base register. 

<Rm> Is the general-purpose index register, encoded in the "Rm" field. 

<imm> If present, the size of the left shift to apply to the value from <Rm>, in the range 1-3. <imm> is encoded 


in imm2. If absent, no shift is specified and imm2 is encoded as 0b00. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
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offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if index then offset_addr else R[n]; 

data = MemU[address,2]; 

if wback then R[n] = offset_addr; 

R[t] = ZeroExtend(data, 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.89 LDRHT 


Load Register Halfword Unprivileged loads a halfword from memory, zero-extends it to form a 32-bit word, and 
writes it to a register. For information about memory accesses see Memory accesses on page F2-3913. 


The memory access is restricted as if the PE were running in User mode. This makes no difference if the PE is 
actually running in User mode. 


LDRHT is UNPREDICTABLE in Hyp mode. 


The T32 instruction uses an offset addressing mode, that calculates the address used for the memory access from a 
base register value and an immediate offset, and leaves the base register unchanged. 


The A32 instruction uses a post-indexed addressing mode, that uses a base register value as the address for the 
memory access, and calculates a new address from a base register value and an offset and writes it back to the base 
register. The offset can be an immediate value or a register value. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 12111 8|7 6 5 4]|3 0| 

Fem joo ojoun An | R | imma [1]0 4] 1] imma 
cond 

A1 variant 


LDRHT{<c>}{<q>} <Rt>, [<Rn>] {, #{+/-}<imm>} 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); postindex = TRUE; add = (U == '1'); 


register_form = FALSE; imm32 = ZeroExtend(imm4H:imm4L, 32); 
if t == 15 || n == 15 || n == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 


s The instruction is treated as if bit[24] == '1' and bit[21] == '0'. The instruction uses immediate offset 
addressing with the base register as PC, without writeback. 


Ifn == t & n != 15, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
: The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4287 
ID070919 Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4288 





A2 
|31 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|3 0 | 
| 111 [o o ojoļjujojiji] Ra | R kokoka] fa] Rm | 
cond 
A2 variant 


LDRHT{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm> 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); postindex = TRUE; add = (U = '1'); 


register_form = TRUE; 
if t == 15 || n == 15 || n == t || m == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == t & n != 15, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
è The instruction executes as NOP. 
- The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0 | 


11111000 o0jo1ji| nn | rR [1170] _ imm | 
Rn 


T1 variant 


LDRHT{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 

if Rn == '1111' then SEE "LDRH (literal)"; 

t = UInt(Rt); n = UInt(Rn); postindex = FALSE; add = TRUE; 
register_form = FALSE; imm32 = ZeroExtend(imm8, 32); 

if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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+/- For encoding A1: specifies the offset is added to or subtracted from the base register, defaulting to 
+ if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 


For encoding A2: specifies the index register is added to or subtracted from the base register, 
defaulting to + if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 
<Rm> Is the general-purpose index register, encoded in the "Rm" field. 
+ Specifies the offset is added to the base register. 
<imm> For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 


if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is an optional 8-bit unsigned immediate byte offset, in the range 0 to 255, 
defaulting to 0 and encoded in the "imm8" field. 


Operation for all encodings 


if ConditionPassed() then 
if PSTATE.EL == EL2 then UNPREDICTABLE; // Hyp mode 
EncodingSpecificOperations(); 
offset = if register_form then R[m] else imm32; 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if postindex then R[n] else offset_addr; 
data = MemU_unpriv[address,2]; 
if postindex then R[n] = offset_addr; 
R[t] = ZeroExtend(data, 32); 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == EL2, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The instruction executes as LDRH (immediate). 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.90 


F5-4290 


LDRSB (immediate) 


Load Register Signed Byte (immediate) calculates an address from a base register value and an immediate offset, 
loads a byte from memory, sign-extends it to form a 32-bit word, and writes it to a register. It can use offset, 
post-indexed, or pre-indexed addressing. For information about memory accesses see Memory accesses on 

page F2-3913. 


A1 


i 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 


=m [o o ofPjojijwj enn | R | mman fiji Of] imma 





E 


Offset variant 
Applies when P == 1 & W == 0. 


LDRSB{<c>}{<q>} <Rt>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == 0 && W == 0. 


LDRSB{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W = 1. 


LDRSB{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDRSB (literal)"; 
if P == '0' && W == '1' then SEE "LDRSBT"; 
= UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm4H:imm4L, 32); 
index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
if t == 15 || (whack && n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
s The instruction executes as NOP. 
$ The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


T1 


Laaa 109 8|7 6 5 4/3 as 12\11 | 0 | 


Pee eer eo] || ae 





T1 variant 


LDRSB{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 
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Decode for this encoding 


if Rt == '1111' then SEE "PLI"; 

if Rn == '1111' then SEE "LDRSB (literal)"; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 
index = TRUE; add = TRUE; wback = FALSE; 

// Armv8-A removes UNPREDICTABLE for R13 


T2 


[15 141312/11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


Danaa oon oooh] enn | Rt pP imme —is 
Rn 





Offset variant 
Applies when Rt != 1111 && P == 1 & U == 0 & W = 0. 


LDRSB{<c>}{<q>} <Rt>, [<Rn> {, #-<imm>}] 


Post-indexed variant 
Applies when P == 0 && W == 1. 


LDRSB{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W = 1. 


LDRSB{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rt == '1111' & P == '1' & U == '0' && W == 'O' then SEE "PLI"; 
if Rn == '1111' then SEE "LDRSB (literal)"; 

if P == '1' & U == '1' && W == '@' then SEE "LDRSBT"; 

if P == 'Q' && W == '@' then UNDEFINED; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); 

index = (P == '1'); add = (U == '1'); wback = (W == '1'); 

if (t == 15 && W == '1') || (wback && n == t) then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


à The instruction is UNDEFINED. 
- The instruction executes as NOP. 
$ The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
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F5-4292 


<q> 
<Rt> 
<Rn> 


+/- 


<imm> 


Ope 


if C 


Ope 
If CP 


See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose register to be transferred, encoded in the "Rt" field. 

Is the general-purpose base register, encoded in the "Rn" field. For PC use see LDRSB (literal). 
Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 

- when U = 0 

+ when U = 1 

Specifies the offset is added to the base register. 

For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 
defaulting to 0 and encoded in the "Iimm12" field. 


For encoding T2: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm8" field. 


ration for all encodings 


onditionPassed() then 

EncodingSpecificOperations(); 

offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 

R[t] = SignExtend(MemU[address,1], 32); 

if wback then R[n] = offset_addr; 


rational information 


SR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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LDRSB (literal) 


ARM DDI 0487E.a 


Load Register Signed Byte (literal) calculates an address from the PC value and an immediate offset, loads a byte 
from memory, sign-extends it to form a 32-bit word, and writes it to a register. For information about memory 
accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|11 8|7 6 5 4|3 0 | 


[m11 fo o ofplujafwiift 11 1f Rt | imma [iji oft] imma | 





cond 


A1 variant 
Applies when !(P == 0 && W == 1). 


LDRSB{<c>}{<q>} <Rt>, <label> // Normal form 
LDRSB{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative form 


Decode for this encoding 
if P == 'Q@' && W == '1' then SEE "LDRSBT"; 
t = UInt(Rt); imm32 = ZeroExtend(imm4H:imm4L, 32); 


add = (U == '1'); whack = (P == '@') || (W == '1'); 
if t == 15 || wback then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback, then one of the following behaviors must occur: 


a The instruction is UNDEFINED. 

. The instruction executes as NOP. 

° The instruction executes with the additional decode: wback = FALSE;. 

è The instruction treats bit[24] as the P bit, and bit[21] as the writeback (W) bit, and uses the same addressing 


mode as described in LDRSB (immediate). The instruction uses post-indexed addressing when P == '0' and 
uses pre-indexed addressing otherwise. The instruction is handled as described in Using R15 on 
page K1-7607. 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12\11 | | 0 | 


Tiitioouooiiiii| = | mmm —SC=~s 
Rt 


T1 variant 


LDRSB{<c>}{<q>} <Rt>, <label> // Preferred syntax 
LDRSB{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative syntax 


Decode for this encoding 


if Rt == '1111' then SEE "PLI"; 
t = UInt(Rt); imm32 = ZeroExtend(imml2, 32); add = (U == '1'); 
// Armv8-A removes UNPREDICTABLE for R13 
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Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<label> For encoding A1: the label of the literal data item that is to be loaded into <Rt>. The assembler 


calculates the required value of the offset from the Align(PC, 4) value of the instruction to this label. 
Any value in the range -255 to 255 is permitted. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. If 
the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 


For encoding T1: the label of the literal data item that is to be loaded into <Rt>. The assembler 
calculates the required value of the offset from the Align(PC, 4) value of the instruction to this label. 
Permitted values of the offset are -4095 to 4095. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. 


If the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = @ 
+ when U = 1 

<imm> For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 


if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is a 12-bit unsigned immediate byte offset, in the range 0 to 4095, encoded in the 
"imm12" field. 


The alternative syntax permits the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
base = Align(PC,4); 
address = if add then (base + imm32) else (base - imm32); 
R[t] = SignExtend(MemU[address,1], 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.92 LDRSB (register) 


ARM DDI 0487E.a 
ID070919 


Load Register Signed Byte (register) calculates an address from a base register value and an offset register value, 
loads a byte from memory, sign-extends it to form a 32-bit word, and writes it to a register. The offset register value 


can be shifted left by 0, 1, 2, or 3 bits. For information about memory accesses see Memory accesses on 
page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[111 jo o ofPfujofwiif Rn | R Joyo] 1] oft] Rm | 





cond 


Offset variant 
Applies when P == 1 & W == 


LDRSB{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>] 


Post-indexed variant 
Applies when P == 0 & W == 


LDRSB{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm> 


Pre-indexed variant 
Applies when P == 1 & W == 


LDRSB{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>]! 


Decode for all variants of this encoding 


if P == '0' && W == '1' then SEE "LDRSBT"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); whack = (P == '0') || (W == '1'); 
(shift_t, shift n) = (SRType_LSL, 0); 

if t == 15 || m == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


š The instruction is UNDEFINED. 
- The instruction executes as NOP. 
è The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 


address might be corrupted so that the instruction cannot be repeated. 
T1 
|15 14 13 12|11 10 9 8| 6 5 |3 2 0| 


or orfon] km | Rn] R 


T1 variant 


LDRSB{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>] 
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F5-4296 


Decode for this encoding 


t = UInt(Rt); 
index = TRUE; 


n = UInt(Rn); m = UInt(Rm); 
add = TRUE; whack = FALSE; 


(shift_t, shift_n) = (SRType_LSL, 0); 


T2 


[15 141312/11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





T2 variant 


[11441007 ofo oft] 1m1 | 1111 fo 0 0 0 0 Ofimm2] Rm | 
Rn Rt 


LDRSB{<c>}.W <Rt>, [<Rn>, {+}<Rm>] // <Rt>, <Rn>, <Rm> can be represented in T1 
LDRSB{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>{, LSL #<imm>}] 


Decode for this encoding 


if Rt == '1111' then SEE "PLI"; 
if Rn == '1111' then SEE "LDRSB (literal)"; 


t = UInt(Rt); 
index = TRUE; 


n = UInt(Rn); m = UInt(Rm); 
add = TRUE; whack = FALSE; 


(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 
if m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 
<q> 
<Rt> 


<Rn> 


+/- 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose register to be transferred, encoded in the "Rt" field. 


For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 
in the offset variant. 

For encoding T1 and T2: is the general-purpose base register, encoded in the "Rn" field. 

Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 

- when U = 0 


+ when U = 1 
Specifies the index register is added to the base register. 
Is the general-purpose index register, encoded in the "Rm" field. 


If present, the size of the left shift to apply to the value from <Rm>, in the range 1-3. <imm> is encoded 
in imm2. If absent, no shift is specified and imm2 is encoded as 0b00. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
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offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if index then offset_addr else R[n]; 

R[t] = SignExtend(MemU[address,1], 32); 

if wback then R[n] = offset_addr; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.93 


F5-4298 


LDRSBT 


Load Register Signed Byte Unprivileged loads a byte from memory, sign-extends it to form a 32-bit word, and 
writes it to a register. For information about memory accesses see Memory accesses on page F2-3913. 


The memory access is restricted as if the PE were running in User mode. This makes no difference if the PE is 
actually running in User mode. 


LDRSBT is UNPREDICTABLE in Hyp mode. 


The T32 instruction uses an offset addressing mode, that calculates the address used for the memory access from a 
base register value and an immediate offset, and leaves the base register unchanged. 


The A32 instruction uses a post-indexed addressing mode, that uses a base register value as the address for the 
memory access, and calculates a new address from a base register value and an offset and writes it back to the base 
register. The offset can be an immediate value or a register value. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 12111 8|7 6 5 4]3 0| 

Fem joo ojoun An | R | imma [1]1 [1] ima 
cond 

A1 variant 


LDRSBT{<c>}{<q>} <Rt>, [<Rn>] {, #{+/-}<imm>} 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); postindex = TRUE; add = (U == '1'); 


register_form = FALSE; imm32 = ZeroExtend(imm4H:imm4L, 32); 
if t == 15 || n == 15 || n == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 


s The instruction is treated as if bit[24] == '1' and bit[21] == '0'. The instruction uses immediate offset 
addressing with the base register as PC, without writeback. 


Ifn == t & n != 15, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
: The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 
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A2 
|31 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|3 0 | 
| ttt [o o ojoļujojiji] Ra | R kokoka] oft] Rm | 
cond 
A2 variant 


LDRSBT{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm> 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); postindex = TRUE; add = (U = '1'); 


register_form = TRUE; 
if t == 15 || n == 15 || n == t || m == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == t & n != 15, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
è The instruction executes as NOP. 
- The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0 | 


11177007 0/0 oft] 11 | rR [1170] imm | 
Rn 


T1 variant 


LDRSBT{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 

if Rn == '1111' then SEE "LDRSB (literal)"; 

t = UInt(Rt); n = UInt(Rn); postindex = FALSE; add = TRUE; 
register_form = FALSE; imm32 = ZeroExtend(imm8, 32); 

if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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F5-4300 


+/- 


Ope 


if C 


For encoding A1: specifies the offset is added to or subtracted from the base register, defaulting to 
+ if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 


For encoding A2: specifies the index register is added to or subtracted from the base register, 
defaulting to + if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 


+ when U = 1 
Is the general-purpose index register, encoded in the "Rm" field. 
Specifies the offset is added to the base register. 


For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is an optional 8-bit unsigned immediate byte offset, in the range 0 to 255, 
defaulting to 0 and encoded in the "imm8" field. 


ration for all encodings 


onditionPassed() then 

if PSTATE.EL == EL2 then UNPREDICTABLE; // Hyp mode 
EncodingSpecificOperations(); 

offset = if register_form then R[m] else imm32; 

offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if postindex then R[n] else offset_addr; 

R[t] = SignExtend(MemU_unpriv[address,1], 32); 

if postindex then R[n] = offset_addr; 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == EL2, then one of the following behaviors must occur: 


Ope 
If CP 


The instruction is UNDEFINED. 
The instruction executes as NOP. 


The instruction executes as LDRSB (immediate). 


rational information 


SR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.94 LDRSH (immediate) 


ARM DDI 0487E.a 
ID070919 


Load Register Signed Halfword (immediate) calculates an address from a base register value and an immediate 
offset, loads a halfword from memory, sign-extends it to form a 32-bit word, and writes it to a register. It can use 
offset, post-indexed, or pre-indexed addressing. For information about memory accesses see Memory accesses on 
page F2-3913. 


A1 


i 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 


=m Joo ofPjojijwj enn | R | imma fiji AP] imma 





E 


Offset variant 
Applies when P == 1 && W == 0. 


LDRSH{<c>}{<q>} <Rt>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == 0 && W == 0. 


LDRSH{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W = 1. 


LDRSH{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDRSH (literal)"; 
if P == '0' && W == '1' then SEE "LDRSHT"; 
= UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm4H:imm4L, 32); 
index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
if t == 15 || (whack && n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
s The instruction executes as NOP. 
$ The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


T1 


Laaa 10 9 all 6 5 4|3 as 12\11 | 0 | 


Pee et | |e | ae 





T1 variant 


LDRSH{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 
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Decode for this encoding 


if Rn == '1111' then SEE "LDRSH (literal)"; 

if Rt == '1111' then SEE "Related instructions"; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 
index = TRUE; add = TRUE; wback = FALSE; 

// Armv8-A removes UNPREDICTABLE for R13 


T2 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


fFrtt tooo enn | Rt pP imme —is 
Rn 





Offset variant 
Applies when Rt != 1111 && P == 1 & U == 0 && W == 0. 


LDRSH{<c>}{<q>} <Rt>, [<Rn> {, #-<imm>}] 


Post-indexed variant 
Applies when P == 0 && W == 1. 


LDRSH{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 1. 


LDRSH{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rn == '1111' then SEE "LDRSH (literal)"; 

if Rt == '1111' && P == '1' & U == '0' && W == 'Q' then SEE "Related instructions"; 
if P == '1' & U == '1' && W == '@' then SEE "LDRSHT"; 

if P == 'Q' && W == '@' then UNDEFINED; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); 

index = (P == '1'); add = (U == '1'); whack = (W == '1'); 

if (t == 15 && W == '1') || (wback && n == t) then UNPREDICTABLE; 

// Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If whack && n == t, then one of the following behaviors must occur: 


à The instruction is UNDEFINED. 
- The instruction executes as NOP. 
$ The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such an instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related instructions: Load/store single on page F3-3988. 
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Assembler symbols 


<C> 
<q> 
<Rt> 


<Rn> 


+/- 


<imm> 


Ope 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose register to be transferred, encoded in the "Rt" field. 

Is the general-purpose base register, encoded in the "Rn" field. For PC use see LDRSH (literal). 


Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 


+ when U = 1 

Specifies the offset is added to the base register. 

For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 
defaulting to 0 and encoded in the "Imm12" field. 


For encoding T2: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm8" field. 


ration for all encodings 


if ConditionPassed() then 


Ope 
If CP 


EncodingSpecificOperations(); 

offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 

data = MemU[address,2]; 

if wback then R[n] = offset_addr; 

R[t] = SignExtend(data, 32); 


rational information 


SR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.95 LDRSH (literal) 


Load Register Signed Halfword (literal) calculates an address from the PC value and an immediate offset, loads a 
halfword from memory, sign-extends it to form a 32-bit word, and writes it to a register. For information about 


memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12\11 8|7 6 5 4|3 


o | 


[111 Jo o ofpfujiafwiitt 11 1f Rt | imma Jiji afi] imma | 





cond 


A1 variant 
Applies when !(P == 0 && W == 1). 


LDRSH{<c>}{<q>} <Rt>, <label> // Normal form 
LDRSH{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative form 


Decode for this encoding 
if P == 'Q@' && W == '1' then SEE "LDRSHT"; 
t = UInt(Rt); imm32 = ZeroExtend(imm4H:imm4L, 32); 


add = (U == '1'); whack = (P == '@') || (W == '1'); 
if t == 15 || wback then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback, then one of the following behaviors must occur: 


a The instruction is UNDEFINED. 

. The instruction executes as NOP. 

° The instruction executes with the additional decode: wback = FALSE;. 

è The instruction treats bit[24] as the P bit, and bit[21] as the writeback (W) bit, and uses the same addressing 


mode as described in LDRSH (immediate). The instruction uses post-indexed addressing when P == '0' and 
uses pre-indexed addressing otherwise. The instruction is handled as described in Using R15 on 


page K1-7607. 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12\11 | 


o | 


Tii77007ujoii77171)| im 
Rt 


T1 variant 


LDRSH{<c>}{<q>} <Rt>, <label> // Preferred syntax 
LDRSH{<c>}{<q>} <Rt>, [PC, #{+/-}<imm>] // Alternative syntax 


Decode for this encoding 


if Rt == '1111' then SEE "Related instructions"; 
t = UInt(Rt); imm32 = ZeroExtend(imml2, 32); add = (U == '1'); 
// Armv8-A removes UNPREDICTABLE for R13 
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Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related instructions: Load, signed (literal) on page F3-3996. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<label> For encoding A1: the label of the literal data item that is to be loaded into <Rt>. The assembler 


calculates the required value ofthe offset from the Align(PC, 4) value ofthe instruction to this label. 
Any value in the range -255 to 255 is permitted. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. If 
the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 


For encoding T1: the label of the literal data item that is to be loaded into <Rt>. The assembler 
calculates the required value ofthe offset from the Align(PC, 4) value ofthe instruction to this label. 
Permitted values of the offset are -4095 to 4095. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE, encoded as U == 1. 


If the offset is negative, imm32 is equal to minus the offset and add == FALSE, encoded as U == 0. 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

<imm> For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 


if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is a 12-bit unsigned immediate byte offset, in the range 0 to 4095, encoded in the 
"imm12" field. 


The alternative syntax permits the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
base = Align(PC,4); 
address = if add then (base + imm32) else (base - imm32); 
data = MemU[address,2]; 
R[t] = SignExtend(data, 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.96 


F5-4306 


LDRSH (register) 


Load Register Signed Halfword (register) calculates an address from a base register value and an offset register 
value, loads a halfword from memory, sign-extends it to form a 32-bit word, and writes it to a register. The offset 
register value can be shifted left by 0, 1, 2, or 3 bits. For information about memory accesses see Memory accesses 
on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 





cond 


Offset variant 
Applies when P == 1 && W == 


LDRSH{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>] 


Post-indexed variant 
Applies when P == @ && W == 


LDRSH{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm> 


Pre-indexed variant 
Applies when P == 1 && W == 


LDRSH{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>]! 


Decode for all variants of this encoding 


if P == 'Q@' && W == '1' then SEE "LDRSHT"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
(shift_t, shift_n) = (SRType_LSL, Q); 

if t == 15 || m == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


š The instruction is UNDEFINED. 
- The instruction executes as NOP. 
è The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


T1 
15 14 13 12/1110 9 8| 65 132 ol 


T1 variant 


LDRSH{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>] 
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Decode for this encoding 


t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 
index = TRUE; add = TRUE; wback = FALSE; 
(shift_t, shift_n) = (SRType_LSL, Q); 


T2 


[15 141312/11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


Rn Rt 





T2 variant 


LDRSH{<c>}.W <Rt>, [<Rn>, {+}<Rm>] // <Rt>, <Rn>, <Rm> can be represented in T1 
LDRSH{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>{, LSL #<imm>}] 


Decode for this encoding 


if Rn == '1111' then SEE "LDRSH (literal)"; 

if Rt == '1111' then SEE "Related instructions"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = TRUE; add = TRUE; wback = FALSE; 

(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 

if m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related instructions: Load/store, signed (register offset) on page F3-3993. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 


in the offset variant. 


For encoding T1 and T2: is the general-purpose base register, encoded in the "Rn" field. 


+/- Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

+ Specifies the index register is added to the base register. 

<Rm> Is the general-purpose index register, encoded in the "Rm" field. 

<imm> If present, the size of the left shift to apply to the value from <Rm>, in the range 1-3. <imm> is encoded 


in imm2. If absent, no shift is specified and imm2 is encoded as 0b00. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if index then offset_addr else R[n]; 
data = MemU[address,2]; 
if whack then R[n] = offset_addr; 
R[t] = SignExtend(data, 32); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.97 LDRSHT 


Load Register Signed Halfword Unprivileged loads a halfword from memory, sign-extends it to form a 32-bit word, 
and writes it to a register. For information about memory accesses see Memory accesses on page F2-3913. 


The memory access is restricted as if the PE were running in User mode. This makes no difference if the PE is 
actually running in User mode. 


LDRSHT is UNPREDICTABLE in Hyp mode. 


The T32 instruction uses an offset addressing mode, that calculates the address used for the memory access from a 
base register value and an immediate offset, and leaves the base register unchanged. 


The A32 instruction uses a post-indexed addressing mode, that uses a base register value as the address for the 
memory access, and calculates a new address from a base register value and an offset and writes it back to the base 
register. The offset can be an immediate value or a register value. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 12111 8|7 6 5 4]|3 0| 

Fem joo ojoun Rn | R | imma [1]1 4] 1] imma _| 
cond 

A1 variant 


LDRSHT{<c>}{<q>} <Rt>, [<Rn>] {, #{+/-}<imm>} 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); postindex = TRUE; add = (U == '1'); 


register_form = FALSE; imm32 = ZeroExtend(imm4H:imm4L, 32); 
if t == 15 || n == 15 || n == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 


s The instruction is treated as if bit[24] == '1' and bit[21] == '0'. The instruction uses immediate offset 
addressing with the base register as PC, without writeback. 


Ifn == t & n != 15, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
: The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 
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F5-4310 


A2 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 





cond 


A2 variant 


LDRSHT{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm> 
Decode for this encoding 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); postindex = TRUE; add = (U = '1'); 
register_form = TRUE; 


if t == 15 || n == 15 || n == t || m == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == t && n != 15, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
è The instruction executes as NOP. 
- The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0 | 


11111001 o0ļjo1ji| en | rR [1170] imm | 
Rn 


T1 variant 


LDRSHT{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 

if Rn == '1111' then SEE "LDRSH (literal)"; 

t = UInt(Rt); n = UInt(Rn); postindex = FALSE; add = TRUE; 
register_form = FALSE; imm32 = ZeroExtend(imm8, 32); 

if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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+/- For encoding A1: specifies the offset is added to or subtracted from the base register, defaulting to 
+ if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 


For encoding A2: specifies the index register is added to or subtracted from the base register, 
defaulting to + if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 
<Rm> Is the general-purpose index register, encoded in the "Rm" field. 
+ Specifies the offset is added to the base register. 
<imm> For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 


if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is an optional 8-bit unsigned immediate byte offset, in the range 0 to 255, 
defaulting to 0 and encoded in the "imm8" field. 


Operation for all encodings 


if ConditionPassed() then 
if PSTATE.EL == EL2 then UNPREDICTABLE; // Hyp mode 
EncodingSpecificOperations(); 
offset = if register_form then R[m] else imm32; 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if postindex then R[n] else offset_addr; 
data = MemU_unpriv[address,2]; 
if postindex then R[n] = offset_addr; 
R[t] = SignExtend(data, 32); 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == EL2, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The instruction executes as LDRSH (immediate). 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.98 


F5-4312 


LDRT 


Load Register Unprivileged loads a word from memory, and writes it to a register. For information about memory 
accesses see Memory accesses on page F2-3913. 


The memory access is restricted as if the PE were running in User mode. This makes no difference if the PE is 
actually running in User mode. 


LDRT is UNPREDICTABLE in Hyp mode. 


The T32 instruction uses an offset addressing mode, that calculates the address used for the memory access from a 
base register value and an immediate offset, and leaves the base register unchanged. 


The A32 instruction uses a post-indexed addressing mode, that uses a base register value as the address for the 
memory access, and calculates a new address from a base register value and an offset and writes it back to the base 
register. The offset can be an immediate value or an optionally-shifted register value. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 | | o| 
Cem joi opojno en | R o ë ë me ë 
cond 
A1 variant 


LDRT{<c>}{<q>} <Rt>, [<Rn>] {, #{+/-}<imm>} 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); postindex = TRUE; add = (U == '1'); 


register_form = FALSE; imm32 = ZeroExtend(imm12, 32); 
if t == 15 || n == 15 || n == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 


s The instruction is treated as if bit[24] == '1' and bit[21] == '0'. The instruction uses immediate offset 
addressing with the base register as PC, without writeback. 


Ifn == t & n != 15, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
: The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 
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A2 


31 28|27 26 25 24|23 22 21 20|19 16/15 12|11 7 6 5 4|3 0 | 


Perm [oouo] Rn [Rt | immd_[stype]o. Rm | 


cond 
A2 variant 
LDRT{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm>{, <shift>} 
Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); postindex = TRUE; add = (U == '1'); 


register_form = TRUE; (shift_t, shift_n) = DecodeImmShift(stype, immS); 
if t == 15 || n == 15 || n == t || m == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == t && n != 15, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
è The instruction executes as NOP. 
- The instruction performs all of the loads using the specified addressing mode and the content of the register 


that is written back is UNKNOWN. In addition, if an exception occurs during such as instruction, the base 
address might be corrupted so that the instruction cannot be repeated. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0 | 


11117000 0/1 oft] n1 | rR [1170] imme 
Rn 


T1 variant 


LDRT{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 

if Rn == '1111' then SEE "LDR (literal)"; 

t = UInt(Rt); n = UInt(Rn); postindex = FALSE; add = TRUE; 
register_form = FALSE; imm32 = ZeroExtend(imm8, 32); 

if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 


can be used, but this is deprecated. 


For encoding A2 and T1: is the general-purpose register to be transferred, encoded in the "Rt" field. 
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<Rn> Is the general-purpose base register, encoded in the "Rn" field. 

+/- For encoding A1: specifies the offset is added to or subtracted from the base register, defaulting to 
+ if omitted and encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 


For encoding A2: specifies the index register is added to or subtracted from the base register, 
defaulting to + if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 
<Rm> Is the general-purpose index register, encoded in the "Rm" field. 
<shift> The shift to apply to the value read from <Rm>. If absent, no shift is applied. Otherwise, see Shifts 


applied to a register on page F2-3911. 
+ Specifies the offset is added to the base register. 


<imm> For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 
0 if omitted, and encoded in the "imm12" field. 


For encoding T1: is an optional 8-bit unsigned immediate byte offset, in the range 0 to 255, 
defaulting to 0 and encoded in the "imm8" field. 


Operation for all encodings 


if ConditionPassed() then 
if PSTATE.EL == EL2 then UNPREDICTABLE; // Hyp mode 
EncodingSpecificOperations(); 
offset = if register_form then Shift(R[m], shift_t, shift_n, PSTATE.C) else imm32; 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if postindex then R[n] else offset_addr; 
data = MemU_unpriv[address,4]; 
if postindex then R[n] = offset_addr; 
R[t] = data; 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == EL2, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The instruction executes as LDR (immediate). 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.99 LSL (immediate) 


ARM DDI 0487E.a 
ID070919 


Logical Shift Left (immediate) shifts a register value left by an immediate number of bits, shifting in zeros, and 
writes the result to the destination register. 


This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 
g The encodings in this description are named to match the encodings of MOV, MOVS (register). 


s The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16/15 12|11 7 6 5 4|3 0| 


Cem [0001 oono Ra | ooo [0 ojo Rm | 


cond S imm5 stype 


MOV, shift or rotate by value variant 
LSL{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 

is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, LSL #<imm> 


and is always the preferred disassembly. 
T2 


|15 14 13 12|11 10 | 65 |32 ol] 


[o o ojo of !=o0000 | Rm | Ra | 


op imm5 


T2 variant 

LSL<c>{<q>} {<Rd>,} <Rm>, #<imm> // Inside IT block 
is equivalent to 

MOV<c>{<q>} <Rd>, <Rm>, LSL #<imm> 


and is the preferred disassembly when InITBlock(). 


T3 
|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|1514 12/11 8|7 6 5 4|3 0 | 
111010100100 11 O mma] Rd [immo of Rm_| 
S stype 


MOV, shift or rotate by value variant 

LSL<c>.W {<Rd>,} <Rm>, #<imm> // Inside IT block, and <Rd>, <Rm>, <imm> can be represented in T2 
is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, LSL #<imm> 

and is always the preferred disassembly. 


LSL{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 
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is equivalent to 
MOV{<c>}{<q>} <Rd>, <Rm>, LSL #<imm> 


and is always the preferred disassembly. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 


deprecates using the PC as the destination register, but if the PC is used, the instruction is a branch 
to the address calculated by the operation. This is an interworking branch, see Pseudocode 
description of operations on the AArch32 general-purpose registers and the PC on page E1-3787. 


For encoding T2 and T3: is the general-purpose destination register, encoded in the "Rd" field. 
<Rm> For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 
used, but this is deprecated. 
For encoding T2 and T3: is the general-purpose source register, encoded in the "Rm" field. 
<imm> For encoding A1: is the shift amount, in the range 0 to 31, encoded in the "imm5" field as <imm> 
modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31, encoded in the "Imm5" field as <amount> 
modulo 32. 


For encoding T3: is the shift amount, in the range 0 to 31, encoded in the "imm3:imm2" field as 
<imm> modulo 32. 


Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
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F5.1.100 LSL (register) 


ARM DDI 0487E.a 
ID070919 


Logical Shift Left (register) shifts a register value left by a variable number of bits, shifting in zeros, and writes the 
result to the destination register. The variable number of bits is read from the bottom byte of a register 


This instruction is an alias of the MOV, MOVS (register-shifted register) instruction. This means that: 


$ The encodings in this description are named to match the encodings of MOV, MOVS (register-shifted 
register). 


a The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this 
instruction. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12111 8|7 6 5 4|3 0| 


[=m Jo 0 0 14 1f0o 10o] Ra | rs Jofjooji] Rm | 


cond S stype 


Not flag setting variant 
LSL{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, LSL <Rs> 


and is always the preferred disassembly. 
T1 


15141312411109 | 65 132 ol] 


op 


Logical shift left variant 

LSL<c>{<q>} {<Rdm>,} <Rdm>, <Rs> // Inside IT block 
is equivalent to 

MOV<c>{<q>} <Rdm>, <Rdm>, LSL <Rs> 


and is the preferred disassembly when InITBlock(). 


T2 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 
11111010 0/0 ofo] Rm [1111| Ra [0000| Rs | 


stype S 


Not flag setting variant 

LSL<c>.W {<Rd>,} <Rm>, <Rs> // Inside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in T1 
is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, LSL <Rs> 


and is always the preferred disassembly. 
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LSL{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 
MOV{<c>}{<q>} <Rd>, <Rm>, LSL <Rs> 


and is always the preferred disassembly. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdm> Is the first general-purpose source register and the destination register, encoded in the "Rdm" field. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 

<Rs> Is the second general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation for all encodings 


The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this instruction. 
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F5.1.101 LSLS (immediate) 


Logical Shift Left, setting flags (immediate) shifts a register value left by an immediate number of bits, shifting in 
zeros, and writes the result to the destination register. 


If the destination register is not the PC, this instruction updates the condition flags based on the result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


e The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


$ The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from AArch32 
state on page G1-5524. 


e The instruction is UNDEFINED in Hyp mode. 

° The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 

This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 

s The encodings in this description are named to match the encodings of MOV, MOVS (register). 


s The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|11 |7 6 5 4|3 0| 
=1111 [o o o 1 1[o afko 000] Ra | !=00000 [o ofo] Rm | 
cond S imm5 stype 
MOVS, shift or rotate by value variant 
LSLS{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 
is equivalent to 
MOVS{<c>}{<q>} <Rd>, <Rm>, LSL #<imm> 
and is always the preferred disassembly. 
T2 
|15 14 13 12|11 10 | 65 |3 2 0| 
[0 o ofo o] 00000 | Rm | Ra | 
op imm5 
T2 variant 
LSLS{<q>} {<Rd>,} <Rm>, #<imm> // Outside IT block 
is equivalent to 
MOVS{<q>} <Rd>, <Rm>, LSL #<imm> 
and is the preferred disassembly when !InITBlock(). 
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F5-4320 


T3 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|1514 12/11 8|7 6 5 4|3 0 | 


T7070 7007 O11 77 TO] mms | Ra fmajo o] Rm | 
S 


stype 


MOVS, shift or rotate by value variant 


LSLS.W {<Rd>, 


is equivalent to 


MOVS{<c>} 


<q> 


<Rm>, #<imm> // Outside IT block, and <Rd>, <Rm>, <imm> can be represented in T2 


<Rd>, <Rm>, LSL #<imm> 


and is always the preferred disassembly. 


LSLS{<c>} 





<q> 


is equivalent to 





MOVS {<c>} 


<q>} 


{<Rd>,} <Rm>, #<imm> 


<Rd>, <Rm>, LSL #<imm> 


and is always the preferred disassembly. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rm> 


<imm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 
deprecates using the PC as the destination register, but if the PC is used, the instruction performs an 
exception return, that restores PSTATE from SPSR_<current_mode>. 


For encoding T2 and T3: is the general-purpose destination register, encoded in the "Rd" field. 
For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 
used, but this is deprecated. 

For encoding T2 and T3: is the general-purpose source register, encoded in the "Rm" field. 

For encoding A1: is the shift amount, in the range 0 to 31, encoded in the "imm5" field as <imm> 
modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31, encoded in the "imm5" field as <amount> 
modulo 32. 


For encoding T3: is the shift amount, in the range 0 to 31, encoded in the "imm3:imm2" field as 
<imm> modulo 32. 


Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
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F5.1.102 LSLS (register) 


ARM DDI 0487E.a 
ID070919 


Logical Shift Left, setting flags (register) shifts a register value left by a variable number of bits, shifting in zeros, 
writes the result to the destination register, and updates the condition flags based on the result. The variable number 
of bits is read from the bottom byte of a register 


This instruction is an alias of the MOV, MOVS (register-shifted register) instruction. This means that: 


s The encodings in this description are named to match the encodings of MOV, MOVS (register-shifted 
register). 


° The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this 
instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12|11 8|7 6 5 4|3 0 | 


[ ie1it_fo oo 4 1fo 1] ify oo) Ra | rs Jojo oft] Rm | 
S 


cond stype 


Flag setting variant 
LSLS{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, LSL <Rs> 


and is always the preferred disassembly. 
T1 


15141312411109 | 65 132 ol] 


op 


Logical shift left variant 

LSLS{<q>} {<Rdm>,} <Rdm>, <Rs> // Outside IT block 
is equivalent to 

MOVS{<q>} <Rdm>, <Rdm>, LSL <Rs> 


and is the preferred disassembly when !InITBlock(). 
T2 


|15 14 13 121110 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


1111010 0f0 ofsf Rm [trait] Rd jooo of] Rs | 


stype S 


Flag setting variant 
LSLS.W {<Rd>,} <Rm>, <Rs> // Outside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in T1 
is equivalent to 


MOVS{<c>}{<q>} <Rd>, <Rm>, LSL <Rs> 
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and is always the preferred disassembly. 
LSLS{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 

is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, LSL <Rs> 


and is always the preferred disassembly. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdm> Is the first general-purpose source register and the destination register, encoded in the "Rdm" field. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 

<Rs> Is the second general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation for all encodings 


The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this instruction. 
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F5.1.103 LSR (immediate) 


ARM DDI 0487E.a 
ID070919 


Logical Shift Right (immediate) shifts a register value right by an immediate number of bits, shifting in zeros, and 
writes the result to the destination register. 


This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 


g The encodings in this description are named to match the encodings of MOV, MOVS (register). 


s The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16/15 12|11 7 65 4|3 0| 
iit [000 4 o pO Ra [imme o jo Rm | 
cond S stype 


MOV, shift or rotate by value variant 
LSR{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 

is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, LSR #<imm> 


and is always the preferred disassembly. 
T2 


|15 14 13 12|11 10 | 65 |32 ol] 


[o o ofo 4| imm5s | Rm | Ra | 
op 


T2 variant 

LSR<c>{<q>} {<Rd>,} <Rm>, #<imm> // Inside IT block 
is equivalent to 

MOV<c>{<q>} <Rd>, <Rm>, LSR #<imm> 


and is the preferred disassembly when InITBlock(). 


T3 
|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|1514 12/11 8|7 6 5 4|3 0 | 
111010100100 11 O mma] Rd immo i] Rm] 
S stype 


MOV, shift or rotate by value variant 

LSR<c>.W {<Rd>,} <Rm>, #<imm> // Inside IT block, and <Rd>, <Rm>, <imm> can be represented in T2 
is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, LSR #<imm> 

and is always the preferred disassembly. 


LSR{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 
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F5-4324 


is equivalent to 


MOV{<c>}{<q>} <Rd>, <Rm>, LSR #<imm> 


and is always the preferred disassembly. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rm> 


<imm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 
deprecates using the PC as the destination register, but if the PC is used, the instruction is a branch 
to the address calculated by the operation. This is an interworking branch, see Pseudocode 
description of operations on the AArch32 general-purpose registers and the PC on page E1-3787. 


For encoding T2 and T3: is the general-purpose destination register, encoded in the "Rd" field. 
For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 
used, but this is deprecated. 

For encoding T2 and T3: is the general-purpose source register, encoded in the "Rm" field. 

For encoding A1 and T2: is the shift amount, in the range 1 to 32, encoded in the "imm5" field as 
<imm> modulo 32. 


For encoding T3: is the shift amount, in the range 1 to 32, encoded in the "imm3:imm2" field as 
<imm> modulo 32. 


Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
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F5.1.104 LSR (register) 


ARM DDI 0487E.a 
ID070919 


Logical Shift Right (register) shifts a register value right by a variable number of bits, shifting in zeros, and writes 
the result to the destination register. The variable number of bits is read from the bottom byte of a register 


This instruction is an alias of the MOV, MOVS (register-shifted register) instruction. This means that: 


$ The encodings in this description are named to match the encodings of MOV, MOVS (register-shifted 
register). 


a The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this 
instruction. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12111 8|7 6 5 4|3 0| 


[=m Jo 0 0 4 1f0o 1eko] Ra | rs Jojo afi] Rm | 


cond S stype 


Not flag setting variant 
LSR{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, LSR <Rs> 


and is always the preferred disassembly. 
T1 


15141312411109 | 65 |32 ol] 


op 


Logical shift right variant 

LSR<c>{<q>} {<Rdm>,} <Rdm>, <Rs> // Inside IT block 
is equivalent to 

MOV<c>{<q>} <Rdm>, <Rdm>, LSR <Rs> 


and is the preferred disassembly when InITBlock(). 


T2 
|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 
11111010 o0ļjo1jo] Rm 1111| Ra [0000| Rs | 


stype S 


Not flag setting variant 

LSR<c>.W {<Rd>,} <Rm>, <Rs> // Inside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in T1 
is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, LSR <Rs> 


and is always the preferred disassembly. 
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LSR{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 
MOV{<c>}{<q>} <Rd>, <Rm>, LSR <Rs> 


and is always the preferred disassembly. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdm> Is the first general-purpose source register and the destination register, encoded in the "Rdm" field. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 

<Rs> Is the second general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation for all encodings 


The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this instruction. 
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F5.1.105 | LSRS (immediate) 


Logical Shift Right, setting flags (immediate) shifts a register value right by an immediate number of bits, shifting 
in zeros, and writes the result to the destination register. 


If the destination register is not the PC, this instruction updates the condition flags based on the result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


e The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


$ The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from AArch32 
state on page G1-5524. 


e The instruction is UNDEFINED in Hyp mode. 

° The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 

This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 

s The encodings in this description are named to match the encodings of MOV, MOVS (register). 


s The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12\11 7 6 5 4|3 0 | 


[m1 foo 0 4 1jo 1] 1foy@ oo) Ra | imms Jo ifo] Rm | 
S 


cond stype 


MOVS, shift or rotate by value variant 
LSRS{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 

is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, LSR #<imm> 


and is always the preferred disassembly. 
T2 


|15 14 13 12/11 10 | 65 |32 0l 


0 o ojo 1] mms | Rm | Ra | 
op 


T2 variant 

LSRS{<q>} {<Rd>,} <Rm>, #<imm> // Outside IT block 
is equivalent to 

MOVS{<q>} <Rd>, <Rm>, LSR #<imm> 


and is the preferred disassembly when !InITBlock(). 
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T3 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|1514 12/11 8|7 6 5 4|3 0 


Ti 70707007 onj 17 TO] mms | Rd fmajo 1] Rm | 
S 


stype 


MOVS, shift or rotate by value variant 


LSRS.W {<Rd>, 


is equivalent to 


MOVS{<c>} 


<q> 


<Rm>, #<imm> // Outside IT block, and <Rd>, <Rm>, <imm> can be represented in T2 


<Rd>, <Rm>, LSR #<imm> 


and is always the preferred disassembly. 


LSRS{<c>} 





<q> 


is equivalent to 





MOVS {<c>} 


<q>} 


{<Rd>,} <Rm>, #<imm> 


<Rd>, <Rm>, LSR #<imm> 


and is always the preferred disassembly. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rm> 


<imm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 
deprecates using the PC as the destination register, but if the PC is used, the instruction performs an 
exception return, that restores PSTATE from SPSR_<current_mode>. 


For encoding T2 and T3: is the general-purpose destination register, encoded in the "Rd" field. 
For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 
used, but this is deprecated. 

For encoding T2 and T3: is the general-purpose source register, encoded in the "Rm" field. 

For encoding A1 and T2: is the shift amount, in the range 1 to 32, encoded in the "imm5" field as 
<imm> modulo 32. 


For encoding T3: is the shift amount, in the range 1 to 32, encoded in the "imm3:imm2" field as 
<imm> modulo 32. 


Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 


F5-4328 
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F5.1.106 | LSRS (register) 


ARM DDI 0487E.a 
ID070919 


Logical Shift Right, setting flags (register) shifts a register value right by an immediate number of bits, shifting in 
zeros, writes the result to the destination register, and updates the condition flags based on the result. The variable 
number of bits is read from the bottom byte of a register 


This instruction is an alias of the MOV, MOVS (register-shifted register) instruction. This means that: 


s The encodings in this description are named to match the encodings of MOV, MOVS (register-shifted 
register). 


° The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this 
instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12|11 8/7 6 5 4|3 0 | 


[m1 Jooo 4 1fo t]ifoyo oo Ra | rs Jojo 1f1] Rm | 
S 


cond stype 


Flag setting variant 
LSRS{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, LSR <Rs> 


and is always the preferred disassembly. 
T1 


151413 12411109 | 65 132 ol] 


op 


Logical shift right variant 

LSRS{<q>} {<Rdm>,} <Rdm>, <Rs> // Outside IT block 
is equivalent to 

MOVS{<q>} <Rdm>, <Rdm>, LSR <Rs> 


and is the preferred disassembly when !InITBlock(). 
T2 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


1111010 ojo tfi{ Rm J111 1| Rd jooo oj] Rs | 


stype S 


Flag setting variant 
LSRS.W {<Rd>,} <Rm>, <Rs> // Outside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in T1 
is equivalent to 


MOVS{<c>}{<q>} <Rd>, <Rm>, LSR <Rs> 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4329 
Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


and is always the preferred disassembly. 
LSRS{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 

is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, LSR <Rs> 


and is always the preferred disassembly. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdm> Is the first general-purpose source register and the destination register, encoded in the "Rdm" field. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 

<Rs> Is the second general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation for all encodings 


The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this instruction. 
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F5.1.107 MCR 


Move to System register from general-purpose register or execute a System instruction. This instruction copies the 
value of a general-purpose register to a System register, or executes a System instruction. 


The System register and System instruction descriptions identify valid encodings for this instruction. Other 
encodings are UNDEFINED. For more information see About the AArch32 System register interface on page E1-3805 
and General behavior of System registers on page G8-5892. 


In an implementation that includes EL2, MCR accesses to System registers can be trapped to Hyp mode, meaning that 
an attempt to execute an MCR instruction in a Non-secure mode other than Hyp mode, that would be permitted in the 
absence of the Hyp trap controls, generates a Hyp Trap exception. For more information, see EL2 configurable 
controls on page G1-5585. 


Because of the range of possible traps to Hyp mode, the MCR pseudocode does not show these possible traps. 


A1 


|31 28|27 26 25 24|23 21 20|19 16|15 12\11 9 8|7 5 4|3 0 | 
Tem [1 171 of opt fo] orn | R [111] | op [1] cRm | 
cond coproc<3:1>| 
coproc<0> 


A1 variant 


MCR{<c>}{<q>} <coproc>, {#}<opcl>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


Decode for this encoding 
t = UInt(Rt); cp = if coproc<@> == '@' then 14 else 15; 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


T1 


|15 14 13 12|11 10 9 8|7 5 4]|3 0 |15 12|11 9 8|7 5 4|3 0| 
[1 1 ajoji 1 1 of opet [o] crn | rt f1 1 1| | opc2 [1i] CRM | 
coproc<3:1>| 
coproc<0> 


T1 variant 


MCR{<c>}{<q>} <coproc>, {#}<opcl>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


Decode for this encoding 

t = UInt(Rt); cp = if coproc<@> == '@' then 14 else 15; 

if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
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<coproc> Is the System register encoding space, encoded in the "coproc<0>" field. It can have the following 
values: 
p14 when coproc<@> = 0 
p15 when coproc<@> = 1 

<opcl> Is the opcl parameter within the System register encoding space, in the range 0 to7, encoded in the 
"opcl" field. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<CRn> Is the CRn parameter within the System register encoding space, in the range c0 to c15, encoded in 


the "CRn" field. 


<CRm> Is the CRm parameter within the System register encoding space, in the range c0 to c15, encoded in 
the "CRm" field. 


<opc2> Is the opc2 parameter within the System register encoding space, in the range 0 to7, encoded in the 
"opc2" field. 


The possible values of { <coproc>, <opcl>, <CRn>, <CRm>, <opc2> } encode the entire System register and System 
instruction encoding space. Not all of this space is allocated, and the System register and System instruction 
descriptions identify the allocated encodings. 


Operation for all encodings 
if ConditionPassed() then 


EncodingSpecificOperations(); 
AArch32.SysRegwWrite(cp, ThisInstr(), R[t]); 
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F5.1.108 MCRR 


ARM DDI 0487E.a 
ID070919 


Move to System register from two general-purpose registers. This instruction copies the values of two 
general-purpose registers to a System register. 


The System register descriptions identify valid encodings for this instruction. Other encodings are UNDEFINED. For 
more information see About the AArch32 System register interface on page E1-3805 and General behavior of 
System registers on page G8-5892. 


In an implementation that includes EL2, MCRR accesses to System registers can be trapped to Hyp mode, meaning 
that an attempt to execute an MCRR instruction in a Non-secure mode other than Hyp mode, that would be permitted 
in the absence of the Hyp trap controls, generates a Hyp Trap exception. For more information, see EL2 
configurable controls on page G1-5585. 


Because of the range of possible traps to Hyp mode, the MCRR pseudocode does not show these possible traps. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 12\11 9 8|7 4|3 0 | 
Tem [1100 o[tjojo] Re | R pin | opt | cRm | 
cond coproc<3:1>| 
coproc<0> 


A1 variant 


MCRR{<c>}{<q>} <coproc>, {#}<opcl>, <Rt>, <Rt2>, <CRm> 


Decode for this encoding 
t = UInt(Rt); t2 = UInt(Rt2); cp = if coproc<@> == 'Q' then 14 else 15; 


if t == 15 || t2 == 15 then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 9 8|7 4|3 0 | 
[1 1 fofi 1 0 0o oftfofo] R2 | rt |111| | oper | CRm | 
coproc<3:1>| 
coproc<0> 


T1 variant 


MCRR{<c>}{<q>} <coproc>, {#}<opcl>, <Rt>, <Rt2>, <CRm> 


Decode for this encoding 

t = UInt(Rt); t2 = UInt(Rt2); cp = if coproc<@> == '@' then 14 else 15; 
if t == 15 || t2 == 15 then UNPREDICTABLE; 

// Armv8-A removes UNPREDICTABLE for R13 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 

<coproc> Is the System register encoding space, encoded in the "coproc<0>" field. It can have the following 
values: 
p14 when coproc<ð> = @ 
p15 when coproc<@> = 1 

<opc1> Is the opc1 parameter within the System register encoding space, in the range 0 to 15, encoded in 


the "opc1" field. 


<Rt> Is the first general-purpose register that is transferred into, encoded in the "Rt" field. 
<Rt2> Is the second general-purpose register that is transferred into, encoded in the "Rt2" field. 
<CRm> Is the CRm parameter within the System register encoding space, in the range c0 to c15, encoded in 


the "CRm" field. 


The possible values of { <coproc>, <opcl>, <CRm> } encode the entire System register encoding space. Not all of this 
space is allocated, and the System register descriptions identify the allocated encodings. 


For the permitted uses of these instructions, as described in this manual, <Rt2> transfers bits[63:32] of the selected 
System register, while <Rt> transfers bits[31:0]. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
value = R[t2]:R[t]; 
AArch32.SysRegwWrite64(cp, ThisInstr(), value); 
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F5.1.109 MLA, MLAS 


ARM DDI 0487E.a 
ID070919 


Multiply Accumulate multiplies two register values, and adds a third register value. The least significant 32 bits of 
the result are written to the destination register. These 32 bits do not depend on whether the source register values 
are considered to be signed values or unsigned values. 


In an A32 instruction, the condition flags can optionally be updated based on the result. Use of this option adversely 
affects performance on many implementations. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12111 8|7 6 5 4|3 0| 
emn [ooo 0007s] ra | ra | Rm [7007] m | 


cond 


Flag setting variant 

Applies when S = 1. 

MLAS{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 

Not flag setting variant 

Applies when S == 0. 

MLA{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 

Decode for all variants of this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); setflags = (S == '1'); 
if d == 15 || n == 15 || m == 15 || a == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11 8/7 6 5 4|3 0 | 


Tiit70770000] Ra | =i | Rd [oojoo] Rm | 
Ra 


T1 variant 


MLA{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for this encoding 

if Ra == '1111' then SEE "MUL"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); setflags = FALSE; 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
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<Rn> Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. 
<Ra> Is the third general-purpose source register holding the addend, encoded in the "Ra" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand1 = SInt(R[n]); // operandl = UInt(R[n]) produces the same final results 
operand2 = SInt(R[m]); // operand2 = UInt(R[m]) produces the same final results 
addend = SInt(R[a]); // addend = UInt(R[a]) produces the same final results 
result = operand1 « operand2 + addend; 
R[d] = result<31:0>; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result<31:0>); 
// PSTATE.C, PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
2 The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Multiply and Subtract multiplies two register values, and subtracts the product from a third register value. The least 
significant 32 bits of the result are written to the destination register. These 32 bits do not depend on whether the 
source register values are considered to be signed values or unsigned values. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 


| iit jo oo ofo 1 tfof Ra | Ra | Rm |i oot] R | 


cond 


A1 variant 


MLS{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 
if d == 15 || n == 15 || m == 15 || a == 15 then UNPREDICTABLE; 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12111 8|7 6 5 4|3 0| 


marano 0000] Rn | ra | ro Joor) Rm | 


T1 variant 


MLS{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 

if d == 15 || n == 15 || m == 15 || a == 15 then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. 

<Ra> Is the third general-purpose source register holding the minuend, encoded in the "Ra" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand1 = SInt(R[n]); // operandl = UInt(R[n]) produces the same final results 
operand2 = SInt(R[m]); // operand2 = UInt(R[m]) produces the same final results 
addend = SInt(R[a]); // addend = UInt(R[a]) produces the same final results 
result = addend - operand1 » operand2; 
R[d] = result<31:@>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.111 MOV, MOVS (immediate) 


ARM DDI 0487E.a 
ID070919 


Move (immediate) writes an immediate value to the destination register. 


If the destination register is not the PC, the MOVS variant of the instruction updates the condition flags based on 
the result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


è The MOV variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

° The MOVS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12111 | | 0| 
1111 Jo o 11 1/0 1]/sho(o@ ol Ra |  imm2 ____ | 
cond 

MOV variant 


Applies when S == 0. 

MOV{<c>}{<q>} <Rd>, #<const> 

MOVS variant 

Applies when S = 1. 

MOVS{<c>}{<q>} <Rd>, #<const> 

Decode for all variants of this encoding 


d = UInt(Rd); setflags = (S == '1');  (imm32, carry) = A32ExpandImm_C(imm12, PSTATE.C); 


A2 

|31 28|27 26 25 24|23 22 21 20|19 16115 12111 | | 0| 
EAM [0.011 ojojo o) mm | Rd | — mma  ě | 
cond 

A2 variant 


MOV{<c>}{<q>} <Rd>, #<imm16> // <imm16> can not be represented in Al 
MOVW{<c>}{<q>} <Rd>, #<imm16> // <imm16> can be represented in Al 


Decode for this encoding 


d = UInt(Rd); setflags = FALSE; imm32 = ZeroExtend(imm4:imm12, 32); 
if d == 15 then UNPREDICTABLE; 
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F5-4340 


T1 
|15 14 13 12|1110 8|7 | 0 | 
foo 1]o Oo] Rd | me ] 
T1 variant 


MOV<c>{<q>} <Rd>, #<imm8> // Inside IT block 
MOVS{<q>} <Rd>, #<imm8> // Outside IT block 


Decode for this encoding 


d = UInt(Rd); setflags = !InITBlock(); imm32 = ZeroExtend(imm8, 32); carry = PSTATE.C; 


T2 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0]1514 12/11 8|7 | 0 | 


[1111 ofifojo o 1 ojsj1 1 1 1fof imma | Rd | imme | 


MOV variant 
Applies when S == 0. 


MOV<c>.W <Rd>, #<const> // Inside IT block, and <Rd>, <const> can be represented in T1 
MOV{<c>}{<q>} <Rd>, #<const> 


MOVS variant 
Applies when S = 1. 


MOVS.W <Rd>, #<const> // Outside IT block, and <Rd>, <const> can be represented in T1 
MOVS{<c>}{<q>} <Rd>, #<const> 


Decode for all variants of this encoding 
d = UInt(Rd); setflags = (S == '1');  (imm32, carry) = T32ExpandImm_C(i:imm3:imm8, PSTATE.C); 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


T3 


|15 14 13 12|11109 8|7 6 5 4|3 0\1514 12\11 8|7 | 0 | 


[11.1 4 ofits ojoj o of imm4 Jo] imma | Ra | imma | 


T3 variant 


MOV{<c>}{<q>} <Rd>, #<imm16> // <imm16> cannot be represented in T1 or T2 
MOVW{<c>}{<q>} <Rd>, #<imm16> // <imm16> can be represented in T1 or T2 


Decode for this encoding 


d = UInt(Rd); setflags = FALSE; imm32 = ZeroExtend(imm4:i:imm3:imm8, 32); 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
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Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<imm8> 


<imm16> 


<const> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 


deprecates using the PC as the destination register, but if the PC is used: 


° For the MOV variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


. For the MOVS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding A2, T1, T2 and T3: is the general-purpose destination register, encoded in the "Rd" 
field. 

Is a 8-bit unsigned immediate, in the range 0 to 255, encoded in the "imm&" field. 

For encoding A2: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 
"imm4:imm12" field. 

For encoding T3: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 
"imm4:i:imm3:imms" field. 

For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T2: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = imm32; 
if d == 15 then // Can only occur for encoding A1 


else 


if setflags then 


ALUExceptionReturn(result) ; 
ALUWritePC(result) ; 


= result; 


if setflags then 


PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result) ; 
PSTATE.C = carry; 

// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


s The execution time of this instruction is independent of: 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.112 — MOV, MOVS (register) 
Move (register) copies a value from a register to the destination register. 


If the destination register is not the PC, the MOVS variant of the instruction updates the condition flags based on 
the result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. If the 
destination register is the PC: 


° The MOV variant of the instruction is a branch. In the T32 instruction set (encoding T1) this is a simple 
branch, and in the A32 instruction set it is an interworking branch, see Pseudocode description of operations 
on the AArch32 general-purpose registers and the PC on page E1-3787. 

è The MOVS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See Ilegal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 
— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 
This instruction is used by the aliases ASRS (immediate), ASR (immediate), LSLS (immediate), LSL (immediate), 


LSRS (immediate), LSR (immediate), RORS (immediate), ROR (immediate), RRXS, and RRX. See Alias 
conditions on page F5-4345 for details of when each alias is preferred. 


A1 
31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12\11 i7 6 5 4|3 0 | 
i [0007 1]0 SOON Ra | mms [sype[o] Rm | 


cond 


MOV, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


MOV{<c>}{<q>} <Rd>, <Rm>, RRX 


MOV, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 


MOV{<c>}{<q>} <Rd>, <Rm> {, <shift> #<amount>} 


MOVS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


MOVS{<c>}{<q>} <Rd>, <Rm>, RRX 


MOVS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


MOVS{<c>}{<q>} <Rd>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4343 
ID070919 Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


T1 


|15 14 13 12|11 10 9 8|7 6 3 2 ol 


fo 700071 o| Rm | Ra | 


T1 variant 


MOV{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(D:Rd); m = UInt(Rm); setflags = FALSE; 
(shift_t, shift_n) = (SRType_LSL, Q); 
if d == 15 && InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


T2 


|15 14 13 12/11 10 | 65 |32 Of 


[o o ofiz]  imm5 | Rm | Ra | 


op 


T2 variant 


MOV<c>{<q>} <Rd>, <Rm> {, <shift> #<amount>} // Inside IT block 
MOVS{<q>} <Rd>, <Rm> {, <shift> #<amount>} // Outside IT block 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); setflags = !InITBlock(); 
(shift_t, shift_n) = DecodeImmShift(op, imm5); 
if op == 'Q0' && imm5 == 'Q0000' && InITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If op == '00' && imm5 == 'Q0000' && InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as if it passed its condition code check. 
. The instruction executes as NOP, as if it failed its condition code check. 
° The instruction executes as MOV Rd, Rm. 
T3 
|15 14 13 1211110 9 8/7 6 5 4|3 2 1 0ļ1514 12/11 8|7 6 5 4|3 


o| 


770407007 ojs 10] mm3 | Rd fmmajsype] Rm | 


MOV, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


MOV{<c>}{<q>} <Rd>, <Rm>, RRX 
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MOV, shift or rotate by value variant 
Applies when S == O && !(imm3 == 000 && imm2 == 00 && stype == 11). 


MOV{<c>}.W <Rd>, <Rm> {, LSL #0} // <Rd>, <Rm> can be represented in T1 

MOV<c>.W <Rd>, <Rm> {, <shift> #<amount>} // Inside IT block, and <Rd>, <Rm>, <shift>, <amount> can be 
represented in T2 

MOV{<c>}{<q>} <Rd>, <Rm> {, <shift> #<amount>} 


MOVS, rotate right with extend variant 


Applies when S == 1 && imm3 == 000 && imm2 == 00 && stype == 11. 


MOVS{<c>}{<q>} <Rd>, <Rm>, RRX 


MOVS, shift or rotate by value variant 


Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11). 


MOVS.W <Rd>, <Rm> {, <shift> #<amount>} // Outside IT block, and <Rd>, <Rm>, <shift>, <amount> can be 
represented in T1 or T2 
MOVS{<c>}{<q>} <Rd>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); 


m = UInt(Rm); 


setflags = (S == '1'); 


(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 
if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Alias conditions 





Alias 


ASRS (immediate) 


ASRS (immediate) 


ASR (immediate) 


ASR (immediate) 
LSLS (immediate) 
LSLS (immediate) 
LSLS (immediate) 
LSL (immediate) 
LSL (immediate) 
LSL (immediate) 


LSRS (immediate) 


LSRS (immediate) 
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of variant 


T3 (MOVS, shift or rotate by value), 
Al (MOVS, shift or rotate by value) 


T2 


T3 (MOV, shift or rotate by value), 
Al (MOV, shift or rotate by value) 


T2 

T3 (MOVS, shift or rotate by value) 
Al (MOVS, shift or rotate by value) 
T2 

T3 (MOV, shift or rotate by value) 
Al (MOV, shift or rotate by value) 
T2 


T3 (MOVS, shift or rotate by value), 
Al (MOVS, shift or rotate by value) 


T2 
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is preferred when 


S == '1' && stype == '10' 


op == '10' && !InITBlock() 


S == 'Q' && stype == '10' 


op == '10' && InITBlock() 

S == '1' && imm3:Rd:imm2 != 'QQOxxxx00' && stype == '00' 
S == '1' && imm5 != '00000' && stype == '00' 

op == 'Q0' && immS != 'Q0000' && !InITBlock() 

S == '0' && imm3:Rd:imm2 != 'QQOxxxx00' && stype == '00' 
S == '0' && imm5 != '00000' && stype == '00' 

op == 'Q0' && immS != 'Q0000' && InITBlock() 


S == '1' && stype == 'Q1' 


op == 'Q1' && !InITBlock() 
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Alias of variant is preferred when 


LSR (immediate) T3 (MOV, shift or rotate by value), S == 'Q' && stype == '01' 
Al (MOV, shift or rotate by value) 


LSR (immediate) T2 op == '01' && InITBlock() 


RORS (immediate) T3 (MOVS, shift or rotate by value) S == '1' && imm3:Rd:imm2 != 'Q0Oxxxx00' && stype == '11' 








RORS (immediate) Al (MOVS, shift or rotate by value) S == '1' && imm5 != '00000' && stype == '11' 

ROR (immediate) T3 (MOV, shift or rotate by value) S == '0' && imm3:Rd:imm2 != 'Q0Oxxxx00' && stype == '11' 
ROR (immediate) Al (MOV, shift or rotate by value) S == 'Q' && imm5 != '00000' && stype == '11' 

RRXS T3 (MOVS, rotate right with extend) S == '1' && imm3 == '000' && imm2 == '00' && stype == '11' 
RRXS Al (MOVS, rotate right with extend) S == '1' && imm5 == '00000' && stype == '11' 

RRX T3 (MOV, rotate right with extend) S == 'Q' && imm3 == 'Q00' && imm2 == '00' && stype == '11' 








RRX Al (MOY, rotate right with extend) S == '@' && imm5 == '00000' && stype == '11' 





Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If the PC is 
used: 
° For the MOV variant, the instruction is a branch to the address calculated by the operation. 


This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. Arm deprecates use of the 
instruction if <Rn> is the PC. 


° For the MOVS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. Arm deprecates use of the instruction if <Rn> is not the LR, 
or if the optional shift or RRX argument is specified. 


For encoding T1: is the general-purpose destination register, encoded in the "D:Rd" field. If the PC 
is used: 


. The instruction causes a branch to the address moved to the PC. This is a simple branch, see 
Pseudocode description of operations on the AArch32 general-purpose registers and the PC 
on page E1-3787. 


. The instruction must either be outside an IT block or the last instruction of an IT block. 
For encoding T2 and T3: is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> For encoding A1 and T1: is the general-purpose source register, encoded in the "Rm" field. The PC 
can be used. Arm deprecates use of the instruction if <Rd> is the PC. 


For encoding T2 and T3: is the general-purpose source register, encoded in the "Rm" field. 


<shift> For encoding A1 and T3: is the type of shift to be applied to the source register, encoded in the 
"stype" field. It can have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
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For encoding T2: is the type of shift to be applied to the source register, encoded in the "op" field. 
It can have the following values: 


LSL when op = 00 
LSR when op = 01 
ASR when op = 10 

<amount> For encoding A1: is the shift amount, in the range 0 to 31 (when <shift> = LSL), or 1 to 31 (when 
<shift> =ROR) or 1 to 32 (when <shift> = LSR or ASR), encoded in the "imm5" field as <amount> 
modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm5" field as <amount> modulo 32. 


For encoding T3: is the shift amount, in the range 0 to 31 (when <shift> = LSL) or 1 to 31 (when 
<shift> = ROR), or 1 to 32 (when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as 
<amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = shifted; 
if d == 15 then 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 
° The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.113 MOV, MOVS (register-shifted register) 


F5-4348 


Move (register-shifted register) copies a register-shifted register value to the destination register. It can optionally 
update the condition flags based on the value. 


This instruction is used by the aliases ASRS (register), ASR (register), LSLS (register), LSL (register), LSRS 
(register), LSR (register), RORS (register), and ROR (register). See Alias conditions on page F5-4350 for details of 
when each alias is preferred. 


A1 
31 28|27 26 25 24/23 22 21 20/19 18 17 16|15 12111 8|7 6 5 4|3 o| 
Cem [000 1 pooo a | R [ofe Rm 


cond 


Flag setting variant 
Applies when S = 1. 


MOVS{<c>}{<q>} <Rd>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


MOV{<c>}{<q>} <Rd>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 
d = UInt(Rd); m = UInt(Rm); s = UInt(Rs); 


setflags = (S == '1'); shift_t = DecodeRegShift(stype) ; 
if d == 15 || m == 15 || s == 15 then UNPREDICTABLE; 


T1 


151413 12411109 | 65 |32 ol] 


op 


Arithmetic shift right variant 
Applies when op == 0100. 


MOV<c>{<q>} <Rdm>, <Rdm>, ASR <Rs> // Inside IT block 
MOVS{<q>} <Rdm>, <Rdm>, ASR <Rs> // Outside IT block 


Logical shift left variant 
Applies when op == 0010. 


MOV<c>{<q>} <Rdm>, <Rdm>, LSL <Rs> // Inside IT block 
MOVS{<q>} <Rdm>, <Rdm>, LSL <Rs> // Outside IT block 


Logical shift right variant 
Applies when op == 0011. 


MOV<c>{<q>} <Rdm>, <Rdm>, LSR <Rs> // Inside IT block 
MOVS{<q>} <Rdm>, <Rdm>, LSR <Rs> // Outside IT block 
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Rotate right variant 
Applies when op == 0111. 


MOV<c>{<q>} <Rdm>, <Rdm>, ROR <Rs> // Inside IT block 
MOVS{<q>} <Rdm>, <Rdm>, ROR <Rs> // Outside IT block 


Decode for all variants of this encoding 
if !(op IN {'Q010', 'Q@11', '@100', '@111'}) then SEE "Related encodings”; 


d = UInt(Rdm); m = UInt(Rdm); s = UInt(Rs); 
setflags = !InITBlock(); shift_t = DecodeRegShift(op<2>:op<O>) ; 


T2 


[15 1413 12/1110 9 8|7 6 5 4/3 0 |15 14 13 12|11 8|7 6 5 4/3 0| 


Tii71070 Ofsype[s] em [7177] Rd [oooo] Rs | 


Flag setting variant 
Applies when S = 1. 


MOVS.W <Rd>, <Rm>, <shift> <Rs> // Outside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in 
T1 
MOVS{<c>}{<q>} <Rd>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


MOV<c>.W <Rd>, <Rm>, <shift> <Rs> // Inside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in 
T1 
MOV{<c>}{<q>} <Rd>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); m = UInt(Rm); s = UInt(Rs); 

setflags = (S == '1'); shift_t = DecodeRegShift(stype); 

if d == 15 || m == 15 || s == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


Related encodings: In encoding T1, for an op field value that is not described above, see Data-processing (two low 
registers) on page F3-3937. 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5-4350 


Alias conditions 





Alias 


ASRS (register) 


of variant 


Al (flag setting) 


is preferred when 


S == '1' && stype == '10' 





ASRS (register) T1 (arithmetic shift right) op == '0100' && !InITBlock() 
ASRS (register) T2 (flag setting) stype == '10' && S == '1' 
ASR (register) Al (not flag setting) == 'Q' && stype == '10' 
ASR (register) T1 (arithmetic shift right) op == '0100' && InITBlock() 
ASR (register) T2 (not flag setting) stype == '10' && S == 'Q' 
LSLS (register) A1 (flag setting) == '1' && stype == '00' 
LSLS (register) T1 (logical shift left) op == '0010' && !InITBlock() 
LSLS (register) T2 (flag setting) stype == '00' && S == '1' 
LSL (register) Al (not flag setting) == '0' && stype == '00' 
LSL (register) T1 (logical shift left) op == '0010' && InITBlock() 
LSL (register) T2 (not flag setting) stype == 'Q0' && S == 'Q' 
LSRS (register) A1 (flag setting) == '1' && stype == 'Q1' 
LSRS (register) T1 (logical shift right) op == '0011' && !InITBlock() 
LSRS (register) T2 (flag setting) stype == '@1' && S == '1' 
LSR (register) Al (not flag setting) == 'Q' && stype == 'Q1' 
LSR (register) T1 (logical shift right) op == '0011' && InITBlock() 
LSR (register) T2 (not flag setting) stype == '01' && S == '0' 
RORS (register) A1 (flag setting) == '1' && stype == '11' 
RORS (register) T1 (rotate right) op == '0111' && !InITBlock() 
RORS (register) T2 (flag setting) stype == '11' && S == '1' 
ROR (register) Al (not flag setting) == 'Q' && stype == '11' 
ROR (register) T1 (rotate right) op == '0111' && InITBlock() 
ROR (register) T2 (not flag setting) stype == '11' && S == '0' 

Assembler symbols 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdm> Is the general-purpose source register and the destination register, encoded in the "Rdm" field. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the general-purpose source register, encoded in the "Rm" field. 
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<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


<Rs> 


Is the general-purpose source register holding a shift amount in its bottom 8 bits, encoded in the "Rs" 
field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
(result, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.114 MOVT 


Move Top writes an immediate value to the top halfword of the destination register. It does not affect the contents 
of the bottom halfword. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16115 12111 | | 0| 
i111 fo o 1 1 ofjıjo of imma | Ra | mm2 ë žě | 
cond 

A1 variant 


MOVT{<c>}{<q>} <Rd>, #<imm16> 


Decode for this encoding 
d = UInt(Rd); imm16 = imm4:imm12; 
if d == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 01514  12|11 8|7 | 0 | 


741 oft o 0 0] mma [oy imma | Ra | me | 


T1 variant 


MOVT{<c>}{<q>} <Rd>, #<imm16> 


Decode for this encoding 
d = UInt(Rd); imm16 = imm4:i:imm3:imm8; 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<imm16> For encoding A1: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 


"imm4:imm12" field. 


For encoding T1: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 
"imm4:i:imm3:imm8" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
R[d]<31:16> = imm16; 
// R{d]<15:@> unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4353 
Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.115 


F5-4354 


MRC 


Move to general-purpose register from System register. This instruction copies the value of a System register to a 
general-purpose register. 


The System register descriptions identify valid encodings for this instruction. Other encodings are UNDEFINED. For 
more information see About the AArch32 System register interface on page E1-3805 and General behavior of 
System registers on page G8-5892. 


In an implementation that includes EL2, MRC accesses to system control registers can be trapped to Hyp mode, 
meaning that an attempt to execute an MRC instruction in a Non-secure mode other than Hyp mode, that would be 
permitted in the absence of the Hyp trap controls, generates a Hyp Trap exception. For more information, see EL2 
configurable controls on page G1-5585. 


Because of the range of possible traps to Hyp mode, the MRC pseudocode does not show these possible traps. 
A1 


|31 28|27 26 25 24|23 21 20|19 16|15 12\11 9 8|7 5 4|3 0 | 
Tem [1171 of opt [i] orn | Rt [1711] | op [1] cRm | 
cond coproc<3:1>| 
coproc<0> 


A1 variant 


MRC{<c>}{<q>} <coproc>, {#}<opcl>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


Decode for this encoding 


t = UInt(Rt); cp = if coproc<@> == '@' then 14 else 15; 
// Armv8-A removes UNPREDICTABLE for R13 


T1 


|15 14 13 12|11 10 9 8|7 5 4|3 o |15 12|11 9 8|7 5 4|3 0| 
[1 1 ajoji 1 1 of opet [1] crn | rt [1 1 1| | opc2 [1i] CRM | 
coproc<3:1>| 
coproc<0> 


T1 variant 
MRC{<c>}{<q>} <coproc>, {#}<opcl>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
Decode for this encoding 

t = UInt(Rt); cp = if coproc<@> == '@' then 14 else 15; 

// Armv8-A removes UNPREDICTABLE for R13 
Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<coproc> Is the System register encoding space, encoded in the "coproc<0>" field. It can have the following 
values: 


iT} 
© 


p14 when coproc<0> 


iT} 
m 


p15 when coproc<@> 
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<opcl> Is the opcl parameter within the System register encoding space, in the range 0 to7, encoded in the 
"opcl" field. 
<Rt> Is the general-purpose register to be transferred or APSR_nzcv (encoded as @b1111), encoded in the 


"Rt" field. If APSR_nzcv is used, bits [31:28] of the transferred value are written to the PSTATE 
condition flags. 


<CRn> Is the CRn parameter within the System register encoding space, in the range c0 to c15, encoded in 
the "CRn" field. 


<CRm> Is the CRm parameter within the System register encoding space, in the range c0 to c15, encoded in 
the "CRm" field. 


<opc2> Is the opc2 parameter within the System register encoding space, in the range 0 to7, encoded in the 
"opc2" field. 


The possible values of { <coproc>, <opcl>, <CRn>, <CRm>, <opc2> } encode the entire System register and System 
instruction encoding space. Not all of this space is allocated, and the System register and System instruction 
descriptions identify the allocated encodings. 


Operation for all encodings 


if ConditionPassed() then 

EncodingSpecificOperations(); 

bits(32) value = AArch32.SysRegRead(cp, ThisInstr()); 

if t != 15 then 
R[t] = value; 

elsif AArch32.SysRegReadCanWriteAPSR(cp, ThisInstr()) then 
PSTATE.<N,Z,C,V> = value<31:28>; 
// “alue<27:@> are not used. 

else 
PSTATE.<N,Z,C,V> = bits(4) UNKNOWN; 
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F5.1.116 


F5-4356 


MRRC 


Move to two general-purpose registers from System register. This instruction copies the value of a System register 
to two general-purpose registers. 


The System register descriptions identify valid encodings for this instruction. Other encodings are UNDEFINED. For 
more information see About the AArch32 System register interface on page E1-3805 and General behavior of 
System registers on page G8-5892. 


In an implementation that includes EL2, MRRC accesses to System registers can be trapped to Hyp mode, meaning 
that an attempt to execute an MRRC instruction in a Non-secure mode other than Hyp mode, that would be permitted 
in the absence of the Hyp trap controls, generates a Hyp Trap exception. For more information, see EL2 
configurable controls on page G1-5585. 


Because of the range of possible traps to Hyp mode, the MRRC pseudocode does not show these possible traps. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 12\11 9 8|7 4|3 0 | 
Tem [1100 o]tjoys] Re | R (11%) | opt | cRm | 
cond coproc<3:1>| 
coproc<0> 


A1 variant 
MRRC{<c>}{<q>} <coproc>, {#}<opcl>, <Rt>, <Rt2>, <CRm> 


Decode for this encoding 


= UInt(Rt); t2 = UInt(Rt2); cp = if coproc<@> == '@' then 14 else 15; 
if t == 15 || t2 == 15 || t == t2 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The value in the destination register is UNKNOWN. 
T1 
|15 14 13 12|1110 9 8|7 6 5 4/3 015 12/11 9 8|7 4|3 0 | 


[1 1 ajoji 1 0 0 oftfoft] R2 | r |111| | op | CRm | 
coproc<3:1>| 
coproc<0> 


T1 variant 


MRRC{<c>}{<q>} <coproc>, {#}<opcl>, <Rt>, <Rt2>, <CRm> 


Decode for this encoding 


= UInt(Rt); t2 = UInt(Rt2); cp = if coproc<@> == '@' then 14 else 15; 
if t == 15 || t2 == 15 || t == t2 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
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CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<coproc> Is the System register encoding space, encoded in the "coproc<0>" field. It can have the following 
values: 
p14 when coproc<@> = 0 
p15 when coproc<@> = 1 

<opc1> Is the opc1 parameter within the System register encoding space, in the range 0 to 15, encoded in 


the "opc1" field. 


<Rt> Is the first general-purpose register that is transferred into, encoded in the "Rt" field. 
<Rt2> Is the second general-purpose register that is transferred into, encoded in the "Rt2" field. 
<CRm> Is the CRm parameter within the System register encoding space, in the range c0 to c15, encoded in 


the "CRm" field. 


The possible values of { <coproc>, <opcl>, <CRm> } encode the entire System register encoding space. Not all of this 
space is allocated, and the System register descriptions identify the allocated encodings. 


For the permitted uses of these instructions, as described in this manual, <Rt2> transfers bits[63:32] of the selected 
System register, while <Rt> transfers bits[31:0]. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
value = AArch32.SysRegRead64(cp, ThisInstr()); 
R[t] = value<31:@>; 
R[t2] = value<63:32>; 
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F5.1.117 


F5-4358 


MRS 


Move Special register to general-purpose register moves the value of the The Application Program Status Register, 
APSR on page E1-3789, CPSR, or SPSR_<current_mode> into a general-purpose register. 


Arm recommends the APSR form when only the N, Z, C, V, Q, and GE[3:0] bits are being written. For more 
information, see The Application Program Status Register, APSR on page E1-3789. 


An MRS that accesses the SPSR is UNPREDICTABLE if executed in User mode or System mode. 

An MRS that is executed in User mode and accesses the CPSR returns an UNKNOWN value for the CPSR. {E, A, I, F, 
M} fields. 

A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 8|7 6 5 4/3 2 1 0| 


| 1111 fo o o 1 ofRfofola aay Ra  kokofokojo o o 0|(0) (0) )(0) 


cond 


A1 variant 


MRS{<c>}{<q>} <Rd>, <spec_reg> 


Decode for this encoding 


d = UInt(Rd); read_spsr = (R == '1'); 
if d == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|151413 12/11 8|7 6 5 4|3 21 0| 


pt to ot 1 1 Rat ofofol Rai kokoto (O|fO)f(0) 





T1 variant 
MRS{<c>}{<q>} <Rd>, <spec_reg> 
Decode for this encoding 
d = UInt(Rd); read_spsr = (R == '1'); 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 


<spec_reg> Is the special register to be accessed, encoded in the "R" field. It can have the following values: 


CPSR|APSR whenR = 0 
SPSR whenR = 1 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if read_spsr then 
if PSTATE.M IN {M32_User,M32_System} then 
UNPREDICTABLE; 
else 
R[d] = SPSR[]; 
else 
// CPSR has same bit assignments as SPSR, but with the IT, J, SS, IL, and T bits masked out. 
bits(32) mask = '11111000 00001111 00000011 11011111'; 
if HavePANExt() then 
mask<22> = '1'; 
psr_val = GetPSRFromPSTATE() AND mask; 
if PSTATE.EL == ELO then 
// If accessed from User mode return UNKNOWN values for E, A, I, F bits, bits<9:6>, 
// and for the M field, bits<4:0> 
psr_val<22> = bits(1) UNKNOWN; 
psr_val<9:6> = bits(4) UNKNOWN; 
psr_val<4:@> = bits(5) UNKNOWN; 
R[d] = psr_val; 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.M IN {M32_User, M32_System} && read_spsr, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
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F5.1.118 


F5-4360 


MRS (Banked register) 


Move to Register from Banked or Special register moves the value from the Banked general-purpose register or 
SPSR of the specified mode, or the value of ELR_hyp on page G1-5492, to a general-purpose register. 


MRS (Banked register) is UNPREDICTABLE if executed in User mode. 


When EL3 is using AArch64, if an MRS (Banked register) instruction that is executed in a Secure EL] mode would 
access SPSR_mon, SP_mon, or LR_mon, it is trapped to EL3. 


The effect of using an MRS (Banked register) instruction with a register argument that is not valid for the current mode 
is UNPREDICTABLE. For more information see Usage restrictions on the banked register transfer instructions on 
page F5-4778. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4/3 2 1 0| 


| 111 jo oo 14 ofRfojo] m | Ra [oo {Mjo o o okoo (00) 


cond 


A1 variant 


MRS{<c>}{<q>} <Rd>, <banked_reg> 


Decode for this encoding 


d = UInt(Rd); read_spsr = (R == '1'); 
if d == 15 then UNPREDICTABLE; 


SYSm = M:M1; 
T1 
|15 14 13 12|11 10 9 8|7 6 5 43 0 [15 14 13 12|11 8|7 65 4/3 21 0| 





111001111 sry m ft ofoyol Ra [oo + {mMjoofoo) 


T1 variant 


MRS{<c>}{<q>} <Rd>, <banked_reg> 


Decode for this encoding 

d = UInt(Rd); read_spsr = (R == '1'); 

if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
SYSm = M:M1; 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
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<banked_reg> Is the name of the banked register to be transferred to or from, encoded in the "R:M:M1" field. It 
can have the following values: 
































R8_usr when R = 0,M = 0,M1 = 0000 
R9_usr when R = 0,M = 0,M1 = 0001 
R10_usr when R = 0,M = 0,M1 = 0010 
R1l_usr when R = 0,M = 0,M1 = 0011 
R12_usr when R = 0,M = 0,M1 = 0100 
SP_usr when R = 0,M = 0,M1 = 0101 
LR_usr when R = 0,M = 0,M1 = 0110 
R8_figq when R = 0,M = 0,M1 = 1000 
R9_fiq when R = 0,M = 0, M1 = 1001 
R10_fiq when R = 0,M = 0, M1 = 1010 
R11_fig when R = 0,M = 0,M1 = 1011 
R12_fig when R = 0,M = 0,M1 = 1100 
SP_fiq when R = 0,M = 0,M1 = 1101 
LR_fig when R = 0,M = 0,M1 = 1110 
LR_irg when R = 0,M = 1,M1 = 0000 
SP_irq when R = 0,M = 1,M1 = 0001 
LR_svc when R = 0,M = 1,M1 = 0010 
SP_svc when R = 0,M = 1,M1 = 0011 
LR_abt when R = 0,M = 1,M1 = 0100 
SP_abt when R = 0,M = 1,M1 = 0101 
LR_und when R = 0,M = 1,M1 = 0110 
SP_und when R = 0,M = 1,M1 = 0111 
LR_mon when R = 0,M = 1,M1 = 1100 
SP_mon when R = 0,M = 1,M1 = 1101 
ELR_hyp when R = 0,M = 1,M1 = 1110 
SP_hyp when R = 0,M = 1,M1 = 1111 
SPSR_fig when R = 1,M = 0,M1 = 1110 
SPSR_irq when R = 1,M = 1,M1 = 0000 
SPSR_svc when R = 1,M = 1,M1 = 0010 
SPSR_abt when R = 1,M = 1,M1 = 0100 
SPSR_und when R = 1,M = 1,M1 = 0110 
SPSR_mon when R = 1,M = 1,M1 = 1100 
SPSR_hyp when R = 1,M = 1,M1 = 1110 
The following encodings are UNPREDICTABLE: 

s R = 0,M = 0, M1 = 0111. 

$ R = 0,M = 0, M1 = 1111. 

° R = 0,M = 1,M1 = 10xx. 

. R = 1,M = 0, M1 = 0xxx. 

° R = 1,M = 0, M1 = 10xx. 

° R = 1,M = Q,M1 = 110x. 

° R = 1,M = @,M1 = 1111. 

. R = 1,M = 1,M1 = 0001. 
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. R =1,M = 1,M1 = 0011 
. R =1,M = 1, M1 = 0101 
. R =1,M = 1, M1 = 0111 
. R = 1,M = 1, M1 = 10xx 
. R = 1,M = 1, M1 = 1101 
. R = 1,M = 1, M1 = 1111 








Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if PSTATE.EL == ELQ then 
UNPREDICTABLE; 
else 
mode = PSTATE.M; 
if read_spsr then 
SPSRaccessValid(SYSm, mode); // Check for UNPREDICTABLE cases 
case SYSm of 


when 'Q@1110' R[d] = SPSR_figq; 
when '10000' R[d] = SPSR_irq; 
when '10010' R[d] = SPSR_svc; 
when '10100' R[d] = SPSR_abt; 


when '10110' R[d] = SPSR_und; 

when '11100' 
if !ELUsingAArch32(EL3) then AArch64.MonitorModeTrap(); 
R[d] = SPSR_mon; 

when '11110' R[d] = SPSR_hyp; 





else 
BankedRegisterAccessValid(SYSm, mode); // Check for UNPREDICTABLE cases 
case SYSm of 
when 'QQxxx' // Access the User mode registers 
m = UInt(SYSm<2:0>) + 8; 


























R[d] = Rmode[m,M32_User]; 

when 'Q1xxx' // Access the FIQ mode registers 
m = UInt(SYSm<2:0>) + 8; 
R[d] = Rmode[m,M32_F1Q]; 

when '1000x' // Access the IRQ mode registers 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == @, otherwise SP 
R[d] = Rmode[m,M32_IRQ]; 

when '10Q1x' // Access the Supervisor mode registers 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == @, otherwise SP 
R[d] = Rmode[m,M32_Svc]; 

when '1010x' // Access the Abort mode registers 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == 0, otherwise SP 
R[d] = Rmode[m,M32_Abort]; 

when '1011x' // Access the Undefined mode registers 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == @, otherwise SP 
R[d] = Rmode[m,M32_Undef]; 

when '1110x' // Access Monitor registers 
if !ELUsingAArch32(EL3) then AArch64.MonitorModeTrap(); 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == @, otherwise SP 
R[d] = Rmode[m,M32_Monitor]; 

when '11110' // Access ELR_hyp register 
R[d] = ELR_hyp; 

when '11111' // Access SP_hyp register 
R[d] = Rmode[13,M32_Hyp]; 


CONSTRAINED UNPREDICTABLE behavior 
If PSTATE.EL == ELQ, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
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. The instruction executes as NOP. 
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F5.1.119 


F5-4364 


MSR (Banked register) 


Move to Banked or Special register from general-purpose register moves the value of a general-purpose register to 
the Banked general-purpose register or SPSR of the specified mode, or to ELR_hyp on page G1-5492. 


MSR (Banked register) is UNPREDICTABLE if executed in User mode. 


When EL3 is using AArch64, if an MSR (Banked register) instruction that is executed in a Secure EL] mode would 
access SPSR_mon, SP_mon, or LR_mon, it is trapped to EL3. 


The effect of using an MSR (Banked register) instruction with a register argument that is not valid for the current mode 
is UNPREDICTABLE. For more information see Usage restrictions on the banked register transfer instructions on 
page F5-4778. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 10 9 8|7 6 5 4|3 0| 


Cem [ooo 7 RE m Moo ooo] Rn 


cond 


A1 variant 


MSR{<c>}{<q>} <banked_reg>, <Rn> 


Decode for this encoding 


n = UInt(Rn); write_spsr = (R == '1'); 
if n == 15 then UNPREDICTABLE; 


SYSm = M:M1; 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4/3 0 [15 14 13 12|11 8|7 6 54|32 10| 





111001110 ofr] Rn [1 okofoj m (oo [mkoko 


T1 variant 


MSR{<c>}{<q>} <banked_reg>, <Rn> 

Decode for this encoding 

n = UInt(Rn); write_spsr = (R == '1'); 

if n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 

SYSm = M:M1; 

Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
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<banked_reg> Is the name of the banked register to be transferred to or from, encoded in the "R:M:M1" field. It 
can have the following values: 


R8_usr 
R9_usr 
R1@_usr 
R1l_usr 
R12_usr 
SP_usr 
LR_usr 
R8_fig 
R9_fiq 
R10_fiq 
R11_fiq 
R12_fiq 
SP_fiq 
LR_fiq 
LR_irq 
SP_irg 
LR_svc 
SP_svc 
LR_abt 
SP_abt 
LR_und 
SP_und 
LR_mon 
SP_mon 
ELR_hyp 
SP_hyp 
SPSR_fiq 
SPSR_irg 
SPSR_svc 
SPSR_abt 
SPSR_und 
SPSR_mon 
SPSR_hyp 





when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 
when R 


when R 


ere ee eS eS Se Se SSS SQ LLP SS LS _— LLL = LL OP LS LS LS PLS OSS 


1, 

















The following encodings are UNPREDICTABLE: 


s R 


R 
R 
R 
: R 
R 
R 
R 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


0, M 
0, M 
0, M 
1,M 
1,M 
1,M 
1,M 
1,M 


Se SS S&S FS 





M1 = 0111. 
M1 = 1111. 
M1 = 10xx. 
M1 = Qxxx. 
M1 = 10xx. 
M1 = 110x. 
M1 = 1111. 
M1 = 0001. 











M1 = 0000 
M1 = 0001 
M1 = 0010 
M1 = 0011 
M1 = 0100 
M1 = 0101 
M1 = 0110 
M1 = 1000 
M1 = 1001 
M1 = 1010 
M1 = 1011 
M1 = 1100 
M1 = 1101 
M1 = 1110 
M1 = 0000 
M1 = 0001 
M1 = 0010 
M1 = 0011 
M1 = 0100 
M1 = 0101 
M1 = 0110 
M1 = 0111 
M1 = 1100 
M1 = 1101 
M1 = 1110 
M1 = 1111 
M1 = 1110 
M1 = 0000 
M1 = 0010 
M1 = 0100 
M1 = 0110 
M1 = 1100 
M1 = 1110 


F5-4365 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 








. R= 1,M = 1,M1 = 0011. 
. R = 1,M = 1,M1 = 0101. 
. R= 1,M = 1,M1 = 0111. 
. R = 1,M = 1,M1 = 1Oxx. 
. R = 1,M=1,M1 = 1101. 
. R= 1,M = 1, M1 = 1111. 
<Rn> Is the general-purpose source register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if PSTATE.EL == ELO then 
UNPREDICTABLE; 
else 
mode = PSTATE.M; 
if write_spsr then 
SPSRaccessValid(SYSm, mode); // Check for UNPREDICTABLE cases 
case SYSm of 


when 'Q@1110' SPSR_fiq = R[n]; 
when '10000' SPSR_irq = R[n]; 
when '10010' SPSR_svc = R[n]; 
when '10100' SPSR_abt = R[n]; 
when '10110' SPSR_und = R[n]; 


when '11100' 
if !ELUsingAArch32(EL3) then AArch64.MonitorModeTrap(); 
SPSR_mon = R[n]; 

when '11110' SPSR_hyp = R[n]; 





else 
BankedRegisterAccessValid(SYSm, mode); // Check for UNPREDICTABLE cases 
case SYSm of 
when '00xxx' // Access the User mode registers 
m = UInt(SYSm<2:0>) + 8; 

















Rmode[m,M32_User] = R[n]; 

when '@1xxx' // Access the FIQ mode registers 
m = UInt(SYSm<2:0>) + 8; 
Rmode[m,M32_F1IQ] = R[n]; 

when '1000x' // Access the IRQ mode registers 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == @, otherwise SP 
Rmode[m,M32_IRQ] = R[n]; 

when '10Q1x' // Access the Supervisor mode registers 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == @, otherwise SP 
Rmode[m,M32_Svc] = R[n]; 

when '1010x' // Access the Abort mode registers 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == @, otherwise SP 
Rmode[m,M32_Abort] = R[n]; 

when '1011x' // Access the Undefined mode registers 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == 0, otherwise SP 
Rmode[m,M32_Undef] = R[n]; 

when '1110x' // Access Monitor registers 
if !ELUsingAArch32(EL3) then AArch64.MonitorModeTrap(); 
m = 14 - UInt(SYSm<@>) ; // LR when SYSm<@> == @, otherwise SP 
Rmode[m,M32_Monitor] = R[n]; 

when '11110' // Access ELR_hyp register 
ELR_hyp = R[n]; 

when '11111' // Access SP_hyp register 


Rmode[13,M32_Hyp] = R[n]; 
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CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == ELQ, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
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F5.1.120 


F5-4368 


MSR (immediate) 


Move immediate value to Special register moves selected bits of an immediate value to the corresponding bits in 
the The Application Program Status Register, APSR on page E1-3789, CPSR, or SPSR_<current_mode>. 


Because of the Do-Not-Modify nature of its reserved bits, the immediate form of MSR is normally only useful at the 
Application level for writing to APSR_nzcvq (CPSR_f). 


If an MSR (immediate) moves selected bits of an immediate value to the CPSR, the PE checks whether the value being 
written to PSTATE.M is legal. See ///egal changes to PSTATE.M on page G1-5497. 


An MSR (immediate) executed in User mode: 

è Is CONSTRAINED UNPREDICTABLE if it attempts to update the SPSR. 

° Otherwise, does not update any CPSR field that is accessible only at EL1 or higher, 

An MSR (immediate) executed in System mode is CONSTRAINED UNPREDICTABLE if it attempts to update the SPSR. 


The CPSR.E bit is writable from any mode using an MSR instruction. Arm deprecates using this to change its value. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 | | 0| 
i111 fo o 1 1 ofR[1 of mask ooo imma O 
cond 

A1 variant 


Applies when !(R == 0 && mask == 0000). 

MSR{<c>}{<q>} <spec_reg>, #<imm> 

Decode for this encoding 

if mask == 'Q000' && R == 'Q' then SEE "Related encodings"; 


imm32 = A32ExpandImm(imm12); write_spsr = (R == '1'); 
if mask == '0000' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If mask == '0000' && R == '1', then one of the following behaviors must occur: 
7 The instruction is UNDEFINED. 
s The instruction executes as NOP. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related encodings: Move Special Register and Hints (immediate) on page F4-4021. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<spec_reg> Is one of: 


° APSR_<bits>. 
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<imm> 


Operation 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


$ CPSR_<fields>. 
: SPSR_<fields>. 


For CPSR and SPSR, <fields> is a sequence of one or more of the following: 


c mask<0> = '1' to enable writing of bits<7:0> of the destination PSR. 

x mask<1>='1' to enable writing of bits<15:8> of the destination PSR. 
s mask<2> = '1' to enable writing of bits<23:16> of the destination PSR. 
f mask<3> = '1' to enable writing of bits<31:24> of the destination PSR. 


For APSR, <bits> is one of nzcvq, g, or nzcvqg. These map to the following CPSR_<fields> values: 
à APSR_nzcvq is the same as CPSR_f (mask== '1000'). 

° APSR_g is the same as CPSR_s (mask == '0100'). 

° APSR_nzcvaqg is the same as CPSR_fs (mask == '1100'). 


Arm recommends the APSR_<bits> forms when only the N, Z, C, V, Q, and GE[3:0] bits are being 
written. For more information, see The Application Program Status Register, APSR on 
page E1-3789. 


Is an immediate value. See Modified immediate constants in A32 instructions on page F2-3924 for 
the range of values. 


if ConditionPassed() then 


EncodingSpecificOperations(); 
if write_spsr then 
if PSTATE.M IN {M32_User,M32_System} then 
UNPREDICTABLE; 


SPSRWriteByInstr(imm32, mask); 


// Attempts to change to an illegal mode will invoke the Illegal Execution state mechanism 
CPSRWriteByInstr(imm32, mask); 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.M IN {M32_User,M32_System} && write_spsr, then one of the following behaviors must occur: 


The instruction is UNDEFINED. 


The instruction executes as NOP. 
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F5.1.121 


F5-4370 


MSR (register) 


Move general-purpose register to Special register moves selected bits of a general-purpose register to the The 
Application Program Status Register, APSR on page E1-3789, CPSR or SPSR_<current_mode>. 


Because of the Do-Not-Modify nature of its reserved bits, a read-modify-write sequence is normally required when 
the MSR instruction is being used at Application level and its destination is not APSR_nzcvq (CPSR_f). 


If an MSR (register) moves selected bits of an immediate value to the CPSR, the PE checks whether the value being 
written to PSTATE.M is legal. See ///egal changes to PSTATE.M on page G1-5497. 


An MSR (register) executed in User mode: 

Is UNPREDICTABLE if it attempts to update the SPSR. 

° Otherwise, does not update any CPSR field that is accessible only at EL1 or higher. 

An MSR (register) executed in System mode is UNPREDICTABLE if it attempts to update the SPSR. 


The CPSR.E bit is writable from any mode using an MSR instruction. Arm deprecates using this to change its value. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 121110 9 8|7 6 5 4|3 0| 


[ 1111 foo o1 ofrjifo] mak nmm Oooo 0 o] Rn | 


cond 


A1 variant 
MSR{<c>}{<q>} <spec_reg>, <Rn> 
Decode for this encoding 
n = UInt(Rn); write_spsr = (R == '1'); 


if mask == '0000' then UNPREDICTABLE; 
if n == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If mask == '0000', then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
T1 
|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 21 0| 





TTT TOOTT TO OR] Rn [1 ofo] mack [Oo TOO 


T1 variant 


MSR{<c>}{<q>} <spec_reg>, <Rn> 


Decode for this encoding 


n = UInt(Rn); write_spsr = (R == '1'); 
if mask == '0000' then UNPREDICTABLE; 
if n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
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CONSTRAINED UNPREDICTABLE behavior 


If mask == 'Q000', then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
. The instruction executes as NOP. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<spec_reg> Is one of: 


° APSR_<bits>. 
bd CPSR_<fields>. 
` SPSR_<fields>. 


For CPSR and SPSR, <fields> is a sequence of one or more of the following: 


c mask<0> = '1' to enable writing of bits<7:0> of the destination PSR. 

xX mask<1>='1' to enable writing of bits<15:8> of the destination PSR. 
s mask<2>='1' to enable writing of bits<23:16> of the destination PSR. 
f mask<3> = '1' to enable writing of bits<31:24> of the destination PSR. 


For APSR, <bits> is one of nzcvq, g, or nzcvqg. These map to the following CPSR_<fields> values: 
° APSR_nzcvq is the same as CPSR_f (mask== '1000'). 

° APSR_g is the same as CPSR_s (mask == '0100'). 

° APSR_nzcvgg is the same as CPSR_fs (mask == '1100'). 


Arm recommends the APSR_<bits> forms when only the N, Z, C, V, Q, and GE[3:0] bits are being 
written. For more information, see The Application Program Status Register, APSR on 
page E1-3789. 


<Rn> Is the general-purpose source register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if write_spsr then 
if PSTATE.M IN {M32_User,M32_System} then 
UNPREDICTABLE; 
else 
SPSRWriteByInstr(R[n], mask); 
else 
// Attempts to change to an illegal mode will invoke the Illegal Execution state mechanism 
CPSRWriteByInstr(R[n], mask); 


CONSTRAINED UNPREDICTABLE behavior 
Ifwrite_spsr && PSTATE.M IN {M32_User,M32_System}, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
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. The instruction executes as NOP. 
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F5.1.122 MUL, MULS 


ARM DDI 0487E.a 
ID070919 


Multiply multiplies two register values. The least significant 32 bits of the result are written to the destination 
register. These 32 bits do not depend on whether the source register values are considered to be signed values or 


unsigned values. 


Optionally, it can update the condition flags based on the result. In the T32 instruction set, this option is limited to 
only a few forms of the instruction. Use of this option adversely affects performance on many implementations. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12/11 8/7 6 5 4|3 o| 
cmm [oo oojoo ojs Ra [ooo] am oo Rn | 


cond 


Flag setting variant 
Applies when S = 1. 


MULS{<c>}{<q>} <Rd>, <Rn>{, <Rm>} 


Not flag setting variant 
Applies when S == 0. 


MUL{<c>}{<q>} <Rd>, <Rn>{, <Rm>} 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8|7 65 132 ol] 


T1 variant 


MUL<c>{<q>} <Rdm>, <Rn>{, <Rdm>} // Inside IT block 
MULS{<q>} <Rdm>, <Rn>{, <Rdm>} // Outside IT block 


Decode for this encoding 
d = UInt(Rdm); n = UInt(Rn); m = UInt(Rdm); setflags = !InITBlock(); 


T2 


|15 14 13 121110 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


Tiit70770j000| Ra [i177] Rd oojoo) Rm | 


T2 variant 


MUL<c>.W <Rd>, <Rn>{, <Rm>} // Inside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
MUL{<c>}{<q>} <Rd>, <Rn>{, <Rm>} 
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Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = FALSE; 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rdm> Is the second general-purpose source register holding the multiplier and the destination register, 


encoded in the "Rdm" field. 


<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. If 


omitted, <Rd> is used. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand1 = SInt(R[n]); // operand1 = UInt(R[n]) produces the same final results 
operand2 = SInt(R[m]); // operand2 = UInt(R[m]) produces the same final results 
result = operandl « operand2; 
R[d] = result<31:0>; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result<31:0>); 
// PSTATE.C, PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.123 MVN, MVNS (immediate) 


ARM DDI 0487E.a 
ID070919 


Bitwise NOT (immediate) writes the bitwise inverse of an immediate value to the destination register. 


If the destination register is not the PC, the MVNS variant of the instruction updates the condition flags based on 
the result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 
deprecates any use of these encodings. However, when the destination register is the PC: 


è The MVN variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

7 The MVNS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12111 | | 0| 
i111 fo 0 114 1/11 1/Sho(@ ol Ra | mm2 ___ | 
cond 

MVN variant 


Applies when S == 0. 
MVN{<c>}{<q>} <Rd>, #<const> 
MVNS variant 
Applies when S == 1. 
MVNS{<c>}{<q>} <Rd>, #<const> 
Decode for all variants of this encoding 
d = UInt(Rd); setflags = (S == '1'); 
(imm32, carry) = A32ExpandImm_C(imm12, PSTATE.C); 


T1 


|15 14 13 1211110 9 8|7 6 5 4|3 2 1 0ļ1514 12/11 8|7 | 0 | 


771 of [ojo ot a[s]i 17 1/0] mma] Ra [imme _—s 


MVN variant 

Applies when S == 0. 
MVN{<c>}{<q>} <Rd>, #<const> 
MVNS variant 

Applies when S == 1. 
MVNS{<c>}{<q>} <Rd>, #<const> 
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Decode for all variants of this encoding 


d = UInt(Rd); setflags = (S == '1'); 
(imm32, carry) = T32ExpandImm_C(i:imm3:imm8, PSTATE.C); 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<const> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 
deprecates using the PC as the destination register, but if the PC is used: 


e For the MVN variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


a For the MVNS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. 
For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = NOT(imm32) ; 
if d == 15 then // Can only occur for A32 encoding 


else 


F5-4376 


if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 


R[d] = result; 

if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result) ; 
PSTATE.C = carry; 
// PSTATE.V unchanged 
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F5.1.124 MVN, MVNS (register) 


Bitwise NOT (register) writes the bitwise inverse of a register value to the destination register. 


If the destination register is not the PC, the MVNS variant of the instruction updates the condition flags based on 
the result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 
deprecates any use of these encodings. However, when the destination register is the PC: 


è The MVN variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

7 The MVNS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 
31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12\11 7 6 5 4|3 0 | 
1111 [o o 0 1 1[4 1] S{)(0)()(0f Ra | imms__[stypef[o] Rm | 


cond 


MVN, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


MVN{<c>}{<q>} <Rd>, <Rm>, RRX 


MVN, shift or rotate by value variant 

Applies when S == @ && !(imm5 == 00000 && stype == 11). 
MVN{<c>}{<q>} <Rd>, <Rm> {, <shift> #<amount>} 

MVNS, rotate right with extend variant 

Applies when S == 1 && imm5 == 00000 && stype == 11. 


MVNS{<c>}{<q>} <Rd>, <Rm>, RRX 

MVNS, shift or rotate by value variant 

Applies when S == 1 && !(imm5 == 00000 && stype == 11). 
MVNS{<c>}{<q>} <Rd>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 
d = UInt(Rd); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 


T1 


|15 14 13 121110 9 8|7 65 |32 0] 


[o tooo ol1 111| Rm | Ra | 
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T1 variant 


MVN<c>{<q>} <Rd>, <Rm> // Inside IT block 
MVNS{<q>} <Rd>, <Rm> // Outside IT block 


Decode for this encoding 
d = UInt(Rd); m = UInt(Rm); setflags = !InITBlock(); 
(shift_t, shift_n) = (SRType_LSL, Q); 


T2 


|15 141312/11109 8/7 6 5 4/3 2 1 0/1514 12/11 8|7 6 5 4|3 0 | 


770407001 1/5]1 11 10] mms | Rd |imma]sype] Rm | 


MVN, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


MVN{<c>}{<q>} <Rd>, <Rm>, RRX 


MVN, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


MVN<c>.W <Rd>, <Rm> // Inside IT block, and <Rd>, <Rm> can be represented in T1 
MVN{<c>}{<q>} <Rd>, <Rm> {, <shift> #<amount>} 


MVNS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && imm2 == 00 && stype == 11. 


MVNS{<c>}{<q>} <Rd>, <Rm>, RRX 


MVNS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11). 


MVNS.W <Rd>, <Rm> // Outside IT block, and <Rd>, <Rm> can be represented in T1 
MVNS{<c>}{<q>} <Rd>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 

d = UInt(Rd); m = UInt(Rm); setflags = (S == '1'); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
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<Rd> 


<Rm> 


<shift> 


<amount> 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 
deprecates using the PC as the destination register, but if the PC is used: 


° For the MVN variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


3 For the MVNS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1 and T2: is the general-purpose destination register, encoded in the "Rd" field. 
For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 
used, but this is deprecated. 

For encoding T1 and T2: is the general-purpose source register, encoded in the "Rm" field. 


Is the type of shift to be applied to the source register, encoded in the "stype" field. It can have the 
following values: 


LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "Imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = NOT(shifted); 


if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 


PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 


// PSTATE.V unchanged 
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F5.1.125 


F5-4380 


MVN, MVNS (register-shifted register) 


Bitwise NOT (register-shifted register) writes the bitwise inverse of a register-shifted register value to the 
destination register. It can optionally update the condition flags based on the result. 


A1 


|31 


28|27 26 25 24|23 22 21 20|19 18 17 16|15 12111 8|7 6 5 4|3 0| 


[mm fo 0 0 4 144 [somo] Rd | Rs Jofsyeji] Rm | 


cond 


Flag setting variant 


Applies when S = 1. 


MVNS{<c>}{<q>} <Rd>, <Rm>, <shift> <Rs> 


Not flag setting variant 


Applies when S == 0. 


MVN{<c>}{<q>} <Rd>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 


d = UInt(Rd); 
setflags 


m = UInt(Rm); s = UInt(Rs); 


(S == '1'); shift_t = DecodeRegShift(stype) ; 


if d == 15 || m == 15 || s == 15 then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rm> 


<shift> 


<Rs> 


Operation 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose destination register, encoded in the "Rd" field. 
Is the general-purpose source register, encoded in the "Rm" field. 


Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 


LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


Is the general-purpose source register holding a shift amount in its bottom 8 bits, encoded in the "Rs" 
field. 


if ConditionPassed() then 
EncodingSpecificOperations(); 


shift_n 


UInt(R[s]<7:@>); 


(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
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result = NOT(shifted); 

R[d] = result; 

if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 
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F5.1.126 


F5-4382 


NOP 


No Operation does nothing. This instruction can be used for instruction alignment purposes. 


Note 


The timing effects of including a NOP instruction in a program are not guaranteed. It can increase execution time, 
leave it unchanged, or even reduce it. Therefore, NOP instructions are not suitable for timing loops. 





A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|1110 9 8|7 6 5 4|3 2 1 0| 


Cem [oo 1 7 ojo ojo ojo o KONO o o o o o oo 


cond 


A1 variant 


NOP{<c>}{<q>} 


Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 1211110 9 8|7 6 5 4|3 2 1 0| 


TOT7T11770000)0000] 


T1 variant 


NOP{<c>}{<q>} 


Decode for this encoding 


// No additional decoding required 


T2 


|15 14 1312/1110 9 8/7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 21 0| 


Tit TOOT 101 OM ofofofoyo o ojo oo ojo o oo] 


T2 variant 


NOP{<c>}.W 


Decode for this encoding 


// No additional decoding required 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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Assembler symbols 
<C> See Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
// Do nothing 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.127 — ORN, ORNS (immediate) 


Bitwise OR NOT (immediate) performs a bitwise (inclusive) OR of a register value and the complement of an 
immediate value, and writes the result to the destination register. It can optionally update the condition flags based 
on the result. 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0\1514  12|11 8|7 | 0 | 


[11 1 1 ofijojo o 1 1js| 1111 Jol imm3 | Ra | imma | 
Rn 


Flag setting variant 
Applies when S = 1. 


ORNS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Not flag setting variant 
Applies when S == 0. 


ORN{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 

if Rn == '1111' then SEE "MVN (immediate)"; 

d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); 

(imm32, carry) = T32ExpandImm_C(i:imm3:imm8, PSTATE.C); 

if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. If omitted, this register is the 


same as <Rn>. 
<Rn> Is the general-purpose source register, encoded in the "Rn" field. 


<const> An immediate value. See Modified immediate constants in T32 instructions on page F2-3923 for the 
range of values. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = R[n] OR NOT(imm32); 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 
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Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.128 — ORN, ORNS (register) 


Bitwise OR NOT (register) performs a bitwise (inclusive) OR of a register value and the complement of an 
optionally-shifted register value, and writes the result to the destination register. It can optionally update the 
condition flags based on the result. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0\1514  12|11 8|7 6 5 4|3 0 | 


[111010 1ļ0o0 1 1js| 1111 [ol imm3 | Rd fimmalstype| Rm | 
Rn 





ORN, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


ORN{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ORN, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


ORN{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


ORNS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && imm2 == 00 && stype == 11. 


ORNS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ORNS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11). 


ORNS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 

if Rn == '1111' then SEE "MVN (register)"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
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<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> Is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 (when <shift> = 


LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] OR NOT(shifted); 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.129 ORR, ORRS (immediate) 


Bitwise OR (immediate) performs a bitwise (inclusive) OR of a register value and an immediate value, and writes 
the result to the destination register. 


If the destination register is not the PC, the ORRS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 
deprecates any use of these encodings. However, when the destination register is the PC: 


s The ORR variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

è The ORRS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

31 28|27 26 25 24|23 22 21 20|19 1615 1211 | | 0 | 
1111 Jo o 1 1 1/0 ofs| Rn | Ra | _ immi2_— | 
cond 

ORR variant 


Applies when S == 0. 


ORR{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


ORRS variant 
Applies when S = 1. 


ORRS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); 
(imm32, carry) = A32ExpandImm_C(imm12, PSTATE.C); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 01514 12\11 8|7 | 0 | 


mana ooo ot os] =n jo] imma] Ra | me | 
Rn 


ORR variant 

Applies when S == 0. 

ORR{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
ORRS variant 


Applies when S == 1. 
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ORRS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 
if Rn == '1111' then SEE "MOV (immediate)"; 
d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); 


(imm32, carry) = T32ExpandImm_C(i:imm3:imm8, PSTATE.C); 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 
° For the ORR variant, the instruction is a branch to the address calculated by the operation. 


This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


s For the ORRS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 


<Rn> For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 


For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 


<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = R[n] OR imm32; 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result) ; 
PSTATE.C = carry; 
// PSTATE.V unchanged 
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Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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ORR, ORRS (register) 


Bitwise OR (register) performs a bitwise (inclusive) OR of a register value and an optionally-shifted register value, 


and writes the result to the destination register. 


If the destination register is not the PC, the ORRS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 


deprecates any use of these encodings. However, when the destination register is the PC: 


s The ORR variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The ORRS variant of the instruction performs an exception return without the use of the stack. In this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 7 6 5 4|3 


[ 111 jo oo 4 1jo ojs| Rn | Ra | immS  |stypefo] Rm | 


cond 


ORR, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


ORR{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ORR, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 


ORR{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


ORRS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


ORRS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ORRS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


ORRS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); n 


= UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = 


DecodeImmShift(stype, imm5); 
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T1 


[15 14 13 12/1110 9 8|7 65 |32 o0] 


T1 variant 


ORR<c>{<q>} {<Rdn>,} <Rdn>, <Rm> // Inside IT block 
ORRS{<q>} {<Rdn>,} <Rdn>, <Rm> // Outside IT block 


Decode for this encoding 
d = UInt(Rdn); n = UInt(Rdn); m = UInt(Rm); setflags = !InITBlock(); 
(shift_t, shift_n) = (SRType_LSL, Q); 


T2 


[15 1413 12/1110 9 8|7 6 5 4|3 0/1514 12\11 8/7 6 5 4|3 0 | 


111010 1J0 071 ojs| !1111 [0| imm3 | Rd  |imm2|stype| Rm | 
Rn 





ORR, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


ORR{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ORR, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


ORR<c>.W {<Rd>,} <Rn>, <Rm> // Inside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
ORR{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


ORRS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && imm2 == 00 && stype == 11. 


ORRS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


ORRS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11). 


ORRS.W {<Rd>,} <Rn>, <Rm> // Outside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
ORRS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 

if Rn == '1111' then SEE "Related encodings"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related encodings: Data-processing (shifted register) on page F3-3948 
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Assembler symbols 


<C> 


<q> 


<Rdn> 


<Rd> 


<Rn> 


<Rm> 


<shift> 


<amount> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the first general-purpose source register and the destination register, encoded in the "Rdn" field. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 


° For the ORR variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


. For the ORRS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T2: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 

For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used, but this is deprecated. 

For encoding T2: is the first general-purpose source register, encoded in the "Rn" field. 

For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 

For encoding T1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 


Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 


LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "Iimm3:imm2" field as <amount> modulo 32. 


In T32 assembly: 


. Outside an IT block, if ORRS <Rd>, <Rn>, <Rd> is written with <Rd> and <Rn> both in the range RO-R7, it is 
assembled using encoding T1 as though ORRS <Rd>, <Rn> had been written. 


. Inside an IT block, if ORR<c> <Rd>, <Rn>, <Rd> is written with <Rd> and <Rn> both in the range RO-R7, it is 
assembled using encoding T1 as though ORR<c> <Rd>, <Rn> had been written. 


To prevent either of these happening, use the .W qualifier. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] OR shifted; 
if d == 15 then // Can only occur for A32 encoding 


if setflags then 
ALUExceptionReturn(result) ; 


ALUWritePC(result) ; 
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else 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.131 ORR, ORRS (register-shifted register) 


ARM DDI 0487E.a 
ID070919 


Bitwise OR (register-shifted register) performs a bitwise (inclusive) OR of a register value and a register-shifted 
register value, and writes the result to the destination register. It can optionally update the condition flags based on 
the result. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 
| !'=1111 fo o o 1 1[o ofs{ Rn | Ra | Rs [o]styeeļi| Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


ORRS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


ORR{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype) ; 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the general-purpose source register holding a shift amount in its bottom 8 bits, encoded in the "Rs" 
field. 
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Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] OR shifted; 
R[d] = result; 
if setflags then 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.132 PKHBT, PKHTB 


ARM DDI 0487E.a 
ID070919 


Pack Halfword combines one halfword of its first operand with the other halfword of its shifted second operand. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 |7 6 5 4|3 0| 
rim [o1107000] Rn | Rd | mms [ejor] Rm | 
cond 

PKHBT variant 

Applies when tb == 0. 


PKHBT{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, LSL #<imm>} 


PKHTB variant 
Applies when tb == 1. 


PKHTB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ASR #<imm>} 


Decode for all variants of this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); tbform = (tb == '1'); 


(shift_t, shift_n) = DecodeImmShift(tb:'@', imm5); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 01514 12\11 8|7 6 5 4|3 0| 


111010 1o11 ofof Rn [oy imm3 | Rd  fimm2jtøjo] Rm | 
S T 


PKHBT variant 
Applies when tb == 0. 


PKHBT{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, LSL #<imm>} // tbform == FALSE 


PKHTB variant 
Applies when tb == 1. 


PKHTB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ASR #<imm>} // tbform == TRUE 


Decode for all variants of this encoding 


if S == '1' || T == '1' then UNDEFINED; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); tbform = (tb == '1'); 

(shift_t, shift_n) = DecodeImmShift(tb:'Q', imm3:imm2); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5-4398 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 

<imm> For encoding A1: the shift to apply to the value read from <Rm>, encoded in the "imm5" field. Is one 
of: 


omitted No shift, encoded as 0b00000. 
1-31 Left shift by specified number of bits, encoded as a binary number. 


For encoding A1: the shift to apply to the value read from <Rm>, encoded in the "imm5" field. Is one 
of: 


omitted Instruction is a pseudo-instruction and is assembled as though PKHBT{<c>}{<q>} <Rd>, 
<Rm>, <Rn> had been written. 


1-32 Arithmetic right shift by specified number of bits. A shift by 32 bits is encoded as 
0b00000. Other shift amounts are encoded as binary numbers. 
Note 


An assembler can permit <imm> = 0 to mean the same thing as omitting the shift, but this is not 
standard UAL and must not be used for disassembly. 








For encoding T1: the shift to apply to the value read from <Rm>, encoded in the "Imm3:imm2" field. 
For PKHBT, it is one of: 

omitted No shift, encoded as 0b00000. 

1-31 Left shift by specified number of bits, encoded as a binary number. 

For PKHTB, it is one of: 


omitted Instruction is a pseudo-instruction and is assembled as though PKHBT{<c>}{<q>} <Rd>, 
<Rm>, <Rn> had been written. 


1-32 Arithmetic right shift by specified number of bits. A shift by 32 bits is encoded as 
0b00000. Other shift amounts are encoded as binary numbers. 
Note 


An assembler can permit <imm> = 0 to mean the same thing as omitting the shift, but this is not 
standard UAL and must not be used for disassembly. 








Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand2 = Shift(R[m], shift_t, shift_n, PSTATE.C); // PSTATE.C ignored 
R[d]<15:@> = if tbform then operand2<15:0> else R[n]<15:0>; 
R[d]<31:16> = if tbform then R[n]<31:16> else operand2<31:16>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


. The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.133 


F5-4400 


PLD, PLDW (immediate) 


Preload Data (immediate) signals the memory system that data memory accesses from a specified address are likely 
in the near future. The memory system can respond by taking actions that are expected to speed up the memory 
accesses when they do occur, such as preloading the cache line containing the specified address into the data cache. 


The PLD instruction signals that the likely memory access is a read, and the PLDW instruction signals that it is a write. 


The effect of a PLD or PLDW instruction is IMPLEMENTATION DEFINED. For more information, see Preloading caches 
on page E2-3832. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 | | 0 | 


Ti+ toOtouRp ty =m (oma a S EY 
Rn 


Preload read variant 
Applies when R == 
PLD{<c>}{<q>} [<Rn> {, #{+/-}<imm>}] 
Preload write variant 
Applies when R == 
PLDW{<c>}{<q>} [<Rn> {, #{+/-}<imm>}] 
Decode for all variants of this encoding 

if Rn == '1111' then SEE "PLD (literal)"; 

= UInt(Rn); imm32 = ZeroExtend(imm12, 32); add = (U == '1'); is_pldw = (R == '0'); 


T1 


Teora: 8|7 6 5 4|3 0 |15 14 13 12|11 | 0 | 





cc E a 


Preload read variant 

Applies when W == 

PLD{<c>}{<q>} [<Rn> {, #{+}<imm>}] 

Preload write variant 

Applies when W == 

PLDW{<c>}{<q>} [<Rn> {, #{+}<imm>}] 
Decode for all variants of this encoding 


if Rn == '1111' then SEE "PLD (literal)"; 
= UInt(Rn); imm32 = ZeroExtend(imm12, 32); add = TRUE; is_pldw = (W == '1'); 
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T2 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 14 13 12|11 10 9 8|7 | 0 | 


F711 7000 ow] enn [itt 1[1100| imme | 
Rn 





Preload read variant 
Applies when W == 0. 
PLD{<c>}{<q>} [<Rn> {, #-<imm>}] 
Preload write variant 
Applies when W == 1. 
PLDW{<c>}{<q>} [<Rn> {, #-<imm>}] 
Decode for all variants of this encoding 
if Rn == '1111' then SEE "PLD (literal)"; 
n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); add = FALSE; is_pldw = (W == '1'); 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. Must be AL or omitted. 
For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. If the PC is used, see PLD (literal). 
+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 
+ Specifies the offset is added to the base register. 
<imm> For encoding A1: is the optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 


defaulting to 0 and encoded in the "Iimm12" field. 


For encoding T1: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 
defaulting to 0 and encoded in the "Imm12" field. 


For encoding T2: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm8" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = if add then (R[n] + imm32) else (R[n] - imm32); 
if is_pldw then 
Hint_PreloadDataForWrite(address); 
else 
Hint_PreloadData(address); 
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F5.1.134 


F5-4402 


PLD (literal) 


Preload Data (literal) signals the memory system that data memory accesses from a specified address are likely in 
the near future. The memory system can respond by taking actions that are expected to speed up the memory 
accesses when they do occur, such as preloading the cache line containing the specified address into the data cache. 


The effect of a PLD instruction is IMPLEMENTATION DEFINED. For more information, see Preloading caches on 


page E2-3832. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12/11 | | 0 | 


A1 variant 


PLD{<c>}{<q>} <label> // Normal form 
PLD{<c>}{<q>} [PC, #{+/-}<imm>] // Alternative form 


Decode for this encoding 
imm32 = ZeroExtend(imm12, 32); add = (U == '1'); 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|151413 12/11 | | 0 | 


111100 ofujofoftts iaaiiai immi2 E 


T1 variant 


PLD{<c>}{<q>} <label> // Preferred syntax 
PLD{<c>}{<q>} [PC, #{+/-}<imm>] // Alternative syntax 


Decode for this encoding 


imm32 = ZeroExtend(imm12, 32); add = (U == '1'); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. Must be AL or omitted. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


<label> The label of the literal data item that is likely to be accessed in the near future. The assembler 
calculates the required value of the offset from the Align(PC, 4) value of the instruction to this label. 


The offset must be in the range —4095 to 4095. 
If the offset is zero or positive, imm32 is equal to the offset and add == TRUE. 


If the offset is negative, imm32 is equal to minus the offset and add == FALSE. 
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+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

<imm> For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, encoded in 


the "imm12" field. 


For encoding T1: is a 12-bit unsigned immediate byte offset, in the range 0 to 4095, encoded in the 
"imm12" field. 


The alternative syntax permits the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = if add then (Align(PC,4) + imm32) else (Align(PC,4) - imm32); 
Hint_PreloadData(address); 
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F5.1.135 


F5-4404 


PLD, PLDW (register) 


Preload Data (register) signals the memory system that data memory accesses from a specified address are likely in 
the near future. The memory system can respond by taking actions that are expected to speed up the memory 
accesses when they do occur, such as preloading the cache line containing the specified address into the data cache. 


The PLD instruction signals that the likely memory access is a read, and the PLDW instruction signals that it is a write. 


The effect of a PLD or PLDW instruction is IMPLEMENTATION DEFINED. For more information, see Preloading caches 
on page E2-3832. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 14 13 12|11 7 6 5 4|3 0 | 


T7701 ai [UR[O 7] Ra (OA ms [aypeo[ Rm | 


Preload read, optional shift or rotate variant 
Applies when R == 1 && !(imm5 == 00000 && stype == 11). 


PLD{<c>}{<q>} [<Rn>, {+/-}<Rm> {, <shift> #<amount>}] 


Preload read, rotate right with extend variant 
Applies when R == 1 && imm5 == 00000 && stype == 11. 


PLD{<c>}{<q>} [<Rn>, {+/-}<Rm> , RRX] 


Preload write, optional shift or rotate variant 
Applies when R == O && !(imm5 == 00000 && stype == 11). 


PLDW{<c>}{<q>} [<Rn>, {+/-}<Rm> {, <shift> #<amount>}] 


Preload write, rotate right with extend variant 
Applies when R == @ && imm5 == 00000 && stype == 11. 


PLDW{<c>}{<q>} [<Rn>, {+/-}<Rm> , RRX] 


Decode for all variants of this encoding 
n = UInt(Rn); m = UInt(Rm); add = (U == '1'); is_pldw = (R == 'Q'); 


(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
if m == 15 || (n == 15 && is_pldw) then UNPREDICTABLE; 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 14 13 12|11 10 9 8|7 6 5 4/3 0| 


11111000 ofolwit] 1111 |1 1414/0 0000 oļimm2| Rm | 
Rn 





Preload read variant 
Applies when W == 0. 


PLD{<c>}{<q>} [<Rn>, {+}<Rm> {, LSL #<amount>}] 


Preload write variant 


Applies when W == 1. 
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PLDW{<c>}{<q>} [<Rn>, {+}<Rm> {, LSL #<amount>}] 


Decode for all variants of this encoding 

if Rn == '1111' then SEE "PLD (literal)"; 

n = UInt(Rn); m = UInt(Rm); add = TRUE; is_pldw = (W == '1'); 
(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 

if m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. <c> must be AL or omitted. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be 
used. 


For encoding T1: is the general-purpose base register, encoded in the "Rn" field. 


+/- Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 
+ Specifies the index register is added to the base register. 
<Rm> Is the general-purpose index register, encoded in the "Rm" field. 
<shi ft> Is the type of shift to be applied to the index register, encoded in the "stype" field. It can have the 
following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T1: is the shift amount, in the range 0 to 3, defaulting to 0 and encoded in the "imm2" 
field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
address = if add then (R[n] + offset) else (R[n] - offset); 
if is_pldw then 
Hint_PreloadDataForWrite(address); 
else 
Hint_PreloadData(address); 
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F5.1.136 PLI (immediate, literal) 


Preload Instruction signals the memory system that instruction memory accesses from a specified address are likely 
in the near future. The memory system can respond by taking actions that are expected to speed up the memory 
accesses when they do occur, such as pre-loading the cache line containing the specified address into the instruction 
cache. 


The effect of a PLI instruction is IMPLEMENTATION DEFINED. For more information, see Preloading caches on 
page E2-3832. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 14 13 12|11 | | 0 | 


Tiitotopuifo a] Re yO) mmm ——S—~™ 


A1 variant 
PLI{<c>}{<q>} [<Rn> {, #{+/-}<imm>}] 


PLI{<c>}{<q>} <label> // Normal form 
PLI{<c>}{<q>} [PC, #{+/-}<imm>] // Alternative form 


Decode for this encoding 


n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); add = (U == '1'); 


T1 
|15141312|/1110 9 8|7 6 5 4/3 0 |15 14 13 12|11 | | o| 
1111100 1 ito oji] mm |1111] mm2 
Rn 
T1 variant 


PLI{<c>}{<q>} [<Rn> {, #{+}<imm>}] 


Decode for this encoding 
if Rn == '1111' then SEE "encoding T3"; 
n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); add = TRUE; 


T2 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 10 9 8|7 | 0 | 


fr t1 TooToo] enn [itt t[1100| imme | 
Rn 


T2 variant 


PLI{<c>}{<q>} [<Rn> {, #-<imm>}] 


Decode for this encoding 


if Rn == '1111' then SEE "encoding T3"; 
n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); add = FALSE; 
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T3 


|15 14 13 12|/11109 8|7 6 5 4/3 2 1 0|151413 12/11 | | 0 | 


Tiitioouooiiiiiiiii|) mmm | 


T3 variant 


PLI{<c>}{<q>} <label> // Preferred syntax 
PLI{<c>}{<q>} [PC, #{+/-}<imm>] // Alternative syntax 


Decode for this encoding 


n = 15; imm32 = ZeroExtend(imml2, 32); add = (U == '1'); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> For encoding A1: see Standard assembler syntax fields on page F2-3908. Must be AL or omitted. 
For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


<label> The label of the instruction that is likely to be accessed in the near future. The assembler calculates 
the required value of the offset from the Align(PC, 4) value of the instruction to this label. The offset 
must be in the range -4095 to 4095. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE. 


If the offset is negative, imm32 is equal to minus the offset and add == FALSE. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 

+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

+ Specifies the offset is added to the base register. 

<imm> For encoding A1: is the optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 


defaulting to 0 and encoded in the "imm12" field. 


For encoding T1: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 
defaulting to 0 and encoded in the "imm12" field. 


For encoding T2: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm8" field. 


For encoding T3: is a 12-bit unsigned immediate byte offset, in the range 0 to 4095, encoded in the 
"imm12" field. 


For the literal forms of the instruction, encoding T3 is used, or Rn is encoded as 0b1111 in encoding A1, to indicate 
that the PC is the base register. 


The alternative literal syntax permits the addition or subtraction of the offset and the immediate offset to be specified 
separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 
information, see Use of labels in UAL instruction syntax on page F1-3867. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
base = if n == 15 then Align(PC,4) else R[n]; 
address = if add then (base + imm32) else (base - imm32); 
Hint_PreloadInstr(address); 
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F5.1.137 PLI (register) 


ARM DDI 0487E.a 
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Preload Instruction signals the memory system that instruction memory accesses from a specified address are likely 
in the near future. The memory system can respond by taking actions that are expected to speed up the memory 
accesses when they do occur, such as pre-loading the cache line containing the specified address into the instruction 
cache. 


The effect of a PLI instruction is IMPLEMENTATION DEFINED. For more information, see Preloading caches on 
page E2-3832. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 14 13 12|11 |7 6 5 4|3 0 | 


T4717 onoono Ra (OA mm __[aypefo[ Rm |] 


Rotate right with extend variant 
Applies when imm5 == 00000 && stype == 11. 


PLI{<c>}{<q>} [<Rn>, {+/-}<Rm> , RRX] 


Shift or rotate by value variant 
Applies when !(imm5 == 00000 && stype == 11). 


PLI{<c>}{<q>} [<Rn>, {+/-}<Rm> {, <shift> #<amount>}] 


Decode for all variants of this encoding 


n = UInt(Rn); m = UInt(Rm); add = (U == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
if m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |1514 13 12|1110 9 8|7 6 5 4|3 0| 


7117007 Ooo] emn (177100000 0]mm] Rm | 
Rn 





T1 variant 


PLI{<c>}{<q>} [<Rn>, {+}<Rm> {, LSL #<amount>}] 


Decode for this encoding 

if Rn == '1111' then SEE "PLI (immediate, literal)"; 

n = UInt(Rn); m = UInt(Rm); add = TRUE; 

(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 

if m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. <c> must be AL or omitted. 
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F5-4410 


<q> 
<Rn> 


+/- 


+ 
<Rm> 


<shift> 


<amount> 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose base register, encoded in the "Rn" field. 


Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 


- when U = 0 


+ when U = 1 
Specifies the index register is added to the base register. 
Is the general-purpose index register, encoded in the "Rm" field. 


Is the type of shift to be applied to the index register, encoded in the "stype" field. It can have the 
following values: 


LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T1: is the shift amount, in the range 0 to 3, defaulting to 0 and encoded in the "imm2" 
field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
address = if add then (R[n] + offset) else (R[n] - offset); 
Hint_PreloadInstr(address); 
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Pop Multiple Registers from Stack loads multiple general-purpose registers from the stack, loading from 
consecutive memory locations starting at the address in SP, and updates SP to point just above the loaded data. 


The lowest-numbered register is loaded from the lowest memory address, through to the highest-numbered register 
from the highest memory address. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


The registers loaded can include the PC, causing a branch to a loaded address. This is an interworking branch, see 
Pseudocode description of operations on the AArch32 general-purpose registers and the PC on page E1-3787. 


T1 


|15 14 13 12|11 10 9 8|7 | 0| 


morai o[P] resister ist | 


T1 variant 


POP{<c>}{<q>} <registers> // Preferred syntax 
LDM{<c>}{<q>} SP!, <registers> // Alternate syntax 


Decode for this encoding 
registers = P:'Q000000':register_list; | UnalignedAllowed = FALSE; 


if BitCount(registers) < 1 then UNPREDICTABLE; 
if registers<15> == '1' && InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
$ The instruction targets an unspecified set of registers. These registers might include R15. If the instruction 


specifies writeback, the modification to the base address on writeback might differ from the number of 
registers loaded. 

Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 

Architectural Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 


<registers> Is a list of one or more registers to be loaded, separated by commas and surrounded by { and }. 


The registers in the list must be in the range RO-R7, encoded in the "register_list" field, and can 
optionally include the PC. Ifthe PC is in the list, the "P" field is set to 1, otherwise this field defaults 


to 0. 
If the PC is in the list, the instruction must be either outside any IT block, or the last instruction in 
an IT block. 
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Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = SP; 
for i = 0 to 14 
if registers<i> == '1' then 
R[i] = if UnalignedAllowed then MemU[address,4] else MemA[address,4]; 
address = address + 4; 
if registers<15> == '1' then 
if UnalignedAllowed then 
if address<1:0> == '00' then 
LoadWritePC(MemU[address,4]); 
else 
UNPREDICTABLE; 
else 
LoadWritePC(MemA[address,4]); 
if registers<13> == 'Q' then SP = SP + 4«BitCount(registers); 
if registers<13> == '1' then SP = bits(32) UNKNOWN; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.139 POP (multiple registers) 


Pop Multiple Registers from Stack loads multiple general-purpose registers from the stack, loading from 
consecutive memory locations starting at the address in SP, and updates SP to point just above the loaded data 


This instruction is an alias of the LDM, LDMIA, LDMFD instruction. This means that: 
° The encodings in this description are named to match the encodings of LDM, LDMIA, LDMFD. 


s The description of LDM, LDMIA, LDMFD gives the operational pseudocode for this instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 | | | 0 | 


Denn [10 ofo[toyiyi[+ +o] eoses ë O 
Ww Rn 


cond 


A1 variant 

POP{<c>}{<q>} <registers> 

is equivalent to 

LDM{<c>}{<q>} SP!, <registers> 


and is the preferred disassembly when BitCount(register_list) > 1. 
T2 


\15141312|11109 8|7 6 5 4|3 0\151413 | | | 0 | 


[1121070 o0ļjo1jojlijiji 1 0 1jejm]|  registerlist_ | 
W Rn 


T2 variant 

POP{<c>}.W <registers> // All registers in RQ-R7, PC 

is equivalent to 

LDM{<c>}{<q>} SP!, <registers> 

and is the preferred disassembly when BitCount(P:M:register_list) > 1. 
POP{<c>}{<q>} <registers> 


is equivalent to 














LDM{<c>}{<q>} SP!, <registers> 


and is the preferred disassembly when BitCount(P:M:register_list) > 1. 


Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<registers> For encoding A1: is a list of two or more registers to be loaded, separated by commas and 
surrounded by { and }. The lowest-numbered register is loaded from the lowest memory address, 
through to the highest-numbered register from the highest memory address. See also Encoding of 
lists of general-purpose registers and the PC on page F2-3914. 


If the SP is in the list, the value of the SP after such an instruction is UNKNOWN. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4414 


The PC can be in the list. If it is, the instruction branches to the address loaded to the PC. This is an 
interworking branch, see Pseudocode description of operations on the AArch32 general-purpose 
registers and the PC on page E1-3787. 


Arm deprecates the use of this instruction with both the LR and the PC in the list. 


For encoding T2: is a list of two or more registers to be loaded, separated by commas and 
surrounded by { and }. The lowest-numbered register is loaded from the lowest memory address, 
through to the highest-numbered register from the highest memory address. See also Encoding of 
lists of general-purpose registers and the PC on page F2-3914. 


The registers in the list must be in the range RO-R12, encoded in the "register_list" field, and can 
optionally contain one of the LR or the PC. If the LR is in the list, the "M" field is set to 1, otherwise 
it defaults to 0. If the PC is in the list, the "P" field is set to 1, otherwise it defaults to 0. 


The PC can be in the list. If it is, the instruction branches to the address loaded to the PC. This is an 
interworking branch, see Pseudocode description of operations on the AArch32 general-purpose 
registers and the PC on page E1-3787. If the PC is in the list: 


° The LR must not be in the list. 


$ The instruction must be either outside any IT block, or the last instruction in an IT block. 


Operation for all encodings 


The description of LDM, LDMIA, LDMFD gives the operational pseudocode for this instruction. 
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F5.1.140 POP (single register) 
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Pop Single Register from Stack loads a single general-purpose register from the stack, loading from the address in 
SP, and updates SP to point just above the loaded data 


This instruction is an alias of the LDR (immediate) instruction. This means that: 


$ The encodings in this description are named to match the encodings of LDR (immediate). 
s The description of LDR (immediate) gives the operational pseudocode for this instruction. 
A1 
|31 28|27 26 25 22 21 K 16115 12/11 | | 0| 
m [ot oof ojo; io e Joos se eoo oT OD 
cond imm12 


Post-indexed variant 
POP{<c>}{<q>} <single_register_list> 
is equivalent to 

LDR{<c>}{<q>} <Rt>, [SP], #4 


and is always the preferred disassembly. 


T4 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0| 
111110000 ojiji ron) R [ijolijifooorciodg 
PUW imm8 
Post-indexed variant 
POP{<c>}{<q>} <single_register_list> 
is equivalent to 
LDR{<c>}{<q>} <Rt>, [SP], #4 
and is always the preferred disassembly. 
Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<single_register_list> 


Is the general-purpose register <Rt> to be loaded surrounded by { and }. 


<Rt> For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 
can be used. If the PC is used, the instruction branches to the address (data) loaded to the PC. This 
is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 
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For encoding T4: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 
can be used, provided the instruction is either outside an IT block or the last instruction of an IT 
block. If the PC is used, the instruction branches to the address (data) loaded to the PC. This is an 
interworking branch, see Pseudocode description of operations on the AArch32 general-purpose 
registers and the PC on page E1-3787. 


Operation for all encodings 


The description of LDR (immediate) gives the operational pseudocode for this instruction. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.141 PSSBB 


Physical Speculative Store Bypass Barrier is a memory barrier which prevents speculative loads from bypassing 
earlier stores to the same physical address. 


The semantics of the Physical Speculative Store Bypass Barrier are: 


: When a load to a location appears in program order after the PSSBB, then the load does not speculatively 
read an entry earlier in the coherence order for that location than the entry generated by the latest store 
satisfying all of the following conditions: 


— The store is to the same location as the load. 


— The store appears in program order before the PSSBB. 


° When a load to a location appears in program order before the PSSBB, then the load does not speculatively 
read data from any store satisfying all of the following conditions: 


— The store is to the same location as the load. 


— The store appears in program order after the PSSBB. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16/15 14 13 12|11 10 9 8|7 6 5 4/3 2 1 0| 


A1 variant 


PSSBB{<q>} 


Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 2 1 0| 


tt toons a o1 1ko okooko +o ofo 1 0 0| 





T1 variant 
PSSBB{<q>} 
Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
SpeculativeStoreBypassBarrierToPA() ; 
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F5.1.142 


F5-4418 


PUSH 


Push Multiple Registers to Stack stores multiple general-purpose registers to the stack, storing to consecutive 
memory locations ending just below the address in SP, and updates SP to point to the start of the stored data. 


The lowest-numbered register is stored to the lowest memory address, through to the highest-numbered register to 
the highest memory address. See also Encoding of lists of general-purpose registers and the PC on page F2-3914. 


T1 


|15 14 13 12|11 10 9 8|7 | 0 | 


[1 0 1 1jofji ojm]  registerist_ | 


T1 variant 


PUSH{<c>}{<q>} <registers> // Preferred syntax 
STMDB{<c>}{<q>} SP!, <registers> // Alternate syntax 


Decode for this encoding 


registers = 'Q':M:'Q00000':register_list; UnalignedAllowed = FALSE; 
if BitCount(registers) < 1 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


a The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
è The instruction targets an unspecified set of registers. These registers might include R15. If the instruction 


specifies writeback, the modification to the base address on writeback might differ from the number of 
registers loaded. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<registers> Isa list of one or more registers to be stored, separated by commas and surrounded by { and }. 


The registers in the list must be in the range RO-R7, encoded in the "register_list" field, and can 
optionally include the LR. Ifthe LR is in the list, the "M" field is set to 1, otherwise this field defaults 
to 0. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = SP - 4xBitCount(registers); 
for i = 0 to 14 
if registers<i> == '1' then 
if i == 13 & i != LowestSetBit(registers) then // Only possible for encoding A1 
MemA[Laddress,4] = bits(32) UNKNOWN; 
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else 
if UnalignedAllowed then 
MemU[address,4] = R[i]; 
else 
MemA[address,4] = R[i]; 
address = address + 4; 
if registers<15> == '1' then // Only possible for encoding Al or A2 
if UnalignedAllowed then 
MemU[address,4] = PCStoreValue(); 
else 
MemA[address,4] = PCStoreValue(); 
SP = SP - 4*BitCount(registers) ; 
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F5.1.143 PUSH (multiple registers) 


Push multiple registers to Stack stores multiple general-purpose registers to the stack, storing to consecutive 
memory locations ending just below the address in SP, and updates SP to point to the start of the stored data 


This instruction is an alias of the STMDB, STMFD instruction. This means that: 
$ The encodings in this description are named to match the encodings of STMDB, STMFD. 


s The description of STMDB, STMFD gives the operational pseudocode for this instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 | | | 0 | 


Penn [10 o[tfojofijol+ + o1] oses ë O 
Ww Rn 


cond 


A1 variant 

PUSH{<c>}{<q>} <registers> 

is equivalent to 

STMDB{<c>}{<q>} SP!, <registers> 


and is the preferred disassembly when BitCount(register_list) > 1. 
T1 


|15 14 13 121110 9 8|7 6 5 4|3 0151413 | | | 0 | 


[111070 0f7 ojofijoji 1 0 1kofm]| register ist | 
Ww Rn P 


T1 variant 

PUSH{<c>}.W <registers> // All registers in RQ-R7, LR 

is equivalent to 

STMDB{<c>}{<q>} SP!, <registers> 

and is the preferred disassembly when BitCount(M:register_list) > 1. 
PUSH{<c>}{<q>} <registers> 

is equivalent to 

STMDB{<c>}{<q>} SP!, <registers> 


and is the preferred disassembly when BitCount(M:register_list) > 1. 


Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<registers> For encoding A1: is a list of two or more registers to be stored, separated by commas and surrounded 
by { and }. The lowest-numbered register is stored to the lowest memory address, through to the 
highest-numbered register to the highest memory address. See also Encoding of lists of 
general-purpose registers and the PC on page F2-3914. 


F5-4420 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


The SP and PC can be in the list. However: 
. Arm deprecates the use of instructions that include the PC in the list. 


° If the SP is in the list, and it is not the lowest-numbered register in the list, the instruction 
stores an UNKNOWN value for the SP. 


For encoding T1: is a list of one or more registers to be stored, separated by commas and surrounded 
by { and }. The lowest-numbered register is stored to the lowest memory address, through to the 
highest-numbered register to the highest memory address. See also Encoding of lists of 
general-purpose registers and the PC on page F2-3914. 


The registers in the list must be in the range RO-R12, encoded in the "register _list" field, and can 
optionally contain the LR. If the LR is in the list, the "M" field is set to 1, otherwise it defaults to 0. 


Operation for all encodings 


The description of STMDB, STMFD gives the operational pseudocode for this instruction. 
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F5.1.144 


F5-4422 


PUSH (single register) 


Push Single Register to Stack stores a single general-purpose register to the stack, storing to the 32-bit word below 
the address in SP, and updates SP to point to the start of the stored data 


This instruction is an alias of the STR (immediate) instruction. This means that: 


$ The encodings in this description are named to match the encodings of STR (immediate). 
s The description of STR (immediate) gives the operational pseudocode for this instruction. 
A1 
|31 28|27 26 25 L 22 21 LR 16115 12/11 | | 0| 
m Jot o[ifofoifoli toi] w Joos ee oo oo TOD 
cond imm12 


Pre-indexed variant 

PUSH{<c>}{<q>} <single_register_list> 
is equivalent to 

STR{<c>}{<q>} <Rt>, [SP, #-4]! 


and is always the preferred disassembly. 


T4 
|15 14 13 1211110 9 8|7 6 5 4/3 0 |15 12/1110 9 8|7 | 0| 
1111100001 ojoj roi R jijifojifo cording 
P UW imm8 
Pre-indexed variant 
PUSH{<c>}{<q>} <single_register_list> // Standard syntax 
is equivalent to 
STR{<c>}{<q>} <Rt>, [SP, #-4]! 
and is always the preferred disassembly. 
Assembler symbols 
<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<single_register_list> 


Is the general-purpose register <Rt> to be stored surrounded by { and }. 


<Rt> For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 
can be used, but this is deprecated. 


For encoding T4: is the general-purpose register to be transferred, encoded in the "Rt" field. 


Operation for all encodings 


The description of STR (immediate) gives the operational pseudocode for this instruction. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.145 QADD 
Saturating Add adds two register values, saturates the result to the 32-bit signed integer range -23! to (23! - 1), and 


writes the result to the destination register. If saturation occurs, it sets PSTATE.Q to 1. 


A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


| 111 jooo 4 ofo ojo] Rn | Rd (ooo. 10 1| Rm | 


cond 


A1 variant 


QADD{<c>}{<q>} {<Rd>,} <Rm>, <Rn> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiit7o070o00] Rn jira) Rd ojoo) Rm | 


T1 variant 


QADD{<c>}{<q>} {<Rd>,} <Rm>, <Rn> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 
<Rn> Is the second general-purpose source register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(R[d], sat) = SignedSatQ(SInt(R[m]) + SInt(R[n]), 32); 


if sat then 
PSTATE.Q = '1'; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.146 QADD16 
Saturating Add 16 performs two 16-bit integer additions, saturates the results to the 16-bit signed integer range -215 
<= x <=215- 1, and writes the results to the destination register. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Perm forno ojoro) Rn | Rd OOO of7] Rm | 


cond 


A1 variant 


QADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


Tiitto7ooo Ra [iii 7] Rd fojoj Rm 


T1 variant 


QADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum1 = SInt(R[n]<15:0>) + SInt(R[m]<15:0>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


sum2 = SInt(R[n]<31:16>) + SInt(R[m]<31:16>) ; 
R[d]<15:@> = SignedSat(sum1, 16); 
R[d]<31:16> = SignedSat(sum2, 16); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.147 


F5-4426 


QADD8 


Saturating Add 8 performs four 8-bit integer additions, saturates the results to the 8-bit signed integer range -27 <= 


x <= 27 - 1, and writes the results to the destination register. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[111 jo 110 ojo 1 of Rn | Ri Werf to oft] Rm | 


cond 


A1 variant 


QADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


Tiit7o70ooo] Ra [iii] Rd Jooo] Rm | 


T1 variant 


QADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
suml = SInt(R[n]<7:0>) + SInt(R[m]<7:0>); 
sum2 = SInt(R[n]<15:8>) + SInt(R[m]<15:8>); 
sum3 = SInt(R[n]<23:16>) + SInt(R[m]<23:16>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 


F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


sum4 = SInt(R[n]<31:24>) + SInt(R[m]<31:24>); 
R[d]<7:@> = SignedSat(sum1, 8); 
R[d]<15:8> = SignedSat(sum2, 8); 
R[d]<23:16> = SignedSat(sum3, 8); 
R[d]<31:24> = SignedSat(sum4, 8); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.148 QASX 


Saturating Add and Subtract with Exchange exchanges the two halfwords of the second operand, performs one 
16-bit integer addition and one 16-bit subtraction, saturates the results to the 16-bit signed integer range -2!5 <= x 
<= 215 - 1, and writes the results to the destination register. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[111 jo 110 ojo 1 of Rn | Rd kojoj fji] Rm | 


cond 


A1 variant 


QASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiit7o70o10] Ra [i147] Rd fojoj Rm | 


T1 variant 
QASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 

Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff = SInt(R[n]<15:@>) - SInt(R[m]<31:16>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


sum = SInt(R[n]<31:16>) + SInt(R[m]<15:0>); 
R[d]<15:@> = SignedSat(diff, 16); 
R[d]<31:16> = SignedSat(sum, 16); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.149 


F5-4430 


QDADD 


Saturating Double and Add adds a doubled register value to another register value, and writes the result to the 
destination register. Both the doubling and the addition have their results saturated to the 32-bit signed integer range 


-231 <= x <= 23! - 1. If saturation occurs in either operation, it sets PSTATE.Q to 1. 
A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[=m fo oo 4 oft ojo] Rn | Ra kokokokojo 1 o0 1| Rm | 


cond 


A1 variant 


QDADD{<c>}{<q>} {<Rd>,} <Rm>, <Rn> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manan onorooo] R jira) R oon Rm 


T1 variant 


QDADD{<c>}{<q>} {<Rd>,} <Rm>, <Rn> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 
<Rn> Is the second general-purpose source register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(doubled, sat1) = SignedSatQ(2 » SInt(R[n]), 32); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


(R[d], sat2) = SignedSatQ(SInt(R[m]) + SInt(doubled), 32); 
if satl || sat2 then 
PSTATE.Q = '1'; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.150 


F5-4432 


QDSUB 


Saturating Double and Subtract subtracts a doubled register value from another register value, and writes the result 
to the destination register. Both the doubling and the subtraction have their results saturated to the 32-bit signed 


integer range -23! <= x <= 23! - 1. If saturation occurs in either operation, it sets PSTATE.Q to 1. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[=m fo oo 4 oft jo] Rn | Rd kokokokojo 1 o0 1| Rm | 


cond 


A1 variant 


QDSUB{<c>}{<q>} {<Rd>,} <Rm>, <Rn> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manar onorooo] em [titi] R popoa Rm 


T1 variant 


QDSUB{<c>}{<q>} {<Rd>,} <Rm>, <Rn> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 
<Rn> Is the second general-purpose source register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(doubled, sat1) = SignedSatQ(2 » SInt(R[n]), 32); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


(R[d], sat2) = SignedSatQ(SInt(R[m]) - SInt(doubled), 32); 
if satl || sat2 then 
PSTATE.Q = '1'; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.151 QSAX 


Saturating Subtract and Add with Exchange exchanges the two halfwords of the second operand, performs one 
16-bit integer subtraction and one 16-bit addition, saturates the results to the 16-bit signed integer range -2!5 <= x 
<= 215 - 1, and writes the results to the destination register. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Perm forno ojoro) en | Rd (enol of7] Rm 


cond 


A1 variant 


QSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Toit 70707110] Ra [i177] Rd fojoj Rm 


T1 variant 
QSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 

Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum = SInt(R[n]<15:0>) + SInt(R[m]<31:16>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


diff = SInt(R[n]<31:16>) - SInt(R[m]<15:@>); 
R[d]<15:@> = SignedSat(sum, 16); 
R[d]<31:16> = SignedSat(diff, 16); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.152  QSUB 


Saturating Subtract subtracts one register value from another register value, saturates the result to the 32-bit signed 
integer range -23! <= x <= 231 - 1, and writes the result to the destination register. If saturation occurs, it sets 
PSTATE.Q to 1. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[=m fo oo 4 ojo sfo] Rn | Rd kokokokojo 1 o0 1| Rm | 


cond 


A1 variant 


QSUB{<c>}{<q>} {<Rd>,} <Rm>, <Rn> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manar onorooo] Rm [titi] R ool Rm | 


T1 variant 


QSUB{<c>}{<q>} {<Rd>,} <Rm>, <Rn> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 
<Rn> Is the second general-purpose source register, encoded in the "Rn" field. 
F5-4436 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(R[d], sat) = SignedSatQ(SInt(R[m]) - SInt(R[n]), 32); 


if sat then 
PSTATE.Q = '1'; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.153 


F5-4438 


QSUB16 


Saturating Subtract 16 performs two 16-bit integer subtractions, saturates the results to the 16-bit signed integer 


range -215 <= x <= 215 - 1, and writes the results to the destination register. 
A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[111 jo 110 ojo 1 of Rn | Ri kool +f] Rm 


cond 


A1 variant 


QSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7o0io e [i177] Rd fojoj Rm 


T1 variant 


QSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = SInt(R[n]<15:@>) - SInt(R[m]<15:0>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


diff2 = SInt(R[n]<31:16>) - SInt(R[m]<31:16>); 
R[d]<15:@> = SignedSat(diff1, 16); 
R[d]<31:16> = SignedSat(diff2, 16); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.154 


F5-4440 


QSUB8 


Saturating Subtract 8 performs four 8-bit integer subtractions, saturates the results to the 8-bit signed integer range 


-27 <= x <= 27- 1, and writes the results to the destination register. 
A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[111 jo 110 ojo t of Rn | Ra Ween] tft] Rm 


cond 


A1 variant 


QSUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto70 oo] Ra jira) Rd fojoj Rm | 


T1 variant 


QSUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diffl = SInt(R[n]<7:@>) - SInt(R[m]<7:@>); 
diff2 = SInt(R[n]<15:8>) - SInt(R[m]<15:8>); 
diff3 = SInt(R[n]<23:16>) - SInt(R[m]<23:16>); 
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diff4 = SInt(R[n]<31:24>) - SInt(R[m]<31:24>); 
R[d]<7:@> = SignedSat(diff1, 8); 
R[d]<15:8> SignedSat(diff2, 8); 
R[d]<23:16> = SignedSat(diff3, 8); 
R[d]<31:24> = SignedSat(diff4, 8); 
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F5.1.155  RBIT 


Reverse Bits reverses the bit order in a 32-bit register. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4|3 0| 

Dem lotto ttt to Re ofo + 7] R 
cond 

A1 variant 


RBIT{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 
d = UInt(Rd); m = UInt(Rm); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0| 


fa7itiototoot em pira) Re oo Rm | 


T1 variant 
RBIT{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); n = UInt(Rn); 
ifm !=n || d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ifm != n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction executes with the additional decode: m = UInt(Rn);. 
. The instruction executes with the additional decode: m = UInt(Rm);. 
: The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
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<Rm> For encoding A1: is the general-purpose source register, encoded in the "Rm" field. 


For encoding T1: is the general-purpose source register, encoded in the "Rm" field. It must be 
encoded with an identical value in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
bits(32) result; 
for i = 0 to 31 
result<31-i> = R[m]<i>; 
R[d] = result; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.156 


F5-4444 


REV 


Byte-Reverse Word reverses the byte order in a 32-bit register. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4|3 0| 

Pen fo 170 tot to] Reso + 7] R 
cond 

A1 variant 


REV{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 12/1110 9 8|7 65 |32 O| 


morar on ojoo] Rm | Ra | 


T1 variant 
REV{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); 
T2 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


Tiit7o0707o07] Ra [i177] Rd [1 0J0 0] Rm | 


T2 variant 


REV{<c>}.W <Rd>, <Rm> // <Rd>, <Rm> can be represented in T1 
REV{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); n = UInt(Rn); 
ifm !=n || d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ifm != n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
e The instruction executes with the additional decode: m = UInt(Rn);. 
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e The instruction executes with the additional decode: m = UInt(Rm);. 
: The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> For encoding A1 and T1: is the general-purpose source register, encoded in the "Rm" field. 


For encoding T2: is the general-purpose source register, encoded in the "Rm" field. It must be 
encoded with an identical value in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
bits(32) result; 
result<31:24> = R[m]<7:>; 
result<23:16> = R[m]<15:8>; 
result<15:8> R[m]<23:16>; 
result<7:0> R[m]<31:24>; 
R[d] = result; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.157 


F5-4446 


REV16 


Byte-Reverse Packed Halfword reverses the byte order in each16-bit halfword of a 32-bit register. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4|3 0| 

Pen foto to to Reso + tT R 
cond 

A1 variant 


REV16{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 65 |32 o0] 


moraro oon] Rm] Ra 


T1 variant 
REV16{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); 
T2 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


T7itiototoot en [171i Re [1 ojo7] Rm | 


T2 variant 


REV16{<c>}.W <Rd>, <Rm> // <Rd>, <Rm> can be represented in T1 
REV16{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); n = UInt(Rn); 
ifm !=n || d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ifm != n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
e The instruction executes with the additional decode: m = UInt(Rn);. 
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e The instruction executes with the additional decode: m = UInt(Rm);. 
: The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> For encoding A1 and T1: is the general-purpose source register, encoded in the "Rm" field. 


For encoding T2: is the general-purpose source register, encoded in the "Rm" field. It must be 
encoded with an identical value in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
bits(32) result; 
result<31:24> = R[m]<23:16>; 
result<23:16> = R[m]<31:24>; 
result<15:8> R[m]<7:Q>; 
result<7:@> = R[m]<15:8>; 
R[d] = result; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.158 


F5-4448 


REVSH 


Byte-Reverse Signed Halfword reverses the byte order in the lower 16-bit halfword of a 32-bit register, and 


sign-extends the result to 32 bits. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4|3 0| 

[1m fo 1 1 0 titty R aaa fo a af Rm | 
cond 

A1 variant 


REVSH{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8|7 65 |32 ol] 


morar oro a] Rm] Ra | 


T1 variant 
REVSH{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); 
T2 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7ojooi Rm pira) Rd opa Rn | 


T2 variant 


REVSH{<c>}.W <Rd>, <Rm> // <Rd>, <Rm> can be represented in T1 
REVSH{<c>}{<q>} <Rd>, <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); n = UInt(Rn); 
ifm !=n || d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ifm != n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
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The instruction executes with the additional decode: m = UInt(Rn);. 
The instruction executes with the additional decode: m = UInt(Rm);. 


The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose destination register, encoded in the "Rd" field. 


For encoding A1 and T1: is the general-purpose source register, encoded in the "Rm" field. 


For encoding T2: is the general-purpose source register, encoded in the "Rm" field. It must be 
encoded with an identical value in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

bits(32) result; 

result<31:8> = SignExtend(R[m]<7:0>, 24); 
result<7:0> R[m]<15:8>; 

R[d] = result; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.159 


F5-4450 


RFE, RFEDA, RFEDB, RFEIA, RFEIB 


Return From Exception loads two consecutive memory locations using an address in a base register: 


° The word loaded from the lower address is treated as an instruction address. The PE branches to it. 
° The word loaded from the higher address is used to restore PSTATE. This word must be in the format of an 
SPSR. 


An address adjusted by the size of the data loaded can optionally be written back to the base register. 


The PE checks the value of the word loaded from the higher address for an illegal return event. See Ilegal return 
events from AArch32 state on page G1-5524. 


RFE is UNDEFINED in Hyp mode and CONSTRAINED UNPREDICTABLE in User mode. 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0| 


[141 1 1 1 0 O[P[UJO]W]4] Rn [0 (0) (0) (0) (4) 0) 0) (0) (0) (0) f0) (0) (0) (0) (0) 


Decrement After variant 
Applies when P == 0 && U == 


RFEDA{<c>}{<q>} <Rn>{!} 


Decrement Before variant 
Applies when P == 1 & U == 0. 


RFEDB{<c>}{<q>} <Rn>{!} 


Increment After variant 
Applies when P == 0 && U = 1. 


RFE{IA}{<c>}{<q>} <Rn>{!} 


Increment Before variant 
Applies when P == 1 & U = 1. 


RFEIB{<c>}{<q>} <Rn>{!} 


Decode for all variants of this encoding 
n = UInt(Rn); 


wback = (W == '1'); increment = (U == '1'); wordhigher = (P == U); 
if n == 15 then UNPREDICTABLE; 


T1 
[15 14 1312/1110 9 8|7 6 5 4|3 0|/15141312/11109 8|7 6 5 4|3 2 1 0| 


[14a 1 1 0 1 0 ofo oļofw]1[ Rn koio ko) (0) (0) (0) (0) (0) (0) (0) (0) (0) (0) (0) (0) (0) 


T1 variant 


RFEDB{<c>}{<q>} <Rn>{!} // Outside or last in IT block 
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Decode for this encoding 
n = UInt(Rn); whack = (W == '1'); increment = FALSE; wordhigher = FALSE; 


if n == 15 then UNPREDICTABLE; 
if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


T2 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |1514 13 121110 9 8|7 6 5 4|3 2 1 0| 


[11 10 1 0 0f4 1[ofw]1[ Rn [oiko (0) (0) (0) (0) (0) (0) (0) (0) (0) (0) (0) (0) (0) 


T2 variant 


RFE{IA}{<c>}{<q>} <Rn>{!} // Outside or last in IT block 


Decode for this encoding 
n = UInt(Rn); wback = (W == '1'); increment = TRUE; wordhigher = FALSE; 


if n == 15 then UNPREDICTABLE; 
if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


IA For encoding A1: is an optional suffix to indicate the Increment After variant. 


For encoding T2: is an optional suffix for the Increment After form. 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. <c> must be AL or omitted. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


! The address adjusted by the size of the data loaded is written back to the base register. If specified, 


it is encoded in the "W" field as 1, otherwise this field defaults to 0. 


RFEFA, RFEEA, RFEFD, and RFEED are pseudo-instructions for RFEDA, RFEDB, RFEIA, and RFEIB respectively, referring to 
their use for popping data from Full Ascending, Empty Ascending, Full Descending, and Empty Descending stacks. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == ELO then 
UNPREDICTABLE; // UNDEFINED or NOP 
else 
address = if increment then R[n] else R[n]-8; 
if wordhigher then address = address+4; 
new_pc_value = MemA[address,4]; 
spsr = MemA[address+4,4]; 
if whack then R[n] = if increment then R[n]+8 else R[n]-8; 
AArch32.ExceptionReturn(new_pc_value, spsr); 
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CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == ELQ, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
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F5.1.160 ROR (immediate) 


ARM DDI 0487E.a 
ID070919 


Rotate Right (immediate) provides the value of the contents of a register rotated by a constant value. The bits that 


are rotated off the right end are inserted into the vacated bit positions on the left. 
This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 
$ The encodings in this description are named to match the encodings of MOV, MOVS (register). 


s The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16/15 12|11 7 6 5 4|3 0| 


EE OOOO Ra | 00000 [1 iJo] Rm _| 


cond S imm5 stype 


MOV, shift or rotate by value variant 
ROR{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 

is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, ROR #<imm> 


and is always the preferred disassembly. 


T3 
|15 14 13 12|1110 9 8|7 6 5 4|3 2 1 0]1514 12/11 8|7 6 5 4|3 0| 
111010 1/0 0 1 ojoj 1 1 1ko] imma | Rd fimm2f1 1| Rm | 
S stype 
MOV, shift or rotate by value variant 
Applies when !(imm3 == 000 && imm2 == QQ). 
ROR{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 
is equivalent to 
MOV{<c>}{<q>} <Rd>, <Rm>, ROR #<imm> 
and is always the preferred disassembly. 
Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 


deprecates using the PC as the destination register, but if the PC is used, the instruction is a branch 
to the address calculated by the operation. This is an interworking branch, see Pseudocode 
description of operations on the AArch32 general-purpose registers and the PC on page E1-3787. 


For encoding T3: is the general-purpose destination register, encoded in the "Rd" field. 


<Rm> For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 


used, but this is deprecated. 


For encoding T3: is the general-purpose source register, encoded in the "Rm" field. 
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<imm> For encoding A1: is the shift amount, in the range 1 to 31, encoded in the "imm5" field. 


For encoding T3: is the shift amount, in the range 1 to 31, encoded in the "imm3:imm2" field. 


Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
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F5.1.161 ROR (register) 
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Rotate Right (register) provides the value of the contents of a register rotated by a variable number of bits. The bits 
that are rotated off the right end are inserted into the vacated bit positions on the left. The variable number of bits is 
read from the bottom byte of a register 


This instruction is an alias of the MOV, MOVS (register-shifted register) instruction. This means that: 


s The encodings in this description are named to match the encodings of MOV, MOVS (register-shifted 
register). 


° The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this 
instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12|11 8/7 6 5 4|3 0 | 


[m1 Jooo 4 1jo foomo] Ra | rs Joji iji] Rm | 


cond S stype 


Not flag setting variant 
ROR{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, ROR <Rs> 


and is always the preferred disassembly. 


T1 
151413 12/11109 | 65 |32 0l] 
0100000111] Rs | Rim | 


op 


Rotate right variant 

ROR<c>{<q>} {<Rdm>,} <Rdm>, <Rs> // Inside IT block 
is equivalent to 

MOV<c>{<q>} <Rdm>, <Rdm>, ROR <Rs> 


and is the preferred disassembly when InITBlock(). 


T2 
|15 14 13 121110 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 
111770170 0{1 ılo] Rm [1111] Ra [ooo o}] Rs | 


stype S 


Not flag setting variant 
ROR<c>.W {<Rd>,} <Rm>, <Rs> // Inside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in T1 
is equivalent to 


MOV{<c>}{<q>} <Rd>, <Rm>, ROR <Rs> 
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and is always the preferred disassembly. 
ROR{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 

is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, ROR <Rs> 


and is always the preferred disassembly. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdm> Is the first general-purpose source register and the destination register, encoded in the "Rdm" field. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 

<Rs> Is the second general-purpose source register holding a rotate amount in its bottom 8 bits, encoded 


in the "Rs" field. 


Operation for all encodings 


The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this instruction. 
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F5.1.162 RORS (immediate) 


ARM DDI 0487E.a 
ID070919 


Rotate Right, setting flags (immediate) provides the value of the contents of a register rotated by a constant value. 
The bits that are rotated off the right end are inserted into the vacated bit positions on the left. 


If the destination register is not the PC, this instruction updates the condition flags based on the result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


e The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


$ The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from AArch32 
state on page G1-5524. 


e The instruction is UNDEFINED in Hyp mode. 

° The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 

This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 

s The encodings in this description are named to match the encodings of MOV, MOVS (register). 


s The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|11 7 6 5 4]3 0 | 
1111 [oo 01 1o 1o] Ra | '=00000 [1 1o] Rm | 
cond S imm5 stype 
MOVS, shift or rotate by value variant 
RORS{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 
is equivalent to 
MOVS{<c>}{<q>} <Rd>, <Rm>, ROR #<imm> 
and is always the preferred disassembly. 
T3 
|15 14 13 12|11 10 9 8/7 6 5 4/3 2 1 0/1514 12/11 8/7 6 5 4|3 0 | 
Ti 40107007 0]1]1 O mms Ra [mma] 7] Rm _| 
S stype 
MOVS, shift or rotate by value variant 
Applies when !(imm3 == 000 && imm2 == QQ). 
RORS{<c>}{<q>} {<Rd>,} <Rm>, #<imm> 
is equivalent to 
MOVS{<c>}{<q>} <Rd>, <Rm>, ROR #<imm> 
and is always the preferred disassembly. 
Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 


<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 
deprecates using the PC as the destination register, but if the PC is used, the instruction performs an 
exception return, that restores PSTATE from SPSR_<current_mode>. 


For encoding T3: is the general-purpose destination register, encoded in the "Rd" field. 


<Rm> For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 
used, but this is deprecated. 


For encoding T3: is the general-purpose source register, encoded in the "Rm" field. 


<imm> For encoding A1: is the shift amount, in the range 1 to 31, encoded in the "imm5" field. 


For encoding T3: is the shift amount, in the range 1 to 31, encoded in the "imm3:imm2" field. 


Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
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F5.1.163  RORS (register) 


ARM DDI 0487E.a 
ID070919 


Rotate Right, setting flags (register) provides the value of the contents of a register rotated by a variable number of 
bits, and updates the condition flags based on the result. The bits that are rotated off the right end are inserted into 
the vacated bit positions on the left. The variable number of bits is read from the bottom byte of a register 


This instruction is an alias of the MOV, MOVS (register-shifted register) instruction. This means that: 


s The encodings in this description are named to match the encodings of MOV, MOVS (register-shifted 
register). 


° The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this 
instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12|11 8/7 6 5 4|3 0 | 


[m1 fo oo 4 1fo 1] ify oo Ra | rs Joji iji] Rm | 
S 


cond stype 


Flag setting variant 
RORS{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 
is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, ROR <Rs> 


and is always the preferred disassembly. 
T1 


15141312411109 | 65 132 ol] 


oroo oojo 111] Rs | Ram 


op 


Rotate right variant 

RORS{<q>} {<Rdm>,} <Rdm>, <Rs> // Outside IT block 
is equivalent to 

MOVS{<q>} <Rdm>, <Rdm>, ROR <Rs> 


and is the preferred disassembly when !InITBlock(). 
T2 


|15 14 13 121110 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


1171717070 0/1 aji] Rm [1171] Rd [ooo o}] Rs | 


stype S 


Flag setting variant 
RORS.W {<Rd>,} <Rm>, <Rs> // Outside IT block, and <Rd>, <Rm>, <shift>, <Rs> can be represented in T1 
is equivalent to 


MOVS{<c>}{<q>} <Rd>, <Rm>, ROR <Rs> 
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and is always the preferred disassembly. 
RORS{<c>}{<q>} {<Rd>,} <Rm>, <Rs> 

is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, ROR <Rs> 


and is always the preferred disassembly. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdm> Is the first general-purpose source register and the destination register, encoded in the "Rdm" field. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the first general-purpose source register, encoded in the "Rm" field. 

<Rs> Is the second general-purpose source register holding a rotate amount in its bottom 8 bits, encoded 


in the "Rs" field. 


Operation for all encodings 


The description of MOV, MOVS (register-shifted register) gives the operational pseudocode for this instruction. 
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Rotate Right with Extend provides the value of the contents of a register shifted right by one place, with the Carry 


flag shifted into bit[31]. 
This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 
g The encodings in this description are named to match the encodings of MOV, MOVS (register). 


s The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 


A1 
ce sol aaa 20/19 18 17 16|15 12|11 7 65 4|3 0| 
m [oo 0 1 eboo Ra Joo oo oa an] 


ani imm5 stype 


MOV, rotate right with extend variant 
RRX{<c>}{<q>} {<Rd>,} <Rm> 

is equivalent to 

MOV{<c>}{<q>} <Rd>, <Rm>, RRX 


and is always the preferred disassembly. 


T3 
|15 14 13 12|11 10 9 e ae 12111 aa 0| 
111010 soos ofoji 14 ifoyo oof Rd fooi Rm | 
imm3 imm2 T 
MOV, rotate right with extend variant 
RRX{<c>}{<q>} {<Rd>,} <Rm> 
is equivalent to 
MOV{<c>}{<q>} <Rd>, <Rm>, RRX 
and is always the preferred disassembly. 
Assembler symbols 
<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 


deprecates using the PC as the destination register, but if the PC is used, the instruction is a branch 
to the address calculated by the operation. This is an interworking branch, see Pseudocode 
description of operations on the AArch32 general-purpose registers and the PC on page E1-3787. 


For encoding T3: is the general-purpose destination register, encoded in the "Rd" field. 


<Rm> For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 


used, but this is deprecated. 


For encoding T3: is the general-purpose source register, encoded in the "Rm" field. 
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Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
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F5.1.165 RRXS 


ARM DDI 0487E.a 
ID070919 


Rotate Right with Extend, setting flags provides the value of the contents of a register shifted right by one place, 
with the Carry flag shifted into bit[31]. 


If the destination register is not the PC, this instruction updates the condition flags based on the result, and bit[0] is 
shifted into the Carry flag. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. Arm 
deprecates any use of these encodings. However, when the destination register is the PC: 


° The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


s The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from AArch32 
state on page G1-5524. 


e The instruction is UNDEFINED in Hyp mode. 

° The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 

This instruction is an alias of the MOV, MOVS (register) instruction. This means that: 

è The encodings in this description are named to match the encodings of MOV, MOVS (register). 


° The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 


A1 


i aeo 20|19 18 17 16|15 12\11 |7 6 5 4|3 0 | 


[eri [oo oy pho “Ra Joo oo oft ao] im | 


oid imm5 stype 


MOVS, rotate right with extend variant 
RRXS{<c>}{<q>} {<Rd>,} <Rm> 

is equivalent to 

MOVS{<c>}{<q>} <Rd>, <Rm>, RRX 


and is always the preferred disassembly. 


T3 

|15 14 13 12/11 10 9 ste eee one 12\11 sia ee 0 | 

Daroro oor ofifi ts ifoyo oof Rd fooi Rm | 
imm3 imm2 swe 
MOVS, rotate right with extend variant 
RRXS{<c>}{<q>} {<Rd>,} <Rm> 
is equivalent to 
MOVS{<c>}{<q>} <Rd>, <Rm>, RRX 
and is always the preferred disassembly. 
Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 


<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. Arm 
deprecates using the PC as the destination register, but if the PC is used, the instruction performs an 
exception return, that restores PSTATE from SPSR_<current_mode>. 


For encoding T3: is the general-purpose destination register, encoded in the "Rd" field. 


<Rm> For encoding A1: is the general-purpose source register, encoded in the "Rm" field. The PC can be 
used, but this is deprecated. 


For encoding T3: is the general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


The description of MOV, MOVS (register) gives the operational pseudocode for this instruction. 
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F5.1.166 RSB, RSBS (immediate) 


Reverse Subtract (immediate) subtracts a register value from an immediate value, and writes the result to the 
destination register. 


If the destination register is not the PC, the RSBS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 
deprecates any use of these encodings. However, when the destination register is the PC: 


s The RSB variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

è The RSBS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

31 28|27 26 25 24|23 22 21 20|19 1615 1211 | | 0 | 
1111 Jo o 1 ofo 1 ijs] Rn | Ra [| immi2_— | 
cond 

RSB variant 


Applies when S == 0. 

RSB{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
RSBS variant 

Applies when S = 1. 

RSBS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = A32ExpandImm(imm12) ; 
T1 


|15 14 13 1211110 9 8|7 65 |32 ol] 


[o 10000100 1| Rn | Ra | 


T1 variant 


RSB<c>{<q>} {<Rd>, }<Rn>, #0 // Inside IT block 
RSBS{<q>} {<Rd>, }<Rn>, #0 // Outside IT block 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = !InITBlock(); imm32 = Zeros(32); // immediate = #0 
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T2 


|15 14 13 12|11109 8|7 6 5 4|3 0\1514 12\11 8|7 | 0 | 


771 of [oli 17 os] eno] mma] Ra | me 


RSB variant 


Applies when S == 0. 


RSB<c>.W {<Rd>,} <Rn>, #0 // Inside IT block 
RSB{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


RSBS variant 


Applies when S = 1. 


RSBS.W {<Rd>,} <Rn>, #0 // Outside IT block 
RSBS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


d = UInt(Rd); 


n = UInt(Rn); setflags = (S == '1'); imm32 = T32ExpandImm(i:imm3:imm8) ; 


if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 
° For the RSB variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 
. For the RSBS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 
For encoding T1 and T2: is the general-purpose destination register, encoded in the "Rd" field. If 
omitted, this register is the same as <Rn>. 
<Rn> For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 
For encoding T1 and T2: is the general-purpose source register, encoded in the "Rn" field. 
<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 
For encoding T2: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(NOT(R[n]), imm32, '1'); 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.167 RSB, RSBS (register) 


Reverse Subtract (register) subtracts a register value from an optionally-shifted register value, and writes the result 


to the destination register. 


If the destination register is not the PC, the RSBS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 


deprecates any use of these encodings. However, when the destination register is the PC: 


s The RSB variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The RSBS variant of the instruction performs an exception return without the use of the stack. In this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 


7 6 5 4|3 


o | 


| fit jo oo ofo 1 1js| Rn | Ra | imm5  [styejo] Rm | 


cond 


RSB, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


RSB{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


RSB, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 


RSB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


RSBS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


RSBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


RSBS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


RSBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); n 


= UInt(Rn); m = UInt(Rm); setflags 
(shift t, shift_n) = 


DecodeImmShift(stype, imm5); 
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T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0\1514  12|11 8|7 6 5 4|3 0 | 


770707 17 0S] Rn [OL mms | Ra [imma]sype] Rm | 


RSB, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


RSB{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


RSB, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


RSB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


RSBS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && imm2 == 00 && stype == 11. 


RSBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


RSBS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11). 

RSBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 

Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 
° For the RSB variant, the instruction is a branch to the address calculated by the operation. 


This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


$ For the RSBS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 

<Rn> For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used, but this is deprecated. 


For encoding T1: is the first general-purpose source register, encoded in the "Rn" field. 
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F5-4470 


<Rm> 


For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 


For encoding T1: is the second general-purpose source register, encoded in the "Rm" field. 


<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 


have the following values: 

LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(NOT(R[n]), shifted, '1'); 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.168 RSB, RSBS (register-shifted register) 


Reverse Subtract (register-shifted register) subtracts a register value from a register-shifted register value, and 
writes the result to the destination register. It can optionally update the condition flags based on the result. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 8|7 6 5 4|3 0 | 
| i111 [o o o ofo 1 1js| Rn | Ra | Rs ([O|stype[1] Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


RSBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


RSB{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype); 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(NOT(R[n]), shifted, '1'); 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F5.1.169 RSC, RSCS (immediate) 


Reverse Subtract with Carry (immediate) subtracts a register value and the value of NOT (Carry flag) from an 
immediate value, and writes the result to the destination register. 


If the destination register is not the PC, the RSCS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 
deprecates any use of these encodings. However, when the destination register is the PC: 


s The RSC variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 


è The RSCS variant of the instruction performs an exception return without the use of the stack. In this case: 


The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


The PE checks SPSR_<current_mode> for an illegal return event. See J//egal return events from 
AArch32 state on page G1-5524. 


The instruction is UNDEFINED in Hyp mode. 


The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

31 28|27 26 25 24|23 22 21 20|19 1615 1211 0 | 
121111 Jo o 1 0/1 1 afs] Rn | Ra [| immi2_— | 
cond 

RSC variant 


Applies when S == 0. 


RSC{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


RSCS variant 


Applies when S = 1. 


RSCS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = A32ExpandImm(imm12) ; 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


ARM DDI 0487E.a 
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See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose destination register, encoded in the "Rd" field. If omitted, this register is the 
same as <Rn>. Arm deprecates using the PC as the destination register, but if the PC is used: 


° For the RSC variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


For the RSCS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


Is the general-purpose source register, encoded in the "Rn" field. The PC can be used, but this is 
deprecated. 
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<const> Animmediate value. See Modified immediate constants in A32 instructions on page F2-3924 for the 


range of values. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(NOT(R[n]), imm32, PSTATE.C); 
if d == 15 then 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.170 RSC, RSCS (register) 


ARM DDI 0487E.a 
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Reverse Subtract with Carry (register) subtracts a register value and the value of NOT (Carry flag) from an 


optionally-shifted register value, and writes the result to the destination register. 


If the destination register is not the PC, the RSCS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 


deprecates any use of these encodings. However, when the destination register is the PC: 


s The RSC variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The RSCS variant of the instruction performs an exception return without the use of the stack. In this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 7 6 5 4|3 


[111 jo oo oļi 1 1js| Rn | Ra | immS _|stypefo] Rm | 


cond 


RSC, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


RSC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


RSC, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 
RSC{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 
RSCS, rotate right with extend variant 
Applies when S == 1 & imm5 == 00000 && stype == 11. 
RSCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 
RSCS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 
RSCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 

Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
Assembler symbols 

<c> See Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


<Rd> Is the general-purpose destination register, encoded in the "Rd" field. If omitted, this register is the 
same as <Rn>. Arm deprecates using the PC as the destination register, but if the PC is used: 
d For the RSC variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 
. For the RSCS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. The PC can be used, but this 
is deprecated. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. The PC can be used, but 
this is deprecated. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> Is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 (when <shift> = 
LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 
Operation 


if ConditionPassed() then 


EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(NOT(R[n]), shifted, PSTATE.C); 
if d == 15 then 
if setflags then 
ALUExceptionReturn(result); 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


F5-4476 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
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F5.1.171 RSC, RSCS (register-shifted register) 


ARM DDI 0487E.a 
ID070919 


Reverse Subtract (register-shifted register) subtracts a register value and the value of NOT (Carry flag) from a 
register-shifted register value, and writes the result to the destination register. It can optionally update the condition 
flags based on the result. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 
| !'=1111 fo o o oļ1 14 js] Rn | Ra | Rs [o]styeeļi| Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


RSCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


RSC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype) ; 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 
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Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(NOT(R[n]), shifted, PSTATE.C); 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F5.1.172 SADD16 
Signed Add 16 performs two 16-bit signed integer additions, and writes the results to the destination register. It sets 
PSTATE.GE according to the results of the additions. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


| tei fo 1 to ojo ot] Rao | RA kiolo ofi] Rm | 


cond 


A1 variant 


SADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7ooo Ra [i177] Rd o]ojofo] Rm | 


T1 variant 


SADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum1 = SInt(R[n]<15:@>) + SInt(R[m]<15:0>); 
sum2 = SInt(R[n]<31:16>) + SInt(R[m]<31:16>) ; 
R[d]<15:@> = sum1<15:0>; 
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R[d]<31:16> = sum2<15:0>; 
PSTATE.GE<1:0> = if suml >= @ then '11' else '00'; 
PSTATE.GE<3:2> = if sum2 >= @ then '11' else '00'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.173 SADD8 
Signed Add 8 performs four 8-bit signed integer additions, and writes the results to the destination register. It sets 
PSTATE.GE according to the results of the additions. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


| tei fo 1 to ojo ot] Rao | Ri fafa tfo oft] Rm | 


cond 


A1 variant 


SADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiit7o0707000] Ra [i147] Rd o]ojofo] Rm | 


T1 variant 


SADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
suml = SInt(R[n]<7:0>) + SInt(R[m]<7:0>); 
sum2 = SInt(R[n]<15:8>) + SInt(R[m]<15:8>); 
sum3 = SInt(R[n]<23:16>) + SInt(R[m]<23:16>); 
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F5-4482 


sum4 = SInt(R[n]<31:24>) + SInt(R[m]<31:24>); 


R[d]<7:0> 
R[d]<15:8> 
R[d]<23:16> 
R[d]<31:24> 
PSTATE.GE<0> 
PSTATE.GE<1> 
PSTATE.GE<2> 
PSTATE.GE<3> 


sum1<7 :0>; 
sum2<7:0>; 
sum3<7:0>; 
sum4<7 :0>; 
= if suml >= @ then '1' else 'Q'; 
= if sum2 >= @ then '1' else 'Q'; 
= if sum3 >= @ then '1' else 'Q'; 
if sum4 >= 0 then '1' else 'Q'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 


or destination: 


è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F5.1.174 SASX 
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ID070919 


Signed Add and Subtract with Exchange exchanges the two halfwords of the second operand, performs one 16-bit 
integer addition and one 16-bit subtraction, and writes the results to the destination register. It sets PSTATE.GE 
according to the results. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[m1 jo 110 ojo oat Rn | Ra Waarfofo fi] Rm | 


cond 


A1 variant 


SASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manan ononono] en [111%] R ojojojo] Rm | 


T1 variant 


SASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff = SInt(R[n]<15:@>) - SInt(R[m]<31:16>); 
sum = SInt(R[n]<31:16>) + SInt(R[m]<15:0>); 
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R[d]<15:@> = diff<15:@>; 
R[d]<31:16> = sum<15:@>; 
PSTATE.GE<1:0> = if diff >= @ then '11' else '00'; 
PSTATE.GE<3:2> = if sum >= Q then '11' else '00'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
: The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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Speculation Barrier is a barrier that controls speculation. 


The semantics of the Speculation Barrier are that the execution, until the barrier completes, of any instruction that 
appears later in the program order than the barrier: 


. Cannot be performed speculatively to the extent that such speculation can be observed through side-channels 
as a result of control flow speculation or data value speculation. 


à Can be speculatively executed as a result of predicting that a potentially exception generating instruction has 
not generated an exception. 


In particular, any instruction that appears later in the program order than the barrier cannot cause a speculative 
allocation into any caching structure where the allocation of that entry could be indicative of any data value present 
in memory or in the registers. 


The SB instruction: 
° Cannot be speculatively executed as a result of control flow speculation or data value speculation. 


` Can be speculatively executed as a result of predicting that a potentially exception generating instruction has 
not generated an exception. The potentially exception generating instruction can complete once it is known 
not to be speculative, and all data values generated by instructions appearing in program order before the SB 
instruction have their predicted values confirmed. 


When the prediction of the instruction stream is not informed by data taken from the register outputs of the 
speculative execution of instructions appearing in program order after an uncompleted SB instruction, the SB 
instruction has no effect on the use of prediction resources to predict the instruction stream that is being fetched. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4/3 2 1 0| 


11110101011 ALANA AAAAOFOMOFO] o a 1 1 ko 0 00 


A1 variant 


SB{<q>} 


Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 2 1 0| 


tt tot 1 ot tat o koo ookko a 1 1 (0) 0) 0) 0) 





T1 variant 


SB{<q>} 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 
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Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
SpeculationBarrier(); 
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F5.1.176 SBC, SBCS (immediate) 


Subtract with Carry (immediate) subtracts an immediate value and the value of NOT (Carry flag) from a register 
value, and writes the result to the destination register. 


If the destination register is not the PC, the SBCS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 
deprecates any use of these encodings. However, when the destination register is the PC: 


s The SBC variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

è The SBCS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

31 28|27 26 25 24|23 22 21 20|19 1615 1211 | | 0 | 
1111 Jo o 10/1 1 ofjs| Rn | Ra | _— č mm2  žăě | 
cond 

SBC variant 


Applies when S == 0. 


SBC{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


SBCS variant 
Applies when S = 1. 


SBCS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = A32ExpandImm(imm12) ; 
T1 


[15 14 13 121110 9 8|7 6 5 4|3 01514 12\11 8|7 | 0| 


11 1 1 o0ļifofa o 1 sts} Rn [o| imm3| Ra | imma | 


SBC variant 

Applies when S == 0. 

SBC{<c>}{<q>} {<Rd>,} <Rn>, #<const> 
SBCS variant 


Applies when S == 1. 
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F5-4488 


SBCS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = T32ExpandImm(i:imm3: imm8) ; 
if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 
° For the SBC variant, the instruction is a branch to the address calculated by the operation. 


This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


s For the SBCS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 


<Rn> For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 


For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 


<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(R[n], NOT(imm32), PSTATE.C); 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.177 SBC, SBCS (register) 


Subtract with Carry (register) subtracts an optionally-shifted register value and the value of NOT (Carry flag) from 


a register value, and writes the result to the destination register. 


If the destination register is not the PC, the SBCS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. ARM 


deprecates any use of these encodings. However, when the destination register is the PC: 


s The SBC variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The SBCS variant of the instruction performs an exception return without the use of the stack. In this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 


7 6 5 4|3 


o | 


| fit jo oo oj 1 ojs| Rn | Ra | immS  [styeejo] Rm | 


cond 


SBC, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


SBC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


SBC, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 


SBC{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


SBCS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


SBCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


SBCS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


SBCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
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T1 


|15 14 13 121110 9 8|7 65 |32 0| 


T1 variant 


SBC<c>{<q>} {<Rdn>,} <Rdn>, <Rm> // Inside IT block 
SBCS{<q>} {<Rdn>,} <Rdn>, <Rm> // Outside IT block 


Decode for this encoding 
d = UInt(Rdn); n = UInt(Rdn); m = UInt(Rm); setflags = !InITBlock(); 
(shift t, shift n) = (SRType_LSL, 0); 


T2 


[15 14 13 1211110 9 8|7 6 5 4|3 01514  12|11 8|7 6 5 4|3 0| 


1110101101 1js| Rn [of imm3 | Ra _ |imm2|stye| Rm | 


SBC, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


SBC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


SBC, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


SBC<c>.W {<Rd>,} <Rn>, <Rm> // Inside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
SBC{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


SBCS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && imm2 == 00 && stype == 11. 


SBCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


SBCS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11). 


SBCS.W {<Rd>,} <Rn>, <Rm> // Outside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
SBCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 


(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 
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Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rdn> Is the first general-purpose source register and the destination register, encoded in the "Rdn" field. 
<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 
° For the SBC variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 
. For the SBCS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 
For encoding T2: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. 
<Rn> For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used, but this is deprecated. 
For encoding T2: is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 
For encoding T1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "Iimm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], NOT(shifted), PSTATE.C); 
if d == 15 then // Can only occur for A32 encoding 


if setflags then 
ALUExceptionReturn(result) ; 

else 
ALUWritePC(result) ; 

else 

R[d] = result; 

if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 
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Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.178 


F5-4494 


SBC, SBCS (register-shifted register) 


Subtract with Carry (register-shifted register) subtracts a register-shifted register value and the value of NOT (Carry 
flag) from a register value, and writes the result to the destination register. It can optionally update the condition 
flags based on the result. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 
| !'=1111 fo o o oļi 1 ofs{ Rn | Ra | Rs Jofstype] 1] Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


SBCS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


SBC{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype) ; 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 
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Operation 


if ConditionPassed() then 


EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], NOT(shifted), PSTATE.C); 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F5.1.179 


F5-4496 


SBFX 


Signed Bit Field Extract extracts any number of adjacent bits at any position from a register, sign-extends them to 
32 bits, and writes the result to the destination register. 


A1 


31 28|27 26 25 24|23 22 21 20| 16/15 12\11 7 6 5 4|3 0| 


[1mm fo 1 11 1jojij widthmt | Rd | ib [101| R | 


cond 


A1 variant 


SBFX{<c>}{<q>} <Rd>, <Rn>, #<lsb>, #<width> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); 


Isbit = UInt(1sb); widthminus1 = UInt(widthm1); 
if d == 15 || n == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0\1514  12|11 8|7 6 54| 0| 


maaa oo ooo] on [oy mms | Ra [immaloy_wiethmt 





T1 variant 


SBFX{<c>}{<q>} <Rd>, <Rn>, #<lsb>, #<width> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); 

Isbit = UInt(imm3:imm2); widthminus1 = UInt(widthm1); 

if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the general-purpose source register, encoded in the "Rn" field. 

<lsb> For encoding A1: is the bit number of the least significant bit in the field, in the range 0 to 31, 


encoded in the "Isb" field. 


For encoding T1: is the bit number of the least significant bit in the field, in the range 0 to 31, 
encoded in the "imm3:imm2" field. 


<width> Is the width of the field, in the range 1 to 32-<Isb>, encoded in the "widthm1" field as <width>-1. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
msbit = Isbit + widthminus1; 
if msbit <= 31 then 
R[d] = SignExtend(R[n]<msbit:lsbit>, 32); 
else 
UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If msbit > 31, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
s The value in the destination register is UNKNOWN. 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.180 SDIV 


Signed Divide divides a 32-bit signed integer register value by a 32-bit signed integer register value, and writes the 
result to the destination register. The condition flags are not affected. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 8/7 6 5 4|3 0 | 


i111 fo 1114 0f0 0 1] Ra [WMA] Rm foo ft] R | 
cond Ra 

A1 variant 

SDIV{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 

Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 
if d == 15 || n == 15 || m == 15 || a != 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


IfRa != '1111', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
s The instruction executes as described, with no change to its behavior and no additional side effects. 
. The instruction executes as described, and the register specified by Ra becomes UNKNOWN. 
T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12111 8|7 6 5 4|3 0| 


Titi to11 sooty Rm Oon ra rn Rm | 
Ra 


T1 variant 


SDIV{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 
if d == 15 || n == 15 || m == 15 || a != 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


IfRa != '1111', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The instruction executes as described, with no change to its behavior and no additional side effects. 
: The instruction executes as described, and the register specified by Ra becomes UNKNOWN. 
F5-4498 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register holding the dividend, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register holding the divisor, encoded in the "Rm" field. 
Overflow 


If the signed integer division 0x80000000 / 0xFFFFFFFF is performed, the pseudocode produces the intermediate 
integer result +231, that overflows the 32-bit signed integer range. No indication of this overflow case is produced, 
and the 32-bit result written to <Rd> must be the bottom 32 bits of the binary representation of +231. So the result of 
the division is 0x80000000. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if SInt(R[m]) == @ then 
result = Q; 
else 
result = RoundTowardsZero(Real(SInt(R[n])) / Real(SInt(R[m]))); 
R[d] = result<31:0>; 
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F5.1.181 


F5-4500 


SEL 


Select Bytes selects each byte of its result from either its first operand or its second operand, according to the values 


of the PSTATE.GE flags. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16115 12|1110 9 8|7 6 5 4|3 0| 
Fit fo 110700 0] Rn | Ra kK o 1 1| Rm | 
cond 

A1 variant 


SEL{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiit70707010| Ra [i177] Rd ojoo) Rm | 


T1 variant 


SEL{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
R[d]<7:@> = if PSTATE.GE<@> == '1' then R[n]<7:0> else R[m]<7:0>; 
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R[d]<15:8> if PSTATE.GE<1> == '1' then R[n]<15:8> else R[m]<15:8>; 
R[d]<23:16> = if PSTATE.GE<2> == '1' then R[n]<23:16> else R[m]<23:16>; 
R[d]<31:24> = if PSTATE.GE<3> == '1' then R[n]<31:24> else R[m]<31:24>; 
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F5.1.182 SETEND 


Set Endianness writes a new value to PSTATE.E. 
A1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/1110 9 8/7 6 5 4/3 21 0| 


111100010 0 0 okoko] [(0)](0)](0)](0)|(0)](0)] E (0)} 0 | 0} Of 0 (0) (0) (0) (0) 


A1 variant 


SETEND{<q>} <endian_specifier> // Cannot be conditional 


Decode for this encoding 


set_bigend = (E == '1'); 
T1 


|15 14 13 1211110 9 8|7 6 5 4|3 2 1 0| 


10110110 0 1ļokE ko 00 


T1 variant 


SETEND{<q>} <endian_specifier> // Not permitted in IT block 


Decode for this encoding 
set_bigend = (E == '1'); 
if InITBlock() then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 


<endian_specifier> Is the endianness to be selected, and the value to be set in PSTATE.E, encoded in the "E" field. 
It can have the following values: 
LE when E = 0 


BE when E = 1 


Operation for all encodings 


EncodingSpecificOperations(); 
AArch32 .CheckSETENDEnabled(); 
PSTATE.E = if set_bigend then '1' else '0'; 
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F5.1.183 SETPAN 
Set Privileged Access Never writes a new value to PSTATE.PAN. 


This instruction is available only in privileged mode and it is a NOP when executed in User mode. 


A1 


ARMv8.1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8/7 6 5 4|3 2 14 0| 





111000100 0 1ko] [o_o 0 0 okoko 
fe imm1 


A1 variant 


SETPAN{<q>} #<imm> // Cannot be conditional 


Decode for this encoding 

if !HavePANExt() then UNDEFINED; 
value = imm1; 

T1 

ARMVv8.1 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0| 


m o110110 0 0 oft) okoko 
L imm1 


T1 variant 

SETPAN{<q>} #<imm> // Not permitted in IT block 
Decode for this encoding 

if InITBlock() then UNPREDICTABLE; 

if !HavePANExt() then UNDEFINED; 

value = imm1; 

Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 


<imm> Is the unsigned immediate 0 or 1, encoded in the "imm1" field. 


Operation for all encodings 


EncodingSpeci ficOperations(); 
if PSTATE.EL != ELO then 
PSTATE.PAN = value; 
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F5.1.184 


F5-4504 


SEV 


Send Event is a hint instruction. It causes an event to be signaled to all PEs in the multiprocessor system. For more 


information, see Wait For Event and Send Event on page G1-5562. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|1110 9 8|7 6 5 4|3 2 1 0| 


[=m |oo 11 0oļojı ofo ojo oft kooo o 0 0 0 100 


cond 


A1 variant 
SEV{<c>}{<q>} 
Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0| 


TOT11177/0100)0000] 


T1 variant 
SEV{<c>}{<q>} 
Decode for this encoding 


// No additional decoding required 


T2 


|15 14 1312/1110 9 8/7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 21 0| 


TiT7TOOT1 101 MMMM ofofofofo o ojo oo ofo10 0] 


T2 variant 


SEV{<c>}.W 


Decode for this encoding 


// No additional decoding required 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
SendEvent(); 
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F5.1.185 


F5-4506 


SEVL 


Send Event Local is a hint instruction that causes an event to be signaled locally without requiring the event to be 
signaled to other PEs in the multiprocessor system. It can prime a wait-loop which starts with a WFE instruction. 


A1 


31 28|27 26 25 24/23 22 21 20/19 18 17 16/15 14 13 12/1110 9 8/7 6 5 4/3 2 1 0| 


[=m |oo 11 ofof1 ofo ojo okD ooo 0 OOO 101 


cond 


A1 variant 
SEVL{<c>}{<q>} 
Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0| 


TOTt1177010 10000] 


T1 variant 
SEVL{<c>}{<q>} 
Decode for this encoding 


// No additional decoding required 


T2 


|15 14 1312/1110 9 8/7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 21 0| 


Tit 7TOOT1 101 OM ofofofoyo o ojo oo ofo107| 


T2 variant 


SEVL{<c>}.W 


Decode for this encoding 


// No additional decoding required 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
SendEventLocal(); 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.186 


F5-4508 


SHADD16 


Signed Halving Add 16 performs two signed 16-bit integer additions, halves the results, and writes the results to the 


destination register. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[1mm fo 1 100jo11| Rn | RA kiolo ofi] Rm | 


cond 


A1 variant 


SHADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiit7o7ooo Ra [iii] Rd o]olijo] om 


T1 variant 


SHADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
suml = SInt(R[n]<15:0>) + SInt(R[m]<15:0>); 
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sum2 = SInt(R[n]<31:16>) + SInt(R[m]<31:16>) ; 
R[d]<15:@> = suml<16:1>; 
R[d]<31:16> = sum2<16:1>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.187 


F5-4510 


SHADD8 


Signed Halving Add 8 performs four signed 8-bit integer additions, halves the results, and writes the results to the 


destination register. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[=m fo 1 to ojo rt] Rn | Ri fain sto ofi] Rm | 


cond 


A1 variant 


SHADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7oooo| Ra jira) Rd Jooo] Rm | 


T1 variant 


SHADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
suml = SInt(R[n]<7:0>) + SInt(R[m]<7:0>); 
sum2 = SInt(R[n]<15:8>) + SInt(R[m]<15:8>); 
sum3 = SInt(R[n]<23:16>) + SInt(R[m]<23:16>); 
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sum4 = SInt(R[n]<31:24>) + SInt(R[m]<31:24>); 
R[d]<7:@> = suml<8:1>; 
R[d]<15:8> = sum2<8:1>; 
R[d]<23:16> = sum3<8:1>; 
R[d]<31:24> = sum4<8:1>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.188 


F5-4512 


SHASX 


Signed Halving Add and Subtract with Exchange exchanges the two halfwords of the second operand, performs one 
signed 16-bit integer addition and one signed 16-bit subtraction, halves the results, and writes the results to the 


destination register. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[m1 jo 11 o ojo taf Rn | Ra kooo fi] Rm | 


cond 


A1 variant 


SHASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manar onroron o] en [1111] Re oojo] Rm 


T1 variant 


SHASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff = SInt(R[n]<15:@>) - SInt(R[m]<31:16>); 
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sum = SInt(R[n]<31:16>) + SInt(R[m]<15:0>); 
R[d]<15:@> = diff<16:1>; 
R[d]<31:16> = sum<16:1>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.189 


F5-4514 


SHSAX 


Signed Halving Subtract and Add with Exchange exchanges the two halfwords of the second operand, performs one 
signed 16-bit integer subtraction and one signed 16-bit addition, halves the results, and writes the results to the 


destination register. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


[m1 jot 1o ojo taf Rn | Rai kooo] ofi] Rm | 


cond 


A1 variant 


SHSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


marar onrorn ao] e [1717] e oojo] Rm 


T1 variant 


SHSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum = SInt(R[n]<15:@>) + SInt(R[m]<31:16>); 
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diff = SInt(R[n]<31:16>) - SInt(R[m]<15:@>); 
R[d]<15:@> = sum<16:1>; 
R[d]<31:16> = diff<16:1>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.190 


F5-4516 


SHSUB16 


Signed Halving Subtract 16 performs two signed 16-bit integer subtractions, halves the results, and writes the results 


to the destination register. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


pte fo 1 100jo11| Rn | Ri kooli fi] Rm 


cond 


A1 variant 


SHSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7oio Ra oira) Rd Jooj] om 


T1 variant 


SHSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diffl = SInt(R[n]<15:@>) - SInt(R[m]<15:0>); 
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diff2 = SInt(R[n]<31:16>) - SInt(R[m]<31:16>); 
R[d]<15:@> = diff1<16:1>; 
R[d]<31:16> = diff2<16:1; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.191 


F5-4518 


SHSUB8 


Signed Halving Subtract 8 performs four signed 8-bit integer subtractions, halves the results, and writes the results 


to the destination register. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


pte fo 1 100jo11| Rao | RA faint fi] Rm 


cond 


A1 variant 


SHSUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto70ioo| Ra ira) Rd o]o]ijo] om 


T1 variant 


SHSUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = SInt(R[n]<7:@>) - SInt(R[m]<7:0>); 
diff2 = SInt(R[n]<15:8>) - SInt(R[m]<15:8>); 
diff3 = SInt(R[n]<23:16>) - SInt(R[m]<23:16>); 
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diff4 = SInt(R[n]<31:24>) - SInt(R[m]<31:24>); 
R[d]<7:@> = diff1l<8:1>; 
R[d]<15:8> = diff2<8:1>; 
R[d]<23:16> = diff3<8:1>; 
R[d]<31:24> = diff4<8:1; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.192 


F5-4520 


SMC 


Secure Monitor Call causes a Secure Monitor Call exception. For more information see Secure Monitor Call (SMC) 
exception on page G1-5541. 


SMC is available only for software executing at EL1 or higher. It is UNDEFINED in User mode. 


If the values of HCR.TSC and SCR.SCD are both 0, execution of an SMC instruction at EL1 or higher generates a 
Secure Monitor Call exception that is taken to EL3. When EL3 is using AArch32 this exception is taken to Monitor 
mode. When EL3 is using AArch64, it is the SCR_EL3.SMD bit, rather than the SCR.SCD bit, that can change the 
effect of executing an SMC instruction. 


Ifthe value of HCR.TSC is 1, execution of an SMC instruction in a Non-secure EL1 mode generates an exception that 
is taken to EL2, regardless of the value of SCR.SCD. When EL2 is using AArch32, this is a Hyp Trap exception 
that is taken to Hyp mode. For more information see Traps to Hyp mode of Non-secure EL1 execution of SMC 
instructions on page G1-5592. 


If the value of HCR.TSC is 0 and the value of SCR.SCD is 1, the SMC instruction is: 
. UNDEFINED in Non-secure state. 


e CONSTRAINED UNPREDICTABLE if executed in Secure state at EL1 or higher. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4|3 0| 


| !=1111 [o o o 1 oļf4 1] 0|(0)(0)(0)(0) (0) (0) (0) (0) (0) 000o 1 1 1| imm | 


cond 


A1 variant 
SMC{<c>}{<q>} {#}<imm4> 
Decode for this encoding 


// imm4 is for assembly/disassembly only and is ignored by hardware 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|1110 9 8|7 6 5 4|3 2 10] 


1 1 1101111 14 1[|1| imm4 [1 0[o0 [o fo) (0)(0)(0)(0)(0)(0)(0) (0) (0) (0) (0) 


T1 variant 

SMC{<c>}{<q>} {#}<imm4> 

Decode for this encoding 

// imm4 is for assembly/disassembly only and is ignored by hardware 
if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<imm4> Is a 4-bit unsigned immediate value, in the range 0 to 15, encoded in the "imm4" field. This is 


ignored by the PE. The Secure Monitor Call exception handler (Secure Monitor code) can use this 
value to determine what service is being requested, but Arm does not recommend this. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 


AArch32.CheckForSMCUndefOrTrap() ; 


if !ELUsingAArch32(EL3) then 
if SCR_EL3.SMD == '1' then 
// SMC disabled. 
UNDEFINED; 
else 
if SCR.SCD == '1' then 
// SMC disabled 
if IsSecure() then 
// Executes either as a NOP or UNALLOCATED. 
c = ConstrainUnpredictable(Unpredictable_SMD) ; 
assert c IN {Constraint_NOP, Constraint_UNDEF}; 
if c == Constraint_NOP then EndOfInstruction(); 
UNDEFINED; 


if !ELUsingAArch32(EL3) then 
AArch64.Cal1SecureMonitor(Zeros(16)); 
else 
AArch32.TakeSMCException(); 


CONSTRAINED UNPREDICTABLE behavior 


If SCR.SCD == '1' && IsSecure(), then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
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F5.1.193 


F5-4522 


SMLABB, SMLABT, SMLATB, SMLATT 


Signed Multiply Accumulate (halfwords) performs a signed multiply accumulate operation. The multiply acts on 
two signed 16-bit quantities, taken from either the bottom or the top half of their respective source registers. The 
other halves of these source registers are ignored. The 32-bit product is added to a 32-bit accumulate value and the 


result is written to the destination register. 


If overflow occurs during the addition of the accumulate value, the instruction sets PSTATE.Q to 1. It is not possible 


for overflow to occur during the multiplication. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8/7 6 5 4|3 0 | 


| 111 jo oo 1 ojo ofof Ra | Ra | Rm filmjnjo] R | 


cond 


SMLABB variant 

Applies when M == 0 && N == 
SMLABB{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 
SMLABT variant 

Applies when M == 1 & N == 
SMLABT{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 
SMLATB variant 

Applies when M == 0 && N == 1. 
SMLATB{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 
SMLATT variant 

Applies when M == 1 && N = 1. 
SMLATT{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 
Decode for all variants of this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 


n_high = (N == '1'); m_high = (M = '1'); 
if d == 15 || n == 15 || m == 15 || a == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/11 8|7 6 5 4|3 0 | 


Tit+t70770/001] Ra | =i | Ra [0 O[N[M] Rm | 
Ra 


SMLABB variant 

Applies when N == @ && M == 
SMLABB{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 
SMLABT variant 


Applies when N == @ && M == 
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SMLABT{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMLATB variant 
Applies when N == 1 && M == 


SMLATB{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMLATT variant 
Applies when N == 1 && M == 


SMLATT{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 

if Ra == '1111' then SEE "SMULBB, SMULBT, SMULTB, SMULTT"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 

n_high = (N == '1'); m_high = (M = '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register holding the multiplicand in the bottom or top half 


(selected by <x>), encoded in the "Rn" field. 


<Rm> Is the second general-purpose source register holding the multiplier in the bottom or top half 
(selected by <y>), encoded in the "Rm" field. 


<Ra> Is the third general-purpose source register holding the addend, encoded in the "Ra" field. 


Operation for all encodings 


if ConditionPassed() then 

EncodingSpecificOperations(); 

operand1 = if n_high then R[n]<31:16> else R[n]<15:0>; 

operand2 = if m_high then R[m]<31:16> else R[m]<15:0>; 

result = SInt(operand1) « SInt(operand2) + SInt(R[a]); 

R[d] = result<31:@>; 

if result != SInt(result<31:0>) then // Signed overflow 
PSTATE.Q = '1'; 
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F5.1.194 


F5-4524 


SMLAD, SMLADX 


Signed Multiply Accumulate Dual performs two signed 16 x 16-bit multiplications. It adds the products to a 32-bit 


accumulate operand. 


Optionally, the instruction can exchange the halfwords of the second operand before performing the arithmetic. This 


produces top x bottom and bottom x top multiplication. 


This instruction sets PSTATE.Q to 1 if the accumulate operation overflows. Overflow cannot occur during the 


multiplications. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 


Penn Jorin 0)o0 0] ra | = | Rm joom] Rn | 
Ra 


cond 


SMLAD variant 
Applies when M == 0. 


SMLAD{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMLADX variant 
Applies when M == 1. 


SMLADX{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 
if Ra == '1111' then SEE "SMUAD"; 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 


m_swap = (M == '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12\11 8|7 6 5 4|3 0 | 


Titi t0770/010] Ra | =i | Ra [oojo Rm | 
Ra 


SMLAD variant 
Applies when M == 0. 


SMLAD{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMLADX variant 
Applies when M == 1. 


SMLADX{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 


if Ra == '1111' then SEE "SMUAD"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 

m_swap = (M == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
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Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


<Ra> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose destination register, encoded in the "Rd" field. 
Is the first general-purpose source register, encoded in the "Rn" field. 


Is the second general-purpose source register, encoded in the "Rm" field. 


Is the third general-purpose source register holding the addend, encoded in the "Ra" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

operand2 = if m_swap then ROR(R[m],16) else R[m]; 

product1 = SInt(R[n]<15:@>) » SInt(operand2<15:0>); 

product2 = SInt(R[n]<31:16>) « SInt(operand2<31:16>) ; 

result = productl + product2 + SInt(R[a]); 

R[d] = result<31:@>; 

if result != SInt(result<31:0>) then // Signed overflow 
PSTATE.Q = '1'; 
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F5.1.195 SMLAL, SMLALS 


Signed Multiply Accumulate Long multiplies two signed 32-bit values to produce a 64-bit value, and accumulates 
this with a 64-bit value. 


In A32 instructions, the condition flags can optionally be updated based on the result. Use of this option adversely 
affects performance on many implementations. 


A1 
31 28|27 26 25 24|23 22 21 20|19 16/15 12|11 8|7 6 5 4|3 o| 


cond 


Flag setting variant 
Applies when S = 1. 


SMLALS{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Not flag setting variant 
Applies when S == 0. 
SMLAL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
Decode for all variants of this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 


if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The value in the destination register is UNKNOWN. 
T1 
|15 14 13 12|1110 9 8|7 6 5 4|3 0 \15 12111 8|7 6 5 4|3 0 | 


11111011 1j 00] Rn | Rdlo | Rani jo o 0 of Rm | 


T1 variant 


SMLAL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Decode for this encoding 


dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); setflags = FALSE; 
if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 

// Armv8-A removes UNPREDICTABLE for R13 

if dHi == dLo then UNPREDICTABLE; 


F5-4526 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<RdLo> Is the general-purpose source register holding the lower 32 bits of the addend, and the destination 


register for the lower 32 bits of the result, encoded in the "RdLo" field. 


<RdHi> Is the general-purpose source register holding the upper 32 bits of the addend, and the destination 
register for the upper 32 bits of the result, encoded in the "RdHi" field. 


<Rn> Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 


<Rm> Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = SInt(R[n]) « SInt(R[m]) + SInt(R[dHi]:R[dLo]); 
R[dHi] = result<63:32>; 
R[dLo] = result<31:0>; 
if setflags then 
PSTATE.N = result<63>; 
PSTATE.Z = IsZeroBit(result<63:0>); 
// PSTATE.C, PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.196 SMLALBB, SMLALBT, SMLALTB, SMLALTT 


F5-4528 


Signed Multiply Accumulate Long (halfwords) multiplies two signed 16-bit values to produce a 32-bit value, and 
accumulates this with a 64-bit value. The multiply acts on two signed 16-bit quantities, taken from either the bottom 
or the top half of their respective source registers. The other halves of these source registers are ignored. The 32-bit 


product is sign-extended and accumulated with a 64-bit accumulate value. 


Overflow is possible during this instruction, but only as a result of the 64-bit addition. This overflow is not detected 


if it occurs. Instead, the result wraps around modulo 2%. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 


o | 


| 111 jooo 4 oj ojo] Rahi | Rado | Rm |ijMjNjo}] Rn | 


cond 


SMLALBB variant 
Applies when M == 0 && N == 


SMLALBB{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


SMLALBT variant 
Applies when M == 1 & N == 


SMLALBT{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


SMLALTB variant 
Applies when M == 0 && N == 


SMLALTB{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


SMLALTT variant 
Applies when M == 1 & N == 


SMLALTT{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Decode for all variants of this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); 
n_high = (N == '1'); m_high = (M = '1'); 


if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


od The instruction is UNDEFINED. 
, The instruction executes as NOP. 
s The value in the destination register is UNKNOWN. 
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T1 


|15 14 13 121110 9 8|7 6 5 4|3 


Tiit70%77100| Ra | Rao | Ram [1 O|N[M] Rm | 


SMLALBB variant 


Applies when N == 0 && M == 


SMLALBB{<c>}{<q>} <RdLo>, 


SMLALBT variant 


Applies when N == 0 && M == 


SMLALBT{<c>}{<q>} <RdLo>, 


SMLALTB variant 


Applies when N == 1 && M == 


SMLALTB{<c>}{<q>} <RdLo>, 


SMLALTT variant 


Applies when N == 1 && M == 


T32 and A32 Base Instruction Set Instruction Descriptions 


F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


<RdHi>, <Rn>, <Rm> 


<RdHi>, <Rn>, <Rm> 


<RdHi>, <Rn>, <Rm> 


SMLALTT{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Decode for all variants of this encoding 


dLo = UInt(RdLo); 
n_high = (N == '1'); 
if dLo == 15 || dHi == 15 || n == 15 


dHi = UInt(RdHi); 
m_high = (M = '1'); 


// Armv8-A removes UNPREDICTABLE for R13 


if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If di 


The instruction is UNDEFINED. 


Notes for all encodings 


== dLo, then one of the following behaviors must occur: 


The instruction executes as NOP. 


The value in the destination register is UNKNOWN. 


0 |15 8|7 6 5 4|3 


n = UInt(Rn); 


|| m == 15 then UNPREDICTABLE; 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<RdLo> 


<RdHi> 


See Standard assembler syntax fields on page F2-3908. 


See Standard assembler syntax fields on page F2-3908. 


Is the general-purpose source register holding the lower 32 bits of the addend, and the destination 


register for the lower 32 bits of the result, encoded in the "RdLo" field. 


Is the general-purpose source register holding the upper 32 bits of the addend, and the destination 


register for the upper 32 bits of the result, encoded in the "RdHi" field. 
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F5-4530 


<Rn> For encoding A1: is the first general-purpose source register holding the multiplicand in the bottom 
or top half (selected by <x>), encoded in the "Rn" field. 


For encoding T1: is the first general-purpose source register holding the multiplicand in the bottom 
or top half (selected by <x>), encoded in the "Rn" field. 


<Rm> For encoding A1: is the second general-purpose source register holding the multiplier in the bottom 
or top half (selected by <y>), encoded in the "Rm" field. 


For encoding T1: is the second general-purpose source register holding the multiplier in the bottom 
or top half (selected by <x>), encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand1 = if n_high then R[n]<31:16> else R[n]<15:0>; 
operand2 = if m_high then R[m]<31:16> else R[m]<15:0>; 
result = SInt(operand1) « SInt(operand2) + SInt(R[dHi]:R[dLo]); 
R[dHi] = result<63:32>; 
R[dLo] = result<31:0>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.197 SMLALD, SMLALDX 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Signed Multiply Accumulate Long Dual performs two signed 16 x 16-bit multiplications. It adds the products to a 
64-bit accumulate operand. 


Optionally, the instruction can exchange the halfwords of the second operand before performing the arithmetic. This 
produces top x bottom and bottom x top multiplication. 


Overflow is possible during this instruction, but only as a result of the 64-bit addition. This overflow is not detected 
if it occurs. Instead, the result wraps around modulo 2%. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 


[m11 fo 414 0]1 0 of Rai | Rado | Rm fo omit] Rn | 


cond 


SMLALD variant 


Applies when M == 0. 


SMLALD{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


SMLALDX variant 


Applies when M == 1. 


SMLALDX{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Decode for all variants of this encoding 


dLo = UInt(RdLo); 
if dLo == 15 || dHi 


dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); m_swap = (M = '1'); 


== 15 || n == 15 || m == 15 then UNPREDICTABLE; 


if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
è The instruction executes as NOP. 
: The value in the destination register is UNKNOWN. 
T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12111 8|7 6 5 4|3 0| 


SMLALD variant 


Applies when M = 0. 


SMLALD{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


SMLALDX variant 


Applies when M = 1. 


SMLALDX{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4532 


Decode for all variants of this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); m_swap = (M == '1'); 
if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


// Armv8-A removes UNPREDICTABLE for R13 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
° The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<RdLo> Is the general-purpose source register holding the lower 32 bits of the addend, and the destination 


register for the lower 32 bits of the result, encoded in the "RdLo" field. 


<RdHi> Is the general-purpose source register holding the upper 32 bits of the addend, and the destination 
register for the upper 32 bits of the result, encoded in the "RdHi" field. 


<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 


<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand2 = if m_swap then ROR(R[m],16) else R[m]; 
product1 = SInt(R[n]<15:@>) » SInt(operand2<15:0>); 
product2 = SInt(R[n]<31:16>) « SInt(operand2<31:16>) ; 
result = productl + product2 + SInt(R[dHi]:R[dLo]); 
R[dHi] = result<63:32>; 
R[dLo] = result<31:0>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.198 SMLAWB, SMLAWT 


Signed Multiply Accumulate (word by halfword) performs a signed multiply accumulate operation. The multiply 
acts on a signed 32-bit quantity and a signed 16-bit quantity. The signed 16-bit quantity is taken from either the 
bottom or the top half of its source register. The other half of the second source register is ignored. The top 32 bits 
of the 48-bit product are added to a 32-bit accumulate value and the result is written to the destination register. The 
bottom 16 bits of the 48-bit product are ignored. 


If overflow occurs during the addition of the accumulate value, the instruction sets PSTATE.Q to 1. No overflow 
can occur during the multiplication. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16115 12111 8|7 6 5 4|3 0 | 
[erm [oo 07 0f0 fo] Rd | Ra | Rm [mojo] Rn 


cond 


SMLAWB variant 
Applies when M == 0. 


SMLAWB{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMLAWT variant 
Applies when M == 1. 


SMLAWT{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); m_high = (M == '1'); 
if d == 15 || n == 15 || m == 15 || a == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12\11 8/7 6 5 4|3 0 | 


11111011 0011| Rn | 111 | ra fo ofojm| Rm | 
Ra 


SMLAWB variant 
Applies when M == 0. 


SMLAWB{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMLAWT variant 
Applies when M == 1. 


SMLAWT{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 


if Ra == '1111' then SEE "SMULWB, SMULWT"; 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); m_high = (M == '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4534 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


<Ra> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose destination register, encoded in the "Rd" field. 

Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 


Is the second general-purpose source register holding the multiplier in the bottom or top half 
(selected by <y>), encoded in the "Rm" field. 


Is the third general-purpose source register holding the addend, encoded in the "Ra" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

operand2 = if m_high then R[m]<31:16> else R[m]<15:Q>; 

result = SInt(R[n]) « SInt(operand2) + (SInt(R[a]) << 16); 

R[d] = result<47:16>; 

if (result >> 16) != SInt(R[d]) then // Signed overflow 
PSTATE.Q = '1'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.199 SMLSD, SMLSDX 


Signed Multiply Subtract Dual performs two signed 16 x 16-bit multiplications. It adds the difference of the 
products to a 32-bit accumulate operand. 


Optionally, the instruction can exchange the halfwords of the second operand before performing the arithmetic. This 
produces top x bottom and bottom x top multiplication. 


This instruction sets PSTATE.Q to 1 if the accumulate operation overflows. Overflow cannot occur during the 
multiplications or subtraction. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 


Penn [o747 0)000] Ra | = | Rm Jorim] Rn | 
Ra 


cond 
SMLSD variant 


Applies when M == 0. 


SMLSD{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMLSDX variant 
Applies when M == 1. 


SMLSDX{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 
if Ra == '1111' then SEE "SMUSD"; 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); m_swap = (M == '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11 81/7 6 5 4|3 0 | 


Ttit710710/100] Ra | =i | Ra [0 O]0|M] Rm | 
Ra 


SMLSD variant 
Applies when M == 0. 


SMLSD{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMLSDX variant 
Applies when M == 1. 


SMLSDX{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 


if Ra == '1111' then SEE "SMUSD"; 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); m_swap = (M = '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4536 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


<Ra> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose destination register, encoded in the "Rd" field. 
Is the first general-purpose source register, encoded in the "Rn" field. 


Is the second general-purpose source register, encoded in the "Rm" field. 


Is the third general-purpose source register holding the addend, encoded in the "Ra" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

operand2 = if m_swap then ROR(R[m],16) else R[m]; 

product1 = SInt(R[n]<15:0>) » SInt(operand2<15:0>); 

product2 = SInt(R[n]<31:16>) « SInt(operand2<31:16>) ; 

result = productl - product2 + SInt(R[a]); 

R[d] = result<31:0>; 

if result != SInt(result<31:0>) then // Signed overflow 
PSTATE.Q = '1'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.200 SMLSLD, SMLSLDX 


ARM DDI 0487E.a 
ID070919 


Signed Multiply Subtract Long Dual performs two signed 16 x 16-bit multiplications. It adds the difference of the 
products to a 64-bit accumulate operand. 


Optionally, the instruction can exchange the halfwords of the second operand before performing the arithmetic. This 
produces top x bottom and bottom x top multiplication. 


Overflow is possible during this instruction, but only as a result of the 64-bit addition. This overflow is not detected 
if it occurs. Instead, the result wraps around modulo 2%. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 8|7 6 5 4|3 0 | 
cond 
SMLSLD variant 
Applies when M == 0. 
SMLSLD{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
SMLSLDX variant 
Applies when M == 1. 
SMLSLDX{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
Decode for all variants of this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); m_swap = (M == '1'); 


if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
è The instruction executes as NOP. 
: The value in the destination register is UNKNOWN. 
T1 
|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12111 8|7 6 5 4|3 0| 


SMLSLD variant 

Applies when M == 0. 

SMLSLD{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
SMLSLDX variant 

Applies when M == 1. 


SMLSLDX{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Decode for all variants of this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); m_swap = (M = '1'); 
if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


// Armv8-A removes UPREDICTABLE for R13 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
° The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<RdLo> Is the general-purpose source register holding the lower 32 bits of the addend, and the destination 


register for the lower 32 bits of the result, encoded in the "RdLo" field. 


<RdHi> Is the general-purpose source register holding the upper 32 bits of the addend, and the destination 
register for the upper 32 bits of the result, encoded in the "RdHi" field. 


<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 


<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand2 = if m_swap then ROR(R[m],16) else R[m]; 
product1 = SInt(R[n]<15:@>) » SInt(operand2<15:0>); 
product2 = SInt(R[n]<31:16>) « SInt(operand2<31:16>) ; 
result = productl - product2 + SInt(R[dHi]:R[dLo]); 
R[dHi] = result<63:32>; 
R[dLo] = result<31:0>; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.201 SMMLA, SMMLAR 


Signed Most Significant Word Multiply Accumulate multiplies two signed 32-bit values, extracts the most 
significant 32 bits of the result, and adds an accumulate value. 


Optionally, the instruction can specify that the result is rounded instead of being truncated. In this case, the constant 
0x80000000 is added to the product before the high word is extracted. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 o| 


[ 11111 fo 1 110j101| Ra [oe | Rm jo ofR]t] Rn | 
Ra 


cond 


SMMLA variant 
Applies when R = 0. 


SMMLA{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMMLAR variant 
Applies when R = 1. 


SMMLAR{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 
if Ra == '1111' then SEE "SMMUL"; 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); round = (R = '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/11 8|7 6 5 4|3 0 | 


Titt+t0770/101] Ra | =i | Rd [0 O]o|R] Rm | 
Ra 


SMMLA variant 
Applies when R == 0. 


SMMLA{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMMLAR variant 
Applies when R == 1. 


SMMLAR{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 

if Ra == '1111' then SEE "SMMUL"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); round = (R == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4540 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


<Ra> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose destination register, encoded in the "Rd" field. 

Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 
Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. 


Is the third general-purpose source register holding the addend, encoded in the "Ra" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

result = (SInt(R[a]) << 32) + SInt(R[n]) « SInt(R[m]); 
if round then result = result + 0x80000000; 

R[d] = result<63:32>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.202 SMMLS, SMMLSR 


ARM DDI 0487E.a 
ID070919 


Signed Most Significant Word Multiply Subtract multiplies two signed 32-bit values, subtracts the result from a 
32-bit accumulate value that is shifted left by 32 bits, and extracts the most significant 32 bits of the result of that 
subtraction. 


Optionally, the instruction can specify that the result of the instruction is rounded instead of being truncated. In this 
case, the constant 0x80000000 is added to the result of the subtraction before the high word is extracted. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12111 8|7 6 5 4|3 0| 
Cem [orro on) Rd | ra | Rm MiRe | 


cond 


SMMLS variant 
Applies when R = 0. 


SMMLS{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMMLSR variant 
Applies when R = 1. 


SMMLSR{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); round = (R = '1'); 
if d == 15 || n == 15 || m == 15 || a == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11 8|7 6 5 4|3 0 | 


Tiit70%770)710| Ra | Ra | Rd Jooo) Rm | 


SMMLS variant 
Applies when R == 0. 


SMMLS{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


SMMLSR variant 
Applies when R == 1. 


SMMLSR{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); round = (R == '1'); 
if d == 15 || n == 15 || m == 15 || a == 15 then UNPREDICTABLE; 

// Armv8-A removes UNPREDICTABLE for R13 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5-4542 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


<Ra> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose destination register, encoded in the "Rd" field. 

Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 
Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. 


Is the third general-purpose source register holding the addend, encoded in the "Ra" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

result = (SInt(R[a]) << 32) - SInt(R[n]) « SInt(R[m]); 
if round then result = result + 0x80000000; 

R[d] = result<63:32>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.203 SMMUL, SMMULR 
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Signed Most Significant Word Multiply multiplies two signed 32-bit values, extracts the most significant 32 bits of 
the result, and writes those bits to the destination register. 


Optionally, the instruction can specify that the result is rounded instead of being truncated. In this case, the constant 
0x80000000 is added to the product before the high word is extracted. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 8|7 6 5 4|3 o| 
Posi [o 111o0oļj1401| ra [1111| Rm fo ofRii] R | 


cond 


SMMUL variant 

Applies when R = 0. 

SMMUL{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 

SMMULR variant 

Applies when R = 1. 

SMMULR{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 

Decode for all variants of this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); round = (R == '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiit7o0771o707] Ra [i177] Rd fo o]o[R] Rm | 


SMMUL variant 
Applies when R == 0. 


SMMUL{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


SMMULR variant 
Applies when R == 1. 


SMMULR{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); round = (R == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4544 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose destination register, encoded in the "Rd" field. 


Is the first general-purpose source register, encoded in the "Rn" field. 


Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

result = SInt(R[n]) « SInt(R[m]); 

if round then result = result + 0x80000000; 
R[d] = result<63:32>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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ARM DDI 0487E.a 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.204 SMUAD, SMUADX 


ARM DDI 0487E.a 
ID070919 


Signed Dual Multiply Add performs two signed 16 x 16-bit multiplications. It adds the products together, and writes 
the result to the destination register. 


Optionally, the instruction can exchange the halfwords of the second operand before performing the arithmetic. This 
produces top x bottom and bottom x top multiplication. 


This instruction sets PSTATE.Q to 1 if the addition overflows. The multiplications cannot overflow. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 8|7 6 5 4|3 0 | 


[m1 jo 114 ojo oof Rd fi 111| Rm Jo ojfmji] Rn | 


cond 


SMUAD variant 
Applies when M == 0. 


SMUAD{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


SMUADX variant 

Applies when M == 1. 

SMUADX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 

Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); m_swap = (M == '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manar onn ojoro) R [1777] R 0 ojom) Rm | 


SMUAD variant 

Applies when M = 0. 
SMUAD{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 
SMUADX variant 

Applies when M = 1. 


SMUADX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); m_swap = (M == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4546 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose destination register, encoded in the "Rd" field. 


Is the first general-purpose source register, encoded in the "Rn" field. 


Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

operand2 = if m_swap then ROR(R[m],16) else R[m]; 

productl = SInt(R[n]<15:@>) » SInt(operand2<15:0>); 

product2 = SInt(R[n]<31:16>) « SInt(operand2<31:16>) ; 

result = productl + product2; 

R[d] = result<31:0>; 

if result != SInt(result<31:0>) then // Signed overflow 
PSTATE.Q = '1'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.205 SMULBB, SMULBT, SMULTB, SMULTT 


ARM DDI 0487E.a 
ID070919 


Signed Multiply (halfwords) multiplies two signed 16-bit quantities, taken from either the bottom or the top half of 
their respective source registers. The other halves of these source registers are ignored. The 32-bit product is written 


to the destination register. No overflow is possible during this instruction. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 14 13 12|11 8|7 6 5 4|3 0 | 


[m11 fo oo 4 of1 1o] Ra kowo] rm filminfo] R | 


cond 
SMULBB variant 


Applies when M == @ && N == 


SMULBB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


SMULBT variant 
Applies when M == 1 && N == 


SMULBT{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


SMULTB variant 
Applies when M == @ && N == 


SMULTB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


SMULTT variant 

Applies when M == 1 && N == 
SMULTT{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 
Decode for all variants of this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 


n_high = (N == '1'); m_high = (M = '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


1111011 0jo0o1| R [1111| Ra fo ojNnjm| Rm | 


SMULBB variant 
Applies when N == 0 & M == 


SMULBB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 
SMULBT variant 
Applies when N == 0 && M == 


SMULBT{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


SMULTB variant 


Applies when N == 1 && M == 


SMULTB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


SMULTT variant 


Applies when N == 1 && M == 


SMULTT{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for all variants of this encoding 


d= 


UInt(Rd); n = UInt(Rn); m = UInt(Rm); 


n_high = (N == '1'); m_high = (M = '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> 


<q> 


<Rd> 


<Rn> 


<Rm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose destination register, encoded in the "Rd" field. 


Is the first general-purpose source register holding the multiplicand in the bottom or top half 
(selected by <x>), encoded in the "Rn" field. 


Is the second general-purpose source register holding the multiplier in the bottom or top half 
(selected by <y>), encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

operand1 = if n_high then R[n]<31:16> else R[n]<15:0>; 
operand2 = if m_high then R[m]<31:16> else R[m]<15:0>; 
result = SInt(operand1) » SInt(operand2) ; 

R[d] = result<31:0>; 

// Signed overflow cannot occur 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 


F5-4548 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.206 SMULL, SMULLS 


ARM DDI 0487E.a 
ID070919 


Signed Multiply Long multiplies two 32-bit signed values to produce a 64-bit result. 


In A32 instructions, the condition flags can optionally be updated based on the result. Use of this option adversely 
affects performance on many implementations. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 8|7 6 5 4|3 0 | 


cond 


Flag setting variant 
Applies when S == 1. 


SMULLS{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Not flag setting variant 
Applies when S == 0. 
SMULL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
Decode for all variants of this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 


if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
` The value in the destination register is UNKNOWN. 
T1 
|15 14 13 12/1110 9 8|7 6 5 4/3 015 12|11 8|7 6 5 4|3 0 | 


11111011 1/0 00] Rn | Rdlo | Rani jo 0 0 of Rm | 


T1 variant 


SMULL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Decode for this encoding 


dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); setflags = FALSE; 
if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 

// Armv8-A removes UNPREDICTABLE for R13 

if dHi == dLo then UNPREDICTABLE; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<RdLo> Is the general-purpose destination register for the lower 32 bits of the result, encoded in the "RdLo" 
field. 

<RdHi> Is the general-purpose destination register for the upper 32 bits of the result, encoded in the "RdHi" 
field. 

<Rn> Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = SInt(R[n]) « SInt(R[m]); 
R[dHi] = result<63:32>; 
R[dLo] = result<31:0>; 
if setflags then 
PSTATE.N = result<63>; 
PSTATE.Z = IsZeroBit(result<63:0>); 
// PSTATE.C, PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.207 SMULWB, SMULWT 


ARM DDI 0487E.a 
ID070919 


Signed Multiply (word by halfword) multiplies a signed 32-bit quantity and a signed 16-bit quantity. The signed 
16-bit quantity is taken from either the bottom or the top half of its source register. The other half of the second 
source register is ignored. The top 32 bits of the 48-bit product are written to the destination register. The bottom 
16 bits of the 48-bit product are ignored. No overflow is possible during this instruction. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16115 14 13 12|11 8|7 6 5 4|3 o| 
Cem [0001 opio Ra [OOOO] Rm o Ra | 


cond 


SMULWEB variant 
Applies when M == 0. 


SMULWB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


SMULWT variant 
Applies when M == 1. 


SMULWT{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for all variants of this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); m_high = (M == '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiit70%770)017] Ra [i177] Rd Jo ojom) Rm 


SMULWEB variant 
Applies when M == 0. 


SMULWB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


SMULWT variant 
Applies when M == 1. 


SMULWT{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); m_high = (M == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register holding the multiplier in the bottom or top half 


(selected by <y>), encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand2 = if m_high then R[m]<31:16> else R[m]<15:0>; 
product = SInt(R[n]) « SInt(operand2); 
R[d] = product<47:16>; 
// Signed overflow cannot occur 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.208 SMUSD, SMUSDX 


ARM DDI 0487E.a 
ID070919 


Signed Multiply Subtract Dual performs two signed 16 x 16-bit multiplications. It subtracts one of the products from 
the other, and writes the result to the destination register. 


Optionally, the instruction can exchange the halfwords of the second operand before performing the arithmetic. This 
produces top x bottom and bottom x top multiplication. 


Overflow cannot occur. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 8|7 6 5 4|3 0 | 
Psi fo 111 ofo oof ra [1111| Rm fo jmf] R | 


cond 


SMUSD variant 
Applies when M == 0. 


SMUSD{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


SMUSDX variant 

Applies when M == 1. 

SMUSDX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 

Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); m_swap = (M == '1'); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


maraon onoo) Rn jira) R 0 0]o[mM] Rm | 


SMUSD variant 

Applies when M == 0. 
SMUSD{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 
SMUSDX variant 

Applies when M == 1. 


SMUSDX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); m_swap = (M == '1'); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4554 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the general-purpose destination register, encoded in the "Rd" field. 


Is the first general-purpose source register, encoded in the "Rn" field. 


Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 

operand2 = if m_swap then ROR(R[m],16) else R[m]; 
productl = SInt(R[n]<15:@>) » SInt(operand2<15:0>); 
product2 = SInt(R[n]<31:16>) « SInt(operand2<31:16>) ; 
result = productl - product2; 

R[d] = result<31:0>; 

// Signed overflow cannot occur 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.209 SRS, SRSDA, SRSDB, SRSIA, SRSIB 


ARM DDI 0487E.a 
ID070919 


Store Return State stores the LR_<current_mode> and SPSR_<current_mode> to the stack of a specified mode. For 
information about memory accesses see Memory accesses on page F2-3913. 


SRS is UNDEFINED in Hyp mode. 


SRS is CONSTRAINED UNPREDICTABLE if it is executed in User or System mode, or if the specified mode is any of the 
following: 


. Not implemented. 

$ A mode that Table G1-5 on page G1-5484 does not show. 

° Hyp mode. 

° Monitor mode, if the SRS instruction is executed in Non-secure state. 


If EL3 is using AArch64 and an SRS instruction that is executed in a Secure EL1 mode specifies Monitor mode, it 
is trapped to EL3. 


See Traps to EL3 of Secure monitor functionality from Secure ELI using AArch32 on page D1-2361. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 1615 1413 12/1110 9 8|7 6 5 4| 0 | 


[114-1 1 0 O[PJU] 1 Jw] [(1) (1) (0) (1)[(0) (0) (0) (0) (0) (1) (0) (1) OOO] mode 


Decrement After variant 
Applies when P == @ && U == 


SRSDA{<c>}{<q>} SP{!}, #<mode> 


Decrement Before variant 

Applies when P == 1 & U == @. 
SRSDB{<c>}{<q>} SP{!}, #<mode> 

Increment After variant 

Applies when P == 0 && U == 1. 
SRS{TA}{<c>}{<q>} SP{!}, #<mode> 
Increment Before variant 

Applies when P == 1 && U == 1. 
SRSIB{<c>}{<q>} SP{!}, #<mode> 

Decode for all variants of this encoding 


wback = (W == '1'); increment = (U == '1'); wordhigher = (P == U); 
T1 


|15 1413 12/1110 9 8/7 6 5 4/3 2 1 0|15141312/11109 8|7 6 5 4| 0 | 


[111010 Of Of ofw]ofity(4y (0) Okko (0) (0) (0) (0) (0) (0) (0) (mode | 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4556 


T1 variant 


SRSDB{<c>}{<q>} SP{!}, #<mode> 


Decode for this encoding 


wback = (W == '1'); | increment = FALSE; wordhigher = FALSE; 
T2 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 1 0|15141312/11109 8|7 6 5 4| 0 | 


[11 10 1 0 oļi 1[0[w]o k0 (4) (0) kokako) (©) (0) (0) (0) (0) (0) (0) 0] mode | 


T2 variant 


SRS{IA}{<c>}{<q>} SP{!}, #<mode> 


Decode for this encoding 


wback = (W == '1'); increment = TRUE; wordhigher = FALSE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly SRS (T32) on page K1-7619 and SRS 
(432) on page K1-7619. 


Assembler symbols 


IA For encoding A1: is an optional suffix to indicate the Increment After variant. 


For encoding T2: is an optional suffix for the Increment After form. 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. <c> must be AL or omitted. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


! The address adjusted by the size of the data loaded is written back to the base register. If specified, 
it is encoded in the "W" field as 1, otherwise this field defaults to 0. 


<mode> Is the number of the mode whose Banked SP is used as the base register, encoded in the "mode" 
field. For details of PE modes and their numbers see AArch32 state PE mode descriptions on 
page G1-5484. 


SRSFA, SRSEA, SRSFD, and SRSED are pseudo-instructions for SRSIB, SRSIA, SRSDB, and SRSDA respectively, referring to 
their use for pushing data onto Full Ascending, Empty Ascending, Full Descending, and Empty Descending stacks. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 
if ConditionPassed() then 
EncodingSpecificOperations(); 
if PSTATE.EL == EL2 then // UNDEFINED at EL2 
UNDEFINED; 


// Check for UNPREDICTABLE cases. The definition of UNPREDICTABLE does not permit these 
// to be security holes 
if PSTATE.M IN {M32_User,M32_System} then 


UNPREDICTABLE; 
elsif mode == M32_Hyp then // Check for attempt to access Hyp mode SP 
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UNPREDICTABLE; 
elsif mode == M32_Monitor then // Check for attempt to access Monitor mode SP 
if !HaveEL(EL3) || !IsSecure() then 
UNPREDICTABLE; 
elsif !ELUsingAArch32(EL3) then 
AArch64.MonitorModeTrap(); 
elsif BadMode(mode) then 
UNPREDICTABLE; 


base = Rmode[13,mode]; 
address = if increment then base else base-8; 
if wordhigher then address = address+4; 
MemA[address,4] = LR; 
MemA[address+4,4] = SPSR[]; 
if wback then Rmode[13,mode] = if increment then base+8 else base-8; 
else 
if ConditionPassed() then 
EncodingSpecificOperations(); 
if PSTATE.EL == EL2 then // UNDEFINED at EL2 
UNDEFINED; 


// Check for UNPREDICTABLE cases. The definition of UNPREDICTABLE does not permit these 
// to be security holes 
if PSTATE.M IN {M32_User,M32_System} then 
UNPREDICTABLE; 
elsif mode == M32_Hyp then // Check for attempt to access Hyp mode SP 
UNPREDICTABLE; 
elsif mode == M32_Monitor then // Check for attempt to access Monitor mode SP 
if !HaveEL(EL3) || !IsSecure() then 
UNPREDICTABLE; 
elsif !ELUsingAArch32(EL3) then 
AArch64.MonitorModeTrap(); 
elsif BadMode(mode) then 
UNPREDICTABLE; 





base = Rmode[13,mode]; 

address = if increment then base else base-8; 

if wordhigher then address = address+4; 

MemA[address,4] = LR; 

MemA[address+4,4] = SPSR[]; 

if whack then Rmode[13,mode] = if increment then base+8 else base-8; 
CONSTRAINED UNPREDICTABLE behavior 
If PSTATE.M IN {M32_User,M32_System}, then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 


. The instruction executes as NOP. 


If mode == M32_Hyp, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

e The instruction executes as NOP. 

If mode == M32_Monitor && (!HaveEL(EL3) || !IsSecure()), then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 

° The instruction executes as NOP. 


If BadMode (mode), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
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. The instruction stores to the stack of the mode in which it is executed. 


° The instruction stores to an UNKNOWN address, and if the instruction specifies writeback then any 
general-purpose register that can be accessed from the current Exception level without a privilege violation 
becomes UNKNOWN. 
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F5.1.210 SSAT 


Signed Saturate saturates an optionally-shifted signed value to a selectable signed range. 


This instruction sets PSTATE.Q to 1 if the operation saturates. 


A1 


31 28|27 26 25 24|23 22 21 20| 16/15 12\11 7 6 5 4/3 0 | 


erm Jonn o afo] satimm | Rao mms [sho 7] Rn | 


cond 


Arithmetic shift right variant 
Applies when sh == 1. 


SSAT{<c>}{<q>} <Rd>, #<imm>, <Rn>, ASR #<amount> 


Logical shift left variant 
Applies when sh = 0. 


SSAT{<c>}{<q>} <Rd>, #<imm>, <Rn> {, LSL #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); saturate_to = UInt(sat_imm)+1; 
(shift_t, shift_n) = DecodeImmShift(sh:'O', imm5); 
if d == 15 || n == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 01514  12|11 8|7 6 5 4| 0 | 


11 1 1 oot 1fo ofsnjo| Rn fo] imma | Ra fimm2|(o)]__sat_imm_| 





Arithmetic shift right variant 
Applies when sh == 1 && !(imm3 == 000 && imm2 == QQ). 


SSAT{<c>}{<q>} <Rd>, #<imm>, <Rn>, ASR #<amount> 


Logical shift left variant 
Applies when sh = 0. 


SSAT{<c>}{<q>} <Rd>, #<imm>, <Rn> {, LSL #<amount>} 


Decode for all variants of this encoding 


if sh == '1' && (imm3:imm2) == '00000' then SEE "SSAT16"; 

d = UInt(Rd); n = UInt(Rn); saturate_to = UInt(sat_imm)+1; 

(shift t, shift_n) = DecodeImmShift(sh:'@', imm3:imm2); 

if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5-4560 


Assembler symbols 


<C> 


<q> 


<Rd> 


<imm> 


<Rn> 


<amount> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose destination register, encoded in the "Rd" field. 

Is the bit position for saturation, in the range 1 to 32, encoded in the "sat_imm" field as <imm>-1. 
Is the general-purpose source register, encoded in the "Rn" field. 


For encoding A1: is the optional shift amount, in the range 0 to 31, defaulting to 0 and encoded in 
the "imm5" field. 


For encoding A1: is the shift amount, in the range 1 to 32 encoded in the "imm5" field as <amount> 
modulo 32. 


For encoding T1: is the optional shift amount, in the range 0 to 31, defaulting to 0 and encoded in 
the "Imm3:imm2" field. 


For encoding T1: is the shift amount, in the range 1 to 31 encoded in the "imm3:imm2" field as 
<amount>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand = Shift(R[n], shift_t, shift_n, PSTATE.C); // PSTATE.C ignored 
(result, sat) = SignedSatQ(SInt(operand), saturate_to); 
R[d] = SignExtend(result, 32); 


if sat then 
PSTATE.Q = '1'; 
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F5.1.211 SSAT16 


Signed Saturate 16 saturates two signed 16-bit values to a selected signed range. 


This instruction sets PSTATE.Q to 1 if the operation saturates. 
A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


erm [o 7710 afo o] samm | Ra (yoo 17] Rn 


cond 


A1 variant 


SSAT16{<c>}{<q>} <Rd>, #<imm>, <Rn> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); saturate_to = UInt(sat_imm)+1; 
if d == 15 || n == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


741 oft oono] Rn [ojo o oj Ra Jo opoo] sat_imm | 


T1 variant 


SSAT16{<c>}{<q>} <Rd>, #<imm>, <Rn> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); saturate_to = UInt(sat_imm)+1; 
if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<imm> Is the bit position for saturation, in the range 1 to 16, encoded in the "sat_imm" field as <imm>-1. 
<Rn> Is the general-purpose source register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result1, sat1) = SignedSatQ(SInt(R[n]<15:0>), saturate_to); 
(result2, sat2) = SignedSatQ(SInt(R[n]<31:16>), saturate_to) ; 
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R[d]<15:@> = SignExtend(resultl, 16); 
R[d]<31:16> = SignExtend(result2, 16); 
if satl || sat2 then 

PSTATE.Q = '1'; 
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F5.1.212 SSAX 


ARM DDI 0487E.a 
ID070919 


Signed Subtract and Add with Exchange exchanges the two halfwords of the second operand, performs one 16-bit 
integer subtraction and one 16-bit addition, and writes the results to the destination register. It sets PSTATE.GE 
according to the results. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


[1m1 Jo 110 ojo oat Rn | Rd kooo] oft] Rm | 


cond 


A1 variant 


SSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


marar onrorn ao] kn [1717] R Jojojojo] Rm 


T1 variant 


SSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum = SInt(R[n]<15:0>) + SInt(R[m]<31:16>); 
diff = SInt(R[n]<31:16>) - SInt(R[m]<15:0>); 
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R[d]<15:@> = sum<15:@>; 
R[d]<31:16> = diff<15:@>; 
PSTATE.GE<1:@> = if sum >= @ then '11' else 'Q0'; 
PSTATE.GE<3:2> = if diff >= @ then '11' else 'Q0'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
: The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.213 SSBB 


ARM DDI 0487E.a 
ID070919 


Speculative Store Bypass Barrier is amemory barrier which prevents speculative loads from bypassing earlier stores 
to the same virtual address under certain conditions. 


The semantics of the Speculative Store Bypass Barrier are: 


° When a load to a location appears in program order after the SSBB, then the load does not speculatively read 
an entry earlier in the coherence order for that location than the entry generated by the latest store satisfying 
all of the following conditions: 


— The store is to the same location as the load. 
— The store uses the same virtual address as the load. 


— The store appears in program order before the SSBB. 


° When a load to a location appears in program order before the SSBB, then the load does not speculatively 
read data from any store satisfying all of the following conditions: 


— The store is to the same location as the load. 
— The store uses the same virtual address as the load. 


— The store appears in program order after the SSBB. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4|3 2 1 0| 


A1 variant 


SSBB{<q>} 


Decode for this encoding 


// No additional decoding required 


T1 


15 14 13 1211110 9 8|7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 21 0| 


tt toot a o1 1ko okoo kookako +o ofo o o 0| 





T1 variant 


SSBB{<q>} 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
SpeculativeStoreBypassBarrierToVA(); 
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F5.1.214 SSUB16 
Signed Subtract 16 performs two 16-bit signed integer subtractions, and writes the results to the destination register. 
It sets PSTATE.GE according to the results of the subtractions. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[1mm fo 1 to ojo ot] Rn | RA kiaj fi] Rm | 


cond 


A1 variant 


SSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto1oio e ira) R olojofo] Rm 


T1 variant 


SSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = SInt(R[n]<15:@>) - SInt(R[m]<15:@>); 
diff2 = SInt(R[n]<31:16>) - SInt(R[m]<31:16>); 
R[d]<15:@> = diff1<15:0>; 
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R[d]<31:16> = diff2<15:0>; 
PSTATE.GE<1:0> = if diff1 >= @ then '11' else '00'; 
PSTATE.GE<3:2> = if diff2 >= @ then '11' else '00'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.215 SSUB8 
Signed Subtract 8 performs four 8-bit signed integer subtractions, and writes the results to the destination register. 
It sets PSTATE.GE according to the results of the subtractions. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


| tei fo 1 to ojo ot] Rao | Ri koa] fi] Rm 


cond 


A1 variant 


SSUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto70io0] Ra jira) R o]ojofo] Rm | 


T1 variant 


SSUB8{<c>} {<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = SInt(R[n]<7:@>) - SInt(R[m]<7:0>); 
diff2 = SInt(R[n]<15:8>) - SInt(R[m]<15:8>); 
diff3 = SInt(R[n]<23:16>) - SInt(R[m]<23:16>); 
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F5-4570 


diff4 = SInt(R[n]<31:24>) - SInt(R[m]<31:24>); 


R[d]<7:Q> 
R[d]<15:8> 
R[d]<23:16> 
R[d]<31:24> 
PSTATE.GE<Q> 
PSTATE.GE<1> 
PSTATE.GE<2> 
PSTATE.GE<3> 


diff1<7:0>; 
diff2<7:0>; 
diff3<7:0>; 
diff4<7:0>; 
= if diffl >= 
if diff2 >= 
if diff3 >= 
= if diff4 >= 


Operational information 


O then '1' else 'Q'; 
O then '1' else 'Q'; 
O then '1' else 'Q'; 
O then '1' else 'Q'; 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 


or destination: 


è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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Store data to System register calculates an address from a base register value and an immediate offset, and stores a 
word from the DBGDTRRXint System register to memory. It can use offset, post-indexed, pre-indexed, or 
unindexed addressing. For information about memory accesses see Memory accesses on page F2-3913. 


In an implementation that includes EL2, the permitted STC access to DBGDTRRXint can be trapped to Hyp mode, 
meaning that an attempt to execute an STC instruction in a Non-secure mode other than Hyp mode, that would be 
permitted in the absence of the Hyp trap controls, generates a Hyp Trap exception. For more information, see 
Trapping general Non-secure System register accesses to debug registers on page G1-5601. 


For simplicity, the STC pseudocode does not show this possible trap to Hyp mode. 


A1 
31 28|27 26 25 24|23 22 21 20|19 16/15 14 13 12/1110 9 8|7 | 0| 
Cem [i 7 ouo] e oroa a o me 


cond 


Offset variant 
Applies when P == 1 && W == 


STC{<c>}{<q>} p14, c5, [<Rn>{, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == 0 & W == 


STC{<c>}{<q>} p14, c5, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W == 


STC{<c>}{<q>} p14, c5, [<Rn>, #{+/-}<imm>]! 


Unindexed variant 
Applies when P == 0 && U == 1 && W == 


STC{<c>}{<q>} p14, c5, [<Rn>], <option> 


Decode for all variants of this encoding 
if P == '0' && U == '0' && W == 'Q' then UNDEFINED; 
n = UInt(Rn); cp = 14; 


imm32 = ZeroExtend(imm8:'00', 32); index = (P == '1'); add = (U == '1'); whack = (W = '1'); 
if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == 15 && wback, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 

° The instruction executes as NOP. 

. The instruction executes without writeback of the base address. 

e The instruction executes with writeback to the PC. The instruction is handled as described in Using R15 on 


page K1-7607. 
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F5-4572 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 [15 14 13 12|11 10 9 8|7 | 0| 


aaao ouo] e Joron a o me 


Offset variant 


Applies when P == 1 && W == 


STC{<c>}{<q>} p14, c5, [<Rn>{, #{+/-}<imm>}] 


Post-indexed variant 


Applies when P == 0 && W == 


STC{<c>}{<q>} p14, c5, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 


Applies when P == 1 && W == 


STC{<c>}{<q>} p14, c5, [<Rn>, #{+/-}<imm>]! 


Unindexed variant 


Applies when P == 0 && U == 1 && W == 


STC{<c>}{<q>} p14, c5, [<Rn>], <option> 


Decode for all variants of this encoding 


if P == '0' && U == '@' && W == '@' then UNDEFINED; 

n = UInt(Rn); cp = 14; 

imm32 = ZeroExtend(imm8:'00', 32); index = (P == '1'); add = (U == '1'); wback = (W = '1'); 
if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

. The instruction executes without writeback of the base address. 

° The instruction executes with writeback to the PC. The instruction is handled as described in Using R15 on 


page K1-7607. 


Assembler symbols 


<C> 
<q> 


<Rn> 


<option> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For the offset or unindexed variant: is the general-purpose base register, encoded in the "Rn" field. 
The PC can be used, but this is deprecated. 


For the offset, post-indexed or pre-indexed variant: is the general-purpose base register, encoded in 
the "Rn" field. 


Is an 8-bit immediate, in the range 0 to 255 enclosed in { }, encoded in the "imm8" field. The value 
of this field is ignored when executing this instruction. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = @ 
+ when U = 1 

<imm> Is the immediate offset used for forming the address, a multiple of 4 in the range 0-1020, defaulting 


to 0 and encoded in the "imm8" field, as <imm>/4. 


Operation for all encodings 

if ConditionPassed() then 
EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 


// System register read from DBGDTRRXint. 
MemA[Laddress,4] = DBGDTR_ELQ[]; 


if wback then R[n] = offset_addr; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.217 


F5-4574 


STL 


Store-Release Word stores a word from a register to memory. The instruction also has memory ordering semantics 
as described in Load-Acquire, Store-Release on page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 10 9 8|7 6 5 4|3 0| 


[m1 Jooo 1 tfo ofof R fy afynfofot1 oo 1| rR | 


cond 


A1 variant 


STL{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


110100011 ojo} R | R (HM malstfo}1 oma) 


T1 variant 


STL{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
MemO[address, 4] = R[t]; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.218 


F5-4576 


STLB 


Store-Release Byte stores a byte from a register to memory. The instruction also has memory ordering semantics as 
described in Load-Acquire, Store-Release on page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 10 9 8|7 6 5 4|3 0| 


Feit foo o 1 1j ofo] R  wmmamo]o] oo 1] rR | 


cond 


A1 variant 


STLB{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


fatto ooot1 op) m | a Moooi bo owna 


T1 variant 


STLB{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
MemO[address, 1] = R[t]<7:0>; 
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Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.219 STLEX 


F5-4578 


Store-Release Exclusive Word stores a word from a register to memory if the executing PE has exclusive access to 
the memory at that address, and returns a status value of 0 if the store was successful, or of 1 if no store was 
performed. 


The instruction also has memory ordering semantics as described in Load-Acquire, Store-Release on page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Derm [ooo 7 10 ojo] en | Rd Oon oon Rk 


cond 


A1 variant 


STLEX{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 
Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 


if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
: The instruction executes as NOP. 
s The instruction performs the store to an UNKNOWN address. 
T1 
|15 14 13 12/1110 9 8|7 6 5 4/3 015 12/1110 9 8|7 6 5 4/3 0| 


1110100011 0fof] Rn | R woooh o] Ri | 


T1 variant 


STLEX{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 


Decode for this encoding 


d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 
if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t then UNPREDICTABLE; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
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CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the destination general-purpose register into which the status result of the store exclusive is 
written, encoded in the "Rd" field. The value returned is: 
Q If the operation updates memory. 
I If the operation fails to update memory. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Aborts and alignment 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

° <Rd> is not updated. 


A non word-aligned memory address causes an Alignment fault Data Abort exception to be generated, subject to 
the following rules: 


° If AArch32.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
s Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch32.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
if AArch32.ExclusiveMonitorsPass(address,4) then 
MemO[address, 4] = R[t]; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


R[d] = ZeroExtend('@'); 
else 
R[d] = ZeroExtend('1'); 
Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.220 STLEXB 


ARM DDI 0487E.a 
ID070919 


Store-Release Exclusive Byte stores a byte from a register to memory if the executing PE has exclusive access to 
the memory at that address, and returns a status value of 0 if the store was successful, or of 1 if no store was 
performed. 


The instruction also has memory ordering semantics as described in Load-Acquire, Store-Release on page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Perm [ooo 711 ojo] en | Rd Oon oon R 


cond 


A1 variant 


STLEXB{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 
Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 


if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
: The instruction executes as NOP. 
s The instruction performs the store to an UNKNOWN address. 
T1 
|15 14 13 12/1110 9 8|7 6 5 4/3 015 12/1110 9 8|7 6 5 4|3 0| 


1110100011 0fof Rn | R [aaaaifsfo o] Ri | 


T1 variant 


STLEXB{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 


Decode for this encoding 


d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 
if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t then UNPREDICTABLE; 
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CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the destination general-purpose register into which the status result of the store exclusive is 
written, encoded in the "Rd" field. The value returned is: 
Q If the operation updates memory. 
I If the operation fails to update memory. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Aborts 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

° <Rd> is not updated. 


If AArch32.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation for all encodings 


if ConditionPassed() then 

EncodingSpecificOperations(); 

address = R[n]; 

if AArch32.ExclusiveMonitorsPass(address,1) then 
MemO[address, 1] = R[t]<7:0>; 
R[d] = ZeroExtend('@'); 

else 
R[d] = ZeroExtend('1'); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.221 STLEXD 


ARM DDI 0487E.a 
ID070919 


Store-Release Exclusive Doubleword stores a doubleword from two registers to memory if the executing PE has 
exclusive access to the memory at that address, and returns a status value of 0 if the store was successful, or of 1 if 
no store was performed. 


The instruction also has memory ordering semantics as described in Load-Acquire, Store-Release on page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Derm [ooo 71/070] en | Rd Oon oon R 


cond 


A1 variant 


STLEXD{<c>}{<q>} <Rd>, <Rt>, <Rt2>, [<Rn>] 
Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); t2 = t+1; n = UInt(Rn); 


if d == 15 || Rt<@> == '1' || t2 == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t || d == t2 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction performs the store to an UNKNOWN address. 

If Rt<@> == '1', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

e The instruction executes with the additional decode: Rt<0> = '0'. 
e The instruction executes with the additional decode: t2 =t. 

° The instruction executes as described, with no change to its behavior and no additional side effects. 
IfRt == '1110', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

e The instruction executes as NOP. 


7 The instruction is handled as described in Using R15 on page K1-7607. 
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T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/11 8|7 6 5 4|3 0 | 


T7totoooti oo] em | a | Re Moo Re 


T1 variant 


STLEXD{<c>}{<q>} <Rd>, <Rt>, <Rt2>, [<Rn>] 
Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); t2 = UInt(Rt2); n = UInt(Rn); 


if d == 15 || t == 15 || t2 == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t || d == t2 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
s The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the destination general-purpose register into which the status result of the store exclusive is 
written, encoded in the "Rd" field. The value returned is: 
() If the operation updates memory. 
1 If the operation fails to update memory. 

<Rt> For encoding A1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 


<Rt> must be even-numbered and not R14. 


For encoding T1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 


<Rt2> For encoding A1: is the second general-purpose register to be transferred. <Rt2> must be <R(t+1)>. 


For encoding T1: is the second general-purpose register to be transferred, encoded in the "Rt2" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Aborts and alignment 
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If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 
° <Rd> is not updated. 


A non word-aligned memory address causes an Alignment fault Data Abort exception to be generated, subject to 
the following rules: 


° If AArch32.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
s Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch32.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
// Create doubleword to store such that R[t] will be stored at address and R[t2] at address+4. 
value = if BigEndian() then R[t]:R[t2] else R[t2]:R[t]; 
if AArch32.ExclusiveMonitorsPass(address, 8) then 
MemO[address, 8] = value; 
R[d] = ZeroExtend('@'); 
else 
R[d] = ZeroExtend('1'); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.222 STLEXH 


F5-4586 


Store-Release Exclusive Halfword stores a halfword from a register to memory if the executing PE has exclusive 
access to the memory at that address, and returns a status value of 0 if the store was successful, or of 1 if no store 
was performed. 


The instruction also has memory ordering semantics as described in Load-Acquire, Store-Release on page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Derm [ooo 71170] en | Rd OOo oon Rt 


cond 


A1 variant 


STLEXH{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 
Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 


if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
: The instruction executes as NOP. 
s The instruction performs the store to an UNKNOWN address. 
T1 
|15 14 13 12/1110 9 8|7 6 5 4/3 015 12/1110 9 8|7 6 5 4/3 0| 


1110100011 0fof Rn | R Wwomoh]lfo 1] R | 


T1 variant 


STLEXH{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 


Decode for this encoding 


d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 
if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t then UNPREDICTABLE; 
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CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the destination general-purpose register into which the status result of the store exclusive is 
written, encoded in the "Rd" field. The value returned is: 
Q If the operation updates memory. 
I If the operation fails to update memory. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Aborts and alignment 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated 

° <Rd> is not updated. 


A non word-aligned memory address causes an Alignment fault Data Abort exception to be generated, subject to 
the following rules: 


° If AArch32.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
s Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch32.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
if AArch32.ExclusiveMonitorsPass(address,2) then 
MemO[address, 2] = R[t]<15:0>; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4587 
ID070919 Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


R[d] = ZeroExtend('@'); 
else 
R[d] = ZeroExtend('1'); 
Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.223 STLH 


ARM DDI 0487E.a 
ID070919 


Store-Release Halfword stores a halfword from a register to memory. The instruction also has memory ordering 
semantics as described in Load-Acquire, Store-Release on page E2-3828. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 


information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 10 9 8|7 6 5 4|3 0| 


Peat foo o 1 tis fo] R wmmamo]o] oo 1] rR | 


cond 


A1 variant 


STLH{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


1110100011 ojo} R | RM Masfofo tama) 


T1 variant 


STLH{<c>}{<q>} <Rt>, [<Rn>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); 
if t == 15 || n == 15 then UNPREDICTABLE; 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
MemO[address, 2] = R[t]<15:0>; 
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Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


F5-4590 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.224 STM, STMIA, STMEA 


ARM DDI 0487E.a 
ID070919 


Store Multiple (Increment After, Empty Ascending) stores multiple registers to consecutive memory locations using 
an address from a base register. The consecutive memory locations start at this address, and the address just above 
the last of those locations can optionally be written back to the base register. 


The lowest-numbered register is loaded from the lowest memory address, through to the highest-numbered register 
from the highest memory address. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


Armv8.2 permits the deprecation of some Store Multiple ordering behaviors in AArch32 state, for more information 
see ARMv8.2-LSMAOC. For details of related system instructions see STM (User registers). 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | o| 
em [1 0 0]o]4]o]wjo] Ro register list 
cond 
A1 variant 


STM{IA}{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
STMEA{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Empty Ascending stack 


Decode for this encoding 


n = UInt(Rn); registers = register_list; wback = (W == '1'); 
if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers stored. 


Ifn == 15 && wback, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

e The instruction executes as NOP. 

° The instruction executes without writeback of the base address. 

° The instruction executes with writeback to the PC. The instruction is handled as described in Using R15 on 


page K1-7607. 
T1 
|15 1413 12|1110 817 | 0 | 


110 ojo] R | register_list 


T1 variant 


STM{IA}{<c>}{<q>} <Rn>!, <registers> // Preferred syntax 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4591 
Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4592 


STMEA{<c>}{<q>} <Rn>!, <registers> // Alternate syntax, Empty Ascending stack 


Decode for this encoding 


n = UInt(Rn); registers = 'Q0000000':register_list; wback = TRUE; 
if BitCount(registers) < 1 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
e The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers stored. 


Ifn == 15 && whack, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

. The instruction executes without writeback of the base address. 

° The instruction executes with writeback to the PC. The instruction is handled as described in Using R15 on 


page K1-7607. 
T2 


[15 1413 12/1110 9 8|7 6 5 4|3 0|/151413 | | | 0| 


77040 ojo rowo] Ra Jom roose o E 
P 


T2 variant 


STM{IA}{<c>}.W <Rn>{!}, <registers> // Preferred syntax, if <Rn>, '!' and <registers> can be represented 
in T1 

STMEA{<c>}.W <Rn>{!}, <registers> // Alternate syntax, Empty Ascending stack, if <Rn>, 
<registers> can be represented in T1 

STM{IA}{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 

STMEA{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Empty Ascending stack 


and 


Decode for this encoding 

n = UInt(Rn); registers = P:M:register_list; wback = (W == '1'); 
if n == 15 || BitCount(registers) < 2 then UNPREDICTABLE; 

if wback && registers<n> == '1' then UNPREDICTABLE; 


if registers<13> == '1' then UNPREDICTABLE; 
if registers<15> == '1' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 

If BitCount(registers) < 1, then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

° The instruction executes as NOP. 


° The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 
These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers stored. 
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If BitCount(registers) == 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

e The instruction executes as NOP. 

° The instruction executes as described, with no change to its behavior and no additional side effects. 

e The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. 


If wback && registers<n> == '1', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The store instruction executes but the value stored for the base register is UNKNOWN. 

If registers<13> == '1', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

s The instruction executes as NOP. 

° The store instruction performs all of the stores using the specified addressing mode but the value of R13 is 
UNKNOWN. 

If registers<15> == '1', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

- The instruction executes as NOP. 

° The store instruction performs all of the stores using the specified addressing mode but the value of R15 is 
UNKNOWN. 


Ifn == 15 && whack, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

. The instruction executes without writeback of the base address. 

° The instruction executes with writeback to the PC. The instruction is handled as described in Using R15 on 


page K1-7607. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


IA Is an optional suffix for the Increment After form. 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


! The address adjusted by the size of the data loaded is written back to the base register. If specified, 
it is encoded in the "W" field as 1, otherwise this field defaults to 0. 
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F5-4594 


<registers> For encoding A1: is a list of one or more registers to be stored, separated by commas and surrounded 
by { and }. 


The PC can be in the list. However, Arm deprecates the use of instructions that include the PC in 
the list. 


If base register writeback is specified, and the base register is not the lowest-numbered register in 
the list, such an instruction stores an UNKNOWN value for the base register. 


For encoding T1: is a list of one or more registers to be stored, separated by commas and surrounded 
by { and }. The registers in the list must be in the range RO-R7, encoded in the "register_list" field. 
If the base register is not the lowest-numbered register in the list, such an instruction stores an 
UNKNOWN value for the base register. 


For encoding T2: is a list of one or more registers to be stored, separated by commas and surrounded 
by { and }. 


The registers in the list must be in the range RO-R12, encoded in the "register_list" field, and can 
optionally contain the LR. If the LR is in the list, the "M" field is set to 1, otherwise it defaults to 0. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
for i = 0 to 14 
if registers<i> == '1' then 
if i == n && whack && i != LowestSetBit(registers) then 
MemA[address,4] = bits(32) UNKNOWN; // Only possible for encodings T1 and A1 
else 
MemA[address,4] = R[i]; 
address = address + 4; 
if registers<15> == '1' then // Only possible for encoding A1 
MemA[address,4] = PCStoreValue(); 
if wback then R[n] = R[n] + 4*BitCount(registers); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.225 STM (User registers) 


In an EL1 mode other than System mode, Store Multiple (User registers) stores multiple User mode registers to 
consecutive memory locations using an address from a base register. The PE reads the base register value normally, 
using the current mode to determine the correct Banked version of the register. This instruction cannot writeback to 
the base register. 


Store Multiple (User registers) is UNDEFINED in Hyp mode, and CONSTRAINED UNPREDICTABLE in User or System 
modes. 


Armv8.2 permits the deprecation of some Store Multiple ordering behaviors in AArch32 state, for more information 
see ARMv8.2-LSMAOC. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | o| 
em [1 0 ofp] R register list 
cond 
A1 variant 


STM{<amode>}{<c>}{<q>} <Rn>, <registers>^ 


Decode for this encoding 


n = UInt(Rn); registers = register_list; increment = (U == '1'); wordhigher = (P == U); 
if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<amode> is one of: 

DA Decrement After. The consecutive memory addresses end at the address in the base 
register. Encoded as P = 0, U = 0. 

ED Empty Descending. For this instruction, a synonym for DA. 

DB Decrement Before. The consecutive memory addresses end one word below the address 
in the base register. Encoded as P = 1, U = 0. 

FD Full Descending. For this instruction, a synonym for DB. 

IA Increment After. The consecutive memory addresses start at the address in the base 
register. This is the default. Encoded as P = 0, U = 1. 

EA Empty Ascending. For this instruction, a synonym for IA. 

IB Increment Before. The consecutive memory addresses start one word above the address 
in the base register. Encoded as P= 1,U = 1. 
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F5-4596 


<C> 
<q> 
<Rn> 


<registers> 


FA Full Ascending. For this instruction, a synonym for IB. 
See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the general-purpose base register, encoded in the "Rn" field. 


Is a list of one or more registers, separated by commas and surrounded by { and }. It specifies the 
set of registers to be stored by the STM instruction. The registers are stored with the lowest-numbered 
register to the lowest memory address, through to the highest-numbered register to the highest 
memory address. See also Encoding of lists of general-purpose registers and the PC on 


page F2-3914. 


Operation 


if Conditi 
Encodi 


onPassed() then 
ngSpecificOperations(); 


if PSTATE.EL == EL2 then 
UNDEFINED; 


elsif 


PSTATE.M IN {M32_User,M32_System} then 


UNPREDICTABLE; 


else 


length = 4«BitCount(registers); 

address = if increment then R[n] else R[n]-length; 
if wordhigher then address = address+4; 

for i = 0 to 14 


if registers<i> == '1' then // Store User mode register 
MemA[address,4] = Rmode[i, M32_User]; 
address = address + 4; 


if registers<15> == '1' then 


MemA[address,4] = PCStoreValue(); 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.M IN {M32_User,M32_System}, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. 


Operatio 


nal information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.226 STMDA, STMED 


ARM DDI 0487E.a 
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Store Multiple Decrement After (Empty Descending) stores multiple registers to consecutive memory locations 
using an address from a base register. The consecutive memory locations end at this address, and the address just 
below the lowest of those locations can optionally be written back to the base register. 


The lowest-numbered register is loaded from the lowest memory address, through to the highest-numbered register 
from the highest memory address. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


Armv8.2 permits the deprecation of some Store Multiple ordering behaviors in AArch32 state, for more information 
see ARMv8.2-LSMAOC. For details of related system instructions see STM (User registers). 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | o| 
em [1 0 o]ojo]o|wjo] Ro | register list 
cond 
A1 variant 


STMDA{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
STMED{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Empty Descending stack 


Decode for this encoding 


n = UInt(Rn); registers = register_list; wback = (W == '1'); 
if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


a The instruction is UNDEFINED. 
° The instruction executes as NOP. 
7 The instruction targets an unspecified set of registers. These registers might include R15. If the instruction 


specifies writeback, the modification to the base address on writeback might differ from the number of 
registers stored. 


Ifn == 15 && whack, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

. The instruction executes as NOP. 

. The instruction executes without writeback of the base address. 

° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
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<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


! The address adjusted by the size of the data loaded is written back to the base register. If specified, 
it is encoded in the "W" field as 1, otherwise this field defaults to 0. 


<registers> Isa list of one or more registers to be stored, separated by commas and surrounded by { and }. 


The PC can be in the list. However, Arm deprecates the use of instructions that include the PC in 
the list. 


If base register writeback is specified, and the base register is not the lowest-numbered register in 
the list, such an instruction stores an UNKNOWN value for the base register. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n] - 4«BitCount(registers) + 4; 
for i =0 to 14 
if registers<i> == '1' then 
if i == n && whack && i != LowestSetBit(registers) then 
MemA[Laddress,4] = bits(32) UNKNOWN; 
else 
MemA[address, 4] 
address = address + 4; 
if registers<15> == '1' then 
MemA[address,4] = PCStoreValue(); 
if wback then R[n] = R[n] - 4*BitCount(registers); 


RL]; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.227 STMDB, STMFD 


Store Multiple Decrement Before (Full Descending) stores multiple registers to consecutive memory locations 
using an address from a base register. The consecutive memory locations end just below this address, and the 
address of the first of those locations can optionally be written back to the base register. 


The lowest-numbered register is loaded from the lowest memory address, through to the highest-numbered register 
from the highest memory address. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


Armv8.2 permits the deprecation of some Store Multiple ordering behaviors in AArch32 state, for more information 
see ARMv8.2-LSMAOC. For details of related system instructions see STM (User registers). 


This instruction is used by the alias PUSH (multiple registers). See Alias conditions on page F5-4601 for details of 
when each alias is preferred. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | o| 
emm [1 0 o]t]o]o]wjo] Ro | register list 
cond 
A1 variant 


STMDB{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
STMFD{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Full Descending stack 


Decode for this encoding 


n = UInt(Rn); registers = register_list; wback = (W == '1'); 
if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
° The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers stored. 


T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0\151413 | | | 0 | 


Ti 7070 0]1 oowoo] Ra [Ol] regse o 
P 


T1 variant 


STMDB{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
STMFD{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Full Descending stack 
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F5-4600 


Decode for this encoding 


n = UInt(Rn); registers = P:M:register_list; whack = (W == '1'); 
if n == 15 || BitCount(registers) < 2 then UNPREDICTABLE; 

if whack && registers<n> == '1' then UNPREDICTABLE; 

if registers<13> == '1' then UNPREDICTABLE; 

if registers<15> == '1' then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. If the instruction specifies writeback, the modification to the base address 
on writeback might differ from the number of registers stored. 


If wback && registers<n> == '1', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

. The store instruction executes but the value stored for the base register is UNKNOWN. 


If BitCount(registers) == 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

. The instruction executes as described, with no change to its behavior and no additional side effects. 

e The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. 


If registers<13> == '1', then one of the following behaviors must occur: 

: The instruction is UNDEFINED. 

è The instruction executes as NOP. 

$ The instruction executes as described, with no change to its behavior and no additional side effects. 

° The store instruction performs all of the stores using the specified addressing mode but the value of R13 is 
UNKNOWN. 

If registers<15> == '1', then one of the following behaviors must occur: 

è The instruction is UNDEFINED. 

$ The instruction executes as NOP. 

° The store instruction performs all of the stores using the specified addressing mode but the value of R15 is 
UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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Alias conditions 





Alias of variant is preferred when 
PUSH (multiple registers) T1 W == '1' && Rn == '1101' && BitCount(M:register_list) > 1 
PUSH (multiple registers) Al W == '1' && Rn == '1101' && BitCount(register_list) > 1 





Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


! The address adjusted by the size of the data loaded is written back to the base register. If specified, 
it is encoded in the "W" field as 1, otherwise this field defaults to 0. 


<registers> For encoding A1: is a list of one or more registers to be stored, separated by commas and surrounded 
by { and }. 


The PC can be in the list. However, Arm deprecates the use of instructions that include the PC in 
the list. 


If base register writeback is specified, and the base register is not the lowest-numbered register in 
the list, such an instruction stores an UNKNOWN value for the base register. 


For encoding T1: is a list of one or more registers to be stored, separated by commas and surrounded 
by { and }. 


The registers in the list must be in the range RO-R12, encoded in the "register_list" field, and can 
optionally contain the LR. If the LR is in the list, the "M" field is set to 1, otherwise it defaults to 0. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n] - 4xBitCount(registers); 
for i = 0 to 14 
if registers<i> == '1' then 
if i == n && whack && i != LowestSetBit(registers) then 
MemA[address,4] = bits(32) UNKNOWN; // Only possible for encoding A1 
else 
MemA[address,4] = R[i]; 
address = address + 4; 
if registers<15> == '1' then // Only possible for encoding A1 
MemA[address,4] = PCStoreValue(); 
if wback then R[n] = R[n] - 4*BitCount(registers); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.228 


F5-4602 


STMIB, STMFA 


Store Multiple Increment Before (Full Ascending) stores multiple registers to consecutive memory locations using 
an address from a base register. The consecutive memory locations start just above this address, and the address of 
the last of those locations can optionally be written back to the base register. 


The lowest-numbered register is loaded from the lowest memory address, through to the highest-numbered register 
from the highest memory address. See also Encoding of lists of general-purpose registers and the PC on 
page F2-3914. 


Armv8.2 permits the deprecation of some Store Multiple ordering behaviors in AArch32 state, for more information 
see ARMv8.2-LSMAOC. For details of related system instructions see STM (User registers). 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 | | | o| 
emm [1 0 0]t]1]o]wjo] R register list 
cond 
A1 variant 


STMIB{<c>}{<q>} <Rn>{!}, <registers> // Preferred syntax 
STMFA{<c>}{<q>} <Rn>{!}, <registers> // Alternate syntax, Full Ascending stack 


Decode for this encoding 


n = UInt(Rn); registers = register_list; wback = (W == '1'); 
if n == 15 || BitCount(registers) < 1 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If BitCount(registers) < 1, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction operates as an STM with the same addressing mode but targeting an unspecified set of registers. 


These registers might include R15. 


Ifn == 15 && wback, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 

. The instruction executes as NOP. 

. The instruction executes without writeback of the base address. 

° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


! The address adjusted by the size of the data loaded is written back to the base register. If specified, 
it is encoded in the "W" field as 1, otherwise this field defaults to 0. 


<registers> Isa list of one or more registers to be stored, separated by commas and surrounded by { and }. 


The PC can be in the list. However, Arm deprecates the use of instructions that include the PC in 
the list. 


If base register writeback is specified, and the base register is not the lowest-numbered register in 
the list, such an instruction stores an UNKNOWN value for the base register. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n] + 4; 
for i = 0 to 14 
if registers<i> == '1' then 
if i == n && whack && i != LowestSetBit(registers) then 
MemA[address,4] = bits(32) UNKNOWN; 
else 
MemA[address,4] = R[i]; 
address = address + 4; 
if registers<15> == '1' then 
MemA[address,4] = PCStoreValue(); 
if wback then R[n] = R[n] + 4«BitCount(registers) ; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.229 STR (immediate) 


Store Register (immediate) calculates an address from a base register value and an immediate offset, and stores a 
word from a register to memory. It can use offset, post-indexed, or pre-indexed addressing. For information about 
memory accesses see Memory accesses on page F2-3913. 


This instruction is used by the alias PUSH (single register). See Alias conditions on page F5-4607 for details of 
when each alias is preferred. 


A1 
31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 | | 0 | 
[erm [o oP] en | | o m o E 


cond 


Offset variant 
Applies when P == 1 && W == 


STR{<c>}{<q>} <Rt>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == 0 && W == 


STR{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 


STR{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 
if P == '@' && W == '1' then SEE "STRT"; 
t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 


index = (P == '1'); add = (U == '1'); whack = (P == '0') || (W == '1'); 
if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction executes without writeback of the base address. 
° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


T1 

\15 14 13 12/11 10 | 65 |32 0] 
fo + t]ofo] mms Rn | R] 
T1 variant 


STR{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 


t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm5:'00', 32); 
index = TRUE; add = TRUE; wback = FALSE; 


T2 

|15 14 13 12/1110 8|7 | 0 | 
tooo] R | imm | 

T2 variant 


STR{<c>}{<q>} <Rt>, [SP{, #{+}<imm>}] 


Decode for this encoding 


t = UInt(Rt); n = 13; imm32 = ZeroExtend(imm8:'00', 32); 
index = TRUE; add = TRUE; wback = FALSE; 


T3 
|15 14 13 1211110 9 8|7 6 5 4/3 0115 12111 | | 0| 
Tit11000%]1 oo] em 
Rn 
T3 variant 


STR{<c>}.W <Rt>, [<Rn> {, #{+}<imm>}] // <Rt>, <Rn>, <imm> can be represented in T1 or T2 
STR{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 
if Rn == '1111' then UNDEFINED; 
t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 


index = TRUE; add = TRUE; wback = FALSE; 
if t == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
: The instruction executes as NOP. 
° The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4606 


T4 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0| 


manaa oooop ool enn | Rt pP me —is 
Rn 





Offset variant 
Applies when P == 1 & U == 0 && W == 


STR{<c>}{<q>} <Rt>, [<Rn> {, #-<imm>}] 


Post-indexed variant 
Applies when P == 0 && W == 


STR{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 


STR{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if P == '1' & U == '1' && W == '@' then SEE "STRT"; 

if Rn == '1111' || (P == '@' && W == '@') then UNDEFINED; 
t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); 
index = (P == '1'); add = (U == '1'); wback = (W = '1'); 
if t == 15 || (whack && n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 

. The instruction executes as NOP. 

° The instruction executes without writeback of the base address. 

° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 


Ift == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
: The instruction executes as NOP. 
° The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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Alias conditions 





Alias 


PUSH (single register) 


PUSH (single register) 


of variant is preferred when 


Al (pre-indexed) P == '1' & U == '0' && W == '1' && Rn == '1101' && imm12 == '000000000100' 


T4 (pre-indexed) Rn == '1101' && U == 'Q' && imm8 == '00000100' 





ARM DDI 0487E.a 
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Assembler symbols 


<C> 
<q> 


<Rt> 


<Rn> 


+/- 


<imm> 


See Standard assembler syntax fields on page F2-3908. 


See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 


can be used, but this is deprecated. 


For encoding T1, T2, T3 and T4: is the general-purpose register to be transferred, encoded in the 


"Rt" field. 


For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 


in the offset variant, but this is deprecated. 


For encoding T1, T3 and T4: is the general-purpose base register, encoded in the "Rn" field. 


Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 


encoded in the "U" field. It can have the following values: 
- when U = 0 


+ when U = 1 


Specifies the offset is added to the base register. 


For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 


0 if omitted, and encoded in the "imm12" field. 


For encoding T1: is the optional positive unsigned immediate byte offset, a multiple of 4, in the 


range 0 to 124, defaulting to 0 and encoded in the "imm5" field as <imm>/4. 


For encoding T2: is the optional positive unsigned immediate byte offset, a multiple of 4, in the 


range 0 to 1020, defaulting to 0 and encoded in the "imm8" field as <imm>/4. 


For encoding T3: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 


defaulting to 0 and encoded in the "Imm12" field. 


For encoding T4: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 


if omitted, and encoded in the "imm8" field. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 


else 


if ConditionPassed() then 


EncodingSpecificOperations(); 

offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
MemU[address,4] = if t == 15 then PCStoreValue() else R[t]; 
if wback then R[n] = offset_addr; 


if ConditionPassed() then 


EncodingSpecificOperations(); 

offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
MemU[address,4] = R[t]; 

if wback then R[n] = offset_addr; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.230 STR (register) 


Store Register (register) calculates an address from a base register value and an offset register value, stores a word 
from a register to memory. The offset register value can optionally be shifted. For information about memory 
accesses see Memory accesses on page F2-3913. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 |7 6 5 4|3 0 | 
| sii fo 1 afPfufofwiof Rn | Rt | imms __|stypefo] Rm | 


cond 


Offset variant 
Applies when P == 1 & W == 


STR{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>{, <shift>}] 


Post-indexed variant 
Applies when P == 0 & W == 


STR{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm>{, <shift>} 


Pre-indexed variant 
Applies when P == 1 & W == 


STR{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>{, <shift>}]! 


Decode for all variants of this encoding 


if P == '0' && W == '1' then SEE "STRT"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); wback = (P == 'Q') || (W == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 

if m == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If wback && n == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The instruction executes without writeback of the base address. 
° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


T1 


[15 1413 12/1110 9 8| 65 |32 o0] 


o1 o tojofo] km | Rn | R 


T1 variant 


STR{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 


index = TRUE; add = TRUE; wback = FALSE; 
(shift t, shift n) = (SRType_LSL, 0); 


T2 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


[11441000 0{1 ojo] 1111 | Rt jo 0000 Ofimm2] Rm | 
Rn 


T2 variant 


STR{<c>}.W <Rt>, [<Rn>, {+}<Rm>] // <Rt>, <Rn>, <Rm> can be represented in T1 
STR{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>{, LSL #<imm>}] 


Decode for this encoding 


if Rn == '1111' then UNDEFINED; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = TRUE; add = TRUE; wback = FALSE; 

(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 

if t == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 


can be used, but this is deprecated. 


For encoding T1 and T2: is the general-purpose register to be transferred, encoded in the "Rt" field. 
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<Rn> 


+/- 


+ 
<Rm> 


<shif 


<imm> 


Ope 


if C 


Ope 
If CP 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 
in the offset variant, but this is deprecated. 


For encoding T1 and T2: is the general-purpose base register, encoded in the "Rn" field. 
Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 


- when U = 0 


+ when U = 1 
Specifies the index register is added to the base register. 
Is the general-purpose index register, encoded in the "Rm" field. 


t> The shift to apply to the value read from <Rm>. If absent, no shift is applied. Otherwise, see Shifts 
applied to a register on page F2-3911. 


If present, the size of the left shift to apply to the value from <Rm>, in the range 1-3. <imm> is encoded 
in imm2. If absent, no shift is specified and imm2 is encoded as 0b00. 


ration for all encodings 


onditionPassed() then 
EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if index then offset_addr else R[n]; 
if t == 15 then // Only possible for encoding A1 
data = PCStoreValue(); 
else 
data = R[t]; 
MemU[address,4] = data; 
if wback then R[n] = offset_addr; 


rational information 


SR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.231 


F5-4612 


STRB (immediate) 


Store Register Byte (immediate) calculates an address from a base register value and an immediate offset, and stores 
a byte from a register to memory. It can use offset, post-indexed, or pre-indexed addressing. For information about 


memory accesses see Memory accesses on page F2-3913. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 | | 0 | 
| tsi fo 1 ofPjufajwiof Rn | R | imm2— 


cond 


Offset variant 
Applies when P == 1 && W == 


STRB{<c>}{<q>} <Rt>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == @ && W == 


STRB{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 


STRB{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if P == 'Q' && W == '1' then SEE "STRBT"; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 

index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
if t == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If t == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


If wback && n == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The instruction executes without writeback of the base address. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


è The instruction uses the addressing mode described in the equivalent immediate offset instruction. 
T1 


|15 14 13 12/11 10 | 65 |32 0l 


[o 1 filo] imm5 | Rn | Rt | 


T1 variant 


STRB{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 


t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm5, 32); 
index = TRUE; add = TRUE; wback = FALSE; 


T2 
|15 14 13 1211110 9 8|7 6 5 4/3 0 |15 12111 | | 0| 
1111100010 ojo] em 
Rn 
T2 variant 


STRB{<c>}.W <Rt>, [<Rn> {, #{+}<imm>}] // <Rt>, <Rn>, <imm> can be represented in T1 
STRB{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 
if Rn == '1111' then UNDEFINED; 
t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 


index = TRUE; add = TRUE; wback = FALSE; 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If t == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 
T3 
|15 14 13 12|11 10 9 8|7 6 5 4/3 0 |15 12|11 10 9 8|7 | o| 


11111000000) emm | R [Pow me —i| 
Rn 


Offset variant 
Applies when P == 1 & U == 0 && W == 


STRB{<c>}{<q>} <Rt>, [<Rn> {, #-<imm>}] 
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F5-4614 


Post-indexed variant 
Applies when P == @ && W == 


STRB{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 


STRB{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if P == '1' & U == '1' && W == '@' then SEE "STRBT"; 

if Rn == '1111' || (P == '@' && W == 'Q') then UNDEFINED; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); 

index = (P == '1'); add = (U == '1'); whack = (W == '1'); 

if t == 15 || (whack && n == t) then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If t == 15, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


If wback && n == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction executes without writeback of the base address. 

° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 


in the offset variant, but this is deprecated. 


For encoding T1, T2 and T3: is the general-purpose base register, encoded in the "Rn" field. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
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Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 


- when U = 0 

+ when U = 1 

Specifies the offset is added to the base register. 

For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 


0 if omitted, and encoded in the "imm12" field. 


For encoding T1: is an optional 5-bit unsigned immediate byte offset, in the range 0 to 31, defaulting 
to 0 and encoded in the "imm5" field. 


For encoding T2: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 
defaulting to 0 and encoded in the "Imm12" field. 


For encoding T3: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm8" field. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 


else 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
MemU[address,1] = R[t]<7:0>; 
if wback then R[n] = offset_addr; 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
MemU[address,1] = R[t]<7:0>; 
if wback then R[n] = offset_addr; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.232 STRB (register) 


Store Register Byte (register) calculates an address from a base register value and an offset register value, and stores 
a byte from a register to memory. The offset register value can optionally be shifted. For information about memory 
accesses see Memory accesses on page F2-3913. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 |7 6 5 4|3 0 | 
[_!=1111 fo 1 afPfufajwiof Rn | Rt | imm5 | stypefo] Rm | 


cond 


Offset variant 
Applies when P == 1 & W == 


STRB{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>{, <shift>}] 


Post-indexed variant 
Applies when P == 0 && W == 


STRB{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm>{, <shift>} 


Pre-indexed variant 
Applies when P == 1 & W == 


STRB{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>{, <shift>}]! 


Decode for all variants of this encoding 


if P == '0' && W == '1' then SEE "STRBT"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); whack = (P == '0') || (W == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 

if t == 15 || m == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


If wback && n == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction executes without writeback of the base address. 
F5-4616 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 
T1 


15 1413 1211110 9 8| 65 132 ol 


[o 1 0 tfofifo} Rm | Rn | Rt | 


T1 variant 


STRB{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 


index = TRUE; add = TRUE; wback = FALSE; 
(shift_t, shift n) = (SRType_LSL, 0); 


T2 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


111110000000] em | Rt [00000 0jmm] Rm | 
Rn 


T2 variant 


STRB{<c>}.W <Rt>, [<Rn>, {+}<Rm>] // <Rt>, <Rn>, <Rm> can be represented in T1 
STRB{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>{, LSL #<imm>}] 


Decode for this encoding 


if Rn == '1111' then UNDEFINED; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = TRUE; add = TRUE; wback = FALSE; 

(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 

if t == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
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F5-4618 


<Rn> 


+/- 


+ 
<Rm> 


<shift> 


<imm> 


For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 
in the offset variant, but this is deprecated. 


For encoding T1 and T2: is the general-purpose base register, encoded in the "Rn" field. 
Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 


- when U = 0 


+ when U = 1 
Specifies the index register is added to the base register. 
Is the general-purpose index register, encoded in the "Rm" field. 


The shift to apply to the value read from <Rm>. If absent, no shift is applied. Otherwise, see Shifts 
applied to a register on page F2-3911. 


If present, the size of the left shift to apply to the value from <Rm>, in the range 1-3. <imm> is encoded 
in imm2. If absent, no shift is specified and imm2 is encoded as 0b00. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if index then offset_addr else R[n]; 
MemU[address,1] = R[t]<7:>; 
if wback then R[n] = offset_addr; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.233 STRBT 
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Store Register Byte Unprivileged stores a byte from a register to memory. For information about memory accesses 
see Memory accesses on page F2-3913. 


The memory access is restricted as if the PE were running in User mode. This makes no difference if the PE is 
actually running in User mode. 


STRBT is UNPREDICTABLE in Hyp mode. 


The T32 instruction uses an offset addressing mode, that calculates the address used for the memory access from a 
base register value and an immediate offset, and leaves the base register unchanged. 


The A32 instruction uses a post-indexed addressing mode, that uses a base register value as the address for the 
memory access, and calculates a new address from a base register value and an offset and writes it back to the base 
register. The offset can be an immediate value or an optionally-shifted register value. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 | | o| 
Cem joi opojno] en | R o ë ë m ë E 
cond 
A1 variant 


STRBT{<c>}{<q>} <Rt>, [<Rn>] {, #{+/-}<imm>} 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); postindex = TRUE; add = (U == '1'); 


register_form = FALSE; imm32 = ZeroExtend(imm12, 32); 
if t == 15 || n == 15 || n == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Ifn = t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 


i The instruction is treated as if bit[24] == 1 and bit[21] == 0. The instruction uses immediate offset addressing 
with the base register as PC, without writeback. 
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A2 


31 28|27 26 25 24|23 22 21 20|19 16/15 12|11 7 6 5 4|3 0 | 


Perm [oouo] Rn [Rt | mmd_[stype]o] Rm 


cond 
A2 variant 
STRBT{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm>{, <shift>} 
Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); postindex = TRUE; add = (U == '1'); 


register_form = TRUE; (shift_t, shift_n) = DecodeImmShift(stype, immS); 
if t == 15 || n == 15 || n == t || m == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
è The instruction executes as NOP. 
° The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Ifn == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 


5 The instruction is treated as if bit[24] == 1 and bit[21] == 0. The instruction uses immediate offset addressing 
with the base register as PC, without writeback. 


T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0 | 


11111000 0/0 ojoj 11 | Rte [1170] imm | 
Rn 


T1 variant 


STRBT{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 
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Decode for this encoding 
if Rn == '1111' then UNDEFINED; 
t = UInt(Rt); n = UInt(Rn); postindex = FALSE; add = TRUE; 


register_form = FALSE; imm32 = ZeroExtend(imm8, 32); 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
° The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the general-purpose register to be transferred, encoded in the "Rt" field. The PC 


can be used, but this is deprecated. 


For encoding A2 and T1: is the general-purpose register to be transferred, encoded in the "Rt" field. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 

+/- For encoding A1: specifies the offset is added to or subtracted from the base register, defaulting to 
+ if omitted and encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 


For encoding A2: specifies the index register is added to or subtracted from the base register, 
defaulting to + if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 
<Rm> Is the general-purpose index register, encoded in the "Rm" field. 
<shift> The shift to apply to the value read from <Rm>. If absent, no shift is applied. Otherwise, see Shifts 


applied to a register on page F2-3911. 
+ Specifies the offset is added to the base register. 


<imm> For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 
0 if omitted, and encoded in the "imm12" field. 


For encoding T1: is an optional 8-bit unsigned immediate byte offset, in the range 0 to 255, 
defaulting to 0 and encoded in the "imm8" field. 


Operation for all encodings 
if ConditionPassed() then 


if PSTATE.EL == EL2 then UNPREDICTABLE; // Hyp mode 
EncodingSpecificOperations(); 
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F5-4622 


offset = if register_form then Shift(R[m], shift_t, shift_n, PSTATE.C) else imm32; 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 

address = if postindex then R[n] else offset_addr; 

MemU_unpriv[address,1] = R[t]<7:>; 

if postindex then R[n] = offset_addr; 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == EL2, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The instruction executes as STRB (immediate). 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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Store Register Dual (immediate) calculates an address from a base register value and an immediate offset, and stores 
two words from two registers to memory. It can use offset, post-indexed, or pre-indexed addressing. For information 
about memory accesses see Memory accesses on page F2-3913. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 
| !'=1111 [o o ofPfulajwiof Rn | Rt | imman [tt 1] 4] imma | 


cond 


Offset variant 
Applies when P == 1 & W == 


STRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == 0 & W == 


STRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W == 


STRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if Rt<@> == '1' then UNPREDICTABLE; 

t = UInt(Rt); t2 = t+1; n = UInt(Rn); imm32 = ZeroExtend(imm4H:imm4L, 32); 
index = (P == '1'); add = (U == '1'); whack = (P == '0') || (W == '1'); 

if P == '0' && W == '1' then UNPREDICTABLE; 

if whack && (n == 15 || n == t || n == t2) then UNPREDICTABLE; 

if t2 == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15 || t2 == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


If whack && (n == t || n == t2), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction executes without writeback of the base address. 
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° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 

If Rt<@> == '1', then one of the following behaviors must occur: 

g The instruction is UNDEFINED. 

: The instruction executes as NOP. 

s The instruction executes with the additional decode: t<0> = '0'. 

$ The instruction executes with the additional decode: t2 = t. 

° The instruction executes as described, with no change to its behavior and no additional side-effects. This does 


not apply when Rt =='1111'. 


IfP == 'Q' && W == '1', then one of the following behaviors must occur: 
z The instruction is UNDEFINED. 
` The instruction executes as NOP. 
° The instruction executes as an LDRD using one of offset, post-indexed, or pre-indexed addressing. 
T1 
|15 14 13 12/1110 9 8|7 6 5 4/3 0 |15 12|11 8/7 | 0| 


T1107 0 0PlUlt wo emm | Rt | Re | me E) 
Rn 


Offset variant 
Applies when P == 1 && W == 


STRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == @ && W == 


STRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 1. 


STRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if P == '0' && W == 'Q' then SEE "Related encodings"; 

t = UInt(Rt); t2 = UInt(Rt2); n = UInt(Rn); imm32 = ZeroExtend(imm8:'Q0', 32); 

index = (P == '1'); add = (U == '1'); whack = (W == '1'); 

if whack && (n == t || n == t2) then UNPREDICTABLE; 

if n == 15 || t == 15 || t2 == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15 || t2 == 15, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
s The instruction executes as NOP. 
° The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 
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If whack && (n == t || n == t2), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction executes without writeback of the base address. 

° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related encodings: Load/store dual, load/store exclusive, load-acquire/store-release, and table branch on 
page F3-3975. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 


This register must be even-numbered and not R14. 

For encoding T1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 
<Rt2> For encoding A1: is the second general-purpose register to be transferred. This register must be 

<R(t+1)>. 

For encoding T1: is the second general-purpose register to be transferred, encoded in the "Rt2" field. 
<Rn> For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 

in the offset variant, but this is deprecated. 


For encoding T1: is the general-purpose base register, encoded in the "Rn" field. 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

<imm> For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 


if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is the unsigned immediate byte offset, a multiple of 4, in the range 0 to 1020, 
defaulting to 0 if omitted, and encoded in the "imm8" field as <imm>/4. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
if address == Align(address, 8) then 
bits(64) data; 
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if BigEndian() then 
data<63:32> = R[t]; 
data<31:0> = R[t2]; 


else 
data<31:0> = R[t]; 
data<63:32> = R[t2]; 
MemA[address,8] = data; 


else 





MemA[address,4] = R[t]; 
MemA[address+4,4] = R[t2]; 
if whack then R[n] = offset_addr; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


F5-4626 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.235  STRD (register) 
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Store Register Dual (register) calculates an address from a base register value and a register offset, and stores two 
words from two registers to memory. It can use offset, post-indexed, or pre-indexed addressing. For information 


about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 





cond 


Offset variant 
Applies when P == 1 && W == 


STRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>, {+/-}<Rm>] 


Post-indexed variant 
Applies when P == @ && W == 


STRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>], {+/-}<Rm> 


Pre-indexed variant 
Applies when P == 1 && W == 


STRD{<c>}{<q>} <Rt>, <Rt2>, [<Rn>, {+/-}<Rm>]! 


Decode for all variants of this encoding 


if Rt<@> == '1' then UNPREDICTABLE; 

t = UInt(Rt); t2 = t+1; n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); whack = (P == 'Q') || (W == '1'); 
if P == 'Q' && W == '1' then UNPREDICTABLE; 

if t2 == 15 || m == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t || n == t2) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15 || t2 == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


If whack && (n == t || n == t2), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction executes without writeback of the base address. 
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F5-4628 


° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 

If Rt<@> == '1', then one of the following behaviors must occur: 

g The instruction is UNDEFINED. 

: The instruction executes as NOP. 

s The instruction executes with the additional decode: t<0> = '0'. 

$ The instruction executes with the additional decode: t2 = t. 

° The instruction executes as described, with no change to its behavior and no additional side-effects. This does 


not apply when Rt =='1111'. 


IfP == 'Q' && W == '1', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

` The instruction executes as NOP. 

. The instruction executes with the additional decode: P ='1'; W ='0'. 
. The instruction executes with the additional decode: P ='1'; W ='1'. 
° The instruction executes with the additional decode: P = '0'; W ='0'. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the first general-purpose register to be transferred, encoded in the "Rt" field. This register must 


be even-numbered and not R14. 
<Rt2> Is the second general-purpose register to be transferred. This register must be <R(t+1)>. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. The PC can be used in the offset 
variant, but this is deprecated. 


+/- Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 

<Rm> Is the general-purpose index register, encoded in the "Rm" field. 

Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
offset_addr = if add then (R[n] + R[m]) else (R[n] - R[m]); 
address = if index then offset_addr else R[n]; 
if address == Align(address, 8) then 
bits(64) data; 
if BigEndian() then 
data<63:32> = R[t]; 
data<31:0> = R[t2]; 
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else 
data<31:0> = R[t]; 
data<63:32> = R[t2]; 
MemA[address,8] = data; 
else 
MemA[address,4] = R[t]; 
MemA[address+4,4] = R[t2]; 
if wback then R[n] = offset_addr; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 


ARM DDI 0487E.a 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4629 
IDO70919 


Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.236 


F5-4630 


STREX 


Store Register Exclusive calculates an address from a base register value and an immediate offset, stores a word 
from a register to the calculated address if the PE has exclusive access to the memory at that address, and returns a 
status value of 0 if the store was successful, or of 1 if no store was performed. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Derm [ooo 710 ojo] en | Rd Ooo R 


cond 


A1 variant 


STREX{<c>}{<q>} <Rd>, <Rt>, [<Rn> {, {#}<imm>}] 
Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); imm32 = Zeros(32); // Zero offset 


if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 
T1 
|15 14 13 12|1110 9 8|7 6 5 4/3 015 12|11 8/7 | 0| 


1110100001 ofof Rn | R | Ri | imma | 


T1 variant 


STREX{<c>}{<q>} <Rd>, <Rt>, [<Rn> {, #<imm>}] 


Decode for this encoding 


d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8:'00', 32); 
if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
if d == n || d == t then UNPREDICTABLE; 
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CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the destination general-purpose register into which the status result of the store exclusive is 
written, encoded in the "Rd" field. The value returned is: 
Q If the operation updates memory. 
I If the operation fails to update memory. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 

<imm> For encoding A1: the immediate offset added to the value of <Rn> to calculate the address. <imm> can 


only be 0 or omitted. 


For encoding T1: the immediate offset added to the value of <Rn> to calculate the address. <imm> can 
be omitted, meaning an offset of 0. Values are multiples of 4 in the range 0-1020. 


Aborts and alignment 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

° <Rd> is not updated. 


A non word-aligned memory address causes an Alignment fault Data Abort exception to be generated, subject to 
the following rules: 


. If AArch32.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
° Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch32.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 
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Operation for all encodings 


if ConditionPassed() then 

EncodingSpecificOperations(); 

address = R[n] + imm32; 

if AArch32.ExclusiveMonitorsPass(address,4) then 
MemA[address,4] = R[t]; 
R[d] = ZeroExtend('@'); 

else 
R[d] = ZeroExtend('1'); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.237  STREXB 


Store Register Exclusive Byte derives an address from a base register value, stores a byte from a register to the 
derived address if the executing PE has exclusive access to the memory at that address, and returns a status value 
of 0 if the store was successful, or of 1 if no store was performed. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Derm [ooo 711 ojo] mn | Rd Ooo Rt 


cond 


A1 variant 


STREXB{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 
Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 


if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 
T1 
|15 14 13 12|1110 9 8|7 6 5 4/3 0|15 12/1110 9 8|7 6 5 4/3 0 | 


1110100011 0fof] Rn | R Wwwomaolo joo] Ri | 


T1 variant 


STREXB{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 


Decode for this encoding 


d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 
if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
if d == n || d == t then UNPREDICTABLE; 
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CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the destination general-purpose register into which the status result of the store exclusive is 
written, encoded in the "Rd" field. The value returned is: 
Q If the operation updates memory. 
I If the operation fails to update memory. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Aborts 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

° <Rd> is not updated. 


If AArch32.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation for all encodings 


if ConditionPassed() then 

EncodingSpecificOperations(); 

address = R[n]; 

if AArch32.ExclusiveMonitorsPass(address,1) then 
MemA[address,1] = R[t]<7:0>; 
R[d] = ZeroExtend('@'); 

else 
R[d] = ZeroExtend('1'); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.238 STREXD 


ARM DDI 0487E.a 
ID070919 


Store Register Exclusive Doubleword derives an address from a base register value, stores a 64-bit doubleword from 
two registers to the derived address if the executing PE has exclusive access to the memory at that address, and 
returns a status value of 0 if the store was successful, or of 1 if no store was performed. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Derm [ooo to 7jo] mn | Rd Ooo R 


cond 


A1 variant 


STREXD{<c>}{<q>} <Rd>, <Rt>, <Rt2>, [<Rn>] 
Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); t2 = t+1; n = UInt(Rn); 


if d == 15 || Rt<@> == '1' || t2 == 15 || n == 15 then UNPREDICTABLE; 
if d==n || d == t || d == t2 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 

° The instruction executes as NOP. 

° The instruction performs the store to an UNKNOWN address. 

If Rt<@> == '1', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as NOP. 

. The instruction executes with the additional decode: Rt<0> = '0'. 
e The instruction executes with the additional decode: t2 =t. 

. The instruction executes as described, with no change to its behavior and no additional side effects. 
IfRt == '1110', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as NOP. 


° The instruction is handled as described in Using R15 on page K1-7607. 
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F5-4636 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/11 8|7 6 5 4|3 0 | 


fatto; oooti oo] em | Rk | Re Jora Ro 


T1 variant 


STREXD{<c>}{<q>} <Rd>, <Rt>, <Rt2>, [<Rn>] 


Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); t2 = UInt(Rt2); n = UInt(Rn); 
if d == 15 || t == 15 || t2 == 15 || n == 15 then UNPREDICTABLE; 


// Armv8-A removes UNPREDICTABLE for R13 
if d == n || d == t || d == t2 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
: The instruction performs the store to an UNKNOWN address. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the destination general-purpose register into which the status result of the store exclusive is 
written, encoded in the "Rd" field. The value returned is: 
(] If the operation updates memory. 
1 If the operation fails to update memory. 


<Rd> must not be the same as <Rn>, <Rt>, or <Rt2>. 


<Rt> For encoding A1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 
<Rt> must be even-numbered and not R14. 


For encoding T1: is the first general-purpose register to be transferred, encoded in the "Rt" field. 


<Rt2> For encoding A1: is the second general-purpose register to be transferred. <Rt2> must be <R(t+1)>. 


For encoding T1: is the second general-purpose register to be transferred, encoded in the "Rt2" field. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
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Aborts and alignment 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

. <Rd> is not updated. 


A non doubleword-aligned memory address causes an Alignment fault Data Abort exception to be generated, 
subject to the following rules: 


° If AArch32.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
e Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch32.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
// Create doubleword to store such that R[t] will be stored at address and R[t2] at address+4. 
value = if BigEndian() then R[t]:R[t2] else R[t2]:R[t]; 
if AArch32.ExclusiveMonitorsPass(address,8) then 
MemA[address,8] = value; R[d] = ZeroExtend('Q'); 
else 
R[d] = ZeroExtend('1'); 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.239 


F5-4638 


STREXH 


Store Register Exclusive Halfword derives an address from a base register value, stores a halfword from a register 
to the derived address if the executing PE has exclusive access to the memory at that address, and returns a status 
value of 0 if the store was successful, or of 1 if no store was performed. 


For more information about support for shared memory see Synchronization and semaphores on page E2-3853. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Derm [ooo 71170] em | Ro (poo R 


cond 


A1 variant 


STREXH{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 
Decode for this encoding 
d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 


if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; 
if d == n || d == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 
T1 
|15 14 13 12|1110 9 8|7 6 5 4/3 0|15 12/1110 9 8|7 6 5 4/3 0 | 


1170700077 fof Rn | R mmm] fo 1] Ri | 


T1 variant 


STREXH{<c>}{<q>} <Rd>, <Rt>, [<Rn>] 


Decode for this encoding 


d = UInt(Rd); t = UInt(Rt); n = UInt(Rn); 
if d == 15 || t == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
if d == n || d == t then UNPREDICTABLE; 
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CONSTRAINED UNPREDICTABLE behavior 


Ifd == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifd == n, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction performs the store to an UNKNOWN address. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the destination general-purpose register into which the status result of the store exclusive is 
written, encoded in the "Rd" field. The value returned is: 
Q If the operation updates memory. 
I If the operation fails to update memory. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


Aborts and alignment 

If a synchronous Data Abort exception is generated by the execution of this instruction: 
° Memory is not updated. 

° <Rd> is not updated. 


A non halfword-aligned memory address causes an Alignment fault Data Abort exception to be generated, subject 
to the following rules: 


° If AArch32.ExclusiveMonitorsPass() returns TRUE, the exception is generated. 
s Otherwise, it is IMPLEMENTATION DEFINED whether the exception is generated. 


If AArch32.ExclusiveMonitorsPass() returns FALSE and the memory address, if accessed, would generate a 
synchronous Data Abort exception, it is IMPLEMENTATION DEFINED whether the exception is generated. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
address = R[n]; 
if AArch32.ExclusiveMonitorsPass(address,2) then 
MemA[address,2] = R[t]<15:0>; 
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R[d] = ZeroExtend('@'); 
else 
R[d] = ZeroExtend('1'); 
Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.240 STRH (immediate) 


ARM DDI 0487E.a 
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Store Register Halfword (immediate) calculates an address from a base register value and an immediate offset, and 
stores a halfword from a register to memory. It can use offset, post-indexed, or pre-indexed addressing. For 
information about memory accesses see Memory accesses on page F2-3913. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 
| !=1111 [o o ofPjulajwiof Rn | Rt | imman [it fo 1] 4] imma | 


cond 


Offset variant 
Applies when P == 1 & W == 


STRH{<c>}{<q>} <Rt>, [<Rn> {, #{+/-}<imm>}] 


Post-indexed variant 
Applies when P == 0 & W == 


STRH{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 & W == 


STRH{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if P == '0' && W == '1' then SEE "STRHT"; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm4H:imm4L, 32); 

index = (P == '1'); add = (U == '1'); whack = (P == '0') || (W == '1'); 
if t == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If t == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


If wback && n == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The instruction executes without writeback of the base address. 
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F5-4642 


è The instruction uses the addressing mode described in the equivalent immediate offset instruction. 
T1 


|15 14 13 12/11 10 | 65 |32 0l 


[1 0 0 ojo] imm5 | Rn | Rt | 


T1 variant 


STRH{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 


t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm5:'0', 32); 
index = TRUE; add = TRUE; wback = FALSE; 


T2 
|15 14 13 1211110 9 8|7 6 5 4/3 0 |15 12111 | | 0| 
Ti417000%)0 to] nM 
Rn 
T2 variant 


STRH{<c>}.W <Rt>, [<Rn> {, #{+}<imm>}] // <Rt>, <Rn>, <imm> can be represented in T1 
STRH{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 
if Rn == '1111' then UNDEFINED; 
t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm12, 32); 


index = TRUE; add = TRUE; wback = FALSE; 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If t == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 
T3 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


mananao ooo ol enn] Rt P imme E 
Rn 





Offset variant 
Applies when P == 1 & U == 0 && W == 


STRH{<c>}{<q>} <Rt>, [<Rn> {, #-<imm>}] 
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Post-indexed variant 
Applies when P == @ && W == 


STRH{<c>}{<q>} <Rt>, [<Rn>], #{+/-}<imm> 


Pre-indexed variant 
Applies when P == 1 && W == 


STRH{<c>}{<q>} <Rt>, [<Rn>, #{+/-}<imm>]! 


Decode for all variants of this encoding 


if P == '1' & U == '1' && W == '@' then SEE "STRHT"; 

if Rn == '1111' || (P == '@' && W == 'Q') then UNDEFINED; 

t = UInt(Rt); n = UInt(Rn); imm32 = ZeroExtend(imm8, 32); 

index = (P == '1'); add = (U == '1'); whack = (W == '1'); 

if t == 15 || (whack && n == t) then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If t == 15, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


If wback && n == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 


in the offset variant, but this is deprecated. 
For encoding A1, T1, T2, T3: is the general-purpose base register, encoded in the "Rn" field. 
+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 


+ when U = 1 


+ Specifies the offset is added to the base register. 
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F5-4644 


<imm> 


For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is the optional positive unsigned immediate byte offset, a multiple of 2, in the 
range 0 to 62, defaulting to 0 and encoded in the "imm5" field as <imm>/2. 


For encoding T2: is an optional 12-bit unsigned immediate byte offset, in the range 0 to 4095, 
defaulting to 0 and encoded in the "imm12" field. 


For encoding T3: is an 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 
if omitted, and encoded in the "imm8" field. 


Operation for all encodings 


if CurrentInstrSet() == InstrSet_A32 then 


else 


if ConditionPassed() then 


EncodingSpecificOperations(); 

offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
MemU[address,2] = R[t]<15:Q>; 

if wback then R[n] = offset_addr; 


if ConditionPassed() then 


EncodingSpecificOperations(); 

offset_addr = if add then (R[n] + imm32) else (R[n] - imm32); 
address = if index then offset_addr else R[n]; 
MemU[address,2] = R[t]<15:0>; 

if wback then R[n] = offset_addr; 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.241 STRH (register) 


ARM DDI 0487E.a 
ID070919 


Store Register Halfword (register) calculates an address from a base register value and an offset register value, and 
stores a halfword from a register to memory. The offset register value can be shifted left by 0, 1, 2, or 3 bits. For 


information about memory accesses see Memory accesses on page F2-3913. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[111 Jo o ojplujofwjof Rn | r  kokokoko]ijo afi] Rm | 





cond 


Offset variant 
Applies when P == 1 & W == 


STRH{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>] 


Post-indexed variant 
Applies when P == 0 && W == 


STRH{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm> 


Pre-indexed variant 
Applies when P == 1 & W == 


STRH{<c>}{<q>} <Rt>, [<Rn>, {+/-}<Rm>]! 


Decode for all variants of this encoding 


if P == '0' && W == '1' then SEE "STRHT"; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = (P == '1'); add = (U == '1'); wback = (P == '0') || (W == '1'); 
(shift_t, shift_n) = (SRType_LSL, 0); 

if t == 15 || m == 15 then UNPREDICTABLE; 

if whack && (n == 15 || n == t) then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


If wback && n == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


If wback && n == 15, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction executes without writeback of the base address. 
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F5-4646 


° The instruction uses the addressing mode described in the equivalent immediate offset instruction. 
T1 


15 14 13 1241110 9 8| 65 132 ol 


[o 1 0 1jojoji| Rm | Rn | Rt | 


T1 variant 


STRH{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>] 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 


index = TRUE; add = TRUE; wback = FALSE; 
(shift_t, shift n) = (SRType_LSL, 0); 


T2 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


Tt1771000 0/0 10] em | R [00000 0jmm] Rm | 
Rn 


T2 variant 


STRH{<c>}.W <Rt>, [<Rn>, {+}<Rm>] // <Rt>, <Rn>, <Rm> can be represented in T1 
STRH{<c>}{<q>} <Rt>, [<Rn>, {+}<Rm>{, LSL #<imm>}] 


Decode for this encoding 


if Rn == '1111' then UNDEFINED; 

t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); 

index = TRUE; add = TRUE; wback = FALSE; 

(shift_t, shift_n) = (SRType_LSL, UInt(imm2)); 

if t == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 
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<Rn> 


+/- 


Ope 


if C 


Ope 
If CP 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


For encoding A1: is the general-purpose base register, encoded in the "Rn" field. The PC can be used 
in the offset variant, but this is deprecated. 


For encoding T1 and T2: is the general-purpose base register, encoded in the "Rn" field. 
Specifies the index register is added to or subtracted from the base register, defaulting to + if omitted 
and encoded in the "U" field. It can have the following values: 


- when U = 0 


+ when U = 1 
Specifies the index register is added to the base register. 
Is the general-purpose index register, encoded in the "Rm" field. 
If present, the size of the left shift to apply to the value from <Rm>, in the range 1-3. <imm> is encoded 
in imm2. If absent, no shift is specified and imm2 is encoded as 0b00. 
ration for all encodings 
onditionPassed() then 
EncodingSpecificOperations(); 
offset = Shift(R[m], shift_t, shift_n, PSTATE.C); 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if index then offset_addr else R[n]; 
MemU[address,2] = R[t]<15:0>; 
if wback then R[n] = offset_addr; 
rational information 


SR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.242 STRHT 


F5-4648 


Store Register Halfword Unprivileged stores a halfword from a register to memory. For information about memory 
accesses see Memory accesses on page F2-3913. 


The memory access is restricted as if the PE were running in User mode. This makes no difference if the PE is 
actually running in User mode. 


STRHT is UNPREDICTABLE in Hyp mode. 


The T32 instruction uses an offset addressing mode, that calculates the address used for the memory access from a 
base register value and an immediate offset, and leaves the base register unchanged. 


The A32 instruction uses a post-indexed addressing mode, that uses a base register value as the address for the 
memory access, and calculates a new address from a base register value and an offset and writes it back to the base 
register. The offset can be an immediate value or a register value. 


A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12\11 8|7 6 5 4|3 0 | 


erm [oo ojojumo] Rn | Rt | mman [ajo 4]7] mma 


cond 
A1 variant 
STRHT{<c>}{<q>} <Rt>, [<Rn>] {, #{+/-}<imm>} 
Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); postindex = TRUE; add = (U == '1'); 


register_form = FALSE; imm32 = ZeroExtend(imm4H:imm4L, 32); 
if t == 15 || n == 15 || n == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If t == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Ifn = t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 


i The instruction is treated as if bit[24] == 1 and bit[21] == 0. The instruction uses immediate offset addressing 
with the base register as PC, without writeback. 
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A2 
|31 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|3 0 | 
| 1111 [o o ojo[ļujojijo] Rna | Rt __fofofofojt{o fa] Rm | 
cond 
A2 variant 


STRHT{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm> 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); postindex = TRUE; add = (U = '1'); 


register_form = TRUE; 
if t == 15 || n == 15 || n == t || m == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
è The instruction executes as NOP. 
° The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Ifn == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 


5 The instruction is treated as if bit[24] == 1 and bit[21] == 0. The instruction uses immediate offset addressing 
with the base register as PC, without writeback. 


T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0 | 


11177000 0/0 1ļjoj 11 | rR [1170] imme 
Rn 


T1 variant 


STRHT{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 
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F5-4650 


Decode for this encoding 
if Rn == '1111' then UNDEFINED; 
t = UInt(Rt); n = UInt(Rn); postindex = FALSE; add = TRUE; 


register_form = FALSE; imm32 = ZeroExtend(imm8, 32); 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
° The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rt> Is the general-purpose register to be transferred, encoded in the "Rt" field. 

<Rn> Is the general-purpose base register, encoded in the "Rn" field. 

+/- For encoding A1: specifies the offset is added to or subtracted from the base register, defaulting to 
+ if omitted and encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 


For encoding A2: specifies the index register is added to or subtracted from the base register, 
defaulting to + if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 
<Rm> Is the general-purpose index register, encoded in the "Rm" field. 
+ Specifies the offset is added to the base register. 
<imm> For encoding A1: is the 8-bit unsigned immediate byte offset, in the range 0 to 255, defaulting to 0 


if omitted, and encoded in the "imm4H:imm4L" field. 


For encoding T1: is an optional 8-bit unsigned immediate byte offset, in the range 0 to 255, 
defaulting to 0 and encoded in the "imm8" field. 


Operation for all encodings 


if ConditionPassed() then 
if PSTATE.EL == EL2 then UNPREDICTABLE; // Hyp mode 
EncodingSpecificOperations(); 
offset = if register_form then R[m] else imm32; 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if postindex then R[n] else offset_addr; 
MemU_unpriv[address,2] = R[t]<15:>; 
if postindex then R[n] = offset_addr; 
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CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == EL2, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
e The instruction executes as STRH (immediate). 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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F5.1.243 


F5-4652 


STRT 


Store Register Unprivileged stores a word from a register to memory. For information about memory accesses see 
Memory accesses on page F2-3913. 


The memory access is restricted as if the PE were running in User mode. This makes no difference if the PE is 
actually running in User mode. 


STRT is UNPREDICTABLE in Hyp mode. 


The T32 instruction uses an offset addressing mode, that calculates the address used for the memory access from a 
base register value and an immediate offset, and leaves the base register unchanged. 


The A32 instruction uses a post-indexed addressing mode, that uses a base register value as the address for the 
memory access, and calculates a new address from a base register value and an offset and writes it back to the base 
register. The offset can be an immediate value or an optionally-shifted register value. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12|11 | | o| 
Cem joi ojojumo] rn | R | me ë 
cond 
A1 variant 


STRT{<c>}{<q>} <Rt>, [<Rn>] {, #{+/-}<imm>} 


Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); postindex = TRUE; add = (U == '1'); 


register_form = FALSE; imm32 = ZeroExtend(imm12, 32); 
if n == 15 || n == t then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 


: The instruction is treated as if bit[24] == 1 and bit[21] == 0. The instruction uses immediate offset addressing 
with the base register as PC, without writeback. 


A2 
31 28/27 26 25 24|23 22 21 20|19 16/15 12\11 i765 4|3 0 | 


erm [o ioun] Rn | R | mmd_[stype]o] Rm | 


cond 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


A2 variant 


STRT{<c>}{<q>} <Rt>, [<Rn>], {+/-}<Rm>{, <shift>} 
Decode for this encoding 
t = UInt(Rt); n = UInt(Rn); m = UInt(Rm); postindex = TRUE; add = (U = '1'); 


register_form = TRUE; (shift_t, shift_n) = DecodeImmShift(stype, imm5); 
if n == 15 || n == t || m == 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn == t, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The store instruction executes but the value stored is UNKNOWN. 


Ifn == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction uses post-indexed addressing with the base register as PC. This is handled as described in 


Using R15 on page K1-7607. 
s The instruction is treated as if bit[24] == 1 and bit[21] == 0. The instruction uses immediate offset addressing 


with the base register as PC, without writeback. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


11447000 0/1 ofof e11 | rR [1170] _ imm | 
Rn 


T1 variant 


STRT{<c>}{<q>} <Rt>, [<Rn> {, #{+}<imm>}] 


Decode for this encoding 
if Rn == '1111' then UNDEFINED; 
t = UInt(Rt); n = UInt(Rn); postindex = FALSE; add = TRUE; 


register_form = FALSE; imm32 = ZeroExtend(imm8, 32); 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


Ift == 15, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The store instruction performs the store using the specified addressing mode but the value corresponding to 


R15 is UNKNOWN. 


Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4653 
Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4654 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> For encoding A1 and A2: is the general-purpose register to be transferred, encoded in the "Rt" field. 


The PC can be used, but this is deprecated. 


For encoding T1: is the general-purpose register to be transferred, encoded in the "Rt" field. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 

+/- For encoding A1: specifies the offset is added to or subtracted from the base register, defaulting to 
+ if omitted and encoded in the "U" field. It can have the following values: 
- when U = 0 
+ when U = 1 


For encoding A2: specifies the index register is added to or subtracted from the base register, 
defaulting to + if omitted and encoded in the "U" field. It can have the following values: 


- when U = 0 
+ when U = 1 
<Rm> Is the general-purpose index register, encoded in the "Rm" field. 
<shift> The shift to apply to the value read from <Rm>. If absent, no shift is applied. Otherwise, see Shifts 


applied to a register on page F2-3911. 
+ Specifies the offset is added to the base register. 


<imm> For encoding A1: is the 12-bit unsigned immediate byte offset, in the range 0 to 4095, defaulting to 
0 if omitted, and encoded in the "imm12" field. 


For encoding T1: is an optional 8-bit unsigned immediate byte offset, in the range 0 to 255, 
defaulting to 0 and encoded in the "imm8" field. 


Operation for all encodings 


if ConditionPassed() then 
if PSTATE.EL == EL2 then UNPREDICTABLE; // Hyp mode 
EncodingSpecificOperations(); 
offset = if register_form then Shift(R[m], shift_t, shift_n, PSTATE.C) else imm32; 
offset_addr = if add then (R[n] + offset) else (R[n] - offset); 
address = if postindex then R[n] else offset_addr; 
if t == 15 then // Only possible for encodings Al and A2 
data = PCStoreValue(); 
else 
data = R[t]; 
MemU_unpriv[address,4] = data; 
if postindex then R[n] = offset_addr; 


CONSTRAINED UNPREDICTABLE behavior 


If PSTATE.EL == EL2, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The instruction executes as STR (immediate). 


Operational information 


If CPSR.DIT is 1, the timing of this instruction is insensitive to the value of the data being loaded or stored. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


SUB (immediate, from PC) 


Subtract from PC subtracts an immediate value from the Align(PC, 4) value to form a PC-relative address, and 
writes the result to the destination register. Arm recommends that, where possible, software avoids using this alias 


This instruction is an alias of the ADR instruction. This means that: 


$ The encodings in this description are named to match the encodings of ADR. 
è The description of ADR gives the operational pseudocode for this instruction. 
A2 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16/15 12|11 0 | 
eit [ooroo 7 ojoji1 74] Ra | è ë me 
cond 
A2 variant 
SUB{<c>}{<q>} <Rd>, PC, #<const> 
is equivalent to 
ADR{<c>}{<q>} <Rd>, <label> 
and is the preferred disassembly when imm12 == '000000000000'. 
T2 
|15 141312/11109 8/7 6 5 4/3 2 1 0/1514 12/11 8|7 | 0 | 


1 11 ofits ofijolijloji 1 1 1]o] imma | Ra | imma | 


T2 variant 

SUB{<c>}{<q>} <Rd>, PC, #<imm12> 
is equivalent to 

ADR{<c>}{<q>} <Rd>, <label> 


and is the preferred disassembly when i: imm3:imm8 == '000000000000'. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> For encoding A2: is the general-purpose destination register, encoded in the "Rd" field. If the PC is 


used, the instruction is a branch to the address calculated by the operation. This is an interworking 
branch, see Pseudocode description of operations on the AArch32 general-purpose registers and the 


PC on page E1-3787. 


For encoding T2: is the general-purpose destination register, encoded in the "Rd" field. 


<label> For encoding A2: the label of an instruction or literal data item whose address is to be loaded into 
<Rd>. The assembler calculates the required value of the offset from the Align(PC, 4) value of the 


ADR instruction to this label. 


If the offset is zero or positive, encoding A1 is used, with imm32 equal to the offset. 
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F5-4656 


<imm12> 


<const> 


If the offset is negative, encoding A2 is used, with imm32 equal to the size of the offset. That is, the 
use of encoding A2 indicates that the required offset is minus the value of imm32. 


Permitted values of the size of the offset are any of the constants described in Modified immediate 
constants in A32 instructions on page F2-3924. 


For encoding T2: the label of an instruction or literal data item whose address is to be loaded into 
<Rd>. The assembler calculates the required value of the offset from the Align(PC, 4) value of the 
ADR instruction to this label. 


If the offset is zero or positive, encoding T3 is used, with imm32 equal to the offset. 


If the offset is negative, encoding T2 is used, with imm32 equal to the size of the offset. That is, the 
use of encoding T2 indicates that the required offset is minus the value of imm32. 


Permitted values of the size of the offset are 0-4095. 
Is a 12-bit unsigned immediate, in the range 0 to 4095, encoded in the "1:imm3:imm8" field. 


Animmediate value. See Modified immediate constants in A32 instructions on page F2-3924 for the 
range of values. 


Operation for all encodings 


The description of ADR gives the operational pseudocode for this instruction. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.245 SUB, SUBS (immediate) 


Subtract (immediate) subtracts an immediate value from a register value, and writes the result to the destination 
register. 


If the destination register is not the PC, the SUBS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. If the 
destination register is the PC: 


s The SUB variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 

è The SUBS variant of the instruction performs an exception return without the use of the stack. In this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See //egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode, except for encoding T5 with <imm8> set to zero, which is 
the encoding for the ERET instruction, see ERET. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 1615 1211 | | 0 | 
emm [0071 0]0 7 0]s] Rmn | Rd | — mma  ž | 
cond 

SUB variant 


Applies when S == @ && Rn != 11x1. 


SUB{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


SUBS variant 
Applies when S == 1 & Rn != 1101. 


SUBS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 
if Rn == '1111' && S == '0' then SEE "ADR"; 


if Rn == '1101' then SEE "SUB (SP minus immediate)"; 
d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = A32ExpandImm(imm12) ; 


T1 
15 14 13 1211110 9 8| 65 132 ol 


oo orri] mma] Ra | Ra | 


T1 variant 


SUB<c>{<q>} <Rd>, <Rn>, #<imm3> // Inside IT block 
SUBS{<q>} <Rd>, <Rn>, #<imm3> // Outside IT block 
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Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); setflags = !InITBlock(); imm32 = ZeroExtend(imm3, 32); 


T2 
[15 14 13 12/1110 8|7 | 0 | 
T2 variant 


SUB<c>{<q>} <Rdn>, #<imm8> // Inside IT block, and <Rdn>, <imm8> can be represented in T1 
SUB<c>{<q>} {<Rdn>,} <Rdn>, #<imm8> // Inside IT block, and <Rdn>, <imm8> cannot be represented in T1 
SUBS{<q>} <Rdn>, #<imm8> // Outside IT block, and <Rdn>, <imm8> can be represented in T1 
SUBS{<q>} {<Rdn>,} <Rdn>, #<imm8> // Outside IT block, and <Rdn>, <imm8> cannot be represented in T1 


Decode for this encoding 


d = UInt(Rdn); n = UInt(Rdn); setflags = !InITBlock(); imm32 = ZeroExtend(imm8, 32); 


T3 


|15 14 13 121110 9 8|7 6 5 4|3 01514 12\11 8|7 | 


+11 opi folt 10 4s] Hor [ol imma | Ra | imme —is 
Rn 


SUB variant 


Applies when S == 0. 


SUB<c>.W {<Rd>,} <Rn>, #<const> // Inside IT block, and <Rd>, <Rn>, <const> can be represented in T1 or 


T2 
SUB{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


SUBS variant 


Applies when S == 1 && Rd != 1111. 


SUBS.W {<Rd>,} <Rn>, #<const> // Outside IT block, and <Rd>, <Rn>, <const> can be represented in T1 or T2 


SUBS{<c>}{<q>} {<Rd>,} <Rn>, #<const> 


Decode for all variants of this encoding 


if Rd == '1111' && S == '1' then SEE "CMP (immediate)"; 
if Rn == '1101' then SEE "SUB (SP minus immediate)"; 


d = UInt(Rd); n = UInt(Rn); setflags = (S == '1'); imm32 = T32ExpandImm(i:imm3: imm8) ; 
if (d == 15 && !setflags) || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


T4 


|15 14 13 12/1110 9 8|7 6 5 4|3 0\1514  12|11 8|7 | 





T4 variant 


SUB{<c>}{<q>} {<Rd>,} <Rn>, #<imm12> // <imm12> cannot be represented in T1, T2, or T3 
SUBW{<c>}{<q>} {<Rd>,} <Rn>, #<imm12> // <imm12> can be represented in T1, T2, or T3 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Decode for this encoding 


if Rn == '1111' then SEE "ADR"; 

if Rn == '1101' then SEE "SUB (SP minus immediate)"; 

d = UInt(Rd); n = UInt(Rn); setflags = FALSE; imm32 = ZeroExtend(i:imm3:imm8, 32); 
if d == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 





T5 
|15 14 13 12|11 10 9 8|7 6 5 4/3 0 [15 14 13 1211 10 9 8|7 | o| 
11110011110 1mo] o O 0 AOO 1=00000000 
Rn imm8 
T5 variant 


SUBS{<c>}{<q>} PC, LR, #<imm8> 


Decode for this encoding 


if Rn == '1110' && IsZero(imm8) then SEE "ERET"; 

d = 15; n = UInt(Rn); setflags = TRUE; imm32 = ZeroExtend(imm8, 32); 
if n != 14 then UNPREDICTABLE; 

if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly SUBS PC. LR and related instructions 
(A32) on page K1-7620 and SUBS PC, LR and related instructions (T32) on page K1-7620. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rdn> Is the general-purpose source and destination register, encoded in the "Rdn" field. 

<imm8> For encoding T2: is a 8-bit unsigned immediate, in the range 0 to 255, encoded in the "imm8" field. 


For encoding T5: is a 8-bit unsigned immediate, in the range 0 to 255, encoded in the "imm8" field. 
If <Rn> is the LR, and zero is used, see ERET. 


<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. If the PC is used: 


° For the SUB variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


$ For the SUBS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. Arm deprecates use of this instruction unless <Rn> is the LR. 


For encoding T1, T3 and T4: is the general-purpose destination register, encoded in the "Rd" field. 
If omitted, this register is the same as <Rn>. 

<Rn> For encoding A1 and T4: is the general-purpose source register, encoded in the "Rn" field. Ifthe SP 
is used, see SUB, SUBS (SP minus immediate). If the PC is used, see ADR. 
For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 
For encoding T3: is the general-purpose source register, encoded in the "Rn" field. Ifthe SP is used, 


see SUB, SUBS (SP minus immediate). 


<imm3> Is a 3-bit unsigned immediate, in the range 0 to 7, encoded in the "imm3" field. 
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F5-4660 


<imm12> Is a 12-bit unsigned immediate, in the range 0 to 4095, encoded in the "1:imm3:imm8" field. 


<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 


page F2-3924 for the range of values. 


For encoding T3: an immediate value. See Modified immediate constants in T32 instructions on 


page F2-3923 for the range of values. 


In the T32 instruction set, MOVS{<c>}{<q>} PC, LR is a pseudo-instruction for SUBS{<c>}{<q>} PC, LR, #0. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(R[n], NOT(imm32), '1'); 
if d == 15 then 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


SUB, SUBS (register) 


Subtract (register) subtracts an optionally-shifted register value from a register value, and writes the result to the 


destination register. 


If the destination register is not the PC, the SUBS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. However, 


when the destination register is the PC: 


s The SUB variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The SUBS variant of the instruction performs an exception return without the use of the stack. Arm 


deprecates use of this instruction. However, in this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12\11 7 6 5 4|3 


Tenn [oo 0 ofo 7 o[8] mmo | Ra | mms  siypofo] Rm | 
Rn 


cond 


SUB, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


SUB{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


SUB, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 


SUB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


SUBS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


SUBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


SUBS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


SUBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


if Rn == '1101' then SEE "SUB (SP minus register)"; 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
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T1 


|15 1413 12/1110 9 8| 65 |32 o0] 


foo 0110o] Rm | Rn | Ra | 


T1 variant 


SUB<c>{<q>} <Rd>, <Rn>, <Rm> // Inside IT block 
SUBS{<q>} {<Rd>,} <Rn>, <Rm> // Outside IT block 


Decode for this encoding 


d = UInt(Rd); n 


= UInt(Rn); m = UInt(Rm); setflags = !InITBlock(); 
(shift t, shift_n) = 


(SRType_LSL, 0); 
T2 


[15 14 13 121110 9 8|7 6 5 4|3 01514  12|11 8|7 6 5 4|3 0| 


[1110170 144110 1js| '=1101 [0| imm3 | Rd  [imm2|stype| Rm | 
Rn 





SUB, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


SUB{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


SUB, shift or rotate by value variant 
Applies when S == @ && !(imm3 == 000 && imm2 == 00 && stype == 11). 


SUB<c>.W {<Rd>,} <Rn>, <Rm> // Inside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
SUB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


SUBS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && Rd != 1111 && imm2 == 00 && stype == 11. 


SUBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, RRX 


SUBS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11) && Rd != 1111. 


SUBS.W {<Rd>,} <Rn>, <Rm> // Outside IT block, and <Rd>, <Rn>, <Rm> can be represented in T1 
SUBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


if Rd == '1111' && S == '1' then SEE "CMP (register)"; 

if Rn == '1101' then SEE "SUB (SP minus register)"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if (d == 15 && !setflags) || n == 15 || m == 15 then UNPREDICTABLE; 
// Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


<shift> 


<amount> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the same as <Rn>. Arm deprecates using the PC as the destination register, but if the 
PC is used: 


e For the SUB variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


° For the SUBS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1 and T2: is the general-purpose destination register, encoded in the "Rd" field. If 
omitted, this register is the same as <Rn>. 

For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used, but this is deprecated. If the SP is used, see SUB, SUBS (SP minus register). 

For encoding T1: is the first general-purpose source register, encoded in the "Rn" field. 

For encoding T2: is the first general-purpose source register, encoded in the "Rn" field. If the SP is 
used, see SUB, SUBS (SP minus register). 

For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 

For encoding T1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 


Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 


LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 


For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], NOT(shifted), '1'); 
if d == 15 then // Can only occur for A32 encoding 


else 
R[d] = result; 
if setflags then 


if setflags then 
ALUExceptionReturn(result) ; 


ALUWritePC(result) ; 


PSTATE.<N,Z,C,V> = nzcv; 
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Operational information 
If CPSR.DIT is 1 and this instruction does not use R15 as either its source or destination: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.247 SUB, SUBS (register-shifted register) 


Subtract (register-shifted register) subtracts a register-shifted register value from a register value, and writes the 
result to the destination register. It can optionally update the condition flags based on the result. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 8|7 6 5 4|3 0 | 
| i111 [o o o ofo 1 ojs| Rn | Ra | Rs ([O|stype[1] Rm | 


cond 


Flag setting variant 
Applies when S = 1. 


SUBS{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Not flag setting variant 
Applies when S == 0. 


SUB{<c>}{<q>} {<Rd>,} <Rn>, <Rm>, <shift> <Rs> 


Decode for all variants of this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 
setflags = (S == '1'); shift_t = DecodeRegShift(stype); 

if d == 15 || n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 
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Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(R[n], NOT(shifted), '1'); 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F5.1.248 SUB, SUBS (SP minus immediate) 


ARM DDI 0487E.a 
ID070919 


Subtract from SP (immediate) subtracts an immediate value from the SP value, and writes the result to the 
destination register. 


If the destination register is not the PC, the SUBS variant of the instruction updates the condition flags based on the 
result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. If the 
destination register is the PC: 


s The SUB variant of the instruction is an interworking branch, see Pseudocode description of operations on 
the AArch32 general-purpose registers and the PC on page E1-3787. 


è The SUBS variant of the instruction performs an exception return without the use of the stack. Arm 
deprecates use of this instruction. However, in this case: 
— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 
AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 1211 | | 0 | 
emm [0010/07 0]s]1107] Ra | ë ë m ë O 
cond 

SUB variant 


Applies when S == 0. 


SUB{<c>}{<q>} {<Rd>,} SP, #<const> 


SUBS variant 
Applies when S = 1. 


SUBS{<c>}{<q>} {<Rd>,} SP, #<const> 
Decode for all variants of this encoding 
d = UInt(Rd); setflags = (S == '1'); imm32 = A32ExpandImm(imm12) ; 


T1 


|15 14 13 12|11 10 9 8|7 6 | 0 | 


1011000 0j] imm | 


T1 variant 


SUB{<c>}{<q>} {SP,} SP, #<imm7> 


Decode for this encoding 


d = 13; setflags = FALSE; imm32 = ZeroExtend(imm7:'Q0', 32); 
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F5-4668 


T2 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0]1514 12/11 8|7 | 0| 


771 of folt 10 7s] 10 1/0] mma] Ra [imme —s 


SUB variant 
Applies when S == 0. 


SUB{<c>}.W {<Rd>,} SP, #<const> // <Rd>, <const> can be represented in T1 
SUB{<c>}{<q>} {<Rd>,} SP, #<const> 


SUBS variant 
Applies when S == 1 && Rd != 1111. 


SUBS{<c>}{<q>} {<Rd>,} SP, #<const> 


Decode for all variants of this encoding 
if Rd == '1111' && S == '1' then SEE "CMP (immediate)"; 


d = UInt(Rd); setflags = (S == '1');  imm32 = T32ExpandImm(i:imm3:imm8) ; 
if d == 15 && !setflags then UNPREDICTABLE; 


T3 


|15 141312/11109 8/7 6 5 4/3 2 1 0ļ1514 12/11 8/7 | 0| 


741 oft oft opi fot 10 to] mma | Ra | imms——=sd 


T3 variant 


SUB{<c>}{<q>} {<Rd>,} SP, #<imm12> // <imm12> cannot be represented in T1, T2, or T3 
SUBW{<c>}{<q>} {<Rd>,} SP, #<imm12> // <imm12> can be represented in T1, T2, or T3 


Decode for this encoding 


d = UInt(Rd); setflags = FALSE; imm32 = ZeroExtend(i:imm3:imm8, 32); 
if d == 15 then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
SP, Is the stack pointer. 
<imm7> Is the unsigned immediate, a multiple of 4, in the range 0 to 508, encoded in the "imm7" field as 
<imm7>/4. 
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<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the SP. If the PC is used: 


° For the SUB variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


3 For the SUBS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. Arm deprecates use of this instruction unless <Rn> is the LR. 


For encoding T2 and T3: is the general-purpose destination register, encoded in the "Rd" field. If 
omitted, this register is the SP. 


<imm12> Is a 12-bit unsigned immediate, in the range 0 to 4095, encoded in the "1:imm3:imm8" field. 


<const> For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T2: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result, nzcv) = AddWithCarry(SP, NOT(imm32), '1') 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result); 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 
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F5.1.249 SUB, SUBS (SP minus register) 


Subtract from SP (register) subtracts an optionally-shifted register value from the SP value, and writes the result to 


the destination register. 


If the destination register is not the PC, the SUBS variant of the instruction updates the condition flags based on the 


result. 


The field descriptions for <Rd> identify the encodings where the PC is permitted as the destination register. If the 


destination register is the PC: 


s The SUB variant of the instruction is an interworking branch, see Pseudocode description of operations on 


the AArch32 general-purpose registers and the PC on page E1-3787. 


è The SUBS variant of the instruction performs an exception return without the use of the stack. Arm 


deprecates use of this instruction. However, in this case: 


— The PE branches to the address written to the PC, and restores PSTATE from SPSR_<current_mode>. 


— The PE checks SPSR_<current_mode> for an illegal return event. See ///egal return events from 


AArch32 state on page G1-5524. 


— The instruction is UNDEFINED in Hyp mode. 


— The instruction is CONSTRAINED UNPREDICTABLE in User mode and System mode. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 


7 6 5 4|3 


o | 


emn [oo o ojo 7 0[s]i 101] Rd | mms [stype]o] Rm | 


cond 


SUB, rotate right with extend variant 
Applies when S == @ && imm5 == 00000 && stype == 11. 


SUB{<c>}{<q>} {<Rd>,} SP, <Rm> , RRX 


SUB, shift or rotate by value variant 
Applies when S == @ && !(imm5 == 00000 && stype == 11). 


SUB{<c>}{<q>} {<Rd>,} SP, <Rm> {, <shift> #<amount>} 


SUBS, rotate right with extend variant 
Applies when S == 1 && imm5 == 00000 && stype == 11. 


SUBS{<c>}{<q>} {<Rd>,} SP, <Rm> , RRX 


SUBS, shift or rotate by value variant 
Applies when S == 1 && !(imm5 == 00000 && stype == 11). 


SUBS{<c>}{<q>} {<Rd>,} SP, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); m = UInt(Rm); setflags = (S == '1'); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 
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T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0]1514 12/11 8|7 6 5 4|3 0 | 


7707071 10 7/5/11 0 10] mms | Rd limma[sype] Rm 


SUB, rotate right with extend variant 
Applies when S == @ && imm3 == 000 && imm2 == 00 && stype == 11. 


SUB{<c>}{<q>} {<Rd>,} SP, <Rm>, RRX 


SUB, shift or rotate by value variant 
Applies when S == O && !(imm3 == 000 && imm2 == 00 && stype == 11). 


SUB{<c>}.W {<Rd>,} SP, <Rm> // <Rd>, <Rm> can be represented in T1 or T2 
SUB{<c>}{<q>} {<Rd>,} SP, <Rm> {, <shift> #<amount>} 


SUBS, rotate right with extend variant 
Applies when S == 1 && imm3 == 000 && Rd != 1111 && imm2 == 00 && stype == 11. 


SUBS{<c>}{<q>} {<Rd>,} SP, <Rm>, RRX 


SUBS, shift or rotate by value variant 
Applies when S == 1 && !(imm3 == 000 && imm2 == 00 && stype == 11) && Rd != 1111. 


SUBS{<c>}{<q>} {<Rd>,} SP, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 

if Rd == '1111' && S == '1' then SEE "CMP (register)"; 

d = UInt(Rd); m = UInt(Rm); setflags = (S == '1'); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 

if (d == 15 && !setflags) || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> For encoding A1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 


this register is the SP. Arm deprecates using the PC as the destination register, but if the PC is used: 


° For the SUB variant, the instruction is a branch to the address calculated by the operation. 
This is an interworking branch, see Pseudocode description of operations on the AArch32 
general-purpose registers and the PC on page E1-3787. 


a For the SUBS variant, the instruction performs an exception return, that restores PSTATE 
from SPSR_<current_mode>. 


For encoding T1: is the general-purpose destination register, encoded in the "Rd" field. If omitted, 
this register is the SP. 


<Rm> For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 
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For encoding T1: is the second general-purpose source register, encoded in the "Rm" field. 


<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shifted = Shift(R[m], shift_t, shift_n, PSTATE.C); 
(result, nzcv) = AddWithCarry(SP, NOT(shifted), '1'); 
if d == 15 then // Can only occur for A32 encoding 
if setflags then 
ALUExceptionReturn(result) ; 
else 
ALUWritePC(result) ; 
else 
R[d] = result; 
if setflags then 
PSTATE.<N,Z,C,V> = nzcv; 


F5-4672 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


F5.1.250 SVC 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Supervisor Call causes a Supervisor Call exception. For more information, see Supervisor Call (SVC) exception on 
page G1-5540. 


Note 


SVC was previously called SWI, Software Interrupt, and this name is still found in some documentation. 





Software can use this instruction as a call to an operating system to provide a service. 
In the following cases, the Supervisor Call exception generated by the SVC instruction is taken to Hyp mode: 
. If the SVC is executed in Hyp mode. 


° If HCR.TGE is set to 1, and the SVC is executed in Non-secure User mode. For more information, see 
Supervisor Call exception, when the value of HCR.TGE is 1 on page G1-5517 


In these cases, the HSR identifies that the exception entry was caused by a Supervisor Call exception, EC value 0x11, 
see Use of the HSR on page G5-5836. The immediate field in the HSR: 
: If the SVC is unconditional: 

— For the T32 instruction, is the zero-extended value of the imm8 field. 


— For the A32 instruction, is the least-significant 16 bits the imm24 field. 


. If the SVC is conditional, is UNKNOWN. 
A1 
|31 28|27 26 25 24|23 | | | | | 0| 
eam [i117 
cond 
A1 variant 


SVC{<c>}{<q>} {#}<imm> 
Decode for this encoding 
imm32 = ZeroExtend(imm24, 32); 


T1 


|15 14 13 12|11 10 9 8|7 | 0| 


T E imme _| 


T1 variant 
SVC{<c>}{<q>} {#}<imm> 
Decode for this encoding 


imm32 = ZeroExtend(imm8, 32); 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 


<imm> For encoding A1: is a 24-bit unsigned immediate, in the range 0 to 16777215, encoded in the 
"imm24" field. This value is for assembly and disassembly only. SVC handlers in some systems 
interpret imm24 in software, for example to determine the required service. 


For encoding T1: is a 8-bit unsigned immediate, in the range 0 to 255, encoded in the "imm8" field. 
This value is for assembly and disassembly only. SVC handlers in some systems interpret imm8 in 
software, for example to determine the required service. 


Operation for all encodings 
if ConditionPassed() then 


EncodingSpecificOperations(); 
AArch32.Cal1Supervisor(imm32<15 :Q>) ; 
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F5.1.251 SXTAB 
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Signed Extend and Add Byte extracts an 8-bit value from a register, sign-extends it to 32 bits, adds the result to the 
value in another register, and writes the final result to the destination register. The instruction can specify a rotation 
by 0, 8, 16, or 24 bits before extracting the 8-bit value. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[ 1117, Jo 1 1 0 1joji of 1111 | Rda frotateloofo 1 1 1| Rm | 
Rn 


cond 


A1 variant 


SXTAB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 
if Rn == '1111' then SEE "SXTB"; 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Danano oop ool emn [i111] Ra oo Rm | 
Rn 





T1 variant 


SXTAB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 

if Rn == '1111' then SEE "SXTB"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
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16 when rotate = 10 


24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d] = R[n] + SignExtend(rotated<7:0>, 32); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
° The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.252 SXTAB16 


ARM DDI 0487E.a 
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Signed Extend and Add Byte 16 extracts two 8-bit values from a register, sign-extends them to 16 bits each, adds 
the results to two 16-bit values from another register, and writes the final results to the destination register. The 
instruction can specify a rotation by 0, 8, 16, or 24 bits before extracting the 8-bit values. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[ 11111 jo 1 1 0 1jojo of 1111 | Rda __frotateloofo 1 1 1| Rm | 
Rn 


cond 


A1 variant 


SXTAB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 
if Rn == '1111' then SEE "SXTB16"; 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Danano oojoo] emn [i411] Ra ooa Rm | 
Rn 





T1 variant 


SXTAB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 

if Rn == '1111' then SEE "SXTB16"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
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16 when rotate = 10 


24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d]<15:@> = R[n]<15:@> + SignExtend(rotated<7:0>, 16); 
R[d]<31:16> = R[n]<31:16> + SignExtend(rotated<23:16>, 16); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
a The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.253 SXTAH 
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Signed Extend and Add Halfword extracts a 16-bit value from a register, sign-extends it to 32 bits, adds the result 
to a value from another register, and writes the final result to the destination register. The instruction can specify a 
rotation by 0, 8, 16, or 24 bits before extracting the 16-bit value. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[ 11111 fo 1 1 0 1joji 1| 1111 | Ra frotateloofo 1 1 1| Rm | 
Rn 


cond 


A1 variant 


SXTAH{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 
if Rn == '1111' then SEE "SXTH"; 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


mananao oojo ool emn [14141] Ra ooa Rm | 
Rn 





T1 variant 


SXTAH{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 

if Rn == '1111' then SEE "SXTH"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
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16 when rotate = 10 


24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d] = R[n] + SignExtend(rotated<15:0>, 32); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
° The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.254 SXTB 


ARM DDI 0487E.a 
ID070919 


Signed Extend Byte extracts an 8-bit value from a register, sign-extends it to 32 bits, and writes the result to the 
destination register. The instruction can specify a rotation by 0, 8, 16, or 24 bits before extracting the 8-bit value. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 


[=m fo 1 10 1ļjoji oji 111| Rd  frotatekojojo 1 1 1| Rm | 


cond 


A1 variant 


SXTB{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 
d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8|7 65 |32 ol] 


fo710070[0/i] Rm | Ra | 


T1 variant 


SXTB{<c>}{<q>} {<Rd>,} <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); rotation = 0; 
T2 


|15 14 13 1211110 9 8/7 6 5 4|3 2 1 0|151413 1211 8|7 6 5 4|3 0| 


Toit 107001 ojoh iaa Rd oo| Rm _| 


T2 variant 


SXTB{<c>}.W {<Rd>,} <Rm> // <Rd>, <Rm> can be represented in T1 
SXTB{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 

d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
16 when rotate = 10 
24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d] = SignExtend(rotated<7:@>, 32); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
s The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.255 SXTB16 


Signed Extend Byte 16 extracts two 8-bit values from a register, sign-extends them to 16 bits each, and writes the 
results to the destination register. The instruction can specify a rotation by 0, 8, 16, or 24 bits before extracting the 
8-bit values. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


[m11 jo 110 tfofo oft 111] Ra frotateloolo 1 1 1| Rm | 


cond 


A1 variant 


SXTB16{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8/7 6 5 4|3 2 1 0|151413 12/11 8|7 6 5 4|3 0| 


maaan on oojoo a a) Re oo| Rm 


T1 variant 


SXTB16{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 
d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rm> Is the general-purpose source register, encoded in the "Rm" field. 
<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 
(omitted) when rotate = 00 
8 when rotate = 01 
16 when rotate = 10 
24 when rotate = 11 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d]<15:@> = SignExtend(rotated<7:0>, 16); 
R[d]<31:16> = SignExtend(rotated<23:16>, 16); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.256  SXTH 


ARM DDI 0487E.a 
ID070919 


Signed Extend Halfword extracts a 16-bit value from a register, sign-extends it to 32 bits, and writes the result to 
the destination register. The instruction can specify a rotation by 0, 8, 16, or 24 bits before extracting the 16-bit 
value. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


[m1 fo 410 tfoft iji 11 1f Ra frotatelooylo 1 1 1| Rm | 


cond 


A1 variant 


SXTH{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 
d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8|7 65 |32 ol] 


[071007 ojojo] Rm | Ra | 


T1 variant 


SXTH{<c>}{<q>} {<Rd>,} <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); rotation = 0; 
T2 


|15 14 13 1211110 9 8|7 6 5 4|3 2 1 0|151413 1211 8|7 6 5 4|3 0| 


7414070 0/0 ojoj iii ea) Re ooa Rm 


T2 variant 


SXTH{<c>}.W {<Rd>,} <Rm> // <Rd>, <Rm> can be represented in T1 
SXTH{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 

d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
16 when rotate = 10 
24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d] = SignExtend(rotated<15:@>, 32); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
s The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


TBB, TBH 


Table Branch Byte or Halfword causes a PC-relative forward branch using a table of single byte or halfword offsets. 
A base register provides a pointer to the table, and a second register supplies an index into the table. The branch 
length is twice the value returned from the table. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|1110 9 8|7 6 5 4]3 0 | 


i trtoroocorr ost Ra okooko] o ofh] Rm | 


Byte variant 
Applies when H == 0. 


TBB{<c>}{<q>} [<Rn>, <Rm>] // Outside or last in IT block 


Halfword variant 
Applies when H == 1. 


TBH{<c>}{<q>} [<Rn>, <Rm>, LSL #1] // Outside or last in IT block 


Decode for all variants of this encoding 

n = UInt(Rn); m = UInt(Rm); is_tbh = (H == '1'); 

if m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
if InITBlock() && !LastInITBlock() then UNPREDICTABLE; 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the general-purpose base register holding the address of the table of branch lengths, encoded in 


the "Rn" field. The PC can be used. If it is, the table immediately follows this instruction. 


<Rm> For the byte variant: is the general-purpose index register, encoded in the "Rm" field. This register 
contains an integer pointing to a single byte in the table. The offset in the table is the value of the 
index. 


For the halfword variant: is the general-purpose index register, encoded in the "Rm" field. This 
register contains an integer pointing to a halfword in the table. The offset in the table is twice the 
value of the index. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if is_tbh then 
halfwords = UInt(MemU[R[n]+LSL(R[m],1), 2]); 
else 
halfwords = UInt(MemU[R[n]+R[m], 1]); 
BranchWritePC(PC + 2«halfwords, BranchType_INDIR); 
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F5.1.258 TEQ (immediate) 


Test Equivalence (immediate) performs a bitwise exclusive OR operation on a register value and an immediate 
value. It updates the condition flags based on the result, and discards the result. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 | | 0| 
iit |o o 1 1 ofo iji] Rn Oo) imma O 
cond 

A1 variant 


TEQ{<c>}{<q>} <Rn>, #<const> 


Decode for this encoding 


n = UInt(Rn); 
(imm32, carry) = A32ExpandImm_C(imm12, PSTATE.C); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0/1514 12/1110 9 8|7 | 0 | 


741 of fofo to oft] Rn [ol imma [117 7[ imme o 


T1 variant 


TEQ{<c>}{<q>} <Rn>, #<const> 


Decode for this encoding 


n = UInt(Rn); 
(imm32, carry) = T32ExpandImm_C(i:imm3:imm8, PSTATE.C); 
if n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rn> 


<const> 


F5-4688 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 

For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 

For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = R[n] EOR imm32; 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.259 TEQ (register) 


Test Equivalence (register) performs a bitwise exclusive OR operation on a register value and an optionally-shifted 
register value. It updates the condition flags based on the result, and discards the result. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16|15 14 13 12|11 7 6 5 4|3 0 | 
[_!=1111 [o o 0 1 ofo 1/4] Rn (OO(O)(0)]_—immd__stypef[O] Rm | 


cond 


Rotate right with extend variant 
Applies when imm5 == 00000 && stype == 11. 


TEQ{<c>}{<q>} <Rn>, <Rm>, RRX 


Shift or rotate by value variant 
Applies when !(imm5 == 00000 && stype == 11). 


TEQ{<c>}{<q>} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 
n = UInt(Rn); m = UInt(Rm); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0\1514 12|1110 9 8|7 6 5 4|3 0| 


Rotate right with extend variant 
Applies when imm3 == 000 && imm2 == 00 && stype == 11. 
TEQ{<c>}{<q>} <Rn>, <Rm>, RRX 
Shift or rotate by value variant 
Applies when !(imm3 == 000 && imm2 == 00 && stype == 11). 
TEQ{<c>}{<q>} <Rn>, <Rm> {, <shift> #<amount>} 
Decode for all variants of this encoding 
n = UInt(Rn); m = UInt(Rm); 
(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2); 
if n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 

<Rn> For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 
be used, but this is deprecated. 
For encoding T1: is the first general-purpose source register, encoded in the "Rn" field. 

<Rm> For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 
can be used, but this is deprecated. 


For encoding T1: is the second general-purpose source register, encoded in the "Rm" field. 


<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "Imm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] EOR shifted; 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
s The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.260 


F5-4692 


TEQ (register-shifted register) 


Test Equivalence (register-shifted register) performs a bitwise exclusive OR operation on a register value and a 
register-shifted register value. It updates the condition flags based on the result, and discards the result. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 8|7 6 5 4|3 0| 


[1m |oo o1 o0jo tft] Rn  kokokoko] Rs |olsyeeji] Rm | 


cond 


A1 variant 


TEQ{<c>}{<q>} <Rn>, <Rm>, <type> <Rs> 


Decode for this encoding 

n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 

shift_t = DecodeRegShift(stype) ; 

if n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<type> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
(shifted, carry) = Shift_C(R[m], shift t, shift_n, PSTATE.C); 
result = R[n] EOR shifted; 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
° The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.261 


F5-4694 


TSB CSYNC 


Trace Synchronization Barrier. This instruction is a barrier that synchronizes the trace operations of instructions. 


If ARMv8.4-Trace is not implemented, this instruction executes as a NOP. 


A1 


ARMv8.4 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|1110 9 8|7 6 5 4|3 2 1 0| 


Cmm [0 011 ojoj ofo o o omno o o a o o 0 
cond 

A1 variant 

TSB{<c>}{<q>} CSYNC 

Decode for this encoding 


if !HaveSelfHostedTrace() then EndOfInstruction(); // Instruction executes as NOP 
if cond != '1110' then UNPREDICTABLE; // ESB must be encoded with AL condition 


CONSTRAINED UNPREDICTABLE behavior 


If cond != '1110', then one of the following behaviors must occur: 
5 The instruction is UNDEFINED. 

: The instruction executes as NOP. 

° The instruction executes unconditionally. 

° The instruction executes conditionally. 

T1 

ARMv8.4 


1514131211109 8|7 6 5 4/3 2 1 0|15141312/11109 8/7 6 5 4/3 2 10] 


ttt 10 1 ofits okooko o ojo o o 1fo 0 1 0| 


T1 variant 
TSB{<c>}{<q>} CSYNC 


Decode for this encoding 


if !HaveSelfHostedTrace() then EndOfInstruction(); // Instruction executes as NOP 
if InITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
. The instruction executes unconditionally. 
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° The instruction executes conditionally. 


Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
TraceSynchronizationBarrier(); 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.262 TST (immediate) 


Test (immediate) performs a bitwise AND operation on a register value and an immediate value. It updates the 
condition flags based on the result, and discards the result. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 | | 0| 
i111 fo o 1 1 ofo oji] Rn Ooo)! immt2 O 
cond 

A1 variant 


TST{<c>}{<q>} <Rn>, #<const> 


Decode for this encoding 


n = UInt(Rn); 
(imm32, carry) = A32ExpandImm_C(imm12, PSTATE.C); 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0/1514 12/1110 9 8|7 | 0 | 


771 of fofo oo oft] Rn Jo) imma [117 7[ imme 


T1 variant 


TST{<c>}{<q>} <Rn>, #<const> 


Decode for this encoding 


n = UInt(Rn); 
(imm32, carry) = T32ExpandImm_C(i:imm3:imm8, PSTATE.C); 
if n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rn> 


<const> 


F5-4696 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

For encoding A1: is the general-purpose source register, encoded in the "Rn" field. The PC can be 
used, but this is deprecated. 

For encoding T1: is the general-purpose source register, encoded in the "Rn" field. 

For encoding A1: an immediate value. See Modified immediate constants in A32 instructions on 
page F2-3924 for the range of values. 


For encoding T1: an immediate value. See Modified immediate constants in T32 instructions on 
page F2-3923 for the range of values. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = R[n] AND imm32; 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4697 
ID070919 Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.263 


F5-4698 


TST (register) 


Test (register) performs a bitwise AND operation on a register value and an optionally-shifted register value. It 


updates the condition flags based on the result, and discards the result. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16|15 14 13 12|11 7 6 5 4|3 0 | 
[_!=111 [o o 0 1 ofo oft] Rn  KOKOKOkO| _ imm5 _ [stypeļo| Rm | 


cond 


Rotate right with extend variant 
Applies when imm5 == 00000 && stype == 11. 


TST{<c>}{<q>} <Rn>, <Rm>, RRX 


Shift or rotate by value variant 
Applies when !(imm5 == 00000 && stype == 11). 


TST{<c>}{<q>} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 


n = UInt(Rn); m = UInt(Rm); 
(shift_t, shift_n) = DecodeImmShift(stype, imm5); 


T1 


|15 14 13 12/1110 9 8|7 65 |32 0] 


T1 variant 


TST{<c>}{<q>} <Rn>, <Rm> 


Decode for this encoding 
n = UInt(Rn); m = UInt(Rm); 
(shift_t, shift n) = (SRType_LSL, 0); 


T2 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0\1514 12|1110 9 8|7 6 5 4]3 0 | 


Rotate right with extend variant 
Applies when imm3 == 000 && imm2 == 00 && stype == 11. 


TST{<c>}{<q>} <Rn>, <Rm>, RRX 


Shift or rotate by value variant 


Applies when !(imm3 == 000 && imm2 == 00 && stype == 11). 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


TST{<c>}.W <Rn>, <Rm> // <Rn>, <Rm> can be represented in T1 
TST{<c>}{<q>} <Rn>, <Rm> {, <shift> #<amount>} 


Decode for all variants of this encoding 

n = UInt(Rn); m = UInt(Rm); 

(shift_t, shift_n) = DecodeImmShift(stype, imm3:imm2) ; 

if n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> For encoding A1: is the first general-purpose source register, encoded in the "Rn" field. The PC can 


be used, but this is deprecated. 

For encoding T1 and T2: is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> For encoding A1: is the second general-purpose source register, encoded in the "Rm" field. The PC 

can be used, but this is deprecated. 


For encoding T1 and T2: is the second general-purpose source register, encoded in the "Rm" field. 


<shift> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<amount> For encoding A1: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 


(when <shift> = LSR or ASR) encoded in the "imm5" field as <amount> modulo 32. 


For encoding T2: is the shift amount, in the range 1 to 31 (when <shift> = LSL or ROR) or 1 to 32 
(when <shift> = LSR or ASR), encoded in the "imm3:imm2" field as <amount> modulo 32. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(shifted, carry) = Shift_C(R[m], shift_t, shift_n, PSTATE.C); 
result = R[n] AND shifted; 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.264 TST (register-shifted register) 


ARM DDI 0487E.a 
ID070919 


Test (register-shifted register) performs a bitwise AND operation on a register value and a register-shifted register 
value. It updates the condition flags based on the result, and discards the result. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16|15 14 13 12|11 8|7 6 5 4|3 0 | 


[=m |oo 0 4 ofo oft] Ran  kokokoko] Rs [o[syeeji] Rm | 


cond 


A1 variant 


TST{<c>}{<q>} <Rn>, <Rm>, <type> <Rs> 


Decode for this encoding 

n = UInt(Rn); m = UInt(Rm); s = UInt(Rs); 

shift_t = DecodeRegShift(stype); 

if n == 15 || m == 15 || s == 15 then UNPREDICTABLE; 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 
<type> Is the type of shift to be applied to the second source register, encoded in the "stype" field. It can 
have the following values: 
LSL when stype = 00 
LSR when stype = 01 
ASR when stype = 10 
ROR when stype = 11 
<Rs> Is the third general-purpose source register holding a shift amount in its bottom 8 bits, encoded in 


the "Rs" field. 


Operation 


if ConditionPassed() then 
EncodingSpecificOperations(); 
shift_n = UInt(R[s]<7:0>); 
(shifted, carry) = Shift_C(R[m], shift t, shift_n, PSTATE.C); 
result = R[n] AND shifted; 
PSTATE.N = result<31>; 
PSTATE.Z = IsZeroBit(result); 
PSTATE.C = carry; 
// PSTATE.V unchanged 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
° The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.265 UADD16 


ARM DDI 0487E.a 
ID070919 


Unsigned Add 16 performs two 16-bit unsigned integer additions, and writes the results to the destination register. 
It sets PSTATE.GE according to the results of the additions. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[mm fo 1 to ojt ot] Rn | Ri kiolo ofi] Rm | 


cond 


A1 variant 


UADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7ojoo R [i117] Rd fojoj] om | 


T1 variant 


UADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum1 = UInt(R[n]<15:@>) + UInt(R[m]<15:0>); 
sum2 = UInt(R[n]<31:16>) + UInt(R[m]<31:16>) ; 
R[d]<15:@> = sum1<15:0>; 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


R[d]<31:16> = sum2<15:0>; 
PSTATE.GE<1:0> = if sum1 >= 0x10000 then '11' else 'QQ'; 
PSTATE.GE<3:2> = if sum2 >= 0x10000 then '11' else 'QQ'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.266 UADD8 
Unsigned Add 8 performs four unsigned 8-bit integer additions, and writes the results to the destination register. It 
sets PSTATE.GE according to the results of the additions. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[mm [o1 to ojt ot] Ra | Ri Lanier tfo_ ofi] Rm | 


cond 


A1 variant 


UADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiit7o7ojooo] Rn jira) Rd Jojo] Rm | 


T1 variant 


UADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum1 = UInt(R[n]<7:0>) + UInt(R[m]<7:0>); 
sum2 = UInt(R[n]<15:8>) + UInt(R[m]<15:8>); 
sum3 = UInt(R[n]<23:16>) + UInt(R[m]<23:16>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 


F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4706 


sum4 = UInt(R[n]<31:24>) + UInt(R[m]<31:24>); 
sum1<7:0>; 
sum2<7:0>; 
sum3<7:0>; 
sum4<7:Q>; 


R[d]<7:0> 
R[d]<15:8> 
R[d]<23:16> 
R[d]<31:24> 
PSTATE.GE<0> 
PSTATE.GE<1> 
PSTATE.GE<2> 
PSTATE.GE<3> 


if suml >= 
if sum2 >= 
if sum3 >= 
if sum4 >= 


Operational information 


0x100 then '1' else 
0x100 then '1' else 
0x100 then '1' else 
0x100 then '1' else 


'Q'; 
'Q': 
‘g's 
'Q'; 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 


or destination: 


è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.267 UASX 


ARM DDI 0487E.a 
ID070919 


Unsigned Add and Subtract with Exchange exchanges the two halfwords of the second operand, performs one 
unsigned 16-bit integer addition and one unsigned 16-bit subtraction, and writes the results to the destination 
register. It sets PSTATE.GE according to the results. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[m1 jot to oj1 of Rn | Rd kooo] afi] Rm | 


cond 


A1 variant 


UASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manar onorono] en [1117] Re ojojo] Rm | 


T1 variant 


UASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff = UInt(R[n]<15:@>) - UInt(R[m]<31:16>); 
sum = UInt(R[n]<31:16>) + UInt(R[m]<15:0>); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4707 
Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


R[d]<15:@> = diff<15:@>; 

R[d]<31:16> = sum<15:@>; 

PSTATE.GE<1:0> = if diff >= @ then '11' else '00'; 
PSTATE.GE<3:2> = if sum >= 0x10000 then '11' else 'QQ'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
: The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.268 UBFX 


ARM DDI 0487E.a 
ID070919 


Unsigned Bit Field Extract extracts any number of adjacent bits at any position from a register, zero-extends them 
to 32 bits, and writes the result to the destination register. 


A1 


|31 28|27 26 25 24|23 22 21 20| 16|15 12111 7 6 5 4|3 0| 


[mm o1 11 1jiji] widthmt | Rd | ib [101| R | 


cond 


A1 variant 


UBFX{<c>}{<q>} <Rd>, <Rn>, #<Isb>, #<width> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); 


Isbit = UInt(1sb); widthminusl = UInt(widthm1); 
if d == 15 || n == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0\1514  12|11 8|7 6 54| 0| 


MERNO O 





T1 variant 


UBFX{<c>}{<q>} <Rd>, <Rn>, #<lsb>, #<width> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); 

Isbit = UInt(imm3:imm2); widthminus1 = UInt(widthm1); 

if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the general-purpose source register, encoded in the "Rn" field. 

<lsb> For encoding A1: is the bit number of the least significant bit in the field, in the range 0 to 31, 


encoded in the "Isb" field. 


For encoding T1: is the bit number of the least significant bit in the field, in the range 0 to 31, 
encoded in the "imm3:imm2" field. 


<width> Is the width of the field, in the range 1 to 32-<Isb>, encoded in the "widthm1" field as <width>-1. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
msbit = Isbit + widthminus1; 
if msbit <= 31 then 
R[d] = ZeroExtend(R[n]<msbit:lsbit>, 32); 
else 
UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If msbit > 31, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
s The value in the destination register is UNKNOWN. 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Permanently Undefined generates an Undefined Instruction exception. 


The encodings for UDF used in this section are defined as permanently UNDEFINED in the Armv8-A architecture. 
However: 


s With the T32 instruction set, Arm deprecates using the UDF instruction in an IT block. 
. In the A32 instruction set, UDF is not conditional. 
A1 
|31 28|27 26 25 24|23 22 21 20|19 | | 8|7 6 5 4|3 0| 
Tit oorr nania) m on ma 
cond 
A1 variant 


UDF{<c>}{<q>} {#}<imm> 


Decode for this encoding 
imm32 = ZeroExtend(imm12:imm4, 32); 
// imm32 is for assembly and disassembly only, and is ignored by hardware. 


T1 


|15 14 13 12|11 10 9 8|7 | 0| 


Tioti1ijo] me | 


T1 variant 


UDF {<c>}{<q>} {#}<imm> 


Decode for this encoding 


imm32 = ZeroExtend(imm8, 32); 
// imm32 is for assembly and disassembly only, and is ignored by hardware. 


T2 


|15 1413 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 | | 0 | 


1111011111 tat imm fri ofifo] immi2 | 


T2 variant 


UDF{<c>}.W {#}<imm> // <imm> can be represented in T1 
UDF{<c>}{<q>} {#}<imm> 


Decode for this encoding 


imm32 = ZeroExtend(imm4:imm12, 32); 
// imm32 is for assembly and disassembly only, and is ignored by hardware. 
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Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. <c> must be AL or omitted. 
For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. Arm deprecates 
using any <c> value other than AL. 

<q> See Standard assembler syntax fields on page F2-3908. 

<imm> For encoding A1: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 
"imm12:imm4" field. The PE ignores the value of this constant. 


For encoding T1: is a 8-bit unsigned immediate, in the range 0 to 255, encoded in the "imm8" field. 
The PE ignores the value of this constant. 


For encoding T2: is a 16-bit unsigned immediate, in the range 0 to 65535, encoded in the 
"imm4:imm12" field. The PE ignores the value of this constant. 


Operation for all encodings 
if ConditionPassed() then 


EncodingSpecificOperations(); 
UNDEFINED; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.270 UDIV 


Unsigned Divide divides a 32-bit unsigned integer register value by a 32-bit unsigned integer register value, and 
writes the result to the destination register. The condition flags are not affected. 


See Divide instructions on page F1-3877 for more information about this instruction. 
A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12\11 81/7 6 5 4|3 0 | 


Posi fo 1 tt ofo ttf Ra May Rm fo o ofi] R | 
Ra 


cond 


A1 variant 
UDIV{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 
if d == 15 || n == 15 || m == 15 || a != 15 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


IfRa != '1111', then one of the following behaviors must occur: 
à The instruction is UNDEFINED. 
è The instruction executes as NOP. 
° The instruction executes as described, with no change to its behavior and no additional side effects. 
: The instruction performs a divide and the register specified by Ra becomes UNKNOWN. 
T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12111 8|7 6 5 4|3 0| 


maraon on) R (Mma R [1117] Rm | 
Ra 


T1 variant 
UDIV{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 
if d == 15 || n == 15 || m == 15 || a != 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


IfRa != '1111', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 
° The instruction executes as NOP. 
s The instruction executes as described, with no change to its behavior and no additional side effects. 
s The instruction performs a divide and the register specified by Ra becomes UNKNOWN. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5-4714 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Rd> 


<Rn> 


<Rm> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose destination register, encoded in the "Rd" field. 

Is the first general-purpose source register holding the dividend, encoded in the "Rn" field. 


Is the second general-purpose source register holding the divisor, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 
if UInt(R[m]) == @ then 
result = ð; 
else 
result = RoundTowardsZero(Real(UInt(R[n])) / Real(UInt(R[m]))); 
R[d] = result<31:0>; 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.271 UHADD16 
Unsigned Halving Add 16 performs two unsigned 16-bit integer additions, halves the results, and writes the results 


to the destination register. 


A1 


|31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[nn fo 1 to oft tt Ro | Ri fanfnfnfofo ofi] Rm | 


cond 


A1 variant 


UHADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7ojoo Ra prira) Rd fonio e 


T1 variant 


UHADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum1 = UInt(R[n]<15:0>) + UInt(R[m]<15:0>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


sum2 = UInt(R[n]<31:16>) + UInt(R[m]<31:16>) ; 
R[d]<15:@> = suml<16:1>; 
R[d]<31:16> = sum2<16:1>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.272 UHADD8 


ARM DDI 0487E.a 
ID070919 


Unsigned Halving Add 8 performs four unsigned 8-bit integer additions, halves the results, and writes the results to 
the destination register. 


A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[mm fo 1 to oft tt Ro | Ri kojo oft] Rm 


cond 


A1 variant 


UHADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto70o00] Rn jira) Rd fomio e 


T1 variant 


UHADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum1 = UInt(R[n]<7:0>) + UInt(R[m]<7:0>); 
sum2 = UInt(R[n]<15:8>) + UInt(R[m]<15:8>); 
sum3 = UInt(R[n]<23:16>) + UInt(R[m]<23:16>); 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


sum4 = UInt(R[n]<31:24>) + UInt(R[m]<31:24>); 
R[d]<7:@> = suml<8:1>; 
R[d]<15:8> = sum2<8:1>; 
R[d]<23:16> = sum3<8:1>; 
R[d]<31:24> = sum4<8:1>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.273 UHASX 


ARM DDI 0487E.a 
ID070919 


Unsigned Halving Add and Subtract with Exchange exchanges the two halfwords of the second operand, performs 
one unsigned 16-bit integer addition and one unsigned 16-bit subtraction, halves the results, and writes the results 
to the destination register. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[m jot to ofits af Rn | Ri kooo] fi] Rm | 


cond 


A1 variant 


UHASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manar onroronro] ev pira) e onio Rm 


T1 variant 


UHASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff = UInt(R[n]<15:@>) - UInt(R[m]<31:16>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


sum = UInt(R[n]<31:16>) + UInt(R[m]<15:0>); 
R[d]<15:@> = diff<1l6:1>; 
R[d]<31:16> = sum<16:1>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.274 UHSAX 


ARM DDI 0487E.a 
ID070919 


Unsigned Halving Subtract and Add with Exchange exchanges the two halfwords of the second operand, performs 
one unsigned 16-bit integer subtraction and one unsigned 16-bit addition, halves the results, and writes the results 
to the destination register. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


[m jot to oi taf Rn | Ri kooo] ofi] Rm 


cond 


A1 variant 


UHSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manar onrorn ao] e poira) Re onio Rm 


T1 variant 


UHSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum = UInt(R[n]<15:@>) + UInt(R[m]<31:16>); 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


diff = UInt(R[n]<31:16>) - UInt(R[m]<15:@>); 
R[d]<15:@> = sum<16:1>; 
R[d]<31:16> = diff<16:1>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.275 UHSUB16 
Unsigned Halving Subtract 16 performs two unsigned 16-bit integer subtractions, halves the results, and writes the 


results to the destination register. 


A1 


|31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[nm fo 1 to ojt a tt Ro | Ri kioo fi] Rm 


cond 


A1 variant 


UHSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7oio em poira) Rd fonio Am | 


T1 variant 


UHSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = UInt(R[n]<15:0>) - UInt(R[m]<15:0>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


diff2 = UInt(R[n]<31:16>) - UInt(R[m]<31:16>); 
R[d]<15:@> = diff1<16:1>; 
R[d]<31:16> = diff2<16:1; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.276 UHSUB8 


Unsigned Halving Subtract 8 performs four unsigned 8-bit integer subtractions, halves the results, and writes the 
results to the destination register. 


A1 


|31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[nn fo 1 to oft tt Ro | Ri Woo] fi) Rm 


cond 


A1 variant 


UHSUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7o oo) Ra jira) Rd fomio e 


T1 variant 


UHSUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = UInt(R[n]<7:@>) - UInt(R[m]<7:0>); 
diff2 = UInt(R[n]<15:8>) - UInt(R[m]<15:8>); 
diff3 = UInt(R[n]<23:16>) - UInt(R[m]<23:16>); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


diff4 = UInt(R[n]<31:24>) - UInt(R[m]<31:24>); 
R[d]<7:@> = diffl<8:1>; 
R[d]<15:8> = diff2<8:1>; 
R[d]<23:16> = diff3<8:1>; 
R[d]<31:24> = diff4<8:1>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.277 UMAAL 
Unsigned Multiply Accumulate Accumulate Long multiplies two unsigned 32-bit values to produce a 64-bit value, 
adds two unsigned 32-bit values, and writes the 64-bit result to two registers. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16|15 12111 8|7 6 5 4|3 0| 


| =111 |o o o ofo 1 ojoj Rani | Rdo | Rm |1001| Rn | 


cond 


A1 variant 


UMAAL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
Decode for this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); 


if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
: The value in the destination register is UNKNOWN. 
T1 
|15 14 13 12|1110 9 8|7 6 5 4|3 oļ15 12111 8|7 6 5 4|3 0| 


Tiit70777110| Ra | Rao | Rom Jorio) Rm | 


T1 variant 


UMAAL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Decode for this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); 
if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


// Armv8-A removes UNPREDICTABLE for R13 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
° The value in the destination register is UNKNOWN. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<RdLo> Is the general-purpose source register holding the first addend and the destination register for the 


lower 32 bits of the result, encoded in the "RdLo" field. 


<RdHi> Is the general-purpose source register holding the second addend and the destination register for the 
upper 32 bits of the result, encoded in the "RdHi" field. 


<Rn> Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 


<Rm> Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = UInt(R[n]) + UInt(R[m]) + UInt(R[dHi]) + UInt(R[dLo]); 
R[dHi] = result<63:32>; 
R[dLo] = result<31:0>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
od The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.278 UMLAL, UMLALS 


ARM DDI 0487E.a 
ID070919 


Unsigned Multiply Accumulate Long multiplies two unsigned 32-bit values to produce a 64-bit value, and 
accumulates this with a 64-bit value. 


In A32 instructions, the condition flags can optionally be updated based on the result. Use of this option adversely 
affects performance on many implementations. 


A1 
31 28|27 26 25 24|23 22 21 20|19 16/15 12|11 8|7 6 5 4|3 o| 


cond 


Flag setting variant 
Applies when S = 1. 


UMLALS{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Not flag setting variant 
Applies when S == 0. 
UMLAL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
Decode for all variants of this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 


if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The value in the destination register is UNKNOWN. 
T1 
|15 14 13 12|1110 9 8|7 6 5 4|3 0 \15 12111 8|7 6 5 4|3 0 | 


1117707471417 0] Rn | Rdlo | Rani [oO o 0 of Rm | 


T1 variant 


UMLAL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Decode for this encoding 


dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); setflags = FALSE; 
if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 

// Armv8-A removes UNPREDICTABLE for R13 

if dHi == dLo then UNPREDICTABLE; 
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F5-4730 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<RdLo> Is the general-purpose source register holding the lower 32 bits of the addend, and the destination 


register for the lower 32 bits of the result, encoded in the "RdLo" field. 


<RdHi> Is the general-purpose source register holding the upper 32 bits of the addend, and the destination 
register for the upper 32 bits of the result, encoded in the "RdHi" field. 


<Rn> Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 


<Rm> Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = UInt(R[n]) « UInt(R[m]) + UInt(R[dHi]:R[dLo]); 
R[dHi] = result<63:32>; 
R[dLo] = result<31:0>; 
if setflags then 
PSTATE.N = result<63>; 
PSTATE.Z = IsZeroBit(result<63:0>); 
// PSTATE.C, PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.279 UMULL, UMULLS 


ARM DDI 0487E.a 
ID070919 


Unsigned Multiply Long multiplies two 32-bit unsigned values to produce a 64-bit result. 


In A32 instructions, the condition flags can optionally be updated based on the result. Use of this option adversely 
affects performance on many implementations. 


A1 
31 28|27 26 25 24|23 22 21 20/19 16/15 12\11 8|7 6 5 4|3 0 | 


cond 


Flag setting variant 
Applies when S = 1. 


UMULLS{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Not flag setting variant 
Applies when S == 0. 
UMULL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 
Decode for all variants of this encoding 
dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); setflags = (S == '1'); 


if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 
if dHi == dLo then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
` The value in the destination register is UNKNOWN. 
T1 
|15 14 13 12/1110 9 8|7 6 5 4/3 015 12|11 8|7 6 5 4|3 0 | 


11111011 1/017 0] Rn | Rdlo | Rani jo 0 0 of Rm | 


T1 variant 


UMULL{<c>}{<q>} <RdLo>, <RdHi>, <Rn>, <Rm> 


Decode for this encoding 


dLo = UInt(RdLo); dHi = UInt(RdHi); n = UInt(Rn); m = UInt(Rm); setflags = FALSE; 
if dLo == 15 || dHi == 15 || n == 15 || m == 15 then UNPREDICTABLE; 

// Armv8-A removes UNPREDICTABLE for R13 

if dHi == dLo then UNPREDICTABLE; 
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CONSTRAINED UNPREDICTABLE behavior 


If dHi == dLo, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<RdLo> Is the general-purpose destination register for the lower 32 bits of the result, encoded in the "RdLo" 
field. 

<RdHi> Is the general-purpose destination register for the upper 32 bits of the result, encoded in the "RdHi" 
field. 

<Rn> Is the first general-purpose source register holding the multiplicand, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register holding the multiplier, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
result = UInt(R[n]) « UInt(R[m]); 
R[dHi] = result<63:32>; 
R[dLo] = result<31:0>; 
if setflags then 
PSTATE.N = result<63>; 
PSTATE.Z = IsZeroBit(result<63:0>); 
// PSTATE.C, PSTATE.V unchanged 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.280 UQADD16 


Unsigned Saturating Add 16 performs two unsigned 16-bit integer additions, saturates the results to the 16-bit 
unsigned integer range 0 <= x <= 216 - 1, and writes the results to the destination register. 


A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[111 fo 110 of1 1 of Rn | Ri kool oft] Rm | 


cond 


A1 variant 


UQADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitio7ojoow R jira) Rd fomo om _| 


T1 variant 


UQADD16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum1 = UInt(R[n]<15:@>) + UInt(R[m]<15:0>); 
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sum2 = UInt(R[n]<31:16>) + UInt(R[m]<31:16>) ; 
R[d]<15:@> = UnsignedSat(sum1, 16); 
R[d]<31:16> = UnsignedSat(sum2, 16); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.281 UQADD8 


ARM DDI 0487E.a 
ID070919 


Unsigned Saturating Add 8 performs four unsigned 8-bit integer additions, saturates the results to the 8-bit unsigned 
integer range 0 <= x <= 28 - 1, and writes the results to the destination register. 


A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[111 jo 110 oj1 1 of Rn | Ri Weft fo oft] Rm 


cond 


A1 variant 


UQADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


11111010 1joo0oo0| Rn [1111] ra Jojijoji] Rm | 


T1 variant 


UQADD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum1 = UInt(R[n]<7:@>) + UInt(R[m]<7:0>); 
sum2 = UInt(R[n]<15:8>) + UInt(R[m]<15:8>); 
sum3 = UInt(R[n]<23:16>) + UInt(R[m]<23:16>); 
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F5-4736 


sum4 = UInt(R[n]<31:24>) + UIn 
R[d]<7:@> = UnsignedSat(sum1 
R[d]<15:8> = UnsignedSat(sum2 
R[d]<23:16> = UnsignedSat(sum3 
R[d]<31:24> = UnsignedSat(sum4 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.282 UQASX 


ARM DDI 0487E.a 
ID070919 


Unsigned Saturating Add and Subtract with Exchange exchanges the two halfwords of the second operand, 
performs one unsigned 16-bit integer addition and one unsigned 16-bit subtraction, saturates the results to the 16-bit 
unsigned integer range 0 <= x <= 2!6 - 1, and writes the results to the destination register. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


pti fo 1 to oft 1 of] Rn | Ri kiolo fi] Rm | 


cond 


A1 variant 


UQASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


manar onrononr o] en ira) e Jopo] e 


T1 variant 


UQASX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff = UInt(R[n]<15:@>) - UInt(R[m]<31:16>); 
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sum = UInt(R[n]<31:16>) + UInt(R[m]<15:0>); 
R[d]<15:@> = UnsignedSat(diff, 16); 
R[d]<31:16> = UnsignedSat(sum, 16); 
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F5.1.283 UQSAX 


ARM DDI 0487E.a 
ID070919 


Unsigned Saturating Subtract and Add with Exchange exchanges the two halfwords of the second operand, 
performs one unsigned 16-bit integer subtraction and one unsigned 16-bit addition, saturates the results to the 16-bit 
unsigned integer range 0 <= x <= 216 - 1, and writes the results to the destination register. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[=m fo 1 to oft 1 of Rn | Ri kioj ofi] Rm 


cond 


A1 variant 


UQSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


marar onrorn ao] em ora) e opo e 


T1 variant 


UQSAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum = UInt(R[n]<15:@>) + UInt(R[m]<31:16>); 
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diff = UInt(R[n]<31:16>) - UInt(R[m]<15:0>); 
R[d]<15:@> = UnsignedSat(sum, 16); 
R[d]<31:16> = UnsignedSat(diff, 16); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.284 UQSUB16 


Unsigned Saturating Subtract 16 performs two unsigned 16-bit integer subtractions, saturates the results to the 
16-bit unsigned integer range 0 <= x <= 2!6 - 1, and writes the results to the destination register. 


A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[m11 fo 110 of1 tof Rn | Ra kooo afi] Rm 


cond 


A1 variant 


UQSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitio7oio am [jara] Ra opo ee 


T1 variant 


UQSUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = UInt(R[n]<15:0>) - UInt(R[m]<15:0>); 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4741 
ID070919 Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


diff2 = UInt(R[n]<31:16>) - UInt(R[m]<31:16>); 
R[d]<15:@> = UnsignedSat(diffl, 16); 
R[d]<31:16> = UnsignedSat(diff2, 16); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.285 UQSUB8 
Unsigned Saturating Subtract 8 performs four unsigned 8-bit integer subtractions, saturates the results to the 8-bit 


unsigned integer range 0 <= x <= 28 - 1, and writes the results to the destination register. 


A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[m11 fo 110 oj1 tof Rn | Ri Weft tft] Rm 


cond 


A1 variant 


UQSUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7oioo| R jira) Rd fomo em 


T1 variant 


UQSUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = UInt(R[n]<7:@>) - UInt(R[m]<7:0>); 
diff2 = UInt(R[n]<15:8>) - UInt(R[m]<15:8>); 
diff3 = UInt(R[n]<23:16>) - UInt(R[m]<23:16>); 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


diff4 = UInt(R[n]<31:24>) - UInt(R[m]<31:24>); 
R[d]<7:@> = UnsignedSat(diffl1, 8); 
R[d]<15:8> = UnsignedSat(diff2, 8); 
R[d]<23:16> = UnsignedSat(diff3, 8); 
R[d]<31:24> = UnsignedSat(diff4, 8); 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.286 USAD8 


Unsigned Sum of Absolute Differences performs four unsigned 8-bit subtractions, and adds the absolute values of 
the differences together. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16|15 14 13 12|11 8|7 6 5 4]|3 0| 
iit |0 117700 0] Rd |11 11| Rm jo0o001| R | 
cond 

A1 variant 


USAD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto171o0i17] Ra [i177] Rd jo ojo o] Rm | 


T1 variant 


USAD8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
absdiff1 = Abs(UInt(R[n]<7:@>) - UInt(R[m]<7:0>)); 
absdiff2 = Abs(UInt(R[n]<15:8>) - UInt(R[m]<15:8>)); 
absdiff3 = Abs(UInt(R[n]<23:16>) - UInt(R[m]<23:16>)); 
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absdiff4 = Abs(UInt(R[n]<31:24>) - UInt(R[m]<31:24>)); 
result = absdiffl + absdiff2 + absdiff3 + absdiff4; 
R[d] = result<31:0>; 
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F5.1.287 USADA8 


ARM DDI 0487E.a 
ID070919 


Unsigned Sum of Absolute Differences and Accumulate performs four unsigned 8-bit subtractions, and adds the 
absolute values of the differences to a 32-bit accumulate operand. 


A1 

|31 28|27 26 25 24|23 22 21 20|19 16115 12111 8|7 6 5 4]|3 0| 
iit |0 1174700 0] Rd | eit | Rm jooo1; R | 
cond Ra 

A1 variant 


USADA8{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for this encoding 
if Ra == '1111' then SEE "USAD8"; 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12\11 8|7 6 5 4|3 0 | 


Tit+t+7t0770[111] Ra | =i | Ra [000 0] Rm | 
Ra 


T1 variant 


USADA8{<c>}{<q>} <Rd>, <Rn>, <Rm>, <Ra> 


Decode for this encoding 

if Ra == '1111' then SEE "USAD8"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); a = UInt(Ra); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 

<Ra> Is the third general-purpose source register holding the addend, encoded in the "Ra" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 


absdiff1 = Abs(UInt(R[n]<7:@>) - UInt(R[m]<7:0>)); 

absdiff2 = Abs(UInt(R[n]<15:8>) - UInt(R[m]<15:8>)); 
absdiff3 = Abs(UInt(R[n]<23:16>) - UInt(R[m]<23:16>)); 
absdiff4 = Abs(UInt(R[n]<31:24>) - UInt(R[m]<31:24>)); 


result = UInt(R[a]) + absdiff1 + absdiff2 + absdiff3 + absdiff4; 
R[d] = result<31:0>; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
è The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.288 USAT 


Unsigned Saturate saturates an optionally-shifted signed value to a selected unsigned range. 


This instruction sets PSTATE.Q to 1 if the operation saturates. 


A1 
31 28|27 26 25 24|23 22 21 20| 16115 12|11 7 65 4|3 0| 
ei [o1 o 1i] simm | Ro | mms [nfo a] Rn _| 


cond 


Arithmetic shift right variant 
Applies when sh = 1. 


USAT{<c>}{<q>} <Rd>, #<imm>, <Rn>, ASR #<amount> 


Logical shift left variant 
Applies when sh = 0. 


USAT{<c>}{<q>} <Rd>, #<imm>, <Rn> {, LSL #<amount>} 


Decode for all variants of this encoding 


d = UInt(Rd); n = UInt(Rn); saturate_to = UInt(sat_imm); 
(shift t, shift_n) = DecodeImmShift(sh:'0', imm5); 
if d == 15 || n == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 01514  12|11 8|7 6 5 4| 0 | 


11 1 1 ofoft 1f1 ofshfof Rn fo] imma | Ra fimm2|(o)]__sat_imm_| 





Arithmetic shift right variant 
Applies when sh == 1 && !(imm3 == 000 && imm2 == QQ). 


USAT{<c>}{<q>} <Rd>, #<imm>, <Rn>, ASR #<amount> 


Logical shift left variant 
Applies when sh = 0. 


USAT{<c>}{<q>} <Rd>, #<imm>, <Rn> {, LSL #<amount>} 


Decode for all variants of this encoding 


if sh == '1' && (imm3:imm2) == 'QQ000' then SEE "USAT16"; 

d = UInt(Rd); n = UInt(Rn); saturate_to = UInt(sat_imm); 

(shift_t, shift_n) = DecodeImmShift(sh:'@', imm3:imm2); 

if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5-4750 


Assembler symbols 


<C> 


<q> 


<Rd> 


<imm> 


<Rn> 


<amount> 


See Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the general-purpose destination register, encoded in the "Rd" field. 

Is the bit position for saturation, in the range 0 to 31, encoded in the "sat_imm" field. 
Is the general-purpose source register, encoded in the "Rn" field. 


For encoding A1: is the optional shift amount, in the range 0 to 31, defaulting to 0 and encoded in 
the "imm5" field. 


For encoding A1: is the shift amount, in the range 1 to 32 encoded in the "imm5" field as <amount> 
modulo 32. 


For encoding T1: is the optional shift amount, in the range 0 to 31, defaulting to 0 and encoded in 
the "Imm3:imm2" field. 


For encoding T1: is the shift amount, in the range 1 to 31 encoded in the "imm3:imm2" field as 
<amount>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
operand = Shift(R[n], shift_t, shift_n, PSTATE.C); // PSTATE.C ignored 
(result, sat) = UnsignedSatQ(SInt(operand), saturate_to); 
R[d] = ZeroExtend(result, 32); 


if sat then 
PSTATE.Q = '1'; 
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F5.1.289 USAT16 


ARM DDI 0487E.a 
ID070919 


Unsigned Saturate 16 saturates two signed 16-bit values to a selected unsigned range. 


This instruction sets PSTATE.Q to 1 if the operation saturates. 
A1 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


erm fo 7710 ai o] smm | Ra (foo 17] Rn 


cond 


A1 variant 


USAT16{<c>}{<q>} <Rd>, #<imm>, <Rn> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); saturate_to = UInt(sat_imm); 
if d == 15 || n == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 [15 14 13 12|11 8|7 6 5 4|3 0 | 


771 oft a[t opto, Rn [ojo o oj Ra Jo opoo sat_imm | 


T1 variant 


USAT16{<c>}{<q>} <Rd>, #<imm>, <Rn> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); saturate_to = UInt(sat_imm); 
if d == 15 || n == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<imm> Is the bit position for saturation, in the range 0 to 15, encoded in the "sat_imm" field. 
<Rn> Is the general-purpose source register, encoded in the "Rn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
(result1, sat1) = UnsignedSatQ(SInt(R[n]<15:0>), saturate_to); 
(result2, sat2) = UnsignedSatQ(SInt(R[n]<31:16>), saturate_to); 
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R[d]<15:@> = ZeroExtend(result1, 16); 
R[d]<31:16> = ZeroExtend(result2, 16); 
if satl || sat2 then 

PSTATE.Q = '1'; 
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F5.1.290 USAX 


ARM DDI 0487E.a 
ID070919 


Unsigned Subtract and Add with Exchange exchanges the two halfwords of the second operand, performs one 
unsigned 16-bit integer subtraction and one unsigned 16-bit addition, and writes the results to the destination 
register. It sets PSTATE.GE according to the results. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


[m1 jot to oj1 of Rn | Ra kooo] oft] Rm | 


cond 


A1 variant 


USAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


marar onrorn ao] em [17717] e ojoo] Rm 


T1 variant 


USAX{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
sum = UInt(R[n]<15:0>) + UInt(R[m]<31:16>); 
diff = UInt(R[n]<31:16>) - UInt(R[m]<15:0>); 
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R[d]<15:@> = sum<15:@>; 

R[d]<31:16> = diff<15:@>; 

PSTATE.GE<1:0> = if sum >= 0x10000 then '11' else 'QQ'; 
PSTATE.GE<3:2> = if diff >= @ then '11' else 'Q0'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
: The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.291 USUB16 
Unsigned Subtract 16 performs two 16-bit unsigned integer subtractions, and writes the results to the destination 


register. It sets PSTATE.GE according to the results of the subtractions. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[mm fo 1 to ojt ot] Rao | Ri fanfenenfofs fi] Rm 


cond 


A1 variant 


USUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7oio Ra ira) Rd fojoj] om 


T1 variant 


USUB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = UInt(R[n]<15:@>) - UInt(R[m]<15:@>); 
diff2 = UInt(R[n]<31:16>) - UInt(R[m]<31:16>); 
R[d]<15:@> = diff1<15:0>; 
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R[d]<31:16> = diff2<15:0>; 
PSTATE.GE<1:0> = if diff1 >= @ then '11' else '00'; 
PSTATE.GE<3:2> = if diff2 >= @ then '11' else '00'; 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.292 USUB8 
Unsigned Subtract 8 performs four 8-bit unsigned integer subtractions, and writes the results to the destination 


register. It sets PSTATE.GE according to the results of the subtractions. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[mm [o1 to ojt ot] Rao | Ri kioo] fi] Rm 


cond 


A1 variant 


USUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 
d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 
if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Tiitto7o0ioo| Ra jira) Rd fojoj) Rm 


T1 variant 


USUB8{<c>}{<q>} {<Rd>,} <Rn>, <Rm> 


Decode for this encoding 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); 

if d == 15 || n == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 
<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 
<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
diff1 = UInt(R[n]<7:@>) - UInt(R[m]<7:0>); 
diff2 = UInt(R[n]<15:8>) - UInt(R[m]<15:8>); 
diff3 = UInt(R[n]<23:16>) - UInt(R[m]<23:16>); 
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F5-4758 


diff4 = UInt(R[n]<31:24>) - UInt(R[m]<31:24>); 


R[d]<7:Q> 
R[d]<15:8> 
R[d]<23:16> 
R[d]<31:24> 
PSTATE.GE<Q> 
PSTATE.GE<1> 
PSTATE.GE<2> 
PSTATE.GE<3> 


diff1<7:0>; 
diff2<7:0>; 
diff3<7:0>; 
diff4<7:0>; 
= if diffl >= 
if diff2 >= 
if diff3 >= 
= if diff4 >= 


Operational information 


O then '1' else 'Q'; 
O then '1' else 'Q'; 
O then '1' else 'Q'; 
O then '1' else 'Q'; 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 


or destination: 


è The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F5.1.293 UXTAB 


ARM DDI 0487E.a 
ID070919 


Unsigned Extend and Add Byte extracts an 8-bit value from a register, zero-extends it to 32 bits, adds the result to 
the value in another register, and writes the final result to the destination register. The instruction can specify a 
rotation by 0, 8, 16, or 24 bits before extracting the 8-bit value. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[ 11111 fo 1 1 0 1jiji of 1117 | Ra frotateloofo_ 1 1 1| Rm | 
Rn 


cond 


A1 variant 


UXTAB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 
if Rn == '1111' then SEE "UXTB"; 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Danana onoono) emn [i111] Ra oo Rm | 
Rn 





T1 variant 


UXTAB{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 

if Rn == '1111' then SEE "UXTB"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F5-4759 
Non-Confidential 


T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


16 when rotate = 10 


24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d] = R[n] + ZeroExtend(rotated<7:0>, 32); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
° The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F5.1.294 UXTAB16 


ARM DDI 0487E.a 
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Unsigned Extend and Add Byte 16 extracts two 8-bit values from a register, zero-extends them to 16 bits each, adds 
the results to two 16-bit values from another register, and writes the final results to the destination register. The 
instruction can specify a rotation by 0, 8, 16, or 24 bits before extracting the 8-bit values. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[ 11111 Jo 1 1 0 tfifo of 1117 | Rda frotateloofo 1 1 1| Rm | 
Rn 


cond 


A1 variant 


UXTAB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 
if Rn == '1111' then SEE "UXTB16"; 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Danana onoo ip) emn [i111] Ra ooa Rm | 
Rn 





T1 variant 


UXTAB16{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 

if Rn == '1111' then SEE "UXTB16"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


16 when rotate = 10 


24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d]<15:@> = R[n]<15:@> + ZeroExtend(rotated<7:@>, 16); 
R[d]<31:16> = R[n]<31:16> + ZeroExtend(rotated<23:16>, 16); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
a The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.295 UXTAH 


ARM DDI 0487E.a 
ID070919 


Unsigned Extend and Add Halfword extracts a 16-bit value from a register, zero-extends it to 32 bits, adds the result 
to a value from another register, and writes the final result to the destination register. The instruction can specify a 
rotation by 0, 8, 16, or 24 bits before extracting the 16-bit value. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[ 11111 fo 1 1 0 1jiji 1| 1111 | Ra frotateloofo_ 1 1 1| Rm | 
Rn 


cond 


A1 variant 


UXTAH{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 
if Rn == '1111' then SEE "UXTH"; 


d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 14 13 12|11 8|7 6 5 4|3 0| 


Danano ooo op] emn [i111] Ra ooa Rm | 
Rn 





T1 variant 


UXTAH{<c>}{<q>} {<Rd>,} <Rn>, <Rm> {, ROR #<amount>} 


Decode for this encoding 

if Rn == '1111' then SEE "UXTH"; 

d = UInt(Rd); n = UInt(Rn); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rn> Is the first general-purpose source register, encoded in the "Rn" field. 

<Rm> Is the second general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
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16 when rotate = 10 


24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d] = R[n] + ZeroExtend(rotated<15:0>, 32); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
° The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


a The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.296 UXTB 


ARM DDI 0487E.a 
ID070919 


Unsigned Extend Byte extracts an 8-bit value from a register, zero-extends it to 32 bits, and writes the result to the 
destination register. The instruction can specify a rotation by 0, 8, 16, or 24 bits before extracting the 8-bit value. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 


[1mm fo 1 to 1ļiji oji 141] Rd frotatelofoyo 1 1 1| Rm | 


cond 


A1 variant 


UXTB{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 
d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8|7 65 |32 ol] 


fT o71007 omi] Rm] Ra | 


T1 variant 


UXTB{<c>}{<q>} {<Rd>,} <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); rotation = 0; 
T2 


|15 14 13 1211110 9 8/7 6 5 4|3 2 1 0|151413 12/11 8|7 6 5 4|3 0| 


Toit 1010 of opie Rd oo| Rm | 


T2 variant 


UXTB{<c>}.W {<Rd>,} <Rm> // <Rd>, <Rm> can be represented in T1 
UXTB{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 

d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
16 when rotate = 10 
24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d] = ZeroExtend(rotated<7:@>, 32); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
s The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.297  UXTB16 


Unsigned Extend Byte 16 extracts two 8-bit values from a register, zero-extends them to 16 bits each, and writes 
the results to the destination register. The instruction can specify a rotation by 0, 8, 16, or 24 bits before extracting 
the 8-bit values. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 121110 9 8|7 6 5 4|3 0 | 


[m1 fo 110 tfifo oft 111| Ra frotatelofolo 1 1 1| Rm | 


cond 


A1 variant 
UXTB16{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|151413 12/11 8|7 6 5 4|3 0| 


7711070 007i 1111117] Re oo| Rm 


T1 variant 
UXTB16{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 
Decode for this encoding 
d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> For encoding A1: is the general-purpose source register, encoded in the "Rm" field. 


For encoding T1: is the second general-purpose source register, encoded in the "Rm" field. 


<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
16 when rotate = 10 
24 when rotate = 11 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d]<15:@> = ZeroExtend(rotated<7:0>, 16); 
R[d]<31:16> = ZeroExtend(rotated<23:16>, 16); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
$ The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.298 UXTH 


ARM DDI 0487E.a 
ID070919 


Unsigned Extend Halfword extracts a 16-bit value from a register, zero-extends it to 32 bits, and writes the result to 
the destination register. The instruction can specify a rotation by 0, 8, 16, or 24 bits before extracting the 16-bit 
value. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


[m fo 410 a1jifi aji 111] Ra frotatelooyfo 1 1 1| Rm | 


cond 


A1 variant 


UXTH{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 
d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 
if d == 15 || m == 15 then UNPREDICTABLE; 


T1 


|15 14 13 1211110 9 8|7 65 |32 ol 


[0741007 oo] Rm] Ra | 


T1 variant 


UXTH{<c>}{<q>} {<Rd>,} <Rm> 


Decode for this encoding 


d = UInt(Rd); m = UInt(Rm); rotation = Q; 
T2 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|151413 12/11 8|7 6 5 4|3 0| 


7711070 Ooi 1111111 Re ooa Rm 


T2 variant 


UXTH{<c>}.W {<Rd>,} <Rm> // <Rd>, <Rm> can be represented in T1 
UXTH{<c>}{<q>} {<Rd>,} <Rm> {, ROR #<amount>} 


Decode for this encoding 

d = UInt(Rd); m = UInt(Rm); rotation = UInt(rotate:'000'); 

if d == 15 || m == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Rd> Is the general-purpose destination register, encoded in the "Rd" field. 

<Rm> Is the general-purpose source register, encoded in the "Rm" field. 

<amount> Is the rotate amount, encoded in the "rotate" field. It can have the following values: 


(omitted) when rotate = 00 


8 when rotate = 01 
16 when rotate = 10 
24 when rotate = 11 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
rotated = ROR(R[m], rotation); 
R[d] = ZeroExtend(rotated<15:@>, 32); 


Operational information 


If CPSR.DIT is 1, this instruction has passed its condition execution check, and does not use R15 as either its source 
or destination: 
s The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 

— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Wait For Event is a hint instruction that indicates that the PE can enter a low-power state and remain there until a 
wakeup event occurs. Wakeup events include the event signaled as a result of executing the SEV instruction on any 
PE in the multiprocessor system. For more information, see Wait For Event and Send Event on page G1-5562. 


As described in Wait For Event and Send Event on page G1-5562, the execution of a WFE instruction that would 
otherwise cause entry to a low-power state can be trapped to a higher Exception level, see: 


. Traps to Undefined mode of ELO execution of WFE and WFI instructions on page G1-5579. 
. Traps to Hyp mode of Non-secure ELO and EL1 execution of WFE and WFI instructions on page G1-5595. 


s Traps to Monitor mode of the execution of WFE and WFI instructions in modes other than Monitor mode on 
page G1-5606. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|1110 9 8|7 6 5 4|3 2 1 0| 


[=n Joo 1 1 ojoj1i ofo ofo okD koo o0) 0 0o o o0 001 0 


cond 


A1 variant 


WFE{<c>}{<q>} 


Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0| 


TOT7117700710)0000] 


T1 variant 


WFE{<c>}{<q>} 


Decode for this encoding 


// No additional decoding required 


T2 


|15 1413 12/1110 9 8/7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 21 0| 


Tit T0011 101 OM ofofofofo o ojo oo ofo010] 


T2 variant 


WFE{<c>}.W 


Decode for this encoding 


// No additional decoding required 
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Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if IsEventRegisterSet() then 
ClearEventRegister(); 
else 
if PSTATE.EL == ELO then 
// Check for traps described by the OS which may be EL1 or EL2. 
AArch32.CheckForWFxTrap(EL1, TRUE); 
if PSTATE.EL IN {ELQ, EL1} && EL2Enabled() && !IsInHost() then 
// Check for traps described by the Hypervisor. 
AArch32.CheckForWFxTrap(EL2, TRUE); 
if HaveEL(EL3) && PSTATE.M != M32_Monitor then 
// Check for traps described by the Secure Monitor. 
AArch32.CheckForWFxTrap(EL3, TRUE); 
WaitForEvent(); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Wait For Interrupt is a hint instruction that indicates that the PE can enter a low-power state and remain there until 
a wakeup event occurs. For more information, see Wait For Interrupt on page G1-5565. 


As described in Wait For Interrupt on page G1-5565, the execution of a WFI instruction that would otherwise cause 
entry to a low-power state can be trapped to a higher Exception level, see: 


s Traps to Undefined mode of ELO execution of WFE and WFI instructions on page G1-5579. 
. Traps to Hyp mode of Non-secure ELO and EL1 execution of WFE and WFI instructions on page G1-5595. 


à Traps to Monitor mode of the execution of WFE and WFI instructions in modes other than Monitor mode on 
page G1-5606. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 14 13 12|11 10 9 8|7 6 5 4|3 2 1 0| 


Cem [oo 17 ojo ojo ojo o KONO o o o o o 


cond 


A1 variant 


WFI{<c>}{<q>} 


Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0] 


TOT7t11770011)0000] 


T1 variant 
WFI{<c>}{<q>} 
Decode for this encoding 


// No additional decoding required 


T2 


[15 14 1312/1110 9 8/7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 21 0| 


ToT TOOT 101 OM ofofofofo o ojo oo ooo 


T2 variant 


WFI{<c>}.W 


Decode for this encoding 


// No additional decoding required 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 
<c> See Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if !InterruptPending() then 
if PSTATE.EL == ELO then 
// Check for traps described by the OS which may be EL1 or EL2. 
AArch32.CheckForWFxTrap(EL1, FALSE); 
if PSTATE.EL IN {ELQ, EL1} && EL2Enabled() && !IsInHost() then 
// Check for traps described by the Hypervisor. 
AArch32.CheckForWFxTrap(EL2, FALSE); 
if HaveEL(EL3) && PSTATE.M != M32_Monitor then 
// Check for traps described by the Secure Monitor. 
AArch32.CheckForWwFxTrap(EL3, FALSE); 
WaitForInterrupt(); 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


F5.1.301 YIELD 


ARM DDI 0487E.a 
ID070919 


YIELD is a hint instruction. Software with a multithreading capability can use a YIELD instruction to indicate to the 
PE that it is performing a task, for example a spin-lock, that could be swapped out to improve overall system 
performance. The PE can use this hint to suspend and resume multiple software threads if it supports the capability. 


For more information about the recommended use of this instruction see The Yield instruction on page F1-3883. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16/15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0| 


[111 Jo o 1 1 Ofol1 ofo ofo okooko ooo o o o o o o1 


cond 


A1 variant 


YIELD{<c>}{<q>} 
Decode for this encoding 


// No additional decoding required 


T1 


|15 14 13 1211110 9 8|7 6 5 4|3 2 1 0| 


10111171 14000 1ļo 000] 


T1 variant 
YIELD{<c>}{<q>} 
Decode for this encoding 


// No additional decoding required 


T2 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0/15141312/11109 8/7 6 5 4/3 2 1 0| 


1110011101 oaa okooko o ojo o oojo o 01| 


T2 variant 


YIELD{<c>}.W 


Decode for this encoding 


// No additional decoding required 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 
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F5.1 Alphabetical list of T32 and A32 base instruction set instructions 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
Hint_Yield(); 
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F5.2 


F5.2.1 


ARM DDI 0487E.a 
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T32 and A32 Base Instruction Set Instruction Descriptions 
F5.2 Encoding and use of banked register transfer instructions 


Encoding and use of banked register transfer instructions 


Software executing at EL1 or higher can use the MRS (banked register) and MSR (banked register) instructions to 
transfer values between the general-purpose registers and Special-purpose registers. One particular use of these 
instructions is for a hypervisor to save or restore the register values of a Guest OS. The following sections give more 
information about these instructions: 


$ Register arguments in the banked register transfer instructions. 

7 Usage restrictions on the banked register transfer instructions on page F5-4778. 

. Encoding the register argument in the banked register transfer instructions on page F5-4779. 
. Pseudocode support for the banked register transfer instructions on page F5-4780. 


For descriptions of the instructions see MRS (Banked register) on page F5-4360 and MSR (Banked register) on 


page F5-4364. 


Register arguments in the banked register transfer instructions 


Figure F5-1 shows the banked general-purpose registers and Special-purpose registers: 


General-purpose 
registers 


Special-purpose 
registers 


Í 
User or 


Associated PE mode 





Hyp Supervisor Abort Undefined Monitor IRQ FIQ 


System 
R8_usr 





R9_usr 





R10_usr 





R11_usr 





R12_usr 





SP_usr 


SP_hyp 


SP_svc SP_abt SP_und SP_mon SP_irg 








LR_usr LR_svc LR_abt LR_und LR_irq 


SPSR_hyp SPSR svc SPSR abt SPSR_und SPSR_mon SPSR irq  SPSR_fiq 
ELR_hyp 


LR_mon 


For the general-purpose registers, if no other register is shown, the current mode register is the _usr register. 
So, for example, the full set of current mode registers, including the registers that are not banked: 

e For Hyp mode, is {RO_usr - R12_usr, SP_hyp, LR_usr, SPSR_hyp, ELR_hyp}. 

e For Abort mode, is {RO_usr - R12_usr, SP_abt, LR_abt, SPSR_abt}. 


Figure F5-1 Banking of general-purpose and Special-purpose registers 


Figure F5-1 is based on Figure G1-2 on page G1-5487, that shows the complete set of general-purpose registers and 
Special-purpose registers accessible in each mode. 





Note 


. System mode uses the same set of registers as User mode. Neither of these modes can access an SPSR, except 
that System mode can use the MRS (banked register) and MSR (banked register) instructions to access some 
SPSRs, as described in Usage restrictions on the banked register transfer instructions on page F5-4778. 


e General-purpose registers RO-R7, that are not banked, cannot be accessed using the MRS (banked register) and 
MSR (banked register) instructions. 


g In addition to the registers shown in Figure F5-1, the DLR and DSPSR are AArch32 System registers that 
map onto the AArch64 Special-purpose registers DLR_ELO and DSPSR_EL0. However, DLR and DSPSR 
are not accessible using the MRS (banked register) and MSR (banked register) instructions. 


Software using an MRS (banked register) or MSR (banked register) instruction specifies one of these registers using a 
name shown in Figure F5-1, or an alternative name for SP or LR. These registers can be grouped as follows: 


R8-R12 
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SP There is a banked copy of SP for every mode except System mode. For example, SP_svc is the SP 
for Supervisor mode. 


LR There is a banked copy of LR for every mode except System mode and Hyp mode. For example, 
LR_ sve is the LR for Supervisor mode. 


SPSR There is a banked copy of SPSR for every mode except System mode and User mode. 


ELR_hyp Except for the operations provided by MRS (banked register) and MSR (banked register), ELR_hyp is 
accessible only from Hyp mode. It is not banked. 


F5.2.2 Usage restrictions on the banked register transfer instructions 


MRS (banked register) and MSR (banked register) instructions are CONSTRAINED UNPREDICTABLE if any of the 
following applies: 


. The instruction is executed in User mode. 


° The instruction accesses a banked register that is not implemented, or that either: 
—  Isnot accessible from the current Privilege level and Security state. 
— Can be accessed from the current mode by using a different instruction. 


MSR (banked register) and MRS (banked register) on page K1-7628 describes the permitted CONSTRAINED 
UNPREDICTABLE behavior. 


An MRS (banked register) instruction or an MSR (banked register) instruction executed: 


. At Non-secure EL1 cannot access any Hyp mode banked registers. 
$ At Non-secure EL1 or EL2 cannot access any Monitor mode banked registers. 
° In a Secure mode other than Monitor mode cannot access any Hyp banked registers. 


This means that the banked registers that MRS (banked register) and MSR (banked register) instructions cannot access 
are: 


From Monitor mode 





. The current mode registers R8_usr-R12_usr, SP_mon, LR mon, and SPSR_mon. 
From Hyp mode 
ë The Monitor mode registers SP_mon, LR_mon, and SPSR_mon. 


° The current mode registers R8_usr-R12_usr, SP_hyp, LR_usr, and SPSR_hyp. 





Note 


MRS (banked register) and MSR (banked register) instructions can access the current mode register 
ELR hyp. 








From FIQ mode 
: From Non-secure EL1, the Monitor mode registers SP_mon, LR_mon, and SPSR_mon. 
- The Hyp mode registers SP_hyp, SPSR_hyp, and ELR_hyp. 
° The current mode registers R8 _fiq-R12_fiq, SP_fiq, LR_fiq, and SPSR_fiq. 





From System mode 


° From Non-secure EL1, the Monitor mode registers SP_mon, LR_mon, and SPSR_mon. 
` The Hyp mode registers SP_hyp, SPSR_hyp, and ELR hyp. 
s The current mode registers R8_usr-R12_usr, SP_usr, and LR_usr. 


From Supervisor mode, Abort mode, Undefined mode, and IRQ mode 


° From Non-secure EL1, the Monitor mode registers SP_mon, LR_mon, and SPSR_mon. 
a The Hyp mode registers SP_hyp, SPSR_hyp, and ELR hyp. 
° The current mode registers R8_usr-R12_usr, SP_<current_mode>, LR_<current_mode>, 





and SPSR_<current_mode>. 
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If EL3 is using AArch64, all MRS (banked register) and MSR (banked register) accesses to the Monitor mode registers 
from Secure EL1 modes are trapped to EL3. See Traps to EL3 of Secure monitor functionality from Secure EL1 
using AArch32 on page D1-2361. 


For more information, see: 

s Encoding the register argument in the banked register transfer instructions. 

$ Pseudocode support for the banked register transfer instructions on page F5-4780. 
s MRS (Banked register) on page F5-4360. 

: MSR (Banked register) on page F5-4364. 





Note 


CONSTRAINED UNPREDICTABLE behavior must not give access to registers that are not accessible from the current 
Privilege level and Security state. 















































F5.2.3 Encoding the register argument in the banked register transfer instructions 
The MRS (banked register) and MSR (banked register) instructions include a 5-bit field, SYSm, and an R bit, that 
together encode the register argument for the instruction. 
When the R bit is set to 0, the argument is a register other than a banked copy of the SPSR, and Table F5-1 shows 
how the SYSm field defines the required register argument. In this table, CONST. UNPREDICTABLE indicates that 
behavior is CONSTRAINED UNPREDICTABLE. 
Table F5-1 Banked register encodings when R==0 
SYSm<4:3> 
SYSm<2:0> 
0b00 b01 0b10 Qb11 
0b000 R8_usr R8_fiq LR_irq CONST. UNPREDICTABLE 
0b001 R9_usr R9_fiq SP_irq CONST. UNPREDICTABLE 
0b010 R10_usr R10_fiq LR svc CONST. UNPREDICTABLE 
0b011 R11_usr R11_fiq SP svc CONST. UNPREDICTABLE 
0b100 R12_usr R12_fiq LR_abt LR mon 
0b101 SP_usr SP_fiq SP_abt SP_mon 
0b110 LR_usr LR fiq LR und ELR hyp 
0b111 CONST. UNPREDICTABLE CONST. UNPREDICTABLE SP_und SP_hyp 
When the R bit is set to 1, the argument is a banked copy of the SPSR, and Table F5-2 shows how the SY Sm field 
defines the required register argument. In this table, CONST. UNPREDICTABLE indicates that behavior is 
CONSTRAINED UNPREDICTABLE. 
Table F5-2 Banked register encodings when R== 
SYSm<4:3> 
SYSm<2:0> 
0bd0 Qb01 0b10 Qb11 
0b000 CONST. UNPREDICTABLE CONST. UNPREDICTABLE SPSR_irq CONST. UNPREDICTABLE 
0b001 CONST. UNPREDICTABLE CONST. UNPREDICTABLE CONST. UNPREDICTABLE CONST. UNPREDICTABLE 
0b010 CONST. UNPREDICTABLE CONST. UNPREDICTABLE SPSR_ sve CONST. UNPREDICTABLE 
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Table F5-2 Banked register encodings when R==1 (continued) 





SYSm<2:0> 


0b011 


SYSm<4:3> 


0b00 


0b01 


0b10 


0b11 





CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 





0b100 


CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 


SPSR_abt 


SPSR_mon 





0b101 


CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 





0b110 


CONST. UNPREDICTABLE 


SPSR_fiq 


SPSR_und 


SPSR_hyp 





Qb111 


CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 


CONST. UNPREDICTABLE 





F5.2.4 


F5-4780 


Pseudocode support for the banked register transfer instructions 


The pseudocode functions BankedRegisterAccessValid() and SPSRaccessValid() check the validity of MRS (banked 
register) and MSR (banked register) accesses. That is, they filter the accesses that are CONSTRAINED UNPREDICTABLE 
either because: 


They attempt to access a register that Usage restrictions on the banked register transfer instructions on 
page F5-4778 shows is not accessible. 


They use an SYSm<4:@> encoding that Encoding the register argument in the banked register transfer 
instructions on page F5-4779 shows as CONSTRAINED UNPREDICTABLE. 


BankedRegisterAccessValid() applies to accesses to the banked general-purpose registers, or to ELR_hyp, and 
SPSRaccessValid() applies to accesses to the SPSRs. 
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Chapter F6 


T32 and A32 Advanced SIMD and Floating-point 
Instruction Descriptions 


This chapter describes each instruction. It contains the following sections: 


s Alphabetical list of Advanced SIMD and floating-point instructions on page F6-4782. 


Note 


Some headings in this chapter use the term floating-point register. This is an abbreviated description, and means a 
register in the Advanced SIMD and floating-point register file. 
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F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


This section lists every Advanced SIMD and floating-point instruction in the T32 and A32 instruction sets. For 
details of the format used see Format of instruction descriptions on page F2-3904. 


This section is formatted so that each instruction description starts on a new page. 
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F6.1.1 AESD 


ARM DDI 0487E.a 
ID070919 


AES single round decryption. 


A1 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 


Ti7700%7 1p isejo of va [ojo 17 omo] vm | 


A1 variant 


AESD.<dt> <Qd>, <Qm> 


Decode for this encoding 


if !HaveAESExt() then UNDEFINED; 
if size != '00' then UNDEFINED; 
if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


11111111 1fpji 1[szeļo of va [ojo 1 1 ojijmjo] vm | 


T1 variant 


AESD.<dt> <Qd>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveAESExt() then UNDEFINED; 

if size != '@@' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 


<dt> Is the data type, encoded in the "size" field. It can have the following values: 
8 when size = 00 


The following encodings are reserved: 


° size = 0l. 
° size = 1x. 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
op1 = Q[d>>1]; op2 = Q[m>>1]; 
Q[d>>1] = AESInvSubBytes(AESInvShiftRows(op1 EOR op2)); 


Operational information 


If CPSR.DIT is 1: 


7 The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.2 AESE 


ARM DDI 0487E.a 
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AES single round encryption. 


A1 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 


Ti 770017 101 isejo o] va [ojo 11 olomo] vm | 


A1 variant 


AESE.<dt> <Qd>, <Qm> 


Decode for this encoding 


if !HaveAESExt() then UNDEFINED; 
if size != '00' then UNDEFINED; 
if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


11111111 1fpji 1[szeļo of va [ojo 1 1 ojojmjo] vm | 


T1 variant 


AESE.<dt> <Qd>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveAESExt() then UNDEFINED; 

if size != '00' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 


<dt> Is the data type, encoded in the "size" field. It can have the following values: 
8 when size = 00 


The following encodings are reserved: 


° size = 0l. 
° size = 1x. 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
op1 = Q[d>>1]; op2 = Q[m>>1]; 
Q[d>>1] = AESSubBytes(AESShiftRows(op1 EOR op2)); 


Operational information 


If CPSR.DIT is 1: 


7 The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.3 AESIMC 


AES inverse mix columns. 


A1 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 


Ti 770077 1p isejo o] va ojoro] vm | 


A1 variant 


AESIMC.<dt> <Qd>, <Qm> 


Decode for this encoding 


if !HaveAESExt() then UNDEFINED; 
if size != '00' then UNDEFINED; 
if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


11111111 1fpji 1[szeļo of va [ojo 1 1 1jijmjo] vm | 


T1 variant 


AESIMC.<dt> <Qd>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveAESExt() then UNDEFINED; 

if size != '@@' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


Assembler symbols 


<dt> Is the data type, encoded in the "size" field. It can have the following values: 
8 when size = 00 


The following encodings are reserved: 


e size = 0l. 

° size = 1x. 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
Q[d>>1] = AESInvMixColumns(Q[m>>1]); 
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Operational information 
If CPSR.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.4 AESMC 


ARM DDI 0487E.a 
ID070919 


AES mix columns. 


A1 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 


Ti7700%7 1p isejo o] va Jojo 11 1)o|w[o] vm | 


A1 variant 


AESMC.<dt> <Qd>, <Qm> 


Decode for this encoding 


if !HaveAESExt() then UNDEFINED; 
if size != '00' then UNDEFINED; 
if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


11111111 1fpji afsizefo of va [ojo 1 1 1jojmjo] vm | 


T1 variant 


AESMC.<dt> <Qd>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveAESExt() then UNDEFINED; 

if size != '@@' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 

For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 


<dt> Is the data type, encoded in the "size" field. It can have the following values: 
8 when size = 00 


The following encodings are reserved: 


° size = 0l. 
° size = 1x. 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
Q[d>>1] = AESMixColumns(Q[m>>1]) ; 


Operational information 


If CPSR.DIT is 1: 


s The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.5 FLDM*X (FLDMDBX, FLDMIAX) 


ARM DDI 0487E.a 
ID070919 


FLDMDBx is the Decrement Before variant of this instruction, and FLDMIAX is the Increment After variant. 
FLDM*X loads multiple SIMD&FP registers from consecutive locations in the Advanced SIMD and floating-point 
register file using an address from a general-purpose register. 


Arm deprecates use of FLDMDBX and FLDMIAX, except for disassembly purposes, and reassembly of 
disassembled code. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 | 10] 


[m11 J1 1 ofejujofwji] Rn | va fr ofi 1]  immscr1> fi] 





cond imm8<0> 


Decrement Before variant 
Applies when P == 1 && U == 0 && W == 


FLDMDBX{<c>}{<q>} <Rn>!, <dreglist> 


Increment After variant 
Applies when P == 0 & U == 


FLDMIAX{<c>}{<q>} <Rn>{!}, <dreglist> 


Decode for all variants of this encoding 


if P == '0' && U == '0' && W == 'O' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VLDR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = FALSE; add = (U == '1'); whack = (W == '1'); 

d = UInt(D:Vd); n = UInt(Rn); imm32 = ZeroExtend(imm8:'00', 32) 

regs = UInt(imm8) DIV 2; // If UInt(imm8) is odd, see "FLDM:X". 

if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == 0 || regs > 16 || (d+regs) > 32 then UNPREDICTABLE; 

if imm8<0> == '1' && (d+regs) > 16 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. The instruction operates as a VLDM with the same addressing mode but loads no registers. 


If regs > 16 || (d+regs) > 16, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
2 The instruction executes as NOP. 
` One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
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F6-4792 





T1 

|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 | 1 0| 

114017 O[PlUplwi] R | va [op 1] mmer J 
imm8<0> 

Decrement Before variant 
Applies when P == 1 & U == 0 & W = 1. 
FLDMDBX{<c>}{<q>} <Rn>!, <dreglist> 
Increment After variant 
Applies when P == 0 && U == 
FLDMIAX{<c>}{<q>} <Rn>{!}, <dreglist> 
Decode for all variants of this encoding 

if P == '0' && U == '0' && W == 'O' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VLDR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = FALSE; add = (U == '1'); whack = (W == '1'); 

d = UInt(D:Vd); n = UInt(Rn); imm32 = ZeroExtend(imm8:'00', 32); 

regs = UInt(imm8) DIV 2; // If UInt(imm8) is odd, see "FLDM=X". 

if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == @ || regs > 16 || (d+regs) > 32 then UNPREDICTABLE; 

if imm8<@> == '1' && (d+regs) > 16 then UNPREDICTABLE; 
CONSTRAINED UNPREDICTABLE behavior 
If regs == 0, then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The instruction operates as a VLDM with the same addressing mode but loads no registers. 
If regs > 16 || (d+regs) > 16, then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
: One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related encodings: See Advanced SIMD and floating-point 64-bit move on page F3-3972 for the T32 instruction 
set, or Advanced SIMD and floating-point 64-bit move on page F4-4045 for the A32 instruction set. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
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<Rn> 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Is the general-purpose base register, encoded in the "Rn" field. If writeback is not specified, the PC 
can be used. 


Specifies base register writeback. Encoded in the "W" field as 1 if present, otherwise 0. 


<dreglist> Is the list of consecutively numbered 64-bit SIMD&FP registers to be transferred. The first register 


in the list is encoded in "D:Vd", and "imm8" is set to twice the number of registers in the list plus 
one. The list must contain at least one register, all registers must be in the range DO-D15, and must 
not contain more than 16 registers. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
address = if add then R[n] else R[n]-imm32; 
for r = 0 to regs-1 
if single_regs then 
S[d+r] = MemA[address,4]; address = address+4; 
else 
word1 = MemA[address,4]; word2 = MemA[address+4,4]; address = address+8; 
// Combine the word-aligned words in the correct order for current endianness. 
D[d+r] = if BigEndian() then word1:word2 else word2:word1; 
if whack then R[n] = if add then R[n]+imm32 else R[n]-imm32; 
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F6.1.6 


F6-4794 


FSTMDBX, FSTMIAX 


FSTMX stores multiple SIMD&FP registers from the Advanced SIMD and floating-point register file to 
consecutive locations in using an address from a general-purpose register. 


Arm deprecates use of FLDMDBX and FLDMIAX, except for disassembly purposes, and reassembly of 
disassembled code. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 | 1 0| 





[111 |1 1 ofpfujofwiof Rn | va ft oft 1| immb<7t> [n] 


cond imm8<0> 


Decrement Before variant 
Applies when P == 1 & U == 0 && W == 


FSTMDBX{<c>}{<q>} <Rn>!, <dreglist> 


Increment After variant 
Applies when P == 0 && U == 


FSTMIAX{<c>}{<q>} <Rn>{!}, <dreglist> 


Decode for all variants of this encoding 


if P == '0' && U == '0' && W == 'O' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VSTR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = FALSE; add = (U == '1'); whack = (W == '1'); 

d = UInt(D:Vd); n = UInt(Rn); imm32 = ZeroExtend(imm8:'00', 32) 

regs = UInt(imm8) DIV 2; // If UInt(imm8) is odd, see "FSTMX". 

if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == 0 || regs > 16 || (d+regs) > 32 then UNPREDICTABLE; 

if imm8<@> == '1' && (d+regs) > 16 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as a VSTM with the same addressing mode but stores no registers. 


If regs > 16 || (d+regs) > 16, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
è The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 
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T1 

|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 | 1 0] 

114017 0fPjupwo] Rn | va [op 1] mmer J 
imm8<0> 

Decrement Before variant 
Applies when P == 1 & U == 0 & W = 1. 
FSTMDBX{<c>}{<q>} <Rn>!, <dreglist> 
Increment After variant 
Applies when P == 0 & U == 
FSTMIAX{<c>}{<q>} <Rn>{!}, <dreglist> 
Decode for all variants of this encoding 

if P == '0' && U == '0' && W == 'Q' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VSTR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = FALSE; add = (U == '1'); whack = (W == '1'); 

d = UInt(D:Vd); n = UInt(Rn); imm32 = ZeroExtend(imm8:'00', 32); 

regs = UInt(imm8) DIV 2; // If UInt(imm8) is odd, see "FSTMX". 

if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == @ || regs > 16 || (d+regs) > 32 then UNPREDICTABLE; 

if imm8<@> == '1' && (d+regs) > 16 then UNPREDICTABLE; 
CONSTRAINED UNPREDICTABLE behavior 
If regs == 0, then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The instruction operates as a VSTM with the same addressing mode but stores no registers. 
If regs > 16 || (d+regs) > 16, then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
è The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related encodings: See Advanced SIMD and floating-point 64-bit move on page F3-3972 for the T32 instruction 
set, or Advanced SIMD and floating-point 64-bit move on page F4-4045 for the A32 instruction set. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
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<Rn> Is the general-purpose base register, encoded in the "Rn" field. If writeback is not specified, the PC 
can be used. However, Arm deprecates use of the PC. 


! Specifies base register writeback. Encoded in the "W" field as 1 if present, otherwise 0. 


<dreglist> Is the list of consecutively numbered 64-bit SIMD&FP registers to be transferred. The first register 
in the list is encoded in "D:Vd", and "imm8" is set to twice the number of registers in the list plus 
one. The list must contain at least one register, all registers must be in the range DO-D15, and must 
not contain more than 16 registers. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
address = if add then R[n] else R[n]-imm32; 
for r = ð to regs-1 
if single_regs then 
MemA[address,4] = S[d+r]; address = address+4; 
else 
// Store as two word-aligned words in the correct order for current endianness. 
MemA[address,4] = if BigEndian() then D[d+r]<63:32> else D[d+r]<31:0>; 
MemA[address+4,4] = if BigEndian() then D[d+r]<31:0> else D[d+r]<63:32>; 
address = address+8; 
if wback then R[n] = if add then R[n]+imm32 else R[n]-imm32; 
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F6.1.7 SHA1C 


ARM DDI 0487E.a 
ID070919 


SHA1 hash update (choose). 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


717100 7)ojoppjo o] wa | va [110 0|Nja|Mjo] vm | 


A1 variant 


SHA1C.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 
if !HaveSHA1Ext() then UNDEFINED; 
if Q != '1' then UNDEFINED; 


if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


1 ijoja 1 1 1 ojojo of vn | va fi 1 0 ofnjajmjo] vm | 


T1 variant 


SHA1C.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveSHA1Ext() then UNDEFINED; 

if Q != '1' then UNDEFINED; 

if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
X = Q[d>>1]; 
Y = Q[n>>1]<31:0>; // Note: 32 bits wide 
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W = Q[m>>1]; 

for e = Q to 3 
t = SHAchoose(X<63:32>, X<95:64>, X<127:96>); 
Y = Y + ROL(X<31:0>, 5) + t + Elem[W, e, 32]; 
X<63:32> = ROL(X<63:32>, 30); 
<Y, X> = ROL(Y:X, 32); 

Q[d>>1] = X; 


Operational information 


If CPSR.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.8 SHA1H 


SHA fixed rotate. 
A1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 
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A1 variant 


SHA1H.32 <Qd>, <Qm> 


Decode for this encoding 


if !HaveSHA1Ext() then UNDEFINED; 

if size != '10' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


aiaa a11 ajoji ifsiefo 1] va fojo 1 0 1jijmjo] vm | 





T1 variant 


SHA1H.32 <Qd>, <Qm> 


Decode for this encoding 

if InITBlock() then UNPREDICTABLE; 

if !HaveSHA1Ext() then UNDEFINED; 

if size != '10' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 

Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 

Assembler symbols 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
Q[d>>1] = ZeroExtend(ROL(Q[m>>1]<31:0>, 30), 128); 
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Operational information 
If CPSR.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.9 SHA1M 


ARM DDI 0487E.a 
ID070919 


SHA1 hash update (majority). 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


manao onoo o] w | va_[110 0[Nja|Mjo] vm | 


A1 variant 


SHAIM.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 
if !HaveSHA1Ext() then UNDEFINED; 
if Q != '1' then UNDEFINED; 


if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


1 ijoja 1 1 1 ofoft of vn | va fi 1 0 ofnjajmjo] vm | 


T1 variant 


SHAIM.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveSHA1Ext() then UNDEFINED; 

if Q != '1' then UNDEFINED; 

if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
X = Q[d>>1]; 
Y = Q[n>>1]<31:0>; // Note: 32 bits wide 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-4801 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


W = Q[m>>1]; 

for e = Q to 3 
t = SHAmajority(X<63:32>, X<95:64>, X<127:96>); 
Y = Y + ROL(X<31:0>, 5) + t + Elem[W, e, 32]; 
X<63:32> = ROL(X<63:32>, 30); 
<Y, X> = ROL(Y:X, 32); 

Q[d>>1] = X; 


Operational information 


If CPSR.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.10 SHA1P 


ARM DDI 0487E.a 
ID070919 


SHAL hash update (parity). 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 
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A1 variant 


SHA1P.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 
if !HaveSHA1Ext() then UNDEFINED; 
if Q != '1' then UNDEFINED; 


if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


1 ijoja 1 1 1 ojojo sf vn | va fi 1 0 ofnjajmjo] vm | 


T1 variant 


SHA1P.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveSHA1lExt() then UNDEFINED; 

if Q != '1' then UNDEFINED; 

if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
X = Q[d>>1]; 
Y = Q[n>>1]<31:0>; // Note: 32 bits wide 
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W = Q[m>>1]; 

for e = Q to 3 
t = SHAparity(X<63:32>, X<95:64>, X<127:96>); 
Y = Y + ROL(X<31:0>, 5) + t + Elem[W, e, 32]; 
X<63:32> = ROL(X<63:32>, 30); 
<Y, X> = ROL(Y:X, 32); 

Q[d>>1] = X; 


Operational information 


If CPSR.DIT is 1: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.11 SHA1SU0 


SHAI schedule update 0. 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


manao onoo 1] w | va pi oono] vm | 


A1 variant 


SHA1SUQ.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 
if !HaveSHA1Ext() then UNDEFINED; 
if Q != '1' then UNDEFINED; 


if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


1 ijoja 1 1 1 ojofi af vn | va fi 1 0 ofnjajmjo] vm | 


T1 variant 


SHA1SUQ.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveSHA1lExt() then UNDEFINED; 

if Q != '1' then UNDEFINED; 

if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
op1 = Q[d>>1]; op2 = Q[n>>1]; op3 = Q[m>>1]; 
op2 = op2<63:0> : opl<127:64>; 
Q[d>>1] = op1 EOR op2 EOR op3; 


Operational information 


If CPSR.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.12 SHA1SU1 


ARM DDI 0487E.a 
ID070919 


SHAI schedule update 1. 
A1 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 12/1110 9 8|7 6 5 4|3 0| 


Ti7700%7 1p isejo] va Jojo r1 ijomo] wm | 


A1 variant 


SHA1SU1.32 <Qd>, <Qm> 


Decode for this encoding 


if !HaveSHA1Ext() then UNDEFINED; 

if size != '10' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


11111111 1fpji afsize[1 of va [ojo 1 1 1jojmjo] vm | 


T1 variant 


SHA1SU1.32 <Qd>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveSHA1Ext() then UNDEFINED; 

if size != '10' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
X = Q[{d>>1]; Y = Q[m>>1]; 
T = X EOR LSR(Y, 32); 
WO = ROL(T<31:0>, 1); 
W1 = ROL(T<63:32>, 1); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-4807 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


W2 = ROL(T<95:64>, 1); 
W3 = ROL(T<127:96>, 1) EOR ROL(T<31:0>, 2); 
Q[d>>1] = W3:W2:W1:W0; 


Operational information 


If CPSR.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.13 SHA256H 


ARM DDI 0487E.a 
ID070919 


SHA256 hash update part 1. 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


777100 7[ifoppjo o] w | va [110 o[Nja|Mjo] vm | 


A1 variant 


SHA256H.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 
if !HaveSHA256Ext() then UNDEFINED; 
if Q != '1' then UNDEFINED; 


if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


a ilija 1 1 1 ofofo of vn | va fi 1 0 ofnjajmjo] vm | 


T1 variant 


SHA256H.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveSHA256Ext() then UNDEFINED; 

if Q != '1' then UNDEFINED; 

if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
X = Q[d>>1]; Y = Q[n>>1]; W = Q[m>>1]; part1 = TRUE; 
Q[d>>1] = SHA256hash(X, Y, W, part1); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-4809 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Operational information 
If CPSR.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.14 SHA256H2 


ARM DDI 0487E.a 
ID070919 


SHA256 hash update part 2. 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


717100 7{ifopjo n| w | va [110 onoo] vm _| 


A1 variant 


SHA256H2.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 
if !HaveSHA256Ext() then UNDEFINED; 
if Q != '1' then UNDEFINED; 


if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


a ilija 1 1 1 ojojo sf vn | va fi 1 0 ofnjajmjo] vm | 


T1 variant 


SHA256H2.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveSHA256Ext() then UNDEFINED; 

if Q != '1' then UNDEFINED; 

if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
X = Q[n>>1]; Y = Q[d>>1]; W = Q[m>>1]; part1 = FALSE; 
Q[d>>1] = SHA256hash(X, Y, W, part1); 
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Operational information 
If CPSR.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.15 SHA256SU0 


ARM DDI 0487E.a 
ID070919 


SHA256 schedule update 0. 
A1 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16/15 12/1110 9 8|7 6 5 4|3 0| 


Ti7700%7 1p isejo] va Jojo riiim] vm | 


A1 variant 


SHA256SU0.32 <Qd>, <Qm> 


Decode for this encoding 


if !HaveSHA256Ext() then UNDEFINED; 

if size != '10' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


titi ajoji 1jsizeji of va fojo 1 1 1jijmjo] vm | 





T1 variant 


SHA256SU0.32 <Qd>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveSHA256Ext() then UNDEFINED; 

if size != '10' then UNDEFINED; 

if Vd<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
bits(128) result; 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
X = Q[{d>>1]; Y = Q[m>>1]; 
T = Y<31:0@> : X<127:32>; 
for e = Q to 3 
elt = Elem[T, e, 32]; 
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elt = ROR(elt, 7) EOR ROR(elt, 18) EOR LSR(elt, 3); 
Elem[result, e, 32] = elt + Elem[X, e, 32]; 
Q[d>>1] = result; 


Operational information 


If CPSR.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.16 SHA256SU1 


ARM DDI 0487E.a 
ID070919 


SHA256 schedule update 1. 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


717100 7[ifopoj1 o] w | va [110 onoo] vm | 


A1 variant 


SHA256SU1.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 
if !HaveSHA256Ext() then UNDEFINED; 
if Q != '1' then UNDEFINED; 


if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


a ajila 1 1 1 ofoft of vn | va fi 1 0 ofnjajmjo] vm | 


T1 variant 


SHA256SU1.32 <Qd>, <Qn>, <Qm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveSHA256Ext() then UNDEFINED; 

if Q != '1' then UNDEFINED; 

if Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
bits(128) result; 
EncodingSpecificOperations(); CheckCryptoEnabled32(); 
X = Q[d>>1]; Y = Q[n>>1]; Z = Q[m>>1]; 
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TO = Z<31:0> : Y<127:32>; 


T1 = Z<127:64>; 

fore=Qtol 
elt = Elem[T1, e, 32]; 
elt = ROR(elt, 17) EOR ROR(elt, 19) EOR LSR(elt, 10); 
elt = elt + Elem[X, e, 32] + Elem[T@, e, 32]; 
Elem[result, e, 32] = elt; 


T1 = result<63:0>; 

for e = 2 to 3 
elt = Elem[T1, e - 2, 32]; 
elt = ROR(elt, 17) EOR ROR(elt, 19) EOR LSR(elt, 10); 
elt = elt + Elem[X, e, 32] + Elem[T@, e, 32]; 
Elem[result, e, 32] = elt; 


Q[d>>1] = result; 


Operational information 


If CPSR.DIT is 1: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.17 VABA 


Vector Absolute Difference and Accumulate subtracts the elements of one vector from the corresponding elements 
of another vector, and accumulates the absolute values of the results into the elements of the destination vector. 


Operand and result elements are all integers of the same length. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1109 8|7 6 5 4|3 0 | 


Ti 7700 iJU[o[o[sze] vw | va jorrie vm 


64-bit SIMD vector variant 
Applies when Q == 0. 


VABA{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VABA{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 

if size == '11' then UNDEFINED; 

if Q == '1' & (Vd<O> == '1' || Vn<ð> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); Jlong_destination = FALSE; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 


11 tfuj1 1 1 1 ofdfsize] vn | va jo 11 1fnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VABA{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VABA{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); Jlong_destination = FALSE; 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 
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Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 


S8 when U = 0, size = 00 
S16 when U = 0, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 


op1 = Elem[Din[n+r],e,esize]; 
op2 = Elem[Din[m+r],e,esize]; 
absdiff = Abs(Int(op1,unsigned) - Int(op2,unsigned)); 
if long_destination then 
Elem[Q[d>>1],e,2esize] = Elem[Qin[d>>1],e,2esize] + absdiff; 
else 





Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + absdiff; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


F6-4818 


The execution time of this instruction is independent of: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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F6.1.18 VABAL 


ARM DDI 0487E.a 
ID070919 


Vector Absolute Difference and Accumulate Long subtracts the elements of one vector from the corresponding 
elements of another vector, and accumulates the absolute values of the results into the elements of the destination 
vector. 


Operand elements are all integers of the same length, and the result elements are double the length of the operands. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12\11109 8|7 6 5 4|3 0| 
T1471 00 t[utpopen] ve | va [0710 Nomo] vm | 
size 
A1 variant 


VABAL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

unsigned = (U == '1'); long_destination = TRUE; 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


aot 7 pen va | va oa o Noo vm 


size 


T1 variant 


VABAL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

unsigned = (U == '1'); Jlong_destination = TRUE; 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 


Notes for all encodings 
Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<C> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
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F6-4820 


<q> 


<dt> 


<Qd> 
<Dn> 


<Dm> 


See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 


S8 when U = Q, size = 00 
S16 when U = 0, size = 01 
$32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = ð to regs-1 
for e = Q to elements-1 
op1 = Elem[Din[n+r],e,esize]; 
op2 = Elem[Din[m+r],e,esize]; 
absdiff = Abs(Int(op1,unsigned) - Int(op2,unsigned)); 
if long_destination then 
Elem[Q[d>>1],e,2esize] = Elem[Qin[d>>1],e,2esize] + absdiff; 

else 





Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + absdiff; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.19 VABD (floating-point) 


ARM DDI 0487E.a 
ID070919 


Vector Absolute Difference (floating-point) subtracts the elements of one vector from the corresponding elements 
of another vector, and places the absolute values of the results in the elements of the destination vector. 


Operand and result elements are floating-point numbers of the same size. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


77100 t[ifo[pyifee] va | va ionem vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VABD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VABD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


1 ajili 1 1 1 ojos tse] vn | va f1 10 1jnjajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VABD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VABD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 

if sz == '1' && InITBlock() then UNPREDICTABLE; 

case sz of 
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F6-4822 


when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '0' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 

e The instruction is UNDEFINED. 

. The instruction executes as if it passes the Condition code check. 

° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
op1 = Elem[D[n+r],e,esize]; op2 = Elem[D[m+r],e,esize]; 
Elem[D[d+r],e,esize] = FPAbs(FPSub(op1, op2,StandardFPSCRValue())); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.20 VABD (integer) 


ARM DDI 0487E.a 
ID070919 


Vector Absolute Difference (integer) subtracts the elements of one vector from the corresponding elements of 
another vector, and places the absolute values of the results in the elements of the destination vector. 


Operand and result elements are all integers of the same length. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


77100 1[Ulo[pfsze[ va | va jorr vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VABD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VABD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if size == '11' then UNDEFINED; 

if Q == '1' & (Vd<O> == '1' || Vn<ð> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); Jlong_destination = FALSE; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 


11 tfuj1 1 1 1 ofdfsize] vn | va jo 11 t{NJQ}mMfo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VABD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VABD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); Jlong_destination = FALSE; 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 
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Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 


S8 when U = 0, size = 00 
S16 when U = 0, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 


op1 = Elem[Din[n+r],e,esize]; 
op2 = Elem[Din[m+r],e,esize]; 
absdiff = Abs(Int(op1,unsigned) - Int(op2,unsigned)); 
if long_destination then 

Elem[Q[d>>1],e,2esize] = absdiff<2sesize-1:0>; 
else 





Elem[D[d+r],e,esize] = absdiff<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


F6-4824 


The execution time of this instruction is independent of: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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F6.1.21  VABDL (integer) 


ARM DDI 0487E.a 
ID070919 


Vector Absolute Difference Long (integer) subtracts the elements of one vector from the corresponding elements of 
another vector, and places the absolute values of the results in the elements of the destination vector. 


Operand elements are all integers of the same length, and the result elements are double the length of the operands. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12\11109 8|7 6 5 4|3 0| 
Tt 4100 tutpopen] va | va [011 Nomo] vm | 
size 
A1 variant 


VABDL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

unsigned = (U == '1'); Jlong_destination = TRUE; 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 o| 


oaao pen] v | va onoo v 


size 


T1 variant 


VABDL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

unsigned = (U == '1'); long_destination = TRUE; 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 


Notes for all encodings 
Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-4825 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


<dt> Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = ð to regs-1 
for e = 0 to elements-1 
op1 = Elem[Din[n+r],e,esize]; 
op2 = Elem[Din[m+r],e,esize]; 
absdiff = Abs(Int(op1,unsigned) - Int(op2,unsigned)); 
if long_destination then 
Elem[Q[d>>1],e,2xesize] = absdiff<2xesize-1:0>; 

else 





Elem[D[d+r],e,esize] = absdiff<esize-1:0>; 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
$ The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.22 VABS 


ARM DDI 0487E.a 
ID070919 


Vector Absolute takes the absolute value of each element in a vector, and places the results in a second vector. The 
floating-point version only clears the sign bit. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 121110 9 8|7 6 5 4|3 0| 


11110011 1p isejo] va Joje ojoo] vwm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VABS{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VABS{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

advsimd = TRUE; floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 
31 28|27 26 25 24|23 22 21 20/19 18 17 16/15 12/1110 9 8|7 6 5 4/3 0 | 
[11 [1 1 10 1{D]1 tfo}o o of va [1 Ofsize]t]1}Mfo} vm | 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VABS{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 
VABS{<c>}{<q>}.F32 <Sd>, <Sm> 
Double-precision scalar variant 


Applies when size == 11. 


VABS{<c>}{<q>}.F64 <Dd>, <Dm> 
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Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

advsimd = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 





7414177 ph sejo] va Joje 1 ojoo] vm 


64-bit SIMD vector variant 
Applies when Q == 0. 


VABS{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VABS{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if F == '1' && size == 'Q1' && InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<O@> == '1' || Vm<@> == '1') then UNDEFINED; 

advsimd = TRUE; floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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T2 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|15 12/1109 8|7 6 5 4|3 0 | 


Tit 0117070] ooo o] va [i ojs jimo] vm _| 


Half-precision scalar variant 
Applies when size == 01. 


VABS{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VABS{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VABS{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && InITBlock() then UNPREDICTABLE; 

advsimd = FALSE; 

case size of 
when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 

e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding A2, T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the vectors, encoded in the "F:size" field. It can have the 
following values: 
S8 when F = Q, size = 00 
S16 when F = 0, size = 01 
$32 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
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F6-4830 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = 0 to regs-1 
for e = Q to elements-1 
if floating_point then 
Elem[D[d+r],e,esize] = FPAbs(Elem[D[m+r],e,esize]); 
else 
result = Abs(SInt(Elem[D[m+r],e,esize])); 
Elem[D[d+r],e,esize] = result<esize-1:0>; 
else // NFP instruction 
case esize of 
when 16 S[d] = Zeros(16) : FPAbs(S[m]<15:0>); 
when 32 S[d] = FPAbs(S[m]); 
when 64 D[d] = FPAbs(D[m]); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


ê The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.23 VACGE 


ARM DDI 0487E.a 
ID070919 


Vector Absolute Compare Greater Than or Equal takes the absolute value of each element in a vector, and compares 
it with the absolute value of the corresponding element of a second vector. If the first is greater than or equal to the 
second, the corresponding element in the destination vector is set to all ones. Otherwise, it is set to all zeros. 


The operands and result can be quadword or doubleword vectors. They must all be the same size. 


The operand vector elements are floating-point numbers. The result vector elements are the same size as the operand 


vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instruction VACLE. The pseudo-instruction is never the preferred 
disassembly. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


17100 1[ifo[ppofse] va | va_[1 17 0[Nja|Myi] vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VACGE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VACGE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
or_equal = (op == 'Q'); 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '0' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 \15 12/1110 9 8|7 6 5 4|3 0 | 


11 ilija 1 1 1 ofdjofsz] vn | va f1 1 1 ofnjajlmji] vm | 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VACGE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 


Applies when Q == 1. 
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F6-4832 


VACGE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
or_equal = (op == '0'); 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

` The instruction executes as if it passes the Condition code check. 

° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = Q to regs-1 
for e = Q to elements-1 
op1 = FPAbs(Elem[D[n+r],e,esize]); op2 = FPAbs(Elem[D[m+r],e,esize]); 
if or_equal then 
test_passed = FPCompareGE(op1, op2, StandardFPSCRValue()); 
else 
test_passed = FPCompareGT(op1, op2, StandardFPSCRValue()); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.24 


F6-4834 


VACLE 


Vector Absolute Compare Less Than or Equal takes the absolute value of each element in a vector, and compares it 
with the absolute value of the corresponding element of a second vector. If the first is less than or equal to the second, 


the corresponding element in the destination vector is set to all ones. Otherwise, it is set to all zeros 


This instruction is a pseudo-instruction of the VACGE instruction. This means that: 


$ The encodings in this description are named to match the encodings of VACGE. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
à The description of VACGE gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24|23 22 21 20119 16115 12/1110 9 8|7 6 5 4/3 0| 


11110001P] vw | va pronome vm _| 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VACLE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VACGE{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 
VACLE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
is equivalent to 

VACGE{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 
T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


apt 717 opok va | va_[1 17 onm vm | 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VACLE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VACGE{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


128-bit SIMD vector variant 


Applies when Q == 1. 


VACLE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


is equivalent to 


VACGE{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 


Assembler symbols 


<Dm> 
<Dn> 


<Qm> 


<Qn> 


<C> 


<q> 


<dt> 


<Qd> 


<Dd> 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 


F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Operation for all encodings 


The description of VACGE gives the operational pseudocode for this instruction. 
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F6.1.25 


F6-4836 


VACGT 


Vector Absolute Compare Greater Than takes the absolute value of each element in a vector, and compares it with 


the absolute value of the corresponding element of a second vector. If the first is greater than the second, 


corresponding element in the destination vector is set to all ones. Otherwise, it is set to all zeros. 


The operands and result can be quadword or doubleword vectors. They must all be the same size. 


the 


The operand vector elements are floating-point numbers. The result vector elements are the same size as the operand 


vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instruction VACLT. The pseudo-instruction is never the preferred 
disassembly. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


17100 tfifo[pyife] va | va_[1 17 o[NjalMyi] vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VACGT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VACGT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
or_equal = (op == 'Q'); 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '0' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 \15 12/1110 9 8|7 6 5 4|3 0 | 


11 ilija 1 1 1 ofpo]ijs vn | va f1 1 1 ofnjajlm[i] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VACGT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 


Applies when Q == 1. 
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VACGT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
or_equal = (op == '0'); 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

` The instruction executes as if it passes the Condition code check. 

° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = Q to regs-1 
for e = Q to elements-1 
op1 = FPAbs(Elem[D[n+r],e,esize]); op2 = FPAbs(Elem[D[m+r],e,esize]); 
if or_equal then 
test_passed = FPCompareGE(op1, op2, StandardFPSCRValue()); 
else 
test_passed = FPCompareGT(op1, op2, StandardFPSCRValue()); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.26 VACLT 


ARM DDI 0487E.a 
ID070919 


Vector Absolute Compare Less Than takes the absolute value of each element in a vector, and compares it with the 
absolute value of the corresponding element of a second vector. If the first is less than the second, the corresponding 
element in the destination vector is set to all ones. Otherwise, it is set to all zeros 


This instruction is a pseudo-instruction of the VACGT instruction. This means that: 


$ The encodings in this description are named to match the encodings of VACGT. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
à The description of VACGT gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24|23 22 21 20119 16|15 12/1110 9 8|7 6 5 4/3 0 | 


Ti 7700 4]to[o[tfe| ve | va porone vm _| 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VACLT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VACGT{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 
VACLT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
is equivalent to 

VACGT{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 
T1 


|15 14 13 12\11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


apt 717 ophi va | va_[t 17 on vm | 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VACLT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VACGT{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 
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F6-4840 


128-bit SIMD vector variant 


Applies when Q == 1. 


VACLT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


is equivalent to 


VACGT{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 


Assembler symbols 


<Dm> 
<Dn> 


<Qm> 


<Qn> 


<C> 


<q> 


<dt> 


<Qd> 


<Dd> 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 


F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Operation for all encodings 


The description of VACGT gives the operational pseudocode for this instruction. 
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F6.1.27 VADD (floating-point) 


ARM DDI 0487E.a 
ID070919 


Vector Add (floating-point) adds corresponding elements in two vectors, and places the results in the destination 
vector. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


77100 tfofo[ppofs] va | va [iorno vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VADD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
advsimd = TRUE; 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q@' then 1 else 2; 


A2 
|31 28|27 26 25 24|23 22 21 20|19 16115 12/1110 9 8|7 6 5 4|3 0| 
Cem [i171 oop 1] va | va [i o[swe[N]o[mjo[ vm 


cond 


Half-precision scalar variant 
Applies when size == 01. 
VADD{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 
Single-precision scalar variant 


Applies when size == 10. 


VADD{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VADD{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 
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Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

advsimd = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aaao oplo v | va pi onoo] vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VADD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
advsimd = TRUE; 
case sz of 
when 'Q' esize 
when '1' esize 
d = UInt(D:Vd); n 


32; elements 
16; elements 
UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


Ti 70717 0/oo[1 7] va | va [i ojs injo] vm _| 


Half-precision scalar variant 


Applies when size == 01. 


VADD{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 


Single-precision scalar variant 


Applies when size == 10. 


VADD{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 


Applies when size == 11. 


VADD{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != 'Q00' || FPSCR.Stride != '@@' then UNDEFINED; 


if size 
if size 


== 'Q0' || (size == 'Q1' && !HaveFP16Ext()) then UNDEFINED; 
== 'Q1' && InITBlock() then UNPREDICTABLE; 


advsimd = FALSE; 
case size of 


when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


64; d 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


The instruction is UNDEFINED. 
The instruction executes as if it passes the Condition code check. 


The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 


<Qn> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding A2, T1 and T2: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 


values: 
F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
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<Qm> 


<Dd> 
<Dn> 
<Dm> 
<Sd> 
<Sn> 


<Sm> 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 


Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 


F6-4844 


EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = 0 to regs-1 


for e = 0 to elements-1 
Elem[D[d+r],e,esize] = FPAdd(Elem[D[n+r],e,esize], Elem[D[m+r],e,esize], 
StandardFPSCRValue()); 
// NFP instruction 


case esize of 


when 16 
S[d] = Zeros(16) : FPAdd(S[n]<15:0>, S[m]<15:0>, FPSCR) 
when 32 
S[d] = FPAdd(S[n], S[m], FPSCR); 
when 64 
D[d] = FPAdd(D[n], D[m], FPSCR); 
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F6.1.28 VADD (integer) 


ARM DDI 0487E.a 
ID070919 


Vector Add (integer) adds corresponding elements in two vectors, and places the results in the destination vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4/3 0 | 


[111100 1Jofojpfsize] vn | vd fi 0 0 ofnjajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VADD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<ð> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 121110 9 8|7 6 5 4|3 0 | 


7 poli 777 opse] va | va_[1 00 onjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VADD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<ð> == '1' || Vn<ð> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
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F6-4846 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
I8 when size = 00 
116 when size = 01 
132 when size = 10 
164 when size = 11 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = Elem[D[n+r],e,esize] + Elem[D[m+r],e,esize]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.29 VADDHN 


ARM DDI 0487E.a 
ID070919 


Vector Add and Narrow, returning High Half adds corresponding elements in two quadword vectors, and places the 
most significant half of each result in a doubleword vector. The results are truncated. For rounded results, see 
VRADDHN. 


The operand elements can be 16-bit, 32-bit, or 64-bit integers. There is no distinction between signed and unsigned 
integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 

|31 30 29 28|27 26 25 24|23 22 21 20/19 16|15 12/1110 9 8|7 6 5 4|3 o| 

Darno onoho] va | va [o1 0o O[NJo[M[o] wm | 
size 

A1 variant 


VADDHN{<c>}{<q>}.<dt> <Dd>, <Qn>, <Qm> 


Decode for this encoding 
if size == '11' then SEE "Related encodings"; 
if Vn<@> == '1' || Vm<0> == '1' then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aaao n pen] vw | va__[o 10 onoo] wm _| 


size 


T1 variant 


VADDHN{<c>}{<q>}.<dt> <Dd>, <Qn>, <Qm> 


Decode for this encoding 

if size == '11' then SEE "Related encodings"; 

if Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 
Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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F6-4848 


<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 
116 when size = 00 
132 when size = 01 
164 when size = 10 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for e = 0 to elements-1 
result = Elem[Qin[n>>1],e,2sesize] + Elem[Qin[m>>1],e,2«esize]; 
Elem[D[d],e,esize] = result<2esize-1:esize>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.30 VADDL 


ARM DDI 0487E.a 
ID070919 


Vector Add Long adds corresponding elements in two doubleword vectors, and places the results in a quadword 
vector. Before adding, it sign-extends or zero-extends the elements of both operands. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|3 0| 
1111001] va | va [0 0 ojo omo] vm | 
size op 
A1 variant 


VADDL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' || (op == '1' && Vn<@> == '1') then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; is_vaddw = (op == '1'); 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 


maaua tye] va | va fo o ofono o] vm _ 


size op 


T1 variant 


VADDL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' || (op == '1' && Vn<@> == '1') then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; is_vaddw = (op == '1'); 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 
Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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F6-4850 


<dt> Is the data type for the elements of the second operand vector, encoded in the "U:size" field. It can 
have the following values: 


S8 when U = 0, size = 00 

S16 when U = @, size = 01 

$32 when U = 0, size = 10 

U8 when U = 1, size = 00 

U16 when U = 1, size = 01 

U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
for e = Q to elements-1 


if is_vaddw then 
opl = Int(Elem[Qin[n>>1],e,2*esize], unsigned); 


else 


op1 = Int(Elem[Din[n],e,esize], unsigned); 
result = opl + Int(Elem[Din[m] ,e,esize] , unsigned) ; 


Elem[Q[d>>1],e,2xesize] 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


© The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


CheckAdvSIMDEnabled(); 


result<2*esize-1:0>; 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.31 VADDW 


ARM DDI 0487E.a 
ID070919 


Vector Add Wide adds corresponding elements in one quadword and one doubleword vector, and places the results 
in a quadword vector. Before adding, it sign-extends or zero-extends the elements of the doubleword operand. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|3 0| 
Tt 41100 tutpopen] va | va [oo onom] vm | 
size op 
A1 variant 


VADDW{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' || (op == '1' && Vn<@> == '1') then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; is_vaddw = (op == '1'); 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4/3 0 | 


ajo ttt pen] va | va [oo onoo vm _ 
op 


size 


T1 variant 


VADDW{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' || (op == '1' && Vn<@> == '1') then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; is_vaddw = (op == '1'); 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 


SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


F6-4851 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6-4852 


<dt> Is the data type for the elements of the second operand vector, encoded in the "U:size" field. It can 
have the following values: 


S8 when U = 0, size = 00 

S16 when U = @, size = 01 

$32 when U = 0, size = 10 

U8 when U = 1, size = 00 

U16 when U = 1, size = 01 

U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
for e = Q to elements-1 


if is_vaddw then 
opl = Int(Elem[Qin[n>>1],e,2*esize], unsigned); 


else 


op1 = Int(Elem[Din[n],e,esize], unsigned); 
result = opl + Int(Elem[Din[m] ,e,esize] , unsigned) ; 


Elem[Q[d>>1],e,2xesize] 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


© The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


CheckAdvSIMDEnabled(); 


result<2*esize-1:0>; 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.32 VAND (immediate) 


ARM DDI 0487E.a 
ID070919 


Vector Bitwise AND (immediate) performs a bitwise AND between a register value and an immediate value, and 
returns the result into the destination vector 


This instruction is a pseudo-instruction of the VBIC (immediate) instruction. This means that: 


$ The encodings in this description are named to match the encodings of VBIC (immediate). 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
. The description of VBIC (immediate) gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24/23 22 21 20|1918 16ļ15 12111 8|7 6 5 4|3 0| 
1111001 ipeo of mms [va Jo xx jojo mma 
cmode 


64-bit SIMD vector variant 

Applies when Q == 0. 

VAND{<c>}{<q>}.116 {<Dd>,} <Dd>, #<imm> 
is equivalent to 

VBIC{<c>}{<q>}.116 <Dd>, #~<imm> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 

VAND{<c>}{<q>}.116 {<Qd>,} <Qd>, #<imm> 
is equivalent to 

VBIC{<c>}{<q>}.116 <Qd>, #~<imm> 


and is never the preferred disassembly. 


A2 

|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12|11 8|7 6 5 4|3 0 | 

111400 1ļijijojo o of imma | va [1 o x 1jojajifi] imma | 
cmode 
64-bit SIMD vector variant 
Applies when Q == 0. 
VAND{<c>}{<q>}.132 {<Dd>,} <Dd>, #<imm> 
is equivalent to 
VBIC{<c>}{<q>}.132 <Dd>, #~<imm> 
and is never the preferred disassembly. 
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F6-4854 


128-bit SIMD vector variant 

Applies when Q == 1. 

VAND{<c>}{<q>}.132 {<Qd>,} <Qd>, #<imm> 
is equivalent to 

VBIC{<c>}{<q>}.132 <Qd>, #~<imm> 


and is never the preferred disassembly. 


T1 
|15 14 13 12|11 10 9 8|7 65 4|3 2 O15 12111 8/7 6 5 4]3 o| 
Mae o o o mms] va Jo x x foje] imm_| 
cmode 
64-bit SIMD vector variant 
Applies when Q == 0. 
VAND{<c>}{<q>}.116 {<Dd>,} <Dd>, #<imm> 
is equivalent to 
VBIC{<c>}{<q>}.116 <Dd>, #~<imm> 
and is never the preferred disassembly. 
128-bit SIMD vector variant 
Applies when Q == 1. 
VAND{<c>}{<q>}.116 {<Qd>,} <Qd>, #<imm> 
is equivalent to 
VBIC{<c>}{<q>}.116 <Qd>, #~<imm> 
and is never the preferred disassembly. 
T2 
|15 14 13 12|11 10 9 8/7 65 4/3 2 0115 12111 8/7 6 5 4|3 0 | 
7 tfi[t 117 too oo] mms] va [10x oe e ma 
cmode 
64-bit SIMD vector variant 
Applies when Q == 0. 
VAND{<c>}{<q>}.132 {<Dd>,} <Dd>, #<imm> 
is equivalent to 
VBIC{<c>}{<q>}.132 <Dd>, #~<imm> 
and is never the preferred disassembly. 
128-bit SIMD vector variant 
Applies when Q == 1. 
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VAND{<c>}{<q>}.132 {<Qd>,} <Qd>, #<imm> 
is equivalent to 
VBIC{<c>}{<q>}.132 <Qd>, #~<imm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<imm> Is a constant of the specified type that is replicated to fill the destination register. For details of the 


range of constants available and the encoding of <imm>, see Modified immediate constants in T32 
and A32 Advanced SIMD instructions on page F2-3925. 


Operation for all encodings 


The description of VBIC (immediate) gives the operational pseudocode for this instruction. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-4855 
ID070919 Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.33 


F6-4856 


VAND (register) 


Vector Bitwise AND (register) performs a bitwise AND operation between two registers, and places the result in 


the destination register. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


777100 7fojoppjo o] wa | va jooon vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VAND{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VAND{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


7 apolt 717 opoo] wm | va jooon vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 
VAND{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VAND{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<O> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 


d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
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<q> 

<dt> 
<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


See Standard assembler syntax fields on page F2-3908. 

An optional data type. It is ignored by assemblers, and does not affect the encoding. 

Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 


D{d+r] = D[n+r] AND D[m+r]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.34 


F6-4858 


VBIC (immediate) 


Vector Bitwise Bit Clear (immediate) performs a bitwise AND between a register value and the complement of an 
immediate value, and returns the result into the destination vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instruction VAND (immediate). The pseudo-instruction is never the preferred 
disassembly. 


A1 


|31 30 29 28|27 26 25 24|23 22 2120/1918  16|15 12\11 8|7 6 5 4|3 0 | 


77100 tfi[t[o]o oo] mms va [ox x ijoja imma 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VBIC{<c>}{<q>}.132 {<Dd>,} <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VBIC{<c>}{<q>}.132 {<Qd>,} <Qd>, #<imm> 


Decode for all variants of this encoding 
if cmode<@> == '@' || cmode<3:2> == '11' then SEE "Related encodings"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


imm64 = AdvSIMDExpandImm('1', cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


A2 


|31 30 29 28|27 26 25 24|23 22 2120/1918  16|15 12\11 8|7 6 5 4|3 0 | 


777100 tfi[t[o]o oo] mms | va [10x ojo imme | 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VBIC{<c>}{<q>}.116 {<Dd>,} <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VBIC{<c>}{<q>}.116 {<Qd>,} <Qd>, #<imm> 


Decode for all variants of this encoding 


if cmode<@> == '@' || cmode<3:2> == '11' then SEE "Related encodings"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 

imm64 = AdvSIMDExpandImm('1', cmode, i:imm3:imm4) ; 

d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 0 |15 12|11 8|7 6 5 4/3 0 | 
7 tpi[t 177 tof o of mms | va foxx foje ma 
cmode 
64-bit SIMD vector variant 
Applies when Q == 0. 
VBIC{<c>}{<q>}.132 {<Dd>,} <Dd>, #<imm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VBIC{<c>}{<q>}.132 {<Qd>,} <Qd>, #<imm> 
Decode for all variants of this encoding 
if cmode<@> == '@' || cmode<3:2> == '11' then SEE "Related encodings"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 
imm64 = AdvSIMDExpandImm('1', cmode, i: imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 
T2 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 o [15 12111 8|7 6 5 4|3 0| 
7 tpift 177 tooo ol mms | va [tox oe E ma 
cmode 
64-bit SIMD vector variant 
Applies when Q == 0. 
VBIC{<c>}{<q>}.116 {<Dd>,} <Dd>, #<imm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VBIC{<c>}{<q>}.116 {<Qd>,} <Qd>, #<imm> 
Decode for all variants of this encoding 
if cmode<@> == '@' || cmode<3:2> == '11' then SEE "Related encodings"; 


if Q == '1' && Vd<@> == '1' then UNDEFINED; 
imm64 = AdvSIMDExpandImm('1', cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 


Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<imm> Is a constant of the specified type that is replicated to fill the destination register. For details of the 


range of constants available and the encoding of <imm>, see Modified immediate constants in T32 
and A32 Advanced SIMD instructions on page F2-3925. 


The I8, 164, and F32 data types are permitted as pseudo-instructions, if the immediate can be represented by this 
instruction, and are encoded using a permitted encoding of the 116 or 132 data type. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
D[d+r] = D[d+r] AND NOT(imm64) ; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.35 VBIC (register) 


ARM DDI 0487E.a 
ID070919 


Vector Bitwise Bit Clear (register) performs a bitwise AND between a register value and the complement of a 
register value, and places the result in the destination register. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


777100 7fojoppjo n| vw | va jooon vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VBIC{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VBIC{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


aaao an opon] vw | va fo oorno vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VBIC{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VBIC{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<O> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 
Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6-4862 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> An optional data type. It is ignored by assemblers, and does not affect the encoding. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = ð to regs-1 
D[d+r] = D[n+r] AND NOT(D[m+r]); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


` The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Vector Bitwise Insert if False inserts each bit from the first source register into the destination register if the 
corresponding bit of the second source register is 0, otherwise leaves the bit in the destination register unchanged. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Ti7700a/1/opo[1 7] ve | va jo oorneem vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VBIF{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VBIF{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if op == '00' then SEE "VEOR"; 

if op == '01' then operation = VBitOps_VBSL; 

if op == '10' then operation = VBitOps_VBIT; 

if op == '11' then operation = VBitOps_VBIF; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


aa afilia 1 1 ofofji a] wn | va jooo 1jnjajlmji] vm | 


op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VBIF{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VBIF{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if op == '00' then SEE "VEOR"; 

if op == '01' then operation = VBitOps_VBSL; 

if op == '10' then operation = VBitOps_VBIT; 

if op == '11' then operation = VBitOps_VBIF; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == 'Q@' then 1 else 2; 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6-4864 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> An optional data type. It is ignored by assemblers, and does not affect the encoding. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 
enumeration VBitOps {VBitOps_VBIF, VBitOps_VBIT, VBitOps_VBSL}; 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
case operation of 
when VBitOps_VBIF D[d+r] = (D[d+r] AND D[m+r]) OR (D[n+r] AND NOT(D[m+r])); 
when VBitOps_VBIT D[d+r] = (D[n+r] AND D[m+r]) OR (D[d+r] AND NOT(D[m+r])); 
when VBitOps_VBSL D[d+r] = (D[n+r] AND D[d+r]) OR (D[m+r] AND NOT(D[d+r])); 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
7 The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Vector Bitwise Insert if True inserts each bit from the first source register into the destination register if the 
corresponding bit of the second source register is 1, otherwise leaves the bit in the destination register unchanged. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Ti7700 i]1/opo[1 o] ve | va jooon vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VBIT{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VBIT{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if op == '00' then SEE "VEOR"; 

if op == '01' then operation = VBitOps_VBSL; 

if op == '10' then operation = VBitOps_VBIT; 

if op == '11' then operation = VBitOps_VBIF; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


1 ajili a 1 1 ojoj of wn | va jooo 1jnjajmji] vm | 


op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VBIT{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VBIT{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if op == '00' then SEE "VEOR"; 

if op == '01' then operation = VBitOps_VBSL; 

if op == '10' then operation = VBitOps_VBIT; 

if op == '11' then operation = VBitOps_VBIF; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == 'Q@' then 1 else 2; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-4865 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6-4866 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> An optional data type. It is ignored by assemblers, and does not affect the encoding. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 
enumeration VBitOps {VBitOps_VBIF, VBitOps_VBIT, VBitOps_VBSL}; 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
case operation of 
when VBitOps_VBIF D[d+r] = (D[d+r] AND D[m+r]) OR (D[n+r] AND NOT(D[m+r])); 
when VBitOps_VBIT D[d+r] = (D[n+r] AND D[m+r]) OR (D[d+r] AND NOT(D[m+r])); 
when VBitOps_VBSL D[d+r] = (D[n+r] AND D[d+r]) OR (D[m+r] AND NOT(D[d+r])); 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
7 The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.38 VBSL 


ARM DDI 0487E.a 
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Vector Bitwise Select sets each bit in the destination to the corresponding bit from the first source operand when the 
original destination bit was 1, otherwise from the second source operand. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


117700 i]1/ojojo 7] ve | va jooon vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VBSL{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VBSL{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if op == '00' then SEE "VEOR"; 

if op == '01' then operation = VBitOps_VBSL; 

if op == '10' then operation = VBitOps_VBIT; 

if op == '11' then operation = VBitOps_VBIF; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


a ajili 1 1 1 ojojo 1] vn | va jooo 1jnjajmji] vm | 


op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VBSL{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VBSL{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if op == '00' then SEE "VEOR"; 

if op == '01' then operation = VBitOps_VBSL; 

if op == '10' then operation = VBitOps_VBIT; 

if op == '11' then operation = VBitOps_VBIF; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == 'Q@' then 1 else 2; 
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Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> An optional data type. It is ignored by assemblers, and does not affect the encoding. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 
enumeration VBitOps {VBitOps_VBIF, VBitOps_VBIT, VBitOps_VBSL}; 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
case operation of 
when VBitOps_VBIF D[d+r] = (D[d+r] AND D[m+r]) OR (D[n+r] AND NOT(D[m+r])); 
when VBitOps_VBIT D[d+r] = (D[n+r] AND D[m+r]) OR (D[d+r] AND NOT(D[m+r])); 
when VBitOps_VBSL D[d+r] = (D[n+r] AND D[d+r]) OR (D[m+r] AND NOT(D[d+r])); 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
7 The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.39 VCADD 


ARM DDI 0487E.a 
ID070919 


Vector Complex Add. 


This instruction operates on complex numbers that are represented in SIMD&FP registers as pairs of elements, with 
the more significant element holding the imaginary part of the number and the less significant element holding the 
real part of the number. Each element holds a floating-point value. It performs the following computation on the 
corresponding complex number element pairs from the two source registers: 


à Considering the complex number from the second source register on an Argand diagram, the number is 
rotated counterclockwise by 90 or 270 degrees. 


s The rotated complex number is added to the complex number from the first source register. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


111111 ofroft{ojo{s] vn | va  |tfofofo|njafmjo}] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCADD{<q>}.<dt> <Dd>, <Dn>, <Dm>, #<rotate> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCADD{<q>}.<dt> <Qd>, <Qn>, <Qm>, #<rotate> 


Decode for all variants of this encoding 


if !HaveFCADDExt() then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 

esize = 16 << UInt(S); 

if !HaveFP16Ext() && esize == 16 then UNDEFINED; 

elements = 64 DIV esize; 

regs = if Q == 'Q' then 1 else 2; 


T1 
ARMVv8.3 


[15 1413 12/1110 9 8|7 6 5 4/3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





64-bit SIMD vector variant 
Applies when Q == 0. 


VCADD{<q>}.<dt> <Dd>, <Dn>, <Dm>, #<rotate> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VCADD{<q>}.<dt> <Qd>, <Qn>, <Qm>, #<rotate> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveFCADDExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 

esize = 16 << UInt(S); 

if !HaveFP16Ext() && esize == 16 then UNDEFINED; 

elements = 64 DIV esize; 

regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "S" field. It can have the following 
values: 
F16 when S = 0 
F32 when $ = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<rotate> Is the rotation to be applied to elements in the second SIMD&FP source register, encoded in the 
"rot" field. It can have the following values: 
90 when rot = 0 
270 when rot = 1 


Operation for all encodings 


EncodingSpecificOperations(); 
CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 

operand1 = D[n+r]; 

operand2 = D[m+r]; 

operand3 = D[d+r]; 

for e = 0 to (elements DIV 2)-1 


case rot of 
when 'Q' 
element1 = FPNeg(Elem[operand2,e«2+1,esize]); 
element3 = Elem[operand2,e2,esize]; 
when '1' 


element1 = Elem[operand2,e2+1,esize]; 

element3 = FPNeg(Elem[operand2,e«2,esize]); 
resultl = FPAdd(Elem[operand1,e«2,esize],element1, StandardFPSCRValue()); 
result2 = FPAdd(Elem[operand1,e2+1,esize],element3, StandardFPSCRValue()); 
Elem[D[d+r],ex2,esize] = result; 
Elem[D[d+r],e#2+1,esize] = result2; 
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F6.1.40  VCEQ (immediate #0) 


Vector Compare Equal to Zero takes each element in a vector, and compares it with zero. If it is equal to zero, the 
corresponding element in the destination vector is set to all ones. Otherwise, it is set to all zeros. 


The operand vector elements are the same type, and are integers or floating-point numbers. The result vector 
elements are fields the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


11770077 1p isejo] va Jojjo 7 ojoo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCEQ{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCEQ{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


aaia a1 1 ajoji 1fsizejo 1] va [offo 1 ojajmjo] vm | 





64-bit SIMD vector variant 
Applies when Q == 0. 


VCEQ{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCEQ{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 
if F == '1' && ((size == '01' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if F == '1' && size == '@1' && InITBlock() then UNPREDICTABLE; 
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if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
è The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "F:size" field. It can have the 
following values: 
I8 when F = 0, size = 00 
116 when F = 0, size = 01 
132 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D: Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = 0 to elements-1 
if floating_point then 
bits(esize) zero = FPZero('Q'); 
test_passed = FPCompareEQ(Elem[D[mtr],e,esize], zero, StandardFPSCRValue()); 
else 
test_passed = (Elem[D[m+r],e,esize] == Zeros(esize)); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 
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F6.1.41 VCEQ (register) 


Vector Compare Equal takes each element in a vector, and compares it with the corresponding element of a second 
vector. If they are equal, the corresponding element in the destination vector is set to all ones. Otherwise, it is set to 
all zeros. 


The operand vector elements are the same type, and are integers or floating-point numbers. The result vector 
elements are fields the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12\/11109 8|7 6 5 4/3 0 | 


T17700 i]1[0[b[sze] vw | va [ooon vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCEQ{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCEQ{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<ð> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if size == '11' then UNDEFINED; 


int_operation = TRUE; esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


T4770 0 1Joopp]ofse] vn | va pronomo] vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCEQ{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCEQ{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
int_operation = FALSE; 
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F6-4874 


case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


1 ajili 1 1 1 ojpjsze] vn | va f1 o 0 ojnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCEQ{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCEQ{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

int_operation = TRUE; esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T2 


[15 1413 12/1110 9 8|7 6 5 4/3 0 |15 12\11109 8|7 6 5 4/3 0 | 


11 ijoja 1 1 1 ofpfofsz] vn | va fi 11 ofnjajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCEQ{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCEQ{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
int_operation = FALSE; 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


25 
4; 


UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
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CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

. The instruction executes as if it passes the Condition code check. 

e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 

<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 
For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<dt> For encoding A1 and T1: is the data type for the elements of the vectors, encoded in the "size" field. 
It can have the following values: 
I8 when size = 00 
116 when size = 01 
132 when size = 10 


For encoding A2 and T2: is the data type for the elements of the vectors, encoded in the "sz" field. 
It can have the following values: 


F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 
op1 = Elem[D[n+r],e,esize]; op2 = Elem[D[m+r],e,esize] 
if int_operation then 
test_passed = (opl == op2); 
else 
test_passed = FPCompareEQ(op1, op2, StandardFPSCRValue()); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 
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F6.1.42 


F6-4876 


VCGE (immediate #0) 


Vector Compare Greater Than or Equal to Zero takes each element in a vector, and compares it with zero. If it is 
greater than or equal to zero, the corresponding element in the destination vector is set to all ones. Otherwise, it is 
set to all zeros. 


The operand vector elements are the same type, and are signed integers or floating-point numbers. The result vector 
elements are fields the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 


11770077 1p isejo] va [o[FJo o 7[Q]w[o] vwm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCGE{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCGE{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0\15 12/1109 8|7 6 5 4|3 0 | 


a111 1 1 ajoji ifsielo 1] va JolFlo o 1jajmjo] vm | 





64-bit SIMD vector variant 
Applies when Q == 0. 
VCGE{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 
128-bit SIMD vector variant 
Applies when Q == 1. 


VCGE{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 
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Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if F == '1' && size == 'Q1' && InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "F:size" field. It can have the 
following values: 
S8 when F = 0, size = 00 
S16 when F = 0, size = 01 
S32 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 
if floating_point then 
bits(esize) zero = FPZero('Q'); 
test_passed = FPCompareGE(Elem[D[mtr],e,esize], zero, StandardFPSCRValue()); 
else 
test_passed = (SInt(Elem[D[m+r],e,esize]) >= 0); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.43 VCGE (register) 


Vector Compare Greater Than or Equal takes each element in a vector, and compares it with the corresponding 
element of a second vector. If the first is greater than or equal to the second, the corresponding element in the 
destination vector is set to all ones. Otherwise, it is set to all zeros. 


The operand vector elements are the same type, and are signed integers, unsigned integers, or floating-point 
numbers. The result vector elements are fields the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instruction VCLE (register). The pseudo-instruction is never the preferred 
disassembly. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12\11109 8|7 6 5 4/3 0 | 


T11700 iJu[o[p[sze] vn | va Jo oriNomM vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCGE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCGE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if Q == '1' && (Vd<ð> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if size == '11' then UNDEFINED; 

vtype = if U == '1' then VCGEtype_unsigned else VCGEtype_signed; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


maaa oono va | va_[1 17 onmo vm 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCGE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VCGE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
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F6-4880 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
vtype = VCGEtype_fp; 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


1 1juja 1 1 1 ofdfsize] vn | va jo o1 1fnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCGE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCGE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if Q == '1' && (Vd<@> == '1' || Vn<ð> == '1' || Vm<ð> == '1') then UNDEFINED; 
if size == '11' then UNDEFINED; 

vtype = if U == '1' then VCGEtype_unsigned else VCGEtype_signed; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T2 


[15 1413 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


a ifiji 1 1 1 ofpfofsz] vn | va fi 1 1 ofnjajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCGE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCGE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 

if sz == '1' && InITBlock() then UNPREDICTABLE; 

vtype = VCGEtype_fp; 

case sz of 
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when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '0' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 

e The instruction is UNDEFINED. 

. The instruction executes as if it passes the Condition code check. 

° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> For encoding A1 and T1: is the data type for the elements of the operands, encoded in the "U:size" 
field. It can have the following values: 
S8 when U = 0, size = 00 
S16 when U = 0, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 


For encoding A2 and T2: is the data type for the elements of the vectors, encoded in the "sz" field. 
It can have the following values: 


F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 
enumeration VCGEtype {VCGEtype_signed, VCGEtype_unsigned, VCGEtype_fp}; 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 
op1 = Elem[D[n+r],e,esize]; op2 = Elem[D[m+r],e,esize] 
case vtype of 
when VCGEtype_signed test_passed = (SInt(op1) >= SInt(op2)); 
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when VCGEtype_unsigned test_passed = (UInt(op1) >= UInt(op2)); 
when VCGEtype_fp test_passed = FPCompareGE(op1, op2, StandardFPSCRValue()); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.44  VCGT (immediate #0) 


ARM DDI 0487E.a 
ID070919 


Vector Compare Greater Than Zero takes each element in a vector, and compares it with zero. If it is greater than 


zero, the corresponding element in the destination vector is set to all ones. Otherwise, it is set to all zeros. 


The operand vector elements are the same type, and are signed integers or floating-point numbers. The result vector 


elements are fields the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 121110 9 8|7 6 5 4|3 0 | 


71770077 1p isejo] va [o[F[o o ojojo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCGT{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCGT{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


aiaa a1 1 ajoji 1fsizejo 1] va [offo o ojajmjo] vm | 





64-bit SIMD vector variant 
Applies when Q == 0. 


VCGT{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCGT{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 
if F == '1' && ((size == '01' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if F == '1' && size == '@1' && InITBlock() then UNPREDICTABLE; 
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if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
è The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "F:size" field. It can have the 
following values: 
S8 when F = 0, size = 00 
S16 when F = 0, size = 01 
S32 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = 0 to elements-1 
if floating_point then 
bits(esize) zero = FPZero('Q'); 
test_passed = FPCompareGI(Elem[D[mtr],e,esize], zero, StandardFPSCRValue()); 
else 
test_passed = (SInt(Elem[D[m+r],e,esize]) > 0); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.45 


F6-4886 


VCGT (register) 


Vector Compare Greater Than takes each element in a vector, and compares it with the corresponding element of a 
second vector. If the first is greater than the second, the corresponding element in the destination vector is set to all 
ones. Otherwise, it is set to all zeros. 


The operand vector elements are the same type, and are signed integers, unsigned integers, or floating-point 
numbers. The result vector elements are fields the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instruction VCLT (register). The pseudo-instruction is never the preferred 
disassembly. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12\11109 8|7 6 5 4/3 0 | 


T1770 0 iJu[o[o[sze] vn | va [0071 i[NQ\w[o] vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCGT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCGT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if Q == '1' && (Vd<O> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if size == '11' then UNDEFINED; 

vtype = if U == '1' then VCGTtype_unsigned else VCGTtype_signed; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


77100 t[ifo[pyife] va | va 17 o[Nja|Mjo] vm 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCGT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VCGT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
vtype = VCGTtype_fp; 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 


11 tfuj1 1 1 1 ofdfsize] vn | va jo o 1 t|NJa}mMfo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCGT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCGT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if Q == '1' && (Vd<@> == '1' || Vn<ð> == '1' || Vm<ð> == '1') then UNDEFINED; 
if size == '11' then UNDEFINED; 

vtype = if U == '1' then VCGTtype_unsigned else VCGTtype_signed; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T2 


[15 1413 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


a ifiji 1 1 1 ojofils| vn | va fi 1 1 ofnjajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCGT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCGT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 

if sz == '1' && InITBlock() then UNPREDICTABLE; 

vtype = VCGTtype_fp; 

case sz of 
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when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n 


2; 
4; 


UInt(N:Vn); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 


The instruction is UNDEFINED. 
The instruction executes as if it passes the Condition code check. 


The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


For encoding Al and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1 and T1: is the data type for the elements of the operands, encoded in the "U:size" 
field. It can have the following values: 


S8 when U = 0, size = 00 
S16 when U = 0, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 


For encoding A2 and T2: is the data type for the elements of the vectors, encoded in the "sz" field. 
It can have the following values: 


F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


enumeration VCGTtype {VCGTtype_signed, VCGTtype_unsigned, VCGTtype_fp}; 


if ConditionPassed() then 


F6-4888 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 


op1 = Elem[D[n+r],e,esize]; op2 = Elem[D[m+r],e,esize]; 
case vtype of 
when VCGTtype_signed test_passed = (SInt(op1) > SInt(op2)); 
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when VCGTtype_unsigned test_passed = (UInt(op1) > UInt(op2)); 
when VCGTtype_fp test_passed = FPCompareGT(op1, op2, StandardFPSCRValue()); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.46 


F6-4890 


VCLE (immediate #0) 


Vector Compare Less Than or Equal to Zero takes each element in a vector, and compares it with zero. If it is less 
than or equal to zero, the corresponding element in the destination vector is set to all ones. Otherwise, it is set to all 
Zeros. 


The operand vector elements are the same type, and are signed integers or floating-point numbers. The result vector 
elements are fields the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 


11110011 1p isejo] va Jojjo iomo] vwm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCLE{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCLE{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0\15 121110 9 8|7 6 5 4|3 0 | 


a111 1 1 ajoji 1fsizejo 1] va [offo 1 1jajmjo] vm | 





64-bit SIMD vector variant 
Applies when Q == 0. 
VCLE{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 
128-bit SIMD vector variant 
Applies when Q == 1. 


VCLE{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 
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Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if F == '1' && size == 'Q1' && InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "F:size" field. It can have the 
following values: 
S8 when F = 0, size = 00 
S16 when F = 0, size = 01 
S32 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 
if floating_point then 
bits(esize) zero = FPZero('Q'); 
test_passed = FPCompareGE(zero, Elem[D[mtr],e,esize], StandardFPSCRValue()); 
else 
test_passed = (SInt(Elem[D[m+r],e,esize]) <= 0); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.47  VCLE (register) 


ARM DDI 0487E.a 
ID070919 


Vector Compare Less Than or Equal takes each element in a vector, and compares it with the corresponding element 
of a second vector. If the first is less than or equal to the second, the corresponding element in the destination vector 
is set to all ones. Otherwise, it is set to all zeros 


This instruction is a pseudo-instruction of the VCGE (register) instruction. This means that: 


$ The encodings in this description are named to match the encodings of VCGE (register). 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
à The description of VCGE (register) gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24|23 22 21 20119 16115 12/1110 9 8|7 6 5 4/3 0| 


Ti 7700 iU[o[p[sze] vw | va [oo 71 a[N[QlM[i] m | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCLE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VCGE{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 
VCLE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
is equivalent to 

VCGE{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 
A2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


17100 t[ifo[ppofee] va | va pir onem vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCLE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VCGE{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 
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128-bit SIMD vector variant 

Applies when Q == 1. 
VCLE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
is equivalent to 

VCGE{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 
T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4/3 0 | 


7 afuft 111 opse] va | va Joore vm _| 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCLE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VCGE{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 
VCLE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
is equivalent to 

VCGE{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 
T2 


[15 1413 12/1110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4/3 0 | 


apf 714 opok] va | va_[1 17 o[NjalMjo] vm _| 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCLE{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VCGE{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 


Applies when Q == 1. 
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VCLE{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


is equivalent to 


VCGE{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 


Assembler symbols 


<Dm> 
<Dn> 


<Qm> 


<Qn> 


<c> 


<q> 


<dt> 


<Qd> 


<Dd> 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


For encoding Al and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1 and T1: is the data type for the elements of the operands, encoded in the "U:size" 
field. It can have the following values: 


S8 when U = Q, size = 00 
S16 when U = 0, size = 01 
$32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 


For encoding A2 and T2: is the data type for the elements of the vectors, encoded in the "sz" field. 
It can have the following values: 


F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Operation for all encodings 


The description of VCGE (register) gives the operational pseudocode for this instruction. 


ARM DDI 0487E.a 
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F6.1.48 


F6-4896 


VCLS 


Vector Count Leading Sign Bits counts the number of consecutive bits following the topmost bit, that are the same 
as the topmost bit, in each element in a vector, and places the results in a second vector. The count does not include 


the topmost bit itself. 
The operand vector elements can be any one of 8-bit, 16-bit, or 32-bit signed integers. 


The result vector elements are the same data type as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 


11770077 1p isejo of va [oi oo ojoo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCLS{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCLS{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 
if size == '11' then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4|3 0 


77147177 1(0]1 teze[oo[ va Jo oo oja|mjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VCLS{<c>}{<q>}.<dt> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 


VCLS{<c>}{<q>}.<dt> <Qd>, <Qm> 
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Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 


S8 when size = 00 
S16 when size = 01 
S32 when size = 10 


The encoding size = 11 is reserved. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = Q to regs-1 
for e = 0 to elements-1 
Elem[D[d+r],e,esize] = CountLeadingSignBits(Elem[D[m+r] ,e,esize] )<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.49 


F6-4898 


VCLT (immediate #0) 


Vector Compare Less Than Zero takes each element in a vector, and compares it with zero. If it is less than zero, the 
corresponding element in the destination vector is set to all ones. Otherwise, it is set to all zeros. 


The operand vector elements are the same type, and are signed integers or floating-point numbers. The result vector 
elements are fields the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


71770077 1p isejo] va Joj 0 ojoo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCLT{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCLT{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


aaia a1 1 ajoji 1fsizejo 1] va jolF]1 o ojajmjo] vm | 





64-bit SIMD vector variant 
Applies when Q == 0. 


VCLT{<c>}{<q>}.<dt> {<Dd>,} <Dm>, #0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCLT{<c>}{<q>}.<dt> {<Qd>,} <Qm>, #0 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 
if F == '1' && ((size == '01' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if F == '1' && size == '@1' && InITBlock() then UNPREDICTABLE; 
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if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
è The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "F:size" field. It can have the 
following values: 
S8 when F = 0, size = 00 
S16 when F = 0, size = 01 
S32 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = 0 to elements-1 
if floating_point then 
bits(esize) zero = FPZero('Q'); 
test_passed = FPCompareGT (zero, Elem[D[mtr],e,esize], StandardFPSCRValue()); 
else 
test_passed = (SInt(Elem[D[m+r],e,esize]) < 0); 
Elem[D[d+r],e,esize] = if test_passed then Ones(esize) else Zeros(esize); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.50 VCLT (register) 


ARM DDI 0487E.a 
ID070919 


Vector Compare Less Than takes each element in a vector, and compares it with the corresponding element of a 
second vector. If the first is less than the second, the corresponding element in the destination vector is set to all 
ones. Otherwise, it is set to all zeros 


This instruction is a pseudo-instruction of the VCGT (register) instruction. This means that: 


$ The encodings in this description are named to match the encodings of VCGT (register). 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
à The description of VCGT (register) gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24|23 22 21 20119 16115 12/1110 9 8|7 6 5 4/3 0| 


T1770 0 iU[o[p[sze] vw | va Jo or1NomMo] m 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCLT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VCGT{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 
VCLT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
is equivalent to 

VCGT{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 
A2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


17100 t[ifo[plife] va | va_[1 17 onem] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCLT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VCGT{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 
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128-bit SIMD vector variant 

Applies when Q == 1. 
VCLT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
is equivalent to 

VCGT{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 
T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4/3 0 | 


7 afuft 711 opse] va | va Jo oriomo] vm _| 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCLT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VCGT{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 
VCLT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
is equivalent to 

VCGT{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 
T2 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4/3 0 | 


apf 714 ophi va | va_[1 17 ono vm _| 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCLT{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
is equivalent to 

VCGT{<c>}{<q>}.<dt> <Dd>, <Dm>, <Dn> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 


Applies when Q == 1. 
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VCLT{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


is equivalent to 


VCGT{<c>}{<q>}.<dt> <Qd>, <Qm>, <Qn> 


and is never the preferred disassembly. 


Assembler symbols 


<Dm> 
<Dn> 


<Qm> 


<Qn> 


<c> 


<q> 


<dt> 


<Qd> 


<Dd> 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


For encoding Al and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For encoding A1 and T1: is the data type for the elements of the operands, encoded in the "U:size" 
field. It can have the following values: 


S8 when U = Q, size = 00 
S16 when U = 0, size = 01 
$32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 


For encoding A2 and T2: is the data type for the elements of the vectors, encoded in the "sz" field. 
It can have the following values: 


F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Operation for all encodings 


The description of VCGT (register) gives the operational pseudocode for this instruction. 


ARM DDI 0487E.a 
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F6.1.51 


F6-4904 


VCLZ 


Vector Count Leading Zeros counts the number of consecutive zeros, starting from the most significant bit, in each 


element in a vector, and places the results in a second vector. 


The operand vector elements can be any one of 8-bit, 16-bit, or 32-bit integers. There is no distinction between 


signed and unsigned integers. 


The result vector elements are the same data type as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4/3 o| 


11110011 1p isejo o] va Jo ooroo] wm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VCLZ{<c>}{<q>}.<dt> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VCLZ{<c>}{<q>}.<dt> <Qd>, <Qm> 
Decode for all variants of this encoding 
if size == '11' then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4|3 0| 


Tiiti1i17 top isejo o] va Jo ooroo] vwm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VCLZ{<c>}{<q>}.<dt> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 


VCLZ{<c>}{<q>}.<dt> <Qd>, <Qm> 
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Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 


I8 when size = 00 
116 when size = 01 
132 when size = 10 


The encoding size = 11 is reserved. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = Q to regs-1 
for e = 0 to elements-1 
Elem[D[d+r],e,esize] = CountLeadingZeroBits(Elem[D[m+r] ,e,esize] )<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.52 


F6-4906 


VCMLA 


Vector Complex Multiply Accumulate. 


This instruction operates on complex numbers that are represented in SIMD&FP registers as pairs of elements, with 
the more significant element holding the imaginary part of the number and the less significant element holding the 
real part of the number. Each element holds a floating-point value. It performs the following computation on the 
corresponding complex number element pairs from the two source registers and the destination register: 


° Considering the complex number from the second source register on an Argand diagram, the number is 
rotated counterclockwise by 0, 90, 180, or 270 degrees. 


è The two elements of the transformed complex number are multiplied by: 


— Thereal element of the complex number from the first source register, if the transformation was a 
rotation by 0 or 180 degrees. 


— The imaginary element of the complex number from the first source register, if the transformation was 
a rotation by 90 or 270 degrees. 


$ The complex number resulting from that multiplication is added to the complex number from the destination 
register. 


The multiplication and addition operations are performed as a fused multiply-add, without any intermediate 
rounding. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


11111 o0|rojojijs| vn | va  {rjofofojNfajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCMLA{<q>}.<dt> <Dd>, <Dn>, <Dm>, #<rotate> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCMLA{<q>}.<dt> <Qd>, <Qn>, <Qm>, #<rotate> 


Decode for all variants of this encoding 


if !HaveFCADDExt() then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 

esize = 16 << UInt(S); 

if !HaveFP16Ext() && esize == 16 then UNDEFINED; 

elements = 64 DIV esize; 

regs = if Q == 'Q' then 1 else 2; 


T1 


ARMv8.3 
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[15 14 1312/1110 9 8|7 6 5 4/3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


77117 Of ret [Opts] w | ve [1 oJoo[Nyalmpo. vm 


64-bit SIMD vector variant 


Applies when Q == 0. 


VCMLA{<q>}.<dt> <Dd>, <Dn>, <Dm>, #<rotate> 


128-bit SIMD vector variant 


Applies when Q == 1. 


VCMLA{<q>}.<dt> <Qd>, <Qn>, <Qm>, #<rotate> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveFCADDExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 

esize = 16 << UInt(S); 

if !HaveFP16Ext() && esize == 16 then UNDEFINED; 

elements = 64 DIV esize; 

regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<q> 


<dt> 


<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 
<Dm> 


<rotate> 


See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "S" field. It can have the following 


values: 
F16 when S = 0 
F32 when S = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Is the rotation to be applied to elements in the second SIMD&FP source register, encoded in the 
"rot" field. It can have the following values: 


0 when rot = 00 
90 when rot = 01 
180 when rot = 10 
270 when rot = 11 
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Operation for all encodings 


EncodingSpecificOperations(); 
CheckAdvSIMDEnabled(); 


for r = 0 to regs-1 
operand1 = D[n+r]; 
operand2 = D[m+r]; 
operand3 = D[d+r]; 
for e = Q to (elements DIV 2)-1 
case rot of 
when 'QQ' 
element1 = Elem[operand2,e2,esize]; 
element2 = Elem[operand1,ex2,esize]; 
element3 = Elem[operand2,e«2+1,esize]; 
element4 = Elem[operand1,ex2,esize]; 
when 'Q1' 
element1 = FPNeg(Elem[operand2 ,ex2+1,esize]); 
element2 = Elem[operand1,e2+1,esize]; 
element3 = Elem[operand2,e2,esize]; 
element4 = Elem[operand1,e2+1,esize]; 
when '10' 
element1 = FPNeg(Elem[operand2,ex2,esize]); 
element2 = Elem[operand1,ex2,esize]; 
element3 = FPNeg(Elem[operand2 ,ex2+1,esize]); 
element4 = Elem[operand1,ex2,esize]; 
when '11' 
elementl = Elem[operand2,e«2+1,esize]; 
element2 = Elem[operand1,e2+1,esize]; 
element3 = FPNeg(Elem[operand2,ex2,esize]); 
element4 = Elem[operand1,e«2+1,esize]; 








result1l = FPMulAdd(Elem[operand3,ex2,esize],element2,element1, StandardFPSCRValue()); 
result2 = FPMulAdd(Elem[operand3,e«2+1,esize],element4,element3, StandardFPSCRValue()); 
Elem[D[d+r],e*2,esize] = result; 

Elem[D[d+r],e#2+1,esize] = result2; 


F6-4908 
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F6.1.53 VCMLA (by element) 


ARM DDI 0487E.a 
ID070919 


Vector Complex Multiply Accumulate (by element). 


This instruction operates on complex numbers that are represented in SIMD&FP registers as pairs of elements, with 
the more significant element holding the imaginary part of the number and the less significant element holding the 
real part of the number. Each element holds a floating-point value. It performs the following computation on 
complex numbers from the first source register and the destination register with the specified complex number from 
the second source register: 


s Considering the complex number from the second source register on an Argand diagram, the number is 
rotated counterclockwise by 0, 90, 180, or 270 degrees. 


7 The two elements of the transformed complex number are multiplied by: 


— The real element of the complex number from the first source register, if the transformation was a 
rotation by 0 or 180 degrees. 


— The imaginary element of the complex number from the first source register, if the transformation was 
a rotation by 90 or 270 degrees. 


s The complex number resulting from that multiplication is added to the complex number from the destination 
register. 


The multiplication and addition operations are performed as a fused multiply-add, without any intermediate 
rounding. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
ARMv8.3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


1111111 ofs{p] rot] vn | va  [tfofofo[njafmfo}] vm | 


64-bit SIMD vector of half-precision floating-point variant 
Applies when S == 0 & Q == 0. 


VCMLA{<q>}.F16 <Dd>, <Dn>, <Dm>[<index>], #<rotate> 


64-bit SIMD vector of single-precision floating-point variant 
Applies when S == 1 & Q == 0. 


VCMLA{<q>}.F32 <Dd>, <Dn>, <Dm>[0], #<rotate> 


128-bit SIMD vector of half-precision floating-point variant 
Applies when S == 0 & Q = 1. 

VCMLA{<q>}.F16 <Qd>, <Qn>, <Dm>[<index>], #<rotate> 

128-bit SIMD vector of single-precision floating-point variant 
Applies when S == 1 & Q == 1. 


VCMLA{<q>}.F32 <Qd>, <Qn>, <Dm>[@], #<rotate> 
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F6-4910 


Decode for all variants of this encoding 

if !HaveFCADDExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); 

m = if S=='1' then UInt(M:Vm) else UInt(Vm); 
esize = 16 << UInt(S); 

if !HaveFP16Ext() && esize == 16 then UNDEFINED; 
elements = 64 DIV esize; 

regs = if Q == 'Q' then 1 else 2; 

index = if S=='1' then @ else UInt(M); 
T1 


ARMVv8.3 


[15 141312/11109 8|7 6 5 4/3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


11411411 ofs{p] rot] vn | va [1jojojojNjajmjo] vm | 


64-bit SIMD vector of half-precision floating-point variant 
Applies when S == 0 & Q == 0. 


VCMLA{<q>}.F16 <Dd>, <Dn>, <Dm>[<index>], #<rotate> 


64-bit SIMD vector of single-precision floating-point variant 
Applies when S == 1 & Q == @. 


VCMLA{<q>}.F32 <Dd>, <Dn>, <Dm>[@], #<rotate> 


128-bit SIMD vector of half-precision floating-point variant 
Applies when S == 0 & Q == 1. 


VCMLA{<q>}.F16 <Qd>, <Qn>, <Dm>[<index>], #<rotate> 


128-bit SIMD vector of single-precision floating-point variant 
Applies when S == 1 && Q = 1. 


VCMLA{<q>}.F32 <Qd>, <Qn>, <Dm>[@], #<rotate> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveFCADDExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); 

m = if S=='1' then UInt(M:Vm) else UInt(Vm); 

esize = 16 << UInt(S); 

if !HaveFP16Ext() && esize == 16 then UNDEFINED; 

elements = 64 DIV esize; 

regs = if Q == 'Q' then 1 else 2; 

index = if S=='1' then @ else UInt(M); 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
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<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> For the half-precision scalar variant: is the 64-bit name of the second SIMD&FP source register, 


encoded in the "Vm" field. 


For the single-precision scalar variant: is the 64-bit name of the second SIMD&FP source register, 
encoded in the "M:Vm" field. 


<index> Is the element index in the range 0 to 1, encoded in the "M" field. 
<rotate> Is the rotation to be applied to elements in the second SIMD&FP source register, encoded in the 
"rot" field. It can have the following values: 
(] when rot = 00 
90 when rot = 01 
180 when rot = 10 
270 when rot = 11 


Operation for all encodings 


EncodingSpecificOperations( 
CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
operand1 = D[n+r]; 
operand2 = Din[m]; 
operand3 = D[d+r]; 
for e = Q to (elements 
case rot of 
when 'QQ' 
element1 
element2 = 
element3 = 
element4 = 
when 'Q1' 
element1 = 
element2 = 
element3 = 
element4 = 
when '10' 
elementl = 
element2 = 
element3 = 
element4 = 
when '11' 
elementl = 
element2 = 
element3 = 
element4 = 
result1 = FPMulAdd( 
result2 = FPMulAdd( 
Elem[D[d+r] ,e*2,esi 


mmm 


); 


DIV 2)-1 


em[operand2 ,index+2,esize]; 
em[operand1,e+2,esize]; 
em[operand2 ,index+2+1,esize]; 
em[operand1,e+2,esize]; 


PNeg(Elem[operand2, index*2+1,esize]); 
Jem[operand1,e«2+1,esize]; 
em[operand2, index«2,esize]; 
em[operand1,ex2+1,esize]; 


PAPA EA 


PNeg(Elem[operand2 ,index+2,esize]); 
lem[operand1,e+2,esize]; 
PNeg(Elem[operand2, index«2+1,esize]); 
Jem[operand1,ex2,esize]; 


Prk ee PPL T 


em[operand2, index«2+1,esize]; 
em[operand1,ex2+1,esize]; 

PNeg(Elem[operand2, index*2,esize]); 

Jem[operand1, ex2+1,esize]; 
Elem[operand3,ex2,esize],element2,element1, StandardFPSCRValue()); 
Elem[operand3,ex2+1,esize] ,element4,element3, StandardFPSCRValue()); 


ze] = result; 


o TA 


m 








Elem[D[d+r],e#2+1,esize] = result2; 
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F6.1.54 


F6-4912 


VCMP 


Vector Compare compares two floating-point registers, or one floating-point register and zero. It writes the result to 
the FPSCR flags. These are normally transferred to the PSTATE. {N, Z, C, V} Condition flags by a subsequent VMRS 
instruction. 


It raises an Invalid Operation exception only if either operand is a signaling NaN. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 
Cem [17710 ph o 00] va [i ofswe jomo] vm _| 


cond E 


Half-precision scalar variant 
Applies when size == 01. 


VCMP{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCMP{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCMP{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
quiet_nan_exc = (E == '1'); with_zero = FALSE; 

case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
A2 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 2 1 0] 
eit in ophion] va [1 0] size o oo ooo 
cond E 
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Half-precision scalar variant 
Applies when size == 01. 


VCMP{<c>}{<q>}.F16 <Sd>, #0.0 


Single-precision scalar variant 
Applies when size == 10. 


VCMP{<c>}{<q>}.F32 <Sd>, #0.0 


Double-precision scalar variant 
Applies when size == 11. 


VCMP{<c>}{<q>}.F64 <Dd>, #0.0 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
quiet_nan_exc = (E == '1'); with_zero = TRUE; 

case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

s The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4/3 0 | 


7704770 10]1 to] 0 0] va [i ofso mo] vm 
E 


Half-precision scalar variant 
Applies when size == 01. 


VCMP{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCMP{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCMP{<c>}{<q>}.F64 <Dd>, <Dm> 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-4913 
ID070919 Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6-4914 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && InITBlock() then UNPREDICTABLE; 

quiet_nan_exc = (E == '1'); with_zero = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

: The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T2 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 2 1 0| 


141101110 1ļjoj1 1of1 o 1| va [1 of size Jo] 1 ko] o (0) (0) 0) 0) 
E 


Half-precision scalar variant 
Applies when size == 01. 


VCMP{<c>}{<q>}.F16 <Sd>, #0.0 


Single-precision scalar variant 
Applies when size == 10. 


VCMP{<c>}{<q>}.F32 <Sd>, #0.0 


Double-precision scalar variant 
Applies when size == 11. 


VCMP{<c>}{<q>}.F64 <Dd>, #0.0 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 

quiet_nan_exc = (E == '1'); with_zero = TRUE; 

case size of 


when 'Q@1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
š The instruction executes as if it passes the Condition code check. 
e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
NaNs 


The IEEE 754 standard specifies that the result of a comparison is precisely one of <, ==, > or unordered. If either 
or both of the operands are NaNs, they are unordered, and all three of (Operand! < Operand2), (Operand1 == 
Operand2) and (Operand1 > Operand2) are false. This results in the FPSCR flags being set as N=0, Z=0, C=1 and 
V=1. 


VCMPE raises an Invalid Operation exception if either operand is any type of NaN, and is suitable for testing for <, 
<s, >, >=, and other predicates that raise an exception when the operands are unordered. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
bits(4) nzcv; 
case esize of 
when 16 
bits(16) op16 = if with_zero then FPZero('@') else S[m]<15:Q>; 
nzcv = FPCompare(S[d]<15:@>, op16, quiet_nan_exc, FPSCR); 
when 32 
bits(32) op32 = if with_zero then FPZero('Q') else S[m]; 
nzcv = FPCompare(S[d], 0p32, quiet_nan_exc, FPSCR); 
when 64 
bits(64) op64 = if with_zero then FPZero('0') else D[m]; 
nzcv = FPCompare(D[d], 0p64, quiet_nan_exc, FPSCR); 


FPSCR.<N,Z,C,V> = nzcv; 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
7 The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.55 


F6-4916 


VCMPE 


Vector Compare, raising Invalid Operation on NaN compares two floating-point registers, or one floating-point 
register and zero. It writes the result to the FPSCR flags. These are normally transferred to the PSTATE. {N, Z, C, 
V} Condition flags by a subsequent VMRS instruction. 


It raises an Invalid Operation exception if either operand is any type of NaN. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


Derm [1770 1[o]1 o 00] va [i ojs iimo] vm 
E 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VCMPE{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCMPE{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCMPE{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
quiet_nan_exc = (E == '1'); with_zero = FALSE; 

case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
A2 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 2 1 0] 
eit [1110 ph o 0 1] ve [1 oe ooo 
cond E 
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Half-precision scalar variant 
Applies when size == 01. 


VCMPE{<c>}{<q>}.F16 <Sd>, #0.0 


Single-precision scalar variant 
Applies when size == 10. 


VCMPE{<c>}{<q>}.F32 <Sd>, #0.0 


Double-precision scalar variant 
Applies when size == 11. 


VCMPE{<c>}{<q>}.F64 <Dd>, #0.0 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
quiet_nan_exc = (E == '1'); with_zero = TRUE; 

case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

s The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1110 9 8|7 6 5 4|3 0| 


marora orphie o] va [i ojs jimo] vm _| 
E 


Half-precision scalar variant 
Applies when size == 01. 


VCMPE{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCMPE{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCMPE{<c>}{<q>}.F64 <Dd>, <Dm> 
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F6-4918 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && InITBlock() then UNPREDICTABLE; 

quiet_nan_exc = (E == '1'); with_zero = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

: The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T2 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4/3 2 1 0] 


141101110 1ļjoj1 1of1 o 1| va f1 of size f1 [1 kof o (0) (0) 0) 0) 
E 


Half-precision scalar variant 
Applies when size == 01. 


VCMPE{<c>}{<q>}.F16 <Sd>, #0.0 


Single-precision scalar variant 
Applies when size == 10. 


VCMPE{<c>}{<q>}.F32 <Sd>, #0.0 


Double-precision scalar variant 
Applies when size == 11. 


VCMPE{<c>}{<q>}.F64 <Dd>, #0.0 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 

quiet_nan_exc = (E == '1'); with_zero = TRUE; 

case size of 


when 'Q@1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
š The instruction executes as if it passes the Condition code check. 
e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
NaNs 


The IEEE 754 standard specifies that the result of a comparison is precisely one of <, ==, > or unordered. If either 
or both of the operands are NaNs, they are unordered, and all three of (Operand! < Operand2), (Operand1 == 
Operand2) and (Operand1 > Operand2) are false. This results in the FPSCR flags being set as N=0, Z=0, C=1 and 
V=1. 


VCMPE raises an Invalid Operation exception if either operand is any type of NaN, and is suitable for testing for <, 
<s, >, >=, and other predicates that raise an exception when the operands are unordered. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
bits(4) nzcv; 
case esize of 
when 16 
bits(16) op16 = if with_zero then FPZero('@') else S[m]<15:Q>; 
nzcv = FPCompare(S[d]<15:@>, op16, quiet_nan_exc, FPSCR); 
when 32 
bits(32) op32 = if with_zero then FPZero('Q') else S[m]; 
nzcv = FPCompare(S[d], 0p32, quiet_nan_exc, FPSCR); 
when 64 
bits(64) op64 = if with_zero then FPZero('0') else D[m]; 
nzcv = FPCompare(D[d], 0p64, quiet_nan_exc, FPSCR); 


FPSCR.<N,Z,C,V> = nzcv; 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
7 The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.56 VCNT 


F6-4920 


Vector Count Set Bits counts the number of bits that are one in each element in a vector, and places the results in a 


second vector. 
The operand vector elements must be 8-bit fields. 


The result vector elements are 8-bit integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 o| 


11110011 1p isejo o] va Jo 07 ojoo] wm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCNT{<c>}{<q>}.8 <Dd>, <Dm> // Encoded as Q = 0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCNT{<c>}{<q>}.8 <Qd>, <Qm> // Encoded as Q = 1 


Decode for all variants of this encoding 
if size != '00' then UNDEFINED; 
if Q == '1' && (Vd<0> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8; elements = 8; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4|3 o| 


Tiiti117 10] isejo o] va Jo or ojoo] wm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCNT{<c>}{<q>}.8 <Dd>, <Dm> // Encoded as Q = 0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCNT{<c>}{<q>}.8 <Qd>, <Qm> // Encoded as Q = 1 


Decode for all variants of this encoding 


if size != '@@' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
esize = 8; elements = 8; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
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Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = BitCount(Elem[D[m+r] ,e,esize] )<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.57 


F6-4922 


VCVT (between double-precision and single-precision) 


Convert between double-precision and single-precision does one of the following: 


. Converts the value in a double-precision register to single-precision and writes the result to a single-precision 
register. 
. Converts the value in a single-precision register to double-precision and writes the result to a 


double-precision register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and 


PE mode 


in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12\11109 8|7 6 5 4/3 0 | 
[11 [4 110 1ļjpli iloj 11| va J1 oft xliliflmjlo] vm | 


cond size 


Single-precision to double-precision variant 
Applies when size == 10. 


VCVT{<c>}{<q>}.F64.F32 <Dd>, <Sm> 


Double-precision to single-precision variant 
Applies when size == 11. 


VCVT{<c>}{<q>}.F32.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 
double_to_single = (size == '11'); 


d = if double_to_single then UInt(Vd:D) else UInt(D:Vd); 
m = if double_to_single then UInt(M:Vm) else UInt(Vm:M); 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


77704770 ipho ve Mopo v 


size 


Single-precision to double-precision variant 
Applies when size == 10. 


VCVT{<c>}{<q>}.F64.F32 <Dd>, <Sm> 


Double-precision to single-precision variant 
Applies when size == 11. 


VCVT{<c>}{<q>}.F32.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


double_to_single = (size == '11'); 
d = if double_to_single then UInt(Vd:D) else UInt(D:Vd); 
m = if double_to_single then UInt(M:Vm) else UInt(Vm:M); 
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Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
if double_to_single then 
S[d] = FPConvert(D[m], FPSCR); 
else 
D[d] = FPConvert(S[m], FPSCR); 
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F6.1.58 


F6-4924 


VCVT (between half-precision and single-precision, Advanced SIMD) 


Vector Convert between half-precision and single-precision converts each element in a vector from single-precision 
to half-precision floating-point, or from half-precision to single-precision, and places the results in a second vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 


11110011 1p isejo] va Jol roelojomo] vm 


Half-precision to single-precision variant 
Applies when op = 1. 


VCVT{<c>}{<q>}.F32.F16 <Qd>, <Dm> // Encoded as op = 1 


Single-precision to half-precision variant 


Applies when op == 0. 
VCVT{<c>}{<q>}.F16.F32 <Dd>, <Qm> // Encoded as op = 0 
Decode for all variants of this encoding 
if size != '01' then UNDEFINED; 
half_to_single = (op == '1'); 
if half_to_single && Vd<@> == '1' then UNDEFINED; 
if !half_to_single && Vm<0> == '1' then UNDEFINED; 
esize = 16; elements = 4; 
m = UInt(M:Vm); d = UInt(D:Vd); 
T1 
|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|15 12|1110 9 8|7 6 5 4|3 0| 





1111111 ajoji 1jszeji of va Joji 1lojojojmjo] vm | 


Half-precision to single-precision variant 
Applies when op = 1. 


VCVT{<c>}{<q>}.F32.F16 <Qd>, <Dm> // Encoded as op = 1 


Single-precision to half-precision variant 


Applies when op == 0. 
VCVT{<c>}{<q>}.F16.F32 <Dd>, <Qm> // Encoded as op = 0 
Decode for all variants of this encoding 
if size != '01' then UNDEFINED; 
half_to_single = (op == '1'); 
if half_to_single && Vd<@> == '1' then UNDEFINED; 
if !half_to_single && Vm<0> == '1' then UNDEFINED; 
esize = 16; elements = 4; 
m = UInt(M:Vm); d = UInt(D:Vd); 
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Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for e = Q to elements-1 
if half_to_single then 
Elem[Q[d>>1] ,e,32] = FPConvert(Elem[Din[m],e,16], StandardFPSCRValue()); 
else 
Elem[D[d],e,16] = FPConvert(Elem[Qin[m>>1] ,e,32], StandardFPSCRValue()); 
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F6.1.59 


F6-4926 


VCVT (between floating-point and integer, Advanced SIMD) 


Vector Convert between floating-point and integer converts each element in a vector from floating-point to integer, 
or from integer to floating-point, and places the results in a second vector. 


The vector elements are the same type, and are floating-point numbers or integers. Signed and unsigned integers are 
distinct. 


The floating-point to integer operation uses the Round towards Zero rounding mode. The integer to floating-point 
operation uses the Round to Nearest rounding mode. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 


77710077 10]1 isej] va jo 7] op omo vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCVT{<c>}{<q>}.<dtl>.<dt2> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCVT{<c>}{<q>}.<dtl>.<dt2> <Qd>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
to_integer = (op<l> == '1'); unsigned = (op<@> == '1'); 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


11111111 1foji afsize[1 1| va [oji 1f op jajmjo] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VCVT{<c>}{<q>}.<dtl>.<dt2> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 


VCVT{<c>}{<q>}.<dt1>.<dt2> <Qd>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
to_integer = (op<l> == '1'); unsigned = (op<@> == '1'); 
case size of 
when '01' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 

s The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt1> Is the data type for the elements of the destination vector, encoded in the "size:op" field. It can have 
the following values: 
F16 when size = 01, op = 0x 
S16 when size = 01, op = 10 
U16 when size = 01, op = 11 
F32 when size = 10, op = 0x 
S32 when size = 10, op = 10 
U32 when size = 10, op = 11 
<dt2> Is the data type for the elements of the source vector, encoded in the "size:op" field. It can have the 
following values: 
S16 when size = 01, op = 00 
U16 when size = 01, op = 01 
F16 when size = 01, op = 1x 
S32 when size = 10, op = 00 
U32 when size = 10, op = 01 
F32 when size = 10, op = 1x 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(esize) result; 
for r = 0 to regs-1 
for e = Q to elements-1 
op1 = Elem[D[m+r],e,esize]; 
if to_integer then 
result = FPToFixed(op1, @, unsigned, StandardFPSCRValue(), FPRounding_ZERO) ; 
else 
result = FixedToFP(op1, @, unsigned, StandardFPSCRValue(), FPRounding_TIEEVEN) ; 
Elem[D[d+r],e,esize] = result; 


F6-4928 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.60 VCVT (floating-point to integer, floating-point) 


ARM DDI 0487E.a 
ID070919 


Convert floating-point to integer with Round towards Zero converts a value in a register from floating-point to a 
32-bit integer, using the Round towards Zero rounding mode, and places the result in a second register. 


VCVT (between floating-point and fixed-point, floating-point) describes conversions between floating-point and 
16-bit integers. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


31 28|27 26 25 24|23 22 2120/1918  16|15 12/1109 8|7 6 5 4|3 0 | 


Derm [1770 tli ti[1 ox] vat [swe [i]t [mo] vm 





cond opc2 op 


Half-precision scalar variant 
Applies when opc2 == 100 && size == 01. 


VCVT{<c>}{<q>}.U32.F16 <Sd>, <Sm> 


Half-precision scalar variant 
Applies when opc2 == 101 && size == 01. 


VCVT{<c>}{<q>}.S32.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when opc2 == 100 && size == 10. 


VCVT{<c>}{<q>}.U32.F32 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when opc2 == 101 && size == 10. 


VCVT{<c>}{<q>}.S32.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when opc2 == 100 && size == 11. 


VCVT{<c>}{<q>}.U32.F64 <Sd>, <Dm> 


Double-precision scalar variant 
Applies when opc2 == 101 && size == 11. 


VCVT{<c>}{<q>}.S32.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if opc2 != '000' && opc2 != '10x' then SEE "Related encodings"; 
if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
to_integer = (opc2<2> == '1'); 
if to_integer then 
unsigned = (opc2<@> == '0'); 
rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 
d = UInt(Vd:D); 
case size of 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-4929 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


when '@1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


else 

unsigned = (op == 'Q'); 

rounding = FPRoundingMode(FPSCR) ; 

m = UInt(Vm:M); 

case size of 
when '@1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 





If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
è The instruction is UNDEFINED. 
° The instruction executes as if it passes the Condition code check. 
à The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
T1 
|15 14 13 121110 9 8|7 6 5 4|3 2 0 |15 12|1110 9 8|7 6 5 4/3 o| 
mrar o rano p e o va [1 ose Mo] vm] 
opc2 op 
Half-precision scalar variant 
Applies when opc2 == 100 && size == 01. 
VCVT{<c>}{<q>}.U32.F16 <Sd>, <Sm> 
Half-precision scalar variant 
Applies when opc2 == 101 && size == 01. 
VCVT{<c>}{<q>}.S32.F16 <Sd>, <Sm> 
Single-precision scalar variant 
Applies when opc2 == 100 && size == 10. 
VCVT{<c>}{<q>}.U32.F32 <Sd>, <Sm> 
Single-precision scalar variant 
Applies when opc2 == 101 && size == 10. 
VCVT{<c>}{<q>}.S32.F32 <Sd>, <Sm> 
Double-precision scalar variant 
Applies when opc2 == 100 && size == 11. 
VCVT{<c>}{<q>}.U32.F64 <Sd>, <Dm> 
Double-precision scalar variant 
Applies when opc2 == 101 && size == 11. 
VCVT{<c>}{<q>}.S32.F64 <Sd>, <Dm> 
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Decode for all variants of this encoding 


if opc2 != '000' && opc2 != '10x' then SEE "Related encodings"; 
if size == 'Q0' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
to_integer = (opc2<2> == '1'); 
if to_integer then 
unsigned = (opc2<@> == 'Q'); 
rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 
d = UInt(Vd:D); 
case size of 
when '01' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


else 

unsigned = (op == '0'); 

rounding = FPRoundingMode(FPSCR) ; 

m = UInt(Vm:M); 

case size of 
when '@1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

a The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 

7 The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


Related encodings: See Floating-point data-processing on page F3-3958 for the T32 instruction set, or 
Floating-point data-processing on page F4-4039 for the A32 instruction set. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
if to_integer then 

case esize of 

when 16 

S[d] 

when 32 

S[d] 

when 64 

S[d] 


FPToFixed(S[m]<15:0>, ©, unsigned, FPSCR, rounding); 


FPToFixed(S[m], @, unsigned, FPSCR, rounding); 


FPToFixed(D[m], @, unsigned, FPSCR, rounding); 
else 
case esize of 
when 16 
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bits(16) fp16 = FixedToFP(S[m], @, unsigned, FPSCR, rounding); 
S[d] = Zeros(16):fp16; 


when 32 
S[d] = FixedToFP(S[m], @, unsigned, FPSCR, rounding); 
when 64 
D[d] = FixedToFP(S[m], 0, unsigned, FPSCR, rounding); 
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F6.1.61 VCVT (integer to floating-point, floating-point) 


Convert integer to floating-point converts a 32-bit integer to floating-point using the rounding mode specified by 
the FPSCR, and places the result in a second register. 


VCVT (between floating-point and fixed-point, floating-point) describes conversions between floating-point and 
16-bit integers. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 2120/1918 16/15 12/1110 9 8|7 6 5 4|3 0| 
Cem [i770 ph io 00] va [i of size fooi mo] vm 


cond opc2 


Half-precision scalar variant 
Applies when size == 01. 


VCVT{<c>}{<q>}.F16.<dt> <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVT{<c>}{<q>}.F32.<dt> <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCVT{<c>}{<q>}.F64.<dt> <Dd>, <Sm> 


Decode for all variants of this encoding 


if opc2 != '000' && opc2 != '10x' then SEE "Related encodings"; 
if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
to_integer = (opc2<2> == '1'); 
if to_integer then 
unsigned = (opc2<@> == 'Q'); 
rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 
d = UInt(Vd:D); 
case size of 
when '@1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


else 

unsigned = (op == 'Q'); 

rounding = FPRoundingMode(FPSCR) ; 

m = UInt(Vm:M); 

case size of 
when '@1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
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F6-4934 


s The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
T1 
[15 14 13 12/1110 9 8|7 6 5 4|3 2 015 12/1110 9 8|7 6 5 4|3 0| 
1110111 orphen 0] va [i ofsi] vm | 
opc2 


Half-precision scalar variant 
Applies when size == 01. 


VCVT{<c>}{<q>}.F16.<dt> <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVT{<c>}{<q>}.F32.<dt> <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCVT{<c>}{<q>}.F64.<dt> <Dd>, <Sm> 


Decode for all variants of this encoding 


if opc2 != '000' && opc2 != '10x' then SEE "Related encodings"; 
if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
to_integer = (opc2<2> == '1'); 
if to_integer then 
unsigned = (opc2<@> == 'Q'); 
rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 
d = UInt(Vd:D); 
case size of 
when '@1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


else 

unsigned = (op == 'Q'); 

rounding = FPRoundingMode(FPSCR) ; 

m = UInt(Vm:M); 

case size of 
when '@1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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Notes for all encodings 


Related encodings: See Floating-point data-processing on page F3-3958 for the T32 instruction set, or 


Floating-point data-processing on page F4-4039 for the A32 instruction set. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Sd> 
<Dd> 


<Sm> 


See Standard assembler syntax fields on page F2-3908. 


See Standard assembler syntax fields on page F2-3908. 


Is the data type for the operand, encoded in the "op" field. It can have the following values: 


U32 when op = 0 
$32 when op = 1 


Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
if to_integer then 

case esize of 

when 16 

S[d] 

when 32 

S[d] 

when 64 

S[d] 


FPToFixed(S[m]<15:0>, ©, unsigned, FPSCR, rounding); 


FPToFixed(S[m], @, unsigned, FPSCR, rounding); 


FPToFixed(D[m], @, unsigned, FPSCR, rounding); 
else 
case esize of 
when 16 
bits(16) fp16 = FixedToFP(S[m], @, unsigned, FPSCR, rounding); 
S[d] = Zeros(16):fp16; 


when 32 

S[d] = FixedToFP(S[m], @, unsigned, FPSCR, rounding); 
when 64 

D[d] = FixedToFP(S[m], 0, unsigned, FPSCR, rounding); 
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F6.1.62 


F6-4936 


VCVT (between floating-point and fixed-point, Advanced SIMD) 


Vector Convert between floating-point and fixed-point converts each element in a vector from floating-point to 


fixed-point, or from fixed-point to floating-point, and places the results in a second vector. 


The vector elements are the same type, and are floating-point numbers or integers. Signed and unsigned integers are 


distinct. 


The floating-point to fixed-point operation uses the Round towards Zero rounding mode. The fixed-point to 


floating-point operation uses the Round to Nearest rounding mode. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 12\11109 8|7 6 5 4/3 0 | 


77100 TU] imme | va [io ojm vm | 


64-bit SIMD vector variant 
Applies when imm6 != 000xxx && Q == 0. 


VCVT{<c>}{<q>}.<dt1l>.<dt2> <Dd>, <Dm>, #<fbits> 


128-bit SIMD vector variant 
Applies when imm6 != 000xxx && Q == 1. 


VCVT{<c>}{<q>}.<dt1l>.<dt2> <Qd>, <Qm>, #<fbits> 


Decode for all variants of this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 
if op<l> == 'Q@' && !HaveFP16Ext() then UNDEFINED; 
if op<1> == 'Q' && imm6 == '10xxxx' then UNDEFINED; 
if imm6 == '@xxxxx' then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
to_fixed = (op<@> == '1'); frac_bits = 64 - UInt(imm6); 
unsigned = (U == '1'); 
case op<l> of 
when '@' esize = 16; elements = 4; 
when '1' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 12|1110 9 8|7 6 5 | 0 |15 12/1109 8|7 6 5 4|3 0 | 


1 1juja 1 1 1 ajo] imme | va fri 1 op Jojajmji] vm | 


64-bit SIMD vector variant 
Applies when imm6 != 000xxx && Q == 0. 


VCVT{<c>}{<q>}.<dt1>.<dt2> <Dd>, <Dm>, #<fbits> 


128-bit SIMD vector variant 


Applies when imm6 != 000xxx && Q == 1. 
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VCVT{<c>}{<q>}.<dt1l>.<dt2> <Qd>, <Qm>, #<fbits> 


Decode for all variants of this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 
if op<l> == 'Q' && !HaveFP16Ext() then UNDEFINED; 
if op<l> == 'Q@' && imm6 == '10xxxx' then UNDEFINED; 
if imm6 == '@xxxxx' then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
to_fixed = (op<@> == '1'); frac_bits = 64 - UInt(imm6); 
unsigned = (U == '1'); 
case op<l> of 
when '@' esize = 16; elements = 4; 
when '1' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt1> Is the data type for the elements of the destination vector, encoded in the "op:U" field. It can have 
the following values: 
F16 when op = 00, U = x 
S16 when op = 01, U = 0 
U16 when op = 01, U = 1 
F32 when op = 10, U = x 
S32 when op = 11,U = @ 
U32 when op = 11,U = 1 
<dt2> Is the data type for the elements of the source vector, encoded in the "op:U" field. It can have the 
following values: 
S16 when op = 00, U = 0 
U16 when op = 00,U = 1 
F16 when op = 01, U = x 
$32 when op = 10, U = 0 
U32 when op = 10,U = 1 
F32 when op = 11, U = x 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
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<fbits> 


The number of fraction bits in the fixed point number, in the range | to 32 for 32-bit elements, or in 
the range 1 to 16 for 16-bit elements: 


à (64 - <fbits>) is encoded in imm6. 


An assembler can permit an <fbits> value of 0. This is encoded as floating-point to integer or integer 
to floating-point instruction, see VCVT (between floating-point and integer, Advanced SIMD). 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(esize) result; 
for r = 0 to regs-1 


F6-4938 


for e = Q to elements-1 


op1 = Elem[D[m+r],e,esize]; 
if to_fixed then 
result = FPToFixed(op1, frac_bits, unsigned, StandardFPSCRValue(), 
FPRounding_ZERO) ; 
else 
result = FixedToFP(op1, frac_bits, unsigned, StandardFPSCRValue(), 
FPRounding_TIEEVEN) ; 
Elem[D[d+r],e,esize] = result; 
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F6.1.63 VCVT (between floating-point and fixed-point, floating-point) 


Convert between floating-point and fixed-point converts a value in a register from floating-point to fixed-point, or 
from fixed-point to floating-point. Software can specify the fixed-point value as either signed or unsigned. 


The fixed-point value can be 16-bit or 32-bit. Conversions from fixed-point values take their operand from the 
low-order bits of the source register and ignore any remaining bits. Signed conversions to fixed-point values 
sign-extend the result value to the destination register width. Unsigned conversions to fixed-point values 
zero-extend the result value to the destination register width. 


The floating-point to fixed-point operation uses the Round towards Zero rounding mode. The fixed-point to 
floating-point operation uses the Round to Nearest rounding mode. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 


[nm ft 1 1 0 1joji t]ifopftfuy va f1 of st |sx{tfifo] imma | 





cond 


Half-precision scalar variant 
Applies when op == 0 && sf == 01. 


VCVT{<c>}{<q>}.F16.<dt> <Sdm>, <Sdm>, #<fbits> 


Half-precision scalar variant 
Applies when op == 1 & sf == 01. 


VCVT{<c>}{<q>}.<dt>.F16 <Sdm>, <Sdm>, #<fbits> 


Single-precision scalar variant 
Applies when op == 0 && sf == 10. 


VCVT{<c>}{<q>}.F32.<dt> <Sdm>, <Sdm>, #<fbits> 


Single-precision scalar variant 
Applies when op == 1 & sf == 10. 


VCVT{<c>}{<q>}.<dt>.F32 <Sdm>, <Sdm>, #<fbits> 


Double-precision scalar variant 
Applies when op == 0 && sf == 11. 


VCVT{<c>}{<q>}.F64.<dt> <Ddm>, <Ddm>, #<fbits> 


Double-precision scalar variant 
Applies when op == 1 & sf == 11. 


VCVT{<c>}{<q>}.<dt>.F64 <Ddm>, <Ddm>, #<fbits> 


Decode for all variants of this encoding 


if sf == '00' || (sf == '01' && !HaveFP16Ext()) then UNDEFINED; 
if sf == '01' && cond != '1110' then UNPREDICTABLE; 
to_fixed = (op == '1'); unsigned = (U == '1'); 
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size = if sx == '@' then 16 else 32; 

frac_bits = size - UInt(imm4:i); 

case sf of 
when '01' fp_size = 16; d = UInt(Vd:D); 
when '10' fp_size = 32; d = UInt(Vd:D); 
when '11' fp_size = 64; d = UInt(D:Vd); 


if frac_bits < @ then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If frac_bits < 0, then one of the following behaviors must occur: 


: The instruction is UNDEFINED. 
° The instruction executes as NOP. 
$ The value in the destination register is UNKNOWN. 
T1 
[15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1110 9 8|7 6 5 4/3 


o| 





1101110 jolt 1jilojijlu| va f1 of st |sx[1lifo] imm | 


Half-precision scalar variant 
Applies when op == 0 && sf == 01. 


VCVT{<c>}{<q>}.F16.<dt> <Sdm>, <Sdm>, #<fbits> 


Half-precision scalar variant 
Applies when op == 1 && sf == 01. 


VCVT{<c>}{<q>}.<dt>.F16 <Sdm>, <Sdm>, #<fbits> 


Single-precision scalar variant 
Applies when op == 0 && sf == 10. 


VCVT{<c>}{<q>}.F32.<dt> <Sdm>, <Sdm>, #<fbits> 


Single-precision scalar variant 

Applies when op == 1 && sf == 10. 
VCVT{<c>}{<q>}.<dt>.F32 <Sdm>, <Sdm>, #<fbits> 
Double-precision scalar variant 

Applies when op == 0 && sf == 11. 
VCVT{<c>}{<q>}.F64.<dt> <Ddm>, <Ddm>, #<fbits> 
Double-precision scalar variant 

Applies when op == 1 && sf == 11. 


VCVT{<c>}{<q>}.<dt>.F64 <Ddm>, <Ddm>, #<fbits> 
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Decode for all variants of this encoding 


if sf == 'Q0' || (sf == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if sf == 'Q1' && InITBlock() then UNPREDICTABLE; 

to_fixed = (op == '1'); unsigned = (U == '1') 

size = if sx == '@' then 16 else 32; 

frac_bits = size - UInt(imm4:i); 

case sf of 
when '@1' fp_size 
when '10' fp_size 
when '11' fp_size 


16; d = UInt(Vd:D); 
32; d = UInt(Vd:D); 
64; d = UInt(D:Vd); 


if frac_bits < @ then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If frac_bits < 0, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as NOP. 
° The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VCVT (between floating-point and 
fixed-point) on page K1-7621. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the fixed-point number, encoded in the "U:sx" field. It can have the following 
values: 
S16 when U = 0, sx = Q 
S32 when U = 0, sx = 1 
U16 when U = 1, sx = 0 
U32 when U = 1,sx = 1 
<Sdm> Is the 32-bit name of the SIMD&FP destination and source register, encoded in the "Vd:D" field. 
<Ddm> Is the 64-bit name of the SIMD&FP destination and source register, encoded in the "D:Vd" field. 
<fbits> The number of fraction bits in the fixed-point number: 
. If <dt> is S16 or U16, <fbits> must be in the range 0-16. (16 - <fbits>) is encoded in [imm4, i] 
. If <dt> is $32 or U32, <fbits> must be in the range 1-32. (32 - <fbits>) is encoded in [imm4, i]. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
if to_fixed then 
bits(size) result; 
case fp_size of 
when 16 
result = FPToFixed(S[d]<15:0>, frac_bits, unsigned, FPSCR, FPRounding_ZERO) ; 
S[d] = Extend(result, 32, unsigned); 
when 32 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-4941 
ID070919 Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


result = FPToFixed(S[d], frac_bits, unsigned, FPSCR, FPRounding_ZERO) ; 
S[d] = Extend(result, 32, unsigned); 

when 64 
result = FPToFixed(D[d], frac_bits, unsigned, FPSCR, FPRounding_ZERO) ; 
D[d] = Extend(result, 64, unsigned); 

else 
case fp_size of 

when 16 

bits(16) fp16 = FixedToFP(S[d]<size-1:0>, frac_bits, unsigned, FPSCR, 
FPRounding_TIEEVEN) ; 

S[d] = Zeros(16):fp16; 


when 32 
S[d] = FixedToFP(S[d]<size-1:0>, frac_bits, unsigned, FPSCR, FPRounding_TIEEVEN) ; 
when 64 
D[d] = FixedToFP(D[d]<size-1:0>, frac_bits, unsigned, FPSCR, FPRounding_TIEEVEN); 
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F6.1.64 VCVTA (Advanced SIMD) 


Vector Convert floating-point to integer with Round to Nearest with Ties to Away converts each element in a vector 
from floating-point to integer using the Round to Nearest with Ties to Away rounding mode, and places the results 
in a second vector. 


The operand vector elements are floating-point numbers. 
The result vector elements are 32-bit integers. Signed and unsigned integers are distinct. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 


Ti 770077 101 isej] va Jojolo ofop[a]wfo[ vm | 
RM 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCVTA{<q>}.<dt>.<dt2> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCVTA{<q>}.<dt>.<dt2> <Qd>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == '1'); 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


Titti117 40] isej] va Jojolo ofop[a]wfo[ vm | 
RM 


64-bit SIMD vector variant 
Applies when Q == 0. 
VCVTA{<q>}.<dt>.<dt2> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 


VCVTA{<q>}.<dt>.<dt2> <Qd>, <Qm> 
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Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == '1'); 
case size of 
when 'Q@1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the destination, encoded in the "op" field. It can have the 
following values: 
S32 when op = 0 
U32 when op = 1 
<dt2> Is the data type for the elements of the source vector, encoded in the "size" field. It can have the 
following values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(esize) result; 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = FPToFixed(Elem[D[m+r],e,esize], @, unsigned, 
StandardFPSCRValue(), rounding); 
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F6.1.65 VCVTA (floating-point) 


Convert floating-point to integer with Round to Nearest with Ties to Away converts a value in a register from 
floating-point to a 32-bit integer using the Round to Nearest with Ties to Away rounding mode, and places the result 
in a second register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4]3 0 | 
Ti t11410 1)0][11 140 o] va [i oleoj o] vm _| 
RM size 


Half-precision scalar variant 
Applies when size == 01. 


VCVTA{<q>}.<dt>.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVTA{<q>}.<dt>.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCVTA{<q>}.<dt>.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

rounding = FPDecodeRM(RM); unsigned = (op == 'Q'); 

d = UInt(Vd:D); 

case size of 
when 'Q1' esize = 16; m 
when '10' esize = 32; m 
when '11' esize = 64; m 


UInt(Vm:M) ; 
UInt(Vm:M) ; 
UInt(M:Vm) ; 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


11111110 1fpji 1 1flijloo] va [1 o|!o0foj1jmjo] vm | 
RM 


size 


Half-precision scalar variant 
Applies when size == 01. 


VCVTA{<q>}.<dt>.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVTA{<q>}.<dt>.F32 <Sd>, <Sm> 
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F6-4946 


Double-precision scalar variant 
Applies when size == 11. 


VCVTA{<q>}.<dt>.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if size == 'Q0' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == 'Q'); 

d = UInt(Vd:D); 

case size of 


when 'Q1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 
<q> See Standard assembler syntax fields on page F2-3908. 


<dt> Is the data type for the elements of the destination, encoded in the "op" field. It can have the 
following values: 


U32 when op = 0 

S32 when op = 1 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = FPToFixed(S[m]<15:@>, @, unsigned, FPSCR, rounding); 
when 32 
S[d] = FPToFixed(S[m], 0, unsigned, FPSCR, rounding); 
when 64 
S[d] = FPToFixed(D[m], ©, unsigned, FPSCR, rounding); 
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F6.1.66 VCVTB 


ARM DDI 0487E.a 
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Convert to or from a half-precision value in the bottom half of a single-precision register does one of the following: 


. Converts the half-precision value in the bottom half of a single-precision register to single-precision and 
writes the result to a single-precision register. 


s Converts the half-precision value in the bottom half of a single-precision register to double-precision and 
writes the result to a double-precision register. 


: Converts the single-precision value in a single-precision register to half-precision and writes the result into 
the bottom half of a single-precision register, preserving the other half of the destination register. 


° Converts the double-precision value in a double-precision register to half-precision and writes the result into 
the bottom half of a single-precision register, preserving the other half of the destination register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 
[111 [4 11 0 1fpli 1foļo 1f] va |1 oft szfo]i{mjo[ vm | 


cond T 


Half-precision to single-precision variant 
Applies when op == 0 && sz == 


VCVTB{<c>}{<q>}.F32.F16 <Sd>, <Sm> 


Half-precision to double-precision variant 
Applies when op == 0 && sz == 


VCVTB{<c>}{<q>}.F64.F16 <Dd>, <Sm> 


Single-precision to half-precision variant 
Applies when op == 1 && sz == 


VCVTB{<c>}{<q>}.F16.F32 <Sd>, <Sm> 


Double-precision to half-precision variant 
Applies when op == 1 && sz == 


VCVTB{<c>}{<q>}.F16.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


uses_double = (sz == '1'); convert_from_half = (op == 'Q'); 
lowbit = (if T == '1' then 16 else 0); 
if uses_double then 
if convert_from_half then 
d = UInt(D:Vd); m = UInt(Vm:M); 
else 
d = UInt(Vd:D); m = UInt(M:Vm); 
else 
d = UInt(Vd:D); m = UInt(Vm:M); 
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T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4|3 0| 


11101110 1{d]1 1foļo 1fo| va [1 oj1fszjojıjmjo] vm | 
T 


Half-precision to single-precision variant 
Applies when op == 0 && sz == 


VCVTB{<c>}{<q>}.F32.F16 <Sd>, <Sm> 


Half-precision to double-precision variant 
Applies when op == 0 && sz == 


VCVTB{<c>}{<q>}.F64.F16 <Dd>, <Sm> 


Single-precision to half-precision variant 
Applies when op == 1 && sz == 


VCVTB{<c>}{<q>}.F16.F32 <Sd>, <Sm> 


Double-precision to half-precision variant 
Applies when op == 1 && sz == 


VCVTB{<c>}{<q>}.F16.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


uses_double = (sz == '1'); convert_from_half = (op == '0'); 
lowbit = (if T == '1' then 16 else 0); 
if uses_double then 
if convert_from_half then 
d = UInt(D:Vd); m = UInt(Vm:M); 
else 
d = UInt(Vd:D); m = UInt(M:Vm); 
else 
d = UInt(Vd:D); m = UInt(Vm:M); 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
bits(16) hp; 
if convert_from_half then 
hp = S[m]<lowbit+15:lowbit>; 
if uses_double then 
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Co 
= 

oo 
oo 

iT} 


FPConvert(hp, FPSCR); 
else 
S[d] = FPConvert(hp, FPSCR); 
else 
if uses_double then 
hp = FPConvert(D[m], FPSCR); 
else 
hp = FPConvert(S[m], FPSCR); 
S[d]<lowbit+15:lowbit> = hp; 
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F6.1.67 


F6-4950 


VCVTM (Advanced SIMD) 


Vector Convert floating-point to integer with Round towards -Infinity converts each element in a vector from 
floating-point to integer using the Round towards -Infinity rounding mode, and places the results in a second vector. 


The operand vector elements are floating-point numbers. 


The result vector elements are 32-bit integers. Signed and unsigned integers are distinct. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 


Ti 770077 10] isej] va Jojo iporla]wfo[ vm _| 
RM 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCVIM{<q>}.<dt>.<dt2> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCVIM{<q>}.<dt>.<dt2> <Qd>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == '01' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == '1'); 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


7414174 ph sej] va Jojo oleo] vm 
RM 





64-bit SIMD vector variant 
Applies when Q == 0. 
VCVIM{<q>}.<dt>.<dt2> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 


VCVIM{<q>}.<dt>.<dt2> <Qd>, <Qm> 
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Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == '1'); 
case size of 
when 'Q@1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the destination, encoded in the "op" field. It can have the 
following values: 
S32 when op = 0 
U32 when op = 1 
<dt2> Is the data type for the elements of the source vector, encoded in the "size" field. It can have the 
following values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(esize) result; 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = FPToFixed(Elem[D[m+r],e,esize], @, unsigned, 
StandardFPSCRValue(), rounding); 
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F6.1.68 VCVTM (floating-point) 


Convert floating-point to integer with Round towards -Infinity converts a value in a register from floating-point to 
a 32-bit integer using the Round towards -Infinity rounding mode, and places the result in a second register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 121110 9 8|7 6 5 4|3 


o | 


iraran orphie va [1 oeoo vm _| 
RM 


size 


Half-precision scalar variant 
Applies when size == 01. 


VCVTIM{<q>}.<dt>.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVIM{<q>}.<dt>.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCVIM{<q>}.<dt>.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == 'Q'); 

d = UInt(Vd:D); 

case size of 


when 'Q@1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 1 0ļ15 12|1110 9 8|7 6 5 4|3 


o | 


11111110 1foji 1 1fliji 1| va [1 o|!00foj1jmjo] vm | 
RM 


size 


Half-precision scalar variant 
Applies when size == 01. 


VCVTM{<q>}.<dt>.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVTM{<q>}.<dt>.F32 <Sd>, <Sm> 
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Double-precision scalar variant 
Applies when size == 11. 


VCVTIM{<q>}.<dt>.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if size == 'Q0' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == 'Q'); 

d = UInt(Vd:D); 

case size of 


when 'Q1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 
<q> See Standard assembler syntax fields on page F2-3908. 


<dt> Is the data type for the elements of the destination, encoded in the "op" field. It can have the 
following values: 


U32 when op = 0 

S32 when op = 1 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = FPToFixed(S[m]<15:@>, @, unsigned, FPSCR, rounding); 
when 32 
S[d] = FPToFixed(S[m], 0, unsigned, FPSCR, rounding); 
when 64 
S[d] = FPToFixed(D[m], ©, unsigned, FPSCR, rounding); 
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F6.1.69 


F6-4954 


VCVTN (Advanced SIMD) 


Vector Convert floating-point to integer with Round to Nearest converts each element in a vector from floating-point 


to integer using the Round to Nearest rounding mode, and places the results in a second vector. 
The operand vector elements are floating-point numbers. 


The result vector elements are 32-bit integers. Signed and unsigned integers are distinct. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


Ti 770077 10] isej] va [o]o[o ifor[a]wfo[ vm | 
RM 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCVIN{<q>}.<dt>.<dt2> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCVIN{<q>}.<dt>.<dt2> <Qd>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == '01' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == '1'); 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


7414177 ph isej] va Jolojo rolom o] vm | 
RM 





64-bit SIMD vector variant 
Applies when Q == 0. 
VCVIN{<q>}.<dt>.<dt2> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 


VCVIN{<q>}.<dt>.<dt2> <Qd>, <Qm> 
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Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == '1'); 
case size of 
when 'Q@1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the destination, encoded in the "op" field. It can have the 
following values: 
S32 when op = 0 
U32 when op = 1 
<dt2> Is the data type for the elements of the source vector, encoded in the "size" field. It can have the 
following values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(esize) result; 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = FPToFixed(Elem[D[m+r],e,esize], @, unsigned, 
StandardFPSCRValue(), rounding); 
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F6.1.70 VCVTN (floating-point) 


Convert floating-point to integer with Round to Nearest converts a value in a register from floating-point to a 32-bit 


integer using the Round to Nearest rounding mode, and places the result in a second register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 


o | 


Tiiti170 to[17 tio 7] va [1 oeoo vm | 
RM 


size 


Half-precision scalar variant 
Applies when size == 01. 


VCVIN{<q>}.<dt>.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVIN{<q>}.<dt>.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCVIN{<q>}.<dt>.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == 'Q'); 

d = UInt(Vd:D); 

case size of 


when 'Q@1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 1 0|15 12|1110 9 8|7 6 5 4|3 


o | 


11111110 1fpji 1 tfifo sf va [1 o|!00foj1jmjo] vm | 
RM 


size 


Half-precision scalar variant 
Applies when size == 01. 


VCVTN{<q>}.<dt>.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVIN{<q>}.<dt>.F32 <Sd>, <Sm> 
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Double-precision scalar variant 
Applies when size == 11. 


VCVIN{<q>}.<dt>.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if size == 'Q0' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == 'Q'); 

d = UInt(Vd:D); 

case size of 


when 'Q1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 
<q> See Standard assembler syntax fields on page F2-3908. 


<dt> Is the data type for the elements of the destination, encoded in the "op" field. It can have the 
following values: 


U32 when op = 0 

S32 when op = 1 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = FPToFixed(S[m]<15:@>, @, unsigned, FPSCR, rounding); 
when 32 
S[d] = FPToFixed(S[m], 0, unsigned, FPSCR, rounding); 
when 64 
S[d] = FPToFixed(D[m], ©, unsigned, FPSCR, rounding); 
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F6.1.71 


F6-4958 


VCVTP (Advanced SIMD) 


Vector Convert floating-point to integer with Round towards +Infinity converts each element in a vector 


from 


floating-point to integer using the Round towards +Infinity rounding mode, and places the results in a second vector. 


The operand vector elements are floating-point numbers. 


The result vector elements are 32-bit integers. Signed and unsigned integers are distinct. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


Ti 770077 10] isej] va Jojo ofop[a]wfo[ vm | 
RM 


64-bit SIMD vector variant 
Applies when Q == 0. 


VCVTP{<q>}.<dt>.<dt2> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VCVTP{<q>}.<dt>.<dt2> <Qd>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == '01' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == '1'); 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


maaana ph jsej] va Jool ofle o] vm 
RM 





64-bit SIMD vector variant 
Applies when Q == 0. 
VCVTP{<q>}.<dt>.<dt2> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 


VCVTP{<q>}.<dt>.<dt2> <Qd>, <Qm> 
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Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == '1'); 
case size of 
when 'Q@1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the destination, encoded in the "op" field. It can have the 
following values: 
S32 when op = 0 
U32 when op = 1 
<dt2> Is the data type for the elements of the source vector, encoded in the "size" field. It can have the 
following values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(esize) result; 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = FPToFixed(Elem[D[m+r],e,esize], @, unsigned, 
StandardFPSCRValue(), rounding); 
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F6.1.72 VCVTP (floating-point) 


Convert floating-point to integer with Round towards +Infinity converts a value in a register from floating-point to 
a 32-bit integer using the Round towards +Infinity rounding mode, and places the result in a second register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 121110 9 8|7 6 5 4|3 


o | 


riran oaph ol va [1 oeo Mo] vm | 
RM 


size 


Half-precision scalar variant 
Applies when size == 01. 


VCVTP{<q>}.<dt>.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVTP{<q>}.<dt>.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VCVTP{<q>}.<dt>.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == '0'); 

d = UInt(Vd:D); 

case size of 


when '01' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 1 0|15 12|1110 9 8|7 6 5 4|3 


o | 


11111110 1foji 1 1fliji of va [1 o|!00foj1jmjo] vm | 
RM 


size 


Half-precision scalar variant 
Applies when size == 01. 


VCVTP{<q>}.<dt>.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VCVTP{<q>}.<dt>.F32 <Sd>, <Sm> 
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Double-precision scalar variant 
Applies when size == 11. 


VCVTP{<q>}.<dt>.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if size == 'Q0' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); unsigned = (op == 'Q'); 

d = UInt(Vd:D); 

case size of 


when 'Q1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 
<q> See Standard assembler syntax fields on page F2-3908. 


<dt> Is the data type for the elements of the destination, encoded in the "op" field. It can have the 
following values: 


U32 when op = 0 

S32 when op = 1 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = FPToFixed(S[m]<15:@>, @, unsigned, FPSCR, rounding); 
when 32 
S[d] = FPToFixed(S[m], 0, unsigned, FPSCR, rounding); 
when 64 
S[d] = FPToFixed(D[m], ©, unsigned, FPSCR, rounding); 
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F6.1.73 


F6-4962 


VCVTR 


Convert floating-point to integer converts a value in a register from floating-point to a 32-bit integer, using the 
rounding mode specified by the FPSCR and places the result in a second register. 


VCVT (between floating-point and fixed-point, floating-point) describes conversions between floating-point and 
16-bit integers. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 2120/1918 16/15 12/1110 9 8|7 6 5 4|3 0| 
Cem [nopho] va [1 ojs jomo] vm 


cond opc2 op 


Half-precision scalar variant 
Applies when opc2 == 100 && size == 01. 


VCVTR{<c>}{<q>}.U32.F16 <Sd>, <Sm> 


Half-precision scalar variant 
Applies when opc2 == 101 && size == 01. 


VCVTR{<c>}{<q>}.S32.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when opc2 == 100 && size == 10. 


VCVTR{<c>}{<q>}.U32.F32 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when opc2 == 101 && size == 10. 


VCVTR{<c>}{<q>}.S32.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when opc2 == 100 && size == 11. 


VCVTR{<c>}{<q>}.U32.F64 <Sd>, <Dm> 


Double-precision scalar variant 
Applies when opc2 == 101 && size == 11. 


VCVTR{<c>}{<q>}.S32.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


if opc2 != '000' && opc2 != '10x' then SEE "Related encodings"; 
if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
to_integer = (opc2<2> == '1'); 
if to_integer then 
unsigned = (opc2<@> == '0'); 
rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 
d = UInt(Vd:D); 
case size of 
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when '@1' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


else 

unsigned = (op == 'Q'); 

rounding = FPRoundingMode(FPSCR) ; 

m = UInt(Vm:M); 

case size of 
when '@1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
° The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
T1 
|15 14 13 1211110 9 8|7 6 5 4/3 2 of5 12/1110 9 8|7 6 5 4|3 0| 
1110111 ophi o va [1 ofso mo] v | 
opc2 op 


Half-precision scalar variant 
Applies when opc2 == 100 && size == 01. 


VCVTR{<c>}{<q>}.U32.F16 <Sd>, <Sm> 


Half-precision scalar variant 
Applies when opc2 == 101 && size == 01. 


VCVTR{<c>}{<q>}.S32.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when opc2 == 100 && size == 10. 
VCVTR{<c>}{<q>}.U32.F32 <Sd>, <Sm> 
Single-precision scalar variant 
Applies when opc2 == 101 && size == 10. 
VCVTR{<c>}{<q>}.S32.F32 <Sd>, <Sm> 
Double-precision scalar variant 
Applies when opc2 == 100 && size == 11. 
VCVTR{<c>}{<q>}.U32.F64 <Sd>, <Dm> 
Double-precision scalar variant 


Applies when opc2 == 101 && size == 11. 


VCVTR{<c>}{<q>}.S32.F64 <Sd>, <Dm> 
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Decode for all variants of this encoding 


if opc2 != '000' && opc2 != '10x' then SEE "Related encodings"; 
if size == 'Q0' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
to_integer = (opc2<2> == '1'); 
if to_integer then 
unsigned = (opc2<@> == 'Q'); 


rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 


d = UInt(Vd:D); 

case size of 
when '01' esize = 16; m = UInt(Vm:M); 
when '10' esize = 32; m = UInt(Vm:M); 
when '11' esize = 64; m = UInt(M:Vm); 


else 

unsigned = (op == '0'); 

rounding = FPRoundingMode(FPSCR) ; 

m = UInt(Vm:M); 

case size of 
when '@1' esize = 16; d = UInt(Vd:D); 
when '10' esize = 32; d = UInt(Vd:D); 
when '11' esize = 64; d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

a The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 

7 The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


Related encodings: See Floating-point data-processing on page F3-3958 for the T32 instruction set, or 


Floating-point data-processing on page F4-4039 for the A32 instruction set. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
if to_integer then 

case esize of 

when 16 

S[d] 

when 32 

S[d] 

when 64 

S[d] 


FPToFixed(S[m]<15:0>, ©, unsigned, FPSCR, rounding); 


FPToFixed(S[m], @, unsigned, FPSCR, rounding); 


FPToFixed(D[m], @, unsigned, FPSCR, rounding); 
else 
case esize of 
when 16 
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bits(16) fp16 = FixedToFP(S[m], @, unsigned, FPSCR, rounding); 
S[d] = Zeros(16):fp16; 


when 32 
S[d] = FixedToFP(S[m], @, unsigned, FPSCR, rounding); 
when 64 
D[d] = FixedToFP(S[m], 0, unsigned, FPSCR, rounding); 
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F6.1.74 VCVTT 


F6-4966 


Convert to or from a half-precision value in the top half of a single-precision register does one of the following: 


. Converts the half-precision value in the top half of a single-precision register to single-precision and writes 


the result to a single-precision register. 


s Converts the half-precision value in the top half of a single-precision register to double-precision and writes 


the result to a double-precision register. 


e Converts the single-precision value in a single-precision register to half-precision and writes the result into 
the top half of a single-precision register, preserving the other half of the destination register. 


° Converts the double-precision value in a double-precision register to half-precision and writes the result into 
the top half of a single-precision register, preserving the other half of the destination register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 


o | 


[m Ja 1 1 0 1jofi ajojo lo] va [1 of 1 [sz] 1] 


cond 


Half-precision to single-precision variant 
Applies when op == 0 && sz == 


VCVTT{<c>}{<q>}.F32.F16 <Sd>, <Sm> 


Half-precision to double-precision variant 
Applies when op == 0 && sz == 


VCVTT{<c>}{<q>}.F64.F16 <Dd>, <Sm> 


Single-precision to half-precision variant 
Applies when op == 1 && sz == 


VCVTT{<c>}{<q>}.F16.F32 <Sd>, <Sm> 


Double-precision to half-precision variant 
Applies when op == 1 && sz == 


VCVTT{<c>}{<q>}.F16.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


uses_double = (sz == '1'); convert_from_half = (op == 'Q'); 
lowbit = (if T == '1' then 16 else 0); 
if uses_double then 
if convert_from_half then 
d = UInt(D:Vd); m = UInt(Vm:M); 
else 
d = UInt(Vd:D); m = UInt(M:Vm); 
else 
d = UInt(Vd:D); m = UInt(Vm:M); 
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T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4|3 0 | 


11101110 1{d]1 1foļo tforf va [1 oftfsz{t]i{mfo] vm | 
T 


Half-precision to single-precision variant 
Applies when op == 0 && sz == 


VCVTT{<c>}{<q>}.F32.F16 <Sd>, <Sm> 


Half-precision to double-precision variant 
Applies when op == 0 && sz == 


VCVTT{<c>}{<q>}.F64.F16 <Dd>, <Sm> 


Single-precision to half-precision variant 
Applies when op == 1 && sz == 


VCVTT{<c>}{<q>}.F16.F32 <Sd>, <Sm> 


Double-precision to half-precision variant 
Applies when op == 1 && sz == 


VCVTT{<c>}{<q>}.F16.F64 <Sd>, <Dm> 


Decode for all variants of this encoding 


uses_double = (sz == '1'); convert_from_half = (op == '0'); 
lowbit = (if T == '1' then 16 else 0); 
if uses_double then 
if convert_from_half then 
d = UInt(D:Vd); m = UInt(Vm:M); 
else 
d = UInt(Vd:D); m = UInt(M:Vm); 
else 
d = UInt(Vd:D); m = UInt(Vm:M); 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
bits(16) hp; 
if convert_from_half then 
hp = S[m]<lowbit+15:lowbit>; 
if uses_double then 
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Co 
= 

[ea 
pmr 

iT} 


FPConvert(hp, FPSCR); 
else 


S[d] = FPConvert(hp, FPSCR); 
else 
if uses_double then 
hp = FPConvert(D[m], FPSCR); 
else 
hp = FPConvert(S[m], FPSCR); 
S[d]<lowbit+15:lowbit> = hp; 
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Divide divides one floating-point value by another floating-point value and writes the result to a third floating-point 


register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11109 8|7 6 5 4/3 0 | 
Derm [i771 o[tppjo of va | va [i ose [Njom o] vm 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VDIV{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VDIV{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VDIV{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

case size of 
when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


Ti 70717 0/1oJ0 0] vn | va [i 0[sze[N[o[w[o] vm 


Half-precision scalar variant 


Applies when size == 01. 
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VDIV{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VDIV{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VDIV{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 


Decode for all variants of this encoding 


if size == '01' && InITBlock() then UNPREDICTABLE; 

if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

s The instruction is UNDEFINED. 

. The instruction executes as if it passes the Condition code check. 

7 The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = Zeros(16) : FPDiv(S[n]<15:@>, S[m]<15:0>, FPSCR); 
when 32 
S[d] = FPDiv(S[n], S[m], FPSCR); 
when 64 
D[d] = FPDiv(D[n], D[m], FPSCR); 
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VDUP (general-purpose register) 


ARM DDI 0487E.a 


Duplicate general-purpose register to vector duplicates an element from a general-purpose register into every 
element of the destination vector. 


The destination vector elements can be 8-bit, 16-bit, or 32-bit fields. The source element is the least significant 8, 
16, or 32 bits of the general-purpose register. There is no distinction between data types. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


[m11 J1 1 1 oftfefajof va | rt fi 0 1 1 {DOJ E] 1 (Oooo) 


cond 


A1 variant 


VDUP{<c>}{<q>}.<size> <Qd>, <Rt> // Encoded as 


si 
VDUP{<c>}{<q>}.<size> <Dd>, <Rt> // Encoded as Q = 0 


OO 


Decode for this encoding 


if Q == '1' && Vd<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); t = UInt(Rt); regs = if Q == '0' then 1 else 2; 
case B:E of 
when '00' esize = 32; elements = 2; 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 8; elements = 8; 
when '11' UNDEFINED; 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


11101110] ve | Rt p orpo 


T1 variant 


VDUP{<c>}{<q>}.<size> <Qd>, <Rt> // Encoded as 


si 
VDUP{<c>}{<q>}.<size> <Dd>, <Rt> // Encoded as Q = 0 


OO 


Decode for this encoding 


if Q == '1' && Vd<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); t = UInt(Rt); regs = if Q == '0' then 1 else 2; 
case B:E of 
when '00' esize = 32; elements = 2; 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 8; elements = 8; 
when '11' UNDEFINED; 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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F6-4972 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. Arm strongly recommends that any VDUP 
instruction is unconditional, see Conditional execution on page F2-3909. 
<q> See Standard assembler syntax fields on page F2-3908. 
<size> The data size for the elements of the destination vector. It must be one of: 
8 Encoded as [b, e] = 0b10. 
16 Encoded as [b, e] = 0b01. 
32 Encoded as [b, e] = 0b00. 
<Qd> The destination vector for a quadword operation. 
<Dd> The destination vector for a doubleword operation. 
<Rt> The Arm source register. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
scalar = R[t]<esize-1:0>; 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = scalar; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.77 VDUP (scalar) 


ARM DDI 0487E.a 
ID070919 


Duplicate vector element to vector duplicates a single element of a vector into every element of the destination 
vector. 


The scalar, and the destination vector elements, can be any one of 8-bit, 16-bit, or 32-bit fields. There is no 
distinction between data types. 


For more information about scalars see Advanced SIMD scalars on page F2-3934. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


11110011 1{d]1 1| imma | va [1 1/0 o ofalmjo] vm | 


Encoding 
Applies when Q == 0. 


VDUP{<c>}{<q>}.<size> <Dd>, <Dm[x]> 


Encoding 
Applies when Q == 1. 


VDUP{<c>}{<q>}.<size> <Qd>, <Dm[x]> 


Decode for all variants of this encoding 


if imm4 == 'x000' then UNDEFINED; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 
case imm4 of 
when 'xxxl' esize = 8; elements = 8; 
when 'xx10' esize = 16; elements = 4 
when 'x10@' esize = 32; elements = 2 
d = UInt(D:Vd); m = UInt(M:Vm); regs = i 


index = UInt(imm4<3:1>); 
; index = UInt(imm4<3:2>); 
; index = UInt(imm4<3>); 
f Q == 'Q' then 1 else 2; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


11ain | mm | va joo oomo] vm | 


Encoding 

Applies when Q == 0. 
VDUP{<c>}{<q>}.<size> <Dd>, <Dm[x]> 
Encoding 

Applies when Q == 1. 


VDUP{<c>}{<q>}.<size> <Qd>, <Dm[x]> 
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Decode for all variants of this encoding 


if imm4 == 'x000' then UNDEFINED; 

if Q == '1' && Vd<@> == '1' then UNDEFINED; 

case imm4 of 
when 'xxx1' esize = 8; elements = 8; index = UInt(imm4<3:1>); 
when 'xx1@' esize = 16; elements = 4; index = UInt(imm4<3:2>); 
when 'x100' esize = 32; elements = 2; index = UInt(imm4<3>); 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> The data size. It must be one of: 
8 Encoded as imm4<0> = '1'. imm4<3:1> encodes the index[x] of the scalar. 
16 Encoded as imm4<1:0> ='10'. imm4<3:2> encodes the index [x] of the scalar. 
32 Encoded as imm4<2:0> ='100'. imm4<3> encodes the index [x] of the scalar. 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm[x]> The scalar. For details of how [x] is encoded, see the description of <size>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
scalar = Elem[D[m] ,index,esize]; 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = scalar; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.78 VEOR 


ARM DDI 0487E.a 
ID070919 


Vector Bitwise Exclusive OR performs a bitwise Exclusive OR operation between two registers, and places the 
result in the destination register. The operand and result registers can be quadword or doubleword. They must all be 
the same size. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


777100 7[ifoppjo o] vw | va jooon vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VEOR{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VEOR{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


1 ajili 1 1 1 ofpjo of vn | va jooo 1jnjajlmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VEOR{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VEOR{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<0> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 


d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
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F6-4976 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> An optional data type. It is ignored by assemblers, and does not affect the encoding. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N: Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
D[d+r] = D[n+r] EOR D[m+r]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.79 VEXT (byte elements) 


ARM DDI 0487E.a 
ID070919 


Vector Extract extracts elements from the bottom end of the second operand vector and the top end of the first, 
concatenates them and places the result in the destination vector. 


The elements of the vectors are treated as being 8-bit fields. There is no distinction between data types. 


The following figure shows the operation of VEXT doubleword operation for imm = 3. 
76543210 76543210 
Vm Vn 


Vd 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instruction VEXT (multibyte elements). The pseudo-instruction is never the 
preferred disassembly. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 


11110010 1{0]1 4f vn | va | imm j|njajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VEXT{<c>}{<q>}.8 {<Dd>,} <Dn>, <Dm>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VEXT{<c>}{<q>}.8 {<Qd>,} <Qn>, <Qm>, #<imm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if Q == 'O' && imm4<3> == '1' then UNDEFINED; 

quadword_operation = (Q == '1'); position = 8 » UInt(imm4); 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11 8/7 6 5 4|3 0 | 


tron t ina ajoji at vn | va | imma [njajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VEXT{<c>}{<q>}.8 {<Dd>,} <Dn>, <Dm>, #<imm> 
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F6-4978 


128-bit SIMD vector variant 
Applies when Q == 1. 


VEXT{<c>}{<q>}.8 {<Qd>,} <Qn>, <Qm>, #<imm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if Q == 'O' && imm4<3> == '1' then UNDEFINED; 

quadword_operation = (Q == '1'); position = 8 » UInt(imm4); 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 

<imm> For the 64-bit SIMD vector variant: is the location of the extracted result in the concatenation of the 
operands, as a number of bytes from the least significant end, in the range 0 to 7, encoded in the 
"imm4" field. 


For the 128-bit SIMD vector variant: is the location of the extracted result in the concatenation of 
the operands, as a number of bytes from the least significant end, in the range 0 to 15, encoded in 
the "imm4" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
if quadword_operation then 
Q[{d>>1] = (Q[m>>1]:Q[n>>1] )<position+127:position>; 
else 
D[d] = (D[m]:D[n])<position+63:position>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.80 VEXT (multibyte elements) 


ARM DDI 0487E.a 
ID070919 


Vector Extract extracts elements from the bottom end of the second operand vector and the top end of the first, 
concatenates them and places the result in the destination vector 


This instruction is a pseudo-instruction of the VEXT (byte elements) instruction. This means that: 


$ The encodings in this description are named to match the encodings of VEXT (byte elements). 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
. The description of VEXT (byte elements) gives the operational pseudocode for this instruction. 
A1 
[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12|11 8|7 6 5 4|3 0 | 


Toit 0070717] ve | va | ma Njoo] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 

VEXT{<c>}{<q>}.<size> {<Dd>,} <Dn>, <Dm>, #<imm> 

is equivalent to 

VEXT{<c>}{<q>}.8 {<Dd>,} <Dn>, <Dm>, #<imms(size/8)> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 

VEXT{<c>}{<q>}.<size> {<Qd>,} <Qn>, <Qm>, #<imm> 

is equivalent to 

VEXT{<c>}{<q>}.8 {<Qd>,} <Qn>, <Qm>, #<imms«(size/8)> 


and is never the preferred disassembly. 
T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11 8|7 6 5 4|3 0 | 


1170747174 1J0]1 1] vn | va | imm j|njajmjo] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 

VEXT{<c>}{<q>}.<size> {<Dd>,} <Dn>, <Dm>, #<imm> 

is equivalent to 

VEXT{<c>}{<q>}.8 {<Dd>,} <Dn>, <Dm>, #<imms«(size/8)> 


and is never the preferred disassembly. 
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F6-4980 


128-bit SIMD vector variant 


Applies when Q == 1. 


VEXT{<c>}{<q>}.<size> {<Qd>,} <Qn>, <Qm>, #<imm> 


is equivalent to 


VEXT{<c>}{<q>}.8 {<Qd>,} <Qn>, <Qm>, #<imms(size/8)> 


and is never the preferred disassembly. 


Assembler symbols 


<C> 


<q> 


<size> 


<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 
<Dm> 


<imm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For the 64-bit SIMD vector variant: is the size of the operation, and can be one of 16 or 32. 


For the 128-bit SIMD vector variant: is the size of the operation, and can be one of 16, 32 or 64. 
Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


For the 64-bit SIMD vector variant: is the location of the extracted result in the concatenation of the 
operands, as a number of bytes from the least significant end, in the range 0 to (128/<size>)-1. 


For the 128-bit SIMD vector variant: is the location of the extracted result in the concatenation of 
the operands, as a number of bytes from the least significant end, in the range 0 to (64/<size>)-1. 


Operation for all encodings 


The description of VEXT (byte elements) gives the operational pseudocode for this instruction. 
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F6.1.81 VFMA 


ARM DDI 0487E.a 
ID070919 


Vector Fused Multiply Accumulate multiplies corresponding elements of two vectors, and accumulates the results 
into the elements of the destination vector. The instruction does not round the result of the multiply before the 
accumulation. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


T1770 0 1Jo[opplofse| va | va [ioone vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VFMA{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VFMA{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
advsimd = TRUE; opl_neg = (op == '1'); 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 
regs = if Q == 'Q' then 1 else 2; 


2; 
4; 
UInt(M:Vm) ; 


A2 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Perm [177 o of] va | va [i 0[swe[N]o[mjo] vm 


cond op 


Half-precision scalar variant 
Applies when size == 01. 


VFMA{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VFMA{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VFMA{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 
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Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 

if size == 'QQ' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

advsimd = FALSE; opl_neg = (op == '1'); 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aaao oplo v | va_[1 10 onome v | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VFMA{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VFMA{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 

if sz == '1' && InITBlock() then UNPREDICTABLE; 

advsimd = TRUE; opl_neg = (op == '1'); 

case sz of 


when 'Q' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


Ifsz == '1' && InITBlock(), then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
$ The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 


Ti 70717 0/1o[1 0] vn | va |? 0[sze[N[o[w[o] vm _| 
op 


Half-precision scalar variant 


Applies when size == 01. 


VFMA{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 


Applies when size == 10. 


VFMA{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 


Applies when size == 11. 


VFMA{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != 'Q00' || FPSCR.Stride != '00' then UNDEFINED; 


if size 
if size 


== 'Q0' || (size == 'Q1' && !HaveFP16Ext()) then UNDEFINED; 
== '01' && InITBlock() then UNPREDICTABLE; 


advsimd = FALSE; opl_neg = (op == '1'); 
case size of 


when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


64; d 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


The instruction is UNDEFINED. 
The instruction executes as if it passes the Condition code check. 


The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 


<Qn> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding A2, T1 and T2: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 


values: 
F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
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<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N: Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = 0 to regs-1 
for e = 0 to elements-1 
bits(esize) opl = Elem[D[n+r],e,esize]; 
if opl_neg then op1 = FPNeg(op1); 
Elem[D[d+r],e,esize] = FPMulAdd(Elem[D[d+r],e,esize], 
op1, Elem[D[m+r],e,esize], StandardFPSCRValue()); 


else // VFP instruction 
case esize of 

when 16 
op16 = if opl_neg then FPNeg(S[n]<15:0>) else S[n]<15:0>; 
S[d] = Zeros(16) : FPMulAdd(S[d]<15:0>, 0p16, S[m]<15:@>, FPSCR) 

when 32 
op32 = if opl_neg then FPNeg(S[n]) else S[n]; 
S[d] = FPMulAdd(S[d], op32, S[m], FPSCR); 

when 64 
op64 = if opl_neg then FPNeg(D[n]) else D[n]; 
D[d] = FPMulAdd(D[d], op64, D[m], FPSCR); 
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F6.1.82  VFMAL (vector) 


Vector Floating-point Multiply-Add Long to accumulator (vector). This instruction multiplies corresponding values 
in the vectors in the two source SIMD&FP registers, and accumulates the product to the corresponding vector 
element of the destination SIMD&FP register. The instruction does not round the result of the multiply before the 
accumulation. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 





Note 
ID_ISAR6.FHM indicates whether this instruction is supported. 





A1 
ARMv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


714147 oooh of va | va Mooon vm 
S 


64-bit SIMD vector variant 
Applies when Q == 0. 


VFMAL{<q>}.F16 <Dd>, <Sn>, <Sm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VFMAL{<q>}.F16 <Qd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


integer d = UInt(D:Vd); 

integer n = if Q == '1' then UInt(N:Vn) else UInt(Vn:N); 
integer m = if Q == '1' then UInt(M:Vm) else UInt(Vm:M); 
integer esize = 32; 

integer regs = if Q=='1' then 2 else 1; 

integer datasize = if Q=='1' then 64 else 32; 

boolean sub_op = S=='1'; 


T1 
ARMv8.2 
|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 6 5 4|3 0| 
1111110 x] va | va | *)o]ojo[Nja[myi[ m 
S op2 
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64-bit SIMD vector variant 


Applies when op2 == 10 && Q == 0. 


VFMAL{<q>}.F16 


128-bit SIMD 


<Dd>, <Sn>, <Sm> 


vector variant 


Applies when op2 == 11 && Q == 1. 


VFMAL{<q>}.F16 


Decode for a 


if InITBlock( 
if !HaveFP16M 


<Qd>, <Dn>, <Dm> 


ll variants of this encoding 


) then UNPREDICTABLE; 
ulNoRoundingToFP32Ext() then UNDEFINED; 


if Q == '1' && Vd<ð> == '1' then UNDEFINED; 


integer d = U 
integer n = i 
integer m = i 
integer esize 
integer regs 
integer datas 
boolean sub_o 

Assembler 
<q> 

<Qd> 

<Dn> 

<Dm> 

<Dd> 


<Sn> 


<Sm> 


Int(D:Vd); 

f Q == '1' then UInt(N:Vn) else UInt(Vn:N); 
f Q == '1' then UInt(M:Vm) else UInt(Vm:M); 
= 32; 

= if Q=='1' then 2 else 1; 

ize = if Q=='1' then 64 else 32; 

p= S=='1'; 


symbols 


See Standard assembler syntax fields on page F2-3908. 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 


Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


CheckAdvSIMDEnabled(); 


bits(datasize 
bits(datasize 
bits(64) oper 
bits(64) resu 
bits(esize DI 
bits(esize DI 


if Q=='0' the 
operand1 
operand2 
else 
operand1 
operand2 
for r = Q to 
operand3 


) operand ; 

) operand2 ; 
and3; 

Tt; 

V 2) element1; 
V 2) element2; 


n 
= S[n]<datasize-1:0>; 
= S[m]<datasize-1:0>; 


= D[n]<datasize-1:0>; 
= D[m]<datasize-1:0>; 
regs-1 

= D[d+r]; 


fore=Qtol 
element1 = Elem[operand1, 2«rt+e, esize DIV 2]; 
element2 = Elem[operand2, 2«rt+e, esize DIV 2]; 
if sub_op then element1 = FPNeg(element1) ; 
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Elem[result, e, esize] = FPMulAddH(Elem[operand3, e, esize], elementl, element2, 
StandardFPSCRValue()); 
D[d+r] = result; 
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F6.1.83 VFMAL (by scalar) 


Vector Floating-point Multiply-Add Long to accumulator (by scalar). This instruction multiplies the vector 
elements in the first source SIMD&FP register by the specified value in the second source SIMD&FP register, and 
accumulates the product to the corresponding vector element of the destination SIMD&FP register. The instruction 
does not round the result of the multiply before the accumulation. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 





Note 
ID_ISAR6.FHM indicates whether this instruction is supported. 





A1 


ARMv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


111111 1 ofojofojof vn | va [ifjofojojNnjajmji] vm | 
S 


64-bit SIMD vector variant 

Applies when Q == 0. 

VFMAL{<q>}.F16 <Dd>, <Sn>, <Sm>[<index>] 
128-bit SIMD vector variant 

Applies when Q == 1. 

VFMAL{<q>}.F16 <Qd>, <Dn>, <Dm>[<index>] 


Decode for all variants of this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


integer d = UInt(D:Vd); 
integer n = if Q == '1' then UInt(N:Vn) else UInt(Vn:N); 
integer m = if Q == '1' then UInt(Vm<2:0>) else UInt(Vm<2:0>:M); 


integer index = if Q == '1' then UInt(M:Vm<3>) else UInt(Vm<3>); 
integer esize = 32; 

integer regs = if Q=='1' then 2 else 1; 

integer datasize = if Q=='1' then 64 else 32; 

boolean sub_op = S=='1'; 


T1 
ARMv8.2 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


[1114141 ofojofojof vn | va [ilolojojlnjajmji] vm | 
S 


F6-4988 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


64-bit SIMD vector variant 
Applies when Q == 0. 


VFMAL{<q>}.F16 <Dd>, <Sn>, <Sm>[<index>] 


128-bit SIMD vector variant 
Applies when Q == 1. 


VFMAL{<q>}.F16 <Qd>, <Dn>, <Dm>[<index>] 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


integer d = UInt(D:Vd); 
integer n = if Q == '1' then UInt(N:Vn) else UInt(Vn:N); 
integer m = if Q == '1' then UInt(Vm<2:0>) else UInt(Vm<2:0>:M); 


integer index = if Q == '1' then UInt(M:Vm<3>) else UInt(Vm<3>); 
integer esize = 32; 

integer regs = if Q=='1' then 2 else 1; 

integer datasize = if Q=='1' then 64 else 32; 

boolean sub_op = S=='1'; 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Vm<2:0>" field. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm<2:0>:M" field. 

<index> For the 64-bit SIMD vector variant: is the element index in the range 0 to 1, encoded in the "Vm<3>" 
field. 


For the 128-bit SIMD vector variant: is the element index in the range 0 to 3, encoded in the 
"M:Vm<3>" field. 


Operation for all encodings 


CheckAdvSIMDEnabled(); 
bits(datasize) operand1 ; 
bits(datasize) operand2 ; 
bits(64) operand3; 

bits(64) result; 
bits(esize DIV 2) element1; 
bits(esize DIV 2) element2; 


if Q=='0' then 
operand1 = S[n]<datasize-1:0>; 
operand2 = S[m]<datasize-1:0>; 
else 
operand1 = D[n]<datasize-1:0>; 
operand2 = D[m]<datasize-1:0>; 
element2 = Elem[operand2, index, esize DIV 2]; 
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for r = 0 to regs-1 
operand3 = D[d+r]; 
fore=Qtol 
element1 = Elem[operand1, 2«rt+e, esize DIV 2]; 
if sub_op then element1 = FPNeg(element1) ; 
Elem[result, e, esize] = FPMulAddH(Elem[operand3, e, esize], elementl, element2, 
StandardFPSCRValue()); 
D[d+r] = result; 
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F6.1.84 VFMS 


ARM DDI 0487E.a 
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Vector Fused Multiply Subtract negates the elements of one vector and multiplies them with the corresponding 
elements of another vector, adds the products to the corresponding elements of the destination vector, and places the 
results in the destination vector. The instruction does not round the result of the multiply before the addition. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


T1770 0 1Jofopo[tfe| va | va oono vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VFMS{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VFMS{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
advsimd = TRUE; opl_neg = (op == '1'); 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 
regs = if Q == 'Q' then 1 else 2; 


2; 
4; 
UInt(M:Vm) ; 


A2 


31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Perm [1717 o of] va | va [i ojs NMO] v 
op 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VFMS{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VFMS{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VFMS{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 
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Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 

if size == 'QQ' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

advsimd = FALSE; opl_neg = (op == '1'); 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aaao ophi v | va a oono vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VFMS{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VFMS{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 

if sz == '1' && InITBlock() then UNPREDICTABLE; 

advsimd = TRUE; opl_neg = (op == '1'); 

case sz of 


when 'Q' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


Ifsz == '1' && InITBlock(), then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
$ The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 


Ti 70717 0/o]1 0] ve | va [i 0[sze|N[i[w[o] vm _| 
op 


Half-precision scalar variant 


Applies when size == 01. 


VEMS{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 


Applies when size == 10. 


VFMS{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 


Applies when size == 11. 


VFMS{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != 'Q00' || FPSCR.Stride != '00' then UNDEFINED; 


if size 
if size 


== 'Q0' || (size == 'Q1' && !HaveFP16Ext()) then UNDEFINED; 
== '01' && InITBlock() then UNPREDICTABLE; 


advsimd = FALSE; opl_neg = (op == '1'); 
case size of 


when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


64; d 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


The instruction is UNDEFINED. 
The instruction executes as if it passes the Condition code check. 


The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 


<Qn> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding A2, T1 and T2: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 


values: 
F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
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<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N: Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = 0 to regs-1 
for e = 0 to elements-1 
bits(esize) opl = Elem[D[n+r],e,esize]; 
if opl_neg then op1 = FPNeg(op1); 
Elem[D[d+r],e,esize] = FPMulAdd(Elem[D[d+r],e,esize], 
op1, Elem[D[m+r],e,esize], StandardFPSCRValue()); 


else // VFP instruction 
case esize of 

when 16 
op16 = if opl_neg then FPNeg(S[n]<15:0>) else S[n]<15:0>; 
S[d] = Zeros(16) : FPMulAdd(S[d]<15:0>, 0p16, S[m]<15:@>, FPSCR) 

when 32 
op32 = if opl_neg then FPNeg(S[n]) else S[n]; 
S[d] = FPMulAdd(S[d], op32, S[m], FPSCR); 

when 64 
op64 = if opl_neg then FPNeg(D[n]) else D[n]; 
D[d] = FPMulAdd(D[d], op64, D[m], FPSCR); 
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F6.1.85 VFMSL (vector) 
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Vector Floating-point Multiply-Subtract Long from accumulator (vector). This instruction negates the values in the 
vector of one SIMD&FP register, multiplies these with the corresponding values in another vector, and accumulates 
the product to the corresponding vector element of the destination SIMD&FP register. The instruction does not 


round the result of the multiply before the accumulation. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 


to support it. 





Note 
ID_ISAR6.FHM indicates whether this instruction is supported. 





A1 
ARMv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


manao o] va | va Mooon m 
S 


64-bit SIMD vector variant 
Applies when Q == 0. 


VFMSL{<q>}.F16 <Dd>, <Sn>, <Sm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VFMSL{<q>}.F16 <Qd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


integer d = UInt(D:Vd); 

integer n = if Q == '1' then UInt(N:Vn) else UInt(Vn:N); 
integer m = if Q == '1' then UInt(M:Vm) else UInt(Vm:M); 
integer esize = 32; 

integer regs = if Q=='1' then 2 else 1; 

integer datasize = if Q=='1' then 64 else 32; 

boolean sub_op = S=='1'; 


T1 
ARMv8.2 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 
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64-bit SIMD vector variant 
Applies when Q == 0. 


VFMSL{<q>}.F16 <Dd>, <Sn>, <Sm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VFMSL{<q>}.F16 <Qd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if !HaveFP16Mu1NoRoundingToFP32Ext() then UNDEFINED; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


integer d = UInt(D:Vd); 

integer n = if Q == '1' then UInt(N:Vn) else UInt(Vn:N); 
integer m = if Q == '1' then UInt(M:Vm) else UInt(Vm:M) ; 
integer esize = 32; 

integer regs = if Q=='1' then 2 else 1; 

integer datasize = if Q=='1' then 64 else 32; 

boolean sub_op = S=='1'; 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


CheckAdvSIMDEnabled(); 
bits(datasize) operand1 ; 
bits(datasize) operand2 ; 
bits(64) operand3; 

bits(64) result; 
bits(esize DIV 2) element1; 
bits(esize DIV 2) element2; 


if Q=='0' then 
operand1 = S[n]<datasize-1:0>; 
operand2 = S[m]<datasize-1:0>; 
else 
operand1 = D[n]<datasize-1:0>; 
operand2 = D[m]<datasize-1:0>; 
for r = 0 to regs-1 
operand3 = D[d+r]; 
fore=Qtol 
element1 = Elem[operand1, 2«rt+e, esize DIV 2]; 
element2 = Elem[operand2, 2«rt+e, esize DIV 2]; 
if sub_op then element1 = FPNeg(element1) ; 
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Elem[result, e, esize] = FPMulAddH(Elem[operand3, e, esize], elementl, element2, 
StandardFPSCRValue()); 
D[d+r] = result; 
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F6.1.86  VFMSL (by scalar) 


Vector Floating-point Multiply-Subtract Long from accumulator (by scalar). This instruction multiplies the negated 
vector elements in the first source SIMD&FP register by the specified value in the second source SIMD&FP 
register, and accumulates the product to the corresponding vector element of the destination SIMD&FP register. The 
instruction does not round the result of the multiply before the accumulation. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 





Note 
ID_ISAR6.FHM indicates whether this instruction is supported. 





A1 


ARMv8.2 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 
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64-bit SIMD vector variant 

Applies when Q == 0. 

VFMSL{<q>}.F16 <Dd>, <Sn>, <Sm>[<index>] 
128-bit SIMD vector variant 

Applies when Q == 1. 

VFMSL{<q>}.F16 <Qd>, <Dn>, <Dm>[<index>] 


Decode for all variants of this encoding 


if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


integer d = UInt(D:Vd); 
integer n = if Q == '1' then UInt(N:Vn) else UInt(Vn:N); 
integer m = if Q == '1' then UInt(Vm<2:0>) else UInt(Vm<2:0>:M); 


integer index = if Q == '1' then UInt(M:Vm<3>) else UInt(Vm<3>); 
integer esize = 32; 

integer regs = if Q=='1' then 2 else 1; 

integer datasize = if Q=='1' then 64 else 32; 

boolean sub_op = S=='1'; 


T1 
ARMv8.2 
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64-bit SIMD vector variant 
Applies when Q == 0. 


VFMSL{<q>}.F16 <Dd>, <Sn>, <Sm>[<index>] 


128-bit SIMD vector variant 
Applies when Q == 1. 


VFMSL{<q>}.F16 <Qd>, <Dn>, <Dm>[<index>] 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if !HaveFP16MulNoRoundingToFP32Ext() then UNDEFINED; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


integer d = UInt(D:Vd); 
integer n = if Q == '1' then UInt(N:Vn) else UInt(Vn:N); 
integer m = if Q == '1' then UInt(Vm<2:0>) else UInt(Vm<2:0>:M); 


integer index = if Q == '1' then UInt(M:Vm<3>) else UInt(Vm<3>); 
integer esize = 32; 

integer regs = if Q=='1' then 2 else 1; 

integer datasize = if Q=='1' then 64 else 32; 

boolean sub_op = S=='1'; 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Vm<2:0>" field. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm<2:0>:M" field. 

<index> For the 64-bit SIMD vector variant: is the element index in the range 0 to 1, encoded in the "Vm<3>" 
field. 


For the 128-bit SIMD vector variant: is the element index in the range 0 to 3, encoded in the 
"M:Vm<3>" field. 


Operation for all encodings 


CheckAdvSIMDEnabled(); 
bits(datasize) operand1 ; 
bits(datasize) operand2 ; 
bits(64) operand3; 

bits(64) result; 
bits(esize DIV 2) element1; 
bits(esize DIV 2) element2; 


if Q=='0' then 
operand1 = S[n]<datasize-1:0>; 
operand2 = S[m]<datasize-1:0>; 
else 
operand1 = D[n]<datasize-1:0>; 
operand2 = D[m]<datasize-1:0>; 
element2 = Elem[operand2, index, esize DIV 2]; 
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for r = 0 to regs-1 
operand3 = D[d+r]; 
fore=Qtol 
element1 = Elem[operand1, 2«rt+e, esize DIV 2]; 
if sub_op then element1 = FPNeg(element1) ; 
Elem[result, e, esize] = FPMulAddH(Elem[operand3, e, esize], elementl, element2, 
StandardFPSCRValue()); 
D[d+r] = result; 
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F6.1.87 VFNMA 


Vector Fused Negate Multiply Accumulate negates one floating-point register value and multiplies it by another 
floating-point register value, adds the negation of the floating-point value in the destination register to the product, 
and writes the result back to the destination register. The instruction does not round the result of the multiply before 
the addition. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 
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cond 


Half-precision scalar variant 
Applies when size == 01. 


VFNMA{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VFNMA{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VFNMA{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

opl_neg = (op == '1'); 

case size of 
when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 

$ The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4/3 0 | 
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Half-precision scalar variant 
Applies when size == 01. 


VFNMA{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VFNMA{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VFENMA{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == 'Q1' && InITBlock() then UNPREDICTABLE; 

opl_neg = (op == '1'); 

case size of 
when 'Q1' esize 
when '10' esize 
when '11' esize 


16; d 
32; d 
64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

s The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 

<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 
when 16 
op16 = if opl_neg then FPNeg(S[n]<15:0>) else S[n]<15:0>; 
S[d] = Zeros(16) : FPMulAdd(FPNeg(S[d]<15:@>), op16, S[m]<15:0>, FPSCR); 
when 32 
op32 = if opl_neg then FPNeg(S[n]) else S[n]; 
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S[d] 
when 64 

op64 = if opl_neg then FPNeg(D[n]) else D[n]; 

D[d] = FPMulAdd(FPNeg(D[d]), o0p64, D[m], FPSCR); 


FPMulAdd(FPNeg(S[d]), op32, S[m], FPSCR); 
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F6.1.88 


F6-5004 


VFNMS 


Vector Fused Negate Multiply Subtract multiplies together two floating-point register values, adds the negation of 
the floating-point value in the destination register to the product, and writes the result back to the destination 
register. The instruction does not round the result of the multiply before the addition. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
31 28|27 26 25 24|23 22 21 20|19 16/15 12\11109 8|7 6 5 4/3 0 | 
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cond op 


Half-precision scalar variant 
Applies when size == 01. 


VFNMS{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VFNMS{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VFNMS{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == 'Q0' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

opl_neg = (op == '1'); 

case size of 
when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 
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Half-precision scalar variant 
Applies when size == 01. 


VFNMS{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VENMS{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VFNMS{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == 'Q1' && InITBlock() then UNPREDICTABLE; 

opl_neg = (op == '1'); 

case size of 
when 'Q1' esize 
when '10' esize 
when '11' esize 


16; d 
32; d 
64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

s The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 

<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 


<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 


<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 
when 16 
op16 = if opl_neg then FPNeg(S[n]<15:0>) else S[n]<15:0>; 
S[d] = Zeros(16) : FPMulAdd(FPNeg(S[d]<15:@>), op16, S[m]<15:0>, FPSCR); 
when 32 
op32 = if opl_neg then FPNeg(S[n]) else S[n]; 
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S[d] 
when 64 

op64 = if opl_neg then FPNeg(D[n]) else D[n]; 

D[d] = FPMulAdd(FPNeg(D[d]), o0p64, D[m], FPSCR); 


FPMulAdd(FPNeg(S[d]), op32, S[m], FPSCR); 
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F6.1.89 VHADD 


Vector Halving Add adds corresponding elements in two vectors of integers, shifts each result right one bit, and 
places the final results in the destination vector. The results of the halving operations are truncated. For rounded 
results, see VRHADD). 


The operand and result elements are all the same type, and can be any one of: 
s 8-bit, 16-bit, or 32-bit signed integers. 
d 8-bit, 16-bit, or 32-bit unsigned integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 
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64-bit SIMD vector variant 
Applies when Q == 0. 


VHADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VHADD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

add = (op == '@'); unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 
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64-bit SIMD vector variant 

Applies when Q == 0. 
VHADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VHADD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
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F6-5008 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

add = (op == '0'); unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 


S8 when U = 0, size = 00 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = 0 to elements-1 
opl = Int(Elem[D[n+r],e,esize], unsigned); 
op2 = Int(Elem[D[m+r],e,esize], unsigned); 


result = if add then opl+op2 else opl-op2; 
Elem[D[d+r],e,esize] = result<esize:1>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-5009 
ID070919 Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.90 VHSUB 


F6-5010 


Vector Halving Subtract subtracts the elements of the second operand from the corresponding elements of the first 
operand, shifts each result right one bit, and places the final results in the destination vector. The results of the 
halving operations are truncated. There is no rounding version. 


The operand and result elements are all the same type, and can be any one of: 
s 8-bit, 16-bit, or 32-bit signed integers. 
d 8-bit, 16-bit, or 32-bit unsigned integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


11 1100 1]uUJojp]size] vn | va [o ojijolnjajmjo] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VHSUB{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VHSUB{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

add = (op == '@'); unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12\11109 8|7 6 5 4/3 0 | 


[1 1 tfuj1 1 1 1 ojdfsize] vn | va [o ofjijojnjajmjo] vm | 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VHSUB{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VHSUB{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

add = (op == '0'); unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = 0 to elements-1 

opl = Int(Elem[D[n+r],e,esize], unsigned); 
op2 = Int(Elem[D[m+r],e,esize], unsigned); 
result = if add then opl+op2 else opl-op2; 
Elem[D[d+r],e,esize] = result<esize:1>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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Vector move Insertion. This instruction copies the lower 16 bits of the 32-bit source SIMD&FP register into the 
upper 16 bits of the 32-bit destination SIMD&FP register, while preserving the values in the remaining bits. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 

A1 


ARMv8.2 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


Tiititiop 10000) va [ofr onimo] m 


A1 variant 


VINS{<q>}.F16 <Sd>, <Sm> 


Decode for this encoding 

if !HaveFP16Ext() then UNDEFINED; 

if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
d = UInt(Vd:D); m = UInt(Vm:M); 

T1 


ARMVv8.2 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4/3 0 | 


manara o ooo] va Mop onimo vm _| 


T1 variant 


VINS{<q>}.F16 <Sd>, <Sm> 


Decode for this encoding 
if InITBlock() then UNPREDICTABLE; 
if !HaveFP16Ext() then UNDEFINED; 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q00' then UNDEFINED; 
d = UInt(Vd:D); m = UInt(Vm:M); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
s The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-5013 


Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
S[d] = S[m]<15:@> : S[d]<15:0>; 


F6-5014 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.92 VJCVT 


ARM DDI 0487E.a 
ID070919 


Javascript Convert to signed fixed-point, rounding toward Zero. This instruction converts the double-precision 
floating-point value in the SIMD&FP source register to a 32-bit signed integer using the Round towards Zero 
rounding mode, and writes the result to the SIMD&FP destination register. If the result is too large to be 
accommodated as a signed 32-bit integer, then the result is the integer modulo 232, as held in a 32-bit signed integer. 


This instruction can generate a floating-point exception. Depending on the settings in FPSCR, the exception results 
in either a flag being set or a synchronous exception being generated. For more information, see Floating-point 
exceptions and exception traps on page E1-3797. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


ARMVv8.3 


31 28|27 26 25 24/23 22 21 20/19 18 17 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Perm [1770 1p]1 t]/4Jo 07] ve M op 1[a]1|[MJo] vm | 


cond 


A1 variant 


VICVT{<q>}.S32.F64 <Sd>, <Dm> 


Decode for this encoding 

if !HaveFJCVTZSExt() then UNDEFINED; 
if cond != '1110' then UNPREDICTABLE; 
d = UInt(Vd:D); m = UInt(M:Vm); 

T1 


ARMv8.3 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4/3 0 | 


Titottio pp iioo] va popio vm _| 


T1 variant 


VICVT{<q>}.S32.F64 <Sd>, <Dm> 


Decode for this encoding 


if !HaveFJCVTZSExt() then UNDEFINED; 
if InITBlock() then UNPREDICTABLE; 
d = UInt(Vd:D); m = UInt(M:Vm); 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
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F6-5016 


Operation for all encodings 


EncodingSpecificOperations(); 
CheckVFPEnabled(TRUE) ; 
bits(64) fltval = D[m]; 
bits(32) intval; 

bit Z; 


(intval, Z) = FPToFixedJS(fltval, FPSCR, FALSE); 


FPSCR<31:28> = '0':Z:'00'; 
S[d] = intval; 
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F6.1.93 VLD1 (single element to one lane) 


ARM DDI 0487E.a 
ID070919 


Load single 1-element structure to one lane of one register loads one element from memory into one element of a 
register. Elements of the register that are not loaded are unchanged. For details of the addressing mode see The 


Advanced SIMD addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 4|3 0 | 


Ti 770100 )0[1fo] Ra | va Jo ojo Ofindexatgn] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD1 (single element to all lanes)"; 
if index_align<@> != '@' then UNDEFINED; 

ebytes = 1; index = UInt(index_align<3:1>); alignment = 1; 
d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); | register_index = (m != 15 && m != 13); 

if n == 15 then UNPREDICTABLE; 


A2 


[31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 4|3 0 | 


Ti7701001)0[1)o] Ra | va [0 10 Ofindexatgn] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
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F6-5018 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD1 (single element to all lanes)"; 
if index_align<1> != '@' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

alignment = if index_align<@> == 'Q' then 1 else 2; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 then UNPREDICTABLE; 


A3 
|31 30 29 28|27 26 25 24/23 22 21 20/19 16|15 12|11 10 9 8|7 4|3 0 | 
11110100 1jpjijo] Rn | va [1 ofo Ofindex_align] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
Decode for all variants of this encoding 
if size == '11' then SEE "VLD1 (single element to all lanes)"; 


if index_align<2> != '@' then UNDEFINED; 

if index_align<1:0> != '00' && index_align<1:0> != '11' then UNDEFINED; 
ebytes = 4; index = UInt(index_align<3>); 

alignment = if index_align<1:0> == '00' then 1 else 4; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); | register_index = (m != 15 && m != 13); 

if n == 15 then UNPREDICTABLE; 


T1 

|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 4|3 0 | 

11111001 1fpjijo] Rn | va [o ofo Ofindex_align] Rm | 

size 
Offset variant 
Applies when Rm == 1111. 
VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
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Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 

if size == '11' then SEE "VLD1 (single element to all lanes)"; 
if index_align<@> != '@' then UNDEFINED; 

ebytes = 1; index = UInt(index_align<3:1>); alignment = 1; 
d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 then UNPREDICTABLE; 


T2 


[15 1413 12/1110 9 8|7 6 5 4/3 0 |15 12/1110 9 8|7 4|3 0 | 


14111100 1 1jojijo] Rn | va [o 1[0 ofindexalign] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD1 (single element to all lanes)"; 
if index_align<1> != '@' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

alignment = if index_align<0> == 'Q' then 1 else 2; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 then UNPREDICTABLE; 


T3 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 4|3 0 | 


11111001 1jpjijo] Rn | va [1 ofo ofindex align] Rm | 


size 
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Offset variant 


Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 


Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 


Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD1 (single element to all lanes)"; 
if index_align<2> != '@' then UNDEFINED; 
if index_align<1:0> != '00' && index_align<1:0> != '11' then UNDEFINED; 


ebytes = 4; 


index = UInt(index_align<3>); 


alignment = if index_align<1:0@> == '00' then 1 else 4; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<size> 


<list> 


<Rn> 


<align> 
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For encoding A1, A2 and A3: see Standard assembler syntax fields on page F2-3908. This encoding 


must be unconditional. 


For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 


32 when size = 10 


Is a list containing the single 64-bit name of the SIMD&FP register holding the element. 


The list must be { <Dd>[<index>] }. 

The register <Dd> is encoded in the "D:Vd" field. 

The permitted values and encoding of <index> depend on <size>: 

<size> == 8<index> is in the range 0 to 7, encoded in the "index_align<3:1>" field. 
<size> == 16<index> is in the range 0 to 3, encoded in the "index_align<3:2>" field. 


<size> == 32<index> is 0 or 1, encoded in the "index_align<3>" field. 
Is the general-purpose base register, encoded in the "Rn" field. 


When <size> == 8, <align> must be omitted, otherwise it is the optional alignment. 
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Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and the encoding depends on <size>: 


<size> == 8Encoded in the "index_align<0>" field as 0. 

<size> == 16Encoded in the "index_align<1:0>" field as 0b00. 

<size> == 32Encoded in the "index_align<2:0>" field as 0b000. 

Whenever <align> is present, the permitted values and encoding depend on <size>: 


<size> == 16<align> is 16, meaning 16-bit alignment, encoded in the "index_align<1:0>" field as 
0b01. 


<size> == 32<align> is 32, meaning 32-bit alignment, encoded in the "index_align<2:0>" field as 
0b011. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 


page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = FALSE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
Elem[D[d],index] = MemU[address, ebytes]; 
if whack then 
if register_index then 


else 


R[n] = R[n] + R[m]; 


R[n] = R[n] + ebytes; 
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F6.1.94 


F6-5022 


VLD1 (single element to all lanes) 


Load single 1-element structure and replicate to all lanes of one register loads one element from memory into every 
element of one or two vectors. For details of the addressing mode see The Advanced SIMD addressing mode on 


page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


141110100 1jpjijo] Rn | va [1 1[0 ofsize|Tla] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}],<Rm> 


Decode for all variants of this encoding 


if size == '11' || (size == '00' && a == '1') then UNDEFINED; 
ebytes = 1 << UInt(size); regs = if T == 'Q' then 1 else 2; 
alignment = if a == 'Q' then 1 else ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); | register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
s One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


11111001 1jpjijo] Rn | va [1 1J0 ofsize|Tfa] Rm | 
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Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' || (size == '00' && a == '1') then UNDEFINED; 
ebytes = 1 << UInt(size); regs = if T == 'Q' then 1 else 2; 
alignment = if a == '@' then 1 else ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD1 (single element to all lanes) on 
page K1-7621. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<list> Is a list containing the 64-bit names of the SIMD&FP registers. 
The list must be one of: 
{ <Dd>[] } Encoded in the "T" field as 0. 
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F6-5024 


<Rn> 


<align> 


<Rm> 


{ <Dd>[], <Dd+1>[] }Encoded in the "T" field as 1. 
The register <Dd> is encoded in the "D:Vd" field. 


Is the general-purpose base register, encoded in the "Rn" field. 


When <size> == 8, <align> must be omitted, otherwise it is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "a" field as 0. 


Whenever <align> is present, the permitted values and encoding depend on <size>: 
<size> == 16<align> is 16, meaning 16-bit alignment, encoded in the "a" field as 1. 
<size> == 32<align> is 32, meaning 32-bit alignment, encoded in the "a" field as 1. 
: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 


see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 


page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = FALSE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
bits(64) replicated_element = Replicate(MemU[address, ebytes]); 
for r = ð to regs-1 
D[d+r] = replicated_element; 
if whack then 
if register_index then 


else 


R[n] = R[n] + R[m]; 


R[n] = R[n] + ebytes; 
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F6.1.95 VLD1 (multiple single elements) 


Load multiple single 1-element structures to one, two, three, or four registers loads elements from memory into one, 
two, three, or four registers, without de-interleaving. Every element of each register is loaded. For details of the 
addressing mode see The Advanced SIMD addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


11770100 0)0[1fo] Ra | va [011 i[sweJalgn] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 1; if align<l> == '1' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
g One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


A2 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Ti7701000)0]1)o] Ra | va [101 0[szeJaign] Rm | 
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F6-5026 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 2; if align == '11' then UNDEFINED; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


A3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Ti 770100 0)0[1)o] Ra | va [011 0[szeaign] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
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Decode for all variants of this encoding 


regs = 3; if align<l> == '1' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
` One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


A4 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


Ti 770100 0)0]1fo] Ra | va [001 0[sweJalgn] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 4; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
s The instruction executes as NOP. 
s One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
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F6-5028 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 121110 9 8|7 6 5 4|3 o| 


Tii77007 0[io] Ra | va [011 i[sweJalgn] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 1; if align<l> == '1' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
è One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T2 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


Tii770070)0]1o] Ra | va [101 0[szeJalgn] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
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Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 2; if align == '11' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
. The instruction executes as NOP. 
g One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T3 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


11111001 ofpiifol Rn | va [o 1 1 ofsizefalign] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 3; if align<1l> == '1' then UNDEFINED; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d+regs > 32, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
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F6-5030 


. The instruction executes as NOP. 


s One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 
the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T4 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


14111100 1 ofojifoy Rn | va [o o 1 ofsizefalign] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 4; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
a The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD1 (multiple single elements) on 
page K1-7621. 


Related encodings: See Advanced SIMD element or structure load/store on page F3-3985 for the T32 instruction 
set, or Advanced SIMD element or structure load/store on page F4-4061 for the A32 instruction set. 


Assembler symbols 


<C> For encoding A1, A2, A3 and A4: see Standard assembler syntax fields on page F2-3908. This 
encoding must be unconditional. 
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<list> 
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<align> 


<Rm> 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


For encoding T1, T2, T3 and T4: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data size, encoded in the "size" field. It can have the following values: 


8 when size = 00 
16 when size = 01 
32 when size = 10 
64 when size = 11 


Is a list containing the 64-bit names of the SIMD&FP registers. 

The list must be one of: 

{ <Dd> } Single register. Selects the Al and T1 encodings of the instruction. 

{ <Dd>, <Dd+1> }Two single-spaced registers. Selects the A2 and T2 encodings of the instruction. 


{ <Dd>, <Dd+1>, <Dd+2> }Three single-spaced registers. Selects the A3 and T3 encodings of the 
instruction. 


{ <Dd>, <Dd+1>, <Dd+2>, <Dd+3> }Four single-spaced registers. Selects the A4 and T4 encodings of 
the instruction. 


The register <Dd> is encoded in the "D:Vd" field. 
Is the general-purpose base register, encoded in the "Rn" field. 


Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "align" field as 0b00. 


Whenever <align> is present, the permitted values are: 


64 64-bit alignment, encoded in the "align" field as 0b01. 

128 128-bit alignment, encoded in the "align" field as 0b10. Available only if <list> contains 
two or four registers. 

256 256-bit alignment, encoded in the "align" field as 0b11. Available only if <list> contains 
four registers. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 
page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = FALSE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
for r = 0 to regs-1 


for e = Q to elements-1 


bits(ebytes«8) data; 
if ebytes != 8 then 
data = MemU[address, ebytes]; 
else 
- = AArch32.CheckAlignment(address, ebytes, AccType_NORMAL, iswrite); 
data<31:0> = if BigEndian() then MemU[address+4,4] else MemU[address,4]; 
data<63:32> = if BigEndian() then MemU[address,4] else MemU[address+4,4]; 
Elem[D[d+r],e] = data; 
address = address + ebytes; 
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if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 8regs; 
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F6.1.96 VLD2 (single 2-element structure to one lane) 


Load single 2-element structure to one lane of two registers loads one 2-element structure from memory into 
corresponding elements of two registers. Elements of the registers that are not loaded are unchanged. For details of 
the addressing mode see The Advanced SIMD addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 4|3 0 | 


Ti 770100 )0[1fo] Ra | va Jo ojo iJindex align] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 

if size == '11' then SEE "VLD2 (single 2-element structure to all lanes)"; 
ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 

alignment = if index_align<@> == 'Q' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 

If d2 > 31, then one of the following behaviors must occur: 
` The instruction is UNDEFINED. 

$ The instruction executes as NOP. 


g One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 
the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


A2 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0 | 
Tt 4107001)0)1}0] Rn | va Jo 1]0 1[indexaign] Rm | 
size 
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F6-5034 


Offset variant 
Applies when Rm == 1111. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD2 (single 2-element structure to all lanes)"; 
ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 4; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2 > 31, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
è The instruction executes as NOP. 
: One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


A3 

|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0| 

1111010010] Rn | va [i ojo t[indexaign] Rm 
size 
Offset variant 
Applies when Rm == 1111. 
VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
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Decode for all variants of this encoding 


if size == '11' then SEE "VLD2 (single 2-element structure to all lanes)"; 
if index_align<1> != '@' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 8; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2 > 31, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
è The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 4|3 0 | 


11111001 1jpjijo| Rn | vd jo ofo 1 Jindexalign] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 

if size == '11' then SEE "VLD2 (single 2-element structure to all lanes)"; 
ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 

alignment = if index_align<@> == 'Q' then 1 else 2; 

d = UInt(D:Vd); d2 = d+ inc; n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 

If d2 > 31, then one of the following behaviors must occur: 
7 The instruction is UNDEFINED. 

s The instruction executes as NOP. 


è One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 
the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
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F6-5036 


T2 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|11 10 9 8|7 4|3 o| 


Tii77007 t0[1o] Ra | va [0 10 i[indexaten[ Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD2 (single 2-element structure to all lanes)"; 
ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 4; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15);  register_index = (m != 15 && m != 13); 

if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 

If d2 > 31, then one of the following behaviors must occur: 
è The instruction is UNDEFINED. 

: The instruction executes as NOP. 


à One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 
the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T3 

|15 14 13 12|11 10 9 8|7 6 5 43 0 [15 12|11 10 9 8|7 4|3 0| 

Tit1700174)0]1]o] Rn | va [i ojo t[indexaign] Rm 
size 
Offset variant 
Applies when Rm == 1111. 
VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
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Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD2 (single 2-element structure to all lanes)"; 
if index_align<l> != '@' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 8; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2 > 31, then one of the following behaviors must occur: 


š The instruction is UNDEFINED. 
s The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD2 (single 2-element structure to 
one lane) on page K1-7621. 


Assembler symbols 


<c> For encoding A1, A2 and A3: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 
<list> Is a list containing the 64-bit names of the two SIMD&FP registers holding the element. 


The list must be one of: 
{ <Dd>[<index>], <Dd+1>[<index>] }Single-spaced registers, encoded as "spacing" = 0. 


{ <Dd>[<index>], <Dd+2>[<index>] }Double-spaced registers, encoded as "spacing" = 1. Not 
permitted when <size> == 8. 


The encoding of "spacing" depends on <size>: 

<size> == 16"spacing" is encoded in the "index_align<1>" field. 
<size> == 32"spacing" is encoded in the "index_align<2>" field. 
The register <Dd> is encoded in the "D:Vd" field. 

The permitted values and encoding of <index> depend on <size>: 


<size> == 8<index> is in the range 0 to 7, encoded in the "index_align<3:1>" field. 
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<size> == 16<index> is in the range 0 to 3, encoded in the "index_align<3:2>" field. 


<size> == 32<index> is 0 or 1, encoded in the "index_align<3>" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


<align> Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and the encoding depends on <size>: 


<size> == 8Encoded in the "index_align<0>" field as 0. 

<size> == 16Encoded in the "index_align<0>" field as 0. 

<size> == 32Encoded in the "index_align<1:0>" field as 0b00. 

Whenever <align> is present, the permitted values and encoding depend on <size>: 

<size> == 8<align> is 16, meaning 16-bit alignment, encoded in the "index_align<0>" field as 1. 
<size> == 16<align> is 32, meaning 32-bit alignment, encoded in the "index_align<0>" field as 1. 


<size> == 32<align> is 64, meaning 64-bit alignment, encoded in the "index_align<1:0>" field as 
Qb01. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


<Rm> Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 
page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; | iswrite = FALSE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
Elem[D[d], index] = MemU[address, ebytes]; 
Elem[D[d2], index] = MemU[address+ebytes, ebytes]; 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 2xebytes; 
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F6.1.97 VLD2 (single 2-element structure to all lanes) 


Load single 2-element structure and replicate to all lanes of two registers loads one 2-element structure from 
memory into all lanes of two registers. For details of the addressing mode see The Advanced SIMD addressing mode 
on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


141110100 1jpjijo] Rn | va [1 1/0 1[szejt[a] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}],<Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

ebytes = 1 << UInt(size); 

alignment = if a == 'Q' then 1 else 2xebytes; 

inc = if T == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2 > 31, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
à One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


1111001 1jojijo] Rn | va fri 1[o t}size]Tfa} Rm | 
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F6-5040 


Offset variant 
Applies when Rm == 1111. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

ebytes = 1 << UInt(size); 

alignment = if a == '@' then 1 else 2xebytes; 

inc = if T == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2 > 31, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
è The instruction executes as NOP. 
: One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD2 (single 2-element structure to 
all lanes) on page K1-7622. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<list> Is a list containing the 64-bit names of two SIMD&FP registers. 
The list must be one of: 


{ <Dd>[], <Dd+1>[] }Single-spaced registers, encoded in the "T" field as 0. 
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{ <Dd>[], <Dd+2>[] }Double-spaced registers, encoded in the "T" field as 1. 
The register <Dd> is encoded in the "D:Vd" field. 


Is the general-purpose base register, encoded in the "Rn" field. 


Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "a" field as 0. 


Whenever <align> is present, the permitted values and encoding depend on <size>: 

<size> == 8<align> is 16, meaning 16-bit alignment, encoded in the "a" field as 1. 

<size> == 16<align> is 32, meaning 32-bit alignment, encoded in the "a" field as 1. 

<size> == 32<align> is 64, meaning 64-bit alignment, encoded in the "a" field as 1. 

: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 


see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 


page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = FALSE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
D[d] = Replicate(MemU[address,ebytes]); 
D[d2] = Replicate(MemU[address+ebytes,ebytes]); 
if whack then 
if register_index then 


else 


R[n] = R[n] + R[m]; 


R[n] = R[n] + 2xebytes; 
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F6.1.98 


F6-5042 


VLD2 (multiple 2-element structures) 


Load multiple 2-element structures to two or four registers loads multiple 2-element structures from memory into 
two or four registers, with de-interleaving. For more information, see E/ement and structure load/store instructions 
on page F1-3888. Every element of each register is loaded. For details of the addressing mode see The Advanced 

SIMD addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 


77710700 0[o]i]o Rn | va [100 x[sve[algn] Rm | 


itype 


Offset variant 
Applies when Rm == 1111. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 1; if align == '11' then UNDEFINED; 

if size == '11' then UNDEFINED; 

inc = if itype == '1001' then 2 else 1; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 

If d2+regs > 32, then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

$ The instruction executes as NOP. 


x One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 
the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
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A2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


Ti 770100 0)0[1fo] Ra | va [001 i[sweJaign] Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 2; inc = 2; 

if size == '11' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2+regs > 32, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
: The instruction executes as NOP. 
à One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T1 

|15 14 13 12|11 10 9 8|7 6 5 43 0 [15 12|11 8|7 6 5 4|3 o| 

1111100100] Rn | va [io 0 x|szelaion] Rm] 
itype 
Offset variant 
Applies when Rm == 1111. 
VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
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F6-5044 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 1; if align == '11' then UNDEFINED; 

if size == '11' then UNDEFINED; 

inc = if itype == '1001' then 2 else 1; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2+regs > 32, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
à The instruction executes as NOP. 
s One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T2 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 


o| 


manan ooroph]o] Rn | va [001 1szejamn| Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 2; inc = 2; 

if size == '11' then UNDEFINED; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2+regs > 32 then UNPREDICTABLE; 
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CONSTRAINED UNPREDICTABLE behavior 


If d2+regs > 32, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD2 (multiple 2-element structures) 
on page K1-7621. 


Related encodings: See Advanced SIMD element or structure load/store on page F3-3985 for the T32 instruction 
set, or Advanced SIMD element or structure load/store on page F4-4061 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<list> Is a list containing the 64-bit names of the SIMD&FP registers. 
The list must be one of: 


{ <Dd>, <Dd+1> }Two single-spaced registers. Selects the Al and T1 encodings of the instruction, 
and encoded in the "itype" field as 0b1000. 


{ <Dd>, <Dd+2> }Two double-spaced registers. Selects the Al and T1 encodings of the instruction, 
and encoded in the "itype" field as 0b1001. 


{ <Dd>, <Dd+1>, <Dd+2>, <Dd+3> }Three single-spaced registers. Selects the A2 and T2 encodings 
of the instruction. 


The register <Dd> is encoded in the "D:Vd" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


<align> Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "align" field as 0b00. 


Whenever <align> is present, the permitted values are: 


64 64-bit alignment, encoded in the "align" field as 0b01. 

128 128-bit alignment, encoded in the "align" field as 0b10. 

256 256-bit alignment, encoded in the "align" field as 0b11. Available only if <list> contains 
four registers. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 
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<Rm> Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 
page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; | iswrite = FALSE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
for r = 0 to regs-1 
for e = 0 to elements-1 
Elem[D[d+r], e] = MemU[address,ebytes]; 
Elem[D[d2+r],e] = MemU[address+ebytes, ebytes]; 
address = address + 2xebytes; 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 16*regs; 
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F6.1.99 VLD3 (single 3-element structure to one lane) 


Load single 3-element structure to one lane of three registers loads one 3-element structure from memory into 
corresponding elements of three registers. Elements of the registers that are not loaded are unchanged. For details 
of the addressing mode see The Advanced SIMD addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0| 
1111010010] Rn | va Jo ofi index align] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 
Decode for all variants of this encoding 
if size == '11' then SEE "VLD3 (single 3-element structure to all lanes)"; 


if index_align<@> != '@' then UNDEFINED; 

ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
g One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


A2 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0 | 
T14107001)0)1}Q] Rn | va [0 1]1 Ofindexaign[ Rm | 
size 
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F6-5048 


Offset variant 
Applies when Rm == 1111. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD3 (single 3-element structure to all lanes)"; 


if index_align<@> != '@' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); 
wback = (m != 15); | register_index = (m != 15 && m != 13); 
if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d3 > 31, then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 


. The instruction executes as NOP. 


m = UInt(Rm); 


: One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 
the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


A3 

|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0| 

1111010010] Rn | va [i 0]1 Ofindexaign] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 
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Decode for all variants of this encoding 


if size == '11' then SEE "VLD3 (single 3-element structure to all lanes)"; 
if index_align<1:0> != '@0' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 &&m != 13); 

if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
. The instruction executes as NOP. 
s One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T1 
|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 4|3 0 | 
1111100 1 1jojijlo] Rn | va [o oļi ofindexalign] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 
Decode for all variants of this encoding 
if size == '11' then SEE "VLD3 (single 3-element structure to all lanes)"; 


if index_align<@> != '@' then UNDEFINED; 

ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 

if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
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T2 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 4|3 0| 
Tit 47007 To]io] Rn | va Jo 1i [index align] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 
Decode for all variants of this encoding 
if size == '11' then SEE "VLD3 (single 3-element structure to all lanes)"; 


if index_align<@> != '@' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
: The instruction executes as NOP. 
à One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T3 
|15 14 13 12|11 10 9 8|7 6 5 4/3 0 |15 12|11 10 9 8|7 4|3 0 | 
1111001 pho] Rn | va [i 0]1 O]index align] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD3{<c>}{<q>}.<size> <list>, [<Rn>]! 
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Post-indexed variant 
Applies when Rm != 11x1. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD3 (single 3-element structure to all lanes)"; 
if index_align<1:0> != '@0' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
è The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD3 (single 3-element structure to 
one lane) on page K1-7622. 


Assembler symbols 


<c> For encoding A1, A2 and A3: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 
<list> Is a list containing the 64-bit names of the three SIMD&FP registers holding the element. 


The list must be one of: 


{ <Dd>[<index>], <Dd+1>[<index>], <Dd+2>[<index>] }Single-spaced registers, encoded as 
"spacing" = 0. 


{ <Dd>[<index>], <Dd+2>[<index>], <Dd+4>[<index>] }Double-spaced registers, encoded as 
"spacing" = 1. Not permitted when <size> == 8. 


The encoding of "spacing" depends on <size>: 
<size> == 8"spacing" is encoded in the "index_align<0>" field. 
<size> == 16"spacing" is encoded in the "index_align<1>" field, and "index_align<0>" is set to 0. 


<size> == 32"spacing" is encoded in the "index_align<2>" field, and "index_align<1:0>" is set to 
0b00. 


The register <Dd> is encoded in the "D:Vd" field. 
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The permitted values and encoding of <index> depend on <size>: 
<size> == 8<index> is in the range 0 to 7, encoded in the "index_align<3:1>" field. 
<size> == 16<index> is in the range 0 to 3, encoded in the "index_align<3:2>" field. 


<size> == 32<index> is 0 or 1, encoded in the "index_align<3>" field. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
<Rm> Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 
page F2-3929. 


Alignment 


Standard alignment rules apply, see Alignment support on page B2-138. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; 
Elem[D[d], index] = MemU[address, ebytes]; 
Elem[D[d2],index] = MemU[address+ebytes, ebytes]; 
Elem[D[d3], index] = MemU[address+2*ebytes, ebytes]; 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 3xebytes; 
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F6.1.100 VLD3 (single 3-element structure to all lanes) 


ARM DDI 0487E.a 
ID070919 


Load single 3-element structure and replicate to all lanes of three registers loads one 3-element structure from 
memory into all lanes of three registers. For details of the addressing mode see The Advanced SIMD addressing 
mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


1110100 1jpojijo] Rn | va fi 141 ofsize}T{o] Rm | 
a 


Offset variant 
Applies when Rm == 1111. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 


Decode for all variants of this encoding 


if size == '11' || a == '1' then UNDEFINED; 

ebytes = 1 << UInt(size); 

inc = if T == '0' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
s One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


11111001 1jpjijo] Rn | va [1 1/1 ofsie|T]o] Rm | 
a 
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F6-5054 


Offset variant 
Applies when Rm == 1111. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 


Decode for all variants of this encoding 


if size == '11' || a == '1' then UNDEFINED; 

ebytes = 1 << UInt(size); 

inc = if T == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


š The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD3 (single 3-element structure to 
all lanes) on page K1-7622. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<list> Is a list containing the 64-bit names of three SIMD&FP registers. 
The list must be one of: 


{ <Dd>[], <Dd+1>[], <Dd+2>[] }Single-spaced registers, encoded in the "T" field as 0. 
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{ <Dd>[], <Dd+2>[], <Dd+4>[] }Double-spaced registers, encoded in the "T" field as 1. 
The register <Dd> is encoded in the "D:Vd" field. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 
<Rm> Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 
page F2-3929. 


Alignment 


Standard alignment rules apply, see Alignment support on page B2-138. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; 
D[d] = Replicate(MemU[address,ebytes]); 
D[d2] = Replicate(MemU[address+ebytes,ebytes]); 
D[d3] = Replicate(MemU[address+2sebytes,ebytes]); 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 3xebytes; 
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F6.1.101 


F6-5056 


VLD3 (multiple 3-element structures) 


Load multiple 3-element structures to three registers loads multiple 3-element structures from memory into three 
registers, with de-interleaving. For more information, see Element and structure load/store instructions on 

page F1-3888. Every element of each register is loaded. For details of the addressing mode see The Advanced SIMD 
addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 42\11 8/7 6 5 4|3 0 
Tt i10700 0[o[tfo] Ra | va lo 70 x[swelaign] Rm | 


itype 


Offset variant 
Applies when Rm == 1111. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


case itype of 
when '0100' 
inc = 1; 
when 'Q101' 
inc = 2; 
otherwise 
SEE "Related encodings"; 
if size == '11' || align<1l> == '1' then UNDEFINED; 
alignment = if align<@> == 'Q' then 1 else 8; 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
s The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
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T1 
|15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12\11 8/7 6 5 4|3 0 | 
Ti tt7007 Ojo] Ra | va [o 70 x[szeaign] Rm | 


itype 


Offset variant 
Applies when Rm == 1111. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


case itype of 
when 'Q100' 
inc = 1; 
when 'Q101' 
inc = 2; 
otherwise 
SEE "Related encodings"; 
if size == '11' || align<1> == '1' then UNDEFINED; 
alignment = if align<@> == 'Q' then 1 else 8; 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
: The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD3 (multiple 3-element structures) 
on page K1-7622. 


Related encodings: See Advanced SIMD element or structure load/store on page F3-3985 for the T32 instruction 
set, or Advanced SIMD element or structure load/store on page F4-4061 for the A32 instruction set. 
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Assembler symbols 


<C> 


<q> 


<size> 


<list> 


<Rn> 


<align> 


<Rm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


Is a list containing the 64-bit names of the SIMD&FP registers. 

The list must be one of: 

{ <Dd>, <Dd+1>, <Dd+2> }Single-spaced registers, encoded in the "itype" field as 0b0100. 
{ <Dd>, <Dd+2>, <Dd+4> }Double-spaced registers, encoded in the "itype" field as 0b0101. 
The register <Dd> is encoded in the "D:Vd" field. 


Is the general-purpose base register, encoded in the "Rn" field. 


Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "align" field as 0b00. 


Whenever <align> is present, the only permitted values is 64, meaning 64-bit alignment, encoded in 
the "align" field as 0b01. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about <Rn>, !, and <Rm>, see The Advanced SIMD addressing mode on page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = FALSE; 


- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 


for e = 0 to elements-1 
Elem[D[d], e] = MemU[address, ebytes]; 
Elem[D[d2],e] = MemU[address+ebytes, ebytes]; 
Elem[D[d3],e] = MemU[address+2«ebytes,ebytes]; 
address = address + 3xebytes; 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 24; 
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F6.1.102 VLD4 (single 4-element structure to one lane) 


Load single 4-element structure to one lane of four registers loads one 4-element structure from memory into 
corresponding elements of four registers. Elements of the registers that are not loaded are unchanged. For details of 
the addressing mode see The Advanced SIMD addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0| 
1111010010] Rn | va Jo oji [raran] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
Decode for all variants of this encoding 
if size == '11' then SEE "VLD4 (single 4-element structure to all lanes)"; 
ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 
alignment = if index_align<@> == 'Q' then 1 else 4; 


d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
g One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


A2 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0 | 
Ti 4107007)0)1)] Rn | va Joi 1[indexaign] Rm | 
size 
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F6-5060 


Offset variant 
Applies when Rm == 1111. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD4 (single 4-element structure to all lanes)"; 

ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 8; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d4 > 31 then UNPREDICTABLE; 

CONSTRAINED UNPREDICTABLE behavior 

If d4 > 31, then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

e The instruction executes as NOP. 

: One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


A3 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 


4|3 o| 


Ti 770100 7)0[1fo] Ra | va [i 0[1 rarai] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
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Decode for all variants of this encoding 


if size == '11' then SEE "VLD4 (single 4-element structure to all lanes)"; 

if index_align<1:0> == '11' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

alignment = if index_align<1:@> == 'Q0' then 1 else 4 << UInt(index_align<1:0>); 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 

if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
è The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T1 
|15 14 13 12|11 10 9 8|7 6 5 4/3 0 |15 12|11 10 9 8|7 4|3 0 | 
11111001 1jpjijo] Rn | va [o oļ1 1{index_align] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
Decode for all variants of this encoding 
if size == '11' then SEE "VLD4 (single 4-element structure to all lanes)"; 
ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 
alignment = if index_align<@> == 'Q' then 1 else 4; 


d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


7 The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
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T2 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 4|3 0| 
Tit 47007 o] Rn | va Jo 1i 1[index align] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
Decode for all variants of this encoding 
if size == '11' then SEE "VLD4 (single 4-element structure to all lanes)"; 
ebytes = 2; index = UInt(index_align<3:2>); 
inc = if index_align<1> == '@' then 1 else 2; 
alignment = if index_align<@> == 'Q' then 1 else 8; 


d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
: The instruction executes as NOP. 
à One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T3 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 4|3 0| 
1111100110] Rn | va [i op t[indexaign] Rm 
size 
Offset variant 
Applies when Rm == 1111. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
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Post-indexed variant 
Applies when Rm != 11x1. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then SEE "VLD4 (single 4-element structure to all lanes)"; 

if index_align<1:0> == '11' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

alignment = if index_align<1:@> == '00' then 1 else 4 << UInt(index_align<1:0>); 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
à The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD4 (single 4-element structure to 
one lane) on page K1-7622. 


Assembler symbols 


<c> For encoding A1, A2 and A3: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 
<list> Is a list containing the 64-bit names of the four SIMD&FP registers holding the element. 


The list must be one of: 


{ <Dd>[<index>], <Dd+1>[<index>], <Dd+2>[<index>], <Dd+3>[<index>] }Single-spaced registers, 
encoded as "spacing" = 0. 


{ <Dd>[<index>], <Dd+2>[<index>], <Dd+4>[<index>], <Dd+6>[<index>] }Double-spaced registers, 
encoded as "spacing" = 1. Not permitted when <size> == 8. 


The encoding of "spacing" depends on <size>: 
<size> == 16"spacing" is encoded in the "index_align<1>" field. 
<size> == 32"spacing" is encoded in the "index_align<2>" field. 


The register <Dd> is encoded in the "D:Vd" field. 
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F6-5064 


<Rn> 


<align> 


<Rm> 


The permitted values and encoding of <index> depend on <size>: 
<size> == 8<index> is in the range 0 to 7, encoded in the "index_align<3:1>" field. 
<size> == 16<index> is in the range 0 to 3, encoded in the "index_align<3:2>" field. 


<size> == 32<index> is 0 or 1, encoded in the "index_align<3>" field. 
Is the general-purpose base register, encoded in the "Rn" field. 


Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and the encoding depends on <size>: 


<size> == 8Encoded in the "index_align<0>" field as 0. 

<size> == 16Encoded in the "index_align<0>" field as 0. 

<size> == 32Encoded in the "index_align<1:0>" field as 0b00. 

Whenever <align> is present, the permitted values and encoding depend on <size>: 

<size> == 8<align> is 32, meaning 32-bit alignment, encoded in the "index_align<0>" field as 1. 
<size> == 16<align> is 64, meaning 64-bit alignment, encoded in the "index_align<0>" field as 1. 


<size> == 32<align> can be 64 or 128. 64-bit alignment is encoded in the "index_align<1:0>" field 
as 0b01, and 128-bit alignment is encoded in the "index_align<1:0>" field as 0b10. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 


page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 


address = 


R[n]; iswrite = FALSE; 


- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 


Elem[D[d] 


Elem[D[d2] 
Elem[D[d3] 
Elem[D[d4] 


, index] = MemU[address,ebytes]; 

, index] = MemU[address+ebytes, ebytes] ; 

, index] = MemU[address+2«ebytes, ebytes]; 
, index] = MemU[address+3*ebytes, ebytes]; 


if whack then 
if register_index then 





R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 4xebytes; 
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VLD4 (single 4-element structure to all lanes) 


Load single 4-element structure and replicate to all lanes of four registers loads one 4-element structure from 
memory into all lanes of four registers. For details of the addressing mode see The Advanced SIMD addressing mode 


on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


1110100 1jojijo] Rn | va fi 1[i t}size]tfa} Rm | 


Offset variant 
Applies when Rm == 1111. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] ,<Rm> 


Decode for all variants of this encoding 


if size == '11' && a == '@' then UNDEFINED; 


if size == '11' then 
ebytes = 4; alignment = 16; 
else 
ebytes = 1 << UInt(size); 
if size == '10' then 
alignment = if a == 'Q' then 1 else 8; 
else 
alignment = if a == 'Q@' then 1 else 4xebytes; 
inc = if T == '@' then 1 else 2; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 
CONSTRAINED UNPREDICTABLE behavior 
If d4 > 31, then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
. The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


F6-5065 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 


Offset variant 
Applies when Rm == 1111. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' && a == '@' then UNDEFINED; 


if size == '11' then 
ebytes = 4; alignment = 16; 
else 
ebytes = 1 << UInt(size); 
if size == '10' then 
alignment = if a == 'Q@' then 1 else 8; 
else 
alignment = if a == 'Q@' then 1 else 4xebytes; 


inc = if T == '0' then 1 else 2; 


12/1109 8|7 6 5 4|3 o| 


11111001 1fpjijo] Rn | va [11/1 1[szejt[a] Rm | 


d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 
CONSTRAINED UNPREDICTABLE behavior 
If d4 > 31, then one of the following behaviors must occur: 
: The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD4 (single 4-element structure to 


all lanes) on page K1-7623. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
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<q> 


<size> 


<list> 


<Rn> 


<align> 


<Rm> 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


See Standard assembler syntax fields on page F2-3908. 


Is the data size, encoded in the "size" field. It can have the following values: 


8 when size = 00 
16 when size = 01 
32 when size = 1x 


Is a list containing the 64-bit names of four SIMD&FP registers. 

The list must be one of: 

{ <Dd>[], <Dd+1>[], <Dd+2>[], <Dd+3>[] }Single-spaced registers, encoded in the "T" field as 0. 
{ <Dd>[], <Dd+2>[], <Dd+4>[], <Dd+6>[] }Double-spaced registers, encoded in the "T" field as 1. 
The register <Dd> is encoded in the "D:Vd" field. 


Is the general-purpose base register, encoded in the "Rn" field. 


Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "a" field as 0. 


Whenever <align> is present, the permitted values and encoding depend on <size>: 
<size> == 8<align> is 32, meaning 32-bit alignment, encoded in the "a" field as 1. 
<size> == 16<align> is 64, meaning 64-bit alignment, encoded in the "a" field as 1. 


<size> == 32<align> can be 64 or 128. 64-bit alignment is encoded in the "a:size<0>" field as 0b10, 
and 128-bit alignment is encoded in the "a:size<0>" field as 0b11. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 


page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = FALSE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
D[d] = Replicate(MemU[address,ebytes]); 
D[d2] = 
D[d3] = 
D[d4] = 


ARM DDI 0487E.a 
ID070919 


Replicate(MemU[address+ebytes,ebytes]); 

Replicate(MemU[address+2sebytes,ebytes]); 
Replicate(MemU[address+3«ebytes,ebytes]); 
if whack then 


if register_index then 


else 


R[n] = R[n] + R[m]; 





R[n] = R[n] + 4xebytes; 
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F6.1.104 


F6-5068 


VLD4 (multiple 4-element structures) 


Load multiple 4-element structures to four registers loads multiple 4-element structures from memory into four 
registers, with de-interleaving. For more information, see Element and structure load/store instructions on 

page F1-3888. Every element of each register is loaded. For details of the addressing mode see The Advanced SIMD 
addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20119 16115 12|11 8/7 6 5 4|3 0 | 
Tt i10700 0[o[tfo] Ra | va [ooo x[swe|aign] Rm | 


itype 


Offset variant 
Applies when Rm == 1111. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


case itype of 
when '0000' 
inc = 1; 
when '0001' 
inc = 2; 
otherwise 
SEE "Related encodings"; 
if size == '11' then UNDEFINED; 
alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
s The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
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T1 
|15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12\11 8/7 6 5 4|3 0 | 
Toit? 007 Opto] Ra | va [ooo x[swelaign] Rm | 


itype 


Offset variant 
Applies when Rm == 1111. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VLD4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


case itype of 
when '0000' 
inc = 1; 
when '0001' 
inc = 2; 
otherwise 
SEE "Related encodings"; 
if size == '11' then UNDEFINED; 
alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


: The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLD4 (multiple 4-element structures) 
on page K1-7622. 


Related encodings: See Advanced SIMD element or structure load/store on page F3-3985 for the T32 instruction 
set, or Advanced SIMD element or structure load/store on page F4-4061 for the A32 instruction set. 
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F6-5070 


Assembler symbols 


<C> 


<q> 


<size> 


<list> 


<Rn> 


<align> 


<Rm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data size, encoded in the "size" field. It can have the following values: 


8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


Is a list containing the 64-bit names of the SIMD&FP registers. 

The list must be one of: 

{ <Dd>, <Dd+1>, <Dd+2>, <Dd+3> }Single-spaced registers, encoded in the "itype" field as 0b0000. 
{ <Dd>, <Dd+2>, <Dd+4>, <Dd+6> }Double-spaced registers, encoded in the "itype" field as 0b0001. 
The register <Dd> is encoded in the "D:Vd" field. 


Is the general-purpose base register, encoded in the "Rn" field. 


Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "align" field as Qb00. 


Whenever <align> is present, the permitted values are: 


64 64-bit alignment, encoded in the "align" field as 0b01. 
128 128-bit alignment, encoded in the "align" field as 0b10. 
256 256-bit alignment, encoded in the "align" field as @b11. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 


page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = FALSE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
for e = 0 to elements-1 


Elem[D[d], 
Elem[D[d2] 
Elem[D[d3] 
Elem[D[d4] 
address = address + 4xebytes; 


e] = MemU[address,ebytes]; 

,@] = MemU[address+ebytes, ebytes] ; 
,@] = MemU[address+2«ebytes, ebytes]; 
,@] = MemU[address+3*ebytes, ebytes]; 


if whack then 


if register_index then 
R[n] = R[n] + R[m]; 


R[n] = R[n] + 32; 
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F6.1.105 VLDM, VLDMDB, VLDMIA 
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Load Multiple SIMD&FP registers loads multiple registers from consecutive locations in the Advanced SIMD and 
floating-point register file using an address from a general-purpose register. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the alias VPOP. See Alias conditions on page F6-5074 for details of when each alias is 
preferred. 


A1 


31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 | 1 0| 





[m11 J1 1 ofpfujofwiif Rn | va ft ofi 1| imma<7t> [0 | 


cond imm8<0> 


Decrement Before variant 
Applies when P == 1 && U == 0 && W == 


VLDMDB{<c>}{<q>}{.<size>} <Rn>!, <dreglist> 


Increment After variant 
Applies when P == 0 && U == 


VLDM{<c>}{<q>}{.<size>} <Rn>{!}, <dreglist> 
VLDMIA{<c>}{<q>}{.<size>} <Rn>{!}, <dreglist> 


Decode for all variants of this encoding 


if P == '0' && U == '0' && W == 'O' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VLDR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = FALSE; add = (U == '1'); whack = (W == '1'); 

d = UInt(D:Vd); n = UInt(Rn); imm32 = ZeroExtend(imm8:'00', 32) 

regs = UInt(imm8) DIV 2; // If UInt(imm8) is odd, see "FLDM+X". 

if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == @ || regs > 16 || (d+regs) > 32 then UNPREDICTABLE; 

if imm8<0> == '1' && (d+regs) > 16 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as a VLDM with the same addressing mode but loads no registers. 


If regs > 16 || (d+regs) > 32, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
s The instruction executes as NOP. 
s One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 
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F6-5072 


A2 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12/1110 9 8|7 | 0| 
Cem [i ouwe] e | va oo me 


cond 


Decrement Before variant 
Applies when P == 1 && U == 0 && W == 


VLDMDB{<c>}{<q>}{.<size>} <Rn>!, <sreglist> 


Increment After variant 
Applies when P == 0 && U == 


VLDM{<c>}{<q>}{.<size>} <Rn>{!}, <sreglist> 
VLDMIA{<c>}{<q>}{.<size>} <Rn>{!}, <sreglist> 


Decode for all variants of this encoding 


if P == '0' && U == '0' && W == 'O' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VLDR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = TRUE; add = (U == '1'); whack = (W == '1'); d = UInt(Vd:D); n = UInt(Rn); 
imm32 = ZeroExtend(imm8:'00', 32); regs = UInt(imm8); 

if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == @ || (d+regs) > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as a VLDM with the same addressing mode but loads no registers. 


If (d+regs) > 32, then one of the following behaviors must occur: 


: The instruction is UNDEFINED. 
s The instruction executes as NOP. 
$ One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T1 

|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 | 1 0| 

111011 ofPlu[Djwit] Rn | va f1 oft 1| immss7:1> [o 

imm8<0> 
Decrement Before variant 
Applies when P == 1 & U == 0 && W == 
VLDMDB{<c>}{<q>}{.<size>} <Rn>!, <dreglist> 
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Increment After variant 
Applies when P == @ && U == 


VLDM{<c>}{<q>}{.<size>} <Rn>{!}, <dreglist> 
VLDMIA{<c>}{<q>}{.<size>} <Rn>{!}, <dreglist> 


Decode for all variants of this encoding 


if P == '0' && U == '0' && W == 'Q' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VLDR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = FALSE; add = (U == '1'); whack = (W == '1'); 

d = UInt(D:Vd); n = UInt(Rn); imm32 = ZeroExtend(imm8:'00', 32) 

regs = UInt(imm8) DIV 2; // If UInt(imm8) is odd, see "FLDM#X". 

if n == 15 && (whack || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == @ || regs > 16 || (d+regs) > 32 then UNPREDICTABLE; 

if imm8<@> == '1' && (d+regs) > 16 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as a VLDM with the same addressing mode but loads no registers. 


If regs > 16 || (d+regs) > 32, then one of the following behaviors must occur: 


a The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
è One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


T2 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 | 0| 


77047 oui, e | va popo me 


Decrement Before variant 
Applies when P == 1 && U == 0 && W == 


VLDMDB{<c>}{<q>}{.<size>} <Rn>!, <sreglist> 


Increment After variant 
Applies when P == 0 && U == 


VLDM{<c>}{<q>}{.<size>} <Rn>{!}, <sreglist> 
VLDMIA{<c>}{<q>}{.<size>} <Rn>{!}, <sreglist> 


Decode for all variants of this encoding 


if P == '0' && U == '0' && W == 'O' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VLDR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = TRUE; add = (U == '1'); whack = (W == '1'); d = UInt(Vd:D); n = UInt(Rn); 
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imm32 = ZeroExtend(imm8:'Q00', 32); regs = UInt(imm8); 
if n == 15 && (whack || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 
if regs == @ || (d+regs) > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as a VLDM with the same addressing mode but loads no registers. 


If (d+regs) > 32, then one of the following behaviors must occur: 


7 The instruction is UNDEFINED. 
è The instruction executes as NOP. 
g One or more of the SIMD and floating-point registers are UNKNOWN. If the instruction specifies writeback, 


the base register becomes UNKNOWN. This behavior does not affect any general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VLDM on page K1-7623. 


Related encodings: See Advanced SIMD and floating-point 64-bit move on page F3-3972 for the T32 instruction 
set, or Advanced SIMD and floating-point 64-bit move on page F4-4045 for the A32 instruction set. 


Alias conditions 





Alias is preferred when 


VPOP P == '0' && U == '1' && W == '1' && Rn == '1101' 





Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<size> An optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers 


being transferred. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. If writeback is not specified, the PC 
can be used. 


! Specifies base register writeback. Encoded in the "W" field as 1 if present, otherwise 0. 


<sreglist> Is the list of consecutively numbered 32-bit SIMD&FP registers to be transferred. The first register 
in the list is encoded in "Vd:D", and "imm8" is set to the number of registers in the list. The list must 
contain at least one register. 


<dreglist> Is the list of consecutively numbered 64-bit SIMD&FP registers to be transferred. The first register 
in the list is encoded in "D:Vd", and "imm8" is set to twice the number of registers in the list. The 
list must contain at least one register, and must not contain more than 16 registers. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
address = if add then R[n] else R[n]-imm32; 
for r = ð to regs-1 
if single_regs then 
S[d+r] = MemA[address,4]; address = address+4; 
else 
word1 = MemA[address,4]; word2 = MemA[address+4,4]; address = address+8; 
// Combine the word-aligned words in the correct order for current endianness. 
D[d+r] = if BigEndian() then word1:word2 else word2:word1; 
if wback then R[n] = if add then R[n]+imm32 else R[n]-imm32; 
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F6.1.106 


F6-5076 


VLDR (immediate) 


Load SIMD&FP register (immediate) loads a single register from the Advanced SIMD and floating-point register 
file, using an address from a general-purpose register, with an optional offset. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 





A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12|1110 9 8|7 | 0 | 
Cem [1 1 opopo] emm | va [ojs] imma | 
cond Rn 


Half-precision scalar variant 
Applies when size == 01. 


VLDR{<c>}{<q>}.16 <Sd>, [<Rn> {, #{+/-}<imm>}] 


Single-precision scalar variant 
Applies when size == 10. 


VLDR{<c>}{<q>}{.32} <Sd>, [<Rn> {, #{+/-}<imm>}] 


Double-precision scalar variant 
Applies when size == 11. 


VLDR{<c>}{<q>}{.64} <Dd>, [<Rn> {, #{+/-}<imm>}] 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

esize = 8 << UInt(size); add = (U == '1'); 

imm32 = if esize == 16 then ZeroExtend(imm8:'@', 32) else ZeroExtend(imm8:'Q0', 32); 
case size of 


when '@1' d = UInt(Vd:D); 

when '10' d = UInt(Vd:D); 

when '11' d = UInt(D:Vd); 
n = UInt(Rn); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


411074 opopo ann | va [i ose] imme —i 
Rn 
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Half-precision scalar variant 
Applies when size == 01. 


VLDR{<c>}{<q>}.16 <Sd>, [<Rn> {, #{+/-}<imm>}] 


Single-precision scalar variant 
Applies when size == 10. 


VLDR{<c>}{<q>}{.32} <Sd>, [<Rn> {, #{+/-}<imm>}] 


Double-precision scalar variant 
Applies when size == 11. 


VLDR{<c>}{<q>}{.64} <Dd>, [<Rn> {, #{+/-}<imm>}] 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == 'Q1' && InITBlock() then UNPREDICTABLE; 

esize = 8 << UInt(size); add = (U == '1'); 

imm32 = if esize == 16 then ZeroExtend(imm8:'Q', 32) else ZeroExtend(imm8:'Q0', 32); 
case size of 


when 'Q1' d = UInt(Vd:D); 

when '10' d = UInt(Vd:D); 

when '11' d = UInt(D:Vd); 
n = UInt(Rn); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

s The instruction is UNDEFINED. 

à The instruction executes as if it passes the Condition code check. 

: The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
.64 Is an optional data size specifier for 64-bit memory accesses that can be used in the assembler source 


code, but is otherwise ignored. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


32 Is an optional data size specifier for 32-bit memory accesses that can be used in the assembler source 
code, but is otherwise ignored. 


<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = 0 


+ when U = 1 
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<imm> For the single-precision scalar or double-precision scalar variants: is the optional unsigned 
immediate byte offset, a multiple of 4, in the range 0 to 1020, defaulting to 0, and encoded in the 
"imm8s" field as <imm>/4. 


For the half-precision scalar variant: is the optional unsigned immediate byte offset, a multiple of 2, 
in the range 0 to 510, defaulting to 0, and encoded in the "imm8" field as <imm>/2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
base = if n == 15 then Align(PC,4) else R[n]; 
address = if add then (base + imm32) else (base - imm32); 
case esize of 





when 16 
S[d] = Zeros(16) : MemA[address,2]; 
when 32 
S[d] = MemA[address,4]; 
when 64 
word1 = MemA[address,4]; word2 = MemA[address+4,4]; 
// Combine the word-aligned words in the correct order for current endianness. 
D[d] = if BigEndian() then word1:word2 else word2:word1; 


F6-5078 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.107 | VLDR (literal) 


Load SIMD&FP register (literal) loads a single register from the Advanced SIMD and floating-point register file, 
using an address from the PC value and an immediate offset. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 





A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12|1110 9 8|7 | 0 | 
Cem pioppi va [1 ojsze] imme 
cond Rn 


Half-precision scalar variant 
Applies when size == 01. 


VLDR{<c>}{<q>}.16 <Sd>, <label> 
VLDR{<c>}{<q>}.16 <Sd>, [PC, #{+/-}<imm>] 


Single-precision scalar variant 
Applies when size == 10. 


VLDR{<c>}{<q>}{.32} <Sd>, <label> 
VLDR{<c>}{<q>}{.32} <Sd>, [PC, #{+/-}<imm>] 


Double-precision scalar variant 
Applies when size == 11. 


VLDR{<c>}{<q>}{.64} <Dd>, <label> 
VLDR{<c>}{<q>}{.64} <Dd>, [PC, #{+/-}<imm>] 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

esize = 8 << UInt(size); add = (U == '1'); 

imm32 = if esize == 16 then ZeroExtend(imm8:'@', 32) else ZeroExtend(imm8:'Q0', 32); 
case size of 


when '@1' d = UInt(Vd:D); 

when '10' d = UInt(Vd:D); 

when '11' d = UInt(D:Vd); 
n = UInt(Rn); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
s The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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F6-5080 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12|11 10 9 8|7 | 0| 





17071 opipi va [1 ose] me —i 
Rn 


Half-precision scalar variant 


Applies when size == 01. 


VLDR{<c>}{<q>}.16 <Sd>, <label> 
VLDR{<c>}{<q>}.16 <Sd>, [PC, #{+/-}<imm>] 


Single-precision scalar variant 


Applies when size == 10. 


VLDR{<c>}{<q>}{.32} <Sd>, <label> 
VLDR{<c>}{<q>}{.32} <Sd>, [PC, #{+/-}<imm>] 


Double-precision scalar variant 


Applies when size == 11. 


VLDR{<c>}{<q>}{.64} <Dd>, <label> 
VLDR{<c>}{<q>}{.64} <Dd>, [PC, #{+/-}<imm>] 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && InITBlock() then UNPREDICTABLE; 

esize = 8 << UInt(size); add = (U == '1'); 

imm32 = if esize == 16 then ZeroExtend(imm8:'Q', 32) else ZeroExtend(imm8:'Q0', 32); 
case size of 


n= 


when '01' 
when '10' 
when '11' 
UInt(Rn); 


d = UInt(Vd:D); 
d = UInt(Vd:D); 
d = UInt(D:Vd); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


The instruction is UNDEFINED. 


The instruction executes as if it passes the Condition code check. 


The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<C> 


<q> 


.64 


<Dd> 


.32 


<Sd> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is an optional data size specifier for 64-bit memory accesses that can be used in the assembler source 
code, but is otherwise ignored. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Is an optional data size specifier for 32-bit memory accesses that can be used in the assembler source 
code, but is otherwise ignored. 


Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
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+/- 


<imm> 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


The label of the literal data item to be loaded. 


For the single-precision scalar or double-precision scalar variants: the assembler calculates the 
required value of the offset from the Align(PC, 4) value of the instruction to this label. Permitted 
values are multiples of 4 in the range -1020 to 1020. 


For the half-precision scalar variant: the assembler calculates the required value of the offset from 
the Align(PC, 4) value of the instruction to this label. Permitted values are multiples of 2 in the range 
-510 to 510. 


If the offset is zero or positive, imm32 is equal to the offset and add == TRUE. 

If the offset is negative, imm32 is equal to minus the offset and add == FALSE. 

Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 

- when U = 0 

+ when U = 1 

For the single-precision scalar or double-precision scalar variants: is the optional unsigned 


immediate byte offset, a multiple of 4, in the range 0 to 1020, defaulting to 0, and encoded in the 
"imm8s" field as <imm>/4. 


For the half-precision scalar variant: is the optional unsigned immediate byte offset, a multiple of 2, 
in the range 0 to 510, defaulting to 0, and encoded in the "imm8" field as <imm>/2. 


syntax permits the addition or subtraction of the offset and the immediate offset to be specified 


separately, including permitting a subtraction of 0 that cannot be specified using the normal syntax. For more 


information, se 


e Use of labels in UAL instruction syntax on page F1-3867. 


Operation for all encodings 


if ConditionP. 


assed() then 





EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
base = if n == 15 then Align(PC,4) else R[n]; 
address = if add then (base + imm32) else (base - imm32); 
case esize of 
when 16 
S[d] = Zeros(16) : MemA[address,2]; 
when 32 
S[d] = MemA[address,4]; 
when 64 
wordl = MemA[address,4]; word2 = MemA[address+4,4]; 
// Combine the word-aligned words in the correct order for current endianness. 
D[d] = if BigEndian() then word1l:word2 else word2:word1; 
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F6.1.108 VMAX (floating-point) 


Vector Maximum compares corresponding elements in two vectors, and copies the larger of each pair into the 
corresponding element in the destination vector. 


The operand vector elements are floating-point numbers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


T4770 0 1Jolopp]ofse] va | va porno vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMAX{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMAX{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
maximum = (op == 'Q'); 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aaao oplo vw | va pN o vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMAX{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMAX{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
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maximum = (op == 'Q'); 
case sz of 
when '@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 

° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Floating-point maximum and minimum 
° max(+0.0, -0.0) = +0.0 


s If any input is a NaN, the corresponding result element is the default NaN. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = 0 to elements-1 
op1 = Elem[D[n+r],e,esize]; op2 = Elem[D[m+r],e,esize] 
if maximum then 
Elem[D[d+r],e,esize] = FPMax(op1, op2, StandardFPSCRValue()); 
else 
Elem[D[d+r],e,esize] = FPMin(op1, op2, StandardFPSCRValue()); 
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F6.1.109 


F6-5084 


VMAX (integer) 


Vector Maximum compares corresponding elements in two vectors, and copies the larger of each pair into the 


corresponding element in the destination vector. 
The operand vector elements can be any one of: 
s 8-bit, 16-bit, or 32-bit signed integers. 

è 8-bit, 16-bit, or 32-bit unsigned integers. 


The result vector elements are the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 
111140 0 1JuUlojD]size}] vn | Vd [o 1 1 O|NJQiMjo} vm | 


op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VMAX{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VMAX{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

maximum = (op == '@'); unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


7 afuft 117 opse] va | va Jorr onoo] vm | 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VMAX{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VMAX{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

maximum = (op == '@'); unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = 0 to elements-1 

op1 = Int(Elem[D[n+r],e,esize], unsigned); 
op2 = Int(Elem[D[m+r],e,esize], unsigned); 
result = if maximum then Max(op1,op2) else Min(op1,op2); 
Elem[D[d+r],e,esize] = result<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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F6.1.110 VMAXNM 


This instruction determines the floating-point maximum number. 


It handles NaNs in consistence with the IEEE754-2008 specification. It returns the numerical operand when one 
operand is numerical and the other is a quiet NaN, but otherwise the result is identical to floating-point VMAX. 


This instruction is not conditional. 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


114100 1ļjijojojojs] vn | va |1 1 1 1[njajmji| vwm | 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 

VMAXNM{<q>}.<dt> <Dd>, <Dn>, <Dm> 

128-bit SIMD vector variant 

Applies when Q == 1. 

VMAXNM{<q>}.<dt> <Qd>, <Qn>, <Qm> 

Decode for all variants of this encoding 


if Q == '1' && (Vd<O> == '1' || Vn<O> == '1' || Vm<ð> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 


maximum = (op == 'Q'); 

advsimd = TRUE; 

case sz of 
when '@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 


d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


A2 
|31 30 29 28|27 26 25 24/23 22 21 20/19 16|15 12|11 10 9 8/7 6 5 4/3 0 | 
1114741170 1{dJo of vn | va [i of=oo|njojmjo] vm | 
size op 
Half-precision scalar variant 
Applies when size == 01. 
VMAXNM{<q>}.F16 <Sd>, <Sn>, <Sm> // Cannot be conditional 
Single-precision scalar variant 
Applies when size == 10. 
VMAXNM{<q>}.F32 <Sd>, <Sn>, <Sm> // Cannot be conditional 
Double-precision scalar variant 
Applies when size == 11. 
VMAXNM{<q>}.F64 <Dd>, <Dn>, <Dm> // Cannot be conditional 
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F6-5088 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
advsimd = FALSE; 

maximum = (op == 'Q'); 

case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 


when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0| 


11 ifia 1 1 1 ofdjofsz] vn | va f1 1 1 1fjnjalmji] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMAXNM{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMAXNM{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 


maximum = (op == '0'); 
advsimd = TRUE; 
case sz of 


when '@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
- The instruction executes as if it passes the Condition code check. 
e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
T2 

|15 14 13 12/1110 9 8|7 6 5 4/3 015 12/1110 9 8|7 6 5 4/3 0| 

1111111 01jpjoof vn | va f1 ofo0jnjofmjo] vm | 
size op 
Half-precision scalar variant 
Applies when size == 01. 
VMAXNM{<q>}.F16 <Sd>, <Sn>, <Sm> // Not permitted in IT block 
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Single-precision scalar variant 
Applies when size == 10. 


VMAXNM{<q>}.F32 <Sd>, <Sn>, <Sm> // Not permitted in IT block 


Double-precision scalar variant 
Applies when size == 11. 


VMAXNM{<q>}.F64 <Dd>, <Dn>, <Dm> // Not permitted in IT block 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
advsimd = FALSE; 
maximum = (op == 'Q'); 
case size of 
when 'Q@1' esize = 16; d 
when '10' esize = 32; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 


when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
CONSTRAINED UNPREDICTABLE behavior 
If InITBlock(), then one of the following behaviors must occur: 
š The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
$ The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 
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Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = @ to regs-1 
for e = Q to elements-1 
op1 = Elem[D[n+r], e, esize]; op2 = Elem[D[mtr], e, esize]; 
if maximum then 
Elem[D[d+r], e, esize] = FPMaxNum(op1, op2, StandardFPSCRValue()); 
else 
Elem[D[d+r], e, esize] = FPMinNum(op1, op2, StandardFPSCRValue()); 
else // NFP instruction 
case esize of 
when 16 
if maximum then 























S[d] = Zeros(16) : FPMaxNum(S[n]<15:@>, S[m]<15:0>, FPSCR); 
else 
S[d] = Zeros(16) : FPMinNum(S[n]<15:0>, S[m]<15:0>, FPSCR); 
when 32 
if maximum then 
S[d] = FPMaxNum(S[n], S[{m], FPSCR); 
else 
S[d] = FPMinNum(S[n], S[{m], FPSCR); 
when 64 
if maximum then 
D[d] = FPMaxNum(D[n], D[m], FPSCR); 
else 
D[d] = FPMinNum(D[n], D[m], FPSCR); 
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F6.1.111 VMIN (floating-point) 


ARM DDI 0487E.a 
ID070919 


Vector Minimum compares corresponding elements in two vectors, and copies the smaller of each pair into the 
corresponding element in the destination vector. 


The operand vector elements are floating-point numbers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


T4770 0 4foopo[tfe| va | va [+11 a[N[Q[wpo] vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMIN{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMIN{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
maximum = (op == 'Q'); 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aaao ophi v | va Noo vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMIN{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMIN{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
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F6-5092 


maximum = (op == 'Q'); 
case sz of 
when '@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 

° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Floating-point minimum 
. min(+0.0, -0.0) = -0.0 


s If any input is a NaN, the corresponding result element is the default NaN. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = 0 to elements-1 
op1 = Elem[D[n+r],e,esize]; op2 = Elem[D[m+r],e,esize] 
if maximum then 
Elem[D[d+r],e,esize] = FPMax(op1, op2, StandardFPSCRValue()); 
else 
Elem[D[d+r],e,esize] = FPMin(op1, op2, StandardFPSCRValue()); 
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F6.1.112  VMIN (integer) 


ARM DDI 0487E.a 
ID070919 


Vector Minimum compares corresponding elements in two vectors, and copies the smaller of each pair into the 
corresponding element in the destination vector. 


The operand vector elements can be any one of: 

s 8-bit, 16-bit, or 32-bit signed integers. 

è 8-bit, 16-bit, or 32-bit unsigned integers. 

The result vector elements are the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 
111100 1JuUlojD}size}] vn | Vd [o 1 1 ofjnjajļmji] vm | 


op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMIN{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMIN{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

maximum = (op == '@'); unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


7 afuft 711 opse] va | va Jorr onome vm _| 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VMIN{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VMIN{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
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F6-5094 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

maximum = (op == '@'); unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = 0 to elements-1 

op1 = Int(Elem[D[n+r],e,esize], unsigned); 
op2 = Int(Elem[D[m+r],e,esize], unsigned); 
result = if maximum then Max(op1,op2) else Min(op1,op2); 
Elem[D[d+r],e,esize] = result<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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F6.1.113 


F6-5096 


VMINNM 


This instruction determines the floating point minimum number. 


It handles NaNs in consistence with the IEEE754-2008 specification. It returns the numerical operand when one 
operand is numerical and the other is a quiet NaN, but otherwise the result is identical to floating-point VMIN. 


This instruction is not conditional. 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


114100 1ļjijojojijs] vn | va |1 1 1 1jnjajmji| vwm | 
op 


64-bit SIMD vector variant 

Applies when Q == 0. 

VMINNM{<q>}.<dt> <Dd>, <Dn>, <Dm> 

128-bit SIMD vector variant 

Applies when Q == 1. 

VMINNM{<q>}.<dt> <Qd>, <Qn>, <Qm> 

Decode for all variants of this encoding 


if Q == '1' && (Vd<O> == '1' || Vn<O> == '1' || Vm<ð> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 


maximum = (op == 'Q'); 

advsimd = TRUE; 

case sz of 
when '@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 


d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


A2 

|31 30 29 28|27 26 25 24/23 22 21 20/19 16|15 12|11 10 9 8|7 6 5 4/3 0| 

1114741170 1{dJo of vn | va [1 of=oo|n]ijmjo] vm | 
size op 
Half-precision scalar variant 
Applies when size == 01. 
VMINNM{<q>}.F16 <Sd>, <Sn>, <Sm> // Cannot be conditional 
Single-precision scalar variant 
Applies when size == 10. 
VMINNM{<q>}.F32 <Sd>, <Sn>, <Sm> // Cannot be conditional 
Double-precision scalar variant 
Applies when size == 11. 
VMINNM{<q>}.F64 <Dd>, <Dn>, <Dm> // Cannot be conditional 
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Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
advsimd = FALSE; 

maximum = (op == 'Q'); 

case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 


when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0| 


a ifiji 1 1 1 ofoft sz] vn | va fi 11 1fnjajmji] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMINNM{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMINNM{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 


maximum = (op == '0'); 
advsimd = TRUE; 
case sz of 


when '@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 

If InITBlock(), then one of the following behaviors must occur: 

s The instruction is UNDEFINED. 

- The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T2 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


141111110 rfojo of} vn | va f1 ofoojnjijmjo] vm | 


size op 


Half-precision scalar variant 
Applies when size == 01. 


VMINNM{<q>}.F16 <Sd>, <Sn>, <Sm> // Not permitted in IT block 
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F6-5098 


Single-precision scalar variant 
Applies when size == 10. 


VMINNM{<q>}.F32 <Sd>, <Sn>, <Sm> // Not permitted in IT block 


Double-precision scalar variant 
Applies when size == 11. 


VMINNM{<q>}.F64 <Dd>, <Dn>, <Dm> // Not permitted in IT block 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 
if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
advsimd = FALSE; 
maximum = (op == 'Q'); 
case size of 
when 'Q@1' esize = 16; d 
when '10' esize = 32; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 


when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
CONSTRAINED UNPREDICTABLE behavior 
If InITBlock(), then one of the following behaviors must occur: 
š The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
$ The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 
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Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = @ to regs-1 
for e = Q to elements-1 
op1 = Elem[D[n+r], e, esize]; op2 = Elem[D[mtr], e, esize]; 
if maximum then 
Elem[D[d+r], e, esize] = FPMaxNum(op1, op2, StandardFPSCRValue()); 
else 
Elem[D[d+r], e, esize] = FPMinNum(op1, op2, StandardFPSCRValue()); 
else // NFP instruction 
case esize of 
when 16 
if maximum then 























S[d] = Zeros(16) : FPMaxNum(S[n]<15:@>, S[m]<15:0>, FPSCR); 
else 
S[d] = Zeros(16) : FPMinNum(S[n]<15:0>, S[m]<15:0>, FPSCR); 
when 32 
if maximum then 
S[d] = FPMaxNum(S[n], S[{m], FPSCR); 
else 
S[d] = FPMinNum(S[n], S[{m], FPSCR); 
when 64 
if maximum then 
D[d] = FPMaxNum(D[n], D[m], FPSCR); 
else 
D[d] = FPMinNum(D[n], D[m], FPSCR); 
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F6.1.114 


F6-5100 


VMLA (floating-point) 


Vector Multiply Accumulate multiplies corresponding elements in two vectors, and accumulates the results into the 


elements of the destination vector. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and 


PE mode 


in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 
A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


T4770 0 1Jolo[plofse| va | va piorno vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLA{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLA{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
advsimd = TRUE; add = (op == 'Q'); 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


23 
4; 


UInt(M:Vm); regs = if Q == '0' then 1 else 2; 


A2 
|31 28|27 26 25 24|23 22 21 20|19 16115 12/1110 9 8|7 6 5 4/3 0| 
Cem [1171 ofo[pjo o] va | va [i o[swe[N]o[mjo] vm | 


cond op 


Half-precision scalar variant 
Applies when size == 01. 


VMLA{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VMLA{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VMLA{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 
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Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
advsimd = FALSE; add = (op == 'Q'); 
case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aaao olok vw | va pi oN v | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLA{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLA{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
advsimd = TRUE; add = (op == 'Q'); 
case sz of 
when 'Q' esize 
when '1' esize 
d = UInt(D:Vd); n 


32; elements 
16; elements 
UInt(N:Vn); m 


25 
4; 


UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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F6-5102 


T2 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


Ti 70717 0/o[p[o o] vw | va [i 0[sze[N[o[w[o[ vm 
op 


Half-precision scalar variant 
Applies when size == 01. 


VMLA{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VMLA{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VMLA{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
advsimd = FALSE; add = (op == 'Q'); 
case size of 
when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 

e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding A2, T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
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<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N: Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = 0 to regs-1 
for e = 0 to elements-1 
product = FPMul(Elem[D[ntr],e,esize], Elem[D[m+r],e,esize], StandardFPSCRValue()); 
addend = if add then product else FPNeg(product) ; 
Elem[D[d+r],e,esize] = FPAdd(Elem[D[d+r],e,esize], addend, StandardFPSCRValue()); 
else // NFP instruction 
case esize of 
when 16 
addend16 = if add then FPMul(S[n]<15:@>, S[m]<15:0>, FPSCR) else FPNeg(FPMul(S[n]<15:0>, 
S[m]<15:@>, FPSCR)); 
S[d] = Zeros(16) : FPAdd(S[d]<15:@>, addend16, FPSCR) 
when 32 
addend32 = if add then FPMul(S[n], S[m], FPSCR) else FPNeg(FPMul(S[n], S[m], FPSCR)); 
S[d] = FPAdd(S[d], addend32, FPSCR); 
when 64 
addend64 = if add then FPMul(D[n], D[m], FPSCR) else FPNeg(FPMul(D[n], D[m], FPSCR)); 
D[d] = FPAdd(D[d], addend64, FPSCR); 
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F6.1.115 


F6-5104 


VMLA (integer) 


Vector Multiply Accumulate multiplies corresponding elements in two vectors, and adds the products to the 
corresponding elements of the destination vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


T1770 0 1Joo[p[sze] vn | va [oorno] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLA{<c>}{<q>}.<type><size> <Dd>, <Dn>, <Dm> // Encoding T1/A1, encoded as Q = 0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLA{<c>}{<q>}.<type><size> <Qd>, <Qn>, <Qm> // Encoding T1/A1, encoded as Q = 1 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

add = (op == '0'); long_destination = FALSE; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


11 1 1 ofdfsize{ vn | va f1 0 0 1jnjajmjo] vm | 


op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLA{<c>}{<q>}.<type><size> <Dd>, <Dn>, <Dm> // Encoding T1/A1, encoded as Q = 0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLA{<c>}{<q>}.<type><size> <Qd>, <Qn>, <Qm> // Encoding T1/A1, encoded as Q = 1 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

add = (op == '0'); long_destination = FALSE; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 
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Assembler symbols 


<C> 


<q> 


<type> 


<size> 


<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


The data type for the elements of the operands. It must be one of: 


S Optional in encoding T1/A1. Encoded as U = 0 in encoding T2/A2. 
U Optional in encoding T1/A1. Encoded as U = 1 in encoding T2/A2. 
I Available only in encoding T1/A1. 


The data size for the elements of the operands. It must be one of: 


8 Encoded as size = 0b00. 
16 Encoded as size = 0b01. 
32 Encoded as size = 0b10. 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 


for e = 0 to elements-1 


product = Int(Elem[Din[n+r],e,esize],unsigned) « Int(Elem[Din[m+r] ,e,esize] ,unsigned) ; 
addend = if add then product else -product; 
if long_destination then 
Elem[Q[d>>1],e,2xesize] = Elem[Qin[d>>1],e,2sesize] + addend; 
else 
Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + addend; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


ARM DDI 0487E.a 
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The execution time of this instruction is independent of: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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F6.1.116 


F6-5106 


VMLA (by scalar) 


Vector Multiply Accumulate multiplies elements of a vector by a scalar, and adds the products to corresponding 


elements of the destination vector. 


For more information about scalars see Advanced SIMD scalars on page F2-3934. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16115 12|1110 9 8|7 6 5 4/3 o| 
1111001] w | va Joppolo vm | 


size op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLA{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm[x]> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLA{<c>}{<q>}.<dt> <Qd>, <Qn>, <Dm[x]> 


Decode for all variants of this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || (F == '1' && size == '01' && !HaveFP16Ext()) then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 

add = (op == '0'); floating_point = (F == '1'); long_destination = FALSE; 

d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 


if size == 'Q1' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0| 





size op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VMLA{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm[x]> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VMLA{<c>}{<q>}.<dt> <Qd>, <Qn>, <Dm[x]> 
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Decode for all variants of this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || (F == '1' && size == 'Q1' && !HaveFP16Ext()) then UNDEFINED; 

if F == '1' && size == 'Q1' && InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 

add = (op == '0'); floating_point = (F == '1'); long_destination = FALSE; 

d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 

if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 

Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 

Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the scalar and the elements of the operand vector, encoded in the "F:size" field. 
It can have the following values: 
116 when F = 0, size = 01 
132 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D:Vd" 
field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dd> Is the 64-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D: Vd" 
field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm[x]> Is the 64-bit name of the second SIMD&FP source register holding the scalar. If <dt> is 116 or F16, 


Dm is restricted to DO-D7. Dm is encoded in "Vm<2:0>", and x is encoded in "M:Vm<3>". If <dt> is 
132 or F32, Dm is restricted to DO-D15. Dm is encoded in "Vm", and x is encoded in "M". 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
op2 = Elem[Din[m],index,esize]; op2val = Int(op2, unsigned); 
for r = 0 to regs-1 
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for e = 0 to eleme 


op1 = Elem[Din[ 


if floating_po 
fp_addend 
FPNeg(FPMul (op1, op2 , Standar 


Elem[D[d+r] 


else 
addend = i 
if long_de 


nts-1 
ntr],e,esize]; oplval = Int(opl, unsigned); 
int then 
= if add then FPMul(op1,op2,StandardFPSCRValue()) else 
dFPSCRValue())); 


,e,esize] = FPAdd(Elem[Din[d+r],e,esize], fp_addend, StandardFPSCRValue()); 


f add then oplvalsop2val else -oplval«op2val; 
stination then 


Elem[Q[d>>1],e,2esize] = Elem[Qin[d>>1],e,2esize] + addend; 


else 





Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + addend; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of 


this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.117  VMLAL (integer) 


ARM DDI 0487E.a 
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Vector Multiply Accumulate Long multiplies corresponding elements in two vectors, and add the products to the 
corresponding element of the destination vector. The destination vector element is twice as long as the elements that 
are multiplied. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|3 0 | 
1111001] va | va [oojoo] vm _| 
size op 
A1 variant 


VMLAL{<c>}{<q>}.<type><size> <Qd>, <Dn>, <Dm> // Encoding T2/A2 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); long_destination = TRUE; unsigned = (U == '1'); 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





size op 


T1 variant 


VMLAL{<c>}{<q>}.<type><size> <Qd>, <Dn>, <Dm> // Encoding T2/A2 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); long_destination = TRUE; unsigned = (U == '1'); 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 


Notes for all encodings 
Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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F6-5110 


<type> The data type for the elements of the operands. It must be one of: 

S Optional in encoding T1/A1. Encoded as U = 0 in encoding T2/A2. 

U Optional in encoding T1/A1. Encoded as U = 1 in encoding T2/A2. 

I Available only in encoding T1/A1. 
<size> The data size for the elements of the operands. It must be one of: 

8 Encoded as size = 0b00. 

16 Encoded as size = 0b01. 

32 Encoded as size = 0b19. 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 
product = Int(Elem[Din[n+r],e,esize] ,unsigned) « Int(Elem[Din[m+r] ,e,esize] ,unsigned) ; 
addend = if add then product else -product; 
if long_destination then 
Elem[Q[d>>1],e,2xesize] = Elem[Qin[d>>1],e,2sesize] + addend; 
else 
Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + addend; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.118 | VMLAL (by scalar) 


ARM DDI 0487E.a 
ID070919 


Vector Multiply Accumulate Long multiplies elements of a vector by a scalar, and adds the products to 
corresponding elements of the destination vector. The destination vector elements are twice as long as the elements 
that are multiplied. 


For more information about scalars see Advanced SIMD scalars on page F2-3934. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|3 0 | 
1111001] w | va [oo oN Mo vm _| 
size op 
A1 variant 


VMLAL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm[x]> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || Vd<@> == '1' then UNDEFINED; 

unsigned = (U == '1'); add = (op == '@'); floating_point = FALSE; long_destination = TRUE; 
d = UInt(D:Vd); n = UInt(N:Vn); regs = 1; 


if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0 | 





size op 


T1 variant 


VMLAL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm[x]> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == 'QQ' || Vd<@> == '1' then UNDEFINED; 

unsigned = (U == '1'); add = (op == '@'); | floating_point = FALSE; long_destination = TRUE; 
d = UInt(D:Vd); n = UInt(N:Vn); regs = 1; 
if size == '01' then esize = 16; elements 
if size == '10' then esize = 32; elements 


UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
UInt(Vm); index = UInt(M); 


nou 
Ny 
SS 
oul 


Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<C> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
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For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the scalar and the elements of the operand vector, encoded in the "U:size" field. 
It can have the following values: 
S16 when U = 0, size = 01 
$32 when U = 0, size = 10 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 

<Qd> Is the 128-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D: Vd" 
field as <Qd>*2. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm[x]> Is the 64-bit name of the second SIMD&FP source register holding the scalar. If <dt> is $16 or U16, 


Dm is restricted to DO-D7. Dm is encoded in "Vm<2:0>", and x is encoded in "M:Vm<3>". If <dt> is 
$32 or U32, Dm is restricted to DO-D15. Dm is encoded in "Vm", and x is encoded in "M". 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
op2 = Elem[Din[m],index,esize]; op2val = Int(op2, unsigned); 
for r = Q to regs-1 
for e = 0 to elements-1 
op1 = Elem[Din[n+r],e,esize]; oplval = Int(opl, unsigned); 
if floating_point then 
fp_addend = if add then FPMul(op1,op2,StandardFPSCRValue()) else 
FPNeg(FPMul (op1,op2, StandardFPSCRValue())); 
Elem[D[d+r],e,esize] = FPAdd(Elem[Din[d+r],e,esize], fp_addend, StandardFPSCRValue()); 
else 
addend = if add then oplval«op2val else -oplval«op2val; 
if long_destination then 
Elem[Q[d>>1],e,2esize] = Elem[Qin[d>>1],e,2esize] + addend; 
else 





Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + addend; 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
7 The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.119  VMLS (floating-point) 


ARM DDI 0487E.a 
ID070919 


Vector Multiply Subtract multiplies corresponding elements in two vectors, subtracts the products from 
corresponding elements of the destination vector, and places the results in the destination vector. 


Note 


Arm recommends that software does not use the VMLS instruction in the Round towards Plus Infinity and Round 
towards Minus Infinity rounding modes, because the rounding of the product and of the sum can change the result 
of the instruction in opposite directions, defeating the purpose of these rounding modes. 








Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


T4770 0 1)ofopo[tfe| ve | va piorno vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLS{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLS{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
advsimd = TRUE; add = (op == 'Q'); 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 
31 28/27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 
[11 [1 1 1 ofo{pjo of vn | va [1 Ofsize{N]1}Mfo] vm | 


cond op 


Half-precision scalar variant 
Applies when size == 01. 


VMLS{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VMLS{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 
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Double-precision scalar variant 
Applies when size == 11. 


VMLS{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
advsimd = FALSE; add = (op == 'Q'); 
case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

à The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


|15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


oaao opii v | va oa ona vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLS{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLS{<c>}{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
advsimd = TRUE; add = (op == 'Q'); 
case sz of 
when 'Q' esize 
when '1' esize 
d = UInt(D:Vd); n 


32; elements 
16; elements 
UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 
$ The instruction executes as if it passes the Condition code check. 
` The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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T2 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 121110 9 8|7 6 5 4|3 0| 


Ti 70717 0joplo o] vw | va [i ofsini Mo] vm _| 
op 


Half-precision scalar variant 
Applies when size == 01. 


VMLS{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VMLS{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VMLS{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
advsimd = FALSE; add = (op == 'Q'); 
case size of 
when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 

e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding A2, T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
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<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N: Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = 0 to regs-1 
for e = 0 to elements-1 
product = FPMul(Elem[D[ntr],e,esize], Elem[D[m+r],e,esize], StandardFPSCRValue()); 
addend = if add then product else FPNeg(product) ; 
Elem[D[d+r],e,esize] = FPAdd(Elem[D[d+r],e,esize], addend, StandardFPSCRValue()); 
else // NFP instruction 
case esize of 
when 16 
addend16 = if add then FPMul(S[n]<15:@>, S[m]<15:0>, FPSCR) else FPNeg(FPMul(S[n]<15:0>, 
S[m]<15:@>, FPSCR)); 
S[d] = Zeros(16) : FPAdd(S[d]<15:@>, addend16, FPSCR) 
when 32 
addend32 = if add then FPMul(S[n], S[m], FPSCR) else FPNeg(FPMul(S[n], S[m], FPSCR)); 
S[d] = FPAdd(S[d], addend32, FPSCR); 
when 64 
addend64 = if add then FPMul(D[n], D[m], FPSCR) else FPNeg(FPMul(D[n], D[m], FPSCR)); 
D[d] = FPAdd(D[d], addend64, FPSCR); 
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F6.1.120  VMLS (integer) 


ARM DDI 0487E.a 
ID070919 


Vector Multiply Subtract multiplies corresponding elements in two vectors, and subtracts the products from the 
corresponding elements of the destination vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


T17700 i]1)0[o[sze] vn | va [oorno] wm 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLS{<c>}{<q>}.<type><size> <Dd>, <Dn>, <Dm> // Encoding T1/A1, encoded as Q = 0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLS{<c>}{<q>}.<type><size> <Qd>, <Qn>, <Qm> // Encoding T1/A1, encoded as Q = 1 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

add = (op == '0'); long_destination = FALSE; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


aja 111 ofp}sie] vn | va {1 0 0 1jnjajmjo] vm | 


op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLS{<c>}{<q>}.<type><size> <Dd>, <Dn>, <Dm> // Encoding T1/A1, encoded as Q = 0 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLS{<c>}{<q>}.<type><size> <Qd>, <Qn>, <Qm> // Encoding T1/A1, encoded as Q = 1 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

add = (op == '0'); long_destination = FALSE; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 
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Assembler symbols 


<C> 


<q> 


<type> 


<size> 


<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


The data type for the elements of the operands. It must be one of: 


S Optional in encoding T1/A1. Encoded as U = 0 in encoding T2/A2. 
U Optional in encoding T1/A1. Encoded as U = 1 in encoding T2/A2. 
I Available only in encoding T1/A1. 


The data size for the elements of the operands. It must be one of: 


8 Encoded as size = 0b00. 
16 Encoded as size = 0b01. 
32 Encoded as size = 0b10. 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 


for e = 0 to elements-1 


product = Int(Elem[Din[n+r],e,esize] ,unsigned) « Int(Elem[Din[m+r] ,e,esize] ,unsigned) ; 
addend = if add then product else -product; 
if long_destination then 
Elem[Q[d>>1],e,2xesize] = Elem[Qin[d>>1],e,2sesize] + addend; 
else 
Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + addend; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


F6-5118 


The execution time of this instruction is independent of: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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F6.1.121  VMLS (by scalar) 


ARM DDI 0487E.a 


ID070919 


Vector Multiply Subtract multiplies elements of a vector by a scalar, and either subtracts the products from 


corresponding elements of the destination vector. 


For more information about scalars see Advanced SIMD scalars on page F2-3934. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|1110 9 8|7 6 5 4|3 0| 
11110011H] va | va [ooN Mo vm _| 
size op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMLS{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm[x]> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMLS{<c>}{<q>}.<dt> <Qd>, <Qn>, <Dm[x]> 


Decode for all variants of this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || (F == '1' && size == '01' && !HaveFP16Ext()) then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 

add = (op == '0'); floating_point = (F == '1'); long_destination = FALSE; 

d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 


if size == 'Q1' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0| 





1 jaji 1 1 1 fof] vn | va Jolt fofF IN| t|mfo} vm | 


size op 


64-bit SIMD vector variant 

Applies when Q == 0. 
VMLS{<c>}{<q>}.<dt> <Dd>, <Dn>, <Dm[x]> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VMLS{<c>}{<q>}.<dt> <Qd>, <Qn>, <Dm[x]> 
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F6-5120 


Decode for all variants of this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || (F == '1' && size == 'Q1' && !HaveFP16Ext()) then UNDEFINED; 

if F == '1' && size == 'Q1' && InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 

add = (op == '0'); floating_point = (F == '1'); long_destination = FALSE; 

d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 

if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 

Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 

Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the scalar and the elements of the operand vector, encoded in the "F:size" field. 
It can have the following values: 
116 when F = 0, size = 01 
132 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D:Vd" 
field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dd> Is the 64-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D: Vd" 
field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm[x]> Is the 64-bit name of the second SIMD&FP source register holding the scalar. If <dt> is 116 or F16, 


Dm is restricted to DO-D7. Dm is encoded in "Vm<2:0>", and x is encoded in "M:Vm<3>". If <dt> is 
132 or F32, Dm is restricted to DO-D15. Dm is encoded in "Vm", and x is encoded in "M". 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
op2 = Elem[Din[m],index,esize]; op2val = Int(op2, unsigned); 
for r = 0 to regs-1 
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for e = 0 to eleme 


op1 = Elem[Din[ 


if floating_po 
fp_addend 
FPNeg(FPMul (op1, op2 , Standar 


Elem[D[d+r] 


else 
addend = i 
if long_de 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


nts-1 
ntr],e,esize]; oplval = Int(opl, unsigned); 
int then 
= if add then FPMul(op1,op2,StandardFPSCRValue()) else 
dFPSCRValue())); 


,e,esize] = FPAdd(Elem[Din[d+r],e,esize], fp_addend, StandardFPSCRValue()); 


f add then oplvalsop2val else -oplval«op2val; 
stination then 


Elem[Q[d>>1],e,2esize] = Elem[Qin[d>>1],e,2esize] + addend; 


else 





Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + addend; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of 


this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.122 


F6-5122 


VMLSL (integer) 


Vector Multiply Subtract Long multiplies corresponding elements in two vectors, and subtract the products from the 
corresponding elements of the destination vector. The destination vector element is twice as long as the elements 
that are multiplied. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|3 0| 
Tt 4100 tUtopen] va | va [4 o]t]0[NJo[mjo[ vm _| 
size op 
A1 variant 


VMLSL{<c>}{<q>}.<type><size> <Qd>, <Dn>, <Dm> // Encoding T2/A2 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); long_destination = TRUE; unsigned = (U == '1'); 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





size op 


T1 variant 


VMLSL{<c>}{<q>}.<type><size> <Qd>, <Dn>, <Dm> // Encoding T2/A2 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); long_destination = TRUE; unsigned = (U == '1'); 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 


Notes for all encodings 
Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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<type> The data type for the elements of the operands. It must be one of: 

S Optional in encoding T1/A1. Encoded as U = 0 in encoding T2/A2. 

U Optional in encoding T1/A1. Encoded as U = 1 in encoding T2/A2. 

I Available only in encoding T1/A1. 
<size> The data size for the elements of the operands. It must be one of: 

8 Encoded as size = 0b00. 

16 Encoded as size = 0b01. 

32 Encoded as size = 0b19. 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 
product = Int(Elem[Din[n+r],e,esize] ,unsigned) « Int(Elem[Din[m+r] ,e,esize] ,unsigned) ; 
addend = if add then product else -product; 
if long_destination then 
Elem[Q[d>>1],e,2xesize] = Elem[Qin[d>>1],e,2sesize] + addend; 
else 
Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + addend; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-5123 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.123 


F6-5124 


VMLSL (by scalar) 


Vector Multiply Subtract Long multiplies elements of a vector by a scalar, and subtracts the products from 
corresponding elements of the destination vector. The destination vector elements are twice as long as the elements 
that are multiplied. 


For more information about scalars see Advanced SIMD scalars on page F2-3934. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|3 0 | 
1111001] w | va [on oN Mo m _| 
size op 
A1 variant 


VMLSL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm[x]> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || Vd<@> == '1' then UNDEFINED; 

unsigned = (U == '1'); add = (op == '@'); floating_point = FALSE; long_destination = TRUE; 
d = UInt(D:Vd); n = UInt(N:Vn); regs = 1; 


if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0 | 





aoe ttt pen) va | va o o[N[t [myo vm _ 


size op 


T1 variant 


VMLSL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm[x]> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == 'QQ' || Vd<@> == '1' then UNDEFINED; 

unsigned = (U == '1'); add = (op == '@'); | floating_point = FALSE; long_destination = TRUE; 
d = UInt(D:Vd); n = UInt(N:Vn); regs = 1; 
if size == '01' then esize = 16; elements 
if size == '10' then esize = 32; elements 


UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
UInt(Vm); index = UInt(M); 


nou 
Ny 
SS 
oul 


Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<C> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
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For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the scalar and the elements of the operand vector, encoded in the "U:size" field. 
It can have the following values: 
S16 when U = 0, size = 01 
$32 when U = 0, size = 10 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 

<Qd> Is the 128-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D: Vd" 
field as <Qd>*2. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm[x]> Is the 64-bit name of the second SIMD&FP source register holding the scalar. If <dt> is $16 or U16, 


Dm is restricted to DO-D7. Dm is encoded in "Vm<2:0>", and x is encoded in "M:Vm<3>". If <dt> is 
$32 or U32, Dm is restricted to DO-D15. Dm is encoded in "Vm", and x is encoded in "M". 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
op2 = Elem[Din[m],index,esize]; op2val = Int(op2, unsigned); 
for r = Q to regs-1 
for e = 0 to elements-1 
op1 = Elem[Din[n+r],e,esize]; oplval = Int(opl, unsigned); 
if floating_point then 
fp_addend = if add then FPMul(op1,op2,StandardFPSCRValue()) else 
FPNeg(FPMul (op1,op2, StandardFPSCRValue())); 
Elem[D[d+r],e,esize] = FPAdd(Elem[Din[d+r],e,esize], fp_addend, StandardFPSCRValue()); 
else 
addend = if add then oplval«op2val else -oplval«op2val; 
if long_destination then 
Elem[Q[d>>1],e,2esize] = Elem[Qin[d>>1],e,2esize] + addend; 
else 





Elem[D[d+r],e,esize] = Elem[Din[d+r],e,esize] + addend; 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
7 The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.124 


F6-5126 


VMOV (between two general-purpose registers and a doubleword floating-point register) 


Copy two general-purpose registers to or from a SIMD&FP register copies two words from two general-purpose 
registers into a doubleword register in the Advanced SIMD and floating-point register file, or from a doubleword 


register in the Advanced SIMD and floating-point register file to two general-purpose registers. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 
Per [i700 oo| re | Rt [1 0]7 70 o[mi] vm | 


cond 


From general-purpose registers variant 
Applies when op == 0. 


VMOV{<c>}{<q>} <Dm>, <Rt>, <Rt2> 


To general-purpose registers variant 
Applies when op == 1. 
VMOV{<c>}{<q>} <Rt>, <Rt2>, <Dm> 
Decode for all variants of this encoding 
to_arm_registers = (op == '1'); t = UInt(Rt); t2 = UInt(Rt2); m = UInt(M:Vm); 


if t == 15 || t2 == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
if to_arm_registers && t == t2 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If to_arm_registers && t == t2, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
à The instruction executes as NOP. 
: The value in the destination register is UNKNOWN. 
T1 
|15 14 13 12|1110 9 8|7 6 5 4/3 0|15 12/11109 8|7 6 5 4/3 0 | 


77704700 oie Re | Rt [10/7 1/0 o[Mi] vm | 


From general-purpose registers variant 
Applies when op == 0. 

VMOV{<c>}{<q>} <Dm>, <Rt>, <Rt2> 

To general-purpose registers variant 
Applies when op == 1. 


VMOV{<c>}{<q>} <Rt>, <Rt2>, <Dm> 
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Decode for all variants of this encoding 
to_arm_registers = (op == '1'); t = UInt(Rt); t2 = UInt(Rt2); m = UInt(M:Vm); 


if t == 15 || t2 == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
if to_arm_registers && t == t2 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If to_arm_registers && t == t2, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
: The instruction executes as NOP. 
: The value in the destination register is UNKNOWN. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VMOV (between two general-purpose 
registers and a doubleword floating-point register) on page K1-7623. 


Assembler symbols 


<Dm> Is the 64-bit name of the SIMD&FP register to be transferred, encoded in the "M:Vm" field. 

<Rt2> Is the second general-purpose register that <Dm>[63:32] will be transferred to or from, encoded in the 
"Rt2" field. 

<Rt> Is the first general-purpose register that <Dm>[3 1:0] will be transferred to or from, encoded in the "Rt" 
field. 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
if to_arm_registers then 
R[t] = D[m]<31:0>; 
R[t2] = D[m]<63:32>; 
else 
D[m]<31:0> = R[t]; 
D[m]<63:32> = R[t2]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.125 


F6-5128 


VMOV (between general-purpose register and half-precision) 


Copy 16 bits of a general-purpose register to or from a 32-bit SIMD&FP register. This instruction transfers the value 
held in the bottom 16 bits of a 32-bit SIMD&FP register to the bottom 16 bits of a general-purpose register, or the 
value held in the bottom 16 bits of a general-purpose register to the bottom 16 bits of a 32-bit SIMD&FP register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 

ARMv8.2 

|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 
[ 11 [1 11000 obf vn | R [4 0 0 AIN{OfO 4 (Ooo) 


cond 


From general-purpose register variant 
Applies when op == 0. 
VMOV{<c>}{<q>}.F16 <Sn>, <Rt> 
To general-purpose register variant 
Applies when op == 1. 
VMOV{<c>}{<q>}.F16 <Rt>, <Sn> 
Decode for all variants of this encoding 
if !HaveFP16Ext() then UNDEFINED; 
if cond != '1110' then UNPREDICTABLE; 


to_arm_register = (op == '1'); t = UInt(Rt); n = UInt(Vn:N); 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 

If cond != '1110', then one of the following behaviors must occur: 

s The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 
ARMv8.2 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


TTT O77 1000 o| vw | R [100 NOO 


From general-purpose register variant 
Applies when op == 0. 


VMOV{<c>}{<q>}.F16 <Sn>, <Rt> 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


To general-purpose register variant 
Applies when op == 1. 


VMOV{<c>}{<q>}.F16 <Rt>, <Sn> 


Decode for all variants of this encoding 


if !HaveFP16Ext() then UNDEFINED; 

if InITBlock() then UNPREDICTABLE; 

to_arm_register = (op == '1'); t = UInt(Rt); n = UInt(Vn:N); 

if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<Rt> Is the general-purpose register that <Sn> will be transferred to or from, encoded in the "Rt" field. 
<Sn> Is the 32-bit name of the SIMD&FP register to be transferred, encoded in the "Vn:N" field. 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
if to_arm_register then 
R[t] = Zeros(16) : S[n]<15:@>; 
else 
S[n] = Zeros(16) : R[t]<15:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.126 


F6-5130 


VMOV (immediate) 


Copy immediate value to a SIMD&FP register places an immediate constant into every element of the destination 


register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12\11 8/7 6 5 4|3 0 | 
777100 tfi[t[o]o 0 of mms va [ox x ofojalo]i] mma 


cmode op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMOV{<c>}{<q>}.132 <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMOV{<c>}{<q>}.132 <Qd>, #<imm> 


Decode for all variants of this encoding 


if op == '@' && cmode<@> == '1' && cmode<3:2> != '11' then SEE "VORR (immediate)"; 

if op == '1' && cmode != '1110' then SEE "Related encodings"; 

if Q == '1' && Vd<@> == '1' then UNDEFINED; 

single_register = FALSE; advsimd = TRUE; imm64 = AdvSIMDExpandImm(op, cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


A2 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 
[ !=1111 |4 1 1 0 1fp]1 1| imm | va [1 ofsize (of ofoo] imma | 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VMOV{<c>}{<q>}.F16 <Sd>, #<imm> 


Single-precision scalar variant 
Applies when size == 10. 


VMOV{<c>}{<q>}.F32 <Sd>, #<imm> 


Double-precision scalar variant 
Applies when size == 11. 


VMOV{<c>}{<q>}.F64 <Dd>, #<imm> 
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Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

single_register = (size != '11'); advsimd = FALSE; 

bits(16) imm16; 

bits(32) imm32; 

bits(64) imm64; 

case size of 
when 'Q1' d = UInt(Vd:D); imm16 = VFPExpandImm(imm4H:imm4L); imm32 = Zeros(16) : imm16; 
when '10' d = UInt(Vd:D); imm32 = VFPExpandImm(imm4H:imm4L) ; 


when '11' d = UInt(D:Vd); imm64 = VFPExpandImm(imm4H:imm4L); regs = 1; 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

- The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


A3 


[31 30 29 28|27 26 25 24|23 22 21 20/1918  16|15 12|11 8|7 6 5 4|3 o| 


111100 1ļ|ifilojo o of imms | va [1 o x ojojajofi] imma | 


cmode op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMOV{<c>}{<q>}.116 <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMOV{<c>}{<q>}.116 <Qd>, #<imm> 


Decode for all variants of this encoding 


if op == '@' && cmode<@> == '1' && cmode<3:2> != '11' then SEE "VORR (immediate)"; 

if op == '1' && cmode != '1110' then SEE "Related encodings"; 

if Q == '1' && Vd<@> == '1' then UNDEFINED; 

single_register = FALSE; advsimd = TRUE; imm64 = AdvSIMDExpandImm(op, cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


A4 

|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12|11 8|7 6 5 4|3 0 | 

1411170 0 1ļijijojo o of imma | va [1 1 x xfofafo}1] imma | 
cmode op 
64-bit SIMD vector variant 
Applies when Q == 0. 
VMOV{<c>}{<q>}.<dt> <Dd>, #<imm> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VMOV{<c>}{<q>}.<dt> <Qd>, #<imm> 


Decode for all variants of this encoding 


if op == '@' && cmode<@> == '1' && cmode<3:2> != '11' then SEE "VORR (immediate)"; 

if op == '1' && cmode != '1110' then SEE "Related encodings"; 

if Q == '1' && Vd<@> == '1' then UNDEFINED; 

single_register = FALSE; advsimd = TRUE; imm64 = AdvSIMDExpandImm(op, cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == 'Q@' then 1 else 2; 


A5 
|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12\11 8/7 6 5 4|3 0 | 
77100 t[i[t[]o 0 Of mms va jra ojojo mm | 


cmode op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMOV{<c>}{<q>}.164 <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMOV{<c>}{<q>}.164 <Qd>, #<imm> 


Decode for all variants of this encoding 


if op == '@' && cmode<@> == '1' && cmode<3:2> != '11' then SEE "VORR (immediate)"; 

if op == '1' && cmode != '1110' then SEE "Related encodings"; 

if Q == '1' && Vd<@> == '1' then UNDEFINED; 

single_register = FALSE; advsimd = TRUE; imm64 = AdvSIMDExpandImm(op, cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 o |15 12|11 8|7 6 5 4|3 0 | 
[11 tfif1 114 1fpjo o of imma | va fo x x ofofafo[1] imma | 

cmode op 

64-bit SIMD vector variant 

Applies when Q == 0. 

VMOV{<c>}{<q>}.132 <Dd>, #<imm> 

128-bit SIMD vector variant 

Applies when Q == 1. 

VMOV{<c>}{<q>}.132 <Qd>, #<imm> 
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Decode for all variants of this encoding 


if op == '@' && cmode<@> == '1' && cmode<3:2> != '11' then SEE "VORR (immediate)"; 

if op == '1' && cmode != '1110' then SEE "Related encodings"; 

if Q == '1' && Vd<@> == '1' then UNDEFINED; 

single_register = FALSE; advsimd = TRUE; imm64 = AdvSIMDExpandImm(op, cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == 'Q@' then 1 else 2; 


T2 


[15 141312/11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


7704770 10]1 1] mman | va [1 [sie Oo Oo mma 


Half-precision scalar variant 
Applies when size == 01. 


VMOV{<c>}{<q>}.F16 <Sd>, #<imm> 


Single-precision scalar variant 
Applies when size == 10. 


VMOV{<c>}{<q>}.F32 <Sd>, #<imm> 


Double-precision scalar variant 
Applies when size == 11. 


VMOV{<c>}{<q>}.F64 <Dd>, #<imm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 
if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
single_register = (size != '11'); advsimd = FALSE; 
bits(16) imm16; 
bits(32) imm32; 
bits(64) imm64; 
case size of 
when 'Q1' d = UInt(Vd:D); imm16 = VFPExpandImm(imm4H:imm4L); imm32 = Zeros(16) : imm16; 
when '10' d = UInt(Vd:D); imm32 = VFPExpandImm(imm4H:imm4L) ; 
when '11' d = UInt(D:Vd); imm64 = VFPExpandImm(imm4H:imm4L); regs 


1; 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
° The instruction executes as if it passes the Condition code check. 


° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T3 


|15 14 13 1211110 9 8|7 6 5 4/3 2 0|15 12111 8|7 6 5 4|3 0| 


maaie oo o of mms | va fi 0 x oojoo] i| mma | 


cmode op 
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F6-5134 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMOV{<c>}{<q>}.116 <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMOV{<c>}{<q>}.116 <Qd>, #<imm> 


Decode for all variants of this encoding 


if op == '@' && cmode<@> == '1' && cmode<3:2> != '11' then SEE "VORR (immediate)"; 

if op == '1' && cmode != '1110' then SEE "Related encodings"; 

if Q == '1' && Vd<@> == '1' then UNDEFINED; 

single_register = FALSE; advsimd = TRUE; imm64 = AdvSIMDExpandImm(op, cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == 'Q@' then 1 else 2; 


T4 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 0O|15 12\11 8|7 6 5 4|3 0 | 


a afila 1 1 1 ajojo o of imma | va fr 1 x xjojajoji] imm | 


cmode op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMOV{<c>}{<q>}.<dt> <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMOV{<c>}{<q>}.<dt> <Qd>, #<imm> 


Decode for all variants of this encoding 


if op == '@' && cmode<@> == '1' && cmode<3:2> != '11' then SEE "VORR (immediate)"; 

if op == '1' && cmode != '1110' then SEE "Related encodings"; 

if Q == '1' && Vd<@> == '1' then UNDEFINED; 

single_register = FALSE; advsimd = TRUE; imm64 = AdvSIMDExpandImm(op, cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


T5 

|15 14 13 12|11 10 9 8|7 6 5 4|3 2 0 |15 12|11 8|7 6 5 4|3 0 | 

[14 alilia 1 1 fojo 0 of imma | va [1 1 1 ofofajiji] imma | 

cmode op 
64-bit SIMD vector variant 
Applies when Q == 0. 
VMOV{<c>}{<q>}.164 <Dd>, #<imm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
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VMOV{<c>}{<q>}.164 <Qd>, #<imm> 


Decode for all variants of this encoding 


if op == '@' && cmode<@> == '1' && cmode<3:2> != '11' then SEE "VORR (immediate)"; 

if op == '1' && cmode != '1110' then SEE "Related encodings"; 

if Q == '1' && Vd<@> == '1' then UNDEFINED; 

single_register = FALSE; advsimd = TRUE; imm64 = AdvSIMDExpandImm(op, cmode, i:imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 


Assembler symbols 


<c> For encoding A1, A3, A4 and A5: see Standard assembler syntax fields on page F2-3908. This 
encoding must be unconditional. 


For encoding A2, T1, T2, T3, T4 and T5: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> The data type, encoded in the "cmode" field. It can have the following values: 
132 when cmode = 110x 
I8 when cmode = 1110 
F32 when cmode = 1111 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<imm> For encoding A1, A3, A4, A5, T1, T3, T4 and TS: is a constant of the specified type that is replicated 


to fill the destination register. For details of the range of constants available and the encoding of 
<imm>, see Modified immediate constants in T32 and A32 Advanced SIMD instructions on 
page F2-3925. 


For encoding A2 and T2: is a signed floating-point constant with 3-bit exponent and normalized 4 
bits of precision, encoded in "imm4H:imm4L". For details of the range of constants available and 
the encoding of <imm>, see Modified immediate constants in T32 and A32 floating-point instructions 
on page F2-3926. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if single_register then 
S[d] = imm32; 
else 
for r = 0 to regs-1 
D[d+r] = imm64; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.127 VMOV (register) 


ARM DDI 0487E.a 
ID070919 


Copy between FP registers copies the contents of one FP register to another. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A2 
31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 
| ist [1 1 1 0 1[d]1 1fofo o of va [1 of1 xfol{i{mjo] vm | 


cond size 


Single-precision scalar variant 
Applies when size == 10. 


VMOV{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VMOV{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 
single_register = (size == '10'); advsimd = FALSE; 
if single_register then 
d = UInt(Vd:D); m = UInt(Vm:M); 
else 
d = UInt(D:Vd); m = UInt(M:Vm); regs = 1; 


T2 


|15 14 1312/1110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4/3 0 | 


1170117170 1{d]1 tfojo o of va [1 oft xjojijmjo] vm | 


size 


Single-precision scalar variant 
Applies when size == 10. 


VMOV{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VMOV{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
single_register = (size == '10'); advsimd = FALSE; 
if single_register then 
d = UInt(Vd:D); m = UInt(Vm:M); 
else 
d = UInt(D:Vd); m = UInt(M:Vm); regs = 1; 
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F6-5138 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if single_register then 
S[d] = S[m]; 
else 
for r = 0 to regs-1 
D{d+r] = D[m+r]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.128 | VMOV (register, SIMD) 


ARM DDI 0487E.a 
ID070919 


Copy between SIMD registers copies the contents of one SIMD register to another 


This instruction is an alias of the VORR (register) instruction. This means that: 


: The encodings in this description are named to match the encodings of VORR (register). 
è The description of VORR (register) gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


777100 tfofopoyi o] w | va jo oorno vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VMOV{<c>}{<q>}{.<dt>} <Dd>, <Dm> 

is equivalent to 

VORR{<c>}{<q>}{.<dt>} <Dd>, <Dm>, <Dm> 


and is the preferred disassembly when N:Vn == M:Vm. 


128-bit SIMD vector variant 

Applies when Q == 1. 
VMOV{<c>}{<q>}{.<dt>} <Qd>, <Qm> 

is equivalent to 

VORR{<c>}{<q>}{.<dt>} <Qd>, <Qm>, <Qm> 


and is the preferred disassembly when N:Vn == M:Vm. 
T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


11 tfoj1 1 1 1 ojoj of vn | va joo o 1fnjajmji] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VMOV{<c>}{<q>}{.<dt>} <Dd>, <Dm> 

is equivalent to 

VORR{<c>}{<q>}{.<dt>} <Dd>, <Dm>, <Dm> 


and is the preferred disassembly when N:Vn == M:Vm. 
128-bit SIMD vector variant 
Applies when Q == 1. 


VMOV{<c>}{<q>}{.<dt>} <Qd>, <Qm> 
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F6-5140 


is equivalent to 


VORR{<c>}{<q>}{.<dt>} <Qd>, <Qm>, <Qm> 


and is the preferred disassembly when N:Vn == M:Vm. 


Assembler symbols 


<C> 


<q> 
<dt> 
<Qd> 


<Qm> 


<Dd> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

An optional data type. <dt> must not be F64, but it is otherwise ignored. 

Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 128-bit name of the SIMD&FP source register, encoded in the "N:Vn" and "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Is the 64-bit name of the SIMD&FP source register, encoded in the "N: Vn" and "M:Vm" field. 


Operation for all encodings 


The description of VORR (register) gives the operational pseudocode for this instruction. 
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F6.1.129 | VMOV (general-purpose register to scalar) 


ARM DDI 0487E.a 
ID070919 


Copy a general-purpose register to a vector element copies a byte, halfword, or word from a general-purpose register 


into an Advanced SIMD scalar. 


On a Floating-point-only system, this instruction transfers one word to the upper or lower half of a double-precision 
floating-point register from a general-purpose register. This is an identical operation to the Advanced SIMD single 


word transfer. 


For more information about scalars see Advanced SIMD scalars on page F2-3934. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 
A1 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 


eri [i711 oojoo] va | R [10 7 1 Dlopez] 7 OOOO) 


cond 


A1 variant 
VMOV{<c>}{<q>}{.<size>} <Dd[x]>, <Rt> 
Decode for this encoding 


case opcl:opc2 of 
when '1xxx' advsimd 


TRUE; esize = 8; index = UInt(opcl<0>:opc2); 
when '@xx1' advsimd = TRUE; esize = 16; index = UInt(opcl<0>:opc2<1>); 
when 'Q@x@@' advsimd = FALSE; esize = 32; index = UInt(opcl<Q>); 

when 'Q@x10' UNDEFINED; 
d = UInt(D:Vd); t = UInt(Rt); 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 


111011 1 ofofopctfol va | R [1 0 1 1[D]opc2] 1 okoko 


T1 variant 


VMOV{<c>}{<q>}{.<size>} <Dd[x]>, <Rt> 


Decode for this encoding 


case opcl:opc2 of 
when '1xxx' advsimd = TRUE; esize = 8; index = UInt(opcl<@>:opc2); 
when '@xx1' advsimd = TRUE; esize = 16; index = UInt(opcl<Q>:opc2<1>); 
when 'Q@x@@' advsimd = FALSE; esize = 32; index = UInt(opcl<Q>); 
when '@x1@' UNDEFINED; 

d = UInt(D:Vd); t = UInt(Rt); 

if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 
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F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<size> The data size. It must be one of: 
8 Encoded as opc1<1> = 1. [x] is encoded in opc1<0>, opc2. 
16 Encoded as opcl<1> = 0, opc2<@> = 1. [x] is encoded in opcl<0>, opc2<1>. 
32 Encoded as opcl<1> = 0, opc2 = @b00. [x] is encoded in opc1<0>. 


omitted Equivalent to 32. 


<Dd[x]> The scalar. The register <Dd> is encoded in D: Vd. For details of how [x] is encoded, see the 
description of <size>. 


<Rt> The source general-purpose register. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
Elem[D[d],index,esize] = R[t]<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.130 | VMOV (between general-purpose register and single-precision) 


Copy a general-purpose register to or from a 32-bit SIMD&FP register. This instruction transfers the value held in 
a 32-bit SIMD&FP register to a general-purpose register, or the value held in a general-purpose register to a 32-bit 
SIMD&FP register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 2 1 0| 
Derm [i710 00 ofl va | Rt [10 7 oN OO TO 


cond 


From general-purpose register variant 
Applies when op == 0. 
VMOV{<c>}{<q>} <Sn>, <Rt> 
To general-purpose register variant 
Applies when op == 1. 
VMOV{<c>}{<q>} <Rt>, <Sn> 
Decode for all variants of this encoding 
to_arm_register = (op == '1'); t = UInt(Rt); n = UInt(Vn:N); 


if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0] 


1110111000 0p] vn | R f1 o1 oino 1 (OOo) 


From general-purpose register variant 
Applies when op == 0. 
VMOV{<c>}{<q>} <Sn>, <Rt> 
To general-purpose register variant 
Applies when op = 1. 
VMOV{<c>}{<q>} <Rt>, <Sn> 
Decode for all variants of this encoding 
to_arm_register = (op == '1'); t = UInt(Rt); n = UInt(Vn:N); 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 
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Assembler symbols 


<Rt> Is the general-purpose register that <Sn> will be transferred to or from, encoded in the "Rt" field. 
<Sn> Is the 32-bit name of the SIMD&FP register to be transferred, encoded in the "Vn:N" field. 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
if to_arm_register then 
R[t] = S[n]; 
else 
S[n] = R[t]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
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ARM DDI 0487E.a 


VMOV (scalar to general-purpose register) 


Copy a vector element to a general-purpose register with sign or zero extension copies a byte, halfword, or word 
from an Advanced SIMD scalar to a general-purpose register. Bytes and halfwords can be either zero-extended or 


sign-extended. 


On a Floating-point-only system, this instruction transfers one word from the upper or lower half of a 


double-precision floating-point register to a general-purpose register. This is an identical operation to the Advanced 


SIMD single word transfer. 


For more information about scalars see Advanced SIMD scalars on page F2-3934. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 16115 12|1110 9 8|7 6 5 4|3 21 0] 
cond 

A1 variant 


VMOV{<c>}{<q>}{.<dt>} <Rt>, <Dn[x]> 


Decode for this encoding 


case U:opcl:opc2 of 


when 'xlxxx' advsimd = TRUE; esize = 8; index = UInt(opcl<Q>:opc2); 
when 'x@xx1' advsimd = TRUE; esize = 16; index = UInt(opcl<Q>:opc2<1>); 
when '00x00' advsimd = FALSE; esize = 32; index = UInt(opcl<0>); 
when '10x00' UNDEFINED; 
when 'x@x10' UNDEFINED; 

t = UInt(Rt); n = UInt(N:Vn); unsigned = (U == '1'); 


if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 





T1 variant 


VMOV{<c>}{<q>}{.<dt>} <Rt>, <Dn[x]> 


Decode for this encoding 


case U:opcl:opc2 of 


when 'x1xxx' advsimd = TRUE; esize = 8; index = UInt(opcl<@>:opc2); 
when 'x@xx1' advsimd = TRUE; esize = 16; index = UInt(opcl<Q>:opc2<1>); 
when 'Q@Qx@@' advsimd = FALSE; esize = 32; index = UInt(opcl<Q>); 
when '10x00' UNDEFINED; 
when 'x@x10' UNDEFINED; 

t = UInt(Rt); n = UInt(N:Vn); unsigned = (U == '1'); 


if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
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Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<dt> The data type. It must be one of: 
S8 Encoded as U = 0, opc1<1> = 1. [x] is encoded in opc1<0>, opc2. 
S16 Encoded as U = 0, opc1<1> = 0, opc2<0> = 1. [x] is encoded in opc1<0>, opc2<1>. 
U8 Encoded as U = 1, opc1<1> = 1. [x] is encoded in opc1<0>, opc2. 
U16 Encoded as U = 1, opc1<1> = 0, opc2<@> = 1. [x] is encoded in opcl<@>, opc2<1>. 
32 Encoded as U = 0, opc1<1> = 0, opc2 = @b00. [x] is encoded in opc1<0>. 


omitted Equivalent to 32. 
<Rt> The destination general-purpose register. 


<Dn[x]> The scalar. For details of how [x] is encoded see the description of <dt>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if unsigned then 
R[t] = ZeroExtend(Elem[D[n],index,esize], 32); 
else 
R[t] = SignExtend(Elem[D[n],index,esize], 32); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.132 | VMOV (between two general-purpose registers and two single-precision registers) 


ARM DDI 0487E.a 
ID070919 


Copy two general-purpose registers to a pair of 32-bit SIMD&FP registers transfers the contents of two 
consecutively numbered single-precision Floating-point registers to two general-purpose registers, or the contents 
of two general-purpose registers to a pair of single-precision Floating-point registers. The general-purpose registers 
do not have to be contiguous. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16115 12/1110 9 8|7 6 5 4/3 0| 
Cem [i700 oo| Re | Rt o ojo oma vm | 


cond 


From general-purpose registers variant 
Applies when op == 0. 


VMOV{<c>}{<q>} <Sm>, <Sm1>, <Rt>, <Rt2> 


To general-purpose registers variant 
Applies when op = 1. 


VMOV{<c>}{<q>} <Rt>, <Rt2>, <Sm>, <Sm1> 


Decode for all variants of this encoding 


to_arm_registers = (op == '1'); t = UInt(Rt); t2 = UInt(Rt2); m = UInt(Vm:M); 
if t == 15 || t2 == 15 || m == 31 then UNPREDICTABLE; 
if to_arm_registers && t == t2 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If to_arm_registers && t == t2, then one of the following behaviors must occur: 


: The instruction is UNDEFINED. 
` The instruction executes as NOP. 
7 The value in the destination register is UNKNOWN. 


Ifm == 31, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
e The instruction executes as NOP. 
. One or more of the single-precision registers become UNKNOWN for a move to the single-precision register. 


The general-purpose registers listed in the instruction become UNKNOWN for a move from the 
single-precision registers. This behavior does not affect any other general-purpose registers. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


77704700 0/ifofel Re | Rt [1 0]7 0f0 o[mi] m | 
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F6-5148 


From general-purpose registers variant 
Applies when op == 0. 


VMOV{<c>}{<q>} <Sm>, <Sml>, <Rt>, <Rt2> 


To general-purpose registers variant 
Applies when op == 1. 
VMOV{<c>}{<q>} <Rt>, <Rt2>, <Sm>, <Sm1> 
Decode for all variants of this encoding 
to_arm_registers = (op == '1'); t = UInt(Rt); t2 = UInt(Rt2); m = UInt(Vm:M); 


if t == 15 || t2 == 15 || m == 31 then UNPREDICTABLE; 
if to_arm_registers && t == t2 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If to_arm_registers && t == t2, then one of the following behaviors must occur: 


à The instruction is UNDEFINED. 
G The instruction executes as NOP. 
è The value in the destination register is UNKNOWN. 


Ifm == 31, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
è The instruction executes as NOP. 
° One or more of the single-precision registers become UNKNOWN for a move to the single-precision register. 


The general-purpose registers listed in the instruction become UNKNOWN for a move from the 
single-precision registers. This behavior does not affect any other general-purpose registers. 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VMOV (between two general-purpose 
registers and two single-precision registers) on page K1-7623. 


Assembler symbols 


<Rt2> Is the second general-purpose register that <Sm1> will be transferred to or from, encoded in the "Rt2" 
field. 

<Rt> Is the first general-purpose register that <Sm> will be transferred to or from, encoded in the "Rt" field. 

<Sm1> Is the 32-bit name of the second SIMD&FP register to be transferred. This is the next SIMD&FP 
register after <Sm>. 

<Sm> Is the 32-bit name of the first SIMD&FP register to be transferred, encoded in the "Vm:M" field. 

<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
if to_arm_registers then 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


R[t] = S[m]; 

R[t2] = S[m+1]; 
else 

S[m] = R[t]; 

S[m+1] = R[t2]; 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 


a The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


z The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-5149 
ID070919 Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.133 


F6-5150 


VMOVL 


Vector Move Long takes each element in a doubleword vector, sign or zero-extends them to twice their original 
length, and places the results in a quadword vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 

|31 30 29 28|27 26 25 24/23 2221 |19 18 17 16|15 12\11109 8|7 6 5 4|3 0| 

[+1170 0 tuft fo] 000 [oo oO] va [101 ojojo] vm | 
imm3H 

A1 variant 


VMOVL{<c>}{<q>}.<dt> <Qd>, <Dm> 


Decode for this encoding 


if imm3H == '000' then SEE "Related encodings"; 

if imm3H != 'QQ1' && imm3H != 'Q10' && imm3H != '100' then SEE "VSHLL"; 
if Vd<@> == '1' then UNDEFINED; 

esize = 8 « UInt(imm3H); 

unsigned = (U == '1'); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 121110 9 8|7 6 5 |3 2 1 0\15 12/1110 9 8|7 6 5 4|3 0 | 


[11 tfuj1 1 1 1 14of 000 fo o of va f1 o 1 ojojojmji] vm | 


imm3H 


T1 variant 


VMOVL{<c>}{<q>}.<dt> <Qd>, <Dm> 


Decode for this encoding 


if imm3H == '000' then SEE "Related encodings"; 

if imm3H != 'QQ1' && imm3H != 'Q10' && imm3H != '100' then SEE "VSHLL"; 
if Vd<@> == '1' then UNDEFINED; 

esize = 8 « UInt(imm3H); 

unsigned = (U == '1'); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operand, encoded in the "U:imm3H" field. It can have the 
following values: 
S8 when U = Q, imm3H = 001 
S16 when U = 0, imm3H = 010 
S32 when U = 0, imm3H = 100 
U8 when U = 1, imm3H = 001 
U16 when U = 1, imm3H = 010 
U32 when U = 1, imm3H = 100 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for e = Q to elements-1 
result = Int(Elem[Din[m],e,esize], unsigned) ; 
Elem[Q[d>>1],e,2xesize] = result<2xesize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.134 


F6-5152 


VMOVN 


Vector Move and Narrow copies the least significant half of each element of a quadword vector into the 
corresponding elements of a doubleword vector. 


The operand vector elements can be any one of 16-bit, 32-bit, or 64-bit integers. There is no distinction between 
signed and unsigned integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instructions VRSHRN (zero) and VSHRN (zero). The pseudo-instruction is 
never the preferred disassembly. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 18 17 1615 12/1110 9 8|7 6 5 4/3 0 | 


77710077 10]1 isej of va Jojo 70 ojoo] vm | 


A1 variant 


VMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


Decode for this encoding 


if size == '11' then UNDEFINED; 
if Vm<@> == '1' then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


Tiiti117 40] isej of va Jojo ro ojojo] wm | 


T1 variant 


VMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


Decode for this encoding 


if size == '11' then UNDEFINED; 
if Vm<@> == '1' then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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<dt> Is the data type for the elements of the operand, encoded in the "size" field. It can have the following 
values: 
116 when size = 00 
132 when size = 01 
164 when size = 10 


The encoding size = 11 is reserved. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for e = Q to elements-1 
Elem[D[d],e,esize] = Elem[Qin[m>>1] ,e,2*esize]<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


. The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.135 


F6-5154 


VMOVX 


Vector Move extraction. This instruction copies the upper 16 bits of the 32-bit source SIMD&FP register into the 
lower 16 bits of the 32-bit destination SIMD&FP register, while clearing the remaining bits to zero. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
ARMV8.2 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


Tiititio 10000) va M o ojoo] vm _| 


A1 variant 


VMOVX{<q>}.F16 <Sd>, <Sm> 


Decode for this encoding 

if !HaveFP16Ext() then UNDEFINED; 

if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
d = UInt(Vd:D); m = UInt(Vm:M); 

T1 


ARMVv8.2 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4/3 0 | 


Tata tii101py110000) va 1 0]7 olomo] vm _| 


T1 variant 


VMOVX{<q>}.F16 <Sd>, <Sm> 


Decode for this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveFP16Ext() then UNDEFINED; 

if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
d = UInt(Vd:D); m = UInt(Vm:M); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
s The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
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<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
S[d] = Zeros(16) : S[m]<31:16>; 
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F6.1.136 


F6-5156 


VMRS 


Move SIMD&FP Special register to general-purpose register moves the value of an Advanced SIMD and 
floating-point System register to a general-purpose register. When the specified System register is the FPSCR, a 
form of the instruction transfers the FPSCR. {N, Z, C, V} condition flags to the APSR. {N, Z, C, V} condition flags. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


When these settings permit the execution of floating-point and Advanced SIMD instructions, if the specified 
floating-point System register is not the FPSCR, the instruction is UNDEFINED if executed in User mode. 


In an implementation that includes EL2, when HCR.TIDO is set to 1, any VMRS access to FPSID from a Non-secure 
EL1 mode that would be permitted if HCR.TIDO was set to 0 generates a Hyp Trap exception. For more information, 
see ID group 0, Primary device identification registers on page G1-5593. 


For simplicity, the VMRS pseudocode does not show the possible trap to Hyp mode. 





A1 

|31 28|27 26 25 24|23 22 21 20|19 16115 12|1110 9 8|7 6 5 4|3 2 14 0] 
cond 

A1 variant 


VMRS{<c>}{<q>} <Rt>, <spec_reg> 


Decode for this encoding 
t = UInt(Rt); 


if !(reg IN {'000x', '@101', '@11x', '1000'}) then UNPREDICTABLE; 
if t == 15 && reg != '0001' then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If !(reg IN {'Q00x', '0101', 'Q11x', '1000'}), then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
à The instruction transfers an UNKNOWN value to the specified target register. When the Rt field holds the value 


0b1111, the specified target register is the APSR. {N, Z, C, V} bits, and these bits become UNKNOWN. 
Otherwise, the specified target register is the register specified by the Rt field, RO - R14. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 2 1 0| 





T1 variant 


VMRS{<c>}{<q>} <Rt>, <spec_reg> 
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Decode for this encoding 
t = UInt(Rt); 


if !(reg IN {'000x', '@101', '@11x', '1000'}) then UNPREDICTABLE; 
if t == 15 && reg != '0001' then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If !(reg IN {'000x', 'Q101', 'Q11x', '1000'}), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
. The instruction transfers an UNKNOWN value to the specified target register. When the Rt field holds the value 


0b1111, the specified target register is the APSR. {N, Z, C, V} bits, and these bits become UNKNOWN. 
Otherwise, the specified target register is the register specified by the Rt field, RO - R14. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Rt> Is the general-purpose destination register, encoded in the "Rt" field. Is one of: 


RO-R14 General-purpose register. 
APSR_nzcv Permitted only when <spec_reg> is FPSCR. Encoded as 0b1111. The instruction transfers 
the FPSCR. {N, Z, C, V} condition flags to the APSR. {N, Z, C, V} condition flags. 


<spec_reg> Is the source Advanced SIMD and floating-point System register, encoded in the "reg" field. It can 
have the following values: 


FPSID when reg = 0000 
FPSCR when reg = 0001 
MVFR2 when reg = 0101 
MVFR1 when reg = 0110 
MVFRO when reg = 0111 
FPEXC when reg = 1000 


The following encodings are UNPREDICTABLE: 
$ reg = 001x. 
` reg = 0100. 
7 reg = 1001. 
s reg = 101x. 


: reg = 11xx. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
if reg == 'Q001' then // FPSCR 
CheckVFPEnabled(TRUE) ; 
if t == 15 then 
PSTATE.<N,Z,C,V> = FPSR.<N,Z,C,V>; 
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else 
R[t] = FPSCR; 

elsif PSTATE.EL == ELO then 

UNDEFINED; // Non-FPSCR registers accessible only at PL1 or above 
else 

CheckVFPEnabled(FALSE) ; // Non-FPSCR registers are not affected by FPEXC.EN 

AArch32.CheckAdvSIMDOrFPRegisterTraps(reg) ; 

case reg of 


when 'Q000' R[t] = FPSID; 
when 'Q101' R[t] = MVFR2; 
when 'Q110' R[t] = MVFR1; 
when '0111' R[t] = MVFRO; 
when '1000' R[t] = FPEXC; 
otherwise Unreachable(); // Dealt with above or in encoding-specific pseudocode 
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F6.1.137  VMSR 


ARM DDI 0487E.a 
ID070919 


Move general-purpose register to SIMD&FP Special register moves the value of a general-purpose register to a 
floating-point System register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


When these settings permit the execution of floating-point and Advanced SIMD instructions: 


° If the specified floating-point System register is FPSID or FPEXC, the instruction is UNDEFINED if executed 
in User mode. 


° If the specified floating-point System register is the FPSID and the instruction is executed in a mode other 
than User mode, the instruction is ignored. 


A1 

31 28|27 26 25 24|23 22 21 20|19 1615 12/1110 9 8|7 6 5 4|32 10 

Posi fa 11011 1jo] reg | R fi o1 0ko okoko ko] 
cond 

A1 variant 


VMSR{<c>}{<q>} <spec_reg>, <Rt> 


Decode for this encoding 
t = UInt(Rt); 


if reg != 'Q00x' && reg != '1000' then UNPREDICTABLE; 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 


CONSTRAINED UNPREDICTABLE behavior 


If reg != '000x' && reg != '1000', then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

à The instruction executes as NOP. 

° The instruction transfers the value in the general-purpose register to one of the allocated registers accessible 


using VMSR at the same Exception level. 
T1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12\11109 8|7 6 5 4/3 2 1 0| 


117071trort tol reg | R [1 01 ofofools (oof oor 


T1 variant 


VMSR{<c>}{<q>} <spec_reg>, <Rt> 


Decode for this encoding 


t = UInt(Rt); 
if reg != 'Q00x' && reg != '1000' then UNPREDICTABLE; 
if t == 15 then UNPREDICTABLE; // Armv8-A removes UNPREDICTABLE for R13 
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F6-5160 


CONSTRAINED UNPREDICTABLE behavior 


If reg != '000x' && reg != '1000', then one of the following behaviors must occur: 


The instruction is UNDEFINED. 


The instruction executes as NOP. 


The instruction transfers the value in the general-purpose register to one of the allocated registers accessible 


using VMSR at the same Exception level. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<spec_reg> Is the destination Advanced SIMD and floating-point System register, encoded in the "reg" field. It 
can have the following values: 
FPSID when reg = 0000 
FPSCR when reg = 0001 
FPEXC when reg = 1000 
The following encodings are UNPREDICTABLE: 
d reg = 001x. 
s reg = 01xx. 
: reg = 1001. 
d reg = 101x. 
bd reg = 11xx. 
<Rt> Is the general-purpose source register, encoded in the "Rt" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); 
if reg == '0001' then 
CheckVFPEnabled(TRUE) ; 
FPSCR = R[t]; 
elsif PSTATE.EL == ELO then 
UNDEFINED; 
else 
CheckVFPEnabled(FALSE) ; 
case reg of 
when '0000' 
when '1000' FPEXC = R[t]; 
otherwise Unreachable(); 


// FPSCR 


// Non-FPSCR registers accessible only at PL1 or above 
// Non-FPSCR registers are not affected by FPEXC.EN 
// \MSR access to FPSID is ignored 


// Dealt with above or in encoding-specific pseudocode 
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F6.1.138 | VMUL (floating-point) 


ARM DDI 0487E.a 
ID070919 


Vector Multiply multiplies corresponding elements in two vectors, and places the results in the destination vector. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


11100 1jijojolols] vn | va fi 1 0 1fnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMUL{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMUL{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
advsimd = TRUE; 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


25 
4; 


UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


A2 
|31 28|27 26 25 24|23 22 21 20|19 16115 12/1110 9 8|7 6 5 4/3 0| 
Cem [i771 oop o] va | va [i ojs [njom o] vm 


cond 


Half-precision scalar variant 
Applies when size == 01. 
VMUL{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 
Single-precision scalar variant 


Applies when size == 10. 


VMUL{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VMUL{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 
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Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == 'Q1' && cond != '1110' then UNPREDICTABLE; 

advsimd = FALSE; 


case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
CONSTRAINED UNPREDICTABLE behavior 
If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
: The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
T1 
|15 14 13 12|1110 9 8|7 6 5 4/3 0|15 12/1110 9 8|7 6 5 4/3 0 | 


apt 717 oplo va | va a one vm 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMUL{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMUL{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if sz == '1' && InITBlock() then UNPREDICTABLE; 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
advsimd = TRUE; 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
$ The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


Ti 70717 0/ojo[1 o] vn | va [i 0[sze[N[o[w[o] vm 


Half-precision scalar variant 


Applies when size == 01. 


VMUL{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 


Single-precision scalar variant 


Applies when size == 10. 


VMUL{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 


Applies when size == 11. 


VMUL{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 


Decode for all variants of this encoding 


if size == '01' && InITBlock() then UNPREDICTABLE; 

if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
advsimd = FALSE; 


case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
CONSTRAINED UNPREDICTABLE behavior 
If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


The instruction is UNDEFINED. 
The instruction executes as if it passes the Condition code check. 


The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 


<Qn> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding A2, T1 and T2: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 


values: 
F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
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F6-5164 


<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N: Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = 0 to regs-1 
for e = 0 to elements-1 
Elem[D[d+r],e,esize] = FPMul(Elem[D[n+r],e,esize], Elem[D[m+r],e,esize], 
StandardFPSCRValue()); 


else // NFP instruction 
case esize of 

when 16 
S[d] = Zeros(16) : FPMul(S[n]<15:0>, S[m]<15:0>, FPSCR) 

when 32 
S[d] = FPMul(S[n], S[m], FPSCR); 

when 64 
D[d] = FPMul(D[n], D[m], FPSCR); 
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F6.1.139  VMUL (integer and polynomial) 


ARM DDI 0487E.a 
ID070919 


Vector Multiply multiplies corresponding elements in two vectors. 
For information about multiplying polynomials see Polynomial arithmetic over {0, 1} on page A1-50. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


[111100 tfopfojofsize] vn | va fi o 0 1fnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMUL{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMUL{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if size == '11' || (op == '1' && size != '00') then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 
polynomial = (op == '1'); long_destination = FALSE; 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


maae opse] vw | va poorno vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMUL{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMUL{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if size == '11' || (op == '1' && size != '00') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 
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F6-5166 


polynomial = (op == '1'); long_destination = FALSE; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Notes for all encodings 
For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "op:size" field. It can have the 
following values: 
I8 when op = Q, size = 00 
116 when op = 0, size = 01 
132 when op = @, size = 10 
P8 when op = 1, size = 00 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
op1 = Elem[Din[n+r],e,esize]; oplval = Int(opl, unsigned); 
op2 = Elem[Din[m+r],e,esize]; op2val = Int(op2, unsigned); 
if polynomial then 
product = PolynomialMult(op1,op2); 
else 
product = (oplval«op2val)<2«esize-1:0>; 
if long_destination then 
Elem[Q[d>>1],e,2xesize] = product; 
else 
Elem[D[d+r],e,esize] = product<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.140 


F6-5168 


VMUL (by scalar) 


Vector Multiply multiplies each element in a vector by a scalar, and places the results in a second vector. 


For more information about scalars see Advanced SIMD scalars on page F2-3934. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 
[111400 1jajlijo]en]| vn | va f1 o ofFIN{1{mMjo] vm | 


size 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMUL{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm>[<index>] 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMUL{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm>[<index>] 


Decode for all variants of this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || (F == '1' && size == '01' && !HaveFP16Ext()) then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 
floating_point = (F == '1'); long_destination = FALSE; 

d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 


if size == 'Q1' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0 | 





maajaa pen] va | va _[1 0 oF Mo vm _ 


size 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMUL{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm>[<index>] 


128-bit SIMD vector variant 
Applies when Q == 1. 
VMUL{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm>[<index>] 
Decode for all variants of this encoding 
if size == '11' then SEE "Related encodings"; 


if F == '1' && size == 'Q1' && InITBlock() then UNPREDICTABLE; 
if size == '00' || (F == '1' && size == '01' && !HaveFP16Ext()) then UNDEFINED; 
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if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1') then UNDEFINED; 

unsigned = FALSE; // "Don't care" value: TRUE produces same functionality 

floating_point = (F == '1'); long_destination = FALSE; 

d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 

if size == 'Q1' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
$ The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 

Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 

Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the scalar and the elements of the operand vector, encoded in the "F:size" field. 
It can have the following values: 
116 when F = 0, size = 01 
132 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register. When <dt> is 116 or F16, this is encoded 


in the "Vm<2:0>" field. Otherwise it is encoded in the "Vm" field. 


<index> Is the element index. When <dt> is 116 or F16, this is in the range 0 to 3 and is encoded in the 
"M:Vm<3>" field. Otherwise it is in the range 0 to | and is encoded in the "M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
op2 = Elem[Din[m],index,esize]; op2val = Int(op2, unsigned); 
for r = ð to regs-1 
for e = 0 to elements-1 
opl = Elem[Din[n+r],e,esize]; oplval = Int(opl, unsigned); 
if floating_point then 
Elem[D[d+r],e,esize] = FPMul(op1, op2, StandardFPSCRValue()); 
else 
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if long_destination then 

Elem[Q[d>>1],e,2esize] = (oplval«op2val)<2*esize-1:0>; 
else 

Elem[D[d+r],e,esize] = (oplval«op2val)<esize-1:0>; 
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F6.1.141  VMULL (integer and polynomial) 


ARM DDI 0487E.a 
ID070919 


Vector Multiply Long multiplies corresponding elements in two vectors. The destination vector elements are twice 


as long as the elements that are multiplied. 


For information about multiplying polynomials see Polynomial arithmetic over {0, 1} on page A1-50. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12\11109 8|7 6 5 4|3 0| 
T14100 tuple] va | va [4 tfopfo[No[mjo[ vm _| 
size 
A1 variant 


VMULL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 
unsigned = (U == '1'); polynomial = (op == '1'); long_destination = TRUE; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
if polynomial then 
if U == '1' || size == 'Q@1' then UNDEFINED; 
if size == '10' then // «p64 
if !HaveBit128PMULLExt() then UNDEFINED; 
esize = 64; elements = 1; 
if Vd<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 


aaao en] va | va [1 tponfo[N[o[mpo[ vm 


size 


T1 variant 


VMULL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 
unsigned = (U == '1'); polynomial = (op == '1'); long_destination = TRUE; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
if polynomial then 
if U == '1' || size == '@1' then UNDEFINED; 
if size == '10' then // «p64 
if InITBlock() then UNPREDICTABLE; 
if !HaveBit128PMULLExt() then UNDEFINED; 
esize = 64; elements = 1; 
if Vd<@> == '1' then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = 1; 
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CONSTRAINED UNPREDICTABLE behavior 


Ifop == '1' && size == '10' && InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 
Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "op:U:size" field. It can have the 
following values: 
S8 when op = 0, U = 0, size = 00 
S16 when op = 0, U = 0, size = 01 
S32 when op = 0, U = 0, size = 10 
U8 when op = 0, U = 1, size = 00 
U16 when op = 0, U = 1, size = 01 
U32 when op = 0, U = 1, size = 10 
P8 when op = 1, U = 0, size = 00 
P64 when op = 1, U = 0, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = 0 to elements-1 
opl = Elem[Din[n+r],e,esize]; oplval = Int(opl, unsigned); 
op2 = Elem[Din[m+r],e,esize]; op2val = Int(op2, unsigned); 
if polynomial then 
product = PolynomialMult(op1,op2) ; 
else 
product = (oplval«op2val)<2«esize-1:0>; 
if long_destination then 
Elem[Q[d>>1],e,2xesize] = product; 
else 
Elem[D[d+r],e,esize] = product<esize-1:0>; 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.142 


F6-5174 


VMULL (by scalar) 


Vector Multiply Long multiplies each element in a vector by a scalar, and places the results in a second vector. The 
destination vector elements are twice as long as the elements that are multiplied. 


For more information about scalars see Advanced SIMD scalars on page F2-3934. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12\11109 8|7 6 5 4|3 0| 
Tt 4100 t[utpopen] ve | va [+07 oN Mo vm | 
size 
A1 variant 


VMULL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm>[<index>] 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == 'QQ' || Vd<@> == '1' then UNDEFINED; 

unsigned = (U == '1'); Jlong_destination = TRUE; floating_point = FALSE; 
d = UInt(D:Vd); n = UInt(N:Vn); regs = 1; 


if size == 'Q1' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0| 
1 alufa i 1 1 ajojen] vn | va [1 0 1 o[N[i[mMjo] vm | 
size 
T1 variant 


VMULL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm>[<index>] 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 
if size == '00' || Vd<@> == '1' then UNDEFINED; 
unsigned = (U == '1'); Jlong_destination = TRUE; floating_point = FALSE; 
d = UInt(D:Vd); n = UInt(N:Vn); regs = 1; 

if size == '01' then esize = 16; elements = 4; m 
if size == '10' then esize = 32; elements = 2; m 


UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
UInt(Vm); index = UInt(M); 


Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the scalar and the elements of the operand vector, encoded in the "U:size" field. 
It can have the following values: 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Vm<2:0>" field when 


<dt> is S16 or U16, otherwise the "Vm" field. 


<index> Is the element index in the range 0 to 3, encoded in the "M:Vm<3>" field when <dt> is S16 or U16, 
otherwise in range 0 to 1, encoded in the "M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
op2 = Elem[Din[m],index,esize]; op2val = Int(op2, unsigned); 
for r = 0 to regs-1 
for e = Q to elements-1 
op1 = Elem[Din[n+r],e,esize]; oplval = Int(opl, unsigned); 
if floating_point then 
Elem[D[d+r],e,esize] = FPMul(op1, op2, StandardFPSCRValue()); 
else 
if long_destination then 
Elem[Q[d>>1],e,2esize] = (oplval«op2val)<2«esize-1:0>; 
else 





Elem[D[d+r],e,esize] = (oplval«op2val)<esize-1:0>; 
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F6.1.143 


F6-5176 


VMVN (immediate) 


Vector Bitwise NOT (immediate) places the bitwise inverse of an immediate integer constant into every element of 
the destination register. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12\11 8/7 6 5 4|3 0 | 
77100 t[i[t[oJo oo] mms | va Jo x x ojojo i| mm 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMVN{<c>}{<q>}.132 <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMVN{<c>}{<q>}.132 <Qd>, #<imm> 


Decode for all variants of this encoding 


if (cmode<@> == '1' && cmode<3:2> != '11') || cmode<3:1> == '111' then SEE "Related encodings"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 

imm64 = AdvSIMDExpandImm('1', cmode, i: imm3:imm4) ; 

d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


A2 
|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12\11 8/7 6 5 4|3 0 | 
77100 tfi[t[o]o 0 of mms | va [ox ojojo mm | 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMVN{<c>}{<q>}.116 <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMVN{<c>}{<q>}.116 <Qd>, #<imm> 


Decode for all variants of this encoding 


if (cmode<@> == '1' && cmode<3:2> != '11') || cmode<3:1> == '111' then SEE "Related encodings”; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 

imm64 = AdvSIMDExpandImm('1', cmode, i:imm3:imm4) ; 

d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 
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A3 
|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12\11 8|7 6 5 4|3 0 | 
77100 tfi[t[o]o 0 oO] mms va_[1 10 xfojali]i] imma 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMVN{<c>}{<q>}.132 <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMVN{<c>}{<q>}.132 <Qd>, #<imm> 


Decode for all variants of this encoding 
if (cmode<@> == '1' && cmode<3:2> != '11') || cmode<3:1> == '111' then SEE "Related encodings”; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


imm64 = AdvSIMDExpandImm('1', cmode, i: imm3:imm4) ; 
d = UInt(D:Vd);_ regs = if Q == 'Q@' then 1 else 2; 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 o5 12111 8|7 6 5 4|3 0| 


aaie oo o of mms | va fo x x ojojo | mma 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMVN{<c>}{<q>}.132 <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMVN{<c>}{<q>}.132 <Qd>, #<imm> 


Decode for all variants of this encoding 


if (cmode<@> == '1' && cmode<3:2> != '11') || cmode<3:1> == '111' then SEE "Related encodings”; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 

imm64 = AdvSIMDExpandImm('1', cmode, i: imm3:imm4) ; 

d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


T2 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 0 |15 12|11 8|7 6 5 4|3 0 | 
aap + +t o of mms | va [10 x oloja i] imma _| 
cmode 
64-bit SIMD vector variant 
Applies when Q == 0. 
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F6-5178 


VMVN{<c>}{<q>}.116 <Dd>, #<imm> 


128-bit SIMD vector variant 


Applies when Q == 1. 


VMVN{<c>}{<q>}.116 <Qd>, #<imm> 


Decode for all variants of this encoding 


if (cmode<@> == '1' && cmode<3:2> != '11') || cmode<3:1> == '111' then SEE "Related encodings"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 

imm64 = AdvSIMDExpandImm('1', cmode, i:imm3:imm4) ; 

d = UInt(D:Vd); regs = if Q == 'Q@' then 1 else 2; 


T3 


|15 141312/11109 8/7 6 5 4/3 2 0|15 12\11 8|7 6 5 4|3 0 | 


apt 717 oe oo] mms | va ao foja e imma 


cmode 


64-bit SIMD vector variant 


Applies when Q == 0. 


VMVN{<c>}{<q>}.132 <Dd>, #<imm> 


128-bit SIMD vector variant 


Applies when Q == 1. 


VMVN{<c>}{<q>}.132 <Qd>, #<imm> 


Decode for all variants of this encoding 


if (cmode<@> == '1' && cmode<3:2> != '11') || cmode<3:1> == '111' then SEE "Related encodings"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 

imm64 = AdvSIMDExpandImm('1', cmode, i:imm3:imm4) ; 

d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 


set. 


Assembler symbols 


<C> 


<q> 
<Qd> 
<Dd> 


<imm> 


For encoding A1, A2 and A3: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Is a constant of the specified type that is replicated to fill the destination register. For details of the 
range of constants available and the encoding of <imm>, see Modified immediate constants in T32 
and A32 Advanced SIMD instructions on page F2-3925. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
D[d+r] = NOT(imm64) ; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.144 VMVN (register) 


Vector Bitwise NOT (register) takes a value from a register, inverts the value of each bit, and places the result in the 
destination register. The registers can be either doubleword or quadword. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 


11770077 1)0[1 isejo of va [oli oriomo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VMVN{<c>}{<q>}{.<dt>} <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VMVN{<c>}{<q>}{.<dt>} <Qd>, <Qm> 


Decode for all variants of this encoding 
if size != '00' then UNDEFINED; 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


Tiiti117 to] isejo o] va Jo oriomo] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 

VMVN{<c>}{<q>}{.<dt>} <Dd>, <Dm> 

128-bit SIMD vector variant 

Applies when Q == 1. 

VMVN{<c>}{<q>}{.<dt>} <Qd>, <Qm> 

Decode for all variants of this encoding 
if size != '00' then UNDEFINED; 


if Q == '1' && (Vd<O> == '1' || Vm<ð> == '1') then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
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For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> An optional data type. It is ignored by assemblers, and does not affect the encoding. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
D[d+r] = NOT(D[m+r]); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.145 VNEG 


Vector Negate negates each element in a vector, and places the results in a second vector. The floating-point version 
only inverts the sign bit. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 


Ti 770077 1p isejo] va Joje emo] vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VNEG{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VNEG{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

advsimd = TRUE; floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 
31 28|27 26 25 24/23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 
[11 [1 1 10 1{D]1 tfojo o 1] va [1 Ofsizefo]1jmMfo} vm | 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VNEG{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VNEG{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VNEG{<c>}{<q>}.F64 <Dd>, <Dm> 
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Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
advsimd = FALSE; 
case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 





7414777 ph sejo] va oje 1 eMo] v _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VNEG{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VNEG{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if F == '1' && ((size == 'Q1' && !HaveFP16Ext()) || size == '00') then UNDEFINED; 
if F == '1' && size == 'Q1' && InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<O@> == '1' || Vm<@> == '1') then UNDEFINED; 

advsimd = TRUE; floating_point = (F == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


IfF == '1' && size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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F6-5184 


T2 


|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|15 12/1109 8|7 6 5 4|3 0| 


111011101 ooon] va [1 ojs jomo] vm 


Half-precision scalar variant 
Applies when size == 01. 


VNEG{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VNEG{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VNEG{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 
advsimd = FALSE; 
case size of 
when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 

e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding A2, T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "F:size" field. It can have the 
following values: 
S8 when F = Q, size = 00 
S16 when F = 0, size = 01 
$32 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
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<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = 0 to regs-1 
for e = Q to elements-1 
if floating_point then 
Elem[D[d+r],e,esize] = FPNeg(Elem[D[m+r] ,e,esize] ); 
else 
result = -SInt(Elem[D[m+r],e,esize]); 
Elem[D[d+r],e,esize] = result<esize-1:0>; 
else // NFP instruction 
case esize of 
when 16 S[d] = Zeros(16) : FPNeg(S[m]<15:0>); 
when 32 S[d] = FPNeg(S[m]); 
when 64 D[d] = FPNeg(D[m]); 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
ê The execution time of this instruction is independent of: 

— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.146 VNMLA 


F6-5186 


Vector Negate Multiply Accumulate multiplies together two floating-point register values, adds the negation of the 
floating-point value in the destination register to the negation of the product, and writes the result back to the 


destination register. 


Note 





Arm recommends that software does not use the VNMLA instruction in the Round towards Plus Infinity and Round 
towards Minus Infinity rounding modes, because the rounding of the product and of the sum can change the result 


of the instruction in opposite directions, defeating the purpose of these rounding modes. 





Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12\11109 8|7 6 5 4/3 


o| 


Cem [i171 ojoppjo 1] va | va [1 oswe fN] 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VNMLA{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VNMLA{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VNMLA{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'QQ0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 

vtype = if op == '1' then VFPNegMul_VNMLA else VFPNegMul_VNMLS; 
case size of 


Tmo. wm 
op 


when 'Q@1' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
CONSTRAINED UNPREDICTABLE behavior 
If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 121110 9 8|7 6 5 4|3 0| 


1110111 oopen] vw | va [i ofsini] vm _| 
op 


Half-precision scalar variant 
Applies when size == 01. 


VNMLA{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VNMLA{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VNMLA{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 
if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
vtype = if op == '1' then VFPNegMul_VNMLA else VFPNegMul_VNMLS; 
case size of 
when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 

e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
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Operation for all encodings 
enumeration VFPNegMul {VFPNegMul_VNMLA, VFPNegMu1_VNMLS, VFPNegMul_VNMUL}; 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 
when 16 
product16 = FPMul(S[n]<15:@>, S[m]<15:0>, FPSCR); 
case vtype of 











when VFPNegMul_VNMLA S[d] = Zeros(16) : FPAdd(FPNeg(S[d]<15:0>), FPNeg(product16) 
FPSCR) ; 
when VFPNegMul_VNMLS S[d] = Zeros(16) : FPAdd(FPNeg(S[d]<15:0>), product16, FPSCR); 
when VFPNegMul_VNMUL S[d] = Zeros(16) : FPNeg(product16) ; 
when 32 
product32 = FPMul(S[n], S[m], FPSCR); 
case vtype of 
when VFPNegMul_VNMLA S[d] = FPAdd(FPNeg(S[d]), FPNeg(product32), FPSCR) 
when VFPNegMul_VNMLS S[d] = FPAdd(FPNeg(S[d]), product32, FPSCR); 
when VFPNegMul_VNMUL S[d] = FPNeg(product32); 
when 64 
product64 = FPMul(D[n], D[m], FPSCR); 
case vtype of 
when VFPNegMul_VNMLA D[d] = FPAdd(FPNeg(D[d]), FPNeg(product64), FPSCR) 
when VFPNegMul_VNMLS D[d] = FPAdd(FPNeg(D[d]), product64, FPSCR); 
when VFPNegMul_VNMUL D[d] = FPNeg(product64) ; 
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F6.1.147 VNMLS 


Vector Negate Multiply Subtract multiplies together two floating-point register values, adds the negation of the 
floating-point value in the destination register to the product, and writes the result back to the destination register. 


ARM DDI 0487E.a 
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Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11109 8|7 6 5 4/3 0 | 
Perm [i771 oopen] va | va [i ojs [Njom o] vm 


cond op 


Half-precision scalar variant 
Applies when size == 01. 


VNMLS{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VNMLS{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VNMLS{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 
if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
vtype = if op == '1' then VFPNegMul_VNMLA else VFPNegMul_VNMLS; 
case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == '01' & cond != '1110', then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11109 8|7 6 5 4/3 0 | 


1110111 ofofpjo1{ vn | va [14 ofsize|Nfo[mjo] vm | 
op 
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Half-precision scalar variant 
Applies when size == 01. 


VNMLS{<c>}{<q>}.F16 <Sd>, <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VNMLS{<c>}{<q>}.F32 <Sd>, <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VNMLS{<c>}{<q>}.F64 <Dd>, <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q00' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == 'Q1' && InITBlock() then UNPREDICTABLE; 

vtype = if op == '1' then VFPNegMul_VNMLA else VFPNegMul_VNMLS; 
case size of 


when '01' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 

when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 

when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
CONSTRAINED UNPREDICTABLE behavior 
If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 
s The instruction executes as if it passes the Condition code check. 
è The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
Assembler symbols 
<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 
enumeration VFPNegMul {VFPNegMul_VNMLA, VFPNegMu1_VNMLS, VFPNegMul_VNMUL}; 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 
when 16 
product16 = FPMul(S[n]<15:@>, S[m]<15:0>, FPSCR); 
case vtype of 
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when VFPNegMul_VNMLA S[d] = Zeros(16) : FPAdd(FPNeg(S[d]<15:0>), FPNeg(product16) 
FPSCR) ; 
when VFPNegMul_VNMLS S[d] = Zeros(16) : FPAdd(FPNeg(S[d]<15:0>), product16, FPSCR); 
when VFPNegMul_VNMUL S[d] = Zeros(16) : FPNeg(product16); 
when 32 
product32 = FPMul(S[n], S[m], FPSCR); 
case vtype of 
when VFPNegMul_VNMLA S[d] = FPAdd(FPNeg(S[d]), FPNeg(product32), FPSCR) 
when VFPNegMul_VNMLS S[d] = FPAdd(FPNeg(S[d]), product32, FPSCR); 
when VFPNegMul_VNMUL S[d] = FPNeg(product32); 
when 64 
product64 = FPMul(D[n], D[m], FPSCR); 
case vtype of 
when VFPNegMul_VNMLA D[d] = FPAdd(FPNeg(D[d]), FPNeg(product64), FPSCR) 
when VFPNegMul_VNMLS D[d] = FPAdd(FPNeg(D[d]), product64, FPSCR); 
when VFPNegMul_VNMUL D[d] = FPNeg(product64) ; 
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F6.1.148 


F6-5192 


VNMUL 


Vector Negate Multiply multiplies together two floating-point register values, and writes the negation of the result 
to the destination register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12\11109 8|7 6 5 4/3 0 | 
Derm [i771 oop of va | va [i ojs NMO] vm 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VNMUL{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VNMUL{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VNMUL{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != '00' then UNDEFINED; 
if size == '01' && !HaveFP16Ext() then UNDEFINED; 
if size == '01' && cond != '1110' then UNPREDICTABLE; 
vtype = VFPNegMul_VNMUL ; 
case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11109 8|7 6 5 4/3 0 | 


1101 1 1 ofojoft of vn | va fr ofsize |N]t]Mfo] vm | 
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Half-precision scalar variant 
Applies when size == 01. 


VNMUL{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VNMUL{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VNMUL{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q00' then UNDEFINED; 
if size == '01' && !HaveFP16Ext() then UNDEFINED; 

if size == 'Q1' && InITBlock() then UNPREDICTABLE; 

vtype = VFPNegMul_VNMUL ; 

case size of 


when 'Q@1' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 

when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 

when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
CONSTRAINED UNPREDICTABLE behavior 
If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 
s The instruction executes as if it passes the Condition code check. 
è The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
Assembler symbols 
<C> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 
<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 
enumeration VFPNegMul {VFPNegMul_VNMLA, VFPNegMu1_VNMLS, VFPNegMul_VNMUL}; 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 
when 16 
product16 = FPMul(S[n]<15:@>, S[m]<15:0>, FPSCR); 
case vtype of 
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when VFPNegMul_VNMLA S[d] = Zeros(16) : FPAdd(FPNeg(S[d]<15:0>), FPNeg(product16) 
FPSCR) ; 
when VFPNegMul_VNMLS S[d] = Zeros(16) : FPAdd(FPNeg(S[d]<15:0>), product16, FPSCR); 
when VFPNegMul_VNMUL S[d] = Zeros(16) : FPNeg(product16); 
when 32 
product32 = FPMul(S[n], S[m], FPSCR); 
case vtype of 
when VFPNegMul_VNMLA S[d] = FPAdd(FPNeg(S[d]), FPNeg(product32), FPSCR) 
when VFPNegMul_VNMLS S[d] = FPAdd(FPNeg(S[d]), product32, FPSCR); 
when VFPNegMul_VNMUL S[d] = FPNeg(product32); 
when 64 
product64 = FPMul(D[n], D[m], FPSCR); 
case vtype of 
when VFPNegMul_VNMLA D[d] = FPAdd(FPNeg(D[d]), FPNeg(product64), FPSCR) 
when VFPNegMul_VNMLS D[d] = FPAdd(FPNeg(D[d]), product64, FPSCR); 
when VFPNegMul_VNMUL D[d] = FPNeg(product64) ; 
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F6.1.149 VORN (immediate) 


ARM DDI 0487E.a 
ID070919 


Vector Bitwise OR NOT (immediate) performs a bitwise OR between a register value and the complement of an 
immediate value, and returns the result into the destination vector 


This instruction is a pseudo-instruction of the VORR (immediate) instruction. This means that: 


$ The encodings in this description are named to match the encodings of VORR (immediate). 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
. The description of VORR (immediate) gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24/23 22 21 20|1918 16ļ15 12111 8|7 6 5 4|3 0| 
1111001 ipeo o| mms | va [ox x ifola}o[t] mma 
cmode 


64-bit SIMD vector variant 

Applies when Q == 0. 

VORN{<c>}{<q>}.116 {<Dd>,} <Dd>, #<imm> 
is equivalent to 

VORR{<c>}{<q>}.116 <Dd>, #~<imm> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 

VORN{<c>}{<q>}.116 {<Qd>,} <Qd>, #<imm> 
is equivalent to 

VORR{<c>}{<q>}.116 <Qd>, #~<imm> 


and is never the preferred disassembly. 


A2 

|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12|11 8|7 6 5 4|3 0 | 

111400 t]i{1[DJo o of imma | va [1 o x tfolafo[1] imma | 
cmode 
64-bit SIMD vector variant 
Applies when Q == 0. 
VORN{<c>}{<q>}.132 {<Dd>,} <Dd>, #<imm> 
is equivalent to 
VORR{<c>}{<q>}.132 <Dd>, #~<imm> 
and is never the preferred disassembly. 
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F6-5196 


128-bit SIMD vector variant 

Applies when Q == 1. 

VORN{<c>}{<q>}.132 {<Qd>,} <Qd>, #<imm> 
is equivalent to 

VORR{<c>}{<q>}.132 <Qd>, #~<imm> 


and is never the preferred disassembly. 


T1 
|15 14 13 12|11 10 9 8|7 65 4|3 2 O15 12111 8/7 6 5 4]3 o| 
oae o oo] mms] va Jo x x ioje] ma 
cmode 
64-bit SIMD vector variant 
Applies when Q == 0. 
VORN{<c>}{<q>}.116 {<Dd>,} <Dd>, #<imm> 
is equivalent to 
VORR{<c>}{<q>}.116 <Dd>, #~<imm> 
and is never the preferred disassembly. 
128-bit SIMD vector variant 
Applies when Q == 1. 
VORN{<c>}{<q>}.116 {<Qd>,} <Qd>, #<imm> 
is equivalent to 
VORR{<c>}{<q>}.116 <Qd>, #~<imm> 
and is never the preferred disassembly. 
T2 
|15 14 13 12|11 10 9 8/7 65 4/3 2 0115 12111 8|7 6 5 4|3 o| 
Moa o oo] mms] va [10x joao] ma 
cmode 
64-bit SIMD vector variant 
Applies when Q == 0. 
VORN{<c>}{<q>}.132 {<Dd>,} <Dd>, #<imm> 
is equivalent to 
VORR{<c>}{<q>}.132 <Dd>, #~<imm> 
and is never the preferred disassembly. 
128-bit SIMD vector variant 
Applies when Q = 1. 
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VORN{<c>}{<q>}.132 {<Qd>,} <Qd>, #<imm> 
is equivalent to 
VORR{<c>}{<q>}.132 <Qd>, #~<imm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<imm> Is a constant of the specified type that is replicated to fill the destination register. For details of the 


range of constants available and the encoding of <imm>, see Modified immediate constants in T32 
and A32 Advanced SIMD instructions on page F2-3925. 


Operation for all encodings 


The description of VORR (immediate) gives the operational pseudocode for this instruction. 
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F6.1.150 


F6-5198 


VORN (register) 


Vector bitwise OR NOT (register) performs a bitwise OR NOT operation between two registers, and places the 
result in the destination register. The operand and result registers can be quadword or doubleword. They must all be 


the same size. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


77100 tfojopoyi 7] vw | va joo orno vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VORN{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VORN{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


1 ajoji 1 1 1 ofpji 1| wn | va jooo 1jnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VORN{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VORN{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<0> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 


d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
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For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> An optional data type. It is ignored by assemblers, and does not affect the encoding. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N: Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
D[d+r] = D[n+r] OR NOT(D[m+r]); 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.151 VORR (immediate) 


F6-5200 


Vector Bitwise OR (immediate) performs a bitwise OR between a register value and an immediate value, and returns 


the result into the destination vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instruction VORN (immediate). The pseudo-instruction is never the preferred 


disassembly. 

A1 

|31 30 29 28|27 26 25 24/23 22 21 20|1918  16|15 12111 8|7 6 5 4|3 0| 
mirror o) mma] va Jo xx ijojajo | mma _| 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VORR{<c>}{<q>}.132 {<Dd>,} <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VORR{<c>}{<q>}.132 {<Qd>,} <Qd>, #<imm> 


Decode for all variants of this encoding 


if cmode<@> == '@' || cmode<3:2> == '11' then SEE "VMOV (immediate)"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 

imm64 = AdvSIMDExpandImm('@', cmode, i:imm3:imm4) ; 

d = UInt(D:Vd); regs = if Q == 'Q@' then 1 else 2; 


A2 
|31 30 29 28|27 26 25 24/23 22 2120/1918  16|15 12111 8|7 6 5 4|3 0| 
mana oonji ioeo o) mms | va j 0x t[o[alo]i] mma 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VORR{<c>}{<q>}.116 {<Dd>,} <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VORR{<c>}{<q>}.116 {<Qd>,} <Qd>, #<imm> 


Decode for all variants of this encoding 


if cmode<@> == '@' || cmode<3:2> == '11' then SEE "VMOV (immediate)"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 

imm64 = AdvSIMDExpandImm('@', cmode, i:imm3:imm4) ; 

d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 0O|15 12/11 8|7 6 5 4|3 0 | 


apt 717 oo 0 of mms | va [ox x t[ojaloli] mma 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VORR{<c>}{<q>}.132 {<Dd>,} <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VORR{<c>}{<q>}.132 {<Qd>,} <Qd>, #<imm> 


Decode for all variants of this encoding 
if cmode<@> == '@' || cmode<3:2> == '11' then SEE "VMOV (immediate)"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 


imm64 = AdvSIMDExpandImm('@', cmode, i: imm3:imm4) ; 
d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


T2 


|15 141312/11109 8/7 6 5 4/3 2 0|15 12\11 8/7 6 5 4|3 0 | 


apt 717 oo 0 of mms [va ji 0 x t[oalo]i] mm 


cmode 


64-bit SIMD vector variant 
Applies when Q == 0. 


VORR{<c>}{<q>}.116 {<Dd>,} <Dd>, #<imm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VORR{<c>}{<q>}.116 {<Qd>,} <Qd>, #<imm> 


Decode for all variants of this encoding 


if cmode<@> == '@' || cmode<3:2> == '11' then SEE "VMOV (immediate)"; 
if Q == '1' && Vd<@> == '1' then UNDEFINED; 

imm64 = AdvSIMDExpandImm('@', cmode, i:imm3:imm4) ; 

d = UInt(D:Vd); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<C> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
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F6-5202 


<imm> Is a constant of the specified type that is replicated to fill the destination register. For details of the 
range of constants available and the encoding of <imm>, see Modified immediate constants in T32 


and A32 Advanced SIMD instructions on page F2-3925. 


The I8, 164, and F32 data types are permitted as pseudo-instructions, if the immediate can be represented by this 


instruction, and are encoded using a permitted encoding of the 116 or 132 data type. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
D[d+r] = D[d+r] OR imm64; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.152 VORR (register) 


Vector bitwise OR (register) performs a bitwise OR operation between two registers, and places the result in the 
destination register. The operand and result registers can be quadword or doubleword. They must all be the same 
size. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instructions VMOV (register, SIMD), VRSHR (zero), and VSHR (zero). The 
pseudo-instruction is never the preferred disassembly. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


77100 tfofopp]7 o] wa | va jooon vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 

VORR{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 

VORR{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12\11109 8|7 6 5 4/3 0 | 


1 ijoja 1 1 1 ofoft of vn | va joo o 1fnjajmji] vm | 


64-bit SIMD vector variant 

Applies when Q = 0. 

VORR{<c>}{<q>}{.<dt>} {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q = 1. 

VORR{<c>}{<q>}{.<dt>} {<Qd>,} <Qn>, <Qm> 
Decode for all variants of this encoding 


if Q == '1' && (Vd<ð> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Alias conditions 





Alias or pseudo-instruction is preferred when 


VMOV (register, SIMD) N:Vn == M:Vm 
VRSHR (zero) Never 
VSHR (zero) Never 





Assembler symbols 


<C> 


<q> 

<dt> 
<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

An optional data type. It is ignored by assemblers, and does not affect the encoding. 

Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
D[d+r] = D[n+r] OR D[m+r]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


F6-5204 


The execution time of this instruction is independent of: 
The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
The values of the data supplied in any of its registers. 


The values of the NZCV flags. 
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F6.1.153  VPADAL 


ARM DDI 0487E.a 
ID070919 


Vector Pairwise Add and Accumulate Long adds adjacent pairs of elements of a vector, and accumulates the results 
into the elements of the destination vector. 


The vectors can be doubleword or quadword. The operand elements can be 8-bit, 16-bit, or 32-bit integers. The 
result elements are twice the length of the operand elements. 


The following figure shows the operation of VPADAL doubleword operation for data type S16. 








Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 


111001 1 1joji 1[szejo of va jolt 1 ofopfajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VPADAL{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VPADAL{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 

if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (op == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


11111111 1fpji 1[szeļo of va [oji 1 ofoeļajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VPADAL{<c>}{<q>}.<dt> <Dd>, <Dm> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VPADAL{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (op == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "op:size" field. It can have the 
following values: 
S8 when op = 0, size = 00 
S16 when op = 0, size = 01 
S32 when op = @, size = 10 
U8 when op = 1, size = 00 
U16 when op = 1, size = 01 
U32 when op = 1, size = 10 


The following encodings are reserved: 
° op = 0, size = 11. 


° op = 1, size = 11. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
h = elements DIV 2; 


for r = 0 to regs-1 
for e = @ to h-1 
op1 = Elem[D[m+r],2*e,esize]; op2 = Elem[D[m+r] ,2xe+1,esize]; 
result = Int(op1, unsigned) + Int(op2, unsigned); 
Elem[D[d+r],e,2xesize] = Elem[D[d+r],e,2*esize] + result; 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.154 


F6-5208 


VPADD (floating-point) 


Vector Pairwise Add (floating-point) adds adjacent pairs of elements of two vectors, and places the results in the 
destination vector. 


The operands and result are doubleword vectors. 
The operand and result elements are floating-point numbers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


T4770 0 i]t)o[p]ofse] va | va [+70 a[N[Q[w[o] vm | 


A1 variant 


VPADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 


if Q == '1' then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
case sz of 


when '@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0| 


a ijili 1 1 1 ofpfofsz] vn | va fi 1 0 1fnjajmjo] vm | 


T1 variant 


VPADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 


if Q == '1' then UNDEFINED; 

if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
case sz of 


when '0' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(64) dest; 
h = elements DIV 2; 


for e = 0 to h-1 
Elem[dest,e,esize] 
StandardFPSCRValue()); 
Elem[dest,e+h,esize] = FPAdd(Elem[D[m],2*e,esize], Elem[D[m],2se+1,esize], 
StandardFPSCRValue()); 


FPAdd(Elem[D[n],2xe,esize], Elem[D[n],2se+1,esize], 


D[d] = dest; 
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F6.1.155 | VPADD (integer) 


Vector Pairwise Add (integer) adds adjacent pairs of elements of two vectors, and places the results in the destination 
vector. 


The operands and result are doubleword vectors. 


The operand and result elements must all be the same type, and can be 8-bit, 16-bit, or 32-bit integers. There is no 
distinction between signed and unsigned integers. 


The following figure shows the operation of VPADD doubleword operation for data type 116. 








Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


111100 1}ofojp]size] vn | va [1 0 1 1jnjajmji] vm | 


A1 variant 


VPADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 
if size == '11' || Q == '1' then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aaao 117 opse] va | va porine vm _| 


T1 variant 


VPADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 


if size == '11' || Q == '1' then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
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F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Assembler symbols 


<C> 


<q> 


<dt> 


<Dd> 


<Dn> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 


values: 

I8 when size = 00 
I16 when size = 01 
132 when size = 10 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(64) dest; 
h = elements DIV 2; 


for e = 0 to h-1 
Elem[dest,e,esize] = Elem[D[n],2*e,esize] + Elem[D[n],2se+1,esize]; 


Elem[dest,eth,esize] = Elem[D[m],2*e,esize] + Elem[D[m],2se+1,esize]; 


D[d] = dest; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.156 VPADDL 


Vector Pairwise Add Long adds adjacent pairs of elements of two vectors, and places the results in the destination 
vector. 


The vectors can be doubleword or quadword. The operand elements can be 8-bit, 16-bit, or 32-bit integers. The 
result elements are twice the length of the operand elements. 


The following figure shows the operation of VPADDL doubleword operation for data type S16. 








Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 


111001 1 1joji 1[szejo of vd fojo 1 ofoeļajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VPADDL{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VPADDL{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 

if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (op == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


11111111 1fpji 1[szeļo of va [ojo 1 ofoeļajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q = 0. 


VPADDL{<c>}{<q>}.<dt> <Dd>, <Dm> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VPADDL{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (op == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "op:size" field. It can have the 
following values: 
S8 when op = 0, size = 00 
S16 when op = 0, size = 01 
S32 when op = @, size = 10 
U8 when op = 1, size = 00 
U16 when op = 1, size = 01 
U32 when op = 1, size = 10 


The following encodings are reserved: 
° op = 0, size = 11. 


° op = 1, size = 11. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
h = elements DIV 2; 


for r = 0 to regs-1 
for e = @ to h-1 
op1 = Elem[D[m+r],2*e,esize]; op2 = Elem[D[m+r] ,2xe+1,esize]; 
result = Int(op1, unsigned) + Int(op2, unsigned); 
Elem[D[d+r],e,2xesize] = result<2xesize-1:0>; 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.157 VPMAX (floating-point) 


ARM DDI 0487E.a 
ID070919 


Vector Pairwise Maximum compares adjacent pairs of elements in two doubleword vectors, and copies the larger 
of each pair into the corresponding element in the destination doubleword vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


T4770 0 4]t[o[p]ofse] va | va [+141 4N[o[w[o] vm _| 
op 


A1 variant 


VPMAX{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 


if sz == '1' && !HaveFP16Ext() then UNDEFINED; 


maximum = (op == '0'); 
case sz of 
when '@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0 | 


a1 ifiji 1 1 1 ofpfofsz] vn | va fi 11 1fnjojmjo] vm | 
op 


T1 variant 


VPMAX{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 


if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 


maximum = (op == 'Q'); 
case sz of 
when 'Q@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
For encoding T1: see Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(64) dest; 
h = elements DIV 2; 


for e = 0 to h-1 
op1 = Elem[D[n],2e,esize]; op2 = Elem[D[n],2e+1,esize]; 
Elem[dest,e,esize] = if maximum then FPMax(op1,op2,StandardFPSCRValue()) else 
FPMin(op1,op2,StandardFPSCRValue()); 
op1 = Elem[D[m],2*e,esize]; op2 = Elem[D[m],2*e+1,esize]; 
Elem[dest,eth,esize] = if maximum then FPMax(op1,op2,StandardFPSCRValue()) else 
FPMin(op1,op2,StandardFPSCRValue()); 


D[d] = dest; 
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F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.158 §VPMAX (integer) 


Vector Pairwise Maximum compares adjacent pairs of elements in two doubleword vectors, and copies the larger 
of each pair into the corresponding element in the destination doubleword vector. 


The following figure shows the operation of VPMAX doubleword operation for data type S16 or U16. 





Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12/1110 9 8|7 6 5 4|3 0| 


1 11 00 1jujojo]sze| vn | va fi o 1 ofnjojmjo] vm | 
op 





A1 variant 


VPMAX{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 
if size == '11' then UNDEFINED; 
maximum = (op == '@'); unsigned = (U == '1'); 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 121110 9 8|7 6 5 4|3 0 | 


7 ajult 717 opse] va | va [or 0|N[o[Mjo] vm | 
op 


T1 variant 


VPMAX{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 


if size == '11' then UNDEFINED; 

maximum = (op == '@'); unsigned = (U == '1'); 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
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<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = Q, size = 00 
S16 when U = 0, size = 01 
$32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(64) dest; 
h = elements DIV 2; 


for e = 0 to h-1 
opl = Int(Elem[D[n],2*e,esize], unsigned); 
op2 = Int(Elem[D[n],2«e+1,esize], unsigned); 
result = if maximum then Max(op1,op2) else Min(op1,op2); 
Elem[dest,e,esize] = result<esize-1:0>; 
opl = Int(Elem[D[m],2*e,esize], unsigned); 
op2 = Int(Elem[D[m],2xe+1,esize], unsigned); 
result = if maximum then Max(op1,op2) else Min(op1,op2); 
Elem[dest,eth,esize] = result<esize-1:0>; 


D[d] = dest; 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.159  VPMIN (floating-point) 


Vector Pairwise Minimum compares adjacent pairs of elements in two doubleword vectors, and copies the smaller 
of each pair into the corresponding element in the destination doubleword vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


Ti 7700 4]1)o[o[tfe| vw | va pornom vm _| 
op 


A1 variant 


VPMIN{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 


if sz == '1' && !HaveFP16Ext() then UNDEFINED; 


maximum = (op == '0'); 
case sz of 
when '@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0 | 


11 afifa 1 1 1 ofd]tfsz] vn | va f1 1 1 1[njojm[o] vm | 
op 


T1 variant 


VPMIN{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 


if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 


maximum = (op == 'Q'); 
case sz of 
when 'Q@' esize = 32; elements = 2; 
when '1' esize = 16; elements = 4; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 
° The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
For encoding T1: see Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(64) dest; 
h = elements DIV 2; 


for e = 0 to h-1 
op1 = Elem[D[n],2e,esize]; op2 = Elem[D[n],2e+1,esize]; 
Elem[dest,e,esize] = if maximum then FPMax(op1,op2,StandardFPSCRValue()) else 
FPMin(op1,op2,StandardFPSCRValue()); 
op1 = Elem[D[m],2*e,esize]; op2 = Elem[D[m],2*e+1,esize]; 
Elem[dest,eth,esize] = if maximum then FPMax(op1,op2,StandardFPSCRValue()) else 
FPMin(op1,op2,StandardFPSCRValue()); 


D[d] = dest; 
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F6.1.160  VPMIN (integer) 


ARM DDI 0487E.a 
ID070919 


Vector Pairwise Minimum compares adjacent pairs of elements in two doubleword vectors, and copies the smaller 


of each pair into the corresponding element in the destination doubleword vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


T1770 0 iJu[o[o[sze] vn | va [1071 0|N[o[M[1[ vm _| 
op 


A1 variant 


VPMIN{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 
if size == '11' then UNDEFINED; 
maximum = (op == '@'); unsigned = (U == '1'); 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


7 afuft 717 opse] va | va porono vm | 
op 


T1 variant 


VPMIN{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


Decode for this encoding 


if size == '11' then UNDEFINED; 

maximum = (op == '@'); unsigned = (U == '1'); 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = Q, size = 00 
S16 when U = @, size = 01 
$32 when U = 0, size = 10 
U8 when U = 1, size = 00 
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U16 when U = 1, size = 01 

U32 when U = 1, size = 10 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
bits(64) dest; 
h = elements DIV 2; 


for e = 0 to h-1 
opl = Int(Elem[D[n],2*e,esize], unsigned); 
op2 = Int(Elem[D[n],2«e+1,esize], unsigned); 
result = if maximum then Max(op1,op2) else Min(op1,op2); 
Elem[dest,e,esize] = result<esize-1:0>; 
opl = Int(Elem[D[m],2*e,esize], unsigned); 
op2 = Int(Elem[D[m],2se+1,esize], unsigned); 
result = if maximum then Max(op1,op2) else Min(op1,op2); 
Elem[dest,eth,esize] = result<esize-1:0>; 


D[d] = dest; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.161 VPOP 


ARM DDI 0487E.a 
ID070919 


Pop SIMD&FP registers from Stack loads multiple consecutive Advanced SIMD and floating-point register file 
registers from the stack 


This instruction is an alias of the VLDM, VLDMDB, VLDMIA instruction. This means that: 
$ The encodings in this description are named to match the encodings of VLDM, VLDMDB, VLDMIA. 


s The description of VLDM, VLDMDB, VLDMIA gives the operational pseudocode for this instruction. 


A1 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 | 1 0| 


[m11 ft 1 ojojijofijliji 101| va fr ofi 1|  immssr:1> [o] 


cond P U WwW Rn imm8<0> 





Increment After variant 
VPOP{<c>}{<q>}{.<size>} <dreglist> 

is equivalent to 

VLDM{<c>}{<q>}{.<size>} SP!, <dreglist> 


and is always the preferred disassembly. 
A2 


|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 | 0 | 


[m1 [1 1 ojojijoliliji 10 1f va fr oft of imma | 
U Ww Rn 


cond P 


Increment After variant 
VPOP{<c>}{<q>}{.<size>} <sreglist> 

is equivalent to 

VLDM{<c>}{<q>}{.<size>} SP!, <sreglist> 


and is always the preferred disassembly. 


T1 

|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 | 1 0| 

1a o nop PLU on va o mera o 
P U W Rn imm8<0> 
Increment After variant 
VPOP{<c>}{<q>}{.<size>} <dreglist> 
is equivalent to 
VLDM{<c>}{<q>}{.<size>} SP!, <dreglist> 
and is always the preferred disassembly. 
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F6-5224 


T2 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


Tito opto] va [toto] me 
PU WwW Rn 


Increment After variant 


VPOP{<c>}{<q>}{.<size>} <sreglist> 


is equivalent to 


VLDM{<c>}{<q>}{.<size>} SP!, <sreglist> 


and is always the preferred disassembly. 


Assembler symbols 


<C> 
<q> 


<size> 


<sreglist> 


<dreglist> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


An optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers 
being transferred. 


Is the list of consecutively numbered 32-bit SIMD&FP registers to be transferred. The first register 
in the list is encoded in "Vd:D", and "imm8" is set to the number of registers in the list. The list must 
contain at least one register. 


Is the list of consecutively numbered 64-bit SIMD&FP registers to be transferred. The first register 
in the list is encoded in "D:Vd", and "imm8" is set to twice the number of registers in the list. The 
list must contain at least one register, and must not contain more than 16 registers. 


Operation for all encodings 


The description of VLDM, VLDMDB, VLDMIA gives the operational pseudocode for this instruction. 
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F6.1.162 VPUSH 


ARM DDI 0487E.a 
ID070919 


Push SIMD&FP registers to Stack stores multiple consecutive registers from the Advanced SIMD and 
floating-point register file to the stack 


This instruction is an alias of the VSTM, VSTMDB, VSTMIA instruction. This means that: 
g The encodings in this description are named to match the encodings of VSTM, VSTMDB, VSTMIA. 


s The description of VSTM, VSTMDB, VSTMIA gives the operational pseudocode for this instruction. 


A1 


31 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 | 1 0| 


[111 |1 1 ojijojofijoji 10 1| va fr oft 1| immé<71> [o 


cond P U W Rn imm8<0> 





Decrement Before variant 
VPUSH{<c>}{<q>}{.<size>} <dreglist> 

is equivalent to 

VSTMDB{<c>}{<q>}{.<size>} SP!, <dreglist> 


and is always the preferred disassembly. 


A2 


31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 | 0 | 


[m11 [1 1 ojijojolijoji 10 1f va fi ofi o] imma | 
P U Ww Rn 


cond 


Decrement Before variant 
VPUSH{<c>}{<q>}{.<size>} <sreglist> 

is equivalent to 

VSTMDB{<c>}{<q>}{.<size>} SP!, <sreglist> 


and is always the preferred disassembly. 


T1 

|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 | 1 0| 

rirorio oL 101] va [o meara o 
P U Ww Rn imm8<0> 
Decrement Before variant 
VPUSH{<c>}{<q>}{.<size>} <dreglist> 
is equivalent to 
VSTMDB{<c>}{<q>}{.<size>} SP!, <dreglist> 
and is always the preferred disassembly. 
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F6-5226 


T2 


\15141312|11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


Tit 071 ofopppoy1+o 7] va Mopo) — me 
PU Ww Rn 


Decrement Before variant 


VPUSH{<c>}{<q>}{.<size>} <sreglist> 


is equivalent to 


VSTMDB{<c>}{<q>}{.<size>} SP!, <sreglist> 


and is always the preferred disassembly. 


Assembler symbols 


<C> 
<q> 


<size> 


<sreglist> 


<dreglist> 


See Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


An optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers 
being transferred. 


Is the list of consecutively numbered 32-bit SIMD&FP registers to be transferred. The first register 
in the list is encoded in "Vd:D", and "imm8" is set to the number of registers in the list. The list must 
contain at least one register. 


Is the list of consecutively numbered 64-bit SIMD&FP registers to be transferred. The first register 
in the list is encoded in "D:Vd", and "imm8" is set to twice the number of registers in the list. The 
list must contain at least one register, and must not contain more than 16 registers. 


Operation for all encodings 


The description of VSTM, VSTMDB, VSTMIA gives the operational pseudocode for this instruction. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.163 VQABS 


ARM DDI 0487E.a 
ID070919 


Vector Saturating Absolute takes the absolute value of each element in a vector, and places the results in the 
destination vector. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 


Ti 770077 1p isejo of va [oli 17 ojoo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQABS{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQABS{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 
if size == '11' then UNDEFINED; 
if Q == '1' && (Vd<0> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0\15 12/1109 8|7 6 5 4|3 o| 


Tiiti117 [1 isejo o] va Jo 17 ojomo] wm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQABS{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQABS{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
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F6-5228 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
S8 when size = 00 
S16 when size = 01 
$32 when size = 10 


The encoding size = 11 is reserved. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
result = Abs(SInt(Elem[D[m+r],e,esize])); 
(Elem[D[d+r],e,esize], sat) = SignedSatQ(result, esize); 
if sat then FPSCR.QC = '1'; 
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F6.1.164 VQADD 


ARM DDI 0487E.a 
ID070919 


Vector Saturating Add adds the values of corresponding elements of two vectors, and places the results in the 
destination vector. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


717100 1[Ulo[pfsze[ va | va Jo 00 o[Nja|mji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQADD{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQADD{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<O> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


7 afult 717 opse] va | va Jooo onom vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQADD{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQADD{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 
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F6-5230 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = 0, size = 01 
S32 when U = 0, size = 10 
S64 when U = 0, size = 11 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
U64 when U = 1, size = 11 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
sum = Int(Elem[D[n+r],e,esize], unsigned) + Int(Elem[D[m+r],e,esize], unsigned); 
(Elem[D[d+r],e,esize], sat) = SatQ(sum, esize, unsigned); 
if sat then FPSCR.QC = '1'; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.165 VQDMLAL 


ARM DDI 0487E.a 
ID070919 


Vector Saturating Doubling Multiply Accumulate Long multiplies corresponding elements in two doubleword 
vectors, doubles the products, and accumulates the results into the elements of a quadword vector. 


The second operand can be a scalar instead of a vector. For more information about scalars see Advanced SIMD 
scalars on page F2-3934. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


11100 1jojijojsn| vn | va fı ofoft|Njojmfo} vm | 


size op 


A1 variant 


VQDMLAL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); 

scalar_form = FALSE; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
esize = 8 << UInt(size); elements = 64 DIV esize; 


A2 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


11100 1jojijojsn| vn | va fofojs tN] t}Mfo} vm | 


size op 


A2 variant 


VQDMLAL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm>[<index>] 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); 

if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 





if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4/3 0 |15 12|11 10 9 8|7 6 5 4|3 0| 
Danpol) vn | va h ooN omo] m | 
size op 
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F6-5232 


T1 variant 


VQDMLAL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size 
if size 


= '11' then SEE "Related encodings"; 
"Q0' || Vd<@> == '1' then UNDEFINED; 


add = (op == '0'); 
scalar_form = FALSE; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
esize = 8 << UInt(size); elements = 64 DIV esize; 


T2 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 o| 





aaao pen) vw | ve ojo Neo vm 


size op 


T2 variant 


VQDMLAL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm>[<index>] 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); 

if size == '@1' then esize = 16; elements = 4; m = UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 


Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 
<Dn> 


<Dm> 


<index> 


For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 
S16 when size = 01 


$32 when size = 10 
Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


For encoding A1 and T1: is the 64-bit name of the second SIMD&FP source register, encoded in 
the "M:Vm" field. 


For encoding A2 and T2: is the 64-bit name of the second SIMD&FP source register, encoded in 
the "Vm<2:0>" field when <dt> is S16, otherwise the "Vm" field. 


Is the element index in the range 0 to 3, encoded in the "M:Vm<3>" field when <dt> is $16, 
otherwise in range 0 to 1, encoded in the "M" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
if scalar_form then op2 = SInt(Elem[Din[m] , index, esize]); 
for e = Q to elements-1 
if !scalar_form then op2 = SInt(Elem[Din[m],e,esize]); 
op1 = SInt(Elem[Din[n],e,esize]); 
// The following only saturates if both op1 and op2 equal -(2A(esize-1)) 
(product, sat1) = SignedSatQ(2sopl*op2, 2*esize); 
if add then 
result = SInt(Elem[Qin[d>>1],e,2esize]) + SInt(product); 
else 
result = SInt(Elem[Qin[d>>1],e,2esize]) - SInt(product); 
(Elem[Q[d>>1],e,2esize], sat2) = SignedSatQ(result, 2*esize); 
if sat1 || sat2 then FPSCR.QC = '1'; 
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F6.1.166 


F6-5234 


VQDMLSL 


Vector Saturating Doubling Multiply Subtract Long multiplies corresponding elements in two doubleword vectors, 
subtracts double the products from corresponding elements of a quadword vector, and places the results in the same 
quadword vector. 


The second operand can be a scalar instead of a vector. For more information about scalars see Advanced SIMD 
scalars on page F2-3934. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20/19 16|15 12/1110 9 8|7 6 5 4|3 o| 
T14100 t)otpopen] w | va [4 onio vm _| 
size op 
A1 variant 


VQDMLSL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == 'QQ' || Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); 

scalar_form = FALSE; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
esize = 8 << UInt(size); elements = 64 DIV esize; 


A2 
|31 30 29 28|27 26 25 24|23 22 21 20/19 16|15 12/1110 9 8|7 6 5 4/3 o| 
114100 t)o]tpo[en] va | va Jon Ne Mo vm _| 
size op 
A2 variant 


VQDMLSL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm>[<index>] 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); 

if size == 'Q1' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 





T1 
|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|1110 9 8|7 6 5 4|3 0| 
Daioh ippen] vn | va M oN omo] m _| 
size op 
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T1 variant 


VQDMLSL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == 'QQ' || Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); 

scalar_form = FALSE; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
esize = 8 << UInt(size); elements = 64 DIV esize; 


T2 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 





7 apolt pen) va | ve Joa]? t[N[t [myo vm _ 


size op 


T2 variant 


VQDMLSL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm>[<index>] 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == 'QQ' || Vd<@> == '1' then UNDEFINED; 

add = (op == '0'); 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); 

if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 


Notes for all encodings 

Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 

Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 
S16 when size = 01 
$32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> For encoding A1 and T1: is the 64-bit name of the second SIMD&FP source register, encoded in 


the "M:Vm" field. 


For encoding A2 and T2: is the 64-bit name of the second SIMD&FP source register, encoded in 
the "Vm<2:0>" field when <dt> is S16, otherwise the "Vm" field. 


<index> Is the element index in the range 0 to 3, encoded in the "M:Vm<3>" field when <dt> is S16, 
otherwise in range 0 to 1, encoded in the "M" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
if scalar_form then op2 = SInt(Elem[Din[m] , index, esize]); 
for e = Q to elements-1 
if !scalar_form then op2 = SInt(Elem[Din[m],e,esize]); 
op1 = SInt(Elem[Din[n],e,esize]); 
// The following only saturates if both op1 and op2 equal -(2A(esize-1)) 
(product, sat1) = SignedSatQ(2sopl*op2, 2*esize); 
if add then 
result = SInt(Elem[Qin[d>>1],e,2esize]) + SInt(product); 
else 
result = SInt(Elem[Qin[d>>1],e,2esize]) - SInt(product); 
(Elem[Q[d>>1],e,2esize], sat2) = SignedSatQ(result, 2*esize); 
if sat1 || sat2 then FPSCR.QC = '1'; 
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VQDMULH 


Vector Saturating Doubling Multiply Returning High Half multiplies corresponding elements in two vectors, 
doubles the results, and places the most significant half of the final results in the destination vector. The results are 


truncated, for rounded results see VQRDMULH. 


The second operand can be a scalar instead of a vector. For more information about scalars see Advanced SIMD 


scalars on page F2-3934. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 


occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


717100 1f0[o[pfsze[ va | va porinem] vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQDMULH{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQDMULH{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == 'QQ' || size == '11' then UNDEFINED; 

scalar_form = FALSE; esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 
|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15 12/1110 9 8|7 6 5 4/3 0 | 
mana oonan] vw | va_[1 10 oNu vm _| 


size 


64-bit SIMD vector variant 

Applies when Q == 0. 

VQDMULH{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm[x]> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VQDMULH{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm[x]> 
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F6-5238 


Decode for all variants of this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 


if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0 | 


7 apolt 717 opse] va | va porinem vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQDMULH{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQDMULH{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' |] Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if size == 'QQ' || size == '11' then UNDEFINED; 


scalar_form = FALSE; esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T2 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4/3 0 | 


7 aot ttt pen] vw | va a o ono vm | 


size 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQDMULH{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm[x]> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQDMULH{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm[x]> 


Decode for all variants of this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 
if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
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Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 
S16 when size = 01 
$32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm[x]> Is the 64-bit name of the second SIMD&FP source register holding the scalar. If <dt> is S16, Dm is 


restricted to DO-D7. Dm is encoded in "Vm<2:0>", and x is encoded in "M:Vm<3>". If <dt> is $32, 
Dm is restricted to DO-D15. Dm is encoded in "Vm", and x is encoded in "M". 


<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 

EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 

if scalar_form then op2 = SInt(Elem[D[m] ,index,esize]); 

for r = 0 to regs-1 

for e = Q to elements-1 

if !scalar_form then op2 = SInt(Elem[D[m+r],e,esize]); 
op1 = SInt(Elem[D[n+r],e,esize] ) 
// The following only saturates if both op1 and op2 equal -(2A(esize-1)) 
(result, sat) = SignedSatQ((2*oplso0p2) >> esize, esize); 
Elem[D[d+r],e,esize] = result; 
if sat then FPSCR.QC = '1'; 
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F6.1.168 


F6-5240 


VQDMULL 


Vector Saturating Doubling Multiply Long multiplies corresponding elements in two doubleword vectors, doubles 
the products, and places the results in a quadword vector. 


The second operand can be a scalar instead of a vector. For more information about scalars see Advanced SIMD 
scalars on page F2-3934. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 

|31 30 29 28|27 26 25 24|23 22 21 20/19 16|15 12/1110 9 8|7 6 5 4/3 o| 

Darno onipo] va | vw [110 1|NJO[M[o] m 
size 

A1 variant 


VQDMULL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' || Vd<@> == '1' then UNDEFINED; 

scalar_form = FALSE; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
esize = 8 << UInt(size); elements = 64 DIV esize; 


A2 
|31 30 29 28|27 26 25 24|23 22 21 20/19 16|15 12/1110 9 8|7 6 5 4|3 o| 
114100 t)otpo[en] ve | va orno] vm | 
size 
A2 variant 


VQDMULL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm[x]> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == 'QQ' || Vd<@> == '1' then UNDEFINED; 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); 

if size == 'Q1' then esize = 16; elements = 4; m = UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 


T1 
|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 6 5 4|3 0| 
11 ijofji 1 1 1 atopy wn | va f1 10 1fjnjofmjo] vm | 
size 
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T1 variant 


VQDMULL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == 'QQ' || Vd<@> == '1' then UNDEFINED; 

scalar_form = FALSE; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
esize = 8 << UInt(size); elements = 64 DIV esize; 


T2 


[15 1413 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


tapi 717 tppeny vw | va_[1 07 7[N[i[Mjo] vm | 


size 


T2 variant 


VQDMULL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm[x]> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if size == 'QQ' || Vd<@> == '1' then UNDEFINED; 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); 

if size == 'Q1' then esize = 16; elements = 4; m = UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 


Notes for all encodings 

Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 

Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 
S16 when size = 01 
$32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm[x]> Is the 64-bit name of the second SIMD&FP source register holding the scalar. If <dt> is S16, Dm is 


restricted to DO-D7. Dm is encoded in "Vm<2:0>", and x is encoded in "M:Vm<3>". If <dt> is $32, 
Dm is restricted to DO-D15. Dm is encoded in "Vm", and x is encoded in "M". 


<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
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Operation for all encodings 


if ConditionPassed() then 

EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 

if scalar_form then op2 = SInt(Elem[Din[m] , index, esize]); 

for e = Q to elements-1 
if !scalar_form then op2 = SInt(Elem[Din[m],e,esize]); 
op1 = SInt(Elem[Din[n],e,esize]); 
// The following only saturates if both op1 and op2 equal -(2A(esize-1)) 
(product, sat) = SignedSatQ(2soplxop2, 2esize); 
Elem[Q[d>>1],e,2*esize] = product; 
if sat then FPSCR.QC = '1'; 
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F6.1.169 VQMOVN, VQMOVUN 


ARM DDI 0487E.a 
ID070919 


Vector Saturating Move and Narrow copies each element of the operand vector to the corresponding element of the 
destination vector. 


The operand is a quadword vector. The elements can be any one of: 


$ 16-bit, 32-bit, or 64-bit signed integers. 


16-bit, 32-bit, or 64-bit unsigned integers. 


The result is a doubleword vector. The elements are half the length of the operand vector elements. If the operand 
is unsigned, the results are unsigned. If the operand is signed, the results can be signed or unsigned. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instructions VQRSHRN (zero), VQRSHRUN (zero), VQSHRN (zero), and 
VQSHRUN (zero). The pseudo-instruction is never the preferred disassembly. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


11770077 1)0][1 isejo] va Jojo 1 0] » [mo] vm | 


Signed result variant 
Applies when op == 1x. 


VQMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


Unsigned result variant 
Applies when op == 01. 


VQMOVUN{<c>}{<q>}.<dt> <Dd>, <Qm> 


Decode for all variants of this encoding 


if op == '00' then SEE "VMOVN"; 

if size == '11' || Vm<@> == '1' then UNDEFINED; 

src_unsigned = (op == '11'); dest_unsigned = (op<@> == '1'); 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4|3 o| 


7414177 p isej o] va Jojo 7 0] op [mo] vwm | 





Signed result variant 
Applies when op == 1x. 


VQMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 
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Unsigned result variant 


Applies when op == 01. 


VQMOVUN{<c>}{<q>}.<dt> <Dd>, <Qm> 


Decode for all variants of this encoding 


if op == '00' then SEE "VMOVN"; 

if size == '11' || Vm<@> == '1' then UNDEFINED; 

src_unsigned = (op == '11'); dest_unsigned = (op<@> == '1'); 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); 


Assembler symbols 


<C> 


<q> 


<dt> 


<Dd> 


<Qm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


For the signed result variant: is the data type for the elements of the operand, encoded in the 
"op<0>:size" field. It can have the following values: 


S16 when op<0> = 0, size = 00 
$32 when op<0> = 0, size = 01 
S64 when op<0> = 0, size = 10 
U16 when op<0> = 1, size = 00 
U32 when op<@> = 1, size = 01 
U64 when op<@> = 1, size = 10 


The following encodings are reserved: 
° op<0> = 0, size = 11. 
° op<@> = 1, size = 11. 


For the unsigned result variant: is the data type for the elements of the operand, encoded in the "size" 
field. It can have the following values: 


S16 when size = 00 
S32 when size = 01 
S64 when size = 10 


The encoding size = 11 is reserved. 
Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 

for e = Q to elements-1 
operand = Int(Elem[Qin[m>>1],e,2sesize], src_unsigned) ; 
(Elem[D[d],e,esize], sat) = SatQ(operand, esize, dest_unsigned); 
if sat then FPSCR.QC = '1'; 
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F6.1.170 VQNEG 


ARM DDI 0487E.a 
ID070919 


Vector Saturating Negate negates each element in a vector, and places the results in the destination vector. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


71770077 1p isejo of va [oli 17 7/Q[w[o] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQNEG{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQNEG{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 
if size == '11' then UNDEFINED; 
if Q == '1' && (Vd<O> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0\15 12/1110 9 8|7 6 5 4|3 0| 


Gaana aanp isejo o] va fop ejom] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQNEG{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQNEG{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
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Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
S8 when size = 00 
S16 when size = 01 
$32 when size = 10 


The encoding size = 11 is reserved. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = 0 to elements-1 
result = -SInt(Elem[D[m+r],e,esize]); 
(Elem[D[d+r],e,esize], sat) = SignedSatQ(result, esize); 
if sat then FPSCR.QC = '1'; 
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F6.1.171 VQRDMLAH 


ARM DDI 0487E.a 
ID070919 


Vector Saturating Rounding Doubling Multiply Accumulate Returning High Half. This instruction multiplies the 
vector elements of the first source SIMD&FP register with either the corresponding vector elements of the second 
source SIMD&FP register or the value of a vector element of the second source SIMD&FP register, without 
saturating the multiply results, doubles the results, and accumulates the most significant half of the final results with 


the vector elements of the destination SIMD&FP register. The results are rounded. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 


occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
ARMVv8.1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12\11109 8|7 6 5 4/3 0 | 


1141700 1jilojojsze| vn | va f1 o1 1jnjajmji] vwm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQRDMLAH{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQRDMLAH{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if !HaveQRDMLAHExt() then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == 'QQ' || size == '11' then UNDEFINED; 

add = TRUE; scalar_form = FALSE; esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 

ARMv8.1 

|31 30 29 28|27 26 25 24/23 22 21 20119 16|15 12/1110 9 8|7 6 5 4/3 0 | 
717100 tape] vw | va prone vm _| 


size 


64-bit SIMD vector variant 

Applies when Q == 0. 
VQRDMLAH{<q>}.<dt> <Dd>, <Dn>, <Dm[x]> 
128-bit SIMD vector variant 

Applies when Q == 1. 
VQRDMLAH{<q>}.<dt> <Qd>, <Qn>, <Dm[x]> 
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Decode for all variants of this encoding 


if !HaveQRDMLAHExt() then UNDEFINED; 

if size == '11' then SEE "Related encodings"; 

if size == '00' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

add = TRUE; scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 
if size == 'Q@1' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 


if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 

T1 

ARMv8.1 

|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0| 


a ifiji 1 1 1 ofpfsize] vn | va fi o1 1fnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VQRDMLAH{<q>}.<dt> <Dd>, <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VQRDMLAH{<q>}.<dt> <Qd>, <Qn>, <Qm> 
Decode for all variants of this encoding 
if !HaveQRDMLAHExt() then UNDEFINED; 
if InITBlock() then UNPREDICTABLE; 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if size == 'QQ' || size == '11' then UNDEFINED; 


add = TRUE; scalar_form = FALSE; esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 

If InITBlock(), then one of the following behaviors must occur: 

è The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T2 


ARMv8.1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


moa pen va | va_[1 17 oN Mo vm _| 





size 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQRDMLAH{<q>}.<dt> <Dd>, <Dn>, <Dm[x]> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VQRDMLAH{<q>}.<dt> <Qd>, <Qn>, <Dm[x]> 


Decode for all variants of this encoding 


if !HaveQRDMLAHExt() then UNDEFINED; 

if InITBlock() then UNPREDICTABLE; 

if size == '11' then SEE "Related encodings"; 

if size == '00' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

add = TRUE; scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 
if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:@>); index = UInt(M:Vm<3>); 

if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 
S16 when size = 01 
S32 when size = 10 

<Qd> Is the 128-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D: Vd" 
field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D: Vd" 
field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm[x]> Is the 64-bit name of the second SIMD&FP source register holding the scalar. If <dt> is S16, Dm is 


restricted to DO-D7. Dm is encoded in "Vm<2:0>", and x is encoded in "M:Vm<3>". If <dt> is $32, 
Dm is restricted to DO-D15. Dm is encoded in "Vm", and x is encoded in "M". 


<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
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Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 

round_const = 1 << (esize-1); 

if scalar_form then op2 = SInt(Elem[D[m] ,index,esize]); 

for r = 0 to regs-1 

for e = Q to elements-1 

op1 = SInt(Elem[D[n+r],e,esize]); 
op3 = SInt(Elem[D[d+r],e,esize]) << esize; 
if !scalar_form then op2 = SInt(Elem[D[m+tr],e,esize]); 
(result, sat) = SignedSatQ((op3 + 2*(oplxop2) + round_const) >> esize, esize); 
Elem[D[d+r],e,esize] = result; 
if sat then FPSCR.QC = '1'; 
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F6.1.172 VQRDMLSH 


ARM DDI 0487E.a 
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Vector Saturating Rounding Doubling Multiply Subtract Returning High Half. This instruction multiplies the vector 
elements of the first source SIMD&FP register with either the corresponding vector elements of the second source 
SIMD&FP register or the value of a vector element of the second source SIMD&FP register, without saturating the 
multiply results, doubles the results, and subtracts the most significant half of the final results from the vector 


elements of the destination SIMD&FP register. The results are rounded. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 


occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
ARMVv8.1 


|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


11411700 1jilojojsze| vn | va [1 10 ojnjajmji] vwm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQRDMLSH{<q>}.<dt> <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQRDMLSH{<q>}.<dt> <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if !HaveQRDMLAHExt() then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == 'QQ' || size == '11' then UNDEFINED; 

add = FALSE; scalar_form = FALSE; esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 

ARMv8.1 

|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15 12/1110 9 8|7 6 5 4/3 0 | 
717100 taypyen] w | v poneo vm _| 


size 


64-bit SIMD vector variant 

Applies when Q == 0. 
VQRDMLSH{<q>}.<dt> <Dd>, <Dn>, <Dm[x]> 
128-bit SIMD vector variant 

Applies when Q == 1. 
VQRDMLSH{<q>}.<dt> <Qd>, <Qn>, <Dm[x]> 
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F6-5252 


Decode for all variants of this encoding 


if !HaveQRDMLAHExt() then UNDEFINED; 

if size == '11' then SEE "Related encodings"; 

if size == '00' then UNDEFINED; 

if Q == '1' && (Vd<0> == '1' || Vn<@> == '1') then UNDEFINED; 


add = FALSE; scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 


if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
ARMv8.1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0| 


a ijili 1 1 1 ofpfsize] vn | va fi 1 0 ofnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VQRDMLSH{<q>}.<dt> <Dd>, <Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VQRDMLSH{<q>}.<dt> <Qd>, <Qn>, <Qm> 
Decode for all variants of this encoding 
if !HaveQRDMLAHExt() then UNDEFINED; 
if InITBlock() then UNPREDICTABLE; 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if size == 'QQ' || size == '11' then UNDEFINED; 


add = FALSE; scalar_form = FALSE; esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == 'Q@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 

If InITBlock(), then one of the following behaviors must occur: 

è The instruction is UNDEFINED. 

° The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T2 


ARMv8.1 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 





mooo pen) vw | va ono v | 


size 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQRDMLSH{<q>}.<dt> <Dd>, <Dn>, <Dm[x]> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VQRDMLSH{<q>}.<dt> <Qd>, <Qn>, <Dm[x]> 


Decode for all variants of this encoding 


if !HaveQRDMLAHExt() then UNDEFINED; 

if InITBlock() then UNPREDICTABLE; 

if size == '11' then SEE "Related encodings"; 

if size == '00' then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1') then UNDEFINED; 

add = FALSE; scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 
if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 

if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 
S16 when size = 01 
S32 when size = 10 

<Qd> Is the 128-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D: Vd" 
field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP register holding the accumulate vector, encoded in the "D: Vd" 
field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm[x]> Is the 64-bit name of the second SIMD&FP source register holding the scalar. If <dt> is S16, Dm is 


restricted to DO-D7. Dm is encoded in "Vm<2:0>", and x is encoded in "M:Vm<3>". If <dt> is $32, 
Dm is restricted to DO-D15. Dm is encoded in "Vm", and x is encoded in "M". 


<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
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Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 

round_const = 1 << (esize-1); 

if scalar_form then op2 = SInt(Elem[D[m] ,index,esize]); 

for r = 0 to regs-1 

for e = Q to elements-1 

op1 = SInt(Elem[D[n+r],e,esize]); 
op3 = SInt(Elem[D[d+r],e,esize]) << esize; 
if !scalar_form then op2 = SInt(Elem[D[mtr],e,esize]); 
(result, sat) = SignedSatQ((op3 - 2*(oplxop2) + round_const) >> esize, esize); 
Elem[D[d+r],e,esize] = result; 
if sat then FPSCR.QC = '1'; 
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F6.1.173 VQRDMULH 


Vector Saturating Rounding Doubling Multiply Returning High Half multiplies corresponding elements in two 
vectors, doubles the results, and places the most significant half of the final results in the destination vector. The 
results are rounded. For truncated results see VQDMULH. 


The second operand can be a scalar instead of a vector. For more information about scalars see Advanced SIMD 
scalars on page F2-3934. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


717100 1[i)o[pfsze[ va | va [107 1|NJQ|Mjo] vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQRDMULH{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQRDMULH{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == 'QQ' || size == '11' then UNDEFINED; 

scalar_form = FALSE; esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


A2 
|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15 12/1110 9 8|7 6 5 4/3 0 | 
77100 tape] vw | va [110 7|N[1|[Mo] vm _| 


size 


64-bit SIMD vector variant 

Applies when Q == 0. 

VQRDMULH{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm[x]> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VQRDMULH{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm[x]> 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-5255 
ID070919 Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6-5256 


Decode for all variants of this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 


if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:0>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 6 5 4|3 0 | 


7 aft 717 opse] vw | va porinem vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQRDMULH{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQRDMULH{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' |] Vn<ð> == '1' || Vm<@> == '1') then UNDEFINED; 
if size == 'QQ' || size == '11' then UNDEFINED; 


scalar_form = FALSE; esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T2 


|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


7 aot t+ pen] wm | va a ono vm _| 


size 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQRDMULH{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm[x]> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQRDMULH{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm[x]> 


Decode for all variants of this encoding 


if size == '11' then SEE "Related encodings"; 

if size == '00' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 

scalar_form = TRUE; d = UInt(D:Vd); n = UInt(N:Vn); regs = if Q == 'Q' then 1 else 2; 
if size == '01' then esize = 16; elements = 4; m = UInt(Vm<2:@>); index = UInt(M:Vm<3>); 
if size == '10' then esize = 32; elements = 2; m = UInt(Vm); index = UInt(M); 
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Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 
S16 when size = 01 
$32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm[x]> Is the 64-bit name of the second SIMD&FP source register holding the scalar. If <dt> is S16, Dm is 


restricted to DO-D7. Dm is encoded in "Vm<2:0>", and x is encoded in "M:Vm<3>". If <dt> is $32, 
Dm is restricted to DO-D15. Dm is encoded in "Vm", and x is encoded in "M". 


<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 

EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 

round_const = 1 << (esize-1); 

if scalar_form then op2 = SInt(Elem[D[m] ,index,esize]); 

for r = @ to regs-1 

for e = 0 to elements-1 

op1 = SInt(Elem[D[n+r],e,esize] ) 
if !scalar_form then op2 = SInt(Elem[D[m+r],e,esize]); 
(result, sat) = SignedSatQ((2*oplxop2 + round_const) >> esize, esize); 
Elem[D[d+r],e,esize] = result; 
if sat then FPSCR.QC = '1'; 
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F6.1.174 


F6-5258 


VQRSHL 


Vector Saturating Rounding Shift Left takes each element in a vector, shifts them by a value from the least 
significant byte of the corresponding element of a second vector, and places the results in the destination vector. If 


the shift value is positive, the operation is a left shift. Otherwise, it is a right shift. 
For truncated results see VQSHL (register). 

The first operand and result elements are the same data type, and can be any one of: 
è 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 

° 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 


The second operand is a signed integer of the same size. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 


occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


11 1100 1jujojofsze| vn | va jo 10 1fnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQRSHL{<c>}{<q>}.<dt> {<Dd>,} <Dm>, <Dn> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQRSHL{<c>}{<q>}.<dt> {<Qd>,} <Qm>, <Qn> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<O> == '1' || Vm<@> == '1' || Vn<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); n = UInt(N:Vn); regs = if Q == '@' then 1 else 2; 


T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 121110 9 8|7 6 5 4|3 0| 


maau opse] vw | va joro 7[NJQ|Myi] Vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQRSHL{<c>}{<q>}.<dt> {<Dd>,} <Dm>, <Dn> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VQRSHL{<c>}{<q>}.<dt> {<Qd>,} <Qm>, <Qn> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vm<@> == '1' || Vn<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); n = UInt(N:Vn); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = 0, size = 01 
S32 when U = 0, size = 10 
S64 when U = 0, size = 11 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
U64 when U = 1, size = 11 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = Q to regs-1 
for e = Q to elements-1 

shift = SInt(Elem[D[n+r],e,esize]<7:0>); 
round_const = 1 << (-1-shift); // @ for left shift, 2A(n-1) for right shift 
operand = Int(Elem[D[m+r],e,esize], unsigned); 
(result, sat) = SatQ((operand + round_const) << shift, esize, unsigned); 
Elem[D[d+r],e,esize] = result; 
if sat then FPSCR.QC = '1'; 
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F6.1.175 


F6-5260 


VQRSHRN (zero) 


Vector Saturating Rounding Shift Right, Narrow takes each element in a quadword vector of integers, right shifts 
them by an immediate value, and places the signed rounded results in a doubleword vector 


This instruction is a pseudo-instruction of the VQMOVN, VQMOVUN instruction. This means that: 
$ The encodings in this description are named to match the encodings of VQMOVN, VQMOVUN. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 


° The description of VQMOVN, VQMOVUN gives the operational pseudocode for this instruction. 
A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 


77710077 10]1 isej o] va Jojo 7 of xmo] vm | 
op 


Signed result variant 
VQRSHRN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VQMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


ainan 1 ajoji ifsize[1 of va fojo 1 oj1 xjmjo] vm | 
op 


Signed result variant 
VQRSHRN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VQMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operand, encoded in the "op<0>:size" field. It can have the 
following values: 
S16 when op<0> = 0, size = 00 
$32 when op<@> = 0, size = 01 
S64 when op<0> = 0, size = 10 
U16 when op<@> = 1, size = 00 
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01 
10 


U32 when op<0@> = 1, size 


U64 when op<@> = 1, size 


The following encodings are reserved: 
° op<0> = 0, size = 11. 


. op<ð> = 1, size = 11. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


The description of VQMOVN, VQMOVUN gives the operational pseudocode for this instruction. 
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F6.1.176 


F6-5262 


VQRSHRN, VQRSHRUN 


Vector Saturating Rounding Shift Right, Narrow takes each element in a quadword vector of integers, right shifts 
them by an immediate value, and places the rounded results in a doubleword vector. 


For truncated results, see VQSHL (register). 

The operand elements must all be the same size, and can be any one of: 
° 16-bit, 32-bit, or 64-bit signed integers. 

š 16-bit, 32-bit, or 64-bit unsigned integers. 


The result elements are half the width of the operand elements. If the operand elements are signed, the results can 
be either signed or unsigned. If the operand elements are unsigned, the result elements must also be unsigned. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28/27 26 25 24|23 2221 | 16/15 12/1109 8|7 6 5 4|3 0 | 


11100 1ļjujijo] imme | va fri 0 ofofojijmji] vm | 


Signed result variant 
Applies when !(imm6 == 000xxx) && op == 1. 


VQRSHRN{<c>}{<q>}.<type><size> <Dd>, <Qm>, #<imm> 


Unsigned result variant 
Applies when U == 1 && !(imm6 == 000xxx) && op == 0. 


VQRSHRUN{<c>}{<q>}.<type><size> <Dd>, <Qm>, #<imm> 


Decode for all variants of this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 

if U == 'Q' && op == '@' then SEE "VRSHRN"; 

if Vm<@> == '1' then UNDEFINED; 

case imm6 of 
when 'QQ1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when 'Q@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when '1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 

src_unsigned = (U == '1' && op == '1'); dest_unsigned = (U == '1') 

d = UInt(D:Vd); m = UInt(M:Vm); 


T1 
|15 14 13 12|11 10 9 8|7 6 5 | 0 |15 12/1109 8|7 6 5 4/3 0 | 


aaua to] imme [va [10 oflo [mya] vm _ 


Signed result variant 


Applies when ! (imm6 == 000xxx) && op == 1. 
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VQRSHRN{<c>}{<q>}.<type><size> <Dd>, <Qm>, #<imm> 


Unsigned result variant 
Applies when U == 1 && !(imm6 == 000xxx) && op == Q. 


VQRSHRUN{<c>}{<q>}.<type><size> <Dd>, <Qm>, #<imm> 


Decode for all variants of this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 


if U == '@' && op == '@' then SEE "VRSHRN"; 
if Vm<@> == '1' then UNDEFINED; 


case imm6 of 


when 'QQ1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when '@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when '1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 


src_unsigned 


= (U == '1' & op == '1'); dest_unsigned = (U == '1'); 


d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 


set. 


Assembler symbols 


<C> 


<q> 


<type> 


<size> 


<Dd> 
<Qm> 


<imm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

For the signed result variant: is the data type for the elements of the vectors, encoded in the "U" 
field. It can have the following values: 

S when U = 0 

U when U = 1 


For the unsigned result variant: is the data type for the elements of the vectors, encoded in the "U" 
field. It can have the following values: 


S when U = 1 


Is the data size for the elements of the vectors, encoded in the "imm6<5:3>" field. It can have the 
following values: 


16 when imm6<5:3> = 001 
32 when imm6<5:3> = 01x 
64 when imm6<5:3> = 1xx 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Is an immediate value, in the range 1 to <size>/2, encoded in the "imm6" field as <size>/2 - <imm>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
round_const = 1 << (shift_amount - 1); 
for e = 0 to elements-1 
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operand = Int(Elem[Qin[m>>1],e,2*esize], src_unsigned) ; 

(result, sat) = SatQ((operand + round_const) >> shift_amount, esize, dest_unsigned); 
Elem[D[d],e,esize] = result; 

if sat then FPSCR.QC = '1'; 
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F6.1.177 VQRSHRUN (zero) 


Vector Saturating Rounding Shift Right, Narrow takes each element in a quadword vector of integers, right shifts 
them by an immediate value, and places the unsigned rounded results in a doubleword vector 


This instruction is a pseudo-instruction of the VQMOVN, VQMOVUN instruction. This means that: 
$ The encodings in this description are named to match the encodings of VQMOVN, VQMOVUN. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 


° The description of VQMOVN, VQMOVUN gives the operational pseudocode for this instruction. 
A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 121110 9 8|7 6 5 4/3 0| 


mana oor iph isej o] va Jojo 7 ojo rmo] wm | 
op 


Unsigned result variant 
VQRSHRUN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VQMOVUN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


ti titi tfoft ifsize[1 of va fojo 1 ojo 1jmjo] vm | 
op 


Unsigned result variant 
VQRSHRUN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VQMOVUN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operand, encoded in the "size" field. It can have the following 
values: 
S16 when size = 00 
$32 when size = 01 
S64 when size = 10 


The encoding size = 11 is reserved. 
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<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


The description of VQMOVN, VQMOVUN gives the operational pseudocode for this instruction. 
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F6.1.178 VQSHL, VQSHLU (immediate) 


Vector Saturating Shift Left (immediate) takes each element in a vector of integers, left shifts them by an immediate 
value, and places the results in a second vector. 


The operand elements must all be the same size, and can be any one of: 
. 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 
° 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 


The result elements are the same size as the operand elements. If the operand elements are signed, the results can 
be either signed or unsigned. If the operand elements are unsigned, the result elements must also be unsigned. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28/27 26 25 24|23 2221 | 16/15 12/1109 8|7 6 5 4|3 0 | 


77100 tlt] imme | va Joi roM vm _| 


VQSHL, double, signed-result variant 
Applies when !(imm6 == 000xxx && L == 0) && op == 1 && Q == 0. 


VQSHL{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 


VQSHL, quad, signed-result variant 
Applies when !(imm6 == 000xxx && L == 0) && op == 1 && Q == 1. 


VQSHL{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 


VQSHLU, double, unsigned-result variant 
Applies when U == 1 && !(imm6 == Q@0xxx && L == 0) && op == 0 & Q == 0. 


VQSHLU{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 


VQSHLU, quad, unsigned-result variant 
Applies when U == 1 && !(imm6 == Q@0xxx && L == 0) && op == 0 & Q == 1. 


VQSHLU{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 


Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if U == 'Q' && op == '@' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'QQQ1xxx' esize = 8; elements = 8; shift_amount = UInt(imm6) - 8; 
when 'QQ1xxxx' esize = 16; elements = 4; shift_amount = UInt(imm6) - 16; 
when 'Q@1xxxxx' esize = 32; elements = 2; shift_amount = UInt(imm6) - 32; 
when '1xxxxxx' esize = 64; elements = 1; shift_amount = UInt(imm6); 

src_unsigned = (U == '1' && op == '1'); dest_unsigned = (U == '1') 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
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F6-5268 


T1 


|15 14 13 121110 9 8|7 6 5 | 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aut tt o me | va fo 1 reM vm _ 


VQSHL, double, signed-result variant 

Applies when !(imm6 == 000xxx && L == 0) && op == 1 && Q == 0. 
VQSHL{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 
VQSHL, quad, signed-result variant 

Applies when !(imm6 == 000xxx && L == 0) && op == 1 & Q == 1. 


VQSHL{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 


VQSHLU, double, unsigned-result variant 


Applies when U == 1 && !(imm6 == Q@0xxx && L == 0) && op == 0 & Q == 0. 


VQSHLU{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 


VQSHLU, quad, unsigned-result variant 


Applies when U == 1 && !(imm6 == Q@0xxx && L == 0) && op == 0 & Q == 1. 


VQSHLU{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 


Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if U == '@' && op == '@' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'QQQ1xxx' esize = 8; elements = 8; shift_amount = 
when 'QQ@1xxxx' esize = 16; elements = 4; shift_amount 
when 'Q1xxxxx' esize = 32; elements = 2; shift_amount 
when '1xxxxxx' esize = 64; elements = 1; shift_amount 

src_unsigned = (U == '1' && op == '1'); dest_unsigned = (U = 


UInt(imm6) - 8; 
UInt(imm6) - 16; 
UInt(imm6) - 32; 
UInt(imm6) ; 
'1'); 


d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 


set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 


<type> Is the data type for the elements of the vectors, encoded in the "U" field. It can have the following 


values: 
S when U 
U when U 


iT} 1 
e O 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


ARM DDI 0487E.a 
ID070919 


<size> 


<Qd> 
<Qm> 
<Dd> 
<Dm> 
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Is the data size for the elements of the vectors, encoded in the "L:imm6<5:3>" field. It can have the 
following values: 


8 when L = 0, imm6<5:3> = 001 
16 when L = Q, imm6<5:3> = 01x 
32 when L = 0, imm6<5:3> = 1xx 
64 when L = 1, imm6<5:3> = xxx 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 

Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Is an immediate value, in the range 0 to <size>-1, encoded in the "imm6" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = ð to regs-1 


for e = Q to elements-1 
operand = Int(Elem[D[m+r],e,esize], src_unsigned); 
(result, sat) = SatQ(operand << shift_amount, esize, dest_unsigned) ; 
Elem[D[d+r],e,esize] = result; 
if sat then FPSCR.QC = '1'; 
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F6.1.179 


F6-5270 


VQSHL (register) 


Vector Saturating Shift Left (register) takes each element in a vector, shifts them by a value from the least significant 
byte of the corresponding element of a second vector, and places the results in the destination vector. If the shift 
value is positive, the operation is a left shift. Otherwise, it is a right shift. 


The results are truncated. For rounded results, see VQRSHL. 

The first operand and result elements are the same data type, and can be any one of: 
è 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 

° 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 

The second operand is a signed integer of the same size. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


11 1100 1jujojofsze| vn | va jo 1 0 ofnjajmji] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQSHL{<c>}{<q>}.<dt> {<Dd>,} <Dm>, <Dn> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VQSHL{<c>}{<q>}.<dt> {<Qd>,} <Qm>, <Qn> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<O> == '1' || Vm<@> == '1' || Vn<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); n = UInt(N:Vn); regs = if Q == '@' then 1 else 2; 


T1 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


7 afult 777 opse] va | va joro onom vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VQSHL{<c>}{<q>}.<dt> {<Dd>,} <Dm>, <Dn> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VQSHL{<c>}{<q>}.<dt> {<Qd>,} <Qm>, <Qn> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vm<@> == '1' || Vn<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); n = UInt(N:Vn); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = 0, size = 01 
S32 when U = 0, size = 10 
S64 when U = 0, size = 11 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
U64 when U = 1, size = 11 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 

shift = SInt(Elem[D[n+r],e,esize]<7:0>); 
operand = Int(Elem[D[m+r],e,esize], unsigned); 
(result,sat) = SatQ(operand << shift, esize, unsigned); 
Elem[D[d+r],e,esize] = result; 
if sat then FPSCR.QC = '1'; 
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F6.1.180 


F6-5272 


VQSHRN (zero) 


Vector Saturating Shift Right, Narrow takes each element in a quadword vector of integers, right shifts them by an 
immediate value, and places the signed truncated results in a doubleword vector 


This instruction is a pseudo-instruction of the VQMOVN, VQMOVUN instruction. This means that: 
$ The encodings in this description are named to match the encodings of VQMOVN, VQMOVUN. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 


° The description of VQMOVN, VQMOVUN gives the operational pseudocode for this instruction. 
A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1109 8|7 6 5 4|3 0| 


mara oor iph isej of va Jojo 1 of xmo] wm | 
op 


Signed result variant 
VQSHRN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VQMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


aiaa a1 1 ajoji ifsize[1 of va fojo 1 oj1 xjmjo] vm | 
op 


Signed result variant 
VQSHRN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VQMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operand, encoded in the "op<0>:size" field. It can have the 
following values: 
S16 when op<0> = 0, size = 00 
$32 when op<@> = 0, size = 01 
S64 when op<0> = 0, size = 10 
U16 when op<@> = 1, size = 00 
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01 
10 


U32 when op<0@> = 1, size 


U64 when op<@> = 1, size 


The following encodings are reserved: 
° op<0> = 0, size = 11. 


. op<ð> = 1, size = 11. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


The description of VQMOVN, VQMOVUN gives the operational pseudocode for this instruction. 
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F6.1.181 


F6-5274 


VQSHRN, VQSHRUN 


Vector Saturating Shift Right, Narrow takes each element in a quadword vector of integers, right shifts them by an 
immediate value, and places the truncated results in a doubleword vector. 


For rounded results, see VQRSHRN, VQRSHRUN. 

The operand elements must all be the same size, and can be any one of: 
° 16-bit, 32-bit, or 64-bit signed integers. 

š 16-bit, 32-bit, or 64-bit unsigned integers. 


The result elements are half the width of the operand elements. If the operand elements are signed, the results can 
be either signed or unsigned. If the operand elements are unsigned, the result elements must also be unsigned. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28/27 26 25 24|23 2221 | 16/15 12/1110 9 8|7 6 5 4|3 0 | 


111100 1ļjujijo] imme | va fri 0 ofofojojmji] vm | 


Signed result variant 
Applies when !(imm6 == 000xxx) && op == 1. 


VQSHRN{<c>}{<q>}.<type><size> <Dd>, <Qm>, #<imm> 


Unsigned result variant 
Applies when U == 1 && !(imm6 == 000xxx) && op == 0. 


VQSHRUN{<c>}{<q>}.<type><size> <Dd>, <Qm>, #<imm> 


Decode for all variants of this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 

if U == '0' && op == '@' then SEE "VSHRN"; 

if Vm<@> == '1' then UNDEFINED; 

case imm6 of 
when 'QQ1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when 'Q@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when '1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 

src_unsigned = (U == '1' && op == '1'); dest_unsigned = (U == '1') 

d = UInt(D:Vd); m = UInt(M:Vm); 


T1 
|15 14 13 12|11 10 9 8|7 6 5 | 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


aaua 1p] imme | va [10 oflo jome vm _ 


Signed result variant 


Applies when ! (imm6 == 000xxx) && op == 1. 
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VQSHRN{<c>}{<q>}.<type><size> <Dd>, <Qm>, #<imm> 


Unsigned result variant 


Applies when U == 1 && !(imm6 == Q00xxx) && op == 0. 


VQSHRUN{<c>}{<q>}.<type><size> <Dd>, <Qm>, #<imm> 


Decode for all variants of this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 
if U == '@' && op == 'Q@' then SEE "VSHRN"; 
if Vm<@> == '1' then UNDEFINED; 


case imm6 of 


when 'QQ1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when '@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when '1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 


src_unsigned 


= (U == '1' & op == '1'); dest_unsigned = (U == '1'); 


d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 


set. 


Assembler symbols 


<C> 


<q> 


<type> 


<size> 


<Dd> 
<Qm> 


<imm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

For the signed result variant: is the data type for the elements of the vectors, encoded in the "U" 
field. It can have the following values: 

S when U = 0 

U when U = 1 


For the unsigned result variant: is the data type for the elements of the vectors, encoded in the "U" 
field. It can have the following values: 


S when U = 1 


Is the data size for the elements of the vectors, encoded in the "imm6<5:3>" field. It can have the 
following values: 


16 when imm6<5:3> = 001 
32 when imm6<5:3> = 01x 
64 when imm6<5:3> = 1xx 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Is an immediate value, in the range 1 to <size>/2, encoded in the "imm6" field as <size>/2 - <imm>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for e = 0 to elements-1 
operand = Int(Elem[Qin[m>>1],e,2esize], src_unsigned) ; 
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(result, sat) = SatQ(operand >> shift_amount, esize, dest_unsigned) ; 
Elem[D[d],e,esize] = result; 
if sat then FPSCR.QC = '1'; 
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F6.1.182 VQSHRUN (zero) 


Vector Saturating Shift Right, Narrow takes each element in a quadword vector of integers, right shifts them by an 
immediate value, and places the unsigned truncated results in a doubleword vector 


This instruction is a pseudo-instruction of the VQMOVN, VQMOVUN instruction. This means that: 
$ The encodings in this description are named to match the encodings of VQMOVN, VQMOVUN. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 


° The description of VQMOVN, VQMOVUN gives the operational pseudocode for this instruction. 
A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 121110 9 8|7 6 5 4/3 0| 


77710077 10]1 isejo] va Jojo 7 ojo rimo] vwm | 
op 


Unsigned result variant 
VQSHRUN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VQMOVUN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


titi tfoft ifsize[1 of va fojo 1 ojo 1jmjo] vm | 
op 


Unsigned result variant 
VQSHRUN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VQMOVUN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operand, encoded in the "size" field. It can have the following 
values: 
S16 when size = 00 
$32 when size = 01 
S64 when size = 10 


The encoding size = 11 is reserved. 
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<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


The description of VQMOVN, VQMOVUN gives the operational pseudocode for this instruction. 


F6-5278 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.183 VQSUB 


ARM DDI 0487E.a 
ID070919 


Vector Saturating Subtract subtracts the elements of the second operand vector from the corresponding elements of 
the first operand vector, and places the results in the destination vector. Signed and unsigned operations are distinct. 


The operand and result elements must all be the same type, and can be any one of: 
. 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 
. 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 


If any of the results overflow, they are saturated. The cumulative saturation bit, FPSCR.QC, is set if saturation 
occurs. For details see Pseudocode description of saturation on page E1-3785. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


[111400 1jujojo]sze| vn | vd joo 1 ofnjajmji] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 

VQSUB{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm> 

128-bit SIMD vector variant 

Applies when Q == 1. 

VQSUB{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Qm> 

Decode for all variants of this encoding 
if Q == '1' && (Vd<ð> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 oļ15 12/1110 9 8|7 6 5 4|3 0 | 


1 tfuj1 1 1 1 ofdfsize] vn | va fo o 1 ofnjajmji] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VQSUB{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VQSUB{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> 


<q> 


<dt> 


<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "U:size" field. It can have the 
following values: 


S8 when U = 0, size = 00 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
S64 when U = 0, size = 11 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
U64 when U = 1, size = 11 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 


F6-5280 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 


diff = Int(Elem[D[n+r],e,esize], unsigned) - Int(Elem[D[m+r],e,esize], unsigned); 
(Elem[D[d+r],e,esize], sat) = SatQ(diff, esize, unsigned); 
if sat then FPSCR.QC = '1'; 
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F6.1.184 VRADDHN 


ARM DDI 0487E.a 
ID070919 


Vector Rounding Add and Narrow, returning High Half adds corresponding elements in two quadword vectors, and 
places the most significant half of each result in a doubleword vector. The results are rounded. For truncated results, 
see VADDHN. 


The operand elements can be 16-bit, 32-bit, or 64-bit integers. There is no distinction between signed and unsigned 
integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 

|31 30 29 28|27 26 25 24|23 22 21 20/19 16|15 12/1110 9 8|7 6 5 4|3 o| 

Darn ooiphion] va | va [o1 o oNomMo] wm | 
size 

A1 variant 


VRADDHN{<c>}{<q>}.<dt> <Dd>, <Qn>, <Qm> 


Decode for this encoding 
if size == '11' then SEE "Related encodings"; 
if Vn<@> == '1' || Vm<0> == '1' then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


moop pen] vw | va fo o onoo] vm _| 


size 


T1 variant 


VRADDHN{<c>}{<q>}.<dt> <Dd>, <Qn>, <Qm> 


Decode for this encoding 

if size == '11' then SEE "Related encodings"; 

if Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 
Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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F6-5282 


<dt> 


<Dd> 
<Qn> 


<Qm> 


Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 


116 when size = 00 
132 when size = 01 
164 when size = 10 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
round_const = 1 << (esize-1); 
for e = Q to elements-1 


result = Elem[Qin[n>>1],e,2xesize] + Elem[Qin[m>>1],e,2*esize] + round_const; 
Elem[D[d],e,esize] = result<2esize-1:esize>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.185 VRECPE 


Vector Reciprocal Estimate finds an approximate reciprocal of each element in the operand vector, and places the 


results in the destination vector. 


The operand and result elements are the same type, and can be floating-point numbers or unsigned integers. 


For details of the operation performed by this instruction see Floating-point reciprocal square root estimate and 


step on page E1-3803. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 


11110011 101 isej] va Jol ojFlojemo] vwm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRECPE{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRECPE{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
floating_point = (F == '1'); 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 





maanani] va ol ofroje o] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VRECPE{<c>}{<q>}.<dt> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 


VRECPE{<c>}{<q>}.<dt> <Qd>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
floating_point = (F == '1'); 
case size of 
when 'Q@1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 

s The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "F:size" field. It can have the 
following values: 
U32 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Newton-Raphson iteration 


For details of the operation performed and how it can be used in a Newton-Raphson iteration to calculate the 
reciprocal of a number, see Floating-point reciprocal estimate and step on page E1-3802. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
if floating_point then 
Elem[D[d+r],e,esize] = FPRecipEstimate(Elem[D[m+r],e,esize], StandardFPSCRValue()); 
else 
Elem[D[d+r],e,esize] = UnsignedRecipEstimate(Elem[D[m+r] ,e,esize]); 
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F6.1.186 VRECPS 


Vector Reciprocal Step multiplies the elements of one vector by the corresponding elements of another vector, 
subtracts each of the products from 2.0, and places the results into the elements of the destination vector. 


The operand and result elements are floating-point numbers. 


For details of the operation performed by this instruction see Floating-point reciprocal estimate and step on 
page E1-3802. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


77100 tfofo[ppofs] va | va poeme vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRECPS{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRECPS{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


[1 t ijoja 1 1 1 ofpfofsz] vn | va fi 11 1fnjajmji] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VRECPS{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VRECPS{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If size == '01' & InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

. The instruction executes as if it passes the Condition code check. 

e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Newton-Raphson iteration 


For details of the operation performed and how it can be used in a Newton-Raphson iteration to calculate the 
reciprocal of a number, see Floating-point reciprocal estimate and step on page E1-3802. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = FPRecipStep(Elem[D[n+r],e,esize], Elem[D[m+r],e,esize]); 


F6-5286 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


F6.1.187 VREV16 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Vector Reverse in halfwords reverses the order of 8-bit elements in each halfword of the vector, and places the result 
in the corresponding destination vector. 


There is no distinction between data types, other than size. 


The following figure shows the operation of VREV16 doubleword operation. 


VREV16.8, doubleword 
Dm 


Dd 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 


12/1110 9 8|7 6 5 4|3 0| 


11110011 1{d]1 1[szeļo of va [ojo of1 ojajmjo] vm | 
op 


64-bit SIMD vector variant 


Applies when Q == 0. 


ARM DDI 0487E.a 


VREV16{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VREV16{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if UInt(op)+UInt(size) >= 3 then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size) 
integer container_size; 
case op of 
when '10' container_size = 16; 
when '01' container_size = 32; 
when '00' container_size = 64; 
integer containers = 64 DIV container_size; 
integer elements_per_container = container_size DIV esize; 


d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
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T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 121110 9 8|7 6 5 4|3 0| 


11ra raap isejo o] va Jojo ojt ojojo] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VREV16{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VREV16{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if UInt(op)+UInt(size) >= 3 then UNDEFINED; 
if Q == '1' & (Vd<ð> == '1' || Vm<ð> == '1') then UNDEFINED; 


esize = 8 << UInt(size) 
integer container_size; 
case op of 
when '10' container_size = 16; 
when '@1' container_size = 32; 
when '00' container_size = 64; 
integer containers = 64 DIV container_size; 
integer elements_per_container = container_size DIV esize; 


d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the operand, encoded in the "size" field. It can have the following 
values: 
8 when size = 00 


The following encodings are reserved: 


° size = 0l. 
° size = 1x. 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 


bits(64) result; 
integer element; 
integer rev_element; 
for r = ð to regs-1 
element = Q; 
for c = Q to containers-1 
rev_element = element + elements_per_container - 1; 
for e = @ to elements_per_container-1 
Elem[result, rev_element, esize] = Elem[D[m+r], element, esize]; 
element = element + 1; 
rev_element = rev_element - 1; 
D[d+r] = result; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.188 VREV32 


F6-5290 


Vector Reverse in words reverses the order of 8-bit or 16-bit elements in each word of the vector, and places the 


result in the corresponding destination vector. 
There is no distinction between data types, other than size. 


The following figure shows the operation of VREV32 doubleword operations. 
VREV32.8, doubleword VREV32.16, doubleword 


Dm Dm 

Dd Dd 
Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 


o | 


11110011 1{d]1 1[szeļo of va [ojo ofo 1jajmjo] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VREV32{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VREV32{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if UInt(op)+UInt(size) >= 3 then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<ð> == '1') then UNDEFINED; 


esize = 8 << UInt(size) 
integer container_size; 
case op of 
when '10' container_size = 16; 
when '01' container_size = 32; 
when '00' container_size = 64; 
integer containers = 64 DIV container_size; 
integer elements_per_container = container_size DIV esize; 


d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
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T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1110 9 8|7 6 5 4|3 0| 


11ra raapi isejo o] va Jojo ojo jomo] vwm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VREV32{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VREV32{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if UInt(op)+UInt(size) >= 3 then UNDEFINED; 
if Q == '1' & (Vd<ð> == '1' || Vm<ð> == '1') then UNDEFINED; 


esize = 8 << UInt(size) 
integer container_size; 
case op of 
when '10' container_size = 16; 
when '@1' container_size = 32; 
when '00' container_size = 64; 
integer containers = 64 DIV container_size; 
integer elements_per_container = container_size DIV esize; 


d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> Is the data type for the elements of the operand, encoded in the "size" field. It can have the following 
values: 
8 when size = 00 
16 when size = 01 


The encoding size = 1x is reserved. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 


bits(64) result; 
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integer element; 
integer rev_element; 
for r = 0 to regs-1 
element = Q; 
for c = Q@ to containers-1 
rev_element = element + elements_per_container - 1; 
for e = 0 to elements_per_container-1 
Elem[result, rev_element, esize] = Elem[D[m+r], element, esize]; 
element = element + 1; 
rev_element = rev_element - 1; 
D[d+r] = result; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.189 VREV64 


Vector Reverse in doublewords reverses the order of 8-bit, 16-bit, or 32-bit elements in each doubleword of the 
vector, and places the result in the corresponding destination vector. 


There is no distinction between data types, other than size. 


The following figure shows the operation of VREV64 doubleword operations. 
VREV64.8, doubleword VREV64.32, quadword 


Dm Qm 
Dd Qm 
Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 


the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 121110 9 8|7 6 5 4|3 0| 


11110011 1|p]1 t1{sizelo of va [ojo ofo ojaļmjo] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VREV64{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VREV64{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if UInt(op)+UInt(size) >= 3 then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size) 
integer container_size; 
case op of 
when '10' container_size = 16; 
when '01' container_size = 32; 
when '00' container_size = 64; 
integer containers = 64 DIV container_size; 
integer elements_per_container = container_size DIV esize; 


d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
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T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4|3 0| 


Tiiti1i17 to] isejo o] va Jojo ojo ojojmo] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VREV64{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VREV64{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if UInt(op)+UInt(size) >= 3 then UNDEFINED; 
if Q == '1' & (Vd<ð> == '1' || Vm<ð> == '1') then UNDEFINED; 


esize = 8 << UInt(size) 
integer container_size; 
case op of 
when '10' container_size = 16; 
when '@1' container_size = 32; 
when '00' container_size = 64; 
integer containers = 64 DIV container_size; 
integer elements_per_container = container_size DIV esize; 


d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operand, encoded in the "size" field. It can have the following 
values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 


bits(64) result; 
integer element; 
integer rev_element; 
for r = ð to regs-1 
element = Q; 
for c = Q to containers-1 
rev_element = element + elements_per_container - 1; 
for e = @ to elements_per_container-1 
Elem[result, rev_element, esize] = Elem[D[m+r], element, esize]; 
element = element + 1; 
rev_element = rev_element - 1; 
D[d+r] = result; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.190 


F6-5296 


VRHADD 


Vector Rounding Halving Add adds corresponding elements in two vectors of integers, shifts each result right one 


bit, and places the final results in the destination vector. 

The operand and result elements are all the same type, and can be any one of: 
s 8-bit, 16-bit, or 32-bit signed integers. 

è 8-bit, 16-bit, or 32-bit unsigned integers. 


The results of the halving operations are rounded. For truncated results, see VHADD. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


1411100 1Jujojp}sie} vn | va foo 0 1jnjajmjo] vwm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VRHADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VRHADD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 1211110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


7 afuft 117 opse] va | va Jo oorno] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VRHADD{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VRHADD{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operands, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = 0 to elements-1 

opl = Int(Elem[D[n+r],e,esize], unsigned); 
op2 = Int(Elem[D[m+r],e,esize], unsigned); 
result = opl + op2 + 1; 
Elem[D[d+r],e,esize] = result<esize:1>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-5297 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


— The values of the NZCV flags. 
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ARM DDI 0487E.a 
ID070919 


Vector Round floating-point to integer towards Nearest with Ties to Away rounds a vector of floating-point values 
to integral floating-point values of the same size using the Round to Nearest with Ties to Away rounding mode. A 
zero input gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and a 


NaN is propagated as for normal arithmetic. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 |7 65 4|3 0 | 


Ti 770077 1p isejo] va Jojo ojoo] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTA{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTA{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if op<2> != op<@> then SEE "Related encodings"; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == '01' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
// Rounding encoded differently from other VCVT and VRINT instructions 
rounding = FPDecodeRM(op<2>:NOT(op<1>)); exact = FALSE; 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 |7 6 5 4|3 0| 


77147171 jsej o] va jojo ojoo] vwm 





64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTA{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTA{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if op<2> != op<@> then SEE "Related encodings"; 

if InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
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F6-5300 


// Rounding encoded differently from other VCVT and VRINT instructions 
rounding = FPDecodeRM(op<2>:NOT(op<1>)); exact = FALSE; 
case size of 
when '01' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
$ The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


Related encodings: See Advanced SIMD two registers misc on page F3-3966 for the T32 instruction set, or 
Advanced SIMD two registers misc on page F4-4053 for the A32 instruction set. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
op1 = Elem[D[m+r],e,esize]; 
result = FPRoundInt(op1, StandardFPSCRValue(), rounding, exact); 
Elem[D[d+r],e,esize] = result; 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.192  VRINTA (floating-point) 


ARM DDI 0487E.a 
ID070919 


Round floating-point to integer to Nearest with Ties to Away rounds a floating-point value to an integral 


floating-point value of the same size using the Round to Nearest with Ties to Away rounding mode. A zero input 
gives a zero result with the same sign, an infinite input gives an infinite result with the same sign, and a NaN is 


propagated as for normal arithmetic. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4|3 0 | 
11111110 ojoo) va [i oeoo Mo] vm | 
RM size 


Half-precision scalar variant 
Applies when size == 01. 


VRINTA{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VRINTA{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VRINTA{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 

rounding = FPDecodeRM(RM); exact = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 1 0|15 121110 9 8|7 6 5 4|3 0| 
141111410 1/D{1 1 1Jo}o0 of va [1 of oofo[1|mMjo] vm | 
RM size 


Half-precision scalar variant 
Applies when size == 01. 


VRINTA{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 
VRINTA{<q>}.F32 <Sd>, <Sm> 
Double-precision scalar variant 


Applies when size == 11. 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


VRINTA{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); exact = FALSE; 

case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = Zeros(16) : FPRoundInt(S[m]<15:@>, FPSCR, rounding, exact); 
when 32 
S[d] = FPRoundInt(S[m], FPSCR, rounding, exact); 
when 64 
D[d] = FPRoundInt(D[m], FPSCR, rounding, exact); 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.193  VRINTM (Advanced SIMD) 


ARM DDI 0487E.a 
ID070919 


Vector Round floating-point to integer towards -Infinity rounds a vector of floating-point values to integral 
floating-point values of the same size, using the Round towards -Infinity rounding mode. A zero input gives a zero 
result with the same sign, an infinite input gives an infinite result with the same sign, and a NaN is propagated as 


for normal arithmetic. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 |7 65 4|3 0 | 


Ti 770077 1)0[1 isejo] va jop 0 7]Q[w[o] vm _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTM{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTM{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if op<2> != op<@> then SEE "Related encodings"; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == '01' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
// Rounding encoded differently from other VCVT and VRINT instructions 
rounding = FPDecodeRM(op<2>:NOT(op<1>)); exact = FALSE; 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 |7 6 5 4|3 0 | 


7411177 p isej o] va opi oomo vm _| 





64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTM{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTM{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if op<2> != op<@> then SEE "Related encodings"; 

if InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
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F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6-5304 


// Rounding encoded differently from other VCVT and VRINT instructions 
rounding = FPDecodeRM(op<2>:NOT(op<1>)); exact = FALSE; 
case size of 
when '01' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
$ The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


Related encodings: See Advanced SIMD two registers misc on page F3-3966 for the T32 instruction set, or 
Advanced SIMD two registers misc on page F4-4053 for the A32 instruction set. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
op1 = Elem[D[m+r],e,esize]; 
result = FPRoundInt(op1, StandardFPSCRValue(), rounding, exact); 
Elem[D[d+r],e,esize] = result; 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.194  VRINTM (floating-point) 


Round floating-point to integer towards -Infinity rounds a floating-point value to an integral floating-point value of 
the same size using the Round towards -Infinity rounding mode. A zero input gives a zero result with the same sign, 
an infinite input gives an infinite result with the same sign, and a NaN is propagated as for normal arithmetic. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4]3 0 | 
11111110 1{0[{11 1fofa 1{ va [1 ofoojojijmjo] vm | 
RM size 


Half-precision scalar variant 
Applies when size == 01. 


VRINTM{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VRINTM{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VRINTM{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); exact = FALSE; 
case size of 


when '01' esize = 16; d = UInt(Vd:D); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); m = UInt(M:Vm); 
T1 
|15 14 13 12/1110 9 8|7 6 5 4/3 2 1 0|15 12|11 10 9 8|7 6 5 4|3 0| 
irao ph io 1] va [1 opoo Mo] v] 
RM size 
Half-precision scalar variant 
Applies when size == 01. 
VRINTM{<q>}.F16 <Sd>, <Sm> 
Single-precision scalar variant 
Applies when size == 10. 
VRINTM{<q>}.F32 <Sd>, <Sm> 
Double-precision scalar variant 
Applies when size == 11. 
VRINTM{<q>}.F64 <Dd>, <Dm> 
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F6-5306 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

rounding = FPDecodeRM(RM); exact = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = Zeros(16) : FPRoundInt(S[m]<15:@>, FPSCR, rounding, exact); 
when 32 
S[d] = FPRoundInt(S[m], FPSCR, rounding, exact); 
when 64 
D[d] = FPRoundInt(D[m], FPSCR, rounding, exact); 
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T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.195 | VRINTN (Advanced SIMD) 


ARM DDI 0487E.a 
ID070919 


Vector Round floating-point to integer to Nearest rounds a vector of floating-point values to integral floating-point 
values of the same size using the Round to Nearest rounding mode. A zero input gives a zero result with the same 
sign, an infinite input gives an infinite result with the same sign, and a NaN is propagated as for normal arithmetic. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 |7 65 4|3 0 | 


11110011 1{d]1 afsize{1 of va [ojijo o ojajmjo] vm | 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTN{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTN{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if op<2> != op<@> then SEE "Related encodings"; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
// Rounding encoded differently from other VCVT and VRINT instructions 
rounding = FPDecodeRM(op<2>:NOT(op<1>)); exact = FALSE; 
case size of 
when '01' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0\15 12/1109 |7 6 5 4|3 0 | 


aiaa a1 a ajoji ifsize[1 of va [ofifo o ojajmjo] vm | 





op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTN{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTN{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if op<2> != op<@> then SEE "Related encodings"; 

if InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
// Rounding encoded differently from other VCVT and VRINT instructions 
rounding = FPDecodeRM(op<2>:NOT(op<1>)); exact = FALSE; 
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F6-5308 


case size of 
when 'Q@1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
s The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


Related encodings: See Advanced SIMD two registers misc on page F3-3966 for the T32 instruction set, or 
Advanced SIMD two registers misc on page F4-4053 for the A32 instruction set. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = 0 to elements-1 
op1 = Elem[D[m+r],e,esize]; 
result = FPRoundInt(op1, StandardFPSCRValue(), rounding, exact); 
Elem[D[d+r],e,esize] = result; 
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F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.196 VRINTN (floating-point) 


Round floating-point to integer to Nearest rounds a floating-point value to an integral floating-point value of the 
same size using the Round to Nearest rounding mode. A zero input gives a zero result with the same sign, an infinite 
input gives an infinite result with the same sign, and a NaN is propagated as for normal arithmetic. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4]3 0 | 
11111110 1{0[11 1fofo 1| va [1 ofoojojijmjo] vm | 
RM size 


Half-precision scalar variant 
Applies when size == 01. 


VRINTN{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VRINTN{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VRINTN{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); exact = FALSE; 
case size of 


when '01' esize = 16; d = UInt(Vd:D); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); m = UInt(M:Vm); 
T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 2 1 0|15 12|11 10 9 8|7 6 5 4|3 0| 
irao ap ioon] va [1 opoo Mo] vm] 
RM size 
Half-precision scalar variant 
Applies when size == 01. 
VRINTN{<q>}.F16 <Sd>, <Sm> 
Single-precision scalar variant 
Applies when size == 10. 
VRINTN{<q>}.F32 <Sd>, <Sm> 
Double-precision scalar variant 
Applies when size == 11. 
VRINTN{<q>}.F64 <Dd>, <Dm> 
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F6-5310 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

rounding = FPDecodeRM(RM); exact = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = Zeros(16) : FPRoundInt(S[m]<15:@>, FPSCR, rounding, exact); 
when 32 
S[d] = FPRoundInt(S[m], FPSCR, rounding, exact); 
when 64 
D[d] = FPRoundInt(D[m], FPSCR, rounding, exact); 
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F6.1.197 | VRINTP (Advanced SIMD) 


Vector Round floating-point to integer towards +Infinity rounds a vector of floating-point values to integral 
floating-point values of the same size using the Round towards +Infinity rounding mode. A zero input gives a zero 
result with the same sign, an infinite input gives an infinite result with the same sign, and a NaN is propagated as 
for normal arithmetic. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1109 |7 6 5 4|3 o| 


11110011 1p isej of va jop emo] m _| 
op 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTP{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTP{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if op<2> != op<@> then SEE "Related encodings"; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == '01' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
// Rounding encoded differently from other VCVT and VRINT instructions 
rounding = FPDecodeRM(op<2>:NOT(op<1>)); exact = FALSE; 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 |7 6 5 4|3 0| 


7714177 p jsej o] va op eemo vm 





64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTP{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTP{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if op<2> != op<@> then SEE "Related encodings"; 

if InITBlock() then UNPREDICTABLE; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
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F6-5312 


// Rounding encoded differently from other VCVT and VRINT instructions 
rounding = FPDecodeRM(op<2>:NOT(op<1>)); exact = FALSE; 
case size of 
when '01' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
$ The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


Related encodings: See Advanced SIMD two registers misc on page F3-3966 for the T32 instruction set, or 
Advanced SIMD two registers misc on page F4-4053 for the A32 instruction set. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
op1 = Elem[D[m+r],e,esize]; 
result = FPRoundInt(op1, StandardFPSCRValue(), rounding, exact); 
Elem[D[d+r],e,esize] = result; 
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F6.1.198  VRINTP (floating-point) 


Round floating-point to integer towards +Infinity rounds a floating-point value to an integral floating-point value 
of the same size using the Round towards +Infinity rounding mode. A zero input gives a zero result with the same 
sign, an infinite input gives an infinite result with the same sign, and a NaN is propagated as for normal arithmetic. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4]3 0 | 
11111110 1{D{1 1 1fofa of va [1 ofoofo[1|mjo] vm | 
RM size 


Half-precision scalar variant 
Applies when size == 01. 


VRINTP{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VRINTP{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VRINTP{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 
rounding = FPDecodeRM(RM); exact = FALSE; 
case size of 


when '01' esize = 16; d = UInt(Vd:D); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); m = UInt(M:Vm); 
T1 
|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0|15 12|11 10 9 8|7 6 5 4|3 0| 
1ra aop io o] va [1 opoo Mo vm] 
RM size 
Half-precision scalar variant 
Applies when size == 01. 
VRINTP{<q>}.F16 <Sd>, <Sm> 
Single-precision scalar variant 
Applies when size == 10. 
VRINTP{<q>}.F32 <Sd>, <Sm> 
Double-precision scalar variant 
Applies when size == 11. 
VRINTP{<q>}.F64 <Dd>, <Dm> 
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Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

rounding = FPDecodeRM(RM); exact = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 


Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = Zeros(16) : FPRoundInt(S[m]<15:@>, FPSCR, rounding, exact); 
when 32 
S[d] = FPRoundInt(S[m], FPSCR, rounding, exact); 
when 64 
D[d] = FPRoundInt(D[m], FPSCR, rounding, exact); 
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F6.1.199 VRINTR 


ARM DDI 0487E.a 
ID070919 


Round floating-point to integer rounds a floating-point value to an integral floating-point value of the same size 
using the rounding mode specified in the FPSCR. A zero input gives a zero result with the same sign, an infinite 


input gives an infinite result with the same sign, and a NaN is propagated as for normal arithmetic. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 
Pst [4 1 1 0 1[p]1 1fo]1 1 of va [1 ofsizefo{i{mjo] vm | 


cond op 


Half-precision scalar variant 
Applies when size == 01. 


VRINTR{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VRINTR{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VRINTR{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 

exact = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 121110 9 8|7 6 5 4|3 o| 


11101110 1ļpji ijoli 10| va [1 o|szejojijmjo] vm | 
op 


Half-precision scalar variant 
Applies when size == 01. 


VRINTR{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VRINTR{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 


Applies when size == 11. 
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F6-5316 


VRINTR{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == 'QQ' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && InITBlock() then UNPREDICTABLE; 

rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 

exact = FALSE; 

case size of 
when '@1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
` The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = Zeros(16) : FPRoundInt(S[m]<15:@>, FPSCR, rounding, exact); 
when 32 
S[d] = FPRoundInt(S[m], FPSCR, rounding, exact); 
when 64 
D[d] = FPRoundInt(D[m], FPSCR, rounding, exact); 
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F6.1.200 | VRINTX (Advanced SIMD) 


ARM DDI 0487E.a 
ID070919 


Vector round floating-point to integer inexact rounds a vector of floating-point values to integral floating-point 
values of the same size, using the Round to Nearest rounding mode, and raises the Inexact exception when the result 
value is not numerically equal to the input value. A zero input gives a zero result with the same sign, an infinite input 
gives an infinite result with the same sign, and a NaN is propagated as for normal arithmetic. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1109 8|7 6 5 4|3 0 | 


11770077 10/1 isejo] va Jo ooroo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTX{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTX{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPRounding_TIEEVEN; exact = TRUE; 
case size of 
when '01' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


Titti117 4 isej of va Jol ooroo] wm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTX{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTX{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPRounding_TIEEVEN; exact = TRUE; 
case size of 
when 'Q1' esize = 16; elements = 4; 
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when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
if InITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = 0 to elements-1 
op1 = Elem[D[m+r],e,esize]; 
result = FPRoundInt(op1, StandardFPSCRValue(), rounding, exact); 
Elem[D[d+r],e,esize] = result; 
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F6.1.201 VRINTX (floating-point) 


Round floating-point to integer inexact rounds a floating-point value to an integral floating-point value of the same 
size, using the rounding mode specified in the FPSCR, and raises an Inexact exception when the result value is not 
numerically equal to the input value. A zero input gives a zero result with the same sign, an infinite input gives an 
infinite result with the same sign, and a NaN is propagated as for normal arithmetic. 


A1 
31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 
Derm [i770 1] tot 1 7] vat ojs jomo] vm _| 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VRINTX{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VRINTX{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VRINTX{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

exact = TRUE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4|3 0 | 


Tit 0711071 1o17 7] va [1 ojs jomo] vm 


Half-precision scalar variant 
Applies when size == 01. 


VRINTX{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VRINTX{<c>}{<q>}.F32 <Sd>, <Sm> 
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Double-precision scalar variant 
Applies when size == 11. 


VRINTX{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && InITBlock() then UNPREDICTABLE; 

exact = TRUE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<C> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
rounding = FPRoundingMode(FPSCR) ; 
case esize of 


when 16 
S[d] = Zeros(16) : FPRoundInt(S[m]<15:@>, FPSCR, rounding, exact); 
when 32 
S[d] = FPRoundInt(S[m], FPSCR, rounding, exact); 
when 64 
D[d] = FPRoundInt(D[m], FPSCR, rounding, exact); 
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F6.1.202 VRINTZ (Advanced SIMD) 


ARM DDI 0487E.a 
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Vector round floating-point to integer towards Zero rounds a vector of floating-point values to integral 
floating-point values of the same size, using the Round towards Zero rounding mode. A zero input gives a zero result 
with the same sign, an infinite input gives an infinite result with the same sign, and a NaN is propagated as for 
normal arithmetic. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


Ti7700%77 1p isej of va [oli oriomo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTZ{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTZ{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPRounding_ZERO; exact = FALSE; 
case size of 
when '01' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


Tiiti117 p isej of va Jo oriomo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRINTZ{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRINTZ{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == '01' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
rounding = FPRounding_ZERO; exact = FALSE; 
case size of 
when 'Q1' esize = 16; elements = 4; 
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F6-5322 


when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
if InITBlock() then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
F16 when size = 01 
F32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = 0 to elements-1 
op1 = Elem[D[m+r],e,esize]; 
result = FPRoundInt(op1, StandardFPSCRValue(), rounding, exact); 
Elem[D[d+r],e,esize] = result; 
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F6.1.203 VRINTZ (floating-point) 


ARM DDI 0487E.a 
ID070919 


Round floating-point to integer towards Zero rounds a floating-point value to an integral floating-point value of the 
same size, using the Round towards Zero rounding mode. A zero input gives a zero result with the same sign, an 


infinite input gives an infinite result with the same sign, and a NaN is propagated as for normal arithmetic. 


A1 


31 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


Pst [4 1 1 0 1fp]1 foji 1 of va [1 ofsize]t{i1{mjo] vm | 
op 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VRINTZ{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VRINTZ{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VRINTZ{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 

exact = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 121110 9 8|7 6 5 4|3 o| 


11101110 1ļpji sfoj1 10| va [1 o|szejijijmjo] vm | 
op 


Half-precision scalar variant 
Applies when size == 01. 


VRINTZ{<c>}{<q>}.F16 <Sd>, <Sm> 
Single-precision scalar variant 
Applies when size == 10. 
VRINTZ{<c>}{<q>}.F32 <Sd>, <Sm> 
Double-precision scalar variant 
Applies when size == 11. 
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F6-5324 


VRINTZ{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && InITBlock() then UNPREDICTABLE; 

rounding = if op == '1' then FPRounding_ZERO else FPRoundingMode(FPSCR) ; 

exact = FALSE; 

case size of 
when '@1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
` The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 
S[d] = Zeros(16) : FPRoundInt(S[m]<15:@>, FPSCR, rounding, exact); 
when 32 
S[d] = FPRoundInt(S[m], FPSCR, rounding, exact); 
when 64 
D[d] = FPRoundInt(D[m], FPSCR, rounding, exact); 
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F6.1.204 VRSHL 


ARM DDI 0487E.a 
ID070919 


Vector Rounding Shift Left takes each element in a vector, shifts them by a value from the least significant byte of 
the corresponding element of a second vector, and places the results in the destination vector. If the shift value is 
positive, the operation is a left shift. If the shift value is negative, it is a rounding right shift. For a truncating shift, 
see VSHL. 


The first operand and result elements are the same data type, and can be any one of: 
° 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 

° 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 

The second operand is always a signed integer of the same size. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


77100 1[Ulo[pysze[ va | va_[o 10 1|NJQ|Mjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRSHL{<c>}{<q>}.<dt> {<Dd>,} <Dm>, <Dn> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRSHL{<c>}{<q>}.<dt> {<Qd>,} <Qm>, <Qn> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<O> == '1' || Vm<@> == '1' || Vn<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); n = UInt(N:Vn); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 o| 


maaua opse] vw | va Jor orno] m _| 


64-bit SIMD vector variant 

Applies when Q == 0. 
VRSHL{<c>}{<q>}.<dt> {<Dd>,} <Dm>, <Dn> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VRSHL{<c>}{<q>}.<dt> {<Qd>,} <Qm>, <Qn> 
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F6-5326 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vm<@> == '1' || Vn<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); n = UInt(N:Vn); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
S64 when U = 0, size = 11 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
U64 when U = 1, size = 11 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = Q to regs-1 
for e = Q to elements-1 

shift = SInt(Elem[D[n+r],e,esize]<7:0>); 
round_const = 1 << (-shift-1); // @ for left shift, 2A(n-1) for right shift 
result = (Int(Elem[D[m+r],e,esize], unsigned) + round_const) << shift; 
Elem[D[d+r],e,esize] = result<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.205 


F6-5328 


VRSHR 


Vector Rounding Shift Right takes each element in a vector, right shifts them by an immediate value, and places the 
rounded results in the destination vector. For truncated results, see VSHR. 


The operand and result elements must be the same size, and can be any one of: 


. 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 


° 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 12\11109 8|7 6 5 4/3 0 | 


111100 tulip] imme | va joo 1 ojtfajmii] vm | 


64-bit SIMD vector variant 
Applies when !(imm6 == 000xxx && L == 0) & Q == 0. 


VRSHR{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 


128-bit SIMD vector variant 
Applies when !(imm6 == Q00xxx && L == 0) & Q == 1. 


VRSHR{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 


Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'QQQ1xxx 
when 'QQ1xxxx 
when 'Q1xxxxx 
when '1xxxxxx 

unsigned = (U == 


esize = 8; elements = 8; 
esize = 16; elements = 4; shift_amount 
esize = 32; elements = 2; shift_amount 
esize = 64; elements = 1; shift_amount 
1'); d 


T1 


UInt(D:Vd); m = UInt(M:Vm); regs 


shift_amount = 16 - UInt(imm6); 


32 - UInt(imm6); 
64 - UInt(imm6); 
64 - UInt(imm6); 


if Q == 'Q' then 1 else 2; 


|15 14 13 12|1110 9 8|7 6 5 | 0 |15 12/1110 9 8|7 6 5 4|3 o| 


at 1juja 1 1 1 ajo] imme | va foo 1 ofLjajmji] vm | 


64-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q = 0. 
VRSHR{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 
128-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q == 1. 


VRSHR{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 
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Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 
if Q == '1' && (Vd<@> == '1' || Vm<ð> == '1') then UNDEFINED; 
case L:imm6 of 


when 'QQQ1xxx 
when 'QQ1xxxx 
when 'Q1xxxxx 
when '1xxxxxx 
unsigned = (U == 


esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 
esize = 64; elements = 1; shift_amount = 64 - UInt(imm6); 
1'); d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 


set. 


Assembler symbols 


<C> 


<q> 


<type> 


<size> 


<Qd> 
<Qm> 
<Dd> 
<Dm> 


<imm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "U" field. It can have the following 
values: 
S when U = 0 


U when U = 1 


Is the data size for the elements of the vectors, encoded in the "L:imm6<5:3>" field. It can have the 
following values: 


8 when L = @, imm6<5:3> = 001 
16 when L = 0, imm6<5:3> = 01x 
32 when L = 0, imm6<5:3> = 1xx 
64 when L = 1, imm6<5:3> = xxx 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 

Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Is an immediate value, in the range 1 to <size>, encoded in the "imm6" field as <size> - <imm>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
round_const = 1 << (shift_amount - 1); 
for r = 0 to regs-1 


ARM DDI 0487E.a 
ID070919 


for e = 0 to elements-1 


result = (Int(Elem[D[m+r],e,esize], unsigned) + round_const) >> shift_amount; 
Elem[D[d+r],e,esize] = result<esize-1:0>; 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.206 | VRSHR (zero) 


ARM DDI 0487E.a 
ID070919 


Vector Rounding Shift Right copies the contents of one SIMD register to another 


This instruction is a pseudo-instruction of the VORR (register) instruction. This means that: 


$ The encodings in this description are named to match the encodings of VORR (register). 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
$ The description of VORR (register) gives the operational pseudocode for this instruction. 
A1 
[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


77100 tfofopoj7 o] wa | va jooon vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VRSHR{<c>}{<q>}.<dt> <Dd>, <Dm>, #0 

is equivalent to 

VORR{<c>}{<q>}{.<dt>} <Dd>, <Dm>, <Dm> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 
VRSHR{<c>}{<q>}.<dt> <Qd>, <Qm>, #0 

is equivalent to 

VORR{<c>}{<q>}{.<dt>} <Qd>, <Qm>, <Qm> 


and is never the preferred disassembly. 
T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


1 ijoja 1 1 1 ofoft of vn | va foo o 1fnjajmji] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VRSHR{<c>}{<q>}.<dt> <Dd>, <Dm>, #0 

is equivalent to 

VORR{<c>}{<q>}{.<dt>} <Dd>, <Dm>, <Dm> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 


Applies when Q == 1. 
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F6-5332 


VRSHR{<c>}{<q>}.<dt> <Qd>, <Qm>, #0 


is equivalent to 


VORR{<c>}{<q>}{.<dt>} <Qd>, <Qm>, <Qm> 


and is never the preferred disassembly. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 


<Qm> 


<Dd> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, and must be one of: S8, S16, S32, S64, U8, U16, 
U32 or U64. 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 128-bit name of the SIMD&FP source register, encoded in the "N:Vn" and "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Is the 64-bit name of the SIMD&FP source register, encoded in the "N: Vn" and "M:Vm" field. 


Operation for all encodings 


The description of VORR (register) gives the operational pseudocode for this instruction. 
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F6.1.207 VRSHRN 


ARM DDI 0487E.a 
ID070919 


Vector Rounding Shift Right and Narrow takes each element in a vector, right shifts them by an immediate value, 
and places the rounded results in the destination vector. For truncated results, see VSHRN. 


The operand elements can be 16-bit, 32-bit, or 64-bit integers. There is no distinction between signed and unsigned 
integers. The destination elements are half the size of the source elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 2221 | 16/15 12/1110 9 8|7 6 5 4/3 0 | 


T7700 4Jo[to] mme [ va [100 ojo]i[m[i] vm | 


A1 variant 
Applies when imm6 != 000xxx. 


VRSHRN{<c>}{<q>}.I<size> <Dd>, <Qm>, #<imm> 


Decode for this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 

if Vm<@> == '1' then UNDEFINED; 

case imm6 of 
when 'Q@Q@1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when '@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when '1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 121110 9 8|7 6 5 | 0 |15 12\11109 8|7 6 5 4/3 0 | 


[1 t ijoja 1 1 1 tof imme | va fi o o ojojijmji] vm | 


T1 variant 
Applies when imm6 != 000xxx. 


VRSHRN{<c>}{<q>}.I<size> <Dd>, <Qm>, #<imm> 


Decode for this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 

if Vm<@> == '1' then UNDEFINED; 

case imm6 of 
when 'QQ@1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when '@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when '1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 
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F6-5334 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size for the elements of the vectors, encoded in the "imm6<5:3>" field. It can have the 
following values: 
16 when imm6<5:3> = 001 
32 when imm6<5:3> = 01x 
64 when imm6<5:3> = 1xx 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<imm> Is an immediate value, in the range 1 to <size>/2, encoded in the "imm6" field as <size>/2 - <imm>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
round_const = 1 << (shift_amount-1); 
for e = 0 to elements-1 
result = LSR(Elem[Qin[m>>1],e,2sesize] + round_const, shift_amount); 
Elem[D[d],e,esize] = result<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.208 | VRSHRN (zero) 


Vector Rounding Shift Right and Narrow takes each element in a vector, right shifts them by an immediate value, 
and places the rounded results in the destination vector 


This instruction is a pseudo-instruction of the VMOVN instruction. This means that: 


$ The encodings in this description are named to match the encodings of VMOVN. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
. The description of VMOVN gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 12/1110 9 8|7 6 5 4|3 0| 


11110011 1p isej of va Jojo 10 ojomo] vwm | 


A1 variant 

VRSHRN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


11111111 1fpji afsize[1 of va [ojo 1 0 ojojmjo] vm | 


T1 variant 

VRSHRN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operand, encoded in the "size" field. It can have the following 
values: 
116 when size = 00 
132 when size = 01 
164 when size = 10 


The encoding size = 11 is reserved. 
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<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


The description of VMOVN gives the operational pseudocode for this instruction. 


F6-5336 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.209 VRSQRTE 


Vector Reciprocal Square Root Estimate finds an approximate reciprocal square root of each element in a vector, 


and places the results in a second vector. 


The operand and result elements are the same type, and can be floating-point numbers or unsigned integers. 


For details of the operation performed by this instruction see Floating-point reciprocal estimate and step on 


page E1-3802. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1109 8|7 6 5 4|3 


11110011 1p isej] va Jol oriomo] vwm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRSQRTE{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRSQRTE{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
floating_point = (F == '1'); 
case size of 
when 'Q1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 





aana ph se] va ol oF ieo] m 


64-bit SIMD vector variant 
Applies when Q == 0. 
VRSQRTE{<c>}{<q>}.<dt> <Dd>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 


VRSQRTE{<c>}{<q>}.<dt> <Qd>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if (size == 'Q1' && !HaveFP16Ext()) || size IN {'00', '11'} then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 
floating_point = (F == '1'); 
case size of 
when 'Q@1' esize = 16; elements = 4; 
when '10' esize = 32; elements = 2; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 

s The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "F:size" field. It can have the 
following values: 
U32 when F = 0, size = 10 
F16 when F = 1, size = 01 
F32 when F = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Newton-Raphson iteration 


For details of the operation performed and how it can be used in a Newton-Raphson iteration to calculate the 
reciprocal of the square root of a number, see Floating-point reciprocal estimate and step on page E1-3802. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
if floating_point then 
Elem[D[d+r],e,esize] = FPRSqrtEstimate(Elem[D[m+r],e,esize], StandardFPSCRValue()); 
else 
Elem[D[d+r],e,esize] = UnsignedRSqrtEstimate(Elem[D[m+r] ,e,esize]); 
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F6.1.210 VRSQRTS 


Vector Reciprocal Square Root Step multiplies the elements of one vector by the corresponding elements of another 
vector, subtracts each of the products from 3.0, divides these results by 2.0, and places the results into the elements 
of the destination vector. 


The operand and result elements are floating-point numbers. 


For details of the operation performed by this instruction see Floating-point reciprocal estimate and step on 
page E1-3802. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


77100 tfofo[pytfe] va | va ponme vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VRSQRTS{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VRSQRTS{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == '0' then 1 else 2; 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 
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64-bit SIMD vector variant 

Applies when Q == 0. 
VRSQRTS{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VRSQRTS{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
case sz of 
when 'Q@' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If size == '01' & InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

. The instruction executes as if it passes the Condition code check. 

e The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 
values: 
F32 when sz = 0 
F16 when sz = 1 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Newton-Raphson iteration 


For details of the operation performed and how it can be used in a Newton-Raphson iteration to calculate the 
reciprocal of the square root of a number, see Floating-point reciprocal estimate and step on page E1-3802. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = FPRSqrtStep(Elem[D[n+r],e,esize], Elem[D[m+r],e,esize]); 
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F6.1.211 VRSRA 


ARM DDI 0487E.a 
ID070919 


Vector Rounding Shift Right and Accumulate takes each element in a vector, right shifts them by an immediate 
value, and accumulates the rounded results into the destination vector.For truncated results, see VSRA. 


The operand and result elements must all be the same type, and can be any one of: 
. 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 
° 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 12\11109 8|7 6 5 4/3 0 | 


111100 tulip] imme | va joo 1 1jijalmji] vm | 


64-bit SIMD vector variant 
Applies when !(imm6 == 000xxx && L == 0) & Q == 0. 


VRSRA{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 


128-bit SIMD vector variant 
Applies when !(imm6 == Q00xxx && L == 0) && Q = 1. 


VRSRA{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 


Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'QQQ1xxx 
when 'QQ1xxxx 
when 'Q1xxxxx 
when '1xxxxxx 

unsigned = (U == 


esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 
esize = 64; elements = 1; shift_amount = 64 - UInt(imm6); 
1'); d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 12|1110 9 8|7 6 5 | 0 |15 12/1109 8|7 6 5 4|3 o| 
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64-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q == 0. 
VRSRA{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 
128-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q = 1. 


VRSRA{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 
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Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 
if Q == '1' && (Vd<@> == '1' || Vm<ð> == '1') then UNDEFINED; 
case L:imm6 of 


when 'QQQ1xxx 
when 'QQ1xxxx 
when 'Q1xxxxx 
when '1xxxxxx 
unsigned = (U == 


esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 
esize = 64; elements = 1; shift_amount = 64 - UInt(imm6); 
1'); d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 


set. 


Assembler symbols 


<C> 


<q> 


<type> 


<size> 


<Qd> 
<Qm> 
<Dd> 
<Dm> 


<imm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "U" field. It can have the following 
values: 
S when U = 0 


U when U = 1 


Is the data size for the elements of the vectors, encoded in the "L:imm6<5:3>" field. It can have the 
following values: 


8 when L = @, imm6<5:3> = 001 
16 when L = 0, imm6<5:3> = 01x 
32 when L = 0, imm6<5:3> = 1xx 
64 when L = 1, imm6<5:3> = xxx 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 

Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Is an immediate value, in the range 1 to <size>, encoded in the "imm6" field as <size> - <imm>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
round_const = 1 << (shift_amount - 1); 
for r = 0 to regs-1 


F6-5342 


for e = 0 to elements-1 


result = (Int(Elem[D[m+r],e,esize], unsigned) + round_const) >> shift_amount; 
Elem[D[d+r],e,esize] = Elem[D[d+r],e,esize] + result; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.212 


F6-5344 


VRSUBHN 


Vector Rounding Subtract and Narrow, returning High Half subtracts the elements of one quadword vector from the 
corresponding elements of another quadword vector, takes the most significant half of each result, and places the 
final results in a doubleword vector. The results are rounded. For truncated results, see VSUBHN. 


The operand elements can be 16-bit, 32-bit, or 64-bit integers. There is no distinction between signed and unsigned 
integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 

|31 30 29 28|27 26 25 24|23 22 21 20/19 16|15 12/1110 9 8|7 6 5 4/3 o| 

717001 open[ va | va [ori oNomMo] m | 
size 

A1 variant 


VRSUBHN{<c>}{<q>}.<dt> <Dd>, <Qn>, <Qm> 


Decode for this encoding 
if size == '11' then SEE "Related encodings"; 
if Vn<@> == '1' || Vm<0> == '1' then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


moop pen] vw | va fonr onoo] vm_| 


size 


T1 variant 


VRSUBHN{<c>}{<q>}.<dt> <Dd>, <Qn>, <Qm> 


Decode for this encoding 

if size == '11' then SEE "Related encodings"; 

if Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 
Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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<dt> 


<Dd> 
<Qn> 


<Qm> 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 


116 when size = 00 
132 when size = 01 
164 when size = 10 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
round_const = 1 << (esize-1); 
for e = Q to elements-1 


result = Elem[Qin[n>>1],e,2xesize] - Elem[Qin[m>>1],e,2*esize] + round_const; 
Elem[D[d],e,esize] = result<2esize-1l:esize>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.213 VSDOT (by element) 


Dot Product index form with signed integers. This instruction performs the dot product of the four 8-bit elements in 
each 32-bit element of the first source register with the four 8-bit elements of an indexed 32-bit element in the 
second source register, accumulating the result into the corresponding 32-bit element of the destination register. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 


to support it. 





Note 
ID_ISAR6.DP indicates whether this instruction is supported. 





A1 
ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 
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64-bit SIMD vector variant 
Applies when Q == 0. 


VSDOT{<q>}.S8 <Dd>, <Dn>, <Dm>[<index>] 


128-bit SIMD vector variant 
Applies when Q == 1. 


VSDOT{<q>}.S8 <Qd>, <Qn>, <Dm>[<index>] 


Decode for all variants of this encoding 


if !HaveDOTPExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 
boolean signed = (U=='0'); 

integer d = UInt(D:Vd); 

integer n = UInt(N:Vn); 

integer m = UInt(Vm<3:0>); 

integer index = UInt(M); 

integer esize = 32; 

integer regs = if Q == '1' then 2 else 1; 


T1 
ARMV8.2 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4/3 


o | 





64-bit SIMD vector variant 
Applies when Q == 0. 


VSDOT{<q>}.S8 <Dd>, <Dn>, <Dm>[<index>] 
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128-bit SIMD vector variant 


Applies when Q == 1. 


VSDOT{<q>}.S8 <Qd>, <Qn>, <Dm>[<index>] 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveDOTPExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 
boolean signed = (U=='0'); 

integer d = UInt(D:Vd); 

integer n = UInt(N:Vn); 

integer m = UInt(Vm<3:0>); 

integer index = UInt(M); 

integer esize = 32; 

integer regs = if Q == '1' then 2 else 1; 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Vm" field. 

<index> Is the element index in the range 0 to 1, encoded in the "M" field. 


Operation for all encodings 


bits(64) operand; 
bits(64) operand2 = D[m]; 
bits(64) result; 
CheckAdvSIMDEnabled(); 


for 


r = @ to regs-1 
operand1 = D[n+r]; 
result = D[d+r] 
integer element1, element2; 
fore=Qtol 
integer res = 0; 
for i = Q to 3 
if signed then 
element1 = SInt(Elem[operandl, 4 » e + i, esize DIV 4]); 
element2 = SInt(Elem[operand2, 4 » index + i, esize DIV 4]); 
else 
element1 = UInt(Elem[operandl, 4 » e + i, esize DIV 4]); 
element2 = UInt(Elem[operand2, 4 » index + i, esize DIV 4]); 
res = res + elementl « element2; 
Elem[result, e, esize] = Elem[result, e, esize] + res; 
D[d+r] = result; 
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F6.1.214 


F6-5348 


VSDOT (vector) 


Dot Product vector form with signed integers. This instruction performs the dot product of the four 8-bit elements 
in each 32-bit element of the first source register with the four 8-bit elements of the corresponding 32-bit element 
in the second source register, accumulating the result into the corresponding 32-bit element of the destination 
register. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 





Note 
ID_ISAR6.DP indicates whether this instruction is supported. 





A1 
ARMV8.2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1109 8|7 6 5 4/3 0 | 


1141717 ofo ofpjt of vn | va  [tfrfofi{Njafmfo} vm | 
U 


64-bit SIMD vector variant 
Applies when Q == 0. 


VSDOT{<q>}.S8 <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VSDOT{<q>}.S8 <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if !HaveDOTPExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
boolean signed = U=='0'; 

integer d = UInt(D:Vd); 

integer n = UInt(N:Vn); 

integer m = UInt(M:Vm); 

integer esize = 32; 

integer regs = if Q == '1' then 2 else 1; 


T1 


ARMv8.2 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





64-bit SIMD vector variant 
Applies when Q == 0. 


VSDOT{<q>}.S8 <Dd>, <Dn>, <Dm> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VSDOT{<q>}.S8 <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveDOTPExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
boolean signed = U=='0'; 

integer d = UInt(D:Vd); 

integer n = UInt(N:Vn); 

integer m = UInt(M:Vm); 

integer esize = 32; 

integer regs = if Q == '1' then 2 else 1; 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 

<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 

<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


bits(64) operand1; 
bits(64) operand2; 
bits(64) result; 
CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
operand1 = D[n+r]; 
operand2 = D[m+r]; 
result = D[d+r] 
integer element1, element2; 
fore=Qtol 
integer res = 0; 
for i = Q to 3 
if signed then 
element1 = SInt(Elem[operandl, 4 » e + i, esize DIV 4]); 
element2 = SInt(Elem[operand2, 4 » e + i, esize DIV 4]); 
else 
element1 = UInt(Elem[operandl, 4 » e + i, esize DIV 4]); 
element2 = UInt(Elem[operand2, 4 » e + i, esize DIV 4]); 
res = res + elementl « element2; 
Elem[result, e, esize] = Elem[result, e, esize] + res; 
D[d+r] = result; 
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F6.1.215 


F6-5350 


VSELEQ, VSELGE, VSELGT, VSELVS 


Floating-point conditional select allows the destination register to take the value in either one or the other source 
register according to the condition codes in the The Application Program Status Register, APSR on page E1-3789. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 


11111110 ojpf cc] vn | va f1 of=oo|njojmjo] vm | 


VSELEQ,doubleprec variant 
Applies when cc == 00 && size == 11. 


VSELEQ.F64 <Dd>, <Dn>, <Dm> // Cannot 


VSELEQ,halfprec variant 
Applies when cc == 00 && size == 01. 


VSELEQ.F16 <Sd>, <Sn>, <Sm> // Cannot 


VSELEQ,singleprec variant 
Applies when cc == 00 && size == 10. 
VSELEQ.F32 <Sd>, <Sn>, <Sm> // Cannot 
VSELGE,doubleprec variant 
Applies when cc == 10 && size == 11. 
VSELGE.F64 <Dd>, <Dn>, <Dm> // Cannot 
VSELGE, halfprec variant 

Applies when cc == 10 && size == 01. 
VSELGE.F16 <Sd>, <Sn>, <Sm> // Cannot 
VSELGE,singleprec variant 
Applies when cc == 10 && size == 10. 
VSELGE.F32 <Sd>, <Sn>, <Sm> // Cannot 
VSELGT, doubleprec variant 
Applies when cc == 11 && size == 11. 
VSELGT.F64 <Dd>, <Dn>, <Dm> // Cannot 
VSELGT, halfprec variant 

Applies when cc == 11 && size == 01. 
VSELGT.F16 <Sd>, <Sn>, <Sm> // Cannot 
VSELGT,singleprec variant 
Applies when cc == 11 && size == 10. 


VSELGT.F32 <Sd>, <Sn>, <Sm> // Cannot 
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VSELVS,doubleprec variant 
Applies when cc == 01 && size == 11. 


VSELVS.F64 <Dd>, <Dn>, <Dm> // Cannot be conditional 


VSELVS,halfprec variant 
Applies when cc == 01 && size == 01. 


VSELVS.F16 <Sd>, <Sn>, <Sm> // Cannot be conditional 


VSELVS,singleprec variant 
Applies when cc == 01 && size == 10. 


VSELVS.F32 <Sd>, <Sn>, <Sm> // Cannot be conditional 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

case size of 
when 'Q1' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 

cond = cc:(cc<1> EOR cc<Q>):'0'; 


T1 
|15 14 13 12|11 10 9 8|7 6 5 4/3 0 |15 12|11 10 9 8|7 6 5 4|3 
aaao o] e] v | va 1 opon oM o] vwm 
size 
VSELEQ,doubleprec variant 
Applies when cc == 00 && size == 11. 
VSELEQ.F64 <Dd>, <Dn>, <Dm> // Not permitted in IT block 
VSELEQ,halfprec variant 
Applies when cc == 00 && size == 01. 
VSELEQ.F16 <Sd>, <Sn>, <Sm> // Not permitted in IT block 
VSELEQ,singleprec variant 
Applies when cc == 00 && size == 10. 
VSELEQ.F32 <Sd>, <Sn>, <Sm> // Not permitted in IT block 
VSELGE,doubleprec variant 
Applies when cc == 10 && size == 11. 
VSELGE.F64 <Dd>, <Dn>, <Dm> // Not permitted in IT block 
VSELGE, halfprec variant 
Applies when cc == 10 && size == 01. 
VSELGE.F16 <Sd>, <Sn>, <Sm> // Not permitted in IT block 
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VSELGE,singleprec variant 
Applies when cc == 10 && size == 10. 


VSELGE.F32 <Sd>, <Sn>, <Sm> // Not permitted in IT block 


VSELGT, doubleprec variant 
Applies when cc == 11 && size == 11. 


VSELGT.F64 <Dd>, <Dn>, <Dm> // Not permitted in IT block 


VSELGT, halfprec variant 
Applies when cc == 11 && size == 01. 


VSELGT.F16 <Sd>, <Sn>, <Sm> // Not permitted in IT block 


VSELGT,singleprec variant 
Applies when cc == 11 && size == 10. 


VSELGT.F32 <Sd>, <Sn>, <Sm> // Not permitted in IT block 


VSELVS,doubleprec variant 
Applies when cc == 01 && size == 11. 


VSELVS.F64 <Dd>, <Dn>, <Dm> // Not permitted in IT block 


VSELVS,halfprec variant 
Applies when cc == 01 && size == 01. 


VSELVS.F16 <Sd>, <Sn>, <Sm> // Not permitted in IT block 


VSELVS,singleprec variant 
Applies when cc == 01 && size == 10. 


VSELVS.F32 <Sd>, <Sn>, <Sm> // Not permitted in IT block 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

case size of 
when 'Q@1' esize = 16; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 

cond = cc:(cc<1> EOR cc<Q@>):'0'; 


CONSTRAINED UNPREDICTABLE behavior 


If InITBlock(), then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as if it passes the Condition code check. 
. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
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Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 


Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 


when 16 

S[d] = Zeros(16) : (if ConditionHolds(cond) then S[n] else S[m])<15:0>; 
when 32 

S[d] = if ConditionHolds(cond) then S[n] else S[m]; 
when 64 

D[d] = if ConditionHolds(cond) then D[n] else D[m]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.216 


F6-5354 


VSHL (immediate) 


Vector Shift Left (immediate) takes each element in a vector of integers, left shifts them by an immediate value, and 
places the results in the destination vector. 


Bits shifted out of the left of each element are lost. 


The elements must all be the same size, and can be 8-bit, 16-bit, 32-bit, or 64-bit integers. There is no distinction 
between signed and unsigned integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 | 16/15 12/1110 9 8|7 6 5 4|3 0 | 


777100 7fo[1[p] imme | va forori vm | 


64-bit SIMD vector variant 
Applies when !(imm6 == @00xxx && L == 0) && Q == 0. 


VSHL{<c>}{<q>}.I<size> {<Dd>,} <Dm>, #<imm> 


128-bit SIMD vector variant 
Applies when !(imm6 == 000xxx && L == 0) & Q == 1. 


VSHL{<c>}{<q>}.I<size> {<Qd>,} <Qm>, #<imm> 


Decode for all variants of this encoding 


if L:imm6 == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'QQQ1xxx' esize = 8; elements = 8; shift_amount = UInt(imm6) - 8; 
when 'QQ1xxxx' esize = 16; elements = 4;  shift_amount = UInt(imm6) - 16; 
when 'Q1xxxxx' esize = 32; elements = 2; shift_amount = UInt(imm6) - 32; 
when '1xxxxxx' esize = 64; elements = 1; shift_amount = UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8|7 6 5 | 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


7 apolt 717 1p] imme | va for orim vm | 


64-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) && Q == 0. 
VSHL{<c>}{<q>}.I<size> {<Dd>,} <Dm>, #<imm> 
128-bit SIMD vector variant 

Applies when !(imm6 == @00xxx && L == 0) & Q == 1. 


VSHL{<c>}{<q>}.I<size> {<Qd>,} <Qm>, #<imm> 
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Decode for all variants of this encoding 


if L:imm6 == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when '0001xxx' esize = 8; elements = 8; shift_amount = UInt(imm6) - 8; 
when 'Q@Q1xxxx' esize = 16; elements = 4; shift_amount = UInt(imm6) - 16; 
when 'Q1xxxxx' esize = 32; elements = 2; shift_amount = UInt(imm6) - 32; 
when '1xxxxxx' esize = 64; elements = 1; shift_amount = UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size for the elements of the vectors, encoded in the "L:imm6<5:3>" field. It can have the 
following values: 
8 when L = 0, imm6<5:3> = 001 
16 when L = Q, imm6<5:3> = 01x 
32 when L = 0, imm6<5:3> = 1xx 
64 when L = 1, imm6<5:3> = xxx 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
<imm> Is an immediate value, in the range 0 to <size>-1, encoded in the "imm6" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = LSL(Elem[D[m+r],e,esize], shift_amount) ; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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F6.1.217  VSHL (register) 


ARM DDI 0487E.a 
ID070919 


Vector Shift Left (register) takes each element in a vector, shifts them by a value from the least significant byte of 
the corresponding element of a second vector, and places the results in the destination vector. If the shift value is 
positive, the operation is a left shift. If the shift value is negative, it is a truncating right shift. 


For a rounding shift, see VRSHL. 

The first operand and result elements are the same data type, and can be any one of: 
s 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 

. 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 

The second operand is always a signed integer of the same size. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12\11109 8|7 6 5 4/3 0 | 


1 1100 1jujojo]sze] vn | va fo 1 0 ofnjajmjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VSHL{<c>}{<q>}.<dt> {<Dd>,} <Dm>, <Dn> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VSHL{<c>}{<q>}.<dt> {<Qd>,} <Qm>, <Qn> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<O> == '1' || Vm<@> == '1' || Vn<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); m = UInt(M:Vm); n = UInt(N:Vn); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


[1 1 tfuj1 1 1 1 ojdfsize] vn | va fo 1 0 ofnjajmjo] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VSHL{<c>}{<q>}.<dt> {<Dd>,} <Dm>, <Dn> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VSHL{<c>}{<q>}.<dt> {<Qd>,} <Qm>, <Qn> 
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F6-5358 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vm<@> == '1' || Vn<@> == '1') then UNDEFINED; 
unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); n = UInt(N:Vn); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "U:size" field. It can have the 
following values: 
S8 when U = 0, size = 00 
S16 when U = @, size = 01 
S32 when U = 0, size = 10 
S64 when U = 0, size = 11 
U8 when U = 1, size = 00 
U16 when U = 1, size = 01 
U32 when U = 1, size = 10 
U64 when U = 1, size = 11 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
shift = SInt(Elem[D[n+r],e,esize]<7:0>); 
result = Int(Elem[D[m+r],e,esize], unsigned) << shift; 
Elem[D[d+r],e,esize] = result<esize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 
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F6.1.218 


F6-5360 


VSHLL 


Vector Shift Left Long takes each element in a doubleword vector, left shifts them by an immediate value, and places 


the results in a quadword vector. 

The operand elements can be: 

s 8-bit, 16-bit, or 32-bit signed integers. 

è 8-bit, 16-bit, or 32-bit unsigned integers. 

s 8-bit, 16-bit, or 32-bit untyped integers, maximum shift only. 


The result elements are twice the length of the operand elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 | 16|15 12/1110 9 8|7 6 5 4|3 0| 


Ti 7700 auto] mme | va [101 ofo]o[m[i] m | 


A1 variant 
Applies when imm6 != 000xxx. 


VSHLL{<c>}{<q>}.<type><size> <Qd>, <Dm>, #<imm> 


Decode for this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

case imm6 of 
when '00lxxx' esize = 8; elements = 8; shift_amount = UInt(imm6) - 8; 
when 'Q@1xxxx' esize = 16; elements = 4; shift_amount = UInt(imm6) - 16; 
when '1xxxxx' esize = 32; elements = 2; shift_amount = UInt(imm6) - 32; 

if shift_amount == @ then SEE "VMOVL"; 

unsigned = (U == '1'); d = UInt(D:Vd); m = UInt(M:Vm); 


A2 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0 | 


11110011 1{d]1 afsize{1 of va [ojo 11 ojojmjo] vm | 


A2 variant 


VSHLL{<c>}{<q>}.<type><size> <Qd>, <Dm>, #<imm> 


Decode for this encoding 


if size == '11' || Vd<@> == '1' then UNDEFINED; 

esize = 8 << UInt(size); elements = 64 DIV esize; shift_amount = esize; 
unsigned = FALSE; // Or TRUE without change of functionality 

d = UInt(D:Vd); m = UInt(M:Vm); 
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T1 


|15 14 13 121110 9 8|7 6 5 | 0 |15 12/1109 8|7 6 5 4|3 0| 


aaao me | va or ojojo v | 


T1 variant 
Applies when imm6 != 000xxx. 


VSHLL{<c>}{<q>}.<type><size> <Qd>, <Dm>, #<imm> 


Decode for this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 

if Vd<@> == '1' then UNDEFINED; 

case imm6 of 
when 'QQ1xxx' esize = 8; elements = 8; shift_amount = UInt(imm6) - 8; 
when 'Q@1xxxx' esize = 16; elements = 4; shift_amount = UInt(imm6) - 16; 
when '1xxxxx' esize = 32; elements = 2; shift_amount = UInt(imm6) - 32; 

if shift_amount == @ then SEE "VMOVL"; 

unsigned = (U == '1'); d = UInt(D:Vd); m = UInt(M:Vm); 


T2 


|15 14 13 1211110 9 8/7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4/3 0 | 


77414177 p jsej o] va Jojo 71 ojoo] vm | 


T2 variant 


VSHLL{<c>}{<q>}.<type><size> <Qd>, <Dm>, #<imm> 


Decode for this encoding 


if size == '11' || Vd<@> == '1' then UNDEFINED; 

esize = 8 << UInt(size); elements = 64 DIV esize; shift_amount = esize; 
unsigned = FALSE; // Or TRUE without change of functionality 

d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 


Assembler symbols 
<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<type> The data type for the elements of the operand. It must be one of: 
S Signed. In encoding T1/A1, encoded as U = 0. 
U Unsigned. In encoding T1/A1, encoded as U = 1. 
I Untyped integer, Available only in encoding T2/A2. 
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F6-5362 














<size> The data size for the elements of the operand. The following table shows the permitted values and 
their encodings: 
<size> Encoding T1/A1 Encoding T2/A2 
8 Encoded as imm6<5:3>= @b001 Encoded as size = 0b00 
16 Encoded as imm6<5:4> = 0b01 Encoded as size = 0b01 
32 Encoded as imm6<5> = 1 Encoded as size = 0b10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
<imm> The immediate value. <imm> must lie in the range 1 to <size>, and: 
° If <size> == <imm>, the encoding is T2/A2. 


è Otherwise, the encoding is T1/A1, and: 
— If <size> == 8, <imm> is encoded in imm6<2:0>. 
— If <size> == 16, <imm> is encoded in imm6<3:0>. 


— = If <size> == 32, <imm> is encoded in imm6<4:0>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for e = Q to elements-1 
result = Int(Elem[Din[m],e,esize], unsigned) << shift_amount; 
Elem[Q[d>>1],e,2esize] = result<2xesize-1:0>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


$ The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


è The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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Vector Shift Right takes each element in a vector, right shifts them by an immediate value, and places the truncated 


results in the destination vector. For rounded results, see VRSHR. 


The operand and result elements must be the same size, and can be any one of: 


. 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 


° 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 12/1110 9 8|7 6 5 4/3 


111100 1ļujijo] imme | va jooo oft fajmii] vm | 


64-bit SIMD vector variant 
Applies when !(imm6 == 000xxx && L == 0) & Q == 0. 


VSHR{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 


128-bit SIMD vector variant 
Applies when !(imm6 == 000xxx && L == 0) & Q = 1. 


VSHR{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 


Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'QQQ1xxx 
when 'QQ1xxxx 
when 'Q1xxxxx 
when '1xxxxxx 

unsigned = (U == 


esize = 8; elements = 8; 
esize = 16; elements = 4; shift_amount 
esize = 32; elements = 2; shift_amount 
esize = 64; elements = 1; shift_amount 
1'); d 


T1 


UInt(D:Vd); m = UInt(M:Vm); regs 


shift_amount = 16 - UInt(imm6); 


32 - UInt(imm6); 
64 - UInt(imm6); 
64 - UInt(imm6); 


if Q == 'Q' then 1 else 2; 


|15 14 13 12|1110 9 8|7 6 5 | 0 |15 121110 9 8|7 6 5 4|3 


64-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q == 0. 
VSHR{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 
128-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q = 1. 


VSHR{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 
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Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 
if Q == '1' && (Vd<@> == '1' || Vm<ð> == '1') then UNDEFINED; 
case L:imm6 of 


when 'QQQ1xxx 
when 'QQ1xxxx 
when 'Q1xxxxx 
when '1xxxxxx 
unsigned = (U == 


esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 
esize = 64; elements = 1; shift_amount = 64 - UInt(imm6); 
1'); d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 


set. 


Assembler symbols 


<C> 


<q> 


<type> 


<size> 


<Qd> 
<Qm> 
<Dd> 
<Dm> 


<imm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "U" field. It can have the following 
values: 
S when U = 0 


U when U = 1 


Is the data size for the elements of the vectors, encoded in the "L:imm6<5:3>" field. It can have the 
following values: 


8 when L = @, imm6<5:3> = 001 
16 when L = 0, imm6<5:3> = 01x 
32 when L = 0, imm6<5:3> = 1xx 
64 when L = 1, imm6<5:3> = xxx 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 

Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Is an immediate value, in the range 1 to <size>, encoded in the "imm6" field as <size> - <imm>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 


F6-5364 


for e = Q to elements-1 


result = Int(Elem[D[m+r],e,esize], unsigned) >> shift_amount; 
Elem[D[d+r],e,esize] = result<esize-1:0>; 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.220 


F6-5366 


VSHR (zero) 


Vector Shift Right copies the contents of one SIMD register to another 


This instruction is a pseudo-instruction of the VORR (register) instruction. This means that: 


$ The encodings in this description are named to match the encodings of VORR (register). 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
$ The description of VORR (register) gives the operational pseudocode for this instruction. 
A1 
[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


777100 7[ofopoj7 o] vw | va jo oorno vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VSHR{<c>}{<q>}.<dt> <Dd>, <Dm>, #0 

is equivalent to 

VORR{<c>}{<q>}{.<dt>} <Dd>, <Dm>, <Dm> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 

Applies when Q == 1. 
VSHR{<c>}{<q>}.<dt> <Qd>, <Qm>, #0 

is equivalent to 

VORR{<c>}{<q>}{.<dt>} <Qd>, <Qm>, <Qm> 


and is never the preferred disassembly. 
T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


1 ijoja 1 1 1 ofoft of vn | va foo o 1fnjajmji] vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VSHR{<c>}{<q>}.<dt> <Dd>, <Dm>, #0 

is equivalent to 

VORR{<c>}{<q>}{.<dt>} <Dd>, <Dm>, <Dm> 


and is never the preferred disassembly. 


128-bit SIMD vector variant 


Applies when Q == 1. 
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VSHR{<c>}{<q>}.<dt> <Qd>, <Qm>, #0 


is equivalent to 


VORR{<c>}{<q>}{.<dt>} <Qd>, <Qm>, <Qm> 


and is never the preferred disassembly. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 


<Qm> 


<Dd> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, and must be one of: S8, S16, S32, S64, U8, U16, 
U32 or U64. 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 128-bit name of the SIMD&FP source register, encoded in the "N:Vn" and "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Is the 64-bit name of the SIMD&FP source register, encoded in the "N: Vn" and "M:Vm" field. 


Operation for all encodings 


The description of VORR (register) gives the operational pseudocode for this instruction. 
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F6.1.221 


F6-5368 


VSHRN 


Vector Shift Right Narrow takes each element in a vector, right shifts them by an immediate value, and places the 
truncated results in the destination vector. For rounded results, see VRSHRN. 


The operand elements can be 16-bit, 32-bit, or 64-bit integers. There is no distinction between signed and unsigned 
integers. The destination elements are half the size of the source elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 2221 | 16/15 12/1109 8|7 6 5 4|3 0 | 


Ti 7700 4)0[t[o] mme | va [100 ojo]o|m[i] vm | 


A1 variant 
Applies when imm6 != 000xxx. 


VSHRN{<c>}{<q>}.I<size> <Dd>, <Qm>, #<imm> 


Decode for this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 

if Vm<@> == '1' then UNDEFINED; 

case imm6 of 
when 'Q@Q@1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when '@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when '1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 121110 9 8|7 6 5 | 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


[1 t ijoja 1 1 1 tof imme | va fi o o ojojojmji] vm | 


T1 variant 
Applies when imm6 != 000xxx. 


VSHRN{<c>}{<q>}.I<size> <Dd>, <Qm>, #<imm> 


Decode for this encoding 


if imm6 == '000xxx' then SEE "Related encodings"; 

if Vm<@> == '1' then UNDEFINED; 

case imm6 of 
when 'QQ@1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when '@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when '1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 
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Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size for the elements of the vectors, encoded in the "imm6<5:3>" field. It can have the 
following values: 
16 when imm6<5:3> = 001 
32 when imm6<5:3> = 01x 
64 when imm6<5:3> = 1xx 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<imm> Is an immediate value, in the range 1 to <size>/2, encoded in the "imm6" field as <size>/2 - <imm>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for e = 0 to elements-1 
result = LSR(Elem[Qin[m>>1],e,2sesize], shift_amount); 
Elem[D[d],e,esize] = result<esize-1:0>; 
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F6.1.222 VSHRN (zero) 


Vector Shift Right Narrow takes each element in a vector, right shifts them by an immediate value, and places the 
truncated results in the destination vector 


This instruction is a pseudo-instruction of the VMOVN instruction. This means that: 


$ The encodings in this description are named to match the encodings of VMOVN. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
. The description of VMOVN gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16/15 12/1110 9 8|7 6 5 4|3 0| 


11110011 1p isej of va Jojo 10 o[o|w[o] vwm | 


A1 variant 

VSHRN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


11111111 1fpji afsize[1 of va [ojo 1 0 ojojmjo] vm | 


T1 variant 

VSHRN{<c>}{<q>}.<dt> <Dd>, <Qm>, #0 
is equivalent to 

VMOVN{<c>}{<q>}.<dt> <Dd>, <Qm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the operand, encoded in the "size" field. It can have the following 
values: 
116 when size = 00 
132 when size = 01 
164 when size = 10 


The encoding size = 11 is reserved. 
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<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 


Operation for all encodings 


The description of VMOVN gives the operational pseudocode for this instruction. 
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F6.1.223 


F6-5372 


VSLI 


Vector Shift Left and Insert takes each element in the operand vector, left shifts them by an immediate value, and 


inserts the results in the destination vector. Bits shifted out of the left of each element are lost. 


The elements must all be the same size, and can be 8-bit, 16-bit, 32-bit, or 64-bit. There is no distinction between 


data types. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 2221 | 16/15 12/1110 9 8|7 6 5 4/3 0 | 


77100 ti] imme | va forori vm | 


64-bit SIMD vector variant 
Applies when ! (imm6 == 000xxx && L == 0) && Q == 0. 


VSLI{<c>}{<q>}.<size> {<Dd>,} <Dm>, #<imm> 


128-bit SIMD vector variant 
Applies when !(imm6 == Q00xxx && L == 0) & Q = 1. 


VSLI{<c>}{<q>}.<size> {<Qd>,} <Qm>, #<imm> 


Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'QQQ1xxx' esize = 8; elements = 8; shift_amount = UInt(imm6) - 8; 
when 'QQ1xxxx' esize = 16; elements = 4; shift_amount = UInt(imm6) - 16; 
when 'Q1xxxxx' esize = 32; elements = 2; shift_amount = UInt(imm6) - 32; 
when '1xxxxxx' esize = 64; elements = 1; shift_amount = UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 1211110 9 8|7 6 5 | 0 |15 12/1110 9 8|7 6 5 4|3 0| 


apt 114 me | va fon o oM v | 


64-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q == 0. 
VSLI{<c>}{<q>}.<size> {<Dd>,} <Dm>, #<imm> 

128-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q = 1. 


VSLI{<c>}{<q>}.<size> {<Qd>,} <Qm>, #<imm> 
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Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'QQQ1xxx' esize = 8; elements = 8; shift_amount = UInt(imm6) - 8; 
when 'QQ@1xxxx' esize = 16; elements = 4; shift_amount = UInt(imm6) - 16; 
when 'Q1xxxxx' esize = 32; elements = 2; shift_amount = UInt(imm6) - 32; 
when '1xxxxxx' esize = 64; elements = 1; shift_amount = UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size for the elements of the vectors, encoded in the "L:imm6<5:3>" field. It can have the 
following values: 
8 when L = 0, imm6<5:3> = 001 
16 when L = Q, imm6<5:3> = 01x 
32 when L = 0, imm6<5:3> = 1xx 
64 when L = 1, imm6<5:3> = xxx 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
<imm> Is an immediate value, in the range 0 to <size>-1, encoded in the "imm6" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
mask = LSL(Ones(esize), shift_amount) ; 
for r = 0 to regs-1 
for e = Q to elements-1 
shifted_op = LSL(Elem[D[m+r],e,esize], shift_amount); 
Elem[D[d+r],e,esize] = (Elem[D[d+r],e,esize] AND NOT(mask)) OR shifted_op; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-5373 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.224 VSQRT 


ARM DDI 0487E.a 
ID070919 


Square Root calculates the square root of the value in a floating-point register and writes the result to another 


floating-point register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 


mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 
Cem [i770 ph oo 07] va [1 ojs iimo] vm _| 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VSQRT{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VSQRT{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VSQRT{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

case size of 
when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); m = UInt(Vm:M); 
UInt(Vd:D); m = UInt(Vm:M); 
UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 
|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0\15 12/1109 8|7 6 5 4|3 0| 


111011101 ooon] va [i ojs jimo] vm _| 


Half-precision scalar variant 


Applies when size == 01. 
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VSQRT{<c>}{<q>}.F16 <Sd>, <Sm> 


Single-precision scalar variant 
Applies when size == 10. 


VSQRT{<c>}{<q>}.F32 <Sd>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VSQRT{<c>}{<q>}.F64 <Dd>, <Dm> 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 
if size == '01' && InITBlock() then UNPREDICTABLE; 

if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

case size of 


when 'Q1' esize = 16; d = UInt(Vd:D); m = UInt(Vm:M); 
when '10' esize = 32; d = UInt(Vd:D); m = UInt(Vm:M); 
when '11' esize = 64; d = UInt(D:Vd); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

s The instruction is UNDEFINED. 

. The instruction executes as if it passes the Condition code check. 

7 The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 

<q> See Standard assembler syntax fields on page F2-3908. 

<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 
<Sm> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vm:M" field. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
case esize of 
when 16 S[d] = Zeros(16) : FPSqrt(S[m]<15:@>, FPSCR) 
when 32 S[d] = FPSqrt(S[m], FPSCR); 
when 64 D[d] = FPSqrt(D[m], FPSCR); 
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F6.1.225 VSRA 


ARM DDI 0487E.a 
ID070919 


Vector Shift Right and Accumulate takes each element in a vector, right shifts them by an immediate value, and 
accumulates the truncated results into the destination vector. For rounded results, see VRSRA. 


The operand and result elements must all be the same type, and can be any one of: 
. 8-bit, 16-bit, 32-bit, or 64-bit signed integers. 
° 8-bit, 16-bit, 32-bit, or 64-bit unsigned integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 | 16/15 12/1110 9 8|7 6 5 4/3 0 | 


111100 tulip] imme | va jooo tft fais] vm | 


64-bit SIMD vector variant 
Applies when !(imm6 == 000xxx && L == 0) & Q == 0. 


VSRA{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 


128-bit SIMD vector variant 
Applies when !(imm6 == 000xxx && L == 0) & Q = 1. 


VSRA{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 


Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'Q@QQ1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when 'QQ1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when 'Q@1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 
when '1xxxxxx' esize = 64; elements = 1; shift_amount = 64 - UInt(imm6); 


unsigned = (U == '1'); d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 
T1 
|15 14 13 12|11 10 9 8|7 6 5 | 0 |15 12|1110 9 8|7 6 5 4|3 0 | 


1 1juja 1 1 1 ajo] imme | va foo o 1fijajmji] vm | 


64-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q == 0. 
VSRA{<c>}{<q>}.<type><size> {<Dd>,} <Dm>, #<imm> 
128-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q = 1. 


VSRA{<c>}{<q>}.<type><size> {<Qd>,} <Qm>, #<imm> 
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Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 
if Q == '1' && (Vd<@> == '1' || Vm<ð> == '1') then UNDEFINED; 
case L:imm6 of 


when 'QQQ1xxx 
when 'QQ1xxxx 
when 'Q1xxxxx 
when '1xxxxxx 
unsigned = (U == 


esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 
esize = 64; elements = 1; shift_amount = 64 - UInt(imm6); 
1'); d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 


set. 


Assembler symbols 


<C> 


<q> 


<type> 


<size> 


<Qd> 
<Qm> 
<Dd> 
<Dm> 


<imm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "U" field. It can have the following 
values: 
S when U = 0 


U when U = 1 


Is the data size for the elements of the vectors, encoded in the "L:imm6<5:3>" field. It can have the 
following values: 


8 when L = @, imm6<5:3> = 001 
16 when L = 0, imm6<5:3> = 01x 
32 when L = 0, imm6<5:3> = 1xx 
64 when L = 1, imm6<5:3> = xxx 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 

Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Is an immediate value, in the range 1 to <size>, encoded in the "imm6" field as <size> - <imm>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 


F6-5378 


for e = 0 to elements-1 


result = Int(Elem[D[m+r],e,esize], unsigned) >> shift_amount; 
Elem[D[d+r],e,esize] = Elem[D[d+r],e,esize] + result; 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.226 


F6-5380 


VSRI 


Vector Shift Right and Insert takes each element in the operand vector, right shifts them by an immediate value, and 


inserts the results in the destination vector. Bits shifted out of the right of each element are lost. 


The elements must all be the same size, and can be 8-bit, 16-bit, 32-bit, or 64-bit. There is no distinction between 


data types. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 
A1 


|31 30 29 28|27 26 25 24|23 2221 | 16/15 12/1110 9 8|7 6 5 4/3 0 | 


777100 tip] imme | va foroo vm | 


64-bit SIMD vector variant 
Applies when !(imm6 == @00xxx && L == 0) && Q == 0. 


VSRI{<c>}{<q>}.<size> {<Dd>,} <Dm>, #<imm> 


128-bit SIMD vector variant 
Applies when !(imm6 == Q00xxx && L == 0) && Q = 1. 


VSRI{<c>}{<q>}.<size> {<Qd>,} <Qm>, #<imm> 


Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'QQQ1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when 'QQ@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when 'Q1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 
when '1xxxxxx' esize = 64; elements = 1; shift_amount = 64 - UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


|15 14 13 1211110 9 8|7 6 5 | 0 |15 12/1110 9 8|7 6 5 4|3 0| 


api 1171 1p] imme | va fon o ofo] v | 


64-bit SIMD vector variant 

Applies when !(imm6 == 000xxx && L == 0) & Q == 0. 
VSRI{<c>}{<q>}.<size> {<Dd>,} <Dm>, #<imm> 

128-bit SIMD vector variant 

Applies when !(imm6 == 000xxx & L == 0) & Q = 1. 


VSRI{<c>}{<q>}.<size> {<Qd>,} <Qm>, #<imm> 
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Decode for all variants of this encoding 


if (L:imm6) == '0000xxx' then SEE "Related encodings"; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 

case L:imm6 of 
when 'Q@QQ1xxx' esize = 8; elements = 8; shift_amount = 16 - UInt(imm6); 
when 'QQ@1xxxx' esize = 16; elements = 4; shift_amount = 32 - UInt(imm6); 
when 'Q1xxxxx' esize = 32; elements = 2; shift_amount = 64 - UInt(imm6); 
when '1xxxxxx' esize = 64; elements = 1; shift_amount = 64 - UInt(imm6); 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Notes for all encodings 


Related encodings: See Advanced SIMD one register and modified immediate on page F3-3971 for the T32 
instruction set, or Advanced SIMD one register and modified immediate on page F4-4058 for the A32 instruction 
set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size for the elements of the vectors, encoded in the "L:imm6<5:3>" field. It can have the 
following values: 
8 when L = 0, imm6<5:3> = 001 
16 when L = Q, imm6<5:3> = 01x 
32 when L = 0, imm6<5:3> = 1xx 
64 when L = 1, imm6<5:3> = xxx 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 
<imm> Is an immediate value, in the range 1 to <size>, encoded in the "imm6" field as <size> - <imm>. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
mask = LSR(Ones(esize), shift_amount) ; 
for r = 0 to regs-1 
for e = Q to elements-1 
shifted_op = LSR(Elem[D[m+r],e,esize], shift_amount); 
Elem[D[d+r],e,esize] = (Elem[D[d+r],e,esize] AND NOT(mask)) OR shifted_op; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.227 VST1 (single element from one lane) 


Store single element from one lane of one register stores one element to memory from one element of a register. For 
details of the addressing mode see The Advanced SIMD addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0 | 
T1170700 1[oJo]o] Rn | va Jo ojo O]index align] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
Decode for all variants of this encoding 
if size == '11' then UNDEFINED; 
if index_align<@> != '@' then UNDEFINED; 
ebytes = 1; index = UInt(index_align<3:1>); alignment = 1; 
d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 then UNPREDICTABLE; 
A2 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12/1110 9 8|7 4|3 0| 
T1170700 1[oJo]o] Rn | va Jo 1]0 O]index align] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
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F6-5384 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if index_align<1> != '@' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

alignment = if index_align<@> == 'Q' then 1 else 2; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 then UNPREDICTABLE; 


A3 
|31 30 29 28|27 26 25 24/23 22 21 20/19 16/15 12/1110 9 8|7 4|3 0 | 
11170700 1{Djofo} Rn | Vd |1 0}0 Olindex_align] _ Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if index_align<2> != '@' then UNDEFINED; 

if index_align<1:0> != '00' && index_align<1:0> != '11' then UNDEFINED; 
ebytes = 4; index = UInt(index_align<3>); 

alignment = if index_align<1:0@> == '00' then 1 else 4; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); | register_index = (m != 15 && m != 13); 

if n == 15 then UNPREDICTABLE; 


T1 

|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 4|3 0 | 

1111100 1 1{dfojo] Rn | va [o ofo Ofindex_align] Rm | 

size 
Offset variant 
Applies when Rm == 1111. 
VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
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Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 

if size == '11' then UNDEFINED; 

if index_align<@> != '@' then UNDEFINED; 

ebytes = 1; index = UInt(index_align<3:1>); alignment = 1; 
d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 then UNPREDICTABLE; 


T2 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 4|3 0 | 


14111100 1 sfojofo}y Ra | va [o 1[0 ofindexalign] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if index_align<1> != '@' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

alignment = if index_align<@> == 'Q' then 1 else 2; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 then UNPREDICTABLE; 


T3 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 4|3 0 | 


11111001 1{ofofof Rn | va [1 ofo ofindex align] Rm | 


size 
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Offset variant 


Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 


Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 


Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 
if index_align<2> != '@' then UNDEFINED; 
if index_align<1:0> != '00' && index_align<1:0> != '11' then UNDEFINED; 


ebytes = 4; 


index = UInt(index_align<3>); 


alignment = if index_align<1:0@> == '00' then 1 else 4; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 then UNPREDICTABLE; 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<size> 


<list> 


<Rn> 


<align> 
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For encoding A1, A2 and A3: see Standard assembler syntax fields on page F2-3908. This encoding 


must be unconditional. 


For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 


32 when size = 10 


Is a list containing the single 64-bit name of the SIMD&FP register holding the element. 


The list must be { <Dd>[<index>] }. 

The register <Dd> is encoded in the "D:Vd" field. 

The permitted values and encoding of <index> depend on <size>: 

<size> == 8<index> is in the range 0 to 7, encoded in the "index_align<3:1>" field. 
<size> == 16<index> is in the range 0 to 3, encoded in the "index_align<3:2>" field. 


<size> == 32<index> is 0 or 1, encoded in the "index_align<3>" field. 
Is the general-purpose base register, encoded in the "Rn" field. 


When <size> == 8, <align> must be omitted, otherwise it is the optional alignment. 
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Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and the encoding depends on <size>: 


<size> == 8Encoded in the "index_align<0>" field as 0. 

<size> == 16Encoded in the "index_align<1:0>" field as 0b00. 

<size> == 32Encoded in the "index_align<2:0>" field as 0b000. 

Whenever <align> is present, the permitted values and encoding depend on <size>: 


<size> == 16<align> is 16, meaning 16-bit alignment, encoded in the "index_align<1:0>" field as 
0b01. 


<size> == 32<align> is 32, meaning 32-bit alignment, encoded in the "index_align<2:0>" field as 
0b011. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 


page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = TRUE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
MemU[address,ebytes] = Elem[D[d], index]; 
if whack then 
if register_index then 


else 


R[n] = R[n] + R[m]; 


R[n] = R[n] + ebytes; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-5387 


Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.228 


F6-5388 


VST1 (multiple single elements) 


Store multiple single elements from one, two, three, or four registers stores elements to memory from one, two, 
three, or four registers, without interleaving. Every element of each register is stored. For details of the addressing 
mode see The Advanced SIMD addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Ti 770100 0[0]ojo] Ra | va [011 i[sweJaign] Rm | 


Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 1; if align<l> == '1' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


` The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
s The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


A2 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4/3 0 | 


111010 0 ojpofojof Rn | va fi o 1 Ofsizejalign] Rm | 
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Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 2; if align == '11' then UNDEFINED; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
$ The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 


register becomes UNKNOWN. This behavior does not affect any other memory locations. 


A3 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12/1110 9 8|7 6 5 4|3 


Ti 770100 0)p]ojo] Ra | va [011 ofszejamn| Rm | 


Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
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Decode for all variants of this encoding 


regs = 3; if align<l> == '1' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
` The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


A4 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Ti 770100 0[d]ojo] Ra | va [001 0[sweJalgn] Rm | 


Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 4; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
e The instruction executes as NOP. 
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è The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T1 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 


77414007 opolo] en | va [017 1[sze[algn] Rm | 


Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 1; if align<l> == '1' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
è The instruction executes as NOP. 
: The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T2 


|15 141312/11109 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


Tii77007 0)pjojo] Ra | va [101 0[sweJaign] Rm | 


Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
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F6-5392 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 2; if align == '11' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
s The instruction executes as NOP. 
$ The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 


register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T3 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 


o| 


1111100 1 ojpjojo] Rn | va [o 1 1 ofsizefalign] Rm | 


Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 3; if align<1l> == '1' then UNDEFINED; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 
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CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


: The instruction is UNDEFINED. 
: The instruction executes as NOP. 
: The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T4 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


Ti 777007 opoje] Ra | va [001 0[sweJalgn] Rm | 


Offset variant 
Applies when Rm == 1111. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST1{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 4; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); n = UInt(Rn); m = UInt(Rm); 

wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d+regs > 32, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
è The instruction executes as NOP. 
è The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VST1 (multiple single elements) on 
page K1-7623. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. F6-5393 
Non-Confidential 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6-5394 


Related encodings: See Advanced SIMD element or structure load/store on page F3-3985 for the T32 instruction 
set, or Advanced SIMD element or structure load/store on page F4-4061 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1, A2, A3 and A4: see Standard assembler syntax fields on page F2-3908. This 
encoding must be unconditional. 


For encoding T1, T2, T3 and T4: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 
64 when size = 11 
<list> Is a list containing the 64-bit names of the SIMD&FP registers. 


The list must be one of: 
{ <Dd> } Single register. Selects the A1 and T1 encodings of the instruction. 
{ <Dd>, <Dd+1> }Two single-spaced registers. Selects the A2 and T2 encodings of the instruction. 


{ <Dd>, <Dd+1>, <Dd+2> }Three single-spaced registers. Selects the A3 and T3 encodings of the 
instruction. 


{ <Dd>, <Dd+1>, <Dd+2>, <Dd+3> }Four single-spaced registers. Selects the A4 and T4 encodings of 
the instruction. 


The register <Dd> is encoded in the "D:Vd" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


<align> Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "align" field as Qb00. 


Whenever <align> is present, the permitted values are: 
64 64-bit alignment, encoded in the "align" field as 0b01. 


128 128-bit alignment, encoded in the "align" field as 0b10. Available only if <list> contains 
two or four registers. 


256 256-bit alignment, encoded in the "align" field as 0b11. Available only if <list> contains 
four registers. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


<Rm> Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about <Rn>, !, and <Rm>, see The Advanced SIMD addressing mode on page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 

EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = TRUE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
for r = 0 to regs-1 

for e = Q to elements-1 

if ebytes != 8 then 
MemU[address,ebytes] = Elem[D[d+r],e]; 
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else 
- = AArch32.CheckAlignment(address, ebytes, AccType_NORMAL, iswrite); 
bits(64) data = Elem[D[d+r],e]; 
MemU[address,4] = if BigEndian() then data<63:32> else data<31:0>; 
MemU[address+4,4] = if BigEndian() then data<31:0> else data<63:32>; 
address = address + ebytes; 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 8regs; 
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F6.1.229 


F6-5396 


VST2 (single 2-element structure from one lane) 


Store single 2-element structure from one lane of two registers stores one 2-element structure to memory from 
corresponding elements of two registers. For details of the addressing mode see The Advanced SIMD addressing 


mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 4|3 0 | 


Ti 770100 1)oJo[o] Ra | va Jo ojo iJindex align] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 

if size == '11' then UNDEFINED; 

ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 
alignment = if index_align<@> == 'Q' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d2 > 31, then one of the following behaviors must occur: 
` The instruction is UNDEFINED. 


° The instruction executes as NOP. 


s The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 


register becomes UNKNOWN. This behavior does not affect any other memory locations. 


A2 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0 | 
114101700 1|pjojo] Rn | va [o 1[0 1[indexaign| Rm | 
size 
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Offset variant 
Applies when Rm == 1111. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 4; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2 > 31, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
è The instruction executes as NOP. 
$ The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


A3 

|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0| 

T1110700 1[DJo}o] Rn | va [i ojo mexan] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
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Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if index_align<l> != '@' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 
alignment = if index_align<@> == 'Q' then 1 else 8; 


d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 


if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2 > 31, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
è The instruction executes as NOP. 
s The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 


register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 


12/1110 9 8|7 


o | 


11111001 1{pfofo] Rn | va [o ofo 1]index align] Rm | 


Offset variant 
Applies when Rm == 1111. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 
ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 
alignment = if index_align<@> == 'Q' then 1 else 2; 


d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 


if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2 > 31, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as NOP. 
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: The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T2 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 4|3 0 | 


7717007 pojo] Rn | va [0 1]0 1index ain] Rm 


size 


Offset variant 
Applies when Rm == 1111. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 4; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 

If d2 > 31, then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

7 The instruction executes as NOP. 


°. The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T3 

|15 14 13 12|11 10 9 8|7 6 5 4]|3 o |15 12|11 10 9 8|7 4|3 0 | 

177117007 1)0)o]o] Rn | va |? 0]0 ‘index align] Rm | 

size 
Offset variant 
Applies when Rm == 1111. 
VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
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Post-indexed variant 


Applies when Rm == 1101. 


VST2{< 


c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 


Applies when Rm != 11x1. 


VST2{< 


c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 
if index_align<l> != 'Q' then UNDEFINED; 


ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 8; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 


if n == 15 || d2 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2 > 


31, then one of the following behaviors must occur: 
The instruction is UNDEFINED. 


The instruction executes as NOP. 


The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 


register becomes UNKNOWN. This behavior does not affect any other memory locations. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VST2 (single 2-element structure from 
one lane) on page K1-7624. 


Asse 


<C> 


<q> 


<size> 


<list> 


F6-5400 


mbler symbols 


For encoding Al, A2 and A3: see Standard assembler syntax fields on page F2-3908. This encoding 


must be unconditional. 


For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 


See Standard assembler syntax fields on page F2-3908. 


Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


Is a list containing the 64-bit names of the two SIMD&FP registers holding the element. 
The list must be one of: 


{ <Dd>[<index>], <Dd+1>[<index>] }Single-spaced registers, encoded as "spacing" = 0. 


{ <Dd>[<index>], <Dd+2>[<index>] }Double-spaced registers, encoded as "spacing" = 1. Not 


permitted when <size> == 8. 
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The encoding of "spacing" depends on <size>: 

<size> == 16"spacing" is encoded in the "index_align<1>" field. 

<size> == 32"spacing" is encoded in the "index_align<2>" field. 

The register <Dd> is encoded in the "D:Vd" field. 

The permitted values and encoding of <index> depend on <size>: 

<size> == 8<index> is in the range 0 to 7, encoded in the "index_align<3:1>" field. 
<size> == 16<index> is in the range 0 to 3, encoded in the "index_align<3:2>" field. 


<size> == 32<index> is 0 or 1, encoded in the "index_align<3>" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


<align> Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and the encoding depends on <size>: 


<size> == 8Encoded in the "index_align<0>" field as 0. 

<size> == 16Encoded in the "index_align<0>" field as 0. 

<size> == 32Encoded in the "index_align<1:0>" field as 0b00. 

Whenever <align> is present, the permitted values and encoding depend on <size>: 

<size> == 8<align> is 16, meaning 16-bit alignment, encoded in the "index_align<0>" field as 1. 
<size> == 16<align> is 32, meaning 32-bit alignment, encoded in the "index_align<0>" field as 1. 


<size> == 32<align> is 64, meaning 64-bit alignment, encoded in the "index_align<1:0>" field as 
0b01. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


<Rm> Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 
page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = TRUE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
MemU[address, ebytes] = Elem[D[d], index]; 
MemU[address+ebytes,ebytes] = Elem[D[d2], index]; 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 2xebytes; 
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F6.1.230 


F6-5402 


VST2 (multiple 2-element structures) 


Store multiple 2-element structures from two or four registers stores multiple 2-element structures from two or four 
registers to memory, with interleaving. For more information, see Element and structure load/store instructions on 
page F1-3888. Every element of each register is saved. For details of the addressing mode see The Advanced SIMD 


addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 


more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12\11 8|7 6 5 4|3 0 | 


77710700 0[pjofo] Rn | va [100 x[ske[algn] Rm | 


itype 


Offset variant 
Applies when Rm == 1111. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 1; if align == '11' then UNDEFINED; 

if size == '11' then UNDEFINED; 

inc = if itype == '1001' then 2 else 1; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d2+regs > 32, then one of the following behaviors must occur: 
: The instruction is UNDEFINED. 


° The instruction executes as NOP. 


à The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 


register becomes UNKNOWN. This behavior does not affect any other memory locations. 
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A2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


Ti 770100 0[0]ojo] Ra | va [001 i[sweJalgn] Rm | 


Offset variant 
Applies when Rm == 1111. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 2; inc = 2; 

if size == '11' then UNDEFINED; 

alignment = if align == 'Q0' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2+regs > 32, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
: The instruction executes as NOP. 
3 The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T1 

|15 14 13 12|11 10 9 8|7 6 5 4]|3 o |15 12|11 8|7 6 5 4|3 0 | 

111110071 opoo] Rn | va [100 x|swelaign] Rm | 
itype 
Offset variant 
Applies when Rm == 1111. 
VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
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F6-5404 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 1; if align == '11' then UNDEFINED; 

if size == '11' then UNDEFINED; 

inc = if itype == '1001' then 2 else 1; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2+regs > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d2+regs > 32, then one of the following behaviors must occur: 


: The instruction is UNDEFINED. 
. The instruction executes as NOP. 
s The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 


register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T2 


[15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 


o| 


11111001 opoje] Ra | va [001 i[sweJalgn] Rm | 


Offset variant 
Applies when Rm == 1111. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST2{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


regs = 2; inc = 2; 

if size == '11' then UNDEFINED; 

alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 

d = UInt(D:Vd); d2 =d + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d2+regs > 32 then UNPREDICTABLE; 
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CONSTRAINED UNPREDICTABLE behavior 


If d2+regs > 32, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
: The instruction executes as NOP. 
: The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VST2 (multiple 2-element structures) 
on page K1-7623. 


Related encodings: See Advanced SIMD element or structure load/store on page F3-3985 for the T32 instruction 
set, or Advanced SIMD element or structure load/store on page F4-4061 for the A32 instruction set. 
Assembler symbols 


<c> For encoding A1 and A2: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1 and T2: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<list> Is a list containing the 64-bit names of the SIMD&FP registers. 
The list must be one of: 


{ <Dd>, <Dd+1> }Two single-spaced registers. Selects the A1 and T1 encodings of the instruction, 
and encoded in the "itype" field as 0b1000. 


{ <Dd>, <Dd+2> }Two double-spaced registers. Selects the Al and T1 encodings of the instruction, 
and encoded in the "itype" field as 0b1001. 


{ <Dd>, <Dd+1>, <Dd+2>, <Dd+3> }Three single-spaced registers. Selects the A2 and T2 encodings 
of the instruction. 


The register <Dd> is encoded in the "D:Vd" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


<align> Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "align" field as 0b00. 


Whenever <align> is present, the permitted values are: 


64 64-bit alignment, encoded in the "align" field as @b01. 
128 128-bit alignment, encoded in the "align" field as 0b10. 
256 256-bit alignment, encoded in the "align" field as 0b11. Available only if <list> contains 
four registers. 
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: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


<Rm> Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 
page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = TRUE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
for r = 0 to regs-1 
for e = Q to elements-1 
MemU[address, ebytes] = Elem[D[d+r], e]; 
MemU[address+ebytes,ebytes] = Elem[D[d2+r],e]; 
address = address + 2«ebytes; 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 16*regs; 
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F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


ARM DDI 0487E.a 


VST3 (single 3-element structure from one lane) 


Store single 3-element structure from one lane of three registers stores one 3-element structure to memory from 
corresponding elements of three registers. For details of the addressing mode see The Advanced SIMD addressing 


mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 


12/1110 9 8|7 


4|3 o| 


111101001] Ra | va Jo 0]1 ofraxaion| Rm | 


size 
Offset variant 
Applies when Rm == 1111. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>] 
Post-indexed variant 
Applies when Rm == 1101. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 
Decode for all variants of this encoding 
if size == '11' then UNDEFINED; 
if index_align<@> != '@' then UNDEFINED; 
ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d3 > 31 then UNPREDICTABLE; 
CONSTRAINED UNPREDICTABLE behavior 
If d3 > 31, then one of the following behaviors must occur: 
- The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
s The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


A2 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 


12/1110 9 8|7 


4|3 0 | 


1110100 tfofojof Rn | va fo 141 Ofindexalign] Rm | 


size 
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Offset variant 
Applies when Rm == 1111. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>] 


Post-indexed variant 
Applies when Rm == 1101. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if index_align<@> != '@' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d3 > 31, then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 


. The instruction executes as NOP. 


m = UInt(Rm); 


$ The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


A3 

|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12|11 10 9 8|7 4|3 0| 

T1110700 1[DJo}o] Rn | va [i 01 Ofindexaign] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>] 
Post-indexed variant 
Applies when Rm == 1101. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 
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Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if index_align<1:0> != '@0' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); 
wback = (m != 15); register_index = (m != 15 &&m != 13); 
if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d3 > 31, then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 


. The instruction executes as NOP. 


m = UInt(Rm); 


s The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 


register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 


7717007 plojo] Rn | va Jo of 0|index align] Rm 


size 


Offset variant 
Applies when Rm == 1111. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>] 


Post-indexed variant 
Applies when Rm == 1101. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 


Decode for all variants of this encoding 

if size == '11' then UNDEFINED; 

if index_align<@> != '@' then UNDEFINED; 

ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d3 > 31, then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 


. The instruction executes as NOP. 


m = UInt(Rm); 
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: The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T2 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 4|3 0 | 
mararo orpo] Rn | va Jo 4]7 0|index align] Rm 


size 


Offset variant 
Applies when Rm == 1111. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>] 


Post-indexed variant 
Applies when Rm == 1101. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if index_align<@> != '@' then UNDEFINED; 

ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
° The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T3 

|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 4|3 0 | 

Tt 4410071 4[0foo] Ra | va [i 0]? Ofindex align] Rm | 

size 
Offset variant 
Applies when Rm == 1111. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>] 
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Post-indexed variant 
Applies when Rm == 1101. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if index_align<1:0> != '@0' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


š The instruction is UNDEFINED. 
- The instruction executes as NOP. 
è The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VST3 (single 3-element structure from 
one lane) on page K1-7624. 


Assembler symbols 


<c> For encoding A1, A2 and A3: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 
<list> Is a list containing the 64-bit names of the three SIMD&FP registers holding the element. 


The list must be one of: 


{ <Dd>[<index>], <Dd+1>[<index>], <Dd+2>[<index>] }Single-spaced registers, encoded as 
"spacing" = ð. 


{ <Dd>[<index>], <Dd+2>[<index>], <Dd+4>[<index>] }Double-spaced registers, encoded as 
"spacing" = 1. Not permitted when <size> == 8. 
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<Rn> 


<Rm> 


The encoding of "spacing" depends on <size>: 
<size> == 8"spacing" is encoded in the "index_align<0>" field. 
<size> == 16"spacing" is encoded in the "index_align<1>" field, and "index_align<0>" is set to 0. 


<size> == 32"spacing" is encoded in the "index_align<2>" field, and "index_align<1:0>" is set to 
0b00. 


The register <Dd> is encoded in the "D:Vd" field. 

The permitted values and encoding of <index> depend on <size>: 

<size> == 8<index> is in the range 0 to 7, encoded in the "index_align<3:1>" field. 
<size> == 16<index> is in the range 0 to 3, encoded in the "index_align<3:2>" field. 


<size> == 32<index> is 0 or 1, encoded in the "index_align<3>" field. 
Is the general-purpose base register, encoded in the "Rn" field. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 


page F2-3929. 


Alignment 


Standard alignment rules apply, see Alignment support on page B2-138. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; 
MemU[address, ebytes] = Elem[D[d], index] 
MemU[address+ebytes, ebytes] = Elem[D[d2],index] 
MemU[address+2sebytes,ebytes] = Elem[D[d3], index]; 
if whack then 

if register_index then 

R[n] = R[n] + R[m]; 


R[n] = R[n] + 3xebytes; 
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F6.1.232 VST3 (multiple 3-element structures) 


Store multiple 3-element structures from three registers stores multiple 3-element structures to memory from three 
registers, with interleaving. For more information, see Element and structure load/store instructions on 

page F1-3888. Every element of each register is saved. For details of the addressing mode see The Advanced SIMD 
addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15 12|11 8/7 6 5 4|3 0 | 
77710700 0[pjofo] en | va [010 x|ske[algn] Rm | 


itype 


Offset variant 
Applies when Rm == 1111. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' || align<1l> == '1' then UNDEFINED; 
case itype of 
when 'Q100' 
inc = 1; 
when 'Q101' 
inc = 2; 
otherwise 
SEE "Related encodings"; 
alignment = if align<@> == 'Q' then 1 else 8; 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 
if n == 15 || d3 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d3 > 31, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 
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T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|11 8|7 6 5 4/3 0| 
11471007 0[pjojo] Rn | va [010 x]szeJaign] Rm] 
itype 
Offset variant 
Applies when Rm == 1111. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 
Post-indexed variant 
Applies when Rm == 1101. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 
Post-indexed variant 
Applies when Rm != 11x1. 
VST3{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
Decode for all variants of this encoding 
if size == '11' || align<1l> == '1' then UNDEFINED; 
case itype of 
when 'Q100' 
inc =1; 
when 'Q101' 
inc = 2; 
otherwise 
SEE "Related encodings"; 
alignment = if align<@> == 'Q' then 1 else 8; 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d3 > 31 then UNPREDICTABLE; 
CONSTRAINED UNPREDICTABLE behavior 
If d3 > 31, then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
° The instruction executes as NOP. 
$ The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VST3 (multiple 3-element structures) 


on page K1-7624. 


Related encodings: See Advanced SIMD element or structure load/store on page F3-3985 for the T32 instruction 
set, or Advanced SIMD element or structure load/store on page F4-4061 for the A32 instruction set. 
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Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<list> Is a list containing the 64-bit names of the SIMD&FP registers. 
The list must be one of: 
{ <Dd>, <Dd+1>, <Dd+2> }Single-spaced registers, encoded in the "itype" field as 0b0100. 
{ <Dd>, <Dd+2>, <Dd+4> }Double-spaced registers, encoded in the "itype" field as 0b0101. 
The register <Dd> is encoded in the "D:Vd" field. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


<align> Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "align" field as Qb00. 


Whenever <align> is present, the only permitted values is 64, meaning 64-bit alignment, encoded in 
the "align" field as 0b01. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


<Rm> Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 
page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = TRUE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
for e = 0 to elements-1 
MemU[address, ebytes] = Elem[D[d], e]; 
MemU[address+ebytes, ebytes] = Elem[D[d2],e]; 
MemU[address+2«ebytes,ebytes] = Elem[D[d3],e]; 
address = address + 3xebytes; 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
Rn] = R[n] + 24; 
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VST4 (single 4-element structure from one lane) 


Store single 4-element structure from one lane of four registers stores one 4-element structure to memory from 
corresponding elements of four registers. For details of the addressing mode see The Advanced SIMD addressing 


mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 


4|3 0 | 


Ti 770100 1)oJo[o] Ra | va Jo oji i[index align] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if size != '00' then SEE "Related encodings"; 

ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 

alignment = if index_align<@> == 'Q' then 1 else 4; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 

if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d4 > 31, then one of the following behaviors must occur: 
- The instruction is UNDEFINED. 


. The instruction executes as NOP. 


m = UInt(Rm); 


è The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


A2 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 


4|3 0 | 


Ti 770100 1)oJojo] Ra | va Joi rarai] Rm | 


size 
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Offset variant 
Applies when Rm == 1111. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if size != '@1' then SEE "Related encodings"; 

ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 8; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); 
wback = (m != 15);  register_index = (m != 15 && m != 13); 

if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d4 > 31, then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 


. The instruction executes as NOP. 


m = UInt(Rm); 


: The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


A3 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 


4|3 o| 


111101001] Ra | va [1 0[1 i[index align] Rm | 


size 


Offset variant 
Applies when Rm == 1111. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 
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Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if size != '10' then SEE "Related encodings"; 
if index_align<1:0> == '11' then UNDEFINED; 
ebytes = 4; index = UInt(index_align<3>); 
inc = if index_align<2> == '@' then 1 else 2; 


alignment = if index_align<1:@> == 'Q0' then 1 else 4 << UInt(index_align<1:0>); 


d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 
If d4 > 31, then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 


. The instruction executes as NOP. 


m = UInt(Rm); 


$ The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 


4|3 0 | 


Tii77007 1oJojo] Ra | va Jo ojn rarai] Rm] 


size 


Offset variant 
Applies when Rm == 1111. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if size != '00' then SEE "Related encodings"; 

ebytes = 1; index = UInt(index_align<3:1>); inc = 1; 

alignment = if index_align<@> == 'Q' then 1 else 4; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 

If d4 > 31, then one of the following behaviors must occur: 
s The instruction is UNDEFINED. 

e The instruction executes as NOP. 
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: The memory locations specified by the instruction and the number of registers specified by the instruction if 
the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T2 
|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\1110 9 8|7 4|3 0 | 
77717007 pojo] Rn | va Jo 4]7 1 [index align] Rm 


size 


Offset variant 
Applies when Rm == 1111. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if size != '@1' then SEE "Related encodings"; 

ebytes = 2; index = UInt(index_align<3:2>); 

inc = if index_align<1> == '@' then 1 else 2; 

alignment = if index_align<@> == 'Q' then 1 else 8; 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


, The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
° The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T3 
|15 14 13 12|11 10 9 8|7 6 5 4/3 o |15 12|11 10 9 8|7 4|3 0 | 
11111001100] Ra | va [i oj 1 [index alin] Rm | 
size 
Offset variant 
Applies when Rm == 1111. 
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F6-5420 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm != 11x1. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Post-indexed variant 
Applies when Rm == 1101. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if size != '10' then SEE "Related encodings"; 

if index_align<1:0> == '11' then UNDEFINED; 

ebytes = 4; index = UInt(index_align<3>); 

inc = if index_align<2> == '@' then 1 else 2; 

alignment = if index_align<1:@> == 'Q0' then 1 else 4 << UInt(index_align<1:0>); 

d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 

if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
s The instruction executes as NOP. 
7 The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VST4 (single 4-element structure from 
one lane) on page K1-7624. 


Assembler symbols 


<c> For encoding A1, A2 and A3: see Standard assembler syntax fields on page F2-3908. This encoding 
must be unconditional. 


For encoding T1, T2 and T3: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<size> Is the data size, encoded in the "size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 
<list> Is a list containing the 64-bit names of the four SIMD&FP registers holding the element. 


The list must be one of: 


{ <Dd>[<index>], <Dd+1>[<index>], <Dd+2>[<index>], <Dd+3>[<index>] }Single-spaced registers, 
encoded as "spacing" = Q. 
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{ <Dd>[<index>], <Dd+2>[<index>], <Dd+4>[<index>], <Dd+6>[<index>] }Double-spaced registers, 
encoded as "spacing" = 1. Not permitted when <size> == 8. 


The encoding of "spacing" depends on <size>: 

<size> == 16"spacing" is encoded in the "index_align<1>" field. 

<size> == 32"spacing" is encoded in the "index_align<2>" field. 

The register <Dd> is encoded in the "D:Vd" field. 

The permitted values and encoding of <index> depend on <size>: 

<size> == 8<index> is in the range 0 to 7, encoded in the "index_align<3:1>" field. 
<size> == 16<index> is in the range 0 to 3, encoded in the "index_align<3:2>" field. 


<size> == 32<index> is 0 or 1, encoded in the "index_align<3>" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. 


<align> Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and the encoding depends on <size>: 


<size> == 8Encoded in the "index_align<0>" field as 0. 

<size> == 16Encoded in the "index_align<0>" field as 0. 

<size> == 32Encoded in the "index_align<1:0>" field as 0b00. 

Whenever <align> is present, the permitted values and encoding depend on <size>: 

<size> == 8<align> is 32, meaning 32-bit alignment, encoded in the "index_align<0>" field as 1. 
<size> == 16<align> is 64, meaning 64-bit alignment, encoded in the "index_align<0>" field as 1. 


<size> == 32<align> can be 64 or 128. 64-bit alignment is encoded in the "index_align<1:0>" field 
as 0b01, and 128-bit alignment is encoded in the "index_align<1:0>" field as 0b10. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


<Rm> Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 
page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
address = R[n]; iswrite = TRUE; 
- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 
MemU[address, ebytes] = Elem[D[d], index] 


MemU[address+ebytes, ebytes] = Elem[D[d2], index]; 
MemU[address+2sebytes,ebytes] = Elem[D[d3], index]; 
MemU[address+3*ebytes,ebytes] = Elem[D[d4], index]; 
if whack then 
if register_index then 
R[n] = R[n] + R[m]; 
else 
R[n] = R[n] + 4xebytes; 
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F6.1.234 


F6-5422 


VST4 (multiple 4-element structures) 


Store multiple 4-element structures from four registers stores multiple 4-element structures to memory from four 
registers, with interleaving. For more information, see Element and structure load/store instructions on 

page F1-3888. Every element of each register is saved. For details of the addressing mode see The Advanced SIMD 
addressing mode on page F2-3929. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24/23 22 21 20|19 16|15 12|11 8/7 6 5 4|3 0 | 
77710700 0[pjofo] Rn | va [000 x|sue [align] Rm | 


itype 


Offset variant 
Applies when Rm == 1111. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 
case itype of 
when '0000' 
inc = 1; 
when '0001' 
inc = 2; 
otherwise 
SEE "Related encodings"; 
alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
s The instruction executes as NOP. 
è The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 
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T1 
|15 1413 12/1110 9 8|7 6 5 4|3 0 |15 12\11 8/7 6 5 4|3 0 | 
Ti it7007 O[ojojo] Ra | va [ooo x[swe[aign] Rm | 


itype 


Offset variant 
Applies when Rm == 1111. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}] 


Post-indexed variant 
Applies when Rm == 1101. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}]! 


Post-indexed variant 
Applies when Rm != 11x1. 


VST4{<c>}{<q>}.<size> <list>, [<Rn>{:<align>}], <Rm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 
case itype of 
when '0000' 
inc = 1; 
when '0001' 
inc = 2; 
otherwise 
SEE "Related encodings"; 
alignment = if align == '00' then 1 else 4 << UInt(align); 
ebytes = 1 << UInt(size); elements = 8 DIV ebytes; 
d = UInt(D:Vd); d2 =d + inc; d3 = d2 + inc; d4 = d3 + inc; n = UInt(Rn); m = UInt(Rm); 
wback = (m != 15); register_index = (m != 15 && m != 13); 
if n == 15 || d4 > 31 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If d4 > 31, then one of the following behaviors must occur: 


: The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
$ The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VST4 (multiple 4-element structures) 
on page K1-7624. 


Related encodings: See Advanced SIMD element or structure load/store on page F3-3985 for the T32 instruction 
set, or Advanced SIMD element or structure load/store on page F4-4061 for the A32 instruction set. 
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F6-5424 


Assembler symbols 


<C> 


<q> 


<size> 


<list> 


<Rn> 


<align> 


<Rm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data size, encoded in the "size" field. It can have the following values: 


8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


Is a list containing the 64-bit names of the SIMD&FP registers. 

The list must be one of: 

{ <Dd>, <Dd+1>, <Dd+2>, <Dd+3> }Single-spaced registers, encoded in the "itype" field as 0b0000. 
{ <Dd>, <Dd+2>, <Dd+4>, <Dd+6> }Double-spaced registers, encoded in the "itype" field as 0b0001. 
The register <Dd> is encoded in the "D:Vd" field. 


Is the general-purpose base register, encoded in the "Rn" field. 


Is the optional alignment. 


Whenever <align> is omitted, the standard alignment is used, see Unaligned data access on 
page E2-3834, and is encoded in the "align" field as Qb00. 


Whenever <align> is present, the permitted values are: 


64 64-bit alignment, encoded in the "align" field as 0b01. 
128 128-bit alignment, encoded in the "align" field as 0b10. 
256 256-bit alignment, encoded in the "align" field as @b11. 


: is the preferred separator before the <align> value, but the alignment can be specified as @<align>, 
see The Advanced SIMD addressing mode on page F2-3929. 


Is the general-purpose index register containing an offset applied after the access, encoded in the 
"Rm" field. 


For more information about the variants of this instruction, see The Advanced SIMD addressing mode on 


page F2-3929. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 


address = R[n]; iswrite = TRUE; 


- = AArch32.CheckAlignment(address, alignment, AccType_VEC, iswrite); 


for e = Q to elements-1 
MemU[address, ebytes 
MemU[addresst+ebytes, ebytes 
MemU[address+2«ebytes, ebytes 
MemU[address+3ebytes, ebytes 
address = address + 4xebytes; 


= Elem[D[d], e 
Elem[D[d2],e 
Elem[D[d3],e 
= Elem[D[d4],e 





Pe ate Par Prater 
Peira E er 


if wback then 


if register_index then 
R[n] = R[n] + R[m]; 


R[n] = R[n] + 32; 
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F6.1.235 VSTM, VSTMDB, VSTMIA 


ARM DDI 0487E.a 
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Store multiple SIMD&FP registers stores multiple registers from the Advanced SIMD and floating-point register 
file to consecutive memory locations using an address from a general-purpose register. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the alias VPUSH. See Alias conditions on page F6-5428 for details of when each alias is 
preferred. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 | 1 0| 
Cem [17 oup] e | va po mmer 0) 


cond imm8<0> 


Decrement Before variant 
Applies when P == 1 & U == 0 && W == 


VSTMDB{<c>}{<q>}{.<size>} <Rn>!, <dreglist> 


Increment After variant 
Applies when P == 0 & U == 


VSTM{<c>}{<q>}{.<size>} <Rn>{!}, <dreglist> 
VSTMIA{<c>}{<q>}{.<size>} <Rn>{!}, <dreglist> 


Decode for all variants of this encoding 


if P == '0' && U == '0' && W == 'Q' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VSTR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = FALSE; add = (U == '1'); whack = (W == '1'); 

d = UInt(D:Vd); n = UInt(Rn); imm32 = ZeroExtend(imm8:'00', 32) 

regs = UInt(imm8) DIV 2; // If UInt(imm8) is odd, see "FSTMX". 

if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == @ || regs > 16 || (d+regs) > 32 then UNPREDICTABLE; 

if imm8<0> == '1' && (d+regs) > 16 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as a VSTM with the same addressing mode but stores no registers. 


If regs > 16 || (d+regs) > 32, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
s The instruction executes as NOP. 
s The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 
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A2 
|31 28|27 26 25 24|23 22 21 20/19 16/15 12/1110 9 8|7 | 0| 
Cem [i 7 ouwe] Rn | va op o me 


cond 


Decrement Before variant 
Applies when P == 1 && U == 0 && W == 


VSTMDB{<c>}{<q>}{.<size>} <Rn>!, <sreglist> 


Increment After variant 
Applies when P == 0 && U == 


VSTM{<c>}{<q>}{.<size>} <Rn>{!}, <sreglist> 
VSTMIA{<c>}{<q>}{.<size>} <Rn>{!}, <sreglist> 


Decode for all variants of this encoding 


if P == '0' && U == '0' && W == 'O' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VSTR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = TRUE; add = (U == '1'); whack = (W == '1'); d = UInt(Vd:D); n = UInt(Rn); 
imm32 = ZeroExtend(imm8:'00', 32); regs = UInt(imm8); 

if n == 15 && (wback || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == @ || (d+regs) > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


e The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as a VSTM with the same addressing mode but stores no registers. 


If (d+regs) > 32, then one of the following behaviors must occur: 


s The instruction is UNDEFINED. 
s The instruction executes as NOP. 
$ The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 


register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T1 
|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12|1110 9 8|7 | 1 0] 
111011 o0oļjpjujojwjo] Rn | va Jı oji 1| immas7s1> Jol 
imm8<0> 
Decrement Before variant 
Applies when P == 1 && U == 0 && W == 
VSTMDB{<c>}{<q>}{.<size>} <Rn>!, <dreglist> 
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Increment After variant 
Applies when P == @ && U == 


VSTM{<c>}{<q>}{.<size>} <Rn>{!}, <dreglist> 
VSTMIA{<c>}{<q>}{.<size>} <Rn>{!}, <dreglist> 


Decode for all variants of this encoding 


if P == '0' && U == '0' && W == 'Q' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VSTR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
single_regs = FALSE; add = (U == '1'); whack = (W == '1'); 

d = UInt(D:Vd); n = UInt(Rn); imm32 = ZeroExtend(imm8:'Q0', 32) 

regs = UInt(imm8) DIV 2; // If UInt(imm8) is odd, see "FSTMX". 

if n == 15 && (whack || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == @ || regs > 16 || (d+regs) > 32 then UNPREDICTABLE; 

if imm8<@> == '1' && (d+regs) > 16 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as a VSTM with the same addressing mode but stores no registers. 


If regs > 16 || (d+regs) > 32, then one of the following behaviors must occur: 


a The instruction is UNDEFINED. 
7 The instruction executes as NOP. 
è The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 


T2 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0| 


77047 opu] en | va popo] imme _— 


Decrement Before variant 
Applies when P == 1 && U == 0 && W == 


VSTMDB{<c>}{<q>}{.<size>} <Rn>!, <sreglist> 


Increment After variant 
Applies when P == 0 && U == 


VSTM{<c>}{<q>}{.<size>} <Rn>{!}, <sreglist> 
VSTMIA{<c>}{<q>}{.<size>} <Rn>{!}, <sreglist> 


Decode for all variants of this encoding 


if P == '@' && U == 'Q' && W == 'Q' then SEE "Related encodings"; 

if P == '1' && W == '@' then SEE "VSTR"; 

if P == U && W == '1' then UNDEFINED; 

// Remaining combinations are PUW = 010 (IA without !), 011 (IA with !), 101 (DB with !) 
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single_regs = TRUE; add = (U == '1'); whack = (W == '1'); d = UInt(Vd:D); n = UInt(Rn); 
imm32 = ZeroExtend(imm8:'Q0', 32); regs = UInt(imm8); 

if n == 15 && (whack || CurrentInstrSet() != InstrSet_A32) then UNPREDICTABLE; 

if regs == @ || (d+regs) > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If regs == 0, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as NOP. 
. The instruction operates as a VSTM with the same addressing mode but stores no registers. 


If (d+regs) > 32, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
s The instruction executes as NOP. 
$ The memory locations specified by the instruction and the number of registers specified by the instruction if 


the register list had not gone out of range, become UNKNOWN. If the instruction specifies writeback, then that 
register becomes UNKNOWN. This behavior does not affect any other memory locations. 
Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors, and particularly VSTM on page K1-7624. 


Related encodings: See Advanced SIMD and floating-point 64-bit move on page F3-3972 for the T32 instruction 
set, or Advanced SIMD and floating-point 64-bit move on page F4-4045 for the A32 instruction set. 


Alias conditions 





Alias is preferred when 


VPUSH P == '1' & U == '0' && W == '1' && Rn == '1101' 





Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
<size> An optional data size specifier. If present, it must be equal to the size in bits, 32 or 64, of the registers 


being transferred. 


<Rn> Is the general-purpose base register, encoded in the "Rn" field. If writeback is not specified, the PC 
can be used. However, Arm deprecates use of the PC. 


! Specifies base register writeback. Encoded in the "W" field as 1 if present, otherwise 0. 


<sreglist> Is the list of consecutively numbered 32-bit SIMD&FP registers to be transferred. The first register 
in the list is encoded in "Vd:D", and "imm8" is set to the number of registers in the list. The list must 
contain at least one register. 


<dreglist> Is the list of consecutively numbered 64-bit SIMD&FP registers to be transferred. The first register 
in the list is encoded in "D:Vd", and "imm8" is set to twice the number of registers in the list. The 
list must contain at least one register, and must not contain more than 16 registers. 
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Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
address = if add then R[n] else R[n]-imm32; 
for r = ð to regs-1 
if single_regs then 
MemA[address,4] = S[d+r]; address = address+4; 
else 
// Store as two word-aligned words in the correct order for current endianness. 
MemA[address,4] = if BigEndian() then D[d+r]<63:32> else D[d+r]<31:0>; 
MemA[address+4,4] = if BigEndian() then D[d+r]<31:0> else D[d+r]<63:32>; 
address = address+8; 
if wback then R[n] = if add then R[n]+imm32 else R[n]-imm32; 
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F6.1.236 


F6-5430 


VSTR 


Store SIMD&FP register stores a single register from the Advanced SIMD and floating-point register file to 
memory, using an address from a general-purpose register, with an optional offset. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 28|27 26 25 24|23 22 21 20|19 16|15 12/1110 9 8|7 | 0| 
Cem [i 7 o upeo] e | va [i ojs] — me | 


cond 


Half-precision scalar variant 
Applies when size == 01. 


VSTR{<c>}{<q>}.16 <Sd>, [<Rn>{, #{+/-}<imm>}] 


Single-precision scalar variant 
Applies when size == 10. 


VSTR{<c>}{<q>}{.32} <Sd>, [<Rn>{, #{+/-}<imm>}] 


Double-precision scalar variant 
Applies when size == 11. 


VSTR{<c>}{<q>}{.64} <Dd>, [<Rn>{, #{+/-}<imm>}] 


Decode for all variants of this encoding 


if size == '00' || (size == '01' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

esize = 8 << UInt(size); add = (U == '1'); 

imm32 = if esize == 16 then ZeroExtend(imm8:'@', 32) else ZeroExtend(imm8:'00', 32); 
case size of 


when '01' d = UInt(Vd:D); 

when '10' d = UInt(Vd:D); 

when '11' d = UInt(D:Vd); 
n = UInt(Rn); 


if n == 15 && CurrentInstrSet() != InstrSet_A32 then UNPREDICTABLE; 
CONSTRAINED UNPREDICTABLE behavior 
If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
7 The instruction is UNDEFINED. 
à The instruction executes as if it passes the Condition code check. 


° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


|15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 | 0 | 


Ti 7071 oup] Ra | va [1 0[sze] — me | 
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Half-precision scalar variant 
Applies when size == 01. 


VSTR{<c>}{<q>}.16 <Sd>, [<Rn>{, #{+/-}<imm>}] 


Single-precision scalar variant 
Applies when size == 10. 


VSTR{<c>}{<q>}{.32} <Sd>, [<Rn>{, #{+/-}<imm>}] 


Double-precision scalar variant 
Applies when size == 11. 


VSTR{<c>}{<q>}{.64} <Dd>, [<Rn>{, #{+/-}<imm>}] 


Decode for all variants of this encoding 


if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == 'Q1' && InITBlock() then UNPREDICTABLE; 

esize = 8 << UInt(size); add = (U == '1'); 

imm32 = if esize == 16 then ZeroExtend(imm8:'Q', 32) else ZeroExtend(imm8:'Q0', 32); 
case size of 


when 'Q1' d = UInt(Vd:D); 

when '10' d = UInt(Vd:D); 

when '11' d = UInt(D:Vd); 
n = UInt(Rn); 


if n == 15 && CurrentInstrSet() != InstrSet_A32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 

° The instruction is UNDEFINED. 

. The instruction executes as if it passes the Condition code check. 

° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<c> See Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 
.64 Is an optional data size specifier for 64-bit memory accesses that can be used in the assembler source 


code, but is otherwise ignored. 
<Dd> Is the 64-bit name of the SIMD&FP source register, encoded in the "D:Vd" field. 


32 Is an optional data size specifier for 32-bit memory accesses that can be used in the assembler source 
code, but is otherwise ignored. 


<Sd> Is the 32-bit name of the SIMD&FP source register, encoded in the "Vd:D" field. 
<Rn> Is the general-purpose base register, encoded in the "Rn" field. The PC can be used, but this is 
deprecated. 
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+/- Specifies the offset is added to or subtracted from the base register, defaulting to + if omitted and 
encoded in the "U" field. It can have the following values: 
- when U = @ 
+ when U = 1 

<imm> For the single-precision scalar or double-precision scalar variants: is the optional unsigned 


immediate byte offset, a multiple of 4, in the range 0 to 1020, defaulting to 0, and encoded in the 
"imms" field as <imm>/4. 


For the half-precision scalar variant: is the optional unsigned immediate byte offset, a multiple of 2, 
in the range 0 to 510, defaulting to 0, and encoded in the "imm8" field as <imm>/2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckVFPEnabled(TRUE) ; 
address = if add then (R[n] + imm32) else (R[n] - imm32); 
case esize of 


when 16 

MemA[address,2] = S[d]<15:0>; 
when 32 

MemA[address,4] = S[d]; 
when 64 


// Store as two word-aligned words in the correct order for current endianness. 
MemA[address,4] = if BigEndian() then D[d]<63:32> else D[d]<31:0>; 
MemA[address+4,4] = if BigEndian() then D[d]<31:0> else D[d]<63:32>; 
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F6.1.237 VSUB (floating-point) 


ARM DDI 0487E.a 
ID070919 


Vector Subtract (floating-point) subtracts the elements of one vector from the corresponding elements of another 
vector, and places the results in the destination vector. 


Depending on settings in the CPACR, NSACR, HCPTR, and FPEXC registers, and the Security state and PE mode 
in which the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp 
mode. For more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4|3 0 | 


17100 tfofo[p]ife] va | va_[1 10 1[NJQ|Mpo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VSUB{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VSUB{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
advsimd = TRUE; 
case sz of 
when 'Q' esize = 32; elements 
when '1' esize = 16; elements 
d = UInt(D:Vd); n = UInt(N:Vn); m 


2; 
4; 
= UInt(M:Vm); regs = if Q == 'Q@' then 1 else 2; 


A2 
|31 28|27 26 25 24|23 22 21 20|19 16115 12/1110 9 8|7 6 5 4/3 0| 
Cem [i171 oop 1] va | va [i ojs No] v 


cond 


Half-precision scalar variant 
Applies when size == 01. 
VSUB{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 
Single-precision scalar variant 


Applies when size == 10. 


VSUB{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 
Applies when size == 11. 


VSUB{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 
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Decode for all variants of this encoding 


if FPSCR.Len != '000' || FPSCR.Stride != 'Q0' then UNDEFINED; 

if size == '00' || (size == '@1' && !HaveFP16Ext()) then UNDEFINED; 

if size == '01' && cond != '1110' then UNPREDICTABLE; 

advsimd = FALSE; 

case size of 
when '01' esize = 16; d 
when '10' esize = 32; d 
when '11' esize = 64; d 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


CONSTRAINED UNPREDICTABLE behavior 

If size == 'Q1' && cond != '1110', then one of the following behaviors must occur: 
$ The instruction is UNDEFINED. 

è The instruction executes as if it passes the Condition code check. 


. The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


T1 


[15 14 1312/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


aaao ophi v | va a onoo vm _| 


64-bit SIMD vector variant 
Applies when Q == 0. 


VSUB{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VSUB{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if sz == '1' && !HaveFP16Ext() then UNDEFINED; 
if sz == '1' && InITBlock() then UNPREDICTABLE; 
advsimd = TRUE; 
case sz of 
when 'Q' esize 
when '1' esize 
d = UInt(D:Vd); n 


32; elements 
16; elements 
UInt(N:Vn); m 


2; 
4; 


UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


CONSTRAINED UNPREDICTABLE behavior 


If sz == '1' && InITBlock(), then one of the following behaviors must occur: 
. The instruction is UNDEFINED. 
: The instruction executes as if it passes the Condition code check. 
° The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 
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|15 14 13 12|11109 8|7 6 5 4|3 0 |15 12/1109 8|7 6 5 4|3 0 | 


Tit 0717 0/011] va | va [i 0[sze[N[i[w[o[ vm _| 


Half-precision scalar variant 


Applies when size == 01. 


VSUB{<c>}{<q>}.F16 {<Sd>,} <Sn>, <Sm> 


Single-precision scalar variant 


Applies when size == 10. 


VSUB{<c>}{<q>}.F32 {<Sd>,} <Sn>, <Sm> 


Double-precision scalar variant 


Applies when size == 11. 


VSUB{<c>}{<q>}.F64 {<Dd>,} <Dn>, <Dm> 


Decode for all variants of this encoding 


if FPSCR.Len != 'Q00' || FPSCR.Stride != '@@' then UNDEFINED; 


if size 
if size 


== 'Q0' || (size == 'Q1' && !HaveFP16Ext()) then UNDEFINED; 
== 'Q1' && InITBlock() then UNPREDICTABLE; 


advsimd = FALSE; 
case size of 


when 'Q1' esize = 16; d 
when '10' esize = 32; d 
when '11' esize 


UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(Vd:D); n = UInt(Vn:N); m = UInt(Vm:M); 
UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


64; d 


CONSTRAINED UNPREDICTABLE behavior 


If size == 'Q1' && InITBlock(), then one of the following behaviors must occur: 


The instruction is UNDEFINED. 
The instruction executes as if it passes the Condition code check. 


The instruction executes as NOP. This means it behaves as if it fails the Condition code check. 


Assembler symbols 


<C> 


<q> 


<dt> 


<Qd> 


<Qn> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding A2, T1 and T2: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 


Is the data type for the elements of the vectors, encoded in the "sz" field. It can have the following 


values: 
F32 when sz = 0 
F16 when sz = 1 


Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 


Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
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F6-5436 


<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 

<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N: Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 
<Sd> Is the 32-bit name of the SIMD&FP destination register, encoded in the "Vd:D" field. 

<Sn> Is the 32-bit name of the first SIMD&FP source register, encoded in the "Vn:N" field. 

<Sm> Is the 32-bit name of the second SIMD&FP source register, encoded in the "Vm:M" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDOrVFPEnabled(TRUE, advsimd) ; 
if advsimd then // Advanced SIMD instruction 
for r = 0 to regs-1 
for e = 0 to elements-1 
Elem[D[d+r],e,esize] = FPSub(Elem[D[n+r],e,esize], Elem[D[m+r],e,esize], 
StandardFPSCRValue()); 


else // NFP instruction 
case esize of 

when 16 
S[d] = Zeros(16) : FPSub(S[n]<15:0>, S[m]<15:0>, FPSCR); 

when 32 
S[d] = FPSub(S[n], S[m], FPSCR); 

when 64 
D[d] = FPSub(D[n], D[m], FPSCR); 
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F6.1.238 | VSUB (integer) 


ARM DDI 0487E.a 
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Vector Subtract (integer) subtracts the elements of one vector from the corresponding elements of another vector, 
and places the results in the destination vector. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1109 8|7 6 5 4/3 0 | 


77100 1[i[o[lsze[ va | va_[1 00 o[Nja|Mjo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VSUB{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VSUB{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<ð> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0| 


oaae opse] vw | va [joo o[Nja|Mjo] wm | 


64-bit SIMD vector variant 
Applies when Q == 0. 
VSUB{<c>}{<q>}.<dt> {<Dd>, }<Dn>, <Dm> 
128-bit SIMD vector variant 
Applies when Q == 1. 
VSUB{<c>}{<q>}.<dt> {<Qd>, }<Qn>, <Qm> 
Decode for all variants of this encoding 
if Q == '1' && (Vd<0> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
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F6-5438 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
I8 when size = 00 
116 when size = 01 
132 when size = 10 
164 when size = 11 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
for e = Q to elements-1 
Elem[D[d+r],e,esize] = Elem[D[n+r],e,esize] - Elem[D[m+r],e,esize]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.239 VSUBHN 


ARM DDI 0487E.a 
ID070919 


Vector Subtract and Narrow, returning High Half subtracts the elements of one quadword vector from the 
corresponding elements of another quadword vector, takes the most significant half of each result, and places the 
final results in a doubleword vector. The results are truncated. For rounded results, see VRSUBHN. 


There is no distinction between signed and unsigned integers. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 16|15 12\11109 8|7 6 5 4|3 0| 
Darno onipo] va | va [o1 0[Njo[M[o] wm 
size 
A1 variant 


VSUBHN{<c>}{<q>}.<dt> <Dd>, <Qn>, <Qm> 


Decode for this encoding 
if size == '11' then SEE "Related encodings"; 
if Vn<@> == '1' || Vm<0> == '1' then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12\11109 8|7 6 5 4/3 0 | 


aaao oen] va | va fonr onoo] vm _| 


size 


T1 variant 


VSUBHN{<c>}{<q>}.<dt> <Dd>, <Qn>, <Qm> 


Decode for this encoding 

if size == '11' then SEE "Related encodings"; 

if Vn<@> == '1' || Vm<@> == '1' then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
Notes for all encodings 


Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 
Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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F6-5440 


<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 
116 when size = 00 
132 when size = 01 
164 when size = 10 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for e = 0 to elements-1 
result = Elem[Qin[n>>1],e,2sesize] - Elem[Qin[m>>1],e,2«esize]; 
Elem[D[d],e,esize] = result<2esize-1:esize>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


e The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.240 VSUBL 


ARM DDI 0487E.a 
ID070919 


Vector Subtract Long subtracts the elements of one doubleword vector from the corresponding elements of another 
doubleword vector, and places the results in a quadword vector. Before subtracting, it sign-extends or zero-extends 
the elements of both operands. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


11100 1jujijojsn]| vn | va joo 1fojNjojmjo} vm | 


size op 


A1 variant 


VSUBL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' || (op == '1' && Vn<@> == '1') then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; is_vsubw = (op == '1'); 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





size op 


T1 variant 


VSUBL{<c>}{<q>}.<dt> <Qd>, <Dn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' || (op == '1' && Vn<@> == '1') then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; is_vsubw = (op == '1'); 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 
Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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F6-5442 


<dt> Is the data type for the elements of the second operand vector, encoded in the "U:size" field. It can 
have the following values: 


S8 when U = 0, size = 00 

S16 when U = @, size = 01 

$32 when U = 0, size = 10 

U8 when U = 1, size = 00 

U16 when U = 1, size = 01 

U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
for e = Q to elements-1 


if is_vsubw then 
opl = Int(Elem[Qin[n>>1],e,2*esize], unsigned); 


else 


op1 = Int(Elem[Din[n],e,esize], unsigned); 
result = opl - Int(Elem[Din[m],e,esize], unsigned); 


Elem[Q[d>>1],e,2xesize] 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


© The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


CheckAdvSIMDEnabled(); 


result<2*esize-1:0>; 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.241 VSUBW 


ARM DDI 0487E.a 
ID070919 


Vector Subtract Wide subtracts the elements of a doubleword vector from the corresponding elements of a quadword 
vector, and places the results in another quadword vector. Before subtracting, it sign-extends or zero-extends the 
elements of the doubleword operand. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


111100 1ļjujijo]=en| vn | va [o o 1f4|Nfo[mjo] vm | 
op 


size 


A1 variant 


VSUBW{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' || (op == '1' && Vn<@> == '1') then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; is_vsubw = (op == '1'); 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 





size op 


T1 variant 


VSUBW{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Dm> 


Decode for this encoding 


if size == '11' then SEE "Related encodings"; 

if Vd<@> == '1' || (op == '1' && Vn<@> == '1') then UNDEFINED; 

unsigned = (U == '1'); 

esize = 8 << UInt(size); elements = 64 DIV esize; is_vsubw = (op == '1'); 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 


Notes for all encodings 
Related encodings: See Advanced SIMD data-processing on page F3-3962 for the T32 instruction set, or Advanced 
SIMD data-processing on page F4-4049 for the A32 instruction set. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
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F6-5444 


<dt> Is the data type for the elements of the second operand vector, encoded in the "U:size" field. It can 
have the following values: 


S8 when U = 0, size = 00 

S16 when U = @, size = 01 

$32 when U = 0, size = 10 

U8 when U = 1, size = 00 

U16 when U = 1, size = 01 

U32 when U = 1, size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); 
for e = Q to elements-1 


if is_vsubw then 
opl = Int(Elem[Qin[n>>1],e,2*esize], unsigned); 


else 


op1 = Int(Elem[Din[n],e,esize], unsigned); 
result = opl - Int(Elem[Din[m],e,esize], unsigned); 


Elem[Q[d>>1],e,2xesize] 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


© The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 


CheckAdvSIMDEnabled(); 


result<2*esize-1:0>; 


— The values of the NZCV flags. 


. The response of this instruction to asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


T32 and A32 Advanced SIMD and Floating-point Instruction Descriptions 
F6.1 Alphabetical list of Advanced SIMD and floating-point instructions 


F6.1.242 VSWP 


ARM DDI 0487E.a 
ID070919 


Vector Swap exchanges the contents of two vectors. The vectors can be either doubleword or quadword. There is 
no distinction between data types. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 
|31 30 29 28/27 26 25 24|23 22 21 20|19 18 17 16|15 12|1110 9 8|7 6 5 4/3 o| 
111100111 ioo o] va Jojo oo ojamo] vwm | 


size 


64-bit SIMD vector variant 
Applies when Q == 0. 


VSWP{<c>}{<q>}{.<dt>} <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VSWP{<c>}{<q>}{.<dt>} <Qd>, <Qm> 


Decode for all variants of this encoding 


if size != '00' then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 
|15 14 13 12|1110 9 8|7 6 5 4/3 2 1 0\15 12/1109 8|7 6 5 4|3 0 | 
Tiitti117 ph to o]7 o) ve [ojo oo oja] vm | 


size 


64-bit SIMD vector variant 

Applies when Q == 0. 

VSWP{<c>}{<q>}{.<dt>} <Dd>, <Dm> 

128-bit SIMD vector variant 

Applies when Q == 1. 

VSWP{<c>}{<q>}{.<dt>} <Qd>, <Qm> 

Decode for all variants of this encoding 
if size != '00' then UNDEFINED; 


if Q == '1' && (Vd<O> == '1' || Vm<ð> == '1') then UNDEFINED; 
d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 
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F6-5446 


<q> 

<dt> 
<Qd> 
<Qm> 
<Dd> 


<Dm> 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 

See Standard assembler syntax fields on page F2-3908. 

An optional data type. It is ignored by assemblers, and does not affect the encoding. 

Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 

Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 


EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = 0 to regs-1 
if d == m then 


D[d+r] = bits(64) UNKNOWN; 


else 


D[{d+r] = Din[m+r]; 
D[m+r] = Din[d+r]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


The execution time of this instruction is independent of: 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 


The response of this instruction to asynchronous exceptions does not vary based on: 


The values of the data supplied in any of its registers. 
The values of the NZCV flags. 
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F6.1.243 VTBL, VTBX 


ARM DDI 0487E.a 
ID070919 


Vector Table Lookup uses byte indexes in a control vector to look up byte values in a table and generate a new 
vector. Indexes out of range return 0. 


Vector Table Extension works in the same way, except that indexes out of range leave the destination element 
unchanged. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


Ti77 0077 70[1 7] vo | va [i often [NM o vm | 


VTBL variant 

Applies when op == 0. 

VIBL{<c>}{<q>}.8 <Dd>, <list>, <Dm> 

VTBX variant 

Applies when op == 1. 

VIBX{<c>}{<q>}.8 <Dd>, <list>, <Dm> 

Decode for all variants of this encoding 
is_vtb] = (op == '0'); length = UInt(len)+1; 


d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
if n+length > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn + length > 32, then one of the following behaviors must occur: 


à The instruction is UNDEFINED. 
$ The instruction executes as NOP. 
° One or more of the SIMD and floating-point registers are UNKNOWN. This behavior does not affect any 


general-purpose registers. 
T1 


[15 14 13 121110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4/3 0 | 


Tittiti7 aoa] ve | va [1 often [nfo] vm _| 


VTBL variant 
Applies when op == 0. 


VIBL{<c>}{<q>}.8 <Dd>, <list>, <Dm> 
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F6-5448 


VTBX variant 


Applies when op == 1. 


VIBX{<c>}{<q>}.8 <Dd>, <list>, <Dm> 


Decode for all variants of this encoding 


is_vtb] = (op == '0'); length = UInt(len)+1; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); 
if n+length > 32 then UNPREDICTABLE; 


CONSTRAINED UNPREDICTABLE behavior 


Ifn + length > 32, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
: The instruction executes as NOP. 
. One or more of the SIMD and floating-point registers are UNKNOWN. This behavior does not affect any 


general-purpose registers. 


Notes for all encodings 


For more information about the CONSTRAINED UNPREDICTABLE behavior of this instruction, see Appendix K1 
Architectural Constraints on UNPREDICTABLE behaviors. 


Assembler symbols 


<C> 


<q> 


<Dd> 


<list> 


<Dm> 


For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
See Standard assembler syntax fields on page F2-3908. 
Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 


The vectors containing the table. It must be one of: 
{<Dn>} Encoded as len = 0b00. 

{<Dn>, <Dn+1>}Encoded as len = @b01. 

{<Dn>, <Dn+1>, <Dn+2>}Encoded as len = 0b10. 

{<Dn>, <Dn+1>, <Dn+2>, <Dn+3>}Encoded as len = 0b11. 


Is the 64-bit name of the SIMD&FP source register holding the indices, encoded in the "M:Vm" 
field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 


// Create 256-bit = 32-byte table variable, with zeros in entries that will not be used. 


table3 
table2 
tablel 


if length == 4 then D[n+3] else Zeros(64); 
if length >= 3 then D[n+2] else Zeros(64); 
if length >= 2 then D[n+1] else Zeros(64); 


table = table3 : table2 : tablel : D[n]; 


fori =Q@to7 
index = UInt(Elem[D[m] ,i,8]); 
if index < 8*length then 


Elem[D[d],i,8] = Elem[table, index, 8]; 
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else 
if is_vtbl then 
Elem[D[d],i1,8] = Zeros(8); 
// else Elem[D[d],i,8] unchanged 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


© The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 


` The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.244 


F6-5450 


VTRN 


Vector Transpose treats the elements of its operand vectors as elements of 2 x 2 matrices, and transposes the 
matrices. 


The elements of the vectors can be 8-bit, 16-bit, or 32-bit. There is no distinction between data types. 


The following figure shows the operation of VTRN doubleword operations. 
VTRN.32 VTRN.16 VTRN.8 


1 0 3 2 1 0 7 6 5 43 2 1 «0 
Dd Dd Dd 
Dm Dm Dm 
Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 


the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


This instruction is used by the pseudo-instructions VUZP (alias) and VZIP (alias). The pseudo-instruction is never 
the preferred disassembly. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 1615 12/1110 9 8|7 6 5 4|3 0| 


14111001 1 1joj1 t}sze[1 of va [ojo o o 1jajmjo] vwm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VIRN{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VIRN{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


T1 


15 14 13 1211110 9 8|7 6 5 4/3 2 1 0|15 12/1110 9 8|7 6 5 4|3 0| 


maiaa iit ajoji ifsize[1 of va fojo o o 1jajmjo] vm | 
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64-bit SIMD vector variant 
Applies when Q == 0. 


VIRN{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VIRN{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); m = UInt(M:Vm); regs = if Q == 'Q' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<dt> Is the data type for the elements of the vectors, encoded in the "size" field. It can have the following 
values: 
8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
h = elements DIV 2; 


for r = ð to regs-1 
if d == m then 
D[d+r] = bits(64) UNKNOWN; 
else 
for e = @ to h-1 
Elem[D[d+r] ,2*e+1,esize] = Elem[Din[m+r],2se,esize]; 
Elem[D[m+r] ,2*e,esize] = Elem[Din[d+r] ,2xe+1,esize]; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


s The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
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— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.245 VTST 


Vector Test Bits takes each element in a vector, and bitwise ANDs it with the corresponding element of a second 
vector. If the result is not zero, the corresponding element in the destination vector is set to all ones. Otherwise, it is 
set to all zeros. 


The operand vector elements can be any one of: 
° 8-bit, 16-bit, or 32-bit fields. 
The result vector elements are fields the same size as the operand vector elements. 


Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


|31 30 29 28|27 26 25 24|23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


717100 t[o[o[plsze[ va | va [ooon vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VTST{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VTST{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Qm> 


Decode for all variants of this encoding 
if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
if size == '11' then UNDEFINED; 


esize = 8 << UInt(size); elements = 64 DIV esize; 
d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 


7 apolt 777 opse] vw | va [ooon vm | 


64-bit SIMD vector variant 

Applies when Q == 0. 
VTST{<c>}{<q>}.<dt> {<Dd>,} <Dn>, <Dm> 
128-bit SIMD vector variant 

Applies when Q == 1. 


VTIST{<c>}{<q>}.<dt> {<Qd>,} <Qn>, <Qm> 
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Decode for all variants of this encoding 


if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 

if size == '11' then UNDEFINED; 

esize = 8 << UInt(size); elements = 64 DIV esize; 

d = UInt(D:Vd); n = UInt(N:Vn); m = UInt(M:Vm); regs = if Q == '@' then 1 else 2; 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 
unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 
<q> See Standard assembler syntax fields on page F2-3908. 


<dt> Is the data type for the elements of the operands, encoded in the "size" field. It can have the 
following values: 


8 when size = 00 
16 when size = 01 
32 when size = 10 
<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Qm> Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 
<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
for r = @ to regs-1 
for e = Q to elements-1 
if !IsZero(Elem[D[n+r],e,esize] AND Elem[D[m+r],e,esize]) then 
Elem[D[d+r],e,esize] = Ones(esize); 
else 
Elem[D[d+r],e,esize] = Zeros(esize) 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.246  VUDOT (by element) 


Dot Product index form with unsigned integers. This instruction performs the dot product of the four 8-bit elements 
in each 32-bit element of the first source register with the four 8-bit elements of an indexed 32-bit element in the 
second source register, accumulating the result into the corresponding 32-bit element of the destination register. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 
to support it. 


Note 
ID_ISAR6.DP indicates whether this instruction is supported. 








A1 
ARMVv8.2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1110 9 8|7 6 5 4|3 0 | 


1111111 ofofoft of vn | va [ijlijlojliinjajmji] vm | 
U 


64-bit SIMD vector variant 
Applies when Q == 0. 


VUDOT{<q>}.U8 <Dd>, <Dn>, <Dm>[<index>] 


128-bit SIMD vector variant 
Applies when Q == 1. 


VUDOT{<q>}.U8 <Qd>, <Qn>, <Dm>[<index>] 


Decode for all variants of this encoding 


if !HaveDOTPExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 
boolean signed = (U=='0'); 

integer d = UInt(D:Vd); 

integer n = UInt(N:Vn); 

integer m = UInt(Vm<3:0>); 

integer index = UInt(M); 

integer esize = 32; 

integer regs = if Q == '1' then 2 else 1; 


T1 
ARMV8.2 


|15 14 13 12|11 10 9 8|7 6 5 4|3 0 |15 12/1110 9 8|7 6 5 4|3 0 | 





64-bit SIMD vector variant 
Applies when Q == 0. 


VUDOT{<q>}.U8 <Dd>, <Dn>, <Dm>[<index>] 
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F6-5456 


128-bit SIMD vector variant 


Applies when Q == 1. 


VUDOT{<q>}.U8 <Qd>, <Qn>, <Dm>[<index>] 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveDOTPExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1') then UNDEFINED; 
boolean signed = (U=='0'); 

integer d = UInt(D:Vd); 

integer n = UInt(N:Vn); 

integer m = UInt(Vm<3:0>); 

integer index = UInt(M); 

integer esize = 32; 

integer regs = if Q == '1' then 2 else 1; 


Assembler symbols 


<q> See Standard assembler syntax fields on page F2-3908. 

<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qn> Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dn> Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 

<Dm> Is the 64-bit name of the second SIMD&FP source register, encoded in the "Vm" field. 

<index> Is the element index in the range 0 to 1, encoded in the "M" field. 


Operation for all encodings 


bits(64) operand; 
bits(64) operand2 = D[m]; 
bits(64) result; 
CheckAdvSIMDEnabled(); 


for 


r = @ to regs-1 
operand1 = D[n+r]; 
result = D[d+r] 
integer element1, element2; 
fore=Qtol 
integer res = 0; 
for i = Q to 3 
if signed then 
element1 = SInt(Elem[operandl, 4 » e + i, esize DIV 4]); 
element2 = SInt(Elem[operand2, 4 » index + i, esize DIV 4]); 
else 
element1 = UInt(Elem[operandl, 4 » e + i, esize DIV 4]); 
element2 = UInt(Elem[operand2, 4 » index + i, esize DIV 4]); 
res = res + elementl « element2; 
Elem[result, e, esize] = Elem[result, e, esize] + res; 
D[d+r] = result; 
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F6.1.247 VUDOT (vector) 


ARM DDI 0487E.a 
ID070919 


Dot Product vector form with unsigned integers. This instruction performs the dot product of the four 8-bit elements 
in each 32-bit element of the first source register with the four 8-bit elements of the corresponding 32-bit element 
in the second source register, accumulating the result into the corresponding 32-bit element of the destination 


register. 


In Armv8.2 and Armv8.3, this is an OPTIONAL instruction. From Armv8.4 it is mandatory for all implementations 


to support it. 





Note 
ID_ISAR6.DP indicates whether this instruction is supported. 





A1 
ARMV8.2 


|31 30 29 28|27 26 25 24/23 22 21 20|19 16/15 12/1109 8|7 6 5 4/3 0 | 


1141717 ofo ojoj of vn | va [tfifofi{njafm]1] vm | 
U 


64-bit SIMD vector variant 
Applies when Q == 0. 


VUDOT{<q>}.U8 <Dd>, <Dn>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VUDOT{<q>}.U8 <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if !HaveDOTPExt() then UNDEFINED; 

if Q == '1' && (Vd<@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
boolean signed = U=='0'; 

integer d = UInt(D:Vd); 

integer n = UInt(N:Vn); 

integer m = UInt(M:Vm); 

integer esize = 32; 


integer regs = if Q == '1' then 2 else 1; 

T1 

ARMvV8.2 

|15 14 13 12|11 10 9 8|7 6 5 4/3 0 |15 12|11 10 9 8/7 6 5 4/3 0 | 





64-bit SIMD vector variant 
Applies when Q == 0. 


VUDOT{<q>}.U8 <Dd>, <Dn>, <Dm> 
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F6-5458 


128-bit SIMD vector variant 


Applies when Q == 1. 


VUDOT{<q>}.U8 <Qd>, <Qn>, <Qm> 


Decode for all variants of this encoding 


if InITBlock() then UNPREDICTABLE; 

if !HaveDOTPExt() then UNDEFINED; 

if Q == '1' && (Vd<O@> == '1' || Vn<@> == '1' || Vm<@> == '1') then UNDEFINED; 
boolean signed = U=='0'; 

integer d = UInt(D:Vd); 

integer n = UInt(N:Vn); 

integer m = UInt(M:Vm); 

integer esize = 32; 

integer regs = if Q == '1' then 2 else 1; 


Assembler symbols 


<q> 
<Qd> 
<Qn> 


<Qm> 


<Dd> 
<Dn> 


<Dm> 


See Standard assembler syntax fields on page F2-3908. 
Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
Is the 128-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field as <Qn>*2. 


Is the 128-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field as 
<Qm>*2. 


Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
Is the 64-bit name of the first SIMD&FP source register, encoded in the "N:Vn" field. 


Is the 64-bit name of the second SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


bits(64) operand1; 
bits(64) operand2; 
bits(64) result; 
CheckAdvSIMDEnabled(); 


for 


r = @ to regs-1 
operand1 = D[n+r]; 
operand2 = D[m+r]; 
result = D[d+r] 
integer element1, element2; 
fore=Qtol 
integer res = 0; 
for i = Q to 3 
if signed then 
element1 = SInt(Elem[operandl, 4 » e + i, esize DIV 4]); 
element2 = SInt(Elem[operand2, 4 » e + i, esize DIV 4]); 
else 
element1 = UInt(Elem[operandl, 4 » e + i, esize DIV 4]); 
element2 = UInt(Elem[operand2, 4 » e + i, esize DIV 4]); 
res = res + elementl « element2; 
Elem[result, e, esize] = Elem[result, e, esize] + res; 
D[d+r] = result; 
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F6.1.248 VUZP 


ARM DDI 0487E.a 
ID070919 


Vector Unzip de-interleaves the elements of two vectors. 
The elements of the vectors can be 8-bit, 16-bit, or 32-bit. There is no distinction between data types. 


The following figure shows the operation of VUZP doubleword operation for data type 8. 
VUZP.8, doubleword 





Register state before operation Register state after operation 








The following figure shows the operation of VUZP quadword operation for data type 32. 


VUZP.32, quadword 
Rees state before operaren Register state after operation 








Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 16|15 12/1110 9 8|7 6 5 4|3 0| 


11110011 1p isej of va Jojo o1 ojomo] vwm | 


64-bit SIMD vector variant 
Applies when Q == 


VUZP{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 


VUZP{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' || (Q == '0' && size == '10') then UNDEFINED; 
if Q == '1' && (Vd<0> == '1' || Vm<@> == '1') then UNDEFINED; 
quadword_operation = (Q == '1'); esize = 8 << UInt(size); 

d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 121110 9 8|7 6 5 4|3 0| 


iit raap isej of va Jojo or ojojmo] vwm | 


64-bit SIMD vector variant 
Applies when Q == 


VUZP{<c>}{<q>}.<dt> <Dd>, <Dm> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VUZP{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' || (Q == '@' && size == '10') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
quadword_operation = (Q == '1'); esize = 8 << UInt(size); 

d = UInt(D:Vd); m = UInt(M:Vm); 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> For the 64-bit SIMD vector variant: is the data type for the elements of the vectors, encoded in the 
"size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 


The encoding size = 1x is reserved. 


For the 128-bit SIMD vector variant: is the data type for the elements of the vectors, encoded in the 


"size" field. It can have the following values: 


8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
if quadword_operation then 
if d == m then 
Q[d>>1] = bits(128) UNKNOWN; Q[m>>1] = bits(128) UNKNOWN; 
else 
Zipped_q = Q[m>>1]:Q[d>>1]; 
for e = 0 to (128 DIV esize) - 1 
Elem[Q[d>>1],e,esize] = Elem[zipped_q,2e,esize]; 
Elem[Q[m>>1],e,esize] = Elem[zipped_q,2*e+1,esize]; 
else 
if d == m then 
D[d] = bits(64) UNKNOWN; D[m] = bits(64) UNKNOWN; 
else 
Zipped_d = D[m]:D[d]; 
for e = 0 to (64 DIV esize) - 1 
Elem[D[d],e,esize] = Elem[zipped_d,2e,esize]; 
Elem[D[m],e,esize] = Elem[zipped_d,2se+1,esize]; 
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Operational information 
If CPSR.DIT is 1 and this instruction passes its condition execution check: 
° The execution time of this instruction is independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


° The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 
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F6.1.249 


F6-5462 


VUZP (alias) 


Vector Unzip de-interleaves the elements of two vectors 


This instruction is a pseudo-instruction of the VTRN instruction. This means that: 


$ The encodings in this description are named to match the encodings of VTRN. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
$ The description of VTRN gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 1615 12/1110 9 8|7 6 5 4|3 0| 


11770077 1p isejo] va Jojo o oromo] vwm | 
Q 


64-bit SIMD vector variant 
VUZP{<c>}{<q>}.32 <Dd>, <Dm> 
is equivalent to 

VTRN{<c>}{<q>}.32 <Dd>, <Dm> 


and is never the preferred disassembly. 
T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


Titti1117 10] jsej o] va Jojo o oromo] wm | 
Q 


64-bit SIMD vector variant 
VUZP{<c>}{<q>}.32 <Dd>, <Dm> 
is equivalent to 

VTRN{<c>}{<q>}.32 <Dd>, <Dm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


The description of VTRN gives the operational pseudocode for this instruction. 
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Vector Zip interleaves the elements of two vectors. 
The elements of the vectors can be 8-bit, 16-bit, or 32-bit. There is no distinction between data types. 


The following figure shows the operation of VZIP doubleword operation for data type 8. 
VZIP.8, doubleword 





Register state before operation Register state after operation 








The following figure shows the operation of VZIP quadword operation for data type 32. 


VZIP.32, quadword 
Register state before operation Register state after operation 











Depending on settings in the CPACR, NSACR, and HCPTR registers, and the Security state and PE mode in which 
the instruction is executed, an attempt to execute the instruction might be UNDEFINED, or trapped to Hyp mode. For 
more information see Enabling Advanced SIMD and floating-point support on page G1-5570. 


A1 


[31 30 29 28|27 26 25 24|23 22 21 20/19 18 17 16|15 12/1110 9 8|7 6 5 4/3 0 | 


Ti 770077 1)0][1 isejo] va Jojo oriomo] vm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VZIP{<c>}{<q>}.<dt> <Dd>, <Dm> 


128-bit SIMD vector variant 
Applies when Q == 1. 


VZIP{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' || (Q == '@' && size == '10') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
quadword_operation = (Q == '1'); esize = 8 << UInt(size); 

d = UInt(D:Vd); m = UInt(M:Vm); 


T1 


|15 14 13 12/1110 9 8|7 6 5 4|3 2 1 0ļ15 12/1109 8|7 6 5 4|3 0| 


77714177 p jsej o] va Jojo oriomo] vwm | 


64-bit SIMD vector variant 
Applies when Q == 0. 


VZIP{<c>}{<q>}.<dt> <Dd>, <Dm> 
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128-bit SIMD vector variant 
Applies when Q == 1. 


VZIP{<c>}{<q>}.<dt> <Qd>, <Qm> 


Decode for all variants of this encoding 


if size == '11' || (Q == '@' && size == '10') then UNDEFINED; 
if Q == '1' && (Vd<@> == '1' || Vm<@> == '1') then UNDEFINED; 
quadword_operation = (Q == '1'); esize = 8 << UInt(size); 

d = UInt(D:Vd); m = UInt(M:Vm); 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 

<dt> For the 64-bit SIMD vector variant: is the data type for the elements of the vectors, encoded in the 
"size" field. It can have the following values: 
8 when size = 00 
16 when size = 01 


The encoding size = 1x is reserved. 


For the 128-bit SIMD vector variant: is the data type for the elements of the vectors, encoded in the 


"size" field. It can have the following values: 


8 when size = 00 
16 when size = 01 
32 when size = 10 


The encoding size = 11 is reserved. 


<Qd> Is the 128-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field as <Qd>*2. 
<Qm> Is the 128-bit name of the SIMD&FP source register, encoded in the "M:Vm" field as <Qm>*2. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 

<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


if ConditionPassed() then 
EncodingSpecificOperations(); CheckAdvSIMDEnabled(); 
if quadword_operation then 
if d == m then 
Q[d>>1] = bits(128) UNKNOWN; Q[m>>1] = bits(128) UNKNOWN; 
else 
bits(256) zipped_q; 
for e = 0 to (128 DIV esize) - 1 
Elem[zipped_q,2xe,esize] = Elem[Q[d>>1],e,esize]; 
Elem[zipped_q,2*e+1,esize] = Elem[Q[m>>1],e,esize]; 
Q[{d>>1] = zipped_q<127:0>; Q[m>>1] = zipped_q<255:128>; 
else 
if d == m then 
D[d] = bits(64) UNKNOWN; D[m] = bits(64) UNKNOWN; 
else 
bits(128) zipped_d; 
for e = 0 to (64 DIV esize) - 1 
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Elem[zipped_d,2*e,esize] = 
Elem[zipped_d, 2*e+1,esize] 
D[d] = zipped_d<63:@>; D[m] = 


Elem[D[d],e,esize]; 
= Elem[D[m],e,esize]; 
Zipped_d<127:64>; 


Operational information 


If CPSR.DIT is 1 and this instruction passes its condition execution check: 


° The execution time of this instruction is independent of: 
— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


i The response of this instruction to asynchronous exceptions does not vary based on: 
— The values of the data supplied in any of its registers. 


— The values of the NZCV flags. 
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F6.1.251 


F6-5466 


VZIP (alias) 


Vector Zip interleaves the elements of two vectors 


This instruction is a pseudo-instruction of the VTRN instruction. This means that: 


$ The encodings in this description are named to match the encodings of VTRN. 
. The assembler syntax is used only for assembly, and is not used on disassembly. 
$ The description of VTRN gives the operational pseudocode for this instruction. 
A1 
|31 30 29 28|27 26 25 24|23 22 21 20|19 18 17 1615 12/1110 9 8|7 6 5 4|3 0| 


11770077 1p isejo] va Jojo o oromo] vwm | 
Q 


64-bit SIMD vector variant 
VZIP{<c>}{<q>}.32 <Dd>, <Dm> 
is equivalent to 

VTRN{<c>}{<q>}.32 <Dd>, <Dm> 


and is never the preferred disassembly. 
T1 


|15 14 13 1211110 9 8|7 6 5 4/3 2 1 0115 12/1110 9 8|7 6 5 4|3 0| 


Titti1117 10] jsej o] va Jojo o oromo] wm | 
Q 


64-bit SIMD vector variant 
VZIP{<c>}{<q>}.32 <Dd>, <Dm> 
is equivalent to 

VTRN{<c>}{<q>}.32 <Dd>, <Dm> 


and is never the preferred disassembly. 


Assembler symbols 


<c> For encoding A1: see Standard assembler syntax fields on page F2-3908. This encoding must be 


unconditional. 


For encoding T1: see Standard assembler syntax fields on page F2-3908. 


<q> See Standard assembler syntax fields on page F2-3908. 
<Dd> Is the 64-bit name of the SIMD&FP destination register, encoded in the "D:Vd" field. 
<Dm> Is the 64-bit name of the SIMD&FP source register, encoded in the "M:Vm" field. 


Operation for all encodings 


The description of VTRN gives the operational pseudocode for this instruction. 
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This chapter gives a system level description of the programmers’ model for execution in AArch32 state. It contains 
the following sections: 


About the AArch32 System level programmers’ model on page G1-5470. 

Exception levels on page G1-5471. 

Exception terminology on page G1-5472. 

Execution state on page G1-5474. 

Instruction Set state on page G1-5476. 

Security state on page G1-5477. 

Security state, Exception levels, and AArch32 execution privilege on page G1-5480. 
Virtualization on page G1-5482. 


AArch32 state PE modes, and general-purpose and Special-purpose registers on page G1-5484. 


Process state, PSTATE on page G1-5493. 

Instruction set states on page G1-5499. 

Handling exceptions that are taken to an Exception level using AArch32 on page G1-5501. 
Routing of aborts taken to AArch32 state on page G1-5520. 

Exception return to an Exception level using AArch32 on page G1-5523. 

Asynchronous exception behavior for exceptions taken from AArch32 state on page G1-5528. 
AArch32 state exception descriptions on page G1-5536. 

Reset into AArch32 state on page G1-5558. 

Mechanisms for entering a low-power state on page G1-5562. 

The AArch32 System register interface on page G1-5567. 

Advanced SIMD and floating-point support on page G1-5570. 

Configurable instruction enables and disables, and trap controls on page G1-5576. 
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G1.1 


G1-5470 


About the AArch32 System level programmers’ model 


An application programmer has only a restricted view of the system. The System level programmers’ model 
supports this application level view of the system, and includes features that are required for one or both of an 
operating system (OS) and a hypervisor to provide the programming environment seen by an application. This 
chapter describes the System level programmers’ model when executing at EL1 or higher in an Exception level that 
is using AArch32. 


The system level programmers’ model includes all of the system features required to support operating systems and 
to handle hardware events. 


The following sections give a system level introduction to the basic concepts of the Arm architecture AArch32 state, 
and the terminology that is used for describing the architecture when executing in this state: 


. Exception levels on page G1-5471. 

° Exception terminology on page G1-5472. 
° Execution state on page G1-5474. 

. Instruction Set state on page G1-5476. 

. Security state on page G1-5477. 

7 Virtualization on page G1-5482. 


The rest of this chapter describes the system level programmers’ model when executing in AArch32 state. 


The other chapters in this part describe: 


. The memory system architecture, as seen when executing in an Exception level that is using AArch32: 
— Chapter G4 The AArch32 System Level Memory Model describes the general features of the Armv8 
memory model, when executing in AArch32 state, that are not visible at the application level. 
Note 


Chapter E2 The AArch32 Application Level Memory Model describes the application level view of the 
memory model. 








— Chapter G5 The AArch32 Virtual Memory System Architecture describes the Virtual Memory System 
Architecture (VMSA) used in AArch32 state. 


$ The AArch32 System registers, see Chapter G8 AArch32 System Register Descriptions. 


Note 


The T32 and A32 instruction sets include instructions that provide system level functionality, such as returning from 
an exception. See for example, ERET on page F5-4195. 
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G1.2 Exception levels 


The Armv8-A architecture defines a set of Exception levels, ELO to EL3, where: 


. If ELn is the Exception level, increased values of n indicate increased software execution privilege. 
à Execution at ELO is called unprivileged execution. 

° EL2 provides support for virtualization. 

è EL3 provides support for switching between two Security states, Secure state and Non-secure state. 


An implementation might not include all of the Exception levels. All implementations must include ELO and EL1. 
EL2 and EL3 are optional. 


Note 


A PE is not required to implement a contiguous set of Exception levels. For example, it is permissible for an 
implementation to include only ELO, EL1, and EL3. 





The effect of implementation choices on the programmers’ model on page D1-2393 provides information on 
implementations. 


When executing in AArch32 state, execution can move between Exception levels only on taking an exception or on 
returning from an exception: 


s On taking an exception, the Exception level can only increase or remain the same. 


7 On returning from an exception, the Exception level can only decrease or remain the same. 


The Exception level that execution changes to or remains in on taking an exception is called the target Exception 
level of the exception. 


Each exception type has a target Exception level that is either: 
. Implicit in the nature of the exception. 
. Defined by configuration bits in the System registers. 


An exception cannot target ELO. 


Exception levels exist within Security states. The Armv8-A security model on page G1-5477 describes this. When 
executing at an Exception level, the PE can access both of the following: 


: The resources that are available for the combination of the current Exception level and the current Security 
state. 
° The resources that are available at all lower Exception levels, provided that those resources are available to 


the current Security state. 


This means that if the implementation includes EL3, then because EL3 is only implemented in Secure state, 
execution at EL3 can access all resources available at all Exception levels, for both Security states. 


Each Exception level other than ELO has its own translation regime and associated control registers. For information 
on the translation regimes, see Chapter G5 The AArch32 Virtual Memory System Architecture. 


G1.2.1 Typical Exception level usage model 
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The architecture does not specify what software uses which Exception level. Such choices are outside the scope of 
the architecture. However, the following is a common usage model for the Exception levels: 


ELO Applications. 
ELI OS kernel and associated functions that are typically described as privileged. 
EL2 Hypervisor. 
EL3 Secure monitor. 
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G1.3 


G1.3.1 


G1.3.2 


G1.3.3 


G1.3.4 


G1-5472 


Exception terminology 


The following subsections define the terms that are used when describing exceptions: 


s Terminology for taking an exception. 

. Terminology for returning from an exception. 

° Exception levels. 

. Definition of a precise exception. 

. Definitions of synchronous and asynchronous exceptions on page G1-5473. 


Terminology for taking an exception 


An exception is generated when the PE first responds to an exceptional condition. The PE state at this time is the 
state that the exception is taken from. The PE state immediately after taking the exception is the state that the 
exception is taken to. 


Terminology for returning from an exception 


To return from an exception, the PE must execute an exception return instruction. The PE state when an exception 
return instruction is committed for execution is the state the exception returns from. The PE state immediately after 
the execution of that instruction is the state that the exception returns to. 


Exception levels 


An Exception level, ELn, with a larger value of n than another Exception level, is described as being a higher 
Exception level than the other Exception level. For example, EL3 is a higher Exception level than EL1. 


An Exception level with a smaller value of n than another Exception level is described as being a lower Exception 
level than the other Exception level. For example, ELO is a lower Exception level than EL1. 


An Exception level is described as: 
s Using AArch64 when execution in that Exception level is in the AArch64 Execution state. 
° Using AArch32 when execution in that Exception level is in the AArch32 Execution state. 


Definition of a precise exception 


An exception is described as precise when the exception handler receives the PE state and memory system state that 
is consistent with the PE having executed all of the instructions up to but not including the point in the instruction 
stream where the exception was taken, and none afterwards. 


Other than the SError interrupt all exceptions that are taken to AArch32 state are required to be precise. For each 
occurrence of an SError interrupt, whether the interrupt is precise or imprecise is IMPLEMENTATION DEFINED. 


Where a synchronous exception that is taken to AArch32 state is generated as part of an instruction that performs 
more than one single-copy atomic memory access, the definition of precise permits that the values in registers or 
memory affected by those instructions can be UNKNOWN, provided that: 


° The accesses affecting those registers or memory locations do not, themselves, generate exceptions. 
è The registers are not involved in the calculation of the memory address that is used by the instruction. 


In AArch32 state, examples of instructions that perform more than one single-copy atomic memory access are the 
LDM and STM instructions. 





Note 
$ For the definition of a single-copy atomic access, see Properties of single-copy atomic accesses on 
page E2-3811. 
è The SError interrupt replaces the Armv7 asynchronous abort. 
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G1.3.5 Definitions of synchronous and asynchronous exceptions 
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An exception is described as synchronous if all of the following apply: 


. The exception is generated as a result of direct execution or attempted execution of an instruction. 

7 The return address presented to the exception handler is guaranteed to indicate the instruction that caused the 
exception. 

° The exception is precise. 


An exception is described as asynchronous if any of the following apply: 
° The exception is not generated as a result of direct execution or attempted execution of the instruction stream. 


à The return address presented to the exception handler is not guaranteed to indicate the instruction that caused 
the exception. 


è The exception is imprecise. 


For more information about exceptions, see Handling exceptions that are taken to an Exception level using AArch32 
on page G1-5501. 
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G1.4 Execution state 


The Execution states are: 
AArch64 The 64-bit Execution state. 
AArch32 The 32-bit Execution state. Operation in this state is compatible with Armv7-A operation. 


Execution state on page A1-38 gives more information about them. 


Exception levels use Execution states. For example, ELO, EL1 and EL2 might all be using AArch32, under EL3 
using AArch64. 


This means that: 


s Different software layers, such as an application, an operating system kernel, and a hypervisor, executing at 
different Exception levels, can execute in different Execution states. 

š The PE can change Execution states only either: 
—  Atreset. 
— Ona change of Exception level. 


Note 


° Typical Exception level usage model on page G1-5471 shows which Exception levels different software 
layers might typically use. 





. The effect of implementation choices on the programmers’ model on page D1-2393 gives information on 
supported configurations of Exception levels and Execution states. 





The interaction between the AArch64 and AArch32 Execution states is called interprocessing. Interprocessing on 
page D1-2380 describes this. 


G1.4.1 About the AArch32 PE modes 


G1-5474 


AArch32 state provides a set of PE modes that support normal software execution and handle exceptions. The 
current mode determines the set of registers that are available, as described in AArch32 general-purpose registers, 
the PC, and the Special-purpose registers on page G1-5489. 


The AArch32 modes are: 

g Monitor mode. This mode always executes at Secure EL3. 

° Hyp mode. This mode always executes at Non-secure EL2. 

. System, Supervisor, Abort, Undefined, IRQ, and FIQ modes. The Exception level these modes execute at 


depends on the Security state, as described in Security state on page G1-5477. 


° User mode. This mode always executes at ELO. 


Note 


AArch64 state does not support modes. Modes are a concept that is specific to AArch32 state. Modes that execute 
at a particular Exception level are only implemented if that Exception level supports using AArch32 state. 








For more information on modes, see AArch32 state PE mode descriptions on page G1-5484. 


The mode in use immediately before an exception is taken is described as the mode the exception is taken from. The 
mode that is used on taking the exception is described as the mode the exception is taken to. 


All of the following define the mode that an exception is taken to: 
g The type of exception. 

° The mode the exception is taken from. 

: Configuration settings defined at EL2 and EL3. 
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Monitor mode and Hyp mode can create system traps that cause exceptions to EL3 or EL2 respectively. There is an 
architected hierarchy where EL2 and EL3 configuration settings affect a common condition, for example interrupt 
routing. When no traps are enabled for a particular condition, the AArch32 mode an exception is taken to is called 
the default mode for that exception. 


In AArch32 state, a number of different modes can exist at the same Exception level. All modes at a particular 
Exception level have the execution privilege, meaning they have the same access rights for accesses to memory and 
to System registers. However, the mapping of PE modes to Exception levels depends on the Security state, as 
described in Security state on page G1-5477. Security state, Exception levels, and AArch32 execution privilege on 
page G1-5480 gives more information about the PE modes, their associated execution privilege, and how this maps 
onto the Exception levels. 
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G1.5 


G1-5476 


Instruction Set state 


In AArch32 state, the Instruction Set state determines the instruction set that the PE is executing. In an 


implementation that follows the Arm recommendations, the available Instruction Set states are: 


T32 state The PE is executing T32 instructions. 


A32 state The PE is executing A32 instructions. 





Note 
In previous versions of the Arm architecture: 
° The T32 instruction set was called the Thumb instruction set. 
° The A32 instruction set was called the ARM instruction set. 





For more information, see Process state, PSTATE on page E1-3787. 
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G1.6 Security state 


The Armv8-A architecture provides two Security states, each with an associated physical memory address space, 
as follows: 


Secure state When in this state, the PE can access both the Secure physical address space and the 
Non-secure physical address space. 


Non-secure state When in this state, the PE: 
. Can access only the Non-secure physical address space. 
: Cannot access the Secure system control resources. 


For information on how virtual addresses translate onto Secure physical and Non-secure addresses, see About 
VMSAv8-32 on page G5-5720. 


G1.6.1 The Armv8-A security model 
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The principles of the Armv8-A security model are defined in The Armv8-A security model on page D1-2272. 


The AArch32 security model, and execution privilege 


The Exception level hierarchy of four Exception levels, ELO, EL1, EL2, and EL3, applies to execution in both 
Execution states. This section describes the mapping between Exception levels, AArch32 modes, and execution 
privilege. 


The AArch32 modes Monitor, System, Supervisor, Abort, Undefined, IRQ, and FIQ all have the same execution 
privilege. 


In Secure state: 
à Monitor mode executes only at EL3, and is accessible only when EL3 is using AArch32. 


. System mode, Supervisor mode, Abort mode, Undefined mode, IRQ mode, and FIQ mode all: 
— Execute at EL1 when EL3 is using AArch64. 
— Execute at EL3 when EL3 is using AArch32. 


This means that there is a difference in the Secure state hierarchy that the PE is using, depending on which Execution 
state EL3 is using: 
è If EL3 is using AArch64: 
— There is no support for Monitor mode. 
— IfELl! is using AArch32, System mode, Supervisor mode, Abort mode, Undefined mode, IRQ mode, 
and FIQ mode execute at Secure EL]. 
è If EL3 is using AArch32: 
— Monitor mode is supported, and executes at Secure EL3. 


— System mode, Supervisor mode, Abort mode, Undefined mode, IRQ mode, and FIQ mode execute at 
Secure EL3. 


— There is no support for a Secure EL1 Exception level. 


See Security behavior in Exception levels using AArch32 when EL2 or EL3 are using AArch64 on page G1-5512 for 
more information about operation in a Secure EL1 mode when EL3 is using AArch64. 


In Non-secure state, the PL1 modes System, Supervisor, Abort, Undefined, IRQ, and FIQ always execute at EL1. 
User mode always executes at ELO and has the lowest possible execution privilege. 


Hyp mode always executes in Non-secure state at EL2 and has higher execution privilege than all of: 
° User mode. 
. System mode, Supervisor mode, Abort mode, Undefined mode, IRQ mode, and FIQ mode. 
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Limited use of Privilege level in Armv8 AArch32 state on page G1-5481 describes how, in some contexts, the 
concept of Privilege levels can be used to represent the execution privilege hierarchy. 


For more information about the modes, see About the AArch32 PE modes on page G1-5474. 


Figure G1-1 shows the security model when EL3 is using AArch32, and shows the expected use of the different 
Exception levels, and which modes execute at which Exception levels. 


Non-secure state Secure state 
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Figure G1-1 Armv8-A Security model when EL3 is using AArch32 
Note 
For an overview of the Security models when EL3 is using AArch64: 
° See Figure G1-2 on page G1-5487 for the case where EL2, EL1, and ELO are all using AArch32. This figure 
shows the implementation of the PE modes. 
° See Figure D1-1 on page D1-2273 for an overview of the set of possible implementations. 
Figure G1-1 shows that when EL3 is using AArch32, the Exception levels and modes available in each Security 
state are as follows: 
Secure state 
ELO User mode. 
EL3 Any mode that is available in Secure state, other than User mode. 
Non-secure state 
ELO User mode. 
EL1 Any mode that is available in Non-secure state, other than Hyp mode and User mode. 
EL2 Hyp mode. 
Execution at ELO is described as unprivileged execution. 
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A mode associated with a particular Exception level, ELn, is described as an ELn mode. 


Note 


The Exception level defines the ability to access resources in the current Security state, and does not imply anything 
about the ability to access resources in the other Security state. 








When EL3 is using AArch32, many AArch32 System registers accessible at PL1 are banked between the Secure 
and Non-secure states. 


When EL3 is using AArch64 and Secure EL] is using AArch32, System registers accessible at PL1 are not banked 
between the Non-secure and Secure states. Software running at EL3 is expected to switch the content of the 
PL1-accessible System registers between the Secure and Non-secure context, in a similar manner to switching the 
contents of general purpose registers. For information on the relationship between AArch64 and AArch32 System 
registers in an interprocessing environment, see Mapping of the System registers between the Execution states on 
page D1-2383. 


For more information on the System registers, see The AArch32 System register interface on page G1-5567. 


The Secure Monitor Call (SMC) instruction provides software with a system call to EL3. When executing at a 
privileged Exception level, SMC instructions generates exceptions. For more information, see Secure Monitor Call 
(SMC) exception on page G1-5541 and SMC on page F5-4520. 





Note 


For more information about the Privilege level terminology, see Security state, Exception levels, and AArch32 
execution privilege on page G1-5480. 





Changing from Secure state to Non-secure state 


Monitor mode is provided to support switching between Secure and Non-secure states. When executing in an 
Exception level that is using AArch32, except in Monitor mode and Hyp mode, the Security state is controlled: 
° By the SCR.NS bit, when EL3 is using AArch32. 

è By the SCR_EL3.NS bit, when EL3 is using AArch64. 


The mapping of AArch32 privileged modes to the exception hierarchy means that it is possible when EL3 is using 
AArch32 to change from EL3 to Non-secure EL1 without an exception return. This can occur in one of the 
following ways: 


. Using an MSR or CPS instruction to switch from Monitor mode to another privileged mode while SCR.NS is 1. 


° Using an MCR instruction that writes SCR.NS to change from Secure to Non-secure state when in a privileged 
mode other than Monitor mode. 


Arm strongly recommends that software executing at EL3 using AArch32 does not use either of these mechanisms 
to change from EL3 to Non-secure EL1 without an exception return. The use of both of these mechanisms is 
deprecated. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G1-5479 
Non-Confidential 


The AArch32 System Level Programmers’ Model 
G1.7 Security state, Exception levels, and AArch32 execution privilege 


G1.7 


Security state, Exception levels, and AArch32 execution privilege 


In Armv8, the hierarchy of software execution privilege, within a particular Security state, is defined by the 
Exception levels, with higher Exception level numbers indicating higher privilege. Table G1-1 shows this hierarchy 
for each Security state. 


Table G1-1 Execution privilege and Exception levels, by Security state 

















Execution privilege Secure state Non-secure state Typical use 

Highest EL3 -a Secure monitor 

> EL2> EL2 Hypervisor 

- EL1 ELI Secure or Non-secure OS 
Lowest, Unprivileged ELO ELO Secure or Non-secure application 





a. EL3 is never implemented in Non-secure state. 
b. If ARMv8.4-SecEL2 is implemented in AArch64 state, EL2 can be enabled in Secure state. 


When executing in AArch32 state, within a given Security state, the current PE state, including the execution 
privilege, is primarily indicated by the current PE mode. In Secure state, how the PE modes map onto the Exception 
levels depends on whether EL3 is using AArch32 or is using AArch64, and: 


s Figure G1-1 on page G1-5478 shows this mapping when EL3 is using AArch32. 
° Figure G1-2 on page G1-5487 shows this mapping when EL3 is using AArch64. 


Table G1-2 shows this mapping. In interpreting this table: 
$ Monitor mode is implemented only in Secure state, and only if EL3 is using AArch32. 
$ Hyp mode is implemented only in Non-secure state, and only if EL2 is using AArch32. 
° System, FIQ, IRQ, Supervisor, Abort, and Undefined modes are implemented: 
In Secure state If either: 
s EL3 is using AArch32. 
a EL3 is using AArch64 and EL1 is using AArch32. 
In Non-secure state If EL1 is using AArch32. 
° User mode is implemented if ELO is using AArch32. 


Table G1-2 Mapping of AArch32 PE modes to Exception levels 


PE modes in the given Security state, and EL3 Execution state 


Exception level 














Secure state, EL3 using AArch32 Secure state, EL3 using AArch644 Non-secure state 
EL3 Monitor, System, FIQ, IRQ, Supervisor, - - 
Abort, Undefined 
EL2 - - Hyp 
ELI - System, FIQ, IRQ, Supervisor, Abort, System, FIQ, IRQ, 
Undefined Supervisor, Abort, 
Undefined 
ELO User User User 
a. If ARMv8.4-SecEL2 is implemented and enabled in AArch64 State, this column can be applied to EL2. 
Because AArch32 behavior is described in terms of the PE modes, and transitions between PE modes, the Exception 
levels are implicit in most of the description of operation in AArch32 state. 
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G1.7.1 Limited use of Privilege level in Armv8 AArch32 state 


As described in The VMSAv8-32 translation regimes on page G5-5722, a translation regime maps a virtual address 
(VA) to the corresponding physical address (PA). The VMSAv8-64 translation regimes are defined by the Exception 
levels that use them. However, because the mapping between PE modes and Exception levels in Secure state 
depends on whether EL3 is using AArch32 or is using AArch64, as shown in Table G1-2 on page G1-5480, the 
VMSAv8-32 translation regimes cannot be described simply in terms of either the Exception levels or the PE modes 
that use them. 


To provide a consistent description of address translation as seen from AArch32 state, the VMSAv8-32 translation 
regimes are described in terms of the Privilege levels originally defined in the Armv7 descriptions of AArch32 state. 
Table G1-3 shows how the PE modes map to these Privilege levels: 


Table G1-3 Mapping of PE modes to AArch32 Privilege levels 














Privilege level Secure state Non-secure state 

PL2 - Hyp? 

PLI Monitor?, System, FIQ, IRQ, Supervisor, Abort, Undefined System, FIQ, IRQ, Supervisor, Abort, Undefined 
PLO User User 





a. Implemented only in Non-secure state, and only if EL2 is using AArch32 state. 


b. Implemented only in Secure state, and only if EL3 is using AArch32 state. 
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Comparing Table G1-3 with Table G1-2 on page G1-5480 shows that: 


In Non-secure state 


Each privilege level maps to the corresponding Exception level. For example PL1 maps to EL1. 


In Secure state 
PLO maps to ELO. 
The mapping of PL1 depends on the Execution state being used by EL3, as follows: 
EL3 using AArch64 Secure PL1 maps to Secure EL1. Monitor mode is not implemented. 


EL3 using AArch32 Secure PL1 maps to Secure EL3. Monitor mode is implemented as one of 
the Secure PL1 modes. 
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G1.8 Virtualization 


The support for virtualization described in this section applies only to an implementation that includes EL2. A PE 
is in Hyp mode when it is executing at EL2 in the AArch32 state. An exception return from Hyp mode to software 
running at EL1 or ELO is performed using the ERET instruction. 


EL2 provides a set of features that support virtualizing the Non-secure state of an Armv8-A implementation. The 
basic model of a virtualized system involves: 


è A hypervisor, running in EL2, that is responsible for switching between virtual machines. A virtual machine 
is comprised of Non-secure EL1 and Non-secure ELO. 
e A number of Guest operating systems, that each run in Non-secure EL1, on a virtual machine. 
e For each Guest operating system, applications, that usually run in Non-secure ELO, on a virtual machine. 
Note 





In some systems, a Guest OS is unaware that it is running on a virtual machine, and is unaware of any other Guest 
OS. In other systems, a hypervisor makes the Guest OS aware of these facts. The Armv8-A architecture supports 
both of these models. 





The hypervisor assigns a virtual machine identifier (VMID) to each virtual machine. 


In AArch32 state, EL2 is implemented only in Non-secure state, to support Guest OS management. EL2 provides 
controls to: 


° Provide virtual values for the contents of a small number of identification registers. A read of one of these 
registers by a Guest OS or the applications for a Guest OS returns the virtual value. 


g Trap various operations, including memory management operations and accesses to many other registers. A 
trapped operation generates an exception that is taken to EL2. 


7 Route interrupts to the appropriate one of: 
— The current Guest OS. 
— A Guest OS that is not currently running. 
— The hypervisor. 


In Non-secure state: 
$ The implementation provides an independent translation regime for memory accesses from EL2. 


: For the PL1&0 translation regime, address translation occurs in two stages: 


— Stage 1 maps the virtual address (VA) to an intermediate physical address (IPA). This is managed at 
EL1, usually by a Guest OS. The Guest OS believes that the IPA is the physical address (PA). 


— Stage 2 maps the IPA to the PA. This is managed at EL2. The Guest OS might be completely unaware 
of this stage. 


For more information on the translation regimes, see Chapter GS The AArch32 Virtual Memory System Architecture. 


G1.8.1 The effect of implementing EL2 on the Exception model 


G1-5482 


An implementation that includes EL2 implements the following exceptions: 
- Hypervisor Call (HVC) exception. 
° Traps to EL2. EL2 configurable controls on page G1-5585, describes these. 
° All of the virtual interrupts: 
— Virtual SError. 
— Virtual IRQ. 
— Virtual FIQ. 


HVC exceptions are always taken to EL2. All virtual interrupts are always taken to EL1, and can only be taken from 
Non-secure EL1 or ELO. 
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Each of the virtual interrupts can be independently enabled using controls at EL2. 
Each of the virtual interrupts has a corresponding physical interrupt. See Virtual interrupts. 


When a virtual interrupt is enabled, its corresponding physical exception is taken to EL2, unless EL3 has configured 
that physical exception to be taken to EL3. For more information, see Asynchronous exception behavior for 
exceptions taken from AArch32 state on page G1-5528. 


An implementation that includes EL2 also: 


. Provides controls that can be used to route some synchronous exceptions, taken from Non-secure state, to 
EL2. For more information, see: 


— Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 
— Routing debug exceptions to EL2 using AArch32 on page G1-5518. 
— Routing of aborts taken to AArch32 state on page G1-5520 
g Provides mechanisms to trap PE operations to EL2. See EL2 configurable controls on page G1-5585. 


When an operation is trapped to EL2, the hypervisor typically either: 
— Emulates the required operation. The application running in the Guest OS is unaware of the trap. 
— Returns an error to the Guest OS. 


Virtual interrupts 


The virtual interrupts have names that correspond to the physical interrupts, as shown in Table G1-4. 


Table G1-4 The virtual interrupts 





Physical interrupt Corresponding virtual interrupt 











External SError Virtual SError 
IRQ Virtual IRQ 
FIQ Virtual FIQ 





Software executing at EL2 can use virtual interrupts to signal physical interrupts to Non-secure EL1 and Non-secure 
ELO. Example G1-1 shows a usage model for virtual interrupts. 


Example G1-1 Virtual interrupt usage model 


A usage model is as follows: 
l. Software executing at EL2 routes a physical interrupt to EL2. 


2; When a physical interrupt of that type occurs, the exception handler executing in EL2 determines whether 
the interrupt can be handled in EL2 or requires routing to a Guest OS in EL1. If the interrupt requires routing 
to a Guest OS: 


s If the Guest OS is currently running, the hypervisor uses the appropriate virtual interrupt type to signal 
the physical interrupt to the Guest OS. 


è If the Guest OS is not currently running, the physical interrupt is marked as pending for the guest OS. 
When the hypervisor next switches to the virtual machine that is running that Guest OS, the hypervisor 
uses the appropriate virtual interrupt type to signal the physical interrupt to the Guest OS. 


Non-secure EL1 and Non-secure ELO modes cannot distinguish a virtual interrupt from the corresponding physical 
interrupt. 


For more information, see Virtual exceptions when an implementation includes EL2 on page G1-5528. 
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G1.9 AArch32 state PE modes, and general-purpose and Special-purpose registers 


The following sections describe the AArch32 PE modes and the general-purpose registers and the PC: 
$ AArch32 state PE mode descriptions. 

. AArch32 general-purpose registers, the PC, and the Special-purpose registers on page G1-5489. 
° Saved Program Status Registers (SPSRs) on page G1-5491. 

è ELR _hyp on page G1-5492. 


Note 


The PC is included in the scope of this section because, in AArch32 state, it is defined as being part of the same 
register file as the general-purpose registers. That is, the AArch32 register file RO-R15 comprises: 





g The general-purpose registers RO-R14. 
. The PC, that can be described as R15. 





G1.9.1 AArch32 state PE mode descriptions 
Table G1-5 shows the PE modes defined by the Arm architecture, for execution in AArch32 state. In this table: 


. The PE mode column gives the name of each mode and the abbreviation used, for example, in the 
general-purpose register name suffixes used in AArch32 general-purpose registers, the PC, and the 
Special-purpose registers on page G1-5489. 


g The Encoding column gives the corresponding PSTATE.M field. 


G The Exception level column gives the Exception level at which the mode is implemented, including 
dependencies on the current Security state and on whether EL3 is using AArch32, see Exception levels on 
page G1-5471. 


Table G1-5 AArch32 PE modes 






































PE mode Encoding Security state Exception level Implemented 
User usr 10000 Both ELO Always 
FIQ fiq 10001 Non-secure ELI Always 
Secure EL] or EL34 
IRQ irq 10010 Non-secure ELI Always 
Secure ELI or EL34 
Supervisor svc 10011 Non-secure EL1 Always 
Secure EL] or EL34 
Monitor mon 10110 Secure EL3 If EL3 implemented and using AArch32 
Abort abt 10111 Non-secure ELI Always 
Secure ELI or EL34 
Hyp hyp 11010 Non-secure EL2 If EL2 implemented and using AArch32 
Undefined und 11011 Non-secure EL1 Always 
Secure ELI or EL34 
System sys 11111 Non-secure ELI Always 
Secure EL] or EL34 
a. EL3 if EL3 is using AArch32. EL1 if EL3 is using AArch64 and EL1 is using AArch32. 
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ARMv8.4-SecEL2 is not supported if EL2 is using AArch32. 





Mode changes can be made under software control, or can be caused by an external or internal exception. 


Notes on the AArch32 PE modes 


PE modes are defined only in AArch32 state. Because each mode is implemented as part of a particular Exception 
level that is using AArch32, the set of available modes depends on which Exception levels are implemented and 
using AArch32, as described in Effect of the EL3 Execution state on the PE modes and Exception levels on 


page G1-5486. 


This section gives more information about each of the modes, when it is implemented. 


User mode 


System mode 


Software executing in User mode executes at ELO. Execution in User mode is sometimes described 
as unprivileged execution. Application programs normally execute in User mode, and any program 
executed in User mode: 


° Makes only unprivileged accesses to system resources, meaning it cannot access protected 
system resources. 

. Makes only unprivileged access to memory. 

. Cannot change mode except by causing an exception, see Handling exceptions that are taken 


to an Exception level using AArch32 on page G1-5501. 


System mode is implemented at EL1 or EL3, see Effect of the EL3 Execution state on the PE modes 
and Exception levels on page G1-5486. 


System mode has the same registers available as User mode, and is not entered by any exception. 


Supervisor mode 


Abort mode 


Supervisor mode is implemented at EL1 or EL3, see Effect of the EL3 Execution state on the PE 
modes and Exception levels on page G1-5486. 


Supervisor mode is the default mode to which a Supervisor Call exception is taken. Executing an 
SVC (Supervisor Call) instruction generates a Supervisor Call exception. 


In an implementation where the highest implemented Exception level is using AArch32, if that 
Exception level is EL3 or EL1, a PE enters Supervisor mode on Reset. 

Abort mode is implemented at EL1 or EL3, see Effect of the EL3 Execution state on the PE modes 
and Exception levels on page G1-5486. 


Abort mode is the default mode to which a Data Abort exception or Prefetch Abort exception is 
taken. 


Undefined mode 


FIQ mode 


IRQ mode 


Hyp mode 


Undefined mode is implemented at EL1 or EL3, see Effect of the EL3 Execution state on the PE 
modes and Exception levels on page G1-5486. 


Undefined mode is the default mode to which an instruction-related exception, including any 
attempt to execute an UNDEFINED instruction, is taken. 

FIQ mode is implemented at EL1 or EL3, see Effect of the EL3 Execution state on the PE modes 
and Exception levels on page G1-5486. 

FIQ mode is the default mode to which an FIQ interrupt is taken. 

IRQ mode is implemented at EL1 or EL3, see Effect of the EL3 Execution state on the PE modes 
and Exception levels on page G1-5486. 

IRQ mode is the default mode to which an IRQ interrupt is taken. 


Hyp mode is the Non-secure EL2 mode. 


Hyp mode is entered on taking an exception from Non-secure state that must be taken to EL2. 
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In an implementation where the highest implemented Exception level is EL2 and EL2 uses 
AArch32 on reset, a PE enters Hyp mode on Reset. 


The Hypervisor Call exception and Hyp Trap exception are implemented as part of EL2 and are 
always taken to Hyp mode. 


Note 


This means that Hypervisor Call and Hyp Trap exceptions cannot be taken from Secure state. 








When the value of the Hypervisor Call enable bit, SCR.HCE, is 1, executing an HVC (Hypervisor 
Call) instruction in a Non-secure EL1 mode generates a Hypervisor Call exception. 


For more information, see Hyp mode on page G1-5487. 


Monitor mode 


Monitor mode is the Secure EL3 mode. This means it is always in the Secure state, regardless of the 
value of the SCR.NS bit. 


Monitor mode is the mode to which a Secure Monitor Call exception is taken. In a Non-secure EL1 
mode, or a Secure EL3 mode, executing an SMC (Secure Monitor Call) instruction generates a Secure 
Monitor Call exception. 


When EL3 is using AArch32, some exceptions that are taken to a different mode by default can be 
configured to be taken to EL3, see PE mode for taking exceptions on page G1-5511. 


When EL3 is using AArch32, software executing in Monitor mode: 
. Has access to both the Secure and Non-secure copies of System registers. 


Can perform an exception return to Secure state, or to Non-secure state. 
This means that, when EL3 is using AArch32, Monitor mode provides the only recommended 
method of changing between the Secure and Non-secure Security states. 

Secure and Non-secure modes 


In an implementation that includes EL3, the names of most implemented modes can be qualified as 
Secure or Non-secure, to indicate whether the PE is also in Secure state or Non-secure state. For 





example: 
- If a PE is in Supervisor mode and Secure state, it is in Secure Supervisor mode. 
. If a PE is in User mode and Non-secure state, it is in Non-secure User mode. 
Note 
As indicated in the appropriate Mode descriptions: 
° Monitor mode is a Secure mode, meaning it is always in the Secure state. 
. Hyp mode is a Non-secure mode, meaning it is accessible only in Non-secure state. 





Effect of the EL3 Execution state on the PE modes and Exception levels 


Figure G1-1 on page G1-5478 shows the PE modes, Exception levels, and Security states, for an implementation 
that includes all of the Exception levels, when EL3 is using AArch32. Figure G1-2 on page G1-5487 shows how 
the implemented modes change when EL3 is using AArch64. 
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Secure state 


























AArch32 AArch32 AArch32 AArch32 AArch32 AArch32 
App1 App2 App1 App2 l Secure App1 Secure App2 
[ Modes: 1 Modes: = |1 Modes: fi Modes: | | [Modes: |1 Modes: | 
User User User User ! User User 
AArch32" AArch32" | | AArch32t 
Guest OS1 Guest OS2 Secure OS 
Modes: System, FIQ, IRQ, Modes: System, FIQ, IRQ, Modes: System, FIQ, IRQ, 
Supervisor, Abort, Undefined Supervisor, Abort, Undefined Supervisor, Abort, Undefined 

















AArch32* 


Hypervisor 

















Secure monitor 








t When EL1 is using AArch64, System, FIQ, IRQ, Supervisor, Abort, and Undefined modes are not implemented 
+ When EL2 is using AArch64, Hyp mode is not implemented 


Figure G1-2 Armv8 Exception levels, and PE modes, when EL3 is using AArch64 


Comparing Figure G1-1 on page G1-5478 and Figure G1-2 shows how, in Secure state only, the implementation of 
System, FIQ, IRQ, Supervisor, Abort, and Undefined mode depends on the Execution state that EL3 is using. That 
is, these modes are implemented as follows: 


Non-secure state 


If Non-secure EL1 is using AArch32, then System, FIQ, IRQ, Supervisor, Abort, and Undefined 
modes are implemented as part of EL1. Otherwise, these modes are not implemented in Non-secure 


Secure state 


state. 


The implementation of these modes depends on the Execution state that EL3 is using, as follows: 


EL3 using AArch64 = If Secure EL1 is using AArch32, then System, FIQ, IRQ, Supervisor, Abort, 
and Undefined modes are implemented as part of EL1. Otherwise, these 
modes are not implemented in Secure state. 


EL3 using AArch32 


Hyp mode 


In Secure state, System, FIQ, IRQ, Supervisor, Abort, and Undefined modes 


are implemented as part of EL3, see Figure G1-1 on page G1-5478. 


Hyp mode is the Non-secure EL2 mode. When EL2 is using AArch32, it provides the usual method of controlling 
the virtualization of Non-secure execution at EL1 and ELO. 


Note 





The alternative method of controlling this functionality is by accessing the EL2 controls from EL3 with the 
SCR_EL3.NS or SCR.NS bit set to 1. 
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G1-5488 


This section summarizes how Hyp mode differs from the other modes, and references where this part of the manual 
describes the features of Hyp mode in more detail: 


7 Software executing in Hyp mode executes at EL2, see Figure G1-1 on page G1-5478. 


° Hyp mode is accessible only in Non-secure state. In Secure state, an attempt by a CPS or an MSR instruction to 
change PSTATE.M to Hyp mode is an illegal change to PSTATE.M, as described in ///egal changes to 
PSTATE.M on page G1-5497. 


. In Non-debug state, the only mechanisms for changing to Hyp mode are: 
— An exception taken from a Non-secure EL1 or ELO mode. 
— When EL3 is using AArch32, an exception return from Secure Monitor mode. 
— When EL3 is using AArch64, an exception return from EL3. 


è In Hyp mode, the only exception return is execution of an ERET instruction, see ERET on page F5-4195. 


° In Hyp mode, the CPACR has no effect on the execution of; 
— System register access instructions. 


— Advanced SIMD and floating-point instructions. 
The HCPTR controls execution of these instructions in Hyp mode. 


° If software running in Hyp mode executes an SVC instruction, the Supervisor Call exception generated by the 
instruction is taken to Hyp mode, see SVC on page F5-4673. 


` An exception return with restored PSTATE specifying Hyp mode is an illegal return event, as described in 
Illegal return events from AArch32 state on page G1-5524, if any of the following applies: 


—  EL3 is using AArch64 and the value of SCR_EL3.NS is 0. 
—  EL3 is using AArch32 and the value of SCR.NS is 0. 
— The return is from a Non-secure EL1 mode. 


e The instructions described in the following sections are UNDEFINED if executed in Hyp mode: 
— SRS. See SRS, SRSDA, SRSDB, SRSIA, SRSIB on page F5-4555. 
— RFE. See RFE, RFEDA, RFEDB, RFEIA, RFEIB on page F5-4450. 
— LDM (exception return) on page F5-4228. 
— LDM (User registers) on page F5-4230. 
— STM (User registers) on page F5-4595. 
— The SUBS PC, LR forms of the instructions described in SUB, SUBS (immediate) on page F5-4657. 


Note 
In T32 state, ERET is encoded as SUBS PC, LR, #0, and therefore this is a valid instruction. 








— The exception return form of the instructions described in MOV, MOVS (register) on page F5-4343. 
In addition, deprecated forms of the A32 ADCS, ADDS, ANDS, BICS, EORS, MOVS, MVNS, ORRS, RSBS, RSCS, SBCS, and 


SUBS instructions with the PC as the destination register are UNDEFINED if executed in Hyp mode. The 
instruction descriptions identify these UNDEFINED cases. 


° The Load unprivileged and Store unprivileged instructions LDRT, LDRSHT, LDRHT, LDRBT, STRT, STRHT, and STRBT, 
are CONSTRAINED UNPREDICTABLE if executed in Hyp mode, see Execution of Load/Store unprivileged 
instructions in Hyp mode on page K1-7626. 


In an implementation that includes EL3, from reset, the HVC instruction is UNDEFINED in Non-secure EL1 modes, 
meaning entry to Hyp mode is disabled by default. To permit entry to Hyp mode using the Hypervisor Call 
exception, Secure software must enable use of the HVC instruction: 

$ By setting the SCR_EL3.HCE bit to 1, if EL3 is using AArch64. 

$ By setting the SCR.HCE bit to 1, if EL3 is using AArch32. 


If EL3 is implemented and using AArch32, and SCR.HCE bit is set to 0, the HVC instruction is UNPREDICTABLE in 
Hyp mode. The instruction is either UNDEFINED or executes as a NOP. 
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If EL3 is implemented and using AArch64, and SCR_EL3.HCE bit is set to 0, the HVC instruction is UNDEFINED in 
Hyp mode. 


If EL3 is not implemented and HCR_EL2 or HCR.HCD is set to 1, the HVC instruction is UNDEFINED in Hyp mode. 


Pseudocode description of mode operations 
The BadMode() function tests whether a 5-bit mode number corresponds to one of the permitted modes. 


The BadMode() function is defined in Chapter J1 ArmvS Pseudocode. 


G1.9.2 AArch32 general-purpose registers, the PC, and the Special-purpose registers 


ARM DDI 0487E.a 
ID070919 


The general-purpose registers, and the PC, in AArch32 state on page E1-3785 describes the application level view 
of the general-purpose registers, and the PC. This view provides: 


s The general-purpose registers RO-R14, of which: 
— The preferred name for R13 is SP (stack pointer). 
— The preferred name for R14 is LR (link register). 
° The PC, that can be described as R15. 


These registers are selected from a larger set of registers, that includes banked copies of some registers, with the 
current register selected by the execution mode. The implementation and banking of the general-purpose registers 
depends on whether or not the implementation includes EL2 and EL3, and whether those Exception levels are using 
AArch32. Figure G1-3 on page G1-5490 shows the full set of banked general-purpose registers, and the 
Special-purpose registers: 

: The Program Status Registers CPSR and SPSR. 

. ELR hyp: 


Note 
The architecture uses system level register names, such as RO_usr, R8_usr, and R8_fiq, when it must identify a 
specific register. The application level names refer to the registers for the current mode, and usually are sufficient 
to identify a register. 
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ł Part of EL3. Exists only in Secure state, and only when EL3 is using AArch32. 
t Part of EL2. Exists only in Non-secure state, and only when EL2 is using AArch32. 
Cells with no entry indicate that the User mode register is used. 


Figure G1-3 AArch32 general-purpose registers, PC, and Special-purpose registers, showing banking 


As described in PE mode for taking exceptions on page G1-5511, on taking an exception the PE changes mode, 
unless it is already in the mode to which it must take the exception. Each mode that the PE might enter in this way 
has: 


s A banked copy of the stack pointer, for example SP_irq and SP_hyp. 
s A register that holds a preferred return address for the exception. This is: 
— Forthe EL2 mode, Hyp mode, the Special-purpose register ELR_hyp. 


— Forthe other privileged modes to which exceptions can be taken, a banked copy of the link register, 
for example LR_und and LR_mon. 


$ A saved copy of PSTATE, made on exception entry, for example SPSR_irq and SPSR_ hyp. 

In addition, FIQ mode has banked copies of the general-purpose registers R8 to R12. 

User mode and System mode share the same general-purpose registers. 

User mode, System mode, and Hyp mode share the same LR. 

For more information about the application level view of the SP, LR, and PC, and the alternative descriptions of 
them as R13, R14 and R15, see The general-purpose registers, and the PC, in AArch32 state on page E1-3785. 
AArch32 Special-purpose registers 

In AArch32 state, the Special-purpose registers are: 

° The CPSR and its view as the APSR. 


à The SPSR, including the banked copies SPSR_abt, SPSR_fiq, SPSR_hyp, SPSR_irq, SPSR_mon, 
SPSR_ sve, and SPSR_und. 


. The ELR hyp. 
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Pseudocode description of general-purpose register and PC operations 


The following pseudocode gives access to the general-purpose registers and the PC. These registers are an array, _R, 
indexed by parameter n. This array is common to AArch32 and AArch64 operation and therefore contains 31 64-bit 
registers. _PC is the Program Counter, and its definition is common to AArch32 and AArch64 operation and 
therefore its size is 64-bit. 


LookUpRIndex() looks up the index value, n, for the specified register number and PE mode, using RBankSelect() to 
evaluates the result. 


_R accesses the specified general-purpose register in the current PE mode, using Rmode[] to access the register, 
accessing _R if necessary. SP accesses the stack pointer, LR accesses the link register, and PC accesses the Program 
Counter. Each function has a non-assignment form for register reads and an assignment form for register writes, 
other than PC, which has only a non-assignment form. 


BranchTo() performs a branch to the specified address. 


The _R, _PC, LR, SP, LookUpRIndex(), RBankSelect(), Rmode[], and BranchTo() functions are defined in Chapter J1 
Armv8 Pseudocode. 


G1.9.3 Saved Program Status Registers (SPSRs) 
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The Saved Program Status Registers (SPSRs) are used to save PE state on taking exceptions. In AArch32 state, there 
is an SPSR for every mode that an exception can be taken to, as shown in Figure G1-3 on page G1-5490. For 
example, the SPSR for Monitor mode is called SPSR_mon. 





Note 


Exceptions cannot be taken to ELO. 





When the PE takes an exception, PE state is saved from PSTATE in the SPSR for the mode the exception is taken 
to. For example, if the PE takes an exception to Monitor mode, PE state is saved in SPSR_ mon. For more 
information on PSTATE, see Process state, PSTATE on page G1-5493. 


Note 


All PSTATE fields are saved, including those which have no direct read and write access. 





Saving the PSTATE fields means the exception handler can: 


e On return from the exception, restore the PE state to the values it had immediately before the exception was 
taken. When the PE returns from an exception, PE state is restored to the state stored in the SPSR of the mode 
the exception is returning from, if the exception return is made using one of: 

— EREET. 

= LDM. 

— The Exception return form of the instruction described in MOV, MOVS (register) on page F5-4343. 
— The Exception return form of the instruction described in SUB, SUBS (immediate) on page F5-4657. 
For example, on returning from Monitor mode, PE state is restored to the state stored in SPSR_mon. If the 


exception return is made using the RFE instruction, the PE restores the PE state from an SPSR valued read 
from memory. 


à Examine the value that PSTATE had when the exception was taken, for example to determine the instruction 
set state and privilege level in which the instruction that caused an Undefined Instruction exception was 
executed. 


The SPSRs are UNKNOWN on reset. Any operation in a Non-secure EL1 or ELO mode makes SPSR_hyp unknown. 


SPSR bits that are defined as RESO on an exception taken from AArch32 state are ignored on any exception return 
to AArch32 state. 


For more information on SPSR, see SPSR, Saved Program Status Register on page G8-6253. 
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Pseudocode description of SPSR operations 
The following pseudocode gives access to the SPSRs. 
The SPSR[] function accesses the current SPSR and is common to AArch32 and AArch64 operation. 


The SPSRWriteByInstr() function is used by the MSR (register) and MSR (immediate) instructions to update the 
current SPSR. 


The SPSR[] and SPSRWriteByInstr() functions are defined in Chapter J1 Armv8 Pseudocode. 


ELR_hyp 


Hyp mode does not provide its own banked copy of LR. Instead, on taking an exception to Hyp mode, the preferred 
return address is stored in ELR_hyp, a 32-bit Special-purpose register implemented for this purpose. 


ELR_hyp can be accessed explicitly only by executing: 

° An MRS or MSR instruction that targets ELR_hyp, see: 
— MRS (Banked register) on page F5-4360. 
— MSR (Banked register) on page F5-4364. 


The ERET instruction uses the value in ELR_hyp as the return address for the exception. For more information, see 
ERET on page F5-4195. 


Software execution in any Non-secure EL1 or ELO mode makes ELR_hyp UNKNOWN. 
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G1.10 Process state, PSTATE 


In the Armv8-A architecture, Process state or PSTATE is an abstraction of process state information. All of the 
instruction sets provide instructions that operate on elements of PSTATE. 


PSTATE includes all of the following: 

: Fields that are meaningful only in AArch32 state. 

s Fields that are meaningful only in AArch64 state. 

è Fields that are meaningful in both Execution states. 


PSTATE is defined in pseudocode as the PSTATE structure, of type ProcState. ProcState is defined in Chapter J1 
Armv8 Pseudocode. 


The PSTATE fields that are meaningful in AArch32 state are: 


The Condition flags 
N Negative Condition flag. 
Z Zero Condition flag. 
C Carry Condition flag. 
Vv Overflow Condition flag. 


Process state, PSTATE on page E1-3787 gives more information about these. 


The overflow or saturation flag 
Q See Process state, PSTATE on page E1-3787. 


The greater than or equal flags 
GE[3:0] See Process state, PSTATE on page E1-3787. 


The PE state controls 


J,T Instruction set state. See Process state, PSTATE on page E1-3787. J is RESO. On a reset 
to AArch32 state, T is set to an IMPLEMENTATION DEFINED value. On taking an 
exception to: 


s A PL1 mode using AArch32, T is set to SCTLR.TE. 
a EL2 using AArch32, T is set to HSCTLR.TE. 


IT[7:0] IT block state bits. See Process state, PSTATE on page E1-3787. On a reset or taking an 
exception to AArch32 state, these bits are set to 0. 


E Endianness of data accesses. See Process state, PSTATE on page E1-3787. If an 
implementation provides both Big-endian and Little-endian support, then: 


$ On a reset to AArch32 state this bit is set to the IMPLEMENTATION DEFINED reset 
value of: 
—  SCTLR.EE if the highest implemented Exception level is not EL2. 
—  HSCTLR.EE if the highest implemented Exception level is EL2. 


° On taking an exception to: 
— APLI mode using AArch32, this bit is set to SCTLR.EE. 
— El2 using AArch32, this bit is set to HSCTLR.EE 


IL Illegal Execution state bit. See The Illegal Execution state exception on page G1-5526. 
On a reset or taking an exception to AArch32 state, this bit is set to 0. 


For information on how the J, T, IT[7:0], E, and IL fields can be accessed, see Accessing the PE 
state controls and the Execution state bit on page G1-5496. 


The asynchronous exception mask bits 


A SError interrupt mask bit. 
I IRQ interrupt mask bit. 
F FIQ interrupt mask bit. 
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For each bit, the values are: 
0 Exception not masked. 
1 Exception masked. 


On a reset to AArch32 state, these bits are set to 1. 
On taking an exception to AArch32 state, one or more of these bits are set to 1. 
For more information, see both: 


. Asynchronous exception masking controls on page G1-5531. 
e PE state on exception entry on page G1-5514. 


The mode bits 


M[4:0] Current mode of the PE. Table G1-5 on page G1-5484 lists the permitted values of this 
field. All other values are reserved. Ilegal changes to PSTATE.M on page G1-5497 
describes the effect of setting M[4:0] to a reserved value. 


M[4] is: 

M[4], Execution state 
The current Execution state: 
0 AArché64 state. 
1 AArch32 state. 


Note 


This is consistent with the use of M[4:0] in previous versions of the 
architecture. 








On a reset to AArch32 state, M[4:0] is set to: 


a 0b10011, meaning Supervisor mode, if the highest implemented Exception level 
is not EL2. 
. 0b11010, meaning Hyp mode, if the highest implemented Exception level is EL2. 


On taking an exception to AArch32 state, M[4:0] is set to the target mode for the 
exception type. 


For more information about the PE modes, see: 
š AArch32 state PE mode descriptions on page G1-5484. 
s PE state on exception entry on page G1-5514. 


Access control bits, from Armv8.1 
PAN Privileged Access Never (PAN) state bit, see About the PAN bit on page G5-5769. 


Timing control bits 


DIT Data Independent Timing (DIT) bit. For more information, see About the DIT bit on 
page E1-3793. 


This bit is implemented only when ARMxv8.4-DIT is implemented. 
On a reset to AArch32 state, this bit is set to 0. 


Speculation control bits 


SSBS Speculative Store Bypass Safe (SSBS) bit. For more information, see Speculative Store 
Bypass Safe (SSBS) on page E2-3822. 


This bit is implemented only when ARMv8.0-SSBS is implemented. 
On reset to AArch32 state, this bit is set to an IMPLEMENTATION DEFINED value. 


Accessing PSTATE fields 


The PSTATE fields can be accessed as described in the following subsections: 
e The Current Program Status Register, CPSR on page G1-5495. 
. Accessing the PE state controls and the Execution state bit on page G1-5496. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


The AArch32 System Level Programmers’ Model 
G1.10 Process state, PSTATE 


° The CPS instruction on page G1-5496. 
. The SETEND instruction on page G1-5497. 
° The SETPAN instruction on page G1-5497. 


The Current Program Status Register, CPSR 


Some PSTATE fields can be accessed using the Special-purpose Current Program Status Register (CPSR). The 
CPSR can be directly read using the MRS instruction, and directly written using the MSR (register) and MSR 
(immediate) instructions. 


The CPSR bit assignments are: 
31 30 29 28 27 26 25 24 23 22 21 20 19 16 15 109 8765 4 





L Reso ee L RESO 
Condition — DIT. from ARMv8.4 Mask bits 
SSBS 


PAN, from ARMv8.1 
N, Z, C, V, bits [31:28] 
The PSTATE Condition flags. 
Q, bit [27] The PSTATE overflow or saturation flag. 
Bits[26:23, 20, 15:10, 5] 
Reserved, RESO. 


SSBS, bit [23] Speculative Store Bypass Safe (SSBS) bit, see Access permissions for instruction execution on 
page G5-5770. 


Bit[22] In Armv8.0, Reserved, RESO. 
In Armv8.1, Privileged Access Never (PAN) state bit, see About the PAN bit on page G5-5769. 
DIT, bit [21] Shows the value of CPSR.DIT immediately before the exception was taken. 
GE[3:0], bits [19:16] 
The PSTATE greater than or equal flags. 
E, bit [9] The PSTATE endianness bit. 
A, I, F, bits [8:6] 
The PSTATE asynchronous exception mask bits. 
M[4:0], bits [4:0] 
The PSTATE mode bits. 


The other PSTATE fields cannot be accessed by using the CPSR. For information on how to access them, see 
Accessing the PE state controls and the Execution state bit on page G1-5496. 


The application level alias for the CPSR is the APSR. The APSR is a subset of the CPSR. See The Application 
Program Status Register, APSR on page E1-3789. 


Writes to the CPSR have side-effects on various aspects of PE operation. All of these side-effects, except 
side-effects on memory accesses associated with fetching instructions, are synchronous to the CPSR write. This 
means that they are guaranteed: 


. Not to be visible to earlier instructions in the execution stream. 
° To be visible to later instructions in the execution stream. 
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The privilege level and address space of memory accesses associated with fetching instructions depend on the 
current Exception level and Security state. Writes to PSTATE.M can change one or both of the Exception level and 
Security state. The effect, on memory accesses associated with fetching instructions, of a change of Exception level 
or Security state is: 


- Synchronous to the change of Exception level or Security state, if that change is caused by an exception entry 
or exception return. 


° Guaranteed not to be visible to any memory access caused by fetching an earlier instruction in the execution 
stream. 
° Guaranteed to be visible to any memory access caused by fetching any instruction after the next Context 


synchronization event in the execution stream. 


° Might or might not affect memory accesses caused by fetching instructions between the mode change 
instruction and the point where the mode change is guaranteed to be visible. 


See Exception return to an Exception level using AArch32 on page G1-5523 for the definition of exception return 
instructions. 


Accessing the PE state controls and the Execution state bit 

The PE state controls are the PSTATE. {IL, IT[7:0], J, E, T} fields. Software can read or write these in an SPSR. 
In the CPSR: 

. The PE state controls, other than PSTATE.E, are RAZ when read by an MRS instruction. 


. Writes to the PE state controls, other than PSTATE.E, by MSR (register) or MSR (immediate), are ignored 
in all modes. 


Instructions other than MRS, MSR (register), or MSR (immediate) that access the PE state controls can read and 
write them in any mode. 


Unlike the other PSTATE PE state controls, PSTATE.E can be read by an MRS instruction and might be written by 
MSR (register) or MSR (immediate). However, Arm deprecates PSTATE.E having a different value from the 
equivalent System register EE bit, see Mixed-endian support on page G4-5686. 


Note 


To determine the current endianness, software can use an LDR instruction to load a word from memory with a known 
value that differs if the endianness is reversed. For example, using an LDR instruction to load a word whose four bytes 
are 0x01, 0x00, 0x00, and 0x00 in ascending order of memory address loads the destination register with: 





° 0x00000001 if the current endianness is little-endian. 
° 0x01000000 if the current endianness is big-endian. 





The PSTATE.M[4] bit is the Execution state bit. When read by an MRS instruction in AArch32 state, this bit always 
reads as 1. When written by an MSR (register) instruction or MSR (immediate) instruction, writing a value other 
than 1 is an illegal change to the PSTATE.M field. See I//egal changes to PSTATE.M on page G1-5497. 


The CPS instruction 
The A32 and T32 instruction sets both include an instruction to manipulate PSTATE. {A, I, F} and PSTATE.M: 


CPSIE <iflags> {, #<mode>} 
Sets the specified PSTATE. {A, I, F} exception masks to 0, enabling the exception, and optionally 
changes to the specified mode. 


CPSID <iflags> {, #<mode>} 
Sets the specified PSTATE. {A, I, F} exception masks to 1, disabling the exception, and optionally 
changes to the specified mode. 


CPS #<mode> Changes to the specified mode without affecting the PSTATE. {A, I, F} exception masks. 
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The CPS instruction is unconditional. For more information, see CPS, CPSID, CPSIE on page F5-4160. 


The SETEND instruction 


The A32 and T32 instruction sets both include an instruction to manipulate PSTATE.E: 
SETEND BE Sets PSTATE.E to 1, for big-endian operation. 
SETEND LE Sets PSTATE.E to 0, for little-endian operation. 


The SETEND instruction is unconditional. For more information, see SETEND on page F5-4502. Arm deprecates use 
of the SETEND instruction. 


The SETPAN instruction 


ARMv8.1-PAN adds the SETPAN instruction to the A32 and T32 instruction sets, to manipulate PSTATE.PAN: 
SETPAN #0 Sets PSTATE.PAN to 0, disabling Privileged access-never operation. 
SETPAN #1 Sets PSTATE.PAN to 1, enabling Privileged access-never operation. 


The SETPAN instruction is unconditional. 
° SETPAN on page F5-4503. 
. About the PAN bit on page G5-5769. 


G1.10.2 The Saved Program Status Registers (SPSRs) 


On taking an exception, PSTATE is preserved in the SPSR of the mode to which the exception is taken. The SPSRs 
are described in Saved Program Status Registers (SPSRs) on page G1-5491. 


G1.10.3 Illegal changes to PSTATE.M 
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In AArch32 PE modes other than User mode, MSR and CPS instructions can explicitly change PSTATE.M. The 
following changes to PSTATE.M by MSR or CPS instructions are illegal: 


° A change to an encoding that Table G1-5 on page G1-5484 does not show. 
. A change to a mode that is not implemented. 


. A change to a mode that is not accessible from the context the MRS or CPS instruction is executed in, as follows: 
— A change to a mode that would cause entry to a higher Exception level. 
— When executing in Non-secure state, a change to Monitor mode. 
— When executing in Secure EL1, a change to Monitor mode when EL3 is using AArch64. 
— A change to Hyp mode from any other mode. 
— A change from Hyp mode to any other mode. 
— When the value of HCR.TGE is 1, attempting to change from Monitor mode to a Non-secure PL1 
mode, see Trapping of general exceptions to Hyp mode on page K1-7627. 


On executing an instruction that attempts an illegal change to PSTATE.M: 
$ PSTATE.M is unchanged, and the current mode remains unchanged. 
7 PSTATE.IL is set to 1. 

. All other PSTATE fields are written to as normal. 





Note 
For the PSTATE fields that MSR and CPS instructions update, see the instruction descriptions: 
s MSR (register) on page F5-4370. 
s MSR (immediate) on page F5-4368. 
$ CPS, CPSID, CPSIE on page F5-4160. 





Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G1-5497 
Non-Confidential 


The AArch32 System Level Programmers’ Model 
G1.10 Process state, PSTATE 


When the value of PSTATE.IL is 1, any attempt to execute any instruction results in an Illegal Execution state 
exception. See The Illegal Execution state exception on page G1-5526. 





Note 
$ The PE ignores writes to PSTATE.M when executing at PLO. 
- In Armv7, an instruction that attempts to make an illegal change to PSTATE.M is UNPREDICTABLE. 





G1.10.4 Pseudocode description of PSTATE operations 


The CPSRWriteByInstr() function is used by the MSR (register) and MSR (immediate) instructions to update 
PSTATE. 


The SetPSTATEFromPSR() function updates PSTATE from a CPSR or SPSR. 


Chapter J1 Armv8 Pseudocode defines these functions. 
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G1.11 Instruction set states 


The instruction set states are described in Chapter E2 The AArch32 Application Level Memory Model and 
application level operations on them are described there. This section supplies more information about how they 
interact with system level functionality, in the sections: 


: Exceptions and instruction set state. 
$ Unimplemented instruction sets. 
G1.11.1 Exceptions and instruction set state 


Ifan exception is taken to an EL1 mode, the SCTLR.TE bit for the Security state the exception is taken to determines 
the instruction set state that handles the exception, and if necessary, the PE changes to this instruction set state on 
exception entry. 


If the exception is taken to Hyp mode, the HSCTLR.TE bit determines the instruction set state that handles the 
exception, and if necessary, the PE changes to this instruction set state on exception entry. 


On coming out of reset, if the highest implemented Exception level is using AArch32: 


` If the highest implemented Exception level is EL2, the PE starts execution in Hyp mode, in the instruction 
set state determined by the reset value of HSCTLR.TE. 


° Otherwise, the PE starts execution in Supervisor mode, in the instruction set state determined by the reset 
value of SCTLR.TE. If the implementation includes EL3, this execution is in Secure Supervisor mode. 


For more information about exception entry, see Overview of exception entry on page G1-5508. 


G1.11.2 Unimplemented instruction sets 
The PSTATE.T bit defines the current instruction set state, see Process state, PSTATE on page E1-3787. 


In the Armv8 architecture, there is no support for the hardware acceleration of Java bytecodes, and the Jazelle 
Instruction set state is obsolete. Every AArch32 implementation must support the Trivial Jazelle implementation 
described in Trivial implementation of the Jazelle extension. 


Note 


In previous versions of the Arm architecture, the PSTATE. {J, T} bits determined the Instruction set state. In Armv8, 
PSTATE.J is RESO. 





Trivial implementation of the Jazelle extension 
Armv§8 requires that the implementation of AArch32 state includes the trivial Jazelle implementation. 
In a trivial implementation of the Jazelle extension: 


. At EL1, EL2, or EL3, if the Exception level is using AArch32: 
— The JMCR and JOSCR are RAZ/WI. 
— The JIDR is a RAZ read-only register. 


. At ELO when ELO is using AArch32: 
— Itis IMPLEMENTATION DEFINED whether the JMCR and JOSCR are RAZ/WI or UNDEFINED. 


— It is IMPLEMENTATION DEFINED whether JIDR is RAZ or UNDEFINED. 


è The BXJ instruction behaves identically to the BX instruction in all circumstances. 





Note 


This is consistent with the JMCR.JE bit being RAZ, and means that the A32 and T32 instruction sets do not 
provide any mechanism for attempting to enter Jazelle state. 
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° Jazelle state, as defined in previous versions of the Arm architecture, is an unimplemented instruction set 
state. 


These requirements ensure that operating systems that support an EJVM execute correctly. 


A trivial implementation is not required to extend the PC to 32 bits, that is, it can implement PC[0] as RAZ/WI. 





Note 


This is because the only way that PC[0] is visible in A32 or T32 state is as a result of an exception occurring during 
Jazelle state execution, and Jazelle state execution cannot occur on a trivial implementation. 
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G1.12 Handling exceptions that are taken to an Exception level using AArch32 


An exception causes the PE to suspend program execution to handle an event, such as an externally generated 
interrupt or an attempt to execute an undefined instruction. Exceptions can be generated by internal and external 
sources. 


Normally, when an exception is taken the PE state is preserved immediately, before handling the exception. This 
means that, when the event has been handled, the original state can be restored and program execution resumed from 
the point where the exception was taken. 


More than one exception might be generated at the same time, and a new exception can be generated while the PE 
is handling an exception. 


The following sections describe exception handling: 


. Exception vectors and the exception base address. 
e Exception prioritization for exceptions taken to AArch32 state on page G1-5504. 
° Overview of exception entry on page G1-5508. 


. PE mode for taking exceptions on page G1-5511. 

° PE state on exception entry on page G1-5514. 

e Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 
7 Routing debug exceptions to EL2 using AArch32 on page G1-5518. 


See also: 

. Routing of aborts taken to AArch32 state on page G1-5520. 

. Exception return to an Exception level using AArch32 on page G1-5523. 

s Asynchronous exception behavior for exceptions taken from AArch32 state on page G1-5528. 
p AArch32 state exception descriptions on page G1-5536. 


G1.12.1 Exception vectors and the exception base address 
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When an exception is taken, PE execution is forced to an address that corresponds to the type of exception. This 
address is called the exception vector for that exception. The vectors for the different types of exception form a 
vector table. 





Note 


There are significant differences in the sets of exception vectors for exceptions taken to an Exception level that is 
using AArch32 and for exceptions taken to an Exception level that is using AArch64. This part of this manual 
describes only how exceptions are taken to an Exception level that is using AArch32. 


When an exception is taken to an Exception level that is using AArch64, then the exception is taken as described in 
Chapter D1 The AArch64 System Level Programmers’ Model using the exception vectors described in Exception 
vectors on page D1-2295. 


AArch32 state defines exception vector tables for exceptions taken to EL2 and EL3 when those Exception levels 
are using AArch32. Those vector tables are not used when the corresponding Exception levels are using AArch64. 





A set of exception vectors for an Exception level that is using AArch32 comprises eight consecutive word-aligned 
memory addresses, starting at an exception base address. These eight vectors form an AArch32 vector table. 


The number of possible exception base addresses, and therefore the number of vector tables, depends on the 
implemented Exception levels, as follows: 
Implementation that does not include EL3 


Any implementation that does not include EL3 must include the following AArch32 vector table if 
EL1 can use AArch32: 


- An exception table for exceptions taken to EL1 modes other than System mode. This is the 
EL1 vector table, and is in the address space of the PL1&0 translation regime. 
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Note 


Exceptions cannot be taken to System mode. 








For this vector table: 
— When SCTLR.V == 0, the VBAR holds the exception base address. 
— When SCTLR.V == 1, the exception base address is @xFFFF0QQ0. 


Implementation that includes EL2 


Any implementation that includes EL2 must include the following additional AArch32 vector table 
if EL2 can use AArch32: 


An exception table for exceptions taken to Hyp mode. This is the Hyp vector table, and is in 
the address space of the Non-secure PL2 translation regime. 


For this vector table, HVBAR holds the exception base address. 


Implementation that includes EL3 


Any implementation that includes EL3 must include the following AArch32 vector tables: 


If EL3 can use AArch32, a vector table for exceptions taken to Secure Monitor mode. This 
is the Monitor vector table, and is in the address space of the Secure PL1&0 translation 
regime. 

For this vector table, MVBAR holds the exception base address. 


If Secure EL1 can use AArch32, a vector table for exceptions taken to Secure privileged 
modes other than Monitor mode and System mode. This is the Secure vector table, and is in 
the address space of the Secure PL1&0 translation regime. 


— When the Secure instance of SCTLR.V == 0, the Secure instance of VBAR holds the 
exception base address. 
— When the Secure instance of SCTLR.V == 1, the exception base address is 0xFFFFQQ00. 


If Non-secure EL1 can use AArch32, a vector table for exceptions taken to Non-secure PL1 
modes. This is the Non-secure vector table, and is in the address space of the Non-secure 
PL1&0 translation regime. 


— When the Non-secure instance of SCTLR.V == 0, the Non-secure instance of VBAR 
holds the exception base address. 


— When the Non-secure instance of SCTLR.V == 1, the exception base address is 
OxFFFFQ000. 


The following subsections give more information: 


The vector tables and exception offsets. 
Pseudocode determination of the exception base address on page G1-5504. 


The vector tables and exception offsets 


Table G1-6 on page G1-5503 defines the AArch32 vector table entries. In this table: 


The Hyp column defines the vector table entries for exceptions taken to Hyp mode. 
The Monitor column defines the vector table entries for exceptions taken to Monitor mode. 


The Secure and Non-secure columns define the Secure and Non-secure vector table entries, that are used for 
exceptions taken to modes other than Monitor mode, Hyp mode, System mode, and User mode. Table G1-7 
on page G1-5503 shows the mode to which each of these exceptions is taken. Each of these modes is 
described as the default mode for taking the corresponding exception. 





Note 


Exceptions cannot be taken to System mode or User mode. 
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For more information about determining the mode to which an exception is taken, see PE mode for taking exceptions 


on page G1-5511. 


When EL2 is using AArch32, it provides a number of additional exceptions, some of which are not shown explicitly 
in the vector tables. For more information, see Interrupt offsets of AArch32 exceptions provided by EL2 on 


page G1-5504. 


Table G1-6 The AArch32 vector tables 





Vector tables 


























Offset 
Hypa Monitor? Secure® Non-secure° 
0x00 Not used Not used Not used4 Not used 
0x04 Undefined Instruction, from Hyp mode Monitor Trap Undefined Instruction Undefined Instruction 
0x08 Hypervisor Call, from Hyp mode Secure Monitor Call Supervisor Call Supervisor Call 
QxOC Prefetch Abort, from Hyp mode Prefetch Abort Prefetch Abort Prefetch Abort 
0x10 Data Abort, from Hyp mode Data Abort Data Abort Data Abort 
0x14 Hyp Trap, or Hyp mode entry® Not used Not used Not used 
0x18 IRQ interrupt IRQ interrupt IRQ interrupt IRQ interrupt 
Qx1C FIQ interrupt FIQ interrupt FIQ interrupt FIQ interrupt 





a. Non-secure state only. Implemented only if the implementation includes EL2 and EL2 can use AArch32. 


Secure state only. Implemented only if the implementation includes EL3 and EL3 can use AArch32. 


c. Ifthe implementation does not include EL3 then there is a single vector table for exceptions taken to EL1 when EL] is using 


AArch32. That table holds the vectors shown in the Secure column of this table 


d. In previous versions of the architecture, this entry has been used for the Reset vector, meaning the address at which execution starts 
on coming out of reset. In Armv8, the AArch32 Reset vector is IMPLEMENTATION DEFINED. An implementation might use this vector 


table entry to hold the Reset vector. 


e. See Use of offset 0x14 in the Hyp vector table on page G1-5504. 


Table G1-7 Modes for taking the exceptions shown in the Secure or Non-secure vector table 























Exception Mode taken to 
Undefined Instruction Undefined 
Supervisor Call Supervisor 
Prefetch Abort Abort 

Data Abort Abort 

IRQ interrupt IRQ 

FIQ interrupt FIQ 


For more information about use of the vector tables, see Overview of exception entry on page G1-5508. 
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Interrupt offsets of AArch32 exceptions provided by EL2 


EL2 provides the following exceptions. When EL2 is using AArch32, these exceptions are taken to Hyp mode, and 
the PE enters the handlers for these exceptions using the following vector table entries shown in Table G1-6 on 
page G1-5503: 


Hypervisor Call 


Iftaken from Hyp mode, shown explicitly in the Hyp mode vector table. Otherwise, see Use of offset 
0x14 in the Hyp vector table. 


Hyp Trap Shown explicitly in the Hyp mode vector table. 
Virtual Abort Entered through the Data Abort vector in the Non-secure vector table. 
Virtual IRQ Entered through the IRQ vector in the Non-secure vector table. 


Virtual FIQ Entered through the FIQ vector in the Non-secure vector table. 


Note 


Virtual exceptions when an implementation includes EL2 on page G1-5528 gives more information about the virtual 
exceptions. 








Use of offset 0x14 in the Hyp vector table 


The vector at offset 0x14 in the Hyp vector table is used for all exceptions that cause entry to Hyp mode from 
Non-secure ELO and EL1, except for IRQ and FIQ exceptions. 





Note 


Virtual exceptions are never taken to Hyp mode. 





Pseudocode determination of the exception base address 
For an exception taken to a PL1 mode, the ExcVectorBase() function determines the exception base address. 


The ExcVectorBase() function is defined in Chapter J1 Armv8 Pseudocode. 





Note 


The PL1 modes to which exceptions can be taken are Supervisor mode, Undefined mode, Abort mode, IRQ mode, 
and FIQ mode. In Non-secure state, and in Secure state when EL3 is using AArch64, these are EL1 modes. 
However, in Secure state when EL3 is using AArch32, these are EL3 modes. For more information see Security 
state, Exception levels, and AArch32 execution privilege on page G1-5480. 





Exception prioritization for exceptions taken to AArch32 state 


The following sections describe the Armv8 requirements for the prioritization of synchronous exceptions, and the 
limits on when asynchronous exceptions can be taken: 


. Synchronous exception prioritization for exceptions taken to AArch32 state on page G1-5505. 

. Architectural requirements for taking asynchronous exceptions on page G1-5507. 

See also: 

. AArch32 state prioritization of synchronous aborts from a single stage of address translation on 


page GS-5819, for information about: 
— The prioritization of aborts on a single memory access in a VMSA implementation. 
— The prioritization of exceptions generated during address translation. 


. Debug state entry and debug event prioritization on page H2-6707 for information about the relative 
prioritization of exceptions and the debug events that cause entry to Debug state. 
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Synchronous exception prioritization for exceptions taken to AArch32 state 


In principle, any single instruction can generate a number of different synchronous exceptions, between the fetching 
of the instruction, its decode, and eventual execution. This section describes the prioritization of such exceptions 
when they are taken to an Exception level that is using AArch372. 





An exception that is taken to an Exception level that is using AArch32 must have been taken from an 
Exception level that is using AArch32. 


The priority numbering in this list correlates with the equivalent AArch64 list in Synchronous exception 
prioritization for exceptions taken to AArch64 state on page D1-2308. 





For an exception that is taken to an Exception level that is using AArch32, exceptions are prioritized as follows, 
where | is the highest priority. 


1-5 


6 


13 


ARM DDI 0487E.a 
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These priority numbers are used by AArch64 exceptions or debug events. 


PC alignment fault exceptions. A PC alignment fault exception can only be taken to an Exception 
level that is using AArch32 as a result of: 


. The CONSTRAINED UNPREDICTABLE handling of a branch to an unaligned address, see 
Branching to an unaligned PC on page K1-7608. 


g Exiting from Debug state to AArch32 specifying an unaligned PC value, see Exiting Debug 
state on page H2-6740. 


A PC alignment fault exception that is taken to an Exception level that is using AArch32 is reported 
as a Prefetch Abort exception, see Prefetch Abort exception reporting a PC alignment fault 
exception on page G1-5544. 


Prefetch Abort exceptions. See Prefetch Abort exception on page G1-5543 and AArch32 state 
prioritization of synchronous aborts from a single stage of address translation on page G5-5819. 


Breakpoint exceptions or Address Matching Vector Catch exceptions. See: 
° Breakpoint exceptions on page G2-5628. 
° Vector Catch exceptions on page G2-5667. 


Note 


An Exception Trapping Vector Catch exception is generated on exception entry for an exception that 
has been prioritized as described in this section. This means that it does not have its own entry in 
this list. 








Illegal Execution state exceptions. See The Illegal Execution state exception on page G1-5526. 
Software Breakpoint Exceptions caused by the execution of a BKPT Exception generating instruction. 
This priority number is used by AArch64 exceptions. 


Exceptions taken from EL1 to EL2 because of one of the following configuration settings: 
à HSTR.Tn. 
. HCR.TIDCP. 


Undefined Instruction exceptions that occur as a result of one or more of the following: 


à An attempt to execute an unallocated instruction encoding, including an encoding for an 
instruction that is not implemented in the PE implementation. 


è An attempt to execute an instruction that is defined never to be accessible at the current 
Exception level regardless of any enables or traps. 
à Debug state execution of an instruction encoding that is unallocated in Debug state. 
$ Non-debug state execution of an instruction encoding that is unallocated in Non-debug state. 
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14 


15 


16 


17 


18 


19 


20 


21-22 


23 


24 


25 


26-27 


G1-5506 


° Execution of an HVC instruction, when HVC instructions are disabled by SCR.HCE or 
HCR.HCD. 

° Execution of an HLT instruction when HLT instructions are disabled by EDSCR.HDE or when 
halting is prohibited. 


° In Debug state: 
— Execution of a DCPS1 instruction in Non-secure ELO when HCR.TGE is 1. 


— Execution of a DCPS2 instruction in EL1 or ELO when SCR.NS is 0 or when EL2 is 
disabled or not implemented in the current Security state. 

— Execution of a DCPS3 instruction when EDSCR.SDD is 1 or when EL3 is not 
implemented. 

— When the value of EDSCR.SDD is 1, execution in EL2, EL1, or ELO of an instruction 
that is trapped to EL3. 

a Execution of an instruction that is UNDEFINED as a result of any of: 

— Being in an IT block when SCTLR.ITD is 1, or when HSCTLR.ITD is 1. 

— Executing a SETEND instruction when SCTLR.SED is 1, or when HSCTLR.SED is 1. 

— Executing a CP15DMB, CP15DSB, or CP15ISB barrier instruction when 
SCTLR.CP15BEN is 0, or when HSCTLR.CP15BEN is 0. 


See Disabling or enabling PLO and PL1 use of AArch32 deprecated functionality on 
page G1-5579 and Disabling or enabling EL2 use of AArch32 deprecated functionality on 
page G1-5588. 


° Execution of an instruction that is UNDEFINED because at least one of FPSCR. {Stride, Len} 
is nonzero, when programming these bits to nonzero values is supported. See Floating-point 
exceptions and exception traps on page G1-5574. 


Exceptions taken to EL1, or taken to EL2 because the value of HCR.TGE is 1, that are generated 
because of configurable access to instructions, and that are not covered by any of priorities 6-12. 


Exceptions taken from ELO to EL2 because of one of the following configuration settings: 
è HSTR.Tn. 
° HCR.TIDCP. 


Exceptions taken to EL2 because of configuration settings in the HCPTR. 


Exceptions taken to EL2 because of one of the following configuration settings: 
. Any setting in HCR, other than the TIDCP bit. 

$ Any setting in CNTHCTL. 

. Any setting in HDCR. 


Exceptions taken to EL2 because of configurable access to instructions, and that are not covered by 
any of priorities 6-16. 


Exceptions caused by the SMC instruction being UNDEFINED because the value of SCR.SCD is 1. 
Exceptions caused by the execution of an Exception generating instruction, SVC, HVC, or SMC. 
These priority numbers are used by AArch64 exceptions. 

Exceptions taken to EL3 from ELO, EL1 or EL2 because of configuration settings in the SDCR. 


Exceptions taken to EL3 because of configurable access to instructions, and that are not covered by 
any of priorities 6-22. 


Trapped floating-point exceptions, if supported. See Floating-point exceptions and exception traps 
on page G1-5574. 


These priority numbers are used by AArch64 exceptions and debug events. 
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28 Data Abort exceptions other than a Data Abort exception generated by a synchronous External abort 
that was not generated by a translation table walk. That is, any Data Abort exception that is not 
covered by item 29. See Data Abort exception on page G1-5547 and AArch32 state prioritization of 
synchronous aborts from a single stage of address translation on page G5-5819. It is 
IMPLEMENTATION DEFINED whether synchronous External aborts are prioritized here or as item 29. 


29 Watchpoint exceptions. See Watchpoint exceptions on page G2-5653. 


30 Data Abort exception generated by a synchronous External abort that was not generated by a 
translation table walk, see External aborts on page G4-5712. It is IMPLEMENTATION DEFINED 
whether synchronous External aborts are prioritized here or as item 27. 


For items 28-30, if an instruction results in more than one single-copy atomic memory access, the prioritization 
between synchronous exceptions generated on each of those different memory accesses is not defined by the 
architecture. 


Note 
Exceptions generated by a translation table walk are reported and prioritized as either a Prefetch Abort exception, 
priority 7 in this list, or a Data Abort exception, priority 28 in this list. See also AArch32 state prioritization of 
synchronous aborts from a single stage of address translation on page G5-5819. 








Architectural requirements for taking asynchronous exceptions 


The Arm architecture does not define when asynchronous exceptions are taken. The prioritization of asynchronous 
exceptions, including virtual asynchronous exceptions, is IMPLEMENTATION DEFINED. 


An asynchronous exception that is pending before a Context synchronization event in the following list, is taken 
before the first instruction after the context synchronizing event, provided that the pending asynchronous event is 
not masked: 





è Execution of an ISB instruction that does not fail its Condition code check. 

. Exception entry. 

- Exception return. 

° Exit from Debug state. 

Note 

è If the first instruction after the context synchronizing event generates a synchronous exception, then the 
architecture does not define the order in which that synchronous exception and the asynchronous exception 
are taken. 

7 The ISR identifies any pending asynchronous exceptions. 

à Interrupts are masked when the PE is in Debug state, and therefore this list of context synchronizing events 


does not include the DCPS and DRPS instructions. 





In the absence of a specific requirement to take an asynchronous exception, the only requirement of the architecture 
is that an unmasked asynchronous exception is taken in finite time. 


Note 


The taking of an unmasked asynchronous exception in finite time must occur with all code sequences, including 
with a sequence that consists of unconditional loops. 








If an unmasked interrupt was pending but is changed to not pending before it is taken, then the architecture permits 
the interrupt to be taken, but does not require this to happen. If the interrupt is taken, then it must be taken before 
the first Context synchronization event after the interrupt was changed to not pending. 
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PSTATE includes a mask bit for each type of asynchronous exception. Setting one of these bits to 1 can prevent the 
corresponding asynchronous exception from being taken, although when the PE is in Non-secure state other controls 
can modify the effect of these bits. For more information, see Asynchronous exception behavior for exceptions taken 


from AArch32 state on page G1-5528. 


Taking an exception sets an exception-dependent subset of these mask bits. 


Note 


In some contexts, the PSTATE. {A, I, F} bits mask the taking of asynchronous exceptions. The way these are set on 
exception entry, described in PSTATE. {A, I, E M} values on exception entry on page G1-5515, can prevent an 
exception handler being interrupted by an asynchronous exception. 








Overview of exception entry 


There are some significant differences between the handling of exceptions taken to Hyp mode and exceptions taken 
to other modes. Because Hyp mode is the EL2 mode, this means that the following descriptions sometimes 
distinguish between the EL2 mode and the non-EL2 modes. 


On taking an exception to an Exception level that is using AArch32: 


1. The hardware determines the mode to which the exception must be taken, see PE mode for taking exceptions 
on page G1-5511. 


2, A link value, indicating the preferred return address for the exception, is saved. This is a possible return 
address for the exception handler, and depends on: 
‘ The exception type. 
s Whether the exception is taken to the EL2 mode or to a non-EL2 mode. 
s For some exceptions taken to non-EL2 modes, the instruction set state when the exception was taken. 
Where the link value is saved depends on whether the exception is taken to the EL2 mode. 
For more information, see Link values saved on exception entry on page G1-5509. 


3; The value of PSTATE is saved in the SPSR for the mode to which the exception must be taken. The value 
saved in SPSR.IT[7:0] is always correct for the preferred return address. 


4. In an implementation that includes EL3, when EL3 is using AArch32: 
° If the exception is taken from Monitor mode, SCR.NS is cleared to 0. 
° Otherwise, taking the exception leaves SCR.NS unchanged. 


When EL3 is using AArch64, Monitor mode is not available. 


5: PSTATE is updated with new context information for the exception handler. This includes: 


. Setting PSTATE.M to the PE mode to which the exception is taken. 


$ Setting the appropriate PSTATE mask bits. This can disable the corresponding exceptions, preventing 
uncontrolled nesting of exception handlers. 

š Setting the instruction set state to the state required for exception entry. 

è Setting the endianness to the required value for exception entry. 


- Clearing the PSTATE.IT[7:0] bits to 0. 


For more information, see PE state on exception entry on page G1-5514. 


6. The appropriate exception vector is loaded into the PC, see Exception vectors and the exception base address 
on page G1-5501. 


7. Execution continues from the address held in the PC. 


For an exception taken to a non-EL2 mode, on exception entry, the exception handler can use the SRS instruction to 
store the return state onto the stack of any mode at the same Exception level and in the same Security state, and can 
use the CPS instruction to change mode. For more information about the instructions, see SRS, SRSDA, SRSDB, 
SRSIA, SRSIB on page F5-4555 and CPS, CPSID, CPSIE on page F5-4160. 
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Later sections of this chapter describe each of the possible exceptions, and each of these descriptions includes a 
pseudocode description of the PE state changes on taking that exception. Table G1-8 gives an index to these 
descriptions: 


Table G1-8 Pseudocode descriptions of exception entry for exceptions taken to AArch32 state 





Exception Description of exception entry 





Reset Pseudocode descriptions of reset on page G1-5561 





Undefined Instruction Pseudocode description of taking the Undefined Instruction exception on page G1-5538 











Hyp Trap Pseudocode description of taking the Hyp Trap exception on page G1-5540 
Monitor Trap Pseudocode description of taking the Monitor Trap exception on page G1-5539 
Supervisor Call Pseudocode description of taking the Supervisor Call exception on page G1-5541 





Secure Monitor Call Pseudocode description of taking the Secure Monitor Call exception on page G1-5542 


























Hypervisor Call Pseudocode description of taking the Hypervisor Call exception on page G1-5543 
Prefetch Abort Pseudocode description of taking the Prefetch Abort exception on page G1-5547 

Data Abort Pseudocode description of taking the Data Abort exception on page G1-5550 

Virtual Abort Pseudocode description of taking the Virtual SError interrupt exception on page G1-5552 
IRQ Pseudocode description of taking the physical IRQ exception on page G1-5553 

Virtual IRQ Pseudocode description of taking the Virtual IRQ exception on page G1-5554 

FIQ Pseudocode description of taking the FIQ exception on page G1-5556 

Virtual FIQ Pseudocode description of taking the Virtual FIQ exception on page G1-5556 





The following sections give more information about the PE state changes, for different architecture 
implementations. However, you must refer to the pseudocode for a full description of the state changes: 


. PE mode for taking exceptions on page G1-5511. 
e PE state on exception entry on page G1-5514. 


Link values saved on exception entry 


On exception entry, a link value for use on return from the exception, is saved. This link value is based on the 
preferred return address for the exception, as shown in Table G1-9: 


Table G1-9 Exception return addresses for exceptions taken to AArch32 state 


























Exception Preferred return address Taken to a mode at 
Undefined Instruction Address of the UNDEFINED instruction Non-EL22, or EL2° 
Hyp Trap Address of the trapped instruction EL2 only° 
Monitor Trap Address of the trapped instruction EL3 only 
Supervisor Call Address of the instruction after the SVC instruction Non-EL22 or EL2¢ 
Secure Monitor Call Address of the instruction after the SMC instruction EL3>, and only in Secure state 
Hypervisor Call Address of the instruction after the HVC instruction EL2 only¢ 
Prefetch Abort Address of aborted instruction fetch Non-EL2? or EL2¢ 
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Table G1-9 Exception return addresses for exceptions taken to AArch32 state (continued) 














Exception Preferred return address Taken to a mode at 

Data Abort Address of instruction that generated the abort Non-EL2? or EL2¢ 

Virtual Abort Address of next instruction to execute EL1, and only in Non-secure state 
IRQ or FIQ Address of next instruction to execute Non-EL2? or EL2¢ 

Virtual IRQ or Virtual FIQ Address of next instruction to execute EL1, and only in Non-secure state 





a. ELI ifthe exception is taken to a Non-secure mode, or is taken to a Secure mode when EL3 is using AArch64. EL3 if the 


exception is taken to a Secure mode when EL3 is using AArch64. 


b. A Secure Monitor Call exception is taken to EL3, and therefore is taken to AArch32 state only if EL3 is using AArch32, 


in which case it is taken to Monitor mode. 


c. EL2 is implemented only in Non-secure state when using AArch32 state. Therefore, an exception can be taken to EL2 mode 


only if it is taken from Non-secure state when using AArch32 state. 


Note 





. Although Reset is described as an exception, it differs significantly from other exceptions. The architecture 
has no concept of a return from a Reset and therefore it is not listed in this section. 


° For each exception, the preferred return address is not affected by the Exception level from which the 


exception was taken. 





The link value saved, and where it is saved, depend on whether the exception is taken to a non-EL2 mode, or to an 


EL2 mode, as follows: 


Exception taken to a non-EL2 mode 


The link value is saved in the LR for the mode to which the exception is taken. 


The saved link value is the preferred return address for the exception, plus an offset that depends on 


the instruction set state when the exception was taken, as Table G1-10 shows: 


Table G1-10 Offsets applied to Link value for exceptions taken to non-EL2 modes 





Offset, for PE state of: 





























Exception 
A32 T32 

Undefined Instruction +4 +2 
Monitor Trap +4 +2 
Supervisor Call None None 
Secure Monitor Call None None 
Prefetch Abort +4 +4 
Data Abort +8 +8 
Virtual Abort +8 +8 
IRQ or FIQ +4 +4 
Virtual IRQ or Virtual FIQ +4 +4 











Exception taken to an EL2 mode 


The link value is saved in the ELR_hyp Special-purpose register. 
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The saved link value is the preferred return address for the exception, as shown in Table G1-9 on 
page G1-5509, with no offset. 


G1.12.4 PE mode for taking exceptions 


The following principles determine the Exception level to which an exception is taken, and if that Exception level 
is using AArch32, the PE mode to which the exception is taken: 


° An exception cannot be taken to the ELO mode. 


s An exception is taken either: 
— To the Exception level at which the PE was executing when it took the exception. 
— Toa higher Exception level. 
This means that, in Secure state: 
— When EL3 is using AArch32, an exception is always taken to an EL3 mode. 
— When EL3 is using AArch64, an exception that is taken to AArch32 state is taken to an EL1 mode. 


° Configuration options and other features provided by EL2 and EL3 can determine the mode to which some 
exceptions are taken, as follows: 
In an implementation that does not include EL2 or EL3 
An exception is always taken to the default mode for that exception. 


In an implementation that includes EL3 
A Secure Monitor Call exception is always taken to EL3. This means: 


° If EL3 is using AArch32 the exception is taken to Secure Monitor mode. 


s If EL3 is using AArch64, then executing the instruction generates an exception that is 
taken to EL3, see Execution of an SMC instruction from a privileged Exception level that 
is using AArch32 on page G1-5512. 

IRQ, FIQ, and External abort exceptions can be configured to be taken to EL3. Therefore, if EL3 

is using AArch32 the exceptions are taken to Secure Monitor mode. 

When EL3 is using AArch32, a Monitor Trap exception is taken to Secure Monitor mode. 

Any exception taken from Secure state that is not taken to Secure Monitor mode is taken to 

Secure state in the default mode for that exception. As described in Security state, Exception 

levels, and AArch32 execution privilege on page G1-5480, this means it is taken to: 

à An EL3 mode other than Monitor mode if EL3 is using AArch32. 

à An EL1 mode if EL3 is using AArch64. 

If the implementation does not include EL2, any exception taken from Non-secure state that is 

not taken to Secure Monitor mode is taken to Non-secure state to the default mode for that 

exception. The default mode will be an EL1 mode. 
In an implementation that includes EL2 


An exception taken from Non-secure state that is not taken to Secure Monitor mode is taken to 
Non-secure state and: 





° If the exception is taken from Hyp mode, then it is taken to Hyp mode. 
° Otherwise, the exception is either taken to Hyp mode, as described in Exceptions taken to 
Hyp mode on page G1-5512, or taken to the default mode for the exception. 
Note 
s Hyp mode is the EL2 mode. The other modes to which an exception can be taken in 


Non-secure state are EL1 modes. 


° Hyp mode has no effect on the handling of exceptions taken from Secure state. 


Table G1-7 on page G1-5503 shows the default mode to which each exception is taken. 


Asynchronous exception routing controls on page G1-5530 describes the exception routing controls provided by 
EL2 and EL3. 
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Routing of aborts taken to AArch32 state on page G1-5520 gives more information about the modes to which 
memory aborts are taken. 


The possible modes for taking each exception on page G1-5513 shows all modes to which each exception might be 
taken, in any implementation. That is, it applies to implementations: 

s That include neither EL2 nor EL3. 

$ That include EL2 but not EL3. 

s That do not include EL2 but include EL3. 

. That include both EL2 and EL3. 


Exceptions taken to Hyp mode 
In an implementation that includes EL2 and EL3, when EL2 is using AArch32: 


. Any exception taken from Hyp mode, that is not routed to EL3 by the controls described in Asynchronous 
exception routing controls on page G1-5530, is taken to Hyp mode. 
$ The following exceptions, if taken from Non-secure state, are taken to Hyp mode: 


— An abort that Routing of aborts taken to AArch32 state on page G1-5520 identifies as taken to Hyp 
mode. 


— A Hyp Trap exception, see EL2 configurable controls on page G1-5585. 
—  AHypervisor Call exception. This is generated by executing an HVC instruction in a Non-secure mode. 


— An SError interrupt exception, IRQ exception or FIQ exception that is not routed to EL3 but is 
explicitly routed to Hyp mode, as described in Asynchronous exception routing controls on 
page G1-5530. 


— A synchronous External abort, Alignment fault, Undefined Instruction exception, or Supervisor Call 
exception taken from the Non-secure ELO mode and explicitly routed to Hyp mode, as described in 
Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 

Note 


A synchronous External abort can be routed to Hyp mode only if it is not routed to EL3. 








— A debug exception that is explicitly routed to Hyp mode as described in Routing debug exceptions to 
EL2 using AArch32 on page G1-5518. 


Note 


The virtual exceptions cannot be taken to Hyp mode. They are always taken to a Non-secure EL1 mode. 








Security behavior in Exception levels using AArch32 when EL2 or EL3 are using 
AArch64 


As described in The Armv8-A security model on page G1-5477, when EL3 is using AArch64, lower Exception 
levels, in either Security state, can be using AArch32. This means software executing in those Exception levels 
might try to access AArch32 security features that are not available. The following subsections describe the 
associated behaviors: 

° Execution of an SMC instruction from a privileged Exception level that is using AArch32 

. Non-secure reads of the NSACR on page G1-5513 


E Secure EL] operations when Secure EL1 is using AArch32 state on page G1-5513 


Execution of an SMC instruction from a privileged Exception level that is using AArch32 


When EL3 is using AArch64, an SMC instruction executed from Secure or Non-secure EL1 using AArch32, or from 
Non-secure EL2 using AArch32 when the value of HCR.TSC is 0, generates an exception that is taken to EL3. The 
exception syndrome is reported with an EC value of 0x13, SMC instruction executed in AArch32 state, see ZSS 
encoding for an exception from SMC instruction execution in AArch32 state on page D13-2936. 
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Non-secure reads of the NSACR 


The NSACR is defined as being RO from Non-secure PE modes other than User mode. When EL3 is using 
AArch64, a read of the NSACR returns a fixed value of 0x00000C00 in the following cases: 


$ If the read is from a Non-secure EL1 mode when EL! is using AArch32. 
s If the read is from Hyp mode when EL2 is using AArch32. 


Secure EL1 operations when Secure EL1 is using AArch32 state 


When Secure EL1 is using AArch32 and if ARMv8.4-SecEL2 is implemented and enabled or EL3 is using 
AArch64: 


° Any of the following operations performed in a Secure EL1 mode is trapped to Secure EL3: 
— Areador write of any of the SCR, NSACR, MVBAR, and SDCR. 
— Executing any of the ATS12NSO** instructions. 
— Executing an SRS instruction that would use SP_mon, see SRS, SRSDA, SRSDB, SRSIA, SRSIB on 
page F5-4555. 


— Executing an MRS (banked register) or MSR (banked register) instruction that would access SPSR_mon, 
SP_mon, or LR_mon, see MRS (Banked register) on page F5-4360 and MSR (Banked register) on 
page F5-4364. 


For more information about these traps, including the associated exception syndromes, see Traps to EL3 of 
Secure monitor functionality from Secure EL1 using AArch32 on page D1-2361. 


è Any attempt to move into Hypervisor mode, either by an exception return or by executing a CPS or MSR 
instruction, is treated as an illegal operation and is handled as described in ///egal return events from AArch32 
state on page G1-5524. 


è Any attempt to move into Monitor mode, either by an exception return or by executing a CPS or MSR 
instruction, is treated as an illegal operation and is handled as described in ///egal return events from AArch32 
state on page G1-5524. 


Note 
This functionality supports a usage model where: 
. EL3 uses AArch6é4. 
° Secure software executed in Secure EL1 using AArch32 and Secure ELO using AArch32. 





. The Non-secure state uses AArch64. 


The possible modes for taking each exception 


Each of the exception descriptions in AArch32 state exception descriptions on page G1-5536 includes a subsection 
that describes the modes to which each exception can be taken. Those subsections are: 


. The PE mode to which the Undefined Instruction exception is taken on page G1-5537. 
. The PE mode to which the Hyp Trap exception is taken on page G1-5540. 

. The PE mode to which the Monitor Trap exception is taken on page G1-5539. 

$ The PE mode to which the Supervisor Call exception is taken on page G1-5540. 

7 The PE mode to which the Secure Monitor Call exception is taken on page G1-5542. 

° The PE mode to which the Hypervisor Call exception is taken on page G1-5543. 

. The PE mode to which the Prefetch Abort exception is taken on page G1-5545. 

. The PE mode to which the Data Abort exception is taken on page G1-5548. 

. The PE mode to which the Virtual SError interrupt exception is taken on page G1-5552. 
. The PE mode to which the physical IRQ exception is taken on page G1-5553. 

. The PE mode to which the Virtual IRQ exception is taken on page G1-5554. 

. The PE mode to which the physical FIQ exception is taken on page G1-5555. 

. The PE mode to which the Virtual FIQ exception is taken on page G1-5556. 
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These descriptions also show the vector offset for the exception entry for each mode. These descriptions assume 
that all Exception levels are using AArch32, meaning: 


. HCR, rather than HCR_EL2, controls the routing of exceptions to EL2. 
° SCR, rather than SCR_EL3, controls the routing of exceptions to EL3. 


For more information about: 
s Vector offsets, see Exception vectors and the exception base address on page G1-5501. 


° The routing of synchronous External aborts or SError, IRQ, and FIQ interrupt exceptions, and the virtual 
exceptions, see Asynchronous exception routing controls on page G1-5530. 


UNPREDICTABLE cases when the value of HCR.TGE is 1 


When the value of HCR.TGE is 1, exceptions that would otherwise be taken to EL1 are, instead, routed to EL2, see 
Routing exceptions from Non-secure ELO to EL2 on page G1-5516. Related to this, when the value of HCR.TGE is 
1, execution in a Non-secure EL] mode is UNPREDICTABLE. Armv8 does not constrain this UNPREDICTABLE 
behavior, but in Armv8 software that follows the Arm recommendations cannot get to this state. When following 
the Arm recommendations, any attempt to move to a Non-secure EL1 mode when the value of HCR.TGE is 1 is 
either: 

$ An illegal exception return, see Illegal return events from AArch32 state on page G1-5524. 


: An illegal PE mode change, see Illegal changes to PSTATE.M on page G1-5497. 


PE state on exception entry 


The description of each exception includes a pseudocode description of entry to that exception, as Table G1-8 on 
page G1-5509 shows. The following sections describe the PE state changes on entering an exception, for different 
implementations and operating states. However, you must always see the exception entry pseudocode for a full 
description of the state changes on exception entry: 

. Instruction set state on exception entry. 

5 PSTATE.E value on exception entry on page G1-5515. 

° PSTATE.{A, I, E M} values on exception entry on page G1-5515. 





Note 


The descriptions in these sections assume that EL2 and EL3, that control some aspects of the routing of exceptions 
taken from EL1 or ELO, are both using AArch32. If this is not the case: 


$ If EL2 is using AArch64: 
— Controls shown as provided by the HSCTLR are provided by the SCTLR_EL2. 
— Controls shown as provided by the HCR are provided by the HCR_EL2. 
. If EL3 is using AArch64, controls shown as provided by the SCR are provided by the SCR_EL3. 





Instruction set state on exception entry 


Exception handlers can execute in either T32 state or A32 state. On exception entry, PSTATE.T is set to the required 
value, as determined by SCTLR.TE or HSCTLR.TE, depending on the mode the exception is taken to. Table G1-11 
shows this: 


Table G1-11 PSTATE.T bit value on exception entry 





Mode to which exception is taken HSCTLR.TE SCTLR.TE PSTATE.T Exception handler state 

















Not Hyp mode x 0 0 A32 
1 1 T32 
Hyp mode 0 x 0 A32 
1 xX 1 T32 
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When an implementation includes EL3 and EL3 is using AArch32, SCTLR is banked for Secure and Non-secure 
states, and therefore the TE bit value might be different for Secure and Non-secure states. For an exception taken to 
a PE mode other than Hyp mode, the SCTLR.TE bit for the Security state to which the exception is taken determines 
the instruction set state for the exception handler. This means the instruction set state in which an exception handler 
might execute depends on the Security state to which the exception is taken. 


PSTATE.E value on exception entry 


PSTATE.E controls the load and store endianness for data handling. Table G1-12 show the value to which this bit 
is set on exception entry: 


Table G1-12 PSTATE.E value on exception entry 

















Exception mode HSCTLR.EE SCTLR.EE Endianness for data loads and stores PSTATE.E 
Secure or Non-secure ELI x 0 Little-endian 0 
1 Big-endian 1 
Hyp 0 x Little-endian 0 
1 x Big-endian 1 
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For more information, see the bit description in Saved Program Status Registers (SPSRs) on page G1-5491. 


PSTATE.{A, I, F, M} values on exception entry 


On exception entry, PSTATE.M is set to the value for the mode to which the exception is taken, as described in PE 
mode for taking exceptions on page G1-5511. 


Table G1-13 shows the cases where PSTATE. {A, I, F} bits are set to 1 on an exception entry, and how this depends 
on the mode and Security state to which an exception is taken. If the table entry for a particular mode and Security 
state does not define a value for a PSTATE. {A, I, F} bit then that bit is unchanged by the exception entry. In this 
table: 


° The PE mode exception is taken to column is the mode to which the exception is taken. 


$ The Non-secure column applies to exceptions taken to Non-secure state in an implementation that includes 
EL3 but does not include EL2. 


e The Secure column applies to: 
— Exceptions taken to Secure state. 
— Implementations that do not include the EL3. 
— Exceptions taken to Non-secure state in an implementation that includes EL2. 


Table G1-13 PSTATE.{A, I, F} values on exception entry 


Security state 
PE mode exception is taken to 
Non-secure Secure 





Hyp If SCR.EA==0 then PSTATE.A is settol  - 
If SCR.IRQ==0 then PSTATE.1 is set to 1 
If SCR.FIQ==0 then PSTATE.F is set to 1 





Monitor - PSTATE.A is set to 1 
PSTATE.I is set to 1 
PSTATE.F is set to 1 
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Table G1-13 PSTATE.{A, I, F} values on exception entry (continued) 





Security state 
PE mode exception is taken to 











Non-secure Secure 
FIQ PSTATE.A is set to 1 PSTATE.A is set to 1 
PSTATE.1 is set to 1 PSTATE.I is set to 1 
PSTATE.F is set to 1 PSTATE.F is set to 1 
IRQ, Abort PSTATE.A is set to 1 PSTATE.A is set to 1 
PSTATE.1 is set to 1 PSTATE.I is set to 1 
Undefined, Supervisor PSTATE.1 is set to 1 PSTATE.I is set to 1 





Asynchronous exception behavior for exceptions taken from AArch32 state on page G1-5528 describes how, in some 
situations, the PSTATE. {A, I, F} bits mask the taking of SError interrupts, IRQ interrupts, and FIQ interrupts. 


Routing exceptions from Non-secure ELO to EL2 


Note 


The routing control described in this section permits a Non-secure state usage model where applications execute in 
User mode under a hypervisor, that executes in Hyp mode, without a Guest OS running at Non-secure EL1. This 
control applies when the PE is executing in Non-secure ELO using AArch32 and EL2 is using AArch32 and the 
value of HCR.TGE is 1. 








If the PE is in Non-secure User mode, any exception that would otherwise be taken to Non-secure EL] is taken to 
EL2 if either: 


a EL2 is using AArch32 and the value of HCR.TGE is 1. 


In this case the exception is taken to Hyp mode, instead of to the default Non-secure mode for handling the 
exception. For more information see Exception reporting when HCR. TGE routes an exception to EL2 using 
AArch32 on page G1-5517. 


s EL2 is using AArch64 and the value of HCR_EL2.TGE is 1. 
In this case the exception is taken to EL2 using AArch64, see Exception entry on page D1-2293. 


Any exception that is routed to Secure Monitor mode or to EL3 using AArch64 is unaffected by the value of 
HCR.TGE or HCR_EL2.TGE. 


When the value of HCR.TGE is 1, meaning TGE routing from Non-secure ELO using AArch32 to EL2 using 
AArch32 applies: 


7 The SCTLR.M bit is treated as 0 for all purposes other than a direct read of the SCTLR register. 


s Each of the HCR. {FMO, IMO, AMO} bits is treated as 1 for all purposes other than a direct read of the HCR 
register 


° Each of the HDCR. {TDE, TDA, TDRA, TDOSA } bits is treated as 1 for all purposes other than a direct read 
of the HDCR register. 


i An exception return to Non-secure EL] is treated as an illegal exception return, see ///egal return events from 
AArch32 state on page G1-5524. 


è All virtual interrupts, including any IMPLEMENTATION DEFINED mechanisms for signaling virtual interrupts, 
are disabled. 
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Exception reporting when HCR.TGE routes an exception to EL2 using AArch32 


The following sections give more information about the behavior of synchronous exceptions that are routed to Hyp 
mode because the value of HCR.TGE is 1: 


$ Undefined Instruction exception, when the value of HCR. TGE is 1. 

5 Supervisor Call exception, when the value of HCR.TGE is 1. 

$ Abort exceptions, when the value of HCR.TGE is 1. 

s Reporting of exceptions routed to EL2 using AArch32 because the value of HCR. TGE is 1 on page G1-5518. 


Undefined Instruction exception, when the value of HCR.TGE is 1 


When HCR.TGE is set to 1, if the PE is executing in Non-secure User mode and attempts to execute an UNDEFINED 
instruction, it takes the Hyp Trap exception, instead of an Undefined Instruction exception. On taking the Hyp Trap 
exception, the HSR reports an unknown reason for the exception, using the EC value 0x00. For more information 
see Use of the HSR on page G5-5836. 


Supervisor Call exception, when the value of HCR.TGE is 1 


When HCR.TGE is set to 1, if the PE executes an SVC instruction in Non-secure User mode, the Supervisor Call 
exception generated by the instruction is taken to Hyp mode. 


The HSR reports that entry to Hyp mode was because of a Supervisor Call exception, and: 
. Tf the SVC is unconditional, takes for the imm16 value in the HSR: 
— A zero-extended 8-bit immediate value for the T32 SVC instruction. 
Note 
The only T32 encoding for SVC is a 16-bit instruction encoding. 








— The bottom16 bits of the immediate value for the A32 SVC instruction. 
° If the SVC is conditional, the imm16 value in the HSR is UNKNOWN. 


If the SVC is conditional, the PE takes the exception only if the instruction passes its Condition code check. 


The HSR reports the exception as a Supervisor Call exception taken to Hyp mode, using the EC value 0x11. For 
more information, see Use of the HSR on page G5-5836. 


Note 

The effect of setting HCR.TGE to 1 is to route the Supervisor Call exception to Hyp mode, not to trap the execution 
of the SVC instruction. This means that the preferred return address for the exception, when routed to Hyp mode in 
this way, is the instruction after the SVC instruction. 





Abort exceptions, when the value of HCR.TGE is 1 


When the value of HCR.TGE is 1, if the PE is executing in Non-secure User mode then any abort exception that is 
not routed to Secure Monitor mode or to EL3 using AArch64 generates an exception that is taken as a Hyp Trap 
exception. Where an attempt to execute an instruction causes an abort, on taking the Hyp Trap exception, the HSR 
indicates whether a Data Abort exception or a Prefetch Abort exception caused the Hyp Trap exception entry, and 
presents a valid syndrome in the HSR. 


When SCR.EA is set to 1, External aborts and SError interrupts are routed to EL3, and this routing takes priority 
over the HCR.TGE routing. For more information, see Routing of aborts taken to AArch32 state on page G1-5520. 


An SError interrupt that is routed to Hyp mode because the value of HCR.TGE is 1 is reported as a Data Abort 
exception routed to Hyp mode. 


The HSR reports the exception either: 
. As a Prefetch Abort exception routed to Hyp mode, using the EC value 0x20. 
° As a Data Abort exception routed to Hyp mode, using the EC value 0x24. 


For more information about the exception reporting, see Use of the HSR on page G5-5836. 
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Reporting of exceptions routed to EL2 using AArch32 because the value of HCR.TGE is 1 


PL1 configurable controls on page G1-5577 describes controls that, when the value of HCR.TGE is 0, can generate 
exceptions that are taken from Non-secure ELO to EL1. When EL2 is using AArch32 and the value of HCR.TGE 
is 1, the exceptions generated by these controls are routed to Hyp mode. Table G1-14 shows how these exceptions 
are then reported in the HSR. 


Table G1-14 Syndrome reporting in HSR from HCR.TGE routing of traps, disables, and enables 





Control provided 


by PL1 Control type? Syndrome reporting in HSR 



































SCTLR. {nTWE, nTWI} T Uses EC value 0x00, Exception for an unknown reason 
SCTLR.{SED, ITD} D Uses EC value 0x00, Exception for an unknown reason 
SCTLR.CP1I5BEN E Uses EC value 0x00, Exception for an unknown reason 
CPACR.TRCDIS T Uses EC value 0x00, Exception for an unknown reason 
CPACR. {cp11, cp10} E Uses EC value 0x00, Exception for an unknown reason 
FPEXC.EN E Uses EC value 0x00, Exception for an unknown reason 
CPACR.ASEDIS D Uses EC value 0x00, Exception for an unknown reason 
DBGDSCRext.UDCCdis T Uses EC value 0x00, Exception for an unknown reason 
CNTKCTL.{PLOPTEN, PLOVTEN, PLOPCTEN, T Uses EC value 0x00, Exception for an unknown reason 
PLOVCTEN} 

PMUSERENR. {ER, CR, SW, EN} T Uses EC value 0x00, Exception for an unknown reason 





a. T indicates a trap control, E indicates an instruction enable, and D indicates an instruction disable. For the definition of these terms, see the 
list that begins with Instruction enables and instruction disables on page G1-5576. 


G1.12.7 Routing debug exceptions to EL2 using AArch32 


G1-5518 


When the value of HDCR.TDE is 1, if the PE is executing in a Non-secure mode other than Hyp mode, any Debug 
exception is routed to Hyp mode. This means it generates a Hyp Trap exception. This applies to: 


. Debug exceptions associated with an instruction fetch, that would otherwise generate a Prefetch Abort 
exception. These are the Breakpoint, Breakpoint Instruction, and Vector Catch exception, see Chapter G2 
AArch32 Self-hosted Debug. 


: Watchpoint exceptions associated with data accesses, that would otherwise generate a Data Abort exception. 
See Watchpoint exceptions on page G2-5653. 


When the value of HDCR.TDE is 1, each of the HDCR. {TDRA, TDOSA, TDA} bits is treated as 1 for all purposes 
other than reading the HDCR register. 





Note 


$ A Breakpoint or Watchpoint debug event that generates entry to Debug state cannot be trapped to Hyp mode. 
See Breakpoint and Watchpoint debug events on page H2-6706. 


7 When HDCR.TDE is set to 1, the Hyp Trap exception is generated instead of the Prefetch Abort exception 
or Data Abort exception that is otherwise generated by the Debug exception. 


è Debug exceptions, other than Breakpoint Instruction exceptions, are never generated in Hyp mode. 





When a Hyp Trap exception is generated because the value of HDCR.TDE is 1, The HSR reports the exception 
either: 


. As a Prefetch Abort exception routed to Hyp mode, using the EC value 0x20. 
è As a Data Abort exception routed to Hyp mode, using the EC value 0x24. 
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For more information see Use of the HSR on page G5-5836. 
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G1.13 Routing of aborts taken to AArch32 state 


A memory abort is either a Data Abort exception or a Prefetch Abort exception. When executing in AArch32 state, 
depending on the cause of the abort, and possibly on configuration settings, an abort is taken either: 


s To the Exception level of the PE mode from which the abort is taken. In this case the abort is taken to 
AArch32 state. 
° To a higher Exception level. In this case the Exception level to which the abort is taken is either: 


— Using AArch32. In this case, this chapter describes how the abort is handled. 
— Using AArch64. In this case, Chapter D5 The AArch64 Virtual Memory System Architecture describes 
how the abort is handled. 


For an abort taken to an Exception level that is using AArch32, the mode to which a memory abort is taken depends 
on the reason for the exception, the mode the PE is in when it takes the exception, and configuration settings, as 
follows: 


Memory aborts taken to Monitor mode 


If an implementation includes EL3, when the value of SCR.EA is 1, all External aborts are taken to 
EL3, and if EL3 is using AArch32 they are taken to Monitor mode. This applies to aborts taken from 
Secure modes and from Non-secure modes. 


Memory aborts taken to Secure Abort mode 


If an implementation includes EL3, when the PE is executing in Secure state, all memory aborts that 
are not routed to EL3 are taken to Secure Abort mode. 


Note 


The only memory aborts that can be routed to Monitor mode are External aborts. 








Memory aborts taken to Hyp mode 


If an implementation includes EL2, when the PE is executing in Non-secure state, the following 
aborts are taken to EL2. If EL2 is using AArch32 this means they are taken to Hyp mode: 


s; Alignment faults taken: 
— When the PE is in Hyp mode. 


— When the PE is in a Non-secure PL1 or ELO mode and the exception is generated 
because the Non-secure PL1&0 stage 2 translation identifies the target of an unaligned 
access as any type of Device memory. 


— When the PE is in Non-secure User mode and HCR.TGE is set to 1. For more 
information see Abort exceptions, when the value of HCR.TGE is 1 on page G1-5517. 


- When the PE is using the Non-secure PL1&0 translation regime: 


— MMU faults from stage 2 translations, for which the stage 1 translation did not cause 
an MMU fault. 


— Any abort taken during the stage 2 translation of an address accessed in a stage 1 
translation table walk that is not routed to Secure Monitor mode, see Stage 2 fault on 
a stage 1 translation table walk on page G5-5817. 


g When the PE is using the Non-secure EL2 translation regime, MMU faults from stage 1 
translations. 


Note 


The Non-secure EL2 translation regime has only one stage of translation. 








° External aborts, if SCR.EA is set to 0 and any of the following applies: 


— The PE was executing in Hyp mode when it took the exception. 
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— The PE was executing in a Non-secure PL1 or ELO mode when it took the exception, 
the abort is asynchronous, and HCR.AMO is set to 1. For more information see 
Asynchronous exception routing controls on page G1-5530. 


— The PE was executing in the Non-secure User mode when it took the exception, the 
abort is synchronous, and HCR.TGE is set to 1. For more information see Abort 
exceptions, when the value of HCR.TGE is 1 on page G1-5517. 


— The The Reliability, Availability, and Serviceability Extension (RAS Extension) is 
implemented, the PE was executing in a Non-secure PL1 or ELO mode when it took 
the exception, the abort is synchronous, and the value of HCR2.TEA is 1. 


— The abort occurred on a stage 2 translation table walk. 
è Debug exceptions, if HDCR.TDE is set to 1. For more information, see Routing debug 
exceptions to EL2 using AArch32 on page G1-5518. 
Memory aborts taken to Non-secure Abort mode 


In an implementation that does not include EL3, all memory aborts that are taken to an Exception 
level that is using AArch32 are taken to Abort mode. 


Otherwise, when the PE is executing in Non-secure state, the following aborts are taken to 
Non-secure Abort mode: 


s When the PE is in a Non-secure PL1 or ELO mode, Alignment faults taken for any of the 
following reasons: 
—  SCTLR.A is set to 1. 


— An instruction that does not support unaligned accesses is committed for execution, 
and the instruction accesses an unaligned address. 


— The PL1&0 stage | translation identifies the target of an unaligned access as any type 
of Device memory. 


Note 


In an implementation that does not include EL2, this case results in a CONSTRAINED 
UNPREDICTABLE memory access, see Cases where unaligned accesses are 
CONSTRAINED UNPREDICTABLE on page E2-3835 and Loads and Stores to 
unaligned locations on page K1-7608. 





If an implementation includes EL2 and the PE is in Non-secure User mode, these exceptions 
are taken to Abort mode only if the value of HCR.TGE is 0. 


. When the PE is using the Non-secure PL1&0 translation regime, an MMU fault from a stage 
1 translation. 


. External aborts, if the PE was executing in a Non-secure PL1 or ELO mode when it took the 
exception and both: 
— The value of SCR.EA is 0, meaning the abort is not taken to EL3. 
— The abort is not taken to EL2 for one of the reasons defined in Memory aborts taken 
to Hyp mode. 


od Virtual Aborts, see Virtual exceptions when an implementation includes EL2 on 
page G1-5528. 


d When the value of HDCR.TDE is 0, Debug exceptions. For more information, see Routing 
debug exceptions to EL2 using AArch32 on page G1-5518. 


— Note 


If ELO is using AArch32 and EL1 is using AArch64 then any of these memory aborts taken from 
User mode are taken to EL1 as described in Chapter D5 The AArch64 Virtual Memory System 
Architecture. 
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Memory aborts with IMPLEMENTATION DEFINED behavior 


In addition, a PE can generate an abort for an IMPLEMENTATION DEFINED reason associated with 
lockdown. In an implementation that includes EL2, whether such an abort is taken to Non-secure 
Abort mode or is taken to EL2 is IMPLEMENTATION DEFINED, and an implementation might include 
a mechanism to select whether the abort is routed to Non-secure Abort mode or to EL2. 


When the PE is in a Non-secure mode other than Hyp mode, if multiple factors cause an Alignment fault, the abort 
is taken to Non-secure Abort mode if any of the factors require the abort to be taken to Abort mode. For example, 
if the SCTLR.A bit is set to 1, and the access is an unaligned access to an address that the stage 2 translation tables 
mark as Device-nGnRnE, then the abort is taken to Non-secure Abort mode. 


For more information see Handling exceptions that are taken to an Exception level using AArch32 on 
page G1-5501. 
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G1.14 Exception return to an Exception level using AArch32 


In the Arm architecture, exception return to an Exception level that is using AArch32 requires the simultaneous 
restoration of the PC and PSTATE to values that are consistent with the desired state of execution on returning from 
the exception. Typically, exception return involves returning to one of: 


è The instruction after the instruction boundary at which an asynchronous exception was taken. 

. The instruction following an SVC, SMC, or HMC instruction, for an exception generated by one of those 
instructions. 

a The instruction that caused the exception, after the reason for the exception has been removed. 

° The subsequent instruction, if the instruction that caused the exception has been emulated in the exception 
handler. 


The Arm architecture defines a preferred return address for each exception other than Reset, see Link values saved 
on exception entry on page G1-5509. The values of the SPSR.IT[7:0] bits generated on exception entry are always 
correct for this preferred return address, but might require adjustment by the exception handler if returning 
elsewhere. 


In some cases, to calculate the appropriate preferred return address for a return to an Exception level that is using 
AArch32, a subtraction must be performed on the link value saved on taking the exception. The description of each 
exception includes any value that must be subtracted from the link value, and other information about the required 
exception return. 


On an exception return, the PSTATE takes either: 
° The value loaded by the RFE instruction. 


7 If the exception return is not performed by executing an RFE instruction, the value of the current SPSR at the 
time of the exception return. 


If ARMv8.5-MemTag is implemented PSTATE.TCO is not updated on Exception return to AArch32 state. 


Illegal return events from AArch32 state on page G1-5524 describes the behavior if the restored PE state would not 
be valid for the Exception level, PE mode, and Security state targeted by the exception return. 


G1.14.1 Exception return instructions 
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The instructions that an exception handler can use to return from an exception depend on whether the exception was 
taken to an EL1 mode, or in an EL2 mode, see: 


$ Return from an exception taken to a PE mode other than Hyp mode. 
s Return from an exception taken to Hyp mode on page G1-5524. 


Return from an exception taken to a PE mode other than Hyp mode 


For an exception taken to a PE mode other than Hyp mode, the Arm AArch32 architecture provides the following 
exception return instructions: 


: From privileged modes other than System mode, the ERET instruction. After the exception return, execution 
resumes from the address held in the LR (R14) for the mode in which ERET is executed. See ERET on 
page F5-4195. 


° Data-processing instructions with the S bit set and the PC as a destination, see MOV, MOVS (register) on 
page F5-4343 and SUB, SUBS (immediate) on page F5-4657. 
Note 


The A32 instruction set includes other instructions that can be used for an exception return, but Arm 
deprecates any use of those instructions. 
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Typically: 


— A return where no subtraction is required uses SUBS with an operand of 0, or the equivalent MOVS 
instruction. 


— A return requiring subtraction uses SUBS with a nonzero operand. 


è? The RFE instruction, see RFE, RFEDA, RFEDB, RFEIA, RFEIB on page F5-4450. Ifa subtraction is required, 
typically it is performed before saving the LR value to memory. After the exception return, execution resumes 
from the address held in the memory location indicated by the base register specified by the RFE instruction. 


° In A32 state, a form of the LDM instruction in which the PC is one of the registers loaded, see LDM (exception 
return) on page F5-4228. If a subtraction is required, typically it is performed before saving the LR value to 
memory. 


Return from an exception taken to Hyp mode 


For an exception taken to Hyp mode, the Arm architecture provides the ERET instruction, see ERET on page F5-4195. 
An exception handler executing in Hyp mode must return using the ERET instruction. 


Hyp mode is implemented only as part of EL2. 


G1.14.2 Alignment of exception returns 


The T bit of the value transferred to the PSTATE by an exception return controls the target instruction set of that 
return. The behavior of the hardware for exception returns for different values of the T bit is as follows: 





T= The target instruction set state is A32 state. Bits[1:0] of the address transferred to the PC are ignored 
by the hardware. 
T == The target instruction set state is T32 state: 
- Bit[0] of the address transferred to the PC is ignored by the hardware. 
š Bit[1] of the address transferred to the PC is part of the instruction address. 
Note 
In previous versions of the Arm architecture, the PSTATE. {J, T} bits determined the Instruction set state. In Armv8, 
PSTATE.J is RESO. 


Arm deprecates any dependence on the requirements that the hardware ignores bits of the address. Arm 
recommends that the address transferred to the PC for an exception return is correctly aligned for the target 
instruction set. 


After an exception entry other than Reset, the LR value has the correct alignment for the instruction set indicated 
by the SPSR.T bit. This means that if exception return instructions are used with the LR and SPSR values produced 
by such an exception entry, the only precaution software needs to take to ensure correct alignment is that any 
subtraction is of a multiple of four if returning to A32 state, or a multiple of two if returning to T32 state. 


G1.14.3 Illegal return events from AArch32 state 


Throughout this section: 


Return In AArch32 state, refers to any of: 
5 Execution of any exception return instruction. 
° Execution of a DRPS instruction in Debug state. 
° Exit from Debug state. 


If an exception or debug return from an Exception level using AArch32 triggers an illegal exception 
return, then bit[1] of the PC is either: 


s Zero. 
° The value of bit[1] of the return address for the exception or debug return. 
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The choice between these two alternatives is made by the implementation, and might differ from 
instance to instance of an illegal exception return. 


Note 


This means software must support both alternatives. 








Saved process state value 


In AArch32 state, refers to any of: 


s The value held in the SPSR for any exception return other than an exception return made by 
executing an RFE instruction. 

s The value read from memory that is to be restored to PSTATE by the execution of an RFE 
instruction. 

° The value held in the SPSR for the execution of a DRPS instruction in Debug state. 


e The value held in the DSPSR for a Debug state exit. 


Link address In AArch32 state, refers to any of: 


a The address held in the link register for any exception return other than an exception return 
made by executing an ERET, LDM, or RFE instruction. 

è The address held in ELR_hyp for any exception return made by executing an ERET instruction. 

° The address read from memory that is to be restored to the PC by the execution of an LDM or 


RFE instruction. 
° The address held in the DLR for Debug state exit. 


Configured from reset 


Indicates the state determined on powerup or reset by a configuration input signal, or by another 
IMPLEMENTATION DEFINED mechanism. 


The Armv8 architecture has a generic mechanism for handling exception or debug returns to a mode or state that is 
illegal. In AArch32 state, this can occur as a result of any of the following situations: 


A return where the Exception level being returned to is higher than the current Exception level. 


A return where the mode being returned to is not implemented. For example: 
—  Areturn to Hyp mode when EL2 is not implemented. 


— Areturn to Monitor mode, when EL3 is either not implemented or using AArch64 state. 


A return to EL2 when: 
—  EL3 is implemented and using AArch64, and the values of SCR_EL3.{NS, EEL2} 0. 
— _ EL3 is implemented and using AArch32, and the value of the SCR.NS bit is 0. 


A return to Non-secure EL1 when: 
—  EL2 is implemented and using AArch64, and the value of the HCR_EL2.TGE bit is 1. 
—  EL2 is implemented and using AArch32, and the value of the HCR.TGE bit is 1. 


A return where the value of the saved process state M[4:0] field is not a valid AArch32 PE mode for the 
implementation. Table G1-5 on page G1-5484 shows the valid M[4:0] values for AArch32 PE modes. 


In these cases: 


PSTATE.IL is set to 1, to indicate an illegal return. 
PSTATE.M is unchanged. This means the PE mode does not change. 


The SS bit is handled in the same way as any other exception or debug return, see Software Step exceptions 
on page D2-2446. 
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° The following PSTATE bits are restored from the saved process state value: 
— TheN,Z, C, V Condition flags. 
— The Q Overflow or saturation flag. 
— The GE Greater than or Equal flags. 
— The E Endianness mapping bit. 
— TheA, I, F exception mask bits. 
— The DIT Data Independent Timing bit. 


° The PSTATE. {IT, T} bits are each either: 
— Set to0. 
— Copied from the saved process state in the SPSR for the PE mode in which the exception is handled. 


The choice between these two options is determined by an implementation, and might vary dynamically 
within an implementation. Correspondingly software must regard the value as being an UNKNOWN choice 
between the two values. 


s The PC is restored from the link address, unless the illegal return is the execution of a DRPS instruction in 
Debug state. 


When the value of the PSTATE.IL bit is 1, any attempt to execute any instruction results in an Illegal Execution state 
exception. See The Illegal Execution state exception. 


All aspects of the illegal return, other than the effects described in this section, are the same as for a legal return. 


Legal returns that set PSTATE.IL to 1 


In this section, return, saved process state value, and link address have the meaning that is defined in ///egal return 
events from AArch32 state on page G1-5524. 


If the IL bit in the saved process state value is 1, then it is copied to PSTATE meaning that PSTATE.IL is set to 1. 
In this case, the PSTATE. {IT, T} bits are each either: 


$ Set to 0. 
° Copied from the SPSR, or loaded from memory if the exception return was performed by executing an RFE 
instruction. 


The choice between these two options is determined by an implementation, and might vary dynamically within the 
implementation. This means software must regard each value as being an UNKNOWN choice between the two 
permitted values. 


Because the return sets the PSTATE.IL bit to 1, any attempt to execute any instruction results in an Illegal Execution 
state exception. See The Illegal Execution state exception. 


The Illegal Execution state exception 


When the value of the PSTATE.IL bit is 1, any attempt to execute an instruction generates an Illegal Execution state 
exception. In AArch32 state, the PSTATE.IL bit can be set to 1 by one of the following: 


7 An illegal return, as described in J/legal return events from AArch32 state on page G1-5524. 
à An illegal change to PSTATE.M, as described in ///egal changes to PSTATE.M on page G1-5497. 
s A legal return that sets PSTATE.IL to 1, as described in Legal returns that set PSTATE.IL to 1. 


An Illegal Execution state exception is taken in the same way as an Undefined Instruction exception in the current 
Exception level. If the current Exception level is EL2 using AArch32 state, the HSR provides additional syndrome 
information for the exception, see Use of the HSR on page G5-5836. 


An Illegal Execution state exception has priority over any other Undefined Instruction exception that might arise 
from instruction execution. 
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Note 


This section only describes the handling of an Illegal Execution state exception that is taken to an Exception level 
that is using AArch32 state. The Illegal Execution state exception on page D1-2306 describes the cases where an 
Illegal Execution state exception is taken to an Exception level that is using AArch64 state. 








On taking any exception to an Exception level that is using AArch32 state: 


1. The value of the PSTATE.IL bit is 1 and this is copied to the SPSR.IL bit for the PE mode to which the 
exception is taken. 


2. The PSTATE.IL bit is cleared to 0. 


Note 


This means that it is not possible for software to observe the value of PSTATE.IL. 





Pseudocode description of exception return 


The AArch32.ExceptionReturn() function transfers the return address to the PC and restores PSTATE to its saved 
value. 


This function uses the function SetPSTATEFromPSR(). 
The I]legalExceptionReturn() function checks for an Illegal Execution state exception. 


Chapter J1 Armv8 Pseudocode includes the definitions of these functions. 
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Asynchronous exception behavior for exceptions taken from AArch32 state 


In an implementation that does not include EL2 or EL3, the asynchronous exceptions behave as follows when EL1 
and ELO are both using AArch32: 


è An SError interrupt is taken to Abort mode. 
s An IRQ exception is taken to IRQ mode. 
. An FIQ exception is taken to FIQ mode. 


These are the default PE modes for taking these exceptions. 


Note 


The SError interrupt replaces the Armv7 asynchronous abort. The new name better describes the nature of the 
exception. 








However, the PSTATE. {A, I, F} bits mask the asynchronous exceptions, meaning that when the value of one of these 
PSTATE bits is 1, the corresponding exception is not taken. 


Ifa masked asynchronous exception remains signaled, then the exception remains pending unless the value of the 
PSTATE bit is changed to 0. 


EL2 and EL3 provide controls that affect: 
è The routing of these exceptions, see Asynchronous exception routing controls on page G1-5530. 


- Masking of these exceptions in Non-secure state, see Asynchronous exception masking controls on 
page G1-5531. 


Similar register control bits are provided regardless of whether EL2 and EL3 are using AArch32 or AArch64: 


` The EL2 controls are provided by the HCR when EL2 is using AArch32, and by the HCR_EL2 when EL2 is 
using AArch64. 


s The EL3 controls are provided by the SCR when EL3 is using AArch32, and by the SCR_EL3 when EL3 is 
using AArch64. 


Therefore, most references to the HCR or SCR in this section are to entries in Table K14-1 on page K 14-7810, that 
disambiguates between AArch32 registers and AArch64 registers. However, the Execution states used by EL2 and 
EL3 do affect some aspects of the routing and masking of the asynchronous exceptions, see Asynchronous exception 
routing and masking with higher Exception levels using AArch64 on page G1-5533. 


Virtual exceptions when an implementation includes EL2 


When implemented, EL2 provides the following virtual exceptions, that correspond to the physical asynchronous 
exceptions: 


7 Virtual SError, that corresponds to a physical external SError interrupt. 
s Virtual IRQ, that corresponds to a physical IRQ. 
s Virtual FIQ, that corresponds to a physical FIQ. 


When the value of HCR.TGE is 0 and the value of an HCR. {AMO, IMO, FMO} routing control bit is 1, the 
corresponding virtual interrupt is enabled and a virtual exception is generated either: 


$ By setting the corresponding virtual interrupt pending bit, HCR. {VA, VI, VF}, to 1. 


: For a Virtual IRQ or Virtual FIQ, by an IMPLEMENTATION DEFINED mechanism. This might be a signal from 
an interrupt controller. See, for example, the ARM Generic Interrupt Controller Architecture Specification. 


When the value of HCR_EL2.TGE is 1 all virtual interrupts are disabled. 


When a virtual interrupt is disabled: 


° It cannot be taken. 
° It cannot be seen in the ISR. 
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In AArch32 state, a virtual exception is taken only from a Non-secure EL1 or ELO mode. In any other mode, if the 
exception is generated it is not taken. 


A virtual exception is taken in Non-secure state to the default mode for the corresponding physical exception. This 
means: 


° A Virtual SError is taken to Non-secure Abort mode. 
. A Virtual IRQ is taken to Non-secure IRQ mode. 
° A Virtual FIQ is taken to Non-secure FIQ mode. 


Table G1-15 summarizes the HCR bits that route asynchronous exceptions to EL2, and the bits that generate the 
virtual exceptions. 


Table G1-15 HCR bits controlling asynchronous exceptions 





Exception Routing the physical exception to EL2 Generating the virtual exception 











SError HCR.AMO HCR.VA 
IRQ HCR.IMO HCR.VI 
FIQ HCR.FMO HCR.VF 





The HCR.{VA, VI, VF} bits generate a virtual exception only if set to 1 when the value of the corresponding 
HCR. {AMO, IMO, FMO} is 1. 


Similarly, if the implementation also includes EL3, the HCR. {AMO, IMO, FMO} bits route the corresponding 
physical exception to Hyp mode only if the physical exception is not routed to Monitor mode by the SCR. {EA, IRQ, 
FIQ} bit. For more information, see Asynchronous exception routing controls on page G1-5530. 


When the value of an HCR. {AMO, IMO, FMO} control bit is 1, the corresponding mask bit in PSTATE: 
s Does not mask the physical exception. 
s Masks the virtual exception when the PE is executing in a Non-secure EL1 or ELO mode. 


Taking a Virtual Abort exception clears HCR.VA to zero. Taking a Virtual IRQ exception or a Virtual FIQ exception 
does not affect the value of HCR.VI or HCR.VF. 


Note 


This means that the exception handler for a Virtual IRQ exception or a Virtual FIQ exception must cause software 
that is executing at EL2 or EL3 to update the HCR to clear the appropriate virtual exception bit to 0. 








See WFE wake-up events on page G1-5564 and Wait For Interrupt on page G1-5565 for information about how 
virtual exceptions affect wake up from power-saving states. 





Note 

A hypervisor can use virtual exceptions to signal exceptions to the current Guest OS. The Guest OS takes a virtual 
exception exactly as it would take the corresponding physical exception, and is unaware of any distinction between 
virtual exception and the corresponding physical exception. 





Effects of the HCR.{AMO, IMO, FMO} bits 


As described in this section, the HCR.{AMO, IMO, FMO} bits are part of the mechanism for enabling the virtual 
exceptions. In addition, for exceptions generated in Non-secure state: 


$ As mentioned in this section, affect the routing of the exceptions. See Asynchronous exception routing 
controls on page G1-5530. 


à Affect the masking of the exceptions. See Asynchronous exception masking controls on page G1-5531. 
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Asynchronous exception routing controls 





Note 


This section describes the behavior when all Exception levels are using AArch32. For the differences when this is 
not the case see Asynchronous exception routing and masking with higher Exception levels using AArch64 on 
page G1-5533. 





In an implementation that includes EL3 the following bits in the SCR control the routing of asynchronous 
exceptions: 


SCR.EA When the value of this bit is 1, any SError interrupt is taken to EL3. 





Note 


Although this section describes the asynchronous exception routing controls, SCR.EA also controls 
the routing of synchronous External aborts, see Routing of aborts taken to AArch32 state on 
page G1-5520. 





SCR.FIQ When the value of this bit is 1, any FIQ exception is taken to EL3. 
SCR.IRQ When the value of this bit is 1, any IRQ exception is taken to EL3. 


When EL3 is using AArch32 and the value of one of the SCR. {EA, FIQ, IRQ} bits is 1, the exception is taken to 
Monitor mode. 


Only Secure software can change the values of these bits. 


In an implementation that includes EL2, the following bits in the HCR route asynchronous exceptions to EL2, for 
exceptions that are both: 


. Taken from a Non-secure EL1 or ELO mode. 


. If the implementation also includes EL3, not configured, by the SCR. {EA, FIQ, IRQ} controls, to be taken 
to EL3. 


HCR.AMO When the value of this bit is 1, an SError interrupt exception taken from a Non-secure EL1 or ELO 
mode is taken to EL2, instead of to Non-secure Abort mode. If the implementation also includes 
EL3, this control applies only if the value of SCR.EA is 0. When the value of SCR.EA is 1, the value 
of the AMO bit is ignored. 


HCR.FMO When the value of this bit is 1, an FIQ exception taken from a Non-secure EL1 or ELO mode is taken 
to EL2, instead of to Non-secure FIQ mode. If the implementation also includes EL3, this control 
applies only if the value of SCR.FIQ is 0. When the value of SCR.FIQ is 1, the value of the FMO 
bit is ignored. 


HCR.IMO When the value of this bit is 1, an IRQ exception taken from a Non-secure EL1 or ELO mode is taken 
to EL2, instead of to Non-secure IRQ mode. If the implementation also includes EL3, this control 
applies only if the value of SCR.IRQ is 0. When the value of SCR.IRQ is 1, the value of the IMO 
bit is ignored. 


When EL2 is using AArch32 and the value of one of the HCR. {AMO, FMO, IMO} bits is 1, the exception is taken 
to Hyp mode. 


Only software executing in Hyp mode, or Secure software executing at EL3 with SCR.NS set to 1, can change the 
values of these bits. If EL3 is using AArch32, this requires the Secure software to be executing in Monitor mode. 


The HCR.{AMO, FMO, IMO} bits also affect the masking of asynchronous exceptions in Non-secure state, as 
described in Asynchronous exception masking controls on page G1-5531. 


The SCR. {EA, FIQ, IRQ} and HCR. {AMO, FMO, IMO} bits have no effect on the routing of Virtual Abort, Virtual 
FIQ, and Virtual IRQ exceptions. 
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Note 
When the PE is in Hyp mode: 
7 Physical asynchronous exceptions that are not routed to Monitor mode are taken to Hyp mode. 
è Virtual exceptions are not signaled to the PE. 





See also Asynchronous exception behavior for exceptions taken from AArch32 state on page G1-5528. 


G1.15.3 Asynchronous exception masking controls 
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Note 


This section describes the behavior when all Exception levels are using AArch32. For the differences when this is 
not the case see Asynchronous exception routing and masking with higher Exception levels using AArch64 on 
page G1-5533. 








The PSTATE. {A, I, F} bits can mask the taking of the corresponding exceptions from AArch32 state, as follows: 
e PSTATE.A can mask SError interrupt exceptions. 

. PSTATE.I can mask IRQ exceptions. 

. PSTATE.F can mask FIQ exceptions. 


In an implementation that does not include either of EL2 and EL3, setting one of these bits to 1 masks the 
corresponding exception, meaning the exception cannot be taken. 


In an implementation that includes EL2, the HCR. {AMO, IMO, FMO} bits modify the masking of exceptions taken 
from Non-secure state. 


Similarly, in an implementation that includes EL3, the SCR. {AW, FW} bits modify the masking of exceptions taken 
from Non-secure state by the PSTATE. {A, F} bits. 


An implementation that includes only EL1 and ELO does not provide any masking of the PSTATE. {A, I, F} bits. 
The following subsections describe the masking of these bits in other implementations: 


. Asynchronous exception masking in an implementation that includes EL2 but not EL3. 
è Asynchronous exception masking in an implementation that includes EL3 but not EL2. 
° Asynchronous exception masking in an implementation that includes both EL2 and EL3 on page G1-5532. 


. Summary of the asynchronous exception masking controls on page G1-5532. 


Asynchronous exception masking in an implementation that includes EL2 but not EL3 


The HCR.{AMO, IMO, FMO} bits modify the effect of the PSTATE. {A, I, F} bits. When the value of an 
HCR. {AMO, IMO, FMO} mask override bit is 1, the value of the corresponding PSTATE. {A, I, F} bit is ignored 
when the exception is taken from a Non-secure mode other than Hyp mode. 


Asynchronous exception masking in an implementation that includes EL3 but not EL2 
The SCR. {AW, FW} bits modify the effect of the PSTATE. {A, F} bits. When the value of one of the 

SCR. {AW, FW} bits is 0, the corresponding PSTATE bit is ignored when both of the follow apply: 

s The corresponding exception is taken from Non-secure state. 


$ The value of the corresponding SCR. {EA, FIQ} bit is 1, routing the exception to EL3. This means the 
exception is routed to Monitor mode if EL3 is using AArch32. 


Note 
Whenever the value of PSTATE.I is 1, IRQ exceptions are masked and cannot be taken. 
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Asynchronous exception masking in an implementation that includes both EL2 and EL3 


When the value of an HCR. {AMO, IMO, FMO} mask override bit is 1, the value of the corresponding PSTATE. {A, 
I, F} bit is ignored when both of the following apply: 
$ The exception is taken from Non-secure state. 
s Either: 
— The corresponding SCR. {EA, IRQ, FIQ} bit routes the exception to Monitor mode. 
— The exception is taken from a Non-secure mode other than Hyp mode. 


In addition, when the value of an SCR. {AW, FW} bit is 0, the value of the corresponding PSTATE. {A, F} bit is 
ignored when all of the following apply: 

s The exception is taken from Non-secure state. 

s The corresponding SCR. {EA, FIQ} bit routes the exception to Monitor mode. 

° The corresponding HCR. {AMO, FMO} mask override bit is set to 0. 


Summary of the asynchronous exception masking controls 


The tables in this section show the masking controls for each of the PSTATE. {A, I, F} bits. For an implementation 
that does not include all of the Exception levels: 


If the implementation includes only EL1 and ELO 
The PSTATE bits cannot be masked. The behavior is as shown in the Secure row of the tables. 


If the implementation includes EL2 but not EL3 


The behavior is as shown in the Non-secure table rows when the control bits in the SCR are both 0. 


If the implementation includes EL3 but not EL2 


The behavior is as shown in the table rows where the control bit in the HCR is 0. 


Table G1-16 shows the controls of the masking of SError interrupt exceptions by PSTATE.A. 


Table G1-16 Control of masking by PSTATE.A 





Security state HCR.AMO SCR.EA SCR.AW Mode PSTATE.A 





























Secure x x x x Masks SError interrupt, when set to 1 
Non-secure 0 0 x x Masks SError interrupt, when set to 1 
1 0 x Ignored 
1 x Masks SError interrupt, when set to 1 
1 x x Not Hyp Ignored 
0 xX Hyp Masks SError interrupt, when set to 1 
1 x x Ignored 
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Table G1-17 shows the controls of the masking of IRQ exceptions by PSTATE.I: 


Table G1-17 Control of masking by PSTATE.| 





Security state HCRIMO SCR.IRQ Mode PSTATE.I 

















Secure x xX x Masks IRQs, when set to 1 
Non-secure 0 xX x Masks IRQs, when set to 1 
1 x Not Hyp Ignored 
0 Hyp Masks IRQs, when set to 1 

1 x Ignored 





Table G1-18 shows the controls of the masking of FIQ exceptions by PSTATE.F: 


Table G1-18 Control of masking by PSTATE.F 





Security state HCR.FMO SCR.FIQ SCR.FW Mode PSTATE.F 


























Secure x xX xX xX Masks FIQs, when set to 1 
Non-secure 0 0 xX xX Masks FIQs, when set to 1 
1 0 x Ignored 
1 x Masks FIQs, when set to 1 
1 x xX Not Hyp Ignored 
0 x Hyp Masks FIQs, when set to 1 
1 x x Ignored 





G1.15.4 Asynchronous exception routing and masking with higher Exception levels using AArch64 


ARM DDI 0487E.a 
ID070919 


Asynchronous exception routing controls on page G1-5530 and Asynchronous exception masking controls on 
page G1-5531 give full descriptions of the routing and masking of the asynchronous exceptions when all Exception 
levels are using AArch32. However, when ELO and EL! are using AArch32: 


° As already described, the SCR and HCR controls might be from Exception levels that are using AArch64. 


° If EL3 is using AArch64, or EL2 is using AArch64, there are some changes to the asynchronous exception 
behaviors. 


Therefore, the following sections summarize the asynchronous exception behaviors, taking account of the 
Execution state being used at EL2 and EL3: 

7 Summary of physical interrupt routing. 

è Summary of physical interrupt masking on page G1-5534. 


Summary of physical interrupt routing 


The Table G1-19 on page G1-5534 shows the routing of physical FIQ, IRQ and SError interrupts when the highest 
Exception level is using AArch32. If the highest Exception level is using AArch64, see Table D1-10 on 
page D1-2317. 


In this table: 


SCR This is the Effective value of a field in SCR. 
HCR This is the Effective value of a field in HCR. 
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FIQ IRQ EA The Effective value of the field that handles the asynchronous exception type in SCR. 


FMO IMO AMO The Effective value of the mask override field for the asynchronous exception type in HCR, if 
EL2 is using AArch32 or HCR_EL2 if EL2 is using AArch64. 


FIQ IRQ Abt The exception is taken to the FIQ mode, the IRQ mode or the Abort mode according to the type of 
asynchronous exception. 


Hyp The exception is taken to AArch32 Hyp mode. 
Mon The exception is taken to AArch32 Monitor mode. 
n/a This field does not exist, or the Exception level is not accessible in this configuration. 


Table G1-19 Routing of physical asynchronous exceptions 























Control bits 
Target when Target when Target when Target when 
SCR HCR taken from taken from taken from taken from 
ELO EL1 EL2 EL3 
NS FIQIRQEA TGE FMO IMỌ AMO 
0 xX xX xX FIQ IRQ Abt n/a n/a FIQ IRQ Abt 
1 0 0 0 FIQ IRQ Abt FIQ IRQ Abt Hyp FIQ IRQ Abt 
1 Hyp Hyp Hyp FIQ IRQ Abt 
1 x Hyp n/a Hyp FIQ IRQ Abt 
1 0 x Mon Mon Mon Mon 
1 x Mon n/a Mon Mon 





Summary of physical interrupt masking 


Table G1-20 on page G1-5535 shows the masking of physical FIQ, IRQ and SError interrupts when the highest 
Exception level is using AArch32. When the highest Exception level is using AArch64, see Table D1-13 on 
page D1-2321. 


In this table: 

SCR This is the Effective value of a field in SCR. 

HCR This is the Effective value of a field in HCR. 

FIQ IRQ EA The Effective value of the field that handles the asynchronous exception type in SCR. 


FMO IMO AMO The Effective value of the mask override field for the asynchronous exception type in HCR. 


FW AW For FIQ interrupts, the SCR.FW field, and for SError interrupts, the SCR.AW field. For IRQ 
interrupts, there is no equivalent field, so the Effective value is 0 and rows where this cell is 1 should 
be ignored. 

A When the interrupt is asserted, it is taken regardless of the value of the PSTATE mask bit. 


When the interrupt is asserted, it is subject to the corresponding PSTATE mask bit. If the value of 
the mask is 1, the interrupt is not taken. If the value of the mask is 0, the interrupt is taken. 
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n/a This field does not exist, or the Exception level is not accessible in this configuration. 


Table G1-20 Masking of physical asynchronous exceptions 
































Control bits Effect of the interrupt mask when executing at: 
SCR HCR 
NS FWAW FIQIRQEA TGE FMO IMOAMO ELO EL1 EL2 EL3 
0 X x x x B n/a n/a B 
1 x 0 0 0 B B B B 
1 A A B B 
1 x A n/a B B 
0 1 0 x A A A B 
1 x A n/a A B 
1 1 0 0 B B B B 
1 A A A B 
1 x A n/a A B 





G1.15.5 Taking an interrupt or other exception during a multiple-register load or store 


In AArch32 state, an interrupt cannot be taken during a sequence of memory accesses caused by a single load or 
store instruction, except that when ARMv8.2-LSMAOC is implemented and the value of the applicable LSMAOE 
field is 0, an interrupt can be taken between two memory accesses made by a single AArch32 Load Multiple (LDM) 
or Store Multiple (STM) instruction. 


The applicable LSMAOE field is the field in the SCTLR_EL1, SCTLR_EL2, HSCTLR, or SCTLR register that 
applies to the Exception level and Security state at which the LDM or STM instruction is executed. 


When the value of the LSMAOE bit is 0 and an interrupt is taken between two memory accesses made by a single 
AArch32 LDM or STM instruction, then: 


a For a load, any register being loaded by the instruction other than a register used in the generation of the 
address by the instruction or the PC, can contain an UNKNOWN value. Any register used in the generation of 
the address is restored to its initial value and the LR is set on the interrupt to a value consistent with returning 
to the instruction. 


è For a store, any data location being stored to by the instruction can contain an UNKNOWN value. 


è For either a load or store, if the instruction specifies writeback of the base address, then that register is 
restored to its initial value. 


Armv8.2 deprecates software relying on interrupts not being taken during the sequence of memory accesses caused 
by a single load or store instruction. 
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G1.16 


G1.16.1 


G1-5536 


AArch32 state exception descriptions 


Handling exceptions that are taken to an Exception level using AArch32 on page G1-5501 gives general information 
about exception handling. This section describes each of the exceptions, in the following subsections: 


è Undefined Instruction exception. 

. Monitor Trap exception on page G1-5538. 

7 Hyp Trap exception on page G1-5539. 

è Supervisor Call (SVC) exception on page G1-5540. 

° Secure Monitor Call (SMC) exception on page G1-5541. 
a Hypervisor Call (HVC) exception on page G1-5542. 
. Prefetch Abort exception on page G1-5543. 

e Data Abort exception on page G1-5547. 

. Virtual SError interrupt exception on page G1-5551. 
° IRQ exception on page G1-5552. 

° Virtual IRQ exception on page G1-5554. 

. FIQ exception on page G1-5554. 

. Virtual FIQ exception on page G1-5556. 


Additional pseudocode functions for exception handling on page G1-5556 gives additional pseudocode that is used 
in the pseudocode descriptions of a number of the exceptions. 


Undefined Instruction exception 


An Undefined Instruction exception might be caused by: 


° A System register access, floating-point, or Advanced SIMD instruction that is not accessible because of the 
settings in one or more of the CPACR, NSACR, HCPTR, and DBGDSCRext. 


° A System register access, floating-point, or Advanced SIMD instruction that is not implemented. 
° A System register access, floating-point, or Advanced SIMD instruction that causes an exception during 
execution. This includes: 


— Trapped floating-point exceptions that are taken to AArch32, if an implementation supports these 
traps. See Floating-point exceptions and exception traps on page E1-3797. 


— Execution of certain floating-point instructions when one or both of the FPSCR. {Stride, Len} fields 
in nonzero, in an implementation in which those fields are RW. The description of FPEXC specifies 
the instructions to which this applies. 


. An instruction that is UNDEFINED. 


Note 
The Undefined Instruction exception is taken using offset 0x04 in the Hyp, Secure, or Non-secure vector table. In 
the Monitor vector table this offset is used for the Monitor Trap exception. See Monitor Trap exception on 
page G1-5538 and The vector tables and exception offsets on page G1-5502. 








By default, an Undefined Instruction exception is taken to Undefined mode, but an Undefined Instruction exception 
can be taken to EL2, meaning it is taken to Hyp mode if EL2 is using AArch32, see The PE mode to which the 
Undefined Instruction exception is taken on page G1-5537. 


The Undefined Instruction exception can provide: 


. Signaling of an illegal instruction execution. 
z Lazy context switching of System registers. 
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The preferred return address for an Undefined Instruction exception is the address of the instruction that generated 
the exception. For an exception taken to AArch32 state, this return is performed as follows: 


. If returning from Secure or Non-secure Undefined mode, the exception return uses the SPSR and LR_und 
values generated by the exception entry, as follows: 


—  IfSPSR.T is 0, indicating that the exception occurred in A32 state, the return uses an exception return 
instruction with a subtraction of 4. 


—  IfSPSR.T is 1, indicating that the exception occurred in T32 state, the return uses an exception return 
instruction with a subtraction of 2. 


- If returning from Hyp mode, the exception return is performed by an ERET instruction, using the SPSR and 
ELR_hyp values generated by the exception entry. 


For more information, see Exception return to an Exception level using AArch32 on page G1-5523. 


Note 
If handling the Undefined Instruction exception requires instruction emulation, followed by return to the next 
instruction after the instruction that caused the exception, the instruction emulator must use the instruction length 
to calculate the correct return address, and to calculate the updated values of the IT bits if necessary. 








The PE mode to which the Undefined Instruction exception is taken 


Figure G1-4 shows how the implementation, state, and configuration options determine the PE mode to which an 
Undefined Instruction exception is taken, when the exception is taken to an Exception level that is using AArch32. 
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4 Non-secure Undefined mode, 
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Figure G1-4 The PE mode an Undefined Instruction exception is taken to in AArch32 state 


See also UNPREDICTABLE cases when the value of HCR.TGE is 1 on page G1-5514. 
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Pseudocode description of taking the Undefined Instruction exception 


The AArch32.UndefinedFault() pseudocode procedure determines whether the Undefined Instruction exception is 
taken to AArch32 state. If it is taken to AArch32 state, the AArch32.TakeUndefInstrException() pseudocode 
procedure describes how the PE takes the exception. 


An Undefined Instruction exception is taken to an Exception level using AArch64 if either: 


of It is generated in User mode when EL] is using AArch64. 


e It is generated in User mode when EL2 is enabled in the current Security state and is using AArch64 and the 
value of HCR_EL2.TGE is 1. 


Conditional execution of undefined instructions 


The conditional execution rules described in Conditional execution on page F2-3909 apply to all instructions. This 
includes undefined instructions and other instructions that would cause entry to the Undefined Instruction 
exception. 


If such an instruction fails its condition check, the behavior depends on the potential cause of entry to the Undefined 
Instruction exception, as follows: 


° If the potential cause is the execution of the instruction itself and depends on data values used by the 
instruction, the instruction executes as a NOP and does not cause an Undefined Instruction exception. 


è In the following cases, it is IMPLEMENTATION DEFINED whether the instruction executes as a NOP or causes an 
Undefined Instruction exception: 


— The potential cause is the execution of an earlier System register access instruction, floating-point 
instruction, or Advanced SIMD instruction. 


— The potential cause is the execution of the instruction itself without dependence on the data values 
used by the instruction. 


An implementation must handle all such cases in the same way. 





Note 


Before Armv7, all implementations executed any instruction that failed its condition check as a NOP, even if it would 
otherwise have caused an Undefined Instruction exception. An Undefined Instruction handler written for these 
implementations might assume without checking that the undefined instruction passed its condition check. Such an 
Undefined Instruction handler is likely to need rewriting, to check the condition is passed, before it functions 
correctly on all AArch32 implementations. 





Interaction of UNDEFINED instruction behavior with UNPREDICTABLE or 
CONSTRAINED UNPREDICTABLE instruction behavior 


If this manual describes an instruction as both: 





a UNPREDICTABLE and UNDEFINED then the instruction is UNPREDICTABLE. 
. CONSTRAINED UNPREDICTABLE and UNDEFINED then the instruction is CONSTRAINED UNPREDICTABLE. 
Note 
An example of this is where both: 
° An instruction, or instruction class, is made UNDEFINED by some general principle, or by a configuration 
field. 
$ A particular encoding of that instruction or instruction class is specified as CONSTRAINED UNPREDICTABLE. 





G1.16.2 Monitor Trap exception 


The Monitor Trap exception is implemented only as part of EL3, and can be generated only if EL3 is using 
AArch32. 
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Note 


The Monitor Trap exception is taken using offset @x04 in the Monitor vector table. In the other vector tables, this 
offset is used for the Undefined Instruction exception. See Undefined Instruction exception on page G1-5536 and 
The vector tables and exception offsets on page G1-5502. 








A Monitor Trap exception is generated if the PE is running in a mode other than Monitor mode, and commits for 
execution a WFI or WFE instruction that would otherwise cause suspension of execution when: 


. In the case of the WFI instruction, the value of the SCR.TWI bit is 1. 
° In the case of the WFE instruction, the value of the SCR.TWE bit is 1. 





Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed 
to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the 
instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken. 





The preferred return address for a Monitor Trap exception is the address of the instruction that generated the 
exception. The exception return uses the SPSR and LR_mon values generated by the exception entry, as follows: 


š If SPSR.T is 0, indicating that the exception occurred in A32 state, the return uses an exception return 
instruction with a subtraction of 4. 


5 If SPSR.T is 1, indicating that the exception occurred in T32 state, the return uses an exception return 
instruction with a subtraction of 2. 


For more information, see Exception return to an Exception level using AArch32 on page G1-5523. 


The PE mode to which the Monitor Trap exception is taken 


When EL3 is using AArch32, a Monitor Trap exception is taken to Monitor mode, using a vector offset of 0x04 from 
the Monitor exception base address. 


Pseudocode description of taking the Monitor Trap exception 


The AArch32.TakeMonitorTrapException() pseudocode procedure describes how the PE takes the exception. 


G1.16.3 Hyp Trap exception 
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The Hyp Trap exception provides the standard mechanism for trapping Guest OS functions to the hypervisor. 
The Hyp Trap exception is implemented only as part of EL2 and can be generated only if EL2 is using AArch32. 


A Hyp Trap exception is generated if the PE is running in a Non-secure mode other than Hyp mode, and commits 
for execution an instruction that is trapped to Hyp mode. Instruction traps are enabled by setting bits to 1 in the HCR, 
HCPTR, HDCR, or HSTR. For more information see EL2 configurable controls on page G1-5585. 


Traps to Hyp mode never apply in Secure state, regardless of the value of the SCR.NS bit. 


The preferred return address for a Hyp Trap exception is the address of the trapped instruction. The exception return 
is performed by an ERET instruction, using the SPSR and ELR_hyp values generated by the exception entry. 


Note 


The SPSR and ELR_hyp values generated on exception entry can be used, without modification, for an exception 
return to re-execute the trapped instruction. If the exception handler emulates the trapped instruction, and must 
return to the following instruction, the emulation of the instruction must include modifying ELR_hyp, and possibly 
updating SPSR_hyp. 








When the PE enters the handler for a Hyp Trap exception, the HSR holds syndrome information for the exception. 
For more information see Use of the HSR on page G5-5836. 
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The PE mode to which the Hyp Trap exception is taken 


A Hyp Trap exception is taken to Hyp mode, using a vector offset of 0x14 from the Hyp exception base address. 


Pseudocode description of taking the Hyp Trap exception 


The AArch32.TakeHypTrapException() pseudocode procedure describes how the PE takes the exception. 


Supervisor Call (SVC) exception 


The Supervisor Call instruction, SVC, requests a supervisor function, typically to request an operating system 
function. When EL] is using AArch32, executing an SVC instruction causes the PE to enter Supervisor mode. For 
more information, see SVC on page F5-4673. 


Note 
In an implementation that includes EL2, when EL2 is using AArch32: 





° When an SVC instruction is executed in Hyp mode, the Supervisor Call exception is taken to Hyp mode. For 
more information see SVC on page F5-4673. 


° When the HCR.TGE bit is set to 1, the Supervisor Call exception generated by execution of an SVC instruction 
in Non-secure User mode is routed to Hyp mode. For more information, see Supervisor Call exception, when 
the value of HCR.TGE is 1 on page G1-5517. 





By default, a Supervisor Call exception that is taken to AArch32 state is taken to Supervisor mode, but a Supervisor 
Call exception can be taken to EL2, meaning it is taken to Hyp mode if EL2 is using AArch32, see The PE mode to 
which the Supervisor Call exception is taken. 


The preferred return address for a Supervisor Call exception is the address of the next instruction after the SVC 
instruction. For an exception taken to AArch32 state, this return is performed as follows: 


° If returning from Secure or Non-secure Supervisor mode, the exception return uses the SPSR and LR_sve 
values generated by the exception entry, in an exception return instruction without subtraction. 


° If returning from Hyp mode, the exception return is performed by an ERET instruction, using the SPSR and 
ELR hyp values generated by the exception entry. 


For more information, see Exception return to an Exception level using AArch32 on page G1-5523. 


The PE mode to which the Supervisor Call exception is taken 


Figure G1-5 on page G1-5541 shows how the implementation, state, and configuration options determine the PE 
mode to which a Supervisor Call exception is taken, when the exception is taken to an Exception level that is using 
AArch32. 
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Figure G1-5 The PE mode the Supervisor Call exception is taken to in AArch32 state 


See also UNPREDICTABLE cases when the value of HCR.TGE is 1 on page G1-5514. 


Pseudocode description of taking the Supervisor Call exception 


The AArch32.CallSupervisor() pseudocode procedure determines whether the Supervisor Call exception is taken to 
AArch32 state. If it is taken to AArch32 state, the AArch32.TakeSVCException() pseudocode procedure describes how 
the PE takes the exception. 


An Supervisor Call exception is taken to an Exception level using AArch64 if either: 
è It is generated by executing an SVC instruction in User mode when EL] is using AArch64. 


s It is generated by executing an SVC instruction in Non-secure User mode when EL2 is using AArch64 and the 
value of HCR_EL2.TGE is 1. 


G1.16.5 Secure Monitor Call (SMC) exception 


The Secure Monitor Call exception is implemented only as part of EL3. When EL3 is using AArch32, the exception 
is taken to Monitor mode. 


The Secure Monitor Call instruction, SMC, requests a Secure Monitor function. When EL3 is using AArch32, 
executing an SMC instruction causes the PE to enter Monitor mode. For more information, see SMC on page F5-4520. 


Note 
è In an implementation that includes EL2, execution of an SMC instruction in a Non-secure EL1 mode can be 
trapped to EL2. When EL2 is using AArch32, this means that when HCR.TSC 1, execution of an SMC 
instruction in a Non-secure EL1 mode generates a Hyp Trap Exception that is taken to Hyp mode. For more 
information see Traps to Hyp mode of Non-secure EL1 execution of SMC instructions on page G1-5592. 
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G1-5542 


. The Operation pseudocode in the description of the AArch32 SMC instruction, in SMC on page F5-4520, 
identifies cases where execution of the instruction generates an exception that is taken to EL3 using 
AArch64. 


The preferred return address for a Secure Monitor Call exception is the address of the next instruction after the SMC 
instruction. For an exception taken to AArch32 state, this return is performed using the SPSR and LR_mon values 
generated by the exception entry, using an exception return instruction without a subtraction. 


For more information, see Exception return to an Exception level using AArch32 on page G1-5523. 





Note 
For an exception taken to AArch32 state, the exception handler can return to the SMC instruction itself by returning 
using a subtraction of 4, without any adjustment to the SPSR.IT[7:0] bits. If it does this, the return occurs, then 
asynchronous exceptions might occur and be handled, then the SMC instruction is re-executed and another Secure 
Monitor Call exception occurs. 


This relies on: 


° The SMC instruction being used correctly, either outside an IT block or as the last instruction in an IT block, 
so that the SPSR.IT[7:0] bits indicate unconditional execution. 


à The Secure Monitor Call handler not changing the result of the original conditional execution test for the SMC 
instruction. 





The PE mode to which the Secure Monitor Call exception is taken 


The Secure Monitor Call exception is supported only as part of EL3. When EL3 is using AArch32, a Secure Monitor 
Call exception is taken to Monitor mode, using vector offset 0x08 from the Monitor exception base address. 


Note 


° An SMC instruction that is trapped to Hyp mode because HCR.TSC is set to 1 generates a Hyp Trap exception, 
see The PE mode to which the Hyp Trap exception is taken on page G1-5540. 





- If EL3 is using AArch64 then Security behavior in Exception levels using AArch32 when EL2 or EL3 are 
using AArch64 on page G1-5512 describes the effect of executing an SMC instruction at an Exception level 
that is using EL1. 





Pseudocode description of taking the Secure Monitor Call exception 


The AArch32.TakeSMCException() pseudocode procedure describes how the PE takes the exception when the 
exception is taken to an Exception level that is using AArch32. 


Hypervisor Call (HVC) exception 


The Hypervisor Call exception is implemented only as part of EL2. 


The Hypervisor Call instruction, HVC, requests a hypervisor function. When EL2 is using AArch32, executing an HVC 
instruction generates a Hypervisor Call exception that is taken to Hyp mode. For more information, see HVC on 
page F5-4201. 


Note 


° Execution of HVC instructions is disabled when the value of SCR.HCE is 0. Descriptions of HVC instruction 
execution elsewhere in this section assume the Effective value of SCR.HCE is 1. 





° When EL? is using AArch64 an HVC instruction executed in a Non-secure EL1 mode generates an exception 
that is taken to EL2 using AArch64. Exception classes and the ESR_ELx syndrome registers on 
page D1-2296 describes how this exception is reported in ESR_EL2. 
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The preferred return address for a Hypervisor Call exception is the address of the next instruction after the HVC 
instruction. The exception return is performed by an ERET instruction, using the SPSR and ELR_hyp values 
generated by the exception entry. 


For more information, see Exception return to an Exception level using AArch32 on page G1-5523. 


When EL2 is using AArch32, executing an HVC instruction transfers the immediate argument of the instruction to 
the HSR. The exception handler retrieves the argument from the HSR, and therefore does not have to access the 
original HVC instruction. For more information see Use of the HSR on page G5-5836. 


The PE mode to which the Hypervisor Call exception is taken 


The Hypervisor Call exception is supported only as part of EL2. When EL2 is using AArch32, a Hypervisor Call 
exception is taken to Hyp mode, using a vector offset that depends on the mode from which the exception is taken, 
as Figure G1-6 shows. This offset is from the Hyp exception base address. 





(Hypervisor Call exception ) 








Hyp mode, 
vector offset 0x08 








Hyp mode, 
vector offset 0x14 














Figure G1-6 The PE mode the Hypervisor Call exception is taken to in AArch32 state 


Pseudocode description of taking the Hypervisor Call exception 


The AArch32.CallHypervisor() pseudocode procedure determines whether the valid execution of an HVC instruction 
in AArch32 state generates an exception that is taken to EL2 using AArch64, or generates a Hypervisor Call 
exception taken to Hyp mode. The AArch32.TakeHVCException() pseudocode procedure describes how the PE takes 
a Hypervisor Call exception. 


G1.16.7 Prefetch Abort exception 


ARM DDI 0487E.a 
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A Prefetch Abort exception can be generated by: 


° A synchronous memory abort on an instruction fetch. 





Note 


Asynchronous External aborts on instruction fetches are reported as SError interrupts using the Data Abort 
exception, see Data Abort exception on page G1-5547. 





A Prefetch Abort exception entry is synchronous to the instruction whose fetch aborted. 


For more information about memory aborts see VMSAv8-32 memory aborts on page G5-5810. 


: A Breakpoint, Vector Catch or Breakpoint Instruction exception, see Chapter G2 AArch32 Self-hosted 
Debug. 


Note 


If an implementation fetches instructions speculatively, it must handle a synchronous abort on such an instruction 
fetch by: 





. Generating a Prefetch Abort exception only if the instruction would be executed in a simple sequential 
execution of the program. 


. Ignoring the abort if the instruction would not be executed in a simple sequential execution of the program. 
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By default, when EL1 is using AArch32, a Prefetch Abort exception is taken to Abort mode, but a Prefetch Abort 
exception can be taken to: 


s EL2, meaning it is taken to Hyp mode if EL2 is using AArch32. 
° EL3, meaning it is taken to Monitor mode if EL3 is using AArch32. 


For more information: 


, About cases where the Prefetch Abort exception is taken to an Exception level that is using AArch32, see 
The PE mode to which the Prefetch Abort exception is taken on page G1-5545. 


© About cases where the Prefetch Abort generates an exception that is taken to an Exception level that is using 
AArch64, see Pseudocode description of taking the Prefetch Abort exception on page G1-5547. 


The preferred return address for a Prefetch Abort exception is the address of the aborted instruction. For an 
exception taken to AArch32 state this return is performed as follows: 


° If returning from a mode other than Hyp mode, using the SPSR and LR values generated by the exception 
entry, using an exception return instruction with a subtraction of 4. This means using: 


— SPSR abt and LR_abt if returning from Abort mode. 
—  SPSR_mon and LR mon if returning from Monitor mode. 


If returning from Hyp mode, using the SPSR_hyp and ELR_hyp values generated by the exception entry, 
using an ERET instruction. 


For more information about the handling of Prefetch Abort exceptions in AArch32 state see Exception return to an 
Exception level using AArch32 on page G1-5523. 


Prefetch Abort exception reporting a PC alignment fault exception 


A PC alignment fault exception that is taken to an Exception level that is using AArch32 is reported as a Prefetch 
Abort exception, and: 
If the exception is taken to EL1 using AArch32 or EL3 using AArch32 
` The IFSR indicates the cause of the exception: 
— Ifthe value of TTBCR.EAE is 0, IFSR.FS takes the value 0b00001. 
— Ifthe value of TTBCR.EAE is 1, IFSR.STATUS takes the value 0b100001. 


è IFAR holds the value of the address that faulted, including the misaligned low order bit or 
bits. 


G R14_abt holds the address that faulted, including the misaligned low order bit or bits, with 

the standard offset for a Prefetch Abort exception. 
If the exception is taken to EL2 using AArch32 

. HSR.EC takes the value 0b100010. 

s HSR.IL is UNKNOWN. 

° HSR.ISS is RESO. 

: HIFAR and ELR_hyp each hold the value of the address that faulted, including the 
misaligned low order bit or bits. 


For a PC alignment fault exception taken to an Exception level that is using AArch32: 


: If the exception occurred because of the CONSTRAINED UNPREDICTABLE behavior of a branch to an unaligned 
PC value, as described in Branching to an unaligned PC on page K1-7608, then bit[0] of the faulting address 
is forced to zero, and therefore the misalignment is because the value of bit[1] of this address is 1. 


s If the exception occurred on an exit from Debug state, as described in Exiting Debug state on page H2-6740, 
then it is CONSTRAINED UNPREDICTABLE whether bit[0] of the faulting address is forced to zero. 
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The PE mode to which the Prefetch Abort exception is taken 


Figure G1-7 on page G1-5546 shows how the implementation, state, and configuration options determine the PE 
mode to which a Prefetch Abort exception is taken, when the exception is taken to an Exception level that is using 
AArch32. 


Note 


In this figure, the Effective value of HCR2.TEA is 0 ifthe The Reliability, Availability, and Serviceability Extension 
(RAS Extension) is not implemented. 
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Figure G1-7 The PE mode the Prefetch Abort exception is taken to in AArch32 state 


See also UNPREDICTABLE cases when the value of HCR.TGE is 1 on page G1-5514. 
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Pseudocode description of taking the Prefetch Abort exception 


The AArch32.Abort() pseudocode function determines whether the Prefetch Abort condition generates an exception 
that is taken to an Exception level that is using AArch64, or generates a Prefetch Abort exception that is taken in 
AArch32 state. When the exception is taken in AArch32 state, the AArch32.TakePrefetchAbortException() 
pseudocode procedure describes how the PE takes the exception. 


The exception is taken to an Exception level using AArch64 if one of the following applies: 
° The exception is generated in User mode when EL1 is using AArch64. 


° The implementation includes EL2, EL2 is using AArch64, and one of the following applies: 
— The value of HCR_EL2.TGE is 1 and the exception is generated in Non-secure User mode. 


— The value of MDCR_EL2.TDE is 1 and the exception is generated by a Debug exception in a 
Non-secure EL1 or Non-secure ELO mode. 


— The exception is generated by a stage 2 fault during a stage 1 translation table walk using the AArch32 
Non-secure EL1&0 translation regime. 


The implementation includes EL3, EL3 is using AArch64, the value of SCR_EL3.EA is 1. and the exception 
is generated by an External abort in AArch32 state. 


G1.16.8 Data Abort exception 
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In AArch32 state, a Data Abort exception can be generated by: 


° A synchronous abort on a data read or write memory access. Exception entry is synchronous to the instruction 
that generated the memory access. 


` An SError interrupt. The SError interrupt might be caused by an External abort on a memory access, which 
can be any of: 


— A data read or write access. 
— An instruction fetch. 
— Ina VMSA memory system, a translation table access. 


Exception entry occurs asynchronously. 
As described in Asynchronous exception masking controls on page G1-5531, SError interrupts can be 
masked. When this happens, a generated SError interrupt is not taken until it is not masked. 


: A watchpoint, see Watchpoint exceptions on page G2-5653. 


By default, when EL1 is using AArch32 a Data Abort exception is taken to Abort mode, but a Data Abort exception 
can be taken to: 


$ EL2, meaning it is taken to Hyp mode if EL2 is using AArch32. 
$ EL3, meaning it is taken to Monitor mode if EL3 is using AArch32. 


For more information: 


è About cases where the Data Abort exception is taken to an Exception level that is using AArch32 see The PE 
mode to which the Data Abort exception is taken on page G1-5548. 


7 About memory aborts in AArch32 state see VMSAv8-32 memory aborts on page G5-5810. 


è About cases where the Data Abort generates an exception that is taken to an Exception level that is using 
AArch64 see Pseudocode description of taking the Data Abort exception on page G1-5550. 


The preferred return address for a Data Abort exception is the address of the instruction that generated the aborting 
memory access, or the address of the instruction following the instruction boundary at which an SError interrupt 
exception was taken. For an exception taken to AArch32 state, this return is performed as follows: 


° If returning from a mode other than Hyp mode, using the SPSR and LR values generated by the exception 
entry, using an exception return instruction with a subtraction of 8. This means using: 


—  SPSR_abt and LR_abt if returning from Abort mode. 
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—  SPSR_mon and LR_mon if returning from Monitor mode. 


è If returning from Hyp mode, using the SPSR_hyp and ELR_hyp values generated by the exception entry, 
using an ERET instruction. 


For more information about the handling of Data Abort exceptions in AArch32 state see Exception return to an 
Exception level using AArch32 on page G1-5523. 


The PE mode to which the Data Abort exception is taken 


Figure G1-8 on page G1-5549 shows the determination of the mode to which a Data Abort exception is taken when 
the exception is taken to an Exception level that is using AArch32. 


Note 


In this figure, the Effective value of HCR2.TEA is 0 ifthe The Reliability, Availability, and Serviceability Extension 
(RAS Extension) is not implemented. 
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Figure G1-8 The PE mode the Data Abort exception is taken to in AArch32 state 


See also UNPREDICTABLE cases when the value of HCR.TGE is 1 on page G1-5514. 
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Pseudocode description of taking the Data Abort exception 


The AArch32.Abort() pseudocode function determines whether the Data Abort condition generates an exception that 
is taken to an Exception level that is using AArch64, or generates a Data Abort exception that is taken in AArch32 
state. When the exception is taken in AArch32 state, the AArch32.TakeDataAbortException() pseudocode procedure 
describes how the PE takes the exception. 


The exception is taken to an Exception level using AArch64 if one of the following applies: 
° The exception is generated in User mode when EL] is using AArch64. 


e The implementation includes EL2, EL2 is using AArch64, and one of the following applies: 
— The value of HCR_EL2.TGE is 1 and the exception is generated in Non-secure User mode. 


— The value of MDCR_EL2.TDE is 1 and the exception is generated by a Debug exception in a 
Non-secure EL1 or Non-secure ELO mode. 


— The exception is generated by a stage 2 fault during a stage 1 translation table walk using the AArch32 
Non-secure EL1&0 translation regime. 


The implementation includes EL3, EL3 is using AArch64, the value of SCR_EL3.EA is 1. and the exception 
is generated by an External abort in AArch32 state. 


Effects of data-aborted instructions 


An instruction that accesses data memory can modify memory by storing one or more values. If the execution of 
such an instruction generates a Data Abort exception, or causes Debug state entry because of a watchpoint set on 
the instruction, the value of each memory location that the instruction stores to is: 


° Unchanged for any location for which one of the following applies: 

— An Alignment fault is generated. 

— An MMU fault is generated. 

— A Watchpoint is generated. 

— An External abort is generated, if that External abort is taken synchronously. 
x UNKNOWN for any location for which no exception and no debug event is generated. 


If the access to a memory location generates an External abort that is taken asynchronously, it is outside the scope 
of the architecture to define the effect of the store on that memory location, because this depends on the 
system-specific nature of the External abort. However, in general, Arm recommends that such locations are 
unchanged. 


For External aborts and Watchpoints, where in principle faulting could be identified at byte or halfword granularity, 
the size of a location in this definition is the size for which a memory access is single-copy atomic. 


In AArch32 state, instructions that access data memory can modify registers in the following ways: 


° By loading values into one or more of the general-purpose registers. The registers loaded can include the PC. 
7 By loading values into one or more of the registers in the Advanced SIMD and floating-point register file. 
s By specifying base register writeback, in which the base register used in the address calculation has a 


modified value written to it. All instructions that support base register writeback have CONSTRAINED 
UNPREDICTABLE results if base register writeback is specified with the PC as the base register. Only 
general-purpose registers can be modified reliably in this way. 


° By a direct transfer to or from the Debug Communication Channel (DCC) register, using the LDC and STC 
instructions. For more information see Chapter H4 The Debug Communication Channel and Instruction 
Transfer Register. 


If the instruction that accesses the DCC registers is an LDC or STC instruction, UNKNOWN values are left in 
the Data Transfer Register and DCC flow-control flags. 


s By modifying PSTATE. 
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If the execution of such an instruction generates a synchronous Data Abort exception, the following rules determine 
the values left in these registers: 
s On entry to the Data Abort exception handler: 


— The PC value is the Data Abort vector address, see Exception vectors and the exception base address 
on page G1-5501. 


— The LR_abt value is determined from the address of the aborted instruction. 
Neither value is affected by the results of any load specified by the instruction. 
° The base register is restored to its original value if either: 


— The aborted instruction is a load and the list of registers to be loaded includes the base register. 
— The base register is being written back. 


è If the instruction only loads one general-purpose register the value in that register is unchanged. 


` If the instruction loads more than one general-purpose register, UNKNOWN values are left in destination 
registers other than the PC and the base register of the instruction. 


s If the instruction affects any registers in the Advanced SIMD and floating-point register file, UNKNOWN 
values are left in the registers that are affected. 


è PSTATE bits that are not defined as updated on exception entry retain their current value. 
° If the instruction is a STREX, STREXB, STREXH, or STREXD, <Rd> is not updated. 


After taking a Data Abort exception, the state of the Exclusives monitors is UNKNOWN. Therefore, Arm strongly 
recommends that the abort handler performs a CLREX instruction, or a dummy STREX instruction, to clear the 
Exclusives monitor state. 


An External abort might signal a data corruption to the PE. For example a memory location might have been 
corrupted. The error that caused the External abort might have been propagated. The RAS Extension provides 
mechanisms for software to determine the extent of the corruption and contain propagation of the error. For more 
information, see the ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMVv8, for the 
ARMVv8-A architecture profile. 


The Arm abort model 


The abort model used by an Arm PE is described as a Base Restored Abort Model. This means that if a synchronous 
Data Abort exception is generated by executing an instruction that specifies base register writeback, the value in the 
base register is unchanged. 


The abort model applies uniformly across all instructions. 


G1.16.9 Virtual SError interrupt exception 
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The Virtual SError interrupt exception is implemented only as part of EL2 is enabled in the current Security state. 


A Virtual SError interrupt exception is generated in AArch372 state if all of the following apply: 
° The PE is in a mode other than Hyp mode. 
° The value of PSTATE.A is 0. 
$ Either: 
— El2 is using AArch32 and the values of the HCR. {TGE, AMO, VA} bits are {0, 1, 1}. 
—  EL2 is using AArch64 and the values of the HCR_EL2.{TGE, AMO, VA} bits are {0, 1, 1}. 


The preferred return address for a Virtual SError interrupt exception is the address of the instruction immediately 
after the instruction boundary where the exception was taken. For an exception taken to AArch32 state, this return 
is performed using the SPSR and LR_abt values generated by the exception entry, using an exception return 
instruction without subtraction. 
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The PE mode to which the Virtual SError interrupt exception is taken 


The Virtual SError interrupt exception is taken using a vector offset of 0x10 from the Non-secure exception base 
address. 


The conditions for generating a Virtual SError interrupt exception in AArch32 state mean the exception is: 
° Taken from a EL1 or ELO mode. 

a Taken to Abort mode if EL1 is using AArch32. 

7 Taken to EL1, when ELO is using AArch32 and EL1 is using AArch64. 


For more information see Virtual exceptions when an implementation includes EL2 on page G1-5528. 


Note 


Because a Virtual SError interrupt exception taken to AArch32 state is always taken to Abort mode, on exception 
entry the preferred return address is always saved to LR_abt. 








Pseudocode description of taking the Virtual SError interrupt exception 


The AArch32.TakeVirtualSErrorException() pseudocode procedure describes how the PE takes the exception. 


IRQ exception 


The IRQ exception is generated by IMPLEMENTATION DEFINED means. Typically this is by asserting an IRQ interrupt 
request input to the PE. 


When an IRQ exception is taken, exception entry is precise to an instruction boundary. 


As described in Asynchronous exception masking controls on page G1-5531, IRQ exceptions can be masked. When 
this happens, a generated IRQ exception is not taken until it is not masked. 


By default, when EL] is using AArch32, an IRQ exception is taken to IRQ mode, but an IRQ exception can be taken 
to: 


° EL2, meaning it is taken to Hyp mode if EL2 is using AArch32. 
s EL3, meaning it is taken to Monitor mode if EL3 is using AArch32. 


For more information: 


° About cases where the exception is taken to an Exception level using AArch32 see The PE mode to which 
the physical IRQ exception is taken on page G1-5553. 


$ About cases where the exception is taken to an Exception level using AArch64 see Pseudocode description 
of taking the physical IRQ exception on page G1-5553. 


The preferred return address for an IRQ exception is the address of the instruction following the instruction 
boundary at which the exception was taken. For an exception taken to AArch32 state this return is performed as 
follows: 


° If returning from a mode other than Hyp mode, using the SPSR and LR values generated by the exception 
entry, using an exception return instruction with a subtraction of 4. This means using: 


—  SPSR_irg and LR irq if returning from IRQ mode. 
—  SPSR_mon and LR_mon if returning from Monitor mode. 


s If returning from Hyp mode, using the SPSR_hyp and ELR_hyp values generated by the exception entry, 
using an ERET instruction. 


For more information, see Exception return to an Exception level using AArch32 on page G1-5523. 
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The PE mode to which the physical IRQ exception is taken 


Figure G1-9 shows how the implementation, state, and configuration options determine the mode to which an IRQ 
exception is taken when the exception is taken to an Exception level that is using AArch32. 
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Figure G1-9 The PE mode the IRQ exception is taken to in AArch32 state 


Pseudocode description of taking the physical IRQ exception 


The AArch32.TakePhysicalIRQException() pseudocode procedure describes how the PE takes the exception. This 
procedure includes the case where the exception is taken to an Exception level that is using AArch64. This happens 
if one of the following applies: 


The exception is taken from User mode and EL1 is using AArch64. The Exception is taken to EL1 using 
AArch64. 


The exception is taken from User mode, EL2 is implemented in the current Security state and using AArch64, 
and the value of HCR_EL2.TGE is 1. The Exception is taken to EL2 using AArch64. 


The exception is taken from ELO or EL1 mode, EL2 is implemented in the current Security state and using 
AArch64, and the value of HCR_EL2.IMO is 1. The Exception is taken to EL2 using AArch64. 


The exception is taken from a PE mode other than Monitor mode, EL3 is implemented and using AArch64, 
and the value of SCR_EL3.IRQ is 1. The Exception is taken to EL3 using AArch64. 
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Virtual IRQ exception 


The Virtual IRQ exception is implemented only as part of EL2, if EL2 is enabled in the current Security state. 


A Virtual IRQ exception is generated in AArch32 state if all of the following apply: 
The PE is in a mode other than Hyp mode. 
° The value of PSTATE.I is 0. 
° Either: 
— El2 is using AArch32 and the value of HCR. {TGE, IMO} is {0, 1}. 
—  EL2 is using AArch64 and the value of HCR_EL2.{TGE, IMO} is {0, 1}. 
$ One of the following applies: 
—  EL2 is using AArch32 and the value of HCR.VIis 1. 
—  EL2 is using AArch64 and the value of HCR_EL2.V1 is 1. 
— A Virtual IRQ exception is generated by an IMPLEMENTATION DEFINED mechanism. 


The preferred return address for a Virtual IRQ exception is the address of the instruction immediately after the 
instruction boundary where the exception was taken. For an exception taken to AArch32 state this return is 
performed using the SPSR and LR_ irq values generated by the exception entry, using an exception return instruction 
with a subtraction of 4. 

The PE mode to which the Virtual IRQ exception is taken 

The Virtual IRQ exception uses a vector offset of 0x18. 

The conditions for generating a Virtual IRQ exception in AArch32 state mean the exception is: 

° Taken from an EL1 or ELO mode. 

$ Taken to IRQ mode if EL1 is using AArch32. 

° Taken to EL1 if ELO is using AArch32 and EL1 is using AArch64. 


For more information see Virtual exceptions when an implementation includes EL2 on page G1-5528. 


Pseudocode description of taking the Virtual IRQ exception 


The AArch32.TakeVirtualIRQException() pseudocode procedure describes how the PE takes the exception. 


FIQ exception 


The FIQ exception is generated by IMPLEMENTATION DEFINED means. Typically this is by asserting an FIQ interrupt 
request input to the PE. 


When an FIQ exception is taken, exception entry is precise to an instruction boundary. 


As described in Asynchronous exception masking controls on page G1-5531, FIQ exceptions can be masked. When 
this happens, a generated FIQ exception is not taken until it is not masked. 


By default, an FIQ exception is taken to FIQ mode, but an FIQ exception can be taken to: 
$ EL2, meaning it is taken to Hyp mode if EL2 is using AArch32. 
` EL3, meaning it is taken to Monitor mode if EL3 is using AArch32. 


For more information: 


s About cases where the exception is taken to an Exception level using AArch32 see The PE mode to which 
the physical FIQ exception is taken on page G1-5555. 


° About cases where the exception is taken to an Exception level using AArch64 see Pseudocode description 
of taking the FIQ exception on page G1-5556. 
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The preferred return address for an FIQ exception is the address of the instruction following the instruction 
boundary at which the exception was taken. For an exception taken to AArch32 state this return is performed as 


follows: 


If returning from a mode other than Hyp mode, using the SPSR and LR values generated by the exception 
entry, using an exception return instruction with a subtraction of 4. This means using: 


SPSR_fiq and LR_fiq if returning from FIQ mode. 
SPSR_mon and LR_mon if returning from Monitor mode. 


If returning from Hyp mode, using the SPSR_hyp and ELR_hyp values generated by the exception entry, 
using an ERET instruction. 


For more information see Exception return to an Exception level using AArch32 on page G1-5523. 


The PE mode to which the physical FIQ exception is taken 


Figure G1-9 on page G1-5553 shows how the implementation, state, and configuration options determine the PE 
mode to which an FIQ exception is taken when the exception is taken to an Exception level that is using AArch32. 
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Figure G1-10 The PE mode the FIQ exception is taken to in AArch32 state 
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Pseudocode description of taking the FIQ exception 


The AArch32.TakePhysicalFIQException() pseudocode procedure describes how the PE takes the exception. This 
procedure includes the case where the exception is taken to an Exception level that is using AArch64. This happens 
if one of the following applies: 


è The exception is taken from User mode and EL1 is using AArch64. The Exception is taken to EL1 using 
AArch64. 


: The exception is taken from User mode, EL2 is implemented in the current Security state and using AArch64, 
and the value of HCR_EL2.TGE is 1. The Exception is taken to EL2 using AArch64. 


è The exception is taken from an ELO or EL1 mode, EL2 is implemented in the current Security state and using 
AArch64, and the value of HCR_EL2.FMO is 1. The Exception is taken to EL2 using AArch64. 


$ The exception is taken from a PE mode other than Monitor mode, EL3 is implemented and using AArch64, 
and the value of SCR_EL3.FIQ is 1. The Exception is taken to EL3 using AArch64. 


G1.16.13 Virtual FIQ exception 
The Virtual FIQ exception is implemented only as part of EL2, if EL2 is enabled in the current Security state. 


A Virtual FIQ exception is generated in AArch32 state if all of the following apply: 
$ The PE is in a mode other than Hyp mode. 
e The value of PSTATE.F is 0. 
e Either: 
—  EL2 is using AArch32 and the value of HCR. {TGE, FMO} is {0, 1}. 
—  EL2 is using AArch64 and the value of HCR_EL2.{TGE, FMO} is {0, 1}. 
e One of the following applies: 
— El2 is using AArch32 and the value of HCR.VF is 1. 
—  EL2 is using AArch64 and the value of HCR_EL2.VF is 1. 
— A Virtual FIQ exception is generated by an IMPLEMENTATION DEFINED mechanism. 


The preferred return address for a Virtual FIQ exception is the address of the instruction immediately after the 
instruction boundary where the exception was taken. For an exception taken to AArch32 state this return is 
performed using the SPSR and LR_ irq values generated by the exception entry, using an exception return instruction 
with a subtraction of 4. 

The PE mode to which the Virtual FIQ exception is taken 

The Virtual FIQ exception is taken using a vector offset of @x1C. 

The conditions for generating a Virtual FIQ exception in AArch32 state mean the exception is: 

: Taken from EL1 or ELO. 

e Taken to FIQ mode if EL1 is using AArch32. 

7 Taken to EL1 if ELO is using AArch32 and EL1 is using AArch64. 


For more information see Virtual exceptions when an implementation includes EL2 on page G1-5528. 


Pseudocode description of taking the Virtual FIQ exception 


The AArch32.TakeVirtualFIQException() pseudocode procedure describes how the PE takes the exception. 


G1.16.14 Additional pseudocode functions for exception handling 


The AArch32.EnterMonitorMode() pseudocode function changes the PE mode to Monitor mode, with the required 
state changes. 
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The AArch32.EnterHypMode() pseudocode function changes the PE mode to Hyp mode, with the required state 
changes. 


The AArch32.EnterMode() pseudocode function changes the PE mode to a PL1 mode, with the required state changes. 
It is used for all exceptions that are not routed to Hyp mode or Monitor mode. 


The AArch32.EnterMonitorMode(), AArch32.EnterHypMode(), and AArch32.EnterMode() functions are described in 
Chapter J1 Armv8 Pseudocode. 
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Reset into AArch32 state 


Reset on page D1-2289 describes the Armv8 reset model, including the defined levels of reset. When reset is 
deasserted, the PE starts executing instructions in the highest implemented Exception level. If that Exception level 
is using AArch32, then it starts execution: 


$ In Secure state, if the implementation includes EL3. 

° With interrupts disabled: 
— In Hyp mode, if the highest implemented Exception level is EL2. 
— In Supervisor mode, otherwise. 


Note 


s This section describes the architectural requirements for a reset into AArch32 state. It takes no account of 
whether Arm licenses any particular combination of Exception levels and Execution state. For more 
information about the licensed combinations, see Support for Exception levels and Execution states on 
page D1-2394. 





: The Execution state in which the highest implemented Execution level starts executing instructions on 
coming out of reset might be determined by a configuration input signal. 





Reset returns some PE state to architecturally-defined or IMPLEMENTATION DEFINED values, and makes other state 
UNKNOWN, as described in PE state on reset into AArch32 state on page G1-5559. For more information about 
behavior when resetting into an Exception level using AArch32, see: 


° Behavior of caches at reset on page G4-5693. 

. Enabling stages of address translation on page G5-5730. 
. TLB behavior at reset on page G5-5790. 

. Reset and debug on page H6-6819. 


When reset is deasserted, if the PE resets into an Exception level that is using AArch32, it is IMPLEMENTATION 
DEFINED whether execution starts: 





° From an IMPLEMENTATION DEFINED address. 

. If reset is into EL3 or EL1, from the low or high reset vector address, as determined by the reset value of the 
SCTLR.V bit. This reset value can be determined by an IMPLEMENTATION DEFINED configuration input 
signal. 

Note 


This option might be implemented for compatibility with earlier versions of the architecture. 





Software might be able to identify the reset address: 


e If reset is into EL3, by reading the reset value of MVBAR. That is, after coming out of reset, by reading 
MVBAR before the boot software has updated it. It is IMPLEMENTATION DEFINED whether this discovery 
mechanism is supported. 


s If reset is into EL2 or EL1, by reading RVBAR. RVBAR can only be implemented at the highest implemented 
Exception level, and only if that Exception level is not EL3. 


If RVBAR is not implemented, and at all Exception levels other than the highest implemented Exception level, the 
encoding for RVBAR is UNDEFINED. 


The Arm architecture does not define any way of returning to a previous Execution state from a reset. 
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Note 


See the ARM” Generic Interrupt Controller Architecture Specification, GIC architecture version 3.0, and version 
4.0 for the reset requirements for GIC System registers. 





Immediately after a reset, much of the PE state is UNKNOWN. However, some of the PE state is defined. If the PE 
resets to AArch32 state using either a Cold or a Warm reset, the PE state that is defined is as follows: 


° The global exclusive monitor and local exclusive monitor for the PE are UNKNOWN. 
7 If reset is into EL3 using AArch32, then all fields of the SCR reset to zero. 


Note 
This means SCR.NS correctly indicates that the PE is in Secure state. 








$ If reset is into EL2 using AArch32, then reset is into Hyp mode and CPSR.M resets to 0b1010, otherwise reset 
is into Supervisor mode and CPSR.M resets to 0b0011, 


. CPSR.IL resets to 0. 


: The CPACR. {cp11, cp10} fields reset to zero, and if CPACR.ASEDIS is implemented as an RW field it resets 
to zero. 


Note 
When CPACR.TRCDIS is an RW field, its reset value is architecturally UNKNOWN. 








$ PSTATE is reset to the values defined by the AArch32.TakeReset() pseudocode function, see Pseudocode 
descriptions of reset on page G1-5561. 


. The FPEXC.EN field resets to 0. 


s In the SCTLR: 
— The {AFE, TRE, UWXN, WXN, I, SED, ITD, C, A, M} fields reset to 0. 
— The {nTWE, nTWI, CP15BEN} fields reset to 1. 


— The {TE, EE, V} fields reset to IMPLEMENTATION DEFINED values, see the register description for 
more information. 


When the reset is to EL3 using AArch32 then these reset values apply only to the Secure instance of the 
SCTLR, and the reset value of the Non-secure SCTLR is architecturally UNKNOWN. 
. All field of the TTBCR reset to 0. 
When the reset is to EL3 using AArch32 then: 
— All fields of the Secure TTBCR reset to 0. 
— Inthe Non-secure TTBCR, the EAE field resets to 0, and the reset values of all other fields are 
architecturally UNKNOWN. 
è The VBAR resets to an IMPLEMENTATION DEFINED value. 
When the reset is to EL3 using AArch32 then this reset value applies only to the Secure instance of the 
register, and the reset value of the Non-secure VBAR is architecturally UNKNOWN. 
° All fields of the DBGDCCINT reset to 0. 
° The DBGDSCRext. {MDBGen, UDCCadis} fields reset to 0. 


. The DBGOSDLR.DLK field resets to 0. 
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In addition: 


If the reset is into EL1 using AArch32 


In the RMR register, the RR field resets to 0 on any warm or cold reset, and the AA64 field 
resets to 0 on a Cold reset. 


If the reset is into EL2 using AArch32 


In the HRMR, the RR field resets to 0 on any warm or Cold reset, and the AA64 field resets 
to 0 on a Cold reset. 


The HSCTLR. {I, C, M} fields all reset to 0, and the HSCTLR.EE field resets to an 
IMPLEMENTATION DEFINED value. 


If the reset is into EL2 using AArch32 or into EL3 using AArch32 


For a reset into EL3 using AArch32 these reset values apply only if the implementation includes 
EL2, see the register descriptions for more information. 


All fields of the HCPTR reset to zero. 
All fields of the HCR reset to zero. 

The HCR2.{ID, CD} fields reset to zero. 
All fields of the HSTR reset to zero. 


The VMPIDR resets to the value of the MPIDR, see the register description for more 
information. 


The VPIDR resets to the value of the MIDR, see the register description for more 
information. 


The VTTBR.VMID field resets to zero. 

In the HDCR: 

— The HPMN field resets to the IMPLEMENTATION DEFINED value of PMCR.N. 
— The reset value of the HPME field is architecturally UNKNOWN. 

—  Allother fields reset to 0. 


If the reset is into EL3 using AArch32 


The MVBAR resets to an IMPLEMENTATION DEFINED value, see the register description for 
more information. 


If the NSACR.{NSTRCDIS, NSASEDIS} fields are RW fields then they reset to 0. 


In the RMR register, the RR field resets to 0 on any warm or Cold reset, and the AA64 field 
resets to 0 on a Cold reset. 


All fields of the SCR reset to zero. 
All fields of the SDER reset to 0. 
All fields of the SDCR reset to zero. 


For either a warm or a Cold reset 


The EDPRSR.SR field resets to 1. 
The EDESR.{SS, RC, OSUC} fields reset to 0. 


For a Cold reset only 


The EDSCR. {RXO, TXU, INTdis, TDA, MA, HDE, ERR, RXfull, TXfull} fields reset to 0. 
The EDECCR. {NSE, SE} fields reset to 0. 

The EDPRSR. {SPMAD, SDAD} fields reset to 0, and the EDPRSR.SPD field resets to 1. 
The DBGOSLSR.OSLK field resets to 1. 

The DBGPRCR.CORENPDRQ field resets to the value of EDPRCR.COREPURQ. 
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An External Debug reset sets EDPRCR.COREPURQ to 0, see External debug register resets 
on page H8-6847. If an External Debug reset and a Cold reset coincide, both 
DBGPRCR.CORENPRDRQ and EDPRCR.COREPURQ are reset to 0. 


° The debug CLAIM bits are reset to 0. 


Note 


These are the bits that are set to 1 by writing to DBGCLAIMSET.CLAIM, and reset to 0 by 
writing to DBGCLAIMCLR.CLAIM. 








° Each bit of AMCNTENCLRO, AMCNTENCLR1, AMCNTENSETO, and AMCNTENSETI1 
is set to 0. 


3 Each of the implemented architected activity monitor counters AMEVCNTRO<n> and each 
of the implemented auxiliary activity monitor counters AMEVCNTRI1<n> are set to 0. 


For more information about resets in AArch32 System registers, see Chapter G8 AArch32 System Register 
Descriptions. 


G1.17.2 Pseudocode descriptions of reset 


ARM DDI 0487E.a 
ID070919 


The AArch32.TakeReset() pseudocode procedure describes how the PE behaves when reset is deasserted. 
The AArch32.ResetGeneralRegisters() pseudocode function resets the general-purpose registers. 
The AArch32.ResetSIMDFPRegisters() pseudocode function resets the SIMD and floating-point registers. 


The AArch32.ResetSpecialRegisters() pseudocode function resets the Special-purpose registers, and the debug 
System registers DLR and DSPSR, that are used for handling Debug exceptions. 


The AArch32.ResetSystemRegisters() pseudocode function resets all System registers in the (coproc==0b111x) 
encoding space to their reset state as defined in the register descriptions in Chapter G8 AArch32 System Register 
Descriptions. 





Note 


The ResetSystemRegisters() function only resets the System registers. It has no effect on memory-mapped registers. 


The ResetExternalDebugRegisters() pseudocode function resets all external debug registers to their reset state as 
defined in the register descriptions in Chapter H9 External Debug Register Descriptions. 
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Mechanisms for entering a low-power state 


The following sections describe the architectural mechanisms that a PE can use to request entry to a low-power 
state: 


è Wait For Event and Send Event. 
° Wait For Interrupt on page G1-5565. 


Wait For Event and Send Event 


The Wait For Event (WFE) mechanism permits a PE to request entry to a low-power state, and, if the request 
succeeds, to remain in that state until an event is generated by a Send Event operation, or another WFE wake-up 
event occurs. Example G1-2 describes how a spinlock implementation might use this mechanism to save energy. 


Example G1-2 Spinlock as an example of using Wait For Event and Send Event 


A multiprocessor operating system requires locking mechanisms to protect data structures from being accessed 
simultaneously by multiple PEs. These mechanisms prevent the data structures becoming inconsistent or corrupted 
if different PEs try to make conflicting changes. If a lock is busy, because a data structure is being used by one PE, 
it might not be practical for another PE to do anything except wait for the lock to be released. For example, if a PE 
is handling an interrupt from a device it might need to add data received from the device to a queue. If another PE 
is removing data from the queue, it will have locked the memory area that holds the queue. The first PE cannot add 
the new data until the queue is in a consistent state and the lock has been released. It cannot return from the interrupt 
handler until the data has been added to the queue, so it must wait. 


Typically, a spin-lock mechanism is used in these circumstances: 


è A PE requiring access to the protected data attempts to obtain the lock using single-copy atomic 
synchronization primitives such as the Load-Exclusive and Store-Exclusive operations described in 
Synchronization and semaphores on page E2-3853. 


. If the PE obtains the lock, it performs its memory operation and releases the lock. 


à If the PE cannot obtain the lock, it reads the lock value repeatedly in a tight loop until the lock becomes 
available. At this point, it again attempts to obtain the lock. 


A spin-lock mechanism is not ideal for all situations: 
° In a low-power system, the tight read loop is undesirable because it uses energy to no effect. 


° In a multithreaded implementation, the execution of spin-locks by waiting threads can significantly degrade 
overall performance. 


Using the Wait For Event and Send Event mechanism can improve the energy efficiency of a spinlock. In this 
situation, a PE that fails to obtain a lock can execute a Wait For Event instruction, WFE, to request entry to a 
low-power state. When a PE releases a lock, it must execute a Send Event instruction, SEV, causing any waiting PEs 
to wake up. Then, these PEs can attempt to gain the lock again. 


The execution of a WFE instruction can cause suspension of execution only if all of the following are true: 
e The instruction does not cause any other exception. 
. When the instruction is executed: 

— The Event Register is not set. 

— There is not a pending WFE wakeup event. 


For more information about the trap to EL2, see Traps to Hyp mode of Non-secure ELO and EL1 execution of WFE 
and WFI instructions on page G1-5595. 


The architecture does not define the exact nature of the low power state entered as a result of executing a WFE 
instruction, but the execution of a WFE instruction must not cause a loss of memory coherency. 
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Note 


Although a complex operating system can contain thousands of distinct locks, the event sent by this mechanism does 
not indicate which lock has been released. If the event relates to a different lock, or if another PE acquires the lock 
more quickly, the PE fails to acquire the lock and can reenter the low-power state waiting for the next event. 








The Wait For Event system relies on hardware and software working together to achieve energy saving: 
è The hardware provides the mechanism to enter the Wait For Event low-power state. 


° The operating system software is responsible for issuing: 


— A Wait For Event instruction, to request entry to the low-power state, used in the example when 
waiting for a spin-lock. 


— A Send Event instruction, required in the example when releasing a spin-lock. 


The mechanism depends on the interaction of: 
° WFE wake-up events, see WFE wake-up events on page G1-5564. 


s The Event Register, see The Event Register. 
` The Send Event instructions, see The Send Event instructions on page G1-5564. 
° The Wait For Event instruction, see The Wait For Event instruction. 


The Event Register 


The Event Register is a single bit register for each PE. When set, an event register indicates that an event has 
occurred, since the register was last cleared, that might require some action by the PE. Therefore, the PE must not 
suspend operation on issuing a WFE instruction. 


The reset value of the Event Register is UNKNOWN. 


The Event Register for a PE is set by: 


° The execution of an SEV instruction on any PE in the multiprocessor system. 

i The execution of an SEVL instruction by the PE. 

è An exception return. 

3 An event from a Generic Timer event stream, see Event streams on page G6-5863. 
. An event sent by some IMPLEMENTATION DEFINED mechanism. 


As shown in this list, the Event Register might be set by IMPLEMENTATION DEFINED mechanisms. 
The Event Register is cleared only by a Wait For Event instruction. 


Software cannot read or write the value of the Event Register directly. 


The Wait For Event instruction 
The action of the Wait For Event instruction depends on the state of the Event Register: 


è If the Event Register is set, the instruction clears the register and completes immediately. Normally, if this 
happens the software makes another attempt to claim the lock. 


7 If the Event Register is clear the PE can suspend execution, and hardware might enter a low-power state. The 
PE can remain suspended until a WFE wake-up event or a reset occurs. When a WFE wake-up event occurs, 
or earlier if the implementation chooses, the WFE instruction completes. 


The execution in AArch32 state of a WFE instruction that would otherwise cause suspension of execution might be 
trapped, see: 


. Traps to Undefined mode of ELO execution of WFE and WFI instructions on page G1-5579. 
. Traps to Hyp mode of Non-secure ELO and EL1 execution of WFE and WFI instructions on page G1-5595. 


$ Traps to Monitor mode of the execution of WFE and WFI instructions in modes other than Monitor mode on 
page G1-5606. 
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The Wait For Event instruction, WFE, is available at all privilege levels, see WFE on page F5-4771. 


Software using the Wait For Event mechanism must tolerate spurious wake-up events, including multiple wake ups. 


WFE wake-up events 


The following events are WFE wake-up events: 
è The execution of an SEV instruction on any PE in the system. 
$ The execution of an SEVL instruction on the PE. 
7 A physical IRQ interrupt, unless masked by the PSTATE.] bit. 
$ A physical FIQ interrupt, unless masked by the PSTATE.F bit. 
s A physical SError interrupt, unless masked by the PSTATE.A bit. 
° In Non-secure state in any mode other than Hyp mode: 
— When HCR.IMO is set to 1, a virtual IRQ interrupt, unless masked by the PSTATE.I bit. 
— When HCR.FMO is set to 1, a virtual FIQ interrupt, unless masked by the PSTATE.F bit. 
— When HCR.AMO is set to 1, a virtual SError interrupt, unless masked by the PSTATE.A bit. 


: An asynchronous External Debug Request debug event, if halting is allowed. For the definition of halting is 
allowed, see Halting allowed and halting prohibited on page H2-6705. 


See also External Debug Request debug event on page H3-6761. 


s An event sent by the timer event stream, see Event streams on page D11-2795. 
à An event sent by some IMPLEMENTATION DEFINED mechanism. 
$ An event caused by the clearing of the global monitor associated with the PE. 


In addition to the possible masking of WFE wake-up events shown in this list, when invasive debug is enabled and 
EDSCR.HDE is set to 1, EDSCR.INTdis can mask interrupts, including masking them acting as WFE wake-up 
events. See the register description for more information. 


As shown in the list of wake-up events, an implementation can include IMPLEMENTATION DEFINED hardware 
mechanisms to generate wake-up events. 


Note 


For more information about PSTATE masking, see Asynchronous exception masking controls on page G1-5531. If 
the configuration of the masking controls provided by EL2 and EL3 mean that a PSTATE mask bit cannot mask the 
corresponding exception, then the physical exception is a WFE wake-up event, regardless of the value of the 
PSTATE mask bit. 





The Send Event instructions 
The Send Event instructions are: 
SEV, Send Event This causes an event to be signaled to all PEs in the multiprocessor system. 


SEVL, Send Event Local 


This must set the local Event Register. It might signal an event to other PEs, but is not 
required to do so. 


The mechanism that signals an event to other PEs is IMPLEMENTATION DEFINED. The PE is not required to guarantee 
the ordering of this event with respect to the completion of memory accesses by instructions before the SEV 
instruction. Therefore, Arm recommends that software includes a DSB instruction before any SEV instruction. 


Note 


A DSB instruction ensures that no instruction, including any SEV instruction, that appears in program order after the 
DSB instruction, can execute until the DSB instruction has completed. For more information, see Data Synchronization 
Barrier (DSB) on page E2-3824. 
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The SEVL instruction appears to execute in program order relative to any subsequent WFE instruction executed on the 
same PE, without the need for any explicit insertion of barrier instructions. 


Execution of the Send Event instruction sets the Event Register. 


The Send Event instructions are available at all privilege levels. 


Pseudocode description of the Wait For Event mechanism 
This section defines pseudocode functions that describe the operation of the Wait For Event mechanism. 
The ClearEventRegister() pseudocode procedure clears the Event Register of the current PE. 


The IsEventRegisterSet() pseudocode function returns TRUE if the Event Register of the current PE is set and 
FALSE if it is clear. 


The WaitForEvent() pseudocode procedure optionally suspends execution until a WFE wake-up event or reset 
occurs, or until some earlier time if the implementation chooses. It is IMPLEMENTATION DEFINED whether restarting 
execution after the period of suspension causes a ClearEventRegister() to occur. 


The SendEvent() pseudocode procedure sets the Event Register of every PE in the system. 


G1.18.2 Wait For Interrupt 
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AArch32 state supports Wait For Interrupt through an instruction, WFI, that is provided in the A32 and T32 
instruction sets. For more information, see WFI on page F5-4773. 


When a PE issues a WFI instruction, its execution can be suspended, and a low-power state can be entered. 


The execution in AArch32 state of a WFI instruction that would otherwise cause suspension of execution might be 
trapped, see: 


. Traps to Undefined mode of ELO execution of WFE and WFI instructions on page G1-5579. 
. Traps to Hyp mode of Non-secure ELO and EL1 execution of WFE and WFI instructions on page G1-5595. 


7 Traps to Monitor mode of the execution of WFE and WFI instructions in modes other than Monitor mode on 
page G1-5606. 


The execution of a WFI instruction can cause suspension of execution only if both: 
° The instruction does not cause any other exception. 
è When the instruction is executed, there is not a pending WFI wakeup event. 


WFI wake-up events 


The PE can remain suspended in its WFI state until it is reset, or one of the following WFI wake-up events occurs: 
è A physical IRQ interrupt, regardless of the value of the PSTATE.I bit. 
7 A physical FIQ interrupt, regardless of the value of the PSTATE.F bit. 
a A physical SError interrupt, regardless of the value of the PSTATE.A bit. 
è In Non-secure state in any mode other than Hyp mode: 
— When HCR.IMO is set to 1, a virtual IRQ interrupt, regardless of the value of the PSTATE.I bit. 
— When HCR.FMO is set to 1, a virtual FIQ interrupt, regardless of the value of the PSTATE.F bit. 
— When HCR.AMO is set to 1, a virtual SError interrupt, regardless of the value of the PSTATE.A bit. 


à An asynchronous External Debug Request debug event, if halting is allowed. For the definition of halting is 
allowed, see Halting allowed and halting prohibited on page H2-6705. 


See also External Debug Request debug event on page H3-6761. 


An implementation can include other IMPLEMENTATION DEFINED hardware mechanisms to generate WFI wake-up 
events. 


When a WFI wake-up event is detected, or earlier if the implementation chooses, the WFI instruction completes. 


WFI wake-up events cannot be masked by the mask bits in the PSTATE. 
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The architecture does not define the exact nature of the low power state, but the execution of a WFI instruction must 
not cause a loss of memory coherency. 





Note 


° Because debug events are WFI wake-up events, Arm strongly recommends that Wait For Interrupt is used as 
part ofan idle loop rather than waiting for a single specific interrupt event to occur and then moving forward. 
This ensures the intervention of debug while waiting does not significantly change the function of the 
program being debugged. 


è In some previous implementations of Wait For Interrupt, the idle loop is followed by exit functions that must 
be executed before taking the interrupt. The operation of Wait For Interrupt remains consistent with this 
model, and therefore differs from the operation of Wait For Event. 


è Some implementations of Wait For Interrupt drain down any pending memory activity before suspending 
execution. The Arm architecture does not require this operation, and software must not rely on Wait For 
Interrupt operating in this way. 





Using WFI to indicate an idle state on bus interfaces 


A common implementation practice is to complete any entry into powerdown routines with a WFI instruction. 
Typically, the WFI instruction: 

1. Forces the completion of execution of any instructions that are in progress, and of all associated bus activity. 
2. Suspends the execution of instructions by the PE. 


The control logic required to do this tracks the activity of the bus interfaces used by the PE. This means it can signal 
to an external power controller when there is no ongoing bus activity. 


However, memory-mapped and external debug interface accesses to debug registers must continue to be processed 
while the PE is in the WFI state. The indication of idle state to the system normally only applies to the non-debug 
functional interfaces used by the PE, not the debug interfaces. 


If ARMv8.0-DoubleLock is implemented and the value of DBGOSDLR.DLK, the OS Double Lock status bit, is set 
to 1, this idle state must not be signaled to the PE unless the system can guarantee, also, that the debug interface is 
idle. 


Note 


When separate Core and Debug power domains are implemented, the debug interface referred to in this section is 
the interface between the Core and Debug power domains, since the signal to the power controller indicates that the 
Core power domain is idle. For more information about the power domains, see Power domains and debug on 
page H6-6807. 








The exact nature of this interface is IMPLEMENTATION DEFINED, but the use of Wait For Interrupt as the only 
architecturally-defined mechanism that completely suspends execution makes it very suitable as the preferred 
powerdown entry mechanism. 


Pseudocode description of Wait For Interrupt 


The WaitForInterrupt() pseudocode function optionally suspends execution until a WFI wake-up event or reset 
occurs, or until some earlier time if the implementation chooses. 
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G1.19 The AArch32 System register interface 


In ArmArmv8, most System registers are accessed using the instructions described in System register access 
instructions on page F1-3887. The System register interface provides access to those instructions, and: 


These registers are encoded using the parameters {coproc, opc1, CRn, CRm, opc2}, with permitted coproc values 
of 0b1110 and 0b1111. 


Some of these encodings provide the AArch32 System instructions. 


To maintain compatibility with previous versions of the Arm architecture, the access controls for the 
AArch32 System registers include the access controls for AArch32 Advanced SIMD and floating-point 
functionality. 

Note 
See Background to the System register interface on page G1-5568 for more information. 





The following sections give more information about the AArch32 System register interface: 


System registers in the coproc == 0b111x encoding space. 

Access to System registers. 

Access controls for Advanced SIMD and floating-point functionality. 
Background to the System register interface on page G1-5568. 


G1.19.1 System registers in the coproc == @b111x encoding space 


In AArch32 state: 


The coproc == 0b1110 encoding space is reserved for the configuration and control of: 

— Debug features, see Debug registers on page G8-6376. 

— Trace features, see the Embedded Trace Macrocell Architecture Specification. 

— Identification registers for the Trivial Jazelle implementation, see Trivial implementation of the Jazelle 


extension on page G1-5499., 


The coproc == 0b1111 encoding space is reserved for the control and configuration of the PE, including 
architecture and feature identification. This means these encodings provide access to the System registers that 
control and return status information for PE operation. 


For more information, see Chapter G8 AArch32 System Register Descriptions. 


G1.19.2 Access to System registers 


Most System registers are accessible only from EL1 or higher. For possible accesses from ELO the register 
descriptions in Chapter G8 AArch32 System Register Descriptions indicate whether a register is accessible from 


ELO. 


G1.19.3 Access controls for Advanced SIMD and floating-point functionality 


ARM DDI 0487E.a 
ID070919 


In Armv8, the CPACR controls access to Advanced SIMD and floating-point functionality from software executing 
at PL1 or ELO in AArch32 state: 


The {cp10, cp11} fields control access to all Advanced SIMD and floating-point functionality, and can: 
— Disable ELO and PL1 access to this functionality. 

— Enable access to this functionality at PL1 only. 

— Enable access to this functionality at ELO and PL1. 


The ASEDIS field controls access to Advanced SIMD instructions that are not also floating-point 
instructions. 
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G1.19.4 


G1-5568 


Initially on powerup or reset into AArch32 state, all access to all Advanced SIMD and floating-point functionality 
from PL1 and ELO is disabled. 


Note 
The CPACR has no effect on accesses from Hyp mode. 








If an implementation includes EL3, the NSACR determines whether Advanced SIMD and floating-point 
functionality can be accessed from Non-secure state: 


° The {cp10, cp11} fields control Non-secure access to all Advanced SIMD and floating-point functionality. 


. The NSASEDIS field controls Non-secure access to Advanced SIMD instructions that are not also 
floating-point instructions. 


If an implementation includes EL2, the HCPTR provides additional controls on Non-secure accesses to Advanced 
SIMD and floating-point functionality. For accesses that are otherwise permitted by the CPACR and NSACR 
settings, setting HCPTR bits to 1: 


è Traps otherwise-permitted accesses from EL1 or ELO to EL2. When EL2 is using AArch32, these accesses 
are trapped to Hyp mode. 


. Makes accesses from EL2 mode UNDEFINED. When EL2 is using AArch32, this makes accesses from Hyp 
mode UNDEFINED. 


In the HCPTR: 
s The {TCP10, TCP11} fields control access to all Advanced SIMD and floating-point functionality. 
° The TASE field controls access to Advanced SIMD instructions that are not also floating-point instructions. 


° The TCPAC field traps Non-secure EL1 accesses to the CPACR to Hyp mode. 


For more information, see General trapping to Hyp mode of Non-secure accesses to the SIMD and floating-point 
registers on page G1-5596. 





Note 


Whenever a pair of fields control the access to the Advanced SIMD and floating-point functionality, the values of 
each field of the pair must be identical. In Armv8, if these settings are not identical the behavior of the Advanced 
SIMD and floating-point functionality is CONSTRAINED UNPREDICTABLE, see Handling of System register control 


fields for Advanced SIMD and floating-point operation on page K1-7612. 





For more information about Advanced SIMD and floating-point support, see Advanced SIMD and floating-point 
support on page G1-5570. 


Background to the System register interface 


Note 


This section is not part of the Armv8 Architecture specification. It is included only to present the rationale of some 
aspects of the System register interface. 





The interface to the System registers was originally defined as part of a generic coprocessor interface, that gave 
access to 15 coprocessors, CPO - CP15. Of these, CP8 - CP15 were reserved for use by Arm, while CPO - CP7 were 
available for IMPLEMENTATION DEFINED coprocessors. 


The coprocessors were accessed using coprocessor instructions. These instructions remain part of the T32 and A32 
instruction sets, see System register access instructions on page F1-3887. 


In the Arm coprocessor model, a coprocessor included both: 


$ Primary and secondary coprocessor registers, that form part of the coprocessor interface. 
e A number of internal registers. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


The AArch32 System Level Programmers’ Model 
G1.19 The AArch32 System register interface 


When accessing a 32-bit internal coprocessor register, using an MCR or MRC instruction, the instruction specified: 


$ The target coprocessor, specified by the coproc parameter and taking a value between p@ for CPO and p15 for 
CP15. 

è The primary coprocessor register, specified by the CRn parameter and taking a value between c@ and c15. 

° The secondary coprocessor register, specified by the CRm parameter and taking a value between c0 and c15. 

° Up to two additional parameters, opc1 and opc2, taking values between 0 and 7. 


Other instructions in the group described in System register access instructions on page F1-3887 take a subset of 
these parameters: 


° In the Armv7 definitions, LDC and STC instructions take parameters {coproc, CRd}, where CRd is the primary 
coprocessor register. 


° MCRR and MRRC instructions take parameters {coproc, opc1, CRm}, where CRm is the primary coprocessor register. 


To maintain backwards compatibility, the arguments to an MCR or MRC instruction remain {coproc, opc1, CRn, CRm, 
opc2}. Correspondingly, the encoding of the AArch64 System registers is described using the parameters {opQ, op1, 
CRn, CRm, op2}. However: 

è The naming of these parameters no longer has any particular significance. 

. While the coproc field is a 4-bit field, op0 is a 2-bit field. 


Of the coprocessors reserved for use by Arm, in Armv7 and earlier versions of the architecture: 


° CP15 provided access to the System registers relating to non-debug operation, and was originally called the 
System control coprocessor. In Armv8, these registers are described as being in the coproc == 0b1111 
encoding space. 


° CP 14 provided access to additional System registers, including those relating to debug and trace. In Armv8, 
these registers are described as being in the coproc == 0b1110 encoding space. 


a CP10 and CP11 were used for Advanced SIMD and floating-point control, and many coprocessor instruction 
encodings targeting CP10 and CP11 were used as floating-point instruction encodings: 


— Generally Armv8 does not relate these instructions to the coprocessor encoding space, but the naming 
of registers and register fields for Advanced SIMD and floating-point control reflects the historic 
coprocessor model. 


— Because the Advanced SIMD and floating-point functionality used both CP10 and CP11, some System 
register controls of this functionality have a pair of fields, for example NSACR. {cp10, cp11}. In these 
cases, both fields must be set to the same value. For more information, see Access controls for 
Advanced SIMD and floating-point functionality on page G1-5567. 


In Armvs: 


° The AArch32 System registers include registers that were described as Special registers in Armv7 and earlier 
versions of the architecture. This means that the Armv8 System registers include registers that are outside the 
earlier coprocessor model. 


° The Armv7 AArch32 instruction encodings for LDC, STC, MCR, MRC, MCRR, and MRRC instructions with coproc field 
values other than {1010, 1011, 1110, 1111} are available for reuse. Armv8.2 re-uses some encodings in this 
way. 
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G1.20 


G1.20.1 


G1.20.2 


G1-5570 


Advanced SIMD and floating-point support 


Advanced SIMD and floating-point instructions on page E1-3794 introduces: 


s The scalar floating-point instructions in the A32 and T32 instruction sets. 
> The Advanced SIMD integer and floating-point vector instructions in the A32 and T32 instruction sets. 
a The SIMD and floating-point register file, that can be viewed as: 


— Singleword registers SO - S31. 
— Doubleword registers DO - D31. 
— Quadword registers QO - Q15. 
° The Floating-Point Status and Control Register (FPSCR). 


For more information about the System registers for the Advanced SIMD and floating-point operation, see 
Advanced SIMD and floating-point System registers on page G1-5572. Software can interrogate these registers to 
discover the implemented Advanced SIMD and floating-point support. 


AArch32 implications of not including support for Advanced SIMD and floating-point summarizes the effects of not 
supporting these instructions, and the following subsections give more information about the Advanced SIMD and 
Floating-point support: 


. Enabling Advanced SIMD and floating-point support. 

° Advanced SIMD and floating-point System registers on page G1-5572. 

. Context switching when using Advanced SIMD and floating-point functionality on page G1-5573. 
° Floating-point exceptions and exception traps on page G1-5574. 


AArch32 implications of not including support for Advanced SIMD and floating-point 


As stated in Implementations not including Advanced SIMD and floating-point instructions on page D1-2394, 
although Armv8-A generally requires the inclusion of the Advanced SIMD and floating-point instructions in all 
instruction sets, for implementations targeting specialized markets, Arm might produce or license Armv8-A 
implementations that do not provide any support for Advanced SIMD and floating-point instructions. In such an 
implementation, in AArch32 state: 


: The CPACR. {ASEDIS, cp11, cp10} fields are RESO. 
z The NSACR.{NSASEDIS, cp11, cp10} fields are RESO. 
° The HCPTR. {TASE, TCP11, TCP10} fields are RES1. 


° The FPEXC, FPSCR, FPSID, MVFRO, MVFR1, and MVFR2 registers are not implemented and their 
encodings are UNDEFINED. 


5 Attempted accesses to Advanced SIMD and floating-point functionality are UNDEFINED. This means: 
— All Advanced SIMD and floating-point instructions are UNDEFINED. 
— Attempts to access the Advanced SIMD and floating-point System registers are UNDEFINED. 


Enabling Advanced SIMD and floating-point support 


Software must ensure that the required access to the Advanced SIMD and floating-point features is enabled. Most 
of those controls are described in Configurable instruction enables and disables, and trap controls on 
page G1-5576, and this section: 


$ Summarizes those controls. 

7 Provides additional information in the following subsections: 
—  FPEXC control of access to Advanced SIMD and floating-point functionality on page G1-5572. 
—  ELO access to Advanced SIMD and floating-point functionality on page G1-5572. 
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Note 


This section shows the controls when the controlling Exception levels are using AArch32. Similar controls are 
provided when the Exception levels are using AArch64, and then apply to lower Exception levels that are using 
AArch32. 








The controls of access to Advanced SIMD and floating-point functionality are: 


General {cp10, cp11} or {TCP10, TCP11} controls 
This relates to the CPACR. {cp10, cp11}, NSACR. {cp10, cp11}, and HCPTR.{TCP10, TCP11} 


controls. 


— Note 


Background to the System register interface on page G1-5568 explains the naming of these controls. 





The {cp10, cp11} controls provide general control of the use of Advanced SIMD and floating-point 
functionality, as follows: 


. CPACR. {cp10, cp11} control access from PE modes other than Hyp mode. 
These fields have no effect on accesses to Advanced SIMD and floating-point functionality 
from Hyp mode. 


e In an implementation that includes EL3, NSACR. {cp10, cp11} control access from 
Non-secure state. 


s In an implementation that includes EL2, if NSACR. {cp10, cp11} permit Non-secure 
accesses, or if EL3 is not implemented, HCPTR. {TCP10, TCP11} provide an additional 
control on those accesses. 


In each case, the {cp10, cp11} controls must be programmed to the same value, otherwise operation 
is CONSTRAINED UNPREDICTABLE. The Armv8 CONSTRAINED UNPREDICTABLE behavior is that, for 
all purposes other than reading the value of the register field, behavior is as if the cp11 field has the 
same value as the cp10 field. For more information, see Handling of System register control fields 
for Advanced SIMD and floating-point operation on page K1-7612. 


For more information about these controls, see: 
. Enabling PLO and PL1 accesses to the SIMD and floating-point registers on page G1-5581. 


: General trapping to Hyp mode of Non-secure accesses to the SIMD and floating-point 
registers on page G1-5596. 


. Enabling Non-secure access to SIMD and floating-point functionality on page G1-5608. 


Control of accesses to the CPACR from Non-secure PL1 modes 


As stated in General {cp10, cp11} or {TCP10, TCP11} controls, the CPACR controls access to 
Advanced SIMD and floating-point functionality from PE modes other than Hyp mode. Accesses 
to the CPACR from Non-secure PL1 modes can be trapped to EL2, see Traps to Hyp mode of 
Non-secure EL] accesses to the CPACR on page G1-5597. 


Additional controls of Advanced SIMD functionality 


è Ifimplemented as an RW field, CPACR.ASEDIS can make all Advanced SIMD instructions 
UNDEFINED in all modes other than Hyp mode. 


° In an implementation that includes EL3, when CPACR.ASEDIS permits use of the Advanced 
SIMD instructions or if the CPACR.ASEDIS control is not implemented, 
NSACR.NSASEDIS can make all Advanced SIMD instructions UNDEFINED in Non-secure 
state. 


- In an implementation that includes EL2, when the CPACR and NSACR settings permit 
Non-secure use of the Advanced SIMD instructions, if HCPTR.TASE is implemented as an 
RW field it can make these instructions UNDEFINED in Hyp mode, and trap to Hyp mode any 
use of these instructions in a Non-secure PLO or PL1 mode. 
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G1.20.3 


G1-5572 


For more information about these controls, see: 
. Disabling PLO and PL1 execution of Advanced SIMD instructions on page G1-5582. 


. Traps to Hyp mode of Non-secure accesses to Advanced SIMD functionality on 
page G1-5597. 


. Disabling Non-secure access to Advanced SIMD functionality on page G1-5609. 


Pseudocode description of enabling SIMD and floating-point functionality on page G1-5609 provides links to the 
pseudocode descriptions of all of these controls. 


FPEXC control of access to Advanced SIMD and floating-point functionality 


In addition, FPEXC.EN is an enable bit for most Advanced SIMD and floating-point operations. When FPEXC.EN 
is 0, all Advanced SIMD and floating-point instructions are treated as UNDEFINED except for: 


è A VMSR to the FPEXC or FPSID register. 
° A WRS from the FPEXC, FPSID, MVFRO, MVFR1, or MVFR2 register. 


These instructions can be executed only at EL1 or higher. 


Note 
° When the FPSID is accessible, any write access to the FPSID is ignored. 





$ When FPEXC.EN is 0, these operations are treated as UNDEFINED: 
— A VNSR to the FPSCR. 
— A VNRS from the FPSCR. 





See Enabling access to the SIMD and floating-point registers on page G1-5582 for more information about the 
scope of the FPEXC.EN control. 


When executing at ELO, the PE behaves as if the value of FREXC.EN is 1 if either: 


. EL1 is using AArch64. 
è EL2 is enabled in the current Security state and is using AArch64. and the value of HCR_EL2.TGE is 1. 


Note 


In Non-secure state, if the value of HCR_EL2.RW is 0 then it is permitted for the value of 
FPEXC32_EL2.EN to control whether Advanced SIMD and floating-point functionality is enabled. 
However, Arm deprecates using the value of FREXC32_EL2.EN to determine behavior. 








ELO access to Advanced SIMD and floating-point functionality 


When the access controls summarized in this section permit ELO access to the Advanced SIMD and floating-point 
functionality, this applies only to the subset of functionality that is available at ELO. In particular: 


7 Only Advanced SIMD and Floating-point System register that is accessible is the FPSCR. 
à The Advanced SIMD and floating-point instructions are available. 


Execution at ELO corresponds to the application level view of the Advanced SIMD and floating-point functionality, 
as described in Advanced SIMD and floating-point System registers on page E1-3796. 


Advanced SIMD and floating-point System registers 


AArch32 state provides a common set of System registers for the Advanced SIMD and floating-point functionality. 
This section gives general information about this set of registers, and indicates where each register is described in 
detail. It contains the following subsections: 


. Register map of the Advanced SIMD and floating-point System registers on page G1-5573. 
. Accessing the Advanced SIMD and floating-point System registers on page G1-5573. 
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Register map of the Advanced SIMD and floating-point System registers 


Table G1-21 shows the register map of the Advanced SIMD and Floating-point registers. Each register is 32 bits 
wide. 


Table G1-21 Floating-point registers 























Name Permitted access 
FPEXC RW 

FPSCR RW 

FPSID RWwa 

MVFRO RO 

MVFRI RO 

MVFR2 RO 





a. When FPSID is accessible, VMSR accesses to FPSID are ignored. 


In an implementation that includes EL3, the Advanced SIMD and Floating-point registers are common registers, 
see Common System registers on page G5-5853. 


Accessing the Advanced SIMD and floating-point System registers 


Software accesses the Advanced SIMD and floating-point System registers using the VMRS and VMSR instructions, see: 
$ VMRS on page F6-5156. 
5 VMSR on page F6-5159. 


For example: 


VMRS <Rt>, FPSID ; Read Floating-Point System ID Register 
VMRS <Rt>, MVFR1 ; Read Media and VFP Feature Register 1 
VMSR FPSCR, <Rt> ; Write Floating-Point System Control Register 


Software can access the Advanced SIMD and floating-point System registers only if the access controls permit the 
access, see Enabling Advanced SIMD and floating-point support on page G1-5570. 


Note 


All hardware ID information can be accessed only from EL1 or higher. This means: 





The FPSID is accessible only from EL1 or higher. 


This is a change introduced from VFPv3. Previously, the FPSID register can be accessed in all 
modes. 


The MVER registers are accessible only from EL1 or higher. 


Unprivileged software must issue a system call to determine what features are supported. 





G1.20.4 Context switching when using Advanced SIMD and floating-point functionality 


ARM DDI 0487E.a 
ID070919 


When the Advanced SIMD and floating-point functionality is used by only a subset of processes, the operating 
system might implement lazy context switching of the Advanced SIMD and floating-point register file and System 
registers. 


In the simplest lazy context switch implementation, the primary context switch software uses the 

CPACR. {cp10, cp11} controls to disable access to the Advanced SIMD and floating-point functionality, see 
Enabling Advanced SIMD and floating-point support on page G1-5570. Subsequently, when a process or thread 
attempts to use an Advanced SIMD or floating-point instruction, it triggers an Undefined Instruction exception. The 
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G1.20.5 


G1-5574 


operating system responds by saving and restoring the Advanced SIMD and floating-point register file and System 
registers. Typically, it then re-executes the Advanced SIMD or floating-point instruction that generated the 
Undefined Instruction exception. 


Floating-point exceptions and exception traps 


Execution of a floating-point instruction can generate an exceptional condition, called a floating-point exception. 


The Armv8-A architecture supports synchronous exception generation in the event of any or all of the following 
floating-point exceptions: 


. Input Denormal. 

° Inexact. 

° Underflow. 

s Overflow. 

° Divide by Zero. 

: Invalid Operation. 
Note 





Do not confuse floating-point exceptions with the AArch32 architectural exceptions summarized in AArch32 state 
exception descriptions on page G1-5536. 





Whether an implementation includes synchronous exception generation for these floating-point exceptions is 
IMPLEMENTATION DEFINED: 


: For an implementation that does provide this capability, FPSCR. {IDE, IXE, UFE, OFE, DZE, IOE} are the 
control bits that enable synchronous exception generation for each of the floating-point exceptions. 


s For an implementation that does provide this capability, the FPSCR. {IDE, IXE, UFE, OFE, DZE, IOE} are 
RAZ/WI. 





Note 


° An Input Denormal floating-point exception is generated when a single-precision or double-precision 
floating-point value is flushed-to-zero because the value of FPSCR.FZ is 1. However, no Input Denormal 
exception is generated when a half-precision floating-point value is flushed-to-zero because the value of 
FPSCR.FZ16 is 1. 


à The Armv8-A architecture does not support asynchronous reporting of floating-point exceptions. 





Trapped exception handling never causes the corresponding cumulative exception bit of the FPSCR to be set to 1. 
If this behavior is desired, the trap handler routine must use a read, modify, write sequence on the FPSCR to set the 
cumulative exception bit. 


When generating synchronous exceptions for one or more floating-point exceptions is enabled, the synchronous 
exceptions generated by the floating-point exception traps are taken to the lowest Exception level that can handle 
such an exception, while adhering to the rule that an exception can never be taken to a lower Exception level. This 
means that trapped floating-point exceptions taken: 


s From ELO are taken to EL1, except for the following cases when they are taken from ELO to EL2: 
—  EL2 is using AArch32 and the value of HCR.TGE is 1. 
—  EL2 is using AArch64 and the value of HCR_EL2.TGE is 1 


. From EL] are taken to EL1. 
. From EL2 are taken to EL2. 
° From EL3 are taken to EL3. 


If the exception is taken to an Exception level that is using AArch64, then it is reported in the ELR_ELx for the 
Exception level to which it is taken, as described in Exception entry on page D1-2293. 
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If the exception is taken to an Exception level that is using AArch32, then it is taken as an Undefined Instruction 
exception, see Undefined Instruction exception on page G1-5536. The FPEXC identifies the floating-point 
exceptions that occurred since the corresponding status bits in that register were last set to 0. 


See also Floating-point exceptions and exception traps on page E1-3797. 
In an implementation that provides synchronous exception generation for floating-point exceptions: 


s Synchronous exception generation applies to floating-point exceptions generated by scalar SIMD and 
floating-point instructions executed in AArch32 state. 


s The registers that are presented to the exception handler are consistent with the state of the PE immediately 
before the instruction that caused the exception. An implementation is permitted not to restore the cumulative 
exception flags in the event of such an exception. 


Armv§8 does not support the trapping of floating-point exceptions from Advanced SIMD instructions executed in 
AArch32 state. 


The AArch32.FPTrappedException() and FPProcessException() pseudocode functions describe the handling of 
trapped floating-point exceptions generated in AArch32 state. 


The AArch32.FPTrappedException() and FPProcessException() functions are described in Chapter J1 Armv& 
Pseudocode. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G1-5575 
Non-Confidential 


The AArch32 System Level Programmers’ Model 
G1.21 Configurable instruction enables and disables, and trap controls 


G1.21 Configurable instruction enables and disables, and trap controls 


This section describes the controls provided by AArch32 state for enabling, disabling, and trapping particular 
instructions. Each control is categorized as an instruction enable, an instruction disable, or a trap control: 


Instruction enables and instruction disables 


Trap controls 


Enable or disable the use of one or more particular instructions at a particular Privilege level and 
Security state. 


When an instruction is disabled as a result of an instruction enable or disable, it is UNDEFINED. 
The exception generated by attempting to executed an UNDEFINED instruction 1s: 


. Taken to EL1 if the UNDEFINED instruction was executed at ELO, unless the instruction was 
executed at Non-secure ELO and is routed to EL2 by the control described in Routing 
exceptions from Non-secure ELO to EL2 on page G1-5516. 


When the exception is taken to ELI, it is taken to Undefined mode. 

d Otherwise, taken to the Exception level at which the UNDEFINED instruction was executed: 
— Ifthe instruction was executed in Hyp mode the exception is taken to Hyp mode. 
— Otherwise, the exception is taken to Undefined mode. 


Control whether one or more instructions, when executed at a particular Privilege level, are trapped. 


— Note 

AArch32 trap controls are described in terms of Privilege levels, rather than Exception levels, 
because the PL1 traps apply at and are controlled from: 

EL1 In Non-secure state, and in Secure state when EL3 is using AArch64. 

EL3 In Secure state when EL3 is using AArch32. 


For more information see Security state, Exception levels, and AArch32 execution privilege on 
page G1-5480. 





Trap controls are grouped as: 


PL1, excluding Monitor mode 


Trapped instructions generate Undefined Instruction exceptions that are taken to 
Undefined mode, unless the instruction was executed at Non-secure ELO and is routed 
to EL2 by the control described in Routing exceptions from Non-secure ELO to EL2 on 
page G1-5516. 


For more information about these traps, see PLZ configurable controls on 
page G1-5577. 
Hyp mode (PL2) 
These traps apply only to execution in Non-secure state. This section only describes the 
traps that apply when EL2 is using AArch32. 


Trapped instructions generate: 


s Hyp Trap exceptions, taken to Hyp mode, if trapped from a mode other than Hyp 
mode. 


° Undefined Instruction exceptions taken to Hyp mode, if trapped from Hyp mode. 


For more information about these traps, see EL2 configurable controls on 
page G1-5585. 


See also Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 


Monitor mode (Secure PL1) 
This section only describes the traps that apply when EL3 is using AArch32. 
Trapped instructions generate Monitor Trap exceptions, that are taken to Monitor mode. 


For more information about these traps, see EL3 configurable controls on 
page G1-5604. 
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An exception generated as a result of an instruction enable or disable, or a trap control, is only taken if the instruction 
does not also generate a higher priority exception. Exception prioritization for exceptions taken to AArch32 state on 
page G1-5504 defines the prioritization of different exceptions on the same instruction. 


Exceptions generated as a result of these controls are synchronous exceptions. 


For exceptions taken to an Exception level that is using AArch32, only exceptions that are taken to Hyp mode are 
reported in a syndrome register, the HSR. 


Note 
: A particular control might have a mnemonic that suggests it is different type of control to the control type it 
is categorized as. For example, CPACR.TRCDIS is a trap control even though TRCDIS is a mnemonic for 
Trace Disable. 





$ An implementation might provide additional controls, in IMPLEMENTATION DEFINED registers, to provide 
control of trapping of IMPLEMENTATION DEFINED features. 


. Configurable instruction enables and disables, and trap controls on page D1-2326 describes controls 
provided by AArch64 state for enabling, disabling, and trapping instructions. Generally, where an AArch64 
control applies to execution at lower Exception levels, it traps the equivalent functionality when that lower 
Exception level is using AArch32. See the AArch64 trap controls for more information. 





This section is organized as follows: 

7 Register access instructions. 

. PL1 configurable controls. 

. EL2 configurable controls on page G1-5585. 

a EL3 configurable controls on page G1-5604. 

s Pseudocode description of configurable instruction enables, disables, and traps on page G1-5609. 


G1.21.1 Register access instructions 


When an instruction is disabled or trapped, the exception is taken before execution of the instruction. This means 
that if the instruction is a register access instruction: 


°: No access is made before the exception is taken. 
. Side-effects that are normally associated with the access do not occur before the exception is taken. 


G1.21.2 PL1 configurable controls 


ARM DDI 0487E.a 
ID070919 


In AArch32 state, each control is associated with a particular System register field that is accessible: 
° When EL3 is using AArch64, or when an implementation does not include EL3, from EL1. 
: When EL3 is using AArch32: 

— In Non-secure state, from EL1. 

— In Secure state, from EL3. 


This means that the controls are described as PL1 controls, because PL1 is defined as being the Privilege level of 
software that is executing: 


è At EL3, if the PE is executing in EL3 and EL3 is using AArch32. 
° At EL1 under all other conditions. 


Where there is an AArch64 control that is equivalent to an AArch32 PL1 control, the AArch64 control is an EL1 
control. 


Any exception that is generated because of an AArch32 PL1 control is taken to a PL1 mode. 





Note 
Any exception generated because of an AArch32 PL1 control is taken to AArch32 state. 
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Table G1-22 shows the AArch32 System registers that contain these controls. 


Table G1-22 System registers that contain instruction enables and disables, and trap controls 





Register name Register description 




















SCTLR System Control Register 

FPEXC Floating-point Exception Control Register 
CPACR Architectural Feature Access Control Register 
DBGDSCRext Monitor System Debug Control Register 
PMUSERENR Performance Monitors User Enable Register 
AMUSERENR Activity Monitors User Enable Register 





Table G1-23 summarizes these controls. 


Table G1-23 Instruction enables and disables, and trap controls, for exceptions taken to Undefined mode 





Control 


























Control type Description 

SCTLR. {nTWE, nTWI} T Traps to Undefined mode of ELO execution of WFE and WFI instructions on 
page G1-5579 

SCTLR.{SED, ITD} D Disabling or enabling PLO and PL1 use of AArch32 deprecated functionality on 

SCTLR.CP1SBEN E page G1-5579 

CPACR.TRCDIS T Traps to Undefined mode of PLO and PL1 System register accesses to trace 
registers on page G1-5580 

CPACR. {cp11, cp10} E Enabling use of Advanced SIMD and floating-point functionality on 

FPEXC.EN E page G1-5581 

CPACR.ASEDIS D 

DBGDSCRext.UDCCdis T Traps to Undefined mode of ELO accesses to the Debug Communications 
Channel (DCC) registers on page G1-5582 

CNTKCTL.{PLOPTEN, PLOVTEN, T Traps to Undefined mode of ELO accesses to the Generic Timer registers on 

PLOPCTEN, PLOVCTEN} page G1-5583 

PMUSERENR. {ER, CR, SW, EN} T Traps to Undefined mode of ELO accesses to Performance Monitors registers on 
page G1-5583 

AMUSERENR.EN T Traps to Undefined mode of ELO accesses to Activity Monitors registers on 


page G1-5584 





a. See Table G1-24. 


G1-5578 


Table G1-24 Control types, for exceptions taken to Undefined mode 














Abbreviation Type See 

D Disable Jnstruction enables and instruction disables on page G1-5576 
E Enable Instruction enables and instruction disables on page G1-5576 
T Trap Trap controls on page G1-5576 
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When generated in Non-secure User mode, exceptions generated by these controls can be routed to EL2, as 
described in Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 
Instructions that fail their Condition code check 


See Conditional execution of undefined instructions on page G1-5538. 


Trapping to PL1 of instructions that are UNPREDICTABLE 


For an instruction that is UNPREDICTABLE or CONSTRAINED UNPREDICTABLE, when the instruction is disabled or 
trapped then it is CONSTRAINED UNPREDICTABLE whether execution of the instruction generates an Undefined 
Instruction exception. 


Traps to Undefined mode of ELO execution of WFE and WFI instructions 


SCTLR. {nTWE, nTWI} trap ELO execution of WFE and WFI instructions to Undefined mode: 


SCTLR.nTWE 
1 This control has no effect on the ELO execution of WFE instructions. 
0 Any attempt to execute a WFE instruction at ELO is trapped to Undefined mode, if the 
instruction would otherwise have caused the PE to enter a low-power state. 
SCTLR.nTWI 
1 This control has no effect on the ELO execution of WFI instructions. 
0 Any attempt to execute a WFI instruction at ELO is trapped to Undefined mode, if the 


instruction would otherwise have caused the PE to enter a low-power state. 


The attempted execution of a conditional WFE or WFI instruction is only trapped if the instruction passes its Condition 
code check. 





Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed 
to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the 
instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken. 





When generated in Non-secure User mode, exceptions generated by these controls can be routed to EL2, as 
described in Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 


For more information about these instructions, and when they can cause the PE to enter a low-power state, see: 
è Wait For Event and Send Event on page G1-5562. 
. Wait For Interrupt on page G1-5565. 


Disabling or enabling PLO and PL1 use of AArch32 deprecated functionality 


Table G1-25 on page G1-5580 shows the deprecated AArch32 functionality that might have disable controls in the 
SCTLR: 


a The SED control is always implemented. 


7 Whether each of the ITD or CP15BEN controls is implemented is IMPLEMENTATION DEFINED. If a control is 
not implemented, then the associated functionality cannot be disabled. 


When an instruction is disabled by one of these controls, it is UNDEFINED at PLO and PL1. This means an attempt 
to execute the instruction at PLO or PL1 generates an Undefined Instruction exception that is taken to Undefined 
mode, unless both of the following apply, in which case the attempted execution generates an exception that is taken 
to EL2, as described in Routing exceptions from Non-secure ELO to EL2 on page G1-5516: 


° The instruction is executed at Non-secure ELO using AArch32. 
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è Either: 
—  EL2 is using AArch32 and the value of HCR.TGE is 1. 
—  EL2 is using AArch64 and the value of HCR_EL2.TGE is 1. 


Table G1-25 PL1 controls for disabling and enabling PLO and PL1 use of AArch32 deprecated functionality 





Instruction enable or 











Deprecated AArch32 functionality disable in the SCTLR@ Disabled instructions 

SETEND instructions SED» SETEND instructions 

Some uses of IT instructions ITD¢ See the SCTLR.ITD description 
Accesses to the CP15DMB, CP15DSB, and CP15ISB CP15BEN¢ MCR accesses to the CP15DMB, CP15DSB, 


barrier instructions 


and CP15ISB instructions 





a. The controls that are implemented in SCTLR are also implemented in SCTLR_EL1, and apply when PL1 is using AArch64 and PLO is using 


AArch32. 


b. SETEND instruction disable. SETEND instructions are disabled when the value of this field is 1. 


c. IT instruction disable. If this control is implemented, some uses of IT instructions are disabled when the value of this field is 1. 


d. System register (coproc==0b1111) memory barrier enable. If this control is implemented, the specified register accesses are disabled when 
the value of CP15BEN is 0. 


G1-5580 


Note 


The uses of the IT instruction, and use of the CP1SDMB, CPI5DSB, and CP15ISB barrier instructions, are 
deprecated for performance reasons. 








Traps to Undefined mode of PLO and PL1 System register accesses to trace registers 


If implemented, the CPACR.TRCDIS control traps PLO and PL1 System register accesses to the trace registers to 
Undefined mode, as follows: 


1 PLO and PL1 accesses to the System register interface to the PE Trace Unit are trapped to Undefined 
mode 

0 This control has no effect on PLO and PL1 accesses to the System register interface to the PE Trace 
Unit. 


If the CPACR.TRCDIS control is not implemented, then the CPACR.TRCDIS field is RAZ/WI. This means the 
CPACR does not provide a trap to Undefined mode of PL1 and PLO System register accesses to trace registers. See 
the register description for more information. 





Note 
s System register accesses to the PE Trace Unit use the (coproc==0b1110) encoding space. 
` The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A architecture is 


implemented with an ETMv4 implementation, ELO accesses to the trace System registers are UNDEFINED. 


$ The Armv8-A architecture does not provide traps on trace register accesses through the optional 
memory-mapped external debug interface. 





System register accesses to the trace System registers can have side-effects. When a System register access is 
trapped, no side-effects occur before the exception is taken, see Register access instructions on page G1-5577. 


If EL3 is implemented and is using AArch32, and NSACR.NSTRCDIS is 1, CPACR.TRCDIS behaves as RAO/WI 
in Non-secure state. This behavior also applies if the CPACR.TRCDIS control is not implemented. 


When generated in Non-secure User mode, an exception generated by this control can be routed to EL2, as described 
in Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 
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Enabling use of Advanced SIMD and floating-point functionality 


Table G1-26 summarizes the controls of Advanced SIMD and floating-point functionality. 


Table G1-26 Controls of use of Advanced SIMD and floating-point functionality 














Control Type Description, see 

CPACR. {cpll, cp10} E Enabling PLO and PL1 accesses to the SIMD and floating-point registers 
FPEXC.EN E Enabling access to the SIMD and floating-point registers on page G1-5582 
CPACR.ASEDIS D Disabling PLO and PL1 execution of Advanced SIMD instructions on page G1-5582 





If any of CPACR. {cp11, cp10}, FREXC.EN, or for Advanced SIMD instructions, CPACR.ASEDIS, disable a 
floating-point or an Advanced SIMD instruction, the instruction is UNDEFINED. Support for the CPACR.ASEDIS 
control is optional, and if the control is not implemented behavior is as if the control permits the execution of 
Advanced SIMD instructions at PL1 and PLO. 


When generated in Non-secure User mode, exceptions generated by these controls can be routed to EL2, as 
described in Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 


Enabling PLO and PL1 accesses to the SIMD and floating-point registers 
CPACR. {cp11, cp10} enable PLO and PL1 accesses to the SIMD and floating-point registers. 


When CPACR.cp10 is: 


00 PLO and PL1 accesses to Advanced SIMD and floating-point registers or instructions are 
UNDEFINED. 

01 PLO accesses to Advanced SIMD and floating-point registers or instructions are UNDEFINED. 

10 Reserved. The effect of programming this field to this value is CONSTRAINED UNPREDICTABLE. 

11 This control permits full access to the Advanced SIMD and floating-point functionality from PLO 
and PL1. 


The value of CPACR.cp11 is ignored. If CPACR.cp11 is programmed with a different value to CPACR.cp10 then 
CPACR.cp11 is UNKNOWN on a direct read of the CPACR. 


Note 
: Software must set CPACR.cp11 and CPACR.cp10 to the same value. 








Table G1-27 shows the registers for which accesses are enabled. 


Table G1-27 Register accesses enabled at PLO and PL1 by CPACR.{cp11, cp10} 





Enabled at Registers 





PLO and PL1, or PLO only? FPSCR, FPEXC, FPSID, MVFRO, MVFR1, MVFR2, and any of the SIMD and floating-point registers 
Q0-Q15, including their views as DO-D31 registers or SO-S31 registers? 





a. Depending on the value of CPACR. {cp11, cp10}. See the register description for details. 


b. Permitted VMSR accesses to the FPSID are ignored, but for the purposes of the {cp10, cp11} controls the architecture defines a VMSR accesses 
to the FPSID from EL1 or higher is an access to a SIMD and floating-point register. 


If EL3 is implemented and is using AArch32, and NSACR. {cp11, cp10} are both set to 0, the functionality 
described in this section is disabled in Non-secure state, and CPACR. {cp11, cp10} are RAZ/WI in Non-secure state. 
See Enabling Non-secure access to SIMD and floating-point functionality on page G1-5608. 
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For more information about SIMD and floating-point support, see Advanced SIMD and floating-point support on 
page G1-5570. 


Enabling access to the SIMD and floating-point registers 

FPEXC.EN enables accesses to the SIMD and floating-point registers at all Exception levels, but does not control 
the following: 

è VMSR accesses to the FPEXC or FPSID. 

° VMRS accesses from the FPEXC, FPSID, MVFRO, MVFRI1, or MVFR2. 


When FPEXC.EN is: 
1 Accesses to the registers shown in Table G1-28 are enabled at all Exception levels. 
0 All accesses to the registers shown in Table G1-28 are UNDEFINED. 


Table G1-28 shows the registers for which accesses are enabled, and for an exception taken to Hyp mode, how the 
exception is reported in HSR. 


Table G1-28 Register accesses enabled when FPEXC.EN is 1 





Syndrome reporting in 





Enabled at Register: 

abled a g s HSRa 

All Exception FPSCR, and any of the SIMD and floating-point registers Q0-Q15, Exception for an unknown 
levels including their views as D0-D31 registers or S0-S31 registers. reason, using EC value 0x00 





a. Only for exceptions that are taken to Hyp mode. 


G1-5582 


For more information, see Advanced SIMD and floating-point support on page G1-5570. 


Disabling PLO and PL1 execution of Advanced SIMD instructions 


If implemented as an RW field, CPACR.ASEDIS can disable PLO and PL1 execution of Advanced SIMD 
instructions, as follows: 


1 Advanced SIMD instructions are UNDEFINED at PLO and PL1. 
0 Advanced SIMD instruction execution is enabled at PLO and PL1. 


The instructions that CPACR.ASEDIS disables are those described in Controls of Advanced SIMD operation that 
do not apply to floating-point operation on page E1-3800. 


When the control is not implemented, meaning the CPACR.ASEDIS field is RAZ/WI, behavior is as if the control 
permits execution of Advanced SIMD instructions at PLO and PL1. 


If EL3 is implemented and is using AArch32, and NSACR.NSASEDIS is 1, CPACR.ASEDIS is RAO/WI in 
Non-secure state. This also applies when the CPACR.ASEDIS control is not implemented. 


Traps to Undefined mode of ELO accesses to the Debug Communications Channel 
(DCC) registers 


DBGDSCRext.UDCCdis traps ELO accesses to the DCC registers to Undefined mode: 
1 ELO accesses to the DCC registers are trapped to Undefined mode 
0 This control has no effect on ELO accesses to the DCC registers. 


Traps of ELO accesses to the DBGDTRRXint and DBGDTRTXint are ignored in Debug state. 


Table G1-29 shows the registers for which accesses are trapped. 


Table G1-29 Register accesses trapped to Undefined mode when DBGDSCRext.UDCCdis is 1 





Traps from Registers 





ELO DBGDSCRint, DBGDTRRXint, DBGDTRTXint, DBGDIDR, DBGDSAR, DBGDRAR 
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Note 


All accesses to these registers are trapped, including LDC and STC accesses to DBGDTRTXint and DBGDTRRXint, 
and MRRC accesses to DBGDSAR and DBGDRAR. 





When generated in Non-secure User mode, an exception generated by this control can be routed to EL2, as described 
in Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 


Traps to Undefined mode of ELO accesses to the Generic Timer registers 


CNTKCTL.{PLOPTEN, PLOVTEN, PLOPCTEN, PLOVCTEN} trap ELO accesses to the Generic Timer registers 
to Undefined mode, as follows: 


g CNTKCTL.PLOPTEN traps ELO accesses to the physical timer registers. 

7 CNTKCTL.PLOVTEN traps ELO accesses to the virtual timer registers. 

s CNTKCTL.PLOPCTEN traps ELO accesses to the frequency register and physical counter register. 
° CNTKCTL.PLOVCTEN traps ELO accesses to the frequency register and virtual counter register. 


For all of these controls: 
1 This control has no effect on ELO accesses to the corresponding registers. 
0 ELO accesses to the corresponding registers are trapped to Undefined mode. 


Accesses to the frequency register, CNTFRQ, are only trapped if CNTKCTL.PLOPCTEN and 
CNTKCTL.PLOVCTEN are both 0. 


Table G1-30 shows the registers for which accesses are trapped. 


Table G1-30 Register accesses trapped to Undefined mode by CNTKCTL trap controls 





Traps from Trap control Registers 





ELO PLOPTEN CNTP_CTL, CNTP_CVAL, CNTP_TVAL 





PLOVTEN CNTV_CTL, CNTV_CVAL, CNTV_TVAL 





PLOPCTEN CNTFRQ, CNTPCT 





PLOVCTEN CNTFRQ, CNTVCT 





When generated in Non-secure User mode, an exception generated by this control can be routed to EL2, as described 
in Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 


Traps to Undefined mode of ELO accesses to Performance Monitors registers 


PMUSERENR. {ER, CR, SW, EN} trap ELO accesses to the Performance Monitors registers to Undefined mode. 
For each of these controls: 


1 This control has no effect on ELO accesses to the corresponding registers. 
0 ELO accesses to the corresponding registers are trapped to Undefined mode. 


For those Performance Monitors registers that more than one PMUSERENR. {ER, CR, SW, EN} control applies to, 
accesses are only trapped if all controls that apply are set to 0. 


The accesses that these trap controls trap might be reads, writes, or both. 


Note 


° The architecture does not provide traps on Performance Monitors register accesses through the 
memory-mapped external debug interface. 





s If the Performance Monitors Extension is not implemented, the Performance Monitors registers, including 
PMUSERENR, are reserved. 
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Table G1-31 shows the registers for which ELO accesses are trapped. For each register, the table shows the type of 
access trapped. 


Table G1-31 Register accesses trapped to Undefined mode when disabled from ELO 


























Tra Access 
Traps from P Registers 
control type 
ELO ER PMXEVCNTR, PMEVCNTR<n> R 
PMSELR RW 
CR PMCCNTR, accessed using an MRC R 
CR PMCCNTR, accessed using an MRRC R 
SW PMSWINC W 
EN PMCNTENSET, PMCNTENCLR, PMCR, PMOVSR, PMSWINC, PMSELR, PMCEIDO, RWa 
PMCEID1, PMCEID2, PMCEID3, PMCCNTR, PMXEVTYPER, PMXEVCNTR, 
PMOVSSET, PMEVCNTR<n>, PMEVTYPER<n>, PMCCFILTR 





a. The ELO access is trapped only if the corresponding EL1 accesses is permitted. For example, the PMSWINC register is WO at EL1, and 
therefore, when the value of EN is 0: 


‘ Write accesses to the register from ELO are trapped. 


` Read accesses to the register from ELO are UNDEFINED, because read accesses to the register from EL] are UNDEFINED. 


G1-5584 


When generated in Non-secure User mode, an exception generated by this control can be routed to EL2, as described 
in Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 


Traps to Undefined mode of ELO accesses to Activity Monitors registers 


AMUSERENR.EN traps ELO accesses to the Activity Monitors System registers other than AMUSERENR to 
Undefined mode: 





1 This control has no effect on ELO accesses to the corresponding registers. 
0 ELO accesses to the corresponding registers are trapped to Undefined mode. 
Note 
° The architecture does not provide traps on Activity Monitors register accesses through the memory-mapped 


external interface. 


s If the Activity Monitors Extension is not implemented, the Activity Monitors registers, including 
AMUSERENR, are reserved. 





Table G1-32 shows the registers for which ELO accesses are trapped. 


Table G1-32 Register accesses trapped to Undefined mode when disabled from ELO 


Traps from Registers 





ELO AMCFGR, AMCGCR, AMCNTENCLRO, AMCNTENCLR1, AMCNTENSETO, 
AMCNTENSET1, AMCR, AMEVTYPERO<n>, AMEVTYPERI<n>, AMEVCNTRO<n> 
or AMEVCNTRI<n>. 





When generated in Non-secure User mode, an exception generated by this control can be routed to EL2, as described 
in Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 
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These controls are ignored in Secure state when using AArch32. 


Table G1-33 shows the System registers that contain these controls. 


Table G1-33 System registers that contain instruction enables and disables, and trap controls 





Note 





Register name Register description 

















FPEXC Floating-point Exception Control Register 
HCR Hypervisor Configuration Register 

HSTR Hypervisor System Trap Register 

HCPTR Hyp Architectural Feature Trap Register 
HDCR Hyp Debug Control Register 





FPEXC.EN is a control that is in a System register provided by PL1. However, some exceptions generated 
because the value of FPEXC.EN is 1 are taken to Hyp mode. 


For completeness, Table G1-34 includes the HCR.TGE routing control, that is described in Routing 
exceptions from Non-secure ELO to EL2 on page G1-5516. 





Table G1-34 summarizes the controls. 


Table G1-34 Instruction enables and disables, and trap controls, for exceptions taken to Hyp mode 



































ntrol 
Control conio Description 
typea 

HSCTLR.{SED, ITD} D Disabling or enabling EL2 use of AArch32 deprecated functionality on 

HSCTLR.CP15BEN E page G1-5588 

HCR. {TRVM, TVM} T Traps to Hyp mode of Non-secure EL1 accesses to virtual memory control 
registers on page G1-5588 

HCR.HCD D Disabling Non-secure state execution of HVC instructions on page G1-5589 

HCR.TGE R Routing exceptions from Non-secure ELO to EL2 on page G1-5516 

HCR.TTLB T Traps to Hyp mode of Non-secure EL1 execution of TLB maintenance 
instructions on page G1-5589 

HCR. {TSW, TPC, TPU} T Traps to Hyp mode of Non-secure EL1 execution of cache maintenance 
instructions on page G1-5590 

HCR.TAC T Traps to Hyp mode of Non-secure EL1 accesses to the Auxiliary Control 
Register on page G1-5590 

HCR.TIDCP T Traps to Hyp mode of Non-secure ELO and EL1 accesses to lockdown, DMA, 
and TCM operations on page G1-5591 

HCR.TSC T Traps to Hyp mode of Non-secure EL1 execution of SMC instructions on 
page G1-5592 

HCR. {TIDO, TID1, TID2, TID3} T Traps to Hyp mode of Non-secure ELO and EL] accesses to the ID registers on 
page G1-5592 
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Table G1-34 Instruction enables and disables, and trap controls, for exceptions taken to Hyp mode (continued) 





Control 






































Control Description 
type? P 

HCR. {TWI, TWE} T Traps to Hyp mode of Non-secure ELO and EL1 execution of WFE and WFI 
instructions on page G1-5595 

HCPTR.TAM T Traps to Hyp mode of Non-secure ELO and EL1 accesses to Activity Monitors 
registers on page G1-5595 

HCPTR.{TCP11, TCP10} T General trapping to Hyp mode of Non-secure accesses to the SIMD and 
floating-point registers on page G1-5596 

FPEXC.EN T Enabling access to the SIMD and floating-point registers on page G1-5596 

HCPTR.TASE T Traps to Hyp mode of Non-secure accesses to Advanced SIMD functionality on 
page G1-5597 

HCPTR.TCPAC T Traps to Hyp mode of Non-secure EL1 accesses to the CPACR on 
page G1-5597 

HCPTR.TTA T Traps to Hyp mode of Non-secure System register accesses to trace registers on 
page G1-5598 

HDCR.TTRF T Traps to Hyp mode of Non-secure System register accesses to trace filter 
control registers on page G1-5598 

HSTR. {T0-T3, T5-T13, T15} T General trapping to Hyp mode of Non-secure ELO and EL1 accesses to System 
registers in the (coproc ==0b1111) encoding space on page G1-5599 

HDCR.{TDRA, TDOSA, TDA} T Traps to Hyp mode of Non-secure System register accesses to debug registers 
on page G1-5600 

CNTHCTL.{PLIPCEN, PLIPCTEN} T Traps to Hyp mode of Non-secure ELO and EL] accesses to the Generic Timer 
registers on page G1-5602 

HDCR. {TPM, TPMCR} T Traps to Hyp mode of Non-secure ELO and EL1 accesses to Performance 
Monitors registers on page G1-5603 

HCR2.TERR T Traps to Hyp mode of Non-secure EL1 accesses to the RAS error record 


registers on page G1-5604 





a. See Table G1-35. 


Table G1-35 Control types, for exceptions taken to Hyp mode 

















Abbreviation Type See 
D Disable Instruction enables and instruction disables on page G1-5576 
E Enable Instruction enables and instruction disables on page G1-5576 
R Routing control Routing exceptions from Non-secure ELO to EL2 on page G1-5516 
T Trap Trap controls on page G1-5576 
Also see the following: 
° Register access instructions on page G1-5577. 


° Instructions that fail their Condition code check on page G1-5587. 
. Trapping to EL2 of instructions that are UNPREDICTABLE on page G1-5587. 


G1-5586 
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Instructions that fail their Condition code check 


For UNDEFINED instructions that fail their Condition code check, see Conditional execution of undefined instructions 
on page G1-5538. 


For an instruction that has a Hyp trap set, that fails its Condition code check: 


° Unless the trap description states otherwise, it is IMPLEMENTATION DEFINED whether the instruction: 
— Generates a Hyp Trap exception. 
— Executes as a NOP. 


Any implementation must be consistent in its handling of instructions that fail their Condition code check. This 
means that: 


s Whenever a Hyp trap is set on an instruction it must either: 
— Always generate a Hyp Trap exception. 
— Always treat the instruction as a NOP. 


: The IMPLEMENTATION DEFINED part of the requirements of Conditional execution of undefined instructions 
on page G1-5538 must be consistent with the handling of Hyp traps on instructions that fail their Condition 
code check. Table G1-36 shows this: 


Table G1-36 Consistent handling of instructions that fail their Condition code check 





Behavior of conditional UNDEFINED instruction@ Hyp trap on instruction that fails its Condition code check? 





Executes as a NOP Executes as a NOP 





Generates an Undefined Instruction exception Generates a Hyp Trap exception 





a. As defined in Conditional execution of undefined instructions on page G1-5538. In Non-secure ELO and EL1 modes, this applies only 
if no Hyp trap is set for the instruction, otherwise see the behavior in the other column of the table. 


b. Fora trapped instruction executed in a Non-secure EL] or ELO mode. 


ARM DDI 0487E.a 
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Note 
Hyp traps on WFE and WFI instructions generate Hyp Trap exceptions only if the instruction passes its Condition code 
check. See Traps to Hyp mode of Non-secure ELO and EL1 execution of WFE and WFI instructions on 
page G1-5595. 








Trapping to EL2 of instructions that are UNPREDICTABLE 


For an instruction that is UNPREDICTABLE or CONSTRAINED UNPREDICTABLE, when the instruction is disabled or 
trapped then it is CONSTRAINED UNPREDICTABLE whether execution of the instruction generates a Hyp Trap 
exception. 


Note 


UNPREDICTABLE and CONSTRAINED UNPREDICTABLE behavior must not perform any function that cannot be 
performed at the current or lower Exception level using instructions that are not UNPREDICTABLE and are not 
CONSTRAINED UNPREDICTABLE. This means that disabling or trapping an instruction changes the set of instructions 
that might be executed in Non-secure state at EL1 or ELO. This indirectly affects the permitted behavior of 
UNPREDICTABLE and CONSTRAINED UNPREDICTABLE instructions. 








If no instructions are trapped, the attempted execution of an UNPREDICTABLE instruction in a Non-secure EL1 or 
ELO mode must not generate a Hyp Trap exception. 
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Disabling or enabling EL2 use of AArch32 deprecated functionality 
Table G1-37 shows the deprecated AArch32 functionality that might have disable controls in the HSCTLR: 
è The SED control is always implemented. 


7 Whether each of the ITD, CP15BEN controls is implemented is IMPLEMENTATION DEFINED. If a control is 
not implemented, then the associated functionality cannot be disabled. 


These HSCTLR controls apply only to execution at EL2 using AArch32. When an instruction is disabled by one of 
these controls, it is UNDEFINED at EL2, meaning it is undefined in Hyp mode. 


Table G1-37 EL2 controls for disabling and enabling EL2 use of AArch32 deprecated functionality 





Instruction enable or 











Deprecated AArch32 functionality disable in the HSCTLR Disabled instructions 

SETEND instructions SED SETEND instructions 

Some uses of IT instructions ITD? See the HSCTLR.IT description 

Accesses to the System register (coproc==0b1111) CP15BEN¢ MCR accesses to the CP1ISDMB, CP15DSB, 
DMB, DSB, and ISB barrier operations and CP15ISB 


a. SETEND instruction disable. SETEND instructions are disabled when the value of this field is 1. 


b. IT instruction disable. If this control is implemented, some uses of IT instructions are disabled when the value of this field is 1. 


c. System register (coproc==0b1111) memory barrier enable. If this control is implemented, the specified register accesses are disabled when 
the value of CP15BEN is 0. 


G1-5588 


Note 


° These controls have no effect on instructions executed in any mode other than Hyp mode. The SCTLR 
provides similar controls that apply to execution in other modes. 





. The uses of the IT instruction, and use of the CP15DMB, CP15DSB, and CP15ISB barrier instructions, are 
deprecated for performance reasons. 





Traps to Hyp mode of Non-secure EL1 accesses to virtual memory control registers 
HCR. {TRVM, TVM} trap Non-secure EL1 accesses to the virtual memory control registers to Hyp mode: 


HCR.TRVM, for read accesses: 


1 Non-secure EL] reads of the virtual memory control registers are trapped to Hyp mode. 
0 This control has no effect on Non-secure EL1 reads of the virtual memory control 
registers. 


HCR.TVM, for write access: 


1 Non-secure EL1 writes to the virtual memory control registers are trapped to Hyp mode. 
0 This control has no effect on Non-secure EL1 writes to the virtual memory control 
registers. 


Table G1-38 on page G1-5589 shows the registers for which: 
$ Reads are trapped to Hyp mode when HCR.TRVM is 1. 
7 Writes are trapped to Hyp mode when HCR.TVM is 1. 
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The table also shows how the exceptions are reported in HSR. 


Table G1-38 Register read and write accesses trapped when HCR.{TRVM, TVM} are 1 





Traps from 


Registers Syndrome reporting in HSR 





Non-secure EL 1 


SCTLR, TTBRO, TTBR1, TTBCR, TTBCR2,DACR, Trapped MCR or MRC access (coproc==0b1111), using EC 
DFSR, IFSR, DFAR, IFAR, ADFSR, AIFSR,PRRR, value 0x03 





Traps from 





NMRR, MAIRO, MAIRI, AMAIRO, AMAIRI, Trapped MCRR or MRRC access (coproc==0b1111), using EC 
CONTEXTIDR value 0x04 
Note 


These registers are not accessible at ELO. 


Disabling Non-secure state execution of HVC instructions 
HCR.HCD disables Non-secure state execution of HVC instructions: 


1 HVC instructions are UNDEFINED at EL2 and Non-secure EL1. The Undefined Instruction exception 
is taken from the current Exception level to the current Exception level. 


0 HVC instruction execution is enabled at EL2 and Non-secure EL 1. 





Note 
HVC instructions are always UNDEFINED at ELO. 


HCR.HCD is only implemented if EL3 is not implemented. Otherwise, it is RESO. See the HCR register description. 


Table G1-39 shows how the exceptions are reported in HSR. 


Table G1-39 Instruction that causes exceptions when HCR.HCD is 1 











Attempted execution in Disabled Syndrome reporting in HSR 

instruction 
Hyp mode HVC Exception for an unknown reason, using EC value 0x00 
Mode other than Hyp mode HVC Not applicable 





Traps to Hyp mode of Non-secure EL1 execution of TLB maintenance instructions 
In the Armv8-A architecture, the System instruction encoding space includes TLB maintenance instructions. 


HCR.TTLB traps Non-secure EL1 execution of TLB maintenance instructions to Hyp mode: 
1 Any attempt to execute a TLBI instruction at Non-secure EL] is trapped to Hyp mode. 
0 This control has no effect on the Non-secure EL1 execution of TLBI instructions. 


Table G1-40 shows the instructions that are trapped, and how the exceptions are reported in HSR. 


Table G1-40 Instructions trapped to Hyp mode when HCR.TTLB is 1 





Non-secure EL1 


Trapped instructions Syndrome reporting in HSR 
TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, TLBIMVALIS, Trapped MCR or MRC access 
TLBIMVAALIS, ITLBIALL, ITLBIMVA, ITLBIASID, DTLBIALL, (coproc==0b1111), using EC value 
DTLBIMVA, DTLBIASID, TLBIALL, TLBIMVA, TLBIASID, 0x03 


TLBIMVAA, TLBIMVAL, TLBIMVAAL. 
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Note 
These instructions are always UNDEFINED at ELO. 








For more information about these instructions, see The scope of TLB maintenance instructions on page G5S-5802. 


Traps to Hyp mode of Non-secure EL1 execution of cache maintenance instructions 
HCR. {TSW, TPC, TPU} trap cache maintenance instructions to Hyp mode: 
0 The control has no effect on the execution of cache maintenance instructions. 


1 Any attempt to execute one of the cache maintenance instructions shown in Table G1-42 at 
Non-secure EL1 is trapped to Hyp mode. 


Table G1-41 Controls for trapping cache maintenance instructions to Hyp mode 





Trap control Trapped instructions 











HCR.TSW Data or unified cache maintenance by set/way 
HCR.TPC Data or unified cache maintenance to point of coherency 
HCR.TPU Cache maintenance to point of unification 





Table G1-42 shows the instructions that are trapped to Hyp mode, and how the exceptions are reported in HSR. 


Table G1-42 Instructions trapped to Hyp mode when HCR.{TSW, TPC, TPU} are 1 





Traps from 


Non-secure EL1 


Trap control Trapped instructions Syndrome reporting in HSR 


TSW DCISW, DCCSW, DCCISW Trapped MCR or MRC access 





(coproc==0b1111), using EC value 0x3 
TPC DCIMVAC, DCCIMVAC, DCCMVAC 





TPU ICIMVAU, ICIALLU, ICIALLUIS, DCCMVAU 








Note 
These instructions are always UNDEFINED at ELO. 





For more information about these instructions, see Cache maintenance system instructions on page K14-7861. 


Traps to Hyp mode of Non-secure EL1 accesses to the Auxiliary Control Register 


HCR.TAC traps Non-secure EL1 accesses to the Auxiliary Control Registers to Hyp mode: 
1 Non-secure EL1 accesses to the Auxiliary Control Registers are trapped to Hyp mode. 
0 This control has no effect on Non-secure EL1 accesses to the Auxiliary Control Registers. 


Table G1-43 shows the registers for which accesses are trapped, and how the exceptions are reported in HSR: 


Table G1-43 Register accesses trapped to Hyp mode when HCR.TAC is 1 





Traps from 


Registers Syndrome reporting in HSR 





Non-secure EL1 ACTLR and, if implemented, ACTLR2. Trapped MCR or MRC access (coproc==0b1111) access, using EC 


value 0x03 
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Note 
The ACTLR and ACTLR2 are not accessible at ELO. 








Traps to Hyp mode of Non-secure ELO and EL1 accesses to lockdown, DMA, and TCM 
operations 


The lockdown, DMA, and TCM features of the Armv8-A architecture are IMPLEMENTATION DEFINED. The 
architecture reserves the encodings of a number of System registers for control of these features. 


HCR.TIDCP traps the execution of System register access instructions that access these registers, as follows: 


1 At Non-secure EL1, any attempt to execute an MCR or MRC instruction with a reserved register 
encoding shown in Table G1-44 is trapped to Hyp mode. 


At Non-secure ELO, it is IMPLEMENTATION DEFINED whether attempts to execute MCR or MRC 
instructions with reserved register encodings are: 


° Trapped to Hyp mode. 


. UNDEFINED, and the PE takes the Undefined Instruction exception to Non-secure Undefined 
mode. 


Any lockdown fault in the memory system caused by the use of these operations in Non-secure state 
generates a Data Abort exception that is taken to Hyp mode. 


0 This control has no effect on Non-secure ELO and EL1 System register access instructions with 
reserved register encodings shown in Table G1-44. 


Note 


This means that a Hyp Trap exception taken from Non-secure EL1 to Hyp mode, generated because of a 
configuration setting in HCR.TIDCP is a higher priority exception than an Undefined Instruction exception 
generated because either the System register encoding is unallocated or because the register is never accessible at 
EL1. As Synchronous exception prioritization for exceptions taken to AArch32 state on page G1-5505 shows, this 
is an exception to the general exception prioritization rules, that prioritize most Undefined Instruction exceptions 
taken to Undefined mode above traps to EL2. 








Table G1-44 shows the register encodings for which accesses are trapped to Hyp mode, and how the exceptions are 
reported in HSR. 


Table G1-44 Encodings trapped to Hyp mode when HCR.TIDCP is 1 





Traps from Register encodings Syndrome reportingin HSR 
Non-secure ELO and An access to any of the following encodings: Trapped MCR or MRC access 
ELI . CRn==09, opc1=={0-7}, CRm=={c0-c2, c5-c8}, opc2=={0-7}. (coproc==0b1111), using EC 


*  CRn==cl0, opel=={0-7}, CRm=={c0, cl, c4, c8}, opc2=={0-7}, Value 0x03 
° CRn==c11, opcl=={0-7}, CRm=={c0-c8, c15}, opc2=={0-7}. 





ARM DDI 0487E.a 
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An implementation can also include IMPLEMENTATION DEFINED registers that provide additional controls, to give 
finer-grained control of the trapping of IMPLEMENTATION DEFINED features. 


Note 


Arm expects the trapping of Non-secure User mode accesses to these functions to Hyp mode to be unusual, and used 
only when the hypervisor is virtualizing User mode operation. Arm strongly recommends that unless the hypervisor 
must virtualize User mode operation, a Non-secure User mode access to any of these functions generates an 
Undefined Instruction exception, as it would if the implementation did not include EL2. The PE then takes this 
exception to Non-secure Undefined mode. 
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Traps to Hyp mode of Non-secure EL1 execution of SMC instructions 


HCR.TSC traps Non-secure EL1 execution of SMC instructions to Hyp mode: 


1 Any attempt to execute an SMC instruction at Non-secure EL] is trapped to Hyp mode, regardless of 
the value of SCR.SCD. 
0 This control has no effect on Non-secure EL1 execution of SMC instructions. 


Table G1-45 shows how the exceptions are reported in HSR: 


Table G1-45 SMC Instruction trapped to Hyp mode when HCR.TSC is 1 





Traps from Trapped instruction Syndrome reporting in HSR 





Non-secure ELI SMC on page F5-4520 Trapped SMC instruction execution in AArch32 state, using EC value 0x13 





The Armv8-A architecture permits, but does not require, this trap to apply to conditional SMC instructions that fail 
their Condition code check, in the same way as with traps on other conditional instructions. 





Note 
: This trap is implemented only if the implementation includes EL3. 
è SMC instructions are always UNDEFINED at ELO. 
s HCR.TSC traps execution of the SMC instruction. It is not a routing control for the SMC exception. Hyp Trap 


and SMC exceptions have different preferred return addresses. 





For more information about SMC instructions, see SMC on page F5-4520. 


Traps to Hyp mode of Non-secure ELO and EL1 accesses to the ID registers 


Other than the MIDR, MPIDR, and PMCR.N, the ID registers are divided into groups, with a trap control in the 
HCR for each group. 


Table G1-46 ID register groups 





Trap control Register group 














HCR.TIDO ID group 0, Primary device identification registers on page G1-5593 
HCR.TID1 ID group 1, Implementation identification registers on page G1-5594 
HCR.TID2 ID group 2, Cache identification registers on page G1-5594 

HCR.TID3 ID group 3, Detailed feature identification registers on page G1-5594 





These controls trap register accesses from Non-secure ELO or EL1 to Hyp mode, as follows: 


HCR.TIDO 0 This control has no effect on Non-secure EL1 reads of the ID group 0 registers. 
1 Any attempt at Non-secure ELO or EL] to read any register in ID group 0 is trapped to 
Hyp mode. 
HCR.TIDI 0 This control has no effect on Non-secure EL1 reads of the ID group 1 registers. 
1 Any attempt at Non-secure EL] to read any register in ID group 1 is trapped to Hyp 
mode. 
HCR.TID2 0 This control has no effect on Non-secure EL1 and ELO accesses to the ID group 2 
registers. 
1 Any attempt at Non-secure ELO or EL! to read any register in ID group 2, and any 


attempt at Non-secure ELO or EL1 to write to the CSSELR, is trapped to Hyp mode. 
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HCR.TID3 0 This control has no effect on Non-secure EL1 reads of the ID group 3 registers. 
1 Any attempt at Non-secure EL] to read any register in ID group 3 is trapped to Hyp 
mode. 


For the MIDR and MPIDR, and for PMCR.N, the architecture provides read/write aliases. The original register 
becomes accessible only from Hyp mode and Secure state, and a Non-secure ELO or ELI read of the original register 
returns the value of the read/write alias. This substitution is invisible to the ELO or EL1 software reading the register. 


Table G1-47 ID register substitution 














Register Original Alias, EL2 using AArch32 
Main ID MIDR VPIDR 

Multiprocessor Affinity MPIDR VMPIDR 

Performance Monitors Control Register PMCR.N HDCR.HPMN 





Reads of the MIDR, MPIDR, or PMCR.N from Hyp mode or Secure state are unchanged by the implementation of 
EL2, and access the physical registers. 





Note 
s If the optional Performance Monitors Extension is not implemented, HDCR.HPMN is RESO and PMCR is 
reserved. 
° HDCR.HPMN also affects whether a Performance Monitors counter can be accessed from Non-secure EL1 


or ELO. See the register description of HDCR for more information. 


e PMCR contains other fields that identify the implementation. For more information about trapping accesses 
to the PMCR, see Traps to Hyp mode of Non-secure ELO and EL1 accesses to Performance Monitors 
registers on page G1-5603. 





A reset into AArch32 state sets VPIDR to the MIDR value, VMPIDR to the MPIDR value, and HDCR.HPMN to 
the PMCR.N value. 


ID group 0, Primary device identification registers 
These registers identify some top-level implementation choices. 


Table G1-48 shows the registers that are in ID group 0 for traps to Hyp mode, and how the exceptions are reported 
in HSR. 


Table G1-48 ID group 0 registers 

















Traps from Group 0 registers Syndrome reporting in HSR 

Non-secure EL1 FPSID Trapped VMRS access, for ID group traps, using EC value 0x08 

Non-secure ELO and ELI JIDR Trapped MCR or MRC access (coproc==0b1110), using EC value 0x05 
Note 


ARM DDI 0487E.a 
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The FPSID is not accessible at ELO. 





If HCPTR.{TCP11, TCP10} traps accesses to SIMD and floating-point functionality, then for a read of FPSID, that 
trap has priority over this trap. 


When the FPSID is accessible, a VMSR FPSID, <Rt> instruction is permitted but is ignored. The execution of this VMSR 
instruction is not trapped by the ID group 0 trap. 
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ID group 1, Implementation identification registers 
These registers often provide coarse-grained identification mechanisms for implementation-specific features. 


Table G1-49 shows the registers that are in ID group 1 for traps to Hyp mode, and how the exceptions are reported 
in HSR. 


Table G1-49 ID group 1 registers 





Traps from Group 1 registers Syndrome reporting in HSR 





Non-secure EL1 TCMTR,TLBTR,REVIDR, AIDR Trapped MCR or MRC access (coproc==0b1111), using EC value 0x03 





ID group 2, Cache identification registers 
These registers describe and control the cache implementation. 


Table G1-50 shows the registers that are in ID group 2 for traps to Hyp mode, and how the exceptions are reported 
in HSR. 


Table G1-50 ID group 2 registers 





Traps from 


Group 2 registers Syndrome reporting in HSR 





Non-secure ELO and ELI = CTR,CCSIDR,CLIDR,CSSELR, Trapped MCR or MRC access (coproc==0b1111), using EC value 0x03 


and, if implemented, CCSIDR2. 





ID group 3, Detailed feature identification registers 


These registers provide detailed information about the features of the implementation. 


Note 


These registers are called the CPUID registers. There is no requirement for this trap to apply to those registers that 
the CPUID Identification Scheme defines as reserved. See The CPUID identification scheme on page G4-4993. 








Table G1-51 shows the registers that are in ID group 3 for traps to Hyp mode, and how the exceptions are reported 
in HSR. 


Table G1-51 ID group 3 registers 





Traps from 


Non-secure EL 1 


G1-5594 





Group 3 registers Syndrome reporting in HSR 
MVFRO, MVFRI, MVFR2. Trapped WRS access for ID group 

traps, using EC value 0x08 
ID_PFRO, ID_PFR1, ID DFRO, ID_AFRO. Trapped MCR or MRC access 
ID_MMFRO, ID_MMFR1, ID_ MMEFR2, ID_MMFR3, and ID MMFR4, (coproc==0b1111), using EC value 
except that if ID MMFR4 is implemented as RAZ/WI then it is 0x03 


IMPLEMENTATION DEFINED whether reads of the register are trapped. 
ID_ISARO, ID_ISAR1, ID_ISAR2, ID_ISAR3, ID_ISAR4, ID_ISARS. 
Any MRC access to any of the following encodings when coproc==0b1111: 

. opc1 == 0, CRn == c0, CRm {c3-c7}, opc2 == {0, 1}. 

s opc1 0, CRn c0, CRm == c3, opc2 2, 

. opc1 == 0, CRn == c0, CRm == c5, opc2 {4, 5}. 

It is IMPLEMENTATION DEFINED whether HCR.TID3 traps MRC accesses with 


coproc==0b1111 to encodings in the following range that are not already 
mentioned in this table: 


. CRn == c0, opc1 == 0, CRm == {c2-c7}, opc2 == {0-7}. 
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If HCPTR traps accesses to SIMD and floating-point functionality, then for reads of MVFRO, MVFR1, and 
MVER2, that trap has priority over this trap. 


Traps to Hyp mode of Non-secure ELO and EL1 execution of WFE and WFI instructions 


HCR. {TWE, TWI} trap Non-secure ELO and EL1 execution of WFE and WFI instructions to Hyp mode: 


HCR.TWE: 
1 Any attempt to execute a WFE instruction at Non-secure ELO or EL1 is trapped to Hyp 
mode, if the instruction would otherwise have caused the PE to enter a low-power state. 
0 This control has no effect on Non-secure ELO or EL1 execution of WFE instructions. 
HCR.TWI: 
1 Any attempt to execute a WFI instruction at Non-secure ELO or EL] is trapped to Hyp 


mode, if the instruction would otherwise have caused the PE to enter a low-power state. 


0 This control has no effect on Non-secure ELO or EL! execution of WFI instructions. 


Table G1-52 shows how the exceptions are reported in HSR. 


Table G1-52 Instructions trapped to Hyp mode when HCR.{TWE, TWI} are 1 











Traps from Trapped instructions Syndrome reporting in HSR 
Non-secure ELO and EL1 WFE Trapped WFI or WFE instruction, using EC value 0x01 
WFI 





The attempted execution of a conditional WFE or WFI instruction is only trapped if the instruction passes its Condition 
code check. 


Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed 
to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the 
instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken. 








For more information about these instructions, and when they can cause the PE to enter a low-power state, see: 
- Wait For Event and Send Event on page G1-5562. 
E Wait For Interrupt on page G1-5565. 


Traps to Hyp mode of Non-secure ELO and EL1 accesses to Activity Monitors registers 


If the Activity Monitors Extension is implemented, HCPTR.TAM traps Non-secure ELO and EL! accesses to the 
Activity Monitors registers to Hyp mode: 





1 Non-secure ELO and EL1 accesses to all Activity Monitors registers are trapped to Hyp 
mode. 
0 This control has no effect on Non-secure ELO and EL1 accesses to the Activity Monitors 
registers. 
Note 
° EL2 does not provide traps on Activity Monitor register accesses through the optional memory-mapped 


external interface. 


è If the Activity Monitors Extension is not implemented, HCPTR.TAM is RESO. 
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Table G1-53 shows the registers for which accesses are trapped, and how the exceptions are reported in HSR. 


Table G1-53 Register accesses trapped to Hyp mode when HDCR.{TPM, TPMCR} are 1 


























Traps from Trap control Registers Syndrome reporting in HSR 
Non-secure TPM AMCFGR, AMCGCR, AMCNTENCLRO, Trapped MCR or MRC access 
ELO and EL1 AMCNTENCLRI1, AMCNTENSETO, (coproc==0b1111), using EC value 
AMCNTENSET1, AMCR, AMEVTYPERO<n>, or 0x03. 
AMEVTYPERI<n>. 
AMEVCNTRO<n>or AMEVCNTRI<n>. Trapped MCRR or MRRC access 
(coproc==0b1111), using EC value 
0x04. 
General trapping to Hyp mode of Non-secure accesses to the SIMD and floating-point 
registers 
HCPTR.{TCP11, TCP10} trap Non-secure accesses to the SIMD and floating-point registers to Hyp mode: 
Ob11 All Non-secure accesses to the SIMD and floating-point registers are trapped to Hyp mode. Trapped 
instructions generate: 
à Hyp Trap exceptions, if the exception is taken from Non-secure ELO or EL1. 
° Undefined Instruction exceptions taken to Hyp mode, if the exception is taken from EL2. 
0b00 This control has no effect on Non-secure accesses to the SIMD and floating-point registers. 
Note 
Software must set HCPTR.TCP11 and HCPTR.TCP10 to the same value. 
Table G1-54 shows the registers for which accesses are trapped, and how the exceptions are reported in HSR. 
Table G1-54 Register accesses trapped to Hyp mode when HCPTR.{TCP11, TCP10} are both 0b11 
Traps from Registers Syndrome reporting in HSR 
Non-secure FPSID, MVFRO, MVFR1, MVFR2, FPSCR, FPEXC, and any of the SIMD Trapped access to SIMD and 
state and floating-point registers QO-Q15, including their views as DO-D31 floating-point register, resulting from 


registers or S0-S31 registers. See Advanced SIMD and floating-point System | HCPTR, using EC value 0x072 
registers on page G1-5572. 





a. VMSR accesses to the FPSID are ignored, but for the purposes of this trap the architecture defines a VMSR access to the FPSID from EL1 or 
higher as an access to a SIMD and floating-point register. 


G1-5596 


If EL3 is implemented and is using AArch32, and NSACR. {cp11, cp10} are both set to 0, then 
HCPTR.{TCP11, TCP10} behave as RAO/WI, regardless of their actual value. 


For more information about SIMD and floating-point support, see Advanced SIMD and floating-point support on 
page G1-5570. 


Enabling access to the SIMD and floating-point registers 


FPEXC.EN is an instruction enable that enables access to the SIMD and floating-point registers from all Exception 
levels, but does not control the following: 


. VMSR accesses to the FPEXC or FPSID. 
. VMRS accesses from the FPEXC, FPSID, MVFRO, MVFRI1, or MVFR2. 


FPEXC.EN is a PL1 control that also applies at EL2. See Enabling access to the SIMD and floating-point registers 
on page G1-5582. 
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Traps to Hyp mode of Non-secure accesses to Advanced SIMD functionality 


If implemented as an RW field, HCPTR.TASE can trap Non-secure execution of Advanced SIMD instructions to 
Hyp mode, as follows. This trap applies only when HCPTR.{TCP11, TCP10} are both 0: 


1 Any attempt to execute an Advanced SIMD instruction in Non-secure state is trapped to Hyp mode. 
Trapped instructions generate: 
à Hyp Trap exceptions, if the exception is taken from Non-secure ELO or EL1. 
° Undefined Instruction exceptions taken to Hyp mode, if the exception is taken from EL2. 

0 This control has no effect on Non-secure execution of Advanced SIMD instructions. 


When the control is not implemented, meaning the HCPTR.TASE field is RAZ/WI, the HCPTR does not provide a 
trap to Hyp mode of the Non-secure execution of Advanced SIMD instructions, other than the 

HCPTR.{TCP11, TCP10} trap that applies to Non-secure execution of both Advanced SIMD and floating-point 
instructions. 


Table G1-27 on page G1-5581 shows the instructions that are trapped, and how the exceptions are reported in HSR. 


Table G1-55 Instructions trapped to Hyp mode when HCPTR.TASE is set to 1 





Traps from 


Instructions Syndrome reporting in HSR 





Non-secure state 


All Advanced SIMD instructions that are not also floating-point Trapped access to SIMD and floating-point 
instructions. For more information, see Controls of Advanced register, resulting from HCPTR, using EC 
SIMD operation that do not apply to floating-point operationon value 0x07 

page E1-3800. 





If EL3 is implemented and is using AArch32, and NSACR.NSASEDIS is 1, then HCPTR.TASE behaves as 
RAO/WI, regardless of its actual value. This behavior also applies when the HCPTR.TASE control is not 
implemented. 


Traps to Hyp mode of Non-secure EL1 accesses to the CPACR 


HCPTR.TCPAC traps Non-secure EL1 accesses to the CPACR to Hyp mode: 
1 Non-secure EL1 accesses to the CPACR are trapped to Hyp mode. 
0 This control has no effect on Non-secure EL1 accesses to the CPACR. 


Table G1-56 shows how the exceptions are reported in HSR: 


Table G1-56 Register accesses trapped to Hyp mode when HCPTR.TCPAC is 1 





Traps from Register Syndrome reporting in HSR 





Non-secure ELI CPACR Trapped MCR or MRC access to System register with coproc==0b1111, using EC value 0x03 


ARM DDI 0487E.a 
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Note 
. The CPACR is not accessible at ELO. 





. In Armv7 and earlier versions of the Arm architecture, one use of the CPACR is to identify what coprocessor, 
or conceptual coprocessor, functionality is implemented. Legacy software might use this identification 
mechanism. A hypervisor can use this trap to emulate this mechanism. See Background to the System register 
interface on page G1-5568 for more information about this functionality. 
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Traps to Hyp mode of Non-secure System register accesses to trace registers 


Ifimplemented, the HCPTR.TTA control traps System register accesses to the trace registers from Non-secure state 
to Hyp mode, as follows: 


1 Non-secure System register accesses to the trace registers are trapped to Hyp mode. Trapped 
instructions generate: 
è Hyp Trap exceptions, if the exception is taken from Non-secure ELO or EL1. 
° Undefined Instruction exceptions taken to Hyp mode, if the exception is taken from EL2. 
0 This control has no effect on Non-secure System register accesses to the trace registers. 


If the HCPTR.TTA control is not implemented, then HCPTR.TTA is RAO/WI. See the register description for more 
information. 





Note 
e System register accesses to the trace registers use the System register (coproc==0b1110) encoding space. 
$ The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A architecture is 


implemented with an ETMv4 implementation, ELO accesses to the trace registers are UNDEFINED. A resulting 
Undefined Instruction exception is higher priority than an HCPTR.TTA Hyp Trap exception. 


° EL2 does not provide traps on trace register accesses through the optional memory-mapped external debug 
interface. 





System register accesses to the trace registers can have side-effects. When a System register access is trapped, no 
side-effects occur before the exception is taken, see Register access instructions on page G1-5577. 


Table G1-57 shows the registers for which accesses are trapped to Hyp mode when HCPTR.TTA is 1, and how the 
exceptions are reported in HSR. 


Table G1-57 Register accesses trapped to Hyp mode when HCPTR.TTA is 1 





Traps from 


Registers Syndrome reporting in HSR 





Non-secure 
state 


System register accesses For accesses using: 


to all implemented trace. MCR or MRC instructions, trapped MCR or MRC access (coproc==0b1110), using EC value 
registers 0x05. 


7 MCRR or MRRC instructions, trapped MCRR or MRRC access (coproc==0b1110), using EC 
value Qx@C. 





G1-5598 


If EL3 is implemented and is using AArch32, and NSACR.NSTRCDIS is 1, then HCPTR.TTA behaves as 
RAO/WI, regardless of its actual value. This behavior applies, also, when the HCPTR.TTA control is not 
implemented. 


Traps to Hyp mode of Non-secure System register accesses to trace filter control 
registers 


If implemented, the HDCR.TTRF control traps System register accesses to the trace filter control registers from 
Non-secure state to Hyp mode, as follows: 


1 Non-secure System register accesses at EL1 to the trace filter control registers are trapped to Hyp 
mode. Trapped instructions generate Hyp Trap exceptions. 


0 This control has no effect on Non-secure System register accesses to the trace registers. 
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Table G1-58 shows the registers for which accesses are trapped to Hyp mode when HDCR.TTRF is 1, and how the 
exceptions are reported in HSR. 


Table G1-58 Register accesses trapped to Hyp mode when HDCR.TTRF is 1 








Traps from Registers Syndrome reporting in HSR 
Non-secure TRFCR For accesses using MCR or MRC instructions, trapped MCR or MRC access (coproc==0b1111), 
state using EC value 0x03. 





General trapping to Hyp mode of Non-secure ELO and EL1 accesses to System registers 
in the (coproc==0b1111) encoding space 


HSTR.{TO0-T3, T5-T13, T15} trap Non-secure ELO and EL1 accesses, using MCR, MRC, MCRR, or MRRC instructions, to 
the System registers in the (coproc==0b1111) encoding space, by: 


$ The value of the CRn argument to the instruction, for MCR and MRC instructions. 
$ The value of the CRm argument to the instruction, for MCRR and MRRC instructions. 


This applies for the set of CRn, or CRm, values {c0-c3, c5-c13, c15}. 
When an HSTR.Tn trap control is: 


1 Non-secure EL1 accesses to the corresponding System registers in the (coproc==0b1111) encoding 
space are trapped to Hyp mode. 


ELO accesses to the corresponding System registers are trapped to Hyp mode if they would not be 
UNDEFINED if the bit was zero. 


0 This control has no effect on Non-secure ELO or EL1 accesses to System registers. 


Note 


This means that a Hyp Trap exception taken from EL1 to EL2, generated because of a configuration setting in 
HSTR.Tn, is a higher priority exception than an Undefined Instruction exception generated because either the 
System register encoding is unallocated or because a register is never accessible at Non-secure EL1. As 
Synchronous exception prioritization for exceptions taken to AArch32 state on page G1-5505 shows, this is an 
exception to the general exception prioritization rules, that prioritize most Undefined Instruction exceptions taken 
to Undefined mode above traps to EL2. This prioritization includes any access from Non-secure EL1 to a 

register that is only accessible in Secure state. So, for example, an access to the SCR from Non-secure EL1: 





è When the value of HSTR.T1 is 0, generates an Undefined Instruction exception. 
$ When the value of HSTR.T1 is 1, generates a Hyp Trap exception. 


Table G1-59 shows the accesses that are trapped, and how the exceptions are reported in HSR. 


Table G1-59 Accesses trapped to Hyp mode when an HSTR.Tn trap is enabled 








Traps from Trap control Trapped accesses Syndrome reporting in HSR 
Non-secure ELOand Tn MCR and MRC instructions, with coproc set to Trapped MCR or MRC access (coproc==0b1111), 
EL12 Qb1111 and CRn set to n using EC value 0x03 





MCRR and MRRC instructions, with coproc set Trapped MCRR or MRRC access 
to 0b1111 and CRm set ton (coproc==0b1111), using EC value 0x04 





a. As described in this section, traps from EL1 apply whenever the value of HSTR.Tn is 1. Traps from ELO apply only if the value of 
HSTR.Tn is 1 and the access would not be UNDEFINED if the value of HSTR.Tn was 0. 


ARM DDI 0487E.a 
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For example, when HSTR.T7 is 1, considering only accesses from Non-secure EL1: 


s Any 32-bit access from a Non-secure PL1 mode using an MRC or MCR instruction with coproc set to 0b1111 and 
CRn set to c7, is trapped to Hyp mode. 
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è Any 64-bit access from a Non-secure PL1 mode using an MRRC or MCRR instructions with coproc set to 0b1111 
and CRm set to c7, is trapped to Hyp mode. 


Note 
G Bits[4,14] of the HSTR are reserved, RESO. Although the Generic Timer control registers are implemented in 
the coproc == 0b1111 encoding space with CRn==c14 for an MRC or MCR access, EL2 does not provide a trap 
on accesses to the Generic Timer System registers. 





` An implementation might provide additional controls, in IMPLEMENTATION DEFINED registers, to provide 
finer-grained control of trapping of IMPLEMENTATION DEFINED features. 





System registers in the (coproc==0b1111) encoding space with IMPLEMENTATION DEFINED access 
permission from ELO 


For a System register in the (coproc==0b1111) encoding space, that is accessed using a CRn or CRm value that can 
be trapped by a HSTR.Tn control, if an access to the register from User mode is UNDEFINED when the value of the 
corresponding HSTR.Tn trap control is 0, then when that HSTR.Tn trap control is 1, it is IMPLEMENTATION DEFINED 
whether an access from Non-secure User mode generates: 


° A Hyp Trap exception. 
° An Undefined Instruction exception taken to Non-secure Undefined mode. 


Note 


Arm expects that trapping to Hyp mode of Non-secure User mode accesses to System register in the 
(coproc==0b1111) encoding space will be unusual, and used only when the hypervisor must virtualize User mode 
operation. Arm recommends that, whenever possible, Non-secure User mode accesses to System register in the 
(coproc==0b1111) encoding space behave as they would if the processor did not implement EL2, generating an 
Undefined Instruction exception taken to Non-secure Undefined mode if the architecture does not support the User 
mode access. 








Traps to Hyp mode of Non-secure System register accesses to debug registers 


HDCR.{TDRA, TDOSA, TDA} trap Non-secure System register accesses to debug registers to Hyp mode, as 
follows: 


. HDCR.(TDRA, TDA} trap Non-secure ELO and EL1 accesses. 
. HDCR.TDOSA traps Non-secure EL1 accesses. 





Note 


EL2 does not provide traps of debug register accesses through the optional memory-mapped external debug 
interface. 


System register accesses to the debug registers can have side-effects. When a System register access is trapped to 
Hyp mode, no side-effects occur before the exception is taken to Hyp mode. See Register access instructions on 
page G1-5577. 


Table G1-60 shows the subsections that list the accesses trapped. The subsections describe how the traps are 











reported in HSR. 
Table G1-60 Traps of Non-secure ELO and EL1 accesses to debug registers 
Trap control Subsection 
HDCR.TDRA Trapping Non-secure System register accesses to Debug ROM registers on page G1-5601 
HDCR.TDOSA Trapping Non-secure System register accesses to powerdown debug registers on page G1-5601 
HDCR.TDA Trapping general Non-secure System register accesses to debug registers on page G1-5601 
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Note 


System register accesses to debug registers use the (coproc==0b1110) encoding space. 








Trapping Non-secure System register accesses to Debug ROM registers 


HDCR.TDRA traps Non-secure ELO and EL1 System register accesses to the Debug ROM registers to Hyp mode: 


1 Non-secure ELO or EL1 System register accesses to the Debug ROM registers are trapped to Hyp 
mode. 

0 This control has no effect on Non-secure ELO and EL1 System register accesses to the Debug ROM 
registers. 


Table G1-61 shows the register accesses that are trapped, and how the exceptions are reported in HSR: 


Table G1-61 Register accesses trapped to Hyp mode when HDCR.TDRA is 1 





Traps from 


Registers Syndrome reporting in HSR 





Non-secure ELO 
and EL1 


DBGDRAR, DBGDSAR For accesses using: 


e MCR or MRC instructions, trapped MCR or MRC access (coproc==0b1110), using EC 
value 0x05. 


e MRRC instructions, trapped MRRC access (coproc==0b1110), using EC value 0x0C. 





If HDCR.TDE or HCR.TGE is 1, behavior is as if HDCR.TDRA is 1 other than for the purpose of a direct read. 


Trapping Non-secure System register accesses to powerdown debug registers 


HDCR.TDOSA traps Non-secure EL1 System register accesses to the powerdown debug registers to Hyp mode: 


1 Non-secure EL1 System register accesses to the powerdown debug registers are trapped to Hyp 
mode. 


0 This control has no effect on Non-secure EL1 System register accesses to the powerdown debug 
registers. 


Table G1-62 shows the register accesses that are trapped, and how the exceptions are reported in HSR. 


Table G1-62 Register accesses trapped to Hyp mode when HDCR.TDOSA is 1 





Traps from 


Non-secure 
ELI 


Registers Syndrome reporting in HSR 


DBGOSLSR, DBGOSLAR, DBGOSDLR, DBGPRCR Trapped MCR or MRC access 
Any IMPLEMENTATION DEFINED integration registers. (coproc==0b1110), using EC value 0x05 


Any IMPLEMENTATION DEFINED register with similar functionality that 
the implementation specifies as trapped by HDCR.TDOSA. 
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Note 


These registers are not accessible at ELO. 





If HDCR.TDE or HCR.TGE is 1, behavior is as if HDCR.TDOSA is 1 other than for the purpose of a direct read. 


Trapping general Non-secure System register accesses to debug registers 


HDCR.TDA traps Non-secure ELO and EL1 System register accesses to the debug registers that are not mentioned 
in either of the following: 


7 Traps to Hyp mode of Non-secure System register accesses to debug registers on page G1-5600. 
$ Trapping Non-secure System register accesses to powerdown debug registers. 
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This means that HDCR.TDA traps to Hyp mode Non-secure ELO and EL1 System register accesses to all debug 
registers except the following: 


7 Non-secure System register accesses to DBGDRAR or DBGDSAR. The HDCR.TDRA trap traps these 
accesses. 


e Non-secure System register access to DBGOSLSR, DBGOSLAR, DBGOSDLR, or DBGPRCR. The 
HDCR.TDOSA trap traps these accesses. 


HDCR.TDA does not trap accesses to DBGDTRTXint or DBGDTRRXint when the PE is in Debug state. 


When HDCR.TDA is: 

1 Non-secure ELO or EL1 System register accesses to any of the registers shown in Table G1-63 are 
trapped to Hyp mode. 

0 This control has no effect on Non-secure ELO or EL1 System register accesses. 


Table G1-63 shows how the exceptions are reported in HSR. 


Table G1-63 Accesses trapped to Hyp mode when HDCR.TDA is 1 





Traps from Trapped accesses Syndrome reporting in HSR 





Non-secure Accesses to the DBGDIDR, DBGDSCRint, DBGDCCINT, For accesses using MCR or MRC instructions, trapped MCR 
ELO and EL1 DBGDTRRXint, DBGDTRTXint, DBGWFAR, or MRC access (coproc==0b1110), using EC value 0x05 

DBGVCR, DBGDSCRext, DBGDTRTXext, 

DBGDTRRXext, DBGBVR<n>, DBGBCR<n>, 

DBGBXVR<n>, DBGWCR<n>, DBGWVR<n>, 

DBGCLAIMSET, DBGCLAIMCLR, 

DBGAUTHSTATUS, DBGDEVID, DBGDEVID1, 

DBGDEVID2, and DBGOSECCR 





STC accesses to DBGDTRR Xint. Trapped LDC or STC access, using EC value 0x06 
LDC accesses to DBGDTRTXint. 





If HDCR.TDE or HCR.TGE is 1, behavior is as if HDCR.TDA is 1 other than for the purpose of a direct read. 


Traps to Hyp mode of Non-secure ELO and EL1 accesses to the Generic Timer registers 


CNTHCTL. {PL1PCEN, PL1PCTEN} trap Non-secure ELO and EL1 accesses to the Generic Timer registers to Hyp 
mode, as follows: 


° CNTHCTL.PL1PCEN traps Non-secure ELO and EL1 accesses to the physical timer registers. 
- CNTHCTL.PL1PCTEN traps Non-secure ELO and EL1 accesses to the physical counter register. 


For each of these controls: 


1 This control has no effect on Non-secure ELO and EL1 accesses to the registers shown in 
Table G1-64 on page G1-5603. 
0 Non-secure ELO and EL1 accesses are trapped to Hyp mode. 
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Table G1-64 shows the registers for which accesses are trapped, and how the exceptions are reported in HSR. 


Table G1-64 Register accesses trapped to Hyp mode by CNTHCTL trap controls 





Traps from Trap control 


Registers 


Syndrome reporting in HSR 





Non-secure PLIPCEN 


CNTP_CTL,CNTP_CVAL, For accesses using: 





ELO and CNTP_TVAL s MCR or MRC instructions, trapped MCR or MRC access 
ELI (coproc==0b1111), using EC value 0x03 
. MCRR or MRRC instructions, trapped MCRR or MRRC access 
(coproc==0b1111), using EC value 0x04 
PLIPCTEN CNTPCT Trapped MCRR or MRRC access (coproc==0b1110), using EC value 0x04 
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Traps to Hyp mode of Non-secure ELO and EL1 accesses to Performance Monitors 


registers 


If the Performance Monitors Extension is implemented, HDCR.{TPM, TPMCR} trap Non-secure ELO and EL1 
accesses to the Performance Monitors registers to Hyp mode: 














HDCR.TPM: 
1 Non-secure ELO and EL] accesses to all Performance Monitors registers are trapped to 
Hyp mode. 
0 This control has no effect on Non-secure ELO and EL1 accesses to the Performance 
Monitors registers. 
HDCR.TPMCR: 
1 Non-secure ELO and EL1 accesses to the Performance Monitors Control Register are 
trapped to Hyp mode. 
Note 
The conditions for this trap are identical to those for the trap controlled by HDCR.TPM 
0 This control has no effect on Non-secure ELO and EL1 accesses to the Performance 
Monitors Control Registers. 
Note 
° EL2 does not provide traps on Performance Monitor register accesses through the optional memory-mapped 


external debug interface. 


s If the Performance Monitors Extension is not implemented, HDCR.{TPM, TPMCR} are RESO. 
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Table G1-65 shows the registers for which accesses are trapped, and how the exceptions are reported in HSR. 


Table G1-65 Register accesses trapped to Hyp mode when HDCR.{TPM, TPMCR} are 1 









































Traps from Trap control Registers Syndrome reporting in HSR 
Non-secure TPM PMCR, PMCNTENSET, PMCNTENCLR, PMOVSR, For accesses using: 
ELO and EL1 PMSWINC, PMSELR, PMCEIDO, PMCEID1, . MCR or MRC instructions, trapped 
PMCCNTR, PMXEVTYPER, PMXEVCNTR, MCR or MRC access 
PMUSERENR, PMINTENSET, PMINTENCLR, (coproc==0b1111), using EC 
PMOVSSET, PMEVCNTR<n>, PMEVTYPER<n>, value 0x03. 
PMCCFILTR . MCRR or MRRC instructions, 
trapped MCRR or MRRC access 
(coproc==0b1111), using EC 
value 0x04. 

TPMCR PMCR Trapped MCR or MRC access 
(coproc==0b1111), using EC value 
0x03 

Note 
HDCR.HPMN affects whether a counter can be accessed from Non-secure EL1 or ELO. See the register description 
of HDCR for more information. 
Traps to Hyp mode of Non-secure EL1 accesses to the RAS error record registers 
HCR2.TERR traps Non-secure EL1 accesses to the RAS ER* registers to Hyp mode. For more information on the 
RAS ER* registers, see the ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMV68, for the 
ARMVv8-A architecture profile. 
Table G1-66 Register accesses trapped to Hyp mode when HCR2.TERR is 1 
Traps from Trap control Registers Syndrome reporting in HSR 
Non-secure TERR ERRIDR, ERRSELR, ERXADDR, ERXADDR2, For accesses using: 
ELO and EL1 ERXCTLR, ERXCTLR2, ERXFR, ERXFR2, . MCR or MRC instructions, trapped 
ERXMISC0, ERXMISC1, ERXMISC2, ERXMISC3, MCR or MRC access 
ERXMISC4, ERXMISC5, ERXMISC6, ERXMISC7, (coproc==0b1111), using EC 
ERXSTATUS. value 0x03. 
. MCRR or MRRC instructions, 
trapped MCRR or MRRC access 
(coproc==0b1111), using EC 
value 0x04. 
G1.21.4 EL3 configurable controls 
Table G1-67 shows the System registers that contain these controls. 
Table G1-67 System registers that contain instruction enables and disables, and trap controls 
Register name Register description 
SCR Secure Configuration Register 
NSACR Non-secure Access Control Register 
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Table G1-68 summarizes the controls. 


Table G1-68 EL3 Instruction enables and disables, and trap controls 





Control 


Type of controla Trap 





SCR. {TWE, TWI} 


T Traps to Monitor mode of the execution of WFE and WFI instructions in modes other 
than Monitor mode on page G1-5606 























SCR.HCE E Enabling EL2 and Non-secure EL1 execution of HVC instructions on page G1-5607 
SCR.SCD D Disabling SMC instructions on page G1-5607 
NSACR.NSTRCDIS D Disabling Non-secure System register access to the trace registers on page G1-5608 
SDCR.TTRF T Traps to Monitor mode of System register accesses to the trace filter control registers 
on page G1-5608 
NSACR.{cp11,cp10} E Enabling Non-secure access to SIMD and floating-point functionality on 
page G1-5608 
NSACR.NSASEDIS D Disabling Non-secure access to Advanced SIMD functionality on page G1-5609 
SCR.TERR T Traps to Monitor mode of accesses to RAS error record registers on page G1-5607 





a. See Table G1-69. 
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Table G1-69 Control types, for AArch32 EL3 controls 





Abbreviation Type See 











D Disable Jnstruction enables and instruction disables on page G1-5576 
E Enable Instruction enables and instruction disables on page G1-5576 
T Trap Trap controls on page G1-5576 





Also see the following: 

s Register access instructions on page G1-5577. 

$ Instructions that fail their Condition code check. 

° Trapping to EL3 of instructions that are UNPREDICTABLE on page G1-5606. 


Instructions that fail their Condition code check 


For UNDEFINED instructions that fail their Condition code check, see Conditional execution of undefined instructions 
on page G1-5538. 


For an instruction that has a Monitor trap set, that fails its Condition code check: 


° Unless the trap description states otherwise, it is IMPLEMENTATION DEFINED whether the instruction: 
— Generates a Monitor Trap exception. 
— Executes as a NOP. 


Any implementation must be consistent in its handling of instructions that fail their Condition code check. This 
means that: 


$ Whenever a Monitor trap is set on such an instruction it must either: 
— Always generate a Monitor trap exception. 
— Always treat the instruction as a NOP. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G1-5605 
Non-Confidential 


The AArch32 System Level Programmers’ Model 
G1.21 Configurable instruction enables and disables, and trap controls 


è The IMPLEMENTATION DEFINED part of the requirements of Conditional execution of undefined instructions 
on page G1-5538 must be consistent with the handling of Monitor traps on instructions that fail their 
Condition code check. Table G1-70 shows this: 


Table G1-70 Consistent handling of instructions that fail their Condition code check 





Behavior of conditional UNDEFINED instructiona Monitor trap on instruction that fails its Condition code check» 





Executes as a NOP 


Executes as a NOP 





Generates an Undefined Instruction exception Generates a Monitor trap exception 





a. As defined in Conditional execution of undefined instructions on page G1-5538. In Non-secure ELO and EL1 modes, this applies only if no 
Monitor trap is set for the instruction, otherwise see the behavior in the other column of the table. 


b. Fora trapped instruction executed in a Non-secure EL1 or ELO mode. 


G1-5606 


Note 


When SCR{TWE, TWI} is set so that conditional WFE and WFI instructions are trapped to Monitor mode, the 
attempted execution ofa conditional WFE or WFI instruction is only trapped if the instruction passes its Condition code 
check. See Traps to Monitor mode of the execution of WFE and WFT instructions in modes other than Monitor mode. 








Trapping to EL3 of instructions that are UNPREDICTABLE 


For an instruction that is UNPREDICTABLE, when the instruction is disabled or trapped then it is CONSTRAINED 
UNPREDICTABLE whether execution of the instruction generates a Monitor Trap exception. 


Note 


UNPREDICTABLE and constrained unpredictable behavior must not perform any function that cannot be performed 
at the current or lower Exception level using instructions that are not UNPREDICTABLE and are not constrained 
unpredictable. This means that disabling or trapping an instruction changes the set of instructions that might be 
executed in modes other than Monitor mode. This affects, indirectly, the permitted behavior of UNPREDICTABLE and 
constrained unpredictable instructions. 








If no instructions are trapped, the attempted execution of an UNPREDICTABLE instruction in a mode other than 
Monitor mode must not generate a Monitor Trap exception. 


Traps to Monitor mode of the execution of WFE and WFI instructions in modes other than 
Monitor mode 


SCR{TWE, TWI} trap WFE and WFI instructions to Monitor mode: 


SCR.TWE 1 Any attempt to execute a WFE instruction in any mode other than Monitor mode is 
trapped to Monitor mode, if the instruction would otherwise have caused the PE to enter 
a low-power state. 


0 This control has no effect on the execution of WFE instructions. 
SCR.TWI 1 Any attempt to execute a WFI instruction in any mode other than Monitor mode is 


trapped to Monitor mode, if the instruction would otherwise have caused the PE to enter 
a low-power state. 


0 This control has no effect on the execution of WFI instructions. 
For PLO and PL1, these traps apply to WFE and WFI instruction execution in both Security states. 


The attempted execution ofa conditional WFE or WFI instruction is only trapped if the instruction passes its Condition 
code check. 
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Note 
Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of WFI are not guaranteed 
to be taken, even if the WFE or WFI is executed when there is no Wakeup event. The only guarantee is that if the 
instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken. 








For more information about these instructions, and when they can cause the PE to enter a low-power state, see: 
a Wait For Event and Send Event on page G1-5562. 
° Wait For Interrupt on page G1-5565. 


Traps to Monitor mode of accesses to RAS error record registers 


SCR.TERR traps accesses to the RAS ER* registers from modes other than Monitor mode to Monitor mode. 


Table G1-71 Register accesses trapped to EL3 when SCR.TERR is 1 








Traps from Registers Syndrome reporting in ESR_EL3 
AArch32 state ERRIDR, ERRSELR, ERXADDR, ERXADDR2, For accesses using: 
ERXCTLR, ERXCTLR2, ERXFR, ERXFR2, ERXMISCO, . MCR or MRC instructions, trapped MCR or MRC 
ERXMISC1, ERXMISC2, ERXMISC3, ERXMISC4, access (coproc==0b1111), using EC value 
ERXMISC5, ERXMISC6, ERXMISC7, ERXSTATUS. 0x03 


ARM DDI 0487E.a 
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a MCRR or MRRC instructions, trapped MCRR or 
MRRC access, (coproc==0b1111) using 
EC value 0x04 


This trap control applies to accesses from both Security states. 


Enabling EL2 and Non-secure EL1 execution of HVC instructions 


SCR.HCE enables EL2 and Non-secure EL1 execution of HVC instructions: 


1 HVC instruction execution is enabled at EL2 and Non-secure EL1. 
0 HVC instructions are: 
. UNDEFINED at Non-secure EL1. The Undefined Instruction exception is taken to Undefined 
mode. 
$ CONSTRAINED UNPREDICTABLE at EL2. The behavior must be one of the following: 


— The instruction is UNDEFINED. 
— The instruction executes as a NOP. 





Note 
s If EL2 is not implemented, SCR.HCE is RESO and HVC is UNDEFINED. 
: HVC instructions are always UNDEFINED at ELO and in Secure state. 


Disabling SMC instructions 
SCR.SCD disables SMC instructions: 


1 In Non-secure state 
SMC instructions are UNDEFINED. The Undefined Instruction exception is taken from the 
current Exception level to the current Exception level. 
In Secure state 
Behavior is one of the following: 
a The instruction is UNDEFINED. 
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° The instruction executes as a NOP. 
0 SMC instructions are enabled. 
Note 
7 SMC instructions are always UNDEFINED at ELO. 
à When the value of HCR.TSC is 1, any attempted execution of an SMC instruction at Non-secure EL1 is trapped 


to EL2, regardless of the value of SCR.SCD, see Traps to Hyp mode of Non-secure EL] execution of SMC 
instructions on page G1-5592. As Synchronous exception prioritization for exceptions taken to AArch32 state 
on page G1-5505 shows, this is an exception to the general exception prioritization rules, that prioritize most 
Undefined Instruction exceptions taken to Undefined mode above traps to a higher Exception level. 





Disabling Non-secure System register access to the trace registers 
NSACR.NSTRCDIS disables Non-secure System register accesses to the trace registers, from all Privilege levels: 


1 Non-secure state accesses are disabled. Secure state accesses are enabled. If the PE is in Non-secure 
state: 


ë CPACR.TRCDIS behaves as RAO/WI, regardless of its actual value. See Traps to Undefined 
mode of PLO and PL1 System register accesses to trace registers on page G1-5580. 
This behavior applies even if the CPACR.TRCDIS control is not implemented. See the 
referenced section for more information. 


G HCPTR.TTA behaves as RAO/WI, regardless of its actual value. See Traps to Hyp mode of 
Non-secure System register accesses to trace registers on page G1-5598. 


0 There is no effect on accesses to CPACR.TRCDIS and HCPTR.TTA. 





Note 


° System register accesses to the trace registers use the (coproc==0b1111) encoding space. 


s NSACR.NSTRCDIS might be implemented as RAZ/WI. See the NSACR register description for more 
information. 


$ The ETMv4 architecture does not permit ELO to access the trace registers. If the Armv8-A architecture is 
implemented with an ETMv4 implementation, ELO accesses to the trace registers are UNDEFINED. 


° EL3 does not provide Non-secure access controls on trace register accesses through the optional 
memory-mapped external debug interface. 





Traps to Monitor mode of System register accesses to the trace filter control registers 
SDCR.TTRF traps any System register accesses to trace filter control registers to Monitor mode: 


1 Any attempt to access a trace filter control register in any mode other than Monitor mode is trapped 
to Monitor mode. 


0 This control has no effect. 


Enabling Non-secure access to SIMD and floating-point functionality 
NSACR. {cp11, cp10} enable Non-secure access to the SIMD and floating-point registers, from all Privilege levels: 


0b11 All accesses, from both Security states, are enabled. 
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0b00 Non-secure state accesses are disabled. Secure state accesses are enabled. If the PE is in Non-secure 
state: 


° CPACR. {cp11, cp10} behave as RAZ/WI. See Enabling PLO and PL1 accesses to the SIMD 
and floating-point registers on page G1-5581. 


s HCPTR. {TCP11, TCP10} behave as RAO/WI. See General trapping to Hyp mode of 
Non-secure accesses to the SIMD and floating-point registers on page G1-5596. 





Note 
Software must set NSACR.cp11 and NSACR.cp10 to the same value. 





For more information about SIMD and floating-point support, see Advanced SIMD and floating-point support on 
page G1-5570. 


Disabling Non-secure access to Advanced SIMD functionality 
NSACR.NSASEDIS disables Non-secure accesses to the Advanced SIMD functionality, from all Privilege levels: 


1 Non-secure state accesses are disabled. Secure accesses are enabled. If the PE is in Non-secure state: 


s CPACR.ASEDIS behaves as RAO/WI. See Disabling PLO and PL1 execution of Advanced 
SIMD instructions on page G1-5582. 


: HCPTR.TASE behaves as RAO/WI. See Traps to Hyp mode of Non-secure accesses to 
Advanced SIMD functionality on page G1-5597. 


These behaviors apply even if one or both of the CPACR.ASEDIS and HCPTR.TASE controls is 
not implemented. See the referenced sections for more information. 


0 There is no effect on CPACR.ASEDIS and HCPTR.TASE. 


G1.21.5 Pseudocode description of configurable instruction enables, disables, and traps 
The pseudocode function AArch32.CheckITEnabled() checks whether the T32 IT instruction is enabled. 
The pseudocode function AArch32.CheckSETENDEnabled() checks whether the SETEND instruction is disabled. 
The pseudocode function for AArch32.CheckForSMCUndefOrTrap() checks for traps on an SMC instruction. 


The AArch32.CheckForWFxTrap() pseudocode function checks for traps on WFE and WFI instructions: 


Pseudocode description of enabling SIMD and floating-point functionality 


The AArch32.CheckAdvSIMDOrFPEnabled() and AArch32.CheckFPAdvSIMDTrap() pseudocode functions take appropriate 
action if an SIMD or floating-point instruction is used when the SIMD and floating-point functionality is not 
enabled or is trapped. 


The CheckAdvSIMDOrVFPEnabled(), CheckAdvSIMDEnabled(), and CheckVFPEnabled() wrapper functions support the 
AArch32.CheckAdvSIMDOrFPEnabled() and AArch32.CheckFPAdvSIMDTrap() functions. 


The AArch32.CheckAdvSIMDOrFPEnabled(), AArch32.CheckFPAdvSIMDTrap(), CheckAdvSIMDOrVFPEnab1ed(), 
CheckAdvSIMDEnabled(), and CheckVFPEnabled() functions are described in Chapter J1 Armv8 Pseudocode. 
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Chapter G2 
AArch32 Self-hosted Debug 


When the PE is using self-hosted debug, it generates debug exceptions. This chapter describes the AArch32 
self-hosted debug exception model. It is organized as follows: 
Introductory information 

. About self-hosted debug on page G2-5612. 

. The debug exception enable controls on page G2-5616. 


The debug Exception model 
. Routing debug exceptions on page G2-5617. 


. Enabling debug exceptions from the current Privilege level and Security state on 
page G2-5619. 


. The effect of powerdown on debug exceptions on page G2-5621. 
. Summary of permitted routing and enabling of debug exceptions on page G2-5622. 
° Pseudocode description of debug exceptions on page G2-5624. 


The debug exceptions 
° Breakpoint Instruction exceptions on page G2-5625. 
e Breakpoint exceptions on page G2-5628. 
° Watchpoint exceptions on page G2-5653. 
e Vector Catch exceptions on page G2-5667. 


Synchronization requirements 


The behavior of self-hosted debug after changes to System registers, or after changes to the 
authentication interface, but before a Context synchronization event guarantees the effects of the 
changes: 


g Synchronization and debug exceptions on page G2-5674. 
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G2.1.2 
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About self-hosted debug 


Self-hosted debug supports debugging through the generation and handling of debug exceptions, that are taken using 
the exception model described in: 


$ Chapter D1 The AArch64 System Level Programmers’ Model, if the exception is taken to AArch64 state. 
$ Chapter G1 The AArch32 System Level Programmers’ Model, if the exception is taken to AArch32 state. 


This section introduces some terms used in describing self-hosted debug, and then introduces the debug exceptions. 
See: 


. Definition of a debugger in the context of self-hosted debug. 
$ Context ID and Process ID. 


Definition of a debugger in the context of self-hosted debug 


Within this chapter, debugger means that part of an operating system, or higher level of system software, that 
handles debug exceptions and programs the debug System registers. An operating system with rich application 
environments might provide debug services that support a debugger user interface executing at ELO. From the 
architectural perspective, the debug services are the debugger. 


Context ID and Process ID 


In AArch32 state, the CONTEXTIDR identifies the current Context ID, that is used by: 
° The debug logic, for breakpoint and watchpoint matching. 
` Implemented trace logic, to identify the current process. 


When using the Long-descriptor translation table format, the CONTEXTIDR has a single field, PROCID, that is 
defined as the Process Identifier (Process ID). Therefore, in AArch64 state, the Context ID and Process ID are 
identical when using this translation table format. 


When using the Short-descriptor translation table format: 
7 CONTEXTIDR{3 1:0] defines the Context ID, that is used for breakpoint and watchpoint matching. 
è CONTEXTIDR[31:8] defines the Process ID. 


s CONTEXTIDR[7:0] define the ASID. See Global and process-specific translation table entries on 
page G5-5789. This means that, when using the Short-descriptor translation table format, the ASID is always 
bits[7:0] of the Context ID. 


About debug exceptions 


Debug exceptions occur during normal program flow if a debugger has programmed the PE to generate them. For 
example, a software developer might use a debugger contained in an operating system to debug an application. To 
do this, the debugger might enable one or more debug exceptions. The debug exceptions that can be generated in 
an AArch32 stage 1 translation regime are: 


e Breakpoint Instruction exceptions on page G2-5613. 

. Breakpoint exceptions on page G2-5613, generated by hardware breakpoints. 
. Watchpoint exceptions on page G2-5614, generated by hardware watchpoints. 
7 Vector Catch exceptions on page G2-5614. 


Note 


In addition, Software Step exceptions can be generated in stage 1 of an AArch32 translation regime. However, these 
are always taken to AArch64 state. Software Step exceptions on page D2-2400 describes this. 








The PE can only generate a particular debug exception when both: 


l. Debug exceptions are enabled from the current Exception level and Security state. 
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See Enabling debug exceptions from the current Privilege level and Security state on page G2-5619. 
Breakpoint Instruction exceptions are always enabled from the current Exception level and Security state. 
2. A debugger has enabled that particular debug exception. 


All of the debug exceptions except for Breakpoint Instruction exceptions have an enable control contained in 
the DBGDSCRext. See The debug exception enable controls on page G2-5616. 


Note 


If halting is allowed and EDSCR.HDE is 1, hardware breakpoints and watchpoints cause entry to Debug state 
instead of causing debug exceptions. In Debug state, the PE is halted. 





For the definition of halting is allowed, see Halting allowed and halting prohibited on page H2-6705. 





When a debug exception is taken to an Exception level that is using AArch32: 
° If the debug exception is a Watchpoint exception, it is taken as a Data Abort exception. 
s Otherwise, it is taken as a Prefetch Abort exception. 


The following list summarizes each of the debug exceptions: 


Breakpoint Instruction exceptions 


Breakpoint instructions generate these. Breakpoint instructions are instructions that software 
developers can use to cause exceptions at particular points in the program flow. 


The breakpoint instruction in the A32 and T32 instruction sets is BKPT #<immediate>. Whenever one 
of these is committed for execution, the PE takes a Breakpoint Instruction exception. 
PE behavior 


Breakpoint Instruction exceptions cannot be masked. The PE takes Breakpoint 
Instruction exceptions regardless of both of the following: 


s The current Privilege level and AArch32 mode. 
° The current Security state. 


For more information, see Breakpoint Instruction exceptions on page G2-5625. 


Breakpoint exceptions 


The Armv8-A architecture provides 2-16 hardware breakpoints. These can be programmed to 
generate Breakpoint exceptions based on particular instruction addresses, or based on particular PE 
contexts, or both. 


For example, a software developer might program a hardware breakpoint to generate a Breakpoint 
exception whenever the instruction with address 0x1000 is committed for execution. 


The Armv8-A architecture supports the following types of hardware breakpoint for use in stage 1 
of an AArch32 translation regime: 
° Address: 

— Address Match. 

— Address Mismatch. 

Comparisons are made with the virtual address of each instruction in the program flow. 


s Context: 
— Context ID Match. Matches with the Context ID value held in the CONTEXTIDR. 
—  VMID Match. Matches with the VMID value held in the VTTBR. 
— Context ID and VMID Match. Matches with both the Context ID and the VMID value. 
An Address breakpoint can link to a Context breakpoint, so that the Address breakpoint only 


generates a Breakpoint exception if the PE is in a particular context when the address match or 
mismatch occurs. 
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A breakpoint generates a Breakpoint exception whenever an instruction that causes a match is 
committed for execution. 
PE behavior 


If halting is allowed and EDSCR.HDE is 1, hardware breakpoints cause entry to Debug 
state. That is, they halt the PE. See Chapter H2 Debug State. 


Otherwise: 

° If debug exceptions are enabled, hardware breakpoints cause Breakpoint 
exceptions. 

° If debug exceptions are disabled, hardware breakpoints are ignored. 


For more information, see Breakpoint exceptions on page G2-5628. 


Watchpoint exceptions 


The Armv8-A architecture provides 2-16 hardware watchpoints. These can be programmed to 
generate Watchpoint exceptions based on accesses to particular data addresses, or based on accesses 
to any address in a data address range. 


For example, a software developer might program a hardware watchpoint to generate a Watchpoint 
exception on an access to any address in the data address range 0x1000 - 0x101F. 


A hardware watchpoint can link to a hardware breakpoint if the hardware breakpoint is a Linked 
Context type. In this case, the watchpoint only generates a Watchpoint exception if the PE is in a 
particular context when the data address match occurs. 


The smallest data address size that a watchpoint can be programmed to match on is a byte. A single 
watchpoint can be programmed to match on one or more bytes. 


A watchpoint generates a Watchpoint exception whenever an instruction that initiates an access that 
causes a match is committed for execution. 
PE behavior 


If halting is allowed and EDSCR.HDE is 1, hardware watchpoints cause entry to Debug 
state. That is, they halt the PE. See Chapter H2 Debug State. 


Otherwise: 

° If debug exceptions are enabled, hardware watchpoints cause Watchpoint 
exceptions. 

s If debug exceptions are disabled, hardware watchpoints are ignored. 


For more information, see Watchpoint exceptions on page G2-5653. 


Vector Catch exceptions 


These are used to trap exceptions. The Armv8-A architecture provides two forms of vector catch, 
address-matching and exception-trapping. Only one form can be implemented. 


Whichever form is implemented, a debugger must enable Vector Catch exceptions for one or more 
exception vectors by programming the DBGVCR. Generation of Vector Catch exceptions is then as 


follows: 

è For the address-matching form, a Vector Catch exception is generated whenever the virtual 
address ofan instruction matches a vector that Vector Catch exceptions are enabled for. 

s For the Exception-trapping form, a Vector Catch exception is generated as part of exception 
entry for exception types that correspond to vectors that Vector Catch exceptions are enabled 
for. 

PE behavior 

If debug exceptions are: 
° Enabled, Vector Catch exceptions can be generated. 
° Disabled, vector catch is ignored. 


For more information, see Vector Catch exceptions on page G2-5667. 


Table G2-1 on page G2-5615 summarizes PE behavior and shows the location of the pseudocode for each of the 
debug exceptions. 
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Table G2-1 PE behavior and pseudocode for each of the debug exceptions 





PE behavior if debug exceptions are: 














Debug exception Pseudocode 
Enabled Disabled 
Breakpoint Instruction Takes Prefetch Abort Takes Prefetch Abort = AArch32.SoftwareBreakpoint() 
exception exception exception 
Breakpoint exception Takes Prefetch Abort Ignored See Pseudocode description of Breakpoint 
exception? exceptions taken from AArch32 state on 
page G2-5652 
Watchpoint exception Takes Data Abort Ignored See Pseudocode description of Watchpoint 
exception? exceptions taken from AArch32 state on 
page G2-5665 
Vector Catch exception Takes Prefetch Abort Ignored See Pseudocode description of Vector Catch 
exception exceptions on page G2-5673 





a. Ifhalting is allowed and EDSCR.HDE is 1, hardware breakpoints and watchpoints cause the PE to enter Debug state instead of causing debug 
exceptions. See Chapter H2 Debug State. 
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G2.2 The debug exception enable controls 
The enable controls for each debug exception are as follows: 


Breakpoint Instruction exceptions 


None. Breakpoint Instruction exceptions are always enabled. 


Breakpoint exceptions 
DBGDSCRext.MDBGen, plus an enable control for each breakpoint, DBGBCR<n>.E. 


Watchpoint exceptions 
DBGDSCRext.MDBGen, plus an enable control for each watchpoint, DBGWCR<n>.E. 


Vector Catch exceptions 
DBGDSCRext.MDBGen. 





In addition, for all debug exceptions other than Breakpoint Instruction exceptions, software must configure the 
controls that enable debug exceptions from the current Exception level and Security state. See Enabling debug 
exceptions from the current Privilege level and Security state on page G2-5619. 


The PE cannot take a debug exception if debug exceptions are disabled from either the current Exception level or 
the current Security state. 


Breakpoint Instruction exceptions are always enabled from the current Exception level and Security state. 
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Debug exceptions are usually routed to Abort mode. However, if EL2 is implemented, the routing of debug 


exceptions depends on the Effective values of HDCR.TDE and HCR.TGE: 


If the Effective value of {ADCR.TDE, HCR.TGE} is not {0, 0} 


Debug exceptions taken from Non-secure state are routed to Hyp mode. 


If EL2 is using AArch64 and ARMv8.4-SecEL2 is implemented, debug exceptions taken from 
Secure ELO and Secure EL1 may be routed to Secure EL2. For more information, see Routing debug 


exceptions on page D2-2403. 


Otherwise 
In Non-secure state debug exceptions behave as follows: 
- Debug exceptions taken from Non-secure EL1 and Non-secure ELO are routed to Non-secure 
Abort mode. 
s Breakpoint Instruction exceptions taken from Hyp mode are routed to Hyp mode. 
. All other debug exceptions are disabled from Hyp mode. 
Note 





If EL2 is not implemented, the Effective value of HCR.TGE is 0 and the Effective value of HDCR.TDE is 0. 





Table G2-2, Table G2-3, and Table G2-4 on page G2-5618 show the routing of debug excep 
Exception level that is using AArch32 to an Exception level that is using AArch32. In these 


TDE Means the logical OR of HDCR.TDE and HCR.TGE. 


(Hyp mode) Means: 


tions taken from an 
tables: 


° All debug exceptions other than Breakpoint Instruction exceptions are disabled from this 


Privilege level. 


* Breakpoint Instruction exceptions taken from this Privilege level are taken to Hyp mode. 


Table G2-2 Routing when both EL3 and EL2 are implemented 











Target AArch32 mode when executing in: 
TDE Non-secure: 
Secure state 
PLO PL1 PL2 
0 Non-secure Abort mode Non-secure Abort mode (Hyp mode) | Secure Abort mode 
1 Hyp mode Hyp mode (Hyp mode) | Secure Abort mode 








Table G2-3 Routing when EL3 is implemented and EL2 is not implemented 





Target AArch32 mode w 


Non-secure state 


hen executing in: 


Secure state 





Non-secure Abort mode 





Secure Abort mode 
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Table G2-4 Routing when EL3 is not implemented and EL2 is implemented 





TDE 


Target AArch32 mode when executing in Non-secure: 


PLO PL1 PL2 





Non-secure Abort mode Non-secure Abort mode (Hyp mode) 








Hyp mode Hyp mode (Hyp mode) 





Pseudocode description of routing debug exceptions 


DebugTarget() returns the current debug target Exception level. DebugTargetFrom() returns the debug target 
Exception level for the specified Security state. 
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G2.4 Enabling debug exceptions from the current Privilege level and Security state 


A debug exception can only be taken if all of the following are true: 

° The OS Lock is unlocked. 

e DoubleLockStatus() == FALSE. 

° The debug exception is enabled from the current Privilege level. 
è The debug exception is enabled from the current Security state. 


Table G2-5 shows when debug exceptions are enabled from the current Privilege level. 


Table G2-5 Whether debug exceptions are enabled from the current Privilege level 





Current Privilege level | Breakpoint Instruction exceptions All other debug exceptions 











PL2 Enabled Disabled 
PL1 Enabled Enabled 
PLO 








Table G2-6 shows when debug exceptions are enabled from the current Security state. 


Table G2-6 Whether debug exceptions are enabled from the current Security state 





Current Security state | Breakpoint Instruction exceptions All other debug exceptions 





Non-secure Enabled Enabled from PL1 and PLO only. 





Secure Enabled Depends on SDCR.SPD and SDER.SUIDEN. 
See Disabling debug exceptions from Secure state. 








G2.4.1 Disabling debug exceptions from Secure state 


If EL3 is implemented, software executing at EL3 can enable or disable all debug exceptions taken from Secure PL1 
other than Breakpoint Instruction exceptions, by using one of: 


š The Secure Privileged Debug field, SDCR.SPD, if EL3 is using AArch32. 
$ The AArch32 Secure Privileged Debug field, MDCR_EL3.SPD32, if EL3 is using AArch64. 


If debug exceptions are disabled from Secure PL1, software executing at Secure PL1 can set the Secure User 
Invasive Debug Enable bit, SDER.SUIDEN, to 1 to enable all debug exceptions taken from Secure PLO other than 
Breakpoint Instruction exceptions. 


Note 


Breakpoint Instruction exceptions are always enabled. 








The Armv8-A architecture does not support disabling debug in Non-secure state. 


Note 


If the boot software that is executed when reset is deasserted programs SUIDEN and SPD so that all debug 
exceptions are disabled from Secure state, software operating at EL3 never has to switch any of the debug registers 
between the Security states. 








G2.4.2 Pseudocode description of enabling debug exceptions 


AArch64.GenerateDebugExceptions() determines whether debug exceptions are enabled from the current Exception 
level and Security state. AArch64.GenerateDebugExceptionsFrom() determines whether debug exceptions are enabled 
from the specified Exception level and Security state. 
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G2.5 The effect of powerdown on debug exceptions 
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Debug OS Save and Restore sequences on page H6-6813 describes the powerdown save routine and the restore 
routine. 


When executing either routine, software must use the OS Lock to disable generation of all of the following: 


° Breakpoint exceptions. 
° Watchpoint exceptions. 
à Vector Catch exceptions. 


This is because the generation of these exceptions depends on the state of the debug registers, and the state of the 
debug registers might be lost over these routines. 


Debug exceptions other than Breakpoint Instruction exceptions are enabled only if both the OS Lock is unlocked 
and DoubleLockStatus() == FALSE. 


Breakpoint Instruction exceptions are enabled regardless of the state of the OS Lock and the OS Double Lock. 
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G2.6 Summary of permitted routing and enabling of debug exceptions 
Behavior is as follows: 


Breakpoint Instruction exceptions 


These are always enabled, regardless of the current Privilege level and Security state. Table G2-7 
shows the routing of these. In the table, n/a means not applicable. 


Table G2-7 Routing of Breakpoint Instruction exceptions 

















Target when enabled from: 
Current Security state HDCR.TDE?: 
PLO PL1 PL2 
Secure X Secure Abort mode? Secure Abort mode? n/a 
Non-secure 0 Non-secure Abort mode Non-secure Abort mode Hyp mode 
1 Hyp mode Hyp mode Hyp mode 





a. If EL2 is not implemented, behavior is as if the value of this bit is 0. Otherwise, if the value of HCR.TGE is 1, 
HDCR.TDE is treated as being | other than for a direct read of HDCR. 


b. IfEL3 is implemented and is using AArch32, Secure Abort mode is at EL3. Otherwise, Secure Abort mode is at EL1. 


All other debug exceptions 
The enabling and permitted routing is controlled by all of the following: 
. SDCR.SPD. 
. SDER.SUIDEN. 
° HDCR.TDE. 
. The IMPLEMENTATION DEFINED authentication interface. 
Table G2-8 shows the valid combinations of the values of SDCR.SPD, SDER.SUIDEN, 
HDCR.TDE, and, in the Auth column, the input from the IMPLEMENTATION DEFINED authentication 
interface described by the pseudocode function 


AArch32.SelfHostedSecurePrivilegedInvasiveDebugEnabled(). For each combination, the table 
shows where debug exceptions are enabled from and where they are taken to. 


In the table, n/a means not applicable and a dash, -, means that debug exceptions are disabled from 
that Exception level. 


Table G2-8 Breakpoint, Watchpoint, and Vector Catch exceptions 





























Target AArch32 mode when 
enabled from: 
Debug state Locka current SPD> Authe SUIDEN TDE4 
Security state 
PLO PL1 PL2 
Yes X X ObXX X X - - - 
No TRUE X @bXX X X - - - 
No FALSE Secure b00 FALSE 0 X - - n/a 
No FALSE Secure 0b00 FALSE 1 X Secure Abort - n/a 
mode® 
No FALSE Secure 0b00 TRUE X X Secure Abort Secure Abort n/a 
mode® mode® 
No FALSE Secure 0b10 X 0 X - - n/a 
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Table G2-8 Breakpoint, Watchpoint, and Vector Catch exceptions (continued) 





Target AArch32 mode when 














enabled from: 
Debug state Locka Current SPDb Authc SUIDEN TDEd 
Security state 

PLO PL1 PL2 

No FALSE Secure 0b10 X 1 X Secure Abort - n/a 
mode® 

No FALSE Secure 0b11 X X X Secure Abort Secure Abort n/a 
mode® mode® 

No FALSE  Non-secure ObXX X X 0 Non-secure Non-secure - 
Abort mode Abort mode 

No FALSE Non-secure 0bXX X X 1 Hyp mode Hyp mode - 








a. The value of (OSLSR_EL1.OSLK == ’1’ || DoubleLockStatus()). 
b. IfEL3 is not implemented, behavior is as if this is 0b11. 


c. See the text that introduces this table for an explanation of the Auth on page G2-5622 column. An entry of TRUE indicates that the 
authentication mechanism permits the debug exceptions to be taken to their default target PE mode. 


d. IfHCR.TGE is 1, this bit is treated as being 1 other than for a direct read of HDCR. If EL2 is not implemented, behavior is as if TDE is 0. 
e. IfEL3 is implemented and is using AArch32, Secure Abort mode is at EL3. Otherwise, Secure Abort mode is at EL1 
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G2.7 Pseudocode description of debug exceptions 


AArch32.DebugFault() returns a FaultRecord() that indicates that a memory access has generated a debug exception. 


The AArch32.Abort() function processes FaultRecord(), as described in Abort exceptions on page G4-5717, and 


generates: 
. Data Abort exceptions for watchpoints. 
. Prefetch Abort exceptions for all other debug exceptions. 
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G2.8 Breakpoint Instruction exceptions 


This section describes Breakpoint Instruction exceptions in an AArch32 translation regime. 


Note 


When the PE is executing in ELO using AArch32 and EL] is using AArch64, it is using the AArch64 EL1&0 
translation regime. A T32 or A32 BKPT instruction executed at ELO can generate a Breakpoint Instruction exception 
that is taken to an Exception level that is using AArch64. For more information about the handling of these 
exceptions, see Breakpoint Instruction exceptions on page D2-2411. 








It contains the following subsections: 

. About Breakpoint Instruction exceptions. 

è Breakpoint instruction in the A32 and T32 instruction sets. 

. BKPT instructions as the first instruction in an IT block on page G2-5626. 

. Exception syndrome information and preferred return address for a BKPT instruction on page G2-5626. 
s Pseudocode description of Breakpoint Instruction exceptions on page G2-5627. 


G2.8.1 About Breakpoint Instruction exceptions 


A breakpoint is an event that results from the execution of an instruction, based on either: 
: The instruction address, the PE context, or both. This type of breakpoint is called a hardware breakpoint. 


s The instruction itself. That is, the instruction is a breakpoint instruction. These can be included in the 
program that the PE executes. This type of breakpoint is called a software breakpoint. 


Breakpoint Instruction exceptions, that this section describes, are software breakpoints. Breakpoint exceptions on 
page G2-5628 describes hardware breakpoints. 


There is no enable control for Breakpoint Instruction exceptions. They are always enabled, and cannot be masked. 


A Breakpoint Instruction exception is generated whenever a breakpoint instruction is committed for execution, 
regardless of all of the following: 


s The current Exception level. 
. The current Security state. 
. Whether the debug target Exception level, ELp, is using AArch64 or AArch32. 


Note 


° ELp is the Exception level that debug exceptions are targeting. See Enabling debug exceptions from the 
current Privilege level and Security state on page G2-5619. 





. Debuggers using breakpoint instructions must be aware of the Armv8 rules for concurrent modification and 
execution of instructions. See Concurrent modification and execution of instructions on page B2-112. 





G2.8.2 Breakpoint instruction in the A32 and T32 instruction sets 


ARM DDI 0487E.a 
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The breakpoint instruction, in both instruction sets, is: 
° BKPT #<immediate> 


For details of the instruction encoding, see BKPT on page F5-4133. 


About whether the BKPT instruction is conditional 
In the T32 instruction set, BKPT instructions are always unconditional. 


In the A32 instruction set: 


. If the Condition code field is AL, the BKPT instruction is unconditional. 
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è If the Condition code field is anything other than AL, behavior is CONSTRAINED UNPREDICTABLE, and is one 
of the following: 


— The instruction is UNDEFINED. 

— The instruction is treated as a NOP instruction. 
— The instruction is executed unconditionally. 
— The instruction is executed conditionally. 


BKPT instructions as the first instruction in an IT block 


If the first instruction in an IT block is a T32 BKPT instruction, then in an implementation that supports the ITD 
control, if ITD field that applies to the current Exception level is: 


0 The BKPT instruction generates a Breakpoint Instruction exception. 


1 The combination of IT instruction and BKPT instruction is UNDEFINED. Either the IT instruction or the 
BKPT instruction generates an Undefined Instruction exception. 


In such an implementation, to ensure consistent behavior when making the first instruction in one or more IT blocks 
a BKPT instruction, the debugger must replace the IT instruction. 


An implementation that does not support the ITD control behaves as if the value of the ITD field is 0. 


The ITD control fields are: 
HSCTLR.ITD Applies to execution at EL2 when EL2 is using AArch32. 
SCTLR.ITD Applies to execution at ELO or EL1 when EL1 is using AArch32. 
SCTLR_EL1.ITD 
Applies to execution at ELO using AArch32 when EL] is using AArch64. 


Note 
T32 BKPT instructions are always unconditional, even when they are inside an IT block. See: 
. Disabling or enabling PLO and PL1 use of AArch32 deprecated functionality on page G1-5579. 
. Disabling or enabling EL2 use of AArch32 deprecated functionality on page G1-5588. 








Exception syndrome information and preferred return address for a BKPT instruction 


See the following: 


° Exception syndrome information for a Breakpoint Instruction exception. 
. Preferred return address for a Breakpoint Instruction exception on page G2-5627. 
Note 





Usually, the term exception syndrome is used only for exceptions taken to Hyp mode, or to AArch64 state. The 
referenced section uses the term more generally, to include exception information reported in the IFSR. 





Exception syndrome information for a Breakpoint Instruction exception 
The PE takes a Breakpoint Instruction exception as either: 
s A Prefetch Abort exception if it is taken to PL1. In this case, it is taken to Abort mode. 


s A Hyp Trap exception, if it is taken to PL2 because either HCR.TGE or HDCR.TDE is 1. In this case, it is 
taken to Hyp mode. 


If the exception is taken to: 


PL1 Abort mode 


The PE sets all of the following: 
s DBGDSCRext.MOE to 0b0011, to indicate a Breakpoint Instruction exception. 
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. IFSR.FS to the code for a debug, 0b00010. 


è The IFAR with an UNKNOWN value. 
PL2 Hyp mode 
The PE does all of the following: 
è Records information about the exception in the Hypervisor Syndrome Register, HSR. See 
Table G2-9. 


è Sets DBGDSCRext.MOE to 0b0011, to indicate a Breakpoint Instruction exception. 
` Sets the HIFAR to an unknown value. 


Table G2-9 Information recorded in the HSR 





HSR field 


Information recorded 





Exception Class, EC 


The PE sets this to the code for a Prefetch Abort exception routed to Hyp mode, 0x20. 





Instruction Length, IL 


The PE sets this to: 
° 0 for a T32 BKPT instruction. 
. 1 for an A32 BKPT instruction. 





Instruction Specific Syndrome, 
ISS 


ISS[24:10] RESO. 
ISS[9] External Abort type (EA). The PE sets this to 0. 
ISS[8:6] RESO. 


ISS[5:0] = Instruction Fault Status Code (IFSC). The PE sets this to the code for a debug 
exception, 0b100010. 





Note 


For information about how debug exceptions can be routed to PL2, see Routing debug exceptions 
on page G2-5617. 








Preferred return address for a Breakpoint Instruction exception 


The preferred return address is the address of the breakpoint instruction, not the next instruction. This is different 
to the behavior of other exception-generating instructions, like SVC. 


G2.8.5 Pseudocode description of Breakpoint Instruction exceptions 


AArch32.SoftwareBreakpoint() generates a Prefetch Abort exception that is taken from AArch32 state. 
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Breakpoint exceptions 


This section describes Breakpoint exceptions in stage 1 of an AArch32 translation regime. 


The PE is using an AArch32 translation regime when it is executing either: 
è At EL1 or higher in an Exception level that is using AArch32. 
: At ELO using AArch32 when EL! is using AArch32. 


This section contains the following subsections: 


. About Breakpoint exceptions. 

. Breakpoint types and linking of breakpoints on page G2-5629. 

. Execution conditions for which a breakpoint generates Breakpoint exceptions on page G2-5637. 
. Breakpoint instruction address comparisons on page G2-5640. 

e Breakpoint context comparisons on page G2-5645. 


$ Using breakpoints on page G2-5646. 
. Exception syndrome information and preferred return address for a Breakpoint exception on page G2-5651. 
s Pseudocode description of Breakpoint exceptions taken from AArch32 state on page G2-5652. 


About Breakpoint exceptions 


A breakpoint is an event that results from the execution of an instruction, based on either: 
a The instruction address, the PE context, or both. This type of breakpoint is called a hardware breakpoint. 


s The instruction itself. That is, the instruction is a breakpoint instruction. These can be included in the 
program that the PE executes. This type of breakpoint is called a software breakpoint. 


Breakpoint exceptions are generated by Breakpoint debug events. Breakpoint debug events are generated by 
hardware breakpoints. Software breakpoints are described in Breakpoint Instruction exceptions on page G2-5625. 


An implementation can include between 2-16 hardware breakpoints. DBGDIDR.BRPs shows how many are 
implemented. 


To use an implemented hardware breakpoint, a debugger programs the following registers for the breakpoint: 


è The Breakpoint Control Register, DBGBCR<n>. This contains controls for the breakpoint, for example an 
enable control. 


: The Breakpoint Value Register, DBGBVR<n>. This holds a value used for breakpoint matching, that is one 
of: 


— An instruction virtual address. 
— A Context ID. 


s If EL2 is implemented, the Breakpoint Extended Value Register, DBGBXVR<n>, that holds a VMID value 
used for breakpoint matching. 


These registers are numbered, so that: 
° DBGBCR1, DBGBVR1, and DBGBXVR1 are for breakpoint number one. 
. DBGBCR2, DBGBVR2, and DBGBXVR2 are for breakpoint number two. 


. DBGBCR<n>, DBGBVR<n>, and DBGBXVR<n> are for breakpoint number <n>. 


A debugger can link a breakpoint that is programmed with an address and a breakpoint that is programmed with 
anything other than an address together, so that a Breakpoint debug event is only generated if both breakpoints 
match. 


For each instruction in the program flow, all of the breakpoints are tested. When a breakpoint is tested, it generates 
a Breakpoint debug event if all of the following are true: 


: The breakpoint is enabled. That is, the breakpoint enable control for it, DBGBCR<n>.E, is 1. 
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s The conditions specified in the DBGBCR<n> are met. 


° The comparisons with the values held in one or both of the DBGBVR<n> and DBGBX VR<n>, as applicable, 
are successful. 


s If the breakpoint is linked to another breakpoint, the comparisons made by that other breakpoint are also 
successful. 
7 The instruction is committed for execution. 


If all of these conditions are met, the breakpoint generates the Breakpoint debug event regardless of the following: 
° Whether the instruction passes its Condition code check. 
° The instruction type. 


If halting is allowed and EDSCR.HDE is 1, Breakpoint debug events cause entry to Debug state. 


Otherwise, if debug exceptions are 


° Enabled, Breakpoint debug events generate Breakpoint exceptions 
° Disabled, Breakpoint debug events are ignored. 
Note 





The remainder of this Breakpoint exceptions section, including all subsections, describes breakpoints as generating 
Breakpoint exceptions. However, the behavior described also applies if breakpoints are causing entry to Debug 
state. 





The debug exception enable controls on page G2-5616 describes the enable controls for Breakpoint debug events. 


G2.9.2 Breakpoint types and linking of breakpoints 
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Each implemented breakpoint is one of the following: 


$ A context-aware breakpoint. This is a breakpoint that can be programmed to generate a Breakpoint exception 
on any one of the following: 


— An instruction address match. 

— An instruction address mismatch. 

— A Context ID match, with the value held in the CONTEXTIDR. 
— A VMID match, with the value held in the VTTBR. 

— Botha Context ID match and a VMID match. 


à A breakpoint that is not context-aware. These can only be programmed to generate a Breakpoint exception 
on an instruction address match or an instruction address mismatch. 


DBGDIDR.CTX_CMPs shows how many of the implemented breakpoints are context-aware breakpoints. At least 
one implemented breakpoint must be context-aware. The context-aware breakpoints are the highest numbered 
breakpoints. 


Any breakpoint that is programmed to generate a Breakpoint exception on an instruction address match or mismatch 
is categorized as an Address breakpoint. Breakpoints that are programmed to match on anything else are categorized 
as Context breakpoints. 


When a debugger programs a breakpoint to be an Address or a Context breakpoint, it must also program that 
breakpoint so that it is either: 


: Used in isolation. In this case, the breakpoint is called an Unlinked breakpoint. 
s Enabled for linking to another breakpoint. In this case, the breakpoint is called a Linked breakpoint. 


By linking an Address breakpoint and a Context breakpoint together, the debugger can create a breakpoint pair that 
only generates a Breakpoint exception if the PE is in a particular context when an instruction address match or 
mismatch occurs. For example, a debugger might: 


1. Program breakpoint number one to be a Linked Address Match breakpoint. 
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2; Program breakpoint number five to be a Linked Context ID Match breakpoint. 


3. Link these two breakpoints together. A Breakpoint exception is only generated if both the instruction address 
matches and the Context ID matches. 


The Breakpoint Type field for a breakpoint, DBGBCR<n>.BT, controls the breakpoint type and whether the 
breakpoint is enabled for linking. If BT[0] is 1, the breakpoint is enabled for linking. 


Address breakpoints can be programmed to generate Breakpoint exceptions on addresses that are halfword-aligned 
but not word-aligned. This makes it possible to breakpoint on T32 instructions. See Specifving the halfword-aligned 
address that an Address breakpoint matches on on page G2-5640. 


Rules for linking breakpoints 
The rules for breakpoint linking are as follows: 
s Only Linked breakpoint types can be linked. 


è Any type of Linked Address breakpoint can link to any type of Linked Context breakpoint. The Linked 
Breakpoint Number field, DBGBCR<n>.LBN, for the Linked Address breakpoint specifies the particular 
Linked Context breakpoint that the Linked Address breakpoint links to, and: 


—  DBGBCR<n>.{SSC, HMC, PMC} for the Linked Address breakpoint define the execution conditions 
that the breakpoint pair generates Breakpoint exceptions for. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page G2-5637. 


—  DBGBCR<n>.{SSC, HMC, PMC} for the Linked Context breakpoint are ignored. 


` Linked Context breakpoint types can only be linked to. The LBN field for Context breakpoints is therefore 
ignored. 


° Linked Address breakpoints cannot link to watchpoints. The LBN field can therefore only specify another 
breakpoint. 


è If a Linked Address breakpoint links to a breakpoint that is not context-aware, the behavior of the Linked 
Address breakpoint is CONSTRAINED UNPREDICTABLE. See Other usage constraints for Address breakpoints 
on page G2-5650. 


Ifa Linked Address breakpoint links to an Unlinked Context breakpoint, the Linked Address breakpoint 
never generates any Breakpoint exceptions. 


: Multiple Linked Address breakpoints can link to a single Linked Context breakpoint. 





Note 


Multiple Linked watchpoints can also link to a single Linked Context breakpoint. Watchpoint exceptions on 
page G2-5653 describes watchpoints. 





These rules mean that a single Linked Context breakpoint might be linked to by all, or any combination of, the 
following: 


è Multiple Linked Address Match breakpoints. 
< Multiple Linked Address Mismatch breakpoints. 
s Multiple Linked watchpoints. 


It is also possible that a Linked Context breakpoint might have no breakpoints or watchpoints linked to it. 


Figure G2-1 on page G2-5631 shows an example of permitted breakpoint and watchpoint linking. 
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Figure G2-1 The role of linking in Breakpoint and Watchpoint exception generation 


In Figure G2-1, each Linked Address breakpoint can only generate a Breakpoint exception if the comparisons made 
by both it, and the Linked Context breakpoint that it links to, are successful. Similarly, each Linked watchpoint can 
only generate a Watchpoint exception if the comparisons made by both it, and the Linked Context breakpoint that 


it links to, are successful. 


Breakpoint types defined by DBGBCRn.BT 


The following list provides more detail about each breakpoint type: 


0b0000, Unlinked Address Match breakpoint 


Generation of a Breakpoint exception depends on both: 


° DBGBCR<n>. {SSC, HMC, PMC}. These define the execution conditions that the 
breakpoint generates Breakpoint exceptions for. See Execution conditions for which a 


breakpoint generates Breakpoint exceptions on page G2-5637. 


° A successful address match, as described in Breakpoint instruction address comparisons on 
page G2-5640. 


DBGBCR<n>.LBN for this breakpoint is ignored. 
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0b0001, Linked Address Match breakpoint 
Generation of a Breakpoint exception depends on all of the following: 


è DBGBCR<n>. {SSC, HMC, PMC} for this breakpoint. These define the execution 
conditions that the breakpoint generates Breakpoint exceptions for. See Execution conditions 
for which a breakpoint generates Breakpoint exceptions on page G2-5637. 


° A successful address match defined by this breakpoint, as described in Breakpoint instruction 
address comparisons on page G2-5640. 

° A successful context match defined by the Linked Context breakpoint that this breakpoint 
links to. 

DBGBCR<n>.LBN for this breakpoint selects the Linked Context breakpoint that this breakpoint 

links to. 


0b0010, Unlinked Context ID Match breakpoint 
BT == 0b0010 is a reserved value if the breakpoint is not a context-aware breakpoint. 
For context-aware breakpoints, generation of a Breakpoint exception depends on both: 


. DBGBCR<n>. {SSC, HMC, PMC}. These define the execution conditions that the 
breakpoint generates Breakpoint exceptions for. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page G2-5637. 


` A successful Context ID match, as described in Breakpoint context comparisons on 
page G2-5645. 


The value of DBGBVR<n>.ContextID is compared with the current Context ID. 


CONTEXTIDR_EL2 holds the current Context ID when all of: 

s The implementation includes ARMv8.1-VHE. 

: EL2 is implemented and enabled in the current Security state. 

a EL2 using AArch64 and the value of HCR_EL2.E2H is 1. 

s The PE is executing at ELO and HCR_EL2.TGE is 1, or the PE is executing at EL2. 


Otherwise, CONTEXTIDR holds the current Context ID. 
DBGBCR<n>. {LBN, BAS} for this breakpoint are ignored 


0b0011, Linked Context ID Match breakpoint 
BT == 0b0011 is a reserved value if the breakpoint is not a context-aware breakpoint. 
For context-aware breakpoints, either: 


. This breakpoint does not generate any Breakpoint exceptions, if no Linked breakpoints or 
Linked watchpoints link to it. 


° Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address breakpoint that 
links to this breakpoint, see Breakpoint instruction address comparisons on 
page G2-5640. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page G2-5645. 


° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page G2-5657. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page G2-5645. 


The value of DBGBVR<n>.ContextID is compared with the current Context ID. 
CONTEXTIDR_EL2 holds the current Context ID when all of: 

$ The implementation includes ARMv8.1-VHE. 

G EL2 is implemented and enabled in the current Security state. 

- EL2 using AArch64 and the value of HCR_EL2.E2H is 1. 
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a The PE is executing at ELO and HCR_EL2.TGE is 1, or the PE is executing at EL2. 
Otherwise, CONTEXTIDR holds the current Context ID. 
DBGBCR<n>. {LBN, SSC, HMC, BAS PMC} for this breakpoint are ignored. 


0b0100, Unlinked Address Mismatch breakpoint 
Generation of a Breakpoint exception depends on both: 


: DBGBCR<n>. {SSC, HMC, PMC}. These define the execution conditions that the 
breakpoint generates Breakpoint exceptions for. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page G2-5637. 


° A successful address mismatch, as described in Breakpoint instruction address comparisons 
on page G2-5640. 


DBGBCR<n>.LBN for this breakpoint is ignored. 


0b0101, Linked Address Mismatch breakpoint 
Generation of a Breakpoint exception depends on all of the following: 


° DBGBCR<n>. {SSC, HMC, PMC}. These define the execution conditions that the 
breakpoint generates Breakpoint exceptions for. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page G2-5637. 


° A successful address mismatch defined by this breakpoint, as described in Breakpoint 
instruction address comparisons on page G2-5640. 


` A successful context match defined by the Linked Context breakpoint that this breakpoint 
links to. 


DBGBCR<n>.LBN for this breakpoint selects the Linked Context breakpoint that this breakpoint 
links to. 
0b0110, Unlinked CONTEXTIDR_EL1 Match breakpoint 
BT == 0b0110 is a reserved value if either: 
a The breakpoint is not a context-aware breakpoint. 
° The implementation does not include ARMv8.1-VHE. 
For context-aware breakpoints, generation of a Breakpoint exception depends on both: 


a DBGBCR<n>. {SSC, HMC, PMC}. These define the execution conditions for which the 
breakpoint generates Breakpoint exceptions. 


s A successful Context ID match defined by this breakpoint, as described in Breakpoint context 
comparisons on page G2-5645. 


The Context ID check is made against the value in CONTEXTIDR, or CONTEXTIDR_EL1. The 
value of DBGBVR<n>.ContextID is compared with the Context ID value held in CONTEXTIDR 
or CONTEXTIDR_EL1. 


DBGBCR<n>. {LBN, BAS} for this breakpoint are ignored. 


0b0111, Linked CONTEXTIDR_EL1 Match breakpoint 
BT == 0b0111 is a reserved value if either: 


° The breakpoint is not a context-aware breakpoint. 
a The implementation does not include ARMv8.1-VHE. 
For context-aware breakpoints, one of the following applies: 


: If no Linked breakpoints or Linked watchpoints link to this breakpoint, then the breakpoint 
does not generate any Breakpoint exceptions. 
° Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address match 
breakpoint that links to this breakpoint, see Breakpoint instruction address 
comparisons on page G2-5640. 
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— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page G2-5645. 


° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page G2-5657. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page G2-5645. 


The Context ID check is made against the value in CONTEXTIDR, or CONTEXTIDR_EL1. The 
value of DBGBVR<n>.ContextID is compared with the Context ID value held in CONTEXTIDR 
or CONTEXTIDR_EL1. 


DBGBCR<n>. {LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


0b1000, Unlinked VMID Match breakpoint 
BT == 0b1000 is a reserved value if either: 
s The breakpoint is not a context-aware breakpoint. 
. EL2 is not implemented. 
For context-aware breakpoints, generation of a Breakpoint exception depends on both: 


° DBGBCR<n>. {SSC, HMC, PMC}. These define the execution conditions that the 
breakpoint generates Breakpoint exceptions for. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page G2-5637. 


* A successful VMID match, as described in Breakpoint context comparisons on 
page G2-5645. 


DBGBCR<n>.{LBN, BAS} for this breakpoint are ignored. 


0b1001, Linked VMID Match breakpoint 


BT == 0b1000 is a reserved value if either: 
. The breakpoint is not a context-matching breakpoint. 
. EL2 is not implemented. 


For context-aware breakpoints, either: 


. This breakpoint does not generate any Breakpoint exceptions, if no Linked breakpoints or 
Linked watchpoints link to it. 


e Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address Match 
breakpoint that links to this breakpoint. See Breakpoint instruction address 
comparisons on page G2-5640. 


— A successful VMID match defined by this breakpoint. 
° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page G2-5657. 


— A successful VMID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page G2-5645. 


DBGBCR<n>. {LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


0b1010, Unlinked Context ID and VMID Match breakpoint 
BT == 0b1010 is a reserved value if either: 


s The breakpoint is not a context-matching breakpoint. 
. EL2 is not implemented. 
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For context-matching breakpoints, generation of a Breakpoint exception depends on all of the 
following: 


. DBGBCR<n>. {SSC, HMC, PMC}. These define the execution conditions that the 
breakpoint generates Breakpoint exceptions for. See Execution conditions for which a 
breakpoint generates Breakpoint exceptions on page G2-5637. 


3 A successful Context ID match, as described in Breakpoint context comparisons on 
page G2-5645. 


. A successful VMID match. 
The value of DBGBVR<n>.ContextID is compared with CONTEXTIDR. 


Breakpoint context comparisons on page G2-5645 describes the requirements for a successful 
Context ID match and a successful VMID match. 


DBGBCR<n>. {LBN, BAS} for this breakpoint are ignored. 


0b1011, Linked Context ID and VMID Match breakpoint 


BT == 0b1011 is a reserved value if either: 
e The breakpoint is not a context-matching breakpoint. 
. EL2 is not implemented. 


For context-matching breakpoints, either: 


$ This breakpoint does not generate any Breakpoint exceptions, if no Linked breakpoints or 
Linked watchpoints link to it. 


: Generation of a Breakpoint exception depends on all of the following: 


— A successful instruction address match, defined by a Linked Address breakpoint that 
links to this breakpoint, see Breakpoint instruction address comparisons on 
page G2-5640. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page G2-5645. 


— A successful VMID match defined by this breakpoint. 
G Generation of a Watchpoint exception depends on all of the following: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page G2-5657. 


— A successful Context ID match defined by this breakpoint, as described in Breakpoint 
context comparisons on page G2-5645. 


— A successful VMID match defined by this breakpoint. 
The value of DBGBVR<n>.ContextID is compared with CONTEXTIDR. 


Breakpoint context comparisons on page G2-5645 describes the requirements for a successful 
Context ID match and a successful VMID match by this breakpoint. 


DBGBCR<n>. {LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


0b1100, Unlinked CONTEXTIDR_EL2 Match breakpoint 
BT == 0b1100 is a reserved value if: 


s The breakpoint is not a context-aware breakpoint. 
$ The implementation does not include ARMv8.1-VHE. 
. EL2 is not implemented. 


For context-aware breakpoints, generation of a Breakpoint exception depends on both: 


ë DBGBCR<n>. {SSC, HMC, PMC}. These define the execution conditions for which the 
breakpoint generates Breakpoint exceptions. 


. A successful CONTEXTIDR_EL2 match.The value of DBGBVR<n>.ContextID2 is 
compared with the Context ID value held in CONTEXTIDR_EL2, as described in 
Breakpoint context comparisons on page G2-5645. 
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The check against CONTEXTIDR_EL2 means this breakpoint can be generated only if EL2 is 
implemented and enabled in the current Security state and EL2 is using AArch64. 


Note 
The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 








DBGBCR<n>. {LBN, BAS} for this breakpoint are ignored. 


0b1101, Linked CONTEXTIDR_EL2 Match 


BT == 0b1101 is a reserved value if: 


s The breakpoint is not a context-aware breakpoint. 
` The implementation does not include ARMv8.1-VHE. 
. EL2 is not implemented. 


For context-aware breakpoints, either: 


3 If no Linked breakpoints or Linked watchpoints link to this breakpoint, then the breakpoint 
does not generate any Breakpoint exceptions. 


° Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address match 
breakpoint that links to this breakpoint, see Breakpoint instruction address 
comparisons on page G2-5640. 


— A successful CONTEXTIDR_EL2 match, as described in Breakpoint context 
comparisons on page G2-5645. 


° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page G2-5657. 


— A successful CONTEXTIDR_EL2 match. The value of DBGBVR<n>.ContextID2 is 
compared with the Context ID value held in CONTEXTIDR_EL2, as described in 
Breakpoint context comparisons on page G2-5645. 


The check against the CONTEXTIDR_EL2 means the breakpoint or watchpoint can be generated 
only if EL2 is implemented and enabled in the current Security state and EL2 is using AArch64. 


— Note 
The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 


DBGBCR<n>. {LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 


0b1110, Unlinked Full Context ID Match breakpoint 


G2-5636 


BT == 0b1110 is a reserved value if: 


$ The breakpoint is not a context-aware breakpoint. 
s The implementation does not include ARMv8.1-VHE. 
. EL2 is not implemented. 


For context-aware breakpoints, generation of a Breakpoint exception depends on both: 


. DBGBCR<n>. {SSC, HMC, PMC}. These define the execution conditions for which the 
breakpoint generates Breakpoint exceptions. 


. A successful Context ID match, as described in Breakpoint context comparisons on 
page G2-5645. 


The Context ID check is made by checking both: 


$ The value of DBGBVR<n>.ContextID against the value in CONTEXTIDR, or 
CONTEXTIDR EL1. 


: The value of DBGBXVR<n>.ContextID2 against the value in CONTEXTIDR_EL2. 


Both comparisons must match for the check to succeed. 
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The check against the CONTEXTIDR_EL2 means this breakpoint can be generated only if EL2 is 
implemented and enabled in the current Security state and EL2 is using AArch64. 


Note 
The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 








DBGBCR<n>. {LBN, BAS} for this breakpoint are ignored. 


0b1111, Linked Full Context ID Match breakpoint 


BT == 0b1111 is a reserved value if: 


s The breakpoint is not a context-aware breakpoint. 
` The implementation does not include ARMv8.1-VHE. 
. EL2 is not implemented. 


For context-aware breakpoints, one of the following applies: 


3 If no Linked breakpoints or Linked watchpoints link to this breakpoint, then the breakpoint 
does not generate any Breakpoint exceptions. 


° Generation of a Breakpoint exception depends on both: 


— A successful instruction address match, defined by a Linked Address match 
breakpoint that links to this breakpoint, see Breakpoint instruction address 
comparisons on page G2-5640. 


— A successful Context ID match, as described in Breakpoint context comparisons on 
page G2-5645. 


° Generation of a Watchpoint exception depends on both: 


— A successful data address match, defined by a Linked watchpoint that links to this 
breakpoint, see Watchpoint data address comparisons on page G2-5657. 


— A successful Context ID match, as described in Breakpoint context comparisons on 
page G2-5645. 


The Context ID check is made by checking both: 


: The value of DBGBVR<n>.ContextID against the value in CONTEXTIDR, or 
CONTEXTIDR EL1. 


g The value of DBGBXVR<n>.ContextID2 against the value in CONTEXTIDR_EL2. 

Both comparisons must match for the check to succeed. 

The check against the CONTEXTIDR_EL2 means the breakpoint or watchpoint can be generated 
only if EL2 is implemented and enabled in the current Security state and EL2 is using AArch64. 


— Note 
The operation of this breakpoint does not depend on the value of HCR_EL2.E2H. 


DBGBCR<n>. {LBN, SSC, HMC, BAS, PMC} for this breakpoint are ignored. 





See Reserved DBGBCR<n>.BT values on page G2-5648 for the behavior of breakpoints programmed with reserved 





G2.9.3 Execution conditions for which a breakpoint generates Breakpoint exceptions 


ARM DDI 0487E.a 
ID070919 


Each breakpoint can be programmed so that it only generates Breakpoint exceptions for certain execution 
conditions. For example, a breakpoint might be programmed to generate Breakpoint exceptions only when the PE 
is executing at PLO in Secure state. 
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DBGBCR<n>. {SSC, HMC, PMC} define the execution conditions the breakpoint generates Breakpoint exceptions 


for, as follows: 


Security State Control, SSC 


Controls whether the breakpoint generates Breakpoint exceptions only in Secure state, only in 
Non-secure state, or in both Security states. 
Note 


This is determined by the Security state of the PE, not from the NS attribute returned by the 
translation of the virtual address on which the breakpoint is set. 








Higher Mode Control, HMC, and Privileged Mode Control, PMC 


HMC and PMC together control which AArch32 modes the breakpoint generates Breakpoint 
exceptions in. 


Table G2-10 shows the valid combinations of the values of HMC, SSC, and PMC, and for each combination shows 
which Privilege levels breakpoints generate Breakpoint exceptions in. 


In the table: 







































































Y Means that a breakpoint programmed with the values of HMC, SSC and PMC shown in that row 
can generate Breakpoint exceptions in AArch32 modes at that Privilege level. 
- Means that a breakpoint programmed with the values of HMC, SSC and PMC shown in that row 
cannot generate Breakpoint exceptions in AArch32 modes at that Privilege level. 
Res Means that the combination of HMC, SSC, and PMC is reserved. See Reserved 
DBGBCR<n>.{SSC, HMC, PMC} values on page G2-5649. 
Table G2-10 Summary of breakpoint HMC, SSC, and PMC encodings 
nc ssc pmo Secury state the breakpoint | as pL plo 
0 00 00 Both 7 ye Y 
0 00 01 2 Y z 
0 00 10 - - Y 
0 00 11 - Y Y 
0 01 00 Non-Secure - ye Y 
0 01 01 = Y 2 
0 01 10 - - Y 
0 01 11 - Y Y 
0 10 00 Secure z ye Y 
0 10 01 - Y - 
0 10 10 P z 
0 10 11 - Y 
0 11 01 Secure Y Y - 
0 11 11 Y Y 
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Table G2-10 Summary of breakpoint HMC, SSC, and PMC encodings (continued) 












































ume ssc puo Secu atate ebreatpeint | pix pii Pio 
1 00 01 Both Y - 
1 00 11 Y Y Y 
1 01 00 Non-secure Y - 
1 01 01 Y Y - 
1 01 11 Y Y Y 
1 10 01 Secure Y Y - 
1 10 11 Y Y Y 
1 11 00 Both Y - - 
1 11 01 Y Y - 
1 11 11 Y Y Y 








a. Debug exceptions are not generated at PL2 using AArch32. This means that these 


combinations of HMC, SSC, and PMC are only relevant if breakpoints cause entry to 
Debug state. Self-hosted debuggers must avoid combinations of HMC, SSC, and PMC 
that generate Breakpoint exceptions at PL2 using AArch32. 


b. Only in User, System and Supervisor modes. 


All combinations of HMC, SSC, and PMC that this table does not show are reserved. See Reserved HMC, SSC, and 
PMC combinations on page G2-5649. 
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Breakpoint instruction address comparisons 


Address comparisons are made for each instruction in the program flow. The following subsections describe the 
criteria for a successful address comparison, for: 


$ Address Match breakpoints. 
s Address Mismatch breakpoints. 


Address Match breakpoints 
An address match comparison is successful if both: 
: Bits [31:2] of the current instruction virtual address are equal to DBGBVR<n>[31:2]. 


° The word or halfword selected by DBGBCR<n>.BAS matches. That is, either: 


— DBGBCR<n>.BAS is programmed with 0b0011 or 0b1111, and the instruction is at a word-aligned 
address. 


—  DBGBCR<n>.BAS is programmed with 0b1100, and the instruction is not at a word-aligned address. 
See Specifving the halfword-aligned address that an Address breakpoint matches on. 





Note 
DBGBVR<n>[1:0] are RESO and are ignored. 





Address Mismatch breakpoints 
An address mismatch comparison is successful if either: 
s Bits [31:2] of the current instruction virtual address are not equal to DBGBVR<n>[31:2]. 


à The word or halfword selected by DBGBCR<n>.BAS does not match. That is, either: 


— DBGBCR<n>.BAS is programmed with 0b0011 or 0b1111, and the instruction is not at a word-aligned 
address. 


—  DBGBCR<n>.BAS is programmed with 0b1100, and the instruction is at a word-aligned address. 
See Specifying the halfword-aligned address that an Address breakpoint matches on. 





Note 
DBGBVR<n>[1:0] are RESO and are ignored. 


° Address Mismatch breakpoints can be used to single-step through code. See Using an Address Mismatch 
breakpoint to single-step an instruction on page G2-5646. 





Specifying the halfword-aligned address that an Address breakpoint matches on 


For an Address breakpoint, a debugger can use the Byte Address Selection field, DBGBCR<n>.BAS, so that the 
address comparison is successful on one of: 


° The whole word starting at address DBGBVR<n>[31:2]:00. 
° The halfword starting at address DBGBVR<n>[31:2]:00. 
° The halfword starting at address (DBGBVR<n>[31:2]:00) + 2). 


Note 
The address programmed into the DBGBVR<n> must be word-aligned. 
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DBGBCR<n>.BAS can be used in both Address Match breakpoints and Address Mismatch breakpoints, as follows: 


The fo 


For an Address Match breakpoint, DBGBCR<n>.BAS selects which halfword-aligned address the 
breakpoint must generate a Breakpoint exception for. This means that an address comparison is successful 
only if both of the following match: 


— The instruction address held in bits [31:2] of the DBGBVR<n>. 
— The halfword defined by the BAS field. 


That is, a successful address comparison = DBGBVR<n>[31:2] match AND BAS match. 


For an Address Mismatch breakpoint, DBGBCR<n>.BAS selects which halfword-aligned address the 
breakpoint must not generate a Breakpoint exception for. This means that an address comparison is successful 
if either or both of the following do not match: 


— The instruction address held in bits [31:2] of the DBGBVR<n>. 
— The halfword defined by the BAS field. 


That is, a successful address comparison = NOT (DBGBVR<n>[31:2] match AND BAS match). 
llowing subsections show the supported BAS values: 


Using the BAS field in Address Match breakpoints. 
Using the BAS field in Address Mismatch breakpoints on page G2-5643. 


For Context breakpoints, DBGBCR<n>.BAS is RES1 and is ignored. 


Using the BAS field in Address Match breakpoints 


The supported BAS values are: 


0b0000 


0b0011 


0b1100 
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This value is reserved. Behavior is a CONSTRAINED UNPREDICTABLE choice of: 
° The breakpoint is disabled. 
. The breakpoint behaves as if BAS is 0b0011, 0b1100, or 0b1111. 


The breakpoint generates a Breakpoint exception if an instruction with an address described as 
follows is committed for execution: 


$ Bits [31:2] of the address equals DBGBVR<n>[31:2]. 
° Bits [1:0] of the address are 0b00. 


This means that breakpoints programmed with this BAS value generate Breakpoint exceptions for 
all of the following: 


. 32-bit T32 instructions at word-aligned addresses. 
° 16-bit T32 instructions at word-aligned addresses. 
° A32 instructions. These are always at word-aligned addresses. 


However, Arm recommends that a debugger uses this BAS value only for T32 instructions. 


It is CONSTRAINED UNPREDICTABLE whether a breakpoint programmed with this BAS value 
generates a Breakpoint exception on the second halfword of a 32-bit T32 instruction starting at the 
halfword-aligned address (DBGBVR<n>[31:2]:00) - 2). 


The breakpoint generates a Breakpoint exception if an instruction with an address described as 
follows is committed for execution: 


à Bits [31:2] of the address equals DBGBVR<n>[31:2]. 

a Bits [1:0] of the address are 0b10. 

This means that breakpoints programmed with this BAS value generate Breakpoint exceptions for 
both of the following: 

° 32-bit T32 instructions at addresses that are halfword-aligned but not word-aligned. 

. 16-bit T32 instructions at addresses that are halfword-aligned but not word-aligned. 

It is CONSTRAINED UNPREDICTABLE whether a breakpoint programmed with this BAS value 


generates a Breakpoint exception on the second halfword of a 32-bit T32 or A32 instruction starting 
at a word-aligned address. 
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0b1111 The breakpoint generates a Breakpoint exception if an instruction with an address described as 
follows is committed for execution: 


. Bits [31:2] of the address equals DBGBVR<n>[31:2]. 
° Bits [1:0] of the address are 0b00. 


This means that breakpoints programmed with this BAS value generate Breakpoint exceptions for 
all of the following: 


. 32-bit T32 instructions at word-aligned addresses. 
. 16-bit T32 instructions at word-aligned addresses. 
. A32 instructions. These are always at word-aligned addresses. 


However, Arm recommends that a debugger uses this BAS value only for A32 instructions. 


It is CONSTRAINED UNPREDICTABLE whether a breakpoint programmed with this BAS value 
generates a Breakpoint exception on the second halfword of a 32-bit T32 instruction starting at the 
halfword-aligned address (DBGBVR<n>[31:2]:00) - 2). 


It is CONSTRAINED UNPREDICTABLE whether a breakpoint programmed with this BAS value 
generates a Breakpoint exception on a 32-bit T32 instruction or a 16-bit T32 instruction at the 
halfword-aligned address (DBGBVR<n>[31:2]:00) + 2). 


All other BAS values are reserved. For these reserved other values, DBGBCR<n>.BAS[3,1] ignore writes and read 
the same values as DBGBCR<n>[2,0] respectively. This means that the smallest instruction size a debugger can 
program breakpoints to match on is a halfword. 


Figure G2-2 on page G2-5643 shows a summary of when breakpoints programmed with particular BAS values 
generate Breakpoint exceptions. 


The figure contains four parts: 


s A column showing the row number, on the left. 
è An instruction set and instruction size table. 
7 A location of instruction figure. 


: A BAS field values table, on the right. 
To use the figure, read across the rows. For example: 


s Row 2 shows that a breakpoint with a BAS value of 0b1100 generates Breakpoint exceptions for 16-bit T32 
instructions starting at the halfword-aligned address (DBGBVR<n>[31:2]:00) + 2). 


. Row 6 shows that a breakpoint with a BAS value of either 0b0011 or 0b1111 generates Breakpoint exceptions 
for A32 instructions. A32 instructions are always at word-aligned addresses. 


In the figure: 
Yes Means that the breakpoint generates a Breakpoint exception. 
No Means that the breakpoint does not generate a Breakpoint exception. 
UNP Means that it is CONSTRAINED UNPREDICTABLE whether the breakpoint generates a Breakpoint 
exception. See Other usage constraints for Address breakpoints on page G2-5650. 
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Location of instruction? BAS[3:0] 
Instruction set Size -2 -1 0 +1 +2 +3 +4 +5 0b0011 0b1100 0b1111 
Row 1 T32 16-bit Yes No Yes 
Row 2 16-bit No Yes UNP 
Row 3 T32 32-bit UNP No UNP 
Row 4 32-bit Yes UNP Yes 
Row 5 32-bit No Yes UNP 
Row 6 A32 32-bit Yes UNP Yes 




















a. 0 means the word-aligned address held in the DBGBVRn. The other locations 
are as follows: 
-2 means ((DBGBVRn[31:2]:00) - 2). 
-1 means ((DBGBVRn[31:2]:00) - 1). 


+5 means ((DBGBVRn[31:2]:00) + 5). 


The solid areas show the location of the instruction. 


Figure G2-2 Summary of BAS field meanings for Address Match breakpoints 


Using the BAS field in Address Mismatch breakpoints 


An Address Mismatch breakpoint generates Breakpoint exceptions for all instructions committed for execution, 
except the instruction whose address the breakpoint is programmed to match. 


The supported BAS values are: 


0b0000 


0b0011 


0b1100 
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The breakpoint ignores the address held in the DBGBVR<n> and generates Breakpoint exceptions 
for all instruction addresses. 


The breakpoint does not generate a Breakpoint exception if an instruction with an address described 
as follows is committed for execution: 


: Bits [31:2] of the address equals DBGBVR<n>[31:2]. 
° Bits [1:0] of the address are @b00. 


This means that breakpoints programmed with this BAS value do not generate Breakpoint 
exceptions for any of the following: 


° 32-bit T32 instructions at word-aligned addresses. 
° 16-bit T32 instructions at word-aligned addresses. 
° A32 instructions. These are always at word-aligned addresses. 


However, Arm recommends that a debugger uses this BAS value only for T32 instructions. 


It is CONSTRAINED UNPREDICTABLE whether a breakpoint programmed with this BAS value does 
not generate a Breakpoint exception on the second halfword of a 32-bit T32 instruction starting at 
the halfword-aligned address ((DBGBVR<n>[31:2]:00) - 2). 


The breakpoint does not generate a Breakpoint exception if an instruction with an address described 
as follows is committed for execution: 


è Bits [31:2] equals DBGBVR<n>[31:2]. 
° Bits [1:0] of the address are 0b10. 


This means that breakpoints programmed with this BAS value do not generate Breakpoint 
exceptions for either of the following: 


° 32-bit T32 instructions at addresses that are halfword-aligned but not word-aligned. 
. 16-bit T32 instructions at addresses that are halfword-aligned but not word-aligned. 
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It is CONSTRAINED UNPREDICTABLE whether a breakpoint programmed with this BAS value does 
not generate a Breakpoint exception on the second halfword of a 32-bit T32 or A32 instruction at a 
word-aligned address. 


0b1111 The breakpoint does not generate a Breakpoint exception if an instruction with an address described 
as follows is committed for execution: 


: Bits [31:2] of the address equals DBGBVR<n>[31:2]. 
° Bits [1:0] of the address are 0b00. 


This means that breakpoints programmed with this BAS value do not generate Breakpoint 
exceptions for any of the following: 


° 32-bit T32 instructions at word-aligned addresses. 
. 16-bit T32 instructions at word-aligned addresses. 
° A32 instructions. These are always at word-aligned addresses. 


However, Arm recommends that a debugger uses this BAS value only for A32 instructions. 


It is CONSTRAINED UNPREDICTABLE whether a breakpoint programmed with this BAS value does 
not generate a Breakpoint exception on the second halfword of a 32-bit T32 instruction starting at 
the halfword-aligned address ((DBGBVR<n>[31:2]:00) - 2). 


It is CONSTRAINED UNPREDICTABLE whether a breakpoint programmed with this BAS value does 
not generate a Breakpoint exception on a 32-bit T32 instruction or a 16-bit T32 instruction at the 
halfword-aligned address (DBGBVR<n>[31:2]:00) + 2). 


All other BAS values are reserved. For these reserved other values, DBGBCR<n>.BAS[3,1] ignore writes and read 
the same values as DBGBCR<n>[2,0] respectively. This means that the smallest instruction size that a breakpoint 
can never generate a Breakpoint exception for is a halfword. 


Figure G2-3 on page G2-5645 shows a summary of when breakpoints programmed with particular BAS values 
generate Breakpoint exceptions. 


The figure contains four parts: 


° A column showing the row number, on the left. 
° An instruction set and instruction size table. 
à A location of instruction figure. 


a A BAS field values table, on the right. 
To use the figure, read across the rows. For example: 


a Row 1 shows that a breakpoint with a BAS value of 0b1100 generates Breakpoint exceptions for 16-bit T32 
instructions starting at the word-aligned address held in the DBGBVR<n>. 


è Row 5 shows that a breakpoint with a BAS value of 0b0011 generates Breakpoint exceptions for 32-bit T32 
instructions starting at the halfword-aligned address immediately after the word aligned address held in the 


DBGBVR<n>. 
In the figure: 
Yes Means that the breakpoint does generate a Breakpoint exception. 
No Means that the breakpoint does not generate a Breakpoint exception. 
UNP Means that is it CONSTRAINED UNPREDICTABLE whether the breakpoint generates a Breakpoint 


exception. See Other usage constraints for Address breakpoints on page G2-5650. 
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Location of instruction? BAS[3:0] 
Instruction set Size -2 -1 0 +1 +2 +3 +4 +5 Ob0000 0b0011 0b1100 0b1111 
Row 1 T32 16-bit Yes No Yes No 
Row 2 16-bit Yes Yes No UNP 
Row 3 T32 32-bit Yes UNP Yes UNP 
Row 4 32-bit Yes No UNP No 
Row 5 32-bit Yes Yes No UNP 
Row 6 A32 32-bit Yes No UNP No 


























a. 0 means the word-aligned address held in the DBGBVRn. The other locations are as follows: 
-2 means ((DBGBVRn[31:2]:00) - 2). 
-1 means ((DBGBVRn[31:2]:00) - 1). 


+5 means ((DBGBVRn[31:2]:00) + 5). 


The solid areas show the location of the instruction. 


Figure G2-3 Summary of BAS field meanings for Address Mismatch breakpoints 


Breakpoint context comparisons 


The breakpoint type defined by DBGBCR<n>.BT determines what context comparison is required, if any. 
Table G2-11 shows the BT values that require a comparison, and the match required for the comparison to be 


successful. 


Table G2-11 Breakpoint Context ID and VMID comparison tests 





DBGBCR<n>.BT 


Test required for successful context comparison 























0b001x a When ARMv8.1-VHE is implemented, EL2 is using AArch64, the Effective value of HCR_EL2.E2H 
is 1, and either the PE is executing at ELO with HCR_EL2.TGE set to 1, or the PE is executing at EL2, 
CONTEXTIDR_EL2 must match the DBGBVR<n>. ContextID value. 
. Otherwise, CONTEXTIDR must match the DBGBVR<n>.ContextID value. 
0b011x CONTEXTIDR, or CONTEXTIDR_EL1, must match the DBGBVR<n>.ContextID value. 
0b100x VTTBR.VMID must match the DBGBXVR<n>.VMID value. 
Ob101x CONTEXTIDR, or CONTEXTIDR_EL1, must match the DBGBVR<n>.ContextID value, and VTTBR.VMID 
must match the DBGBXVR<n>.VMID value. 
0b110x CONTEXTIDR_EL2 must match the DBGBXVR<n>.ContextID2 value. 
Qb111x Both: 


. CONTEXTIDR, or CONTEXTIDR_EL1, must match the DBGBVR<n>.ContextID value. 


à CONTEXTIDR_EL2 must match the DBGBXVR<n>.ContextID2 value. 
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No context comparison is required for other valid DBGBCR<n>.BT values. 


Context breakpoints do not generate Breakpoint exceptions when any of: 


è The comparison uses the value of CONTEXTIDR, or CONTEXTIDR_EL1, and any of: 


— The PE is executing at EL3 using AArch64. 
— The PE is executing at EL2. 


—  ARMv8.1-VHE is implemented, EL2 is using AArch64, EL2 is implemented and enabled in the 
current Security state, and HCR_EL2.{E2H, TGE} == {1, 1}. 


G The comparison uses the value of CONTEXTIDR_EL2 and any of: 
—  ARMv8.1-VHE is not implemented. 
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EL2 is either not implemented or not enabled in the current Security state. 
EL2 is using AArch32. 


° The comparison uses the current VMID value and any of: 


EL2 is not implemented. 
EL2 is either not implemented or not enabled in the current Security state. 
The PE is executing at EL2. 


ARMv8.1-VHE is implemented, EL2 is using AArch64, EL2 is implemented and enabled in the 
current Security state, and HCR_EL2.{E2H, TGE} == {1, 1}. 


Note 





. For all Context breakpoints, DBGBCR<n>.BAS is RES1 and is ignored. 
. For Linked Context breakpoints, DBGBCR<n>.{LBN, SSC, HMC, PMC} are RESO and are ignored. 





Using breakpoints 


This section contains the following: 


è Using an Address Mismatch breakpoint to single-step an instruction. 
. ITD control effects on address breakpoints on the first instruction in an IT block on page G2-5647. 
° Breakpoint usage constraints on page G2-5648. 


Using an Address Mismatch breakpoint to single-step an instruction 


In execution conditions that an Address Mismatch breakpoint matches, defined by DBGBCR<n>.{LBN, SSC, 
PMC}, the breakpoint generates Breakpoint exceptions for all instructions committed for execution, except the 
instruction whose address the breakpoint is programmed with. Figure G2-4 shows an example of Address Mismatch 
breakpoint operation, for an Address Mismatch breakpoint programmed with address 0x1014. 


Program 9x100C 





Instruction 
addresses 


0x1000 
0x1004 
0x1008 > The breakpoint generates a Breakpoint exception for all of these instructions 


0x1010 _ 
0x1014  <—— The breakpoint does not generate a Breakpoint exception 


0x1018 \ 
0x101C > The breakpoint generates a Breakpoint exception for all of these instructions 
0x1020 


LY 


All executed in execution conditions that the breakpoint matches 





Figure G2-4 Operation of an Address Mismatch breakpoint 


This means that an Address Mismatch breakpoint can be used to single-step an instruction. 


In the example shown in Figure G2-4: 


e If the target of a branch is an instruction other than the instruction at address 0x1014, the breakpoint generates 
a Breakpoint exception when the instruction is committed for execution. 


s If the target of a branch is the instruction at address 0x1014, the PE executes the instruction at 0x1014 and the 
breakpoint does not generate a Breakpoint exception until the instruction at address 0x1018 is committed for 
execution. The instruction at address 0x1014 is therefore single-stepped. 
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However, if the instruction at 0x1014 generates a synchronous exception, or if the PE takes an asynchronous 
exception while the instruction is being stepped, the breakpoint is evaluated again after taking the exception. 
This means that behavior is as follows: 


— Ifthe exception handler executes in execution conditions that the breakpoint matches, the breakpoint 
generates a Breakpoint exception for the exception vector, because the exception vector is not address 
0x1014. This means that software execution steps into the exception. 


— Ifthe exception handler executes in execution conditions that the breakpoint does not match, the 
breakpoint does not generate any Breakpoint exceptions after the PE has taken the exception, until the 
exception handler completes and executes an exception return instruction. The effect is to step over 
the exception. Whether the instruction is stepped again depends on whether the target of the exception 
return instruction is the instruction at 0x1014 or the instruction at 0x1018. 


If the instruction at 0x1014 is single-stepped and branches to itself, it is CONSTRAINED UNPREDICTABLE 
whether the breakpoint generates a Breakpoint exception after the PE has executed the branch. 


This means that an instruction is only single-stepped if it is the target of a branch instruction and its address matches 
the address the breakpoint is programmed for. In the example shown in Figure G2-4 on page G2-5646, this is 0x1014. 


Usually this branch instruction is an exception return instruction that changes PE mode, branching from a PE mode 
in which the breakpoint does not generate a Breakpoint exception. A branch instruction that does not change PE 
mode would itself generate a Breakpoint exception. However, it might be a branch-to-self instruction as described 
above. 


Because Address Mismatch breakpoints can single-step instructions, the behavior of an address mismatch 
Breakpoint exception is similar to the behavior of an AArch64 Software Step exception. 


Note 


: The example shown in Figure G2-4 on page G2-5646 assumes an A32 instruction. The same behavior applies 
for both 32-bit and 16-bit T32 instructions. 





7 Software Step exceptions are the highest priority synchronous exception. Breakpoint exceptions are lower 
priority. See Synchronous exception prioritization for exceptions taken to AArch64 state on page D1-2308. 





ITD control effects on address breakpoints on the first instruction in an IT block 


In an implementation that supports the ITD control, if the value of the ITD field that applies to the current Exception 
level is 1, all of the following are true: 


° An IT instruction can only be used to apply to one 16-bit T32 instruction. 
7 Only certain combinations of an IT instruction and second single 16-bit T32 instruction are permitted. 
s For a permitted combination, it is IMPLEMENTATION DEFINED whether the implementation treats the 


combination as: 
— A pair of 16-bit instructions. 
— One 32-bit instruction. 


If the implementation treats the combination as one 32-bit instruction, then as described in Other usage constraints 


for Address breakpoints on page G2-5650, an Address breakpoint might not generate a Breakpoint exception for an 


address match only on the second halfword of the instruction. 


For this reason, if the ITD bit associated with the current Exception level is 1, Arm recommends that a debugger 
that wants to program a breakpoint to match on the second T32 instruction programs it to match on the IT instruction 
instead. 


However, if returning from an exception whose preferred return address is the address of the second T32 instruction, 
then because the debugger is aware that the implementation has treated the combination as a pair of 16-bit 
instructions, the debugger is permitted to program the breakpoint to match on the second T32 instruction. 


The ITD control fields are: 
HSCTLR.ITD Applies to execution at EL2 when EL2 is using AArch32. 
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SCTLR.ITD Applies to execution at ELO or EL1 when EL! is using AArch32. 
SCTLR_EL1.ITD 
Applies to execution at ELO using AArch32 when EL] is using AArch64. 


An implementation that does not support the ITD control behaves as if the value of the ITD field is 0, and therefore 
the information in this section does not apply to such an implementation. 


Note 


Programming the breakpoint to match on the second T32 instruction might be necessary when using an Address 
Mismatch breakpoint for single stepping. 








Breakpoint usage constraints 


See the following sections: 

: Reserved DBGBCR<n>.BT values. 

$ Reserved DBGBCR<n>.{SSC, HMC, PMC} values on page G2-5649. 
° Reserved DBGBCR<n>.BAS values on page G2-5649. 

. Reserved DBGBCR<n>.LBN values on page G2-5650. 

° Other usage constraints for Address breakpoints on page G2-5650. 

è Other usage constraints for Context breakpoints on page G2-5650. 


Reserved DBGBCR<n>.BT values 


Table G2-12 shows when particular DBGBCR<n>.BT values are reserved. 


Table G2-12 Reserved BT values 























BT value Breakpoint type Reserved 

0b001x Context ID Match If the breakpoint is not context-aware 

0b010x Address Mismatch If EDSCR.HDE is 1 and halting is allowed 

0b011x CONTEXTIDR_EL1 Match If ARMv8.1-VHE is not implemented, or the breakpoint is not context-aware 
0b100x VMID Match If EL2 is not implemented, or the breakpoint is not context-aware 

0b101x Context ID and VMID Match 

0b110x CONTEXTIDR_EL2 Match If ARMv8.1-VHE is not implemented, or the breakpoint is not context-aware 
0b111x Full Context ID Match Note 


For these BT values, breakpoints are not generated if EL2 is using AArch32. 








G2-5648 


If a breakpoint is programmed with one of these reserved BT values: 


s The breakpoint must behave as if it is either: 
— Disabled. 
— Programmed with a BT value that is not reserved, other than for a direct or external read of 
DBGBCR<n>. 
° For a direct or external read of DBGBCR<n>, if the reserved BT value: 


— Has no function for any execution conditions, the value read back is UNKNOWN. 


— Hasa function for execution conditions other than the current execution conditions, the value read 
back is the value written. This permits software to save and restore the BT value so that the breakpoint 
functions for the other execution conditions. 
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The behavior of breakpoints with reserved BT values might change in future revisions of the architecture. For this 
reason, software must not rely on the behavior described here. 


Reserved DBGBCR<n>.{SSC, HMC, PMC} values 


Table G2-13 shows when particular combinations of DBGBCR<n>. {SSC, HMC, PMC} are reserved in stage 1 of 
an AArch32 translation regime. 


Table G2-13 Reserved HMC, SSC, and PMC combinations 





HMC, SSC, and PMC combination Reserved 





All combinations with SSC set to @b01 or 0b10, except for the combination When EL3 is not implemented and EL2 is implemented. 
with HMC set to 1, SSC set to 0b01 and PMC set to 0b00 





Any combination where HMC or SSC is nonzero When both of EL2 and EL3 are not implemented 





The combination with HMC set to 1, SSC set to @b11, and PMC set to @b00 When EL2 is not implemented 





The combinations with SSC set to 0b11 and PMC set to 0b01 or @b1 When Secure EL2 is not implemented 





The combination with HMC set to 1, SSC set to @b01 and PMC set to @b00 When Secure EL2 is not implemented 





Combinations not included in Table G2-10 on page G2-5638 Always 
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For all breakpoints except Linked Context breakpoints, if a breakpoint is programmed with one of these reserved 
combinations: 
° If the reserved combination has a function for other execution conditions: 

— The breakpoint must behave as if it is disabled. 

— A direct or external read of DBGBCR<n>.{SSC, HMC, PMC} returns the values written. This means 
that software can save and restore the combination so that the breakpoint can function for the other 
execution conditions. 

e If the reserved combination does not have a function for other execution conditions: 


— _ It must behave either as if it is programmed with a combination that is not reserved or as if it is 
disabled. 


— A direct or external read of DBGBCR<n>. {SSC, HMC, PMC} returns UNKNOWN values. 
If the breakpoint is a Linked Context breakpoint, then: 


. The values of HMC, SSC, and PMC are ignored. 
° A direct or external read of DBGBCR<n>. {SSC, HMC, PMC} returns UNKNOWN values 


The behavior of breakpoints with reserved combinations of HMC, SSC, and PMC might change in future revisions 
of the architecture. For this reason, software must not rely on the behavior described here. 


Reserved DBGBCR<n>.BAS values 


For all Context breakpoints 
DBGBCR<n>.BAS is RES1 and is ignored. 


For all Address breakpoints 


The supported values of the BAS field for the Address Match and Address Mismatch breakpoints 
are shown in Specifying the halfword-aligned address that an Address breakpoint matches on on 
page G2-5640. 


If a breakpoint is programmed with a reserved BAS value: 


è The breakpoint must behave as if it is either: 
— Disabled. 
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— Programmed with a BAS value that is not reserved, other than for a direct or external read of 
DBGBCR<n>. 


. A direct or external read of DBGBCR<n>.BAS returns an UNKNOWN value. 


Software must not rely on these properties as the behavior of reserved values might change in a future revision of 
the architecture. 


Reserved DBGBCR<n>.LBN values 


For all Context breakpoints 


DBGBCR<n>.LBN reads UNKNOWN and its value is ignored. 


For Linked Address breakpoints 


A Linked Address breakpoint must link to a context-aware breakpoint. For a Linked Address 
breakpoint, any DBGBCR<n>.LBN value that is not for a context-aware breakpoint is reserved. 


If a Linked Address breakpoint links to a breakpoint that is not implemented, or that is not 
context-aware, then reads of DBGBCR<n>.LBN return an unknown value and the behavior is 
CONSTRAINED UNPREDICTABLE. The Linked Address breakpoint behaves as if it is either: 


° Disabled. 
s Linked to an UNKNOWN context-aware breakpoint. 
If a Linked Address breakpoint that links to a breakpoint that is implemented and that is 


context-aware, but that is either not enabled or not programmed as a Linked Context breakpoint, it 
behaves as if it is disabled. 


For Unlinked Address breakpoints 
DBGBCR<n>.LBN reads UNKNOWN and its value is ignored. 


Other usage constraints for Address breakpoints 


For all Address breakpoints 
. DBGBVR<n>[1:0] are RESO and are ignored. 
° The DBGBXVR<n> is ignored. 


For Address Match breakpoints 

° For 32-bit instructions, if a breakpoint matches on the address of the second halfword but not 
the address of the first halfword, it is CONSTRAINED UNPREDICTABLE whether the breakpoint 
generates a Breakpoint exception. 

, If DBGBCR<n>.BAS is 0b1111, it is CONSTRAINED UNPREDICTABLE whether the breakpoint 
generates a Breakpoint exception for a T32 instruction starting at address 
((DBGBVR<n>[31:2]:00) + 2). For T32 instructions, Arm recommends that the debugger 
programs the BAS field with either 0b0011 or 0b1100. 


For Address Mismatch breakpoints 


The constraints are the same as those described in For Address Match breakpoints, except that if 
two Address Mismatch breakpoints are programmed to match in the same Exception level and 
Security state, it is CONSTRAINED UNPREDICTABLE whether or not the instruction is stepped or a 
Breakpoint debug even is generated. 


Other usage constraints for Context breakpoints 


For all Context breakpoints 


Any bits of DBGBVR<n> and DBGBXVR<n> that are not used to specify Context ID or VMID 
are RESO and are ignored. 
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Note 


This means that for Context ID Match breakpoints, the DBGBXVR<n> is RESO and is ignored, and 
for VMID Match breakpoints, the DBGBVR<n> is RESO and is ignored. 





For Linked Context breakpoints 


If no Linked Address breakpoints or Linked Watchpoints link to a Linked Context breakpoint, the 
Linked Context breakpoint does not generate any Breakpoint exceptions. 


ption syndrome information and preferred return address for a Breakpoint exception 


See the following: 
. Exception syndrome information for a Breakpoint exception. 
. Preferred return address for a Breakpoint exception on page G2-5652. 


Note 


Usually, the term exception syndrome is used only for exceptions taken to Hyp mode, or to AArch64 state. The 
referenced section uses the term more generally, to include exception information reported in the IFSR. 








Exception syndrome information for a Breakpoint exception 
The PE takes a Breakpoint exception as either: 
$ A Prefetch Abort exception if it is taken to PL1. In this case, it is taken to Abort mode. 


° A Hyp trap exception, if it is taken to PL2 because HCR.TGE or HDCR.TDE is 1. In this case, it is taken to 
Hyp mode. 


If the exception is taken to: 


Abort mode 
The PE sets all of the following: 
° DBGDSCRext.MOE to 0b0001, to indicate a Breakpoint exception. 
. IFSR.FS to the code for a debug exception, 0b00010. 
. The IFAR with an UNKNOWN value. 
Hyp mode 
The PE does all of the following: 
$ Records information about the exception in the Hypervisor Syndrome Register, HSR. See 
Table G2-14. 


à Sets DBGDSCRext.MOE to 0b0001, to indicate a Breakpoint exception. 
è Sets the HIFAR to an unknown value. 


Table G2-14 Information recorded in the HSR 


Information recorded 





Exception Class, EC 


The PE sets this to the code for a Prefetch Abort exception routed to Hyp mode, 0x20. 





Instruction Length, I 


L The PE sets this to 1. 





Instruction Specific Syndrome, ISS. YSS[24:10] RESO. 


ISS[9] External Abort type (EA). The PE sets this to 0. 
ISS[8:6] RESO. 


ISS[5:0] Instruction Fault Status Code (IFSC). The PE sets this to the code for a debug 
exception, 0b100010. 
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Note 


For information about how debug exceptions can be routed to PL2, see Routing debug exceptions 
on page G2-5617. 





Preferred return address for a Breakpoint exception 


The preferred return address of a Breakpoint exception is the address of the instruction that was not executed 
because the PE took the Breakpoint exception instead. 


This means that the preferred return address is the address of the instruction that caused the exception. 


Pseudocode description of Breakpoint exceptions taken from AArch32 state 


AArch32.BreakpointValueMatch() returns a pair of results: 
° A result for Address Match and Context breakpoints. 
° A result for Address Mismatch breakpoints. 


AArch32.StateMatch() tests the values in DBGBCR<n>. {SSC, HMC, PMC} and, if the breakpoint links to a Linked 
Context breakpoint, also tests the Linked Context breakpoint. 


AArch32.BreakpointMatch() tests a committed instruction against all breakpoints. 
AArch32.CheckBreakpoint() generates a FaultRecord. A Breakpoint exception is taken if all of the following are true: 
7 DBGDSCRext.MDBGen is 1. 


° Debug exceptions are enabled from the current Exception level and Security state. See Enabling debug 
exceptions from the current Privilege level and Security state on page G2-5619. 


$ All of the conditions required for Breakpoint exception generation are met. See About Breakpoint exceptions 
on page G2-5628. 





Note 
AArch32.CheckBreakpoint() might halt the PE and cause it to enter Debug state. External debug uses Debug state. 





The AArch32.Abort() function processes the FaultRecord object returned by AArch32.CheckBreakpoint(), as 
described in Abort exceptions on page G4-5717. When a Breakpoint exception is taken to AArch32 state, the 
AArch32.Abort() function generates a Prefetch Abort exception. 
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G2.10 Watchpoint exceptions 


This section describes Watchpoint exceptions in stage 1 of an AArch32 translation regime. 


The PE is using an AArch32 translation regime when it is executing either: 
è At EL1 or higher in an Exception level that is using AArch32. 
$ At ELO using AArch32 when EL1 is using AArch32. 


This section contains the following subsections: 


. About Watchpoint exceptions. 

i Watchpoint types and linking of watchpoints on page G2-5654. 

. Execution conditions for which a watchpoint generates Watchpoint exceptions on page G2-5655. 
. Watchpoint data address comparisons on page G2-5657. 

. Determining the memory location that caused a Watchpoint exception on page G2-5660. 

s Watchpoint behavior on other instructions on page G2-5661. 


7 Usage constraints on page G2-5662. 
. Exception syndrome information and preferred return address on page G2-5664. 
. Pseudocode description of Watchpoint exceptions taken from AArch32 state on page G2-5665. 


G2.10.1 About Watchpoint exceptions 
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A watchpoint is an event that results from the execution of an instruction, based on a data address. Watchpoints are 
also known as data breakpoints. 


A watchpoint operates as follows: 


1. A debugger programs the watchpoint with a data address, or a data address range. 
2. The watchpoint generates a Watchpoint debug event on an access to the address, or any address in the address 
range. 


A watchpoint never generates a Watchpoint debug event on an instruction fetch. 


An implementation can include between 2-16 watchpoints. In an implementation, DBGDIDR.WRPs shows how 
many are implemented. 


To use an implemented watchpoint, a debugger programs the following registers for the watchpoint: 


od The Watchpoint Control Register, DBGWCR<n>. This holds control information for the watchpoint, for 
example an enable control. 


° The Watchpoint Value Register, DBGWVR<n>. This holds the data virtual address used for watchpoint 
matching. 


The registers are numbered, so that: 
e DBGWCR1 and DBGWVR1 are for watchpoint number one. 
è DBGWCR2 and DBGWVR2 are for watchpoint number two. 


7 DBGWCRn and DBGWVRn are for watchpoint number n. 
A watchpoint can: 


° Be programmed to generate Watchpoint debug events on read accesses only, on write accesses only, or on 
both types of access. 


s Link to a Linked Context breakpoint, so that a Watchpoint debug event is only generated if the PE is in a 
particular context when the address match occurs. 
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A single watchpoint can be programmed to match on one or more address bytes. A watchpoint generates a 
Watchpoint debug event on an access to any byte that it is watching. The number of bytes a watchpoint is watching 
is either: 


s One to eight bytes, provided that these bytes are contiguous and that they are all in the same naturally-aligned 
doubleword. A debugger uses the Byte Address Select field, DBGWCR<n>.BAS, to select the bytes. See 
Programming a watchpoint with eight bytes or fewer on page G2-5658. 


7 Eight bytes to 2GB, provided that both of the following are true: 
— The number of bytes is a power-of-two. 
— The range starts at an address that is aligned to the range size. 


A debugger uses the MASK field, DBGWCR<n>.MASK, to program a watchpoint with eight bytes to 2GB. 
See Programming a watchpoint with eight or more bytes on page G2-5659. 


A debugger must use either the BAS field or the MASK field. If it uses both, whether the watchpoint generates 
Watchpoint exceptions is CONSTRAINED UNPREDICTABLE. See Programming dependencies of the BAS and MASK 


fields on page G2-5663. 


For each memory access, all of the watchpoints are tested. When a watchpoint is tested, it generates a Watchpoint 
debug event if all of the following are true: 


s The watchpoint is enabled. That is, the watchpoint enable control for it, DBGWCR<n>.E, is 1. 
è The conditions specified in the DBGWCR<n> are met. 
° The comparison with the address held in the DBGWVR<n> is successful. 


° If the watchpoint links to a Linked Context breakpoint, the comparison or comparisons made by the Linked 
Context breakpoint are successful. See on page G2-5631 shows this. See also Breakpoint context 
comparisons on page G2-5645. 


7 The instruction that initiates the memory access is committed for execution. 
° The instruction that initiates the memory access passes its Condition code check. 
If halting is allowed and EDSCR.HDE is 1, Watchpoint debug events cause entry to Debug state. 


Otherwise, if debug exceptions are: 


: Enabled, Watchpoint debug events generate Watchpoint exceptions. 
° Disabled, Watchpoint debug events are ignored. 
Note 





The remainder of this Watchpoint Exceptions section, including all subsections, describes watchpoints as generating 
Watchpoint exceptions. However, the behavior described also applies if watchpoints are causing entry to Debug 
state. 





The debug exception enable controls on page G2-5616 describes the enable controls for Watchpoint debug events. 


Watchpoint types and linking of watchpoints 


When a debugger programs a watchpoint, it must program that watchpoint so that it is either: 
$ Used in isolation. In this case, the watchpoint is called an Unlinked watchpoint. 
5 Enabled for linking to a Linked Context breakpoint. In this case, the watchpoint is called a Linked watchpoint. 


When a Linked watchpoint links to a Linked Context breakpoint, the Linked watchpoint only generates a 
Watchpoint exception if the PE is in a particular context when the data address match occurs. For example, a 
debugger might: 


1. Program watchpoint number one with a data address. 


2. Program breakpoint number five to be a Linked VMID Match breakpoint. 
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3. Link the watchpoint and the breakpoint together. A Watchpoint exception is only generated if both the data 
address matches and the VMID matches. 


The Watchpoint Type field for a watchpoint, DBGWCR<n>.WT, controls whether the watchpoint is enabled for 
linking. If DBGWCR<n>.WT is 1, the watchpoint is enabled for linking. 


Rules for linking watchpoints 
The rules for watchpoint linking are as follows: 
7 Only Linked watchpoints can be linked. 


a A Linked watchpoint can link to any type of Linked Context breakpoint. The Linked Breakpoint Number 
field, DBGWCR<n>.LBN, for the Linked watchpoint specifies the particular Linked Context breakpoint that 
the Linked watchpoint links to, and: 


— DBGWCR<n>. WT. {SSC, HMC, PAC} for the Linked watchpoint define the execution conditions that 
the watchpoint generates Watchpoint exceptions for. See Execution conditions for which a watchpoint 
generates Watchpoint exceptions. 


—  DBGBCR<n>.{SSC, HMC, PMC} for the Linked Context breakpoint are ignored. 


s A Linked watchpoint cannot link to another watchpoint. The LBN field can therefore only specify a 
breakpoint. 


7 Ifa Linked watchpoint links to a breakpoint that is not context-aware, the behavior of the Linked watchpoint 
is CONSTRAINED UNPREDICTABLE. See Usage constraints on page G2-5662. 


è Ifa Linked watchpoint links to an Unlinked Context breakpoint, the Linked watchpoint never generates any 
Watchpoint exceptions. 


: Multiple Linked watchpoints can link to a single Linked Context breakpoint. 


Note 


Multiple Address breakpoints can also link to a single Linked Context breakpoint. Breakpoint exceptions on 
page G2-5628 describes breakpoints. 








Figure G2-1 on page G2-5631 shows an example of permitted watchpoint linking. 


G2.10.3 Execution conditions for which a watchpoint generates Watchpoint exceptions 


Each watchpoint can be programmed so that it only generates Watchpoint exceptions for certain execution 
conditions. For example, a watchpoint might be programmed to generate Watchpoint exceptions only when the PE 
is executing at EL2. 


DBGWCR<n>. {SSC, HMC, PAC} define the execution conditions a watchpoint generates Watchpoint exceptions 
for, as follows: 
Security State Control, SSC 
Controls whether the watchpoint generates Watchpoint exceptions only in Secure state, only in 
Non-secure state, or in both Security states. 
Note 


This is determined by the Security state of the PE, not from the NS attribute returned by the 
translation of the virtual address on which the watchpoint is set. 








Higher Mode Control, HMC, and Privileged Access Control, PAC 


HMC and PAC together control which Privilege level the watchpoint generates Watchpoint 
exceptions in. 


The PAC control relates to the privilege of the memory access, not to the Exception level or 
Privilege level at which the access was made. 
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Note 


This means that, if the PE executes a Load unprivileged or Store unprivileged instruction at PL1, 
the resulting data access triggers a watchpoint only if both: 





s PAC is programmed to a value that generates watchpoints on PLO accesses. 
: All other conditions for generating the watchpoint are met. 


Example A32/T32 Load unprivileged and Store unprivileged instructions are LDRT and STRT. 





Table G2-15 shows the valid combinations of HMC, SSC, and PAC, and for each combination shows which 
Privilege levels watchpoints generate Watchpoint exceptions in. 


In the table: 


































































































Y or - Means that a watchpoint programmed with the values of HMC, SSC, and PAC shown in that row: 
Y Can generate Watchpoint exceptions at that Privilege level. 
- Cannot generate Watchpoint exceptions at that Privilege level. 
Res Means that the combination of HMC, SSC, and PAC is reserved. See Reserved 
DBGWCR<n>.{SSC, HMC, PAC} values on page G2-5662. 
Table G2-15 Summary of watchpoint HMC, SSC, and PAC encodings 

Security state the watchpoint implementation 

HMO: “SSC LRAG is programmed to match in Pee PLI: PLO 

No EL3 No EL2 and no EL3 

0 00 01 Both - Y - - = 

0 00 10 - - - - 

0 00 11 7 Y z = 

0 01 01 Non-secure - Y - Res Res 

0 01 10 - - Res Res 

0 01 11 - Y Res Res 

0 10 01 Secure - Y - Res Res 

0 10 10 - - Res Res 

0 10 11 - Y Y Res Res 

0 11 01 Secure Y Y - - Res 

0 11 11 Y Y Y - Res 

1 00 01 Both Y Y - - Res 

1 00 11 Y Y Y - Res 

1 01 00 Non-secure Y - - 

1 01 01 Y Y - Res Res 

1 01 11 Y Y Y Res Res 

1 10 01 Secure - Y - Res Res 

1 10 11 - Y Y Res Res 
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Table G2-15 Summary of watchpoint HMC, SSC, and PAC encodings (continued) 





HMC SSC PAC 


Security state the watchpoint Implementation 


is programmed to match in PL2a PL1 PLO 


No EL3 No EL2 and no EL3 

















1 11 00 Both Y - - - Res if no EL2> 
1 11 01 Y Y - 
1 11 11 Y Y Y 











a. Debug exceptions are not generated at PL2 using AArch32. This means that these combinations of HMC, SSC, and PAC are only 
relevant if watchpoints cause entry to Debug state. Self-hosted debuggers must avoid combinations of HMC, SSC, and PAC that 
generate Watchpoint exceptions at PL2 using AArch32. 


b. This encoding is only reserved when EL2 is not implemented, regardless of whether EL3 is implemented. 


All combinations of HMC, SSC, and PAC that this table does not show are reserved. See Reserved 
DBGWCR<n>.{SSC, HMC, PAC} values on page G2-5662. 


G2.10.4 Watchpoint data address comparisons 
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An address comparison is successful if bits [31:2] of the current data virtual address are equal to 
DBGWVR<n>[31:2], taking into account all of the following: 


e The size of the access. See Size of the data access. 


° The bytes selected by DBGWVR<n>.BAS. See Programming a watchpoint with eight bytes or fewer on 
page G2-5658. 


- Any address ranges indicated by DBGWVR<n>.MASK. See Programming a watchpoint with eight or more 
bytes on page G2-5659. 


Note 
DBGWVR<n>[1:0] are RESO and are ignored. 








Size of the data access 
Because watchpoints can be programmed to generate Watchpoint exceptions on individual bytes, the size of each 


access must be taken into account. See Example G2-1. 


Example G2-1 


l. A debugger programs a watchpoint to generate Watchpoint exceptions only when the byte at address 0x1009 
is accessed. 


2. The PE accesses the unaligned doubleword starting at address 0x1003. 


In this scenario, the watchpoint must generate a Watchpoint exception. 


The size of data accesses initiated by DCIMVAC instructions is an IMPLEMENTATION DEFINED size that is both: 


è From the inclusive range between: 
— The size that CTR.DminLine defines. 
—  2KB. 
. A power-of-two. 
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The lowest address accessed by a DCIMVAC instruction is the address supplied to the instruction, rounded down to the 
nearest multiple of the access size initiated by that instruction. 


The highest address accessed is (size - 1) bytes above the lowest address accessed. 


See also, Watchpoint behavior on accesses by DCIMVAC instructions on page G2-5662. 


Programming a watchpoint with eight bytes or fewer 


The Byte Address Select field, DBGWCR<n>.BAS, selects which bytes in the doubleword starting at the address 
contained in the DBGWVR<n> the watchpoint generates Watchpoint exceptions for. 


If the address programmed into the DBGWVR<n> is: 


. Doubleword-aligned: 
— All eight bits of DBGWCR<n>.BAS are used, and the descriptions given in Table G2-16 apply. 


° Word-aligned but not doubleword-aligned: 


— Only DBGWCR<n>.BAS[3:0] are used, and the descriptions given in Table G2-17 apply. In this case, 
DBGWCR<n>.BAS[7:4] are RESO. 


Table G2-16 Supported BAS values when the DBGWVRn address alignment is doubleword 





BAS value Description 





0b00000000 Watchpoint never generates a Watchpoint exception 


























BAS[0] == Generates a Watchpoint exception if byte at address DBGWVR<n>[3 1:3]:000 is accessed 
BAS[1] == Generates a Watchpoint exception if byte at address DBGWVR<n>[31:3]:001 is accessed 
BAS[2] == Generates a Watchpoint exception if byte at address DBGWVR<n>[3 1:3]:010 is accessed 
BAS[3] == Generates a Watchpoint exception if byte at address DBGWVR<n>[31:3]:011 is accessed 
BAS[4] == Generates a Watchpoint exception if byte at address DBGW VR<n>[31:3]:100 is accessed 
BAS[5] == Generates a Watchpoint exception if byte at address DBGWVR<n>[31:3]:101 is accessed 
BAS[6] == Generates a Watchpoint exception if byte at address DBGW VR<n>[31:3]:110 is accessed 
BAS[7] == Generates a Watchpoint exception if byte at address DBGWVR<n>[31:3]:111 is accessed 








Table G2-17 Supported BAS values when the DBGWVRn address alignment is word 





BAS value@ Description 

















0b00000000 Watchpoint never generates a Watchpoint exception 

BAS[0] == Generates a Watchpoint exception if byte at address DBGWVR<n>[31:2]:00 is accessed 
BAS[1] == Generates a Watchpoint exception if byte at address DBGWVR<n>[31:2]:01 is accessed 
BAS[2] == Generates a Watchpoint exception if byte at address DBGWVR<n>[31:2]:10 is accessed 
BAS[3] == Generates a Watchpoint exception if byte at address DBGWVR<n>[31:2]:11 is accessed 





a. DBGWCR<n>.BAS[7:4] are RESO. 
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If the BAS field is programmed with more than one byte, the bytes that it is programmed with must be contiguous. 
For watchpoint behavior when its BAS field is programmed with non-contiguous bytes, see Other usage constraints 
on page G2-5664. 


When programming the BAS field with anything other than 0b11111111, a debugger must also program 
DBGWCR<n>.MASK to be 0b00000. See Programming dependencies of the BAS and MASK fields on 
page G2-5663. 


A watchpoint generates a Watchpoint exception whenever a watched byte is accessed, even if: 
. The access size is smaller or larger than the address region being watched. 


° The access is misaligned, and the base address of the access is not in the doubleword or word of memory 
addressed by the DBGWVR<n>[3 1:3]. See Example G2-1 on page G2-5657. 


The following are some example configurations of the BAS field: 


$ To program a watchpoint to generate a Watchpoint exception on the byte at address 0x1003, program: 
— DBGWVR<r> with 0x1000. 
— DBGWCR<n>_EL1.BAS to be 0b00001000. 


s To program a watchpoint to generate a Watchpoint exception on the bytes at addresses 0x2003, 0x2004 and 
0x2005, program: 


— DBGWVR<n> with 0x2000. 
—  DBGWCR<n>_EL1.BAS to be 0b00111000. 


è If the address programmed into the DBGWVR<n> is doubleword-aligned: 


— To generate a Watchpoint exception when any byte in the word starting at the doubleword-aligned 
address is accessed, program DBGWCR<n>.BAS to be 0b00001111. 


— To generate a Watchpoint exception when any byte in the word starting at address 
DBGWVR<n>[31:3]:100 is accessed, program DBGWCR<n>.BAS to be 0b11110000. 


Note 
Arm deprecates programming a DBGWVR<n> with an address that is not doubleword-aligned. 








Programming a watchpoint with eight or more bytes 


A debugger can use the MASK field, DBGWCR<n>.MASK, to program a single watchpoint with a data address 
range. The data address range must meet all of the following criteria: 


° It is a size that is both: 
— A power-of-two. 
— A minimun of eight bytes. 
— A maximum of 2GB. 


s It starts at an address that is aligned to the size. 


The MASK field specifies the number of least significant data address bits that must be masked. Up to 31 least 
significant bits can be masked: 


MASK 0b00000 No bits are masked. 
Qb00001 Reserved. 
0b00010 Reserved. 
0b00011 Three least significant bits are masked. 
0b00100 Four least significant bits are masked. 
0b00101 Five least significant bits are masked. 





0b11111 31 least significant bits are masked. 
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G2.10.5 


G2-5660 


If n least significant address bits are masked, the watchpoint generates a Watchpoint exception on all of the 
following: 


° Address DBGWVR<n>{[3 1:7]:000... 
° Address DBGWVR<n>[31:7]:111... 
° Any address between these two addresses. 


For example, if the four least significant address bits are masked, Watchpoint exceptions are generated for all 
addresses between DBGWVR<n>[31:4]:0000 and DBGWVR<n>[31:4]:1111, including these addresses. 





Note 
$ The most significant bit cannot be masked. This means that the full address cannot be masked. 
° For watchpoint behavior when its MASK field is programmed with a reserved value, see Reserved 


DBGWCR<n>.MASK values on page G2-5664. 





When masking address bits, a debugger must both: 


s Program DBGWCR<n>.BAS to be 0b11111111. See Programming dependencies of the BAS and MASK fields 
on page G2-5663. 


° In the DBGWVR<n>, set the masked address bits to 0. For watchpoint behavior when any of the masked 
address bits are not 0, see Other usage constraints on page G2-5664. 


Determining the memory location that caused a Watchpoint exception 


On a Watchpoint exception, the PE records an address in a Fault Address Register that the debugger can use to 
determine the memory location that triggered the watchpoint. 


The Fault Address Register (FAR) used is either: 
. DFAR, if the exception is taken to PL1. 
è HDFAR, if the exception is taken to PL2. 


In cases where one instruction triggers multiple watchpoints, only one address is recorded. 


On entering Debug state on a Watchpoint debug event, the PE records the address in the EDWAR. 


Note 


If Debug state was entered from AArch32 state, then EDWAR[63:32] is UNKNOWN and must be ignored by the 
debugger. 








For more information, see the subsections that follow. These are: 


. Address recorded for Watchpoint exceptions generated by instructions other than data cache maintenance 
instructions. 


s Address recorded for Watchpoint exceptions generated by data cache maintenance instructions on 
page G2-5661. 


Address recorded for Watchpoint exceptions generated by instructions other than data 
cache maintenance instructions 


The address recorded must be both: 
° From the inclusive range between: 


— The lowest address accessed by the memory access that triggered the watchpoint. 


— The highest watchpointed address accessed by the memory access. A watchpointed address is an 
address that the watchpoint is watching. 


: Within a naturally-aligned block of memory that is all of the following: 
— A power-of-two size. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch32 Self-hosted Debug 
G2.10 Watchpoint exceptions 


— No larger than 2KB. 
— No larger than the block size used by the A64 DC ZVA instruction. 
Note 


There are no architectural means to discover the A64 DC ZVA instruction block size from AArch32 
state. 








— Contains a watchpointed address accessed by the memory access. 


The size of the block is IMPLEMENTATION DEFINED. There is no architectural means of discovering the size. 


Example G2-2 Address recorded for a watchpoint programmed on 0x8019 


A debugger programs a watchpoint to generate a Watchpoint exception on any access to the byte 0x8019. 


An A32 load multiple instruction then loads nine registers starting from address 0x8004 upwards. This triggers the 
watchpoint. 


If the DC ZVA block size is: 
° 32 bytes, the address that the PE records must be between 0x8004 and 0x8019 inclusive. 
° 16 bytes, the address that the PE records must be between 0x8010 and 0x8019 inclusive. 


Address recorded for Watchpoint exceptions generated by data cache maintenance 
instructions 


The address recorded is the address passed to the instruction. This means that the address recorded might be higher 
than the address of the location that triggered the watchpoint. 


G2.10.6 Watchpoint behavior on other instructions 
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Under normal operating conditions, the following do not generate Watchpoint exceptions: 


. Instruction cache maintenance instructions. 

° Address translation instructions. 

. TLB maintenance instructions. 

° Preload instructions. 

e All data cache maintenance instructions except DCIMVAC. 

à If the Point of Coherency is before any level of cache, it is IMPLEMENTATION DEFINED whether a DC IVAC 


instruction can generate a Watchpoint. 


However, the debug architecture allows for implementation defined controls, such as those in ACTLR registers, to 
enable watchpoints on an implementation defined subset of these instructions. Whether a watchpoint treats the 
instruction as a load or a store, and the access size of instruction cache maintenance, address translation, and TLB 
maintenance instructions are implementation defined. 


The access size of the IMPLEMENTATION DEFINED instruction cache maintenance, address translation, and TLB 
maintenance instructions that generate Watchpoint exceptions are IMPLEMENTATION DEFINED. 


See also: 
. Watchpoint behavior on accesses by Store-Exclusive instructions. 
. Watchpoint behavior on accesses by DCIMVAC instructions on page G2-5662. 


Watchpoint behavior on accesses by Store-Exclusive instructions 
If a watchpoint matches on a data access caused by a Store-Exclusive instruction, then: 


° If the store fails because an Exclusives monitor does not permit it, it is IMPLEMENTATION DEFINED whether 
the watchpoint generates a Watchpoint exception. 
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: Otherwise, the watchpoint generates a Watchpoint exception. 


Watchpoint behavior on accesses by DCIMVAC instructions 


It is IMPLEMENTATION DEFINED whether DCIMVAC operations can generate Watchpoint exceptions. If they can, they 
are treated as data stores. This means that for a watchpoint to match on an access caused by a DCIMVAC instruction, 
the debugger must program DBGWCR<n>.LSC to be one of the following: 

10 Match on data stores only. 

11 Match on data stores and data loads. 


Note 


For the size of data accesses performed by DCIMVAC instructions, see Watchpoint data address comparisons on 
page G2-5657. The size ofall data accesses must be considered because watchpoints can be programmed to match 
on individual bytes. 








Usage constraints 


See the following: 

7 Reserved DBGWCR<n>.{SSC, HMC, PAC} values. 

° Reserved DBGWCR<n>.LBN values on page G2-5663. 

. Programming dependencies of the BAS and MASK fields on page G2-5663. 
. Reserved DBGWCR<n>.BAS values on page G2-5663. 

. Reserved DBGWCR<n>.MASK values on page G2-5664. 

e Other usage constraints on page G2-5664. 


Reserved DBGWCR<n>.{SSC, HMC, PAC} values 


Table G2-18 shows when particular combinations of DBGWCR<n>.{SSC, HMC, PAC} are reserved. 


Table G2-18 Reserved SSC, HMC, and PAC combinations 





HMC, SSC, and PMC combination Reserved 





All combinations with SSC set to 0b01 or @b10, except for the combination When EL3 is not implemented and EL2 is implemented. 
with HMC set to 1, SSC set to 0b01 and PMC set to 0b00 





Any combination where HMC or SSC is nonzero When both of EL2 and EL3 are not implemented 





The combination with HMC set to 1, SSC set to @b11, and PMC set to 0b00 When EL2 is not implemented 





The combinations with SSC set to @b11 and PMC set to 0b01 or @b1 When Secure EL2 is not implemented 





The combination with HMC set to 1, SSC set to @b01 and PMC set to @b0@ When Secure EL2 is not implemented 





Combinations not included in Table G2-15 on page G2-5656. Always 





G2-5662 


If a watchpoint is programmed with one of these reserved combinations: 


$ The watchpoint must behave as if it is either: 
— Disabled. 
— Programmed with a combination that is not reserved, other than for a direct or external read of 
DBGWCR<n>. 
. For a direct or external read of DBGWCR<n>, if the reserved combination: 


— Has no function for any execution conditions, the value read back for each of SSC, HMC, and PMC 
is UNKNOWN. 
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— Has a function for execution conditions other than the current execution conditions, the value read 
back is the value written. This permits software to save and restore the combination so that the 
watchpoint functions for the other execution conditions. 


The behavior of watchpoints with reserved combinations of SSC, HMC, and PAC might change in future revisions 
of the architecture. For this reason, software must not rely on the behavior described here. 


Reserved DBGWCR<n>.LBN values 


For Linked watchpoints 


A Linked watchpoint must link to a context-aware breakpoint. For a Linked watchpoint, any 
DBGWCR<n>.LBN value that is not for a context-aware breakpoint is reserved. 


If a Linked watchpoint links to a breakpoint that is not implemented, or that is not context-aware, 
then reads of DBGWCR<n>.LBN return an UNKNOWN value and the behavior is CONSTRAINED 
UNPREDICTABLE. The Linked watchpoint behaves as if it is either: 


° Disabled. 
$ Linked to an UNKNOWN context-aware breakpoint. 


If a Linked watchpoint links to a breakpoint that is implemented and is context-aware, but that is 
either not enabled or not programmed as a Linked Context breakpoint, it behaves as if it is disabled. 


For Unlinked watchpoints 
For Unlinked watchpoints, DBGWCR<n>.LBN reads UNKNOWN and its value is ignored. 


Programming dependencies of the BAS and MASK fields 
When programming a watchpoint, a debugger must use either: 
s The MASK field, to program the watchpoint with an address range that can be eight bytes to 2GB. 


° The BAS field, to select which bytes in the doubleword or word starting at the address contained in the 
DBGWVR<n> the watchpoint must generate Watchpoint exceptions for. 


If the debugger uses the: 
° MASK field, it must program BAS to be 0b11111111, so that all bytes in the doubleword or word are selected. 


° BAS field, it must program MASK to be 0b00000, so that the MASK field does not indicate any address 
ranges. 


If an enabled watchpoint has a MASK field that is non-zero and a BAS field that is not set to 0b11111111, then for 
each byte in the address range, it is CONSTRAINED UNPREDICTABLE whether or not a Watchpoint exception 
is generated. 


Reserved DBGWCR<n>.BAS values 


The BAS field must be programmed with a value Zeros (8-n-m) :Ones(n) :Zeros(m), where: 


. n is a non-zero positive integer less-than-or-equal-to 8. 
7 mis a positive integer less-than 8. 
s n+m is less-than-or-equal-to 8. 


All other values are reserved. 





Note 
If x is zero, then Zeros(x) is an empty bitstring. 





If DBGWVR<n>[2] is 1, DBGWCR<n>.BAS[7:4] are RESO and are ignored. 
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If a watchpoint is programmed with a reserved BAS value: 


s It is CONSTRAINED UNPREDICTABLE whether the watchpoint generates a Watchpoint exception for each byte 
in the doubleword or word of memory addressed by the DBGWVR<n>. 


è A direct or external read of DBGWCR<n>.BAS returns an UNKNOWN value. 

Software must not rely on these properties as the behavior of reserved values might change in a future revision of 
the architecture. 

Reserved DBGWCR<n>.MASK values 

If a watchpoint is programmed with a reserved MASK value: 


$ The watchpoint must behave as if it is either: 
— Disabled. 


— Programmed with an UNKNOWN value that is not reserved, that might be 0b00000, other than for a direct 
or external read of DBGWCR<n>. 


. A direct or external read of DBGWCR<n>.MASK returns an UNKNOWN value. 


Other usage constraints 
For all watchpoints: 
. DBGWVR<n>[1:0] are RESO and are ignored. 


° If DBGWCR<n>.MASK is nonzero, and any masked bits of DBGWVR<n> are not 0, it is CONSTRAINED 
UNPREDICTABLE whether the watchpoint generates a Watchpoint exception when the unmasked bits match. 


s A watchpoint never generates any Watchpoint exceptions if DBGWCR<n>.LSC is 0b00. 


G2.10.8 Exception syndrome information and preferred return address 


See the following: 
. Exception syndrome information. 
° Preferred return address on page G2-5665. 


Exception syndrome information 
The PE takes a Watchpoint exception as either: 
. A Data Abort exception, if it is taken to PL1. In this case, it is taken to Abort mode. 


° A Hyp trap exception, if it is taken to PL2 because HCR.TGE or HDCR.TDE is 1. In this case, it is taken to 
Hyp mode. 


If the exception is taken to: 


Abort mode 

The PE sets all of the following: 

° DBGDSCRext.MOE to 0b1010, to indicate a Watchpoint exception. 

e DFSR.CM to indicate whether a cache maintenance instruction caused the exception. 

: DFSR.WnR to indicate whether the exception was generated on a read instruction or a write 
instruction. 

à DFAR to an address that the debugger can use to determine the memory location that 
triggered the watchpoint. See Determining the memory location that caused a Watchpoint 
exception on page G2-5660. 
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In addition, if using the: 


. Short-descriptor format, the PE sets DFSR.FS to the code for a debug exception, 0b00010, and 
DFSR.Domain to an UNKNOWN value. 


° Long-descriptor format, the PE sets DFSR.STATUS to the code for a debug exception, 


0b100010. 
Hyp mode 
The PE does all of the following: 
5 Records information about the exception in the Hypervisor Syndrome Register, HSR. See 
Table G2-19. 


. Sets DBGDSCRext.MOE to 0b1001, to indicate a Watchpoint exception. 


è Sets the HDFAR to an address that the debugger can use to determine the memory location 
that triggered the watchpoint. See Determining the memory location that caused a 
Watchpoint exception on page G2-5660. 


Table G2-19 Information recorded in the HSR 





HSR field 


Information recorded 





Exception Class, EC 


The PE sets this to the code for a Data Abort exception routed to Hyp mode, 0x24. 





Instruction Length, IL 


The PE sets this to 1. 





Instruction Specific Syndrome, ISS 


ISV[24] Instruction Syndrome Valid (ISV). The PE sets this to 0. 


ISS[23:10] RESO. 


ISS[9] 
ISS[8] 


ISS[7| 
ISS[6] 


External Abort type (EA). The PE sets this to 0. 

Cache Maintenance (CM). The PE sets this to indicate whether a cache maintenance 
instruction caused the exception. 

RESO. 

Write not Read (WnR). The PE sets this to indicate whether the exception was 
generated on a read instruction or a write instruction. 


ISS[5:0] Data Fault Status Code (DFSC). The PE sets this to the code for a debug exception, 


0b100010. 








Note 


For information about how debug exceptions can be routed to PL2, see Routing debug exceptions 
on page G2-5617. 





Preferred return address 


The preferred return address of a Watchpoint exception is the address of the instruction that was not executed 


because the PE took the 


Watchpoint exception instead. 


This means that the preferred return address is the address of the instruction that caused the exception. 


G2.10.9 Pseudocode description of Watchpoint exceptions taken from AArch32 state 
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AArch32.WatchpointByteMatch() tests an individual byte accessed by an operation. 


AArch32.StateMatch() tests the values in DBGWCR<n>. {HMC, SSC, PAC}, and if the watchpoint is Linked, also 
tests the Linked Context breakpoint that the watchpoint links to. 


AArch32.WatchpointMatch() tests the value in DBGWVR<n>. 
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AArch32.CheckWatchpoint() generates a FaultRecord. A Watchpoint exception is taken if all of the following are true: 
s DBGDSCRext.MDBGen is 1. 


° Debug exceptions are enabled from the current Exception level and Security state. See Enabling debug 
exceptions from the current Privilege level and Security state on page G2-5619. 


s All ofthe conditions required for Watchpoint exception generation are met. See About Watchpoint exceptions 
on page G2-5653. 


Note 
AArch32.CheckWatchpoint might halt the PE and cause it to enter Debug state. External debug uses Debug state. 








The AArch32.Abort() function processes the FaultRecord object returned by AArch32.CheckWatchpoint(), as 
described in Abort exceptions on page G4-5717. If a Watchpoint exception is taken to AArch32 state, the 
AArch32.Abort() function generates a Data Abort exception. 
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G2.11 Vector Catch exceptions 


Arm deprecates the use of vector catch. 
This section describes Vector Catch exceptions in stage 1 of an AArch32 translation regime. 


The PE is using an AArch32 translation regime when it is executing either: 
$ At EL1 or higher in an Exception level that is using AArch32. 
è At ELO using AArch32 when EL1 is using AArch32. 


Note 


Vector Catch exceptions cannot be generated when the PE is using an AArch64 translation regime. 





This section contains the following subsections: 


$ About Vector Catch exceptions. 
. Exception vectors that Vector Catch exceptions can be enabled for on page G2-5669. 
5 Generation of Vector Catch exceptions on page G2-5670. 


. Usage constraints on page G2-5672. 


. Exception syndrome information and preferred return address for a Vector Catch exception on 
page G2-5672. 


. Pseudocode description of Vector Catch exceptions on page G2-5673. 


G2.11.1 About Vector Catch exceptions 
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Whenever the PE takes an exception, execution is forced to an address that is the exception vector for that exception. 
Vector catch permits a debugger to trap exceptions based on the exception vector, or based on the exception type 
associated with the exception vector, as follows: 


. If the address-matching form of vector catch is implemented, the debugger can trap exceptions based on the 
exception vector. 


° If the exception-trapping form of vector catch is implemented, the debugger can trap exceptions based on the 
exception type associated with the exception vector. 


The Armv8-A architecture supports only these two forms of vector catch. Only one form can be implemented, and 
which is implemented is IMPLEMENTATION DEFINED. The DBGDEVID indicates which form is implemented. 


Regardless of the form of vector catch implemented, a debugger enables Vector Catch exceptions for exception 
vectors or types by programming the DBGVCR. This register contains vector catch enable bits. Each of these bits 
corresponds to a different vector. When a debugger sets a vector catch enable bit to 1, Vector Catch exceptions are 
enabled for the corresponding exception vector or type. 


Note 


EL2 using AArch64 or EL3 using AArch64 can enable Vector Catch exceptions for vectors by programming the 
DBGVCR32_EL2. The DBGVCR32_EL2 is architecturally mapped to the DBGVCR. 








When Vector Catch exceptions are enabled for an exception vector, this is called an enabled vector catch. The set 
of exception vectors that Vector Catch exceptions are enabled for is called the enabled vector catch set. 


If the form of vector catch implemented is the: 


Address-matching form: 


The PE compares the virtual address of each instruction in the program flow with a subset of the 
enabled vector catch set. 


If an address match occurs, a Vector Catch exception is generated when the instruction that caused 
the match is committed for execution. 
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Exception-trapping form 


Whenever the PE takes an exception, if the vector the exception is taken to is included in a subset 
of the enabled vector catch set, a Vector Catch exception is generated. 


The Vector Catch exception is generated as part of entry to the exception, and must be taken before 
the PE either executes any instructions or takes any further exceptions. 


The addresses that comprise the subset depend on whether EL3 is implemented and, for the: 


` Address-matching form, the current Security state. 


è Exception-trapping form, the Security state that the exception is handled in. 


See Generation of Vector Catch exceptions on page G2-5670. 


Table G2-20 summarizes the differences between the address-matching and exception-trapping forms. 


Table G2-20 Differences in behavior of the address-matching and exception-trapping forms of vector catch 





Address-matching 


Exception-trapping 





An enabled vector catch generates a Vector Catch exception when 
an instruction that is fetched from the vector is committed for 
execution. 

This means that spurious Vector Catch exceptions might occur, 
where the Vector Catch exception does not result from an 
exception entry, but is instead caused by a branch to the vector. 
A branch to the vector might occur, for example, on a return from 
a nested exception or when simulating an exception entry. 


An enabled vector catch generates a Vector Catch exception 
immediately after the PE takes the exception that is associated 
with the vector. 


This means that Vector Catch exceptions always result from 
exception entry, and not from branches to exception vectors. 





A Vector Catch exception is generated as a result of an instruction 
fetch. This means that the Vector Catch exception has a priority 
relative to the other synchronous exceptions that result from an 
instruction fetch. 

Synchronous exception prioritization for exceptions taken to 
AArch64 state on page D1-2308 describes this prioritization. 


A Vector Catch exception is generated as a result of an exception 
entry. This means that the Vector Catch exception is part of the 
exception that caused the Vector Catch exception. Therefore, the 
Vector Catch exception has no priority associated with it. 

For this reason, Vector Catch exceptions are outside the scope of 
the prioritization that Synchronous exception prioritization for 
exceptions taken to AArch64 state on page D1-2308 describes. 





A Vector Catch exception can be preempted by another exception. 


If this happens, the Vector Catch exception is generated again 
when the exception handler branches back to the vector. 


Vector Catch exceptions must be taken before other exceptions. 





A Vector Catch exception can be generated as a result of an 
instruction fetch executed in any AArch32 mode except Hyp 
mode, including User mode. 


Because a Vector Catch exception is generated as the result of an 
exception entry, the Vector Catch exception is only generated 
when the PE is in the AArch32 exception handling mode. 





If HCR.TGE is 1, Vector Catch exceptions can be generated for 
User mode instruction fetches from Non-secure PL1 vectors. 


If HCR.TGE is 1, Vector Catch exceptions are never generated in 
Non-secure state, because: 


a Exceptions are routed away from Non-secure PL1 vectors, 
to PL2. 
7 The architecture does not provide vector catch enable bits 


for the Hyp exception vectors. 





Depending on the implementation, some vector catch enable bits in the DBGVCR might be RESO. For example, if 
EL3 is not implemented or is implemented but is using AArch64, Monitor mode is not implemented, and so the 
enable bits for exception vectors for exceptions taken to Monitor mode are RESO. See Exception vectors that Vector 
Catch exceptions can be enabled for on page G2-5669 for the vector catch enable bits that exist for different 


implementations. 


The debug exception enable controls on page G2-5616 describes the enable controls for Vector Catch exceptions. 


G2-5668 
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G2.11.2 Exception vectors that Vector Catch exceptions can be enabled for 
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When the PE takes an exception, the exception vector is contained in a vector table at the Privilege level the 
exception is taken to. 


Depending on the Security state and AArch32 mode the exception is taken to, when the exception is taken, the 
vector table used is the table that contains one of: 


è Local exception vectors. 

° Non-secure Local exception vectors. 
7 Secure Local exception vectors. 

è Hyp exception vectors. 

è Monitor exception vectors. 


Table G2-21 shows which vector tables are implemented for different implementations. In the table: 


è A dash, -, means that the Exception level is not implemented. 
s 64 means that the Exception level is using AArch64. 
è 32 means that the Exception level is using AArch32. 


Table G2-21 Vector tables implemented for different implementations 





Implementation 
Vector table or tables implemented 
ELO EL1 EL2 EL3 











32 32 - - Local exception vectors. 
64 - Non-secure Local exception vectors. 
32 - Non-secure Local exception vectors. 


Hyp exception vectors. 





- 64 Secure Local exception vectors. 


Non-secure Local exception vectors. 





- 32 Secure Local exception vectors. 
Non-secure Local exception vectors. 


Monitor exception vectors. 





64 64 Secure Local exception vectors. 
Non-secure Local exception vectors. 





32 64 Secure Local exception vectors. 





Non-secure Local exception vectors. 
Hyp exception vectors. 





32 32 Secure Local exception vectors. 
Non-secure Local exception vectors. 
Hyp exception vectors. 

Monitor exception vectors. 








For example, in an AArch32-only implementation that includes ELO, EL1, and EL3, when the PE takes an exception 
to Monitor mode, it uses the vector table containing Monitor exception vectors. 


The tables that follow show the vectors that Vector Catch exceptions can be enabled for, and their corresponding 
vector catch enable bits in the DBGVCR: 


. Table G2-22 on page G2-5670 shows the Local exception vectors, Secure Local exception vectors, and 
Non-secure Local exception vectors that Vector Catch exceptions can be enabled for. 


è Table G2-23 shows the Monitor exception vectors that Vector Catch exceptions can be enabled for. 
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The Armv8-A architecture does not provide vector catch enable bits for the Hyp exception vectors. 


Table G2-22 Local exception vectors, Secure Local exception vectors, and Non-secure Local exception vectors that 
Vector Catch exceptions can be enabled for 
































Vector catch enable bit Local exception vectors 
Local or Secure Local Non-secure Local Exception type 

: eee Normal. SCTLR.V is 0.a High. SCTLR.V is 1. 
exception vectors exception vectors 
SF NSF FIQ interrupt VBAR + 0x0000001C OxFFFFQQ1C 
SI NSI IRQ interrupt VBAR + 0x00000018 OxFFFFQ018 
SD NSD Data Abort VBAR + 0x00000010 OxFFFFQ010 
SP NSP Prefetch Abort VBAR + 0x0000000C OxFFFFQ0OC 
SS NSS Supervisor Call VBAR + 0x00000008 OxFFFFQQ08 
SU NSU Undefined VBAR + 0x00000004 OxFFFFQQ04 

Instruction 











a. IfEL3 is implemented and is using AArch32, VBAR is banked. The Secure Local exception vectors use VBARs and the Non-secure Local 
Exception vectors use VBARws. 


Table G2-23 Monitor exception vectors that Vector Catch exceptions can be enabled for 

















Vector catch enable bit Exception type Monitor exception vectors 
MF FIQ interrupt MVBAR + 0x0000001C 
MI IRQ interrupt MVBAR + 0x00000018 
MD Data Abort MVBAR + 0x00000010 
MP Prefetch Abort MVBAR + 0x0000000C 
MS Secure Monitor Call MVBAR + 0x00000008 














Note 
There is no vector catch enable bit for Monitor trap exceptions. 








G2.11.3 Generation of Vector Catch exceptions 


How Vector Catch exceptions are generated depends on which form is implemented: 
. Address-matching form. 
e Exception-trapping form on page G2-5671. 


Address-matching form 


The PE compares the virtual address of each instruction in the program flow is with some or all of the addresses in 
the enabled vector catch set, as follows: 


, If EL3 is not implemented, the enabled vector catch set contains only Local exception vectors. The PE 
compares the virtual address of each instruction in the program flow, including those executed at ELO, with 
all addresses in the enabled vector catch set. 
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: If EL3 is implemented, the enabled vector catch set might contain one or more of the following: 
— Monitor exception vectors, if EL3 is using AArch32. 
— Secure Local exception vectors. 
—  Non-secure Local exception vectors. 


In this case, Table G2-24 shows which addresses, in the enabled vector catch set, the virtual address of each 
instruction in the program flow is compared with. 


Table G2-24 Comparisons made if the implementation includes EL3 











For exceptions taken to: 
EL3 is using 

Secure PL1 modes Non-secure PL1 modes 
AArch64 Secure Local exception vectors | Non-secure Local exception vectors 
AArch32 Secure Local exception vectors 

and Monitor exception vectors 








For example, for exceptions taken to a Secure PL1 mode when EL3 is using AArch64, the virtual address of each 
instruction in the program flow is compared with each Secure Local exception vector in the enabled vector catch set. 


For each instruction in the program flow, the PE tests for any possible Vector Catch exceptions before executing the 
instruction. If a match occurs, a Vector Catch exception is generated when the instruction is committed for 
execution, regardless of all of the following: 


° Whether the instruction passes its Condition code check. 

e Whether the instruction is executed as part of exception entry. 

° If EL2 is implemented, what HCR. {IMO, FMO, AMO} are set to. 
° If EL3 is implemented, what SCR. {IRQ, FIQ, EA} are set to. 


Exception-trapping form 


When the PE takes an exception, it tests whether the exception is by branching to an exception vector in a subset of 
the enabled vector catch set, as follows: 


s If EL3 is not implemented, the enabled vector catch set contains only Local exception vectors. The PE tests 
whether the exception is by branching to any address in the enabled vector catch set. 


s If EL3 is implemented, the enabled vector catch set might contain one or more of the following: 
— Monitor exception vectors, if EL3 is using AArch32. 
— Secure Local exception vectors. 
— Non-secure Local exception vectors. 


In this case, the PE tests whether the exception is by branching to a vector in one of the subsets that 
Table G2-25 shows. In the table, n/a means not applicable. 


Table G2-25 Subsets that the PE tests within if EL3 is implemented 





For exceptions taken to: 





EL3 is using 

Monitor mode Other Secure PL1 modes Non-secure PL1 modes 
AArch64 n/a Secure Local exception vectors Non-secure Local exception vectors 
AArch32 Monitor exception vectors 
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For example, for an exception taken to a Secure PL1 mode when EL3 is using AArch64, the PE tests whether the 
exception is by branching to any of the Secure Local exception vectors in the enabled vector address set. 
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G2.11.4 


G2.11.5 


G2-5672 


If the exception is by branching to a vector in the subset, a Vector Catch exception is generated as part of exception 
entry. That is, a Vector Catch exception is generated instead of the exception handler executing its first instruction. 


Usage constraints 


See the following subsections: 
$ Usage constraints that apply to both forms of vector catch. 


. Usage constraints that apply only to the address-matching form. 


Usage constraints that apply to both forms of vector catch 


For Vector Catch exceptions enabled for either the Prefetch Abort exception vector or the Data Abort exception 
vector, if one of these exception types is taken to the Exception level that debug exceptions are targeting, behavior 
is CONSTRAINED UNPREDICTABLE. Either: 


° Vector catch is ignored, therefore a Vector Catch exception is not generated. 


7 Vector catch generates a Prefetch Abort debug exception. For Vector Catch exceptions enabled for the 
Prefetch Abort exception vector, the PE might enter a recursive loop of Prefetch Abort exceptions causing 
Vector Catch exceptions and Vector Catch exceptions causing Prefetch Abort exceptions. 





Note 


The Exception level that debug exceptions are targeting is called the debug target Exception level, ELp. Routing 
debug exceptions on page G2-5617 describes how ELp is derived. 





Usage constraints that apply only to the address-matching form 
Exception vectors are at word-aligned addresses, and: 


° It is CONSTRAINED UNPREDICTABLE whether an enabled vector catch generates a Vector Catch exception for 
a 32-bit T32 instruction starting at the halfword-aligned address immediately prior to the vector address. 


e T32 instructions that start at the halfword-aligned address immediately after the exception vector do not 
generate Vector Catch exceptions. 


For the address-matching form, Vector Catch exceptions have the same priority as Breakpoint exceptions. If a single 
instruction causes both a Vector Catch exception and a Breakpoint exception, it is CONSTRAINED UNPREDICTABLE 
which of these debug exceptions the PE takes. 


Exception syndrome information and preferred return address for a Vector Catch exception 


See the following: 
. Exception syndrome information for a Vector Catch exception. 
. Preferred return address for a Vector Catch exception on page G2-5673. 


Note 


Usually, the term exception syndrome is used only for exceptions taken to Hyp mode, or to AArch64 state. The 
referenced section uses the term more generally, to include exception information reported in the IFSR. 








Exception syndrome information for a Vector Catch exception 
The PE takes a Vector Catch exception as either: 
è A Prefetch Abort exception if it is taken to PL1. In this case, it is taken to Abort mode. 


° A Hyp trap exception, if it is taken to PL2 because HCR.TGE or HDCR.TDE is 1. In this case, it is taken to 
Hyp mode. 
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If the exception is taken to: 


PL1 Abort mode 
The PE sets all of the following: 
° IFSR.FS to the code for a debug exception, 0b00010. 
° DBGDSCRext.MOE to 0b0101, to indicate a Vector Catch exception. 


° The IFAR with an UNKNOWN value. 
PL2 Hyp mode 
The PE does all of the following: 
s Records information about the exception in the Hypervisor Syndrome Register, HSR. See 
Table G2-26. 


a Sets DBGDSCRext.MOE to 0b0101, to indicate a Vector Catch exception. 
$ Sets the HIFAR to an unknown value. 


Table G2-26 Information recorded in the HSR 











HSR field Information recorded 
Exception Class, EC The PE sets this to the code for a Prefetch Abort exception routed to Hyp mode, 0x20. 
Instruction Length, IL The PE sets this to 1. 





Instruction Specific Syndrome, ISS  ISS[24:10] RESO. 


ISS[9] External Abort type (EA). The PE sets this to 0. 
ISS[8:6] RESO. 


ISS[5:0] Instruction Fault Status Code (IFSC). The PE sets this to the code for a debug 
exception, 0b100010. 








Note 


For information about how debug exceptions can be routed to PL2, see Routing debug exceptions 
on page G2-5617. 





Preferred return address for a Vector Catch exception 


The preferred return address of a Vector Catch exceptions is the address of the instruction that was not executed 
because the PE took the Vector Catch exception instead. 


This means that the preferred return address is the exception vector. This is true regardless of whether the 
address-matching form or the exception trapping form is implemented. 


G2.11.6 Pseudocode description of Vector Catch exceptions 
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The AArch32.VCRMatch() pseudocode function checks whether the instruction at address generates a Vector Catch 
exception. It therefore shows the address-matching form of vector catch. 


The AArch32.CheckVectorCatch() pseudocode function uses AArch32.VCRMatch() to test whether the instruction 
generates a Vector Catch exception, and if AArch32.VCRMatch() returns TRUE it generates that event. 


The AArch32.Abort() function processes the FaultRecord object returned by AArch32.CheckVectorCatch(), as 
described in Abort exceptions on page G4-5717. If there is a Vector Catch exception, the AArch32.Abort() function 
generates a Prefetch Abort exception. 
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G2.12 


G2.12.1 
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Synchronization and debug exceptions 


The behavior of debug depends on all of the following: 

s The state of the external debug authentication interface. 

. Indirect reads of: 
— External debug registers. 
— System registers, including system debug registers. 
— Special-purpose registers. 


If a change is made to any of these, the effect of that change on debug exception generation cannot be relied on until 
after a Context synchronization event has occurred. 


For any instructions executed between the time when the change is made and the time when the next Context 
synchronization event occurs, it is CONSTRAINED UNPREDICTABLE whether debug uses the state of the PE before the 
change, or the state of the PE after the change. 


Example G2-3 
1. Software changes DBGDSCRext.MDBGen from 0 to 1. 
2. An instruction is executed, that would cause a Breakpoint exception if self-hosted debug uses the state of the 
PE after the change. 
3. A Context synchronization event occurs. 


In this case, it is CONSTRAINED UNPREDICTABLE whether the instruction generates a Breakpoint exception. 


Example G2-4 


1. Software unlocks the OS Lock. 
2. The PE executes some instructions. 
3. A Context synchronization event occurs. 


During the time when the PE is executing some instructions, step 2, it is CONSTRAINED UNPREDICTABLE whether 
debug exceptions other than Breakpoint Instruction exceptions can be generated. 


Note 


Some register updates are self-synchronizing. Others require an explicit Context synchronization event. For more 
information, see: 





à Synchronization of changes to AArch32 System registers on page G8-5896. 
: Accessing PSTATE fields on page G1-5494. 


: Synchronization of changes to the external debug registers on page H8-6828. 





State and mode changes without explicit context synchronization events 


Most changes to the Exception level, and most changes to the Security state if EL3 is implemented, happen as a 
result of operations that are an explicit Context synchronization event. This is because taking an exception and 
returning from an exception are both explicit Context synchronization events, and the Privilege level and Security 
state can only change as a result of taking or returning from an exception. 
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However, some Security state and AArch32 mode changes can happen because of operations that are not an explicit 
Context synchronization event. These are: 


AArch32 mode changes caused by MSR and CPS instructions. A mode change might be to a mode at a lower 
Privilege level. 


If EL3 is using AArch32, a Security state change caused by a direct write to the SCR in a privileged mode 
other than Monitor mode, to set SCR.NS to 1. 
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This chapter describes the AArch32 self-hosted trace: 
Introductory information: 

. About self-hosted trace on page G3-5678. 

a Trace Sinks on page G3-5678. 

. Register controls to enable self-hosted trace on page G3-5678. 
Prohibited regions in trace: 

. Controls to prohibit trace at Exception levels on page G3-5679. 

. Self-hosted trace and address translation on page G3-5679. 
Timestamps and Synchronization: 

$ Self-hosted trace timestamps on page G3-5680. 

° Synchronization in self-hosted trace on page G3-5681. 
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G3.1 


G3.1.1 


G3.1.2 
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About self-hosted trace 


A PE Trace Unit generates trace data to describe the program flow of the PE. 


The PE Trace Unit may be an implementation of a standard Arm Embedded Trace Macrocell (ETM), or another 
type of Arm Trace Architecture, or an IMPLEMENTATION DEFINED trace function. 


If an Armv8.4-compliant PE implements an ETM Architecture PE Trace Unit, ARMv8.4-Trace extension must be 
implemented. 


If an Armv8.4-compliant PE implements a Trace Unit that is not an ETM Architecture PE Trace Unit, Arm 
recommends that ARMv8.4-Trace extension is implemented, but this is not mandatory. 


Self-hosted trace happens when the agent controlling the trace collection is part of the same software stack as the 
software being traced. The agent controls prohibited regions. The information collected by the agent is sent to a trace 
sink. 


If the self-hosted trace extensions are implemented, the PE Trace Unit must implement the system register interface. 
The PE Trace Unit and the PE must have the same view of the debug authentication interface. If ARMv8.4-Trace 
is implemented, ExternalNoninvasiveDebugEnabled() is always TRUE. 


Trace Sinks 


The PE Trace Unit sends the trace data to a trace sink. A system might include multiple trace sinks, and allow 
software to configure which trace sink or sinks are used. 


An example of an internal trace sink is an Embedded Trace Router (ETR), which allows software to define a buffer 
in memory. Trace data is written to this buffer. 


Arm recommends that a system that a system that includes ARMv8.4-Trace incorporates an ETR, and follows the 
system architecture described by the CoreSight Base System Architecture (CS-BSA). 


The self-hosted trace extensions do not describe the programmers’ model trace sinks. 


Register controls to enable self-hosted trace 


For EL1 using AArch64, see Chapter D3 AArch64 Self-hosted Trace. 


If ARMv8.4-Trace is implemented, and external self-hosted trace is not implemented, self-hosted trace is always 
enabled. 


If ARMv8.4-Trace is implemented, and external self-hosted trace is implemented, self-hosted trace is also enabled 
if one of the following is true: 


è EDSCR.TFO == 0. 


s EDSCR.TFO == 1, EL3 is implemented, SDCR.STE == 1 and External SecureNoninvasiveDebugEnab1ed() == 
FALSE. 


° EDSCR.TFO ==], EL3 is not implemented, the PE executes in Secure state and 
ExternalSecureNoninvasiveDebugEnabled() = FALSE. 


The pseudocode function SelfHostedTraceEnabled() shows these rules. 
If ARMv8.4-Trace is not implemented, SelfHostedTraceEnabled() returns FALSE. 


While Sel fHostedTraceEnabled() == FALSE, ExternalSecureNoninvasiveDebugEnabled() and 
ExternalNoninvasiveDebugEnabled() control whether external tracing is prohibited or allowed in each Security state. 


The self-hosted trace extensions do not provide any mechanism to control software access to the PE Trace Unit 
external debug interface. 
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G3.2 Prohibited regions in self-hosted trace 


Trace is not generated in prohibited regions. The pseudocode function TraceA1]owed() indicates whether tracing is 
allowed in the current Security state and Exception Level. 


The IMPLEMENTATION DEFINED debug authentication interface can allow an external agent to disable the self-hosted 
trace extension. 


If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited in Secure state when SDCR.STE == 0. If 
ARMv8.4-Trace is implemented but not enabled, tracing is prohibited in Secure state when 
External SecureNoninvasiveDebugEnab1ed() == FALSE. 


G3.2.1 Controls to prohibit trace at Exception levels 


If Sel fHostedTraceEnabled() == TRUE, TRFCR, TRFCR_EL1, TRFCR_EL2 and HTRFCR control whether trace 
is prohibited at an Exception level. While Sel fHostedTraceEnabled() == FALSE, these registers are ignored. 


If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited at ELO if one of the following is true: 
$ The Effective value of HCR_EL2.TGE == 0 and TRFCR_EL1.EOTRE == 0. 

5 The Effective value of HCR.TGE == 0 and TRFCR.EOTRE == 0. 

è The Effective value of HCR_EL2.TGE == 1 and TRFCR_EL2.E0HTRE == 0. 


If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited at EL1 if TRFCR.E1TRE == 0. 
If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited at EL2 if HTRFCR.E2TRE == 0. 


If Sel fHostedTraceEnabled() == TRUE, tracing is prohibited at EL3 if one of the following is true: 
. EL3 is in AArch64 state. 
$ EL3 is in AArch32 state and TRFCR.EITRE == 0. 


The pseudocode TraceAl lowed() shows the above rules. 


If Sel fHostedTraceEnabled() == TRUE, Table G3-1 shows when export of PMU events Attributable to an Exception 
level is prohibited. 


Table G3-1 Export of PMU events prohibited 























HCR_EL2.TGE Tracing prohibited in Export of PMU events Attributable to this Exception level prohibited 
1 ELO, EL2, EL3 ELO 
x ELO, EL1, EL2, EL3 ELO 
x EL1, EL2, EL3 ELI 
xX EL2, EL3 EL2 
x EL3 EL3 
G3.2.2 Self-hosted trace and address translation 
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A hypervisor can use HTRFCR.CX to control visibility of VTTBR.VMID. 
If Sel fHostedTraceEnabled() == TRUE, and HTRFCR.CX == 0, or if EL2 is not implemented: 
e The value of VTTBR.VMID is not traced. 


š Comparisons with VTTBR.VMID do not match and results of comparison are not exposed through the 
comparators. 


The PE Trace Unit may either prohibit trace for these values, or may record a VTTBR.VMID value of zero in the 
trace. 
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G3.3 Self-hosted trace timestamps 
For EL1 using AArch64, see Chapter D3 AArch64 Self-hosted Trace. 


The trace timestamp is a value that represents the passage of time in real-time. It is calculated from a counter which 
increments all the time, when the PE is generating trace and when the PE is in a prohibited region. 


While Sel fHostedTraceEnabled() == FALSE, the external trace provides the trace timestamp. If the external trace is 
a standard CoreSight system, the relationship between CoreSight time and the Generic Timer counter is 
IMPLEMENTATION DEFINED. 


When Sel fHostedTraceEnabled() == TRUE, the trace time stamp is one of the following: 
$ The physical counter value CNTPCT_ELO or CNTPCT. 


è A virtual counter, which is calculated from the physical counter CNTPCT_ELO minus an offset 
CNTVOFF EL2, if EL2 is implemented and using AArch64. 


s A virtual counter, which is calculated from the physical counter CNTPCT minus an offset CNTVOFF, if EL2 
is implemented and using AArch32. 


a If EL2 is not implemented, the value of the offset is zero. 
The fields TRFCR_EL2.TS, TRFCR.TS and HTRFCR.TS control which counter is used for self-hosted trace. 


The timestamp used for trace is shown in Table G3-2. 


Table G3-2 Timestamp used for trace. 





SelfHostedTraceEnabled() TRFCR_EL2.TS or HTRFCR.TS TRFCR_EL1.TS Timestamp traced 


























FALSE XX XX CoreSight time 
TRUE 0b00 0b01 CNTPCT - CNTVOFF 
0b00 0b11 CNTPCT 
0b01 XX CNTPCT - CNTVOFF or 
CNTPCT_ELO - CNTVOFF_EL2 
Ob11 XX CNTPCT or CNTPCT_ELO 








Note 
The value of HCR_EL2.E2H does not affect the counter used for the trace timestamp. 
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G3.4 Synchronization in self-hosted trace 
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The PE Trace Unit is an indirect observer of the trace control registers. 


While Sel fHostedTraceEnabled() == TRUE, indirect reads of the trace filter control fields, TRFCR.{E1TRE, 
EOTRE} and HTRFCR.{E2TRE, EOHTRE} are treated as indirect reads made by the instruction being traced, and 
are subject to the standard requirements for synchronization of System register accesses. 


The TSB CSYNC operation is used to ensure that a trace operation, due to a PE Trace Unit generating trace for an 
instruction has completed. The TSB CSYNC operation may be reordered with respect to other instructions, so must be 
combined with at least one context synchronization event to ensure the operations are executed in the required order. 
This means that a direct write to TRFCR or HTRFCR is guaranteed to be observed by the PE Trace Unit only after 
a subsequent Context synchronization event.For more information, see Trace Synchronization Barrier (TSB 
CSYNC) on page E2-3826. 


While Sel fHostedTraceEnabled() == FALSE, the PE Trace Unit might impose stronger synchronization 
requirements. 
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This chapter provides a system level view of the general features of the memory system. It contains the following 
sections: 


About the memory system architecture on page G4-5684. 

Address space on page G4-5685. 

Mixed-endian support on page G4-5686. 

AArch32 cache and branch predictor support on page G4-5687. 

System register support for IMPLEMENTATION DEFINED memory features on page G4-5711. 
External aborts on page G4-5712. 

Memory barrier instructions on page G4-5714. 

Pseudocode description of general memory System instructions on page G4-5715. 
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G4.1 About the memory system architecture 


The Arm architecture supports different implementation choices for the memory system microarchitecture and 
memory hierarchy, depending on the requirements of the system being implemented. In this respect, the memory 
system architecture describes a design space in which an implementation is made. The architecture does not 
prescribe a particular form for the memory systems. Key concepts are abstracted in a way that permits 
implementation choices to be made while enabling the development of common software routines that do not have 
to be specific to a particular microarchitectural form of the memory system. For more information about the concept 
of a hierarchical memory system see Memory hierarchy on page E2-3829. 


G4.1.1 Form of the memory system architecture 
The Armv8 A-profile architecture includes a Virtual Memory System Architecture (VMSA). Chapter G5 The 
AArch32 Virtual Memory System Architecture describes the AArch32 view of the VMSA. 


G4.1.2 Memory attributes 


Memory types and attributes on page E2-3840 describes the memory attributes, including how different memory 
types have different attributes. Each location in memory has a set of memory attributes, and the translation tables 
define the virtual memory locations, and the attributes for each location. 


Table G4-1 shows the memory attributes that are visible at the system level. 


Table G4-1 Memory attribute summary 











Memory type Shareability Cacheability 

Deviceé Outer Shareable Non-cacheable. 

Normal One of: One of?: 
. Non-shareable. . Non-cacheable. 
° Inner Shareable. ° Write-Through Cacheable. 
. Outer Shareable. . Write-Back Cacheable. 


a. Takes additional attributes, see Device memory on page E2-3844. 


b. See also Cacheability, cache allocation hints, and cache transient hints on page G4-5690. 


For more information on Cacheability and Shareability see The Cacheability and Shareability memory attributes on 
page E2-3830, Non-shareable Normal memory on page E2-3842, and Caches and memory hierarchy on 
page E2-3829. 
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G4.2 Address space 


The Armv§8 architecture is designed to support a wide range of applications with different memory requirements. It 
supports a range of physical address (PA) sizes, and provides associated control and identification mechanisms. For 
more information, see About VMSAv8-32 on page G5-5720. 


G4.2.1 Address space overflow or underflow 
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This subsection describes address space overflow or underflow: 


Instruction address space overflow 

When a PE performs a normal, sequential execution of instructions, it calculates: 
(address_of_current_instruction) + (size_of_executed_instruction) 

This calculation is performed after each instruction to determine which instruction to execute next. 


If the address calculation performed after executing an A32 or T32 instruction overflows OxFFFF FFFF, the program 
counter becomes UNKNOWN. 


If the PE executes an instruction for which the instruction address, size, and alignment mean that it contains the 
bytes @xFFFFFFFF and 0x00000000, the bytes that apparently from 0x00000000 onwards come from an UNKNOWN 
address. 


Data address space overflow and underflow 


If the PE executes a load or store instruction for which the computed address, total access size, and alignment mean 
that it accesses bytes @xFFFFFFFF and 0x00000000, then the bytes that apparently come from 0x00000000 onwards come 
from UNKNOWN addresses. 
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G4.3 


Mixed-endian support 


Table G4-2 shows the endianness of explicit data accesses and translation table walks. 


Table G4-2 Endianness support 





Exception level 


Explicit data accesses Stage 1 translation table walks Stage 2 translation table walks 





ELO 


PSTATE.E SCTLR(S/NS).EE HSCTLR.EE 





ELI 


PSTATE.E SCTLR(S/NS).EE HSCTLR.EE 





EL2 


PSTATE.E HSCTLR.EE N/A 





EL3 


PSTATE.E SCTLR(S).EE N/A 





G4-5686 


AArch32 state provides the following options for endianness support: 


All Exception levels support mixed-endianness: 
—  SCTLR(S/NS).EE, HSCTLR.EE, and PSTATE.E are RW. 


Only ELO supports mixed-endianness and EL1, EL2, and EL3 support only little-endianness: 

—  SCTLR(S/NS).EE and HSCTLR.EE are RESO. PSTATE.E is RW when in ELO and RESO when in EL1, 
EL2, or EL3. SPSR.E is also RESO when not returning to ELO. 

Only ELO supports mixed-endianness and EL1, EL2, and EL3 support only big-endianness: 

—  SCTLR(S/NS).EE and HSCTLR.EE are RES1. PSTATE.E is RW when in ELO and RES1 when in EL1, 
EL2, or EL3. SPSR.E is also RES1 when not returning to ELO. 

All Exception levels support only little-endianness: 

— Each of SCTLR(S/NS).EE, HSCTLR.EE, PSTATE.E, and SPSR.E is RESO. 


All Exception levels support only big-endianness: 
— Each of SCTLR(S/NS).EE, HSCTLR.EE, PSTATE.E, and SPSR.E is RES1. 


If mixed endian support is implemented for an Exception level using AArch32, endianness is controlled by 
PSTATE.E. For exception returns to AArch32 state, PSTATE.E is copied from SPSR_ELx.E. If the target Exception 
level supports only little-endian accesses, SPSR_ELx.E is RESO. If the target Exception level supports only 
big-endian accesses, SPSR_ELx.E is RES1. 


Note 





When using AArch32, Arm deprecates PSTATE.E having a different value from the equivalent System 
register EE bit when in EL1, EL2 or EL3. The use of the SETEND instruction is also deprecated. 


If the higher Exception levels are using AArch64, the corresponding registers are: 
—  SCTLR_EL1 for SCTLR(NS). 

—  SCTLR_EL2 for HSCTLR. 

—  SCTLR_EL3 for SCTLR(S). 





The BigEndian() function determines whether the current Exception level and Execution state is using big-endian 


data. 


For more information about endianness in the Arm architecture see Endian support on page E2-3836. 
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G4.4 AArch32 cache and branch predictor support 


The following sections describe the support for caches and branch predictors in AArch32 state: 


s General behavior of the caches. 
. Cache identification on page G4-5688. 
° Cacheability, cache allocation hints, and cache transient hints on page G4-5690. 


° Enabling and disabling the caching of memory accesses in AArch32 state on page G4-5691. 
. Behavior of caches at reset on page G4-5693. 

. About cache maintenance in AArch32 state on page G4-5693. 

. AArch32 cache and branch predictor maintenance instructions on page G4-5697. 

. Execution and data prediction restriction System instructions on page G4-5708. 

$ Cache lockdown on page G4-5709. 

7 System level caches on page G4-5710. 


See also Chapter G5 The AArch32 Virtual Memory System Architecture, and in particular Caches in VMSAv8-32 on 
page G5-5807. 





Note 


: Branch predictors typically use a form of cache to hold branch target data. Therefore, they are included in 
this section. 


° In the instruction mnemonics, MVA is a synonym for VA. 





G4.4.1 General behavior of the caches 
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When a memory location is marked with a Normal Cacheable memory attribute, determining whether a copy of the 
memory location is held in a cache still depends on many aspects of the implementation. The following 
non-exhaustive list of factors might be involved: 


è The size, line length, and associativity of the cache. 

$ The cache allocation algorithm. 

è Activity by other elements of the system that can access the memory. 
° Speculative instruction fetching algorithms. 


° Speculative data fetching algorithms. 
. Interrupt behaviors. 


Given this range of factors, and the large variety of cache systems that might be implemented, the architecture 
cannot guarantee whether: 


è A memory location present in the cache remains in the cache. 


è A memory location not present in the cache is brought into the cache. 
Instead, the following principles apply to the behavior of caches: 


° The architecture has a concept of an entry locked down in the cache. How lockdown is achieved is 
IMPLEMENTATION DEFINED, and lockdown might not be supported by: 


— A particular implementation. 


— Some memory attributes. 


a An unlocked entry in a cache might not remain in that cache. The architecture does not guarantee that an 
unlocked cache entry remains in the cache or remains incoherent with the rest of memory. Software must not 
assume that an unlocked item that remains in the cache remains dirty. 


° A locked entry in a cache is guaranteed to remain in that cache. The architecture does not guarantee that a 
locked cache entry remains incoherent with the rest of memory, that is, it might not remain dirty. 
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Note 


For more information, see The interaction of cache lockdown with cache maintenance instructions on 
page G4-5709. 


è Any memory location that has a Normal Cacheable attribute at either the current Exception level or at a 
higher Exception level can be allocated to a cache at any time. 


s It is guaranteed that no memory location that does not have a Normal Cacheable attribute is allocated into the 
cache. 
è It is guaranteed that no memory location is allocated to the cache if it has a Normal Non-cacheable attribute 


or any type of Device memory attribute in both: 
— The translation regime at the current Exception level. 
— The translation regime at any higher Exception level. 


° For data accesses, any memory location with a Normal Inner Shareable or Normal Outer Shareable attribute 
is guaranteed to be coherent with all masters in its Shareability domain. 


- Any memory location is not guaranteed to remain incoherent with the rest of memory. 


° The eviction of a cache entry from a cache level can overwrite memory that has been written by another 
observer only if the entry contains a memory location that has been written to by an observer in the 
Shareability domain of that memory location. The maximum size of the memory that can be overwritten is 
called the Cache Write-back Granule. In some implementations the CTR identifies the Cache Write-back 
Granule. 


è The allocation ofa memory location into a cache cannot cause the most recent value of that memory location 
to become invisible to an observer, if it was previously visible to that observer. 





Note 


The Cacheability attribute of an address is determined by the applicable translation table entry for that address, as 
modified by any applicable System register Cacheability controls, such as the SCTLR. {I, C} controls. 


For the purpose of these principles, a cache entry covers at least 16 bytes and no more than 2KB of contiguous 
address space, aligned to the size of the cache entry. 


Cache identification 


The Armv8 cache identification consists of a set of registers that describe the implemented caches that are affected 
by cache maintenance instructions executed on the PE. This includes cache maintenance instructions that: 


$ Affect the entire cache, for example ICIALLUIS. 
e Operate by VA, for example ICIMVAU. 
. Operate by set/way, for example DCISW. 


The cache identification registers are: 


s A single Cache Type Register, CTR, that defines: 


— The minimum line length of any of the instruction caches affected by the instruction cache 
maintenance instructions. 


— The minimum line length of any of the data or unified caches, affected by the data cache maintenance 
instructions. 


— The cache indexing and tagging policy of the Level 1 instruction cache. 


Note 


It is IMPLEMENTATION DEFINED whether caches beyond the PoC will be reported by this mechanism, and 
because of the possible existence of system caches some caches before the PoC might not be reported. For 
more information about system caches see System level caches on page G4-5710. 
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A single Cache Level ID Register, CLIDR, that defines: 

— The type of cache that is implemented and can be maintained using the architected cache maintenance 
instructions that operate by set/way or operate on the entire cache at each cache level, up to the 
maximum of seven levels. 

— The Level of Unification Inner Shareable (LoUIS), Level of Coherence (LoC) and the Level of 
Unification (LoU) for the caches. See Terms used in describing the cache maintenance instructions on 
page G4-5694 for a definition of these terms. 

— An optional ICB field to indicate the boundary between the caches use for caching Inner Cacheable 
memory regions and those used only for caching Outer Cacheable regions. 


A single Cache Size Selection Register, CSSELR, that selects the cache level and cache type of the current 
Cache Size Identification Register. 


For each implemented cache that is identifiable by this mechanism, across all the levels of caching, a Cache 

Size Identification Register, that defines: 

— Whether the cache supports Write-Through, Write-Back, Read-Allocate and Write-Allocate. 

— The number of sets, associativity, and line length of the cache. See Terms used in describing the cache 
maintenance instructions on page G4-5694 for a definition of these terms. 





Note 


From Armv8.3, it is possible to have multiple Cache Size Identification Registers. For more details, see 
Possible formats of the Cache Size Identification Registers, CCSIDR and CCSIDR2. 





To determine the cache topology associated with a PE: 


l. 


Read the Cache Type Register to find the indexing and tagging policy used for the Level 1 instruction cache. 
This register also provides the size of the smallest cache lines used for the instruction caches, and for the data 
and unified caches. These values are used in cache maintenance instructions. 


Read the Cache Level ID Register to find what caches are implemented. The register includes seven Cache 
type fields, for cache levels 1 to 7. Scanning these fields, starting from Level 1, identifies the instruction, data 
or unified caches implemented at each level. This scan ends when it reaches a level at which no caches are 
defined. The Cache Level ID Register also specifies the Level of Unification (LoU) and the Level of 
Coherence (LoC) for the cache implementation. 


For each cache identified at stage 2: 


. Write to the Cache Size Selection Register to select the required cache. A cache is identified by its 
level, and whether it is: 
— An instruction cache. 


— A data or unified cache. 


. Read the Cache Size Identification Register to find details of the cache. 


Possible formats of the Cache Size Identification Registers, CCSIDR and CCSIDR2 


From Armv8.3, two different formats are available for defining the number of sets and associativity of the currently 
selected cache. For a definition of these terms, see Terms used in describing the cache maintenance instructions on 
page G4-5694. 


When ARMv8.3-CCIDX is implemented: 


There are two Cache Size Identification Registers, CCSIDR and CCSIDR2. 


The length of the CCSIDR.Assoc field is 21 bits. This limits the associativity of the currently selected cache 
to 221, 


The length of the CCSIDR2.NumSets field is 24 bits. This limits the number of sets in the currently selected 
cache to 224. 


This is the 64-bit format of the Cache Size Identification Register. 
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When ARMv8.3-CCIDX is not implemented: 
s There is a single Cache Size Identification Register, CCSIDR. 


e The length of the CCSIDR.Assoc field is 10 bits. This limits the associativity of the currently selected cache 
to 210, 


š The length of the CCSIDR.NumSets field is 15 bits. This limits the number of sets in the currently selected 
cache to 215, 


This is the 32-bit format of the Cache Size Identification Register. 


When one of these formats is implemented, it is implemented across all the levels of caching. 


Cacheability, cache allocation hints, and cache transient hints 


Cacheability only applies to Normal memory, and is defined independently for Inner and Outer cache locations. All 
types of Device memory are always treated as Non-cacheable. 


As described in Memory types and attributes on page E2-3840, the memory attributes include a cacheability 
attribute that is one of: 


. Non-cacheable. 
° Write-Through cacheable. 
. Write-Back cacheable. 


In Armv8, Cacheability attributes other than Non-cacheable can be complemented by a cache allocation hint. This 
is an indication to the memory system of whether allocating a value to a cache is likely to improve performance. In 
addition, it is IMPLEMENTATION DEFINED whether a cache transient hint is supported, see Transient cacheability 
hint. 


The cache allocation hints are assigned independently for read and write accesses, and therefore when the Transient 
hint is supported the following cache allocation hints can be used: 


For read accesses: Read-Allocate, Transient Read-Allocate, or No Read-Allocate. 


For write accesses: | Write-Allocate, Transient Write-Allocate, or No Write-Allocate. 





Note 


$ A Cacheable location with both No Read-Allocate and No Write-Allocate hints is not the same as a 
Non-cacheable location. A Non-cacheable location has coherency guarantees for all observers within the 
system that do not apply for a location that is Cacheable, No Read-Allocate, No Write-Allocate. 


. Implementations can use the cache allocation hints to limit cache pollution to a part of a cache, such as to a 
subset of ways. 


è For VMSAv8-32 translation table walks using the Long-descriptor translation table format, the appropriate 
TCR. {IRGNn, ORGNn} fields define the memory attributes of the translation tables, including the 
cacheability. However, this assignment supports only a subset of the cacheability attributes described in this 
section. 





The architecture does not require an implementation to make any use of cache allocation hints. This means an 
implementation might not make any distinction between memory locations with attributes that differ only in their 
cache allocation hint. 


Transient cacheability hint 


In Armv8, it is IMPLEMENTATION DEFINED whether a Transient hint is supported for the VMSAv8-32 translation 
scheme when using the Long-descriptor translation table format. In an implementation that supports the Transient 
hint, the Transient hint is a qualifier of the cache allocation hints, and indicates that the benefit of caching is for a 
relatively short period. It indicates that it might be better to restrict allocation of transient entries, to avoid possibly 
casting-out other, less transient, entries. 
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Note 
The architecture does not specify what is meant by a relatively short period. 








When using the Short-descriptor translation table format, VMSAv8-32 cannot support the Transient hint. 


The description of the MAIRO, MAIR1, HMAIRO, and HMAIRI registers includes the assignment of the Transient 
attribute in an implementation that supports this option. In this assignment: 


s The Transient hint is defined independently for Inner Cacheable and Outer Cacheable memory regions. 
7 A single Transient hint applies to both read and write accesses to a memory region. 


G4.4.4 Enabling and disabling the caching of memory accesses in AArch32 state 


In Armv8, Cacheability control fields can force all memory locations with the Normal memory type to be treated 
as Non-cacheable, regardless of their assigned Cacheability attribute. Independent controls are provided for each 
stage of address translation, with separate controls for: 





. Data accesses. These controls also apply to accesses to the translation tables. 
° Instruction accesses. 
Note 


These Cacheability controls replace the cache enable controls provided in previous versions of the Arm architecture. 


In AArch32 state, the Cacheability control fields and their effects are as follows: 


For the Non-secure PL1&0 translation regime 
The Non-secure instance of SCTLR holds the EL1 controls that affect cacheability: 


° When the value of SCTLR.C is 0: 
— Allstage 1 translations for data accesses to Normal memory are Non-cacheable. 
— All accesses to the PL1&0 stage 1 translation tables are Non-cacheable. 


. When the value of SCTLR.I is 0: 
—  Allstage 1 translations for instruction accesses to Normal memory are Non-cacheable. 


s When the value of HCR2.CD is 1: 
—  Allstage 2 translations for data accesses to Normal memory are Non-cacheable. 
— All accesses to the PL1&0 stage 2 translation tables are Non-cacheable. 


. When the value of HCR2.ID is 1: 


— Allstage 2 translations for instruction accesses to Normal memory are Non-cacheable. 


G When the value of HCR.DC is 1, all Non-secure stage 1 translations and all accesses to the 
Non-secure EL1&0 stage 1 translation tables, are treated as accesses to Normal 
Non-shareable Inner Write-Back Cacheable Read-Allocate Write-Allocate, Outer 
Write-Back Cacheable Read-Allocate Write-Allocate memory, regardless of the value of 
SCTLR.C. This applies to translations for both data and instruction accesses. 


In addition, when the value of SCTLR.M is 0, indicating that the stage 1 translations are disabled 
for the translation regime, then if EL2 is using AArch32 and the value of HCR.DC is 0 or if EL2 is 
using AArch64 and the value of HCR_EL2.DC is 0, then: 


° If the value of SCTLR.I is 0, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Non-cacheable, Outer Non-cacheable. 


° If the value of SCTLR.I is 1, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Write-Through cacheable, Outer 
Write-Through cacheable. 


Note 


° In Non-secure state, the stage 1 and stage 2 cacheability attributes are combined as described 
in Combining the Cacheability attribute on page G5-5787. 
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The Non-secure SCTLR. {C, I} and HCR.DC fields have no effect on the Secure PL1&0 and 
EL2 translation regimes. 


The HCR2. {ID, CD} fields affect only stage 2 of the Non-secure PL1&0 translation regime. 


In Non-secure state, the PL1&0 translation regime can be described as the Non-secure 
EL1&0 translation regime. This is consistent with the equivalent AArch64 descriptions. 





For the Secure PL1&0 translation regime 
The Secure instance of SCTLR holds the controls that determine cacheability: 


When the value of SCTLR.C is 0: 


— All data accesses to Normal memory using the Secure PL1&0 translation regime are 
Non-cacheable. 


— All accesses to the Secure PL1&0 translation tables are Non-cacheable. 
When the value of SCTLR.I is 0: 


— All instruction accesses to Normal memory using the Secure PL1&0 translation 
regime are Non-cacheable. 


In addition, when the value of SCTLR.M is 0, indicating that stage 1 translations are disabled, then: 





If the value of SCTLR.1 is 0, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Non-cacheable, Outer Non-cacheable. 


If the value of SCTLR.1 is 1, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Write-Through cacheable, Outer 
Write-Through cacheable. 


Note 


The Secure SCTLR. {I, C, M} fields have no effect on the Non-secure PL1&0 and EL2 translation 
regimes. 





For the EL2 translation regime 


When the value of HSCTLR.C is 0: 


— All data accesses to Normal memory using the EL2 translation regime are 
Non-cacheable. 


— All accesses to the EL2 translation tables are Non-cacheable. 


When the value of HSCTLR.I is 0: 


— All instruction accesses to Normal memory using the EL2 translation regime are 
Non-cacheable. 


In addition, when the value of HSCTLR.M is 0, indicating that stage 1 translations are disabled, 


then: 





If the value of HSCTLR.I is 0, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Non-cacheable, Outer Non-cacheable. 


If the value of HSCTLR.I is 1, instruction accesses to Normal memory from stage 1 of the 
translation regime are Outer Shareable, Inner Write-Through cacheable, Outer 
Write-Through cacheable. 


Note 


The HSCTLR.{I. C, M} fields have no effect on the PL1&0 and EL3 translation regimes. 





The effect of the SCTLR.C or HSCTLR.C and HCR2.CD bits is reflected in the result of the address translation 
instructions in the PAR. 


Note 





$ The requirements in this section mean the architecturally required effects of SCTLR.I and HSCTLR.I are 
limited to their effects on caching instruction accesses in unified caches. 
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: This specification can give rise to different cacheability attributes between instruction and data accesses to 
the same location. Where this occurs, the measures for mismatch memory attributes described in Mismatched 
memory attributes on page E2-3850 must be followed to manage the corresponding loss of coherency. 


G4.4.5 Behavior of caches at reset 
In Armv8: 
è All caches reset to IMPLEMENTATION DEFINED states that might be UNKNOWN. 


$ The Cacheability control fields described in Enabling and disabling the caching of memory accesses in 
AArch32 state on page G4-5691 reset to values that force all memory locations to be treated as 
Non-cacheable. 


Note 


This applies only to the controls that apply to the Translation regime that is used by the Exception level, PE 
mode, and Security state entered on reset. 








à An implementation can require the use of a specific cache initialization routine to invalidate its storage array 
before caching is enabled. The exact form of any required initialization routine is IMPLEMENTATION DEFINED, 
and the routine must be documented clearly as part of the documentation of the device. 


: If an implementation permits cache hits when the Cacheability control fields force all memory locations to 
be treated as Non-cacheable then the cache initialization routine must: 


— Provide a mechanism to ensure the correct initialization of the caches. 

— Be documented clearly as part of the documentation of the device. 

In particular, if an implementation permits cache hits when the Cacheability controls force all memory 
locations to be treated as Non-cacheable, and the cache contents are not invalidated at reset, the initialization 


routine must avoid any possibility of running from an uninitialized cache. It is acceptable for an initialization 
routine to require a fixed instruction sequence to be placed in a restricted range of memory. 


è Arm recommends that whenever an invalidation routine is required, it is based on the Armv8 cache 
maintenance instructions. 


Similar rules apply to: 
š Branch predictor behavior, see Behavior of the branch predictors at reset on page G4-5701. 
s TLB behavior, see TLB behavior at reset on page G5-5790. 


G4.4.6 About cache maintenance in AArch32 state 


The following sections give general information about cache maintenance in Armv8: 
$ Terms used in describing the cache maintenance instructions on page G4-5694. 


. The Armv8 abstraction of the cache hierarchy on page G4-5696. 


The following sections describe the AArch32 state cache maintenance instructions: 
. AArch32 instruction cache maintenance instructions (IC*) on page G4-5698. 
. AArch32 data cache maintenance instructions (DC*) on page G4-5699. 





Note 


Some descriptions of the cache maintenance instructions refer to the Cacheability of the address on which the 
instruction operates. The Cacheability of an address is determined by the applicable translation table entry for that 
address, as modified by any applicable System register Cacheability controls, such as the SCTLR. {I, C} controls. 
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Terms used in describing the cache maintenance instructions 


Cache maintenance instructions are defined to act on particular memory locations. Instructions can be defined: 
s By the virtual address of the memory location to be maintained, referred to as operating by VA. 
s By a mechanism that describes the location in the hardware of the cache, referred to as operating by set/way. 


In addition, for instruction caches and branch predictors, there are instructions that invalidate all entries. 


The following subsections define the terms used in the descriptions of the cache maintenance instructions: 


$ Terminology for cache maintenance instructions operating by set/way. 
. Terminology for Clean, Invalidate, and Clean and Invalidate instructions. 
Note 





There is no terminology specific to cache maintenance instructions that operate by VA. When all applicable stages 
of translation are disabled, the VA used is identical to the PA. For more information about memory system behavior 
when address translation is disabled, see The effects of disabling address translation stages on VUSAv8-32 behavior 
on page G5-5728. 





Terminology for cache maintenance instructions operating by set/way 


Cache maintenance instruction that operate by set/way refer to the particular structures in a cache. Three parameters 
describe the location in a cache hierarchy that an instruction works on. These parameters are: 


Level The cache level of the hierarchy. The number of levels of cache is IMPLEMENTATION DEFINED. The 
cache levels that can be managed using the architected cache maintenance instructions that operate 
by set/way can be determined from the CLIDR. 


In the Arm architecture, the lower numbered cache levels are those closest to the PE. See Memory 
hierarchy on page E2-3829. 


Set Each level of a cache is split up into a number of sets. Each set is a set of locations in a cache level 
to which an address can be assigned. Usually, the set number is an IMPLEMENTATION DEFINED 
function of an address. 


In the Arm architecture, sets are numbered from 0. 
Way The associativity of a cache is the number of locations in a set to which a specific address can be 
assigned. The way number specifies one of these locations. 


In the Arm architecture, ways are numbered from 0. 





Note 


Because the allocation of a memory address to a cache location is entirely IMPLEMENTATION DEFINED, Arm expects 
that most portable software will use only the cache maintenance instructions by set/way as single steps in a routine 
to perform maintenance on the entire cache. 





Terminology for Clean, Invalidate, and Clean and Invalidate instructions 
Caches introduce coherency problems in two possible directions: 


1. An update to a memory location by a PE that accesses a cache might not be visible to other observers that 
can access memory. This can occur because new updates are still in the cache and are not visible yet to the 
other observers that do not access that cache. 


2. Updates to memory locations by other observers that can access memory might not be visible to a PE that 
accesses a cache. This can occur when the cache contains an old, or stale, copy of the memory location that 
has been updated. 


G4-5694 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch32 System Level Memory Model 
G4.4 AArch32 cache and branch predictor support 


The Clean and Jnvalidate instructions address these two issues. The definitions of these instructions are: 


Clean A cache clean instruction ensures that updates made by an observer that controls the cache are made 
visible to other observers that can access memory at the point to which the instruction is performed. 
Once the Clean has completed, the new memory values are guaranteed to be visible to the point to 
which the instruction is performed, for example to the Point of Unification. 


The cleaning of a cache entry from a cache can overwrite memory that has been written by another 
observer only if the entry contains a location that has been written to by an observer in the 
Shareability domain of that memory location. 


Invalidate A cache invalidate instruction ensures that updates made visible by observers that access memory 
at the point to which the invalidate is defined, are made visible to an observer that controls the cache. 
This might result in the loss of updates to the locations affected by the invalidate instruction that 
have been written by observers that access the cache, if those updates have not been cleaned from 
the cache since they were made. 


If the address of an entry on which the invalidate instruction operates is Normal, Non-cacheable or 
any type of Device memory then an invalidate instruction also ensures that this address is not 
present in the cache. 


— Note 


Entries for addresses that are Normal Cacheable can be allocated to the cache at any time, and so 
the cache invalidate instruction cannot ensure that the address is not present in a cache. 





Clean and Invalidate 


A cache clean and invalidate instruction behaves as the execution of a clean instruction followed 
immediately by an invalidate instruction. Both instructions are performed to the same location. 


The points to which a cache maintenance instruction can be defined differ depending on whether the instruction 
operates by VA or by set/way: 


° For instructions operating by set/way, the point is defined to be to the next level of caching. For the All 
operations, the point is defined as the Point of Unification for each location held in the cache. 


° For instruction operating by VA, two conceptual points are defined: 


Point of Coherency (PoC) 
The point at which all agents that can access memory are guaranteed to see the same copy of a 
memory location for accesses of any memory type or cacheability attribute. In many cases this is 
effectively the main system memory, although the architecture does not prohibit the 
implementation of caches beyond the PoC that have no effect on the coherency between memory 
system agents. 


Note 


The presence of system caches can affect the determination of the point of coherency as described 
in System level caches on page G4-5710. 








Point of Unification (PoU) 
The PoU for a PE is the point by which the instruction and data caches and the translation table 
walks of that PE are guaranteed to see the same copy of a memory location. In many cases, the 
Point of Unification is the point in a uniprocessor memory system by which the instruction and 
data caches and the translation table walks have merged. 
The PoU for an Inner Shareable Shareability domain is the point by which the instruction and 
data caches and the translation table walks of all the PEs in that Inner Shareable Shareability 
domain are guaranteed to see the same copy of a memory location. Defining this point permits 
self-modifying software to ensure future instruction fetches are associated with the modified 
version of the software by using the standard correctness policy of: 


1. Clean data cache entry by address. 
2; Invalidate instruction cache entry by address. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G4-5695 
ID070919 Non-Confidential 


The AArch32 System Level Memory Model 
G4.4 AArch32 cache and branch predictor support 


G4-5696 


The following fields in the CLIDR relate to these conceptual points: 


LoC, Level of Coherence 


This field defines the last level of cache that must be cleaned or invalidated when cleaning or 
invalidating to the Point of Coherency. The LoC value is a cache level, so, for example, if LoC 
contains the value 3: 


° A clean to the Point of Coherency operation requires the level 1, level 2 and level 3 caches 
to be cleaned. 
è Level 4 cache is the first level that does not have to be maintained. 


If the LoC field value is 0x0, this means that no levels of cache need to cleaned or invalidated 
when cleaning or invalidating to the Point of Coherency. 


If the LoC field value is a nonzero value that corresponds to a level that is not implemented, this 
indicates that all implemented caches are before the Point of Coherency. 
LoUU, Level of Unification, uniprocessor 


This field defines the last level of cache that must be cleaned or invalidated when cleaning or 
invalidating to the Point of Unification for the PE. As with LoC, the LoUU value is a cache level. 


If the LoUU field value is 0x0, this means that no levels of cache need to cleaned or invalidated 
when cleaning or invalidating to the Point of Unification. 


If the LoUU field value is a nonzero value that corresponds to a level that is not implemented, 
this indicates that all implemented caches are before the Point of Unification. 
LoUIS, Level of Unification, Inner Shareable 
In any implementation: 
e This field defines the last level of cache that must be cleaned or invalidated when cleaning 


or invalidating to the Point of Unification for the Inner Shareable Shareability domain. As 
with LoC, the LoUIS value is a cache level. 


° If the LoUIS field value is 0x0, this means that no levels of cache need to cleaned or 
invalidated when cleaning or invalidating to the Point of Unification for the Inner 
Shareable Shareability domain. 


e If the LoUIS field value is a nonzero value that corresponds to a level that is not 
implemented, this indicates that all implemented caches are before the Point of 
Unification. 


For more information, see the CLIDR description. 


The Armv8 abstraction of the cache hierarchy 


The following subsections describe the Armv8 abstraction of the cache hierarchy: 
s Cache maintenance instructions that operate by VA. 


. Cache maintenance instructions that operate by set/way on page G4-5697. 


Cache maintenance instructions that operate by VA 


The VA-based cache maintenance instructions are described as operating by VA. Each ofthese instructions is always 
qualified as being either: 


. Performed to the Point of Coherency. 
. Performed to the Point of Unification. 


See Terms used in describing the cache maintenance instructions on page G4-5694 for definitions of Point of 
Coherency and Point of Unification, and more information about possible meanings of VA. 


AArch32 cache and branch predictor maintenance instructions on page G4-5697 lists the VA-based maintenance 
instructions. 


The CTR holds minimum line length values for: 


. The instruction caches. 
° The data and unified caches. 
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These values support efficient invalidation of a range of addresses, because this value is the most efficient address 
stride to use to apply a sequence of VA-based maintenance instructions to a range of VAs. 


For the Invalidate data or unified cache line by VA instruction, the Cache Write-back Granule field of the CTR 
defines the maximum granule that a single invalidate instruction can invalidate. This meaning of the Cache 
Write-back Granule is in addition to its defining the maximum size that can be written back. 


Cache maintenance instructions that operate by set/way 


AArch32 cache and branch predictor maintenance instructions lists the set/way-based maintenance instructions. 
Some encodings of these instructions include a required field that specifies the cache level for the instruction: 


s A clean instruction cleans from the level of cache specified through to at least the next level of cache, moving 
further from the PE. 
° An invalidate instruction invalidates only at the level specified. 
G4.4.7 AArch32 cache and branch predictor maintenance instructions 


ARM DDI 0487E.a 
ID070919 


The instruction and data cache maintenance instructions have the same functionality in AArch32 state and in 
AArch64 state. Table G4-3 shows the AArch32 System instructions. Instructions that take an argument include Rt 
in the instruction description. 


AArch32 state also provides branch predictor maintenance instructions. 





Note 
° In Table G4-3 the Point of Unification is the Point of Unification of the PE executing the cache maintenance 
instruction. 
° In AArch32 state, all of the maintenance instructions are available from EL1 or higher. 
7 In AArch64 state, branch predictors are always invisible to software, and therefore AArch64 state does not 


provide any branch predictor maintenance instructions. 





Table G4-3 AArch32 System instructions for cache maintenance 





Register Instruction 


Instruction cache maintenance instructions 











ICIALLUIS Invalidate all to Point of Unification, Inner Shareable 
ICIALLU Invalidate all to Point of Unification 
ICIMVAU, Rt Invalidate by virtual address to Point of Unification 





Data cache maintenance instructions 























DCIMVAC, Rt Invalidate by virtual address to Point of Coherency 
DCISW, Rt Invalidate by set/way 
DCCMVAC, Rt Clean by virtual address to Point of Coherency 
DCCSW, Rt Clean by set/way 
DCCMVAU, Rt Clean by virtual address to Point of Unification 
DCCIMVAC, Rt Clean and invalidate by virtual address to Point of Coherency 
DCCISW, Rt Clean and invalidate by set/way 
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Table G4-3 AArch32 System instructions for cache maintenance (continued) 





Register Instruction 


Branch prediction maintenance instructions 











BPIMVA, Rt Invalidate the virtual address from the branch predictors 
BPIALLIS, Rt Invalidate all entries from branch predictors, Inner Shareable 
BPIALL, Rt Invalidate all entries from branch predictors 





A DSB or DMB instruction intended to ensure the completion of cache or branch predictor maintenance instructions 
must have an access type of both loads and stores. 


In an implementation where the branch predictors are architecturally invisible, the BPIMVA, BPIALLIS, and 
BPIALL instructions can execute as NOPs. 


The following subsections give more information about these instructions: 

s AArch32 instruction cache maintenance instructions (IC*). 

° AArch32 data cache maintenance instructions (DC*) on page G4-5699. 
. Branch predictors on page G4-5699. 


$ General requirements for the scope of cache and branch predictor maintenance instructions on 
page G4-5701. 


. Effects of instructions that operate by VA to the Point of Coherency on page G4-5701. 
. Effects of instructions that operate by VA but not to the Point of Coherency on page G4-5702. 
° Effects of All and set/way maintenance instructions on page G4-5702. 


° Effects of virtualization and security on the AArch32 cache maintenance instructions on page G4-5703. 
. Boundary conditions for cache maintenance instructions on page G4-5705. 

° Ordering of cache and branch predictor maintenance instructions on page G4-5705. 

° Performing cache maintenance instructions on page G4-5706. 


AArch32 instruction cache maintenance instructions (IC*) 


Where an address argument for these instructions is required, it takes the form of a 32-bit register that holds the 
virtual address argument. No alignment restrictions apply for this address. 


Any cache maintenance instruction operating by VA includes as part of any required VA to PA translation: 


: For an instruction executed at EL1, the current system ASID. 

° The current Security state. 

s Whether the instruction was performed from Hyp mode, or at EL1. 
° For an instruction executed at EL1, the VMID. 


That VA to PA translation might fault. However for an instruction cache maintenance instruction that operates by 
VA: 


7 It is IMPLEMENTATION DEFINED whether the operation can generate a Data Abort exception for a Translation 
fault or an Access flag fault. 


: The operation cannot generate a Data Abort exception for a Domain fault or a Permission fault, except for 
the Permission fault case on a Stage 2 fault on a stage 1 translation table walk. 


For more information about the possible faults on an instruction that operates by VA, see Types of MMU faults on 
page G5-5811. 


An instruction cache maintenance instruction can complete at any time after it is executed, but is only guaranteed 
to be complete, and its effects visible to other observers, following a DSB instruction executed by the PE that executed 
the cache maintenance instruction. See also the completion requirements for cache and branch predictor 
maintenance instructions in Completion and endpoint ordering on page E2-3819. 
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See also Ordering of cache and branch predictor maintenance instructions on page G4-5705. 


AArch32 data cache maintenance instructions (DC*) 
Data cache maintenance instructions that take a set/way/level argument take a 32-bit register. 


Ifa data cache maintenance by set/way instruction specifies a set, way, or level argument that is larger than the value 
supported by the implementation then the instruction is CONSTRAINED UNPREDICTABLE, see Out of range values of 
the Set/Way/Index fields in cache maintenance instructions on page K1-7619 or the instruction description. 


DCIS W instructions executed at EL1 perform a clean and invalidate, meaning it performs the same maintenance as 
a DCCISW instruction, if all of the following apply: 


s EL2 is implemented and enabled in the current Security state. 
s Either: 
— El2 is using AArch32 and the value of HCR.SWIO is 1. 
—  EL2 is using AArch64 and the value of HCR_EL2.SWIO is 1. 


Where an address argument for these instructions is required, it takes the form of a 32-bit register that holds the 
virtual address argument. No alignment restrictions apply for this address. 


Any cache maintenance instruction operating by VA includes as part of any required VA to PA translation: 


è For an instruction executed at EL1, the current system ASID. 

. The current Security state. 

à Whether the instruction was performed from Hyp mode, or from EL1. 
° For an instruction executed from EL1, the VMID. 


That VA to PA translation might fault. However a data or unified cache maintenance instruction that operates by VA 
cannot generate a Data Abort exception for a Domain fault, and cannot generate a Data Abort exception for a 
Permission fault, except for the Permission fault case on a Stage 2 fault on a stage 1 translation table walk. 


For more information about the possible faults on an instruction that operates by VA, see Types of MMU faults on 
page G5-5811. 


DCIMVAC and DCISW instructions executed at EL1 perform a clean and invalidate, meaning they perform the 
same maintenance as a DCCIMVAC or DCCISW instruction respectively, if all of the following apply: 
è EL2 is implemented and enabled in the current Security state. 
s PL1&0 stage two address translation is enabled, meaning either: 
—  EL2 is using AArch32 and the value of HCR.VM is 1. 
—  EL2 is using AArch64 and the value of HCR_EL2.VM is 1. 


Ifa memory fault that sets FAR for the translation regime applicable for the cache maintenance instruction is 
generated from a data cache maintenance instruction, the FAR holds the address specified in the register argument 
of the instruction. 


See also Ordering of cache and branch predictor maintenance instructions on page G4-5705. 


Branch predictors 


In AArch32 state it is IMPLEMENTATION DEFINED whether branch prediction is architecturally visible. This means 
that under some circumstances software must perform branch predictor maintenance to avoid incorrect execution 
caused by out-of-date entries in the branch predictor. For example, to ensure correct operation it might be necessary 
to invalidate branch predictor entries on a change to instruction memory, or a change of instruction address mapping. 
For more information, see Specific requirements for branch predictor maintenance instructions on page G4-5700. 


In an implementation where the branch predictors are architecturally invisible, the branch predictor maintenance 
instructions can execute as NOPs. 


An invalidate all operation on the branch predictor ensures that any location held in the branch predictor has no 
functional effect on execution. An invalidate branch predictor by VA instruction operates on the address of the 
branch instruction, but can affect other branch predictor entries. 
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Note 


The architecture does not make visible the range of addresses in a branch predictor to which the invalidate operation 
applies. This means the address used in the invalidate by VA operation must be the address of the branch to be 
invalidated. 





If branch prediction is architecturally visible, an instruction cache invalidate all operation also invalidates all branch 
predictors. 


See also Ordering of cache and branch predictor maintenance instructions on page G4-5705. 


Specific requirements for branch predictor maintenance instructions 


If, for a given translation regime and a given ASID and VMID as appropriate, the instructions at any virtual address 
change, then branch predictor maintenance instructions must be performed to invalidate entries in the branch 
predictor, to ensure that the change is visible to subsequent execution. This maintenance is required when writing 
new values to instruction locations. It can also be required as a result of any of the following situations that change 
the translation ofa virtual address to a physical address, if, as a result of the change to the translation, the instructions 
at the virtual addresses change: 


° For any translation regime other than the Non-secure PL1 &0 translation regime, enabling or disabling stage 1 
translations. 
° For the Non-secure PL1&0 translation regime: 


— When stage 2 translations are enabled, enabling or disabling stage 1 translations unless accompanied 
by a change of VMID. 


— When stage 2 translations are disabled, enabling or disabling stage 1 translations. 


— Enabling or disabling stage 2 translations. 
. Writing new mappings to the translation tables. 


. Any change to the TTBRO, TTBR1, or TTBCR registers, unless: 


— Fora change to the Secure PL1&0 translation regime, the change is accompanied by a change to the 
ASID. 


— Forachange to the stage 1 translations of the Non-secure PL1&0 translation regime, the change is 
accompanied by a change to the ASID or a change to the VMID. 


a Any change to the VTTBR or VTCR registers, unless accompanied by a change to the VMID. 





Note 


Invalidation is not required if the changes to the translations are such that the instructions associated with the 
non-faulting translations of a virtual address, for a given translation regime and a given ASID and VMID, as 
appropriate, remain unchanged throughout the sequence of changes to the translations. Examples of translation 
changes to which this applies are: 

7 Changing a valid translation to a translation that generates an MMU fault. 


° Changing a translation that generates an MMU fault to a valid translation. 





Failure to invalidate entries might give CONSTRAINED UNPREDICTABLE results, caused by the execution of old 
branches. For more information, see Ordering of cache and branch predictor maintenance instructions on 
page G4-5705. 


Note 


è In Armv§8, there is no requirement to use the branch predictor maintenance operations to invalidate the branch 
predictor after: 


— Changing the ContextID or VMID. 
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— A cache maintenance instruction that is identified as also flushing the branch predictors, see AArch32 
cache and branch predictor maintenance instructions on page G4-5697. 





Cache maintenance system instructions on page K 14-7861 shows the branch predictor maintenance operations in a 
VMSA implementation. 


Behavior of the branch predictors at reset 


In AArch32 state: 


a If branch predictors are not architecturally invisible: 
— The branch predictors reset to an IMPLEMENTATION DEFINED state that might be UNKNOWN. 
— The branch predictors are disabled at reset. 


z An implementation can require the use of a specific branch predictor initialization routine to invalidate the 
branch predictor storage array before it is enabled. The exact form of any required initialization routine is 
IMPLEMENTATION DEFINED, but the routine must be documented clearly as part of the documentation of the 
device. 


è Arm recommends that whenever an invalidation routine is required, it is based on the AArch32 branch 
predictor maintenance operations. 


Similar rules apply: 
: To cache behavior, see Behavior of caches at reset on page G4-5693. 
s To TLB behavior, see TLB behavior at reset on page G5-5790. 


General requirements for the scope of cache and branch predictor maintenance 
instructions 


The Armv8 specification of the cache maintenance and branch predictor instructions describes what each instruction 
is guaranteed to do in a system. It does not limit other behaviors that might occur, provided they are consistent with 
the requirements described in General behavior of the caches on page G4-5687, Behavior of caches at reset on 
page G4-5693, and Preloading caches on page E2-3832. 


This means that as a side-effect of a cache maintenance instruction: 
° Any location in the cache might be cleaned. 
. Any unlocked location in the cache might be cleaned and invalidated. 


As a side-effect of a branch predictor maintenance instruction, any entry in the branch predictor might be 
invalidated. 


Note 
Arm recommends that, for best performance, such side-effects are kept to a minimum. Arm strongly recommends 
that the side-effects of operations performed in Non-secure state do not have a significant performance impact on 
execution in Secure state. 








Effects of instructions that operate by VA to the Point of Coherency 


For Normal memory that is not Inner Non-cacheable, Outer Non-cacheable, these instructions must affect the caches 
of other PEs in the Shareability domain described by the Shareability attributes of the VA supplied with the 
instruction. 


For Device memory and Normal memory that is Inner Non-cacheable, Outer Non-cacheable, these instructions must 
affect the caches of all PEs in the Outer Shareable Shareability domain of the PE on which the instruction is 
operating. 
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In all cases, for any affected PE, these instructions affect all data and unified caches to the Point of Coherency. 


Table G4-4 PEs affected by cache maintenance instructions to the Point of Coherency 





Shareability 


PEs affected Effective to 





Non-shareable 


The PE performing the operation The Point of Coherency of the entire system 





Inner Shareable 


All PEs in the same Inner Shareable Shareability domain as the The Point of Coherency of the entire system 
PE performing the operation 





Outer Shareable 


All PEs in the same Outer Shareable Shareability domain asthe The Point of Coherency of the entire system 
PE performing the operation 





Effects of instructions that operate by VA but not to the Point of Coherency 


The following instruction operate by VA but not to the Point of Coherency: 

$ Clean data or unified cache line by MVA to the Point of Unification, DCCMVAU. 
7 Invalidate instruction cache line by MVA to Point of Unification, ICIMVAU. 

: Invalidate by MVA from branch predictors, BPIMVA. 


For these instructions, Table G4-5 shows how, for a VA in a Normal or Device memory location, the Shareability 
attribute of the VA determines the minimum set of PEs affected, and the point to which the instruction must be 
effective. 


Table G4-5 PEs affected by cache maintenance instructions to the Point of Unification 





Shareability 


PEs affected Effective to 





Non-shareable 


The PE executing the instruction The Point of Unification of instruction cache fills, data cache fills and 
write-backs, and translation table walks, on the PE executing the instruction 





Inner Shareable 
or 
Outer Shareable 


All PEs in the same Inner The Point of Unification of instruction cache fills, data cache fills and 
Shareable Shareability domain write-backs, and translation table walks, of all PEs in the same Inner 
as the PE executing the Shareable Shareability domain as the PE executing the instruction 
instruction 





G4-5702 





Note 


The set of PEs guaranteed to be affected is never greater than the PEs in the Inner Shareable Shareability domain 
containing the PE executing the instruction. 





Effects of All and set/way maintenance instructions 


The ICIALLU, BPIALL and DC* set/way instructions apply only to the caches and branch predictors of the PE that 
performs the instruction. If the branch predictors are architecturally-visible, ICIALLU also performs a BPIALL 
operation. 


The ICIALLUIS and BPIALLIS instructions can affect the caches and branch predictors of all PEs in the same Inner 
Shareable Shareability domain as the PE that performs the instruction. If the branch predictors are 
architecturally-visible, ICIALLUIS also performs a BPIALLIS operation. These instructions have an effect to the 
Point of Unification of instruction cache fills, data cache fills, and write-backs, and translation table walks, of all 
PEs in the same Inner Shareable Shareability domain. 


Note 


The possible presence of system caches, as described in System level caches on page G4-5710, means architecture 
does not guarantee that all levels of cache can be maintained using set/way instructions. 
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Effects of virtualization and security on the AArch32 cache maintenance instructions 


Each Security state has its own physical address space, and therefore cache entries are associated with physical 
address space. In addition, cache maintenance and branch predictor instructions performed in Non-secure state have 
to take account of: 


s Whether the instruction was performed at EL1 or at EL2. 


$ For instructions that operate by VA, the current VMID. 


Table G4-6 shows the effects of virtualization and security on these maintenance instructions. 


Table G4-6 Effects of virtualization and security on the AArch32 cache maintenance instructions 





Cache maintenance 
instructions 


Security 


state Specified entry 





Data or unified cache maintenance instructions 





Invalidate, Clean, or Clean 
and Invalidate by VA: 
DCIMVAC, DCCMVAC, 
DCCMVAU, DCCIMVAC 


Either All lines that hold the PA that, in the current translation regime, are mapped to by 
the combination of all of: 


° The specified VA. 


. For an instruction executed at EL1, the current ASID if the location is 
mapped to by a non-global page. 


e For an instruction executed at EL1, the current VMID2. 





Invalidate, Clean, or Clean 


Non- secure Line specified by set/way provided that the entry comes from the Non-secure PA 














and Invalidate by set/way: space. 

DCISW, DCCSW, 7 7 

DCCISW Secure Line specified by set/way regardless of the PA space that the entry has come from. 
Instruction cache maintenance instructions 

Invalidate by VA: Either All lines corresponding to the specified VAP in the current translation regime and: 

ICIMVAU ° For an instruction executed at EL1 or ELO, the current ASID. 

. For an instruction executed at EL1 or ELO, the current VMID2. 
Invalidate All: ICIALLU, ` Can invalidate any unlocked entry in the instruction cache. 
ICIALLUIS a Are required to invalidate any entries relevant to the software component that 


executed it. The Non-secure and Secure descriptions give more information: 
Non-secure 


An instruction executed at EL1 must operate on all instruction 
cache lines that contain entries associated with the current virtual 
machine, meaning any entry with the current VMID.? 

An instruction executed at EL2 must operate on all instruction 
cache lines that contain entries that can be accessed from 
Non-secure state. 


Secure The instruction must invalidate all instruction cache lines. 





Branch predictor instructions® 





Invalidate by VA: BPIMVA 


Either All lines that, in the current translation regime, are mapped to by the combination 
of: all of: 


° The specified VA. 


° For an instruction executed at EL1 or ELO, the current ASID if the location 
is mapped to by a non-global page. 


. For an instruction executed at EL1 or ELO, the current VMID@. 





Invalidate all: BPIALL, 
BPIALLIS 


° Can invalidate any unlocked entry in the branch predictor. 


e Are required to invalidate any entries relevant to the software component that executed it. 
The Non-secure and Secure descriptions give more information. 
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a. 


c. 


Dependencies on the VMID apply even when either EL2 is using AArch32 and the value of HCR.VM is 0 or EL2 is using AArch64 when 
enabled for the current Security state, and the value of HCR_EL2.VM is 0. If the PE resets into an Exception level that is using AArch32, 
VTTBR.VMID resets to zero, meaning there is a valid VMID from reset. However, if the PE resets into an Exception level that is using 
AArch64, VTTBR_EL2.VMID resets to a value that is architecturally UNKNOWN, and the VTTBR_EL2.VMID field must be set to a known 
value, that might be zero, as part of the PE initialization sequence. 


The type of instruction cache used affects the interpretation of the specified entries in this table such that: 
£ For a PIPT instruction cache, the cache maintenance applies to all entries whose physical address corresponds to the specified address. 
C Fora VIPT instruction cache, the cache maintenance applies to entries whose virtual index and physical tag corresponds to the specified 


address. 


For information of types of instruction cache, see Jnstruction caches on page G5-5807. 


In an implementation where the branch predictors are architecturally invisible, these instructions can execute as NOPs. 


For locked entries and entries that might be locked, the behavior of cache maintenance instructions described in The 
interaction of cache lockdown with cache maintenance instructions on page G4-5709 applies. 


With an implementation that generates aborts if entries are locked or might be locked in the cache, when the use of 
lockdown aborts is enabled, these aborts can occur on any cache maintenance instructions. 


In an implementation that includes EL2: 


The architecture does not require cache cleaning when switching between virtual machines. Cache 
invalidation by set/way must not present an opportunity for one virtual machine to corrupt state associated 
with a second virtual machine. To ensure this requirement is met, EL1 invalidate by set/way instructions 
executed in at EL1 when HCR_EL2.VM or HCR.VM is 1 and EL2 is enabled can, instead, perform a clean 
and invalidate by set/way. 


The AArch32 Data cache invalidate instructions DCIMVAC and DCISW perform a cache clean as well as a 

cache invalidate, meaning DCIMVAC performs the same invalidation as a DCCIMVAC instruction, and 

DCISW performs the same invalidation as a DCCISW instruction, if both of the following apply: 

—  EL2is using AArch32, the value of HCR.VM is 1, and the instruction is executed at Non-secure EL1. 

— EL2 is using AArch64, the value of HCR_EL2.VM is 1, EL2 is enabled, and the instruction is 
executed at EL1. 


The AArch32 Data cache invalidate by set/way instruction DCISW performs a cache clean as well as a cache 

invalidate, meaning it performs the same invalidation as a DCCISW instruction, if either of the following 

apply: 

— EL2 is using AArch32, the value of HCR.SWIO is 1, and the instruction is executed at Non-secure 
ELI. 

— EL2is using AArch64, the value of HCR_EL2.SWIO is 1, EL2 is enabled, and the instruction is 
executed at EL1. 


TLB and instruction cache invalidate instructions are broadcast across the Inner Shareable domain when 
either: 


—  EL2 is using AArch32, the value of HCR.FB is 1, and execution is at Non-secure EL1. 


—  EL2 is using AArch64, the value of HCR_EL2.FWB is 1, EL2 is enabled, and the instruction is 
executed at EL1. 


When EL1 is using AArch32, this applies to the TLBIMVA, TLBIASID, TLBIMVAA, TLBIMVAL, 
TLBIMVAAL, and ICIALLU instructions. This means the instruction performs the invalidation that would 
be performed by the corresponding Inner Shareable instruction, for example ICIALLU performs the 
invalidation that would be performed by ICIALLUIS, and BPIALL performs the invalidation that would be 
performed by BPIALLIS. 


For more information about the cache maintenance instructions, see About cache maintenance in AArch32 state on 
page G4-5693, AArch32 cache and branch predictor maintenance instructions on page G4-5697, and Chapter G5 
The AArch32 Virtual Memory System Architecture. 


G4-5704 
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Boundary conditions for cache maintenance instructions 


Cache maintenance instructions operate on the caches regardless of whether the System register Cacheability 
controls force all memory accesses to be Non-cacheable. 


For VA-based cache maintenance instructions, the instructions operate on the caches regardless of the memory type 
and cacheability attributes marked for the memory address in the VMSA translation table entries. This means that 
the effects of the cache maintenance instructions can apply regardless of: 


Whether the address accessed: 
— Is Normal memory or Device memory. 


— Has the Cacheable attribute or the Non-cacheable attribute. 
Any applicable domain control of the address accessed. 


The access permissions for the address accessed, other than the effect of the stage two write permission on 
data or unified cache invalidation instructions. 


Ordering of cache and branch predictor maintenance instructions 


The following rules describe the effect of the memory order model on the cache and branch predictor maintenance 
instructions: 


All cache and branch predictor maintenance instructions that do not specify an address execute, relative to 
each other, in program order. 


All cache and branch predictor instructions that specify an address: 


— Execute in program order relative to all cache and branch predictor operations that do not specify an 
address. 


— Execute in program order relative to all cache and branch predictor operations that specify the same 
address. 


— Can execute in any order relative to cache and branch predictor operations that specify a different 
address. 


Where a cache maintenance or branch predictor instruction appears in program order before a change to the 
translation tables, the architecture guarantees that the cache or branch predictor maintenance instruction uses 
the translations that were visible before the change to the translation tables. 


Where a change of the translation tables appears in program order before a cache maintenance or branch 
predictor instruction, software must execute the sequence outlined in Ordering and completion of TLB 
maintenance instructions on page G5-5796 before performing the cache or branch predictor maintenance 
instruction, to ensure that the maintenance operation uses the new translations. 


A DMB instruction causes the effect of all data or unified cache maintenance instructions appearing in program 
order before the DMB to be visible to all explicit load and store operations appearing in program order after the 
DMB. 


Also, a DMB instruction ensures that the effects of any data or unified cache maintenance instruction appearing 
in program order before the DMB are observable by any observer in the same required Shareability domain 
before any data or unified cache maintenance or explicit memory operations appearing in program order after 
the DMB are observed by the same observer. Completion of the DMB does not guarantee the visibility of all data 
to other observers. For example, all data might not be visible to a translation table walk, or to instruction 
fetches. 


A DSB is required to guarantee the completion of all cache maintenance instruction that appear in program 
order before the DSB instruction. 


A Context synchronization event is required to guarantee the effects of any branch predictor maintenance 
operation. This means a Context synchronization event causes the effect of all completed branch predictor 
maintenance operations appearing in program order before the Context synchronization event to be visible to 
all instructions after the Context synchronization event. 
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This means that, ifa branch instruction appears after an invalidate branch predictor operation and before any 
Context synchronization event, it is CONSTRAINED UNPREDICTABLE whether the branch instruction is affected 
by the invalidate. Software must avoid this ordering of instructions, because it might cause CONSTRAINED 
UNPREDICTABLE behavior. 


è Any data or unified cache maintenance instruction by VA must be executed in program order relative to any 
explicit load or store on the same PE to an address covered by the VA of the cache instruction if that load or 
store is to Normal Cacheable memory. The order of memory accesses that result from the cache maintenance 
instruction, relative to any other memory accesses to Normal Cacheable memory, are subject to the memory 
ordering rules. For more information, see Definition of the Armv8 memory model on page E2-3814. 


Any data or unified cache maintenance instruction by VA can be executed in any order relative to any explicit 
load or store on the same PE to an address covered by the VA of the cache maintenance instruction if that 
load or store is not to Normal Cacheable memory. 


° There is no restriction on the ordering of data or unified cache maintenance instruction by VA relative to any 
explicit load or store on the same PE where the address of the explicit load or store is not covered by the VA 
of the cache instruction. Where the ordering must be restricted, a DMB instruction must be inserted to enforce 
ordering. 


e There is no restriction on the ordering ofa data or unified cache maintenance instruction by set/way relative 
to any explicit load or store on the same PE. Where the ordering must be restricted, a DMB instruction must be 
inserted to enforce ordering. 


5 Software must execute a Context synchronization event after the completion of an instruction cache 
maintenance instruction, to guarantee that the effect of the maintenance instruction is visible to any 
instruction fetch. 


A DSB or DMB instruction intended to ensure the completion of cache maintenance instructions or branch predictor 
instructions must have an access type of both loads and stores. 


See also the completion requirements for cache and branch predictor maintenance instructions in Completion and 
endpoint ordering on page E2-3819. 


The scope of instruction cache maintenance depends on the type of the instruction cache. For more information see 
Instruction caches on page G5-5807. 


Example G4-1 Cache cleaning operations for self-modifying code 


The sequence of cache cleaning operations for a line of self-modifying code on a uniprocessor system is: 


; Coherency example for data and instruction accesses within the same Inner Shareable domain. 
; Enter this code with <Rt> containing a new 32-bit instruction, 

; to be held in Cacheable space at a location pointed to by Rn. Use STRH in the first line 

; instead of STR for a 16-bit instruction. 


STR Rt, [Rn] 

DCCMVAU Rn ; Clean data cache by MVA to point of unification (PoU) 
DSB ; Ensure visibility of the data cleaned from cache 
ICIMVAU Rn ; Invalidate instruction cache by MVA to PoU 

BPIMVA Rn ; Invalidate branch predictor by MVA to PoU 

DSB ; Ensure completion of the invalidations 

ISB ; Synchronize the fetched instruction stream 


Performing cache maintenance instructions 


To ensure all cache lines in a block of address space are maintained through all levels of cache Arm strongly 
recommends that software: 


° For data or unified cache maintenance, uses the CTR.DMinLine value to determine the loop increment size 
for a loop of data cache maintenance by VA instructions. 
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° For instruction cache maintenance, uses the CTR.IMinLine value to determine the loop increment size for a 
loop of instruction cache maintenance by VA instructions. 


Example code for cache maintenance instructions 


The cache maintenance instructions by set/way can be used to clean or invalidate, or both, the entirety of one or 
more levels of cache attached to a PE. However, unless all PEs attached to the caches regard all memory locations 
as Non-cacheable, it is not possible to prevent locations being allocated into the cache during such a sequence of 
the cache maintenance instructions. 


Note 


Because the set/way instructions operate only locally, there is no guarantee of the atomicity of cache maintenance 
between different PEs, even if those different PEs are each executing the same cache maintenance instructions at 
the same time. Because any cacheable line can be allocated into the cache at any time, it is possible for a cache line 
to migrate from an entry in the cache of one PE to the cache of a different PE in a way that means the cache line is 
not affected by set/way based cache maintenance. Therefore, Arm strongly discourages the use of set/way 
instructions to manage coherency in coherent systems. The expected use of the cache maintenance instructions that 
operate by set/way is limited to the cache maintenance associated with the powerdown and powerup of caches, if 
this is required by the implementation. 





The limitations of cache maintenance by set/way mean maintenance by set/way does not happen on multiple PEs, 
and cannot be made to happen atomically for each address on each PE. Therefore in multiprocessor or multithreaded 
systems, the use of cache maintenance by set/way to clean, or clean and invalidate, the entire cache for coherency 
management with very large buffers or with buffers with unknown address can fail to provide the expected 
coherency results because of speculation by other PEs, or possibly by other threads. The only way that these 
instructions can be used in this way is to first ensure that all PEs that might cause speculative accesses to caches that 
need to be maintained are not capable of generating speculative accesses. This can be achieved by ensuring that 
those PEs have no memory locations with a Normal Cacheable attribute. Such an approach can have very large 
system performance effects, and Arm advises implementers to use hardware coherency mechanisms in systems 
where this will be an issue. 


System level caches on page G4-5710 refers to other limitations of cache maintenance by set/way. 





The following example code for cleaning a data or unified cache to the Point of Coherency illustrates a generic 
mechanism for cleaning the entire data or unified cache to the Point of Coherency. It assumes the current Cache Size 
Identification Register is in 32-bit format. For more information, see Possible formats of the Cache Size 
Identification Registers, CCSIDR and CCSIDR2 on page G4-5689. 


RC p15, 1, RO, c@, c0, 1 ; Read CLIDR into RO 
ANDS R3, RO, #0x07000000 


OV R3, R3, LSR #23 ; Cache level value (naturally aligned) 
BEQ Finished 
OV R10, #0 
Loop1 
ADD R2, R10, R10, LSR #1 ; Work out 3 x cache level 
OV R1, RO, LSR R2 ; bottom 3 bits are the Cache type for this level 
AND R1, R1, #7 ; get those 3 bits alone 
CMP R1, #2 
BLT Skip ; no cache or only instruction cache at this level 


CR p15, 2, R10, c0, c0, © ; write CSSELR from R10 

ISB ISB to sync the change to the CCSIDR 
RC p15, 1, R1, c0, c0, @ ; read current CCSIDR to R1 

AND R2, R1, #7 ; extract the line length field 











ADD R2, R2, #4 ; add 4 for the line length offset (log2 16 bytes) 

OV R4, #0x3FF 

ANDS R4, R4, R1, LSR #3 ; R4 is the max number on the way size (right aligned) 

CLZ R5, R4 ; R5 is the bit position of the way size increment 

OV R9, R4 ; R9 working copy of the max way size (right aligned) 
Loop2 

OV R7, #0x00007FFF 

ANDS R7, R7, R1, LSR #13 ; R7 is the max number of the index size (right aligned) 
Loop3 

ORR R11, R10, R9, LSL R5 ; factor in the way number and cache number into R11 
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Skip 


ADD R10, R10, #2 
CMP R3, R10 

DSB 

BGT Loop1 


ORR R11, R11, R7, LSL R2 ; factor in the index number 
MCR p15, @, R11, c7, c10, 2 ; DCCSW, clean by set/way 
SUBS R7, R7, #1 
BGE Loop3 

SUBS R9, R9, #1 
BGE Loop2 


decrement the index 


decrement the way number 


increment the cache number 


ensure completion of previous cache maintenance instruction 


Finished 


Similar approaches can be used for all cache maintenance instructions. 


Execution and data prediction restriction System instructions 


When ARMv8.0-PredInv is implemented, the System instructions in Table G4-7 prevent predictions based on 
information gathered from earlier execution within a particular execution context from affecting the later 
Speculative execution within that context, to the extent that the speculation execution is observable through 
side-channels. 


The prediction restriction System instructions being used by a particular execution context apply to: 


All control flow prediction resources that predict execution addresses. 
Data value prediction. 


Cache allocation prediction. 


Table G4-7 Prediction restriction System instructions 


Register Instruction 





CFPRCTX Control Flow Prediction Restriction by Context 





CPPRCTX Cache Prefetch Prediction Restriction by Context 





DVPRCTX Data Value Prediction Restriction by Context 





For these System instructions, the execution context is defined by: 


The Security state. 
The Exception level. 
When executing at EL1, the VMID. 


When executing at ELO when using the PL1&0 translation regime, the ASID and VMID. 


Note 





The data value prediction applies to all prediction resources that use some form of training to speculate data 
values as part of an execution. 


The cache allocation applies to all instruction and data caches, and TLB prefetching hardware used by the 
executing PE that applies to the supplied context. 





The context information is passed as a register argument, and is restricted so that: 


Execution of the System instruction at ELO only applies to the current hardware defined context. 


Execution of the System instruction at EL1only applies to the current VMID and Security state, and does not 
apply to EL2 or EL3. 
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s Execution of the System instruction at EL2 can only apply to the current Security state, and does not apply 
to EL3. 


Ifthe System instruction is specified to apply to Exception levels that are not implemented, or which are higher than 
the Exception level that the System instruction is executed at, then the System instruction is treated as a NOP. 


When the System instruction is complete and synchronized, no predictions of the restricted type for the affected 
context are influenced by the execution of the program before the System instruction in a manner that can be 
observed by the use of any side channels. 


Note 


Prediction restriction System instructions do not require the invalidation of prediction structures so long as the 
behavior described for completion is met by an implementation. 








These System instructions are guaranteed to be complete following a DSB that covers both read and write behavior 
on the same PE that executed the original instruction. A subsequent Context synchronization event is required to 
ensure that the effect of the completion of the instructions is synchronized to the current execution. 


In AArch32 state, ELO access to the System instructions is controlled by SCTLR.EnRCTX. 


G4.4.9 Cache lockdown 


The concept of an entry locked in a cache is allowed, but not architecturally defined. How lockdown is achieved is 
IMPLEMENTATION DEFINED and might not be supported by: 


. An implementation. 


. Some memory attributes. 


An unlocked entry in a cache might not remain in that cache. The architecture does not guarantee that an unlocked 
cache entry remains in the cache or remains incoherent with the rest of memory. Software must not assume that an 
unlocked item that remains in the cache remains dirty. 


A locked entry in a cache is guaranteed to remain in that cache. The architecture does not guarantee that a locked 
cache entry remains incoherent with the rest of memory, that is, it might not remain dirty. 


The interaction of cache lockdown with cache maintenance instructions 


The interaction of cache lockdown and cache maintenance instructions is IMPLEMENTATION DEFINED. However, an 
architecturally-defined cache maintenance instruction on a locked cache line must comply with the following 
general rules: 


. The effect of the following instructions on locked cache entries is IMPLEMENTATION DEFINED: 
— Cache clean by set/way, DCCSW. 
— Cache invalidate by set/way, DCISW. 
— Cache clean and invalidate by set/way, DCISW. 
— Instruction cache invalidate all, ICIALLU and ICIALLUIS. 


However, one of the following approaches must be adopted in all these cases: 


l. If the instruction specified an invalidation, a locked entry is not invalidated from the cache. 
2; If the instruction specified a clean it is IMPLEMENTATION DEFINED whether locked entries are cleaned. 
3. If an entry is locked down, or could be locked down, an IMPLEMENTATION DEFINED Data Abort 


exception is generated, using the Fault status code defined for this purpose. See Data Abort exception 
on page G1-5547. 


This permits a usage model for cache invalidate routines to operate on a large range of addresses by 
performing the required operation on the entire cache, without having to consider whether any cache entries 
are locked. 


The effect of the following instructions is IMPLEMENTATION DEFINED: 
è Cache clean by virtual address, DCCMVAC and DCCMVAU. 
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: Cache invalidate by virtual address, DCIM VAC. 
. Cache clean and invalidate by virtual address, DCCIMVAC. 


However, one of the following approaches must be adopted in all these cases: 


1. If the instruction specified an invalidation, a locked entry is invalidated from the cache. For the clean and 
invalidate instructions, the entry must be cleaned before it is invalidated. 


2. If the instruction specified an invalidation, a locked entry is not invalidated from the cache. If the instruction 
specified a clean it is IMPLEMENTATION DEFINED whether locked entries are cleaned. 


3; If an entry is locked down, or could be locked down, an IMPLEMENTATION DEFINED Data Abort exception is 
generated, using the Fault status code defined for this purpose. See DFSR or HSR. 


In an implementation that includes EL2, if HCR.TIDCP is set to 1, any exception relating to lockdown of an entry 
associated with Non-secure memory is routed to EL2. 





Note 


An implementation that uses an abort mechanism for entries that can be locked down but are not actually locked 
down must: 


$ Document the IMPLEMENTATION DEFINED instruction sequences that perform the required operations on 
entries that are not locked down. 


s Implement one of the other permitted alternatives for the locked entries. 


Arm recommends that, when possible, such IMPLEMENTATION DEFINED instruction sequences use 
architecturally-defined instructions. This minimizes the number of customized instructions required. 


In addition, an implementation that uses an abort to handle cache maintenance instructions for entries that might be 
locked must provide a mechanism that ensures that no entries are locked in the cache. 


The reset setting of the cache must be that no cache entries are locked. 





Additional cache functions for the implementation of lockdown 


An implementation can add additional cache maintenance functions for the handling of lockdown in the 
IMPLEMENTATION DEFINED space. 


G4.4.10 System level caches 


The Arm Architecture defines a system cache as a cache that is not described in the PE Cache Identification 
registers, CCSIDR, CCSIDR2, and CLIDR, and for which the set/way cache maintenance instructions do not apply. 


Conceptually, three classes of system cache can be envisaged: 


1. System caches which lie before the point of coherency and cannot be managed by cache maintenance 
instructions. Such systems fundamentally undermine the concept of cache maintenance instructions 
operating to the point of coherency, as they imply the use of non-architecture mechanisms to manage 
coherency. The use of such systems in the Arm architecture is explicitly prohibited. 


2; System caches which lie before the point of coherency and can be managed by cache maintenance by address 
instructions that apply to the point of coherency, but cannot be managed by cache maintenance by set/way 
instructions. Where maintenance of the entire system cache must be performed, as is the case for power 
management, it must be performed using non-architectural mechanisms. 


3. System caches which lie beyond the point of coherency and so are invisible to software. The management of 
such caches is outside the scope of architecture. 
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G4.5 System register support for IMPLEMENTATION DEFINED memory features 


The VMSAv8-32 defines the following registers for describing IMPLEMENTATION DEFINED features of the memory 
system: 


ARM DDI 0487E.a 
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The TCM Type Register, T[CMTR must be implemented on any implementation where EL1 or above supports 
AArch32. The format of this register is IMPLEMENTATION DEFINED. 


The System register encoding space with {coproc==0b1111, CRn==c9, CRm== {cO-c2, c5-c7}} is 
IMPLEMENTATION DEFINED for all values of opc2 and opc1. This space is reserved for branch predictor, cache 
and TCM functionality, for example maintenance, override behaviors and lockdown. 


In a VMSAv8-32 implementation, part of the System register encoding space with {coproc==0b1111, 
CRn==c10} is IMPLEMENTATION DEFINED and reserved for TLB functionality, see TLB lockdown on 
page G5-5791. 


The System register encoding space with {coproc==0b1111, CRn==c11, CRm== {c0-c8, c15}} is 
IMPLEMENTATION DEFINED for all values of opc2 and opc1. This space is reserved for DMA operations to and 
from the TCMs. 


In addition, the System register encoding space with {coproc==0b1111, CRn==c15}is reserved for 
IMPLEMENTATION DEFINED registers, and can provide additional registers for the memory system. For more 
information, see VMSAv8-32 organization of registers in the (coproc==O0b1111) encoding space on page G7-5874. 
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G4.6 External aborts 


The Arm architecture defines External aborts as errors that occur in the memory system, other than those that are 
detected by the MMU or Debug hardware. An External abort might signal a data corruption to the PE. For example, 
a memory location might have been corrupted, and this corruption is detected by hardware using a parity or error 
correction code (ECC). The error might have been propagated. The RAS Extension provides mechanisms for 
software to determine the extent of the corruption and contain propagation of the error. For more information, see 
the ARM” Reliability, Availability, and Serviceability (RAS) Specification, ARMV8, for the ARMvS8-A architecture 
profile. 


An External abort is one of: 


. Synchronous. 
. Precise asynchronous. 
° Imprecise asynchronous. 


For more information, see Exception terminology on page G1-5472. 


The RAS Extension provides an expanded taxonomy for describing aborts. When the RAS Extension is not 
implemented, the Arm architecture does not provide any method to distinguish between precise asynchronous and 
imprecise asynchronous External aborts. 


VMSAv8-32 permits External aborts on data accesses, translation table walks, and instruction fetches to be either 
synchronous or asynchronous. The reported fault code identifies whether the External abort is synchronous or 
asynchronous. 


It is IMPLEMENTATION DEFINED which External aborts, if any, are supported. Asynchronous External aborts generate 
SError interrupt exceptions. 


In AArch32 state: 
$ SError interrupts are taken as asynchronous Data Abort exceptions. 
g Synchronous External aborts: 
— On data accesses are taken as synchronous Data Abort exceptions. 
— On instruction fetches, or prefetches, are taken as synchronous Prefetch Abort exceptions. 


See also: 
° External abort on a translation table walk on page G5-5818. 
. Handling exceptions that are taken to an Exception level using AArch32 on page G1-5501. 


Normally, External aborts are rare. An imprecise asynchronous External abort is likely to be fatal to the process that 
is running. Arm recommends that implementations make External aborts precise wherever possible. 


The following subsections give more information about possible External aborts: 
$ Provision for classification of External aborts. 


° Parity or ECC error reporting, RAS Extension not implemented on page G4-5713. 


The section Exception reporting in a VMSAv8-32 implementation on page G5-5822 describes the reporting of 
External aborts. 


G4.6.1 Provision for classification of External aborts 


G4-5712 


For an External abort taken to a privileged mode other than Hyp mode, an implementation can use the DFSR.ExT 
or IFSR.ExT bits to provide more information about the External abort: 


s DFSR.ExT provides an IMPLEMENTATION DEFINED classification of External aborts on data accesses. 
: IFSR.ExT provides an IMPLEMENTATION DEFINED classification of External aborts on instruction accesses. 


For an External abort taken to Hyp mode, the HSR.EA bit, provides an IMPLEMENTATION DEFINED classification of 
External aborts. 


For all aborts other than External aborts these bits return a value of 0. 
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If the RAS Extension is implemented: 

. The HSR.AET field provides information about the state of the PE following an SError interrupt exception 
taken to Hyp mode. 

e The DFSR.AET field provides information about the state of the PE following an asynchronous Data Abort 
exception. 


° The implementation might define error record registers. 


For more information on the RAS Extension, see ARM” Reliability, Availability, and Serviceability (RAS) 
Specification, ARMv8, for the ARMVv8-A architecture profile. 


G4.6.2 Parity or ECC error reporting, RAS Extension not implemented 


ARM DDI 0487E.a 
ID070919 


The Arm architecture supports the reporting of both synchronous and asynchronous parity or ECC errors from the 
cache systems. It is IMPLEMENTATION DEFINED what parity or ECC errors in the cache systems, if any, result in 
synchronous or asynchronous parity or ECC errors. 


A fault code is defined for reporting parity or ECC errors, see Exception reporting in a VMSAv8-32 implementation 
on page G5-5822. However when parity or ECC error reporting is implemented it is IMPLEMENTATION DEFINED 
whether a parity or ECC error is reported using the assigned fault code, or using another appropriate encoding. 


For all purposes other than the Fault status encoding, parity or ECC errors are treated as External aborts. 
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G4.7 Memory barrier instructions 


Memory barriers on page E2-3823 describes the memory barrier instructions. This section describes the system 


level controls of those instructions. 


G4.7.1 EL2 control of the Shareability of data barrier instructions executed at ELO or EL1 


In an implementation that includes EL2 and supports Shareability limitations on the data barrier instructions, the 
HCR.BSU field can modify the required Shareability of an instruction that is executed at ELO or EL1 in Non-secure 


state. Table G4-8 shows the encoding of this field: 


Table G4-8 EL2 control of Shareability of barrier instructions executed at ELO or EL1 





HCR.BSU Minimum Shareability of barrier instructions 














00 No effect, Shareability is as specified by the instruction 
01 Inner Shareable 

10 Outer Shareable 

11 Full system 





For an instruction executed at ELO or EL1 in Non-secure state, Table G4-9 shows how the HCR.BSU is combined 
with the Shareability specified by the argument of the DMB or DSB instruction to give the scope of the instruction: 


Table G4-9 Effect of the HCR_EL2.BSU on barrier instructions executed at Non-secure EL1 or EL1 











Shareability specified by the DMB or DSB argument HCR.BSU Resultant Shareability 
Full system Any Full system 
Outer Shareable 00, 01, or 10 Outer Shareable 





11, Full system 


Full system 





Inner Shareable 


00 or 01 


Inner Shareable 





10, Outer Shareable 


Outer Shareable 





11, Full system 


Full system 





Non-shareable 


00, No effect 


Non-shareable 





01, Inner Shareable 


Inner Shareable 





10, Outer Shareable 


Outer Shareable 





11, Full system 


Full system 





G4-5714 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


The AArch32 System Level Memory Model 
G4.8 Pseudocode description of general memory System instructions 


G4.8 Pseudocode description of general memory System instructions 


This section lists the pseudocode describing general memory operations: 
$ Memory data type definitions. 


° Basic memory access. 

. Aligned memory access. 

è Unaligned memory access on page G4-5716. 

e Exclusives monitors operations on page G4-5716. 


. Access permission checking on page G4-5717. 
. Abort exceptions on page G4-5717. 
° Memory barriers on page G4-5717. 


G4.8.1 Memory data type definitions 
This section lists the memory data types. 


The memory data types are: 

7 Address descriptor, defined by the AddressDescriptor type. 
° Full address, defined by the FullAddress type. 

` Memory attributes, defined by the MemoryAttributes type. 
s Memory type, defined by the MemType enumeration. 


° Device memory type, defined by the DeviceType enumeration. 
: Normal memory attributes, defined by the MemAttrHints type. 
. Cacheability attributes, defined by the MemAttr_NC, MemAttr_WT, and MemAttr_WB constants. 
° Allocation hints, defined by the MemHint_No, MemHint_WA, MemHint_RA, and MemHint_RWA constants. 
° Access permissions, defined by the Permissions type. 
G4.8.2 Basic memory access 


The two forms of the _Mem[] accessor, non-assignment (memory read) and assignment (memory write), are the 
operations that perform single-copy atomic, aligned, little-endian memory accesses of size bytes to or from the 
underlying physical memory array of bytes. 


The functions address the array using desc.paddress, that supplies: 

° The physical address. 

. An NS bit that selects between the Secure and Non-secure parts of the array. 

The attributes in desc.memattrs are used by the memory system to determine caching and ordering behaviors as 


described in Memory types and attributes on page E2-3840, Definition of the Armv8 memory model on 
page E2-3814, and Atomicity in the Arm architecture on page E2-3810. 


An additional parameter to the _Mem[] accessor defines the access type, for example normal, exclusive, or ordered, 
and whether the access is made as part of a translation table walk. 


The actual implemented array of memory might be smaller than the maximum address size that can be accessed 
from AArch32 state. In this case the scheme for aliasing is IMPLEMENTATION DEFINED, or some parts of the address 
space might give rise to External aborts or SErrors (System Errors). 


PAMax() returns the IMPLEMENTATION DEFINED size of the physical address. 





Note 
A stage of address translation using VMSAv8-32 cannot generate an output address of more than 40 bits. 


G4.8.3 Aligned memory access 


The AArch32.MemSingle[] functions make atomic, little-endian accesses of size bytes. 
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G4.8.4 


G4.8.5 


G4-5716 


Unaligned memory access 


See Unaligned data access on page E2-3834 for details of the SCTLR.A and HSCTLR.A controls on the generation 
of alignment faults. The HSCTLR control applies to Normal memory accesses from Hyp mode, and the SCTLR 
control applies to Normal memory accesses from all other modes. 


The Mem_with_type[] functions make an access of the required type. If that access is naturally aligned, each form of 
the function performs an atomic access by making a single call to AArch32.MemSingle[]. If that access is not aligned 
but passes the AArch32.CheckAlignment() checks, each form of the function synthesizes the required access from 
multiple calls to AArch32.MemSingle[]. It also reverses the byte order if the access is big-endian. 


Exclusives monitors operations 


The AArch32.SetExclusiveMonitors() function sets the Exclusives monitors for a Load-Exclusive instruction, for a 
block of bytes. The size of the blocks is determined by size, at the VA address. The ExclusiveMonitorsPass() 
function checks whether a Store-Exclusive instruction still has possession of the Exclusives monitors and therefore 
completes successfully. 


The AArch32.ExclusiveMonitorsPass() function checks whether a Store-Exclusive instruction still has possession of 
the Exclusives monitors, by checking whether the Exclusives monitors are set to include the location of the memory 
block specified by size, at the virtual address defined by address. The atomic write that follows after the Exclusives 
monitors have been set must be to the same physical address. It is permitted, but not required, for this function to 
return FALSE if the virtual address is not the same as that used in the previous call to 
AArch32.SetExclusiveMonitors(). 


The ExclusiveMonitorsStatus() function returns 0 if the previous atomic write was to the same physical memory 
locations selected by ExclusiveMonitorsPass() and therefore succeeded. Otherwise the function returns 1, indicating 
that the address translation delivered a different physical address. 


The MarkExclusiveGlobal() procedure takes as arguments a FullAddress.paddress, the PE identifier processorid and 
the size of the transfer. The procedure records that the PE processorid has requested exclusive access covering at 
least size bytes from address paddress. The size of the location marked as exclusive is IMPLEMENTATION DEFINED, 
up to a limit of 2KB and no smaller than two words, and aligned in the address space to the size of the location. It 
is CONSTRAINED UNPREDICTABLE whether this causes any previous request for exclusive access to any other address 
by the same PE to be cleared. 


The MarkExclusiveLocal() procedure takes as arguments a FullAddress paddress, the PE identifier processorid and 
the size of the transfer. The procedure records in a local record that PE processorid has requested exclusive access 
to an address covering at least size bytes from address paddress. The size of the location marked as exclusive is 
IMPLEMENTATION DEFINED, and can at its largest cover the whole of memory but is no smaller than two words, and 
is aligned in the address space to the size of the location. It is IMPLEMENTATION DEFINED whether this procedure 
also performs a MarkExclusiveGlobal() using the same parameters. 


The IsExclusiveGlobal() function takes as arguments a FullAddress paddress, the PE identifier processorid and the 
size of the transfer. The function returns TRUE if the PE processorid has marked in a global record an address range 
as exclusive access requested that covers at least size bytes from address paddress. It is IMPLEMENTATION DEFINED 
whether it returns TRUE or FALSE if a global record has marked a different address as exclusive access requested. 
If no address is marked in a global record as exclusive access, IsExclusiveGlobal() returns FALSE. 


The IsExclusiveLocal() function takes as arguments a FullAddress paddress, the PE identifier processorid and the 
size of the transfer. The function returns TRUE if the PE processorid has marked an address range as exclusive 
access requested that covers at least the size bytes from address paddress. It is IMPLEMENTATION DEFINED whether 
this function returns TRUE or FALSE if the address marked as exclusive access requested does not cover all of size 
bytes from address paddress. If no address is marked as exclusive access requested, then this function returns 
FALSE. It is IMPLEMENTATION DEFINED whether this result is ANDed with the result of IsExclusiveGlobal() with 
the same parameters. 


The ClearExclusiveByAddress() procedure takes as arguments a FullAddress paddress, the PE identifier processorid 
and the size of the transfer. The procedure clears the global records of all PEs, other than processorid, for which an 
address region including any of size bytes starting from paddress has had a request for an exclusive access. It is 
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IMPLEMENTATION DEFINED whether the equivalent global record of the PE processorid is also cleared if any of size 
bytes starting from paddress has had a request for an exclusive access, or if any other address has had a request for 
an exclusive access. 


The ClearExclusiveLocal() procedure takes as arguments the PE identifier processorid. The procedure clears the 
local record of PE processorid for which an address has had a request for an exclusive access. It is IMPLEMENTATION 
DEFINED whether this operation also clears the global record of PE processorid that an address has had a request for 
an exclusive access. 


G4.8.6 Access permission checking 


The function AArch32.CheckPermission() is used by the architecture to perform access permission checking based 
on attributes derived from the translation tables or location descriptors. 


The interpretation of access permission is shown in Memory access control on page G5-5766. 


G4.8.7 Abort exceptions 


The function AArch32.Abort() generates a Data Abort exception or a Prefetch Abort exception by calling the 
AArch32.TakeDataAbortException() or AArch32.TakePrefetchAbortException() function. 


The FaultRecord type describes a fault. Functions that check for faults return a record of this type appropriate to the 
type of fault. Pseudocode description of VUSAv8-32 memory system operations on page G5-5848 provides a 
number of wrappers to generate a FaultRecord. 


The function AArch32.NoFau1t() returns a null record that indicates no fault. The IsFault() function tests whether a 
FaultRecord contains a fault. 


G4.8.8 Memory barriers 
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The definition for the memory barrier functions is given by the enumerations MBReqDomain and MBReqTypes. 


These enumerations define the required Shareability domains and required access types used as arguments for DMB 
and DSB instructions. 


The procedures DataMemoryBarrier(), DataSynchronizationBarrier(), and InstructionSynchronizationBarrier() 
perform the memory barriers. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G4-5717 
Non-Confidential 


The AArch32 System Level Memory Model 
G4.8 Pseudocode description of general memory System instructions 


G4-5718 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Chapter G5 


The AArch32 Virtual Memory System Architecture 


This chapter describes the Armv8-A AArch32 Virtual Memory System Architecture (VMSA), that is 
backwards-compatible with VMSAv/7. It includes the following sections: 


About VMSAv8s-32 on page G5-5720. 

The effects of disabling address translation stages on VMSAv8-32 behavior on page G5-5728. 
Translation tables on page G5-5732. 

The VMSAv8-32 Short-descriptor translation table format on page G5-5737. 

The VMSAv8-32 Long-descriptor translation table format on page G5S-5746. 
Memory access control on page G5-5766. 

Memory region attributes on page G5S-5777. 

Translation Lookaside Buffers (TLBs) on page G5S-5789. 

TLB maintenance requirements on page G5-5793. 

Caches in VMSAv8-32 on page G5-5807. 

VMSAv8-32 memory aborts on page G5-5810. 

Exception reporting in a VMSAv8-32 implementation on page G5-5822. 

Address translation instructions on page GS5-5841. 

Pseudocode description of VUSAv8-32 memory system operations on page G5-5848. 
About the System registers for VUSAv8-32 on page G5-5850. 

Functional grouping of VUSAv8-32 System registers on page G5-5856. 





Note 


This chapter must be read with Chapter G4 The AArch32 System Level Memory Model. 
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G5.1 


G5-5720 


About VMSAv8-32 


This chapter describes the Armv8 VMSA for AArch32 state, VMSAv8-32. This is generally equivalent to VMSAv7 
for an implementation that includes all of the Security Extensions, the Multiprocessing Extensions, the Large 
Physical Address Extension, and the Virtualization Extensions. 


This chapter describes the control of the VMSA by Exception levels that are using AArch32. Security state, 
Exception levels, and AArch32 execution privilege on page G1-5480 summarizes how the AArch32 PE modes map 
onto the Exception levels. 


ARMv8.4-SecEL2, if implemented, is not available in AArch32 state and EL2 only executes in Non-secure state. 


ARMv8.4-S2F WB, if implemented, is not available in AArch32 state. If EL2 is executing in AArch64 state 2 stage 
translations might be affected. For more informations see Chapter D5 The AArch64 Virtual Memory System 
Architecture. 


Chapter DS The AArch64 Virtual Memory System Architecture describes the control of the VMSA by Exception 
levels that are using AArch64. 


The main function of the VMSA is to perform address translation, and access permissions and memory attribute 
determination and checking, for memory accesses made by the PE. Address translation, and permissions and 
attribute determination and checking, is performed by a stage of address translation. 


In VMSAv8-32, the Memory Management Unit (MMU) provides a number of stages of address translation. This 
chapter describes only the stages that are visible from Exception levels that are using AArch32, which are as 
follows: 


For operation in Secure state 


A single stage of address translation, for use when executing at PL1 or ELO. This is the Secure 
PL1&0 stage 1 address translation stage. 


For operation in Non-secure state 


° A single stage of address translation for use when executing at EL2. This is the Non-secure 
EL2 stage 1 address translation stage. 


° Two stages of address translation for use when executing at PL1 or ELO. These are: 
— The Non-secure PL1&0 stage 1 address translation stage. 
— The Non-secure PL1&0 stage 2 address translation stage. 


The System registers provide independent control of each supported stage of address translation, including a control 
to disable that stage of translation. 


However, ifthe PE is executing at ELO using AArch32 when EL1 is using AArch64 then it is using the VMSAv8-64 
EL1&0 translation regime, described in Chapter D5 The AArch64 Virtual Memory System Architecture. 


These features mean the VMSAv8-32 can support a hierarchy of software supervision, for example an Operating 
System and a hypervisor. 


Each stage of address translation uses address translations and associated memory properties held in memory 
mapped tables called translation tables. 


For information about how the MMU features differ if an implementation does not include all of the Exception 
levels, see About address translation for VMSAv8-32 on page G5-5723. 


The translation tables define the following properties: 


Access to the Secure or Non-secure address map 


The translation table entries determine whether an access from Secure state accesses the Secure or 
the Non-secure address map. Any access from Non-secure state accesses the Non-secure address 
map. 


Memory access permission control 


This controls whether a program is permitted to access a memory region. For instruction and data 
access, the possible settings are: 


. No access. 
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° Read-only. 
. Write-only. This is possible only in a translation regime with two stages of translation. 
7 Read/write. 


For instruction accesses, additional controls determine whether instructions can be fetched and 
executed from the memory region. 


If a PE attempts an access that is not permitted, a memory fault is signaled to the PE. 


Memory region attributes 


These describe the properties of a memory region. The top-level attribute, the Memory type, is one 
of Normal, or a type of Device memory, as follows: 
s Both translation table formats support the following Device memory types: 
— Device-nGnRnE 
— Device-nGnRE 
- The Long-descriptor translation table format supports, in addition, the following Device 


memory types: 
—  Device-nGRE 


—  Device-GRE 





Note 

Armv8 added the Device-nGRE and Device-GRE memory types. Also, in versions of the Arm 
architecture before Armv8: 

° Device-nGnRnE memory is described as Strongly-ordered memory. 

° Device-nGnRE memory is described as Device memory. 





Normal memory regions can have additional attributes. 


For more information, see Memory types and attributes on page E2-3840. 


Address translation mappings 


An address translation maps an input address to an output address. 


A stage 1 translation takes the address of an explicit data access or instruction fetch, a virtual 
address (VA), as the input address, and translates it to a different output address: 


- If only one stage of translation is provided, this output address is the physical address (PA). 

à If two stages of address translation are provided, the output address of the stage 1 translation 
is an intermediate physical address (IPA). 

Note 


In the Armv8-32 architecture, a software agent, such as an Operating System, that uses or defines 
stage 1 memory translations, might be unaware of the distinction between IPA and PA. 








A stage 2 translation translates the IPA to a PA. 


The possible Security states and privilege levels of memory accesses define a set of translation 
regimes, where a translation regime maps an input VA to the corresponding PA, using one or two 
stages of translation. See The VMSAv8-32 translation regimes on page G5-5722. 


System registers control VMSAv8-32, including defining the location of the translation tables, and enabling and 

configuring the MMU, including enabling and disabling the different address translation stages. Also, they report 
any faults that occur on a memory access. For more information, see Functional grouping of VMSAv8-32 System 

registers on page G5-5856. 


The following sections give an overview of VMSAv8-32, and of the implementation options for VMSAv8-32: 


The VMSAv8-32 translation regimes on page G5-5722. 

Address types used in a VMSAv8-32 description on page G5-5722. 
Address spaces in VMSAv8-32 on page G5-5723. 

About address translation for VMSAv8-32 on page G5-5723. 
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The remainder of the chapter fully describes the VMSA, including the different implementation options, as 
summarized in Organization of the remainder of this chapter on page G5-5726. 


G5.1.1 The VMSAv8-32 translation regimes 


As introduced in Address translation mappings on page G5-5721, a translation regime maps an input VA to the 
corresponding PA, using one or two stages of translation. Figure GS-1 shows the VMSAv8-32 translation regimes, 
and their associated translation stages and the Exception levels from which they are controlled. 


Translation regimes, for Exception levels that are using AArch32 
Secure PL1&0 VA Secure PL1&0 stage 1 
Controlled from Secure PL1 modest 





> PA, Secure or Non-secure 


Non-secure EL2 stage 1 


Non-secure EL2 VA 
Controlled from Hyp modet 





> PA, Non-secure only 


Non-secure PL1&0 VA Non-secure PL1&0 stage 1 IPA Non-secure PL1&0 stage 2 PA, Non-secure only 
Controlled from Non-secure PL1 modest Controlled from Hyp modet 


t Typical control when controlled from an Exception level using AArch32. 
Figure G5-1 VMSAv8-32 translation regimes, and associated control 


Note 


Conceptually, a translation regime that has only a stage 1 address translation is equivalent to a regime with a fixed, 
flat stage 2 mapping from IPA to PA. 








Limited use of Privilege level in Armv8 AArch32 state on page G1-5481 describes the mapping between the PE 
modes and the Privilege levels (PLs). 


Alternative descriptions of the PL1&0 translation regime 


The PL1&0 is described in terms of Privilege level because of the way the AArch32 PE modes map onto the 
Exception levels, as described in Limited use of Privilege level in Armv8 AArch32 state on page G1-5481. The 
description of this translation regime in terms of the Exception levels using depends on the current state of the PE, 
as follows: 


. In Non-secure state, PL1 always maps to EL1, and therefore the Non-secure PL1&0 translation regime could 
be described as the Non-secure EL1&0 translation regime. 
à In Secure state: 


— When EL3 is using AArch32, PL1 maps to EL3, and therefore under these conditions the Secure 
PL1&0 translation regime could be described as the Secure EL3&0 translation regime, 


— When EL3 is using AArch64, Secure PL1 maps to Secure EL1, and therefore under these conditions 
the Secure PL1&0 translation regime could be described as the Secure EL1&0 translation regime, 


However, these descriptions all refer to the same translation regime, with the same System registers associated with 
its stage 1 translations. Therefore, the regime is generally referred to as the PL1&0 translation regime. 


Note 


As Figure G5-1 shows, stage 2 translation is supported only in Non-secure state. 








G5.1.2 Address types used in a VMSAv8-32 description 


A description of VMSAv8-32 refers to the following address types. 
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Note 


These descriptions relate to a VMSAv8-32 description and therefore sometimes differ from the generic definitions 
given in the Glossary. 


Virtual address (VA) 
An address used in an instruction, as a data or instruction address, is a Virtual Address (VA). 
An address held in the PC, LR, or SP, is a VA. 


The VA map runs from zero to the size of the VA space. For AArch32 state, the maximum VA space 
is 4GB, giving a maximum VA range of 0x00000000-0xFFFFFFFF. 


Intermediate physical address (IPA) 


In a translation regime that provides two stages of address translation, the IPA is the address after 
the stage | translation, and is the input address for the stage 2 translation. 


In a translation regime that provides only one stage of address translation, the IPA is identical to the 


PA. 
A VMSAv8-32 implementation provides only one stage of address translation: 
° If the implementation does not include EL2. 
è When executing in Secure state. 
° When executing in Hyp mode. 
Physical address (PA) 


The address of a location in the Secure or Non-secure memory map. That is, an output address from 
the PE to the memory system. 


G5.1.3 Address spaces in VMSAv8-32 


For execution in AArch32 state, the Armv8 architecture supports: 
è A VA space of up to 32 bits. The actual width is IMPLEMENTATION DEFINED. 


s An IPA space of up to 40 bits. The translation tables and associated System registers define the width of the 
implemented address space. 


Note 


AArch32 defines two translation table formats. The Long-descriptor format gives access to the full 40-bit IPA or 
PA space at a granularity of 4KB. The Short-descriptor format: 

° Gives access to a 32-bit PA space at 4KB granularity. 

: Gives access to a 40-bit PA space, but only at 16MB granularity, by the use of Supersections. 





If an implementation includes EL3, the address maps are defined independently for Secure and Non-secure 
operation, providing two independent 40-bit address spaces, where: 


. A VA accessed from Non-secure state can only be translated to the Non-secure address map. 
° A VA accessed from Secure state can be translated to either the Secure or the Non-secure address map. 


G5.1.4 About address translation for VMSAv8-32 
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Address translation is the process of mapping one address type to another, for example, mapping VAs to IPAs, or 
mapping VAs to PAs. A translation table defines the mapping from one address type to another, and a Translation 
table base register (TTBR) indicates the start of a translation table. Each implemented stage of address translation 
shown in Figure G5-1 on page G5-5722 requires its own translation tables. 


For PL1&0 stage 1 translations, the mapping can be split between two tables, one controlling the lower part of the 
VA space, and the other controlling the upper part of the VA space. This can be used, for example, so that: 


e One table defines the mapping for operating system and I/O addresses, that do not change on a context switch. 
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s A second table defines the mapping for application-specific addresses, and therefore might require updating 
on a context switch. 


The VMSAv8-32 implementation options determine the supported address translation stages. The following 
descriptions apply when all implemented Exception levels are using AArch32: 


VMSAv8-32 without EL2 or EL3 


Supports only a single PL1&0 stage 1 address translation. Translation of this stage of address 
translation can be split between two sets of translation tables, with base addresses defined by 
TTBRO and TTBR1, and controlled by TTBCR. 


VMSAv8-32 with EL3 but without EL2 


Supports only the Secure PL1&0 stage 1 address translation and the Non-secure PL1&0 stage 1 
address translation. In each Security state, this stage of translation can be split between two sets of 
translation tables, with base addresses defined by the Secure and Non-secure copies of TTBRO and 
TTBR1, and controlled by the Secure and Non-secure copies of TTBCR. 


VMSAv8-32 with EL2 but without EL3 
The implementation supports the following stages of address translation: 


Non-secure EL2 stage 1 address translation 
The HTTBR defines the base address of the translation table for this stage of address 
translation, controlled by HTCR. 

Non-secure PL1&0 stage 1 address translation 
Translation of this stage of address translation can be split between two sets of 
translation tables, with base addresses defined by the Non-secure copies of TTBRO and 
TTBR1 and controlled by the Non-secure instance of TTBCR. 

Non-secure PL1&0 stage 2 address translation 


The VTTBR defines the base address of the translation table for this stage of address 
translation, controlled by VTCR. 


VMSAv8-32 with EL2 and EL3 
The implementation supports all of the stages of address translation, as follows: 


Secure PL1&0 stage 1 address translation 
Translation of this stage of address translation can be split between two sets of 
translation tables, with base addresses defined by the Secure copies of TTBRO and 
TTBRI1, and controlled by the Secure instance of TTBCR. 


Non-secure EL2 stage 1 address translation 
The HTTBR defines the base address of the translation table for this stage of address 
translation, controlled by HTCR. 

Non-secure PL1&0 stage 1 address translation 
Translation of this stage of address translation can be split between two sets of 
translation tables, with base addresses defined by the Non-secure copies of TTBRO and 
TTBR1 and controlled by the Non-secure instance of TTBCR. 

Non-secure PL1&0 stage 2 address translation 


The VTTBR defines the base address of the translation table for this stage of address 
translation, controlled by VTCR. 


Figure GS-2 on page G5-5725 shows the translation regimes and stages in a VMSAv8-32 implementation that 
includes all of the Exception levels, and indicates the PE mode that, typically, defines each set of translation tables, 
if that stage of address translation is controlled by a Privilege level that is using AArch32: 
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Secure PL1&0 VA 


Non-secure EL2 VA 


Non-secure PL1&0 VA 
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Secure PL18&0 stage 1 n PA, 
Secure TTBRO*, TTBR1*, and TTBCR* Secure or Non-secure 
Non-secure PL2 stage 1 5 PA, 
HTTBR® and HTCR® Non-secure only 
Non-secure PL1&0 stage 1 >l Non-secure PL1&0 stage 2 PA, 
Non-secure TTBRO', TTBR1', and TTBCRt VTTBR® and VTCRS Non-secure only 


t Typically configured from a Secure PL1 mode 


§ Typically configured from Hyp mode 


Translation table base address and control registers. 
See the Note that follows this figure for other configuration options. 


t Typically configured from a Non-secure PL1 mode 
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Figure G5-2 VMSAv8-32 address translation summary 





Note 


The term Typically configured is used in Figure G5-2 to indicate the expected software usage. However, stages of 
address translation used in AArch32 state can also be configured: 


: From an Exception level higher than the Exception level of the configuring PE mode shown in Figure G5-2, 
regardless of whether that Exception level is using AArch32 or is using AArch64, except that a Non-secure 
Exception level can never configure a stage of address translation that is used in Secure state. 


$ From an Exception level that is using AArch64 and is higher than the level at which the translation stage is 
being used. For example, if Non-secure ELO is the only Non-secure Exception level that is using AArch32, 
then the Non-secure PL1 &0 stage of address translation is configured from Non-secure EL1, that is using 





AArché4. 
In general: 
à The translation from VA to PA can require multiple stages of address translation, as Figure G5-2 shows. 
è A single stage of address translation takes an input address and translates it to an output address. 


A full translation table lookup is called a translation table walk. It is performed automatically by hardware, and can 
have a significant cost in execution time. To support fine granularity ofthe VA to PA mapping, a single input address 
to output address translation can require multiple accesses to the translation tables, with each access giving finer 
granularity. Each access is described as a level of address lookup. The final level of the lookup defines: 

$ The required output address. 


. The attributes and access permissions of the addressed memory. 


Translation Lookaside Buffers (TLBs) reduce the average cost of a memory access by caching the results of 
translation table walks. TLBs behave as caches of the translation table information, and VMSAv8-32 provides TLB 
maintenance instructions for the management of TLB contents. 


Note 


The Arm architecture permits TLBs to hold any translation table entry that does not directly cause a Translation 
fault, an Address size fault, or an Access flag fault. 








To reduce the software overhead of TLB maintenance, for the PL1&0 translation regimes VMSAv8-32 
distinguishes between Global pages and Process-specific pages. The Address Space Identifier (ASID) identifies 
pages associated with a specific process and provides a mechanism for changing process-specific tables without 
having to maintain the TLB structures. 


If an implementation includes EL2, the virtual machine identifier (VMID) identifies the current virtual machine, 
with its own independent ASID space. The TLB entries include this VMID information, meaning TLBs do not 
require explicit invalidation when changing from one virtual machine to another, if the virtual machines have 
different VMIDs. For stage 2 translations, all translations are associated with the current VMID. There is no 
mechanism to associate a particular stage 2 translation with multiple virtual machines. 
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Atomicity of register changes on changing virtual machine 


From the viewpoint of software executing at Non-secure PL1 or ELO, when there is a switch from one virtual 
machine to another, the registers that control or affect address translation must be changed atomically. This applies 
to the registers for the Non-secure PL1&0 translation regime. This means that all of the following registers must 
change atomically: 
è The registers associated with the stage 1 translations: 

— MAIRO, MAIR1, AMAIRO, and AMAIRI. 

— TTBRO, TTBR1, TTBCR, TTBCR2, and CONTEXTIDR. 

— SCTLR. 


è The registers associated with the stage 2 translations: 
— VTTBR and VTCR. 
—  HSCTLR. 





Note 


Only some fields of SCTLR affect the stage 1 translation, and only some fields of HSCTLR affect the stage 2 
translation. However, in each case, changing these fields requires a write to the register, and that write must be 
atomic with the other register updates. 





These registers apply to execution using the Non-secure PL1&0 translation regime. However, when updated as part 
of a switch of virtual machines they are updated by software executing at EL2. This means the registers are out of 
context when they are updated, and no synchronization precautions are required. 


Use of out-of-context translation regimes 
The architecture requires that: 


s When executing at EL3 or EL2, the PE must not use the registers associated with the Non-secure PL1 &0 
translation regime for speculative memory accesses. 


s When executing at EL3 the PE must not use the registers associated with the EL2 translation regime for 
speculative memory accesses. 


° When executing at EL3, EL2, or Non-secure EL1, the PE must not use the registers associated with the 
Secure PL1&0 translation regime for speculative memory accesses. 


When entering an Exception level on completion of a DSB instruction, no new memory accesses using any translation 
table entries from a translation regime of an Exception level lower than the Exception level that has been entered, 
will be observed by any observers to the extent that those accesses are required to be observed, as determined by 
the Shareability and Cacheability of those translation table entries. 


Note 


° This does not require that speculative memory accesses cannot be performed using those entries if it is 
impossible to tell that those memory accesses have been observed by the observers. 





s This requirement does not imply that, on taking an exception to a higher Exception level, any translation table 
walks started before the exception was taken will be completed by the time the higher Exception level is 
entered, and therefore memory accesses required for such a translation table walk might, in effect, be 
performed speculatively. However, the execution of a DSB on entry to the higher Exception level ensures that 
these accesses are complete. 





G5.1.5 Organization of the remainder of this chapter 


The remainder of this chapter is organized as follows. 
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The next part of the chapter describes address translation and the associated memory properties held in the 
translation table entries, in the following sections: 


. The effects of disabling address translation stages on VMSAv8-32 behavior on page G5-5728. 
. Translation tables on page G5-5732. 

° Secure and Non-secure address spaces on page G5-5735. 

. The VMSAv8-32 Short-descriptor translation table format on page G5-5737. 

. The VMSAv8-32 Long-descriptor translation table format on page G5-5746. 

è Memory access control on page G5-5766. 

. Memory region attributes on page G5-5777. 

. Translation Lookaside Buffers (TLBs) on page G5-5789. 

. TLB maintenance requirements on page G5-5793. 


Caches in VMSAv8-32 on page G5-5807 describes VMSAv8-32-specific cache requirements. 

The following sections then describe aborts on VMSAv8-32 memory accesses, and how these and other faults are 
reported: 

: VMSAv8-32 memory aborts on page G5-5810. 

° Exception reporting in a VMSAv8-32 implementation on page G5-5822. 


Address translation instructions on page G5-5841 then describes these operations, and how they relate to address 
translation. 


A number of sections then describe the System registers for VMSAv8-32. The following sections give general 
information about the System registers, and the organization of the registers in the primary encoding spaces, 
(coproc==0b1110) and (coproc==0b1111) for these registers: 


$ About the System registers for VMSAv8-32 on page G5-5850. 
. Functional grouping of VMSAv8-32 System registers on page G5-5856. 


Note 


The System registers in the (coproc==0b1110) encoding space provide the following functionality: 





° Self-hosted debug. These registers are described in Debug registers on page G8-6376. 
° The System register interface to a PE Trace Unit These registers are not described in this manual. 


è Jazelle registers. These registers are summarized in Legacy feature registers and system instructions on 
page K14-7863. 


Therefore, there is no summary of these registers by functional groups. 





Pseudocode description of VMSAv8-32 memory system operations on page G5-5848 then summarizes the 
pseudocode functions that describe many features of VMSAv8-32 operation. 
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The effects of disabling address translation stages on VMSAv8-32 behavior 


About VMSAv8-32 on page G5-5720 defines the translation regimes and the associated stages of address translation, 
each of which has its own System registers for control and configuration. VMSAv8-32 includes an enable bit for 
each stage of address translation, as follows: 


è SCTLR.M, in the Secure instance of the register, controls Secure PL1&0 stage 1 address translation. 
. SCTLR.M, in the Non-secure instance of the register, controls Non-secure PL1&0 stage 1 address 
translation. 


a HCR.VM controls Non-secure PL1&0 stage 2 address translation. 


7 HSCTLR.M controls Non-secure EL2 stage 1 address translation. 


Note 
° The descriptions throughout this chapter describe address translation as seen by Exception levels that are 
using AArch32. However, for the Non-secure PL1&0 translation regime, the stage 2 translation: 
— Is controlled by the HCR if EL2 is using AArch32. 
— Is controlled by the HCR_EL2 if EL2 is using AArch64. 


For this reason, links to the HCR link to a table that disambiguates between the AArch32 HCR and the 
AArch64 HCR_EL2. 





. If EL2 is using AArch64, then the equivalent of the Non-secure EL2 translation regime is described in 
Chapter D5 The AArch64 Virtual Memory System Architecture, not in this chapter. 





The following sections describe the effect on VMSAv8-32 behavior of disabling each stage of translation: 
è VMSAv8-32 behavior when stage 1 address translation is disabled. 
. VMSAv8-32 behavior when stage 2 address translation is disabled on page G5-5730. 


: Behavior of instruction fetches when all associated address translations are disabled on page G5S-5730. 


Enabling stages of address translation on page G5-5730 gives more information about each stage of address 
translation, in particular after a reset on an implementation that includes EL3. 


VMSAv8-32 behavior when stage 1 address translation is disabled 


When stage | address translation is disabled, memory accesses that would otherwise be translated by that stage of 
address translation are treated as follows: 
Non-secure PL1 and ELO accesses when EL2 is implemented and HCR.DC is set to 1 


In an implementation that includes EL2, for an access from a Non-secure PL1 or ELO mode when 
HCR.DC is set to 1, the stage 1 translation assigns the Normal Non-shareable, Inner Write-Back 
Read-Allocate Write-Allocate, Outer Write-Back Read-Allocate Write-Allocate memory attributes. 


See also Effect of the HCR.DC field on page G5-5729. 


All other accesses 


For all other accesses, when a stage 1 address translation is disabled, the assigned attributes depend 
on whether the access is a data access or an instruction access, as follows: 
Data access 

The stage 1 translation assigns the Device-nGnRnE memory type. 


Instruction access 


The stage 1 translation assigns Normal memory attribute, with the Cacheability and 
Shareability attributes determined by the value of: 


e The Secure instance of SCTLR.I for the Secure PL1&0 translation regime. 
e The Non-secure instance of SCTLR.I for the Non-secure PL1&0 translation 
regime. 


e HSCTLR.I for the Non-secure EL2 translation regime. 
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In these cases, the meaning of the I field is as follows: 

When I is set to 0 
The stage | translation assigns the attributes Outer Shareable, 
Non-cacheable. 

When I is set to 1 
The stage | translation assigns the attributes Inner Write-Through 
Read-Allocate No Write-Allocate, Outer Write-Through Read-Allocate 
No Write-Allocate Cacheable. 


Note 


On some implementations, if the SCTLR.TRE field is set to 0 then this behavior can be 
changed by the remap settings in the memory remap registers. The details of TEX remap 
when SCTLR.TRE is set to 0 are IMPLEMENTATION DEFINED, see SCTLR.TRE, 
SCTLR.M, and the effect of the TEX remap registers on page G5-5782. 





For this stage of translation, no memory access permission checks are performed, and therefore no MMU faults 
relating to this stage of translation can be generated. 





Note 


Alignment checking is performed, and therefore Alignment faults can occur. 


For every access, when stage | translation is disabled, the output address of the stage 1 translation is equal to the 
input address. This is called a flat address mapping. If the implementation supports output addresses of more than 
32 bits then the output address bits above bit[31] are zero. For example, for a VA to PA translation on an 
implementation that supports 40-bit PAs, PA[39:32] is 0x00. 


For a Non-secure PL1 or ELO access, if the PL1&0 stage 2 address translation is enabled, the stage 1 memory 
attribute assignments and output address can be modified by the stage 2 translation. 


See also Behavior of instruction fetches when all associated address translations are disabled on page G5-5730. 


Effect of the HCR.DC field 


The HCR.DC field determines the default memory attributes assigned for the first stage of the Non-secure PL1&0 
translation regime when that stage of translation is disabled. 


When executing in a Non-secure PL1 or ELO mode with HCR.DC set to 1: 


° For all purposes other than reading the value of the SCTLR, the PE behaves as if the value of the SCTLR.M 
field is 0. This means Non-secure PL1&0 stage | address translation is disabled. 


° For all purposes other than reading the value of the HCR, the PE behaves as if the value of the HCR.VM field 
is 1. This means Non-secure PL1&0 stage 2 address translation is enabled. 


The effect of HCR.DC might be held in TLB entries associated with a particular VMID. Therefore, if software 
executing at EL2 changes the HCR.DC value without also changing the current VMID, it must also invalidate all 
TLB entries associated with the current VMID. Otherwise, the behavior of Non-secure software executing at EL1 
or ELO is CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching of 
control or data values on page K1-7611. 


Effect of disabling translation on maintenance and address translation instructions 


Cache maintenance instructions act on the target cache whether address translation is enabled or not, and regardless 
of the values of the memory attributes. However, if a stage of translation is disabled, they use the flat address 
mapping for that stage, and all mappings are considered global. 


TLB invalidate operations act on the target TLB whether address translation is enabled or not. 


When the Non-secure PL1&0 stage 1 address translation is disabled, any ATS1C** or ATS12NSO** address 
translation instruction that accesses the Non-secure state translation reflects the effect of the HCR.DC field. 
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VMSAv8-32 behavior when stage 2 address translation is disabled 


When stage 2 address translation is disabled: 
s The IPA output from the stage 1 translation maps flat to the PA 
° The memory attributes and permissions from the stage 1 translation apply to the PA. 


If the stage 1 address translation and the stage 2 address translation are both disabled, see Behavior of instruction 
fetches when all associated address translations are disabled. 


Behavior of instruction fetches when all associated address translations are disabled 


The information in this section applies to memory accesses: 
- From Secure PL1 and ELO modes, when the Secure PL1&0 stage 1 address translation is disabled 
è From Hyp mode, when the Non-secure EL2 stage 1 address translation is disabled 
e From Non-secure PL1 and ELO modes, when all of the following apply: 
— The Non-secure PL1&0 stage 1 address translation is disabled. 
— The Non-secure PL1&0 stage 2 address translation is disabled. 
— HCR.DCis set to 0. 


In these cases, when execution is in AArch32 state a memory location might be accessed as a result of an instruction 
fetch if either: 


: The memory location is in the same 4KB block of memory, aligned to 4KB, as an instruction which a simple 
sequential execution of the program either requires to be fetched now or has required to be fetched since the 
last reset, or is in the 4KB block immediately following such a block. 


$ The memory location is the target of a direct branch that a simple sequential execution of the program would 
have taken since the most recent of: 
— The last reset. 


— Ifthe branch predictor is architecturally invisible, the last synchronization of instruction cache 
maintenance targeting the address of the branch instruction. 


— Ifthe branch predictor is not architecturally invisible, the last synchronization of branch predictor 
maintenance targeting the address of the branch instruction. 


These accesses can be caused by speculative instruction fetches, regardless of whether the prefetched instruction is 
committed for execution. 


Note 
To ensure architectural compliance, software must ensure that both of the following apply: 





° Instructions that will be executed when address translation is disabled are located in 4KB blocks of the 
address space that contain only memory that is tolerant to speculative accesses. 


$ Each 4KB block of the address space that immediately follows a 4KB block that holds instructions that will 
be executed when address translation is disabled also contains only memory that is tolerant to speculative 
accesses. 





Enabling stages of address translation 


On powerup or reset, only the SCTLR.M field for the Exception level and Security state entered on reset is reset to 
0, disabling address translation for the initial state of the PE. All other SCTLR.M and HSCTLR.M fields that are 
implemented are UNKNOWN after the reset. 
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This means, on powerup or reset: 


s On an implementation that includes EL3, where EL3 is using AArch32: 


— The PL1&0 stage 1 address translation enable bit, SCTLR.M, is banked, meaning there are separate 
enables for operation in Secure and Non-secure state. 


—  IfEL3 is using AArch32, only the Secure instance of the SCTLR.M field resets to 0, disabling the 
Secure state PL1&0 stage 1 address translation. The reset value of the Non-secure instance of 
SCTLR.M is UNKNOWN. 


s On an implementation that includes EL2, where EL2 is using AArch32, the HSCTLR.M field, that controls 
the Non-secure EL2 stage 1 address translation: 
— Ifthe implementation does not include EL3, resets to 0. 
— Otherwise, is UNKNOWN. 


š On an implementation that does not include either EL2 or EL3, there is a single stage of translation. This is 
controlled by SCTLR.M, that resets to 0. 


Note 


If, for the software that enables or disables a stage of address translation, the input address of a stage 1 translation 
differs from the output address of that stage 1 translation, and the software is running in translation regime that is 
affected by that stage of translation, then the requirement to synchronize changes to the System registers means it 
is uncertain where in the instruction stream the change of the translation takes place. For this reason, Arm strongly 
recommends that the input address and the output address are identical in this situation. 
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Translation tables 


VMSAv8-32 defines two alternative translation table formats: 


Short-descriptor format 
It uses 32-bit descriptor entries in the translation tables, and provides: 
° Up to two levels of address lookup. 
° 32-bit input addresses. 
. Output addresses of up to 40 bits. 
è Support for PAs of more than 32 bits by use of supersections, with 16MB granularity. 
e Support for No access, Client, and Manager domains. 


Long-descriptor format 


It uses 64-bit descriptor entries in the translation tables, and provides: 


. Up to three levels of address lookup. 

° Input addresses of up to 40 bits, when used for stage 2 translations. 

. Output addresses of up to 40 bits. 

è 4KB assignment granularity across the entire PA range. 

è No support for domains, all memory regions are treated as in a Client domain. 

. Fixed 4KB table size, unless truncated by the size of the input address space. 
—— Note 


— Translation with a 40-bit input address range requires two concatenated 4KB top-level 
tables, aligned to 8KB. 


— The VMSAv8-64 Long-descriptor translation table format is generally similar to this 
format, but supports input and output addresses of up to 48 bits, and has an assignment 
granularity and table size defined by its translation granule. This can be 4KB, 16KB, 
or 64KB. See The VMSAv8-64 translation table format on page D5-2547. 





In all implementations, of the possible address translations shown in Figure G5-2 on page G5-5725, for stages of 
address translation that are using AArch32: 


$ In a particular Security state, the translation tables for the PL1&0 stage 1 translations can use either 
translation table format, and the TTBCR.EAE field indicates the current translation table format. 


à The translation tables for the Non-secure EL2 stage 1 translations, and for the Non-secure PL1&0 stage 2 
translations, must use the Long-descriptor translation table format. 


Many aspects of performing a translation table walk depend on the current translation table format. Therefore, the 
following sections describe the two formats, including how the MMU performs a translation table walk for each 
format: 


. The VMSAv8-32 Short-descriptor translation table format on page G5-5737. 
° The VMSAv8-32 Long-descriptor translation table format on page G5-5746. 


The following subsections describe aspects of the translation tables and translation table walks, for memory 
accesses from AArch32 state, that are independent of the translation table format: 


. Translation table walks for memory accesses using VMSAv8-32 translation regimes on page G5-5733. 

° Information returned by a translation table lookup on page G5-5733. 

. Determining the translation table base address in the VMSAv8-32 translation regimes on page G5-5734. 
° Control of translation table walks on a TLB miss on page G5-5735. 

° Access to the Secure or Non-secure PA map on page G5-5735. 


See also TLB maintenance requirements on page G5-5793. 
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G5.3.1 Translation table walks for memory accesses using VMSAv8-32 translation regimes 


A translation table walk occurs as the result of a TLB miss, and starts with a read of the appropriate starting-level 
translation table. The result of that read determines whether additional translation table reads are required, for this 
stage of translation, as described in either: 


. Translation table walks, when using the VMSAv8-32 Short-descriptor translation table format on 
page G5-5743. 
. Translation table walks, when using the VMSAv8-32 Long-descriptor translation table format on 


page G5-5761. 


Note 


When using the Short-descriptor translation table format, the starting level for a translation table walk is always a 
level 1 lookup. However, with the Long-descriptor translation table format, the starting-level can be either a 
level lor a level 2 lookup. 








For the PL1&0 stage 1 translations, SCTLR.EE determines the endianness of the translation table lookups. SCTLR 
is banked, and therefore the endianness is determined independently for each Security state. 


HSCTLR.EE defines the endianness for the Non-secure EL2 stage 1 and Non-secure PL1&0 stage 2 translations. 





Note 
Dynamically changing translation table endianness 

Because any change to SCTLR.EE or HSCTLR.EE requires synchronization before it is visible to 

subsequent operations, Arm strongly recommends that: 

š SCTLR.EE is changed only when either: 
— Executing in a mode that does not use the translation tables affected by SCTLR.EE. 
— Executing with SCTLR.M set to 0. 

s HSCTLR.EE is changed only when either: 
— Executing in a mode that does not use the translation tables affected by HSCTLR.EE. 
— Executing with HSCTLR.M set to 0. 


The PA of the base of the starting-level translation table is determined from the appropriate TTBR, see Determining 
the translation table base address in the VMSAv8-32 translation regimes on page G5S-5734. 


For more information, see Ordering and completion of TLB maintenance instructions on page G5-5796. 


Translation table walks must access data or unified caches, or data and unified caches, of other agents participating 
in the coherency protocol, according to the Shareability attributes described in the TTBR. These Shareability 
attributes must be consistent with the Shareability attributes for the translation tables themselves. 


G5.3.2 Information returned by a translation table lookup 
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When an associated stage of address translation is enabled, a memory access requires one or more translation table 
lookups. If the required translation table descriptor is not held in a TLB, a translation table walk is performed to 
obtain the descriptor. A lookup, whether from the TLB or as the result of a translation table walk, returns both: 


° An output address that corresponds to the input address for the lookup. 
° A set of properties that correspond to that output address. 
The returned properties are classified as providing address map control, access controls, or region attributes. This 


classification determines how the descriptions of the properties are grouped. The classification is based on the 
following model: 


Address map control 


Memory accesses from Secure state can access either the Secure or the Non-secure address map, as 
summarized in Access to the Secure or Non-secure PA map on page G5-5735. 


Memory accesses from Non-secure state can only access the Non-secure address map. 
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Access controls 


Determine whether the PE, in its current state, can access the output address that corresponds to the 
given input address. If not, an MMU fault is generated and there is no memory access. 


Memory access control on page G5-5766 describes the properties in this group. 
Attributes Are valid only for an output address that the PE, in its current state, can access. The attributes define 
aspects of the required behavior of accesses to the target memory region. 


Memory region attributes on page G5-5777 describes the properties in this group. 


Determining the translation table base address in the VMSAv8-32 translation regimes 


On a TLB miss, the VMSA must perform a translation table walk, and therefore must find the base address of the 
translation table to use for its lookup. A TTBR holds this address. As Figure GS-2 on page G5-5725 shows: 


è For a Non-secure EL2 stage 1 translation, the HTTBR holds the required base address. The HTCR is the 
control register for these translations. 


è For a Non-secure PL1&0 stage 2 translation, the VTTBR holds the required base address. The VTCR is the 
control register for these translations. 


s For a PL1 &0 stage 1 translation, either TTBRO or TTBR1 holds the required base address. The TTBCR is 
the control register for these translations. 


The Non-secure copies of TTBRO, TTBR1, and TTBCR, relate to the Non-secure PL1&0 stage 1 translation. 
The Secure copies of TTBRO, TTBR1, and TTBCR, relate to the Secure PL1&0 stage 1 translation. 


For the PL1&0 translation table walks: 


. TTBRO can be configured to describe the translation of VAs in the entire address map, or to describe only the 
translation of VAs in the lower part of the address map. 


. If TTBRO is configured to describe the translation of VAs in the lower part of the address map, TTBR1 is 
configured to describe the translation of VAs in the upper part of the address map. 


The contents of the appropriate instance of the TTBCR determine whether the address map is separated into two 
parts, and where the separation occurs. The details of the separation depend on the current translation table format, 
see: 


è Selecting between TTBRO and TTBR1, VMSAv8-32 Short-descriptor translation table format on 
page G5-5742. 


7 Selecting between TTBRO and TTBR1, VMSAv8-32 Long-descriptor translation table format on 
page G5-5755. 


Example G5-1 shows a typical use of the two sets of translation tables: 


Example G5-1 Example use of TTBRO and TTBR1 


An example of using the two TTBRs for PL1&0 stage 1 address translations is: 


TTBRO Used for process-specific addresses. 
Each process maintains a separate level 1 translation table. On a context switch: 
$ TTBRO is updated to point to the level 1 translation table for the new context. 
5 TTBCR is updated if this change changes the size of the translation table. 
e The CONTEXTIDR is updated. 


TTBCR can be programmed so that all translations use TTBRO in a manner compatible with 
architecture versions before Armv6. 


TTBRI1 Used for operating system and I/O addresses, that do not change on a context switch. 
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G5.3.4 Control of translation table walks on a TLB miss 


Two fields in the TCR for the translation stage required by a memory access control whether a translation table walk 
is performed on a TLB miss. These two fields are the: 


$ PDO and PD1 fields, on a PE using the Short-descriptor translation table format. 
: EPDO and EPD1 fields, on a PE using the Long-descriptor translation table format. 


Note 


For the VMSAv8-32 translation regimes, the different field names are because the fields are in different positions 
in TTBCR, depending on the translation table format. 








The effect of these fields is: 


{E}PDx ==0 Ifa TLB miss occurs based on TTBRx, a translation table walk is performed. The current Security 
state determines whether the memory access is Secure or Non-secure. 


{E}PDx ==1 Ifa TLB miss occurs based on TTBRx, a level 1 Translation fault is returned, and no translation 
table walk is performed. 


G5.3.5 Access to the Secure or Non-secure PA map 


ARM DDI 0487E.a 
ID070919 


As stated in Address spaces in VMSAv8-32 on page G5-5723, a PE can access independent Secure and Non-secure 
address maps. When the PL1 Exception level is using AArch32, these are defined by the translation tables identified 
by the Secure TTBRO and TTBRI1. In both translation table formats in the Secure translation tables, the NS field in 
a descriptor indicates whether the descriptor refers to the Secure or the Non-secure address map: 


NS == Access the Secure PA space. 
NS == Access the Non-secure PA space. 


Note 


In the Non-secure translation tables, the corresponding field is SBZ. Non-secure accesses always access the 
Non-secure PA space, regardless of the value of this field. 








The Long-descriptor translation table format extends this control, adding an NSTable field to the Secure translation 
tables, as described in Hierarchical control of Secure or Non-secure memory accesses, Long-descriptor format on 
page G5-5754. In the Non-secure translation tables, the corresponding field is SBZ, and Non-secure accesses ignore 
the value of this field. 


The following sections describe the address map controls in the two implementations: 
7 Control of Secure or Non-secure memory access, VMSAv8-32 Short-descriptor format on page G5-5742. 
s Control of Secure or Non-secure memory access, VMSAv8-32 Long-descriptor format on page G5-5754. 


The following subsection gives more information. 


Secure and Non-secure address spaces 
EL3 provides two PA spaces, a Secure PA space and a Non-secure PA space. 


As described in Access to the Secure or Non-secure PA map, for the PL1&0 stage 1 translations when controlled 
from an Exception level using AArch32, the registers that control the stage of translation, TTBRO, TTBR1, TTBCR, 
and TTBCR2 are banked to provide independent Secure and Non-secure instances of the registers, and the Security 
state of the PE when it performs a memory access whether the Secure or Non-secure instances are used. This means 
that for stage 1 of the PL1&0 translation regime there are independent Secure and Non-secure translation tables, 
and translation table walks are made to the PA space corresponding to the Security state of the translation tables 
used. 


For a translation table walk caused by a memory access from Non-secure state, all memory accesses are to the 
Non-secure address space. 
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For a translation table walk caused by a memory access from Secure state: 


When address translation is using the Long-descriptor translation table format: 
— The initial lookup performed must access the Secure address space. 


— Ifa table descriptor read from the Secure address space has the NSTable field set to 0, then the next 
level of lookup is from the Secure address space. 


— Ifa table descriptor read from the Secure address space has the NSTable field set to 1, then the next 
level of lookup, and any subsequent level of lookup, is from the Non-secure address space. 


For more information, see Control of Secure or Non-secure memory access, VMSAv8-32 Long-descriptor 
format on page G5-5754. 


Otherwise, all memory accesses are to the Secure address space. 


Note 





When executing in Non-secure state, additional translations are supported. For memory accesses from 
AArch32 state, these are: 


—  Non-secure EL2 stage 1 translation. 


—  Non-secure PL1&0 stage 2 translation. 


These translations can access only the Non-secure address space. 


A system implementation can alias parts of the Secure PA space to the Non-secure PA space in an 
implementation-specific way. As with any other aliasing of physical memory, the use of aliases in this way 
can require the use of cache maintenance instructions to ensure that changes to memory made using one alias 
of the physical memory are visible to accesses to the other alias of the physical memory. 
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The Short-descriptor translation table format supports a memory map based on memory sections or pages: 


Supersections Consist of 16MB blocks of memory. Support for Supersections is optional, except that an 
implementation that supports more than 32 bits of PA must also support Supersections to provide 
access to the entire PA space. 


Sections Consist of 1MB blocks of memory. 
Large pages Consist of 64KB blocks of memory. 
Small pages Consist of 4KB blocks of memory. 


Supersections, Sections, and Large pages map large regions of memory using only a single TLB entry. 





Note 


od Whether a VMSAv8-32 implementation of the Short-descriptor format translation tables supports 
supersections is IMPLEMENTATION DEFINED. 


. The EL2 translation regime cannot use the Short-descriptor translation table format. 





When using the Short-descriptor translation table format, two levels of translation tables are held in memory: 
Level 1 table 

Holds Zevel 1 descriptors that contain the base address and 

° Translation properties for a Section and Supersection. 

° Translation properties and pointers to a level 2 table for a Large page or a Small page. 
Level 2 tables 


Hold level 2 descriptors that contain the base address and translation properties for a Small page or 
a Large page. With the Short-descriptor format, level 2 tables can be referred to as translation tables. 


A level 2 table requires 1KB of memory. 


In the translation tables, in general, a descriptor is one of: 


7 An invalid or fault entry. 

$ A translation table entry, that points to a next-level translation table. 

° A page or section entry, that defines the memory properties for the access. 
‘ A reserved format. 


Bits[1:0] of the descriptor give the primary indication of the descriptor type. 


Figure G5-3 on page G5-5738 gives a general view of address translation when using the Short-descriptor 
translation table format. 
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+ When using TTBR1, N is 0. When using TTBRO, O<N<8. . i 
; , i , See text for more information. 
t Repeated entries required because of descriptor field overlaps. 


Figure G5-3 General view of address translation using VMSAv8-32 Short-descriptor format translation tables 


Additional requirements for Short-descriptor format translation tables on page G5-5741 describes why, when using 
the Short-descriptor format, Supersection and Large page entries must be repeated 16 times, as shown in 
Figure G5-3. 


VMSAv8-32 Short-descriptor translation table format descriptors, Memory attributes in the VMSAv8-32 
Short-descriptor translation table format descriptors on page G5-5741, and Control of Secure or Non-secure 
memory access, VMSAv8-32 Short-descriptor format on page G5-5742 describe the format of the descriptors in the 
Short-descriptor format translation tables. 


The following sections then describe the use of this translation table format: 


$ Selecting between TTBRO and TTBR1, VMSAv8-32 Short-descriptor translation table format on 
page G5-5742. 


° Translation table walks, when using the VMSAv8-32 Short-descriptor translation table format on 
page G5-5743. 


G5.4.1 VMSAv8-32 Short-descriptor translation table format descriptors 


The following sections describe the formats of the entries in the Short-descriptor translation tables: 
s Short-descriptor translation table level 1 descriptor formats. 


$ Short-descriptor translation table level 2 descriptor formats on page G5-5740. 


For more information about level 2 translation tables, see Additional requirements for Short-descriptor format 
translation tables on page G5-5741. 


Note 


Previous versions of the Arm Architecture Reference Manual, and some other documentation, describes the AP[2] 
bit in the translation table entries as the APX bit. 








Information returned by a translation table lookup on page G5-5733 describes the classification of the non-address 
fields in the descriptors as address map control, access control, or attribute fields. 


Short-descriptor translation table level 1 descriptor formats 
Each entry in the level 1 table describes the mapping of the associated 1MB VA range. 


Figure GS-4 on page G5-5739 shows the possible level 1 descriptor formats. 
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31 210 
31 109 8 5 432 10 


Translation table Translation table base address, bits[31:10] | | Domain | | | fol 1 
IMPLEMENTATION DEFINED — RESO- 
NS 
PXN 


20 19 18 17 161514 1211109 8 543210 


Section Section base address, PA[31:20] Jof {sf | | | | Doman | [ele] a] 


NS- nG- XN- PXN— 
AP[2] 
TEX[2:0] 


AP[1:0] 











IMPLEMENTATION DEFINED 








24 23 20191817161514 1211109 8 543210 
Supersection PCLT ST ee af || [efef 
Supersection base address, PA[31:24] —— | NS- nG- XN- PXN— 
Extended base address, PA[35:32] AP[2] 
AP[1:0] 








IMPLEMENTATION DEFINED 
Extended base address, PA[39:36] 





Figure G5-4 VMSAv8-32 Short-descriptor level 1 descriptor formats 
Descriptor bits[1:0] identify the descriptor type. The encoding of these bits is: 


0b00, Invalid entry 
The associated VA is unmapped, and any attempt to access it generates a Translation fault. 


Bits[3 1:2] of the descriptor are IGNORED, see JGNORED on page Glossary-7887. This means 
software can use these bits for its own purposes. 


0b01, Translation table 
The descriptor gives the address of a level 2 translation table, that specifies the mapping of the 
associated 1MByte VA range. 


0b10, Section or Supersection 
The descriptor gives the base address of the Section or Supersection. Bit[18] determines whether 
the entry describes a Section or a Supersection. 


This encoding also defines the PXN field as 0. 


0b11, Section or Supersection, if the implementation supports the PXN attribute 
This encoding is identical to 0b10, except that it defines the PXN field as 1. 





Note 
A VMSAv8-32 implementation can use the Short-descriptor translation table format for the PL1&0 stage 1 
translations, by setting TTBCR.EAE to 0. 





The address information in the level 1 descriptors is: 
Translation table Bits[3 1:10] of the descriptor are bits[3 1:10] of the address of a translation table. 
Section Bits[3 1:20] of the descriptor are bits[31:20] of the address of the Section. 
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Supersection Bits[31:24] of the descriptor are bits[31:24] of the address of the Supersection. 
Optionally, bits[8:5, 23:20] of the descriptor are bits[39:32] of the extended Supersection address. 


For the Non-secure PL1&0 translation tables, the address in the descriptor is the IPA of the translation table, Section, 
or Supersection. Otherwise, the address is the PA of the translation table, Section, or Supersection. 


For descriptions of the other fields in the descriptors, see Memory attributes in the VMSAv8-32 Short-descriptor 
translation table format descriptors on page G5-5741. 
Short-descriptor translation table level 2 descriptor formats 


Figure GS-5 shows the possible formats of a level 2 descriptor. 


31 2 1 0 


Invalid IGNORED fofo] 


161514 1211109 8 6543210 


Large page Large page base address, PA[31:16] | TEX[2:0] fsf | reso | Jefs[o]1] 





XNA ng + APtt:0]— 
ee si 


121110 9 8 6543210 


Small page Small page base address, PA[31:12] | |s| | TEX(2:0] | fejs] | 





nG — AP[t:0]— XN 
a! sei 


Figure G5-5 Short-descriptor level 2 descriptor formats 


Descriptor bits[1:0] identify the descriptor type. The encoding of these bits is: 
0b00, Invalid entry 


The associated VA is unmapped, and attempting to access it generates a Translation fault. 


Bits[3 1:2] of the descriptor are IGNORED, see IGNORED on page Glossary-7887. This means 
software can use these bits for its own purposes. 


0b01, Large page 
The descriptor gives the base address and properties of the Large page. 
0b1x, Small page 


The descriptor gives the base address and properties of the Small page. 

In this descriptor format, bit[0] of the descriptor is the XN field. 
The address information in the level 2 descriptors is: 
Large page __ Bits[31:16] of the descriptor are bits[31:16] of the address of the Large page. 
Small page Bits[31:12] of the descriptor are bits[31:12] of the address of the Small page. 


For the Non-secure PL1&0 translation tables, the address in the descriptor is the IPA of the translation table, Section, 
or Supersection. Otherwise, the address is the PA of the translation table, Section, or Supersection. 


For descriptions of the other fields in the descriptors, see Memory attributes in the VMSAv8-32 Short-descriptor 
translation table format descriptors on page G5-5741. 
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Additional requirements for Short-descriptor format translation tables 


When using Supersection or Large page descriptors in the Short-descriptor translation table format, the input 
address field that defines the Supersection or Large page descriptor address overlaps the table address field. In each 
case, the size of the overlap is 4 bits. The following diagrams show these overlaps: 


è Figure K7-14 on page K7-7711 for the level 1 translation table entry for a Supersection. 
$ Figure K7-16 on page K7-7713 for the level 2 translation table entry for a Large page. 


Considering the case of using Large page descriptors in a level 2 translation table, this overlap means that for any 
specific Large page, the bottom four bits of the level 2 translation table entry might take any value from 0b0000 to 
0b1111. Therefore, each of these 16 index values must point to a separate copy of the same descriptor. 


This means that each Large page or Supersection descriptor must: 
° Occur first on a sixteen-word boundary. 
° Be repeated in 16 consecutive memory locations. 


G5.4.2 Memory attributes in the VMSAv8-32 Short-descriptor translation table format descriptors 
This section describes the descriptor fields other than the descriptor type field and the address field: 


TEX[2:0], C, B 
Memory region attribute fields, see Memory region attributes on page G5-5777. 


These fields are not present in a descriptor for a translation table. 


XN bit The Execute-never field, see Access permissions for instruction execution on page G5-5770. 
This bit is not present in a descriptor for a translation table. 
PXN bit The Privileged execute-never field, see Access permissions for instruction execution on 
page G5-5770. 
When this field is set to 1 in the descriptor for a translation table, it indicates that all memory pages 


described in the corresponding translation table are Privileged execute-never. 


NS bit Non-secure bit. Specifies whether the translated PA is in the Secure or Non-secure address map, see 
Control of Secure or Non-secure memory access, VMSAv8-32 Short-descriptor format on 
page GS-5742. 


This bit is not present in level 2 descriptors. The value of the NS bit in a level 1 descriptor for a 
translation table applies to all entries in the corresponding level 2 translation table. 

Domain Domain field, see Domains, Short-descriptor format only on page G5-5774. 
This field is not present in a Supersection entry. Memory described by Supersections is in domain 0. 
This bit is not present in level 2 descriptors. The value of the Domain field in the level 1 descriptor 
for a translation table applies to all entries in the corresponding level 2 translation table. 

An IMPLEMENTATION DEFINED bit 


This bit is not present in level 2 descriptors. 


AP[2], AP[1:0] 
Access Permissions bits, see Memory access control on page G5-5766. 
AP[0] can be configured as the Access flag, see The Access flag on page G5-5774. 
These bits are not present in a descriptor for a translation table. 


S bit Shareable bit. Used in determining the Shareability of the addressed region, see Memory region 
attributes on page G5-5777. 


— Note 


The naming of this bit as the Shareable bit is carried forward from early versions of the Arm 
architecture. This name is no longer an adequate description of the interpretation of the bit. 
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G5.4.3 


G5.4.4 


G5-5742 


This bit is not present in a descriptor for a translation table. 


nG bit The not global bit. Ifa lookup using this descriptor is cached in a TLB, determines whether the TLB 
entry applies to all ASID values, or only to the current ASID value. See Global and process-specific 
translation table entries on page G5-5789. 


This bit is not present in a descriptor for a translation table. 
Bit[18], when bits[1:0] indicate a Section or Supersection descriptor 


0 Descriptor is for a Section. 
1 Descriptor is for a Supersection. 


Control of Secure or Non-secure memory access, VMSAv8-32 Short-descriptor format 


Access to the Secure or Non-secure PA map on page G5-5735 describes how the NS bit in the translation table 
entries: 


. For accesses from Secure state, determines whether the access is to Secure or Non-secure memory. 
° Is ignored by accesses from Non-secure state. 


In the Short-descriptor translation table format, the NS bit is defined only in the level 1 translation tables. This 
means that, in a level 1 descriptor for a translation table, the NS bit defines the PA map, Secure or Non-secure, for 
all of the Large pages and Small pages of memory described by that table. 


The NS bit of a level 1 descriptor for a translation table has no effect on the PA map in which that translation table 
is held. As stated in Secure and Non-secure address spaces on page G5-5735, the PA of that translation table is in: 


s The Secure address map if the translation table walk is in Secure state. 
è The Non-secure address map if the translation table walk is in Non-secure state. 


This means the granularity of the Secure and Non-secure memory maps is 1MB. However, in these memory maps, 
table entries can define physical memory regions with a granularity of 4KB. 


Selecting between TTBRO and TTBR1, VMSAv8-32 Short-descriptor translation table format 


As described in Determining the translation table base address in the VMSAv8-32 translation regimes on 

page G5-5734, two sets of translation tables can be defined for each of the PL1&0 stage 1 translations, and TTBRO 
and TTBR1 hold the base addresses for the two sets of tables. When using the Short-descriptor translation table 
format, the value of TTBCR.N indicates the number of most significant bits of the input VA that determine whether 
TTBRO or TTBR1 holds the required translation table base address, as follows: 


š If N == 0 then use TTBRO. Setting TTBCR.N to zero disables use of a second set of translation tables. 
° If N > 0 then: 

— If bits[31:32-N] of the input VA are all zero, then use TTBRO. 

— Otherwise use TTBR1. 


Table GS-1 shows how the value of N determines the lowest address translated using TTBR1, and the size of the 
level 1 translation table addressed by TTBRO. 


Table G5-1 Effect of TTBCR.N on address translation, Short-descriptor format 




















TTBRO table 
TTBCR.N First address translated with TTBR1 

Size Index range 
0b000 TTBRI not used 16KB VA[3 1:20] 
0b001 0x80000000 8KB VA[30:20] 
0b010 0x40000000 4KB VA[29:20] 
0b011 0x20000000 2KB VA[28:20] 
0b100 0x10000000 1KB VA[27:20] 
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Table G5-1 Effect of TTBCR.N on address translation, Short-descriptor format (continued) 














TTBRO table 
TTBCR.N First address translated with TTBR1 

Size Index range 
0b101 0x08000000 512 bytes VA[26:20] 
0b110 0x04000000 256 bytes VA[25:20] 
Qb111 0x02000000 128 bytes VA[24:20] 





Whenever TTBCR.N is nonzero, the size of the translation table addressed by TTBR1 is 16KB. 


Figure GS-6 shows how the value of TTBCR.N controls the boundary between VAs that are translated using 
TTBRO, and VAs that are translated using TTBR1. 























OxFFFFFFFF 
= ss ss TTBR1 region = 
TTBRO region 
Effect of decreasing N 
002000000 - saben 
TTBRO region 
0x00000000 


TTBCR.N==0b000 
Use of TTBR1 disabled 


Figure G5-6 How TTBCR.N controls the boundary between the TTBRs, Short-descriptor format 


In the selected TTBR, bits RGN, S, and IRGN[1:0] define the memory region attributes for the translation table 
walk. 


Translation table walks, when using the VMSAv8-32 Short-descriptor translation table format describes the 
translation. 


G5.4.5 Translation table walks, when using the VMSAv8-32 Short-descriptor translation table format 


When using the Short-descriptor translation table format, and a memory access requires a translation table walk: 
a A section-mapped access only requires a read of the level 1 translation table. 
è A page-mapped access also requires a read of the level 2 translation table. 


Reading a level 1 translation table on page G5-5744 describes how either TTBR1 or TTBRO is used, with the 
accessed VA, to determine the address of the level 1 descriptor. 


Reading a level 1 translation table on page G5-5744 shows the output address as A[39:0]: 


s For a Non-secure PL1&0 stage 1 translation, this is the IPA of the required descriptor. A Non-secure PL1 &0 
stage 2 translation of this address is performed to obtain the PA of the descriptor. 


s Otherwise, this address is the PA of the required descriptor. 


The full translation flow for Sections, Supersections, Small pages and Large pages on page G5-5744 then shows the 
complete translation flow for each valid memory access. 
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G5-5744 


Reading a level 1 translation table 


When performing a fetch based on TTBRO: 

° The address bits taken from TTBRO vary between bits[31:14] and bits[31:7]. 

° The address bits taken from the VA, that is the input address for the translation, vary between bits[3 1:20] and 
bits[24:20]. 

The width of the TTBRO and VA fields depend on the value of TTBCR.N, as Figure G5-7 shows. 


When performing a fetch based on TTBR1, Bits TTBR1[31:14] are concatenated with bits[31:20] of the VA. This 
makes the fetch equivalent to that shown in Figure GS-7, with N==0. 


Note 


See The address and Properties fields shown in the translation flows on page K7-7714 for more information about 
the Properties label used in this and other figures. 








31 20 19 0 














31 
Translation base TTBRO 
D) 


14-N! 


13-N 
31 210 
F F A[31:0] of level 1 descriptor : 
Translation base Table index Jo] A[39:32] = 0x00 Descriptor address 


+ This field is absent if N is 0 
N is the value of TTBCR.N 
For details of the Properties field, see the register description 


Figure G5-7 Accessing level 1 translation table based on TTBRO, Short-descriptor format 


Regardless of which register is used as the base for the fetch, the resulting output address selects a four-byte 
translation table entry that is one of: 


è A level 1 descriptor for a Section or Supersection. 
. A descriptor for a translation table, that points to a level 2 translation table. In this case: 

— A second fetch is performed to retrieve a level 2 descriptor. 

— The descriptor also contains some attributes for the access, see Figure G5-4 on page G5-5739. 
s A faulting entry. 


The full translation flow for Sections, Supersections, Small pages and Large pages 


In a translation table walk, only the initial lookup uses the translation table base address from the appropriate TTBR. 
Subsequent lookups use a combination of address information from: 


. The table descriptor read in the previous lookup. 
° The input address. 


Address translation examples using the VMSAv8-32 Short descriptor translation table format on page K7-7710 
shows the full translation flow for each of the memory section and page options. As described in VMSAv8-32 
Short-descriptor translation table format descriptors on page G5-5738, these options are: 


Supersection A 16MB memory region, see Translation flow for a Supersection on page K7-7710. 


Section A 1MB memory region, see Translation flow for a Section on page K7-7711. 
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A 64KB memory region, described by the combination of: 
- A level 1 translation table entry that indicates the address of a level 2 translation table. 
à A level 2 descriptor that indicates a Large page. 


See Translation flow for a Large page on page K7-7712. 
A 4KB memory region, described by the combination of: 


è A level 1 translation table entry that indicates the address of a level 2 translation table. 
e A level 2 descriptor that indicates a Small page. 


See Translation flow for a Small page on page K7-7713. 
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G5.5 The VMSAv8-32 Long-descriptor translation table format 


The VMSAv8-32 Long-descriptor translation table format supports the assignment of memory attributes to memory 
Pages, at a granularity of 4KB, across the complete input address range. It also supports the assignment of memory 
attributes to blocks of memory, where a block can be 2MB or 1GB. 


Note 


° Although the VMSAv8-32 Long-descriptor format is limited to three levels of address lookup, its design and 
naming conventions support extension to additional levels, to support a larger input address range. 





a Similarly, while the VMSAv8-32 implementation limits the output address range to 40 bits, its design 
supports extension to a larger output address range. 





Figure GS-2 on page G5-5725 shows the different address translation stages. The Long-descriptor translation table 


format: 
$ Is used for: 
— The Non-secure EL2 stage 1 translation. 
— The Non-secure PL1&0 stage 2 translation. 
: Can be used for the Secure and Non-secure PL1&0 translations. 


When used for a stage | translation, the translation tables support an input address of up to 32 bits, corresponding 
to the VA address range of the PE. 


When used for a stage 2 translation, the translation tables support an input address range of up to 40 bits, to support 
the translation from IPA to PA. If the input address for the stage 2 translation is a 32-bit address, then this address 
is zero-extended to 40 bits. 


Note 


When the Short-descriptor translation table format is used for the Non-secure stage 1 translations, this generates 
32-bit IPAs. These are zero-extended to 40 bits to provide the input address for the stage 2 translation. 





Overview of VMSAv8-32 address translation using Long-descriptor translation tables summarizes address 
translation from AArch32 state when using the Long-descriptor format translation tables. 


The following sections then describe the format of the descriptors in the Long-descriptor format translation tables: 
$ VMSAv8-32 Long-descriptor translation table format descriptors on page G5-5747. 

. Attribute fields in VMSAv8-32 Long-descriptor translation table format descriptors on page G5-5750. 

$ Control of Secure or Non-secure memory access, VMSAv8-32 Long-descriptor format on page G5-5754. 


The following sections then describe this translation table format: 


à Selecting between TTBRO and TTBR1, VMSAv8-32 Long-descriptor translation table format on 
page G5-5755. 


. VMSAv8-32 Long-descriptor translation table format address lookup levels on page G5-5757. 


. Translation table walks, when using the VMSAv8-32 Long-descriptor translation table format on 
page G5-5761. 


° The algorithm for finding the translation table entries, VMSAv8-32 Long-descriptor format on 
page G5-5764. 
G5.5.1 Overview of VMSAv8-32 address translation using Long-descriptor translation tables 


Figure GS-8 on page G5-5747 gives a general view of VMSAv8-32 stage 1 address translation when using the 
Long-descriptor translation table format. 
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If a level 1 table would contain only one entry, it is skipped, and the TTBR points to 
the level 2 table. This happens if the VA address range is 30 bits or less. 
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Figure G5-8 General view of VMSAv8-32 stage 1 address translation using Long-descriptor format 


Figure G5-9 gives a general view of VMSAv8-32 stage 2 address translation. Stage 2 translation always uses the 
Long-descriptor translation table format. 
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If a level 1 table would contain 16 entries or fewer, level 1 lookup can be omited. If so, VTTBR 
points to the start of a block of concatenated level 2 tables. See text for more information. 


Figure G5-9 General view of VMSAv8-32 stage 2 address translation, Long-descriptor translation table format 


G5.5.2 
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Use of concatenated translation tables for the initial stage 2 lookup on page G5-5758 describes how using 
concatenated level 2 tables means lookup can start at level 2, as referred to in Figure GS-9. 


VMSAv8-32 Long-descriptor translation table format descriptors 


As described in VMSAv8-32 Long-descriptor translation table format address lookup levels on page G5-5757, the 
Long-descriptor translation table format provides up to three levels of address lookup. A translation table walk starts 
either at level 1 or level 2 of the address lookup. 


In general, a descriptor is one of: 


° An invalid or fault entry. 


a A table entry, that points to the next-level translation table. 


° A block entry, that defines the memory properties for the access. 


. A reserved format. 


Bit[1] of the descriptor indicates the descriptor type, and bit[0] indicates whether the descriptor is valid. 


The following sections describe the Long-descriptor translation table descriptor formats: 


. VMSAv8-32 Long-descriptor level 1 and level 2 descriptor formats on page G5-5748. 


. VMSAv8-32 Long-descriptor translation table level 3 descriptor formats on page G5-5749. 
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Information returned by a translation table lookup on page G5-5733 describes the classification of the non-address 
fields in the descriptors between address map control, access controls, and region attributes. 


VMSAv8-32 Long-descriptor level 1 and level 2 descriptor formats 


In the Long-descriptor translation tables, the formats of the level 1 and level 2 descriptors differ only in the size of 
the block of memory addressed by the block descriptor. A block entry: 


è In a level 1 table describes the mapping of the associated 1GB input address range. 
$ In a level 2 table describes the mapping of the associated 2MB input address range. 


Figure G5-10 shows the Long-descriptor level 1 and level 2 descriptor formats: 


63 10 
Invalid | IGNORED 0 
52 51 40 39 12 11 210 


" Upper block attributes SBz* Output address[39:n] RESO Lower block attibutes| o | 1 | 


For the level 1 descriptor, n is 30. For the level 2 descriptor, n is 21. 


NSTable 

APTable Stage 1 only, 

XNTable SBZ at stage 2 
r PXNTable 


63 62 61 60:59 58 52 51 40 39 12 11 2 1 0 


Table LL [I [irene SBz? Next-level table address[39:12] IGNORED Bo 


The level 1 descriptor returns the address of the level 2 table. 
The level 2 descriptor returns the address of the level 3 table. 


+ See the descriptions of the address fields for more information about bits[47:40] of the Block and Table descriptors. 
Figure G5-10 VMSAv8-32 Long-descriptor level 1and level 2 descriptor formats 


Descriptor encodings, Long-descriptor level 1 and level 2 formats 


Descriptor bit[0] identifies whether the descriptor is valid, and is 1 for a valid descriptor. If a lookup returns an 
invalid descriptor, the associated input address is unmapped, and any attempt to access it generates a Translation 
fault. 


Descriptor bit[1] identifies the descriptor type, and is encoded as: 


0, Block The descriptor gives the base address of a block of memory, and the attributes for that memory 
region. 
1, Table The descriptor gives the address of the next level of translation table, and for a stage 1 translation, 


some attributes for that translation. 
The other fields in the valid descriptors are: 


Block descriptor 
Gives the base address and attributes of a block of memory: 


. For a level 1 Block descriptor, bits[39:30] are bits[39:30] of the output address that specifies 
a 1GB block of memory. 


. For a level 2 Block descriptor, bits[39:21] are bits[39:21] of the output address that specifies 
a 2MB block of memory. 


In both cases, if bits[47:40] of the descriptor are not zero then a translation that uses the descriptor 
will generate an Address size fault, see Address size fault on page G5-5812. 
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Bits[63:52, 11:2] provide attributes for the target memory block, see Attribute fields in VUSAv8-32 
Long-descriptor translation table format descriptors on page G5-5750. The position and contents 
of these bits is identical in the level 2 block descriptor and in the level 3 page descriptor. 


Table descriptor 


Bits[39:m] are bits[39:m] of the address of the required next-level table. Bits[m-1:0] of the table 
address are zero: 


s For a level 1 Table descriptor, this is the address of a level 2 table. 
$ For a level 2 Table descriptor, this is the address of a level 3 table. 


In both cases, if bits[47:40] of the descriptor are not zero then a translation that uses the descriptor 
will generate an Address size fault, see Address size fault on page G5-5812. 


For a stage 1 translation only, bits[63:59] provide attributes for the next-level lookup, see Attribute 
fields in VMSAv8-32 Long-descriptor translation table format descriptors on page G5-5750. 


If the translation table defines the Non-secure PL1&0 stage 1 translations, then the output address in the descriptor 
is the IPA of the target block or table. Otherwise, it is the PA of the target block or table. 


VMSAv8-32 Long-descriptor translation table level 3 descriptor formats 
Each entry in a level 3 table describes the mapping of the associated 4KB input address range. 


Figure GS-11 shows the Long-descriptor level 3 descriptor formats. 


63 1 0 


Invalid IGNORED 0 


63 210 

BESS rved, RESO ofa] 
invalid 

52:51 40:39 12:11 210 


Page| Upper page attributes | sBz* Output address[39:12] Lower page attributes] 1 |1 | 


+ See the description of the address field for more information about bits[47:40] of the Page descriptor. 


Figure G5-11 VMSAv8-32 Long-descriptor level 3 descriptor formats 


Descriptor bit[0] identifies whether the descriptor is valid, and is 1 for a valid descriptor. If a lookup returns an 
invalid descriptor, the associated input address is unmapped, and any attempt to access it generates a Translation 
fault. 


Descriptor bit[1] identifies the descriptor type, and is encoded as: 


0, Reserved, invalid 
Behaves identically to encodings with bit[0] set to 0. 


This encoding must not be used in level 3 translation tables. 
1, Page Gives the address and attributes of a 4KB page of memory. 
At this level, the only valid format is the Page descriptor. The other fields in the Page descriptor are: 


Page descriptor 
Bits[39:12] are bits[39:12] of the output address for a page of memory. 


If bits[47:40] of the descriptor are not zero, then a translation that uses the descriptor will generate 
an Address size fault, see Address size fault on page G5-5812. 


Bits[63:52, 11:2] provide attributes for the target memory page, see Attribute fields in VMSAv8-32 
Long-descriptor translation table format descriptors on page G5-5750. The position and contents 
of these bits are identical in the level 1 block descriptor and in the level 2 block descriptor. 
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If the translation table defines the Non-secure PL1&0 stage 1 translations, then the output address in the descriptor 
is the IPA of the target page. Otherwise, it is the PA of the target page. 


G5.5.3 Attribute fields in VMSAv8-32 Long-descriptor translation table format descriptors 


The memory attributes in the VMSAv8-32 Long-descriptor translation tables are based on those in the 
Short-descriptor translation table format, with some extensions. Memory region attributes on page G5-5777 
describes these attributes. In the Long-descriptor translation table format: 


è Table entries for stage 1 translations define attributes for the next level of lookup, see Next-level attributes in 
VMSAv8-32 Long-descriptor stage 1 Table descriptors 


The hierarchical attributes in the translation tables, APTable, XNTable, and PXNTable, permit subtrees of the 
translation tables to be used by different agents. Not all operating systems use this functionality, and so 
ARMv8.2-AA32HPD adds a facility to disable these bits. 


This ability to disable hierarchical attribute bits has no effect on the NSTable bit. 


e Block and Page entries define memory attributes for the target block or page of memory. Stage 1 and stage 2 
translations have some differences in these attributes, see: 


— Attribute fields in VMSAv8-32 Long-descriptor stage 1 Block and Page descriptors on page G5-5751. 
— Attribute fields in VMSAv8-32 Long-descriptor stage 2 Block and Page descriptors on page G5-5753. 


Next-level attributes in VMSAv8-32 Long-descriptor stage 1 Table descriptors 


In a Table descriptor for a stage 1 translation, bits[63:59] of the descriptor define the following attributes for the 
next-level translation table access: 


NSTable, bit[63] 


APTable, bits[62:61] 


XNTable, bit[60] 


PXNTable, bit[59] 


For memory accesses from Secure state, specifies the Security state for subsequent levels of 
lookup, see Hierarchical control of Secure or Non-secure memory accesses, 
Long-descriptor format on page G5-5754. 


For memory accesses from Non-secure state, this bit is ignored. 

Access permissions limit for subsequent levels of lookup, see Hierarchical control ofaccess 
permissions, Long-descriptor format on page G5-5768. 

APTable[0] is reserved, SBZ, in the Non-secure EL2 stage 1 translation tables. 

From Armv8.2, when ARMv8.2-AA32HPD is implemented, this field can be disabled. 


When the value of TTBCR2.HPDO or TTBCR2.HPD1 is 1, and the value of TTBCR.T2E 
is also 1: 


è The value of the corresponding APTable field is IGNORED by hardware, allowing the 
field to be used by software. 


° The behavior of the system is as if the value of the corresponding APTable field is 0, 
that is to say, the APTable field has an Effective value of 0. 

XN limit for subsequent levels of lookup, see Hierarchical control of instruction fetching, 

Long-descriptor format on page G5-5772. 

From Armv8.2, when ARMv8.2-AA32HPD is implemented, this field can be disabled. 


When the value of TTBCR2.HPDO or TTBCR2.HPD1 is 1, and the value of TTBCR.T2E 
is also 1: 


è The value of the corresponding XNTable field is IGNORED by hardware, allowing the 
field to be used by software. 


° The behavior of the system is as if the value of the corresponding XNTable field is 0, 
that is to say, the XNTable field has an Effective value of 0. 

PXN limit for subsequent levels of lookup, see Hierarchical control of instruction fetching, 

Long-descriptor format on page G5-5772. 

This bit is RESO in the Non-secure EL2 stage 1 translation tables. 
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From Armv8.2, when ARMv8.2-AA32HPD is implemented, this field can be disabled. 


When the value of TTBCR2.HPDO or TTBCR2.HPD1 is 1 and the value of TTBCR.T2E is 
also 1: 


° The value of the corresponding PXNTable field is ignored by hardware, allowing the 
field to be used by software. 


° The behavior of the system is as if the value of the corresponding PXNTable field is 
0, that is to say, the PXNTable field has an Effective value of 0. 


Attribute fields in VMSAv8-32 Long-descriptor stage 1 Block and Page descriptors 


In Block and Page descriptors, the memory attributes are split into an upper block and a lower block as shown for 
a stage 1 translation: 


Upper attributes Lower attributes 
63 62 59 58 55 54 53 52 1110987654 2 


J ri [o] | | ATR 


IGNORED —! o nG 7] 
Reserved for software use AF 
XN SH[1:0] 
PXN# AP[2:1] 


Contiguous NS 
Attrindx[2:0] 








tT IGNORED if ARMv8.2-TTPBHA is not implemented. 
Ħ RESO for a translation regime that cannot apply to execution at ELO. 


For a stage 1 descriptor, the attributes are: 


PBHA, bits[62:59] 
Page-based hardware attributes bits. 
These bits are IGNORED when ARMv8.2-TTPBHA is not implemented. 


When ARMv8.2-TTPBHA is implemented, the HTCR and the TTBCR2 registers both contain a 
control bit for each PBHA bit in the translation tables that they control. When the value of that 
control bit is 1, and the value of the corresponding Hierarchical permission disables bit is 1, 
hardware can use that PBHA bit for IMPLEMENTATION DEFINED purposes. 


The control bits for this feature are: 
For a Non-secure EL2 translation regime: 
HTCR.HWUnn 


Controls whether Block or Page descriptor bit[nn] can be used by hardware. 
These controls apply only when the value of HTCR.HPD is 1. 


For a PL1&0 translation regime: 


TTBCR2.HWU1nn 
For the translation tables indicated by TTBR1, controls whether Block or 
Page descriptor bit[nn] can be used by hardware. 
These controls apply only when the value of TTBCR2.HPD1 is 1 and the 
value of TTBCR.T2E is 1. 

TTBCR2.HWU0nn 
For the translation tables indicated by TTBRO, controls whether Block or 
Page descriptor bit[nn] can be used by hardware. 


These controls apply only when the value of TTBCR2.HPD0 is 1 and the 
value of TTBCR.T2E is 1. 
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Implementation of ARMv8.2-TTPBHA requires the implementation of ARMv8.2-AA32HPD, 
which provides the Hierarchical permission disables bits. If ARMv8.2-AA32HPD is implemented 
but ARMv8.2-TTPBHA is not implemented, then the control bits are RAZ/WI but other aspects of 
ARMv8.2-AA32HPD functionality are implemented. If neither feature is implemented, then: 


. The control bits are RAZ/WI. 


a The ARMv8.2-AA32HPD identification registers indicate that the functionality is not 
supported, see ARMv8.2-AA32HPD on page A2-73. 


$ The TTBCR2 register encoding is treated as unallocated. 
XN, bit[54] The Execute-never field, see Access permissions for instruction execution on page G5S-5770. 


PXN, bit[53] The Privileged execute-never field, see Access permissions for instruction execution on 
page G5-5770. 


This bit is RESO in the Non-secure EL2 stage 1 translation tables. 


Contiguous, bit[52] 
Indicates that 16 adjacent translation table entries point to contiguous memory regions, see 
Contiguous bit on page G5-5784. 

nG, bit[11] The not global bit. Determines how the translation is marked in the TLB, see Global and 
process-specific translation table entries on page G5S-5789. 


This bit is RESO in the Non-secure EL2 stage 1 translation tables. 
AF, bit[10] The Access flag, see The Access flag on page G5-5774. 
SH, bits[9:8] Shareability field, see Memory region attributes on page G5S-5777. 
AP[2:1], bits[7:6] 

Access Permissions bits, see Memory access control on page G5-5766. 


— Note 


For consistency with the Short-descriptor translation table formats, the Long-descriptor format 
defines AP[2:1] as the Access Permissions bits, and does not define an AP[0] bit. 


AP[1] is RES1 in the Non-secure EL2 stage 1 translation tables. 


NS, bit[5] Non-secure bit. For memory accesses from Secure state, specifies whether the output address is in 
Secure or Non-secure memory, see Control of Secure or Non-secure memory access, VMSAv8-32 
Long-descriptor format on page G5-5754. 


For memory accesses from Non-secure state, this bit is RESO and is ignored by the PE. 


AttrIndx[2:0], bits[4:2] 


Stage 1 memory attributes index field, for the indicated Memory Attribute Indirection Register, see 
VMSAv8-32 Long-descriptor format memory region attributes on page G5-5783. 


The definition of IGNORED means the architecture guarantees that the PE makes no use of the field, see JGNORED 
on page Glossary-7887. For more information about these fields, see Other fields in the Long-descriptor translation 
table format descriptors on page G5-5784. 
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Attribute fields in VMSAv8-32 Long-descriptor stage 2 Block and Page descriptors 
In Block and Page descriptors, the memory attributes are split into an upper block and a lower block as shown for 
a stage 2 translation: 
Upper attributes Lower attributes 
6362 605958 55 54 53 52 11109 87 65 2 


[r o] fide 


Reserved for use by System MMU AF 
Reserved for software use SH[1:0] 
XN[1:0]* S2AP[1:0] 


Contiguous MemAttr[3:0] 


t Bit[53] is RESO if ARMv8.2-TTS2UXN is not implemented. 
t Bits [62:60] are IGNORED and reserved for use by System MMU if ARMv8.2-TTPBHA is not implemented. 
Bits [59] is IGNORED if ARMv8.2-TTPBHA is not implemented. 


| E 
3 
E 














For a stage 2 descriptor, the attributes are: 


PBHA[3:1], bits[62:60] 
Page-based hardware attributes bits. 


These bits are IGNORED and reserved for System MMU use when ARMv8.2-TTPBHA is not 
implemented. 


When ARMv8.2-TTPBHA is implemented, VTCR_EL2 has a control bit for each PBHA bit in the 
EL1&0 stage 2 translation tables. When the value of that control bit is 1, hardware can use the 
corresponding PBHA bit for IMPLEMENTATION DEFINED purposes. When the value of the control bit 
is 0, the corresponding PBHA bit is IGNORED and reserved for System MMU use. 

PBHA[0], bit[59] 
Page-based hardware attributes bit. 


This bit is IGNORED when ARMv8.2-TTPBHA is not implemented. 


When ARMv8.2-TTPBHA is implemented, VTCR_EL2 has a control bit for this bit in the EL1&0 
stage 2 translation tables. When the value of that control bit is 1, hardware can use this bit for 
IMPLEMENTATION DEFINED purposes. When the value of the control bit is 0, this bit is IGNORED. 


XN[1:0], bits[54:53] 
The stage 2 Execute-never field, see Access permissions for instruction execution on page G5-5770. 
If ARMv8.2-TTS2UXN is not implemented, bit[53] is RESO. 


Contiguous, bit[52] 


Indicates that 16 adjacent translation table entries point to contiguous memory regions, see 
Contiguous bit on page GS-5784. 


AF, bit[10] The Access flag, see The Access flag on page G5-5774. 
SH, bits[9:8] Shareability field, see EL2 control of Non-secure memory region attributes on page GS-5785. 


S2AP, bits[7:6] 
Stage 2 Access Permissions bits, see Hyp mode control of Non-secure access permissions on 
page G5-5775. 

Note 


In the original VMSAv7-32 Long-descriptor attribute definition, this field was called HAP[2:1], for 
consistency with the AP[2:1] field in the stage 1 descriptors and despite there being no HAP[0] bit. 
Armv§8 renames the field for greater clarity. 
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G5.5.4 


G5-5754 


MemAttr, bits[5:2] 


Stage 2 memory attributes, see EL2 control of Non-secure memory region attributes on 
page GS-5785. 


The definition of IGNORED means the architecture guarantees that the PE makes no use of the field, see JGNORED 
on page Glossary-7887. For more information about these fields, see Other fields in the Long-descriptor translation 
table format descriptors on page G5-5784. 


Control of Secure or Non-secure memory access, VMSAv8-32 Long-descriptor format 


Access to the Secure or Non-secure PA map on page G5-5735 describes how the NS bit in the translation table 
entries: 
. For accesses from Secure state, determines whether the access is to Secure or Non-secure memory. 


. Is ignored by accesses from Non-secure state. 


In the Long-descriptor format: 
. The NS bit relates only to the memory block or page at the output address defined by the descriptor. 


è The descriptors also include an NSTable bit, see Hierarchical control of Secure or Non-secure memory 
accesses, Long-descriptor format. 


The NS and NSTable bits are valid only for memory accesses from Secure state. Memory accesses from Non-secure 
state ignore the values of these bits. 


Hierarchical control of Secure or Non-secure memory accesses, Long-descriptor 
format 


For Long-descriptor format table descriptors for stage 1 translations, the descriptor includes an NSTable bit, that 
indicates whether the table identified in the descriptor is in Secure or Non-secure memory. For accesses from Secure 
state, the meaning of the NSTable bit is: 


NSTable == 0 The defined table address is in the Secure PA map. In the descriptors in that translation table, NS 
bits and NSTable bits have their defined meanings. 


NSTable == 1 The defined table address is in the Non-secure PA map. Because this table is fetched from the 
Non-secure address map, the NS and NSTable bits in the descriptors in this table must be ignored. 
This means that, for this table: 


° The value of the NS bit in any block or page descriptor is ignored. The block or page address 
refers to Non-secure memory. 


° The value of the NSTable bit in any table descriptor is ignored, and the table address refers 
to Non-secure memory. When this table is accessed, the NS bit in any block or page 
descriptor is ignored, and all descriptors in the table refer to Non-secure memory. 


In addition, an entry fetched in Secure state is treated as non-global if it is read from Non-secure memory. That is, 
these entries must be treated as if nG==1, regardless of the value of the nG bit. For more information about the nG 
bit, see Global and process-specific translation table entries on page G5-5789. 


The effect of NSTable applies to later entries in the translation table walk, and so its effects can be held in one or 
more TLB entries. Therefore, a change to NSTable requires coarse-grained invalidation of the TLB to ensure that 
the effect of the change is visible to subsequent memory transactions. 





Note 
: When using the Long-descriptor format, table descriptors are defined only for the level 1 and level 2 of 
lookup. 
à Stage 2 translations are performed only for operations in Non-secure state, that can access only the 


Non-secure address map. Therefore, the stage 2 descriptors do not include NS or NSTable bits. 
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G5.5.5 Selecting between TTBRO and TTBR1, VMSAv8-32 Long-descriptor translation table format 


As described in Determining the translation table base address in the VMSAv8-32 translation regimes on 

page G5-5734, two sets of translation tables can be defined for each of the PL1&0 stage 1 translations, and TTBRO 
and TTBR1 hold the base addresses for the two sets of tables. The Long-descriptor translation table format provides 
more flexibility in defining the boundary between using TTBRO and using TTBR1. When a PL1&0 stage 1 address 
translation is enabled, TTBRO is always used. If TTBR1 is also used then: 


è TTBR!1 is used for the top part of the input address range. 
° TTBRO is used for the bottom part of the input address range. 


The TTBCR.TOSZ and TTBCR.T1SZ size fields control the use of TTBRO and TTBR1, as Table G5-2 shows. 


Table G5-2 Use of TTBRO and TTBR1, Long-descriptor format 

















TTBCR Input address range using: 

TOSZ 1T1SZ TTBRO TTBR1 

Qbeee@ = =—ab000 All addresses Not used 

Ma @b000 = Zero to (262-1) 232-M to maximum input address 
b000 Ne Zero to (232-232-N)-1) 232-2(82-M) to maximum input address 
Ma Na Zero to (262-1) 232-2(32-N) to maximum input address 





a. M, N must be greater than 0.The maximum possible value for each of TOSZ and 
T1SZ is 7. 
For stage 1 translations, the input address is always a VA, and the maximum possible VA is (232-1). 
When address translation is using the Long-descriptor translation table format: 


s Figure G5-12 shows how, when TTBCR.T1SZ is zero, the value of TTBCR.TOSZ controls the boundary 
between VAs that are translated using TTBRO, and VAs that are translated using TTBR1. 


TTBCR.T1SZ==0b000 





OxFFFFFFFF [ 


0x80000000 — — <+—\ Boundary, when TTBCR.TOSZ==0b001 


TTBR1 region 


(e 


TTBRO region = = =  |Effect of increasing TTBCR.TOSZ 


0x02000000 — — l + Boundary, when TTBCR. TOSZ==0b111 
TTBRO region 











0x00000000 





TTBCR.TOSZ==0b000 
Use of TTBR1 disabled 


Figure G5-12 Control of TTBR boundary, when TTBCR.T1SZ is zero 


x Figure G5-13 on page G5-5756 shows how, when TTBCR.T1SZ is nonzero, the values of TTBCR.TOSZ and 
TTBCR.T1SZ control the boundaries between VAs that are translated using TTBRO, and VAs that are 
translated using TTBR1. 
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OXFFFFFFFF —-————_Ly -+--+ 
, Effect of : 
ş TTBR1 region = | increasing ş TTBR1 region = | effect of increasing TTBCR.T1SZ 
TTBCR.T1SZ 
Boundary, 
0x80000000 — ates ---- l «— Boundary, when TTBCR.T1SZ==0b001 
TTBCR.T1SZ==0b001  |Access generates a 
F F F ea "J F |Effect of decreasing TTBCR.TOSZ 
see tex 
0x40000000 —| TTBRO region |---------------------------------- Boundary, when TTBCR.TOSZ==0b010 
4 4 & TTBRO region = Effect of increasing TTBCR.TOSZ 
0x00000000 — ——— ---------------------------------- 
TTBCR.TOSZ==0b000 TTBCR.TOSZ>0b000 
Figure G5-13 Control of TTBR boundaries, when TTBCR.T1SZ is nonzero 
When TOSZ and T1SZ are both nonzero: 
—  Ifboth fields are set to 0b001, the boundary between the two regions is 0x80000000. This is identical to 
having TOSZ set to @b000 and T1SZ set to 0b001. 
— Otherwise, the TTBRO and TTBR1 regions are non-contiguous. In this case, any attempt to access an 
address that is in that gap between the TTBRO and TTBR1 regions generates a Translation fault. 
Note 
The handling of the Contiguous bit can mean that the boundary between the translation regions defined 
by the TCR_EL1.TnSZ values and the region for which an access generates a Translation fault is wider 
than shown in Figure G5-13. That is, if the descriptor for an access to the region shown as generating 
a fault has the Contiguous bit set to 1, the access might not generate a fault. Possible errors in 
programming the translation table registers describes this possibility. 
When using the Long-descriptor translation table format: 
è The TTBCR contains fields that define memory region attributes for the translation table walk, for each 
TTBR. These are the SHO, ORGNO, IRGNO, SH1, ORGN1, and IRGN1 bits. 
. TTBRO and TTBR! each contain an ASID field, and the TTBCR.A1 field selects which ASID to use. 
For this translation table format, VMSAv8-32 Long-descriptor translation table format address lookup levels on 
page G5-5757 summarizes the lookup levels, and Translation table walks, when using the VMSAv8-32 
Long-descriptor translation table format on page G5-5761 describes the possible translations. 
Possible errors in programming the translation table registers 
In all the descriptions in this subsection, the size of the input address supported for a PL1&0 stage 1 translation 
refers to the size specified by a TTBCR.TxSZ field. 
Note 
For a PL1&0 stage 1 translation, the input address range can be split so that the lower addresses are translated by 
TTBRO and the higher addresses are translated by TTBR1. In this case, each of input address sizes specified by 
TTBCR.{TOSZ, T1SZ} is smaller than the total address size supported by the stage of translation. 
The following are possible errors in the programming of TTBRO, TTBR1, and TTBCR. For the translation of a 
particular address at a particular stage of translation, either: 
è The block size being used to translate the address is larger than the size of the input address supported at a 
stage of translation used in performing the required translation. This can occur only for the PL1&0 stage 1 
translations, and only when either TTBCR.TOSZ or TTBCR.T1SZ is zero, meaning there is no gap between 
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the address range translated by TTBRO and the range translated by TTBR1. In this case, this programming 
error occurs if a block translated from the region that has TxSZ set to zero straddles the boundary between 
the two address ranges. Example G5-2 shows an example of this mis-programming. 


. The address range translated by a set of blocks marked as contiguous, by use of the contiguous bit, is larger 
than the size of the input address supported at a stage of translation used in performing the required 
translation. 


Example G5-2 Error in programming the translation table registers 


If TTBCR.TOSZ is programmed to 0 and TTBCR.T1SZ is programmed to 7, this means: 
° TTBRO translates addresses in the range 0x00000000-0xFDFFFFFF. 
° TTBR! translates addresses in the range 0xFE000000-0xFFFFFFFF. 


The translation table indicated by TTBRO might be programmed with a block entry for a 1GB region starting at 
0xC 0000000. This covers the address range 0xC0000000-OxFFFFFFFF, that overlaps the TTBR1 address range. This 
means this block size is larger than the input address size supported for translations using TTBRO, and therefore this 
is a programming error. 


To understand why this must be a programming error, consider a memory access to address @xFFFFQ000. According 
to the TTBCR. {TOSZ, T1SZ} values, this must be translated using TTBR1. However, the access matches a TLB 
entry for the translation, using TTBRO, of the block at 0xC0000000. Hardware is not required to detect that the access 
to OxFFFFQ000 is being translated incorrectly. 


In these cases, an implementation might use one of the following approaches: 

e Treat such a block as causing a Translation fault, even though the block is valid, and the address accessed 
within that block is within the size of the input address supported at a stage of translation. 
The block might be a block within a contiguous set of blocks. 


$ Treat such a block as not causing a Translation fault, even though the address accessed within that block is 
outside the size of the input address supported at a stage of translation, provided that both of the following 


apply: 
— The block is valid. 


— Atleast one address within the block, or contiguous set of blocks, is within the size of the input address 
supported at a stage of translation. 


The block might be a block within a contiguous set of blocks. 


Additional constraints apply to programming the VTCR, see Determining the required initial lookup level for stage 
2 translations on page G5-5763. 
G5.5.6 VMSAv8-32 Long-descriptor translation table format address lookup levels 


As stated at the start of this section, because the Long-descriptor translation table format is used for the Non-secure 
PL1&0 stage 2 translations, the format must support input addresses of up to 40 bits. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G5-5757 
ID070919 Non-Confidential 


The AArch32 Virtual Memory System Architecture 
G5.5 The VMSAv8-32 Long-descriptor translation table format 


G5-5758 


Table GS-3 summarizes the properties of the different levels of address lookup when using this format. 


Table G5-3 Properties of the three levels of address lookup with VMSAv8-32 Long-descriptor 
translation tables 














Input address Output address? 

Level Number of entries 
Size Address range? Size Address range 

First Up to 512GB Up to Address[38:0] 1GB Address[39:30] Up to 512 

Second Upto 1GB Up to Address[29:0] 2MB _ Address[39:21] Up to 512 

Third 2MB Address[20:0] 4KB Address[39: 12] 512 





a. Output address when an entry addresses a block of memory or a memory page. If an entry addresses the next level 
of address lookup it specifies Address[39:12] for the next-level translation table. 


b. Input address range for the translation table. See Use of concatenated level 1 translation tables on page G5-5759 
for details of support for additional bits of address at a given level, including possible support of a 40-bit input 
address range for stage 2 translations at level 1. For stage 1 translations at level 1 the input address range is limited 
to the VA size of [31:0]. 


For level 1 and level 2 tables, reducing the input address range reduces the number of addresses in the table and 
therefore reduces the table size. The appropriate Translation Table Control Register specifies the input address 
range. 


Stage 1 translations require an input address range of up to 32 bits, corresponding to VA[31:0]. For these 
translations: 


° For a memory access from a mode other than Hyp mode, the Secure or Non-secure TTBRO or TTBR1 holds 
the translation table base address, and the Secure or Non-secure TTBCR is the control register. 


s For a memory access from Hyp mode, HTTBR holds the translation table base address, and HTCR is the 
control register. 


Note 


For translations controlled by TTBRO and TTBR1, if neither TTBR has an input address range larger than 1GB, 
then translation starts at level 2. Together, TTBRO and TTBR!1 can still cover the 32-bit VA input address range. 








Stage 2 translations require an input address range of up to 40 bits, corresponding to IPA[39:0], and the supported 
input address size is configurable in the range 25-40 bits. Table GS-3 indicates a requirement for the translation 
mechanism to support a 39-bit input address range, Address[38:0]. Use of concatenated translation tables for the 
initial stage 2 lookup describes how a 40-bit IPA address range is supported. For stage 2 translations: 


° VTTBR holds the translation table base address, and VTCR is the control register. 
s If a supplied input address is larger than the configured input address size, a Translation fault is generated. 


Use of concatenated translation tables for the initial stage 2 lookup 


Ifa stage 2 translation would require 16 entries or fewer in its top-level translation table, that stage of translation 
can, instead, be configured so that: 


7 It requires the corresponding number of concatenated translation tables at the next translation level, aligned 
to the size of the block of concatenated translation tables. 


è The stage 2 translation starts at that next translation level. 


Note 
Stage 2 translations always use the Long-descriptor translation table format. 





Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch32 Virtual Memory System Architecture 
G5.5 The VMSAv8-32 Long-descriptor translation table format 


This use of concatenated translation tables is: 


: Required when the stage 2 translation supports a 40-bit input address range, see Use of concatenated level 1 
translation tables. 


° Supported for a stage 2 translation with an input address range of 31-34 bits, see Use of concatenated level 2 
translation tables. 


The use of concatenated translation tables requires the software that is defining the translation to: 


$ Define the concatenated translation tables with the required overall alignment. 

$ Program VTTBR to hold the address of the first of the concatenated translation tables. 

5 Program VTCR to indicate the required input address range and initial lookup level. 
Note 





The use of concatenated translation tables avoids the overhead of an additional level of translation. 





Use of concatenated level 1 translation tables 


The Long-descriptor format translation tables provide 9 bits of address resolution at each level of lookup. However, 
a 40-bit input address range with a translation granularity of 4KB requires a total of 28 bits of address resolution. 
Therefore, a stage 2 translation that supports a 40-bit input address range requires two concatenated level 1 
translation tables, together aligned to 8KB, where: 


$ The table at the address with PA[12:0]==0b0_0000_0000_0000 defines the translations for input addresses with 


bit[39]==0. 

° The table at the address with PA[12:0]==0b1_0000_0000_0000 defines the translations for input addresses with 
bit[39]==1. 

s The 8KB alignment requirement means that both tables have the same value for PA[39:13]. 


Use of concatenated level 2 translation tables 


A stage 2 translation with an input address range of 31-34 bits can start the translation either: 
è With a level 1 lookup, accessing a level 1 translation table with 2-16 entries. 
d With a level 2 lookup, accessing a set of concatenated level 2 translation tables. 


Table G5-4 shows these options, for each of the input address ranges that can use this scheme. 


Note 


Because these are stage 2 translations, the input address range is an IPA range. 








Table G5-4 Possible uses of concatenated translation tables for level 2 lookup 





Input address range Lookup starts at level1 Lookup starts at level 2 














IPA range Size Required level 1 entries Number of concatenated tables Required alignmenta 
IPA[30:0] 23! bytes 2 2 8KB 

IPA[31:0] 232 bytes 4 4 16KB 

IPA[32:0] 233 bytes 8 8 32KB 

IPA[33:0] 234 bytes 16 16 64KB 





a. Required alignment of the set of concatenated level 2 tables. 
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See also Determining the required initial lookup level for stage 2 translations on page G5-5763. 
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G5.5.7 Translation table walks, when using the VMSAv8-32 Long-descriptor translation table format 
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Figure GS-2 on page G5-5725 shows the possible address translations. Ifa stage of translation is controlled from an 
Exception level that is using AArch32, the input and output address constraints and the registers that control the 
translation are as follows: 


Stage 1 translations 
For all stage 1 translations: 
: The input address range is up to 32 bits, as determined by either: 
—  TTBCR.TOSZ or TTBCR.T1SZ, for a PL1&0 stage 1 translation. 
—  HTCR.TOSZ, for an EL2 stage 1 translation. 
` The output address range is 40 bits. 
The stage 1 translations are: 


Non-secure PL1&0 stage 1 translation 


The stage 1 translation for memory accesses from Non-secure modes other than Hyp 
mode. This translates a VA to an IPA. For this translation, when Non-secure EL1 is 
using AArch32: 


° Non-secure TTBRO or TTBR1 holds the translation table base address. 
° Non-secure TTBCR determines which TTBR is used. 

Non-secure EL2 stage 1 translation 
The stage 1 translation for memory accesses from Hyp mode, translates a VA to a PA. 
For this translation, when EL2 is using AArch32, HTTBR holds the translation table 
base address. 

Secure PL1&0 stage 1 translation 


The stage 1 translation for memory accesses from Secure modes, translates a VA to a 
PA. For this translation, when the Secure PL1 modes are using AArch32: 


. Secure TTBRO or TTBR1 holds the translation table base address. 
. Secure TTBCR determines which TTBR is used. 


Stage 2 translation 


Non-secure PL1&0 stage 2 translation 


The stage 2 translation for memory accesses from Non-secure modes other than Hyp 
mode, and translates an IPA to a PA. For this translation, when EL2 is using AArch32: 


° The input address range is 40 bits, and VTCR.TOSZ determines the input address 
size. 


. The output address range depends on the implemented memory system, and is up 
to 40 bits. 


. VTTBR holds the translation table base address. 


° VTCR specifies the required input address range, and whether the initial lookup 
is at level 1 or at level 2. 


The descriptions of the VMSAv8-32 translation stages state that the maximum output address size is 40 bits. 
However, the register and Long-descriptor format descriptor fields that hold these addresses are 48 bits wide. If 
bits[47:40] of an output address are not all zero, then the address generates an Address size fault. 


The Long-descriptor translation table format provides up to three levels of address lookup, as described in 
VMSAv8-32 Long-descriptor translation table format address lookup levels on page G5-5757, and the initial 
lookup, in which the MMU reads the translation table base address, is at either level 1 or level 2. The following 
determines the level of the initial lookup: 


$ For a stage 1 translation, the required input address range. For more information, see Determining the 
required initial lookup level for stage 1 translations on page G5-5763. 


: For a stage 2 translation, the level specified by the VTCR.SLO field. For more information, see Determining 
the required initial lookup level for stage 2 translations on page G5-5763. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G5-5761 
Non-Confidential 


The AArch32 Virtual Memory System Architecture 
G5.5 The VMSAv8-32 Long-descriptor translation table format 


Note 
For a stage 2 translation, the size of the required input address range constrains the VTCR.SLO value. 








Figure GS-14 shows how the descriptor address for the initial lookup for a translation using the Long-descriptor 
translation table format is determined from the input address and the TTBR value. This figure shows the lookup for 
a translation that starts with a level 1 lookup, that translates bits[39:30] of the input address, zero extended if 


necessary. 


Input address 








56.55 48:47 40:39 


63 n:n-1 0 
RESO Register-defined Translation table base address[39:n] RESO | TTBR 
N y, 
í Y l 


n-1 


39 n 32 0 


See text for more information about the translation table base register used, and the value of n. 

t+ This field is absent if n is 13. 

t For a Non-secure PL1&0 stage 1 translation, the IPA of the descriptor. Otherwise, the PA of the descriptor. 
§ See the lookup description for more information about bits[40:47] of the TTBR 











Figure G5-14 VMSAv8-32 Long-descriptor initial lookup, starting at level 1 


If bits[47:40] of the TTBR are not zero then the initial lookup will generate an Address size fault, see Address size 
fault on page G5-5812. 


For a translation that starts with a level 1 lookup, as shown in Figure G5-14: 


For a stage 1 translation 
n is in the range 4-5 and: 
. For a memory access from Hyp mode: 
— HTTBR is the TTBR. 
—  n=5-(HTCR.TOSZ). 
° For other accesses: 


— The Secure or Non-secure instance of TTBRO or TTBR1 is the TTBR. 
— _ n=(5-TTBCR.TxSZ), where x is 0 when using TTBRO, and 1 when using TTBR1. 


For a stage 2 translation 
n is in the range 4-13 and: 
° VTTBR is the TTBR. 
° n=5-(VTCR.TOSZ). 
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For a translation that starts with a level 2 lookup, the descriptor address is obtained in the same way, except that 
bits[(m+17):21] of the input address provide bits[(7-1):3] of the descriptor address, where: 
For a stage 1 translation 


n is in the range 7-12. As Determining the required initial lookup level for stage 1 translations 
shows, for a stage | translation to start with a level 2 lookup, the corresponding TOSZ or T1SZ field 
must be 2 or more. This means: 


. For a memory access from Hyp mode, n=14-HTCR.TOSZ. 
° For other memory accesses, n=14-(TTBCR.TxSZ), where x is 0 when using TTBRO, and 1 
when using TTBR1. 
For a stage 2 translation 
n is in the range 7-16. For a stage 2 translation to start with a level 2 lookup, VTCR.SLO is 0b00, and 
n=14-(VTCR.TOSZ). 


The following sections describe how the level of the initial lookup is determined: 
. Determining the required initial lookup level for stage 1 translations. 


7 Determining the required initial lookup level for stage 2 translations. 


Address translation examples using the VMSAv8-32 Long descriptor translation table format on page K7-7715 
shows examples of full translation flows, to an entry fora 4KB memory page, for lookups starting at level 1 and 
lookups starting at level 2. 


Determining the required initial lookup level for stage 1 translations 


For a stage 1 translation, the required input address range, indicated by a TOSZ or T1SZ field in a translation table 
control register, determines the initial lookup level. The size of this input address region is 262-T*SZ) bytes, and if 
this size is: 


: Less than or equal to 23° bytes, the required start is at level 2, and translation requires two levels of table to 
map to 4KB pages. This corresponds to a TxSZ value of 2 or more. 


è More than 230 bytes, the required start is at level 1, and translation requires three levels of table to map to 
4KB pages. This corresponds to a TxSZ value that is less than 2. 


For the PL1&0 stage 1 translations, the TTBCR: 


s Splits the 32-bit VA input address range between TTBRO and TTBR1, see Selecting between TTBRO and 
TTBR1, VMSAv8-32 Long-descriptor translation table format on page G5-5755. 


s Holds the input address range sizes for TTBRO and TTBR1, in the TTBCR.TOSZ and TTBCR.T1SZ fields. 


For the EL2 stage 1 translations, HTCR.TOSZ indicates the size of the required input address range. For example, 
if this field is 0b000, it indicates a 32-bit VA input address range, and translation lookup must start at level 1. 


Determining the required initial lookup level for stage 2 translations 


For a PL1&0 stage 2 translation, the output address range from the PL1&0 stage 1 translations determines the 
required input address range for the stage 2 translation. 


VTCR.SLO indicates the starting level for the lookup. The permitted SLO values are: 
0bee Stage 2 translation lookup must start at level 2. 
0b01 Stage 2 translation lookup must start at level 1. 


In addition, VTCR.TOSZ must indicate the required input address range. The size of the input address region is 
2(32-T0SZ) bytes. 
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G5.5.8 


G5-5764 


Note 


VTCR.TOSZ holds a four-bit signed integer value, meaning it supports values from -8 to 7. This is different from 
the other translation control registers, where TnSZ holds a three-bit unsigned integer, supporting values from 0 to 7. 





The programming of VTCR must follow the constraints shown in Table GS-5, otherwise any attempt to perform a 
translation table walk that uses the stage 2 address translation generates a stage 2 level 1 Translation Fault. The table 
also shows how the VTCR.SLO and VTCR.TOSZ values determine the VTTBR.BADDR field width. 


Note 


If VICR.SLO is programmed to a reserved value then the constraints shown in Table G5-5 are not met, and a 
translation table walk that uses stage 2 translation generates a stage 2 level 1 Translation fault. 








Table G5-5 Input address range constraints on programming VTCR 





VTCR.SLO VTCR.TOSZ Input address range, R Initial lookup level BADDR[39:x] width@ 














0b00 2to7 R<230bytes Level 2 [39:12] to [39:7] 
0b00 -2 tol 230<R<234bytes Level 2 [39:16] to [39:13] 
0b01 -2 to 1 Level 1 [39:7] to [39:4] 
0b01 -8 to -3 234<R Level 1 [39:13] to [39:8] 





a. The first range corresponds to the first TOSZ value, the second range to the second TOSZ value. 


In addition, VTCR.S must be programmed to the value of TOSZ[3], otherwise behavior is CONSTRAINED 
UNPREDICTABLE with the resulting behavior being that VITCR.TOSZ is treated as an UNKNOWN value. 


Note 


VTCR.TOSZ being treated as an UNKNOWN value results in a stage 2 level 1 Translation Fault if that UNKNOWN 
value is not consistent with the programmed value of VTCR.SLO. 








CONSTRAINED UNPREDICTABLE behaviors associated with the VTCR on page K1-7625 describes these 
CONSTRAINED UNPREDICTABLE behaviors. 


Where necessary, the initial lookup level provides multiple concatenated translation tables, as described in Use of 
concatenated level 2 translation tables on page G5-5759. This section also gives more information about the 
alternatives, shown in Table G5-5, when R is in the range 231-234, 


The algorithm for finding the translation table entries, VMSAv8-32 Long-descriptor format 


This section gives the algorithm for finding the translation table entry that corresponds to a given IA, for each 
required level of lookup. The algorithm encodes the descriptions of address translation given earlier in this section. 
The VMSAv8-32 Long-descriptor format uses a 4KB translation granule. 


The description uses the following terms: 


BaseAddr The base address for the level of lookup, as defined by: 


s For the initial lookup level, the TTBR.BADDR base address field in the appropriate TTBR, 
see the description of TnSZ on page G5-5765. 


° Otherwise, the translation table address returned by the previous level of lookup. 
IA The supplied IA for this stage of translation. 
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TnSZ The translation table size for this stage of translation: 


For PL1&0 stage 1 —_ Either: 
s TTBCR.TOSZ if the translation is using TTBRO. 
. TTBCR.T1SZ if the translation is using TTBR1. 


For PL1&0 stage2 VTCR.TOSZ. The translation uses VTTBR. 
For EL2 stage 1 HTCR.TOSZ. The translation uses HTTBR. 


SLO VTCR.SLO. Applies to the Non-secure PL1&0 stage 2 translation only. 


Table GS-6 shows the translation table descriptor address, for each level of lookup. The table shows only 
architecturally-valid programming of the TCR. See also Possible errors in programming the translation table 
registers on page G5-5756. 


Table G5-6 Translation table entry addresses, VMSAv8-32 using Long-descriptor format 





Entry address and conditions 











a General conditions 
Stage 1 translation Stage 2 translation 
One BaseAddr[39:x]:IA[y:30]:0b000 BaseAddr[39:x]:IA[y:30]:0b000 y=(x + 26) 
ifa 0 < TnSZ < 1 then x = (5 - TnSZ) if SLO> == 1 then 
if? -8 < TOSZ < 1 then x = (5 - TOSZ) 
Two BaseAddr[39:x]:IA[y:21]:0b000 BaseAddr[39:x]:IA[y:2 1]:0b000 y=(x+17) 
ifa 2 <TnSZ < 7 thenx=(14-TnSZ) if SLO = 0 then 
if@ -2 < TOSZ <7 then x = (14 - TOSZ) 
else® x =12 elsif° SLO? == 1 then x = 12 
Three BaseAddr[39:12]:IA[20:12]:0b000 BaseAdd1[39:12]:IA[20:12]:@b000 - 
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This line indicates the range of permitted values for TnSZ, for a lookup that starts at this level, see Use of concatenated 
translation tables for the initial stage 2 lookup on page G5-5758. 


SLO == 0 if the initial lookup is level 2, SLO == 1 if the initial lookup is level 1. 
This is the case where this level of lookup is not the initial level of lookup. 
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G5.6 Memory access control 


In addition to an output address, a translation table entry that refers to page or region of memory includes fields that 
define properties of the target memory region. Information returned by a translation table lookup on page G5-5733 
describes the classification of those fields as address map control, access control, and memory attribute fields. The 
access control fields, described in this section, determine whether the PE, in its current state, is permitted to perform 
the required access to the output address given in the translation table descriptor. Ifa translation stage does not 

permit the access, then an MMU fault is generated for that translation stage, and no memory access is performed. 


The following sections describe the memory access controls: 


s About access permissions. 
. About the PAN bit on page G5-5769. 
° Access permissions for instruction execution on page G5-5770. 


. Domains, Short-descriptor format only on page G5-5774. 
. The Access flag on page G5-5774. 


° Hyp mode control of Non-secure access permissions on page G5-5775. 


G5.6.1 About access permissions 


The translation table descriptors include fields that define access permissions for data accesses and for instruction 
fetches. This section introduces those fields. In addition: 


° System register controls can prevent execution from writable locations, see Preventing execution from 
writable locations on page G5-5773. 


: In Armv8.1, the PSTATE.PAN can affect the access permissions for privileged data accesses, see About the 
PAN bit on page G5-5769. 


Note 


This section gives a general description of memory access permissions. Software executing at PL1 in Non-secure 
state can see only the access permissions defined by the Non-secure PL1&0 stage 1 translations. However, software 
executing at EL2 can modify these permissions, as described in Hyp mode control of Non-secure access permissions 
on page G5-5775. This modification is invisible to Non-secure software executing at EL1 or ELO. 








Access permission bits in a translation table descriptor control access to the corresponding memory region. The 
details of this control depend on the translation table format, as follows: 
Short-descriptor format 


This format supports two options for defining the access permissions: 
. Three bits, AP[2:0], define the access permissions. 
a Two bits, AP[2:1], define the access permissions, and AP[0] can be used as an Access flag. 


SCTLR.AFE selects the access permissions option. Setting this bit to 1, to enable the Access flag, 
also selects use of AP[2:1] to define access permissions. 


Arm deprecates any use of the AP[2:0] scheme for defining access permissions. 


Long-descriptor format 


AP[2:1] to control the access permissions, and the descriptors provide an AF bit for use as an Access 
flag. This means VMSAv8-32 behaves as if the value of SCTLR.AFE is 1, regardless of the value 
that software has written to this bit. 

— Note 

When use of the Long-descriptor format is enabled, SCTLR.AFE is UNK/SBOP. 





The Access flag on page G5-5774 describes the Access flag, for both translation table formats. 


The XN and PXN bits provide additional access controls for instruction fetches, see Access permissions for 
instruction execution on page G5-5770. 
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An attempt to perform a memory access that the translation table access permission bits do not permit generates a 
Permission fault, for the corresponding stage of translation. However, when using the Short-descriptor translation 
table format, it generates the fault only if the access is to memory in the Client domain, see Domains, 
Short-descriptor format only on page G5-5774. 


Note 


For the Non-secure PL1&0 translation regime, memory accesses are subject to two stages of translation. Each stage 
of translation has its own, independent, fault checking. Fault handling is different for the two stages, see Exception 
reporting in a VMSAv8-32 implementation on page G5-5822. 








The following sections describe the two access permissions models: 
. AP[2:1] access permissions model. 


. AP[2:0] access permissions control, Short-descriptor format only on page G5-5768. This section includes 
some information on access permission control in earlier versions of the Arm VMSA. 


AP[2:1] access permissions model 


Note 


Arm recommends that this model is always used, even where the AP[2:0] model is permitted. Some documentation 
describes the AP[2:1] model as the simplified access permissions model. 





This access permissions model is used if the translation is either: 
è Using the Long-descriptor translation table format. 
e Using Short-descriptor translation table format, and the SCTLR.AFE bit is set to 1. 


In this model: 

° One bit, AP[2], selects between read-only and read/write access. 

. A second bit, AP[1], selects between Application level (ELO) and System level (PL1) control. 
For the Non-secure EL2 stage 1 translations, AP[1] is SBO. 


This provides four access combinations: 


° Read-only at all privilege levels. 
: Read/write at all privilege levels. 
$ Read-only at PL1, no access by software executing at ELO. 
s Read/write at PL1, no access by software executing at ELO. 


Table G5-7 shows this access control model. 


Table G5-7 VMSAv8-32 AP[2:1] access permissions model 





AP[2], disable write access AP[1], enable unprivileged access Access 











0 0a Read/write, only at PL1 
0 1 Read/write, at any privilege level 
1 0a Read-only, only at PL1 
1 1 Read-only, at any privilege level 





a. Not valid for Non-secure EL2 stage 1 translation tables. AP[1] is SBO in these tables. 
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Hierarchical control of access permissions, Long-descriptor format 


The Long-descriptor translation table format introduces a mechanism that entries at one level of translation table 
lookup can use to set limits on the permitted entries at subsequent levels of lookup. This applies to the access 
permissions, and also to the restrictions on instruction fetching described in Hierarchical control of instruction 
fetching, Long-descriptor format on page G5-5772. 


The restrictions apply only to subsequent levels of lookup at the same stage of translation. The APTable[1:0] field 
restricts the access permissions, as Table G5-8 shows. 


However, in an implementation that includes ARMv8.2-AA32HPD, when hierarchical control of data access 
permissions is disabled for a translation regime, the information in this subsection does not apply. See Attribute 
fields in VMSAv8-32 Long-descriptor translation table format descriptors on page G5-5750. 


As stated in the table footnote, for the Non-secure EL2 stage 1 translation tables, APTable[0] is reserved, SBZ. 


Table G5-8 Effect of APTable[1:0] on subsequent levels of lookup 





APTable[1:0] 


Effect 














00 No effect on permissions in subsequent levels of lookup. 

01a Access at ELO not permitted, regardless of permissions in subsequent levels of lookup. 

10 Write access not permitted, at any Exception level, regardless of permissions in subsequent levels of lookup. 
11a Regardless of permissions in subsequent levels of lookup: 


: Write access not permitted, at any Exception level. 
° Read access not permitted at ELO. 





a. Not valid for the Non-secure EL2 stage 1 translation tables. In those tables, APTable[0] is SBZ. 


G5-5768 


Note 


The APTable[1:0] settings are combined with the translation table access permissions in the translation tables 
descriptors accessed in subsequent levels of lookup. They do not restrict or change the values entered in those 
descriptors. 








The Long-descriptor format provides APTable[1:0] control only for the stage 1 translations. The corresponding bits 
are SBZ in the stage 2 translation table descriptors. 


The effect of APTable applies to later entries in the translation table walk, and so its effects can be held in one or 
more TLB entries. Therefore, a change to APTable requires coarse-grained invalidation of the TLB to ensure that 
the effect of the change is visible to subsequent memory transactions. 


AP[2:0] access permissions control, Short-descriptor format only 


This access permissions model applies when using the Short-descriptor translation tables format, and the 
SCTLR.AFE bit is set to 0. Arm deprecates any use of this access permissions model. 


When SCTLR.AFE is set to 0, ensuring that the AP[0] bit is always set to 1 effectively changes the access model to 
the simpler model described in AP/2:1] access permissions model on page G5-5767. 
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Table GS-9 shows the full AP[2:0] access permissions model: 


Table G5-9 VMSAv8-32 MMU access permissions 





AP[2] AP[1:0] PL1access Unprivileged access Description 


























0 00 No access No access All accesses generate Permission faults 
01 Read/write No access Access only at PL1 
10 Read/write Read-only Writes at ELO generate Permission faults 
11 Read/write Read/write Full access 
1 00 - - Reserved 
01 Read-only No access Read-only, only at PL1 
10 Read-only Read-only Read-only at any Exception level, deprecated 
11 Read-only Read-only Read-only at any Exception level? 


a. From VMSAv7, Arm strongly recommends use of the 0b11 encoding for Read-only at any Exception level. 
b. This mapping was introduced in VMSAv7, and is reserved in earlier versions of the VMSA. 


Note 


è VMSAv8-32 supports the full set of access permissions shown in Table G5-9 only when SCTLR.AFE is set 
to 0. When SCTLR.AFE is set to 1, the only supported access permissions are those described in AP/2:1/ 
access permissions model on page G5-5767. 





° Some old documentation describes the AP[2] bit in the translation table entries as the APX bit. 





G5.6.2 About the PAN bit 
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When the value of PSTATE.PAN is 1, any privileged data access from PL1 or EL2 to a virtual memory address that 
is accessible at ELO generates a Permission fault. 


When the value of PSTATE.PAN is 0, the translation system is the same as in Armv8.0. 


A corresponding PAN bit is added to CPSR and SPSR for exception returns, and DSPSR for entry to and exit from 
Debug state. 


A new SPAN bit is added to SCTLR that controls whether the PAN state bit is set on taking an exception to EL1 
from either Secure or Non-secure state, or to EL3 from Secure state when EL3 is using AArch32. 


CPSR.PAN bit can be written using an MSR instruction at PL1 or higher. Data writes to CPSR.PAN using an MSR 
instruction at ELO are ignored. The value that is returned for an MRS instruction of CPSR from ELO is UNKNOWN. In 
keeping with all other writes to the CPSR, other than for instruction fetches, the effect of the PAN state bit does not 
need to be explicitly synchronized. 


The PAN state bit has no effect on: 

° Data Cache instructions. 

s Address translation instructions, other than ATS1CPRP and ATS1CPWP when ARMv8.2-ATS1E1 is implemented. 

. Unprivileged instructions, LDRBT, LDRHT, LDRT, LDRSBT, LDRSHT, STRBT, STRHT, STRT, STRSBT, and STRSHT, unless 
HCR_EL2.{E2H, TGE} == {1, 0}. 

. Instruction accesses. 


. Manager domains. 


The PAN bit has no effect when the first stage of translation is disabled for the current translation regime or when 
the first stage of translation for the current translation regime does not describe the permissions for access at ELO. 
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If access is disabled, then the access will give rise to a stage 1 Permission fault. 


On an exception taken from AArch32: 
$ CPSR.PAN is copied to SPSR_ELx.PAN, when the target Exception level is AArch64. 
s CPSR.PAN is copied to SPSR.PAN, when the target Exception level is AArch32. 


On an exception return from AArch32 to AArch32, SPSR.PAN is copied to CPSR.PAN. 
On entry to Debug state, CPSR.PAN is copied to DSPSR.PAN. 

On exit from Debug state, DSPSR.PAN is copied to CPSR.PAN. 

The CPSR.PAN bit is not an Execution state bit. 


Note 
s In Non-debug state, in AArch32 state, software can use the SETPAN #imm instruction to modify PSTATE.PAN. 








7 In Debug state, in AArch32 state, a debugger can use the ERET instruction to perform a DRPS operation to 
modify PSTATE.PAN. 
G5.6.3 Access permissions for instruction execution 


Execute-never controls provide an additional level of control on memory accesses permitted by the access 
permissions settings. These controls are: 


XN, Execute-never 
Descriptor bit[54], defined as XN for: 


° Stage 1 of any translation regime. 
s Stage 2 translations when ARMv8.2-TTS2UXN is not implemented. 
Note 





XN[1:0], Execute-never, stage 2 only describes the stage 2 control when 
ARMv8.2-TTS2UXN is implemented. 


This field applies to execution at any Exception level to which the stage of translation applies. A 
value of 0 indicates that this control permits execution. 
PXN, Privileged execute-never, stage 1 only 


Descriptor bit[53], used only for stage 1 of any translation regime for which the stage 1 translation 
can support two VA ranges: 


. For stage 1 ofa translation regime for which the stage 1 translation supports only a single VA 
range the stage 1 descriptors define a PXN field that is RESO, meaning it is ignored by 
hardware. 


This field applies only to execution at an Exception level higher than ELO. A value of 0 indicates 
that this control permits execution. 
XN[1:0], Execute-never, stage 2 only 


Descriptor bits[54:53], defined as XN[1:0] for: 
s Stage 2 translations when ARMv8.2-TTS2UXN is implemented. 
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Table G5-10 shows the operation of this control. 


Table G5-10 XN[1:0] stage 2 access permissions model 





XN[1] XN[O] Access 

















0 0 The stage 2 control permits execution at EL1 and ELO if read access is permitted 

0 1 The stage 2 control does not permit execution at EL1, but permits execution at ELO if read access is permitted 

1 0 The stage 2 control does not permit execution at EL1 or at ELO 

1 1 The stage 2 control permits execution at EL1 ifread access is permitted, but does not permit execution at ELO 
—— Note 


For stage 2 translations when ARMv8.2-TTS2UXN is not implemented, descriptor bit[53] is RESO, 
meaning it is ignored by hardware, and bit[54] is the XN control, see XN, Execute-never on 
page G5-5770. 





Executing an instruction at ELx in a particular Security state generates a Permission fault unless all of the following 
are true for the instruction address: 


7 Any stage 1 execute-never control that applies to execution at ELx in the current Security state permits 
execution. 
è If the translation regime that applies to ELx in the current Security state has two stages of translations, the 


stage 2 execute-never control that applies to execution at ELx permits execution. 
. Read access is permitted. 


However, if a stage 1 translation is using the Short-descriptor translation table format and the address is in a 
Managers domain the stage 1 access permissions are not checked, and therefore the access cannot cause a stage 1 
Permission fault, see Domains, Short-descriptor format only on page G5-5774. 


See also Hyp mode control of Non-secure access permissions on page G5-5775. 


In addition, System register controls can enforce execute-never restrictions, regardless of the settings in the 
translation table XN and PXN fields, see: 


. Restriction on Secure instruction fetch on page G5-5773. 


. Preventing execution from writable locations on page G5-5773. 


The execute-never controls apply also to speculative instruction fetching. This means a speculative instruction fetch 
from a memory region that is execute-never at the current level of privilege is prohibited. 


The execute-never controls means that, when the stage of address translation is enabled, the PE can fetch, or 
speculatively fetch, an instruction from a memory location only if all of the following apply: 


$ If using the Short-descriptor translation table format, the translation table descriptor for the location does not 
indicate that it is in a No access domain. 


, If using the Long-descriptor translation table format, or using the Short descriptor format and the descriptor 
indicates that the location is in a Client domain, in the descriptor for the location the following apply: 


— The stage 1 execute-never control for the Exception level at which the instruction is executed permits 
execution. 


— Fora translation regime with two stages of address translation, the stage 2 execute-never control that 
applies to the Exception level at which the instruction is executed permits execution. 


— The access permissions permit a read access from the current PE mode. 


. No other Prefetch Abort condition exists. 
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G5-5772 





Note 


2 The PXN control applies to the PE privilege when it attempts to execute the instruction. In an implementation 
that fetches instructions speculatively, this might not be the privilege when the instruction was prefetched. 
Therefore, the architecture does not require the PXN control to prevent instruction fetching. 


š Although the XN control applies to speculative fetching, on a speculative instruction fetch from an XN 
location, no Permission fault is generated unless the PE attempts to execute the instruction that would have 
been fetched from that location. This means that, if a speculative fetch from an XN location is attempted, but 
there is no attempt to execute the corresponding instruction, a Permission fault is not generated. 


` The software that defines a translation table must mark any region of memory that is read-sensitive as XN, 
to avoid the possibility of a speculative fetch accessing the memory region. This means it must mark any 
memory region that corresponds to a read-sensitive peripheral as XN. Hardware does not prevent speculative 
accesses to a region of any Device memory type unless that region is also marked as execute-never for all 
Exception levels from which it can be accessed. 


$ When using the Short-descriptor translation table format, the XN attribute is not checked for domains marked 
as Manager. Therefore, the system must not include read-sensitive memory in domains marked as Manager, 
because the XN field does not prevent speculative fetches from a Manager domain. 





When no stage of address translation for the translation regime is enabled, memory regions cannot have XN or PXN 
attributes assigned. Behavior of instruction fetches when all associated address translations are disabled on 
page G5-5730 describes how disabling all MMUs affects instruction fetching. 


Hierarchical control of instruction fetching, Long-descriptor format 


The Long-descriptor translation table format introduces a mechanism that means entries at one level of translation 
tables lookup can set limits on the permitted entries at subsequent levels of lookup. This applies to the restrictions 
on instruction fetching, and also to the access permissions described in Hierarchical control of access permissions, 
Long-descriptor format on page G5-5768. 


Note 


Similar hierarchical controls apply to data accesses, see Hierarchical control of access permissions, 
Long-descriptor format on page G5-5768. 








However, in an implementation that includes ARMv8.2-AA32HPD, when hierarchical control of instruction 
fetching is disabled for a translation regime, the information in this subsection does not apply. See Attribute fields 
in VMSAv8-32 Long-descriptor translation table format descriptors on page G5-5750. 


The restrictions apply only to subsequent levels of lookup at the same stage of translation, and: 


° XNTable restricts the XN control: 


— When XNTable is set to 1, the XN field is treated as 1 in all subsequent levels of lookup, regardless of 
the actual value of the field. 


— When XNTable is set to 0 it has no effect. 


° PXNTable restricts the PXN control: 


— When PXNTable is set to 1, the PXN field is treated as 1 in all subsequent levels of lookup, regardless 
of the actual value of the field. 


— When PXNTable is set to 0 it has no effect. 





Note 


The XNTable and PXNTable settings are combined with the XN and PXN fields in the translation table descriptors 
accessed at subsequent levels of lookup. They do not restrict or change the values entered in those descriptors. 








The XNTable and PXNTable controls are provided only in the Long-descriptor translation table format, and only 
for stage 1 translations. The corresponding bits are SBZ in the stage 2 translation table descriptors. 
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The effect of XNTable or PXNTable applies to later entries in the translation table walk, and so its effects can be 
held in one or more TLB entries. Therefore, a change to XNTable or PXNTable requires coarse-grained invalidation 
of the TLB to ensure that the effect of the change is visible to subsequent memory transactions. 


Preventing execution from writable locations 


Armv8 provides control bits that, when the corresponding stage 1 address translation is enabled, force writable 
memory to be treated as XN or PXN, regardless of the value of the XN or PXN field. When the translation stages 
are controlled by an Exception level that is using AArch32: 


è For PL1 &0 stage 1 translations, when SCTLR.WXN is set to 1, all regions that are writable at stage 1 of the 
address translation are treated as XN. 


à For PL1 &0 stage 1 translations, when SCTLR.UWXN is set to 1, an instruction fetch is treated as accessing 
a PXN region if it accesses a region that software executing at ELO can write to. 


. For Non-secure EL2 stage 1 translations, when HSCTLR.WXN is set to 1, all regions that are writable at 
stage 1 of the address translation are treated as XN. 





Note 
: The SCTLR.WXN controls are intended to be used in systems with very high security requirements. 
: Setting a WXN or UWXN bit to 1 changes the interpretation of the translation table entry, overriding a zero 


value of an XN or PXN field. It does not cause any change to the translation table entry. 





For any given virtual machine, Arm expects WXN and UWXN to remain static in normal operation. In particular, 
it is IMPLEMENTATION DEFINED whether TLB entries associated with a particular VMID reflect the effect of the 
values of these fields. A generic sequence to ensure synchronization of a change to these fields, when that change 
is made without a corresponding change of VMID, is: 


Change the WXN or UWXN bit 


ISB ; This ensures synchronization of the change 
Invalidate entire TLB of associated entries 

DSB ; This completes the TLB Invalidation 

ISB ; This ensures instruction synchronization 


As with all Permission fault checking, if the stage 1 translation is using the Short-descriptor translation table format, 
the permission checks are performed only for Client domains. For more information, see About access permissions 
on page G5-5766. 


For more information about address translation, see About address translation for VMSAv8-32 on page G5-5723. 


Restriction on Secure instruction fetch 


EL3 provides a Secure instruction fetch bit, SCR.SIF. When this bit is to 1, any attempt in Secure state to execute 
an instruction fetched from Non-secure physical memory causes a Permission fault. As with all Permission fault 
checking, when using the Short-descriptor format translation tables the check applies only to Client domains, see 
About access permissions on page G5-5766. 


Arm expects SCR.SIF to be static during normal operation. In particular, whether the TLB holds the effect of the 
SIF bit is IMPLEMENTATION DEFINED. The generic sequence to ensure visibility of a change to the SIF bit is: 


Change the SCR.SIF bit 


ISB ; This ensures synchronization of the change 
Invalidate entire TLB 
DSB ; This completes the TLB Invalidation 
ISB ; This ensures instruction synchronization 
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G5.6.4 


G5.6.5 


G5-5774 


Domains, Short-descriptor format only 


A domain is a collection of memory regions. The Short-descriptor translation table format supports 16 domains, and 
requires the software that defines a translation table to assign each VMSAv8-32 memory region to a domain. When 
using the Short-descriptor format: 


. Level 1 translation table entries for translation tables and Sections include a domain field. 


° Translation table entries for Supersections do not include a domain field. The Short-descriptor format defines 
Supersections as being in domain 0. 


è Level 2 translation table entries inherit a domain setting from the parent level 1 translation table descriptor. 
7 Each TLB entry includes a domain field. 


The domain field specifies which of the 16 domains the entry is in, and a two-bit field in the DACR defines the 
permitted access for each domain. The possible settings for each domain are: 


No access Any access using the translation table descriptor generates a Domain fault. 


Clients On an access using the translation table descriptor, the access permission attributes are checked. 
Therefore, the access might generate a Permission fault. 


Managers On an access using the translation table descriptor, the access permission attributes are not checked. 
Therefore, the access cannot generate a Permission fault. 


See The MMU fault-checking sequence on page G5-5814 for more information about how, when using the 
Short-descriptor translation table format, the Domain attribute affects the checking of the other attributes in the 
translation table descriptor. 





Note 
A single program might: 
° Be a Client of some domains. 
s Be a Manager of some other domains. 
e Have no access to the remaining domains. 





The Long-descriptor translation table format does not support domains. When a stage of translation is using this 
format, all memory is treated as being in a Client domain, and the settings in the DACR are ignored. 


The Access flag 


The Access flag indicates when a page or section of memory is accessed for the first time since the Access flag in 
the corresponding translation table descriptor was set to 0: 


: If address translation is using the Short-descriptor translation table format, it must set SCTLR.AFE to 1 to 
enable use of the Access flag. Setting this bit to 1 redefines the AP[0] bit in the translation table descriptors 
as an Access flag, and limits the access permissions information in the translation table descriptors to 
AP[2:1], as described in AP/2:1] access permissions model on page G5-5767. 


i The Long-descriptor format always supports an Access flag bit in the translation table descriptors, and 
address translation using this format behaves as if SCTLR.AFE is set to 1, regardless of the value of that bit. 


In Armv8.0, the Access flag is managed by software as described in Software management of the Access flag on 
page G5-5775. 





Note 


Previous version of the Arm architecture optionally supported hardware management of the Access flag. Armv8.0 
obsoletes this option. However, ARMv8.1-TTHM provides a new mechanism for hardware management of the 
Access flag, that is supported only for the VMSAv8-64 translation regimes. 
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Software management of the Access flag 


Armv8.0 requires that software manages the Access flag. This means an Access flag fault is generated whenever an 
attempt is made to read into the TLB a translation table descriptor entry for which the value of the Access flag is 0. 


Note 


When using the Short-descriptor translation table format, Access flag faults are generated only if SCTLR.AFE is 
set to 1, to enable use of a translation table descriptor bit as an Access flag. 





The Access flag mechanism expects that, when an Access flag fault occurs, software resets the Access flag to 1 in 
the translation table entry that caused the fault. This prevents the fault occurring the next time that memory location 
is accessed. Entries with the Access flag set to 0 are never held in the TLB, meaning software does not have to flush 
the entry from the TLB after setting the flag. 


Note 
Ifa system incorporates components that can autonomously update translation table entries that are shared with the 
Arm PE, then the software must be aware of the possibility that such components can update the access flag 
autonomously. 





In such a system, system software should perform any changes of translation table entries with an Access flag of 0, 
other than changes to the Access flag value, by using an Load-Exclusive/Store-Exclusive loop, to allow for the 
possibility of simultaneous updates. 


G5.6.6 Hyp mode control of Non-secure access permissions 
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When EL2 is using AArch32, Non-secure software executing in Hyp mode controls two sets of translation tables, 
both of which use the Long-descriptor translation table format: 


è The translation tables that control the Non-secure EL2 stage 1 translations. These map VAs to PAs, for 
memory accesses made when executing in Non-secure state in Hyp mode, and are indicated and controlled 
by the HTTBR and HTCR. 


These translations have similar access controls to other Non-secure stage 1 translations using the 
Long-descriptor translation table format, as described in: 
—  AP[2:1] access permissions model on page G5-5767. 


— Access permissions for instruction execution on page G5-5770. 


The differences from the Non-secure stage 1 translations are that: 
— The APTable[0], PXNTable, and PXN bits are reserved, SBZ. 
—  AP[1] is reserved, SBO. 


s The translation tables that control the Non-secure PL1&0 stage 2 translations. These map the IPAs from the 
stage 1 translation onto PAs, for memory accesses made when executing in Non-secure state at PL1 or ELO, 
and are indicated and controlled by the VTTBR and VTCR. 


The descriptors in the virtualization translation tables define stage 2 access permissions, that are combined 
with the permissions defined in the stage 1 translation. This section describes this combining of access 
permissions. 


Note 


The level 2 access permissions mean a hypervisor can define additional access restrictions to those defined by a 
Guest OS in the stage 1 translation tables. For a particular access, the actual access permission is the more restrictive 
of the permissions defined by: 





è The Guest OS, in the stage 1 translation tables. 
od The hypervisor, in the stage 2 translation tables. 





The stage 2 access controls defined from Hyp mode: 
° Affect only the Non-secure stage 1 access permissions settings. 
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è Take no account of whether the accesses are from a Non-secure PL1 mode or a Non-secure ELO mode. 
è Permit software executing in Hyp mode to assign a write-only attribute to a memory region. 


The S2AP field in the stage 2 descriptors define the stage 2 access permissions, as Table G5-11 shows: 


Table G5-11 Stage 2 control of access permissions 





S2AP Access permission 














00 No access permitted 

01 Read-only. Writes to the region are not permitted, regardless of the stage 1 permissions. 
10 Write-only. Reads from the region are not permitted, regardless of the stage 1 permissions. 
11 Read/write. The stage 1 permissions determine the access permissions for the region. 





For more information about the S2AP field, see Attribute fields in VMSAv8-32 Long-descriptor stage 2 Block and 
Page descriptors on page G5-5753. 


If the stage 2 permissions cause a Permission fault, this is a stage 2 MMU fault. Stage 2 MMU faults are taken to 
Hyp mode, and reported in the HSR using an EC code of 0x20 or 0x24. For more information, see Use of the HSR 
on page G5-5836. 


Note 


In the HSR, the combination of the EC code and the DFSC or IFSC value in the ISS indicate that the fault is a stage 2 
MMU fault. 








The stage 2 permissions include an XN attribute. If this identifies the region as execute-never, execution from the 
region is not permitted, regardless of the value of the XN or UXN attribute in the stage 1 translation. Ifa Permission 
fault is generated because the stage 2 XN field identifies the region as execute-never, this is reported as a stage 2 
MMU fault. 


Note 
The stage 2 XN attribute: 





a Is a single bit if ARMv8.2-TTS2UXN is not implemented, see XN, Execute-never on page G5-5770. 


. Is a 2-bit field if ARMv8.2-TTS2UXN is implemented, see XN//:0], Execute-never, stage 2 only on 
page G5-5770. 





AArch32 state prioritization of synchronous aborts from a single stage of address translation on page G5-5819 
describes the abort prioritization if both stages of a translation generate a fault. 
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In addition to an output address, a translation table entry that refers to a page or region of memory includes fields 
that define properties of that target memory region. /nformation returned by a translation table lookup on 

page G5-5733 describes the classification of those fields as address map control, access control, and memory 
attribute fields. The memory region attribute fields control the memory type, Cacheability, and Shareability of the 
region. 


The following sections describe the assignment of memory region attributes for stage 1 translations: 


è Overview of memory region attributes for stage 1 translations. 
. Short-descriptor format memory region attributes, without TEX remap on page G5-5778. 
. Short-descriptor format memory region attributes, with TEX remap on page G5-5780. 


. VMSAv8-32 Long-descriptor format memory region attributes on page G5-5783. 


For an implementation that is operating in Secure state, or in Hyp mode, these assignments define the memory 
attributes of the accessed region. 


For an implementation that is operating in a Non-secure PL1 or ELO mode, the Non-secure PL1&0 stage 2 
translation can modify the memory attributes assigned by the stage 1 translation. EL2 control of Non-secure memory 
region attributes on page G5S-5785 describes these stage 2 assignments. 


G5.7.1 Overview of memory region attributes for stage 1 translations 
The description of the memory region attributes in a translation descriptor divides into: 


Memory type and attributes 
These are described either: 
è Directly, by bits in the translation table descriptor. 


° Indirectly, by registers referenced by bits in the table descriptor. This is described as 
remapping the memory type and attribute description. 


The Short-descriptor translation table format can use either of these approaches, selected by the 
SCTLR.TRE bit: 


TRE == 0 Remap disabled. The TEX[2:0], C, and B bits in the translation table descriptor define 
the memory region attributes. Short-descriptor format memory region attributes, 
without TEX remap on page G5-5778 describes this encoding. 

—— Note 


With the Short-descriptor format, remapping is called TEX remap, and the SCTLR.TRE 
bit is the TEX remap enabled bit. 





The description of the TRE == 0 encoding includes information about the encoding in 
previous versions of the architecture. 


TRE == 1 Remap enabled. The TEX[0], C, and B bits in the translation table descriptor are index 
bits to the remap registers, that define the memory region attributes: 
s The Primary Region Remap Register, PRRR. 
g The Normal Memory Remap Register, NMRR. 
Short-descriptor format memory region attributes, with TEX remap on page G5-5780 
describes this encoding scheme. 
This scheme reassigns translation table descriptor bits TEX[2:1] for use as bits managed 
by the operating system. 


The Long-descriptor translation table format always uses remapping. This means that when the 
value of TTBCR.EAE is 1, enabling use of the Long-descriptor translation table format, 


SCTLR.TRE is RES1. 
VMSAv8-32 Long-descriptor format memory region attributes on page G5-5783 describes this 
encoding. 
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Shareability 


In the Short-descriptor translation table format, the S bit in the translation table descriptor is used in 
determining the Shareability of the region. How the S bit is interpreted depends on whether TEX 
remap is enabled, see: 

. Shareability and the S bit, without TEX remap on page G5-5779. 

. Determining the Shareability, with TEX remap on page G5-5781. 


In the Long-descriptor translation table format, the SH[1:0] field in the translation table descriptor 
encodes the Shareability of the region, see Shareability, Long-descriptor format on page G5-5783. 


Note 

Shareability is one of Non-shareable, Inner Shareable, and Outer Shareable. However, when using 
the Short-descriptor translation table format without TEX remap, VMSAv8-32 does not support any 
distinction between Inner Shareable and Outer Shareable memory, and a memory region is either 
Non-shareable or Outer Shareable. 









































G5.7.2 Short-descriptor format memory region attributes, without TEX remap 
When using the Short-descriptor translation table formats, TEX remap is disabled when the value of SCTLR.TRE 
is 0. 
Note 
$ The Short-descriptor format scheme without TEX remap is the scheme used in VMSAv6. 
e The B (Bufferable), C (Cacheable), and TEX (Type extension) bit names are inherited from earlier versions 
of the architecture. These names no longer adequately describe the function of the B, C, and TEX bits. 
Table G5-12 shows the C, B, and TEX[2:0] encodings when TEX remap is disabled. In the Page Shareability 
column, an entry of S bit indicates that the S bit in the translation table descriptor determines the Shareability, see 
Shareability and the S bit, without TEX remap on page G5-5779. 
Table G5-12 TEX, C, and B encodings when TRE == 
TEX[2:0] B Description Memory type Page Shareability 
000 Device-nGnRnE Device-nGnRnE Outer Shareable 
Device-nGnRE# Device-nGnRE Outer Shareable? 
Outer and Inner Write-Through, Read-Allocate Normal S bit 
No Write-Allocate 
Outer and Inner Write-Back, Read-Allocate Normal S bit 
No Write-Allocate 
001 Outer and Inner Non-cacheable Normal Outer Shareable> 
Reserved - - 
IMPLEMENTATION DEFINED IMPLEMENTATION IMPLEMENTATION 
DEFINED DEFINED 
Outer and Inner Write-Back, Read-Allocate Write-Allocate Normal S bit 
010 Device-nGnRE@ Device-nGnRE Outer Shareable? 
Reserved - - 
Reserved - - 
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Table G5-12 TEX, C, and B encodings when TRE == 0 (continued) 





TEX[2:0] C B Description Memory type Page Shareability 


oll x 


x Reserved = 5 





1BB A A Cacheable memory: AA = Inner attributet Normal S bit 


BB = Outer attribute 





a. In Armv8, all Device memory types are Outer Shareable. For the Device-nGnRE memory type this is a change from previous versions of 
the architecture. This is why Device-nGnRE memory has two entries in this table. For compatibility with Armv7 software should use the 
{TEX, C, B} values {000, 0, 1}. 

b. In Armv8, Normal Inner Non-cacheable, Outer Non-cacheable memory is always Outer Shareable. This is a change from previous 
versions of the architecture, where the S bit determined the Shareability. For compatibility with Armv7 software should set S to 1. 


c. For more information, see Cacheability attributes, without TEX remap. 
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See Memory types and attributes on page E2-3840 for an explanation of Normal memory, and the types of Device 
memory, and of the Shareability attribute. 


Cacheability attributes, without TEX remap 


When the value of TEX[2] is 0, the same Cacheability attribute applies to Inner Cacheable and Outer Cacheable 
memory regions, and the {TEX[1:0], C, B} values identify this attribute, as Table GS-12 on page G5-5778 shows. 


When the value of TEX[2] is 1, the memory described by the translation table entry is cacheable, and the rest of the 
encoding defines the Inner Cacheability and Outer Cacheability attributes: 


TEX[1:0] Define the Outer Cacheability attribute. 
C, B Define the Inner Cacheability attribute. 


The translation table entries use the same encoding for the Outer and Inner Cacheability attributes, as Table G5-13 
shows. 


Table G5-13 Inner and Outer Cacheability attribute encoding 





Encoding Cacheability attribute 














00 Non-cacheable 

01 Write-Back, Read-Allocate Write-Allocate 

10 Write-Through, Read Allocate No Write-Allocate 
11 Write-Back, Read Allocate No Write-Allocate 


Shareability and the S bit, without TEX remap 


The Short-descriptor format translation table entries include an S bit. This bit: 


: Is ignored if the entry refers to any type of Device memory, or to Normal memory that is Inner 
Non-cacheable, Outer Non-cacheable. 


$ For Normal memory that is not Inner Non-cacheable, Outer Non-cacheable, determines whether the memory 
region is Outer Shareable or Non-shareable: 


S == Normal memory region is Non-shareable. 
S == Normal memory region is Outer Shareable. 


Without TEX remapping there is no distinction between Inner Shareable and Outer Shareable memory, meaning the 
S bit determines whether the region is Non-shareable or Outer Shareable. 
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G5.7.3 Short-descriptor format memory region attributes, with TEX remap 

When using the Short-descriptor translation table formats, TEX remap is enabled when the value of SCTLR.TRE 

is 1. In this configuration: 

s The software that defines the translation tables must program the PRRR and NMRR to define seven possible 
memory region attributes. 

° The TEX[0], C, and B bits of the translation table descriptors define the memory region attributes, by 
indexing PRRR and NMRR. 

è Hardware makes no use of TEX[2:1], see The OS managed translation table bits on page G5-5782. 

When TEX remap is enabled: 

: For seven of the eight possible combinations of the TEX[0], C and B bits, fields in the PRRR and NMRR 
define the region attributes, as described in this section. 

s The meaning of the eighth combination for the TEX[0], C and B bits is IMPLEMENTATION DEFINED. 

à If the TEX[0], C and B bits determine that the region is a Device memory type, or is Normal Inner 
Non-cacheable, Outer Non-cacheable, then the region is Outer Shareable. Otherwise, the Shareability is 
determined by the combination of: 

— The S bit from the translation table descriptor. 

— The value of the PRRR.NSO or PRRR.NS1 bit. 

— The value of the appropriate PRRR.NOSz bit, as shown in Table G5-14. 

For more information, see Determining the Shareability, with TEX remap on page G5-5781. 

For each of the possible encodings of the TEX[0], C, and B bits in a translation table entry, Table G5-14 shows 

which fields of the PRRR and NMRR registers describe the memory region attributes. 

Table G5-14 TEX, C, and B encodings when TRE == 
Encoding Cache attributes@: 5: 
Memory type4 Outer Shareable attribute: ¢ 
TEX[0] C B Inner cacheability Outer cacheability 
0 0 0 PRRR.TRO NMRR.IRO NMRR.ORO NOT(PRRR.NOSO) 
1 PRRR.TRI NMRR.IR1 NMRR.ORI1 NOT(PRRR.NOS1) 
1 0  PRRR.TR2 NMRR.IR2 NMRR.OR2 NOT(PRRR.NOS2) 
1 PRRR.TR3 NMRR.IR3 NMRR.OR3 NOT(PRRR.NOS3) 
1 0 0 PRRR.TR4 NMRR.IR4 NMRR.OR4 NOT(PRRR.NOS4) 
1 PRRR.TRS5S NMRR.IRS5 NMRR.ORS NOT(PRRR.NOSS) 
1 0 IMPLEMENTATION DEFINED 
1 PRRR.TR7 NMRR.IR7 NMRR.OR7 NOT(PRRR.NOS7) 
. For details of the Memory type and Outer Shareable encodings see the description of the PRRR. For details of the Cache attributes 
encodings the description of the NMRR. 
. Applies only if the memory type for the region is mapped as Normal memory. 
. Applies only if both of the following apply: 
The memory type for the region is mapped as Normal memory that is not Inner Non-cacheable and Outer Non-cacheable. 
The region is not Non-shareable. 
See Determining the Shareability, with TEX remap on page G5-5781. 
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As Table G5-14 on page G5-5780 shows, when TEX remap is enabled, for a given set of {TEX[0], C, B} bits from 
a translation table descriptor: 


1. The primary mapping, to memory type, is given by the PRRR.TRzx field as shown in the Memory type 
column. 


2, For any region that the PRRR.TRn maps as Normal memory, NMRR.IRn determines the Inner cacheability 
attribute, and NMRR.ORn determines the Outer cacheability attribute. 


3. For a region that PRRR.TRn maps as Normal memory, if NMRR. {IRn, ORn} do not map the region as Inner 
Non-cacheable, Outer Non-cacheable, PRRR.{NS0, NS1} and PRRR.NOSz are used to determine the 
Shareability of the region, see Determining the Shareability, with TEX remap. 


The TEX remap registers and the SCTLR.TRE bit are banked between the Secure and Non-secure Security states. 
For more information, see The effect of EL3 on TEX remap on page G5-5783. 


The TEX remap registers must be static during normal operation. In particular, when the remap registers are 


changed: 
. It is IMPLEMENTATION DEFINED when the changes take effect. 
: It is CONSTRAINED UNPREDICTABLE whether the TLB caches the effect of the TEX remap on translation 


tables, see CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values on 
page K1-7611. 


The software sequence to ensure the synchronization of changes to the TEX remap registers is: 

Execute a DSB instruction. This ensures any memory accesses using the old mapping have completed. 
Write the TEX remap registers or SCTLR.TRE bit. 

Execute an ISB instruction. This ensures synchronization of the register updates. 

Invalidate the entire TLB. 

Execute a DSB instruction. This ensures completion of the entire TLB operation. 

Clean and invalidate all caches. This removes any cached information associated with the old mapping. 


Execute a DSB instruction. This ensures completion of the cache maintenance. 


SS D Bese 


Execute an ISB instruction. This ensures instruction synchronization. 


This extends the standard rules for the synchronization of changes to System registers described in Synchronization 
of changes to AArch32 System registers on page G8-5896, and provides implementation freedom as to whether or 
not the effect of the TEX remap is cached. 


Determining the Shareability, with TEX remap 


The memory type of a region, as indicated in the Memory type column of Table G5-14 on page G5-5780, provides 
the first level of control of the Shareability of the region: 


: If the memory is any type of Device memory, then the region is Outer Shareable, and any Shareability 
attributes in the translation table descriptor and PRRR for that region are ignored. 
This applies also to a Normal memory region that the NMRR attributes identify as Inner Non-cacheable and 
Outer Non-cacheable, 


7 If using the Short descriptor translation table format then the Shareability of the region is determined using 
the value of the S bit in the translation table descriptor to index one of the PRRR.{NS1. NSO} bits, as 
described in this section. 


Table G5-15 shows how the translation table S bit indexes into the PRRR: 


Table G5-15 Determining the Shareability attribute, with TEX remap 











Memory type Remapping when S == Remapping when S == 
Device or Normal Inner Non-cacheable, Outer Non-cacheable Outer Shareable Outer Shareable 
Normal, not Inner Non-cacheable, Outer Non-cacheable PRRR.NSO PRRR.NS1 
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For a Normal memory region that is not Inner Non-cacheable, Outer Non-cacheable, the appropriate bit of the 
PRRR indicates whether the region is Non-shareable, as follows: 


PRRR.NSn== Non-shareable. 
PRRR. {NOS7:NOS0} are ignored. 


PRRR.NSn== The appropriate PRRR.NOSm field, as shown in Table GS-14 on page G5-5780, indicates 
whether the region is Inner Shareable or Outer Shareable: 
PRRR.NOSm== Region is Outer Shareable. 
PRRR.NOSm== Region is Inner Shareable. 
Note 





This means that TEX remapping can map a translation table entry with S == 0 as shareable memory. 





SCTLR.TRE, SCTLR.M, and the effect of the TEX remap registers 
When TEX remap is disabled, because the value of the SCTLR.TRE bit is 0: 
s The effect of the PRRR and NMRR registers can be IMPLEMENTATION DEFINED. 


à The interpretation of the fields of the PRRR and NMRR registers can differ from the description given earlier 
in this section. One implication of this is that the implementation can provide an IMPLEMENTATION DEFINED 
mechanism to interpret the PRRR. {NOS7:NOS0} fields. 


VMSAv8-32 requires that the effect of these registers is limited to remapping the attributes of memory locations. 
These registers must not change whether any cache hardware or stages of address translation are enabled. The 
mechanism by which the TEX remap registers have an effect when the value of the SCTLR.TRE bit is 0 is 
IMPLEMENTATION DEFINED. The AArch32 architecture requires that from reset, if the IMPLEMENTATION DEFINED 
mechanism has not been invoked: 


s Ifthe PL1&0 stage 1 address translation is enabled and is using the Short-descriptor format translation tables, 
the architecturally-defined behavior of the TEX[2:0], C, and B bits must apply, without reference to the TEX 
remap functionality. In other words, memory attribute assignment must comply with the scheme described 
in Short-descriptor format memory region attributes, without TEX remap on page G5-5778. 


$ Ifthe PL1&0 stage 1 address translation is disabled, then the architecturally-defined behavior of VMSAv8-32 
with address translation disabled must apply, without reference to the TEX remap functionality. See The 
effects of disabling address translation stages on VMSAv8-32 behavior on page G5-5728. 


Possible mechanisms for enabling the IMPLEMENTATION DEFINED effect of the TEX remap registers when the value 
of SCTLR.TRE is 0 include: 


s A control bit in the ACTLR, or in an IMPLEMENTATION DEFINED System register. 


è Changing the behavior when the PRRR and NMRR registers are changed from their IMPLEMENTATION 
DEFINED reset values. 


In addition, if the stage of address translation is disabled and the value of the SCTLR.TRE bit is 1, the 
architecturally-defined behavior of the VMSAv8-32 with the stage of address translation disabled must apply 
without reference to the TEX remap functionality. 


In an implementation that includes EL3, the IMPLEMENTATION DEFINED effect of these registers must only take 
effect in the Security state of the registers. See also The effect of EL3 on TEX remap on page G5-5783. 


The OS managed translation table bits 


When TEX remap is enabled, the TEX[2:1] bits in the translation table descriptors are available as two bits that can 
be managed by the operating system. In VMSAv8-32, as long as the SCTLR.TRE bit is set to 1, the values of the 
TEX[2:1] bits are IGNORED by the PE. Software can write any value to these bits in the translation tables. 
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The effect of EL3 on TEX remap 


In an implementation that includes EL3, when EL3 is using AArch32, the TEX remap registers are banked between 
the Secure and Non-secure Security states. When EL3 is using AArch32, write accesses to the Secure register for 
the current security state apply to all PL1&0 stage 1 translation table lookups in that state. The SCTLR.TRE bit is 
banked in the Secure and Non-secure copies of the register, and the appropriate version of this bit determines 
whether TEX remap is applied to translation table lookups in the current security state. 


Write accesses to the Secure copies of the TEX remap registers are disabled when the CPISSDISABLE input is 
asserted HIGH, meaning the MCR operations to access these registers are UNDEFINED. For more information, see The 
CPISSDISABLE and CP1I5SDISABLE2 input signals on page G5-5854. 


VMSAv8-32 Long-descriptor format memory region attributes 


When a PE is using the VMSAv8-32 Long-descriptor translation table format, the AttrIndx[2:0] field in a block or 
page translation table descriptor for a stage 1 translation indicates the 8-bit field, in the appropriate MAIR register, 
that specifies the attributes for the corresponding memory region, as follows: 
° AttrIndx[2] indicates the MAIR register to be used: 

AttrIndx[2] == Use MAIRO. 

AttrIndx[2] == Use MAIRI. 


à AttrIndx[2:0] indicates the required Attr field, Attrn, where n = AttrIndx[2:0]. 
Each AttrIndx field defines, for the corresponding memory region: 
` The memory type, Normal or a type of Device memory. 


7 For Normal memory: 


— The Inner cacheability and Outer cacheability attributes, each of which is one of Non-cacheable, 
Write-Through Cacheable, or Write-Back Cacheable. 


— For Write-Through Cacheable and Write-Back Cacheable regions, the Read-Allocate and 
Write-Allocate policy hints, each of which is Allocate or No allocate. 


For more information about the AttrIndx[2:0] descriptor field, see Attribute fields in VMSAv8-32 Long-descriptor 
stage I Block and Page descriptors on page G5-5751. 


Shareability, Long-descriptor format 


When a PE is using the Long-descriptor translation table format, the SH[1:0] field in a block or page translation 
table descriptor specifies the Shareability attributes of the corresponding memory region, if the MAIR entry for that 
region identifies it as Normal memory that is not both Inner Non-cacheable and Outer Non-cacheable. Table G5-16 
shows the encoding of this field. 


Table G5-16 SH[1:0] field encoding for Normal memory, Long-descriptor format 





SH[1:0] 


Normal memory 





00 


Non-shareable 





01 


Reserved, CONSTRAINED UNPREDICTABLE, see Reserved values in System and memory-mapped registers and translation 
table entries on page K1-7628 for the permitted behavior. 





10 


Outer Shareable 





11 


Inner Shareable 


See Combining the Shareability attribute on page G5-5788 for constraints on the Shareability attributes of a Normal 
memory region that is Inner Non-cacheable, Outer Non-cacheable. 
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For any type of Device memory, and for Normal Inner Non-cacheable, Outer Non-cacheable memory, the value of 
the SH[1:0] field of the translation table descriptor is ignored. 


Other fields in the Long-descriptor translation table format descriptors 


The following subsections describe the other fields in the translation table block and page descriptors when a PE is 
using the Long-descriptor translation table format: 

5 Contiguous bit 

° IGNORED fields. 

. Field reserved for software use on page G5-5785 


Contiguous bit 


The Long-descriptor translation table format descriptors contain a Contiguous bit. Setting this bit to 1 indicates that 
16 adjacent translation table entries point to a contiguous output address range. These 16 entries must be aligned in 
the translation table so that the top five bits of their input addresses, that index their position in the translation table, 
are the same. For example, to use this bit for a block of 16 entries in the level 3 translation table, bits[20:16] of the 
input addresses for the 16 entries must be the same. 


The contiguous output address range must be aligned to size of 16 translation table entries at the same translation 
table level. 


Use of this bit means that the TLB can cache a single entry to cover the 16 translation table entries. 


This bit acts as a hint. The architecture does not require a PE to cache TLB entries in this way. To avoid TLB 
coherency issues, any TLB maintenance by address must not assume any optimization of the TLB tables that might 
result from use of this bit. 





Note 


The use of the contiguous bit is similar to the approach used, in the Short-descriptor translation table format, for 
optimized caching of Large Pages and Supersections in the TLB. However, an important difference in the 
contiguous bit capability is that TLB maintenance must be performed based on the size of the underlying translation 
table entries, to avoid TLB coherency issues. That is, any use of the contiguous bit has no effect on the minimum 
size of entry that must be invalidated from the TLB. 





IGNORED fields 

In the VMSAv8-32 translation table long-descriptor format, the following fields are defined as IGNORED, meaning 

the architecture guarantees that a PE makes no use of these fields: 

: In the stage 1 and stage 2 Table descriptors, bits[58:52] and bits[11:2]. 

` In the stage 1 and stage 2 Block and Page descriptors, bit[63] and bits[58:55]. 

7 In the stage 1 and stage 2 Block and Page descriptors in an implementation that does not include 
ARMv8.2-TTPBHA, bits[62:59]. 


Of these fields: 


° In the stage 1 and stage 2 block and page descriptors, bits[58:55] are reserved for software use, see Field 
reserved for software use on page G5-5785. 

e In the stage 2 block and page descriptors: 
— Bit[63] is reserved for use by a System MMU. 


—  Inanimplementation that does not include ARMv8.2-TTPBHA, bits[62:59] are reserved for use by a 
System MMU. 
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Field reserved for software use 


The architecture reserves a 4-bit IGNORED field in the Block and translation table descriptors, bits[58:55], for 
software use. In considering migration from using the Short-descriptor format to the Long-descriptor format, this 
field is an extension of the Short-descriptor field described in The OS managed translation table bits on 

page G5-5782. 


Note 
The definition of IGNORED means there is no need to invalidate the TLB if these bits are changed. 








G5.7.5 EL2 control of Non-secure memory region attributes 
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Software executing at EL2 controls two sets of translation tables, both of which use the Long-descriptor translation 
table format. These are: 


: The translation tables that control Non-secure EL2 stage | translations. These map VAs to PAs, and when 
EL2 is using AArch32 they are indicated and controlled by the HTTBR and HTCR. 


These translations have exactly the same memory region attribute controls as any other stage 1 translations, 
as described in VMSAv8-32 Long-descriptor format memory region attributes on page G5-5783. 


° The translation tables that control Non-secure PL1&0 stage 2 translations. These map the IPAs from the stage 
1 translation onto PAs, and are indicated and when EL2 is using AArch32 they are controlled by the VTTBR 
and VTCR. 


The descriptors in the virtualization translation tables define level 2 memory region attributes, that are 
combined with the attributes defined in the stage 1 translation. This section describes this combining of 
attributes. 


VMSAv8-32 Long-descriptor translation table format descriptors on page G5-5747 describes the format of the 
entries in these tables. 





Note 
In a virtualization implementation, a hypervisor might usefully: 
° Reduce the permitted Cacheability of a region. 
° Increase the required Shareability of a region. 


The combining of attributes from stage 1 and stage 2 translations supports both of these options. 





In the stage 2 translation table descriptors for memory regions and pages, the MemAttr[3:0] and SH[1:0] fields 
describe the stage 2 memory region attributes: 


The definition of the stage 2 SH[1:0] field is identical to the same field for a stage 1 translation, see 
Shareability, Long-descriptor format on page G5S-5783. 


s MemAttr[3:2] give a top-level definition of the memory type, and of the cacheability of a Normal memory 
region, as Table G5-17 shows: 


Table G5-17 Long-descriptor MemAttr[3:2] encoding, stage 2 translation 

















MemAttr[3:2] Memory type Cacheability 

00 Device, of type determined by MemAttr[1:0] Not applicable 

01 Normal, Inner cacheability determined by MemAttr[1:0] | Outer Non-cacheable 

10 Outer Write-Through Cacheable 

11 Outer Write-Back Cacheable 
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The encoding of MemAttr[1:0] depends on the Memory type indicated by MemAttr[3:2]: 


— When MemAttr[3:2]==0b00, indicating a type of Device memory, Table GS-18 shows the encoding of 
MemAttr[1:0]: 


Table G5-18 MemAttr[1:0] encoding for the types of Device memory 


MemAttr[1:0] Meaning when MemAttr[3:2] == 0b00 














00 Region is Device-nGnRnE memory 
01 Region is Device-nGnRE memory 
10 Region is Device-nGRE memory 
11 Region is Device-GRE memory 





— When MemAttr[3:2]!=0b00, indicating Normal memory, Table G5-19 shows the encoding of 
MemAttr[1:0]: 


Table G5-19 MemAttr[1:0] encoding for Normal memory 





MemAttr[1:0] Meaning when MemAttr[3:2] != 0b00 





00 Reserved, CONSTRAINED UNPREDICTABLE, See Reserved values in System and memory-mapped registers and 
translation table entries on page K1-7628 for the permitted behavior. 














01 Inner Non-cacheable 

10 Inner Write-Through Cacheable 

11 Inner Write-Back Cacheable 
Note 





The stage 2 translation does not assign any allocation hints. 





The following sections describe how the memory type attributes assigned at stage 2 of the translation are combined 
with those assigned at stage 1: 


7 Combining the memory type attribute on page G5-5787. 
. Combining the Cacheability attribute on page G5-5787. 
` Combining the Shareability attribute on page G5-5788. 





Note 
: The following stage 2 translation table attribute settings leave the stage 1 settings unchanged: 
—  MemAttr[3:2] == 0b11, Normal memory, Outer Write-Back Cacheable. 
—  MemAttr[1:0] == 0b11, Inner Write-Back Cacheable. 


$ In addition to the attribute combinations described in this section, Access permissions for instruction 
execution on page G5-5770 describes how the stage 1 and stage 2 execute-never permission fields are 
combined, so that a region is execute-never if it is defined as execute-never in at least one stage of translation. 
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Combining the memory type attribute 


Table G5-20 shows how the stage 1 and stage 2 memory type assignments are combined: 


Table G5-20 Combining the stage 1 and stage 2 memory type assignments 




















Assignment in stage 1 Assignment in stage 2 Resultant type 
Device-nGnRnE Any Device-nGnRnE 
Device-nGnRE Device-nGnRnE Device-nGnRnE 
Not Device-nGnRnE Device-nGnRE 
Device-nGRE Device-nGnRnE Device-nGnRnE 
Device-nGnRE Device-nGnRE 





Not (Device-nGnRnE or Device-nGnRE) Device-nGRE 




















Device-GRE Device-nGnRnE Device-nGnRnE 
Device-nGnRE Device-nGnRE 
Device-nGRE Device-nGRE 
Device-GRE or Normal Device-GRE 

Normal Any type of Device Device type assigned at stage 2 
Normal Normal 





See Combining the Shareability attribute on page G5-5788 for information about the Shareability of: 
a A region for which the resultant type is any Device type. 


à A region with a resultant type of Normal for which the resultant cacheability, described in Combining the 
Cacheability attribute, is Inner Non-cacheable, Outer Non-cacheable. 


The combining of the memory type attribute means a translation table walk for a stage 1 translation can be made to 
a type of Device memory. If this occurs, then: 


. If the value of HCR.PTW is 0, then the translation table walk occurs as if it is to Normal Non-cacheable 
memory. This means it can be done speculatively. 


è If the value of HCR.PTW is 1, then the memory access generates a stage 2 Permission fault. 


Combining the Cacheability attribute 


For a Normal memory region, Table G5-21 shows how the stage 1 and stage 2 Cacheability assignments are 
combined. This combination applies, independently, for the Inner Cacheability and Outer Cacheability attributes: 


Table G5-21 Combining the stage 1 and stage 2 cacheability assignments 











Assignment in stage 1 Assignment in stage 2 Resultant cacheability 
Non-cacheable Any Non-cacheable 
Any Non-cacheable Non-cacheable 
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Table G5-21 Combining the stage 1 and stage 2 cacheability assignments (continued) 





Assignment in stage 1 


Write-Through Cacheable 


Assignment in stage 2 


Write-Through or Write-Back Cacheable 


Resultant cacheability 


Write-Through Cacheable 





Write-Through or Write-Back Cacheable 


Write-Through Cacheable 


Write-Through Cacheable 





Write-Back Cacheable 


Write-Back Cacheable 


Write-Back Cacheable 





Note 





Only Normal memory has a Cacheability attribute. 


Combining the Shareability attribute 


In the following cases, a memory region is treated as Outer Shareable, regardless of any shareability assignments at 


either stage of translation: 


The resultant memory type attribute, described in Combining the memory type attribute on page G5-5787, is 
any type of Device memory. 


The resultant memory type attribute is Normal memory, and the resultant Cacheability, described in 
Combining the Cacheability attribute on page G5-5787, is Inner Non-cacheable Outer Non-cacheable. 


For a memory region with a resultant memory type attribute of Normal that is not Inner Non-cacheable Outer 


Non-cacheable, Table G5-22 shows how the stage 1 and stage 2 shareability assignments are combined: 
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Assignment in stage 1 


Assignment in stage 2 


Resultant Shareability 





Outer Shareable 


Any 


Outer Shareable 





Inner Shareable 


Outer Shareable 


Outer Shareable 





Inner Shareable 


Inner Shareable 


Inner Shareable 





Inner Shareable 


Non-shareable 


Inner Shareable 





Non-shareable 


Outer Shareable 


Outer Shareable 





Non-shareable 


Inner Shareable 


Inner Shareable 





Non-shareable 


Non-shareable 


Non-shareable 
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G5.8 Translation Lookaside Buffers (TLBs) 


Translation Lookaside Buffers (TLBs) are an implementation technique that caches translations or translation table 
entries. TLBs avoid the requirement to perform a translation table walk in memory for every memory access. The 
Arm architecture does not specify the exact form of the TLB structures for any design. In a similar way to the 
requirements for caches, the architecture only defines certain principles for TLBs: 


è The architecture has a concept of an entry locked down in the TLB. The method by which lockdown is 
achieved is IMPLEMENTATION DEFINED, and an implementation might not support lockdown. 


$ The architecture does not guarantee that an unlocked TLB entry remains in the TLB. 


è The architecture guarantees that a locked TLB entry remains in the TLB. However, a locked TLB entry might 
be updated by subsequent updates to the translation tables. Therefore, when a change is made to the 
translation tables, the architecture does not guarantee that a locked TLB entry remains incoherent with an 
entry in the translation table. 


7 The architecture guarantees that a translation table entry that generates a Translation fault, an Address size 
fault, or an Access flag fault is not held in the TLB. However a translation table entry that generates a Domain 
fault or a Permission fault might be held in the TLB. 


: When address translation is enabled, any translation table entry that does not generate a Translation fault, an 
Address size fault, or an Access flag fault and is not from a translation regime for an Exception level that is 
lower than the current Exception level can be allocated to a TLB at any time. The only translation table entries 
guaranteed not to be held in the TLB are those that generate a Translation fault, an Address size fault, or an 
Access flag fault. 


Note 


An TLB can hold translation table entries that do not generate a Translation fault but point to subsequent 
tables in the translation table walk. This can be referred to as intermediate caching of TLB entries. 








. Software can rely on the fact that between disabling and re-enabling a stage of address translation, entries in 
the TLB relating to that stage of translation have not been corrupted to give incorrect translations. 


The following sections give more information about TLB implementation: 
$ Global and process-specific translation table entries. 

° TLB matching on page G5-5790. 

. TLB behavior at reset on page G5-5790. 

. TLB lockdown on page G5-5791. 

. TLB conflict aborts on page G5-5791. 


See also TLB maintenance requirements on page G5-5793. 


Note 


In addition to the functions described in this section, the TLB might cache information from control registers that 
are described as being "permitted to be cached in a TLB", even when any or all of the stages of translation are 
disabled. This caching of information gives rise to the maintenance requirements described in General TLB 
maintenance requirements on page G5-5793 








G5.8.1 Global and process-specific translation table entries 
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For VMSAv8-32, system software can divide a virtual memory map used by memory accesses at PL1 and ELO into 
global and non-global regions, indicated by the nG bit in the translation table descriptors: 


nG == The translation is global, meaning the region is available for all processes. 
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nG == The translation is non-global, or process-specific, meaning it relates to the current ASID, as defined 
by: 
$ TTBRO.ASID or TTBR1.ASID, if using the Long-descriptor translation table format. In this 
case, TTBCR.A1 selects which ASID is current. 


a CONTEXTIDR.ASID, if using the Short-descriptor translation table format. 


Each non-global region has an associated ASID. These identifiers mean different translation table mappings can 
co-exist in a caching structure such as a TLB. This means that software can create a new mapping of a non-global 
memory region without removing previous mappings. 


For a symmetric multiprocessor cluster where a single operating system is running on the set of PEs, the architecture 
requires all ASID values to be assigned uniquely within any single Inner Shareable domain. In other words, each 
ASID value must have the same meaning to all PEs in the system. 


In AArch32 state, the translation regime used for accesses made at EL2 never supports ASIDs, and all pages are 
treated as global. 


When a PE is using the Long-descriptor translation table format, and is in Secure state, a translation must be treated 
as non-global, regardless of the value of the nG bit, if NSTable is set to 1 at any level of the translation table walk. 


For more information see Control of Secure or Non-secure memory access, VMSAv8-32 Long-descriptor format on 
page G5-5754. 


TLB matching 


A TLB is a hardware caching structure for translation table information. Like other hardware caching structures, it 
is mostly invisible to software. However, there are some situations where it can become visible. These are associated 
with coherency problems caused by an update to the translation table that has not been reflected in the TLB. Use of 
the TLB maintenance instructions described in TLB maintenance requirements on page G5-5793 can prevent any 
TLB incoherency becoming a problem. 


A particular case where the presence of the TLB can become visible is if the translation table entries that are in use 
under a particular ASID and VMID are changed without suitable invalidation of the TLB. This can occur only if the 
architecturally-required break-before-make sequence described in Using break-before-make when updating 
translation table entries on page G5-5794 is not used. If the break-before make sequence is not used, the TLB can 
hold two mappings for the same address, and this: 


7 Might generate an exception that is reported using the TLB Conflict fault code, see TLB conflict aborts on 
page G5-5791. 


z Might lead to CONSTRAINED UNPREDICTABLE behavior. In this case, behavior will be consistent with one of 
the mappings held in the TLB, or with some amalgamation of the values held in the TLB, but cannot give 
access to regions of memory with permissions or attributes that could not be assigned by valid translation 
table entries in the translation regime being used for the access. See CONSTRAINED UNPREDICTABLE 
behaviors due to caching of control or data values on page K1-7611. 


TLB behavior at reset 


The Arm architecture does not require a reset to invalidate the TLBs, and recognizes that an implementation might 
require caches, including TLBs, to maintain context over a system reset. Possible reasons for doing so include power 
management and debug requirements. 


Therefore, for Armv8: 
a All TLBs reset to an IMPLEMENTATION DEFINED state that might be UNKNOWN. 


° All TLBs are disabled from reset. All stages of address translation that are used from the PE state entered on 
coming out of reset are disabled from reset, and the contents of the TLBs have no effect on address 
translation. For more information see Enabling stages of address translation on page G5-5730. 
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è An implementation can require the use of a specific TLB invalidation routine, to invalidate the TLB arrays 
before they are enabled after a reset. The exact form of this routine is IMPLEMENTATION DEFINED, but if an 
invalidation routine is required it must be documented clearly as part of the documentation of the device. 


Arm recommends that if an invalidation routine is required for this purpose, and the PE resets into AArch32 
state, the routine is based on the AArch32 TLB maintenance instructions described in The scope of TLB 
maintenance instructions on page G5-5802. 


Similar rules apply: 
° To cache behavior, see Behavior of caches at reset on page G4-5693. 
s To branch predictor behavior, see Behavior of the branch predictors at reset on page G4-5701. 


G5.8.4 TLB lockdown 


The Arm architecture recognizes that any TLB lockdown scheme is heavily dependent on the microarchitecture, 
making it inappropriate to define a common mechanism across all implementations. This means that: 


° The architecture does not require TLB lockdown support. 


: If TLB lockdown support is implemented, the lockdown mechanism is IMPLEMENTATION DEFINED. However, 
key properties of the interaction of lockdown with the architecture must be documented as part of the 
implementation documentation. 


This means that: 
° The TLB Type Register, TLBTR, does not define the lockdown scheme in use. 


è In AArch32 state, a region of the {coproc==0b1111, CRn==c10} encodings is reserved for IMPLEMENTATION 
DEFINED TLB functions, such as TLB lockdown functions. The reserved encodings are those with: 


—  <CRm> == {c0, cl, c4, c8}. 
— All values of <opc2> and <opc1>. 


An implementation might use some of the {coproc==0b1111, CRn==c10} encodings that are reserved for 
IMPLEMENTATION DEFINED TLB functions to implement additional TLB control functions. These functions might 
include: 

s Unlock all locked TLB entries. 


s Preload into a specific level of TLB. This is beyond the scope of the PLI and PLD hint instructions. 


The inclusion of EL2 in an implementation does not affect the TLB lockdown requirements. However, in an 
implementation that includes EL2, exceptions generated as a result of TLB lockdown when executing in a 
Non-secure PL1 mode or in Non-secure User mode can be routed to either: 


° Non-secure Abort mode, using the Non-secure Data Abort exception vector. 
è Hyp mode, using the Hyp Trap exception vector. 


For more information, see Traps to Hyp mode of Non-secure ELO and EL1 accesses to lockdown, DMA, and TCM 
operations on page G1-5591. 


G5.8.5 TLB conflict aborts 
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If an address matches multiple entries in the TLB, it is IMPLEMENTATION DEFINED whether a TLB conflict abort is 
generated. 


An implementation can generate TLB conflict aborts on either or both instruction fetches and data accesses. A TLB 
conflict abort is classified as an MMU fault, see Types of MMU faults on page G5-5811. This means: 


à A TLB conflict abort on an instruction fetch is reported as a Prefetch Abort exception, 
° A TLB conflict abort on a data access is reported as a Data Abort exception, 


Fault status codes for TLB conflict aborts are defined for both the Short-descriptor and Long-descriptor translation 
table formats, see: 


. PL1 fault reporting with the Short-descriptor translation table format on page G5-5827 
. PL1 fault reporting with the Long-descriptor translation table format on page G5-5829. 
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On a TLB conflict abort, the fault address register returns the address that generated the fault. That is, it returns the 
address that was being looked up in the TLB. 


It is IMPLEMENTATION DEFINED whether a TLB conflict abort is a stage 1 abort or a stage 2 abort. 


Note 


e An address can hit multiple entries in the TLB if the TLB has been invalidated inappropriately, for example 
if TLB invalidation required by this manual has not been performed. 





s A stage 2 abort cannot be generated if the Non-secure PL1&0 stage 2 address translation is disabled. 


The priority of the TLB conflict abort is IMPLEMENTATION DEFINED, because it depends on the form of any TLB 
that can generate the abort. However, the TLB conflict abort must have higher priority than any abort that depends 
on a value held in the TLB. 


If an address matches multiple entries in the TLB and no TLB conflict abort not generated, the resulting behavior 
is CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching of control or 
data values on page K1-7611. The CONSTRAINED UNPREDICTABLE behavior must not permit access to regions of 
memory with permissions or attributes that mean they cannot be accessed in the current Security state at the current 
Privilege level. 
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G5.9 TLB maintenance requirements 


Translation Lookaside Buffers (TLBs) on page G5-5789 describes the Arm architectural provision for TLBs. 
Although the Arm architecture does not specify the form of any TLB structures, it does define the mechanisms by 
which TLBs can be maintained. The following sections describe the VMSAv8-32 TLB maintenance instructions: 


7 General TLB maintenance requirements. 
$ Maintenance requirements on changing System register values on page G5-5798. 
° Atomicity of register changes on changing virtual machine on page G5-5799. 
- Synchronization of changes of ASID and TTBR on page G5-5800. 
e The scope of TLB maintenance instructions on page G5-5802. 
G5.9.1 General TLB maintenance requirements 
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TLB maintenance instructions provide a mechanism to invalidate entries from a TLB. As Translation Lookaside 
Buffers (TLBs) on page G5-5789 describes, when address translation is enabled translation table entries can be 
allocated to a TLB at any time. This means that software must perform TLB maintenance between updating 
translation table entries that apply in a particular context and accessing memory locations whose translation is 
determined by those entries in that context. 


Note 


This requirement applies to any translation table entry at any level of the translation tables, including an entry that 
points to further levels of the tables, provided that the entry in that level of the tables does not cause a Translation 
fault, an Address size fault, or an Access flag fault. 








In addition to any TLB maintenance requirement, when changing the cacheability attributes of an area of memory, 
software must ensure that any cached copies of affected locations are removed from the caches. For more 
information see Cache maintenance requirement created by changing translation table attributes on page G5-5809. 


Because a TLB never holds any translation table entry that generates a Translation fault, an Address size fault, or 
an Access flag fault, a change from a translation table entry that causes a Translation, Address size, or Access flag 
fault to one that does not fault, does not require any TLB or branch predictor invalidation. However, a Context 
synchronization event is required to ensure that instruction fetches are affected by a completed change to translation 
table entries that, before the change, generated a Translation, Address size, or Access flag fault. 


Special considerations apply to translation table updates that change the memory type, cacheability, or output 
address of an entry, see Using break-before-make when updating translation table entries on page G5-5794. 


In addition, software must perform TLB maintenance after updating the System registers if the update means that 
the TLB might hold information that applies to a current translation context, but is no longer valid for that context. 
Maintenance requirements on changing System register values on page G5-5798 gives more information about this 
maintenance requirement. 


Each of the translation regimes defined in Figure G5-1 on page G5-5722 is a different context, and: 
s For the Non-secure PL1&0 regime, a change in the VMID or ASID value changes the context. 
g For the Secure PL1&0 regime, a change in the ASID value changes the context. 


For operation in Non-secure PL1 or ELO modes, a change of HCR.VM, unless made at the same time as a change 
of VMID, requires the invalidation of all TLB entries for the Non-secure PL1&0 translation regime that apply to 
the current VMID. Otherwise, there is no guarantee that the effect of the change of HCR.VM is visible to software 
executing in the Non-secure PL1 and ELO modes. 


Any TLB maintenance instruction can affect any other TLB entries that are not locked down. 


AArch32 state defines {coproc==0b1111, CRn==c8} System instructions for TLB maintenance instructions, and 
supports the following operations: 


5 Invalidate all unlocked entries in the TLB. 

: Invalidate a single TLB entry, by VA, or VA and ASID for a non-global entry. 
s Invalidate all TLB entries that match a specified ASID. 

à Invalidate all TLB entries that match a specified VA, regardless of the ASID. 
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° Operations that apply across multiprocessors in the same Inner Shareable domain. 


Note 


An address-based TLB maintenance instruction that applies to the Inner Shareable domain does so regardless 
of the Shareability attributes of the address supplied as an argument to the instruction. 








A TLB maintenance instruction that specifies a VA that would generate any MMU fault, including a VA that is not 
in the range of VAs that can be translated, does not generate an abort. 


EL2 provides additional TLB maintenance instructions for use in AArch32 state at EL2, and has some implications 
for the effect of the other TLB maintenance instructions, see The scope of TLB maintenance instructions on 
page G5-5802. 


In an implementation that includes EL3, the TLB maintenance instructions take account of the current Security 
state, as part of the address translation required for the TLB maintenance instruction. 


Some TLB maintenance instructions are defined as operating only on instruction TLBs, or only on data TLBs. 
Armv8 AArch32 state includes these instructions for backwards compatibility. However, more recent TLB 
maintenance instructions do not support this distinction. From the introduction of Armv7, Arm deprecates any use 
of Instruction TLB maintenance instructions, or of Data TLB maintenance instructions, and developers must not 
rely on this distinction being maintained in future revisions of the Arm architecture. 


The Arm architecture does not dictate the form in which the TLB stores translation table entries. However, for TLB 
invalidate instructions, the minimum size of the table entry that is invalidated from the TLB must be at least the size 
that appears in the translation table entry. 


The scope of TLB maintenance instructions on page G5-5802 describes the TLB maintenance instructions. The 
following subsections give more information about the general requirements for TLB maintenance: 


$ Using break-before-make when updating translation table entries. 
. The interaction of TLB lockdown with TLB maintenance instructions on page G5-5795. 
. Ordering and completion of TLB maintenance instructions on page G5-5796. 


. Use of ASIDs and VMIDs to reduce TLB maintenance requirements on page G5-5797. 


Using break-before-make when updating translation table entries 


To avoid possibly creating multiple TLB entries for the same address, and to avoid the effects of TLB caching 
possibly breaking coherency, single-copy atomicity properties, ordering guarantees or uniprocessor semantics, or 
possibly failing to clear the Exclusives monitors, the architecture requires the use of a break-before-make sequence 
when changing translation table entries whenever multiple threads of execution can use the same translation tables 
and the change to the translation table entries involves any of: 


° A change of the memory type. 
è A change of the cacheability attributes. 


° A change of the output address (OA), if the OA of at least one of the old translation table entries and the new 
translation table entry is writable. 
s A change to the size of block used by the translation system. This applies both: 


— When changing from a smaller size to a larger size, for example by replacing a table mapping with a 
block mapping in a stage 2 translation table. 


— When changing from a larger size to a smaller size, for example by replacing a block mapping with a 
table mapping in a stage 2 translation table. 


7 A change of the output address (OA), if the contents of memory at the new OA do not match the contents of 
memory at the previous OA. 


è Creating a global entry when there might be non-global entries in a TLB that overlap with that global entry. 
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A break-before-make sequence on changing from an old translation table entry to a new translation table entry 
requires the following steps: 


1. Replace the old translation table entry with an invalid entry, and execute a DSB instruction. 


2; Invalidate the translation table entry with a broadcast TLB invalidation instruction, and execute a DSB 
instruction to ensure the completion of that invalidation. 


3. Write the new translation table entry, and execute a DSB instruction to ensure that the new entry is visible. 


This sequence ensures that at no time are both the old and new entries simultaneously visible to different threads of 
execution, and therefore the problems described at the start of this subsection cannot arise. 


The interaction of TLB lockdown with TLB maintenance instructions 


The precise interaction of TLB lockdown with the TLB maintenance instructions is IMPLEMENTATION DEFINED. 
However, the architecturally-defined TLB maintenance instructions must comply with these rules: 


a The effect on locked entry of a TLB invalidate all unlocked entries instruction or a TLB invalidate by VA all 
ASID instruction that would invalidate that entry if the entry was not locked must be one of the following, 
and it is IMPLEMENTATION DEFINED which behavior applies: 


— The instructions have no effect on entries that are locked down. 


— The instructions generate an IMPLEMENTATION DEFINED Data Abort exception if an entry is locked 
down, or might be locked down. For an invalidate instruction performed in AArch32 state, the 
{coproc==0b1111, CRn==c5} fault status register definitions include a Fault status code for cache and 
TLB lockdown faults, see Table G5-26 on page G5-5827 for the codes used with the Short-descriptor 
translation table formats, or Table GS-27 on page G5-5829 for the codes used with the Long-descriptor 
translation table formats. 


In an implementation that includes EL2, if EL2 is using AArch32 and the value of HCR.TIDCP is 1, 
any such exceptions taken from a Non-secure PL1 mode are routed to Hyp mode, see Traps to Hyp 
mode of Non-secure ELO and EL1 accesses to lockdown, DMA, and TCM operations on 

page G1-5591. 


This permits a usage model for TLB invalidate routines, where the routine invalidates a large range of 
addresses, without considering whether any entries are locked in the TLB. 


: The effect on a locked TLB entry of a TLB invalidate by VA instruction or a TLB invalidate by ASID match 
instruction that would invalidate that entry if the entry was not locked must be one of the following, and it is 
IMPLEMENTATION DEFINED which behavior applies: 


— A locked entry is invalidated in the TLB. 


— The instruction has no effect on a locked entry in the TLB. In the case of the Invalidate single entry by 
VA, this means the PE treats the instruction as a NOP. 


— The instruction generates an IMPLEMENTATION DEFINED Data Abort exception if it operates on an entry 
that is locked down, or might be locked down. For an invalidate instruction performed in AArch32 
state, the {coproc==0b1111, CRn==c5} fault status register definitions include a Fault status code for 
cache and TLB lockdown faults, see Table G5-26 on page G5-5827 and Table G5-27 on 
page G5-5829. 


Note 


Any implementation that uses an abort mechanism for entries that can be locked down but are not actually locked 
down must: 





è Document the IMPLEMENTATION DEFINED instruction sequences that perform the required invalidation on 
entries that are not locked down. 


: Implement one of the other specified alternatives for the locked entries. 


Arm recommends that, when possible, such IMPLEMENTATION DEFINED instruction sequences use the 
architecturally-defined maintenance instructions. This minimizes the number of customized maintenance 
operations required. 
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In addition, an implementation that uses an abort mechanism for handling TLB maintenance instructions on entries 
that can be locked down but are not actually locked down must also must provide a mechanism that ensures that no 
TLB entries are locked. 


Similar rules apply to cache lockdown, see The interaction of cache lockdown with cache maintenance instructions 
on page G4-5709. 





The architecture does not guarantee that any unlocked entry in the TLB remains in the TLB. This means that, as a 
side-effect of a TLB maintenance instruction, any unlocked entry in the TLB might be invalidated. 


Ordering and completion of TLB maintenance instructions 


The following rules describe the relations between the memory order model and the TLB maintenance instructions: 


° A TLB invalidate instruction is complete when all memory accesses using the TLB entries that have been 
invalidated are complete. 


After the TLB invalidate instruction is complete, no new memory accesses using the invalidated TLB entries 
will be architecturally performed by any observer that is affected by the TLB invalidation. 





Note 


This requirement does not mean that speculative memory accesses cannot be performed using those entries 
if it is impossible for software running on any observer to tell that those memory accesses have been 





performed. 
è A TLB maintenance instruction is only guaranteed to be complete after the execution of a DSB instruction. 
° An ISB instruction, or a return from an exception, causes the effect of all completed TLB maintenance 


instructions that appear in program order before the ISB or return from exception to be visible to all 
subsequent instructions, including the instruction fetches for those instructions. 


7 An exception causes all completed TLB maintenance instructions, that appear in the instruction stream before 
the point where the exception is taken, to be visible to all subsequent instructions, including the instruction 
fetches for those instructions. 


$ All TLB maintenance instructions are executed in program order relative to each other. 


° The execution of a Data or Unified TLB maintenance instruction is only guaranteed to be visible to a 
subsequent explicit load or store instruction after both: 


— The execution of a DSB instruction to ensure the completion of the TLB maintenance instruction. 


— Execution of a subsequent Context synchronization event. 


° The execution of an Instruction or Unified TLB maintenance instruction is only guaranteed to be visible to a 
subsequent instruction fetch after both: 


— The execution of a DSB instruction to ensure the completion of the TLB maintenance instruction. 
— Execution of a subsequent Context synchronization event. 


In all cases in this section where a DMB or DSB is referred to, it refers to a DMB or DSB whose required access type is 
both loads and stores. A DSB NSH is sufficient to ensure completion of TLB maintenance instructions that apply to a 
single PE. A DSB ISH is sufficient to ensure completion of TLB maintenance instructions that apply to PEs in the 
same Inner Shareable domain. 


The following rules apply when writing translation table entries. They ensure that the updated entries are visible to 
subsequent accesses and cache maintenance instructions. 


For TLB maintenance, the translation table walk is treated as a separate observer. This means: 


` A write to the translation tables is only guaranteed to be seen by a translation table walk caused by an explicit 
load or store after the execution of both a DSB and an ISB. 


However, the architecture guarantees that any writes to the translation tables are not seen by any explicit 
memory access that occurs in program order before the write to the translation tables. 
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è A write to the translation tables is only guaranteed to be seen by a translation table walk caused by the 
instruction fetch of an instruction that follows the write to the translation tables after both a DSB and an ISB. 


Therefore, in a uniprocessor system, an example instruction sequence for writing a translation table entry, covering 
changes to the instruction or data mappings is: 


STR rx, [Translation table entry] ; write new entry to the translation table 
DSB ; ensures visibility of the new entry 

Invalidate TLB entry by VA (and ASID if non-global) [page address] 

Invalidate BTC 

DSB ; ensure completion of the Invalidate TLB instruction 

ISB ; ensure table changes visible to instruction fetch 


Use of ASIDs and VMIDs to reduce TLB maintenance requirements 


To reduce the need for TLB maintenance on context switches, the lookups from some translation regimes can be 
associated with an ASID, or with an ASID and a VMID. 


Note 


The use of ASIDs and VMIDs in VMSAv8-32 is generally similar to their use in VMSAv8-64, see Use of ASIDs 
and VMIDs to reduce TLB maintenance requirements on page D5-2632. 








For more information about the use of ASIDs in VMSAv8-32 see Global and process-specific translation table 
entries on page G5-5789. 


Common not private translations in VMSAv8-32 


In an implementation that includes ARMv8.2-TTCNP, multiple PEs in the same Inner Shareable domain can use 
the same translation table entries for a given stage of address translation in a particular translation regime. This 
sharing is enabled by the TTBR.CnP field for the stage of address translation. 


When the value of a TTBR.CuP field is 1, translation table entries pointed to by that TTBR are shared with all other 
PEs in the Inner Shareable domain for which the following conditions are met: 


à The corresponding TTBR.CnP field has the value 1. 
$ That TTBR is using the Long-descriptor translation table format. 


z If an ASID applies to the stage of translation corresponding to that TTBR then the current ASID value must 
be the same for all of the PEs that are sharing entries. 


à Ifa VMID applies to the stage of translation corresponding to that TTBR then the current VMID value must 
be the same for all of the PEs that are sharing entries. 


Note 


In an implementation that includes EL3, the Secure instances of TTBRO and TTBR1 relate to the Secure PL1 &0 
translation regime, and the Non-secure instances of TTBRO and TTBR1 relate to the Non-secure PL1&0 translation 
regime. 








For a translation regime with both stage 1 and stage 2 translations, where a TLB holds only stage 1 translation table 
entries, or where a TLB combines information from stage | and stage 2 translation table entries into a single entry, 
this entry can be shared between different PEs only if the value of the TTBR.CnP bit is 1 for both stage 1 and stage 
2 of the translation table walk. 


The TTBR.CnP bit can be cached in a TLB. 
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For a given TTBR, if the value of TTBR.CnP is 1 on multiple PEs in the same Inner Shareable domain, and those 
PEs meet the other conditions for sharing translation table entries as defined in this section, but those TTBRs do not 
point to the same translation table entries, then the system is misconfigured, and performing an address translation 
using that TTBR: 


: Might generate multiple hits in the TLB, and as a result generate an exception that is reported using the TLB 
conflict fault code, see TLB conflict aborts on page G5-5791. 


. Otherwise, has a CONSTRAINED UNPREDICTABLE result, as described in CONSTRAINED UNPREDICTABLE 
behaviors due to caching of control or data values on page K1-7611. 


Maintenance requirements on changing System register values 


The TLB contents can be influenced by control bits in a number of System registers. This means the TLB entries 
associated with a translation regime affected by these control bits must be invalidated after any changes to these 
bits, unless the changes are accompanied by a change to the VMID or ASID, if appropriate depending on the 
translation regime, that defines the context to which the bits apply. The general form of the required invalidation 
sequence is as follows: 


; Change control bits in System registers 
ISB ; Synchronize changes to the control bits 
; Perform TLB invalidation of all entries that might be affected by the changed control bits 
The System register changes that this applies to are: 
. Any change to the NMRR, PRRR, MAIRO,MAIR1, HMAIRO or HMAIRI registers. 
. Any change to the SCTLR.AFE bit, see Changing the Access flag enable. 
è Any change to any of the SCTLR.{TRE, WXN, UWXN} bits. 
è Any change to the Translation table base 0 address in TTBRO. 
7 Any change to the Translation table base 1 address in TTBR1. 
a Any change to HTTBR.BADDR. 
- Any change to VITTBR.BADDR. 
5 Changing TTBCR.EAE, see Changing the current Translation table format on page G5-5799. 
. In an implementation that includes EL3, any change to the SCR.SIF bit. 
s In an implementation that includes EL2: 
— Any change to the HCR.VM bit. 
— Any change to HCR.PTW bit, see Changing HCR.PTW on page G5-5799. 
: When using the Short-descriptor translation table format: 
— Any change to the RGN, IRGN, S, or NOS fields in TTBRO or TTBR1. 
— Any change to the N, EAE, PDO or PD1 fields in TTBCR 
` When using the Long-descriptor translation table format: 


— Any change to the EAE, TnSZ, ORGNn, IRGNn, SHn, or EPDn fields in the TTBCR, where n is 0 
or |. 


— Any change to the TTBCR2. 
— Any change to the TOSZ, ORGNO, IRGNO, or SHO fields in the HTCR. 
— Any change to the TOSZ, ORGNO, IRGNO, or SHO fields in the VTCR. 


Changing the Access flag enable 


In a PE that is using the Short-descriptor translation table format, it is CONSTRAINED UNPREDICTABLE whether the 
TLB caches the effect of the SCTLR.AFE bit on translation tables. This means that, after changing the SCTLR.AFE 
bit software must invalidate the TLB before it relies on the effect of the new value of the SCTLR.AFE bit, otherwise 
behavior is CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching of 
control or data values on page K1-7611. 


Note 


There is no enable bit for use of the Access flag when using the Long-descriptor translation table format. 
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Changing HCR.PTW 


When EL2 is using AArch32 and the value of the Protected table walk bit, HCR.PTW, is 1, a stage 1 translation 
table access in the Non-secure PL1&0 translation regime, to an address that is mapped to any type of Device 
memory by its stage 2 translation, generates a stage 2 Permission fault. A TLB associated with a particular VMID 
might hold entries that depend on the effect of HCR.PTW. Therefore, if the value of HCR.PTW is changed without 
achange to the VMID value, all TLB entries associated with the current VMID must be invalidated before executing 
software in a Non-secure PL1 or ELO mode. If this is not done, behavior is CONSTRAINED UNPREDICTABLE, see 
CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values on page K1-7611. 


Changing the current Translation table format 


The effect of changing TTBCR.EAE when executing in the translation regime affected by TTBCR.EAE with any 
stage of address translation for that translation regime enabled is CONSTRAINED UNPREDICTABLE. This means that, 
when TTBCR.EAE is changed for a given context, the TLB must be invalidated before resuming execution in that 
context, otherwise the effect is CONSTRAINED UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors 
due to caching of control or data values on page K1-7611. 


G5.9.3 Atomicity of register changes on changing virtual machine 


ARM DDI 0487E.a 
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From the viewpoint of software executing in a Non-secure PL1 or ELO mode, when there is a switch from one virtual 
machine to another, the registers that control or affect address translation must be changed atomically. This applies 
to the registers for: 


a Non-secure PL1 &0 stage 1 address translations. This means that all of the following registers must change 
atomically: 
—  PRRR and NMRR, if using the Short-descriptor translation table format. 
— MAIRO and MAIRI], if using the Long-descriptor translation table format. 
—  TTBRO, TTBR1, TTBCR, TTBCR2, DACR, and CONTEXTIDR. 
— The SCTLR. 


s Non-secure PL1&0 stage 2 address translations. When EL2 is using AArch32, this means that all of the 
following registers and register fields must change atomically: 


— VTTBR and VTCR. 
—  HMAIRO and HMAIRI. 
— The HSCTLR. 


Note 
Only some bits of SCTLR affect the stage 1 translation, and only some bits of HSCTLR affect the stage 2 translation. 
However, in each case, changing these bits requires a write to the register, and that write must be atomic with the 
other register updates. 








These registers apply to execution in Non-secure PL1 &0 modes. However, when updated as part of a switch of 
virtual machines they are updated by software executing in Hyp mode. This means the registers are out of context 
when they are updated, and no synchronization precautions are required. 


Note 

By contrast, a translation table change associated with a change of ASID, made by software executing at PL1, can 
require changes to registers that are in context. Synchronization of changes of ASID and TTBR on page G5-5800 
describes appropriate precautions for such a change. 








Software executing in Hyp mode, or in Secure state, must not use the registers associated with the Non-secure 
PL1&0 translation regime for speculative memory accesses. 
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Synchronization of changes of ASID and TTBR 


A common virtual memory management requirement is to change the ASID and TTBR together to associate the 

new ASID with different translation tables, without any change to the current translation regime. When using the 
Short-descriptor translation table format, different registers hold the ASID and the translation table base address, 
meaning these two values cannot be updated atomically. Since a PE can perform a speculative memory access at 
any time, this lack of atomicity is a problem that software must address. Such a change is complicated by: 


° The depth of speculative fetch being IMPLEMENTATION DEFINED. 
. The use of branch prediction. 


When using the Short-descriptor translation table format, the virtual memory management operations must ensure 
the synchronization of changes of the ContextID and the translation table registers. For example, some or all of the 
TLBs, branch predictors, and other caching of ASID and translation information might become corrupt with invalid 
translations. Synchronization is required to avoid either: 

7 The old ASID being associated with translation table walks from the new translation tables. 

$ The new ASID being associated with translation table walks from the old translation tables. 


There are a number of possible solutions to this problem, and the most appropriate approach depends on the system. 
Example G5-3, Example G5-4, and Example G5-5 on page G5-5801 describe three possible approaches. 





Note 


Another instance of the synchronization problem occurs if a branch is encountered between changing the ASID and 
performing the synchronization. In this case the value in the branch predictor might be associated with the incorrect 
ASID. Software can address this possibility using any of these approaches, but instead software might be written in 
a way that avoids such branches. 





Example G5-3 Using a reserved ASID to synchronize ASID and TTBR changes 


In this approach, a particular ASID value is reserved for use by the operating system, and is used only for the 
synchronization of the ASID and TTBR. This example uses the value of 0 for this purpose, but any value could be 
used. 


This approach can be used only when the size of the mapping for any given VA is the same in the old and new 
translation tables. 


The maintenance software uses the following sequence, that must be executed from memory marked as global: 


Change ASID to 0 

ISB 

Change TTBR 

ISB 

Change ASID to new value 


This approach ensures that any non-global pages fetched at a time when it is uncertain whether the old or new 
translation tables are being accessed are associated with the unused ASID value of 0. Since the ASID value of 0 is 
not used for any normal operations these entries cannot cause corruption of execution. 


Example G5-4 Using translation tables containing only global mappings when changing the ASID 


A second approach involves switching the translation tables to a set of translation tables that only contain global 
mappings while switching the ASID. 


The maintenance software uses the following sequence, that must be executed from memory marked as global: 


Change TTBR to the global-only mappings 
ISB 
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Change ASID to new value 
ISB 
Change TTBR to new value 


This approach ensures that no non-global pages can be fetched at a time when it is uncertain whether the old or new 
ASID value will be used. 


This approach works without the need for TLB invalidations in systems that have caching of intermediate levels of 
translation tables, as described in General TLB maintenance requirements on page G5-5793, provided that the 
translation tables containing only global mappings have only level 1 translation table entries of the following kinds: 


: Entries that are global. 


$ Pointers to level 2 tables that hold only global entries, and that are the same level 2 tables that are used for 
accessing global entries by both: 


— The set of translation tables that were used under the old ASID value. 
— The set of translation tables that will be used with the new ASID value. 


. Invalid level 1 entries. 


In addition, all sets of translation tables in this example should have the same Shareability and Cacheability 
attributes, as held in the TTBRO.{ORGN, IRGN} or TTBR1.{ORGN, IRGN} fields. 


If these rules are not followed, then the implementation might cache level 1 translation table entries that require 
explicit invalidation. 


Example G5-5 Disabling non-global mappings when changing the ASID 


In systems where only the translation tables indexed by TTBRO hold non-global mappings, maintenance software 
can use the TTBCR.PD0 field to disable use of TTBRO during the change of ASID. This means the system does not 
require a set of global-only mappings. 


The maintenance software uses the following sequence, that must be executed from a memory region with a 
translation that is accessed using the base address in the TTBR1 register, and is marked as global: 


Set TTBCR.PD@ = 1 

ISB 

Change ASID to new value 
Change TTBR to new value 
ISB 

Set TTBCR.PDQ = 0 


This approach ensures that no non-global pages can be fetched at a time when it is uncertain whether the old or new 
ASID value will be used. 


When using the Long-descriptor translation table format, TTBCR.A1 holds the number, 0 or 1, of the TTBR that 
holds the current ASID. This means the current TTBR can also hold the current ASID, and the current translation 
table base address and ASID can be updated atomically when: 

$ TTBRO is the only TTBR being used. TTBCR.A1 must be set to 0. 

s TTBRO points to the only translation tables that hold non-global entries, and TTBCR.A1 is set to 0. 

` TTBR1 points to the only translation tables that hold non-global entries, and TTBCR.A1 is set to 1. 


In these cases, software can update the current translation table base address and ASID atomically, by updating the 
appropriate TTBR, and does not require a specific routine to ensure synchronization of the change of ASID and base 
address. 


However, in all other cases using the Long-descriptor format, the synchronization requirements are identical to 
those when using the Short-descriptor formats, and the examples in this section indicate how synchronization might 
be achieved. 
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Note 


When using the Long-descriptor translation table format, CONTEXTIDR.ASID has no significance for address 
translation, and is only an extension of the Context ID value. 





The scope of TLB maintenance instructions 


TLB maintenance instructions provide a mechanism for invalidating entries from TLB caching structures, to ensure 
that changes to the translation tables are reflected correctly in the TLB caching structures. To support TLB 
maintenance in multiprocessor systems, there are maintenance operations that apply to the TLBs of all PEs in the 
same Inner Shareable domain. 


The architecture permits the caching of any translation table entry that has been returned from memory without a 
fault and that does not, itself, cause a Translation Fault, an Address size fault, or an Access Flag fault. This means 
the TLB: 


` Cannot hold an entry that, when used for a translation table lookup, causes a Translation fault, an Address 
size fault, or an Access Flag fault. 


$ Can hold an entry for a translation table lookup for a translation that causes a Translation Fault, an Address 
size fault, or an Access Flag fault at a subsequent level of translation table lookup. For example, it can hold 
an entry for the level 1 lookup of a translation that causes a Translation fault, an Address size fault, or an 
Access Flag fault at level 2 or level 3 of lookup. 


This means that entries cached in the TLB can include: 
7 Translation table entries that point to a subsequent table to be used in the current stage of translation. 
: In an implementation that includes EL2: 

— Stage 2 translation table entries that are used as part of a stage 1 translation table walk. 

— Stage 2 translation table entries for translating the output address of a stage 1 translation. 


Such entries might be held in intermediate TLB caching structures that are distinct from the data caches, in that they 
are not required to be invalidated as the result of writes of the data. The architecture makes no restriction on the form 
of these intermediate TLB caching structures. 


The architecture does not intend to restrict the form of TLB caching structures used for holding translation table 
entries. In particular for translation regimes that involve two stages of translation, it recognizes that such caching 
structures might contain: 


: At any level of the translation table walk, entries containing information from stage 1 translation table entries. 


: In an implementation that includes EL2: 


—  Atany level of the translation table walk, entries containing information from stage 2 translation table 
entries. 


— At any level of the translation table walk, entries combining information from both stage 1 and stage 
2 translation table entries. 


Note 


For the purpose of TLB maintenance, the term TLB entry denotes any structure, including temporary working 
registers in translation table walk hardware, that holds a translation table entry. 








For the TLB maintenance instructions: 


- Ifa TLB maintenance instruction is required to apply to stage 1 entries then it must apply to any cached entry 
in the caching structures that includes any stage 1 information that would be used to translate the address 
being invalidated, including any entry that combines information from both stage 1 and stage 2 translation 
table entries. 
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Note 


— Where stage 1 information has been cached in multiple TLB entries, as could occur from splintering 
a page when caching in the TLB, then the invalidation must apply to each cached entry containing 
stage 1 information from the page that is used to translate the address being invalidated, regardless of 
whether or not that cached entry would be used to translate the address being invalidated. 





— As stated in Global and process-specific translation table entries on page G5-5789, translation table 
entries from levels of translation other than the final level are treated as being non-global. Arm expects 
that, in at least some implementations, cached copies of levels of the translation table walk other than 
the last level are tagged with their ASID, regardless of whether the final level is global. This means 
that TLB invalidations that involve the ASID require the ASID to match such entries to perform the 
required invalidation. 





s Ifa TLB maintenance instruction is required to apply to stage 2 entries only, then: 


— Itis not required to apply to caching structures that combine stage 1 and stage 2 translation table 
entries. 


— It must apply to caching structures that contain information only from stage 2 translation table entries. 


$ Ifa TLB maintenance instruction is required to apply to both stage 1 and stage 2 entries, then it must apply 
to any entry in the caching structures that includes information from either a stage 1 translation table entry or 
a stage 2 translation table entry, including any entry that combines information from both stage 1 and stage 
2 translation table entries. 


Table G5-23 on page G5-5804 summarizes the required effect of the AArch32 TLB maintenance instructions, that 
operate only on TLBs on the PE that executes the instruction. Additional TLB maintenance instructions that: 


7 Apply across all PEs in the same Inner Shareable domain. Each instruction shown in the table has an Inner 
Shareable equivalent, identified by an IS suffix. For example, the Inner Shareable equivalent of TLBIALL is 
TLBIALLIS. See also EL2 forced broadcasting of TLB maintenance instructions on page G5-5805. 


g Can apply to separate Instruction or Data TLBs. These instructions are indicated by a footnote to the table. 
Arm deprecates any use of these instructions. 


Note 


$ The architecture permits a TLB invalidation instruction to affect any unlocked entry in the TLB. Table G5-23 
on page G5-5804 defines only the entries that each instruction must invalidate. 





° All TLB instructions, including those that operate on a VA match, operate as described regardless of the value 
of SCTLR.M. 





When interpreting the table: 


Related operations Each instruction description applies also to any equivalent instruction that either: 
s Applies to all PEs in the same Inner Shareable domain. 
š Applies only to a data TLB, or only to an instruction TLB. 


So, for example, the TLBIALL instruction description applies also to TLBIALLIS, 
ITLBIALL, and DTLBIALL. 


TLB maintenance system instructions on page K14-7862 lists all of the TLB maintenance 
instructions. 


Matches the VA Means the VA argument for the instruction must match the VA value in the TLB entry. 


Matches the ASID Means the ASID argument for the instruction must match the ASID in use when the TLB 
entry was assigned. 


Matches the current VMID 
Means the current VMID must match the VMID in use when the TLB entry was assigned. 
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The dependency on the VMID applies even when the value of HCR.VM is 0, including 
situations where there is no use of virtualization. However, VTTBR.VMID resets to zero, 
meaning there is a valid VMID from reset. 


Execution at EL2 Descriptions of operations at EL2 apply only to implementations that include EL2. 


For the definitions of the translation regimes referred to in the table see About VMSAv8-32 on page G5-5720. 


Table G5-23 Effect of the TLB maintenance instructions 





Executed from 














Instruction Effect, must invalidate any entry that matches all stated conditions 
State Mode 
TLBIALL® Secure PLI All entries for the Secure PL1&0 translation regime. That is, all entries that were 
allocated in Secure state. 
Non-secure PL1 All entries for stage 1 of the Non-secure PL1&0 translation regime that match the 
current VMID. 
Hyp All entries for stage 1 or stage 2 of the Non-secure PL1&0 translation regime that 
match the current VMID. 
TLBIMVA> Secure PL1 Any entry for the Secure PL1&0 translation regime that both: 


° Matches the VA argument. 
` Matches the ASID argument, or is global. 





Non-secure PL1 or Any entry for stage 1 of the Non-secure PL1&0 translation regime to which all of 
Hyp the following apply. The entry: 


. Matches the VA argument. 
. Matches the ASID argument, or is global. 
° Matches the current VMID. 








TLBIASID? Secure PL1 Any entry for the Secure PL1&0 translation regime that matches the specified ASID 
and either: 
* Is from a level of lookup above the final level. 
° Is a non-global entry from the final level of lookup. 
Non-secure PL1 or Any entry for stage 1 of the Non-secure PL1&0 translation regime that both: 
Hyp ° Matches the specified ASID and either: 


— Is from a level of lookup above the final level. 
— Isanon-global entry from the final level of lookup. 
s Matches the current VMID. 








TLBIMVAA Secure PLI Any entry for the Secure PL1&0 translation regime that matches the VA argument. 
Non-secure PL1 or Any entry for stage 1 of the Non-secure PL1&0 translation regime that both: 
Hyp ° Matches the VA argument. 


. Matches the current VMID. 





TLBIALLNSNH¢ Secure Monitor All entries for stage 1 or stage 2 of the Non-secure PL1&0 translation regime, 
regardless of the associated VMID. 





Non-secure Hyp 





TLBIALLH: Secure Monitor All entries for the Non-secure EL2 translation regime. That is, any entry that was 
allocated in Non-secure state from Hyp mode. 





Non-secure Hyp 
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Table G5-23 Effect of the TLB maintenance instructions (continued) 





Executed from 






































Instruction Effect, must invalidate any entry that matches all stated conditions? 
State Mode 
TLBIMVAL Secure PL1 Any entry for stage 1 of the Secure PL1&0 translation regime that is from the last 
level of the translation table walk and both: 
° Matches the VA argument. 
° Matches the ASID argument, or is global. 
Non-secure PL1 or Any entry for stage 1 of the Non-secure PL1&0 translation regime that is from the 
Hyp last level of the translation table walk and to which all of the following apply. The 
entry: 
. Matches the VA argument. 
s Matches the ASID argument, or is global. 
e Matches the current VMID. 
TLBIMVAAL Secure PL1 Any entry for stage 1 of the Secure PL1&0 translation regime that is from the last 
level of the translation table walk and matches the VA argument. 
Non-secure PL1 or Any entry for stage 1 of the Non-secure PL1&0 translation regime that is from the 
Hyp last level of the translation table walk and both: 
š Matches the VA argument. 
. Matches the current VMID. 
TLBIMVAH®¢ Secure Monitor Any entry for the Non-secure EL2 translation regime that matches the VA argument. 
Non-secure Hyp 
TLBIMVALH¢ Secure Monitor Any entry for the Non-secure EL2 translation regime that is from the last level of the 
translation table walk and matches the VA argument. 
Non-secure Hyp 
TLBIIPAS2¢: 4 Secure Monitore Any entry for stage 2 of the PL1&0 translation regime that both: 
N e ° Matches the IPA argument. 
E R ° Matches the current VMID. 
TLBIIPAS2L°. 4 Secure Monitore Any entry for stage 2 of the PL1&0 translation regime that is from the last level of 
translation and both: 
Non-secure Hyp 


. Matches the IPA argument. 
e Matches the current VMID. 





a. When a TLB maintenance instruction is executed at Secure EL1 in AArch32 state when EL3 is using AArch64, it only affects TLB entries 


related to the Secure EL1 translation regime. 


b. The architecture defines variants of these instructions that apply only to instruction TLBs, and only to data TLBs. Arm deprecates any use 
of these variants. For more information, see the referenced description of the operation. 


c. Available only in an implementation that includes EL2. See also EL2 forced broadcasting of TLB maintenance instructions. 


d. This instruction is CONSTRAINED UNPREDICTABLE if executed in any AArch32 Secure privileged mode, see Hyp mode TLB maintenance 


instructions on page K1-7627. 


e. This instruction executes as a NOP when SCR.NS == 0. 


EL2 forced broadcasting of TLB maintenance instructions 


In an implementation that includes EL2, when the value of HCR.FB is 1, the TLB maintenance instructions that are 
not broadcast across the Inner Shareable domain are forced to operate across the Inner Shareable domain when 
executed in a Non-secure PL1 mode. For example, when the value of HCR.FB is 1, a TLBIMVA instruction 
executed in a Non-secure PL1 mode performs the same invalidation as the invalidation performed by a TLBIMVAIS 


instruction. 
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TLB maintenance with different translation granule sizes 


Ifa TLB maintenance instruction specifying a VA affecting the EL2 translation regime is broadcast from a PE using 
AArch32 to a PE using AArch64 using a translation granule size that is different from the AArch32 translation 
granule size for that same translation regime, the TLB maintenance instruction is not required to perform any 
invalidation on the recipient PE. 


Ifa TLB maintenance instruction specifying a VA affecting the PL1 translation regime is broadcast from a PE using 
AArch32 using one translation granule size for that translation regime for a particular ASID, VMID (if applicable), 
and Security state, to a PE using AArch64 where EL1 for the same ASID, VMID (if applicable), and Security state, 
is using a translation granule size that is different from the AArch32 translation granule size, the TLB maintenance 
instruction is not required to perform any invalidation on the recipient PE. 
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G5.10 Caches in VMSAv8-32 


The Arm architecture describes the required behavior of an implementation of the architecture. As far as possible it 
does not restrict the implemented microarchitecture, or the implementation techniques that might achieve the 
required behavior. 


Maintaining this level of abstraction is difficult when describing the relationship between memory address 
translation and caches, especially regarding the indexing and tagging policy of caches. This section: 


a Summarizes the architectural requirements for the interaction between caches and memory translation. 


à Gives some information about the likely implementation impact of the required behavior. 


The following sections give this information: 
. Data and unified caches. 


. Instruction caches. 


In addition Cache maintenance requirement created by changing translation table attributes on page G5-5809 
describes the cache maintenance required after updating the translation tables to change the attributes of an area of 
memory. 


For more information about cache maintenance see: 


. AArch32 cache and branch predictor support on page G4-5687. This section describes the Arm cache 
maintenance instructions. 


. Cache maintenance system instructions on page K14-7861. This section summarizes the System register 
encodings used for these operations when executing in AArch32 state. 


G5.10.1 Data and unified caches 


For data and unified caches, the use of memory address translation is entirely transparent to any data access other 
than as described in Mismatched memory attributes on page E2-3850. 


This means that the behavior of accesses from the same observer to different VAs, that are translated to the same PA 
with the same memory attributes, is fully coherent. This means these accesses behave as follows, regardless of 
which VA is accessed: 


e Two writes to the same PA occur in program order. 

. A read of a PA returns the value of the last successful write to that PA. 

. A write to a PA that occurs, in program order, after a read of that PA, has no effect on the value returned by 
that read. 


The memory system behaves in this way without any requirement to use barrier or cache maintenance instructions. 


In addition, if cache maintenance is performed on a memory location, the effect of that cache maintenance is visible 
to all aliases of that physical memory location. 


These properties are consistent with implementing all caches that can handle data accesses as Physically-indexed, 
physically-tagged (PIPT) caches. 


G5.10.2 Instruction caches 
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In the Arm architecture, an instruction cache is a cache that is accessed only as a result of an instruction fetch. 
Therefore, an instruction cache is never written to by any load or store instruction executed by the PE. 


The Arm architecture permits different behaviors for instruction caches. These are identified by descriptions of the 
associated expected implementation. The following subsections describe the behavior associated with these cache 
types, including any occasions where explicit cache maintenance is required to make the use of memory address 
translation transparent to the instruction cache: 

. PIPT (Physically-indexed, physically-tagged) instruction caches on page G5-5808. 

. VPIPT (VMID-aware PIPT ) instruction caches on page G5-5808. 

. VIPT (Virtually-indexed, physically-tagged) instruction caches on page G5-5808. 
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. The IVIPT architecture Extension on page G5-5809. 


In AArch32 state, the CTR.L1Ip field identifies the form of the instruction caches. 





Note 


For software to be portable between implementations that might use any of PIPT instruction caches, VPIPT 
instruction caches, or VIPT instruction caches, software must invalidate the instruction cache whenever any 
condition occurs that would require instruction cache maintenance for at least one of the instruction cache types. 





PIPT (Physically-indexed, physically-tagged) instruction caches 
For a PIPT instruction cache: 


s The use of memory address translation is entirely transparent to all instruction fetches other than as described 
in Mismatched memory attributes on page E2-3850. 


è If cache maintenance is performed on a memory location, the effect of that cache maintenance is visible to 
all aliases of that physical memory location. 


An implementation that provides PIPT instruction caches implements the IVIPT Extension, see The IVIPT 
architecture Extension on page G5-5809. 


VPIPT (VMID-aware PIPT ) instruction caches 


An Armv8.2 implementation can implement VPIPT instruction caches. If it does so then it is described as 
implementing ARMv8.2-VPIPT. 


The CTR.LIIp field identifies the implemented cache type, meaning it identifies whether ARMv8.2-VPIPT is 
implemented. 


For a VPIPT instruction cache: 


- Instruction fetches from Non-secure EL1 and Non-secure ELO are only permitted to hit in the cache if the 
instruction fetch is made using the VMID that was used when the entry in the instruction cache was fetched. 


e An instruction cache maintenance instruction executed at Non-secure ELO or at Non-secure EL1 is required 
to have an effect on entries in the instruction cache only if those entries were fetched using the VMID that is 
current when the cache maintenance instruction is executed. 


All other requirements for the use of cache maintenance instructions are the same as for PIPT (Physically-indexed, 
physically-tagged) instruction caches. 


An implementation that provides VPIPT instruction caches implements the IVIPT Extension, see The IVIPT 
architecture Extension on page G5-5809. 


VIPT (Virtually-indexed, physically-tagged) instruction caches 
For a VIPT instruction cache: 


à The use of memory address translation is transparent to all instruction fetches other than for the effect of 
memory address translation on instruction cache invalidate by address operations or as described in 
Mismatched memory attributes on page E2-3850. 

Note 


Cache invalidation is the only cache maintenance instruction that can be performed on an instruction cache. 








s If instruction cache invalidation by address is performed on a memory location, the effect of that invalidation 
is visible only to the VA supplied with the operation. The effect of the invalidation might not be visible to 
any other VA aliases of that physical memory location. 
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The only architecturally-guaranteed way to invalidate all aliases of a PA from a VIPT instruction cache is to 
invalidate the entire instruction cache. 


An implementation that provides VIPT instruction caches implements the [VIPT Extension, see The IVIPT 
architecture Extension. 


The IVIPT architecture Extension 


In Armv8, any permitted instruction cache implementation can be described as implementing the VIPT Extension 
to the Arm architecture. 


The formal definition of the Arm IVIPT Extension is that it reduces the instruction cache maintenance requirement 
to the following condition: 


. Instruction cache maintenance is required only after writing new data to a PA that holds an instruction. 





Note 


Previous versions of the Arm architecture have permitted an instruction cache option that does not implement the 
Arm IVIPT Extension. 





G5.10.3 Cache maintenance requirement created by changing translation table attributes 
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Any change to the translation tables to change the attributes of an area of memory can require maintenance of the 
translation tables, as described in General TLB maintenance requirements on page G5-5793. If the change affects 
the cacheability attributes of the area of memory, including any change between Write-Through and Write-Back 
attributes, software must ensure that any cached copies of affected locations are removed from the caches, typically 
by cleaning and invalidating the locations from the levels of cache that might hold copies of the locations affected 
by the attribute change. Any of the following changes to the inner cacheability or outer cacheability attribute creates 
this maintenance requirement: 

° Write-Back to Write-Through. 

° Write-Back to Non-cacheable. 

. Write-Through to Non-cacheable. 

. Write-Through to Write-Back. 


The cache clean and invalidate avoids any possible coherency errors caused by mismatched memory attributes. 


Similarly, to avoid possible coherency errors caused by mismatched memory attributes, the following sequence 
must be followed when changing the Shareability attributes of a cacheable memory location: 


1. Make the memory location Non-cacheable, Outer Shareable. 


2. Clean and invalidate the location from them cache. 
3. Change the Shareability attributes to the required new values. 
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G5.11 


G5-5810 


VMSAv8-32 memory aborts 


In a VMSAv8-32 implementation, the following mechanisms cause a PE to take an exception on a failed memory 
access: 


Debug exception An exception caused by the debug configuration, see Chapter G2 AArch32 Self-hosted 
Debug. 


Alignment fault An Alignment fault is generated if the address used for a memory access does not have the 
required alignment for the operation. For more information see Unaligned data access on 
page E2-3834 and Alignment faults on page G5-5818. 


MMU fault An MMU fault is a fault generated by the fault checking sequence for the current translation 
regime. See Types of MMU faults on page G5-5811. 

External abort Any memory system fault other than a Debug exception, an Alignment fault, or an MMU 
fault. 


Collectively, these mechanisms are called aborts. Chapter G2 AArch32 Self-hosted Debug and Chapter H3 Halting 
Debug Events describe Debug exceptions, and the remainder of this section describes Alignment faults, MMU 
faults, and External aborts. 


An access that causes an abort is said to be aborted, and uses the Fault Address Registers (FARs) and Fault Status 
Registers (FSRs) or Exception Syndrome Registers (ESRs) to record context information. 


The exception generated on a synchronous memory abort: 


° On an instruction fetch is called the Prefetch Abort exception. 
. On a data access is called the Data Abort exception. 
Note 





The Prefetch Abort exception applies to any synchronous memory abort on an instruction fetch. It is not restricted 
to speculative instruction fetches. 





The Exception level and PE mode that a VMSAv8-32 memory abort is taken to depends on the translation regime 
and stage that generate the abort. The fault context is dependent on whether: 





è The abort is reported as a Prefetch Abort or as a Data Abort. 
. The exception is taken from the same or a lower Exception level. 
Note 


A memory access from AArch32 state may be subject to one or more VMSAv8-64 translation stages. For example, 
a Non-secure ELO access when EL1 is using AArch64 is subject to both stages of the VMSAv8-64 Non-secure 
EL1&0 translation regime. A memory abort generated on a VMSAv8-64 translation stage is handled as described 
in VMSAv8-64 memory aborts on page D5-2622. 





For more information, see Routing of aborts taken to AArch32 state on page G1-5520. 


External aborts can be reported synchronously or asynchronously. Asynchronous External aborts are reported using 
the SError interrupt. For more information, see External aborts on page G4-5712. 


In AArch32 state, asynchronous memory aborts are a type of External abort, and are treated as a type of Data Abort 
exception. 


The following sections describe the abort mechanisms: 

è Types of MMU faults on page G5-5811. 

. VMSAv8-32 MMU fault terminology on page G5-5813. 

7 The MMU fault-checking sequence on page G5-58 14. 

. Alignment faults on page G5-5818. 

° External abort on a translation table walk on page G5-5818. 
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. AArch32 state prioritization of synchronous aborts from a single stage of address translation on 
page G5-5819. 


An access that causes an abort is said to be aborted. On an abort, System registers are used to record context 
information. For more information see Exception reporting in a VMSAv&-32 implementation on page G5-5822. 


G5.11.1 Types of MMU faults 
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This section describes the faults that might be detected during one of the fault-checking sequences described in The 
MMU fault-checking sequence on page G5-5814. Unless indicated otherwise, information in this section applies to 
the fault checking sequences for both the Short-descriptor translation table format and the Long-descriptor 
translation table format. 


MMU faults are always synchronous. 


When an MMU fault generates an abort for a region of memory, no memory access is made if that region is or could 
be marked as any type of Device memory. 


The MMU faults that might be detected during a fault checking sequence are: 


: Permission fault. 
° Translation fault. 
. Address size fault. 


: Access flag fault. 
s Domain fault, short-descriptor translation tables only. 
° TLB conflict abort. 


See also External abort on a translation table walk on page G5-5818. 


Note 


è Although the TLB conflict abort is classified as an MMU fault, it is described in the section Translation 
Lookaside Buffers (TLBs) on page G5-5789. 





° In VMSAv8-64 an External abort on a translation table walk is classified as an MMU fault. However, in 
VMSAv8-32, for consistency with earlier versions of the architecture these aborts are not classified as MMU 
faults. 





Permission fault 


A Permission fault can be generated at any level of lookup, and the reported fault code identifies the lookup level. 
See About access permissions on page G5-5766 for information about conditions that cause a Permission fault. 





Note 


When using the Short-descriptor translation table format, the translation table descriptors are checked for 
Permission faults only for accesses to memory regions in Client domains. 


A TLB might hold a translation table entry that cause a Permission fault. Therefore, if the handling of a Permission 
fault results in an update to the associated translation tables, the software that updates the translation tables must 
invalidate the appropriate TLB entry, to prevent the stale information in the TLB being used on a subsequent 
memory access. For more information, see the translation table entry update examples in Ordering and completion 
of TLB maintenance instructions on page G5-5796. 


In an implementation that includes EL2, this maintenance requirement applies to Permission faults in both stage 1 
and stage 2 translations. 


Cache or branch predictor maintenance operations cannot cause a Permission fault, except that a stage 1 translation 
table walk performed as part ofa cache or branch predictor maintenance operation can generate a stage 2 Permission 
fault as described in Stage 2 fault on a stage 1 translation table walk. 
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Translation fault 


A Translation fault can be generated at any level of lookup, and the reported fault code identifies the lookup level. 
A Translation fault is generated if bits[1:0] of a translation table descriptor identify the descriptor as either a Fault 
encoding or a reserved encoding. For more information see: 


s VMSAv8-32 Short-descriptor translation table format descriptors on page G5-5738. 
s VMSAv8-32 Long-descriptor translation table format descriptors on page G5-5747. 


In addition, a Translation fault is generated if the input address for a translation either does not map onto an address 
range of a TTBR, or the TTBR range that it maps onto is disabled. In these cases the fault is reported as a level 1 
Translation fault on the translation stage at which the mapping to a region described by a TTBR failed. 


The architecture guarantees that any translation table entry that causes a Translation fault is not cached, meaning 
the TLB never holds such an entry. Therefore, when a Translation fault occurs, the fault handler does not have to 
perform any TLB maintenance instructions to remove the faulting entry. 


A data or unified cache maintenance by VA instruction can generate a Translation fault. However: 


a If the Point of Coherency is before any level of cache, it is IMPLEMENTATION DEFINED whether a data or 
unified cache maintenance by VA to the Point of Coherency instruction can generate a Translation fault. 


s If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether a data 
or unified cache clean by VA to the Point of Unification instruction can generate a Translation fault. 


It is IMPLEMENTATION DEFINED whether an instruction cache invalidate by VA operation can generate a Translation 
fault. 


It is IMPLEMENTATION DEFINED whether a branch predictor maintenance operation can generate a Translation fault. 


Address size fault 
An Address size fault can be generated at any level of lookup, and the reported fault code identifies the lookup level. 


An Address size fault is generated if the translation table entries or the TTBR for the stage of translation have 
nonzero address bits above the most significant bit of the maximum output address size. Because VMSAv8-32 
supports a maximum PA and IPA size of 40 bits, this means any case where a translation table entry or the TTBR 
holds an address for which A[47:40] is nonzero generates an Address size fault. 


A data or unified cache maintenance by VA instruction can generate an Address size fault. However: 


° If the Point of Coherency is before any level of cache, it is IMPLEMENTATION DEFINED whether a data or 
unified cache maintenance by VA instruction can generate an Address size fault. 


è If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether a data 
or unified cache clean by VA to the Point of Unification instruction can generate an Address size fault. 


It is IMPLEMENTATION DEFINED whether an instruction cache invalidate by VA operation can generate an Address 
size fault. 


It is IMPLEMENTATION DEFINED whether a branch predictor maintenance operation can generate an Address size 
fault. 


The architecture guarantees that any translation table entry that causes an Address size fault is not cached, meaning 
the TLB never holds such an entry. Therefore, when an Address size fault occurs, the fault handler does not have to 
perform any TLB maintenance instructions to remove the faulting entry. 


Access flag fault 


An Access flag fault can be generated at any level of lookup, and the reported fault code identifies the lookup level. 
An Access flag fault is generated only if all of the following apply: 


s The translation tables support an Access flag bit: 
— The Short-descriptor format supports an Access flag only when SCTLR.AFE is set to 1. 
— The Long-descriptor format always supports an Access flag. 
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° A translation table descriptor with the Access flag bit set to 0 is loaded. 


For more information about the Access flag bit see: 
° VMSAv8-32 Short-descriptor translation table format descriptors on page G5-5738 
s VMSAv8-32 Long-descriptor translation table format descriptors on page G5-5747. 


The architecture guarantees that any translation table entry that causes an Access flag fault is not cached, meaning 
the TLB never holds such an entry. Therefore, when an Access flag fault occurs, the fault handler does not have to 
perform any TLB maintenance instructions to remove the faulting entry. 


Whether any cache maintenance instruction by VA can generate Access flag faults is IMPLEMENTATION DEFINED. 
Whether branch predictor invalidate by VA operations can generate Access flag faults is IMPLEMENTATION DEFINED. 


For more information, see The Access flag on page G5-5774. 


Domain fault, Short-descriptor format translation tables only 


When using the Short-descriptor translation table format, a Domain fault can be generated at level lor level 2 of 
lookup. The reported fault code identifies the lookup level. The conditions for generating a Domain fault are: 


Level 1 When a level 1 descriptor fetch returns a valid Section level 1 descriptor, the domain field of that 
descriptor is checked against the DACR. A level 1 Domain fault is generated if this check fails. 


Level 2 When a level 2 descriptor fetch returns a valid level 2 descriptor, the domain field of the level 1 
descriptor that required the level 2 fetch is checked against the DACR, and a level 2 Domain fault 
is generated if this check fails. 


For more information, see Domains, Short-descriptor format only on page G5S-5774. 
Domain faults cannot occur on cache or branch predictor maintenance operations. 


A TLB might hold a translation table entry that cause a Domain fault. Therefore, if the handling of a Domain fault 
results in an update to the associated translation tables, the software that updates the translation tables must 
invalidate the appropriate TLB entry, to prevent the stale information in the TLB being used on a subsequent 
memory access. For more information, see the translation table entry update examples in Ordering and completion 
of TLB maintenance instructions on page G5-5796. 


Any change to the DACR must be synchronized by a Context synchronization event. For more information see 
Synchronization of changes to AArch32 System registers on page G8-5896. 


G5.11.2 VMSAv8-32 MMU fault terminology 


The Armv7 Large Physical Address Extension introduced new terminology for faults on a stage of address 
translation, to provide consistent terminology across all implementations. Table G5-24 shows the terminology used 
in this manual for an MMU faults, compared with older Arm documentation. The current terms are the same for 
faults that occur with the Short-descriptor translation table format and with the Long-descriptor format, and also 
apply to faults in a level 3 lookup when using the Long-descriptor translation table format. 


Table G5-24 MMU fault terminology 





Current term Old term Note 





Level 1 Translation fault Section Translation fault = - 





Level 2 Translation fault Page Translation fault - 





Level 3 Translation fault - Long-descriptor translation table format only. 





Level 1 Access flag fault Section Access flag fault = - 





Level 2 Access flag fault Page Access flag fault - 





Level 3 Access flag fault - Long-descriptor translation table format only. 
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Table G5-24 MMU fault terminology (continued) 








Current term Old term Note 

Level 1 Domain fault Section Domain fault Short-descriptor translation table format only, except for reporting faults 
7 7 on address translation instructions in the 64-bit PAR, see Determining 

Level 2 Domain fault Page Domain fault the PAR format on page G5-5845. 


Cannot occur at level 3. 





Level | Permission fault Section Permission fault  - 





Level 2 Permission fault Page Permission fault - 





Level 3 Permission fault - Long-descriptor translation table format only. 





In an implementation that includes EL2, MMU faults are also classified by the translation stage at which the fault 
is generated. This means that a memory access from a Non-secure PL1 or ELO mode can generate: 


è A stage 1 MMU fault, for example, a stage 1 Translation fault. 
: A stage 2 MMU fault, for example, a stage 2 Translation fault. 


G5.11.3 The MMU fault-checking sequence 


This section describes the MMU checks made for the memory accesses required for instruction fetches and for 
explicit memory accesses: 


à If an instruction fetch faults it generates a Prefetch Abort exception. 
$ If an data memory access faults it generates a Data Abort exception. 


For more information about Prefetch Abort exceptions and Data Abort exceptions see Handling exceptions that are 
taken to an Exception level using AArch32 on page G1-5501. 


In VMSAv8-32, all memory accesses require VA to PA translation. Therefore, when a corresponding stage of 
address translation is enabled, each access requires a lookup of the translation table descriptor for the accessed VA. 
For more information, see Translation tables on page G5-5732 and subsequent sections of this chapter. MMU fault 
checking is performed for each level of translation table lookup. If an implementation includes EL2 and is operating 
in Non-secure state, MMU fault checking is performed for each stage of address translation. 


Note 


In an implementation that includes EL2, if a PE is executing in Non-secure state, the operating system or similar 
Non-secure system software defines the stage 1 translation tables in the IPA address map, and typically is unaware 
of the stage 2 translation from IPA to PA. However, each Non-secure stage 1 translation table access is subject to 
stage 2 address translation, and might be faulted at that stage. 








The MMU fault checking sequence is largely independent of the translation table format, as the figures in this 
section show. The differences are: 


When using the Short-descriptor format 


. There are one or two levels of lookup. 
° Lookup always starts at level 1. 
a The final level of lookup checks the Domain field of the descriptor and: 


— Faults if there is no access to the Domain. 
— Checks the access permissions only for Client domains. 


When using the Long-descriptor format 


° There are one, two, or three levels of lookup. 
e Lookup starts at either level 1 or level 2. 
à Domains are not supported. All accesses are treated as Client domain accesses. 
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The fault-checking sequence shows a translation from an Input address to an Output address. For more information 
about this terminology, see About address translation for VMSAv8-32 on page GS-5723. 





Note 
The descriptions in this section do not include the possibility that the attempted address translation generates a TLB 
conflict abort, as described in TLB conflict aborts on page G5-5791. 





Types of MMU faults on page G5-5811 describes the faults that an MMU fault-checking sequence can report. 


Figure GS-15 shows the process of fetching a descriptor from the translation table. For the top-level fetch for any 
translation, the descriptor is fetched only if the input address passes any required alignment check. As the figure 
shows, in an implementation that includes EL2, if the translation is stage 1 of the Non-secure PL1&0 translation 
regime, then the descriptor address is in the IPA address map, and is subject to a stage 2 translation to obtain the 
required PA. This stage 2 translation requires a recursive entry to the fault checking sequence. 


Note 
Figure GS-15 and Figure GS-16 on page G5-5816 give an overview of the fault checking performed by the MMU. 
See AArch32 state prioritization of synchronous aborts from a single stage of address translation on page G5-5819 
for the complete set of possible faults and their prioritization. 
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Figure G5-15 Fetching the descriptor in a VMSAv8-32 translation table walk 


Figure G5-16 on page G5-5816 shows the full VMSAv8-32 fault checking sequence, including the alignment check 
on the initial access. 
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Stage 2 fault on a stage 1 translation table walk 


When an implementation that includes EL2 is operating in a Non-secure PL1 or ELO mode, any memory access 
goes through two stages of translation: 


° Stage 1, from VA to IPA. 
° Stage 2, from IPA to PA. 


Note 


In a virtualized system that is using AArch32, typically, a Guest OS operating in a Non-secure PL1 mode defines 
the translation tables and translation table register entries controlling the Non-secure PL1 &0 stage 1 translations. A 
Guest OS has no awareness of the stage 2 address translation, and therefore believes it is specifying translation table 
addresses in the PA map. However, it actually specifies these addresses in its IPA map. Therefore, to support 
virtualization, translation table addresses for the Non-secure PL1&0 stage | translations are always defined in the 
IPA address map. 








On performing a translation table walk for the stage 1 translations, the descriptor addresses must be translated from 
IPA to PA, using a stage 2 translation. This means that a memory access made as part of a stage 1 translation table 
lookup might generate, on a stage 2 translation: 

. A Translation fault, Access flag fault, or Permission fault. 

7 A synchronous External abort on the memory access. 


If SCR.EA is set to 1, asynchronous External abort is taken to EL3, and if EL3 is using AArch32 it is taken to Secure 
Monitor mode. Otherwise, these faults are reported as stage 2 memory aborts. When EL2 is using AArch32, 

HSR.ISS[7] is set to 1, to indicate a stage 2 fault during a stage 1 translation table walk, and the part of the ISS field 
that might contain details of the instruction is invalid. For more information see Use of the HSR on page G5-5836. 


Alternatively, a memory access made as part of a stage 1 translation table lookup might target an area of memory 
with the Device memory attribute assigned on the stage 2 translation of the address accessed. When the value of the 
HCR.PTW bit is 1, such an access generates a stage 2 Permission fault. 





Note 


s On most systems, such a mapping to a Device memory type on the stage 2 translation is likely to indicate a 
Guest OS error, where the stage 1 translation table is corrupted. Therefore, it is appropriate to trap this access 
to the hypervisor. 





A TLB might hold entries that depend on the effect of HCR.PTW. Therefore, if HCR.PTW is changed without 
changing the current VMID, the TLBs must be invalidated before executing in a Non-secure PL1 or ELO mode. For 
more information see Changing HCR.PTW on page G5-5799. 


A cache maintenance instruction executed at Non-secure PL1 can cause a stage 1 translation table walk that might 
generate a stage 2 Permission fault, as described in this section. However: 


g If the Point of Coherency is before any level of cache, it is IMPLEMENTATION DEFINED whether a cache 
maintenance by VA instruction can generate a Permission fault in this way. 


s If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether a data 
or unified cache clean by VA to the Point of Unification instruction can generate a Permission fault in this 
way. 





Note 


This is an exception to the general rule that a cache maintenance instruction cannot generate a Permission fault. 
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The level associated with MMU faults 


When an MMU fault is from a stage of translation that is using Long-descriptor translation table format, 
Table G5-25 shows how the LL bits in the STATUS field of DFSR, IFSR, and HSR encode the lookup level 
associated with the fault. 


Table G5-25 Use of LL bits to encode the lookup level at which the fault occurred 





LL bits Meaning 














00 Level 0 of translation or translation table base register. 

01 Level 1. 

10 Level 2. 

11 Level 3. When xFSR.STATUS indicates a Domain fault, this value is reserved. 





The lookup level associated with a fault is: 
° For a fault generated on a translation table walk, the lookup level of the walk being performed. 


° For a Translation fault, the lookup level of the translation table that gave the fault. If a fault occurs because 
a stage of address translation is disabled, or because the input address is outside the range specified by the 
appropriate base address register or registers, the fault is reported as a level 1 fault. 


s For an Access flag fault, the lookup level of the translation table that gave the fault. 


s For a Permission fault, including a Permission fault caused by hierarchical permissions, the lookup level of 
the final level of translation table accessed for the translation. That is, the lookup level of the translation table 
that returned a Block or Page descriptor. 


Also see Synchronous External abort errors from address translation caching structures on page G5-5821. 


G5.11.4 Alignment faults 


The Arm memory architecture requires support for strict alignment checking. This checking is controlled by: 
: SCTLR.A, for accesses made from any PE mode other than Hyp mode. 
. HSCTLR.A, for accesses made from Hyp mode. 


In addition, some instructions do not support unaligned accesses, regardless of the value of SCTLR.A or 
HSCTLR.A. 


Unaligned data access on page E2-3834: 
$ Defines when Alignment faults are generated, for both values of SCTLR.A or HSCTLR.A. 


. Describes the possible generation of Alignment faults on accesses to Device memory by AArch32 Load 
Multiple or Store Multiple instructions when ARMv8.2-LSMAOC is implemented. 


An Alignment fault can occur on an access for which the stage of address translation is disabled. 
Any unaligned access to memory region with any Device memory type attribute generates an Alignment fault. 
Routing of aborts taken to AArch32 state on page G1-5520 defines the mode to which an Alignment fault is taken. 


The prioritization of Alignment faults depends on whether the fault was generated because of an access to a Device 
memory type, or for another reason. For more information see AArch32 state prioritization of synchronous aborts 
from a single stage of address translation on page GS-58 19. 


G5.11.5 External abort on a translation table walk 


An External abort on a translation table walk can be either synchronous or asynchronous. For more information on 
External aborts, see External aborts on page G4-5712. 
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An External abort on a translation table walk is reported: 

. If the External abort is synchronous, using: 
— Asynchronous Prefetch Abort exception if the translation table walk is for an instruction fetch. 
— A synchronous Data Abort exception if the translation table walk is for a data access. 


s If the External abort is asynchronous, using an SError interrupt, which is taken as an asynchronous Data 
Abort exception. 


If an implementation reports the error in the translation table walk asynchronously from executing the instruction 
whose instruction fetch or memory access caused the translation table walk, these aborts behave essentially as 
interrupts. The aborts are masked when PSTATE.A is set to 1, otherwise they are reported using the Data Abort 
exception. 


Behavior of External aborts on a translation table walk caused by address translation 
instructions 


The address translation instructions summarized in Address translation system instructions on page K14-7861 
require translation table walks. An External abort can occur in the translation table walk. The abort generates a Data 
Abort exception, and can be synchronous or asynchronous. For more information, see Handling of faults and aborts 
during an address translation instruction on page G5-5845. 


G5.11.6 AArch32 state prioritization of synchronous aborts from a single stage of address translation 


ARM DDI 0487E.a 
ID070919 


Exception prioritization for exceptions taken to AArch32 state on page G1-5504 describes the prioritization of 
exceptions taken from an Exception level that is using AArch32. This section gives additional information about 
the prioritization of MMU faults from VMSAv8-32 translation regimes. 


Ifa single instruction generates aborts on more than one memory access, the architecture does not define any 
prioritization between those aborts. 


In general, the Arm architecture does not define when asynchronous events are taken, and therefore the 
prioritization of asynchronous events is IMPLEMENTATION DEFINED. 


Note 


The priority numbering in this list only shows the relative priorities of aborts from a single stage of address 
translation in a VMSAv8-32 translation regime. This numbering has no global significance and, for example, does 
not correlate with the equivalent AArch64 list in AArch64 state prioritization of synchronous aborts from a single 
stage of address translation on page D5-2629. 








For a single stage of translation ina VMSAv8-32 translation regime, the following numbered list shows the priority 
of the possible memory management faults on a memory access. In this list: 


s For memory accesses that undergo two stages of translation, the italic entries show where the faults from the 
stage 2 translation can occur. A stage 2 fault within a stage 1 translation table walk follows the same 
prioritization of faults. 


: For synchronous External aborts from translation table walks see also Synchronous External abort errors 
from address translation caching structures on page G5-5821. 


The priority order, from highest priority to lowest priority, is: 
l. Alignment fault not caused by memory type. This is possible for a stage 1 translation only. 


2; Translation fault due to the input address being out of the address range to be translated or requiring an 
AArch32 TTBR that is disabled. This includes VTCR.SLO being inconsistent with VTCR.TOSZ or 
programmed to a reserved value. 


3. Address size fault on an AArch32 TTBR caused by the PA being out of the range implemented. 


4. Second stage abort ona level 1 lookup of a a stage 1 table walk. When stage 2 address translation is enabled 
this includes an Address size fault caused by the PA being out of the range implemented. This is second stage 
abort during a first stage translation table walk. 
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G5-5820 


20. 


21; 


Synchronous parity or ECC error on a level 1 lookup of a translation table walk. 
Synchronous External abort on a level 1 lookup level of a translation table walk. 
Translation fault on a level 1 translation table entry. 


Address size fault on a level 1 lookup translation table entry caused by the output address being out of the 
range implemented. 


Second stage abort on a level 2 lookup ofa a stage 1 table walk. When stage 2 address translation is enabled 
this includes an Address size fault caused by the PA being out of the range implemented. This is second stage 
abort during a first stage translation table walk. 


Synchronous parity or ECC error on a level 2 lookup of a translation table walk. 
Synchronous External abort on a level 2 lookup level of a translation table walk. 
Translation fault on a level 2 translation table entry. 


Address size fault on a level 2 lookup translation table entry caused by the output address being out of the 
range implemented. 


Second stage abort on a level 3 lookup ofa a stage 1 table walk. When stage 2 address translation is enabled 
this includes an Address size fault caused by the PA being out of the range implemented. This is second stage 
abort during a first stage translation table walk. 


Synchronous parity or ECC error on a level 3 lookup of a translation table walk. 
Synchronous External abort on a level 3 lookup level of a translation table walk. 
Translation fault on a level 3 translation table entry. 


Address size fault on a level 3 lookup translation table entry caused by the output address being out of the 
range implemented. 


Access Flag fault. 
Alignment fault caused by the memory type. 
Domain fault. 


Note 


Domain faults are possible only when using the VMSAv8-32 Short-descriptor translation table format, see 
Domain fault, Short-descriptor format translation tables only on page GS-58 13. 





Permission fault. 


A fault from the stage 2 translation of the memory access. When stage 2 address translation is enabled this 
includes an Address size fault caused by the PA being out of the range implemented. 


Synchronous parity or ECC error on the memory access. 


Synchronous External abort on the memory access. 





Note 


The prioritization of TLB Conflict aborts is IMPLEMENTATION DEFINED, as the exact cause of these aborts 
depends on the form of TLBs implemented. However, the TLB conflict abort must have higher priority than 
any abort that depends on a value held in the TLB. 


The prioritization of IMPLEMENTATION DEFINED MMU faults for a Load-Exclusive or Store-Exclusive to an 
unsupported memory type is IMPLEMENTATION DEFINED. 





See also The MMU fault-checking sequence on page GS-58 14. 
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Synchronous External abort errors from address translation caching structures 


A caching structure used for caching translation table walks might support: 
° An arbitrary number of levels of translation table lookup. 
° One or more stages of translation, that might not correspond to the stages of an address translation lookup. 


This might mean that, on a synchronous External abort arising from the caching structure, such as from a parity or 
ECC error, the PE cannot precisely determine one or both of the translation stage and level of lookup at which the 
error occurred. In this case: 


° If the PE cannot determine precisely the translation stage at which the error occurred, it is reported and 
prioritized as a stage 1 error. 


° If the PE cannot determine precisely the lookup level at which the error occurred, the level is reported and 
prioritized as either: 
— The lowest-numbered level that could have given rise to the error. 
— Level 1 if it the PE cannot determine any information about the level. 
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G5.12 Exception reporting in a VMSAv8-32 implementation 


This section describes exception reporting, in AArch32 state, ina VMSAv8-32 implementation. That is, it describes 
only the reporting of exceptions that are taken to an Exception level that is using AArch32. EL2 provides an 
enhanced reporting mechanism for exceptions taken to the Non-secure EL2 mode, Hyp mode. This means that, for 
VMSAv8-32, the exception reporting depends on the mode to which the exception is taken. 





Note 


The enhanced reporting mechanism for exceptions that are taken to Hyp mode is generally similar to the reporting 
of exceptions that are taken to an Exception level that is using AArch64. 


About exception reporting introduces the general approach to exception reporting, and the following sections then 
describe exception reporting at different privilege levels: 


° Reporting exceptions taken to PLI modes on page G5-5823. 

. Fault reporting in PL1 modes on page G5-5826. 

G Summary of register updates on faults taken to PLI modes on page G5-5831. 
° Reporting exceptions taken to Hyp mode on page G5-5832. 

è Use of the HSR on page G5-5836. 





7 Summary of register updates on exceptions taken to Hyp mode on page G5-5839. 

Note 
The registers used for exception reporting also report information about debug exceptions. For more information 
see: 


. Data Abort exceptions, taken to a PLI mode on page G5-5824. 
` Prefetch Abort exceptions, taken to a PLI mode on page G5-5826. 
: Reporting exceptions taken to Hyp mode on page G5-5832. 





G5.12.1 About exception reporting 


In an implementation that includes EL2 and EL3, exceptions can be taken to: 
° Monitor mode, if EL3 is using AArch32. 

è Hyp mode, if EL2 is using AArch32. 

$ A Secure or Non-secure PL1 mode. 


Monitor mode is a PL1 mode, but: 
: It is accessible only when EL3 is using AArch32. 
s It is present only in Secure state. 


s When EL3 is using AArch32, System register controls route some exceptions from Non-secure state to 
Monitor mode. These are the only cases where taking an exception to an Exception level that is using 
AArch32 changes the Security state of the PE. 


Exception reporting in Hyp mode differs significantly from that in the other modes, but in general, exception 
reporting returns: 
s Information about the exception: 


— On taking an exception to Hyp mode, the Hyp Syndrome Register, HSR, returns syndrome 
information. 


— On taking an exception to any other mode, a Fault Status Register (FSR) returns status information. 


. For synchronous exceptions, one or more addresses associated with the exceptions, returned in Fault Address 
Registers (FARs). For a permitted exception to this requirement see Fault address reporting on synchronous 
External aborts on page G5-5823. 


In all modes, additional IMPLEMENTATION DEFINED registers can provide additional information about exceptions. 


G5-5822 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch32 Virtual Memory System Architecture 
G5.12 Exception reporting in a VMSAv8-32 implementation 


Note 


° PE mode for taking exceptions on page G1-5511 describes how the mode to which an exception is taken is 
determined. 





° EL2 provides: 


— Specific exception types, that can only be taken from Non-secure PL1 and ELO modes, and are always 
taken to Hyp mode. 


— Routing controls that can route some exceptions from Non-secure PL1 and ELO modes to Hyp mode. 


These exceptions are reported using the same mechanism as the Hyp mode reporting of VMSAv8-32 memory 
aborts, as described in this section. 





Memory system faults generate either a Data Abort exception or a Prefetch Abort exception, as summarized in: 
s Reporting exceptions taken to PL1 modes. 
. Memory fault reporting in Hyp mode on page G5-5834. 


On an access that might have multiple aborts, the MMU fault checking sequence and the prioritization of aborts 
determine which abort occurs. For more information, see The MMU fault-checking sequence on page G5-5814 and 
AArch32 state prioritization of synchronous aborts from a single stage of address translation on page G5-5819. 


Fault address reporting on synchronous External aborts 


The general architectural requirement is that, on a synchronous abort, the faulting address is recorded in a Fault 
Address Register (FAR). This requirement is relaxed for the case of a synchronous External abort that is not a 
synchronous External abort on a translation table walk. In this case only: 


è It is IMPLEMENTATION DEFINED whether the faulting address is recorded in a FAR. 
° A bit in a fault reporting register, the FnV bit, indicates whether a valid address is recorded. 


For exceptions taken to an Exception level that is using AArch32, the details of this reporting depend on whether 
the exception is taken to: 


° A PL1 mode, as described in Reporting exceptions taken to PLI modes. 
s Hyp mode, as described in Reporting exceptions taken to Hyp mode on page G5-5832. 


G5.12.2 Reporting exceptions taken to PL1 modes 
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The following sections give general information about the reporting of exceptions when they are taken to a Secure 
or Non-secure PL1 mode: 


. Registers used for reporting exceptions taken to PL1 modes. 
è Data Abort exceptions, taken to a PLI mode on page G5-5824. 
. Prefetch Abort exceptions, taken to a PL1 mode on page G5-5826. 


Fault reporting in PLI modes on page G5-5826 then describes the fault reporting in these modes, including the 
encodings used for reporting the faults. 


Note 


Security state, Exception levels, and AArch32 execution privilege on page G1-5480 describes how the Secure and 
Non-secure PL1 modes map onto the Exception levels. 








Registers used for reporting exceptions taken to PL1 modes 


AArch32 state defines the following registers, and register encodings, for exceptions taken to PL1 modes: 
: The DFSR holds information about a Data Abort exception. 

° The DFAR holds the faulting address for some synchronous Data Abort exceptions. 

° The IFSR holds information about a Prefetch Abort exception. 

. The IFAR holds the faulting address for some synchronous Prefetch Abort exceptions. 
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In addition, if implemented, the optional ADFSR and AIFSR can provide additional fault information, see Auxiliary 
Fault Status Registers. 


Auxiliary Fault Status Registers 


AArch32 state defines the following Auxiliary Fault Status Registers: 
. The Auxiliary Data Fault Status Register, ADFSR. 
$ The Auxiliary Instruction Fault Status Register, AIFSR. 


The position of these registers is architecturally-defined, but the content and use of the registers is IMPLEMENTATION 
DEFINED. An implementation can use these registers to return additional fault status information. An example use 
of these registers is to return more information for diagnosing parity or ECC errors. 


An implementation that does not need to report additional fault information must implement these registers as RESO. 
This ensures that an attempt to access these registers from software executing at PL1 does not cause an Undefined 
Instruction exception. 


Data Abort exceptions, taken to a PL1 mode 
On taking a Data Abort exception to a PL1 mode: 


s If the exception is on an instruction cache or branch predictor maintenance operation by VA, its reporting 
depends on the value of TTBCR.EAE. For more information about the registers used when reporting the 
exception, see Data Abort on an instruction cache or branch predictor maintenance instruction by VA on 
page G5-5825. 


7 Otherwise, the DFSR is updated with details of the fault, including the appropriate Fault status code. If the 
Data Abort exception is synchronous, DFSR.WnR is updated to indicate whether the faulted instruction was 
a read or a write. However, if the fault is on a cache maintenance instruction, or on an address translation 
instruction, WnR is set to 1, to indicate a fault on a write instruction, and the CM bit is set to 1. 
If the Data Abort is external, then DFSR provides fields for additional classification of the abort, see 
Provision for classification of External aborts on page G4-5712. 


If the RAS Extension is implemented, and the exception is a virtual SError interrupt exception, the 
classification reported in DFSR is taken from VDFSR or VSESR_EL2. For more information, see the ARM” 
Reliability, Availability, and Serviceability (RAS) Specification, ARMVv8, for the ARMv8-A architecture 


profile. 

See the register description for more information about the returned fault information. See also Data Abort 
on a Watchpoint exception on page G5-5825. 

If the Data Abort exception is 


— Synchronous, the DFAR is updated with the VA that caused the exception, but see Fault address 
reporting on synchronous External aborts on page G5-5823 for a permitted exception to this 
requirement. 


— Asynchronous, the DFAR becomes UNKNOWN. 
DFSR.WnR and DFSR.CM are UNKNOWN on an asynchronous Data Abort exception. 


For all Data Abort exceptions, if the implementation includes EL3, the Security state of the PE in the mode to which 
the Data Abort exception is taken determines whether the Secure or Non-secure DFSR and DFAR are updated. 
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Data Abort on an instruction cache or branch predictor maintenance instruction by VA 


If an instruction cache invalidation by VA or branch predictor invalidation by VA operation generates a Data Abort 
exception that is taken to a PL1 mode, the DFAR is updated to hold the faulting VA. However, the reporting of the 
fault depends on the value of TTBCR.EAE: 


TTBCR.EAE == 
When the value of TTBCR.EAE is 0, it is IMPLEMENTATION DEFINED which of the following is used 
when reporting the fault: 
. The DFSR indicates an Instruction cache maintenance instruction fault, and the IFSR is valid 
and indicates the cause of the fault, a Translation fault or Access flag fault. 
° The DFSR indicates the cause of the fault, a Translation fault or Access flag fault. The IFSR 
is UNKNOWN. 
In either case: 
. DFSR.WnR is set to 1. 
. DFSR.CM is set to 1, to indicate a fault on a cache maintenance instruction. 
TTBCR.EAE == 


When the value of TTBCR.EAE is 1: 

° DFSR.CM is set to 1, to indicate a fault on a cache maintenance instruction. 

: DFSR.STATUS indicates the cause of the fault, a Translation or Access flag fault. 
° DFSR.WnR is set to 1. 

è The IFSR is UNKNOWN. 


Data Abort on a Watchpoint exception 


On taking a Data Abort exception caused by a watchpoint: 

. DFSR.FS is updated to indicate a debug exception. 

$ DFSR.{WnR, Domain} are UNKNOWN. 

7 DFAR is set to the address that generated the watchpoint 


Note 
$ LR_abt indicates the address of the instruction that triggered the watchpoint. 





. In some Armv7 AArch32 implementations, the DBGWFAR is set to the address of the instruction that 
triggered the watchpoint. In Armv8 this register is RESO. 





A watchpointed address can be any byte-aligned address. The address reported in DFAR might not be the 
watchpointed address, and: 


° For a watchpoint due to an operation other than a Data Cache maintenance instruction, can be any address 
between and including: 


— The lowest address accessed by the instruction that triggered the watchpoint. 
— The highest watchpointed address accessed by that instruction. 
If multiple watchpoints are set in this range, there is no guarantee of which watchpoint is generated. 
The address must also be within a naturally-aligned block of memory of an IMPLEMENTATION DEFINED 
power-of-two size, containing a watchpoint address accessed by that location. 

Note 


— In particular, there is no guarantee of generating the watchpoint with the lowest address in the range. 





— The IMPLEMENTATION DEFINED power-of-two size must be no larger than the block size of the 
AArch64 DC ZVA operation. 





e For a watchpoint due to a Data Cache operation, the address is the address passed to the instruction. This 
might be an address that is above the watchpointed location. 
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G5-5826 


Prefetch Abort exceptions, taken to a PL1 mode 


For a Prefetch Abort exception generated by an instruction fetch, the Prefetch Abort exception is taken 
synchronously with the instruction that the abort is reported on. This means: 


° If the PE attempts to execute the instruction a Prefetch Abort exception is generated. 


° If an instruction fetch is issued but the PE does not attempt to execute the prefetched instruction, no Prefetch 
Abort exception is generated for that instruction. For example, if the execution flow branches round a 
prefetched instruction, no Prefetch Abort exception is generated. 


In addition, Breakpoint Instruction, Breakpoint, and Vector Catch exceptions, generate a Prefetch Abort exception, 
see the following for more information: 


° Exception syndrome information and preferred return address for a BKPT instruction on page G2-5626. 
. Exception syndrome information and preferred return address for a Breakpoint exception on page G2-5651. 
. Exception syndrome information and preferred return address for a Vector Catch exception on 


page G2-5672. 





Note 


Usually, the term exception syndrome is used only for exceptions taken to Hyp mode, or to AArch64 state. The 
referenced sections use the term more generally, to include exception information reported in the IFSR. 





On taking a Prefetch Abort exception to a PL1 mode: 


è The IFSR is updated with details of the fault, including the appropriate fault code. If appropriate, the fault 
code indicates that the exception was generated by a debug exception. 
See the register description for more information about the returned fault information. 

` For a Prefetch Abort exception generated by an instruction fetch, the IFAR is updated with the VA that caused 


the exception, but see Fault address reporting on synchronous External aborts on page G5-5823 for a 
permitted exception to this requirement. 


: For a Prefetch Abort exception generated by a debug exception, the IFAR is UNKNOWN. 


If the implementation includes EL3, the security state of the PE in the mode to which it takes the Prefetch Abort 
exception determines whether the exception updates the Secure or Non-secure IFSR and IFAR. 


Fault reporting in PL1 modes 


The FSRs provide fault information, including an indication of the fault that occurred. The following subsections 
describe fault reporting in PL1 modes for each of the translation table formats: 


. PLI fault reporting with the Short-descriptor translation table format on page G5-5827. 
. PL1 fault reporting with the Long-descriptor translation table format on page G5-5829. 


Reserved encoding in the IFSR and DFSR encodings tables on page G5-5830 gives some additional information 
about the encodings for both formats. 


Summary of register updates on faults taken to PL1 modes on page G5-5831 shows which registers are updated on 
each of the reported faults. 


Reporting of External aborts taken from Non-secure state to Monitor mode describes how the fault status register 
format is determined for those aborts. For all other aborts, the current translation table format determines the format 
of the fault status registers. 


Reporting of External aborts taken from Non-secure state to Monitor mode 


When an External abort is taken from Non-secure state to Monitor mode: 
e For a Data Abort exception, the Secure DFSR and DFAR hold information about the abort. 
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$ For a Prefetch Abort exception, the Secure IFSR and IFAR hold information about the abort. 
° The abort does not affect the contents of the Non-secure copies of the fault reporting registers. 


Normally, the current translation table format determines the format of the DFSR and IFSR. However, when 
SCR.EA is set to 1, to route External aborts to Monitor mode, and an External abort is taken from Non-secure state, 
this section defines the DFSR and IFSR format. 


For an External abort taken from Non-secure state to Monitor mode, the DFSR or IFSR uses the format associated 
with the Long-descriptor translation table format, as described in PL/ fault reporting with the Long-descriptor 
translation table format on page G5-5829, if any of the following applies: 


. The value of the Secure TTBCR.EAE field is 1. 


: The External abort is synchronous and is taken from either: 

— Hyp mode. 

— A Non-secure PL1 or ELO mode, and the value of the Non-secure TTBCR.EAE field is 1. 
Otherwise: 
° For a synchronous External abort from a stage 2 translation routed to Monitor mode when the value of the 


Secure TTBCR.EAE field is 0 it is IMPLEMENTATION DEFINED whether: 


— The format associated with the Long-descriptor translation table format is used, as described in PLZ 
fault reporting with the Long-descriptor translation table format on page G5-5829. 


— The format associated with the Short-descriptor translation table format is used, as described in PL7 
fault reporting with the Short-descriptor translation table format. Arm deprecates using this format. 


When this format is used, the value of DFSR.FS[1] or IFSR.FS[1] is UNKNOWN when reporting a 
synchronous External abort, or a synchronous parity or ECC error, on the stage 2 translation. 


° In all other cases the DFSR or IFSR uses the format associated with the Short-descriptor translation table 
format, as described in PL1 fault reporting with the Short-descriptor translation table format. 


PL1 fault reporting with the Short-descriptor translation table format 


This subsection describes the fault reporting for a fault taken to a PL1 when address translation is using the 
Short-descriptor translation table format. 


On taking an exception, bit[9] of the FSR is RAZ, or set to 0, if the PE is using this FSR format. 


An FSR encodes the fault in a 5-bit FS field, that comprises FSR[10, 3:0]. Table G5-26 shows the encoding of that 
field. Summary of register updates on faults taken to PLI modes on page G5-5831 shows: 


7 Whether the corresponding FAR is updated on the fault. That is: 
— Fora fault reported in the IFSR, whether the IFAR holds a valid address. 
— Fora fault reported in the DFSR, whether the DFAR holds a valid address. 
$ For faults that update DFSR, whether DFSR.Domain is valid 


When reading Table G5-26: 
° FS values not shown in the table are reserved. 
° FS values shown as DFSR only are reserved for the IFSR. 


Table G5-26 FSR encodings when using the Short-description translation table format 














FS Source Notes 

00001 Alignment fault DFSR only. Fault on initial lookup 
00100 Fault on instruction cache maintenance DFSR only 

01100 Synchronous External abort on translation table walk: > Level 1 

01110 Level 2 
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Table G5-26 FSR encodings when using the Short-description translation table format (continued) 


















































FS Source Notes 

11100 Synchronous parity or ECC error on translation table walk?» Level 1 

11110 Level 2 

00101 Translation fault Level1 MMU fault 

00111 Level 2 

00011° Access flag fault Level 1 MMU fault 

00110 Level 2 

01001 Domain fault@ Level 1 MMU fault 

01011 Level 2 

01101 Permission fault? Level 1 MMU fault 

01111 Level 2 

00010 Debug exception See Chapter G2 AArch32 Self-hosted Debug 
01000 Synchronous External abort - 

10000 TLB conflict abort See TLB conflict aborts on page G5-5791 
10100 IMPLEMENTATION DEFINED Lockdown 

10101 IMPLEMENTATION DEFINED Unsupported Exclusive access 

11001 Synchronous parity or ECC error on memory access = 

10110 SError interrupt4 DFSR only 

11000 SError interrupt* from a parity or ECC error on memory access DFSR only 





a. 


See The level associated with MMU faults on a Short-descriptor translation table lookup. 


b. FS[1] is UNKNOWN if the reported error is from a stage 2 translation. 


G5-5828 


Previously, this encoding was a deprecated encoding for Alignment fault. The extensive changes in the memory model in VMSAv8-32 
mean there should be no possibility of confusing the new use of this encoding with its previous use 


Including asynchronous External abort on a data access, a translation table walk, or an instruction fetch. 


The level associated with MMU faults on a Short-descriptor translation table lookup 


The lookup level associated with a fault is: 


7 For a fault generated on a translation table walk, the lookup level of the walk being performed. 


s For a Translation fault, the lookup level of the translation table that gave the fault. If a fault occurs because 
a stage of address translation is disabled, or because the input address is outside the range specified by the 
appropriate base address register or registers, the fault is reported as a level 1 fault. 


° For an Access flag fault, Permission fault, or Domain fault, the lookup level of the final level of translation 
table accessed for the translation. That is, the lookup level of the translation table that returned a 


Supersection, Section, or Page descriptor. 


Also see Synchronous External abort errors from address translation caching structures on page G5-5821. 


The Domain field in the DFSR 


The DFSR includes a Domain field. This is inherited from previous versions of the VMSA. The IFSR does not 
include a Domain field. Summary of register updates on faults taken to PLI modes on page G5-5831 describes when 


DFSR.Domain is valid. 
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Arm deprecates any use of the Domain field in the DFSR. The Long-descriptor translation table format does not 
support a Domain field, and future versions of the Arm architecture might not support a Domain field in the 
Short-descriptor translation table format. Arm strongly recommends that new software does not use this field. 


For both Data Abort exceptions and Prefetch Abort exceptions, software can find the domain information by 
performing a translation table read for the faulting address and extracting the Domain field from the translation table 
entry. 


PL1 fault reporting with the Long-descriptor translation table format 


This subsection describes the fault reporting for a fault taken to a PLlmode when address translation is using the 
Long-descriptor translation table format. 


When the PE takes an exception, bit[9] of the FSR is set to 1 if the PE is using this FSR format. 


The FSRs encode the fault in a 6-bit STATUS field, that comprises FSR[5:0]. Table G5-27 shows the encoding of 
that field. In addition: 


è For a fault taken to a PL1 mode, Summary of register updates on faults taken to PLI modes on page G5-5831 
shows whether the corresponding FAR is updated on the fault. That is: 


— Fora fault reported in the IFSR, whether the IFAR holds a valid address. 
— Fora fault reported in the DFSR, whether the DFAR holds a valid address. 


° For a fault taken to the Hyp mode, Summary of register updates on exceptions taken to Hyp mode on 
page G5-5839 shows what registers are updated on the fault. 


Table G5-27 FSR encodings when using the Long-descriptor translation table format 












































STATUS@ Source Notes 
OO0OLL Address size fault. LL bits indicate level?. MMU fault 
0001LL Translation fault. LL bits indicate level>. MMU fault 
0010LL Access flag fault. LL bits indicate level. MMU fault 
0011LL Permission fault. LL bits indicate level’. MMU fault 
010000 Synchronous External abort. - 
011000 Synchronous parity or ECC error on memory access. - 
010001 SError interrupt. DFSR only 
011001 SError interrupt® from a parity or ECC error on memory access. DFSR only 
0101LL Synchronous External abort on translation table walk. - 
LL bits indicate level>. 
OILILL Synchronous parity or ECC error on memory access on translation - 
table walk. 
LL bits indicate levelb. 
100001 Alignment fault. Fault on initial lookup 
100010 Debug exception. See Chapter G2 AArch32 Self-hosted Debug 
110000 TLB conflict abort. See TLB conflict aborts on page G5-5791 
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Table G5-27 FSR encodings when using the Long-descriptor translation table format (continued) 





STATUS2 Source 


Notes 











110100 IMPLEMENTATION DEFINED. Lockdown, DFSR only 
110101 IMPLEMENTATION DEFINED. Unsupported Exclusive access 
1111LL Domain fault. MMU fault. 64-bit PAR only, level 1 or level 


LL bits indicate level’. 


2 only. Never used in DFSR, IFSR, or HSR4 





a. STATUS values not shown in this table are reserved. STATUS values not supported in the IFSR or DFSR are reserved for the register or 


registers in which they are not supported. 


b. See The level associated with MMU faults on a Long-descriptor translation table lookup. 


c. Including asynchronous External abort on a data access, a translation table walk, or an instruction fetch. 


d. A Domain fault can be reported using the Long-descriptor STATUS encodings only as a result of a fault on an address translation instruction. 
For more information see MMU fault on an address translation instruction on page G5-5845. 


The level associated with MMU faults on a Long-descriptor translation table lookup 


For MMU faults, Table G5-28 shows how the LL bits in the xFSR.STATUS field encode the lookup level associated 


with the fault. 


Table G5-28 Use of LL bits to encode the lookup level at which the fault occurred 














LL bits Meaning 
00 Address size fault Address size fault in TTBRO or TTBR1. 
All other faults Reserved. 
01 Level 1. 
10 Level 2. 
11 Level 3. When xFSR.STATUS indicates a Domain fault, this value is reserved. 





The lookup level associated with a fault is: 


s For a fault generated on a translation table walk, the lookup level of the walk being performed. 


s For a Translation fault, the lookup level of the translation table that gave the fault. If a fault occurs because 
a stage of address translation is disabled, or because the input address is outside the range specified by the 
appropriate base address register or registers, the fault is reported as a level 1 fault. 


: For an Access flag fault, the lookup level of the translation table that gave the fault. 


° For a Permission fault, including a Permission fault caused by hierarchical permissions, the lookup level of 
the final level of translation table accessed for the translation. That is, the lookup level of the translation table 
that returned a Block or Page descriptor. 


Also see Synchronous External abort errors from address translation caching structures on page G5-5821. 


Reserved encoding in the IFSR and DFSR encodings tables 


With both the Short-descriptor and the Long-descriptor FSR format, the fault encodings reserve a single encoding 
for Cache and TLB lockdown faults. The details of these faults and any associated subsidiary registers are 


IMPLEMENTATION DEFINED. 
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G5.12.4 Summary of register updates on faults taken to PL1 modes 


For faults that generate exceptions that are taken to a PL1 mode, Table G5-29 shows the registers affected by each 
fault. In this table: 


$ Yes indicates that the register is updated. 
7 UNK indicates that the fault makes the register value UNKNOWN. 
. A null entry, -, indicates that the fault does not affect the register. 


For faults that update the DFSR using the Short-descriptor format FSR encodings, Table G5-30 on page G5-5832 
shows whether DFSR.Domain is valid. 


Table G5-29 Effect of a fault taken to a PL1 mode on the reporting registers 





Fault IFSR IFAR DFSR DFAR 





Faults reported as Prefetch Abort exceptions: 




















MMU fault, always synchronous Yes Yes - - 
Synchronous External abort on translation table walk Yes Yes - - 
Synchronous parity or ECC error on translation table walk Yes Yes - - 
Synchronous External abort Yes IMP DEF? - - 
Synchronous parity or ECC error on memory access Yes Yes - - 
TLB conflict abort Yes Yes - - 





Fault reported as Data Abort exception: 











Alignment fault, always synchronous - - Yes Yes 
MMU fault, always synchronous - - Yes Yes 
Fault on instruction cache maintenance, when using Long-descriptor UNK - Yes Yes 


translation table format? 






































Fault on instruction cache maintenance, when using either Yes - Yes Yes 
Short descriptor translation table format°® 

or UNK - Yes Yes 
Synchronous External abort on translation table walk - - Yes Yes 
Synchronous parity or ECC error on translation table walk - - Yes Yes 
Synchronous External abort - - Yes IMP DEF? 
Synchronous parity or ECC error on memory access - - Yes Yes 
SError interrupt - - Yes UNK 
SError interrupt from a parity or ECC error on memory access - - Yes UNK 
TLB conflict abort - - Yes Yes 

Debug exceptions: 

Breakpoint, Breakpoint Instruction, or Vector Catch4 Yes UNK - - 
Watchpoint¢ z = Yes Yes 





a. IMPLEMENTATION DEFINED. The IFSR.FnV or DFSR.FnV bit indicates whether the register holds a valid address. See Fault 
address reporting on synchronous External aborts on page G5-5823. 
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b. When using the Long-descriptor translation table format, there is not a specific fault code for a fault on an instruction cache 
maintenance instruction. For more information see Data Abort on an instruction cache or branch predictor maintenance 
instruction by VA on page G5-5825. 


c. The two lines of this entry show the alternative ways of reporting the fault when using the Short-descriptor translation table 
format. It is IMPLEMENTATION DEFINED which methods is used, see Data Abort on an instruction cache or branch predictor 
maintenance instruction by VA on page G5-5825. 


d. Generates a Prefetch Abort exception. 


e. Generates a Data Abort exception. 


For those faults for which Table G5-29 on page G5-5831 shows that the DFSR is updated, if the fault is reported 
using the Short-descriptor FSR encodings, Table G5-30 shows whether DFSR.Domain is valid. In this table, UNK 
indicates that the fault makes DFSR.Domain UNKNOWN. 


Table G5-30 Validity of Domain field on faults that update the DFSR when using the Short-descriptor encodings 


G5.12.5 


G5-5832 
























































DFSR.FS Source DFSR.Domain Notes 
00001 Alignment fault UNK - 

00100 Fault on instruction cache maintenance instruction UNK - 

01100 Synchronous External abort on translation table walk Level l UNK 

01110 Level2 Valid g 

11100 Synchronous parity or ECC error on translation table walk Levell UNK 

11110 Level2 Valid 

00101 Translation fault Level 1 UNK MMU fault 
00111 Level2 Valid 

000114 Access flag fault Level 1 UNK MMU fault 
00110 Level2 Valid 

01001 Domain fault Level 1 Valid MMU fault 
01011 Level2 Valid 

01101 Permission fault Level l UNK MMU fault 
01111 Level2 UNK 

01000 Synchronous External abort UNK - 

10000 TLB conflict abort UNK - 

11001 Synchronous parity or ECC error on memory access UNK - 

10110 SError interrupt? UNK = 

11000 SError interrupt? from a parity or ECC error on memory access UNK z 

00010 Watchpoint UNK 





a. Previously, this encoding was a deprecated encoding for Alignment fault. The extensive changes in the memory model in 
VMSAv8-32 mean there should be no possibility of confusing the new use of this encoding with its previous use 


b. Including asynchronous External abort on a data access, a translation table walk, or an instruction fetch. 


Reporting exceptions taken to Hyp mode 


Hyp mode is the Non-secure EL2 mode. It is entered by taking an exception to Hyp mode. 
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Note 


Software executing in Monitor mode, or at EL3 when EL3 is using AArch64, can perform an exception return to 
Hyp mode. This means Hyp mode can be entered either by taking an exception, or by a permitted exception return. 





When EL2 is using AArch32, the following exceptions are taken to Hyp mode: 


. SError interrupt exceptions, IRQ exceptions, and FIQ exceptions, from Non-secure PL1 and ELO modes, if 
not routed to Secure Monitor mode, and if configured by the AMO, FMO or IMO bits. For more information 
see Asynchronous exception routing controls on page G1-5530. 


° When HCR.TGE is set to 1, all exceptions that would be routed to Non-secure PL1 modes. 


For more information, see Routing exceptions from Non-secure ELO to EL2 on page G1-5516. 


° When HDCR.TDE is set to 1, any debug exception that would otherwise be taken to a Non-secure PL1 mode, 
see Routing debug exceptions to EL2 using AArch32 on page G1-5518. 


è The privilege rules for taking exceptions mean that any exception taken from Hyp mode, if not routed to EL3, 
must be taken to Hyp mode. 


. An abort that Routing of aborts taken to AArch32 state on page G1-5520 identifies as taken to Hyp mode. 


a Hypervisor Call exceptions, and Hyp Trap exceptions, are always taken to Hyp mode. These exceptions are 
supported only as part of EL2. 


When EL2 is implemented, various operations from Non-secure PL1 and ELO modes can be trapped to Hyp 
mode, using the Hyp Trap exception. For more information, see EL2 configurable controls on page G1-5585. 


Synchronous exceptions taken to Hyp mode provide syndrome information in the HSR. 


On an abort exception taken to Hyp mode, the syndrome information in the HSR includes the Fault status code 
otherwise provided by the fault status register, and extends the fault reporting compared to that available for an 
exception taken to a PL1 mode. 


In addition, for a Debug exception taken to Hyp mode, DBGDSCRint.MOE or DBGDSCRext.MOE shows what 
caused the Debug exception. This field is valid regardless of whether the Debug exception was taken from Hyp 
mode or from another Non-secure mode. 


For more information, see the following subsections: 

. Registers used for reporting exceptions taken to Hyp mode. 
. Memory fault reporting in Hyp mode on page G5-5834. 

s Use of the HSR on page G5-5836 


Registers used for reporting exceptions taken to Hyp mode 


The following registers are used for reporting exceptions taken to Hyp mode: 

s The HSR holds syndrome information for the exception. 

° The HDFAR holds the VA associated with a Data Abort exception. 

° The HIFAR holds the VA associated with a Prefetch Abort exception. 

s The HPFAR holds bits[39:12] of the IPA associated with some aborts on stage 2 address translations. 


In addition, if implemented, the optional HADFSR and HAIFSR can provide additional fault information, see Hyp 
Auxiliary Fault Syndrome Registers. 


Hyp Auxiliary Fault Syndrome Registers 


EL2 also defines encodings for the following Hyp Auxiliary Fault Syndrome Registers: 
7 The Hyp Auxiliary Data Fault Syndrome Register, HADFSR. 
è The Hyp Auxiliary Instruction Fault Syndrome Register, HAIFSR. 
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An implementation can use these registers to return additional fault status information for aborts taken to Hyp mode. 
They are the Hyp mode equivalents of the registers described in Auxiliary Fault Status Registers on page G5-5824. 
An example use of these registers is to return more information for diagnosing parity or ECC errors. 


The architectural requirements for the HADFSR and HAIFSR are: 


The position of these registers is architecturally-defined, but the content and use of the registers is 
IMPLEMENTATION DEFINED. 


An implementation with no requirement for additional fault reporting can implement these registers as RESO, 
but the architecture does not require it to do so. 


Memory fault reporting in Hyp mode 


Prefetch Abort and Data Abort exceptions taken to Hyp mode report memory faults. For these aborts, the HSR 
contains the following fault status information: 


The HSR.EC field indicates the type of abort, as Table G5-31 shows. 


The HSR.ISS field holds more information about the abort. In particular: 


— _ Bits[5:0] of this field hold the STATUS field for the abort, using the encodings defined in PL/ fault 
reporting with the Long-descriptor translation table format on page G5-5829. 


— Other subfields of the ISS give more information about the exception, equivalent to the information 
returned in the FSR for a memory fault reported at PL1. 


See the descriptions of the ISS fields for the memory faults, referenced from the Syndrome description 
column of Table G5-31, for information about the returned fault information. 


Table G5-31 HSR.EC encodings for aborts taken to Hyp mode 





HSR.EC 


Abort 


Syndrome description 





0x20 


Prefetch Abort taken from Non-secure PL1 or ELO mode ZSS encoding for an exception from a Prefetch Abort on 





0x21 


page G8-6097 


Prefetch Abort taken from Hyp mode 





0x24 


Data Abort taken from Non-secure PL1 or ELO mode ISS encoding for an exception from a Data Abort on 





0x25 


page G8-6099 


Data Abort taken from Hyp mode 





G5-5834 


For more information, see Use of the HSR on page G5-5836. 


A Prefetch Abort exception is taken synchronously with the instruction that the abort is reported on. This means: 


If the PE attempts to execute the instruction a Prefetch Abort exception is generated. 


If an instruction fetch is issued but the PE does not attempt to execute the prefetched instruction, no Prefetch 
Abort exception is generated for that instruction. For example, if the execution flow branches round a 
prefetched instruction that would abort if the PE attempted to execute it, no Prefetch Abort exception is 
generated. 


Register updates on exception reporting in Hyp mode 


The use of the HSR, and of the other registers listed in Registers used for reporting exceptions taken to Hyp mode 
on page G5-5833, depends on the cause of the Abort. In reporting these faults, in general: 


Ifthe fault generates a synchronous Data Abort exception, the HDFAR holds the associated VA, but see Fault 
address reporting on synchronous External aborts on page G5-5823 for a permitted exception to this 
requirement. 


If the fault generates a Prefetch Abort exception, the HIFAR holds the associated VA, but see Fault address 
reporting on synchronous External aborts on page G5-5823 for a permitted exception to this requirement. 
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In the following cases, the HPFAR holds the faulting IPA: 
— A Translation or Access flag fault on a stage 2 translation. 


— A Translation, Access flag, or Permission fault on the stage 2 translation of an address accessed in a 
stage 1 translation table walk. 


— A stage 2 Address size fault. 


In all other cases, the HPFAR is UNKNOWN. 
$ On a Data Abort exception that is taken to Hyp mode, the HIFAR is UNKNOWN. 
: On a Prefetch Abort exception that is taken to Hyp mode, the HDFAR is UNKNOWN. 
In addition, the reporting of particular aborts is as follows: 


Abort on the stage 1 translation for a memory access from Hyp mode 


The HDFAR or HIFAR holds the VA that caused the fault. The STATUS subfield of HSR.ISS 
indicates the type of fault, Translation, Address size, Access flag, or Permission. The HPFAR is 
UNKNOWN. 


Abort on the stage 2 translation for a memory access from a Non-secure PL1 or ELO mode 


This includes aborts on the stage 2 translation of amemory access made as part of a translation table 
walk for a stage 1 translation. The HDFAR or HIFAR holds the VA that caused the fault. The 
STATUS subfield of HSR.ISS indicates the type of fault, Translation, Address size, Access flag, or 
Permission. 


For any Access flag fault or Translation fault, and also for any Permission fault on the stage 2 
translation of a memory access made as part of a translation table walk for a stage 1 translation, the 
HPFAR holds the IPA that caused the fault. Otherwise, the HPFAR is UNKNOWN. 


Abort caused by a synchronous External abort, or synchronous parity or ECC error, and taken to Hyp mode 


The HDFAR or HIFAR holds the VA that caused the fault, but see Fault address reporting on 
synchronous External aborts on page G5-5823 for a permitted exception to this requirement. The 
HPFAR is UNKNOWN. 


Data Abort caused by a Watchpoint exception and routed to Hyp mode because HDCR.TDE is set to 1 


When HDCR.TDE is set to 1, a Watchpoint exception generated in a Non-secure PL1 or ELO mode, 
that would otherwise generate a Data Abort exception, is routed to Hyp mode and generates a Hyp 
Trap exception. 


HDFAR is set to the address that generated the watchpoint. 





Note 
ELR_hyp indicates the address of the instruction that triggered the watchpoint. 





A watchpointed address can be any byte-aligned address. The address reported in HDFAR might 
not be the watchpointed address, and, for a watchpoint due to an operation other than a Data Cache 
maintenance instruction, can be any address between and including: 


° The lowest address accessed by the instruction that triggered the watchpoint. 
° The highest watchpointed address accessed by that instruction. 


If multiple watchpoints are set in this range, there is no guarantee of which watchpoint is generated. 


Note 


In particular, there is no guarantee of generating the watchpoint with the lowest address in the range. 








The address must also be within a naturally-aligned block of memory of an IMPLEMENTATION 
DEFINED power-of-two size, containing a watchpoint address accessed by that location. 
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G5-5836 


Note 


The IMPLEMENTATION DEFINED power-of-two size must be no larger than the block size of the 
AArch64 DC ZVA operation. 





See also Watchpoint exceptions on page G2-5653. 


In all cases, HPFAR is UNKNOWN. 


Prefetch Abort caused by a Breakpoint Instruction exception and taken to Hyp mode 


This abort is generated if a BKPT instruction is executed in Hyp mode. The abort leaves the HIFAR 
and HPFAR UNKNOWN. 


See also Breakpoint Instruction exceptions on page G2-5625. 
Prefetch Abort caused by a Breakpoint Instruction, Breakpoint, or Vector Catch exception, and routed to 
Hyp mode because HDCR.TDE is set to 1 


When HDCR.TDE is set to 1, a debug exception, generated in a Non-secure PL1 or ELO mode, that 
would otherwise generate a Prefetch Abort exception, is routed to Hyp mode and generates a Hyp 
Trap exception. 

The abort leaves the HIFAR and HPFAR UNKNOWN. This is identical to the reporting of a Prefetch 
Abort exception caused by a Debug exception on a BKPT instruction that is executed in Hyp mode. 





Note 
The difference between these two cases is: 


. The Debug exception on a BKPT instruction executed in Hyp mode generates a Prefetch Abort 
exception, taken to Hyp mode, and reported in the HSR using EC value 0x21. 


° Aborts generated because HDCR.TDE is set to 1 generate a Hyp Trap exception, and are 
reported in the HSR using EC value 0x20. 





Use of the HSR 


The HSR holds syndrome information for any synchronous exception taken to Hyp mode. Compared with the 
reporting of exceptions taken to PL1 modes, the HSR: 


s Always provides details of the fault. The DFSR and IFSR are not used. 


° Provides more extensive information, for a wider range of exceptions. 


Note 
IRQ and FIQ exceptions taken to Hyp mode do not report any syndrome information in the HSR. 








This section summarizes the general form of the HSR register, to show how it encodes exception syndrome 
information, see the register description for more information. The register comprises: 


° A 6-bit Exception class field, EC, that indicates the cause of the exception. 

e An instruction length bit, IL. When an exception is caused by trapping an instruction to Hyp mode, this bit 
indicates the length of the trapped instruction, as follows: 
0 16-bit instruction trapped. 
1 32-bit instruction trapped. 


In other cases the IL field is not valid and is RES1. 


e An instruction specific syndrome field, ISS. Architecturally, this field could be defined independently for 
each defined Exception class (EC), but in practice several ISS formats are common to more than one EC. 
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The format of the HSR depends on the value of the EC field, as follows: 


0b000000<EC<0b001100 


The ISS part of the returned value includes the CV and COND fields described in Encoding 
of ISS[24:20] when 0b000000 < EC s0b001100. Figure G5-17 shows the HSR format in this 
case. 


31 30 29 26 25 24 23 20 19 0 


| 


CV 








EC IL ISS 
Figure G5-17 HSR format when the ISS includes CV and COND fields 


EC==0b000000 or EC0b001110 There are no generic fields within the ISS. Figure GS-18 shows the HSR format 
in this case. 





31 26 25 24 0 
l J|! 
EC L ISS 


Figure G5-18 HSR format when the ISS does not include a COND field 


Encoding of ISS[24:20] when 0b000000<EC<0b001100 


For EC values that are nonzero and less than or equal to 0b001100, ISS[24:20] provides the Condition code field for 
the trapped instruction, together with a valid flag for this field. The encoding of this part of the ISS field is: 


CV, ISS[24] | Condition code valid. Possible values of this bit are: 
0 The COND field is not valid. 
1 The COND field is valid. 
COND, ISS[23:20] 
The Condition code for the trapped instruction. This field is valid only when CV is set to 1. 
If CV is set to 0, this field is RESO. 


The full descriptions of the HSR.ISS formats give more information about the CV field. 





Note 


In some circumstances, it is IMPLEMENTATION DEFINED whether a conditional instruction that fails its Condition 
code check generates an Undefined Instruction exception, see Conditional execution of undefined instructions on 
page G1-5538. 
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HSR exception classes 


Table GS-32 shows the encoding of the HSR exception class field, EC. Values of EC not shown in the table are 
reserved. For each EC value, the table references a subsection of the description of the HSR that describes the 
associated ISS format and gives information about the cause of the exception, for example the configuration 


required to enable the associated trap. 


Table G5-32 HSR.EC field encoding 




































































EC Exception class ISS description, or notes 
0b000000 Unknown reason ISS encoding for exceptions with an unknown reason on page G8-6086. 
0b000001 Trapped WFI or WFE instruction ISS encoding for an exception from a WFI or WFE instruction on 
page G8-6087. 
0b000011 Trapped MCR or MRC access with ISS encoding for an exception from an MCR or MRC access on 
(coproc==0b1111) page G8-6088. 
0b000100 Trapped MCRR or MRRC access with ISS encoding for an exception from an MCRR or MRRC access on 
(coproc==0b1111) page G8-6090. 
0b000101 Trapped MCR or MRC access with ISS encoding for an exception from an MCR or MRC access on 
(coproc==0b1110) page G8-6088. 
0b000110 Trapped LDC or STC access ISS encoding for an exception from an LDC or STC instruction on 
page G8-6092. 
0b000111 Advanced SIMD or floating-point functionality ZSS encoding for an exception from an access to SIMD or floating-point 
trapped by a HCPTR.{TASE, TCP10} control functionality, resulting from HCPTR on page G8-6094. 
0b001000 Trapped VMRS access, from ID group traps, that ZSS encoding for an exception from an MCR or MRC access on 
is not reported using EC @b000111 page G8-6088. 
This trap is not taken if the HCPTR settings trap the access. 
0b001100 Trapped MRRC access with (coproc==0b1110) ISS encoding for an exception from an MCRR or MRRC access on 
page G8-6090. 
0b001110 Illegal exception return to AArch32 state ISS encoding for an exception from an Illegal state or PC alignment 
fault on page G8-6098. 
0b010001 Exception on SVC execution in AArch32 state ISS encoding for an exception from HVC or SVC instruction execution 
routed to EL2 on page G8-6095. 
0b010010 HVC instruction execution in AArch32 state, 
when HVC is not disabled 
0b010011 Trapped execution of SMC instruction in ISS encoding for an exception from SMC instruction execution on 
AArch32 state page G8-6096. 
0b100000 Prefetch Abort from a lower Exception level ISS encoding for an exception from a Prefetch Abort on page G8-6097. 
0b100001 Prefetch Abort taken without a change in 
Exception level 
0b100010 PC alignment exception. ISS encoding for an exception from an Illegal state or PC alignment 
fault on page G8-6098. 
0b100100 Data Abort from a lower Exception level ISS encoding for an exception from a Data Abort on page G8-6099. 
0b100101 Data Abort taken without a change in Exception 
level 
All EC encodings not shown in Table GS-31 on page G5-5834 are reserved by Arm. 
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For memory system faults that generate exceptions that are taken to Hyp mode, Table G5-33 shows the registers 
affected by each fault. In this table: 


Yes indicates that the register is updated. 


UNK indicates that the fault makes the register value UNKNOWN. 


A null entry, -, indicates that the fault does not affect the register. 





Note 


For a list of the MMU faults see Types of MMU faults on page G5-5811. 





Table G5-33 Effect of an exception taken to Hyp mode on the reporting registers 
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Fault HSR HIFAR HDFAR HPFAR 
Faults reported as Prefetch Abort exceptions: 
MMU fault? at stage 1. Yes Yes UNK UNK 
Translation or Access flag MMU fault? at stage 2. Yes Yes UNK Yes 
Other> MMU fault? at stage 2. Yes Yes UNK UNK 
Stage 2 MMU fault? on a stage 1 translation. Yes Yes UNK Yes 
Synchronous External abort on translation table walk. Yes Yes UNK UNK 
Synchronous parity or ECC error on translation table walk. Yes Yes UNK UNK 
Synchronous External abort. Yes IMP DEF? UNK UNK 
Synchronous parity or ECC error on memory access. Yes Yes UNK UNK 
Fault reported as Data Abort exception: 
MMU fault? at stage 1. Yes UNK Yes UNK 
Translation or Access flag MMU fault? at stage 2. Yes UNK Yes Yes 
Other> MMU fault? at stage 2. Yes UNK Yes UNK 
Stage 2 MMU fault? on a stage 1 translation. Yes UNK Yes Yes 
Synchronous External abort on translation table walk. Yes UNK Yes UNK 
Synchronous parity or ECC error on translation table walk. Yes UNK Yes UNK 
Synchronous External abort. Yes UNK IMP DEF? UNK 
Synchronous parity or ECC error on memory access. Yes UNK Yes UNK 
SError interrupt Yes UNK UNK UNK 
SError interrupt from a parity or ECC error on memory access. Yes UNK UNK UNK 
Debug exception: 
Breakpoint Instruction4, generates a Prefetch Abort exception. Yes UNK = UNK 
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Table G5-33 Effect of an exception taken to Hyp mode on the reporting registers (continued) 





Fault HSR HIFAR HDFAR HPFAR 


Debug exception routed to Hyp mode because HDCR.TDE is set to 1. Generates a Hyp Trap exception. 





Breakpoint Instruction or Vector Catch Yes UNK - UNK 





Watchpoint Yes - Yes UNK 





a. For more information see Classification of MMU faults taken to Hyp mode 
b. MMU fault other than a Translation fault or an Access flag fault. 


c. IMPLEMENTATION DEFINED. The FnV bit in the HSR.ISS field indicates whether the register holds a valid address. 
See Fault address reporting on synchronous External aborts on page G5-5823. 


d. All other debug exceptions are not permitted in Hyp mode. 


Note 


Unlike Table G5-29 on page G5-5831, the Hyp mode fault reporting table does not include an entry for a fault on 
an instruction cache maintenance instruction. That is because, when the fault is taken to Hyp mode, the reporting 

indicates the cause of the fault, for example a Translation fault, and ISS.CM is set to 1 to indicate that the fault was 
on a cache maintenance instruction, see JSS encoding for an exception from a Data Abort on page G8-6099. 








Classification of MMU faults taken to Hyp mode 


This subsection gives more information about the MMU faults shown in Table G5-33 on page G5-5839. 





Note 
All MMU faults are synchronous. 





The table uses the following descriptions for MMU faults taken to Hyp mode: 


MMU fault at stage 1 


This is an MMU fault generated on a stage 1 translation performed in the Non-secure EL2 
translation regime. 


MMU fault at stage 2 


This is an MMU fault generated on a stage 2 translation performed in the Non-secure PL1&0 
translation regime. 


As the table shows, for the faults in this group: 
: Translation and Access flag faults update the HPFAR 
` Permission faults leave the HPFAR UNKNOWN. 


MMU stage 2 fault on a stage 1 translation 


This is an MMU fault generated on the stage 2 translation of an address accessed in a stage 1 
translation table walk performed in the Non-secure PL1&0 translation regime. For more 
information about these faults see Stage 2 fault on a stage 1 translation table walk on page G5-5817. 


Figure G5-1 on page G5-5722 shows the different translation regimes and associated stages of translation. 


G5-5840 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


The AArch32 Virtual Memory System Architecture 
G5.13 Address translation instructions 


G5.13 Address translation instructions 


The System register encoding space includes encodings for instructions that either: 
s Translate a virtual address (VA) to a physical address (PA). 
s Translate a virtual address (VA) to an intermediate physical address (IPA). 


Address translation system instructions on page K14-7861 summarizes these instructions. 


When using the Short-descriptor translation table format, all translations performed by these instructions take 
account of TEX remap when this is enabled, see Short-descriptor format memory region attributes, with TEX remap 
on page G5-5780. 


An address translation instruction that executes successfully returns the output address, a PA or an IPA, in the PAR. 
This is a 64-bit register, that can hold addresses of up to 40 bits. 


It is IMPLEMENTATION DEFINED whether the address translation instructions return the values held in a TLB or the 
result of a translation table walk. Therefore, Arm recommends that these instructions are not used at a time when 
the TLB entries might be different from the underlying translation tables held in memory. 


The following sections give more information about these instructions: 


. Address translation instruction naming and operation summary. 

. Encoding and availability of the address translation instructions on page G5-5843. 

. Determining the PAR format on page G5-5845. 

. Handling of faults and aborts during an address translation instruction on page G5-5845. 


G5.13.1 Address translation instruction naming and operation summary 


Some older documentation uses the original names for the address translation instructions that were included in the 
original Armv7 documentation. Table GS-34 summarizes the instructions that are available in AArch32 state, and 
relates the old instruction names to the current names. 


Table G5-34 Naming of address translation instructions 








Name Old name Description 

ATSICPR, ATSICPW, V2PCWPR, V2PCWPW, See ATSIC**, Address translation stage 1, current security state on 
ATSICUR, ATSICUW V2PCWUR, V2PCWUW page G5-5842 

ATSICPRP, ATS1CPWP Not applicable 





ATS12NSOPR, ATSI2NSOPW, V2POWPR, V2POWPW, See ATSI2NSO**, Address translation stages 1 and 2, Non-secure 
ATS12NSOUR, ATSIZ2NSOUW  V2POWUR, V2POWUW state only on page G5-5842 





ATSIHR, ATS1HW 


Not applicable> See ATS1H*, Address translation stage 1, Hyp mode on 
page G5-5843 





a. Instructions are added by ARMv8.2-ATS1E1 and do not have a previous name. 


b. Instructions are part of EL2 and have no equivalent in the older descriptions. 
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In an implementation that does not include EL2, there is no distinction between stage 1 translations and stage 1 and 
2 combined translations. 


For the stage 1 current state and stages 1 and 2 Non-secure state only instructions, the meanings of the final letters 
of the names are: 


PR PL1 mode, read operation. 
PRP PL1 mode, read operation, taking account of PSTATE.PAN. 
PW PL1 mode, write operation. 
PWP PL1 mode, write operation, taking account of PSTATE.PAN. 
UR User mode, read operation. 
UW User mode, write operation. 
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G5-5842 


Note 


User mode can be described as the unprivileged mode. It is the only ELO mode. 








For the stage 1 Hyp mode instructions, the last letter of the instruction name is R for the read operation and W for 
the write operation. 


See also Encoding and availability of the address translation instructions on page G5-5843. 


ATS1C**, Address translation stage 1, current security state 


Any VMSAv8-32 implementation supports the ATS1C** instructions. They can be executed by any software 
executing at PL1 or higher, in either Security state. 


The ATS1C** instructions are ATSICPR, ATSICPW, ATSICUR, and ATS1CUW and, when ARMv8.2-ATSIE1 
is implemented, ATS1CPRP and ATS1CPWP. These instructions perform the address translations of the PL1&0 
translation regime. 


In an implementation that includes EL2, when executed in Non-secure state, these instructions return the IPA that 
is the output address of the stage 1 translation. Figure G5-1 on page G5-5722 shows the different translation 
regimes. 


Note 


The Non-secure PL1 and ELO modes have no visibility of the stage 2 address translations, that can be defined only 
at EL2, and translate IPAs to be PAs. 








See Determining the PAR format on page G5-5845 for the format used when returning the result of these 
instructions. 


ATS12NSO**, Address translation stages 1 and 2, Non-secure state only 


A VMSAv8-32 implementation supports the ATS12NSO** instructions only if it includes EL2. In an 
implementation that includes EL2, in AArch32 state, they can be executed: 


è By software executing in Non-secure state at EL2. This means by software executing in Hyp mode. 
à If the implementation includes EL3, when EL3 is using AArch32, by software executing in Secure state at 
PLI. 


The ATS12NSO** instructions are ATS12NSOPR, ATS12NSOPW, ATS12NSOUR, and ATS12NSOUW. 


In an implementation that includes EL3, when EL3 is using AArch64 and EL1 is using AArch32, any execution of 
an ATS12NSO** instruction at Secure EL1 is trapped as an exception that is taken to EL3. 


In an implementation that does not include EL2, but includes EL3, when EL3 is using AArch32 these instructions 
are not UNDEFINED but each instruction behaves in the same way as the equivalent ATS1C** instruction. 


If an implementation does not include EL2 and does not include EL3 then these instructions are CONSTRAINED 
UNPREDICTABLE, with the permitted behavior that the instructions are UNDEFINED, see Unallocated System register 
access instructions on page K1-7609. 


Arm deprecates use of these instructions from any Secure PL1 mode other than Monitor mode. 


In Secure state and in Non-secure Hyp mode these instructions perform the translations made by the Non-secure 
PL1&0 translation regime. 


These instructions always return the PA and final attributes generated by the translation. That is, for an 
implementation that includes EL2, they return: 


e The result of the two stages of address translation for the specified Non-secure input address. 
G The memory attributes obtained by the combination of the stage 1 and stage 2 attributes. 
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Note 


From Hyp mode, the ATS1C** and ATS12NSO** instructions both return the results of address translations that 
would be performed in the Non-secure modes other than Hyp mode. The difference is: 





° The ATS1C** instructions return the Non-secure PL1 view of the associated address translation. That is, they 
return the IPA output address corresponding to the VA input address. 


$ The ATS12NSO** instructions return the EL2, or Hyp mode, view of the associated address translation. That 
is, they return the PA output address corresponding to the VA input address, generated by two stages of 
translation. 





See Determining the PAR format on page G5-5845 for the format used when returning the result of these 
instructions. 


ATS1H*, Address translation stage 1, Hyp mode 


A VMSAv8-32 implementation supports the ATS1H* instructions only if it includes EL2. They can be executed by: 
$ Software executing in Non-secure state at EL2. This means by software executing in Hyp mode. 
. Software executing in Secure state in Monitor mode. 


The ATS1H* instructions are ATS1HR and ATS1HW. In an implementation that includes EL3, these instructions 
are CONSTRAINED UNPREDICTABLE if executed in a Secure PL1 mode other than Monitor mode, see Hyp mode VA 
to PA address translation instructions on page K1-7627. 


If an implementation does not include EL2 then these instructions are CONSTRAINED UNPREDICTABLE, with the 
permitted behavior that the instructions are UNDEFINED, see Unallocated System register access instructions on 
page K1-7609. 


These instructions perform the translations made by the Non-secure EL2 translation regime. The instruction takes 
a VA input address and returns a PA output address. 


These instructions always return a result in a 64-bit format PAR. 


G5.13.2 Encoding and availability of the address translation instructions 


Software executing at ELO never has any visibility of the address translation instructions, but software executing at 
PL1 or higher can use the unprivileged address translation instructions to find the address translations used for 
memory accesses by software executing at PL1 and ELO. 


Note 


For information about translations when the stage of address translation is disabled see The effects of disabling 
address translation stages on VMSAv8-32 behavior on page G5-5728. 








Table GS-35 shows the encodings for the address translation instructions, and their availability in different 
implementations in different PE modes and states. 


Table G5-35 Address translation instructions in AArch32 state 





opc1 CRm opc2 Name Type Description 





All VMSAv8-32 implementations, in all modes, at PL1 or higher, see ATS/C**, Address translation stage 1, current 
security state on page G5-5842 
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Table G5-35 Address translation instructions in AArch32 state (continued) 




















opc1 CRm opc2 Name Type Description 
0 c8 0 ATSICPR WO PL1 stage 1 read translation, current state 
1 ATS1CPW WO PL1 stage 1 write translation, current state 
2 ATSICUR WO Unprivileged stage 1 read translation, current state 
3 ATS1CUW WO Unprivileged stage 1 write translation, current state 
c9 0 ATS1CPRPa WO PL1 stage 1 read translation, current state, PSTATE.PAN@ 
1 ATS1CPWPa WO PL1 stage 1 write translation, current state, PSTATE.PAN@ 





Implementation includes EL2, in Non-secure Hyp mode and Secure PL1 modes, see ATS/2NSO**, Address 
translation stages 1 and 2, Non-secure state only on page G5-5842 














0 c8 4 ATSI2NSOPR WO Non-secure PL1 stage 1 and 2 read translation 
S ATSI2NSOPW WO Non-secure PL1 stage 1 and 2 write translation 
6 ATSI2NSOUR WO Non-secure unprivileged stage 1 and 2 read translation 
7 ATSI2NSOUW WO Non-secure unprivileged stage 1 and 2 write translation 





Implementation includes EL2, in Non-secure Hyp mode and Secure Monitor mode, see ATS/H*, Address translation 
stage 1, Hyp mode on page G5-5843 





4 c8 0 ATSIHR WO Hyp mode stage 1 read translation 





1 ATS1IHW WO Hyp mode stage | write translation 





a. Instruction only supported when ARMv8.2-ATS1E1 is implemented. 


The result of an instruction is always returned in the PAR. The PAR is a RW register and: 


: In all implementations, the 32-bit format PAR is accessed using an MCR or MRC instruction with CRn set to c7, 
CRm set to c4, and opcl and opc2 both set to 0. 


$ The 64-bit format PAR is accessed using an MCRR or MRRC instruction with CRm set to c7, and opc1 set to 0. 


Address translation instructions that are not available in a particular implementation are reserved and CONSTRAINED 
UNPREDICTABLE. For example: 


a In an implementation that does not include EL2, the encodings with an opc1 value of 4 are reserved and 
CONSTRAINED UNPREDICTABLE. These are the ATS1H* instructions. 


è In an implementation that does not include either EL2 or EL3, the encodings with opc2 values of 4-7 are 
reserved and CONSTRAINED UNPREDICTABLE. These are the ATS12NSO** instructions. 


The CONSTRAINED UNPREDICTABLE behavior of these encodings is that they are UNDEFINED, see Unallocated 
System register access instructions on page K1-7609. 
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G5.13.3 Determining the PAR format 


The PAR is a 64-bit register, that supports both 32-bit and 64-bit PAR formats. This section describes how the PAR 
format is determined, for returning a result from each of the groups of address translation instructions. The returned 
result might be the translated address, or might indicate a fault on the translation, see Handling of faults and aborts 
during an address translation instruction. 


ATS1C** instructions 


Address translations for the current state. From modes other than Hyp mode: 


. TTBCR.EAE determines whether the result is returned using the 32-bit or the 64-bit PAR 
format. 


s Ifthe implementation includes EL3, the translation performed is for the current security state 
and, depending on that state: 
— The Secure or Non-secure TTBCR.EAE determines the PAR format. 
— The result is returned to the Secure or Non-secure instance of the PAR 


Instructions executed in Hyp mode always return a result to the Non-secure PAR, using the 64-bit 
format. 
ATS12NSO** instructions 


Address translations for the Non-secure PL1 and ELO modes. These instructions return a result 
using the 64-bit PAR format if at least one of the following is true: 


: The Non-secure TTBCR.EAE bit is set to 1. 
. The implementation includes EL2, and the value of HCR.VM is 1. 


Otherwise, the instruction returns a result using the 32-bit PAR format. 
Instructions executed in a Secure PL1 mode return a result to the Secure PAR. Instructions executed 
in Hyp mode return a result to the Non-secure PAR. 

ATS1H* instructions 


Address translations from Hyp mode. These instructions always return a result using the 64-bit PAR 
format. 


Instructions executed in Secure Monitor mode return a result to the Secure PAR. Instructions 
executed in Non-secure Hyp mode return a result to the Non-secure PAR. 


G5.13.4 Handling of faults and aborts during an address translation instruction 


ARM DDI 0487E.a 
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When a stage of address translation is enabled, any corresponding address translation instruction requires a 
translation table lookup, and this might require a translation table walk. However, the input address for the 
translation might be a faulting address, either because: 


è The translation table entries used for the translation indicate a fault. 
° A stage 2 fault or an External abort occurs on the required translation table walk. 


VMSAv8-32 memory aborts on page G5-5810 describes the faults that might occur on a translation table walk in 
AArch32 state. 


How the fault is handled, and whether it generates an exception, depends on the cause of the fault, as described in: 


of MMU fault on an address translation instruction. 
° External abort during an address translation instruction on page G5-5846. 
à Stage 2 fault on a current state address translation instruction on page G5-5846. 


MMU fault on an address translation instruction 


In the following cases, an MMU fault on an address translation is reported in the PAR, and no abort is taken. This 
applies: 


7 For a faulting address translation instruction executed in Hyp mode, or in a Secure PL1 mode. 
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G5-5846 


s For a faulting address translation instruction executed in a Non-secure PL1 mode, for cases where the fault 
would generate a stage 1 abort if it occurred on the equivalent load or store operation. 


Using the PAR to report a fault on an address translation instruction gives more information about how these faults 
are reported. 





Note 


s The Domain fault encodings shown in Table G5-27 on page G5-5829 are used only for reporting a fault on 
an address translation instruction that uses the 64-bit PAR format. That is, they are used only in an 
implementation that includes EL2, and are used for reporting a Domain fault on either: 

— An ATS1C** instruction executed in Hyp mode. 
—  AnATS12NSO** instruction executed when the value of HCR.VM is 1. 


These encodings are never used for fault reporting in the DFSR, IFSR, or HSR. 
è For an address translation instruction executed in a Non-secure PL1 mode, for a fault that would generate a 


stage 2 abort if it occurred on the equivalent load or store operation, the stage 2 abort is generated as described 
in Stage 2 fault on a current state address translation instruction. 





Using the PAR to report a fault on an address translation instruction 


For a fault on an address translation instruction for which no abort is taken, the PAR is updated with the following 
information, to indicate the fault: 


. The fault code, that would normally be written to the Fault status register. The code used depends on the 
current translation table format, as described in either: 


— PL] fault reporting with the Short-descriptor translation table format on page G5-5827. 
— PL] fault reporting with the Long-descriptor translation table format on page G5-5829. 


See also the Note at the start of Determining the PAR format on page G5-5845 about the Domain fault 
encodings shown in Table G5-27 on page G5-5829. 


. A status bit, that indicates that the translation operation failed. 


The fault does not update any Fault Address Register. 


External abort during an address translation instruction 


As stated in External abort on a translation table walk on page G5-5818, an External abort on a translation table 
walk generates a Data Abort exception. The abort can be synchronous or asynchronous, and behaves as follows: 
Synchronous External abort on a translation table walk 


The fault status and fault address registers of the Security state to which the abort is taken are 
updated. The fault status register indicates the appropriate External abort on a Translation fault, and 
the fault address register indicates the input address for the translation. 


The PAR is UNKNOWN. 


Asynchronous External abort on a translation table walk 
The fault status register of the Security state to which the abort is taken is updated, to indicate the 
asynchronous External abort. No fault address registers are updated. 


The PAR is UNKNOWN. 


Stage 2 fault on a current state address translation instruction 


If the PE is in a Non-secure PL1 mode and executes one of the ATS1C*™* instructions, then a fault in the stage 2 
translation of an address accessed in a stage 1 translation table lookup generates an exception. This is equivalent to 
the case described in Stage 2 fault on a stage 1 translation table walk on page G5-5817. When this fault occurs on 
an ATS1C** address translation instruction: 


. A Hyp Trap exception is taken to Hyp mode. 
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: The PAR is UNKNOWN. 
. The HSR indicates that: 
— The fault occurred on a translation table walk. 
— The operation that faulted was a cache maintenance instruction. 
° The HPFAR holds the IPA that faulted. 
$ The HDFAR holds the VA that the executing software supplied to the address translation instruction. 
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G5.14 


G5.14.1 


G5.14.2 


G5.14.3 


G5.14.4 


G5.14.5 


G5-5848 


Pseudocode description of VMSAv8-32 memory system operations 


This section contains a list of pseudocode functions describing VMSAv8-32 memory operations. The following 
subsections describe the pseudocode functions: 


. Alignment fault. 

° Address translation. 

. Domain checking. 

e TLB operations. 

° Translation table walk. 

° Reporting syndrome information on page G5-5849. 

$ Memory access decode when TEX remap is enabled on page G5-5849. 


See also the descriptions of pseudocode for general memory system operations in Pseudocode description of 
general memory System instructions on page G4-5715. 


Alignment fault 


The AArch32.AlignmentFault() pseudocode function describes the generation of an Alignment fault Data Abort 
exception. 


See also Abort exceptions on page G4-5717. 


Address translation 


The AArch32.TranslateAddress() and AArch32.FullTranslate() pseudocode functions describe a VMSAv8-32 
address translation. 


The AArch32.FullTranslate() function calls either: 
: The function described in Address translation when the stage 1 address translation is disabled. 
° One of the functions described in Translation table walk. 


See also Stage 2 translation table walk on page G5-5849. 


Address translation when the stage 1 address translation is disabled 


The AArch32.TranslateAddressS10ff() pseudocode function describes the address translation performed when the 
stage 1 address translation is disabled. 


Domain checking 


The AArch32.CheckDomain() pseudocode function describes domain checking. 


TLB operations 


The TLBRecord type represents the contents of a TLB entry: 


Translation table walk 


Because of the complexity of a translation table walk, the following sections describe the different cases: 

s Translation table walk using the Short-descriptor translation table format for stage 1. 

. Translation table walk using the Long-descriptor translation table format for stage 1 on page G5-5849. 
$ Stage 2 translation table walk on page G5-5849. 


Translation table walk using the Short-descriptor translation table format for stage 1 


The AArch32.TranslationTableWalkSD() pseudocode function describes the translation table walk when the stage 1 
translation tables use the Short-descriptor format. It calls the function described in Stage 2 translation table walk on 
page G5-5849 if necessary. 
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The ShortConvertAttrsHints() pseudocode function converts the Normal memory cacheability attribute, from the 
TTBR or the translation table TEX field, into the separate cacheability attribute and cache allocation hint defined 
in a Long-descriptor translation table descriptor. 


Translation table walk using the Long-descriptor translation table format for stage 1 


The AArch32.TranslationTableWalkLD() pseudocode function describes the translation table walk when the stage 1 
translation tables use the Long-descriptor format. It calls the function described in Stage 2 translation table walk if 
necessary. 


AArch32.TranslationTableWalkLD() calls the ConvertAttrsHints() pseudocode function that is defined in Translation 
table walk using the Short-descriptor translation table format for stage 1 on page G5-5848. 


The AArch32.S1AttrDecode() pseudocode function uses the MAIRO and MAIR1 registers to decode the Attr[2:0] 
value from a stage 1 translation table descriptor. 


The S2AttrDecode() pseudocode function decodes the Attr[3:0] value from a stage 2 translation table descriptor. 


Stage 2 translation table walk 


In the Non-secure EL1&0 translation regime, a descriptor address returned by stage 1 lookup is in the IPA address 
map, and must be mapped to a PA by a stage 2 translation. When EL2 is using AArch32, function 
AArch32.SecondStageWalk() performs this translation, by calling the AArch32.SecondStageTranslate() function. 
When called from AArch32.SecondStageWalk(), the AArch32.SecondStageTranslate() function performs a second 
stage translation, from IPA to PA, of the supplied address, including checking that the access has read permission 
at the second stage. If the access does not have second stage read permission it generates a second stage Permission 
fault on the first stage translation table walk. The second stage translation might hit in a TLB, or might involve a 
translation table walk, which will use the algorithm described in this section. Stage 2 translations tables always use 
the Long-descriptor translation table format. 


The AArch32.CheckPermission() pseudocode function checks the access permissions for the stage 1 translation. 
The AArch32.CheckS2Permission() pseudocode function checks the access permissions for the stage 2 translation. 


The CombineS1S2Desc() pseudocode function combines the stage 1 and stage 2 access descriptors: 


G5.14.6 Reporting syndrome information 


The AArch32.ReportHypEntry(), AArch32.ReportDataAbort(), and AArch32.ReportPrefetchAbort() pseudocode 
functions write syndrome value information to the appropriate registers for the current mode. 


G5.14.7 Memory access decode when TEX remap is enabled 


ARM DDI 0487E.a 
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When using the Short-descriptor translation table format, the function AArch32.RemappedTEXDecode() decodes the 
texcb and S attributes derived from the translation tables when TEX remap is enabled. Short-descriptor format 
memory region attributes, with TEX remap on page G5-5780 shows the interpretation of the arguments. 
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G5.15.1 


G5-5850 


About the System registers for VMSAv8-32 


The System registers and System instructions that are accessible in AArch32 state are almost all in the encoding 
space described in The AArch32 System register interface on page G1-5567. This section gives general information 
about these registers, which comprise: 


°: Registers in the (coproc==0b1111) encoding space, that provide control and status information for the PE in 
Non-debug state. 


: Registers in the (coproc==0b1110) encoding space, including: 
— Debug registers. 
— Trace registers. 


— Legacy execution environment registers. 


VMSAv8-32 organization of registers in the (coproc==0b1110) encoding space on page G7-5871 summarizes the 
registers in the (coproc==0b1110) encoding space, and indicates where these registers are described, either in this 
manual or in other architecture specifications. 


VMSAv8-32 organization of registers in the (coproc==0b1111) encoding space on page G7-5874 summarizes the 
registers in the (coproc==0b1111) encoding space, and indicates where in this manual these registers are described. 


Note 


Many implementations include other interfaces to some System registers, for example a memory-mapped interface 
to some debug System registers. These are described in the appropriate sections of this manual. 








Classification of System registers 


Features provided by EL3 and EL2 integrate with many features of the architecture. Therefore, the descriptions of 
the individual System registers include information about how these Exception levels affect the register. This 
section: 


s Summarizes how EL3 and EL2 affect the implementation of the System registers, and the classification of 
those registers. 

° Summarizes how EL3 controls access to the System registers. 

$ Describes an EL3 signal that can control access to some registers in the (coproc==0b1111) encoding space. 


It contains the following subsections: 

s Banked System registers. 

7 Restricted access System registers on page G5-5851. 

Configurable access System registers on page G5-5851. 

e EL2-mode System registers on page G5-5852. 

. Common System registers on page G5-5853. 

3 Access to registers from Monitor mode on page G5-5853. 

. The CPI5SDISABLE and CP15SDISABLE2 input signals on page GS-5854. 


Note 


EL3 defines the register classifications of Banked, Restricted access, Configurable, and Common. EL2 defines the 
EL2-mode classification. 








It is IMPLEMENTATION DEFINED whether each IMPLEMENTATION DEFINED register is Banked, Restricted access, 
Configurable, EL2-mode, or Common. 


Banked System registers 


In an implementation that includes EL3 using AArch32, some System registers are banked. Banked System 
registers have two copies, one Secure and one Non-secure. The SCR.NS bit selects the Secure or Non-secure 
instance of the register. 
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A Banked System register can contain a mixture of: 
. Fields that are banked. 
è Fields that are read-only in Non-secure PL1 or EL2 modes but read/write in the Secure state. 


The System Control Register SCTLR is an example of a register of that contains this mixture of fields. 


The Secure copies of the Banked System registers are sometimes referred to as the Secure Banked System registers. 
The Non-secure copies of the Banked System registers are sometimes referred to as the Non-secure Banked System 
registers. 


Restricted access System registers 


In an implementation that includes EL3, some System registers are present only in Secure state. These are called 
Restricted access registers, and their read/write access permissions are: 


° In Non-secure state, software cannot modify Restricted access registers. 


° For the NSACR, in Non-secure state: 
— Software running at PL1 or higher can read the register. 
—  Unprivileged software, meaning software running at ELO, cannot read the register. 


This means that Non-secure software running at PL1 or higher can read the access permissions for System 
registers that have Configurable access. 


If EL3 is using AArch64, then any read of the NSACR from Non-secure EL2 using AArch32, or Non-secure 
EL1 using AArch32, returns the value 0x00000CQ0. 


° For all other Restricted access registers, Non-secure software cannot read the register. 


In an implementation that does not include EL3: 


: SDER is implemented only in Secure state. 
° Any read of the NSACR returns the value 0x00000C00. 
° All other accesses to Restricted access System registers are UNDEFINED. 


Configurable access System registers 


Secure software can configure the access to some System registers. These registers are called Configurable access 
registers, and the control can be: 


è A bit in the control register determines whether the register is: 
— Accessible from Secure state only. 
— Accessible from both Secure and Non-secure states. 


à A bit in the control register changes the accessibility of a register bit or field. For example, setting a bit in the 
control register might mean that an RW field behaves as RAZ/WI when accessed from Non-secure state. 


Bits in the NSACR control access. 


In an AArch32 implementation that includes EL3: 
° There are no Configurable access System registers in the (coproc==0b1110) encoding space. 
$ The only required Configurable access register in the (coproc==0b1111) encoding space is the CPACR. 
— Floating-point Status and Control Register, FPSCR 
— Floating-point Exception register, FPEXC. 
— Floating-point System ID register, FPSID. 
— Media and VFP Feature Register 0, MVFRO. 
— Media and VFP Feature Register 1, MVFR1. 
— Media and VFP Feature Register 2, MVFR2. 
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EL2-mode System registers 


In an implementation that includes EL2, if EL2 can use AArch32, the implementation provides a number of 
registers for use in the EL2 mode, Hyp mode. As with other System register encodings, some of these register 
encodings provide write-only operations. When the implementation includes EL3 and EL3 is using AArch32, these 
registers are also accessible from Monitor mode when the value of SCR.NS is 1. 


The following subsections describe the EL2-mode registers: 

- Hyp mode read/write registers in the (coproc==0b1111) encoding space. 

s Hyp mode encodings for shared (coproc ==0b1111) System registers. 

` Hyp mode (coproc==0b1111) write-only System instructions on page G5-5853. 


There are no EL2-mode registers in the (coproc==0b1110) encoding space. 


Hyp mode read/write registers in the (coproc==0b1111) encoding space 


These registers are implemented only in Non-secure state, and in Non-secure state they are accessible only from 
Hyp mode. 


Except for accesses to CNT VOFF in an implementation that includes EL3 but not EL2, the behavior of accesses to 
these registers is as follows: 


° In Secure state, the registers can be accessed from EL3 when SCR.NS is set to 1, see Access to registers from 
Monitor mode on page G5-5853. 


è The following accesses are UNDEFINED: 
— Accesses from Non-secure PL1 modes. 
— Accesses in Secure state when SCR.NS is set to 0. 


In an implementation that includes EL3 but not EL2, the behavior of accesses to CNTVOFF is as follows: 


è Any access from Secure Monitor mode is CONSTRAINED UNPREDICTABLE, regardless of the value of SCR.NS. 
The CONSTRAINED UNPREDICTABLE behavior is that the access is UNDEFINED, see Unallocated System 
register access instructions on page K1-7609. 


. All other accesses are UNDEFINED. 





Note 


Except for CNTVOFF, the Hyp mode registers are part of EL2, meaning they are implemented only if the 
implementation includes EL2. However, conceptually, CNTVOFF is part of any implementation of the Generic 
Timer, see Status of the CNTVOFF register on page G6-5863. This means the behavior of CNTVOFF in an 
implementation that does not include EL2 is not covered by the general definition of the behavior of the Hyp mode 
(coproc==0b1111) read/write registers. 





Hyp mode encodings for shared (coproc==0b1111) System registers 


Some Hyp mode registers share the Secure instance of an existing banked register. In this case, the implementation 
includes an encoding for the register that is accessible only in Hyp mode, or in Monitor mode when SCR.NS is 
set to 1. 


For these registers, the following accesses are UNDEFINED: 
° Accesses from Non-secure PL1 modes. 
° Accesses in Secure state when SCR.NS is set to 0. 


In Monitor mode, the Secure copies of these registers can be accessed either: 
è Using the DFAR or IFAR encoding with SCR.NS set to 0. 
à Using the HDFAR or HIFAR encoding with SCR.NS set to 1. 


However, between accessing a register using one alias and accessing the register using the other alias, a Context 
synchronization event is required to ensure the ordering of the accesses. 
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Hyp mode (coproc==0b1111) write-only System instructions 


Architecturally, these encodings are an extension of the banked register encodings described in Banked System 
registers on page G5-5850, where: 


$ The implementation does not implement the operation in Secure state. 
° In Non-secure state, the operation is accessible only at EL2, that is, only from Hyp mode. 


In Secure state: 


° These instructions can be accessed from Monitor mode regardless of the value of SCR.NS, see Access to 
registers from Monitor mode. 


$ Accesses to these instructions are CONSTRAINED UNPREDICTABLE if executed in a Secure mode other than 
Monitor mode, see Hyp mode TLB maintenance instructions on page K1-7627 and Hyp mode VA to PA 
address translation instructions on page K 1-7627. 


Accesses to these instructions are UNDEFINED if accessed from a Non-secure PL1 mode. 


Common System registers 


Some System registers and operations are common to the Secure and Non-secure Security states. These are 
described as the Common access registers, or simply as the Common registers. These registers include: 


e Read-only registers that hold configuration information. 
° Register encodings used for various memory system operations, rather than to access registers. 
. The ISR. 


° All System registers in the (coproc==0b1110) encoding space. 


Secure System registers for the (coproc==0b1111) encoding space 


The Secure System registers in the (coproc==0b1111) encoding space comprise: 


° The Secure copies of the Banked System registers in the (coproc==0b1111) encoding space. 
. The Restricted access System registers in the (coproc==0b1111) encoding space. 
e The Configurable access System registers in the (coproc==0b1111) encoding space that are configured to be 


accessible only from Secure state. 


In an implementation that includes EL3, the Non-secure System registers are the System registers other than the 
Secure System registers. 


Access to registers from Monitor mode 


When the PE is in Monitor mode, the PE is in Secure state regardless of the value of the SCR.NS bit. In Monitor 
mode, the SCR.NS bit determines whether, for System registers in the (coproc==0b1111) encoding space, valid uses 
of the MRC, MCR, MRRC, and MCRR instructions access the Secure Banked System registers or the Non-secure Banked 
System registers. That is, when: 


NS == Common, Restricted access, and Secure Banked System registers are accessed by MRC, MCR, MRRC, and 
MCRR instructions that target the (coproc==0b1111) encoding space. 
If the implementation includes EL2, the registers listed in Hyp mode read/write registers in the 
(coproc==0bI1111) encoding space on page G5-5852 and Hyp mode encodings for shared 
(coproc==0b1111) System registers on page G5-5852 are not accessible, and any attempt to access 
them generates an Undefined Instruction exception. 


— Note 


The operations listed in Hyp mode (coproc==0b1111) write-only System instructions are accessible 
in Monitor mode regardless of the value of SCR.NS. 
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System instructions in the (coproc==0b1111) encoding space use the Security state to determine all 
resources used, that is, all operations performed by these instructions are performed in Secure state. 


NS == Common, Restricted access and Non-secure Banked System registers are accessed by MRC, MCR, MRRC, 
and MCRR instructions that target the (coproc==0b1111) encoding space. 


If the implementation includes EL2, all the registers and operations listed in the subsections of 
EL2-mode System registers on page G5-5852 are accessible, using the MRC, MCR, MRRC, or MCRR 
instructions required to access them from Hyp mode. 


System instructions in the (coproc==0b1111) encoding space use the Security state to determine all 
resources used, that is, all operations by these instructions are performed in Secure state. 


The Security state determines whether the Secure or Non-secure banked registers determine the control state. 





Note 


Where the contents of a register select the value accessed by an MRC or MCR access to a different register, then the 
register that is used for selection is being used as control state. For example, CSSELR selects the current Cache Size 
Identification Register, and therefore CSSELR is used as control state. Therefore, in Monitor mode: 


° SCR.NS determines whether the Secure or Non-secure CSSELR is accessible. 
° Because the PE is in Secure state, the Secure CSSELR selects the current Cache Size Identification Register. 


From Armv8.3, it is possible to have multiple Cache Size Identification Registers. For more details, see Possible 


formats of the Cache Size Identification Registers, CCSIDR and CCSIDR2 on page G4-5689. 





The CP15SDISABLE and CP15SDISABLE2 input signals 
When EL3 is using AArch32, it provides an input signal, CPISSDISABLE, that disables write access to some of 
the Secure registers when asserted HIGH. The CP1SSDISABLE signal has no effect on: 


° Register accesses from AArch64 state. 
° Register accesses from Secure EL1 when EL3 is using AArch64 and EL1 is using AArch32. 


Note 


When EL3 is using AArch32, the interaction between CP1SSDISABLE and any IMPLEMENTATION DEFINED 
register is IMPLEMENTATION DEFINED. 





On a reset by the external system that resets the PE into EL3 using AArch32, the CPISSDISABLE input signal 
must be taken LOW. This permits the Reset code to set up the configuration of EL3 features. When the input is 
asserted HIGH, any attempt to write to the Secure registers that are affected by CPISSDISABLE results in an 
Undefined Instruction exception. 


The CP1I5SDISABLE input does not affect reading Secure registers, or reading or writing Non-secure registers. It 
is IMPLEMENTATION DEFINED how the input is changed and when changes to this input are reflected in the PE, and 
an implementation might not provide any mechanism for driving the CP1ISSDISABLE input HIGH. However, in 
an implementation in which the CP1SSDISABLE input can be driven HIGH, changes in the state of 
CP15SDISABLE must be reflected as quickly as possible. Any change must occur before completion of an 
Instruction Synchronization Barrier operation, issued after the change, is visible to the PE with respect to instruction 
execution boundaries. Software must perform an Instruction Synchronization Barrier operation meeting the above 
conditions to ensure all subsequent instructions are affected by the change to CPISSDISABLE. 


When EL3 is using AArch32, use of CPISSDISABLE means key Secure features that are accessible only at PL1 
can be locked in a known state. This provides an additional level of overall system security. Arm expects control of 
CP15SDISABLE to reside in the system, in a block dedicated to security. 


When ARMv8.0-CP15SDISABLE2 is implemented and EL3 is using AArch32, EL3 provides a second input 
signal, CPISSDISABLE2. CP15SDISABLE2 has all of the properties of CP1ISSDISABLE described above. The 
difference between CPISSDISABLE and CP15SDISABLE2 is only in the set of registers each signal affects. 
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Information on whether a given register is affected by CPISSDISABLE, or CPISSDISABLE2 when it is 
implemented, can be found in the access pseudocode for that register, as described in Chapter G8 AArch32 System 
Register Descriptions. 
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Functional grouping of VMSAv8-32 System registers 


This section describes how the System registers in an VMSAv8-32 implementation divide into functional groups. 
The functional groups of AArch32 registers are: 


Special-purpose registers. 

VMSA-specific registers. 

ID registers. 

Performance monitors registers. 

Activity monitors registers. 

Debug registers. 

The Reliability, Availability, and Serviceability Extension (RAS Extension) registers. 
Generic timer registers. 

Cache maintenance System instructions. 
Address translation System instructions. 

TLB maintenance System instructions. 

Base system registers. 

Legacy feature registers and System instructions. 


For a list of these functional groups and the registers in each group, see Functional index of AArch32 registers and 
System instructions on page K14-7855. 


Chapter G8 AArch32 System Register Descriptions describes each of these registers. 





Note 
Table G7-3 on page G7-5878 lists all of the VMSAv8-32 System registers in the (coproc==0b1111) encoding 
space, ordered by: 
l. The CRn primary register used when using a 32-bit access to the register. 


For 64-bit register accesses using an MCRR or MRRC instruction, the instruction arguments that identify 
the target register are {coproc, Rm, opc1} The value of Rm determines where these registers appear in 
Table G7-3 on page G7-5878, so that these registers appear with the 32-bit registers accessed using 
that value for CRn. So, for example, the 64-bit access to TTBRO, that uses (CRm==c2), appears with the 
32-bit access to TTBRO, that uses (CRn==c2). 


2. The opc1 value used when accessing the register. 


3; For 32-bit registers, the {CRm, opc2} values used when accessing the register. 


The functional groups defined in this section mainly consist of the VMSAv8-32 System registers, but include 
some additional System registers. 


Some registers belong to more than one functional group. 





For other related information see: 


The AArch32 System register interface on page G1-5567 for general information about the access to the 
AArch32 System registers, including the main register access instructions MRC and MCR. 


About the System registers for VMUSAv8-32 on page G5-5850. 
VMSAv8-32 organization of registers in the (coproc ==0b1110) encoding space on page G7-5871. 
VMSAVv8-32 organization of registers in the (coproc==O0bI1111) encoding space on page G7-5874. 


About the AArch32 System registers on page G8-5892. 


The register descriptions in Chapter G8 AArch32 System Register Descriptions, assume you are familiar with these 
functional groups, and use conventions and other information from them without any explanation. 
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The Generic Timer in AArch32 state 


This chapter describes the implementation of the Arm Generic Timer as an extension to an Armv8 implementation. 
It includes an overview of the AArch32 System register interface to an Arm Generic Timer. 


It contains the following sections: 
. About the Generic Timer in AArch32 state on page G6-5858. 
. The AArch32 view of the Generic Timer on page G6-5862. 


Chapter D11 The Generic Timer in AArch64 state describes the AArch64 view of the Generic Timer, including an 
additional timer that can be implemented in AArch64 state, and Chapter 12 System Level Implementation of the 
Generic Timer describes the system level implementation of the Generic Timer. 
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About the Generic Timer in AArch32 state 


Figure G6-1 shows an example system-on-chip that uses the Generic Timer as a system timer. In this figure: 



















































° This manual defines the architecture of the individual PEs in the multiprocessor blocks. 

è The ARM Generic Interrupt Controller Architecture Specification defines a possible architecture for the 
interrupt controllers. 

è Generic Timer functionality is distributed across multiple components. 
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Figure G6-1 Generic Timer example 
The Generic Timer: 


$ Provides a system counter, that measures the passing of time in real-time. 


Note 


The Generic Timer can also provide other components at a system level, but Figure G6-1 does not show any 
such components. 








$ Supports virtual counters that measure the passing of virtual-time. That is, a virtual counter can measure the 
passing of time on a particular virtual machine. 


s Timers, that can trigger events after a period of time has passed. The timers: 
— Can be used as count-up or as count-down timers. 


— Can operate in real-time or in virtual-time. 


This chapter describes an instance of the Generic Timer component that Figure G6-1 shows as Timer_0 or Timer_1 
within the Multiprocessor A or Multiprocessor B block. This component can be accessed from AArch64 state or 
AArch32 state, and this chapter describes access from AArch32 state. Chapter D11 The Generic Timer in AArch64 
state describes access to this component from AArch6é4 state. 


Note 


The reset requirements of Generic Timer registers are more strict when they are accessed from AArch32 state than 
when they are accessed from AArch64 state. 
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A Generic Timer implementation must also include a memory-mapped system component, see The full set of 
Generic Timer components. 


G6.1.1 The full set of Generic Timer components 
Within a system that might include multiple PEs, a full set of Generic Timer components is as follows: 


The system counter 


This provides a uniform view of system time, see The system counter on page G6-5860. Because 
this must be implemented at the system level, it is accessed through The system level 
memory-mapped implementation of the Generic Timer. However, during initialization, a status 
register in each implemented timer in the system must be programmed with the frequency of the 
system counter, so that software can read this frequency. 


PE implementations of the Generic Timer 
Each PE implementation of the Generic Timer provides the following components: 
. A physical counter, that gives access to the count value of the system counter. 


s A virtual counter, that gives access to virtual time. In AArch32 state, the CNTVOFF register 
defines the offset between physical time, as defined by the value of the system counter, and 
virtual time. 


- A number of timers. In an implementation where all Exception levels are implemented and 
can use AArch32 state, the timers that are accessible from AArch64 state are: 
— A Secure PL1 physical timer. 
— A Non-secure EL1 physical timer. 
—  AnEL2 physical timer. 


— A virtual timer. 


Note 


The Secure PL1 physical timer uses the Secure banked instances of the CNTP_CTL, 
CNTP_CVAL, and CNTP_TVAL registers, and the Non-secure EL1 physical timer uses the 
Non-secure instances of the same registers. 








The AArch32 view of the Generic Timer on page G6-5862 describes these components. 


The system level memory-mapped implementation of the Generic Timer 


The memory-mapped registers that control the components of the system level implementation of 
the Generic Timer are grouped into frames. The Generic Timer architecture defines the offset of 
each register within its frame, but the base address of each frame is IMPLEMENTATION DEFINED, and 
defined by the system. 


Each system level component has one or two register frames. The possible system level components 
are: 
The memory-mapped counter module, required 

This module controls the system counter. It has two frames: 

° A control frame, CNTControlBase. 

° A status frame, CNTReadBase. 


The memory-mapped timer control module, required 


The system level implementation of the Generic Timer can provide up to eight timers, 
and the memory-mapped timer control module identifies: 


. Which timers are implemented. 

od The features of each implemented timer. 

This module has a single frame, CNTCTLBase. 
Memory-mapped timers, optional 

An implemented memory-mapped timer: 


s Must provide a privileged view of the timer, in the CNTBaseN frame. 
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e Optionally. provides an unprivileged view of the timer in the CNTELOBaseN 
frame. 


N is the timer number, and the corresponding frame number, in the range 0-7. 


Chapter 12 System Level Implementation of the Generic Timer describes these components. 


The system counter 


The Generic Timer provides a system counter with the following specification: 
Width At least 56 bits wide. 

The value returned by any 64-bit read of the counter is zero-extended to 64 bits. 
Frequency Increments at a fixed frequency, typically in the range 1-50MHz. 


Can support one or more alternative operating modes in which it increments by larger amounts at a 
lower frequency, typically for power-saving. 


Roll-over Roll-over time of not less than 40 years. 


Accuracy Arm does not specify a required accuracy, but recommends that the counter does not gain or lose 
more than ten seconds in a 24-hour period. 


Use of lower-frequency modes must not affect the implemented accuracy. 
Start-up Starts operating from zero. 


The system counter, once configured and running, must provide a uniform view of system time. More precisely, it 
must be impossible for the following sequence of events to show system time going backwards: 


l. Device A reads the time from the system counter. 
2; Device A communicates with another agent in the system, Device B. 
3: After recognizing the communication from Device A, Device B reads the time from the system counter. 


The system counter must be implemented in an always-on power domain. 


To support lower-power operating modes, the counter can increment by larger amounts at a lower frequency. For 
example, a 10MHz system counter might either increment: 


° By 1 at 1OMHz. 
e By 500 at 20kHz, when the system lowers the clock frequency, to reduce power consumption. 


In this case, the counter must support transitions between high-frequency, high-precision operation, and 
lower-frequency, lower-precision operation, without any impact on the required accuracy of the counter. 


The CNTFRQ register is intended to hold a copy of the current clock frequency to allow fast reference to this 
frequency by software running on the PE. For more information see Initializing and reading the system counter 
frequency. 


The mechanism by which the count from the system counter is distributed to system components is 
IMPLEMENTATION DEFINED, but each PE with a System register interface to the system counter must have a counter 
input that can capture each increment of the counter. 


Note 
So that the system counter can be clocked independently from the PE hardware, the count value might be distributed 
using a Gray code sequence. Gray-count scheme for timer distribution scheme on page K5-7688 gives more 
information about this possibility. 








Initializing and reading the system counter frequency 


The CNTFRQ register must be programmed to the clock frequency of the system counter. Typically, this is done 
only during the system boot process, by using the System register interface to write the system counter frequency 
to the CNTFRQ register. Only software executing at the highest implemented Exception level can write to 
CNTFRQ. 
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Note 


The CNTFRQ register is UNKNOWN at reset, and therefore the counter frequency must be set as part of the system 
boot process. 


Software can read the CNTFRQ register, to determine the current system counter frequency, in the following states 
and modes: 


° Hyp mode. 
° Secure PL1 modes and Non-secure EL1 modes. 
. When CNTKCTL.PLOPCTEN is set to 1, Secure and Non-secure ELO modes. 


Memory-mapped controls of the system counter 


Some system counter controls are accessible only through the memory-mapped interface to the system counter. 
These controls are: 


. Enabling and disabling the counter. 

. Setting the counter value. 

7 Changing the operating mode, to change the update frequency and increment value. 
° Enabling Halt-on-debug, that a debugger can then use to suspend counting. 


For descriptions of these controls, see Chapter 12 System Level Implementation of the Generic Timer. 
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The AArch32 view of the Generic Timer 


The following sections describe the components and features of a PE implementation of the Generic Timer, as seen 
from AArch3?2 state: 


. The physical counter. 

° The virtual counter. 

$ Event streams on page G6-5863. 
E Timers on page G6-5864. 


The physical counter 


The PE includes a physical counter that contains the count value of the system counter. The CNTPCT register holds 
the current physical counter value. 


Accessing the physical counter 

Software with sufficient privilege can read CNTPCT using a 64-bit System register read. 
CNTPCT: 

° Is always accessible from Secure PL1 modes and from Non-secure Hyp mode. 


° Is accessible from Non-secure EL1 modes when the value of CNTHCTL.PL1PCTEN is 1. When the value 
of CNTHCTL.PL1PCTEN is 0, any attempt to access CNTPCT from Non-secure EL1 modes is trapped to 
Hyp mode. 


° Is accessible from Secure User mode when the value of CNTKCTL.PLOPCTEN is 1. When the value of 
CNTKCTL.PLOPCTEN is 0, any attempt to access CNTPCT generates an UNDEFINED exception. 


° Is accessible from Non-secure User mode when the value of CNTHCTL.PLIPCTEN is 1 and the value of 
CNTKCTL.PLOPCTEN is 1. Otherwise: 


— When the value of CNTKCTL.PLOPCTEN is 0, any attempt to access CNTPCT from Non-secure 
User mode generates an UNDEFINED exception. 


— When the value of CNTKCTL.PLOPCTEN is 1 and the value of CNTHCTL.PL1PCTEN is 0, any 
attempt to access CNTPCT from Non-secure User mode is trapped to Hyp mode. 


Reads of CNTPCT can occur speculatively and out of order relative to other instructions executed on the same PE. 


For example, if a read from memory is used to obtain a signal from another agent that indicates that CNTPCT must 
be read, an ISB is used to ensure that the read of CNTPCT occurs after the signal has been read from memory, as 
shown in the following code sequence: 


loop ; polling for some communication to indicate a requirement to read the timer 
LDR R1, [R2] 
CMP R1, #1 
BNE loop 
ISB ; without this, the CNTPCT could be read before the memory location in [R2] 


; has had the value 1 written to it 
MRS R1, CNTPCT 


The virtual counter 


An implementation of the Generic Timer always includes a virtual counter, that indicates virtual time. 


The virtual counter contains the value of the physical counter minus a 64-bit virtual offset. When executing in a 
Non-secure EL] or ELO mode, the virtual offset value relates to the current virtual machine. 


The CNTVOFF register contains the virtual offset. CNTVOFF is only accessible: 
° From Hyp mode. 
: From Monitor mode only when SCR.NS is set to 1. 


For more information see Status of the CNTVOFF register on page G6-5863. 
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The CNTVCT register holds the current virtual counter value. 


Accessing the virtual counter 

Software with sufficient privilege can read CNTVCT using a 64-bit System register read. 

CNTVCT is always accessible from Secure PL1 modes and from Non-secure EL1 and EL2 modes. 

In addition, when CNTKCTL.PLOVCTEN is set to 1, CNTVCT is accessible from ELO. 

When CNTKCTL.PLOVCTEN is set to 0, any attempt to access CNT VCT from ELO is UNDEFINED. 

Reads of CNTVCT can occur speculatively and out of order relative to other instructions executed on the same PE. 


For example, if a read from memory is used to obtain a signal from another agent that indicates that CNTVCT must 
be read, an ISB is used to ensure that the read of CNT VCT occurs after the signal has been read from memory, as 
shown in the following code sequence: 


loop ; polling for some communication to indicate a requirement to read the timer 
LDR R1, [R2] 
CMP R1, #1 
BNE loop 
ISB ; without this, the CNTVCT could be read before the memory location in [R2] 


; has had the value 1 written to it 
MRS R1, CNTVCT 


Status of the CNTVOFF register 


All implementations of the Generic Timer include the virtual counter. Therefore, conceptually, all implementations 
include the CNTVOFF register that defines the virtual offset between the physical count and the virtual count. 
CNTVOFF is only accessible at EL2 or above. If EL2 is not implemented, the virtual counter uses a fixed virtual 
offset of zero. 


G6.2.3 Event streams 


ARM DDI 0487E.a 
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Any implementation of the Generic Timer can use the system counter to generate one or more event streams, to 
generate periodic wake-up events as part of the mechanism described in Wait for Event mechanism and Send event 
on page D1-2372. 





Note 
An event stream might be used: 
° To impose a time-out on a Wait For Event polling loop. 
è To safeguard against any programming error that means an expected event is not generated. 





An event stream is configured by: 


: Selecting which bit, from the bottom 16 bits of a counter, triggers the event. This determines the frequency 
of the events in the stream. 


° Selecting whether the event is generated on each 0 to 1 transition, or each 1 to 0 transition, of the selected 
counter bit. 


The CNTKCTL. {EVNTEN, EVNTDIR, EVNTI} fields define an event stream that is generated from the virtual 
counter. 


In all implementations the CNTHCTL. {EVNTEN, EVNTDIR, EVNTI} fields define an event stream that is 
generated from the physical counter. 


The operation of an event stream is as follows: 


° The pseudocode variables PreviousCNTVCT and PreviousCNTPCT are initialized as: 


// Variables used for generation of the timer event stream. 
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Timers 


bits(64) PreviousCNTVCT = bits(64) UNKNOWN; 
bits(64) PreviousCNTPCT = bits(64) UNKNOWN; 


The pseudocode functions TestEventCNTV() and TestEventCNTP() are called on each cycle of the PE clock. 


The TestEventCNTx() pseudocode template defines the functions TestEventCNTV() and TestEventCNTP(): 


// TestEventCNTx() 


// Template for the TestEventCNTV() and TestEventCNTP() functions 

// Describes operation when all Exception Levels are using AArch32: 

// — CNTxCT is CNTVCT or CNTPCT 64-bit count value 
// — CNTx_CTL is CNTV_CTL or CNTP_CTL Control register 
//  PreviousCNTxCT is PreviousCNTVCT or PreviousCNTPCT 


TestEventCNTx() 
if CNTx_CTL.EVNTEN == '1' then 
n = UInt(CNTx_CTL.EVNTI) ; 
SampleBit = CNTxCT<n>; 
PreviousBit = PreviousCNTxCT<n>; 


if CNTx_CTL.EVNTDIR == 'Q@' then 
if PreviousBit == '0' && SampleBit == '1' then EventRegisterSet(); 
else 
if PreviousBit == '1' && SampleBit == 'Q' then EventRegisterSet(); 
PreviousCNTxCT = CNTxCT; 


return; 


In an implementation that includes EL3, in any implementation of the Generic Timer, the following timers are 
accessible from AArch32 state, provided the appropriate Exception level can use AArch32: 


A Non-secure EL1 physical timer. A Non-secure EL1 control determines whether this register is accessible 
from Non-secure ELO. 


A Secure PL1 physical timer. This timer: 
— Is accessible from Secure EL] using AArch32 when EL3 is using AArch64. 
— Is accessible from Secure EL3 when EL3 is using AArch32. 


A Secure PL1 control determines whether this register is accessible from Secure ELO. 
A Non-secure EL2 physical timer. 


A virtual timer. 


The output of each implemented timer: 


Provides an output signal to the system. 


If the PE interfaces to a Generic Interrupt Controller (GIC), signals a Private Peripheral Interrupt (PPI) to 
that GIC. In a multiprocessor implementation, each PE must use the same interrupt number for each timer. 


Each timer: 


Is based around a 64-bit CompareValue that provides a 64-bit unsigned upcounter. 


Provides an alternative view of the CompareValue, called the TimerValue, that appears to operate as a 32-bit 
downcounter. 


Has, in addition, a 32-bit Control register. 
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In all implementations, the AArch32 System registers for the EL1 (or PL1) physical timer are banked, to provide 
the Secure and Non-secure implementations of the timer. Table G6-1 shows the Timer registers. 


Table G6-1 Timer registers summary for the Generic Timer 














Timer register Secure PL1 or Non-secure EL1 physical timer EL2 physical timer Virtual timer 
CompareValue register CNTP_CVAL@ CNTHP_CVAL CNTV_CVAL 
TimerValue register CNTP_TVAL2 CNTHP_TVAL CNTV_TVAL 
Control register CNTP_CTL@ CNTHP_ CTL CNTV_CTL 





a. In AArch32 state, these registers are banked to provide the Non-secure EL1 physical timer and the Secure PL1 physical timer. 


The following sections describe: 

E Accessing the timer registers 

è Operation of the CompareValue views of the timers on page G6-5866 
è Operation of the Timer Value views of the timers on page G6-5866. 


Accessing the timer registers 
For each timer, all timer registers have the same access permissions, as follows: 


Secure PL1 and Non-secure EL1 physical timer 
The Secure PL1 physical timer is accessible from Secure PL1 modes. 


Non-secure software executing at EL2 controls access to the Non-secure EL1 physical timer 
from Non-secure EL1 modes. The Non-secure EL1 physical timer is accessible from 
Monitor mode when the value of SCR.NS is 1. 


When access from PL1 or EL1 modes is permitted, CNTKCTL.PLOPTEN determines 
whether the registers are accessible from ELO. If an access is not permitted because 
CNTKCTL.PLOPTEN is set to 0, an attempted access from ELO is UNDEFINED. 


In all implementations: 


. Except for accesses from Monitor mode, accesses are to the registers for the current 
Security state. 
° For accesses from Monitor mode, the value of SCR.NS determines whether accesses 
are to the Secure or the Non-secure registers. 
Note 





Monitor mode is present only when EL3 is using AArch32. 





° The Non-secure registers are accessible from Hyp mode. 


. CNTHCTL.PL1PCEN determines whether the Non-secure registers are accessible 
from Non-secure EL1 modes. If this bit is set to 1, to enable access from Non-secure 
EL1 modes, CNTKCTL.PLOPTEN determines whether the registers are accessible 
from Non-secure ELO. 
If an access is not permitted because CNTHCTL.PL1PCEN is set to 0, an attempted 
access from a Non-secure EL1 or ELO mode generates a Hyp Trap exception. 
However, if CNTKCTL.PLOPTEN is set to 0, this control takes priority, and an 
attempted access from ELO is UNDEFINED. 


EL2 physical timer Accessible from Hyp mode, and from Secure Monitor mode when SCR_EL3.NS is set to 1. 


Virtual timer Accessible from Secure PL1 modes and Non-secure EL1 modes, and from Hyp mode. 


CNTKCTL.PLOVTEN determines whether the registers are accessible from ELO modes. If 
an access is not permitted because CNTKCTL.PLOVTEN is set to 0, an attempted access 
from ELO is UNDEFINED. 
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Operation of the CompareValue views of the timers 


The CompareValue view of a timer operates as a 64-bit upcounter. The timer condition is met when the appropriate 
counter reaches the value programmed into its CompareValue register. When the timer condition is met an interrupt 
is generated if the interrupt is not masked in the corresponding timer control register, CNTP_CTL, CNTHP_CTL, 
or CNTV_CTL. For CNTP_CTL, the interrupt is the same as the interrupt asserted by the Non-secure instance of 
the AArch64 register CNTP_CTL_ELO. 


The operation of this view of a timer is: 


TimerConditionMet = (((Counter[63:0] - Offset[63:0]) [63:0] - CompareValue[63:0]) >= Q) 





Where: 
TimerConditionMet Is TRUE if the timer condition for this counter is met, and FALSE otherwise. 
Counter The physical counter value, that can be read from the CNTPCT register. 
Note 
The virtual counter value, that can be read from the CNTVCT register, is the value: 
(Counter - Offset) 
Offset For a physical timer it is zero, and for the virtual timer it is the virtual offset, held in the 
CNTVOFF register. 
CompareValue The value of the appropriate Compare Value register, CNTP_CVAL, CNTHP_CVAL, or 


CNTV_CVAL. 


In this view of a timer, Counter, Offset, and CompareValue are all 64-bit unsigned values. 


Note 


This means that a timer with a CompareValue of, or close to, @xFFFF_FFFF_FFFF_FFFF might never meet its timer 
condition. However, there is no practical requirement to use values close to the counter wrap value. 








Operation of the TimerValue views of the timers 


The TimerValue view of a timer appears to operate as a signed 32-bit downcounter. A TimerValue register is 
programmed with a count value. This value decrements on each increment of the appropriate counter, and the timer 
condition is met when the value reaches zero. When the timer condition is met, an interrupt is generated if the 
interrupt is not masked in the corresponding timer control register, CNTP_CTL, CNTHP_CTL, or CNTV_CTL. 


This view of a timer depends on the following behavior of accesses to TimerValue registers: 
Reads TimerValue = (CompareValue - (Counter - Offset) ) [31:0] 
Writes CompareValue = ((Counter - Offset) [63:0] + SignExtend(TimerValue) ) [63:0] 


Where the arguments other than TimerValue have the definitions used in Operation of the CompareValue views of 
the timers, and in addition: 


TimerValue The value of a TimerValue register, CNTP_TVAL, CNTHP_TVAL, or CNTV_TVAL. 
In this view of a timer, values are signed, in standard two’s complement form. 


A read of a TimerValue register after the timer condition has been met indicates the time since the timer condition 
was met. 


Note 


. Operation of the CompareValue views of the timers gives a strict definition of TimerConditionMet. However, 
provided that the TimerValue is not expected to wrap as a 32-bit signed value when decremented from 
0x80000000, the TimerValue view can be used as giving an effect equivalent to: 





TimerConditionMet = (TimerValue <0) 
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° Programming TimerValue to a negative number with magnitude greater than (Counter—Offset) can lead to 
an arithmetic overflow that causes the Compare Value to be an extremely large positive value. This potentially 
delays meeting the timer condition for an extremely long period of time. 
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This chapter describes the AArch32 System register encoding space. It contains the following sections: 

` The AArch32 System register encoding space on page G7-5870. 

$ VMSAv8-32 organization of registers in the (coproc==0b1110) encoding space on page G7-5871. 
. VMSAv8-32 organization of registers in the (coproc==0b1111) encoding space on page G7-5874. 
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The AArch32 System register encoding space 


The T32 and A32 instruction sets includes instructions that access the System register encoding space. These 
instructions provide: 


s Access to System registers, including the debug registers, that provide system control, and system status 
information. 
. The cache, branch predictor, and TLB maintenance instructions, and address translation instructions. 


The AArch32 System register interface on page G1-5567 describes the instructions that provide access to these 
registers and instructions. Chapter G8 AArch32 System Register Descriptions describes these registers and 
encodings. 


When accessing 32-bit registers, or executing these instructions, entries in the encoding space are characterized by 
the parameter set {coproc, CRn, opc1, CRm, opc2}. In Armv8 this encoding space is defined only for the coproc values 
0b1110 and @b1111. 





Note 


When accessing 64-bit registers entries in the encoding space are characterized by the parameter set 
{coproc, CRm, opc1}, for the coproc values 0b1110 and 0b1111. A CRm value in this parameter set is equivalent 
to a CRn value in the parameter set for accessing 32-bit registers. 


s Background to the System register interface on page G1-5568 gives more information about this encoding 
model. 





The following describe this encoding space: 
. VMSAv8-32 organization of registers in the (coproc==0b1110) encoding space on page G7-5871. 
. VMSAv8-32 organization of registers in the (coproc==0b1111) encoding space on page G7-5874. 
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The System registers in the (coproc==0b1110) encoding space provide a number of distinct control functions, 
covering: 


. Debug. 
° Trace. 
e Execution environment control, for identification of the trivial Jazelle implementation. 


Because these functions are distinct, the descriptions of these registers are distributed, as follows: 
° In this manual, Debug registers on page G8-6376 describes the Debug registers. 
° The Embedded Trace Macrocell Architecture Specification describes the Trace registers. 


This section summarizes the allocation of the System registers in the (coproc==0b1110) encoding space between 
these different functions, and the register encodings in this space that are reserved. 


The 32-bit System register encodings are classified by the {opc1, CRn, opc2, CRm} values required to access them using 
an MCR or an MRC instruction. The 64-bit System register encodings are classified by the {opc1, CRm} values required 
to access them using an MCRR or an MRRC instruction. For the registers in the (coproc==0b1110) encoding space, the 
opcl value determines the primary allocation of these registers, as follows: 


opel== Debug registers. 
opel== Trace registers. 
opci== Jazelle registers. Jazelle registers are implemented as required for a trivial Jazelle implementation. 


Other opc1 values 
Reserved. 


Note 
Primary allocation of (coproc==0b1110) register function by opc1 value differs from the allocation of 
(coproc==0b1111) registers, where primary allocation is by CRn value for 32-bit register accesses, or CRm value for 
64-bit register accesses. 








For the Debug and Jazelle registers, Table G7-1 on page G7-5872 defines: 
° The {opc1, CRn, opc2, CRm} values used for accessing the 32-bit registers using the MRC and MCR instructions. 
a The {opc1, CRm} values used for accessing the 64-bit register using the MRRC instruction. 


Some Debug registers can also be accessed using the LDC and STC instructions. Table G7-2 on page G7-5873 defines 
the CRn values used for accessing the registers using these instructions. 


Note 

The only permitted uses of the LDC and STC instructions are: 

$ An LDC access to load data from memory to DBGDTRTXint. 
s An STC access to store data to memory from DBGDTRRXint. 





In the LDC and STC syntax descriptions in this Manual, the required coproc value of p14 and CRn value of c5 are given 
explicitly. 
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G7.2.1 Register access instruction arguments, (coproc==0b1110) registers 


Table G7-1 shows the MCR, MRC, and MRRC instruction arguments required for accesses to each register that can be 
visible in the System register interface in the (coproc==0b1110) encoding. 


Table G7-1 Mapping of (coproc==0b1110) MCR, MRC, and MRRC instruction arguments to System 




























































































registers 
Name Width opc1 CRn opc2 CRm 
DBGDIDR& 32-bit 0 c0 0 c0 
DBGDSCRint 32-bit cl 
DBGDCCINT 32-bit c2 
DBGDTRRXint 32-bit c5 
DBGDTRTXint 32-bit c5 
- 32-bit c6 
DBGVCR 32-bit c7 
DBGDTRRXext 32-bit 2 c0 
DBGDSCRext 32-bit c2 
DBGDTRTXext 32-bit c3 
DBGOSECCR 32-bit c6 
DBGBVR<n> 32-bit 4 c0-15> 
DBGBCR<n> 32-bit 5 c0-15> 
DBGWVR<n> 32-bit 6 c0-15> 
DBGWCR<n> 32-bit 7 c0-15> 
DBGDRAR 32-bit cl 0 c0 
64-bit =o à w al 
DBGBXVR<n> 32-bit cl 1 c0-15> 
DBGOSLAR 32-bit 4 c0 
DBGOSLSR 32-bit cl 
DBGOSDLR 32-bit c3 
DBGPRCR 32-bit c4 
DBGDSAR 32-bit c2 0 c0 
64-bit - - c2 
" c4 0-3 c0-15 
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Table G7-1 Mapping of (coproc==0b1110) MCR, MRC, and MRRC instruction arguments to System 
registers (continued) 


Name Width opc1 CRn opc2 CRm 






































DBGCLAIMSET 32-bit 0 c7 6 c8 
DBGCLAIMCLR 32-bit c9 
DBGAUTHSTATUS 32-bit c14 
DBGDEVID2 32-bit 7 c0 
DBGDEVIDI1 32-bit cl 
DBGDEVID 32-bit c2 

- 32-bit 1 c0-c7 0-7 c0-c15 
JIDR® 32-bit 7 c0 0 c0 
JOSCR® 32-bit cl 0 c0 
JMCR" 32-bit c2 0 c0 





- 32-bit All other encodings 


a. IfEL1 cannot use AArch32, this register is OPTIONAL and 
deprecated. See the register description for details. 


b. Not implemented breakpoint and watchpoint register access 
instructions are unallocated. If EL2 is not implemented or 
breakpoint n is not context-aware, DBGBXVR<n> is unallocated. 
CRm encodes <n>, the breakpoint or watchpoint number. 


c. Legacy register. 


Table G7-2 shows the LDC and STC instruction arguments required for accesses to the Debug registers that can be 
accessed using these instructions. 


Table G7-2 Mapping of LDC and STC instruction arguments to System registers 














Name Width CRn Instruction Description 

DBGDTRTXint 32-bit c5 LDC Debug Data Transfer Register, Transmit, Internal View 

DBGDTRRXint 32-bit c5 STC Debug Data Transfer Register, Receive, Internal View 
Note 





In the instruction syntax descriptions for the LDC and STC instructions, the required coproc and CRn values are given 
explicitly as coproc==p14, CRn==c5. 
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VMSAv8-32 organization of registers in the (coproc==0b1111) encoding space 


For 32-bit accesses to the System registers in the (coproc==0b1111) encoding space, the ordered set of parameters 
{CRn, opc1, CRm, opc2} determine the register order. Within this ordering, the CRn value originally provided a 
functional grouping of these registers. As the number of System registers has increased this ordering has become 
less appropriate. 


This document now: 


° Groups the Armv8.0 System registers in the (coproc==0b1111) encoding space by functional group, see 
Functional index of AArch32 registers and System instructions on page K14-7855. 


è Describes all of the Armv8.0 System registers for VMSAv8-32, in Chapter G8 AArch32 System Register 
Descriptions. 


7 Gives additional information about the organization of the VMSAv8-32 System registers in the 
(coproc==0b1111) encoding space, in the remainder of this section. 


Note 


Not all System registers introduced by architectural extensions to Armv8.0 are described in Chapter G8 AArch32 
System Register Descriptions. For information about the System registers introduced by architectural extensions to 
Armv8.0, see Chapter A2 Armv8-A Architecture Extensions. 








This section presents information about the register ordering by {CRn, opc1, CRm, opc2}. It contains the following 
subsections: 


. System register summary for (coproc == 0b1111) encodings by CRn value. 
. Full list of VMSAv8-32 System registers in the (coproc ==0b1111) encoding space on page G7-5877. 





Note 


The ordered listing of (coproc==0b1111) registers by the {CRn, opc1, CRm, opc2} encoding of the 32-bit registers is 
most likely to be useful to those implementing AArch32 state, and to those validating such implementations. 
However, otherwise, the grouping of registers by function is more logical. 





In addition, the indexes in Appendix K14 Registers Index include all of the System registers. 


System register summary for (coproc==0b1111) encodings by CRn value 


Figure G7-1 on page G7-5875 summarizes the grouping of the System registers in the (coproc==0b1111) encoding 
space, for a VMSAv8-32 implementation, by the value of CRn used for a 32-bit access to the register. 
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CRn | opc1 ! CRm l opc2 
c0 +—{0-2, 4}——c0-c2}——{0-7}— ID registers 
c1 +—{0, 4}——{00, c1}——{0-7}—>_ System control registers 
a ! ous ! = Nia ! e d Memory system control registers 
c4 ! 0. A c6 ! 0 > GIC System register *, Debug exception registers 
i — - ama e ze Memory system fault registers 
c7 l {0, 4} ' Various i Various—> Cache maintenance, address translations, legacy operations 
c8 ! {0, 4} i Various l Various» TLB maintenance operations 
c9 +—{0-7}1—-Various—}—{0-7}—» Performance monitors 
c10 --—{0-7}—_1—-Various—1—{0-7}—» Memory mapping registers and TLB operations 





c11 + 10-7} -{c0-c8,c1 5}4+-—{0-7} > Reserved for DMA operations for TCM access 

c12 -H0-2, 4, 6} Various i {0,1}—» System control registers, GIC System registers * 

c13 —=—00, 4}1—Various—+—Various-» Process, Context, Thread ID registers, Activity Monitors registers * 
c14 +—_{0-7} {c0-c15} {0-7}—» Generic Timer registers *, Performance Monitors registers * 

c15 i {0-7} {c0-c15} {0-7}—> IMPLEMENTATION DEFINED registers 











* If implemented 
Figure G7-1 AArch32 System register groupings for (coproc==0b1111), for 32-bit registers 


Note 


For the System registers in the (coproc==0b1111) encoding space, Figure G7-1 gives only an overview of the 
assigned encodings for 32-bit registers for each of the CRn values c0-c15. For more information, see: 





7 The full list of registers in the (coproc==0b1111) encoding space, in Full list of VMUSAv8-32 System registers 
in the (coproc==0b1111) encoding space on page G7-5877, for the definition of the assigned and unassigned 
encodings for that register. 


; The register definitions in Chapter G8 AArch32 System Register Descriptions for any dependencies on the 
implemented Exception levels. 





In general, System register accesses using an unallocated set of {CRn, opc1, CRm, opc2} values are UNDEFINED. 
Behavior of VMSAv8-32 32-bit System registers with (coproc == 0b1111, CRn==c0) described the only exceptions 
to this rule. 


The 32-bit System registers with (coproc==0b1111, CRn==cl15), and the corresponding 64-bit System registers, are 
reserved for implementation defined registers. For more information see Reserved encodings in the VMSAv8-32 
System register (coproc == 0bI1111) space on page G7-5876. 


The HSTR.Tn trap on (coproc==0b1111) System registers 


As General trapping to Hyp mode of Non-secure ELO and EL] accesses to System registers in the 
(coproc==0b1111) encoding space on page G1-5599 describes, when the value of HSTR.Tn is 1, Non-secure PL1 
accesses to System registers in the (coproc==0b1111) encoding space using a CRn or CRm value that corresponds to 
the value of Tn are trapped to EL2, even if the encoding is UNDEFINED when the value of HSTR.Tn is 0. This applies: 


ë For 32 bit register accesses when the value of Rn in the MCR or MRC instruction corresponds to Tn. 
s For 64 bit register accesses when the value of Rm in the MCRR or MRRC instruction corresponds to Tn. 


If there are matching System register encodings that are accessible from Non-secure ELO then those accesses are 
also trapped to EL2 when the value of HSTR.Tn is 1. 


Behavior of VMSAv8-32 32-bit System registers with (coproc==0b1111, CRn==c0) 


In the (coproc==0b1111) encoding space, the 32-bit System registers with (CRn==c0) provide device and feature 
identification. 
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Table G7-3 on page G7-5878 shows all of the architecturally required System registers with {coproc==0b1111, 
CRn==c0}. The behavior of 32-bit System register encodings in this group that are not shown in the table, and 
encodings that are part of an unimplemented Exception level, depends on the value of opc1, and possibly on the 
value of CRm and opc2, as follows: 


opcl == All write accesses to the encodings are UNDEFINED. 
For read accesses: 
: The following encodings return an UNKNOWN value: 
CRm==3, opc2=={0, 1, 2}. 
—  CRm== {4, 6, 7}, opc2=={0, 1}. 
CRm==5, opc2== {0, 1, 4, 5}. 
° All other encodings are RESO. 
opcl > 0 All accesses to the encodings are UNDEFINED. 








See also Accesses to unallocated encodings in the (coproc==0bI111x) encoding space on page G8-5894. 


Note 


Some of these registers were previously described as being part of the CPUID identification scheme, see The 
CPUID identification scheme on page G8-5893. 








Reserved encodings in the VMSAv8-32 System register (coproc==0b1111) space 


AArch32 state reserves a number of regions in the (coproc==0b1111) encoding space for IMPLEMENTATION 
DEFINED System registers. These reservations are defined in terms of the encoding of 32-bit accesses to the System 
register encoding space. That is, they are defined by the reserved 32-bit {CRn, opc1, CRm, opc2} encodings. 


In Armv8, reserved encodings that do not have an IMPLEMENTATION DEFINED function are UNDEFINED. 
The following subsections give more information about these reserved encodings: 

è Reserved 32-bit encodings with {coproc==0b1111, CRn==c9}. 

$ Reserved 32-bit encodings with {coproc == 0b1111, CRn==c10}. 

. Reserved 32-bit encodings with {coproc == 0b1111, CRn==c11} on page G7-5877. 

. Reserved 32-bit encodings with {coproc ==0b1111, CRn==c15} on page G7-5877. 


Reserved 32-bit encodings with {coproc==0b1111, CRn==c9} 


In the AArch32 encoding space, for 32-bit encodings with {coproc==0b1111, CRn==c9}, the following encodings 
are reserved for IMPLEMENTATION DEFINED purposes: 


è Encodings with {coproc==0b1111, CRn==c9, opc1== {0-7}, opc2== {0-7}, CRm== {c0-c2, c5-c8}} are 
reserved for IMPLEMENTATION DEFINED branch predictor, cache, and TCM operations. 


. Encodings with {coproc==0b1111, CRn==c9, opcl== {0-7}, opc2== {0-7}, CRm==c15 } are reserved for 
IMPLEMENTATION DEFINED performance monitors. 
Note 


These are distinct from the OPTIONAL Arm Performance Monitors Extension, the registers for which use the 
encoding space {coproc==0b1111, CRn==c9, opcl== {0-7}, opc2== {0-7}, CRm== {c12-c14}}. 








Reserved 32-bit encodings with {coproc==0b1111, CRn==c10} 


In the AArch32 encoding space, for 32-bit encodings with {coproc==0b1111, CRn==c10}, the following encodings 
are reserved for IMPLEMENTATION DEFINED purposes: 


° Encodings with {coproc==0b1111, CRn==c10, opc== {0-7}, CRm== {c0, c1, c4, c8} } are reserved for 
IMPLEMENTATION DEFINED TLB lockdown operations. 
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Reserved 32-bit encodings with {coproc==0b1111, CRn==c1}} 


In the AArch32 encoding space, for 32-bit encodings with {coproc==0b1111, CRn==c11}, the following encodings 
are reserved for IMPLEMENTATION DEFINED purposes: 


. Encodings with {coproc==0b1111, CRn==c11, opc== {0-7}, CRm== {c0-c8, c15}} are reserved for 
IMPLEMENTATION DEFINED DMA operations for TCM access. 


In Armv8, the remainder of the AArch32 {coproc==0b1111, CRn==c11} encoding space is UNDEFINED. 


Reserved 32-bit encodings with {coproc==0b1111, CRn==c15} 


Armv8 reserves the AArch32 System register encodings with (coproc==0b1111, CRn==c15) for IMPLEMENTATION 
DEFINED purposes, and does not impose any restrictions on the use of the these encodings. The documentation of 
the Arm implementation must describe fully any registers implemented in the {coproc==0b1111, CRn==c15} 
encoding space. Normally, for processor implementations by Arm, this information is included in the Technical 
Reference Manual for the processor. 


Typically, an implementation uses the {coproc==0b1111, CRn==c15} encodings to provide test features, and any 
required configuration options that are not covered by this Manual. 


This reservation means that the AArch32 64-bit encodings with {coproc==0b1111, CRnm==c15} are also reserved for 
IMPLEMENTATION DEFINED purposes, without any restrictions on the use of the these encodings. 


G7.3.2 Full list of VMSAv8-32 System registers in the (coproc==0b1111) encoding space 
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Table G7-3 on page G7-5878 shows the System registers in the (coproc==0b1111) encoding space in VMSAv8-32, 
in the order of the {CRn, opc1, CRm, opc2} parameter values used in MCR or MRC accesses to the 32-bit registers: 


$ For MCR or MRC accesses to the 32-bit registers, CRn is the primary identifier of the target System register for 
the access. This applies, also, to MCR or MRC instructions that provide 32-bit accesses to a single word of a 64-bit 
System register. 


$ For MCRR or MRRC accesses to the 64-bit registers, CRm is the primary identifier of the target System register for 
the access. Table G7-3 on page G7-5878 orders the 64-bit registers with the 32-bit registers accessed using 
the same primary register identifier. For example, the 64-bit encoding of TTBRO, that is accessed with 
(CRm==c2), is listed with the 32-bit registers that are accessed with (CRn==c2). 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order 






















































































































































































Name Width CRn opc1 CRm opc2 Source 
MIDR 32-bit c0 0 c0 0 v8.0 
CTR 32-bit 1 v8.0 
TCMTR 32-bit 2 v8.0 
TLBTR 32-bit 3 v8.0 
MIDR 32-bit 4, 64,7 v8.0 
MPIDR 32-bit 5 v8.0 
REVIDR 32-bit 62 v8.0 
ID_PFRO 32-bit cl 0 v8.0 
ID_PFRI 32-bit 1 v8.0 
ID_DFRO 32-bit 2 v8.0 
ID_AFRO 32-bit 3 v8.0 
ID_MMFRO 32-bit 4 v8.0 
ID_MMFRI 32-bit 5 v8.0 
ID_MMFR2 32-bit 6 v8.0 
ID_MMFR3 32-bit 7 v8.0 
ID_ISARO 32-bit c2 0 v8.0 
ID_ISARI 32-bit 1 v8.0 
ID_ISAR2 32-bit 2 v8.0 
ID_ISAR3 32-bit 3 v8.0 
ID_ISAR4 32-bit 4 v8.0 
ID_ISAR5 32-bit 5 v8.0 
ID_MMFR4 32-bit 6 v8.0 
ID_PFR2 32-bit c3 4 v8.0 
CCSIDR 32-bit 1 c0 0 v8.0 
CLIDR 32-bit 1 v8.0 
CCSIDR2 32-bit 2 v8.3b 
AIDR 32-bit 7 v8.0 
CSSELR 32-bit 2 c0 0 v8.0 
VPIDR¢ 32-bit 4 c0 0 v8.0 
VMPIDR¢ 32-bit > v8.0 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 






























































































































































Name Width CRn opc1 CRm opc2 Source 
SCTLR 32-bit cl 0 c0 0 v8.0 
ACTLR 32-bit 1 v8.0 
CPACR 32-bit 2 v8.0 
ACTLR2 32-bit 3 v8.0 
SCR4 32-bit cl 0 v8.0 
SDER¢ 32-bit 1 v8.0 
NSACR¢ 32-bit 2 v8.0 
TRFCR 32-bit c2 1 v8.4 
SDCR 32-bit c3 1 v8.0 
HSCTLR" 32-bit 4 c0 0 v8.0 
HACTLR" 32-bit 1 v8.0 
HACTLR2° 32-bit 3 v8.0 
HCR° 32-bit cl 0 v8.0 
HDCRe 32-bit 1 v8.0 
HCPTR®° 32-bit 2 v8.0 
HSTR°* 32-bit 3 v8.0 
HCR2°¢ 32-bit 4 v8.0 
HACR: 32-bit 7 v8.0 
HTRFCR 32-bit c2 1 v8.4 
TTBRO 32-bit c2 0 c0 0 v8.0 
TTBRO 64-bit - 0 c2 - v8.0 
TTBR1 32-bit c2 0 c0 1 v8.0 
TTBR1 64-bit - 1 c2 - v8.0 
TTBCR 32-bit c2 0 c0 2 v8.0 
TTBCR2 32-bit 3 v8.2 
HTCR*¢ 32-bit 4 c0 2 v8.0 
VTCR: 32-bit cl 2 v8.0 
HTTBR° 64-bit - 4 c2 - v8.0 
VTTBR® 64-bit - 6 c2 - v8.0 
DACR 32-bit c3 0 c0 0 v8.0 
ICC_PMR 32-bit c4 0 c6 0 GICe 
ICV_PMR 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 






















































































































































































Name Width CRn opc1 CRm opc2 Source 
DSPSRf 32-bit c4 3 c5 0 v8.0 
DLR 32-bit 1 v8.0 
DFSR 32-bit c5 0 c0 0 v8.0 
IFSR 32-bit 1 v8.0 
ADFSR 32-bit cl 0 v8.0 
AIFSR 32-bit 1 v8.0 
ERRIDR 32-bit c3 0 RASS 
ERRSELR 32-bit 1 RASS 
ERXFR 32-bit c4 0 RASS 
ERXCTLR 32-bit 1 RASS 
ERXSTATUS 32-bit 2 RASS 
ERXADDR 32-bit 3 RASS 
ERXFR2 32-bit 4 RASS 
ERXCTLR2 32-bit 5 RASS 
ERXADDR2 32-bit 7 RASS 
ERXMISCO 32-bit c5 0 RASS 
ERXMISC1 32-bit 1 RASS 
ERXMISC4 32-bit 2 RASS 
ERXMISC5 32-bit 3 RASS 
ERXMISC2 32-bit 4 RASS 
ERXMISC3 32-bit 5 RASS 
ERXMISC6 32-bit 6 RASS 
ERXMISC7 32-bit i RASS 
HADFSR° 32-bit 4 cl 0 v8.0 
HAIFSR 32-bit 1 v8.0 
HSR° 32-bit c2 0 v8.0 
VDFSR 32-bit 3 RASS 
DFAR 32-bit c6 0 c0 0 v8.0 
IFAR 32-bit 2 v8.0 
HDFAR® 32-bit 4 c0 0 v8.0 
HIFAR® 32-bit 2 v8.0 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 






















































































































































































Name Width CRn opc1 CRm opc2 Source 
HPFAR®* 32-bit c6 4 c0 4 v8.0 
ICIALLUIS 32-bit c7 0 cl 0 v8.0 
BPIALLIS 32-bit 6 v8.0 
CFPRCTX 32-bit c3 4 v8.0h 
CPPRCTX 32-bit 5 v8.0h 
DVPRCTX 32-bit 7 v8.0h 
PAR 32-bit c4 0 v8.0 
PAR 64-bit - 0 c7 - v8.0 
ICIALLU 32-bit c7 0 c5 0 v8.0 
ICIMVAU 32-bit 1 v8.0 
CP15ISBi 32-bit 4 v8.0 
BPIALL 32-bit 6 v8.0 
BPIMVA 32-bit 7 v8.0 
DCIMVAC 32-bit c6 1 v8.0 
DCISW 32-bit 2 v8.0 
ATS1CPR 32-bit c8 0 v8.0 
ATS1CPW 32-bit 1 v8.0 
ATSICUR 32-bit 2 v8.0 
ATS1CUW 32-bit 3 v8.0 
ATS12NSOPR4 32-bit 4 v8.0 
ATS12NSOPW4 32-bit 5 v8.0 
ATS12NSOUR4 32-bit 6 v8.0 
ATS12NSOUW4 32-bit 7 v8.0 
DCCMVAC 32-bit c10 1 v8.0 
DCCSW 32-bit 2 v8.0 
CP15DSBi 32-bit 4 v8.0 
CP15DMBi 32-bit 5 v8.0 
DCCMVAU 32-bit cll 1 v8.0 
DCCIMVAC 32-bit c14 1 v8.0 
DCCISW 32-bit 2 v8.0 
ATS1HR°® 32-bit 4 c8 0 v8.0 
ATS1HW° 32-bit 1 v8.0 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 


































































































































































































Name Width CRn opc1 CRm opc2 Source 
TLBIALLIS 32-bit c8 0 c3 0 v8.0 
TLBIMVAIS 32-bit 1 v8.0 
TLBIASIDIS 32-bit 2 v8.0 
TLBIMVAAIS 32-bit 3 v8.0 
TLBIMVALIS 32-bit 5 v8.0 
TLBIMVAALIS 32-bit 7 v8.0 
ITLBIALL 32-bit c5 0 v8.0 
ITLBIMVA 32-bit 1 v8.0 
ITLBIASID 32-bit 2 v8.0 
DTLBIALL 32-bit c6 0 v8.0 
DTLBIMVA 32-bit 1 v8.0 
DTLBIASID 32-bit 2 v8.0 
TLBIALL 32-bit c7 0 v8.0 
TLBIMVA 32-bit 1 v8.0 
TLBIASID 32-bit 2 v8.0 
TLBIMVAA 32-bit 3 v8.0 
TLBIMVAL 32-bit 5 v8.0 
TLBIMVAAL 32-bit 7 v8.0 
TLBIIPAS2IS 32-bit 4 c0 1 v8.0 
TLBIIPAS2LIS 32-bit 5 v8.0 
TLBIALLHIS¢ 32-bit c3 0 v8.0 
TLBIMVAHIS¢ 32-bit 1 v8.0 
TLBIALLNSNHISe 32-bit 4 v8.0 
TLBIMVALHIS 32-bit 5 v8.0 
TLBIIPAS2 32-bit c4 1 v8.0 
TLBIIPAS2L 32-bit 5 v8.0 
TLBIALLH* 32-bit c7 0 v8.0 
TLBIMVAH¢* 32-bit 1 v8.0 
TLBIALLNSNH*¢ 32-bit 4 v8.0 
TLBIMVALH 32-bit 5 v8.0 
Reservedi 32-bit c9 0-7 c0- c2 0-7 - 
Reservedi 32-bit c5- c8 0-7 - 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 

































































































































































Name Width CRn opc1 CRm opc2 Source 
PMCRkK 32-bit c9 0 c12 0 v8.0 
PMCNTENSETK 32-bit 1 v8.0 
PMCNTENCLRK 32-bit 2 v8.0 
PMOVSRk 32-bit 3 v8.0 
PMSWINCK 32-bit 4 v8.0 
PMSELRk 32-bit 5 v8.0 
PMCEIDOk 32-bit 6 v8.0 
PMCEIDI1k 32-bit 7 v8.0 
PMCCNTRE 32-bit c13 0 v8.0 
PMCCNTR_ELO* 64-bit - 0 c9 - v8.0 
PMXEVTY PERK 32-bit c9 0 c13 1 v8.0 
PMXEVCNTRK 32-bit 2 v8.0 
PMUSERENR£ 32-bit c14 0 v8.0 
PMINTENSETK 32-bit 1 v8.0 
PMINTENCLRkK 32-bit 2 v8.0 
PMOVSSET® k 32-bit 3 v8.0 
PMCEID2k 32-bit 4 v8.1 
PMCEID3k 32-bit 5 v8.1 
PMMIR 32-bit 6 v8.4 
Reserved! 32-bit 0-7 c15 0-7 - 
Reserved™ 32-bit c10 0 c0- cl 0-7 - 
PRRR® 32-bit c2 0 v8.0 
MAIRO® 32-bit v8.0 
NMRR® 32-bit 1 v8.0 
MAIRI” 32-bit v8.0 
AMAIRO 32-bit c3 0 v8.0 
AMAIR1 32-bit 1 v8.0 
Reserved™ 32-bit c4, c8 0-7 - 
Reserved™ 32-bit 1-3 c0, cl, c4, c8 0-7 - 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 









































































































































Name Width CRn opc1 CRm opc2 Source 
Reserved™ 32-bit c10 4 c0, cl 0-7 - 
HMAIRO0¢ 32-bit c2 0 v8.0 
HMAIR1° 32-bit 1 v8.0 
HAMAIRO¢ 32-bit c3 0 v8.0 
HAMAIR1° 32-bit 1 v8.0 
Reserved™ 32-bit c4, c8 0-7 Š 
Reserved™ 32-bit 5-7 c0, cl, c4, c8 0-7 - 
Reserved? 32-bit cll 0-7 c0-c8 0-7 - 
Reserved? 32-bit c15 0-7 - 
ICC_SGIIR 64-bit - 0 c12 - GICe 
VBAR 32-bit c12 0 c0 0 v8.0 
MVBAR¢ 32-bit 1 v8.0 
RVBAR 32-bit v8.0 
RMRP 32-bit 2 v8.0 
ISR4 32-bit cl 0 v8.0 
DISR 32-bit 1 RASS 
VDISR 32-bit 4 cl 1 RASS 
ICC_IARO 32-bit 0 c8 0 GICe 
ICV_IARO 
ICC_EOIRO 32-bit 1 GICe 
ICV_EOIRO 
ICC_HPPIRO 32-bit 2 GICe 
ICV_HPPIRO 
ICC_BPRO 32-bit 3 GIC® 
ICV_BPRO 
ICC_APORO 32-bit 4 GICe 
ICV_APORO 
ICC_APOR1 32-bit 5 GIC* 
ICV_APORI 
ICC_APOR2 32-bit 6 GIC* 
ICV_APOR2 
ICC_APOR3 32-bit 7 GICe 
ICV_APOR3 

G7-5884 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential 


ID070919 


AArch32 System Register Encoding 
G7.3 VMSAv8-32 organization of registers in the (coproc==0b1111) encoding space 


Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 


























































































































Name Width CRn opc1 CRm opc2 Source 

ICC_API1RO 32-bit c12 0 c9 0 GICe 

ICV_AP1RO 

ICC_APIRI 32-bit 1 GIC¢ 

ICV_APIRI1 

ICC_APIR2 32-bit 2 GICe 

ICV_AP1R2 

ICC_API1R3 32-bit 3 GICe 

ICV_APIR3 

ICC_DIR 32-bit cll 1 GICe 

ICV_DIR 

ICC_RPR 32-bit 3 GICe 

ICV_RPR 

ICC_IARI 32-bit c12 0 GICe 

ICV_IARI 

ICC_EOIR1 32-bit 1 GIC® 

ICV_EOIR1 

ICC_HPPIR1 32-bit 2 GICe 

ICV_HPPIR1 

ICC_BPRI 32-bit 3 GICe 

ICV_BPRI 

ICC_CTLR 32-bit 4 GIC* 

ICV_CTLR 

ICC_SRE 32-bit 5 GICe 

ICC_IGRPENO 32-bit 6 GICe 

ICV_IGRPENO 

ICC_IGRPENI1 32-bit 7 GIC* 

ICV_IGRPENI1 

ICC_ASGIIR 64 bit - 1 c12 - GIC® 

ICC_SGIOR 64 bit - 2 c12 7 GIC¢ 

HVBAR¢ 32-bit c12 4 c0 0 v8.0° 

HRMRP 32-bit 2 v8.0° 

ICH_APORO 32-bit c8 0 GICe 

ICH_APORI1 32-bit 1 GICe 

ICH_APOR2 32-bit 2 GIC¢ 

ICH_APOR3 32-bit 3 GICe 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 





































































































































































































Name Width CRn opc1 CRm opc2 Source 
ICH_AP1RO 32-bit c12 4 c9 0 GICe 
ICH_APIR1 32-bit l GIC® 
ICH_APIR2 32-bit 2 GIC® 
ICH_APIR3 32-bit 3 GICe 
ICC_HSRE 32-bit 5 GICe 
ICH_HCR 32-bit cll 0 GIC¢ 
ICH_VTR 32-bit 1 GICe 
ICH_MISR 32-bit 2 GICe 
ICH_EISR 32-bit 3 GIC¢ 
ICH_ELRSR 32-bit 5 GIC® 
ICH_VMCR 32-bit 7 GICe 
ICH_LR<n>, for n==0 to 7 32-bit c12 0-7 GICe 
ICH_LR<n>, for n==8 to 15 32-bit c13 0-7 GIC®e 
ICH_LRC<n>, for n==0 to 7 32-bit c14 0-7 GICe 
ICH_LRC<n>, for n==8 to 15 32-bit c15 0-7 GICe 
ICC_MCTLR 32-bit 6 c12 4 GIC® 
ICC_MSRE 32-bit 5 GICe 
ICC_MGRPEN1 32-bit 7 GICe 
FCSEIDR 32-bit c13 0 c0 0 v8.0 
CONTEXTIDR 32-bit 1 v8.0 
TPIDRURW 32-bit 2 v8.0 
TPIDRURO 32-bit 3 v8.0 
TPIDRPRW 32-bit 4 v8.0 
AMCR 32-bit c2 0 AMU% 
AMCFGR 32-bit c2 l AMU®9 
AMCGCR 32-bit c2 2 AMU%9 
AMUSERENR 32-bit c2 3 AMU%9 
AMCNTENCLRO 32-bit c2 4 AMU% 
AMCNTENSETO 32-bit c2 5 AMU% 
AMCNTENCLR1 32-bit c3 0 AMU% 
AMCNTENSET1 32-bit c3 1 AMU% 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 

































































































































































Name Width CRn opc1 CRm opc2 Source 
AMEVTYPERO<n>, for n==0 to 7 32-bit c13 0 c6 0-7 AMU4 
AMEVTYPERO<p>, for n==8 to 15 32-bit c7 AMU% 
AMEVTYPER1<n>, for n==0 to 7 32-bit c14 AMU% 
AMEVTYPER1<n>, for n==8 to 15 32-bit c15 AMUa4 
AMEVCNTRO<n>, for n==0 to 7 64-bit - 0-7 c0 - AMUS9 
AMEVCNTRO<n>, for n==8 to 15 64-bit - cl AMU% 
AMEVCNTRI<n> for n==0 to 7 64-bit - c4 AMU4 
AMEVCNTRI<n>, for n==8 to 15 64-bit - c5 AMU% 
HTPIDR® 32-bit c13 4 c0 2 v8.0 
CNTPCT® 64-bit - 0 c14 - v8.0 
CNTFRQ" 32-bit cl4 0 c0 0 v8.0 
CNTKCTL” 32-bit cl 0 v8.0 
CNTP_TVALt 32-bit c2 0 v8.0 
CNTP_CTL’ 32-bit 1 v8.0 
CNTV_TVAL* 32-bit c3 0 v8.0 
CNTV_CTL'" 32-bit 1 v8.0 
PMEVCNTR<n>, for n==0 to 7k 32-bit c8 0-7 v8.0 
PMEVCNTR<n>, for n==8 to 15* 32-bit c9 0-7 v8.0 
PMEVCNTR<n>, for n==16 to 23k 32-bit c10 0-7 v8.0 
PMEVCNTR<n>, for n==24 to 30k 32-bit cll 0-6 v8.0 
PMEVTYPER<n>, for n==0 to 7 32-bit c12 0-7 v8.0 
PMEVTYPER<p>, for n==8 to 15k 32-bit c13 0-7 v8.0 
PMEVTYPER<p>, for n==16 to 23k 32-bit cl4 0-7 v8.0 
PMEVTYPER<n>, for n==17 to 30k 32-bit c15 0-6 v8.0 
PMCCFILTRk 32-bit c15 7 v8.0 
CNTVCT! 64-bit - 1 c14 - v8.0 
CNTP_CVAL" 64-bit - 2 c14 - v8.0 
CNTV_CVAL" 64-bit - 3 c14 - v8.0 
CNTVOFFs 64-bit - 4 c14 - v8.0 
CNTHCTL? 32-bit c14 4 cl 0 v8.0 
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Table G7-3 VMSAv8-32 (coproc==0b1111) register summary, in MCR/MRC parameter order (continued) 

















Name Width CRn opc1 CRm opc2 Source 
CNTHP_TVAL" 32-bit c14 4 c2 0 v8.0 
CNTHP CTL? 32-bit 1 v8.0 
CNTHP_CVAL' 64-bit - 6 c14 - v8.0 
Reservedt 32-bit c15 0-7 c0-c15 0-7 - 





a. REVIDR is an optional register. If it is not implemented, the encoding with opc2 set to 2 is an alias of MIDR. 

b. When ARMv8.3-CCIDX is implemented, CCSIDR2 is implemented. 

c. Implemented only as part of EL2 when EL2 is using AArch32. Otherwise, encoding is unallocated and UNDEFINED. 

d. Implemented only as part of EL3 when EL3 is using AArch32. Otherwise, encoding is unallocated and UNDEFINED. 

e. GIC System register, see About the GIC System registers. As that subsection describes, each ICV_* register uses the same encoding as the 
corresponding ICC_* register. 

f. This register is accessible only in Debug state. 

g. RAS Extension System registers, see The Reliability, Availability, and Serviceability Extension (RAS Extension) on page A2-90. 


h. When ARMv8.0-PredInv is implemented, the execution and data prediction restriction instructions are implemented, see Execution and data 
prediction restriction System instructions on page G4-5708. 


i. For performance reasons, Arm deprecates any use of these memory barrier operations. 


j. Reserved for IMPLEMENTATION DEFINED branch predictor, cache, and TCM operations, see Reserved 32-bit encodings with 
{coproc == 0b1111, CRn==c9} on page G7-5876. 


k. Performance Monitors Extension System register, see Performance Monitors registers on page G8-6479. 





1. Reserved for IMPLEMENTATION DEFINED performance monitors, see Reserved 32-bit encodings with {coproc==O0bI111, CRn==c9} on 
page G7-5876. 


m. Reserved for IMPLEMENTATION DEFINED TLB lockdown operations, see Reserved 32-bit encodings with {coproc == 0b1111, CRn==c10} on 
page G7-5876. 


n. When an implementation is using the Long descriptor translation table format, these encodings access the MAIRO and MAIR1 registers. 
Otherwise, they use PRRR and NMRR. 

o. Reserved for IMPLEMENTATION DEFINED DMA operations for TCM access, see Reserved 32-bit encodings with {coproc==0b1I111, 
CRn==cl11} on page G7-5877. 

p. Only one of RMR and HRMR is implemented, corresponding to the highest implemented Exception level, and the register is implemented 
only if that Exception level is using AArch32. 


q. Activity Monitors System register, see Activity Monitors registers on page G8-6542. 
r. Generic Timer System register, see Generic Timer registers on page D13-3685. 


s. Implemented as RW as part of the Generic Timer on an implementation that includes EL2 and when EL2 is using AArch32. For more 
information, see Status of the CNTVOFF register on page G6-5863. 


t. Reserved for IMPLEMENTATION DEFINED purposes, see Reserved 32-bit encodings with {coproc==0bI1111, CRn==c15} on page G7-5877. 


About the GIC System registers 


From version 3.0 of the GIC architecture specification, the specification defines three groups of System registers, 
identified by the prefix of the register name: 





ICC_ GIC physical CPU interface System registers. 

ICH_ GIC virtual interface control System registers. 

ICV_ GIC Virtual CPU interface System registers. 
Note 


These registers are in addition to the GIC memory-mapped register groups GICC_, GICD_, GICH_, GICR_, 
GICV_,andGITS_. 








In VMSAv8-32, the GIC System registers are all in the (coproc==0b1111) encoding space with (CRn==c12). The 
ICV_* registers have the same {CRn, opcl, CRm, op2} encodings as the corresponding ICC_* registers. For these 
encodings, GIC register configuration fields determine which register is accessed. 
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When implemented, the GIC System registers form part of an Arm processor implementation, and therefore these 
registers are included in the register summaries. However, the registers are defined only in the GIC Architecture 
Specification. 


For more information see the ARM® Generic Interrupt Controller Architecture Specification, GIC architecture 
version 3.0 and version 4.0 (ARM IHI 0069). 
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This chapter describes each of the AArch32 System registers. 


It contains the following sections: 


About the AArch32 System registers on page G8-5892. 
General system control registers on page G8-5907. 
Debug registers on page G8-6376. 

Performance Monitors registers on page G8-6479. 
Activity Monitors registers on page G8-6542. 

RAS registers on page G8-6579. 

Generic Timer registers on page G8-6627. 
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G8.1 


G8.1.1 


G8.1.2 


G8-5892 


About the AArch32 System registers 


For general information about the AArch32 System registers, see: 


In Chapter G5: 


. About the System registers for VUSAv8-32 on page G5-5850. 
. Functional grouping of VMSAv8-32 System registers on page G5-5856. 


In Chapter G7: 


VMSAVv8-32 organization of registers in the (coproc==0b1110) encoding space on 
page G7-5871. 


` VMSAv8-32 organization of registers in the (coproc ==0b1111) encoding space on 
page G7-5874. 


In this chapter: 


° Fixed values in the System register descriptions. 

- General behavior of System registers. 

. Principles of the ID scheme for fields in ID registers on page G8-5902. 
° About AArch32 System register accesses on page G8-5904. 


The remainder of this chapter describes the AArch32 System registers, in the following sections: 


General system control registers on page G8-5907. 
Debug registers on page G8-6376. 

Performance Monitors registers on page G8-6479. 
Generic Timer registers on page G8-6627. 


Fixed values in the System register descriptions 


See Fixed values in AArch32 instruction and System register descriptions on page F2-3915. This section defines 
how the glossary terms RAZ, RESO, RAO, and RES1 can be represented in the System register descriptions. 


General behavior of System registers 


Except where indicated, System registers are 32-bits wide. As stated in About the System registers for VMSAv8-32 
on page G5-5850, there are some 64-bit registers, and these include cases where software can access either a 32-bit 
view or a 64-bit view of a register. The register summaries, and the individual register descriptions, identify the 
64-bit registers and how they can be accessed. 


The following sections give information about the general behavior of these registers: 


Register names. 

Read-only bits in read/write registers on page G8-5893. 

The CPUID identification scheme on page G8-5893. 
IMPLEMENTATION DEFINED performance monitors on page G8-5893. 


UNPREDICTABLE, CONSTRAINED UNPREDICTABLE, and UNDEFINED behavior for AArch32 System 
register accesses on page G8-5893. 


Read-only and write-only register encodings on page G8-5895. 
Reset behavior of AArch32 System registers on page G8-5896. 
Synchronization of changes to AArch32 System registers on page G8-5896. 


Unless otherwise indicated, information in the listed sections applies to all AArch32 System registers 


See also About AArch32 System register accesses on page G8-5904. 


Register names 


The Arm architecture guarantees not to define any register name prefixed with JMP_as part of the standard Arm 
architecture. 
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Note 


Arm strongly recommends that any register names created in the IMPLEMENTATION DEFINED register spaces be 
prefixed with JMP_, where appropriate. 





Read-only bits in read/write registers 


Some read/write registers include bits that are read-only. These bits ignore writes. 


The CPUID identification scheme 


The ID _* registers were originally called the CPUID identification scheme registers. However, functionally, there 
is no value in separating these registers from the slightly larger Identification registers functional group. See 
Table K14-22 on page K 14-7856 for a list of the ID_ * registers. 


IMPLEMENTATION DEFINED performance monitors 


VMSAV8-32 reserves some additional System register encodings in the (coproc==0b1111) encoding space for 
optional additional IMPLEMENTATION DEFINED performance monitors. Table G8-1 shows the allocation of these 
encodings: 


Table G8-1 Performance Monitors System register encoding allocations 





CRn opci 


CRm opc2 Name Width Type 





c9 0-7 


c12-c14 0-7 Performance Monitors Extension registers, see Table K14-23 on 32-bit RW orRO@ 


page K14-7857 





c15 0-7 IMPLEMENTATION DEFINED 32-bit b 


a. The table referenced in the Name entry shows the type of each of the OPTIONAL Performance Monitors Extension registers. 


b. Access depends on the register or operation, and is IMPLEMENTATION DEFINED. 
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AArch32 System register accesses 


This section defines UNPREDICTABLE and UNDEFINED behaviors for accesses to System registers, including those 
cases where the Armv8 behavior is CONSTRAINED UNPREDICTABLE. 


In AArch32 state the following operations are UNDEFINED: 


e All LDC and STC accesses, except for the LDC access to DBGDTRTXint and the STC access to DBGDTRRXint 
specified in Table G7-2 on page G7-5873. 


° All MCRR and MRRC operations to the (coproc==0b111x) encoding space, except for those explicitly defined as 
accessing 64-bit System registers specified in Table G7-1 on page G7-5872 and Table G7-3 on 
page G7-5878. 


Unless otherwise indicated in the individual register descriptions: 
° Reserved fields in registers are RESO. 


e Assigning a reserved value to a field has a CONSTRAINED UNPREDICTABLE effect, see Reserved values in 
System and memory-mapped registers and translation table entries on page K1-7628. 


The following subsections give more information about UNPREDICTABLE, CONSTRAINED UNPREDICTABLE, and 
UNDEFINED behavior for accesses to the (coproc==0b111x) encoding space: 


. Accesses to unallocated encodings in the (coproc==0b111x) encoding space on page G8-5894. 
. Additional rules for MCR and MRC accesses to System registers on page G8-5894. 
$ Effects of EL3 and EL2 on System register accesses on page G8-5894. 
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Accesses to unallocated encodings in the (coproc==0b111x) encoding space 


In Armv8-A, accesses to unallocated register encodings in the (coproc==0b111x) encoding space are UNDEFINED. 





Note 


In Armv7, except for 32-bit registers encoded with a CRn value of c12, accesses to unallocated 32-bit registers were 
UNPREDICTABLE. The Armv8 CONSTRAINED UNPREDICTABLE behavior of these accesses is that they are UNDEFINED, 
see Unallocated System register access instructions on page K1-7609. 





Additional rules for MCR and MRC accesses to System registers 


The following operations are CONSTRAINED UNPREDICTABLE for all encodings in the (coproc==0b111x) encoding 
space: 
. All MCR operations from the PC. 


$ All MRC operations to APSR_nzcv, except for the (coproc==0b1110) MRC operation to APSR_nzcv from 
DBGDSCRint. 


The CONSTRAINED UNPREDICTABLE behavior of these operations is that they are UNDEFINED, see Unallocated 
System register access instructions on page K1-7609. 


For registers and operations that are accessible from a particular Privilege level, any attempt to access those registers 
from a lower Privilege level is UNDEFINED. 


Some individual registers can be made inaccessible by setting configuration bits, possibly including 
IMPLEMENTATION DEFINED configuration bits, to disable access to the register. The effects of the 
architecturally-defined configuration bits are defined individually in this manual. Unless explicitly stated otherwise 
in this manual, setting a configuration bit to disable access to a register results in the register becoming UNDEFINED 
for MRC and MCR accesses. 


See also Read-only and write-only register encodings on page G8-5895. 


Effects of EL3 and EL2 on System register accesses 


EL2 and EL3 introduce classes of System registers, described in Classification of System registers on 
page G5-5850. Some of these classes of register are either: 


. Accessible only from certain modes or states. 
° Accessible from certain modes or states only when configuration settings permit the access. 


Accesses to these registers that are not permitted are UNDEFINED, meaning execution of the register access 
instruction generates an Undefined Instruction exception. 


— Note 


This section applies only to registers that are accessible from some modes and states. That is, it applies only to 
register access instructions using an encoding that, under some circumstances, would perform a valid register 
access. 


The following register classes restrict access in this way: 


Restricted access System registers 
This register class is defined in any implementation that includes EL3. 


Restricted access registers other than the NSACR are accessible only from Secure EL3 modes. All 
other accesses to these registers are UNDEFINED. 
The NSACR is a special case of a Restricted access register and: 
° The NSACR is: 
— Read/write accessible from Secure PL1 modes. 
— Is Read-only accessible from Non-secure PL2 and PL1 modes. 
° All other accesses to the NSACR are UNDEFINED. 
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For more information, including behavior when EL3 is using AArch64 or is not implemented, see 
Restricted access System registers on page G5-5851. 


Configurable access System registers 


This register class is defined in any implementation that includes EL3. 


Most Configurable access registers are accessible from Non-secure state only if control bits in the 
NSACR permit Non-secure access to the register. Otherwise, a Non-secure access to the register is 
UNDEFINED. 


For other Configurable access registers, control bits in the NSACR control the behavior of bits or 
fields in the register when it is accessed from Non-secure state. That is, Non-secure accesses to the 
register are permitted, but the NSACR controls how they behave. The only architecturally-defined 
register of this type is the CPACR. 


For more information, see Configurable access System registers on page G5-5851. 


EL2-mode System registers 


This register class is defined only in an implementation that includes EL2. 
EL2-mode registers are accessible only from: 

. The Non-secure EL2 mode, Hyp mode. 

° Secure Monitor mode when SCR.NS is set to 1. 

All other accesses to these registers are UNDEFINED. 


For more information, see Hyp mode read/write registers in the (coproc==0b1111) encoding space 
on page G5-5852 and Hyp mode encodings for shared (coproc ==0b1111) System registers on 
page GS-5852. 


EL2-mode write-only operations 


This register class is defined only in an implementation that includes EL2. 

EL2-mode write-only operations are accessible only from: 

. The Non-secure EL2 mode, Hyp mode. 

. Secure Monitor mode, regardless of the value of SCR. NS. 

Write accesses to these operations are: 

° CONSTRAINED UNPREDICTABLE in Secure EL3 modes other than Monitor mode. 
. UNDEFINED in Non-secure modes other than Hyp mode. 


For more information, see Hyp mode (coproc ==0b1111) write-only System instructions on 
page G5-5853. 


In addition, in any implementation that includes EL3, when EL3 is using AArch32, if write access to a register is 
disabled by the CP15SDISABLE signal then any MCR access to that register is UNDEFINED. 


Read-only and write-only register encodings 


Some System registers are read-only (RO) or write-only (WO). For example: 


Most identification registers are read-only. 
Most encodings that perform an operation, such as a cache maintenance instruction, are write-only. 


Ifa particular Privilege level defines a register to be: 


RO, then any attempt to write to that register, at that Privilege level, is UNDEFINED. This means that any access 
to that register with L == 0 is UNDEFINED. 


WO, then any attempt to read from that register, at that Privilege level, is UNDEFINED. This means that any 
access to that register with L== 1 is UNDEFINED. 


For IMPLEMENTATION DEFINED encoding spaces, the treatment of the encodings is IMPLEMENTATION DEFINED. 
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G8-5896 





Note 


This section applies only to registers that this manual defines as RO or WO. It does not apply to registers for which 
other access permissions are explicitly defined. 


Reset behavior of AArch32 System registers 
Reset values apply only to RW registers and fields, however: 


s Some RO registers or fields, including feature ID registers and some status registers or register fields, always 
return a known value. 


° Some RW and RO registers or register fields return status information about the PE. Unless the register 
description indicates that the value is UNKNOWN on reset, a read of the register immediately after a reset 
returns valid information. 


° Some RW and RO registers and fields are aliases of other registers or fields. In these cases, the reset behavior 
of the aliased register or field determines the value returned by a read of the register immediately after a reset. 


z WO registers that only have an effect on writes do not have meaningful reset values. However, an access to 
a WO register might affect underlying state, and that state might have a defined reset value. 


° IMPLEMENTATION DEFINED registers have IMPLEMENTATION DEFINED reset behavior. 


After a reset, only a limited subset of the PE state is guaranteed to be set to defined values. Also, for debug and trace 
System registers, reset requirements must take account of different levels of reset. For more information about the 
reset behavior of System registers when the PE resets into an Exception level that is using AArch32, see: 


° PE state on reset into AArch32 state on page G1-5559. 
° The appropriate Trace architecture specification, for the Trace System registers. 


When the PE resets into an Exception level that is using AArch64, PE state that relates to execution in AArch32 
state, including the System register values, is UNKNOWN. The only exception to this is state that applies to execution 
in both AArch64 state and AArch32 state and that has a defined reset value on the reset into AArch64 state. An 
example of such PE state is the EDPRSR.SR bit. 


For a PE reset into an Exception level that is using AArch32, the architecture defines which AArch32 System 
registers have a defined reset value, and when that defined reset value applies. The register descriptions include this 
information, and PE state on reset into AArch32 state on page G1-5559 summarizes these architectural 
requirements. Otherwise, RW registers reset to an architecturally unknown value. 


Note 


In an implementation that includes EL3, unless this manual explicitly states otherwise, only the Secure instance of 
a banked register is reset to the defined value. This means that software must program the Non-secure instance of 
the register with the required values. Typically, this programming is part of the PE boot sequence. 








Pseudocode description of resetting System registers 


The AArch32.ResetControlRegisters() pseudocode function resets all System registers, and register fields, that have 
defined reset values, as described in this section and PE state on reset into AArch32 state on page G1-5559. 


Note 
For debug and trace System registers, this function resets registers as defined for the appropriate level of reset. 








Synchronization of changes to AArch32 System registers 


In this section, this PE means the PE on which accesses are being synchronized. 
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Note 


See Definitions of direct and indirect reads and writes and their side-effects on page G8-5901 for definitions of the 
terms direct write, direct read, indirect write, and indirect read. 


A direct write to a System register might become visible at any point after the change to the register, but without a 
Context synchronization event there is no guarantee that the change becomes visible. 


Any direct write to a System register is guaranteed not to affect any instruction that appears, in program order, before 
the instruction that performed the direct write, and any direct write to a System register must be synchronized before 
any instruction that appears after the direct write, in program order, can rely on the effect of that write. The only 
exceptions to this are: 


° All direct writes to the same register, using the same encoding, are guaranteed to occur in program order. 


G All direct writes to a register are guaranteed to occur in program order relative to all direct reads of the same 
register using the same encoding. 


$ Any System register access that an Arm Architecture Specification or equivalent specification defines as not 
requiring synchronization. 


g If an instruction that appears in program order before the direct write performs a memory access, such as a 
memory-mapped register access, that causes an indirect read or write to a register, that memory access is 
subject to the memory order model. In this case, if permitted by the memory order model, the instruction that 
appears in program order before the direct write can be affected by the direct write. For information about 
the memory order model, see Definition of the Armv8 memory model on page E2-3814. 


These rules mean that an instruction that writes to one of the address translation instructions described in Address 
translation instructions on page G5-5841 must be explicitly synchronized to guarantee that the result of the address 
translation instruction is visible in the PAR. 


Note 


In this case, the direct write to the encoding of the address translation instruction causes an indirect write to the PAR. 
Without a Context synchronization event after the direct write, there is no guarantee that the indirect write to the 
PAR is visible. 








Conceptually, the explicit synchronization occurs as the first step of any Context synchronization event. This means 
that if the operation uses the state that had been changed but not synchronized before the operation occurred, the 
operation is guaranteed to use the state as if it had been synchronized. 


Note 


è This explicit synchronization is applied as the first step of the execution of any instruction that causes the 
synchronization operation. This means it does not synchronize any effect of changes to the System registers 
that might affect the fetch and decode of the instructions that cause the operation, such as breakpoints or 
changes to translation tables. 





à For a synchronous exception, the control state in use at the time the exception is generated determines the 
exception syndrome information, and this syndrome information is not changed by this synchronization at 
the start of taking the exception. 





Except for the register reads listed in Registers with some architectural guarantee of ordering or observability on 
page G8-5899, if no Context synchronization event is performed, direct reads of System registers can occur in any 
order. 


Table G8-2 on page G8-5898 shows the synchronization requirement between two reads or writes that access the 
same System register. In the column headings, First and Second refer to: 


s Program order, for any read or write caused by the execution of an instruction by this PE, other than a read 
or write caused by a memory access made by that instruction. 
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The order of arrival of asynchronous reads or writes made by this PE relative to the execution of instructions 
by this PE. 


In addition: 


For indirect reads or writes caused by an external agent, such as a debugger, the mechanism that determines 
the order of the reads or writes is defined by that external agent. The external agent can provide mechanisms 
that ensure that any read or write it makes arrives at the PE. These indirect reads and writes are asynchronous 
to software execution on the PE. 


For indirect reads or writes caused by memory-mapped reads or writes made by this PE, the ordering of the 
memory accesses is subject to the memory order model, including the effect of the memory type of the 
accessed memory address. This applies, for example, if this PE reads or writes one of its registers in a 
memory-mapped register interface. 


The mechanism for ensuring completion of these memory accesses, including ensuring the arrival of the 
asynchronous read or write at the PE, is defined by the system. 





Note 


Such accesses are likely to be given a Device memory attribute, but requiring this is outside the scope of the 
architecture. 





For indirect reads or writes caused by autonomous asynchronous events that are counted, for example events 
caused by the passage of time, the events are ordered so that: 


— Counts progress monotonically. 
— The events arrive at the PE in finite time and without undue delay. 


Table G8-2 Synchronization requirements for updates to System registers 





























First read or write Second read or write Context synchronization event required 
Direct read Direct read No 

Direct write No 

Indirect read Noa 

Indirect write Noa, but see text in this section for exceptions 
Direct write Direct read No 

Direct write No 

Indirect read Yes? 








Indirect read 











Indirect write No, but see text in this section for exceptions 
Direct read No 
Direct write No 
Indirect read No 
Indirect write No 








Indirect write 


Direct read 


Yes, but see text in this section for exceptions 





Direct write 





No, but see text in this section for exceptions 





Indirect read 


Yes, but see text in this section for exceptions 





Indirect write 








No, but see text in this section for exceptions 
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a. Although no synchronization is required between a Direct write and a Direct read, or between a Direct read and 
an Indirect write, this does not imply that a Direct read causes synchronization of a previous Direct write. This 
means that the sequence Direct write followed by Direct read followed by Indirect read, with no intervening 
context synchronization, does not guarantee that the Indirect read observes the result of the Direct write. 


If the indirect write is to a register that Registers with some architectural guarantee of ordering or observability 
shows as having some guarantee of the visibility of an indirect write, synchronization might not be required. 


If a direct read or a direct write to a register is followed by an indirect write to that register that is caused by an 
external agent, or by an autonomous asynchronous event, or as a result of a memory-mapped write, then 
synchronization is required to guarantee the ordering of the indirect write relative to the direct read or direct write. 


If an indirect write caused by a direct write is followed by an indirect write caused by an external agent, or by an 
autonomous asynchronous event, or as a result of a memory-mapped write, then synchronization is required to 
guarantee the ordering of the two indirect writes. 


Where an indirect write occurs as a side-effect of an access, this happens atomically with the access, meaning no 
other accesses are allowed between the register access and its side-effect. For other information about indirect writes 
after a direct read or a direct write, see Definitions of direct and indirect reads and writes and their side-effects on 
page G8-5901 


— Note 


Where a register has more that one encoding, a direct write to the register using a particular encoding is not an 
indirect write to the same register with a different encoding. 





Where an indirect write is caused by the action of an external agent, such as a debugger, or by a memory-mapped 
read or write by the PE, then an indirect write by that agent to a register using a particular access mechanism, 
followed by an indirect read by that agent to the same register using the same access mechanism and address does 
not need synchronization. 


Without explicit synchronization to guarantee the order of the accesses, where the same register is accessed by two 
or more of a System register access instruction, and external agent, and autonomous asynchronous event, or as a 
result of a memory-mapped access, the behavior must be as if the accesses occurred atomically and in any order. 
This applies even if the accesses occur simultaneously. 


For information about the additional synchronization requirements for memory-mapped registers, see 
Synchronization requirements for AArch64 System registers on page D13-2819. 


To guarantee the visibility of changes to some registers, additional operations might be required before the Context 
synchronization event. For such a register, the definition of the register identifies these additional requirements. 


In this manual, unless the context indicates otherwise: 
° Accessing a System register refers to a direct read or write of the register. 
° Using a System register refers to an indirect read or write of the register. 


Registers with some architectural guarantee of ordering or observability 


For the registers for which Table G8-3 on page G8-5900 shows that the ordering of direct reads is guaranteed, 
multiple direct reads of a single register, using the same encoding, occur in program order without any explicit 
ordering. 


For the registers for which Table G8-3 on page G8-5900 shows that some observability of indirect writes is 
guaranteed, an indirect write to the register caused by an external agent, an autonomous asynchronous event, or as 
a result of a memory-mapped write, is both: 


° Observable to direct reads of the register, in finite time, without explicit synchronization. 
° Observable to subsequent indirect reads of the register without explicit synchronization. 
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These two sets of registers are similar, as Table G8-3 shows: 


Table G8-3 Registers with a guarantee of ordering or observability, VMSAv8-32 





Ordering of Observability of 













































































Register direct reads indirect writes Notes 

ISR Guaranteed Guaranteed Interrupt Status Register 

DBGCLAIMCLR Guaranteed Guaranteed Debug CLAIM registers 

DBGCLAIMSET - Guaranteed 

DBGDTRRXint Guaranteed Guaranteed Debug Communication Channel registers 

DBGDTRTXint - Guaranteed 

The DCC flags in Guaranteed Guaranteed 

DBGDSCRint 

CNTPCT Guaranteed Guaranteed Generic Timer registers 

CNTP_TVAL Guaranteed Guaranteed 

CNTVCT Guaranteed Guaranteed 

CNTV_TVAL Guaranteed Guaranteed 

CNTHP_TVAL Guaranteed Guaranteed 

PMCCNTR Guaranteed Guaranteed Performance Monitors Extension registers, if the 
implementation includes the extension 

PMEVCNTR<n> Guaranteed Guaranteed 

PMXEVCNTR Guaranteed Guaranteed 

PMOVSSET Guaranteed Guaranteed 

PMOVSR Guaranteed Guaranteed 

EDSCR.PipeAdv and the - Guaranteed Fields of the External Debug Status and Control Register 

DCC flags in EDSCR 

In addition to the requirements shown in Table G8-3: 

e Indirect writes to the following registers as a result of memory-mapped writes, including accesses by external 
agents, are required to be observable to the indirect read made in determining the response to a subsequent 
memory-mapped access without explicit synchronization: 

—  OSLAR_EL1.OSLAR_EL1 is indirectly read to determine whether the subsequent access is 
permitted. 
Note 
OSLAR_EL1 maps to the AArch32 System register DBGOSLAR. 
—  EDLAR, if implemented. EDLAR is indirectly read to determine whether a subsequent write or 
side-effect of an access is ignored. 
Note 
This requirement is stricter than the general requirement for the observability of indirect writes. 

s The requirement that an indirect write to the registers in Table G8-3 is observable to direct reads in finite time 
does not imply that all observers will observe the indirect write at the same time. 
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For example, an increment of the system counter is an autonomous asynchronous event that performs an 
indirect write to the counter. This asynchronous event might generate a timer interrupt request, resulting in a 
Context synchronization event. When a GIC is used, the timer interrupt might arrive at the GIC after the PE 
has taken an interrupt request from another source, but before software reads the current interrupt ID from 
the GIC. This means that the GIC might identify the timer interrupt as the current interrupt. Software must 
not assume that a subsequent direct read of the counter register is guaranteed to observe the updated value of 
that register. 


Although this example uses the counter-timer registers, it applies equally to other registers that might be 
linked to interrupt requests, including the PMU and Statistical Profiling status registers. 


. When the PE is in Debug state, there are synchronization requirements for the Debug Communication 
Channel and Instruction Transfer registers. See DCC and ITR access in Debug state on page H4-6784. 


The possibility that direct reads can occur early, in the absence of context synchronization, described in Ordering 
of reads of System registers on page G8-5904, still applies to the registers listed in Table G8-3 on page G8-5900. 


Definitions of direct and indirect reads and writes and their side-effects 
Direct and indirect reads and writes are defined as follows: 


Direct read Is a read of a register, using an MRC, MRRC, or STC instruction, that the architecture permits for the 
current PE state. 


Ifa direct read of a register has a side-effect of changing the value ofa register, the effect of a direct 
read on that register is defined to be an indirect write, and has the synchronization requirements of 
an indirect write. This means the indirect write is guaranteed to have occurred, and to be visible to 
subsequent direct or indirect reads and writes only if synchronization is performed after the direct 
read. 


— Note 


The indirect write described here can affect either the register written to by the direct write, or some 
other register. The synchronization requirement is the same in both cases. 





Direct write Is a write to a register, using an MCR, MCRR, or LDC instruction, that the architecture permits for the 
current PE state. 


In the following cases, the side-effect of the direct write is defined to be an indirect write of the 
affected register, and has the synchronization requirements of an indirect write: 


a If the direct write has a side-effect of changing the value of a register other than the register 
accessed by the direct write. 

. If the direct write has a side-effect of changing the value of the register accessed by the direct 
write, so that the value in that register might not be the value that the direct write wrote to the 
register. 


In both cases, this means that the indirect write is not guaranteed to be visible to subsequent direct 
or indirect reads and writes unless synchronization is performed after the direct write. 


— Note 


. As an example of a direct write to a register having an effect that is an indirect write of that 
register, writing 1 to a PMCNTENCLR.Px bit is also an indirect write, because if the Px bit 
had the value 1 before the direct write, the side-effect of the write changes the value of that 
bit to 0. 


. The indirect write described here can affect either the register written to by the direct write, 
or some other register. The synchronization requirement is the same in both cases. 
For example, writing 1 to a PMCNTENCLR.Px bit that is set to 1 also changes the 
corresponding PMCNTENSET.Px bit from 1 to 0. This means that the direct write to the 
PMCNTENCLR defines indirect writes to both itself and to the PMCNTENSET. 
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G8-5902 


Indirect read Is a use of the register by an instruction to establish the operating conditions for the instruction. 
Examples of operating conditions that might be determined by an indirect read are the translation 
table base address, or whether memory accesses are forced to be Non-cacheable. 


Indirect reads include situations where the value of one register determines what value is returned 
by asecond register. This means that any read of the second register is an indirect read of the register 
that determines what value is returned. 


Indirect reads also include: 


. Reads of the System registers by external agents, such as debuggers, as described in Debug 
registers on page G8-6376. 


$ Memory-mapped reads of the System registers made by the PE on which the System registers 
are implemented. 


Where an indirect read of a register has a side-effect of changing the value of a register, that change 
is defined to be an indirect write, and has the synchronization requirements of an indirect write. 


Indirect write Is an update to the value of a register as a consequence of either: 


è An exception, operation, or execution of an instruction that is not a direct write to that 
register. 
. The asynchronous operation of an external agent. 


This can include: 


5 The passage of time, as seen in counters or timers, including performance counters. 
s The assertion of an interrupt. 
. A write from an external agent, such as a debugger. 


However, for some registers, the architecture gives some guarantee of visibility without any explicit 
synchronization, see Registers with some architectural guarantee of ordering or observability on 
page G8-5899. 


Note 


Taking an exception is a Context synchronization event. Any indirect write performed as part of an 
exception entry does not require additional synchronization. This includes the indirect writes to the 
registers that report the exception, as described in Exception reporting in a VMSAv8-32 
implementation on page G5-5822. 





Principles of the ID scheme for fields in ID registers 


The Arm architecture specifies a number of JD registers that are characterized as comprising a set of 4-bit ID fields, 
Each ID field identifies the presence, and possibly the level of support for, a particular feature in an implementation 
of the architecture. These fields follow an architectural model that aids their use by software and provides future 
compatibility. This section describes that model. AArch32 ID registers to which this scheme applies on 

page G8-5903 identifies the set of ID registers that are accessible from AArch32 state. 


A small number of ID fields do not follow the scheme described in this section. In these cases, the field description 
states that it does not follow this scheme. 


Note 


s The ID fields described here are distinct from register fields that enumerate the number of resources, such as 
the number of breakpoints, watchpoints, or performance monitors, or the amount of memory. 





° ID fields that do not follow this scheme include the ID AA64DFRO_EL1.PMUVer, 
ID_DFRO_EL1.PerfMon, ID_DFRO.PerfMon and EDDFR.PMUVer fields, see Alternative ID scheme used 
for the Performance Monitors Extension version on page G8-5904. 


s The presence of an ID field for a feature does not imply that the feature is optional. 





To provide forward compatibility, software can rely on the features of these fields that are described in this section. 
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The ID fields, which are either signed or unsigned, use increasing numerical values to indicate increases in 
functionality. Therefore, if a value of 0x1 indicates the presence of some instructions, then the value 0x2 will indicate 
the presence of those instructions plus some additional instructions or functionality. This means software can be 
written in the form: 


if (value >= number) { // do something that relies on the value of the feature} 


For ID fields where the value 0x@ defines that a feature is not present, the field holds an unsigned value. This covers 
the vast majority of such fields. 


In a few cases, the architecture has been changed to permit implementations to exclude a feature that has previously 
been required and for which no ID field has been defined. In these cases, a new ID field is defined and: 


. The field holds a signed value. 


° The field value 0xF indicates that the feature is not implemented. 
° The field value 0x0 indicates that the feature is implemented. 
° Software that depends on the feature can use the test: 
if value >= 0 { // Software features that depend on the presence of the hardware 


feature } 


In some cases, it has been decided retrospectively that the increase in functionality between two consecutive 
numerical values is too great, and it is desirable to permit an intermediate degree of functionality, and the means to 
discover this. This is done by the introduction of a fractional field that both: 


$ Is referred to in the definition of the original field. 
š Applies only when the original field is at the lower value of the step. 


In principle, a fractional field can be used for two different fractional steps, with different meanings associated with 
each of these steps. For this reason, a fractional field must be interpreted in the context of the field to which it relates 
and the value of that field. Example G8-1 shows the use of such a field. 


Example G8-1 Example of the use of a fractional field 


For a field describing some class of functionality: 
s The value 0x1 was defined as indicating that item A is present. 
` The value 0x2 was defined as indicating that items B and C are present, in addition to item A. 


Subsequently, it might be necessary to introduce a second ID field to indicate that A and B only are present. This 
new field is a fractional field, and might be defined as having the value 0x1 when A and B only are present. This 
fractional field is valid only when the original ID field has the value 0x1. 


This approach means that: 


: Software that depends on the test if (value >= 0x2) can rely on features A, B, and C being present, 
, Software that depends on the test if (value >= 0x1) can rely on feature A being present. 
° If new software needs to check only that features A and B are present, then it can test: 
if (value >= 0x2 || (value == 0x1 && fractional_value >= Qx1)) { // Software features 


that depend on A and B only } 


A fractional field uses the same approach of increasing numerical values indicating increasing functionality, and the 
fractional approach can also be applied recursively to fractional fields. 


Unused ID fields, and fractional fields that are not applicable, are RESO to allow their future use when features, or 
fractional implementation options, are added. 

AArch32 ID registers to which this scheme applies 

` The Auxiliary Feature register ID_AFRO. 

s The Processor Feature registers ID_PFRO and ID_PFR1. 


° The Debug Feature register ID_DFRO. 
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: The Memory Model Feature registers ID_MMFRO, ID_MMFR1, ID MMFR2, ID_MMFR3, and 
ID_MMFR4. 


7 The Instruction Set Attribute registers ID ISARO, ID ISAR1, ID ISAR2, ID ISAR3, ID_ISAR4, and 
ID_ISARS. 


è The Media and VFP Feature registers MVFRO, MVFR1, and MVFR2. 


Note 


Principles of the ID scheme for fields in ID registers on page D13-2823 includes information about the AArch64 
System registers and the memory-mapped registers to which this scheme applies. 





Alternative ID scheme used for the Performance Monitors Extension version 


The ID AA64DFRO_EL1.PMUVer, ID DFRO_EL1.PerfMon, ID_DFRO.PerfMon, and EDDFR.PMUVer fields, 
which identify the version of the Performance Monitors Extension, do not follow the standard ID scheme. Software 
must treat these fields as follows: 


° The value 0xF indicates that the Arm-architected Performance Monitors Extension is not implemented. 
. If the field value is not 0xF the field is treated as an unsigned value, as described for the standard ID scheme. 


This means that software that depends on the implementation of a particular version of the Arm Performance 
Monitors Extension must be written in the form: 


if (value != @xF and value >= number) { // do something that relies on version 'number' of the 
feature } 


For these fields, Arm deprecates use of the value @xF in new implementations. 


G8.1.4 About AArch32 System register accesses 


The following subsections give more information about accesses to the AArch32 System registers: 
$ Ordering of reads of System registers. 

° Accessing 32-bit System registers on page G8-5905. 

° Accessing 64-bit System registers on page G8-5906. 


Ordering of reads of System registers 


Reads of the System registers can occur out of order with respect to earlier instructions executed on the same PE, 
provided that both: 


° Any data dependencies between the instructions, as specified in Synchronization of changes to AArch32 
System registers on page G8-5896, including read-after-read dependencies, are respected. 


$ The reads to the register do not occur earlier than the most recent Context synchronization event to its 
architectural position in the instruction stream. 


Note 


In particular, the values read from System registers that hold self-incrementing counts, such as the Performance 
Monitors counters or the Generic Timer counter or timers, could be accessed from any time after the previous 
Context synchronization event. For example, where a memory access is used to communicate a read of such a 
counter, an ISB must be inserted between the read of the memory location that is known to have returned its data, 
either as a result of a condition on that data or of the read having completed, and the read of the counter, if it is 
necessary that the counter returns a count value after the memory communication. 
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Accessing 32-bit System registers 


Software accesses most 32-bit System registers using the generic MCR and MRC System register access instructions, 
specifying some or all of the parameters {coproc, CRn, opcl, CRm, opc2}, where: 


coproc Identifies the primary region of the System register encoding space. Takes one of the values: 
p14 Encoded as 0b1110. 
p15 Encoded as 0b1111. 

CRn Takes a value in the range c0-c15, encoded the corresponding 4-bit binary value, @b0000-0b1111. 


In the (coproc==0b1110) encoding space, the opc1 value identifies the System register functional 
group, and CRn is the most significant identifier for the required register within that group. 


In the (coproc==0b1111) encoding space, CRn is the most significant identifier for the required 
register. 


opcl Takes a value in the range 0-7, encoded as its 3-bit binary value. 


In the (coproc==0b1110) encoding space, the opc1 value identifies the System register functional 
group, and can take the following values: 


) Debug System registers. 

1 Trace System registers. 

7 Legacy Jazelle System registers. 

In the (coproc==0b1111) encoding space, opc1 can take any value in the range 0-7. 
CRm Takes a value in the range c0-c15, encoded the corresponding 4-bit binary value, @b0000-0b1111. 
opc2 Takes a value in the range 0-7, encoded as its 3-bit binary value. 


opc2 is optional in the MCR and MRC instruction syntax, and if no value is specified the encoding 
defaults to 0b000. 


Rt A general-purpose register to hold a 32-bit value to transfer to or from the System register. Takes a 
value in the range RQ-R14, encoded as the corresponding 4-bit binary value, @b0000-0b1110. 


This means an MCR or MRC access to a specific 32-bit System register uses: 


° A unique combination of coproc, CRn, opc1, CRm, and opc2, to specify the required System register. 
od A general-purpose register, Rt, for the transferred 32-bit value. 
See also: 


7 MCR on page F5-4331. 
3 MRC on page F5-4354. 


A small number of AArch32 debug System registers are accessed using LDC or STC instructions. In these cases, the 
register to be accessed is identified in the instruction syntax by the use of p14, c5 where: 


p14 Identifies that the access is to the (coproc==0b1110) encoding space. 
c5 Identifies the target debug System register. 


See the instruction descriptions: 

. LDC (immediate) on page F5-4220. 
è LDC (literal) on page F5-4222. 

. STC on page F5-4571. 


The only uses of LDC and STC permitted in Armv8-A are: 


° An LDC access to load data from memory to DBGDTRTXint, see LDC (immediate) on page F5-4220 and LDC 
(literal) on page F5-4222. 


7 An STC access to store data to memory from DBGDTRRXint, see STC on page F5-4571. 


A small number of AArch32 System registers are accessed using MRS, MSR, VMRS, or VMSR instructions, see the 
appropriate register and instruction description for more information, see: 


7 MRS on page F5-4358. 

- MSR (immediate) on page F5-4368, 
7 MSR (register) on page F5-4370. 

> VMRS on page F6-5156. 
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s VMSR on page F6-5159. 


Note 
° For example: 
— The APSR, CPSR, and SPSR are accessed using MRS or MSR instructions. 
— The MVFRO, MVFR1, and MVFR2 are accessed using VMRS or VMSR instructions. 





° In addition, the banked register forms of the MRS and MSR instructions can be used to access some System 
registers associated with PE modes other than the mode in which the PE is currently executing, see MRS 
(Banked register) on page F5-4360 and MSR (Banked register) on page F5-4364. 





Accessing 64-bit System registers 


Software accesses a 64-bit System register using the generic MCRR and MRRC System register access instructions, 
specifying the parameters {coproc, CRm, opc1}, where: 


coproc Identifies the primary region of the System register encoding space. Takes one of the values: 
p14 Encoded as 0b1110. 
p15 Encoded as 0b1111. 

CRm Takes a value in the range c0-c15, encoded the corresponding 4-bit binary value, @b0000-0b1111. 


In the (coproc==b1110) encoding space, the opc1 value identifies the System register functional 
group, and CRm is the most significant identifier for the required register within that group. 


In the (coproc==0b1111) encoding space, CRm is the most significant identifier for the required 
register. 


opcl Takes a value in the range 0-15, encoded as its 3-bit binary value. 


In the (coproc==0b1110) encoding space, the opc1 value identifies the System register functional 
group, and can take the following values: 


() Debug System registers. 
1 Trace System registers. 
In the (coproc==0b1111) encoding space, opc1 can take any value in the range 0-15. 


Rt A general-purpose register to hold bits[31:0] of the value to transfer to or from the System register. 
Takes a value in the range R0-R14, encoded as the corresponding 4-bit binary value, 0b0000-0b1110. 


Rt2 A general-purpose register to hold bits[63:32] of the value to transfer to or from the System register. 
Takes a value in the range RQ-R14, encoded as the corresponding 4-bit binary value, 0b0000-0b1110. 


This means an MCRR or MRRC access to a specific 64-bit System register uses: 
$ A unique combination of coproc, CRm and opc1, to specify the required 64-bit System register. 
. Two general-purpose registers, each holding 32 bits of the value to transfer. 


This means a PE can access a 64-bit System register using: 
° An MCRR instruction to write to a System register, see MCRR on page F5-4333. 
° An MRRC instruction to read a System register, see MRRC on page F5-4356. 


When using an MCRR or MRRC instruction the System register access is 64-bit atomic. 


Some 64-bit registers also have an MCR and MRC encoding. The MCR and MRC encodings for these registers access the 
least significant 32 bits of the register. For example, to access the PAR, software can: 


° Use the following instructions to access all 64 bits of the register: 
MRRC p15, 0, <Rt>, <Rt2>, c7 ; Read 64-bit PAR into Rt (low word) and Rt2 (high word) 
MCRR p15, 0, <Rt>, <Rt2>, c7 ; Write Rt (low word) and Rt2 (high word) to 64-bit PAR 
° Use the following instructions to access the least-significant 32 bits of the register: 
MRC p15, 0, <Rt>, c7, c4, @ ; Read PAR[31:0] into Rt 
MCR p15, 0, <Rt>, c7, c4, @ ; Write Rt to PAR[31:0] 
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G8.2 General system control registers 


This section lists the System registers in AArch32 state that are not part of one of the other listed groups. 
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G8.2.1 


G8-5908 


ACTLR, Auxiliary Control Register 


The ACTLR characteristics are: 


Purpose 


Provides IMPLEMENTATION DEFINED configuration and control options for execution at EL1 and 
ELO. 


Configurations 
AArch32 System register ACTLR[31:0] is architecturally mapped to AArch64 System register 
ACTLR_EL1[31:0]. 
Some bits might define global configuration settings, and be common to the Secure and Non-secure 
instances of the register. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ACTLR is a 32-bit register. 


Field descriptions 


The ACTLR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the ACTLR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





0b1111 0b000 = 0b0001 0b0000 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TACR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TAC == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return ACTLR_S; 
else 
return ACTLR_NS; 
else 
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return ACTLR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return ACTLR_NS; 
else 
return ACTLR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return ACTLR_S; 
else 





return ACTLR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b0001 0b0000 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TACR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TAC == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
ACTLR_S = R[t]; 
else 
ACTLR_NS = R[t]; 





else 
ACTLR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
ACTLR_NS = R[t]; 
else 
ACTLR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
ACTLR_S = R[t]; 
else 
ACTLR_NS = R[t]; 
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G8.2.2 


G8-5910 


ACTLR2, Auxiliary Control Register 2 


The ACTLR2 characteristics are: 


Purpose 


Provides additional space to the ACTLR register to hold IMPLEMENTATION DEFINED trap 
functionality for execution at EL1 and ELO. 


Configurations 


Attributes 


AArch32 System register ACTLR2[3 1:0] is architecturally mapped to AArch64 System register 
ACTLR_EL1[63:32]. 


In Armv8.0 and Armv8.1, it is IMPLEMENTATION DEFINED whether this register is implemented, or 
whether it causes UNDEFINED exceptions when accessed. The implementation of this register can be 
detected by examining ID MMFR4.AC2. 


From Armv8.2 this register must be implemented. 
RW fields in this register reset to architecturally UNKNOWN values. 


ACTLR2 is a 32-bit register. 


Field descriptions 


The ACTLR2 bit assignments are: 


31 


0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 


IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the ACTLR2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b0001 0b0000 Ob011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TACR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TAC == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 


return ACTLR2_S; 
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else 
return ACTLR2_NS; 
else 
return ACTLR2; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return ACTLR2_NS; 
else 
return ACTLR2; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return ACTLR2_S; 
else 





return ACTLR2_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b0001 O0b0000 O0b011 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TACR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TAC == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
ACTLR2_S = R[t]; 
else 
ACTLR2_NS = R[t]; 
else 
ACTLR2 = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
ACTLR2_NS = R[t]; 
else 
ACTLR2 = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
ACTLR2_S = R[t]; 
else 
ACTLR2_NS = R[t]; 
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G8.2.3 


G8-5912 


ADFSR, Auxiliary Data Fault Status Register 


The ADFSR characteristics are: 


Purpose 
Provides additional IMPLEMENTATION DEFINED fault status information for Data Abort exceptions 
taken to EL1 modes, and EL3 modes when EL3 is implemented and is using AArch32. 
Configurations 
AArch32 System register ADFSR[31:0] is architecturally mapped to AArch64 System register 
AFSRO_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ADFSR is a 32-bit register. 


Field descriptions 


The ADFSR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the ADFSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 














coproc opct CRn CRm opc2 
Ob1111 0b000 0b0101 O0b0001 Ob000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return ADFSR_S; 
else 
return ADFSR_NS; 
else 
return ADFSR; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return ADFSR_NS; 

else 
return ADFSR; 

elsif PSTATE.EL == EL3 then 

if SCR.NS == '@' then 
return ADFSR_S; 

else 
return ADFSR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b0101 O0b0001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
ADFSR_S = R[t]; 
else 
ADFSR_NS = R[t]; 
else 
ADFSR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
ADFSR_NS = R[t]; 
else 
ADFSR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
ADFSR_S = R[t]; 
else 





ADFSR_NS = R[t]; 
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G8.2.4 AIDR, Auxiliary ID Register 


The AIDR characteristics are: 


Purpose 
Provides IMPLEMENTATION DEFINED identification information. 
The value of this register must be used in conjunction with the value of MIDR. 
Configurations 
AArch32 System register AIDR[31:0] is architecturally mapped to AArch64 System register 
AIDR_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AIDR is a 32-bit register. 


Field descriptions 


The AIDR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


Accessing the AIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b001 Ob0000 O0b0000 Obi11 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 





return AIDR; 
elsif PSTATE.EL == EL2 then 
return AIDR; 
elsif PSTATE.EL == EL3 then 
return AIDR; 
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G8.2.5 AIFSR, Auxiliary Instruction Fault Status Register 


The AIFSR characteristics are: 


Purpose 
Provides additional IMPLEMENTATION DEFINED fault status information for Prefetch Abort 
exceptions taken to EL1 modes, and EL3 modes when EL3 is implemented and is using AArch32. 
Configurations 
AArch32 System register AIFSR[31:0] is architecturally mapped to AArch64 System register 
AFSRI_ EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AIFSR is a 32-bit register. 


Field descriptions 


The AIFSR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the AIFSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 O0b0001 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return AIFSR_S; 
else 
return AIFSR_NS; 





else 
return AIFSR; 
elsif PSTATE.EL == EL2 then 
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G8-5916 


if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return AIFSR_NS; 

else 
return AIFSR; 

elsif PSTATE.EL == EL3 then 

if SCR.NS == '@' then 
return AIFSR_S; 

else 
return AIFSR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b0101 O0b0001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
AIFSR_S = R[t]; 
else 
AIFSR_NS = R[t]; 
else 
AIFSR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
AIFSR_NS = R[t]; 
else 
AIFSR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
AIFSR_S = R[t]; 
else 





AIFSR_NS = R[t]; 


0b001 
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G8.2.6 AMAIRO, Auxiliary Memory Attribute Indirection Register 0 


The AMAIRO characteristics are: 


Purpose 
When using the Long-descriptor format translation tables for stage 1 translations, provides 
IMPLEMENTATION DEFINED memory attributes for the memory regions specified by MAIRO. 
Configurations 
AArch32 System register AMAIRO[3 1:0] is architecturally mapped to AArch64 System register 
AMAIR_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


AMAIRO is a 32-bit register. 


Field descriptions 


The AMAIRO bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


This register is RESO in the following cases: 

s When an implementation does not provide any IMPLEMENTATION DEFINED memory attributes. 

è When the Long-descriptor translation table format is not used. 

If EL3 is implemented and is using AArch32: 

7 AMAIRO(S) gives the value for memory accesses from Secure state. 

è AMAIRO(NS) gives the value for memory accesses from Non-secure states other than Hyp mode. 


Any IMPLEMENTATION DEFINED memory attributes are additional qualifiers for the memory locations and must not 
change the architected behavior specified by MAIRO and MAIRI. 


In a typical implementation, AMAIRO and AMAIR! split into eight one-byte fields, corresponding to the 
MAIRn.Attr<n> fields, but the architecture does not require them to do so. 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the AMAIRO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b000 0b1010 Ob0011 


opc2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return AMAIRQ_S; 
else 
return AMAIRQ_NS; 
else 
return AMAIRQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return AMAIRQ_NS; 
else 
return AMAIRQ; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return AMAIRQ_S; 
else 





return AMAIRQ_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b1010 O0b0011 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 
UNDEFINED; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP1ISSDISABLE2 == HIGH then 
UNDEFINED; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 

AMAIR@_S = R[t]; 
else 
AMAIRO@_NS = R[t]; 

else 

AMAIRO = R[t]; 


0b000 
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elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
AMAIRO_NS = R[t]; 
else 
AMAIR@ = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' && CP15SDISABLE == HIGH then 
UNDEFINED; 
elsif SCR.NS == '@' && CPISSDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
AMAIR@_S = R[t]; 
else 
AMAIRO_NS = R[t]; 


AArch32 System Register Descriptions 
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G8.2.7 AMAIR1, Auxiliary Memory Attribute Indirection Register 1 
The AMAIRI characteristics are: 


Purpose 


When using the Long-descriptor format translation tables for stage 1 translations, provides 
IMPLEMENTATION DEFINED memory attributes for the memory regions specified by MAIR1. 


Configurations 
AArch32 System register AMAIR1[31:0] is architecturally mapped to AArch64 System register 
AMAIR_EL1[63:32]. 
When EL3 is using AArch32, write access to AMAIR1I(S) is disabled when the CP1SSDISABLE 
signal is asserted HIGH. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMAIR] is a 32-bit register. 


Field descriptions 


The AMAIR1 bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


This register is RESO in the following cases: 

è When an implementation does not provide any IMPLEMENTATION DEFINED memory attributes. 

s When the Long-descriptor translation table format is not used. 

If EL3 is implemented and is using AArch32: 

s AMAIR1(S) gives the value for memory accesses from Secure state. 

s AMAIR1(NS) gives the value for memory accesses from Non-secure states other than Hyp mode. 


Any IMPLEMENTATION DEFINED memory attributes are additional qualifiers for the memory locations and must not 
change the architected behavior specified by MAIRO and MAIR1. 


In a typical implementation, AMAIRO and AMAIRI split into eight one-byte fields, corresponding to the 
MAIRn.Attr<n> fields, but the architecture does not require them to do so. 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the AMAIR1 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1010 Ob0011 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return AMAIRI_S; 
else 
return AMAIR1_NS; 
else 
return AMAIR1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return AMAIRI_NS; 
else 
return AMAIR1; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return AMAIR1_S; 
else 





return AMAIRI_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1010 Ob0011 Ob001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 
UNDEFINED; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP1ISSDISABLE2 == HIGH then 
UNDEFINED; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 

AMAIR1_S = R[t]; 
else 
AMAIRI_NS = R[t]; 

else 

AMAIR1 = R[t]; 
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elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
AMAIRI_NS = R[t]; 
else 
AMAIR1 = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' && CP15SDISABLE == HIGH then 
UNDEFINED; 
elsif SCR.NS == '@' && CPISSDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
AMAIRI_S = R[t]; 
else 
AMAIRI_NS = R[t]; 
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G8.2.8 APSR, Application Program Status Register 


ARM DDI 0487E.a 
ID070919 


The APSR characteristics are: 


Purpose 

Hold program status and control information. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


APSR is a 32-bit register. 


Field descriptions 


The APSR bit assignments are: 


31 30 29 28 27 26 20 19 16 15 543 0 


Loo RES1 


N, bit [31] 
Negative condition flag. Set to bit[31] of the result of the last flag-setting instruction. If the result is 
regarded as a two's complement signed integer, then N is set to 1 if the result was negative, and N 
is set to 0 if the result was positive or zero. 

Z, bit [30] 
Zero condition flag. Set to 1 if the result of the last flag-setting instruction was zero, and to 0 
otherwise. A result of zero often indicates an equal result from a comparison. 

C, bit [29] 
Carry condition flag. Set to 1 if the last flag-setting instruction resulted in a carry condition, for 
example an unsigned overflow on an addition. 

V, bit [28] 
Overflow condition flag. Set to 1 ifthe last flag-setting instruction resulted in an overflow condition, 
for example a signed overflow on an addition. 

Q, bit [27] 


Cumulative saturation bit. Set to 1 to indicate that overflow or saturation occurred in some 
instructions. 


Bits [26:20] 
Reserved, RESO. 


GE, bits [19:16] 


Greater than or Equal flags, for parallel addition and subtraction. 


Bits [15:5] 
Reserved, RESO. 
Bit [4] 
Reserved, RES]. 
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Bits [3:0] 
Reserved, RESO. 


It is permitted that, on a read of APSR: 

Bit[22] returns the value of PSTATE.PAN 

è Bit[9] returns the value of PSTATE.E. 

$ Bits[8:6] return the value of PSTATE. {A, I, F}, the mask bits. 


è Bit[4:0] returns the value of PSTATE.M[4:0] 


Note 


This is an exception to the general rule that an UNKNOWN field must not return information that cannot be obtained, 
at the current Privilege level, by an architected mechanism. 








For more information see The Application Program Status Register, APSR on page E1-3789. 
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G8.2.9 ATS12NSOPR, Address Translate Stages 1 and 2 Non-secure Only PL1 Read 


ARM DDI 0487E.a 
ID070919 


The ATS12NSOPR characteristics are: 


Purpose 
Performs stage 1 and 2 address translations as defined for PL1 and the Non-secure state, with 
permissions as if reading from the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATS12NSOPR is a 32-bit System instruction. 


Field descriptions 


The ATS12NSOPR input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. The resulting address is the PA that is the output address 
of the stage 2 translation. 


Executing the ATS12NSOPR instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = O0b0111 Ob1000 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == '@1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
ATS12NSOPR(R[t]) ; 
elsif PSTATE.EL == EL3 then 
ATS12NSOPR(R[t] ) ; 
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G8.2.10 


G8-5926 


ATS12NSOPW, Address Translate Stages 1 and 2 Non-secure Only PL1 Write 


The ATS12NSOPW characteristics are: 


Purpose 
Performs stage 1 and 2 address translations as defined for PL1 and the Non-secure state, with 
permissions as if writing to the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATS12NSOPW is a 32-bit System instruction. 


Field descriptions 


The ATS12NSOPW input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. The resulting address is the PA that is the output address 


of the stage 2 translation. 


Executing the ATS12NSOPW instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
Ob1111 0b000 = Ob0111  0b1000 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == '@1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
ATS12NSOPW(R[t] ) ; 
elsif PSTATE.EL == EL3 then 
ATS12NSOPW(R[t]) ; 
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G8.2.11 ATS12NSOUR, Address Translate Stages 1 and 2 Non-secure Only Unprivileged Read 


ARM DDI 0487E.a 
ID070919 


The ATS12NSOUR characteristics are: 


Purpose 
Performs stage 1 and 2 address translations as defined for PLO and the Non-secure state, with 
permissions as if reading from the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATS12NSOUR is a 32-bit System instruction. 


Field descriptions 


The ATS12NSOUR input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. The resulting address is the PA that is the output address 
of the stage 2 translation. 


Executing the ATS12NSOUR instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 0b1000 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == '@1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
ATS12NSOUR(R[t]) ; 
elsif PSTATE.EL == EL3 then 
ATS12NSOUR(R[t]) ; 
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G8.2.12 


G8-5928 


ATS12NSOUW, Address Translate Stages 1 and 2 Non-secure Only Unprivileged Write 


The ATS12NSOUW characteristics are: 


Purpose 
Performs stage 1 and 2 address translations as defined for PLO and the Non-secure state, with 
permissions as if writing to the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATS12NSOUW is a 32-bit System instruction. 


Field descriptions 


The ATS12NSOUW input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. The resulting address is the PA that is the output address 
of the stage 2 translation. 


Executing the ATS12NSOUW instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





0b1111 0b000 0b0111 0b1000 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == '@1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
ATS12NSOUW(R[t]) ; 
elsif PSTATE.EL == EL3 then 
ATS12NSOUW(R[t]) ; 
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G8.2.13 ATS1CPR, Address Translate Stage 1 Current state PL1 Read 


ARM DDI 0487E.a 
ID070919 


The ATS1CPR characteristics are: 


Purpose 
Performs stage 1 address translation as defined for PL1 and the current Security state, with 
permissions as if reading from the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATSICPR is a 32-bit System instruction. 


Field descriptions 


The ATS1CPR input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. If EL2 is implemented and enabled in the current 
Security state, the resulting address is the IPA that is the output address of the stage 1 translation. 
Otherwise, the resulting address is a PA. 


Executing the ATS1CPR instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 0b1000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
else 
ATSICPR(R[t]); 
elsif PSTATE.EL == EL2 then 
ATS1CPR(R[t]); 
elsif PSTATE.EL == EL3 then 
ATS1CPR(R[t]); 
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G8.2.14 ATS1CPRP, Address Translate Stage 1 Current state PL1 Read PAN 
The ATS1CPRP characteristics are: 


Purpose 


Performs a stage | address translation at PL1 and in the current Security state, where the value of 
PSTATE.PAN determines if a read from a location will generate a permission fault for a privileged 


access. 


Configurations 
This instruction is present only when ARMv8.2-ATSIE1 is implemented. Otherwise, direct 
accesses to ATS1CPRP are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ATSICPRP is a 32-bit System instruction. 


Field descriptions 


The ATS1CPRP input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. If EL2 is implemented and enabled in the current 
Security state, the resulting address is the IPA that is the output address of the stage 1 translation. 
Otherwise, the resulting address is a PA. 


Executing the ATS1CPRP instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = Ob0111 Ob1001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
ATSICPRP(R[t]); 
elsif PSTATE.EL == EL2 then 
ATS1CPRP(R[t]); 
elsif PSTATE.EL == EL3 then 
ATSICPRP(R[t]); 
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G8.2.15 ATS1CPW, Address Translate Stage 1 Current state PL1 Write 


ARM DDI 0487E.a 
ID070919 


The ATS1CPW characteristics are: 


Purpose 
Performs stage 1 address translation as defined for PL1 and the current Security state, with 
permissions as if writing to the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATS1CPW is a 32-bit System instruction. 


Field descriptions 


The ATSICPW input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. If EL2 is implemented and enabled in the current 
Security state, the resulting address is the IPA that is the output address of the stage 1 translation. 
Otherwise, the resulting address is a PA. 


Executing the ATS1CPW instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 Ob1000 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
ATS1ICPW(R[t]); 
elsif PSTATE.EL == EL2 then 
ATS1CPW(R[t]); 
elsif PSTATE.EL == EL3 then 
ATS1CPW(R[t]); 
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G8.2.16 ATS1CPWP, Address Translate Stage 1 Current state PL1 Write PAN 
The ATS1CPWP characteristics are: 


Purpose 


When ARMv8.2-ATS1E1 is implemented, performs a stage 1 address translation at PL1 and in the 
current Security state, where the value of PSTATE.PAN determines if a write to the location will 


generate a permission fault for a privileged access. 


Configurations 
This instruction is present only when ARMv8.2-ATSIE1 is implemented. Otherwise, direct 
accesses to ATSICPWP are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ATS1CPWP is a 32-bit System instruction. 


Field descriptions 


The ATS1CPWP input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. If EL2 is implemented and enabled in the current 
Security state, the resulting address is the IPA that is the output address of the stage 1 translation. 
Otherwise, the resulting address is a PA. 


Executing the ATS1CPWP instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = Ob0111 Ob1001 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
ATSICPWP(R[t]); 
elsif PSTATE.EL == EL2 then 
ATS1CPWP(R[t]); 
elsif PSTATE.EL == EL3 then 
ATS1CPWP(R[t]); 
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G8.2.17 ATS1CUR, Address Translate Stage 1 Current state Unprivileged Read 


ARM DDI 0487E.a 
ID070919 


The ATSICUR characteristics are: 


Purpose 
Performs stage 1 address translation as defined for PLO and the current Security state, with 
permissions as if reading from the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATSICUR is a 32-bit System instruction. 


Field descriptions 


The ATS1CUR input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. If EL2 is implemented and enabled in the current 
Security state, the resulting address is the IPA that is the output address of the stage 1 translation. 
Otherwise, the resulting address is a PA. 


Executing the ATS1CUR instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 Ob1000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
ATSICUR(R[t]); 
elsif PSTATE.EL == EL2 then 
ATSICUR(R[t]); 
elsif PSTATE.EL == EL3 then 
ATSICUR(R[t]); 
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G8.2.18 ATS1CUW, Address Translate Stage 1 Current state Unprivileged Write 


The ATSICUW characteristics are: 


Purpose 
Performs stage 1 address translation as defined for PLO and the current Security state, with 
permissions as if writing to the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATS1CUW is a 32-bit System instruction. 


Field descriptions 


The ATS1CUW input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. If EL2 is implemented and enabled in the current 
Security state, the resulting address is the IPA that is the output address of the stage 1 translation. 
Otherwise, the resulting address is a PA. 


Executing the ATS1CUW instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = O0b0111 Ob1000 Ob011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
else 
ATS1ICUW(R[t]); 
elsif PSTATE.EL == EL2 then 
ATS1CUW(R[t]); 
elsif PSTATE.EL == EL3 then 
ATS1CUW(R[t] ); 
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G8.2.19 ATS1HR, Address Translate Stage 1 Hyp mode Read 


ARM DDI 0487E.a 
ID070919 


The ATS1HR characteristics are: 


Purpose 
Performs stage 1 address translation as defined for PL2 and the Non-secure state, with permissions 
as if reading from the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATS1HR is a 32-bit System instruction. 


Field descriptions 


The ATS1HR input value bit assignments are: 


31 0 
Input address for translation 
Bits [31:0] 


Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. The resulting address is the PA that is the output address 
of the translation. 


Executing the ATS1HR instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b100 = Ob0111 O0b1000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
ATSIHR(R[t]); 
elsif PSTATE.EL == EL2 then 
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ATSIHR(R[t] ); 
elsif PSTATE.EL == EL3 then 
ATSIHR(R[t] ); 
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G8.2.20 ATS1HW, Address Translate Stage 1 Hyp mode Write 


ARM DDI 0487E.a 
ID070919 


The ATS1HW characteristics are: 


Purpose 
Performs stage 1 address translation as defined for PL2 and the Non-secure state, with permissions 
as if writing to the given virtual address. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ATS1HW is a 32-bit System instruction. 


Field descriptions 


The ATS1HW input value bit assignments are: 


31 0 


Input address for translation 


Bits [31:0] 
Input address for translation. The resulting address can be read from the PAR. 


This System instruction takes a VA as input. The resulting address is the PA that is the output address 
of the translation. 


Executing the ATS1HW instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b100 0b0111 Ob1000 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
ATSIHW(R[t]); 
elsif PSTATE.EL == EL2 then 
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ATSIHW(R[t]); 
elsif PSTATE.EL == EL3 then 
ATSIHW(R[t]); 
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G8.2.21 BPIALL, Branch Predictor Invalidate All 


The BPIALL characteristics are: 


Purpose 
Invalidate all entries from branch predictors. 
Configurations 
In an implementation where the branch predictors are architecturally invisible, this instruction can 
execute as a NOP. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


BPIALL is a 32-bit System instruction. 


Field descriptions 


BPIALL ignores the value in the register specified by the instruction. Software does not have to write a value to the 


register before issuing this instruction. 


Executing the BPIALL instruction 


The PE ignores the value of <Rt>. Software does not have to write a value to this register before issuing this 


instruction. 


When HCR.FB is 1, at Non-secure EL] this instruction executes as a BPIALLIS. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 


opc2 





Ob1111 0b000 


0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.FB == '1' then 
BPIALLIS(); 
else 
BPIALL(); 
elsif PSTATE.EL == EL2 then 
BPIALL(); 
elsif PSTATE.EL == EL3 then 
BPIALL(); 
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G8.2.22 


G8-5940 


BPIALLIS, Branch Predictor Invalidate All, Inner Shareable 


The BPIALLIS characteristics are: 


Purpose 
Invalidate all entries from branch predictors Inner Shareable. 
Configurations 
In an implementation where the branch predictors are architecturally invisible, this instruction can 
execute as a NOP. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


BPIALLIS is a 32-bit System instruction. 


Field descriptions 


BPIALLIS ignores the value in the register specified by the instruction. Software does not have to write a value to 


the register before issuing this instruction. 


Executing the BPIALLIS instruction 


The PE ignores the value of <Rt>. Software does not have to write a value to this register before issuing this 


instruction. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
0b1111 0b000 0b0111  0b0001 0b110 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
BPIALL(); 
elsif PSTATE.EL == EL2 then 
BPIALL(); 
elsif PSTATE.EL == EL3 then 
BPIALL(); 
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G8.2.23 BPIMVA, Branch Predictor Invalidate by VA 


The BPIMVA characteristics are: 


Purpose 
Invalidate virtual address from branch predictors. 
Configurations 
In an implementation where the branch predictors are architecturally invisible, this instruction can 
execute as a NOP. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


BPIMVA is a 32-bit System instruction. 


Field descriptions 


The BPIMVA input value bit assignments are: 


31 0 
Virtual address to use 
Bits [31:0] 


Virtual address to use. 


Executing the BPIMVA instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1111 0b000 0b0111 0b0101 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 
BPIMVA(R[t]); 
elsif PSTATE.EL == EL2 then 
BPIMVA(R[t]); 
elsif PSTATE.EL == EL3 then 
BPIMVA(R[t]); 
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G8.2.24 


G8-5942 


CCSIDR, Current Cache Size ID Register 


The CCSIDR characteristics are: 


Purpose 
Provides information about the architecture of the currently selected cache. 


When ARMv8.3-CCIDX is implemented, this register is used in conjunction with CCSIDR2. 


Configurations 


AArch32 System register CCSIDR[31:0] is architecturally mapped to AArch64 System register 
CCSIDR_EL1[31:0]. 


The implementation includes one CCSIDR for each cache that it can access. CSSELR and the 
Security state select which Cache Size ID Register is accessible. 


RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CCSIDR is a 32-bit register. 


Field descriptions 


The CCSIDR bit assignments are: 


When ARMv8.3-CCIDX is implemented: 


31 24 23 3 2 0 
RESO Associativity 
Note 





The parameters NumSets, Associativity, and LineSize in these registers define the architecturally visible parameters 
that are required for the cache maintenance by Set/Way instructions. They are not guaranteed to represent the actual 
microarchitectural features of a design. You cannot make any inference about the actual sizes of caches based on 
these parameters. 





Bits [31:24] 
Reserved, RESO. 

Associativity, bits [23:3] 
(Associativity of cache) - 1, therefore a value of 0 indicates an associativity of 1. The associativity 
does not have to be a power of 2. 

LineSize, bits [2:0] 
(Log2(Number of bytes in cache line)) - 4. For example: 
For a line length of 16 bytes: Logo(16) = 4, LineSize entry = 0. This is the minimum line length. 
For a line length of 32 bytes: Log2(32) = 5, LineSize entry = 1. 


Otherwise: 
31 28 27 13 12 3 2 0 
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Note 


The parameters NumSets, Associativity, and LineSize in these registers define the architecturally visible parameters 
that are required for the cache maintenance by Set/Way instructions. They are not guaranteed to represent the actual 
microarchitectural features of a design. You cannot make any inference about the actual sizes of caches based on 
these parameters. 








UNKNOWN, bits [31:28] 


Reserved, UNKNOWN. 


NumSets, bits [27:13] 


(Number of sets in cache) - 1, therefore a value of 0 indicates 1 set in the cache. The number of sets 
does not have to be a power of 2. 


Associativity, bits [12:3] 


(Associativity of cache) - 1, therefore a value of 0 indicates an associativity of 1. The associativity 
does not have to be a power of 2. 


LineSize, bits [2:0] 
(Log2(Number of bytes in cache line)) - 4. For example: 
For a line length of 16 bytes: Log(16) = 4, LineSize entry = 0. This is the minimum line length. 
For a line length of 32 bytes: Logo(32) = 5, LineSize entry = 1. 


Accessing the CCSIDR 


If CSSELR.Level is programmed to a cache level that is not implemented, then on a read of the CCSIDR the 
behavior is CONSTRAINED UNPREDICTABLE, and can be one of the following: 


. The CCSIDR read is treated as NOP. 
° The CCSIDR read is UNDEFINED. 
. The CCSIDR read returns an UNKNOWN value. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b001 0b0000 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TID4 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return CCSIDR; 
elsif PSTATE.EL == EL2 then 
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return CCSIDR; 
elsif PSTATE.EL == EL3 then 
return CCSIDR; 
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G8.2.25 CCSIDR2, Current Cache Size ID Register 2 


ARM DDI 0487E.a 
ID070919 


The CCSIDR2 characteristics are: 


Purpose 


When ARMv8.3-CCIDX is implemented, in conjunction with CCSIDR, provides information about 
the architecture of the currently selected cache. 


When ARMv8.3-CCIDX is not implemented, this register is not implemented. 


Configurations 


AArch32 System register CCSIDR2[3 1:0] is architecturally mapped to AArch64 System register 
CCSIDR2_EL1[31:0]. 


This register is present only when ARMVv8.3-CCIDX is implemented. Otherwise, direct accesses to 
CCSIDR2 are UNDEFINED. 


The implementation includes one CCSIDR2 for each cache that it can access. CSSELR and the 
Security state select which Cache Size ID Register is accessible. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CCSIDR2 is a 32-bit register. 


Field descriptions 


The CCSIDR2 bit assignments are: 


31 24 23 0 


Bits [31:24] 


Reserved, RESO. 


NumSets, bits [23:0] 


(Number of sets in cache) - 1, therefore a value of 0 indicates 1 set in the cache. The number of sets 
does not have to be a power of 2. 


Accessing the CCSIDR2 


If CSSELR.Level is programmed to a cache level that is not implemented, then on a read of the CCSIDR2 the 
behavior is CONSTRAINED UNPREDICTABLE, and can be one of the following: 


. The CCSIDR2 read is treated as NOP. 
° The CCSIDR2 read is UNDEFINED. 
. The CCSIDR2 read returns an UNKNOWN value. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
0b1111 0b001  0b0000 0b0000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TID4 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return CCSIDR2; 
elsif PSTATE.EL == EL2 then 
return CCSIDR2; 
elsif PSTATE.EL == EL3 then 
return CCSIDR2; 
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G8.2.26 CFPRCTX, Control Flow Prediction Restriction by Context 


The CFPRCTX characteristics are: 


Purpose 


Control Flow Prediction Restriction by Context applies to all Control Flow Prediction Resources 
that predict execution based on information gathered within the target execution context or contexts. 


When this instruction is complete and synchronized, control flow prediction does not permit later 
speculative execution within the target execution context to be observable through side channels. 
This instruction is guaranteed to be complete following a DSB that covers both read and write 
behavior on the same PE as executed the original restriction instruction, and a subsequent context 


synchronization event is required to ensure that the effect of the completion of the instructions is 
synchronized to the current execution. 


Note 


This instruction does not require the invalidation of prediction structures so long as the behavior 
described for completion of this instruction is met by the implementation. 





On some implementations the instruction is likely to take a significant number of cycles to execute. 
This instruction is expected to be used very rarely, such as on the roll-over of an ASID or VMID, 
but should not be used on every context switch. 





Configurations 


This instruction is present only when ARMV8.0-PredInv is implemented. Otherwise, direct accesses 
to CFPRCTX are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CFPRCTX is a 32-bit System instruction. 


Field descriptions 


The CFPRCTX input value bit assignments are: 


31 28 27 26 25 24 23 1615 98 7 0 


RESO hs | VMID RESO ASID 


GVMID _ | Po GASID 


ARM DDI 0487E.a 
ID070919 


Bits [31:28] 
Reserved, RESO. 
GVMID, bit [27] 
Execution of this instruction applies to all VMIDs or a specified VMID. 


Ob Applies to specified VMID for an ELO or EL1 context. For all other contexts this field 
is RESO. 
Qb1 Applies to all VMIDs for an ELO or EL1 context. For all other contexts this field is RESO. 


If the instruction is executed at ELO or EL1, then this field has an Effective value of 0. 


NS, bit [26] 
Security State. 


Qbd Secure state. 
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G8-5948 


Qb1 Non-secure state. 


If the instruction is executed in Non-secure state, this field has an Effective value of 1. 


EL, bits [25:24] 


Exception Level. 


0b00 ELO. 
0b01 EL1. 
0b10 EL2. 
0b11 EL3. 


If the instruction is executed at an exception level lower than the specified level, this instruction is 
treated as a NOP. 


VMID, bits [23:16] 


Bits [15:9] 


Only applies when bit[27] is 0 and either of: 


° an EL1 context. 
s an ELO context when (HCR_EL2.E2H==0 or HCR_EL2.TGE==0) or EL2 is using AArch32 
state. 


Otherwise this field is RESO. 
When the instruction is executed at EL1 then this field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==0 or HCR_EL2.TGE==0 or 
ELUsingAArch32(EL2)) then this field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==1 and HCR_EL2.TGE==1 and 
!ELUsingAArch32(EL2)) then this field is ignored. 


Reserved, RESO. 


GASID, bit [8] 


Execution of this instruction applies to all ASIDs or a specified ASID. 
Ob Applies to specified ASID for an ELO context. For all other contexts this field is RESO. 
Qb1 Applies to all ASID for an ELO context. For all other contexts this field is RESO. 


If the instruction is executed at ELO, then this field is treated as 0. 


ASID, bits [7:0] 


Only applies for an ELO context and when bit[8] is 0. 
Otherwise this field is RESO. 
When the instruction is executed at ELO then this field is treated as the current ASID. 


Executing the CFPRCTX instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 Ob0011 0b100 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.EnRCTX == 'Q' 


then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
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AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && SCTLR.EnRCTX == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T7 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.EnRCTX == 'Q' 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


else 
CFPRCTX(R[t]); 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x03); 
else 
CFPRCTX(R[t]); 
elsif PSTATE.EL == EL2 then 
CFPRCTX(R[t]); 
elsif PSTATE.EL == EL3 then 
CFPRCTX(R[t]); 
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G8.2.27 CLIDR, Cache Level ID Register 
The CLIDR characteristics are: 


Purpose 


Identifies the type of cache, or caches, that are implemented at each level and can be managed using 
the architected cache maintenance instructions that operate by set/way, up to a maximum of seven 
levels. Also identifies the Level of Coherence (LoC) and Level of Unification (LoU) for the cache 
hierarchy. 

Configurations 


AArch32 System register CLIDR[3 1:0] is architecturally mapped to AArch64 System register 
CLIDR_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CLIDR is a 32-bit register. 


Field descriptions 


The CLIDR bit assignments are: 


313029 2726 2423 2120 1817 1514 1211 9 8 6 5 3 2 0 





ICB, bits [31:30] 


Inner cache boundary. This field indicates the boundary for caching Inner Cacheable memory 
regions. 


The possible values are: 


0b00 Not disclosed by this mechanism. 

0b01 L1 cache is the highest Inner Cacheable level. 
0b10 L2 cache is the highest Inner Cacheable level. 
0b11 L3 cache is the highest Inner Cacheable level. 


LoUU, bits [29:27] 

Level of Unification Uniprocessor for the cache hierarchy. 
LoC, bits [26:24] 

Level of Coherence for the cache hierarchy. 
LoUIS, bits [23:21] 

Level of Unification Inner Shareable for the cache hierarchy. 
Ctype<n>, bits [3(n-1)+2:3(n-1)], for n = 1 to 7 


Cache Type fields. Indicate the type of cache that is implemented and can be managed using the 
architected cache maintenance instructions that operate by set/way at each level, from Level 1 up to 
a maximum of seven levels of cache hierarchy. Possible values of each field are: 


0b000 No cache. 
0b001 Instruction cache only. 
0b010 Data cache only. 


0b011 Separate instruction and data caches. 
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Qb100 Unified cache. 
All other values are reserved. 


If software reads the Cache Type fields from Ctypel upwards, once it has seen a value of 000, no 
caches that can be managed using the architected cache maintenance instructions that operate by 
set/way exist at further-out levels of the hierarchy. So, for example, if Ctype3 is the first Cache Type 


field with a value of 000, the values of Ctype4 to Ctype7 must be ignored. 


Accessing the CLIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 














coproc opci CRn CRm opc2 
0b1111 0b001  0b0000 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TID4 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return CLIDR; 
elsif PSTATE.EL == EL2 then 
return CLIDR; 
elsif PSTATE.EL == EL3 then 
return CLIDR; 
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G8.2.28 


G8-5952 


CONTEXTIDR, Context ID Register 


The CONTEXTIDR characteristics are: 


Purpose 


Identifies the current Process Identifier and, when using the Short-descriptor translation table 
format, the Address Space Identifier. 


The value of the whole of this register is called the Context ID and is used by: 
° The debug logic, for Linked and Unlinked Context ID matching. 
- The trace logic, to identify the current process. 


The significance of this register is for debug and trace use only. 


Configurations 


AArch32 System register CONTEXTIDR[31:0] is architecturally mapped to AArch64 System 
register CONTEXTIDR_EL1[31:0]. 


The register format depends on whether address translation is using the Long-descriptor or the 
Short-descriptor translation table format. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CONTEXTIDR is a 32-bit register. 


Field descriptions 


The CONTEXTIDR bit assignments are: 


When TTBCR.EAE == 0: 


31 8 7 0 
PROCID ASID 


PROCID, bits [31:8] 
Process Identifier. This field must be programmed with a unique value that identifies the current 
process. 
This field resets to an architecturally UNKNOWN value. 


ASID, bits [7:0] 
Address Space Identifier. This field is programmed with the value of the current ASID. 


This field resets to an architecturally UNKNOWN value. 


When TTBCR.EAE == 1: 


31 0 
PROCID 


PROCID, bits [31:0] 
Process Identifier. This field must be programmed with a unique value that identifies the current 
process. 
This field resets to an architecturally UNKNOWN value. 
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Accessing the CONTEXTIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return CONTEXTIDR_S; 
else 
return CONTEXTIDR_NS; 
else 
return CONTEXTIDR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CONTEXTIDR_NS; 
else 
return CONTEXTIDR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return CONTEXTIDR_S; 
else 





return CONTEXTIDR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
CONTEXTIDR_S = R[t]; 
else 
CONTEXTIDR_NS = R[t]; 
else 


coproc opct CRn CRm opc2 
0b1111 0b000 0b1101 Ob0000 0b001 
coproc opc1 CRn CRm opc2 
0b1111 0b000 0b1101  0b0000 0b001 
G8-5953 
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CONTEXTIDR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
CONTEXTIDR_NS = R[t]; 
else 
CONTEXTIDR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
CONTEXTIDR_S = R[t]; 
else 





CONTEXTIDR_NS = R[t]; 
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CP15DMB, Data Memory Barrier System instruction 


ARM DDI 0487E.a 


The CP15DMB characteristics are: 


Purpose 
Performs a Data Memory Barrier. 
Arm deprecates any use of this System instruction, and strongly recommends that software use the 
DMB instruction instead. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CP15DMB is a 32-bit System instruction. 


Field descriptions 


CP15DMB ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 


Executing the CP15DMB instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b0111 Ob1010 0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.CP15BEN == 'Q' 


then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.CP15BEN == 'Q' 
then 
UNDEFINED; 
elsif ELUsingAArch32(EL1) && SCTLR.CP1SBEN == 'Q' then 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

else 
CP15DMB(); 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif ELUsingAArch32(EL1) && SCTLR.CP15BEN == 'Q@' then 
UNDEFINED; 

else 
CP15DMB(); 

elsif PSTATE.EL == EL2 then 

if HSCTLR.CPI5BEN == '@' then 
UNDEFINED; 

else 
CP15DMB(); 
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elsif PSTATE.EL == EL3 then 
CP15DMB(); 
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CP15DSB, Data Synchronization Barrier System instruction 


ARM DDI 0487E.a 


The CP15DSB characteristics are: 


Purpose 
Performs a Data Synchronization Barrier. 
Arm deprecates any use of this System instruction, and strongly recommends that software use the 
DSB instruction instead. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CP15DSB is a 32-bit System instruction. 


Field descriptions 


CP15DSB ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 


Executing the CP15DSB instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 0b1010 0b100 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.CP15BEN == 'Q' 


then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.CP15BEN == 'Q' 
then 
UNDEFINED; 
elsif ELUsingAArch32(EL1) && SCTLR.CP1SBEN == 'Q' then 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

else 
CP15DSB(); 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif ELUsingAArch32(EL1) && SCTLR.CP15BEN == 'Q' then 
UNDEFINED; 

else 
CP15DSB(); 

elsif PSTATE.EL == EL2 then 

if HSCTLR.CPI5BEN == '@' then 
UNDEFINED; 

else 
CP15DSB(); 
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elsif PSTATE.EL == EL3 then 
CP15DSB(); 
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CP15ISB, Instruction Synchronization Barrier System instruction 


ARM DDI 0487E.a 


The CP15ISB characteristics are: 


Purpose 
Performs an Instruction Synchronization Barrier. 
Arm deprecates any use of this System instruction, and strongly recommends that software use the 
ISB instruction instead. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CP15ISB is a 32-bit System instruction. 


Field descriptions 


CP15ISB ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 


Executing the CP15ISB instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 0b0101 0b100 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.CP15BEN == 'Q' 


then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.CP15BEN == 'Q' 
then 
UNDEFINED; 
elsif ELUsingAArch32(EL1) && SCTLR.CP1SBEN == 'Q' then 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

else 
CP15ISB(); 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif ELUsingAArch32(EL1) && SCTLR.CP15BEN == '@' then 
UNDEFINED; 

else 
CP15ISB(); 

elsif PSTATE.EL == EL2 then 

if HSCTLR.CPI5BEN == '@' then 
UNDEFINED; 

else 
CP15ISB(); 
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elsif PSTATE.EL == EL3 then 
CP15ISB(); 
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G8.2.32 CPACR, Architectural Feature Access Control Register 


The CPACR characteristics are: 








Purpose 
Controls access to trace, and to Advanced SIMD and floating-point functionality from ELO, EL1, 
and EL3. 
In an implementation that includes EL2, the CPACR has no effect on instructions executed at EL2. 
Configurations 
AArch32 System register CPACR[3 1:0] is architecturally mapped to AArch64 System register 
CPACR_EL1[31:0]. 
Bits in the NSACR control Non-secure access to the CPACR fields. See the field descriptions for 
more information. 
Note 
In the register field descriptions, controls are described as applying at specified Privilege levels. 
This is because, in Secure state, a PL1 control: 
è Applies to execution in a Secure EL3 mode when EL3 is using AArch32. 
° Applies to execution in a Secure EL] mode when EL3 is using AArch64. 
See Security state, Exception levels, and AArch32 execution privilege on page G1-5480. 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 
Attributes 


CPACR is a 32-bit register. 


Field descriptions 


The CPACR bit assignments are: 


31 30 29 28 27 24 23 22 21 20 19 0 


ASEDIS — | | 
RESO 


TRCDIS 


ASEDIS, bit [31] 
Disables PLO and PL1 execution of Advanced SIMD instructions. 
Ob This control permits execution of Advanced SIMD instructions at PLO and PL1. 


Qb1 All instruction encodings that are Advanced SIMD instruction encodings, but are not 
also floating-point instruction encodings, are UNDEFINED at PLO and PL1. 


If the implementation does not include Advanced SIMD and floating-point functionality, this field 
is RESO. Otherwise, it is IMPLEMENTATION DEFINED whether this field is implemented as a RW field. 
If it is not implemented as a RW field, it is RAZ/WI. 


If EL3 is implemented and is using AArch32, and the value of NSACR.NSASEDIS is 1, this field 
behaves as RAO/WI in Non-secure state, regardless of its actual value. This applies even if the field 
is implemented as RAZ/WI. 
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Bits [30:29] 


For the list of instructions affected by this field, see Controls of Advanced SIMD operation that do 
not apply to floating-point operation on page E1-3800. 


See the description of CPACR.cp10 for a list of other controls that can disable or trap execution of 
Advanced SIMD instructions in AArch32 state. 


This field resets to Q. 


Reserved, RESO. 


TRCDIS, bit [28] 


Bits [27:24] 


Traps PLO and PL1 System register accesses to all implemented trace registers to Undefined mode. 


Ob This control has no effect on PLO and PL1 System register accesses to trace registers. 
Qb1 PLO and PL1 System register accesses to all implemented trace registers are trapped to 
Undefined mode. 


If the implementation does not include a PE trace unit, or does not include a System register 
interface to the PE trace unit registers, this field is RESO. Otherwise, it is IMPLEMENTATION DEFINED 
whether this field is implemented as a RW field. If it is not implemented as a RW field, it is RAZ/WI. 


If EL3 is implemented and is using AArch32, and the value of NSACR.NSTRCDIS is 1, this field 
behaves as RAO/WI in Non-secure state, regardless of its actual value. This applies even if the field 
is implemented as RAZ/WI. 


— Note 

è The ETMv4 architecture does not permit ELO to access the trace registers. If the 
implementation includes an ETMv4 implementation, ELO accesses to the trace registers are 
UNDEFINED. 

. The architecture does not provide traps on trace register accesses through the optional 


memory-mapped external debug interface. 





System register accesses to the trace registers can have side-effects. When a System register access 
is trapped, any side-effects that are normally associated with the access do not occur before the 
exception is taken. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


cp11, bits [23:22] 


The value of this field is ignored. If this field is programmed with a different value to the cp10 field 
then this field is UNKNOWN on a direct read of the CPACR. 


If the implementation does not include Advanced SIMD and floating-point functionality, this field 
is RESO. 


In Non-secure state, if EL3 is implemented and is using AArch32, when the value of NSACR.cp10 
is 0, this field behaves as RAZ/WI, regardless of its actual value. 


This field resets to 0. 


cp10, bits [21:20] 


Defines the access rights for the floating-point and Advanced SIMD functionality. Possible values 
of the field are: 


0b00 PLO and PL1 accesses to floating-point and Advanced SIMD registers or instructions 
are UNDEFINED. 
0b01 PLO accesses to floating-point and Advanced SIMD registers or instructions are 
UNDEFINED. 
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0b10 Reserved. The effect of programming this field to this value is CONSTRAINED 
UNPREDICTABLE. See Reserved values in System and memory-mapped registers and 
translation table entries on page K1-7628. 


Qb11 This control permits full access to the floating-point and Advanced SIMD functionality 
from PLO and PL1. 


The floating-point and Advanced SIMD features controlled by these fields are: 
. Execution of any floating-point or Advanced SIMD instruction. 


$ Any access to the Advanced SIMD and floating-point registers D0-D31 and their views as 
S0-S31 and Q0-Q15. 


. Any access to the FPSCR, FPSID, MVFRO, MVFR1, MVFR2, or FPEXC System registers. 


Note 


The CPACR has no effect on floating-point and Advanced SIMD accesses from PL2. These can be 
disabled by the HCPTR.TCP10 field. 








If the implementation does not include Advanced SIMD and floating-point functionality, this field 
is RESO. 


In Non-secure state, if EL3 is implemented and is using AArch32, when the value of NSACR.cp10 
is 0, this field behaves as RAZ/WI, regardless of its actual value. 


Execution of floating-point and Advanced SIMD instructions in AArch32 state can be disabled or 
trapped by the following controls: 


CPACR.cp10, or, if executing at EL0, CPACR_EL1.FPEN. 
. FPEXC.EN. 
a If executing in Non-secure state: 
— HCPTR.TCP10, or if EL2 is using AArch64, CPTR_EL2.TFP. 
—  NSACR.cp10, or if EL3 is using AArch64, CPTR_EL3.TFP. 
` For Advanced SIMD instructions only: 
— CPACR.ASEDIS. 
—  Ifexecuting in Non-secure state, HCPTR.TASE and NSACR.NSTRCDIS. 
See the descriptions of the controls for more information. 


This field resets to Q. 


Reserved, RESO. 


Accessing the CPACR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b0001 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TCPAC == '1' then 
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AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TCPAC == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return CPACR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return CPACR; 
elsif PSTATE.EL == EL3 then 
return CPACR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 
Ob1111 0b000 0b0001 Ob0000 O0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TCPAC == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TCPAC == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
CPACR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
CPACR = R[t]; 
elsif PSTATE.EL == EL3 then 
CPACR = R[t]; 
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The CPSR characteristics are: 


Purpose 
Holds PE status and control information. 

Configurations 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


CPSR is a 32-bit register. 


Field descriptions 


The CPSR bit assignments are: 


31 30 29 28 27 26 24 23 22 21 20 19 1615 1098765 4 3 





SSBS cea f= = 
RESO 


PAN 
DIT 


RESO 


N, bit [31] 
Negative condition flag. Set to bit[31] of the result of the last flag-setting instruction. If the result is 
regarded as a two's complement signed integer, then N is set to 1 if the result was negative, and N 
is set to 0 if the result was positive or zero. 

Z, bit [30] 
Zero condition flag. Set to 1 if the result of the last flag-setting instruction was zero, and to 0 
otherwise. A result of zero often indicates an equal result from a comparison. 

C, bit [29] 
Carry condition flag. Set to 1 if the last flag-setting instruction resulted in a carry condition, for 
example an unsigned overflow on an addition. 

V, bit [28] 
Overflow condition flag. Set to 1 ifthe last flag-setting instruction resulted in an overflow condition, 
for example a signed overflow on an addition. 

Q, bit [27] 


Cumulative saturation bit. Set to 1 to indicate that overflow or saturation occurred in some 
instructions. 
Bits [26:24] 
Reserved, RESO. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 
Speculative Store Bypass Safe. 
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Prohibits speculative loads or stores which might practically allow a cache timing side channel. 


A cache timing side channel might be exploited where a load or store uses an address that is derived 
from a register that is being loaded from memory using a load instruction speculatively read from a 
memory location. If PSTATE.SSBS is enabled, the address derived from the load instruction might 
be from earlier in the coherence order than the latest store to that memory location with the same 
virtual address. 


Qbd Hardware is not permitted to load or store speculatively in the manner described. 
Qb1 Hardware is permitted to load or store speculatively in the manner described. 


The value of this bit is usually set to the value described by the SCTLR.DSSBS bit on exceptions 
to any mode except Hyp mode, and the value described by HSCTLR.DSSBS on exceptions to Hyp 
mode. 


This field resets to an IMPLEMENTATION DEFINED value. 


Otherwise: 


PAN, bit [22] 


Reserved, RESO. 


When ARMV8.1-PAN is implemented: 


Privileged Access Never. 

Obd The translation system is the same as Armv8.0. 

Qb1 Disables privileged read and write accesses to addresses accessible at ELO. 

The value of this bit is usually preserved on taking an exception, except in the following situations: 


è When the target of the exception is EL1, and the value ofthe SCTLR.SPAN bit for the current 
Security state is 0, this bit is set to 1. 


° When the target of the exception is EL3, from Secure state, and the value of the Secure 
SCTLR.SPAN is 0, this bit is set to 1. 


$ When the target of the exception is EL3, from Non-secure state, this bit is set to 0 regardless 
of the value of the Secure SCTLR.SPAN bit. 


Otherwise: 


DIT, bit [21] 


Reserved, RESO. 


When ARMv8.4-DIT is implemented: 


Data Independent Timing. 


Qbd The architecture makes no statement about the timing properties of any instructions. 
Qb1 The architecture requires that: 
a The timing of every load and store instruction is insensitive to the value of the 


data being loaded or stored. 


s For certain data processing instructions, the instruction takes a time which is 
independent of: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 


š For certain data processing instructions, the response of the instruction to 
asynchronous exceptions does not vary based on: 


— The values of the data supplied in any of its registers. 
— The values of the NZCV flags. 

The data processing instructions affected by this bit are: 

s All cryptographic instructions. These instructions are: 


— AESD, AESE, AESIMC, AESMC, SHA1C, SHA1H, SHA1M, SHA1P, SHA1SUQ, SHA1SU1, SHA256H, 
SHA256H2, SHA256SU0, and SHA256SU1. 
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. A subset of those instructions which use the general-purpose register file. For these 
instructions, the effects of CPSR.DIT apply only if they do not use R15 as either their source 
or destination and pass their condition execution check. The instructions are: 


— BFI, BFC, CLZ, CMN, CMP, MLA, MLAS, MLS, MOVT, MUL, MULS, NOP, PKHBT, PKHTB, RBIT, REV, REV16, 
REVSH, RRX, SADD16, SADD8, SASX, SBFX, SHADD16, SHADD8, SHASX, SHSAX, SHSUB16, SHSUB8, 
SMLAL**, SMLAWs, SMLSD*, SMMLA=, SMMLS«, SMMUL*, SMUAD*, SMUL#, SSAX, SSUB16, SSUB8, 
SXTABs, SXTAH, SXTBs, SXTH, TEQ, TST, UADDs, UASX, UBFX, UHADD=, UHASX, UHSAX, UHSUB=, 
UMAAL, UMLAL, UMLALS, UMULL, UMULLS, USADA8, USAX, USUB=, UXTAB*, UXTAH, UXTB«, UXTH, ADC 
(register-shifted register), ADCS (register-shifted register), ADD (register-shifted 
register), ADDS (register-shifted register), AND (register-shifted register), ANDS 
(register-shifted register), ASR (register-shifted register), ASRS (register-shifted 
register), BIC (register-shifted register), BICS (register-shifted register), EOR 
(register-shifted register), EORS (register-shifted register), LSL (register-shifted 
register), LSLS (register-shifted register), LSR (register-shifted register), LSRS 
(register-shifted register), MOV (register-shifted register), MOVS (register-shifted 
register), MVN (register-shifted register), MVNS (register-shifted register), ORR 
(register-shifted register), ORRS (register-shifted register), ROR (register-shifted 
register), RORS (register-shifted register), RSB (register-shifted register), RSBS 
(register-shifted register), RSC (register-shifted register), RSCS (register-shifted 
register), SBC (register-shifted register), SBCS (register-shifted register), SUB 
(register-shifted register), and SUBS (register-shifted register). 


° A subset of those instructions which use the general-purpose register file. For these 
instructions, the effects of CPSR.DIT apply only if they do not use R15 as either their source 
or destination. The effects of CPSR.DIT do not depend on these instructions passing their 
condition execution check. These instructions are: 


— ADC(immediate), ADC (register), ADCS (immediate), ADCS (register), ADD (immediate), ADD 
(register), ADDS (immediate), ADDS (register), AND (immediate), AND (register), ANDS 
(immediate), ANDS (register), ASR (immediate), ASR (register), ASRS (immediate), ASRS 
(register), BIC (immediate), BIC (register), BICS (immediate), BICS (register), EOR 
(immediate), EOR (register), EORS (immediate), EORS (register), LSL (immediate), LSL 
(register), LSLS (immediate), LSLS (register), LSR (immediate), LSR (register), LSRS 
(immediate), LSRS (register), MOV (immediate), MOV (register), MOVS (immediate), MOVS 
(register), MVN (immediate), MVN (register), MVNS (immediate), MVNS (register), ORR 
(immediate), ORR (register), ORRS (immediate), ORRS (register), ROR (immediate), ROR 
(register), RORS (immediate), RORS (register), RSB (immediate), RSB (register), RSBS 
(immediate), RSBS (register), RSC (immediate), RSC (register), RSCS (immediate), RSCS 
(register), SBC (immediate), SBC (register), SBCS (immediate), SBCS (register), SUB 
(immediate), SUB (register), SUBS (immediate), and SUBS (register). 





° A subset of those instructions which use the SIMD&FP register file. For these instructions, 
the effects of CPSR.DIT apply only if they pass their condition execution check. These 
instructions are: 


— _ CRC32B, CRC32H, CRC32W, CRC32CB, CRC32CH, CRC32CW, VABA, VABD::, VABS, VACGE, VACGT, 
VACLE, VACLT, VADD (integer), VADDHN, VADDL, VADDW, VAND, VBIC, VBIF, VBIT, VBSL, VCGE, 
VCGT, VCLE, VCLS, VCLT, VCLZ, VCMP, VCMPE, VCNT, VDUP, VEOR, VEXT, VHADD, VHSUB, VMAX 
(integer), VMIN (integer), VMLA (integer), VMLAL, VMLS (integer), VMLSL, VMOV, VMOVL, VMOVN, 
VMUL (integer and polynomial), VMULL (integer and polynomial), VMVN, VNEG, VORN, VORR, 
VPADAL, VPADD (integer), VPADDL, VPMAX (integer), VPMIN (integer), VRADDHN, VREV=, VRHADD, 
VRSHL, VRSHR, VRSHRN, VRSRA, VRSUBHN, VSELEQ, VSELGE, VSELGT, VSELVS, VSHL, VSHLL, VSHR, 
VSLI, VSRA, VSRI, VSUB (integer), VSUBHN, VSUBL, VSUBW, VSWP, VTBL, VTBX, VTRN, VTST, VUZP, 
and VZIP 


This field resets to Q. 
Otherwise: 
Reserved, RESO. 
Bit [20] 


Reserved, RESO. 
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GE, bits [19:16] 


Bits [15:10] 


E, bit [9] 


A, bit [8] 


I, bit [7] 


F, bit [6] 


Bit [5] 


Bit [4] 


M, bits [3:0] 


Greater than or Equal flags, for parallel addition and subtraction. 


Reserved, RESO. 


Endianness state bit. Controls the load and store endianness for data accesses: 
Qbd Little-endian operation 

Qb1 Big-endian operation. 

Instruction fetches ignore this bit. 


If an implementation does not provide Big-endian support, this bit is RESO. If it does not provide 
Little-endian support, this bit is RES1. 


If an implementation provides Big-endian support but only at ELO, this bit is RESO for an exception 
return to any Exception level other than ELO. 


Likewise, if it provides Little-endian support only at ELO, this bit is RES] for an exception return to 
any Exception level other than ELO. 


When the reset value of the SCTLR.EE bit is defined by a configuration input signal, that value also 
applies to the CPSR.E bit on reset, and therefore applies to software execution from reset. 


SError interrupt mask bit. The possible values of this bit are: 
Qbd Exception not masked. 


Qb1 Exception masked. 


IRQ mask bit. The possible values of this bit are: 
Obd Exception not masked. 


Qb1 Exception masked. 


FIQ mask bit. The possible values of this bit are: 
Qbd Exception not masked. 


Qb1 Exception masked. 


Reserved, RESO. 


Reserved, RES1. 


Current PE mode. Possible values are: 
0b0000 User. 

0b0001 FIQ. 

0b0010 IRQ. 

0b0011 Supervisor. 

0b0110 Monitor. 

0b0111 Abort. 

0b1010 Hyp. 

0b1011 Undefined. 
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Qb1111 System. 
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G8.2.34 


CPPRCTX, Cache Prefetch Prediction Restriction by Context 


The CPPRCTX characteristics are: 


Purpose 


Cache Prefetch Prediction Restriction by Context applies to all Cache Allocation Resources that 
predict cache allocations based on information gathered within the target execution context or 
contexts. 


When this instruction is complete and synchronized, cache prefetch prediction does not permit later 
speculative execution within the target execution context to be observable through side channels. 


This instruction applies to all: 
° Instruction caches. 
. Data caches. 


° TLB prefetching hardware used by the executing PE that applies to the supplied context or 
contexts. 


This instruction is guaranteed to be complete following a DSB that covers both read and write 
behavior on the same PE as executed the original restriction instruction, and a subsequent context 
synchronization event is required to ensure that the effect of the completion of the instructions is 
synchronized to the current execution. 


Note 


This instruction does not require the invalidation of Cache Allocation Resources so long as the 
behavior described for completion of this instruction is met by the implementation. 





On some implementations the instruction is likely to take a significant number of cycles to execute. 
This instruction is expected to be used very rarely, such as on the roll-over of an ASID or VMID, 
but should not be used on every context switch. 





Configurations 


This instruction is present only when ARMv8.0-PredInv is implemented. Otherwise, direct accesses 
to CPPRCTX are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CPPRCTX is a 32-bit System instruction. 


Field descriptions 


The CPPRCTX input value bit assignments are: 


28 27 26 25 24 23 1615 98 7 0 


31 
RESO hs | VMID RESO ASID 


GVMID = == =| aa: GASID 


G8-5970 


Bits [31:28] 
Reserved, RESO. 
GVMID, bit [27] 
Execution of this instruction applies to all VMIDs or a specified VMID. 


Ob Applies to specified VMID for an ELO or EL1 context. For all other contexts this field 
is RESO. 
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Qb1 Applies to all VMIDs for an ELO or EL1 context. For all other contexts this field is RESO. 
If the instruction is executed at ELO or EL1, then this field has an Effective value of 0. 


NS, bit [26] 
Security State. 
Qbd Secure state. 
Qb1 Non-secure state. 


If the instruction is executed in Non-secure state, this field is treated as 1. 


EL, bits [25:24] 


Exception Level. 


0b00 ELO. 
0b01 ELI. 
0b10 EL2. 
@b11 EL3. 
If the instruction is executed at an exception level lower than the specified level, this instruction is 
treated as a NOP. 


VMID, bits [23:16] 
Only applies when bit[27] is 0 and either: 


° an EL1 context. 
a an ELO context when (HCR_EL2.E2H==0 or HCR_EL2.TGE==0) or EL2 is using AArch32 
state. 


Otherwise this field is RESO. 
When the instruction is executed at EL1 then this field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==0 or HCR_EL2.TGE==0 or 
ELUsingAArch32(EL2)) then this field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==1 and HCR_EL2.TGE==1 and 
!ELUsingAArch32(EL2)) then this field is ignored. 

Bits [15:9] 
Reserved, RESO. 

GASID, bit [8] 
Execution of this instruction applies to all ASIDs or a specified ASID. 
Ob Applies to specified ASID for an ELO context. For all other contexts this field is RESO. 
Qb1 Applies to all ASID for an ELO context. For all other contexts this field is RESO. 


If the instruction is executed at ELO, then this field has an Effective value of 0. 


ASID, bits [7:0] 
Only applies for an ELO context and when bit[8] is 0. 
Otherwise this field is RESO. 
When the instruction is executed at ELO then this field is treated as the current ASID. 


Executing the CPPRCTX instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








coproc opct CRn CRm opc2 
0b1111 0b000 0b0111  0b0011 0b111 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.EnRCTX == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 


AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && SCTLR.EnRCTX == 'Q' then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 


UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.EnRCTX == '0' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 


CPPRCTX(R[t]); 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x03); 
else 


CPPRCTX(R[t] ); 

elsif PSTATE.EL == EL2 then 
CPPRCTX(R[t]); 

elsif PSTATE.EL == EL3 then 
CPPRCTX(R[t]); 
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G8.2.35 CSSELR, Cache Size Selection Register 
The CSSELR characteristics are: 


Purpose 


Selects the current Cache Size ID Register, CCSIDR, by specifying the required cache level and the 
cache type, which is either instruction cache or data cache. 


If ARMv8.3-CCIDX is implemented, CSSELR also selects the current CCSIDR2. 


Configurations 


AArch32 System register CSSELR[3 1:0] is architecturally mapped to AArch64 System register 
CSSELR_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CSSELR is a 32-bit register. 


Field descriptions 


The CSSELR bit assignments are: 


Bits [31:4] 


Reserved, RESO. 


Level, bits [3:1] 

Cache level of required cache. Permitted values are: 
0b000 Level 1 cache. 

0b001 Level 2 cache. 

0b010 Level 3 cache. 

0b011 Level 4 cache. 

0b100 Level 5 cache. 

0b101 Level 6 cache. 

0b110 Level 7 cache. 

All other values are reserved. 


If CSSELR.Level is programmed to a cache level that is not implemented, then the value for this 
field on a read of CSSELR is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


InD, bit [0] 
Instruction not Data bit. Permitted values are: 
Ob Data or unified cache. 
Qb1 Instruction cache. 


If CSSELR.Level is programmed to a cache level that is not implemented, then the value for this 
field on a read of CSSELR is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 
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Accessing the CSSELR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


























coproc opct CRn CRm opc2 
0b1111 0b010 0b0000 0b0000 0b000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TID4 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return CSSELR_S; 
else 
return CSSELR_NS; 
else 
return CSSELR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CSSELR_NS; 
else 
return CSSELR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return CSSELR_S; 
else 
return CSSELR_NS; 
MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
coproc opct CRn CRm opc2 
Ob1111 0b010 0b0000 O0b0000 Ob000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID4 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
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elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TID4 == '1' then 


AArc 
elsif Ha 
if S 


else 


else 
CSSE 
elsif PSTATE 
if HaveE 
CSSE 

else 
CSSE 
elsif PSTATE 
if SCR.N 
CSSE 

else 
CSSE 


h32.TakeHypTrapException(QxQ3) ; 
veEL(EL3) && ELUsingAArch32(EL3) then 
CR.NS == '@' then 

CSSELR_S = R[t]; 


CSSELR_NS = R[t]; 


LR = R[t]; 

„EL == EL2 then 

L(EL3) && ELUsingAArch32(EL3) then 
LR_NS = R[t]; 


LR = R[t]; 

„EL == EL3 then 
S == 'Q' then 
LR_S = R[t]; 





LR_NS = R[t]; 
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G8.2.36 CTR, Cache Type Register 


The CTR characteristics are: 


Purpose 
Provides information about the architecture of the caches. 
Configurations 
AArch32 System register CTR[3 1:0] is architecturally mapped to AArch64 System register 
CTR_ELO[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CTR is a 32-bit register. 


Field descriptions 


The CTR bit assignments are: 


31 30 29 28 27 24 23 20 19 16 15 14 13 





RES1 a=! 
RESO 


DIC 
IDC 
Bit [31] 
Reserved, RES]. 
Bit [30] 
Reserved, RESO. 
DIC, bit [29] 
Instruction cache invalidation requirements for instruction to data coherence. The meaning of this 
bit is: 
Qbd Instruction cache invalidation to the Point of Unification is required for instruction to 
data coherence. 
Qb1 Instruction cache cleaning to the Point of Unification is not required for instruction to 
data coherence. 
IDC, bit [28] 
Data cache clean requirements for instruction to data coherence. The meaning of this bit is: 
Qbd Data cache clean to the Point of Unification is required for instruction to data coherence, 
unless CLIDR.LoC == 0b000 or (CLIDR.LoUIS == 0b000 & & CLIDR.LoUU == 0b000). 
Qb1 Data cache clean to the Point of Unification is not required for instruction to data 
coherence. 
CWG, bits [27:24] 
Cache writeback granule. Log? of the number of words of the maximum size of memory that can be 
overwritten as a result of the eviction of a cache entry that has had a memory location in it modified. 
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A value of 0b0000 indicates that this register does not provide Cache writeback granule information 


and either: 
° The architectural maximum of 512 words (2KB) must be assumed. 
s The Cache writeback granule can be determined from maximum cache line size encoded in 


the Cache Size ID Registers. 
Values greater than 0b1001 are reserved. 
Arm recommends that an implementation that does not support cache write-back implements this 
field as 0b0001. This applies, for example, to an implementation that supports only write-through 
caches. 
ERG bits [23:20] 


Exclusives reservation granule. Log» of the number of words of the maximum size of the reservation 
granule that has been implemented for the Load-Exclusive and Store-Exclusive instructions. 


The use of the value @b0000 is deprecated. 


The value 0b0001 and values greater than 0b1001 are reserved. 


DminLine, bits [19:16] 


Log» of the number of words in the smallest cache line of all the data caches and unified caches that 
are controlled by the PE. 


Lilp, bits [15:14] 


Level 1 instruction cache policy. Indicates the indexing and tagging policy for the L1 instruction 
cache. Possible values of this field are: 


0b00 VMID aware Physical Index, Physical tag (VPIPT) 
0b01 ASID-tagged Virtual Index, Virtual Tag (AIVIVT) 
0b10 Virtual Index, Physical Tag (VIPT) 

0b11 Physical Index, Physical Tag (PIPT) 


The value 0b01 is reserved in Armv8. 


The value 0b00 is permitted only in an implementation that includes ARMv8.2-VPIPT, otherwise 
the value is reserved. 


Bits [13:4] 


Reserved, RESO. 


IminLine, bits [3:0] 


Log» of the number of words in the smallest cache line of all the instruction caches that are 
controlled by the PE. 


Accessing the CTR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0000 0b0000 0b001 


if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 
return CTR; 
elsif PSTATE.EL == EL2 then 
return CTR; 
elsif PSTATE.EL == EL3 then 
return CTR; 
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G8.2.37 DACR, Domain Access Control Register 
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The DACR characteristics are: 


Purpose 


Defines the access permission for each of the sixteen memory domains. 


Configurations 


AArch32 System register DACR[31:0] is architecturally mapped to AArch64 System register 


DACR32_EL2[31:0]. 


This register has no function when TTBCR.EAE is set to 1, to select the Long-descriptor translation 


table format. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DACR is a 32-bit register. 


Field descriptions 


The DACR bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 12 1110 9 8 76543210 





D<n>, bits [2n+1:2n], for n = 0 to 15 


Domain n access permission, where n = 0 to 15. Permitted values are: 


0b00 No access. Any access to the domain generates a Domain fault. 
0b01 Client. Accesses are checked against the permission bits in the translation tables. 
0b11 Manager. Accesses are not checked against the permission bits in the translation tables. 


The value 0b10 is reserved. 


This field resets to an architecturally UNKNOWN value. 


Accessing the DACR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


coproc opct CRn CRm opc2 
0b1111 0b000 = =0b0011 0b0000 O0b000 
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elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return DACR_S; 
else 
return DACR_NS; 
else 
return DACR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return DACR_NS; 
else 
return DACR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return DACR_S; 
else 
return DACR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci 


CRm opc2 





Ob1111 0b000 


0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 


UNDEFINED; 


elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP1ISSDISABLE2 == HIGH then 


UNDEFINED; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 


DACR_S = R[t]; 
else 
DACR_NS = R[t]; 
else 
DACR = R[t]; 


elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
DACR_NS = R[t]; 
else 
DACR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q@' && CP15SDISABLE == HIGH then 


UNDEFINED; 
elsif SCR.NS == '@' && CP15SDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
DACR_S = R[t]; 
else 
DACR_NS = R[t]; 
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G8.2.38 DCCIMVAC, Data Cache line Clean and Invalidate by VA to PoC 


The DCCIMVAC characteristics are: 


Purpose 
Clean and Invalidate data or unified cache line by virtual address to PoC. 
Configurations 
AArch32 System instruction DCCIMVAC performs the same function as AArch64 System 
instruction DC CIVAC. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DCCIMVAC is a 32-bit System instruction. 


Field descriptions 


The DCCIMVAC input value bit assignments are: 


31 0 
Virtual address to use 
Bits [31:0] 


Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DCCIMVAC instruction 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see AArch32 data cache maintenance instructions (DC*) on page G4-5699. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b0111 Ob1110 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TPC == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
DCCIMVAC(R[t]); 
elsif PSTATE.EL == EL2 then 
DCCIMVAC(R[t]); 
elsif PSTATE.EL == EL3 then 
DCCIMVAC(R[t]); 
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G8.2.39 
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DCCISW, Data Cache line Clean and Invalidate by Set/Way 


The DCCISW characteristics are: 


Purpose 
Clean and Invalidate data or unified cache line by set/way. 
Configurations 
AArch32 System instruction DCCISW performs the same function as AArch64 System instruction 
DC CISW. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DCCISW is a 32-bit System instruction. 


Field descriptions 


The DCCISW input value bit assignments are: 


SetWay, bits [31:4] 
Contains two fields: 
s Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Logo(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 
Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 

Bit [0] 
Reserved, RESO. 


Executing the DCCISW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED 


s The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— Multiple arbitrary cache lines. 
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Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b0111 Ob1110 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TSW == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 





else 
DCCISW(R[t]); 
elsif PSTATE.EL == EL2 then 
DCCISW(R[t]) ; 
elsif PSTATE.EL == EL3 then 
DCCISW(R[t]) ; 
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G8.2.40 DCCMVAC, Data Cache line Clean by VA to PoC 


The DCCMVAC characteristics are: 


Purpose 
Clean data or unified cache line by virtual address to PoC. 
Configurations 
AArch32 System instruction DCCMVAC performs the same function as AArch64 System 
instruction DC CVAC. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DCCMVAC is a 32-bit System instruction. 


Field descriptions 


The DCCMVAC input value bit assignments are: 


31 0 
Virtual address to use 
Bits [31:0] 


Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DCCMVAC instruction 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see AArch32 data cache maintenance instructions (DC*) on page G4-5699. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b0111 Ob1010 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TPC == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
DCCMVAC(R[t]); 
elsif PSTATE.EL == EL2 then 
DCCMVAC(R[t]); 
elsif PSTATE.EL == EL3 then 
DCCMVAC(R[t]); 
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G8.2.41 DCCMVAU, Data Cache line Clean by VA to PoU 


The DCCMVAU characteristics are: 


Purpose 
Clean data or unified cache line by virtual address to PoU. 
Configurations 
AArch32 System instruction DCCMVAU performs the same function as AArch64 System 
instruction DC CVAU. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DCCMVAU is a 32-bit System instruction. 


Field descriptions 


The DCCMVAU input value bit assignments are: 


31 0 
Virtual address to use 
Bits [31:0] 


Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DCCMVAU instruction 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see AArch32 data cache maintenance instructions (DC*) on page G4-5699. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 0b1011 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPU == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TOCU == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TPU == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TOCU == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
DCCMVAU(R[t]); 
elsif PSTATE.EL == EL2 then 
DCCMVAU(R[t]); 
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elsif PSTATE.EL == EL3 then 
DCCMVAU(R[t]); 
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G8.2.42 DCCSW, Data Cache line Clean by Set/Way 
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The DCCSW characteristics are: 


Purpose 
Clean data or unified cache line by set/way. 
Configurations 
AArch32 System instruction DCCSW performs the same function as AArch64 System instruction 
DC CSW. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DCCSW is a 32-bit System instruction. 


Field descriptions 


The DCCSW input value bit assignments are: 


SetWay, bits [31:4] 
Contains two fields: 
- Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Logo(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 
Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 

Bit [0] 
Reserved, RESO. 


Executing the DCCSW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED 


s The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— Multiple arbitrary cache lines. 
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Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b0111 0b1010 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TSW == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
DCCISW(R[t]) ; 
elsif PSTATE.EL == EL2 then 
DCCISW(R[t]); 
elsif PSTATE.EL == EL3 then 
DCCISW(R[t]); 
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G8.2.43 DCIMVAC, Data Cache line Invalidate by VA to PoC 


ARM DDI 0487E.a 
ID070919 


The DCIMVAC characteristics are: 


Purpose 
Invalidate data or unified cache line by virtual address to PoC. 
Configurations 
AArch32 System instruction DCIMVAC performs the same function as AArch64 System 
instruction DC IVAC. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DCIMVAC is a 32-bit System instruction. 


Field descriptions 


The DCIMVAC input value bit assignments are: 


31 0 
Virtual address to use 
Bits [31:0] 


Virtual address to use. No alignment restrictions apply to this VA. 


Executing the DCIMVAC instruction 


It is IMPLEMENTATION DEFINED whether, when this instruction is executed, it can generate a watchpoint. If this 
instruction can generate a watchpoint this is prioritized in the same way as other watchpoints. 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see AArch32 data cache maintenance instructions (DC*) on page G4-5699. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b0111 Ob0110 Ob001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPCP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TPC == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<DC,VM> != 'Q@' then 
DCCIMVAC(R[t]); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.<DC,VM> != 'Q0' then 
DCCIMVAC(R[t]); 
else 
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DCIMVAC(R[t]); 
elsif PSTATE.EL == 


EL2 then 
DCIMVAC(R[t]); 

elsif PSTATE.EL == EL3 then 
DCIMVAC(R[t]); 


G8-5990 
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G8.2.44 DCISW, Data Cache line Invalidate by Set/Way 


ARM DDI 0487E.a 
ID070919 


The DCISW characteristics are: 


Purpose 
Invalidate data or unified cache line by set/way. 
Configurations 
AArch32 System instruction DCISW performs the same function as AArch64 System instruction 
DC ISW. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DCISW is a 32-bit System instruction. 


Field descriptions 


The DCISW input value bit assignments are: 


SetWay, bits [31:4] 
Contains two fields: 
s Way, bits[31:32-A], the number of the way to operate on. 
° Set, bits[B-1:L], the number of the set to operate on. 
Bits[L-1:4] are RESO. 
A = Log2(ASSOCIATIVITY), L = Log2(LINELEN), B = (L + S), S = Logo(NSETS). 


ASSOCIATIVITY, LINELEN (line length, in bytes), and NSETS (number of sets) have their usual 
meanings and are the values for the cache level being operated on. The values of A and S are 
rounded up to the next integer. 


Level, bits [3:1] 
Cache level to operate on, minus 1. For example, this field is 0 for operations on L1 cache, or 1 for 
operations on L2 cache. 

Bit [0] 
Reserved, RESO. 


Executing the DCISW instruction 


If this instruction is executed with a set, way or level argument that is larger than the value supported by the 
implementation then the behavior is CONSTRAINED UNPREDICTABLE and one of the following occurs: 


. The instruction is UNDEFINED 


s The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 


— Multiple arbitrary cache lines. 
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Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm 


opc2 





Ob1111 0b000 = O0b0111 Ob0110 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TSW == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TSW == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.SWIO == '1' then 
DCCISW(R[t]); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<DC,VM> != 'Q@@' then 
DCCISW(R[t]); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.SWIO == '1' then 
DCCISW(R[t]) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.<DC,VM> != 'Q0' then 
DCCISW(R[t]) ; 











else 





DCISW(R[t]); 

elsif PSTATE.EL == EL2 then 
DCISW(R[t]); 

elsif PSTATE.EL == EL3 then 
DCISW(R[t]); 
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G8.2.45 DFAR, Data Fault Address Register 
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ID070919 


The DFAR characteristics are: 


Purpose 
Holds the virtual address of the faulting address that caused a synchronous Data Abort exception. 
Configurations 
AArch32 System register DFAR[31:0] is architecturally mapped to AArch64 System register 
FAR_EL1[31:0]. 
AArch32 System register DFAR[31:0](S) is architecturally mapped to AArch32 System register 
HDFAR{[31:0] when HaveEL(EL2), HaveEL(EL3) and HighestELUsingAArch32(). 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DFAR is a 32-bit register. 


Field descriptions 


The DFAR bit assignments are: 


31 0 
VA of faulting address of synchronous Data Abort exception 
Bits [31:0] 


VA of faulting address of synchronous Data Abort exception. 
This field resets to an architecturally UNKNOWN value. 


Accessing the DFAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
Ob1111 0b000 0b0110 Ob0000 Ob000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return DFAR_S; 
else 
return DFAR_NS; 
else 
return DFAR; 
G8-5993 
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G8-5994 


elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return DFAR_NS; 
else 
return DFAR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return DFAR_S; 
else 
return DFAR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b000 = 0b0110  0b0000 


opc2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
DFAR_S = R[t]; 
else 
DFAR_NS = R[t]; 
else 
DFAR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
DFAR_NS = R[t]; 
else 
DFAR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
DFAR_S = R[t]; 
else 





DFAR_NS = R[t]; 
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G8.2.46 DFSR, Data Fault Status Register 


The DFSR characteristics are: 


Purpose 
Holds status information about the last data fault. 
Configurations 
AArch32 System register DFSR[31:0] is architecturally mapped to AArch64 System register 
ESR_EL1[31:0]. 
The current translation table format determines which format of the register is used. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DFSR is a 32-bit register. 


Field descriptions 


The DFSR bit assignments are: 


When TTBCR.EAE == 


1716151413121110 9 8 7 





an? ne RESO 
LPAE 


FS[4] 
WnR 
ExT 
CM 


Bits [31:17] 
Reserved, RESO. 
FnV, bit [16] 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd DFAR is valid. 
Ob1 DFAR is not valid, and holds an UNKNOWN value. 


This field is only valid for a synchronous External abort other than a synchronous External abort on 
a translation table walk. It is RESO for all other Data Abort exceptions. 


This field resets to an architecturally UNKNOWN value. 
AET, bits [15:14] 


Asynchronous Error Type. When the RAS Extension is implemented, this field describes the state 
of the PE after taking an asynchronous Data Abort exception. Possible values are: 


0b00 Uncontainable error (UC) or uncategorized. 
0b01 Unrecoverable error (UEU). 
0b10 Restartable error (UEO) or Corrected error (CE). 
0b11 Recoverable error (UER). 
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When the RAS Extension is not implemented, or on a synchronous Data Abort, this field is RESO. 


Note 


Armv8.2 requires the implementation of the RAS Extension. 








In the event of multiple errors taken as a single SError interrupt exception, the overall state of the 
PE is reported. 


Note 


Software can use this information to determine what recovery might be possible. The recovery 
software must also examine any implemented fault records to determine the location and extent of 
the error. 








This field resets to an architecturally UNKNOWN value. 


CM, bit [13] 


Cache maintenance fault. For synchronous faults, this bit indicates whether a cache maintenance 
instruction generated the fault. The possible values of this bit are: 


0bd Abort not caused by execution of a cache maintenance instruction. 
Qb1 Abort caused by execution of a cache maintenance instruction, or on an address 
translation. 


On a synchronous Data Abort on a translation table walk, this bit is UNKNOWN. 
On an asynchronous fault, this bit is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


EXT, bit [12] 


External abort type. This bit can be used to provide an IMPLEMENTATION DEFINED classification of 
External aborts. 


In an implementation that does not provide any classification of External aborts, this bit is RESO. 
For aborts other than External aborts this bit always returns 0. 


This field resets to an architecturally UNKNOWN value. 


Wak, bit [11] 


Write not Read bit. Indicates whether the abort was caused by a write or a read instruction. The 
possible values of this bit are: 


Oboe Abort caused by a read instruction. 
0b1 Abort caused by a write instruction. 


For faults on the cache maintenance and address translation System instructions in the 
(coproc==0b1111) encoding space this bit always returns a value of 1. 


This field resets to an architecturally UNKNOWN value. 


FS[4], bit [10] 
This field is bit[4] of FS[4:0]. 
Fault status bits. Possible values of FS[4:0] are: 
0b00001 Alignment fault 
0b00010 Debug exception 
0b00011 Access flag fault, level 1 
0b00100 Fault on instruction cache maintenance 
0b00101 Translation fault, level 1 
0b00110 Access flag fault, level 2 
0b00111 Translation fault, level 2 
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0b01000 Synchronous External abort, not on translation table walk 
0b01001 Domain fault, level 1 

0b01011 Domain fault, level 2 

0b01100 Synchronous External abort, on translation table walk, level 1 
0b01101 Permission fault, level 1 

0b01110 Synchronous External abort, on translation table walk, level 2 
0b01111 Permission fault, level 2 

0b10000 TLB conflict abort 


0b10100 IMPLEMENTATION DEFINED fault (Lockdown fault) 





@b10101 IMPLEMENTATION DEFINED fault (Unsupported Exclusive access fault) 

0b10110 SError interrupt 

@b11000 SError interrupt, from a parity or ECC error on memory access 

0b11001 Synchronous parity or ECC error on memory access, not on translation table walk 
@b11100 Synchronous parity or ECC error on translation table walk, level 1 

@b11110 Synchronous parity or ECC error on translation table walk, level 2 

All other values are reserved. 

When the RAS Extension is implemented, 0b11000, 0b11001, 0b11100, and @b11110, are reserved. 


For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on a Short-descriptor translation table lookup on page G5-5828. 


The FS field is split as follows: 
° FS[4] is DFSR[10]. 
° FS[3:0] is DFSR[3:0]. 


This field resets to an architecturally UNKNOWN value. 


LPAE, bit [9] 
On taking a Data Abort exception, this bit is set as follows: 
Qbd Using the Short-descriptor translation table formats. 
Qb1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore 
software can set this bit to 0 or 1 without affecting operation. 


This field resets to an architecturally UNKNOWN value. 
Bit [8] 

Reserved, RESO. 
Domain, bits [7:4] 

The domain of the fault address. 


Arm deprecates any use of this field, see The Domain field in the DFSR on page G5-5828. 


This field is UNKNOWN for certain faults where the DFSR is updated and reported using the 
Short-descriptor FSR encodings, see Table G5-30 on page G5-5832. 


This field resets to an architecturally UNKNOWN value. 
FS[3:0], bits [3:0] 

This field is bits[3:0] of FS[4:0]. 

See FS[4] for the field description. 
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FnV ao Po LPAE 


G8-5998 


When TTBCR.EAE == 


31 


1716151413121110 9 8 


RESO Ter TTT] RESO STATUS 


Bits [31:17] 


FnV, bit [16] 


Reserved, RESO. 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Obd DFAR is valid. 
Qb1 DFAR is not valid, and holds an UNKNOWN value. 


This field is only valid for a synchronous External abort other than a synchronous External abort on 
a translation table walk. It is RESO for all other Data Abort exceptions. 


This field resets to an architecturally UNKNOWN value. 


AET, bits [15:14] 


CM, bit [13] 


Asynchronous Error Type. When the RAS Extension is implemented, this field describes the state 
of the PE after taking an asynchronous Data Abort exception. Possible values are: 


0b00 Uncontainable error (UC) or uncategorized. 

0b01 Unrecoverable error (UEU). 

0b10 Restartable error (UEO) or Corrected error (CE). 
0b11 Recoverable error (UER). 


When the RAS Extension is not implemented, or on a synchronous Data Abort, this field is RESO. 


Note 


Armv8.2 requires the implementation of the RAS Extension. 





In the event of multiple errors taken as a single SError interrupt exception, the overall state of the 
PE is reported. 


Note 


Software can use this information to determine what recovery might be possible. The recovery 
software must also examine any implemented fault records to determine the location and extent of 
the error. 








This field resets to an architecturally UNKNOWN value. 


Cache maintenance fault. For synchronous faults, this bit indicates whether a cache maintenance 
instruction generated the fault. The possible values of this bit are: 


Qbd Abort not caused by execution of a cache maintenance instruction. 
Qb1 Abort caused by execution of a cache maintenance instruction. 


On a synchronous Data Abort on a translation table walk, this bit is UNKNOWN. 
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On an asynchronous fault, this bit is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


External abort type. This bit can be used to provide an IMPLEMENTATION DEFINED classification of 
External aborts. 


In an implementation that does not provide any classification of External aborts, this bit is RESO. 
For aborts other than External aborts this bit always returns 0. 


This field resets to an architecturally UNKNOWN value. 


Write not Read bit. Indicates whether the abort was caused by a write or a read instruction. The 
possible values of this bit are: 


ObO Abort caused by a read instruction. 
Qb1 Abort caused by a write instruction. 


For faults on the cache maintenance and address translation System instructions in the 
(coproc==0b1111) encoding space this bit always returns a value of 1. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


On taking a Data Abort exception, this bit is set as follows: 
Qbd Using the Short-descriptor translation table formats. 
Qb1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore 
software can set this bit to 0 or 1 without affecting operation. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


STATUS, bits [5:0] 


Fault status bits. Possible values of this field are: 
0b000000 Address size fault in TTBRO or TTBRI. 
0b000001 Address size fault, level 1. 

0b000010 Address size fault, level 2. 

0b000011 Address size fault, level 3. 

0b000101 Translation fault, level 1. 

0b000110 Translation fault, level 2. 

0b000111 Translation fault, level 3. 

0b001001 Access flag fault, level 1. 

0b001010 Access flag fault, level 2. 

0b001011 Access flag fault, level 3. 

0b001101 Permission fault, level 1. 

0b001110 Permission fault, level 2. 

0b001111 Permission fault, level 3. 





0b010000 Synchronous External abort, not on translation table walk. 
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@b010001 SError interrupt. 

0b010101 Synchronous External abort, on translation table walk, level 1. 

0b010118 Synchronous External abort, on translation table walk, level 2. 

0b010111 Synchronous External abort, on translation table walk, level 3. 

0b01100@ Synchronous parity or ECC error on memory access, not on translation table walk. 
0b011001 SError interrupt, from a parity or ECC error on memory access. 

0b011101 Synchronous parity or ECC error on memory access on translation table walk, level 1. 
0b011110 Synchronous parity or ECC error on memory access on translation table walk, level 2. 


0b011111 Synchronous parity or ECC error on memory access on translation table walk, level 3. 


0b100001 Alignment fault. 

0b100010 Debug exception. 

0b110000 TLB conflict abort. 

Qb11010@ IMPLEMENTATION DEFINED fault (Lockdown fault). 

@b110101 IMPLEMENTATION DEFINED fault (Unsupported Exclusive access fault). 


All other values are reserved. 


When the RAS Extension is implemented, 06011000, 0b011001, 0b011101, 0b011110, and 0b011111, are 


reserved. 


For more information about the lookup level associated with a fault, see The level associated with 


MMU faults on a Long-descriptor translation table lookup on page G5-5830. 


This field resets to an architecturally UNKNOWN value. 


Accessing the DFSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b0101 0b0000 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return DFSR_S; 
else 
return DFSR_NS; 
else 
return DFSR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return DFSR_NS; 
else 
return DFSR; 
elsif PSTATE.EL == EL3 then 
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if SCR.NS == 'Q' then 
return DFSR_S; 
else 
return DFSR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b0101 0b0000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
DFSR_S = R[t]; 
else 
DFSR_NS = R[t]; 
else 
DFSR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
DFSR_NS = R[t]; 
else 
DFSR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
DFSR_S = R[t]; 
else 





DFSR_NS = R[t]; 
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G8.2.47 


G8-6002 


DTLBIALL, Data TLB Invalidate All 


The DTLBIALL characteristics are: 


Purpose 
Invalidate all cached copies of translation table entries from data TLBs that are from any level of 
the translation table walk. The entries that are invalidated are as follows: 
° If executed at Secure EL1 when EL3 is using AArch64, all entries that would be required for 
the Secure EL1&0 translation regime. 
° If executed in Secure state when EL3 is using AArch32, all entries that would be required for 
the Secure PL1&0 translation regime. 
° If executed at Non-secure EL1, all stage 1 translation table entries that would be required for 
the Non-secure PL1&0 translation regime and, if EL2 is implemented, they must match the 
current VMID. 
° If executed at EL2, the stage 1 or stage 2 translation table entries that would be required for 
the Non-secure PL1&0 translation regime and matches the current VMID. 
The invalidation only applies to the PE that executes this System instruction. 
Arm deprecates the use of this System instruction. It is only provided for backwards compatibility 
with earlier versions of the Arm architecture. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DTLBIALL is a 32-bit System instruction. 


Field descriptions 


DTLBIALL ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 


Executing the DTLBIALL instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b000 = 0b1000 0b0110 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 


DTLBIALL(); 
elsif PSTATE.EL == EL2 then 
DTLBIALL(); 
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elsif PSTATE.EL == EL3 then 
DTLBIALL(); 
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G8.2.48 DTLBIASID, Data TLB Invalidate by ASID match 


The DTLBIASID characteristics are: 


Purpose 
Invalidate all cached copies of translation table entries from data TLBs that meet the following 
requirements: 


° The entry is a stage 1 translation table entry. 
. The entry would be used for the specified ASID, and either: 
— Is from a level of lookup above the final level. 
— Isa non-global entry from the final level of lookup. 
° If EL2 is implemented, the entry would be used with the current VMID. 


From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 


° If executed at Secure EL1 when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 

° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 

. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 

The invalidation only applies to the PE that executes this System instruction. 


Arm deprecates the use of this System instruction. It is only provided for backwards compatibility 
with earlier versions of the Arm architecture. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DTLBIASID is a 32-bit System instruction. 


Field descriptions 


The DTLBIASID input value bit assignments are: 


31 8 7 0 
RESO ASID 
Bits [31:8] 


Reserved, RESO. 


ASID, bits [7:0] 
ASID value to match. Any TLB entries for non-global pages that match the ASID values will be 
affected by this System instruction. 


Executing the DTLBIASID instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1000 O0b0110 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
DTLBIASID(R[t]); 
elsif PSTATE.EL == EL2 then 
DTLBIASID(R[t]); 
elsif PSTATE.EL == EL3 then 
DTLBIASID(R[t]); 
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G8.2.49 


G8-6006 


DTLBIMVA, Data TLB Invalidate by VA 


The DTLBIMVA characteristics are: 


Purpose 


Invalidate all cached copies of translation table entries from data TLBs that meet the following 
requirements: 


° The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified address, and one of the following applies: 


— The entry is from a level of lookup above the final level and matches the specified 
ASID. 


— The entry is a global entry from the final level of lookup. 


— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 


° If EL2 is implemented, the entry would be used with the current VMID. 


From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 


° If executed at Secure EL1 when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 

° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 

. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 

The invalidation only applies to the PE that executes this System instruction. 


Arm deprecates the use of this System instruction. It is only provided for backwards compatibility 
with earlier versions of the Arm architecture. 

Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DTLBIMVA is a 32-bit System instruction. 


Field descriptions 


The DTLBIMVA input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this System instruction. 


Bits [11:8] 
Reserved, RESO. 
ASID, bits [7:0] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 
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Global TLB entries that match the VA value will be affected by this System instruction, regardless 


of the value of the ASID field. 


Executing the DTLBIMVA instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





Ob1111 0b000 = 0b1000 0b0110 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
DTLBIMVA(R[t]); 
elsif PSTATE.EL == EL2 then 
DTLBIMVA(R[t]); 
elsif PSTATE.EL == EL3 then 
DTLBIMVA(R[t]); 
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G8.2.50 


DVPRCTX, Data Value Prediction Restriction by Context 


The DVPRCTX characteristics are: 


Purpose 


Data Value Prediction Restriction by Context applies to all Data Value Prediction Resources that 
predict execution based on information gathered within the target execution context or contexts. 


When this instruction is complete and synchronized, data value prediction does not permit later 
speculative execution within the target execution context to be observable through side channels. 


This instruction is guaranteed to be complete following a DSB that covers both read and write 
behavior on the same PE as executed the original restriction instruction, and a subsequent context 
synchronization event is required to ensure that the effect of the completion of the instructions is 
synchronized to the current execution. 


Note 


This instruction does not require the invalidation of prediction structures so long as the behavior 
described for completion of this instruction is met by the implementation. 





On some implementations the instruction is likely to take a significant number of cycles to execute. 
This instruction is expected to be used very rarely, such as on the roll-over of an ASID or VMID, 
but should not be used on every context switch. 





Configurations 


This instruction is present only when ARMV8.0-PredInv is implemented. Otherwise, direct accesses 
to DVPRCTX are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DVPRCTX is a 32-bit System instruction. 


Field descriptions 


The DVPRCTX input value bit assignments are: 


28 27 26 25 24 23 1615 98 7 0 


31 
RESO hs | VMID RESO ASID 


GVMID _ | [Po GASID 


G8-6008 


Bits [31:28] 
Reserved, RESO. 
GVMID, bit [27] 
Execution of this instruction applies to all VMIDs or a specified VMID. 


Ob Applies to specified VMID for an ELO or EL1 context. For all other contexts this field 
is RESO. 
Qb1 Applies to all VMIDs for an ELO or EL1 context. For all other contexts this field is RESO. 


If the instruction is executed at ELO or EL1, then this field has an Effective value of 0. 


NS, bit [26] 
Security State. 


Qbd Secure state. 
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Qb1 Non-secure state. 


If the instruction is executed in Non-secure state, this field has an Effective value of 1. 


EL, bits [25:24] 


Exception Level 


0b00 ELO. 
0b01 EL1. 
0b10 EL2. 
Qb11 EL3. 


If the instruction is executed at an exception level lower than the specified level, this instruction is 
treated as a NOP. 


VMID, bits [23:16] 


Bits [15:9] 


Only applies when bit[27] is 0 and either: 


° an EL1 context. 
s an ELO context when (HCR_EL2.E2H==0 or HCR_EL2.TGE==0) or EL2 is using AArch32 
state. 


Otherwise this field is RESO. 
When the instruction is executed at EL1 then this field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==0 or HCR_EL2.TGE==0 or 
ELUsingAArch32(EL2)) then this field is treated as the current VMID. 


When the instruction is executed at ELO and (HCR_EL2.E2H==1 and HCR_EL2.TGE==1 and 
!ELUsingAArch32(EL2)) then this field is ignored. 


Reserved, RESO. 


GASID, bit [8] 


Execution of this instruction applies to all ASIDs or a specified ASID. 
Ob Applies to specified ASID for an ELO context. For all other contexts this field is RESO. 
Qb1 Applies to all ASID for an ELO context. For all other contexts this field is RESO. 


If the instruction is executed at ELO, then this field has an Effective value of 0. 


ASID, bits [7:0] 


Only applies for an ELO context and when bit[8] is 0. 
Otherwise this field is RESO. 
When the instruction is executed at ELO then this field is treated as the current ASID. 


Executing the DVPRCTX instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b0111 Ob0011 0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && SCTLR_EL1.EnRCTX == 'Q' 


then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6009 
Non-Confidential 


AArch32 System Register Descriptions 
G8.2 General system control registers 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && SCTLR.EnRCTX == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T7 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCTLR_EL2.EnRCTX == 'Q' 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


else 
DVPRCTX(R[t]); 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.NV == '1' then 
AArch64.SystemAccessTrap(EL2, 0x03); 
else 
DVPRCTX(R[t]); 
elsif PSTATE.EL == EL2 then 
DVPRCTX(R[t] ); 
elsif PSTATE.EL == EL3 then 
DVPRCTX(R[t]); 
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ELR_hyp, Exception Link Register (Hyp mode) 


The ELR_hyp characteristics are: 


Purpose 
When taking an exception to Hyp mode, holds the address to return to. 
Configurations 
AArch32 System register ELR_hyp[31:0] is architecturally mapped to AArch64 System register 
ELR_EL2[31:0]. 
On a reset into an Exception level that is using AArch32 ELR_hyp is UNKNOWN. 
Attributes 


ELR_hyp is a 32-bit register. 


Field descriptions 


The ELR_hyp bit assignments are: 


31 0 
Return address 
Bits [31:0] 
Return address. 


This field resets to an architecturally UNKNOWN value. 


Accessing the ELR_hyp 


ELR_hyp is accessible only at Hyp mode and Monitor mode. For more details, see MRS (Banked register) and MSR 
(Banked register) in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRS{<c>}{<q>} <Rd>, ELR_hyp 





R M M1 





0b0 Obl O0b1110 





MSR{<c>}{<q>} ELR_hyp, <Rn> 





R M M1 





0bO Obl 0b1110 
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G8.2.52 


G8-6012 


FCSEIDR, FCSE Process ID register 


The FCSEIDR characteristics are: 


Purpose 
Identifies whether the Fast Context Switch Extension (FCSE) is implemented. 
From Armv8, the FCSE is not implemented, so this register is RAZ/WI. Software can access this 
register to determine that the implementation does not include the FCSE. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


FCSEIDR is a 32-bit register. 


Field descriptions 


The FCSEIDR bit assignments are: 


31 0 
RAZ/WI 
Bits [31:0] 


Reserved, RAZ/WI. 


Accessing the FCSEIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1101 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return FCSEIDR; 
elsif PSTATE.EL == EL2 then 
return FCSEIDR; 
elsif PSTATE.EL == EL3 then 
return FCSEIDR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1101 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
FCSEIDR = R[t]; 
elsif PSTATE.EL == EL2 then 
FCSEIDR = R[t]; 
elsif PSTATE.EL == EL3 then 
FCSEIDR = R[t]; 
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G8.2.53 FPEXC, Floating-Point Exception Control register 


The FPEXC characteristics are: 


Purpose 
Provides a global enable for the implemented Advanced SIMD and floating-point functionality, and 
reports floating-point status information. 

Configurations 
AArch32 System register FPEXC[3 1:0] is architecturally mapped to AArch64 System register 
FPEXC32_EL2[31:0]. 
Implemented only if the implementation includes the Advanced SIMD and floating-point 
functionality. 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


FPEXC is a 32-bit register. 


Field descriptions 


The FPEXC bit assignments are: 


11 10 876543210 


31 30 29 28 27 26 25 





EX 
EN 


rei 


EX, bit [31] 


EN, bit [30] 


G8-6014 
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== IOF 


OFF 
UFF 
IXF 
RESO 
IDF 


Exception bit. From Armv8, this bit is RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


Enables access to the Advanced SIMD and floating-point functionality from all Exception levels, 
except that setting this field to 0 does not disable the following: 


VMSR accesses to the FPEXC or FPSID. 
VMRS accesses from the FREXC, FPSID, MVFRO, MVFR1, or MVFR2. 


Qbd Accesses to the FPSCR, and any of the SIMD and floating-point registers QO-Q15, 
including their views as DO-D31 registers or SO-S31 registers, are UNDEFINED at all 
Exception levels. 

Qb1 This control permits access to the Advanced SIMD and floating-point functionality at 


all Exception levels. 


Execution of floating-point and Advanced SIMD instructions in AArch32 state can be disabled or 
trapped by the following controls: 


CPACR.cp 10, or, if executing at EL0, CPACR_EL1.FPEN. 
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e FPEXC.EN. 
è If executing in Non-secure state: 
— HCPTR.TCP10, or if EL2 is using AArch64, CPTR_EL2.TFP. 
—  NSACR.cp10, or if EL3 is using AArch64, CPTR_EL3.TFP. 
° For Advanced SIMD instructions only: 
— CPACR.ASEDIS. 
— Ifexecuting in Non-secure state, HCPTR.TASE and NSACR.NSTRCDIS. 


See the descriptions of the controls for more information. 


Note 
When executing at ELO using AArch32: 
. If EL1 is using AArch64 then behavior is as if the value of FREXC.EN is 1. 


` If EL2 is using AArch64 and enabled in the current Security state, and the value of 
HCR_EL2.{RW, TGE} is {1, 1}, then the behavior is as if the value of FPEXC.EN is 1. 


: If EL2 is using AArch64 and enabled in the current Security state, and the value of 
HCR_EL2.{RW, TGE} is {0, 1}, then it is IMPLEMENTATION DEFINED whether the behavior 
is: 





— As ifthe value of FPEXC.EN is 1. 


— Determined by the value of FPEXC.EN, as described in this field description. 
However, Arm deprecates using the value of FREXC.EN to determine behavior. 





This field resets to Q. 


DEX, bit [29] 
Defined synchronous exception on floating-point execution. 


This field identifies whether a synchronous exception generated by the attempted execution of an 
instruction was generated by an unallocated encoding. The instruction must be in the encoding space 
that is identified by the pseudocode function ExecutingCP 1 0or11Instr() returning TRUE. This field 
also indicates whether the FPEXC.TFV field is valid. 


The meaning of this bit is: 


Qbd The exception was generated by the attempted execution of an unallocated instruction 
in the encoding space that is identified by the pseudocode function 
ExecutingCP 10or11Instr(). If FREXC.TFV is RW then it is invalid and UNKNOWN. If 
FPEXC. {IDF, IXF, UFF, OFF, DZF, IOF} are RW then they are invalid and UNKNOWN. 


Qb1 The exception was generated during the execution of an unallocated encoding. 
FPEXC.TFV is valid and indicates the cause of the exception. 


On an exception that sets this bit to 1 the exception-handling routine must clear this bit to 0. 


On an implementation that both does not support trapping of floating-point exceptions and 
implements the FPSCR. {Stride, Len} fields as RAZ, this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 
FP2V, bit [28] 

FPINST2 instruction valid bit. From Armv8, this bit is RESO. 

This field resets to an architecturally UNKNOWN value. 


VV, bit [27] 
VECITR valid bit. From Armv8, this bit is RESO. 
This field resets to an architecturally UNKNOWN value. 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6015 


ID070919 Non-Confidential 


AArch32 System Register Descriptions 


G8.2 General system control registers 


TEV, bit [26] 


Bits [25:11] 


VECITR, bits 


IDF, bit [7] 


Bits [6:5] 


IXF, bit [4] 


Trapped Fault Valid bit. Valid only when the value of FREXC.DEX is 1. When valid, it indicates the 
cause of the exception and therefore whether the FPEXC. {IDF, IXF, UFF, OFF, DZF, IOF} bits are 
valid. 


Qbd The exception was caused by the execution of a floating-point VABS, VADD, VDIV, 
VFMA, VFMS, VFNMA, VFNMS, VMLA, VMLS, VMOV, VMUL, VNEG, 
VNMLA, VNMLS, VNMUL, VSQRT, or VSUB instruction when one or both of 
FPSCR. {Stride, Len} was non-zero. If the FPEXC. {IDF, IXF, UFF, OFF, DZF, IOF} 
bits are RW then they are invalid and UNKNOWN. 


Qb1 FPEXC. {IDF, [IXF, UFF, OFF, DZF, IOF} indicate the presence of trapped 
floating-point exceptions that had occurred at the time of the exception. Bits are set for 
all trapped exceptions that had occurred at the time of the exception. 


This bit returns a status value and ignores writes. 
When the value of FRPEXC.DEX is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


On an implementation that supports the trapping of floating-point exceptions and implements 
FPSCR. {Stride, Len} as RAZ, this bit is RAO/WI. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


[10:8] 
Vector iteration count. From Armv8, this field is RES1. 


This field resets to an architecturally UNKNOWN value. 


Input Denormal trapped exception bit. Valid only when the value of FPEXC.TFV is 1. When valid, 
it indicates whether an Input Denormal exception occurred while FPSCR.IDE was 1: 


Qbd Input Denormal exception has not occurred. 
Qb1 Input Denormal exception has occurred. 
Input Denormal exceptions can occur only when FPSCR.FZ is 1. 


Note 


A half-precision floating-point value that is flushed to zero because the value of FPSCR.FZ16 is 1 
does not generate an Input Denormal exception. 








This bit must be cleared to 0 by the exception-handling routine. 
When the value of FPEXC.TFYV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Inexact trapped exception bit. Valid only when the value of FPEXC.TFV is 1. When valid, it 
indicates whether an Inexact exception occurred while FPSCR.IXE was 1: 


Qbe Inexact exception has not occurred. 
Qb1 Inexact exception has occurred. 
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This bit must be cleared to 0 by the exception-handling routine. 
When the value of FPEXC.TFYV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


UFF, bit [3] 


Underflow trapped exception bit. Valid only when the value of FREXC.TFV is 1. When valid, it 
indicates whether an Underflow exception occurred while FPSCR.UFE was 1: 


0bd Underflow exception has not occurred. 

Qb1 Underflow exception has occurred. 

Underflow trapped exceptions can occur: 

. On half-precision data-processing instructions only when FPSCR.FZ16 is 0. 

. Otherwise only when FPSCR.FZ is 0. 

This bit must be cleared to 0 by the exception-handling routine. 

When the value of FPEXC.TFV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


OFF, bit [2] 


Overflow trapped exception bit. Valid only when the value of FPEXC.TFV is 1. When valid, it 
indicates whether an Overflow exception occurred while FPSCR.OFE was 1: 


0bd Overflow exception has not occurred. 

Qb1 Overflow exception has occurred. 

This bit must be cleared to 0 by the exception-handling routine. 

When the value of FPEXC.TFYV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


DZF, bit [1] 


Divide by Zero trapped exception bit. Valid only when the value of FREXC.TFV is 1. When valid, 
it indicates whether a Divide by Zero exception occurred while FPSCR.DZE was 1: 


ObO Divide by Zero exception has not occurred. 

0b1 Divide by Zero exception has occurred. 

This bit must be cleared to 0 by the exception-handling routine. 

When the value of FPEXC.TFV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


IOF, bit [0] 


Invalid Operation trapped exception bit. Valid only when the value of FPEXC.TFV is 1. When valid, 
it indicates whether an Invalid Operation exception occurred while FPSCR.IOE was 1: 


Qbd Invalid Operation exception has not occurred. 

Qb1 Invalid Operation exception has occurred. 

This bit must be cleared to 0 by the exception-handling routine. 

When the value of FPEXC.TFYV is 0 and this bit is RW, this bit is invalid and UNKNOWN. 
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G8-6018 


On an implementation that does not support the trapping of floating-point exceptions this bit is 
RAZ/WI. 


This field resets to an architecturally UNKNOWN value. 


Accessing the FPEXC 


Accesses to this register use the following encodings in the System instruction encoding space: 


VMRS{<c>}{<q>} <Rt>, <spec_reg> 


reg 


0b1000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if ELUsingAArch32(EL1) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == '@') || CPACR.cp10 
== 'QQ') then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQ8) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x08); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ8) ; 
else 
return FPEXC; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
return FPEXC; 
elsif PSTATE.EL == EL3 then 
if CPACR.cp1@ == '00' then 
UNDEFINED; 
else 
return FPEXC; 





VMSR{<c>}{<q>} <spec_reg>, <Rt> 


reg 


0b1000 


if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if ELUsingAArch32(EL1) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == '@') || CPACR.cp10 
== 'QQ') then 
UNDEFINED; 
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elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQ8) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x08); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ8) ; 
else 
FPEXC = R[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQQ) ; 





else 

FPEXC = R[t]; 
elsif PSTATE.EL == EL3 then 

if CPACR.cp10 == '00' then 
UNDEFINED; 

else 
FPEXC = R[t]; 
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G8.2.54 FPSCR, Floating-Point Status and Control Register 
The FPSCR characteristics are: 


Purpose 


Provides floating-point system status information and control. 


Configurations 
The named fields in this register map to the equivalent fields in the AArch64 FPCR and FPSR. 


It is IMPLEMENTATION DEFINED whether the Len and Stride fields can be programmed to non-zero 
values, which will cause some AArch32 floating-point instruction encodings to be UNDEFINED, or 
whether these fields are RAZ. 


Implemented only if the implementation includes the Advanced SIMD and floating-point 
functionality. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
FPSCR is a 32-bit register. 


Field descriptions 


The FPSCR bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21201918 161514131211109 8 76543 210 





a | | e 


DN OFC 


RMode UFC 


FZ16 IXC 
RESO 


IDC 
IOE 
DZE 
OFE 
UFE 
IXE 
RESO 
IDE 


N, bit [31] 
Negative condition flag. This is updated by floating-point comparison operations. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 
Zero condition flag. This is updated by floating-point comparison operations. 
This field resets to an architecturally UNKNOWN value. 
C, bit [29] 
Carry condition flag. This is updated by floating-point comparison operations. 
This field resets to an architecturally UNKNOWN value. 
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V, bit [28] 
Overflow condition flag. This is updated by floating-point comparison operations. 


This field resets to an architecturally UNKNOWN value. 


QC, bit [27] 


Cumulative saturation bit, Advanced SIMD only. This bit is set to 1 to indicate that an Advanced 
SIMD integer operation has saturated since 0 was last written to this bit. 


This field resets to an architecturally UNKNOWN value. 


AHP, bit [26] 
Alternative half-precision control bit: 
Qbd IEEE half-precision format selected. 
Qb1 Alternative half-precision format selected. 


This bit is only used for conversions between half-precision floating-point and other floating-point 
formats. 


The data-processing instructions added as part of the ARMv8.2-FP16 extension always use the 
IEEE half-precision format, and ignore the value of this bit. 


This field resets to an architecturally UNKNOWN value. 


DN, bit [25] 
Default NaN mode control bit: 
Qbd NaN operands propagate through to the output of a floating-point operation. 
Qb1 Any operation involving one or more NaNs returns the Default NaN. 


The value of this bit only controls scalar floating-point arithmetic. Advanced SIMD arithmetic 
always uses the Default NaN setting, regardless of the value of the DN bit. 


This field resets to an architecturally UNKNOWN value. 


FZ, bit [24] 
Flush-to-zero mode control bit: 


Qbe Flush-to-zero mode disabled. Behavior of the floating-point system is fully compliant 
with the IEEE 754 standard. 


Qb1 Flush-to-zero mode enabled. 


The value of this bit only controls scalar floating-point arithmetic. Advanced SIMD arithmetic 
always uses the Flush-to-zero setting, regardless of the value of the FZ bit. 


This bit has no effect on half-precision calculations. 

This field resets to an architecturally UNKNOWN value. 
RMode, bits [23:22] 

Rounding Mode control field. The encoding of this field is: 


0b00 Round to Nearest (RN) mode. 

0b01 Round towards Plus Infinity (RP) mode. 
0b10 Round towards Minus Infinity (RM) mode. 
0b11 Round towards Zero (RZ) mode. 


The specified rounding mode is used by almost all scalar floating-point instructions. Advanced 
SIMD arithmetic always uses the Round to Nearest setting, regardless of the value of the RMode 
bits. 


This field resets to an architecturally UNKNOWN value. 
Stride, bits [21:20] 
It is IMPLEMENTATION DEFINED whether this field is RW or RAZ. 
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If this field is RW and is set to a value other than zero, some floating-point instruction encodings 
are UNDEFINED. The instruction pseudocode identifies these instructions. 


Arm strongly recommends that software never sets this field to a value other than zero. 
The value of this field is ignored when processing Advanced SIMD instructions. 


This field resets to an architecturally UNKNOWN value. 


FZ16, bit [19] 
When ARMV8.2-FP16 is implemented: 
Flush-to-zero mode control bit on half-precision data-processing instructions: 


0b0 Flush-to-zero mode disabled. Behavior of the floating-point system is fully compliant 
with the IEEE 754 standard. 


Qb1 Flush-to-zero mode enabled. 


The value of this bit applies to both scalar and Advanced SIMD floating-point half-precision 
calculations. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Len, bits [18:16] 
It is IMPLEMENTATION DEFINED whether this field is RW or RAZ. 


If this field is RW and is set to a value other than zero, some floating-point instruction encodings 
are UNDEFINED. The instruction pseudocode identifies these instructions. 


Arm strongly recommends that software never sets this field to a value other than zero. 
The value of this field is ignored when processing Advanced SIMD instructions. 


This field resets to an architecturally UNKNOWN value. 


IDE, bit [15] 


Input Denormal floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
IDC bit is set to 1. 

Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the IDC bit. The trap handling software can decide whether to set the IDC 
bit to 1. 


This bit is RW only if the implementation supports the trapping of floating-point exceptions. In an 
implementation that does not support floating-point exception trapping, this bit is RAZ/WI. 


When this bit is RW, it applies only to floating-point operations. Advanced SIMD operations always 
use untrapped floating-point exception handling in AArch32 state. 


This field resets to an architecturally UNKNOWN value. 
Bits [14:13] 

Reserved, RESO. 
IXE, bit [12] 


Inexact floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
IXC bit is set to 1. 

Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the [XC bit. The trap handling software can decide whether to set the IXC 
bit to 1. 


This bit is RW only if the implementation supports the trapping of floating-point exceptions. In an 
implementation that does not support floating-point exception trapping, this bit is RAZ/WI. 
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When this bit is RW, it applies only to floating-point operations. Advanced SIMD operations always 
use untrapped floating-point exception handling in AArch32 state. 


This field resets to an architecturally UNKNOWN value. 
UFE, bit [11] 


Underflow floating-point exception trap enable. Possible values are: 


Ob Untrapped exception handling selected. If the floating-point exception occurs then the 
UFC bit is set to 1. 

Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the UFC bit. The trap handling software can decide whether to set the UFC 
bit to 1. 


This bit is RW only if the implementation supports the trapping of floating-point exceptions. In an 
implementation that does not support floating-point exception trapping, this bit is RAZ/WI. 


When this bit is RW, it applies only to floating-point operations. Advanced SIMD operations always 
use untrapped floating-point exception handling in AArch32 state. 


This field resets to an architecturally UNKNOWN value. 
OFE, bit [10] 


Overflow floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
OFC bit is set to 1. 

Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the OFC bit. The trap handling software can decide whether to set the OFC 
bit to 1. 


This bit is RW only if the implementation supports the trapping of floating-point exceptions. In an 
implementation that does not support floating-point exception trapping, this bit is RAZ/WI. 


When this bit is RW, it applies only to floating-point operations. Advanced SIMD operations always 
use untrapped floating-point exception handling in AArch32 state. 


This field resets to an architecturally UNKNOWN value. 
DZE, bit [9] 


Divide by Zero floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
DZC bit is set to 1. 

Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the DZC bit. The trap handling software can decide whether to set the DZC 
bit to 1. 


This bit is RW only if the implementation supports the trapping of floating-point exceptions. In an 
implementation that does not support floating-point exception trapping, this bit is RAZ/WI. 


When this bit is RW, it applies only to floating-point operations. Advanced SIMD operations always 
use untrapped floating-point exception handling in AArch32 state. 


This field resets to an architecturally UNKNOWN value. 
IOE, bit [8] 


Invalid Operation floating-point exception trap enable. Possible values are: 


Qbd Untrapped exception handling selected. If the floating-point exception occurs then the 
IOC bit is set to 1. 

Qb1 Trapped exception handling selected. If the floating-point exception occurs, the PE does 
not update the IOC bit. The trap handling software can decide whether to set the IOC 
bit to 1. 


This bit is RW only if the implementation supports the trapping of floating-point exceptions. In an 
implementation that does not support floating-point exception trapping, this bit is RAZ/WI. 
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IDC, bit [7] 


Bits [6:5] 


IXC, bit [4] 


UFC, bit [3] 


OFC, bit [2] 


DZC, bit [1] 


When this bit is RW, it applies only to floating-point operations. Advanced SIMD operations always 
use untrapped floating-point exception handling in AArch32 state. 


This field resets to an architecturally UNKNOWN value. 


Input Denormal cumulative floating-point exception bit. This bit is set to 1 to indicate that the Input 
Denormal floating-point exception has occurred since 0 was last written to this bit. 


How VFP instructions update this bit depends on the value of the IDE bit. 


Advanced SIMD instructions set this bit if the Input Denormal floating-point exception occurs in 
one or more of the floating-point calculations performed by the instruction, regardless of the value 
of the IDE bit. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Inexact cumulative floating-point exception bit. This bit is set to 1 to indicate that the Inexact 
floating-point exception has occurred since 0 was last written to this bit. 


How VFP instructions update this bit depends on the value of the IXE bit. 


Advanced SIMD instructions set this bit if the Inexact floating-point exception occurs in one or 
more of the floating-point calculations performed by the instruction, regardless of the value of the 
IXE bit. 


This field resets to an architecturally UNKNOWN value. 


Underflow cumulative floating-point exception bit. This bit is set to 1 to indicate that the Underflow 
floating-point exception has occurred since 0 was last written to this bit. 


How VFP instructions update this bit depends on the value of the UFE bit. 


Advanced SIMD instructions set this bit if the Underflow floating-point exception occurs in one or 
more of the floating-point calculations performed by the instruction, regardless of the value of the 
UFE bit. 


This field resets to an architecturally UNKNOWN value. 


Overflow cumulative floating-point exception bit. This bit is set to 1 to indicate that the Overflow 
floating-point exception has occurred since 0 was last written to this bit. 


How VFP instructions update this bit depends on the value of the OFE bit. 


Advanced SIMD instructions set this bit if the Overflow floating-point exception occurs in one or 
more of the floating-point calculations performed by the instruction, regardless of the value of the 
OFE bit. 


This field resets to an architecturally UNKNOWN value. 


Divide by Zero cumulative floating-point exception bit. This bit is set to 1 to indicate that the Divide 
by Zero floating-point exception has occurred since 0 was last written to this bit. 


How VFP instructions update this bit depends on the value of the DZE bit. 


Advanced SIMD instructions set this bit if the Divide by Zero floating-point exception occurs in one 
or more of the floating-point calculations performed by the instruction, regardless of the value of 
the DZE bit. 


This field resets to an architecturally UNKNOWN value. 
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IOC, bit [0] 


Invalid Operation cumulative floating-point exception bit. This bit is set to 1 to indicate that the 
Invalid Operation floating-point exception has occurred since 0 was last written to this bit. 


How VFP instructions update this bit depends on the value of the IOE bit. 


Advanced SIMD instructions set this bit if the Invalid Operation floating-point exception occurs in 
one or more of the floating-point calculations performed by the instruction, regardless of the value 
of the IOE bit. 


This field resets to an architecturally UNKNOWN value. 


Accessing the FPSCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


VMRS{<c>}{<q>} <Rt>, <spec_reg> 


reg 


0b0001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if CPACR_EL1.FPEN == 'x@' then 
AArch64.AArch32SystemAccessTrap(EL1, 0x07); 
elsif ELUsingAArch32(EL1) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 'Q') || 
CPACR.cp10 == 'Q0') then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQ8) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x08); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ8) ; 
else 
return FPSCR; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
return FPSCR; 
elsif PSTATE.EL == EL3 then 
if CPACR.cp1@ == '00' then 
UNDEFINED; 
else 
return FPSCR; 
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G8-6026 


VMSR{<c>}{<q>} <spec_reg>, <Rt> 


reg 


0b0001 


if PSTATE.EL == EL@ then 


UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if CPACR_EL1.FPEN == 'x0' then 


AArch64.AArch32SystemAccessTrap(EL1, 0x07); 
elsif ELUsingAArch32(EL1) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 'Q') || 
CPACR.cp10 == 'Q0') then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp10 == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQ8) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x08); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ8) ; 
else 
FPSCR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'Ø') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
FPSCR = R[t]; 
elsif PSTATE.EL == EL3 then 
if CPACR.cp1@ == '00' then 
UNDEFINED; 
else 
FPSCR = R[t]; 


"1' && CPTR_EL2.FPEN == 'x@' then 
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FPSID, Floating-Point System ID register 


The FPSID characteristics are: 


Purpose 
Provides top-level information about the floating-point implementation. 
This register largely duplicates information held in the MIDR. Arm deprecates use of it. 
Configurations 
Implemented only if the implementation includes the Advanced SIMD and floating-point 
functionality. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


FPSID is a 32-bit register. 


Field descriptions 


The FPSID bit assignments are: 


31 24 23 22 1615 8 7 4 3 0 


a | 


ARM DDI 0487E.a 
ID070919 


Implementer, bits [31:24] 
Implementer codes are the same as those used for the MIDR. 
For an implementation by Arm this field is 0x41, the ASCII code for A. 


This field resets to an architecturally UNKNOWN value. 


SW, bit [23] 


Software bit. Defined values are: 


Qbd The implementation provides a hardware implementation of the floating-point 
instructions. 
Qb1 The implementation supports only software emulation of the floating-point instructions. 


In Armv8-A the only permitted value is 0b0. 
This field resets to an architecturally UNKNOWN value. 


Subarchitecture, bits [22:16] 
Subarchitecture version number. For an implementation by Arm, defined values are: 
@b0000000 VFPv1 architecture with an IMPLEMENTATION DEFINED subarchitecture. 
0b0000001 WVFPv2 architecture with Common VFP subarchitecture v1. 


0b0000010 VFPv3 architecture, or later, with Common VFP subarchitecture v2. The VFP 
architecture version is indicated by the MVFRO and MVFR!1 registers. 


0b0000011 WVFPv3 architecture, or later, with Null subarchitecture. The entire floating-point 
implementation is in hardware, and no software support code is required. The VFP 
architecture version is indicated by the MVFRO and MVFR1 registers. This value can 
be used only by an implementation that does not support the trap enable bits in the 
FPSCR. 
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0b0000100 VFPv3 architecture, or later, with Common VFP subarchitecture v3, and support for 
trap enable bits in FPSCR. The VFP architecture version is indicated by the MVFRO and 
MVERI registers. 


For a subarchitecture designed by Arm the most significant bit of this field, register bit[22], is 0. 
Values with a most significant bit of 0 that are not listed here are reserved. 


When the subarchitecture designer is not Arm, the most significant bit of this field, register bit[22], 
must be 1. Each implementer must maintain its own list of subarchitectures it has designed, starting 
at subarchitecture version number 0x40. 


In Armv8-A the permitted values are 0b0000011 and 0b0000100. 


This field resets to an architecturally UNKNOWN value. 


PartNum, bits [15:8] 


An IMPLEMENTATION DEFINED part number for the floating-point implementation, assigned by the 
implementer. 


This field resets to an architecturally UNKNOWN value. 


Variant, bits [7:4] 


An IMPLEMENTATION DEFINED variant number. Typically, this field distinguishes between different 
production variants of a single product. 


This field resets to an architecturally UNKNOWN value. 


Revision, bits [3:0] 
An IMPLEMENTATION DEFINED revision number for the floating-point implementation. 


This field resets to an architecturally UNKNOWN value. 


Accessing the FPSID 


Accesses to this register use the following encodings in the System instruction encoding space: 


VMRS{<c>}{<q>} <Rt>, <spec_reg> 


reg 


0b0000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if ELUsingAArch32(EL1) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == '@') || CPACR.cp10 
== 'Q0') then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQ8) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x08); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ8) ; 
else 
return FPSID; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x0' then 
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AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
return FPSID; 
elsif PSTATE.EL == EL3 then 
if CPACR.cp10 == '00' then 
UNDEFINED; 
else 
return FPSID; 


VMSR{<c>}{<q>} <spec_reg>, <Rt> 


reg 


0b0000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if ELUsingAArch32(EL1) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == '@') || CPACR.cp10 
== 'QQ') then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQ8) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x08); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ8) ; 
else 
//no operation 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
//no operation 
elsif PSTATE.EL == EL3 then 
if CPACR.cp1@ == '00' then 
UNDEFINED; 
else 
//no operation 
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G8.2.56 HACR, Hyp Auxiliary Configuration Register 
The HACR characteristics are: 


Purpose 
Controls trapping to Hyp mode of IMPLEMENTATION DEFINED aspects of Non-secure EL1 or ELO 
operation. 


Configurations 
AArch32 System register HACR[31:0] is architecturally mapped to AArch64 System register 
HACR_EL2[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HACR is a 32-bit register. 


Field descriptions 


The HACR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the HACR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





0b1111 0b100 0b0001 0b0001 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HACR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HACR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b100 0b0001 O0b0001 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HACR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
HACR = R[t]; 
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G8.2.57 HACTLR, Hyp Auxiliary Control Register 


The HACTLR characteristics are: 


Purpose 
Controls IMPLEMENTATION DEFINED features of Hyp mode operation. 
Configurations 
AArch32 System register HACTLR[31:0] is architecturally mapped to AArch64 System register 
ACTLR_EL2[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


HACTLR is a 32-bit register. 


Field descriptions 


The HACTLR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the HACTLR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b0001 O0b0000 O0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HACTLR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HACTLR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b100 0b0001 O0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HACTLR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
HACTLR = R[t]; 
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G8.2.58 HACTLR2, Hyp Auxiliary Control Register 2 
The HACTLR2 characteristics are: 


Purpose 


Provides additional space to the HACTLR register to hold IMPLEMENTATION DEFINED trap 
functionality. 


Configurations 


AArch32 System register HACTLR2[31:0] is architecturally mapped to AArch64 System register 
ACTLR_EL2[63:32]. 


In Armv8.0 and Armv8.1, it is IMPLEMENTATION DEFINED whether this register is implemented, or 
whether it causes UNDEFINED exceptions when accessed. The implementation of this register can be 
detected by examining ID MMFR4.AC2. 


From Armv8.2 this register must be implemented. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HACTLR2 is a 32-bit register. 


Field descriptions 


The HACTLR2 bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the HACTLR2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b100 0b0001 O0b0000 Ob011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HACTLR2; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
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else 
return HACTLR2; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn 


CRm 


opc2 





Ob1111 0b100 0b0001 


0b0000 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HACTLR2 = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HACTLR2 = R[t]; 
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G8.2.59 HADFSR, Hyp Auxiliary Data Fault Status Register 
The HADFSR characteristics are: 


Purpose 


Provides additional IMPLEMENTATION DEFINED syndrome information for Data Abort exceptions 
taken to Hyp mode. 


Configurations 
AArch32 System register HADFSR[3 1:0] is architecturally mapped to AArch64 System register 
AFSRO_EL2[31:0]. 
This is an optional register. An implementation that does not require this register can implement it 
as RESO. 


If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HADFSR is a 32-bit register. 


Field descriptions 


The HADFSR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the HADFSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b0101 O0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HADFSR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 


G8-6036 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch32 System Register Descriptions 
G8.2 General system control registers 


else 
return HADFSR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn 


CRm 


opc2 





Ob1111 0b100 0b0101 


0b0001 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HADFSR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HADFSR = R[t]; 
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G8.2.60 HAIFSR, Hyp Auxiliary Instruction Fault Status Register 
The HAIFSR characteristics are: 


Purpose 


Provides additional IMPLEMENTATION DEFINED syndrome information for Prefetch Abort 
exceptions taken to Hyp mode. 


Configurations 
AArch32 System register HAIFSR[31:0] is architecturally mapped to AArch64 System register 
AFSRI_EL2[31:0]. 
This is an optional register. An implementation that does not require this register can implement it 
as RESO. 


If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HAIFSR is a 32-bit register. 


Field descriptions 


The HAIFSR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the HAIFSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 = 0b0101 Ob0001 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HAIFSR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
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else 
return HAIFSR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn 


CRm 


opc2 





Ob1111 0b100 0b0101 


0b0001 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HAIFSR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HAIFSR = R[t]; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


G8-6039 


AArch32 System Register Descriptions 
G8.2 General system control registers 


G8.2.61 


G8-6040 


HAMAIRO, Hyp Auxiliary Memory Attribute Indirection Register 0 


The HAMAIRO characteristics are: 


Purpose 


Provides IMPLEMENTATION DEFINED memory attributes for the memory attribute encodings defined 
by HMAIRO. These IMPLEMENTATION DEFINED attributes can only provide additional qualifiers for 
the memory attribute encodings, and cannot change the memory attributes defined in HMAIRO. 


Configurations 


AArch32 System register HAMAIRO[31:0] is architecturally mapped to AArch64 System register 
AMAIR_EL2[31:0]. 

If EL2 is not implemented, this register is RESO from EL3. 

RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


HAMAIRO is a 32-bit register. 


Field descriptions 


The HAMAIRO bit assignments are: 


31 


0 


IMPLEMENTATION DEFINED 


If an implementation does not provide any IMPLEMENTATION DEFINED memory attributes, this register is RESO. 


IMPLEMENTATION DEFINED, bits [31:0] 


IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the HAMAIRO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b1010 Ob0011 0b000 


if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T10 == '1' then 


AArch32.TakeHypTrapException(Q@xQ3) ; 


else 


UNDEFINED; 


elsif PSTATE.EL == EL2 then 
return HAMAIRQ; 

elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 


UNDEFINED; 
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else 
return HAMAIRQ; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b1010 Ob0011 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HAMAIRO = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HAMAIRO = R[t]; 
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G8.2.62 


G8-6042 


HAMAIR1, Hyp Auxiliary Memory Attribute Indirection Register 1 


The HAMAIR1 characteristics are: 


Purpose 


Provides IMPLEMENTATION DEFINED memory attributes for the memory attribute encodings defined 
by HMAIR1. These IMPLEMENTATION DEFINED attributes can only provide additional qualifiers for 
the memory attribute encodings, and cannot change the memory attributes defined in HMAIR1. 


Configurations 


AArch32 System register HAMAIR1[31:0] is architecturally mapped to AArch64 System register 
AMAIR_EL2[63:32]. 


If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


HAMAIRI is a 32-bit register. 


Field descriptions 


The HAMAIR1 bit assignments are: 


31 


0 


IMPLEMENTATION DEFINED 


If an implementation does not provide any IMPLEMENTATION DEFINED memory attributes, this register is RESO. 


IMPLEMENTATION DEFINED, bits [31:0] 


IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Accessing the HAMAIR1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 = 0b1010 Ob0011 Ob001 


if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T10 == '1' then 


AArch32.TakeHypTrapException(Q@xQ3) ; 


else 


UNDEFINED; 


elsif PSTATE.EL == EL2 then 
return HAMAIR1; 

elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 


UNDEFINED; 
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else 
return HAMAIR1; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn 


CRm 


opc2 





Ob1111 0b100 0b1010 


0b0011 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HAMAIRI = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HAMAIRI = R[t]; 
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G8.2.63 


G8-6044 


HCPTR, Hyp Architectural Feature Trap Register 


The HCPTR characteristics are: 


Purpose 
Controls: 


$ Trapping to Hyp mode of Non-secure access, at EL1 or ELO, to trace, and to Advanced SIMD 
and floating-point functionality. 


. Hyp mode access to trace, and to Advanced SIMD and floating-point functionality. 





Note 
Accesses to this functionality: 


$ From Non-secure modes other than Hyp mode are also affected by settings in the CPACR and 
NSACR. 


s From Hyp mode are also affected by settings in the NSACR. 


Exceptions generated by the CPACR and NSACR controls are higher priority than those generated 
by the HCPTR controls. 





Configurations 


AArch32 System register HCPTR[31:0] is architecturally mapped to AArch64 System register 
CPTR_EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 with EL2 using AArch32, or into EL3 with EL3 using AArch32. Otherwise, RW fields in 
this register reset to architecturally UNKNOWN values. 


Attributes 
HCPTR is a 32-bit register. 


Field descriptions 


The HCPTR bit assignments are: 


31 30 29 21 20 19 1615141312 1110 9 0 


i RESO i RESO HE RES1 








RES1 
RESO 
TASE 
TCPAC, bit [31] 

Traps Non-secure EL1 accesses to the CPACR to Hyp mode. 

Ob This control does not cause any instructions to be trapped. 

Qb1 Non-secure EL1 accesses to the CPACR are trapped to Hyp mode. 

Note 
The CPACR is not accessible at ELO. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 
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TAM, bit [30] 
When AMUv1 is implemented: 


Trap Activity Monitor access. Traps Non-secure EL1 and ELO accesses to all Activity Monitor 
registers to EL2. 


Qbd Accesses from Non-secure EL1 and ELO to Activity Monitor registers are not trapped. 
Qb1 Accesses from Non-secure EL1 and ELO to Activity Monitor registers are trapped to 
Hyp mode. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


Bits [29:21] 


Reserved, RESO. 


TTA, bit [20] 
Traps Non-secure System register accesses to all implemented trace registers to Hyp mode. 
0bd This control does not cause any instructions to be trapped. 


0b1 Any Non-secure System register access to an implemented trace register is trapped to 
Hyp mode, unless the access is trapped to EL1 by a CPACR or NSACR control, or the 
access is from Non-secure ELO and the definition of the register in the appropriate trace 
architecture specification indicates that the register is not accessible from ELO. A 
trapped instruction generates: 


š A Hyp Trap exception, if the exception is taken from Non-secure ELO or EL1. 


. An Undefined Instruction exception taken to Hyp mode, if the exception is taken 
from Hyp mode. 


If the implementation does not include a PE trace unit, or does not include a System register 
interface to the PE trace unit registers, it is IMPLEMENTATION DEFINED whether this bit: 


. Is RESO. 
a Is RES1. 
° Can be written from Hyp mode, and from Secure Monitor mode when SCR.NS is 1. 


If EL3 is implemented and is using AArch32, and the value of NSACR.NSTRCDIS is 1, in 
Non-secure state this field behaves as RAO/WI, regardless of its actual value. 





Note 


. The ETMv4 architecture does not permit ELO to access the trace registers. If the 
implementation includes an ETMv4 implementation, ELO accesses to the trace registers are 
UNDEFINED, and a resulting Undefined Instruction exception is higher priority than a 
HCPTR.TTA Hyp Trap exception. 


° The architecture does not provide traps on trace register accesses through the optional 
memory-mapped debug interface. 





System register accesses to the trace registers can have side-effects. When a System register access 
is trapped, any side-effects that are normally associated with the access do not occur before the 
exception is taken. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 
Bits [19:16] 


Reserved, RESO. 
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TASE, bit [15] 
Traps Non-secure execution of Advanced SIMD instructions to Hyp mode when the value of 
HCPTR.TCP10 is 0. 
0bd This control does not cause any instructions to be trapped. 


Qb1 When the value of HCPTR.TCP10 is 0, any attempt to execute an Advanced SIMD 
instruction in Non-secure state is trapped to Hyp mode, unless it is trapped to EL1 by a 
CPACR or NSACR control. A trapped instruction generates: 


š A Hyp Trap exception, if the exception is taken from Non-secure ELO or EL1. 
a An Undefined Instruction exception taken to Hyp mode, if the exception is taken 
from Hyp mode. 


When the value of HCPTR.TCP10 is 1, the value of this field is ignored. 


If the implementation does not include Advanced SIMD and floating-point functionality, this field 
is RES1. Otherwise, it is IMPLEMENTATION DEFINED whether this field is implemented as a RW field. 
If it is not implemented as a RW field, then it is RAZ/WI. 


If EL3 is implemented and is using AArch32, and the value of NSACR.NSASEDIS is 1, in 
Non-secure state this field behaves as RAO/WI, regardless of its actual value. This applies even if 
the field is implemented as RAZ/WI. 


For the list of instructions affected by this field, see Controls of Advanced SIMD operation that do 
not apply to floating-point operation on page E1-3800. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Bit [14] 


Reserved, RESO. 


Bits [13:12] 


Reserved, RES1. 


TCP11, bit [11] 


The value of this field is ignored. If this field is programmed with a different value to the TCP 10 bit 
then this field is UNKNOWN on a direct read of the HCPTR. 


If the implementation does not include Advanced SIMD and floating-point functionality, this field 
is RES1. 


If EL3 is implemented and is using AArch32, and the value of NSACR.cp10 is 0, in Non-secure 
state this field behaves as RAO/WI, regardless of its actual value. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


TCP10, bit [10] 
Trap Non-secure accesses to Advanced SIMD and floating-point functionality to Hyp mode: 
0bd This control does not cause any instructions to be trapped. 


Qb1 Any attempted access to Advanced SIMD and floating-point functionality from 
Non-secure state is trapped to Hyp mode, unless it is trapped to EL1 by a CPACR or 
NSACR control. A trapped instruction generates: 


s A Hyp Trap exception, if the exception is taken from Non-secure ELO or EL1. 
š An Undefined Instruction exception taken to Hyp mode, if the exception is taken 
from Hyp mode. 


The Advanced SIMD and floating-point features controlled by these fields are: 
. Execution of any floating-point or Advanced SIMD instruction. 


è Any access to the Advanced SIMD and floating-point registers D0-D31 and their views as 
S0-S31 and Q0-Q15. 


. Any access to the FPSCR, FPSID, MVFRO, MVFR1, MVFR2, or FPEXC System registers. 
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If the implementation does not include Advanced SIMD and floating-point functionality, this field 
is RES1. 


If EL3 is implemented and is using AArch32, and the value of NSACR.cp10 is 0, in Non-secure 
state this field behaves as RAO/WI, regardless of its actual value. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Reserved, RES]. 


Accessing the HCPTR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b0001 0b0001 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


else 


return HCPTR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 


else 


return HCPTR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b0001 0b0001 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TCPAC == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


else 


HCPTR = R[t]; 
elsif PSTATE.EL == EL3 then 
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if SCR.NS == 'Q' then 
UNDEFINED; 

else 
HCPTR = R[t]; 
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G8.2.64 HCR, Hyp Configuration Register 
The HCR characteristics are: 


Purpose 
Provides configuration controls for virtualization, including defining whether various Non-secure 
operations are trapped to Hyp mode. 

Configurations 


AArch32 System register HCR[31:0] is architecturally mapped to AArch64 System register 
HCR_EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 with EL2 using AArch32, or into EL3 with EL3 using AArch32. Otherwise, RW fields in 
this register reset to architecturally UNKNOWN values. 


Attributes 
HCR is a 32-bit register. 


Field descriptions 


The HCR bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 1514131211109 8 76543 210 





RESO = E VM 
TRVM SWIO 


HCD PTW 
RESO FMO 
TGE IMO 
TVM AMO 
TTLB VF 
TPU VA 
TPC DC 
TSW TWI 
TAC TWE 
TIDCP TIDO 
TSC 
TID3 
TID2 
TID1 
Bit [31] 
Reserved, RESO. 
TRVM, bit [30] 
Trap Reads of Virtual Memory controls. Traps Non-secure EL] reads of the virtual memory control 
registers to EL2, when EL2 is enabled in the current Security state. 
The registers for which read accesses are trapped are as follows: 
SCTLR, TTBRO, TTBR1, TTBCR, TTBCR2, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, 
AIFSR, PRRR, NMRR, MAIRO, MAIR1, AMAIRO, AMAIRI, CONTEXTIDR. 
Ob This control does not cause any instructions to be trapped. 
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G8-6050 


HCD, bit [29] 


Bit [28] 


TGE, bit [27] 


TVM, bit [26] 


Qb1 Non-secure EL1 read accesses to the specified Virtual Memory controls are trapped to 
EL2. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


HVC instruction disable. Disables Non-secure EL1 and EL2 execution of HVC instructions, when 
EL2 is enabled in the current Security state. 


b0 HVC instruction execution is enabled at EL2 and EL1. 


Qb1 HVC instructions are UNDEFINED at EL2 and Non-secure EL]. 


The Undefined Instruction exception is taken to the Exception level at which the HVC 
instruction is executed. 


— Note ——_____ 
HVC instructions are always UNDEFINED at ELO. 





This bit is only implemented if EL3 is not implemented. Otherwise, it is RESO. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Reserved, RESO. 


Trap General Exceptions, from Non-secure ELO. 
Obd This control has no effect on execution at ELO. 


Qb1 When EL2 is not enabled in the current Security state, this control has no effect on 
execution at ELO. 


When EL2 is enabled in the current Security state, then: 
s All exceptions that would be routed to EL1 are routed to EL2. 


s The SCTLR.M bit is treated as being 0 for all purposes other than returning the 
result of a direct read of SCTLR. 


° The HCR. {FMO, IMO, AMO} bits are treated as being | for all purposes other 
than returning the result of a direct read of HCR. 


° All virtual interrupts are disabled. 

. Any IMPLEMENTATION DEFINED mechanisms for signaling virtual interrupts are 
disabled. 

g An exception return to EL] is treated as an illegal exception return. 

s Monitor mode execution of an MSR or CPS instruction that changes CPSR.M to 


a Non-secure EL1 mode is an illegal change to PSTATE.M. For more information 
see Illegal changes to PSTATE.M on page G1-5497. 


Also, when HCR.TGE is 1: 


° If EL3 is using AArch32, an attempt to change from a Secure PL1 mode to a Non-secure EL1 
mode by changing SCR.NS from 0 to 1 results in SCR.NS remaining as 0. 


a The HDCR.{TDRA, TDOSA, TDA, TDE} bits are ignored and treated as being 1 other than 
for the purpose of a direct read of HDCR. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Trap Virtual Memory controls. Traps Non-secure EL1 writes to the virtual memory control registers 
to EL2, when EL2 is enabled in the current Security state. 


The registers for which write accesses are trapped are as follows: 
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SCTLR, TTBRO, TTBR1, TTBCR, TTBCR2, DACR, DFSR, IFSR, DFAR, IFAR, ADFSR, 
AIFSR, PRRR, NMRR, MAIRO, MAIRI, AMAIRO, AMAIR1, CONTEXTIDR. 


Obed This control does not cause any instructions to be trapped. 
Qb1 Non-secure EL! write accesses to the specified virtual memory control registers are 
trapped to EL2. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


TTLB, bit [25] 
Trap TLB maintenance instructions. Traps Non-secure EL1 execution of a TLBI instruction to EL2, 
when EL2 is enabled in the current Security state. 
This applies to the following instructions: 


TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, TLBIMVALIS, TLBIMVAALIS, 
ITLBIALL, ITLBIMVA, ITLBIASID, DTLBIALL, DTLBIMVA, DTLBIASID, TLBIALL, 
TLBIMVA, TLBIASID, TLBIMVAA, TLBIMVAL, TLBIMVAAL 


Qbd This control does not cause any instructions to be trapped. 
Qb1 Non-secure EL1 accesses to the specified TLB maintenance instructions are trapped to 
EL2. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


TPU, bit [24] 


Trap cache maintenance instructions that operate to the Point of Unification. Traps Non-secure EL1 
execution of those cache maintenance instructions to EL2, when EL2 is enabled in the current 
Security state. 


This applies to the following instructions: 
° ICIMVAU, ICIALLU, ICIALLUIS, DCCMVAU. 


— Note 


An Undefined Instruction exception generated at ELO is higher priority than this trap to EL2, and 
these instructions are always UNDEFINED at ELO. 





ObO This control does not cause any instructions to be trapped. 
Qb1 Non-secure EL1 execution of the specified cache maintenance instructions is trapped to 
EL2. 


If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean by VA to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED 
whether the execution of any instruction cache invalidate to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


TPC, bit [23] 


Trap data or unified cache maintenance instructions that operate to the Point of Coherency. Traps 
Non-secure EL1 execution of those cache maintenance instructions to EL2, when EL2 is enabled in 
the current Security state. 


This applies to the following instructions: 
° DCIMVAC, DCCIMVAC, DCCMVAC. 


Note 


An Undefined Instruction exception generated at ELO is higher priority than this trap to EL2, and 
these instructions are always UNDEFINED at ELO. 





0bd This control does not cause any instructions to be trapped. 
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TSW, bit [22] 


TAC, bit [21] 


Qb1 Non-secure EL1 execution of the specified cache maintenance instructions is trapped to 
EL2. 


If the Point of Coherency is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean, invalidate, or clean and invalidate instruction that 
operates by VA to the point of coherency can be trapped when the value of this control is 1. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Trap data or unified cache maintenance instructions that operate by Set/Way. Traps Non-secure EL1 
execution of those cache maintenance instructions by set/way to EL2, when EL2 is enabled in the 
current Security state. 


This applies to the following instructions: 
è DCISW, DCCSW, DCCISW. 


Note 


An Undefined Instruction exception generated at ELO is higher priority than this trap to EL2, and 
these instructions are always UNDEFINED at ELO. 








ObO This control does not cause any instructions to be trapped. 
Qb1 Non-secure EL1 execution of the specified cache maintenance instructions is trapped to 
EL2. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Trap Auxiliary Control Registers. Traps Non-secure EL1 accesses to the Auxiliary Control 
Registers to EL2, when EL2 is enabled in the current Security state, from both Execution states. 


This applies to the following register accesses: 

ACTLR and, if implemented, ACTLR2. 

Qbe This control does not cause any instructions to be trapped. 

Qb1 Non-secure EL1 accesses to the specified registers are trapped to EL2. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


TIDCP, bit [20] 


TSC, bit [19] 


Trap IMPLEMENTATION DEFINED functionality. Traps Non-secure EL1 accesses to the encodings for 
IMPLEMENTATION DEFINED System Registers to EL2, when EL2 is enabled in the current Security 
state. 


MCR and MRC instructions accessing the following encodings: 

. All coproc==p15, CRn==c9, Opcodel = {0-7}, CRm == {c0-c2, c5-c8}, opcode2 == {0-7}. 

. All coproc==p15, CRn==c10, Opcodel =={0-7}, CRm == {c0, cl, c4, c8}, opcode2 == 
{0-7}. 

. All coproc==p15, CRn==c11, Opcode1=={0-7}, CRm == {c0-c8, c15}, opcode2 == {0-7}. 


When HCR.TIDCP is set to 1, it is IMPLEMENTATION DEFINED whether any of this functionality 
accessed from Non-secure ELO is trapped to EL2. Otherwise, it is UNDEFINED and the PE takes an 
Undefined Instruction exception to Non-secure Undefined mode. 


0bd This control does not cause any instructions to be trapped. 


Qb1 Non-secure EL1 accesses to the specified System register encodings for 
IMPLEMENTATION DEFINED functionality are trapped to EL2. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Trap SMC instructions. Traps Non-secure EL1 execution of SMC instructions to Hyp mode. 


0bd This control does not cause any instructions to be trapped. 
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Qb1 Any attempt to execute an SMC instruction at Non-secure EL1 is trapped to Hyp mode, 
regardless of the value of SCR.SCD. 


The Armv8-A architecture permits, but does not require, this trap to apply to conditional SMC 
instructions that fail their condition code check, in the same way as with traps on other conditional 





instructions. 
Note 
. This trap is only implemented if the implementation includes EL3. 
à SMC instructions are always UNDEFINED at PLO. 
a This bit traps execution of the SMC instruction. It is not a routing control for the SMC 
exception. Hyp Trap exceptions and SMC exceptions have different preferred return 
addresses. 





In a system where the PE resets into EL2 or EL3, this field resets to 0. 


TID3, bit [18] 


Trap ID group 3. Traps Non-secure EL1 reads of the following registers to EL2, when EL2 is 
enabled in the current Security state: 


ID_PFRO,ID_PFR1, ID_DFRO, ID AFRO, ID MMFRO, ID MMFRI1, ID MMFR2, ID MMEFR3, 
ID_ISARO, ID_ISAR1, ID ISAR2, ID ISAR3, ID_ISAR4, ID ISAR5, MVFRO, MVFRI, 
MVFR2, and ID MMFR4, except that if ID MMFR4 is implemented as RAZ/WI then it is 
IMPLEMENTATION DEFINED whether accesses to ID_ MMFR4 are trapped. 





Also, an MRC access to any of the following encodings: 

. coproc==p15, opcl == 0, CRn == c0, CRm == {c3-c7}, opc2 == {0,1}. 

$ coproc==p15, opel == 0, CRn == c0, CRm == c3, opc2 == 2. 

s coproc==p15, opc1 == 0, CRn == c0, CRm == c5, opc2 == {4,5}. 

It is IMPLEMENTATION DEFINED whether this bit traps MRC accesses to the following encodings: 
. coproc==p15, opcl == 0, CRn == c0, CRm == c2, opc2 == 7. 

i coproc==p15, opcl == 0, CRn == c0, CRm == c3, opc2 == {3-7}. 

. coproc==p15, opcl == 0, CRn == c0, CRm == {c4, c6, c7}, opc2 == {2-7}. 

° coproc==p15, opcl == 0, CRn == c0, CRm == c5, opc2 == {2, 3, 6, 7}. 

0bd This control does not cause any instructions to be trapped. 

Qb1 The specified Non-secure EL1 read accesses to ID group 3 registers are trapped to EL2. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 


TID2, bit [17] 


Trap ID group 2. Traps the following register accesses to EL2, when EL2 is enabled in the current 
Security state: 


. Non-secure EL1 and ELO reads of the CTR, CCSIDR, CCSIDR2, CLIDR, and CSSELR. 
° Non-secure EL1 and ELO writes to the CSSELR. 


ObO This control does not cause any instructions to be trapped. 
0b1 The specified Non-secure EL1 and ELO accesses to ID group 2 registers are trapped to 
EL2. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


TIDI, bit [16] 


Trap ID group 1. Traps Non-secure EL1 reads of the following registers to EL2, when EL2 is 
enabled in the current Security state: 


TCMTR, TLBTR, REVIDR, AIDR. 


0bd This control does not cause any instructions to be trapped. 
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TIDO, bit [15] 


TWE, bit [14] 


TWI, bit [13] 


Qb1 The specified Non-secure EL1 read accesses to ID group | registers are trapped to EL2. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Trap ID group 0. Traps the following register accesses to EL2, when EL2 is enabled in the current 
Security state: 


° Non-secure EL1 reads of the JIDR and FPSID. 
. If the JIDR is RAZ from Non-secure ELO, Non-secure ELO reads of the JIDR. 


Note 


à It is IMPLEMENTATION DEFINED whether the JIDR is RAZ or UNDEFINED at ELO. If it is 
UNDEFINED at ELO then the Undefined Instruction exception takes precedence over this trap. 


. The FPSID is not accessible at ELO. 





° Writes to the FPSID are ignored, and not trapped by this control. 





0bd This control does not cause any instructions to be trapped. 
Qb1 The specified Non-secure EL1 read accesses to ID group 0 registers are trapped to EL2. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Traps Non-secure ELO and EL1 execution of WFE instructions to EL2, when EL2 is enabled in the 
current Security state. 


0bd This control does not cause any instructions to be trapped. 


Qb1 Any attempt to execute a WFE instruction at Non-secure ELO or EL] is trapped to EL2, 
if the instruction would otherwise have caused the PE to enter a low-power state and it 
is not trapped by SCTLR.nTWE. 


The attempted execution of a conditional WFE instruction is only trapped if the instruction passes 
its condition code check. 


Note 


Since a WFE can complete at any time, even without a Wakeup event, the traps on WFE are not 
guaranteed to be taken, even if the WFE is executed when there is no Wakeup event. The only 
guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, 
the trap will be taken. 








In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Traps Non-secure ELO and EL1 execution of WFI instructions to EL2, when EL2 is enabled in the 
current Security state. 


0bd This control does not cause any instructions to be trapped. 


Qb1 Any attempt to execute a WFI instruction at Non-secure ELO or EL1 is trapped to EL2, 
if the instruction would otherwise have caused the PE to enter a low-power state and it 
is not trapped by SCTLR.nTWI. 


The attempted execution of a conditional WFI instruction is only trapped if the instruction passes 
its condition code check. 





Note 


Since a WFI can complete at any time, even without a Wakeup event, the traps on WFI are not 
guaranteed to be taken, even if the WFI is executed when there is no Wakeup event. The only 
guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, 
the trap will be taken. 





In a system where the PE resets into EL2 or EL3, this field resets to 0. 
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Default Cacheability. 
Qbd This control has no effect on the Non-secure EL1&0 translation regime. 
Qb1 In Non-secure state: 


a The SCTLR.M field behaves as 0 for all purposes other than a direct read of the 
value of the field. 


g The HCR. VM field behaves as 1 for all purposes other than a direct read of the 
value of the field. 


a The memory type produced by the first stage of the EL1&0 translation regime is 
Normal Non-Shareable, Inner Write-Back Read-Allocate Write-Allocate, Outer 
Write-Back Read-Allocate Write-Allocate. 


This field has no effect on the EL2 and EL3 translation regimes. 
This field is permitted to be cached in a TLB. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 


BSU, bits [11:10] 


FB, bit [9] 


VA, bit [8] 


VI, bit [7] 


Barrier Shareability upgrade. This field determines the minimum shareability domain that is applied 
to any barrier instruction executed from Non-secure EL1 or Non-secure ELO: 


b00 No effect. 


0b01 Inner Shareable. 
0b10 Outer Shareable. 
0b11 Full system. 


This value is combined with the specified level of the barrier held in its instruction, using the same 
principles as combining the shareability attributes from two stages of address translation. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Force broadcast. Causes the following instructions to be broadcast within the Inner Shareable 
domain when executed from Non-secure EL1: 


BPIALL, TLBIALL, TLBIMVA, TLBIASID, DTLBIALL, DTLBIMVA, DTLBIASID, 
ITLBIALL, ITLBIMVA, ITLBIASID, TLBIMVAA, ICIALLU, TLBIMVAL, TLBIMVAAL. 


Qbd This field has no effect on the operation of the specified instructions. 


Qb1 When one of the specified instruction is executed at Non-secure EL1, the instruction is 
broadcast within the Inner Shareable shareability domain. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Virtual SError interrupt exception. 

Qbd This mechanism is not making a virtual SError interrupt pending. 

Qb1 A virtual SError interrupt is pending because of this mechanism. 

The virtual SError interrupt is enabled only when the value of HCR.{TGE, AMO} is {0, 1}. 

The Guest OS cannot distinguish the virtual exception from the corresponding physical exception. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Virtual IRQ exception. 

Qbd This mechanism is not making a virtual IRQ pending. 

Qb1 A virtual IRQ is pending because of this mechanism. 

The virtual IRQ is enabled only when the value of HCR. {TGE, IMO} is {0, 1}. 
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VF, bit [6] 


AMO, bit [5] 


IMO, bit [4] 


FMO, bit [3] 


PTW, bit [2] 


SWIO, bit [1] 


The Guest OS cannot distinguish the virtual exception from the corresponding physical exception. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Virtual FIQ exception. 

Qbd This mechanism is not making a virtual FIQ pending. 

Qb1 A virtual FIQ is pending because of this mechanism. 

The virtual FIQ is enabled only when the value of HCR.{TGE, FMO} is {0, 1}. 

The Guest OS cannot distinguish the virtual exception from the corresponding physical exception. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


SError interrupt Mask Override. When this bit is set to 1, it overrides the effect of CPSR.A, and 
enables virtual exception signaling by the VA bit. 


If the value of HCR.TGE is 0, then virtual SError interrupts are enabled in Non-secure state. 


If the value of HCR.TGE is 1, then in Non-secure state the HCR.AMO bit behaves as | for all 
purposes other than a direct read of the value of the bit. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


IRQ Mask Override. When this bit is set to 1, it overrides the effect of CPSR.I, and enables virtual 
exception signaling by the VI bit. 


If the value of HCR.TGE is 0, then Virtual IRQ interrupts are enabled in the Non-secure state. 


If the value of HCR.TGE is 1, then in Non-secure state the HCR.IMO bit behaves as 1 for all 
purposes other than a direct read of the value of the bit. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


FIQ Mask Override. When this bit is set to 1, it overrides the effect of CPSR.F, and enables virtual 
exception signaling by the VF bit. 


If the value of HCR.TGE is 0, then Virtual FIQ interrupts are enabled in the Non-secure state. 


If the value of HCR.TGE is 1, then in Non-secure state the HCR.FMO bit behaves as | for all 
purposes other than a direct read of the value of the bit. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Protected Table Walk. In the Non-secure PL1&0 translation regime, a translation table access made 
as part of a stage 1 translation table walk is subject to a stage 2 translation. The combining of the 
memory type attributes from the two stages of translation means the access might be made to a type 
of Device memory. If this occurs then the value of this bit determines the behavior: 


0b0 The translation table walk occurs as if it is to Normal Non-cacheable memory. This 
means it can be made speculatively. 


Qb1 The memory access generates a stage 2 Permission fault. 
This field is permitted to be cached in a TLB. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Set/Way Invalidation Override. Causes Non-secure EL1 execution of the data cache invalidate by 
set/way instructions to perform a data cache clean and invalidate by set/way. 


Ob This control has no effect on the operation of data cache invalidate by set/way 
instructions. 
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Qb1 Data cache invalidate by set/way instructions perform a data cache clean and invalidate 


by set/way. 


When this bit is set to 1, DCISW performs the same invalidation as a DCCISW instruction. 


As aresult of changes to the behavior of DCISW, this bit is redundant in Armv8. This bit can be 


implemented as RES1. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


VM, bit [0] 
Virtualization enable. Enables stage 2 address translation for the Non-secure EL1&0 translation 
regime. 
Qbd Non-secure EL1&0 stage 2 address translation disabled. 
Qb1 Non-secure EL1&0 stage 2 address translation enabled. 


If the HCR.DC bit is set to 1, then the behavior of the PE when executing in a Non-secure mode 
other than Hyp mode is consistent with HCR.VM being 1, regardless of the actual value of 


HCR.VM, other than the value returned by an explicit read of HCR.VM. 


When the value of this bit is 1, data cache invalidate instructions executed at Non-secure EL1 
perform a data cache clean and invalidate. For the invalidate by set/way instruction this behavior 


applies regardless of the value of the HCR.SWIO bit. 
This bit is permitted to be cached in a TLB. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Accessing the HCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





Ob1111 0b100 0b0001 O0b0001 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HCR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HCR; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


G8-6057 


AArch32 System Register Descriptions 
G8.2 General system control registers 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b100 0b0001 O0b0001 


opc2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HCR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
HCR = R[t]; 
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G8.2.65 HCR2, Hyp Configuration Register 2 
The HCR2 characteristics are: 


Purpose 


Provides additional configuration controls for virtualization. 


Configurations 


AArch32 System register HCR2[31:0] is architecturally mapped to AArch64 System register 
HCR_EL2[63:32]. 


If EL2 is not implemented, this register is RESO from EL3. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 with EL2 using AArch32, or into EL3 with EL3 using AArch32. Otherwise, RW fields in 
this register reset to architecturally UNKNOWN values. 


Attributes 
HCR2 is a 32-bit register. 


Field descriptions 


The HCR2 bit assignments are: 


23 22 21 20 19 18 17 16 76543 210 





ms | 

RESO Tbe 
TOCU ya 
RESO 

TICAB mises 
TID4 


Bits [31:23] 
Reserved, RESO. 
TTLBIS, bit [22] 
When ARMV8.2-EVT is implemented: 


Trap TLB maintenance instructions that operate on the Inner Shareable domain. Traps execution of 
the following TLB maintenance instructions at EL1 to EL2: 


TLBIALLIS, TLBIMVAIS, TLBIASIDIS, TLBIMVAAIS, TLBIMVALIS, TLBIMVAALIS 


Ob This control does not cause any instructions to be trapped. 
Qb1 Non-secure EL1 execution of the specified TLB maintenance instructions is trapped to 
EL2. 


If ARMv8.2-EVT is not implemented, this field is RESO. 


When ARMvV8.1-VHE and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for 
all purposes other than a direct read of the value of this bit. 


Otherwise: 
Reserved, RESO. 
Bit [21] 


Reserved, RESO. 
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TOCU, bit [20] 
When ARMV8.2-EVT is implemented: 


Trap cache maintenance instructions that operate to the Point of Unification. Traps execution of 
those cache maintenance instructions at EL1 or ELO using AArch64, and at EL1 using AArch32, to 
EL2. 


This applies to the following instructions: 


. When Non-secure ELO is using AArch64, IC IVAU, DC CVAU. However, if the value of 
SCTLR EL1.UCI is 0 these instructions are UNDEFINED at ELO and any resulting exception 
is higher priority than this trap to EL2. 


. When EL! is using AArch64, IC IVAU, IC IALLU, DC CVAU. 
. When Non-secure EL1 is using AArch32, ICIMVAU, ICIALLU, DCCMVAU. 


— Note 


An exception generated because an instruction is UNDEFINED at ELO is higher priority than this trap 
to EL2. In addition: 


à IC IALLUIS and IC IALLU are always UNDEFINED at ELO using AArch64. 
è ICIMVAU, ICIALLU, ICIALLUIS, and DCCMVAU are always UNDEFINED at ELO using 





AArch32. 
ObO This control does not cause any instructions to be trapped. 
0b1 Non-secure execution of the specified cache maintenance instructions is trapped to EL2. 


If ARMv8.2-EVT is not implemented, this field is RESO. 


If the Point of Unification is before any level of data cache, it is IMPLEMENTATION DEFINED whether 
the execution of any data or unified cache clean by VA to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED 
whether the execution of any instruction cache invalidate to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


When ARMvV8.1-VHE is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


Otherwise: 


Bit [19] 


Reserved, RESO. 


Reserved, RESO. 


TICAB, bit [18] 
When ARMV8.2-EVT is implemented: 


Trap ICIALLUIS cache maintenance instructions. Traps execution of those cache maintenance 
instructions at EL1 to EL2. 


This applies to the following instructions: 


ICIALLUIS. 

ObO This control does not cause any instructions to be trapped. 

Qb1 Non-secure EL1 execution of the specified cache maintenance instructions is trapped to 
EL2. 


If ARMv8.2-EVT is not implemented, this field is RESO. 


If the Point of Unification is before any level of instruction cache, it is IMPLEMENTATION DEFINED 
whether the execution of any instruction cache invalidate to the Point of Unification instruction can 
be trapped when the value of this control is 1. 


When ARMv8.1-VHE and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for 
all purposes other than a direct read of the value of this bit. 
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Otherwise: 


Reserved, RESO. 


TID4, bit [17] 

When ARMV8.2-EVT is implemented: 
Trap ID group 4. Traps the following register accesses to EL2: 
AArch64: 
° CCSIDR_EL1, CCSIDR2_EL1, CLIDR_EL1, and CSSELR_EL1. 
° EL1 writes to CSSELR_EL1. 
AArch32: 
° EL1 reads of the CCSIDR, CCSIDR2, CLIDR, and CSSELR. 
: EL1 writes to the CSSELR. 


0bd This control does not cause any instructions to be trapped. 
Qb1 The specified Non-secure EL1 and ELO accesses to ID group 4 registers are trapped to 
EL2. 


If ARMv8.2-EVT is not implemented, this field is RESO. 


When ARMv8.1-VHE is implemented and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field 
behaves as 0 for all purposes other than a direct read of the value of this bit. 


Otherwise: 
Reserved, RESO. 
Bits [16:7] 
Reserved, RESO. 
MIOCNCE, bit [6] 
Mismatched Inner/Outer Cacheable Non-Coherency Enable, for the Non-secure PL1&0 translation 


regime. 

Ob For the Non-secure PL1&0 translation regime, for permitted accesses to a memory 
location that use a common definition of the Shareability and Cacheability of the 
location, there must be no loss of coherency if the Inner Cacheability attribute for those 
accesses differs from the Outer Cacheability attribute. 

Qb1 For the Non-secure PL1&0 translation regime, for permitted accesses to a memory 


location that use a common definition of the Shareability and Cacheability of the 
location, there might be a loss of coherency if the Inner Cacheability attribute for those 
accesses differs from the Outer Cacheability attribute. 


For more information see Mismatched memory attributes on page E2-3850. 
This field can be implemented as RAZ/WI. 


In a system where the PE resets into EL2 or EL3, this field resets to an architecturally UNKNOWN 
value. 


TEA, bit [5] 


Route synchronous External abort exceptions from ELO and EL! to EL2. If the RAS Extension is 
implemented, the possible values of this bit are: 


Qbd Does not route synchronous External abort exceptions from Non-secure ELO and EL1 
to EL2. 
Qb1 Route synchronous External abort exceptions from Non-secure ELO and EL1 to EL2, if 


not routed to EL3. 
When the RAS Extension is not implemented, this field is RESO. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 
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TERR, bit [4] 


Bits [3:2] 


ID, bit [1] 


CD, bit [0] 


When RAS is implemented: 


Trap Error record accesses from EL1 to EL2. Trap accesses to the following registers from EL1 to 
EL2: 


ERRIDR, ERRSELR, ERXADDR, ERXADDR2, ERXCTLR, ERXCTLR2, ERXFR, ERXFR2, 
ERXMISC0, ERXMISC1, ERXMISC2, ERXMISC3, and ERXSTATUS. When ARMV8.4-RAS is 
implemented, ERXMISC4, ERXMISC5, ERXMISC6, and ERXMISC7. 


0bd This control does not cause any instructions to be trapped. 
Qb1 Accesses to the specified registers from EL1 generate a Trap exception to EL2. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 

Otherwise: 


Reserved, RESO. 


Reserved, RESO. 


Stage 2 Instruction access cacheability disable. For the Non-secure PL1&0 translation regime, when 
HCR.VM==1, this control forces all stage 2 translations for instruction accesses to Normal memory 
to be Non-cacheable. 


Qbd This control has no effect on stage 2 of the Non-secure PL1&0 translation regime. 


Qb1 For the Non-secure PL1&0 translation regime, forces all stage 2 translations for 
instruction accesses to Normal memory to be Non-cacheable. 


This bit has no effect on the EL2 translation regime. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 


Stage 2 Data access cacheability disable. When HCR.VM==1, this forces all stage 2 translations for 
data accesses and translation table walks to Normal memory to be Non-cacheable for the 
Non-secure PL1&0 translation regime. 


Qbd This control has no effect on stage 2 of the Non-secure PL1&0 translation regime for 
data accesses and translation table walks. 


Qb1 For the Non-secure PL1&0 translation regime, forces all stage 2 translations for data 
accesses and translation table walks to Normal memory to be Non-cacheable. 


This bit has no effect on the EL2 translation regime. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Accessing the HCR2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b100 0b0001 O0b0001 0b100 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HCR2; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
return HCR2; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn 


Ob1111 0b100 0b0001 


CRm 


0b0001 


opc2 


0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HCR2 = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
HCR2 = R[t]; 
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G8.2.66 


G8-6064 


HDFAR, Hyp Data Fault Address Register 


The HDFAR characteristics are: 


Purpose 


Holds the virtual address of the faulting address that caused a synchronous Data Abort exception 
that is taken to Hyp mode. 


Configurations 


Attributes 


AArch32 System register HDFAR[31:0] is architecturally mapped to AArch64 System register 
FAR_EL2[31:0]. 


AArch32 System register HDFAR[31:0] is architecturally mapped to AArch32 System register 
DFAR[31:0] (S) when HaveEL(EL2), HaveEL(EL3) and HighestELUsingA Arch32(). 


If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


HDFAR is a 32-bit register. 


Field descriptions 


The HDFAR bit assignments are: 


31 


0 


VA of faulting address of synchronous Data Abort exception taken to Hyp mode 


Bits [31:0] 


VA of faulting address of synchronous Data Abort exception taken to Hyp mode. 
On a Prefetch Abort exception, this register is UNKNOWN. 
Any execution in a Non-secure EL1 or Non-secure ELO mode makes this register UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Accessing the HDFAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 = 0b0110 O0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HDFAR; 
elsif PSTATE.EL == EL3 then 
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if SCR.NS == 'Q' then 
UNDEFINED; 

else 
return HDFAR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn 


CRm 


opc2 





Ob1111 0b100 0b0110 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HDFAR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HDFAR = R[t]; 
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G8.2.67 


G8-6066 


HIFAR, Hyp Instruction Fault Address Register 


The HIFAR characteristics are: 


Purpose 


Holds the virtual address of the faulting address that caused a synchronous Prefetch Abort exception 
that is taken to Hyp mode. 


Configurations 


Attributes 


AArch32 System register HIFAR[31:0] is architecturally mapped to AArch64 System register 
FAR_EL2[63:32]. 


AArch32 System register HIFAR[31:0] is architecturally mapped to AArch32 System register 
IFAR[31:0] (S) when HaveEL(EL2), HaveEL(EL3) and HighestELUsingAArch32(). 


If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


HIFAR is a 32-bit register. 


Field descriptions 


The HIFAR bit assignments are: 


31 


0 


VA of faulting address of synchronous Prefetch Abort exception taken to Hyp mode 


Bits [31:0] 


VA of faulting address of synchronous Prefetch Abort exception taken to Hyp mode. 
On a Data Abort exception, this register is UNKNOWN. 
Any execution in a Non-secure EL1 or Non-secure ELO mode makes this register UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Accessing the HIFAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 = 0b0110 Ob0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HIFAR; 
elsif PSTATE.EL == EL3 then 
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if SCR.NS == 'Q' then 
UNDEFINED; 

else 
return HIFAR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn 


CRm 


opc2 





Ob1111 0b100 0b0110 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HIFAR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HIFAR = R[t]; 
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G8.2.68 


G8-6068 


HMAIRO, Hyp Memory Attribute Indirection Register 0 


The HMAIJIRO characteristics are: 


Purpose 


Along with HMAIR1, provides the memory attribute encodings corresponding to the possible 
AttrIndx values in a Long-descriptor format translation table entry for stage 1 translations for 
memory accesses from Hyp mode. 


AttrIndx[2] indicates the HMAIR register to be used: 
° When AttrIndx[2] is 0, HMAIRO is used. 
. When AttrIndx[2] is 1, HMAIR1 is used. 


Configurations 


AArch32 System register HMAIRO[31:0] is architecturally mapped to AArch64 System register 
MAIR EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HMAIRO is a 32-bit register. 


Field descriptions 


The HMAIRO bit assignments are: 


When TTBCR.EAE == 1: 


Attr<n>, bits [8n+7:8n], for n = 0 to 3 


The memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format translation 
table entry, where: 


- AttrIndx[2:0] gives the value of <n> in Attr<n>. 
° AttrIndx[2] defines which MAIR to access. Attr7 to Attr4 are in MAIR1, and Attr3 to Attr0 
are in MAIRO. 


Bits [7:4] are encoded as follows: 





Attr<n>[7:4] Meaning 





0b0000 Device memory. See encoding of Attr<n>[3:0] for the type of Device memory. 





ObOORW, RW not @b00 Normal memory, Outer Write-Through Transient. 





0b0100 Normal memory, Outer Non-cacheable. 





ObOIRW, RW not @b00 Normal memory, Outer Write-Back Transient. 





0b10RW Normal memory, Outer Write-Through Non-transient. 











0b11RW Normal memory, Outer Write-Back Non-transient. 





R = Outer Read-Allocate policy, W = Outer Write-Allocate policy. 
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The meaning of bits [3:0] depends on the value of bits [7:4]: 





Meaning when 


Attr<n>[3:0] Attr<n>[7:4] is 0b0000 


Meaning when Attr<n>[7:4] is not 0b0000 
































0b0000 Device-nGnRnE memory UNPREDICTABLE 

ObOORW, RW not 0b00 UNPREDICTABLE Normal memory, Inner Write-Through Transient 

0b0100 Device-nGnRE memory Normal memory, Inner Non-cacheable 

ObOIRW, RW not 0b00 UNPREDICTABLE Normal memory, Inner Write-Back Transient 

0b1000 Device-nGRE memory Normal memory, Inner Write-Through Non-transient (RW=0b00) 
Ob1ORW, RW not 0b00 UNPREDICTABLE Normal memory, Inner Write-Through Non-transient 

0b1100 Device-GRE memory Normal memory, Inner Write-Back Non-transient (RW=0b00) 
O0b11RW, RW not 0b0@ UNPREDICTABLE Normal memory, Inner Write-Back Non-transient 








R = Inner Read-Allocate policy, W = Inner Write-Allocate policy. 


The R and W bits in some Attr<n> fields have the following meanings: 





RorW Meaning 





b0 No Allocate 





0b1 Allocate 





This field resets to an architecturally UNKNOWN value. 


Accessing the HMAIRO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 = 0b1010 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HMAIRQ; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HMAIRQ; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b100 = 0b1010 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HMAIRO = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
HMAIRO = R[t]; 
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The HMAIRI characteristics are: 
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Along with HMAIRO, provides the memory attribute encodings corresponding to the possible 
AttrIndx values in a Long-descriptor format translation table entry for stage 1 translations for 
memory accesses from Hyp mode. 


AttrIndx[2] indicates the HMAIR register to be used: 
° When AttrIndx[2] is 0, HMAIRO is used. 
. When AttrIndx[2] is 1, HMAIR1 is used. 


AArch32 System register HMAIR1[31:0] is architecturally mapped to AArch64 System register 


If EL2 is not implemented, this register is RESO from EL3. 


RW fields in this register reset to architecturally UNKNOWN values. 


Purpose 
Configurations 

MAIR EL2[63:32]. 
Attributes 


HMAIR1 is a 32-bit register. 


Field descriptions 


The HMAIR1 bit assignments are: 


When TTBCR.EAE == 1: 


Attr<n>, bits [8(n-4)+7:8(n-4)], for n = 4 to 7 


The memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format translation 
table entry, where: 


- AttrIndx[2:0] gives the value of <n> in Attr<n>. 


° AttrIndx[2] defines which MAIR to access. Attr7 to Attr4 are in MAIR1, and Attr3 to Attr0 
are in MAIRO. 


Bits [7:4] are encoded as follows: 





Attr<n>[7:4] 


Meaning 





0b0000 


Device memory. See encoding of Attr<n>[3:0] for the type of Device memory. 





ObOORW, RW not 0b00 


Normal memory, Outer Write-Through Transient. 





0b0100 


Normal memory, Outer Non-cacheable. 





ObOIRW, RW not 0b00 


Normal memory, Outer Write-Back Transient. 





0b10RW 


Normal memory, Outer Write-Through Non-transient. 





0b11RW 








Normal memory, Outer Write-Back Non-transient. 





R = Outer Read-Allocate policy, W = Outer Write-Allocate policy. 
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The meaning of bits [3:0] depends on the value of bits [7:4]: 





Meaning when 


Attr<n>[3:0] Attr<n>[7:4] is 0b0000 


Meaning when Attr<n>[7:4] is not 0b0000 



































0b0000 Device-nGnRnE memory UNPREDICTABLE 

ObOORW, RW not 0b00 UNPREDICTABLE Normal memory, Inner Write-Through Transient 

0b0100 Device-nGnRE memory Normal memory, Inner Non-cacheable 

ObOIRW, RW not @b@0 UNPREDICTABLE Normal memory, Inner Write-Back Transient 

0b1000 Device-nGRE memory Normal memory, Inner Write-Through Non-transient (RW=0b00) 
Ob1ORW, RW not 0b0@ UNPREDICTABLE Normal memory, Inner Write-Through Non-transient 

0b1100 Device-GRE memory Normal memory, Inner Write-Back Non-transient (RW=0b00) 
Ob11RW, RW not 0b0@ UNPREDICTABLE Normal memory, Inner Write-Back Non-transient 





R = Inner Read-Allocate policy, W = Inner Write-Allocate policy. 


The R and W bits in some Attr<n> fields have the following meanings: 


This field resets to an architecturally UNKNOWN value. 


Accessing the HMAIR1 





RorW Meaning 





b0 No Allocate 





0b1 Allocate 





Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 


CRn CRm opc2 





Ob1111 0b100 


0b1010 0b0010 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HMAIR1; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HMAIR1; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b100 = 0b1010 O0b0010 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HMAIR1 = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
HMAIR1 = R[t]; 
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G8.2.70 


G8-6074 


HPFAR, Hyp IPA Fault Address Register 


The HPFAR characteristics are: 


Purpose 
Holds the faulting IPA for some aborts on a stage 2 translation taken to Hyp mode. 
Configurations 
AArch32 System register HPFAR[31:0] is architecturally mapped to AArch64 System register 
HPFAR_EL2[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


HPFAR is a 32-bit register. 


Field descriptions 


The HPFAR bit assignments are: 


31 


4 3 0 


FIPA[39:12] RESO 


Execution in any Non-secure mode other than Hyp mode makes this register UNKNOWN. 


FIPA[39:12], bits [31:4] 


Bits [3:0] 


Bits [39:12] of the faulting intermediate physical address. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Accessing the HPFAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b100 = 0b0110 0b0000 


0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HPFAR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
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UNDEFINED; 
else 
return HPFAR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn 


CRm 


opc2 





Ob1111 0b100 0b0110 


0b0000 


0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HPFAR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HPFAR = R[t]; 
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G8.2.71 


G8-6076 


HRMR, Hyp Reset Management Register 
The HRMR characteristics are: 


Purpose 
If EL2 is the highest implemented Exception level and this register is implemented: 
$ A write to the register at EL2 can request a Warm reset. 


° If EL2 can use AArch32 and AArch64, this register specifies the Execution state that the PE 
boots into on a Warm reset. 


Configurations 
AArch32 System register HRMR[31:0] is architecturally mapped to AArch64 System register 
RMR_EL2[31:0]. 
Only implemented if EL2 is the highest implemented Exception level. In this case: 
a If EL2 can use AArch32 and AArch64 then this register must be implemented. 


è If EL2 cannot use AArch64 then it is IMPLEMENTATION DEFINED whether the register is 
implemented. 


See the field descriptions for the reset values. These apply whenever the register is implemented. 


Attributes 
HRMR is a 32-bit register. 


Field descriptions 


The HRMR bit assignments are: 


Bits [31:2] 
Reserved, RESO. 

RR, bit [1] 
Reset Request. Setting this bit to 1 requests a Warm reset. 
This field resets to 0. 


AA64, bit [0] 
When EL2 can use AArch64, determines which Execution state the PE boots into after a Warm 


reset: 
Qbd AArch32. 
Qb1 AArché4. 


On coming out of the Warm reset, execution starts at the IMPLEMENTATION DEFINED reset vector 
address of the specified Execution state. 


If EL2 cannot use AArch64 this bit is RAZ/WI. 
When implemented as a RW field, this field resets to 0 on a Cold reset. 


Accessing the HRMR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 

















coproc opct CRn CRm opc2 
Ob1111 0b100 O0b1100 O0b0000 O0b010 
if PSTATE.EL == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif PSTATE.EL == EL1 && EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(0xQ3) ; 
elsif PSTATE.EL == EL2 && IsHighestEL(EL2) then 
return HRMR; 
else 
UNDEFINED; 
MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
coproc opct CRn CRm opc2 
Ob1111 0b100 0b1100 0b0000 O0b010 
if PSTATE.EL == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif PSTATE.EL == EL1 && EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(0xQ3) ; 
elsif PSTATE.EL == EL2 && IsHighestEL(EL2) then 
HRMR = R[t]; 
else 
UNDEFINED; 
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G8.2.72 HSCTLR, Hyp System Control Register 
The HSCTLR characteristics are: 


Purpose 


Provides top level control of the system operation in Hyp mode. 


Configurations 


AArch32 System register HSCTLR[3 1:0] is architecturally mapped to AArch64 System register 
SCTLR_EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 with EL2 using AArch32. Otherwise, RW fields in this register reset to architecturally 
UNKNOWN values. 


Attributes 
HSCTLR is a 32-bit register. 


Field descriptions 


The HSCTLR bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 201918171615 131211109 8 76543210 





DSSBS = | [o> nTLSMD 
RES1 LSMAOE 








RESO CP15BEN 
EE RESO 
RESO ITD 
RES1 SED 
RESO RESO 
WXN RES1 
RES1 
RESO 
RES1 
DSSBS, bit [31] 
When ARMVv%8.0-SSBS is implemented: 

Default PSTATE.SSBS value on Exception Entry. The defined values are: 

0bd PSTATE.SSBS is set to 0 on an exception to Hyp mode. 

Qb1 PSTATE.SSBS is set to 1 on an exception to Hyp mode. 

In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value. 

Otherwise: 
Reserved, RESO. 
TE, bit [30] 

T32 Exception Enable. This bit controls whether exceptions to EL2 are taken to A32 or T32 state: 

Qbd Exceptions, including reset, taken to A32 state. 

Qb1 Exceptions, including reset, taken to T32 state. 

In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
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Bits [29:28] 


Reserved, RES1. 


Bits [27:26] 


Reserved, RESO. 


EE, bit [25] 


The value of the PSTATE.E bit on entry to Hyp mode, the endianness of stage 1 translation table 
walks in the EL2 translation regime, and the endianness of stage 2 translation table walks in the 
PL1&0 translation regime. 


The possible values of this bit are: 


Ob Little-endian. PSTATE.E is cleared to 0 on entry to Hyp mode. Stage 1 translation table 
walks in the EL2 translation regime, and stage 2 translation table walks in the PL1&0 
translation regime are little-endian. 


Qb1 Big-endian. PSTATE.E is set to 1 on entry to Hyp mode. Stage 1 translation table walks 
in the EL2 translation regime, and stage 2 translation table walks in the PL1&0 
translation regime are big-endian. 


Ifan implementation does not provide Big-endian support at Exception Levels higher than ELO, this 
bit is RESO. 


If an implementation does not provide Little-endian support at Exception Levels higher than ELO, 
this bit is RES1. 


In a system where the PE resets into EL2, this field resets to an IMPLEMENTATION DEFINED value. 
Bit [24] 
Reserved, RESO. 
Bits [23:22] 
Reserved, RES1. 
Bits [21:20] 
Reserved, RESO. 
WXN, bit [19] 


Write permission implies XN (Execute-never). For the EL2 translation regime, this bit can force all 
memory regions that are writable to be treated as XN. The possible values of this bit are: 


0bd This control has no effect on memory access permissions. 


Qb1 Any region that is writable in the EL2 translation regime is forced to XN for accesses 
from software executing at EL2. 


The WXN bit is permitted to be cached in a TLB. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Bit [18] 

Reserved, RES1. 
Bit [17] 

Reserved, RESO. 
Bit [16] 


Reserved, RES1. 


Bits [15:13] 


Reserved, RESO. 
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I, bit [12] 


Bit [11] 


Bits [10:9] 


SED, bit [8] 


ITD, bit [7] 


Instruction access Cacheability control, for accesses at EL2: 


Qbd All instruction access to Normal memory from EL2 are Non-cacheable for all levels of 
instruction and unified cache. 


Ifthe value of HSCTLR.M is 0, instruction accesses from stage 1 of the EL2 translation 
regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer Non-cacheable 
memory. 


Qb1 All instruction access to Normal memory from EL2 can be cached at all levels of 
instruction and unified cache. 


Ifthe value of HSCTLR.M is 0, instruction accesses from stage | of the EL2 translation 
regime are to Normal, Outer Shareable, Inner Write-Through, Outer Write-Through 
memory. 


This bit has no effect on the PL1&0 translation regime. 


In a system where the PE resets into EL2, this field resets to 0. 


Reserved, RES1. 


Reserved, RESO. 


SETEND instruction disable. Disables SETEND instructions at EL2. 

Obd SETEND instruction execution is enabled at EL2. 

Qb1 SETEND instructions are UNDEFINED at EL2. 

If the implementation does not support mixed-endian operation at EL2, this bit is RES1. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


IT Disable. Disables some uses of IT instructions at EL2. 
Qbd All IT instruction functionality is enabled at EL2. 
Qb1 Any attempt at EL2 to execute any of the following is UNDEFINED: 
s All encodings of the IT instruction with hw1[3:0]!=1000. 
a All encodings of the subsequent instruction with the following values for hw1: 


— 11XXXXXXXXXXXXXX: All 32-bit instructions, and the 16-bit instructions B, 
UDF, SVC, LDM, and STM. 


— 1011xxxxxxxxxxxx: All instructions in Miscellaneous 16-bit instructions 
on page F3-3943. 


— 10100xxxxxxxxxxx: ADD Rd, PC, #imm 
— 01001xxxxxxxxxxx: LDR Rd, [PC, #imm] 


— 0100x1xxx1111xxx: ADD Rdn, PC; CMP Rn, PC; MOV Rd, PC; BX PC; 
BLX PC. 


— 010001xx1xxxx111: ADD PC, Rm; CMP PC, Rm; MOV PC, Rm. This 
pattern also covers unpredictable cases with BLX Rn. 


These instructions are always UNDEFINED, regardless of whether they would pass or fail 
the condition code check that applies to them as a result of being in an IT block. 


It is IMPLEMENTATION DEFINED whether the IT instruction is treated as: 
: A 16-bit instruction, that can only be followed by another 16-bit instruction. 


. The first half of a 32-bit instruction. 


This means that, for the situations that are UNDEFINED, either the second 16-bit 
instruction or the 32-bit instruction is UNDEFINED. 
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An implementation might vary dynamically as to whether IT is treated as a 16-bit 
instruction or the first half of a 32-bit instruction. 


If an instruction in an active IT block that would be disabled by this field sets this field to 1 then 
behavior is CONSTRAINED UNPREDICTABLE. For more information see Changes to an ITD control by 
an instruction in an IT block on page E1-3792 


ITD is optional, but if it is implemented in the SCTLR then it must also be implemented in the 
HSCTLR. If it is not implemented then this bit is RAZ/WI. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


Bit [6] 


Reserved, RESO. 


CP15BEN, bit [5] 


System instruction memory barrier enable. Enables accesses to the DMB, DSB, and ISB System 
instructions in the (coproc==0b1111) encoding space from EL2: 


Qbd EL2 execution of the CP15DMB, CP15DSB, and CP15ISB instructions is UNDEFINED. 
Qb1 EL2 execution of the CP1SDMB, CP15DSB, and CP15ISB instructions is enabled. 


CP15BEN is optional, but if it is implemented in the SCTLR then it must also be implemented in 
the HSCTLR. If it is not implemented then this bit is RAO/WI. 


In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 


LSMAOE, bit [4] 
When ARMv%8.2-LSMAOC is implemented: 
Load Multiple and Store Multiple Atomicity and Ordering Enable. 


0b0 For all memory accesses at EL2, A32 and T32 Load Multiple and Store Multiple can 
have an interrupt taken during the sequence memory accesses, and the memory accesses 
are not required to be ordered. 


Qb1 The ordering and interrupt behavior of A32 and T32 Load Multiple and Store Multiple 
at EL2 is as defined for Armv8.0. 


This bit is permitted to be cached in a TLB. 
In a system where the PE resets into EL2, this field resets to 1. 
Otherwise: 


Reserved, RES]. 
nTLSMD, bit [3] 
When ARMV8.2-LSMAOC is implemented: 
No Trap Load Multiple and Store Multiple to Device-nGRE/Device-nGnRE/Device-nGnRnE 


memory. 

ObO All memory accesses by A32 and T32 Load Multiple and Store Multiple at EL2 that are 
marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are 
trapped and generate a stage 1 Alignment fault. 

Qb1 All memory accesses by A32 and T32 Load Multiple and Store Multiple at EL2 that are 
marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory are not 
trapped. 


This bit is permitted to be cached in a TLB. 
In a system where the PE resets into EL2, this field resets to 1. 
Otherwise: 


Reserved, RES1. 
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C, bit [2] 
Cacheability control, for data accesses at EL2: 
Qbd All data access to Normal memory from EL2, and all accesses to the EL2 translation 
tables, are Non-cacheable for all levels of data and unified cache. 
Qb1 All data access to Normal memory from EL2, and all accesses to the EL2 translation 
tables, can be cached at all levels of data and unified cache. 
This bit has no effect on the PL1&0 translation regime. 
In a system where the PE resets into EL2, this field resets to 0. 
A, bit [1] 
Alignment check enable. This is the enable bit for Alignment fault checking at EL2: 
Obd Alignment fault checking disabled when executing at EL2. 
Instructions that load or store one or more registers, other than load/store exclusive and 
load-acquire/store-release, do not check that the address being accessed is aligned to the 
size of the data element or data elements being accessed. 
Qb1 Alignment fault checking enabled when executing at EL2. 
All instructions that load or store one or more registers have an alignment check that the 
address being accessed is aligned to the size of the data element or data elements being 
accessed. If this check fails it causes an Alignment fault, which is taken as a Data Abort 
exception. 
Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless 
of the value of the A bit. 
In a system where the PE resets into EL2, this field resets to an architecturally UNKNOWN value. 
M, bit [0] 


MMU enable for EL2 stage 1 address translation. Possible values of this bit are: 
Qbe EL2 stage 1 address translation disabled. 


See the HSCTLR.I field for the behavior of instruction accesses to Normal memory. 


Qb1 EL2 stage 1 address translation enabled. 
In a system where the PE resets into EL2, this field resets to 0. 


Accessing the HSCTLR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


0b1111 0b100 0b0001 0b0000 


opc2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HSCTLR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
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else 
return HSCTLR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn 


CRm 


opc2 





Ob1111 0b100 0b0001 


0b0000 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HSCTLR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HSCTLR = R[t]; 
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G8.2.73 HSR, Hyp Syndrome Register 


The HSR characteristics are: 


Purpose 
Holds syndrome information for an exception taken to Hyp mode. 
Configurations 
AArch32 System register HSR[31:0] is architecturally mapped to AArch64 System register 
ESR_EL2[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


HSR is a 32-bit register. 


Field descriptions 


The HSR bit assignments are: 


31 26 25 24 0 


Execution in any Non-secure PE mode other than Hyp mode makes this register UNKNOWN. 


When an UNPREDICTABLE instruction is treated as UNDEFINED, and the exception is taken to EL2, the value of HSR 
is UNKNOWN. The value written to HSR must be consistent with a value that could be created as a result of an 
exception from the same Exception level that generated the exception as a result of a situation that is not 
UNPREDICTABLE at that Exception level, in order to avoid the possibility of a privilege violation. 


EC, bits [31:26] 


Exception Class. Indicates the reason for the exception that this register holds information about. 
Possible values of this field are: 


EC = 0b000000 

Unknown reason. 

See ISS encoding for exceptions with an unknown reason. 
EC = 0b000001 

Trapped WFI or WFE instruction execution. 


Conditional WFE and WFI instructions that fail their condition code check do not cause 
an exception. 


See ISS encoding for an exception from a WFI or WFE instruction. 
EC = 0b000011 


Trapped MCR or MRC access with (coproc==0b1111) that is not reported using EC 
0b000000. 


See ISS encoding for an exception from an MCR or MRC access. 
EC = 0b000100 


Trapped MCRR or MRRC access with (coproc==0b1111) that is not reported using EC 
0b000000. 


See ISS encoding for an exception from an MCRR or MRRC access. 
EC == 0b000101 

Trapped MCR or MRC access with (coproc==0b1110). 

See ISS encoding for an exception from an MCR or MRC access. 


G8-6084 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch32 System Register Descriptions 
G8.2 General system control registers 


EC == 0b000110 

Trapped LDC or STC access. 

The only architected uses of these instructions are: 

. An STC to write data to memory from DBGDTRRXint. 

. An LDC to read data from memory to DBGDTRTXint. 

See ISS encoding for an exception from an LDC or STC instruction. 
EC == 0b000111 


Access to Advanced SIMD or floating-point functionality trapped by a HCPTR. {TASE, 
TCP10} control. 


Excludes exceptions generated because Advanced SIMD and floating-point are not 
implemented. These are reported with EC value 0b000000. 


See ISS encoding for an exception from an access to SIMD or floating-point 
functionality, resulting from HCPTR. 
EC = 0b001000 
Trapped VMRS access, from ID group trap, that is not reported using EC 0b000111. 
See ISS encoding for an exception from an MCR or MRC access. 
EC == 0b001100 
Trapped MRRC access with (coproc==0b1110). 
See ISS encoding for an exception from an MCRR or MRRC access. 
EC == 0b001110 
Illegal exception return to AArch32 state. 
See ISS encoding for an exception from an Illegal state or PC alignment fault. 
EC == 0b010001 
Exception on SVC instruction execution in AArch32 state routed to EL2. 
See ISS encoding for an exception from HVC or SVC instruction execution. 
EC == 0b010010 
HVC instruction execution in AArch32 state, when HVC is not disabled. 
See ISS encoding for an exception from HVC or SVC instruction execution. 
EC == 0b010011 
Trapped execution of SMC instruction in AArch32 state. 
See ISS encoding for an exception from SMC instruction execution. 
EC = 0b100000 
Prefetch Abort from a lower Exception level. 
See ISS encoding for an exception from a Prefetch Abort. 
EC == 0b100001 
Prefetch Abort taken without a change in Exception level. 
See ISS encoding for an exception from a Prefetch Abort. 
EC == 0b100010 
PC alignment fault exception. 
See ISS encoding for an exception from an Illegal state or PC alignment fault. 
EC == 0b100100 
Data Abort from a lower Exception level. 
See ISS encoding for an exception from a Data Abort. 
EC == 0b100101 
Data Abort taken without a change in Exception level. 
See ISS encoding for an exception from a Data Abort. 
All other EC values are reserved by Arm, and: 


° Unused values in the range 0b000000 - 0b101100 (0x00 - 0x2C) are reserved for future use for 
synchronous exceptions. 
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G8-6086 


° Unused values in the range 0b101101 - 0b111111 (0x2D - 0x3F) are reserved for future use, and 
might be used for synchronous or asynchronous exceptions. 


The effect of programming this field to a reserved value is that behavior is CONSTRAINED 
UNPREDICTABLE, as described in Reserved values in System and memory-mapped registers and 
translation table entries on page K1-7644. 


This field resets to an architecturally UNKNOWN value. 


IL, bit [25] 


Instruction length bit. Indicates the size of the instruction that has been trapped to Hyp mode. When 
this bit is valid, possible values of this bit are: 


Qbd 16-bit instruction trapped. 

Qb1 32-bit instruction trapped. 

This field is RES1 and not valid for the following cases: 

à When the EC field is 0b000000, indicating an exception with an unknown reason. 
. Prefetch Aborts. 

. Data Aborts for which the HSR.ISS.ISV field is 0. 

: When the EC value is 0b00111, indicating an Illegal state exception. 


Note 


This is a change from the behavior in Armv7, where the IL field is UNK/SBZP for the 
corresponding cases. 








The IL field is not valid and is UNKNOWN on an exception from a PC alignment fault. 


This field resets to an architecturally UNKNOWN value. 


ISS, bits [24:0] 


Instruction Specific Syndrome. Architecturally, this field can be defined independently for each 
defined Exception class. However, in practice, some ISS encodings are used for more than one 
Exception class. 


The following subsections describe each ISS format. 


ISS encoding for exceptions with an unknown reason 


Bits [24:0] 


24 0 


RESO 


Reserved, RESO. 


This EC code is used for all exceptions that are not covered by any other EC value. This includes exceptions that 
are generated in the following situations: 


: The attempted execution of an instruction bit pattern that has no allocated instruction or is not accessible in 
the current PE mode in the current Security state, including: 


A read access using a System register encoding pattern that is not allocated for reads or that does not 
permit reads in the current PE mode and Security state. 


A write access using a System register encoding pattern that is not allocated for writes or that does not 
permit writes in the current PE mode and Security state. 


Instruction encodings that are unallocated. 


Instruction encodings for instructions not implemented in the implementation. 
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è In Debug state, the attempted execution of an instruction bit pattern that not accessible in Debug state. 

s In Non-debug state, the attempted execution of an instruction bit pattern that not accessible in Non-debug 
state. 

è The attempted execution of a short vector floating-point instruction. 

° In an implementation that does not include Advanced SIMD and floating-point functionality, an attempted 


access to Advanced SIMD or floating-point functionality under conditions where that access would be 
permitted if that functionality was present. This includes the attempted execution of an Advanced SIMD or 
floating-point instruction, and attempted accesses to Advanced SIMD and floating-point System registers. 


a An exception generated because of the value of one of the SCTLR. {ITD, SED, CP15BEN} control bits. 


° Attempted execution of: 
— An HVC instruction when disabled by HCR.HCD, SCR.HCE, or SCR_EL3.HCE. 
— An SMC instruction when disabled by SCR.SCD or SCR_EL3.SMD. 
— An HLT instruction when disabled by EDSCR.HDE. 


° An HVC instruction when disabled by HCR.HCD, SCR.HCE, or SCR_EL3.HCE.An SMC instruction when 
disabled by SCR.SCD or SCR_EL3.SMD.An HLT instruction when disabled by EDSCR.HDE. 


$ An exception generated because of the attempted execution of an MSR (Banked register) or MRS (Banked 
register) instruction that would access a Banked register that is not accessible from the Security state and PE 
mode at which the instruction was executed. 


An exception is generated only if the CONSTRAINED UNPREDICTABLE behavior of the instruction is that it is 
UNDEFINED, see MSR (banked register) and MRS (banked register) on page K1-7628. 
$ Attempted execution, in Debug state, of: 


— A DCPS| instruction in Non-secure state from ELO when EL2 is using AArch32 and the value of 
HCR.TGE is 1. 


— A DCPS2 instruction at EL1 or ELO when EL2 is not implemented, or when EL3 is using AArch32 
and the value of SCR.NS is 0, or when EL3 is using AArch64 and the value of SCR_EL3.NS is 0. 


— A DCPS3 instruction when EL3 is not implemented, or when the value of EDSCR.SDD is 1. 


° In Debug state when the value of EDSCR.SDD is 1, the attempted execution at EL2, EL1, or ELO of an 
instruction that is configured to trap to EL3. 


Undefined Instruction exception, when the value of HCR.TGE is 1 on page G1-5517 describes the configuration 
settings for a trap that returns an HSR.EC value of 0b000000. 


ISS encoding for an exception from a WFI or WFE instruction 


24 23 20 19 1 0 


i COND RESO 


| 


CV, bit [24] 
Condition code valid. Possible values of this bit are: 
ObO The COND field is not valid. 
Qb1 The COND field is valid. 
When an A32 instruction is trapped, CV is set to 1. 


When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 
0. See the description of the COND field for more information. 
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This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


Bits [19:1] 


TI, bit [0] 


The condition code for the trapped instruction. 


When an A32 instruction is trapped, CV is set to 1 and: 


. If the instruction is conditional, COND is set to the condition code field value from the 
instruction. 
. If the instruction is unconditional, COND is set to 0b1110. 


A conditional A32 instruction that is known to pass its condition code check can be presented either: 
. With COND set to 0b1110, the value for unconditional. 

° With the COND value held in the instruction. 

When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


° CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT 
field to determine the condition, if any, of the T32 instruction. 


à CV is set to 1 and COND is set to the condition code for the condition that applied to the 
instruction. 


For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped 
conditional instruction only if the instruction passes its condition code check, these definitions mean 
that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, 
or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Trapped instruction. Possible values of this bit are: 
Qbd WFI trapped. 
Qb1 WFE trapped. 


This field resets to an architecturally UNKNOWN value. 


Traps to Hyp mode of Non-secure ELO and EL] execution of WFE and WFI instructions on page G1-5595 describes 
the configuration settings for this trap. 


ISS encoding for an exception from an MCR or MRC access 


a | 


CV, bit [24] 


24 23 2019 1716 1413 109 8 


ae 
RESO 


Condition code valid. Possible values of this bit are: 
ObO The COND field is not valid. 

0b1 The COND field is valid. 

When an A32 instruction is trapped, CV is set to 1. 


When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 
0. See the description of the COND field for more information. 
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This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 
The condition code for the trapped instruction. 


When an A32 instruction is trapped, CV is set to 1 and: 


° If the instruction is conditional, COND is set to the condition code field value from the 
instruction. 
. If the instruction is unconditional, COND is set to 0b1110. 


A conditional A32 instruction that is known to pass its condition code check can be presented either: 
. With COND set to 0b1110, the value for unconditional. 

e With the COND value held in the instruction. 

When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


° CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT 
field to determine the condition, if any, of the T32 instruction. 


° CV is set to 1 and COND is set to the condition code for the condition that applied to the 
instruction. 


For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped 
conditional instruction only if the instruction passes its condition code check, these definitions mean 
that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, 
or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 
Opc2, bits [19:17] 

The Opc2 value from the issued instruction. 

For a trapped VMRS access, holds the value 0b000. 

This field resets to an architecturally UNKNOWN value. 
Opcl, bits [16:14] 

The Opcl value from the issued instruction. 

For a trapped VMRS access, holds the value 0b111. 


This field resets to an architecturally UNKNOWN value. 
CRn, bits [13:10] 
The CRn value from the issued instruction. 
For a trapped VMRS access, holds the reg field from the VMRS instruction encoding. 
This field resets to an architecturally UNKNOWN value. 
Bit [9] 
Reserved, RESO. 
Rt, bits [8:5] 
The Rt value from the issued instruction, the general-purpose register used for the transfer. 
This field resets to an architecturally UNKNOWN value. 
CRm, bits [4:1] 
The CRm value from the issued instruction. 


For a trapped VMRS access, holds the value 0b0000. 


This field resets to an architecturally UNKNOWN value. 
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Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 
Qbd Write to System register space. MCR instruction. 
Qb1 Read from System register space. MRC or VMRS instruction. 


This field resets to an architecturally UNKNOWN value. 


The following sections describe configuration settings for traps that are reported using EC value 0b000011: 


Traps to Hyp mode of Non-secure ELO and EL1 accesses to the ID registers on page G1-5592. 


Traps to Hyp mode of Non-secure ELO and EL1 accesses to lockdown, DMA, and TCM operations on 
page G1-5591. 


Traps to Hyp mode of Non-secure ELI execution of cache maintenance instructions on page G1-5590. 
Traps to Hyp mode of Non-secure ELI execution of TLB maintenance instructions on page G1-5589. 
Traps to Hyp mode of Non-secure EL1 accesses to the Auxiliary Control Register on page G1-5590. 


Traps to Hyp mode of Non-secure ELO and EL1 accesses to Performance Monitors registers on 
page G1-5603. 


Traps to Hyp mode of Non-secure ELO and EL1 accesses to Activity Monitors registers on page G1-5595. 
Traps to Hyp mode of Non-secure EL1 accesses to the CPACR on page G1-5597. 
Traps to Hyp mode of Non-secure ELI accesses to virtual memory control registers on page G1-5588. 


General trapping to Hyp mode of Non-secure ELO and EL] accesses to System registers in the 
(coproc==0b1111) encoding space on page G1-5599. 


The following sections describe configuration settings for traps that are reported using EC value 0b000101: 


ID group 0, Primary device identification registers on page G1-5593. 

Traps to Hyp mode of Non-secure System register accesses to trace registers on page G1-5598. 
Trapping Non-secure System register accesses to Debug ROM registers on page G1-5601. 
Trapping Non-secure System register accesses to powerdown debug registers on page G1-5601. 


Trapping general Non-secure System register accesses to debug registers on page G1-5601. 


The following sections describes configuration settings for traps that are reported using EC value 0b001000: 


ID group 0, Primary device identification registers on page G1-5593. 


ID group 3, Detailed feature identification registers on page G1-5594. 


ISS encoding for an exception from an MCRR or MRRC access 


24 23 20 19 16 15 14 13 109 8 


oe Se 
RESO RESO 


CV, bit [24] 


Condition code valid. Possible values of this bit are: 
Qbd The COND field is not valid. 
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Qb1 The COND field is valid. 
When an A32 instruction is trapped, CV is set to 1. 


When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 
0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. 


When an A32 instruction is trapped, CV is set to 1 and: 


. If the instruction is conditional, COND is set to the condition code field value from the 
instruction. 
. If the instruction is unconditional, COND is set to 0b1110. 


A conditional A32 instruction that is known to pass its condition code check can be presented either: 
° With COND set to 0b1110, the value for unconditional. 

° With the COND value held in the instruction. 

When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


° CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT 
field to determine the condition, if any, of the T32 instruction. 


° CV is set to 1 and COND is set to the condition code for the condition that applied to the 
instruction. 


For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped 
conditional instruction only if the instruction passes its condition code check, these definitions mean 
that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, 
or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Opcl, bits [19:16] 


Bits [15:14] 


The Opcl value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Rt2, bits [13:10] 


Bit [9] 


Rt, bits [8:5] 


The Rt2 value from the issued instruction, the second general-purpose register used for the transfer. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


The Rt value from the issued instruction, the first general-purpose register used for the transfer. 


This field resets to an architecturally UNKNOWN value. 


CRm, bits [4:1] 


The CRm value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 


Qbd Write to System register space. MCRR instruction. 
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Qb1 Read from System register space. MRRC instruction. 


This field resets to an architecturally UNKNOWN value. 
The following sections describe configuration settings for traps that are reported using EC value 0b000100: 
° Traps to Hyp mode of Non-secure EL1 accesses to virtual memory control registers on page G1-5588. 


. Traps to Hyp mode of Non-secure ELO and EL1 accesses to Performance Monitors registers on 
page G1-5603. 


° Traps to Hyp mode of Non-secure ELO and EL1 accesses to Activity Monitors registers on page G1-5595. 
. Traps to Hyp mode of Non-secure ELO and EL1 accesses to the Generic Timer registers on page G1-5602. 


$ General trapping to Hyp mode of Non-secure ELO and EL1 accesses to System registers in the 
(coproc==0b1111) encoding space on page G1-5599. 


The following sections describe configuration settings for traps that are reported using EC value 0b001100: 
3 Traps to Hyp mode of Non-secure System register accesses to trace registers on page G1-5598. 


e Trapping Non-secure System register accesses to Debug ROM registers on page G1-5601. 


ISS encoding for an exception from an LDC or STC instruction 


24 23 20 19 12 11 9 8 5 4 3 0 


1 
CV 4 | L- Direction 
Offset 


CY, bit [24] 
Condition code valid. Possible values of this bit are: 
ObO The COND field is not valid. 
0b1 The COND field is valid. 
When an A32 instruction is trapped, CV is set to 1. 


When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 
0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 
COND, bits [23:20] 
The condition code for the trapped instruction. 


When an A32 instruction is trapped, CV is set to 1 and: 


° If the instruction is conditional, COND is set to the condition code field value from the 
instruction. 
. If the instruction is unconditional, COND is set to 0b1110. 


A conditional A32 instruction that is known to pass its condition code check can be presented either: 
° With COND set to 0b1110, the value for unconditional. 

e With the COND value held in the instruction. 

When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


. CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT 
field to determine the condition, if any, of the T32 instruction. 
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a CV is set to | and COND is set to the condition code for the condition that applied to the 
instruction. 


For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped 
conditional instruction only if the instruction passes its condition code check, these definitions mean 
that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, 
or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


imm8, bits [19:12] 
The immediate value from the issued instruction. 


This field resets to an architecturally UNKNOWN value. 


Bits [11:9] 


Reserved, RESO. 


Rn, bits [8:5] 


The Rn value from the issued instruction. Valid only when AM[2] is 0, indicating an immediate 
form of the LDC or STC instruction. 


When AM[2] is 1, indicating a literal form of the LDC or STC instruction, this field is UNKNOWN. 
This field resets to an architecturally UNKNOWN value. 
Offset, bit [4] 
Indicates whether the offset is added or subtracted: 
ObO Subtract offset. 
Qb1 Add offset. 
This bit corresponds to the U bit in the instruction encoding. 
This field resets to an architecturally UNKNOWN value. 
AM, bits [3:1] 
Addressing mode. The permitted values of this field are: 


0b000 Immediate unindexed. 
0b001 Immediate post-indexed. 
0b010 Immediate offset. 

0b011 Immediate pre-indexed. 
0b100 Literal unindexed. 


LDC instruction in A32 instruction set only. 


For a trapped STC instruction or a trapped T32 LDC instruction this encoding is 
reserved. 


0b110 Literal offset. 
LDC instruction only. 
For a trapped STC instruction, this encoding is reserved. 


The values 0b101 and 0b111 are reserved. The effect of programming this field to a reserved value is 
that behavior is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and 
memory-mapped registers and translation table entries on page K1-7628. 


Bit [2] in this subfield indicates the instruction form, immediate or literal. 
Bits [1:0] in this subfield correspond to the bits {P, W} in the instruction encoding. 


This field resets to an architecturally UNKNOWN value. 
Direction, bit [0] 


Indicates the direction of the trapped instruction. The possible values of this bit are: 


Qbd Write to memory. STC instruction. 
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Qb1 Read from memory. LDC instruction. 


This field resets to an architecturally UNKNOWN value. 


Trapping general Non-secure System register accesses to debug registers on page G1-5601 describes the 
configuration settings for the trap that is reported using EC value 0b000110. 


ISS encoding for an exception from an access to SIMD or floating-point functionality, resulting 


from HCPTR 


24 23 20 19 6 5 4 3 0 


CV = 2 = == RESO 


Excludes exceptions that occur because Advanced SIMD and floating-point functionality is not implemented, or 
because the value of HCR.TGE or HCR_EL2.TGE is 1. These are reported with EC value 0b000000. 


CV, bit [24] 


Condition code valid. Possible values of this bit are: 
Oboe The COND field is not valid. 

Qb1 The COND field is valid. 

When an A32 instruction is trapped, CV is set to 1. 


When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 
0. See the description of the COND field for more information. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


Bits [19:6] 


The condition code for the trapped instruction. 


When an A32 instruction is trapped, CV is set to 1 and: 


. If the instruction is conditional, COND is set to the condition code field value from the 
instruction. 
. If the instruction is unconditional, COND is set to 0b1110. 


A conditional A32 instruction that is known to pass its condition code check can be presented either: 
. With COND set to 0b1110, the value for unconditional. 

e With the COND value held in the instruction. 

When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


. CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT 
field to determine the condition, if any, of the T32 instruction. 


- CV is set to 1 and COND is set to the condition code for the condition that applied to the 
instruction. 


For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped 
conditional instruction only if the instruction passes its condition code check, these definitions mean 
that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, 
or to the value of any condition that applied to the instruction. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 
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TA, bit [5] 
Indicates trapped use of Advanced SIMD functionality. The possible values of this bit are: 
ObO Exception was not caused by trapped use of Advanced SIMD functionality. 
0b1 Exception was caused by trapped use of Advanced SIMD functionality. 


Any use of an Advanced SIMD instruction that is not also a floating-point instruction that is trapped 
to Hyp mode because of a trap configured in the HCPTR sets this bit to 1. 


For a list of these instructions, see Controls of Advanced SIMD operation that do not apply to 
floating-point operation on page E1-3800. 


This field resets to an architecturally UNKNOWN value. 


Bit [4] 


Reserved, RESO. 


coproc, bits [3:0] 
When the TA field returns the value 1, this field returns the value 1010, otherwise this field is RESO. 
This field resets to an architecturally UNKNOWN value. 


The following sections describe the configuration settings for the traps that are reported using EC value 0b000111: 


. General trapping to Hyp mode of Non-secure accesses to the SIMD and floating-point registers on 
page G1-5596. 


° Traps to Hyp mode of Non-secure accesses to Advanced SIMD functionality on page G1-5597. 


ISS encoding for an exception from HVC or SVC instruction execution 


Bits [24:16] 


Reserved, RESO. 


imm16, bits [15:0] 
The value of the immediate field from the HVC or SVC instruction. 
For an HVC instruction, this is the value of the imm16 field of the issued instruction. 
For an SVC instruction: 
. If the instruction is unconditional, then: 


— For the T32 instruction, this field is zero-extended from the imm8 field of the 
instruction. 


— For the A32 instruction, this field is the bottom 16 bits of the imm24 field of the 
instruction. 


. For the T32 instruction, this field is zero-extended from the imm8 field of the instruction.For 
the A32 instruction, this field is the bottom 16 bits of the imm24 field of the instruction. 


° If the instruction is conditional, this field is UNKNOWN. 
This field resets to an architecturally UNKNOWN value. 
The HVC instruction is unconditional, and a conditional SVC instruction generates an exception only if it passes its 


condition code check. Therefore, the syndrome information for these exceptions does not require conditionality 
information. 


Supervisor Call exception, when the value of HCR.TGE is 1 on page G1-5517 describes the configuration settings 
for the trap reported with EC value 0b010001. 
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ISS encoding for an exception from SMC instruction execution 


24 23 20 19 18 0 


fi COND i RESO 


p=] 


CCKNOWNPASS 


CV, bit [24] 


Condition code valid. Possible values of this bit are: 
ObO The COND field is not valid. 

Qb1 The COND field is valid. 

When an A32 instruction is trapped, CV is set to 1. 


When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 
0. See the description of the COND field for more information. 


This field is only valid if CCKNOWMPASS is 1, otherwise it is RESO. 


This field resets to an architecturally UNKNOWN value. 


COND, bits [23:20] 


The condition code for the trapped instruction. 


When an A32 instruction is trapped, CV is set to 1 and: 


° If the instruction is conditional, COND is set to the condition code field value from the 
instruction. 
° If the instruction is unconditional, COND is set to 0b1110. 


A conditional A32 instruction that is known to pass its condition code check can be presented either: 
. With COND set to 0b1110, the value for unconditional. 

e With the COND value held in the instruction. 

When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 


. CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT 
field to determine the condition, if any, of the T32 instruction. 


° CV is set to 1 and COND is set to the condition code for the condition that applied to the 


instruction. 


For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped 
conditional instruction only if the instruction passes its condition code check, these definitions mean 
that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, 
or to the value of any condition that applied to the instruction. 


This field is only valid if CCKNOWMPASS is 1, otherwise it is RESO. 


This field resets to an architecturally UNKNOWN value. 


CCKNOWNPASS, bit [19] 


Bits [18:0] 


Indicates whether the instruction might have failed its condition code check. 


0bd The instruction was unconditional, or was conditional and passed its condition code 
check. 
Qb1 The instruction was conditional, and might have failed its condition code check. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 
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Traps to Hyp mode of Non-secure EL1 execution of SMC instructions on page G1-5592 describes the configuration 
settings for this trap, for instructions executed in Non-secure EL1. 


ISS encoding for an exception from a Prefetch Abort 


24 11109 8 7 6 5 0 


RESO il IFSC 


Bits [24:11] 
Reserved, RESO. 
FnV, bit [10] 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd HIFAR is valid. 
Ob1 HIFAR is not valid, and holds an UNKNOWN value. 
This field is only valid if the IFSC code is @b@10000. It is RESO for all other aborts. 


This field resets to an architecturally UNKNOWN value. 


EA, bit [9] 
External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External 
aborts. 
For any abort other than an External abort this bit returns a value of 0. 
This field resets to an architecturally UNKNOWN value. 
Bit [8] 


Reserved, RESO. 


SIPTW, bit [7] 


For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 
translation table walk: 


Qbd Fault not on a stage 2 translation for a stage 1 translation table walk. 
Qb1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. 
For any abort other than a stage 2 fault this bit is RESO. 
This field resets to an architecturally UNKNOWN value. 
Bit [6] 
Reserved, RESO. 
IFSC, bits [5:0] 
Instruction Fault Status Code. Possible values of this field are: 
0b000000 Address size fault, translation table base register. 


0b000001 Address size fault, level 1. 
0b000010 Address size fault, level 2. 
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0b000011 
0b000101 
0b000110 
0b000111 
0b001001 
0b001010 
0b001011 
0b001101 
0b001110 
0b001111 
0b010000 
0b010101 
0b010110 
0b010111 
0b011000 
0b011101 
0b011110 
0b011111 
0b100010 
0b110000 





Address size fault, level 3. 

Translation fault, level 1. 

Translation fault, level 2. 

Translation fault, level 3. 

Access flag fault, level 1. 

Access flag fault, level 2. 

Access flag fault, level 3. 

Permission fault, level 1. 

Permission fault, level 2. 

Permission fault, level 3. 

Synchronous External abort, not on translation table walk. 

Synchronous External abort, on translation table walk, level 1. 

Synchronous External abort, on translation table walk, level 2. 

Synchronous External abort, on translation table walk, level 3. 

Synchronous parity or ECC error on memory access, not on translation table walk. 
Synchronous parity or ECC error on memory access on translation table walk, level 1. 
Synchronous parity or ECC error on memory access on translation table walk, level 2. 
Synchronous parity or ECC error on memory access on translation table walk, level 3. 
Debug exception. 

TLB conflict abort. 


All other values are reserved. 


When the RAS Extension is implemented, 0b011000, 0b011101, 0b011110, and 0b011111, are reserved. 





Note 


Armv8.2 requires the implementation of the RAS Extension. 





For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on a Long-descriptor translation table lookup on page G5-5830. 


If the SIPTW bit is set, then the level refers the level of the stage2 translation that is translating a 
stage 1 translation walk. 


This field resets to an architecturally UNKNOWN value. 


The following sections describe cases where Prefetch Abort exceptions can be routed to Hyp mode, generating 
exceptions that are reported in the HSR with EC value 0b100000: 


è Abort exceptions, when the value of HCR.TGE is 1 on page G1-5517. 


. Routing debug exceptions to EL2 using AArch32 on page G1-5518. 


ISS encoding for an exception from an Illegal state or PC alignment fault 


24 


0 


RESO 


Reserved, RESO. 


Bits [24:0] 
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For more information about the Illegal state exception, see: 

. Illegal changes to PSTATE.M on page G1-5497. 

. Illegal return events from AArch32 state on page G1-5524. 
. Legal returns that set PSTATE.IL to 1 on page G1-5526. 

è The Illegal Execution state exception on page G1-5526. 


For more information about the PC alignment fault exception, see Branching to an unaligned PC on page K1-7608. 


ISS encoding for an exception from a Data Abort 


24 23 22 21 20 19 16 15 14 1312111098765 





awl 

v—! | — Pw 
RESO 

RESO 

AR 

RESO 


ISV, bit [24] 
Instruction syndrome valid. Indicates whether the syndrome information in ISS[23:14] is valid. 
Qbd No valid instruction syndrome. ISS[23:14] are RESO. 
Qb1 ISS[23:14] hold a valid instruction syndrome. 


This bit is 0 for all faults except Data Aborts generated by stage 2 address translations for which all 
the following apply to the instruction that generated the Data Abort exception: 


. The instruction is an LDR, LDA, LDRT, LDRSH, LDRSHT, LDRH, LDAH, LDRHT, 
LDRSB, LDRSBT, LDRB, LDAB, LDRBT, STR, STL, STRT, STRH, STLH, STRHT, 
STRB, STLB, or STRBT instruction. 


$ The instruction is not performing register writeback. 
. The instruction is not using the PC as a source or destination register. 


For these cases, ISV is UNKNOWN if the exception was generated in Debug state in memory access 
mode, as described in Data Aborts in Memory access mode on page H4-6774, and otherwise 
indicates whether [SS[23:14] hold a valid syndrome. 





Note 


In the A32 instruction set, LDR*T and STR*T instructions always perform register writeback and 
therefore never return a valid instruction syndrome. 





When the RAS Extension is implemented, ISV is 0 for any synchronous External abort. 
ISV is set to 0 on a stage 2 abort on a stage 1 translation table walk. 


When the RAS Extension is not implemented, it is IMPLEMENTATION DEFINED whether ISV is set to 
1 or 0 ona synchronous External abort on a stage 2 translation table walk. 


This field resets to an architecturally UNKNOWN value. 


SAS, bits [23:22] 
Syndrome Access Size. When ISV is 1, indicates the size of the access attempted by the faulting 


operation. 
0b00 Byte 
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SSE, bit [21] 


Bit [20] 


0b01 Halfword 
0b10 Word 
0b11 Doubleword 


This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


Syndrome Sign Extend. When ISV is 1, for a byte, halfword, or word load operation, indicates 
whether the data item must be sign extended. For these cases, the possible values of this bit are: 


0b0 Sign-extension not required. 

Qb1 Data item must be sign-extended. 

For all other operations this bit is 0. 

This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


SRT, bits [19:16] 


Bit [15] 


AR, bit [14] 


Bits [13:12] 


Syndrome Register transfer. When ISV is 1, the register number of the Rt operand of the faulting 
instruction. 


This field is UNKNOWN when the value of ISV is UNKNOWN. 
This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Acquire/Release. When ISV is 1, the possible values of this bit are: 
Ob Instruction did not have acquire/release semantics. 

Qb1 Instruction did have acquire/release semantics. 

This field is UNKNOWN when the value of ISV is UNKNOWN. 

This field is RESO when the value of ISV is 0. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


AET, bits [11:10] 


Asynchronous Error Type. 


When the RAS Extension is implemented and the value returned in the DFSC field is 0b010001, 
describes the state of the PE after taking the SError interrupt exception. The possible values of this 
field are: 


0b00 Uncontainable error (UC) or uncategorized. 
0b01 Unrecoverable error (UEU). 
0b10 Restartable error (UEO) or Corrected error (CE). 
Qb11 Recoverable error (UER). 
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On a synchronous Data Abort, this field is RESO. 


If multiple errors are taken as a single SError interrupt exception, the overall state of the PE is 
reported. For example, if both a Recoverable and Unrecoverable error occurred, the state is 
Unrecoverable. 


Note 


Software can use this information to determine what recovery might be possible. The recovery 
software must also examine any implemented fault records to determine the location and extent of 
the error. 








When the RAS Extension is not implemented, or when DFSC is not 0b010001: 
. Bit[11] is RESO. 

. Bit[10] forms the FnV field. 

Note 


Armv8.2 requires the implementation of the RAS Extension. 








This field resets to an architecturally UNKNOWN value. 


EA, bit [9] 
External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External 
aborts. 
For any abort other than an External abort this bit returns a value of 0. 
This field resets to an architecturally UNKNOWN value. 
CM, bit [8] 


Cache maintenance. For a synchronous fault, identifies fault that comes from a cache maintenance 
or address translation instruction. For synchronous faults, the possible values of this bit are: 


Qbd Fault not generated by a cache maintenance or address translation instruction. 
Qb1 Fault generated by a cache maintenance or address translation instruction. 
For an asynchronous Data Abort exception, this bit is 0. 


This field resets to an architecturally UNKNOWN value. 


SIPTW, bit [7] 


For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 
translation table walk: 


Obd Fault not on a stage 2 translation for a stage 1 translation table walk. 
Qb1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. 
For any abort other than a stage 2 fault this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Wa, bit [6] 


Write not Read. Indicates whether a synchronous abort was caused by a write instruction or a read 
instruction. The possible values of this bit are: 


0b0 Abort caused by a read instruction. 
0b1 Abort caused by a write instruction. 


For faults on cache maintenance and address translation instructions, this bit always returns a value 
of 1. 


On an asynchronous Data Abort: 


° When the RAS Extension is not implemented, this bit is UNKNOWN. 
° When the RAS Extension is implemented, this bit is RESO. 
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Note 


Armv8.2 requires the implementation of the RAS Extension. 





This field resets to an architecturally UNKNOWN value. 


DESC, bits [5:0] 


Data Fault Status Code. Possible values of this field are: 


0b000000 
0b000001 
0b000010 
0b000011 
0b000101 
0b000110 
0b000111 
0b001001 
0b001010 
0b001011 
0b001101 
0b001110 
0b001111 
0b010000 
0b010001 
0b010101 
0b010110 
0b010111 
0b011000 
0b011001 
0b011101 
0b011110 
0b011111 
0b100001 
0b100010 
0b110000 
0b110100 
0b110101 





Address size fault, translation table base register. 

Address size fault, level 1. 

Address size fault, level 2. 

Address size fault, level 3. 

Translation fault, level 1. 

Translation fault, level 2. 

Translation fault, level 3. 

Access flag fault, level 1. 

Access flag fault, level 2. 

Access flag fault, level 3. 

Permission fault, level 1. 

Permission fault, level 2. 

Permission fault, level 3. 

Synchronous External abort, not on translation table walk. 

SError interrupt. 

Synchronous External abort, on translation table walk, level 1. 

Synchronous External abort, on translation table walk, level 2. 

Synchronous External abort, on translation table walk, level 3. 

Synchronous parity or ECC error on memory access, not on translation table walk. 
SError interrupt from a parity or ECC error on memory access. 

Synchronous parity or ECC error on memory access on translation table walk, level 1. 
Synchronous parity or ECC error on memory access on translation table walk, level 2. 
Synchronous parity or ECC error on memory access on translation table walk, level 3. 
Alignment fault. 

Debug exception. 

TLB conflict abort. 

IMPLEMENTATION DEFINED fault (Lockdown). 


IMPLEMENTATION DEFINED fault (Unsupported Exclusive access). 


All other values are reserved. 
When the RAS Extension is implemented, 0b011000, @b011001, 0b011101, 0b011110, and 0b011111, are 


reserved. 


For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on a Long-descriptor translation table lookup on page G5-5830. 


If the SIPTW bit is set, then the level refers the level of the stage2 translation that is translating a 
stage 1 translation walk. 


This field resets to an architecturally UNKNOWN value. 
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The following describe cases where Data Abort exceptions can be routed to Hyp mode, generating exceptions that 


are reported in the HSR with EC value 0b100100: 
s Abort exceptions, when the value of HCR.TGE is 1 on page G1-5517. 


. Routing debug exceptions to EL2 using AArch32 on page G1-5518. 


The following describe cases that can cause a Data Abort exception that is taken to Hyp mode, and reported in the 


HSR with EC value of 0b100000 or 0b100100: 
° Hyp mode control of Non-secure access permissions on page G5-5775. 


. Memory fault reporting in Hyp mode on page G5-5834. 


Accessing the HSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b100 = 0b0101 0b0010 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HSR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
return HSR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b100 = 0b0101 0b0010 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HSR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
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else 
HSR = R[t]; 
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G8.2.74 HSTR, Hyp System Trap Register 


The HSTR characteristics are: 


Purpose 


Controls trapping to Hyp mode of Non-secure accesses, at EL1 or lower, to System registers in the 
coproc == 0b1111 encoding space: 


° By the CRn value used to access the register using MCR or MRC instruction. 
° By the CRm value used to access the register using MCRR or MRRC instruction. 


Configurations 


Attributes 


AArch32 System register HSTR[31:0] is architecturally mapped to AArch64 System register 
HSTR_EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 with EL2 using AArch32, or into EL3 with EL3 using AArch32. Otherwise, RW fields in 
this register reset to architecturally UNKNOWN values. 


HSTR is a 32-bit register. 


Field descriptions 


The HSTR bit assignments are: 


161514131211109 8 76543210 





Bits [31:16] 


Reserved, RESO. 


T<n>, bit [n], for n = 0 to 15 


ARM DDI 0487E.a 
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Fields T14 and T4 are RESO. 


The remaining fields control whether Non-secure ELO and EL1 accesses, using MCR, MRC, 
MCRR, and MRRC instructions, to the System registers in the coproc == 0b1111 encoding space are 
trapped to Hyp mode: 


Ob This control has no effect on Non-secure ELO or EL1 accesses to System registers. 


Qb1 Any Non-secure EL1 MCR or MRC access with coproc == 0b1111 and CRn == <n> is 

trapped to Hyp mode. A Non-secure ELO MCR or MRC access with these values is 
trapped to Hyp mode only if the access is not UNDEFINED when the value of this field is 
0. 
Any Non-secure EL1 MCRR or MRRC access with coproc == 0b1111 and CRm == <n> 
is trapped to Hyp mode. A Non-secure ELO MCRR or MRRC access with these values 
is trapped to Hyp mode only if the access is not UNDEFINED when the value of this field 
is 0. 
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For example, when HSTR.T7 is 1, for instructions executed at Non-secure EL1: 


° An MCR or MRC instruction with coproc set to 0b1111 and <CRn> set to c7 is trapped to Hyp 
mode. 


° An MCRR or MRRC instruction with coproc set to 0b1111 and <CRm> set to c7 is trapped to 
Hyp mode. 


In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Accessing the HSTR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b0001 0b0001 Ob011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HSTR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HSTR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b100 0b0001 O0b0001 Ob011 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HSTR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HSTR = R[t]; 
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G8.2.75 HTCR, Hyp Translation Control Register 
The HTCR characteristics are: 


Purpose 
The control register for stage 1 of the EL2 translation regime. 


Note 


This stage of translation always uses the Long-descriptor translation table format. 








Configurations 


AArch32 System register HTCR[31:0] is architecturally mapped to AArch64 System register 
TCR_EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HTCR is a 32-bit register. 


Field descriptions 


The HTCR bit assignments are: 


31 30 29 28 27 26 25 24 23 22 14131211109 8 7 3 2 0 





IMP DEF ORGNO 


RESO 
HWU62 
HWU61 
HWU60 
HWU59 
HPD 
RES1 


Bit [31] 


Reserved, RES1. 


IMPLEMENTATION DEFINED, bit [30] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Bit [29] 


Reserved, RESO. 


HWU6O®2, bit [28] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 
translation table Block or Page entry. 


Qbd Bit[62] of each stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 
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Qb1 Bit[62] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of HTCR.HPD is 1. 


The Effective value of this field is 0 if the value of HTCR.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU61, bit [27] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 
translation table Block or Page entry. 


Obed Bit[61] ofeach stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[61] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of HTCR.HPD is 1. 


The Effective value of this field is 0 if the value of HTCR.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU60, bit [26] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 
translation table Block or Page entry. 


Obd Bit[60] ofeach stage 1 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[60] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of HTCR.HPD is 1. 


The Effective value of this field is 0 if the value of HTCR.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWUSS9, bit [25] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 
translation table Block or Page entry. 


Obd Bit[59] ofeach stage | translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[59] of each stage 1 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose if the value of HTCR.HPD is 1. 


The Effective value of this field is 0 if the value of HTCR.HPD is 0. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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HPD, bit [24] 
When ARMV8.2-AA32HPD is implemented: 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, XNTable, and 
PXNTable, in the PL2 translation regime. 


Obd Hierarchical permissions are enabled. 

Qb1 Hierarchical permissions are disabled. 

When disabled, the permissions are treated as if the bits are zero. 

This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
Bit [23] 

Reserved, RES1. 
Bits [22:14] 

Reserved, RESO. 
SHO, bits [13:12] 


Shareability attribute for memory associated with translation table walks using HTTBR. 


Qbe0 Non-shareable. 
0b10 Outer Shareable. 
Qb11 Inner Shareable. 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7628. 


This field resets to an architecturally UNKNOWN value. 


ORGNO, bits [11:10] 


Outer cacheability attribute for memory associated with translation table walks using HTTBR. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IRGNO, bits [9:8] 


Inner cacheability attribute for memory associated with translation table walks using HTTBR. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 
Bits [7:3] 

Reserved, RESO. 
TOSZ, bits [2:0] 


The size offset of the memory region addressed by HTTBR. The region size is 2G2-T0SZ) bytes. 
This field resets to an architecturally UNKNOWN value. 
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G8-6110 


Accessing the HTCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b100 0b0010 0b0000 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HTCR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HTCR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b100 0b0010 0b0000 


opc2 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HTCR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HTCR = R[t]; 
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G8.2.76 HTPIDR, Hyp Software Thread ID Register 


ARM DDI 0487E.a 
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The HTPIDR characteristics are: 


Purpose 


Provides a location where software running in Hyp mode can store thread identifying information 
that is not visible to Non-secure software executing at ELO or EL1, for hypervisor management 


purposes. 


The PE makes no use of this register. 


Configurations 


AArch32 System register HTPIDR[31:0] is architecturally mapped to AArch64 System register 
TPIDR_EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 


Note 
The PE never updates this register. 








RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 
HTPIDR is a 32-bit register. 


Field descriptions 


The HTPIDR bit assignments are: 


31 0 


Thread ID 


Bits [31:0] 
Thread ID. Thread identifying information stored by software running at this Exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the HTPIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b100 0b1101 O0b0000 0b010 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HTPIDR; 
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elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HTPIDR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





0b1111 0b100 0b1101 0b0000 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HTPIDR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HTPIDR = R[t]; 
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G8.2.77 HTTBR, Hyp Translation Table Base Register 


63 
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The HTTBR characteristics are: 


Purpose 
Holds the base address of the translation table for the initial lookup for stage 1 of an address 
translation in the EL2 translation regime, and other information for this translation regime. 
Configurations 


AArch32 System register HTTBR[47: 1] is architecturally mapped to AArch64 System register 
TTBRO_EL2[47:1]. 


If EL2 is not implemented, this register is RESO from EL3. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
HTTBR is a 64-bit register. 


Field descriptions 


The HTTBR bit assignments are: 


48 47 1 0 


RESO BADDR 


=a CnP 


Bits [63:48] 


Reserved, RESO. 


BADDR, bits [47:1] 


Translation table base address, bits[47:x], Bits [x-1:1] are RESO, with the additional requirement that 
if bits[x-1:3] are not all zero, this is a misaligned translation table base address, with effects that are 
CONSTRAINED UNPREDICTABLE, and must be one of the following: 


à Register bits [x-1:3] are treated as if all the bits are zero. The value read back from these bits 
is either the value written or zero. 


° The result of the calculation of an address for a translation table walk using this register can 
be corrupted in those bits that are nonzero. 


x is determined from the value of HTCR.TOSZ as follows: 

. If HTCR.TOSZ is 0 or 1, x = 5 - HTCR.TOSZ. 

° If HTCR.TOSZ is greater than 1, x = 14 - HTCR.TOSZ. 

If bits[47:40] of the translation table base address are not zero, an Address size fault is generated. 


This field resets to an architecturally UNKNOWN value. 


CnP, bit [0] 
When ARMV8.2-TTCNP is implemented: 
Common not Private. This bit indicates whether each entry that is pointed to by HTTBR is a member 


of a common set that can be used by every PE in the Inner Shareable domain for which the value of 
HTTBR.CnP is 1. 


Qbd The translation table entries pointed to by HTTBR are permitted to differ from 
corresponding entries for HTTBR for other PEs in the Inner Shareable domain. This is 
not affected by the value of HTTBR.CnP on those other PEs. 
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Qb1 The translation table entries pointed to by HTTBR are the same as the translation table 
entries pointed to by HTTBR on every other PE in the Inner Shareable domain for which 


the value of HTTBR.CnP is 1. 


Note 





If the value of the HTTBR.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and 
those HTTBRs do not point to the same translation table entries when the other conditions specified 
for the case when the value of CnP is 1 apply, then the results of translations are CONSTRAINED 
UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching of control or 


data values on page K1-7611. 





This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Accessing the HTTBR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HTTBR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HTTBR; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HTTBR = R[t2]:R[t]; 
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elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HTTBR = R[t2]:R[t]; 
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G8.2.78 


G8-6116 


HVBAR, Hyp Vector Base Address Register 


The HVBAR characteristics are: 


Purpose 
Holds the vector base address for any exception that is taken to Hyp mode. 
Configurations 
AArch32 System register HVBAR[31:0] is architecturally mapped to AArch64 System register 
VBAR_EL2[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


HVBAR is a 32-bit register. 


Field descriptions 


The HVBAR bit assignments are: 


31 


5 4 0 


Vector Base Address RESO 


Bits [31:5] 


Bits [4:0] 


Vector Base Address. Bits[31:5] of the base address of the exception vectors for exceptions taken to 
this Exception level. Bits[4:0] of an exception vector are the exception offset. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Accessing the HVBAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b100 = 0b1100 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return HVBAR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
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else 
return HVBAR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn 


CRm 


opc2 





Ob1111 0b100 0b1100 


0b0000 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
HVBAR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HVBAR = R[t]; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


G8-6117 


AArch32 System Register Descriptions 
G8.2 General system control registers 


G8.2.79 


G8-6118 


ICIALLU, Instruction Cache Invalidate All to PoU 


The ICIALLU characteristics are: 


Purpose 
Invalidate all instruction caches to PoU. If branch predictors are architecturally visible, also flush 
branch predictors. 

Configurations 
AArch32 System instruction ICIALLU performs the same function as AArch64 System instruction 
IC IALLU. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ICIALLU is a 32-bit System instruction. 


Field descriptions 

ICIALLU ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 

Executing the ICIALLU instruction 


The PE ignores the value of <Rt>. Software does not have to write a value to this register before issuing this 
instruction. 


When HCR.FB is 1, at Non-secure EL1 this instruction executes as a ICIALLUIS. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 0b0101 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPU == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TOCU == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TPU == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TOCU == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.FB == '1' then 
ICIALLUIS(); 








else 
ICIALLU(); 
elsif PSTATE.EL == EL2 then 
ICIALLU(); 
elsif PSTATE.EL == EL3 then 
ICIALLU(); 
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G8.2.80 ICIALLUIS, Instruction Cache Invalidate All to PoU, Inner Shareable 


The ICIALLUIS characteristics are: 


Purpose 
Invalidate all instruction caches Inner Shareable to PoU. If branch predictors are architecturally 
visible, also flush branch predictors. 

Configurations 
AArch32 System instruction ICIALLUIS performs the same function as AArch64 System 
instruction IC [ALLUIS. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ICIALLUIS is a 32-bit System instruction. 


Field descriptions 

ICIALLUIS ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 

Executing the ICIALLUIS instruction 


The PE ignores the value of <Rt>. Software does not have to write a value to this register before issuing this 
instruction. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 0b0001 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPU == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TICAB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TOCU == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TPU == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TICAB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TOCU == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 











else 
ICIALLU() ; 
elsif PSTATE.EL == EL2 then 
ICIALLU(); 
elsif PSTATE.EL == EL3 then 
ICIALLU(); 
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G8.2.81 ICIMVAU, Instruction Cache line Invalidate by VA to PoU 
The ICIMVAU characteristics are: 


Purpose 
Invalidate instruction cache line by virtual address to PoU. 
Configurations 
AArch32 System instruction ICIMVAU performs the same function as AArch64 System instruction 
IC IVAU. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ICIMVAU is a 32-bit System instruction. 


Field descriptions 


The ICIMVAU input value bit assignments are: 


31 0 
Virtual address to use 
Bits [31:0] 


Virtual address to use. No alignment restrictions apply to this VA. 


Executing the ICIMVAU instruction 


Execution of this instruction might require an address translation from VA to PA, and that translation might fault. 
For more information, see AArch32 instruction cache maintenance instructions (IC*) on page G4-5698. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b0111 Ob0101 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TPU == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TOCU == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TPU == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TOCU == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
ICIMVAU(R[t]); 
elsif PSTATE.EL == EL2 then 
ICIMVAU(R[t]); 
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elsif PSTATE.EL == EL3 then 
ICIMVAU(R[t]); 
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G8.2.82 


G8-6122 


ID_AFRO, Auxiliary Feature Register 0 


The ID_AFRO characteristics are: 


Purpose 
Provides information about the IMPLEMENTATION DEFINED features of the PE in AArch32 state. 
Must be interpreted with the Main ID Register, MIDR. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 


for fields in ID registers on page G8-5902. 


Configurations 


AArch32 System register ID_AFRO[31:0] is architecturally mapped to AArch64 System register 
ID_AFRO_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_AFRO is a 32-bit register. 


Field descriptions 


The ID_AFRO bit assignments are: 


31 1615 12 11 8 


7 4 3 0 


IMP DEF 
IMP DEF 
IMP DEF 
IMP DEF 


Bits [31:16] 
Reserved, RESO. 


IMPLEMENTATION DEFINED, bits [15:12] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [11:8] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED, bits [7:4] 
IMPLEMENTATION DEFINED. 

















IMPLEMENTATION DEFINED, bits [3:0] 
IMPLEMENTATION DEFINED. 


Accessing the ID_AFRO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000  0b0000 0b0001 Ob011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_AFRQ; 
elsif PSTATE.EL == EL2 then 
return ID_AFRQ; 
elsif PSTATE.EL == EL3 then 
return ID_AFRQ; 
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G8.2.83 ID_DFRO, Debug Feature Register 0 
The ID_DFRO characteristics are: 


Purpose 
Provides top level information about the debug system in AArch32 state. 
Must be interpreted with the Main ID Register, MIDR. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 
Configurations 


AArch32 System register ID_DFRO[31:0] is architecturally mapped to AArch64 System register 
ID_DFRO_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_DFRO is a 32-bit register. 


Field descriptions 


The ID_DFRO bit assignments are: 


28 27 24 23 20 19 1615 12 11 


TraceFilt MProfDbg | MMapTrc MMapDbg | CopSDbg | CopDbg 


TraceFilt, bits [31:28] 
Armv8.4 Self-hosted Trace Extension version. Defined values are: 
0b0000 Armv8.4 Self-hosted Trace Extension not implemented. 
0b0001 Armv8.4 Self-hosted Trace Extension implemented. 
All other values are reserved. 
ARMv8.4-Trace implements the functionality added by the value 0b0001. 
From Armv8.3, the permitted values are 0b0000 and 0b0001. 


PerfMon, bits [27:24] 
Performance Monitors Extension version. 


This field does not follow the standard ID scheme, but uses the alternative ID scheme described in 
Alternative ID scheme used for the Performance Monitors Extension version on page G8-5904. 


Defined values are: 


0b0000 Performance Monitors Extension not implemented. 

0b0001 Performance Monitors Extension version 1 implemented, PMUv1. 
0b0010 Performance Monitors Extension version 2 implemented, PMUv2. 
Qb0011 Performance Monitors Extension version 3 implemented, PMUv3. 


0b0100 PMUVv3 for Armv8.1. As @b0011, and also includes support for: 

8 Extended 16-bit PMEVTYPER<n>.evtCount field. 

a If EL2 is implemented, the HDCR.HPMD control bit. 
0b0101 PMUVv3 for Armv8.4. As 0b0100 and also includes support for the PMMIR register. 
0b0110 PMUV3 for Armv8.5. As 0b0101 and also includes support for: 


. 64-bit event counters. 
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7 If EL2 is implemented, the HDCR.HCCD control bit. 
g If EL3 is implemented, the SDCR.SCCD control bit. 


0b1111 IMPLEMENTATION DEFINED form of performance monitors supported, PMUv3 not 
supported. Arm does not recommend this value in new implementations. 


ARMv8.1-PMU implements the functionality added by the value 0b0100. 
ARMv8.4-PMU implements the functionality added by the value 0b0101. 
ARMv8.5-PMU implements the functionality added by the value 0b0110. 

All other values are reserved. 

In any Armv8 implementation, the values 0b0001 and 0b0010 are not permitted. 
From Armv8.1, the value 0b0011 is not permitted. 

From Armv8.4, the value 0b0100 is not permitted. 

From Armvs.5, the value 0b0101 is not permitted. 


— Note 


In Armv7, the value 0b0000 can mean that PMUv1 is implemented. PMUV1 is not permitted in an 
Armv8 implementation. 





MProfDbg, bits [23:20] 


M Profile Debug. Support for memory-mapped debug model for M profile processors. Defined 
values are: 


0b0000 Not supported. 
0b0001 Support for M profile Debug architecture, with memory-mapped access. 
All other values are reserved. 


In Armv8-A, the only permitted value is 0b0000. 


MMapTre, bits [19:16] 
Memory Mapped Trace. Support for memory-mapped trace model. Defined values are: 
0b0000 Not supported. 
0b0001 Support for Arm trace architecture, with memory-mapped access. 
All other values are reserved. 
In Armv8-A, the permitted values are 0b0000 and 0b0001. 


See the ETM Architecture Specification for more information. 


CopTre, bits [15:12] 


Support for System registers-based trace model, using registers in the coproc == 0b1110 encoding 
space. Defined values are: 


0b0000 Not supported. 

0b0001 Support for Arm trace architecture, with System registers access. 
All other values are reserved. 

In Armv8-A, the permitted values are 0b0000 and 0b0001. 


See the ETM Architecture Specification for more information. 


MMapDbg, bits [11:8] 


Memory Mapped Debug. Support for v7 memory-mapped debug model, for A and R profile 
processors. 


In Armv8s-A, this field is RESO. 
The optional memory map defined by Armv8 is not compatible with Armv7. 
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CopSDbg, bits [7:4] 


Support for a System registers-based Secure debug model, using registers in the coproc = 0b1110 


encoding space, for an A profile processor that includes EL3. 


If EL3 is not implemented and the implemented Security state is Non-secure state, this field is RESO. 


Otherwise, this field reads the same as bits [3:0]. 


CopDbg, bits [3:0] 


Support for System registers-based debug model, using registers in the coproc == 0b1110 encoding 


space, for A and R profile processors. Defined values are: 

0b0000 Not supported. 

0b0010 Support for Armv6, v6 Debug architecture, with System registers access. 
0b0011 Support for Armv6, v6.1 Debug architecture, with System registers access. 
0b0100 Support for Armv7, v7 Debug architecture, with System registers access. 
0b0101 Support for Armv7, v7.1 Debug architecture, with System registers access. 
0b0110 Support for Armv8 debug architecture, with System registers access. 


Qb0111 Support for Armv8 debug architecture, with System registers access, and Virtualization 


Host extensions. 
0b1000 Support for Armv8.2 debug architecture. 
0b1001 Support for Armv8.4 debug architecture. 


All other values are reserved. 


In any Armv8 implementation, the values 0b0000, 0b0010, b0011, @b0100, and 0b0101 are not 


permitted. 
If ARMv8.1-VHE is not implemented, the only permitted value is 0b0110. 


In an Armv8.0 implementation, the value 0b1000 is not permitted. 


Accessing the ID_DFRO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 














coproc opct CRn CRm opc2 
0b1111 0b000 0b0000 0b0001 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_DFRQ; 
elsif PSTATE.EL == EL2 then 
return ID_DFRQ; 
elsif PSTATE.EL == EL3 then 
return ID_DFRQ; 
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G8.2.84 ID_ISARO, Instruction Set Attribute Register 0 


ARM DDI 0487E.a 
ID070919 


The ID_ISARO characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 
Must be interpreted with ID ISAR1, ID_ISAR2, ID_ISAR3, ID_ISAR4, and ID_ISARS. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 
Configurations 


AArch32 System register ID_ISARO[31:0] is architecturally mapped to AArch64 System register 
ID_ISARO_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_ISAR0O is a 32-bit register. 


Field descriptions 


The ID_ISARO bit assignments are: 


28 27 24 23 20 19 1615 12 11 





Bits [31:28] 


Reserved, RESO. 


Divide, bits [27:24] 
Indicates the implemented Divide instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds SDIV and UDIV in the T32 instruction set. 
0b0010 As for 0b0001, and adds SDTV and UDIV in the A32 instruction set. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


Debug, bits [23:20] 
Indicates the implemented Debug instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds BKPT. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Coproc, bits [19:16] 
Indicates the implemented System register access instructions. Defined values are: 


0b0000 None implemented, except for instructions separately attributed by the architecture to 
provide access to AArch32 System registers and System instructions. 


0b0001 Adds generic CDP, LDC, MCR, MRC, and STC. 
0b0010 As for 0b0001, and adds generic CDP2, LDC2, MCR2, MRC2, and STC2. 
Qb0011 As for 0b0010, and adds generic MCRR and MRRC. 
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0b0100 As for 0b0011, and adds generic MCRR2 and MRRC2. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


CmpBranch, bits [15:12] 


Indicates the implemented combined Compare and Branch instructions in the T32 instruction set. 


Defined values are: 

0b0000 None implemented. 
0b0001 Adds CBNZ and CBZ. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


BitField, bits [11:8] 
Indicates the implemented BitField instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds BFC, BFI, SBFX, and UBFX. 
All other values are reserved. 
In Armv8-A the only permitted value is 0b0001. 
BitCount, bits [7:4] 
Indicates the implemented Bit Counting instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds CLZ. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Swap, bits [3:0] 


Indicates the implemented Swap instructions in the A32 instruction set. Defined values are: 


0b0000 None implemented. 
Qb0001 Adds SWP and SWPB. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


Accessing the ID_ISARO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
Ob1111 0b000 0b0000 O0b0010 Ob000 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_ISARQ; 
elsif PSTATE.EL == EL2 then 
return ID_ISARQ; 
elsif PSTATE.EL == EL3 then 
return ID_ISARQ; 
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G8-6130 


ID_ISAR1, Instruction Set Attribute Register 1 


The ID_ISAR1 characteristics are: 


Purpose 


Configu 


Provides information about the instruction sets implemented by the PE in AArch32 state. 
Must be interpreted with ID ISARO, ID_ISAR2, ID _ISAR3, ID_ISAR4, and ID_ISARS. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 
rations 


AArch32 System register ID_ISAR1[31:0] is architecturally mapped to AArch64 System register 
ID_ISAR1_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


ID_ISAR1 is a 32-bit register. 


Field descriptions 


The ID_ISAR1 bit assignments are: 


28 27 24 23 20 19 1615 12 11 


Jazelle, bits [31:28] 


Indicates the implemented Jazelle extension instructions. Defined values are: 
0b0000 No support for Jazelle. 


0b0001 Adds the BXJ instruction, and the J bit in the PSR. This setting might indicate a trivial 
implementation of the Jazelle extension. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Interwork, bits [27:24] 


Indicates the implemented Interworking instructions. Defined values are: 

0b0000 None implemented. 

0b0001 Adds the BX instruction, and the T bit in the PSR. 

0b0010 As for 0b0001, and adds the BLX instruction. PC loads have BX-like behavior. 


Qb0011 As for 0b0010, and guarantees that data-processing instructions in the A32 instruction 
set with the PC as the destination and the S bit clear have BX-like behavior. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0011. 


Immediate, bits [23:20] 


Indicates the implemented data-processing instructions with long immediates. Defined values are: 
0b0000 None implemented. 
0b0001 Adds: 

° The MOVT instruction 


a The MOV instruction encodings with zero-extended 16-bit immediates. 
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. The T32 ADD and SUB instruction encodings with zero-extended 12-bit 
immediates, and the other ADD, ADR, and SUB encodings cross-referenced by 
the pseudocode for those encodings. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


IfThen, bits [19:16] 
Indicates the implemented If-Then instructions in the T32 instruction set. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the IT instructions, and the IT bits in the PSRs. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Extend, bits [15:12] 
Indicates the implemented Extend instructions. Defined values are: 


0b0000 No scalar sign-extend or zero-extend instructions are implemented, where scalar 
instructions means non-Advanced SIMD instructions. 


0b0001 Adds the SXTB, SXTH, UXTB, and UXTH instructions. 


0b0010 As for 0b0001, and adds the SXTB16, SXTAB, SXTAB16, SXTAH, UXTB16, UXTAB, 
UXTABI6, and UXTAH instructions. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


Except_AR, bits [11:8] 
Indicates the implemented A and R profile exception-handling instructions. Defined values are: 
0b0000 None implemented. 


0b0001 Adds the SRS and RFE instructions, and the A and R profile forms of the CPS 
instruction. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Except, bits [7:4] 


Indicates the implemented exception-handling instructions in the A32 instruction set. Defined 
values are: 


0b0000 Not implemented. This indicates that the User bank and Exception return forms of the 
LDM and STM instructions are not implemented. 


0b0001 Adds the LDM (exception return), LDM (user registers), and STM (user registers) 
instruction versions. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Endian, bits [3:0] 
Indicates the implemented Endian instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the SETEND instruction, and the E bit in the PSRs. 
All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b0001. 
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G8-6132 


Accessing the ID_ISAR1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b0000 0b0010 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_ISAR1; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR1; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR1; 
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G8.2.86 ID_ISAR2, Instruction Set Attribute Register 2 
The ID_ISAR2 characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 
Must be interpreted with ID ISARO, ID_ISAR1, ID_ISAR3, ID_ISAR4, and ID_ISARS. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 
Configurations 


AArch32 System register ID_ISAR2[31:0] is architecturally mapped to AArch64 System register 
ID_ISAR2_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_ISAR2 is a 32-bit register. 


Field descriptions 


The ID_ISAR2 bit assignments are: 


28 27 24 23 20 19 1615 12 11 


a a O MultiAccesslnt 


Reversal, bits [31:28] 
Indicates the implemented Reversal instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the REV, REV16, and REVSH instructions. 
0b0010 As for 0b0001, and adds the RBIT instruction. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


PSR_AR, bits [27:24] 
Indicates the implemented A and R profile instructions to manipulate the PSR. Defined values are: 
0b0000 None implemented. 


0b0001 Adds the MRS and MSR instructions, and the exception return forms of data-processing 
instructions. 


All other values are reserved. 
In Armv8-A the only permitted value is 0b0001. 
The exception return forms of the data-processing instructions are: 


è In the A32 instruction set, data-processing instructions with the PC as the destination and the 
S bit set. These instructions might be affected by the WithShifts attribute. 


. In the T32 instruction set, the SUBS PC,LR,#N instruction. 
MultU, bits [23:20] 
Indicates the implemented advanced unsigned Multiply instructions. Defined values are: 


0b0000 None implemented. 
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Qb0001 Adds the UMULL and UMLAL instructions. 
Qb0010 As for 0b0001, and adds the UMAAL instruction. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


MultS, bits [19:16] 


Indicates the implemented advanced signed Multiply instructions. Defined values are: 
0b0000 None implemented. 

0b0001 Adds the SMULL and SMLAL instructions. 

0b0010 As for 0b0001, and adds the SMLABB, SMLABT, SMLALBB, SMLALBT, 


SMLALTB, SMLALTT, SMLATB, SMLATT, SMLAWB, SMLAWT, SMULBB, 
SMULBT, SMULTB, SMULTT, SMULWB, and SMULWT instructions. Also adds the 


Q bit in the PSRs. 


0b0011 As for 0b0010, and adds the SMLAD, SMLADX, SMLALD, SMLALDX, SMLSD, 
SMLSDX, SMLSLD, SMLSLDX, SMMLA, SMMLAR, SMMLS, SMMLSR, 
SMMUL, SMMULR, SMUAD, SMUADX, SMUSD, and SMUSDX instructions. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0011. 


Mult, bits [15:12] 


Indicates the implemented additional Multiply instructions. Defined values are: 


0b0000 No additional instructions implemented. This means only MUL is implemented. 


Qb0001 Adds the MLA instruction. 
0b0010 As for 0b0001, and adds the MLS instruction. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


MultiAccessInt, bits [11:8] 


Indicates the support for interruptible multi-access instructions. Defined values are: 


0b0000 No support. This means the LDM and STM instructions are not interruptible. 


Qb0001 LDM and STM instructions are restartable. 
Qb0010 LDM and STM instructions are continuable. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


MemHint, bits [7:4] 


Indicates the implemented Memory Hint instructions. Defined values are: 
0b0000 None implemented. 

0b0001 Adds the PLD instruction. 

0b0010 Adds the PLD instruction. (0b0001 and @b0010 have identical effects.) 
0b0011 As for 060001 (or 0b0010), and adds the PLI instruction. 

0b0100 As for 0b0011, and adds the PLDW instruction. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0100. 


LoadStore, bits [3:0] 
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0b0010 As for 0b0001, and adds the Load Acquire (LDAB, LDAH, LDA, LDAEXB, LDAEXH, 
LDAEX, LDAEXD) and Store Release (STLB, STLH, STL, STLEXB, STLEXH, 


STLEX, STLEXD) instructions. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


Accessing the ID_ISAR2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_ISAR2; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR2; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR2; 


coproc opct CRn CRm opc2 
Ob1111 0b000 0b0000 0b0010 O0b010 
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G8.2.87 ID_ISAR3, Instruction Set Attribute Register 3 
The ID_ISAR3 characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 
Must be interpreted with ID ISARO, ID_ISAR1, ID ISAR2, ID _ISAR4, and ID_ISARS. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 
Configurations 


AArch32 System register ID_ISAR3[31:0] is architecturally mapped to AArch64 System register 
ID_ISAR3_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_ISAR3 is a 32-bit register. 


Field descriptions 


The ID_ISAR3 bit assignments are: 


28 27 24 23 20 19 16 15 12 11 


T32EE TrueNOP | T32Copy | TabBranch a j SIMD 


T32EE, bits [31:28] 
Indicates the implemented T32FE instructions. Defined values are: 
0b0000 None implemented. 


0b0001 Adds the ENTERX and LEAVEX instructions, and modifies the load behavior to 
include null checking. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


TrueNOP, bits [27:24] 
Indicates the implemented true NOP instructions. Defined values are: 


0b0000 None implemented. This means there are no NOP instructions that do not have any 
register dependencies. 


0b0001 Adds true NOP instructions in both the T32 and A32 instruction sets. This also permits 
additional NOP-compatible hints. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


T32Copy, bits [23:20] 
Indicates the support for T32 non flag-setting MOV instructions. Defined values are: 


0b0000 Not supported. This means that in the T32 instruction set, encoding T1 of the MOV 
(register) instruction does not support a copy from a low register to a low register. 


0b0001 Adds support for T32 instruction set encoding T1 of the MOV (register) instruction, 
copying from a low register to a low register. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 
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TabBranch, bits [19:16] 


Indicates the implemented Table Branch instructions in the T32 instruction set. Defined values are: 
0b0000 None implemented. 

0b0001 Adds the TBB and TBH instructions. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


SynchPrim, bits [15:12] 


Used in conjunction with ID_ISAR4.SynchPrim_frac to indicate the implemented Synchronization 
Primitive instructions. Defined values are: 


0b0000 If SynchPrim_frac == @b000, no Synchronization Primitives implemented. 


0b0001 If SynchPrim_frac == 0b000, adds the LDREX and STREX instructions. 


IfSynchPrim_ frac == 0b011, also adds the CLREX, LDREXB, STREXB, and STREXH 
instructions. 


0b0010 If SynchPrim_frac == 0b000, as for [0b001, 0b011] and also adds the LDREXD and 
STREXD instructions. 


All other combinations of SynchPrim and SynchPrim_frac are reserved. 


In Armv8-A the only permitted value is 0b0010. 


SVC, bits [11:8] 


Indicates the implemented SVC instructions. Defined values are: 
0b0000 Not implemented. 

0b0001 Adds the SVC instruction. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


SIMD, bits [7:4] 


Indicates the implemented SIMD instructions. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the SSAT and USAT instructions, and the Q bit in the PSRs. 


0b0011 As for 0b0001, and adds the PKHBT, PKHTB, QADD16, QADD8, QASX, QSUB16, 
QSUB8, QSAX, SADD16, SADD8, SASX, SEL, SHADD16, SHADD8, SHASX, 
SHSUB16, SHSUB8, SHSAX, SSAT16, SSUB16, SSUB8, SSAX, SXTAB16, 
SXTB16, UADD16, UADD8, UASX, UHADD16, UHADD8, UHASX, UHSUB16, 
UHSUB8, UHSAX, UQADD16, UQADD8, UQASX, UQSUB16, UQSUB8, UQSAX, 
USAD8, USADA8, USAT16, USUB16, USUB8, USAX, UXTAB16, and UXTB16 
instructions. Also adds support for the GE[3:0] bits in the PSRs. 


All other values are reserved. 
In Armv8-A the only permitted value is 0b0011. 


The SIMD field relates only to implemented instructions that perform SIMD operations on the 
general-purpose registers. In an implementation that supports floating-point and Advanced SIMD 
instructions, MVFRO, MVFR1, and MVFR2 give information about the implemented Advanced 
SIMD instructions. 


Saturate, bits [3:0] 


Indicates the implemented Saturate instructions. Defined values are: 


0b0000 None implemented. This means no non-Advanced SIMD saturate instructions are 
implemented. 


0b0001 Adds the QADD, QDADD, QDSUB, and QSUB instructions, and the Q bit in the PSRs. 


All other values are reserved. 
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G8-6138 


In Armv8-A the only permitted value is 0b0001. 


Accessing the ID_ISAR3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b0000 0b0010 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_ISAR3; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR3; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR3; 
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G8.2.88 ID_ISAR4, Instruction Set Attribute Register 4 
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The ID_ISAR4 characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 
Must be interpreted with ID ISARO, ID_ISAR1, ID_ISAR2, ID _ISAR3, and ID_ISARS. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 
Configurations 
AArch32 System register ID_ISAR4[31:0] is architecturally mapped to AArch64 System register 
ID_ISAR4 EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ID_ISAR4 is a 32-bit register. 


Field descriptions 


The ID_ISAR4 bit assignments are: 


28 27 24 23 20 19 1615 12 11 





SynchPrim_frac — 


SWP frac, bits [31:28] 


Indicates support for the memory system locking the bus for SWP or SWPB instructions. Defined 
values are: 


0b0000 SWP or SWPB instructions not implemented. 


0b0001 SWP or SWPB implemented but only in a uniprocessor context. SWP and SWPB do not 
guarantee whether memory accesses from other masters can come between the load 
memory access and the store memory access of the SWP or SWPB. 


All other values are reserved. This field is valid only if the ID ISARO.Swap_instrs field is 0b0000. 
In Armv8-A the only permitted value is 0b0000. 


PSR_M, bits [27:24] 
Indicates the implemented M profile instructions to modify the PSRs. Defined values are: 
0b0000 None implemented. 
0b0001 Adds the M profile forms of the CPS, MRS, and MSR instructions. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


SynchPrim_frac, bits [23:20] 


Used in conjunction with ID_ISAR3.SynchPrim to indicate the implemented Synchronization 
Primitive instructions. Possible values are: 


0b0000 If SynchPrim == @b000, no Synchronization Primitives implemented. If SynchPrim == 
0b0001, adds the LDREX and STREX instructions. If SynchPrim == 0b0010, also adds 
the CLREX, LDREXB, LDREXH, STREXB, STREXH, LDREXD, and STREXD 
instructions. 
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0b0011 If SynchPrim == 0b0001, adds the LDREX, STREX, CLREX, LDREXB, LDREXH, 
STREXB, and STREXH instructions. 


All other combinations of SynchPrim and SynchPrim_frac are reserved. 


In Armv8-A the only permitted value is 0b0000. 


Barrier, bits [19:16] 


Indicates the implemented Barrier instructions in the A32 and T32 instruction sets. Defined values 
are: 


0b0000 None implemented. Barrier operations are provided only as System instructions in the 
(coproc==0b1111) encoding space. 


0b0001 Adds the DMB, DSB, and ISB barrier instructions. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


SMC, bits [15:12] 


Indicates the implemented SMC instructions. Defined values are: 
0b0000 None implemented. 

0b0001 Adds the SMC instruction. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Writeback, bits [11:8] 


Indicates the support for Writeback addressing modes. Defined values are: 


0b0000 Basic support. Only the LDM, STM, PUSH, POP, SRS, and RFE instructions support 
writeback addressing modes. These instructions support all of their writeback 
addressing modes. 


0b0001 Adds support for all of the writeback addressing modes. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


WithShifts, bits [7:4] 


Indicates the support for instructions with shifts. Defined values are: 
0b0000 Nonzero shifts supported only in MOV and shift instructions. 
0b0001 Adds support for shifts of loads and stores over the range LSL 0-3. 


0b0011 As for 0b0001, and adds support for other constant shift options, both on load/store and 
other instructions. 


0b0100 As for @b0011, and adds support for register-controlled shift options. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0100. 


Unpriv, bits [3:0] 


Indicates the implemented unprivileged instructions. Defined values are: 

0b0000 None implemented. No T variant instructions are implemented. 

0b0001 Adds the LDRBT, LDRT, STRBT, and STRT instructions. 

0b0010 As for 0b0001, and adds the LDRHT, LDRSBT, LDRSHT, and STRHT instructions. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 
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Accessing the ID_ISAR4 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 0b0000 0b0010 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_ISAR4; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR4; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR4; 
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ID_ISARS, Instruction Set Attribute Register 5 


The ID_ISARS5 characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 
Must be interpreted with ID ISARO, ID_ISAR1, ID_ISAR2, ID_ISAR3, and ID_ISAR4. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 
Configurations 
AArch32 System register ID_ISAR5[31:0] is architecturally mapped to AArch64 System register 
ID_ISARS_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ID_ISARS is a 32-bit register. 


Field descriptions 


The ID_ISARS bit assignments are: 


24 23 20 19 1615 12 11 


VCMA | rom | RESO CRC32 SHA2 SHA1 Ta | SEVL 


VCMA, bits [31:28] 


From ARMV8.3: 


Indicates AArch32 support for complex number addition and multiplication where numbers are 
stored in vectors. Defined values are: 


0b0000 The VCMLA and VCADD instructions are not implemented in AArch32. 
0b0001 The VCMLA and VCADD instructions are implemented in AArch32. 
All other values are reserved. 

In Armv8.0, Armv8.1 and Armv8.2 the only permitted value is 0b0000. 


From Armv8.3 the only permitted value is @b0001. This feature is identified as 
ARMv8.3-CompNum. 


Otherwise: 


Reserved, RESO. 


RDM, bits [27:24] 


From ARMVv8.1: 


Indicates whether the VQRDMLAH and VQRDMLSH instructions are implemented in AArch32 
state. Defined values are: 


0b0000 No VQRDMLAH and VQRDMLSAH instructions implemented. 
0b0001 VQRDMLAH and VQRDMLSH instructions implemented. 

All other values are reserved. 

ARMv8.1-RDMA implements the functionality identified by the value 0b0001. 
From Armv8.1 the only permitted value is 0b0001. 


Otherwise: 


Reserved, RESO. 
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Bits [23:20] 


Reserved, RESO. 


CRC32, bits [19:16] 
Indicates whether the CRC32 instructions are implemented in AArch32 state. 
0b0000 No CRC32 instructions implemented. 


0b0001 CRC32B, CRC32H, CRC32W, CRC32CB, CRC32CH, and CRC32CW instructions 
implemented. 


All other values are reserved. 
In Armv8.0 the permitted values are 0b0000 and 0b0001. 
From Armv8.1 the only permitted value is 0b0001. 


SHA2, bits [15:12] 
Indicates whether the SHA2 instructions are implemented in AArch32 state. 
0b0000 No SHA2 instructions implemented. 
0b0001 SHA256H, SHA256H2, SHA256SU0, and SHA256SU1 implemented. 
All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b0001. 


SHA1, bits [11:8] 
Indicates whether the SHA1 instructions are implemented in AArch32 state. 
0b0000 No SHA1 instructions implemented. 
0b0001 SHAIC, SHA1P, SHA1M, SHA1H, SHA1SU0, and SHA1SU1 implemented. 
All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b0001. 


AES, bits [7:4] 
Indicates whether the AES instructions are implemented in AArch32 state. 
0b0000 No AES instructions implemented. 
0b0001 AESE, AESD, AESMC, and AESIMC implemented. 


0b0010 As for 0b0001, plus VMULL (polynomial) instructions operating on 64-bit data 
quantities. 


All other values are reserved. 
In Armv8-A the permitted values are 0b0000 and 0b0010. 
SEVL, bits [3:0] 
Indicates whether the SEVL instruction is implemented in AArch372 state. 
0b0000 SEVL is implemented as a NOP. 
0b0001 SEVL is implemented as Send Event Local. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Accessing the ID_ISAR5 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








coproc opct CRn CRm opc2 
0b1111 0b000 0b0000 0b0010 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_ISARS; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR5; 
elsif PSTATE.EL == EL3 then 
return ID_ISARS; 
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G8.2.90 ID_ISAR6, Instruction Set Attribute Register 6 
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The ID_ISAR6 characteristics are: 


Purpose 
Provides information about the instruction sets implemented by the PE in AArch32 state. 
Must be interpreted with ID ISARO, ID_ISARI, ID_ISAR2, ID ISAR3, ID_ISAR4 and 
ID_ISARS. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 

Configurations 
AArch32 System register ID_ISAR6[31:0] is architecturally mapped to AArch64 System register 
ID_ISAR6_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ID_ISAR6 is a 32-bit register. 


Field descriptions 


The ID_ISAR6 bit assignments are: 


31 20 19 16 15 12 11 8 


7 4 3 0 


Bits [31:20] 
Reserved, RESO. 


SPECRES, bits [19:16] 
Speculation invalidation instruction support in AArch32 state. Defined values are: 


0b0000 CFPRCTX, DVPRCTX, and CPPRCTX instructions are not implemented. 
0b0001 CFPRCTX, DVPRCTX, and CPPRCTX instructions are implemented. 
All other values are reserved. 


From Armvs.5, the only permitted value is 0b0001. 


SB, bits [15:12] 
SB instruction support in AArch32 state. Defined values are: 
0b0000 SB instruction is not implemented. 
0b0001 SB instruction is implemented. 
All other values are reserved. 


From Armvs.5, the only permitted value is 0b0001. 


FHM, bits [11:8] 
From ARMvé8.2: 
Indicates whether VFMAL and VFMSL instructions are implemented. 
0b0000 VFMAL and VMEFSL instructions not implemented. 
0b0001 VFMAL and VMESL instructions implemented. 
ARMv8.2-FHM implements the functionality identified by the value 0b0001. 
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Otherwise: 


Reserved, RESO. 


DP, bits [7:4] 
From ARMvé8.2: 
Indicates the support for dot product instructions in AArch32 state. 
0b0000 No dot product instructions implemented. 
0b0001 VUDOT and VSDOT instructions implemented. 
All other values are reserved. 
ARMv8.2-DotProd implements the functionality identified by the value 0b0001. 
Otherwise: 


Reserved, RESO. 


JSCVT, bits [3:0] 
From ARMV8.3: 


Indicates whether the Javascript conversion instruction is implemented in AArch32 state. Defined 


values are: 

0b0000 The VJCVT instruction is not implemented. 
0b0001 The VJCVT instruction is implemented. 
All other values are reserved. 


In Armv8.0, Armv8.1 and Armv8.2 the only permitted value is 0b0000. 


From Armv8.3 the only permitted value is 0b0001. This feature is identified as ARMv8.3-JSConv. 


Otherwise: 


Reserved, RESO. 


Accessing the ID_ISAR6 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b0000 0b0010 


0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_ISAR6; 
elsif PSTATE.EL == EL2 then 
return ID_ISAR6; 
elsif PSTATE.EL == EL3 then 
return ID_ISAR6; 
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G8.2.91 ID_MMFRO, Memory Model Feature Register 0 


The ID_MMFRO characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch32 state. 


Must be interpreted with ID MMFR1, ID MMFR2, ID MMEFR3, and ID MMFR4. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 


for fields in ID registers on page G8-5902. 


Configurations 


Attributes 


AArch32 System register ID MMFRO[31:0] is architecturally mapped to AArch64 System register 
ID_MMFRO EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


ID_MMER0O is a 32-bit register. 


Field descriptions 


The ID_MMFRO bit assignments are: 


24 23 20 19 1615 12 11 


rose Sk ShareLvi | outerse | pasa | VMSA 


InnerShr, bits [31:28] 


Innermost Shareability. Indicates the innermost shareability domain implemented. Defined values 
are: 


0b0000 Implemented as Non-cacheable. 

0b0001 Implemented with hardware coherency support. 
Qb1111 Shareability ignored. 

All other values are reserved. 

From Armv8 the permitted values are 0b0000, 0b0001, and 0b1111. 


This field is valid only if the implementation supports two levels of shareability, as indicated by 
ID_MMFRO.ShareLvl having the value 0b0001. 


When ID_MMFRO.ShareLv1 is zero, this field is UNK. 


FCSE, bits [27:24] 


Indicates whether the implementation includes the FCSE. Defined values are: 
0b0000 Not supported. 

0b0001 Support for FCSE. 

All other values are reserved. 


From Armv8 the only permitted value is 0b0000. 


AuxReg, bits [23:20] 


ARM DDI 0487E.a 
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Auxiliary Registers. Indicates support for Auxiliary registers. Defined values are: 
0b0000 None supported. 
0b0001 Support for Auxiliary Control Register only. 
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0b0010 Support for Auxiliary Fault Status Registers (AIFSR and ADFSR) and Auxiliary 
Control Register. 


All other values are reserved. 
From Armv8 the only permitted value is 0b0010. 
Note 


Accesses to unimplemented Auxiliary registers are UNDEFINED. 








TCM, bits [19:16] 
Indicates support for TCMs and associated DMAs. Defined values are: 
0b0000 Not supported. 
0b0001 Support is IMPLEMENTATION DEFINED. Armv7 requires this setting. 
0b0010 Support for TCM only, Armv6 implementation. 
0b0011 Support for TCM and DMA, Armv6 implementation. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


ShareLvl, bits [15:12] 
Shareability Levels. Indicates the number of shareability levels implemented. Defined values are: 
0b0000 One level of shareability implemented. 
0b0001 Two levels of shareability implemented. 
All other values are reserved. 


From Armvé8 the only permitted value is 0b0001. 


OuterShr, bits [11:8] 


Outermost Shareability. Indicates the outermost shareability domain implemented. Defined values 
are: 


0b0000 Implemented as Non-cacheable. 

0b0001 Implemented with hardware coherency support. 
0b1111 Shareability ignored. 

All other values are reserved. 


From Armv§8 the permitted values are 0b0000, @b0001, and 0b1111. 


PMSA, bits [7:4] 
Indicates support for a PMSA. Defined values are: 
0b0000 Not supported. 
0b0001 Support for IMPLEMENTATION DEFINED PMSA. 
0b0010 Support for PMSAv6, with a Cache Type Register implemented. 
0b0011 Support for PMSAv7, with support for memory subsections. Armv7-R profile. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


VMSA, bits [3:0] 
Indicates support fora VMSA. Defined values are: 
0b0000 Not supported. 
0b0001 Support for IMPLEMENTATION DEFINED VMSA. 
0b0010 Support for VMSAv6, with Cache and TLB Type Registers implemented. 
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Qb0011 Support for VMSAv7, with support for remapping and the Access flag. ARMv7-A 


profile. 


0b0100 As for @b0011, and adds support for the PXN bit in the Short-descriptor translation table 


format descriptors. 


0b0101 As for @b0100, and adds support for the Long-descriptor translation table format. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0101. 


Accessing the ID_MMFRO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





0b1111 0b000 0b0000 0b0001 


0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_MMFRQ; 
elsif PSTATE.EL == EL2 then 
return ID_MMFRO; 
elsif PSTATE.EL == EL3 then 
return ID_MMFRO; 





Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


G8-6149 


AArch32 System Register Descriptions 
G8.2 General system control registers 


G8.2.92 ID_MMFR1, Memory Model Feature Register 1 


The ID MMERI characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch32 state. 


Must be interpreted with ID MMFRO, ID MMFR2, ID MMEFR3, and ID MMFR4. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 


Configurations 


AArch32 System register ID MMFR1[31:0] is architecturally mapped to AArch64 System register 
ID_MMEFRI EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


ID_MMER1 is a 32-bit register. 


Field descriptions 


The ID MMERI bit assignments are: 


28 27 24 23 


20 19 1615 12 11 


L1TstCin L1Hvd L1UniSW | L1HvdSW | L1UniVA | LiHvdVA 


BPred, bits [31:28] 


Branch Predictor. Indicates branch predictor management requirements. Defined values are: 


0b0000 
0b0001 


0b0010 


Qb0011 
0b0100 


No branch predictor, or no MMU present. Implies a fixed MPU configuration. 


Branch predictor requires flushing on: 


g Enabling or disabling a stage of address translation. 
7 Writing new data to instruction locations. 
. Writing new mappings to the translation tables. 


s Changes to the TTBRO, TTBR1, or TTBCR registers. 
. Changes to the ContextID or ASID, or to the FCSE ProcessID if this is supported. 


Branch predictor requires flushing on: 


s Enabling or disabling a stage of address translation. 
s Writing new data to instruction locations. 
. Writing new mappings to the translation tables. 


7 Any change to the TTBRO, TTBR1, or TTBCR registers without a change to the 
corresponding ContextID or ASID, or FCSE ProcessID if this is supported. 


Branch predictor requires flushing only on writing new data to instruction locations. 


For execution correctness, branch predictor requires no flushing at any time. 


All other values are reserved. 


In Armv8-A the permitted values are 0b0010, @b0011, or 0b0100. For values other than @b0000 and 
0b0100 the Arm Architecture Reference Manual, or the product documentation, might give more 
information about the required maintenance. 
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L1TstCln, bits [27:24] 


Level 1 cache Test and Clean. Indicates the supported Level 1 data cache test and clean operations, 
for Harvard or unified cache implementations. Defined values are: 


0b0000 None supported. 

0b0001 Supported Level 1 data cache test and clean operations are: 
° Test and clean data cache. 

0b0010 As for 0001, and adds: 
° Test, clean, and invalidate data cache. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 
L1Uni, bits [23:20] 


Level 1 Unified cache. Indicates the supported entire Level 1 cache maintenance operations for a 
unified cache implementation. Defined values are: 


0b0000 None supported. 


0b0001 Supported entire Level 1 cache operations are: 
e Invalidate cache, including branch predictor if appropriate. 
° Invalidate branch predictor, if appropriate. 


0b0010 As for 0001, and adds: 


. Clean cache, using a recursive model that uses the cache dirty status bit. 
° Clean and invalidate cache, using a recursive model that uses the cache dirty 
status bit. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 
L1Hvd, bits [19:16] 


Level 1 Harvard cache. Indicates the supported entire Level 1 cache maintenance operations for a 
Harvard cache implementation. Defined values are: 


0b0000 None supported. 


0b0001 Supported entire Level 1 cache operations are: 
° Invalidate instruction cache, including branch predictor if appropriate. 
° Invalidate branch predictor, if appropriate. 


0b0010 As for 0001, and adds: 


° Invalidate data cache. 
. Invalidate data cache and instruction cache, including branch predictor if 
appropriate. 


Qb0011 As for 0010, and adds: 


° Clean data cache, using a recursive model that uses the cache dirty status bit. 
° Clean and invalidate data cache, using a recursive model that uses the cache dirty 
status bit. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


L1UniSW, bits [15:12] 


Level 1 Unified cache by Set/Way. Indicates the supported Level 1 cache line maintenance 
operations by set/way, for a unified cache implementation. Defined values are: 


0b0000 None supported. 
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0b0001 Supported Level 1 unified cache line maintenance operations by set/way are: 
° Clean cache line by set/way. 

0b0010 As for 0001, and adds: 
° Clean and invalidate cache line by set/way. 

0b0011 As for 0010, and adds: 
° Invalidate cache line by set/way. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 
L1HvdSW, bits [11:8] 


Level 1 Harvard cache by Set/Way. Indicates the supported Level 1 cache line maintenance 
operations by set/way, for a Harvard cache implementation. Defined values are: 


0b0000 None supported. 


0b0001 Supported Level 1 Harvard cache line maintenance operations by set/way are: 
° Clean data cache line by set/way. 
° Clean and invalidate data cache line by set/way. 


0b0010 As for 0001, and adds: 

° Invalidate data cache line by set/way. 
0b0011 As for 0010, and adds: 

° Invalidate instruction cache line by set/way 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


L1UniVA, bits [7:4] 


Level 1 Unified cache by Virtual Address. Indicates the supported Level 1 cache line maintenance 
operations by VA, for a unified cache implementation. Defined values are: 


0b0000 None supported. 
0b0001 Supported Level 1 unified cache line maintenance operations by VA are: 
° Clean cache line by VA. 
° Invalidate cache line by VA. 
e Clean and invalidate cache line by VA. 
0b0010 As for 0001, and adds: 
° Invalidate branch predictor by VA, if branch predictor is implemented. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 
LiHvdVA, bits [3:0] 


Level 1 Harvard cache by Virtual Address. Indicates the supported Level 1 cache line maintenance 
operations by VA, for a Harvard cache implementation. Defined values are: 


0b0000 None supported. 
0b0001 Supported Level 1 Harvard cache line maintenance operations by VA are: 
° Clean data cache line by VA. 
° Invalidate data cache line by VA. 
° Clean and invalidate data cache line by VA. 
e Clean instruction cache line by VA. 
0b0010 As for 0001, and adds: 
° Invalidate branch predictor by VA, if branch predictor is implemented. 
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All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


Accessing the ID_MMFR1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b000 = 0b0000 0b0001 0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_MMFR1; 
elsif PSTATE.EL == EL2 then 
return ID_MMFR1; 
elsif PSTATE.EL == EL3 then 
return ID_MMFR1; 
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ID_MMFR2, Memory Model Feature Register 2 


The ID_ MMER2 characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch32 state. 


Must be interpreted with ID MMFRO, ID MMFR1, ID MMEFR3, and ID MMFR4. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 

Configurations 


AArch32 System register ID MMFR2[31:0] is architecturally mapped to AArch64 System register 
ID_MMFR2_ EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_MMER2 is a 32-bit register. 


Field descriptions 


The ID_ MMER2 bit assignments are: 


28 27 24 23 20 19 1615 12 11 


HWAccFlg | WFIStall UniTLB HvdTLB | L1HvdRng | L1HvdBG | L1HvdFG 


HWAccFlg, bits [31:28] 


Hardware Access Flag. In earlier versions of the Arm Architecture, this field indicates support for 
a Hardware Access flag, as part of the VMSAv7 implementation. Defined values are: 


0b0000 Not supported. 
0b0001 Support for VMSAv7 Access flag, updated in hardware. 
All other values are reserved. 


From Armvé8 the only permitted value is 0b000. 


WFEIStall, bits [27:24] 


Wait For Interrupt Stall. Indicates the support for Wait For Interrupt (WFI) stalling. Defined values 
are: 


0b0000 Not supported. 
0b0001 Support for WFI stalling. 
All other values are reserved. 


From Armv8 the permitted values are 0b000 and 0b001. 


MemBarr, bits [23:20] 


Memory Barrier. Indicates the supported memory barrier System instructions in the (coproc==1111) 
encoding space: 


0b0000 None supported. 

0b0001 Supported memory barrier System instructions are: 
‘ Data Synchronization Barrier (DSB). 

0b0010 As for 0b001, and adds: 


° Instruction Synchronization Barrier (ISB). 
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a Data Memory Barrier (DMB). 
All other values are reserved. 
From Army8 the only permitted value is 0b010. 
Arm deprecates the use of these operations. ID_ISAR4.Barrier_instrs indicates the level of support 
for the preferred barrier instructions. 
UniTLB, bits [19:16] 


Unified TLB. Indicates the supported TLB maintenance operations, for a unified TLB 
implementation. Defined values are: 


0b0000 Not supported. 
0b0001 Supported unified TLB maintenance operations are: 
a Invalidate all entries in the TLB. 
š Invalidate TLB entry by VA. 
0b0010 As for 0b001, and adds: 
s Invalidate TLB entries by ASID match. 
0b0011 As for 0b010, and adds: 


. Invalidate instruction TLB and data TLB entries by VA All ASID. This is a 
shared unified TLB operation 


0b0100 As for 0b011, and adds: 
s Invalidate Hyp mode unified TLB entry by VA. 
a Invalidate entire Non-secure PL1&0 unified TLB. 
s Invalidate entire Hyp mode unified TLB. 


0b0101 As for 0b100, and adds the following operations: TLBIMVALIS, TLBIMVAALIS, 
TLBIMVALHIS, TLBIMVAL, TLBIMVAAL,TLBIMVALH. 


0b0110 As for 0b101, and adds the following operations: TLBIIPAS2IS, TLBIIPAS2LIS, 
TLBIIPAS2, TLBIIPAS2L. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b110. 


HvdTLB, bits [15:12] 
If the Unified TLB field (UniTLB, bits [19:16]) is not 0000, then the meaning of this field is 
IMPLEMENTATION DEFINED. Arm deprecates the use of this field by software. 

L1HvdRng, bits [11:8] 


Level 1 Harvard cache Range. Indicates the supported Level 1 cache maintenance range operations, 
for a Harvard cache implementation. Defined values are: 


0b0000 Not supported. 
0b0001 Supported Level 1 Harvard cache maintenance range operations are: 
. Invalidate data cache range by VA. 
s Invalidate instruction cache range by VA. 
g Clean data cache range by VA. 
° Clean and invalidate data cache range by VA. 
All other values are reserved. 


From Armvé8 the only permitted value is 0b0000. 
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L1HvdBG, bits [7:4] 


Level 1 Harvard cache Background fetch. Indicates the supported Level 1 cache background fetch 
operations, for a Harvard cache implementation. When supported, background fetch operations are 


non-blocking operations. Defined values are: 

0b0000 Not supported. 

0b0001 Supported Level 1 Harvard cache background fetch operations are: 
e Fetch instruction cache range by VA. 
° Fetch data cache range by VA. 

All other values are reserved. 


From Armyv8 the only permitted value is 0b0000. 


L1HvdFG, bits [3:0] 


Level 1 Harvard cache Foreground fetch. Indicates the supported Level 1 cache foreground fetch 
operations, for a Harvard cache implementation. When supported, foreground fetch operations are 


blocking operations. Defined values are: 

0b0000 Not supported. 

0b0001 Supported Level 1 Harvard cache foreground fetch operations are: 
e Fetch instruction cache range by VA. 
° Fetch data cache range by VA. 

All other values are reserved. 


From Armyv8 the only permitted value is 0b0000. 


Accessing the ID_MMFR2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b0000 0b0001 


0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_MMFR2; 
elsif PSTATE.EL == EL2 then 
return ID_MMFR2; 
elsif PSTATE.EL == EL3 then 
return ID_MMFR2; 
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G8.2.94 ID_MMFR3, Memory Model Feature Register 3 


The ID_MMER3 characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch32 state. 


Must be interpreted with ID MMFRO, ID MMFR1, ID MMFR2, and ID MMFR4. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 


for fields in ID registers on page G8-5902. 


Configurations 


Attributes 


AArch32 System register ID MMFR3[31:0] is architecturally mapped to AArch64 System register 
ID_MMFR3_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


ID_MMER3 is a 32-bit register. 


Field descriptions 


The ID_MMER3 bit assignments are: 


24 23 20 19 1615 12 11 8 7 4 3 0 





Supersec, bits [31:28] 


Supersections. On a VMSA implementation, indicates whether Supersections are supported. 
Defined values are: 


0b0000 Supersections supported. 

0b1111 Supersections not supported. 

All other values are reserved. 

In Armv8-A the permitted values are 0b0000 and 0b1111. 


CMems&z, bits [27:24] 


Cached Memory Size. Indicates the physical memory size supported by the caches. Defined values 
are: 


0b0000 4GB, corresponding to a 32-bit physical address range. 

0b0001 64GB, corresponding to a 36-bit physical address range. 

0b0010 1TB or more, corresponding to a 40-bit or larger physical address range. 
All other values are reserved. 

In Armv8-A the permitted values are 0b0000, 0b0001, and 0b0010. 


CohWalk, bits [23:20] 


ARM DDI 0487E.a 
ID070919 


Coherent Walk. Indicates whether Translation table updates require a clean to the Point of 
Unification. Defined values are: 


0b0000 Updates to the translation tables require a clean to the Point of Unification to ensure 
visibility by subsequent translation table walks. 


0b0001 Updates to the translation tables do not require a clean to the Point of Unification to 
ensure visibility by subsequent translation table walks. 
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All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


PAN, bits [19:16] 


From ARMV8.1: 


Privileged Access Never. Indicates support for the PAN bit in CPSR, SPSR, and DSPSR in AArch32 
state. Defined values are: 


0b0000 PAN not supported. 
0b0001 PAN supported. 
0b0010 PAN supported and ATS1CPRP and ATS1CPWP instructions supported. 
All other values are reserved. 
ARMv8.1-PAN implements the functionality identified by the value 0b0001. 
ARMv8.2-ATS1E1 implements the functionality added by the value 0b0019. 
In Armv8.1 the value @b0000 is not permitted. 
From Armv8.2, the only permitted value is 0b0010. 
Otherwise: 


Reserved, RESO. 


MaintBest, bits [15:12] 


Maintenance Broadcast. Indicates whether Cache, TLB, and branch predictor operations are 
broadcast. Defined values are: 


0b0000 Cache, TLB, and branch predictor operations only affect local structures. 


0b0001 Cache and branch predictor operations affect structures according to shareability and 
defined behavior of instructions. TLB operations only affect local structures. 


0b0010 Cache, TLB, and branch predictor operations affect structures according to shareability 
and defined behavior of instructions. 


All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


BPMaint, bits [11:8] 


Branch Predictor Maintenance. Indicates the supported branch predictor maintenance operations in 
an implementation with hierarchical cache maintenance operations. Defined values are: 


0b0000 None supported. 

0b0001 Supported branch predictor maintenance operations are: 
. Invalidate all branch predictors. 

0b0010 As for 0001, and adds: 
s Invalidate branch predictors by VA. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0010. 


CMaintSW, bits [7:4] 


Cache Maintenance by Set/Way. Indicates the supported cache maintenance operations by set/way, 
in an implementation with hierarchical caches. Defined values are: 


0b0000 None supported. 


0b0001 Supported hierarchical cache maintenance instructions by set/way are: 
$ Invalidate data cache by set/way. 
s Clean data cache by set/way. 
e Clean and invalidate data cache by set/way. 
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All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


In a unified cache implementation, the data cache maintenance operations apply to the unified 


caches. 


CMaintVA, bits [3:0] 


Cache Maintenance by Virtual Address. Indicates the supported cache maintenance operations by 


VA, in an implementation with hierarchical caches. Defined values are: 
0b0000 None supported. 
0b0001 Supported hierarchical cache maintenance operations by VA are: 
° Invalidate data cache by VA. 
° Clean data cache by VA. 
e Clean and invalidate data cache by VA. 
° Invalidate instruction cache by VA. 
. Invalidate all instruction cache entries. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


In a unified cache implementation, data cache maintenance operations apply to the unified caches, 


and the instruction cache maintenance instructions are not implemented. 


Accessing the ID_MMFR3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_MMFR3; 
elsif PSTATE.EL == EL2 then 
return ID_MMFR3; 
elsif PSTATE.EL == EL3 then 
return ID_MMFR3; 


coproc opct CRn CRm opc2 
0b1111 0b000 0b0000 0b0001 0b111l 
G8-6159 
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ID_MMFR4, Memory Model Feature Register 4 


The ID_ MMFR&4 characteristics are: 


Purpose 


Provides information about the implemented memory model and memory management support in 
AArch32 state. 


Must be interpreted with ID MMFRO, ID MMFR1, ID MMFR2, and ID MMFR3. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 

Configurations 


AArch32 System register ID MMFR4[31:0] is architecturally mapped to AArch64 System register 
ID_MMFR4 EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_MMFR4 is a 32-bit register. 


Field descriptions 


The ID MMFR4 bit assignments are: 


28 27 24 23 20 19 1615 12 11 


EVT, bits [31:28] 
When ARMV8.2-EVT is implemented: 


Enhanced Virtualization Traps. If EL2 is implemented, indicates support for the HCR2.{TTLBIS, 
TOCU, TICAB, TID4} traps. Defined values are: 


0b0000 HCR2.{TTLBIS, TOCU, TICAB, TID4} traps are not supported. 


0b0001 HCR2. {TOCU, TICAB, TID4} traps are supported. HCR2.TTLBIS trap is not 
supported 


0b0010 HCR2. {TTLBIS, TOCU, TICAB, TID4} traps are supported. 

All other values are reserved. 

In Armv8.0, the only permitted value is 0b0000. 

From Armv8.1, the permitted values are 0b0000, 0b0001, and 0b0010. 

From Armvs.5, the permitted values are: 

à 0b0000 when EL2 is not implemented. 

° 0b0010 when EL2 is implemented. This feature is identified as ARMv8.2-EVT. 
Otherwise: 


Reserved, RESO. 


CCIDX, bits [27:24] 
From ARMV8.3: 


Support for use of the revised CCSIDR format and the presence of the CCSIDR2 is indicated. 
Defined values are: 


0b0000 32-bit format implemented for all levels of the CCSIDR, and the CCSIDR2 register is 
not implemented. 
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Qb0001 64-bit format implemented for all levels of the CCSIDR, and the CCSIDR2? register is 
implemented. 


All other values are reserved. 


From Armv8.3, the permitted values are 0b0000 and 0b0001. This feature is identified as 
ARMv8.3-CCIDX. 


Otherwise: 


Reserved, RAZ. 


LSM, bits [23:20] 
From ARMVv8.2: 


Indicates support for LSMAOE and nTLSMD bits in HSCTLR and SCTLR. Defined values are: 
0b0000 LSMAOE and nTLSMD bits not supported. 

0b0001 LSMAOE and nTLSMD bits supported. 

All other values are reserved. 

ARMv8.2-LSMAOC implements the functionality identified by the value 0b0001. 


Otherwise: 


Reserved, RAZ. 


HPDS, bits [19:16] 
From ARMv8.2: 


Hierarchical permission disables bits in translation tables. Defined values are: 
0b0000 Disabling of hierarchical controls not supported. 


0b0001 Supports disabling of hierarchical controls using the TTBCR2.HPDO, TTBCR2.HPD1, 
and HTCR.HPD bits. 


0b0010 As for value @b0001, and adds possible hardware allocation of bits[62:59] of the 
translation table descriptors from the final lookup level for IMPLEMENTATION DEFINED 
use. 


All other values are reserved. 
ARMv8.2-AA32HPD implements the functionality identified by the value 0b0001. 
ARMv8.2-TTPBHA implements the functionality added by the value 0b0010. 





Note 
The value 0b0000 implies that the encoding for TTBCR2 is UNDEFINED. 





Otherwise: 


Reserved, RAZ. 


CnP, bits [15:12] 
From ARMVv8.2: 


Common not Private translations. Defined values are: 

0b0000 Common not Private translations not supported. 

0b0001 Common not Private translations supported. 

All other values are reserved. 

ARMv8.2-TTCNP implements the functionality identified by the value 0b0001. 
From Armv8.2 the only permitted value is @b0001. 


Otherwise: 


Reserved, RAZ. 
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XNX, bits [11:8] 
From ARMv8.2: 
Support for execute-never control distinction by Exception level at stage 2. Defined values are: 
0b0000 Distinction between ELO and EL1 execute-never control at stage 2 not supported. 
0b0001 Distinction between ELO and EL1 execute-never control at stage 2 supported. 
All other values are reserved. 
ARMv8.2-TTS2UXN implements the functionality identified by the value 0b0001. 
When ARMv8.2-TTS2UXN is implemented: 


- If all of the following conditions are true it is IMPLEMENTATION DEFINED whether the value 
of ID MMFR4.XNX is 0b0000 or 0b0001: 


— ID _AA64MMFRI ELI.XNX ==1. 
—  EL2 cannot use AArch32. 
— ELl can use AArch32. 
° If EL2 can use AArch32 then the only permitted value is 0b0001. 
Otherwise: 


Reserved, RAZ. 


AC2, bits [7:4] 


Indicates the extension of the ACTLR and HACTLR registers using ACTLR2 and HACTLR2. 
Defined values are: 


0b0000 ACTLR2 and HACTLR2 are not implemented. 

0b0001 ACTLR2 and HACTLR2 are implemented. 

All other values are reserved. 

In Armv8.0 and Armv8.1 the permitted values are 0b0000 and 0b0001. 
From Armv8.2, the only permitted value is 0b0001. 


SpecSEI, bits [3:0] 
When RAS is implemented: 


Describes whether the PE can generate SError interrupt exceptions from speculative reads of 
memory, including speculative instruction fetches. The defined values of this field are: 


0b0000 The PE never generates an SError interrupt due to an External abort on a speculative 
read. 

0b0001 The PE might generate an SError interrupt due to an External abort on a speculative 
read. 


All other values are reserved. 
Otherwise: 


Reserved, RESO. This provides no information about whether the PE generates a speculative SError 
interrupt. 


Accessing the ID_MMFR4 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b0000 0b0010 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (!IsZero(ID_MMFR4) || boolean IMPLEMENTATION_DEFINED 
"ID_MMFR4_EL1 trapped by HCR_EL2.TID3 and ID_MMFR4 trapped by HCR_EL2.TID3 and HCR.TID3") && HCR_EL2.TID3 
== '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_MMFR4; 
elsif PSTATE.EL == EL2 then 
return ID_MMFR4; 
elsif PSTATE.EL == EL3 then 
return ID_MMFR4; 
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ID_PFRO, Processor Feature Register 0 


The ID_PFRO characteristics are: 


Purpose 


Gives top-level information about the instruction sets and other features supported by the PE in 
AArch32 state. 


Must be interpreted with ID_PFR1. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 


Configurations 


Attributes 


AArch32 System register ID_PFRO[31:0] is architecturally mapped to AArch64 System register 
ID_PFRO_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


ID_PFRO is a 32-bit register. 


Field descriptions 


The ID_PFRO bit assignments are: 


28 27 24 23 20 19 1615 12 11 


DORA csv2 | states | stator | statet | stato 


RAS, bits [31:28] 


RAS Extension version. 
0b0000 No RAS Extension. 
0b0001 RAS Extension present. 


0b0010 ARMv8.4-RAS present. As @b0001, and adds support for additional ERXMISC<m> 
System registers. 


Error records accessed through System registers conform to RAS System Architecture 
v1.1, which includes simplifications to ERR<n>STATUS and support for the optional 
RAS Timestamp Extension. 


All other values are reserved. 


From Armv8.4, when ARMv8.4-DFE is not implemented, and ERRIDR.NUM is zero, the 
permitted values are IMPLEMENTATION DEFINED 0b0001 or @b0010. Otherwise from Armv8.4 the only 
permitted value is 0b0010. 


ARMv8.4-RAS implements the functionality identified by the value 0b0019. 
In Armv8.2, the only permitted value is 0b0001. 
In Armv8.1 and Armv8.0, the permitted values are b0000 and 0b0001. 


DIT, bits [27:24] 


From ARMv8.4: 
Data Independent Timing. Defined values are: 
0b0000 AArch32 does not guarantee constant execution time of any instructions. 


0b0001 AArch32 provides the CPSR.DIT mechanism to guarantee constant execution time of 
certain instructions. 


All other values are reserved. 
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ARMv8.4-DIT implements the functionality identified by the value 0b0001. 
From Armv8.4, the only permitted value is 0b0001. 
Otherwise: 


Reserved, RESO. 


AMU, bits [23:20] 

From ARMv8.4: 
Activity Monitors Extension. Defined values are: 
0b0000 Activity Monitors Extension is not implemented. 
0b0001 Activity Monitors Extension Version 1 is implemented. 
All other values are reserved. 
AMUv1 implements the functionality identified by the value 0b0001. 
In Armv8.0, Armv8.1, Armv8.2, and Armv8.3, the only permitted value is 0b0000. 
From Armv8.4, the permitted values are 0b0000 and 0b0001. 

Otherwise: 


Reserved, RESO. 


CSV2, bits [19:16] 
From ARMvs.5: 
Speculative use of out of context branch targets. Defined values are: 


0b0000 This Device does not disclose whether branch targets trained in one hardware described 
context can affect speculative execution in a different hardware described context. 


0b0001 Branch targets trained in one hardware described context can only affect speculative 
execution in a different hardware described context in a hard-to-determine way. 


From Armvs.5, the only permitted value is 0b0001. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


State3, bits [15:12] 
T32EE instruction set support. Defined values are: 
0b0000 Not implemented. 
0b0001 T32EE instruction set implemented. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


State2, bits [11:8] 
Jazelle extension support. Defined values are: 
0b0000 Not implemented. 
0b0001 Jazelle extension implemented, without clearing of JOSCR.CV on exception entry. 
0b0010 Jazelle extension implemented, with clearing of JOSCR.CV on exception entry. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Statel, bits [7:4] 
T32 instruction set support. Defined values are: 


0b0000 T32 instruction set not implemented. 
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0b0001 T32 encodings before the introduction of Thumb-2 technology implemented: 


. All instructions are 16-bit. 
° A BL or BLX is a pair of 16-bit instructions 
. 32-bit instructions other than BL and BLX cannot be encoded. 


0b0011 T32 encodings after the introduction of Thumb-2 technology implemented, for all 


16-bit and 32-bit T32 basic instructions. 

All other values are reserved. 

In Armv8-A the only permitted value is 0b0011. 
State0, bits [3:0] 

A32 instruction set support. Defined values are: 

0b0000 A32 instruction set not implemented. 

0b0001 A32 instruction set implemented. 

All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Accessing the ID_PFRO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





Ob1111 0b000 = 0b0000 0b0001 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_PFRQ; 
elsif PSTATE.EL == EL2 then 
return ID_PFRQ; 
elsif PSTATE.EL == EL3 then 
return ID_PFRQ; 
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G8.2.97 ID_PFR1, Processor Feature Register 1 
The ID_PFRI characteristics are: 
Purpose 
Gives information about the AArch32 programmers’ model. 


Must be interpreted with ID_PFRO. 


For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 


Configurations 


AArch32 System register ID_PFR1[31:0] is architecturally mapped to AArch64 System register 
ID_PFR1_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ID_PFR1 is a 32-bit register. 


Field descriptions 


The ID_PFR1 bit assignments are: 


28 27 24 23 20 19 1615 12 11 





me Virtualization 


GIC, bits [31:28] 
System register GIC CPU interface. Defined values are: 
0b0000 No System register interface to the GIC CPU interface is supported. 
0b0001 System register interface to versions 3.0 and 4.0 of the GIC CPU interface is supported. 


All other values are reserved. 


Virt_frac, bits [27:24] 


Virtualization fractional field. When the Virtualization field is 0b0000, determines the support for 
features from the ARMv7 Virtualization Extensions. Defined values are: 


0b0000 No features from the ARMv7 Virtualization Extensions are implemented. 
0b0001 The following features of the ARMv7 Virtualization Extensions are implemented: 
. The SCR.SIF bit, if EL3 is implemented. 


° The modifications to the SCR.AW and SCR.FW bits described in the 
Virtualization Extensions, if EL3 is implemented. 


° The MSR (banked register) and MRS (banked register) instructions. 
. The ERET instruction. 

All other values are reserved. 

In Armv8-A the permitted values are: 

è 0b0000 when EL2 is implemented. 

s 0b0001 when EL2 is not implemented. 


This field is only valid when the value of ID_PFR1.Virtualization is 0, otherwise it holds the value 
0b0000. 
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Note 


The ID_ISAR registers do not identify whether the instructions added by the ARMv7 Virtualization 
Extensions are implemented. 





Sec_frac, bits [23:20] 


Security fractional field. When the Security field is 0b0000, determines the support for features from 
the ARMv7 Security Extensions. Defined values are: 


0b0000 No features from the ARMv7 Security Extensions are implemented. 

0b0001 The following features from the ARMv7 Security Extensions are implemented: 
. The VBAR register. 
° The TTBCR.PDO and TTBCR.PD1 bits. 


0b0010 As for 0b0001, plus the ability to access Secure or Non-secure physical memory is 
supported. 


All other values are reserved. 

In Armv8-A the permitted values are: 

° 0b0000 when EL3 is implemented. 

- 0b0001 or 0b0010 when EL3 is not implemented. 

This field is only valid when the value of ID_PFR1.Security is 0, otherwise it holds the value 0b0000. 


GenTimer, bits [19:16] 
Generic Timer support. Defined values are: 
0b0000 Not implemented. 
0b0001 Generic Timer implemented. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Virtualization, bits [15:12] 
Virtualization support. Defined values are: 
0b0000 EL2, Hyp mode, and the HVC instruction not implemented. 


0b0001 EL2, Hyp mode, the HVC instruction, and all the features described by Virt_frac == 
0b0001 implemented. 


All other values are reserved. 

In Armv8-A the permitted values are: 

. 0b0000 when EL2 is not implemented. 

- 0b0001 when EL2 is implemented. 

In an implementation that includes EL2, if EL2 cannot use AArch32 but EL1 can use AArch32 then 
this field has the value 0b0001. 

Note 

The ID_ISARs do not identify whether the HVC instruction is implemented. 








MProgMod, bits [11:8] 
M profile programmers' model support. Defined values are: 
0b0000 Not supported. 
0b0010 Support for two-stack programmers' model. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 
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Security, bits [7:4] 
Security support. Defined values are: 
0b0000 EL3, Monitor mode, and the SMC instruction not implemented. 


0b0001 EL3, Monitor mode, the SMC instruction, and all the features described by Sec_frac == 
0b0001 implemented. 


0b0010 As for 0b0001, and adds the ability to set the NSACR.REFR bit. Not permitted in Armv8 
as the NSACR.RER bit is RESO. 


All other values are reserved. 
In Armv8-A the permitted values are: 
° 0b0000 when EL3 is not implemented. 
: 0b0001 when EL3 is implemented. 
In an implementation that includes EL3, if EL3 cannot use AArch32 but EL1 can use AArch32 then 
this field has the value 0b0001. 
ProgMod, bits [3:0] 


Support for the standard programmers' model for ARMv4 and later. Model must support User, FIQ, 
IRQ, Supervisor, Abort, Undefined, and System modes. Defined values are: 


0b0000 Not supported. 
0b0001 Supported. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0001. 


Accessing the ID_PFR1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





0b1111 0b000 0b0000 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_PFR1; 
elsif PSTATE.EL == EL2 then 
return ID_PFR1; 
elsif PSTATE.EL == EL3 then 
return ID_PFR1; 
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G8.2.98 ID_PFR2, Processor Feature Register 2 


The ID_PFR2 characteristics are: 


Purpose 
Gives information about the AArch32 programmers’ model. 
Must be interpreted with ID_PFRO and ID_PFR1. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 


for fields in ID registers on page G8-5902. 


Configurations 
AArch32 System register ID_PFR2[31:0] is architecturally mapped to AArch64 System register 
ID_PFR2_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


ID_PFR2 is a 32-bit register. 


Field descriptions 


The ID_PFR2 bit assignments are: 


31 12 11 8 7 43 0 
RESO RAS frac | SSBS csv3 
Bits [31:12] 


Reserved, RESO. 


RAS frac, bits [11:8] 
When ARMV8.4-RAS is implemented: 
RAS Extension fractional field. 
0b0000 If ID_PFRO.RAS == 0b0001, RAS Extension implemented. 


0b0001 If ID_PFRO.RAS == 0b0001, as 0b0000 and adds support for additional ERXMISC<m> 
System registers. 


Error records accessed through System registers conform to RAS System Architecture 
v1.1, which includes simplifications to ERR<n>STATUS and support for the optional 


RAS Timestamp Extension. 
All other values are reserved. 
This field is valid only if ID_PFRO.RAS == 0b0001. 
Otherwise: 


Reserved, RESO. 


SSBS, bits [7:4] 
From ARMvs.5: 
Speculative Store Bypassing controls in AArch64 state. Defined values are: 
0b0000 AArch32 provides no mechanism to control the use of Speculative Store Bypassing. 


0b0001 AArch32 provides the PSTATE.SSBS mechanism to mark regions that are Speculative 
Store Bypass Safe. 


From Armv8.0, the permitted values are 0b0000 and 0b0001. 
From Armv8.5, the only permitted value is 0b0001. 
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All other values are reserved. 
Otherwise: 


Reserved, RESO. 
CSV3, bits [3:0] 
From ARMv8.5: 


Speculative use of faulting data. Defined values are: 


0b0000 This Device does not disclose whether data loaded under speculation with a permission 
or domain fault can be used to form an address or generate condition codes or SVE 
predicate values to be used by instructions newer than the load in the speculative 


sequence 


0b0001 Data loaded under speculation with a permission or domain fault cannot be used to form 


an address or generate condition codes or SVE predicate values to be used by 


instructions newer than the load in the speculative sequence 
From Armv8.0, the permitted values are 0b0000 and 0b0001. 
From Armvs.5, the only permitted value is 0b0001. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


Accessing the ID_PFR2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ID_PFR2; 
elsif PSTATE.EL == EL2 then 
return ID_PFR2; 
elsif PSTATE.EL == EL3 then 
return ID_PFR2; 


coproc opci1 CRn CRm opc2 
Ob1111 0b000 0b0000 0b0011 O0b100 
G8-6171 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


AArch32 System Register Descriptions 
G8.2 General system control registers 


G8.2.99 


G8-6172 


IFAR, Instruction Fault Address Register 


The IFAR characteristics are: 


Purpose 


Holds the virtual address of the faulting address that caused a synchronous Prefetch Abort 
exception. 


Configurations 


Attributes 


AArch32 System register IFAR[3 1:0] is architecturally mapped to AArch64 System register 
FAR_EL1[63:32]. 


AArch32 System register IFAR[31:0](S) is architecturally mapped to AArch32 System register 
HIFAR[3 1:0] when HaveEL(EL2), HaveEL(EL3) and HighestELUsingA Arch32(). 


AArch32 System register IFAR[31:0](S) is architecturally mapped to AArch64 System register 
FAR_EL2[63:32] when HaveEL(EL2). 


RW fields in this register reset to architecturally UNKNOWN values. 


IFAR is a 32-bit register. 


Field descriptions 


The IFAR bit assignments are: 


31 


0 


VA of faulting address of synchronous Prefetch Abort exception 


Bits [31:0] 


VA of faulting address of synchronous Prefetch Abort exception. 


This field resets to an architecturally UNKNOWN value. 


Accessing the IFAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b0110 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 


return IFAR_S; 
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else 
return IFAR_NS; 
else 
return IFAR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return IFAR_NS; 
else 
return IFAR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return IFAR_S; 
else 
return IFAR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opci1 CRn CRm 


opc2 





Ob1111 0b000 = 0b0110  0b0000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T6 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T6 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
IFAR_S = R[t]; 
else 
IFAR_NS = R[t]; 
else 
IFAR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
IFAR_NS = R[t]; 
else 
IFAR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
IFAR_S = R[t]; 
else 





IFAR_NS = R[t]; 
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G8.2.100 


FnV —— a} ees LPAE 


G8-6174 


IFSR, Instruction Fault Status Register 


The IFSR characteristics are: 


Purpose 
Holds status information about the last instruction fault. 
Configurations 
AArch32 System register IFSR[31:0] is architecturally mapped to AArch64 System register 
IFSR32_EL2[31:0]. 
The current translation table format determines which format of the register is used. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


IFSR is a 32-bit register. 


Field descriptions 


The IFSR bit assignments are: 


When TTBCR.EAE == 


31 


171615 131211109 8 


RESO i RESO Le RESO FS[3:0] 


Bits [31:17] 


Fn, bit [16] 


Bits [15:13] 


EXT, bit [12] 


Reserved, RESO. 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd IFAR is valid. 
Qb1 IFAR is not valid, and holds an UNKNOWN value. 


This field is only valid for a synchronous External abort other than a synchronous External abort on 
a translation table walk. It is RESO for all other Prefetch Abort exceptions. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


External abort type. This bit can be used to provide an IMPLEMENTATION DEFINED classification of 
External aborts. 


In an implementation that does not provide any classification of External aborts, this bit is RESO. 
For aborts other than External aborts this bit always returns 0. 


This field resets to an architecturally UNKNOWN value. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


AArch32 System Register Descriptions 
G8.2 General system control registers 


Bit [11] 
Reserved, RESO. 


FS[4], bit [10] 
This field is bit[4] of FS[4:0]. 
Fault Status bits. Bits [10] and [3:0] are interpreted together. 
0b00001 PC alignment fault 
0b00010 Debug exception 
0b00011 Access flag fault, level 1 
0b00101 Translation fault, level 1 
0b00110 Access flag fault, level 2 
0b00111 Translation fault, level 2 
0b01000 Synchronous External abort, not on translation table walk 
0b01001 Domain fault, level 1 
0b01011 Domain fault, level 2 
0b01100 Synchronous External abort, on translation table walk, level 1 
0b01101 Permission fault, level 1 
0b01110 Synchronous External abort, on translation table walk, level 2 
0b01111 Permission fault, level 2 
0b10000 TLB conflict abort 


0b10100 IMPLEMENTATION DEFINED fault (Lockdown fault) 





0b11001 Synchronous parity or ECC error on memory access, not on translation table walk 
0b11100 Synchronous parity or ECC error on translation table walk, level 1 

@b11110 Synchronous parity or ECC error on translation table walk, level 2 

All other values are reserved. 

When the RAS Extension is implemented, 0b11001, 0b11100, and 0b11110, are reserved. 


For more information about the lookup level associated with a fault, see The level associated with 
MMU faults on a Short-descriptor translation table lookup on page G5-5828. 


The FS field is split as follows: 
° FS[4] is IFSR[10]. 
° FS[3:0] is IFSR[3:0]. 


This field resets to an architecturally UNKNOWN value. 


LPAE, bit [9] 
On taking a Data Abort exception, this bit is set as follows: 
Obd Using the Short-descriptor translation table formats. 
Qb1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore 
software can set this bit to 0 or 1 without affecting operation. 


This field resets to an architecturally UNKNOWN value. 
Bits [8:4] 

Reserved, RESO. 
FS[3:0], bits [3:0] 

This field is bits[3:0] of FS[4:0]. 

See FS[4] for the field description. 
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When TTBCR.EAE == 


31 


171615 131211109 8 


RESO i RESO Ty [ee RESO STATUS 


Bits [31:17] 


FnV, bit [16] 


Bits [15:13] 


EXT, bit [12] 


Bits [11:10] 


LPAE, bit [9] 


Bits [8:6] 


Reserved, RESO. 


FAR not Valid, for a synchronous External abort other than a synchronous External abort on a 
translation table walk. 


Qbd IFAR is valid. 
Qb1 IFAR is not valid, and holds an UNKNOWN value. 


This field is only valid for a synchronous External abort other than a synchronous External abort on 
a translation table walk. It is RESO for all other Prefetch Abort exceptions. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


External abort type. This bit can be used to provide an IMPLEMENTATION DEFINED classification of 
External aborts. 


In an implementation that does not provide any classification of External aborts, this bit is RESO. 
For aborts other than External aborts this bit always returns 0. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


On taking a Data Abort exception, this bit is set as follows: 
Qbd Using the Short-descriptor translation table formats. 
Qb1 Using the Long-descriptor translation table formats. 


Hardware does not interpret this bit to determine the behavior of the memory system, and therefore 
software can set this bit to 0 or 1 without affecting operation. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


STATUS, bits [5:0] 


Fault status bits. Possible values of this field are: 
0b000000 Address size fault in TTBRO or TTBRI. 
0b000001 Address size fault, level 1. 

0b000010 Address size fault, level 2. 
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0b000011 Address size fault, level 3. 
0b000101 Translation fault, level 1. 
0b000110 Translation fault, level 2. 
0b000111 Translation fault, level 3. 
0b001001 Access flag fault, level 1. 
0b001010 Access flag fault, level 2. 
0b001011 Access flag fault, level 3. 
0b001101 Permission fault, level 1. 
0b001110 Permission fault, level 2. 
0b001111 Permission fault, level 3. 





0b010000 Synchronous External abort, not on translation table walk. 

0b010101 Synchronous External abort, on translation table walk, level 1. 

0b010118 Synchronous External abort, on translation table walk, level 2. 

0b010111 Synchronous External abort, on translation table walk, level 3. 

0b011000 Synchronous parity or ECC error on memory access, not on translation table walk. 
0b011101 Synchronous parity or ECC error on memory access on translation table walk, level 1. 
0b011110 Synchronous parity or ECC error on memory access on translation table walk, level 2. 


0b011111 Synchronous parity or ECC error on memory access on translation table walk, level 3. 


0b100001 PC alignment fault. 
0b100010 Debug exception. 
0b110000 TLB conflict abort. 


All other values are reserved. 


When the RAS Extension is implemented, 0b011000, 0b011101, 0b011110, and 0b011111, are reserved. 


For more information about the lookup level associated with a fault, see The level associated with 


MMU faults on a Long-descriptor translation table lookup on page G5-5830. 


This field resets to an architecturally UNKNOWN value. 


Accessing the IFSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opci CRn CRm opc2 
0b1111 0b000 0b0101 0b0000 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return IFSR_S; 
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else 
return IFSR_NS; 
else 
return IFSR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return IFSR_NS; 
else 
return IFSR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return IFSR_S; 
else 
return IFSR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opci1 CRn CRm 


opc2 





Ob1111 0b000 = 0b0101 0b0000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
IFSR_S = R[t]; 
else 
IFSR_NS = R[t]; 
else 
IFSR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
IFSR_NS = R[t]; 
else 
IFSR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
IFSR_S = R[t]; 
else 





IFSR_NS = R[t]; 


0b001 
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G8.2.101 ISR, Interrupt Status Register 


ARM DDI 0487E.a 
ID070919 


The ISR characteristics are: 


Purpose 
Shows the pending status of the IRQ, FIQ, or SError. 
When executing at EL2, EL3, or Secure EL1, when SCR_EL3.EEL2 == 0b, this shows the pending 
status of the physical interrupts. 
When executing at Non-secure EL1, or at Secure EL1, when SCR_EL3.EEL2 == 0b01: 
° If the HCR. {IMO,FMO,AMO} bit has a value of 1, the corresponding ISR. {I,F,A} bit shows 
the pending status of the virtual IRQ, FIQ, or SError. 
° If the HCR. {IMO,FMO,AMO} bit has a value of 0, the corresponding ISR. {I,F,A} bit shows 
the pending status of the physical IRQ, FIQ, or SError. 
Configurations 
AArch32 System register ISR[31:0] is architecturally mapped to AArch64 System register 
ISR_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ISR is a 32-bit register. 


Field descriptions 


The ISR bit assignments are: 


31 98765 0 
RESO ang RESO 
Bits [31:9] 


Reserved, RESO. 


A, bit [8] 
SError interrupt pending bit: 
Qbd No pending SError interrupt. 
Qb1 An SError interrupt is pending. 
If the SError interrupt is edge-triggered, this field is cleared to zero when the physical SError 
interrupt is taken. 
I, bit [7] 
IRQ pending bit. Indicates whether an IRQ interrupt is pending: 
Qbd No pending IRQ. 
Qb1 An IRQ interrupt is pending. 
F, bit [6] 
FIQ pending bit. Indicates whether an FIQ interrupt is pending. 
Qbd No pending FIQ. 
Qb1 An FIQ interrupt is pending. 
Bits [5:0] 


Reserved, RESO. 
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Accessing the ISR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b1100 0b0001 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return ISR; 
elsif PSTATE.EL == EL2 then 
return ISR; 
elsif PSTATE.EL == EL3 then 
return ISR; 
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G8.2.102  ITLBIALL, Instruction TLB Invalidate All 


The ITLBIALL characteristics are: 


Purpose 
Invalidate all cached copies of translation table entries from instruction TLBs that are from any level 
of the translation table walk. The entries that are invalidated are as follows: 
° If executed at Secure EL1 when EL3 is using AArch64, all entries that would be required for 
the Secure EL1&0 translation regime. 
° If executed in Secure state when EL3 is using AArch32, all entries that would be required for 
the Secure PL1&0 translation regime. 
° If executed at Non-secure EL1, all stage 1 translation table entries that would be required for 
the Non-secure PL1&0 translation regime and, if EL2 is implemented, they must match the 
current VMID. 
° If executed at EL2, the stage 1 or stage 2 translation table entries that would be required for 
the Non-secure PL1&0 translation regime and matches the current VMID. 
The invalidation only applies to the PE that executes this System instruction. 
Arm deprecates the use of this System instruction. It is only provided for backwards compatibility 
with earlier versions of the Arm architecture. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


ITLBIALL is a 32-bit System instruction. 


Field descriptions 


ITLBIALL ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 


Executing the ITLBIALL instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>} {<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b000 = 0b1000 0b0101 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 


ITLBIALL(); 
elsif PSTATE.EL == EL2 then 
ITLBIALL(); 


ARM DDI 0487E.a 
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elsif PSTATE.EL == EL3 then 
ITLBIALL(); 
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G8.2.103 ITLBIASID, Instruction TLB Invalidate by ASID match 


ARM DDI 0487E.a 
ID070919 


The ITLBIASID characteristics are: 


Purpose 


Invalidate all cached copies of translation table entries from instruction TLBs that meet the 
following requirements: 


° The entry is a stage 1 translation table entry. 
. The entry would be used for the specified ASID, and either: 
— Is from a level of lookup above the final level. 
— Isa non-global entry from the final level of lookup. 
° If EL2 is implemented, the entry would be used with the current VMID. 


From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 


° If executed at Secure EL1 when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 

° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 

. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 

The invalidation only applies to the PE that executes this System instruction. 


Arm deprecates the use of this System instruction. It is only provided for backwards compatibility 
with earlier versions of the Arm architecture. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ITLBIASID is a 32-bit System instruction. 


Field descriptions 


The ITLBIASID input value bit assignments are: 


31 8 7 0 
RESO ASID 
Bits [31:8] 


Reserved, RESO. 

ASID, bits [7:0] 
ASID value to match. Any TLB entries for non-global pages that match the ASID values will be 
affected by this System instruction. 

Executing the ITLBIASID instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b000 = 0b1000 0b0101 


opc2 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
ITLBIASID(R[t]); 
elsif PSTATE.EL == EL2 then 
ITLBIASID(R[t]); 
elsif PSTATE.EL == EL3 then 
ITLBIASID(R[t]); 
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G8.2.104 ITLBIMVA, Instruction TLB Invalidate by VA 
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The ITLBIMVA characteristics are: 


Purpose 


Invalidate all cached copies of translation table entries from instruction TLBs that meet the 
following requirements: 


° The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified address, and one of the following applies: 


— The entry is from a level of lookup above the final level and matches the specified 
ASID. 


— The entry is a global entry from the final level of lookup. 


— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 


° If EL2 is implemented, the entry would be used with the current VMID. 


From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 


° If executed at Secure EL1 when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 

° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 

. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 

The invalidation only applies to the PE that executes this System instruction. 


Arm deprecates the use of this System instruction. It is only provided for backwards compatibility 
with earlier versions of the Arm architecture. 

Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ITLBIMVA is a 32-bit System instruction. 


Field descriptions 


The ITLBIMVA input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this System instruction. 

Bits [11:8] 
Reserved, RESO. 

ASID, bits [7:0] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 
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Global TLB entries that match the VA value will be affected by this operation, regardless of the 


value of the ASID field. 


Executing the ITLBIMVA instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





Ob1111 0b000 = 0b1000 0b0101 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
ITLBIASID(R[t]); 
elsif PSTATE.EL == EL2 then 
ITLBIASID(R[t]); 
elsif PSTATE.EL == EL3 then 
ITLBIASID(R[t]); 
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G8.2.105 JIDR, Jazelle ID Register 


The JIDR characteristics are: 


Purpose 

A Jazelle register, which identified the Jazelle architecture version. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


JIDR is a 32-bit register. 


Field descriptions 


The JIDR bit assignments are: 


31 


RAZ 


Bits [31:0] 
Reserved, RAZ. 


Accessing the JIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1t CRn CRm opc2 





0b1110 0b111  0b0000 O0b0000 0b000 





if PSTATE.EL == EL@ then 
if boolean IMPLEMENTATION_DEFINED "JIDR UNDEFINED at ELO" then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HCR_EL2.TID@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID@ == '1' then 
AArch32.TakeHypTrapException(QxQ5) ; 
else 
return JIDR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID@ == '1' then 
AArch32.TakeHypTrapException(QxQ5) ; 
else 





return JIDR; 
elsif PSTATE.EL == EL2 then 
return JIDR; 
elsif PSTATE.EL == EL3 then 
return JIDR; 
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G8.2.106 


G8-6188 


JMCR, Jazelle Main Configuration Register 


The JMCR characteristics are: 


Purpose 

A Jazelle register, which provides control of the Jazelle extension. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


JMCR is a 32-bit register. 


Field descriptions 


The JMCR bit assignments are: 


31 


Bits [31:0] 
Reserved, RAZ/WI. 


Accessing the JMCR 


0 


RAZ/WI 


For accesses from ELO it is IMPLEMENTATION DEFINED whether the register is RW or UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 


CRn 


CRm opc2 





0b1110 0b111 


0b0010 


0b0000 = 0b000 





if PSTATE.EL == EL@ then 
if boolean IMPLEMENTATION_DEFINED "JMCR UNDEFINED at ELQ" then 
UNDEFINED; 
else 
return JMCR; 
elsif PSTATE.EL == EL1 then 
return JMCR; 
elsif PSTATE.EL == EL2 then 
return JMCR; 
elsif PSTATE.EL == EL3 then 
return JMCR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 CRn CRm opc2 


0b1110 Ob111 O0b0010 O0b0000 0b000 





if PSTATE.EL == ELO then 
if boolean IMPLEMENTATION_DEFINED "JMCR UNDEFINED at ELO" then 
UNDEFINED; 
else 
//no operation 
elsif PSTATE.EL == EL1 then 
//no operation 
elsif PSTATE.EL == EL2 then 
//no operation 
elsif PSTATE.EL == EL3 then 
//no operation 
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G8.2.107 


G8-6190 


JOSCR, Jazelle OS Control Register 


The JOSCR characteristics are: 


Purpose 

A Jazelle register, which provides operating system control of the Jazelle Extension. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


JOSCR is a 32-bit register. 


Field descriptions 


The JOSCR bit assignments are: 


31 


0 


RAZ/WI 


Bits [31:0] 
Reserved, RAZ/WI. 


Accessing the JOSCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 


CRn 


CRm opc2 





0b1110 0b111 


0b0001 


0b0000 = 0b000 





if PSTATE.EL == ELO then 
if boolean IMPLEMENTATION_DEFINED "JOSCR UNDEFINED at ELQ" then 
UNDEFINED; 
else 
return JOSCR; 
elsif PSTATE.EL == EL1 then 
return JOSCR; 
elsif PSTATE.EL == EL2 then 
return JOSCR; 
elsif PSTATE.EL == EL3 then 
return JOSCR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 CRn CRm opc2 


0b1110 Ob111 Ob0001 O0b0000 0b000 





if PSTATE.EL == ELO then 
if boolean IMPLEMENTATION_DEFINED "JOSCR UNDEFINED at ELO" then 
UNDEFINED; 
else 
//no operation 
elsif PSTATE.EL == EL1 then 
//no operation 
elsif PSTATE.EL == EL2 then 
//no operation 
elsif PSTATE.EL == EL3 then 
//no operation 
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G8-6192 


MAIRO, Memory Attribute Indirection Register 0 


The MAIRO characteristics are: 


Purpose 


Along with MAIR1, provides the memory attribute encodings corresponding to the possible 
AttrIndx values in a Long-descriptor format translation table entry for stage 1 translations. 


AttrIndx[2] indicates the MAIR register to be used: 
° When AttrIndx[2] is 0, MAIRO is used. 
° When AttrIndx[2] is 1, MAIR1 is used. 


Configurations 


AArch32 System register MAIRO[31:0] is architecturally mapped to AArch64 System register 
MAIR EL1[31:0]. 


MAIRO and PRRR are the same register, with a different view depending on the value of 
TTBCR.EAE: 


à When it is set to 0, the register is as described in PRRR. 
s When it is set to 1, the register is as described in MAIRO. 


When EL3 is using AArch32, write access to MAIRO(S) is disabled when the CP1SSDISABLE 
signal is asserted HIGH. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MAIRO is a 32-bit register. 


Field descriptions 


The MAIRO bit assignments are: 


When TTBCR.EAE == 1: 


Attr<n>, bits [8n+7:8n], for n = 0 to 3 


The memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format translation 
table entry, where: 


- AttrIndx[2:0] gives the value of <n> in Attr<n>. 
. AttrIndx[2] defines which MAIR to access. Attr7 to Attr4 are in MAIR1, and Attr3 to Attr0 
are in MAIRO. 


Bits [7:4] are encoded as follows: 





Attr<n>[7:4] Meaning 





0b0000 Device memory. See encoding of Attr<n>[3:0] for the type of Device memory. 





ObOORW, RW not @b00 Normal memory, Outer Write-Through Transient. 





0b0100 Normal memory, Outer Non-cacheable. 
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Attr<n>[7:4] Meaning 





Ob01RW, RW not @b00 Normal memory, Outer Write-Back Transient. 





0b10RW Normal memory, Outer Write-Through Non-transient. 





0b11RW Normal memory, Outer Write-Back Non-transient. 





R = Outer Read-Allocate policy, W = Outer Write-Allocate policy. 
The meaning of bits [3:0] depends on the value of bits [7:4]: 





Attr<n>[3:0] 


Meaning whom Atti<n>[7:4] is Meaning when Attr<n>[7:4] is not 0b0000 





























0b0000 
0b0000 Device-nGnRnE memory UNPREDICTABLE 
ObOORW, RW not @b0@ UNPREDICTABLE Normal memory, Inner Write-Through Transient 
0b0100 Device-nGnRE memory Normal memory, Inner Non-cacheable 
ObOIRW, RW not @b00 UNPREDICTABLE Normal memory, Inner Write-Back Transient 
0b1000 Device-nGRE memory Normal memory, Inner Write-Through Non-transient (RW=0b00) 
Ob1ORW, RW not @b0@ UNPREDICTABLE Normal memory, Inner Write-Through Non-transient 
0b1100 Device-GRE memory Normal memory, Inner Write-Back Non-transient (RW=0b00) 
Ob11RW, RW not 0b0@ UNPREDICTABLE Normal memory, Inner Write-Back Non-transient 
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R = Inner Read-Allocate policy, W = Inner Write-Allocate policy. 


The R and W bits in some Attr<n> fields have the following meanings: 





RorW Meaning 





b0 No Allocate 





Qb1 Allocate 





This field resets to an architecturally UNKNOWN value. 


Accessing the MAIRO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 


coproc opct CRn CRm opc2 
Ob1111 0b000 0b1010 0b0010 O0b000 
G8-6193 
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AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return MAIRQ_S; 
else 
return MAIRQ_NS; 
else 
return MAIRO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return MAIRQ_NS; 
else 
return MAIRO; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return MAIRO_S; 
else 








return MAIRO_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1010 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T10 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
MAIRO_S = R[t]; 
else 
MAIRO_NS = R[t]; 
else 
MAIRO = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
MAIRO_NS = R[t]; 
else 
AIRO = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' && CPLISSDISABLE == HIGH then 
UNDEFINED; 





else 
if SCR.NS == 'Q' then 
MAIRO_S = R[t]; 
else 
MAIRO_NS = R[t]; 
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G8.2.109 MAIR1, Memory Attribute Indirection Register 1 
The MAIRI characteristics are: 


Purpose 


Along with MAIRO, provides the memory attribute encodings corresponding to the possible 
AttrIndx values in a Long-descriptor format translation table entry for stage 1 translations. 


AttrIndx[2] indicates the MAIR register to be used: 
° When AttrIndx[2] is 0, MAIRO is used. 
° When AttrIndx[2] is 1, MAIR1 is used. 


Configurations 


AArch32 System register MAIR1[31:0] is architecturally mapped to AArch64 System register 
MAIR EL1[63:32]. 


MAIRI and NMRR are the same register, with a different view depending on the value of 
TTBCR.EAE: 


è When it is set to 0, the register is as described in NMRR. 
s When it is set to 1, the register is as described in MAIR1. 


When EL3 is using AArch32, write access to MAIR1(S) is disabled when the CP1SSDISABLE 
signal is asserted HIGH. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MAIR! is a 32-bit register. 


Field descriptions 


The MAIRI bit assignments are: 


When TTBCR.EAE == 1: 


Attr<n>, bits [8(n-4)+7:8(n-4)], for n = 4 to 7 


The memory attribute encoding for an AttrIndx[2:0] entry in a Long descriptor format translation 
table entry, where: 


- AttrIndx[2:0] gives the value of <n> in Attr<n>. 
. AttrIndx[2] defines which MAIR to access. Attr7 to Attr4 are in MAIR1, and Attr3 to Attr0 
are in MAIRO. 


Bits [7:4] are encoded as follows: 





Attr<n>[7:4] Meaning 





0b0000 Device memory. See encoding of Attr<n>[3:0] for the type of Device memory. 





ObOORW, RW not @b00 Normal memory, Outer Write-Through Transient. 





0b0100 Normal memory, Outer Non-cacheable. 
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Attr<n>[7:4] Meaning 





Ob01RW, RW not @b00 Normal memory, Outer Write-Back Transient. 





0b10RW Normal memory, Outer Write-Through Non-transient. 





0b11RW Normal memory, Outer Write-Back Non-transient. 





R = Outer Read-Allocate policy, W = Outer Write-Allocate policy. 
The meaning of bits [3:0] depends on the value of bits [7:4]: 





Attr<n>[3:0] 


Meaning when Attr<n>[7:4] is 


0b0000 Meaning when Attr<n>[7:4] is not 0b0000 





0b0000 


Device-nGnRnE memory UNPREDICTABLE 





ObOORW, RW not 0b00 UNPREDICTABLE 


Normal memory, Inner Write-Through Transient 





0b0100 


Device-nGnRE memory Normal memory, Inner Non-cacheable 





ObOIRW, RW not 0b00 UNPREDICTABLE 


Normal memory, Inner Write-Back Transient 





0b1000 


Device-nGRE memory Normal memory, Inner Write-Through Non-transient (RW=0b00) 





Ob10RW, RW not 0b00 UNPREDICTABLE 


Normal memory, Inner Write-Through Non-transient 





0b1100 


Device-GRE memory Normal memory, Inner Write-Back Non-transient (RW=0b00) 





0b11RW, RW not @b0@ UNPREDICTABLE 











Normal memory, Inner Write-Back Non-transient 
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R = Inner Read-Allocate policy, W = Inner Write-Allocate policy. 


The R and W bits in some Attr<n> fields have the following meanings: 











R or W Meaning 
Qbd No Allocate 
Qb1 Allocate 





This field resets to an architecturally UNKNOWN value. 


Accessing the MAIR1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
Ob1111 0b000 0b1010 O0b0010 Ob001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
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AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return MAIR1_S; 
else 
return MAIRI_NS; 
else 
return MAIRI; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return MAIRI_NS; 


else 
return MAIR1; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 


return MAIR1_S; 
else 











return MAIRI_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1010 0b0010 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T10 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
MAIR1_S = R[t]; 
else 
MAIRI_NS = R[t]; 
else 
MAIR1 = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
MAIRI_NS = R[t]; 
else 
MAIR1 = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q@' && CPLISSDISABLE == HIGH then 
UNDEFINED; 





else 
if SCR.NS == 'Q' then 
MAIR1_S = R[t]; 
else 
MAIRI_NS = R[t]; 
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G8.2.110  MIDR, Main ID Register 
The MIDR characteristics are: 


Purpose 


Provides identification information for the PE, including an implementer code for the device and a 
device ID number. 


Configurations 
AArch32 System register MIDR[3 1:0] is architecturally mapped to AArch64 System register 
MIDR_EL1[31:0]. 
AArch32 System register MIDR[31:0] is architecturally mapped to External register 
MIDR_EL1[31:0]. 
Some fields of the MIDR are IMPLEMENTATION DEFINED. For details of the values of these fields for 


a particular Armv8 implementation, and any implementation-specific significance of these values, 
see the product documentation. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MIDR is a 32-bit register. 


Field descriptions 


The MIDR bit assignments are: 


31 24 23 20 19 1615 4 3 0 


Architecture en ee 


Implementer, bits [31:24] 


The Implementer code. This field must hold an implementer code that has been assigned by Arm. 
Assigned codes include the following: 





Hex representation Implementer 
































0x00 Reserved for software use 

OxC0 Ampere Computing 

0x41 Arm Limited 

0x42 Broadcom Corporation 

0x43 Cavium Inc. 

0x44 Digital Equipment Corporation 

0x49 Infineon Technologies AG 

0x4D Motorola or Freescale Semiconductor Inc. 

0x4E NVIDIA Corporation 

0x50 Applied Micro Circuits Corporation 
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Hex representation Implementer 











0x51 Qualcomm Inc. 
0x56 Marvell International Ltd. 
0x69 Intel Corporation 





Arm can assign codes that are not published in this manual. All values not assigned by Arm are 
reserved and must not be used. 
Variant, bits [23:20] 
An IMPLEMENTATION DEFINED variant number. Typically, this field is used to distinguish between 
different product variants, or major revisions of a product. 
Architecture, bits [19:16] 
The permitted values of this field are: 
0b0001 Armv4. 
0b0010 Armv4T. 
Qb0011 Armv5 (obsolete). 
0b0100 Armv5T. 
0b0101 ArmvSTE. 
0b0110 ArmvSTEJ. 
0b0111 Armv6. 


Qb1111 Architectural features are individually identified in the ID_* registers, see ZD registers 
on page K 14-7856. 


All other values are reserved. 


PartNum, bits [15:4] 
An IMPLEMENTATION DEFINED primary part number for the device. 


On processors implemented by Arm, if the top four bits of the primary part number are 0x0 or 0x7, 
the variant and architecture are encoded differently. 


Revision, bits [3:0] 


An IMPLEMENTATION DEFINED revision number for the device. 


Accessing the MIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0000 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) then 
return VPIDR_EL2<31:0>; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6199 
ID070919 Non-Confidential 


AArch32 System Register Descriptions 
G8.2 General system control registers 


elsif EL2Enabled() && ELUsingAArch32(EL2) then 
return VPIDR; 
else 
return MIDR; 
elsif PSTATE.EL == EL2 then 
return MIDR; 
elsif PSTATE.EL == EL3 then 
return MIDR; 
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G8.2.111 MPIDR, Multiprocessor Affinity Register 


The MPIDR characteristics are: 


Purpose 
In a multiprocessor system, provides an additional PE identification mechanism for scheduling 
purposes. 

Configurations 


AArch32 System register MPIDR[31:0] is architecturally mapped to AArch64 System register 
MPIDR_EL1[31:0]. 


In a uniprocessor system Arm recommends that each Aff<n> field of this register returns a value of 
0. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MPIDR is a 32-bit register. 


Field descriptions 


The MPIDR bit assignments are: 


31 30 29 25 24 23 1615 8 7 0 


__—<—<—$—$<_ 
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M, bit [31] 


Indicates whether this implementation includes the functionality introduced by the ARMv7 
Multiprocessing Extensions. The possible values of this bit are: 


0b0 This implementation does not include the ARMv7 Multiprocessing Extensions 
functionality. 


Qb1 This implementation includes the ARMv7 Multiprocessing Extensions functionality. 
From Armv§8, this bit is RAO. 


U, bit [30] 
Indicates a Uniprocessor system, as distinct from PE 0 in a multiprocessor system. The possible 
values of this bit are: 


0b0 Processor is part of a multiprocessor system. 


0b1 Processor is part of a uniprocessor system. 


Bits [29:25] 


Reserved, RESO. 


MT, bit [24] 
Indicates whether the lowest level of affinity consists of logical PEs that are implemented using a 
multithreading type approach. See the description of Aff0 for more information about affinity 
levels. The possible values of this bit are: 
ObO Performance of PEs at the lowest affinity level, or PEs with MPIDR.MT set to 1, 
different affinity level 0 values, and the same values for affinity level 1 and higher, is 
largely independent. 
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G8-6202 


Qb1 Performance of PEs at the lowest affinity level, or PEs with MPIDR.MT set to 1, 
different affinity level 0 values, and the same values for affinity level 1 and higher, is 


very interdependent. 
Aff2, bits [23:16] 
Affinity level 2. See the description of Aff0 for more information. 
Aff1, bits [15:8] 
Affinity level 1. See the description of Aff0 for more information. 


Aff0, bits [7:0] 


Affinity level 0. This is the affinity level that is most significant for determining PE behavior. Higher 
affinity levels are increasingly less significant in determining PE behavior. The assigned value of 
the MPIDR. {Aff2, Affl, Aff0} or MPIDR EL1.{Aff3, Aff2, Affl, Aff0} set of fields of each PE 


must be unique within the system as a whole. 


Accessing the MPIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b0000 0b0000 


0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) then 
return VMPIDR_EL2<31:0>; 
elsif EL2Enabled() && ELUsingAArch32(EL2) then 
return VMPIDR; 
else 
return MPIDR; 
elsif PSTATE.EL == EL2 then 
return MPIDR; 
elsif PSTATE.EL == EL3 then 
return MPIDR; 
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G8.2.112  MVBAR, Monitor Vector Base Address Register 


ARM DDI 0487E.a 
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The MVBAR characteristics are: 


Purpose 


When EL3 is implemented and can use AArch32, holds the vector base address for any exception 
that is taken to Monitor mode. 


Secure software must program the MVBAR with the required initial value as part of the PE boot 
sequence. 


Configurations 


It is IMPLEMENTATION DEFINED whether MVBAR[0] has a fixed value and ignored writes, or takes 
the last value written to it. 


On a reset into EL3 using AArch32, the reset value of MVBAR is an IMPLEMENTATION DEFINED 
choice between: 


. MVBAR[31:5] = an IMPLEMENTATION DEFINED value, which might be UNKNOWN. 
° MVBAR[4:1] = RESO. 
° MVBARĮ[0] = 0. 


. MVBAR[31:1] = an IMPLEMENTATION DEFINED value that is bits[31:1] of the AArch32 reset 
address. 


*  MVBAR[0]=1. 





Attributes 
MVBAR is a 32-bit register. 


Field descriptions 


The MVBAR bit assignments are: 


When programmed with a vector base address: 


31 5 4 0 
Vector Base Address 
Bits [31:5] 


Vector Base Address. Bits[31:5] of the base address of the exception vectors for exceptions taken to 
this Exception level. Bits[4:0] of an exception vector are the exception offset. 


Reserved, bits [4:0] 


Reserved, see Configurations. 


Accessing the MVBAR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = =0b1100 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == 'Q1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return MVBAR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = =0b1100 0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == '@1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' && CPLISSDISABLE == HIGH then 


UNDEFINED; 
elsif SCR.NS == '@' && CP15SDISABLE2 == HIGH then 
UNDEFINED; 
else 
MVBAR = R[t]; 
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G8.2.113  MVFRO, Media and VFP Feature Register 0 


ARM DDI 0487E.a 
ID070919 


The MVFRO characteristics are: 


Purpose 


Describes the features provided by the AArch32 Advanced SIMD and Floating-point 
implementation. 


Must be interpreted with MVFR1 and MVFR2. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 

Configurations 


AArch32 System register MVFRO[31:0] is architecturally mapped to AArch64 System register 
MVFRO_EL1[31:0]. 


Implemented only if the implementation includes Advanced SIMD and floating-point instructions. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MVERO is a 32-bit register. 


Field descriptions 


The MVFRO bit assignments are: 


28 27 24 23 20 19 1615 12 11 


FPRound | FPShVec FPSart FPDivide FPTrap FPDP FPSP SIMDReg 


FPRound, bits [31:28] 


Floating-Point Rounding modes. Indicates whether the floating-point implementation provides 
support for rounding modes. Defined values are: 


0b0000 Not implemented, or only Round to Nearest mode supported, except that Round towards 
Zero mode is supported for VCVT instructions that always use that rounding mode 
regardless of the FPSCR setting. 


0b0001 All rounding modes supported. 
All other values are reserved. 


In Armv8-A the permitted values are @b0000 and 0b0001. 


FPShVec, bits [27:24] 


Short Vectors. Indicates whether the floating-point implementation provides support for the use of 
short vectors. Defined values are: 


0b0000 Short vectors not supported. 
0b0001 Short vector operation supported. 
All other values are reserved. 


In Armv8-A the only permitted value is 0b0000. 


FPSart, bits [23:20] 


Square Root. Indicates whether the floating-point implementation provides support for the ARMv6 
VFP square root operations. Defined values are: 


0b0000 Not supported in hardware. 
0b0001 Supported. 
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All other values are reserved. 
In Armv8-A the permitted values are 0b0000 and 0b0001. 


The VSQRT.F32 instruction also requires the single-precision floating-point attribute, bits [7:4], 
and the VSQRT.F64 instruction also requires the double-precision floating-point attribute, bits 
[11:8]. 

FPDivide, bits [19:16] 


Indicates whether the floating-point implementation provides support for VFP divide operations. 
Defined values are: 


0b0000 Not supported in hardware. 

0b0001 Supported. 

All other values are reserved. 

In Armv8-A the permitted values are 0b0000 and 0b0001. 

The VDIV.F32 instruction also requires the single-precision floating-point attribute, bits [7:4], and 

the VDIV.F64 instruction also requires the double-precision floating-point attribute, bits [11:8]. 
FPTrap, bits [15:12] 


Floating Point Exception Trapping. Indicates whether the floating-point implementation provides 
support for exception trapping. Defined values are: 


0b0000 Not supported. 
0b0001 Supported. 
All other values are reserved. 
A value of 0b0001 indicates that, when the corresponding trap is enabled, a floating-point exception 
generates an exception. 
FPDP, bits [11:8] 


Double Precision. Indicates whether the floating-point implementation provides support for 
double-precision operations. Defined values are: 


0b0000 Not supported in hardware. 
0b0001 Supported, VFPv2. 


0b0010 Supported, VFPv3, VFPv4, or Armv8. VFPv3 and Armv8 add an instruction to load a 
double-precision floating-point constant, and conversions between double-precision 
and fixed-point values. 


All other values are reserved. 
In Armv8-A the permitted values are 0b0000 and 0b0010. 


A value of 0b0001 or 0b0010 indicates support for all VFP double-precision instructions in the 
supported version of VFP, except that, in addition to this field being nonzero: 


° VSQRT.F64 is only available if the Square root field is 0b0001. 

. VDIV.F64 is only available if the Divide field is 0b0001. 

° Conversion between double-precision and single-precision is only available if the 
single-precision field is nonzero. 

FPSP, bits [7:4] 

Single Precision. Indicates whether the floating-point implementation provides support for 

single-precision operations. Defined values are: 

0b0000 Not supported in hardware. 

0b0001 Supported, VFPv2. 


0b0010 Supported, VFPv3 or VFPv4. VFPv3 adds an instruction to load a single-precision 
floating-point constant, and conversions between single-precision and fixed-point 
values. 
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All other values are reserved. 
In Armv8-A the permitted values are 0b0000 and 0b0010. 


A value of 0b0001 or 0b0010 indicates support for all VFP single-precision instructions in the 
supported version of VFP, except that, in addition to this field being nonzero: 


° VSQRT.F32 is only available if the Square root field is 0b0001. 
° VDIV.F32 is only available if the Divide field is 0b0001. 


° Conversion between double-precision and single-precision is only available if the 
double-precision field is nonzero. 


SIMDReg, bits [3:0] 


Advanced SIMD registers. Indicates whether the Advanced SIMD and floating-point 
implementation provides support for the Advanced SIMD and floating-point register bank. Defined 
values are: 


0b0000 The implementation has no Advanced SIMD and floating-point support. 
0b0001 The implementation includes floating-point support with 16 x 64-bit registers. 


0b0010 The implementation includes Advanced SIMD and floating-point support with 32 x 
64-bit registers. 


All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b0010. 


Accessing the MVFRO 


Accesses to this register use the following encodings in the System instruction encoding space: 


VMRS{<c>}{<q>} <Rt>, <spec_reg> 


reg 


0b0111 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if ELUsingAArch32(EL1) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == '0') || CPACR.cp10 
== 'QQ') then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQ8) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x08); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ8) ; 
else 
return MVFROQ; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
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return MVFRQ; 
elsif PSTATE.EL == EL3 then 
if CPACR.cp10 == '00' then 
UNDEFINED; 
else 
return MVFRO; 
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G8.2.114  MVFR1, Media and VFP Feature Register 1 


SIMDFMAC 


ARM DDI 0487E.a 
ID070919 


The MVFR1 characteristics are: 


Purpose 


Describes the features provided by the AArch32 Advanced SIMD and Floating-point 
implementation. 


Must be interpreted with MVFRO and MVFR2. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 

Configurations 


AArch32 System register MVFR1[31:0] is architecturally mapped to AArch64 System register 
MVFR1_EL1[31:0]. 


Implemented only if the implementation includes Advanced SIMD and floating-point instructions. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MVERI is a 32-bit register. 


Field descriptions 


The MVFRI1 bit assignments are: 


28 27 24 23 20 19 1615 12 11 


= FPHP SIMDHP | SIMDSP SIMDInt SIMDLS | FPDNaN FPFtZ 


SIMDFMAC, bits [31:28] 


Advanced SIMD Fused Multiply-Accumulate. Indicates whether the Advanced SIMD 
implementation provides fused multiply accumulate instructions. Defined values are: 


0b0000 Not implemented. 

0b0001 Implemented. 

All other values are reserved. 

In Armv8-A the permitted values are 0b0000 and 0b0001. 


The Advanced SIMD and floating-point implementations must provide the same level of support 
for these instructions. 


FPHP, bits [27:24] 


Floating Point Half Precision. Indicates the level of half-precision floating-point support. Defined 
values are: 


0b0000 Not supported. 


0b0001 Floating-point half-precision conversion instructions are supported for conversion 
between single-precision and half-precision. 

0b0010 As for 0b0001, and adds instructions for conversion between double-precision and 
half-precision. 


Qb0011 As for 0b0010, and adds support for half-precision floating-point arithmetic. 


All other values are reserved. 
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In Armv8-A the permitted values are: 
è 0b0000 in an implementation without floating-point support. 


s 0b0010 in an implementation with floating-point support that does not include the 
ARMv8.2-FP16 extension. 


s 0b0011 in an implementation with floating-point support that includes the ARMv8.2-FP16 
extension. 


The level of support indicated by this field must be equivalent to the level of support indicated by 
the SIMDHP field, meaning the permitted values are: 





Half Precision instructions supported FPHP SIMDHP 











No support Qb0000  Ob0000 
Conversions only Qb0010 0b0001 
Conversions and arithmetic Qb0011 0b0010 





SIMDHP, bits [23:20] 


Advanced SIMD Half Precision. Indicates the level of half-precision floating-point support. 
Defined values are: 


0b0000 Not supported. 


0b0001 SIMD half-precision conversion instructions are supported for conversion between 
single-precision and half-precision. 


0b0010 As for 0b0001, and adds support for half-precision floating-point arithmetic. 
All other values are reserved. 

In Armv8-A the permitted values are: 

à 0b0000 in an implementation without SIMD floating-point support. 


g 0b0010 in an implementation with SIMD floating-point support that does not include the 
ARMv8.2-FP16 extension. 


3 0b0011 in an implementation with SIMD floating-point support that includes the 
ARMv8.2-FP16 extension. 


The level of support indicated by this field must be equivalent to the level of support indicated by 
the FPHP field, meaning the permitted values are: 


Half Precision instructions supported PHP SIMDHP 











No support Qb0000  eb0000 
Conversions only 0b0010 0b0001 
Conversions and arithmetic Qb0011  b0010 





SIMDSP, bits [19:16] 


Advanced SIMD Single Precision. Indicates whether the Advanced SIMD and floating-point 
implementation provides single-precision floating-point instructions. Defined values are: 


0b0000 Not implemented. 
0b0001 Implemented. This value is permitted only if the SIMDInt field is @b0001. 
All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b0001. 
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[15:12] 


Advanced SIMD Integer. Indicates whether the Advanced SIMD and floating-point implementation 
provides integer instructions. Defined values are: 


0b0000 Not implemented. 

0b0001 Implemented. 

All other values are reserved. 

In Armv8-A the permitted values are 0b0000 and 0b0001. 


[11:8] 


Advanced SIMD Load/Store. Indicates whether the Advanced SIMD and floating-point 
implementation provides load/store instructions. Defined values are: 


0b0000 Not implemented. 
0b0001 Implemented. 
All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b0001. 


[7:4] 


Default NaN mode. Indicates whether the floating-point implementation provides support only for 
the Default NaN mode. Defined values are: 


0b0000 Not implemented, or hardware supports only the Default NaN mode. 
0b0001 Hardware supports propagation of NaN values. 

All other values are reserved. 

In Armv8-A the permitted values are 0b0000 and 0b0001. 


0] 


Flush to Zero mode. Indicates whether the floating-point implementation provides support only for 
the Flush-to-Zero mode of operation. Defined values are: 


0b0000 Not implemented, or hardware supports only the Flush-to-Zero mode of operation. 
0b0001 Hardware supports full denormalized number arithmetic. 
All other values are reserved. 


In Armv8-A the permitted values are 0b0000 and 0b0001. 


Accessing the MVFR1 


Accesses to this register use the following encodings in the System instruction encoding space: 


VMRS{<c>}{<q>} <Rt>, <spec_reg> 


reg 


0b0110 


if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 
if ELUsingAArch32(EL1) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp10 == '@') || CPACR.cp10 


== 'QQ') then 


UNDEFINED; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
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'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQ8) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x08); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ8) ; 
else 
return MVFR1; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'xQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
return MVFR1; 
elsif PSTATE.EL == EL3 then 
if CPACR.cp1@ == '00' then 
UNDEFINED; 
else 
return MVFR1; 
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G8.2.115 MVFR2, Media and VFP Feature Register 2 


ARM DDI 0487E.a 
ID070919 


The MVFR2 characteristics are: 


Purpose 


Describes the features provided by the AArch32 Advanced SIMD and Floating-point 
implementation. 


Must be interpreted with MVFRO and MVFRI. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page G8-5902. 


Configurations 
AArch32 System register MVFR2[31:0] is architecturally mapped to AArch64 System register 
MVFR2_EL1[31:0]. 
Implemented only if the implementation includes Advanced SIMD and floating-point instructions. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
MVER2 is a 32-bit register. 


Field descriptions 


The MVFR2 bit assignments are: 


31 8 7 43 0 
RESO SIMDMisc 
Bits [31:8] 


Reserved, RESO. 


FPMisc, bits [7:4] 
Indicates whether the floating-point implementation provides support for miscellaneous VFP 
features. 


0b0000 Not implemented, or no support for miscellaneous features. 

0b0001 Support for Floating-point selection. 

0b0010 As 0b0001, and Floating-point Conversion to Integer with Directed Rounding modes. 
Qb0011 As 0b0010, and Floating-point Round to Integer Floating-point. 

0b0100 As 0b0011, and Floating-point MaxNum and MinNum. 

All other values are reserved. 

In Armv8-A the permitted values are 0b0000 and 0b0100. 


SIMDMisc, bits [3:0] 
Indicates whether the Advanced SIMD implementation provides support for miscellaneous 
Advanced SIMD features. 


0b0000 Not implemented, or no support for miscellaneous features. 

0b0001 Floating-point Conversion to Integer with Directed Rounding modes. 
0b0010 As 0b0001, and Floating-point Round to Integer Floating-point. 
0b0011 As 0b0010, and Floating-point MaxNum and MinNum. 


All other values are reserved. 
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In Armv8-A the permitted values are 0b0000 and 0b0011. 


Accessing the MVFR2 


Accesses to this register use the following encodings in the System instruction encoding space: 


VMRS{<c>}{<q>} <Rt>, <spec_reg> 


reg 


0b0101 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if ELUsingAArch32(EL1) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == '@') || CPACR.cp10 
== 'QQ') then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H != '1' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp10 == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQ8) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID3 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x08); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID3 == '1' then 
AArch32.TakeHypTrapException(QxQ8) ; 
else 
return MVFR2; 
elsif PSTATE.EL == EL2 then 
if HCR_EL2.E2H == '@' && CPTR_EL2.TFP == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif HCR_EL2.E2H == '1' && CPTR_EL2.FPEN == 'x0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x07); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && ((ELUsingAArch32(EL3) && SCR.NS == '1' && NSACR.cp1@ == 
'@') || HCPTR.TCP10 == '1') then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
return MVFR2; 
elsif PSTATE.EL == EL3 then 
if CPACR.cp1@ == '00' then 
UNDEFINED; 
else 
return MVFR2; 
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G8.2.116  NMRR, Normal Memory Remap Register 
The NMRR characteristics are: 


Purpose 


Provides additional mapping controls for memory regions that are mapped as Normal memory by 
their entry in the PRRR. 


Used in conjunction with the PRRR. 


Configurations 


AArch32 System register NMRR[31:0] is architecturally mapped to AArch64 System register 
MAIR EL1[63:32]. 


MAIRI and NMRR are the same register, with a different view depending on the value of 
TTBCR.EAE: 


š When it is set to 0, the register is as described in NMRR. 
è When it is set to 1, the register is as described in MAIR1. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
NMRR is a 32-bit register. 


Field descriptions 


The NMRR bit assignments are: 


When TTBCR.EAE == 0: 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 12 1110 9 8 76543 210 





OR<n>, bits [2n+17:2n+16], for n = 0 to 7 


Outer Cacheable property mapping for memory attributes n, if the region is mapped as Normal 
memory by the PRRR.TR<n> entry. n is the value of the TEX[0], C, and B bits concatenated. The 
possible values of this field are: 


0b00 Region is Non-cacheable. 

0b01 Region is Write-Back, Write-Allocate. 

0b10 Region is Write-Through, no Write-Allocate. 
0b11 Region is Write-Back, no Write-Allocate. 


The meaning of the field with n = 6 is IMPLEMENTATION DEFINED and might differ from the meaning 
given here. This is because the meaning of the attribute combination {TEX[0] = 1, C=1, B =0} is 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


IR<n>, bits [2n+1:2n], for n = 0 to 7 


Inner Cacheable property mapping for memory attributes n, if the region is mapped as Normal 
memory by the PRRR.TR<n> entry. n is the value of the TEX[0], C, and B bits concatenated. The 
possible values of this field are: 


Oboe Region is Non-cacheable. 
0b01 Region is Write-Back, Write-Allocate. 
0b10 Region is Write-Through, no Write-Allocate. 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6215 


ID070919 Non-Confidential 


AArch32 System Register Descriptions 
G8.2 General system control registers 


G8-6216 


Qb11 Region is Write-Back, no Write-Allocate. 


The meaning of the field with n = 6 is IMPLEMENTATION DEFINED and might differ from the meaning 
given here. This is because the meaning of the attribute combination {TEX[0] = 1, C=1, B =0} is 


IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the NMRR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b1010 0b0010 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return NMRR_S; 
else 
return NMRR_NS; 
else 
return NMRR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return NMRR_NS; 
else 
return NMRR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return NMRR_S; 
else 
return NMRR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b1010 0b0010 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP15SDISABLE == HIGH then 
UNDEFINED; 
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elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP1ISSDISABLE2 == HIGH then 
UNDEFINED; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 


NMRR_S = R[t]; 
else 
NMRR_NS = R[t]; 
else 
NMRR = R[t]; 


elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
NMRR_NS = R[t]; 
else 
NMRR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' && CPLISSDISABLE == HIGH then 


UNDEFINED; 
elsif SCR.NS == '@' && CPISSDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
NMRR_S = R[t]; 
else 


NMRR_NS = R[t]; 
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G8.2.117 


NSTRCDIS 
RESO 
IMP DEF 


G8-6218 


NSACR, Non-Secure Access Control Register 


The NSACR characteristics are: 


Purpose 


When EL3 is implemented and can use AArch32, defines the Non-secure access permissions to 
Trace, Advanced SIMD and floating-point functionality. Also includes IMPLEMENTATION DEFINED 
bits that can define Non-secure access permissions for IMPLEMENTATION DEFINED functionality. 


Configurations 


Note 
In AArch64 state, the NSACR controls are replaced by controls in CPTR_EL3. 








Some or all RW fields of this register have defined reset values. These apply whenever the register 
is accessible. This means they apply when the PE resets into EL3 using AArch32. 


Attributes 
NSACR is a 32-bit register. 


Field descriptions 


The NSACR bit assignments are: 


31 21201918 161514 1211109 0 


RESO i RESO al RESO 


— | CO ooo 


NSASEDIS 


If EL3 is implemented and is using AArch64 then: 

à Any read of the NSACR from Non-secure EL2 or Non-secure EL1 returns a value of 0x00000C00. 
è Any read or write to NSACR from Secure EL! is trapped as an exception to EL3. 

If EL3 is not implemented, then any read of the NSACR from EL2 or EL1 returns a value of 0x00000C00. 


Bits [31:21] 
Reserved, RESO. 


NSTRCDIS, bit [20] 
Disables Non-secure System register accesses to all implemented trace registers. 


Qbd This control has no effect on: 
` System register access to implemented trace registers. 
° The behavior of CPACR.TRCDIS and HCPTR.TTA. 

0b1 Non-secure System register accesses to all implemented trace registers are disabled, 
meaning: 


e CPACR.TRCDIS behaves as RAO/WI in Non-secure state, regardless of its 
actual value. 


s HCPTR.TTA behaves as RAO/WI, regardless of its actual value. 
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The implementation of this field must correspond to the implementation of the CPACR.TRCDIS 
field: 


à If CPACR.TRCDIS is RAZ/WI, this field is RAZ/WI. 
s If CPACR.TRCDIS is RW, this field is RW. 


— Note 

è The ETMv4 architecture does not permit ELO to access the trace registers. If the 
implementation includes an ETMv4 implementation, ELO accesses to the trace registers are 
UNDEFINED. 

è The architecture does not provide Non-secure access controls on trace register accesses 


through the optional memory-mapped external debug interface. 





System register accesses to the trace registers can have side-effects. When a System register access 
is trapped, any side-effects that are normally associated with the access do not occur before the 
exception is taken. 


In a system where the PE resets into EL3, this field resets to 0. 


Bit [19] 


Reserved, RESO. 


IMPLEMENTATION DEFINED, bits [18:16] 
IMPLEMENTATION DEFINED. 


NSASEDIS, bit [15] 
Disables Non-secure access to the Advanced SIMD functionality. 
Qbd This control has no effect on: 
s Non-secure access to Advanced SIMD functionality. 
? The behavior of CPACR.ASEDIS and HCPTR.TASE. 
Qb1 Non-secure access to the Advanced SIMD functionality is disabled, meaning: 


7 CPACR.ASEDIS behaves as RAO/WI in Non-secure state, regardless of its 
actual value. 


° HCPTR.TASE behaves as RAO/WI, regardless of its actual value. 


The implementation of this field must correspond to the implementation of the CPACR.ASEDIS 
field: 


à If CPACR.ASEDIS is RESO, this field is RESO. If the implementation does not include 
Advanced SIMD and floating-point functionality, this field is RESO. 


° If CPACR.ASEDIS is RAZ/WI, this field is RAZ/WI. 
° If CPACR.ASEDIS is RW, this field is RW. 
In a system where the PE resets into EL3, this field resets to 0. 


Bits [14:12] 
Reserved, RESO. 


cp11, bit [11] 


The value of this field is ignored. If this field is programmed with a different value to the cp10 field 
then this field is UNKNOWN on a direct read of the NSACR. 


If the implementation does not include Advanced SIMD and floating-point functionality, this field 
is RESO. 


In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 
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cp10, bit [10] 


Bits [9:0] 


Enable Non-secure access to the Advanced SIMD and floating-point features. Possible values of the 
fields are: 


Qbd Advanced SIMD and floating-point features can be accessed only from Secure state. 
Any attempt to access this functionality from Non-secure state is UNDEFINED. 


When the PE is in Non-secure state: 
° The CPACR. {cp11, cp10} fields ignore writes and read as 0b00, access denied. 


s The HCPTR.{TCP11, TCP10} fields behave as RAO/WI, regardless of their 
actual values. 


Qb1 Advanced SIMD and floating-point features can be accessed from both Security states. 


IfNon-secure access to the Advanced SIMD and floating-point functionality is enabled, the CPACR 
must be checked to determine the level of access that is permitted. 


The Advanced SIMD and floating-point features controlled by these fields are: 
. Execution of any floating-point or Advanced SIMD instruction. 


à Any access to the Advanced SIMD and floating-point registers D0-D31 and their views as 
S0-S31 and Q0-Q15. 


. Any access to the FPSCR, FPSID, MVFRO, MVFR1, MVFR2, or FPEXC System registers. 


If the implementation does not include Advanced SIMD and floating-point functionality, this field 
is RESO. 


In a system where the PE resets into EL3, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Accessing the NSACR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b0001 0b0001 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == '@1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif !HaveEL(EL3) || (!ELUsingAArch32(EL3) && SCR_EL3.NS == '1') then 
return Zeros(20):'1100':Zeros(8); 


else 


return NSACR; 
elsif PSTATE.EL == EL2 then 
if !HaveEL(EL3) || (!ELUsingAArch32(EL3) && SCR_EL3.NS == '1') then 
return Zeros(20):'1100':Zeros(8); 


else 


return NSACR; 


G8-6220 
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elsif PSTATE.EL == EL3 then 
return NSACR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b0001 O0b0001 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == '@1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' && CPI5SDISABLE2 == HIGH then 
UNDEFINED; 
else 
NSACR = R[t]; 
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G8.2.118 | PAR, Physical Address Register 
The PAR characteristics are: 


Purpose 
Returns the output address (OA) from an Address translation instruction that executed successfully, 
or fault information if the instruction did not execute successfully. 

Configurations 


AArch32 System register PAR[63:0] is architecturally mapped to AArch64 System register 
PAR_EL1[63:0]. 


PAR is accessed as a 32-bit value: 
$ When the PE is not in Hyp mode and is using the Short-descriptor translation table format. 


: When the PE is in Hyp mode and executes an ATS12NSOPR, ATSI2NSOPW, 
ATS12NSOUR, or ATS12NSOUW instruction and the value of HCR.VM is 0 and the value 
of TTBCR.EAE is 0. 


In these cases, PAR[63:32] is RESO. 

Otherwise, the PAR is accessed as a 64-bit value, if any of the following is true: 
. When using the Long-descriptor translation table format. 

: If the stage 1 address translation is disabled and TTBCR.EAE is set to 1. 


° In an implementation that includes EL2, for the result of an ATS1Cxx instruction performed 
from Hyp mode. 


For PL1 &0 stage 1 translations, TTBCR.EAE selects the translation table format. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


PAR is a 64-bit register that can also be accessed as a 32-bit value. If it is accessed as a 32-bit 
register, accesses read and write bits[31:0] and do not modify bits[63:32]. 


The Configurations section specifies the cases where each PAR format is used. 


Field descriptions 


The PAR bit assignments are: 


When the instruction returned a 32-bit value to the PAR, PAR.F==0: 


63 32 31 1211109 8 7 6 43210 

| RESO PA 
Tota 
Inner[2:0] 


SH 
IMP DEF 
NOS 
LPAE 






This section describes the register value returned by the successful execution of an Address translation instruction. 
Software might subsequently write a different value to the register, and that write does not affect the operation of 
the PE. 
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On a successful conversion, the PAR can return a value that indicates the resulting attributes, rather than the values 
that appear in the translation table descriptors. More precisely: 


° Memory attribute fields are permitted to report the resulting attributes, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of reporting the values that appear in 
the translation table descriptors. This applies to the NOS, SH, Inner, and Outer fields. 


. See the NS bit description for constraints on the value it returns. 


Bits [63:32] 


Reserved, RESO. 


PA, bits [31:12] 


Output address. The output address (OA) corresponding to the supplied input address. This field 
returns address bits[3 1:12]. 


This field resets to an architecturally UNKNOWN value. 


LPAE, bit [11] 
When updating the PAR with the result of the translation operation, this bit is set as follows: 


Ob Short-descriptor translation table format used. This means the PAR returned a 32-bit 
value. 


This field resets to an architecturally UNKNOWN value. 


NOS, bit [10] 


Not Outer Shareable. When the returned value of PAR.SH is 1, indicates the Shareability attribute 
for the physical memory region: 


ObO Memory region is Outer Shareable. 
Qb1 Memory region is Inner Shareable. 
When the returned value of PAR.SH is 0 the value returned to this field is UNKNOWN. 


The value returned in this field can be the resulting attribute, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of the value that appears in 
the translation table descriptor. 


This field resets to an architecturally UNKNOWN value. 


NS, bit [9] 
Non-secure. The NS attribute for a translation table entry from a Secure translation regime. 


For a result from a Secure translation regime, this bit reflects the Security state of the physical 
address space of the translation. This means it reflects the effect of the NSTable bits of earlier levels 
of the translation table walk if those NSTable bits have an effect on the translation. 


For a result from a Non-secure translation regime, this bit is UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bit [8] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


SH, bit [7] 
Shareability. Indicates whether the physical memory region is Non-shareable: 
Qbd Memory is Non-shareable. 
Qb1 Memory is shareable, and PAR.NOS indicates whether the region is Outer Shareable or 
Inner Shareable. 

The value returned in this field can be the resulting attribute, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of the value that appears in 
the translation table descriptor. 
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This field resets to an architecturally UNKNOWN value. 


Inner[2:0], bits [6:4] 


Inner cacheability attribute for the region. Permitted values are: 
0b000 Non-cacheable. 

0b001 Device-nGnRnE. 

0b011 Device-nGnRE. 

0b101 Write-Back, Write-Allocate. 

0b110 Write-Through. 

0b111 Write-Back, no Write-Allocate. 

The values 0b010 and 0b100 are reserved. 


The value returned in this field can be the resulting attribute, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of the value that appears in 
the translation table descriptor. 


This field resets to an architecturally UNKNOWN value. 


Outer[1:0], bits [3:2] 


SS, bit [1] 


F, bit [0] 


G8-6224 


Outer cacheability attribute for the region. Permitted values are: 


0b00 Non-cacheable. 

b01 Write-Back, Write-Allocate. 

0b10 Write-Through, no Write-Allocate. 
Qb11 Write-Back, no Write-Allocate. 


The value returned in this field can be the resulting attribute, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of the value that appears in 
the translation table descriptor. 


This field resets to an architecturally UNKNOWN value. 


Supersection. Used to indicate if the result is a Supersection: 
ObO Result is not a Supersection. PAR[31:12] contains OA[31:12]. 
Qb1 Result is a Supersection, and: 

e PAR[31:24] contains OA[31:24]. 

. PAR[23:16] contains OA[39:32]. 


. PAR[15:12] contains 0b0000. 


If an implementation supports less than 40 bits of physical address, the bits in the PAR 
field that correspond to physical address bits that are not implemented are UNKNOWN. 


This field resets to an architecturally UNKNOWN value. 


Indicates whether the instruction performed a successful address translation. 
0bd Address translation completed successfully. 


This field resets to an architecturally UNKNOWN value. 
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When the instruction returned a 32-bit value to the PAR, PAR.F==1: 


32 31 1615 .. 12 11 10 7 6 1 


0 
RESO IMPLEMENTATION DEFINED RESO RESO FS 


fe es LPAE 


This section describes the register value returned by a fault on the execution of an Address translation instruction. 
Software might subsequently write a different value to the register, and that write does not affect the operation of 
the PE. 





Bits [63:32] 


Reserved, RESO. 


IMPLEMENTATION DEFINED, bits [31:16] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 
Bits [15:12] 
Reserved, RESO. 
LPAE, bit [11] 
When updating the PAR with the result of the translation operation, this bit is set as follows: 


0b0 Short-descriptor translation table format used. This means the PAR returned a 32-bit 
value. 


This field resets to an architecturally UNKNOWN value. 
Bits [10:7] 
Reserved, RESO. 
FS, bits [6:1] 
Fault status bits. Bits [12,10,3:0] from the DFSR, indicating the source of the abort. 


This field resets to an architecturally UNKNOWN value. 


F, bit [0] 
Indicates whether the instruction performed a successful address translation. 
Qb1 Address translation aborted. 


This field resets to an architecturally UNKNOWN value. 


When the instruction returned a 64-bit value to the PAR, PAR.F==0: 


56 55 40 39 1211109 8 7 6 1 0 


| Le IMP DEF 
LPAE 


This section describes the register value returned by the successful execution of an Address translation instruction. 
Software might subsequently write a different value to the register, and that write does not affect the operation of 
the PE. 
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On a successful conversion, the PAR can return a value that indicates the resulting attributes, rather than the values 
that appear in the translation table descriptors. More precisely: 


° Memory attribute fields are permitted to report the resulting attributes, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of reporting the values that appear in 
the translation table descriptors. This applies to the ATTR and SH fields. 


. See the NS bit description for constraints on the value it returns. 


ATTR, bits [63:56] 


Memory attributes for the returned output address. This field uses the same encoding as the Attr<n> 
fields in MAIRO and MAIRI. 


The value returned in this field can be the resulting attribute, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of the value that appears in 
the translation table descriptor. 


This field resets to an architecturally UNKNOWN value. 


Bits [55:40] 


Reserved, RESO. 


PA, bits [39:12] 


Output address. The output address (OA) corresponding to the supplied input address. This field 
returns address bits[39:12]. 


This field resets to an architecturally UNKNOWN value. 


LPAE, bit [11] 
When updating the PAR with the result of the translation operation, this bit is set as follows: 


Qb1 Long-descriptor translation table format used. This means the PAR returned a 64-bit 
value. 


This field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bit [10] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


NS, bit [9] 
Non-secure. The NS attribute for a translation table entry from a Secure translation regime. 


For a result from a Secure translation regime, this bit reflects the Security state of the physical 
address space of the translation. This means it reflects the effect of the NSTable bits of earlier levels 
of the translation table walk if those NSTable bits have an effect on the translation. 


For a result from a Non-secure translation regime, this bit is UNKNOWN. 
This field resets to an architecturally UNKNOWN value. 
SH, bits [8:7] 


Shareability attribute, for the returned output address. Permitted values are: 


Qbe0 Non-shareable. 
0b10 Outer Shareable. 
Qb11 Inner Shareable. 


The value 0b01 is reserved. 


Note 
This field returns the value @b10 for: 





. Any type of Device memory. 
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à Normal memory with both Inner Non-cacheable and Outer Non-cacheable attributes. 





The value returned in this field can be the resulting attribute, as determined by any permitted 
implementation choices and any applicable configuration bits, instead of the value that appears in 
the translation table descriptor. 


This field resets to an architecturally UNKNOWN value. 
Bits [6:1] 
Reserved, RESO. 
F, bit [0] 
Indicates whether the instruction performed a successful address translation. 


Qbd Address translation completed successfully. 


This field resets to an architecturally UNKNOWN value. 


When the instruction returned a 64-bit value to the PAR, PAR.F==1: 


63 56 55 52 51 48 47 1211109 8 7 6 1 


0 
RESO | | | FST 


IMP DEF | a RESO 
IMP DEF S2WLK 
IMP DEF FSTAGE 
RESO 
LPAE 


This section describes the register value returned by a fault on the execution of an Address translation instruction. 
Software might subsequently write a different value to the register, and that write does not affect the operation of 
the PE. 
IMPLEMENTATION DEFINED, bits [63:56] 

IMPLEMENTATION DEFINED. 

This field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bits [55:52] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bits [51:48] 
IMPLEMENTATION DEFINED. 
This field resets to an architecturally UNKNOWN value. 


Bits [47:12] 


Reserved, RESO. 


LPAE, bit [11] 
When updating the PAR with the result of the translation operation, this bit is set as follows: 


Qb1 Long-descriptor translation table format used. This means the PAR returned a 64-bit 
value. 


This field resets to an architecturally UNKNOWN value. 
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Bit [10] 
Reserved, RESO. 
FSTAGE, bit [9] 
Indicates the translation stage at which the translation aborted: 
Qbd Translation aborted because of a fault in the stage 1 translation. 
Qb1 Translation aborted because of a fault in the stage 2 translation. 


This field resets to an architecturally UNKNOWN value. 


S2WLK, bit [8] 


If this bit is set to 1, it indicates the translation aborted because of a stage 2 fault during a stage 1 
translation table walk. 


This field resets to an architecturally UNKNOWN value. 
Bit [7] 

Reserved, RESO. 
FST, bits [6:1] 


Fault status field. Values are as in the DFSR.STATUS and IFSR.STATUS fields when using the 
Long-descriptor translation table format. 


This field resets to an architecturally UNKNOWN value. 


F, bit [0] 
Indicates whether the instruction performed a successful address translation. 
Qb1 Address translation aborted. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob0111 0b0100 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return PAR_S<31:0>; 
else 
return PAR_NS<31:0>; 
else 
return PAR<31:0>; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return PAR_NS<31:0>; 
else 
return PAR<31:0>; 
elsif PSTATE.EL == EL3 then 
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if SCR.NS == 'Q' then 
return PAR_S<31:0>; 
else 
return PAR_NS<31:0>; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = O0b0111 0b0100 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
PAR_S = ZeroExtend(R[t]); 
else 
PAR_NS = ZeroExtend(R[t]); 
else 
PAR = ZeroExtend(R[t]); 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
PAR_NS = ZeroExtend(R[t]); 
else 
PAR = ZeroExtend(R[t]); 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
PAR_S = ZeroExtend(R[t]); 
else 





PAR_NS = ZeroExtend(R[t]); 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


coproc CRm opc1 





0b1111 0b0111 0b0000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return PAR_S; 
else 
return PAR_NS; 
else 
return PAR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return PAR_NS; 
else 
return PAR; 
elsif PSTATE.EL == EL3 then 
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if SCR.NS == 'Q' then 
return PAR_S; 
else 
return PAR_NS; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


coproc CRm 


opc1 





0b1111 0b0111 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T7 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T7 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
PAR_S = R[t2]:R[t]; 
else 
PAR_NS = R[t2]:R[t]; 
else 
PAR = R[t2]:R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
PAR_NS = R[t2]:R[t]; 
else 
PAR = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
PAR_S = R[t2]:R[t]; 
else 





PAR_NS = R[t2]:R[t]; 


0b0000 
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G8.2.119 PRRR, Primary Region Remap Register 


The PRRR characteristics are: 


Purpose 


Controls the top level mapping of the TEX[0], C, and B memory region attributes. 


Configurations 


AArch32 System register PRRR[3 1:0] is architecturally mapped to AArch64 System register 
MAIR _EL1[31:0]. 


MAIRO and PRRR are the same register, with a different view depending on the value of 
TTBCR.EAE: 


$ When it is set to 0, the register is as described in PRRR. 
; When it is set to 1, the register is as described in MAIRO. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
PRRR is a 32-bit register. 


Field descriptions 


The PRRR bit assignments are: 


When TTBCR.EAE == 0: 


31 30 29 28 27 26 25 24 23 20191817161514131211109 8 76543 2 1 0 





NOS7 — | 
NOS6 


NOS5 

NOS4 

NOS3 

NOS2 

NOS1 

NOSO 

NS1 

NSO 

DS1 

DSO 

NOS<n>, bit [n+24], for n = 0 to 7 
Not Outer Shareable. NOS<n> is the Outer Shareable property for memory attributes n, if the region 
is mapped as Normal memory that is not Inner Non-cacheable, Outer Non-cacheable, and the 
appropriate PRRR.{NSO, NS1} field identifies the region as shareable. n is the value of the 
concatenation of the {TEX[0], C, B} bits from the translation table descriptor. The possible values 
of each NOS<n> field other than NOS6 are: 
Qbe Memory region is Outer Shareable. 
Qb1 Memory region is Inner Shareable. 
The value of this bit is ignored if the region is: 
° Device memory 
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Bits [23:20] 


NS1, bit [19] 


NSO, bit [18] 


DS1, bit [17] 


DSO, bit [16] 


a Normal memory that is at least one of: 

— Imner Non-cacheable, Outer Non-cacheable. 

— Identified by the appropriate PRRR.{NS0, NS1} field as Non-shareable. 
The meaning of the NOS6 field is IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Mapping of S = 1 attribute for Normal memory regions. This field is used in determining the 
Shareability of a memory region that is mapped to Normal memory and both: 


. Is not Inner Non-cacheable, Outer Non-cacheable. 

° Has the S bit in the translation table descriptor set to 1. 
The possible values of this bit are: 

0b0 Region is Non-shareable. 


Qb1 Region is shareable. The value of the appropriate PRRR.NOS<n> field determines 
whether the region is Inner Shareable or Outer Shareable. 


This field resets to an architecturally UNKNOWN value. 


Mapping of S = 0 attribute for Normal memory regions. This field is used in determining the 
Shareability of a memory region that is mapped to Normal memory and both: 


. Is not Inner Non-cacheable, Outer Non-cacheable. 

° Has the S bit in the translation table descriptor set to 0. 
The possible values of this bit are: 

0b0 Region is Non-shareable. 


Qb1 Region is shareable. The value of the appropriate PRRR.NOS<n> field determines 
whether the region is Inner Shareable or Outer Shareable. 


This field resets to an architecturally UNKNOWN value. 


Mapping of S = 1 attribute for Device memory. From Armv§8, all types of Device memory are Outer 
Shareable, and therefore this bit is RES1. 


This field resets to an architecturally UNKNOWN value. 


Mapping of S = 0 attribute for Device memory. From Armv§8, all types of Device memory are Outer 
Shareable, and therefore this bit is RES]. 


This field resets to an architecturally UNKNOWN value. 


TR<n>, bits [2n+1:2n], for n = 0 to 7 


TR<n> is the primary TEX mapping for memory attributes n, and defines the mapped memory type 
for a region with attributes n. n is the value of the concatenation of the {TEX[0], C, B} bits from the 
translation table descriptor. The possible values for each field other than TR6 are: 


Oba Device-nGnRnE memory 
QbO1 Device-nGnRE memory 
0b10 Normal memory 


The value 0b11 is reserved. The effect of programming a field to 0b11 is CONSTRAINED 
UNPREDICTABLE, see Reserved values in System and memory-mapped registers and translation 
table entries on page K1-7628. 


G8-6232 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


ARM DDI 0487E.a 
ID070919 


AArch32 System Register Descriptions 
G8.2 General system control registers 


The meaning of the TR6 field is IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PRRR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm 


opc2 





Ob1111 0b000 = 0b1010 0b0010 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return PRRR_S; 
else 
return PRRR_NS; 
else 
return PRRR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return PRRR_NS; 
else 
return PRRR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return PRRR_S; 
else 
return PRRR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b1010 0b0010 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T10 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 
UNDEFINED; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP1ISSDISABLE2 == HIGH then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
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elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 


PRRR_S = R[t]; 
else 
PRRR_NS = R[t]; 
else 
PRRR = R[t]; 


elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
PRRR_NS = R[t]; 
else 
PRRR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' && CP15SDISABLE == HIGH then 


UNDEFINED; 
elsif SCR.NS == '@' && CP15SDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
PRRR_S = R[t]; 
else 
PRRR_NS = R[t]; 
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REVIDR, Revision ID Register 


The REVIDR characteristics are: 


Purpose 
Provides implementation-specific minor revision information. 
Configurations 
AArch32 System register REVIDR[31:0] is architecturally mapped to AArch64 System register 
REVIDR_EL1[31:0]. 
If REVIDR has the same value as MIDR, then its contents have no significance. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


REVIDR is a 32-bit register. 


Field descriptions 


The REVIDR bit assignments are: 


31 


0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 


IMPLEMENTATION DEFINED. 


Accessing the REVIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0000 0b0000 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 





return REVIDR; 
elsif PSTATE.EL == EL2 then 
return REVIDR; 
elsif PSTATE.EL == EL3 then 
return REVIDR; 


ARM DDI 0487E.a 


ID070919 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6235 
Non-Confidential 


AArch32 System Register Descriptions 
G8.2 General system control registers 


G8.2.121 


G8-6236 


RMR, Reset Management Register 


The RMR characteristics are: 


Purpose 
If EL1 or EL3 is the highest implemented Exception level and this register is implemented: 
$ A write to the register at the highest implemented Exception level can request a Warm reset. 


. If the highest implemented Exception level can use AArch32 and AArch64, this register 
specifies the Execution state that the PE boots into on a Warm reset. 


Configurations 


AArch32 System register RMR[31:0] is architecturally mapped to AArch64 System register 
RMR_EL1[31:0] when IsHighestEL(EL1). 


AArch32 System register RMR[31:0] is architecturally mapped to AArch64 System register 
RMR_EL3[31:0] when HaveEL(EL3). 


Only implemented if EL1 or EL3 is the highest implemented Exception level. In this case: 


è If the highest implemented Exception level can use AArch32 and AArch64 then this register 
must be implemented. 


- If the highest implemented Exception level cannot use AArch64 then it is IMPLEMENTATION 
DEFINED whether the register is implemented. 


See the field descriptions for the reset values. These apply whenever the register is implemented. 


Attributes 
RMR is a 32-bit register. 


Field descriptions 


The RMR bit assignments are: 


Bits [31:2] 


Reserved, RESO. 


RR, bit [1] 
Reset Request. Setting this bit to 1 requests a Warm reset. 


This field resets to Q. 


AA64, bit [0] 
When the highest implemented Exception level can use AArch64, determines which Execution state 
the PE boots into after a Warm reset: 


Ob AArch32. 
Qb1 AArché4. 


On coming out of the Warm reset, execution starts at the IMPLEMENTATION DEFINED reset vector 
address of the specified Execution state. 


If the highest implemented Exception level cannot use AArch64 this bit is RAZ/WI. 
When implemented as a RW field, this field resets to 0 on a Cold reset. 
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Accessing the RMR 


When EL3 is implemented, Arm deprecates accessing this register from any PE mode other than Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 




















coproc opct CRn CRm opc2 
Ob1111 0b000 = 0b1100 O0b0000 O0b010 
if PSTATE.EL IN {EL3, EL1} && IsHighestEL(PSTATE.EL) then 
return RMR; 
else 
UNDEFINED; 
MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
coproc opci1 CRn CRm opc2 
Ob1111 0b000 = 0b1100 O0b0000 O0b010 
if PSTATE.EL IN {EL3, EL1} && IsHighestEL(PSTATE.EL) then 
RMR = R[t]; 
else 
UNDEFINED; 
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G8.2.122 RVBAR, Reset Vector Base Address Register 


The RVBAR characteristics are: 


Purpose 
If EL3 is not implemented, contains the IMPLEMENTATION DEFINED address that execution starts 
from after reset when executing in AArch32 state. 

Configurations 
This register is only implemented if the highest Exception level implemented is capable of using 
AArch32, and is not EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


RVBAR is a 32-bit register. 


Field descriptions 


The RVBAR bit assignments are: 


31 1 0 


Reset Address[31:1] il 


Es RES1 


Bits [31:1] 
Reset Address[31:1]. Bits [31:1] of the IMPLEMENTATION DEFINED address that execution starts 
from after reset when executing in 32-bit state. 


Bit [0] 
Reserved, RES1. 


Accessing the RVBAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opci1 CRn CRm opc2 





Ob1111 0b000 = 0b1100 0b0000 0b001 





if PSTATE.EL IN {EL2, EL1} && IsHighestEL(PSTATE.EL) then 
return RVBAR; 


else 
UNDEFINED; 
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G8.2.123 SCR, Secure Configuration Register 
The SCR characteristics are: 


Purpose 


When EL3 is implemented and can use AArch32, defines the configuration of the current Security 
state. It specifies: 


. The Security state, either Secure or Non-secure. 
° What mode the PE branches to if an IRQ, FIQ, or External abort occurs. 
. Whether the CPSR.F or CPSR.A bits can be modified when SCR.NS== 


Configurations 


AArch32 System register SCR[31:0] can be mapped to AArch64 System register SCR_EL3[31:0], 
but this is not architecturally mandated. 


Some or all RW fields of this register have defined reset values. These apply whenever the register 
is accessible. This means they apply when the PE resets into EL3 using AArch32. 


Attributes 
SCR is a 32-bit register. 


Field descriptions 


The SCR bit assignments are: 


16 15 14 1312 11109876543210 





- Ro 


EA 
FW 
AW 
nET 

SCD 
HCE 
SIF 
RESO 
TWI 
TWE 
RESO 
TERR 


Bits [31:16] 


Reserved, RESO. 


TERR, bit [15] 
When RAS is implemented: 


Trap Error record accesses. Generate a Monitor Trap exception on accesses to the following 
registers from modes other than Monitor mode: 


ERRIDR, ERRSELR, ERXADDR, ERXADDR2, ERXCTLR, ERXCTLR2, ERXFR, ERXFR2, 
ERXMISCO0, ERXMISC1, ERXMISC2, ERXMISC3, and ERXSTATUS. When ARMV8.4-RAS is 
implemented, ERXMISC4, ERXMISC5, ERXMISC6, ERXMISC7. 


Qbd This control does not cause any instructions to be trapped. 
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Qb1 Accesses to the specified registers from modes other than Monitor mode generate a 
Monitor Trap exception. 


In a system where the PE resets into EL3, this field resets to 0. 


Otherwise: 


Bit [14] 


TWE, bit [13] 


TWI, bit [12] 


Bits [11:10] 


SIF, bit [9] 


Reserved, RESO. 


Reserved, RESO. 


Traps WFE instructions to Monitor mode. 
Qbd This control does not cause any instructions to be trapped. 


Qb1 Any attempt to execute a WFE instruction in any mode other than Monitor mode is 
trapped to Monitor mode, if the instruction would otherwise have caused the PE to enter 
a low-power state and the attempted execution does not generate an exception that is 
taken to EL1 or EL2 by SCTLR.nTWE or HCR.TWE. 


Any exception that is taken to EL1 or to EL2 has priority over this trap. 


The attempted execution of a conditional WFE instruction is only trapped if the instruction passes 
its condition code check. 


Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 








In a system where the PE resets into EL3, this field resets to 0. 


Traps WFI instructions to Monitor mode. 
0bd This control does not cause any instructions to be trapped. 


Qb1 Any attempt to execute a WFI instruction in any mode other than Monitor mode is 
trapped to Monitor mode, if the instruction would otherwise have caused the PE to enter 
a low-power state and the attempted execution does not generate an exception that is 
taken to EL1 or EL2 by SCTLR.nTWI or HCR.TWI. 


Any exception that is taken to EL1 or to EL2 has priority over this trap. 


The attempted execution of a conditional WFI instruction is only trapped if the instruction passes 
its condition code check. 





Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 





In a system where the PE resets into EL3, this field resets to 0. 


Reserved, RESO. 


Secure instruction fetch. When the PE is in Secure state, this bit disables instruction fetch from 
Non-secure memory. The possible values for this bit are: 


ObO Secure state instruction fetches from Non-secure memory are permitted. 
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Qb1 Secure state instruction fetches from Non-secure memory are not permitted. 
This bit is permitted to be cached in a TLB. 
In a system where the PE resets into EL3, this field resets to 0. 

HCE, bit [8] 


Hypervisor Call instruction enable. If EL2 is implemented, enables execution of HVC instructions 
at Non-secure EL1 and EL2. 


Ob HVC instructions are: 
° UNDEFINED at Non-secure EL1. The Undefined Instruction exception is taken 
from PL1 to PL1. 
° UNPREDICTABLE at EL2. Behavior is one of the following: 


— The instruction is UNDEFINED. 
— The instruction executes as a NOP. 
Qb1 HVC instructions are enabled at Non-secure EL] and EL2. 


Note 
HVC instructions are always UNDEFINED at ELO and in Secure state. 








If EL2 is not implemented, this bit is RESO and HVC is UNDEFINED. 


In a system where the PE resets into EL3, this field resets to 0. 


SCD, bit [7] 
Secure Monitor Call disable. Disables SMC instructions. 
QbO SMC instructions are enabled. 


Qb1 In Non-secure state, SMC instructions are UNDEFINED. The Undefined Instruction 
exception is taken from the current Exception level to the current Exception level. 


In Secure state, behavior is one of the following: 


° The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
Note 





SMC instructions are always UNDEFINED at PLO. 





In a system where the PE resets into EL3, this field resets to 0. 


nET, bit [6] 


Not Early Termination. This bit disables early termination. The possible values of this bit are: 


Qbd Early termination permitted. Execution time of data operations can depend on the data 
values. 
Qb1 Disable early termination. The number of cycles required for data operations is forced 


to be independent of the data values. 


This IMPLEMENTATION DEFINED mechanism can disable data dependent timing optimizations from 
multiplies and data operations. It can provide system support against information leakage that might 
be exploited by timing correlation types of attack. 


On implementations that do not support early termination or do not support disabling early 
termination, this bit is RESO. 


In a system where the PE resets into EL3, this field resets to 0. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6241 
ID070919 Non-Confidential 


AArch32 System Register Descriptions 


G8.2 General system control registers 


AW, bit [5] 


FW, bit [4] 


EA, bit [3] 


FIQ, bit [2] 


IRQ, bit [1] 


When the value of SCR.EA is | and the value of HCR.AMO is 0, this bit controls whether CPSR.A 
masks an External abort taken from Non-secure state, and the possible values of this bit are: 


Qbd External aborts taken from Non-secure state are not masked by CPSR.A, and are taken 
to EL3. 
External aborts taken from Secure state are masked by CPSR.A. 

Qb1 External aborts taken from either Security state are masked by CPSR.A. When CPSR.A 


is 0, the abort is taken to EL3. 
When SCR.EA is 0 or HCR.AMO is 1, this bit has no effect. 


In a system where the PE resets into EL3, this field resets to 0. 


When the value of SCR.FIQ is 1 and the value of HCR.FMO is 0, this bit controls whether CPSR.F 
masks an FIQ interrupt taken from Non-secure state, and the possible values of this bit are: 


Qbd An FIQ taken from Non-secure state is not masked by CPSR.F, and is taken to EL3. 
An FIQ taken from Secure state is masked by CPSR.F. 
Qb1 An FIQ taken from either Security state is masked by CPSR.F. When CPSR.F is 0, the 


FIQ is taken to EL3. 
When SCR.FIQ is 0 or HCR.FMO is 1, this bit has no effect. 
In a system where the PE resets into EL3, this field resets to 0. 


External Abort handler. This bit controls which mode takes External aborts. The possible values of 
this bit are: 


Oba External aborts taken to Abort mode. 
Qb1 External aborts taken to Monitor mode. 


In a system where the PE resets into EL3, this field resets to 0. 


FIQ handler. This bit controls which mode takes FIQ exceptions. The possible values of this bit are: 
Ob FIQs taken to FIQ mode. 
Qb1 FIQs taken to Monitor mode. 


In a system where the PE resets into EL3, this field resets to 0. 


IRQ handler. This bit controls which mode takes IRQ exceptions. The possible values of this bit are: 
Ob IRQs taken to IRQ mode. 

Qb1 IRQs taken to Monitor mode. 

In a system where the PE resets into EL3, this field resets to 0. 


NS, bit [0] 
Non-secure bit. Except when the PE is in Monitor mode, this bit determines the Security state of the 
PE: 
Qbd PE is in Secure state. 
Qb1 PE is in Non-secure state. 
If the HCR.TGE bit is set, an attempt to change from a Secure PL1 mode to a Non-secure EL1 mode 
by changing the SCR.NS bit from 0 to 1 results in the SCR.NS bit remaining as 0. 
In a system where the PE resets into EL3, this field resets to 0. 
G8-6242 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


ARM DDI 0487E.a 


AArch32 System Register Descriptions 
G8.2 General system control registers 


Accessing the SCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b0001 0b0001 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == '@1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return SCR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm 


opc2 





Ob1111 0b000 = 0b0001 O0b0001 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == '@1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
SCR = R[t]; 
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G8.2.124 SCTLR, System Control Register 
The SCTLR characteristics are: 


Purpose 


Provides the top level control of the system, including its memory system. 


Configurations 


AArch32 System register SCTLR[3 1:0] is architecturally mapped to AArch64 System register 
SCTLR_EL1[31:0]. 


Some bits in the register are read-only. These bits relate to non-configurable features of an 
implementation, and are provided for compatibility with previous versions of the architecture. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. If the PE resets into EL3 using AArch32 they apply 
only to the Secure instance of the register. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
SCTLR is a 32-bit register. 


Field descriptions 


The SCTLR bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 12 1110 9 8 76543210 





DSSBS — | | a nTLSMD 
AFE LSMAOE 





TRE CP15BEN 

RESO UNK 
EE ITD 
RESO SED 
SPAN RESO 

RES1 EnRCTX 
RESO RES1 

UWXN RESO 

WXN 

nTWE 

RESO 

nTWI 


DSSBS, bit [31] 
When ARMV8.0-SSBS is implemented: 
Default PSTATE.SSBS value on Exception Entry. The defined values are: 





Qbd PSTATE.SSBS is set to 0 on an exception to any mode in this security state except Hyp 
mode 
Qb1 PSTATE.SSBS is set to 1 on an exception to any mode in this security state except Hyp 
mode 
Note 


When EL3 is implemented and is using AArch32, this bit is banked between the two Security states. 





G8-6244 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch32 System Register Descriptions 
G8.2 General system control registers 


This field resets to an IMPLEMENTATION DEFINED value. 
Otherwise: 


Reserved, RESO. 


TE, bit [30] 


T32 Exception Enable. This bit controls whether exceptions to an Exception Level that is executing 
at PLI are taken to A32 or T32 state: 


Qbd Exceptions, including reset, taken to A32 state. 

Qb1 Exceptions, including reset, taken to T32 state. 

This field resets to an IMPLEMENTATION DEFINED choice between: 
è 0. 

° a value determined by an input configuration signal. 


AFE, bit [29] 


Access Flag Enable. When using the Short-descriptor translation table format for the PL1 &0 
translation regime, this bit enables use of the AP[0] bit in the translation descriptors as the Access 
flag, and restricts access permissions in the translation descriptors to the simplified model. The 
possible values of this bit are: 


Qbd In the translation table descriptors, AP[0] is an access permissions bit. The full range of 
access permissions is supported. No Access flag is implemented. 


Qb1 In the translation table descriptors, AP[0] is the Access flag. Only the simplified model 
for access permissions is supported. 


When using the Long-descriptor translation table format, the VMSA behaves as if this bit is set to 
1, regardless of the value of this bit. 


The AFE bit is permitted to be cached in a TLB. 
This field resets to 0. 


TRE, bit [28] 


TEX remap enable. This bit enables remapping of the TEX[2:1] bits in the PL1&0 translation 
regime for use as two translation table bits that can be managed by the operating system. Enabling 
this remapping also changes the scheme used to describe the memory region attributes in the 
VMSA. The possible values of this bit are: 


ObO TEX remap disabled. TEX[2:0] are used, with the C and B bits, to describe the memory 
region attributes. 


Qb1 TEX remap enabled. TEX[2:1] are reassigned for use as bits managed by the operating 
system. The TEX[0], C, and B bits are used to describe the memory region attributes, 
with the MMU remap registers. 


When the value of TTBCR.EAE is 1, this bit is RES]. 
The TRE bit is permitted to be cached in a TLB. 
This field resets to 0. 


Bits [27:26] 


Reserved, RESO. 


EE, bit [25] 


The value of the PSTATE.E bit on branch to an exception vector or coming out of reset, and the 
endianness of stage 1 translation table walks in the PL1&0 translation regime. 


The possible values of this bit are: 


Qbd Little-endian. PSTATE.E is cleared to 0 on taking an exception or coming out of reset. 
Stage 1 translation table walks in the PL1&0 translation regime are little-endian. 


Qb1 Big-endian. PSTATE.E is set to 1 on taking an exception or coming out of reset. Stage 
1 translation table walks in the PL1&0 translation regime are big-endian. 
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If an implementation does not provide Big-endian support for data accesses at Exception Levels 
higher than ELO, this bit is RESO. 


If an implementation does not provide Little-endian support for data accesses at Exception Levels 
higher than ELO, this bit is RES1. 


This field resets to an IMPLEMENTATION DEFINED choice between: 
g 0. 
° a value determined by an input configuration signal. 

Bit [24] 


Reserved, RESO. 


SPAN, bit [23] 
When ARMV8.1-PAN is implemented: 


Set Privileged Access Never, on taking an exception to EL1 from either Secure or Non-secure state, 
or to EL3 from Secure state when EL3 is using AArch32. 


Qbd CPSR.PAN is set to 1 in the following situations: 
. In Non-secure state, on taking an exception to EL1. 
s In Secure state, when EL3 is using AArch64, on taking an exception to EL1. 
. In Secure state, when EL3 is using AArch32, on taking an exception to EL3. 
Qb1 The value of CPSR.PAN is left unchanged on taking an exception to EL1. 
This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RES1. 
Bit [22] 

Reserved, RES]. 
Bit [21] 

Reserved, RESO. 
UWXN, bit [20] 


Unprivileged write permission implies PL1 XN (Execute-never). This bit can force all memory 
regions that are writable at PLO to be treated as XN for accesses from software executing at PL1. 
The possible values of this bit are: 


0bd This control has no effect on memory access permissions. 
Qb1 Any region that is writable at PLO forced to XN for accesses from software executing 
at PL1. 


The UWXN bit is permitted to be cached in a TLB. 
This field resets to 0. 


WXN, bit [19] 


Write permission implies XN (Execute-never). For the PL1&0 translation regime, this bit can force 
all memory regions that are writable to be treated as XN. The possible values of this bit are: 
0bd This control has no effect on memory access permissions. 


Qb1 Any region that is writable in the PL1&0 translation regime is forced to XN for accesses 
from software executing at PL1 or PLO. 


The WXN bit is permitted to be cached in a TLB. 
This field resets to 0. 
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nTWE, bit [18] 
Traps ELO execution of WFE instructions to Undefined mode. 


Qbd Any attempt to execute a WFE instruction at ELO is trapped to Undefined mode, if the 
instruction would otherwise have caused the PE to enter a low-power state. 


Qb1 This control does not cause any instructions to be trapped. 

The attempted execution of a conditional WFE instruction is only trapped if the instruction passes 
its condition code check. 

Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 








This field resets to 1. 


Bit [17] 


Reserved, RESO. 


nTWL, bit [16] 
Traps ELO execution of WFI instructions to Undefined mode. 


Qbd Any attempt to execute a WFI instruction at ELO is trapped to Undefined mode, if the 
instruction would otherwise have caused the PE to enter a low-power state. 


Qb1 This control does not cause any instructions to be trapped. 


The attempted execution of a conditional WFI instruction is only trapped if the instruction passes 
its condition code check. 





Note 


Since a WFE or WFI can complete at any time, even without a Wakeup event, the traps on WFE of 
WFI are not guaranteed to be taken, even if the WFE or WFI is executed when there is no Wakeup 
event. The only guarantee is that if the instruction does not complete in finite time in the absence of 
a Wakeup event, the trap will be taken. 


This field resets to 1. 


Bits [15:14] 


Reserved, RESO. 


V, bit [13] 


Vectors bit. This bit selects the base address of the exception vectors for exceptions taken to a PE 
mode other than Monitor mode or Hyp mode: 


0bd Normal exception vectors. Base address is held in VBAR. 


Qb1 High exception vectors (Hivecs), base address 0xFFFF0000. This base address cannot be 
remapped. 


This field resets to an IMPLEMENTATION DEFINED choice between: 
° Q. 


è a value determined by an input configuration signal. 
I, bit [12] 
Instruction access Cacheability control, for accesses at EL1 and ELO: 


Qbd All instruction access to Normal memory from PL1 and PLO are Non-cacheable for all 
levels of instruction and unified cache. 
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Bit [11] 


If the value of SCTLR.M is 0, instruction accesses from stage 1 of the PL1&0 
translation regime are to Normal, Outer Shareable, Inner Non-cacheable, Outer 
Non-cacheable memory. 


Qb1 All instruction access to Normal memory from PL1 and PLO can be cached at all levels 
of instruction and unified cache. 


If the value of SCTLR.M is 0, instruction accesses from stage 1 of the PL1&0 
translation regime are to Normal, Outer Shareable, Inner Write-Through, Outer 
Write-Through memory. 


Instruction accesses to Normal memory from EL1 and ELO are Cacheable regardless of the value of 
the SCTLR.I bit if either: 


è EL2 is using AArch32 and the value of HCR.DC is 1. 
G EL2 is using AArch64 and the value of HCR_EL2.DC is 1. 
This field resets to 0. 


Reserved, RES1. 


EnRCTX, bit [10] 
When ARMV8.0-CSV2 is implemented: 


Enable ELO Access to the AArch32 CFPRCTX, DVPRCTX and CPPRCTX instructions. The 
defined values are: 


Qbd ELO access to these instructions is disabled, and these instructions are trapped to EL1. 
Qb1 ELO access to these instructions is enabled. 
Note 





When EL3 is implemented and is using AArch32, this bit is banked between the two Security states. 





This field resets to an architecturally UNKNOWN value. 


Otherwise: 


Bit [9] 


SED, bit [8] 


ITD, bit [7] 


Reserved, RESO. 


Reserved, RESO. 


SETEND instruction disable. Disables SETEND instructions at PLO and PL1. 
b0 SETEND instruction execution is enabled at PLO and PL1. 
Qb1 SETEND instructions are UNDEFINED at PLO and PL1. 


If the implementation does not support mixed-endian operation at any Exception level, this bit is 
RESİ. 


This field resets to 0. 


IT Disable. Disables some uses of IT instructions at PL1 and PLO. 
Qbd All IT instruction functionality is enabled at PL1 and PLO. 
Qb1 Any attempt at PL1 or PLO to execute any of the following is UNDEFINED: 
a All encodings of the IT instruction with hw1[3:0]!=1000. 
s All encodings of the subsequent instruction with the following values for hw1: 


— 11XXXXXXXXXXXXXX: All 32-bit instructions, and the 16-bit instructions B, 
UDF, SVC, LDM, and STM. 
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— 1011xxxxxxxxxxxx: All instructions in Miscellaneous 16-bit instructions 
on page F3-3943. 


— 10100xxxxxxxxxxx: ADD Rd, PC, #imm 
— 01001xxxxxxxxxxx: LDR Rd, [PC, #imm] 


— 0100x1xxx1111xxx: ADD Rdn, PC; CMP Rn, PC; MOV Rd, PC; BX PC; 
BLX PC. 

— 010001xx1xxxx111: ADD PC, Rm; CMP PC, Rm; MOV PC, Rm. This 
pattern also covers unpredictable cases with BLX Rn. 


These instructions are always UNDEFINED, regardless of whether they would pass or fail 
the condition code check that applies to them as a result of being in an IT block. 


It is IMPLEMENTATION DEFINED whether the IT instruction is treated as: 
s A 16-bit instruction, that can only be followed by another 16-bit instruction. 
. The first half of a 32-bit instruction. 


This means that, for the situations that are UNDEFINED, either the second 16-bit 
instruction or the 32-bit instruction is UNDEFINED. 


An implementation might vary dynamically as to whether IT is treated as a 16-bit 
instruction or the first half of a 32-bit instruction. 


If an instruction in an active IT block that would be disabled by this field sets this field to 1 then 
behavior is CONSTRAINED UNPREDICTABLE. For more information see Changes to an ITD control by 
an instruction in an IT block on page E1-3792. 


ITD is optional, but if it is implemented in the SCTLR then it must also be implemented in the 
SCTLR_ELI. If it is not implemented then this bit is RAZ/WI. 


This field resets to Q. 


Writes to this bit are IGNORED. Reads of this bit return an UNKNOWN value. 


This field resets to an architecturally UNKNOWN value. 


CP15BEN, bit [5] 


System instruction memory barrier enable. Enables accesses to the DMB, DSB, and ISB System 
instructions in the (coproc==0b1111) encoding space from PL1 and PLO: 


Qbd PLO and PL1 execution of the CP15DMB, CP15DSB, and CP15ISB instructions is 
UNDEFINED. 

Qb1 PLO and PL1 execution of the CP15DMB, CP15DSB, and CP15ISB instructions is 
enabled. 


CP15BEN is optional, but if it is implemented in the SCTLR then it must also be implemented in 
the SCTLR_EL1. If it is not implemented then this bit is RAO/WI. 


This field resets to 1. 


LSMAOE, bit [4] 
When ARMV8.2-LSMAOC is implemented: 


Load Multiple and Store Multiple Atomicity and Ordering Enable. 


Qbd For all memory accesses at EL1 or ELO, A32 and T32 Load Multiple and Store Multiple 
can have an interrupt taken during the sequence memory accesses, and the memory 
accesses are not required to be ordered. 


Qb1 The ordering and interrupt behavior of A32 and T32 Load Multiple and Store Multiple 
at EL1 or ELO is as defined for Armv8.0. 


This bit is permitted to be cached in a TLB. 
This field resets to 1. 


Otherwise: 


Reserved, RES1. 
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nTLSMD, bit [3] 
When ARMV8.2-LSMAOC is implemented: 


No Trap Load Multiple and Store Multiple to Device-nGRE/Device-nGnRE/Device-nGnRnE 
memory. 


Qbd All memory accesses by A32 and T32 Load Multiple and Store Multiple at EL1 or ELO 
that are marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory 
are trapped and generate a stage 1 Alignment fault. 


Qb1 All memory accesses by A32 and T32 Load Multiple and Store Multiple at EL1 or ELO 
that are marked at stage 1 as Device-nGRE/Device-nGnRE/Device-nGnRnE memory 
are not trapped. 


This bit is permitted to be cached in a TLB. 
This field resets to 1. 
Otherwise: 


Reserved, RES1. 


C, bit [2] 
Cacheability control, for data accesses at EL1 and ELO: 
Qbd All data access to Normal memory from PL1 and PLO, and all accesses to the PL1&0 
stage | translation tables, are Non-cacheable for all levels of data and unified cache. 
Qb1 All data access to Normal memory from PL1 and PLO, and all accesses to the PL1&0 
stage | translation tables, can be cached at all levels of data and unified cache. 
The PE ignores SCLTR.C for Non-secure state and data accesses to Normal memory from EL1 and 
ELO are Cacheable if either: 
. EL2 is using AArch32 and the value of HCR.DC is 1. 
: EL2 is using AArch64 and the value of HCR_EL2.DC is 1. 
This field resets to 0. 
A, bit [1] 
Alignment check enable. This is the enable bit for Alignment fault checking at PL1 and PLO: 
Qbd Alignment fault checking disabled when executing at PL1 or PLO. 
Instructions that load or store one or more registers, other than load/store exclusive and 
load-acquire/store-release, do not check that the address being accessed is aligned to the 
size of the data element(s) being accessed. 
Qb1 Alignment fault checking enabled when executing at PL1 or PLO. 
All instructions that load or store one or more registers have an alignment check that the 
address being accessed is aligned to the size of the data element(s) being accessed. If 
this check fails it causes an Alignment fault, which is taken as a Data Abort exception. 
Load/store exclusive and load-acquire/store-release instructions have an alignment check regardless 
of the value of the A bit. 
This field resets to 0. 
M, bit [0] 
MMU enable for EL1 and ELO stage 1 address translation. Possible values of this bit are: 
Qbd ELI and ELO stage 1 address translation disabled. 
See the SCTLR.I field for the behavior of instruction accesses to Normal memory. 
Qb1 ELI and ELO stage 1 address translation enabled. 
In the Non-secure state the PE behaves as if the value of the SCTLR.M field is 0 for all purposes 
other than returning the value of a direct read of the field if either: 
: EL2 is using AArch32 and the value of HCR. {DC, TGE} is not {0, 0}. 
$ EL2 is using AArch64 and the value of HCR_EL2.{DC, TGE} is not {0, 0}. 
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This field resets to Q. 


Accessing the SCTLR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b0001 0b0000 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return SCTLR_S; 
else 
return SCTLR_NS; 
else 
return SCTLR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return SCTLR_NS; 
else 
return SCTLR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return SCTLR_S; 
else 





return SCTLR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


Ob1111 0b000 0b0001 0b0000 


opc2 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 
UNDEFINED; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPISSDISABLE2 == HIGH then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
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elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
SCTLR_S = R[t]; 
else 
SCTLR_NS = R[t]; 
else 
SCTLR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
SCTLR_NS = R[t]; 
else 
SCTLR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q@' && CPLISSDISABLE == HIGH then 
UNDEFINED; 
elsif SCR.NS == 'Q' && CPISSDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
SCTLR_S = R[t]; 
else 
SCTLR_NS = R[t]; 
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G8.2.125 SPSR, Saved Program Status Register 


ARM DDI 0487E.a 
ID070919 


The SPSR characteristics are: 


Purpose 
Holds the saved process state for the current mode. 

Configurations 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


SPSR is a 32-bit register. 


Field descriptions 


The SPSR bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 1615 1098765 4 3 





A Sc CO 

IT[1:0] gs = al eer 
SSBS 

PAN 
DIT 


N, bit [31] 


Z, bit [30] 


C, bit [29] 


V, bit [28] 


Q, bit [27] 


Set to the value of PSTATE.N on taking an exception to the current mode, and copied to PSTATE.N 
on executing an exception return operation in the current mode. 


Set to the value of PSTATE.Z on taking an exception to the current mode, and copied to PSTATE.Z 
on executing an exception return operation in the current mode. 


Set to the value of PSTATE.C on taking an exception to the current mode, and copied to PSTATE.C 
on executing an exception return operation in the current mode. 


Set to the value of PSTATE.V on taking an exception to the current mode, and copied to PSTATE.V 
on executing an exception return operation in the current mode. 


Set to the value of PSTATE.Q on taking an exception to the current mode, and copied to PSTATE.Q 
on executing an exception return operation in the current mode. 


IT[1:0], bits [26:25] 


J, bit [24] 


IT block state bits for the T32 IT (If-Then) instruction. See IT[7:2] for explanation of this field. 


RESO. 


In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
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SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass Safe. This bit is set to the value of PSTATE.SSBS on taking an exception 
to the current mode, and copied to PSTATE.SSBS on executing an exception return operation in the 
current mode. 


Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. This bit is set to the value of PSTATE.PAN on taking an exception to the 
current mode, and copied to PSTATE.PAN on executing an exception return operation in the current 
mode. 


Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. This bit is set to the value of PSTATE.DIT on taking an exception to the 
current mode, and copied to PSTATE.DIT on executing an exception return operation in the current 
mode. 


Otherwise: 


Reserved, RESO. 


IL, bit [20] 
Illegal Execution state bit. Shows the value of PSTATE.IL immediately before the exception was 
taken. 
GE, bits [19:16] 
Greater than or Equal flags, for parallel addition and subtraction. 
IT[7:2], bits [15:10] 
IT block state bits for the T32 IT (If-Then) instruction. This field must be interpreted in two parts. 


° IT[7:5] holds the base condition for the IT block. The base condition is the top 3 bits of the 
condition code specified by the first condition field of the IT instruction. 


° IT[4:0] encodes the size of the IT block, which is the number of instructions that are to be 
conditionally executed, by the position of the least significant 1 in this field. It also encodes 
the value of the least significant bit of the condition code for each instruction in the block. 


The IT field is 0b00000000 when no IT block is active. 


E, bit [9] 
Endianness state bit. Controls the load and store endianness for data accesses: 
0b0ð Little-endian operation 
Qb1 Big-endian operation. 
Instruction fetches ignore this bit. 


If an implementation does not provide Big-endian support, this bit is RESO. If it does not provide 
Little-endian support, this bit is RES1. 


If an implementation provides Big-endian support but only at ELO, this bit is RESO for an exception 
return to any Exception level other than ELO. 


Likewise, if it provides Little-endian support only at ELO, this bit is RES] for an exception return to 
any Exception level other than ELO. 


G8-6254 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch32 System Register Descriptions 
G8.2 General system control registers 


When the reset value of the SCTLR.EE bit is defined by a configuration input signal, that value also 
applies to the CPSR.E bit on reset, and therefore applies to software execution from reset. 


A, bit [8] 
SError interrupt mask bit. 
Qbd Exception not masked. 
Qb1 Exception masked. 

I, bit [7] 
IRQ mask bit. 
Qbd Exception not masked. 
Qb1 Exception masked. 

F, bit [6] 
FIQ mask bit. 
Qbd Exception not masked. 
Qb1 Exception masked. 

T, bit [5] 
T32 Instruction set state bit. Determines the AArch32 instruction set state that the exception was 
taken from. 
Qbd Taken from A32 state. 
Qb1 Taken from T32 state. 


M/[4], bit [4] 
Execution state that the exception was taken from. 


Qb1 Exception taken from AArch32. 


M[3:0], bits [3:0] 
AArch32 mode that an exception was taken from. 
0b0000 User. 
0b0001 FIQ. 
0b0010 IRQ. 
0b0011 Supervisor. 
0b0110 Monitor (only valid in Secure state, if EL3 is implemented and can use AArch32). 
0b0111 Abort. 
0b1010 Hyp. 
0b1011 Undefined. 
Qb1111 System. 


Other values are reserved. 
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G8.2.126 SPSR_abt, Saved Program Status Register (Abort mode) 


The SPSR_abt characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to Abort mode. 
Configurations 
AArch32 System register SPSR_abt[31:0] is architecturally mapped to AArch64 System register 
SPSR_abt[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_abt is a 32-bit register. 


Field descriptions 


The SPSR_abt bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 1615 1098765 4 





IT[1:0] See 
SSBS 


PAN 
DIT 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to Abort mode, and 
copied to PSTATE.N on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to Abort mode, and 
copied to PSTATE.Z on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to Abort mode, and 
copied to PSTATE.C on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to Abort mode, and 
copied to PSTATE.V on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


Q, bit [27] 
Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to Abort mode, 
and copied to PSTATE.Q on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 
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IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to Abort mode, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in Abort mode. 


On executing an exception return operation in Abort mode SPSR_abt.IT must contain a value that 
is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to Abort mode, 
and copied to PSTATE.SSBS on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to Abort mode, 
and copied to PSTATE.PAN on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to Abort mode, 
and copied to PSTATE.DIT on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to Abort mode, and 
copied to PSTATE.IL on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to Abort mode, 
and copied to PSTATE.GE on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to Abort mode, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in Abort mode. 


SPSR_abt.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 
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G8-6258 


E, bit [9] 


Endianness. Set to the value of PSTATE.E on taking an exception to Abort mode, and copied to 
PSTATE.E on executing an exception return operation in Abort mode. 


If the implementation does not support big-endian operation, SPSR_abt.E is RESO. If the 
implementation does not support little-endian operation, SPSR_abt.E is RES1. On executing an 
exception return operation in Abort mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_abt.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_abt.E is 
RESİ. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to Abort mode, and 
copied to PSTATE.A on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to Abort mode, and copied 
to PSTATE.I on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to Abort mode, and copied 
to PSTATE.F on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to Abort mode, and 
copied to PSTATE.T on executing an exception return operation in Abort mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to Abort mode, and copied to 
PSTATE.M[4:0] on executing an exception return operation in Abort mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10111 Abort. 
0b11011 Undefined. 
Qb11111 System. 





Other values are reserved. If SPSR_abt.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in Abort mode is an illegal 
return event, as described in J//egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_abt 


SPSR_abt is accessible in all modes other than User mode and Abort mode. For more details, see MRS (Banked 
register) and MSR (Banked register) in the Arm® Architecture Reference Manual, Armv8, for Armv8-A 
architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS{<c>}{<q>} <Rd>, SPSR_abt 





R M M1 


Obl Obl 0b0100 





MSR{<c>}{<q>} SPSR_abt, <Rn> 





R M M1 





Obl Obl 0b0100 
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G8.2.127 SPSR_fiq, Saved Program Status Register (FIQ mode) 


The SPSR_fiq characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to FIQ mode. 
Configurations 
AArch32 System register SPSR_fiq[31:0] is architecturally mapped to AArch64 System register 
SPSR_fiq[3 1:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_fiq is a 32-bit register. 


Field descriptions 


The SPSR_fiq bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 1615 1098765 4 





IT[1:0] See 
SSBS 

PAN 

DIT 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to FIQ mode, and 
copied to PSTATE.N on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to FIQ mode, and copied 
to PSTATE.Z on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to FIQ mode, and copied 
to PSTATE.C on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to FIQ mode, and 
copied to PSTATE.V on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


Q, bit [27] 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to FIQ mode, and 
copied to PSTATE.Q on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 
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IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to FIQ mode, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in FIQ mode. 


On executing an exception return operation in FIQ mode SPSR_fiq.IT must contain a value that is 
valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to FIQ mode, 
and copied to PSTATE.SSBS on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to FIQ mode, and 
copied to PSTATE.PAN on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to FIQ mode, 
and copied to PSTATE.DIT on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to FIQ mode, and 
copied to PSTATE.IL on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to FIQ mode, 
and copied to PSTATE.GE on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to FIQ mode, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in FIQ mode. 


SPSR_fiq.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 
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G8-6262 


E, bit [9] 


Endianness. Set to the value of PSTATE.E on taking an exception to FIQ mode, and copied to 
PSTATE.E on executing an exception return operation in FIQ mode. 


If the implementation does not support big-endian operation, SPSR_fiq.E is RESO. If the 
implementation does not support little-endian operation, SPSR_fiq.E is RES1. On executing an 
exception return operation in FIQ mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_fiq.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_fiq.E is 
RESİ. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to FIQ mode, and 
copied to PSTATE.A on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to FIQ mode, and copied 
to PSTATE.I on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to FIQ mode, and copied 
to PSTATE.F on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to FIQ mode, and 
copied to PSTATE.T on executing an exception return operation in FIQ mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to FIQ mode, and copied to 
PSTATE.M[4:0] on executing an exception return operation in FIQ mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10111 Abort. 
0b11011 Undefined. 
Qb11111 System. 





Other values are reserved. If SPSR_fiq.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in FIQ mode is an illegal 
return event, as described in J//egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_fiq 


SPSR_fiq is accessible in all modes other than User mode and FIQ mode. For more details, see MRS (Banked 
register) and MSR (Banked register) in the Arm® Architecture Reference Manual, Armv8, for Armv8-A 
architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS{<c>}{<q>} <Rd>, SPSR_fiq 





R M M1 


Obl Ob0 O0b1110 





MSR{<c>}{<q>} SPSR_fiq, <Rn> 





R M M1 





Obl Ob0 O0b1110 
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G8.2.128 SPSR_hyp, Saved Program Status Register (Hyp mode) 


The SPSR_hyp characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to Hyp mode. 
Configurations 
AArch32 System register SPSR_hyp[31:0] is architecturally mapped to AArch64 System register 
SPSR_EL2[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_hyp is a 32-bit register. 


Field descriptions 


The SPSR_hyp bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 1615 1098765 4 





IT[1:0] See 
SSBS 

PAN 

DIT 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to Hyp mode, and 
copied to PSTATE.N on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to Hyp mode, and copied 
to PSTATE.Z on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to Hyp mode, and copied 
to PSTATE.C on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to Hyp mode, and 
copied to PSTATE.V on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 


Q, bit [27] 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to Hyp mode, and 
copied to PSTATE.Q on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 


G8-6264 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch32 System Register Descriptions 
G8.2 General system control registers 


IT[1:0], bits [26:25] 
If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to Hyp mode, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in Hyp mode. 


On executing an exception return operation in Hyp mode SPSR_hyp.IT must contain a value that is 
valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to Hyp mode, 
and copied to PSTATE.SSBS on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to Hyp mode, and 
copied to PSTATE.PAN on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to Hyp mode, 
and copied to PSTATE.DIT on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to Hyp mode, and 
copied to PSTATE.IL on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to Hyp mode, 
and copied to PSTATE.GE on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to Hyp mode, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in Hyp mode. 


SPSR_hyp.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 
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G8-6266 


E, bit [9] 
Endianness. Set to the value of PSTATE.E on taking an exception to Hyp mode, and copied to 
PSTATE.E on executing an exception return operation in Hyp mode. 
If the implementation does not support big-endian operation, SPSR_hyp.E is RESO. If the 
implementation does not support little-endian operation, SPSR_hyp.E is RES1. On executing an 
exception return operation in Hyp mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_hyp.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_hyp.E is 
RES1. 
This field resets to an architecturally UNKNOWN value. 

A, bit [8] 
SError interrupt mask. Set to the value of PSTATE.A on taking an exception to Hyp mode, and 
copied to PSTATE.A on executing an exception return operation in Hyp mode. 
This field resets to an architecturally UNKNOWN value. 

I, bit [7] 
IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to Hyp mode, and copied 
to PSTATE.I on executing an exception return operation in Hyp mode. 
This field resets to an architecturally UNKNOWN value. 

F, bit [6] 
FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to Hyp mode, and copied 
to PSTATE.F on executing an exception return operation in Hyp mode. 
This field resets to an architecturally UNKNOWN value. 

T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to Hyp mode, and 
copied to PSTATE.T on executing an exception return operation in Hyp mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to Hyp mode, and copied to 
PSTATE.M[4:0] on executing an exception return operation in Hyp mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10111 Abort. 
0b11010 Hyp. 
0b11011 Undefined. 
0b11111 System. 





Other values are reserved. If SPSR_hyp.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in Hyp mode is an illegal 
return event, as described in ///egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_hyp 


SPSR_hyp is accessible only in Monitor mode. For more details, see MRS (Banked register) and MSR (Banked 
register) in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS{<c>}{<q>} <Rd>, SPSR_hyp 





R M M1 


Obl Obl Ob1110 





MSR{<c>}{<q>} SPSR_hyp, <Rn> 





R M M1 





Obl Obl Ob1110 
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G8.2.129 SPSR_irq, Saved Program Status Register (IRQ mode) 


The SPSR_irq characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to IRQ mode. 
Configurations 
AArch32 System register SPSR_irq[31:0] is architecturally mapped to AArch64 System register 
SPSR_irq[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_ irq is a 32-bit register. 


Field descriptions 


The SPSR_irq bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 1615 1098765 4 





IT[1:0] See 
SSBS 

PAN 

DIT 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to IRQ mode, and 
copied to PSTATE.N on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to IRQ mode, and copied 
to PSTATE.Z on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to IRQ mode, and copied 
to PSTATE.C on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to IRQ mode, and 
copied to PSTATE.V on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


Q, bit [27] 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to IRQ mode, and 
copied to PSTATE.Q on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 
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IT[1:0], bits [26:25] 
If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to IRQ mode, and copied to 
PSTATE.IT[1:0] on executing an exception return operation in IRQ mode. 


On executing an exception return operation in IRQ mode SPSR_irq.IT must contain a value that is 
valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to IRQ mode, 
and copied to PSTATE.SSBS on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to IRQ mode, and 
copied to PSTATE.PAN on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to IRQ mode, 
and copied to PSTATE.DIT on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to IRQ mode, and 
copied to PSTATE.IL on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to IRQ mode, 
and copied to PSTATE.GE on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to IRQ mode, and copied to 
PSTATE.IT[7:2] on executing an exception return operation in IRQ mode. 


SPSR_irq.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 
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E, bit [9] 
Endianness. Set to the value of PSTATE.E on taking an exception to IRQ mode, and copied to 
PSTATE.E on executing an exception return operation in IRQ mode. 
If the implementation does not support big-endian operation, SPSR_irq.E is RESO. If the 
implementation does not support little-endian operation, SPSR_irg.E is RES1. On executing an 
exception return operation in IRQ mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_irg.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_irq.E is 
RES1. 
This field resets to an architecturally UNKNOWN value. 

A, bit [8] 
SError interrupt mask. Set to the value of PSTATE.A on taking an exception to IRQ mode, and 
copied to PSTATE.A on executing an exception return operation in IRQ mode. 
This field resets to an architecturally UNKNOWN value. 

I, bit [7] 
IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to IRQ mode, and copied 
to PSTATE.I on executing an exception return operation in IRQ mode. 
This field resets to an architecturally UNKNOWN value. 

F, bit [6] 
FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to IRQ mode, and copied 
to PSTATE.F on executing an exception return operation in IRQ mode. 
This field resets to an architecturally UNKNOWN value. 

T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to IRQ mode, and 
copied to PSTATE.T on executing an exception return operation in IRQ mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to IRQ mode, and copied to 
PSTATE.M[4:0] on executing an exception return operation in IRQ mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10111 Abort. 
0b11011 Undefined. 
Qb11111 System. 





Other values are reserved. If SPSR_irg.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in IRQ mode is an illegal 
return event, as described in ///egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_irq 


SPSR_ irq is accessible in all modes other than User mode and IRQ mode. For more details, see MRS (Banked 
register) and MSR (Banked register) in the Arm® Architecture Reference Manual, Armv8, for Armv8-A 
architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS{<c>}{<q>} <Rd>, SPSR_irq 





R M M1 


Obl Obl 0b0000 





MSR{<c>}{<q>} SPSR_irq, <Rn> 





R M M1 





Obl Obl 0b0000 





ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6271 
ID070919 Non-Confidential 


AArch32 System Register Descriptions 
G8.2 General system control registers 


G8.2.130 SPSR_mon, Saved Program Status Register (Monitor mode) 


The SPSR_mon characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to Monitor mode. 
Configurations 
AArch32 System register SPSR_mon[31:0] can be mapped to AArch64 System register 
SPSR_EL3[31:0], but this is not architecturally mandated. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_mon is a 32-bit register. 


Field descriptions 


The SPSR_mon bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 1615 1098765 4 





IT[1:0] See 
SSBS 


PAN 
DIT 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to Monitor mode, 
and copied to PSTATE.N on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to Monitor mode, and 
copied to PSTATE.Z on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to Monitor mode, and 
copied to PSTATE.C on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to Monitor mode, 
and copied to PSTATE.V on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 


Q, bit [27] 
Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to Monitor mode, 
and copied to PSTATE.Q on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 
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IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to Monitor mode, and copied 
to PSTATE.IT[1:0] on executing an exception return operation in Monitor mode. 


On executing an exception return operation in Monitor mode SPSR_mon.IT must contain a value 
that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 


In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to Monitor 
mode, and copied to PSTATE.SSBS on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to Monitor mode, 
and copied to PSTATE.PAN on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMV8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to Monitor mode, 
and copied to PSTATE.DIT on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to Monitor mode, and 
copied to PSTATE.IL on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to Monitor 
mode, and copied to PSTATE.GE on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to Monitor mode, and copied 
to PSTATE.IT[7:2] on executing an exception return operation in Monitor mode. 


SPSR_mon.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 
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E, bit [9] 
Endianness. Set to the value of PSTATE.E on taking an exception to Monitor mode, and copied to 
PSTATE.E on executing an exception return operation in Monitor mode. 
If the implementation does not support big-endian operation, SPSR_mon.E is RESO. If the 
implementation does not support little-endian operation, SPSR_mon.E is RES1. On executing an 
exception return operation in Monitor mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_mon.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_mon.E is 
RES1. 
This field resets to an architecturally UNKNOWN value. 

A, bit [8] 
SError interrupt mask. Set to the value of PSTATE.A on taking an exception to Monitor mode, and 
copied to PSTATE.A on executing an exception return operation in Monitor mode. 
This field resets to an architecturally UNKNOWN value. 

I, bit [7] 
IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to Monitor mode, and 
copied to PSTATE.I on executing an exception return operation in Monitor mode. 
This field resets to an architecturally UNKNOWN value. 

F, bit [6] 
FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to Monitor mode, and 
copied to PSTATE.F on executing an exception return operation in Monitor mode. 
This field resets to an architecturally UNKNOWN value. 

T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to Monitor mode, 
and copied to PSTATE.T on executing an exception return operation in Monitor mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to Monitor mode, and copied to 
PSTATE.M[4:0] on executing an exception return operation in Monitor mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10110 = Monitor. 
0b10111 Abort. 
0b11010 Hyp. 
0b11011 Undefined. 
Qb11111 System. 





Other values are reserved. If SPSR_mon.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in Monitor mode is an 
illegal return event, as described in ///egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_mon 


SPSR_mon is only accessible in EL3 modes other than Monitor mode. For more details, see MRS (Banked register) 
and MSR (Banked register) in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 
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Accesses to this register use the following encodings in the System instruction encoding space: 


MRS{<c>}{<q>} <Rd>, SPSR_mon 


MSR{<c>}{<q>} SPSR_mon, <Rn> 
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G8.2.131 SPSR_svc, Saved Program Status Register (Supervisor mode) 


The SPSR_ sve characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to Supervisor mode. 
Configurations 
AArch32 System register SPSR_sve[31:0] is architecturally mapped to AArch64 System register 
SPSR_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_ sve is a 32-bit register. 


Field descriptions 


The SPSR_ sve bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 1615 1098765 4 





IT[1:0] See 
SSBS 


PAN 
DIT 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to Supervisor mode, 
and copied to PSTATE.N on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to Supervisor mode, and 
copied to PSTATE.Z on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to Supervisor mode, and 
copied to PSTATE.C on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to Supervisor mode, 
and copied to PSTATE.V on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


Q, bit [27] 
Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to Supervisor 
mode, and copied to PSTATE.Q on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 
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IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to Supervisor mode, and copied 
to PSTATE.IT[1:0] on executing an exception return operation in Supervisor mode. 


On executing an exception return operation in Supervisor mode SPSR_svc.IT must contain a value 
that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to Supervisor 
mode, and copied to PSTATE.SSBS on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to Supervisor 
mode, and copied to PSTATE.PAN on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to Supervisor 
mode, and copied to PSTATE.DIT on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to Supervisor mode, 
and copied to PSTATE.IL on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to Supervisor 
mode, and copied to PSTATE.GE on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to Supervisor mode, and copied 
to PSTATE.IT[7:2] on executing an exception return operation in Supervisor mode. 


SPSR_svc.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 
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E, bit [9] 


Endianness. Set to the value of PSTATE.E on taking an exception to Supervisor mode, and copied 
to PSTATE.E on executing an exception return operation in Supervisor mode. 


If the implementation does not support big-endian operation, SPSR_svc.E is RESO. If the 
implementation does not support little-endian operation, SPSR_svc.E is RES1. On executing an 
exception return operation in Supervisor mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_svc.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_svc.E is 
RESİ. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to Supervisor mode, 
and copied to PSTATE.A on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to Supervisor mode, and 
copied to PSTATE.I on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to Supervisor mode, and 
copied to PSTATE.F on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to Supervisor mode, 
and copied to PSTATE.T on executing an exception return operation in Supervisor mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to Supervisor mode, and copied 
to PSTATE.M[4:0] on executing an exception return operation in Supervisor mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10111 Abort. 
0b11011 Undefined. 
Qb11111 System. 





Other values are reserved. If SPSR_svc.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in Supervisor mode is an 
illegal return event, as described in ///egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_svc 


SPSR_ sve is accessible in all modes other than User mode and Supervisor mode. For more details, see MRS 
(Banked register) and MSR (Banked register) in the Arm® Architecture Reference Manual, Armv8, for Armv8-A 
architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch32 System Register Descriptions 
G8.2 General system control registers 


MRS{<c>}{<q>} <Rd>, SPSR_svc 





R M M1 


Obl Obl 0b0010 





MSR{<c>}{<q>} SPSR_svc, <Rn> 





R M M1 





Obl Obl 0b0010 
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G8.2.132 SPSR_und, Saved Program Status Register (Undefined mode) 


The SPSR_und characteristics are: 


Purpose 
Holds the saved process state when an exception is taken to Undefined mode. 
Configurations 
AArch32 System register SPSR_und[31:0] is architecturally mapped to AArch64 System register 
SPSR_und[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


SPSR_und is a 32-bit register. 


Field descriptions 


The SPSR_und bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 1615 1098765 4 





IT[1:0] See 
SSBS 


PAN 
DIT 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on taking an exception to Undefined mode, 
and copied to PSTATE.N on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on taking an exception to Undefined mode, and 
copied to PSTATE.Z on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 


Carry Condition flag. Set to the value of PSTATE.C on taking an exception to Undefined mode, and 
copied to PSTATE.C on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 


Overflow Condition flag. Set to the value of PSTATE.V on taking an exception to Undefined mode, 
and copied to PSTATE.V on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


Q, bit [27] 


Overflow or saturation flag. Set to the value of PSTATE.Q on taking an exception to Undefined 
mode, and copied to PSTATE.Q on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 
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IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on taking an exception to Undefined mode, and copied 
to PSTATE.IT[1:0] on executing an exception return operation in Undefined mode. 


On executing an exception return operation in Undefined mode SPSR_und.IT must contain a value 
that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 


J, bit [24] 
RESO. 
In previous versions of the architecture, the {J, T} bits determined the AArch32 Instruction set state. 
Armv8 does not support either Jazelle state or T32EE state, and the T bit determines the Instruction 
set state. 
SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on taking an exception to Undefined 
mode, and copied to PSTATE.SSBS on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMV8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on taking an exception to Undefined 
mode, and copied to PSTATE.PAN on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DIT, bit [21] 
When ARMv8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on taking an exception to Undefined 
mode, and copied to PSTATE.DIT on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on taking an exception to Undefined mode, 
and copied to PSTATE.IL on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on taking an exception to Undefined 
mode, and copied to PSTATE.GE on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on taking an exception to Undefined mode, and copied 
to PSTATE.IT[7:2] on executing an exception return operation in Undefined mode. 


SPSR_und.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 
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G8-6282 


E, bit [9] 


Endianness. Set to the value of PSTATE.E on taking an exception to Undefined mode, and copied 
to PSTATE.E on executing an exception return operation in Undefined mode. 


If the implementation does not support big-endian operation, SPSR_und.E is RESO. If the 
implementation does not support little-endian operation, SPSR_und.E is RES. On executing an 
exception return operation in Undefined mode, if the implementation does not support big-endian 
operation at the Exception level being returned to, SPSR_und.E is RESO, and if the implementation 
does not support little-endian operation at the Exception level being returned to, SPSR_und.E is 
RES1. 


This field resets to an architecturally UNKNOWN value. 


A, bit [8] 


SError interrupt mask. Set to the value of PSTATE.A on taking an exception to Undefined mode, 
and copied to PSTATE.A on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


I, bit [7] 


IRQ interrupt mask. Set to the value of PSTATE.I on taking an exception to Undefined mode, and 
copied to PSTATE.I on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


F, bit [6] 


FIQ interrupt mask. Set to the value of PSTATE.F on taking an exception to Undefined mode, and 
copied to PSTATE.F on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on taking an exception to Undefined mode, 
and copied to PSTATE.T on executing an exception return operation in Undefined mode. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on taking an exception to Undefined mode, and copied 
to PSTATE.M[4:0] on executing an exception return operation in Undefined mode. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10111 Abort. 
0b11011 Undefined. 
0b11111 System. 





Other values are reserved. If SPSR_und.M[4:0] has a Reserved value, or a value for an 
unimplemented Exception level, executing an exception return operation in Undefined mode is an 
illegal return event, as described in ///egal return events from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the SPSR_und 


SPSR_und is accessible in all modes other than User mode and Undefined mode. For more details, see MRS 
(Banked register) and MSR (Banked register) in the Arm® Architecture Reference Manual, Armv8, for Armv8-A 
architecture profile. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRS{<c>}{<q>} <Rd>, SPSR_und 





R M M1 


Obl Obl 0b0110 





MSR{<c>}{<q>} SPSR_und, <Rn> 





R M M1 





Obl Obl 0b0110 
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G8.2.133 TCMTR, TCM Type Register 
The TCMTR characteristics are: 


Purpose 

Provides information about the implementation of the TCM. 
Configurations 

If EL1 or above can use AArch32 then this register must be implemented. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TCMTR is a 32-bit register. 


Field descriptions 


The TCMTR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


Accessing the TCMTR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 0b0000 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return TCMTR; 
elsif PSTATE.EL == EL2 then 
return TCMTR; 
elsif PSTATE.EL == EL3 then 
return TCMTR; 
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G8.2.134 | TLBIALL, TLB Invalidate All 


The TLBIALL characteristics are: 


Purpose 
Invalidate all cached copies of translation table entries from TLBs that are from any level of the 
translation table walk. The entries that are invalidated are as follows: 
` If executed at Secure EL1 when EL3 is using AArch64, all entries that would be required for 
the Secure EL1&0 translation regime. 
° If executed in Secure state when EL3 is using AArch32, all entries that would be required for 
the Secure PL1&0 translation regime. 
° If executed at Non-secure EL1, all stage 1 translation table entries that would be required for 
the Non-secure PL1&0 translation regime and, if EL2 is implemented, they must match the 
current VMID. 
e If executed at EL2, and if EL2 is enabled in the current Security state, the stage 1 or stage 2 
translation table entries that would be required for the PL1 &0 translation regime and matches 
the current VMID. 
The invalidation only applies to the PE that executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBIALL is a 32-bit System instruction. 


Field descriptions 


TLBIALL ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 


Executing the TLBIALL instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b1000 Ob0111 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.FB == '1' then 
TLBIALLIS(); 
else 
TLBIALL(); 
elsif PSTATE.EL == EL2 then 
TLBIALL(); 





ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6285 
ID070919 Non-Confidential 


AArch32 System Register Descriptions 
G8.2 General system control registers 


elsif PSTATE.EL == EL3 then 
TLBIALL(); 
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G8.2.135 | TLBIALLH, TLB Invalidate All, Hyp mode 
The TLBIALLH characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that are 
from any level of the translation table walk that would be required for the Non-secure EL2 
translation regime. 


The invalidation only applies to the PE that executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIALLH is a 32-bit System instruction. 


Field descriptions 

TLBIALLH ignores the value in the register specified by the instruction. Software does not have to write a value to 
the register before issuing this instruction. 

Executing the TLBIALLH instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b100 0b1000 Ob0111 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIALLH(); 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
else 
TLBIALLH(); 
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G8.2.136 TLBIALLHIS, TLB Invalidate All, Hyp mode, Inner Shareable 


The TLBIALLHIS characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that are 
from any level of the translation table walk that would be required for the Non-secure EL2 
translation regime. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIALLHIS is a 32-bit System instruction. 


Field descriptions 

TLBIALLHIS ignores the value in the register specified by the instruction. Software does not have to write a value 
to the register before issuing this instruction. 

Executing the TLBIALLHIS instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b100 0b1000 0b0011 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIALLHIS() ; 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
else 





TLBIALLHIS() ; 
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G8.2.137 TLBIALLIS, TLB invalidate All, Inner Shareable 


The TLBIALLIS characteristics are: 


ARM DDI 0487E.a 
ID070919 


Purpose 
Invalidate all cached copies of translation table entries from TLBs that are from any level of the 
translation table walk. The entries that are invalidated are as follows: 
` If executed at Secure EL1 when EL3 is using AArch64, all entries that would be required for 
the Secure EL1&0 translation regime. 
° If executed in Secure state when EL3 is using AArch32, all entries that would be required for 
the Secure PL1&0 translation regime. 
° If executed at Non-secure EL1, all stage 1 translation table entries that would be required for 
the Non-secure PL1&0 translation regime and, if EL2 is implemented, they must match the 
current VMID. 
e If executed at EL2 and if EL2 is enabled in the current Security state, the stage 1 or stage 2 
translation table entries that would be required for the PL1 &0 translation regime and matches 
the current VMID. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBIALLIS is a 32-bit System instruction. 


Field descriptions 


TLBIALLIS ignores the value in the register specified by the instruction. Software does not have to write a value 
to the register before issuing this instruction. 


Executing the TLBIALLIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1000 0b0011 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TTLBIS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


else 
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TLBIALLIS() ; 
elsif PSTATE.EL == EL2 then 
TLBIALLIS(); 
elsif PSTATE.EL == EL3 then 
TLBIALLIS(); 
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G8.2.138 |TLBIALLNSNH, TLB Invalidate All, Non-Secure Non-Hyp 
The TLBIALLNSNH characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that are 
from any level of the translation table walk that would be required for stage 1 or stage 2 of the 
Non-secure PL1&0 translation regime, regardless of the associated VMID. 


The invalidation only applies to the PE that executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIALLNSNH is a 32-bit System instruction. 


Field descriptions 

TLBIALLNSNH ignores the value in the register specified by the instruction. Software does not have to write a 
value to the register before issuing this instruction. 

Executing the TLBIALLNSNH instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b100 0b1000 Ob0111 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIALLNSNH() ; 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
else 
TLBIALLNSNH() ; 
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TLBIALLNSNHIS, TLB Invalidate All, Non-Secure Non-Hyp, Inner Shareable 


The TLBIALLNSNHIS characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that are 
from any level of the translation table walk that would be required for stage 1 or stage 2 of the 
Non-secure PL1&0 translation regime, regardless of the associated VMID. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIALLNSNHIS is a 32-bit System instruction. 


Field descriptions 

TLBIALLNSNHIS ignores the value in the register specified by the instruction. Software does not have to write a 
value to the register before issuing this instruction. 

Executing the TLBIALLNSNHIS instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b100 0b1000 O0b0011 0b100 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIALLNSNHIS() ; 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
else 





TLBIALLNSNHIS() ; 
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G8.2.140 TLBIASID, TLB Invalidate by ASID match 


ARM DDI 0487E.a 
ID070919 


The TLBIASID characteristics are: 


Purpose 
Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 
° The entry is a stage 1 translation table entry. 
° The entry would be used for the specified ASID, and either: 
— Is from a level of lookup above the final level. 
—  Isanon-global entry from the final level of lookup. 
° If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 
From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 
° If executed at Secure EL1 when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 
° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 
. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 
The invalidation only applies to the PE that executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBIASID is a 32-bit System instruction. 


Field descriptions 


The TLBIASID input value bit assignments are: 


31 8 7 0 
RESO ASID 
Bits [31:8] 


Reserved, RESO. 


ASID, bits [7:0] 
ASID value to match. Any TLB entries for non-global pages that match the ASID values will be 
affected by this System instruction. 


Executing the TLBIASID instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








coproc opct CRn CRm opc2 
Ob1111 0b000 0b1000 Ob0111 Ob010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.FB == '1' then 
TLBIASIDIS(R[t]); 
else 
TLBIASID(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIASID(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIASID(R[t]); 
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G8.2.141 TLBIASIDIS, TLB Invalidate by ASID match, Inner Shareable 


ARM DDI 0487E.a 
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The TLBIASIDIS characteristics are: 


Purpose 


Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 


° The entry is a stage 1 translation table entry. 

. The entry would be used for the specified ASID, and either: 
— Is from a level of lookup above the final level. 
—  Isanon-global entry from the final level of lookup. 


° If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 


From the entries that match these requirement, the entries that are invalidated are required for the 

following translation regime: 

° If executed at Secure EL1 when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 

° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 

. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIASIDIS is a 32-bit System instruction. 


Field descriptions 


The TLBIASIDIS input value bit assignments are: 


31 8 7 0 
RESO ASID 
Bits [31:8] 


Reserved, RESO. 

ASID, bits [7:0] 
ASID value to match. Any TLB entries for non-global pages that match the ASID values will be 
affected by this System instruction. 

Executing the TLBIASIDIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
Ob1111 0b000 0b1000 Ob0011 Ob010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TTLBIS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
TLBIASIDIS(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIASIDIS(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIASIDIS(R[t]); 
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G8.2.142 TLBIIPAS2, TLB Invalidate by Intermediate Physical Address, Stage 2 


ARM DDI 0487E.a 
ID070919 


The TLBHPAS2 characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that meet 
the following requirements: 


° The entry is a stage 2 only translation table entry, from any level of the translation table walk. 
: SCR.NS is 1. 

° The entry would be used for the specified IPA. 

° The entry would be used with the current VMID. 

° The entry would be required for the PL1&0 translation regime. 


The invalidation is not required to apply to caching structures that combine stage 1 and stage 2 
translation table entries. 


The invalidation only applies to the PE that executes this System instruction. 


Configurations 





Note 
This System instruction is not implemented in architecture versions before Armv8. 





RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIIPAS2 is a 32-bit System instruction. 


Field descriptions 


The TLBIIPAS2 input value bit assignments are: 


31 28 27 0 


RESO IPA[39:12] 


Bits [31:28] 


Reserved, RESO. 


IPA[39:12], bits [27:0] 
Bits[39:12] of the intermediate physical address to match. 


Executing the TLBIIPAS2 instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b100 0b1000 0b0100 


opc2 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIIPAS2(R[t]); 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
elsif SCR.NS == 'Q' then 
//no operation 
else 
TLBIIPAS2(R[t]); 
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G8.2.143 TLBIIPAS2IS, TLB Invalidate by Intermediate Physical Address, Stage 2, Inner Shareable 
The TLBIIPASZIS characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that meet 
the following requirements: 


5 The entry is a stage 2 only translation table entry, from any level of the translation table walk. 
: SCR.NS is 1. 

° The entry would be used for the specified IPA. 

° The entry would be used with the current VMID. 

° The entry would be required for the PL1&0 translation regime. 


The invalidation is not required to apply to caching structures that combine stage 1 and stage 2 
translation table entries. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 


Note 
This System instruction is not implemented in architecture versions before Armv8. 








RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIIPAS2IS is a 32-bit System instruction. 


Field descriptions 


The TLBIIPAS2IS input value bit assignments are: 


31 28 27 0 


RESO IPA[39:12] 


Bits [31:28] 


Reserved, RESO. 


IPA[39:12], bits [27:0] 
Bits[39:12] of the intermediate physical address to match. 


Executing the TLBIIPAS2IS instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b100 0b1000 0b0000 


opc2 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIIPAS2(R[t]); 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
elsif SCR.NS == 'Q' then 
//no operation 
else 
TLBIIPAS2(R[t]); 
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G8.2.144 TLBIIPAS2L, TLB Invalidate by Intermediate Physical Address, Stage 2, Last level 


ARM DDI 0487E.a 
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The TLBIPAS2L characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that meet 
the following requirements: 


s The entry is a stage 2 only translation table entry, from the final level of the translation table 
walk. 


. SCR.NS is 1. 

° The entry would be used for the specified IPA. 

° The entry would be used with the current VMID. 

° The entry would be required for the PL1&0 translation regime. 


The invalidation is not required to apply to caching structures that combine stage | and stage 2 
translation table entries. 


The invalidation only applies to the PE that executes this System instruction. 
Configurations 


Note 
This System instruction is not implemented in architecture versions before Armv8. 








RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIIPAS2L is a 32-bit System instruction. 


Field descriptions 


The TLBIIPAS2L input value bit assignments are: 


31 28 27 0 


RESO IPA[39:12] 


Bits [31:28] 
Reserved, RESO. 


IPA[39:12], bits [27:0] 
Bits[39:12] of the intermediate physical address to match. 


Executing the TLBIIPAS2L instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b100 0b1000 0b0100 


opc2 


0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIIPAS2(R[t]); 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
elsif SCR.NS == 'Q' then 
//no operation 
else 
TLBIIPAS2(R[t]); 
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The TLBHPAS2LIS characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that meet 
the following requirements: 


3 The entry is a stage 2 only translation table entry, from the final level of the translation table 
walk. 


‘ SCR.NS is 1. 

° The entry would be used for the specified IPA. 

° The entry would be used with the current VMID. 

° The entry would be required for the PL1&0 translation regime. 


The invalidation is not required to apply to caching structures that combine stage | and stage 2 
translation table entries. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 


Note 
This System instruction is not implemented in architecture versions before Armv8. 








RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIIPASZ2LIS is a 32-bit System instruction. 


Field descriptions 


The TLBIIPAS2LIS input value bit assignments are: 


31 28 27 0 


RESO IPA[39:12] 


Bits [31:28] 


Reserved, RESO. 


IPA[39:12], bits [27:0] 
Bits[39:12] of the intermediate physical address to match. 


Executing the TLBIIPAS2LIS instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b100 0b1000 0b0000 


opc2 


0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIIPAS2IS(R[t]); 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
elsif SCR.NS == 'Q' then 
//no operation 
else 
TLBIIPAS2IS(R[t]); 
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The TLBIMVA characteristics are: 


Purpose 
Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 
° The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified address, and one of the following applies: 
— The entry is from a level of lookup above the final level and matches the specified 
ASID. 
— The entry is a global entry from the final level of lookup. 
— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 
. If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 
From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 
° If executed at Secure EL1 when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 
. If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 
. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 
The invalidation only applies to the PE that executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBIMVA is a 32-bit System instruction. 


Field descriptions 


The TLBIMVA input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this operation. 


Bits [11:8] 
Reserved, RESO. 


ASID, bits [7:0] 
ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 
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Executing the TLBIMVA instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








coproc opct CRn CRm opc2 
0b1111 0b000 0b1000 0b0111 Ob001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.FB == '1' then 
TLBIMVAIS(R[t]); 
else 
TLBIMVA(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIMVA(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIMVA(R[t]); 
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The TLBIMVAA characteristics are: 


Purpose 
Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 
À. The entry is a stage 1 translation table entry, from any level of the translation table walk. 
° The entry would be used to translate the specified address. 
. If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 
From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 
° If executed at Secure EL] when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 
° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 
° If executed in Non-secure state, the Non-secure PL1&0 translation regime. 
The invalidation only applies to the PE that executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBIMVAA is a 32-bit System instruction. 


Field descriptions 


The TLBIMVAA input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any unlocked TLB entries that match the VA will be affected by this 
System instruction, regardless of the ASID. 


Bits [11:0] 


Reserved, RESO. 


Executing the TLBIMVAA instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








coproc opct CRn CRm opc2 
Ob1111 0b000 0b1000 Ob0111 0b011 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.FB == '1' then 
TLBIMVAAIS(R[t]); 
else 
TLBIMVAA(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIMVAA(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIMVAA(R[t]); 
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The TLBIMVAAIS characteristics are: 


Purpose 


Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 


À. The entry is a stage 1 translation table entry, from any level of the translation table walk. 
° The entry would be used to translate the specified address. 


° If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 


From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 


° If executed at Secure EL] when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 

° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 

. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIMVAAIS is a 32-bit System instruction. 


Field descriptions 


The TLBIMVAAIS input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any unlocked TLB entries that match the VA will be affected by this 
System instruction, regardless of the ASID. 


Bits [11:0] 


Reserved, RESO. 


Executing the TLBIMVAAIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
Ob1111 0b000 0b1000 Ob0011 0b011 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TTLBIS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
TLBIMVAAIS(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIMVAATS(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIMVAATS(R[t]); 
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G8.2.149 TLBIMVAAL, TLB Invalidate by VA, All ASID, Last level 


ARM DDI 0487E.a 
ID070919 


The TLBIMVAAL characteristics are: 








Purpose 
Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 
À. The entry is a stage 1 translation table entry, from the final level of the translation table walk. 
° The entry would be used to translate the specified address. 
. If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 
From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 
° If executed at Secure EL] when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 
° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 
° If executed in Non-secure state, the Non-secure PL1&0 translation regime. 
The invalidation only applies to the PE that executes this System instruction. 
Configurations 
Note 
This System instruction is not implemented in architecture versions before Armv8. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBIMVAAL is a 32-bit System instruction. 


Field descriptions 


The TLBIMVAAL input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any unlocked TLB entries that match the VA will be affected by this 
System instruction, regardless of the ASID. 


Bits [11:0] 


Reserved, RESO. 


Executing the TLBIMVAAL instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








coproc opct CRn CRm opc2 
Ob1111 0b000 0b1000 Ob0111 Obl1l1 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.FB == '1' then 
TLBIMVAALIS(R[t]); 
else 
TLBIMVAAL(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIMVAAL(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIMVAAL(R[t]); 
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G8.2.150 TLBIMVAALIS, TLB Invalidate by VA, All ASID, Last level, Inner Shareable 


ARM DDI 0487E.a 
ID070919 


The TLBIMVAALIS characteristics are: 








Purpose 
Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 
À. The entry is a stage 1 translation table entry, from the final level of the translation table walk. 
° The entry would be used to translate the specified address. 
. If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 
From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 
° If executed at Secure EL] when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 
° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 
. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 
Configurations 
Note 
This System instruction is not implemented in architecture versions before Armv8. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBIMVAALIS is a 32-bit System instruction. 


Field descriptions 


The TLBIMVAALIS input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any unlocked TLB entries that match the VA will be affected by this 
System instruction, regardless of the ASID. 


Bits [11:0] 


Reserved, RESO. 


Executing the TLBIMVAALIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
Ob1111 0b000 0b1000 Ob0011 0b111 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TTLBIS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
TLBIMVAALIS(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIMVAALIS(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIMVAALIS(R[t]); 
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G8.2.151 TLBIMVAH, TLB Invalidate by VA, Hyp mode 


ARM DDI 0487E.a 
ID070919 


The TLBIMVAH characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that are 
from any level of the translation table walk that would be required for the Non-secure EL2 
translation regime and used to translate the specified address. 


The invalidation only applies to the PE that executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIMVAH is a 32-bit System instruction. 


Field descriptions 


The TLBIMVAH input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this System instruction. 

Bits [11:0] 


Reserved, RESO. 


Executing the TLBIMVAH instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b100 = 0b1000 Ob0111 Ob001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIMVAH(R[t]); 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
else 
TLBIMVAH(R[t]); 
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G8.2.152 TLBIMVAHIS, TLB Invalidate by VA, Hyp mode, Inner Shareable 
The TLBIMVAHIS characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that are 
from any level of the translation table walk that would be required for the Non-secure EL2 
translation regime and used to translate the specified address. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 
There are no configuration notes. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIMVAHIS is a 32-bit System instruction. 


Field descriptions 


The TLBIMVAHIS input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this System instruction. 

Bits [11:0] 
Reserved, RESO. 


Executing the TLBIMVAHIS instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b1000 Ob0011 Ob001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
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elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIMVAHTS(R[t]); 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
else 
TLBIMVAHIS(R[t]); 


G8-6318 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch32 System Register Descriptions 
G8.2 General system control registers 


G8.2.153  TLBIMVAIS, TLB Invalidate by VA, Inner Shareable 


ARM DDI 0487E.a 
ID070919 


The TLBIMVAIS characteristics are: 


Purpose 
Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 
° The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified address, and one of the following applies: 
— The entry is from a level of lookup above the final level and matches the specified 
ASID. 
— The entry is a global entry from the final level of lookup. 
— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 
. If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 
From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 
° If executed at Secure EL1 when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 
. If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 
° If executed in Non-secure state, the Non-secure PL1&0 translation regime. 
The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBIMVAIS is a 32-bit System instruction. 


Field descriptions 


The TLBIMVAIS input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this System instruction. 

Bits [11:8] 
Reserved, RESO. 

ASID, bits [7:0] 


ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 
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G8-6320 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 


of the value of the ASID field. 


Executing the TLBIMVAIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 














coproc opci CRn CRm opc2 
Ob1111 0b000 0b1000 Ob0011 Ob001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TTLBIS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
TLBIMVAIS(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIMVAIS(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIMVAIS(R[t]); 
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G8.2.154 TLBIMVAL, TLB Invalidate by VA, Last level 


ARM DDI 0487E.a 
ID070919 


The TLBIMVAL characteristics are: 


Purpose 
Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 
° The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified address, and one of the following applies: 
— The entry is a global entry from the final level of lookup. 
— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 
° If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 
From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 
° If executed at Secure EL] when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 
° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 
° If executed in Non-secure state, the Non-secure PL1&0 translation regime. 
The invalidation only applies to the PE that executes this System instruction. 
Configurations 
This System instruction is not implemented in architecture versions before Armv8. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


TLBIMVAL is a 32-bit System instruction. 


Field descriptions 


The TLBIMVAL input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this System instruction. 


Bits [11:8] 
Reserved, RESO. 


ASID, bits [7:0] 
ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 
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G8-6322 


Executing the TLBIMVAL instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b1000 Ob0111 


0b101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.FB == '1' then 
TLBIMVALIS(R[t]); 
else 





TLBIMVAL(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIMVAL(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIMVAL(R[t]); 
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G8.2.155 TLBIMVALH, TLB invalidate by VA, Last level, Hyp mode 


ARM DDI 0487E.a 
ID070919 


The TLBIMVALH characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that are 
from the final level of the translation table walk that would be required for the Non-secure EL2 
translation regime and used to translate the specified address. 


The invalidation only applies to the PE that executes this System instruction. 


Configurations 
This System instruction is not implemented in architecture versions before Armv8. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIMVALH is a 32-bit System instruction. 


Field descriptions 


The TLBIMVALH input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this System instruction. 

Bits [11:0] 


Reserved, RESO. 


Executing the TLBIMVALH instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b100 = 0b1000 Ob0111 Ob101 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIMVALH(R[t]); 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
else 
TLBIMVALH(R[t]); 
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G8.2.156 TLBIMVALHIS, TLB Invalidate by VA, Last level, Hyp mode, Inner Shareable 
The TLBIMVALHIS characteristics are: 


Purpose 


If EL2 is implemented, invalidate all cached copies of translation table entries from TLBs that are 
from the final level of the translation table walk that would be required for the Non-secure EL2 
translation regime and used to translate the specified address. 


The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 
executes this System instruction. 


Configurations 
This System instruction is not implemented in architecture versions before Armv8. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIMVALHIS is a 32-bit System instruction. 


Field descriptions 


The TLBIMVALHIS input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this System instruction. 

Bits [11:0] 
Reserved, RESO. 


Executing the TLBIMVALHIS instruction 


If this instruction is executed in a Secure privileged mode other than Monitor mode, then the behavior is 
CONSTRAINED UNPREDICTABLE, and one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction is treated as a NOP. 
. The instruction executes as if it had been executed in Monitor mode. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 = 0b1000 Ob0011 0b101 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
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elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
TLBIMVALHIS(R[t]); 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
UNDEFINED; 
else 
TLBIMVALHIS(R[t]); 
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G8.2.157 TLBIMVALIS, TLB Invalidate by VA, Last level, Inner Shareable 


ARM DDI 0487E.a 
ID070919 


The TLBIMVALIS characteristics are: 


Purpose 


Invalidate all cached copies of translation table entries from TLBs that meet the following 
requirements: 


° The entry is a stage 1 translation table entry. 
. The entry would be used to translate the specified address, and one of the following applies: 
— The entry is a global entry from the final level of lookup. 


— The entry is a non-global entry from the final level of lookup that matches the 
specified ASID. 


° If EL2 is implemented and enabled in the current Security state, the entry would be used with 
the current VMID. 


From the entries that match these requirement, the entries that are invalidated are required for the 
following translation regime: 


° If executed at Secure EL] when EL3 is using AArch64, the Secure EL1&0 translation 
regime. 

° If executed in Secure state when EL3 is using AArch32, the Secure PL1&0 translation 
regime. 

. If executed in Non-secure state, the Non-secure PL1&0 translation regime. 

The invalidation applies to all PEs in the same Inner Shareable shareability domain as the PE that 

executes this System instruction. 


Configurations 


This System instruction is not implemented in architecture versions before Armv8. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TLBIMVALIS is a 32-bit System instruction. 


Field descriptions 


The TLBIMVALIS input value bit assignments are: 


VA, bits [31:12] 
Virtual address to match. Any TLB entries that match the ASID value and VA value will be affected 
by this System instruction. 


Bits [11:8] 
Reserved, RESO. 


ASID, bits [7:0] 
ASID value to match. Any TLB entries that match the ASID value and VA value will be affected by 
this System instruction. 


Global TLB entries that match the VA value will be affected by this System instruction, regardless 
of the value of the ASID field. 
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Executing the TLBIMVALIS instruction 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
0b1111 0b000 0b1000 Ob0011 0b101 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T8 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T8 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLB == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TTLBIS == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR.TTLB == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TTLBIS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
TLBIMVAL(R[t]); 
elsif PSTATE.EL == EL2 then 
TLBIMVAL(R[t]); 
elsif PSTATE.EL == EL3 then 
TLBIMVAL(R[t]); 
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G8.2.158 TLBTR, TLB Type Register 


ARM DDI 0487E.a 
ID070919 


The TLBTR characteristics are: 


Purpose 


Provides information about the TLB implementation. The register must define whether the 


implementation provides separate instruction and data TLBs, or a unified TLB. Normally, the 
IMPLEMENTATION DEFINED information in this register includes the number of lockable entries in 


the TLB. 


Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TLBTR is a 32-bit register. 


Field descriptions 


The TLBTR bit assignments are: 


31 1 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:1] 
IMPLEMENTATION DEFINED. 


nU, bit [0] 
Not Unified TLB. Indicates whether the implementation has a unified TLB: 
ObO Unified TLB. 
0b1 Separate Instruction and Data TLBs. 


Accessing the TLBTR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TID1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TID1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return TLBTR; 


coproc opct CRn CRm opc2 
Ob1111 0b000 0b0000 0b0000 Ob011 
G8-6329 
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elsif PSTATE.EL == EL2 then 
return TLBTR; 
elsif PSTATE.EL == EL3 then 
return TLBTR; 
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G8.2.159 TPIDRPRW, PL1 Software Thread ID Register 


ARM DDI 0487E.a 
ID070919 


The TPIDRPRW characteristics are: 


Purpose 


Provides a location where software executing at EL1 or higher can store thread identifying 
information that is not visible to software executing at ELO, for OS management purposes. 


The PE makes no use of this register. 
Configurations 


AArch32 System register TPIDRPRW[31:0] is architecturally mapped to AArch64 System register 
TPIDR_EL1[31:0]. 


Note 
The PE never updates this register. 








RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TPIDRPRW is a 32-bit register. 


Field descriptions 


The TPIDRPRW bit assignments are: 


31 0 
Thread ID 
Bits [31:0] 


Thread ID. Thread identifying information stored by software running at this Exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TPIDRPRW 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1101 O0b0000 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return TPIDRPRW_S; 
else 
return TPIDRPRW_NS; 
else 
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return TPIDRPRW; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return TPIDRPRW_NS; 
else 
return TPIDRPRW; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return TPIDRPRW_S; 
else 





return TPIDRPRW_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b1101 0b0000 


0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
TPIDRPRW_S = R[t]; 
else 
TPIDRPRW_NS = R[t]; 
else 
TPIDRPRW = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
TPIDRPRW_NS = R[t] 
else 
TPIDRPRW = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
TPIDRPRW_S = R[t]; 
else 





TPIDRPRW_NS = R[t] 
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G8.2.160 TPIDRURO, PLO Read-Only Software Thread ID Register 


ARM DDI 0487E.a 
ID070919 


The TPIDRURO characteristics are: 


Purpose 


Provides a location where software executing at EL1 or higher can store thread identifying 
information that is visible to software executing at ELO, for OS management purposes. 


The PE makes no use of this register. 


Configurations 


AArch32 System register TPIDRURO[3 1:0] is architecturally mapped to AArch64 System register 
TPIDRRO _ELO[31:0]. 


Note 
The PE never updates this register. 








RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TPIDRURO is a 32-bit register. 


Field descriptions 


The TPIDRURO bit assignments are: 


31 0 
Thread ID 
Bits [31:0] 


Thread ID. Thread identifying information stored by software running at this Exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TPIDRURO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1101 Ob0000 Ob011 





if PSTATE.EL == EL@ then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return TPIDRURO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
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if SCR.NS == 'Q' then 
return TPIDRURO_S; 
else 
return TPIDRURO_NS; 
else 
return TPIDRURO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return TPIDRURO_NS; 
else 
return TPIDRURO; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return TPIDRURO_S; 
else 
return TPIDRURO_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm 


opc2 





Ob1111 0b000 = 0b1101 0b0000 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
TPIDRURO_S = R[t]; 
else 
TPIDRURO_NS = R[t]; 
else 
TPIDRURO = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
TPIDRURO_NS = R[t] 
else 
TPIDRURO = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
TPIDRURO_S = R[t]; 
else 











TPIDRURO_NS = R[t] 
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G8.2.161 TPIDRURW, PLO Read/Write Software Thread ID Register 


ARM DDI 0487E.a 
ID070919 


The TPIDRURW characteristics are: 


Purpose 
Provides a location where software executing at ELO can store thread identifying information, for 
OS management purposes. 


The PE makes no use of this register. 


Configurations 
AArch32 System register TPIDRURW/[3 1:0] is architecturally mapped to AArch64 System register 
TPIDR_ELO[31:0]. 

Note 

The PE never updates this register. 








RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TPIDRURW is a 32-bit register. 


Field descriptions 


The TPIDRURW bit assignments are: 


31 0 
Thread ID 
Bits [31:0] 


Thread ID. Thread identifying information stored by software running at this Exception level. 


This field resets to an architecturally UNKNOWN value. 


Accessing the TPIDRURW 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1101 O0b0000 0b010 





if PSTATE.EL == EL@ then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
return TPIDRURW; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
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if SCR.NS == 'Q' then 
return TPIDRURW_S; 
else 
return TPIDRURW_NS; 
else 
return TPIDRURW; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return TPIDRURW_NS; 
else 
return TPIDRURW; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return TPIDRURW_S; 
else 





return TPIDRURW_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b000 = 0b1101 O0b0000 0b010 





if PSTATE.EL == EL@ then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
TPIDRURW = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
TPIDRURW_S = R[t]; 
else 
TPIDRURW_NS = R[t]; 





else 
TPIDRURW = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
TPIDRURW_NS = R[t]; 
else 
TPIDRURW = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
TPIDRURW_S = R[t]; 
else 











TPIDRURW_NS = R[t] 
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G8.2.162 TTBCR, Translation Table Base Control Register 


ARM DDI 0487E.a 
ID070919 


The TTBCR characteristics are: 


Purpose 
The control register for stage 1 of the PL1&0 translation regime. Its controls include: 


° Where the VA range is split between addresses translated using TTBRO and addresses 
translated using TTBR1. 


$ The translation table format used by this stage of translation. 
From Armv8.2, when the value of TTBCR.{EAE, T2E} is {1, 1}, TTBCR is used with TTBCR2. 


Configurations 


AArch32 System register TTBCR[31:0] is architecturally mapped to AArch64 System register 
TCR_EL1[31:0]. 


The current translation table format determines which format of the register is used. 


Some RW fields of this register have defined reset values. These apply only if the PE resets into an 
Exception level that is using AArch32. If the PE resets into EL3 using AArch32 then: 


° The EAE bit resets to 0 in both the Secure and the Non-secure instances of the register. 


° Other reset values apply only to the Secure instance of the register. 


Attributes 
TTBCR is a 32-bit register. 


Field descriptions 


The TTBCR bit assignments are: 


When TTBCR.EAE == 0: 


EAE, bit [31] 
Extended Address Enable. The meanings of the possible values of this bit are: 


Obd Use the VMSAv8-32 translation system with the Short-descriptor translation table 
format. 


This field resets to Q. 


Bits [30:6] 


Reserved, RESO. 


PDI, bit [5] 


Translation table walk disable for translations using TTBR1. This bit controls whether a translation 
table walk is performed on a TLB miss, for an address that is translated using TTBR1. The encoding 
of this bit is: 


Qbd Perform translation table walks using TTBR1. 
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Qb1 A TLB miss on an address that is translated using TTBR1 generates a Translation fault. 
No translation table walk is performed. 


This field resets to Q. 


PDO, bit [4] 


Translation table walk disable for translations using TTBRO. This bit controls whether a translation 
table walk is performed on a TLB miss for an address that is translated using TTBRO. The encoding 
of this bit is: 


Qbd Perform translation table walks using TTBRO. 


Qb1 A TLB miss on an address that is translated using TTBRO generates a Translation fault. 
No translation table walk is performed. 


This field resets to 0. 
Bit [3] 

Reserved, RESO. 
N, bits [2:0] 


Indicate the width of the base address held in TTBRO. In TTBRO, the base address field is 
bits[31:14-N]. The value of N also determines: 


è: Whether TTBRO or TTBR1 is used as the base address for translation table walks. 

s The size of the translation table pointed to by TTBRO. 

N can take any value from 0 to 7, that is, from 0b000 to 0b111. 

When N has its reset value of 0, the translation table base is compatible with Armv5 and Armv6. 


This field resets to Q. 


When TTBCR.EAE == 1: 


31 30 29 28 27 26 25 24 23 22 21 1918 161514131211109 8 7 6 5 3 2 0 





IMP DEF — | = EPDO 


ORGN1 IRGNO 
IRGN1 ORGNO 
EPD1 RESO 
A1 


EAE, bit [31] 
Extended Address Enable. The meanings of the possible values of this bit are: 


Qb1 Use the VMSAv8-32 translation system with the Long-descriptor translation table 
format. 


This field resets to Q. 


IMPLEMENTATION DEFINED, bit [30] 
IMPLEMENTATION DEFINED. 


This field resets to Q. 
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SH1, bits [29:28] 


Shareability attribute for memory associated with translation table walks using TTBR1. Defined 


values are: 

0b00 Non-shareable. 
0b10 Outer Shareable. 
0b11 Inner Shareable. 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7628. 


This field resets to Q. 


ORGNI, bits [27:26] 


Outer cacheability attribute for memory associated with translation table walks using TTBR1. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to Q. 


IRGN1, bits [25:24] 


Inner cacheability attribute for memory associated with translation table walks using TTBR1. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to 0. 


EPD1, bit [23] 


Translation table walk disable for translations using TTBR1. This bit controls whether a translation 
table walk is performed on a TLB miss, for an address that is translated using TTBR1. The encoding 


of this bit is: 
Qbd Perform translation table walks using TTBR1. 
Qb1 A TLB miss on an address that is translated using TTBR1 generates a Translation fault. 


No translation table walk is performed. 


This field resets to Q. 


A1, bit [22] 
Selects whether TTBRO or TTBR1 defines the ASID. The encoding of this bit is: 
ObO TTBRO.ASID defines the ASID. 
Qb1 TTBRI.ASID defines the ASID. 
This field resets to 0. 


Bits [21:19] 
Reserved, RESO. 
T1SZ, bits [18:16] 


See Selecting between TTBRO and TTBR1, VMSAv8-32 Long-descriptor translation table format on 
page G5-5755 for how TTBCR. {T1SZ, TOSZ} determine the input address ranges and memory 
region sizes translated using TTBRO and TTBR1. 


This field resets to Q. 
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Bits [15:14] 
Reserved, RESO. 
SHO, bits [13:12] 


Shareability attribute for memory associated with translation table walks using TTBRO. 


0b00 Non-shareable 
0b10 Outer Shareable 
0b11 Inner Shareable 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7628. 


This field resets to 0. 


ORGNO, bits [11:10] 


Outer cacheability attribute for memory associated with translation table walks using TTBRO. 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to 0. 


IRGNO, bits [9:8] 


Inner cacheability attribute for memory associated with translation table walks using TTBRO. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to 0. 


EPDO, bit [7] 


Translation table walk disable for translations using TTBRO. This bit controls whether a translation 
table walk is performed on a TLB miss, for an address that is translated using TTBRO. The encoding 
of this bit is: 


Qbd Perform translation table walks using TTBRO. 


Qb1 A TLB miss on an address that is translated using TTBRO generates a Translation fault. 
No translation table walk is performed. 


This field resets to 0. 
T2E, bit [6] 
When ARMv8.2-AA32HPD is implemented: 


TTBCR2 Enable. 

Ob TTBCR2 is disabled. The contents of TTBCR2 are treated as 0 for all purposes other 
than reading or writing the register. 

Qb1 TTBCR2 is enabled. 


If TTBCR.EAE==0, then the behavior is as if the bit is 0. 
Otherwise: 
Reserved, RESO. 
Bits [5:3] 


Reserved, RESO. 
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TOSZ, bits [2:0] 


See Selecting between TTBRO and TTBR1, VMSAv8-32 Long-descriptor translation table format on 
page G5-5755 for how TTBCR. {T1SZ, TOSZ} determine the input address ranges and memory 


region sizes translated using TTBRO and TTBR1. 
This field resets to 0. 


Accessing the TTBCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return TIBCR_S; 
else 
return TTBCR_NS; 
else 
return TTBCR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return TTBCR_NS; 
else 
return TTBCR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return TTBCR_S; 
else 
return TTBCR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 


UNDEFINED; 


coproc opci CRn CRm opc2 
0b1111 0b000 0b0010 0b0000 0b010 
coproc opct CRn CRm opc2 
0b1111 0b000 0b0010 0b0000 0b010 
G8-6341 
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elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP1ISSDISABLE2 == HIGH then 
UNDEFINED; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 


TTBCR_S = R[t]; 
else 
TTBCR_NS = R[t]; 
else 
TTBCR = R[t]; 


elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && ELUsingAArch32(EL3) then 
TTBCR_NS = R[t]; 
else 





TTBCR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' && CPISSDISABLE == HIGH then 


UNDEFINED; 
elsif SCR.NS == '@' && CPISSDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
TTBCR_S = R[t]; 
else 





TTBCR_NS = R[t]; 
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G8.2.163 TTBCR2, Translation Table Base Control Register 2 


HWU161 
HWU160 


ARM DDI 0487E.a 
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The TTBCR2 characteristics are: 


Purpose 
The second control register for stage 1 of the PL1&0 translation regime. 
If ARMv8.2-AA32HPD is not implemented then this register is not implemented and its encoding 
is UNDEFINED. Otherwise: 
. When the value of TTBCR. {EAE, T2E} is not {1, 1} the contents of TTBCR2 are treated as 
zero for all purposes other than reading or writing the register. 


e When the value of TTBCR.{EAE, T2E} is {1, 1} TTBCR2 is used with TTBCR. 
Configurations 

AArch32 System register TTBCR2[31:0] is architecturally mapped to AArch64 System register 

TCR_EL1[63:32]. 

This register is present only when ARMV8.2-AA32HPD is implemented. Otherwise, direct accesses 

to TTBCR2 are UNDEFINED. 

RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
TTBCR2 is a 32-bit register. 


Field descriptions 


The TTBCR2 bit assignments are: 


31 19181716151413121110 9 8 0 


HWU162 os Po HPDO 
HPD1 


HWU059 
HWU060 
HWU061 
HWU062 
HWU159 


Bits [31:19] 
Reserved, RESO. 


HWU162, bit [18] 
When ARMV%8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 
translation table Block or Page entry for translations using TTBR1. 


Qbd For translations using TTBR1, bit[62] of each stage 1 translation table Block or Page 
entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 
Qb1 For translations using TTBR1, bit[62] of each stage 1 translation table Block or Page 


entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of 
TTBCR2.HPD1 is 1. 
The Effective value of this field is 0 if the value of TTBCR2.HPD1 is 0 or the value of TTBCR.T2E 
is 0. 
This field resets to an architecturally UNKNOWN value. 
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Otherwise: 


Reserved, RESO. 


HWU161, bit [17] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 
translation table Block or Page entry for translations using TTBR1. 


Qbd For translations using TTBR1, bit[61] of each stage 1 translation table Block or Page 
entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBR1, bit[61] of each stage 1 translation table Block or Page 
entry can be used by hardware for an IMPLEMENTATION DEFINED putpose if the value of 
TTBCR2.HPD1 is 1. 


The Effective value of this field is 0 if the value of TTBCR2.HPD1 is 0 or the value of TTBCR.T2E 
is 0. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU160, bit [16] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 
translation table Block or Page entry for translations using TTBR1. 


Obd For translations using TTBR1, bit[60] of each stage 1 translation table Block or Page 
entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBR1, bit[60] of each stage 1 translation table Block or Page 
entry can be used by hardware for an IMPLEMENTATION DEFINED putpose if the value of 
TTBCR2.HPD1 is 1. 


The Effective value of this field is 0 if the value of TTBCR2.HPD1 is 0 or the value of TTBCR.T2E 
is 0. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU159, bit [15] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 
translation table Block or Page entry for translations using TTBR1. 


Qbd For translations using TTBR1, bit[59] of each stage 1 translation table Block or Page 
entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBR1, bit[59] of each stage 1 translation table Block or Page 
entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of 
TTBCR2.HPD1 is 1. 


The Effective value of this field is 0 if the value of TTBCR2.HPD1 is 0 or the value of TTBCR.T2E 
is 0. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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HWU062, bit [14] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 1 
translation table Block or Page entry for translations using TTBRO. 


Qbd For translations using TTBRO, bit[62] of each stage 1 translation table Block or Page 
entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBRO, bit[62] of each stage 1 translation table Block or Page 
entry can be used by hardware for an IMPLEMENTATION DEFINED putpose if the value of 
TTBCR2.HPD0 is 1. 


The Effective value of this field is 0 if the value of TTBCR2.HPD0 is 0 or the value of TTBCR.T2E 
is 0. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWUO061, bit [13] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 1 
translation table Block or Page entry for translations using TTBRO. 


Qbd For translations using TTBRO, bit[61] of each stage 1 translation table Block or Page 
entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBRO, bit[61] of each stage 1 translation table Block or Page 
entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of 
TTBCR2.HPD0 is 1. 


The Effective value of this field is 0 if the value of TTBCR2.HPD0 is 0 or the value of TTBCR.T2E 
is 0. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU060, bit [12] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 1 
translation table Block or Page entry for translations using TTBRO. 


Qbd For translations using TTBRO, bit[60] of each stage 1 translation table Block or Page 
entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBRO, bit[60] of each stage 1 translation table Block or Page 
entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of 
TTBCR2.HPD0 is 1. 


The Effective value of this field is 0 if the value of TTBCR2.HPD0 is 0 or the value of TTBCR.T2E 
is 0. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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HWU0S9, bit [11] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 1 
translation table Block or Page entry for translations using TTBRO. 


Qbd For translations using TTBRO, bit[59] of each stage 1 translation table Block or Page 
entry cannot be used by hardware for an IMPLEMENTATION DEFINED purpose. 


Qb1 For translations using TTBRO, bit[59] of each stage 1 translation table Block or Page 
entry can be used by hardware for an IMPLEMENTATION DEFINED purpose if the value of 
TTBCR2.HPD0 is 1. 


The Effective value of this field is 0 if the value of TTBCR2.HPD0 is 0 or the value of TTBCR.T2E 
is 0. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HPD1, bit [10] 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, XNTable, and 
PXNTable, in the translation tables pointed to by TTBR1. 


Obd Hierarchical permissions are enabled. 
Qb1 Hierarchical permissions are disabled if TTBCR.T2E == 1. 
When disabled, the permissions are treated as if the bits are 0. 
The Effective value of this field is 0 if the value of TTBCR.T2E is 0. 
This field resets to an architecturally UNKNOWN value. 

HPDO, bit [9] 


Hierarchical Permission Disables. This affects the hierarchical control bits, APTable, XNTable, and 
PXNTable, in the translation tables pointed to by TTBRO. 


Ob Hierarchical permissions are enabled. 
Qb1 Hierarchical permissions are disabled if TTBCR.T2E ==1. 
When disabled, the permissions are treated is as if the bits are 0. 
The Effective value of this field is 0 if the value of TTBCR.T2E is 0. 
This field resets to an architecturally UNKNOWN value. 

Bits [8:0] 


Reserved, RESO. 


Accessing the TTBCR2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0010 O0b0000 Ob011 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return TTBCR2_S; 
else 
return TIBCR2_NS; 
else 
return TTBCR2; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return TIBCR2_NS; 
else 
return TTBCR2; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return TTBCR2_S; 
else 
return TIBCR2_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b0010 0b0000 


0b011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '0 
UNDEFINED; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '0 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
TTBCR2_S = R[t]; 
else 


&& CP15SDISABLE == HIGH then 


&& CP15SDISABLE2 == HIGH then 


TTBCR2_NS = R[t]; 
else 
TTBCR2 = R[t]; 
elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && ELUsingAArch32(EL3) then 
TTBCR2_NS = R[t]; 
else 





TTBCR2 = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' && CPI5SDISABLE == HIGH then 
UNDEFINED; 
elsif SCR.NS == 'Q' && CPISSDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
TTBCR2_S = R[t]; 
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else 
TTBCR2_NS = R[t]; 
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G8.2.164 TTBRO, Translation Table Base Register 0 
The TTBRO characteristics are: 


Purpose 
Holds the base address of the translation table for the initial lookup for stage 1 of the translation of 
an address from the lower VA range in the PL1&0 translation regime, and other information for this 
translation regime. 


Configurations 


AArch32 System register TTBRO[63:0] is architecturally mapped to AArch64 System register 
TTBRO_EL1[63:0]. 


TTBCR.EAE determines which TTBRO format is used: 
° TTBCR.EAE == 0b0: 32-bit format is used. TTBRO[63:32] are ignored. 
. TTBCR.EAE == 0b1: 64-bit format is used. 


When EL3 is using AArch32, write access to TTBRO(S) is disabled when the CP15SDISABLE 
signal is asserted HIGH. 


Used in conjunction with the TTBCR. When the 64-bit TTBRO format is used, cacheability and 
shareability information is held in the TTBCR, not in TTBRO. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TTBRO is a 64-bit register that can also be accessed as a 32-bit value. If it is accessed as a 32-bit 
register, accesses read and write bits [31:0] and do not modify bits [63:32]. 


Field descriptions 


The TTBRO bit assignments are: 


When TTBCR.EAE == 0: 


63 32 31 





RESO TTBO 


= IRGN[1] 
IMP 


NOS 
IRGN[0] 


Bits [63:32] 


Reserved, RESO. 


TTBO, bits [31:7] 


Translation table base address, bits[31:x], where x is 14-(TTBCR.N). Register bits [x-1:7] are RESO, 
with the additional requirement that if these bits are not all zero, this is a misaligned translation table 
base address, with effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following: 


- Register bits [x-1:7] are treated as if all the bits are zero. The value read back from these bits 
is either the value written or zero. 


° The result of the calculation of an address for a translation table walk using this register can 
be corrupted in those bits that are nonzero. 


This field resets to an architecturally UNKNOWN value. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6349 
ID070919 Non-Confidential 


AArch32 System Register Descriptions 
G8.2 General system control registers 


IRGN[0], bit [6] 
This field is bit[0] of IRGN[1:0]. 


Inner region bits. Bits [0,6] of this register together indicate the Inner Cacheability attributes for the 
memory associated with the translation table walks. The possible values of IRGN[1:0] are: 





0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Cacheable. 

0b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
Note 


The encoding of the IRGN bits is counter-intuitive, with register bit[6] being IRGN[0] and register 
bit[0] being IRGN[1]. This encoding is chosen to give a consistent encoding of memory region 
types and to ensure that software written for ARMv7 without the Multiprocessing Extensions can 
run unmodified on an implementation that includes the functionality introduced by the ARMv7 
Multiprocessing Extensions. 





The IRGN field is split as follows: 
e IRGN[0] is TTBRO[6]. 
° IRGN[1] is TTBRO[0]. 


This field resets to an architecturally UNKNOWN value. 


NOS, bit [5] 


Not Outer Shareable. When the value of TTBRO.S is 1, indicates whether the memory associated 
with a translation table walk is Inner Shareable or Outer Shareable: 


0b0ð Memory is Outer Shareable. 
Qb1 Memory is Inner Shareable. 
This bit is ignored when the value of TTBRO.S is 0. 


This field resets to an architecturally UNKNOWN value. 


RGN, bits [4:3] 


Region bits. Indicates the Outer cacheability attributes for the memory associated with the 
translation table walks: 


Oboe Normal memory, Outer Non-cacheable. 

QbO1 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Outer Write-Through Cacheable. 

Qb11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IMP, bit [2] 


The effect of this bit is IMPLEMENTATION DEFINED. If the translation table implementation does not 
include any IMPLEMENTATION DEFINED features this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


S, bit [1] 


Shareable. Indicates whether the memory associated with the translation table walks is 
Non-shareable: 


ObO Memory is Non-shareable. 


Qb1 Memory is shareable. The TTBRO.NOS field indicates whether the memory is Inner 
Shareable or Outer Shareable. 


This field resets to an architecturally UNKNOWN value. 
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IRGN[1], bit [0] 
This field is bit[1] of IRGN[1:0]. 
See IRGN[0] for the field description. 


When TTBCR.EAE == 1: 


56 55 48 47 1 0 


63 
| RESO ASID BADDR 


Bits [63:56] 


E: CnP 


Reserved, RESO. 


ASID, bits [55:48] 


An ASID for the translation table base address. The TTBCR.A1 field selects either TTBRO.ASID 
or TTBR1.ASID. 


This field resets to an architecturally UNKNOWN value. 


BADDR, bits [47:1] 


Translation table base address, bits[47:x], Bits [x-1:1] are RESO, with the additional requirement that 
if bits[x-1:3] are not all zero, this is a misaligned translation table base address, with effects that are 
CONSTRAINED UNPREDICTABLE, and must be one of the following: 


è Register bits [x-1:3] are treated as if all the bits are zero. The value read back from these bits 
is either the value written or zero. 


° The result of the calculation of an address for a translation table walk using this register can 
be corrupted in those bits that are nonzero. 


x is determined from the value of TTBCR.TOSZ as follows: 

. If TTBCR.TOSZ is 0 or 1, x = 5 - TTBCR.TOSZ. 

- If TTBCR.TOSZ is greater than 1, x = 14 - TTBCR.TOSZ. 

If bits[47:40] of the translation table base address are not zero, an Address size fault is generated. 


This field resets to an architecturally UNKNOWN value. 


CnP, bit [0] 
When ARMV8.2-TTCNP is implemented: 


Common not Private. When TTBCR.EAE ==1, this bit indicates whether each entry that is pointed 
to by TTBRO is a member of a common set that can be used by every PE in the Inner Shareable 
domain for which the value of TTBRO.CnP is 1. 


Obd The translation table entries pointed to by this instance of TTBRO, for the current ASID, 
are permitted to differ from corresponding entries for this instance of TTBRO for other 
PEs in the Inner Shareable domain. This is not affected by: 


. The value of TTBRO.CnP on those other PEs. 
. The value of TTBCR.EAE on those other PEs. 


. The value of the current ASID or, for the Non-secure instance of TTBRO, the 
value of the current VMID. 
Qb1 The translation table entries pointed to by this instance of TTBRO are the same as the 


translation table entries for every other PE in the Inner Shareable domain for which the 
value of TTBRO.CnP is 1 for this instance of TTBRO and all of the following apply: 


s The translation table entries are pointed to by this instance of TTBRO. 
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7 The value of the applicable TTBCR.EAE field is 1. 
. The ASID is the same as the current ASID. 


. For the Non-secure instance of TTBRO, the VMID is the same as the current 
VMID. 


When a TLB combines entries from stage 1 translation and stage 2 translation into a single entry, 
that entry can only be shared between different PEs if the value of the CnP bit is 1 for both stage 1 
and stage 2. 


Note 


If the value of the TTBRO.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and 
those TTBROs do not point to the same translation table entries when the other conditions specified 
for the case when the value of CnP is 1 apply, then the results of translations are CONSTRAINED 
UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching of control or 





data values on page K1-7611. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Accessing the TTBRO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 


CRm opc2 





Ob1111 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return TTBRQ_S<31:0>; 
else 
return TTBRQ_NS<31:0>; 
else 
return TIBRQ<31:0>; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return TTBRO_NS<31:0>; 
else 
return TIBRQ<31:0>; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return TIBRQ_S<31:0>; 
else 
return TTBRO_NS<31:0>; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b0010 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
TTBRO_S = ZeroExtend(R[t]); 
else 
TTBRO_NS = ZeroExtend(R[t]); 
else 
TTBR@ = ZeroExtend(R[t]); 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
TTBRO_NS = ZeroExtend(R[t]); 
else 





TTBR@ = ZeroExtend(R[t]); 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' && CP15SDISABLE == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
TTBRO_S = ZeroExtend(R[t]); 
else 
TTBRO_NS = ZeroExtend(R[t]); 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


coproc CRm opc1 





Ob1111 0b0010 0b0000 


if PSTATE.EL == EL@ then 


UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return TTBRO_S; 
else 
return TTBRO_NS; 





else 
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return TTBRQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return TTBRO_NS; 
else 
return TTBRO; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return TTBRO_S; 
else 
return TTBRO_NS; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 





CRm opc1 





0b0010 0b0000 





elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP15SDISABLE == HIGH then 


UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
TTBRO_S = R[t2]:R[t]; 
else 
TTBRO_NS = R[t2]:R[t]; 
else 
TTBRO = R[t2]:R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
TTBRO_NS = R[t2]:R[t]; 
else 











TTBRO = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q@' && CP15SDISABLE == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
TTBRO_S = R[t2]:R[t]; 
else 
TTBRO_NS = R[t2]:R[t]; 
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G8.2.165 TTBR1, Translation Table Base Register 1 


63 
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The TTBR1 characteristics are: 


Purpose 


Holds the base address of the translation table for the initial lookup for stage 1 of the translation of 
an address from the higher VA range in the PL1&0 translation regime, and other information for this 
translation regime. 


Configurations 


AArch32 System register TTBR1[63:0] is architecturally mapped to AArch64 System register 
TTBR1_EL1[63:0]. 


TTBCR.EAE determines which TTBR1 format is used: 
° TTBCR.EAE == 0b0: 32-bit format is used. TTBR1[63:32] are ignored. 
. TTBCR.EAE == 0b1: 64-bit format is used. 


Used in conjunction with the TTBCR. When the 64-bit TTBR1 format is used, cacheability and 
shareability information is held in the TTBCR, not in TTBR1. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


TTBRI1 is a 64-bit register that can also be accessed as a 32-bit value. If it is accessed as a 32-bit 
register, accesses read and write bits [31:0] and do not modify bits [63:32]. 


Field descriptions 


The TTBR1 bit assignments are: 


When TTBCR.EAE == 0: 


32 31 





RESO TTB1 


L IRGN[0] 
IMP 


NOS 
IRGN[1] 


Bits [63:32] 


Reserved, RESO. 


TTB1, bits [31:7] 


Translation table base address, bits[31:14]. Register bits [13:7] are RESO, with the additional 
requirement that if these bits are not all zero, this is a misaligned translation table base address, with 
effects that are CONSTRAINED UNPREDICTABLE, and must be one of the following: 


$ Register bits [13:7] are treated as if all the bits are zero. The value read back from these bits 
is either the value written or zero. 


° The result of the calculation of an address for a translation table walk using this register can 
be corrupted in those bits that are nonzero. 


This field resets to an architecturally UNKNOWN value. 
IRGN[1], bit [6] 
This field is bit[1] of IRGN[1:0]. 
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NOS, bit [5] 


Inner region bits. IRGN[1:0] indicate the Inner Cacheability attributes for the memory associated 
with the translation table walks. The possible values of IRGN[1:0] are: 





0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Cacheable. 

0b11 Normal memory, Inner Write-Back no Write-Allocate Cacheable. 
Note 


The encoding of the IRGN bits is counter-intuitive, with register bit[6] being IRGN[0] and register 
bit[0] being IRGN[1]. This encoding is chosen to give a consistent encoding of memory region 
types and to ensure that software written for Armv7 without the Multiprocessing Extensions can run 
unmodified on an implementation that includes the functionality introduced by the ARMv7 
Multiprocessing Extensions. 





The IRGN field is split as follows: 
° IRGN[1] is TTBR1[6]. 
° IRGN[0] is TTBR1[0]. 


This field resets to an architecturally UNKNOWN value. 


Not Outer Shareable. When the value of TTBR1.S is 1, indicates whether the memory associated 
with a translation table walk is Inner Shareable or Outer Shareable: 


0bd Memory is Outer Shareable. 
Qb1 Memory is Inner Shareable. 
This bit is ignored when the value of TTBR1.S is 0. 


This field resets to an architecturally UNKNOWN value. 


RGN, bits [4:3] 


IMP, bit [2] 


S, bit [1] 


Region bits. Indicates the Outer cacheability attributes for the memory associated with the 
translation table walks: 


0b00 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Write-Allocate Cacheable. 
0b10 Normal memory, Outer Write-Through Cacheable. 

0b11 Normal memory, Outer Write-Back no Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


The effect of this bit is IMPLEMENTATION DEFINED. If the translation table implementation does not 
include any IMPLEMENTATION DEFINED features this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Shareable. Indicates whether the memory associated with the translation table walks is 
Non-shareable: 


Qbo Memory is Non-shareable. 


Qb1 Memory is shareable. The TTBR1.NOS field indicates whether the memory is Inner 
Shareable or Outer Shareable. 


This field resets to an architecturally UNKNOWN value. 


IRGN[0], bit [0] 


This field is bit[0] of IRGN[1:0]. 
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See IRGN[1] for the field description. 


When TTBCR.EAE == 1: 


56 55 48 47 


63 1 0 
| RESO ASID BADDR 
| CnP 


Bits [63:56] 


Reserved, RESO. 


ASID, bits [55:48] 


An ASID for the translation table base address. The TTBCR.A1 field selects either TTBRO.ASID 
or TTBR1.ASID. 


This field resets to an architecturally UNKNOWN value. 


BADDR, bits [47:1] 


Translation table base address, bits[47:x], Bits [x-1:1] are RESO, with the additional requirement that 
if bits[x-1:3] are not all zero, this is a misaligned translation table base address, with effects that are 
CONSTRAINED UNPREDICTABLE, and must be one of the following: 


s Register bits [x-1:3] are treated as if all the bits are zero. The value read back from these bits 
is either the value written or zero. 


7 The result of the calculation of an address for a translation table walk using this register can 
be corrupted in those bits that are nonzero. 


x 1s determined from the value of TTBCR.T1SZ as follows: 

. If TTBCR.T1SZ is 0 or 1, x = 5 - TTBCR.T1SZ. 

- If TTBCR.T1SZ is greater than 1, x = 14 - TTBCR.T1SZ. 

If bits[47:40] of the translation table base address are not zero, an Address size fault is generated. 


This field resets to an architecturally UNKNOWN value. 


CnP, bit [0] 
When ARMV8.2-TTCNP is implemented: 


Common not Private. When TTBCR.EAE ==1, this bit indicates whether each entry that is pointed 
to by TTBR1 is a member of a common set that can be used by every PE in the Inner Shareable 
domain for which the value of TTBR1.CnP is 1. 


Qbd The translation table entries pointed to by this instance of TTBR1, for the current ASID, 
are permitted to differ from corresponding entries for this instance of TTBR1 for other 
PEs in the Inner Shareable domain. This is not affected by: 


° The value of TTBR1.CnP on those other PEs. 
° The value of TTBCR.EAE on those other PEs. 


° The value of the current ASID or, for the Non-secure instance of TTBR1, the 
value of the current VMID. 


Qb1 The translation table entries pointed to by this instance of TTBR1 are the same as the 
translation table entries for every other PE in the Inner Shareable domain for which the 
value of TTBR1.CnP is 1 for this instance of TTBR1 and all of the following apply: 


a The translation table entries are pointed to by this instance of TTBR1. 
‘ The value of the applicable TTBCR.EAE field is 1. 
s The ASID is the same as the current ASID. 
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. For the Non-secure instance of TTBR1, the VMID is the same as the current 
VMID. 


When a TLB combines entries from stage 1 translation and stage 2 translation into a single entry, 
that entry can only be shared between different PEs if the value of the CnP bit is 1 for both stage 1 
and stage 2. 


Note 


If the value of the TTBR1.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and 
those TTBR1s do not point to the same translation table entries when the other conditions specified 
for the case when the value of CnP is 1 apply, then the results of translations are CONSTRAINED 
UNPREDICTABLE, see CONSTRAINED UNPREDICTABLE behaviors due to caching of control or 





data values on page K1-7611. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Accessing the TTBR1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 


CRm opc2 





Ob1111 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return TIBR1_S<31:0>; 





else 
return TTBR1_NS<31:0>; 
else 
return TIBR1<31:0>; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return TIBR1_NS<31:0>; 
else 
return TIBR1<31:0>; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return TIBR1_S<31:0>; 
else 





return TIBR1_NS<31:0>; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b0010 O0b0000 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 
UNDEFINED; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP1ISSDISABLE2 == HIGH then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
TTBR1I_S = ZeroExtend(R[t]); 
else 
TTBRI_NS = ZeroExtend(R[t]); 
else 
TTBR1 = ZeroExtend(R[t]); 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
TTBRI_NS = ZeroExtend(R[t]); 
else 





TTBR1 = ZeroExtend(R[t]); 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q@' && CP15SDISABLE == HIGH then 
UNDEFINED; 
elsif SCR.NS == 'Q' && CPISSDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
TTBR1_S = ZeroExtend(R[t]); 
else 





TTBRI_NS = ZeroExtend(R[t]); 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1111 0b0010 0b0001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TRVM == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
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return TTBR1_S; 
else 
return TTBR1_NS; 
else 
return TTBR1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return TTBRI_NS; 
else 
return TTBR1; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return TTBR1_S; 
else 





return TTBR1_NS; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 





CRm opc1 





0b0010 0b0001 





elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 


UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TVM == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
TTBR1I_S = R[t2]:R[t]; 
else 
TTBRI_LNS = R[t2]:R[t]; 
else 
TTBR1 = R[t2]:R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
TTBRI_NS = R[t2]:R[t]; 
else 











TTBR1 = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' && CP15SDISABLE == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
TTBR1_S = R[t2]:R[t]; 
else 
TTBRI_NS = R[t2]:R[t]; 
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The VBAR characteristics are: 


Purpose 


When high exception vectors are not selected, holds the vector base address for exceptions that are 
not taken to Monitor mode or to Hyp mode. 


Software must program VBAR(NS) with the required initial value as part of the PE boot sequence. 


Configurations 


AArch32 System register VBAR[31:0] is architecturally mapped to AArch64 System register 
VBAR_EL1[31:0]. 

Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. If the PE resets into EL3 using AArch32 they apply 


only to the Secure instance of the register. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
VBAR is a 32-bit register. 


Field descriptions 


The VBAR bit assignments are: 


31 5 4 0 
Vector Base Address RESO 
Bits [31:5] 


Vector Base Address. Bits[31:5] of the base address of the exception vectors for exceptions taken to 


this Exception level. Bits[4:0] of an exception vector are the exception offset. 


This field resets to an IMPLEMENTATION DEFINED value. 
Bits [4:0] 


Reserved, RESO. 


Accessing the VBAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





Ob1111 0b000 = 0b1100 0b0000 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return VBAR_S; 
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else 
return VBAR_NS; 
else 
return VBAR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return VBAR_NS; 
else 
return VBAR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return VBAR_S; 
else 
return VBAR_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opci 


CRm opc2 





Ob1111 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 


0b0000 0b000 


elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CPLSSDISABLE == HIGH then 


UNDEFINED; 


elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == '@' && CP1ISSDISABLE2 == HIGH then 


UNDEFINED; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 


VBAR_S = R[t]; 
else 
VBAR_NS = R[t]; 
else 
VBAR = R[t]; 


elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
VBAR_NS = R[t]; 
else 
VBAR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q@' && CPLISSDISABLE == HIGH then 


UNDEFINED; 
elsif SCR.NS == 'Q' && CPI5SDISABLE2 == HIGH then 
UNDEFINED; 
else 
if SCR.NS == 'Q' then 
VBAR_S = R[t]; 
else 


VBAR_NS = R[t]; 
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G8.2.167 VMPIDR, Virtualization Multiprocessor ID Register 


The VMPIDR characteristics are: 


Purpose 
Holds the value of the Virtualization Multiprocessor ID. This is the value returned by Non-secure 
EL1 reads of MPIDR. 

Configurations 


AArch32 System register VMPIDR[31:0] is architecturally mapped to AArch64 System register 
VMPIDR_EL2[31:0]. 


If EL2 is not implemented but EL3 is implemented, this register takes the value of the MPIDR. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 with EL2 using AArch32, or into EL3 with EL3 using AArch32. Otherwise, RW fields in 
this register reset to architecturally UNKNOWN values. 


Attributes 
VMPIDR is a 32-bit register. 


Field descriptions 


The VMPIDR bit assignments are: 


31 30 29 25 24 23 16 15 8 7 0 


eee 


ARM DDI 0487E.a 
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M, bit [31] 


Indicates whether this implementation includes the functionality introduced by the ARMv7 
Multiprocessing Extensions. The possible values of this bit are: 


Ob This implementation does not include the ARMv7 Multiprocessing Extensions 
functionality. 


Qb1 This implementation includes the ARMv7 Multiprocessing Extensions functionality. 


From Armv8 this bit is RES]. 


U, bit [30] 


Indicates a Uniprocessor system, as distinct from PE 0 in a multiprocessor system. The possible 
values of this bit are: 


0bd Processor is part of a multiprocessor system. 
Qb1 Processor is part of a uniprocessor system. 
In a system where the PE resets into EL2 or EL3, this field resets to the value in MPIDR.U. 


Bits [29:25] 
Reserved, RESO. 
MT, bit [24] 


Indicates whether the lowest level of affinity consists of logical PEs that are implemented using a 
multithreading type approach. See the description of Aff0 for more information about affinity 
levels. The possible values of this bit are: 


Qbd Performance of PEs at the lowest affinity level is largely independent. 
Qb1 Performance of PEs at the lowest affinity level is very interdependent. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6363 


Non-Confidential 


AArch32 System Register Descriptions 
G8.2 General system control registers 


G8-6364 


In a system where the PE resets into EL2 or EL3, this field resets to the value in MPIDR.MT. 


Aff2, bits [23:16] 


Affinity level 2. See the description of Aff0 for more information. 


In a system where the PE resets into EL2 or EL3, this field resets to the value in MPIDR.Aff2. 


Affl, bits [15:8] 


Affinity level 1. See the description of Aff0 for more information. 
In a system where the PE resets into EL2 or EL3, this field resets to the value in MPIDR.Aff1. 


Aff, bits [7:0] 


Affinity level 0. This is the affinity level that is most significant for determining PE behavior. Higher 
affinity levels are increasingly less significant in determining PE behavior. The assigned value of 
the MPIDR. {Aff2, Affl, Aff0} or MPIDR EL1.{Aff3, Aff2, Affl, Aff0} set of fields of each PE 
must be unique within the system as a whole. 


In a system where the PE resets into EL2 or EL3, this field resets to the value in MPIDR.Aff0. 


Accessing the VMPIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b0000 0b0000 0b101 





if PSTATE.EL == EL@ then 


UNDE 


FINED; 


elsif PSTATE.EL == EL1 then 


if E 


elsi 


else 


L2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


f EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


UNDEFINED; 


elsif PSTATE.EL == EL2 then 


retu 


rn VMPIDR; 


elsif PSTATE.EL == EL3 then 


if | 


elsi 


else 


HaveEL(EL2) then 
return MPIDR; 

f SCR.NS == 'Q' then 
UNDEFINED; 





return VMPIDR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


if PSTAT 
UNDE 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b0000 O0b0000 0b101 





E.EL == EL@ then 
FINED; 


elsif PSTATE.EL == EL1 then 


if E 


L2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsi 


f EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VMPIDR = R[t]; 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
//no operation 
elsif SCR.NS == 'Q' then 
UNDEFINED; 





else 
VMPIDR = R[t]; 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) then 
return VMPIDR_EL2<31:0>; 
elsif EL2Enabled() && ELUsingAArch32(EL2) then 
return VMPIDR; 
else 
return MPIDR; 
elsif PSTATE.EL == EL2 then 
return MPIDR; 
elsif PSTATE.EL == EL3 then 
return MPIDR; 


coproc opct CRn CRm opc2 
Ob1111 0b000 0b0000 0b0000 0b101 
G8-6365 
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G8.2.168 VPIDR, Virtualization Processor ID Register 
The VPIDR characteristics are: 


Purpose 
Holds the value of the Virtualization Processor ID. This is the value returned by Non-secure EL1 
reads of MIDR. 

Configurations 


AArch32 System register VPIDR[3 1:0] is architecturally mapped to AArch64 System register 
VPIDR_EL2[31:0]. 


If EL2 is not implemented but EL3 is implemented, this register takes the value of the MIDR. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 with EL2 using AArch32, or into EL3 with EL3 using AArch32. Otherwise, RW fields in 
this register reset to architecturally UNKNOWN values. 


Attributes 
VPIDR is a 32-bit register. 


Field descriptions 


The VPIDR bit assignments are: 


31 24 23 20 19 1615 4 3 0 


Architecture es 


Implementer, bits [31:24] 


The Implementer code. This field must hold an implementer code that has been assigned by Arm. 
Assigned codes include the following: 





Hex representation ASCII representation Implementer 
































0x41 A Arm Limited 
0x42 B Broadcom Corporation 
0x43 C Cavium Inc. 
0x44 D Digital Equipment Corporation 
0x49 I Infineon Technologies AG 
0x4D M Motorola or Freescale Semiconductor Inc. 
0x4E N NVIDIA Corporation 
0x50 P Applied Micro Circuits Corporation 
0x51 Q Qualcomm Inc. 
0x56 V Marvell International Ltd. 
0x69 i Intel Corporation 
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Arm can assign codes that are not published in this manual. All values not assigned by Arm are 


reserved and must not be used. 


In a system where the PE resets into EL2 or EL3, this field resets to the value in MIDR.Implementer. 


Variant, bits [23:20] 


An IMPLEMENTATION DEFINED variant number. Typically, this field is used to distinguish between 


different product variants, or major revisions of a product. 


In a system where the PE resets into EL2 or EL3, this field resets to the value in MIDR. Variant. 


Architecture, bits [19:16] 
The permitted values of this field are: 
0b0001 Armv4. 
0b0010 Armv4T. 
0b0011 Armv5 (obsolete). 
0b0100 ArmvST. 
0b0101 Armv5TE. 
0b0110 ArmvSTEJ. 
0b0111 Armv6. 


Qb1111 Architectural features are individually identified in the ID_* registers, see ZD registers 


on page K14-7856. 


All other values are reserved. 


In a system where the PE resets into EL2 or EL3, this field resets to the value in MIDR.Architecture. 


PartNum, bits [15:4] 


An IMPLEMENTATION DEFINED primary part number for the device. 


On processors implemented by Arm, if the top four bits of the primary part number are 0x0 or 0x7, 


the variant and architecture are encoded differently. 


In a system where the PE resets into EL2 or EL3, this field resets to the value in MIDR.PartNum. 


Revision, bits [3:0] 


An IMPLEMENTATION DEFINED revision number for the device. 


In a system where the PE resets into EL2 or EL3, this field resets to the value in MIDR.Revision. 


Accessing the VPIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b100 0b0000 0b0000 


0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VPIDR; 
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elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
return MIDR; 
elsif SCR.NS == 'Q' then 
UNDEFINED; 
else 
return VPIDR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b100 0b0000 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VPIDR = R[t]; 
elsif PSTATE.EL == EL3 then 
if !HaveEL(EL2) then 
//no operation 
elsif SCR.NS == 'Q' then 
UNDEFINED; 





else 
VPIDR = R[t]; 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b0000 0b0000 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T0 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) then 
return VPIDR_EL2<31:0>; 
elsif EL2Enabled() && ELUsingAArch32(EL2) then 
return VPIDR; 
else 
return MIDR; 
elsif PSTATE.EL == EL2 then 
return MIDR; 
elsif PSTATE.EL == EL3 then 
return MIDR; 
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G8.2.169 VTCR, Virtualization Translation Control Register 
The VTCR characteristics are: 


Purpose 
The control register for stage 2 of the Non-secure PL1&0 translation regime. 


Note 


This stage of translation always uses the Long-descriptor translation table format. 








Configurations 


AArch32 System register VTCR[3 1:0] is architecturally mapped to AArch64 System register 
VTCR_EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
VTCR is a 32-bit register. 


Field descriptions 


The VTCR bit assignments are: 


31 30 29 28 27 26 25 24 14131211109 8 7 6 5 4 3 





RES1 — | | es 
RESO IRGNO 
HWU62 ORGNO 
HWU61 
HWU60 
HWU59 

Bit [31] 


Reserved, RES1. 


Bits [30:29] 


Reserved, RESO. 


HWU8O2, bit [28] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[62] of the stage 2 
translation table Block or Page entry. 


Qbd Bit[62] of each stage 2 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[62] of each stage 2 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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HWU61, bit [27] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[61] of the stage 2 
translation table Block or Page entry. 


ObO Bit[61] ofeach stage 2 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


0b1 Bit[61] of each stage 2 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU60, bit [26] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[60] of the stage 2 
translation table Block or Page entry. 


ObO Bit[60] ofeach stage 2 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[60] of each stage 2 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HWU59, bit [25] 
When ARMV8.2-TTPBHA is implemented: 


Hardware Use. Indicates IMPLEMENTATION DEFINED hardware use of bit[59] of the stage 2 
translation table Block or Page entry. 


ObO Bit[59] ofeach stage 2 translation table Block or Page entry cannot be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


Qb1 Bit[59] of each stage 2 translation table Block or Page entry can be used by hardware 
for an IMPLEMENTATION DEFINED purpose. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
Bits [24:14] 
Reserved, RESO. 
SHO, bits [13:12] 


Shareability attribute for memory associated with translation table walks using VITTBR. 


Oboe Non-shareable. 
0b10 Outer Shareable. 
Qb11 Inner Shareable. 


Other values are reserved. The effect of programming this field to a Reserved value is that behavior 
is CONSTRAINED UNPREDICTABLE, as described in Reserved values in System and memory-mapped 
registers and translation table entries on page K1-7628. 


This field resets to an architecturally UNKNOWN value. 
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ORGNO, bits [11:10] 


Outer cacheability attribute for memory associated with translation table walks using VITBR. 


0bd0 Normal memory, Outer Non-cacheable. 

0b01 Normal memory, Outer Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Outer Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Outer Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


IRGNO, bits [9:8] 


Inner cacheability attribute for memory associated with translation table walks using VTTBR. 


0b00 Normal memory, Inner Non-cacheable. 

0b01 Normal memory, Inner Write-Back Read-Allocate Write-Allocate Cacheable. 

0b10 Normal memory, Inner Write-Through Read-Allocate No Write-Allocate Cacheable. 
0b11 Normal memory, Inner Write-Back Read-Allocate No Write-Allocate Cacheable. 


This field resets to an architecturally UNKNOWN value. 


SLO, bits [7:6] 
Starting level for translation table walks using VTTBR. 
0b00 Start at level 2 
0b01 Start at level 1 


All other values are reserved. If this field is programmed to a reserved value, or to a value that is not 
consistent with the programming of TOSZ, then a stage 2 level 1 Translation fault is generated. 


This field resets to an architecturally UNKNOWN value. 
Bit [5] 

Reserved, RESO. 
S, bit [4] 


Sign extension bit. This bit must be programmed to the value of TOSZ[3]. If it is not, then the 
behavior is CONSTRAINED UNPREDICTABLE and the stage 2 TOSZ value is treated as an UNKNOWN 
value, see Misprogramming VTCR.S on page K1-7625. 


This field resets to an architecturally UNKNOWN value. 
TOSZ, bits [3:0] 
The size offset of the memory region addressed by VITBR. The region size is 2G2-TSZ) bytes. 


This field holds a four-bit signed integer value, meaning it supports values from -8 to 7. 





Note 


This is different from the other translation control registers, where TnSZ holds a three-bit unsigned 
integer, supporting values from 0 to 7. 





If this field is programmed to a value that is not consistent with the programming of SLO then a stage 
2 level 1 Translation fault is generated. 


This field resets to an architecturally UNKNOWN value. 


Accessing the VTCR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b100 0b0010 O0b0001 


opc2 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VICR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
return VICR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b100 0b0010 0b0001 


0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VICR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
VICR = R[t]; 
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G8.2.170 VTTBR, Virtualization Translation Table Base Register 
The VTTBR characteristics are: 


Purpose 


Holds the base address of the translation table for the initial lookup for stage 2 of an address 
translation in the Non-secure PL1&0 translation regime, and other information for this translation 
regime. 

Configurations 


AArch32 System register VTTBR[63:0] is architecturally mapped to AArch64 System register 
VTTBR_EL2[63:0]. 


If EL2 is not implemented, this register is RESO from EL3. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 with EL2 using AArch32, or into EL3 with EL3 using AArch32. Otherwise, RW fields in 
this register reset to architecturally UNKNOWN values. 


Attributes 
VTTBR is a 64-bit register. 


Field descriptions 


The VTTBR bit assignments are: 


56 55 48 47 


63 1 0 
| RESO VMID BADDR 


Bits [63:56] 


CnP 


Reserved, RESO. 


VMID, bits [55:48] 
The VMID for the translation table. 
In a system where the PE resets into EL2 or EL3, this field resets to 0. 


BADDR, bits [47:1] 


Translation table base address, bits[47:x], Bits [x-1:1] are RESO, with the additional requirement that 
if bits[x-1:3] are not all zero, this is a misaligned translation table base address, with effects that are 
CONSTRAINED UNPREDICTABLE, and must be one of the following: 


` Register bits [x-1:3] are treated as if all the bits are zero. The value read back from these bits 
is either the value written or zero. 


$ The result of the calculation of an address for a translation table walk using this register can 
be corrupted in those bits that are nonzero. 


x is determined from the value of VTCR.SLO and VTCR.TOSZ as follows: 

- If VTCR.SLO is 0b00, meaning that lookup starts at level 2, then x is 14 - VTCR.TOSZ. 

à If VTCR.SLO is @b01, meaning that lookup starts at level 1, then x is 5 - VTCR.TOSZ. 

è If VTCR.SLO is either 0b10 or 0b11 then a stage 2 level 1 Translation fault is generated. 

If bits[47:40] of the translation table base address are not zero, an Address size fault is generated. 


In a system where the PE resets into EL2 or EL3, this field resets to an architecturally UNKNOWN 
value. 
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CnP, bit [0] 


When ARMV8.2-TTCNP is implemented: 


Common not Private. This bit indicates whether each entry that is pointed to by VITBR is amember 
of a common set that can be used by every PE in the Inner Shareable domain for which the value of 
VTTBR.CoP is 1. 


Qbd The translation table entries pointed to by VTTBR are permitted to differ from the 
entries for VTTBR for other PEs in the Inner Shareable domain. This is not affected by 
the value of the current VMID. 


Qb1 The translation table entries pointed to by VTTBR are the same as the translation table 
entries for every other PE in the Inner Shareable domain for which the value of 
VTTBR.CoP is 1 and the VMID is the same as the current VMID. 


When a TLB combines entries from stage 1 translation and stage 2 translation into a single entry, 
that entry can only be shared between different PEs if the value of the CnP bit is 1 for both stage 1 
and stage 2. 


Note 


If the value of the VTTBR.CnP bit is 1 on multiple PEs in the same Inner Shareable domain and 
those VTTBRs do not point to the same translation table entries when the VMID value is the same 
as the current VMID, then the results of translations are CONSTRAINED UNPREDICTABLE, see 
CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values on 

page K1-7611. 








In a system where the PE resets into EL2 or EL3, this field resets to an architecturally UNKNOWN 
value. 


Otherwise: 


Reserved, RESO. 


Accessing the VITBR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


coproc CRm opc1 





0b1111 0b0010 0b0110 


if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 


else 


UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VTTBR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 


else 
return 


VTTBR; 
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MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 


0b1111 0b0010 0b0110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T2 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T2 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VTTBR = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
VTTBR = R[t2]:R[t]; 
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G8.3 Debug registers 


This section lists the Debug System registers in AArch32 state, in alphabetic order. 
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G8.3.1 DBGAUTHSTATUS, Debug Authentication Status register 


ARM DDI 0487E.a 
ID070919 


The DBGAUTHSTATUS characteristics are: 


Purpose 
Provides information about the state of the IMPLEMENTATION DEFINED authentication interface for 
debug. 


Configurations 


AArch32 System register DBGAUTHSTATUS[3 1:0] is architecturally mapped to AArch64 System 
register DBGAUTHSTATUS _EL1[31:0]. 


AArch32 System register DBGAUTHSTATUS[31:0] is architecturally mapped to External register 
DBGAUTHSTATUS EL1[31:0]. 


This register is required in all implementations. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DBGAUTHSTATUS is a 32-bit register. 


Field descriptions 


The DBGAUTHSTATUS bit assignments are: 


31 876543 210 


RESO SNID sof | NSID 


a NSNID 


Bits [31:8] 


Reserved, RESO. 


SNID, bits [7:6] 
When ARMV8.4-Debug is implemented: 
Secure Non-Invasive Debug. 
This field has the same value as DBGAUTHSTATUS.SID. 
Otherwise: 


Secure Non-Invasive Debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR.NS is 1. 
0b10 Implemented and disabled. ExternalSecureNoninvasiveDebugEnabled() == FALSE. 
0b11 Implemented and enabled. ExternalSecureNoninvasiveDebugEnabled() == TRUE. 


All other values are reserved. 


SID, bits [5:4] 


Secure Invasive Debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 1. 
0b10 Implemented and disabled. ExternalSecureInvasiveDebugEnabled() == FALSE. 
Qb11 Implemented and enabled. ExternalSecureInvasiveDebugEnabled() == TRUE. 


All other values are reserved. 
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NSNID, bits [3:2] 
When ARMV8.4-Debug is implemented: 


Non-secure Non-invasive debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR.NS is 0. 


0b11 Implemented and enabled. EL3 is implemented or the Effective value of SCR.NS is 1. 


All other values are reserved. 
Otherwise: 


Non-secure Non-Invasive Debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR.NS is 0 
0b10 Implemented and disabled. ExternalNoninvasiveDebugEnabled() == FALSE. 
Qb11 Implemented and enabled. ExternalNoninvasiveDebugEnabled() == TRUE. 


All other values are reserved. 


NSID, bits [1:0] 


Non-secure Invasive Debug. 


0b00 Not implemented. EL3 is not implemented or the Effective value of SCR_EL3.NS is 0. 
0b10 Implemented and disabled. ExternallnvasiveDebugEnabled() == FALSE. 
0b11 Implemented and enabled. ExternalInvasiveDebugEnabled() == TRUE. 


All other values are reserved. 


Accessing the DBGAUTHSTATUS 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f{, {#}<opc2>} 











coproc opc1 CRn CRm opc2 
0b1110 0b000 0b0111 0b1110 0b110 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != '00' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGAUTHSTATUS; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGAUTHSTATUS; 
elsif PSTATE.EL == EL3 then 
return DBGAUTHSTATUS; 
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G8.3.2 DBGBCR<n>, Debug Breakpoint Control Registers, n = 0 - 15 


ARM DDI 0487E.a 
ID070919 


The DBGBCR<n> characteristics are: 


Purpose 


Holds control information for a breakpoint. Forms breakpoint n together with value register 
DBGBVR<n>. If EL2 is implemented and this breakpoint supports Context matching, 
DBGBVR<n> can be associated with a Breakpoint Extended Value Register DBGBXVR<n> for 
VMID matching. 


Configurations 


Attributes 


AArch32 System register DBGBCR<n>[31:0] is architecturally mapped to AArch64 System 
register DBGBCR<n>_EL1[31:0]. 


AArch32 System register DBGBCR<n>[3 1:0] is architecturally mapped to External register 
DBGBCR<n>_EL1[31:0]. 


If breakpoint n is not implemented then accesses to this register are UNDEFINED. 


This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 


DBGBCR<n> is a 32-bit register. 


Field descriptions 


The DBGBCR<n> bit assignments are: 


31 


24 23 20 19 16 15 14 13 12 5 43 210 


When the E field is zero, all the other fields in the register are ignored. 


Bits [31:24] 


Reserved, RESO. 


BT, bits [23:20] 


Breakpoint Type. Possible values are: 
Qb0000 Unlinked instruction address match. DBGBVR<n> is the address of an instruction. 


0b0001 As 0b0000 with linking enabled. 


0b0010 Unlinked Context ID match. When ARMv8.1-VHE is implemented, EL2 is using 
AArché64, and the Effective value of HCR_EL2.E2H is 1, if either the PE is executing 
at ELO with HCR_EL2.TGE set to 0 or the PE is executing at EL2, then 
DBGBVR<n>.ContextID must match the CONTEXTIDR_EL2 value. Otherwise 
DBGBVR<n>.ContextID must match the CONTEXTIDR value. 


0b0011 As 0b0010 with linking enabled. 

0b0100 Unlinked instruction address mismatch. DBGBVR<n> is the address of an instruction 
to be stepped. 

0b0101 As 0b0100 with linking enabled. 


0b0110 Unlinked CONTEXTIDR_EL1 match. DBGBVR<n>.ContextID is a Context ID 
compared against CONTEXTIDR. 
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0b0111 As 0b0110 with linking enabled. 


0b1000 Unlinked VMID match. DBGBXVR<n>.VMID is a VMID compared against 
VTTBR.VMID. 


0b1001 As 0b1000 with linking enabled. 


0b1010 Unlinked VMID and Context ID match. DBGBVR<n>.ContextID is a Context ID 
compared against CONTEXTIDR, and DBGBXVR<n>.VMID is a VMID compared 
against VITBR.VMID. 


0b1011 As 0b1010 with linking enabled. 


0b1100 Unlinked CONTEXTIDR_EL2 match. DBGBXVR<n>.ContextID2 is a Context ID 
compared against CONTEXTIDR_EL2. 


0b1101 As 0b1100 with linking enabled. 


0b1110 Unlinked Full Context ID match. DBGBVR<n>.ContextID is compared against 
CONTEXTIDR, and DBGBXVR<n>.ContextID2 is compared against 
CONTEXTIDR_EL2. 


Qb1111 As 0b1110 with linking enabled. 


For more information on Breakpoints and their constraints, see Breakpoint exceptions on 
page G2-5628 and Reserved DBGBCR<n>.BT values on page G2-5648. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


LBN, bits [19:16] 


Linked breakpoint number. For Linked address matching breakpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


For all other breakpoint types this field is ignored and reads of the register return an UNKNOWN 
value. 


This field is ignored when the value of DBGBCR<n>.E is 0. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


SSC, bits [15:14] 


HMC, bit [13] 


Bits [12:9] 


Security state control. Determines the Security states under which a Breakpoint debug event for 
breakpoint n is generated. This field must be interpreted along with the HMC and PMC fields, and 
there are constraints on the permitted values of the {HMC, SSC, PMC} fields. 


For more information, see Execution conditions for which a breakpoint generates Breakpoint 
exceptions on page G2-5637, and Reserved DBGBCR<n>.{SSC, HMC, PMC} values on 
page G2-5649. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Higher mode control. Determines the debug perspective for deciding when a Breakpoint debug 
event for breakpoint n is generated. This field must be interpreted along with the SSC and PMC 
fields, and there are constraints on the permitted values of the {HMC, SSC, PMC} fields. For more 
information see the SSC, bits [15:14] description. 


For more information on the operation of the SSC, HMC, and PMC fields, see Execution conditions 
for which a breakpoint generates Breakpoint exceptions on page G2-5637. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


BAS, bits [8:5] 


Byte address select. Defines which half-words an address-matching breakpoint matches, regardless 
of the instruction set and Execution state. 


The permitted values depend on the breakpoint type. 
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For Address match breakpoints, the permitted values are: 





BAS Match instruction at Constraint for debuggers 








0b0011 DBGBVR<n> Use for T32 instructions 
0b1100 + DBGBVR<n>+2 Use for T32 instructions 
0b1111 DBGBVR<n> Use for A32 instructions 





All other values are reserved. For more information, see Reserved DBGBCR<n>.{SSC, HMC, 
PMC} values on page G2-5649. 


For more information on using the BAS field in Address Match breakpoints, see Using the BAS field 
in Address Match breakpoints on page G2-5641. 


For Address mismatch breakpoints in an AArch32 stage | translation regime, the permitted values 
are: 





BAS Step instruction at Constraint for debuggers 














0b0000 - Use for a match anywhere breakpoint 
0b0011 DBGBVR<n> Use for T32 instructions 
0b1100 =DBGBVR<n>+2 Use for T32 instructions 
0b1111 DBGBVR<n> Use for A32 instructions 





All other values are reserved. For more information, see Reserved DBGBCR<n>.{SSC, HMC, 
PMC} values on page G2-5649. 


For more information on using the BAS field in address mismatch breakpoints, see Using the BAS 
field in Address Match breakpoints on page G2-5641. 


For Context matching breakpoints, this field is RES1 and ignored. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [4:3] 


Reserved, RESO. 


PMC, bits [2:1] 


Privilege mode control. Determines the Exception level or levels at which a Breakpoint debug event 
for breakpoint n is generated. This field must be interpreted along with the SSC and HMC fields, 
and there are constraints on the permitted values of the {HMC, SSC, PMC} fields. For more 
information see the DBGBCR<n>.SSC description. 


For more information on the operation of the SSC, HMC, and PMC fields, see Execution conditions 
for which a breakpoint generates Breakpoint exceptions on page G2-5637. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


E, bit [0] 
Enable breakpoint DBGBVR<n>. Possible values are: 
Obd Breakpoint disabled. 
Qb1 Breakpoint enabled. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGBCR<n> 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


0b1110  Ob000 Ob0000 n[3:0] Ob101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBCR[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBCR[UInt(CRm<3:@>) ]; 
elsif PSTATE.EL == EL3 then 
if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBCR[UInt(CRm<3:@>)]; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110  Ob000 O0b0000 n[3:0] Ob101 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGBCR[UInt(CRm<3:@>)] = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGBCR[UInt(CRm<3:@>)] = R[t]; 
elsif PSTATE.EL == EL3 then 
if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
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else 
DBGBCR[UInt(CRm<3:@>)] = R[t]; 
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G8.3.3 


G8-6384 


DBGBVR<n>, Debug Breakpoint Value Registers, n = 0 - 15 


The DBGBVR<n> characteristics are: 


Purpose 


Holds a value for use in breakpoint matching, either the virtual address of an instruction or a context 
ID. Forms breakpoint n together with control register DBGBCR<n>. If EL2 is implemented and this 
breakpoint supports Context matching, DBGBVR<n> can be associated with a Breakpoint 
Extended Value Register DBGBXVR<n> for VMID matching. 


Configurations 


AArch32 System register DBGBVR<n>[3 1:0] is architecturally mapped to AArch64 System 
register DBGBVR<n>_EL1[31:0]. 

AArch32 System register DBGBVR<n>[3 1:0] is architecturally mapped to External register 
DBGBVR<n>_EL1[31:0]. 


Note 
Writes to DBGBVR<n> do not modify DBGBVR<n>_EL1[63:32]. 








If breakpoint n is not implemented then accesses to this register are UNDEFINED. 
This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 


Attributes 
How this register is interpreted depends on the value of DBGBCR<n>.BT. 
° When DBGBCR<n>.BT is 0b0x0x, this register holds a virtual address. 
. When DBGBCR<n>.BT is @bxx1x, this register holds a Context ID. 
For other values of DBGBCR<n>.BT, this register is RESO. 


Some breakpoints might not support Context ID comparison. For more information, see the 
description of the DBGDIDR.CTX_CMPs field. 


Field descriptions 


The DBGBVR<n> bit assignments are: 


When DBGBCR<n>.BT == 0b0x0x: 


31 2 1 0 


Pwr SO 


VA[31:2], bits [31:2] 

Bits[3 1:2] of the address value for comparison. 

On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Bits [1:0] 


Reserved, RESO. 
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When DBGBCR<n>.BT == 0b001x: 


ContextID, bits [31:0] 
Context ID value for comparison. 
The value is compared against CONTEXTIDR_EL2 when all of the following are true: 
° ARMv8.1-VHE is implemented. 
° HCR_EL2.{E2H, TGE} is {1,1}. 
: The PE is executing at ELO. 
è EL2 is enabled in the current Security state, and is using AArch64. 
Otherwise, the value is compared against CONTEXTIDR. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When DBGBCR<n>.BT == 0b101x and HaveEL(EL2): 


ContextID, bits [31:0] 
Context ID value for comparison against CONTEXTIDR. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When DBGBCR<n>.BT == 0bx11x, HaveEL(EL2) and ARMv8.1-VHE is implemented: 


ContextID, bits [31:0] 
Context ID value for comparison against CONTEXTIDR. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGBVR<n> 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


0b1110  O0b000 Ob0000 nf[3:0] O0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBVR[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBVR[UInt(CRm<3:0>) ]; 
elsif PSTATE.EL == EL3 then 
if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBVR[UInt(CRm<3:@>)]; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110  O0b000 Ob0000 n[3:0] 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGBVR[UInt(CRm<3:@>)] = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGBVR[UInt(CRm<3:@>)] = R[t]; 
elsif PSTATE.EL == EL3 then 
if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
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else 
DBGBVR[UInt(CRm<3:@>)] = R[t]; 
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G8.3.4 DBGBXVR<n>, Debug Breakpoint Extended Value Registers, n = 0 - 15 
The DBGBXVR<n> characteristics are: 


Purpose 


Holds a value for use in breakpoint matching, to support VMID matching. Used in conjunction with 
a control register DBGBCR<n> and a value register DBGBVR<n>, where EL2 is implemented and 
breakpoint n supports Context matching. 


Configurations 


AArch32 System register DBGBXVR<n>[31:0] is architecturally mapped to AArch64 System 
register DBGBVR<n>_EL1[63:32]. 


AArch32 System register DBGBXVR<n>[31:0] is architecturally mapped to External register 
DBGBVR<n>_EL1[63:32]. 





Note 
Writes to DBGBXVR<n> do not modify DBGBVR<n>_EL1[31:0]. 


Accesses to this register are UNDEFINED in any of the following cases: 

. Breakpoint n is not implemented. 

. Breakpoint n does not support Context matching. 

. EL2 is not implemented. 

For more information, see the description of the DBGDIDR.CTX_CMPs field. 

This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 


architecturally UNKNOWN values.The register is not affected by a Warm reset. 


Attributes 
How this register is interpreted depends on the value of DBGBCR<n>.BT. 
5 When DBGBCR<n>.BT is 0b10xx, this register holds a VMID. 
$ When DBGBCR<n>.BT is 0b11xx, this register holds a Context ID. 
For other values of DBGBCR<n>.BT, this register is RESO. 


Field descriptions 


The DBGBXVR<n> bit assignments are: 


When DBGBCR<n>.BT == 0b10xx and HaveEL(EL2): 


31 1615 8 7 0 


RESO VMID[15:8] VMID[7:0] 


Bits [31:16] 
Reserved, RESO. 


VMID/[15:8], bits [15:8] 
When ARMv8.1-VMID16 is implemented: 
Extension to VMID[7:0]. See VMID[7:0] for more details. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
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VMID/[7:0], bits [7:0] 
VMID value for comparison. 
The VMID is 8 bits in the following cases. 
$ EL2 is using AArch32. 
° ARMv8.1-VMID16 is not implemented. 


When ARMv8.1-VMID16 is implemented and EL2 is using AArch64, it is IMPLEMENTATION 


DEFINED whether the VMID is 8 bits or 16 bits. 
VMID[15:8] is RESO if any of the following applies: 
s The implementation has an 8-bit VMID. 

` VTCR_EL2.VS has a value of 0. 

a EL2 is using AArch32. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When DBGBCR<n>.BT == 0b11xx and HaveEL(EL2): 


31 0 


ContextID2 


ContextID2, bits [31:0] 
When ARMV8.1-VHE is implemented: 
Context ID value for comparison against CONTEXTIDR_EL2. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Accessing the DBGBXVR<n> 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opc1t CRn CRm opc2 
0b1110 0b000 = 0b0001 n[3:0] 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != '00' then 
AArch32.TakeHypTrapException(Q@xQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 


Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGBXVR[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 


elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
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Halt (DebugHalt_SoftwareAccess) ; 

else 
return DBGBXVR[UInt(CRm<3:0>)]; 

elsif PSTATE.EL == EL3 then 

if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 

else 
return DBGBXVR[UInt(CRm<3:0>)]; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





0b1110  Ob000 0b0001 n[3:0] Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 


else 
DBGBXVR[UInt(CRm<3:0@>)] = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 





else 





DBGBXVR[UInt(CRm<3:@>)] = R[t]; 
elsif PSTATE.EL == EL3 then 
if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGBXVR [UInt(CRm<3:@>)] = R[t]; 
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G8.3.5 DBGCLAIMCLR, Debug Claim Tag Clear register 


ARM DDI 0487E.a 
ID070919 


The DBGCLAIMCLR characteristics are: 





Purpose 
Used by software to read the values of the CLAIM tag bits, and to clear these bits to 0. 
The architecture does not define any functionality for the CLAIM tag bits. 
Note 
CLAIM tags are typically used for communication between the debugger and target software. 
Used in conjunction with the DBGCLAIMSET register. 
Configurations 
AArch32 System register DBGCLAIMCLR[31:0] is architecturally mapped to AArch64 System 
register DBGCLAIMCLR_EL1[31:0]. 
AArch32 System register DBGCLAIMCLR[31:0] is architecturally mapped to External register 
DBGCLAIMCLR_EL1[31:0]. 
An implementation must include 8 CLAIM tag bits. 
This register is in the Cold reset domain. See the CLAIM field description for the effect of a Cold 
reset on the value returned by this register. This register is not affected by a Warm reset. 
Attributes 


DBGCLAIMCLR is a 32-bit register. 


Field descriptions 


The DBGCLAIMCLR bit assignments are: 


31 8 7 0 
RAZ/SBZ CLAIM 
Bits [31:8] 


Reserved, RAZ/SBZ. Software can rely on these bits reading as zero, and must use a should-be-zero 
policy on writes. Implementations must ignore writes. 

CLAIM, bits [7:0] 
Read or clear CLAIM tag bits. Reading this field returns the current value of the CLAIM tag bits. 


Writing a 1 to one of these bits clears the corresponding CLAIM tag bit to 0. This is an indirect write 
to the CLAIM tag bits. A single write operation can clear multiple CLAIM tag bits to 0. 


Writing 0 to one of these bits has no effect. 


On a Cold reset, this field resets to 0. 


Accessing the DBGCLAIMCLR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 




















coproc opct CRn CRm opc2 
0b1110 0b000 = Ob0111 Ob1001 Ob110 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGCLAIMCLR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGCLAIMCLR; 
elsif PSTATE.EL == EL3 then 
return DBGCLAIMCLR; 
MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
coproc opct CRn CRm opc2 
0b1110 0b000 Ob0111 Ob1001 Ob110 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGCLAIMCLR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGCLAIMCLR = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGCLAIMCLR = R[t]; 
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G8.3.6 DBGCLAIMSET, Debug Claim Tag Set register 
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ID070919 


The DBGCLAIMSET characteristics are: 


Purpose 
Used by software to set the CLAIM tag bits to 1. 
The architecture does not define any functionality for the CLAIM tag bits. 


Note 
CLAIM tags are typically used for communication between the debugger and target software. 





Used in conjunction with the DBGCLAIMCLR register. 


Configurations 


AArch32 System register DBGCLAIMSET{[3 1:0] is architecturally mapped to AArch64 System 
register DBGCLAIMSET _EL1[31:0]. 


AArch32 System register DBGCLAIMSET{[31:0] is architecturally mapped to External register 
DBGCLAIMSET EL1[31:0]. 


An implementation must include 8 CLAIM tag bits. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
DBGCLAIMSET is a 32-bit register. 


Field descriptions 


The DBGCLAIMSET bit assignments are: 


31 8 7 0 
RAZ/SBZ CLAIM 
Bits [31:8] 


Reserved, RAZ/SBZ. Software can rely on these bits reading as zero, and must use a should-be-zero 
policy on writes. Implementations must ignore writes. 

CLAIM, bits [7:0] 
Set CLAIM tag bits. RAO. 


Writing a 1 to one of these bits sets the corresponding CLAIM tag bit to 1. This is an indirect write 
to the CLAIM tag bits. A single write operation can set multiple CLAIM tag bits to 1. 


Writing 0 to one of these bits has no effect. 


On a Cold reset, this field resets to 0. 


Accessing the DBGCLAIMSET 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 




















coproc opct CRn CRm opc2 
0b1110 0b000 Ob0111 Ob1000 Ob110 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGCLAIMSET; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGCLAIMSET; 
elsif PSTATE.EL == EL3 then 
return DBGCLAIMSET; 
MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
coproc opct CRn CRm opc2 
0b1110 0b000 Ob0111 Ob1000 Ob110 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGCLAIMSET = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGCLAIMSET = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGCLAIMSET = R[t]; 
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G8.3.7 DBGDCCINT, DCC Interrupt Enable Register 


The DBGDCCINT characteristics are: 


Purpose 


Enables interrupt requests to be signaled based on the DCC status flags. 


Configurations 


Attributes 


AArch32 System register DBGDCCINT[31:0] is architecturally mapped to AArch64 System 
register MDCCINT_EL1[31:0]. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


DBGDCCINT is a 32-bit register. 


Field descriptions 


The DBGDCCINT bit assignments are: 


31 30 29 28 


Bit [31] 


RX, bit [30] 


TX, bit [29] 


Bits [28:0] 


Reserved, RESO. 


DCC interrupt request enable control for DTRRX. Enables a common COMMIRQ interrupt 
request to be signaled based on the DCC status flags. 


Obd No interrupt request generated by DTRRX. 
Qb1 Interrupt request will be generated on RXfull == 1. 


If legacy COMMRX and COMMTX signals are implemented, then these are not affected by the 
value of this bit. 


On a Warm reset, this field resets to 0. 


DCC interrupt request enable control for DTRTX. Enables a common COMMIRQ interrupt 
request to be signaled based on the DCC status flags. 


Qbd No interrupt request generated by DTRTX. 
Qb1 Interrupt request will be generated on TXfull == 0. 


If legacy COMMRX and COMMTX signals are implemented, then these are not affected by the 
value of this bit. 


On a Warm reset, this field resets to 0. 


Reserved, RESO. 
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Accessing the DBGDCCINT 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opc1 


CRm opc2 





0b1110 0b000 


0b0010 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'Q0' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDCCINT; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDCCINT; 
elsif PSTATE.EL == EL3 then 
return DBGDCCINT; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci 


CRm opc2 





0b1110 0b000 


0b0010 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x05); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 

else 





DBGDCCINT = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGDCCINT = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGDCCINT = R[t]; 


G8-6396 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


AArch32 System Register Descriptions 
G8.3 Debug registers 


G8.3.8 DBGDEVID, Debug Device ID register 0 


The DBGDEVID characteristics are: 


Purpose 
Adds to the information given by the DBGDIDR by describing other features of the debug 
implementation. 
Configurations 
This register is required in all implementations. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DBGDEVID is a 32-bit register. 


Field descriptions 


The DBGDEVID bit assignments are: 


28 27 24 23 20 19 1615 12 11 


WPAddrMask 
BPAddrMask 
VectorCatch 


CIDMask, bits [31:28] 


Indicates the level of support for the Context ID matching breakpoint masking capability. Permitted 
values of this field are: 


0b0000 Context ID masking is not implemented. 
0b0001 Context ID masking is implemented. 
All other values are reserved. The value of this for Armv8 is 0b0000. 


AuxRegs, bits [27:24] 
Indicates support for Auxiliary registers. Permitted values for this field are: 
0b0000 None supported. 
0b0001 Support for External Debug Auxiliary Control Register, EDACR. 


All other values are reserved. 


DoubleLock, bits [23:20] 
OS Double Lock implemented. Defined values are: 
0b0000 OS Double Lock is not implemented. DBGOSDLR is RAZ/WI. 
0b0001 OS Double Lock is implemented. DBGOSDLR is RW. 
ARMv8.0-DoubleLock implements the functionality identified by the value 0b0001. 


All other values are reserved. 


VirtExtns, bits [19:16] 
Indicates whether EL2 is implemented. Permitted values of this field are: 
0b0000 EL2 is not implemented. 
0b0001 EL2 is implemented. 
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All other values are reserved. 


VectorCatch, bits [15:12] 
Defines the form of Vector Catch exception implemented. Permitted values of this field are: 
0b0000 Address matching Vector Catch exception implemented. 
0b0001 Exception matching Vector Catch exception implemented. 


All other values are reserved. 


BPAddrMask, bits [11:8] 


Indicates the level of support for the instruction address matching breakpoint masking capability. 
Permitted values of this field are: 


0b0000 Breakpoint address masking might be implemented. If not implemented, 
DBGBCR<n>[28:24] is RAZ/WI. 


0b0001 Breakpoint address masking is implemented. 
Qb1111 Breakpoint address masking is not implemented. DBGBCR<n>[28:24] is RESO. 


All other values are reserved. The value of this for Armv8 is 0b1111. 


WPAddrMask, bits [7:4] 


Indicates the level of support for the data address matching watchpoint masking capability. 
Permitted values of this field are: 


0b0000 Watchpoint address masking might be implemented. If not implemented, 
DBGWCR<n>.MASK (Address mask) is RAZ/WI. 


0b0001 Watchpoint address masking is implemented. 


Qb1111 Watchpoint address masking is not implemented. DBGWCR<n>.MASK (Address 
mask) is RESO. 


All other values are reserved. The value of this for Armv8 is 0b0001. 


PCSample, bits [3:0] 


Indicates the level of PC Sample-based Profiling support using external debug registers. Permitted 
values of this field are: 


0b0000 PC Sample-based Profiling Extension is not implemented in the external debug registers 
space. 


0b0010 Only EDPCSR and EDCIDSR are implemented. This option is only permitted if EL3 
and EL2 are not implemented. 


Qb0011 EDPCSR, EDCIDSR, and EDVIDSR are implemented. 
All other values are reserved. 


When ARMv8.2-PCSample is implemented, the only permitted value is 0b0000. 


Note 


ARMv8.2-PCSample implements the PC Sample-based Profiling Extension in the Performance 
Monitors register space, as indicated by the value of PMDEVID.PCSample. 








Accessing the DBGDEVID 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDEVID; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDEVID; 
elsif PSTATE.EL == EL3 then 
return DBGDEVID; 


G8.3 Debug registers 
coproc opct CRn CRm opc2 
0b1110 0b000 Ob0111 O0b0010 0b111 

G8-6399 
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G8.3.9 DBGDEVID1, Debug Device ID register 1 


G8-6400 


The DBGDEVID1 characteristics are: 


Purpose 
Adds to the information given by the DBGDIDR by describing other features of the debug 
implementation. 
Configurations 
This register is required in all implementations. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DBGDEVID1 is a 32-bit register. 


Field descriptions 


The DBGDEVID1 bit assignments are: 


31 43 0 
RESO PCSROffset 
Bits [31:4] 


Reserved, RESO. 


PCSROffset, bits [3:0] 


This field indicates the offset applied to PC samples returned by reads of EDPCSR. Permitted values 


of this field in Armv8 are: 
0b0000 EDPCSR is not implemented. 


0b0010 EDPCSR implemented. Samples have no offset applied and do not sample the 


instruction set state in AArch32 state. 


When ARMv8.2-PCSample is implemented, the only permitted value is 0b0000. 


Note 





ARMv8.2-PCSample implements the PC Sample-based Profiling Extension in the Performance 


Monitors register space, as indicated by the value of PMDEVID.PCSample. 





Accessing the DBGDEVID1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opci CRn CRm opc2 
0b1110 0b000 0b0111 0b0001 Obl11 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'Q0' then 
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AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDEVID1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDEVID1; 
elsif PSTATE.EL == EL3 then 
return DBGDEVID1; 
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G8.3.10 DBGDEVID2, Debug Device ID register 2 


G8-6402 


The DBGDEVID2 characteristics are: 


Purpose 

Reserved for future descriptions of features of the debug implementation. 
Configurations 

There are no configuration notes. 

RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DBGDEVID2 is a 32-bit register. 


Field descriptions 


The DBGDEVID2 bit assignments are: 


31 0 


RESO 


Bits [31:0] 


Reserved, RESO. 


Accessing the DBGDEVID2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
0b1110 0b000 Ob0111 Ob0000 0b111 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDEVID2; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDEVID2; 
elsif PSTATE.EL == EL3 then 
return DBGDEVID2; 
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G8.3.11 DBGDIDR, Debug ID Register 


The DBGDIDR characteristics are: 


Purpose 
Specifies which version of the Debug architecture is implemented, and some features of the debug 
implementation. 

Configurations 
If EL1 cannot use AArch32 then the implementation of this register is OPTIONAL and deprecated. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DBGDIDR is a 32-bit register. 


Field descriptions 


The DBGDIDR bit assignments are: 


28 27 24 23 20 19 16 15 14 13 12 11 0 


fe SE_imp 
RESO 


nSUHD_imp 
RES1 


WRPs, bits [31:28] 
The number of watchpoints implemented, minus 1. 


Permitted values of this field are from 0b0001 for 2 implemented watchpoints, to 0b1111 for 16 
implemented watchpoints. 


The value of 0b0000 is reserved. 
If AArch64 is implemented, this field has the same value as ID AA64DFRO_EL1.WRPs. 


BRPs, bits [27:24] 
The number of breakpoints implemented, minus 1. 


Permitted values of this field are from 0b0001 for 2 implemented breakpoint, to 0b1111 for 16 
implemented breakpoints. 


The value of 0b0000 is reserved. 
If AArch64 is implemented, this field has the same value as ID AA64DFRO_EL1.BRPs. 


CTX_CMPs, bits [23:20] 
The number of breakpoints that can be used for Context matching, minus 1. 


Permitted values of this field are from 0b0000 for 1 Context matching breakpoint, to 0b1111 for 16 
Context matching breakpoints. 


The Context matching breakpoints must be the highest addressed breakpoints. For example, if six 
breakpoints are implemented and two are Context matching breakpoints, they must be breakpoints 
4 and 5. 


If AArch64 is implemented, this field has the same value as ID AA64DFRO_EL1.CTX_CMPs. 
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Version, bits [19:16] 


The Debug architecture version. Defined values are: 


0b0001 
0b0010 
Qb0011 
0b0100 
0b0101 
0b0110 
0b0111 
0b1000 
0b1001 


Armv6, v6 Debug architecture. 


Armv6, v6.1 Debug architecture. 


Armv7, v7 Debug architecture, with baseline CP 14 registers implemented. 


Armv7, v7 Debug architecture, with all CP14 registers implemented. 
Armv7, v7.1 Debug architecture. 

Armv8, v8 Debug architecture. 

Armv8.1, v8 Debug architecture, with Virtualization Host Extensions. 
Armv8.2, v8.2 Debug architecture. 

Armv8.4, v8.4 Debug architecture. 


All other values are reserved. 


In any Armv8 implementation, the values 0b0001, 0b0010, 0b0011, @b0100, and 0b0101 are not 


permitted. 


° If ARMv8.1-VHE is not implemented, the only permitted value is 0b0110. 


° In an Armv8.0 implementation, the value 0b1000 or higher is not permitted. 


Bit [15] 


Reserved, RES]. 


nSUHD_imp, bit [14] 


In Armv7-A, was Secure User Halting Debug not implemented. 


The value of this bit must match the value of the SE_ imp bit. 


Bit [13] 


Reserved, RESO. 


SE_imp, bit [12] 


EL3 implemented. The meanings of the values of this bit are: 


Qbd 
Qb1 


EL3 not implemented. 
EL3 implemented. 


The value of this bit must match the value of the nSUHD_imp bit. 


Bits [11:0] 


Reserved, RESO. 


Accessing the DBGDIDR 


Arm deprecates any access to this register from ELO. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


if PSTATE.EL == EL@ then 





coproc opct CRn CRm 


opc2 





0b1110 0b000 0b0000 0b0000 


0b000 





if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
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else 
AArch64.AArch32SystemAccessTrap(EL1, 0x05); 
elsif ELUsingAArch32(EL1) && DBGDSCRext.UDCCdis == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDA> != 'Q0') then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDIDR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDIDR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDIDR; 
elsif PSTATE.EL == EL3 then 
return DBGDIDR; 
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G8.3.12 


G8-6406 


DBGDRAR, Debug ROM Address Register 


The DBGDRAR characteristics are: 


Purpose 


Defines the base physical address of a 4K B-aligned memory-mapped debug component, usually a 
ROM table that locates and describes the memory-mapped debug components in the system. Armv8 
deprecates any use of this register. 


Configurations 


Attributes 


AArch32 System register DBGDRAR[63:0] is architecturally mapped to AArch64 System register 
MDRAR _ EL1[63:0]. 


If EL1 cannot use AArch32 then the implementation of this register is OPTIONAL and deprecated. 


RW fields in this register reset to architecturally UNKNOWN values. 


DBGDRAR is a 64-bit register that can also be accessed as a 32-bit value. If it is accessed as a 32-bit 
register, bits [31:0] are read. 


Field descriptions 


The DBGDRAR bit assignments are: 


63 


RESO 


Bits [63:48] 


48 47 12 11 210 


ROMADDRJ47:12] RESO 


Reserved, RESO. 


ROMADDR{(47:12], bits [47:12] 


Bits [11:2] 


Bits[47:12] of the ROM table physical address. 


If the physical address size in bits (PAsize) is less than 48 then the register bits corresponding to 
ROMADDR [47:PAsize] are RESO. 


Bits [11:0] of the ROM table physical address are zero. 


Arm strongly recommends that bits ROMADDR[(PAsize-1):32] are zero in any system that 
supports AArch32 at the highest implemented Exception level. 


In an implementation that includes EL3, ROMADDR is an address in Non-secure memory. It is 
IMPLEMENTATION DEFINED whether the ROM table is also accessible in Secure memory. 


Reserved, RESO. 


Valid, bits [1:0] 


This field indicates whether the ROM Table address is valid. The permitted values of this field are: 
0b00 ROM Table address is not valid. Software must ignore ROMADDR. 
0b11 ROM Table address is valid. 


Other values are reserved. 


Accessing the DBGDRAR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


0b1110 0b000 = 0b0001 0b0000 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x05); 
elsif ELUsingAArch32(EL1) && DBGDSCRext.UDCCdis == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDRA> != '00') 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR.TGE == '1' || MDCR_EL2.<TDE,TDA> != '00') then 
AArch32.TakeHypTrapException(QxQ5) ; 
else 
return DBGDRAR<31:0>; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDRA> != 'QQ' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDRA> != '@Q' then 
AArch32.TakeHypTrapException(QxQ5) ; 
else 
return DBGDRAR<31:0>; 
elsif PSTATE.EL == EL2 then 
return DBGDRAR<31:0>; 
elsif PSTATE.EL == EL3 then 
return DBGDRAR<31:0>; 





MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1110 0b0001 0b0000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, Q@xQ@C); 
else 
AArch64.AArch32SystemAccessTrap(EL1, QxQ@C); 
elsif ELUsingAArch32(EL1) && DBGDSCRext.UDCCdis == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, Q@xQ@C); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDRA> != '00') 
then 
AArch64.AArch32SystemAccessTrap(EL2, QxQC); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR.TGE == '1' || MDCR_EL2.<TDE,TDA> != 'QQ') then 
AArch32.TakeHypTrapException(Q@xQC) ; 
else 
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return DBGDRAR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDRA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, QxQC); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDRA> != '@Q' then 
AArch32.TakeHypTrapException(Q@xQC) ; 
else 
return DBGDRAR; 
elsif PSTATE.EL == EL2 then 
return DBGDRAR; 
elsif PSTATE.EL == EL3 then 
return DBGDRAR; 
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G8.3.13 DBGDSAR, Debug Self Address Register 


The DBGDSAR characteristics are: 


Purpose 
In earlier versions of the Arm Architecture, this register defines the offset from the base address 
defined in DBGDRAR of the physical base address of the debug registers for the PE. Armv8 
deprecates any use of this register. 

Configurations 
If EL1 cannot use AArch32 then the implementation of this register is OPTIONAL and deprecated. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


DBGDSAR is a 64-bit register that can also be accessed as a 32-bit value. If it is accessed as a 32-bit 
register, bits [31:0] are read. 


Field descriptions 


The DBGDSAR bit assignments are: 


63 0 
Offset 


Offset, bits [63:0] 
This register value is RAZ. 


Accessing the DBGDSAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





0b1110 0b000 = 0b0010 0b0000 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x05); 
elsif ELUsingAArch32(EL1) && DBGDSCRext.UDCCdis == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDRA> != 'Q0') 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR.TGE == '1' || MDCR_EL2.<TDE,TDA> != '00') then 
AArch32.TakeHypTrapException(Q@xQ5) ; 
else 
return DBGDSAR<31:0>; 
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elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDRA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDRA> != '@Q' then 
AArch32.TakeHypTrapException(Q@xQ5) ; 
else 
return DBGDSAR<31:0>; 
elsif PSTATE.EL == EL2 then 
return DBGDSAR<31:0>; 
elsif PSTATE.EL == EL3 then 
return DBGDSAR<31:0>; 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm 


opc1 





0b1110 0b0010 


0b0000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, @xQC); 
else 
AArch64.AArch32SystemAccessTrap(EL1, QxQC); 
elsif ELUsingAArch32(EL1) && DBGDSCRext.UDCCdis == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, Q@xQ@C); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDRA> != '00') 


then 
AArch64.AArch32SystemAccessTrap(EL2, QxQC); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR.TGE == '1' || MDCR_EL2.<TDE,TDA> != '00') then 


AArch32.TakeHypTrapException(Q@xQC) ; 
else 
return DBGDSAR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDRA> != 'QQ' then 
AArch64.AArch32SystemAccessTrap(EL2, QxQC); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDRA> != '@Q' then 
AArch32.TakeHypTrapException(QxQC) ; 
else 
return DBGDSAR; 
elsif PSTATE.EL == EL2 then 
return DBGDSAR; 
elsif PSTATE.EL == EL3 then 
return DBGDSAR; 
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G8.3.14 DBGDSCRext, Debug Status and Control Register, External View 
The DBGDSCRext characteristics are: 


Purpose 


Main control register for the debug implementation. 


Configurations 


AArch32 System register DBGDSCRext[31:0] is architecturally mapped to AArch64 System 
register MDSCR_EL1[31:0]. 


AArch32 System register DBGDSCRext[15:2] is architecturally mapped to AArch32 System 
register DBGDSCRint[15:2]. 


This register is required in all implementations. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
DBGDSCRext is a 32-bit register. 


Field descriptions 


The DBGDSCRext bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 7 65 2 1 0 





TFO = p-e RESO 
RXfull ERR 


TXfull UDCCdis 
RESO RESO 
RXO HDE 
TXU MDBGen 
RESO 

INTdis 

TDA 

RESO 

SC2 

SPNIDdis 

SPIDdis 


TFO, bit [31] 
When ARMV%8.4-Trace is implemented: 
Trace Filter override. Used for save/restore of EDSCR.TFO. 


When the OS Lock is unlocked, OSLSR_EL1.0SLK == 0, this bit ignores writes and software must 
treat it as UNK/SBZP. 


When the OS Lock is locked, OSLSR_EL1.OSLK == 1, this bit is RW and holds the value of 
EDSCR.TFO. 


Reads and writes of this bit are indirect accesses to EDSCR.TFO. 
Otherwise: 


Reserved, RESO. 
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RXfull, bit [30] 
DTRRX full. Used for save/restore of EDSCR.RXfull. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When OSLSR_EL1.OSLK == 1, this bit is RW and holds the value of EDSCR.RXfull. 


Arm deprecates use of this bit other than for save/restore. Use DBGDSCRimnt to access the DTRRX 
full status. 


Reads and writes of this bit are indirect accesses to EDSCR.RXfull. 


The architected behavior of this field determines the value it returns after a reset. 


TXfull, bit [29] 
DTRTX full. Used for save/restore of EDSCR.TXfull. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When DBGOSLSR.OSLK == 1, this bit is RW and holds the value of EDSCR.TXfull. 


Arm deprecates use of this bit other than for save/restore. Use DBGDSCRint to access the DTRTX 
full status. 


Reads and writes of this bit are indirect accesses to EDSCR.TXfull. 

The architected behavior of this field determines the value it returns after a reset. 
Bit [28] 

Reserved, RESO. 


RXO, bit [27] 
Used for save/restore of EDSCR.RXO. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When DBGOSLSR.OSLK == 1, this bit is RW and holds the value of EDSCR.RXO. 
Reads and writes of this bit are indirect accesses to EDSCR.RXO. 


The architected behavior of this field determines the value it returns after a reset. 


TXU, bit [26] 
Used for save/restore of EDSCR.TXU. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When DBGOSLSR.OSLK == 1, this bit is RW and holds the value of EDSCR.TXU. 
Reads and writes of this bit are indirect accesses to EDSCR.TXU. 
The architected behavior of this field determines the value it returns after a reset. 

Bits [25:24] 


Reserved, RESO. 


INTdis, bits [23:22] 
Used for save/restore of EDSCR.INTdis. 
When OSLSR_EL1.OSLK == 0, this field is RO, and software must treat it as UNK/SBZP. 
When DBGOSLSR.OSLK == 1, this field is RW and holds the value of EDSCR.INTdis. 
Reads and writes of this field are indirect accesses to EDSCR.INTdis. 


The architected behavior of this field determines the value it returns after a reset. 


TDA, bit [21] 
Used for save/restore of EDSCR.TDA. 
When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When DBGOSLSR.OSLK == 1, this bit is RW and holds the value of EDSCR.TDA. 
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Reads and writes of this bit are indirect accesses to EDSCR.TDA. 


The architected behavior of this field determines the value it returns after a reset. 


Bit [20] 


Reserved, RESO. 


SC2, bit [19] 


When ARMv8.0-PCSample is implemented, ARMv8.1-VHE is implemented and 
ARMv8.2-PCSample is not implemented: 


Used for save/restore of EDSCR.SC2. 
When DBGOSLSR.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When DBGOSLSR.OSLK == 1, this bit is RW and holds the value of EDSCR.SC2. 
Reads and writes of this bit are indirect accesses to EDSCR.SC2. 

Otherwise: 


Reserved, RESO. 


NS, bit [18] 
Non-secure status. Returns the inverse of IsSecure(). This bit is RO. 


Arm deprecates use of this field. 


SPNIDdis, bit [17] 
Secure privileged profiling disabled status bit. This bit is RO. Permitted values are: 
ObO If EL3 is implemented, profiling allowed in Secure privileged modes. 
0b1 If EL3 is implemented, profiling prohibited in Secure privileged modes. 
This field is RESO if EL3 is not implemented. 
e Otherwise, the field reads as zero if any of the following applies, and reads as one otherwise: 


—  ARMv8.2-Debug is not implemented and 
ExternalSecureNoninvasiveDebugEnabled() returns TRUE. 


—  EL3 is using AArch32 and the value of SDCR.SPME is 1. 
—  EL3 is using AArch64 and the value of MDCR_EL3.SPME is 1. 


Arm deprecates use of this field. 


SPIDdis, bit [16] 


Secure privileged AArch32 invasive self-hosted debug disabled status bit. This bit is RO and 
depends on the value of SDCR.SPD and the pseudocode function 
AArch32.SelfHostedSecurePrivilegedInvasiveDebugEnabled(). Permitted values are: 


0bd Self-hosted debug enabled in Secure privileged AArch32 modes. 
Qb1 Self-hosted debug disabled in Secure privileged AArch32 modes. 
This bit reads as 1 if any of the following is true and reads as 0 otherwise: 

e SDCR.SPD has the value 0b10. 


. SDCR.SPD has the value @b00 and SelfHostedSecurePrivilegedInvasiveDebugEnabled() 
returns FALSE. 


Arm deprecates use of this field. 


MDBGen, bit [15] 
Monitor debug events enable. Enable Breakpoint, Watchpoint, and Vector Catch exceptions. 
Qbd Breakpoint, Watchpoint, and Vector Catch exceptions disabled. 
Qb1 Breakpoint, Watchpoint, and Vector Catch exceptions enabled. 


On a Warm reset, this field resets to 0. 
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HDE, bit [14] 


Bit [13] 


Used for save/restore of EDSCR.HDE. 

When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When DBGOSLSR.OSLK == 1, this bit is RW and holds the value of EDSCR.HDE. 
Reads and writes of this bit are indirect accesses to EDSCR.HDE. 


The architected behavior of this field determines the value it returns after a reset. 


Reserved, RESO. 


UDCCdis, bit [12] 


Bits [11:7] 


ERR, bit [6] 


Traps ELO accesses to the DCC registers to Undefined mode. 
0bd This control does not cause any instructions to be trapped. 


Qb1 ELO accesses to the DBGDSCRint, DBGDTRRXint, DBGDTRTXint, DBGDIDR, 
DBGDSAR, and DBGDRAR are trapped to Undefined mode. 





Note 


All accesses to these registers are trapped, including LDC and STC accesses to DBGDTRT Xint and 
DBGDTRR Xint, and MRRC accesses to DBGDSAR and DBGDRAR. 





Traps of ELO accesses to the DBGDTRRXint and DBGDTRTXint are ignored in Debug state. 


On a Warm reset, this field resets to 0. 


Reserved, RESO. 


Used for save/restore of EDSCR.ERR. 

When OSLSR_EL1.OSLK == 0, this bit is RO, and software must treat it as UNK/SBZP. 
When DBGOSLSR.OSLK == 1, this bit is RW and holds the value of EDSCR.ERR. 
Reads and writes of this bit are indirect accesses to EDSCR.ERR. 


The architected behavior of this field determines the value it returns after a reset. 


MOE, bits [5:2] 


Bits [1:0] 


Method of Entry for debug exception. When a debug exception is taken to an Exception level using 
AArch32, this field is set to indicate the event that caused the exception: 


0b0001 Breakpoint. 

Qb0011 Software breakpoint (BKPT) instruction. 
0b0101 Vector catch. 

0b1010 Watchpoint. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Accessing the DBGDSCRext 


Individual fields within this register might have restricted accessibility when the OS lock is unlocked, 
DBGOSLSR.OSLK == 0. See the field descriptions for more detail. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDSCRext; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDSCRext; 
elsif PSTATE.EL == EL3 then 
return DBGDSCRext; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGDSCRext = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGDSCRext = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGDSCRext = R[t]; 


coproc opct CRn CRm opc2 
0b1110 0b000 0b0000 0b0010 O0b010 
coproc opct CRn CRm opc2 
0b1110 0b000 0b0000 0b0010 O0b010 
G8-6415 
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G8.3.15 DBGDSCRint, Debug Status and Control Register, Internal View 
The DBGDSCRint characteristics are: 


Purpose 


Main control register for the debug implementation. This is an internal, read-only view. 


Configurations 


AArch32 System register DBGDSCRint[30:29] is architecturally mapped to AArch64 System 
register MDCCSR_ELO[30:29]. 


AArch32 System register DBGDSCRint[15:2] is architecturally mapped to AArch32 System 
register DBGDSCRext[15:2]. 


This register is required in all implementations. 


DBGDSCRint. {NS, SPNIDdis, SPIDdis, MDBGen, UDCCdis, MOE} are UNKNOWN when the 
register is accessed at ELO. However, although these values are not accessible at ELO by instructions 
that are neither UNPREDICTABLE nor return UNKNOWN values, it is permissible for an 
implementation to return the values of DBGDSCRext. {NS, SPNIDdis, SPIDdis, MDBGen, 
UDCCdis, MOE} for these fields at ELO. 


It is also permissible for an implementation to return the same values as defined for a read of 
DBGDSCRint at EL1 or above. (This is the case even if the implementation does not support 
AArch32 at EL1 or above.) 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DBGDSCRint is a 32-bit register. 


Field descriptions 


The DBGDSCRint bit assignments are: 


31 30 29 28 191817 16 15 14 13 12 11 210 





Reso — | E 
RXfull Pres 
TXfull RESO 
SPNIDdis MDBGen 
SPIDdis 


Bit [31] 

Reserved, RESO. 
RXfull, bit [30] 

DTRRX full. Read-only view of the equivalent bit in the EDSCR. 
TXfull, bit [29] 

DTRTX full. Read-only view of the equivalent bit in the EDSCR. 
Bits [28:19] 

Reserved, RESO. 
NS, bit [18] 


Non-secure status. 
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Read-only view of the equivalent bit in the DBGDSCRext. Arm deprecates use of this field. 
SPNID4dis, bit [17] 

Secure privileged non-invasive debug disable. 

Read-only view of the equivalent bit in the DBGDSCRext. Arm deprecates use of this field. 
SPIDdis, bit [16] 

Secure privileged invasive debug disable. 

Read-only view of the equivalent bit in the DBGDSCRext. Arm deprecates use of this field. 
MDBGea, bit [15] 

Monitor debug events enable. 

Read-only view of the equivalent bit in the DBGDSCRext. 
Bits [14:13] 

Reserved, RESO. 
UDCCdis, bit [12] 

User mode access to Debug Communications Channel disable. 

Read-only view of the equivalent bit in the DBGDSCRext. Arm deprecates use of this field. 
Bits [11:6] 

Reserved, RESO. 
MOE, bits [5:2] 


Method of Entry for debug exception. When a debug exception is taken to an Exception level using 
AArch32, this field is set to indicate the event that caused the exception: 


0b0001 Breakpoint 

Qb0011 Software breakpoint (BKPT) instruction 

0b0101 Vector catch 

0b1010 Watchpoint 

Read-only view of the equivalent bit in the DBGDSCRext. 
Bits [1:0] 


Reserved, RESO. 


Accessing the DBGDSCRint 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110  0b000 0b0000 0b0001 0b000 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x05); 
elsif ELUsingAArch32(EL1) && DBGDSCRext.UDCCdis == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
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elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDA> != 'Q0') then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDSCRint; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDSCRint; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDSCRint; 
elsif PSTATE.EL == EL3 then 
return DBGDSCRint; 
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G8.3.16 DBGDTRRXext, Debug OS Lock Data Transfer Register, Receive, External View 


ARM DDI 0487E.a 
ID070919 


The DBGDTRR Xext characteristics are: 


Purpose 
Used for save/restore of DBGDTRRXint. It is a component of the Debug Communications Channel. 
Configurations 
AArch32 System register DBGDTRRXext[31:0] is architecturally mapped to AArch64 System 
register OSDTRRX_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DBGDTRR Xext is a 32-bit register. 


Field descriptions 


The DBGDTRR Xext bit assignments are: 


31 0 
Update DTRRX without side-effect 
Bits [31:0] 


Update DTRRX without side-effect. 
Writes to this register update the value in DTRRX and do not change RXfull. 
Reads of this register return the last value written to DTRRX and do not change RXfull. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


This field resets to an architecturally UNKNOWN value. 


Accessing the DBGDTRRXext 


Arm deprecates reads and writes of DBGDTRRXext through the System register interface when the OS Lock is 
unlocked, DBGOSLSR.OSLK == 0. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





0b1110 0b000 = 0b0000 0b0000 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != '00' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDTRRXext; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDTRRXext; 
elsif PSTATE.EL == EL3 then 
return DBGDTRRXext; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 














coproc opci CRn CRm opc2 
0b1110 0b000 0b0000 0b0000 0b010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGDTRRXext = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGDTRRXext = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGDTRRXext = R[t]; 
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G8.3.17 DBGDTRRxXint, Debug Data Transfer Register, Receive 


ARM DDI 0487E.a 
ID070919 


The DBGDTRRXint characteristics are: 


Purpose 


Transfers data from an external debugger to the PE. For example, it is used by a debugger 
transferring commands and data to a debug target. See Arch64-DBGDTR_ELO for additional 
architectural mappings. It is a component of the Debug Communications Channel. 


Configurations 


AArch32 System register DBGDTRRXint[31:0] is architecturally mapped to AArch64 System 
register DBGDTRRX_ELO[31:0]. 


AArch32 System register DBGDTRRXint[31:0] is architecturally mapped to External register 
DBGDTRRX_ELO[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DBGDTRRXint is a 32-bit register. 


Field descriptions 


The DBGDTRRXint bit assignments are: 


31 0 
Update DTRRX 
Bits [31:0] 
Update DTRRX. 


Reads of this register: 

. If RXfull is set to 1, return the last value written to DTRRX. 
. If RXfull is set to 0, return an UNKNOWN value. 

After the read, RXfull is cleared to 0. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGDTRRXint 


Data can be stored to memory from this register using STC. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





0b1110  0b000 0b0000 0b0101 0b000 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
else 
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AArch64.AArch32SystemAccessTrap(EL1, 0x05); 
elsif ELUsingAArch32(EL1) && DBGDSCRext.UDCCdis == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDA> != 'Q0') then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDTRRXint; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'Q0' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDTRRXint; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDTRRXint; 
elsif PSTATE.EL == EL3 then 
return DBGDTRRXint; 
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G8.3.18 DBGDTRTXext, Debug OS Lock Data Transfer Register, Transmit 


ARM DDI 0487E.a 
ID070919 


The DBGDTRT Xext characteristics are: 


Purpose 
Used for save/restore of DBGDTRT Xint. It is a component of the Debug Communication Channel. 
Configurations 
AArch32 System register DBGDTRTXext[3 1:0] is architecturally mapped to AArch64 System 
register OSDTRTX_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DBGDTRTXext is a 32-bit register. 


Field descriptions 


The DBGDTRTXext bit assignments are: 


31 0 
Return DTRTX without side-effect 
Bits [31:0] 


Return DTRTX without side-effect. 
Reads of this register return the value in DTRTX and do not change TXfull. 
Writes of this register update the value in DTRTX and do not change TXfull. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGDTRTXext 


Arm deprecates reads and writes of DBGDTRTXext through the System register interface when the OS Lock is 
unlocked, DBGOSLSR.OSLK == 0. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





0b1110 0b000 = 0b0000 Ob0011 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != '00' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDTRTXext; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGDTRTXext; 
elsif PSTATE.EL == EL3 then 
return DBGDTRTXext; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 














coproc opci CRn CRm opc2 
0b1110 0b000 0b0000 0b0011 Ob010 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGDTRTXext = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGDTRTXext = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGDTRTXext = R[t]; 
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G8.3.19 DBGDTRTXint, Debug Data Transfer Register, Transmit 


ARM DDI 0487E.a 
ID070919 


The DBGDTRTXint characteristics are: 


Purpose 


Transfers data from the PE to an external debugger. For example, it is used by a debug target to 
transfer data to the debugger. See DBGDTR_ELO for additional architectural mappings. It is a 
component of the Debug Communication Channel. 


Configurations 


Attributes 


AArch32 System register DBGDTRTXint[31:0] is architecturally mapped to AArch64 System 
register DBGDTRTX_EL0[31:0]. 


AArch32 System register DBGDTRTXint[31:0] is architecturally mapped to External register 
DBGDTRTX_EL0[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


DBGDTRTXint is a 32-bit register. 


Field descriptions 


The DBGDTRTXint bit assignments are: 


31 


0 


Return DTRTX 


Bits [31:0] 


Return DTRTX. 

Writes to this register: 

. If TXfull is set to 1, set DTRTX to UNKNOWN. 

- If TXfull is set to 0, update the value in DT[RTX. 
After the write, TXfull is set to 1. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGDTRTXint 


Data can be loaded from memory into this register using LDC (immediate) and LDC (literal). 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





0b1110  0b000 0b0000 0b0101 0b000 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && MDSCR_EL1.TDCC == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x05); 


else 
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AArch64.AArch32SystemAccessTrap(EL1, 0x05); 
elsif ELUsingAArch32(EL1) && DBGDSCRext.UDCCdis == '1' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && (HCR_EL2.TGE == '1' || MDCR_EL2.<TDE,TDA> != 'Q0') then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGDTRTXint = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'Q0' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 





DBGDTRTXint = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGDTRTXint = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGDTRTXint = R[t]; 
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G8.3.20 DBGOSDLR, Debug OS Double Lock Register 


The DBGOSDLR characteristics are: 


Purpose 


Locks out the external debug interface. 


Configurations 
AArch32 System register DBGOSDLR[3 1:0] is architecturally mapped to AArch64 System register 
OSDLR_EL1[31:0]. 
This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
DBGOSDLR is a 32-bit register. 


Field descriptions 


The DBGOSDLR bit assignments are: 


Bits [31:1] 
Reserved, RESO. 
DLK, bit [0] 
When ARMV8.0-DoubleLock is implemented: 
OS Double Lock control bit. 


0b0 OS Double Lock unlocked. 


Qb1 OS Double Lock locked, if DBGPRCR.CORENPDRQ (Core no powerdown request) 
bit is set to 0 and the PE is in Non-debug state. 


On a Warm reset, this field resets to 0. 
Otherwise: 


Reserved, RAZ/WI. 


Accessing the DBGOSDLR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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G8-6428 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


0b1110 0b000 = O0b0001 O0b0011 


opc2 


0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != '00' && 
(IsFeatureImp]emented("ARMv8 .0-DoubleLock") boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL2.TDOSA") then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDOSA> != '00' && 
(IsFeatureImp1] 
then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' && 
(IsFeatureImp]emented("ARMv8 .0-DoubleLock") boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL3.TDOSA") then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGOSDLR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' && 
(IsFeatureImplemented("ARMv8.0-DoubleLock") || boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL3.TDOSA") then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGOSDLR; 
elsif PSTATE.EL == EL3 then 
return DBGOSDLR; 

















MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


emented("ARMv8 .Q-DoubleLock") boolean IMPLEMENTATION_DEFINED "Trapped by HDCR.TDOSA") 





coproc opct CRn CRm 


opc2 





0b1110 0b000 = O0b0001 O0b0011 


0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != 'Q0' && 
(IsFeatureImp]emented("ARMv8.0-DoubleLock") boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL2.TDOSA") then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDOSA> != 'Q0' && 


(IsFeatureImp]emented("ARMv8 .0-DoubleLock") boolean IMPLEMENTATION_DEFINED "Trapped by HDCR.TDOSA") 


then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' && 
(IsFeatureImp]emented("ARMv8 .0-DoubleLock") boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL3.TDOSA") then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGOSDLR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' && 
(IsFeatureImp]lemented("ARMv8.0-DoubleLock") || boolean IMPLEMENTATION_DEFINED "Trapped by 
MDCR_EL3.TDOSA") then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGOSDLR = R[t]; 
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elsif PSTATE.EL == EL3 then 
DBGOSDLR = R[t]; 
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G8.3.21 


G8-6430 


DBGOSECCR, 


Debug OS Lock Exception Catch Control Register 


The DBGOSECCR characteristics are: 


Purpose 


Provides a mechanism for an operating system to access the contents of EDECCR that are otherwise 
invisible to software, so it can save/restore the contents of EDECCR over powerdown on behalf of 


the external debugger. 


Configurations 


Attributes 


AArch32 System register DBGOSECCR[31:0] is architecturally mapped to AArch64 System 
register OSECCR_EL1[31:0]. 


AArch32 System register DBGOSECCR{[3 1:0] is architecturally mapped to External register 
EDECCR{31:0]. 


If DBGOSLSR.OSLK == 0 then DBGOSECCR returns an UNKNOWN value on reads and ignores 
writes. 


RW fields in this register reset to architecturally UNKNOWN values. 


DBGOSECCR is a 32-bit register. 


Field descriptions 


The DBGOSECCR bit assignments are: 


When DBGOSLSR.OSLK == 1: 


31 


0 


EDECCR 


EDECCR, bits [31:0] 


Used for save/restore to EDECCR over powerdown. 


Reads or writes to this field are indirect accesses to EDECCR. 


Accessing the DBGOSECCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110 0b000  0b0000 0b0110 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != '00' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 


else 
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return DBGOSECCR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGOSECCR; 
elsif PSTATE.EL == EL3 then 
return DBGOSECCR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





0b1110 0b000 = 0b0000 0b0110 0b010 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'Q0' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 





DBGOSECCR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGOSECCR = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGOSECCR = R[t]; 
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G8.3.22 DBGOSLAR, Debug OS Lock Access Register 


G8-6432 


The DBGOSLAR characteristics are: 


Purpose 
Provides a lock for the debug registers. The OS Lock also disables some debug exceptions and 
debug events. 


Configurations 
AArch32 System register DBGOSLAR[3 1:0] is architecturally mapped to AArch64 System register 
OSLAR_EL1[31:0]. 


AArch32 System register DBGOSLAR[3 1:0] is architecturally mapped to External register 
OSLAR_EL1[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DBGOSLAR is a 32-bit register. 


Field descriptions 


The DBGOSLAR bit assignments are: 


31 0 


OS Lock Access 


OS Lock Access, bits [31:0] 
OS Lock Access. Writing the value @xC5ACCE55 to the DBGOSLAR sets the OS lock to 1. Writing 
any other value sets the OS lock to 0. 


Use DBGOSLSR.OSLK to check the current status of the lock. 


Accessing the DBGOSLAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110 0b000 = 0b0001 0b0000 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != 'Q@Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDOSA> != '00' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGOSLAR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
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DBGOSLAR = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGOSLAR = R[t]; 
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G8.3.23 


G8-6434 


DBGOSLSR, Debug OS Lock Status Register 


The DBGOSLSR characteristics are: 


Purpose 


Provides status information for the OS Lock. 


Configurations 


Attributes 


AArch32 System register DBGOSLSR[3 1:0] is architecturally mapped to AArch64 System register 
OSLSR_EL1[31:0]. 


The OS Lock status is also visible in the external debug interface through EDPRSR. 


This register is in the Cold reset domain. Some or all RW fields of this register have defined reset 
values. On a Cold reset these apply only if the PE resets into an Exception level that is using 
AArch32. Otherwise, on a Cold reset RW fields in this register reset to architecturally UNKNOWN 
values. The register is not affected by a Warm reset. 


DBGOSLSR is a 32-bit register. 


Field descriptions 


The DBGOSLSR bit assignments are: 


Bits [31:4] 


L OSLM[0] 
o 


m 


Reserved, RESO. 


OSLM[I], bit [3] 


nTT, bit [2] 


OSLK, bit [1] 


This field is bit[1] of OSLM[1:0]. 

OS lock model implemented. Identifies the form of OS save and restore mechanism implemented. 
0b00 OS Lock not implemented. 

0b10 OS Lock implemented. 

All other values are reserved. In an Armv8 implementation the value 0b00 is not permitted. 

The OSLM field is split as follows: 

s OSLM[1] is DBGOSLSR[3]. 

: OSLM[0] is DBGOSLSR[0]. 


Not 32-bit access. This bit is always RAZ. It indicates that a 32-bit access is needed to write the key 
to the OS Lock Access Register. 


OS Lock Status. The possible values are: 
Qbd OS Lock unlocked. 
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Qb1 OS Lock locked. 
The OS Lock is locked and unlocked by writing to the OS Lock Access Register. 
On a Cold reset, this field resets to 1. 


OSLM[0], bit [0] 
This field is bit[0] of OSLM[1:0]. 
See OSLM[1] for the field description. 


Accessing the DBGOSLSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110 0b000 = 0b0001 0b0001 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != 'Q@Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDOSA> != '00' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGOSLSR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGOSLSR; 
elsif PSTATE.EL == EL3 then 
return DBGOSLSR; 
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DBGPRCR, Debug Power Control Register 


The DBGPRCR characteristics are: 


Purpose 


Controls behavior of the PE on powerdown request. 


Configurations 


Attributes 


AArch32 System register DBGPRCR[3 1:0] is architecturally mapped to AArch64 System register 
DBGPRCR_EL1[31:0]. 


Bit [0] of this register is mapped to EDPRCR.CORENPDRQ, bit [0] of the external view of this 
register. 
The other bits in these registers are not mapped to each other. 


This register is in the Cold reset domain. Some or all RW fields of this register have defined reset 
values. On a Cold reset these apply only if the PE resets into an Exception level that is using 
AArch32. Otherwise, on a Cold reset RW fields in this register reset to architecturally UNKNOWN 
values. The register is not affected by a Warm reset. 


DBGPRCR is a 32-bit register. 


Field descriptions 


The DBGPRCR bit assignments are: 


31 


RESO ii 


Bits [31:1] 


| CORENPDRQ 


Reserved, RESO. 


CORENPDRQ, bit [0] 


Core no powerdown request. Requests emulation of powerdown. 
This request is typically passed to an external power controller. This means that whether a request 


causes power up is dependent on the IMPLEMENTATION DEFINED nature of the system. The power 
controller must not allow the Core power domain to switch off while this bit is 1. 


Qbd If the system responds to a powerdown request, it powers down Core power domain. 

Qb1 If the system responds to a powerdown request, it does not powerdown the Core power 
domain, but instead emulates a powerdown of that domain. 

In an implementation that includes the recommended external debug interface, this bit drives the 

DBGNOPWRDWN signal. 


It is IMPLEMENTATION DEFINED whether this bit is reset to the value of EDPRCR.COREPURQ on 
exit from an IMPLEMENTATION DEFINED software-visible retention state. For more information 
about retention states see Core power domain power states on page H6-6808. 


Note 

Writes to this bit are not prohibited by the IMPLEMENTATION DEFINED authentication interface. This 
means that a debugger can request emulation of powerdown regardless of whether invasive debug 
is permitted. 
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On a Cold reset, this field resets to the value in EDPRCR.COREPURQ. 


Accessing the DBGPRCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110 0b000 = 0b0001 0b0100 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDOSA> != '@Q@' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGPRCR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGPRCR; 
elsif PSTATE.EL == EL3 then 
return DBGPRCR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


0b1110 0b000 = 0b0001 0b0100 0b100 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDOSA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDOSA> != 'QQ@' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGPRCR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDOSA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGPRCR = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGPRCR = R[t]; 
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G8.3.25 DBGVCR, Debug Vector Catch Register 
The DBGVCR characteristics are: 


Purpose 


Controls Vector Catch debug events. 


Configurations 


AArch32 System register DBGVCR[31:0] is architecturally mapped to AArch64 System register 


DBGVCR32_EL2[31:0]. 


This register is required in all implementations. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 


to architecturally UNKNOWN values. 


Attributes 
DBGVCR is a 32-bit register. 


Field descriptions 


The DBGVCR bit assignments are: 


When HaveEL(EL3) and ELUsingAArch32(EL3): 


31 30 29 28 27 26 25 24 161514131211109 8 76543210 





NSF = | i RESO 


RESO RESO 
NSD SF 
NSP RESO 
NSS MS 
NSU MP 
MD 
RESO 
MF 
NSF, bit [31] 
FIQ vector catch enable in Non-secure state. 
The exception vector offset is @x1C. 
On a Warm reset, this field resets to an architecturally UNKNOWN value. 
NSI, bit [30] 
IRQ vector catch enable in Non-secure state. 
The exception vector offset is 0x18. 
On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bit [29] 
Reserved, RESO. 
NSD, bit [28] 
Data Abort vector catch enable in Non-secure state. 
The exception vector offset is 0x10. 
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On a Warm reset, this field resets to an architecturally UNKNOWN value. 


NSP, bit [27] 
Prefetch Abort vector catch enable in Non-secure state. 
The exception vector offset is @x@C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


NSS, bit [26] 
Supervisor Call (SVC) vector catch enable in Non-secure state. 
The exception vector offset is 0x08. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


NSU, bit [25] 
Undefined Instruction vector catch enable in Non-secure state. 
The exception vector offset is 0x04. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bits [24:16] 

Reserved, RESO. 
MF, bit [15] 

FIQ vector catch enable in Monitor mode. 


The exception vector offset is @x1C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


MI, bit [14] 

IRQ vector catch enable in Monitor mode. 

The exception vector offset is 0x18. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bit [13] 

Reserved, RESO. 
MD, bit [12] 

Data Abort vector catch enable in Monitor mode. 

The exception vector offset is 0x10. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
MP, bit [11] 

Prefetch Abort vector catch enable in Monitor mode. 

The exception vector offset is 0x0C. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
MS, bit [10] 

Secure Monitor Call (SMC) vector catch enable in Monitor mode. 

The exception vector offset is 0x08. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bits [9:8] 

Reserved, RESO. 
SF, bit [7] 


FIQ vector catch enable in Secure state. 
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The exception vector offset is @x1C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


SI, bit [6] 
IRQ vector catch enable in Secure state. 
The exception vector offset is 0x18. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bit [5] 

Reserved, RESO. 
SD, bit [4] 

Data Abort vector catch enable in Secure state. 


The exception vector offset is 0x10. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


SP, bit [3] 

Prefetch Abort vector catch enable in Secure state. 

The exception vector offset is 0x0C. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
SS, bit [2] 

Supervisor Call (SVC) vector catch enable in Secure state. 

The exception vector offset is 0x08. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
SU, bit [1] 

Undefined Instruction vector catch enable in Secure state. 

The exception vector offset is 0x04. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Bit [0] 


Reserved, RESO. 


When HaveEL(EL3) and !ELUsingAArch32(EL3): 


31 30 29 28 27 26 25 24 a 7 654 8 














| RESO | |=] | [er 


























NSF, bit [31] 

FIQ vector catch enable in Non-secure state. 

The exception vector offset is @x1C. 

On a Warm reset, this field resets to an architecturally UNKNOWN value. 
NSI, bit [30] 

IRQ vector catch enable in Non-secure state. 

The exception vector offset is 0x18. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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Bit [29] 


NSD, bit [28] 


NSP, bit [27] 


NSS, bit [26] 


NSU, bit [25] 


Bits [24:8] 


SF, bit [7] 


SI, bit [6] 


Bit [5] 


SD, bit [4] 


SP, bit [3] 


SS, bit [2] 
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Reserved, RESO. 


Data Abort vector catch enable in Non-secure state. 
The exception vector offset is 0x10. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Prefetch Abort vector catch enable in Non-secure state. 
The exception vector offset is @x@C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Supervisor Call (SVC) vector catch enable in Non-secure state. 
The exception vector offset is 0x08. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Undefined Instruction vector catch enable in Non-secure state. 
The exception vector offset is 0x04. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


FIQ vector catch enable in Secure state. 
The exception vector offset is @x1C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


IRQ vector catch enable in Secure state. 
The exception vector offset is 0x18. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Data Abort vector catch enable in Secure state. 
The exception vector offset is 0x10. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Prefetch Abort vector catch enable in Secure state. 
The exception vector offset is 0x0C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Supervisor Call (SVC) vector catch enable in Secure state. 


The exception vector offset is 0x08. 
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SU, bit [1] 


Bit [0] 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Undefined Instruction vector catch enable in Secure state. 
The exception vector offset is 0x04. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


When !HaveEL(EL3): 


Bits [31:8] 


F, bit [7] 


I, bit [6] 


Bit [5] 


D, bit [4] 


P, bit [3] 


S, bit [2] 


U, bit [1] 


31 8765 43 210 





RESO 





























Reserved, RESO. 


FIQ vector catch enable. 
The exception vector offset is @x1C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


IRQ vector catch enable. 
The exception vector offset is 0x18. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


Data Abort vector catch enable. 
The exception vector offset is 0x10. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Prefetch Abort vector catch enable. 
The exception vector offset @x@C. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Supervisor Call (SVC) vector catch enable. 
The exception vector offset is 0x08. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Undefined Instruction vector catch enable. 
The exception vector offset is 0x04. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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Bit [0] 


Reserved, RESO. 


Accessing the DBGVCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





0b1110 0b000 = O0b0000 Ob0111 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGVCR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGVCR; 
elsif PSTATE.EL == EL3 then 
return DBGVCR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110 0b000 = O0b0000 Ob0111 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '00' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != '00' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGVCR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGVCR = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGVCR = R[t]; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6443 
ID070919 Non-Confidential 


AArch32 System Register Descriptions 
G8.3 Debug registers 


G8.3.26 DBGWCR<n>, Debug Watchpoint Control Registers, n = 0 - 15 
The DBGWCR<n> characteristics are: 


Purpose 
Holds control information for a watchpoint. Forms watchpoint n together with value register 
DBGWVR<n>. 

Configurations 


AArch32 System register DBGWCR<n>[31:0] is architecturally mapped to AArch64 System 
register DBGWCR<n>_EL1[31:0]. 


AArch32 System register DBGWCR<n>[31:0] is architecturally mapped to External register 
DBGWCR<n>_EL1[31:0]. 


If watchpoint n is not implemented then accesses to this register are UNDEFINED. 
This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 
Attributes 
DBGWCR<n> is a 32-bit register. 


Field descriptions 


The DBGWCR<n> bit assignments are: 


29 28 2423 212019 16 15 14 13 12 5 43 21 0 


WT | i HMC 


When the E field is zero, all the other fields in the register are ignored. 


Bits [31:29] 


Reserved, RESO. 


MASK, bits [28:24] 
Address mask. Only objects up to 2GB can be watched using a single mask. 
0b00000 No mask. 
0b00001 Reserved. 
0b00010 Reserved. 
If programmed with a reserved value, a watchpoint must behave as if either: 


° MASK has been programmed with a defined value, which might be 0 (no mask), other than 
for a direct read of DBGWCRn_EL1. 


° The watchpoint is disabled. 


Software must not rely on this property because the behavior of reserved values might change in a 
future revision of the architecture. 


Other values mask the corresponding number of address bits, from 0b00011 masking 3 address bits 
(@x@0000007 mask for address) to 0b11111 masking 31 address bits (@x7FFFFFFF mask for address). 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Bits [23:21] 


Reserved, RESO. 
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WT, bit [20] 
Watchpoint type. Possible values are: 
Qbd Unlinked data address match. 
Qb1 Linked data address match. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


LBN, bits [19:16] 


Linked breakpoint number. For Linked data address watchpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


SSC, bits [15:14] 


Security state control. Determines the Security states under which a Watchpoint debug event for 
watchpoint n is generated. This field must be interpreted along with the HMC and PAC fields. 


For more information, see Execution conditions for which a breakpoint generates Breakpoint 
exceptions on page G2-5637, and Reserved DBGBCR<n>.{SSC, HMC, PMC} values on 
page G2-5649. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


HMC, bit [13] 


Higher mode control. Determines the debug perspective for deciding when a Watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and PAC 
fields. 


For more information on the operation of the SSC, HMC, and PAC fields, see Execution conditions 
for which a watchpoint generates Watchpoint exceptions on page G2-5655. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


BAS, bits [12:5] 


Byte address select. Each bit of this field selects whether a byte from within the word or 
double-word addressed by DBGWVR<n> is being watched. 





BAS Description 





Qbxxxxxxxl Match byte at DBGWVR<n> 





@bxxxxxx1x Match byte at DBGWVR<n>+1 





Obxxxxxlxx Match byte at DBGWVR<n>+2 








@bxxxx1xxx Match byte at DBGWVR<n>+3 





In cases where DBGWVR<n> addresses a double-word: 





BAS Description, if DBGWVR<n>[2] == 





Obxxxlxxxx Match byte at DBGWVR<n>+4 








Obxx1xxxxx Match byte at DBGWVR<n>+5 





Obx1xxxxxx Match byte at DBGWVR<n>+6 





Ob1xxxxxxx Match byte at DBGWVR<n>+7 


If DBGWVR<n>[2] == 1, only BAS[3:0] are used and BAS[7:4] are ignored. Arm deprecates 
setting DBGWVR<n>[2] == 1. 
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LSC, bits [4:3] 


PAC, bits [2:1] 


E, bit [0] 


The valid values for BAS are non-zero binary numbers all of whose set bits are contiguous. All other 
values are reserved and must not be used by software. See Reserved DBGWCR<n>.BAS values on 
page G2-5663 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Load/store control. This field enables watchpoint matching on the type of access being made. 
Possible values of this field are: 


QbO1 Match instructions that load from a watchpointed address. 
0b10 Match instructions that store to a watchpointed address. 
Qb11 Match instructions that load from or store to a watchpointed address. 


All other values are reserved, but must behave as if the watchpoint is disabled. Software must not 
rely on this property as the behavior of reserved values might change in a future revision of the 
architecture. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Privilege of access control. Determines the Exception level or levels at which a Watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and HMC 
fields. 


For more information on the operation of the SSC, HMC, and PAC fields, see Execution conditions 


for which a watchpoint generates Watchpoint exceptions on page G2-5655. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Enable watchpoint n. Possible values are: 
0bd Watchpoint disabled. 
Qb1 Watchpoint enabled. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGWCR<n> 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





0b1110 0b000 = 0b0000 n[3:0] 0b111 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 

elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 


else 


return DBGWCR[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch32 System Register Descriptions 
G8.3 Debug registers 


elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 

else 
return DBGWCR[UInt(CRm<3:0>)]; 

elsif PSTATE.EL == EL3 then 

if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 

else 
return DBGWCR[UInt(CRm<3:0>)]; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





0b1110 0b000 = 0b0000 n[3:0] 0b111 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWCR[UInt(CRm<3:@>)] = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWCR[UInt(CRm<3:@>)] = R[t]; 
elsif PSTATE.EL == EL3 then 
if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWCR[UInt(CRm<3:@>)] = R[t]; 
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G8.3.27 DBGWFAR, Debug Watchpoint Fault Address Register 


The DBGWFAR characteristics are: 


Purpose 
Previously returned information about the address of the instruction that accessed a watchpointed 
address. Is now deprecated and RESO. 
Configurations 
There are no configuration notes. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DBGWEAR is a 32-bit register. 


Field descriptions 


The DBGWFAR bit assignments are: 


31 0 
RESO 
Bits [31:0] 


Reserved, RESO. 


Accessing the DBGWFAR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110 0b000 0b0000 0b0110 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != '@Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'Q0' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGWFAR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
return DBGWFAR; 
elsif PSTATE.EL == EL3 then 
return DBGWFAR; 


G8-6448 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch32 System Register Descriptions 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGWFAR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
else 
DBGWFAR = R[t]; 
elsif PSTATE.EL == EL3 then 
DBGWFAR = R[t]; 


G8.3 Debug registers 
coproc opct CRn CRm opc2 
0b1110 0b000 O0b0000 0b0110 O0b000 

G8-6449 
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G8.3.28 


G8-6450 


DBGWVR<n>, Debug Watchpoint Value Registers, n = 0 - 15 


The DBGWVR<n> characteristics are: 


Purpose 


Holds a data address value for use in watchpoint matching. Forms watchpoint n together with 
control register DBGWCR<n>. 


Configurations 


AArch32 System register DBGWVR<n>[31:0] is architecturally mapped to AArch64 System 
register DBGWVR<n>_EL1[31:0]. 


AArch32 System register DBGWVR<n>[31:0] is architecturally mapped to External register 
DBGWVR<n>_EL1[31:0]. 


If watchpoint n is not implemented then accesses to this register are UNDEFINED. 


This register is in the Cold reset domain. On a Cold reset RW fields in this register reset to 
architecturally UNKNOWN values.The register is not affected by a Warm reset. 


Attributes 
DBGWVR<n> is a 32-bit register. 


Field descriptions 


The DBGWVR<n> bit assignments are: 


VA, bits [31:2] 
Bits[3 1:2] of the address value for comparison. 
Arm deprecates setting DBGWVR<n>[2] == 1. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [1:0] 


Reserved, RESO. 


Accessing the DBGWVR<n> 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110  Ob000 Ob0000 n[3:0] O0b110 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'QQ' then 
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AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGWVR[UInt(CRm<3:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGWVR[UInt(CRm<3:@>)]; 
elsif PSTATE.EL == EL3 then 
if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
return DBGWVR[UInt(CRm<3:@>)]; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1110  Ob000 0b0000 n[3:0] O0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.<TDE,TDA> != 'Q0' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x05); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.<TDE,TDA> != 'Q0' then 
AArch32.TakeHypTrapException(QxQ5) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWVR[UInt(CRm<3:@>)] = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x05); 
elsif ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWVR[UInt(CRm<3:@>)] = R[t]; 
elsif PSTATE.EL == EL3 then 
if ELUsingAArch32(EL1) && DBGOSLSR.OSLK == '@' && HaltingAllowed() && EDSCR.TDA == '1' then 
Halt (DebugHalt_SoftwareAccess) ; 
else 
DBGWVR[UInt(CRm<3:@>)] = R[t]; 
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G8.3.29 DLR, Debug Link Register 


The DLR characteristics are: 


Purpose 
In Debug state, holds the address to restart from. 
Configurations 
AArch32 System register DLR[31:0] is architecturally mapped to AArch64 System register 
DLR_ELO[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DLR is a 32-bit register. 


Field descriptions 


The DLR bit assignments are: 


31 0 
Restart address 
Bits [31:0] 


Restart address. 


Accessing the DLR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b011 0b0100 O0b0101 Ob001 





if !Halted() then 
UNDEFINED; 
else 
return DLR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b011 0b0100 O0b0101 Ob001 


if !Halted() then 


UNDEFINED; 
else 
DLR = R[t]; 
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G8.3.30 DSPSR, Debug Saved Program Status Register 


The DSPSR characteristics are: 


Purpose 
Holds the saved process state for Debug state. On entering Debug state, PSTATE information is 
written to this register. On exiting Debug state, values are copied from this register to PSTATE. 
Configurations 
AArch32 System register DSPSR[31:0] is architecturally mapped to AArch64 System register 
DSPSR_ELO[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


DSPSR is a 32-bit register. 


Field descriptions 


The DSPSR bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 16 15 10987654 





IT[1:0] E | 
DIT 

SSBS 

PAN 


N, bit [31] 


Negative Condition flag. Set to the value of PSTATE.N on entering Debug state, and copied to 
PSTATE.N on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


Z, bit [30] 


Zero Condition flag. Set to the value of PSTATE.Z on entering Debug state, and copied to 
PSTATE.Z on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


C, bit [29] 
Carry Condition flag. Set to the value of PSTATE.C on entering Debug state, and copied to 
PSTATE.C on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


V, bit [28] 
Overflow Condition flag. Set to the value of PSTATE.V on entering Debug state, and copied to 
PSTATE.V on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Q, bit [27] 


Overflow or saturation flag. Set to the value of PSTATE.Q on entering Debug state, and copied to 
PSTATE.Q on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
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IT[1:0], bits [26:25] 


If-Then. Set to the value of PSTATE.IT[1:0] on entering Debug state, and copied to PSTATE.IT[1:0] 
on exiting Debug state. 


On exiting Debug state DSPSR.IT must contain a value that is valid for the instruction being 
returned to. 


This field resets to an architecturally UNKNOWN value. 


DIT, bit [24] 
When ARMV8.4-DIT is implemented: 


Data Independent Timing. Set to the value of PSTATE.DIT on entering Debug state, and copied to 
PSTATE.DIT on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SSBS, bit [23] 
When ARMV8.0-SSBS is implemented: 


Speculative Store Bypass. Set to the value of PSTATE.SSBS on entering Debug state, and copied to 
PSTATE.SSBS on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


PAN, bit [22] 
When ARMv8.1-PAN is implemented: 


Privileged Access Never. Set to the value of PSTATE.PAN on entering Debug state, and copied to 
PSTATE.PAN on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


SS, bit [21] 


Software Step. Set to the value of PSTATE.SS on entering Debug state, and conditionally copied to 
PSTATE.SS on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


IL, bit [20] 


Illegal Execution state. Set to the value of PSTATE.IL on entering Debug state, and copied to 
PSTATE.IL on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


GE, bits [19:16] 


Greater than or Equal flags. Set to the value of PSTATE.GE on entering Debug state, and copied to 
PSTATE.GE on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


IT[7:2], bits [15:10] 


If-Then. Set to the value of PSTATE.IT[7:2] on entering Debug state, and copied to PSTATE.IT[7:2] 
on exiting Debug state. 


DSPSR.IT must contain a value that is valid for the instruction being returned to. 


This field resets to an architecturally UNKNOWN value. 
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E, bit [9] 
Endianness. Set to the value of PSTATE.E on entering Debug state, and copied to PSTATE.E on 
exiting Debug state. 
If the implementation does not support big-endian operation, DSPSR.E is RESO. If the 
implementation does not support little-endian operation, DSPSR.E is RES1. On exiting Debug state, 
if the implementation does not support big-endian operation at the Exception level being returned 
to, DSPSR.E is RESO, and if the implementation does not support little-endian operation at the 
Exception level being returned to, DSPSR.E is RES1. 
This field resets to an architecturally UNKNOWN value. 

A, bit [8] 
SError interrupt mask. Set to the value of PSTATE.A on entering Debug state, and copied to 
PSTATE.A on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

I, bit [7] 
IRQ interrupt mask. Set to the value of PSTATE.I on entering Debug state, and copied to PSTATE.I 
on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

F, bit [6] 
FIQ interrupt mask. Set to the value of PSTATE.F on entering Debug state, and copied to PSTATE.F 
on exiting Debug state. 
This field resets to an architecturally UNKNOWN value. 

T, bit [5] 


T32 Instruction set state. Set to the value of PSTATE.T on entering Debug state, and copied to 
PSTATE.T on exiting Debug state. 


This field resets to an architecturally UNKNOWN value. 


M[4:0], bits [4:0] 


Mode. Set to the value of PSTATE.M[4:0] on entering Debug state, and copied to PSTATE.M[4:0] 
on exiting Debug state. 


0b10000 User. 
0b10001 FIQ. 
0b10010 IRQ. 
0b10011 Supervisor. 
0b10110 Monitor. 
Qb10111 Abort. 
0b11010 Hyp. 
0b11011 Undefined. 
0b11111 System. 





Other values are reserved. If DSPSR.M[4:0] has a Reserved value, or a value for an unimplemented 
Exception level, exiting Debug state is an illegal return event, as described in ///egal return events 
from AArch32 state on page G1-5524. 


This field resets to an architecturally UNKNOWN value. 


Accessing the DSPSR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b011 O0b0100 0b0101 0b000 





if !Halted() then 
UNDEFINED; 
else 
return DSPSR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b011  0b0100 0b0101 0b000 





if !Halted() then 
UNDEFINED; 
else 
DSPSR = R[t]; 
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G8.3.31 HDCR, Hyp Debug Control Register 
The HDCR characteristics are: 
Purpose 
Controls the trapping to Hyp mode of Non-secure accesses, at EL1 or lower, to functions provided 
by the debug and trace architectures and the Performance Monitors Extension. 
Configurations 
AArch32 System register HDCR[31:0] is architecturally mapped to AArch64 System register 
MDCR_EL2[31:0]. 
If EL2 is not implemented, this register is RESO from EL3, and other than for a direct read of the 
register, the PE behaves as if HDCR.HPMN == PMCR.N. 
This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into EL2 with EL2 using AArch32, 
or into EL3 with EL3 using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register 
reset to architecturally UNKNOWN values. 
Attributes 
HDCR is a 32-bit register. 
Field descriptions 
The HDCR bit assignments are: 
31 27 26 25 24 2322 20 19 18 17 16 1211109 8 7 65 4 0 
| mer 
s—— T 
HCCD Pn 
TTRF 
RESO 
HPMD ro08h 
Bits [31:27] 
Reserved, RESO. 
HLP, bit [26] 
When ARMv8.5-PMU is implemented: 
Hypervisor Long event counter enable. Determines when unsigned overflow is recorded by a 
counter overflow bit. 
Qbd Event counter overflow on increment that causes unsigned overflow of 
PMEVCNTR<n>[31:0]. 
Qb1 Event counter overflow on increment that causes unsigned overflow of 
PMEVCNTR<n>[63:0]. 
If the highest implemented Exception level is using AArch32, it is IMPLEMENTATION DEFINED 
whether this bit is read/write or RAZ/WI. 
If HDCR.HPMN is less than PMCR.N, this bit affects the operation of event counters in the range 
[HDCR.HPMN..(PMCR.N-1)]. Otherwise this bit has no effect on the operation of the event 
counters. 
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Note 


The effect of HDCR.HPMN on the operation of this bit always applies if EL2 is implemented, at all 
Exception levels including EL2 and EL3, and regardless of whether EL2 is enabled in the current 
Security state. 








For more information see the description of the HDCR.HPMN field. 





Note 
PMEVCNTR<n>[63:32] cannot be accessed directly in AArch32 state. 





On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


Bits [25:24] 


Reserved, RESO. 


HCCD, bit [23] 
When ARMV8.5-PMU is implemented: 
Hypervisor Cycle Counter Disable. Prohibits PMCCNTR from counting at EL2. 
0bd Cycle counting by PMCCNTR is not affected by this bit. 
Qb1 Cycle counting by PMCCNTR is prohibited at EL2. 
This bit does not affect the CPU_CYCLES event or any other event that counts cycles. 
On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


Bits [22:20] 


Reserved, RESO. 


TTRF, bit [19] 
When ARMV8.4-Trace is implemented: 
Traps use of the Trace Filter Control registers at EL1 to EL2. 
Qbd Accesses to TRFCR at EL] are not affected by this control bit. 
Qb1 Accesses to TRFCR at EL1 generate a Hyp Trap exception. 
On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


Bit [18] 


Reserved, RESO. 


HPMD, bit [17] 
When ARMv8.1-PMU is implemented: 
Guest Performance Monitors Disable. This control prohibits event counting at EL2. 
Qbd Event counting allowed in Hyp mode. 


Qb1 Event counting prohibited in Hyp mode. 
If ARMv8.2-Debug is not implemented, event counting is prohibited unless enabled by 
the IMPLEMENTATION DEFINED authentication interface 
ExternalSecureNoninvasiveDebugEnabled(). 
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This control applies only to: 

a The event counters in the range [0..(HDCR.HPMN-1)]. 

° If PMCR.DP is set to 1, PMCCNTR. 

The other event counters are unaffected. When PMCR.DP is set to 0, PMCCNTR is unaffected. 

On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


Bits [16:12] 
Reserved, RESO. 


TDRA, bit [11] 


Trap Debug ROM Address register access. Traps Non-secure ELO and EL1 System register accesses 
to the Debug ROM registers to Hyp mode. 


0bd This control does not cause any instructions to be trapped. 


Qb1 Non-secure ELO and EL1 System register accesses to the DBGDRAR or DBGDSAR 
are trapped to Hyp mode, unless it is trapped by DBGDSCRext.UDCCdis. 


If HCR.TGE or HDCR.TDE is 1, behavior is as if this bit is 1 other than for the purpose of a direct 
read. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 
TDOSA, bit [10] 
When ARMV8.0-DoubleLock is implemented: 


Trap debug OS-related register access. Traps Non-secure EL1 System register accesses to the 
powerdown debug registers to Hyp mode. 


0bd This control does not cause any instructions to be trapped. 
Qb1 Non-secure EL1 System register accesses to the powerdown debug registers are trapped 
to Hyp mode. 


The registers for which accesses are trapped are as follows: 
s DBGOSLSR, DBGOSLAR, DBGOSDLR, and DBGPRCR. 


° Any IMPLEMENTATION DEFINED register with similar functionality that the implementation 
specifies as trapped by this bit. 


Note 


These registers are not accessible at ELO. 








If HCR.TGE or HDCR.TDE is 1, behavior is as if this bit is 1 other than for the purpose of a direct 
read. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 
Otherwise: 


Trap debug OS-related register access. Traps Non-secure EL1 System register accesses to the 
powerdown debug registers to Hyp mode. 


0bd This control does not cause any instructions to be trapped. 
Qb1 Non-secure EL1 System register accesses to the powerdown debug registers are trapped 
to Hyp mode. 


The registers for which accesses are trapped are as follows: 
. DBGOSLSR, DBGOSLAR, and DBGPRCR. 


$ Any IMPLEMENTATION DEFINED register with similar functionality that the implementation 
specifies as trapped by this bit. 


It is IMPLEMENTATION DEFINED whether accesses to DBGOSDLR are trapped. 
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TDA, bit [9] 


TDE, bit [8] 


HPME, bit [7] 


Note 


These registers are not accessible at ELO. 








If HCR.TGE or HDCR.TDE is 1, behavior is as if this bit is 1 other than for the purpose of a direct 
read. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 


Trap debug access. Traps Non-secure ELO and EL1 System register accesses to those debug System 
registers in the (coproc==0b1110) encoding space that are not trapped by either of the following: 


° HDCR.TDRA. 
° HDCR.TDOSA. 
0bd This control does not cause any instructions to be trapped. 


Qb1 Non-secure ELO or EL1 System register accesses to the debug registers, other than the 
registers trapped by HDCR.TDRA and HDCR.TDOSA, are trapped to Hyp mode, 
unless it is trapped by DBGDSCRext.UDCCdis. 


Traps of AArch32 accesses to DBGDTRRXint and DBGDTRTXint are ignored in Debug state. 


If HCR.TGE or HDCR.TDE is 1, behavior is as if this bit is 1 other than for the purpose of a direct 
read. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 


Trap Debug exceptions. The possible values of this bit are: 


Qbd This control has no effect on the routing of debug exceptions, and has no effect on 
Non-secure accesses to debug registers. 


Qb1 Debug exceptions generated at EL1 or ELO are routed to EL2 when enabled in the 
current Security state. The HDCR.{TDRA, TDOSA, TDA} fields are treated as being 
1 for all purposes other than returning the result of a direct read of the register. 


When HCR.TGE == 1, the PE behaves as if the value of this field is 1 for all purposes other than 
returning the value of a direct read of the register. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 


When PMUV3 is implemented: 


[HDCR.HPMN..(N-1)] event counters enable. 


Ob Event counters in the range [HDCR.HPMN..(PMCR.N-1)] are disabled. 
Qb1 Event counters in the range [HDCR.HPMN..(PMCR.N-1)] are enabled by 
PMCNTENSET. 


If HDCR.HPMN is less than PMCR.N, the event counters in the range 
[HDCR.HPMN..(PMCR.N-1)], are enabled and disabled by this bit. Otherwise this bit has no effect 
on the operation of the event counters. 


Note 


The effect of HDCR.HPMN on the operation of this bit applies regardless of whether EL2 is enabled 
in the current Security state. 








For more information see the description of the HPMN field. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to an 
architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 
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TPM, bit [6] 
When PMUV3 is implemented: 


Trap Performance Monitors accesses. Traps Non-secure ELO and EL1 accesses to all Performance 
Monitors registers to Hyp mode. 


ObO This control does not cause any instructions to be trapped. 
Qb1 Non-secure ELO and EL1 accesses to all Performance Monitors registers are trapped to 
Hyp mode. 
Note 





EL2 does not provide traps on Performance Monitor register accesses through the optional 
memory-mapped external debug interface. 





On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 
Otherwise: 


Reserved, RESO. 
TPMCR, bit [5] 
When PMUV3 is implemented: 
Trap PMCR accesses. Traps Non-secure ELO and EL1 accesses to the PMCR to Hyp mode. 


0bd This control does not cause any instructions to be trapped. 
Qb1 Non-secure ELO and EL1 accesses to the PMCR are trapped to Hyp mode, unless it is 
trapped by PMUSERENR.EN. 
Note 





EL2 does not provide traps on Performance Monitor register accesses through the optional 
memory-mapped external debug interface. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


HPMN, bits [4:0] 
When PMUV3 is implemented: 


Defines the number of event counters that are accessible from Non-secure EL1 modes, and from 
Non-secure ELO modes if unprivileged access is enabled. 


If HPMN is less than PMCR.N, HPMN divides the event counters into two ranges, [0..CHPMN-1)] 
and [HPMN..(PMCR.N-1)]. 


For an event counter in the range [0..cHPMN-1)]: 


e The counter is accessible from EL1 and EL2, and from ELO if unprivileged access to the 
counters is enabled. 


s If ARMv8.5-PMU is implemented, PMCR.LP determines whether the counter overflows at 
PMEVCNTR<n>[31:0] or PMEVCNTR<n>[63:0]. 


. PMCR.E enables the operation of counters in this range. 


——— Note 
If HPMN is equal to PMCR.N, this applies to all event counters. 





If HPMN is less than PMCR.N, for an event counter in the range [HPMN..(PMCR.N-1)]: 
° The counter is accessible only from EL2 and from Secure state. 


° If ARMv8.5-PMU is implemented, HDCR.HLP determines whether the counter overflows 
at PMEVCNTR<n>[31:0] or PMEVCNTR<n>[63:0]. 
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è HDCR.HPME enables the operation of counters in this range. 


If this field is set to 0, or to a value larger than PMCR.N, then the following CONSTRAINED 


UNPREDICTABLE behaviors apply: 
. The value returned by a direct read of HDCR.HPMN is UNKNOWN. 
° Either: 


— An UNKNOWN number of counters are reserved for EL2 use. That is, the PE behaves 
as if HDCR.HPMN is set to an UNKNOWN non-zero value less than or equal to 


PMCR.N. 


— All counters are reserved for EL2 use, meaning no counters are accessible from 


Non-secure EL] and Non-secure ELO. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to the value in 


PMCR.N. 
Otherwise: 


Reserved, RESO. 


Accessing the HDCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b100 0b0001 O0b0001 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return HDCR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HDCR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b100 0b0001 O0b0001 


0b001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
HDCR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HDCR = R[t]; 
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G8.3.32 HTRFCR, Hyp Trace Filter Control Register 
The HTRFCR characteristics are: 


Purpose 


Provides EL2 controls for Trace. 


Configurations 


AArch32 System register HTRFCR[31:0] is architecturally mapped to AArch64 System register 
TRFCR_EL2[31:0]. 


This register is present only when ARMV8.4-Trace is implemented. Otherwise, direct accesses to 
HTRFCR are UNDEFINED. 


If EL2 is not implemented, this register is RESO from Monitor mode when SCR.NS == 1. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into EL2 with EL2 using AArch372, 
or into EL3 with EL3 using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register 
reset to architecturally UNKNOWN values. 


Attributes 
HTRFCR is a 32-bit register. 


Field descriptions 


The HTRFCR bit assignments are: 





= EOHTRE 
E2TRE 


RESO 
CX 
RESO 


Bits [31:7] 


Reserved, RESO. 


TS, bits [6:5] 
Timestamp Control. Controls which timebase is used for trace timestamps. 
0b00 The timestamp is controlled by TRFCR.TS. 


0b01 Virtual timestamp. The traced timestamp is the physical counter value minus the value 
of CNTVOFF. 


0b11 Physical timestamp. The traced timestamp is the physical counter value. 
When SelfHostedTraceEnabled() == FALSE, this field is ignored. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 
Bit [4] 

Reserved, RESO. 
CX, bit [3] 

VMID Trace Enable. 

Qbd VMID tracing is not allowed. 
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Qb1 VMID tracing is allowed. 
When SelfHostedTraceEnabled() == FALSE, this field is ignored. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 


Bit [2] 
Reserved, RESO. 
E2TRE, bit [1] 
EL2 Trace Enable. 
Qbd Tracing is prohibited at EL2. 
Qb1 Tracing is allowed at EL2. 


When SelfHostedTraceEnabled() == FALSE, this field is ignored. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 


EOHTRE, bit [0] 


ELO Trace Enable. 
Qbd Tracing is prohibited at ELO when HCR.TGE == 1. 
Qb1 Tracing is allowed at ELO when HCR.TGE == 1. 


This field is ignored if any of the following are true: 
° The PE is in Secure state. 

° SelfHostedTraceEnabled() == FALSE. 

° HCR.TGE == 0. 


On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to 0. 


Accessing the HTRFCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





0b1111 0b100 0b0001 0b0010 0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SDCR.TTRF == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
return HTRFCR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return HTRFCR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b100 0b0001 0b0010 


opc2 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SDCR.TTRF == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
HTRFCR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
HTRFCR = R[t]; 
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G8.3.33 PMMIR, Performance Monitors Machine Identification Register 


The PMMIR characteristics are: 


Purpose 
Describes Performance Monitors parameters specific to the implementation to software. 
Configurations 
This register is present only when ARMVv8.4-PMU is implemented. Otherwise, direct accesses to 
PMMIR are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


PMMIR is a 32-bit register. 


Field descriptions 


The PMMIR bit assignments are: 


31 8 7 0 
RESO SLOTS 
Bits [31:8] 


Reserved, RESO. 


SLOTS, bits [7:0] 
Operation width. The largest value by which the STALL_SLOT event might increment by in a 
single cycle. If the STALL SLOT event is not implemented, this field might read as zero. 


Accessing the PMMIR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1001 0b1110 0b110 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMMIR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
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AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMMIR; 
elsif PSTATE.EL == EL3 then 
return PMMIR; 
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SDCR, Secure Debug Control Register 


The SDCR characteristics are: 


Purpose 
Provides EL3 configuration options for self-hosted debug, trace, and the Performance Monitors 
Extension. 

Configurations 
AArch32 System register SDCR[31:0] can be mapped to AArch64 System register 
MDCR_EL3[31:0], but this is not architecturally mandated. 
Some or all RW fields of this register have defined reset values. These apply whenever the register 
is accessible. This means they apply when the PE resets into EL3 using AArch32. 

Attributes 


SDCR is a 32-bit register. 


Field descriptions 


The SDCR bit assignments are: 


31 24 23 22 21 20 19 18 17 16 15 14 13 


EPMAD 
EDAD 
TTRF 
STE 
SPME 
RESO 
Bits [31:24] 
Reserved, RESO. 
SCCD, bit [23] 
When ARMV8.5-PMU is implemented: 
Secure Cycle Counter Disable. Prohibits PMCCNTR from counting in Secure state. 
0bd Cycle counting by PMCCNTR is not affected by this bit. 
Qb1 Cycle counting by PMCCNTR is prohibited in Secure state. 
This bit does not affect the CPU_CYCLES event or any other event that counts cycles. 
In a system where the PE resets into EL3, this field resets to 0. 
Otherwise: 
Reserved, RESO. 
Bit [22] 
Reserved, RESO. 
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EPMAD, bit [21] 
When ARMv8.4-Debug is implemented and PMUV3 is implemented: 


External Performance Monitors Non-secure access disable. Controls Non-secure access to 
Performance Monitors registers by an external debugger. 


Qbd Non-secure access to the Performance Monitors registers from an external debugger is 
permitted. 
Qb1 Non-secure access to the Performance Monitors registers from an external debugger is 


not permitted. 


If the Performance Monitors Extension does not support external debug interface accesses this bit 
is RESO. 


Otherwise, if EL3 is not implemented and the Effective value of SCR.NS is 0b@, then the Effective 
value of this field is 0b1. 


In a system where the PE resets into EL3, this field resets to 0. 
When PMUV3 is implemented: 


External Performance Monitors access disable. Controls access to Performance Monitors registers 
by an external debugger. 


Qbd Access to Performance Monitors registers from an external debugger is permitted. 


Qb1 Access to Performance Monitors registers from an external debugger is not permitted, 
unless overridden by the IMPLEMENTATION DEFINED authentication interface. 


If the Performance Monitors Extension does not support external debug interface accesses this bit 
is RESO. 


Otherwise, if EL3 is not implemented and the Effective value of SCR.NS is 0b0, then the Effective 
value of this field is 0b1. 


In a system where the PE resets into EL3, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


EDAD, bit [20] 
When ARMV8.4-Debug is implemented: 


External debug Non-secure access disable. Controls Non-secure access to breakpoint, watchpoint, 
and OSLAR_ELI registers by an external debugger. 


ObO Non-secure access to debug registers from an external debugger is permitted. 


0b1 Non-secure access to breakpoint registers, watchpoint registers, and OSLAR_EL1 from 
an external debugger is not permitted. 


If EL3 is not implemented and the Effective value of SCR.NS is 0b@, then the Effective value of this 
field is Qb1. 


In a system where the PE resets into EL3, this field resets to 0. 
When ARMV8.2-Debug is implemented: 


External debug access disable. Controls access to breakpoint, watchpoint, and OSLAR_EL1 
registers by an external debugger. 


ObO Access to debug registers from an external debugger is permitted. 


Qb1 Access to breakpoint registers, watchpoint registers and OSLAR_EL1 from an external 
debugger is not permitted, unless overridden by the IMPLEMENTATION DEFINED 
authentication interface. 


If EL3 is not implemented and the Effective value of SCR.NS is 0b, then the Effective value of this 
field is Qb1. 


In a system where the PE resets into EL3, this field resets to 0. 
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Otherwise: 


TTRE, bit [19] 


External debug access disable. Controls access to breakpoint, watchpoint, and optionally 
OSLAR_ ELI registers by an external debugger. 


ObO Access to debug registers from an external debugger is permitted. 


Qb1 Access to breakpoint registers and watchpoint registers from an external debugger is not 
permitted, unless overridden by the IMPLEMENTATION DEFINED authentication interface. 
It is IMPLEMENTATION DEFINED whether access to the OSLAR_EL] register from an 
external debugger is permitted or not permitted. 


If EL3 is not implemented and the Effective value of SCR.NS is 0b@, then the Effective value of this 
field is 0b1. 


In a system where the PE resets into EL3, this field resets to 0. 


When ARMV8.4-Trace is implemented: 


Trap Trace Filter controls. Controls whether accesses at EL2 and EL] to the trace filter control 
registers are trapped to EL3. 


Qbd Accesses to HTRFCR and TRFCR registers are not affected by this control bit. 


0b1 When not in Monitor mode, accesses to HTRFCR and TRFCR registers generate a 
Monitor Trap exception, unless the access generates a higher priority exception. 


In a system where the PE resets into EL3, this field resets to 0. 


Otherwise: 


STE, bit [18] 


Reserved, RESO. 


When ARMV8.4-Trace is implemented: 


Secure Trace Enable. This bit enables tracing in Secure state and controls the level of authentication 
required by an external debugger to enable external tracing. 


ObO Trace is prohibited in Secure state unless overridden by the IMPLEMENTATION DEFINED 
authentication interface. 


Qb1 Trace in Secure state is not affected by this bit. 


This bit also controls the level of authentication required by an external debugger to enable external 
tracing. See Register controls to enable self-hosted trace on page G3-5678. 


If EL3 is not implemented and the Effective value of SCR.NS is 0b0, the PE behaves as if this bit is 
set to 0b1. 


In a system where the PE resets into EL3, this field resets to 0. 


Otherwise: 


Reserved, RESO. 


SPME, bit [17] 
When ARMv%8.2-Debug is implemented and PMUv3 is implemented: 


Secure Performance Monitors enable. This allows event counting in Secure state. 
Qbd Event counting prohibited in Secure state. 
Qb1 Event counting allowed in Secure state. 


If EL3 is not implemented and the Effective value of SCR.NS is 0b@, then the Effective value of this 
bit is @b1. 


In a system where the PE resets into EL3, this field resets to 0. 
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Bit [16] 


When PMUV3 is implemented: 
Secure Performance Monitors enable. This allows event counting in Secure state. 


ObO Event counting prohibited in Secure state, unless 
ExternalSecureNoninvasiveDebugEnabled() is TRUE. 


0b1 Event counting allowed in Secure state. 


If EL3 is not implemented and the Effective value of SCR.NS is 0b0, then the Effective value of this 
bit is Qb1. 


In a system where the PE resets into EL3, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


Reserved, RESO. 


SPD, bits [15:14] 


Bits [13:0] 


AArch32 Secure self-hosted Privileged Debug. Enables or disables debug exceptions from EL3, 
other than Breakpoint Instruction exceptions 


0b00 Legacy mode. Debug exceptions from EL3 are enabled by the authentication interface. 
0b10 Secure privileged debug disabled. Debug exceptions from EL3 are disabled. 
Qb11 Secure privileged debug enabled. Debug exceptions from EL3 are enabled. 


Other values are reserved, and have the CONSTRAINED UNPREDICTABLE behavior that they must 
have the same behavior as 0b00. Software must not rely on this property as the behavior of reserved 
values might change in a future revision of the architecture. 


This field has no effect on Breakpoint Instruction exceptions. These are always enabled. 
This field is ignored in Non-secure state. 


If debug exceptions from EL3 are enabled, then debug exceptions from Secure ELO are also 
enabled. 


Otherwise, debug exceptions from Secure ELO are enabled only if the value of SDER.SUIDEN is 
0b1. 


If EL3 is not implemented and the Effective value of SCR.NS is 0b@, then the Effective value of this 
field is 0b11. 


In a system where the PE resets into EL3, this field resets to 0. 


Reserved, RESO. 


Accessing the SDCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b0001 Ob0011 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
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elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == 'Q1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return SDCR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b000 = 0b0001 O0b0011 


opc2 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif !ELUsingAArch32(EL2) && SCR_EL3.<NS,EEL2> == 'Q1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif !ELUsingAArch32(EL3) && SCR_EL3.NS == '@' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' && CPI5SDISABLE2 == HIGH then 
UNDEFINED; 
else 
SDCR = R[t]; 
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G8.3.35 SDER, Secure Debug Enable Register 


The SDER characteristics are: 


Purpose 
Controls invasive and non-invasive debug in the Secure ELO mode. 


Configurations 
AArch32 System register SDER[31:0] is architecturally mapped to AArch64 System register 
SDER32_EL3[31:0]. 


This register is present only when HaveEL(EL3) or the implemented Security state is Secure state. 
Otherwise, direct accesses to SDER are UNDEFINED. 


This register is ignored by the PE when one or more of the following are true: 
° The PE is in Non-secure state. 
s EL1 is using AArch64. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
SDER is a 32-bit register. 


Field descriptions 


The SDER bit assignments are: 


L SUIDEN 
SUNIDEN 
Bits [31:2] 
Reserved, RESO. 


SUNIDEN, bit [1] 


Secure User Non-Invasive Debug Enable. 


Qbd This bit does not affect Performance Monitors event counting at Secure ELO 
Qb1 If EL3 or EL] is using AArch32, Performance Monitors event counting is allowed in 
Secure ELO. 


On a Warm reset, this field resets to 0. 


SUIDEN, bit [0] 
Secure User Invasive Debug Enable. 
Qbd This bit does not affect the generation of debug exceptions at Secure ELO. 
Qb1 If EL3 or EL1 is using AArch32, debug exceptions from Secure ELO are enabled. 


On a Warm reset, this field resets to 0. 
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Accessing the SDER 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0001 O0b0001 O0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif (!HaveEL(EL3) || !ELUsingAArch32(EL3)) && SCR_EL3.NS == 'Q' then 
return SDER; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
return SDER; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0001 O0b0001 O0b001 


if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif (!HaveEL(EL3) || !ELUsingAArch32(EL3)) && SCR_EL3.NS == '@' then 
SDER = R[t]; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
UNDEFINED; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' && CPI5SDISABLE2 == HIGH then 
UNDEFINED; 
else 
SDER = R[t]; 
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G8.3.36 TRFCR, Trace Filter Control Register 


G8-6476 


The TRFCR characteristics are: 


Purpose 


Provides EL1 controls for Trace. 


Configurations 
AArch32 System register TRFCR[3 1:0] is architecturally mapped to AArch64 System register 
TRFCR_EL1[31:0]. 
This register is present only when ARMV8.4-Trace is implemented. Otherwise, direct accesses to 
TRFCR are UNDEFINED. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
TRFCR is a 32-bit register. 


Field descriptions 


The TRFCR bit assignments are: 


Bits [31:7] 
Reserved, RESO. 


TS, bits [6:5] 


Timestamp Control. Controls which timebase is used for trace timestamps. 


0b01 Virtual timestamp. The traced timestamp is the physical counter value minus the value 
of CNTVOFF. 
0b11 Physical timestamp. The traced timestamp is the physical counter value. 


All other values are reserved. 

This field is ignored if any of the following are true: 
° SelfHostedTraceEnabled() == FALSE. 

° HTRFCR.TS is not @b00. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Bits [4:2] 
Reserved, RESO. 


EITRE, bit [1] 
EL] Trace Enable. 


Qbe Tracing is prohibited in PL1 modes. 
Qb1 Tracing is allowed in PL1 modes. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


ARM DDI 0487E.a 


AArch32 System Register Descriptions 
G8.3 Debug registers 


When SelfHostedTraceEnabled() == FALSE, this field is ignored. 


On a Warm reset, this field resets to 0. 


EOTRE, bit [0] 
ELO Trace Enable. 
Qbd Tracing is prohibited at ELO. 
Qb1 Tracing is allowed at ELO. 
This field is ignored if any of the following are true: 
° SelfHostedTraceEnabled() == FALSE. 


: EL2 is implemented and enabled in the current security state and HCR.TGE == 1. 


On a Warm reset, this field resets to 0. 


Accessing the TRFCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b0001 0b0010 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif SCR.NS == 'Q' then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TTRF == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TTRF == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SDCR.TTRF == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
return TRFCR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SDCR.TTRF == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
return TRFCR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return TRFCR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b000 0b0001 0b0010 


opc2 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif SCR.NS == 'Q' then 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TTRF == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TTRF == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SDCR.TTRF == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
TRFCR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TTRF == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SDCR.TTRF == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
TRFCR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
TRFCR = R[t]; 
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G8.4 Performance Monitors registers 


This section lists the Performance Monitors registers in AArch32. 
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G8.4.1 


G8-6480 


PMCCFILTR, Performance Monitors Cycle Count Filter Register 


The PMCCFILTR characteristics are: 


Purpose 


Determines the modes in which the Cycle Counter, PMCCNTR, increments. 


Configurations 


AArch32 System register PMCCFILTR[3 1:0] is architecturally mapped to AArch64 System 
register PMCCFILTR_ELO[31:0]. 


AArch32 System register PMCCFILTR[3 1:0] is architecturally mapped to External register 
PMCCFILTR_EL0[31:0]. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
PMCCFILTR is a 32-bit register. 


Field descriptions 


The PMCCFILTR bit assignments are: 


31 30 29 28 27 26 0 


P, bit [31] 
Privileged filtering bit. Controls counting in EL1. If EL3 is implemented, then counting in 
Non-secure EL1 is further controlled by the NSK bit. The possible values of this bit are: 
Qbd Count cycles in EL1. 
Qb1 Do not count cycles in EL1. 
On a Warm reset, this field resets to 0. 

U, bit [30] 


User filtering bit. Controls counting in ELO. If EL3 is implemented, then counting in Non-secure 
ELO is further controlled by the NSU bit. The possible values of this bit are: 


Qbd Count cycles in ELO. 
Qb1 Do not count cycles in ELO. 


On a Warm reset, this field resets to 0. 


NSK, bit [29] 


Non-secure EL1 (kernel) modes filtering bit. Controls counting in Non-secure EL1. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of P, cycles in Non-secure EL1 are counted. 
Otherwise, cycles in Non-secure EL1 are not counted. 


On a Warm reset, this field resets to 0. 
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NSU, bit [28] 


Non-secure ELO (Unprivileged) filtering. Controls counting in Non-secure ELO. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of U, cycles in Non-secure ELO are counted. 
Otherwise, cycles in Non-secure ELO are not counted. 
On a Warm reset, this field resets to 0. 

NSH, bit [27] 


Non-secure EL2 (Hyp mode) filtering bit. Controls counting in Non-secure EL2. If EL2 is not 
implemented, this bit is RESO. 


Qbd Do not count cycles in EL2. 
Qb1 Count cycles in EL2. 


On a Warm reset, this field resets to 0. 


Bits [26:0] 


Reserved, RESO. 


Accessing the PMCCFILTR 
PMCCFILTR can also be accessed by using PMXEVTYPER with PMSELR.SEL set to 0b11111. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1111 0b000 0b1110 0b1111 0b111 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCCFILTR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCCFILTR; 
elsif PSTATE.EL == EL2 then 
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if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCCFILTR; 
elsif PSTATE.EL == EL3 then 
return PMCCFILTR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





0b1111 0b000 0b1110 0b1111 0b111 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMCCFILTR = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





PMCCFILTR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMCCFILTR = R[t]; 
elsif PSTATE.EL == EL3 then 
PMCCFILTR = R[t]; 
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G8.4.2 PMCCNTR, Performance Monitors Cycle Count Register 


The PMCCNTR characteristics are: 


63 
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Purpose 


Holds the value of the processor Cycle Counter, CCNT, that counts processor clock cycles. See Time 
as measured by the Performance Monitors cycle counter on page D7-2671 for more information. 


PMCCFILTR determines the modes and states in which the PMCCNTR can increment. 


Configurations 


Attributes 


AArch32 System register PMCCNTR[63:0] is architecturally mapped to AArch64 System register 
PMCCNTR_ELO[63:0]. 


AArch32 System register PMCCNTR[63:0] is architecturally mapped to External register 
PMCCNTR_ELO[63:0]. 


All counters are subject to any changes in clock frequency, including clock stopping caused by the 
WFI and WFE instructions. This means that it is CONSTRAINED UNPREDICTABLE whether or not 
PMCCNTR continues to increment when clocks are stopped by WFI and WFE instructions. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


PMCCNTR is a 64-bit register that can also be accessed as a 32-bit value. Ifit is accessed as a 32-bit 
register, accesses read and write bits [31:0] and do not modify bits [63:32]. 


Field descriptions 


The PMCCNTR bit assignments are: 


CCNT 


CCNT, bits [63:0] 


Cycle count. Depending on the values of PMCR. {LC,D}, this field increments in one of the 
following ways: 


° Every processor clock cycle. 
° Every 64th processor clock cycle. 
Writing 1 to PMCR.C sets this field to 0. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMCCNTR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b1001 Ob1101 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<CR,EN> == '00' then 


if 


EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
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AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.<CR,EN> == 'QQ' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCCNTR<31:0>; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCCNTR<31:0>; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCCNTR<31:0>; 
elsif PSTATE.EL == EL3 then 
return PMCCNTR<31:0>; 








MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1001 Ob1101 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMCCNTR = ZeroExtend(R[t]); 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMCCNTR = ZeroExtend(R[t]); 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMCCNTR = ZeroExtend(R[t]); 
elsif PSTATE.EL == EL3 then 
PMCCNTR = ZeroExtend(R[t]); 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<CR,EN> == 'QQ' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && PMUSERENR.<CR,EN> == 'QQ@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 





coproc 


Ob1111 


CRm 


0b1001 


opc1 


0b0000 





elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 
else 
return PMCCNTR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
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AArch32.TakeHypTrapException(Qx04) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 
else 
return PMCCNTR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 
else 
return PMCCNTR; 
elsif PSTATE.EL == EL3 then 
return PMCCNTR; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm 


opc1 





Ob1111 0b1001 


0b0000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 

else 
PMCCNTR = R[t2]:R[t]; 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 

else 
PMCCNTR = R[t2]:R[t]; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 

else 
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PMCCNTR = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 
PMCCNTR = R[t2]:R[t]; 
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G8.4.3 PMCEIDO, Performance Monitors Common Event Identification register 0 
The PMCEID0 characteristics are: 


Purpose 


Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the range 0x0000 to 0x001F 


When the value of a bit in the register is 1 the corresponding common event is implemented and 
counted. 


Note 


Arm recommends that, if a common event is never counted, the value of the corresponding register 
bit is 0. 








For more information about the common events and the use of the PMCEIDn registers see The PMU 
event number space and common events on page D7-2693. 


Configurations 


AArch32 System register PMCEIDO[31:0] is architecturally mapped to AArch64 System register 
PMCEIDO_ ELO[31:0]. 


AArch32 System register PMCEIDO[31:0] is architecturally mapped to External register 
PMCEIDO[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
PMCEID0 is a 32-bit register. 


Field descriptions 


The PMCEID0 bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 1110 9 8 76543210 


ID31 ==] =— IDO 
ID30 ID1 
ID29 ID2 
ID28 ID3 
ID27 ID4 
ID26 IDS 
ID25 ID6 
ID24 ID7 
ID23 ID8 
ID22 ID9 
ID21 ID10 
ID20 ID11 
ID19 ID12 
ID18 ID13 
ID17 ID14 
ID16 ID15 


ID<n>, bit [n], for n = 0 to 31 





ID[n] corresponds to common event n. 
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For each bit: 
QbO The common event is not implemented, or not counted. 
Qb1 The common event is implemented. 


A bit that corresponds to a reserved event number is reserved. The value might be used in a future 


revision of the architecture to identify an additional common event. 


Note 





Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n> registers of that earlier version of the PMU architecture. 





Accessing the PMCEIDO 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b1001 0b1100 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


0b110 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





return PMCEIDQ; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





return PMCEIDQ; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
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AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCEIDQ; 
elsif PSTATE.EL == EL3 then 
return PMCEIDQ; 


G8-6490 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch32 System Register Descriptions 
G8.4 Performance Monitors registers 











G8.4.4 PMCEID1, Performance Monitors Common Event Identification register 1 
The PMCEID1 characteristics are: 
Purpose 
Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the range 0x0020 to 0x003F. 
When the value of a bit in the register is 1 the corresponding common event is implemented and 
counted. 
Note 
Arm recommends that, if a common event is never counted, the value of the corresponding register 
bit is 0. 
For more information about the common events and the use of the PMCEIDn registers see The PMU 
event number space and common events on page D7-2693. 
Configurations 
AArch32 System register PMCEID1[31:0] is architecturally mapped to AArch64 System register 
PMCEID1_ELO[31:0]. 
AArch32 System register PMCEID1[31:0] is architecturally mapped to External register 
PMCEID1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 
PMCEID1 is a 32-bit register. 
Field descriptions 
The PMCEID1 bit assignments are: 
31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 1211109 8 76543210 
ID31 =] — IDO 
ID30 ID1 
ID29 ID2 
ID28 ID3 
ID27 ID4 
ID26 ID5 
ID25 ID6 
ID24 ID7 
ID23 ID8 
ID22 ID9 
ID21 ID10 
ID20 ID11 
ID19 ID12 
ID18 ID13 
ID17 ID14 
ID16 ID15 
ID<n>, bit [n], for n = 0 to 31 
ID[n] corresponds to common event (0x0020 + n). 
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For each bit: 
QbO The common event is not implemented, or not counted. 
Qb1 The common event is implemented. 


A bit that corresponds to a reserved event number is reserved. The value might be used in a future 
revision of the architecture to identify an additional common event. 


Note 


Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n> registers of that earlier version of the PMU architecture. 








Accessing the PMCEID1 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1001 O0b1100 Obi11 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





return PMCEID1; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





return PMCEID1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
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AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCEID1; 
elsif PSTATE.EL == EL3 then 
return PMCEID1; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. G8-6493 
ID070919 Non-Confidential 


AArch32 System Register Descriptions 


G8.4 Performance Monitors registers 


G8.4.5 


G8-6494 


PMCEID2, Performance Monitors Common Event Identification register 2 


The PMCEID2 characteristics are: 


Purpose 


Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the range 0x4000 to 0x401F. 


When the value of a bit in the register is 1 the corresponding common event is implemented and 


counted. 


Note 
Arm recommends that, if a common event is never counted, the value of the corresponding register 
bit is 0. 








For more information about the common events and the use of the PMCEIDn registers see The PMU 
event number space and common events on page D7-2693. 


Configurations 


Attributes 


AArch32 System register PMCEID2[31:0] is architecturally mapped to AArch64 System register 
PMCEIDO_ ELO[63:32]. 


AArch32 System register PMCEID2[31:0] is architecturally mapped to External register 
PMCEID2[63:32]. 


This register is present only when ARMV8.1-PMU is implemented. Otherwise, direct accesses to 
PMCEID2 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


PMCEID2 is a 32-bit register. 


Field descriptions 


The PMCEID2 bit assignments are: 


31 


0 


IDhi<n>, bit[n], for n = 0 to 31 


IDhi<n>, bit [n], for n = 0 to 31 


IDhi[n] corresponds to common event (0x4000 + n). 

For each bit: 

Qbd The common event is not implemented, or not counted. 

Qb1 The common event is implemented. 

A bit that corresponds to a reserved event number is reserved. The value might be used in a future 


revision of the architecture to identify an additional common event. 


Note 

Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n> registers of that earlier version of the PMU architecture. 
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Accessing the PMCEID2 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1001 0b1110 0b100 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 








else 





return PMCEID2; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





return PMCEID2; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCEID2; 
elsif PSTATE.EL == EL3 then 
return PMCEID2; 
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PMCEID3, Performance Monitors Common Event Identification register 3 


The PMCEID3 characteristics are: 


Purpose 


Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the range 0x4020 to 0x403F. 

When the value of a bit in the register is 1 the corresponding common event is implemented and 
counted. 


Note 
Arm recommends that, if a common event is never counted, the value of the corresponding register 
bit is 0. 








For more information about the common events and the use of the PMCEIDn registers see The PMU 
event number space and common events on page D7-2693. 


Configurations 


Attributes 


AArch32 System register PMCEID3[31:0] is architecturally mapped to AArch64 System register 
PMCEID1_ELO[63:32]. 


AArch32 System register PMCEID3[31:0] is architecturally mapped to External register 
PMCEID3[63:32]. 


This register is present only when ARMV8.1-PMU is implemented. Otherwise, direct accesses to 
PMCEID3 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


PMCEID3 is a 32-bit register. 


Field descriptions 


The PMCEID3 bit assignments are: 


31 


0 


IDhi<n>, bit[n], for n = 0 to 31 


IDhi<n>, bit [n], for n = 0 to 31 


IDhi[n] corresponds to common event (0x4020 + n). 

For each bit: 

Qbd The common event is not implemented, or not counted. 

Qb1 The common event is implemented. 

A bit that corresponds to a reserved event number is reserved. The value might be used in a future 


revision of the architecture to identify an additional common event. 


Note 

Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n> registers of that earlier version of the PMU architecture. 
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Accessing the PMCEID3 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1001 Ob1110 0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 








else 





return PMCEID3; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





return PMCEID3; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCEID3; 
elsif PSTATE.EL == EL3 then 
return PMCEID3; 
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G8.4.7 PMCNTENCLR, Performance Monitors Count Enable Clear register 
The PMCNTENCLR characteristics are: 


Purpose 


Disables the Cycle Count Register, PMCCNTR, and any implemented event counters 
PMEVCNTR<n>. Reading this register shows which counters are enabled. 


PMCNTENCLR is used in conjunction with the PMCNTENSET register. 


Configurations 


AArch32 System register PMCNTENCLRJ3 1:0] is architecturally mapped to AArch64 System 
register PMCNTENCLR_ELO[31:0]. 


AArch32 System register PMCNTENCLRJ3 1:0] is architecturally mapped to External register 
PMCNTENCLR_ELO[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMCNTENCLR is a 32-bit register. 


Field descriptions 


The PMCNTENCLR bit assignments are: 


31 30 0 
P<n>, bit [n] 
C, bit [31] 
PMCCNTR disable bit. Disables the cycle counter register. Possible values are: 
Qbd When read, means the cycle counter is disabled. When written, has no effect. 
Qb1 When read, means the cycle counter is enabled. When written, disables the cycle 
counter. 


This field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter disable bit for PMEVCNTR<n>. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN if EL2 is using 
AArché4, or in HDCR.HPMN if EL2 is using AArch32. Otherwise, N is the value in PMCR.N. 


Qbd When read, means that PMEVCNTR<n> is disabled. When written, has no effect. 
Qb1 When read, means that PMEVCNTR<n> is enabled. When written, disables 
PMEVCNTR<n>. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMCNTENCLR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1001 0b1100 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCNTENCLR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCNTENCLR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCNTENCLR; 
elsif PSTATE.EL == EL3 then 
return PMCNTENCLR; 








MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1001 0b1100 0b010 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
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AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 

else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
PMCNTENCLR = R[t]; 





elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
PMCNTENCLR = R[t]; 


elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
PMCNTENCLR = R[t]; 


elsif PSTATE.EL == EL3 then 


PMCNTENCLR = R[t]; 
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G8.4.8 PMCNTENSET, Performance Monitors Count Enable Set register 


ARM DDI 0487E.a 
ID070919 


The PMCNTENSET characteristics are: 


Purpose 


Enables the Cycle Count Register, PMCCNTR, and any implemented event counters 
PMEVCNTR<n>. Reading this register shows which counters are enabled. 


PMCNTENSET is used in conjunction with the PMCNTENCLR register. 


Configurations 


AArch32 System register PMCNTENSET[31:0] is architecturally mapped to AArch64 System 
register PMCNTENSET_ELO0[31:0]. 


AArch32 System register PMCNTENSET[31:0] is architecturally mapped to External register 
PMCNTENSET_ELO[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMCNTENSET is a 32-bit register. 


Field descriptions 


The PMCNTENSET bit assignments are: 


31 30 0 
P<n>, bit [n] 
C, bit [31] 
PMCCNTR enable bit. Enables the cycle counter register. Possible values are: 
Qbd When read, means the cycle counter is disabled. When written, has no effect. 
Qb1 When read, means the cycle counter is enabled. When written, enables the cycle 
counter. 


This field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter enable bit for PMEVCNTR<n>. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN if EL2 is using 
AArché4, or in HDCR.HPMN if EL2 is using AArch32. Otherwise, N is the value in PMCR.N. 


Qbd When read, means that PMEVCNTR<n> is disabled. When written, has no effect. 
Qb1 When read, means that PMEVCNTR<n> event counter is enabled. When written, 
enables PMEVCNTR<n>. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMCNTENSET 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b000 = 0b1001 0b1100 


opc2 


0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCNTENSET; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCNTENSET; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCNTENSET; 
elsif PSTATE.EL == EL3 then 
return PMCNTENSET; 








MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











coproc opct CRn CRm opc2 
0b1111 0b000 =0b1001 = 0b1100 O0b001 
if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
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AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 

else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
PMCNTENSET = R[t]; 





elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
PMCNTENSET = R[t]; 


elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
PMCNTENSET = R[t]; 


elsif PSTATE.EL == EL3 then 


PMCNTENSET = R[t]; 
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PMCR, Performance Monitors Control Register 


The PMCR characteristics are: 


Purpose 


Provides details of the Performance Monitors implementation, including the number of counters 
implemented, and configures and controls the counters. 


Configurations 
AArch32 System register PMCR[31:0] is architecturally mapped to AArch64 System register 
PMCR_ELO[31:0]. 
AArch32 System register PMCR[7:0] is architecturally mapped to External register 
PMCR_ELO[7:0]. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
PMCR is a 32-bit register. 


Field descriptions 


The PMCR bit assignments are: 


31 24 23 1615 11 10 876543210 


IMP, bits [31:24] 
Implementer code. This field is RO with an IMPLEMENTATION DEFINED value. 
If this field is zero, then PMCR.IDCODE is RESO and software must use MIDR to identify the PE. 


Otherwise this field and PMCR.IDCODE identify the PMU implementation to software. The 
implementer codes are allocated by Arm. A non-zero value has the same interpretation as 
MIDR.Implementer. 


IDCODE, bits [23:16] 
When PMCR.IMP != 0x00: 
Identification code. This field is RO with an IMPLEMENTATION DEFINED value. 


Each implementer must maintain a list of identification codes that are specific to the implementer. 
A specific implementation is identified by the combination of the implementer code and the 
identification code. 

Otherwise: 


Reserved, RESO. 


N, bits [15:11] 


An RO field that indicates the number of event counters implemented. This value is in the range of 
0b00000-0b111111. If the value is @b00000 then only PMCCNTR_ELO is implemented. If the value is 
0b111111 PMCCNTR_ELO and 31 event counters are implemented. 


In an implementation that includes EL2: 


a IfEL2 is using AArch32, reads of this field from Non-secure EL1 and Non-secure ELO return 
the value of HDCR.HPMN. 
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s If EL2 is using AArch64 and enabled in the current Security state, reads of this field from 
EL1 and ELO return the value of MDCR_EL2.HPMN. 


Access to this field is RO. 
Bits [10:8] 
Reserved, RESO. 
LP, bit [7] 
When ARMV8.5-PMU is implemented: 


Long event counter enable. Determines when unsigned overflow is recorded by a counter overflow 


bit. 

Ob Event counter overflow on increment that causes unsigned overflow of 
PMEVCNTR<n>[31:0]. 

Qb1 Event counter overflow on increment that causes unsigned overflow of 


PMEVCNTR<n>[63:0]. 


If the highest implemented Exception level is using AArch32, it is IMPLEMENTATION DEFINED 
whether this bit is read/write or RAZ/WI. 


If EL2 is implemented and HDCR.HPMN or MDCR_EL2.HPMN is less than PMCR.N, this bit 
does not affect the operation of event counters in the range [HDCR.HPMN..(PMCR.N-1)] or 
[MDCR_EL2.HPMN..(PMCR.N-1)]. 


PMEVCNTR<n>[63:32] cannot be accessed directly in AArch372 state. 





Note 
The effect of HDCR.HPMN or MDCR_EL2.HPMN on the operation of this bit always applies if 
EL2 is implemented, at all Exception levels including EL2 and EL3, and regardless of whether EL2 


is enabled in the current Security state. For more information, see the description of HDCR.HPMN 
or MDCR_EL2.HPMN. 





On a Warm reset, this field resets to 0. 
Otherwise: 


Reserved, RESO. 


LC, bit [6] 


Long cycle counter enable. Determines when unsigned overflow is recorded by the cycle counter 
overflow bit. 


Qbd Cycle counter overflow on increment that causes unsigned overflow of 
PMCCNTR{31:0]. 


Qb1 Cycle counter overflow on increment that causes unsigned overflow of 
PMCCNTR[63:0]. 


Arm deprecates use of PMCR.LC = 0. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


DP, bit [5] 
Disable cycle counter when event counting is prohibited. The possible values of this bit are: 
0bd Cycle counting by PMCCNTR is not affected by this bit. 


Qb1 When event counting for counters in the range [0..(HDCR.HPMN-1)] or 
[0...MDCR_EL2.HPMN-1)] is prohibited, cycle counting by PMCCNTR is disabled. 


For more information about the interaction between the Performance Monitors and EL3, see Effect 
of EL3 and EL2 on page D7-2679 


When EL3 is not implemented, this field is RESO: 
. When ARMv8.1-PMU is not implemented. 
à When ARMv8.1-PMU is implemented, only if EL2 is not implemented. 
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X, bit [4] 


D, bit [3] 


C, bit [2] 


P, bit [1] 


Otherwise this field is RW. 


On a Warm reset, this field resets to 0. 


Enable export of events in an IMPLEMENTATION DEFINED event stream. The possible values of this 
bit are: 


Qbd Do not export events. 
Qb1 Export events where not prohibited. 


This field enables the exporting of events over an event bus to another device, for example to an 
OPTIONAL PE trace unit. If the implementation does not include such an event bus then this field is 
RAZ/WI, otherwise it is an RW field. 


In an implementation that includes an event bus, no events are exported when counting is prohibited. 


This field does not affect the generation of Performance Monitors overflow interrupt requests or 
signaling to a cross-trigger interface (CTI) that can be implemented as signals exported from the PE. 


On a Warm reset, this field resets to 0. 


Clock divider. The possible values of this bit are: 

Qbe When enabled, PMCCNTR counts every clock cycle. 

Qb1 When enabled, PMCCNTR counts once every 64 clock cycles. 

This bit is RW. 

If PMCR.LC == 1, this bit is ignored and the cycle counter counts every clock cycle. 
Arm deprecates use of PMCR.D = 1. 


On a Warm reset, this field resets to 0. 


Cycle counter reset. This bit is WO. The effects of writing to this bit are: 
Qbd No action. 

Qb1 Reset PMCCNTR to zero. 

This bit is always RAZ. 


—— Note 
Resetting PMCCNTR does not change the cycle counter overflow bit. 


The value of PMCR_ELO.LC is ignored, and bits [63:0] of all event counters are reset. 





Event counter reset. This bit is WO. The effects of writing to this bit are: 
Qbd No action. 


Qb1 Reset all event counters accessible in the current Exception level, not including 
PMCCNTR, to zero. 


This bit is always RAZ. 
In ELO and EL1: 


è If EL2 is implemented and enabled in the current Security state, and HDCR.HPMN or 
MDCR_EL2.HPMN is less than PMCR_ELO.N, a write of 1 to this bit does not reset event 
counters in the range [HDCR.HPMN..(PMCR.N-1)] or 
[MDCR_EL2.HPMN..(PMCR.N-1)]. 


° If EL2 is not implemented, EL2 is disabled in the current Security state, or HDCR.HPMN or 
MDCR_EL2.HPMN is equal to PMCR_ELO.N, a write of 1 to this bit resets all the event 
counters. 
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In EL2 and EL3, a write of | to this bit resets all the event counters. 
Note 
Resetting the event counters does not change the event counter overflow bits. 


If ARMv8.5-PMU is implemented, the value of HDCR.HLP, or PMCR.LP is ignored and bits [63:0] 
of all affected event counters are reset. 








Enable. 

Qbd All event counters in the range [0..(PMN-1)] and PMCCNTR, are disabled. 

Qb1 All event counters in the range [0..(PMN-1)] and PMCCNTR, are enabled by 
PMCNTENSET. 

This bit is RW. 


If EL2 is implemented then: 
. If EL2 is using AArch32, PMN is HDCR.HPMN. 
° If EL2 is using AArch64, PMN is MDCR_EL2.HPMN. 


. If PMN is less than PMCR.N, this bit does not affect the operation of event counters in the 
range [PMN..(PMCR.N-1)]. 


If EL2 is not implemented, PMN is PMCR.N. 


Note 
The effect of MDCR_EL2.HPMN or HDCR.HPMN on the operation of this bit always applies if 
EL2 is implemented, at all Exception levels including EL2 and EL3, regardless of whether EL2 is 


enabled in the current Security state. For more information, see the description of 
MDCR_EL2.HPMN or HDCR.HPMN. 








On a Warm reset, this field resets to 0. 


Accessing the PMCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b1001 0b1100 0b000 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


else 


AArch64.AArch32SystemAccessTrap(EL1, 0x03); 


elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 


AArch32.TakeHypTrapException(0xQQ) ; 


else 


UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
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AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMCR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPMCR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMCR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPMCR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMCR; 
elsif PSTATE.EL == EL3 then 
return PMCR; 








MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





0b1111 0b000 0b1001 0b1100 


0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMCR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
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elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPMCR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMCR = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPMCR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPMCR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMCR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMCR = R[t]; 
elsif PSTATE.EL == EL3 then 
PMCR = R[t]; 
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PMEVCNTR<n>, Performance Monitors Event Count Registers, n = 0 - 30 


The PMEVCNTR<n> characteristics are: 


Purpose 


Holds event counter n, which counts events, where n is 0 to 30. 


Configurations 


AArch32 System register PMEVCNTR<n>[31:0] is architecturally mapped to AArch64 System 
register PMEVCNTR<n>_ELO0[31:0]. 


AArch32 System register PMEVCNTR<n>[31:0] is architecturally mapped to External register 
PMEVCNTR<n>_EL0[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMEVCNTR<n> is a 32-bit register. 


Field descriptions 


The PMEVCNTR<n> bit assignments are: 


31 0 
Bits [31:0] 


Event counter n. Value of event counter n, where n is the number of this register and is a number 
from 0 to 30. 


If ARMv8.5-PMU is implemented, the event counter is 64 bits and only the least-significant part of 
the event counter is accessible in AArch32 state: 


: Reads from PMEVCNTR<n> return bits [31:0] of the counter. 
s Writes to PMEVCNTR<n> update bits [31:0] and leave bits [63:32] unchanged. 
s There is no means to access bits [63:32] directly from AArch32 state. 


è If the implementation does not support AArch64 at any Exception level, bits [63:32] are not 
required to be implemented. 


If ARMv8.5-PMU is not implemented, the event counter is 32 bits. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMEVCNTR<n> 
PMEVCNTR<n> can also be accessed by using PMXEVCNTR with PMSELR.SEL set to the value of <n>. 


If <n> is greater than or equal to the number of accessible counters, reads and writes of PMEVCNTR<n> are 
CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 
7 Accesses to the register behave as RAZ/WI. 
. Accesses to the register execute as a NOP 


s If EL2 is implemented and enabled in the current Security state, and <n> is less than the number of 
implemented counters, accesses from EL1 or permitted accesses from ELO are trapped to EL2. 
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Note 





In ELO, an access is permitted if it is enabled by PMUSERENR. {ER,EN} or PMUSERENR_ELO. {ER,EN}. 


If EL2 is implemented and enabled in the current Security state, at ELO and EL1: 
° If EL2 is using AArch32, HDCR.HPMN identifies the number of accessible counters. 


° If EL2 is using AArch64, MDCR_EL2.HPMN identifies the number of accessible counters. 


Otherwise, the number of accessible counters is the number of implemented counters. See HDCR.HPMN and 


MDCR_EL2.HPMN for more details. 





Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 CRn CRm 


opc2 





0b1111 0b000 0b1110 0b10:n[4:3] 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<ER,EN> == 'Q@0' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.<ER,EN> == 'QQ' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMEVCNTR[UInt(CRm<1:0>:opc2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





return PMEVCNTR[UInt(CRm<1:0>:opc2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMEVCNTR[UInt(CRm<1:0>:opc2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return PMEVCNTR[UInt(CRm<1:0>:opc2<2:0>)]; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


0b1111 0b000 0b1110 0b10:n[4:3] 


opc2 


n[2:0] 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMEVCNTR[UInt (CRm<1:0>:0pc2<2:0>)] = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMEVCNTR[UInt (CRm<1:@>:0pc2<2:0>)] = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMEVCNTR[UInt (CRm<1:@>:0pc2<2:0>)] = R[t]; 
elsif PSTATE.EL == EL3 then 
PMEVCNTR[UInt(CRm<1:0>:o0pc2<2:0>)] = R[t]; 
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G8.4.11 PMEVTYPER<n>, Performance Monitors Event Type Registers, n = 0 - 30 
The PMEVTYPER<n> characteristics are: 


Purpose 


Configures event counter n, where n is 0 to 30. 


Configurations 


AArch32 System register PMEVTYPER<n>[3 1:0] is architecturally mapped to AArch64 System 
register PMEVTYPER<n>_EL0[31:0]. 


AArch32 System register PMEVTYPER<n>[31:0] is architecturally mapped to External register 
PMEVTYPER<n>_EL0[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMEVTYPER<n> is a 32-bit register. 


Field descriptions 


The PMEVTYPER<n> bit assignments are: 


31 30 29 28 27 26 25 24 1615 


Pel) | yy RESO evtCount[15:10] evtCount{9:0] 





P, bit [31] 
Privileged filtering bit. Controls counting in EL1. If EL3 is implemented, then counting in 
Non-secure EL1 is further controlled by the NSK bit. The possible values of this bit are: 
Qbd Count events in EL1. 
Qb1 Do not count events in EL1. 
This field resets to an architecturally UNKNOWN value. 

U, bit [30] 


User filtering bit. Controls counting in ELO. If EL3 is implemented, then counting in Non-secure 
ELO is further controlled by the NSU bit. The possible values of this bit are: 


ObO Count events in ELO. 
Qb1 Do not count events in ELO. 


This field resets to an architecturally UNKNOWN value. 


NSK, bit [29] 


Non-secure EL1 (kernel) modes filtering bit. Controls counting in Non-secure EL1. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of P, events in Non-secure EL1 are counted. 
Otherwise, events in Non-secure EL1 are not counted. 


This field resets to an architecturally UNKNOWN value. 
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NSU, bit [28] 


Non-secure ELO (Unprivileged) filtering. Controls counting in Non-secure ELO. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of U, events in Non-secure ELO are counted. 
Otherwise, events in Non-secure ELO are not counted. 


This field resets to an architecturally UNKNOWN value. 


NSH, bit [27] 


Non-secure EL2 (Hyp mode) filtering bit. Controls counting in Non-secure EL2. If EL2 is not 
implemented, this bit is RESO. 


Qbd Do not count events in EL2. 
Qb1 Count events in EL2. 


This field resets to an architecturally UNKNOWN value. 


Bit [26] 


Reserved, RESO. 


MT, bit [25] 
Multithreading. When the implementation is multi-threaded, the valid values for this bit are: 
Qbd Count events only on controlling PE. 
Qb1 Count events from any PE with the same affinity at level 1 and above as this PE. 


When the implementation is not multi-threaded, this bit is RESO. 


Note 


$ When the lowest level of affinity consists of logical PEs that are implemented using a 
multi-threading type approach, an implementation is described as multi-threaded. That is, the 
performance of PEs at the lowest affinity level is highly interdependent. On such an 
implementation, when read at the highest implemented Exception level, the value of 
MPIDR_EL1.MT is 1. 





. Events from a different thread of a multithreaded implementation are not Attributable to the 
thread counting the event. 


This field resets to an architecturally UNKNOWN value. 


Bits [24:16] 


Reserved, RESO. 


evtCount([15:10], bits [15:10] 
When ARMv8.1-PMU is implemented: 
Extension to evtCount[9:0]. See evtCount[9:0] for more details. 
Otherwise: 


Reserved, RESO. 

evtCount[9:0], bits [9:0] 
Event to count. The event number of the event that is counted by event counter PMEVCNTR<n>. 
Software must program this field with an event that is supported by the PE being programmed. 


There are three types of event: 


. Common architectural and microarchitectural events. 
. Arm recommended common architectural and microarchitectural events. 
» IMPLEMENTATION DEFINED events. 
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The ranges of event numbers allocated to each type of event are shown in Table D7-6 on 
page D7-2693. 


If evtCount is programmed to an event that is reserved or not supported by the PE, the behavior 
depends on the event type: 


° For the range 0x000 to 0x03F, no events are counted, and the value returned by a direct or 
external read of the evtCount field is the value written to the field. 


. For IMPLEMENTATION DEFINED events, it is UNPREDICTABLE what event, if any, is counted, 
and the value returned by a direct or external read of the evtCount field is UNKNOWN. 


— Note 


UNPREDICTABLE means the event must not expose privileged information. 





Arm recommends that the behavior across a family of implementations is defined such that if a 
given implementation does not include an event from a set of common IMPLEMENTATION DEFINED 
events, then no event is counted and the value read back on evtCount is the value written. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMEVTYPER<n> 
PMEVTYPER<n> can also be accessed by using PMXEVTYPER with PMSELR.SEL set to n. 


If <n> is greater or equal to the number of accessible counters, reads and writes of PMEVTYPER<n> are 
CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


. Accesses to the register are UNDEFINED. 
. Accesses to the register behave as RAZ/WI. 
. Accesses to the register execute as a NOP. 


a If EL2 is implemented and enabled in the current Security state, and <n> is less than the number of 
implemented counters, accesses from EL1 or permitted accesses from ELO are trapped to EL2. 


Note 
In ELO, an access is permitted if it is enabled by PMUSERENR.EN or PMUSERENR_ELO.EN. 





If EL2 is implemented and enabled in the current Security state, at ELO and EL1: 
° If EL2 is using AArch32, HDCR.HPMN identifies the number of accessible counters. 
° If EL2 is using AArch64, MDCR_EL2.HPMN identifies the number of accessible counters. 


Otherwise, the number of accessible counters is the number of implemented counters. See HDCR.HPMN and 
MDCR_EL2.HPMN for more details. 





Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 


0b1111 0b000 0b1110 ObI1:n[4:3] — n [2:0] 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
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elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMEVTYPER[UInt(CRm<1:0>:opc2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMEVTYPER[UInt(CRm<1:0>:opc2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMEVTYPER[UInt(CRm<1:0>:opc2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return PMEVTYPER[UInt(CRm<1:0>:opc2<2:0>)]; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111  0b000 Ob1110 0bll:n[4:3] n[2:0] 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMEVTYPER[UInt (CRm<1:@>:opc2<2:0>)] = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 


G8-6516 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


AArch32 System Register Descriptions 
G8.4 Performance Monitors registers 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMEVTYPER[UInt (CRm<1:@>:opc2<2:0>)] = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMEVTYPER[UInt (CRm<1:@>:opc2<2:0>)] = R[t]; 
elsif PSTATE.EL == EL3 then 
PMEVTYPER[UInt(CRm<1:0>:opc2<2:0>)] = R[t]; 
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G8.4.12 PMINTENCLR, Performance Monitors Interrupt Enable Clear register 


The PMINTENCLR characteristics are: 


Purpose 
Disables the generation of interrupt requests on overflows from the Cycle Count Register, 
PMCCNTR, and the event counters PMEVCNTR<n>. Reading the register shows which overflow 
interrupt requests are enabled. 
PMINTENCLR is used in conjunction with the PMINTENSET register. 

Configurations 
AArch32 System register PMINTENCLR[3 1:0] is architecturally mapped to AArch64 System 
register PMINTENCLR_EL1[31:0]. 
AArch32 System register PMINTENCLR[31:0] is architecturally mapped to External register 
PMINTENCLR_EL1[31:0]. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 


PMINTENCLR is a 32-bit register. 


Field descriptions 


The PMINTENCLR bit assignments are: 


31 30 0 
C, bit [31] 


PMCCNTR overflow interrupt request disable bit. Possible values are: 


0bd When read, means the cycle counter overflow interrupt request is disabled. When 
written, has no effect. 


Qb1 When read, means the cycle counter overflow interrupt request is enabled. When 
written, disables the cycle count overflow interrupt request. 


This field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter overflow interrupt request disable bit for PMEVCNTR<n>. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1, N is the value in MDCR_EL2.HPMN if EL2 is using AArch64, or in 
HDCR.HPMN if EL2 is using AArch32. Otherwise, N is the value in PMCR.N. 


0bd When read, means that the PMEVCNTR<n> event counter interrupt request is disabled. 
When written, has no effect. 
Qb1 When read, means that the PMEVCNTR<n> event counter interrupt request is enabled. 


When written, disables the PMEVCNTR<n> interrupt request. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMINTENCLR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 








if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMINTENCLR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMINTENCLR; 
elsif PSTATE.EL == EL3 then 
return PMINTENCLR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMINTENCLR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMINTENCLR = R[t]; 
elsif PSTATE.EL == EL3 then 
PMINTENCLR = R[t]; 


coproc opct CRn CRm opc2 
0b1111 0b000 0b1001 0b1110 0b010 
coproc opc1 CRn CRm opc2 
0b1111 0b000 0b1001 0b1110 0b010 
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G8.4.13 PMINTENSET, Performance Monitors Interrupt Enable Set register 
The PMINTENSET characteristics are: 


Purpose 


Enables the generation of interrupt requests on overflows from the Cycle Count Register, 
PMCCNTR, and the event counters PMEVCNTR<n>. Reading the register shows which overflow 


interrupt requests are enabled. 
PMINTENSET is used in conjunction with the PMINTENCLR register. 


Configurations 
AArch32 System register PMINTENSET[31:0] is architecturally mapped to AArch64 System 
register PMINTENSET_EL1[31:0]. 


AArch32 System register PMINTENSET[3 1:0] is architecturally mapped to External register 
PMINTENSET EL1[31:0]. 

This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMINTENSET is a 32-bit register. 


Field descriptions 


The PMINTENSET bit assignments are: 


31 30 0 
C, bit [31] 


PMCCNTR overflow interrupt request enable bit. Possible values are: 


0bd When read, means the cycle counter overflow interrupt request is disabled. When 
written, has no effect. 


Qb1 When read, means the cycle counter overflow interrupt request is enabled. When 
written, enables the cycle count overflow interrupt request. 


This field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter overflow interrupt request enable bit for PMEVCNTR<n>. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1, N is the value in MDCR_EL2.HPMN if EL2 is using AArch64, or in 
HDCR.HPMN if EL2 is using AArch32. Otherwise, N is the value in PMCR.N. 


0bd When read, means that the PMEVCNTR<n> event counter interrupt request is disabled. 
When written, has no effect. 
Qb1 When read, means that the PMEVCNTR<n> event counter interrupt request is enabled. 


When written, enables the PMEVCNTR<n> interrupt request. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMINTENSET 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1001 Ob1110 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMINTENSET; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMINTENSET; 
elsif PSTATE.EL == EL3 then 
return PMINTENSET; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b000 0b1001 Ob1110 O0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMINTENSET = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMINTENSET = R[t]; 
elsif PSTATE.EL == EL3 then 
PMINTENSET = R[t]; 
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G8.4.14 PMOVSR, Performance Monitors Overflow Flag Status Register 


The PMOVSR characteristics are: 


Purpose 
Contains the state of the overflow bit for the Cycle Count Register, PMCCNTR, and each of the 
implemented event counters PMEVCNTR<n>. Writing to this register clears these bits. 
Configurations 
AArch32 System register PMOVSR[31:0] is architecturally mapped to AArch64 System register 
PMOVSCLR_ELO[31:0]. 
AArch32 System register PMOVSR[31:0] is architecturally mapped to External register 
PMOVSCLR_ELO[31:0]. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 
Attributes 


PMOVSR is a 32-bit register. 


Field descriptions 


The PMOVSR bit assignments are: 


31 30 0 
C, bit [31] 


Cycle counter overflow clear bit. Possible values are: 


Qbd When read, means the cycle counter has not overflowed since this bit was last cleared. 
When written, has no effect. 


Qb1 When read, means the cycle counter has overflowed since this bit was last cleared. 
When written, clears the cycle counter overflow bit to 0. 


PMCR.LC controls whether an overflow is detected from unsigned overflow of PMCCNTR[31:0] 
or unsigned overflow of PMCCNTR[63:0]. 


This field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter overflow clear bit for PMEVCNTR<n>. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN if EL2 is using 
AArch64, or in HDCR.HPMN if EL2 is using AArch32. Otherwise, N is the value in PMCR.N. 


Oba When read, means that PMEVCNTR<n> has not overflowed since this bit was last 
cleared. When written, has no effect. 


Qb1 When read, means that PMEVCNTR<n> has overflowed since this bit was last cleared. 
When written, clears the PMEVCNTR<n> overflow bit to 0. 


If ARMv8.5-PMU is implemented, MDCR_EL2.HLP, HDCR.HLP, and PMCR.LP control whether 
an overflow is detected from unsigned overflow of PMEVCNTR<n>[31:0] or unsigned overflow of 
PMEVCNTR<n>[63:0]. PMEVCNTR<n>[63:32] cannot be accessed directly in AArch32 state. 


This field resets to an architecturally UNKNOWN value. 
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Accessing the PMOVSR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 0b1001 Ob1100 Ob011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMOVSR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMOVSR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMOVSR; 
elsif PSTATE.EL == EL3 then 
return PMOVSR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1001 Ob1100 Ob011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





PMOVSR = R[t]; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





PMOVSR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMOVSR = R[t]; 
elsif PSTATE.EL == EL3 then 
PMOVSR = R[t]; 
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G8.4.15 PMOVSSET, Performance Monitors Overflow Flag Status Set register 


The PMOVSSET characteristics are: 


Purpose 
Sets the state of the overflow bit for the Cycle Count Register, PMCCNTR, and each of the 
implemented event counters PMEVCNTR<n>. 

Configurations 
AArch32 System register PMOVSSET[3 1:0] is architecturally mapped to AArch64 System register 
PMOVSSET_ELO[31:0]. 
AArch32 System register PMOVSSET[31:0] is architecturally mapped to External register 
PMOVSSET_ELO0[31:0]. 
This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 


PMOVSSET is a 32-bit register. 


Field descriptions 


The PMOVSSET bit assignments are: 


31 30 0 
C, bit [31] 


Cycle counter overflow set bit. 


Qbd When read, means the cycle counter has not overflowed since this bit was last cleared. 
When written, has no effect. 


Qb1 When read, means the cycle counter has overflowed since this bit was last cleared. 
When written, sets the cycle counter overflow bit to 1. 


PMCR.LC controls whether an overflow is detected from unsigned overflow of PMCCNTR[31:0] 
or unsigned overflow of PMCCNTR[63:0]. 


This field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter overflow set bit for PMEVCNTR<n>. 


If N is less than 31, then bits [30:N] are RAZ/WI. When EL2 is implemented and enabled in the 
current Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN if EL2 is using 
AArch64, or in HDCR.HPMN if EL2 is using AArch32. Otherwise, N is the value in PMCR.N. 


Oba When read, means that PMEVCNTR<n> has not overflowed since this bit was last 
cleared. When written, has no effect. 


Qb1 When read, means that PMEVCNTR<n> has overflowed since this bit was last . When 
written, sets the PMEVCNTR<n> overflow bit to 1. 


If ARMv8.5-PMU is implemented, MDCR_EL2.HLP, HDCR.HLP, and PMCR.LP control whether 
an overflow is detected from unsigned overflow of PMEVCNTR<n>[31:0] or unsigned overflow of 
PMEVCNTR<n>[63:0]. PMEVCNTR<n>[63:32] cannot be accessed directly in AArch32 state. 


This field resets to an architecturally UNKNOWN value. 
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Accessing the PMOVSSET 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1001 Ob1110 Ob011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMOVSSET; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMOVSSET; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMOVSSET; 
elsif PSTATE.EL == EL3 then 
return PMOVSSET; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1001 Ob1110 Ob011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMOVSSET = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMOVSSET = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMOVSSET = R[t]; 
elsif PSTATE.EL == EL3 then 
PMOVSSET = R[t]; 
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G8.4.16 PMSELR, Performance Monitors Event Counter Selection Register 
The PMSELR characteristics are: 


Purpose 
Selects the current event counter PMEVCNTR<n> or the cycle counter, CCNT. 


PMSELR is used in conjunction with PMXEVTYPER to determine the event that increments a 
selected event counter, and the modes and states in which the selected counter increments. 


It is also used in conjunction with PMXEVCNTR, to determine the value of a selected event 
counter. 


Configurations 


AArch32 System register PMSELR[31:0] is architecturally mapped to AArch64 System register 
PMSELR_ELO[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 


Attributes 
PMSELR is a 32-bit register. 


Field descriptions 


The PMSELR bit assignments are: 


31 5 4 0 
RESO SEL 
Bits [31:5] 


Reserved, RESO. 


SEL, bits [4:0] 
Selects event counter, PMEVCNTR<n>, where n is the value held in this field. This value identifies 
which event counter is accessed when a subsequent access to PMXEVTYPER or PMXEVCNTR 


occurs. 
This field can take any value from 0 (@b00000) to (PMCR.N)-1, or 31 (0b11111). 
When PMSELR.SEL is 0b11111, it selects the cycle counter and: 

° A read of the PMXEVTYPER returns the value of PMCCFILTR. 

° A write of the PMXEVTYPER writes to PMCCFILTR. 


. A read or write of PMXEVCNTR has CONSTRAINED UNPREDICTABLE effects. See 
PMXEVCNTR for more details. 


If this field is set to a value greater than or equal to the number of counters accessible at the current 
Exception level, but not equal to 31: 


. Direct reads of this field return an UNKNOWN value. 


° The results of access to PMXEVTYPER or PMXEVCNTR are CONSTRAINED 
UNPREDICTABLE. See PMXEVTYPER or PMXEVCNTR for more details. 


For information about the number of counters accessible at each Exception level, see HDCR.HPMN 
and MDCR_EL2.HPMN. 


This field resets to an architecturally UNKNOWN value. 
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Accessing the PMSELR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1001 Ob1100 0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<ER,EN> == 'Q@Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.<ER,EN> == 'QQ' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 








else 





return PMSELR; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





return PMSELR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMSELR; 
elsif PSTATE.EL == EL3 then 
return PMSELR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1001 Ob1100 0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.<ER,EN> == '00' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.<ER,EN> == 'QQ@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





PMSELR = R[t]; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





PMSELR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMSELR = R[t]; 
elsif PSTATE.EL == EL3 then 
PMSELR = R[t]; 
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G8.4.17 PMSWINC, Performance Monitors Software Increment register 


The PMSWINC characteristics are: 


Purpose 


Increments a counter that is configured to count the Software increment event, event 0x00. For more 
information, see SW_INCR. 


Configurations 


AArch32 System register PMS WINC{[3 1:0] is architecturally mapped to AArch64 System register 
PMSWINC_ELO[31:0]. 


AArch32 System register PMSWINC[3 1:0] is architecturally mapped to External register 
PMSWINC_ELO[31:0]. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
PMSWINC is a 32-bit register. 


Field descriptions 


The PMSWINC bit assignments are: 


31 30 0 


i P<n>, bit [n] 


RESO = 


ARM DDI 0487E.a 
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Bit [31] 


Reserved, RESO. 


P<n>, bit [n], for n = 0 to 30 
Event counter software increment bit for PMEVCNTR<n>. 


If N is less than 31, then bits [30:N] are WI. When EL2 is implemented and enabled in the current 
Security state, in EL1 and ELO, N is the value in MDCR_EL2.HPMN if EL2 is using AArch64, or 
in HDCR.HPMN if EL2 is using AArch32. Otherwise, N is the value in PMCR.N. 


Ob No action. The write to this bit is ignored. 


Qb1 If PMEVCNTR<n> is enabled and configured to count the software increment event, 
increments PMEVCNTR<n> by 1. If PMEVCNTR<n> is disabled, or not configured to 
count the software increment event, the write to this bit is ignored. 


Accessing the PMSWINC 


Accesses to this register use the following encodings in the System instruction encoding space: 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1001 0b1100 0b100 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<SW,EN> == 'QQ' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
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AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 

elsif ELUsingAArch32(EL1) && PMUSERENR.<SW,EN> == 'QQ' then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 

else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMSWINC = R[t]; 








elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
PMSWINC = R[t]; 


elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
PMSWINC = R[t]; 


elsif PSTATE.EL == EL3 then 


PMSWINC = R[t]; 
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G8.4.18 PMUSERENR, Performance Monitors User Enable Register 
The PMUSERENR characteristics are: 


Purpose 


Enables or disables User mode access to the Performance Monitors. 


Configurations 


AArch32 System register PMUSERENR{[3 1:0] is architecturally mapped to AArch64 System 
register PMUSERENR_ELO[31:0]. 


This register is in the Warm reset domain. Some or all RW fields of this register have defined reset 
values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is 
using AArch32. Otherwise, on a Warm or Cold reset RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
PMUSERENR is a 32-bit register. 


Field descriptions 


The PMUSERENR bit assignments are: 


CR 
ER 
Bits [31:4] 
Reserved, RESO. 
ER, bit [3] 
Event counter read trap control: 
Obd ELO reads of the PMXEVCNTR and PMEVCNTR<n>, and ELO RW access to the 
PMSELR, are trapped to Undefined mode if PMUSERENR.EN is also 0. 
Qb1 Overrides PMUSERENR.EN and enables RO access to PMXEVCNTR and 
PMEVCNTR<n>, and RW access to PMSELR. 
On a Warm reset, this field resets to 0. 
CR, bit [2] 
Cycle counter read trap control: 
Qbd ELO reads of the PMCCNTR are trapped to Undefined mode if PMUSERENR.EN is 
also 0. 
Qb1 Overrides PMUSERENR.EN and enables access to PMCCNTR. 
On a Warm reset, this field resets to 0. 
SW, bit [1] 
Software increment write trap control: 
Qbd ELO writes to the PMSWINC are trapped to Undefined mode if PMUSERENR.EN is 
also 0. 
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Qb1 Overrides PMUSERENR.EN and enables access to PMSWINC. 


On a Warm reset, this field resets to 0. 
EN, bit [0] 
Traps ELO accesses to the Performance Monitors registers to Undefined mode: 


Qbd While at ELO, PMUSERENR is always RO. Accesses to the other Performance 
Monitors registers are trapped to Undefined mode, unless enabled by one of 
PMUSERENR. {ER, CR, SW}. 


Qb1 While at ELO, software can access all PMU registers except PMINTENSET and 
PMINTENCLR. 


On a Warm reset, this field resets to 0. 


Accessing the PMUSERENR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b1001 0b1110 0b000 





if PSTATE.EL == EL@ then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMUSERENR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMUSERENR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMUSERENR; 
elsif PSTATE.EL == EL3 then 
return PMUSERENR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1001 0b1110 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMUSERENR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMUSERENR = R[t]; 
elsif PSTATE.EL == EL3 then 
PMUSERENR = R[t]; 
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PMXEVCNTR, Performance Monitors Selected Event Count Register 


The PMXEVCNTR characteristics are: 


Purpose 
Reads or writes the value of the selected event counter, PMEVCNTR<n>. PMSELR.SEL 


determines which event counter is selected. 


Configurations 


AArch32 System register PMXEVCNTRJ[3 1:0] is architecturally mapped to AArch64 System 
register PMXEVCNTR_ELO[31:0]. 


This register is in the Warm reset domain. On a Warm or Cold reset RW fields in this register reset 
to architecturally UNKNOWN values. 

Attributes 
PMXEVCNTR is a 32-bit register. 


Field descriptions 


The PMXEVCNTR bit assignments are: 


31 0 


PMEVCNTR<n> 


PMEVCNTR<n>, bits [31:0] 
Value of the selected event counter, PMEVCNTR<n>, where n is the value stored in PMSELR.SEL. 


If ARMv8.5-PMU is implemented, the event counter is 64 bits and only the least-significant part of 
the event counter is accessible in AArch32 state: 


à Reads from PMXEVCNTR return bits [31:0] of the counter. 
$ Writes to PMXEVCNTR update bits [31:0] and leave bits [63:32] unchanged. 
. There is no means to access bits [63:32] directly from AArch32 state. 


à If the implementation does not support AArch64 at any Exception level, bits [63:32] are not 
required to be implemented. 


If ARMv8.5-PMU is not implemented, the event counter is 32 bits. 


This field resets to an architecturally UNKNOWN value. 


Accessing the PMXEVCNTR 


If PMSELR.SEL is greater than or equal to the number of accessible counters then reads and writes of 
PMXEVCNTR are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


è Accesses to the register are UNDEFINED. 
° Accesses to the register behave as RAZ/WI. 
. Accesses to the register execute as a NOP 


° Accesses to the register behave as if PMSELR.SEL has an UNKNOWN value less than the number of counters 
accessible at the current Exception level and Security state. 


s If EL2 is implemented and enabled in the current Security state, and PMSELR.SEL is less than the number 
of implemented counters, accesses from EL1 or permitted accesses from ELO are trapped to EL2. 
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Note 





In ELO, an access is permitted if it is enabled by PMUSERENR. {ER,EN} or PMUSERENR_ELO. {ER,EN}. 


If EL2 is implemented and enabled in the current Security state, at ELO and EL1: 
° If EL2 is using AArch32, HDCR.HPMN identifies the number of accessible counters. 


° If EL2 is using AArch64, MDCR_EL2.HPMN identifies the number of accessible counters. 


Otherwise, the number of accessible counters is the number of implemented counters. See HDCR.HPMN and 


MDCR_EL2.HPMN for more details. 





Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





Ob1111 0b000 0b1001 O0b1101 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.<ER,EN> == 'QQ' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.<ER,EN> == 'QQ' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


0b010 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
return PMXEVCNTR; 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
return PMXEVCNTR; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
return PMXEVCNTR; 
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elsif PSTATE.EL == EL3 then 
return PMXEVCNTR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b1001 Ob1101 0b010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 








else 
PMXEVCNTR = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMXEVCNTR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMXEVCNTR = R[t]; 
elsif PSTATE.EL == EL3 then 
PMXEVCNTR = R[t]; 
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The PMXEVTYPER characteristics are: 


Purpose 


When PMSELR.SEL selects an event counter, this accesses a PMEVTYPER<n> register. When 
PMSELR.SEL selects the cycle counter, this accesses PMCCFILTR. 


Configurations 


AArch32 System register PMXEVTYPER[3 1:0] is architecturally mapped to AArch64 System 
register PMXEVTYPER_ ELO[31:0]. 


When the value of PMSELR.SEL is 31, to select the cycle counter, RW fields in this register have 
defined reset values that apply only when the PE resets into an Exception level that is using 
AArch32. See PMCCFILTR for the reset values. 


Otherwise, RW fields in this register reset to IMPLEMENTATION DEFINED values that might be 
UNKNOWN. This applies whenever PMSELR.SEL selects an event counter. 


Attributes 
PMXEVTYPER is a 32-bit register. 


Field descriptions 


The PMXEVTYPER bit assignments are: 


31 0 
Event type register or PMCCFILTR 
Bits [31:0] 


Event type register or PMCCFILTR. 
When PMSELR.SEL == 31, this register accesses PMCCFILTR. 
Otherwise, this register accesses PMEVTYPER<n> where n is the value in PMSELR.SEL. 


Accessing the PMXEVTYPER 


If PMSELR.SEL is not 31, and is greater than or equal to the number of accessible counters then reads and writes 
of PMXEVTYPER are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


è Accesses to the register are UNDEFINED. 
. Accesses to the register behave as RAZ/WI. 
. Accesses to the register execute as a NOP 


° Accesses to the register behave as if PMSELR.SEL has an UNKNOWN value less than the number of counters 
accessible at the current Exception level and Security state. 


. Accesses to the register behave as if PMSELR.SEL is 31. 


G If EL2 is implemented and enabled in the current Security state, and PMSELR.SEL is less than the number 
of implemented counters, accesses from EL1 or permitted accesses from ELO are trapped to EL2. 


Note 
In ELO, an access is permitted if it is enabled by PMUSERENR.EN or PMUSERENR_ELO.EN. 
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If EL2 is implemented and enabled in the current Security state, at ELO and EL1: 
° If EL2 is using AArch32, HDCR.HPMN identifies the number of accessible counters. 


° If EL2 is using AArch64, MDCR_EL2.HPMN identifies the number of accessible counters. 


Otherwise, the number of accessible counters is the number of implemented counters. See HDCR.HPMN and 


MDCR_EL2.HPMN for more details. 





Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm 


opc2 





Ob1111 0b000 0b1001 0b1101 


0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
return PMXEVTYPER; 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





return PMXEVTYPER; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return PMXEVTYPER; 
elsif PSTATE.EL == EL3 then 
return PMXEVTYPER; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 0b1001 Ob1101 Ob001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && PMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && PMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(QxQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMXEVTYPER = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T9 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T9 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && MDCR_EL2.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HDCR.TPM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMXEVTYPER = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TPM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
PMXEVTYPER = R[t]; 
elsif PSTATE.EL == EL3 then 
PMXEVTYPER = R[t]; 
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G8.5 Activity Monitors registers 


This section lists the Activity Monitoring registers in AArch32. 
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G8.5.1 AMCFGR, Activity Monitors Configuration Register 


The AMCFGR characteristics are: 


ARM DDI 0487E.a 
ID070919 


Purpose 


Global configuration register for the activity monitors. 


Provides information on supported features, the number of counter groups implemented, the total 
number of activity monitor event counters implemented, and the size of the counters. AMCFGR is 
applicable to both the architected and the auxiliary counter groups. 


Configurations 


Attributes 


AArch32 System register AMCFGR[3 1:0] is architecturally mapped to AArch64 System register 
AMCFGR_ ELO[31:0]. 


AArch32 System register AMCFGR[31:0] is architecturally mapped to External register 
AMCFGR{[31:0]. 


This register is present only when AMUV1 is implemented. Otherwise, direct accesses to AMCFGR 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


AMCFGR is a 32-bit register. 


Field descriptions 


The AMCFGR bit assignments are: 


31 28 27 


25 24 23 14 13 8 7 0 


HDBG es 


NCG, bits [31:28] 


Bits [27:25] 


Defines the number of counter groups. 
The number of implemented counter groups is defined as [AMCFGR.NCG + 1]. 


If the number of implemented auxiliary activity monitor event counters is zero, this field has a value 
of @b0000. Otherwise, this field has a value of @b0001. 


Reserved, RESO. 


HDBG, bit [24] 


Bits [23:14] 


Halt-on-debug supported. 

From Armvé8, this feature must be supported, and so this bit is 0b1. 
Qbe AMCR.HDBG is RESO. 

Qb1 AMCR.HDBG is read/write. 


Reserved, RAZ. 


SIZE, bits [13:8] 


Defines the size of activity monitor event counters. 
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The size of the activity monitor event counters implemented by the Activity Monitors Extension is 
defined as [AMCFGR.SIZE + 1]. 


From Armv8, the counters are 64-bit, and so this field is @b111111. 





Note 


Software also uses this field to determine the spacing of counters in the memory-map. From Armv8, 
the counters are at doubleword-aligned addresses. 





N, bits [7:0] 


Defines the number of activity monitor event counters. 


The total number of counters implemented in all groups by the Activity Monitors Extension is 
defined as [AMCFGR.N + 1]. 


Accessing the AMCFGR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1101 O0b0010 Ob001 





if PSTATE.EL == EL@ then 


if | 


ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


else 


AArch64.AArch32SystemAccessTrap(EL1, 0x03); 


elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 


AArch32.TakeHypTrapException(0xQQ) ; 


else 


UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 





elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 


return AMCFGR; 


elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
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AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 


return AMCFGR; 
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elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCFGR; 
elsif PSTATE.EL == EL3 then 
return AMCFGR; 
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AMCGCR, Activity Monitors Counter Group Configuration Register 


The AMCGCR characteristics are: 


Purpose 
Provides information on the number of activity monitor event counters implemented within each 
counter group. 


Configurations 


AArch32 System register AMCGCR[31:0] is architecturally mapped to AArch64 System register 
AMCGCR_ELO[31:0]. 


AArch32 System register AMCGCRJ[31:0] is architecturally mapped to External register 
AMCGCRJB 1:0]. 


This register is present only when AMUV!1 is implemented. Otherwise, direct accesses to AMCGCR 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMCGCR is a 32-bit register. 


Field descriptions 


The AMCGCR bit assignments are: 


31 16 15 87 0 
RESO CG1NC CGONC 
Bits [31:16] 


Reserved, RESO. 


CGINC, bits [15:8] 
Counter Group 1 Number of Counters. The number of counters in the auxiliary counter group. 


In AMUv1, the permitted range of values is 0 to 16. 


CGONC, bits [7:0] 
Counter Group 0 Number of Counters. The number of counters in the architected counter group. 


In AMUV1I, the value of this field is 4. 


Accessing the AMCGCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1101 0b0010 0b010 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
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AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 

else 
UNDEFINED; 


G8.5 Activity Monitors registers 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
return AMCGCR; 





elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
return AMCGCR; 


elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
return AMCGCR; 


elsif PSTATE.EL == EL3 then 


return AMCGCR; 
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G8.5.3 AMCNTENCLRO, Activity Monitors Count Enable Clear Register 0 
The AMCNTENCLRO characteristics are: 


Purpose 
Disable control bits for the architected activity monitors event counters, AMEVCNTRO<n>. 


Configurations 


AArch32 System register AMCNTENCLRO[3 1:0] is architecturally mapped to AArch64 System 
register AMCNTENCLRO_EL0[31:0]. 


AArch32 System register AMCNTENCLRO[3 1:0] is architecturally mapped to External register 
AMCNTENCLRO[31:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENCLRO are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMCNTENCLRO is a 32-bit register. 


Field descriptions 


The AMCNTENCLRO bit assignments are: 


31 1615 0 


RESO P<n>, bit [n] 


Bits [31:16] 
Reserved, RESO. 
P<n>, bit [n], for n = 0 to 15 
Activity monitor event counter disable bit for AMEVCNTRO<n>. 
Bits [31:16] are RESO. Bits [15:N] are RAZ/WI. N is the value in AMCGCR.CGONC. 


Possible values of each bit are: 


ObO When read, means that AMEVCNTRO<n> is disabled. When written, has no effect. 
0b1 When read, means that AMEVCNTRO<n> is enabled. When written, disables 
AMEVCNTRO<n>. 


On a Cold reset, this field resets to 0. 


Accessing the AMCNTENCLRO 


Accesses to this register use the following encodings in the System instruction encoding space: 


G8-6548 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch32 System Register Descriptions 
G8.5 Activity Monitors registers 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b000 = 0b1101 0b0010 


opc2 


0b100 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENCLRO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENCLRO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENCLRO; 
elsif PSTATE.EL == EL3 then 
return AMCNTENCLROQ; 








MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif PSTATE.EL == EL1 && EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif IsHighestEL(PSTATE.EL) then 


coproc opct CRn CRm opc2 
Ob1111 0b000 O0b1101 0b0010 O0b100 
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AMCNTENCLRO = R[t]; 
else 
UNDEFINED; 
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The AMCNTENCLR|I characteristics are: 


Purpose 


Disable control bits for the auxiliary activity monitors event counters, AMEVCNTRI<n>. 


Configurations 


AArch32 System register AMCNTENCLR1[31:0] is architecturally mapped to AArch64 System 
register AMCNTENCLR1_EL0[31:0]. 


AArch32 System register AMCNTENCLR1[3 1:0] is architecturally mapped to External register 
AMCNTENCLR1[31:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENCLRI are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMCNTENCLR1 is a 32-bit register. 


Field descriptions 


The AMCNTENCLR1 bit assignments are: 


31 1615 0 


RESO P<n>, bit [n] 


Bits [31:16] 
Reserved, RESO. 
P<n>, bit [n], for n = 0 to 15 
Activity monitor event counter disable bit for AMEVCNTRI<n>. 
Bits [31:16] are RESO. Bits [15:N] are RAZ/WI. N is the value in AMCGCR_ELO.CGINC. 


Possible values of each bit are: 


ObO When read, means that AMEVCNTR1<n> is disabled. When written, has no effect. 
0b1 When read, means that AMEVCNTRI<n> is enabled. When written, disables 
AMEVCNTRI<n>. 


On a Cold reset, this field resets to 0. 


Accessing the AMCNTENCLR1 


If the number of auxiliary activity monitor event counters implemented is zero, reads and writes of 
AMCNTENCLRI are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 
. Accesses to the register behave as RAZ/WI. 


. Accesses to the register execute as a NOP. 
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G8-6552 


Note 





The number of auxiliary activity monitor event counters implemented is zero exactly when AMCFGR.NCG == 


0b0000. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 0b1101 Ob0011 


0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENCLR1; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENCLR1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENCLR1; 
elsif PSTATE.EL == EL3 then 
return AMCNTENCLR1; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1101 Ob0011 0b000 





if PSTATE.EL == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif PSTATE.EL == EL1 && EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif IsHighestEL(PSTATE.EL) then 
AMCNTENCLR1 = R[t]; 

else 
UNDEFINED; 
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G8.5.5 AMCNTENSETO, Activity Monitors Count Enable Set Register 0 
The AMCNTENSETO0 characteristics are: 


Purpose 
Enable control bits for the architected activity monitors event counters, AMEVCNTRO<n>. 


Configurations 


AArch32 System register AMCNTENSETO[3 1:0] is architecturally mapped to AArch64 System 
register AMCNTENSETO0_ELO[31:0]. 


AArch32 System register AMCNTENSETO[3 1:0] is architecturally mapped to External register 
AMCNTENSETO[3 1:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENSETO are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMCNTENSETO is a 32-bit register. 


Field descriptions 


The AMCNTENSETO0 bit assignments are: 


31 1615 0 


RESO P<n>, bit [n] 


Bits [31:16] 
Reserved, RESO. 
P<n>, bit [n], for n = 0 to 15 
Activity monitor event counter enable bit for AMEVCNTRO<n>. 
Bits [31:16] are RESO. Bits [15:N] are RAZ/WI. N is the value in AMCGCR.CGONC. 


Possible values of each bit are: 


ObO When read, means that AMEVCNTRO<n> is disabled. When written, has no effect. 
0b1 When read, means that AMEVCNTRO<n> is enabled. When written, enables 
AMEVCNTRO<n>. 


On a Cold reset, this field resets to 0. 


Accessing the AMCNTENSETO 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


Ob1111 0b000 = 0b1101 0b0010 


opc2 


0b101 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_ELO.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENSETO; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENSETO; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENSETO; 
elsif PSTATE.EL == EL3 then 
return AMCNTENSETO; 








MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 











if PSTATE.EL == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif PSTATE.EL == EL1 && EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif IsHighestEL(PSTATE.EL) then 


coproc opct CRn CRm opc2 
Ob1111 0b000 0b1101 Ob0010 0b101 
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AMCNTENSETO = R[t]; 
else 
UNDEFINED; 
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G8.5.6 AMCNTENSET1, Activity Monitors Count Enable Set Register 1 
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The AMCNTENSET]I characteristics are: 


Purpose 


Enable control bits for the auxiliary activity monitors event counters, AMEVCNTRI<n>. 


Configurations 


AArch32 System register AMCNTENSET1[31:0] is architecturally mapped to AArch64 System 
register AMCNTENSET1_ELO0[31:0]. 


AArch32 System register AMCNTENSET1[31:0] is architecturally mapped to External register 
AMCNTENSET1[31:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENSET1 are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMCNTENSET1 is a 32-bit register. 


Field descriptions 


The AMCNTENSET1 bit assignments are: 


31 1615 0 


RESO P<n>, bit [n] 


Bits [31:16] 
Reserved, RESO. 
P<n>, bit [n], for n = 0 to 15 
Activity monitor event counter enable bit for AMEVCNTRI1<n>. 
Bits [31:16] are RESO. Bits [15:N] are RAZ/WI. N is the value in AMCGCR.CGINC. 


Possible values of each bit are: 


ObO When read, means that AMEVCNTR1<n> is disabled. When written, has no effect. 
0b1 When read, means that AMEVCNTRI<n> is enabled. When written, enables 
AMEVCNTRI<n>. 


On a Cold reset, this field resets to 0. 


Accessing the AMCNTENSET1 


If the number of auxiliary activity monitor event counters implemented is zero, reads and writes of 
AMCNTENSETI are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 
. Accesses to the register behave as RAZ/WI. 


. Accesses to the register execute as a NOP. 
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Note 
The number of auxiliary activity monitor counters implemented is zero when AMCFGR.NCG == 060000. 








Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b1101 Ob0011 Ob001 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENSET1; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENSET1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCNTENSET1; 
elsif PSTATE.EL == EL3 then 
return AMCNTENSET1; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1101 Ob0011 Ob001 





if PSTATE.EL == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif PSTATE.EL == EL1 && EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(0xQ3) ; 

elsif IsHighestEL(PSTATE.EL) then 
AMCNTENSET1 = R[t]; 

else 
UNDEFINED; 
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G8.5.7 


G8-6560 


AMCR, Activity Monitors Control Register 


The AMCR characteristics are: 


Purpose 


Global control register for the activity monitors implementation. AMCR is applicable to both the 
architected and the auxiliary counter groups. 


Configurations 
AArch32 System register AMCR[31:0] is architecturally mapped to AArch64 System register 
AMCR_ELO[31:0]. 
AArch32 System register AMCR[31:0] is architecturally mapped to External register AMCR[3 1:0]. 


This register is present only when AMUV1 is implemented. Otherwise, direct accesses to AMCR 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMCR is a 32-bit register. 


Field descriptions 


The AMCR bit assignments are: 


Bits [31:11] 


Reserved, RESO. 


HDBG, bit [10] 
This bit controls whether activity monitor counting is halted when the PE is halted in Debug state. 
Qbd Activity monitors do not halt counting when the PE is halted in Debug state. 
Qb1 Activity monitors halt counting when the PE is halted in Debug state. 


Bits [9:0] 


Reserved, RESO. 


Accessing the AMCR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1101 0b0010 0b000 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
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else 

AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 

else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMCR; 
elsif PSTATE.EL == EL3 then 
return AMCR; 








MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b1101 0b0010 


0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
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elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
AMCR = R[t]; 


elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
AMCR = R[t]; 





elsif PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
AMCR = R[t]; 


elsif PSTATE.EL == EL3 then 


AMCR = R[t]; 
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G8.5.8 AMEVCNTRO<n>, Activity Monitors Event Counter Registers 0, n = 0 - 15 


63 
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The AMEVCNTRO<n> characteristics are: 


Purpose 


Provides access to the architected activity monitor event counters. 


Configurations 


AArch32 System register AMEVCNTRO<n>[63:0] is architecturally mapped to AArch64 System 
register AMEVCNTRO<n>_ELO[63:0]. 


AArch32 System register AMEVCNTRO<n>[63:0] is architecturally mapped to External register 
AMEVCNTRO<n>[63:0]. 


This register is present only when AMUVI1 is implemented. Otherwise, direct accesses to 
AMEVCNTRO<n> are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMEVCNTRO<n> is a 64-bit register. 


Field descriptions 


The AMEVCNTRO<n> bit assignments are: 


ACNT 


ACNT, bits [63:0] 
Architected activity monitor event counter n. 


Value of architected activity monitor event counter n, where n is the number of this register and is 
a number from 0 to 15. 


If the counter is enabled, writes to this register have UNPREDICTABLE results. 
On a Cold reset, this field resets to 0. 


Accessing the AMEVCNTRO<n> 


If <n> is greater than or equal to the number of architected activity monitor event counters, reads and writes of 
AMEVCNTRO<n> are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 
è Accesses to the register behave as RAZ/WI. 


° Accesses to the register execute as a NOP. 


Note 
AMCGCR.CGONC identifies the number of architected activity monitor event counters. 








Accesses to this register use the following encodings in the System instruction encoding space: 
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MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 


0b1111 0b000:n[3] ObO:n[2:0] 





if CRm == @ then 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
Isif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T@ == '1' 


om 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(0x04) ; 

Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(0x04) ; 

Isif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 


fo 


fo} 


om 


om 





else 

return AMEVCNTRO[UInt(CRm<Q>:opcl<2:0>)]; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 

AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(0x04) ; 
Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(0x04) ; 
Isif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 


fo} 


om 


om 


fo} 








else 
return AMEVCNTRO[UInt(CRm<Q>:opcl<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 
else 
return AMEVCNTRO[UInt (CRm<Q>:opcl<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return AMEVCNTRO[UInt(CRm<Q>:opc1<2:0>)]; 





else 
UNDEFINED; 
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MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 


Ob1111 — 0b000:n[3] — Ob0:n[2:0] 





if CRm == @ then 
if PSTATE.EL == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T@ == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif PSTATE.EL == EL1 && EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T@ == '1' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif IsHighestEL(PSTATE.EL) then 
AMEVCNTRO[UInt (CRm<@>:0pc1<2:@>)] = R[t2]:R[t]; 
else 
UNDEFINED; 
else 
UNDEFINED; 
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AMEVCNTR1<n>, Activity Monitors Event Counter Registers 1, n = 0 - 15 


The AMEVCNTRI1<n> characteristics are: 


Purpose 


Provides access to the auxiliary activity monitor event counters. 


Configurations 


AArch32 System register AMEVCNTR1<n>[63:0] is architecturally mapped to AArch64 System 
register AMEVCNTRI<n>_ELO[63:0]. 


AArch32 System register AMEVCNTR1<n>[63:0] is architecturally mapped to External register 
AMEVCNTRI<n>[63:0]. 


This register is present only when AMUVI1 is implemented. Otherwise, direct accesses to 
AMEVCNTRI1<n> are UNDEFINED. 


Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 


Attributes 
AMEVCNTRI<n> is a 64-bit register. 


Field descriptions 


The AMEVCNTRI1<n> bit assignments are: 


ACNT 


ACNT, bits [63:0] 
Auxiliary activity monitor event counter n. 


Value of auxiliary activity monitor event counter n, where n is the number of this register and is a 
number from 0 to 15. 


If the counter is enabled, writes to this register have UNPREDICTABLE results. 
On a Cold reset, this field resets to 0. 


Accessing the AMEVCNTR1<n> 


If <n> is greater than or equal to the number of auxiliary activity monitor event counters, reads and writes of 
AMEVCNTR1<n> are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 
è Accesses to the register behave as RAZ/WI. 


° Accesses to the register execute as a NOP. 


Note 
AMCGCR.CGINC identifies the number of auxiliary activity monitor event counters. 








Accesses to this register use the following encodings in the System instruction encoding space: 
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MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm 


Ob1111 — 0b010:n[3] 


opc1 


0b0:n[2:0] 





if CRm == 100 then 
if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
Isif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T4 


om 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T4 == '1' then 
AArch32.TakeHypTrapException(0x04) ; 

Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(0x04) ; 

Isif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 


fo 


fo} 


om 


om 





else 

return AMEVCNTR1[UInt(CRm<Q>:opcl<2:0>)]; 
elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T4 == '1' then 

AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T4 == '1' then 
AArch32.TakeHypTrapException(0x04) ; 
Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException( 0x04) ; 
lsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, x04); 


fo} 


om 


om 


fo} 








else 
return AMEVCNTR1[UInt(CRm<Q>:opcl<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, x04); 
else 
return AMEVCNTR1[UInt(CRm<Q>:opcl<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return AMEVCNTR1[UInt(CRm<Q>:opc1<2:0>)]; 
elsif CRm == 101 then 
if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 





else 

AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 

else 
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then 


elsi 


elsi 


elsi 


else 


UNDEFINED; 


om 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(0x04) ; 

Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(0x04) ; 

Isif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 


om 


om 


om 


fo) 





else 
return AMEVCNTR1[UInt(CRm<Q>:opcl<2:0>)]; 

f PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 

AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(0x04) ; 
Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(0x04) ; 
Isif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 


om 


om 


om 


fo) 





else 
return AMEVCNTR1[UInt (CRm<Q>:opcl<2:0>)]; 

f PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 

else 
return AMEVCNTR1[UInt(CRm<Q>:opcl<2:0>)]; 

f PSTATE.EL == EL3 then 

return AMEVCNTR1[UInt(CRm<Q>:opc1<2:0>)]; 





UNDEFINED; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


Isif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T5 == '1' 





coproc 


CRm opc1 





0b1111 


0b010:n[3]  Ob0:n[2:0] 





if CRm == 100 then 
if PSTATE.EL == EL@ then 


then 
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if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQ0Q) ; 
else 
UNDEFINED; 





om 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T4 == '1' then 
AArch32.TakeHypTrapException(0x04) ; 

Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 


om 


om 





om 
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AArch32.TakeHypTrapException(0x04) ; 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 


else 


elsif 


AArch64.AArch32SystemAccessTrap(EL3, 0x04); 


AMEVCNTR1[UInt (CRm<0>:opc1<2:@>)] = R[t2]:R[t]; 
PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T4 == '1' then 


om 


fo 


om 


om 


elsif 


el 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 





Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T4 == '1' then 


AArch32.TakeHypTrapException(0x04) ; 


Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 





AArch64.AArch32SystemAccessTrap(EL2, 0x04); 


Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 


AArch32.TakeHypTrapException(Qx04) ; 


Isif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x04); 





se 
AMEVCNTR1[UInt (CRm<0>:opc1<2:@>)] = R[t2]:R[t]; 
PSTATE.EL == EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 


else 


elsif 


AArch64.AArch32SystemAccessTrap(EL3, 0x04); 





AMEVCNTR1[UInt (CRm<0>:opc1<2:0>)] = R[t2]:R[t]; 
PSTATE.EL == EL3 then 





AMEVCNTR1[UInt (CRm<@>:0pc1<2:0>)] = R[t2]:R[t]; 


elsif CRm 


== 101 then 


if PSTATE.EL == EL@ then 


i 


e 


om 


then 


fo} 


om 


om 


om 


elsif 
i 


om 


om 


@m 


fo) 


elsif 
i 
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el 


el 


f !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
Isif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 





AArch64.AArch32SystemAccessTrap(EL2, x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 

AArch32.TakeHypTrapException(0x04) ; 

Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 

AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 

AArch32.TakeHypTrapException(0x04) ; 

Isif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 

se 





AMEVCNTR1[UInt (CRm<0>:opc1<2:0>)] = R[t2]:R[t]; 
PSTATE.EL == EL1 then 
f EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
Isif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(0x04) ; 
Isif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
Isif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(0x04) ; 
Isif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 
se 
AMEVCNTR1[UInt (CRm<0>:opc1<2:0>)] = R[t2]:R[t]; 
PSTATE.EL == EL2 then 
f HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x04); 
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else 
AMEVCNTR1[UInt (CRm<0>:opc1<2:0>)] = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 
AMEVCNTR1[UInt (CRm<@>:0pc1<2:@>)] = R[t2]:R[t]; 
else 
UNDEFINED; 
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G8.5.10 AMEVTYPERO<n>, Activity Monitors Event Type Registers 0, n =0-15 


ARM DDI 0487E.a 
ID070919 


The AMEVTYPERO<n> characteristics are: 


Purpose 
Provides information on the events that an architected activity monitor event counter 
AMEVCNTRO<n> counts. 

Configurations 


AArch32 System register AMEVTYPERO<n>[3 1:0] is architecturally mapped to AArch64 System 
register AMEVTYPERO<n>_EL0[31:0]. 


AArch32 System register AMEVTYPERO<n>[31:0] is architecturally mapped to External register 
AMEVTYPERO<n>[3 1:0]. 


This register is present only when AMUV1 is implemented. Otherwise, direct accesses to 
AMEVTYPERO<n> are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMEVTYPERO<n> is a 32-bit register. 


Field descriptions 


The AMEVTYPER(O<n> bit assignments are: 


31 1615 0 


Bits [31:16] 


Reserved, RESO. 


evtCount, bits [15:0] 


Event to count. The event number of the event that is counted by the architected activity monitor 
event counter AMEVCNTRO<n>. The value of this field is architecturally mandated for each 
architected counter. 


The following table shows the mapping between required event numbers and the corresponding 
counters: 


0x0011 When n == 0 Processor frequency cycles 
0x4004 When n == 1 Constant frequency cycles 
0x0008 When n == 2 Instructions retired 


0x4005 When n == 3 Memory stall cycles 


Accessing the AMEVTYPERO<n> 


If <n> is greater than or equal to the number of architected activity monitor event counters, reads and writes of 
AMEVTYPERO<n> are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


° Accesses to the register are UNDEFINED. 
$ Accesses to the register behave as RAZ/WI. 


. Accesses to the register execute as a NOP. 
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Note 
AMCGCR.CGONC identifies the number of architected activity monitor event counters. 








Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 + Ob1101 Ob011:n[3]  n[2:0] 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMEVTYPERO[UInt(CRm<Q>:opc2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMEVTYPERO[UInt(CRm<Q>:opc2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMEVTYPERO[UInt(CRm<Q>:opc2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return AMEVTYPERO[UInt(CRm<Q>:opc2<2:0>)]; 
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G8.5.11 AMEVTYPER(1<n>, Activity Monitors Event Type Registers 1, n =0-15 


ARM DDI 0487E.a 
ID070919 


The AMEVTYPER1<n> characteristics are: 


Purpose 
Provides information on the events that an auxiliary activity monitor event counter 
AMEVCNTRI<n> counts. 

Configurations 
AArch32 System register AMEVTYPER1<n>[3 1:0] is architecturally mapped to AArch64 System 
register AMEVTYPER1<n>_EL0[31:0]. 
AArch32 System register AMEVTYPER1<n>[31:0] is architecturally mapped to External register 
AMEVTYPER1<n>[31:0]. 
This register is present only when AMUVI1 is implemented. Otherwise, direct accesses to 
AMEVTYPER 1<n> are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


AMEVTYPER1<n> is a 32-bit register. 


Field descriptions 


The AMEVTYPER 1<n> bit assignments are: 


31 1615 0 


Bits [31:16] 
Reserved, RESO. 


evtCount, bits [15:0] 


Event to count. The event number of the event that is counted by the auxiliary activity monitor event 
counter AMEVCNTRI<n>. 


It is IMPLEMENTATION DEFINED what values are supported by each counter. 


If software writes a value to this field which is not supported by the corresponding counter 
AMEVCNTRI<n>, then: 


. It is UNPREDICTABLE which event will be counted. 
. The value read back is UNKNOWN. 


The event counted by AMEVCNTR1<n> might be fixed at implementation. In this case, the field 
is read-only and writes are UNDEFINED. 


If the corresponding counter AMEVCNTR1<n> is enabled, writes to this register have 
UNPREDICTABLE results. 


Accessing the AMEVTYPER1<n> 


If <n> is greater than or equal to the number of auxiliary activity monitor event counters, reads and writes of 
AMEVTYPER1<n> are CONSTRAINED UNPREDICTABLE, and the following behaviors are permitted: 


s Accesses to the register are UNDEFINED. 
. Accesses to the register behave as RAZ/WI. 


° Accesses to the register execute as a NOP. 
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Note 
AMCGCR.CGINC identifies the number of auxiliary activity monitor event counters. 








Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = Ob1101 Ob111:n[3] n[2:0] 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && AMUSERENR_EL@.EN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && AMUSERENR.EN == '@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMEVTYPER1[UInt(CRm<Q>:opc2<2:0>)]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMEVTYPER1[UInt(CRm<Q>:opc2<2:0>)]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMEVTYPER1[UInt(CRm<Q>:opc2<2:0>)]; 
elsif PSTATE.EL == EL3 then 
return AMEVTYPER1[UInt(CRm<Q>:opc2<2:0>)]; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 0b1101 0b111:n[3] n[2:0] 





if PSTATE.EL == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif PSTATE.EL == EL1 && EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(0xQ3) ; 

elsif IsHighestEL(PSTATE.EL) then 
AMEVTYPER1[UInt (CRm<0>:opc2<2:0>)] = R[t]; 

else 
UNDEFINED; 
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G8.5.12 


G8-6576 


AMUSERENR, Activity Monitors User Enable Register 


The AMUSERENR characteristics are: 


Purpose 


Global user enable register for the activity monitors. Enables or disables ELO access to the activity 
monitors. AMUSERENR is applicable to both the architected and the auxiliary counter groups. 


Configurations 
AArch32 System register AMUSERENRJ3 1:0] is architecturally mapped to AArch64 System 
register AMUSERENR_ELO[31:0]. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMUSERENR are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
AMUSERENR is a 32-bit register. 


Field descriptions 


The AMUSERENR bit assignments are: 


Bits [31:1] 
Reserved, RESO. 
EN, bit [0] 
Traps ELO accesses to the activity monitors registers to EL1. 
Qbd ELO accesses to the activity monitors registers are trapped to EL1. 
Qb1 This control does not cause any instructions to be trapped. Software can access all 


activity monitor registers at ELO. 


Note 
° AMUSERENR can always be read at ELO and is not governed by this bit. 








Accessing the AMUSERENR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b1101 O0b0010 Ob011 





if PSTATE.EL == EL@ then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
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elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMUSERENR; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMUSERENR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
return AMUSERENR; 
elsif PSTATE.EL == EL3 then 
return AMUSERENR; 





G8.5 Activity Monitors registers 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opc1 


CRn CRm opc2 





Ob1111 0b000 


0b1101 0b0010 Ob011 





if PSTATE.EL == EL@ then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> != '11' && HSTR_EL2.T13 == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

else 
AMUSERENR = R[t]; 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T13 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T13 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && CPTR_EL2.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCPTR.TAM == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 





else 





AMUSERENR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && CPTR_EL3.TAM == '1' then 
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AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
else 
AMUSERENR = R[t]; 
elsif PSTATE.EL == EL3 then 
AMUSERENR = R[t]; 
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G8.6 RAS registers 


This section lists the RAS Extension registers in AArch32. 
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G8.6.1 DISR, Deferred Interrupt Status Register 


G8-6580 


The DISR characteristics are: 


Purpose 


Records that an SError interrupt has been consumed by an ESB instruction. 


Configurations 


AArch32 System register DISR[31:0] is architecturally mapped to AArch64 System register 
DISR_EL1[31:0] when the highest implemented Exception level is using AArch64. 


This register is present only when RAS is implemented. Otherwise, direct accesses to DISR are 
UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
DISR is a 32-bit register. 


Field descriptions 


The DISR bit assignments are: 


When the ESB instruction is executed at EL2: 


31 30 1211109 8 6 


5 0 
RESO eer | RESO DFSC 


fs Sy 


A, bit [31] 


Set to 1 when an ESB instruction defers an asynchronous SError interrupt. If the implementation does 
not include any sources of SError interrupt that can be synchronized by an Error Synchronization 
Barrier, then this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 


Bits [30:12] 
Reserved, RESO. 
AET, bits [11:10] 
Asynchronous Error Type. See the description of HSR.AET for an SError interrupt. 


This field resets to an architecturally UNKNOWN value. 
EA, bit [9] 
External abort Type. See the description of HSR.EA for an SError interrupt. 


This field resets to an architecturally UNKNOWN value. 
Bits [8:6] 
Reserved, RESO. 
DFSC, bits [5:0] 
Fault Status Code. See the description of HSR.DFSC for an SError interrupt. 


This field resets to an architecturally UNKNOWN value. 
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When the ESB instruction is executed at ELO or EL1 and where TTBCR.EAE == 


31 30 16151413121110 9 8 


a RESO ee} 1] | | | RESO FS[3:0] 





A, bit [31] 


Set to 1 when an ESB instruction defers an asynchronous SError interrupt. If the implementation does 
not include any sources of SError interrupt that can be synchronized by an Error Synchronization 
Barrier, then this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 
Bits [30:16] 
Reserved, RESO. 
AET, bits [15:14] 
Asynchronous Error Type. See the description of DFSR.AET for an SError interrupt. 
This field resets to an architecturally UNKNOWN value. 
Bit [13] 
Reserved, RESO. 
ExT, bit [12] 
External abort Type. See the description of DFSR.ExT for an SError interrupt. 
This field resets to an architecturally UNKNOWN value. 
Bit [11] 
Reserved, RESO. 
FS[4], bit [10] 
This field is bit[4] of FS[4:0]. 
Fault Status Code. See the description of DFSR.FS for an SError interrupt. 
The FS field is split as follows: 
° FS[4] is DISR[10]. 
° FS[3:0] is DISR[3:0]. 
This field resets to an architecturally UNKNOWN value. 
LPAE, bit [9] 
Format. 
Qbd Using the Short-descriptor translation table format. 
This field resets to an architecturally UNKNOWN value. 
Bits [8:4] 


Reserved, RESO. 
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FS[3:0], bits [3:0] 
This field is bits[3:0] of FS[4:0]. 
See FS[4] for the field description. 


When the ESB instruction is executed at ELO or EL1 and where TTBCR.EAE == 


31 30 16151413121110 9 8 


RESO el] [| RESO STATUS 


A, bit [31] 


Set to 1 when an ESB instruction defers an asynchronous SError interrupt. If the implementation does 
not include any sources of SError interrupt that can be synchronized by an Error Synchronization 
Barrier, then this bit is RESO. 


This field resets to an architecturally UNKNOWN value. 
Bits [30:16] 
Reserved, RESO. 
AET, bits [15:14] 
Asynchronous Error Type. See the description of DFSR.AET for an SError interrupt. 
This field resets to an architecturally UNKNOWN value. 
Bit [13] 
Reserved, RESO. 
ExT, bit [12] 
External abort Type. See the description of DFSR.ExT for an SError interrupt. 
This field resets to an architecturally UNKNOWN value. 
Bits [11:10] 
Reserved, RESO. 
LPAE, bit [9] 
Format. 
Qb1 Using the Long-descriptor translation table format. 
This field resets to an architecturally UNKNOWN value. 
Bits [8:6] 
Reserved, RESO. 
STATUS, bits [5:0] 
Fault Status Code. See the description of DFSR.DFSC for an SError interrupt. 


This field resets to an architecturally UNKNOWN value. 
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Accessing the DISR 


An indirect write to DISR made by an ESB instruction does not require an explicit synchronization operation for the 
value that is written to be observed by a direct read of DISR occurring in program order after the ESB instruction. 


DISR is RAZ/WI if EL3 is implemented, the PE is in Non-debug state, and any of the following apply: 


: EL3 is using AArch64, SCR_EL3.EA == 1, and any of the following apply: 
— The PE is executing at EL2. 
— The PEis executing at EL1 and ((SCR_EL3.NS == 0 && SCR_EL3.EEL2 == 0) || HCR_EL2.AMO 


© EL3 is using AArch32, SCR.EA == 1, and any of the following apply: 
— The PE is executing at EL2. 
— The PE is executing at EL1 and (SCR.NS == 0 || HCR.AMO == 0). 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 = 0b1100 O0b0001 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AMO == '1' then 
return VDISR_EL2; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.AMO == '1' then 
return VDISR; 
else 
return DISR; 
elsif PSTATE.EL == EL2 then 
return DISR; 
elsif PSTATE.EL == EL3 then 
return DISR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1100 0b0001 0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AMO == '1' then 
VDISR_EL2 = R[t]; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.AMO == '1' then 
VDISR = R[t]; 
else 
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DISR = R[t]; 
elsif PSTATE.EL == EL2 then 
DISR = R[t]; 
elsif PSTATE.EL == EL3 then 
DISR = R[t]; 
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G8.6.2 ERRIDR, Error Record ID Register 


ARM DDI 0487E.a 
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The ERRIDR characteristics are: 


Purpose 
Defines the highest numbered index of the error records that can be accessed through the Error 
Record System registers. 


Configurations 
AArch32 System register ERRIDR[31:0] is architecturally mapped to AArch64 System register 
ERRIDR_EL1[31:0]. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRIDR are 
UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERRIDR is a 32-bit register. 


Field descriptions 


The ERRIDR bit assignments are: 


31 16 15 0 


RESO NUM 


Bits [31:16] 
Reserved, RESO. 
NUM, bits [15:0] 


Highest numbered index of the records that can be accessed through the Error Record System 
registers plus one. Zero indicates that no records can be accessed through the Error Record System 


registers. 


Each implemented record is owned by a node. A node might own multiple records. 


Accessing the ERRIDR 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 Ob0011 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
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elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
return ERRIDR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
return ERRIDR; 
elsif PSTATE.EL == EL3 then 
if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
return ERRIDR; 
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G8.6.3 ERRSELR, Error Record Select Register 
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The ERRSELR characteristics are: 


Purpose 
Selects an error record to be accessed through the Error Record System registers. 

Configurations 
AArch32 System register ERRSELR[31:0] is architecturally mapped to AArch64 System register 
ERRSELR_EL1[31:0]. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRSELR 
are UNDEFINED. 
If ERRIDR indicates that zero error records are implemented, then it is IMPLEMENTATION DEFINED 
whether ERRSELR is UNDEFINED or RESO. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ERRSELR is a 32-bit register. 


Field descriptions 


The ERRSELR bit assignments are: 


31 1615 0 


RESO SEL 


Bits [31:16] 


Reserved, RESO. 


SEL, bits [15:0] 
Selects the error record accessed through the ERX registers. 
If ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then all of the following 
apply: 
$ The value read back from ERRSELR.SEL is UNKNOWN. 
° One of the following occurs: 
— An UNKNOWN error record is selected. 
— The ERX* registers are RAZ/WI. 
—  ERX* register reads and writes are NOPs. 
—  ERX* register reads and writes are UNDEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the ERRSELR 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 

















coproc opct CRn CRm opc2 
0b1111 0b000 0b0101 Ob0011 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
return ERRSELR; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
return ERRSELR; 
elsif PSTATE.EL == EL3 then 
if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
return ERRSELR; 
MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
coproc opct CRn CRm opc2 
0b1111 0b000 0b0101 Ob0011 0b001 
if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException() ; 
else 
ERRSELR = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
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AArch32.TakeMonitorTrapException(); 

else 
ERRSELR = R[t]; 

elsif PSTATE.EL == EL3 then 

if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
ERRSELR = R[t]; 
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G8.6.4 
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ERXADDR, Selected Error Record Address Register 


The ERXADDR characteristics are: 


Purpose 
Accesses bits [31:0] of ERR<n>ADDR for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv8, for the Armv8-A architecture profile. 


Configurations 


AArch32 System register ERXADDR[31:0] is architecturally mapped to AArch64 System register 
ERXADDR_ EL1[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXADDR 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXADDR is a 32-bit register. 


Field descriptions 


The ERXADDR bit assignments are: 


31 0 
Bits [31:0] of ERR<n>ADDR. 
Bits [31:0] 


ERXADDR accesses bits [31:0] of ERR<n>ADDR, where n is the value in ERRSELR.SEL. 


Accessing the ERXADDR 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


° An UNKNOWN record is selected. 

° ERXADDR is RAZ/WI. 

e Direct reads and writes of ERXADDR are NOPs. 

° Direct reads and writes of ERXADDR are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 Ob011 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXADDR; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TER 
AArch32.TakeMonitorTrapException(); 

else 
return ERXADDR; 

elsif PSTATE.EL == EL3 then 

if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXADDR; 





== '1' then 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 Ob011 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enab1 


ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab1 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif HaveEL(E 


L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 


AArch32. 


else 
ERXADDR 
elsif PSTATE.EL 





TakeMonitorTrapException(); 


= R(t]; 
== EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64. 


AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 


AArch32. 
else 
ERXADDR 
elsif PSTATE.EL 
if PSTATE.M 
AArch32. 


TakeMonitorTrapException(); 


= R[t]; 

== EL3 then 

l= M32_Monitor && SCR.TERR == '1' then 
TakeMonitorTrapException(); 


else 
ERXADDR = R[t]; 
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ERXADDR2, Selected Error Record Address Register 2 


The ERX ADDR2 characteristics are: 


Purpose 
Accesses bits [63:32] of ERR<n>ADDR for the error record selected by ERRSELR.SEL. 
For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 

Configurations 
AArch32 System register ERXADDR2[3 1:0] is architecturally mapped to AArch64 System register 
ERXADDR_EL1[63:32]. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERXADDR2 
are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ERXADDR2 is a 32-bit register. 


Field descriptions 


The ERXADDR2? bit assignments are: 


31 0 
Bits [63:32] of ERR<n>ADDR. 
Bits [31:0] 


ERXADDR2? accesses bits [63:32] of ERR<n>ADDR, where n is the value in ERRSELR.SEL. 


Accessing the ERXADDR2 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


° An UNKNOWN record is selected. 

° ERXADDR2 is RAZ/WI. 

e Direct reads and writes of ERXADDR2 are NOPs. 

° Direct reads and writes of ERXADDR2 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 0b111 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXADDR2; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TER 
AArch32.TakeMonitorTrapException(); 

else 
return ERXADDR2; 

elsif PSTATE.EL == EL3 then 

if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXADDR2; 





== '1' then 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





0b1111 0b000 = 0b0101 0b0100 0b111 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
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AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab1 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TER 


== '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 





AArch32.TakeMonitorTrapException(); 
else 
ERXADDR2 = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
ERXADDR2 = R[t]; 
elsif PSTATE.EL == EL3 then 
if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
ERXADDR2 = R[t]; 
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G8-6594 


The ERXCTLR characteristics are: 


Purpose 
Accesses bits [31:0] of ERR<n>CTLR for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


AArch32 System register ERXCTLR[31:0] is architecturally mapped to AArch64 System register 
ERXCTLR_EL1[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXCTLR 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXCTLR is a 32-bit register. 


Field descriptions 


The ERXCTLR bit assignments are: 


31 0 
Bits [31:0] of ERR<n>CTLR 
Bits [31:0] 


ERXCTLR accesses bits [31:0] of ERR<n>CTLR, where n is the value in ERRSELR.SEL. 


Accessing the ERXCTLR 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


° An UNKNOWN record is selected. 

° ERXCTLR is RAZ/WI. 

e Direct reads and writes of ERXCTLR are NOPs. 

° Direct reads and writes of ERXCTLR are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 Ob001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXCTLR; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TER 
AArch32.TakeMonitorTrapException(); 

else 
return ERXCTLR; 

elsif PSTATE.EL == EL3 then 

if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXCTLR; 





== '1' then 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 0b001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enab1 


ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab1 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif HaveEL(E 


L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 


AArch32. 


else 
ERXCTLR 
elsif PSTATE.EL 





TakeMonitorTrapException(); 


= R[t]; 
== EL2 then 


if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64. 


AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 


AArch32. 

else 
ERXCTLR 
elsif PSTATE.EL 
if PSTATE.M 
AArch32. 


TakeMonitorTrapException(); 


= R[t]; 

== EL3 then 

!= M32_Monitor && SCR.TERR == '1' then 
TakeMonitorTrapException(); 


else 
ERXCTLR = R[t]; 
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G8.6.7 


G8-6596 


ERXCTLR2, Selected Error Record Control Register 2 


The ERXCTLR2 characteristics are: 


Purpose 
Accesses bits [63:32] of ERR<n>CTLR for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


AArch32 System register ERXCTLR2[3 1:0] is architecturally mapped to AArch64 System register 
ERXCTLR_EL1[63:32]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXCTLR2 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXCTLR2 is a 32-bit register. 


Field descriptions 


The ERXCTLR2 bit assignments are: 


31 0 
Bits [63:32] of ERR<n>CTLR 
Bits [31:0] 


ERXCTLR2 accesses bits [63:32] of ERR<n>CTLR, where n is the value in ERRSELR.SEL. 


Accessing the ERXCTLR2 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


° An UNKNOWN record is selected. 

° ERXCTLR2 is RAZ/WI. 

e Direct reads and writes of ERXCTLR2 are NOPs. 

° Direct reads and writes of ERXCTLR2 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 0b101 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXCTLR2; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TER 
AArch32.TakeMonitorTrapException(); 

else 
return ERXCTLR2; 

elsif PSTATE.EL == EL3 then 

if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXCTLR2; 





== '1' then 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 0b101 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enab1 


ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab1 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif HaveEL(E 


L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 





AArch32.TakeMonitorTrapException(); 
else 
ERXCTLR2 = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
ERXCTLR2 = R[t]; 
elsif PSTATE.EL == EL3 then 
if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
ERXCTLR2 = R[t]; 
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G8.6.8 ERXFR, Selected Error Record Feature Register 


G8-6598 


The ERXFR characteristics are: 


Purpose 
Accesses bits [31:0] of ERR<n>FR for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 
AArch32 System register ERXFR[31:0] is architecturally mapped to AArch64 System register 
ERXFR_EL1[31:0]. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERXFR are 
UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXEFR is a 32-bit register. 


Field descriptions 


The ERXFR bit assignments are: 


31 0 
Bits [31:0] of ERR<n>FR 
Bits [31:0] 


ERXER accesses bits [31:0] of ERR<n>FR, where n is the value in ERRSELR.SEL. 


Accessing the ERXFR 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


° An UNKNOWN record is selected. 

° ERXFR is RAZ/WI. 

e Direct reads of ERXFR are NOPs. 

° Direct reads of ERXFR are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXFR; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXFR; 

elsif PSTATE.EL == EL3 then 

if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXFR; 
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G8.6.9 ERXFR2, Selected Error Record Feature Register 2 


G8-6600 


The ERXFR2 characteristics are: 


Purpose 
Accesses bits [63:32] of ERR<n>FR for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


AArch32 System register ERXFR2[31:0] is architecturally mapped to AArch64 System register 
ERXFR_EL1[63:32]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXFR2 are 
UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXFR2 is a 32-bit register. 


Field descriptions 


The ERXFR2 bit assignments are: 


31 0 
Bits [63:32] of ERR<n>FR 
Bits [31:0] 


ERXFR2 accesses bits [63:32] of ERR<n>FR, where n is the value in ERRSELR.SEL. 


Accessing the ERXFR2 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


° An UNKNOWN record is selected. 

° ERXFR2 is RAZ/WI. 

e Direct reads of ERXFR2 are NOPs. 

° Direct reads of ERXFR2 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 0b100 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXFR2; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXFR2; 

elsif PSTATE.EL == EL3 then 

if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXFR2; 
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G8.6.10 


G8-6602 


ERXMISCO, Selected Error Record Miscellaneous Register 0 


The ERXMISCO characteristics are: 


Purpose 
Accesses bits [31:0] of ERR<n>MISCO for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv8, for the Armv8-A architecture profile. 


Configurations 


AArch32 System register ERXMISCO[3 1:0] is architecturally mapped to AArch64 System register 
ERXMISCO_EL1[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXMISCO 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXMISCO0 is a 32-bit register. 


Field descriptions 


The ERXMISCO bit assignments are: 


31 0 
Bits [31:0] of ERR<n>MISCO 
Bits [31:0] 


ERXMISCO0 accesses bits [31:0] of ERR<n>MISCO, where n is the value in ERRSELR.SEL. 


Accessing the ERXMISCO 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


. An UNKNOWN record is selected. 


ERXMISCO is RAZ/WI. 


. Direct reads and writes of ERXMISCO are NOPs. 
. Direct reads and writes of ERXMISCO are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0101 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab] 
AArch32.Ta 
elsif HaveEL(E 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if HaveEL(EL3) 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISCO; 
EL2 then 
&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 

else 
return ERX 


L3) && ELUsingAArch32(EL3) && SCR.TER' 
eMonitorTrapException(); 


== '1' then 


TSCQ; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISCO; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f{, {#}<opc2>} 


if PSTATE.EL == EL 
UNDEFINED; 
elsif PSTATE.EL == 
if EL2Enabled( 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif EL2Enab1 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif HaveEL(E 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC@ = 
elsif PSTATE.EL == 
if HaveEL(EL3) 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC@ = 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 
else 
ERXMISCO = 
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© then 


EL1 then 

) && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TER 
rch32SystemAccessTrap(EL3, 0x03); 
L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 


== '1' then 





R[t]; 

EL2 then 

&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
rch32SystemAccessTrap(EL3, 0x03); 

L3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 
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G8.6.11 


G8-6604 


ERXMISC1, Selected Error Record Miscellaneous Register 1 


The ERXMISC1 characteristics are: 


Purpose 
Accesses bits [63:32] of ERR<n>MISCO0 for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


AArch32 System register ERXMISC1[3 1:0] is architecturally mapped to AArch64 System register 
ERXMISCO_EL1[63:32]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXMISC1 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXMISC1 is a 32-bit register. 


Field descriptions 


The ERXMISC1 bit assignments are: 


31 0 
Bits [63:32] of ERR<n>MISCO 
Bits [31:0] 


ERXMISC1 accesses bits [63:32] of ERR<n>MISCO, where n is the value in ERRSELR.SEL. 


Accessing the ERXMISC1 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


. An UNKNOWN record is selected. 


ERXMISC1 is RAZ/WI. 


. Direct reads and writes of ERXMISC1 are NOPs. 
. Direct reads and writes of ERXMISC1 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 Ob0101 Ob001 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 





return ERXMISC1; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TER 
AArch32.TakeMonitorTrapException(); 


== '1' then 


else 
return ERXMISC1; 
elsif PSTATE.EL == EL3 then 
if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 





return ERXMISC1; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm 


opc2 





Ob1111 0b000 = 0b0101 0b0101 


0b001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TER 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
ERXMISC1 = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
ERXMISC1 = R[t]; 
elsif PSTATE.EL == EL3 then 
if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 
else 
ERXMISC1 = R[t]; 


== '1' then 
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ERXMISC2, Selected Error Record Miscellaneous Register 2 


The ERXMISC2 characteristics are: 


Purpose 
Accesses bits [31:0] of ERR<n>MISC1 for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv8, for the Armv8-A architecture profile. 


Configurations 


AArch32 System register ERXMISC2[3 1:0] is architecturally mapped to AArch64 System register 
ERXMISC1_EL1[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXMISC2 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXMISC2 is a 32-bit register. 


Field descriptions 


The ERXMISC2 bit assignments are: 


31 0 
Bits [31:0] of ERR<n>MISC1 
Bits [31:0] 


ERXMISC2 accesses bits [31:0] of ERR<n>MISC1, where n is the value in ERRSELR.SEL. 


Accessing the ERXMISC2 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


. An UNKNOWN record is selected. 


ERXMISC2 is RAZ/WI. 


. Direct reads and writes of ERXMISC2 are NOPs. 
. Direct reads and writes of ERXMISC2 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0101 0b100 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab] 
AArch32.Ta 
elsif HaveEL(E 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if HaveEL(EL3) 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





TSC2; 
EL2 then 
&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 

else 
return ERX 


L3) && ELUsingAArch32(EL3) && SCR.TER' 
eMonitorTrapException(); 


== '1' then 


ISC2; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISC2; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f{, {#}<opc2>} 


if PSTATE.EL == EL 
UNDEFINED; 
elsif PSTATE.EL == 
if EL2Enabled( 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif EL2Enab1 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif HaveEL(E 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC2 = 
elsif PSTATE.EL == 
if HaveEL(EL3) 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC2 = 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 
else 
ERXMISC2 = 
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coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0101 0b100 





© then 


EL1 then 

) && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TER 
rch32SystemAccessTrap(EL3, 0x03); 
L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 


== '1' then 





R[t]; 

EL2 then 

&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
rch32SystemAccessTrap(EL3, 0x03); 

L3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 
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ERXMISC3, Selected Error Record Miscellaneous Register 3 


The ERXMISC3 characteristics are: 


Purpose 
Accesses bits [63:32] of ERR<n>MISC1 for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


AArch32 System register ERXMISC3[3 1:0] is architecturally mapped to AArch64 System register 
ERXMISC1_ EL1[63:32]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXMISC3 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXMISC3 is a 32-bit register. 


Field descriptions 


The ERXMISC3 bit assignments are: 


31 0 
Bits [63:32] of ERR<n>MISC1 
Bits [31:0] 


ERXMISC3 accesses bits [63:32] of ERR<n>MISC1, where n is the value in ERRSELR.SEL. 


Accessing the ERXMISC3 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


. An UNKNOWN record is selected. 


ERXMISC3 is RAZ/WI. 


. Direct reads and writes of ERXMISC3 are NOPs. 
. Direct reads and writes of ERXMISC3 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 Ob0101 0b101 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab] 
AArch32.Ta 
elsif HaveEL(E 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if HaveEL(EL3) 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISC3; 
EL2 then 
&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 

else 
return ERX 


L3) && ELUsingAArch32(EL3) && SCR.TER' 
eMonitorTrapException(); 


== '1' then 


ISC3; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISC3; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f{, {#}<opc2>} 


if PSTATE.EL == EL 
UNDEFINED; 
elsif PSTATE.EL == 
if EL2Enabled( 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif EL2Enab1 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif HaveEL(E 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC3 = 
elsif PSTATE.EL == 
if HaveEL(EL3) 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC3 = 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 
else 
ERXMISC3 = 
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coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 O0b0101 0b101 





© then 


EL1 then 

) && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TER 
rch32SystemAccessTrap(EL3, 0x03); 
L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 


== '1' then 





R[t]; 

EL2 then 

&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
rch32SystemAccessTrap(EL3, 0x03); 

L3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
keMonitorTrapException() ; 


R[t]; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 
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ERXMISC4, Selected Error Record Miscellaneous Register 4 


The ERXMISC4 characteristics are: 


Purpose 
Accesses bits [31:0] of ERR<n>MISC2 for the error record selected by ERRSELR.SEL. 
For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 

Configurations 
AArch32 System register ERXMISC4[3 1:0] is architecturally mapped to AArch64 System register 
ERXMISC2_EL1[31:0]. 
This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERXMISC4 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ERXMISC4 is a 32-bit register. 


Field descriptions 


The ERXMISC4 bit assignments are: 


31 0 
Bits [31:0] of ERR<n>MISC2 
Bits [31:0] 


ERXMISC4 accesses bits [31:0] of ERR<n>MISC2, where n is the value in ERRSELR.SEL. 


Accessing the ERXMISC4 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


. An UNKNOWN record is selected. 


ERXMISC4 is RAZ/WI. 


. Direct reads and writes of ERXMISC4 are NOPs. 
. Direct reads and writes of ERXMISC4 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0101 0b010 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab] 
AArch32.Ta 
elsif HaveEL(E 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if HaveEL(EL3) 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





TSC4; 
EL2 then 
&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 

else 
return ERX 


L3) && ELUsingAArch32(EL3) && SCR.TER' 
eMonitorTrapException(); 


== '1' then 


ISC4; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISC4; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>f{, {#}<opc2>} 


if PSTATE.EL == EL 
UNDEFINED; 
elsif PSTATE.EL == 
if EL2Enabled( 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif EL2Enab1 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif HaveEL(E 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC4 = 
elsif PSTATE.EL == 
if HaveEL(EL3) 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC4 = 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 
else 
ERXMISC4 = 
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coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0101 0b010 





© then 


EL1 then 

) && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TER 
rch32SystemAccessTrap(EL3, 0x03); 
L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 


== '1' then 





R[t]; 

EL2 then 

&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
rch32SystemAccessTrap(EL3, 0x03); 

L3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 


G8-6611 
Non-Confidential 


AArch32 System Register Descriptions 


G8.6 RAS registers 


G8.6.15 


G8-6612 


ERXMISC5, Selected Error Record Miscellaneous Register 5 


The ERXMISC5 characteristics are: 


Purpose 
Accesses bits [63:32] of ERR<n>MISC2 for the error record selected by ERRSELR.SEL. 
For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 

Configurations 


AArch32 System register ERXMISC5[3 1:0] is architecturally mapped to AArch64 System register 
ERXMISC2_EL1[63:32]. 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERXMISCS are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXMISCS is a 32-bit register. 


Field descriptions 


The ERXMISCS bit assignments are: 


31 0 
Bits [63:32] of ERR<n>MISC2 
Bits [31:0] 


ERXMISCS accesses bits [63:32] of ERR<n>MISC2, where n is the value in ERRSELR.SEL. 


Accessing the ERXMISC5 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


. An UNKNOWN record is selected. 


ERXMISCS is RAZ/WI. 


. Direct reads and writes of ERXMISC5 are NOPs. 
. Direct reads and writes of ERXMISC5 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0101 Ob011 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.Ta 
elsif EL2Enab] 
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eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab] 
AArch32.Ta 
elsif HaveEL(E 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if HaveEL(EL3) 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISC5; 
EL2 then 
&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 

else 
return ERX 


L3) && ELUsingAArch32(EL3) && SCR.TER' 
eMonitorTrapException(); 


== '1' then 


ISC5; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISC5; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


if PSTATE.EL == EL 
UNDEFINED; 
elsif PSTATE.EL == 
if EL2Enabled( 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif EL2Enab1 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif HaveEL(E 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC5 = 
elsif PSTATE.EL == 
if HaveEL(EL3) 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC5 = 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 
else 
ERXMISCS5 = 
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Ob1111 0b000 = 0b0101 O0b0101 Ob011 





© then 


EL1 then 

) && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TER 
rch32SystemAccessTrap(EL3, 0x03); 
L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 


== '1' then 





R[t]; 

EL2 then 

&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
rch32SystemAccessTrap(EL3, 0x03); 

L3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 
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ERXMISC6, Selected Error Record Miscellaneous Register 6 


The ERXMISC6 characteristics are: 


Purpose 
Accesses bits [31:0] of ERR<n>MISC3 for the error record selected by ERRSELR.SEL. 
For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 

Configurations 
AArch32 System register ERXMISC6[3 1:0] is architecturally mapped to AArch64 System register 
ERXMISC3_EL1[31:0]. 
This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERXMISC6 are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


ERXMISC6 is a 32-bit register. 


Field descriptions 


The ERXMISC6 bit assignments are: 


31 0 
Bits [31:0] of ERR<n>MISC3 
Bits [31:0] 


ERXMISC6 accesses bits [31:0] of ERR<n>MISC3, where n is the value in ERRSELR.SEL. 


Accessing the ERXMISC6 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


. An UNKNOWN record is selected. 


ERXMISC6 is RAZ/WI. 


. Direct reads and writes of ERXMISC6 are NOPs. 
. Direct reads and writes of ERXMISC6 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0101 0b110 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


AArch32.Ta 
elsif EL2Enab] 


AArch32 System Register Descriptions 
G8.6 RAS registers 


eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab] 
AArch32.Ta 
elsif HaveEL(E 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if HaveEL(EL3) 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISC6; 
EL2 then 
&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 

else 
return ERX 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 

else 
return ERX 


L3) && ELUsingAArch32(EL3) && SCR.TER' 
eMonitorTrapException(); 


== '1' then 


TSC6; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





TSC6; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


if PSTATE.EL == EL 
UNDEFINED; 
elsif PSTATE.EL == 
if EL2Enabled( 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif EL2Enab1 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif HaveEL(E 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC6 = 
elsif PSTATE.EL == 
if HaveEL(EL3) 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC6 = 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 
else 
ERXMISC6 = 
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coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0101 0b110 





© then 


EL1 then 

) && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TER 
rch32SystemAccessTrap(EL3, 0x03); 
L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 


== '1' then 





R[t]; 

EL2 then 

&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
rch32SystemAccessTrap(EL3, 0x03); 

L3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 
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ERXMISC7, Selected Error Record Miscellaneous Register 7 


The ERXMISC7 characteristics are: 


Purpose 
Accesses bits [63:32] of ERR<n>MISC3 for the error record selected by ERRSELR.SEL. 
For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 

Configurations 


AArch32 System register ERXMISC7[3 1:0] is architecturally mapped to AArch64 System register 
ERXMISC3_EL1[63:32]. 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERXMISC7 are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXMISC7 is a 32-bit register. 


Field descriptions 


The ERXMISC7 bit assignments are: 


31 0 
Bits [63:32] of ERR<n>MISC3 
Bits [31:0] 


ERXMISC7 accesses bits [63:32] of ERR<n>MISC3, where n is the value in ERRSELR.SEL. 


Accessing the ERXMISC7 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


. An UNKNOWN record is selected. 


ERXMISC7 is RAZ/WI. 


. Direct reads and writes of ERXMISC7 are NOPs. 
. Direct reads and writes of ERXMISC7 are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0101 0b111 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab] 


AArch32.Ta 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 


elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 


AArch32.Ta 


else 


return ERX 
elsif PSTATE.EL == 


if HaveEL(EL3) 


eMonitorTrapException(); 





ISC7; 
EL2 then 
&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TER 
AArch32.Ta 


else 
return ERX 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 

else 
return ERX 


== '1' then 
eMonitorTrapException(); 


ISC7; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 





ISC7; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


if PSTATE.EL == EL 
UNDEFINED; 
elsif PSTATE.EL == 
if EL2Enabled( 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif EL2Enab1 
AArch64.AA 
elsif EL2Enab1 
AArch32.Ta 
elsif HaveEL(E 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC7 = 
elsif PSTATE.EL == 
if HaveEL(EL3) 
AArch64.AA 
elsif HaveEL(E 
AArch32.Ta 
else 
ERXMISC7 = 
elsif PSTATE.EL == 
if PSTATE.M != 
AArch32.Ta 
else 
ERXMISC7 = 
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coproc opct CRn CRm opc2 





0b1111 0b000 0b0101 0b0101 0b111 





© then 


EL1 then 

) && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
eHypTrapException(QxQ3) ; 
ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
rch32SystemAccessTrap(EL2, 0x03); 
ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
eHypTrapException(QxQ3) ; 
L3) && !ELUsingAArch32(EL3) && SCR_EL3.TER 
rch32SystemAccessTrap(EL3, 0x03); 
L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
eMonitorTrapException(); 


== '1' then 





R[t]; 

EL2 then 

&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
rch32SystemAccessTrap(EL3, 0x03); 
L3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 

EL3 then 

M32_Monitor && SCR.TERR == '1' then 
keMonitorTrapException(); 


R[t]; 
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ERXSTATUS, Selected Error Record Primary Status Register 


The ERXSTATUS characteristics are: 


Purpose 
Accesses bits [31:0] of ERR<n>STATUS for the error record selected by ERRSELR.SEL. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


AArch32 System register ERXSTATUS[3 1:0] is architecturally mapped to AArch64 System 
register ERXSTATUS_EL1[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERXSTATUS 
are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
ERXSTATUS is a 32-bit register. 


Field descriptions 


The ERXSTATUS bit assignments are: 


31 0 
Bits [31:0] of ERR<n>STATUS 
Bits [31:0] 


ERXSTATUS accesses bits [31:0] of ERR<n>STATUS, where n is the value in ERRSELR.SEL. 


Accessing the ERXSTATUS 


If ERRIDR.NUM == 0 or ERRSELR.SEL is set to a value greater than or equal to ERRIDR.NUM, then one of the 
following occurs: 


° An UNKNOWN record is selected. 

° ERXSTATUS is RAZ/WI. 

è Direct reads and writes of ERXSTATUS are NOPs. 

7 Direct reads and writes of ERXSTATUS are UNDEFINED. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 0b010 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXSTATUS; 

elsif PSTATE.EL == EL2 then 

if HaveEL(EL3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 
AArch64.AArch32SystemAccessTrap(EL3, 0x03); 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.TER 
AArch32.TakeMonitorTrapException(); 

else 
return ERXSTATUS; 

elsif PSTATE.EL == EL3 then 

if PSTATE.M != M32_Monitor && SCR.TERR == '1' then 
AArch32.TakeMonitorTrapException(); 

else 
return ERXSTATUS; 





== '1' then 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b0101 0b0100 0b010 





if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T5 == '1' then 
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AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enab1 


ed() && !ELUsingAArch32(EL2) && HCR_EL2.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enab1 


ed() && ELUsingAArch32(EL2) && HCR2.TERR == '1' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif HaveEL(E 


L3) && !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 


L3) && ELUsingAArch32(EL3) && PSTATE.M != M32_Monitor && SCR.TERR == '1' then 





AArch32.TakeMonitorTrapException(); 


else 
ERXSTATUS 


if HaveEL(EL3) 


= R[t]; 


elsif PSTATE.EL == EL2 then 


&& !ELUsingAArch32(EL3) && SCR_EL3.TERR == '1' then 


AArch64.AArch32SystemAccessTrap(EL3, 0x03); 


elsif HaveEL(E 
AArch32.Ta 
else 
ERXSTATUS 


if PSTATE.M != 
AArch32.Ta 
else 


L3) && ELUsingAArch32(EL3) && SCR.TERR == '1' then 
keMonitorTrapException(); 


= R[t]; 


elsif PSTATE.EL == EL3 then 


M32_Monitor && SCR.TERR == '1' then 
keMonitorTrapException(); 


ERXSTATUS = R[t]; 
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VDFSR, Virtual SError Exception Syndrome Register 


The VDFSR characteristics are: 


Purpose 


Provides the syndrome value reported to software on taking a virtual SError interrupt exception to 
EL1, or on executing an ESB instruction at EL1. 


When a virtual SError interrupt is taken, the syndrome value is reported in DFSR.{AET, ExT} and 
the remainder of the DFSR is set as defined by VMSAv8-32. For more information, see Chapter G5 
The AArch32 Virtual Memory System Architecture. 


If the virtual SError interrupt is deferred by an ESB instruction, then the syndrome value is written 
to VDISR. 


Configurations 


AArch32 System register VDFSR[31:0] is architecturally mapped to AArch64 System register 
VSESR_EL2[31:0] when the highest implemented Exception level is using AArch64. 


This register is present only when RAS is implemented. Otherwise, direct accesses to VDFSR are 
UNDEFINED. 


If EL2 is not implemented, then VDFSR is RESO from Monitor mode when SCR.NS == 1. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
VDFSR is a 32-bit register. 


Field descriptions 


The VDFSR bit assignments are: 


31 16 15 14 13 12 11 0 


RESO eer] | | RESO 


Bits [31:16] 
Reserved, RESO. 
AET, bits [15:14] 
When a virtual SError interrupt is taken to EL1 using AArch32, DFSR[15:4] is set to VDFSR.AET. 


When a virtual SError interrupt is deferred by an ESB instruction, VDISR[15:4] is set to 
VDFSR.AET. 


This field resets to an architecturally UNKNOWN value. 


Bit [13] 
Reserved, RESO. 

ExT, bit [12] 
When a virtual SError interrupt is taken to EL1 using AArch32, DFSR[12] is set to VDFSR.ExT. 
When a virtual SError interrupt is deferred by an ESB instruction, VDISR[12] is set to VDFSR.ExT. 


This field resets to an architecturally UNKNOWN value. 
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Bits [11:0] 


Reserved, RESO. 


Accessing the VDFSR 


Direct reads and writes of VDFSR are UNDEFINED if EL3 is implemented and using AArch32 in all Secure 
privileged modes other than Monitor mode. 


If EL2 is not implemented, then VDFSR is RESO from Monitor mode when SCR.NS == 1. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 = 0b0101 0b0010 Ob011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VDFSR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
return VDFSR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 


Ob1111 0b100 0b0101 0b0010 Ob011 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T5 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.TS == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VDFSR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
UNDEFINED; 
else 
VDFSR = R[t]; 
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G8.6.20 VDISR, Virtual Deferred Interrupt Status Register 
The VDISR characteristics are: 


Purpose 


Records that an SError interrupt has been consumed by an ESB instruction. 


Configurations 


AArch32 System register VDISR[3 1:0] is architecturally mapped to AArch64 System register 
VDISR_EL2[31:0]. 


This register is present only when RAS is implemented. Otherwise, direct accesses to VDISR are 
UNDEFINED. 


If EL2 is not implemented, then VDISR is RESO from Monitor mode when SCR.NS == 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
VDISR is a 32-bit register. 


Field descriptions 


The VDISR bit assignments are: 


When TTBCR.EAE == 


31 30 16 15 14 13 12 1110 9 8 


A RESO er} | | | | RESO FS[3:0] 





A, bit [31] 

Set to 1 when an ESB instruction defers a virtual SError interrupt. 

This field resets to an architecturally UNKNOWN value. 
Bits [30:16] 

Reserved, RESO. 
AET, bits [15:14] 

The value copied from VDFSR.AET. 

This field resets to an architecturally UNKNOWN value. 
Bit [13] 

Reserved, RESO. 
ExT, bit [12] 

The value copied from VDFSR.ExT. 

This field resets to an architecturally UNKNOWN value. 
Bit [11] 


Reserved, RESO. 
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FS[4], bit [10] 
This field is bit[4] of FS[4:0]. 
Fault status code. Set to @b10110 when an ESB instruction defers a virtual SError interrupt. 
@b10110 Asynchronous SError interrupt. 
All other values are reserved. 
The FS field is split as follows: 
° FS[4] is VDISR[10]. 
° FS[3:0] is VDISR[3:0]. 
This field resets to an architecturally UNKNOWN value. 
LPAE, bit [9] 
Format. 
Set to TTBCR.EAE when an ESB instruction defers a virtual SError interrupt. 
Qbd Using the Short-descriptor translation table format. 
This field resets to an architecturally UNKNOWN value. 
Bits [8:4] 
Reserved, RESO. 
FS[3:0], bits [3:0] 
This field is bits[3:0] of FS[4:0]. 
See FS[4] for the field description. 


When TTBCR.EAE == 


31 30 16 15 14 13 12 1110 9 8 


RESO a ie RESO STATUS 


ExT 
RESO 
A, bit [31] 
Set to 1 when an ESB instruction defers a virtual SError interrupt. 
This field resets to an architecturally UNKNOWN value. 
Bits [30:16] 
Reserved, RESO. 
AET, bits [15:14] 
The value copied from VDFSR.AET. 
This field resets to an architecturally UNKNOWN value. 
Bit [13] 
Reserved, RESO. 
ExT, bit [12] 
The value copied from VDFSR.ExT. 
This field resets to an architecturally UNKNOWN value. 
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Bits [11:10] 
Reserved, RESO. 
LPAE, bit [9] 
Format. 
Set to TTBCR.EAE when an ESB instruction defers a virtual SError interrupt. 
Qb1 Using the Long-descriptor translation table format. 
This field resets to an architecturally UNKNOWN value. 
Bits [8:6] 
Reserved, RESO. 
STATUS, bits [5:0] 
Fault status code. Set to @b010001 when an ESB instruction defers a virtual SError interrupt. 
0b010001 Asynchronous SError interrupt. 
All other values are reserved. 


This field resets to an architecturally UNKNOWN value. 


Accessing the VDISR 


Direct reads and writes of VDFSR are UNDEFINED if EL3 is implemented and using AArch32 in all Secure 
privileged modes other than Monitor mode. 


An indirect write to VDISR made by an ESB instruction does not require an explicit synchronization operation for 
the value that is written to be observed by a direct read of DISR occurring in program order after the ESB instruction. 


If EL2 is not implemented, then VDISR is RESO from Monitor mode when SCR.NS == 1. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 = 0b1100 0b0001 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return VDISR; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
return VDISR; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b100 = 0b1100 O0b0001 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
else 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
VDISR = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
UNDEFINED; 
else 
VDISR = R[t]; 








MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1100 0b0001 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AMO == '1' then 
return VDISR_EL2; 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.AMO == '1' then 
return VDISR; 
else 
return DISR; 
elsif PSTATE.EL == EL2 then 
return DISR; 
elsif PSTATE.EL == EL3 then 
return DISR; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1100 0b0001 Ob001 





if PSTATE.EL == EL@ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T12 == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T12 == '1' then 
AArch32.TakeHypTrapException(QxQ3) ; 
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elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.AMO == '1' then 
VDISR_EL2 = 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.AMO == '1' then 


VDISR = R[t]; 
else 
DISR = R[t]; 
elsif PSTATE.EL == EL2 then 
DISR = R[t]; 
elsif PSTATE.EL == EL3 then 
DISR = R[t]; 
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G8.7 Generic Timer registers 


This section lists the Generic Timer registers in AArch32. 
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G8.7.1 
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CNTFRQ, Counter-timer Frequency register 


The CNTFRQ characteristics are: 


Purpose 


This register is provided so that software can discover the frequency of the system counter. It must 


be programmed with this value as part of system initialization. The value of the register is not 
interpreted by hardware. 


Configurations 
AArch32 System register CNTFRQ[31:0] is architecturally mapped to AArch64 System register 
CNTFRQ _ ELO0[31:0]. 

RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 


CNTFRQ is a 32-bit register. 


Field descriptions 


The CNTFRQ bit assignments are: 


31 0 
Clock frequency 
Bits [31:0] 


Clock frequency. Indicates the system counter clock frequency, in Hz. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTFRQ 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b1110 0b0000 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && 
CNTKCTL_EL1.<EL@PCTEN, ELQVCTEN> == '@Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PL@PCTEN == '@' && CNTKCTL.PLO@VCTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && 
CNTHCTL_EL2.<EL@PCTEN, ELQVCTEN> == 'Q@@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
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return CNTFRQ; 
elsif PSTATE.EL == EL1 then 
return CNTFRQ; 
elsif PSTATE.EL == EL2 then 
return CNTFRQ; 
elsif PSTATE.EL == EL3 then 
return CNTFRQ; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1110 0b0000 0b000 





if IsHighestEL(PSTATE.EL) then 
CNTFRQ = R[t]; 

else 
UNDEFINED; 
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CNTHCTL, Counter-timer Hyp Control register 


The CNTHCTL characteristics are: 


Purpose 
Controls the generation of an event stream from the physical counter, and access from Non-secure 


EL1 modes to the physical counter and the Non-secure EL1 physical timer. 


Configurations 


AArch32 System register CNTHCTL[31:0] is architecturally mapped to AArch64 System register 
CNTHCTL_EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHCTL is a 32-bit register. 


Field descriptions 


The CNTHCTL bit assignments are: 


31 8 7 43210 


RESO EVNTI ail 
L PL1PCTEN 
PL1PCEN 


EVNTEN 
EVNTDIR 


Bits [31:8] 


Reserved, RESO. 


EVNTL bits [7:4] 


Selects which bit (0 to 15) of the counter register CNTPCT is the trigger for the event stream 
generated from that counter, when that stream is enabled. 


This field resets to an architecturally UNKNOWN value. 


EVNTDIR, bit [3] 


Controls which transition of the counter register CNTPCT trigger bit, defined by EVNTI, generates 
an event when the event stream is enabled: 


Qbd A 0 to | transition of the trigger bit triggers an event. 
Qb1 A 1 to 0 transition of the trigger bit triggers an event. 
This field resets to an architecturally UNKNOWN value. 


EVNTEN, bit [2] 
Enables the generation of an event stream from the counter register CNTPCT: 
ObO Disables the event stream. 
Qb1 Enables the event stream. 


This field resets to an architecturally UNKNOWN value. 
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PLIPCEN, bit [1] 


Traps Non-secure ELO and EL1 accesses to the physical timer registers to Hyp mode. 


Qbd Non-secure ELO and EL1 accesses to the CNTP_CTL, CNTP_CVAL, and 
CNTP_TVAL are trapped to Hyp mode, unless the it is trapped by 
CNTKCTL.PLOPTEN. 

Qb1 This control does not cause any instructions to be trapped. 


If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 1 other than for the 
purpose of a direct read. 


This field resets to an architecturally UNKNOWN value. 


PLIPCTEN, bit [0] 


Traps Non-secure ELO and EL1 accesses to the physical counter register to Hyp mode. 


Qbd Non-secure ELO and EL1 accesses to the CNTPCT are trapped to Hyp mode, unless it 
is trapped by CNTKCTL.PLOPCTEN. 


Qb1 This control does not cause any instructions to be trapped. 


If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 1 other than for the 
purpose of a direct read. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHCTL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b1110 0b0001 0b000 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 


UNDEFINED; 


elsif PSTATE.EL == EL2 then 
return CNTHCTL; 

elsif PSTATE.EL == EL3 then 
return CNTHCTL; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b1110 0b0001 0b000 





if PSTATE.EL == EL@ then 


UNDEFINED; 


elsif PSTATE.EL == EL1 then 


UNDEFINED; 


elsif PSTATE.EL == EL2 then 


CNTHCTL = 


R[t]; 


elsif PSTATE.EL == EL3 then 


CNTHCTL = 


R[t]; 
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CNTHP_CTL, Counter-timer Hyp Physical Timer Control register 


The CNTHP_CTL characteristics are: 


Purpose 


Control register for the Hyp mode physical timer. 


Configurations 


AArch32 System register CNTHP_CTL[31:0] is architecturally mapped to AArch64 System 
register CNTHP_CTL_EL2[31:0]. 


If EL2 is not implemented, this register is RESO from EL3. 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into EL2 with EL2 using AArch32, or into EL3 with EL3 using AArch32. Otherwise, RW fields in 
this register reset to architecturally UNKNOWN values. 

Attributes 
CNTHP_CTL is a 32-bit register. 


Field descriptions 


The CNTHP_CTL bit assignments are: 


31 3210 


RESO p 
= ENABLE 
IMASK 


ISTATUS 


Bits [31:3] 


Reserved, RESO. 


ISTATUS, bit [2] 
The status of the timer. This bit indicates whether the timer condition is met: 
Ob Timer condition is not met. 
0b1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 
Timer interrupt mask bit. Permitted values are: 
Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 
For more information, see the description of the ISTATUS bit. 


In a system where the PE resets into EL2 or EL3, this field resets to an architecturally UNKNOWN 
value. 
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ENABLE, bit [0] 
Enables the timer. Permitted values are: 
Ob Timer disabled. 
Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 


CNTHP_TVAL continues to count down. 





Note 


Disabling the output signal might be a power-saving option. 





In a system where the PE resets into EL2 or EL3, this field resets to 0. 


Accessing the CNTHP_CTL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 




















coproc opct CRn CRm opc2 
0b1111 0b100 0b1110 0b0010 O0b001 
if PSTATE.EL == ELQ then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
return CNTHP_CTL; 
elsif PSTATE.EL == EL3 then 
return CNTHP_CTL; 
MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
coproc opct CRn CRm opc2 
0b1111 0b100 0b1110 0b0010 O0b001 
if PSTATE.EL == ELO then 
UNDEFINED; 
elsif PSTATE.EL == EL1 then 
UNDEFINED; 
elsif PSTATE.EL == EL2 then 
CNTHP_CTL = R[t]; 
elsif PSTATE.EL == EL3 then 
CNTHP_CTL = R[t]; 
MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 
coproc opct CRn CRm opc2 
0b1111 0b000 0b1110 0b0010 Ob001 





if PSTATE.EL == EL@ then 


if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQPTEN == 'Q' 


then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 


then 

AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CTL_EL2; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CTL_EL2; 

else 
return CNTP_CTL; 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 

return CNTP_CTL_S; 
else 
return CNTP_CTL_NS; 








else 
return CNTP_CTL; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CNTP_CTL_NS; 
else 
return CNTP_CTL; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return CNTP_CTL_S; 
else 
return CNTP_CTL_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1110 0b0010 Ob001 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H, TGE> 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H, TGE> 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> 
CNTHPS_CTL_EL2 = R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> 
CNTHP_CTL_EL2 = R[t]; 
else 
CNTP_CTL = R[t]; 
elsif PSTATE.EL == EL1 then 





then 


' && CNTHCTL_EL2.EL1PCEN == 'Q' then 


== '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 


== '11' && CNTHCTL_EL2.ELO@PTEN == 'Q' 


"Q@' then 
== '11' && SCR_EL3.NS == 'Q' then 


== '11' && SCR_EL3.NS == '1' then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == '@' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
CNTP_CTL_S = R[t]; 
else 
CNTP_CTL_NS = R[t]; 
else 
CNTP_CTL = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
CNTP_CTL_NS = R[t]; 
else 
CNTP_CTL = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
CNTP_CTL_S = R[t]; 
else 





CNTP_CTL_NS = R[t]; 


&& CNTHCTL_EL2.EL1PTEN == 'Q' then 


'@' then 
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G8.7.4 CNTHP_CVAL, Counter-timer Hyp Physical CompareValue register 


The CNTHP_CVAL characteristics are: 


Purpose 
Holds the compare value for the Hyp mode physical timer. 
Configurations 
AArch32 System register CNTHP_CVAL[63:0] is architecturally mapped to AArch64 System 
register CNTHP_CVAL EL2[63:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTHP_CVAL is a 64-bit register. 


Field descriptions 


The CNTHP_CVAL bit assignments are: 


63 0 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL2 physical timer CompareValue. 


When CNTHP_CTL.ENABLE is 1, the timer condition is met when (CNTPCT - Compare Value) is 
greater than or equal to zero. This means that CompareValue acts like a 64-bit upcounter timer. 
When the timer condition is met: 


° CNTHP_CTL.ISTATUS is set to 1. 
. If CNTHP_CTL.IMASK is 0, an interrupt is generated. 
When CNTHP_CTL.ENABLE is 0, the timer condition is not met, but CNTPCT continues to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHP_CVAL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1111 0b1110 0b0110 





if PSTATE.EL == EL@ then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
return CNTHP_CVAL; 
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elsif PSTATE.EL == EL3 then 
return CNTHP_CVAL; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1111 0b1110 0b0110 





if PSTATE.EL == ELO then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
CNTHP_CVAL = R[t2]:R[t]; 

elsif PSTATE.EL == EL3 then 
CNTHP_CVAL = R[t2]:R[t]; 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 


0b1111 0b1110 0b0010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQ@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CVAL_EL2; 
else 
return CNTP_CVAL; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
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if SCR.NS == 'Q' then 
return CNTP_CVAL_S; 
else 
return CNTP_CVAL_NS; 
else 
return CNTP_CVAL; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CNTP_CVAL_NS; 
else 
return CNTP_CVAL; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return CNTP_CVAL_S; 
else 





return CNTP_CVAL_NS; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





Ob1111 0b1110 0b0010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_CVAL_EL2 = R[t2]:R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_CVAL_EL2 = R[t2]:R[t]; 
else 
CNTP_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
CNTP_CVAL_S = R[t2]:R[t]; 
else 
CNTP_CVAL_NS = R[t2]:R[t]; 
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else 
CNTP_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
CNTP_CVAL_NS = R[t2]:R[t]; 
else 
CNTP_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
CNTP_CVAL_S = R[t2]:R[t]; 
else 
CNTP_CVAL_NS = R[t2]:R[t]; 
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G8.7.5 


G8-6640 


CNTHP_TVAL, Counter-timer Hyp Physical Timer TimerValue register 


The CNTHP_TVAL characteristics are: 


Purpose 
Holds the timer value for the Hyp mode physical timer. 
Configurations 
AArch32 System register CNTHP_TVAL[31:0] is architecturally mapped to AArch64 System 
register CNTHP_TVAL_EL2[31:0]. 
If EL2 is not implemented, this register is RESO from EL3. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTHP_TVAL is a 32-bit register. 


Field descriptions 


The CNTHP_TVAL bit assignments are: 


31 


0 


TimerValue 


Timer Value, bits [31:0] 


The TimerValue view of the EL2 physical timer. 

On a read of this register: 

5 If CNTHP_CTL.ENABLE is 0, the value returned is UNKNOWN. 

° If CNTHP_CTL.ENABLE is 1, the value returned is (CNTHP_CVAL - CNTPCT). 


Ona write of this register, CNTHP_CVAL is set to (CNTPCT + TimerValue), where TimerValue is 
treated as a signed 32-bit integer. 


When CNTHP_CTL.ENABLE is 1, the timer condition is met when (CNTPCT - CNTHP_CVAL) 
is greater than or equal to zero. This means that TimerValue acts like a 32-bit downcounter timer. 
When the timer condition is met: 


° CNTHP_CTL.ISTATUS is set to 1. 
. If CNTHP_CTL.IMASK is 0, an interrupt is generated. 


When CNTHP_CTL.ENABLE is 0, the timer condition is not met, but CNTPCT continues to count, 
so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHP_TVAL 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b100 = 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
return CNTHP_TVAL; 

elsif PSTATE.EL == EL3 then 
return CNTHP_TVAL; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b100 0b1110 0b0010 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
CNTHP_TVAL = R[t]; 

elsif PSTATE.EL == EL3 then 
CNTHP_TVAL = R[t]; 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(QxQ3) ; 
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elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_TVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_TVAL_EL2; 
else 
return CNTP_TVAL; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return CNTP_TVAL_S; 
else 
return CNTP_TVAL_NS; 
else 
return CNTP_TVAL; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CNTP_TVAL_NS; 
else 
return CNTP_TVAL; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return CNTP_TVAL_S; 
else 





return CNTP_TVAL_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELO@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.£2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 





then 

AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_TVAL_EL2 = R[t]; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_TVAL_EL2 = R[t]; 
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else 
CNTP_TVAL = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
CNTP_TVAL_S = R[t]; 
else 
CNTP_TVAL_NS = R[t]; 
else 
CNTP_TVAL = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
CNTP_TVAL_NS = R[t]; 
else 
CNTP_TVAL = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
CNTP_TVAL_S = R[t]; 
else 





CNTP_TVAL_NS = R[t]; 
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G8.7.6 


G8-6644 


CNTHPS_CTL, Counter-timer Secure Physical Timer Control Register (EL2) 


The CNTHPS_CTL characteristics are: 








Purpose 
Provides AArch32 access to the Secure EL2 physical timer. 
Note 
The Secure EL2 timer is implemented by ARMv8.4-SecEL2. It is only accessible from AArch32 
state when EL2 is using AArch64 and the value of SCR_EL3.{EEL2, NS} is {1, 0}. 
Configurations 
AArch32 System register CNTHPS_CTL[31:0] is architecturally mapped to AArch64 System 
register CNTHPS_CTL_EL2[31:0]. 
This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHPS_CTL are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTHPS_ CTL is a 32-bit register. 


Field descriptions 


The CNTHPS CTL bit assignments are: 


31 32 1 0 


RESO p 
L ENABLE 
IMASK 


ISTATUS 


Bits [31:3] 


Reserved, RESO. 


ISTATUS, bit [2] 
The status of the timer. This bit indicates whether the timer condition is met: 
Ob Timer condition is not met. 
Qb1 Timer condition is met. 


When the value of the CNTHPS_CTL.ENABLE bit is 1, ISTATUS indicates whether the timer 
condition is met. ISTATUS takes no account of the value of the IMASK bit. If the value of STATUS 
is 1 and the value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the CNTHPS_CTL.ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 


Timer interrupt mask bit. Permitted values are: 


Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 
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For more information, see the description of the ISTATUS bit. 

This field resets to an architecturally UNKNOWN value. 
ENABLE, bit [0] 

Enables the timer. Permitted values are: 

Qbe Timer disabled. 

Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTHPS_TVAL_EL2 continues to count down. 


Note 


Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHPS_CTL 
This register is accessed using the encoding for CNTP_CTL. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 0b1110 0b0010 Ob001 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CTL_EL2; 
else 
return CNTP_CTL; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
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AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return CNTP_CTL_S; 
else 
return CNTP_CTL_NS; 
else 
return CNTP_CTL; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CNTP_CTL_NS; 
else 
return CNTP_CTL; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return CNTP_CTL_S; 
else 
return CNTP_CTL_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = =0b1110 0b0010 0b001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQPTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_CTL_EL2 = R[t]; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_CTL_EL2 = R[t]; 

else 
CNTP_CTL = R[t]; 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
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if SCR.NS == 'Q' then 
CNTP_CTL_S = R[t]; 
else 
CNTP_CTL_NS = R[t]; 
else 
CNTP_CTL = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
CNTP_CTL_NS = R[t]; 
else 
CNTP_CTL = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
CNTP_CTL_S = R[t]; 
else 





CNTP_CTL_NS = R[t]; 
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G8.7.7 CNTHPS_CVAL, Counter-timer Secure Physical Timer CompareValue Register (EL2) 
The CNTHPS CVAL characteristics are: 
Purpose 
Provides AArch32 access to the compare value for the Secure EL2 physical timer. 


Note 


The Secure EL2 timer is implemented by ARMv8.4-SecEL2. It is only accessible from AArch32 
state when EL2 is using AArch64 and the value of SCR_EL3.{EEL2, NS} is {1, 0}. 








Configurations 


AArch32 System register CNTHPS_ CVAL[63:0] is architecturally mapped to AArch64 System 
register CNTHPS_CVAL_ EL2[63:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHPS_CVAL are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHPS_CVAL is a 64-bit register. 


Field descriptions 


The CNTHPS CVAL bit assignments are: 


63 0 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL2 physical timer Compare Value. 


When CNTHPS CTL _EL2.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
CompareValue) is greater than or equal to zero. This means that CompareValue acts like a 64-bit 
upcounter timer. When the timer condition is met: 


° CNTHPS_CTL_EL2.ISTATUS is set to 1. 
è If CNTHPS_CTL_EL2.IMASK is 0, an interrupt is generated. 


When CNTHPS_CTL_EL2.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO 
continues to count 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHPS_CVAL 
This register is accessed using the encoding for CNTP_CVAL. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 


0b1111 0b1110 0b0010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CVAL_EL2; 
else 
return CNTP_CVAL; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return CNTP_CVAL_S; 
else 
return CNTP_CVAL_NS; 





else 
return CNTP_CVAL; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CNTP_CVAL_NS; 
else 
return CNTP_CVAL; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return CNTP_CVAL_S; 
else 





return CNTP_CVAL_NS; 
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MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 


0b1111 0b1110 0b0010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELØPTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_CVAL_EL2 = R[t2]:R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_CVAL_EL2 = R[t2]:R[t]; 
else 
CNTP_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
CNTP_CVAL_S = R[t2]:R[t]; 
else 
CNTP_CVAL_NS = R[t2]:R[t]; 








else 
CNTP_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
CNTP_CVAL_NS = R[t2]:R[t]; 
else 
CNTP_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
CNTP_CVAL_S = R[t2]:R[t]; 
else 
CNTP_CVAL_NS = R[t2]:R[t]; 
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G8.7.8 CNTHPS_TVAL, Counter-timer Secure Physical Timer TimerValue Register (EL2) 


ARM DDI 0487E.a 
ID070919 


The CNTHPS_ TVAL characteristics are: 


Purpose 


Provides AArch32 access to the timer value for the Secure EL2 physical timer. 


Note 
The Secure EL2 timer is implemented by ARMv8.4-SecEL2. It is only accessible from AArch32 
state when EL2 is using AArch64 and the value of SCR_EL3.{EEL2, NS} is {1, 0}. 








Configurations 


Attributes 


AArch32 System register CNTHPS_TVAL[31:0] is architecturally mapped to AArch64 System 
register CNTHPS_TVAL EL2[31:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHPS_TVAL are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


CNTHPS_TVAL is a 32-bit register. 


Field descriptions 


The CNTHPS_ TVAL bit assignments are: 


31 


0 


TimerValue 


Timer Value, bits [31:0] 


The TimerValue view of the EL2 physical timer. 
On a read of this register: 
° If CNTHPS_CTL_EL2.ENABLE is 0, the value returned is UNKNOWN. 


e If CNTHPS_CTL_EL2.ENABLE is 1, the value returned is (CNTHPS_CVAL_EL2 - 
CNTPCT_ELO). 


On a write of this register, CNTHPS CVAL_EL2 is set to (CNTPCT_ELO + TimerValue), where 
TimerValue is treated as a signed 32-bit integer. 


When CNTHPS CTL _EL2.ENABLE is 1, the timer condition is met when (CNTPCT_ELO - 
CNTHPS_CVAL EL2) is greater than or equal to zero. This means that TimerValue acts like a 
32-bit downcounter timer. When the timer condition is met: 


° CNTHPS_CTL_EL2.ISTATUS is set to 1. 
s If CNTHPS_CTL_EL2.IMASK is 0, an interrupt is generated. 


When CNTHPS CTL _EL2.ENABLE is 0, the timer condition is not met, but CNTPCT_ELO 
continues to count, so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTHPS_TVAL 


This register is accessed using the encoding for CNTP_TVAL. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELOPTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_TVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_TVAL_EL2; 
else 
return CNTP_TVAL; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return CNTP_TVAL_S; 
else 
return CNTP_TVAL_NS; 





else 
return CNTP_TVAL; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CNTP_TVAL_NS; 
else 
return CNTP_TVAL; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
return CNTP_TVAL_S; 
else 





return CNTP_TVAL_NS; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELOPTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 
then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_TVAL_EL2 = R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_TVAL_EL2 = R[t]; 
else 
CNTP_TVAL = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
CNTP_TVAL_S = R[t]; 
else 
CNTP_TVAL_NS = R[t]; 





else 
CNTP_TVAL = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
CNTP_TVAL_NS = R[t]; 
else 
CNTP_TVAL = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
CNTP_TVAL_S = R[t]; 
else 





CNTP_TVAL_NS = R[t]; 
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G8.7.9 CNTHV_CTL, Counter-timer Virtual Timer Control register (EL2) 


The CNTHV_CTL characteristics are: 


Purpose 


Provides AArch32 access to the control register for the EL2 virtual timer. 


Note 
The EL2 virtual timer is implemented by ARMv8.1-VHE. It is only accessible from AArch32 state 
when ELO is using AArch32, EL2 is using AArch64, and the value of HCR_EL2.{E2H, TGE} is 


hore 








Configurations 


Attributes 


AArch32 System register CNTHV_CTL[31:0] is architecturally mapped to AArch64 System 
register CNTHV_CTL_EL2[31:0]. 

This register is present only when ARMVv8.1-VHE is implemented. Otherwise, direct accesses to 
CNTHV_CTL are UNDEFINED. 

RW fields in this register reset to architecturally UNKNOWN values. 


CNTHV_CTL is a 32-bit register. 


Field descriptions 


The CNTHV_CTL bit assignments are: 


31 


3210 


RESO ii 


Bits [31:3] 


L ENABLE 
IMASK 


ISTATUS 


Reserved, RESO. 


ISTATUS, bit [2] 


The status of the timer. This bit indicates whether the timer condition is met: 
b0 Timer condition is not met. 
Qb1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 


G8-6654 


Timer interrupt mask bit. Permitted values are: 


Qbd Timer interrupt is not masked by the IMASK bit. 
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Qb1 Timer interrupt is masked by the IMASK bit. 

For more information, see the description of the ISTATUS bit. 
ENABLE, bit [0] 

Enables the timer. Permitted values are: 

Qbe Timer disabled. 

Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTHV_TVAL continues to count down. 


Note 


Disabling the output signal might be a power-saving option. 








Accessing the CNTHV_CTL 
This register is accessed using the encoding for CNTV_CTL. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1110 Ob0011 Ob001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 


s 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CTL_EL2; 
else 
return CNTV_CTL; 
elsif PSTATE.EL == EL1 then 
return CNTV_CTL; 
elsif PSTATE.EL == EL2 then 
return CNTV_CTL; 
elsif PSTATE.EL == EL3 then 
return CNTV_CTL; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1110 Ob0011 Ob001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 
then 


s 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CTL_EL2 = R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CTL_EL2 = R[t]; 
else 
CNTV_CTL = R[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_CTL = R[t]; 
elsif PSTATE.EL == EL2 then 
CNTV_CTL = R[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CTL = R[t]; 
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G8.7.10 CNTHV_CVAL, Counter-timer Virtual Timer CompareValue register (EL2) 
The CNTHV_CVAL characteristics are: 


Purpose 
Provides AArch32 access to the compare value for the EL2 virtual timer. 


Note 


The EL2 virtual timer is implemented by ARMv8.1-VHE. It is only accessible from AArch32 state 
when ELO is using AArch32, EL2 is using AArch64, and the value of HCR_EL2.{E2H, TGE} is 
{1, 1}. 








Configurations 


AArch32 System register CNTHV_CVAL[63:0] is architecturally mapped to AArch64 System 
register CNTHV_CVAL_EL2[63:0]. 


This register is present only when ARMV8.1-VHE is implemented. Otherwise, direct accesses to 
CNTHV_CVAL are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHV_CVAL is a 64-bit register. 


Field descriptions 


The CNTHV_CVAL bit assignments are: 


63 0 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL2 virtual timer CompareValue. 


When CNTHV_CTL.ENABLE is 1, the timer condition is met when (CNT VCT - Compare Value) 
is greater than or equal to zero. This means that Compare Value acts like a 64-bit upcounter timer. 
When the timer condition is met: 


° CNTHV_CTL.ISTATUS is set to 1. 
. If CNTHV_CTL.IMASK is 0, an interrupt is generated. 


When CNTHV_CTL.ENABLE is 0, the timer condition is not met, but CNTVCT continues to 
count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


Accessing the CNTHV_CVAL 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 


0b1111 0b1110 0b0011 





if PSTATE.EL == EL@ then 


if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELOQVTEN == 
then 


s 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CVAL_EL2; 
else 
return CNTV_CVAL; 
elsif PSTATE.EL == EL1 then 
return CNTV_CVAL; 
elsif PSTATE.EL == EL2 then 
return CNTV_CVAL; 
elsif PSTATE.EL == EL3 then 
return CNTV_CVAL; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


coproc CRm opc1 


0b1111 0b1110 0b0011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PL@VTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CVAL_EL2 = R[t2]:R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CVAL_EL2 = R[t2]:R[t]; 
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else 
CNTV_CVAL = R[t2]:R[t]; 

elsif PSTATE.EL == EL1 then 

CNTV_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL2 then 

CNTV_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 

CNTV_CVAL = R[t2]:R[t]; 
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G8.7.11 CNTHV_TVAL, Counter-timer Virtual Timer TimerValue register (EL2) 
The CNTHV_TVAL characteristics are: 


Purpose 


Provides AArch32 access to the timer value for the EL2 virtual timer. 


Note 


The EL2 virtual timer is implemented by ARMv8.1-VHE. It is only accessible from AArch32 state 
when ELO is using AArch32, EL2 is using AArch64, and the value of HCR_EL2.{E2H, TGE} is 


hore 








Configurations 


AArch32 System register CNTHV_TVAL[31:0] is architecturally mapped to AArch64 System 
register CNTHV_TVAL EL2[31:0]. 


This register is present only when ARMVv8.1-VHE is implemented. Otherwise, direct accesses to 
CNTHV_TVAL are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHV_TVAL is a 32-bit register. 


Field descriptions 


The CNTHV_TVAL bit assignments are: 


31 0 


TimerValue 


Timer Value, bits [31:0] 
The TimerValue view of the EL2 virtual timer. 
On a read of this register: 
. If CNTHV_CTL.ENABLE is 0, the value returned is UNKNOWN. 
° If CNTHV_CTL.ENABLE is 1, the value returned is (CNTHV_CVAL - CNTVCT). 


On a write of this register, CNTHV_CVAL is set to (CNTVCT + TimerValue), where Timer Value 
is treated as a signed 32-bit integer. 


When CNTHV_CTL.ENABLE is 1, the timer condition is met when (CNTVCT - CNTHV_CVAL) 
is greater than or equal to zero. This means that TimerValue acts like a 32-bit downcounter timer. 
When the timer condition is met: 


° CNTHV_CTL.ISTATUS is set to 1. 
. If CNTHV_CTL.IMASK is 0, an interrupt is generated. 
When CNTHV_CTL.ENABLE is 0, the timer condition is not met, but CNTVCT continues to 


count, so the TimerValue view appears to continue to count down. 
Accessing the CNTHV_TVAL 
This register is accessed using the encoding for CNTV_TVAL. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 0b1110 Ob0011 0b000 





if PSTATE.EL == EL@ then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '@' then 
return CNTHVS_TVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_TVAL_EL2; 
else 
return CNTV_TVAL; 
elsif PSTATE.EL == EL1 then 
return CNTV_TVAL; 
elsif PSTATE.EL == EL2 then 
return CNTV_TVAL; 
elsif PSTATE.EL == EL3 then 
return CNTV_TVAL; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 0b1110 Ob0011 0b000 





if PSTATE.EL == ELO then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '@' then 
CNTHVS_TVAL_EL2 = R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_TVAL_EL2 = R[t]; 
else 
CNTV_TVAL = R[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_TVAL = R[t]; 
elsif PSTATE.EL == EL2 then 
CNTV_TVAL = R[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_TVAL = R[t]; 
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G8.7.12 


G8-6662 


CNTHVS_CTL, Counter-timer Secure Virtual Timer Control Register (EL2) 


The CNTHVS CTL characteristics are: 


Purpose 
Provides AArch32 access to the Secure EL2 virtual timer. 


Note 


The Secure EL2 timer is implemented by ARMv8.4-SecEL2. It is only accessible from AArch32 
state when EL2 is using AArch64 and the value of SCR_EL3.{EEL2, NS} is {1, 0}. 








Configurations 


AArch32 System register CNTHVS_CTL[31:0] is architecturally mapped to AArch64 System 
register CNTHVS_CTL_EL2[31:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHVS_CTL are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHVS CTL is a 32-bit register. 


Field descriptions 


The CNTHVS CTL bit assignments are: 


31 32 1 0 


RESO p 
L ENABLE 
IMASK 


ISTATUS 


Bits [31:3] 


Reserved, RESO. 


ISTATUS, bit [2] 
The status of the timer. This bit indicates whether the timer condition is met: 
Ob Timer condition is not met. 
Qb1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 


Timer interrupt mask bit. Permitted values are: 


Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 
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For more information, see the description of the ISTATUS bit. 
ENABLE, bit [0] 

Enables the timer. Permitted values are: 

Ob Timer disabled. 

Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTHVS_TVAL continues to count down. 


Note 


Disabling the output signal might be a power-saving option. 








Accessing the CNTHVS_CTL 
This register is accessed using the encoding for CNTV_CTL. 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opci CRn CRm opc2 





0b1111 0b000 0b1110 0b0011 0b001 


if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 
then 


s 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '@' then 
return CNTHVS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CTL_EL2; 
else 
return CNTV_CTL; 
elsif PSTATE.EL == EL1 then 
return CNTV_CTL; 
elsif PSTATE.EL == EL2 then 
return CNTV_CTL; 
elsif PSTATE.EL == EL3 then 
return CNTV_CTL; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1110 Ob0011 Ob001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 
then 


s 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CTL_EL2 = R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CTL_EL2 = R[t]; 
else 
CNTV_CTL = R[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_CTL = R[t]; 
elsif PSTATE.EL == EL2 then 
CNTV_CTL = R[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CTL = R[t]; 
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G8.7.13 CNTHVS_CVAL, Counter-timer Secure Virtual Timer CompareValue Register (EL2) 
The CNTHVS_CVAL characteristics are: 
Purpose 
Provides AArch32 access to the compare value for the Secure EL2 virtual timer. 


Note 


The Secure EL2 timer is implemented by ARMv8.4-SecEL2. It is only accessible from AArch32 
state when EL2 is using AArch64 and the value of SCR_EL3.{EEL2, NS} is {1, 0}. 








Configurations 


AArch32 System register CNTHVS_CVAL[63:0] is architecturally mapped to AArch64 System 
register CNTHVS_CVAL_EL2[63:0]. 


This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHVS_CVAL are UNDEFINED. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTHVS _CVAL is a 64-bit register. 


Field descriptions 


The CNTHVS CVAL bit assignments are: 


63 0 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL2 virtual timer CompareValue. 


When CNTHVS_CTL.ENABLE is 1, the timer condition is met when (CNTVCT - CompareValue) 
is greater than or equal to zero. This means that Compare Value acts like a 64-bit upcounter timer. 
When the timer condition is met: 


° CNTHVS_CTL.ISTATUS is set to 1. 
è If CNTHVS_CTL.IMASK is 0, an interrupt is generated. 


When CNTHVS_CTL.ENABLE is 0, the timer condition is not met, but CNTVCT continues to 
count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


Accessing the CNTHVS_CVAL 
This register is accessed using the encoding for CNTV_CVAL. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 


0b1111 0b1110 0b0011 





if PSTATE.EL == EL@ then 


if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELOQVTEN == 
then 


s 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CVAL_EL2; 
else 
return CNTV_CVAL; 
elsif PSTATE.EL == EL1 then 
return CNTV_CVAL; 
elsif PSTATE.EL == EL2 then 
return CNTV_CVAL; 
elsif PSTATE.EL == EL3 then 
return CNTV_CVAL; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


coproc CRm opc1 


0b1111 0b1110 0b0011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PL@VTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CVAL_EL2 = R[t2]:R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CVAL_EL2 = R[t2]:R[t]; 
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else 
CNTV_CVAL = R[t2]:R[t]; 

elsif PSTATE.EL == EL1 then 

CNTV_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL2 then 

CNTV_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 

CNTV_CVAL = R[t2]:R[t]; 
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G8.7.14 CNTHVS_TVAL, Counter-timer Secure Virtual Timer TimerValue Register (EL2) 


The CNTHVS_TVAL characteristics are: 








Purpose 
Provides AArch32 access to the timer value for the Secure EL2 virtual timer. 
Note 
The Secure EL2 timer is implemented by ARMv8.4-SecEL2. It is only accessible from AArch32 
state when EL2 is using AArch64 and the value of SCR_EL3.{EEL2, NS} is {1, 0}. 
Configurations 
AArch32 System register CNTHVS_TVAL[31:0] is architecturally mapped to AArch64 System 
register CNTHVS_TVAL EL2[31:0]. 
This register is present only when ARMv8.4-SecEL2 is implemented. Otherwise, direct accesses to 
CNTHVS_TVAL are UNDEFINED. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTHVS_TVAL is a 32-bit register. 


Field descriptions 


The CNTHVS_TVAL bit assignments are: 


31 0 


TimerValue 


Timer Value, bits [31:0] 
The TimerValue view of the EL2 virtual timer. 
On a read of this register: 
° If CNTHVS_CTL.ENABLE is 0, the value returned is UNKNOWN. 
° If CNTHVS_CTL.ENABLE is 1, the value returned is (CNTHVS_CVAL - CNTVCT). 


Ona write of this register, CNTHVS_CVAL is set to (CNTVCT + TimerValue), where TimerValue 
is treated as a signed 32-bit integer. 


When CNTHVS_CTL.ENABLE is 1, the timer condition is met when (CNTVCT - 
CNTHVS_CVAL) is greater than or equal to zero. This means that TimerValue acts like a 32-bit 
downcounter timer. When the timer condition is met: 


° CNTHVS_CTL.ISTATUS is set to 1. 
s If CNTHVS_CTL.IMASK is 0, an interrupt is generated. 


When CNTHVS_CTL.ENABLE is 0, the timer condition is not met, but CNTVCT continues to 
count, so the TimerValue view appears to continue to count down. 


Accessing the CNTHVS_TVAL 
This register is accessed using the encoding for CNTV_TVAL. 


Accesses to this register use the following encodings in the System instruction encoding space: 
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MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 0b1110 Ob0011 0b000 





if PSTATE.EL == EL@ then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '@' then 
return CNTHVS_TVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_TVAL_EL2; 
else 
return CNTV_TVAL; 
elsif PSTATE.EL == EL1 then 
return CNTV_TVAL; 
elsif PSTATE.EL == EL2 then 
return CNTV_TVAL; 
elsif PSTATE.EL == EL3 then 
return CNTV_TVAL; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci CRn CRm opc2 





Ob1111 0b000 0b1110 Ob0011 0b000 





if PSTATE.EL == ELO then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '@' then 
CNTHVS_TVAL_EL2 = R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_TVAL_EL2 = R[t]; 
else 
CNTV_TVAL = R[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_TVAL = R[t]; 
elsif PSTATE.EL == EL2 then 
CNTV_TVAL = R[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_TVAL = R[t]; 
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G8.7.15 CNTKCTL, Counter-timer Kernel Control register 


The CNTKCTL characteristics are: 


Purpose 
Controls the generation of an event stream from the virtual counter, and access from ELO modes to 
the physical counter, virtual counter, EL1 physical timers, and the virtual timer. 

Configurations 
AArch32 System register CNTKCTL[31:0] is architecturally mapped to AArch64 System register 
CNTKCTL_EL1[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 

Attributes 


CNTKCTL is a 32-bit register. 


Field descriptions 


The CNTKCTL bit assignments are: 


L PLOPCTEN 
PLOVCTEN 


EVNTEN 
EVNTDIR 
PLOVTEN 
PLOPTEN 
Bits [31:10] 
Reserved, RESO. 
PLOPTEN, bit [9] 
Traps PLO accesses to the physical timer registers to Undefined mode. 
Qbd PLO accesses to the CNTP_CTL, CNTP_CVAL, and CNTP_TVAL registers are trapped 
to Undefined mode. 
Qb1 This control does not cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


PLOVTEN, bit [8] 
Traps PLO accesses to the virtual timer registers to Undefined mode. 


Qbd PLO accesses to the CNTV_CTL, CNTV_CVAL, and CNTV_TVAL registers are 
trapped to Undefined mode. 


Qb1 This control does not cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


EVNTI, bits [7:4] 
Selects which bit (0 to 15) of the counter register CNTVCT is the trigger for the event stream 
generated from that counter, when that stream is enabled. 


This field resets to an architecturally UNKNOWN value. 
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EVNTDIR, bit [3] 


Controls which transition of the counter register CNT VCT trigger bit, defined by EVNTI, generates 
an event when the event stream is enabled: 


Qbd A 0 to 1 transition of the trigger bit triggers an event. 
Qb1 A 1 to 0 transition of the trigger bit triggers an event. 


This field resets to an architecturally UNKNOWN value. 


EVNTEN, bit [2] 
Enables the generation of an event stream from the counter register CNT VCT: 
Qbd Disables the event stream. 
Qb1 Enables the event stream. 


This field resets to an architecturally UNKNOWN value. 


PLOVCTEN, bit [1] 
Traps PLO accesses to the frequency register and virtual counter register to Undefined mode. 


0bd PLO accesses to the CNTVCT are trapped to Undefined mode. 


PLO accesses to the CNTFRQ register are trapped to Undefined mode, if 
CNTKCTL.PLOPCTEN is also 0. 


Qb1 This control does not cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


PLOPCTEN, bit [0] 
Traps PLO accesses to the frequency register and physical counter register to Undefined mode. 


0bd PLO accesses to the CNTPCT are trapped to Undefined mode. 


PLO accesses to the CNTFRQ register are trapped to Undefined mode, if 
CNTKCTL.PLOVCTEN is also 0. 


Qb1 This control does not cause any instructions to be trapped. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTKCTL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 0b1110 0b0001 0b000 


if PSTATE.EL == EL@ then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
return CNTKCTL; 

elsif PSTATE.EL == EL2 then 
return CNTKCTL; 

elsif PSTATE.EL == EL3 then 
return CNTKCTL; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1110 0b0001 0b000 





if PSTATE.EL == ELO then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
CNTKCTL = R[t]; 

elsif PSTATE.EL == EL2 then 
CNTKCTL = R[t]; 

elsif PSTATE.EL == EL3 then 
CNTKCTL = R[t]; 
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G8.7.16 CNTP_CTL, Counter-timer Physical Timer Control register 


ARM DDI 0487E.a 
ID070919 


The CNTP_CTL characteristics are: 


Purpose 
Control register for the EL1 physical timer. 

Configurations 
AArch32 System register CNTP_CTL[31:0] is architecturally mapped to AArch64 System register 
CNTP_CTL_ELO[31:0]. 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. If the PE resets into EL3 using AArch32 they apply 
only to the Secure instance of the register. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


CNTP_CTL is a 32-bit register. 


Field descriptions 


The CNTP_CTL bit assignments are: 


31 


3210 


RESO gi 


Bits [31:3] 


L ENABLE 
IMASK 


ISTATUS 


Reserved, RESO. 


ISTATUS, bit [2] 


The status of the timer. This bit indicates whether the timer condition is met: 
Oba Timer condition is not met. 
Qb1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 


Timer interrupt mask bit. Permitted values are: 

Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 

For more information, see the description of the ISTATUS bit. 


This field resets to an architecturally UNKNOWN value. 
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ENABLE, bit [0] 
Enables the timer. Permitted values are: 
Ob Timer disabled. 
Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTP_TVAL continues to count down. 





Note 


Disabling the output signal might be a power-saving option. 





This field resets to Q. 


Accessing the CNTP_CTL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1110 0b0010 Ob001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQPTEN == 'Q' 


then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PL@PTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQPTEN == 'Q' 
then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(Q@xQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CTL_EL2; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CTL_EL2; 

else 
return CNTP_CTL; 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
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return CNTP_CTL_S; 
else 
return CNTP_CTL_NS; 
else 
return CNTP_CTL; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CNTP_CTL_NS; 
else 
return CNTP_CTL; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return CNTP_CTL_S; 
else 
return CNTP_CTL_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opci1 CRn CRm opc2 





Ob1111 0b000 = 0b1110 O0b0010 Ob001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQPTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHPS_CTL_EL2 = R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHP_CTL_EL2 = R[t]; 
else 
CNTP_CTL = R[t]; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
CNTP_CTL_S = R[t]; 
else 
CNTP_CTL_NS = R[t]; 





else 
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elsif PS 
if H 


else 


elsif PS 
if S 


else 
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CNTP_CTL = R[t]; 

TATE.EL == EL2 then 

aveEL(EL3) && ELUsingAArch32(EL3) then 
CNTP_CTL_NS = R[t]; 


CNTP_CTL = R[t]; 
TATE.EL == EL3 then 
CR.NS == '@' then 
CNTP_CTL_S = R[t]; 





CNTP_CTL_NS = R[t]; 
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G8.7.17 CNTP_CVAL, Counter-timer Physical Timer CompareValue register 


63 


ARM DDI 0487E.a 
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The CNTP_CVAL characteristics are: 


Purpose 
Holds the compare value for the EL1 physical timer. 
Configurations 
AArch32 System register CNTP_CVAL[63:0] is architecturally mapped to AArch64 System 
register CNTP_CVAL_EL0[63:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTP_CVAL is a 64-bit register. 


Field descriptions 


The CNTP_CVAL bit assignments are: 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL1 physical timer CompareValue. 


When CNTP_CTL.ENABLE is 1, the timer condition is met when (CNTPCT - Compare Value) is 
greater than or equal to zero. This means that CompareValue acts like a 64-bit upcounter timer. 
When the timer condition is met: 


° CNTP_CTL.ISTATUS is set to 1. 
` If CNTP_CTL.IMASK is 0, an interrupt is generated. 
When CNTP_CTL.ENABLE is 0, the timer condition is not met, but CNTPCT continues to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTP_CVAL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1111 0b1110 0b0010 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PL@PTEN == 'Q' then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQPTEN == 'Q' 
then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_CVAL_EL2; 
else 
return CNTP_CVAL; 
elsif PSTATE.EL == EL1 then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(Qx04) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
return CNTP_CVAL_S; 
else 
return CNTP_CVAL_NS; 





else 
return CNTP_CVAL; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CNTP_CVAL_NS; 
else 
return CNTP_CVAL; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return CNTP_CVAL_S; 
else 





return CNTP_CVAL_NS; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





Ob1111 0b1110 0b0010 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQPTEN == 'Q' 


then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

else 
AArch64.AArch32SystemAccessTrap(EL1, x04); 

elsif ELUsingAArch32(EL1) && CNTKCTL.PL@PTEN == '@' then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
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elsi 


elsi 
then 


elsi 
then 


elsi 


elsi 


AArch32 System Register Descriptions 


else 
UNDEFINED; 


G8.7 Generic Timer registers 


f EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == '@' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 


f EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 


f EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
f EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(Qx04) ; 





f EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '@' then 





CNTHPS_CVAL_EL2 = R[t2]:R[t]; 





elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 


else 


elsif PS 


CNTHP_CVAL_EL2 = R[t2]:R[t]; 


CNTP_CVAL = R[t2]:R[t]; 
TATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == '@' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 


elsi 


elsi 


else 


elsif PS 
if H 


else 


elsif PS 
if S 


else 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
f EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(Qx04) ; 
f HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
CNTP_CVAL_S = R[t2]:R[t]; 
else 
CNTP_CVAL_NS = R[t2]:R[t]; 


CNTP_CVAL = R[t2]:R[t]; 

TATE.EL == EL2 then 

aveEL(EL3) && ELUsingAArch32(EL3) then 
CNTP_CVAL_NS = R[t2]:R[t]; 


CNTP_CVAL = R[t2]:R[t]; 
TATE.EL == EL3 then 
CR.NS == 'Q' then 
CNTP_CVAL_S = R[t2]:R[t]; 


CNTP_CVAL_NS = R[t2]:R[t]; 
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G8.7.18 CNTP_TVAL, Counter-timer Physical Timer TimerValue register 


The CNTP_TVAL characteristics are: 


Purpose 
Holds the timer value for the EL1 physical timer. 
Configurations 
AArch32 System register CNTP_TVAL[31:0] is architecturally mapped to AArch64 System 
register CNTP_TVAL_ ELO[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTP_TVAL is a 32-bit register. 


Field descriptions 


The CNTP_TVAL bit assignments are: 


31 0 


TimerValue 


Timer Value, bits [31:0] 
The TimerValue view of the EL1 physical timer. 
On a read of this register: 
: If CNTP_CTL.ENABLE is 0, the value returned is UNKNOWN. 
. If CNTP_CTL.ENABLE is 1, the value returned is (CNTP_CVAL - CNTPCT). 


On a write of this register, CNTP_CVAL is set to (CNTPCT + TimerValue), where TimerValue is 
treated as a signed 32-bit integer. 


When CNTP_CTL.ENABLE is 1, the timer condition is met when (CNTPCT - CNTP_CVAL) is 
greater than or equal to zero. This means that TimerValue acts like a 32-bit downcounter timer. 
When the timer condition is met: 


° CNTP_CTL.ISTATUS is set to 1. 
s If CNTP_CTL.IMASK is 0, an interrupt is generated. 


When CNTP_CTL.ENABLE is 0, the timer condition is not met, but CNTPCT continues to count, 
so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTP_TVAL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 = 0b1110 0b0010 0b000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQPTEN == 'Q' 


then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PTEN == 'Q' 


then 

AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == '@' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHPS_TVAL_EL2; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHP_TVAL_EL2; 

else 
return CNTP_TVAL; 

elsif PSTATE.EL == EL1 then 

if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 
AArch32.TakeHypTrapException(QxQ3) ; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 

return CNTP_TVAL_S; 
else 
return CNTP_TVAL_NS; 








else 
return CNTP_TVAL; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
return CNTP_TVAL_NS; 
else 
return CNTP_TVAL; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == 'Q' then 
return CNTP_TVAL_S; 
else 





return CNTP_TVAL_NS; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 


coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1110 0b0010 0b000 


if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@PTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
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elsif ELUsingAArch32(EL1) && CNTKCTL.PL@PTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PTEN == 'Q' 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQPTEN == 'Q' 


then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 


AArch32.TakeHypTrapException(QxQ3) ; 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 


CNTHPS_TVAL_EL2 = R[t]; 





elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 


CNTHP_TVAL_EL2 = R[t]; 
else 
CNTP_TVAL = R[t]; 
elsif PSTATE.EL == EL1 then 


if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '@' && CNTHCTL_EL2.EL1PCEN == '@' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == '1' && CNTHCTL_EL2.EL1PTEN == 'Q' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 


elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCEN == 'Q' then 


AArch32.TakeHypTrapException(QxQ3) ; 
elsif HaveEL(EL3) && ELUsingAArch32(EL3) then 
if SCR.NS == 'Q' then 
CNTP_TVAL_S = R[t]; 
else 
CNTP_TVAL_NS = R[t]; 
else 
CNTP_TVAL = R[t]; 
elsif PSTATE.EL == EL2 then 
if HaveEL(EL3) && ELUsingAArch32(EL3) then 
CNTP_TVAL_NS = R[t]; 
else 
CNTP_TVAL = R[t]; 
elsif PSTATE.EL == EL3 then 
if SCR.NS == '@' then 
CNTP_TVAL_S = R[t]; 
else 





CNTP_TVAL_NS = R[t]; 
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G8.7.19 CNTPCT, Counter-timer Physical Count register 


The CNTPCT characteristics are: 


Purpose 
Holds the 64-bit physical count value. 
Configurations 
AArch32 System register CNTPCT[63:0] is architecturally mapped to AArch64 System register 
CNTPCT_EL0[63:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTPCT is a 64-bit register. 


Field descriptions 


The CNTPCT bit assignments are: 


63 0 
Physical count value 


Bits [63:0] 


Physical count value. 


Accessing the CNTPCT 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1111 0b1110 0b0000 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQPCTEN == 
'@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOPCTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.E2H == 'Q' && CNTHCTL_EL2.EL1PCEN == 'Q' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '10' && CNTHCTL_EL2.EL1PCTEN == 
'@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@PCTEN == 
'@' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
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elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCTEN == '@' then 
AArch32.TakeHypTrapException(Qx04) ; 


else 
return CNTPCT; 


elsif PSTATE.EL == EL1 then 


if EL2Enabled() && 


{ELUsingAArch32(EL2) && CNTHCTL_EL2.EL1PCTEN == '@' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && CNTHCTL.PLIPCTEN == '@' then 
AArch32.TakeHypTrapException(Qx04) ; 


else 
return CNTPCT; 





elsif PSTATE.EL == EL2 then 


return CNTPCT; 


elsif PSTATE.EL == EL3 then 


return CNTPCT; 
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G8.7.20 CNTV_CTL, Counter-timer Virtual Timer Control register 


ARM DDI 0487E.a 
ID070919 


The CNTV_CTL characteristics are: 


Purpose 
Control register for the virtual timer. 

Configurations 
AArch32 System register CNTV_CTL[31:0] is architecturally mapped to AArch64 System register 
CNTV_CTL_ELO[31:0]. 
Some or all RW fields of this register have defined reset values. These apply only if the PE resets 
into an Exception level that is using AArch32. Otherwise, RW fields in this register reset to 
architecturally UNKNOWN values. 

Attributes 


CNTV_CTL is a 32-bit register. 


Field descriptions 


The CNTV_CTL bit assignments are: 


31 3210 


RESO al 
L ENABLE 
IMASK 


ISTATUS 


Bits [31:3] 
Reserved, RESO. 


ISTATUS, bit [2] 
The status of the timer. This bit indicates whether the timer condition is met: 
Ob Timer condition is not met. 
0b1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is | and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 
Timer interrupt mask bit. Permitted values are: 
Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 
For more information, see the description of the ISTATUS bit. 
This field resets to an architecturally UNKNOWN value. 
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ENABLE, bit [0] 
Enables the timer. Permitted values are: 
Ob Timer disabled. 
Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTV_TVAL continues to count down. 


Note 


Disabling the output signal might be a power-saving option. 








This field resets to Q. 


Accessing the CNTV_CTL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 





Ob1111 0b000 = 0b1110 Ob0011 Ob001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 
then 


Q' 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CTL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CTL_EL2; 
else 
return CNTV_CTL; 
elsif PSTATE.EL == EL1 then 
return CNTV_CTL; 
elsif PSTATE.EL == EL2 then 
return CNTV_CTL; 
elsif PSTATE.EL == EL3 then 
return CNTV_CTL; 
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MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 0b1110 Ob0011 Ob001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x03); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 
then 


s 


AArch64.AArch32SystemAccessTrap(EL2, 0x03); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CTL_EL2 = R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CTL_EL2 = R[t]; 
else 
CNTV_CTL = R[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_CTL = R[t]; 
elsif PSTATE.EL == EL2 then 
CNTV_CTL = R[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CTL = R[t]; 
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CNTV_CVAL, Counter-timer Virtual Timer CompareValue register 


The CNTV_CVAL characteristics are: 


Purpose 
Holds the compare value for the virtual timer. 
Configurations 
AArch32 System register CNTV_CVAL[63:0] is architecturally mapped to AArch64 System 
register CNTV_CVAL ELO[63:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTV_CVAL is a 64-bit register. 


Field descriptions 


The CNTV_CVAL bit assignments are: 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL1 virtual timer CompareValue. 


When CNTV_CTL.ENABLE is 1, the timer condition is met when (CNT VCT - CompareValue) is 
greater than or equal to zero. This means that CompareValue acts like a 64-bit upcounter timer. 
When the timer condition is met: 


° CNTV_CTL.ISTATUS is set to 1. 
° If CNTV_CTL.IMASK is 0, an interrupt is generated. 
When CNTV_CTL.ENABLE is 0, the timer condition is not met, but CNTVCT continues to count. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTV_CVAL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1111 0b1110 0b0011 





if PSTATE.EL == ELO then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
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if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 

elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 

else 
UNDEFINED; 

elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 
then 


Q' 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
return CNTHVS_CVAL_EL2; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_CVAL_EL2; 
else 
return CNTV_CVAL; 
elsif PSTATE.EL == EL1 then 
return CNTV_CVAL; 
elsif PSTATE.EL == EL2 then 
return CNTV_CVAL; 
elsif PSTATE.EL == EL3 then 
return CNTV_CVAL; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1111 0b1110 0b0011 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.ELQVTEN == 'Q' 
then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.ELQVTEN == 
then 


s 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == 'Q' then 
CNTHVS_CVAL_EL2 = R[t2]:R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_CVAL_EL2 = R[t2]:R[t]; 
else 
CNTV_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL2 then 
CNTV_CVAL = R[t2]:R[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_CVAL = R[t2]:R[t]; 
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G8.7.22 CNTV_TVAL, Counter-timer Virtual Timer TimerValue register 


The CNTV_TVAL characteristics are: 


Purpose 
Holds the timer value for the virtual timer. 
Configurations 
AArch32 System register CNTV_TVAL[31:0] is architecturally mapped to AArch64 System 
register CNTV_TVAL_EL0[31:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
Attributes 


CNTV_TVAL is a 32-bit register. 


Field descriptions 


The CNTV_TVAL bit assignments are: 


31 0 


TimerValue 


Timer Value, bits [31:0] 
The TimerValue view of the virtual timer. 
On a read of this register: 
s If CNTV_CTL.ENABLE is 0, the value returned is UNKNOWN. 
. If CNTV_CTL.ENABLE is 1, the value returned is (CNTV_CVAL - CNTVCT). 


On a write of this register, CNTV_CVAL is set to (CNTVCT + TimerValue), where TimerValue is 
treated as a signed 32-bit integer. 


When CNTP_CTL.ENABLE is 1, the timer condition is met when (CNTVCT - CNTP_CVAL) is 
greater than or equal to zero. This means that TimerValue acts like a 32-bit downcounter timer. 
When the timer condition is met: 


a CNTV_CTL.ISTATUS is setto 1. 
s If CNTV_CTL.IMASK is 0, an interrupt is generated. 


When CNTV_CTL.ENABLE is 0, the timer condition is not met, but CNT VCT continues to count, 
so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTV_TVAL 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 0b1110 Ob0011 0b000 





if PSTATE.EL == EL@ then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '@' then 
return CNTHVS_TVAL_EL2; 
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elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
return CNTHV_TVAL_EL2; 
else 
return CNTV_TVAL; 
elsif PSTATE.EL == EL1 then 
return CNTV_TVAL; 
elsif PSTATE.EL == EL2 then 
return CNTV_TVAL; 
elsif PSTATE.EL == EL3 then 
return CNTV_TVAL; 


MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>} 





coproc opct CRn CRm opc2 


Ob1111 0b000 0b1110 Ob0011 0b000 





if PSTATE.EL == ELO then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '@' then 
CNTHVS_TVAL_EL2 = R[t]; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && SCR_EL3.NS == '1' then 
CNTHV_TVAL_EL2 = R[t]; 
else 
CNTV_TVAL = R[t]; 
elsif PSTATE.EL == EL1 then 
CNTV_TVAL = R[t]; 
elsif PSTATE.EL == EL2 then 
CNTV_TVAL = R[t]; 
elsif PSTATE.EL == EL3 then 
CNTV_TVAL = R[t]; 
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G8.7.23 CNTVCT, Counter-timer Virtual Count register 
The CNTVCT characteristics are: 


Purpose 


Holds the 64-bit virtual count value. The virtual count value is equal to the physical count value 
visible in CNTPCT minus the virtual offset visible in CNT VOFF. 


Configurations 


AArch32 System register CNTVCT[63:0] is architecturally mapped to AArch64 System register 
CNTVCT_ELO[63:0]. 


The value of this register is the same as the value of CNTPCT in the following conditions: 
. When EL2 is not implemented. 


. When EL2 is implemented and is using AArch64, HCR_EL2. {E2H, TGE} is {1, 1}, and this 
register is read from Non-secure ELO. 


RW fields in this register reset to architecturally UNKNOWN values. 


Attributes 
CNTVCT is a 64-bit register. 


Field descriptions 


The CNTVCT bit assignments are: 


63 0 
Virtual count value 


Bits [63:0] 


Virtual count value. 


Accessing the CNTVCT 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1111 0b1110 0b0001 





if PSTATE.EL == EL@ then 
if !ELUsingAArch32(EL1) && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') && CNTKCTL_EL1.EL@VCTEN == 
'@' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
else 
AArch64.AArch32SystemAccessTrap(EL1, 0x04); 
elsif ELUsingAArch32(EL1) && CNTKCTL.PLOVCTEN == 'Q' then 
if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.AArch32SystemAccessTrap(EL2, 0x04); 
elsif EL2Enabled() && ELUsingAArch32(EL2) && HCR.TGE == '1' then 
AArch32.TakeHypTrapException(0xQQ) ; 
else 
UNDEFINED; 
elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<E2H,TGE> == '11' && CNTHCTL_EL2.EL@VCTEN == 
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'@' then 


AArch64.AArch32SystemAccessTrap(EL2, 0x04); 


else 


return CNTVCT; 


elsif PSTATE.EL == 
return CNTVCT; 
elsif PSTATE.EL == 
return CNTVCT; 
elsif PSTATE.EL == 
return CNTVCT; 
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G8.7.24 CNTVOFF, Counter-timer Virtual Offset register 
The CNTVOFF characteristics are: 


Purpose 
Holds the 64-bit virtual offset. This is the offset between the physical count value visible in 
CNTPCT and the virtual count value visible in CNTVCT. 

Configurations 


AArch32 System register CNTVOFF[63:0] is architecturally mapped to AArch64 System register 
CNTVOFF_EL2[63:0]. 


If EL2 is not implemented, this register is RESO from EL3 and the virtual counter uses a fixed virtual 
offset of zero. 
Note 


When EL2 is implemented and is using AArché4, if HCR_EL2.{E2H, TGE} is {1, 1}, the virtual 
counter uses a fixed virtual offset of zero when CNTVCT is read from Non-secure ELO. 





When EL2 is implemented and can use AArch32, on a reset into an Exception level that is using 
AArch32 this register resets to an IMPLEMENTATION DEFINED value that might be UNKNOWN. 


Attributes 
CNTVOFF is a 64-bit register. 


Field descriptions 


The CNTVOFF bit assignments are: 


63 0 


Virtual offset 


Bits [63:0] 
Virtual offset. 


If the Generic counter is implemented at a size less than 64 bits, then this field is permitted to be 
implemented at the same width as the counter, and the upper bits are RESO. 


The value of this field is treated as zero-extended in all counter calculations. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTVOFF 


Accesses to this register use the following encodings in the System instruction encoding space: 


MRRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 


coproc CRm opc1 





0b1111 0b1110 0b0100 


if PSTATE.EL == EL@ then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
return CNTVOFF; 
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elsif PSTATE.EL == EL3 then 
return CNTVOFF; 


MCRR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <Rt2>, <CRm> 





coproc CRm opc1 





0b1111 0b1110 0b0100 





if PSTATE.EL == ELO then 
UNDEFINED; 

elsif PSTATE.EL == EL1 then 
UNDEFINED; 

elsif PSTATE.EL == EL2 then 
CNTVOFF = R[t2]:R[t]; 

elsif PSTATE.EL == EL3 then 
CNTVOFF = R[t2]:R[t]; 
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Part H 


External Debug 


Chapter H1 
About External Debug 


This chapter gives an overview of Armv8 external debug, and specifies the required debug authentication. It 
contains the following sections: 


$ Introduction to external debug on page H1-6700. 
7 External debug on page H1-6701. 
. Required debug authentication on page H1-6702. 








Note 
For information about self-hosted debug, see Chapter D2 AArch64 Self-hosted Debug and Chapter G2 AArch32 
Self-hosted Debug. 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H1-6699 


ID070919 Non-Confidential 


About External Debug 


H1.1 Introduction to external debug 


H1.1 Introduction to external debug 


Armv8 supports both: 


Self-hosted debug 
The PE itself hosts a debugger. That is, developers developing software to run on the PE use 
debugger software running on the same PE. 

External debug 


The debugger is external to the PE. The debugging might be either on-chip, for example in a second 
PE, or off-chip, for example a JTAG debugger that accesses the chip through a Debug Access Port. 


External debug is particularly useful for: 


° Hardware bring-up. That is, debugging during development when a system is first powered 
up and not all of the software functionality is available. 


° PEs that are deeply embedded inside systems. 


To support external debug, the Arm architecture defines required features that are called external 
debug features. 


Note 


An external debugger has a potentially high level of control over and visibility into the PE. The 
system sets this level using debug authentication. See Required debug authentication on 
page H1-6702. 





Ifthe debug authentication level is set too low, agents may be able to bypass elements of the security 
and privilege models. This includes both off-chip agents and on-chip agents such as unprivileged or 
Non-secure software. 





H1.1.1 Definition and constraints of a debugger in the context of external debug 


H1-6700 


When the description of external debug in this Part of the manual describes a debugger as controlling external debug 
this debugger might be a second on-chip PE or an off-chip device such as a JTAG debugger using a Debug Access 
Port (DAP). 


Ifa Debug Access Port is implemented: 


° When debug is prohibited at the Debug Access Port, the port must not generate accesses to the external debug 
interface of the PE. 


° When Secure debug is prohibited at the Debug Access Port, the port must not generate Secure accesses to the 
external debug interface of the PE. 


. When Secure accesses are allowed at the Debug Access Port, the port must be able to generate Secure 
accesses. 


If ARMv8.4-Debug is not implemented, accesses to the PE are controlled by the external authentication interface 
functions, External InvasiveDebugEnabled(), ExternalNoninvasiveDebugEnabled(), 
ExternalSecureNoninvasiveDebugEnabled() and ExternalSecureInvasiveDebugEnabled(). The external authentication 
interface functions override MDCR_EL3.{EPMAD, EDAD}. 


If ARMv8.4-Trace is implemented, the bus master, which may be the Debug Access Port, controls the accesses it 
makes to the PE and MDCR_EL3.{EPMAD, EDAD} control Non-secure access to registers. 


The Debug Access Port is not required to use the same authentication interface as the PE. 


Arm recommends the following authentication interface: 
. When ExternalSecureInvasiveDebugEnabled()== FALSE at the PE, Secure debug is disabled at the DAP. 
° When ExternalInvasiveDebugEnabled()== FALSE at the PE, all debug is prohibited at the DAP. 
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Debug events allow an external debugger to halt the PE. Armv8 provides the following debug events: 


Halting Step debug events on page H3-6746: 

— The debugger can use this resource to make the PE step through code one line at a time. 
Halt Instruction debug event on page H3-6756: 

— This might occur when software executes the Halting breakpoint instruction, HLT. 
Exception Catch debug event on page H3-6757: 

— This can be programmed to occur on all entries to a given Exception level. 
External Debug Request debug event on page H3-6761: 

— An embedded cross-trigger can signal this debug event. 

OS Unlock Catch debug event on page H3-6762: 

— This might occur when the state of the OS Lock changes from locked to unlocked. 
Reset Catch debug events on page H3-6763: 

— This might occur when the PE exits reset state. 

Software Access debug event on page H3-6764: 


— This can be programmed to occur when software tries to access the Breakpoint Value registers, the 
Breakpoint Control registers, the Watchpoint value registers, or the Watchpoint Control registers. It 
caused a trap to Debug state. 


Breakpoints and watchpoints can also halt the PE. 


When the PE is in Debug state: 


It stops executing instructions from the location indicated by the program counter, and is instead controlled 
through the external debug interface. 


The Instruction Transfer Register, ITR, passes instructions to the PE to execute in Debug state: 


— The ITR contains a single register, EDITR, and associated flow-control flags. 


The Debug Communications Channel, DCC, passes data between the PE and the debugger: 
— The DCC includes the data transfer registers, DTRRX and DTRTX, and associated flow-control flags. 
— Although the DCC is an essential part of Debug state operation, it can also be used in Non-debug state. 


The PE cannot service any interrupts in Debug state. 


Chapter H2 Debug State describes Debug state in more detail. 
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H1.3 Required debug authentication 


Any implementation must provide the debug authentication defined in this section, that controls: 
s Whether the PE can halt. 

° Whether non-invasive debug is permitted. 

. Some legacy aspects of the AArch32 self-hosted debug model. 


The pseudocode functions shown in Table H1-1, and the conditions that follow that table, define the architectural 
requirements for debug authentication. 


Table H1-1 Debug authentication functions 





Pseudocode function Description 





ExternalSecureNoninvasiveDebugEnabled() Returns TRUE if Secure non-invasive debug is enabled. 





AArch32.SelfHostedSecurePrivilegedInvasiveDebugEnabled() Returns TRUE if Secure invasive self-hosted debug is enabled in 
AArch32 state. 














ExternalSecureInvasiveDebugEnabled() Returns TRUE if Secure invasive debug is enabled. 
ExternalNoninvasiveDebugEnab]ed() Returns TRUE if Non-secure non-invasive debug is enabled. 
External InvasiveDebugEnab1ed() Returns TRUE if Non-secure invasive debug is enabled. 





The following conditions always apply: 

. If External InvasiveDebugEnabled() is FALSE then ExternalSecureInvasiveDebugEnabled() is FALSE. 

. If ExternalNoninvasiveDebugEnabled() is FALSE then ExternalSecureNoninvasiveDebugEnabled() is FALSE. 
. If External InvasiveDebugEnabled() is TRUE then ExternalNoninvasiveDebugEnabled() is TRUE. 

° If ExternalSecureInvasiveDebugEnabled() is TRUE then External SecureNoninvasiveDebugEnabled() is TRUE. 


If ARMv8.4-Debug is implemented: 
e ExternalNoninvasiveDebugEnabled() always returns TRUE. 


. ExternalSecureNoninvasiveDebugEnabled()returns the same as ExternalSecureInvasiveDebugEnabled(). 


Arm recommends the use of the interface described in Recommended authentication interface on page K2-7653 to 
provide this debug authentication. The pseudocode functions in Chapter J1 Armv8 Pseudocode, that are linked to 
by the entries in the Pseudocode function column of Table H1-1, assume that this interface is implemented. 


H1-6702 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Chapter H2 


Debug State 


ARM DDI 0487E.a 
ID070919 


This chapter describes Debug state. It contains the following sections: 


About Debug state on page H2-6704. 

Halting the PE on debug events on page H2-6705. 
Entering Debug state on page H2-6711. 

Behavior in Debug state on page H2-6714. 
Exiting Debug state on page H2-6740. 


Note 





Table K14-1 on page K14-7810 disambiguates the general register references used in this chapter. 
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H2.1 About Debug state 


In external debug, debug events allow an external debugger to halt the PE. The PE then enters Debug state. When 
the PE is in Debug state: 


° It stops executing instructions from the location indicated by the program counter, and is instead controlled 
through the external debug interface. 


. The Instruction Transfer Register, ITR, passes instructions to the PE to execute in Debug state. 


° The Debug Communications Channel, DCC, passes data between the PE and the debugger. 


The PE cannot service any interrupts in Debug state. 
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H2.2 Halting the PE on debug events 


For details of debug events, see Introduction to Halting debug events on page H3-6744 and Breakpoint and 
Watchpoint debug events on page H2-6706. 


On a debug event, the PE must do one of the following: 


° Enter Debug state. 

. Pend the debug event. 

° Generate a debug exception. 
° Ignore the debug event. 


This behavior depends on both: 


$ Whether halting is allowed by the current state of the debug authentication interface. See Halting allowed 
and halting prohibited. 

° The type of debug event and the programming of the debug control registers. 
— See Halting debug events for all Halting debug events. 


— See Breakpoint and Watchpoint debug events on page H2-6706 for Breakpoint and Watchpoint debug 
events. 


See also Other debug exceptions on page H2-6706. 


This means that behavior can be CONSTRAINED UNPREDICTABLE if the conditions change. See Synchronization and 
Halting debug events on page H3-6765. 


Summary of debug events and possible outcomes on page H3-6744 summarizes the possible outcomes of each type 
of debug event. 


H2.2.1 Halting allowed and halting prohibited 
Halting can be either allowed or prohibited: 
. Halting is always prohibited in Debug state. 


7 Halting is always prohibited when DoubleLockStatus() == TRUE. 
— This means that ARMv8.0-DoubleLock is implemented and OS Double lock is locked. 


è Halting is also controlled by the IMPLEMENTATION DEFINED authentication interface, and is prohibited when 
either: 


— The PE is in Non-secure state and ExternalInvasiveDebugEnabled() == FALSE. 
— The PE is in Secure state and ExternalSecureInvasiveDebugEnabled() == FALSE. 
Note 


See Appendix K2 Recommended External Debug Interface for more information on these functions. 








s Otherwise, halting is allowed. 


For more information see: 
. Pseudocode description of Halting on debug events on page H2-6710 
: Required debug authentication on page H1-6702. 


H2.2.2 Halting debug events 
The Halting debug events are described in Chapter H3 Halting Debug Events. 


When a Halting debug event is generated, it causes entry to Debug state if all of: 
: Halting is allowed. See Halting allowed and halting prohibited. 
° The Halting debug event is one of: 

— A Halt Instruction debug event and EDSCR.HDE == 1. 
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H2.2.3 


H2.2.4 
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— A Software Access debug event and OSLSR_EL1.0SLK == 0, meaning that the OS Lock is unlocked. 
— Neither a Halt Instruction debug event nor a Software Access debug event. 


Note 
— A Halt Instruction debug event is the only Halting debug event that relies on EDSCR.HDE == 1. 
— Halting on Breakpoint and Watchpoint debug events is also controlled by EDSCR.HDE. See 
Breakpoint and Watchpoint debug events. 
—  EDSCR.HDE can be written by software when the OS Lock is locked. Privileged code can use 
MDCR_EL3.TDOSA and HDCR.TDOSA to trap writes to these registers. 








If a Halting debug event does not generate entry to Debug state because the conditions listed in this section do not 
hold, then: 


5 If the Halting debug event is a Halt Instruction debug event, the instruction that generated the Halting debug 
event is treated as UNDEFINED. 


° If the Halting debug event is an Exception Catch debug event or a Software Access debug event, it is ignored. 
In all other cases the Halting debug event is pended, see Pending Halting debug events on page H3-6765. 


Summary of actions from debug events on page H2-6709 summarizes the possible outcome for each type of Debug 
event. 


Note 


Halting debug events never generate debug exceptions. 








Breakpoint and Watchpoint debug events 


A breakpoint or watchpoint generates an entry to Debug state if all of the following conditions hold: 
è Halting debug is enabled, that is EDSCR.HDE == 1. 

7 Halting is allowed. See Halting allowed and halting prohibited on page H2-6705. 

° The OS Lock is unlocked, that is OSLSR.OSLK == 0. 


The Address Mismatch breakpoint type is reserved when all of these conditions are met. 


MDSCR_EL1.MDE or DBGDSCRext.MDBGen is ignored when determining whether to enter Debug state. A 
breakpoint or watchpoint that generates entry to Debug state is a Breakpoint or Watchpoint debug event and does 
not generate a debug exception. 


A breakpoint or watchpoint that does not generate an entry to Debug state either: 


$ Generates a Breakpoint or Watchpoint exception. 
° Is ignored. 
Note 





EDSCR.HDE is ignored when determining whether to generate a debug exception. The debug exception is 
suppressed only if the PE enters Debug state. This means that the use of Halting debug mode in Non-secure state 
does not affect the Exception model in Secure state. 





See Chapter D2 AArch64 Self-hosted Debug, Chapter G2 AArch32 Self-hosted Debug, and the Note in Other debug 
exceptions. 


Other debug exceptions 


The following events never generate entry to Debug state: 


. Breakpoint Instruction exceptions. 
` Software Step exceptions. 
° Vector Catch exceptions. 
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The behavior of these events is unchanged when Halting debug mode is enabled, that is when EDSCR.HDE == 1. 
This means that these events can do one of the following: 


° They can generate a debug exception. 
° They can be ignored. 


For additional information, see Chapter D2 AArch64 Self-hosted Debug and Chapter G2 AArch32 Self-hosted 
Debug. 


H2.2.5 Debug state entry and debug event prioritization 
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The following are synchronous debug events: 
° Breakpoint debug event. 

° Watchpoint debug event. 

° Halting Step debug event. 


° Halt Instruction debug event. 
° Exception Catch debug event. 
° Software Access debug event. 
° Reset Catch debug event. 


Each of these synchronous debug events are treated as a synchronous exception generated by an instruction, or by 
the taking of an exception or reset. That is, if halting is allowed, the synchronous debug event must be taken before 
any subsequent instructions are executed. Reset Catch debug events must be taken before the PE executes the 
instruction at the reset vector. 





Note 


s Reset Catch and Exception Catch debug events might be generated asynchronously, because they can result 
from an asynchronous exception. However, if halting is allowed after the reset or asynchronous exception 
has been processed, the Reset Catch or Exception Catch debug event is taken synchronously. 


: The Halting Step debug event is generated by the instruction after the stepped instruction. Therefore, if the 
stepped instruction generates any other synchronous exceptions or debug events these are taken first. 





If halting is prohibited then Halting Step debug events and Reset Catch debug events might be pended and taken 
asynchronously. OS Unlock Catch debug events are always pended and taken asynchronously. See Pending Halting 
debug events on page H3-6765. 


The architecture does not define when asynchronous debug events are taken, and therefore the prioritization of 
asynchronous debug events is IMPLEMENTATION DEFINED. See Synchronization and Halting debug events on 
page H3-6765. 


The following list shows how the synchronous debug events are prioritized, with 1 being the highest priority. 


Note 


The priority numbering is the same as the numbering for AArch64 synchronous exception priorities listed in 
Synchronous exception types, routing and priorities on page D1-2307, and in particular Prioritization and 
recognition of interrupts on page D1-2324. This numbering correlates with the equivalent AArch32 list in 
Exception prioritization for exceptions taken to AArch32 state on page G1-5504. 








The priority for synchronous debug events is as follows: 


1 Reset Catch debug event. See Reset Catch debug events on page H3-6763. 
This debug event has a higher priority than the synchronous exceptions listed in Synchronous 
exception types, routing and priorities on page D1-2307. 

2 Exception Catch debug event. See Exception Catch debug event on page H3-6757. 


This debug event can be assigned one of two priorities. When it has a priority of 2, it has a higher 
priority than the synchronous exceptions listed in the Exception model. See Exception Catch debug 
event on page H3-6757. 
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3 Halting Step debug event. See Halting Step debug events on page H3-6746. 
This debug event has a higher priority than the synchronous exceptions listed in the Exception 
model. 

4 These events are not debug events. 

5 Exception Catch debug event. See Exception Catch debug event on page H3-6757. 


This debug event can be assigned one of two priorities, 0 or 5. See Exception Catch debug event on 
page H3-6757. 


6-7 These events are not debug events. 


8 Breakpoint exception or debug event or Address Matching Vector Catch exception. See Breakpoint 
exceptions on page D2-2413, and Vector Catch exceptions on page G2-5667. 


These two debug events have the same priority. 


9-10 These events are not debug events. 

11 Halt Instruction debug event. See Halt Instruction debug event on page H3-6756. 

12-24 These events are not debug events. 

25 Software Access debug event. See Software Access debug event on page H3-6764. 

24-27 These events are not debug events. 

28 Watchpoint exception or debug event. See Watchpoint exceptions on page D2-2431 for exceptions 


taken from AArch64 state, or Watchpoint exceptions on page G2-5653 for exceptions taken from 
AArch32 state. 


29 This event is not a debug event. 


For Reset Catch debug events and Halting Step debug events the priorities listed in this section only apply when 
halting is allowed at the time the event is generated. This means that the event is taken synchronously and not 
pended. 


For more information on the prioritization of exceptions see: 


b Synchronous exception types, routing and priorities on page D1-2307. 
7 Prioritization and recognition of interrupts on page D1-2324. 
° Exception prioritization for exceptions taken to AArch32 state on page G1-5504. This section covers 


synchronous and asynchronous exceptions. 


Breakpoint debug events and Vector Catch exception 


An Address Matching Vector Catch exception has the same priority as a Breakpoint debug event. See Synchronous 
exception prioritization for exceptions taken to AArch64 state on page D1-2308. 


The prioritization of these events is unchanged even if the breakpoint generates entry to Debug state instead of a 
Breakpoint exception. This means that if a single instruction generates both an Address Matching Vector Catch 
exception and a Breakpoint debug event, there is a CONSTRAINED UNPREDICTABLE choice of: 


° The PE entering Debug state due to the Breakpoint debug event. 
° A Vector Catch exception. 


This only applies if all of the following are true: 
° Halting debug is enabled. 

° Halting is allowed. 

° The OS Lock is unlocked. 


An Exception Trapping Vector Catch exception must be generated immediately following the exception that 
generated it. This means that it does not appear in the priority table. 
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H2.2.6 Imprecise entry to Debug state 


Entry to Debug state is normally precise, meaning that the PE cannot enter Debug state if it can neither complete 
nor abandon all currently executing instructions and leave the PE in a precise state. 


A debugger can write a value of 1 to EDRCR.CBRRQ to allow imprecise entry to Debug state. An External Debug 
Request debug event must be pending before writing 1 to this bit. Support for this feature is OPTIONAL and it is 
IMPLEMENTATION DEFINED when it is effective at forcing entry to Debug state. 


The PE ignores writes to this bit if either: 
. External debugging is not enabled, meaning ExternalInvasiveDebugEnabled() == FALSE. 


° Secure external debugging is not enabled, meaning ExternalSecureInvasiveDebugEnabled() == FALSE, and 
either: 
— E3 is not implemented and the implemented Security state is Secure state. 


—  EL3 is implemented. 


Example H2-1 shows how entry to Debug state can be forced. 


Example H2-1 Forcing entry to Debug state 


The debugger pends an External Debug Request debug event through the CTI to halt a program that has stopped 
responding. However, the memory system is not responding and a memory access instruction cannot complete. This 
means that Debug state cannot be entered precisely. The debugger writes a value of 1 to EDRCR.CBRRQ. The PE 
cancels all outstanding memory accesses and enters Debug state. As some instructions might not have completed 
correctly, entry to Debug state is imprecise. 


When Debug state is entered imprecisely, all memory access instructions executed through the ITR have 
UNPREDICTABLE behavior. The value of all registers is UNKNOWN, but might be useful for diagnostic purposes. 


H2.2.7 Summary of actions from debug events 
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Table H2-1 on page H2-6710 shows the Software and Halting debug events. In Table H2-1 on page H2-6710 the 
columns have the following meaning: 
Debug event type 
This means the type of debug event where: 
Other software Means one of: 
E Software Step exceptions on page D2-2446. 
$ Breakpoint Instruction exceptions on page D2-2411. 


. Vector Catch exceptions on page D2-2445 for AArch64 state or 
Vector Catch exceptions on page G2-5667 for AArch32 state. 


Other Halting Means one of the following: 
í Halting Step debug events on page H3-6746. 
° External Debug Request debug event on page H3-6761. 
. Reset Catch debug events on page H3-6763. 
è OS Unlock Catch debug event on page H3-6762. 


Other debug events are referred to explicitly. 


Authentication 


This means halting is allowed by the IMPLEMENTATION DEFINED external authentication interface. 
It is the result of one of the following pseudocode functions: 


In Secure state External SecureInvasiveDebugEnabled(). 


In Non-secure state ExternalInvasiveDebugEnabled(). 
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DLK This indicates whether ARMv8.0-DoubleLock is implemented and locked, DoubleLockStatus() == 
TRUE. 

OSLK This is the value of OSLSR.OSLK. It indicates whether the OS Lock is locked. 

HDE This is the value of EDSCR.HDE. It indicates whether Halting debug is enabled. 


The letter X in Table H2-1 indicates that the value can be either 0 or 1. 


Table H2-1 Debug authentication for external debug 





Debug event type Authentication DLK OSLK HDE Behavior 




































































Other software X X X X Handled by the Exception model 
Breakpoint or X TRUE X X Handled by the Exception model (ignored) 
Watchpoint debug i : 
event FALSE 1 x Handled by the Exception model (ignored) 
FALSE FALSE 0 X Handled by the Exception model 
TRUE FALSE 0 0 Handled by the Exception model 
TRUE FALSE 0 1 Entry to Debug state 
Halt Instruction FALSE X X X undefined 
debug event 
TRUE TRUE X X undefined 
TRUE FALSE X 0 undefined 
TRUE FALSE X 1 Entry to Debug state 
Exception Catch FALSE X X X Ignored 
debug event 
TRUE TRUE X X Ignored 
TRUE FALSE X X Entry to Debug state 
Software Access FALSE X X X Ignored 
debug event 
TRUE TRUE X X Ignored 
TRUE FALSE 1 x Ignored 
TRUE FALSE 0 X Entry to Debug state 
Other Halting FALSE X X X Debug event is pended 
TRUE TRUE X X Debug event is pended 
TRUE FALSE X X Entry to Debug state 
H2.2.8 Pseudocode description of Halting on debug events 


The Halted(), Restarting(), HaltingAllowed(), and HaltOnBreakpointOrWatchpoint() functions are described in the 
Armv8 pseudocode. 
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H2.3 Entering Debug state 


On entry to Debug state, the preferred restart address and PSTATE are saved in DLR and DSPSR. The PE remains 
in the mode and security state from which it entered Debug state. 


If EDRCR.CBRRQ has a value of 0, entry to Debug state is precise. If EDRCR.CBRRQ has a value of 1, then 
imprecise entry to Debug state is permitted. 


Ifa Watchpoint debug event causes an entry to Debug state, the address of the access that generated the Watchpoint 
debug event is recorded in EDWAR. 


For more information see: 


. Determining the memory location that caused a Watchpoint exception on page D2-2439 for a debug event 
taken from AArch64 state. 
. Determining the memory location that caused a Watchpoint exception on page G2-5660 for a debug event 


taken from AArch32 state. 


Other than the effect on PSTATE and EDSCR, entry to Debug state is not a Context synchronization event. The 
effects of entry to Debug state on PSTATE and EDSCR are synchronized. 


H2.3.1 Entering Debug state from AArch32 state 


When entering Debug state from AArch32 state, the PE remains in AArch32 state. In AArch32 Debug state the PE 
executes T32 instructions, regardless of the value of PSTATE.T before entering Debug state. 


To allow the debugger to determine the state of the PE, the current Execution state for all four Exception levels can 
be read from EDSCR.RW, and the current Exception level can be read from EDSCR.EL. 


The current endianness state, PSTATE.E, is unchanged on entry to Debug state. 





Note 
: If EL1 is using AArch32 state, the current endianness state can differ from that indicated by SCTLR.EE. 


$ If EL2 is using AArch32 state, the current endianness state can differ from that indicated by HSCTLR.EE. 


è On entry to Debug state from AArch32 state, PSTATE.SS is copied to DSPSR.SS, even though the PE 
remains in AArch32 state. 





See also Effect of entering Debug state on PSTATE on page H2-6713. 


H2.3.2 Effect of Debug state entry on DLR and DSPSR 
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DLR is set to the preferred restart address for the debug event, that depends on the event type. The value of PSTATE 
is saved in DSPSR. 


For entry to Debug state from AArch32 state, the values saved in DSPSR.IT are always correct for the preferred 
restart address. 


For synchronous Halting debug events, the preferred restart address is the address of the instruction that generated 
the debug event. It is CONSTRAINED UNPREDICTABLE whether DSPSR_ELO.BTYPE is set to the value of 
PSTATE.BTYPE or 0 for synchronous debug events other than the following debug events: 


s A Halting Step debug event. 
$ A Breakpoint debug event. 
° A Halt Instruction debug event. 


For asynchronous Halting debug events, including pending Halting debug events taken asynchronously, the 
preferred restart address is the address of the first instruction that must be executed on exit from Debug state. 
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This means that: 


° For Breakpoint and Watchpoint debug events, the preferred restart address is the same as the preferred return 
address for a debug exception, as described in Chapter D2 AArch64 Self-hosted Debug and Chapter G2 
AArch32 Self-hosted Debug. 


è For Halt Instruction debug events DLR is set to the address of the HLT instruction and DSPSR.IT is correct 
for the HLT instruction. 


. For Software Access debug events, DLR is set to the address of the accessing instruction and DSPSR.IT is 
correct for this instruction. 


à For Halting Step debug events taken synchronously, DLR and DSPSR are set as the ELR and SPSR would 
be set for a Software Step exception. This is usually the address of, and PSTATE for, the instruction after the 
one that was stepped. 


è For Exception Catch debug events: 


— Ifthe debug event is generated on taking an exception to a trapped Exception level, the DLR is set to 
the address of the exception vector the PE would have started fetching from. This is UNKNOWN if the 
VBAR for the Exception level has never been initialized. The DSPSR records the value of PSTATE 
after taking the exception. The Exception Catch occurs after the SPSR and the Link register are set, 
and the debugger can use these registers to determine where in the application program the exception 
occurred. 


Note 


Depending on the target Exception level and Execution state for the exception, the Link register is one 
of ELR_EL1, ELR_EL2, ELR_EL3, ELR_hyp, or LR (R14). 








— Ifthe debug event is generated on an exception return to a trapped Exception level, the DLR is set to 
the target address of the exception return and the DSPSR records the value of PSTATE after the 
exception return. 


. Reset Catch debug events taken synchronously behave like Exception Catch debug events. 


° For Reset Catch debug events and Exception Catch debug events generated on reset to a trapped Exception 
level, the DLR is set to is set to the reset address and the DSPSR records the reset value of PSTATE. 


° For pending Halting debug events and External Debug Request debug events, DLR is set to the address of 
the first instruction that must be executed on exit from Debug state and DSPSR.IT is correct for this 
instruction. See Pending Halting debug events on page H3-6765. 


Normally DLR is aligned according to the instruction set state indicated in DSPSR. However, a debug event might 
be taken at a point where the PC is not aligned. 


Effect of Debug state entry on System registers, the Event register, and Exclusives monitors 


Entering Debug state has no effect on System registers other than DLR and DSPSR. In particular, ESRs, FARs, and 
FSRs are not updated on entering Debug state. SCR is unchanged, even when entering Debug state from EL3. 


Entering Debug state has no architecturally-defined effect on the Event Register and Exclusives monitors. 


Note 


Entry to Debug state might set the Event Register or clear the Exclusives monitors, or both. However, this is not a 
requirement, and debuggers must not rely on any implementation specific behavior. 








Unless otherwise described in this reference manual, instructions executed in Debug state have their 
architecturally-defined effects on the System registers, the Event register, and Exclusives monitors. 
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H2.3.4 Effect of entering Debug state on PSTATE 


The effect of an entry to Debug state on PSTATE is described in Entering Debug state on page H2-6711 and 
Entering Debug state from AArch32 state on page H2-6711. 


On entry to Debug state after PSTATE is saved in DSPSR: 

° PSTATE.IL is cleared to 0. 

s PSTATE.TCO is setto 1. 

. PSTATE.BTYPE is set to 0. 

° PSTATE.{IT, T, SS, D, A, I, F, SSBS} are set to UNKNOWN values 


PSTATE.{N, Z, C, V, Q, GE, E, M, nRW, EL, SP, PAN, UAO, DIT} are unchanged. 


For more information see PSTATE in Debug state on page H2-6714. 


H2.3.5 Entering Debug state during loads and stores 


The PE can enter Debug state during instructions that perform a sequence of memory accesses, as opposed to a 
single single-copy atomic access, because of a Watchpoint debug event. The effect of entering Debug state on such 
an instruction is the same as taking a Data Abort exception during such an instruction. 


In addition, when executing in AArch64 state, the PE can enter Debug state during instructions that perform a 
sequence of memory accesses because of an External Debug Request debug event. The effect of entering Debug 
state on such an instruction is the same as taking an interrupt exception during such an instruction. 


This applies to all memory types. 


H2.3.6 Entering Debug state and Software Step 


When Software Step is active, a debug event that causes entry to Debug state behaves like an exception taken to an 
Exception level above the debug target Exception level. That is: 


è If the instruction that is stepped generates a synchronous debug event that causes entry to Debug state, or an 
asynchronous debug event is taken before the step completes, the PE enters Debug state with DSPSR.SS set 
to 1. 

$ A pending Halting debug event or an asynchronous debug event can be taken after the step has completed. 


In this case the PE enters Debug state with DSPSR.SS set to 0. 
In addition: 


è If the instruction that is stepped generates an exception trapped by an Exception Catch debug event, the PE 
enters Debug state at the exception vector with DSPSR.SS set to 0. This is because PSTATE.SS is set to 0 by 
taking the exception. 


. If the PE is reset, PSTATE.SS is reset to 0. If the following debug events are enabled, the PE enters Debug 
state with DSPSR.SS set to 0: 
— Reset Catch debug event at the reset Exception level. 
— Exception Catch debug event at the reset Exception level. 
— Halting Step debug event. 
- If Halting Step is also active, then Halting Step and Software Step operate in parallel and can both become 


active-pending. In this case Halting step has a higher priority than Software step. This means that the PE 
enters Debug state and DSPSR.SS is set to 0. 


H2.3.7 Pseudocode description of entering Debug state 


The DebugHalt constants are described in shared/debug/halting/DebugHalt on page J1-7503 in the Armv8 
pseudocode. The UpdateEDSCRFields() and Halt() functions are described in Chapter J1 Armv8 Pseudocode. 
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H2.4 


H2.4.1 


H2-6714 


Behavior in Debug state 


Instructions are executed in Debug state from the Instruction Transfer Register, ITR. The debugger controls which 
instructions are executed in Debug state by writing the instructions to the External Debug Instruction Transfer 
register, EDITR. The Execution state of the PE determines which instruction set is executed: 


° If the PE is in AArch64 state it executes A64 instructions. 
° If the PE is in AArch32 state it executes T32 instructions: 


—  Fora32-bit T32 instruction, EDITR[15:0] specifies the first halfword and EDITR[31:16] specifies the 
second halfword. 


— Fora 16-bit T32 instruction, EDITR[15:0] contains the instruction and EDITR[31:16] is ignored. All 
16-bit T32 instructions are UNPREDICTABLE in Debug state. 


The PE does not execute A32 instructions in Debug state. 


Some instructions are available only in Debug state. See Debug state operations, DCPS, DRPS, MRS, MSR on 
page H2-6731. In Non-debug state these instructions are UNDEFINED. 


The following sections describe behavior in Debug state: 

- PSTATE in Debug state. 

e Executing instructions in Debug state on page H2-6715. 

7 Decode tables on page H2-6726. 

: Security in Debug state on page H2-6730. 

s Privilege in Debug state on page H2-6731. 

° Debug state operations, DCPS, DRPS, MRS, MSR on page H2-6731. 
° Exceptions in Debug state on page H2-6734. 

5 Accessing registers in Debug state on page H2-6736. 

e Accessing memory in Debug state on page H2-6739. 

This section specifies the CONSTRAINED UNPREDICTABLE behaviors that apply in Debug state, but see Changing the 


value of EDECR.SS when not in Debug state on page H3-6753 for a change in Non-debug state that causes 
CONSTRAINED UNPREDICTABLE behavior. 


PSTATE in Debug state 


PSTATE. {N, Z, C, V, Q, GE, IT, T, SS, D, A, I, F, SSBS} are all ignored in Debug state: 


è There are no conditional instructions in Debug state. 

è In AArch32 state, the PE only executes T32 instructions and PSTATE.IT is ignored. 
° Asynchronous exceptions and debug events are ignored. 

° Software step is inactive. 


Instructions executed in Debug state indirectly read PSTATE. {UAO, PAN, IL, E, M, nRW, EL, SP} as they would 
in Non-debug state. 


Note 
PSTATE.DIT is not guaranteed to have any effect in Debug state. 








In Debug state: 
- PSTATE.PAN is set to 1 by: 
— A DCPS instruction to EL1 using AArch64 if SCTLR_EL1.SPAN == 0. 
— A DCPS instruction to EL2 using AArch64 if SCTLR_EL2.SPAN == 0. 
: PSTATE.UAO is set to 0 by a DCPS instruction to AArch64 state. 
$ PSTATE.TCO is set to 1 by a DCPS instruction to AArch64 state. 


è PSTATE can also be changed by taking exceptions in Debug state, and by the execution of DCPS and DRPS 
instructions. 


When in Debug state, if ARMv8.0-SSBS is implemented, then hardware is permitted to load or store speculatively, 
regardless of the value of PSTATE.SSBS. 
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H2.4.2 Executing instructions in Debug state 
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The instructions executed in Debug state must be either A64 instructions or T32 instructions, depending on the 
current Execution state. 


Each instruction falls into one of the following groups: 


$ Debug state instructions. These are instructions that are changed in Debug state. See 464 instructions that 
are changed in Debug state and T32 instructions that are changed in Debug state on page H2-6721. 


a Instructions that are unchanged in Debug state. See 464 instructions that are unchanged in Debug state and 
T32 instructions that are unchanged in Debug state on page H2-6721. 


$ Instructions that are UNPREDICTABLE or CONSTRAINED UNPREDICTABLE in Debug state. See 464 instructions 
that are CONSTRAINED UNPREDICTABLE in Debug state on page H2-6718 and T32 instructions that are 
CONSTRAINED UNPREDICTABLE in Debug state on page H2-6723. 


All T32 instructions are treated as unconditional, regardless of PSTATE.IT. See PSTATE in Debug state on 
page H2-6714. 


If EDSCR.SDD == 1 then an instruction executed in Non-secure state cannot cause entry into Secure state. See 
Security in Debug state on page H2-6730 


Executing A64 instructions in Debug state 


The following sections describe the behavior of the A64 instructions in Debug state: 

. 464 instructions that are changed in Debug state. 

. A64 instructions that are unchanged in Debug state. 

$ A64 instructions that are CONSTRAINED UNPREDICTABLE in Debug state on page H2-6718. 


A64 instructions that are changed in Debug state 


The following A64 instructions are defined in Debug state, but are undefined in Non-debug state: 
: DCPS. 


Note 
DCPS can be UNDEFINED in certain conditions in Debug state. See DCPS<n> on page H2-6731. 








*  DRPS. 
* MRS (DLR_ELO), MRS (DSPSR_ELO), MSR (DLR_ELO), MSR (DSPSR_ELO) 


For more information see Debug state operations, DCPS, DRPS, MRS, MSR on page H2-6731. 


A64 instructions that are unchanged in Debug state 
The following list shows the instructions that are unchanged in Debug state: 


Any instruction that is UNDEFINED in Non-debug state 
This list of instructions excludes: 
$ Any instruction listed in 464 instructions that are changed in Debug state. 
. Any instruction listed in 464 instructions that are CONSTRAINED UNPREDICTABLE in 
Debug state on page H2-6718 that is UNDEFINED because an enable or disable bit is not RESO 
or RESI 
Instructions that move System or Special-purpose registers to or from a general-purpose register 


This list of instructions: 


ë Includes the instructions to transfer a general-purpose register to or from the DTR, which can 
be executed at any Exception level. 
° Excludes PSTATE access instructions. 
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H2-6716 


These instructions are: 


MRS <special_reg>, MSR <special_reg>. 


Note 





This does not include NZCV, DAIF, DAIFSet, DAIFCIr, SPSel, and CurrentEL. 





MRS <system_reg>, MSR <system_reg>. 


Floating-point moves between a SIMD&FP register and a general-purpose register 


These instructions are: 


FMOV (between a general-purpose register and a half-precision register). 
FMOV (between a general-purpose register and a single-precision register). 
FMOV (between a general-purpose register and a double-precision register). 
FMOV (between a general-purpose register and a SIMD element). 


SIMD moves between a SIMD&FP register and a general-purpose register 


These instructions are: 


Barriers These 


INS (from a general-purpose register to a SIMD element). 
UMOV (from a SIMD element to a general-purpose register). 


instructions are: 

DMB. 

DSB. 

ESB, when the RAS Extension is implemented. 

ISB. 

PSB, when the Statistical Profiling Extension is implemented. 
SB, when ARMv8.0-SB is implemented. 


Memory access instructions at various access sizes 


The following constraints apply: 
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General purpose-registers only. 

One of the following addressing modes: 

—  Unscaled (9-bit signed) immediate offset. 
— Immediate (9-bit signed) post-indexed. 
— Immediate (9-bit signed) pre-indexed. 

—  Unprivileged (9-bit signed). 

Not literal. 


One of the following types: 

— (Single) register. 

— Exclusive. 

— Exclusive pair. 

—  Acquire/Release. 

—  Acquire/Release Exclusive. 

—  Acquire/Release Exclusive pair. 
32-bit and 64-bit target register variants. 


instructions are: 

LDR, LDRB, LDRH, LDRSB, LDRSH, LDRSW (immediate, not literal). 
LDUR, LDURB, LDURH, LDURSB, LDURSH, LDURSW (immediate). 
LDTR, LDTRB, LDTRH, LDTRSB, LDTRSH, LDTRSW (immediate). 
LDAR, LDARB, LDARH, LDXR, LDXRB, LDXRH, LDAXR, LDAXRB, LDAXRH. 
LDXP, LDAXP. 

STR, STRB, STRH (immediate). 
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STUR, STURB, STURH (immediate). 

STTR,STTRB, STTRH (immediate). 

STLR, STLRB, STLRH, STXR, STXRB, STXRH, STLXR, STLXRB, STLXRH. 
STXP, STLXP. 

LDLAR, LDLARB, LDLARH - Armv8.1 instructions. 
STLLR, STLLRBB, STLLRH - Armv8.1 instructions. 
CAS, CASB, CASH, CASP - Armv8.1 instructions. 
SWP, SWPB, SWPH - Armv8.1 instructions. 

LDADD, LDADDB, LDADDH - Armvé8.1 instructions. 
LDCLR, LDCLB, LDCLRH - Armv8.1 instructions. 
LDEOR, LDEORB, LDEORH - Armv8.1 instructions. 
LDSET, LDSETB, LDSETH - Armv8.1 instructions. 
LDSMAX, LDSMAXB, LDSMAXH - Armv8.1 instructions. 
LDSMIN, LDSMINB, LDSMINH - Armv8.1 instructions. 
LDUMAX, LDUMAXB, LDUMAXH - Armv8.1 instructions. 
LDUMIN, LDUMINB, LDUMINH - Armv8.1 instructions. 
STADD, STADDB, STADDH - Armv8.1 instructions. 
STCLR, STCLB, STCLRH - Armv8.1 instructions. 
STEOR, STEORB, STEORH - Armv8.1 instructions. 
STSET, STSETB, STSETH - Armv8.1 instructions. 
STSMAX, STSMAXB, STSMAXH - Armv8.1 instructions. 
S 

S 

S 








TSMIN, STSMINB, STSMINH - Armv8.1 instructions. 

TUMAX, STUMAXB, STUMAXH - Armv8.1 instructions. 

TUMIN, STUMINB, STUMINH - Armv8.1 instructions. 

LDAPR, LDAPRB, LDAPRH - Armv8.3 instructions. 

LDAPURH, LDAPURSH, LDAPUR, LDAPURSW, LDAPURSB, LDAPURB - Armv8.4 instructions. 
STLUR, STLURH, STLURB - Armv8.4 instructions. 








Move immediate to general-purpose register 


These instructions are: 


MOVZ, MOVN, MOVK (immediate). 
MOV (between a general-purpose register and the stack pointer). 


System instructions, Send Event, NOP, and Clear Exclusive 


In this context, the System instructions are the Cache maintenance instructions, TLB maintenance 
instructions, and the Address translation instructions. 


These instructions are: 


IC. 

DC. 

TLBI. 

AT. 

SEV, SEVL. 
NOP. 
CLREX. 


Memory Tagging Extension Instructions 


When ARMv8.5-MemTag is implemented, Loads and stores in Debug state follow the same rules 
for Tag Checking as Loads and stores when not in Debug state. For more information see 
Chapter D6 Armv8.5 Memory Tagging Extension. 


The following instructions are unchanged in Debug state: 


ADDG <Xd|SP>, <Xn|SP>, #<uimm6>, #<uimm4> 
SUBG <Xd|SP>, <Xn|SP>, #<uimm6>, #<uimm4> 
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. STG <Xt>, [<Xn|SP>{, #<simm>}], signed offset. 

. STZG <Xt>, [<Xn|SP>{, #<simm>}], signed offset. 
. ST2G <Xt>, [<Xn|SP>{, #<simm>}], signed offset. 
. STZ2G <Xt>, [<Xn|SP>{, #<simm>}], signed offset. 
. LDG <Xt>, [<Xn|SP>{, #<simm>}] 

e LDGM <Xt>, [<Xn|SP>] 

° STGM <Xt>, [<Xn|SP>] 

. STZGM <Xt>, [<Xn|SP>] 

. STGP <Xtl>, <Xt2>, [<Xn|SP>{, #<imm>}] 





A64 instructions that are CONSTRAINED UNPREDICTABLE in Debug state 


This subsection describes all instruction not listed in either: 
. A64 instructions that are changed in Debug state on page H2-6715. 
° 464 instructions that are unchanged in Debug state on page H2-6715. 


These instructions are CONSTRAINED UNPREDICTABLE in Debug state. In general, the permissible behaviors are: 


. The instruction is UNDEFINED. 
. The instruction executes as a NOP. 
. If the instruction reads the PC or PSTATE, it uses an UNKNOWN value. 


e If the instruction modifies the PC or PSTATE, other than by advancing the PC to the sequentially next 
instruction, it sets DLR_EL0 and DSPSR_ELO to UNKNOWN values. 


7 If the instruction is similar to a Debug state instruction, it executes as that Debug state instruction. 
. The instruction has the same behavior as in Non-debug state. 


The following list shows the permissible behaviors for A64 instruction in Debug state. An instruction might appear 
multiple times in the list, in which case the choice of permissible behaviors is any of those listed. An example of 
this is CCMP. 

Exception-generating instructions 


These instructions are: 


: SVC. 
s HVC. 
; SMC. 
s BRK. 
s HLT. 


These instructions behave in one of the following ways: 
è They are UNDEFINED. 

° They execute as a NOP. 

, SVC behaves as DCPS1. 

. HVC behaves as DCPS2. 

. SMC behaves as DCPS3. 


: They generate the exception that the instruction would generate in Non-debug state. The 
exception is taken as described in Exceptions in Debug state on page H2-6734 
—— Note 


SMC must not generate a Secure Monitor Call exception from Non-secure state if 
EDSCR.SDD is setto 1. 
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Instructions that explicitly write to the PC (branches) 


These instructions are: 
. B, B.cond, BL, BLR, BR, CBZ, CBNZ, RET, TBZ, TBNZ. 


These instructions behave in one of the following ways: 

s They are UNDEFINED. 

° They execute as a NOP. 

° They execute as in Non-debug state without branching and set DSPSR_EL0 and DLR_ELO 


to UNKNOWN values. 
Exception return and related instructions 


These instructions are: 
° ERET. 


These instructions behave in one of the following ways: 
è They are UNDEFINED. 
° They execute as a NOP. 


° They execute as in Non-debug state without branching. They set DSPSR_ELO and DLR_ELO 
to UNKNOWN values, and either: 


— Execute the DRPS operation instead of performing an exception return, using 
UNKNOWN SPSR values. 


— Not change the Exception level. 


Instructions that request entry to a low-power state 


These instructions are: 


bd WFE, WFI. 

These instructions behave in one of the following ways: 

` They are UNDEFINED. 

° They execute as a NOP. 

° They generate a synchronous exception if the corresponding instruction would be trapped in 


Non-debug state. See Configurable instruction enables and disables, and trap controls on 
page D1-2326. 


à A WFE instruction clears the Event register if it is set. 





Note 


This means that these instructions must not suspend execution. 





Instructions that read the PC 
These instructions are: 
° LDR (literal), LDRSW (literal). 
p ADR, ADRP. 


° PRFM (literal). 

These instructions behave in one of the following ways: 

s They are UNDEFINED. 

° They execute as a NOP. 

s They execute as in Non-debug state, using an UNKNOWN value for the PC operand. 


Instructions that explicitly modify PSTATE, other than DCPS and DRPS 
These instructions are: 
. ADDS, SUBS, ADCS, SBCS, ANDS, BICS, CCMN, CCMP. 
. FCMP, FCMPE, FCCMP, FCCMPE. 
s MSR DAIFSet (immediate), MSR DAIFCIr (immediate), MSR SPSel (immediate). 
e MSR NZCV (register), MSR DAIF (register), MSR SPSel (register). 
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When ARMv8.1-PAN is implemented, MSR PAN (immediate) and MSR PAN (register). 


When ARMv8.2-UAO is implemented, MSR UAO (immediate) and MSR UAO (register). 


When ARMv8.4-CondM is implemented, CFINV, RMIF, SETF8, SETF16. 
When ARMv8.4-DIT is implemented, MSR DIT. 

When ARMv8.5-CondM is implemented, AXFLAG and XAFLAG. 

When ARMv8.5-MemTag is implemented, MSR TCO. 

When ARMv8.5-RNG is implemented, MRS RNDR and MRS RNDRRS. 





These instructions behave in one of the following ways: 


They are UNDEFINED. 
They execute as a NOP. 


They execute as in Non-debug state, setting DSPSR_ELO and DLR_ELO to UNKNOWN 


values. 


Instructions that read PSTATE.{N, Z, C, V} or other PSTATE fields 


These instructions are: 


CSEL, CSINC, CSINV, CSNEG, CCMN, CCMP, FCSEL, FCCMP, FCCMPE. 
ADC, ADCS,SBC, SBCS. 

CFINV. 

MRS NZCV, MRS DAIF, MRS SPSel, MRS CurrentEL. 

When ARMv8.1-PAN is implemented, MRS PAN. 

When ARMv8.2-UAO is implemented, MRS UAO. 

When ARMv8.4-CondM is implemented, CFINV. 

When ARMv8.4-DIT is implemented, MRS DIT. 

When ARMv8.5-MemTag is implemented MRS TCO. 


These instructions behave in one of the following ways: 


They are UNDEFINED. 
They execute as a NOP. 


They execute as in Non-debug state: 


— For the conditional operations and those using the PSTATE.C flag as an input, these 


instructions use an UNKNOWN value for the Condition flag. 


— For the MRS instruction, they return an UNKNOWN value. 


All other instructions 


These instructions behave in one of the following ways: 





They are UNDEFINED. 
They execute as a NOP. 
They have the same behavior as in Non-debug state. 


Note 


This includes instructions defined as UNPREDICTABLE or CONSTRAINED UNPREDICTABLE in 
Non-debug state. These instructions are UNPREDICTABLE or CONSTRAINED UNPREDICTABLE in 
Debug state. 





Executing T32 instructions in Debug state 


The following sections describe the behavior of the T32 instructions in Debug state: 


T32 instructions that are changed in Debug state on page H2-6721. 


T32 instructions that are unchanged in Debug state on page H2-6721. 
T32 instructions that are CONSTRAINED UNPREDICTABLE in Debug state on page H2-6723. 
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T32 instructions that are changed in Debug state 
The following T32 instructions are defined in Debug state, but are undefined in Non-debug state: 
7 DCPS 


Note 
DCPS can be UNDEFINED in certain conditions in Debug state. See DCPS<n> on page H2-6731. 








. MRC p15,3,<Rt>,c4,c5,0 (DSPSR). 

. MCR p15,3,<Rt>,c4,c5,0 (DSPSR). 

$ MRC p15,3,<Rt>,c4,c5,1 (DLR). 

7 MCR p15,3,<Rt>,c4,c5,1 (DLR). 

In addition, ERET executes the DRPS operation in Debug state. 


For more information see Debug state operations, DCPS, DRPS, MRS, MSR on page H2-6731. 


T32 instructions that are unchanged in Debug state 


The following list shows the instructions that are unchanged in Debug state. Any T32 instruction that uses the PC 
or APSR. {N, Z, C, V} as the source or destination register is not included in the list. Moreover, the list only includes 
the 32-bit T32 encodings. 

Any instruction that is UNDEFINED in Non-debug state 

The list of instructions: 

: Excludes any instruction listed in 732 instructions that are changed in Debug state. 

a Excludes any instruction listed in T32 instructions that are CONSTRAINED 
UNPREDICTABLE in Debug state on page H2-6723 that is UNDEFINED because an enable or 
disable bit is not RESO or RES1 

Instructions that move System or Special-purpose registers to or from a general-purpose register 

The list of instructions: 


a Includes the instructions to transfer a general-purpose register to or from the DTR, which can 
be executed at any Exception level. 


e Excludes APSR and CPSR access instructions. 
° Excludes instructions for accessing banked registers for the current mode. 
These instructions are: 
$ MRS <banked_reg>, MSR <banked_reg>. 
— Note 


This does not apply to cases which are UNPREDICTABLE or CONSTRAINED UNPREDICTABLE in 
Non-debug state in the current mode. 


. MRC, MCR. 
Note 


This includes all allocated System registers in the (coproc==0b111x) encoding space other 
than an MRC move to APSR_nzcv. 








. MRS SPSR, MSR SPSR. 
. VMRS <vfp_system_reg>, VMSR <vfp_system_reg>. 


Note 


This includes all allocated Advanced SIMD and floating-point System registers, other than 
an a VMRS move to APSR_nzcv. 
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Floating-point moves between a SIMD&FP register and a general-purpose register 


These 


instructions are: 
VMOV (between a general-purpose register and a single-precision register). 
VMOV (between a general-purpose register and a doubleword floating-point register). 


SIMD moves between a SIMDS&FP register and a general-purpose register 


These 


Barriers These 


instructions are: 


VMOV (between a general-purpose register and a scalar). 


instructions are: 

DMB. 

DSB. 

ESB, when the RAS Extension is implemented. 
ISB. 


Memory access instructions at various access sizes 


The following constraints apply: 


These 


General purpose-registers only. 


One of the following addressing modes: 
— Immediate (8-bit or 12-bit) offset. 
— Immediate (8-bit) post-indexed. 
— Immediate (8-bit) pre-indexed. 
—  Unprivileged (8-bit). 

Not literal. 


One of the following types: 

— (Single) register. 

— Dral. 

— Exclusive. 

— Exclusive doubleword. 

— Acquire/Release. 

— Acquire/Release Exclusive. 

—  Acquire/Release Exclusive doubleword. 

instructions are: 

LDR.W, LDRB.W, LDRH.W, LDRD, LDRSB.W, LDRSH.W (immediate, not literal). 
LDRT, LDRBT, LDRHT, LDRSBT, LDRSHT (immediate). 

LDREX, LDREXB, LDREXH, LDA, LDAB, LDAH, LDAEX, LDAEXB, LDAEXH. 
LDREXD, LDAEXD. 

STR.W, STRB.W, STRH.W, STRD (immediate). 

STRT, STRBT, STRHT (immediate). 

STREX, STREXB, STREXH, STL, STLB, STLH, STLEX, STLEXB, STLEXH. 
STREXD, STLEXD. 





Move to general-purpose register 


These 


instructions are: 
MOVW, MOVT (immediate). 


System instructions, Send Event, NOP, and Clear Exclusive 


The System instructions are Cache maintenance instructions, TLB maintenance instructions, and 
Address translation instructions. These are encoded in the (coproc==0b1111) System register 


encoding space. 


These 
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s DCCIMVAC, DCCISW, DCCMVAC, DCCMVAU, DCCSW, DCIMVAC, DCISW. 


` TLBIALL, TLBIALLH, TLBIALLHIS, TLBIALLIS, TLBIALLNSNH, 
TLBIALLNSNHIS, TLBIASID, TLBIASIDIS, TLBIIPAS2, TLBIIPAS2IS, TLBIIPAS2L, 
TLBIIPAS2LIS, TLBIMVA, TLBIMVAA, TLBIMVAAIS, TLBIMVAAL, TLBIMVAALIS, 
TLBIMVAH, TLBIMVAHIS, TLBIMVAIS, TLBIMVAL, TLBIMVALH, TLBIMVALHIS, 
TLBIMVALIS. 


è ATS12NSOPR, ATS12NSOPW, ATS12NSOUR, ATS12NSOUW, ATS1CPR, ATSICPW. 
ATSICUR, ATS1CUW, ATS1HR, ATSIHW. 


a BPIALL, BPIALLIS, BPIMVA. 
3 SEV.W, SEVL.W. 

. NOP. W. 

7 CLREX. 


T32 instructions that are CONSTRAINED UNPREDICTABLE in Debug state 


This subsection describes all instruction not listed in either: 
s T32 instructions that are changed in Debug state on page H2-6721. 
. T32 instructions that are unchanged in Debug state on page H2-6721. 


These instructions are CONSTRAINED UNPREDICTABLE in Debug state. In general, the permissible behaviors are: 


7 The instruction generates an Undefined Instruction exception. 
° The instruction executes as a NOP. 
° If the instruction reads the PC or PSTATE, it uses an UNKNOWN value. 


i If the instruction modifies the PC or PSTATE, other than by advancing the PC to the sequentially next 
instruction, it sets DLR and DSPSR to unknown values. 


è If the instruction is similar to a Debug state instruction, it executes as that Debug state instruction. 
° The instruction has the same behavior as in Non-debug state. 


The following list shows the permissible behaviors for T32 instruction in Debug state. An instruction might appear 
multiple times in the list, in which case the choice of permissible behaviors is any of those listed. 


Exception-generating instructions 


These instructions are: 


s SVC. 
. HVC. 
d SMC. 
5 UDF. 
a BKPT. 
7 HLT. 


These instructions behave in one of the following ways: 
s They are UNDEFINED. 

° They execute as a NOP. 

. SVC behaves as DCPS1. 

. HVC behaves as DCPS2. 

. SMC behaves as DCPS3. 


e They generate the exception the instruction would generate in Non-debug state. The 
exception is taken as described in Exceptions in Debug state on page H2-6734 
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Note 


SMC must not generate a Secure Monitor Call exception from Non-secure state if 
EDSCR.SDD is set to 1. 


Instructions that explicitly write to the PC (branches) 


These instructions are: 
. B, B (conditional), CBZ, CBNZ BL. 


BX, BLX (register or immediate). 

be BXJ, TBB, TBH. 

° MOV pc and related instructions. 

- LDR pc, LDM (with a register list includes the PC), POP (with a register list that includes the PC). 
These instructions behave in one of the following ways: 

: They are UNDEFINED. 

° They execute as a NOP. 


à They execute as in Non-debug state without branching and set DSPSR and DLR to 
UNKNOWN values. 
Exception return and related instructions, other than ERET 
These instructions are: 
. SRS, RFE, SUBS pc, 1r, and related instructions. 
These instructions behave in one of the following ways: 
$ They are UNDEFINED. 
a They execute as a NOP. 


. They execute as in Non-debug state without branching, setting DLR and DSPSR to 
UNKNOWN values, and either: 


— Execute the DRPS operation instead of performing an exception return, using UNKNOWN 
SPSR values. 


— Not changing Exception level or PE mode. 


Instructions that request entry to a low-power state 


These instructions are: 
a WFE, WFI. 


These instructions behave in one of the following ways: 


è They are UNDEFINED. 
° They execute as a NOP. 
° They generate a synchronous exception if the corresponding instruction would be trapped in 


Non-debug state. See Configurable instruction enables and disables, and trap controls on 
page G1-5576. 


. A WFE instruction is permitted to clear the Event register if it is set. 


Note 


This means that these instructions must not suspend execution. 








Instructions that read the PC 


These instructions are: 

° LDR (literal), LDRB (literal), LDRH (literal), LDRSB (literal), LDRSH (literal). 
° ADR, ADRL, ADRH. 

° PLD (literal), PLI (literal). 
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These instructions behave in one of the following ways: 


` They are UNDEFINED. 
° They execute as a NOP. 
` They execute as in Non-debug state using an UNKNOWN value for the PC operand. 


Instructions that explicitly modify PSTATE, other than DCPS and ERET 


These instructions are: 

: CMP, TST, TEQ, CMN. 

. <opc>S. 

. MRC p14,0,APSR_nzcv,c0,c1,0 (accessing DBGDSCRint). 

. CPS, SETEND, IT. 

: MSR CPSR (immediate), MSR CPSR (register), MSR APSR (immediate), MSR APSR (register). 
. VMRS APSR_nzcv,FPSCR. 

s QADD, QDADD, QSUB, QDSUB. 


. SMLABB. SMLABT, SMLATB, SMLATT, SMLAD, SMLAWB, SMLAWT, SMLSD, 
SMUAD. 


s SSAT, SSAT16, USAT, USAT16. 

° SADD, SADD8, SADD16, SASX, SSAX, SSUB, SSUB8, SSUB16. 

° UADD, UADD8, UADD16, UASX, USAX, USAUB, USUN8, USUB16. 
à When ARMv8.1-PAN is implemented, SETPAN. 


These instructions behave in one of the following ways: 
5 They are UNDEFINED. 
° They execute as a NOP. 
s They execute as in Non-debug state, setting DSPSR_ELO and DLR_ELO to UNKNOWN 
values. 
Instructions that read PSTATE.{N, Z, C, V} or other PSTATE fields 


These instructions are: 


7 SEL, VSEL. 
. ADC, SBC, all instructions with an RRX shift. 
° MRS CPSR. 


These instructions behave in one of the following ways: 


. They are UNDEFINED. 
° They execute as a NOP. 
° They execute as in Non-debug state: 


— For the conditional operations and those using the PSTATE.C flag as an input, these 
instructions use an UNKNOWN value for the Condition flag. 


— For the MRS instruction, they return an UNKNOWN value 


All other instructions 


These instructions behave in one of the following ways: 


: They are UNDEFINED. 

. They execute as a NOP. 

s They have the same behavior as in Non-debug state. 
Note 





This includes instructions defined as UNPREDICTABLE or CONSTRAINED UNPREDICTABLE in 
Non-debug state. These instructions are CONSTRAINED UNPREDICTABLE in Debug state. This 
includes some T32 instructions that specify R15 as a destination or source register. 
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H2.4.3 


Appendix K1 Architectural Constraints on UNPREDICTABLE behaviors describes the 
CONSTRAINED UNPREDICTABLE behavior for these instructions. In Debug state these CONSTRAINED 
UNPREDICTABLE choices are further restricted: 


. Instructions that specify R15 as a destination register: 


— Are not permitted to branch, because the architecture does not define a branch 
operation in Debug state. 


— Might set DLR and DSPSR to UNKNOWN values. 
— Might have any of the other permitted behaviors. 


a Instructions that specify R15 as a source operand: 
— Cannot use PC + offset, because there is no architecturally-defined PC in Debug state. 
— Might have any of the other permitted behaviors, including using an UNKNOWN value. 





Decode tables 


The syntax in the tables is defined as follows: 
1 The bit has a fixed value of 1. 
0 The bit has a fixed value of 0. 


!= The field has any value other than the value or values specified. The field might be an encoding field 
in the instruction whose value is supplied by the debugger. 


Note 


The instruction encodings in Chapter C6 464 Base Instruction Descriptions and Chapter F5 T32 and A32 Base 
Instruction Set Instruction Descriptions might show these bits as (0) or (1). A debugger must set these bits to 0 or 
1, as appropriate. 








Any other value indicates an encoding field in the instruction whose value is supplied by the debugger. Some values 
might be reserved or undefined, in which case the instruction is UNDEFINED or CONSTRAINED UNPREDICTABLE in 
Debug state, as it is in Non-debug state. 


For more information about the instruction encodings, see: 

a Chapter C6 464 Base Instruction Descriptions. 

s Chapter F5 T32 and A32 Base Instruction Set Instruction Descriptions. 

For information about the syntax used in Table H2-2, Table H2-3 on page H2-6727, Table H2-4 on page H2-6727, 
and Table H2-5 on page H2-6728, see: 

e Common syntax terms on page C1-171. 

. Assembler symbols on page F2-3905. 


Table H2-2 shows the A64 instructions that are modified in Debug state. For details of how these are packed in the 
EDITR see the register description. 


Table H2-2 Modified A64 instructions in Debug state 










































































313029282726252423222120191817161514131211109 8 7 654 3 2 1 0 Description 

1 10 010 1010000000000000 00 0 0 0 0 1=00 DCPS<opt> 

110 010 0DOLI1101101000101000 Rt MRS|MSR accessing DSPSR_ELO 

1 10 0 1 0 OoO0oLI 1011010001010 01 Rt MRS|MSR accessing DLR_ELO 

1 10 oll LO11LL1110000001111 10 00 0 pres 
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Table H2-3 show the T32 instructions that are modified in Debug state, with the first halfword on the left side and 
the second halfword on the right side. For details of how these are packed in the EDITR see the register description. 


Table H2-3 Modified T32 instructions in Debug state 
















































































































































































































































































1514131211109 8 7 654 b 2 1 0 7514131211109 8 7 654 3 2 1 0 Description 
11108 110011001 0 0 fF1111 1 111000 1 0 1 O 1 MRC|MCR accessing DSPSR 
11108 11001 1CL 1 0 0 f-1l1l11 1 111001 10 1 O 1 MRC|MCR accessing DLR 
11110011110 1110 0001111000000 0 O ERET 
11110111% 00041111 0000000000 0 0 0 !=00 pCPS<opt> 

Table H2-4 lists the A64 instructions that are unchanged in Debug state. 

Table H2-4 A64 instructions that are unchanged in Debug state 
B13029282726252423222120191817161514131211109 8 7654 3 2 1 0 Description 
sfo001000100000000000000f7 111 1 Rd MOV <Rn>,SP 
sfo0I1 0001000000000000 00 Rn 1 1 1 1 1 MOV SP,<Rn> 
sf !=01 1 0 0 fl 0 || bhw imml6 Rd MOVN, MOVK, MOVZ 
110f 0O1019p0000001100100000000f 1 1 1 1 NOP 
1101010100000011 0010000010L|l 1 1 1 1 SEV, SEVL 
1101010100000011 0010001000 B| 1 1 1 1 ESB, PSB 
1101010100000011 00110000010fl 1 1 1 1 (CLREX 
110f 0101000000 1 1 0 0 1 1 pption 1 !=11 1 1 1 1 1 DSB, DMB, ISB 
110 010 190 00 0 1 ppl CRn CRm op2 Rt IC, DC, TLBI, AT 
11001010 0L] 0 ppl CRn CRm op2 Rt MRS|MSR accessing System register 
110010 10 0 L171 1 ppl !=0100 CRm op2 Rt MRS|MSR accessing System register 
110 010190 02 {L 1 ppl 0 1 0 0 {!=0010 op2 Rt MRS|MSR accessing Special-purpose 

register 
kize D 0 1 b b 0 b2L b Rs b0 Rt2 Rn Rt LD(A|LA|X|AX)R{B |H}, 
ST(L|LL|X|LX)R{B | H}, 
CAS{A|L|AL}{B|H} 
size 0 0 1 0 0 0 b2L 1 Rs b0 Rt2 Rn Rt LD{A}XP, ST{L}XP, CASP{A|L|AL} 
!1=11 1 1 1 0 0 0 opc 0 imm9 0 0 Rn Rt LDUR{B |H|SB | SH | SW}, STUR{B|H} 
11111000 '=10 0 imm9 0 0 Rn Rt LDUR, STUR 
size 1 1 1 0 0 0 ppc 0 imm9 0 Rn IRt LDTR{B|H|SB|SH| Sw}, STTR{B|H} 
size 1 1 1 0 0 0 ppc 0 imm9 IP jl Rn IRt LDR{B|H|SB|SH| SW}, STR{B | H} 
size 1 1 100 0AR{ Rs 0 opc 0 0 Rn Rt LD<op>{A|L|AL}{B|H}, 
ST<op>{A|L|AL}{B|H} 
size 1 1100 0AR{ Rs 1 0 0 0 Rn Rt SWP{A|L|AL}{B |H} 
O 0 1190 00 0 imm5 0 1 1 jl Rn IRd INS <Vd>.<Ts>[<index>] ,<R><n> 
0RQ00 11 0 0 0 0 imm5 0 01 1 1 {1 Rn IRd UMOV <R><d>,<Vn>.<Ts>[<index>] 
ooo 7 110 0 Off Pp O ft 1 opp 0 00 Rn Rd FMOV <Sd>,<Wn>, FMOV <Wd>,<Sn> 
1001111001100 1 ppp 0 0 0 Rn Rd FMOV <Dd>,<Xn>, FMOV <Xd>,<Dn> 
1001 tif pf off 0 1 7 1 ppp 0 0 0 Rn Rd FMOV <Vd>.D[1] ,<Xn> 
FMOV <Xd>,<Vn>.D[1] 
1001000 I 0 uimm6 (0)(0)uimm4 Xn Xd DDG <Xd|SP>, <XN|SP>, #<uimm6>, 
H#<uimm4> 
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Table H2-4 A64 instructions that are unchanged in Debug state (continued) 








































































































3130292827 2625 2423 222120191817161514131211109 8 7 6 5 4 3 2 1 0 Description 

1 oO f 100 f 0 O Jl tmm9 1 0 Xn Xd STG <Xt|SP>, [<Xn|SP>{, #<simm}]!, 
Signed offset 

1 il 110 1 Off 0 0 0 0 0 000000 Kn Xd STGM <Xt>, [<Xt|SP>] 

1 of 100 1 7 O |l imm9 1 1 Kn Xd ST2G <Xt|>, [Xt|SP>{, #<simm>}] Signed 
loffset 

1 of 100 f 0 1 Jl tmm9 1 1 Kn Xd STZG <XT|SP>, [<Xn|SP{. #<simm>}]! 
Signed offset 

1 of 100 ff 1 | imm9 1 0 Kn Xd STZ2G <XT|SP>, [<Xn|SP{. #<simm>}]! 
Signed offset 

1) 0 f 1 0 1 0 000 0 0 0 0000 0 Kn Xd STZGM, <Xt>, [Xn|SP>] 

opi i ol 0 1 0 bimm7 IXt2 Xn Xt STGP <xt1>, <Xt2>, [<Xn|SP>{, #<imm>}] 
Signed offset 

11 010001 I 0 uimm6 op3 uimm4 Xn Xd SUBG <Xd|SP>, <Xn|SP>, #<uimm6>, 
#<uimm4> 

110i 1 Oo jl 0 1 |l imm9 0 0 Xn Xd LDG <Xt>, [<Xn|SP>{, #<simm>}] 

1i 110 1 1 f 0 00 0 0 000000 Kn Xd LDGM <Xt>, [<Xn|SP>] 











Table H2-5 lists the T32 instructions that are unchanged in Debug state. It shows the T32 instructions with the first 
halfword on the left side and the second halfword on the right side. 


Table H2-5 T32 instructions that are unchanged in Debug state 

































































































































































4514131211109 8 7 6 5 4 3 2 1 0 1514131241109 8 7 6 5 4 B 2 1 O Description 
1110410001 0 bpl=un 1 101100 Mi Vm WMOV <Dm>,<Rt>, <Rt2> 
VMOV <Rt>,<Rt2>,<Dm> 

1 11.01 1 10) 0 0 opNn =111 [| 0O10NbD01 D 0 0 0 WMov <Sn>,<Rt>, VNOV <Rt>, <Sn> 
11101 110) bpe 0 Wa =1111 1 0 1 1 D bpe2 i 0 0 0 0 \mov.<size> <Dd>[<x>],<Rt> 
1110110 U bpe 1 Wn =1111 1 0 1 1 D bpe2 | 0 0 0 0 Mov. <dt> <Rt>,<Dd>[<x>] 
111011107 1 1 bpteg =1111 || 01000010 0 0 Wns, wsr 
1 110 100 0 1 0 ppf=1111 =1111 1 11 cp opc1 CRm MCRR|MRRC accessing System registers 
1 110 1 1 0 ppcl op CRn =1111 1 11 bp opc2 1 CRm MCR|MRC accessing System registers 
1110000010 Luu H111 Rd imm8 LDREX, STREX 
11100001108 f= fnnu Re 0 1/!=10Rd LDREX(B|H|D), STREX(B|H|D) 
111000011048 =i funu Re 1 | op3 Rd LDA{EX}{B|H|D}, STL{EX}{B|H|D} 
111000) 10x10 L a111 = «fet  t=1111  imm8 LDRD, STRD 

!=xx0x 
11110: f Off 0 0 imm4 D imm3 |=1111  fmm8 Movw, MOVT 
111100111 00R/-un 000M 001 M0 0 0 0 MSR <spec_reg><mode>,<Rn> 
111i bo11f 001 tun 1 0.0.01 11 1D 0 0 0 0 0 0 0 WsR sPsR, <Rn> 
111100117 0108 111f0000000b000000 0 hop.w 
1111001170108 111f00060000b00001 0 L kevin, sevi.w 
rl111001171010f 111f 00060000b001000 0 [Ess 
biti borrfhoririirippooofi1i11b0101 11 1 forex 
111100111011 111 000 111 p 1 t11 option — psp, ove, ISB 
11110011111RM 1 0 0 0 t=1111 001 Mb 0 0 O MRS <Rd>,<spec_reg><mode> 
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Table H2-5 T32 instructions that are unchanged in Debug state (continued) 
























































1514131241109 8 7 6 5 4 8 2 1 0514131241109 8 7 6 54 3 2 14 0 Description 

PrTT POLIT TTL L1L1f 000 Fill 000000 0 0 PRs <R,SPsR 
11i1ihoook ub tun fun immi? STR{B|H} .w (12-bit immediate) 
11110000 110 fn f= (1 }=000 imm8 STR{B|H| HT} (8-bit immediate) 
rritfooh eni in fHn mm2 LDR{SB|SHIB/H}.W (12-bit immediate) 
r11ifo0o8b fui ii fun | {000 jmms LDR{SB|SH|B|H}{T} (8-bit immediate) 
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H2.4.4 


H2-6730 


In Debug state 


Security in Debug state 


If EL3 is implemented or the implemented Security state is Secure state, security in Debug state is governed by the 
Secure debug disabled flag, EDSCR.SDD. 


On entry to Debug state 


If entering in Secure state, EDSCR.SDD is set to 0. Otherwise EDSCR.SDD is set to the inverse of 
ExternalSecureInvasiveDebugEnabled(). That is: 


° If ExternalSecureInvasiveDebugEnabled() == TRUE, EDSCR.SDD is set to 0. 
. If ExternalSecureInvasiveDebugEnabled() == FALSE, EDSCR.SDD is set to 1. 





Note 


Normally, if ExternalSecureInvasiveDebugEnabled() == FALSE then halting is prohibited and it is 
not possible to enter Debug state from Secure state. However, because changes to the authentication 
signals require a Context synchronization event to guarantee their effect, there is a period during 
which the PE might halt even though the authentication signals prohibit halting. 


The value of EDSCR.SDD does not change, even if ExternalSecureInvasiveDebugEnab1ed() 
changes. 


Note 
DBGAUTHSTATUS _ELI.{SNID, SID, NSNID, NSID} are not frozen in Debug state. 





s If EDSCR.SDD set to 1 in Debug state, then there is no means to enter Secure state from 
Non-secure state. In this case it is impossible for the PE to be in Secure state. This is a general 
principle of behavior in Debug state. 





In Non-debug state 


EDSCR.SDD returns the inverse of ExternalSecureInvasiveDebugEnabled(). If the authentication 
signals that control External SecureInvasiveDebugEnabled() change, a Context synchronization event 
is required to guarantee their effect. 





Note 
a In Non-debug state, EDSCR.SDD is unaffected by the Security state of the PE. 
. A Context synchronization event is also required to guarantee that changes in the 
authentication signals are visible in DBGAUTHSTATUS_EL1.{SNID, SID, NSNID, 
NSID}. 





If EL3 is not implemented and the implemented Security state is Non-Secure state, EDSCR.SDD is RES1. 
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H2.4.5 Privilege in Debug state 


The only additional privileges offered to Debug state are: 
s The privilege to execute Debug state operations, DCPS, DRPS, MRS, MSR. 
° The privilege to execute DTR access instructions regardless of the Exception level and traps. 


The DTR access instructions can be executed at any Exception level, including ELO, regardless of any control 
register settings that might force these instructions to be undefined or trapped in Non-debug state. These instruction 
are: 


è The MRS and MSR instructions that access DBGDTR_EL0, DBGDTRTX_ELO, and DBGDTRRX_ELO in 
AArch64 state. 


. The MRC and MCR instructions that access DBGDTRTXint and DBGDTRRXint in AArch32 state. 


All other instructions operate with the privilege determined by the current Exception level and security state. This 
applies to all Special-purpose and System registers accesses, memory accesses, and undefined instructions, and 
includes generating exceptions when the System registers trap or disable an instruction. 


H2.4.6 Debug state operations, DCPS, DRPS, MRS, MSR 


Armv8 defines operations to change between Exception levels in Debug state. These operations can also change the 
mode at the current Exception level. 


DCPS<n> 


Executing a DCPS<n> instruction in Debug state moves the PE to a higher Exception level or to a specific mode at 
the current Exception level. 


If the DCPS<n> instruction is executed in AArch32 state and the target Exception level is using AArch64: 
a The current instruction set switches from T32 to A64. 


. The effect on registers that are not visible or only partially visible in AArch32 state is the same as for system 
calls in Non-debug state. See Execution state on page D1-2271. 


Otherwise, the instruction set state does not change. 


If the target Exception level is the same as the current Exception level, then the PE does not change Exception level. 
However, the PE might change mode. 


The effect on endianness is the same as for exceptions and exception returns in Non-debug state: 


° In AArch64 state the current endianness is determined by the value of SCTLR_ELx.EE for the target 
Exception level. 


a In AArch32 state the current endianness is determined by the value of SCTLR.EE or HSCTLR.EE for the 
target Exception level. 


The DCPS<n> instructions are: 
In AArch64 state 


s DCPS1 
> DCPS2 
$ DCPS3 
In AArch32 state, in the T32 instruction set only 
e T1 variant 
° T1 variant 
° T1 variant 


The DCPS instructions are undefined in Non-debug state. 
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Table H2-6 shows the target of the instruction. In Table H2-6 the entries have the following meaning: 


EL1h/Sve This means that the target is: 
. EL1h if EL1 is using AArch64. 
5 EL1 and Supervisor mode if EL1 is using AArch32. 


EL2h/Hyp This means that the target is: 
. EL2h if EL2 is using AArch64. 
s EL2 and Hyp mode if EL2 is using AArch32. 


EL3h/Monitor This means that the target is: 
5 EL3h if EL3 is using AArch64. 
` EL3 and Monitor mode if EL3 is using AArch32. 


Sve Secure Supervisor mode, in EL3 using AArch32. 


Monitor Secure Monitor mode, in EL3 using AArch32. 


Table H2-6 Target for DCPS instructions in Debug state 





Instruction Target when DCPS instruction executed at stated Exception level: 











ELO EL1 EL2 EL3 (AArch64)  EL3 (AArch32) 
DCPS1 EL1h/Sve EL1h/Sve EL2h/Hyp EL3h Sve, clears SCR.NS to 0 
DCPS2 EL2h/Hyp EL2h/Hyp EL2h/Hyp EL3h UNDEFINED 
DCPS3 EL3h/Monitor EL3h/Monitor EL3h/Monitor EL3h Monitor, clears SCR.NS to 0 





In AArch32 Monitor mode, DCPS1 and DCPS3 clear SCR.NS to 0. 


Note 
In AArch64 state, at EL3, DCPS<n> does not change SCR_EL3.NS. 








However: 


° DCPS1 is undefined at ELO if either: 


— EL2 is implemented and enabled in the current Security state, and is using AArch64 and 
HCR EL2.TGE = 1. 


— In Non-secure state, EL2 is implemented and using AArch32 and HCR.TGE == 1. 
à DCPS2 is undefined at all Exception levels if EL2 is not implemented. 


à DCPS2 is undefined at the following Exception levels if EL2 is implemented: 
— At ELO and EL! in Secure state if EL2 is disabled in the current Security state. 
— At EL3 if EL3 is using AArch32. 


$ DCPS3 is undefined at all Exception levels if either: 
— EDSCR.SDD = 1. 
—  EL3 is not implemented. 


Note 


The references to DCPS1, DCPS2, and DCPS3 in this section link to the descriptions of the instructions in the A64 
instruction set. The DCPS<n> instructions are also defined in the T32 instruction set, see DCPS1, DCPS2, DCPS3. These 
instructions are not defined in the A32 instruction set, because A32 instructions cannot be executed in Debug state. 
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On executing a DCPS instruction: 


$ If the target Exception level is using AArch64: 
— ELR Elx ofthe target Exception level becomes UNKNOWN. 
—  SPSR_ELx of the target Exception level becomes UNKNOWN. 
— ESR _ELx of the target Exception level becomes UNKNOWN. 
—  DLR_ELO and DSPSR_ELO become UNKNOWN. 


: If the target Exception level is using AArch32 DLR and DSPSR become UNKNOWN and: 
— Ifthe target Exception level is EL1 or EL3, the LR and SPSR of the target mode become UNKNOWN. 
— Ifthe target Exception level is EL2, then ELR_hyp, SPSR_hyp, and HSR become UNKNOWN. 


If the target Exception level is using AArch32, and the target Exception level is EL1 or EL3, the LR and SPSR of 
the target mode become UNKNOWN. 


If ARMv8.0-SSBS is implemented, the DCPS<n> instruction leaves the PSTATE.SSBS bit UNKNOWN. 


The DCPSInstruction() function is described in Chapter J1 Armv8 Pseudocode. 


DRPS 


Executing the DRPS operation in Debug state moves the PE to a lower Exception level, or to another PE mode at 
the current Exception level, by copying the current SPSR to PSTATE. 


If DRPS is executed in AArch64 state and the target Exception level is using AArch32: 
è The current instruction set switches from A64 to T32. 


$ The effect on registers that are not visible or only partially visible in AArch32 state is the same as for 
exception returns in Non-debug state. See Execution state on page D1-2271. 


Otherwise, the instruction set state does not change. 


If the target Exception level is the same as the current Exception level, then the PE does not change Exception level. 
However, the PE might change mode. 


The effect on endianness is the same as for exceptions and exception returns in Non-debug state: 


If targeting an Exception level using AArch64, current endianness is set according to SCTLR_ELx.EE, or 
SCTLR_EL1.EOE for the target Exception level. 


: If targeting an Exception level using AArch32, current endianness is set by SPSR.E as appropriate. 


The DRPS instructions are: 
In AArch64 state 


s DRPS 
In AArch32 state, in the T32 instruction set only 
s ERET 


If the SPSR specifies an illegal exception return, then PSTATE. {M, nRW, EL, SP} are unchanged and PSTATE.IL 
is set to 1. For further information on illegal exception returns, see ///egal return events from AArch64 state on 
page D1-2304. 


PSTATE. {N, Z, C, V, Q, GE, IT, T, SS, D, A, I, F} are ignored in Debug state. This means that the effect of the DRPS 
operation on these fields is to set them to an UNKNOWN value that might be the value from the SPSR. For more 
information see PSTATE in Debug state on page H2-6714. 


All other PSTATE fields are copied from SPSR. 


DRPS is undefined at ELO and in Non-debug state. 
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Note 


Unlike an exception return, the DRPS operation has no architecturally-defined effect on the Event Register and 
Exclusives monitors. DRPS might set the Event Register or clear the Exclusives monitors, or both, but this is not a 
requirement and debuggers must not rely on any implementation specific behavior. 








On executing a DRPS instruction: 
è If the target Exception level is using AArch64: 

— DLR _EL0 and DSPSR_ELO become UNKNOWN. 
z If the target Exception level is using AArch32: 

— DLR and DSPSR become UNKNOWN. 


If ARMv8.0-SSBS is implemented, the DRPS instruction leaves the PSTATE.SSBS bit UNKNOWN. 


The DRPSInstruction() function is described in Chapter J1 Armv8 Pseudocode. 


MRS and MSR 
The other Debug state instructions are used to read or write DLR_ELO and DSPSR_ELO. 


These instructions are: 
In AArché6é4 state 
. MRS 
. MSR (register) 
In AArch32 state 
. MRC 
$ MCR 
MRS <Xt>, DLR_ELO ; Copy DLR_EL@ to <Xt> 
MRS <Xt>, DSPSR_ELO ; Copy DSPSR_EL@ to <Xt> 


MSR DLR_ELO@, <Xt> ; Copy <Xt> to DLR_EL@ 
MSR DSPSR_ELO@, <Xt> ; Copy <Xt> to DSPSR_ELO 


These instructions can be executed at any Exception level when in Debug state, including ELO. They are undefined 
in Non-debug state. 


Exceptions in Debug state 


The following sections describe how exceptions are handled in Debug state: 
° Generating exceptions when in Debug state. 

° Taking exceptions when in Debug state on page H2-6735. 

° Reset in Debug state on page H2-6736. 


Generating exceptions when in Debug state 
In Debug state: 
: Instruction Abort exceptions cannot happen because instructions are not fetched from memory. 


7 Interrupts, including SError and virtual interrupts are ignored and remain pending: 


— The pending interrupt remains visible in ISR. 


. Debug exceptions and debug events are ignored. 

° SCR.EA is treated as if it were set to 0, regardless of its actual state, other than for the purpose of reading the 
bit. 

s Any attempt to execute an instruction bit pattern that is an allocated instruction at the current Exception level, 


but is listed in Executing instructions in Debug state on page H2-6715 as undefined in Debug state, generates 
an exception, that is taken to the current Exception level, or to EL1 if executing at ELO. 
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Note 


If the exception is taken to an Exception level that is using AArch32 then it is taken as an Undefined 
Instruction exception. 





The priority and syndrome for these exceptions is the same as for executing an encoding that does not have 
an allocated instruction. 


Instructions executed at EL2, EL1 and ELO that are configured by EL3 control registers to trap to EL3: 
— When the value of EDSCR.SDD is 0, generate the appropriate trap exception that is taken to EL3. 


— When the value of EDSCR.SDD is 1, are treated as UNDEFINED and generate an exception that is taken 
to the current Exception level, or to EL1 if the instruction is executed at ELO. If the exception is taken 
to an Exception level that is using AArch32 it is taken as an Undefined Instruction exception. 

If the exception is taken to an Exception level using AArch64 or to AArch32 Hyp mode, then it is 
reported with an EC value of 0x00. 


Otherwise configurable traps, enables, and disables for instructions are unaffected by Debug state, and 
executing an affected instruction generates the appropriate exception. 


Otherwise, synchronous exceptions, including Data Aborts, are generated as they would be in Non-debug state and 
taken to the appropriate Exception level in Debug state. 





Note 


If EDSCR.SDD == | then an exception from Non-secure state is never taken to Secure state. See Security in Debug 
state on page H2-6730. 





Taking exceptions when in Debug state 


When the PE is in Debug state, all exceptions are synchronous. When an exception is generated, it is taken to Debug 
state. This means that: 


The target Exception level is as defined for the exception in Non-debug state. 


If the target Exception level is using AArch32 then the target PE mode is as defined for the exception in 
Non-debug state. 


The exception syndrome is reported as defined for the exception in Non-debug state, except for the case 
described in Data Aborts in Memory access mode on page H4-6774 for which the reporting requirements are 
relaxed. 


The exception syndrome is reported using the syndrome register or registers for the target Exception level. 
In AArch64 state, these are ESR_ELx, and FAR_ELx. In AArch32 state, these are DFSR, DFAR, HSR, 
HDFAR, and HPFAR. For example: 


— Ifa Data Abort exception is taken to Abort mode at EL1 or EL3 and the exception is taken from 
AArch32 state and using the Short-descriptor translation table format, the DFSR reports the exception 
using the Short-descriptor format fault encoding. For exceptions other than Data Abort exceptions 
taken to Abort mode, DFSR is not updated. 


—  Ifan instruction is trapped to an Exception level using AArch64 due to a configurable trap, disable, or 
enable, the exception code reported is the same as it would be in Non-debug state. 


The effect on auxiliary syndrome registers, such as AFSR, is IMPLEMENTATION DEFINED. 


Note 


Generally, the AArch32 Fault Address Registers (FARs) and Fault Status Registers (FSRs) are not described 
as syndrome registers, although the term is appropriate to their function. 








The PE remains in Debug state and changes to the target mode. 


If EL3 is using AArch32 and the exception is taken from Monitor mode, SCR.NS is cleared to 0. 
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s If the exception is taken to an Exception level using AArch32, the PE continues to execute T32 instructions, 
regardless of the TE bit in the System register for the target Exception level. 


° The endianness switches to that indicated by the EE bit of the System register for the target Exception level. 
° The SPSR for the target Exception level or mode is corrupted and becomes UNKNOWN. 

° If the target Exception level is using AArch64, ELR_ELx for the target Exception level becomes unknown. 
` If the target Exception level is EL2 using AArch32, ELR _hyp becomes unknown. 


° If the target Exception level is EL1 or EL3 using AArch32, LR_<mode> for the target mode becomes 
unknown. 


e DLR and DSPSR become UNKNOWN. 
° The cumulative error flag, EDSCR.ERR, is set to 1. See Cumulative error flag on page H4-6778. 
° PSTATE.IL is cleared to 0. 


° PSTATE. {IT, T, SS, D, A, I, F} are set to UNKNOWN values, and PSTATE. {N, Z, C, V, Q, GE} are unchanged. 
However, these fields are ignored and are not observable in Debug state. For more information see PSTATE 
in Debug state on page H2-6714. 


The debugger must save any state that can be corrupted by an exception before executing an instruction that might 
generate another exception. 


Pseudocode description of taking exceptions in Debug state 


The pseudocode function AArch64.TakeException() shows the behavior when the PE takes an exception to an 
Exception level using AArch64 in Non-debug state. In Debug state, this is replaced with the function 
AArch64.TakeExceptionInDebugState(). 


The pseudocode functions AArch32.EnterMode(), AArch32.EnterHypMode(), and AArch32.EnterMonitorMode() show 
the behavior when the PE takes an exception to an Exception level using AArch32 in Non-debug state. In Debug 
state: 


. AArch32.EnterMode() is replaced with the function AArch32.EnterModeInDebugState(). 
. AArch32.EnterHypMode() is replaced with the function AArch32.EnterHypModeInDebugState(). 
. AArch32.EnterMonitorMode() is replaced with AArch32.EnterMonitorModeInDebugState(). 


Reset in Debug state 


If the PE is reset when in Debug state, it exits Debug state and enters Non-debug reset state. When the PE is in reset 
state, EDSCR.STATUS == 0b000010 and writes to EDITR are ignored. 





Note 


If EDECR.RCE == 1 or CTIDEVCTL.RCE ==1, meaning that a Reset Catch debug event is programmed, and if 
halting is allowed on exiting reset state, then on exiting reset state the PE halts and re-enters Debug state. See Reset 
Catch debug events on page H3-6763. All PE registers have taken their reset values, which might be UNKNOWN. 





Accessing registers in Debug state 


Register accesses are unchanged in Debug state. The view of each register is determined by either the current 
Exception level or the mode, or both, and accesses might be disabled or trapped by controls at a higher Exception 
level. 
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General-purpose register access, other than AArch64 state SP access 


A single general-purpose register can be read by issuing an MSR instruction through the ITR to write DBGDTR_ELO 
in AArch64 state, or an MCR instruction through the ITR to write DBGDTRTXint in AArch32 state. The debugger 
can then read the DTR register or registers through the external debug interface. The reverse sequence writes to a 


general-purpose register. 


Figure H2-1 shows the reading and writing of general-purpose registers, other than SP, in Debug state in AArch64 


state. 


START 


4— No 


Yes 


4 


DBGDTRTX = D[63:32] 
DBGDTRRX = D[31:0] 
Sets RXfull to 1 














y 





START 





4— No 





TXfull == 
ITE == 1 






Yes 








y 
EDITR = MSR DBGDTR_ELO, Xn 
Sets TXfull to 0 











EDITR = MRS Xn, DBGDTR_ELO 
Clears RXfull to 0 











DONE 
Xn = D[63:0] 





y 
D[63:0] = DBGDTRRX 
D[31:0] = DBGDTRTX 
Clears TXfull to 0 

















DONE 
D[63:0] = Xn 


Figure H2-1 Reading and writing general-purpose registers, other than SP, in Debug state in AArch64 state 
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Figure H2-2 on page H2-6738 shows the reading and writing of general-purpose registers in Debug state in 


AArch32 state. 
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START START 


4 No 4 No 














TXfull == 





RXfull == 






































Yes Yes 
v v 
DBGDTRRX = W[31:0] EDITR = MCR p14, 0, Rn, cO, c5, O 
Sets RXfull to 1 Sets TXfull to 0 
y y 
EDITR = MRC p14, 0, Rn, cO, c5, 0 W[31:0] = DBGDTRTX 
Clears RXfull to 0 Clears TXfull to 0 




















DONE 
Rn = W[31:0] 


Figure H2-2 Reading and writing general-purpose registers in Debug state in AArch32 state 





SIMD and floating-point register, System register, and AArch64 state SP accesses 


To read a SIMD and floating-point register or a System register, the debugger must first copy the value into a 

general-purpose register using: 

$ An FMOV instruction in AArch64 state or a VMOV instruction in AArch32 state for floating-point transfers to 
SIMD and FP registers. 

$ A UMOV instruction in AArch64 state or a VMOV instruction in AArch32 state for SIMD transfers to SIMD and 
FP registers. 

° An MRS instruction in AArch64 state or an MRC instruction in AArch32 state for System registers. 

. A MOV Xd,SP instruction for the SP register in AArch64 state. 


The debugger can then read out the particular general-purpose register. The reverse sequence writes a register. 


PC and PSTATE access 


The debugger reads the program counter and PSTATE of the process being debugged through the DLR_ELO and 
DSPSR_ELO System registers. The actual values of PC and PSTATE cannot be directly observed in Debug state: 


7 Instructions that are used for direct reads and writes of PC and PSTATE in Non-debug state are UNDEFINED 
in Debug state. 


è On taking an exception, ELR_ELx and SPSR_ELx at the target Exception level are UNKNOWN. They do not 
record the PC and PSTATE. 


PSTATE. {IL, E, M, nRW, EL, SP} are indirectly read by instructions executed in Debug state, but all other PSTATE 
fields are ignored and cannot be observed. See also: 


° PSTATE in Debug state on page H2-6714. 
° Executing instructions in Debug state on page H2-6715. 
° Exceptions in Debug state on page H2-6734. 
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H2.4.9 Accessing memory in Debug state 


How the PE accesses memory is unchanged in Debug state. This includes: 


. The operation of the MMU, including address translation, tagged address handling, access permissions, 
memory attribute determination, and the operation of any TLBs. 

$ The operation of any caches and coherency mechanisms. 

$ Alignment support. 

7 Endianness support. 


° The Memory order model. 


Simple memory transfers 


Simple memory accesses can be performed in Debug state by issuing memory access instructions through the ITR 
and passing data through the DTR registers. Executing instructions in Debug state on page H2-6715 lists the 
memory access instructions that are supported in Debug state. 


Bulk memory transfers 


Memory access mode can accelerate bulk memory transfers in Debug state. See DCC and ITR access modes on 
page H4-6772. 
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H2.5 


H2-6740 


Exiting Debug state 


The PE exits Debug state when it receives a Restart request trigger event. If EDSCR.ITE == 0 the behavior of any 
instruction issued through the ITR in Normal access mode or an operation issued by a DTR access in memory access 
mode that has not completed execution is CONSTRAINED UNPREDICTABLE, and must do one of the following: 


° It must complete execution in Debug state before the PE executes the restart sequence. 
$ It must complete execution in Non-debug state after the PE executes the restart sequence. 
. It must be abandoned. This means that the instruction does not execute. Any registers or memory accessed 


by the instruction are left in an UNKNOWN state. 


Note 


. Implementations can set EDSCR.ITE to 1 to indicate that further instructions can be accepted by ITR before 
the previous instructions have completed. If any previous instruction has not completed and 
EDSCR.ITE == 1, then the PE must complete these instructions in Debug state before executing the restart 
sequence. EDSCR.ITE == 0 indicates that the PE is not ready to restart. 





° A debugger must observe that any instructions issued through EDITR that might generate a synchronous 
exception, as complete, before issuing a restart request. It can do this by observing the completion of a later 
instruction, as synchronous exceptions must occur in program order. For example, a debugger can observe 
that an instruction that reads or writes a DTR register is complete because of its effect on the 
EDSCR. {TXfull, RXfull} flags. 





On exiting Debug state, the PE sets the program counter to the address in DLR, where: 


s If exiting to AArch32 state: 
— Bits[31:1] of the PC are set to the value of bits[31:1] of DLR. 


— Bit[0] of the PC is set to a CONSTRAINED UNPREDICTABLE choice of 0 or the value of bit[0] in DLR. 


° If exiting to AArch64 state: 


— Bits[63:56] of DLR_ELO might be ignored as part of tagged address handling. See Address tagging in 
AArch64 state on page DS-2506. 


— Otherwise the PC is set from DLR_ELO. 


Note 
Bits[63:32] of DLR_ELO are ignored when exiting to AArch32 state. 





Exit from Debug state can give rise to a PC alignment fault exception when the program counter is used. Unlike an 
exception return, this might also happen when returning to AArch32 state. For more information, see PC alignment 
checking on page D1-2287. 


On exiting Debug state, PSTATE is set from DSPSR in the same way that an exception return sets PSTATE from 
SPSR_ELx: 


à The same illegal exception return checks that apply to an exception return also apply to exiting Debug state. 
If the return from Debug state is an illegal exception return then the effect on PSTATE and the PC is the same 
as for any other illegal exception return. See Exception return on page D1-2303 and Exception return to an 
Exception level using AArch32 on page G1-5523. 


è The checks on the PSTATE.IT bits that apply to exiting Debug state into AArch32 state are the same as those 
that apply to an exception return. See Appendix K1 Architectural Constraints on UNPREDICTABLE 
behaviors. 


s PSTATE.SS is copied from DSPSR.SS if all of the following hold: 
— MDSCR EL1.SS=1. 
— The debug target Exception level is using AArch64. 
— Software step exceptions from the restart Exception level are enabled. 


Otherwise PSTATE.SS is set to 0. 
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Note 
Unlike a return using ERET, PSTATE.SS must be restored from DSPSR.SS because otherwise it is UNKNOWN. 








However, if OSDLR.DLK == 1 and DBGPRCR.CORENPDRQ == 0, meaning ARMv8.0-DoubleLock is 
implemented and locked in Non-debug state and therefore Software Step exceptions are disabled, but 
otherwise Software Step exceptions would be enabled from the restart Exception level, it is CONSTRAINED 
UNPREDICTABLE whether PSTATE.SS is copied from DSPSR.SS. 


: If ARMv8.0-SSBS is implemented, on exit from Debug state to AArch64 state, DSPSR_ELO.SSBS is copied 
to PSTATE.SSBS. 


° If ARMv8.0-SSBS is implemented, on exit from Debug state to AArch32 state, DSPSR.SSBS is copied to 
CPSR.SSBS. 


- If ARMv8.1-PAN is implemented, DSPSR_ELO.PAN is copied to PSTATE. PAN. 
7 If ARMv8.2-UAO is implemented, DSPSR_EL0.UAO is copied to PSTATE.UAO. 


s If ARMv8.4-DIT is implemented, on exit from Debug state to AArch64 state, DSPSR_ELO.DIT is copied to 
PSTATE.DIT. 


è If ARMv8.4-DIT is implemented, on exit from Debug state to AArch32 state, DSPSR.DIT is copied to 
CPSR.DIT. 


x If ARMv8.5-MemTag is implemented, on exit from Debug state to AArch64 state, DSPSR_EL0.TCO is 
copied to PSTATE.TCO. On exit from Debug state to AArch32 state, PSTATE.TCO is not updated. 





$ If ARMv8.5-BTI is implemented, DSPSR_EL0.BTYPE is copied to PSTATE.BTYPE. 


Note 


. One important difference between Debug state exit and an exception return is that the PE can exit Debug state 
at ELO. Despite this, the behavior of an exit from Debug state is similar to an exception return. For example, 
PSTATE. {D, A, I, F} is updated regardless of the value of SCTLR_EL1.UMA. 





è Exit from Debug state has no architecturally-defined effect on the Event Register and Exclusives monitors. 
An exit from Debug state might set the Event Register or clear the Exclusives monitors, or both, but this is 
not a requirement and debuggers must not rely on any implementation specific behavior. 





The ExitDebugState() function is described in Chapter J1 A4rmv8 Pseudocode. 
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This chapter describes a particular class of debug events. It contains the following sections: 


Introduction to Halting debug events on page H3-6744. 
Halting Step debug events on page H3-6746. 

Halt Instruction debug event on page H3-6756. 

Exception Catch debug event on page H3-6757. 

External Debug Request debug event on page H3-6761. 

OS Unlock Catch debug event on page H3-6762. 

Reset Catch debug events on page H3-6763. 

Software Access debug event on page H3-6764. 
Synchronization and Halting debug events on page H3-6765. 


Note 





Table K14-1 on page K14-7810 disambiguates the general register references used in this chapter. 
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H3.1 Introduction to Halting debug events 


External debug defines Halting debug events. The following Halting debug events are available in Armv8: 
. Halting Step debug events on page H3-6746. 

. Halt Instruction debug event on page H3-6756. 

` Exception Catch debug event on page H3-6757. 

° External Debug Request debug event on page H3-6761. 

è OS Unlock Catch debug event on page H3-6762. 

a Reset Catch debug events on page H3-6763. 

. Software Access debug event on page H3-6764. 


If halting is allowed, a Halting debug event halts the PE. The PE enters Debug state. 


In addition, breakpoints and watchpoints might halt the PE if halting is allowed. See Breakpoint and Watchpoint 
debug events on page H2-6706. Because breakpoints and watchpoints can generate an exception or halt the PE, 
Breakpoint and Watchpoint debug events are not classified as Halting debug events. 


For a definition of Debug state, see Chapter H2 Debug State. For a definition of halting allowed, see Halting allowed 
and halting prohibited on page H2-6705. 


Debug state entry and debug event prioritization on page H2-6707 describes the behavior when multiple debug 
events are generated by an instruction. 


See also Synchronization and Halting debug events on page H3-6765. 


Table H3-1 shows the behavior of Breakpoint, Watchpoint, and Halting debug events. 


Table H3-1 Summary of debug events and possible outcomes 





PE behavior when halting is: 


























Debug event type 
Allowed Prohibited 
Breakpoint and Watchpoint debug events on page H2-6706 Halt See Table D2-1 on page D2-2400 
and Table G2-1 on page G2-5615 
Halt Instruction debug event on page H3-6756 Halt UNDEFINED 
Software Access debug event on page H3-6764 Halt Ignored 
Exception Catch debug event on page H3-6757 Halt Ignored 
Halting Step debug events on page H3-6746 Halt Pended 
External Debug Request debug event on page H3-6761 Halt Pended 
Reset Catch debug events on page H3-6763 Halt Pended 
OS Unlock Catch debug event on page H3-6762 Pended Pended 





Table H3-2 shows where the pseudocode for each Halting debug event type is located. 


Table H3-2 Pseudocode description of Halting debug events 














Halting debug event type Pseudocode 

Halt Instruction debug event on page H3-6756 HLT on page C6-908 for AArch64 and HLT on page F5-4199 for AArch32 

Software Access debug event on page H3-6764 Pseudocode description of Software Access debug event on page H3-6764 

Exception Catch debug event on page H3-6757 Pseudocode description of Exception Catch debug events on page H3-6760 
H3-6744 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


Halting Debug Events 
H3.1 Introduction to Halting debug events 


Table H3-2 Pseudocode description of Halting debug events (continued) 





Halting debug event type Pseudocode 


Halting Step debug events on page H3-6746 Pseudocode description of Halting Step debug events on page H3-6755 





External Debug Request debug event on page H3-6761 Pseudocode description of External Debug Request debug events on 
page H3-6761 











Reset Catch debug events on page H3-6763 Pseudocode description of Reset Catch debug event on page H3-6763 
OS Unlock Catch debug event on page H3-6762 Pseudocode description of OS Unlock Catch debug event on page H3-6762 
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H3.2 Halting Step debug events 


Halting Step is a debug resource that a debugger can use to make the PE step through code one instruction at a time. 
This section describes the Halting Step debug events. It is divided into the following sections: 


$ Overview of a Halting Step debug event. 

$ The Halting Step state machine. 

7 Using Halting Step on page H3-6749. 

. Detailed Halting Step state machine behavior on page H3-6749. 

. Synchronization and the Halting Step state machine on page H3-6752. 

° Stepping T32 IT instructions on page H3-6754. 

. Disabling interrupts while stepping on page H3-6754. 

. Syndrome information on Halting Step on page H3-6754. 

. Pseudocode description of Halting Step debug events on page H3-6755. 


The architecture describes the behavior as a simple Halting Step state machine. See The Halting Step state machine. 


H3.2.1 Overview of a Halting Step debug event 


The behavior of Halting Step is defined by a state machine, shown in Figure H3-1 on page H3-6748. A Halting Step 
debug event executes a single instruction and then returns control to the debugger. When the debugger software 
wants to execute a Halting Step: 


1. With the PE in Debug state, the debugger activates Halting Step. 

2, The debugger signals the PE to exit Debug state and return to the instruction that is to be stepped. 
3; The PE executes that single instruction. 

4. The PE enters Debug state before executing the next instruction. 


However, an exception might be generated while the instruction is being stepped. That is either: 
. A synchronous exception generated by the instruction being stepped. 
° An asynchronous exception taken before or after the instruction being stepped. 


Halting Step has its own enable control bit, EDECR.SS and EDESR.SS. 


Note 


Because the Halting Step state machine states occur as a result of normal PE operation, the states can be described 
as both: 


° PE states. 
. Halting Step states. 








H3.2.2 The Halting Step state machine 


H3-6746 


The state machine states are: 


Inactive Halting Step is inactive. No Halting Step debug events can be generated, therefore execution is not 
affected by Halting Step. The PE is in this state whenever either of the following is true: 
s Halting Step is disabled. That is, EDECR.SS is set to 0 and EDESR.SS is set to 0. 
è Halting is prohibited. See Halting the PE on debug events on page H2-6705. In this state, if 
EDECR.SS is set to 1 then a Halting Step debug event is pending. 


In Figure H3-1 on page H3-6748 this state is shown in red. 


Active-not-pending 
Halting Step is enabled and active. This is the state in which the PE steps an instruction. EDECR.SS 
== ] and EDESR.SS == 0. Software must not set EDECR.SS to 1 unless the PE is in Debug state, 
otherwise behavior is CONSTRAINED UNPREDICTABLE, as described in Changing the value of 
EDECR.SS when not in Debug state on page H3-6753. 
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In Figure H3-1 on page H3-6748 this state is shown in green. 


Active-pending 
Halting Step is enabled and active. The step has completed, and the PE enters Debug state. 
EDESR:SS == 1. 
In Figure H3-1 on page H3-6748 this state is shown in green. 
Whenever Halting Step is enabled and active, whether the state machine is in the active-not-pending state or in the 
active-pending state depends on EDESR.SS. Halting Step state machine states on page H3-6749 shows this. 
In the simple sequential execution of the program the PE executes the Halting Step state machine, as follows: 
1. Initially, Halting Step is inactive. 
2, After exiting Debug state, Halting Step is active-not-pending. 
3. The PE executes an instruction and Halting Step is active-pending. 
4. The pending Debug state entry is taken on the next instruction and the step is complete. 


Exceptions and other changes to the PE context can interrupt this sequence. 


Figure H3-1 on page H3-6748 shows a Halting Step state machine. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H3-6747 
Non-Confidential 


Halting Debug Events 
H3.2 Halting Step debug events 





Halting step is disabled 















Inactive Write 1 to 
EDECR.SS=0 
Debug state EDECR.SS 
Halting step is enabled Debugger activation 
EDESR.SS is 





Inactive 
EDECR.SS=1 
Debug state 


Debug state exit with 
halting prohibited 


set to 0 by the 
exit from Debug 
state 










Step completed? 







Execution within Debug state exit 
Secure state 

Return to 
Non-secure state 






Inactive 
EDECR.SS=1 


EDESR.SS=0 
Halting prohibited 


Active-not-pending 
EDECR.SS=1 
EDESR.SS=0 


Halting allowed 






Exception to Secure state 
where halting is prohibited, 
other than SMC 













Execution within 


b 
Secure state Step completed? Step completed 





Return to 
Non-secure state 













Inactive 
EDECR.SS=1 


EDESR.SS=1 
Halting prohibited 


Active pending 
EDECR.SS=1 
EDESR.SS=1 
Halting allowed 







Asynchronous 
exception? 














Asynchronous 


exception? 
Debug state entry 





Inactive 
EDECR.SS=1 
EDESR.SS=1 
Debug state 










a. Step completed occurs when: 
. A debug event, other than a Halting Step debug event, causes entry into Debug state. 


b. Step completed occurs when: 
* An instruction is executed without taking an exception. 
+ An exception is taken to a state where halting is allowed. 
* Areset. 


c. Step completed occurs when: 
. An SMC exception is taken to Secure state where halting is prohibited. 


d. An asynchronous exception taken to a state where halting is allowed. 


e. An asynchronous exception taken to Secure state where halting is prohibited. 


Figure H3-1 Halting Step state machine 
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Note 


Figure H3-1 on page H3-6748 only describes state transitions to and from the inactive state by exit from Debug 
state, executing an exception return, or taking an exception. Other changes to the PE context, including writes to 
registers such as EDECR and OSDLR and changes to the authentication interface can also cause changes to the 
Halting Step state machine. These can lead to UNPREDICTABLE or CONSTRAINED UNPREDICTABLE behavior. See 
Synchronization and the Halting Step state machine on page H3-6752. 








The following bits control the state machine, as shown in Table H3-3: 
$ EDECR.SS. This is the Halting Step enable bit. 
$ EDESR.SS. This is the Halting Step debug event pending bit. 


Table H3-3 shows the Halting Step state machine states. The letter X in a register column means that the relevant 
bit can be set to either zero or one. 


Table H3-3 Halting Step state machine states 





Halting EDECR.SS EDESR.SS Halting Step state 

















Prohibited X X Inactive (Halting Step debug even not pending) 
Prohibited X 1 Inactive (Halting Step debug event pending). 
Allowed 0 0 Inactive 

Allowed 1 0 Active-not-pending 

Allowed X 1 Active-pending 





H3.2.3 Using Halting Step 


To step a single instruction the PE must be in Debug state: 
1. The debugger sets EDECR.SS to 1 to enable Halting step. 


2. The debugger signals the PE to exit Debug state with DLR set to the address of the instruction being stepped. 
The PE clears EDESR.SS to 0 and the Halting Step state machine enter the active-not-pending state. 


3; The PE executes the instruction being stepped. 


If an exception is taken to a state where halting is prohibited, then EDESR.SS is always correct for the 
preferred return address of the exception. 


4. The PE enters Debug state before executing the next instruction and the step is complete. 


Note 


° If ARMv8.3-DoPD is not implemented, EDECR.SS value is in the Debug power domain, meaning that the 
state machine is maintained over a powerdown of the Core power domain. 





. If ARMv8.3-DoPD is implemented, the values of EDECR.SS and EDESR.SS are set to 0 on a Cold reset, 
and, if the PE was stepping an instruction, EDESR.SS 1s effectively UNKNOWN after a Warm reset. A 
debugger must use a Reset Catch debug event to step over a powerdown state. 


e A debugger must only change the value of EDECR.SS when the PE is in Debug state, otherwise behavior is 
CONSTRAINED UNPREDICTABLE as described in Changing the value of EDECR.SS when not in Debug state 
on page H3-6753. 





H3.2.4 Detailed Halting Step state machine behavior 


The behavior of the Halting Step state machine is described in the following sections: 
° Entering the active-not-pending state on page H3-6750. 
° PE behavior in the active-not-pending state on page H3-6750. 
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. Entering the active-pending state on page H3-6751. 

. PE behavior in the active-pending state on page H3-6752 

. PE behavior in the inactive state when in Non-debug state on page H3-6752. 
. PE behavior in Debug state on page H3-6752. 


Entering the active-not-pending state 
The PE enters the active-not-pending state: 
è By exiting Debug state with EDECR.SS == 1. 


: By an exception return from a state where halting is prohibited to a state where halting is allowed with 
EDECR.SS == | and EDESR.SS == 0. 


s As described in Synchronization and the Halting Step state machine on page H3-6752. 


PE behavior in the active-not-pending state 
When the PE is in the active-not-pending state it does one of the following: 


s It executes one instruction and does one of the following: 
— Completes it without generating a synchronous exception. 
— Generates a synchronous exception. 


— Generates a debug event that causes entry to Debug state. 
a It takes an asynchronous exception without executing any instruction. 


. It takes an asynchronous debug event into Debug state. 


If no exception or debug event is generated 

If no exception or debug event is generated the PE sets EDESR.SS to 1. This means that the Halting Step state 
machine advances to the active-pending state. 

If an exception or debug event is generated 


The PE sets EDESR.SS according to all of the following: 

< The type of exception. 

à The target Exception level of the exception. 

° If the exception is taken to Secure state, whether halting is prohibited in Secure state. 
— This is determined by the result of ExternalSecureInvasiveDebugEnabled(). 


If an exception or debug event is generated, the PE sets EDESR.SS to 1 if one of the following applies: 


s A synchronous exception is generated by the instruction and one of the following applies: 
— The exception is taken to EL1 or EL2. 
— The exception is taken to EL3, it is not an SMC exception, and ExternalSecureInvasiveDebugEnabled() 


— The exception is an SMC exception. 


a An asynchronous exception is generated before executing an instruction and this is either: 
— Taken to EL1 or EL2. 
— Taken to EL3 and ExternalSecureInvasiveDebugEnabled() == TRUE. 


i A PE reset occurs. 
Otherwise EDESR.SS is unchanged. This happens when: 


° No instruction is executed because either: 
— An asynchronous exception is taken to EL3 and ExternalSecureInvasiveDebugEnabled() == FALSE. 
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— An asynchronous debug event causes entry to Debug state. 


An instruction is executed and either: 


— Generates a synchronous exception other than an SMC exception which is taken to EL3, and 
ExternalSecureInvasiveDebugEnabled() == FALSE. 


— Generates a synchronous debug event and causes entry to Debug state. 


It is UNPREDICTABLE whether EDESR.SS is set to 1 or unchanged when an SError interrupt is taken to EL3 without 
executing the instruction, and ExternalSecureInvasiveDebugEnabled() == FALSE. 


If halting is prohibited after taking the exception or debug event, then the Halting Step state machine advances to 
the inactive state. Otherwise the Halting Step state machine advances to the active-pending state. 


Note 





The underlying criteria for the value of EDESR.SS on an exception are: 


Whether halting is allowed at the target of the exception. If halting is allowed, the PE must step into the 
exception. If halting is prohibited, the PE must step over the exception. 


Whether the preferred return address of the exception is the instruction itself or the next instruction, if the PE 
steps over the exception. 





Table H3-4 shows the behavior of the active-not-pending state. The letter X indicates that 
ExternalSecureInvasiveDebugEnabled() can be either TRUE or FALSE. 


Table H3-4 Summary of active-not-pending state behavior 





























Value 
Event Target Exception level ExternalSecureInvasiveDebugEnabled() written to 
EDESR.SS 
No exception or debug event Not applicable X 1 
SMC exception EL3 X 1 
Reset Highest x 1 
Exception, other than SMC ELI X 1 
exception 
EL2 X 1 
EL3 TRUE 1 
FALSE Unchanged 
Debug event Debug state X Unchanged 
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Entering the active-pending state 


The PE enters the active-pending state by one of the following: 


From the active-not-pending state by: 
— Executing an instruction without taking an exception. 


— Taking an exception so that the PE remains in a state where halting is allowed. 
An exception return from a state where halting is prohibited when EDESR.SS == 1. 


Note 


That is, an exception return from Secure state with ExternalSecureInvasiveDebugEnabled() == FALSE to 
Non-secure state with External InvasiveDebugEnabled() == TRUE. 
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° A reset when the value of EDECR.SS == 1, regardless of the state the PE was in before the reset occurred. 
: From the active-pending state by taking an asynchronous exception to a state where halting is allowed. 
è Following the description in Synchronization and the Halting Step state machine. 


PE behavior in the active-pending state 
When the PE is in the active-pending state, it enters Debug state before executing an instruction. 


The entry into Debug state has higher priority than all other types of synchronous debug event and synchronous 
exception. However, the architecture does not define the prioritization of this Debug state entry with respect to any 
unmasked pending asynchronous exception. If an asynchronous exception is prioritized over the entry to Debug 
state, then EDESR.SS is unchanged. 


For more information on the prioritization of debug events, see Debug state entry and debug event prioritization on 
page H2-6707. 


PE behavior in the inactive state when in Non-debug state 


EDESR.SS is not updated by the execution of an instruction or the taking of an exception when Halting Step is 
inactive. This means that EDESR.SS is not changed by an exception handled in a state where halting is prohibited. 


On return to a state where halting is allowed, the Halting Step state machine is restored either to the active-pending 
state or the active-not-pending state, depending on the value of EDESR.SS. The return to a state where halting is 
allowed is normally by an exception return, which in some situations is a Context synchronization event. 


See also Synchronization and the Halting Step state machine. 


PE behavior in Debug state 


Halting Step is inactive in Debug state because halting is prohibited, see Halting allowed and halting prohibited on 
page H2-6705. 


Entry to Debug state does not change EDESR.SS. 


EDESR.SS is cleared to 0 on exiting Debug state as the result of a restart request. If EDECR.SS == 1, Halting Step 
enters the active-not-pending state. 


Note 


This means that EDESR.SS is never cleared to 0 by the execution of an instruction in Debug state, or by taking an 
exception when in Debug state as described in PE behavior in the active-not-pending state on page H3-6750, 
because the Halting Step state machine is not in the active-not-pending state. EDESR.SS can be cleared by a write 
to EDESR, see the register description. 








However, if the PE exits Debug state as the result of a PE reset and EDECR.SS == 1, then Halting Step immediately 
enters the active-pending state, as EDESR.SS is set to the value of EDECR.SS. 


H3.2.5 Synchronization and the Halting Step state machine 


H3-6752 


The Halting Step state machine also changes state if: 
: Halting becomes allowed or prohibited other than by exit from Debug state, an exception return, or taking an 
exception. This means that halting becomes allowed or prohibited because: 


— The security state changes without an exception return. See State and mode changes without explicit 
context synchronization events on page G2-5674. 


— The external authentication interface changes. 


—  ARMvé8.0-DoubleLock is implemented and the status, DoubleLockStatus(), changes. 


i. A write to EDECR when the PE is in Non-debug state changes the value of EDECR.SS. 
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Note 


Behavior is CONSTRAINED UNPREDICTABLE if the value of EDECR.SS is changed when the PE is in 
Non-debug state, see Changing the value of EDECR.SS when not in Debug state. 





° A write to EDESR when the PE is in Non-debug state clears EDESR.SS to 0. 


These operations are guaranteed to take effect only after a Context synchronization event. If the instruction being 
stepped generates a Context synchronization event, then the PE might use the old or new state. 


The PE must perform the required behavior of the new state before or immediately following the next Context 
synchronization event, but it is not required to do so immediately. This means that the PE can perform the required 
behavior of the old state before the next Context synchronization event. This is illustrated in Example H3-1 and 
Example H3-2. 


Example H3-1 Synchronization requirements 1 


EDECR.SS is setto 1 in Debug state, requesting the active-not-pending state on exit from Debug state. On exit from 
Debug state the PE immediately takes an exception to Secure state. ExternalSecureInvasiveDebugEnabled() == 
FALSE, meaning that halting is prohibited in Secure state. The PE does not step any instructions but executes the 
software in Secure state as normal. EDESR.SS remains set to 0. If External SecureInvasiveDebugEnab]ed() 
subsequently becomes TRUE, meaning that halting is now allowed, the PE must perform the required behavior of 
the active-not-pending state before or immediately following the next Context synchronization event, but it is not 
required to do so immediately. 


Example H3-2 Synchronization requirements 2 


EDECR:SS is set to 1 in Debug state. On exit from Debug the PE executes an MSR instruction that sets 
OSDLR_EL1.DLK to 1 and DoubleLockStatus() becomes TRUE. This change requires a Context synchronization 
event to guarantee its effect, meaning it is CONSTRAINED UNPREDICTABLE whether: 

° Halting is allowed: 


— The PE enters Debug state on the next instruction. 
° Halting is prohibited: 
— The PE does not enter Debug state. 


The value in EDESR.SS depends on whether halting was allowed or prohibited when the write to 
OSDLR_EL1.DLK completed, and so it might be 0 or 1. If a second MSR instruction clears OSDLR_EL1.DLK to 0, 
the PE must perform the required behavior of the state indicated by EDESR.SS before or immediately following the 
next Context synchronization event, but it is not required to do so immediately. 


See also Synchronization and Halting debug events on page H3-6765. 


Changing the value of EDECR.SS when not in Debug state 


If software changes the value of EDECR.SS when the PE is not in Debug state then behavior is CONSTRAINED 
UNPREDICTABLE, and one or more of the following behaviors occurs: 


° The value of EDECR.SS becomes UNKNOWN. 

è The state of the Halting Step state machine becomes UNKNOWN. 

7 On a reset of the PE, the value of EDECR.SS and the state of the Halting Step state machine are UNKNOWN. 
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H3.2.6 Stepping T32 IT instructions 


In an implementation that supports the ITD control, the architecture permits a combination of one T32 IT instruction 
and another 16-bit T32 instruction to be treated as a single 32-bit instruction when the value of the ITD field that 
applies to the current Exception level is 1. 


For the purpose of stepping an item, it is IMPLEMENTATION DEFINED whether: 
à The PE considers such a pair of instructions to be one instruction. 
- The PE considers such a pair of instructions be two instructions. 


It is IMPLEMENTATION DEFINED whether this behavior depends on the value of the applicable ITD bit. For example: 


: The debug logic might consider such a pair of instructions as one instruction, regardless of the state of the 
applicable ITD field. 

° The debug logic might consider such a pair of instructions as two instructions, regardless of the state of the 
applicable ITD field. 

< The debug logic might consider such a pair of instructions as one instruction when the value of the applicable 


ITD field is 1, and as two instructions when the value of the ITD field is 0. 
An implementation that does not support the ITD control behaves as if the value of the ITD field is 0. 


The ITD control fields are: 
HSCTLR.ITD 
Applies to execution at EL2 when EL2 is using AArch32. 
SCTLR.ITD 
Applies to execution at ELO or EL] when EL] is using AArch32. 
SCTLR_EL1.ITD 
Applies to execution at ELO using AArch32 when EL] is using AArch64. 


H3.2.7 Disabling interrupts while stepping 


When using Halting Step, the sequence of entering Debug state, interacting with the debugger, and then exiting 
Debug state for each instruction reduces the rate at which the PE executes instructions. However, the rate at which 
certain interrupts, such as timer interrupts, are generated might be fixed by the system. This means it might be 
necessary to disable interrupts while using Halting Step by setting EDSCR.INTdis, to allow the code being 
debugged to make forward progress. 


H3.2.8 Syndrome information on Halting Step 


H3-6754 


Three EDSCR.STATUS encodings record different scenarios for entering Debug state on a Halting Step debug 
event: 


Halting Step, normal 


An instruction other than a Load-Exclusive instruction was stepped. 


Halting Step, exclusive 


A Load-Exclusive instruction was stepped. 


Halting Step, no syndrome 


The syndrome data is not available. 


If the PE enters Debug state due to a Halting Step debug event immediately after stepping an instruction in the 
active-not-pending state, EDSCR.STATUS is set to either: 


s Halting Step, normal, if the stepped instruction was not a Load-Exclusive instruction. 
è Halting Step, exclusive, if the stepped instruction was a Load-Exclusive instruction. 
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If the stepped instruction was a conditional Load-Exclusive instruction that failed its Condition code check, 
EDSCR.STATUS is set to a CONSTRAINED UNPREDICTABLE choice of Halting Step, normal, or Halting Step, 
exclusive. 


Otherwise the PE enters Debug state without stepping an instruction. This means that the Halting Step state machine 
enters the active-pending state directly from the inactive state, without going through active-not-pending state. In 
this case, EDSCR.STATUS is set to Halting Step, no syndrome. This happens when: 


$ The PE enters directly into the active-pending state on an exception return to Non-secure state from EL3 
when Halting is prohibited in Secure state. 


. The active-pending state is entered for other reasons. See Synchronization and the Halting Step state machine 
on page H3-6752 


In addition, EDSCR.STATUS is CONSTRAINED UNPREDICTABLE when: 


° The instruction being stepped generated a Halting Step debug event before the instruction was executed. 
In this case EDSCR.STATUS is set to a CONSTRAINED UNPREDICTABLE choice of: 


— Halting Step, no syndrome, or Halting Step, normal, if the stepped instruction was not a 
Load-Exclusive instruction. 


— Halting Step, no syndrome, or Halting Step, exclusive, if the stepped instruction was a Load-Exclusive 
instruction. 


s The instruction that was stepped was an Exception Return instruction or an ISB. As these instructions are not 
in the Load-Exclusive instructions, EDSCR.STATUS is set to a CONSTRAINED UNPREDICTABLE choice of 
Halting Step, no syndrome or Halting Step, normal. 


$ The PE enters directly into the active-pending state on reset because EDECR.SS is set to 1. EDSCR.STATUS 
is set to a CONSTRAINED UNPREDICTABLE choice of Halting Step, no syndrome or Halting Step, normal. 


In all cases, if EDSCR.STATUS is not set to Halting Step, no syndrome, then it must indicate whether the stepped 
instruction was a Load-Exclusive instruction by setting EDSCR.STATUS to Halting Step, normal or Halting Step, 
exclusive. 





Note 
In an implementation that always sets EDSCR.STATUS to Halting Step, no syndrome is not compliant. 





H3.2.9 Pseudocode description of Halting Step debug events 
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There are two pseudocode functions for Halting Step debug events: 


. RunHaltingStep(). This is called after an instruction has executed and any exception generated by the 
instruction is taken. It is also called after taking a reset before executing any instructions. That is, reset is 
treated like an asynchronous exception, even if EDECR.RCE == 1 or CTIDEVCTL.RCE == 1. 
RunHaltingStep() affects the next instruction. 


° CheckHaltingStep(). This is called before the next instruction is executed. Ifa step is pending, it generates the 
debug event. 
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H3.3 Halt Instruction debug event 


A Halt Instruction debug event is generated when EDSCR.HDE == 1, halting is allowed, and the PE executes the 
Halt instruction, HLT. 


The pseudocode for Halt Instruction debug events is described in HLT on page C6-908 for A64 and HLT on 
page F5-4199 for A32 and T32. 


HLT never generates a debug exception. It is treated as UNDEFINED if EDSCR.HDE == 0, or if halting is prohibited. 


Note 


A debugger can replace a program instruction with a Halt instruction to generate a Halt Instruction debug event. 
Debuggers that use the HLT instruction must be aware of the Armv8-A rules for concurrent modification of 
executable code, CMODX. The rules for concurrent modification and execution of instructions do not allow one 
thread of execution or an external debugger to replace an instruction with an HLT instruction when these same 
instructions are being executed by a different thread of execution. See Concurrent modification and execution of 
instructions on page B2-112. 








The T32 HLT instruction is unconditionally executed inside an IT block, even when it is treated as undefined. The 
A32 HLT instruction is CONSTRAINED UNPREDICTABLE if the Condition code field is not @b1110, with the set of 
behaviors the same as for BKPT. See Appendix K1 Architectural Constraints on UNPREDICTABLE behaviors. 


Note 


The HLT instruction is part of the external debug solution for Armv8-A. As such, the presence of the HLT instruction 
is not indicated in the ID registers. In particular, the AArch32 System register ID ISARO. Debug does not indicate 
the presence of the HLT instruction. 





H3.3.1 HLT instructions as the first instruction in a T32 IT block 


In an implementation that supports the ITD control, the architecture permits a combination of one T32 IT instruction 
and certain other 16-bit T32 instruction to be treated as a single 32-bit instruction when the value of the ITD field 
that applies to the current Exception level is 1. 


The T32 HLT instruction cannot be combined with an IT instruction in this way. In an implementation that supports 
the ITD control, if the first instruction in an IT block is an HLT instruction, then the behavior of the instruction 
depends on the value of the applicable ITD field: 


. Tf the value of the ITD field is 1, then the combination is treated as undefined and an Undefined Instruction 
exception is generated either by the IT instruction or by the HLT instruction. 


° If the value of the ITD field is 0, then the HLT instruction unconditionally executed. 
An implementation that does not support the ITD control behaves as if the value of the ITD field is 0. 


To set an Halt Instruction debug event on the first instruction of an IT block, debuggers must replace the IT 
instruction with an HLT instruction to ensure consistent behavior. 


The ITD control fields are: 
HSCTLR.ITD 
Applies to execution at EL2 when EL2 is using AArch32. 
SCTLR.ITD 
Applies to execution at ELO or EL1 when EL1 is using AArch32. 
SCTLR_EL1.ITD 
Applies to execution at ELO using AArch32 when EL] is using AArch64. 


Note 


An HLT instruction is always unconditional, even within an IT block. 
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H3.4 Exception Catch debug event 


Exception Catch debug events: 


° Are generated when the corresponding bit in the Exception Catch Control Register, EDECCR, is set to 1 on 
all entries to a given Exception level. This means: 


— Exceptions taken to the Exception level. 
— Exception returns to the Exception level. 


è Are taken synchronously, after entry to the Exception level. 
: Ignore the Execution state of the target Exception level. 
a Are ignored if halting is prohibited. 


From Armv8.2 the definition is extended to include generation of Exception Catch debug events on reset entry, see 
Exception Catch debug events from Armv8.2 on page H3-6759. 


The EDECCR contains two sets of fields: 


° One set for Non-secure state. 
. One set for Secure state. 


Each set of fields control generation of Exception Catch debug events: 
° On exception entry and, from Armv8.2, on reset entry. 


: On exception return. 


Each field within each set contains one bit for each Exception level in that state. Bits corresponding to Exception 
levels that are not implemented are RESO. For more information see the EDECCR description. 


Note 
7 EDECCR does not replace DBGVCR: 
—  DBGVCR is retained in AArch32 state for backwards compatibility. 
—  DBGVCR is ignored in AArch64 state and never generates entries to Debug state. 





—  DBGVCR cannot be accessed by the external debug interface. 


a EDECCR is only visible as OSECCR_EL1 by System register instructions in AArch64 state, and as 
DBGOSECCR by System register access instructions in AArch32 state, when the OS Lock is locked to 
allow software to save and restore it over a powerdown. 


° Exception Catch debug events are not disabled when the OS Lock is locked. 





For an Exception Catch debug event generated after taking an exception to a trapped Exception level: 


° The PE must not fetch instructions from the vector address before entering Debug state, if address translation 
is disabled in the translation regime at the target Exception level. 


° On entering Debug state: 
— The current Exception level is the target Exception level of the exception. 
— The ELR, SPSR, ESR, and other syndrome registers contain information about the exception. 
— DIR contains the exception vector address or, from Armv8.2, the reset address. 


H3.4.1 Prioritization of Exception Catch debug events 
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The following rules define the prioritization of Exception Catch debug events: 


° It is IMPLEMENTATION DEFINED whether Exception Catch debug events are higher or lower priority than each 
of Software Step exceptions and Halting Step debug events. 


è Exception Catch debug events are higher priority than all synchronous exceptions other than Software Step 
exceptions. 
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H3.4 Exception Catch debug event 


s Exception Catch debug events are lower priority than Reset Catch debug events. 


Note 


As described in Synchronous exception prioritization for exceptions taken to AArch64 state on page D1-2308, an 
exception trapping form of a Vector Catch debug event might generate a second debug exception as part of the 
exception entry, before the Exception Catch debug event is taken. See Vector Catch exceptions on page D2-2445 or 
Vector Catch exceptions on page G2-5667. 








A second unmasked asynchronous exception can be taken before the PE enters Debug state. If this second exception 
does not generate an Exception Catch debug event, the exception handler executed at the higher Exception level 
later returns to the trapped Exception level, causing the Exception Catch debug event to be generated again. 


See also Debug state entry and debug event prioritization on page H2-6707. 


From Armv8.2, when an Exception Catch debug event is generated on exception entry, the PE must enter Debug 
state as part of the exception entry: 


è After the exception entry has updated the program counter, PSTATE and syndrome registers for the 
exception. 

e Before the first instruction at the handler is executed. 

° Before any asynchronous or lower priority synchronous exception or debug event is taken at the first 


instruction in the exception handler. 


From Armv8.2, when an Exception Catch debug event is generated on exception return, the PE must enter Debug 
state: 





à After the exception return has updated the program counter and PSTATE. 
° Before the execution of the first instruction at the return address is completed. 
Note 


From Armv8.2, there is no prioritization between asynchronous exceptions, asynchronous debug events, and an 
Exception Catch debug event generated on an exception return. 





H3.4.2 CONSTRAINED UNPREDICTABLE generation of Exception Catch debug events 


H3-6758 


When ARMv8.2-Debug is not implemented, the PE is executing code at a given Exception level, and the 
corresponding EDECCR bit is 1, it is CONSTRAINED UNPREDICTABLE whether an Exception Catch debug event is 
generated. 





Note 
It is possible to generate Exception Catch debug events: 
è As a trap on all instruction fetches from the trapped Exception level as part of an instruction fetch. 
a On entry to the Exception level, as described in Detailed Halting Step state machine behavior on 


page H3-6749. 


This is similar to the implementation options allowed for Vector Catch debug events. The architecture does not 
require that the event is generated following an ISB operation executed at the Exception level. 





Examples of this are: 
° If the debugger writes to EDECCR so that the current Exception level is trapped. 
° If the OS restore code writes to OSECCR so that the current Exception level is trapped. 


$ If the code executing in AArch32 state changes the Exception level or security state other than by an 
exception return, and the target Exception level is trapped. See State and mode changes without explicit 
context synchronization events on page G2-5674. 
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When ARMv8.2-Debug is implemented, there are no CONSTRAINED UNPREDICTABLE cases that are permitted to 
generate Exception Catch debug events. 


H3.4.3 Exception Catch debug events from Armv8.2 


From Armv8.2, the definition of Exception Catch debug events is extended so that Exception Catch debug events 
can be generated from: 


è Exception entry. 
$ Reset entry. 
è Exception return. 


It is IMPLEMENTATION DEFINED whether a reset into an Exception level generates an Exception Catch debug event. 


Exception catch debug events are taken synchronously, after the exception or reset entry or the exception return has 
been processed by the PE. 


For exception returns, the final Exception level of the exception return determines whether an Exception Catch 
debug event is generated. On an illegal exception return an Exception Catch debug event is generated only if 
EDECCR is programmed to generate an Exception Catch debug event for an exception return to the current 
Exception level. 


The NSR and SR fields in EDECCR determine whether Exception Catch debug events can be generated from reset 
entry. Table H3-5 shows how exception entry and exception return Exception Catch debug events are enabled by a 
combination of the fields NSR, SR, NSE and SE in EDECCR. 


Table H3-5 Summary of Exception Catch debug event control 





(N)SR<n> (N)SE<n> Behavior on exception return to ELn Behavior on exception taken to ELn 














0 0 No action. No action. 
0 1 Halt if allowed. Halt if allowed. 
1 0 Halt if allowed. No action. 
1 1 No action. Halt if allowed. 





H3.4.4 Examples of Exception Catch debug events 
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If EDECCR == 0x20, meaning that the Exception Catch debug event is enabled for Non-secure EL1, then the 
following exceptions generate Exception Catch debug events: 


s An exception taken from Non-secure ELO to Non-secure EL1. 
$ An exception return from EL2 to Non-secure EL1. 
s An exception return from EL3 to Non-secure EL1. 


For example, on taking a Data Abort exception from Non-secure ELO to Non-secure EL1, using AArch64: 

è ELR_EL1 and SPSR_EL1 are written with the preferred return address and PE state for a return to ELO. 
è ESR_EL1 and FAR_EL] are written with the syndrome information for the exception. 

° DLR_ELO is set to VBAR_EL1 + 0x400, the synchronous exception vector. 

° DSPSR_ELO is written with the PE state for an exit to EL1. 


The following do not generate Exception Catch debug events: 


è An exception taken from ELO to EL2, if enabled in the current Security state, or EL3. 
à An exception return from EL2, if enabled in the current Security state, to ELO. 
$ An exception taken from Secure ELO to Secure EL1. 
7 An exception return from EL3 to Secure EL1. 
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H3.4.5 Pseudocode description of Exception Catch debug events 


The pseudocode function CheckExceptionCatch() is described in Chapter J1 Armv8 Pseudocode. 
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H3.5 External Debug Request debug event 
External Debug Request debug events are asynchronous debug events. 


An External Debug Request debug event is generated when signaled by the embedded cross-trigger. See Chapter H5 
The Embedded Cross-Trigger Interface. 


Note 


Armv8-A requires the implementation of an embedded cross-trigger. 








An implementation might also support IMPLEMENTATION DEFINED ways of generating an External Debug Request 
debug event. 


H3.5.1 Synchronization and External Debug Request debug events 


An External Debug Request debug event that is asserted before a Context synchronization event is taken and the PE 
enters Debug state before the first instruction following the Context synchronization event completes its execution, 
provided that halting is allowed after completion of the Context synchronization event. 


An External Debug Request debug event that is being asserted when the PE comes out of reset is taken, and the PE 
enters Debug state before the first instruction after the reset completes its execution, provided that halting is allowed 
when the PE exits reset state. 


If the first instruction after the Context synchronization event or after coming out of reset generates a synchronous 
exception then the architecture does not define the order in which the debug event and the exception or exceptions 
are taken. 


Otherwise, when halting is allowed, External Debug Request debug events must be taken in finite time, without 
requiring the synchronization of any necessary change to the external authentication interface. 


Note 


These rules are based on the rules that apply when taking asynchronous exceptions. See Asynchronous exception 
types, routing, masking and priorities on page D1-2316. 








If an unmasked External Debug Request debug event was pending but is changed to not pending before it is taken, 
then the architecture permits the External Debug Request debug event to be taken, but does not require this to 
happen. If the External Debug Request debug event is taken then it must be taken before the first Context 
synchronization event after the External Debug Request debug event was changed to not pending. 


Example H3-3 shows an example of the synchronization requirements. 


Example H3-3 Synchronization requirements 


Secure software locks up in a tight loop, so it executes indefinitely without any synchronization operations. An 
External debug request must be able to break the PE out of that loop. This is a requirement even if DBGEN or 
SPIDEN or both are LOW on entry to the loop, meaning that halting is prohibited, and are only asserted HIGH later. 


H3.5.2 Pseudocode description of External Debug Request debug events 


The ExternalDebugRequest() function is described in Chapter J1 Armv8 Pseudocode. 
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H3.6 OS Unlock Catch debug event 


An OS Unlock Catch debug event is generated when enabled and the state of the OS Lock changes from locked to 
unlocked. When ARMv8.3-DoPD is implemented, CTIDEVCTL.OSUCE enables an OS Unlock Catch debug 
event, otherwise EDECR.OSUCE enables an OS Unlock Catch debug event. 


When the OS Lock is unlocked, the PE sets EDESR.OSUC to 1 if the OS Unlock Catch debug event is enabled, and 
the PE is in Non-debug state, meaning the OS Unlock Catch debug event becomes pending. However, this is an 
indirect write to EDESR.OSUC, meaning the OS Unlock Catch debug event is not guaranteed to be taken before a 
subsequent Context synchronization event. If the PE enters Debug state or the OS Unlock Catch debug event is 
disabled before EDESR.OSUC becomes set to 1, then EDESR.OSUC might not be set. 


OS Unlock Catch debug events are not generated if the OS Lock is unlocked when the PE is in Debug state. See 
also Synchronization and Halting debug events on page H3-6765. 


EDESR.OSUC is cleared to 0 on a Warm reset and on exiting Debug state. 


H3.6.1 Using the OS Unlock Catch debug event 


If the debugger attempts to access a debug register when the Core power down domain is completely off or in a 
low-power state in which the Core power domain registers cannot be accessed, and that access returns an error, then 
the debugger must retry the access. However, if the Core power domain is regularly powered down, this can lead to 
unreliable debugger behavior. 


The debugger can program a Reset Catch debug event to halt the PE when it has powered up, and can program the 
debug registers from Debug state. However, if the PE boot software restores the debug registers, as described in 
Debug OS Save and Restore sequences on page H6-6813, then newly written values are overwritten by the restore 
sequence. 


The debugger can program an OS Unlock Catch debug event to halt the PE after the restore sequence has completed, 
and program the debug registers from Debug state. 


H3.6.2 Pseudocode description of OS Unlock Catch debug event 


H3-6762 


The CheckOSUnlockCatch() function is called when the OS Lock is unlocked. 


The CheckPendingOSUnlockCatch() function is called before an instruction is executed. If an OS Unlock Catch is 
pending, it generates the debug event. 
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H3.7 Reset Catch debug events 


A Reset Catch debug event is generated when enabled, and the PE exits reset state. When the Reset Catch debug 
event is generated, it is recorded by setting EDESR.RC to 1. When ARMv8.3-DoPD is implemented, 
CTIDEVCTL.RCE enables a Reset Catch debug event, otherwise EDECR.RCE enables a Reset Catch debug event 


If halting is allowed when the event is generated, the Reset Catch debug event is taken immediately and 
synchronously. On entering Debug state, DLR has the address of the reset vector. The PE must not fetch any 
instructions from memory. 


Otherwise, the Reset Catch debug event is pended and taken when halting is allowed. See Synchronization and 
Halting debug events on page H3-6765 for more information. 


This means that EDESR.RC is set to the value of EDECR.RCE or CTIDEVCTL.RCE on a Warm reset. EDESR.RC 
is cleared to 0 on exiting Debug state. 


H3.7.1 Pseudocode description of Reset Catch debug event 
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The CheckResetCatch() function is called after reset before executing any instruction. 


The CheckPendingResetCatch() function is called before an instruction is executed. If a Reset Catch is pending, it 
generates the Reset Catch debug event. 
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H3.8 Software Access debug event 


When the value of EDSCR.TDA is 1, software access to the following AArch64 and AArch32 debug System 
registers generate a Software Access debug event: 


$ The Breakpoint Value Registers, DBGBVR. 

$ The Breakpoint Control Registers, DBGBCR. 
: The Watchpoint Value Registers, DBGWVR. 

è The Watchpoint Control Registers, DBGWCR. 


However, EDSCR.TDA is ignored if any of the following applies: 
: The value of OSLSR.OSLK == 1, meaning that the OS Lock is locked. 
7 Halting is prohibited. See Halting allowed and halting prohibited on page H2-6705. 





° The register access generates an exception. 
Note 
° The only accesses to the specified registers that generate a Software Access debug event are: 


— Accesses to System registers in AArch64 state. 
— Accesses to System registers in the (coproc==0b1110) encoding space in AArch32 state. 


° Accesses by a PE using the external debug interface never generate a Software Access debug event. 





H3.8.1 Pseudocode description of Software Access debug event 


The CheckSoftwareAccessToDebugRegisters() function is described in Chapter J1 Armv8 Pseudocode. 
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H3.9 Synchronization and Halting debug events 


The behavior of external debug depends on: 
° Indirect reads of: 
— External debug registers. 
— System registers, including system debug registers. 
— Special-purpose registers. 
° The state of the external authentication interface. 
For some registers, all read and write accesses that update the register occur in program order, without any additional 


synchronization, but others require an explicit Context synchronization event. For more information on the 
synchronization of register updates see: 


s Synchronization requirements for AArch64 System registers on page D13-2819. 
$ Synchronization of changes to the external debug registers on page H8-6828. 
: State and mode changes without explicit context synchronization events on page G2-5674. 


Changes to the external authentication interface do not require explicit synchronization to affect External Debug 
Request debug events. See Synchronization and External Debug Request debug events on page H3-6761. 


For changes that require explicit synchronization, it is CONSTRAINED UNPREDICTABLE whether instructions between 
the change and the Context synchronization event observe the old state or the new state. 


This means that any change to these registers or the external authentication interface requires explicit 
synchronization by a Context synchronization event before the change takes effect. This ensures that for instructions 
appearing in program order after the change, the change affects the following: 


s The generation and behavior of Breakpoint and Watchpoint debug events. See Synchronization and debug 
exceptions on page D2-2459 for exceptions taken from AArch64 state, or Synchronization and debug 
exceptions on page G2-5674 for exceptions taken from AArch32 state. 


° The generation of all Halting debug events by instructions. 
° Taking a pending Halting debug event or other asynchronous Debug event. See: 
— Pending Halting debug events. 
— Synchronization and External Debug Request debug events on page H3-6761. 


è The behavior of the Halting Step state machine. See Synchronization and the Halting Step state machine on 
page H3-6752. 


H3.9.1 Pending Halting debug events 
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A Halting debug event might be pending: 


1. If Halting Step of an instruction sets EDESR.SS is set to 1, and halting is prohibited following the step, then 
the Halting Step state machine is inactive but a Halting Step debug event is pending. 


2, If a Reset Catch debug event sets EDESR.RC to 1, and halting is prohibited following reset, then a Reset 
Catch debug event is pending. 


3. If an OS Unlock Catch debug event sets EDESR.OSUC to 1, then an OS Unlock Catch debug event is 
pending. 


Pending Halting debug events are taken asynchronously when halting is allowed. 


Pending Halting debug events are discarded by a Cold reset. The debugger can also force a pending event to be 
dropped by writing to EDESR. 


Any Halting debug event that is observed as pending in the EDESR before a Context synchronization event is taken 
and the PE enters Debug state before the first instruction following the Context synchronization event completes its 
execution. This is only possible if halting is allowed after completion of the Context synchronization event. 
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If the first instruction after the Context synchronization event generates a synchronous exception then the 
architecture does not define the order in which the debug event and the exception or exceptions are taken, unless 


both: 

° A Halting Step debug event is pending. EDESR.SS == 1. 

à The Context synchronization event is an exception return from a state where halting is prohibited to a state 
where halting is allowed. 





Note 


This applies to an exception return from Secure state with ExternalSecureInvasiveDebugEnabled() == FALSE 
to Non-secure state with ExternalInvasiveDebugEnabled() == TRUE. 


In this case the order in which the debug events are handled is specified to avoid a double-step. See Entering the 
active-pending state on page H3-6751. 


If an asynchronous exception is also pending after the Context synchronization event then the architecture does not 
define the order in which the debug event and the exception or exceptions are taken. 





Note 


These rules are based on the rules that apply to taking asynchronous exceptions. See Asynchronous exception types, 
routing, masking and priorities on page D1-2316. 
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Chapter H4 
The Debug Communication Channel and Instruction 
Transfer Register 


This chapter describes communication between a debugger and the implemented debug logic, using the Debug 
Communications Channel (DCC) and the Instruction Transfer Register (ITR), and associated control flags. It 
contains the following sections: 


À Introduction on page H4-6768. 

: DCC and ITR registers on page H4-6769. 

7 DCC and ITR access modes on page H4-6772. 

à Flow control of the DCC and ITR registers on page H4-6776. 

- Synchronization of DCC and ITR accesses on page H4-6780. 

. Interrupt-driven use of the DCC on page H4-6786. 

. Pseudocode description of the operation of the DCC and ITR registers on page H4-6787. 


Note 
Where necessary Table K14-1 on page K14-7810 disambiguates the general register references used in this chapter. 
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H4.1 Introduction 


The Debug Communications Channel, DCC, is a channel for passing data between the PE and an external agent, 


H4-6768 


such as a debugger. The DCC provides a communications channel between: 
° An external debugger, described as the debug host. 
° The debug implementation on the PE, described as the debug target. 


The DCC can be used: 
° As a 32-bit full-duplex channel. 
. As a 64-bit half-duplex channel. 


The DCC is an essential part of Debug state operation and can also be used in Non-debug state. 


The Instruction Transfer Register, ITR, passes instructions to the PE to execute in Debug state. 


The PE includes flow-control mechanisms for both the DCC and ITR. 
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H4.2 DCC and ITR registers 
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The DCC comprises data transfer registers, the DTRs, and associated flow-control flags. The data transfer registers 
are DTRRX and DTRTX. 


The ITR comprises a single register, EDITR, and associated flow-control flags. 
In AArch64 state, software can access the data transfer registers as: 


a A receive and transmit pair for 32-bit full duplex operation: 
— The write-only DBGDTRTX_ELO register to transmit data. 
— The read-only DBGDTRRX_ELO register to receive data. 


: A single 64-bit read/write register, DBGDTR_ELO, for 64-bit half-duplex operation. 
s The read/write OSDTRTX_EL1 and OSDTRRX_ELI registers for save and restore. 
In AArch32 state, software can only access the data transfer registers as: 


$ A receive and transmit pair, for 32-bit full duplex operation: 
— The write-only DBGDTRTXint register to transmit data. 
— The read-only DBGDTRRXint register to receive data. 


a The read/write DBGDTRTXext and DBGDTRRXext registers for save and restore. 


The data transfer registers are also accessible by the external debug interface as a pair of 32-bit registers, 
DBGDTRRX_ELO and DBGDTRTX_ELO. Both registers are read/write, allowing both 32-bit full-duplex and 
64-bit half-duplex operation. 


The DCC flow-control flags are EDSCR. {RXfull, TXfull, RXO, TXU}: 


è The RXfull and TXfull ready flags are used for flow-control and are visible to software in the Debug system 
registers in DCCSR. 


° The RX overrun flag, RXO, and the TX underrun flag, TXU, report flow-control errors. 


è The flow-control flags are also accessible by software as simple read/write bits for saving and restoring over 
a powerdown when the OS Lock is locked in DSCR. 


s The flow-control flags are accessible from the external debug interface in EDSCR. 


Figure H4-1 on page H4-6770 shows the System register and external debug interface views of the EDSCR and 
DTR registers in both AArch64 state and AArch32 state. These figures do not include the save and restore views. 
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Figure H4-1 System register and external debug interface views of EDSCR and DTR registers, Normal access mode 


EDITR and the ITR flow-control flags, EDSCR. {ITE, ITO} are accessible only by the external debug interface: 


g The EDITR specifies an instruction to execute in Debug state. 
. The ITR empty flag, ITE, is used for flow-control. 
. The ITR overrun flag, ITO, reports flow-control errors. 
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Figure H4-2 External debug interface views of EDSCR and EDITR registers, Normal access mode 
The sticky overflow flag, EDSCR.ERR, is used by both the DCC and ITR to report flow-control errors. 
To save and restore the DCC registers for an external debugger over powerdown, software uses: 


$ The MDSCR_EL1, OSDTRTX_EL1, and OSDTRRX_ELI registers in AArch64 state. 
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° The DBGDSCRext, DBGDTRTXext, and DBGDTRRXext registers in AArch32 state. 


Note 


There is no save and restore mechanism for the ITR registers as the ITR is only used in Debug state. 
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Figure H4-3 System register views of EDSCR and DTR registers for save and restore 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H4-6771 
ID070919 Non-Confidential 


The Debug Communication Channel and Instruction Transfer Register 


H4.3 DCC and ITR access modes 


H4.3 DCC and ITR access modes 


The DCC and ITR support two access modes: 





DCC and ITR access mode, links to description Applies when: 











Normal access mode EDSCR.MA == 0 or the PE is in Non-debug state 
Memory access mode on page H4-6773 EDSCR.MA == 1 and the PE is in Debug state 
H4.3.1 Normal access mode 


The Normal access mode allows use of the DCC as a communications channel between target and host. It also 
allows the use of the ITR for issuing instructions to the PE in Debug state. 


In Normal access mode, if there is no overrun or underrun, the following occurs: 


For accesses by software: 





Direct writes to DBGDTRTX update the value in DTRTX and indirectly write 1 to TXfull. 
Direct reads from DBGDTRRX return the value in DTRRX and indirectly write 0 to RXfull. 


In AArch64 state, direct writes to DBGDTR_ELO update both DTRTX and DTRRX, 
indirectly write 1 to TXfull, and do not change RXfull: 


—  DTRTX is set from bits[31:0] of the transfer register. 
— DTRRX is set from bits[63:32] of the transfer register. 


In AArché6é4 state, direct reads from DBGDTR_ELO return the concatenation of DTRRX and 
DTRTX, indirectly write 0 to RXfull, and do not change TXfull: 


—  Bits[31:0] of the transfer register are set from DTRRX. 
—  Bits[63:32] of the transfer register are set from DTRTX. 


Note 


For DBGDTR_ELO, the word order is reversed for reads with respect to writes. 





Software reads TXfull and RXfull using DCCSR. 


For accesses by the external debug interface: 


Writes to EDITR trigger the instruction to be executed if the PE is in Debug state: 
— Ifthe PE is in AArch64 state, this is an A64 instruction. 


— Ifthe PE is in AArch32 state, this is a T32 instruction. The T32 instruction is a pair of 
halfwords where the first halfword is taken from the lower 16-bits, and the second 
halfword is taken from the upper 16-bits. 


Reads of DBGDTRTX_ELO return the value in DTRTX and indirectly write 0 to TXfull. 
Writes to DBGDTRTX_ELO update the value in DTRTX and do not change TXfull. 
Reads of DBGDTRRX_ELO return the value in DTRRX and do not change RX full. 
Writes to DBGDTRRX_ELO update the value in DTRRX and indirectly write 1 to RXfull. 


TXfull and RXfull are visible to the external debug interface in EDSCR. 


The PE detects overrun and underrun by the external debug interface, and records errors in 
EDSCR. {TXU, RXO, ITO, ERR}. See Flow control of the DCC and ITR registers on 
page H4-6776. 


See also Synchronization of DCC and ITR accesses on page H4-6780. 
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H4.3.2 Memory access mode 


ARM DDI 0487E.a 
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When the PE is in Debug state, Memory access mode can be selected to accelerate word-aligned block reads or 
writes of memory by an external debugger. Memory access mode can only be enabled in Debug state, and no 
instructions can be issued directly by the debugger when in Memory access mode. 


If there is no overrun or underrun when in Memory access mode, an access by the external debug interface results 
in the following: 


è External reads from DBGDTRTX_ELO cause: 
l. The existing value in DTRTX to be returned. This clears EDSCR.TXfull to 0. 


2. The equivalent of LDR W1, [X0] ,#4, if in AArch64 state, or LDR R1, [R0] ,#4, if in AArch32 state, to be 
executed. 


3. The equivalent of the MSR DBGDTRTX_ELQ,X1 instruction, if in AArch64 state, or the MCR 
p14,0,R1,c0,c5,@ instruction, if in AArch32 state, to be executed. 


4. EDSCR.{TXfull, ITE} to be set to {1,1}, and X1 or R1 to be set to an UNKNOWN value. 
è External writes to DBGDTRRX_ELO cause: 
1. The value in DTRRX to be updated. This sets EDSCR.RXfull to 1. 


2. The equivalent of the instruction MRS X1,DBGDTRRX_EL@, if in AArch64 state, or MRC p14,0,R1,c0,c5,0if 
in AArch32 state, to be executed. 


3. The equivalent of the instruction STR W1, [X0] , #4, ifin AArch64 state, or STR R1, [R0] ,#4, ifin AArch32 
state, to be executed. 


4. EDSCR.{RXfull, ITE} to be set to {0,1}, and X1 or R1 to be set to an UNKNOWN value. 
$ External reads from DBGDTRRX_ELO return the last value written to DTRRX. 
External writes to EDITR generate an overrun error. 


During these accesses, EDSCR. {TXfull, RXfull, ITE} are used for flow control. 


Note 


An overrun or underrun might result in EDSCR.ERR being set to 1 asynchronously to the sequence of operations 
that are outlined in this section. As this is timing-dependent, it is UNPREDICTABLE when the EDSCR.ERR flag 
affects the instructions and therefore whether neither instruction, only the first instruction, or both instructions are 
executed. If the second instruction is executed, then the first instruction must have been executed. However, in each 
case X1 or R1 is set to an UNKNOWN value. This means that: 





° In both cases, if the memory access instruction is not executed, then the base register X0 or RO is not updated, 
meaning the debugger can determine the last accessed location. 


: In the list describing External reads from DBGDTRTX_EL0, DTRTX and EDSCR.TXfull get set to 
UNKNOWN values. If the load was executed, then the value that was read by the PE is lost. This means the 
operation might need to be repeated by the debugger, and it is not advisable to use Memory access mode to 
read from read-sensitive locations using the underrun and overrun detection for flow control. 


s In the list describing External writes to DBGDTRRX_EL0, EDSCR.RXfull is set to an UNKNOWN value. 


A Data Abort from the memory access can also set EDSCR.ERR to 1. See Data Aborts in Memory access mode on 
page H4-6774. 





The architecture does not require precisely when these flags are set or cleared by the sequence of operations outlined 
in this section. For example, in the case of an external write to DBGDTRRX_ELO, in AArch64 state, RXfull might 
be cleared after step 2, or it might not be cleared until after step 3, as an implementation is free to fuse these steps 
into a single operation. The architecture does require that the flags are set as at step 4 when the PE is ready to accept 
a further read or write without causing an overrun error or an underrun error. 


The process outlined in this section represents a simple sequential execution model of Memory access mode. An 
implementation is free to pipeline, buffer, and re-order instructions and transactions, as long as the following remain 
true: 


. Data items are transferred into and out of the DTR in order and without loss of data, other than as a result of 
an overrun or an underrun. 
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è Data Aborts occur in order. 
: The constraints of the memory type are met. 


è In the list describing External reads from DBGDTRTX_ELO on page H4-6773: 
— The MSR equivalent operation at step 3 of the sequence reads the value loaded by step 2. 
— Ifthe list is performed in a loop, for all but the first iteration of this list, the value read by step 1 returns 


the values written by the MSR equivalent operation at the previous iteration of step 3. 


è In the list describing External writes to DBGDTRRX_ELO on page H4-6773: 
— The MRS equivalent operation at step 2 of the sequence returns the value written at step 1. 
— The STR equivalent at step 3 of the sequence writes the value read at step 2. 


. If the PE cannot accept a read or write, as applicable, during the sequence, then the flags are updated to 
indicate an overrun or underrun. 


See Flow control of the DCC and ITR registers on page H4-6776 for more information on overrun and underrun. 


Ordering, access sizes and effect on Exclusives monitors 


For the purposes of memory ordering, access sizes, and effect on the Exclusives monitor, accesses in Memory access 
mode are consistent with Load/Store word instructions executed by the PE. 


The simple sequential access model of Memory-access mode, as stated in Memory access mode on page H4-6773, 
must also be ordered with respect to instructions executed as a result of explicit writes to EDITR in Normal mode 
both before and after accesses to the DTR registers in Memory-access mode. 


Data Aborts in Memory access mode 
Ifa memory access generates a Data Abort, then: 


$ The Data Abort exception is taken. See Exceptions in Debug state on page H2-6734: 
— This means EDSCR.ERR is set to 1, see Cumulative error flag on page H4-6778. 
— Ifthe Data Abort occurs on stage 2 of an address translation, then the values returned in the ISV field 
and in bits[23:14] of the ISS are UNKNOWN. 
If this Data Abort is taken to EL2 using AArch64, the ISS is returned by ESR_EL2. JSS encoding for 
an exception from a Data Abort on page D13-2943 describes the usual encoding of this ISS. 


If EL2 is using AArch32 and this Data Abort is taken to Hyp mode, the ISS is returned by HSR. JSS 
encoding for an exception from a Data Abort on page G8-6099 describes the usual encoding of this 


ISS. 
: Register RO retains the address that generated the abort. 
. Register R1 is set to an UNKNOWN value. 


. EDSCR.TXfull, for a load, or EDSCR.RXfull, for a store, is set to an UNKNOWN value. 
° DTRTX, for a load, or DTRRX, for a store, is set to an UNKNOWN value. 


s EDSCR.ITE is set to 1. 


Illegal Execution state exception 


If PSTATE.IL is set to 1 when EDSCR.MA == 1, then on an external write access to DBGDTRRX_ELO or an 
external read from DBGDTRTX_ELO, it is CONSTRAINED UNPREDICTABLE whether the PE: 


$ Takes an Illegal Execution state exception without performing any operations. In this case: 
—  EDSCR.ERR is set to 1, see Cumulative error flag on page H4-6778. 
— Register RO is unchanged. 
— Register R1 is set to an UNKNOWN value. 
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—  EDSCR.TXfull or EDSCR.RXfull, as applicable, is set to an UNKNOWN value. 
—  DTRTX or DTRRX, as applicable, is set an UNKNOWN value. 
—  EDSCR.ITE is set to 1. 
See also Exceptions in Debug state on page H2-6734. 
a Ignores PSTATE.IL. 


Note 


The typical usage model for Memory access mode involves executing instructions in Normal access mode to set up 
X0 before setting EDSCR.MA to 1. These instructions generate an Illegal state exception if PSTATE.IL is set to 1. 








Alignment constraints 
If the address in RO is not aligned to a multiple of four, the behavior is as follows: 


° For each external DTR access a CONSTRAINED UNPREDICTABLE choice of: 


l. The PE makes an unaligned memory access to RO. If alignment checking is enabled for the memory 
access, this generates an Alignment fault. 


2. The PE makes a memory access to Align(X[@] ,4) in AArch64 state, or Align(R[0],4) in AArch32 
state. 


The PE generates an Alignment fault, regardless of whether alignment checking is enabled. 
4. The PE does nothing. 


a Following each memory access, if there is no Data Abort, RO is updated with an UNKNOWN value. 
7 For external writes to DBGDTRRX_ELO, if the PE writes to memory, an UNKNOWN value is written. 
: For external reads of DBGDTRTX_ELO an UNKNOWN value is returned. 


. The RXfull and TXfull flags are left in an UNKNOWN state, meaning that a DBGDTRTX ELO read can trigger 
a TX underrun, and a DBGDTRTX_ELO write can trigger an RX overrun. 


H4.3.3 Memory-mapped accesses to the DCC and ITR 
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Writes to the flags in EDSCR by external debug interface accesses to the DCC and the ITR registers are indirect 
writes, because they are a side-effect of the access. The indirect write might not occur for a memory-mapped access 
to the external debug interface. For more information, see Register access permissions for memory-mapped 
accesses on page H8-6832. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H4-6775 
Non-Confidential 


The Debug Communication Channel and Instruction Transfer Register 
H4.4 Flow control of the DCC and ITR registers 


H4.4 Flow control of the DCC and ITR registers 
. Ready flags. 
7 Buffering writes to EDITR. 
$ Overrun and underrun flags. 


. Cumulative error flag on page H4-6778. 


H4.4.1 Ready flags 
In Normal access mode: 


. For the DTR registers there are two ready flags: 
— EDSCR.RXfull == 1 indicates that DBGDTRRX_ELO contains a valid value that has been written by 
the external debugger and not yet read by software running on the target. 


—  EDSCR.TXfull == 1 indicates that DBGDTRTX_ELO contains a valid value that has been written by 
software running on the target and not yet read by an external debugger. 


$ For the ITR register there is a single ready flag: 
—  EDSCR.ITE == 1 indicates that the PE is ready to accept an instruction to the ITR. 
Note 


The architecture permits a PE to continue to accept and buffer instructions when previous instructions 
have not completed their architecturally defined behavior, as long as those instructions are discarded 
if EDSCR.ERR is set, either by an underrun or overrun or by any of the other error conditions 
described in this architecture, such as an instruction generating an abort. 








In Memory access mode: 


: EDSCR. {RXfull, ITE} == {0,1} indicates that DBGDTRRX_ELO is empty and the PE is ready to accept a 
word external write to DBGDTRRX_ELO. 


s EDSCR. {TXfull, ITE} == {1,1} indicates that DBGDTRTX_ELO is full and the PE is ready to accept a word 
external read from DBGDTRTX_ELO. 


All other values indicate that the PE is not ready, and result in a DTR overrun or underrun error, an ITR overrun 
error, or both, as defined in Overrun and underrun flags. 


EDSCR. {ITE, RXfull, TXfull} shows the status of the ITR and DCC registers. It ignores the question of whether a 
read or write cannot be accepted because, for example, EDSCR.ERR is set or the OPTIONAL Software Lock is locked 
for memory-mapped accesses (EDLSR.SLK == 1). 


H4.4.2 Buffering writes to EDITR 


The architecture permits a processor to continue to accept and buffer instructions when previous instructions have 
not completed their architecturally defined behavior, provided that: 


è Those instructions are discarded if EDSCR.ERR is set to 1, either by an underrun or an overrun, or by any 
other error conditions described in this architecture, such as an instruction generating an abort. 


° The PE maintains the simple sequential execution model with the order of instructions determined by the 
order in which the PE accepts the EDITR writes. In particular, the buffered instructions must be executed in 
the Execution state consistent with a simple sequential execution of the instructions, even if one of the 
previous instructions is a state changing operation, such as DCPS or DRPS. 


H4.4.3 Overrun and underrun flags 


Each of the ready flags has a corresponding overrun or a corresponding underrun flag. These are sticky status flags 
that are set if the register is accessed using the external debug interface when the corresponding ready flag is not in 
the ready state. 
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If the PE is in Debug state and Memory access mode, the corresponding error flag is also set if the PE is not ready 
to accept an operation because a previous load or store is still in progress. The sticky status flag remains set until 
cleared by writing 1 to EDRCR.CSE. 


Note 


The architecture permits a PE to continue to accept and buffer data to write to memory in Memory access mode. 








Table H4-1 shows DCC and ITR ready flags and the overrun and underrun flags associated with them. 


Table H4-1 DCC and ITR ready flags and the associated overrun/underrun flags 





External debug 
interface access 


Overrun/Underrun condition EDSCR flag 





Write DBGDTRRX_ELO — EDSCR.RXfull == ‘1’ || (Halted() && EDSCR.MA == ‘1’ && EDSCR.ITE == ‘0’) RXO 





Read DBGDTRTX_ELO EDSCR.TXfull == ‘0’ || (Halted() && EDSCR.MA == ‘1’ && EDSCR.ITE == ‘0’) TXU 





Write EDITR Halted() && (EDSCR.ITE == ‘@’ || EDSCR.MA == ‘1’) ITO 
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When an overrun or underrun flag is set to 1, the cumulative error flag, EDSCR.ERR, described in Cumulative error 
flag on page H4-6778, is also set to 1. 


In the event of an external write to DBGDTRRX_ELO or EDITR generating an overrun, or an external read from 
DBGDTRTX_ELO generating an underrun: 


° For a write, the written value is ignored. 
° For a read, an UNKNOWN value is returned. 
° EDSCR.TXfull, EDSCR.RXfull or EDSCR.ITE, as applicable, are not updated. 


There is no overrun or underrun detection on external reads of DBGDTRRX_ELO or external writes of 
DBGDTRTX_ELO. 


There is no overrun or underrun detection of direct reads and direct writes of the DTR System registers by software: 
z If RXfull == 0, a direct read of DBGDTRRX or DBGDTR_ELO returns UNKNOWN. 


. If TXfull == 1, a direct write of: 
— DBGDTRTX sets DTRTX to UNKNOWN. 
—  DBGDTR_ELO sets DTRRX and DTRTX to UNKNOWN. 


See DCC accesses in Non-debug state on page H4-6781 for more information. 


Accessing 64-bit data 


In AArch64 state, a software access to the DBGDTR_ELO register and an external debugger access to both 
DBGDTRRX_ELO and DBGDTRTX_ELO can perform a 64-bit half-duplex operation. 


However, there is only overrun and underrun detection on one of the external debug registers. That is: 


. If software directly writes a 64-bit value to DBGDTR_ELO, only TXfull is set to 1, meaning: 
— A subsequent external write to DBGDTRRX_ELO would not be detected as an overrun. 


— Ifthe external debugger reads DBGDTRTX_ELO first, software might observe 
MDCCSR_ELO.TXfull == 0 and send a second value before the external debugger reads 
DBGDTRRX_ELO, leading to an undetected overrun. 

5 On external writes to both DBGDTRRX_ELO and DBGDTRTX_ELO only RXfull is set to 1, meaning: 

— A subsequent direct write of DBGDTRTX_ELO would not be detected as an overrun. 
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— Ifthe external debugger writes to DBGDTRRX_EL1O first, software might observe 
MDCCSR_ELO.RXfull == 1 and read a full 64-bit value, before the external debugger writes to 
DBGDTRTX_ELO, leading to an undetected underrun. 


To avoid this, debuggers need to be aware of the data size used by software for transfers and ensure that 64-bit data 
is read or written in the correct order. If the PE is in Non-debug state, this order is as follows: 


è The external debugger must check EDSCR. {RXfull, TXfull} before each transfer. 


è To receive a 64-bit value from the target, the external debugger must read DBGDTRRX_ELO before reading 
DBGDTRTX_ELO. 


s To send a 64-bit value to the target, the external debugger must write to DBGDTRTX_ELO before writing 
DBGDTRRX_ELO. 


Because three accesses are required to transfer 64 bits of data, 64-bit transfers are not recommended for regular 
communication between host and target. The use of underrun and overrun detection means that only one access is 
required for 32 bits of data when using 32-bit transfers. 


In Debug state, the debugger controls the instructions executed by the PE, so these limitations do not apply. 64-bit 
transfers provide a means to transfer a 64-bit general register between the host and the target in Debug state. 


Cumulative error flag 


The cumulative error flag, EDSCR.ERR, is set to 1: 


è On taking an exception from Debug state. 
° On any signalled overrun or underrun in the DCC or ITR. 
When EDSCR.ERR == 1: 


° External reads of DBGDTRTX_ELO do not have any side-effects. 
. External writes to DBGDTRRX_ELO are ignored. 
. External writes to EDITR are ignored. 


. No further instructions can be issued in Debug state. This includes any instructions previously accepted as 
external writes to EDITR that occur in program order after the instruction or access that caused the error. 


This allows a debugger to stream data, or, in Debug state, instructions, to the target without having to: 
7 Check EDSCR.{RXfull, TXfull, ITE} before each access. 


. Check EDSCR.{ITO, RXO, TXU} following each access, for overrun or underrun. 


Check PSTATE or other syndrome registers, or both, for an exception following each instruction executed in 
Debug state that might generate a synchronous exception. 


The cumulative error flag remains set until cleared to 0 by writing 1 to EDRCR.CSE. However, the effect of 
writing 1 to EDRCR.CSE to clear EDSCR.ERR is CONSTRAINED UNPREDICTABLE when both of the following 
apply: 

° The PE is in Debug state. 

° The value of EDSCR.ITE is 0. 


When these conditions apply and a value of 1 is written to EDRCR.CSE, either or both of the following might occur: 
° EDSCR.ERR is not cleared to 0. 


° Any instructions in EDITR that have not been executed might be executed subsequently, rather than being 
ignored. 





Note 


This means that a debugger must poll EDSCR.ITE until it has the value 1, indicating that EDITR is empty, before 
writing to EDRCR.CSE to clear the EDSCR.ERR flag to 0. 





For overruns and underruns, EDSCR. {ITO, RXO, TXU} record the error type. 
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Pseudocode description of clearing the error flag 


The ClearStickyErrors() pseudocode function is described in Chapter J1 Armv8 Pseudocode. 
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Synchronization of DCC and ITR accesses 


In addition to the standard synchronization requirements for register accesses, the following subsections describe 
additional requirements that apply for the DCC and ITR registers: 


7 Summary of System register accesses to the DCC. 

$ DCC accesses in Non-debug state on page H4-6781. 

: Synchronization of DCC interrupt request signals on page H4-6784. 
è DCC and ITR access in Debug state on page H4-6784. 


In these sections, accesses by the external debug interface are referred to as external reads and external writes. 
Accesses to System registers are referred to as direct reads, direct writes, indirect reads, and indirect writes. 





Note 


In Synchronization requirements for AArch64 System registers on page D13-2819 external reads and external writes 
are described as forms of indirect access. This whole section uses more explicit terminology. 





The DTR registers and the DCC flags, TXfull and RXfull, form a communication channel, with one end operating 
asynchronously to the other. Implementations must respect the ordering of accesses to these registers in order to 
maintain the correct behavior of the channel. 


External reads of, and external writes to DBGDTRRX_ELO and DBGDTRTX_ELO are asynchronous to direct 
reads of, and direct writes to, DBGDTRRX, DBGDTRTX, and in AArch64 state DBGDTR_ELO, made by software 
using System register access instructions. The direct reads and direct writes indirectly write to the DCC flags. The 
external reads and external writes indirectly read the DCC flags to check for underrun and overrun. 


Throughout this section: 
DCC flags Means any or all of the following: 
s The EDSCR. {RXfull.TXfull} ready flags. 
° The EDSCR.RXO overrun flag. 
$ The EDSCR.TXU underrun flag. 
e The EDSCR.ERR cumulative error flag. 
ITR flags Means any or all of the following: 
° The EDSCR.ITE ready flag. 
s The EDSCR.ITO overrun flag. 
e The EDSCR.ERR cumulative error flag. 


Summary of System register accesses to the DCC 


System register accesses to the DTR registers are direct reads and writes of those registers, as shown in Table H4-2 
on page H4-6781. Several of these instructions access the same registers using different encodings. 


With the exception of the read and write bits, DBGDTRRX and DBGDTRTX are the same encoding, with exception 
of the read/write bits, but use different registers. The Armv8 architecture governs the order of these instructions, as 
described in Synchronization requirements for AArch64 System registers on page D13-2819. For more details, see 
the description of the individual register in the relevant chapter, Chapter D13 AArch64 System Register Descriptions 
or Chapter G8 AArch32 System Register Descriptions. 
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Table H4-2 shows a summary of System register accesses to the DCC. 


Table H4-2 Summary of System register accesses to the DCC 
































: AArch64 AArch32 =s 

Operation OS Lock (MRS/MSR) (MRC/MCR) Description 

Read - DBGDTRRX_ELO DBGDTRRXint Direct read of DTRRX 
Indirect write to the DCC flags 
An STC instruction that reads DBGDTRRXint 
makes an indirect write to DBGDSCRint.RX full 

Write - DBGDTRTX_ELO DBGDTRTXint Direct read of DTRTX 
Indirect write to the DCC flags 
An LDC instruction that writes to DBGDTRTXint 
using a value read from memory is a direct write 
to DBGDTRTXint 

Read/write - DBGDTR_ELO - Direct read/write of both DTRRX and DTRTX 
Indirect write to the DCC flags 

Read - MDCCSR_ELO DBGDSCRint Direct read of the DCC flags 

Read/write - OSDTRRX_EL1 DBGDTRRXext Direct read/write of DTRRX 

Read/write - OSDTRTX_EL1 DBGDTRTXext Direct read/write of DTRTX 

Read Unlocked © MDSCR_EL1 DBGDSCRext Direct read of DCC flags 

Read/write Locked MDSCR_EL1 DBGDSCRext Direct read/write of DCC flags 

H4.5.2 DCC accesses in Non-debug state 
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In Non-debug state DCC accesses are as described in Normal access mode on page H4-6772: 


° If a direct read of DCCSR returns RX full == 1, then a following direct read of DBGDTRRX, or in AArch64 
state of DBGDTR_ELO, returns valid data and indirectly writes 0 to DCCSR.RXfull as a side-effect. 


. If a direct read of DCCSR returns TXfull == 0, then a following direct write to DBGDTRTX, or in AArch64 
state to DBGDTR_ELO, writes the intended value, and indirectly writes 1 to DCCSR.TXfull as a side-effect. 


No Context synchronization event is required between these two instructions. Overrun and underrun detection 
prevents intervening external reads and external writes affecting the outcome of the second instruction. 


The indirect write to the DCC flags as part of the DTR access instruction is made atomically with the DTR access. 


Because a direct read of DBGDTRRX is an indirect write to DCCSR.RXfull, it must occur in program order with 
respect to the direct read of DCCSR, meaning it must not return a speculative value for DTTRX that predates the 
RXfull flag returned by the read of DCCSR. The direct write to DBGDTRTX must not be executed speculatively. 


Direct reads of DBGDTRRX, or in AArch64 state DBGDTR_ELO, and DCCSR, must occur in program order with 
respect to other direct reads of the same register using the same encoding. 


The following accesses have an implied order within the atomic access: 


è In the simple sequential execution of the program the indirect write of the DCC flags occurs immediately 


after the direct DTR access. 


Note 





For an access to DBGDTR_ELO, this means the indirect write happens after both DBGDTRRX_ELO and 
DBGDTRTX_ELO have been accessed. 
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è In the simple sequential execution model, for an external read of DBGDTRTX_ELO or an external write of 
DBGDTRRX_ELO: 


— The check of the DCC flags for overrun or underrun occurs immediately before the access. 
—  Ifthere is no underrun or overrun, the update of the DCC flags occurs immediately after the access. 


— If there is underrun or overrun, the update of the DCC underrun or overrun flags occurs immediately 
after the access. 


All observers must observe the same order for accesses. 


Note 
These requirements do not create order where order does not otherwise exist. It applies only for ordered accesses. 








Without explicit synchronization following external writes and external reads: 


° The value written by the external write to DBGDTRRX_ELO that does not overrun, must be observable to 
direct reads of DBGDTRRX and DBGDTR_ELO in finite time. 


° The DCC flags that are updated as a side-effect of the external write or external read must be observable: 
— To subsequent external reads of EDSCR. 
— To subsequent external reads of DBGDTRRX_ELO when checking for underrun. 
— To subsequent external writes to DBGDTRTX_ELO when checking for overrun. 
— To direct reads of DCCSR in finite time. 


However, explicit synchronization is required to guarantee that a direct read of DCCSR returns up-to-date DCC 
flags. This means that if a signal is received from another agent that indicates that DCCSR must be read, an ISB is 
required to ensure that the direct read of DCCSR occurs after the signal has been received. This also synchronizes 
the value in DBGDTRRX, if applicable. However, if that signal is an interrupt exception triggered by COMMIRQ, 
COMMTX, or COMMRX, the exception entry is sufficient synchronization. See Synchronization of DCC 
interrupt request signals on page H4-6784. 


Explicit synchronization is required following a direct read or direct write: 
s To ensure that a value directly written to DBGDTRTX is observable to external reads of DBGDTRTX_ELO. 


i. To ensure that a value directly written to DBGDTR_ELO is observable to external reads of 
DBGDTRTX_EL0 and DBGDTRRX_ELO. 


s To guarantee that the indirect writes to the DCC flags that were a side-effect of the direct read or direct write 
have occurred, and therefore that the updated values are: 


— Observable to external reads of EDSCR. 

— Observable to external reads of DBGDTRRX_ELO when checking for underrun. 
— Observable to external writes of DBGDTRTX_ELO when checking for overrun. 
— Returned by a following direct read of DCCSR. 


See also Memory-mapped accesses to the DCC and ITR on page H4-6775 and Synchronization of changes to the 
external debug registers on page H8-6828. 





Note 

These ordering rules mean that software: 

° Must not read DBGDTRRX without first checking DCCSR.RXfull or if the previously-read value of 
DCCSR.RXfull is 0. 
It is not sufficient to read both registers and then later decide whether to discard the read value, as there might 
be an intervening write from the external debug interface. 

. Must not write DBGDTRTX without first checking DCCSR.TXfull or if the previously-read value of 
DCCSR.TXfull is 1. 


The write to DBGDTRTX overwrites the value in DTRTX, and the external debugger might or might not 
have read this value. 
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Must ensure there is an explicit Context synchronization event following a DTR access, even if not 
immediately returning to read DCCSR again. This synchronization operation can be an exception return. 





Derived requirements 


The rules for DCC accesses in Non-debug state are as follows: 
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Following a direct read of DBGDTRRX when RXfull is 1: 


— Ifan external write to DBGDTRRX checks the RXfull flag for overrun and observes that the value of 
RXfull is 0, the value returned by the previous direct read must not be affected by the external write. 


—  Ifanexternal read of EDSCR returns a RXfull value of 0, then the value returned by the previous direct 
read must not be affected by a following external write to DBGDTRRX, and the following external 
write does not overrun. 


Following a direct read of DBGDTR_ELO, when RXfull is 1: 


— Ifan external write to DBGDTRRX checks the RXfull flag for overrun and observes that the value of 
RXfull is 0, the value returned by the previous direct read must not be affected by the external write 
nor by a following direct write to DBGDTRTX. 


—  Ifanexternal read of EDSCR returns a RXfull value of 0, then the value returned by the previous direct 
read must not be affected by subsequent external writes to DBGDTRRX and DBGDTRTX in any 
order, and the following external write of DBGDTRRX will not overrun. 


Following a direct write to DBGDTRTX, when TXfull is 0: 


— Ifan external read of DBGDTRTX checks the TXfull flag for underrun and observes that the value of 
TXfull is 1, the value returned by the external read must be the value written by the previous direct 
write. 


— Ifan external read of EDSCR returns a TXfull value of 1, then the value returned by a following 


external read of DBGDTRRX must be the value written by the previous direct read, and the 
subsequent external read will not underrun. 


Following a direct write to DBGDTR_ELO, when TXfull is 0: 


— Ifan external read of DBGDTRTX checks the TXfull flag for underrun and observes that the value of 
TXfull is 1, the values returned by the external read and by a subsequent external read of DBGDTRRX 
must be the value written by the previous direct write. 


— Ifan external read of EDSCR returns a TXfull value of 1, then the value returned by subsequent 
external reads of DBGDTRRX and DBGDTRTX, in any order, must be the value written by the 
previous direct read, and the subsequent external read of DBGDTRTX does not underrun. 


Following an external read of DBGDTRTX that does not underrun, if a direct read of DCCSR returns a 
TXfull value of 0, then the value returned by the external read must not be affected by a following direct write 
to DBGDTRTX. 


Following a first external read DBGDTRRX and a following second external read of DBGDTRTX that does 
not underrun, if a direct read of DCCSR returns a TXfull value of 0, then the values returned by the external 
reads must not be affected by a following direct write to DBGDTR_ELO. 


Following an external write to DBGDTRRX that does not overrun, if a direct read of DCCSR returns an 
RXfull value of 1, then the value returned by a following direct read of DBGDTRRX or DBGDTR_ELO must 
be the value written by the previous external write. 


Following a first external write to DBGDTRTX and a following second external write to DBGDTRRX that 
does not overrun, if a direct read of DCCSR returns an RXfull value of 1, then the value returned by a 
subsequent direct read of DBGDTR_ELO must return the values written by the previous external writes. 
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Synchronization of DCC interrupt request signals 


Following an external read or external write access to the DTR registers, the interrupt request signals, COMMIRQ, 
COMMTX, and COMMRX, must be updated in finite time without explicit synchronization. 


The updated values must be observable to a direct read of DCCSR or DBGDTRRX, or a direct write of 
DBGDTRTX executed after taking an interrupt exception generated by the interrupt request. The updated values 
must also be observable to a direct write of DBGDTRTX executed after taking an interrupt exception generated by 
the interrupt request. 


Note 


The requirement that indirect writes to registers are observable to direct reads in finite time does not imply that all 
observers will observe the indirect write at the same time. For more information, see Synchronization requirements 





for AArch64 System registers on page D13-2819 and Synchronization of changes to AArch32 System registers on 


page G8-5896. 





Following a direct read of DBGDTRRX or a direct write to DBGDTRRX, software must execute a Context 
synchronization event to guarantee the interrupt request signals have been updated in finite time. This 
synchronization operation can be an exception return. 


DCC and ITR access in Debug state 


In Debug state, stricter observability rules apply for instructions issued through the ITR, to maintain communication 
between a debugger and the PE, without requiring excessive explicit synchronization. 


In Normal access mode, without explicit synchronization: 


è A direct read or direct write of the DTR registers by an instruction written to EDITR must be observable to 
an external write or an external read in finite time: 


— A direct read of DBGDTRRX must be observable to an external write of DBGDTRRX_ELO. 


— A direct read of DBGDTR_ELO must be observable to an external write of DBGDTRRX_ELO and 
DBGDTRTX_ELO. 


— A direct write of DBGDTRTX must be observable to an external read of DBGDTRTX_ELO. 


— A direct write of DBGDTR_ELO must be observable to an external read of DBGDTRRX_ELO and 
DBGDTRTX_ELO. 


This includes the indirect write to the DCC flags that occurs atomically with the access as described in DCC 

accesses in Non-debug state on page H4-6781. 

The subsequent external write or external read must observe either the old or the new values of both the DTR 

contents and DCC flags. If the old values are observed, this typically results in overrun or underrun, assuming 

the old values of the DCC flags indicate an overrun or underrun condition, as would normally be the case. 

This means the debugger can observe the direct read or direct write without explicit synchronization and 

without explicitly testing the DCC flags in EDSCR, because it can rely on overrun and underrun tests. 
External reads of DBGDTRTX_ELO that do not underrun and external writes to DBGDTRRX_ELO that do 

not overrun must be observable to an instruction subsequently written to EDITR on completion of the first 

external access. This includes the indirect write to the DCC flags. 

This means that without explicit synchronization and without the need to first check the DCC flags in 

DCCSR: 

— Ifthe instruction is a direct read of DBGDTRRX, it observes the external write. 

— Ifthe instruction is a direct write of DBGDTRTX, it observes the external read. 


° Writes to EDITR that do not overrun commit an instruction for execution immediately. The instruction must 
complete execution in finite time without requiring any further operation by the debugger. 

s After an external write to the EDITR, the ITR flags that are updated as a side effect of that write must be 
observable by: 


— An external read of the EDSCR that follows the external write to the EDITR. 


— When checking for overrun, another external write to the EDITR that follows the original external 
write to the EDITR. 
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In Memory access mode, these requirements shift to the instructions implicitly executed by external reads and 
external writes of the DTR registers, as described in Memory access mode on page H4-6773. 
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Interrupt-driven use of the DCC 


Arm recommends implementations provide a level-sensitive DCC interrupt request through the IMPLEMENTATION 
DEFINED interrupt controller as a private peripheral interrupt for the originating PE. 





Note 


° In addition to connection to the interrupt controller Arm also recommends COMMIRQ, COMMTX, and 
COMMRX signals that might be implemented for use by any legacy system peripherals. 


à GICv3 reserves a private peripheral interrupt number for the COMMIRQ interrupt. 





The DCCINT register provides a first level of interrupt masking within the PE, meaning only a single interrupt 
source, COMMIRQ, is needed at the interrupt controller. 


See also Synchronization of DCC interrupt request signals on page H4-6784. 
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H4.7 Pseudocode description of the operation of the DCC and ITR registers 
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The basic operation of the DCC and ITR registers is shown by the following pseudocode functions. These functions 
do not cover the behavior when OSLSR.OSLK == 1, meaning that the OS Lock is locked: 


DBGDTR_ELO[]. 
DBGDTRRX_ELO[]. 
DBGDTRTX_ELO[]. 

EDITR[]. 
CheckForDCCInterrupts(). 


For the definition of the DTR Registers, see shared/debug/dccanditr/DTR on page J1-7500. 
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This chapter describes the embedded cross-trigger interface. It contains the following sections: 


About the Embedded Cross-Trigger (ECT) on page H5-6790. 

Basic operation on the ECT on page H5-6792. 

Cross-triggers on a PE in an Armv8 implementation on page H5-6796. 
Description and allocation of CTI triggers on page H5-6797. 

CTI registers programmers’ model on page H5-6801. 

Examples on page H5-6802. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


H5-6789 


The Embedded Cross-Trigger Interface 
H5.1 About the Embedded Cross-Trigger (ECT) 
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About the Embedded Cross-Trigger (ECT) 


The Embedded Cross-Trigger, ECT, allows a debugger to: 
è Send trigger events to a PE. For example, this might be done to halt the PE. 


z Send a trigger event to one or more PEs, or other system components, when a trigger event occurs on another 
PE or system component. For example, this might be done to halt all PEs when one individual PE halts. 


Figure H5-1 shows the logical structure of an ECT. 
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Figure H5-1 Structure of an embedded cross-trigger 


The ECT can deliver many types of trigger events, which are described in the following sections: 
e Debug request trigger event on page H5-6797. 

° Restart request trigger event on page H5-6798. 

° Cross-halt trigger event on page H5-6798. 


° Performance Monitors overflow trigger event on page H5-6798. 
° Generic trace external input trigger events on page H5-6799. 
s Generic trace external output trigger events on page H5-6799. 


7 Generic CTI interrupt trigger event on page H5-6799. 


An Armv8-A implementation must: 
s Include a cross-trigger interface, CTI. 
è Implement at least the input and output triggers defined in this architecture. 


In addition, see Cross-triggers on a PE in an Armv8 implementation on page H5-6796. 


Arm recommends that this cross-trigger interface includes: 
° The ability to route trigger events between Trace Units, which typically have advanced event triggering logic. 
7 An output trigger to the interrupt controller. 


Also, Arm recommends that the Embedded Cross-Trigger includes the capability to send and receive 
IMPLEMENTATION DEFINED system trigger events to and from other system components, including a system counter, 
using a system CTI. See Halt-on-debug on page 12-7018. 


Note 


The ECT and CTI must only signal trigger events for external debugging. They must not route software events, such 
as interrupts. For example, the Performance Monitors overflow input trigger is provided to allow entry to Debug 
state on a counter overflow, and the output trigger to the interrupt controller is provided to generally allow events 
from the external debug sub-system to be routed to a software agent. However, the combination of the two must not 
be used as a mechanism to route Performance Monitors overflows to an interrupt controller. 
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Note 


CTI version 1 (CTIv1) is defined by the CoreSight™ SoC Technical Reference Manual. CTIv2 extends CTIv1 with 
the addition of the input channel gate see Implementation with CTIv2 





H5.1.1 Implementation with a CoreSight CTI 


For details of the recommended connections in an Armv8-A implementation, see Appendix K2 Recommended 


™ 


External Debug Interface. See also CoreSight™ SoC Technical Reference Manual. 


H5.1.2 Implementation with CTiv2 
If the CTI implemented is CTIv2 then: 
° The CTIDEVARCH, CTIDEVAFFO, and CTIDEVAFF1 registers must be implemented. 
s If the channel gate function is implemented, it applies to both input and output channels. 


. The input channel gate function must be implemented if either of the following is true: 
— The CTM is implemented and the architecture variant is Armv8.5 or higher. 
— The CTIDEVARCH,REVISION field reads as 0b0001or higher. 


Implementation of CTIv2 features in architecture variants below Armv8.5 is OPTIONAL, but Arm recommends that 
CTIv2 is implemented, CTIv2 must be implemented from Armv8.5. 
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H5.2 Basic operation on the ECT 


The ECT comprises a Cross-Trigger Matrix, CTM, and one Cross-Trigger Interface, CTI, for each PE. The ECT 
might also include other CTIs for other system components. The CTM passes events between the CTI blocks over 
channels. The CTM can have a maximum of 32 channels. 


The main interfaces of the cross-trigger interface, CTI, are: 
. The input triggers: 
— These are trigger event inputs from the PE to the CTI. 
° The output triggers: 
— These are trigger event outputs from the CTI to the PE. 
. The input channels: 
— These are channel event inputs from the cross-trigger matrix, CTM, to the CTI. 
s The output channels: 
— These are channel event outputs from the CTI to the CTM. 


Each CTI block has: 


G Up to 32 input triggers that come from the PE: 


— The input triggers are numbered 0-31. 


$ Up to 32 output triggers that go to the PE: 


— The output triggers are numbered 0-31. 


If the CTI is not powered up when the Core power domain is powered up, the CTI ignores all input triggers and 
input channel events, and does not generate any output triggers or output channel events. 


Figure H5-2 on page H5-6793 shows the logical internal structure of a CTI. 
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Figure H5-2 Structure of a cross-trigger interface 


Note 
è The number of triggers in IMPLEMENTATION DEFINED. Figure H5-2 shows eight input and eight output 
triggers. 
s The number of channels is IMPLEMENTATION DEFINED. Figure H5-2 shows four channels. 


š In Figure H5-2 the input channel gate function is a CTIv2 feature. 





When the CTI receives an input trigger event, this generates channel events on one or more internal channels, 
according to the mapping function defined by the Input triggeroutput channel mapping registers, CTIINEN<n>. 


The CTI also contains an application trigger and channel pulse to allow a debugger to create channel events directly 


on internal channels by writing to the CTI control registers. 
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Channel events on each internal channel are passed to a corresponding output channel that is controlled by a channel 
gate. The channel gate can block propagation of channel events from an internal channel to an output channel. 





Note 
If the CTM is implemented: 
° The gate function must be implemented. 


° If the CTI is CTIv1, the gate function applies to output triggers only. 





The output channels from a CTI are combined, using a logical OR function, with the output channels from all other 
CTIs to form the input channels on other CTIs. The input channels of this CTI are the logical OR of the output 
channels on all other CTIs. This is the cross-trigger matrix, CTM. Therefore, the number of input channels must 
equal the number of output channels. 


Note 


The number of input triggers and output triggers is not required to be the same. 








The internal channels form an internal cross-trigger matrix within the CTI. This delivers events directly from the 
input triggers to the output triggers. Therefore the number of internal channels is the same as the number of input 
and output channels on the external CTM, and there is a direct mapping between the two. 


Channel events received on each input channel are passed to the corresponding internal channel. It is 
IMPLEMENTATION DEFINED whether the cross-trigger gate also blocks propagation of channel events from input 
channels to internal channels. 


Note 


If CTIv2 is implemented, the cross-trigger gate also blocks propagation of channel events from input channels to 
internal channels. 








When the CTI receives a channel event on an internal channel this generates trigger events on one or more output 
triggers, according to the mapping function defined by the Input channel — output trigger mapping registers, 
CTIOUTEN<n>. 


The CTI contains the input and output trigger interfaces to the PE and the interface of the cross-trigger matrix. The 
architecture does not define the signal protocol used on the trigger interfaces, and: 


. It is IMPLEMENTATION DEFINED whether the CTI supports multicycle input trigger events. 
. It is IMPLEMENTATION DEFINED whether the CTM supports multicycle channel events. 


See Multicycle events on page H5-6795. 


However, an output trigger is asserted until acknowledged. The output trigger can be: 
° Self-acknowledging. This means that no further action is required from the debugger. 
. Acknowledged by the debugger writing 1 to the corresponding bit of CTHNTACK. 


The time taken to propagate a trigger event from the first PE, through its CTI, across the CTM to another CTI, and 
thereby to a second PE is IMPLEMENTATION DEFINED. 


Note 


Arm recommends that this path is not longer than the shortest software communication path between those PEs. 
This is because if the first PE halts, the Cross-halt trigger event can propagate through the ECT and halt the second 
PE without causing software on the second PE to malfunction because the first PE is in Debug state and is not 
responding. 
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A multicycle event is one with a continuous state that might persist over many cycles, as opposed to a discrete event. 
A typical implementation of a multicycle event is a level-based signal interface, whereas a discrete event might be 
implemented as a pulse signal or message. 


CTI support for multicycle trigger events is IMPLEMENTATION DEFINED. Use of multicycle trigger events is 
deprecated. Of the architecturally defined input trigger events, the Performance Monitors overflow trigger event and 
Generic trace external output trigger events can be multicycle input triggers. 


CTM support for multicycle channel events is IMPLEMENTATION DEFINED. A CTM that does not support multicycle 
channel events cannot propagate a multicycle trigger event between CTIs. 


Note 


A full ECT might comprise a mix of CTIs, some of which can support multicycle trigger events. In bridging these 
components, multicycle channel events become single channel events at the boundary between the CTIs. 








An ECT that supports multicycle trigger events 


When an ECT supports multicycle trigger events, an input trigger event to the CTI continuously asserts channel 
events on all output channels mapped to it until either: 


$ The input trigger event is removed. 
° The channel mapping function is disabled. 


This means that an input trigger that is asserted for multiple cycles causes any channels that are mapped to it to 
become active for multiple cycles. Consequently, any output triggers mapped from that channel are asserted for 
multiple cycles. 


Note 


The output trigger remains asserted for at least as long as the channel remains active. This means that even if the 
output trigger is acknowledged, it remains asserted until the channel deactivates. 








The CTI does not guarantee that these events have precisely the same duration, as the triggers and channels can cross 
between clock domains. 


CTIAPPSET and CTIAPPCLEAR can set a channel active for multiple cycles. CTIAPPPULSE generates a single 
channel event. CTICHINSTATUS and CTICHOUTSTATUS can report whether a channel is active. 


An ECT that does not support multicycle trigger events 


When an ECT does not support multicycle trigger events, an input trigger event to the CTI generates a single 
channel event on all output channels mapped to it, regardless of how long the input trigger event is asserted. 


This means that an input trigger event that is asserted for multiple cycles generates a single channel event on any 
channels mapped to it. Consequently any self-acknowledging output triggers mapped from those channels are single 
trigger events. 


Note 


A single event is typically a single cycle, but there is no guarantee that this is always the case. 








CTIAPPSET and CTIAPPCLEAR can only generate a single channel event. CTIAPPPULSE generates a single 
channel event. If the ECT does not support multicycle channel events, use of CTIAPPSET and CTIAPPCLEAR is 
deprecated, and the debugger must only use CTIAPPPULSE. CTICHINSTATUS and CTICHOUTSTATUS must 
be treated as UNKNOWN. 
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H5.3 Cross-triggers on a PE in an Armv8 implementation 


An Armv8 PE must include a cross-trigger interface, and the implementation must include at least the input and 
output triggers defined in this architecture. The number of channels in the cross-trigger matrix is IMPLEMENTATION 
DEFINED, but there must be a minimum of three. Software can read CTIDEVID.NUMCHAN to discover the number 
of implemented channels. 


The CTM must connect to all PEs in the same Inner Shareability domain as the Armv8-A PE, but can also connect 
to additional PEs. Arm strongly recommends that the CTM connects all PEs implementing a CTI in the system. This 
includes Armv7-A PEs and other PEs that can be connected using a CoreSight CTI module. 


Note 


In a uniprocessor system the CTM is OPTIONAL. In a multiprocessor system the CTM is required. The CTM might 
be connected other CTI modules for non-PEs, such as triggers for system visibility components. Arm recommends 
that the CTM is implemented. 








Any CTI connected to a PE that is not an Armv8-A PE must implement at least: 


° The Debug request trigger event. 
$ The Restart trigger event. 
$ The Cross-halt trigger event. 


For more information about the CTI, see the CoreSight ™ SoC Technical Reference Manual. Armv8-A refines the 
generic CTI by defining roles for each of the implemented input and output triggers. 
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Description and allocation of CTI triggers 


Table H5-1 shows the output trigger events defined by the architecture and the related trigger numbers. 


Table H5-1 Allocation of CTI output trigger events 





Number Source Destination Event description 





0 CTI PE Debug request trigger event 





1 CTI PE Restart request trigger event on page H5-6798 





2 CTI IRQ controller Generic CTI interrupt trigger event on page H5-6799 





3 : - Reserved 





4-7 CTI PE Trace Unit OPTIONAL Generic trace external input trigger events on page H5-6799 





Note 
Output triggers from the CTI are inputs to other blocks. 








Table H5-2 shows the input trigger events defined by the architecture and the related trigger numbers. 


Table H5-2 Allocation of CTI input trigger events 





Number Source Destination Event description 


0 PE CTI Cross-halt trigger event on page H5-6798 





1 PE CTI Performance Monitors overflow trigger event on page H5-6798 





2 PE CTI Statistical Profiling Extension sample trigger event on page H5-6799 





3 X - Reserved 





4-7 PE Trace Unit CTI OPTIONAL Generic trace external output trigger events on page H5-6799 


Note 
Input triggers to the CTI are outputs from other blocks. 








Table H5-1 and Table H5-2 show the minimum set of trigger events defined by the architecture. However: 


. The Generic trace external input and output trigger events are only required if the OPTIONAL PE Trace Unit 
is implemented. If the OPTIONAL PE Trace Unit is not implemented, these trigger events are reserved. 


è Support for the generic CTI interrupt trigger event is IMPLEMENTATION DEFINED because details of interrupt 
handling in the system, including any interrupt controllers, are IMPLEMENTATION DEFINED. Details regarding 
how the CTI interrupt is connected to an interrupt controller and its allocated interrupt number lie outside the 
scope of the architecture. Arm strongly recommends that implementations provide a means to generate 
interrupts based on external debug events. 


è The other trigger events are required by the architecture. 


An Armv8-A implementation can extend the CTI with additional triggers. These start with the number eight. 


Debug request trigger event 


This is an output trigger event from the CTI, and an input trigger event to the PE, asserted by the CTI to force the 
PE into Debug state. The trigger event is asserted until acknowledged by the debugger. The debugger acknowledges 
the trigger event by writing 1 to CTIINTACK[0]. 
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Note 


A debugger must poll CTITRIGOUTSTATUS[0] until it reads as 0, to confirm that the output trigger has been 
deasserted before generating any event that must be ordered after the write to CTIINTACK, such as a write to 
CTIAPPPULSE to activate another trigger. 








If the PE is already in Debug state, the PE ignores the trigger event, but the CTI continues to assert it until it is 
removed by the debugger. See also External Debug Request debug event on page H3-6761. 


Restart request trigger event 


This is an output trigger event from the CTI, and an input trigger event to the PE, asserted by the CTI to request the 
PE to exit Debug state. If the PE is in Non-debug state, the request is ignored by the PE. 


If a Restart request trigger event is received at or about the same time as the PE enters Debug state, it is 
CONSTRAINED UNPREDICTABLE whether: 


s The request is ignored by the PE. In this case the PE enters Debug state and remains in Debug state. 
e The PE enters Debug state and then immediately restarts. 


Debuggers must program the CTI to send Restart request trigger events only to PEs that are halted. To enable the 
PE to disambiguate discrete Restart request trigger events, after sending a Restart request trigger event, the debugger 
must confirm that the PE has restarted and halted before sending another Restart request trigger event. Debuggers 
can use EDPRSR. {SDR, HALTED} to determine the Execution state of the PE. 


Note 


Before generating a Restart request trigger event for a PE, a debugger must ensure any Debug request trigger event 
targeting that PE is cleared. Debug request trigger event on page H5-6797 describes how to do this. 








The trigger event is self-acknowledging, meaning that the debugger requires no further action to remove the trigger 
event. The trigger event is acknowledged even if the request is ignored by the PE. See also Exiting Debug state on 
page H2-6740. 


Cross-halt trigger event 


This is an input trigger event to the CTI, and an output trigger event from the PE, asserted by a PE when it is entering 
Debug state. 





Note 


To reduce the latency of halting, Arm recommends that an implementation issues the Cross-halt trigger event early 
in the committed process of entering Debug state. This means that there is no requirement to wait until all aspects 
of entry to Debug state have completed before issuing the trigger event. Speculative emission of Cross-halt trigger 
events is not allowed. The Cross-halt trigger event must not be issued early enough for a subsequent Debug request 
trigger event, that might be derived from the Cross-halt trigger event, to be recorded in the EDSCR.STATUS field. 
This applies to Debug request trigger events that are acting as inputs to the PE. 





Performance Monitors overflow trigger event 


This is an input trigger event to the CTI, and an output trigger event from the PE, asserted each time the PE asserts 
a new Performance Monitors counter overflow interrupt request. See Chapter D7 The Performance Monitors 
Extension. 


If the CTI supports multicycle trigger events, then the trigger event remains asserted until the overflow is cleared 
by a write to PMOVSCLR_ELO. Otherwise, the trigger event is asserted when the value of PMOVSCLR_ELO 
changes from zero to a non-zero value. 
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Note 


. This does not replace the recommended connection of Performance Monitors overflow trigger event to an 
interrupt controller. Software must be able to program an interrupt on Performance Monitors overflow 
without programming the CTI. 





° Events can be counted when ExternalNoninvasiveDebugEnabled()==FALSE, and, in Secure state, when 
ExternalSecureNoninvasiveDebugEnabled()==FALSE. Secure software must be aware that overflow trigger 
events are nevertheless visible to the CTI. 





H5.4.5 Statistical Profiling Extension sample trigger event 


If the Statistical Profiling Extension is implemented, and a sample record is written to memory, CTI input trigger 2 
is asserted. This trigger might also be directly connected to other IMPLEMENTATION DEFINED debug features. 


For more information see Chapter D9 The Statistical Profiling Extension. 


H5.4.6 Generic trace external input trigger events 


These are output trigger events from the CTI, and input trigger events to the OPTIONAL PE Trace Unit, that are used 
in conjunction with the Generic trace external output trigger events to pass trigger events between: 


$ The PE and the OPTIONAL PE Trace Unit. 
x The OPTIONAL PE Trace Unit and any other component attached to the CTM, including other Trace Units. 


There are four Generic trace external input trigger events. 


The trigger events are self-acknowledging. This means that the debugger does not have to take any further action to 
remove the events. 


H5.4.7 Generic trace external output trigger events 


These are input trigger events to the CTI, and output trigger events from the OPTIONAL PE Trace Unit, used in 
conjunction with the Generic trace external input trigger events to pass trigger events between: 


7 The PE and the OPTIONAL PE Trace Unit. 
s The OPTIONAL PE Trace Unit and any other component attached to the CTM, including other Trace Units. 


There are four Generic trace external output trigger events. 


H5.4.8 Generic CTI interrupt trigger event 
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This is an output trigger event from the CTI, and an input to an IMPLEMENTATION DEFINED interrupt controller, and 
can transfer trigger events from the PE, PE Trace Units, or any other component attached to the CTI and CTM to 
software as an interrupt. The Generic CTI interrupt trigger event must be connected to the interrupt controller as an 
interrupt that can target the originating PE. 


Note 


$ Arm recommends that the Generic CTI interrupt trigger event is a private peripheral interrupt, but 
implementations might instead make this trigger event available as a shared peripheral interrupt or a local 
peripheral interrupt. 





, GICVv3 reserves a private peripheral interrupt number for this interrupt. 





It is IMPLEMENTATION DEFINED whether this trigger event is: 


s Self-acknowledging. This means that the debugger is not required to take any further action, and that the 
interrupt controller must treat the trigger event as a pulse or edge-sensitive interrupt. 
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. Acknowledged by the debugger. The debugger acknowledges the trigger event by writing 1 to 
CTIINTACK[2]. This means that the interrupt controller must treat the trigger event as a level-sensitive 
interrupt. 


Arm recommends that the Generic CTI interrupt trigger event is a self-acknowledging trigger event. 
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H5.5 CTI registers programmers’ model 


The CTI registers programmers’ model is described in Chapter H8 About the External Debug Registers. The 
following sections contain information specific to the CTI: 


: External debug register resets on page H8-6847. 

$ External debug interface register access permissions on page H8-6835. 

7 Cross-trigger interface registers on page H8-6845. 

è The individual register descriptions in Cross-Trigger Interface registers on page H9-6960. 


See also Memory-mapped accesses to the external debug interface on page H8-6832. 


H5.5.1 CTI reset 


An External Debug reset resets the CTI. See External debug register resets on page H8-6847 for details of CTI 
register resets. All CTI output triggers and output channels are deasserted on an External Debug reset. 





Note 


An indirect read of an output trigger might not observe the deasserted state until the processor is Cold reset. For 
more information, see Synchronization of changes to the external debug registers on page H8-6828. 





H5.5.2 CTI authentication 
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The CTI ignores the state of the IMPLEMENTATION DEFINED authentication interface. This means that: 


$ CTITRIGINSTATUS shows the status of the input triggers and CTICHINSTATUS shows the status of the 
input channels, regardless of the value of ExternalNoninvasiveDebugEnabled(). 


Note 


The PE does not generate the Cross-halt trigger event and the PE Trace Unit does not generate Generic trace 
external output trigger events when ExternalNoninvasiveDebugEnabled()==FALSE. However, the PE can 
generate Performance Monitors overflow trigger events. 








s The CTI can generate external triggers regardless of the value of External InvasiveDebugEnabled(). 


Note 


The PE ignores Debug request and Restart request trigger events when 

External InvasiveDebugEnabled()==FALSE. The PE Trace Unit ignores Generic trace external input trigger 
events when ExternalNoninvasiveDebugEnabled()==FALSE. The behavior of Generic CTI interrupt requests 
is part of the IMPLEMENTATION DEFINED handling of these interrupts, but it is permissible for an interrupt 
controller to receive these requests even when External InvasiveDebugEnabled()==FALSE. 
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H5.6 Examples 


The CTI is fully programmable and allows for flexible cross-triggering of events within a PE and between PEs ina 
multiprocessor system. For example: 


The Cross-halt trigger event and the Debug request trigger event can be used for cross-triggering in a 
multiprocessor system. 


The Cross-halt trigger event and the Generic interrupt trigger event can be used for event-driven debugging 
in a multiprocessor system. 


The Performance Monitors overflow trigger event and the Debug request trigger event can force entry to 
Debug state on overflow of a Performance Monitors event counter, for event-driven profiling. 


Note 


This does not replace the recommended connection of Performance Monitors overflow trigger events to an 
interrupt controller. Software must be able to program an interrupt on Performance Monitors overflow 
without programming the CTI. Arm recommends that the Performance Monitors overflow signal is directly 
available as a local interrupt source. 








The Generic trace external input and Generic trace external output trigger events can pass trace events into 
and out of the event logic of the PE Trace Unit. They can do this: 


— To pass trace events between Trace Units. 


— In conjunction with the Performance Monitors overflow trigger event, to couple the Performance 
Monitors to the PE Trace Unit. 


— In conjunction with the Debug request trigger event, to trigger entry to Debug state on a trace event. 


— In conjunction with other CTIs, to signal a trace trigger event onto a CoreSight trace interconnect. 


The following sections describe some examples in more detail: 


Halting a single PE. 

Halting all PEs in a group when any one PE halts on page H5-6803. 
Synchronously restarting a group of PEs on page H5-6803. 

Halting a single PE on Performance Monitors overflow on page H5-6803. 


Example H5-1 Halting a single PE 


To halt a single PE, set: 


1. 


2. 


3. 


CTIGATE[0] to 0, so that the CTI does not pass channel events on internal channel 0 to the CTM. 


CTIOUTENO[0] to 1, so that the CTI generates a Debug request trigger event in response to a channel event 
on channel 0. 
Note 


The Cross-halt trigger event is input trigger 0, meaning it is controlled by the instance of CTIOUTENK<n> for 
which <n> is 0. 








CTIAPPPULSE[0] to 1, to generate a channel event on channel 0. 


When the PE has entered Debug state, clear the Debug request trigger event by writing 1 to CTIINTACK[0], before 
restarting the PE. 


H5-6802 
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Example H5-2 Halting all PEs in a group when any one PE halts 


To program a group of PEs so that when one PE in the group halts, all of the PEs in that group halt, set the following 
registers for each PE in the group: 


1. 


2, 


CTIGATE[2] to 1, so that each CTI passes channel events on internal channel 2 to the CTM. 


CTIINENO[2] to 1, so that each CTI generates a channel event on channel 2 in response to a Cross-halt trigger 
event. 


CTIOUTENO[2] to 1, so that each CTI generates a Debug request trigger event in response to a channel event 
on channel 2. 
Note 


The Cross-halt trigger event is input trigger 0, meaning it is controlled by the instances of CTIINEN<n> and 
CTIOUTEN<n> for which <n> is 0. 








When a PE has halted, clear the Debug request trigger event by writing a value of 1to CTIINTACK [0], before 
restarting the PE. 


Example H5-3 Synchronously restarting a group of PEs 


To restart a group of PEs, for each PE in the group: 


1. 


If the PE was halted because of a Debug request trigger event, the debugger must ensure the trigger event is 
deasserted. It can do this by: 


a. Writing 1 to CTHINTACK[0] to clear the Debug request trigger event. 


b. Polling CTITRIGOUTSTATUS[0], until it reads as 0, to confirm that the trigger event has been 
deasserted. 


Set CTIGATE[1] to 1, so that each CTI passes channel events on internal channel | to the CTM. 


Set CTIOUTEN1[1] to 1, so that each CTI generates a Restart request trigger event in response to a channel 
event on channel 1. 





Note 
This example must use the instance of CTIOUTEN<n> for which <n> is 1. 





Set CTIAPPPULSE[1] to 1 on any one PE in the group, to generate a channel event on channel 1. 


Example H5-4 Halting a single PE on Performance Monitors overflow 


To halt a single PE on a Performance Monitors overflow set: 


1. 


2. 


CTIGATE[3] to 0, so that the CTI does not pass channel events on internal channel 3 to the CTM. 


CTIINEN1[3] to 1, so that the CTI generates a channel event on channel 3 in response to a Performance 
Monitors overflow trigger event. 


Note 
This step of this example must use the instance of CTIINEN<n> for which <n> is 1. 








CTIOUTENO[3] to 1, so that the CTI generates a Debug request trigger event in response to a channel event 
on channel 3. 
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H5.6 Examples 
Note 
This step of this example must use the instance of CTIOUTEN<n> for which <n> is 0. 
When the PE has entered Debug state, clear the Debug request trigger event by writing 1 to CTIINTACK[0], before 
restarting the PE. Clear the overflow status by writing to PMOVSCLR_ELO. 
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Chapter H6 
Debug Reset and Powerdown Support 


This chapter describes the reset and powerdown support in the Debug architecture. It contains the following 
sections: 


$ About Debug over powerdown on page H6-6806. 

. Power domains and debug on page H6-6807. 

7 Core power domain power states on page H6-6808. 

. Emulating low-power states on page H6-6811. 

7 Powerup request mechanism on page H6-6810. 

7 Debug OS Save and Restore sequences on page H6-68 13. 
. Reset and debug on page H6-6819. 


Note 
Where necessary, Table K14-1 on page K14-7810 disambiguates the general register references used in this chapter. 
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H6.1 About Debug over powerdown 


Armv8 external debug defines a logical model for the hardware on which a PE executes. This hardware is logically 
split into the Core power domain and the Debug power domain, and the model contains descriptions of the states of 
those domains. See: 


$ Power domains and debug on page H6-6807. 
: Core power domain power states on page H6-6808. 


An implementation may allow power domains to be powered up and down independently. Debug over powerdown 
provides: 


$ A facility for software executing on the PE to save and restore the PE state on behalf of a self-hosted or 
external debugger or both. See Debug OS Save and Restore sequences on page H6-6813. 


a A facility for an external debugger to request power up of the Core power domain. See Powerup request 
mechanism on page H6-6810. 


° A facility for an external debugger, or software executing on the PE, to request emulation of powerdown of 
the Core power domain. See Emulating low-power states on page H6-6811. 
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H6.2 Power domains and debug 
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Armv8 external debug has two logical power domains, each with its own reset: 


The Debug power domain contains the interface between the PE and the external debugger, and is powered 
up whenever an external debugger is connected to the SoC. It remains powered up while the external 
debugger is connected. Registers in this domain are reset by an External Debug reset. 


The Core power domain contains the rest of the PE, and might be allowed to power up and power down 
independently of the Debug power domain. 





Note 


The model of two logical power domains has an impact on the reset and access permission requirements of 
the debug programmers’ model. 


The power domains are described as logical because the architecture defines the requirements but does not 
require two physical power domains. Any power domain split that meets the requirements of the 
programmers’ model is a valid implementation. 





The Core power domain contains several types of registers: 


Non-debug logic refers to all registers and logic that are not associated with debug. 

Self-hosted debug logic refers to registers and logic associated solely with the self-hosted debug aspects of 
the architecture. 

Shared debug logic refers to registers and logic associated with both the self-hosted and external debug 
aspects of the architecture. 

External debug logic refers to registers and logic associated solely with the external debug aspects of the 
architecture. 


For information about which groups of registers and components are in each power domain, and which registers 
change power domain if ARMv8.3-DoPD is implemented, see: 


Access permissions for the External debug interface registers on page H8-6841. 
Cross-trigger interface registers on page H8-6845. 
Management register access permissions on page K2-7656. 


Access permissions for external views of the Performance Monitors on page 13-7027. 
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Core power domain power states 


The Arm architecture does not define the power states of the PE as these are not normally visible to software. 
However, they are visible to the external debugger. Armv8 external debug uses a four logical power states model 
for the Core power domain. The four logical power states are as follows: 


Normal 


Standby 


Retention 


Powerdown 


The Core power domain is fully powered up and the debug registers are accessible. 


The Core power domain is on, but there are measures to reduce energy consumption. In a typical 
implementation, the PE enters standby by executing a WFI or WFE instruction, and exits on a wake-up 
event. There can be other IMPLEMENTATION DEFINED measures the OS can take to enter standby. 


The PE preserves the PE state, including the debug logic state. Changing from standby to normal 
operation does not involve a reset of the PE. 


Standby is the least invasive OS energy saving state. Standby implies only that the PE is unavailable 
and does not clear any debug settings. For standby, the Debug architecture requires only the 
following: 


` An External Debug Request debug event is a wake-up event when halting is allowed. This 
means that the PE must exit standby to handle the debug event. If the PE executed a WFE or a 
WFI instruction to enter standby, then it retires that instruction, 


à If the external debug interface is accessed, the PE must respond to that access. Arm 
recommends that, if the PE executed a WFI or WFE instruction to enter standby, then it does not 
retire that instruction. 


Standby is transparent, meaning that to software and to an external debugger it is indistinguishable 
from normal operation. 


The OS takes some measures, including IMPLEMENTATION DEFINED code sequences and registers, 
to reduce energy consumption. The PE state, including debug settings, is preserved in low-power 
structures, allowing the Core power domain to be at least partially turned off. 


Changing from low-power retention to normal operation does not involve a reset of the PE. The 
saved PE state is restored on changing from low-power retention state to normal operation. If 
software has to use an IMPLEMENTATION DEFINED code sequence before entering, or after leaving, 
a retention state, this is referred to as a software-visible retention state. It is IMPLEMENTATION 
DEFINED whether the value of DBGPRCR.CORENPDRQ is set to the value of 
EDPRCR.COREPURQ on leaving the software-visible retention state. 


External Debug Request debug events stay pending and registers in the Core power domain cannot 
be accessed. 
Note 


= This model of retention does not include implementations where the PE exits the state in 
response to a debug register access. From the Debug architecture perspective, 
implementations like this are forms of standby. 








The OS takes some measures to reduce energy consumption by turning the Core power domain off. 
These measures must include the OS saving any PE state, including the debug settings, that must be 
preserved over powerdown. 


If ARMv8.0-DoubleLock is implemented, it is used during powerdown. 
Changing from powerdown to normal operation must include: 

° A Cold reset of the PE after the power level has been restored. 

à The OS restoring the saved PE state. 


External Debug Request debug events stay pending and debug registers in the Core power domain 
cannot be accessed. 
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An implementation might support enabling and disabling threads, either dynamically or once at reset time. Threads 
that are disabled in this way must appear to the external debugger as either: 


° Powered off, meaning they are either: 
— Inapowerdown state. 
—  Inaretention state. 


. Held in reset state. 


Armv§8 external debug uses a simpler two states model for the Debug power domain. The two states are: 
Off The Debug power domain is turned off. 
On The Debug power domain is turned on. 


The available power states, including the cross-product of Core power domain and Debug power domain power 
states is IMPLEMENTATION DEFINED. Implementations are not required to implement all of these states and might 
include additional states. These additional states must appear to the debugger as one of the logical power states 
defined by this model. The control of power states is IMPLEMENTATION DEFINED. 


Note 


As a result, it is IMPLEMENTATION DEFINED whether it is possible for the Debug power domain to be on when the 
Core power domain is off. 








If the Debug power domain is implemented but not powered up when the Core power domain is powered up, the 
Reset Catch debug event and the OS Unlock Catch debug event are disabled. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H6-6809 
Non-Confidential 


Debug Reset and Powerdown Support 
H6.4 Powerup request mechanism 


H6.4 Powerup request mechanism 


If a powerup request mechanism is implemented, asserting the powerup request requests the power controller to 
power up the Core power domain, and to emulate any subsequent powerdown requests, until the powerup request 
mechanism is deasserted. 


DBGPRCR.CORENPDRQ is set to the value of the powerup request at reset. 


H6.4.1 Powerup request mechanism if ARMv8.3-DoPD is implemented 


If ARMv8.3-DoPD is implemented, the external debug component implements an OPTIONAL powerup request 
mechanism. 


If the powerup request mechanism is implemented, the powerup request must be a CoreSight Class 0x9 ROM table 
block that contains both: 


° A parent entry for the debug registers of the PE. 
$ A parent entry for the PMU registers of the PE, if the OPTIONAL PMU with an external debug interface is 
implemented. 


A parent entry of a component is an entry in a ROM table that either locates the component, or locates another ROM 
table that contains the parent entry for the component. 


Note 


The ROM table and any descendants might describe other debug components, including debug components for 
other PEs. 





The ROM table might have a parent entry in a second ROM table and that parent entry might also have a powerup 
request mechanism in the second ROM table. This applies recursively. 





The parent entries for the debug components have the following properties: 


For the debug registers and Performance Monitors registers: 
These components are in the Core power domain. 
The POWERIDVALID bit is 1. 
All parent entries must have the same IMPLEMENTATION DEFINED POWERID value. 


Note 
The IMPLEMENTATION DEFINED POWERID value does not need to be unique for each PE. 








For the CTI registers: 
This component is in the Debug power domain. 
The POWERIDVALID bit is IMPLEMENTATION DEFINED. 
If the POWERIDVALID bit is 1, the entries must have a valid POWERID value. 


For more information about Coresight Class 0x9 ROM Tables, see ARM” CoreSight™ Architecture Specification. 


H6.4.2 Powerup request mechanism if ARMv8.3-DoPD is not implemented 
If ARMv8.3-DoPD is not implemented, the bit EDPRCR.COREPURQ is the powerup request mechanism. 


The control registers DBGPRCR.CORENPDRQ and EDPRCR.COREPURQ provide an interface between the 
power controller and the PE. They typically map directly to signals in the recommended external debug interface. 
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DBGPRCR.CORENPDRQ and the powerup request mechanism can request the power controller to emulate states 
where the Core power domain is completely off or in a low-power state where the Core power domain registers 
cannot be accessed. This simplifies the requirements on software by sacrificing entirely realistic behavior. 


If ARMv8.3-DoPD is not implemented, EDPRSR. {SPD, PU} indicates the Core power domain power state. For 
more information see: 


- The DBGPRCR_EL1 and DBGPRCR System register descriptions. 
è The EDPRCR and EDPRSR external debug register descriptions. 
. Appendix K2 Recommended External Debug Interface. 


The measures to emulate powerdown are IMPLEMENTATION DEFINED. The ability of the debugger to access the state 
of the PE and the system might be limited as a result of the measures adopted. 


In an emulated powerdown state, the debugger must be able to access all debug, PMU, CTI, and trace unit registers 
that are accessible on the external debug interface and are in one of: 


° The Debug power domain. 
° The Core power domain. 
a When a trace unit with a separate trace unit Core power domain is implemented, and the trace unit Core 


power domain is powered on, the trace unit Core power domain. 


That is, the debugger must be able to read and write to such registers without receiving errors. This allows an 
external debugger to debug the powerup sequence. 


Arm recommends that any IMPLEMENTATION DEFINED registers that are on the external debug interface and in either 
the Core power domain or the Debug power domain are also accessible in an emulated powerdown state. 


If ARMv8.0-DoubleLock is implemented, DoubleLockStatus() == FALSE when DBGPRCR.CORENPDRQ = 1. 


Otherwise, the behavior of the PE in emulated powerdown must be similar to that in a real powerdown state. In 
particular, the PE must not respond to other system stimuli, such as interrupts. 


Example H6-1 and Example H6-2 are examples of two approaches to emulating powerdown. 


Example H6-1 An example of emulating powerdown 


The PE is held in Standby state, isolated from any system stimuli. It is IMPLEMENTATION DEFINED whether the PE 
can respond to debug stimuli such as an External Debug Request debug event. 


If the PE can enter Debug state, then the external debugger is able to use the ITR to execute instructions, such as 
loads and stores. This causes the external debugger to interact with the system. If the external debugger restarts the 
PE, the PE leaves Standby state and restarts fetching instructions from memory. 


Example H6-2 Another example of emulating powerdown 


The PE is held in Warm reset. This limits the ability of an external debugger to access the resources of the PE. For 
example, the PE cannot be put into Debug state. 


On exit from emulated powerdown the PE is reset. However, the debug registers that are only reset by a Cold reset 
must not be reset. Typically this means that a Warm reset is substituted for the Cold reset. As such, the effect of 
accessing any register that is reset by a Warm reset while the PE is in the emulated powerdown state will have an 
IMPLEMENTATION DEFINED effect on that register. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H6-6811 
Non-Confidential 


Debug Reset and Powerdown Support 
H6.5 Emulating low-power states 


H6-6812 





Note 


Warm reset and Cold reset have different effects apart from resetting the debug registers. In particular, 
RMR_ELx is reset by a Cold reset and controls the reset state on a Warm reset. This means that ifa Cold reset 
is substituted by a Warm reset, the behavior of the reset code might be different. 


The timing effects of powering down are typically not factored in the powerdown emulation. Examples of 
these timing effects are clock and voltage stabilization. 


Emulation does not model the state lost during powerdown, meaning that it might mask errors in the state 
storage and recovery routines. 
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H6.6 Debug OS Save and Restore sequences 


In Armv8-A, the following registers provide the OS Save and Restore mechanism: 


The OS Lock Access Register, OSLAR, locks the OS Lock to restrict access to debug registers before starting 
an OS Save sequence, and unlocks the OS Lock after an OS Restore sequence. 


The OS Lock Status Register, OSLSR, shows the status of the OS Lock. 


The PE can be configured to generate an OS Unlock Catch debug event on page H3-6762 when the OS Lock 
is unlocked. 


If ARMv8.0-DoubleLock is implemented, the OS Double Lock locks out an external debug interface entirely. 
This is only used immediately before a powerdown sequence. 


See also: 


ARMV8.0-DoubleLock on page A2-64 
Reset and debug on page H6-6819 
Appendix K8 Example OS Save and Restore Sequences 


H6.6.1 EDPRSR.{DLK, SPD, PU} and the Core power domain 


ARM DDI 0487E.a 
ID070919 


If ARMv8.3-DoPD is not implemented, a debugger uses EDPRSR.{DLK, SPD, PU} to determine whether registers 
in the Core power domain can be accessed, and whether their state has been lost since the last time the register was 




















read. 
Table H6-1 Interpretation of the EDPRSR.{DLK, SPD, PU} bits 
EDPRSR Core power domain 
Notes 
DLK SPD PU Power Accesses State lost 
0 0 1 On OK No - 
0 1 1 On OK Yes SPD is cleared to 0 following the read. 
1 X 1 On Error Not known ARMv8ŝ.0-DoubleLock is 
implemented and DoubleLockStatus() 
== TRUE. Software locks the OS 
Double Lock before removing power. 
1 0 Off Error Yes A Cold reset will be asserted on exiting 
powerdown state, but not on exiting 
0 0 Not known Error Not known 


low-power retention state. 





If ARMv8.3-DoPD is implemented, accesses to EDPRSR return an error when the Core power domain is off or in 
a retention state, meaning successful reads of EDPRSR always return 1 for EDPRSR.PU. 


When ARMv8.4-Debug is implemented, and whenever ARMv8.0-DoubleLock is not implemented, EDPRSR.DLK 
is always 0. 


If ARMv8.0-DoubleLock is not implemented, DoubleLockStatus() always returns FALSE. 


If the Core power domain is powered up and DoubleLockStatus() == TRUE, then: 


When ARMv8.2-Debug is not implemented, EDPRSR.{DLK, SPD, PU} can read either {1, UNKNOWN, 1} 
or {UNKNOWN, 0, 0}. 


When ARMv8.2-Debug is implemented, and ARMv8.4-Debug is not implemented, EDPRSR.{DLK, SPD, 
PU} can only read {UNKNOWN, 0, O}. 
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H6.6.2 


H6.6.3 


H6-6814 


EDPRSR.SPD when the Core domain is in either retention or powerdown state 


If ARMVv8.3-DoPD is not implemented, when the Core power domain is in either the retention or powerdown state, 
EDPRSR.SPD is not cleared following a read of EDPRSR and it is IMPLEMENTATION DEFINED whether: 


s EDPRSR.SPD shows whether the state of the debug registers in the Core power domain has been lost since 
the last time that EDPRSR was read. This means that: 


— When the Core power domain is in the powerdown state, EDPRSR.SPD is RAO, this indicates that 
the state of the debug registers has been lost. 


— When the Core power domain is in the retention state, EDPRSR.SPD indicates whether the state of the 
debug registers was lost before the Core power domain entered retention state. 
e EDPRSR.SPD is RAZ, and: 


— On leaving the powerdown state, EDPRSR.SPD is set to 1 which indicates that the state of the debug 
registers has been lost. 


— On leaving the retention state, EDPRSR.SPD reverts the value it had on entering the retention state. 





Note 


If ARMv8.3-DoPD is implemented, accesses to EDPRSR return an error when the Core power domain is off or in 
a retention state. 





EDPRSR.{DLK, R} and reset state 


If ARMv8.3-DoPD is implemented, accesses to EDPRSR return an error when the Core power domain is off or in 
a retention state, meaning successful reads of EDPRSR always return 1 for EDPRSR.PU. 


When ARMv8.4-Debug is implemented, and whenever ARMv8.0-DoubleLock is not implemented, EDPRSR.DLK 
is always 0. 


If ARMv8.0-DoubleLock is not implemented, DoubleLockStatus() always returns FALSE. 


If ARMv8.0-DoubleLock is implemented and enabled, the behavior of all registers and fields except EDPRSR.DLK 
is the same as their behavior if ARMv8.4-Debug is not implemented. 


If ARMv8.4-Debug is implemented EDPRSR.DLK is always 0 and does not give any information about the OS 
Double Lock. 


EDPRSR.R is UNKNOWN when DoubleLockStatus() == TRUE. OSDLR_EL1.DLK is cleared to 0 by a reset. If the 
Core power domain is powered up and entered reset state with the OS Double Lock locked, it is CONSTRAINED 
UNPREDICTABLE whether a read of EDPRSR while the PE is in reset state returns: 


° EDPRSR.{DLK, R, PU} == {1, UNKNOWN, 1} indicating that the OS Double Lock is locked. This is not 
permitted from Armv8.2. 


. EDPRSR.{DLK, R, PU} == {0, 1, 1} indicating that the PE is in reset state. 


. EDPRSR.{DLK, R, PU} == {UNKNOWN, UNKNOWN, 0} indicating that the registers in the Core power 
domain cannot be accessed because the OS Double Lock is locked. 


If the PE was powered up and the OS Double Lock was unlocked when the PE was reset, then EDPRSR.{DLK, R, 
PU} reads as {0, 1, 1} while the PE is in reset state. 


On leaving reset state, EDPRSR.{DLK, R} reads as {0, 0}. 
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H6.6.4 Debug registers to save over powerdown 

Table H6-2 shows the different requirements for self-hosted debug over powerdown and external debug over 

powerdown: 

° The column labeled Self-hosted lists registers that software must preserve over powerdown so that it can 
support self-hosted debug over powerdown. This does not require use of the OS Save and Restore 
mechanism. 

° The column labeled External lists registers that software must preserve over powerdown so that it can support 


external debug over powerdown. This requires use of the OS Save and Restore mechanism: 


— Some external debug registers are not normally accessible to software executing on the PE. Additional 
debug registers are provided that give software the required access to save and restore these external 
debug registers when OSLSR.OSLK is locked. These registers include OSECCR, OSDTRRX, and 
OSDTRTX. 


e Some registers might only present in some implementations, or might not be accessible at all Exception levels 
or in Non-secure state. DBGVCR32_EL2 and SDER32_EL3 are only required to support AArch32. 


Table H6-2 does not include registers for the OPTIONAL Trace and Performance Monitor extensions. 


Table H6-2 Debug registers to save over powerdown 





Register in AArch64 state Register in AArch32 state Self-hosted External 









































MDSCR_EL1 DBGDSCRext Yes Yesa 
DBGBVR<n>_EL1 DBGBVR<n> Yes Yes 
DBGBCR<n>_EL1 DBGBCR<n> Yes Yes 
DBGWVR<n>_EL1 DBGWVR<n> Yes Yes 
DBGWCR<n>_EL1 DBGWCR<n> Yes Yes 
DBGVCR32_EL2 DBGVCR Yes - 
MDCR_EL2 HDCR Yes 7 
SDER32_EL3 SDER Yes g 
MDCR_EL3 SDCR Yesb * 
MDCCINT EL1 DBGDCCINT E Yesb 
DBGCLAIMSET_EL1 DBGCLAIMSET, - Yes¢ 
DBGCLAIMCLR_ EL1 DBGCLAIMCLR 

OSECCR_EL1 DBGOSECCR - Yes 
OSDTRRX_EL1 DBGDTRRXext - Yes 
OSDTRTX_EL1 DBGDTRTXext 





a. The OS Lock must be locked to save and restore for external debug. When the OS Lock is locked, 
DSCR is part of the software save and restore mechanism for external debug. It provides a 
mechanism for an operating system to access some fields of EDSCR that are otherwise read-only 
or not visible to software. This allows the operating system to save and restore these settings over 
a powerdown for the external debugger. 

b. This register is new in Armv8-A. Sequences written for Armv7 do not preserve the register over 
powerdown. 


c. Read DBGCLAIMCLR to save, write DBGCLAIMSET to restore. 
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H6.6.5 


H6.6.6 


H6.6.7 


H6-6816 


OS Save sequence 


To preserve the debug logic state over a powerdown, the state must be saved to nonvolatile storage. This means the 
OS Save sequence must: 


1. 


Lock the OS Lock by: 
. Writing the key value @xC5ACCE55 to the DBGOSLAR in AArch32 state. 
. Writing 1 to OSLAR_EL1.OSLK in AArch64 state. 


Execute an ISB instruction. 


Walk through the debug registers listed in Debug registers to save over powerdown on page H6-6815 and 
save the values to the nonvolatile storage. 


If the ARMv8.0-DoubleLock is implemented, before removing power from the Core power domain, software must: 


1. 


Lock the OS Double Lock by: 

g Writing 1 to DBGOSDLR.DLK in AArch32 state. 

. Writing 1 to OSDLR_EL1.DLK in AArch64 state. 

If ARMv8.0-DoubleLock is not implemented, OSDLR_EL1 and DBGOSDLR ignore writes. 


Execute a Context synchronization event. 


OS Restore sequence 


After a powerdown, the OS Restore sequence must perform the following steps to restore the debug logic state from 
the non-volatile storage: 


l. 


Lock the OS Lock, as described in OS Save sequence. The OS Lock is generally locked by the Cold reset, 
but this step ensures that it is locked. 


Execute an ISB instruction. 


To ensure that, if an external debugger clears the OS Lock before the end of this sequence, no debug 
exceptions are generated: 


s Write 0 to MDSCR_ELI! if executing in AArch64 state. 
: Write 0 to DBGDSCRext if executing in AArch32 state. 


Walk through the debug registers listed in Debug registers to save over powerdown on page H6-6815, and 
restore the values from the nonvolatile storage. The last register to be restored must be: 


- MDSCR _ ELI if executing in AArch64 state. 
$ DBGDSCRext if executing in AArch32 state. 


Execute an ISB instruction. 


Unlock the OS Lock by: 
$ Writing any non-key value to DBGOSLAR if executing in AArch32 state. 
. Writing 0 to OSLAR_EL1.OSLK if executing in AArch64 state. 


Execute a Context synchronization event. 





Note 


The OS Restore sequence overwrites the debug registers with the values that were saved. If there are valid values 
in these registers immediately before the restore sequence, then those values are lost. 





Debug behavior when the OS Lock is locked 


The main purpose of the OS Lock is to prevent updates to debug registers during an OS Save or OS Restore 
operation. The OS Lock is locked on a Cold reset. 
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When the OS Lock is locked: 


° Access to debug registers through the System register interface is mainly unchanged except that: 
— Certain registers are read and written without side-effects. 
— Fields in DSCR and OSECCR that are normally read-only become read/write. 


This allows the state to be saved or restored. For more information, see the relevant register description in 
Chapter H9 External Debug Register Descriptions. 


. Access to debug registers by the external debug interface is restricted to prevent an external debugger 
modifying the registers that are being saved or restored. For more information see External debug interface 
register access permissions summary on page H8-6837. 


a Debug exceptions, other than Breakpoint Instruction exceptions are not generated. 
$ Breakpoint and Watchpoint debug events are not generated. The OS Lock has no effect on Breakpoint 
Instruction exceptions and other debug events. 
H6.6.8 Debug behavior when the OS Lock is unlocked 


When the OS Lock is unlocked, the PE sets EDESR.OSUC to 1 if the OS Unlock Catch debug event is enabled and 
the PE is in Non-debug state, meaning the OS Unlock Catch debug event becomes pending. See OS Unlock Catch 
debug event on page H3-6762. 


H6.6.9 Debug behavior when the OS Double Lock is locked 


If the ARMv8.0-DoubleLock is implemented, software locks the OS Double Lock immediately before a 
powerdown sequence. 


The OS Double Lock ensures that it is safe to remove core power by forcing the debug interfaces to be quiescent. 


When DoubleLockStatus() == TRUE: 


. The external debug interface only has restricted access to the debug registers, so that it is quiescent before 
removing power. See External debug interface register access permissions summary on page H8-6837. 


: Debug exceptions, other than Breakpoint Instruction exceptions, are not generated. 


: Halting is prohibited. See Halting allowed and halting prohibited on page H2-6705. 
Note 


Pending Halting debug events might be lost when core power is removed. 








° No asynchronous debug events are WFI or WFE wake-up events. 


If the ARMv8.0-DoubleLock is not implemented, the PE ensures these conditions are met before allowing power 
to be removed. 


Software must synchronize the update to OSDLR before it indicates to the system that core power can be removed. 
The interface between the PE and its power controller is IMPLEMENTATION DEFINED. 


Typically software indicates that core power can be removed by entering the Wait For Interrupt state. This means 
that software must explicitly synchronize the OSDLR update before issuing the WFI instruction. 


OSDLR.DLK is ignored and DoubleLockStatus() == FALSE if either: 
s The PE is in Debug state. 
. DBGPRCR.CORENPDRQ is set to 1. 
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Note 


It is possible to enter Debug state with OSDLR.DLK set to 1. This is because a Context synchronization event is 
required to ensure the OS Double Lock is locked, meaning that Debug state might be entered before the OSDLR 
update is synchronized. 








Because OSDLR.DLK is ignored when DBGPRCR.CORENPDRQ is set to 1, an external debugger can write to 
DBGPRCR.CORENPDRQ, and the ARMv8.0-DoubleLock is not always implemented, software must not rely on 
using the OS Double Lock to disable debug exceptions or to prohibit halting, or both. Arm deprecates use of the OS 
Double Lock for these purposes, and instead recommends that software: 


. Uses the OS Lock to disable debug exceptions during save or restore sequences. 


à Uses the debug authentication interface to prohibit halting and external debug access to debug registers at 
times other than immediately prior to removing power. 


As the purpose of the OS Double Lock is to ensure that it is safe to remove core power, if the ARMv8.0-DoubleLock 
is implemented, it is important to avoid race conditions that defeat this purpose. Arm recommends that: 


s Once the write to OSDLR.DLK has been synchronized by a Context synchronization event and 
DoubleLockStatus() == TRUE, a PE must: 


— Not allow a debug event generated before the Context synchronization event to cause an entry to 
Debug state or act as a wake-up event for a WFI or WFE instruction after the Context synchronization 
event has completed. 


— Complete any external debug access started before the Context synchronization event by the time the 
Context synchronization event completes. 


Note 


A debug register access might be in progress when software sets OSDLR.DLK to 1. An 
implementation must not permit the synchronization of locking the OS Double Lock to stall 
indefinitely while waiting for that access to complete. This means that any debug register access that 
is in progress when software sets OSDLR.DLK to 1 must complete or return an error in finite time. 








s If a write to DBGPRCR or EDPRCR made when OSDLR.DLK == 1 changes DBGPRCR.CORENPDRQ or 
EDPRCR.CORENPDRQ from 1 to 0, meaning DoubleLockStatus() changes from FALSE to TRUE, then 
before signaling to the system that the CORENPDRQ field has been cleared and emulation of powerdown is 
no longer requested, meaning the system can remove core power, the PE must ensure that all the requirements 
for DoubleLockStatus() == TRUE listed in this section are met. 


Ina standard OS Save sequence, the OS Lock is locked before the OS Double Lock is locked. This means that writes 
to CORENPDRQ are ignored by the time the OS Double Lock is locked. However, if DoubleLockStatus() == 
FALSE, an external debugger can clear the OS Lock at any time, and then write to EDPRCR. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Debug Reset and Powerdown Support 
H6.7 Reset and debug 


H6.7 Reset and debug 


All registers in the Core power domain are either: 
° Reset by both a Cold and a Warm reset. 
° Reset only by a Cold reset and are not changed by a Warm reset. 


For more information, see Reset on page D1-2289. 
All registers in the Debug power domain are reset by an External Debug reset. 


Figure H6-1 shows this reset scheme. The following three reset signals are an example implementation of the reset 
scheme: 

° CORERESET, which must be asserted for a Warm reset. 

. CPUPORESET, which must be asserted for a Cold reset. 

° PRESETDBG, which must be asserted for an External Debug reset. 


As shown in the figure, the external debug logic is split between the Debug power domain and the Core power 
domain. 


Debug power domain Core power domain 








External debug reset Cold reset Warm reset 








External debug logic 
(part, including external 
debug registers) 


Non-debug logic 
External debug logic 




















(part) Self-hosted debug logic 
Shared debug logic 
CORERESET OR 
PRESETDBG CPUPORESET CPUPORESET 























Figure H6-1 Power and reset domains 
For more information about power domains and power states, see Power domains and debug on page H6-6807. 
When power is first applied to the Debug power domain, PRESETDBG must be asserted. 
When power is first applied to the Core power domain, CPUPORESET must be asserted. 


Note 


In this scheme, logic in the Warm reset domain is reset by asserting either CORERESET or CPUPORESET. This 
implies a particular implementation style that permits these approaches. 








CPUPORESET is not normally asserted on moving from a low-power state, where power has not been removed, 
to a full-power state. This can occur, for example, on exiting a low-power retention state. See also Emulating 
low-power states on page H6-6811 and the EDPRSR register description. 
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H6.7.1 External debug interface accesses to registers in reset 
If a reset signal is asserted and the external debug interface: 


° Writes a register, or indirectly writes a register or register field as a side-effect of an access: 


— Then, if the register or register field is reset by that reset signal, it is CONSTRAINED UNPREDICTABLE 
whether the register or register field takes the reset value or the value written. The reset value might 
be UNKNOWN. 


— Otherwise the register or register field takes the value that is written. 
° Reads a register, or indirectly reads a register or register field, as part of an access: 


— Then, if the register or register field is reset by that reset signal, the value returned in UNKNOWN. 
— Otherwise, the value of the register or register field is returned. 


It is IMPLEMENTATION DEFINED whether any register can be accessed when External Debug reset is being asserted. 
The result of these accesses is IMPLEMENTATION DEFINED. 
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Chapter H7 
The PC Sample-based Profiling Extension 


This chapter describes the OPTIONAL PC Sample-based Profiling Extension that provides a non-invasive external 
debug component. 


It contains the following section: 
g About the PC Sample-based Profiling Extension on page H7-6822. 
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H7.1 


H7.1.1 


H7-6822 


About the PC Sample-based Profiling Extension 


The PC Sample-based Profiling Extension is an OPTIONAL extension that provides coarse-grained, non-invasive 
profiling by an external debugger. See also Non-invasive behavior on page D7-2673. 


PC Sample-based Profiling creates samples so that tools can populate a statistical model of the performance of 
software executing on the PE. 





Note 


Data returned by periodic sampling of PC Sample-based Profiling registers is sufficient to allow tools to estimate 
the distribution of time spent executing software on the PE. 


The delay between an instruction being executed by the PE and its address appearing in the PC Sample Register is 
not defined, and Armv8 does not require that the sampled instruction was recently executed. For example, if a piece 
of software executes a load instruction that reads the PC Sample Register of the PE it is running on, there is no 
guaranteed relationship between the address of the load instruction and the value read. The PC Sample Register is 
intended only for use by an external agent to provide statistical information for software profiling. 





It must be possible to sample references to branch targets. It is IMPLEMENTATION DEFINED whether references to 
other instructions can be sampled. The branch target for a conditional branch instruction that fails its condition 
check is the instruction that follows the conditional branch instruction. The branch target for an exception is the 
exception vector address. 


To keep the implementation and validation cost low, a reasonable degree of inaccuracy in the sampled data is 
acceptable. Arm does not define a reasonable degree of inaccuracy but recommends the following guidelines: 


$ In exceptional circumstances, such as a change in Security state or other boundary condition, it is acceptable 
for the sample to represent an instruction that was not committed for execution. 


s Under unusual non-repeating pathological cases, the sample can represent an instruction that was not 
committed for execution. These cases are likely to occur as a result of asynchronous exceptions, such as 
interrupts, where the chance of a systematic error in sampling is very unlikely. 


è Under normal operating conditions, the sample must reference an instruction that was committed for 
execution, including its context, and must not reference instructions that are fetched but not committed for 
execution. 


Note 


In the Armv7 PC Sample-based Profiling Extension, an offset was applied to the sampled program counter value 
and this offset and the instruction set state indicated in bits [1:0] of the sampled value. In the Armv8 PC 
Sample-based Profiling Extension, the sampled value is the address of an instruction that has executed, with no 
offset and no indication of the instruction set state. 








s Controlling the PC Sample-based Profiling Extension. 

. Registers implemented by the PC Sample-based Profiling Extension on page H7-6823. 

. Permitted behavior that might make the PC Sample-based profiling registers UNKNOWN on page H7-6824. 
s Pseudocode description of PC Sample-based Profiling on page H7-6824. 


Controlling the PC Sample-based Profiling Extension 


PC Sample-based Profiling is controlled by the IMPLEMENTATION DEFINED authentication interface 
ExternalNoninvasiveDebugEnabled(). 


PC Sample-based Profiling is prohibited unless both: 
. It is allowed by the IMPLEMENTATION DEFINED authentication interface ExternalNoninvasiveDebugEnabled(). 


° At least one of the following applies: 
— The PE is executing in Non-secure state. 


—  EL3 is not implemented. 
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—  EL3 is implemented, the PE is executing in Secure state, and non-invasive debug is allowed by the 
IMPLEMENTATION DEFINED authentication interface ExternalSecureNoninvasiveDebugEnabled(). 


—  EL3 is implemented, EL3 or EL1 is using AArch32, the PE is executing at ELO in Secure state, and 
the value of SDER.SUNIDEN is 1. 


The state of the IMPLEMENTATION DEFINED authentication interface is visible through DBGAUTHSTATUS ELI. 
See Recommended authentication interface on page K2-7653. 


H7.1.2 Registers implemented by the PC Sample-based Profiling Extension 


ARM DDI 0487E.a 
ID070919 


The options for implementing the PC Sample-based Profiling extension are: 


5 The extension is implemented in the external debug register space. EDDEVID.PCSample and identifies the 
implemented level of profiling, and EDDEVID1.PCSROffset also indicates that this option is implemented. 


From Army8.2 this option is not permitted. 


s ARMv8.2-PCSample is implemented, meaning the PC Sample-based Profiling extension is implemented in 
the Performance Monitors memory-mapped register space. PMDEVID.PCSample identifies the 
implemented level of profiling. 


If PC Sample-based Profiling is implemented in the external debug register space: 
° The following external debug registers can be implemented: 
— EDCIDSR. 
— EDPCSR. 
—  EDVIDSR. 
See External debug interface register map on page H8-6839. 
° If ARMv8.1-VHE is implemented, EDSCR.SC2 controls what PC Sample-based Profiling samples. 


If ARMv8.2-PCSample is implemented, the following registers can be implemented in the Performance Monitors 
memory-mapped register space: 


: PMCID1SR and PMCID2SR. 
. PMPCSR. 
s PMVIDSR. 


See Performance Monitors external register views on page 15-7036. 


If the PC Sample-based Profiling Extension is implemented with ARMv8.2-PCSample but the Performance 
Monitors Extension is not implemented, then the PC Sample-based Profiling Extension is implemented in its own 
memory-mapped register space, within the area that is reserved for the Performance Monitors, see Table H7-1. If 
CoreSight compliance is required: 
- The management registers are defined as in Table K2-3 on page K2-7655. 
è The support for PC Sample-based profiling is defined in the following registers: 

— PMDEVTYPE.MAJOR has the value 0x0. 

— PMDEVARCH.ARCHID has the value 0x0A10. 


Table H7-1 PC Sample-based Profiling register map without the Performance Monitors Extension 


























Offset Description 
0x200 PMPCSR[31:0] 
0x204 PMPCSR[63:32] 
0x208 PMCIDISR 
0x20C PMVIDSR 
0x220 PMPCSR[31:0] (alias) 
0x224 PMPCSR[63:32] (alias) 
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H7.1.3 


H7.1.4 


H7-6824 


Table H7-1 PC Sample-based Profiling register map without the Performance Monitors Extension 








Offset Description 
0x228 PMCIDISR (alias) 
0x22C PMCID2SR 





0x600-0x6FC IMPLEMENTATION DEFINED 





0xE80-0xEFC IMPLEMENTATION DEFINED for CoreSight compliance 





QxFFO-QxFFc Management and CoreSight compliance registers 





Permitted behavior that might make the PC Sample-based profiling registers UNKNOWN 


The architecture permits IMPLEMENTATION DEFINED extensions to external debug to define mechanisms that make 
the values of the PC Sample-based profiling registers UNKNOWN. However, it requires that any such mechanism is 
disabled by default. This means that powerup or a hard reset of the PE must leave the PE in a state where the PC 
Sample-based Profiling Extension, if implemented, exhibits its architecturally-defined behavior. 





Note 


A mechanism that, when enabled, makes the PC Sample-based profiling registers UNKNOWN might use other 
sample-based profiling events that are appropriate for a use that is independent of PC Sample-based Profiling. 





When EDPCSR or PMPCSR are read by the PE for the first time after exiting Debug state or Reset state, PMPCSR 
or EDPCSR will return the value @xFFFFFFF. Any subsequent read of PMPCSR or EDPCSR will return sampled 
instruction address values. 


Pseudocode description of PC Sample-based Profiling 


When PC Sample-based Profiling is implemented but not with ARMv8.2-PCSample, the functionality is described 
by the pseudocode functions: 


. CreatePCSample(), which populates a variable of type PCSample. 
. EDPCSR1o[], which writes a PC sample to the EDPCSR and associated registers. 


When ARMv8.2-PCSample is implemented, the functionality is described by the pseudocode functions: 
° CreatePCSample(), which populates a variable of type PCSample. 
° PMPCSR[], which writes a PC Sample to the PMPCSR and associated registers. 
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This chapter provides some additional information about the external debug registers. It contains the following 
sections: 


Relationship between external debug and System registers on page H8-6826. 
Endianness and supported access sizes on page H8-6827. 

Synchronization of changes to the external debug registers on page H8-6828. 
Memory-mapped accesses to the external debug interface on page H8-6832. 
External debug interface register access permissions on page H8-6835. 
External debug interface registers on page H8-6839. 

Cross-trigger interface registers on page H8-6845. 

External debug register resets on page H8-6847. 


Note 





Where necessary Table K 14-1 on page K 14-7810 disambiguates the general register references used in this chapter. 
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H8.1 Relationship between external debug and System registers 


Table H8-1 shows the relationship between external debug registers and System registers. Where no relationship 
exists, the registers are not listed. 


Table H8-1 Equivalence between external debug and System registers 





System register 












































External debug register AArch64 AArch32 Notes 

DBGDTRRX_ELO DBGDTRRX_ELO DBGDTRRXint See also Summary of System register 
accesses to the DCC on page H4-6780 

DBGDTRTX_ELO DBGDTRTX_ELO DBGDTRTXint 

OSLAR_EL1 OSLAR_EL1 DBGOSLAR - 

DBGBVR<n>_EL1[31:0] DBGBVR<n>_EL1[31:0] DBGBVR<n> - 

DBGBVR<n>_EL1[63:32] | DBGBVR<n>_EL1[63:32] | DBGBXVR<n> 

DBGBCR<n>_EL1 DBGBCR<n>_EL1 DBGBCR<n> - 

DBGWVR<n>_EL1[31:0] DBGWVR<n>_EL1[31:0] DBGWVR<n> - 

DBGWVR<n>_EL1[63:32] DBGWVR<n>_EL1[63:32] 

DBGWCR<n>_EL1 DBGWCR<n>_EL1 DBGWCR<n> - 

DBGCLAIMSET EL1 DBGCLAIMSET EL1 DBGCLAIMSET - 

DBGCLAIMCLR_EL1 DBGCLAIMCLR_EL1 DBGCLAIMCLR - 

DBGAUTHSTATUS_EL1 DBGAUTHSTATUS EL1 DBGAUTHSTATUS Read-only 

EDSCR MDSCR_EL1 DBGDSCRext Only some fields map 

EDECCR OSECCR_EL1 DBGOSECCR Applies when the OS Lock is locked. 

MIDR_EL1 MIDR EL1 MIDR Read-only copies of Processor ID 
Registers 

EDDEVAFFO MPIDR_EL1[31:0]@ MPIDR Read-only copies of system ID registers 

EDDEVAFF1 MPIDR_EL1[63:32] 








a. This is a word of a 64-bit register. 


In addition: 


s EDSCR. {TXfull, RXfull} are read-only aliases for DCCSR.{TXfull, RXfull}. 
e EDPRCR.CORENPDRQ is a read/write alias for DBGPRCR.CORENPDRQ. 
a EDPRSR.OSLK is a read-only alias for OSLSR.OSLK. 
è If the ARMv8.0-DoubleLock is implemented, EDPRSR.DLK is a read-only function of OSDLR.DLK. 
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H8.2 Endianness and supported access sizes 
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The debug registers, Performance Monitors registers, and CTI registers are implemented as memory-mapped 
peripherals. The Arm architecture requires memory-mapped peripherals to be little-endian. 


The memory access sizes supported by any peripheral is IMPLEMENTATION DEFINED by the peripheral. For accesses 
to the debug registers, Performance Monitors registers, and CTI registers, implementations must: 


s Comply with the requirements of Supported access sizes on page 11-7008. 


° Support word-aligned 32-bit accesses to access 32-bit registers or either half of a 64-bit register mapped to a 
doubleword-aligned pair of adjacent 32-bit locations, even if no PE in the system implements AArch32. 


Note 
These requirements mean that a system implementing the debug registers using a 32-bit bus, such as a AMBA 
APB3, with a wider system interconnect must implement a bridge between the system and the debug bus that can 
split 64-bit accesses. 








For accesses from the external debug interface, the size of an access is determined by the interface. For an access 
from an ADIv5-compliant Memory Access Port, MEM-AP, this is specified by the MEM-AP CSW register. 
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H8.3 
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Synchronization of changes to the external debug registers 


This section describes the synchronization requirements for the external debug interface. 


For more information on how these requirements affect debug, see: 
è Synchronization and debug exceptions on page D2-2459 for exceptions taken from AArch64 state. 
$ Synchronization and debug exceptions on page G2-5674 for exceptions taken from AArch32 state. 
. Synchronization and Halting debug events on page H3-6765. 
s Synchronization of DCC and ITR accesses on page H4-6780. 


This section refers to accesses from the external debug interface as external reads and external writes. It refers to 
accesses to System registers as direct reads, direct writes, indirect reads, and indirect writes. 


Note 


Synchronization requirements for AArch64 System registers on page D13-2819 and Synchronization of changes to 
AArch32 System registers on page G8-5896 define direct read, direct write, indirect read, and indirect write, and 
classifies external reads as indirect reads, and external writes as indirect writes. 








For general information about synchronization, access completion, ordering, and observability, see Synchronization 
of memory-mapped registers on page 11-7010. 


Writes to the same register are serialized, meaning they are observed in the same order by all observers, although 
some observers might not observe all of the writes. With the exception of DBGBCR<n>_EL1, DBGBVR<n>_EL1, 
DBGWCR<n>_EL1, and DBGWVR<n>_EL1, external writes to different registers are not necessarily observed in 
the same order by all observers as the order in which they complete. 


Synchronization of DCC and ITR accesses on page H4-6780 describes the synchronization requirements for the 
DCC and ITR. 


Changes to the IMPLEMENTATION DEFINED authentication interface are external writes to the authentication status 
registers by the master of the authentication interface. See Synchronization and the authentication interface on 
page H8-6829. 


The external agent must be able to guarantee completion of a write. For example by: 


e Marking the memory as Device-nGnRnE and executing a DSB barrier, if the system supports this property. 
` Reading back the value written. 
° Some guaranteed property of the connection between the PE and the external agent. 

Note 





For an external Debug Access Port, access completion is an IMPLEMENTATION DEFINED property. For a CoreSight 
system using APB-AP to access a debug APB, accesses complete in order. 





However, the external agent cannot force synchronization of completed writes without halting the PE. Executing an 
ISB instruction, either in Debug state or in Non-debug state, and exiting from Debug state forces synchronization. 
If the PE is in Debug state, executing an ISB instruction is guaranteed to explicitly synchronize any external reads, 
external writes, and changes to the authentication interface that are ordered before the external write to EDITR. 


For any given observer, external writes to the following register groups are guaranteed to be observable in the same 
order in which they complete: 


s The breakpoint registers, DBGBCR<n>_EL1 and DBGBVR<n>_EL1. 
$ The watchpoint registers, DBGWCR<n>_EL1 and DBGWVR<n>_EL1. 


This guarantee only applies to external writes to registers within one of these groups. There is no guarantee 
regarding the ordering of the observability of external writes within these groups with respect to external writes to 
registers, for example EDSCR, or between breakpoints and watchpoints, including watchpoints linked to context 
matching breakpoints. 
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Note 


This means that a debugger can rely on the external writes to be observed in the same order in which they complete. 
It does not mean that a debugger can rely on the external writes being observed in finite time. 





In a simple sequential execution an indirect write that occurs as a side-effect of an access happens atomically with 
the access, meaning no other accesses are allowed between the register access and its side-effect. 


If two or more interfaces simultaneously access a register, the behavior must be as if the accesses occurred 
atomically and in any order. This is described in Examples of the synchronization of changes to the external debug 
registers. 


Some registers have the property that for certain bits a write of 0 is ignored and a write of 1 has an effect. This means 
that simultaneous writes must be merged. Registers that have this property and support both external debug and 
System register access include DBGCLAIMSET EL1, DBGCLAIMCLR_EL1, PMCR_ELO.{C,P}, 
PMOVSSET_EL0, PMOVSCLR_EL0, PMCNTENSET_EL0, PMCNTENCLR_ELO, PMINTENSET_EL1, 
PMINTENCLR_EL1, and PMSWINC_ELO. This last register is OPTIONAL and deprecated in the external debug 
interface. 


H8.3.1 Synchronization and the authentication interface 


Changes to the authentication interface are indirect writes to the state of the PE by the master of the authentication 
interface. 


For an external debug interface read of any Authentication Status register, or an indirect read of the authentication 
interface made in determining the response to a subsequent external debug interface access, a change on the 
authentication interface must be observable following a subsequent explicit Context synchronization event, and: 


° It is IMPLEMENTATION DEFINED whether a change is guaranteed to be observable in finite time. 
. It is IMPLEMENTATION DEFINED whether a change is guaranteed to be observable following an entry to Debug 
state. 


For a System register read of DBGAUTHSTATUS_EL1, a change on the authentication interface is guaranteed to 
be observable only after a Context synchronization event. 


Note 


s In some systems the authentication interface is fixed by configuration, or changed under the control of 
software. These systems can require explicit synchronization for any change to the authentication interface. 





è In other systems, the authentication interface is controlled dynamically by an external agent. In these systems, 
it is desirable that changes to the authentication interface do not require explicit synchronization by software 
executing on the PE to be observable by subsequent external debug interface accesses, and are either 
observable in finite time or are synchronized by entry to Debug state. Otherwise there are scenarios where a 
debugger is not able to halt and debug the system. 





H8.3.2 Examples of the synchronization of changes to the external debug registers 
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Example H8-1, Example H8-2 on page H8-6830, and Example H8-3 on page H8-6830 show the synchronization of 
changes to the external debug registers. 


Example H8-1 Order of synchronization of Breakpoint and Watchpoint register writes 


Initially DBGBVR<n>_EL1 is 0x8000 and DBGBCR<n>_EL!1 is 0x0181. This means that a breakpoint is enabled 
on the halfword T32 instruction at address 0x8000. 


A sequence of external writes occurs in the following order: 
l. 0x0000 is written to DBGBCR<n>_EL1, disabling the breakpoint. 
2. 0x9000 is written to DBGBVR<n>_EL1[31:0]. 
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3. 0x0061 is written to DBGBCR<n>_EL1, enabling a breakpoint on the halfword at address 0x9002. 


The external writes must be observable to indirect reads in the same order as the external writes complete. This 
means that at no point is there a breakpoint enabled on either of the halfwords at address 0x8002 and 0x9000. 


Similarly a breakpoint or watchpoint must be disabled: 
° If both halves of a 64-bit address have to be updated. 


è If any of the DBGBCR<n>_EL1 or DBGWCR<n>_EL] fields are modified at the same time as updating the 
address. 


Example H8-2 Simultaneous accesses to DTR registers 


Initially EDSCR. {TXfull, TXU, ERR} are 0. Then: 
à 0x0DCCDA7A is directly written to DBGDTRTX_ELO by an MSR instruction. 
è DBGDTRTX_ELO0 is indirectly read by the external debug interface. 


These accesses might happen at the same time and in any order. 


If the direct write of @x@DCCDA7A to DBGDTRTX_ELO is handled first, then: 

a The external debug interface read of DBGDTRTX_ELO clears EDSCR.TXfull to 0. 
s EDSCR. {TXU, ERR} are unchanged. 

7 The external debug interface read returns @x@DCCDA7A. 


If the indirect read of DBGDTRTX_ELO by the external debug interface is handled first, then: 


s The external debug interface read of DBGDTRTX_ELO causes an underrun and as a result EDSCR.{TXU, 
ERR} are both set to 1. 


è The external debug interface returns an UNKNOWN value. 
$ Writing 0x0DCCDA7A to DBGDTRTX_ELO sets DTRTX to 0x0DCCDA7A and EDSCR.TXfull to 1. 


Example H8-3 Simultaneous writes to CLAIM registers 


Initially all CLAIM tag bits are 0. Then: 


` 0x01 is written to DBGCLAIMSET_EL1 by a direct write, followed by an explicit Context synchronization 
event. 


7 0x02 is written to DBGCLAIMSET EL] by an external write. 
These events might happen at the same time and in either order. 


After this: 
a DBGCLAIMCLR ELl! is read by a direct read. 
è DBGCLAIMCLR ELl! is read by an external read. 


In this case, a direct read can return either 0x01 or 0x03, and the external read can return either 0x02 or 0x03. 


The only permitted final result for the CLAIM tags is the value 0x03, because this would be the result regardless of 
whether 0x01 or 0x02 is written first. This is because the external write is guaranteed to be observable to a direct read 
in finite time. See Synchronization requirements for AArch64 System registers on page D13-2819. 


It is not possible for a direct read to return 0x01 and the external read to return 0x02, because the writes to 
DBGCLAIMCLR ELl! are serialized. 


In the following scenario, there is only one permitted result. Both observers observe the value 0x03, and then, at the 

same time, two writes occur: 

of 0x04 is written to DBGCLAIMSET EL] by a direct write, followed by an explicit Context synchronization 
event. 


$ 0x01 is written to DBGCLAIMCLR_EL!1 by an external write. 
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In this case only permitted final result for the CLAIM tags is the value 0x06. 
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Memory-mapped accesses to the external debug interface 


Support for memory-mapped access to the external debug interface is OPTIONAL. When memory-mapped access to 
the external debug interface is supported, the external debug interface is accessed as a little-endian memory-mapped 
peripheral. 


If the external debug interface is CoreSight compliant, then an OPTIONAL Software Lock can be implemented for 
memory-mapped accesses to each component. 


The Software Lock is OPTIONAL and deprecated. If ARMv8.4-Debug is implemented, the Software Lock is not 
implemented. If it is not implemented, the behavior is as if it is unlocked. The Software Locks are controlled by 
EDLSR and EDLAR, PMLSR and PMLAR, and CTILSR and CTILAR. See Management registers and CoreSight 
compliance on page K2-7655. 


With the exception of these registers and the effect of the Software Lock, the behavior of the memory-mapped 
accesses is the same as for other accesses to the external debug interface. 





Note 


The recommended memory-mapped accesses to the external debug interface are not compatible with the 
memory-mapped interface defined in Armv7. In particular: 


: The memory map is different. 


° Memory-mapped accesses do not behave differently to Debug Access Port accesses when 
OSLSR.OSLK == 1, meaning that the OS Lock is locked. 





The following sections give more information about these memory-mapped accesses: 
. Register access permissions for memory-mapped accesses. 


s Synchronization of memory-mapped accesses to external debug registers on page H8-6833. 


See also Supported access sizes on page 11-7008. 


Register access permissions for memory-mapped accesses 


It is IMPLEMENTATION DEFINED whether unprivileged memory-mapped accesses are allowed. Privileged software 
is responsible for controlling memory-mapped accesses using the MMU. 


If ARMv8.4-Debug is implemented, the Secure view of a debug component is mapped into Secure physical memory 
and the Non-secure view is mapped into Non-secure physical memory. 


If ARMv8.4-Debug is implemented, the access permissions are different in each Security state, but Secure and 
Non-secure views of the debug components are identical. Arm recommends the views are located at the same 
address in the Secure and Non-secure physical address maps. 


If memory-mapped accesses are made through an ADIV5S interface, the Debug Access Port can block the access 
using DBGSWENABLE. This is outside the scope of the Armv8-A architecture. See Arm® Debug Interface 
Architecture Specification ADIVS.0 to ADIVS.2. 


Effect of the OPTIONAL Software Lock on memory-mapped access 


For memory-mapped accesses, if other controls permit access to a register, the OPTIONAL Software Lock is 
implemented, and EDLSR.SLK, PMLSR.SLK, or CTILSR.SLK is set to 1, meaning the Software Lock is locked, 
then with the exception of the LAR itself: 


7 If other controls permit access to a register, then writes are ignored. That is: 
—  Read/write (RW) registers become read-only, writes ignored (RO/WI). 
—  Write-only (WO) registers become writes ignored (WI). 


° Reads and writes have no side-effects. A side-effect is where a direct read or a direct write ofa register creates 
an indirect write of the same or another register. When the Software Lock is locked, the indirect write does 
not occur. 
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. Writes to EDLAR, PMLAR, and CTILAR are unaffected. 

This behavior must also apply to all IMPLEMENTATION DEFINED registers. 

For example, if EDLSR.SLK is set to 1: 

7 EDSCR. {TXfull, TXU, ERR} are unchanged by a memory-mapped read from DBGDTRTX_ELO. 


s EDSCR. {RXfull, RXO, ERR} are unchanged by a memory-mapped write to DBGDTRRX_ELO that is 
ignored. 


© EDSCR. {ITE, ITO, ERR} are unchanged by a memory-mapped write to EDITR that is ignored. 
s OSLSR.OSLK is unchanged by a memory-mapped write to OSLAR_ELI1 that is ignored. 


° EDPCSR[63:32], EDCIDSR, and EDVIDSR are unchanged by a memory-mapped read from 
EDPCSR[31:0]. 





Note 


Updating EDVIDSR, EDCIDSR, and EDPCSRhi are side-effects of reading EDPCSRIo, such that these 
registers contain the matching context for EDPCSRlo. The process that updates EDPCSRlo with PC samples 
is not a side-effect of the access. Reads of EDPCSRlo made when the Software Lock is locked can be used 
to profile software. 





è PMPCSR[63:32], PMCID1SR/PMCID2SR, and PMVIDSR are unchanged by a memory-mapped read from 
PMPCSRJ3 1:0]. 


Note 
Updating PMVIDSR, PMCID1ISR/PMCID2SR, and PMPCSR[31:0] are side-effects of reading 
PMPCSR[63:32], such that these registers contain the matching context for PMPCSR[63:32]. The process 
that updates PMPCSR[63:32] with PC samples is not a side-effect of the access. Reads of PMPCSR[63:32] 
made when the Software Lock is locked can be used to profile software. 








° EDPRSR.{SDR, SPMAD, SDAD, SR, SPD} are unchanged by a memory-mapped read from EDPRSR. 


G EDPRSR.SDAD is not set if an error response is returned due to a memory-mapped read or write of any 
debug register as the result of the value of the EDAD field. 


s The CLAIM tags are unchanged by memory-mapped writes to DBGCLAIMSET_EL1 and 
DBGCLAIMCLR EL1 which are ignored. 


Similarly, if PMLSR.SLK is set to 1, then EDPRSR.SPMAD is not set if an error response is returned to a 
memory-mapped read or write of any Performance Monitors register due to the value of the EPMAD field. 


Behavior of a not permitted memory-mapped access 


Where the architecture requires that an external debug interface access generates an error response, a 
memory-mapped access must also generate an error response. However, it is IMPLEMENTATION DEFINED how the 
error response is handled, as this depends on the system. 


Arm recommends that the error is returned as either: 


° A synchronous external Data Abort. 
s An SError interrupt. 
H8.4.2 Synchronization of memory-mapped accesses to external debug registers 


ARM DDI 0487E.a 
ID070919 


The synchronization requirements for memory-mapped accesses to the external debug interface is described in 
Synchronization of changes to the external debug registers on page H8-6828 and Synchronization of 
memory-mapped registers on page 11-7010. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H8-6833 
Non-Confidential 


About the External Debug Registers 
H8.4 Memory-mapped accesses to the external debug interface 


The synchronization requirements between different routes to the external debug interface, that is, between Debug 
Access Port accesses and memory-mapped accesses are IMPLEMENTATION DEFINED. 
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H8.5 External debug interface register access permissions 


Some external accesses to debug registers and Performance Monitor registers are not permitted and return an error 
response if: 


° The Core power domain is powered down or is in low-power state where the registers cannot be accessed. 
° OSLSR.OSLK == 1. The OS Lock is locked. 

- ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE. The OS Double Lock is locked. 
è The access is disabled by either the authentication interface or secure monitor. 


Not all registers are affected in all of these cases. For details, see External debug interface register access 
permissions summary on page H8-6837. 


H8.5.1 External debug over powerdown and locks 


Accessing registers using the external debug interface is not possible when the Debug power domain is off. In this 
case all accesses return an error. 


External accesses to debug and Performance Monitors registers in the Core power domain are not permitted and 
return an error response if: 


s The Core power domain is off or in low-power state where the registers cannot be accessed. 


° OSLSR.OSLK == 1, meaning that the OS Lock is locked. This allows software to prevent external debugger 
modification of the registers while it saves and restores them over powerdown. 


s ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE. This means that the OS Double 
Lock is locked. The OS Double Lock ensures that it is safe to remove Core power by forcing the debug 
interface to be quiescent. 


If ARMv8.0-DoubleLock is not implemented, the hardware must provide another method to safely remove Core 
power. 


The OS Lock condition does not apply to the following debug registers: 
: OSLAR_EL1. This means that an external debugger can override this lock. 


° EDESR. This means that an external debugger can program a debug event for when software unlocks the OS 
Lock. See OS Unlock Catch debug event on page H3-6762. 


. The ID registers that describe the PE to the debugger. 


See also Debug registers to save over powerdown on page H6-6815. 


H8.5.2 External access disabled 


ARM DDI 0487E.a 
ID070919 


Accesses are further controlled by the external authentication interface. An untrusted external debugger cannot 
program the breakpoint and watchpoint registers to generate spurious debug exceptions. If external invasive 
debugging is not enabled, these external accesses to the registers are disabled. If EL3 is implemented, then SDCR 
provides additional external access controls for those registers. 


The disable applies to: 
è The DBGBVR<n>_EL1, DBGBCR<n>_EL1, DBGWVR<n>_EL1, and DBGWCR<n>_EL] registers. 
: From Armv8.2, the OSLAR_ ELI register. 


If ARMv8.2-Debug is not implemented, it is IMPLEMENTATION DEFINED whether the disable applies to 
OSLAR ELl. 


If ARMv8.4-Debug is not implemented, the external debug interface cannot access these registers if any of the 
following are true: 


. ExternalInvasiveDebugEnabled() == FALSE. 


s ExternalSecureInvasiveDebugEnabled() == FALSE, EL3 is not implemented, and the PE behaves as if the 
Security state is Secure. 
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. ExternalSecureInvasiveDebugEnabled() == FALSE, EL3 is implemented and SDCR.EDAD == 1. 


If ARMv8.4-Debug is implemented, Non-secure accesses from the external debug interface to these registers are 
not permitted if any of the following are true: 


° EL3 is not implemented and the PE behaves as if the Security state is Secure. 
7 EL3 is implemented and SDCR.EDAD == 1. 


The AllowExternalDebugAccess() pseudocode function describes these accessibility rules. 


PEs might also provide an OPTIONAL external debug interface to the Performance Monitor registers. The 
authentication interface and SDCR provide similar external access disable controls for those registers. 


If ARMv8.4-Debug is not implemented, the external debug interface cannot access the Performance Monitor 
registers if any of the following are true: 


. ExternalNoninvasiveDebugEnabled() == FALSE. 


. ExternalSecureNoninvasiveDebugEnabled() == FALSE, EL3 is not implemented and the PE behaves as if the 
Security state is Secure. 


. ExternalSecureNoninvasiveDebugEnabled() == FALSE, EL3 is implemented and SDCR.EPMAD == 1. 


If ARMv8.4-Debug is implemented, Non-secure accesses from the external debug interface to these registers are 
not permitted if any of the following are true: 


° EL3 is not implemented and the PE behaves as if the Security state is Secure. 
$ EL3 is implemented and SDCR.EDAD = 1. 


The Al lowExternalPMUAccess() pseudocode function describes these accessibility rules. 





Note 
° Arm recommends that secure software that is not making use of debug hardware does not lock out the 
external debug interface. 


° Armv8-A does not provide the equivalent control over access to Trace extension registers, which means if 
ARMv8.4-Debug is implemented, the Non-secure and Secure views are identical. 





H8.5.3 Behavior of a not permitted access 


For an external debug interface access by a Debug Access Port, the Debug Access Port receives the error response 
and must signal this to the external debugger. For an ADIVS implementation of a Debug Access Port, the error sets 
a sticky error flag in the Debug Access Port that the debugger can poll, and that suppresses further accesses until it 
is explicitly cleared. 


When an error is returned because external access is disabled, and this is the highest priority error condition, a sticky 
error flag in EDPRSR is indirectly written to 1 as a side-effect of the access: 


° For a debug register access when Al lowExternalDebugAccess() == FALSE, EDPRSR.SDAD is indirectly 
written to 1. 


: For Performance Monitor register access when Al]owExternalPMUAccesss() == FALSE, EDPRSR.SPMAD is 
indirectly written to 1. 


The indirect write might not occur for a memory-mapped access to the external debug interface. For more 
information, see Register access permissions for memory-mapped accesses on page H8-6832. 


If no error is returned, or the error is returned because of a higher priority error condition, the flag in EDPRSR is 
unchanged. 


See also Behavior of a not permitted memory-mapped access on page H8-6833. 


For more information, see Arm® Debug Interface Architecture Specification. 
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H8.5.4 External debug interface register access permissions summary 


For accesses to: 
. IMPLEMENTATION DEFINED registers, see IMPLEMENTATION DEFINED registers. 


$ OPTIONAL registers for CoreSight compliance, see Management registers and CoreSight compliance on 
page K2-7655. 
. Reserved, unallocated, or unimplemented registers, writes to read-only registers, and reads of write-only 


registers, see Reserved and unallocated registers. 


For all other external debug interface, CTI, and Performance Monitor registers, Table H8-3 on 
page H8-6842,Table H8-4 on page H8-6843, Table H8-5 on page H8-6845 and Table I3-1 on page 13-7028, show 
the response of the PE to accesses by the external debug interface. 


H8.5.5 IMPLEMENTATION DEFINED registers 


For debug registers, Performance Monitors registers, CTI registers, register access permissions for 
IMPLEMENTATION DEFINED registers are IMPLEMENTATION DEFINED. 


If ARMv8.3-DoPD is not implemented, the power domain of these registers is in which these registers are 
implemented is also IMPLEMENTATION DEFINED. 


If ARMv8.3-DoPD is implemented, then: 


a For debug registers and Performance Monitors registers, IMPLEMENTATION DEFINED registers are 
implemented in the Core power domain. Accesses return an error when the Core power domain is off or in a 
low-power state. 


$ For CTI registers, IMPLEMENTATION DEFINED registers are implemented in the Debug power domain. 


If OPTIONAL memory-mapped access to the external debug interface is supported, there are additional constraints 
on memory-mapped accesses to registers. These constraints must also apply to IMPLEMENTATION DEFINED registers. 
In particular, if the OPTIONAL Software Lock is locked, writes are ignored and accesses have no side-effects. For 
more information see Register access permissions for memory-mapped accesses on page H8-6832. 


H8.5.6 Reserved and unallocated registers 


ARM DDI 0487E.a 
ID070919 


The default access requirements for reserved and unallocated registers are described in Access requirements for 
reserved and unallocated registers on page 11-7012. 





Note 


Reads of WO and writes to RO refers to the default access permissions for a register. For example, when the SLK 
field is set, meaning that the relevant registers become RO, a memory-mapped write to a RW register is ignored, 
and not treated as a reserved access. 





The following reserved registers are RESO in all conditions, other than when debug power is off: 
. All reserved CTI registers. 


z For the debug registers, and Performance Monitors registers, if the implementation is CoreSight architecture 
compliant, and either ARMv8.3-DoPD is not implemented or the Core power domain is on, all reserved 
registers in the range 0xF00 - OxFFC. See Management register access permissions on page K2-7656. 


Otherwise, the architecture defines that: 
1. If debug power is off, all register accesses, including reserved accesses, return an error. 


2. For reserved debug registers and Performance Monitors registers, if ARMv8.3-DoPD is implemented, and 
the Core power domain is off or in a low-power state, the response is an error. Otherwise the response is a 
CONSTRAINED UNPREDICTABLE choice of error or RESO, when any of the following hold: 


Off The Core power domain is either completely off or in a low-power state in which the Core power 
domain registers cannot be accessed. 
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DLK ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE. The OS Double Lock 
is locked. 


OSLK OSLSR.OSLK == 1. The OS Lock is locked. 

In addition, for reserved debug registers in the address ranges 0x400 - 0x4FC and 0x800 - @x8FC, the response 
is a CONSTRAINED UNPREDICTABLE choice of error or RESO when conditions 1 or 2 do not apply and: 
EDAD AllowExternalDebugAccess() == FALSE. External debug is disabled. 





Note 
See also Behavior of a not permitted access on page H8-6836. 





In addition, for reserved Performance Monitors registers in the address ranges 0x000 - QxEFC, the response 
is a CONSTRAINED UNPREDICTABLE choice of error or RESO when conditions 1 or 2 do not apply and: 


EPMAD Al lowExternalPMUAccess() == FALSE. External Performance Monitor access is disabled. 


Note 
See also Behavior of a not permitted access on page H8-6836. 








For reads of WO locations, the response is a CONSTRAINED UNPREDICTABLE choice of error or RESO when the 
architecture permits or requires a write to the location to return an error. 


For writes of RO locations, the response is a CONSTRAINED UNPREDICTABLE choice of error or RESO when the 
architecture permits or requires a read to the location to return an error. 


For reads and writes of locations for features that are not implemented, the response is a CONSTRAINED 
UNPREDICTABLE choice of error or RESO when the architecture permits or requires an access to the location 
to return an error if the feature is implemented. 
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H8.6 External debug interface registers 

The external debug interface register map is described by: 

. Performance Monitors external register views on page 15-7036. 

7 Cross-trigger interface registers on page H8-6845. 

è External debug interface register map. 

Table H8-2 External debug interface register map 
Offset Mnemonic Register, or additional information 
0x020 EDESR EDESR, External Debug Event Status Register on page H9-6906 
0x024 EDECR EDECR, External Debug Execution Control Register on page H9-6904 
0x030 EDWAR[31:0] EDWAR, External Debug Watchpoint Address Register on page H9-6954 
0x034 EDWAR[63:32] 
0x080 DBGDTRRX_ELO Chapter H4 The Debug Communication Channel and Instruction Transfer Register 
0x084 EDITR EDITR, External Debug Instruction Transfer Register on page H9-6910 
0x088 EDSCR EDSCR, External Debug Status and Control Register on page H9-6945 
0x08C DBGDTRTX_ELO Chapter H4 The Debug Communication Channel and Instruction Transfer Register 
0x090 EDRCR EDRCR, External Debug Reserve Control Register on page H9-6943 
0x094 EDACR EDACR, External Debug Auxiliary Control Register on page H9-6880 
0x098 EDECCR EDECCR, External Debug Exception Catch Control Register on page H9-6899 
Ox0Ad EDPCSRIlo# EDPCSR, External Debug Program Counter Sample Register on page H9-6916 
Ox0A4 EDCIDSR EDCIDSR, External Debug Context ID Sample Register on page H9-6885 
Ox0A8 EDVIDSR EDVIDSR, External Debug Virtual Context Sample Register on page H9-6950 
Ox@AC EDPCSRhi EDPCSR, External Debug Program Counter Sample Register on page H9-6916 
0x0300 OSLAR EL1 OSLAR_EL1, OS Lock Access Register on page H9-6958 
0x0310 EDPRCR EDPRCR, External Debug Power/Reset Control Register on page H9-6930 
0x0314 EDPRSR EDPRSR, External Debug Processor Status Register on page H9-6935 
0x0400+16xn  DBGBVR<n>_ EL1[31:0]Ľe DBGBVR<n>_EL1, Debug Breakpoint Value Registers, n = 0 - 15 on page H9-6860 
0x0404+16xn DBGBVR<n>_EL1[63:32]Þ° 
0x0408+16xn DBGBCR<n>_EL1 DBGBCR<n>_EL1, Debug Breakpoint Control Registers, n = 0 - 15 on 
page H9-6856 

0x800+16 DBGWVR<n>_EL1[31:0]’¢ DBGWVR<n>_EL1, Debug Watchpoint Value Registers, n = 0 - 15 on 
Ox804+16xn DBGWVR<n>_EL1[63:32JÞe Page H9-6876 
0x808+16xn DBGWCR<n>_EL1¢ DBGWCR<n>_EL1, Debug Watchpoint Control Registers, n = 0 - 15 on 


page H9-6873 





@xC00-OxCFC 


IMPLEMENTATION DEFINED 





QxD00 


MIDR EL1 


Main ID register 





0xD04-0xD1C 
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Table H8-2 External debug interface register map (continued) 





























Offset Mnemonic Register, or additional information 
0xD20 EDPFR[31:0] External Debug Processor Feature Register 0 
0xD24 EDPFR[63:32] 
0xD28 EDDFR[31:0] External Debug Feature Register 0 
0xD2C EDDFR[63:32] 
0xD30 Reserved, see next column Previously defined as Instruction Set Attribute Register 0 bits[31:0]. Behavior is: 
Bits[31:20] RESO. 
Bits[19:4] UNKNOWN. 
Bits[3:0] RESO. 
0xD34 RESO Previously defined as Instruction Set Attribute Register 0 bits[63:32] 
0xD38 UNKNOWN Previously defined as Memory Model Feature Register 0 
0xD3C RESO 
QxD40-@xDFC RESO Reserved, RESO 












































OxD60 EDAA32PFRJ[3 1:0] External Debug AArch32 Processor Feature Register 

0xD64 EDAA32PFR[63:32] External Debug AArch32 Processor Feature Register 

0xE80-EFC IMPLEMENTATION DEFINED = 

OxF00-E8C Management registers Management registers and CoreSight compliance on page K2-7655 

OxFAQ DBGCLAIMSET EL1 DBGCLAIMSET _EL1, Debug Claim Tag Set register on page H9-6867 
OxFA4 DBGCLAIMCLR_ EL1 DBGCLAIMCLR_EL1, Debug Claim Tag Clear register on page H9-6865 
OxFA8 EDDEVAFFO EDDEVAFFO, External Debug Device Affinity register 0 on page H9-6887 
OxFAC EDDEVAFF 1 EDDEVAFF1, External Debug Device Affinity register 1 on page H9-6888 
OxFBQ-FB4 Management registers Management registers and CoreSight compliance on page K2-7655 
OxFB8 DBGAUTHSTATUS_EL1 DBGAUTHSTATUS_EL1, Debug Authentication Status register on page H9-6854 
OxFCO EDDEVID2 EDDEVID, External Debug Device ID register 0 on page H9-6891 

OxFC4 EDDEVID1 EDDEVIDI1, External Debug Device ID register 1 on page H9-6893 

OxFC8 EDDEVID EDDEVID2, External Debug Device ID register 2 on page H9-6894 
OxFDO-FFC Management registers Management registers and CoreSight compliance on page K2-7655 





a. Supported only if the OPTIONAL PC Sample-Based Profiling is implemented but ARMv8.2-PCSample is not implemented. See Chapter H7 


The PC Sample-based Profiling Extension. 


Implemented only if the OPTIONAL PC Sample-based Profiling Extension is implemented. 


b. A 64-bit register mapped to a pair of 32-bit locations. Doubleword accesses to this register are not guaranteed to be 64-bit single copy atomic. 
See Endianness and supported access sizes on page H8-6827. Software must ensure a breakpoint or watchpoint is disabled before altering 
the value register. 


c. Implemented breakpoints and watchpoints only. n is the breakpoint or the watchpoint number. 


H8-6840 


Note 





All other locations are reserved. 
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Table H8-3 on page H8-6842 and Table H8-4 on page H8-6843 show the access permissions for the external debug 
interface registers in an Armv8-A Debug implementation. The terms are defined as follows: 


Domain 


Conditions 


This describes the power domain in which the register is logically implemented. Registers described 
as implemented in the Core power domain might be implemented in the Debug power domain, as 
long as they exhibit the required behavior. If ARMv8.3-DoPD is implemented, all External debug 
interface registers are in the Core power domain. 


This lists the conditions under which the access is attempted. 


To determine the access permissions for a register, read these columns from left to right, and stop at 
first column which lists the condition as being true. 


The conditions are: 


Off The Core power domain is completely off, or in low-power state. In these cases the Core 
power domain registers cannot be accessed, and if ARMv8.3-DoPD is not implemented, 
EDPRSR.PU will read as 0. 


Note 


If debug power is off, then all external debug interface accesses return an error. 








DLK ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE. The OS 
Double Lock is locked. If ARMv8.3-DoPD is implemented, ARMv8.0-DoubleLock is 
not implemented and so Table H8-3 on page H8-6842 does not include this column. 


OSLK OSLSR.OSLK == 1. The OS Lock is locked. 


EDAD AllowExternalDebugAccess() == FALSE. External debug access is disabled for the 
access. If ARMv8.4-Debug is implemented, this applies only for Non-secure accesses 
to the register. See also Behavior of a not permitted access on page H8-6836. 


EPMAD = AllowExternalPMUAccess() == FALSE. Access to the external Performance Monitors is 
disabled for the access. If ARMv8.4-Debug is implemented, this applies only for 
Non-secure accesses to the register. See also Behavior of a not permitted access on 
page H8-6836. 


SLK The Software Lock is implemented and SoftwareLockStatus() == TRUE. This provides 
the modified default access permissions for OPTIONAL memory-mapped accesses to the 
external debug interface if the OPTIONAL Software Lock is locked. See Register access 
permissions for memory-mapped accesses on page H8-6832. For all other accesses, this 
column is ignored. 


Default This provides the default access permissions, if there are no conditions that prevent 
access to the register. 


The access permissions are: 


RO 


RW 


RC 


wo 


WI 


This means that the default access permission applies. See the Default column, or the SLK column, 
if applicable. 


This means that the register or field is read-only, and: 
: Unless the register description states otherwise, a RO field in an RW register ignores writes. 
° Where the SLK control makes a RW register RO, the register ignores writes. 


This means that the register or field is read/write. Individual fields within the register might be RO 
or WO. See the relevant register description for details. 


This means that a read of the register bit clears the field to 0. 


This means that the register or field is write-only. Unless the register description states otherwise, a 
WO field in a RW register returns an UNKNOWN value on a read of the register. 


This means that the register or field ignores writes. 
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IMP DEF 


This means that the access permissions are IMPLEMENTATION DEFINED. 


For the reset values for the external debug interface registers, see Table H8-7 on page H8-6848. 


If OPTIONAL memory-mapped access to the external debug interface is supported, there might be additional 
constraints on memory-mapped accesses. See Register access permissions for memory-mapped accesses on 
page H8-6832. 


Table H8-3 Access permissions for the external debug interface registers if ARMv8.3-DoPD is implemented 





Conditions (priority from left to right) 










































































Domain 

Offset Register Off DLK OSLK EDAD Default SLK 
0x020 EDESR Core Error - - - RW RO 
0x024 EDECR Core Error - - - RW RO 
0x030 EDWAR[31:0] Core Error - Error - RO - 
0x034 EDWAR[63:32] 
0x080 DBGDTRRX_ELO Core Error - Error - RW RO 
0x084 EDITR Core Error - Error - WO WI 
0x088 EDSCR Core Error - Error - RW RO 
0x08C DBGDTRTX_ELO Core Error - Error - RW RO 
0x090 EDRCR Core Error - Error - WO WI 
0x094 EDACR Core Error - IMP DEF - RW RO 
0x098 EDECCR Core Error - Error - RW RO 
Ox0A0 EDPCSR[31:0] Core Error = Error S RO RO 
0x0A4 EDCIDSR2 Core Error - Error - RO RO 
Ox0A8 EDVIDSR&4 Core Error - Error - RO RO 
@x@AC EDPCSR[63:32] Core Error = Error - RO RO 
0x0300 OSLAR_EL1 Core Error - - Error WO WI 
0x0310 EDPRCR Core Error - Error - RW RO 
0x0314 EDPRSR Core Error - Error - RO RO 
0x0400+16xn DBGBVR<n>_EL1[31:0]° Core Error - Error Error RW RO 
0x0404+16xn DBGBVR<n>_EL1[63:32]> Core Error Error Error RW RO 
@x0408+16xn =DBGBCR<n>_EL1> Core Error = Error Error RW RO 
0x800+16xn DBGWVR<n>_EL1[31 :0]> Core Error - Error Error RW RO 
0x804+16xn DBGWVR<n>_EL1[63:32] Core Error Error Error RW RO 

b 
@x808+16xn =DBGWCR<n>_EL1> Core Error - Error Error RW RO 
QxD00 MIDR EL1 Core Error - - - RO RO 
0xD20 EDPFR[31:0] Core Error - - - RO RO 
0xD24 EDPFR[63:32] Core Error - - - RO RO 
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Table H8-3 Access permissions for the external debug interface registers if ARMv8.3-DoPD is implemented 





Conditions (priority from left to right) 






































Domain 
Offset Register Off DLK OSLK EDAD Default SLK 
0xD28 EDDFR[31:0] Core Error - - - RO RO 
0xD2C EDDFR[63:32] Core Error - - - RO RO 
OxD60 EDAA32PFRJ[31:0] Core Error - - - RO RO 
0xD64 EDAA32PFR[63:32] Core Error - - - RO RO 
OxFAQ DBGCLAIMSET_EL1 Core Error - Error - RW RO 
OxFA4 DBGCLAIMCLR_ EL1 Core Error - Error - RW RO 
OxFA8 EDDEVAFFO Core Error - - - RO RO 
OxFAC EDDEVAFF 1 Core Error - - - RO RO 
OxFB8 DBGAUTHSTATUS EL1 Core Error - - - RO RO 
OxFCO EDDEVID2 Core Error - - - RO RO 
OxFC4 EDDEVID1 Core Error - - - RO RO 
OxFC8 EDDEVID Core Error - - - RO RO 





a. Implemented only if the PC Sample-based profiling Extension is implemented and ARMv8.2-PCSample is not implemented. 


b. Implemented breakpoints and watchpoints only. n is the breakpoint or watchpoint number. 


Table H8-4 Access permissions for the external debug interface registers if ARMv8.3-DoPD is not implemented 


Conditions (priority from left to right) 









































Offset Register Domain Off DLK OSLK EDAD Default SLK 
0x020 EDESR Core Error Error - - RW RO 
0x024 EDECR Debug - - - - RW RO 
0x030 EDWAR[31:0] Core Error Error Error - RO - 
0x034 EDWAR[63:32] 

0x080 DBGDTRRX_ELO Core Error Error Error - RW RO 
0x084 EDITR Core Error Error Error - WO WI 
0x088 EDSCR Core Error Error Error - RW RO 
0x08C DBGDTRTX_ELO Core Error Error Error - RW RO 
0x090 EDRCR Core Error Error Error - WO WI 
0x094 EDACR IMP DEF IMP DEF IMP DEF IMP DEF - RW RO 
0x098 EDECCR Core Error Error Error - RW RO 
0x0A0 EDPCSR[31:0]? Core Error Error Error 7 RO RO 
0x0A4 EDCIDSRa Core Error Error Error - RO RO 
0x0A8 EDVIDSRa Core Error Error Error - RO RO 
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Table H8-4 Access permissions for the external debug interface registers if ARMv8.3-DoPD is not implemented 





Conditions (priority from left to right) 







































































Offset Register Domain Off DLK OSLK EDAD Default SLK 
Ox@AC EDPCSR[63:32] Core Error Error Error - RO RO 
0x0300 OSLAR_EL1 Core Error Error - IMP DEF? WO WI 
0x0310 EDPRCR Core and Debug ° Error Error Error - RW RO 
0x0314 EDPRSR Core and Debug® Error Error Error - RO RO 
@x0400+16xn DBGBVR<n>_EL1[31:0]4 Core Error Error Error Error RW RO 
0x0404+16xn DBGBVR<n>_EL1[63:32]4 Core Error Error Error Error RW RO 
0x0408+16xn © DBGBCR<n>_EL14 Core Error Error Error Error RW RO 
0x800+16xn = DBGWVR<n>_EL1[31:0]4 Core Error Error Error Error RW RO 
0x804+16xn DBGWVR<n>_EL1[63:32]4 Core Error Error Error Error RW RO 
0x808+16xn DBGWCR<n>_EL1 d Core Error Error Error Error RW RO 
QxD00 MIDR ELI IMP DEF IMP DEF? IMP DEF? - - RO RO 
QxD20 EDPFR[31:0] IMP DEF IMP DEF© IMP DEF? - - RO RO 
0xD24 EDPFR[63:32] IMP DEF IMP DEF© IMP DEFE - - RO RO 
@xD28 EDDFRJ31:0] IMP DEF IMP DEF° IMP DEF° - - RO RO 
@xD2C EDDFR[63:32] IMP DEF IMP DEF© IMP DEFE? - - RO RO 
OxD60 EDAA32PFR[31:0] IMP DEF IMP DEF© IMP DEFE? - - RO RO 
QxD64 EDAA32PFR[63:32] IMP DEF IMP DEF© IMP DEF? - - RO RO 
OxFAQ DBGCLAIMSET EL1 Core Error Error Error - RW RO 
OxFA4 DBGCLAIMCLR_ EL1 Core Error Error Error - RW RO 
OxFA8 EDDEVAFFO Debug Error - - - RO RO 
OxFAC EDDEVAFF 1 Debug Error - - - RO RO 
OxFB8 DBGAUTHSTATUS EL1 Debug Error - - - RO RO 
OxFCO EDDEVID2 Debug Error - - - RO RO 
OxFC4 EDDEVID1 Debug Error - - - RO RO 
OxFC8 EDDEVID Debug Error - - - RO RO 





a. Implemented only if the PC Sample-based profiling Extension is implemented. 


b. If ARMv8.2-Debug is not implemented, it is IMPLEMENTATION DEFINED whether an error is returned. See External access disabled on 


page H8-6835. If no error is returned, the access is permitted. 


c. Some bits are in the Debug power domain and some bits are in the Core power domain. See register field descriptions for information. 


d. Implemented breakpoints and watchpoints only. n is the breakpoint or watchpoint number. 


e. It is IMPLEMENTATION DEFINED whether an error is returned. See External debug over powerdown and locks on page H8-6835. If no error is 
returned, the access is permitted. 
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H8.7 Cross-trigger interface registers 
The embedded Cross-trigger Interface, CTI, is located within its own block of the external debug memory map. 
There must be one such block for each PE. 
If the CTI of a PE does not implement the CTIDEVAFF0 or CTIDEVAFF1 registers it must be located 64KB above 
the debug registers in the external debug interface. 
When ARMv8.4-Debug is implemented, each debug component has a Secure and Non-secure view. The Secure 
view of a debug component is mapped into Secure physical memory and the Non-secure view of a debug component 
is mapped into Non-secure memory. Apart from access conditions, the Non-secure and Secure views of the debug 
components are identical. 
Table H8-5 shows the CTI register map. 
Table H8-5 Cross-trigger interface map 

Offset Mnemonic Location of further details 

0x000 CTICONTROL CTICONTROL, CTI Control register on page H9-6974 

0x010 CTUNTACK CTIINTACK, CTI Output Trigger Acknowledge register on page H9-6988 

0x014 CTIAPPSET CTIAPPSET, CTI Application Trigger Set register on page H9-6964 

0x018 CTIAPPCLEAR CTIAPPCLEAR, CTI Application Trigger Clear register on page H9-6962 

0x01C CTIAPPPULSE CTIAPPPULSE, CTI Application Pulse register on page H9-6963 

0x020+4xn CTIINEN<pn>a CTIINEN<n>, CTI Input Trigger to Output Channel Enable registers, n = 0 - 31 on 

page H9-6987 
0x0A0+4xn CTIOUTEN<n>? CTIOUTENK<n>, CTI Input Channel to Output Trigger Enable registers, n = 0 - 31 on 
page H9-6996 

0x130 CTITRIGINSTATUS CTITRIGINSTATUS, CTI Trigger In Status register on page H9-7002 

0x134 CTITRIGOUTSTATUS CTITRIGOUTSTATUS, CTI Trigger Out Status register on page H9-7003 

0x138 CTICHINSTATUS CTICHINSTATUS, CTI Channel In Status register on page H9-6966 

0x13C CTICHOUTSTATUS CTICHOUTSTATUS, CTI Channel Out Status register on page H9-6967 

0x140 CTIGATE CTIGATE, CTI Channel Gate Enable register on page H9-6986 

0x144 ASICCTL ASICCTL, CTI External Multiplexer Control register on page H9-6961 

0xE80 - IMPLEMENTATION IMPLEMENTATION DEFINED. See Management registers and CoreSight compliance on 

OxEFC DEFINED page K2-7655 

OxF00 - Management registers Management registers and CoreSight compliance on page K2-7655 

OxFBC 

OxFCO CTIDEVID2 CTIDEVID2, CTI Device ID register 2 on page H9-6984 

OxFC4 CTIDEVID1 CTIDEVID1, CTI Device ID register 1 on page H9-6983 

OxFC8 CTIDEVID CTIDEVID, CTI Device ID register 0 on page H9-698 1 

OxFD@ - Management registers Management registers and CoreSight compliance on page K2-7655 

QxFFC 





a. Implemented triggers, including triggers that are not connected, only. n is the trigger number. 
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Table H8-6 shows the access permissions for the CTI registers in an Armv8-A Debug implementation. For a 


definition of the terms used, see External debug interface registers on page H8-6839. 


Table H8-6 Access permissions for the CTI registers 





Conditions (priority from left to right) 


















































Offset Register Domain Off DLK OSLK Default SLK 
0x000 CTICONTROL Debug - - - RW RO 
0x010 CTIINTACK Debug - - - WO WI 
0x014 CTIAPPSET Debug - - - RW RO 
0x018 CTIAPPCLEAR Debug - - - WO WI 
@x@1C CTIAPPPULSE Debug - - - WO WI 
0x020+4xn CTIINEN<pn>a Debug - - - RW RO 
0x0A0+4xNn CTIOUTEN<n> Debug - - - RW RO 
0x130 CTITRIGINSTATUS Debug - - - RO RO 
0x134 CTITRIGOUTSTATUS Debug - - - RO RO 
0x138 CTICHINSTATUS Debug - - - RO RO 
0x13C CTICHOUTSTATUS Debug - - - RO RO 
0x140 CTIGATE Debug - - - RW RO 
OxFCO CTIDEVID2 Debug - - - RO RO 
OxFC4 CTIDEVID1 Debug - - - RO RO 
OxFC8 CTIDEVID Debug - - - RO RO 





a. Implemented triggers only (including triggers that are not connected). n is the trigger number. 


H8-6846 


For the reset values of the CTI registers, see Table H8-8 on page H8-6849. 
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H8.8 External debug register resets 
Each register or field has a defined reset domain: 


. Registers and fields in the Warm reset domain are also reset by a Cold reset and unchanged by an External 
Debug reset that is not coincident with a Cold reset or a Warm reset. 


è Registers and fields in the Cold reset domain are unchanged by a Warm reset or an External Debug reset that 
is not coincident with a Cold reset. 


è Registers and fields in the External Debug reset domain are unchanged by a Cold reset or a Warm reset that 
is not coincident with an External Debug reset. 


A reset might change the value of a register. Specific rules apply to the observability of registers in the External 
Debug reset domain by indirect reads from the Core power domain when an External Debug reset is asserted without 
a coincident Cold reset. For more information, see Synchronization of changes to the external debug registers on 
page H8-6828. 


Table H8-7 on page H8-6848 and Table H8-8 on page H8-6849 show the external debug register and CTI register 
resets. For other debug registers and Performance Monitors registers, see Management register resets on 
page K2-7660 and Power domains and Performance Monitors registers reset on page 13-7029. 





Note 


By reference to Figure H6-1 on page H6-6819 the power domain can be deduced from the reset domain. Table K2-7 
on page K2-7660 also shows reset power domains. 





Table H8-7 on page H8-6848 and Table H8-8 on page H8-6849 do not include: 


° Read-only identification registers, such as Processor ID Registers and PMCFGR, that have a fixed value from 
reset. 
° Read-only status registers, such as EDSCR.RW, that are evaluated each time the register is read and that have 


no meaningful reset value. 
à Write-only registers, such as EDRCR, that only have an effect on writes, and have no meaningful reset value. 


° Read/write registers, such as breakpoint and watchpoint registers, and EDPRCR.CORENPDRQ, that alias 
other registers. The reset values are described by the descriptions of those other registers. 


° IMPLEMENTATION DEFINED registers. The reset values and reset domains of these registers are also 
IMPLEMENTATION DEFINED and might be UNKNOWN. 


All other fields in the registers are set to an IMPLEMENTATION DEFINED value, that can be UNKNOWN. The register 
is in the specified reset domain. 


Note 


An IMPLEMENTATION DEFINED reset value, which can be UNKNOWN, means that hardware is not required to reset 
the register on the specified reset, but software must not rely on the register being preserved over reset. 
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Table H8-7 Summary of external debug register resets, debug registers 



















































































Register Reset domain Field Value Description 
DBGPRCR_EL1 Cold into CORENPRDRQ_ The value of Debug Power Control Register. 
AArch64 state the powerup 
request ê 
DBGPRCR Cold into CORENPRDRQ Thevalueof Debug Power Control Register. 
AArch32 state the powerup 
request ê 
EDESR Warm SS EDECR.SS Halting Step debug event pending 
RC EDECR.RCE Reset Catch debug event pending 
OSUC 0 OS Unlock Catch debug event pending 
EDESR if Cold SS 0 Halting Step debug event pending 
ARMv8.3-DoPD 
is implemented Warm RC CTIDEVCTL Reset Catch debug event pending 
.RCE 
EDECR if Cold SS 0 Halting Step debug event enable 
ARMv8.3-DoPD 
is implemented 
EDECR if External debug SS 0 Halting Step debug event enable 
ARMv8.3-DoPD 
istot RCE 0 Reset Catch debug event enable 
implemented OSUCE 0 OS Unlock Catch debug event enable 
8 
EDWAR Cold - - All fields 
EDSCR Cold RXfull 0 DTRRX register full 
TXfull 0 DTRTX register full 
RXO 0 DTRRX overrun 
TXU 0 DTRTX underrun 
INTdis 0 Interrupt disable 
TDA 0 Trap debug register accesses to Debug state 
MA 0 Memory access mode in Debug state 
HDE 0 Halting debug mode enable 
ERR 0 Cumulative error flag 
EDECCR Cold NSE[2:1] 0b00 Coarse-grained Non-secure Exception Catch 
SE[3,1] Qb00 Coarse-grained Secure Exception Catch 
EDPCSR Cold - - All fields 
EDCIDSR Cold - - All fields 
EDVIDSR Cold - - All fields 
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Table H8-7 Summary of external debug register resets, debug registers (continued) 





Register Reset domain Field Value Description 
EDPRCR if Cold - - - 
ARMv8.3-DoPD 


is implemented 




















EDPRCR if External debug COREPURQ> - Core powerup request 

ARMv8.3-DoPD 

is not 

implemented 

EDPRSR Warm SDR - Sticky debug restart 
Cold SPMAD 0 Sticky EPMAD error 

SDAD 0 Sticky EDAD error 

Warm SR 1 Sticky reset status 
Cold SPD 1 Sticky powerdown status 





a. If ARMv8.3-DoPD is not implemented, the powerup request is the EDPRCR.COREPURQ control bit. 


b. IfARMv8.3-DoPD is not implemented, on a Cold reset into AArch64 state, DBGPRCR_EL1.CORENPRDRQ resets to the value 
of EDPRCR.COREPURQ. On a Cold reset into AArch32 state, DBGPRCR.CORENPRDRQ resets to the value of 
EDPRCR.COREPURQ. If an External Debug reset and a Cold reset coincide, both EDPRCR.COREPURQ and the 
CORENPRDRQ field of the appropriate System register are reset to 0. 


Table H8-8 shows the reset values for the CTI registers 


Table H8-8 Summary of external debug register resets, CTI registers 





























Register Reset domain Field Value Description 

CTICONTROL External debug GLBEN 0 CTI global enable 

CTIDEVCTL External debug RCE 0 If ARMv8.3-DoPD is implemented, 
Reset Catch debug event enable 

OSUCE 0 If ARMv8.3-DoPD is implemented, 

OS Unlock Catch debug event enable 

CTIAPPSET External debug - - All fields 

CTIINEN<n> External debug - - All fields 

CTIOUTEN<n> External debug - - All fields 

CTIGATE External debug - - All fields 

ASICCTL IMPLEMENTATION DEFINED - IMPLEMENTATION DEFINED All of register 
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Chapter H9 
External Debug Register Descriptions 


This chapter provides a description of the external debug registers. 


It contains the following sections: 

. About the debug registers on page H9-6852. 

è External debug registers on page H9-6853. 

° Cross-Trigger Interface registers on page H9-6960. 
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H9.1 About the debug registers 


The following sections describe the registers that are accessible through the external debug interface: 
. External debug registers on page H9-6853. 
e Cross-Trigger Interface registers on page H9-6960. 
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H9.2 External debug registers 


This section describes the debug registers that are accessible through the external debug interface and are used for 
external debug. 


This section lists the registers that are accessible through the external debug interface. 
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H9.2.1 


H9-6854 


DBGAUTHSTATUS_EL1, Debug Authentication Status register 


The DBGAUTHSTATUS_ELI characteristics are: 


Purpose 
Provides information about the state of the IMPLEMENTATION DEFINED authentication interface for 
debug. 


Configurations 


External register DBGAUTHSTATUS_EL1[31:0] is architecturally mapped to AArch64 System 
register DBGAUTHSTATUS _EL1[31:0]. 


External register DBGAUTHSTATUS_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGAUTHSTATUS[31:0]. 


It is IMPLEMENTATION DEFINED whether DBGAUTHSTATUS_ EL] is implemented in the Core 
power domain or in the Debug power domain. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


Attributes 
DBGAUTHSTATUS EL! is a 32-bit register. 


Field descriptions 


The DBGAUTHSTATUS_ELI bit assignments are: 


31 876543210 


RESO SNID js] NSID 


ee ee NSNID 


Bits [31:8] 
Reserved, RESO. 


SNID, bits [7:6] 
When ARMV8.4-Debug is implemented: 
Secure non-invasive debug. 
ExternalSecureNoninvasiveDebugEnabled() == ExternalSecureInvasiveDebugEnabled(). 
This field has the same value as DBGAUTHSTATUS _EL1.SID. 
Otherwise: 


Secure non-invasive debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 1. 
0b10 Implemented and disabled. ExternalSecureNoninvasiveDebugEnabled() == FALSE. 
0b11 Implemented and enabled. ExternalSecureNoninvasiveDebugEnabled() == TRUE. 


All other values are reserved. 


SID, bits [5:4] 


Secure invasive debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 1. 

0b10 Implemented and disabled. ExternalSecureInvasiveDebugEnabled() == FALSE. 

0b11 Implemented and enabled. ExternalSecureInvasiveDebugEnabled() == TRUE. 
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All other values are reserved. 


NSNID, bits [3:2] 
When ARMVv%8.4-Debug is implemented: 


Non-secure non-invasive debug. 
0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 0. 
0b11 Implemented and enabled. ExternalNoninvasiveDebugEnabled() == TRUE. 


If the Effective value of SCR_EL3.NS is 1, or if EL3 is implemented and EL2 is not implemented, 
this field reads as 0b11. 


All other values are reserved. 


Otherwise: 


Non-secure non-invasive debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 0. 
0b10 Implemented and disabled. ExternalNoninvasiveDebugEnabled() == FALSE. 
0b11 Implemented and enabled. ExternalNoninvasiveDebugEnabled() == TRUE. 


All other values are reserved. 


NSID, bits [1:0] 


Non-secure invasive debug. 


0b00 Not implemented. EL3 is not implemented and the Effective value of SCR_EL3.NS is 0. 
0b10 Implemented and disabled. ExternallnvasiveDebugEnabled() == FALSE. 
Qb11 Implemented and enabled. ExternalInvasiveDebugEnabled() == TRUE. 


All other values are reserved. 


Accessing the DBGAUTHSTATUS_EL1: 


DBGAUTHSTATUS EL! can be accessed through the external debug interface: 





Component Offset Instance 


Debug OxFB8 DBGAUTHSTATUS EL1 





This interface is accessible as follows: 


When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 


Otherwise accesses to this register generate an error response. 
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H9.2.2 


H9-6856 


DBGBCR<n>_EL1, Debug Breakpoint Control Registers, n = 0 - 15 


The DBGBCR<n>_EL1 characteristics are: 


Purpose 
Holds control information for a breakpoint. Forms breakpoint n together with value register 
DBGBVR<n>_EL1. 

Configurations 


External register DBGBCR<n>_EL1[31:0] is architecturally mapped to AArch64 System register 
DBGBCR<n>_EL1[31:0]. 


External register DBGBCR<n>_EL1[31:0] is architecturally mapped to AArch32 System register 
DBGBCR<n>[31:0]. 


DBGBCR<n>_EL] is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on a Cold reset. The register is not affected by a Warm reset 
and is not affected by an External debug reset. 


If breakpoint n is not implemented then accesses to this register are: 


. RESO when IsCorePowered() && !DoubleLockStatus() && !OSLockStatus() && 
AllowExternalDebugAccess(). 


. A CONSTRAINED UNPREDICTABLE choice of RESO or ERROR otherwise. 


Attributes 
DBGBCR<n>_EL] is a 32-bit register. 


Field descriptions 


The DBGBCR<n>_EL] bit assignments are: 


31 24 23 20 19 16 15 14 13 12 543 210 


When the E field is zero, all the other fields in the register are ignored. 


Bits [31:24] 


Reserved, RESO. 


BT, bits [23:20] 
Breakpoint Type. Possible values are: 
0b0000 Unlinked instruction address match. DBGBVR<n>_EL] is the address of an 
instruction. 
0b0001 As 0b0000 but linked to a Context matching breakpoint. 


0b0010 Unlinked Context ID match. When ARMv8.1-VHE is implemented, EL2 is using 
AArché64, and the Effective value of HCR_EL2.E2H is 1, if either the PE is executing 
at ELO with HCR_EL2.TGE set to 1 or the PE is executing at EL2, then 
DBGBVR<n>_EL1.ContextID must match the CONTEXTIDR_EL2 value. Otherwise, 
DBGBVR<n>_EL1.ContextID must match the CONTEXTIDR_EL]1 value. 


0b0011 As 0b0010, with linking enabled. 


0b0100 Unlinked instruction address mismatch. DBGBVR<n>_EL1 is the address of an 
instruction to be stepped. 
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0b0101 As 0b0100, with linking enabled. 


0b0110 Unlinked CONTEXTIDR_EL1 match. DBGBVR<n>_EL1.ContextID is a Context ID 
compared against CONTEXTIDR ELI. 


0b0111 As 0b0110, with linking enabled. 


0b1000 Unlinked VMID match. DBGBVR<n>_EL1.VMID is a VMID compared against 
VTTBR_EL2.VMID. 


0b1001 As 0b1000, with linking enabled. 


0b1010 Unlinked VMID and Context ID match. DBGBVR<n>_EL1.ContextID is a Context ID 
compared against CONTEXTIDR_EL1, and DBGBVR<n>_EL1.VMID is a VMID 
compared against VITTBR_EL2.VMID. 


0b1011 As 0b1010, with linking enabled. 


0b1100 Unlinked CONTEXTIDR_EL2 match. DBGBVR<n>_EL1.ContextID2 is a Context ID 
compared against CONTEXTIDR_EL2. 


0b1101 As 0b1100, with linking enabled. 


0b1110 Unlinked Full Context ID match. DBGBVR<n>_EL1.ContextID is compared against 
CONTEXTIDR_ ELI, and DBGBVR<n>_EL1.ContextID2 is compared against 
CONTEXTIDR EL2. 


Qb1111 As 0b1110, with linking enabled. 
Constraints on breakpoint programming mean some values are reserved under certain conditions. 


For more information on the operation of the SSC, HMC, and PMC fields, and on the effect of 
programming this field to a reserved value, see Execution conditions for which a breakpoint 
generates Breakpoint exceptions on page D2-2422 and Reserved DBGBCR<n>_EL1.BT values on 
page D2-2427. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


LBN, bits [19:16] 


Linked breakpoint number. For Linked address matching breakpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


For all other breakpoint types this field is ignored and reads of the register return an UNKNOWN 
value. 


This field is ignored when the value of DBGBCR<n>_EL1.E is 0. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


SSC, bits [15:14] 


Security state control. Determines the Security states under which a Breakpoint debug event for 
breakpoint n is generated. This field must be interpreted along with the HMC and PMC fields, and 
there are constraints on the permitted values of the {HMC, SSC, PMC} fields. For more 
information, including the effect of programming the fields to a reserved set of values, see Reserved 
DBGBCR<n>_EL1.{SSC, HMC, PMC} values on page D2-2427. 


For more information on the operation of the SSC, HMC, and PMC fields, see Execution conditions 
for which a breakpoint generates Breakpoint exceptions on page D2-2422. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


HMC, bit [13] 


Higher mode control. Determines the debug perspective for deciding when a Breakpoint debug 
event for breakpoint n is generated. This field must be interpreted along with the SSC and PMC 
fields, and there are constraints on the permitted values of the {HMC, SSC, PMC} fields. For more 
information see DBGBCR<n>_EL1.SSC description. 


For more information on the operation of the SSC, HMC, and PMC fields, see Execution conditions 
for which a breakpoint generates Breakpoint exceptions on page D2-2422. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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Bits [12:9] 


BAS, bits [8:5] 


Bits [4:3] 


Reserved, RESO. 


Byte address select. Defines which half-words an address-matching breakpoint matches, regardless 
of the instruction set and Execution state. In an AArch64 only implementation, this field is reserved, 
RESİ. 


The permitted values depend on the breakpoint type. 
For Address match breakpoints in either AArch32 or AArch64 state, the permitted values are: 





BAS Match instructionat Constraint for debuggers 





0b0011 DBGBVR<n>_EL1 Use for T32 instructions 





0b1100 DBGBVR<n> EL1 +2 Use for T32 instructions 





0b1111 DBGBVR<n>_EL1 Use for A64 and A32 instructions 





All other values are reserved. 
For more information, see Using the BAS field in Address Match breakpoints on page G2-5641. 


For Address mismatch breakpoints in an AArch32 stage 1 translation regime, the permitted values 
are: 





BAS Match instruction at Constraint for debuggers 





0b0000 - Use for a match anywhere breakpoint 





0b0011 DBGBVR<n>_EL1 Use for stepping T32 instructions 





0b1100 ~=DBGBVR<n>_EL1+2 Use for stepping T32 instructions 





0b1111 DBGBVR<n>_EL1 Use for stepping A64 and A32 instructions 





For more information, see Using the BAS field in Address Match breakpoints on page G2-5641. 
For Context matching breakpoints, this field is RES1 and ignored. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


PMC, bits [2:1] 


E, bit [0] 


Privilege mode control. Determines the Exception level or levels at which a Breakpoint debug event 
for breakpoint n is generated. This field must be interpreted along with the SSC and HMC fields, 
and there are constraints on the permitted values of the {HMC, SSC, PMC} fields. For more 
information see the DBGBCR<n>_EL1.SSC description. 


For more information on the operation of the SSC, HMC, and PMC fields, see Execution conditions 


for which a breakpoint generates Breakpoint exceptions on page D2-2422. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Enable breakpoint DBGBVR<n>_ELI. Possible values are: 
0bd Breakpoint disabled. 
Qb1 Breakpoint enabled. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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Accessing the DBGBCR<n>_EL1: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalDebugAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 








DBGBCR<n>_EL]1 can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x408+16n DBGBCR<n> ELI 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalDebugAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalDebugAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


. Otherwise accesses to this register generate an error response. 
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H9.2.3 DBGBVR<n>_EL1, Debug Breakpoint Value Registers, n = 0 - 15 
The DBGBVR<n>_EL1 characteristics are: 


Purpose 
Holds a virtual address, or a VMID and/or a context ID, for use in breakpoint matching. Forms 
breakpoint n together with control register DBGBCR<n>_EL1. 

Configurations 


External register DBGBVR<n>_EL1[63:0] is architecturally mapped to AArch64 System register 
DBGBVR<n>_EL1[63:0]. 


External register DBGBVR<n>_EL1[31:0] is architecturally mapped to AArch32 System register 
DBGBVR<n>[3 1:0]. 


If the breakpoint is context-aware and EL2 is implemented then External register 
DBGBVR<n>_EL1[63:32] is architecturally mapped to AArch32 System register 
DBGBXVR<n>[31:0]. Otherwise there is no External register access to DBGBVR<n>_EL1[63:32] 
from AArch3?2 state. 


DBGBVR<n>_EL1 is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on a Cold reset. The register is not affected by a Warm reset 
and is not affected by an External debug reset. 


If breakpoint n is not implemented then accesses to this register are: 


° RESO when IsCorePowered() && !DoubleLockStatus() && !OSLockStatus() && 
AllowExternalDebugAccess(). 


. A CONSTRAINED UNPREDICTABLE choice of RESO or ERROR otherwise. 


Attributes 
How this register is interpreted depends on the value of DBGBCR<n>_EL1.BT. 
° When DBGBCR<n>_EL1.BT is @b0x0x, this register holds a virtual address. 
. When DBGBCR<n>_EL1.BT is 0b001x, 0b011x, or 0b110x, this register holds a Context ID. 
- When DBGBCR<n>_EL1.BT is 0b100x, this register holds a VMID. 
s When DBGBCR<n>_EL1.BT is 0b101x, this register holds a VMID and a Context ID. 
- When DBGBCR<n>_EL1.BT is 0b111x, this register holds two Context ID values. 
For other values of DBGBCR<n>_EL1.BT, this register is RESO. 


Field descriptions 


The DBGBVR<n>_EL]1 bit assignments are: 


When DBGBCR<n>_EL1.BT == 0b0x0x: 


63 53 52 49 48 210 


RESS[14:4] VA[52:49] VA[48:2] 


RESS[14:4], bits [63:53] 


Reserved, Sign extended. Software must treat this field as RESO if the most significant bit of VA is 
0 or RESO, and as RES1 if the most significant bit of VA is 1. 






je ees 


Hardware always ignores the value of these bits and it is IMPLEMENTATION DEFINED whether: 


$ The bits are hardwired to a copy of the most significant bit of VA, meaning writes to these 
bits are ignored, and reads to the bits always return the hardwired value. 
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° The value in those bits can be written, and reads will return the last value written. The value 
held in those bits is ignored by hardware. 
VA[52:49], bits [52:49] 

When ARMv8.2-LVA is implemented: 
Extension to VA[48:2]. See VA[48:2] for more details. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 

Otherwise: 
Extension to RESS[14:4]. See RESS[14:4] for more details. 


VA[48:2], bits [48:2] 
If the address is being matched in an AArch64 stage 1 translation regime: 
s This field contains bits[48:2] of the address for comparison. 


è When ARMv8.2-LVA is implemented, VA[52:49] forms the upper part of the address value. 
Otherwise, VA[52:49] are RESS. 


If the address is being matched in an AArch32 stage 1 translation regime, the first 20 bits of this 
field are RESO, and the rest of the field contains bits[31:2] of the address for comparison. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Bits [1:0] 


Reserved, RESO. 


When DBGBCR<n>_EL1.BT == 0b001x: 


63 32 31 0 


RESO ContextID 


Bits [63:32] 


Reserved, RESO. 


ContextID, bits [31:0] 
Context ID value for comparison. 


The value is compared against CONTEXTIDR_EL2 when ARMv8.1-VHE is implemented, EL2 is 
using AArch64, HCR_EL2.E2H is 1, and either: 


s The PE is executing at EL2. 


- HCR_EL2.TGE is 1, the PE is executing at ELO, and EL2 is enabled in the current Security 
state. 


Otherwise, the value is compared against CONTEXTIDR when the PE is executing at AArch32, or 
CONTEXTIDR_EL1 when the PE is executing at AArch64. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When DBGBCR<n>_EL1.BT == 0b011x: 


63 32 31 0 


RESO ContextID 
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Bits [63:32] 


Reserved, RESO. 


ContextID, bits [31:0] 
When ARMv8.1-VHE is implemented: 
Context ID value for comparison against CONTEXTIDR_EL1. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


When DBGBCR<n>_EL1.BT == 06100x and HaveEL(EL2): 


63 48 47 40 39 32 31 


RESO VMID[15:8] VMID[7:0] RESO 


Bits [63:48] 


Reserved, RESO. 


VMID[15:8], bits [47:40] 
When ARMv%8.1-VHE is implemented: 
Extension to VMID[7:0]. See VMID[7:0] for more details. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


VMID[7:0], bits [39:32] 
VMID value for comparison. 
The VMID is 8 bits in the following cases. 
. EL2 is using AArch32. 
° ARMv8.1-VMID16 is not implemented. 


When ARMv8.1-VMID16 is implemented and EL2 is using AArch64, it is IMPLEMENTATION 
DEFINED whether the VMID is 8 bits or 16 bits. 


VMID[15:8] is RESO if any of the following applies: 

- The implementation has an 8-bit VMID. 

à VTCR_EL2.VS has a value of 0. 

3 EL2 is using AArch32. 

On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Bits [31:0] 


Reserved, RESO. 


When DBGBCR<n>_EL1.BT == 06101x and HaveEL(EL2): 


48 47 40 39 32 31 
i RESO | VMID[15:8] | VMID[7:0] | ContextID 
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Bits [63:48] 


Reserved, RESO. 


VMID[15:8], bits [47:40] 
When ARMV8.1-VMID16 is implemented: 
Extension to VMID[7:0]. See VMID[7:0] for more details. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


VMID[7:0], bits [39:32] 
VMID value for comparison. 
The VMID is 8 bits in the following cases. 
; EL2 is using AArch32. 
. ARMv8.1-VMID16 is not implemented. 


When ARMv8.1-VMID16 is implemented and EL2 is using AArch64, it is IMPLEMENTATION 
DEFINED whether the VMID is 8 bits or 16 bits. 


VMID[15:8] is RESO if any of the following applies: 
a The implementation has an 8-bit VMID. 

° VTCR_EL2.VS has a value of 0. 

. EL2 is using AArch32. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
ContextID, bits [31:0] 
Context ID value for comparison against CONTEXTIDR_EL1. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When DBGBCR<n>_EL1.BT == 06110x and HaveEL(EL2): 


63 32 31 0 


ContextID2 RESO 


ContextID2, bits [63:32] 
When ARMV8.1-VHE is implemented: 
Context ID value for comparison against CONTEXTIDR_EL2. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [31:0] 


Reserved, RESO. 
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When DBGBCR<n>_EL1.BT == 0b111x and HaveEL(EL2): 


63 32 31 0 


ContextID2 ContextID 


ContextID2, bits [63:32] 
When ARMv8.1-VHE is implemented: 
Context ID value for comparison against CONTEXTIDR_EL2. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


ContextID, bits [31:0] 
When ARMv%8.1-VHE is implemented: 
Context ID value for comparison against CONTEXTIDR_EL1. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Accessing the DBGBVR<n>_EL1: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalDebugAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 








DBGBVR<n>_EL1[63:0] can be accessed through the external debug interface: 


Component Offset Instance Range 


Debug 0x400 + 16n DBGBVR<n> ELI 63:0 


This interface is accessible as follows: 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalDebugAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalDebugAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


e Otherwise accesses to this register generate an error response. 
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H9.2.4 DBGCLAIMCLR_EL1, Debug Claim Tag Clear register 


ARM DDI 0487E.a 
ID070919 


The DBGCLAIMCLR EL! characteristics are: 


Purpose 
Used by software to read the values of the CLAIM tag bits, and to clear these bits to 0. 


The architecture does not define any functionality for the CLAIM tag bits. 


Note 
CLAIM tags are typically used for communication between the debugger and target software. 





Used in conjunction with the DBGCLAIMSET ELI register. 


Configurations 


External register DBGCLAIMCLR_EL1[31:0] is architecturally mapped to AArch64 System 
register DBGCLAIMCLR_EL1[31:0]. 


External register DBGCLAIMCLR_EL1[31:0] is architecturally mapped to AArch32 System 
register DBGCLAIMCLRJ3 1:0]. 


DBGCLAIMCLR_ ELI! is in the Core power domain. 


This register is not affected by a Warm reset, and is not affected by an External debug reset. 


An implementation must include 8 CLAIM tag bits. 


Attributes 
DBGCLAIMCLR_ EL] is a 32-bit register. 


Field descriptions 


The DBGCLAIMCLR _ EL] bit assignments are: 


31 8 7 0 
RAZ/SBZ CLAIM 
Bits [31:8] 


Reserved, RAZ/SBZ. Software can rely on these bits reading as zero, and must use a should-be-zero 
policy on writes. Implementations must ignore writes. 

CLAIM, bits [7:0] 
Read or clear CLAIM tag bits. Reading this field returns the current value of the CLAIM tag bits. 


Writing a 1 to one of these bits clears the corresponding CLAIM tag bit to 0. This is an indirect write 
to the CLAIM tag bits. A single write operation can clear multiple CLAIM tag bits to 0. 


Writing 0 to one of these bits has no effect. 


On a Cold reset, this field resets to 0. 


Accessing the DBGCLAIMCLR_EL1: 


DBGCLAIMCLR _ ELI can be accessed through the external debug interface: 





Component Offset Instance 


Debug OxFA4 DBGCLAIMCLR EL] 
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This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are RW. 


. Otherwise accesses to this register generate an error response. 
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H9.2.5 DBGCLAIMSET_EL1, Debug Claim Tag Set register 


ARM DDI 0487E.a 
ID070919 


The DBGCLAIMSET_EL1 characteristics are: 


Purpose 
Used by software to set the CLAIM tag bits to 1. 
The architecture does not define any functionality for the CLAIM tag bits. 





Note 
CLAIM tags are typically used for communication between the debugger and target software. 


Used in conjunction with the DBGCLAIMCLR_ ELI register. 


Configurations 


External register DBGCLAIMSET _EL1[31:0] is architecturally mapped to AArch64 System 
register DBGCLAIMSET _EL1[31:0]. 


External register DBGCLAIMSET EL1[31:0] is architecturally mapped to AArch32 System 
register DBGCLAIMSET{[31:0]. 


DBGCLAIMSET EL! is in the Core power domain. 
An implementation must include 8 CLAIM tag bits. 


Attributes 
DBGCLAIMSET EL] is a 32-bit register. 


Field descriptions 


The DBGCLAIMSET EL] bit assignments are: 


31 8 7 0 
RAZ/SBZ CLAIM 
Bits [31:8] 


Reserved, RAZ/SBZ. Software can rely on these bits reading as zero, and must use a should-be-zero 
policy on writes. Implementations must ignore writes. 

CLAIM, bits [7:0] 
Set CLAIM tag bits. RAO. 


Writing a 1 to one of these bits sets the corresponding CLAIM tag bit to 1. This is an indirect write 
to the CLAIM tag bits. A single write operation can set multiple CLAIM tag bits to 1. 


Writing 0 to one of these bits has no effect. 


Accessing the DBGCLAIMSET_EL1: 


DBGCLAIMSET EL] can be accessed through the external debug interface: 





Component Offset Instance 


Debug OxFAQ DBGCLAIMSET EL1 
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This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are RW. 


. Otherwise accesses to this register generate an error response. 
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H9.2.6 DBGDTRRX_ELO, Debug Data Transfer Register, Receive 


ARM DDI 0487E.a 
ID070919 


The DBGDTRRX_ELO characteristics are: 


Purpose 


Transfers data from an external debugger to the PE. For example, it is used by a debugger 
transferring commands and data to a debug target. See DBGDTR_ELO for additional architectural 
mappings. It is a component of the Debug Communications Channel. 


Configurations 


External register DBGDTRRX_ELO[31:0] is architecturally mapped to AArch64 System register 
DBGDTRRX_ELO[31:0]. 


External register DBGDTRRX_ELO[31:0] is architecturally mapped to AArch32 System register 
DBGDTRRXint[3 1:0]. 


DBGDTRRX_ELO is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on a Cold reset. The register is not affected by a Warm reset 
and is not affected by an External debug reset. 


Attributes 
DBGDTRRX_ELO is a 32-bit register. 


Field descriptions 


The DBGDTRRX_ELO bit assignments are: 


31 0 
Update DTRRX 
Bits [31:0] 
Update DTRRX. 


Writes to this register: 

° If RXfull is set to 1, set DTRRX to UNKNOWN. 

s If RXfull is set to 0, update the value in DTRRX. 

After the write, RXfull is set to 1. 

Reads of this register: 

. If RXfull is set to 1, return the last value written to DTRRX. 
. If RXfull is set to 0, return an UNKNOWN value. 

After the read, RXfull remains unchanged. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGDTRRX_ELO: 


If EDSCR.ITE == 0 when the PE exits Debug state on receiving a Restart request trigger event, the behavior of any 
operation issued by a DTR access in memory access mode that has not completed execution is CONSTRAINED 
UNPREDICTABLE, and must do one of the following: 


g It must complete execution in Debug state before the PE executes the restart sequence. 
z It must complete execution in Non-debug state before the PE executes the restart sequence. 
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. It must be abandoned. This means that the instruction does not execute. Any registers or memory accessed 
by the instruction are left in an UNKNOWN state. 


DBGDTRRX_ELO can be accessed through the external debug interface: 


Component Offset Instance 


Debug 0x080 DBGDTRRX_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are RW. 


° Otherwise accesses to this register generate an error response. 
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H9.2.7 DBGDTRTX_ELO, Debug Data Transfer Register, Transmit 


ARM DDI 0487E.a 
ID070919 


The DBGDTRTX_ELO characteristics are: 


Purpose 


Transfers data from the PE to an external debugger. For example, it is used by a debug target to 
transfer data to the debugger. See DBGDTR_ELO for additional architectural mappings. It is a 
component of the Debug Communication Channel. 


Configurations 


External register DBGDTRTX_EL0[31:0] is architecturally mapped to AArch64 System register 
DBGDTRTX_EL0[31:0]. 


External register DBGDTRTX_EL0[31:0] is architecturally mapped to AArch32 System register 
DBGDTRTXint[3 1:0]. 


DBGDTRTX_ELO is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on a Cold reset. The register is not affected by a Warm reset 
and is not affected by an External debug reset. 


Attributes 
DBGDTRTX_ELO is a 32-bit register. 


Field descriptions 


The DBGDTRTX_ELO bit assignments are: 


31 0 
Return DTRTX 
Bits [31:0] 
Return DTRTX. 


Reads of this register: 

° If TXfull is set to 1, return the last value written to DTRTX. 
° If TXfull is set to 0, return an UNKNOWN value. 

After the read, TXfull is cleared to 0. 

Writes to this register: 

° If TXfull is set to 1, set DTRTX to UNKNOWN. 

s If TXfull is set to 0, update the value in DTRTX. 

After the write, TXfull remains unchanged. 


For the full behavior of the Debug Communications Channel, see Chapter H4 The Debug 
Communication Channel and Instruction Transfer Register. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGDTRTX_ELO: 


If EDSCR.ITE == 0 when the PE exits Debug state on receiving a Restart request trigger event, the behavior of any 
operation issued by a DTR access in memory access mode that has not completed execution is CONSTRAINED 
UNPREDICTABLE, and must do one of the following: 


g It must complete execution in Debug state before the PE executes the restart sequence. 
z It must complete execution in Non-debug state before the PE executes the restart sequence. 
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. It must be abandoned. This means that the instruction does not execute. Any registers or memory accessed 
by the instruction are left in an UNKNOWN state. 


DBGDTRTX_EL0 can be accessed through the external debug interface: 


Component Offset Instance 


Debug Ox08C DBGDTRTX_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are RW. 


° Otherwise accesses to this register generate an error response. 
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H9.2.8 DBGWCR<n>_EL1, Debug Watchpoint Control Registers, n = 0 - 15 
The DBGWCR<n>_EL1 characteristics are: 


Purpose 
Holds control information for a watchpoint. Forms watchpoint n together with value register 
DBGWVR<n>_EL1. 

Configurations 


External register DBGWCR<n>_EL1[31:0] is architecturally mapped to AArch64 System register 
DBGWCR<n>_EL1[31:0]. 


External register DBGWCR<n>_EL1[31:0] is architecturally mapped to AArch32 System register 
DBGWCR<n>[3 1:0]. 


DBGWCR<n>_EL1 is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on a Cold reset. The register is not affected by a Warm reset 
and is not affected by an External debug reset. 


If watchpoint n is not implemented then accesses to this register are: 


. When IsCorePowered() && !DoubleLockStatus() && !OSLockStatus() && 
AllowExternalDebugAccess(), RESO. 


. Otherwise, a CONSTRAINED UNPREDICTABLE choice of RESO or ERROR. 


Attributes 
DBGWCR<n>_EL1 is a 32-bit register. 


Field descriptions 


The DBGWCR<n>_EL1 bit assignments are: 


29 28 2423 212019 16 15 14 13 12 5 43 210 


WT | e HMC 


When the E field is zero, all the other fields in the register are ignored. 


Bits [31:29] 


Reserved, RESO. 


MASK, bits [28:24] 
Address mask. Only objects up to 2GB can be watched using a single mask. 
0b00000 No mask. 
0b00001 Reserved. 
0b00010 Reserved. 
If programmed with a reserved value, a watchpoint must behave as if either: 


s MASK has been programmed with a defined value, which might be 0 (no mask), other than 
for a direct read of DBGWCRn_EL1. 


° The watchpoint is disabled. 


Software must not rely on this property because the behavior of reserved values might change in a 
future revision of the architecture. 


Other values mask the corresponding number of address bits, from 0b00011 masking 3 address bits 
(@x@0000007 mask for address) to 0b11111 masking 31 address bits (@x7FFFFFFF mask for address). 
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On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [23:21] 


Reserved, RESO. 


WT, bit [20] 
Watchpoint type. Possible values are: 
Qbd Unlinked data address match. 
Qb1 Linked data address match. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


LBN, bits [19:16] 


Linked breakpoint number. For Linked data address watchpoints, this specifies the index of the 
Context-matching breakpoint linked to. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


SSC, bits [15:14] 


Security state control. Determines the Security states under which a Watchpoint debug event for 
watchpoint n is generated. This field must be interpreted along with the HMC and PAC fields. 


For more information on the operation of the SSC, HMC, and PAC fields, see Execution conditions 
for which a watchpoint generates Watchpoint exceptions on page D2-2433. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


HMC, bit [13] 


Higher mode control. Determines the debug perspective for deciding when a Watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and PAC 
fields. 


For more information on the operation of the SSC, HMC, and PAC fields, see Execution conditions 
for which a watchpoint generates Watchpoint exceptions on page D2-2433. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


BAS, bits [12:5] 


Byte address select. Each bit of this field selects whether a byte from within the word or 
double-word addressed by DBGWVR<n>_ ELI is being watched. 


BAS Description 





Xxxxxxxl Match byte at DBGWVR<n>_EL1 





Xxxxxxlx Match byte at DBGWVR<n>_EL1 +1 





xxxxxlxx Match byte at DBGWVR<n>_EL1 +2 








xxxxlxxx Match byte at DBGWVR<n>_EL1 +3 





In cases where DBGWVR<n>_EL1 addresses a double-word: 





BAS Description, if DBGWVR<n>_EL1[2] == 





xxx1xxxx Match byte at DBGWVR<n>_EL1 +4 





xx1xxxxx Match byte at DBGWVR<n>_EL1 +5 





x1xxxxxx Match byte at DBGWVR<n>_EL1 +6 








1xxxxxxx Match byte at DBGWVR<n>_EL1 +7 
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If DBGWVR<n>_EL1[2] == 1, only BAS[3:0] is used. Arm deprecates setting 
DBGWVR<n>_EL1[2] == 1. 


The valid values for BAS are non-zero binary number all of whose set bits are contiguous. All other 
values are reserved and must not be used by software. See Reserved DBGWCR<n>.BAS values on 
page G2-5663. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
LSC, bits [4:3] 


Load/store control. This field enables watchpoint matching on the type of access being made. 
Possible values of this field are: 


QbO1 Match instructions that load from a watchpointed address. 
0b10 Match instructions that store to a watchpointed address. 
Qb11 Match instructions that load from or store to a watchpointed address. 


All other values are reserved, but must behave as if the watchpoint is disabled. Software must not 
rely on this property as the behavior of reserved values might change in a future revision of the 
architecture. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


PAC, bits [2:1] 


Privilege of access control. Determines the Exception level or levels at which a Watchpoint debug 
event for watchpoint n is generated. This field must be interpreted along with the SSC and HMC 
fields. 


For more information on the operation of the SSC, HMC, and PAC fields, see Execution conditions 
for which a watchpoint generates Watchpoint exceptions on page D2-2433. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


E, bit [0] 
Enable watchpoint n. Possible values are: 
0bd Watchpoint disabled. 
Qb1 Watchpoint enabled. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the DBGWCR<n>_EL1: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalDebugAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 








DBGWCR<n>_EL1 can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x808 + 1l6n DBGWCR<n>_EL1 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalDebugAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


e When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalDebugAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


° Otherwise accesses to this register generate an error response. 
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H9.2.9 DBGWVR<n>_EL1, Debug Watchpoint Value Registers, n = 0 - 15 
The DBGWVR<n>_EL1 characteristics are: 


Purpose 
Holds a data address value for use in watchpoint matching. Forms watchpoint n together with 
control register DBGWCR<n>_EL1. 

Configurations 


External register DBGWVR<n>_EL1[63:0] is architecturally mapped to AArch64 System register 
DBGWVR<n>_EL1[63:0]. 


External register DBGWVR<n>_EL1[31:0] is architecturally mapped to AArch32 System register 
DBGWVR<n>{[3 1:0]. 


DBGWVR<n>_EL1 is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on a Cold reset. The register is not affected by a Warm reset 
and is not affected by an External debug reset. 


If watchpoint n is not implemented then accesses to this register are: 


. When IsCorePowered() && !DoubleLockStatus() && !OSLockStatus() && 
AllowExternalDebugAccess(), RESO. 


. Otherwise, a CONSTRAINED UNPREDICTABLE choice of RESO or ERROR. 


Attributes 
DBGWVR<n>_ EL] is a 64-bit register. 


Field descriptions 


The DBGWVR<n>_EL1 bit assignments are: 


63 53 52 49 48 2 10 


RESS[14:4] VA[52:49] VA[48:2] 


RESS[14:4], bits [63:53] 





Reserved, Sign extended. Hardware and software must treat this field as RESO if the most significant 
bit of VA is 0 or RESO, and as RES1 if the most significant bit of VA is 1. 


Hardware always ignores the value of these bits and it is IMPLEMENTATION DEFINED whether: 


a The bits are hardwired to a copy of the most significant bit of VA, meaning writes to these 
bits are ignored, and reads to the bits always return the hardwired value. 


° The value in those bits can be written, and reads will return the last value written. The value 
held in those bits is ignored by hardware. 
VA[52:49], bits [52:49] 

When ARMv8.2-LVA is implemented: 
Extension to VA[48:2]. See VA[48:2] for more details. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 

Otherwise: 
Extension to RESS[14:4]. See RESS[14:4] for more details. 


VA[48:2], bits [48:2] 


Bits[48:2] of the address value for comparison. 
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When ARMv8.2-LVA is implemented, VA[52:49] forms the upper part of the address value. 
Otherwise, VA[52:49] are RESS. 


Arm deprecates setting DBGWVR<n>_EL1[2] == 1. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Bits [1:0] 


Reserved, RESO. 


Accessing the DBGWVR<n>_EL1: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalDebugAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 








DBGWVR<n>_EL1[63:0] can be accessed through the external debug interface: 





Component Offset Instance Range 


Debug 0x800 + 16n DBGWVR<n> ELI 63:0 





This interface is accessible as follows: 


e When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalDebugAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalDebugAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


° Otherwise accesses to this register generate an error response. 
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H9.2.10 EDAA32PFR, External Debug AArch32 Processor Feature Register 
The EDAA32PFR characteristics are: 


Purpose 
Provides information about implemented PE features. 
For general information about the interpretation of the ID registers see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 


It is IMPLEMENTATION DEFINED whether EDAA32PFR is implemented in the Core power domain 
or in the Debug power domain. 


EDAA32PER is only accessible in an implementation that only supports execution in AA32 state. 
If AArch64 state is supported at any Exception level, EDAA32PFR is RESO. 


Attributes 
EDAA32PFR is a 64-bit register. 


Field descriptions 


The EDAA32PFR bit assignments are: 


1615 12 11 


63 8 7 4 3 0 
| RESO EL3 EL2 | PMSA VMSA 


Bits [63:16] 


Reserved, RESO. 


EL3, bits [15:12] 
AArch32 EL3 Exception level handling. Defined values are: 
0b0000 EL3 is not implemented. 
0b0001 EL3 can be executed in AArch32 state only. 
When the value of EDPFR.EL3 is non-zero, this field must be 0b0000. 


All other values are reserved. 





Note 
EDPFR.{EL1, ELO} indicate whether EL1 and ELO can only be executed in AArch32 state. 





EL2, bits [11:8] 
AArch32 EL2 Exception level handling. Defined values are: 
0b0000 EL2 is not implemented. 
0b0001 EL2 can be executed in AArch32 state only. 
When the value of EDPFR.EL2 is non-zero, this field must be 0b0000. 
All other values are reserved. 


Note 
EDPFR.{EL1, ELO} indicate whether EL1 and ELO can only be executed in AArch32 state. 
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PMSA, bits [7:4] 
Indicates support for a PMSA. Defined values are: 
0b0000 PMSA not supported. 
0b0100 Support for an Armv8-R PMSAv8-32. 


All other values are reserved. In Armv8-A, the only permitted value is 0b0000. 


VMSA, bits [3:0] 


Indicates support for a VMSA. When the PMSA field is nonzero, determines support fora VMSA. 
When the PMSA field is 0b0000, VMSA is supported. Defined values are: 


0b0000 VMSA not supported. 


All other values are reserved. In Armv8-A, the only permitted value is 0b0000. 


Accessing the EDAA32PFR: 


EDAA32PFR can be accessed through the external debug interface: 





Component Offset Instance 





Debug QxD60 EDAA32PFR 
This interface is accessible as follows: 
. When IsCorePowered() and !DoubleLockStatus() accesses to this register are RO. 
° Otherwise accesses to this register are IMPDEF. 
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H9.2.11 


H9-6880 


EDACR, External Debug Auxiliary Control Register 


The EDACR characteristics are: 


Purpose 
Allows implementations to support IMPLEMENTATION DEFINED controls. 
Configurations 
It is IMPLEMENTATION DEFINED whether EDACR is implemented in the Core power domain or in 
the Debug power domain. RW fields in this register reset to architecturally UNKNOWN values, and: 
- The register is not affected by a Warm reset. 
° If the register is implemented in the Core power domain the reset values apply on a Cold 
reset, and the register is not affected by an External debug reset. 
: If the register is implemented in the Debug power domain the reset values apply on an 
External debug reset, and the register is not affected by a Cold reset. 
Changing this register from its reset value causes IMPLEMENTATION DEFINED behavior, including 
possible deviation from the architecturally-defined behavior. 
If the EDACR contains any control bits that must be preserved over power down, then these bits 
must be accessible by the external debug interface when the OS Lock is locked, 
OSLSR_EL1.OSLK == 1, and when the Core is powered off. 
Attributes 


EDACR is a 32-bit register. 


Field descriptions 


The EDACR bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


This field resets to an architecturally UNKNOWN value. 


Accessing the EDACR: 


EDACR can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x094 EDACR 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are RO. 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are RW. 


° Otherwise accesses to this register are IMPDEF. 
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H9.2.12 EDCIDRO, External Debug Component Identification Register 0 


The EDCIDRO characteristics are: 


Purpose 
Provides information to identify an external debug component. 


For more information see About the Component Identification scheme on page K2-7663. 


Configurations 
It is IMPLEMENTATION DEFINED whether EDCIDRO is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
EDCIDR0O is a 32-bit register. 


Field descriptions 


The EDCIDRO bit assignments are: 


31 8 7 0 
RESO PRMBL_0O 
Bits [31:8] 


Reserved, RESO. 


PRMBL 0, bits [7:0] 
Preamble. Must read as 0x0D. 


Accessing the EDCIDRO: 


EDCIDRO can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFFQ EDCIDRO 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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H9.2.13 


H9-6882 


EDCIDR1, External Debug Component Identification Register 1 
The EDCIDR1 characteristics are: 


Purpose 
Provides information to identify an external debug component. 


For more information see About the Component Identification scheme on page K2-7663. 


Configurations 


It is IMPLEMENTATION DEFINED whether EDCIDR1 is implemented in the Core power domain or in 


the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 


is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
EDCIDR1 is a 32-bit register. 


Field descriptions 


The EDCIDR1 bit assignments are: 


31 87 4 3 0 
RESO CLASS | PRMBL_1 
Bits [31:8] 


Reserved, RESO. 


CLASS, bits [7:4] 


Component class. Reads as 0x9, debug component. 
PRMBL 1, bits [3:0] 
Preamble. RAZ. 


Accessing the EDCIDR1: 


EDCIDRI can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFF4 EDCIDR1 
This interface is accessible as follows: 
° When ARMxv8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.14 EDCIDR2, External Debug Component Identification Register 2 


The EDCIDR2 characteristics are: 


Purpose 
Provides information to identify an external debug component. 


For more information see About the Component Identification scheme on page K2-7663. 


Configurations 
It is IMPLEMENTATION DEFINED whether EDCIDR2 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
EDCIDR2 is a 32-bit register. 


Field descriptions 


The EDCIDR2 bit assignments are: 


31 8 7 0 
RESO PRMBL_2 
Bits [31:8] 


Reserved, RESO. 


PRMBL 2, bits [7:0] 
Preamble. Must read as 0x05. 


Accessing the EDCIDR2: 


EDCIDR2 can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFF8 EDCIDR2 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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H9.2.15 EDCIDR3, External Debug Component Identification Register 3 


The EDCIDR3 characteristics are: 


Purpose 
Provides information to identify an external debug component. 


For more information see About the Component Identification scheme on page K2-7663. 


Configurations 
It is IMPLEMENTATION DEFINED whether EDCIDR3 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
EDCIDR3 is a 32-bit register. 


Field descriptions 


The EDCIDR3 bit assignments are: 


31 8 7 0 
RESO PRMBL_3 
Bits [31:8] 


Reserved, RESO. 


PRMBL 3, bits [7:0] 
Preamble. Must read as QxB1. 


Accessing the EDCIDR3: 


EDCIDR3 can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFFC EDCIDR3 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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H9.2.16 EDCIDSR, External Debug Context ID Sample Register 


ARM DDI 0487E.a 
ID070919 


The EDCIDSR characteristics are: 


Purpose 
Contains the sampled value of the Context ID, captured on reading EDPCSR[3 1:0]. 


Configurations 
EDCIDSR is in the Core power domain. 


Fields in this register reset to architecturally UNKNOWN values. These apply only on a Cold reset. 
The register is not affected by a Warm reset and is not affected by an External debug reset. 


Implemented only if the OPTIONAL PC Sample-based Profiling Extension is implemented in the 
external debug registers space. 


Note 
ARMv8.2-PCSample implements the PC Sample-based Profiling Extension in the Performance 
Monitors registers space. 








Attributes 
EDCIDSR is a 32-bit register. 


Field descriptions 


The EDCIDSR bit assignments are: 


When ARMv8.2-PCSample is implemented: 


31 0 
RESO 


Bits [31:0] 


Reserved, RESO. 


Otherwise: 


31 0 
CONTEXTIDR 


CONTEXTIDR, bits [31:0] 
Context ID. The value of CONTEXTIDR that is associated with the most recent EDPCSR sample. 
$ If EL1 is using AArch64, then the Context ID is held in CONTEXTIDR_EL1. 
s If EL1 is using AArch32, then the Context ID is held in CONTEXTIDR. 


s If EL3 is implemented and is using AArch32, then CONTEXTIDR is a banked register, and 
EDCIDSR samples the current banked copy of CONTEXTIDR for the Security state that is 
associated with the most recent EDPCSR sample. 


Because the value written to EDCIDSR is an indirect read of CONTEXTIDR, therefore it is 
CONSTRAINED UNPREDICTABLE whether EDCIDSR is set to the original or new value if a read of 
EDPCSRIo samples: 


° An instruction that writes to CONTEXTIDR_EL1. 
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H9-6886 


à The next Context synchronization event. 
3 Any instruction executed between these two instructions. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the EDCIDSR: 


IMPLEMENTATION DEFINED extensions to external debug might make the value of this register UNKNOWN, see 
Permitted behavior that might make the PC Sample-based profiling registers UNKNOWN on page H7-6824. 


EDCIDSR can be accessed through the external debug interface: 





Component Offset Instance 


Debug Ox0A4 EDCIDSR 





This interface is accessible as follows: 
. When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to this register are RO. 


e Otherwise accesses to this register generate an error response. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


External Debug Register Descriptions 
H9.2 External debug registers 


H9.2.17 EDDEVAFFO, External Debug Device Affinity register 0 


The EDDEVAFFO characteristics are: 


Purpose 
Copy of the low half of the PE MPIDR_ELI register that allows a debugger to determine which PE 
in a multiprocessor system the external debug component relates to. 

Configurations 
It is IMPLEMENTATION DEFINED whether EDDEVAFFO is implemented in the Core power domain 
or in the Debug power domain. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 

Attributes 


EDDEVAFFO is a 32-bit register. 


Field descriptions 


The EDDEVAFFO bit assignments are: 


31 0 


MPIDR_EL1 low half 


MPIDR_EL1 low half, bits [31:0] 
MPIDR_EL] low half. Read-only copy of the low half of MPIDR_EL1, as seen from the highest 
implemented Exception level. 


Accessing the EDDEVAFF0: 


EDDEVAFFO can be accessed through the external debug interface: 





Component Offset Instance 


Debug OxFA8 EDDEVAFFO 





This interface is accessible as follows: 


° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 


e Otherwise accesses to this register generate an error response. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H9-6887 
ID070919 Non-Confidential 


External Debug Register Descriptions 
H9.2 External debug registers 


H9.2.18 EDDEVAFF1, External Debug Device Affinity register 1 


The EDDEVAFF!1 characteristics are: 


Purpose 
Copy of the high half of the PE MPIDR_ELI register that allows a debugger to determine which PE 
in a multiprocessor system the external debug component relates to. 

Configurations 
It is IMPLEMENTATION DEFINED whether EDDEVAFF1 is implemented in the Core power domain 
or in the Debug power domain. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 

Attributes 


EDDEVAFF1 is a 32-bit register. 


Field descriptions 


The EDDEVAFF1 bit assignments are: 


31 0 


MPIDR_EL1 high half 


MPIDR_EL1 high half, bits [31:0] 
MPIDR_EL1 high half. Read-only copy of the high half of MPIDR_ELI, as seen from the highest 
implemented Exception level. 


Accessing the EDDEVAFF1: 


EDDEVAFF 1 can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFAC EDDEVAFF1 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.19 EDDEVARCH, External Debug Device Architecture register 


The EDDEVARCH characteristics are: 


Purpose 
Identifies the programmers’ model architecture of the external debug component. 

Configurations 
It is IMPLEMENTATION DEFINED whether EDDEVARCH is implemented in the Core power domain 
or in the Debug power domain. 
Implementation of this register is OPTIONAL. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 

Attributes 


EDDEVARCH is a 32-bit register. 


Field descriptions 


The EDDEVARCH bit assignments are: 


31 21 20 19 1615 12 11 0 


ARCHITECT i REVISION | ARCHVER ARCHPART 


PRESENT E a 


ARCHITECT, bits [31:21] 


Defines the architecture of the component. For debug, this is Arm Limited. 
Bits [31:28] are the JEP106 continuation code, 0x4. 
Bits [27:21] are the JEP106 ID code, 0x3B. 


PRESENT, bit [20] 
When set to 1, indicates that the DEVARCH is present. 
This field is 1 in Armv8. 


REVISION, bits [19:16] 
Defines the architecture revision. For architectures defined by Arm this is the minor revision. 


For debug, the revision defined by Armv8-A is 0x0. 


All other values are reserved. 


ARCHVER, bits [15:12] 


Defines the architecture version of the component. This is the same value as 
ID_AA64DFRO_EL1.DebugVer and DBGDIDR. Version. The defined values of this field are: 


0b0110 Armv8.0 Debug architecture. 
Qb0111 Armv8.0 Debug architecture with Virtualization Host Extensions. 
0b1000 Armv8.2 Debug architecture. 
0b1001 Armv8.4 Debug architecture. 


ARMv8.4-Debug adds the functionality indicated by the value 0b1001.ARMv8.2-Debug adds the 
functionality indicated by the value 0b1000. If ARMv8.1-VHE is not implemented, the only 
permitted value is 0b0110. 
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The fields ARCHVER and ARCHPART together form the field ARCHID, so that ARCHVER is 
ARCHID[15:12]. 


ARCHPART, bits [11:0] 
QxA15 The part number of the Armv8-A debug component. 


The fields ARCHVER and ARCHPART together form the field ARCHID, so that ARCHPART is 
ARCHID[11:0]. 


Accessing the EDDEVARCH: 


EDDEVARCH can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFBC EDDEVARCH 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.20 EDDEVID, External Debug Device ID register 0 


The EDDEVID characteristics are: 


Purpose 
Provides extra information for external debuggers about features of the debug implementation. 
Configurations 
It is IMPLEMENTATION DEFINED whether EDDEVID is implemented in the Core power domain or 
in the Debug power domain. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 
Attributes 


EDDEVID is a 32-bit register. 


Field descriptions 


The EDDEVID bit assignments are: 


31 28 27 24 23 8 7 43 0 
- a E 
Bits [31:28] 


Reserved, RESO. 


AuxRegs, bits [27:24] 
Indicates support for Auxiliary registers. Permitted values for this field are: 
0b0000 None supported. 
0b0001 Support for External Debug Auxiliary Control Register, EDACR. 


All other values are reserved. 


Bits [23:8] 
Reserved, RESO. 


DebugPower, bits [7:4] 
From ARMv8.3: 
Indicates support for the ARMv8.3-DoPD feature. Defined values of this field are: 


0b0000 ARMv8.3-DoPD not implemented. Registers in the external debug interface register 
map are implemented in a mix of the Debug and Core power domains. 


0b0001 ARMv8.3-DoPD implemented. All registers in the external debug interface register 
map are implemented in the Core power domain. 


ARMv8.3-DoPD implements the functionality added by the value 0b0001. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 
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PCSample, bits [3:0] 


Indicates the level of PC Sample-based Profiling support using external debug registers. Permitted 
values of this field are: 


0b0000 PC Sample-based Profiling Extension is not implemented in the external debug registers 
space. 


0b0010 Only EDPCSR and EDCIDSR are implemented. This option is only permitted if EL3 
and EL2 are not implemented. 


0b0011 EDPCSR, EDCIDSR, and EDVIDSR are implemented. 
All other values are reserved. 


When ARMv8.2-PCSample is implemented, the only permitted value is 0b0000. 





Note 


ARMv8.2-PCSample implements the PC Sample-based Profiling Extension in the Performance 
Monitors register space, as indicated by the value of PMDEVID.PCSample. 


Accessing the EDDEVID: 


EDDEVID can be accessed through the external debug interface: 





Component Offset Instance 





Debug QxFC8 EDDEVID 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.21 EDDEVID1, External Debug Device ID register 1 


ARM DDI 0487E.a 
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The EDDEVID1 characteristics are: 


Purpose 
Provides extra information for external debuggers about features of the debug implementation. 
Configurations 
It is IMPLEMENTATION DEFINED whether EDDEVID1 is implemented in the Core power domain or 
in the Debug power domain. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 
Attributes 


EDDEVID1 is a 32-bit register. 


Field descriptions 


The EDDEVID1 bit assignments are: 


31 43 0 
RESO PCSROffset 
Bits [31:4] 


Reserved, RESO. 


PCSROffset, bits [3:0] 
This field indicates the offset applied to PC samples returned by reads of EDPCSR. Permitted values 
of this field in Armv8 are: 


0b0000 EDPCSR not implemented. 


0b0010 EDPCSR implemented, and samples have no offset applied and do not sample the 
instruction set state in AArch372 state. 


When ARMv8.2-PCSample is implemented, the only permitted value is 0b0000. 
Note 


ARMv8.2-PCSample implements the PC Sample-based Profiling Extension in the Performance 
Monitors register space, as indicated by the value of PMDEVID.PCSample. 





Accessing the EDDEVID1: 


EDDEVIDI1 can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFC4 EDDEVID1 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.22 EDDEVID2, External Debug Device ID register 2 


The EDDEVID2 characteristics are: 


Purpose 
Reserved for future descriptions of features of the debug implementation. 

Configurations 
It is IMPLEMENTATION DEFINED whether EDDEVID2 is implemented in the Core power domain or 
in the Debug power domain. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 

Attributes 


EDDEVID2 is a 32-bit register. 


Field descriptions 


The EDDEVID2 bit assignments are: 


31 0 
RESO 
Bits [31:0] 


Reserved, RESO. 


Accessing the EDDEVID2: 


EDDEVID?2 can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFC@ EDDEVID2 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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H9.2.23 EDDEVTYPE, External Debug Device Type register 


The EDDEVTYPE characteristics are: 


Purpose 
Indicates to a debugger that this component is part of a PEs debug logic. 

Configurations 
It is IMPLEMENTATION DEFINED whether EDDEVTYPE is implemented in the Core power domain 
or in the Debug power domain. 
Implementation of this register is OPTIONAL. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 

Attributes 


EDDEVTYPE is a 32-bit register. 


Field descriptions 


The EDDEVTYPE bit assignments are: 


31 8 7 4 3 0 
RESO SUB MAJOR 
Bits [31:8] 


Reserved, RESO. 


SUB, bits [7:4] 
Subtype. Must read as 0x1 to indicate this is a component within a PE. 


MAJOR, bits [3:0] 


Major type. Must read as 0x5 to indicate this is a debug logic component. 


Accessing the EDDEVTYPE: 


EDDEVTYPE can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFCC EDDEVTYPE 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.24 EDDFR, External Debug Feature Register 
The EDDFR characteristics are: 


Purpose 
Provides top level information about the debug system. 


Note 
Debuggers must use EDDEVARCH to determine the Debug architecture version. 








For general information about the interpretation of the ID registers, see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 


Configurations 


It is IMPLEMENTATION DEFINED whether EDDFR is implemented in the Core power domain or in 
the Debug power domain. 


There are no configuration notes. 


Attributes 
EDDFR is a 64-bit register. 


Field descriptions 


The EDDFR bit assignments are: 


44 43 40 39 32 31 28 27, 24 23, 20 19, 16 15,12 11 


r RESO recor UNKNOWN | CTX_CMPs | RESO te RESO | BRPs |PMUVer ase 


Bits [63:44] 
Reserved, RESO. 
TraceFilt, bits [43:40] 
From ARMV8.4: 
Armv8.4 Self-hosted Trace Extension version. The defined values of this field are: 
0b0000 Armv8.4 Self-hosted Trace Extension is not implemented. 
0b0001 Armv8.4 Self-hosted Trace Extension is implemented. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 
UNKNOWN, bits [39:32] 

Reserved, UNKNOWN. 
CTX_CMPs, bits [31:28] 


Number of breakpoints that are context-aware, minus 1. These are the highest numbered 
breakpoints. 


In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_ AA64DFRO _EL1.CTX_CMPs. 


Bits [27:24] 


Reserved, RESO. 
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WRPs, bits [23:20] 
Number of watchpoints, minus 1. The value of 0b0000 is reserved. 
In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_ AA64DFRO _EL1.WRPs. 

Bits [19:16] 


Reserved, RESO. 


BRPs, bits [15:12] 
Number of breakpoints, minus 1. The value of @b0000 is reserved. 
In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_ AA64DFRO_EL1.BRPs. 
PMUVer, bits [11:8] 
Performance Monitors Extension version. 


This field does not follow the standard ID scheme, but uses the Alternative ID scheme described in 
Alternative ID scheme used for the Performance Monitors Extension version on page D13-2825. 


Defined values are: 

0b0000 Performance Monitors Extension not implemented. 

0b0001 Performance Monitors Extension implemented, PMUv3. 
0b0100 PMUVv3 for Armv8.1. As @b0001, and also includes support for: 

s Extended 16-bit PMEVTYPER<n>_EL0.evtCount field. 

s If EL2 is implemented, the MDCR_EL2.HPMD control bit. 
0b0101 PMUVv3 for Armv8.4. As 0b0100 and also includes support for the PMMIR register. 
0b0110 PMUV3 for Armv8.5. As 0b0101 and also includes support for: 

š 64-bit event counters. 

. If EL2 is implemented, the MDCR_EL2.HCCD control bit. 

s If EL3 is implemented, the MDCR_EL3.SCCD control bit. 


0b1111 IMPLEMENTATION DEFINED form of performance monitors supported, PMUVv3 not 
supported. Arm does not recommend this value in new implementations. 


ARMv8.1-PMU implements the functionality added by the value 0b0100. 
ARMv8.4-PMU implements the functionality added by the value 0b0101. 
ARMv8.5-PMU implements the functionality added by the value 0b0110. 
All other values are reserved. 
From Armv8.1, the value 0b0001 is not permitted. 
From Armv8.4, the value 0b0100 is not permitted. 
From Armv8.5, the value 0b0101 is not permitted. 
In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_ AA64DFRO_EL1.PMUVer. 
TraceVer, bits [7:4] 


Trace support. Indicates whether System register interface to a PE trace unit is implemented. 
Defined values are: 


0b0000 PE trace unit System registers not implemented. 
0b0001 PE trace unit System registers implemented. 
All other values are reserved. 


A value of 0b0000 only indicates that no System register interface to a PE trace unit is implemented. 
A PE trace unit might nevertheless be implemented without a System register interface. 
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In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 


field returns the value of ID_ AA64DFRO_EL1.TraceVer. 


UNKNOWN, bits [3:0] 
Reserved, UNKNOWN. 


Accessing the EDDFR: 


EDDFR[31:0] can be accessed through the external debug interface: 














Component Offset Instance Range 
Debug @xD28 EDDFR 31:0 

This interface is accessible as follows: 

. When IsCorePowered() and !DoubleLockStatus() accesses to EDDFR[31:0] are RO. 

° Otherwise accesses to EDDFR[31:0] are IMPDEF. 

EDDFR[63:32] can be accessed through the external debug interface: 
Component Offset Instance Range 
Debug @xD2C EDDFR 63:32 

This interface is accessible as follows: 

° When IsCorePowered() and !DoubleLockStatus() accesses to EDDFR[63:32] are RO. 

° Otherwise accesses to EDDFR[63:32] are IMPDFF. 
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H9.2.25 EDECCR, External Debug Exception Catch Control Register 
The EDECCR characteristics are: 
Purpose 
Controls Exception Catch debug events. 


Configurations 


External register EDECCR[31:0] is architecturally mapped to AArch64 System register 
OSECCR_EL1[31:0]. 


External register EDECCR[31:0] is architecturally mapped to AArch32 System register 
DBGOSECCRJ31:0]. 


EDECCR is in the Core power domain. Some or all RW fields of this register have defined reset 
values. These apply only on a Cold reset. The register is not affected by a Warm reset and is not 
affected by an External debug reset. 


Attributes 
EDECCR is a 32-bit register. 


Field descriptions 


The EDECCR bit assignments are: 


When ARMv8.2-Debug is implemented: 


161514131211109 8 76543210 





ses 
SE1 


SE2 
SE3 
NSEO 
NSE1 
NSE2 
NSE3 
SRO 
SR1 
SR2 
SR3 
NSRO 
NSR1 
NSR2 
NSR3 


Bits [31:16] 
Reserved, RESO. 


NSR<n>, bit [n+12], for n = 0 to 3 


Controls Non-secure exception catch on exception return to EL<n> in conjunction with NSE<n>. 
See the Table H3-5 on page H3-6759 for information. 
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If EL3 is not implemented and the PE behaves as if SCR_EL3.NS is set to 0, this field is reserved, 
RESO. Otherwise, possible values for this field are: 


Obed If the corresponding NSE<n> bit is 0, then Exception Catch debug events are disabled 
for Non-secure Exception level <n>. 
If the corresponding NSE<n> bit is 1, then Exception Catch debug events are enabled 
for exception entry, reset entry and exception return to Non-secure Exception level <n>. 


Qb1 If the corresponding NSE<n> bit is 0, then Exception Catch debug events are enabled 
for exception returns to Non-secure Exception level <n>. 








If the corresponding NSE<n> bit is 1, then Exception Catch debug events are enabled 
for exception entry and reset entry to Non-secure Exception level <n>. 
——— Note 


It is IMPLEMENTATION DEFINED whether a reset entry to an Exception level is permitted to generate 
an Exception Catch debug event. 


A value of the NSR field that enables an Exception Catch debug event for an Exception level that 
is not implemented is reserved. If the NSR field is programmed with a reserved value then: 


s The PE behaves as if it is programmed with a defined value, other than for a read of 
EDECCR. 


° The value returned for NSR by a read of EDECCR is UNKNOWN. 
On a Cold reset, this field resets to 0. 


SR<n>, bit [n+8], for n = 0 to 3 


Controls Secure exception catch on exception return to EL<n> in conjunction with SE<n>. See the 
Table H3-5 on page H3-6759 for information. 


If EL3 is not implemented and the PE behaves as if SCR_EL3.NS is set to 1, this field is reserved, 
RESO. Otherwise, possible values for this field are: 


Qbd Ifthe corresponding SE<n> bit is 0, then Exception Catch debug events are disabled for 
Secure Exception level <n>. 
If the corresponding SE<n> bit is 1, then Exception Catch debug events are enabled for 
exception entry, reset entry and exception return to Secure Exception level <n>. 

Qb1 If the corresponding SE<n> bit is 0, then Exception Catch debug events are enabled for 
exception returns to Secure Exception level <n>. 


If the corresponding SE<n> bit is 1, then Exception Catch debug events are enabled for 
exception entry and reset entry to Secure Exception level <n>. 


Note 


It is IMPLEMENTATION DEFINED whether a reset entry to an Exception level is permitted to generate 
an Exception Catch debug event. 








A value of the SR field that enables an Exception Catch debug event for an Exception level that is 
not implemented is reserved. If the SR field is programmed with a reserved value then: 


° The PE behaves as if it is programmed with a defined value, other than for a read of 
EDECCR. 
° The value returned for SR by a read of EDECCR is UNKNOWN. 


On a Cold reset, this field resets to 0. 


NSE<n>, bit [n+4], for n = 0 to 3 


Coarse-grained Non-secure exception catch for EL<n>. This controls whether Exception Catch 
debug events are enabled for Non-secure EL<n>. This also controls: 


° The behavior of exception catch on exception entry to EL<n>. 
° The behavior of exception catch on exception return to EL<n> in conjunction with NSR<n>. 
H9-6900 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


External Debug Register Descriptions 
H9.2 External debug registers 


If EL3 is not implemented and the PE behaves as if SCR_EL3.NS is set to 0, this field is reserved, 
RESO. Otherwise, possible values for this field are: 


Obed If the corresponding NSR<n> bit is 0, then Exception Catch debug events are disabled 
for Non-secure Exception level <n>. 
If the corresponding NSR<n> bit is 1, then Exception Catch debug events are enabled 
for exception returns to Non-secure Exception level <n>. 


Qb1 If the corresponding NSR<n> bit is 0, then Exception Catch debug events are enabled 
for exception entry, reset entry and exception return to Non-secure Exception level <n>. 








If the corresponding NSR<n> bit is 1, then Exception Catch debug events are enabled 
for exception entry and reset entry to Non-secure Exception level <n>. 


A value of the NSE field that enables an Exception Catch debug event for an Exception level that is 
not implemented is reserved. If the NSE field is programmed with a reserved value then: 


. The PE behaves as if it is programmed with a defined value, other than for a read of 
EDECCR. 


. The value returned for NSE by a read of EDECCR is UNKNOWN. 
On a Cold reset, this field resets to Q. 


SE<n>, bit [n], for n = 0 to 3 


Coarse-grained Secure exception catch for EL<n>. This field controls whether Exception Catch 
debug events are enabled for Secure EL<n>. 

è The behavior of exception catch on exception entry to EL<n>. 

à The behavior of exception catch on exception return to EL<n> in conjunction with SR<n>. 


If EL3 is not implemented and the PE behaves as if SCR_EL3.NS is set to 1, this field is reserved, 
RESO. Otherwise, possible values for this field are: 


ObO If the corresponding SR<n> bit is 0, then Exception Catch debug events are disabled for 
Secure Exception level <n>. 
If the corresponding SR<n> bit is 1, then Exception Catch debug events are enabled for 
exception returns to Secure Exception level <n>. 

Qb1 If the corresponding SR<n> bit is 0, then Exception Catch debug events are enabled for 
exception entry, reset entry and exception return to Secure Exception level <n>. 
Ifthe corresponding SR<n> bit is 1, then Exception Catch debug events are enabled for 
exception entry and reset entry to Secure Exception level <n>. 


A value of the SE field that enables an Exception Catch debug event for an Exception level that is 
not implemented is reserved. If the SE field is programmed with a reserved value then: 


g The PE behaves as if it is programmed with a defined value, other than for a read of 
EDECCR. 


° The value returned for SE by a read of EDECCR is UNKNOWN. 
On a Cold reset, this field resets to Q. 
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Otherwise: 





Bits [31:8] 


Reserved, RESO. 


NSE<n>, bit [n+4], for n = 0 to 3 


Coarse-grained Non-secure exception catch. If EL3 and EL2 are not implemented and the PE 
behaves as if SCR_EL3.NS is set to 0, this field is reserved, RESO. Otherwise, possible values for 
this field are: 


0bd Exception Catch debug events are disabled for Non-secure Exception level <n>. 
Qb1 Exception Catch debug events are enabled for Non-secure Exception level <n>. 


A value of the NSE field that enables an Exception Catch debug event for an Exception level that is 
not implemented is reserved. If the NSE field is programmed with a reserved value then: 


à The PE behaves as if it is programmed with a defined value, other than for a read of 
EDECCR. 


s The value returned for NSE by a read of EDECCR is UNKNOWN. 


SE<n>, bit [n], for n = 0 to 3 


Coarse-grained Secure exception catch. If EL3 is not implemented and the PE behaves as if 
SCR_EL3.NS is set to 1, this field is reserved, RESO. Otherwise, possible values for this field are: 


0bd Exception Catch debug events are disabled for Secure Exception level <n>. 
Qb1 Exception Catch debug events are enabled for Secure Exception level <n>. 


A value of the SE field that enables an Exception Catch debug event for an Exception level that is 
not implemented is reserved. If the SE field is programmed with a reserved value then: 


- The PE behaves as if it is programmed with a defined value, other than for a read of 
EDECCR. 


- The value returned for SE by a read of EDECCR is UNKNOWN. 


Accessing the EDECCR: 


EDECCR can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x098 EDECCR 
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This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are RW. 


. Otherwise accesses to this register generate an error response. 
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H9.2.26 


H9-6904 


EDECR, External Debug Execution Control Register 


The EDECR characteristics are: 


Purpose 
Controls Halting debug events. 
Configurations 
It is IMPLEMENTATION DEFINED whether EDECR is implemented in the Core power domain or in 
the Debug power domain. Some or all RW fields of this register have defined reset values, and: 
- The register is not affected by a Warm reset. 
° If the register is implemented in the Core power domain the reset values apply on a Cold 
reset, and the register is not affected by an External debug reset. 
. If the register is implemented in the Debug power domain the reset values apply on an 
External debug reset, and the register is not affected by a Cold reset. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 
Attributes 


EDECR is a 32-bit register. 


Field descriptions 


The EDECR bit assignments are: 


Bits [31:3] 


Reserved, RESO. 


SS, bit [2] 
Halting step enable. Possible values of this field are: 
Qbe Halting step debug event disabled. 
Qb1 Halting step debug event enabled. 


If the value of EDECR:SS is changed when the PE is in Non-debug state, behavior is CONSTRAINED 
UNPREDICTABLE as described in Changing the value of EDECR.SS when not in Debug state on 
page H3-6753. 


The following resets apply: 
è On a Cold reset, if ARMv8.3-DoPD is implemented, this field resets to 0. 
. On a Debug reset, if ARMv8.3-DoPD is not implemented, this field resets to 0. 


Bit [1] 
When ARMV8.3-DoPD is implemented: 
Reserved, RESO. 
Otherwise: 
Reset Catch Enable. 
0bd Reset Catch debug event disabled. 
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Qb1 Reset Catch debug event enabled. 
On a External debug reset, this field resets to 0. 
Bit [0] 
When ARMvV8.3-DoPD is implemented: 


Reserved, RESO. 


Otherwise: 
OS Unlock Catch Enable. 
0bd OS Unlock Catch debug event disabled. 
Qb1 OS Unlock Catch debug event enabled. 


On a External debug reset, this field resets to 0. 


Accessing the EDECR: 


EDECR can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x024 EDECR 





This interface is accessible as follows: 


. When (ARMv8.3-DoPD is not implemented or IsCorePowered()) and SoftwareLockStatus() accesses to this 
register are RO. 


. When (ARMv8.3-DoPD is not implemented or IsCorePowered()) and !SoftwareLockStatus() accesses to this 
register are RW. 


e Otherwise accesses to this register generate an error response. 
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H9.2.27 EDESR, External Debug Event Status Register 


The EDESR characteristics are: 


Purpose 
Indicates the status of internally pending Halting debug events. 

Configurations 
EDESR is in the Core power domain. Some or all RW fields of this register have defined reset 
values. The field descriptions identify when the reset values apply. 

Attributes 


EDESR is a 32-bit register. 


Field descriptions 


The EDESR bit assignments are: 


Bits [31:3] 
Reserved, RESO. 


SS, bit [2] 
When ARMv8.3-DoPD is implemented: 
Halting step debug event pending. Possible values of this field are: 


Qbd Reading this means that a Halting step debug event is not pending. Writing this means 
no action. 
Qb1 Reading this means that a Halting step debug event is pending. Writing this clears the 


pending Halting step debug event. 
On a Cold reset, this field resets to 0. 


Otherwise: 
Halting step debug event pending. Possible values of this field are: 


Qbd Reading this means that a Halting step debug event is not pending. Writing this means 
no action. 
Qb1 Reading this means that a Halting step debug event is pending. Writing this clears the 


pending Halting step debug event. 
On a Warm reset, this field resets to the value in EDECR.SS. 


RC, bit [1] 

Reset Catch debug event pending. Possible values of this field are: 

Qbd Reading this means that a Reset Catch debug event is not pending. Writing this means 
no action. 

Qb1 Reading this means that a Reset Catch debug event is pending. Writing this clears the 
pending Reset Catch debug event. 

On a Warm reset, this field resets to: 

- If ARMv8.3-DoPD is implemented, this field resets to the value in CTIDEVCTL.RCE. 
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. Otherwise, this field resets to the value in EDECR.RCE. 


OSUC, bit [0] 
OS Unlock Catch debug event pending. Possible values of this field are: 


Qbd Reading this means that an OS Unlock Catch debug event is not pending. Writing this 
means no action. 


Qb1 Reading this means that an OS Unlock Catch debug event is pending. Writing this clears 
the pending OS Unlock Catch debug event. 


On a Warm reset, this field resets to 0. 


Accessing the EDESR: 


If a request to clear a pending Halting debug event is received at or about the time when halting becomes allowed, 
it is CONSTRAINED UNPREDICTABLE whether the event is taken. 


If Core power is removed while a Halting debug event is pending, it is lost. However, it might become pending again 
when the Core is powered back on and Cold reset. 


EDESR can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x020 EDESR 





This interface is accessible as follows: 
e When IsCorePowered(), !DoubleLockStatus() and SoftwareLockStatus() accesses to this register are RO. 
. When IsCorePowered(), !DoubleLockStatus() and !SoftwareLockStatus() accesses to this register are RW. 


e Otherwise accesses to this register generate an error response. 
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H9.2.28 


H9-6908 


EDITCTRL, External Debug Integration mode Control register 


The EDITCTRL characteristics are: 


Purpose 


Enables the external debug to switch from its default mode into integration mode, where test 
software can control directly the inputs and outputs of the PE, for integration testing or topology 
detection. 


Configurations 


It is IMPLEMENTATION DEFINED whether EDITCTRL is implemented in the Core power domain or 
in the Debug power domain. Some or all RW fields of this register have defined reset values, and: 


° The register is not affected by a Warm reset. 


° If the register is implemented in the Core power domain the reset values apply on a Cold 
reset, and the register is not affected by an External debug reset. 


° If the register is implemented in the Debug power domain the reset values apply on an 
External debug reset, and the register is not affected by a Cold reset. 


Implementation of this register is OPTIONAL. 


Attributes 
EDITCTRL is a 32-bit register. 


Field descriptions 


The EDITCTRL bit assignments are: 


Bits [31:1] 
Reserved, RESO. 


IME, bit [0] 


Integration mode enable. When IME == 1, the device reverts to an integration mode to enable 
integration testing or topology detection. The integration mode behavior is IMPLEMENTATION 


DEFINED. 
Obd Normal operation. 
Qb1 Integration mode enabled. 


On a Implementation reset, this field resets to 0. 


Accessing the EDITCTRL: 


EDITCTRL can be accessed through the external debug interface: 





Component Offset Instance 


Debug OxF00 EDITCTRL 





Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


External Debug Register Descriptions 
H9.2 External debug registers 


This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are RW. 


° Otherwise accesses to this register are IMPDEF. 
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H9.2.29 


H9-6910 


EDITR, External Debug Instruction Transfer Register 


The EDITR characteristics are: 


Purpose 

Used in Debug state for passing instructions to the PE for execution. 
Configurations 

EDITR is in the Core power domain. 

There are no configuration notes. 
Attributes 


EDITR is a 32-bit register. 


Field descriptions 


The EDITR bit assignments are: 


When in AArch32 state: 


31 1615 0 


T32Second T32First 


T32Second, bits [31:16] 
Second halfword of the T32 instruction to be executed on the PE. When EDITR contains a 16-bit 
T32 instruction, this field is ignored. For more information see Behavior in Debug state on 
page H2-6714 
T32First, bits [15:0] 
First halfword of the T32 instruction to be executed on the PE. 


When in AArch64 state: 

31 0 
A64 instruction to be executed on the PE 

Bits [31:0] 


A64 instruction to be executed on the PE. 


Accessing the EDITR: 


If EDSCR.ITE == 0 when the PE exits Debug state on receiving a Restart request trigger event, the behavior of any 
instruction issued through the ITR in Normal access mode that has not completed execution is CONSTRAINED 
UNPREDICTABLE, and must do one of the following: 


s It must complete execution in Debug state before the PE executes the restart sequence. 
: It must complete execution in Non-debug state before the PE executes the restart sequence. 
° It must be abandoned. This means that the instruction does not execute. Any registers or memory accessed 


by the instruction are left in an UNKNOWN state. 


EDITR ignores writes if the PE is in Non-debug state. 
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EDITR can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x084 EDITR 





This interface is accessible as follows: 


When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are WI. 


When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are WO. 


Otherwise accesses to this register generate an error response. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H9-6911 
Non-Confidential 


External Debug Register Descriptions 
H9.2 External debug registers 


H9.2.30 


H9-6912 


EDLAR, External Debug Lock Access Register 


The EDLAR characteristics are: 


Purpose 
Allows or disallows access to the external debug registers through a memory-mapped interface. 


The optional Software Lock provides a lock to prevent memory-mapped writes to the debug 
registers. Use of this lock mechanism reduces the risk of accidental damage to the contents of the 
debug registers. It does not, and cannot, prevent all accidental or malicious damage. 


Configurations 


It is IMPLEMENTATION DEFINED whether EDLAR is implemented in the Core power domain or in 
the Debug power domain. 


If ARMv8.4-Debug is implemented, the Software Lock is not implemented. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


Software uses EDLAR to set or clear the lock, and EDLSR to check the current status of the lock. 


Attributes 
EDLAR is a 32-bit register. 


Field descriptions 


The EDLAR bit assignments are: 


When the Software Lock is implemented: 


KEY, bits [31:0] 
Lock Access control. Writing the key value @xC5ACCE55 to this field unlocks the lock, enabling write 
accesses to this component's registers through a memory-mapped interface. 


Writing any other value to this register locks the lock, disabling write accesses to this component's 
registers through a memory mapped interface. 


Otherwise: 
31 0 
RESO 
Bits [31:0] 
Reserved, RESO. 
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Accessing the EDLAR: 


EDLAR can be accessed through its memory-mapped interface: 





Component Offset Instance 





Debug OxFBQ EDLAR 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are WO. 
° Otherwise accesses to this register generate an error response. 
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H9.2.31 EDLSR, External Debug Lock Status Register 


The EDLSR characteristics are: 


Purpose 
Indicates the current status of the software lock for external debug registers. 


The optional Software Lock provides a lock to prevent memory-mapped writes to the debug 
registers. Use of this lock mechanism reduces the risk of accidental damage to the contents of the 
debug registers. It does not, and cannot, prevent all accidental or malicious damage. 


Configurations 


It is IMPLEMENTATION DEFINED whether EDLSR is implemented in the Core power domain or in the 
Debug power domain. Some or all RW fields of this register have defined reset values, and: 


. The register is not affected by a Warm reset. 


° If the register is implemented in the Core power domain the reset values apply on a Cold 
reset, and the register is not affected by an External debug reset. 


- If the register is implemented in the Debug power domain the reset values apply on an 
External debug reset, and the register is not affected by a Cold reset. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


If ARMv8.4-Debug is implemented, the Software Lock is not implemented. 
Software uses EDLAR to set or clear the lock, and EDLSR to check the current status of the lock. 


Attributes 
EDLSR is a 32-bit register. 


Field descriptions 


The EDLSR bit assignments are: 


Bits [31:3] 

Reserved, RESO. 
nTT, bit [2] 

Not thirty-two bit access required. RAZ. 
SLK, bit [1] 


When the Software Lock is implemented: 


Software Lock status for this component. For an access to LSR that is not amemory-mapped access, 
or when the Software Lock is not implemented, this field is RESO. 


For memory-mapped accesses when the Software Lock is implemented, possible values of this field 


are: 
Qbd Lock clear. Writes are permitted to this component's registers. 
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Qb1 Lock set. Writes to this component's registers are ignored, and reads have no side 
effects. 


The following resets apply: 


° If Armv8.3-DoPD is implemented, this register is reset by Cold reset and not affected by 
External debug reset. If Armv8.3-DoPD is not implemented, this register is reset by External 
debug reset and not affected by Cold reset. 


° On a reset, this field resets to 1. 
Otherwise: 


Reserved, RAZ. 


SLI, bit [0] 


Software Lock implemented. For an access to LSR that is not a memory-mapped access, this field 
is RAZ. For memory-mapped accesses, the value of this field is IMPLEMENTATION DEFINED. 
Permitted values are: 


0b0ð Software Lock not implemented or not memory-mapped access. 


Qb1 Software Lock implemented and memory-mapped access. 


Accessing the EDLSR: 


EDLSR can be accessed through its memory-mapped interface: 





Component Offset Instance 





Debug OxFB4 EDLSR 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.32 


H9-6916 


EDPCSR, External Debug Program Counter Sample Register 


The EDPCSR characteristics are: 


Purpose 


Holds a sampled instruction address value. 


Configurations 


Attributes 


EDPCSR is in the Core power domain. 


Fields in this register reset to architecturally UNKNOWN values. These apply only on a Cold reset. 
The register is not affected by a Warm reset and is not affected by an External debug reset. 


Implemented only if the OPTIONAL PC Sample-based Profiling Extension is implemented in the 
external debug registers space. 
Note 


ARMv8.2-PCSample implements the PC Sample-based Profiling Extension in the Performance 
Monitors registers space. 








EDPCSR is a pair of 32-bit registers. 


If ARMv8.1-VHE is implemented, the format of this register differs depending on the value of 
EDSCR.SC2. 


Field descriptions 


The EDPCSR bit assignments are: 


When ARMv8.1-VHE is not implemented: 


63 


PC Sample high word, EDPCSRhi 


Bits [63:32] 


32 31 0 


PC Sample low word 





PC Sample high word, EDPCSRhi. If EDVIDSR.HV == 0 then this field is RAZ, otherwise bits 
[63:32] of the sampled instruction address value. The translation regime that EDPCSR samples can 
be determined from EDVIDSR. {NS,E2,E3}. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [31:0] 
PC Sample low word. EDPCSRIo, bits[31:0] of the sampled instruction address value. The 
translation regime that EDPCSR samples can be determined from EDVIDSR. {NS,E2,E3}. 
$ For a read of EDPCSR[31:0] from the memory-mapped interface, if EDLSR.SLK == 1, 
meaning the OPTIONAL Software Lock is locked, then the access has no side-effects. 
s In any other cases, a read of EDPCSR[31:0] has the side-effect of indirectly writing to 
EDPCSRhi, EDCIDSR, and EDVIDSR: 
— Ifthe PE is in Debug state, or PC Sample-based profiling is prohibited, EDPCSRlo 
reads as OxFFFFFFFF, and EDPCSRhi, EDCIDSR, and EDVIDSR become UNKNOWN. 
— Ifthe PE is in Reset state, the sampled value is UNKNOWN and EDPCSRhi, EDCIDSR, 
and EDVIDSR become UNKNOWN. 
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— Ifno instruction has been sampled since the PE left Reset state, Debug state, or a state 
where PC Sample-based profiling is prohibited, the sampled value is 0xFFFFFFFF, and 
EDPCSRhi, EDCIDSR, and EDVIDSR become UNKNOWN. Any subsequent read will 
return an instruction address value. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When ARMv8.1-VHE is implemented and EDSCR.SC2 == 0: 


63 32 31 0 


PC Sample high word, EDPCSRhi PC Sample low word 





Bits [63:32] 
When ARMV8.1-VHE is implemented: 


PC Sample high word, EDPCSRhi. If EDVIDSR.HV == 0 then this field is RAZ, otherwise bits 
[63:32] of the sampled instruction address value. The translation regime that EDPCSR samples can 
be determined from EDVIDSR. {NS,E2,E3}. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [31:0] 
When ARMV8.1-VHE is implemented: 


PC Sample low word. EDPCSRlo, bits[31:0] of the sampled instruction address value. The 
translation regime that EDPCSR samples can be determined from EDVIDSR. {NS,E2,E3}. 


. For a read of EDPCSR[31:0] from the memory-mapped interface, if EDLSR.SLK == 1, 
meaning the OPTIONAL Software Lock is locked, then the access has no side-effects. 


- In any other cases, a read of EDPCSR[31:0] has the side-effect of indirectly writing to 
EDPCSRhi, EDCIDSR, and EDVIDSR: 


— Ifthe PE is in Debug state, or PC Sample-based profiling is prohibited, EDPCSRlo 
reads as OxFFFFFFFF, and EDPCSRhi, EDCIDSR, and EDVIDSR become UNKNOWN. 


— If the PE is in Reset state, the sampled value is UNKNOWN and EDPCSRhi, EDCIDSR, 
and EDVIDSR become UNKNOWN. 


— If no instruction has been retired since the PE left Reset state, Debug state, or a state 
where PC Sample-based profiling is prohibited, the sampled value is UNKNOWN, and 
EDPCSRhi, EDCIDSR, and EDVIDSR become UNKNOWN. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


When ARMv8.1-VHE is implemented and EDSCR.SC2 == 1: 


63 62 6160 |, 56 55 32 31 0 


RESO PC Sample high word, EDPCSRhi PC Sample low word 
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NS, bit [63] 
When ARMv8.1-VHE is implemented: 


Non-secure state sample. Indicates the Security state that is associated with the most recent 
EDPCSR sample or, when it is read as a single atomic 64-bit read, the current EDPCSR sample. The 
translation regime that EDPCSR samples can be determined from EDPCSR. {NS,EL}. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
EL, bits [62:61] 
When ARMv8.1-VHE is implemented: 


Exception level status sample. Indicates the Exception level that is associated with the most recent 
EDPCSR sample or, when it is read as a single atomic 64-bit read, the current EDPCSR sample. The 
translation regime that EDPCSR samples can be determined from EDPCSR. {NS,EL}. 


0b00 Sample is from ELO. 
0b01 Sample is from EL1. 
0b10 Sample is from EL2. 
0b11 Sample is from EL3. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [60:56] 


Reserved, RESO. 


Bits [55:32] 
When ARMv8.1-VHE is implemented: 


PC Sample high word, EDPCSRhi. Bits [55:32] of the sampled instruction address value. The 
translation regime that EDPCSR samples can be determined from EDPCSR. {NS,EL}. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bits [31:0] 
When ARMv8.1-VHE is implemented: 


PC Sample low word. EDPCSRlo, bits[31:0] of the sampled instruction address value. The 
translation regime that EDPCSR samples can be determined from EDVIDSR. {NS,E2,E3}. 


s For a read of EDPCSR[31:0] from the memory-mapped interface, if EDLSR.SLK = 1, 
meaning the OPTIONAL Software Lock is locked, then the access has no side-effects. 


. In any other cases, a read of EDPCSR[31:0] has the side-effect of indirectly writing to 
EDPCSRhi, EDCIDSR, and EDVIDSR: 


— Ifthe PE is in Debug state, or PC Sample-based profiling is prohibited, EDPCSRlo 
reads as OxFFFFFFFF, and EDPCSRhi, EDCIDSR, and EDVIDSR become UNKNOWN. 


— If the PE is in Reset state, the sampled value is UNKNOWN and EDPCSRhi, EDCIDSR, 
and EDVIDSR become UNKNOWN. 


— If no instruction has been retired since the PE left Reset state, Debug state, or a state 
where PC Sample-based profiling is prohibited, the sampled value is UNKNOWN, and 
EDPCSRhi, EDCIDSR, and EDVIDSR become UNKNOWN. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


H9-6918 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


63 


ARM DDI 0487E.a 
ID070919 


External Debug Register Descriptions 
H9.2 External debug registers 


Otherwise: 


Reserved, RESO. 


When ARMv8.2-PCSample is implemented: 


RESO 


Bits [63:0] 


Reserved, RESO. 


Accessing the EDPCSR: 


IMPLEMENTATION DEFINED extensions to external debug might make the value of this register UNKNOWN, see 
Permitted behavior that might make the PC Sample-based profiling registers UNKNOWN on page H7-6824 


EDPCSRJ3 1:0] can be accessed through its memory-mapped interface: 





Component Offset Instance Range 


Debug Ox0AQ EDPCSR 31:0 





This interface is accessible as follows: 
° When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to EDPCSR[31:0] are RO. 


° Otherwise accesses to EDPCSR[31:0] generate an error response. 


EDPCSR[63:32] can be accessed through the external debug interface: 





Component Offset Instance Range 


Debug Ox@AC EDPCSR 63:32 





This interface is accessible as follows: 
e When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to EDPCSR[63:32] are RO. 


° Otherwise accesses to EDPCSR[63:32] generate an error response. 
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H9.2.33 EDPFR, External Debug Processor Feature Register 
The EDPFR characteristics are: 


Purpose 
Provides information about implemented PE features. 
For general information about the interpretation of the ID registers, see Principles of the ID scheme 
for fields in ID registers on page D13-2823. 

Configurations 


It is IMPLEMENTATION DEFINED whether EDPFR is implemented in the Core power domain or in the 
Debug power domain. 


There are no configuration notes. 


Attributes 
EDPFR is a 64-bit register. 


Field descriptions 


The EDPFR bit assignments are: 


63 60 59 56 55 52 51 48 47 44 43 40 39 36 35 32 31 28 27, 24 23 20 19161912 11.8 7,4 3,0 


AMU SEL2| SVE GIC FP | EL3 | EL2 | EL1 | ELO 
UNKNOWN io Sac eer 
UNKNOWN UNKNOWN 
RESO 
UNKNOWN 
UNKNOWN 


UNKNOWN, bits [63:60] 
From ARMV8.5: 
Reserved, UNKNOWN. 
Otherwise: 


Reserved, RESO. 


UNKNOWN, bits [59:56] 
From ARMV8.5: 
Reserved, UNKNOWN. 
Otherwise: 
Reserved, RESO. 
Bits [55:52] 
Reserved, RESO. 
UNKNOWN, bits [51:48] 
From ARMV8.4: 
Reserved, UNKNOWN. 
Otherwise: 


Reserved, RESO. 
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AMU, bits [47:44] 

From ARMv8.4: 
Activity Monitors Extension. Defined values are: 
0b0000 Activity Monitors Extension is not implemented. 
0b0001 Activity Monitors Extension version | is implemented. 
All other values are reserved. 
AMUvI on page A2-93 implements the functionality identified by the value 0b0001. 
In Armv8.0, Armv8.1, Armv8.2, and Armv8.3, the only permitted value is 0b0000. 
From Armv8.4, the permitted values are 0b0000 and 0b0001. 

Otherwise: 


Reserved, RESO. 


UNKNOWN, bits [43:40] 
From ARMv8.2: 
Reserved, UNKNOWN. 
Otherwise: 


Reserved, RESO. 


SEL2, bits [39:36] 
From ARMv8.4: 
Secure EL2. Defined values are: 
0b0000 Secure EL2 is not implemented. 
0b0001 Secure EL2 is implemented. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


SVE, bits [35:32] 
From ARMv8.2: 
Scalable Vector Extension. Defined values are: 
0b0000 SVE is not implemented. 
0b0001 SVE is implemented. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 


UNKNOWN, bits [31:28] 
From Armv8.2: 
Reserved, UNKNOWN. 
Otherwise: 


Reserved, RESO. 


GIC, bits [27:24] 
System register GIC interface support. Defined values are: 
0b0000 No System register interface to the GIC is supported. 
0b0001 System register interface to versions 3.0 and 4.0 of the GIC CPU interface is supported. 


All other values are reserved. 
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In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_AA64PFRO_ EL1.GIC. 


AdvSIMD, bits [23:20] 


Advanced SIMD. Defined values are: 
0b0000 Advanced SIMD is implemented, including support for the following SISD and SIMD 


operations: 

. Integer byte, halfword, word and doubleword element operations. 

° Single-precision and double-precision floating-point arithmetic. 

° Conversions between single-precision and half-precision data types, and 


double-precision and half-precision data types. 
0b0001 As for 0b0000, and also includes support for half-precision floating-point arithmetic. 
0b1111 Advanced SIMD is not implemented. 
All other values are reserved. 
This field must have the same value as the FP field. 
The permitted values are: 


è 0b0000 in an implementation with Advanced SIMD support, that does not include the 
ARMv8.2-FP16 extension. 


è 0b0001 in an implementation with Advanced SIMD support, that includes the 
ARMv8.2-FP16 extension. 


s 0b1111 in an implementation without Advanced SIMD support. 


In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID AA64PFRO_EL1.AdvSIMD. 


FP, bits [19:16] 


Floating-point. Defined values are: 
0b0000 Floating-point is implemented, and includes support for: 
° Single-precision and double-precision floating-point types. 


° Conversions between single-precision and half-precision data types, and 
double-precision and half-precision data types. 


0b0001 As for 0b0000, and also includes support for half-precision floating-point arithmetic. 
0b1111 Floating-point is not implemented. 

All other values are reserved. 

This field must have the same value as the AdvSIMD field. 

The permitted values are: 


$ 0b0000 in an implementation with floating-point support, that does not include the 
ARMv8.2-FP16 extension. 


- 0b0001 in an implementation with floating-point support, that includes the ARMv8.2-FP16 
extension. 


° 0b1111 in an implementation without floating-point support. 


In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_AA64PFR0_EL1.FP. 


EL3, bits [15:12] 


AArch64 EL3 Exception level handling. Defined values are: 

0b0000 EL3 is not implemented or cannot be executed in AArch64 state. 
0b0001 EL3 can be executed in AArch64 state only. 

0b0010 EL3 can be executed in either AArch64 or AArch32 state. 
When the value of EDAA32PFR.EL3 is non-zero, this field must be 0b0000. 
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All other values are reserved. 
In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_AA64PFRO_EL1.EL3. 
EL2, bits [11:8] 
AArch64 EL2 Exception level handling. Defined values are: 
0b0000 EL2 is not implemented or cannot be executed in AArch64 state. 
0b0001 EL2 can be executed in AArch64 state only. 
0b0010 EL2 can be executed in either AArch64 or AArch32 state. 
When the value of EDAA32PFR.EL2 is non-zero, this field must be 0b0000. 
All other values are reserved. 
In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_AA64PFRO_ EL1.EL2. 
EL, bits [7:4] 
AArch64 EL! Exception level handling. Defined values are: 
0b0000 ELI can be executed in AArch32 state only. 
0b0001 ELI can be executed in AArch64 state only. 
0b0010 ELI can be executed in either AArch64 or AArch3?2 state. 
All other values are reserved. 
In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_AA64PFRO EL1.EL1. 
ELO, bits [3:0] 
AArch64 ELO Exception level handling. Defined values are: 
0b0000 ELO can be executed in AArch32 state only. 
0b0001 ELO can be executed in AArch64 state only. 
0b0010 ELO can be executed in either AArch64 or AArch3?2 state. 
All other values are reserved. 


In an Armv8-A implementation that supports AArch64 state in at least one Exception level, this 
field returns the value of ID_AA64PFRO EL1.EL0. 


Accessing the EDPFR: 


EDPFR{[3 1:0] can be accessed through the external debug interface: 





Component Offset Instance Range 


Debug QxD20 EDPFR 31:0 





This interface is accessible as follows: 
. When IsCorePowered() and !DoubleLockStatus() accesses to EDPFR[31:0] are RO. 
° Otherwise accesses to EDPFR[31:0] are IMPDEF. 


EDPFR[63:32] can be accessed through the external debug interface: 


Component Offset Instance Range 


Debug 0xD24 EDPFR 63:32 
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This interface is accessible as follows: 
. When IsCorePowered() and !DoubleLockStatus() accesses to EDPFR[63:32] are RO. 


° Otherwise accesses to EDPFR[63:32] are IMPDEF. 
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H9.2.34 EDPIDRO, External Debug Peripheral Identification Register 0 
The EDPIDRO characteristics are: 


Purpose 
Provides information to identify an external debug component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether EDPIDRO is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
EDPIDR0O is a 32-bit register. 


Field descriptions 


The EDPIDRO bit assignments are: 


31 8 7 0 
RESO PART_0 
Bits [31:8] 


Reserved, RESO. 


PART. 0, bits [7:0] 


Part number, least significant byte. 


Accessing the EDPIDRO: 


EDPIDRO can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFEQ EDPIDRO 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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H9.2.35 EDPIDR1, External Debug Peripheral Identification Register 1 
The EDPIDRI characteristics are: 


Purpose 
Provides information to identify an external debug component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether EDPIDR1 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
EDPIDR1 is a 32-bit register. 


Field descriptions 


The EDPIDR1 bit assignments are: 


31 8 7 43 0 
RESO DES_0 | PART1 
Bits [31:8] 


Reserved, RESO. 


DES _0, bits [7:4] 
Designer, least significant nibble of JEP106 ID code. For Arm Limited, this field is 0b1011. 


PART 1, bits [3:0] 


Part number, most significant nibble. 


Accessing the EDPIDR1: 


EDPIDRI can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFE4 EDPIDR1 
This interface is accessible as follows: 
° When ARMxv8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.36 EDPIDR2, External Debug Peripheral Identification Register 2 


ARM DDI 0487E.a 
ID070919 


The EDPIDR2 characteristics are: 


Purpose 
Provides information to identify an external debug component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether EDPIDR2 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
EDPIDR2 is a 32-bit register. 


Field descriptions 


The EDPIDR2 bit assignments are: 


31 8 7 432 0 
RESO REVISION 7 DES 1 
EE 
Bits [31:8] 


Reserved, RESO. 


REVISION, bits [7:4] 


Part major revision. Parts can also use this field to extend Part number to 16-bits. 


JEDEC, bit [3] 
RAO. Indicates a JEP 106 identity code is used. 


DES _1, bits [2:0] 
Designer, most significant bits of JEP106 ID code. For Arm Limited, this field is 0b011. 


Accessing the EDPIDR2: 


EDPIDR2 can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFE8 EDPIDR2 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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H9.2.37 EDPIDR3, External Debug Peripheral Identification Register 3 
The EDPIDR3 characteristics are: 


Purpose 
Provides information to identify an external debug component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether EDPIDR3 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
EDPIDR3 is a 32-bit register. 


Field descriptions 


The EDPIDR3 bit assignments are: 


31 8 7 4 3 0 
RESO REVAND | CMOD 
Bits [31:8] 


Reserved, RESO. 


REVAND, bits [7:4] 
Part minor revision. Parts using EDPIDR2.REVISION as an extension to the Part number must use 
this field as a major revision number. 


CMOD, bits [3:0] 
Customer modified. Indicates someone other than the Designer has modified the component. 


Accessing the EDPIDR3: 


EDPIDR3 can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFEC EDPIDR3 
This interface is accessible as follows: 
° When ARMVv8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.38 EDPIDR4, External Debug Peripheral Identification Register 4 
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The EDPIDR4 characteristics are: 


Purpose 
Provides information to identify an external debug component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether EDPIDR4 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
EDPIDR4 is a 32-bit register. 


Field descriptions 


The EDPIDR4 bit assignments are: 


31 8 7 43 0 
RESO SIZE DES 2 
Bits [31:8] 


Reserved, RESO. 


SIZE, bits [7:4] 
Size of the component. RAZ. Log» of the number of 4KB pages from the start of the component to 
the end of the component ID registers. 


DES 2, bits [3:0] 
Designer, JEP106 continuation code, least significant nibble. For Arm Limited, this field is 0b0100. 


Accessing the EDPIDR4: 
EDPIDR4 can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxFDO EDPIDR4 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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H9.2.39 EDPRCR, External Debug Power/Reset Control Register 
The EDPRCR characteristics are: 


Purpose 


Controls the PE functionality related to powerup, reset, and powerdown. 


Configurations 


EDPRCR contains fields that are in the Core power domain and fields that are in the Debug power 
domain. 


For RW fields see the field description for a description of the behavior of the field on a reset that 
applies to its power domain. However: 


° Fields that are in the Core power domain are not affected by a warm reset and are not affected 
by an External debug reset. 


e Fields that are in the Debug power domain reset to their defined reset values on an External 
debug reset, and are not affected by a Warm reset and are not affected by a Cold reset. 


If ARMv8.3-DoPD is implemented then all fields in this register are in the Core power domain. 
CORENPDRQ is the only field that is mapped between the EDPRCR and DBGPRCR and 
DBGPRCR _EL1. 

Attributes 
EDPRCR is a 32-bit register. 


Field descriptions 


The EDPRCR bit assignments are: 


When ARMv8.3-DoPD is implemented: 


| | CORENPDRQ 
CWRR 


Bits [31:2] 


Reserved, RESO. 


CWRR, bit [1] 
Warm reset request. Write-only bit that reads as zero. 
The extent of the reset is IMPLEMENTATION DEFINED, but must be one of: 
° The request is ignored. 
° Only this PE is Warm reset. 
° This PE and other components of the system, possibly including other PEs, are Warm reset. 
Arm deprecates use of this bit, and recommends that implementations ignore the request. 
0b0ð No action. 
Qb1 Request Warm reset. 


This field is in the Core power domain 
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The PE ignores writes to this bit if any of the following are true: 


° ExternalInvasiveDebugEnabled() == FALSE, EL3 is not implemented, and the implemented 
Security state is Non-secure state. 


$ ExternalSecureInvasiveDebugEnabled() == FALSE, EL3 is not implemented, and the 
implemented Security state is Secure state. 


- ExternalSecureInvasiveDebugEnabled() == FALSE and EL3 is implemented. 


In an implementation that includes the recommended external debug interface, this bit drives the 
DBGRSTREQ signal. 


On a Warm reset, this field resets to 0. 


Accessing this field has the following behavior: 


. When !IsCorePowered(), or DoubleLockStatus(), or OSLockStatus() or 
SoftwareLockStatus(), access to this field is WI. 


° Otherwise, access to this field is WO. 


CORENPDRQ, bit [0] 
Core no powerdown request. Requests emulation of powerdown. 


This request is typically passed to an external power controller. This means that whether a request 
causes power up is dependent on the IMPLEMENTATION DEFINED nature of the system. The power 
controller must not allow the Core power domain to switch off while this bit is 1. 


0bd If the system responds to a powerdown request, it powers down Core power domain. 


Qb1 If the system responds to a powerdown request, it does not powerdown the Core power 
domain, but instead emulates a powerdown of that domain. 


When this bit reads as UNKNOWN, the PE ignores writes to this bit. 


This field is in the Core power domain, and permitted accesses to this field map to the 
DBGPRCR.CORENPDRQ and DBGPRCR_EL1.CORENPDRQ fields. 


In an implementation that includes the recommended external debug interface, this bit drives the 
DBGNOPWRDWN signal. 


It is IMPLEMENTATION DEFINED whether this bit is reset to the value of EDPRCR.COREPURQ on 
exit from an IMPLEMENTATION DEFINED software-visible retention state. For more information 
about retention states see Core power domain power states on page H6-6808. 


— Note 


Writes to this bit are not prohibited by the IMPLEMENTATION DEFINED authentication interface. This 
means that a debugger can request emulation of powerdown regardless of whether invasive debug 
is permitted. 


On a Cold reset, this field resets to the value in EDPRCR.COREPURQ. 


Accessing this field has the following behavior: 
. When !IsCorePowered(), or DoubleLockStatus() or OSLockStatus(), access to this field is 


UNKNOWN. 
. When SoftwareLockStatus(), access to this field is RO. 
. Otherwise, access to this field is RW. 
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Otherwise: 


| | CORENPDRQ 
CWRR 


RESO 
COREPURQ 


Bits [31:4] 


Reserved, RESO. 


COREPURQ bit [3] 


Core powerup request. Allows a debugger to request that the power controller power up the core, 
enabling access to the debug register in the Core power domain, and that the power controller 
emulates powerdown. 

This request is typically passed to an external power controller. This means that whether a request 
causes power up is dependent on the IMPLEMENTATION DEFINED nature of the system. The power 
controller must not allow the Core power domain to switch off while this bit is 1. 


ObO Do not request power up of the Core power domain. 
0b1 Request power up of the Core power domain, and emulation of powerdown. 


In an implementation that includes the recommended external debug interface, this bit drives the 
DBGPWRUPREQ signal. 


This field is in the Debug power domain and can be read and written when the Core power domain 
is powered off. 


Note 


Writes to this bit are not prohibited by the IMPLEMENTATION DEFINED authentication interface. This 
means that a debugger can request emulation of powerdown regardless of whether invasive debug 
is permitted. 








On a External debug reset, this field resets to 0. 


Accessing this field has the following behavior: 
. When SoftwareLockStatus(), access to this field is RO. 
. Otherwise, access to this field is RW. 


Bit [2] 
Reserved, RESO. 
CWRR, bit [1] 
Warm reset request. Write-only bit that reads as zero. 
The extent of the reset is IMPLEMENTATION DEFINED, but must be one of: 
° The request is ignored. 
° Only this PE is Warm reset. 
° This PE and other components of the system, possibly including other PEs, are Warm reset. 


Arm deprecates use of this bit, and recommends that implementations ignore the request. 


0b0 No action. 
Qb1 Request Warm reset. 
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This field is in the Core power domain 
The PE ignores writes to this bit if any of the following are true: 


° ExternalInvasiveDebugEnabled() == FALSE, EL3 is not implemented, and the implemented 
Security state is Non-secure state. 


. ExternalSecureInvasiveDebugEnabled() == FALSE, EL3 is not implemented, and the 
implemented Security state is Secure state. 


. ExternalSecureInvasiveDebugEnabled() == FALSE and EL3 is implemented. 


In an implementation that includes the recommended external debug interface, this bit drives the 
DBGRSTREQ signal. 


On a Warm reset, this field resets to 0. 


Accessing this field has the following behavior: 


. When !IsCorePowered(), or DoubleLockStatus(), or OSLockStatus() or 
SoftwareLockStatus(), access to this field is WI. 


. Otherwise, access to this field is WO. 


CORENPDRQ, bit [0] 
Core no powerdown request. Requests emulation of powerdown. 


This request is typically passed to an external power controller. This means that whether a request 
causes power up is dependent on the IMPLEMENTATION DEFINED nature of the system. The power 
controller must not allow the Core power domain to switch off while this bit is 1. 


0bd If the system responds to a powerdown request, it powers down Core power domain. 


Qb1 If the system responds to a powerdown request, it does not powerdown the Core power 
domain, but instead emulates a powerdown of that domain. 


When this bit reads as UNKNOWN, the PE ignores writes to this bit. 


This field is in the Core power domain, and permitted accesses to this field map to the 
DBGPRCR.CORENPDRQ and DBGPRCR_EL1.CORENPDRQ fields. 


In an implementation that includes the recommended external debug interface, this bit drives the 
DBGNOPWRDWN signal. 


It is IMPLEMENTATION DEFINED whether this bit is reset to the value of EDPRCR.COREPURQ on 
exit from an IMPLEMENTATION DEFINED software-visible retention state. For more information 
about retention states see Core power domain power states on page H6-6808. 





Note 


Writes to this bit are not prohibited by the IMPLEMENTATION DEFINED authentication interface. This 
means that a debugger can request emulation of powerdown regardless of whether invasive debug 
is permitted. 





On a Cold reset, this field resets to the value in EDPRCR.COREPURQ. 


Accessing this field has the following behavior: 
. When !IsCorePowered(), or DoubleLockStatus() or OSLockStatus(), access to this field is 


UNKNOWN. 
. When SoftwareLockStatus(), access to this field is RO. 
. Otherwise, access to this field is RW. 


Accessing the EDPRCR: 


On permitted accesses to the register, other access controls affect the behavior of some fields. See the field 
descriptions for more information. 
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EDPRCR can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x310 EDPRCR 





This interface is accessible as follows: 


. When (ARMv8.3-DoPD is not implemented or IsCorePowered()) and SoftwareLockStatus() accesses to this 
register are RO. 


° When (ARMv8.3-DoPD is not implemented or IsCorePowered()) and !SoftwareLockStatus() accesses to this 
register are RW. 


. Otherwise accesses to this register generate an error response. 
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H9.2.40 EDPRSR, External Debug Processor Status Register 


ARM DDI 0487E.a 
ID070919 


The EDPRSR characteristics are: 


Purpose 


Holds information about the reset and powerdown state of the PE. 


Configurations 


Attributes 


EDPRSR contains fields that are in the Core power domain and fields that are in the Debug power 
domain. 


Some of the fields in the Core power domain are in the Cold reset domain and others are in the Warm 
reset domain. See the field descriptions for more information. However: 


° Fields that are in the Cold reset domain are not affected by a warm reset and are not affected 
by an External debug reset. 


° Fields in the Warm reset domain are also reset by a Cold reset but are not affected by an 
External debug reset. 


° Fields in the Debug power domain are not affected by a Warm reset and are not affected by 
a Cold reset. 


If ARMv8.3-DoPD is implemented then all fields in this register are in the Core power domain. 


EDPRSR is a 32-bit register. 


Field descriptions 


The EDPRSR bit assignments are: 


1211109 8 765 4321 0 





7 ae 
HALTED 


OSLK 
DLK 
EDAD 
SDAD 
EPMAD 
SPMAD 
SDR 
Bits [31:12] 
Reserved, RESO. 
SDR, bit [11] 
Sticky Debug Restart. Set to 1 when the PE exits Debug state. 
Permitted values are: 
ObO The PE has not restarted since EDPRSR was last read. 
Qb1 The PE has restarted since EDPRSR was last read. 
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Note 


Ifa reset occurs when the PE is in Debug state, the PE exits Debug state. SDR is UNKNOWN on Warm 
reset, meaning a debugger must also use the SR bit to determine whether the PE has left Debug state. 





If The Core power domain is powered up, then following a read of EDPRSR: 


. If ARMv8.0-DoubleLock is not implemented or DoubleLockStatus() == FALSE this bit 
clears to 0. 


. If ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE, it is 
CONSTRAINED UNPREDICTABLE whether this bit clears to 0 or is unchanged. 


This field is in the Core power domain and the Warm reset domain. 
This field resets to an architecturally UNKNOWN value. 


Accessing this field has the following behavior: 
° When !IsCorePowered(), or DoubleLockStatus() or EDPRSR.R == 1, access to this field is 


UNKNOWN. 
. When SoftwareLockStatus(), access to this field is RO. 
° Otherwise, access to this field is RC. 


SPMAD, bit [10] 
When ARMV8.4-Debug is implemented: 


Sticky EPMAD error. Set to 1 if an external debug interface access to a Performance Monitors 
register returns an error because AllowExternalPMUAccess() == FALSE. 


Permitted values are: 


0bd No Non-secure external debug interface accesses to the external Performance Monitors 
registers have failed because AllowExternalPMUAccess() == FALSE for the access since 
EDPRSR was last read. 


Qb1 At least one Non-secure external debug interface access to the external Performance 
Monitors register has failed and returned an error because Al lowExternalPMUAccess() == 
FALSE for the access since EDPRSR was last read. 


If the Core power domain is powered up, then, following a read of EDPRSR: 


. If ARMv8.0-DoubleLock is not implemented or DoubleLockStatus() == FALSE, this bit 
clears to 0. 


- If ARMv8.0-DoubleLock is implemented, and DoubleLockStatus() == TRUE, it is 
CONSTRAINED UNPREDICTABLE whether this bit clears to 0 or is unchanged. 


This field is in the Core power domain. 
On a Cold reset, this field resets to 0. 


Accessing this field has the following behavior: 


. When !IsCorePowered(), or DoubleLockStatus() or EDPRSR.R == 1, access to this field is 
UNKNOWN. 


. When SoftwareLockStatus(), access to this field is RO. 
° Otherwise, access to this field is RC. 

Otherwise: 
Sticky EPMAD error. 


Qbd No external debug interface accesses to the Performance Monitors registers have failed 
because AllowExternalPMUAccess() == FALSE since EDPRSR was last read. 


Qb1 At least one external debug interface access to the Performance Monitors registers has 
failed and returned an error because AllowExternalPMUAccess() == FALSE since 
EDPRSR was last read. 


If the Core power domain is powered up, then, following a read of EDPRSR: 


. If ARMv8.0-DoubleLock is not implemented or DoubleLockStatus() == FALSE, this bit 
clears to 0. 
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à If ARMv8.0-DoubleLock is implemented, and DoubleLockStatus() == TRUE, it is 
CONSTRAINED UNPREDICTABLE whether this bit clears to 0 or is unchanged. 


This field is in the Core power domain. 
On a Cold reset, this field resets to 0. 


Accessing this field has the following behavior: 


. When !IsCorePowered(), or OSLockStatus(), or DoubleLockStatus() or EDPRSR.R == 1, 
access to this field is UNKNOWN. 


. When SoftwareLockStatus(), access to this field is RO. 
. Otherwise, access to this field is RC. 


EPMAD, bit [9] 
When ARMv8.4-Debug is implemented: 
External Performance Monitors Access Disable status. 


Oba External Non-secure Performance Monitors access enabled. AllowExternal PMUAccess() 
== TRUE for a Non-secure access. 


Qb1 External Non-secure Performance Monitors access disabled. Al]lowExternal PMUAccess() 
== FALSE for a Non-secure access. 


This field is in the Core power domain. 


Accessing this field has the following behavior: 


. When !IsCorePowered(), or DoubleLockStatus() or EDPRSR.R == 1, access to this field is 
UNKNOWN. 


. Otherwise, access to this field is RO. 

Otherwise: 
External Performance Monitors access disable status. 
Oba External Performance Monitors access enabled. AllowExternalPMUAccess() == TRUE. 
0b1 External Performance Monitors access disabled. AllowExternal PMUAccess() == FALSE. 
This field is in the Core power domain. 


Accessing this field has the following behavior: 


. When !IsCorePowered(), or OSLockStatus(), or DoubleLockStatus() or EDPRSR.R = 1, 
access to this field is UNKNOWN. 


. Otherwise, access to this field is RO. 
SDAD, bit [8] 
When ARMV8.4-Debug is implemented: 


Sticky EDAD error. Set to 1 if an external debug interface access to a debug register returns an error 
because AllowExternalDebugAccess() == FALSE. 


ObO No Non-secure external debug interface accesses to the debug registers have failed 
because AllowExternalDebugAccess() == FALSE for the access since EDPRSR was last 
read. 

Qb1 At least one Non-secure external debug interface access to the debug registers has failed 


and returned an error because AllowExternalDebugAccess() == FALSE for the access 
since EDPRSR was last read. 


If the Core power domain is powered up, then, following a read of EDPRSR: 


. If ARMv8.0-DoubleLock is not implemented or DoubleLockStatus() == FALSE this bit 
clears to 0. 


. If ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE, it is 
CONSTRAINED UNPREDICTABLE whether this bit clears to 0 or is unchanged. 


This field is in the Core power domain. 


On a Cold reset, this field resets to 0. 
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EDAD, bit [7] 
When ARMV8.4-Debug is implemented: 


Accessing this field has the following behavior: 
° When !IsCorePowered(), or DoubleLockStatus() or EDPRSR.R == 1, access to this field is 
UNKNOWN. 


° Otherwise, access to this field is RO. 


Otherwise: 


Sticky EDAD error. Set to 1 if an external debug interface access to a debug register returns an error 
because AllowExternalDebugAccess() == FALSE. 


0bd No external debug interface accesses to the debug registers have failed because 
AllowExternalDebugAccess() == FALSE since EDPRSR was last read. 

Qb1 At least one external debug interface access to the debug registers has failed and 
returned an error because AllowExternalDebugAccess() == FALSE since EDPRSR was 
last read. 


If the Core power domain is powered up, then, following a read of EDPRSR: 


. If ARMv8.0-DoubleLock is not implemented or DoubleLockStatus() == FALSE this bit 
clears to 0. 


s If ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE, it is 
CONSTRAINED UNPREDICTABLE whether this bit clears to 0 or is unchanged. 


This bit is UNKNOWN on reads if OSLockStatus() == TRUE and external debug writes to 
OSLAR_EL1 do not return an error when AllowExternalDebugAccess() == FALSE. 


This field is in the Core power domain. 
On a Cold reset, this field resets to 0. 


Accessing this field has the following behavior: 
° When !IsCorePowered(), or DoubleLockStatus() or EDPRSR.R == 1, access to this field is 
UNKNOWN. 


° Otherwise, access to this field is RO. 


External Debug Access Disable status. 


0b0ð External Non-secure access to breakpoint registers, watchpoint registers, and 
OSLAR EL! enabled. AllowExternalDebugAccess() == TRUE for a Non-secure access. 
Qb1 External Non-secure access to breakpoint registers, watchpoint registers, and 
OSLAR EL! disabled. AllowExternalDebugAccess() == FALSE for a Non-secure 
access. 


This field is in the Core power domain. 


Accessing this field has the following behavior: 
B When !IsCorePowered(), or DoubleLockStatus() or EDPRSR.R == 1, access to this field is 
UNKNOWN. 


° Otherwise, access to this field is RO. 


When ARMV8.2-Debug is implemented: 


External debug access disable status. 


Qbd External access to breakpoint registers, watchpoint registers, and OSLAR_EL1 
enabled. Al lowExternalDebugAccess() == TRUE. 


Qb1 External access to breakpoint registers, watchpoint registers, and OSLAR_EL1 
disabled. AllowExternalDebugAccess() == FALSE. 


This bit is not valid and reads UNKNOWN if OSLockStatus() == TRUE and external debug writes to 
OSLAR_EL1 do not return an error when AllowExternalDebugAccess() == FALSE. 


This field is in the Core power domain. 
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Accessing this field has the following behavior: 


° When !IsCorePowered(), or DoubleLockStatus() or EDPRSR.R == 1, access to this field is 
UNKNOWN. 


° Otherwise, access to this field is RO. 
Otherwise: 
External Debug Access Disable status. 


0b0ð External access to breakpoint registers, watchpoint registers, and OSLAR_EL1 
enabled. Al lowExternalDebugAccess() == TRUE. 


Qb1 External access to breakpoint registers, watchpoint registers disabled. It is 
IMPLEMENTATION DEFINED whether accesses to OSLAR_EL1 are enabled or disabled. 
AllowExternalDebugAccess() == FALSE. 


This field is in the Core power domain. 


Accessing this field has the following behavior: 


° When !IsCorePowered(), or DoubleLockStatus() or EDPRSR.R == 1, access to this field is 
UNKNOWN. 


. Otherwise, access to this field is RO. 


DLK, bit [6] 
When ARMV8.4-Debug is implemented: 
This field is RESO. 
When ARMVv%8.2-Debug is implemented and ARMV8.0-DoubleLock is implemented: 
Double Lock. 
From Armv8.2, this field is deprecated. 
This field is in the Core power domain. 


Accessing this field has the following behavior: 
. When IsCorePowered() and !DoubleLockStatus(), access to this field is RAZ. 
. Otherwise, access to this field is UNKNOWN. 


When ARMv8.0-DoubleLock is implemented: 
Double Lock. 
This field returns the result of the pseudocode function DoubleLockStatus(). 


If the Core power domain is powered up and DoubleLockStatus() == TRUE, it is IMPLEMENTATION 
DEFINED whether: 


° EDPRSR.PU reads as 1, EDPRSR.DLK reads as 1, and EDPRSR.SPD is UNKNOWN. 
° EDPRSR.PU reads as 0, EDPRSR.DLK is UNKNOWN, and EDPRSR.SPD reads as 0. 
This field is in the Core power domain. 

Ob DoubleLockStatus() returns FALSE. 

Qb1 DoubleLockStatus() returns TRUE and the Core power domain is powered up. 


Accessing this field has the following behavior: 
° When !IsCorePowered(), access to this field is UNKNOWN. 
. Otherwise, access to this field is RO. 


Otherwise: 
Reserved, RESO. 
OSLK, bit [5] 
OS Lock status bit. 
A read of this bit returns the value of OSLSR_EL1.OSLK. 


This field is in the Core power domain. 
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Accessing this field has the following behavior: 


e When !IsCorePowered(), DoubleLockStatus() and EDPRSR.R == 1, access to this field is 
UNKNOWN. 


° Otherwise, access to this field is RO. 


HALTED, bit [4] 


SR, bit [3] 


R, bit [2] 


SPD, bit [1] 


Halted status bit. 

0b0 PE is in Non-debug state. 
Qb1 PE is in Debug state. 

This field is in the Core power domain. 


Accessing this field has the following behavior: 
° When !IsCorePowered(), access to this field is UNKNOWN. 
. Otherwise, access to this field is RO. 


Sticky core Reset status bit. 


Permitted values are: 


0b0 The non-debug logic of the PE is not in reset state and has not been reset since the last 
time EDPRSR was read. 

0b1 The non-debug logic of the PE is in reset state or has been reset since the last time 
EDPRSR was read. 


If EDPRSR.PU reads as 1 and EDPRSR.R reads as 0, which means that the Core power domain is 
in a powerup state and that the non-debug logic of the PE is not in reset state, then following a read 
of EDPRSR: 


. If ARMv8.0-DoubleLock is not implemented or DoubleLockStatus() == FALSE this bit 
clears to 0. 


. If ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE, it is 
UNPREDICTABLE whether this bit clears to 0 or is unchanged. 


This field is in the Core power domain and the Warm reset domain. 
This field resets to 1. 


Accessing this field has the following behavior: 

. When !IsCorePowered() or DoubleLockStatus(), access to this field is UNKNOWN. 
° When SoftwareLockStatus(), access to this field is RO. 

. Otherwise, access to this field is RC. 


PE reset status bit. 

Permitted values are: 

0b0ð The non-debug logic of the PE is not in reset state. 
Qb1 The non-debug logic of the PE is in reset state. 


If ARMv8.0-DoubleLock is implemented, the PE is in reset state, and the PE entered reset state with 
the OS Double Lock locked this bit has a CONSTRAINED UNPREDICTABLE value. For more 
information see EDPRSR. {DLK, R} and reset state on page H6-6814 


This field is in the Core power domain. 


Accessing this field has the following behavior: 
e When !IsCorePowered() or DoubleLockStatus(), access to this field is UNKNOWN. 
° Otherwise, access to this field is RO. 


Sticky core Powerdown status bit. 
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If OS Double Lock is implemented and DoubleLockStatus() == TRUE then: 
è If ARMv8.2-Debug is implemented, this bit reads as 0. 
. If ARMv8.3-Debug is not implemented, this bit might read as 0 or 1. 


For more information, see EDPRSR. {DLK, SPD, PU} and the Core power domain on 
page H6-6813. 


Qbd If EDPRSR.PU is 0, it is not known whether the state of the debug registers in the Core 
power domain is lost. 


If EDPRSR.PU is 1, the state of the debug registers in the Core power domain has not 
been lost. 


Qb1 The state of the debug registers in the Core power domain has been lost. 
If the Core power domain is powered up, then, following a read of EDPRSR: 


. If ARMv8.0-DoubleLock is not implemented or DoubleLockStatus() == FALSE this bit 
clears to 0. 


: If ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE, it is 
CONSTRAINED UNPREDICTABLE whether this bit clears to 0 or is unchanged. 


When the Core power domain is in either retention or powerdown state, the value of EDPRSR.SPD 
is IMPLEMENTATION DEFINED. For more information, see EDPRSR.SPD when the Core domain is in 
either retention or powerdown state on page H6-6814. 


EDPRSR.{DLK, SPD, PU} describe whether registers in the Core power domain can be accessed, 
and whether their state has been lost since the last time the register was read. For more information, 
see EDPRSR.{DLK, SPD, PU} and the Core power domain on page H6-68 13. 


This field is in the Core power domain and the Cold reset domain. 
On a Cold reset, this field resets to 1. 


Accessing this field has the following behavior: 

. When !IsCorePowered(), access to this field is RAZ. 

. When IsCorePowered() and DoubleLockStatus(), access to this field is UNKNOWN. 
. Otherwise, access to this field is RO. 


PU, bit [0] 
When ARMV8.3-DoPD is implemented: 
Core Powerup status bit. 
Access to this field is RAO. 
When ARMV8.2-Debug is implemented: 


Core Powerup status bit. Indicates whether the debug registers in the Core power domain can be 


accessed. 

0bd Either the Core power domain is in a low-power or powerdown state, or 
ARMv8.0-DoubleLock is implemented and DoubleLockStatus() == TRUE, meaning the 
debug registers in the Core power domain cannot be accessed. 

Qb1 The Core power domain is in a powerup state, and either ARMv8.0-DoubleLock is not 


implemented or DoubleLockStatus() == FALSE, meaning the debug registers in the 
Core power domain can be accessed. 


If ARMv8.0-DoubleLock is implemented, the PE is in reset state, and the PE entered reset state with 
the OS Double Lock locked this bit has a CONSTRAINED UNPREDICTABLE value. For more 
information see EDPRSR.{DLK, R} and reset state on page H6-6814 


EDPRSR.{DLK, SPD, PU} describe whether registers in the Core power domain can be accessed, 
and whether their state has been lost since the last time the register was read. For more information, 
see EDPRSR.{DLK, SPD, PU} and the Core power domain on page H6-6813 


Access to this field is RO. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. H9-6941 
ID070919 Non-Confidential 


External Debug Register Descriptions 
H9.2 External debug registers 


H9-6942 


Otherwise: 


Core Powerup status bit. Indicates whether the debug registers in the Core power domain can be 
accessed. 


When the Core power domain is powered-up and DoubleLockStatus() == TRUE, then the value of 
EDPRSR.PU is IMPLEMENTATION DEFINED. See the description of the DLK bit for more 
information. 


Otherwise, permitted values are: 


0bd Core power domain is in a low-power or powerdown state where the debug registers in 
the Core power domain cannot be accessed. 


Qb1 Core power domain is in a powerup state where the debug registers in the Core power 
domain can be accessed. 


If ARMv8.0-DoubleLock is implemented, the Core power domain is powered up, and 
DoubleLockStatus() == TRUE, it is IMPLEMENTATION DEFINED whether this bit reads as 0 or 1. 


If ARMv8.0-DoubleLock is implemented, the PE is in reset state, and the PE entered reset state with 
the OS Double Lock locked this bit has a CONSTRAINED UNPREDICTABLE value. For more 
information see EDPRSR.{DLK, R} and reset state on page H6-6814 


EDPRSR.{DLK, SPD, PU} describe whether registers in the Core power domain can be accessed, 
and whether their state has been lost since the last time the register was read. For more information, 
see EDPRSR.{DLK, SPD, PU} and the Core power domain on page H6-6813 


Access to this field is RO. 


Accessing the EDPRSR: 


On permitted accesses to the register, other access controls affect the behavior of some fields. See the field 
descriptions for more information. 


If the Core power domain is powered up (EDPRSR.PU == 1), then following a read of EDPRSR: 


. If ARMv8.0-DoubleLock is not implemented or DoubleLockStatus() == FALSE, then: 
—  EDPRSR.{SDR, SPMAD, SDAD, SPD} are cleared to 0. 
—  EDPRSR:SR is cleared to 0 if the non-debug logic of the PE is not in reset state (EDPRSR.R == 0). 


° Otherwise it is CONSTRAINED UNPREDICTABLE whether or not this clearing occurs. 
If the Core power domain is powered down (EDPRSR.PU == 0), then: 


° EDPRSR.{SDR, SPMAD, SDAD, SR} are all UNKNOWN, and are either reset or restored on being powered 
up. 


$ EDPRSR.SPD is not cleared following a read of EDPRSR. See the SPD bit description for more information. 
The clearing of bits is an indirect write to EDPRSR. 


EDPRSR can be accessed through the external debug interface: 





Component Offset Instance 





Debug 0x314 EDPRSR 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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H9.2.41 EDRCR, External Debug Reserve Control Register 


The EDRCR characteristics are: 


Purpose 

This register is used to allow imprecise entry to Debug state and clear sticky bits in EDSCR. 
Configurations 

EDRCR is in the Core power domain. 

There are no configuration notes. 
Attributes 


EDRCR is a 32-bit register. 


Field descriptions 


The EDRCR bit assignments are: 


CSPA 
CBRRQ 
Bits [31:5] 
Reserved, RESO. 
CBRRQ, bit [4] 
Allow imprecise entry to Debug state. The actions on writing to this bit are: 
Qbd No action. 
Qb1 Allow imprecise entry to Debug state, for example by canceling pending bus accesses. 


Setting this bit to 1 allows a debugger to request imprecise entry to Debug state. An External Debug 
Request debug event must be pending before the debugger sets this bit to 1. 


This feature is optional. If this feature is not implemented, writes to this bit are ignored. 


CSPA, bit [3] 
Clear Sticky Pipeline Advance. This bit is used to clear the EDSCR.PipeAdv bit to 0. The actions 
on writing to this bit are: 


Obd No action. 
Qb1 Clear the EDSCR.PipeAdv bit to 0. 


CSE, bit [2] 
Clear Sticky Error. Used to clear the EDSCR cumulative error bits to 0. The actions on writing to 
this bit are: 


0b0 No action. 
Qb1 Clear the EDSCR.{TXU, RXO, ERR} bits, and, if the PE is in Debug state, the 
EDSCR.ITO bit, to 0. 
Bits [1:0] 
Reserved, RESO. 
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Accessing the EDRCR: 


EDRCR can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x090 EDRCR 





This interface is accessible as follows: 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are WI. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are WO. 


. Otherwise accesses to this register generate an error response. 
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H9.2.42 EDSCR, External Debug Status and Control Register 
The EDSCR characteristics are: 


Purpose 


Main control register for the debug implementation. 


Configurations 


External register EDSCR[30:29] is architecturally mapped to AArch64 System register 
MDCCSR_ELO[30:29]. 


EDSCR is in the Core power domain. Some or all RW fields of this register have defined reset 
values. These apply only on a Cold reset. The register is not affected by a Warm reset and is not 
affected by an External debug reset. 


Attributes 
EDSCR is a 32-bit register. 


Field descriptions 


The EDSCR bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 109 8765 0 





TFO =o Loo ERR 
RXfull HDE 


TXfull RESO 
ITO 
RXO 
TXU 
PipeAdv 
ITE 
INTdis 
TDA 

MA 

SC2 
RESO 
SDD 


TFO, bit [31] 
When ARMV8.4-Trace is implemented: 


Trace Filter Override. Overrides the Trace Filter controls allowing the external debugger to trace 
any visible Exception level. 


Qbd Trace Filter controls are not affected. 
Qb1 Trace Filter controls in TRFCR_EL1, TRFCR_EL2, TRFCR, and HTRFCR are 
ignored. 


When OSLSR_EL1.OSLK == 1, this bit can be indirectly read and written through the 
MDSCR_EL1 and DBGDSCRext System registers. 


This bit is ignored by the PE when ExternalSecureNoninvasiveDebugEnabled() == FALSE and the 
Effective value of MDCR_EL3.STE == 1. 


On a Cold reset, this field resets to 0. 
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Otherwise: 


Reserved, RESO. 


RXfull, bit [30] 


DTRRX full. This bit is RO. 
On a Cold reset, this field resets to 0. 


TXfull, bit [29] 


ITO, bit [28] 


RXO, bit [27] 


TXU, bit [26] 


DTRTX full. This bit is RO. 
On a Cold reset, this field resets to 0. 


ITR overrun. This bit is RO. 
If the PE is in Non-debug state, this bit is UNKNOWN. ITO is set to 0 on entry to Debug state. 


DTRRX overrun. This bit is RO. 
On a Cold reset, this field resets to 0. 


DTRTX underrun. This bit is RO. 
On a Cold reset, this field resets to 0. 


PipeAdv, bit [25] 


ITE, bit [24] 


Pipeline advance. This bit is RO. Set to 1 every time the PE pipeline retires one or more instructions. 
Cleared to 0 by a write to EDRCR.CSPA. 


The architecture does not define precisely when this bit is set to 1. It requires only that this happen 
periodically in Non-debug state to indicate that software execution is progressing. 


ITR empty. This bit is RO. 
If the PE is in Non-debug state, this bit is UNKNOWN. It is always valid in Debug state. 


INTdis, bits [23:22] 
When ARMv%8.4-Debug is implemented: 


Interrupt disable. Disables taking interrupts in Non-Debug state. 
Qbd Masking of interrupts is controlled by PSTATE and interrupt routing controls. 


Qb1 If ExternalSecureInvasiveDebugEnabled() == TRUE, then all interrupts, including 
virtual and SError interrupts, are masked. 
If ExternalSecureInvasiveDebugEnabled() == FALSE, then all interrupts targetting 
Non-secure state are masked. 


When OSLSR_EL1.OSLK == 1, this field can be indirectly read and written through the 
MDSCR_EL1 and DBGDSCRext System registers. 


This field is ignored by the PE and treated as zero when ExternalDebugEnabled() == FALSE. 
On a Cold reset, this field resets to 0. 


Otherwise: 


Interrupt disable. 


When OSLSR_EL1.OSLK == 1, this field can be indirectly read and written through the 
MDSCR_EL1 and DBGDSCRext System registers. 


0b00 Do not disable interrupts. 
0b01 Disable interrupts taken to Non-secure EL1. 
H9-6946 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


External Debug Register Descriptions 
H9.2 External debug registers 


0b10 Disable interrupts taken only to Non-secure EL1 and Non-secure EL2. If 
ExternalSecureInvasiveDebugEnabled() == TRUE, also disable interrupts taken to 
Secure EL1. 

Qb11 Disable interrupts taken only to Non-secure EL1 and Non-secure EL2. If 


ExternalSecureInvasiveDebugEnabled() == TRUE, also disable all other interrupts. 
On a Cold reset, this field resets to 0. 


TDA, bit [21] 
Traps accesses to the following debug System registers: 


è AArch64: DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGWCR<n>_EL1, 
DBGWVR<n>_ELl1. 


. AArch32: DBGBCR<n>, DBGBVR<n>, DBGBXVR<n>, DBGWCR<n>, DBGWVR<n>. 
The possible values of this field are: 
0bd Accesses to debug System registers do not generate a Software Access Debug event. 


Qb1 Accesses to debug System registers generate a Software Access Debug event, if 
OSLSR_EL1.OSLK is 0 and if halting is allowed. 


On a Cold reset, this field resets to 0. 


MA, bit [20] 


Memory access mode. Controls the use of memory-access mode for accessing ITR and the DCC. 
This bit is ignored if in Non-debug state and set to zero on entry to Debug state. 


Possible values of this field are: 
0b Normal access mode. 
Qb1 Memory access mode. 


On a Cold reset, this field resets to 0. 


SC2, bit [19] 


When ARMv8.0-PCSample is implemented, ARMv8.1-VHE is implemented and 
ARMv8.2-PCSample is not implemented: 


Sample CONTEXTIDR_EL2. Controls whether the PC Sample-based Profiling Extension samples 
CONTEXTIDR_EL2 or VITBR_EL2.VMID. 


Ob Sample VTTBR_EL2.VMID. 

Qb1 Sample CONTEXTIDR_EL2. 

On a Cold reset, this field resets to Q. 
Otherwise: 


Reserved, RESO. 


NS, bit [18] 
Non-secure status. Read-only. When in Debug state, gives the current Security state: 
Oba Secure state, IsSecure() == TRUE. 
Qb1 Non-secure state, IsSecure() == FALSE. 
In Non-debug state, this bit is UNKNOWN. 


Bit [17] 
Reserved, RESO. 
SDD, bit [16] 
Secure debug disabled. This bit is RO. 


On entry to Debug state: 


è If entering in Secure state, SDD is set to 0. 
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Bit [15] 


HDE, bit [14] 


° If entering in Non-secure state, SDD is set to the inverse of 
ExternalSecureInvasiveDebugEnabled(). 


In Debug state, the value of the SDD bit does not change, even if 
ExternalSecureInvasiveDebugEnabled() changes. 


In Non-debug state: 


$ SDD returns the inverse of ExternalSecureInvasiveDebugEnabled(). If the authentication 
signals that control ExternalSecureInvasiveDebugEnabled() change, a context 
synchronization event is required to guarantee their effect. 


s This bit is unaffected by the Security state of the PE. 


If EL3 is not implemented and the implementation is Non-secure, this bit is RES1. 


Reserved, RESO. 


Halting debug enable. The possible values of this field are: 

Qbd Halting disabled for Breakpoint, Watchpoint and Halt Instruction debug events. 
Qb1 Halting enabled for Breakpoint, Watchpoint and Halt Instruction debug events. 
On a Cold reset, this field resets to 0. 


RW, bits [13:10] 


EL, bits [9:8] 


Exception level Execution state status. Read-only. In Debug state, each bit gives the current 
Execution state of each Exception level: 


Qb1111 All Exception levels are using AArch64 or the PE is in Non-debug state. 


0b1110 The PE is in Debug state. ELO is using AArch32. All other Exception levels are using 
AArch64. Only permitted if the PE is executing at ELO. 


0b110x The PE is in Debug state. ELO and EL1 are using AArch32. EL2 and EL3 are using 
AArch64. Only permitted if EL2 is implemented and enabled in the current Security 
State. 


Qb10xx The PE is in Debug state. ELO, EL1, and, if implemented in the current Security state, 
EL2 are using AArch32. EL3 is using AArch64. Only permitted if EL3 is implemented. 


QbOxxx The PE is in Debug state. All Exception levels are using AArch32. 
In Non-debug state, this field is RAO. 


Exception level. Read-only. In Debug state, this gives the current EL of the PE. 
In Non-debug state, this field is RAZ. 


A, bit [7] 
SError interrupt pending. Read-only. In Debug state, indicates whether an SError interrupt is 
pending: 
. If HCR_EL2.{AMO, TGE} = {1, 0}, EL2 is enabled in the current Security state, and the PE 
is executing at ELO or ELI, a virtual SError interrupt. 
° Otherwise, a physical SError interrupt. 
Qbd No SError interrupt pending. 
Qb1 SError interrupt pending. 
A debugger can read EDSCR to check whether an SError interrupt is pending without having to 
execute further instructions. A pending SError might indicate data from target memory is corrupted. 
UNKNOWN in Non-debug state. 
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Cumulative error flag. This field is RO. It is set to 1 following exceptions in Debug state and on any 


signaled overrun or underrun on the DTR or EDITR. 


On a Cold reset, this field resets to 0. 


STATUS, bits [5:0] 
Debug status flags. This field is RO. 


The possible values of this field are: 


0b000001 
0b000010 
0b000111 
0b010011 
0b011011 
0b011111 
0b100011 
0b100111 
0b101011 
0b101111 
0b110011 
0b110111 
0b111011 





PE is restarting, exiting Debug state. 


PE is in Non-debug state. 
Breakpoint. 

External debug request. 
Halting step, normal. 
Halting step, exclusive. 
OS Unlock Catch. 

Reset Catch. 

Watchpoint. 

HLT instruction. 
Software access to debug register. 
Exception Catch. 


Halting step, no syndrome. 


All other values of STATUS are reserved. 


Accessing the EDSCR: 


EDSCR can be accessed through the external debug interface: 


This interface is accessible as follows: 
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Component Offset Instance 


Debug 0x088 EDSCR 





When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 


register are RO. 


When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 


register are RW. 


Otherwise accesses to this register generate an error response. 
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H9.2.43 EDVIDSR, External Debug Virtual Context Sample Register 
The EDVIDSR characteristics are: 


Purpose 
Contains sampled values captured on reading EDPCSR[31:0]. 


Configurations 
EDVIDSR is in the Core power domain. 
Fields in this register reset to architecturally UNKNOWN values. These apply only on a Cold reset. 
The register is not affected by a Warm reset and is not affected by an External debug reset. 
Implemented only if the OPTIONAL PC Sample-based Profiling Extension is implemented in the 
external debug registers space. 


When the PC Sample-based Profiling Extension is implemented in the external debug registers 
space, if EL2 is not implemented and EL3 is not implemented, it is IMPLEMENTATION DEFINED 
whether EDVIDSR is implemented. 





Note 
ARMv8.2-PCSample implements the PC Sample-based Profiling Extension in the Performance 
Monitors registers space. 





Attributes 


If ARMv8.1-VHE is implemented, the format of this register differs depending on the value of 
EDSCR.SC2. 


Field descriptions 


The EDVIDSR bit assignments are: 


When ARMv8.2-PCSample is implemented: 


31 0 
RESO 


Bits [31:0] 
Reserved, RESO. 


When ARMv8.1-VHE is not implemented: 


31 30 29 28 27 8 


7 0 
rs | | | RESO VMID 


HV 
NS, bit [31] 
Non-secure state sample. Indicates the Security state associated with the most recent EDPCSR 
sample. 
If EL3 is not implemented, this bit indicates the Effective value of SCR.NS. 
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E3, bit [29] 


HV, bit [28] 


Bits [27:8] 
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On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Exception level 2 status sample. Indicates whether the most recent EDPCSR sample was associated 
with EL2. 


If EL2 is not implemented, this bit is RESO. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Exception level 3 status sample. Indicates whether the most recent EDPCSR sample was associated 
with EL3 using AArch64. 


If EDVIDSR.NS = 1 or the PE was in AArch32 state when EDPCSRlo (EDPCSRJ[31:0]) was read, 
this bit is 0. 


If EL3 is not implemented, this bit is RESO. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


EDPCSRhi (EDPCSR[63:32]) valid. Indicates whether bits [63:32] of the most recent EDPCSR 
sample might be nonzero: 


Qbd Bits[63:32] of the most recent EDPCSR sample are zero. 
Qb1 Bits[63:32] of the most recent EDPCSR sample might be nonzero. 
An EDVIDSR.HV value of 1 does not mean that the value of EDPCSRhi is nonzero. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Reserved, RESO. 


VMID, bits [7:0] 


VMID sample. The VMID associated with the most recent EDPCSRlo (EDPCSR[31:0]) sample. 


If EL2 is using AArch64 and the value of EDVIDSR.NS is 0 or the value of EDVIDSR.E2 is 1 this 
field is RESO. 


If EL2 is not implemented, then this field is RESO. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When ARMv8.1-VHE is implemented and EDSCR.SC2 == 0: 


31 30 29 28 27 


1615 0 


rs | | | RESO VMID 


This format applies in all Armv8.0 implementations. 


NS, bit [31] 


Non-secure state sample. Indicates the Security state associated with the most recent EDPCSR 
sample. 


If EL3 is not implemented, this bit indicates the Effective value of SCR.NS. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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H9-6952 


E2, bit [30] 


Exception level 2 status sample. Indicates whether the most recent EDPCSR sample was associated 
with EL2. 


If EL2 is not implemented, this bit is RESO. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
E3, bit [29] 


Exception level 3 status sample. Indicates whether the most recent EDPCSR sample was associated 


with EL3 using AArch64. 
If EDVIDSR.NS == 1 or the PE was in AArch32 state when EDPCSRlo (EDPCSR[3 1:0]) was read, 
this bit is 0. 


If EL3 is not implemented, this bit is RESO. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


HV, bit [28] 


EDPCSRhi (EDPCSR[63:32]) valid. Indicates whether bits [63:32] of the most recent EDPCSR 
sample might be nonzero: 


Qbd Bits[63:32] of the most recent EDPCSR sample are zero. 
Qb1 Bits[63:32] of the most recent EDPCSR sample might be nonzero. 


An EDVIDSR.HV value of 1 does not mean that the value of EDPCSRhi is nonzero. An 
EDVIDSR.HV value of 0 is a hint that EDPCSRhi (EDPCSR[63:32]) does not need to be read. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [27:16] 


Reserved, RESO. 


VMID, bits [15:0] 
VMID sample. The VMID associated with the most recent EDPCSRlo (EDPCSR[31:0]) sample. 


s If EL2 is using AArch64 and the value of EDVIDSR.NS is 0 or the value of EDVIDSR.E2 
is | this field is RESO. 


. If EL2 is not implemented, this field is RESO. 

od If EL2 is implemented and is using AArch64, the VMID is held in VTTBR_EL2.VMID. 
à If EL2 is implemented and is using AArch32, the VMID is held in VTTBR.VMID. 

$ If 16-bit VMIDs are not supported, EDVIDSR.VMID[15:8] is RESO. 


: If 16-bit VMIDs are supported, but VTTBRx.VMID[15:8] are not used, 
EDVIDSR.VMID[15:8] is set to 0. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When ARMv8.1-VHE is implemented and EDSCR.SC2 == 1: 


31 0 


CONTEXTIDR_EL2 


CONTEXTIDR_EL2, bits [31:0] 
Context ID. 


è If EL2 is using AArch64 and if the value of EDPCSR.NS is 0, the value of 
CONTEXTIDR_EL2 as associated with the most recent EDPCSR sample. 


° If the value of EDPCSR.NS is 0, then this field is set to an UNKNOWN value. 
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. If neither of the above conditions are true, this field is set to an UNKNOWN value. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the EDVIDSR: 


IMPLEMENTATION DEFINED extensions to external debug might make the value of this register UNKNOWN, see 
Permitted behavior that might make the PC Sample-based profiling registers UNKNOWN on page H7-6824 


EDVIDSR can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x0A8 EDVIDSR 





This interface is accessible as follows: 
. When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to this register are RO. 


e Otherwise accesses to this register generate an error response. 
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H9.2.44 EDWAR, External Debug Watchpoint Address Register 


The EDWAR characteristics are: 


Purpose 
Returns the virtual data address being accessed when a Watchpoint Debug Event was triggered. 
Configurations 
EDWAR is in the Core power domain. RW fields in this register reset to architecturally UNKNOWN 
values. These apply only on a Cold reset. The register is not affected by a Warm reset and is not 
affected by an External debug reset. 
Attributes 


EDWAR is a 64-bit register. 


Field descriptions 


The EDWAR bit assignments are: 


63 0 


Watchpoint address 


Bits [63:0] 


Watchpoint address. The data virtual address being accessed when a Watchpoint Debug Event was 
triggered and caused entry to Debug state. This address must be within a naturally-aligned block of 
memory of power-of-two size no larger than the DC ZVA block size. 


The value of this register is UNKNOWN if the PE is in Non-debug state, or if Debug state was entered 
other than for a Watchpoint debug event. 


The value of EDWAR[63:32] is UNKNOWN if Debug state was entered for a Watchpoint debug event 
taken from AArch32 state. 


The EDWAR is subject to the same alignment rules as the reporting of a watchpointed address in 
the FAR. See Determining the memory location that caused a Watchpoint exception on 
page D2-2439 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the EDWAR: 


EDWAR[31:0] can be accessed through the external debug interface: 


Component Offset Instance Range 


Debug 0x030 EDWAR 31:0 





This interface is accessible as follows: 
. When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to EDWAR[31:0] are RO. 


° Otherwise accesses to EDWAR[31:0] generate an error response. 
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EDWAR[63:32] can be accessed through the external debug interface: 





Component Offset Instance Range 


Debug 0x034 EDWAR 63:32 





This interface is accessible as follows: 
° When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to EDWAR[63:32] are RO. 


° Otherwise accesses to EDWAR[63:32] generate an error response. 
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H9.2.45 MIDR_EL1, Main ID Register 
The MIDR_EL1 characteristics are: 


Purpose 
Provides identification information for the PE, including an implementer code for the device and a 
device ID number. 

Configurations 
External register MIDR_EL1[31:0] is architecturally mapped to AArch64 System register 
MIDR_EL1[31:0]. 
External register MIDR_EL1[31:0] is architecturally mapped to AArch32 System register 
MIDR{31:0]. 
It is IMPLEMENTATION DEFINED whether MIDR_EL1 is implemented in the Core power domain or 
in the Debug power domain. 

Attributes 


MIDR_ ELI! is a 32-bit register. 
Field descriptions 


The MIDR_ EL] bit assignments are: 


31 24 23 20 19 1615 4 3 0 


Architecture es 


Implementer, bits [31:24] 


The Implementer code. This field must hold an implementer code that has been assigned by Arm. 
Assigned codes include the following: 





Hex representation Implementer 





























0x00 Reserved for software use 

OxC0 Ampere Computing 

0x41 Arm Limited 

0x42 Broadcom Corporation 

0x43 Cavium Inc. 

0x44 Digital Equipment Corporation 

0x49 Infineon Technologies AG 

0x4D Motorola or Freescale Semiconductor Inc. 

0x4E NVIDIA Corporation 

0x50 Applied Micro Circuits Corporation 
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Hex representation Implementer 











0x51 Qualcomm Inc. 
0x56 Marvell International Ltd. 
0x69 Intel Corporation 





Arm can assign codes that are not published in this manual. All values not assigned by Arm are 
reserved and must not be used. 


Variant, bits [23:20] 


An IMPLEMENTATION DEFINED variant number. Typically, this field is used to distinguish between 
different product variants, or major revisions of a product. 


Architecture, bits [19:16] 


The permitted values of this field are: 


0b0001 
0b0010 
Qb0011 
0b0100 
0b0101 
0b0110 
0b0111 
Qb1111 


Armv4. 

Armv4T. 

Army5S (obsolete). 
Armv5T. 
Armv5TE. 
Armv5TEJ. 
Armv6. 


Architectural features are individually identified in the ID_* registers, see Table K14-9 
on page K 14-7832 


All other values are reserved. 


PartNum, bits [15:4] 


An IMPLEMENTATION DEFINED primary part number for the device. 


On processors implemented by Arm, if the top four bits of the primary part number are 0x0 or 0x7, 
the variant and architecture are encoded differently. 


Revision, bits [3:0] 


An IMPLEMENTATION DEFINED revision number for the device. 


Accessing the MIDR_EL1: 


MIDR_ ELI can be accessed through the external debug interface: 





Component Offset Instance 





Debug OxD00 MIDR _EL1 
This interface is accessible as follows: 
. When IsCorePowered() and !DoubleLockStatus() accesses to this register are RO. 
° Otherwise accesses to this register are IMPDEF. 
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H9.2.46 


H9-6958 


OSLAR_EL1, OS Lock Access Register 


The OSLAR_EL1 characteristics are: 


Purpose 
Used to lock or unlock the OS lock. 


Configurations 


External register OSLAR_EL1[31:0] is architecturally mapped to AArch64 System register 
OSLAR_EL1[31:0]. 


External register OSLAR_EL1[31:0] is architecturally mapped to AArch32 System register 
DBGOSLAR{31:0]. 


OSLAR_EL1 is in the Core power domain. 


If ARMv8.2-Debug is not implemented, it is IMPLEMENTATION DEFINED whether external debug 
accesses to OSLAR_ELI are ignored and return an error when AllowExternalDebugAccess() 
returns FALSE for the access. 


If ARMv8.2-Debug is implemented, external debug accesses to OSLAR_EL1 are ignored and 
return an error when AllowExternalDebugAccess() returns FALSE for the access. 


Attributes 
OSLAR_EL1 is a 32-bit register. 


Field descriptions 


The OSLAR_EL1 bit assignments are: 


Bits [31:1] 
Reserved, RESO. 

OSLK, bit [0] 
On writes to OSLAR_ELI, bit[0] is copied to the OS lock. 
Use EDPRSR.OSLK to check the current status of the lock. 


Accessing the OSLAR_EL1: 





Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalDebugAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 





OSLAR_EL] can be accessed through the external debug interface: 





Component Offset Instance 


Debug 0x300 OSLAR_EL1 
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This interface is accessible as follows: 


When IsCorePowered(), !DoubleLockStatus(), AllowExternalDebugAccess() and SoftwareLockStatus() 
accesses to this register are WI. 


When IsCorePowered(), !DoubleLockStatus(), AllowExternalDebugAccess() and !SoftwareLockStatus() 
accesses to this register are WO. 


When IsCorePowered(), !DoubleLockStatus(), !AllowExternalDebugAccess() and ARMv8.2-Debug is not 
implemented accesses to this register are IMPDEF. 


Otherwise accesses to this register generate an error response. 
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H9.3 Cross-Trigger Interface registers 


This section lists the Cross-Trigger Interface registers. 
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H9.3.1 ASICCTL, CTI External Multiplexer Control register 


ARM DDI 0487E.a 
ID070919 


The ASICCTL characteristics are: 


Purpose 


Can be used to provide IMPLEMENTATION DEFINED controls for the CTI. For example, the register 
might be used to control multiplexors for additional IMPLEMENTATION DEFINED triggers. The 
IMPLEMENTATION DEFINED controls provided by this register might modify the architecturally 
defined behavior of the CTI. 


Note 
The architecturally-defined triggers must not be multiplexed. 





Configurations 


It is IMPLEMENTATION DEFINED whether ASICCTL is implemented in the Core power domain or in 
the Debug power domain. 


If it is implemented in the Core power domain then it is IMPLEMENTATION DEFINED whether it is in 
the Cold reset domain or the Warm reset domain. 


This register must reset to a value that supports the architecturally-defined behavior of the CTI. 
Changing the value of the register from its reset value causes IMPLEMENTATION DEFINED behavior 
that might differ from the architecturally-defined behavior of the CTI. 


Other than the requirements listed in this register description, all aspects of the reset behavior of the 
ASICCTL are IMPLEMENTATION DEFINED. 


Attributes 
ASICCTL is a 32-bit register. 


Field descriptions 


The ASICCTL bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


Accessing the ASICCTL: 


ASICCTL can be accessed through the external debug interface: 


Component Offset Instance 


CTI 0x144 ASICCTL 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalDebugAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


° Otherwise accesses to this register are IMPDEF. 
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H9.3.2 CTIAPPCLEAR, CTI Application Trigger Clear register 


The CTIAPPCLEAR characteristics are: 


Purpose 
Clears bits of the Application Trigger register. 
Configurations 
CTIAPPCLEAR is in the Debug power domain. 
There are no configuration notes. 
Attributes 


CTIAPPCLEAR is a 32-bit register. 


Field descriptions 


The CTIAPPCLEAR bit assignments are: 


31 


0 


APPCLEAR<<x>, bit [x] 


APPCLEAR<x>, bit [x], for x = 0 to 31 
Application trigger <x> disable. 


Bits [31:N] are RAZ/WI. N is the number of ECT channels implemented as defined by the 


CTIDEVID.NUMCHAN field. 
Writing to this bit has the following effect: 


Qbd No effect. 
Qb1 Clear corresponding bit in CTIAPPTRIG to 0 and clear the corresponding channel 
event. 


If the ECT does not support multicycle channel events, use of CTIAPPCLEAR is deprecated and 


the debugger must only use CTIAPPPULSE. 


Accessing the CTIAPPCLEAR: 


CTIAPPCLEAR can be accessed through the external debug interface: 





Component 


CTI 


Offset Instance 


0x018 CTIAPPCLEAR 





This interface is accessible as follows: 
° When SoftwareLockStatus() accesses to this register are WI. 


. When !SoftwareLockStatus() accesses to this register are WO. 
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H9.3.3 CTIAPPPULSE, CTI Application Pulse register 


ARM DDI 0487E.a 
ID070919 


The CTIAPPPULSE characteristics are: 


Purpose 

Causes event pulses to be generated on ECT channels. 
Configurations 

CTIAPPPULSE is in the Debug power domain. 

There are no configuration notes. 
Attributes 


CTIAPPPULSE is a 32-bit register. 


Field descriptions 


The CTIAPPPULSE bit assignments are: 


31 0 


APPPULSE<x>, bit [x] 


APPPULSE<x>, bit [x], for x = 0 to 31 
Generate event pulse on ECT channel <x>. 


Bits [31:N] are RAZ/WI. N is the number of ECT channels implemented as defined by the 
CTIDEVID.NUMCHAN field. 


Writing to this bit has the following effect: 
Qbd No effect. 


Qb1 Channel <x> event pulse generated. 


Note 

° The CTIAPPPULSE operation does not affect the state of the Application Trigger register, 
CTIAPPTRIG. If the channel is active, either because of an earlier event or from the 
application trigger, then the value written to CTIAPPPULSE might have no effect. 





s Multiple pulse events that occur close together might be merged into a single pulse event. 





Accessing the CTIAPPPULSE: 


It is CONSTRAINED UNPREDICTABLE whether a write to CTIAPPPULSE generates an event on a channel if 
CTICONTROL.GLBEN is 0. 


CTIAPPPULSE can be accessed through the external debug interface: 





Component Offset Instance 


CTI 0x01C CTIAPPPULSE 





This interface is accessible as follows: 
a When SoftwareLockStatus() accesses to this register are WI. 


. When !SoftwareLockStatus() accesses to this register are WO. 
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H9.3.4 


H9-6964 


CTIAPPSET, CTI Application Trigger Set register 


The CTIAPPSET characteristics are: 


Purpose 
Sets bits of the Application Trigger register. 

Configurations 
CTIAPPSET is in the Debug power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on an External debug reset. The register is not affected by a 
Warm reset and is not affected by a Cold reset. 

Attributes 


CTIAPPSET is a 32-bit register. 


Field descriptions 


The CTIAPPSET bit assignments are: 


31 


0 


APPSET<x>, bit [x] 


APPSET<x>, bit [x], for x = 0 to 31 


Application trigger <x> enable. 

Bits [31:N] are RAZ/WI. N is the number of ECT channels implemented as defined by the 
CTIDEVID.NUMCHAN field. 

Possible values of this bit are: 

Qbd Reading this means the application trigger is inactive. Writing this has no effect. 


Qb1 Reading this means the application trigger is active. Writing this sets the corresponding 
bit in CTIAPPTRIG to 1 and generates a channel event. 


If the ECT does not support multicycle channel events, use of CTIAPPSET is deprecated and the 
debugger must only use CTIAPPPULSE. 


On a External debug reset, this field resets to an architecturally UNKNOWN value. 


Accessing the CTIAPPSET: 


CTIAPPSET can be accessed through the external debug interface: 





Component Offset Instance 


CTI 0x014 CTIAPPSET 





This interface is accessible as follows: 


. When SoftwareLockStatus() accesses to this register are RO. 


e When !SoftwareLockStatus() accesses to this register are RW. 
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CTIAUTHSTATUS, CTI Authentication Status register 


ARM DDI 0487E.a 


The CTIAUTHSTATUS characteristics are: 


Purpose 
Provides information about the state of the IMPLEMENTATION DEFINED authentication interface for 
CTI. 
Configurations 
CTIAUTHSTATUS is in the Debug power domain. 
This register is OPTIONAL, and is required for CoreSight compliance. 
Attributes 


CTIAUTHSTATUS is a 32-bit register. 


Field descriptions 


The CTIAUTHSTATUS bit assignments are: 


31 8 7 43210 


p NSNID 


Bits [31:8] 
Reserved, RESO. 


Bits [7:4] 
Reserved, RAZ. 


NSNID, bits [3:2] 
If EL3 is not implemented and the implemented Security state is Secure state, holds the same value 
as DBGAUTHSTATUS _ELI1.SNID. 


Otherwise, holds the same value as DBGAUTHSTATUS_EL1.NSNID. 


NSID, bits [1:0] 
If EL3 is not implemented and the implemented Security state is Secure state, holds the same value 
as DBGAUTHSTATUS ELI1.SID. 


Otherwise, holds the same value as DBGAUTHSTATUS_EL1.NSID. 


Accessing the CTIAUTHSTATUS: 


CTIAUTHSTATUS can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFB8 CTIAUTHSTATUS 
This interface is accessible as follows: 
7 Accesses to this register are RO. 
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H9.3.6 


H9-6966 


CTICHINSTATUS, CTI Channel In Status register 


The CTICHINSTATUS characteristics are: 


Purpose 

Provides the raw status of the ECT channel inputs to the CTI. 
Configurations 

CTICHINSTATUS is in the Debug power domain. 

There are no configuration notes. 
Attributes 


CTICHINSTATUS is a 32-bit register. 


Field descriptions 


The CTICHINSTATUS bit assignments are: 


31 0 


CHIN<n>, bit [n] 


CHIN<n>, bit [n], for n = 0 to 31 
Input channel <n> status. 


Bits [31:N] are RAZ. N is the number of ECT channels implemented as defined by the 
CTIDEVID.NUMCHAN field. 


Possible values of this bit are: 
Qbd Input channel <n> is inactive. 
Qb1 Input channel <n> is active. 


If the ECT channels do not support multicycle events then it is IMPLEMENTATION DEFINED whether 
an input channel can be observed as active. 


Accessing the CTICHINSTATUS: 
CTICHINSTATUS can be accessed through the external debug interface: 





Component Offset Instance 


CTI 0x138 CTICHINSTATUS 
This interface is accessible as follows: 
s Accesses to this register are RO. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


External Debug Register Descriptions 
H9.3 Cross-Trigger Interface registers 


H9.3.7 CTICHOUTSTATUS, CTI Channel Out Status register 
The CTICHOUTSTATUS characteristics are: 


Purpose 

Provides the status of the ECT channel outputs from the CTI. 
Configurations 

CTICHOUTSTATUS is in the Debug power domain. 

There are no configuration notes. 
Attributes 


CTICHOUTSTATUS is a 32-bit register. 


Field descriptions 


The CTICHOUTSTATUS bit assignments are: 


31 0 


CHOUT<n>, bit [n] 


CHOUT<n>, bit [n], for n = 0 to 31 
Output channel <n> status. 


Bits [31:N] are RAZ. N is the number of ECT channels implemented as defined by the 
CTIDEVID.NUMCHAN field. 


Possible values of this bit are: 
Ob Output channel <n> is inactive. 
Qb1 Output channel <n> is active. 


If the ECT channels do not support multicycle events then it is IMPLEMENTATION DEFINED whether 
an output channel can be observed as active. 





Note 
The value in CTICHOUTSTATUS is after gating by the channel gate. For more information, see 
CTIGATE. 





Accessing the CTICHOUTSTATUS: 
CTICHOUTSTATUS can be accessed through the external debug interface: 





Component Offset Instance 





CTI 0x13C CTICHOUTSTATUS 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.8 CTICIDRO, CTI Component Identification Register 0 
The CTICIDRO characteristics are: 


Purpose 

Provides information to identify a CTI component. 

For more information see About the Component Identification scheme on page K2-7663. 
Configurations 

CTICIDRO is in the Debug power domain. 

Implementation of this register is OPTIONAL. 

This register is required for CoreSight compliance. 
Attributes 


CTICIDRO is a 32-bit register. 


Field descriptions 


The CTICIDRO bit assignments are: 


31 8 7 0 
RESO PRMBL_0O 
Bits [31:8] 


Reserved, RESO. 


PRMBL 0, bits [7:0] 
Preamble. Must read as Qx@D. 


Accessing the CTICIDRO: 
CTICIDRO can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFFO CTICIDRO 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.9 CTICIDR1, CTI Component Identification Register 1 


The CTICIDR1 characteristics are: 


Purpose 

Provides information to identify a CTI component. 

For more information see About the Component Identification scheme on page K2-7663. 
Configurations 

CTICIDR1 is in the Debug power domain. 

Implementation of this register is OPTIONAL. 

This register is required for CoreSight compliance. 
Attributes 


CTICIDR1 is a 32-bit register. 


Field descriptions 


The CTICIDR1 bit assignments are: 


31 8 7 


0 


RESO CLASS | PRMBL_1 


Bits [31:8] 


Reserved, RESO. 


CLASS, bits [7:4] 


Component class. Reads as 0x9, debug component. 
PRMBL 1, bits [3:0] 
Preamble. RAZ. 


Accessing the CTICIDR1: 


CTICIDR1 can be accessed through the external debug interface: 





Component 


Offset Instance 


OxFF4 CTICIDR1 





CTI 
This interface is accessible as follows: 
à Accesses to this register are RO. 
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H9.3.10 CTICIDR2, CTI Component Identification Register 2 


The CTICIDR2 characteristics are: 


Purpose 

Provides information to identify a CTI component. 

For more information see About the Component Identification scheme on page K2-7663. 
Configurations 

CTICIDR2 is in the Debug power domain. 

Implementation of this register is OPTIONAL. 

This register is required for CoreSight compliance. 
Attributes 


CTICIDR2 is a 32-bit register. 


Field descriptions 


The CTICIDR2 bit assignments are: 


31 8 7 0 
RESO PRMBL_2 
Bits [31:8] 


Reserved, RESO. 


PRMBL 2, bits [7:0] 
Preamble. Must read as 0x05. 


Accessing the CTICIDR2: 
CTICIDR2 can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFF8 CTICIDR2 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.11 CTICIDR3, CTI Component Identification Register 3 


The CTICIDR3 characteristics are: 


Purpose 

Provides information to identify a CTI component. 

For more information see About the Component Identification scheme on page K2-7663. 
Configurations 

CTICIDR3 is in the Debug power domain. 

Implementation of this register is OPTIONAL. 

This register is required for CoreSight compliance. 
Attributes 


CTICIDR3 is a 32-bit register. 


Field descriptions 


The CTICIDR3 bit assignments are: 


31 8 7 


0 


RESO PRMBL_3 


Bits [31:8] 
Reserved, RESO. 


PRMBL 3, bits [7:0] 
Preamble. Must read as QxB1. 


Accessing the CTICIDR3: 
CTICIDR3 can be accessed through the external debug interface: 





Component 


Offset Instance 


OxFFC CTICIDR3 





CTI 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.12 


H9-6972 


CTICLAIMCLR, CTI Claim Tag Clear register 


The CTICLAIMCLR characteristics are: 


Purpose 
Used by software to read the values of the CLAIM bits, and to clear these bits to 0. 
Configurations 
CTICLAIMCLR is in the Debug power domain. 
This register is not affected by a Warm reset, and is not affected by a Cold reset. 
Implementation of this register is OPTIONAL. 
Attributes 


CTICLAIMCLR is a 32-bit register. 


Field descriptions 


The CTICLAIMCLR bit assignments are: 


31 0 


CLAIM[<x>], bit [x] 


CLAIM[<x>], bit [x], for x = 0 to 31 
CLAIM tag clear bit. 


For values of x greater than or equal to the IMPLEMENTATION DEFINED number of CLAIM tags, this 
bit is RAZ/SBZ. Software can rely on these bits reading as zero, and must use a Should-Be-Zero 
policy on writes. Implementations must ignore writes. 


For other values of x, reads return the value of CLAIM[x] and the behavior on writes is: 
Qbd No action. 

Qb1 Indirectly clear CLAIM[x] to 0. 

A single write to CTICLAIMCLR can clear multiple tags to 0. 


Accessing the CTICLAIMCLR: 


CTICLAIMCLR can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFA4 CTICLAIMCLR 
This interface is accessible as follows: 
° When SoftwareLockStatus() accesses to this register are RO. 
. When !SoftwareLockStatus() accesses to this register are RW. 
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CTICLAIMSET, CTI Claim Tag Set register 


ARM DDI 0487E.a 


The CTICLAIMSET characteristics are: 


Purpose 
Used by software to set CLAIM bits to 1. 

Configurations 
CTICLAIMSET is in the Debug power domain. Some or all RW fields of this register have defined 
reset values. These apply only on an External debug reset. The register is not affected by a Warm 
reset and is not affected by a Cold reset. 
Implementation of this register is OPTIONAL. 

Attributes 


CTICLAIMSET is a 32-bit register. 


Field descriptions 


The CTICLAIMSET bit assignments are: 


31 0 


CLAIM[<x>], bit [x] 


CLAIM[<x>], bit [x], for x = 0 to 31 
CLAIM tag set bit. 


For values of x greater than or equal to the IMPLEMENTATION DEFINED number of CLAIM tags, this 
bit is RAZ/SBZ. Software can rely on these bits reading as zero, and must use a Should-Be-Zero 
policy on writes. Implementations must ignore writes. 


For other values of x, the bit is RAO and the behavior on writes is: 
Obd No action. 

Qb1 Indirectly set CLAIM[x] tag to 1. 

A single write to CTICLAIMSET can set multiple tags to 1. 

An External Debug reset clears the CLAIM tag bits to 0. 


Accessing the CTICLAIMSET: 


CTICLAIMSET can be accessed through the external debug interface: 





Component Offset Instance 


CTI OxFAOQ CTICLAIMSET 





This interface is accessible as follows: 
° When SoftwareLockStatus() accesses to this register are RO. 


° When !SoftwareLockStatus() accesses to this register are RW. 
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H9.3.14 


H9-6974 


CTICONTROL, CTI Control register 


The CTICONTROL characteristics are: 


Purpose 
Controls whether the CTI is enabled. 

Configurations 
CTICONTROL is in the Debug power domain. Some or all RW fields of this register have defined 
reset values. These apply only on an External debug reset. The register is not affected by a Warm 
reset and is not affected by a Cold reset. 

Attributes 


CTICONTROL is a 32-bit register. 


Field descriptions 


The CTICONTROL bit assignments are: 


Bits [31:1] 


Reserved, RESO. 


GLBEN, bit [0] 
Enables or disables the CTI mapping functions. Possible values of this field are: 
Qbd CTI mapping functions and application trigger disabled. 
Qb1 CTI mapping functions and application trigger enabled. 


When GLBEN is 0, the input channel to output trigger, input trigger to output channel, and 
application trigger functions are disabled and do not signal new events on either output triggers or 
output channels. If a previously asserted output trigger has not been acknowledged, it remains 
asserted after the mapping functions are disabled. All output triggers are disabled by CTI reset. 


If the ECT supports multicycle channel events any existing output channel events will be 
terminated. 


On a External debug reset, this field resets to 0. 


Accessing the CTICONTROL: 


CTICONTROL can be accessed through the external debug interface: 





Component Offset Instance 





CTI 0x000 CTICONTROL 
This interface is accessible as follows: 
° When SoftwareLockStatus() accesses to this register are RO. 
° When !SoftwareLockStatus() accesses to this register are RW. 
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CTIDEVAFFO, CTI Device Affinity register 0 


ARM DDI 0487E.a 


The CTIDEVAFFO characteristics are: 


Purpose 


Copy of the low half of the PE MPIDR_ELI register that allows a debugger to determine which PE 
in a multiprocessor system the CTI component relates to. 


If the CTI is CTIv1, this register is OPTIONAL. If the CTI is CTIv2, this register is mandatory. 
Arm recommends that the CTI is CTIv2. 
In an Armv8.5 compliant implementation the CTI must be CTIv2. 


If this register is implemented, then CTIDEVAFF1 must also be implemented. If the CTI of a PE 
does not implement the CTI Device Affinity registers, the CTI block of the external debug memory 
map must be located 64KB above the debug registers in the external debug interface. 


Configurations 
CTIDEVAFFO is in the Debug power domain. 


Implementation of this register is OPTIONAL. 


Attributes 
CTIDEVAFFO is a 32-bit register. 


Field descriptions 


The CTIDEVAFFO bit assignments are: 


31 0 


MPIDR_EL1 low half 


MPIDR_EL1 low half, bits [31:0] 
MPIDR_EL1 low half. Read-only copy of the low half of MPIDR_EL1, as seen from the highest 
implemented Exception level. 

Accessing the CTIDEVAFF0: 


CTIDEVAFFO can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFA8 CTIDEVAFF0O 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.16 CTIDEVAFF1, CTI Device Affinity register 1 
The CTIDEVAFF 1 characteristics are: 


Purpose 


Copy of the high half of the PE MPIDR_ELI register that allows a debugger to determine which PE 
in a multiprocessor system the CTI component relates to. 


If the CTI is CTIv1, this register is OPTIONAL. If the CTI is CTIv2, this register is mandatory. 
Arm recommends that the CTI is CTIv2. 
In an Armv8.5 compliant implementation the CTI must be CTIv2. 


If this register is implemented, then CTIDEVAFFO must also be implemented. If the CTI of a PE 
does not implement the CTI Device Affinity registers, the CTI block of the external debug memory 
map must be located 64KB above the debug registers in the external debug interface. 


Configurations 
CTIDEVAFF 1 is in the Debug power domain. 


Implementation of this register is OPTIONAL. 


Attributes 
CTIDEVAFF1 is a 32-bit register. 


Field descriptions 


The CTIDEVAFF1 bit assignments are: 


31 0 


MPIDR_EL1 high half 


MPIDR_EL1 high half, bits [31:0] 
MPIDR_EL1 high half. Read-only copy of the high half of MPIDR_ELI, as seen from the highest 
implemented Exception level. 


Accessing the CTIDEVAFF1: 


CTIDEVAFF1 can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFAC CTIDEVAFF1 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.17 CTIDEVARCH, CTI Device Architecture register 
The CTIDEVARCH characteristics are: 


Purpose 
Identifies the programmers' model architecture of the CTI component. 


If the CTI is CTIv1, this register is OPTIONAL. If the CTI is CTIv2, this register is mandatory. 
Arm recommends that the CTI is CTIv2. 

In an Armv8.5 compliant implementation the CTI must be CTIv2. 

If this register is not implemented, CTIDEVAFF0 and CTIDEVAFF1 are also not implemented. 


Configurations 
CTIDEVARCH is in the Debug power domain. 


Implementation of this register is OPTIONAL. 


Attributes 
CTIDEVARCH is a 32-bit register. 


Field descriptions 


The CTIDEVARCH bit assignments are: 


31 21 20 19 1615 0 


ARCHITECT i REVISION ARCHID 


PRESENT E 


ARCHITECT, bits [31:21] 
Defines the architecture of the component. For CTI, this is Arm Limited. 


Bits [31:28] are the JEP106 continuation code, 0x4. 
Bits [27:21] are the JEP106 ID code, 0x3B. 


PRESENT, bit [20] 
When set to 1, indicates that the DEVARCH is present. 


This field is 1 in Armv8. 


REVISION, bits [19:16] 
Revision. 
Defines the architecture revision of the component. 
0b0000 First revision. 


0b0001 When ARMv8.3-DoPD is implemented As 0b0000, and also adds support for 
CTIDEVCTL. 


All other values are reserved. 


ARCHID, bits [15:0] 
Defines this part to be an Armv8 debug component. For architectures defined by Arm this is further 
subdivided. 
For CTI: 
s Bits [15:12] are the architecture version, 0x1. 


. Bits [11:0] are the architecture part number, 0xA14. 
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H9-6978 


This corresponds to CTI architecture version CTIv2. 


Accessing the CTIDEVARCH: 


CTIDEVARCH can be accessed through the external debug interface: 





Component 


CTI 


Offset 


QxFBC 


Instance 


CTIDEVARCH 





This interface is accessible as follows: 


° Accesses to this register are RO. 
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H9.3.18 CTIDEVCTL, CTI Device Control register 


The CTIDEVCTL characteristics are: 


Purpose 
Provides target-specific device controls 

Configurations 
CTIDEVCTL is in the Debug power domain. Some or all RW fields of this register have defined 
reset values. These apply only on an External debug reset. The register is not affected by a Warm 
reset and is not affected by a Cold reset. 
This register is present only when ARMv8.3-DoPD is implemented. Otherwise, direct accesses to 
CTIDEVCTL are RESO. 

Attributes 


CTIDEVCTL is a 32-bit register. 


Field descriptions 


The CTIDEVCTL bit assignments are: 


Bits [31:2] 


RCE, bit [1] 


Reserved, RESO. 


Reset Catch Enable. 

0bd Reset Catch debug event disabled. 
Qb1 Reset Catch debug event enabled. 
On a External debug reset, this field resets to 0. 


OSUCE, bit [0] 


OS Unlock Catch Enable 
Qbd OS Unlock Catch debug event disabled. 
Qb1 OS Unlock Catch debug event enabled. 


On a External debug reset, this field resets to 0. 


Accessing the CTIDEVCTL: 
CTIDEVCTL can be accessed through the external debug interface: 





Component 


CTI 


Offset Instance 


0x150 CTIDEVCTL 
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This interface is accessible as follows: 


. When SoftwareLockStatus() accesses to this register are RO. 
° When !SoftwareLockStatus() accesses to this register are RW. 
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H9.3.19 CTIDEVID, CTI Device ID register 0 


The CTIDEVID characteristics are: 


Purpose 
Describes the CTI component to the debugger. 
Configurations 
CTIDEVID is in the Debug power domain. 
There are no configuration notes. 
Attributes 


CTIDEVID is a 32-bit register. 


Field descriptions 


The CTIDEVID bit assignments are: 


26 25 24 23 22 21 16 15 14 13 


RESO ae NUMCHAN [| NUMTRIG RESO | EXTMUXNUM 
nour — F rs 
RESO 


Bits [31:26] 


Reserved, RESO. 


INOUT, bits [25:24] 


Input/output options. Indicates presence of the input gate. If the CTM is not implemented or CTIv2 
is not implemented, this field is RAZ. 


0b00 CTIGATE does not mask propagation of input events from external channels. 
0b01 CTIGATE masks propagation of input events from external channels. 


All other values are reserved. 


Bits [23:22] 


Reserved, RESO. 


NUMCHAN, bits [21:16] 
Number of ECT channels implemented. IMPLEMENTATION DEFINED. For Armv§8, valid values are: 
0b000011 3 channels (0..2) implemented. 
0b000100 4 channels (0..3) implemented. 
0b000101 5 channels (0..4) implemented. 
0b000110 6 channels (0..5) implemented. 
and so on up to 0b100000, 32 channels (0..31) implemented. 


All other values are reserved. 
Bits [15:14] 
Reserved, RESO. 


NUMTRIG bits [13:8] 


Number of triggers implemented. IMPLEMENTATION DEFINED. This is one more than the index of the 
largest trigger, rather than the actual number of triggers. 
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For Armv8, valid values are: 

0b000011 Up to 3 triggers (0..2) implemented. 

0b001000 Up to 8 triggers (0..7) implemented. 

0b001001 Up to 9 triggers (0..8) implemented. 

0b001010 Up to 10 triggers (0..9) implemented. 

and so on up to 0b100000, 32 triggers (0..31) implemented. 


All other values are reserved. If the contains a Trace extension, this field must be at least @b001000. 
There is no guarantee that any of the implemented triggers, including the highest numbered, are 
connected to any components. 


Bits [7:5] 
Reserved, RESO. 


EXTMUXNUM, bits [4:0] 


Number of multiplexors available on triggers. This value is used in conjunction with External 
Control register, ASICCTL. 


Accessing the CTIDEVID: 
CTIDEVID can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFC8 CTIDEVID 
This interface is accessible as follows: 
a Accesses to this register are RO. 
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H9.3.20 CTIDEVID1, CTI Device ID register 1 
The CTIDEVID1 characteristics are: 


Purpose 

Reserved for future information about the CTI component to the debugger. 
Configurations 

CTIDEVID1 is in the Debug power domain. 

There are no configuration notes. 
Attributes 


CTIDEVID1 is a 32-bit register. 


Field descriptions 


The CTIDEVID1 bit assignments are: 


31 0 
RESO 
Bits [31:0] 


Reserved, RESO. 


Accessing the CTIDEVID1: 
CTIDEVID1 can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFC4 CTIDEVID1 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.21 CTIDEVID2, CTI Device ID register 2 
The CTIDEVID2 characteristics are: 


Purpose 

Reserved for future information about the CTI component to the debugger. 
Configurations 

CTIDEVID2 is in the Debug power domain. 

There are no configuration notes. 
Attributes 


CTIDEVID2 is a 32-bit register. 


Field descriptions 


The CTIDEVID2 bit assignments are: 


31 0 
RESO 
Bits [31:0] 


Reserved, RESO. 


Accessing the CTIDEVID2: 
CTIDEVID2 can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFCO CTIDEVID2 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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CTIDEVTYPE, CTI Device Type register 


ARM DDI 0487E.a 


The CTIDEVTYPE characteristics are: 


Purpose 

Indicates to a debugger that this component is part of a PEs cross-trigger interface. 
Configurations 

CTIDEVTYPE is in the Debug power domain. 

Implementation of this register is OPTIONAL. 
Attributes 


CTIDEVTYPE is a 32-bit register. 


Field descriptions 


The CTIDEVTYPE bit assignments are: 


31 8 7 43 0 
RESO SUB MAJOR 
Bits [31:8] 


Reserved, RESO. 


SUB, bits [7:4] 
Subtype. Must read as 0x1 to indicate this is a component within a PE. 


MAJOR, bits [3:0] 


Major type. Must read as 0x4 to indicate this is a cross-trigger component. 


Accessing the CTIDEVTYPE: 


CTIDEVTYPE can be accessed through the external debug interface: 





Component Offset Instance 





CTI @xFCC CTIDEVTYPE 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.23 CTIGATE, CTI Channel Gate Enable register 


The CTIGATE characteristics are: 


Purpose 
Determines whether events on channels propagate through the CTM to other ECT components, or 
from the CTM into the CTI. 

Configurations 
CTIGATE is in the Debug power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on an External debug reset. The register is not affected by a 
Warm reset and is not affected by a Cold reset. 

Attributes 


CTIGATE is a 32-bit register. 


Field descriptions 


The CTIGATE bit assignments are: 


31 0 


GATE<x>, bit [x] 


GATE<x>, bit [x], for x = 0 to 31 
Channel <x> gate enable. 
Bits [31:N] are RAZ/WI. N is the number of ECT channels implemented as defined by the 


CTIDEVID.NUMCHAN field. 

Possible values of this bit are: 

Qbd Disable output and, if CTIDEVID.INOUT == 0b01, input channel <x> propagation. 
Qb1 Enable output and, if CTIDEVID.INOUT == 0b01, input channel <x> propagation. 


If GATE[x] is set to 0, no new events will be propagated to the ECT, and if the ECT supports 
multicycle channel events any existing output channel events will be terminated. 


On a External debug reset, this field resets to an architecturally UNKNOWN value. 


Accessing the CTIGATE: 


CTIGATE can be accessed through the external debug interface: 





Component Offset Instance 





CTI 0x140 CTIGATE 
This interface is accessible as follows: 
. When SoftwareLockStatus() accesses to this register are RO. 
e When !SoftwareLockStatus() accesses to this register are RW. 
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CTIINEN<n>, CTI Input Trigger to Output Channel Enable registers, n = 0 - 31 


ARM DDI 0487E.a 


The CTIINEN<n> characteristics are: 


Purpose 
Enables the signaling of an event on output channels when input trigger event n is received by the 
CTI. 
Configurations 
CTIINEN<n> is in the Debug power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on an External debug reset. The register is not affected by a 
Warm reset and is not affected by a Cold reset. 
If input trigger n is not connected, the behavior of CTIINEN<n> is IMPLEMENTATION DEFINED. 
Attributes 


CTIINENK<n> is a 32-bit register. 


Field descriptions 


The CTIINENK<n> bit assignments are: 


31 0 


INEN<x>, bit [x] 


INEN<x>, bit [x], for x = 0 to 31 
Input trigger <n> to output channel <x> enable. 


Bits [31:N] are RAZ/WI. N is the number of ECT channels implemented as defined by the 
CTIDEVID.NUMCHAN field. 


Possible values of this bit are: 
Ob Input trigger <n> will not generate an event on output channel <x>. 
Qb1 Input trigger <n> will generate an event on output channel <x>. 


On a External debug reset, this field resets to an architecturally UNKNOWN value. 


Accessing the CTIINEN<n>: 


CTIINENK<n> can be accessed through the external debug interface: 





Component Offset Instance 


CTI 0x020 +4n CTIINEN<n> 





This interface is accessible as follows: 
. When SoftwareLockStatus() accesses to this register are RO. 


° When !SoftwareLockStatus() accesses to this register are RW. 
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H9.3.25 CTIINTACK, CTI Output Trigger Acknowledge register 


The CTIINTACK characteristics are: 


Purpose 

Can be used to deactivate the output triggers. 
Configurations 

CTIINTACK is in the Debug power domain. 

There are no configuration notes. 
Attributes 


CTIINTACK is a 32-bit register. 


Field descriptions 


The CTIINTACK bit assignments are: 


31 0 


ACK<n>, bit [n] 


ACK<n>, bit [n], for n = 0 to 31 
Acknowledge for output trigger <n>. 


Bits [31:N] are RAZ/WI. N is the number of CTI triggers implemented as defined by the 
CTIDEVID.NUMTRIG field. 


If any of the following is true, writes to ACK<n> are ignored: 

. n >= CTIDEVID.NUMTRIG, the number of implemented triggers. 

e Output trigger n is not active. 

° The channel mapping function output, as controlled by CTIOUTEN<p>, is still active. 


Otherwise, if any of the following are true, it is IMPLEMENTATION DEFINED whether writes to 
ACK<n> are ignored: 


° Output trigger n is not implemented. 
° Output trigger n is not connected. 
° Output trigger n is self-acknowledging and does not require software acknowledge. 


Otherwise, the behavior on writes to ACK<n> is as follows: 
Ob No effect 
Qb1 Deactivate the trigger. 


Accessing the CTIINTACK: 


A debugger must read CTITRIGOUTSTATUS to confirm that the output trigger has been acknowledged before 
generating any event that must be ordered after the write to CTIINTACK, such as a write to CTIAPPPULSE to 


activate another trigger. 


CTIINTACK can be accessed through the external debug interface: 





Component Offset Instance 


CTI 0x010 CTIINTACK 
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This interface is accessible as follows: 
° When SoftwareLockStatus() accesses to this register are WI. 


° When !SoftwareLockStatus() accesses to this register are WO. 
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H9.3.26 


H9-6990 


CTIITCTRL, CTI Integration mode Control register 


The CTIITCTRL characteristics are: 


Purpose 


Enables the CTI to switch from its default mode into integration mode, where test software can 
control directly the inputs and outputs of the PE, for integration testing or topology detection. 


Configurations 


It is IMPLEMENTATION DEFINED whether CTUTCTRL is implemented in the Core power domain or 
in the Debug power domain. Some or all RW fields of this register have defined reset values, and: 


° The register is not affected by a Warm reset. 


° If the register is implemented in the Core power domain the reset values apply on a Cold 
reset, and the register is not affected by an External debug reset. 


° If the register is implemented in the Debug power domain the reset values apply on an 
External debug reset, and the register is not affected by a Cold reset. 


Implementation of this register is OPTIONAL. 


Attributes 
CTITCTRL is a 32-bit register. 


Field descriptions 


The CTIITCTRL bit assignments are: 


Bits [31:1] 


Reserved, RESO. 


IME, bit [0] 


Integration mode enable. When IME == 1, the device reverts to an integration mode to enable 
integration testing or topology detection. The integration mode behavior is IMPLEMENTATION 


DEFINED. 
Obd Normal operation. 
Qb1 Integration mode enabled. 


On a Implementation reset, this field resets to 0. 


Accessing the CTIITCTRL: 


CTIITCTRL can be accessed through the external debug interface: 





Component Offset Instance 


CTI OxF0Q CTUTCTRL 
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This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are RW. 


° Otherwise accesses to this register are IMPDEF. 
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H9.3.27 


H9-6992 


CTILAR, CTI Lock Access Register 


The CTILAR characteristics are: 


Purpose 
Allows or disallows access to the CTI registers through a memory-mapped interface. 


The optional Software Lock provides a lock to prevent memory-mapped writes to the Cross-Trigger 
Interface registers. Use of this lock mechanism reduces the risk of accidental damage to the contents 
of the Cross-Trigger Interface registers. It does not, and cannot, prevent all accidental or malicious 


damage. 


Configurations 
CTILAR is in the Debug power domain. 
If ARMv8.4-Debug is implemented, the Software Lock is not implemented. 
Software uses CTILAR to set or clear the lock, and CTILSR to check the current status of the lock. 


Attributes 
CTILAR is a 32-bit register. 


Field descriptions 


The CTILAR bit assignments are: 


When the Software Lock is implemented: 


KEY, bits [31:0] 
Lock Access control. Writing the key value @xC5ACCE55 to this field unlocks the lock, enabling write 
accesses to this component's registers through a memory-mapped interface. 


Writing any other value to this register locks the lock, disabling write accesses to this component's 
registers through a memory mapped interface. 


Otherwise: 
31 0 
Bits [31:0] 


Reserved, RESO. 


Accessing the CTILAR: 


CTILAR can be accessed through a memory-mapped interface access to the external debug interface: 





Component Offset Instance 


CTI OxFBO CTILAR 
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This interface is accessible as follows: 


° Accesses to this register are WO. 
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H9.3.28 


H9-6994 


CTILSR, CTI Lock Status Register 


The CTILSR characteristics are: 


Purpose 
Indicates the current status of the Software Lock for CTI registers. 


The optional Software Lock provides a lock to prevent memory-mapped writes to the Cross-Trigger 
Interface registers. Use of this lock mechanism reduces the risk of accidental damage to the contents 
of the Cross-Trigger Interface registers. It does not, and cannot, prevent all accidental or malicious 


damage. 


Configurations 


CTILSR is in the Debug power domain. Some or all RW fields of this register have defined reset 
values. These apply only on an External debug reset. The register is not affected by a Warm reset 
and is not affected by a Cold reset. 


If ARMv8.4-Debug is implemented, the Software Lock is not implemented. 
Software uses CTILAR to set or clear the lock, and CTILSR to check the current status of the lock. 


Attributes 
CTILSR is a 32-bit register. 


Field descriptions 


The CTILSR bit assignments are: 


Bits [31:3] 


Reserved, RESO. 


nTT, bit [2] 
Not thirty-two bit access required. RAZ. 


SLK, bit [1] 
When the Software Lock is implemented: 


Software Lock status for this component. For an access to LSR that is not amemory-mapped access, 
or when the Software Lock is not implemented, this field is RESO. 


For memory-mapped accesses when the Software Lock is implemented, possible values of this field 


are: 
Qbd Lock clear. Writes are permitted to this component's registers. 
Qb1 Lock set. Writes to this component's registers are ignored, and reads have no side 


effects. 
On a External debug reset, this field resets to 1. 
Otherwise: 


Reserved, RAZ. 
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SLI, bit [0] 


Software Lock implemented. For an access to LSR that is not a memory-mapped access, this field 
is RAZ. For memory-mapped accesses, the value of this field is IMPLEMENTATION DEFINED. 
Permitted values are: 


Qbd Software Lock not implemented or not memory-mapped access. 


Qb1 Software Lock implemented and memory-mapped access. 


Accessing the CTILSR: 


CTILSR can be accessed through a memory-mapped interface access to the external debug interface: 





Component Offset Instance 





CTI QxFB4 CTILSR 
This interface is accessible as follows: 
$ Accesses to this register are RO. 
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H9.3.29 CTIOUTEN<n>, CTI Input Channel to Output Trigger Enable registers, n = 0 - 31 


The CTIOUTEN<n> characteristics are: 


Purpose 
Defines which input channels generate output trigger n. 
Configurations 
CTIOUTEN<n> is in the Debug power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply only on an External debug reset. The register is not affected by a 
Warm reset and is not affected by a Cold reset. 
If output trigger n is not connected, the behavior of CTIOUTEN<n> is IMPLEMENTATION DEFINED. 
Attributes 


CTIOUTEN<n> is a 32-bit register. 


Field descriptions 


The CTIOUTEN<n> bit assignments are: 


31 0 


OUTEN<xe, bit [x] 


OUTEN<x>, bit [x], for x = 0 to 31 
Input channel <x> to output trigger <n> enable. 


Bits [31:N] are RAZ/WI. N is the number of ECT channels implemented as defined by the 
CTIDEVID.NUMCHAN field. 


Possible values of this bit are: 
Qbd An event on input channel <x> will not cause output trigger <n> to be asserted. 
Qb1 An event on input channel <x> will cause output trigger <n> to be asserted. 


On a External debug reset, this field resets to an architecturally UNKNOWN value. 


Accessing the CTIOUTEN<n>: 


CTIOUTEN<n> can be accessed through the external debug interface: 








Component Offset Instance 

CTI 0x0A0 + 4n CTIOUTEN<n> 
This interface is accessible as follows: 
. When SoftwareLockStatus() accesses to this register are RO. 


° When !SoftwareLockStatus() accesses to this register are RW. 
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H9.3.30 CTIPIDRO, CTI Peripheral Identification Register 0 


The CTIPIDRO characteristics are: 


Purpose 

Provides information to identify a CTI component. 

For more information see About the Peripheral identification scheme on page K2-7661. 
Configurations 

CTIPIDRO is in the Debug power domain. 

Implementation of this register is OPTIONAL. 

This register is required for CoreSight compliance. 
Attributes 


CTIPIDRO is a 32-bit register. 


Field descriptions 


The CTIPIDRO bit assignments are: 


Bits [31:8] 
Reserved, RESO. 


PART 0, bits [7:0] 


Part number, least significant byte. 


Accessing the CTIPIDRO: 


CTIPIDRO can be accessed through the external debug interface: 





Component 


Offset Instance 


OxFEO CTIPIDRO 





CTI 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.31 CTIPIDR1, CTI Peripheral Identification Register 1 


The CTIPIDR1 characteristics are: 


Purpose 

Provides information to identify a CTI component. 

For more information see About the Peripheral identification scheme on page K2-7661. 
Configurations 

CTIPIDR1 is in the Debug power domain. 

Implementation of this register is OPTIONAL. 

This register is required for CoreSight compliance. 
Attributes 


CTIPIDR1 is a 32-bit register. 


Field descriptions 


The CTIPIDR1 bit assignments are: 


31 8 7 43 0 
RESO DES_0 | PART1 
Bits [31:8] 


Reserved, RESO. 


DES _0, bits [7:4] 
Designer, least significant nibble of JEP106 ID code. For Arm Limited, this field is 0b1011. 


PART 1, bits [3:0] 


Part number, most significant nibble. 


Accessing the CTIPIDR1: 


CTIPIDR1 can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFE4 CTIPIDR1 
This interface is accessible as follows: 
à Accesses to this register are RO. 
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H9.3.32 CTIPIDR2, CTI Peripheral Identification Register 2 


The CTIPIDR2 characteristics are: 


Purpose 

Provides information to identify a CTI component. 

For more information see About the Peripheral identification scheme on page K2-7661. 
Configurations 

CTIPIDR2 is in the Debug power domain. 

Implementation of this register is OPTIONAL. 

This register is required for CoreSight compliance. 
Attributes 


CTIPIDR2 is a 32-bit register. 


Field descriptions 


The CTIPIDR2 bit assignments are: 


31 8 7 43 2 0 


RESO REVISION [| DES_1 


Bits [31:8] 
Reserved, RESO. 


REVISION, bits [7:4] 


JEDEC 


Part major revision. Parts can also use this field to extend Part number to 16-bits. 


JEDEC, bit [3] 
RAO. Indicates a JEP 106 identity code is used. 


DES _1, bits [2:0] 


Designer, most significant bits of JEP 106 ID code. For Arm Limited, this field is 0b011. 


Accessing the CTIPIDR2: 


CTIPIDR2 can be accessed through the external debug interface: 





Offset Instance 


OxFE8 CTIPIDR2 





Component 
CTI 
This interface is accessible as follows: 
è Accesses to this register are RO. 
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H9.3.33 CTIPIDR3, CTI Peripheral Identification Register 3 


The CTIPIDR3 characteristics are: 


Purpose 

Provides information to identify a CTI component. 

For more information see About the Peripheral identification scheme on page K2-7661. 
Configurations 

CTIPIDR3 is in the Debug power domain. 

Implementation of this register is OPTIONAL. 

This register is required for CoreSight compliance. 
Attributes 


CTIPIDR3 is a 32-bit register. 


Field descriptions 


The CTIPIDR3 bit assignments are: 


31 8 7 43 0 
RESO REVAND | CMOD 
Bits [31:8] 


Reserved, RESO. 


REVAND, bits [7:4] 
Part minor revision. Parts using CTIPIDR2.REVISION as an extension to the Part number must use 
this field as a major revision number. 


CMOD, bits [3:0] 


Customer modified. Indicates someone other than the Designer has modified the component. 


Accessing the CTIPIDR3: 


CTIPIDR3 can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFEC CTIPIDR3 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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CTIPIDR4, CTI Peripheral Identification Register 4 


ARM DDI 0487E.a 


The CTIPIDR4 characteristics are: 


Purpose 

Provides information to identify a CTI component. 

For more information see About the Peripheral identification scheme on page K2-7661. 
Configurations 

CTIPIDR4 is in the Debug power domain. 

Implementation of this register is OPTIONAL. 

This register is required for CoreSight compliance. 
Attributes 


CTIPIDR4 is a 32-bit register. 


Field descriptions 


The CTIPIDR4 bit assignments are: 


31 8 7 43 0 
RESO SIZE DES 2 
Bits [31:8] 


Reserved, RESO. 


SIZE, bits [7:4] 
Size of the component. RAZ. Log» of the number of 4KB pages from the start of the component to 
the end of the component ID registers. 


DES_2, bits [3:0] 
Designer, JEP 106 continuation code, least significant nibble. For Arm Limited, this field is @b0100. 


Accessing the CTIPIDR4: 


CTIPIDR4 can be accessed through the external debug interface: 





Component Offset Instance 





CTI OxFDO CTIPIDR4 
This interface is accessible as follows: 
od Accesses to this register are RO. 
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H9.3.35 CTITRIGINSTATUS, CTI Trigger In Status register 
The CTITRIGINSTATUS characteristics are: 


Purpose 
Provides the status of the trigger inputs. 
Configurations 
CTITRIGINSTATUS is in the Debug power domain. 
There are no configuration notes. 
Attributes 


CTITRIGINSTATUS is a 32-bit register. 


Field descriptions 


The CTITRIGINSTATUS bit assignments are: 


31 0 


TRIN<n>, bit [n] 


TRIN<n>, bit [n], for n = 0 to 31 
Trigger input <n> status. 


Bits [31:N] are RAZ. N is the number of CTI triggers implemented as defined by the 
CTIDEVID.NUMTRIG field. 


Possible values of this bit are: 

Qbd Input trigger n is inactive. 

Qb1 Input trigger n is active. 

Not implemented and not-connected input triggers are always inactive. 


It is IMPLEMENTATION DEFINED whether an input trigger that does not support multicycle events can 
be observed as active. 


Accessing the CTITRIGINSTATUS: 


CTITRIGINSTATUS can be accessed through the external debug interface: 





Component Offset Instance 





CTI 0x130 CTITRIGINSTATUS 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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H9.3.36 CTITRIGOUTSTATUS, CTI Trigger Out Status register 
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The CTITRIGOUTSTATUS characteristics are: 


Purpose 
Provides the raw status of the trigger outputs, after processing by any IMPLEMENTATION DEFINED 
trigger interface logic. For output triggers that are self-acknowledging, this is only meaningful if the 
CTI implements multicycle channel events. 

Configurations 
CTITRIGOUTSTATUS is in the Debug power domain. 
There are no configuration notes. 

Attributes 


CTITRIGOUTSTATUS is a 32-bit register. 


Field descriptions 


The CTITRIGOUTSTATUS bit assignments are: 


31 0 


TROUT<n>, bit [n] 


TROUT<n>, bit [n], for n = 0 to 31 
Trigger output <n> status. 
Bits [31:N] are RAZ. N is the value in CTIDEVID.NUMTRIG. 


Ifn<N, and output trigger <n> is implemented and connected, and either the trigger is not 
self-acknowledging or the CTI implements multicycle channel events, then permitted values for 


TROUT<»> are: 
Qbd Output trigger n is inactive. 
Qb1 Output trigger n is active. 


Otherwise when n < N it is IMPLEMENTATION DEFINED whether TROUT<n> behaves as described 
here or is RAZ. 


Accessing the CTITRIGOUTSTATUS: 


CTITRIGOUTSTATUS can be accessed through the external debug interface: 





Component Offset Instance 





CTI 0x134 CTITRIGOUTSTATUS 
This interface is accessible as follows: 
7 Accesses to this register are RO. 
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Memory-mapped Components of the Armv8 Architecture 


Chapter 11 
Requirements for Memory-mapped Components 


This chapter provides some additional information about memory-mapped components. It contains the following 
sections: 


: Supported access sizes on page 11-7008. 


s Synchronization of memory-mapped registers on page 11-7010. 
. Access requirements for reserved and unallocated registers on page 11-7012. 
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11.1 


11-7008 


Supported access sizes 


The information in this section applies to all accesses to memory-mapped components of the Armv8 architecture, 
unless a register or component description explicitly states otherwise. 


The memory access sizes that are supported by any peripheral are IMPLEMENTATION DEFINED by the peripheral. 


When HaveSecureExtDebugView() == TRUE, each debug component has a Secure and Non-secure view. The Secure 
view of a debug component is mapped into Secure physical memory and the Non-secure view of a debug component 
is mapped into Non-secure memory. Apart from access conditions, the Non-secure and Secure views of the debug 
components are identical. 


An implementation of a memory-mapped component that is compatible with the Armv8 architecture must support 
the following: 


° Word-aligned 32-bit accesses to access 32-bit registers. 


à If any PE in the system implements AArch32, word-aligned 32-bit accesses to either half of a 64-bit register 
that is mapped to a doubleword-aligned pair of adjacent 32-bit locations. 





Note 


Some memory-mapped components of the Armv8 architecture require support for word-aligned 32-bit 
accesses to either half of a 64-bit memory mapped register regardless of whether any PE in the system 
implements AArch32. These include: 


— The memory-mapped interface to the external debug and CTI registers that are described in 
Chapter H9 External Debug Register Descriptions. 


— The memory-mapped interfaces to the Generic Timer registers that are described in Chapter 12 System 
Level Implementation of the Generic Timer. 


— The memory-mapped interfaces to the Performance Monitors registers that are described in Chapter 13 
Recommended External Interface to the Performance Monitors. 





° Doubleword-aligned 64-bit accesses to access 64-bit registers that are mapped to a doubleword-aligned pair 
of adjacent 32-bit locations. 


All registers are only single-copy atomic at word granularity. This means that for 64-bit accesses to a 64-bit register, 
the system might generate a pair of 32-bit accesses. The order in which the two halves are accessed is not specified. 


The following accesses are not supported: 


° Byte accesses. 

° Halfword accesses. 

° Unaligned word accesses. These accesses are not word single-copy atomic. 

è Unaligned doubleword accesses. These accesses are not doubleword single-copy atomic. 

e Doubleword accesses to a pair of 32-bit locations that are not a doubleword-aligned pair that forms a 64-bit 
register. 

. Quadword accesses or higher accesses. 

. Exclusive accesses. 


For unsupported accesses, it is CONSTRAINED UNPREDICTABLE whether: 


- The access generates an External abort or not. 
° The defined side-effects of a read occur or not. A read returns UNKNOWN values. 
e A write is ignored or sets the accessed register or registers to UNKNOWN. 
a The access generates a fault handling interrupt or not. A read returns UNKNOWN data. 
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Requirements for Memory-mapped Components 
11.1 Supported access sizes 


For memory-mapped accesses from a PE that complies with an Arm architecture, the single-copy atomicity rules 
for the instruction, the type of instruction, and the type of memory that is accessed, determine the size of the access 
that is made by an instruction. Example I1-1 shows this. 


Example 11-1 Access sizes for memory-mapped accesses 


Two Load Doubleword instructions that are made to consecutive doubleword-aligned locations generate a pair of 
single-copy atomic doubleword reads. However, if the accesses are made to Normal memory or Device-GRE 
memory they might appear as a single quadword access that is not supported by the peripheral. 


The Armv8 architecture does not require the size of each element that is accessed by a multi-register load or store 
instruction to be identifiable by the memory system beyond the PE. Unless otherwise specified by the component, 
any access to a memory-mapped component of the Armv8 architecture is defined to be beyond the PE. 


Software must use a Device-nGRE or stronger memory type, and only single register load and store instructions, to 
create memory accesses that are supported by the peripheral. For more information, see Memory types and attributes 
on page B2-143. 
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Synchronization of memory-mapped registers 


This section describes the synchronization requirements for the memory-mapped accesses to System registers. 


This section refers to accesses to external system control registers as external reads and external writes. It refers to 
accesses to System registers as direct reads, direct writes, indirect reads and indirect writes. 


— Note 

Synchronization requirements for AArch64 System registers on page D13-2819 and Synchronization of changes to 
AArch32 System registers on page G8-5896 define direct read, direct write, indirect read, and indirect write, and 
classifies external reads as indirect reads and external writes as indirect writes. 





Writes to the same register are serialized, meaning they are observed in the same order by all observers, although 
some observers might not observe all of the writes. Unless otherwise stated, external writes to different registers are 
not necessarily observed in the same order by all observers as the order in which they complete. 


Explicit synchronization is not required for an external read or an external write by an external agent to be 
observable to a following external read or external write by that agent to the same register using the same address, 
and so is never required for registers that are accessible as external system control registers. 


Unless required to be observable to all observers in finite time, without explicit synchronization, explicit 
synchronization is normally required following an external write to any register for that write to be observable by: 


. A direct access. 
x An indirect read by an instruction. 
7 An external read of the register using a different address. 


This means that an external write by an external agent is guaranteed to have an effect on subsequent instructions 
executed by the PE only if all of the following are true: 


° The write has completed. 
è The PE has executed a Context synchronization event. 
è The Context synchronization event was executed after the write completed. 


The order and synchronization of direct reads and direct writes of System registers is defined by: 
s Synchronization requirements for AArch64 System registers on page D13-2819 
$ Synchronization of changes to AArch32 System registers on page G8-5896 


The external agent must be able to guarantee completion of a write. For example, the agent can: 


è Mark the memory as Device-nGnRnE and executing a DSB barrier, if the system supports this property. 
$ If the register is read/write and reads are not destructive, read back the value written. 
. Use some guaranteed property of the connection between the PE and the external agent. 


The external agent and PE can guarantee ordering by, for example, passing messages in an ordered way with respect 
to the external write and the Context synchronization event, and relying on the memory ordering rules provided by 
the memory model. 


External reads and external write complete in the order in which they arrive at the PE. For accesses to different 
register locations the external agent must create this order. The agent can: 


° Mark the memory as Device-nGnRnE or Device-nGnRE. 
° Use the appropriate memory barriers. 
° Rely on some guaranteed property of the connection between the PE and the external agent. 


However, the external agent cannot force the synchronization of completed writes. 


In a simple sequential execution, an indirect write that occurs as a side-effect of an access happens atomically with 
the access, meaning no other accesses are allowed between the register access and its side-effect. 


Without explicit synchronization to guarantee the order of the accesses, where the same register is accessed by two 
or more of a System register access instruction, and external agent, and autonomous asynchronous event, or as a 
result of a memory-mapped access, the behavior must be as if the accesses occurred atomically and in any order. 
This applies even if the accesses occur simultaneously. 
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For example, some registers have the property that for certain bits a write of 0 is ignored and a write of 1 has an 
effect. This means the simultaneous writes must be merged. 
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11.3 Access requirements for reserved and unallocated registers 
This section describes the access requirements for reserved and unallocated memory-mapped components. 
The following information relates to certain types of reserved accesses: 
° Reads and writes of unallocated locations. These accesses are reserved for the architecture. 


° Reads and writes of locations for features that are not implemented, including: 
— OPTIONAL features that are not implemented. 
— Breakpoints and watchpoints that are not implemented. 
— Performance Monitors counters that are not implemented. 
— CTI triggers that are not implemented. 


— Error records that are not implemented. 


These accesses are reserved. 
° Reads of WO locations. These accesses are reserved for the architecture. 
. Writes to RO locations. These accesses are reserved for the architecture. 


Reserved accesses are normally RAZ/WI. However, software must not rely on this property as the behavior of 
reserved values might change in a future revision of the architecture. Software must treat reserved accesses as RESO. 
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This chapter defines the system level implementation of the Generic Timer. It contains the following sections: 


About the Generic Timer specification on page 12-7014. 
Memory-mapped counter module on page 12-7016. 
Memory-mapped timer components on page 12-7020. 


Note 





Generic Timer memory-mapped register descriptions on page 15-7151 describes the System level Generic 
Timer registers. These registers are memory-mapped. 


Appendix K5 Additional Information for Implementations of the Generic Timer gives additional information, 
that does not form part of the architectural definition of a system level implementation of the Generic Timer, 


Chapter D11 The Generic Timer in AArch64 state gives a general description of the AArch64 state view of 
the Generic Timer, and describes the AArch64 System register interface to the Generic Timer. 


Chapter G6 The Generic Timer in AArch32 state gives a general description of the AArch32 state view of the 
Generic Timer, and describes the AArch32 System register interface to the Generic Timer. 
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12.1 


12.1.1 
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About the Generic Timer specification 


Chapter D11 The Generic Timer in AArch64 state describes the Arm Generic Timer and its implementation as seen 
from AArch6é4 state. Chapter G6 The Generic Timer in AArch32 state describes the Arm Generic Timer and its 
implementation as seen from AArch32 state. These chapters include the definition of the low-latency System 
register interface to the Generic Timer. However, the Arm Generic Timer architecture also defines a 
memory-mapped component, that comprises: 


i A memory-mapped counter module, that controls the generation of the Count value used by the Generic 
Timer. 


This memory-mapped counter module is required in any Arm Generic Timer implementation that requires 
software control of the Count value of the Generic Timer. 


$ Optional memory-mapped timer modules. These give a standardized way of providing timers for 
programmable system components other than PEs that implement the Arm architecture. 


The full set of Generic Timer components on page D11-2791 summarizes these components as seen from AArch64 
state, and The full set of Generic Timer components on page G6-5859 summarizes them as seen from AArch32 state. 
The system level components of the Generic Timer on page 12-7015 summarizes the system level components. 


Registers in the system level implementation of the Generic Timer 


Registers that control components of the system level implementation of the Generic Timer are grouped into frames. 
This specification defines the registers in each frame, and their offsets within the frame. The system defines the 
position of each frame in the memory map. This means the base addresses for each frame is IMPLEMENTATION 
DEFINED. 





Note 
The final 12 words of the first or only 4KB block of a register memory frame is an ID block. 





Each frame must be in its own memory page, or memory protection region, and must be aligned to the size of the 
translation granule or protection granule. 


Note 


When a system level implementation of the Generic Timer is accessed by a PE: 





: Using a VMSA, each frame is in its own memory page, aligned to the size of the translation granule. 


` Using a PMSA, each frame is in its own memory protection region, aligned to the size of the memory 
protection granule. 





The following sections give more information about the requirements for the system level Generic Timer 
component: 


5 Endianness and supported access sizes. 


. Power and reset domains for the system level implementation of the Generic Timer on page 12-7015. 


Endianness and supported access sizes 


All memory-mapped peripherals defined in the Arm architecture must be little-endian. This means the system-level 
Generic Timer registers, and the register frames, are little-endian. 


The memory access sizes supported by any peripheral is IMPLEMENTATION DEFINED by the peripheral. For accesses 
to the memory-mapped Generic Timer registers implementations must: 


à Comply with the requirements of Supported access sizes on page 11-7008. 


° Support word-aligned 32-bit accesses to access 32-bit registers or either half of a 64-bit register mapped to a 
doubleword-aligned pair of adjacent 32-bit locations, even if no PE in the system implements AArch32. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


System Level Implementation of the Generic Timer 
12.1 About the Generic Timer specification 


Power and reset domains for the system level implementation of the Generic Timer 


The power and reset domains of the system level implementation of the Generic Timer are IMPLEMENTATION 
DEFINED as part of the system implementation. These domains can be outside the PE power and reset domains 
defined by the remainder of this manual. 


The Arm architecture requires that the CNTCR. {FCREQ, EN} and CNTSR.FCACK fields reset to 0. These reset 
values apply only on powerup of the power domain in which the registers are implemented or a reset of the reset 
domain in which they are implemented. 


Every other register, or register field, of a system level implementation of the Generic Timer resets to a value that 
is architecturally UNKNOWN if it has a meaningful reset value. This applies on powerup of the power domain in 
which the register is implemented, and on a reset of the reset domain in which it is implemented. 


12.1.2 The system level components of the Generic Timer 
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Each system level component has one or two register frames. The possible system level components are: 


The memory-mapped counter module, required 


This module controls the system counter. It has two frames: 
° A control frame, CNTControlBase. 
. A status frame, CNTReadBase. 


Memory-mapped counter module on page 12-7016 describes this component. 


The memory-mapped timer control module, required 


The system level implementation of the Generic Timer can provide up to eight timers, and the 
memory-mapped timer control module identifies: 


° Which timers are implemented. 
a The features of each implemented timer. 


This module has a single frame, CNTCTLBase. 
The CNTCTLBase frame on page 12-7021 describes this frame. 


Memory-mapped timers, optional 
An implemented memory-mapped timer: 
. Must provide a privileged view of the timer, in the CNTBaseN frame. 
e Optionally provides an unprivileged view of the timer in the CNTELOBaseN frame. 
N is the timer number, and the corresponding frame number, in the range 0-7. 
The CNTBaseN and CNTELOBaseN frames on page 12-7022 describes these frames. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 12-7015 
Non-Confidential 


System Level Implementation of the Generic Timer 
12.2 Memory-mapped counter module 


12.2 


12-7016 


Memory-mapped counter module 


The memory-mapped counter module provides top-level control of the system counter. The CNTControlBase frame 
holds the registers for the memory-mapped counter, and provides: 


An RW control register CNTCR, that provides: 
— An enable bit for the system counter. 
— An enable bit for Halt-on-debug. For more information, see Halt-on-debug on page I2-7018. 


— A field that can be written to request a change to the update frequency of the system counter, with a 
corresponding change to the increment made at each update. This mechanism means that, for example, 
if the update frequency is halved, the increment at each update is doubled. 


For more information, see Control of counter operating frequency and increment on page 12-7017. 
Writes to this register are rare. In a system that supports two Security states, this register is writable only by 
Secure writes. 

A RO status register, CNTSR, that provides: 

— A bit that indicates whether the system counter is halted because of an asserted Halt-on-debug signal. 

— A field that indicates the current update frequency of the system counter. This field can be polled to 
determine when a requested change to the update frequency has been made. 

Two contiguous 32-bit RW registers that hold the current system counter value, CNTCV. If the system 

supports 64-bit atomic accesses, these two registers must be accessible by such accesses. 


The system counter must be disabled before writing to these registers, otherwise the effect of the write is 
UNPREDICTABLE. 


Writes to these registers are rare. In a system that supports two Security states, these registers are writable 
only by Secure writes. 
A Frequency modes table of one or more 32-bit entries, where: 


— The first entry in the table defines the base frequency of the system counter. This is the maximum 
frequency at which the counter updates. 


— Each subsequent entry in the table defines an alternative frequency of the system counter, that must be 
an exact divisor of the base frequency. 


A 32-bit zero entry immediately follows the last table entry. 
This table can be RO or RW. For more information, see The Frequency modes table on page 12-7017. 


In addition, the CNTReadBase frame includes a read-only copy of the system counter value, CNTCV, as two 
contiguous 32-bit RO registers. If the system supports 64-bit atomic accesses, these two registers must be accessible 
by such accesses. 


Counter module control and status register summary on page 12-7018 describes CNTReadBase and 
CNTControlBase memory maps, and the registers in each frame. 
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The system counter has a fixed base frequency, and must maintain the required counter accuracy, meaning Arm 
recommends that it does not gain or lose more than ten seconds in a 24-hour period, see The system counter on 
page D11-2792. However, the counter can increment at a lower frequency than the base frequency, using a 
correspondingly larger increment. For example, it can increment by four at a quarter of the base frequency. Any 
lower-frequency operation, and any switching between operating frequencies, must not reduce the accuracy of the 
counter. 


Control of the system counter frequency and increment is provided only through the memory-mapped counter 
module. The following sections describe this control: 


. The Frequency modes table. 


7 Changing the system counter and increment. 


The Frequency modes table 

The Frequency modes table starts at offset 0x20 in the CNTControlBase frame. 

Table entries are 32-bits, and each entry specifies a system counter update frequency, in Hz. 
The first entry in the table specifies the base frequency of the system counter. 


When the system timer is operating at a lower frequency than the base frequency, the increment applied at each 
counter update is given by: 


increment = (base_frequency) / (selected_frequency) 


A 32-bit word of zero value marks the end of the table. That is, the word of memory immediately after the last entry 
in the table must be zero. 


The only required entry in the table is the entry for the base frequency. 


Typically, the Frequency modes table is in RO memory. However, a system implementation might use RW memory 
for the table, and initialize the table entries as part of its startup sequence. Therefore, the CNTControlBase memory 
map shows the table region as RO or RW. 


Arm strongly recommends that the Frequency modes table is not updated once the system is running. 


The architecture can support up to 1004 entries in the Frequency modes table, including the zero-word end marker, 
and the maximum number of entries is IMPLEMENTATION DEFINED, up to this limit. 





Note 
è Arm considers it likely that implementations will require significantly fewer entries than the architectural 
limit. 
è In the CNTControlBase frame, the offset range 0x0C0-0x0FC can be used for IMPLEMENTATION DEFINED 


registers. If any registers are defined in this space, then the Frequency modes table cannot extend beyond 
offset 0x0B8, with a zero word at offset 0x0BC. This means that if any IMPLEMENTATION DEFINED registers are 
defined the maximum number of entries in the table is 40, including the zero-word end marker. 





Changing the system counter and increment 


The value of the CNTCR.FCREQ field specifies which entry in the Frequency modes table specifies the system 
counter update frequency. 


Changing the value of CNTCR.FCREQ requests a change to the system counter update frequency. To ensure the 
frequency change does not affect the overall accuracy of the counter, a change is made as follows: 


s When changing from a higher frequency to a lower frequency, the counter: 
1. Continues running at the higher frequency until the count reaches an integer multiple of the required 
lower frequency. 
2. Switches to operating at the lower frequency. 
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è When changing from a lower frequency to a higher frequency, the counter: 
1. Waits until the end of the current lower-frequency cycle. 
2: Makes the counter increment required for operation at that lower frequency. 


3. Switches to operating at the higher frequency. 


When the frequency has changed, CNTSR is updated to indicate the new frequency. Therefore, a system component 
that is waiting for a frequency change can poll CNTSR to detect the change. 


Halt-on-debug 


The CNTCR register provides an enable bit for an OPTIONAL Halt-on-debug signal. 


When the CNTCR.HDBG bit is set to 1, and the Halt-on-debug signal is implemented and asserted, the system 
counter is halted. Otherwise, the system counter ignores the state of this signal. 


Arm recommends that a system counter implements a Halt-on-debug signal that can be controlled by a debugger 
using the Embedded Cross-Trigger (ECT) using a system-level cross-trigger interface that includes: 


. A debug request output trigger event that asserts the Halt-on-debug signal. 
° A restart request output trigger event that deasserts the Halt-on-debug signal. 


For more information, see About the Embedded Cross-Trigger (ECT) on page H5-6790. 


Note 


Software must use the Halt-on-debug enable bit to ensure that the timers cannot be halted maliciously in an attempt 
to prohibit progress. 








For more information about Halt-on-debug, contact Arm. 


Counter module control and status register summary 


The Counter module control and status registers are memory-mapped registers in the following register memory 
frames: 


. A control frame, with base address CNTControlBase. 
° A status frame, with base address CNTReadBase. 


Each of these register memory frames is in its own memory page or memory protection region, and the frame base 
address points to the start of this region. Each base address must be aligned to the size of the translation granule or 
protection granule. 


Note 


Each frame of a memory-mapped Generic Timer takes the name of its base address. 








In each register memory frame, the memory at offset 0xFD0-0xFFF is reserved for twelve 32-bit IMPLEMENTATION 
DEFINED ID registers, see the CounterID<n> register descriptions for more information. 


Note 


The Arm architecture requires memory-mapped peripherals to be little-endian, and therefore the counter is 
little-endian. 








In an implementation that supports Secure and Non-secure memory maps, CNTControlBase is accessible only by 
Secure accesses. 


Table I2-1 on page I2-7019 shows the CNTControlBase control registers, in order of their offsets from the 
CNTControlBase base address, for an implementation that includes registers in the implementation defined register 
space 0x0C0-0x0FC, and also has fewer than 39 CNTFID<n> registers. The Frequency modes table on page 12-7017 
describes how this memory map differs if more CNTFID<n> registers are implemented. 
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Generic Timer memory-mapped register descriptions on page 15-7151 describes each of these registers. 


Table I2-1 CNTControlBase memory map 






























































Offset Name Type Description 

0x000 CNTCR RW Counter Control Register. 

0x004 CNTSR RO Counter Status Register. 

0x008 CNTCV[31:0] RW Counter Count Value register. 

0x00C CNTCV[63:32] RW 

0x010 CNTSCR2 RW Counter Scale Register. 

0x014-0x018 - RESO Reserved. 

0x01C CNTID? RO Counter Identification Register. 

0x020 CNTFIDO RO or RW Frequency modes table, and end marker. 
axe2er4n CNTFID<n> RO or RW a os o see The Frequency modes table on 
0x024+4n - RO or RW, RAZ 

(0x028+4n)-0x0BC - RO, RESO Reserved. 

Ox0CO-OxOFC = IMPLEMENTATION DEFINED Reserved for IMPLEMENTATION DEFINED registers. 
0x100-0xFCC - RO, RESO Reserved. 

OxFDO-OxFFC CounterID<n> RO Counter ID registers 0-11. 


a. Implemented only if ARMv8.4-CNTSC is implemented. 
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Table 12-2 shows the CNTReadBase control registers, in order of their offsets from the CNTReadBase base address. 
Generic Timer memory-mapped register descriptions on page I5-7151 describes each of these registers. 


Table 12-2 CNTReadBase memory map 














Offset Name Type Description 

0x000 CNTCV[31:0] RO Counter Count Value register 
0x004 CNTCV[63:32] RO 

0x008-0xFCC - RESO Reserved 





@xFD@-@xFFC CounterID<n> RO Counter ID registers 0-11 
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12.3 
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Memory-mapped timer components 


This part of the Arm Generic Timer specification defines an optional memory-mapped timer component. This can 
be implemented as part of any programmable system component that does not incorporate a System register mapped 
Arm Generic Timer, to provide that system component with the timer functionality of an Arm Generic Timer. 


The memory map consists of up to eight timer frames. The base address of a frame is CNTBaseN, where N numbers 
from 0 up to a maximum permitted value of 7. 


Each CNTBaseN timer frame: 


. Provides its own set of timers and associated interrupts. 
s Is implemented in its own memory page or memory protection region. 
s Is implemented at a base address, identified as CNTBaseN, that is aligned to the size of the translation granule 


or memory protection region. 


For each implemented CNTBaseN frame the system can optionally provide an unprivileged view of the frame, 
described as the ELO view of the frame. The base address of this second view of the CNTBaseN frame is 
CNTELOBaseN. 


Note 


In the naming of the registers associated with a CNTBaseNor CNTELOBaseN frame, the value of N is represented 
as <n>, for example CNTACR<n>. 








Ifa CNTELOBaseN frame is implemented: 


: Is implemented in its own memory page or memory protection region and is aligned to the size of the 
translation granule or memory protection region. 


è All registers visible in CNTBaseN, except for CNTVOFF and CNTELOACR, can be visible in 
CNTELOBaseN. 


— Control fields in CNTELOACR determine whether each register is visible. 
° The offsets of all visible registers are the same as their offsets in the CNTBaseN frame. 


In addition to the implemented CNTBaseN and CNTELOBaseN frames, the system must provide a single control 
frame at base address CNTCTLBase. CNTCTLBase must be implemented in its own memory page or memory 
protection region and is aligned to the size of the translation granule or memory protection region. 


The system defines the position of each frame in the memory map. This means the values of each of the CNTBaseN, 
CNTELOBaseN, and CNTCTLBase base addresses is IMPLEMENTATION DEFINED. 


Note 


The Arm architecture requires memory-mapped peripherals to be little-endian, and therefore the memory-mapped 
timers are little-endian. 








The following sections describe the implementation of a memory-mapped view of the counter and timer: 
è The CNTCTLBase frame on page 12-7021. 
è The CNTBaseN and CNTELOBaseN frames on page 12-7022. 





Note 
Providing a complete set of features in a system level implementation on page K5-7686 gives an implementation 
example for a system level Generic Timer implementation that provides equivalent features to a System registers 
Generic Timer implementation in a PE that includes all of the Exception levels. 
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12.3.1 The CNTCTLBase frame 
The CNTCTLBase frame contains: 
s An identification register for the features of the memory-mapped counter and timer implementation. 
s Access controls for each CNTBaseN frame. 
$ A virtual offset register for frames that implement a virtual timer. 
Table 12-3 shows the CNTCTLBase registers, in order of their offsets from the CNTCTLBase base address. 
Note 
CNTFRQ and CNTVOFF registers are also implemented in a System register interface to the Generic Timer. 
Generic Timer memory-mapped register descriptions on page 15-7151 describes each of these registers. 
Table I2-3 CNTCTLBase memory map 
Offset Register Type Security? Description 
0x000 CNTFRQ? RW Secure only Counter Frequency register. 
0x004 CNTNSAR RW Secure only Counter Non-Secure Access register. 
0x008 CNTTIDR RO Both Counter Timer ID register. 
0x00C- 0x03F - RESO - Reserved. 
0x040+4N° CNTACR<n> RW Configurable¢ | Counter Access Control register N. 
0x060- 0x07F - RESO - Reserved. 
0x080+8 N° CNTVOFF<n>[31:0]? RWe Configurable? Virtual Offset register N. If the CNTBaseN frame has 
virtual timer capability then CNTVOFFis implemented 
0x084+8N° CNTVOFF<n>[63:32]> RWe as an RW register, otherwise its location is RAZ/WI. 
OxOCO-0OxXOFC - RESO - Reserved. 
0x100-0x7FC - - - IMPLEMENTATION DEFINED. 
@x8Q0-OxFBC - RESO - Reserved. 
OxFCO-QxFCF - - = IMPLEMENTATION DEFINED. 
QxFDO- @xFFC CounterID<n> RO Both Counter ID registers 0-11. 





a. 


Access security requirement in an implementation that supports two Security states. In an implementation that does not support 
multiple Security states all registers are accessible as shown in the Type column. 


These registers are also defined in the System register interface to the Generic Timer, and therefore are also described in Generic 
Timer registers on page D13-3685 and Generic Timer registers on page G8-6627. The bit assignments of the registers are identical 
in the System register interface and in the memory-mapped system level interface. 

Implemented for each value of N from 0 to 7 for which a CNTBaseN frame is implemented. 

The CNTNSAR determines the Non-secure accessibility of the CNTACR<n>s and the CNTVOFF<n> in the CNTCTLBase frame. 
For more information, see the register descriptions. 


Address is reserved, RAZ/WI if register not implemented. 


All implementations of the Generic Timer include the virtual counter. Therefore, conceptually, all implementations 
include the CNTVOFF register that defines the virtual offset between the physical count and the virtual count. If a 
memory-mapped Generic Timer component does not distinguish between real time and virtual time, then it can 
implement CNTVOFF as RAZ/WI. Otherwise CNTVOFF is an RW register, and Arm strongly recommends that 
the system only permits access to CNT VOFF from EL2 or higher. 
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12.3.2 The CNTBaseN and CNTELOBaseN frames 
Each CNTBaseN frame, or {CNTBaseN, CNTELOBaseN} pair of frames, provides a memory-mapped counter and 
timer, see: 
$ The CNTBaseN frame. 
: The CNTELOBaseN frame on page 12-7023. 
: CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023. 
The CNTBaseN frame 
Table 12-4 shows the CNTBaseN registers, in order of their offsets from the CNTBaseN base address. Whether a 
frame includes a virtual timer is IMPLEMENTATION DEFINED. If it does not, then memory at offsets 0x030-0x03C is 
RAZ/WI. Except for CNTELOACR and the CounterI[D<n> registers, equivalent registers are also implemented in a 
System register interface to the timer component of a Generic Timer. 
Generic Timer memory-mapped register descriptions on page I5-7151 describes each of these registers. 
Table I2-4 CNTBaseN memory map 
Offset Register Type Description 
0x000 CNTPCT[31:0]2 RO Physical Count register. 
0x004 CNTPCT[63:32]? RO 
0x008 CNTVCT{31:0]4 RO Virtual Count register. 
0x00C CNTVCT[63:32]@ RO 
0x010 CNTFRQ2 RO‘ Counter Frequency register. 
0x014 CNTELOACR RW? Counter ELO Access Control Register, optional in the CNTBaseN memory 
map. 
0x018 CNTVOFF[31:0]4 RO¢ Virtual Offset register. If CNTVOFFin the CNTCTLBase frame is an RW 
register, a read of this register returns the value of that register. Otherwise is 
0x01C CNTVOFF[63:32]2 RO¢ RAZ. 
0x020 CNTP_CVAL[31:0]4 RW Physical Timer CompareValue register. 
0x024 CNTP_CVAL[63:32] RW 
0x028 CNTP_TVALa RW Physical TimerValue register. 
0x02C CNTP CTL RW Physical Timer Control register. 
0x030 CNTV_CVAL[31:0] RW? Virtual Timer CompareValue register, optional in the CNTBaseN memory 
map. 
0x034 CNTV_CVAL[63:32]4 RW? 
0x038 CNTV_TVAL2 RW? Virtual TimerValue register, optional in the CNTBaseN memory map. 
0x03C CNTV_CTL# RW? Virtual Timer Control register, optional in the CNTBaseN memory map. 
Qx040-OxFCF - RESO Reserved. 
QxFD@-@xFFC = Counter[D<n> RO Counter ID registers 0-11. 
a. These registers are also defined in the System register interface to the Generic Timer, and therefore are also described in Generic 
Timer registers on page D13-3685 and Generic Timer registers on page G8-6627. The bit assignments of the registers are identical 
in the System register interface and in the memory-mapped system level interface. 
b. Address is reserved, RAZ/WI if register not implemented. 
c. The CNTCTLBase frame includes an RW view of this register. 
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The CNTELOBaseN frame 


For any value of N, the layout of the registers in the CNTELOBaseN frame is identical to the CNTBaseN frame, 
except that, in the CNTELOBaseN frame: 


à CNTVOFF is never visible, and the memory at 0x018-0x01C is RAZ/WI. 
$ CNTELOACR is never visible, and the memory at 0x014 is RAZ/WI. 


° If implemented in the CNTBaseN frame, CNTELOACR controls whether CNTPCT, CNTVCT, CNTFRQ, 
the Physical Timer, and the Virtual Timer registers are visible in the CNTELOBaseN frame. 


If CNTELOACR is not implemented then these registers are not visible in the CNTELOBaseN frame, and 
their addresses in that frame are RAZ/WI. 


If an implementation supports 64-bit atomic accesses, then CNTPCT, CNT VCT, CNTVOFF, CNTP_CVAL, and 
CNTV_CVAL must be accessible as atomic 64-bit values. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames 


In the CNTCTLBase frame: 
CNTTIDR controls: 
s Whether each CNTBaseN frame is implemented. 
* If a CNTBaseN frame is implemented, whether: 
— That CNTBaseN frame has virtual timer capability. 
— A corresponding CNTELOBaseN frame is implemented. 
CNTNSAR controls: 


In an implementation that recognizes two Security states, determines whether each implemented 
CNTBaseN frame, and any corresponding CNTELOBaseN frame, is accessible by Non-secure 
accesses. 


This control also determines whether, in the CNTCTLBase frame, the CNTACR<n> and 
CNTVOFF<n> registers are accessible by Non-secure accesses. 


The CNTACR<n> registers control: 
For each implemented CNTBaseN frame, the accessibility of the following registers in that frame: 
è CNTP_CTL, CNTP_CVAL, and CNTP_TVAL. 
° CNTV_CTL, CNTV_CVAL, and CNTV_TVAL. 
$ CNTVOFF. 
. CNTFRQ. 
a CNTPCT. 
3 CNTVCT. 


For CNTACR<n>, the value of <n> corresponds to the value of N for the controlled CNTBaseN 
frame. 


The CNTVOFF<n> registers provide: 
For each implemented CNTBaseN frame that has virtual capability, the RW copy of the CNTVOFF 
register for that frame. 
— Note 
In a CNTBaseN frame that has virtual timer capability the CNT VOFF register is RO. 





For CNTVOFF<n>, the value of <n> corresponds to the value of N for the controlled CNTBaseN 
frame. 
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Chapter I3 
Recommended External Interface to the 
Performance Monitors 


This chapter describes the recommended external interface to the Performance Monitors. It contains the following 
section: 


$ About the external interface to the Performance Monitors registers on page 13-7026. 


Note 


Performance Monitors external register descriptions on page 15-7039 describes the external view of the 
Performance Monitors registers. 
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13.1 


13.1.1 


13.1.2 
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About the external interface to the Performance Monitors registers 


Arm recommends that: 


x An implementation provides the OPTIONAL external debug interface to the Performance Monitors registers. 


Note 


A debugger can use this interface to access counters in the Performance Monitors. 








. The implementation includes the OPTIONAL support for memory-mapped access to the External debug 
interface. 


Note 


— Software running on any PE in a system can use this interface to access counters in the Performance 
Monitors. 





— Privileged software should use the MMU to control access to this interface. 





: The external debug interface is implemented as defined in Appendix K2 Recommended External Debug 
Interface. 


The following sections describe the memory-mapped views of the Performance Monitors registers: 


7 Differences in the external views of the Performance Monitors registers. 
$ Synchronization of changes to the memory-mapped views on page 13-7027. 
. Access permissions for external views of the Performance Monitors on page 13-7027. 


In this section, unless the context explicitly indicates otherwise, any reference to a memory-mapped view applies 
equally to a register view using: 


è An access through an external debug interface. 
. A memory-mapped access. 


Endianness and supported access sizes 


When an implementation supports memory-mapped access to the external debug interface the interface is accessed 
as a little-endian memory-mapped peripheral. External Performance Monitors registers summary on page 15-7036 
gives the memory map of these registers. 


The memory access sizes supported by any peripheral is IMPLEMENTATION DEFINED by the peripheral. For accesses 
to the external interface to the Performance Monitors registers implementations must: 


° Comply with the requirements of Supported access sizes on page 11-7008. 


° Support word-aligned 32-bit accesses to access 32-bit registers or either half of a 64-bit register mapped to a 
doubleword-aligned pair of adjacent 32-bit locations, even if no PE in the system implements AArch32. 


Differences in the external views of the Performance Monitors registers 


An external view of the Performance Monitors registers accesses the same registers as the System registers interface 
described in Performance Monitors Extension registers on page D7-2723, except that: 


l. The PMSELR is accessible only in the System registers interface. 


2, The following registers are accessible only in external views: 
° PMCFGR 
. PMDEVAFFO 
° PMDEVAFF 1 
. PMLAR 
. PMLSR 
° PMAUTHSTATUS 
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MDEVARCH 
MDEVTYPE 





Performance Monitors external register descriptions on page 15-7039 describes these registers. 


3. The following controls do not affect the external views: 


PMSELR. 
PMUSERENR. 
HDCR.{TPM, TPMCR, HPMN}. 


Instead, see the register descriptions in Chapter [5 External System Control Register Descriptions. 


13.1.3 Synchronization of changes to the memory-mapped views 


Synchronization must comply with Synchronization of memory-mapped registers on page 11-7010. 


In particular, if a Performance Monitor is visible in both System register and an external view, and is accessed 
simultaneously through these two mechanisms, the behavior must be as if the access occurred atomically in any 
order. For more information, see Synchronization of changes to the external debug registers on page H8-6828. 


13.1.4 Access permissions for external views of the Performance Monitors 
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For more information, see External debug interface register access permissions on page H8-6835. 


Table 13-1 on page 13-7028 shows the access permissions for the Performance Monitors registers in a v8 Debug 
implementation. This table uses the following terms: 


DLK 


EPMAD 


Error 


Default 


Off 


OSLK 


SLK 


When ARMv8.0-DoubleLock is implemented and locked, DoubleLockStatus() == TRUE, accesses 
to some registers produce an error. Applies to both interfaces. 


When AllowExternalPMUAccess() == FALSE, external debug access is disabled for the access. If 
ARMv8.4-Debug is implemented, this applies only for Non-secure access to the register. See also 
Behavior of a not permitted memory-mapped access on page H8-6833. 


Indicates that the access gives an error response. 


This shows the default access permissions, if none of the conditions in this list prevent access to the 
register. 


The Core power domain is completely off, or in a low-power state where the Core power domain 
registers cannot be accessed, and EDPRSR.PU will read as zero. 


Note 


If debug power is off, then all external debug interface accesses return an error. 








When the OS Lock is locked, OSLAR_EL1.0SLK == 1, accesses to some registers produces an 
error. This column shows the effect of this control on accesses using the external debug interface. 


This indicates the modified default access permissions for OPTIONAL memory-mapped accesses to 
the external debug interface if the optional Software Lock is locked. See Register access 
permissions for memory-mapped accesses on page H8-6832. 
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For all other accesses, this column is ignored. 


- Indicates that the control has no effect on the behavior of the access: 
° If no other control affects the behavior, the Default access behavior applies. 
$ However, another control might determine the behavior. 


Table I3-1 Access permissions for the Performance Monitors registers 































































































Offset Register Domain Off DLK OSLK EPMAD Default SLK 
0x000+8xn PMEVCNTR<n>_EL02 Core Error Error Error Error RW RO 
OxOF8 PMCCNTR_ELO[31:0] Core Error Error Error Error RW RO 
OxOFC PMCCNTR_ELO[63:32] Core Error Error Error Error RW RO 
0x200 PMPCSR{31:0]® Core Error Error Error 2 RO RO 
0x204 PMPCSR[63:32]? Core Error Error Error - RO RO 
0x208 PMCID1SR®> Core Error Error Error - RO RO 
0x20C PMVIDSR? Core Error Error Error - RO RO 
0x220 PMPCSR[31:0]Þ Core Error Error Error - RO RO 
0x224 PMPCSR[63:32]> Core Error Error Error - RO RO 
0x228 PMCID1SR® Core Error Error Error - RO RO 
0x22C PMCID2SRÞł Core Error Error Error - RO RO 
0x400+4xn PMEVTYPER<n> EL0a Core Error Error Error Error RW RO 
0x47C PMCCFILTR_ELO Core Error Error Error Error RW RO 
0x600-0x6FC - - Access is IMPLEMENTATION DEFINED 
0xA00-0xBFC - - Access is IMPLEMENTATION DEFINED 

OxC00 PMCNTENSET_ELO Core Error Error Error Error RW RO 
0xC20 PMCNTENCLR_ELO Core Error Error Error Error RW RO 
OxC40 PMINTENSET EL1 Core Error Error Error Error RW RO 
OxC60 PMINTENCLR ELI Core Error Error Error Error RW RO 
OxC80 PMOVSCLR_ELO Core Error Error Error Error RW RO 
OxCAQ PMSWINC_EL0° Core Error Error Error Error WO WI 
OxCCO PMOVSSET_ELO Core Error Error Error Error RW RO 
0xD80-0xDFC - - Access is IMPLEMENTATION DEFINED 

OxE00 PMCFGR Core Error Error Error Error RO RO 
0xE04 PMCR_ELO Core Error Error Error Error RW RO 
0xE20 PMCEIDO Core Error Error Error Error RO RO 
0xE24 PMCEID1 Core Error Error Error Error RO RO 
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Table I3-1 Access permissions for the Performance Monitors registers (continued) 








Offset Register Domain Off DLK OSLK EPMAD Default SLK 
0xE40 PMMIR Core Error Error Error Error RO RO 
0xE80-0xEFC Integration registers - Access is IMPLEMENTATION DEFINED 





OxF00-0xFFC Management registers and CoreSight compliance on page K2-7655 





a. Implemented counters only. n is the counter number. 


b. Implemented only if ARMv8.2-PCSample is implemented. See Chapter H7 The PC Sample-based Profiling 
Extension. 


c. Only if the OPTIONAL PMSWINC _ELO register is implemented in the external debug interface. 


13.1.5 Power domains and Performance Monitors registers reset 
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For Armv8-A implementations, Arm recommends that Performance Monitors are implemented as part of the Core 
power domain, not as part of a separate Debug power domain. There is no interface to access the Performance 
Monitors registers when the Core power domain is powered down. 


A Warm or Cold reset sets the Performance Monitors registers to their reset values. An External Debug reset does 
not change the values of the Performance Monitors registers. 


For more information about the reset scheme recommended for a v8 Debug implementation see Chapter H6 Debug 
Reset and Powerdown Support. 


Table [3-2 shows the Performance Monitors register resets for writable register fields. The column headings use the 
following terms: 


64 This is the architectural reset value when resetting into AArch64 state. 
32 This is the architectural reset value when resetting into AArch32 state. 


- This indicates an IMPLEMENTATION DEFINED reset value on the specified reset. This might be 
UNKNOWN. 


Note 
This table does not include: 





: Read-only identification registers and fields that have a fixed value. In this case, the reset value is that fixed 
value. An example of this is PMCR_ELO.N. 


è Write-only registers and fields that only have an effect on writes. These do not have a reset value. An example 
of this is PMSWINC_ELO. 


s IMPLEMENTATION DEFINED registers. In this case, the reset domains are IMPLEMENTATION DEFINED. The reset 
values are IMPLEMENTATION DEFINED and might be UNKNOWN. 





Table 13-2 Performance Monitors System register resets 











Register Domain Field 64 32 Description 
PMCR_ELO Warm DP - 0 Disable PMCCNTR_ELO when prohibited 
- 0 Export enable 





- 0 Clock divider 





0 0 Performance Monitors enable 
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Table 13-2 Performance Monitors System register resets (continued) 









































Register Domain Field 64 32 Description 

PMCNTENSET_ELO Warm - - - All fields in register 

PMCNTENCLR_ELO 

PMOVSSET_ELO Warm - - - All fields in register 

PMOVSCLR_ELO 

PMSELR_ ELO Warm SEL - - Selected event counter 

PMCCNTR_ELO Warm - - - All fields in register 

PMEVTYPER<n>_ELO Warm - - - All fields in register 

PMCCFILTR_ELO Warm [31:26] - 0x00 += PMCCNTR_ELO filtering controls 

PMEVCNTR<n>_ELO Warm - - - All fields in register 

PMUSERENR_ELO Warm ER - 0 Enable counter read access in ELO 
CR - 0 Enable PMCCNTR_ELO read access in ELO 
SW - 0 Enable PMSWINC_ELO write access in ELO 
EN - 0 Enable Performance Monitors access in ELO 

PMINTENSET EL1 Warm - - - All fields in register 


PMINTENCLR ELI 
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Chapter 14 
Recommended External Interface to the Activity 
Monitors 


This chapter describes the optional external interface to the Activity Monitors Extension registers. It contains the 
following section: 


è About the external interface to the Activity Monitors Extension registers on page 14-7032 


Note 


Activity Monitors external register descriptions on page 15-7115 describes the external view of the Activity 
Monitors Extension registers. 
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14.1 


14.1.1 


14.1.2 
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About the external interface to the Activity Monitors Extension registers 


If an implementation supports the Activity Monitors Extension, it may optionally support an external 
memory-mapped interface to the Activity Monitors Extension, and, if so, may further optionally support CoreSight 
device registers and ID registers. 


The memory access sizes supported by the memory-mapped interface are IMPLEMENTATION DEFINED and comply 
with the requirements of Supported access sizes on page 11-7008. 


The base address of the memory-mapped view is aligned to a 4KB boundary, but is otherwise IMPLEMENTATION 
DEFINED. The address offsets for the memory-mapped view are given in Table 15-2 on page 15-7113. 


Differences in the external views of the Activity Monitors Extension registers 


The external memory-mapped interface view of the Activity Monitors Extension registers accesses the same 
registers as the System registers interface to the registers, except that: 


° AMUSERENR is accessible only in the System registers interface. 


. If implemented, the following registers are accessible only in the memory-mapped view: 
— AMIIDR 

MDEVAFFO 

MDEVAFF1 
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Activity Monitors external register descriptions on page 15-7115 describes these registers. 


Access during reset and power transitions 


As described in Power and reset domains on page D8-2727, the power and reset domains of the activity monitoring 
unit are IMPLEMENTATION DEFINED, and when a Cold reset of the power domain of the activity monitoring unit 
occurs, the activity monitoring unit is reset and the counters are reset to zero. 


If the power domain of the activity monitoring unit is an always-on power domain, while the PE is reset or powered 
down counter values may be preserved and might be accessible by memory-mapped access. 


If the power domain of the activity monitoring unit is the Core power domain, while the PE is reset or powered down 
and when a memory-mapped access occurs, the access reads as zero and the bus access completes without an error. 
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This chapter describes the external system control registers. It excludes the External debug registers that are 
described in Chapter H9 External Debug Register Descriptions. It contains the following sections: 


About the external system control register descriptions on page 15-7034. 
External Performance Monitors registers summary on page 15-7036. 
Performance Monitors external register descriptions on page 15-7039. 
External Activity Monitors Extension registers summary on page I5-7113. 
Activity Monitors external register descriptions on page 15-7115. 

Generic Timer memory-mapped registers overview on page 15-7150. 
Generic Timer memory-mapped register descriptions on page I5-7151. 
RAS Registers on page 15-7199. 
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15.1 About the external system control register descriptions 


This chapter describes the external system control registers other than the external debug registers. That is, it 
describes: 


An external view of the Performance Monitors registers 


Arm recommends that implementations provide access to the Performance Monitors registers 
through the OPTIONAL External debug interface, and provide the OPTIONAL memory-mapped 
interface to this interface: 


° External Performance Monitors registers summary on page 15-7036 lists the registers that 
are accessible in this view of the Performance Monitors, and describes their memory map. 


° Performance Monitors external register descriptions on page 15-7039 describes each of the 
memory-mapped registers. 


Chapter 13 Recommended External Interface to the Performance Monitors describes the 
recommended interface to these registers. 





Note 


Chapter D7 The Performance Monitors Extension describes the Performance Monitors. The 
following sections describe the System register interfaces to the Performance Monitors: 


° Performance Monitors registers on page D13-3526, for accesses from an Exception level 
that is using AArch64. 

s Performance Monitors registers on page G8-6479, for accesses from an Exception level that 
is using AArch32. 





An external view of the Activity Monitors Extension registers 


An implementation which supports the Activity Monitors Extension may support an optional 
external memory-mapped interface to the Activity Monitors Extension registers. 


. External Activity Monitors Extension registers summary on page 15-7113 lists the registers 
that are accessible in this view of the Performance Monitors, and describes their memory 
map. 

° Activity Monitors external register descriptions on page 15-7115 describes each of the 


memory-mapped registers. 


Chapter 13 Recommended External Interface to the Performance Monitors describes the 
recommended interface to these registers. 


Note 


Chapter D8 The Activity Monitors Extension describes the Activity Monitors. The following 
sections describe the System register interfaces to the Activity Monitors: 





. Activity Monitors registers on page D13-3584, for accesses from an Exception level that is 
using AArch64. 

. Activity Monitors registers on page G8-6542, for accesses from an Exception level that is 
using AArch32. 





The registers for the system level Generic Timer component 


Any implementation that includes the Generic Timer must include the memory-mapped system 
level component described in Chapter I2 System Level Implementation of the Generic Timer. In this 
chapter: 


. Generic Timer memory-mapped registers overview on page 15-7150 gives an overview of the 
registers, referring to Chapter I2 for more information. 


. Generic Timer memory-mapped register descriptions on page 15-7151 describes each of the 
memory-mapped registers. 
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Note 

Chapter D11 The Generic Timer in AArch64 state describes the Generic Timer component that is 
accessible using the System registers. The following sections describe the System register interfaces 
to that component: 


` Generic Timer registers on page D13-3685, for accesses from an Exception level that is using 
AArch64. 

° Generic Timer registers on page G8-6627, for accesses from an Exception level that is using 
AArch32. 





Note 
Chapter H9 External Debug Register Descriptions describes the external debug registers. 
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15.2 External Performance Monitors registers summary 
When an implementation provides access to the Performance Monitors registers through the External debug 
interface, that interface provides access to: 
° Performance Monitors System registers. 
$ A read-only configuration register, PMCFGR. 
è The OPTIONAL CoreSight registers for the Performance Monitors, if they are implemented. 
The locations of the registers are defined as offsets from a system-defined base address. Performance Monitors 
external register views defines this memory map. 
15.2.1 Performance Monitors external register views 
Table I5-1 shows the external view of the Performance Monitors registers. All other entries are reserved. 
Note 
° Counters that are reserved because HDCR.HPMN has been changed from its reset value remain visible in 
any external view. 
$ The registers that relate to an implemented event counter, PMNx, are PMEVCNTR<n> and 
PMEVTYPER<n>. 
G The mapping of the Performance Monitors Event Counter Registers, at offsets 0x000-0x0F4, has changed 
compared to the mappings of the equivalent registers in Armv7. 
Each entry in the Name column links to the register description in Performance Monitors external register 
descriptions on page 15-7039, and: 
° If the System register? column of the table shows that the register is a System register, the memory-mapped 
interface provides a view of the System register described in: 
— Performance Monitors registers on page D13-3526, for the AArch64 System register. 
— Performance Monitors registers on page G8-6479, for the AArch32 System register. 
° Otherwise, the register is accessible only using the external interface. 
Table 15-1 Performance Monitors external register views 
Name Type Description System Offset 
register? 
PMEVCNTR<n>_EL0 RW Performance Monitors Event Counter Register. Yes 0x000 +8n 
PMCCNTR_ELO[31:0] RW Performance Monitors Cycle Counter Register # Yes OxOF8 
PMCCNTR_ELO[63:32] OxOFC 
PMPCSR{[31:0]® RW Program Counter Sample Register, bits[3 1:0] No 0x200 
PMPCSR[63:32]> RW Program Counter Sample Register, bits[63:32] No 0x204 
PMCIDISR? RW CONTEXTIDR_EL1 Sample Register No 0x208 
PMVIDSR®> RW VMID Sample Register No Qx20C 
PMPCSR{[31:0] RW Program Counter Sample Register, bits[31:0], alias No 0x220 
PMPCSR[63:32]> RW Program Counter Sample Register, bits[63:32], alias No 0x224 
PMCID1SR® RW CONTEXTIDR_EL1 Sample Register (alias) No 0x248 
PMCID2SRÞ? RW CONTEXTIDR_EL2 Sample Register No Qx22C 
15-7036 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


External System Control Register Descriptions 
15.2 External Performance Monitors registers summary 


Table I5-1 Performance Monitors external register views (continued) 
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Name Type Description register? Offset 
PMEVTYPER<n>_ELO RW Performance Monitors Event Type and Filter Register. Yes 0x400+4n 
PMCCFILTR_ELO RW Performance Monitors Cycle Counter Filter Register Yes Qx47C 
- = IMPLEMENTATION DEFINED - Qx600-Ox6FC 
- = IMPLEMENTATION DEFINED - QxAQ0-OxBFC 
PMCNTENSET ELO RW Performance Monitors Count Enable Set register Yes OxC0d 
PMCNTENCLR_ELO RW Performance Monitors Count Enable Clear register Yes OxC20 
PMINTENSET EL1 RW Performance Monitors Interrupt Enable Set register Yes OxC40 
PMINTENCLR EL1 RW Performance Monitors Interrupt Enable Clear register Yes OxC60 
PMOVSCLR_ELO RW Performance Monitors Overflow Flag Status Clear register Yes OxC80 
PMSWINC ELO WO Performance Monitors Software Increment register Yes OxCAQ 
PMOVSSET_ELO RW Performance Monitors Overflow Flag Status Set register Yes QxCCO 
= = IMPLEMENTATION DEFINED a 0xD80-0xDFC 
PMCFGR RO Performance Monitors Configuration Register No OxE0O 
PMCR_ELO RW Performance Monitors Control Register Yes OxE04 
PMCEIDO RO Performance Monitors Common Event Identification register 0 Yes OxE20 
PMCEID1 RO Performance Monitors Common Event Identification register 1 Yes 0xE24 
= = IMPLEMENTATION DEFINED - QxE80-QxEFC 
PMITCTRL¢ RW Integration Model Control registers No OxF@ 
PMDEVAFF0¢ RO Device Affinity registers No OxFA8 
PMDEVAFFI1°¢ RO OxFAC 
PMLAR® d WO Lock Access register No OxFBO 
PMLSR® d RO Lock Status register No OxFB4 
PMAUTHSTATUS*¢ RO Authentication Status register No OXFB8 
PMDEVARCH®¢ RO Device Architecture register No QxFBC 
PMDEVID? RO Performance Monitors Device ID register No OxFC8 
PMDEVTYPE* RO Device Type register No OxFCC 
PMPIDR4°¢ RO Peripheral ID registers No QxFDO 
PMPIDRO¢ RO OxFEQ 
PMPIDR1° RO OxFE4 
PMPIDR2°¢ RO OxFE8 
PMPIDR3°¢ RO OxFEC 
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Table I5-1 Performance Monitors external register views (continued) 





System 














Name Type Description register? Offset 
PMCIDRO* RO Component ID registers No OxFFO 
PMCIDR1°¢ RO OxFF4 
PMCIDR2° RO OxFF8 
PMCIDR3¢ RO OxFFC 





a. The interface must support at least single-copy atomic 32-bit accesses. If single-copy atomic 64-bit access to the registers is not possible, 
software must use a high-low-high read access to read the counter value if the counter is enabled. 


b. PC Sample-based Profiling Extension registers. Implemented only when ARMv8.2-PCSample is implemented, except that from Armv8.2 
PMDEVIDt is required regardless of whether ARMv8.2-PCSample is implemented. 


Before Armv8.2. the PC Sample-based Profiling Extension can, instead, be implemented in the memory-mapped debug registers space, see 
Chapter H7 The PC Sample-based Profiling Extension. 


c. CoreSight interface registers, see Management registers and CoreSight compliance on page K2-7655. 


d. The Software lock registers are defined as part of CoreSight compliance, but their contents depend on the type of access that is made and 
whether the OPTIONAL Software lock is implemented. See the register description for details. 
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15.3 Performance Monitors external register descriptions 


This section describes the external view of the Performance Monitors registers. External Performance Monitors 
registers summary on page 15-7036 lists these registers in offset order. 
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15.3.1 


15-7040 


PMAUTHSTATUS, Performance Monitors Authentication Status register 
The PMAUTHSTATUS characteristics are: 


Purpose 
Provides information about the state of the IMPLEMENTATION DEFINED authentication interface for 
Performance Monitors. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMAUTHSTATUS is implemented in the Core power 
domain or in the Debug power domain. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is OPTIONAL, and is required for CoreSight compliance. Arm recommends that this 


register is implemented. 


Attributes 
PMAUTHSTATUS is a 32-bit register. 


Field descriptions 


The PMAUTHSTATUS bit assignments are: 


31 876543210 


RESO SNID js] NSID 


a NSNID 


Bits [31:8] 
Reserved, RESO. 


SNID, bits [7:6] 
Holds the same value as DBGAUTHSTATUS_EL1.SNID. 


SID, bits [5:4] 
Secure invasive debug. Possible values of this field are: 
0b00 Not implemented. 
All other values are reserved. 
NSNID, bits [3:2] 
Holds the same value as DBGAUTHSTATUS_EL1.NSNID. 


NSID, bits [1:0] 
Non-secure invasive debug. Possible values of this field are: 
0b00 Not implemented. 


All other values are reserved. 
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Accessing the PMAUTHSTATUS: 


PMAUTHSTATUS can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFB8 PMAUTHSTATUS 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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15.3.2 PMCCFILTR_ELO, Performance Monitors Cycle Counter Filter Register 
The PMCCFILTR_ELO characteristics are: 


Purpose 
Determines the modes in which the Cycle Counter, PMCCNTR_ELO, increments. 


Configurations 


External register PMCCFILTR_ELO0[31:0] is architecturally mapped to AArch64 System register 
PMCCFILTR_EL0[31:0]. 


External register PMCCFILTR_ELO0[31:0] is architecturally mapped to AArch32 System register 
PMCCFILTR[3 1:0]. 


PMCCFILTR_ELO is in the Core power domain. 
On a Warm or Cold reset RW fields in this register reset: 


à To architecturally UNKNOWN values if the reset is to an Exception level that is using 
AArch64. 


à To 0 if the reset is to an Exception level that is using AArch32. 


The register is not affected by an External debug reset. 


Attributes 
PMCCFILTR_ELO is a 32-bit register. 


Field descriptions 


The PMCCFILTR_ELO bit assignments are: 


31 30 29 28 27 26 25 24 23 0 


NSK = =) | 
NSU 


NSH 
RESO 
SH 
P, bit [31] 
Privileged filtering bit. Controls counting in EL1. If EL3 is implemented, then counting in 
Non-secure EL] is further controlled by the PMCCFILTR_ELO.NSK bit. The possible values of this 
bit are: 
Qbd Count cycles in EL1. 
Qb1 Do not count cycles in EL1. 
U, bit [30] 
User filtering bit. Controls counting in ELO. If EL3 is implemented, then counting in Non-secure 
ELO is further controlled by the PMCCFILTR_ELO.NSU bit. The possible values of this bit are: 
Qbd Count cycles in ELO. 
Qb1 Do not count cycles in ELO. 
NSK, bit [29] 
Non-secure EL1 (kernel) modes filtering bit. Controls counting in Non-secure EL1. If EL3 is not 
implemented, this bit is RESO. 
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Ifthe value of this bit is equal to the value of the PMCCFILTR_ELO.P bit, cycles in Non-secure EL1 
are counted. 


Otherwise, cycles in Non-secure EL1 are not counted. 


NSU, bit [28] 


Non-secure ELO (Unprivileged) filtering bit. Controls counting in Non-secure ELO. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMCCFILTR_ELO.U bit, cycles in Non-secure 
ELO are counted. 


Otherwise, cycles in Non-secure ELO are not counted. 


NSH, bit [27] 


EL2 (Hypervisor) filtering bit. Controls counting in EL2. If EL2 is not implemented, this bit is RESO. 
If Secure EL2 is implemented, counting in Secure EL2 is further controlled by the 
PMCCFILTR_ELO.SH bit. 


Qbd Do not count cycles in EL2. 
Qb1 Count cycles in EL2. 


M, bit [26] 
Secure EL3 filtering bit. If EL3 is not implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMCCFILTR_ELO.P bit, cycles in Secure EL3 are 
counted. 


Otherwise, cycles in Secure EL3 are not counted. 


Most applications can ignore this field and set its value to 0. 





Note 
This field is not visible in the AArch32 PMCCFILTR System register. 





Bit [25] 


Reserved, RESO. 


SH, bit [24] 
When ARMV8.4-SecEL2 is implemented: 
Secure EL2 filtering. 


If the value of this bit is not equal to the value of the PMCCFILTR_ELO.NSH bit, cycles in Secure 
EL2 are counted. 


Otherwise, cycles in Secure EL2 are not counted. 


If Secure EL2 is not implemented or is disabled, this field is RESO. 


Note 
This field is not visible in the AArch32 PMCCFILTR System register. 








Otherwise: 
Reserved, RESO. 
Bits [23:0] 


Reserved, RESO. 
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Accessing the PMCCFILTR_ELO: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 








PMCCFILTR_ELO can be accessed through the external debug interface: 





Component Offset Instance 


PMU Qx47C PMCCFILTR_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


. Otherwise accesses to this register generate an error response. 
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15.3.3 PMCCNTR_ELO, Performance Monitors Cycle Counter 
The PMCCNTR_ELO characteristics are: 


Purpose 


Holds the value of the processor Cycle Counter, CCNT, that counts processor clock cycles. See Time 
as measured by the Performance Monitors cycle counter on page D7-2671 for more information. 


PMCCFILTR_ELO determines the modes and states in which the PMCCNTR_ELO can increment. 


Configurations 


External register PMCCNTR_ELO[63:0] is architecturally mapped to AArch64 System register 
PMCCNTR_ELO[63:0]. 


External register PMCCNTR_ELO[63:0] is architecturally mapped to AArch32 System register 
PMCCNTR[63:0]. 


PMCCNTR_ELO is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply on a Warm or Cold reset. The register is not affected by an External 
debug reset. 


Attributes 
PMCCNTR_ELO is a 64-bit register. 


Field descriptions 


The PMCCNTR_ELO bit assignments are: 


63 0 


CCNT 


CCNT, bits [63:0] 


Cycle count. Depending on the values of PMCR_ELO.{LC,D}, the cycle count increments in one 
of the following ways: 


° Every processor clock cycle. 
° Every 64th processor clock cycle. 
Writing 1 to PMCR_ELO.C sets this field to 0. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Accessing the PMCCNTR_ELO: 





Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 





PMCCNTR_ELO[31:0] can be accessed through the external debug interface: 








Component Offset Instance Range 
PMU OxOF8 PMCCNTR ELO 31:0 
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This interface is accessible as follows: 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to PMCCNTR_ELO[31:0] are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to PMCCNTR_ELO[31:0] are RW. 


° Otherwise accesses to PMCCNTR_ELO[31:0] generate an error response. 


PMCCNTR_ELO[63:32] can be accessed through the external debug interface: 





Component Offset Instance Range 


PMU OxOFC PMCCNTR_ELO 63:32 





This interface is accessible as follows: 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to PMCCNTR_ELO[63:32] are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !'OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to PMCCNTR_EL0[63:32] are RW. 


. Otherwise accesses to PMCCNTR_EL0[63:32] generate an error response. 
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PMCEIDO, Performance Monitors Common Event Identification register 0 


The PMCEID0 characteristics are: 


Purpose 


Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the range 0x0000 to 0x001F 


When the value of a bit in the register is 1 the corresponding common event is implemented and 
counted. 


For more information about the common events and the use of the PMCEIDn registers see The PMU 
event number space and common events on page D7-2693. 





Note 
à Arm recommends that, if a common event is never counted, the value of the corresponding 
register bit is 0. 


. This view of the register was previously called PMCEIDO_ ELO. 





Configurations 


External register PMCEIDO0[3 1:0] is architecturally mapped to AArch64 System register 
PMCEIDO_ ELO[31:0]. 


External register PMCEIDO[3 1:0] is architecturally mapped to AArch32 System register 
MCEIDO[3 1:0]. 


P 
PMCEID0 is in the Core power domain. 


Attributes 





PMCEID0 is a 32-bit register. 


Field descriptions 


The PMCEID0 bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 12 1110 9 8 76543210 





— | Loo IDO 
ID1 
ID2 
ID3 
ID4 
IDS 
ID6 
ID7 
ID8 
ID9 

ID10 
ID11 

ID12 
ID13 
ID14 
ID15 
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ID<n>, bit [n], for n = 0 to 31 


ID[n] corresponds to common event n. 


For each bit: 
QbO The common event is not implemented, or not counted. 
Qb1 The common event is implemented. 


A bit that corresponds to a reserved event number is reserved. The value might be used in a future 
revision of the architecture to identify an additional common event. 





Note 

Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n> registers of that earlier version of the PMU architecture. 





Accessing the PMCEIDO: 


Note 


AllowExternalPMUAccess() has a new definition from Armv8.4. Refer to the Pseudocode definitions for more 
information. 








PMCEID0 can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxE20 PMCEIDO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and AllowExternalPMUAccess() accesses 
to this register are RO. 


. Otherwise accesses to this register generate an error response. 
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PMCEID1, Performance Monitors Common Event Identification register 1 


The PMCEID1 characteristics are: 


Purpose 


Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the range 0x020 to 0x03F. 


When the value of a bit in the register is 1 the corresponding common event is implemented and 
counted. 


For more information about the common events and the use of the PMCEIDn registers see The PMU 
event number space and common events on page D7-2693. 





Note 
à Arm recommends that, if a common event is never counted, the value of the corresponding 
register bit is 0. 


. This view of the register was previously called PMCEID1_ELO. 





Configurations 


External register PMCEID1[31:0] is architecturally mapped to AArch64 System register 
PMCEID1_ELO[31:0]. 


External register PMCEID1[31:0] is architecturally mapped to AArch32 System register 
MCEID1[31:0]. 


P 
PMCEID1 is in the Core power domain. 


Attributes 





PMCEID1 is a 32-bit register. 


Field descriptions 


The PMCEID1 bit assignments are: 


31 30 29 28 27 26 25 24 23 22 21 201918 17 16 15 14 13 12 1110 9 8 76543210 





— | Loo IDO 
ID1 
ID2 
ID3 
ID4 
IDS 
ID6 
ID7 
ID8 
ID9 

ID10 
ID11 

ID12 
ID13 
ID14 
ID15 
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ID<n>, bit [n], for n = 0 to 31 


ID[n] corresponds to common event (0x0020 + n). 


For each bit: 
QbO The common event is not implemented, or not counted. 
Qb1 The common event is implemented. 


A bit that corresponds to a reserved event number is reserved. The value might be used in a future 
revision of the architecture to identify an additional common event. 





Note 

Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n> registers of that earlier version of the PMU architecture. 





Accessing the PMCEID1: 


Note 


AllowExternalPMUAccess() has a new definition from Armv8.4. Refer to the Pseudocode definitions for more 
information. 








PMCEID1 can be accessed through the external debug interface: 





Component Offset Instance 


PMU QxE24 PMCEID1 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and AllowExternalPMUAccess() accesses 
to this register are RO. 


. Otherwise accesses to this register generate an error response. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


External System Control Register Descriptions 
15.3 Performance Monitors external register descriptions 


15.3.6 PMCEID2, Performance Monitors Common Event Identification register 2 


ARM DDI 0487E.a 
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The PMCEID2 characteristics are: 








Purpose 
Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the range 0x4000 to 0x401F. 
When the value of a bit in the register is 1 the corresponding common event is implemented and 
counted. 

Note 

Arm recommends that, if a common event is never counted, the value of the corresponding register 
bit is 0. 
For more information about the common events and the use of the PMCEIDn registers see The PMU 
event number space and common events on page D7-2693. 

Configurations 
External register PMCEID2[31:0] is architecturally mapped to AArch64 System register 
PMCEIDO_ELO[63:32]. 
External register PMCEID2[63:32] is architecturally mapped to AArch32 System register 
PMCEID2[31:0]. 
PMCEID2 is in the Core power domain. 
This register is present only when ARMV8.1-PMU is implemented. Otherwise, direct accesses to 
PMCEID?2 are RESO. 

Attributes 
PMCEID2 is a 32-bit register. 





Field descriptions 


The PMCEID2 bit assignments are: 


31 


0 


IDhi<n>, bit[n], for n = 0 to 31 


IDhi<n>, bit [n], for n = 0 to 31 


IDhi[n] corresponds to common event (0x4000 + n). 

For each bit: 

Qbd The common event is not implemented, or not counted. 

Qb1 The common event is implemented. 

A bit that corresponds to a reserved event number is reserved. The value might be used in a future 


revision of the architecture to identify an additional common event. 


Note 

Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n> registers of that earlier version of the PMU architecture. 








Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7051 


Non-Confidential 


External System Control Register Descriptions 
15.3 Performance Monitors external register descriptions 


Accessing the PMCEID2: 


Note 


AllowExternalPMUAccess() has a new definition from Armv8.4. Refer to the Pseudocode definitions for more 
information. 








PMCEID2 can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxE28 PMCEID2 





This interface is accessible as follows: 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and AllowExternalPMUAccess() accesses 
to this register are RO. 


° Otherwise accesses to this register generate an error response. 
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15.3.7 PMCEID3, Performance Monitors Common Event Identification register 3 


ARM DDI 0487E.a 
ID070919 


The PMCEID3 characteristics are: 








Purpose 
Defines which common architectural events and common microarchitectural events are 
implemented, or counted, using PMU events in the range 0x4020 to 0x403F. 
When the value of a bit in the register is 1 the corresponding common event is implemented and 
counted. 

Note 

Arm recommends that, if a common event is never counted, the value of the corresponding register 
bit is 0. 
For more information about the common events and the use of the PMCEIDn registers see The PMU 
event number space and common events on page D7-2693. 

Configurations 
External register PMCEID3[31:0] is architecturally mapped to AArch64 System register 
PMCEID1_ELO[63:32]. 
External register PMCEID3[63:32] is architecturally mapped to AArch32 System register 
PMCEID3[31:0]. 
PMCEID3 is in the Core power domain. 
This register is present only when ARMV8.1-PMU is implemented. Otherwise, direct accesses to 
PMCEID3 are RESO. 

Attributes 
PMCEID3 is a 32-bit register. 





Field descriptions 


The PMCEID3 bit assignments are: 


31 


0 


IDhi<n>, bit[n], for n = 0 to 31 


IDhi<n>, bit [n], for n = 0 to 31 


IDhi[n] corresponds to common event (0x4020 + n). 

For each bit: 

Qbd The common event is not implemented, or not counted. 

Qb1 The common event is implemented. 

A bit that corresponds to a reserved event number is reserved. The value might be used in a future 


revision of the architecture to identify an additional common event. 


Note 

Such an event might be added retrospectively to an earlier version of the PMU architecture, 
provided the event does not require any additional PMU features and has an event number that can 
be represented in the PMCEID<n> registers of that earlier version of the PMU architecture. 
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Accessing the PMCEID3: 


Note 


AllowExternalPMUAccess() has a new definition from Armv8.4. Refer to the Pseudocode definitions for more 
information. 








PMCEID3 can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxE2C PMCEID3 





This interface is accessible as follows: 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and AllowExternalPMUAccess() accesses 
to this register are RO. 


° Otherwise accesses to this register generate an error response. 
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15.3.8 PMCFGR, Performance Monitors Configuration Register 


ARM DDI 0487E.a 
ID070919 


The PMCFGR characteristics are: 


Purpose 

Contains PMU-specific configuration data. 
Configurations 

PMCFGBR is in the Core power domain. 

There are no configuration notes. 
Attributes 


PMCFGR is a 32-bit register. 


Field descriptions 


The PMCFGR bit assignments are: 


31 28 27 


20 19 18 17 16 15 14 13 8 7 0 


NCG, bits [31: 


Bits [27:20] 


UEN, bit [19] 


WT, bit [18] 


NA, bit [17] 


EX, bit [16] 


CCD, bit [15] 


28] 
This feature is not supported, so this field is RAZ. 


Reserved, RESO. 


User-mode Enable Register supported. PMUSERENR_ELO is not visible in the external debug 
interface, so this bit is RAZ. 


This feature is not supported, so this bit is RAZ. 
This feature is not supported, so this bit is RAZ. 


Export supported. Value is IMPLEMENTATION DEFINED. 
ObO PMCR_ELO.X is RESO. 
Qb1 PMCR_ELO.X is read/write. 


Cycle counter has prescale. This is RES1 if AArch32 is supported at any EL, and RAZ otherwise. 
ObO PMCR_ELO.D is RESO. 
Qb1 PMCR_ELO.D is read/write. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7055 


Non-Confidential 


External System Control Register Descriptions 
15.3 Performance Monitors external register descriptions 


15-7056 


CC, bit [14] 
Dedicated cycle counter (counter 31) supported. This bit is RAO. 


SIZE, bits [13:8] 


Size of counters, minus one. This field defines the size of the largest counter implemented by the 
Performance Monitors Unit. 


From Armv§8, the largest counter is 64-bits, so the value of this field is @b111111. 


This field is used by software to determine the spacing of the counters in the memory-map. From 
Armv8, the counters are a doubleword-aligned addresses. 


N, bits [7:0] 


Number of counters implemented in addition to the cycle counter, PMCCNTR_ELO. The maximum 
number of event counters is 31. 


0x00 Only PMCCNTR_ELO implemented. 
0x01 PMCCNTR_ELO plus one event counter implemented. 
and so on up to 0b00011111, which indicates PMCCNTR_ELO and 31 event counters implemented. 


Accessing the PMCFGR: 


Note 


AllowExternalPMUAccess() has a new definition from Armv8.4. Refer to the Pseudocode definitions for more 
information. 








PMCFGR can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxE00 PMCFGR 





This interface is accessible as follows: 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and AllowExternalPMUAccess() accesses 
to this register are RO. 


e Otherwise accesses to this register generate an error response. 
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15.3.9 PMCIDRO, Performance Monitors Component Identification Register 0 
The PMCIDRO characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


For more information see About the Component Identification scheme on page K2-7663. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMCIDR0O is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
PMCIDRO is a 32-bit register. 


Field descriptions 


The PMCIDRO bit assignments are: 


31 8 7 0 
RESO PRMBL_0O 
Bits [31:8] 


Reserved, RESO. 


PRMBL 0, bits [7:0] 
Preamble. Must read as 0x0D. 


Accessing the PMCIDRO: 


PMCIDRO can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFFO PMCIDRO 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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15.3.10 PMCIDR1, Performance Monitors Component Identification Register 1 
The PMCIDRI1 characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


For more information see About the Component Identification scheme on page K2-7663. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMCIDR1 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
PMCIDR1 is a 32-bit register. 


Field descriptions 


The PMCIDR1 bit assignments are: 


31 87 4 3 0 
RESO CLASS | PRMBL_1 
Bits [31:8] 


Reserved, RESO. 


CLASS, bits [7:4] 


Component class. Reads as 0x9, debug component. 
PRMBL 1, bits [3:0] 
Preamble. RAZ. 


Accessing the PMCIDR1: 


PMCIDRI can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFF4 PMCIDRI 
This interface is accessible as follows: 
° When ARMVv8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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15.3.11 PMCIDR2, Performance Monitors Component Identification Register 2 
The PMCIDR2 characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


For more information see About the Component Identification scheme on page K2-7663. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMCIDR2 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
PMCIDR2 is a 32-bit register. 


Field descriptions 


The PMCIDR2 bit assignments are: 


31 8 7 0 
RESO PRMBL_2 
Bits [31:8] 


Reserved, RESO. 


PRMBL 2, bits [7:0] 
Preamble. Must read as 0x05. 


Accessing the PMCIDR2: 


PMCIDR2 can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFF8 PMCIDR2 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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15.3.12 PMCIDR3, Performance Monitors Component Identification Register 3 
The PMCIDR3 characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


For more information see About the Component Identification scheme on page K2-7663. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMCIDR3 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
PMCIDR3 is a 32-bit register. 


Field descriptions 


The PMCIDR3 bit assignments are: 


31 8 7 0 
RESO PRMBL_3 
Bits [31:8] 


Reserved, RESO. 


PRMBL 3, bits [7:0] 
Preamble. Must read as QxB1. 


Accessing the PMCIDR3: 


PMCIDR3 can be accessed through the external debug interface: 





Component Offset Instance 





PMU QxFFC PMCIDR3 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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15.3.13 PMCID1SR, CONTEXTIDR_EL1 Sample Register 


ARM DDI 0487E.a 
ID070919 


The PMCID1SR characteristics are: 


Purpose 


Contains the sampled value of CONTEXTIDR_EL1, captured on reading PMPCSRJ[3 1:0]. 


Configurations 


Attributes 


PMCIDISR is in the Core power domain. 


Fields in this register reset to architecturally UNKNOWN values. These apply only on a Cold reset. 
The register is not affected by a Warm reset and is not affected by an External debug reset. 


This register is present only when ARMv8.2-PCSample is implemented. Otherwise, direct accesses 
to PMCIDISR are RESO. 





Note 


Before Armv8.2, the PC Sample-based Profiling Extension can be implemented in the external 
debug register space, as indicated by the value of EDDEVID.PCSample. 





PMCIDISR is a 32-bit register. 


Field descriptions 


The PMCIDISR bit assignments are: 


31 


0 


CONTEXTIDR_EL1 


CONTEXTIDR_EL1, bits [31:0] 


Context ID. The value of CONTEXTIDR that is associated with the most recent PMPCSR sample. 
. If EL1 is using AArch64, then the Context ID is sampled from CONTEXTIDR_EL1. 
à If EL1 is using AArch32, then the Context ID is sampled from CONTEXTIDR. 


$ If EL3 is implemented and is using AArch32, then CONTEXTIDR is a banked register and 
PMCIDI1SR samples the current banked copy of CONTEXTIDR for the Security state that is 
associated with the most recent PMPCSR sample. 


Because the value written to PMCID1SR is an indirect read of CONTEXTIDR, therefore it is 
CONSTRAINED UNPREDICTABLE whether PMCID1SR is set to the original or new value if a read of 
PMPCSR samples: 


° An instruction that writes to CONTEXTIDR ELl1. 
è The next Context synchronization event. 
° Any instruction executed between these two instructions. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the PMCID1SR: 


IMPLEMENTATION DEFINED extensions to external debug might make the value of this register UNKNOWN, see 
Permitted behavior that might make the PC Sample-based profiling registers UNKNOWN on page H7-6824 
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PMCIDI1SR can be accessed through the external debug interface: 





Component Offset Instance 


PMU 0x208 PMCIDISR 





This interface is accessible as follows: 
° When IsCorePowered(), !'DoubleLockStatus() and !OSLockStatus() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 


PMCIDISR can be accessed through the external debug interface: 





Component Offset Instance 


PMU 0x228 PMCIDISR 





This interface is accessible as follows: 
. When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to this register are RO. 


. Otherwise accesses to this register generate an error response. 
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15.3.14 PMCID2SR, CONTEXTIDR_EL2 Sample Register 


The PMCID2SR characteristics are: 


ARM DDI 0487E.a 
ID070919 


Purpose 


Contains the sampled value of CONTEXTIDR_EL2, captured on reading PMPCSR{[3 1:0]. 


Configurations 


Attributes 


PMCID2SR is in the Core power domain. 


Fields in this register reset to architecturally UNKNOWN values. These apply only on a Cold reset. 
The register is not affected by a Warm reset and is not affected by an External debug reset. 


This register is present only when ARMv8.2-PCSample is implemented. Otherwise, direct accesses 
to PMCID2SR are RESO. 


Note 


Before Armv8.2, the PC Sample-based Profiling Extension can be implemented in the external 
debug register space, as indicated by the value of EDDEVID.PCSample. 








If EL2 is not implemented, this register is RESO. 


PMCID2S8R is a 32-bit register. 


Field descriptions 


The PMCID2SR bit assignments are: 


31 


0 


CONTEXTIDR_EL2 


CONTEXTIDR_EL2, bits [31:0] 


Context ID. The value of CONTEXTIDR that is associated with the most recent PMPCSR sample. 
: If EL2 is using AArch64, then the Context ID sampled from CONTEXTIDR_EL2. 
a If EL2 is using AArch32, then this field is set to an UNKNOWN value. 


Because the value written to PMCID2SR is an indirect read of CONTEXTIDR, therefore it is 
CONSTRAINED UNPREDICTABLE whether PMCID2SR is set to the original or new value if a read of 
PMPCSR samples: 


° An instruction that writes to CONTEXTIDR_EL2. 
. The next Context synchronization event. 
° Any instruction executed between these two instructions. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the PMCID2SR: 


IMPLEMENTATION DEFINED extensions to external debug might make the value of this register UNKNOWN, see 
Permitted behavior that might make the PC Sample-based profiling registers UNKNOWN on page H7-6824 
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PMCID2SR can be accessed through the external debug interface: 





Component Offset Instance 


PMU 0x22C PMCID2SR 





This interface is accessible as follows: 
° When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to this register are RO. 


. Otherwise accesses to this register generate an error response. 
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15.3.15 PMCNTENCLR_ELO, Performance Monitors Count Enable Clear register 


ARM DDI 0487E.a 
ID070919 


The PMCNTENCLR_ELO characteristics are: 


Purpose 


Disables the Cycle Count Register, PMCCNTR_ELO, and any implemented event counters 
PMEVCNTR<n>. Reading this register shows which counters are enabled. 


Configurations 


Attributes 


External register PMCNTENCLR_ELO[31:0] is architecturally mapped to AArch64 System 
register PMCNTENCLR_ELO[31:0]. 


External register PMCNTENCLR_ELO[31:0] is architecturally mapped to AArch32 System 
register PMCNTENCLR{J31:0]. 


PMCNTENCLR_ELO is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply on a Warm or Cold reset. The register is not affected by an External 
debug reset. 


PMCNTENCLR _ ELO is a 32-bit register. 


Field descriptions 


The PMCNTENCLR _ ELO bit assignments are: 


31 30 


0 


P<n>, bit [n] 


C, bit [31] 


PMCCNTR_ELO disable bit. Disables the cycle counter register. Possible values are: 


Qbd When read, means the cycle counter is disabled. When written, has no effect. 
Qb1 When read, means the cycle counter is enabled. When written, disables the cycle 
counter. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 


Event counter disable bit for PMEVCNTR<n>_ELO. 
If PMCFGR.N is less than 31, bits [30:PMCFGR.N] are RAZ/WI. 
Qbd When read, means that PMEVCNTR<n>_ELO is disabled. When written, has no effect. 


Qb1 When read, means that PMEVCNTR<n>_EL0 is enabled. When written, disables 
PMEVCNTR<n>_ELO. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Accessing the PMCNTENCLR_ELO: 





Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 
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PMCNTENCLR_ELO can be accessed through the external debug interface: 





Component Offset Instance 


PMU QxC20 PMCNTENCLR_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


. Otherwise accesses to this register generate an error response. 
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15.3.16 PMCNTENSET_ELO, Performance Monitors Count Enable Set register 


ARM DDI 0487E.a 
ID070919 


The PMCNTENSET ELO characteristics are: 


Purpose 


Enables the Cycle Count Register, PMCCNTR_ELO, and any implemented event counters 


PMEVCNTR<n>. Reading this register shows which counters are enabled. 


Configurations 


Attributes 


External register PMCNTENSET_ELO[31:0] is architecturally mapped to AArch64 System register 
PMCNTENSET ELO[31:0]. 

External register PMCNTENSET_ELO[31:0] is architecturally mapped to AArch32 System register 
PMCNTENSET{[3 1:0]. 


PMCNTENSET_ELO is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply on a Warm or Cold reset. The register is not affected by an External 
debug reset. 


PMCNTENSET ELO is a 32-bit register. 


Field descriptions 


The PMCNTENSET ELO bit assignments are: 


31 30 


0 


P<n>, bit [n] 


C, bit [31] 


PMCCNTR_ELO enable bit. Enables the cycle counter register. Possible values are: 


Qbd When read, means the cycle counter is disabled. When written, has no effect. 
Qb1 When read, means the cycle counter is enabled. When written, enables the cycle 
counter. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 


Event counter enable bit for PMEVCNTR<n>_EL0. 
If PMCFGR.N is less than 31, bits [30:PMCFGR.N] are RAZ/WI. 
Qbd When read, means that PMEVCNTR<n>_ELO is disabled. When written, has no effect. 


Qb1 When read, means that PMEVCNTR<n>_ELO0 event counter is enabled. When written, 
enables PMEVCNTR<n>_ELO. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Accessing the PMCNTENSET_ELO: 





Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 
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PMCNTENSET ELO can be accessed through the external debug interface: 





Component Offset Instance 


PMU QxC0d PMCNTENSET_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


. Otherwise accesses to this register generate an error response. 
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15.3.17 PMCR_ELO, Performance Monitors Control Register 


ARM DDI 0487E.a 
ID070919 


The PMCR_ELO characteristics are: 


Purpose 


Provides details of the Performance Monitors implementation, including the number of counters 
implemented, and configures and controls the counters. 


Configurations 
External register PMCR_ELO[7:0] is architecturally mapped to AArch32 System register 
PMCR[7:0]. 
External register PMCR_ELO[7:0] is architecturally mapped to AArch64 System register 
PMCR_ELO[7:0]. 
PMCR_ELO is in the Core power domain. Some or all RW fields of this register have defined reset 
values. The field descriptions identify when the reset values apply. 


This register is only partially mapped to the internal PMCR System register. An external agent must 
use other means to discover the information held in PMCR[3 1:11], such as accessing PMCFGR and 
the ID registers. 


Attributes 
PMCR _ ELO is a 32-bit register. 


Field descriptions 


The PMCR_ELO bit assignments are: 


31 110 876543210 
RAZ/WI RESO Let.cbex| oc] 
Bits [31:11] 


Reserved, RAZ/WI. 
Hardware must implement this field as RAZ/WI. Software must not rely on the register reading as 


zero, and must use a read-modify-write sequence to write to the register. 
Bits [10:8] 
Reserved, RESO. 
LP, bit [7] 
When ARMv8.5-PMU is implemented: 


Long event counter enable. Determines when unsigned overflow is recorded by a counter overflow 


bit. 

Qbd Event counter overflow on increment that causes unsigned overflow of 
PMEVCNTR<n>_ELO[31:0]. 

Qb1 Event counter overflow on increment that causes unsigned overflow of 


PMEVCNTR<n>_EL0[63:0]. 


If EL2 is implemented and MDCR_EL2.HPMN or HDCR.HPMN is less than PMCR_ELO.N, this 
bit does not affect the operation of event counters in the range [HDCR.HPMN..(PMCR_ELO.N-1)] 
or [MDCR_EL2.HPMN:(PMCR_ELO.N-1)]. 
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Note 
The effect of MDCR_EL2.HPMN or HDCR.HPMN on the operation of this bit always applies if 
EL2 is implemented, at all Exception levels including EL2 and EL3, and regardless of whether EL2 


is enabled in the current Security state. For more information, see the description of 
MDCR_EL2.HPMN or HDCR.HPMN. 








If the highest implemented Exception level is using AArch32, it is IMPLEMENTATION DEFINED 
whether this bit is RW or RAZ/WI. 


Otherwise: 


Reserved, RESO. 


LC, bit [6] 
Long cycle counter enable. Determines when unsigned overflow is recorded by the cycle counter 
overflow bit. 
Qbo Cycle counter overflow on increment that causes unsigned overflow of 
PMCCNTR_ELO[31:0]. 
Qb1 Cycle counter overflow on increment that causes unsigned overflow of 
PMCCNTR_ELO[63:0]. 
Arm deprecates use of PMCR_ELO.LC = 0. 
In an AArch64 only implementation, this field is RES1. 
On a Warm reset, this field resets to an architecturally UNKNOWN value. 
DP, bit [5] 
Disable cycle counter when event counting is prohibited. The possible values of this bit are: 
Qbd Cycle counting by PMCCNTR_ELO is not affected by this bit. 
Qb1 When event counting for counters in the range [0.(MDCR_EL2.HPMN-1)] is 
prohibited, cycle counting by PMCCNTR_ELO is disabled. 
For more information about the interaction between the Performance Monitors and EL3, see Effect 
of EL3 and EL2 on page D7-2679. 
When EL3 is not implemented, this field is RESO: 
. When ARMv8.1-PMU is not implemented. 
à When ARMv8.1-PMU is implemented, only if EL2 is not implemented. 
Otherwise this field is RW. 
When this register has an architecturally-defined reset value, if this field is implemented as an RW 
field it resets to: 
° A value that is architecturally UNKNOWN if the reset is into an Exception level that is using 
AArch64. 
. 0 if the reset is into an Exception level that is using AArch32. 
X, bit [4] 
Enable export of events in an IMPLEMENTATION DEFINED event stream. The possible values of this 
bit are: 
Obd Do not export events. 
Qb1 Export events where not prohibited. 
This field enables the exporting of events over an event bus to another device, for example to an 
OPTIONAL PE trace unit. If the implementation does not include such an event bus then this field is 
RAZ/WI, otherwise it is an RW field. 
In an implementation that includes an event bus, no events are exported when counting is prohibited. 
This field does not affect the generation of Performance Monitors overflow interrupt requests or 
signaling to a cross-trigger interface (CTI) that can be implemented as signals exported from the PE. 
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When this register has an architecturally-defined reset value, if this field is implemented as an RW 
field it resets to: 


à A value that is architecturally UNKNOWN if the reset is into an Exception level that is using 
AArch64. 


s 0 if the reset is into an Exception level that is using AArch32. 


D, bit [3] 
Clock divider. The possible values of this bit are: 
0bd When enabled, PMCCNTR_ELO counts every clock cycle. 
Qb1 When enabled, PMCCNTR_ELO counts once every 64 clock cycles. 


In an AArch64 only implementation this field is RESO, otherwise it is an RW field. If 
PMCR_ELO.LC == 1, this bit is ignored and the cycle counter counts every clock cycle. 


Arm deprecates use of PMCR_ELO.D = 1. 


When this register has an architecturally-defined reset value, if this field is implemented as an RW 
field it resets to: 


s; A value that is architecturally UNKNOWN if the reset is into an Exception level that is using 
AArch64. 


5 0 if the reset is into an Exception level that is using AArch32. 


C, bit [2] 
Cycle counter reset. This bit is WO. The effects of writing to this bit are: 
Qbd No action. 
Qb1 Reset PMCCNTR_ELO to zero. 
This bit is always RAZ. 


— Note 
Resetting PMCCNTR_ELO does not change the cycle counter overflow bit. 
The value of PMCR_ELO.LC is ignored, and bits [63:0] of all affected events are reset. 





P, bit [1] 
Event counter reset. This bit is WO. The effects of writing to this bit are: 
Qbd No action. 
Qb1 Reset all event counters, not including PMCCNTR_ELO, to zero. 
This bit is always RAZ. 
Note 


Resetting the event counters does not change the event counter overflow bits. 


If ARMv8.5-PMU is implemented, the values of MDCR_EL2.HLP, and PMCR_ELO.LP are 
ignored and bits [63:0] of all event counters are reset. 








E, bit [0] 
Enable. 
Qbd All event counters in the range [0..(PMN-1)] and PMCCNTR_ELDO, are disabled. 


Qb1 All event counters in the range [0..(PMN-1)] and PMCCNTR_ELO, are enabled by 
PMCNTENSET ELO. 


This bit is RW. 

If EL2 is implemented then: 

$ If EL2 is using AArch32, PMN is HDCR.HPMN. 

: If EL2 is using AArch64, PMN is MDCR_EL2.HPMN. 
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` If PMN is less than PMCR_ELO.N, this bit does not affect the operation of event counters in 
the range [PMN..(PMCR_ELO.N-1)]. 


If EL2 is not implemented, PMN is PMCR_ELO.N. 





Note 
The effect of MDCR_EL2.HPMN or HDCR.HPMN on the operation of this bit always applies if 
EL2 is implemented, at all Exception levels including EL2 and EL3, and regardless of whether EL2 


is enabled in the current Security state. For more information, see the description of 
MDCR_EL2.HPMN or HDCR.HPMN. 





On a Warm reset, this field resets to 0. 


Accessing the PMCR_ELO: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 








PMCR ELO can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxE04 PMCR_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


e When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


° Otherwise accesses to this register generate an error response. 
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15.3.18 PMDEVAFFO, Performance Monitors Device Affinity register 0 
The PMDEVAFFO characteristics are: 


Purpose 


Copy of the low half of the PE MPIDR_ELI register that allows a debugger to determine which PE 
in a multiprocessor system the Performance Monitor component relates to. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMDEVAFFO is implemented in the Core power domain 
or in the Debug power domain. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required if the external interface to the PMU is implemented. 


Attributes 
PMDEVAFFO is a 32-bit register. 


Field descriptions 


The PMDEVAFFO bit assignments are: 


31 0 


MPIDR_EL1 low half 


MPIDR_EL1 low half, bits [31:0] 
MPIDR_EL1 low half. Read-only copy of the low half of MPIDR_EL1, as seen from the highest 
implemented Exception level. 


Accessing the PMDEVAFF0: 


PMDEVAFFO can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFA8 PMDEVAFFO 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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15.3.19 PMDEVAFF1, Performance Monitors Device Affinity register 1 
The PMDEVAFF 1 characteristics are: 


Purpose 


Copy of the high half of the PE MPIDR_ELI register that allows a debugger to determine which PE 
in a multiprocessor system the Performance Monitor component relates to. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMDEVAFF1 is implemented in the Core power domain 
or in the Debug power domain. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required if the external interface to the PMU is implemented. 


Attributes 
PMDEVAFF1 is a 32-bit register. 


Field descriptions 


The PMDEVAFF1 bit assignments are: 


31 0 


MPIDR_EL1 high half 


MPIDR_EL1 high half, bits [31:0] 
MPIDR_EL1 high half. Read-only copy of the high half of MPIDR_ELI, as seen from the highest 
implemented Exception level. 


Accessing the PMDEVAFF1: 


PMDEVAFF1 can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFAC PMDEVAFFI1 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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15.3.20 PMDEVARCH, Performance Monitors Device Architecture register 


The PMDEVARCH characteristics are: 


Purpose 
Identifies the programmers' model architecture of the Performance Monitor component. 
Configurations 
It is IMPLEMENTATION DEFINED whether PMDEVARCH is implemented in the Core power domain 
or in the Debug power domain. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 
Attributes 


PMDEVARCH is a 32-bit register. 


Field descriptions 


The PMDEVARCH bit assignments are: 


31 21 20 19 1615 0 


ARCHITECT l REVISION ARCHID 


PRESENT l 


ARCHITECT, bits [31:21] 
Defines the architecture of the component. For Performance Monitors, this is Arm Limited. 
Bits [31:28] are the JEP106 continuation code, 0x4. 
Bits [27:21] are the JEP106 ID code, 0x3B. 


PRESENT, bit [20] 
When set to 1, indicates that the DEVARCH is present. 


This field is 1 in Armv8. 


REVISION, bits [19:16] 
Defines the architecture revision. For architectures defined by Arm this is the minor revision. 


For Performance Monitors, the revision defined by Armv8 is 0x0. 


All other values are reserved. 


ARCHID, bits [15:0] 
Defines this part to be an Armv8 debug component. For architectures defined by Arm this is further 
subdivided. 


For Performance Monitors: 
° Bits [15:12] are the architecture version, 0x2. 
° Bits [11:0] are the architecture part number, 0xA16. 


This corresponds to Performance Monitors architecture version PMUv3. 
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Note 


The PMUv3 memory-mapped programmers' model can be used by devices other than Armv8 
processors. Software must determine whether the PMU is attached to an Armv8 processor by using 
the PMDEVAFFO0 and PMDEVAFF' registers to discover the affinity of the PMU to any Armv8 
processors. 








Accessing the PMDEVARCH: 


PMDEVARCH can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFBC PMDEVARCH 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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15.3.21 PMDEVID, Performance Monitors Device ID register 


ARM DDI 0487E.a 
ID070919 


The PMDEVID characteristics are: 


Purpose 
Provides information about features of the Performance Monitors implementation. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMDEVID is implemented in the Core power domain or 
in the Debug power domain. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required from Armv8.2 and in any implementation that includes 
ARMv8.2-PCSample. Otherwise, its location is RESO. 


Note 


Before Armv8.2, the PC Sample-based Profiling Extension can be implemented in the external 
debug register space, as indicated by the value of EDDEVID.PCSample. 








Attributes 
PMDEVID is a 32-bit register. 


Field descriptions 


The PMDEVID bit assignments are: 


31 4 3 0 
RESO PCSample 
Bits [31:4] 


Reserved, RESO. 


PCSample, bits [3:0] 

Indicates the level of PC Sample-based Profiling support using Performance Monitors registers. 

Permitted values of this field are: 

0b0000 PC Sample-based Profiling Extension is not implemented in the Performance Monitors 
register space. 

0b0001 PC Sample-based Profiling Extension is implemented in the Performance Monitors 
register space. 

All other values are reserved. 

ARMv8.2-PCSample implements the functionality identified by the value 0b0001. 


Accessing the PMDEVID: 


PMDEVID can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxFC8 PMDEVID 
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This interface is accessible as follows: 


. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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15.3.22 PMDEVTYPE, Performance Monitors Device Type register 


The PMDEVTYPE characteristics are: 


Purpose 
Indicates to a debugger that this component is part of a PEs performance monitor interface. 
Configurations 
It is IMPLEMENTATION DEFINED whether PMDEVTYPE is implemented in the Core power domain 
or in the Debug power domain. 
Implementation of this register is OPTIONAL. 
If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 
Attributes 


PMDEVTYPE is a 32-bit register. 


Field descriptions 


The PMDEVTYPE bit assignments are: 


31 8 7 4 3 0 
RESO SUB MAJOR 
Bits [31:8] 


Reserved, RESO. 


SUB, bits [7:4] 
Subtype. Must read as 0x1 to indicate this is a component within a PE. 


MAJOR, bits [3:0] 


Major type. Must read as 0x6 to indicate this is a performance monitor component. 


Accessing the PMDEVTYPE: 


PMDEVTYPE can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFCC PMDEVTY PE 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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15.3.23 PMEVCNTR<n>_ELO, Performance Monitors Event Count Registers, n = 0 - 30 
The PMEVCNTR<n>_ELO characteristics are: 


Purpose 


Holds event counter n, which counts events, where n is 0 to 30. 


Configurations 


External register PMEVCNTR<n>_EL0[31:0] is architecturally mapped to AArch64 System 
register PMEVCNTR<n>_ELO0[31:0]. 


External register PMEVCNTR<n>_EL0[31:0] is architecturally mapped to AArch32 System 
register PMEVCNTR<n>[31:0]. 


PMEVCNTR<n>_ELO is in the Core power domain. RW fields in this register reset to 
architecturally UNKNOWN values. The field descriptions identify when the reset values apply. 


Attributes 
PMEVCNTR<n>_EL0 is a 64-bit register. 


Field descriptions 


The PMEVCNTR<n>_ELO bit assignments are: 


When ARMv8.5-PMU is implemented: 


63 0 


Event counter n 


Bits [63:0] 
Event counter n. Value of event counter n, where n is the number of this register and is a number 
from 0 to 30. 
If the highest implemented Exception level is using AArch32, the optional external interface to the 
performance monitors is implemented, and the PMCR.LP and HDCR.HLP bits are RAZ/WI, then 
locations in the external interface to the performance monitors that map to 
PMEVCNTR<n>_EL0[63:32] return UNKNOWN values on reads. 
If the implementation does not support AArch64 at any Exception level, bits [63:32] of the event 
counters are not required to be implemented. 
This field resets to an architecturally UNKNOWN value. 

Otherwise: 

31 0 

Bits [31:0] 
Event counter n. Value of event counter n, where n is the number of this register and is a number 
from 0 to 30. 
This field resets to an architecturally UNKNOWN value. 
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Accessing the PMEVCNTR<n>_EL0: 


External accesses to the performance monitors ignore PMUSERENR_ELO and, if implemented, 
MDCR_EL2.{TPM, TPMCR, HPMN} and MDCR_EL3.TPM. This means that all counters are accessible 
regardless of the current Exception level or privilege of the access. 


If ARMv8.5-PMUis not implemented, when IsCorePowered(), DoubleLockStatus(), OSLockStatus() or 
!AllowExternalPMUAccess(), 32-bit access to @x004+8n has a CONSTRAINED UNPREDICTABLE behavior. 





Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 





PMEVCNTR<n>_ELO can be accessed through the external debug interface: 





Component Offset Instance 


PMU 0x000 + 8n PMEVCNTR<n>_ELO 





This interface is accessible as follows: 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


. Otherwise accesses to this register generate an error response. 
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15.3.24 


PMEVTYPER<n>_EL0O, Performance Monitors Event Type Registers, n = 0 - 30 


The PMEVTYPER<n>_ELO characteristics are: 


Purpose 


Configures event counter n, where n is 0 to 30. 


Configurations 


External register PMEVTYPER<n>_EL0[31:0] is architecturally mapped to AArch64 System 
register PMEVTYPER<n>_EL0[31:0]. 


External register PMEVTYPER<n>_EL0[31:0] is architecturally mapped to AArch32 System 
register PMEVTYPER<n>[31:0]. 


PMEVTYPER<n>_EL40 is in the Core power domain. RW fields in this register reset to 
architecturally UNKNOWN values. These apply on a Warm or Cold reset. The register is not affected 
by an External debug reset. 


If event counter n is not implemented then accesses to this register are: 


. RESO when IsCorePowered() && !DoubleLockStatus() && !OSLockStatus() && 
AllowExternalPMUAccess(). 


. A CONSTRAINED UNPREDICTABLE choice of RESO or ERROR otherwise. 


Attributes 
PMEVTYPER<n>_EL0 is a 32-bit register. 


Field descriptions 


The PMEVTYPER<n> _ELO bit assignments are: 


31 30 29 28 27 26 25 24 23 1615 


yey) | do | RESO evtCount[15:10] evtCount{9:0] 





15-7082 


P, bit [31] 


Privileged filtering bit. Controls counting in EL1. If EL3 is implemented, then counting in 
Non-secure EL1 is further controlled by the PMEVTYPER<n>_ELO0.NSK bit. The possible values 
of this bit are: 


Obd Count events in EL1. 
Qb1 Do not count events in EL1. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


U, bit [30] 


User filtering bit. Controls counting in ELO. If EL3 is implemented, then counting in Non-secure 
ELO is further controlled by the PMEVTYPER<n>_ELO.NSU bit. The possible values of this bit 
are: 


Qbd Count events in ELO. 
Qb1 Do not count events in ELO. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


External System Control Register Descriptions 
15.3 Performance Monitors external register descriptions 


NSK, bit [29] 


Non-secure EL1 (kernel) modes filtering bit. Controls counting in Non-secure EL1. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMEVTYPER<n>_EL0.P bit, events in 
Non-secure EL1 are counted. 


Otherwise, events in Non-secure EL1 are not counted. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


NSU, bit [28] 


Non-secure ELO (Unprivileged) filtering bit. Controls counting in Non-secure ELO. If EL3 is not 
implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMEVTYPER<n>_EL0.U bit, events in 
Non-secure ELO are counted. 


Otherwise, events in Non-secure ELO are not counted. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


NSH, bit [27] 


EL2 (Hypervisor) filtering bit. Controls counting in EL2. If EL2 is not implemented, this bit is RESO. 
If Secure EL2 is implemented, counting in Secure EL2 is further controlled by the 
PMEVTYPER<n>_EL0.SH bit. 


Qbd Do not count events in EL2. 
Ob1 Count events in EL2. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


M, bit [26] 
Secure EL3 filtering bit. If EL3 is not implemented, this bit is RESO. 


If the value of this bit is equal to the value of the PMEVTYPER<n>_EL0.P bit, cycles in Secure 
EL3 are counted. 


Otherwise, cycles in Secure EL3 are not counted. 
Most applications can ignore this field and set its value to @bQ. 


Note 
This field is not visible in the AArch32 PMEVTY PER<n> System register. 








On a Warm reset, this field resets to an architecturally UNKNOWN value. 


MT, bit [25] 
Multithreading. When the implementation is multi-threaded, the valid values for this bit are: 
Qbd Count events only on controlling PE. 
Qb1 Count events from any PE with the same affinity at level 1 and above as this PE. 


When the implementation is not multi-threaded, this bit is RESO. 





Note 


. When the lowest level of affinity consists of logical PEs that are implemented using a 
multi-threading type approach, an implementation is described as multi-threaded. That is, the 
performance of PEs at the lowest affinity level is highly interdependent. On such an 
implementation, the value of the MPIDR_EL1.MT bit, when read at the highest implemented 
Exception level, is 0b1. 


à Events from a different thread of a multithreaded implementation are not Attributable to the 
thread counting the event. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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SH, bit [24] 


When ARMV8.4-SecEL2 is implemented: 


Secure EL2 filtering. 


If the value of this bit is not equal to the value of the PMEVTYPER<n>_ELO0.NSH bit, events in 
Secure EL2 are counted. 


Otherwise, events in Secure EL2 are not counted. 
If Secure EL2 is not implemented or is disabled, this field is RESO. 


Note 
This field is not visible in the AArch32 PMEVTY PER<n> System register. 





On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Bits [23:16] 


Reserved, RESO. 


Reserved, RESO. 


evtCount([15:10], bits [15:10] 
When ARMv8.1-PMU is implemented: 


Extension to evtCount[9:0]. See evtCount[9:0] for more details. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


Reserved, RESO. 


evtCount[9:0], bits [9:0] 


Event to count. The event number of the event that is counted by event counter 
PMEVCNTR<n>_ELO. 


Software must program this field with an event that is supported by the PE being programmed. 


There are three types of event: 


. Common architectural and microarchitectural events. 
. Arm recommended common architectural and microarchitectural events. 
. IMPLEMENTATION DEFINED events. 


The ranges of event numbers allocated to each type of event are shown in Table D7-6 on 
page D7-2693. 


If evtCount is programmed to an event that is reserved or not supported by the PE, the behavior 
depends on the event type: 


- For the range 0x000 to @x03F, no events are counted, and the value returned by a direct or 
external read of the evtCount field is the value written to the field. 


. For IMPLEMENTATION DEFINED events, it is UNPREDICTABLE what event, if any, is counted, 
and the value returned by a direct or external read of the evtCount field is UNKNOWN. 


Note 


UNPREDICTABLE means the event must not expose privileged information. 








Arm recommends that the behavior across a family of implementations is defined such that if a 
given implementation does not include an event from a set of common IMPLEMENTATION DEFINED 
events, then no event is counted and the value read back on evtCount is the value written. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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Accessing the PMEVTYPER<n>_ELO: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 








PMEVTYPER<n>_ELO can be accessed through the external debug interface: 





Component Offset Instance 


PMU 0x400+4n PMEVTYPER<n>_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


. Otherwise accesses to this register generate an error response. 
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15.3.25 PMINTENCLR_EL1, Performance Monitors Interrupt Enable Clear register 
The PMINTENCLR_ELI characteristics are: 


Purpose 


Disables the generation of interrupt requests on overflows from the Cycle Count Register, 
PMCCNTR_ELO, and the event counters PMEVCNTR<n>_ELO. Reading the register shows which 
overflow interrupt requests are enabled. 


Configurations 
External register PMINTENCLR_EL1[31:0] is architecturally mapped to AArch64 System register 
PMINTENCLR_EL1[31:0]. 


External register PMINTENCLR_EL1[31:0] is architecturally mapped to AArch32 System register 
PMINTENCLRJ3 1:0]. 


PMINTENCLR_EL1 is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply on a Warm or Cold reset. The register is not affected by an External 


debug reset. 


Attributes 
PMINTENCLR_ EL] is a 32-bit register. 


Field descriptions 


The PMINTENCLR_ EL! bit assignments are: 


31 30 0 
C, bit [31] 


PMCCNTR_ELO overflow interrupt request disable bit. Possible values are: 


Qbd When read, means the cycle counter overflow interrupt request is disabled. When 
written, has no effect. 


Qb1 When read, means the cycle counter overflow interrupt request is enabled. When 
written, disables the cycle count overflow interrupt request. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter overflow interrupt request disable bit for PMEVCNTR<n>_EL0. 
If PMCFGR.N is less than 31, bits [30:PMCFGR.N] are RAZ/WI. 


Qbd When read, means that the PMEVCNTR<n>_ELO event counter interrupt request is 
disabled. When written, has no effect. 
Qb1 When read, means that the PMEVCNTR<n>_ELO event counter interrupt request is 


enabled. When written, disables the PMEVCNTR<n>_ELO interrupt request. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Accessing the PMINTENCLR_EL1: 
Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 
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PMINTENCLR EL! can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxC60 PMINTENCLR_ EL! 





This interface is accessible as follows: 


When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


Otherwise accesses to this register generate an error response. 
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15.3.26 PMINTENSET_EL1, Performance Monitors Interrupt Enable Set register 
The PMINTENSET_EL1 characteristics are: 


Purpose 


Enables the generation of interrupt requests on overflows from the Cycle Count Register, 
PMCCNTR_ELO, and the event counters PMEVCNTR<n>_ELO. Reading the register shows which 
overflow interrupt requests are enabled. 


Configurations 
External register PMINTENSET_EL1[31:0] is architecturally mapped to AArch64 System register 
PMINTENSET EL1[31:0]. 


External register PMINTENSET_EL1[31:0] is architecturally mapped to AArch32 System register 
PMINTENSET{[31:0]. 


PMINTENSET EL] is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply on a Warm or Cold reset. The register is not affected by an External 


debug reset. 


Attributes 
PMINTENSET EL] is a 32-bit register. 


Field descriptions 


The PMINTENSET_ EL] bit assignments are: 


31 30 0 
C, bit [31] 


PMCCNTR_ELO overflow interrupt request enable bit. Possible values are: 


Qbd When read, means the cycle counter overflow interrupt request is disabled. When 
written, has no effect. 


Qb1 When read, means the cycle counter overflow interrupt request is enabled. When 
written, enables the cycle count overflow interrupt request. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 
Event counter overflow interrupt request enable bit for PMEVCNTR<n>_EL0. 
If PMCFGR.N is less than 31, bits [30:PMCFGR.N] are RAZ/WI. 


Qbd When read, means that the PMEVCNTR<n>_ELO event counter interrupt request is 
disabled. When written, has no effect. 
Qb1 When read, means that the PMEVCNTR<n>_ELO event counter interrupt request is 


enabled. When written, enables the PMEVCNTR<n>_ELO interrupt request. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
Accessing the PMINTENSET_EL1: 
Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 
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PMINTENSET ELI can be accessed through the external debug interface: 





Component Offset Instance 


PMU QxC40 PMINTENSET EL1 





This interface is accessible as follows: 


When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


Otherwise accesses to this register generate an error response. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7089 
Non-Confidential 


External System Control Register Descriptions 
15.3 Performance Monitors external register descriptions 


15.3.27 


15-7090 


PMITCTRL, Performance Monitors Integration mode Control register 


The PMITCTRL characteristics are: 


Purpose 


Enables the Performance Monitors to switch from default mode into integration mode, where test 
software can control directly the inputs and outputs of the PE, for integration testing or topology 
detection. 


Configurations 


It is IMPLEMENTATION DEFINED whether PMITCTRL is implemented in the Core power domain or 
in the Debug power domain. Some or all RW fields of this register have defined reset values, and: 


° The register is not affected by a Warm reset. 


° If the register is implemented in the Core power domain the reset values apply on a Cold 
reset, and the register is not affected by an External debug reset. 


° If the register is implemented in the Debug power domain the reset values apply on an 
External debug reset, and the register is not affected by a Cold reset. 


Implementation of this register is OPTIONAL. 


Attributes 
PMITCTRL is a 32-bit register. 


Field descriptions 


The PMITCTRL bit assignments are: 


Bits [31:1] 
Reserved, RESO. 


IME, bit [0] 


Integration mode enable. When IME == 1, the device reverts to an integration mode to enable 
integration testing or topology detection. The integration mode behavior is IMPLEMENTATION 


DEFINED. 
Qbd Normal operation. 
Qb1 Integration mode enabled. 


On a Implementation reset, this field resets to 0. 


Accessing the PMITCTRL: 


PMITCTRL can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxF00 PMITCTRL 
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This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and SoftwareLockStatus() accesses to this 
register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus() and !SoftwareLockStatus() accesses to this 
register are RW. 


° Otherwise accesses to this register are IMPDEF. 
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15.3.28 


15-7092 


PMLAR, Performance Monitors Lock Access Register 


The PMLAR characteristics are: 


Purpose 


Allows or disallows access to the Performance Monitors registers through a memory-mapped 
interface. 


The optional Software Lock provides a lock to prevent memory-mapped writes to the Performance 
Monitors registers. Use of this lock mechanism reduces the risk of accidental damage to the contents 
of the Performance Monitors registers. It does not, and cannot, prevent all accidental or malicious 
damage. 


Configurations 


It is IMPLEMENTATION DEFINED whether PMLAR is implemented in the Core power domain or in 
the Debug power domain. 


If AMRMvV8.4-Debug is implemented, the Software Lock is not implemented. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


Software uses PMLAR to set or clear the lock, and PMLSR to check the current status of the lock. 


Attributes 
PMLAR is a 32-bit register. 


Field descriptions 


The PMLAR bit assignments are: 


When the Software Lock is implemented: 


KEY, bits [31:0] 


Lock Access control. Writing the key value @xC5ACCE55 to this field unlocks the lock, enabling write 
accesses to this component's registers through a memory-mapped interface. 


Writing any other value to this register locks the lock, disabling write accesses to this component's 
registers through a memory mapped interface. 


Otherwise: 
31 0 
RESO 
Bits [31:0] 
Reserved, RESO. 
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Accessing the PMLAR: 


PMLAR can be accessed through its memory-mapped interface: 





Component Offset Instance 





PMU OxFBQ PMLAR 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are WO. 
° Otherwise accesses to this register generate an error response. 
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15.3.29 


15-7094 


PMLSR, Performance Monitors Lock Status Register 


The PMLSR characteristics are: 


Purpose 
Indicates the current status of the software lock for Performance Monitors registers. 


The optional Software Lock provides a lock to prevent memory-mapped writes to the Performance 
Monitors registers. Use of this lock mechanism reduces the risk of accidental damage to the contents 
of the Performance Monitors registers. It does not, and cannot, prevent all accidental or malicious 
damage. 


Configurations 


It is IMPLEMENTATION DEFINED whether PMLSR is implemented in the Core power domain or in 
the Debug power domain. Some or all RW fields of this register have defined reset values, and: 


. The register is not affected by a Warm reset. 


° If the register is implemented in the Core power domain the reset values apply on a Cold 
reset, and the register is not affected by an External debug reset. 


. If the register is implemented in the Debug power domain the reset values apply on an 
External debug reset, and the register is not affected by a Cold reset. 


If ARMv8.4-Debug is implemented, the Software Lock is not implemented. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


Software uses PMLAR to set or clear the lock, and PMLSR to check the current status of the lock. 


Attributes 
PMLSR is a 32-bit register. 


Field descriptions 


The PMLSR bit assignments are: 


Bits [31:3] 


Reserved, RESO. 


nTT, bit [2] 
Not thirty-two bit access required. RAZ. 


SLK, bit [1] 
When the Software Lock is implemented: 


Software Lock status for this component. For an access to LSR that is not amemory-mapped access, 
or when the Software Lock is not implemented, this field is RESO. 


For memory-mapped accesses when the software lock is implemented, possible values of this field 


are: 
Qbd Lock clear. Writes are permitted to this component's registers. 
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Qb1 Lock set. Writes to this component's registers are ignored, and reads have no side 
effects. 


The following resets apply: 


° If Armv8.3-DoPD is implemented, this register is reset by Cold reset and not affected by 
External debug reset. If Armv8.3-DoPD is not implemented, this register is reset by External 
debug reset and not affected by Cold reset. 


° On a reset, this field resets to 1. 
Otherwise: 


Reserved, RAZ. 


SLI, bit [0] 


Software Lock implemented. For an access to LSR that is not a memory-mapped access, this field 
is RAZ. For memory-mapped accesses, the value of this field is IMPLEMENTATION DEFINED. 
Permitted values are: 


0b0ð Software Lock not implemented or not memory-mapped access. 


Qb1 Software Lock implemented and memory-mapped access. 


Accessing the PMLSR: 


PMLSR can be accessed through its memory-mapped interface: 





Component Offset Instance 





PMU OxFB4 PMLSR 
This interface is accessible as follows: 
. When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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15.3.30 PMMIR, Performance Monitors Machine Identification Register 


The PMMIR characteristics are: 


Purpose 
Describes Performance Monitors parameters specific to the implementation. 
Configurations 
PMMIR is in the Core power domain. 
This register is present only when ARMVv8.4-PMU is implemented. Otherwise, direct accesses to 
PMMIR are RESO. 
Attributes 


PMMIR is a 32-bit register. 


Field descriptions 


The PMMIR bit assignments are: 


31 8 7 0 
RESO SLOTS 
Bits [31:8] 


Reserved, RESO. 


SLOTS, bits [7:0] 
Operation width. The largest value by which the STALL_SLOT event might increment by in a 
single cycle. If the STALL_SLOT event is implemented, this field must not be zero. 


Accessing the PMMIR: 


If the Core power domain is off or in a low-power state, access on this interface returns an Error. 


PMMIR can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxE40 PMMIR 





This interface is accessible as follows: 


° When !IsCorePowered(), or DoubleLockStatus(), or OSLockStatus() or !AllowExternalPMUAccess() 
accesses to this register generate an error response. 


° Otherwise accesses to this register are RO. 
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15.3.31 PMOVSCLR_ELO, Performance Monitors Overflow Flag Status Clear register 


ARM DDI 0487E.a 
ID070919 


The PMOVSCLR_ELO characteristics are: 


Purpose 


Contains the state of the overflow bit for the Cycle Count Register, PMCCNTR_ELO, and each of 


the implemented event counters PMEVCNTR<n>. Writing to this register clears these bits. 


Configurations 


Attributes 


External register PMOVSCLR_ELO0[31:0] is architecturally mapped to AArch64 System register 
PMOVSCLR_ELO[31:0]. 

External register PMOVSCLR_EL0[31:0] is architecturally mapped to AArch32 System register 
PMOVSR{[31:0]. 

PMOVSCLR_ELO is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply on a Warm or Cold reset. The register is not affected by an External 
debug reset. 


PMOVSCLR_ELO is a 32-bit register. 


Field descriptions 


The PMOVSCLR_ELO bit assignments are: 


31 30 


0 


P<n>, bit [n] 


C, bit [31] 


Cycle counter overflow clear bit. 


Qbd When read, means the cycle counter has not overflowed since this bit was last cleared. 
When written, has no effect. 


Qb1 When read, means the cycle counter has overflowed since this bit was last cleared. 
When written, clears the cycle counter overflow bit to 0. 


PMCR_ELO.LC controls whether an overflow is detected from unsigned overflow of 
PMCCNTR_ELO[31:0] or unsigned overflow of PMCCNTR_ELO[63:0]. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 


Event counter overflow clear bit for PMEVCNTR<n>_ELO. 
If PMCFGR.N is less than 31, bits [30:PMCFGR.N] are RAZ/WI. 


Obd When read, means that PMEVCNTR<n>_EL0 has not overflowed since this bit was last 
cleared. When written, has no effect. 
Qb1 When read, means that PMEVCNTR<n>_EL0 has overflowed since this bit was last 


cleared. When written, clears the PMEVCNTR<n>_ELO overflow bit to 0. 


If ARMv8.5-PMU is implemented, MDCR_EL2.HLP and PMCR_ELO.LP control whether an 
overflow is detected from unsigned overflow of PMEVCNTR<n>_EL0[31:0] or unsigned overflow 
of PMEVCNTR<n>_EL0[63:0]. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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Accessing the PMOVSCLR_ELO: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 








PMOVSCLR_ELO can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxC80 PMOVSCLR_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


. Otherwise accesses to this register generate an error response. 
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15.3.32 PMOVSSET_ELO, Performance Monitors Overflow Flag Status Set register 


ARM DDI 0487E.a 
ID070919 


The PMOVSSET ELO characteristics are: 


Purpose 
Sets the state of the overflow bit for the Cycle Count Register, PMCCNTR_ELO, and each of the 
implemented event counters PMEVCNTR<n>. 

Configurations 
External register PMOVSSET_ELO[31:0] is architecturally mapped to AArch64 System register 
PMOVSSET_ELO[31:0]. 
External register PMOVSSET_ELO[31:0] is architecturally mapped to AArch32 System register 
PMOVSSET{[3 1:0]. 
PMOVSSET_ELO is in the Core power domain. RW fields in this register reset to architecturally 
UNKNOWN values. These apply on a Warm or Cold reset. The register is not affected by an External 
debug reset. 

Attributes 


PMOVSSET_ELO is a 32-bit register. 


Field descriptions 


The PMOVSSET ELO bit assignments are: 


31 30 


0 


P<n>, bit [n] 


C, bit [31] 


Cycle counter overflow set bit. 


Qbd When read, means the cycle counter has not overflowed since this bit was last cleared. 
When written, has no effect. 


Qb1 When read, means the cycle counter has overflowed since this bit was last cleared. 
When written, sets the cycle counter overflow bit to 1. 


PMCR_ELO.LC controls whether an overflow is detected from unsigned overflow of 
PMCCNTR_ELO[31:0] or unsigned overflow of PMCCNTR_ELO[63:0]. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 


P<n>, bit [n], for n = 0 to 30 


Event counter overflow set bit for PMEVCNTR<n>_EL0. 
If PMCFGR.N is less than 31, bits [30:PMCFGR.N] are RAZ/WI. 


Obd When read, means that PMEVCNTR<n>_EL0 has not overflowed since this bit was last 
cleared. When written, has no effect. 
Qb1 When read, means that PMEVCNTR<n>_EL0 has overflowed since this bit was last 


cleared. When written, sets the PMEVCNTR<n>_EL0 overflow bit to 1. 


If ARMv8.5-PMU is implemented, MDCR_EL2.HLP and PMCR_ELO.LP control whether an 
overflow is detected from unsigned overflow of PMEVCNTR<n>_EL0[31:0] or unsigned overflow 
of PMEVCNTR<n>_EL0[63:0]. 


On a Warm reset, this field resets to an architecturally UNKNOWN value. 
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Accessing the PMOVSSET_ELO: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 








PMOVSSET_EL0 can be accessed through the external debug interface: 





Component Offset Instance 


PMU @xCCO PMOVSSET_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are RO. 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are RW. 


. Otherwise accesses to this register generate an error response. 
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15.3.33 PMPCSR, Program Counter Sample Register 
The PMPCSR characteristics are: 


Purpose 


Holds a sampled instruction address value. 


Configurations 
PMPCSR is in the Core power domain. 


Fields in this register reset to architecturally UNKNOWN values. These apply only on a Cold reset. 
The register is not affected by a Warm reset and is not affected by an External debug reset. 


This register is present only when ARMv8.2-PCSample is implemented. Otherwise, direct accesses 
to PMPCSR are RESO. 





Note 


Before Armv8.2, the PC Sample-based Profiling Extension can be implemented in the external 
debug register space, as indicated by the value of EDDEVID.PCSample. 





Support for 64-bit atomic reads is IMPLEMENTATION DEFINED. If 64-bit atomic reads are 
implemented, a 64-bit read of PMPCSR has the same side-effect as a 32-bit read of PMCSR[31:0] 
followed by a 32-bit read of PMPCSR[63:32], returning the combined value. For example, if the PE 
is in Debug state then a 64-bit atomic read returns bits[3 1:0] == OxFFFFFFFF and bits[63:32] 
UNKNOWN. 


Attributes 
PMPCSR is a 64-bit register. 


Field descriptions 


The PMPCSR bit assignments are: 


63 62 61 60 56 55 32 31 0 


RESO PC Sample[55:32] 


NS, bit [63] 


PC Sample[31:0] 





Non-secure state sample. Indicates the Security state that is associated with the most recent 
PMPCSR sample or, when it is read as a single atomic 64-bit read, the current PMPCSR sample. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
EL, bits [62:61] 


Exception level status sample. Indicates the Exception level that is associated with the most recent 
PMPCSR sample or, when it is read as a single atomic 64-bit read, the current PMPCSR sample. 


0b00 Sample is from ELO. 
0b01 Sample is from EL1. 
0b10 Sample is from EL2. 
0b11 Sample is from EL3. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [60:56] 


Reserved, RESO. 
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PC Sample[55:32], bits [55:32] 


Bits[55:32] of the sampled instruction address value. The translation regime that PMPCSR samples 
can be determined from PMPCSR. {NS,EL}. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 
PC Sample[31:0], bits [31:0] 


Bits[31:0] of the sampled instruction address value. The translation regime that PMPCSR samples 
can be determined from PMPCSR. {NS,EL}. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


For a read of PMPCSR[31:0] from the memory-mapped interface, if PMLSR.SLK == 1, meaning the OPTIONAL 
Software Lock is locked, then the access has no side-effects. 


In any other cases, a read of PMPCSR[31:0] has the side-effect of indirectly writing to PMPCSR[63:32], 
PMCIDISR, PMCID2SR, and PMVIDSR: 


7 If the PE is in Debug state, or PC Sample-based profiling is prohibited, PMPCSR[3 1:0] reads as OxFFFFFFFF, 
and PMPCSR[63:32], PMCIDISR, PMCID2SR, and PMVIDSR become UNKNOWN. 


. If the PE is in Reset state, the sampled value is UNKNOWN and PMPCSR[63:32], PMCIDISR, PMCID2SR, 
and PMVIDSR become UNKNOWN. 


. If no instruction has been sampled since the PE left Reset state, Debug state, or a state where PC 
Sample-based Profiling is prohibited, the sampled value is 0xFFFFFFFF, and PMPCSR.[63:32], PMCIDISR, 
PMCID2SR, and PMVIDSR become UNKNOWN. Any subsequent read will return an instruction address 
value. 


Accessing the PMPCSR: 


IMPLEMENTATION DEFINED extensions to external debug might make the value of this register UNKNOWN, see 
Permitted behavior that might make the PC Sample-based profiling registers UNKNOWN on page H7-6824 


PMPCSRJ3 1:0] can be accessed through the external debug interface: 





Component Offset Instance Range 


PMU 0x200 PMPCSR 31:0 





This interface is accessible as follows: 
. When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to PMPCSR[31:0] are RO. 
° Otherwise accesses to PMPCSR[31:0] generate an error response. 


PMPCSRJ3 1:0] can be accessed through the external debug interface: 





Component Offset Instance Range 


PMU 0x220 PMPCSR 31:0 





This interface is accessible as follows: 
. When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to PMPCSR[31:0] are RO. 


° Otherwise accesses to PMPCSR[31:0] generate an error response. 
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PMPCSR[63:32] can be accessed through the external debug interface: 





Component Offset Instance Range 


PMU 0x204 PMPCSR 63:32 





This interface is accessible as follows: 
. When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to PMPCSR[63:32] are RO. 
° Otherwise accesses to PMPCSR[63:32] generate an error response. 


PMPCSR[63:32] can be accessed through the external debug interface: 





Component Offset Instance Range 


PMU 0x224 PMPCSR 63:32 





This interface is accessible as follows: 
. When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to PMPCSR[63:32] are RO. 


. Otherwise accesses to PMPCSR[63:32] generate an error response. 
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15.3.34 PMPIDRO, Performance Monitors Peripheral Identification Register 0 
The PMPIDRO characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMPIDRO is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
PMPIDRO is a 32-bit register. 


Field descriptions 


The PMPIDRO bit assignments are: 


31 8 7 0 
RESO PART_0 
Bits [31:8] 


Reserved, RESO. 


PART, bits [7:0] 


Part number, least significant byte. 


Accessing the PMPIDRO: 


PMPIDRO can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFEQ PMPIDRO 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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15.3.35 PMPIDR1, Performance Monitors Peripheral Identification Register 1 
The PMPIDRI characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMPIDR1 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
PMPIDR1 is a 32-bit register. 


Field descriptions 


The PMPIDR1 bit assignments are: 


31 8 7 43 0 
RESO DES_0 | PART1 
Bits [31:8] 


Reserved, RESO. 


DES _0, bits [7:4] 
Designer, least significant nibble of JEP106 ID code. For Arm Limited, this field is 0b1011. 


PART 1, bits [3:0] 


Part number, most significant nibble. 


Accessing the PMPIDR1: 


PMPIDRI can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFE4 PMPIDRI1 
This interface is accessible as follows: 
° When ARMxv8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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15.3.36 


15-7106 


PMPIDR2, Performance Monitors Peripheral Identification Register 2 


The PMPIDR2 characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMPIDR2 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
PMPIDR2 is a 32-bit register. 


Field descriptions 


The PMPIDR2 bit assignments are: 


31 8 7 432 0 
RESO REVISION 7 DES 1 
EE 
Bits [31:8] 


Reserved, RESO. 


REVISION, bits [7:4] 


Part major revision. Parts can also use this field to extend Part number to 16-bits. 


JEDEC, bit [3] 
RAO. Indicates a JEP 106 identity code is used. 


DES _1, bits [2:0] 
Designer, most significant bits of JEP106 ID code. For Arm Limited, this field is 0b011. 


Accessing the PMPIDR2: 


PMPIDR2 can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFE8 PMPIDR2 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
° Otherwise accesses to this register generate an error response. 
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15.3.37 PMPIDR3, Performance Monitors Peripheral Identification Register 3 
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The PMPIDR3 characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMPIDR3 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
PMPIDR3 is a 32-bit register. 


Field descriptions 


The PMPIDR3 bit assignments are: 


31 8 7 4 3 0 
RESO REVAND | CMOD 
Bits [31:8] 


Reserved, RESO. 


REVAND, bits [7:4] 
Part minor revision. Parts using PMPIDR2.REVISION as an extension to the Part number must use 
this field as a major revision number. 


CMOD, bits [3:0] 
Customer modified. Indicates someone other than the Designer has modified the component. 


Accessing the PMPIDR3: 


PMPIDR3 can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFEC PMPIDR3 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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15.3.38 


15-7108 


PMPIDR4, Performance Monitors Peripheral Identification Register 4 


The PMPIDR4 characteristics are: 


Purpose 
Provides information to identify a Performance Monitor component. 


For more information see About the Peripheral identification scheme on page K2-7661. 


Configurations 
It is IMPLEMENTATION DEFINED whether PMPIDR4 is implemented in the Core power domain or in 
the Debug power domain. 


Implementation of this register is OPTIONAL. 


If ARMv8.3-DoPD is implemented, this register is in the Core power domain. If ARMv8.3-DoPD 
is not implemented, this register is in the Debug power domain. 


This register is required for CoreSight compliance. 


Attributes 
PMPIDR4 is a 32-bit register. 


Field descriptions 


The PMPIDR4 bit assignments are: 


31 8 7 43 0 
RESO SIZE DES 2 
Bits [31:8] 


Reserved, RESO. 


SIZE, bits [7:4] 
Size of the component. RAZ. Log» of the number of 4KB pages from the start of the component to 
the end of the component ID registers. 


DES 2, bits [3:0] 
Designer, JEP106 continuation code, least significant nibble. For Arm Limited, this field is 0b0100. 


Accessing the PMPIDR4: 


PMPIDR4 can be accessed through the external debug interface: 





Component Offset Instance 





PMU OxFDO PMPIDR4 
This interface is accessible as follows: 
° When ARMV8.3-DoPD is not implemented or IsCorePowered() accesses to this register are RO. 
. Otherwise accesses to this register generate an error response. 
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15.3.39 PMSWINC_ELO, Performance Monitors Software Increment register 


The PMSWINC_ELO characteristics are: 


Purpose 


Increments a counter that is configured to count the Software increment event, event 0x00. For more 
information, see SW_INCR. 


Configurations 


External register PMSWINC_ELO[31:0] is architecturally mapped to AArch64 System register 
PMSWINC_ELO[31:0]. 


External register PMSWINC_ELO[31:0] is architecturally mapped to AArch32 System register 
PMSWINC{3 1:0]. 


PMSWINC ELO is in the Core power domain. 
Implementation of this register is OPTIONAL. 
If this register is implemented, use of it is deprecated. 


If 1 is written to bit [n] from the external debug interface, it is CONSTRAINED UNPREDICTABLE 
whether or not a SW_INCR event is created for counter n. This is consistent with not implementing 
the register in the external debug interface. 


Attributes 
PMSWINC ELO is a 32-bit register. 


Field descriptions 


The PMSWINC_ELO bit assignments are: 


31 30 0 


ý P<n>, bit [n] 


RESO — | 
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Bit [31] 
Reserved, RESO. 

P<n>, bit [n], for n = 0 to 30 
Event counter software increment bit for PMEVCNTR<n>_EL0. 
If PMCFGR.N is less than 31, bits [30:PMCFGR.N] are WI. 


Oba No action. The write to this bit is ignored. 
Qb1 It is CONSTRAINED UNPREDICTABLE whether a SW_INCR event is generated for event 
counter n. 


Accessing the PMSWINC_ELO: 


Note 


SoftwareLockStatus() depends on the type of access attempted and AllowExternalPMUAccess() has a new 
definition from Armv8.4. Refer to the Pseudocode definitions for more information. 
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PMSWINC ELO can be accessed through the external debug interface: 





Component Offset Instance 


PMU OxCAd PMSWINC_ELO 





This interface is accessible as follows: 


. When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
SoftwareLockStatus() accesses to this register are WI. 


° When IsCorePowered(), !DoubleLockStatus(), !OSLockStatus(), AllowExternalPMUAccess() and 
!SoftwareLockStatus() accesses to this register are WO. 


. Otherwise accesses to this register generate an error response. 
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15.3.40 PMVIDSR, VMID Sample Register 
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The PMVIDSR characteristics are: 


Purpose 
Contains the sampled VMID value that is captured on reading PMPCSR[31:0]. 


Configurations 
PMVIDSR is in the Core power domain. 


Fields in this register reset to architecturally UNKNOWN values. These apply only on a Cold reset. 
The register is not affected by a Warm reset and is not affected by an External debug reset. 

This register is present only when ARMv8.2-PCSample is implemented. Otherwise, direct accesses 
to PMVIDSR are RESO. 





Note 


Before Armv8.2, the PC Sample-based Profiling Extension can be implemented in the external 
debug register space, as indicated by the value of EDDEVID.PCSample. 





If EL2 is not implemented, this register is RESO. 


Attributes 
PMVIDSR is a 32-bit register. 


Field descriptions 


The PMVIDSR bit assignments are: 


Bits [31:16] 


Reserved, RESO. 


VMID, bits [15:0] 
VMID sample. The VMID associated with the most recent PMPCSR sample. 
° If EL2 is implemented and is using AArch64, then the VMID is held in VTTBR_EL2.VMID. 
à If EL2 is implemented and is using AArch32, then the VMID is held in VTTBR.VMID. 
s This field is set to an UNKNOWN value if any of the following apply: 
—  PMPCSR.NS == 0. 
—  PMPCSR.EL == 0b10. 


—  PMPCSR.NS == 1, PMPCSR.EL == 0b00, EL2 is using AArch64, HCR_EL2.E2H == 
1, and HCR_EL2.TGE == 1. 


- If EL2 is not implemented, then this field is RESO. 
. If 16-bit VMIDs are not supported, PMVIDSR.VMID[15:8] is RESO. 


è If 16-bit VMIDs are supported, but VTTBRx.VMID[15:8] are not used, 
PMVIDSR.VMID[15:8] is set to RESO. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7111 
Non-Confidential 


External System Control Register Descriptions 
15.3 Performance Monitors external register descriptions 


Accessing the PMVIDSR: 


IMPLEMENTATION DEFINED extensions to external debug might make the value of this register UNKNOWN, see 
Permitted behavior that might make the PC Sample-based profiling registers UNKNOWN on page H7-6824 


PMVIDSR can be accessed through the external debug interface: 





Component Offset Instance 


PMU Qx20C PMVIDSR 





This interface is accessible as follows: 
. When IsCorePowered(), !DoubleLockStatus() and !OSLockStatus() accesses to this register are RO. 


° Otherwise accesses to this register generate an error response. 
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External Activity Monitors Extension registers summary 


The memory-mapped interface to the Activity Monitors Extension registers provides read-only access to: 

s Read-only copies of the Activity Monitors Extension System registers, with the exception of AMUSERENR. 
s An implementation identification register, AMIIDR. 

è If they are implemented, the OPTIONAL Activity Monitors CoreSight and ID registers. 


The locations of the registers are defined as offsets from a base address. The base address of the memory-mapped 
view must be aligned to a 4KB boundary, but is otherwise IMPLEMENTATION DEFINED. Activity Monitors external 
register views defines this memory map. 


Activity Monitors external register views 


Table 15-2 shows the external view of the Activity Monitors registers. All implemented registers are RO. Offsets 
within the 4KB region not defined in this table are RAZ/WI. 


Each entry in the Name column links to the register description in Activity Monitors external register descriptions 
on page I5-7115, and: 


5 If the System register? on page 15-7036 column of the table shows that the register is a System register, the 
memory-mapped interface provides a view of the System register described in: 


— Activity Monitors registers on page D13-3584, for the AArch64 System register. 
— Activity Monitors registers on page G8-6542, for the AArch32 System register. 


s Otherwise, the register is accessible only using the external memory-mapped interface. 


Table 15-2 Activity Monitors external register views 
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Name Description System register? Offset 
AMEVCNTRO<n>[31:0] Activity Monitor Event Counter registers 0 Yes 0x000+8n 
AMEVCNTRO<n>[63:32] 0x004+8n 
AMEVCNTRI1<n>[3 1:0] Activity Monitor Event Counter registers 1 Yes 0x100+8n 
AMEVCNTR1<n>[63:32] @x104+8n 
AMEVTYPERO<n> Activity Monitor Event Type registers 0 Yes 0x400+4n 
AMEVTYPERI<n> Activity Monitor Event Type registers 1 Yes 0x480+4n 
AMCNTENSETO Activity Monitors Counter Enable Set register 0 Yes OxC00 
AMCNTENSET1 Activity Monitors Counter Enable Set register 1 Yes QxC04 
AMCNTENCLRO Activity Monitors Counter Enable Clear register0 Yes QxC20 
AMCNTENCLRI1 Activity Monitors Counter Enable Clear register 1 Yes QxC24 
AMCGCR Activity Monitors Counter Group Yes OxCE@ 
ConfigurationRegister 
AMCFGR Activity Monitors Configuration Register Yes OxE0O 
AMCR Activity Monitors Control Register Yes 0xE04 
AMIIDR Activity Monitors Implementation No 0xE08 
IdentificationRegister 
AMDEVAFF0@ Device Affinity registers No OxFA8 
AMDEVAFF 14 No @xFAC 
AMDEVARCH24 Device Architecture register No QxFBC 
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Table 15-2 Activity Monitors external register views (continued) 





















































Name Description System register? Offset 
AMDEVTY PE Device Type register No OxFCC 
AMPIDR44 Peripheral ID registers No OxFDO 
AMPIDRO@ No OxFEQ 
AMPIDR1@ No OxFE4 
AMPIDR2a No OxFE8 
AMPIDR32 No @xFEC 
AMCIDRO@ Component ID registers No OxFFO 
AMCIDR1@ No OxFF4 
AMCIDR24 No OxFF8 
AMCIDR34 No OxFFC 











a. CoreSight interface registers, see Management registers and CoreSight compliance on page K2-7655. 
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15.5 Activity Monitors external register descriptions 


This section lists the external Activity Monitors registers. 
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15.5.1 


15-7116 


AMCFGR, Activity Monitors Configuration Register 


The AMCFGR characteristics are: 


Purpose 


Global configuration register for the activity monitors. 


Provides information on supported features, the number of counter groups implemented, the total 
number of activity monitor event counters implemented, and the size of the counters. AMCFGR is 
applicable to both the architected and the auxiliary counter groups. 


Configurations 


Attributes 


External register AMCFGR[31:0] is architecturally mapped to AArch64 System register 
AMCFGR_ ELO[31:0]. 


External register AMCFGR[31:0] is architecturally mapped to AArch32 System register 
AMCFGR{31:0]. 


The power domain of AMCFGR is IMPLEMENTATION DEFINED. 


This register is present only when AMUV1 is implemented. Otherwise, direct accesses to AMCFGR 
are RESO. 


AMCFGR is a 32-bit register. 


Field descriptions 


The AMCFGR bit assignments are: 


31 28 27 


25 24 23 14 13 8 7 0 


HDBG es 


NCG, bits [31:28] 


Bits [27:25] 


Defines the number of counter groups. 
The number of implemented counter groups is defined as [AMCFGR.NCG + 1]. 


If the number of implemented auxiliary activity monitor event counters is zero, this field has a value 
of @b0000. Otherwise, this field has a value of @b0001. 


Reserved, RESO. 


HDBG, bit [24] 


Bits [23:14] 


Halt-on-debug supported. 

From Armvé8, this feature must be supported, and so this bit is 0b1. 
Qbe AMCR.HDBG is RESO. 

Qb1 AMCR.HDBG is read/write. 


Reserved, RAZ. 


SIZE, bits [13:8] 


Defines the size of activity monitor event counters. 
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The size of the activity monitor event counters implemented by the Activity Monitors Extension is 
defined as [AMCFGR.SIZE + 1]. 


From Armv8, the counters are 64-bit, and so this field is @b111111. 


Note 


Software also uses this field to determine the spacing of counters in the memory-map. From Armv8, 
the counters are at doubleword-aligned addresses. 








N, bits [7:0] 
Defines the number of activity monitor event counters. 


The total number of counters implemented in all groups by the Activity Monitors Extension is 
defined as [AMCFGR.N + 1]. 


Accessing the AMCFGR: 


AMCFGR can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU @xE00 AMCFGR 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.2 AMCGCR, Activity Monitors Counter Group Configuration Register 
The AMCGCR characteristics are: 


Purpose 
Provides information on the number of activity monitor event counters implemented within each 
counter group. 


Configurations 


External register AMCGCR[31:0] is architecturally mapped to AArch64 System register 
AMCGCR_ELO[31:0]. 


External register AMCGCR[31:0] is architecturally mapped to AArch32 System register 
AMCGCRJB 1:0]. 


The power domain of AMCGCR is IMPLEMENTATION DEFINED. 


This register is present only when AMUV!1 is implemented. Otherwise, direct accesses to AMCGCR 
are RESO. 


Attributes 
AMCGCR is a 32-bit register. 


Field descriptions 


The AMCGCR bit assignments are: 


Bits [31:16] 
Reserved, RESO. 


CGINC, bits [15:8] 
Counter Group 1 Number of Counters. The number of counters in the auxiliary counter group. 


In AMUv1, the permitted range of values is 0 to 16. 


CGONC, bits [7:0] 
Counter Group 0 Number of Counters. The number of counters in the architected counter group. 


In AMUVI, the value of this field is 4. 


Accessing the AMCGCR: 


AMCGCR can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU OxCEQ AMCGCR 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.3 AMCIDRO, Activity Monitors Component Identification Register 0 
The AMCIDRO characteristics are: 


Purpose 


Provides information to identify an activity monitors component. 


For more information, see About the Component Identification scheme on page K2-7663 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
The power domain of AMCIDRO is IMPLEMENTATION DEFINED. 


Implementation of this register is OPTIONAL. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 


AMCIDRO are RESO. 


Attributes 
AMCIDRO is a 32-bit register. 


Field descriptions 


The AMCIDRO bit assignments are: 


31 8 7 


0 


RESO PRMBL_O 


Bits [31:8] 
Reserved, RESO. 


PRMBL 0, bits [7:0] 


Preamble. Must read as 0x0D. 


Accessing the AMCIDRO: 


AMCIDRO can be accessed through its memory-mapped interface: 





Component 


Offset Instance 


OxFFO AMCIDRO 





AMU 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.4 AMCIDR1, Activity Monitors Component Identification Register 1 
The AMCIDRI characteristics are: 


Purpose 
Provides information to identify an activity monitors component. 


For more information, see About the Component Identification scheme on page K2-7663 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
The power domain of AMCIDR1 is IMPLEMENTATION DEFINED. 


Implementation of this register is OPTIONAL. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCIDR1 are RESO. 


Attributes 
AMCIDR1 is a 32-bit register. 


Field descriptions 


The AMCIDR!1 bit assignments are: 


31 8 7 43 0 
RESO CLASS | PRMBL_1 
Bits [31:8] 


Reserved, RESO. 


CLASS, bits [7:4] 


Component class. Reads as 0x9, CoreSight component. 
PRMBL 1, bits [3:0] 


Preamble. Reads as 0x0. 


Accessing the AMCIDR1: 


AMCIDRI can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU OxFF4 AMCIDRI1 
This interface is accessible as follows: 
$ Accesses to this register are RO. 
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15.5.5 AMCIDR2, Activity Monitors Component Identification Register 2 
The AMCIDR2 characteristics are: 


Purpose 


Provides information to identify an activity monitors component. 


For more information, see About the Component Identification scheme on page K2-7663 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
The power domain of AMCIDR2 is IMPLEMENTATION DEFINED. 


Implementation of this register is OPTIONAL. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 


AMCIDR2 are RESO. 


Attributes 
AMCIDR2 is a 32-bit register. 


Field descriptions 


The AMCIDR2 bit assignments are: 


31 8 7 


0 


RESO PRMBL_2 


Bits [31:8] 
Reserved, RESO. 


PRMBL 2, bits [7:0] 
Preamble. Reads as 0x05. 


Accessing the AMCIDR2: 


AMCIDR2 can be accessed through its memory-mapped interface: 





Component 


Offset Instance 


OxFF8 AMCIDR2 





AMU 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.6 AMCIDR3, Activity Monitors Component Identification Register 3 
The AMCIDR3 characteristics are: 


Purpose 
Provides information to identify an activity monitors component. 


For more information, see About the Component Identification scheme on page K2-7663 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
The power domain of AMCIDR3 is IMPLEMENTATION DEFINED. 


Implementation of this register is OPTIONAL. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCIDR3 are RESO. 


Attributes 
AMCIDR3 is a 32-bit register. 


Field descriptions 


The AMCIDR3 bit assignments are: 


31 8 7 0 
RESO PRMBL_3 
Bits [31:8] 


Reserved, RESO. 


PRMBL 3, bits [7:0] 
Preamble. Reads as 0xB1. 


Accessing the AMCIDR3: 


AMCIDR3 can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU OxFFC AMCIDR3 
This interface is accessible as follows: 
° Accesses to this register are RO. 
15-7122 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential IDO070919 


External System Control Register Descriptions 
15.5 Activity Monitors external register descriptions 


15.5.7 AMCNTENCLRO, Activity Monitors Count Enable Clear Register 0 
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The AMCNTENCLRO characteristics are: 


Purpose 
Disable control bits for the architected s event counters, AMEVCNTRO<n>. 


Configurations 


External register AMCNTENCLROJ[31:0] is architecturally mapped to AArch64 System register 
AMCNTENCLRO_ELO[31:0]. 


External register AMCNTENCLROJ[31:0] is architecturally mapped to AArch32 System register 
AMCNTENCLRO{[31:0]. 


The power domain of AMCNTENCLRO is IMPLEMENTATION DEFINED. Some or all RW fields of 
this register have defined reset values. These apply only on a reset of the reset domain in which the 
register is implemented. The register is not affected by a reset of any other reset domain. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENCLRO are RESO. 


Attributes 
AMCNTENCLRO is a 32-bit register. 


Field descriptions 


The AMCNTENCLRO bit assignments are: 


31 0 


P<n>, bit [n] 


P<n>, bit [n], for n = 0 to 31 
Activity monitor event counter disable bit for AMEVCNTRO<n>. 
Bits [31:N] are RAZ/WI. N is the value in AMCGCR.CGONC. 


Possible values of each bit are: 


Obd When read, means that AMEVCNTRO<n> is disabled. When written, has no effect. 
Qb1 When read, means that AMEVCNTRO<n> is enabled. When written, disables 
AMEVCNTRO<n>. 


On a Cold reset, this field resets to 0. 


Accessing the AMCNTENCLRO: 


AMCNTENCLRO can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU QxC20 AMCNTENSETO 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.8 AMCNTENCLR1, Activity Monitors Count Enable Clear Register 1 
The AMCNTENCLRI characteristics are: 


Purpose 


Disable control bits for the auxiliary activity monitors event counters, AMEVCNTRI<n>. 


Configurations 


External register AMCNTENCLR1[31:0] is architecturally mapped to AArch64 System register 
AMCNTENCLRI1_ ELO[31:0]. 


External register AMCNTENCLR1[31:0] is architecturally mapped to AArch32 System register 
AMCNTENCLR1[31:0]. 


The power domain of AMCNTENCLR1 is IMPLEMENTATION DEFINED. Some or all RW fields of 
this register have defined reset values. These apply only on a reset of the reset domain in which the 
register is implemented. The register is not affected by a reset of any other reset domain. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENCLRI are RESO. 


Attributes 
AMCNTENCLR1 is a 32-bit register. 


Field descriptions 


The AMCNTENCLR1 bit assignments are: 


31 0 


P<n>, bit [n] 


P<n>, bit [n], for n = 0 to 31 
Activity monitor event counter disable bit for AMEVCNTRI1<n>. 
Bits [31:N] are RAZ/WI. N is the value in AMCGCR.CGINC. 


Possible values of each bit are: 


Obd When read, means that AMEVCNTR1<n> is disabled. When written, has no effect. 
Qb1 When read, means that AMEVCNTRI<n> is enabled. When written, disables 
AMEVCNTRI<n>. 


On a Cold reset, this field resets to 0. 


Accessing the AMCNTENCLR1: 


If the number of auxiliary activity monitor event counters implemented is zero, reads and writes of 
AMCNTENCLR1I are CONSTRAINED UNPREDICTABLE, and accesses to the register behave as RAZ/WI. 





Note 
The number of auxiliary activity monitor event counters implemented is zero exactly when AMCFGR.NCG == 
0b2000. 





AMCNTENCLR!I can be accessed through its memory-mapped interface: 


Component Offset Instance 


AMU QxC24 AMCNTENCLRI1 
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This interface is accessible as follows: 


° Accesses to this register are RO. 
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15.5.9 AMCNTENSETDO, Activity Monitors Count Enable Set Register 0 
The AMCNTENSETO0 characteristics are: 


Purpose 
Enable control bits for the architected activity monitors event counters, AMEVCNTRO<n>. 


Configurations 


External register AMCNTENSETO0J[3 1:0] is architecturally mapped to AArch64 System register 
AMCNTENSETO_ELO[31:0]. 


External register AMCNTENSETO0J[3 1:0] is architecturally mapped to AArch32 System register 
AMCNTENSETO[3 1:0]. 


The power domain of AMCNTENSET0 is IMPLEMENTATION DEFINED. Some or all RW fields of this 
register have defined reset values. These apply only on a reset of the reset domain in which the 
register is implemented. The register is not affected by a reset of any other reset domain. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENSETD0 are RESO. 


Attributes 
AMCNTENSETO is a 32-bit register. 


Field descriptions 


The AMCNTENSETO0 bit assignments are: 


31 0 


P<n>, bit [n] 


P<n>, bit [n], for n = 0 to 31 
Activity monitor event counter enable bit for AMEVCNTRO<n>. 
Bits [31:N] are RAZ/WI. N is the value in AMCGCR.CGONC. 


Possible values of each bit are: 


Obd When read, means that AMEVCNTRO<n> is disabled. When written, has no effect. 
Qb1 When read, means that AMEVCNTRO<n> is enabled. When written, enables 
AMEVCNTRO<n>. 


On a Cold reset, this field resets to 0. 


Accessing the AMCNTENSET0: 


AMCNTENSET0 can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU OxC0d AMCNTENSETO 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.10 AMCNTENSET1, Activity Monitors Count Enable Set Register 1 


ARM DDI 0487E.a 
ID070919 


The AMCNTENSET]I characteristics are: 


Purpose 
Enable control bits for the auxiliary activity monitors event counters, AMEVCNTRI1<n>. 


Configurations 


External register AMCNTENSET1[31:0] is architecturally mapped to AArch64 System register 
AMCNTENSETI ELO[31:0]. 


External register AMCNTENSET1[31:0] is architecturally mapped to AArch32 System register 
AMCNTENSET1[31:0]. 


The power domain of AMCNTENSET1 is IMPLEMENTATION DEFINED. Some or all RW fields of this 
register have defined reset values. These apply only on a reset of the reset domain in which the 
register is implemented. The register is not affected by a reset of any other reset domain. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMCNTENSET]1 are RESO. 


Attributes 
AMCNTENSET1 is a 32-bit register. 


Field descriptions 


The AMCNTENSET1 bit assignments are: 


31 0 


P<n>, bit [n] 


P<n>, bit [n], for n = 0 to 31 
Activity monitor event counter enable bit for AMEVCNTRI1<n>. 
Bits [31:N] are RAZ/WI. N is the value in AMCGCR.CGINC. 


Possible values of each bit are: 


Obd When read, means that AMEVCNTR1<n> is disabled. When written, has no effect. 
Qb1 When read, means that AMEVCNTRI<n> is enabled. When written, enables 
AMEVCNTRI<n>. 


On a Cold reset, this field resets to 0. 


Accessing the AMCNTENSET1: 


If the number of auxiliary activity monitor event counters implemented is zero, reads and writes of 
AMCNTENSETI are CONSTRAINED UNPREDICTABLE, and accesses to the register behave as RAZ/WI. 


Note 
The number of auxiliary activity monitor counters implemented is zero exactly when AMCFGR.NCG == 0b0000. 








AMCNTENSET1 can be accessed through its memory-mapped interface: 





Component Offset Instance 


AMU QxC04 AMCNTENSET1 
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This interface is accessible as follows: 


° Accesses to this register are RO. 
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AMCR, Activity Monitors Control Register 


The AMCR characteristics are: 


Purpose 
Global control register for the activity monitors implementation. AMCR is applicable to both the 
architected and the auxiliary counter groups. 


Configurations 
External register AMCR[31:0] is architecturally mapped to AArch64 System register 
AMCR_ELO[31:0]. 
External register AMCR[3 1:0] is architecturally mapped to AArch32 System register AMCR[3 1:0]. 
The power domain of AMCR is IMPLEMENTATION DEFINED. 
This register is present only when AMUV1 is implemented. Otherwise, direct accesses to AMCR 
are RESO. 

Attributes 
AMCR is a 32-bit register. 


Field descriptions 


The AMCR bit assignments are: 


Bits [31:11] 
Reserved, RESO. 
HDBG, bit [10] 
This bit controls whether activity monitor counting is halted when the PE is halted in Debug state. 
Qbd Activity monitors do not halt counting when the PE is halted in Debug state. 
Qb1 Activity monitors halt counting when the PE is halted in Debug state. 


Bits [9:0] 


Reserved, RAZ/WI. 


Accessing the AMCR: 


AMCR can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU 0xE04 AMCR 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.12 AMDEVAFFO, Activity Monitors Device Affinity Register 0 
The AMDEVAFFO characteristics are: 


Purpose 
Copy of the low half of the PE MPIDR_ELI register that allows a debugger to determine which PE 
in a multiprocessor system the AMU component relates to. 


Configurations 
The power domain of AMDEVAFFO is IMPLEMENTATION DEFINED. 


Implementation of this register is OPTIONAL. 
This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMDEVAFFO are RESO. 


Attributes 
AMDEVAFFO is a 32-bit register. 


Field descriptions 


The AMDEVAFFO bit assignments are: 


31 0 


MPIDR_EL1 low half 


MPIDR_EL1 low half, bits [31:0] 
MPIDR_EL1 low half. Read-only copy of the low half of MPIDR_EL1, as seen from the highest 
implemented Exception level. 


Accessing the AMDEVAFF0: 


AMDEVAFFO can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU OxFA8 AMDEVAFFO 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.13 AMDEVAFF1, Activity Monitors Device Affinity Register 1 
The AMDEVAFF 1 characteristics are: 


Purpose 
Copy of the high half of the PE MPIDR_ELI register that allows a debugger to determine which PE 
in a multiprocessor system the AMU component relates to. 


Configurations 
The power domain of AMDEVAFF1 is IMPLEMENTATION DEFINED. 


Implementation of this register is OPTIONAL. 
This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMDEVAFF1 are RESO. 


Attributes 
AMDEVAFF'1 is a 32-bit register. 


Field descriptions 


The AMDEVAFF1 bit assignments are: 


31 0 


MPIDR_EL1 high half 


MPIDR_EL1 high half, bits [31:0] 
MPIDR_EL1 high half. Read-only copy of the high half of MPIDR_ELI, as seen from the highest 
implemented Exception level. 


Accessing the AMDEVAFF1: 


AMDEVAFF 1 can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU @xFAC AMDEVAFF1 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.14 AMDEVARCH, Activity Monitors Device Architecture Register 


The AMDEVARCH characteristics are: 


Purpose 
Identifies the programmers’ model architecture of the AMU component. 
Configurations 
The power domain of AMDEVARCH is IMPLEMENTATION DEFINED. 
Implementation of this register is OPTIONAL. 
This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMDEVARCH are RESO. 
Attributes 


AMDEVARCH is a 32-bit register. 


Field descriptions 


The AMDEVARCH bit assignments are: 


31 21 20 19 1615 0 


ARCHITECT i REVISION ARCHID 


PRESENT ba 


ARCHITECT, bits [31:21] 
Defines the architecture of the component. For AMU, this is Arm Limited. 
Bits [31:28] are the JEP106 continuation code, 0x4. 
Bits [27:21] are the JEP106 ID code, 0x3B. 


PRESENT, bit [20] 
When set to 1, indicates that the DEVARCH is present. 


This field is 1 in Armv8. 


REVISION, bits [19:16] 
Defines the architecture revision. For architectures defined by Arm this is the minor revision. 
0b0000 Architecture revision is AMUv1. 


All other values are reserved. 


ARCHID, bits [15:0] 
Defines this part to be an AMU component. For architectures defined by Arm this is further 
subdivided. 


For AMU: 

° Bits [15:12] are the architecture version, 0x0. 

° Bits [11:0] are the architecture part number, 0xA66. 
This corresponds to AMU architecture version AMUv1. 
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Accessing the AMDEVARCH: 


AMDEVARCH can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU QxFBC AMDEVARCH 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.15 AMDEVTYPE, Activity Monitors Device Type Register 


The AMDEVTYPE characteristics are: 


Purpose 
Indicates to a debugger that this component is part of a PE's performance monitor interface. 
Configurations 
The power domain of AMDEVTYPE is IMPLEMENTATION DEFINED. 
Implementation of this register is OPTIONAL. 
This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMDEVTYPE are RESO. 
Attributes 


AMDEVTYPE is a 32-bit register. 


Field descriptions 


The AMDEVTYPE bit assignments are: 


31 8 7 4 3 0 
RESO SUB MAJOR 
Bits [31:8] 


Reserved, RESO. 


SUB, bits [7:4] 
Subtype. Reads as 0x1, to indicate this is a component within a PE. 


MAJOR, bits [3:0] 


Major type. Reads as 0x6, to indicate this is a performance monitor component. 


Accessing the AMDEVTYPE: 


AMDEVTYPE can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU @xFCC AMDEVTYPE 
This interface is accessible as follows: 
° Accesses to this register are RO. 
15-7134 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


External System Control Register Descriptions 
15.5 Activity Monitors external register descriptions 


15.5.16 AMEVCNTRO<n>, Activity Monitors Event Counter Registers 0, n = 0 -15 


63 
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The AMEVCNTRO<n> characteristics are: 


Purpose 


Provides access to the architected activity monitor event counters. 


Configurations 


External register AMEVCNTRO<n>[63:0] is architecturally mapped to AArch64 System register 
AMEVCNTRO<n>_EL0[63:0]. 


External register AMEVCNTRO<n>[63:0] is architecturally mapped to AArch32 System register 
AMEVCNTRO<n>[63:0]. 


The power domain of AMEVCNTRO<n> is IMPLEMENTATION DEFINED. Some or all RW fields of 
this register have defined reset values. These apply only on a reset of the reset domain in which the 
register is implemented. The register is not affected by a reset of any other reset domain. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMEVCNTRO<n> are RESO. 


Attributes 
AMEVCNTRO<n> is a 64-bit register. 


Field descriptions 


The AMEVCNTRO<n> bit assignments are: 


ACNT 


ACNT, bits [63:0] 
Architected activity monitor event counter n. 


Value of architected activity monitor event counter n, where n is the number of this register and is 
a number from 0 to 15. 


If the counter is enabled, writes to this register have UNPREDICTABLE results. 
On a Cold reset, this field resets to 0. 


Accessing the AMEVCNTRO<n>: 


If <n> is greater than or equal to the number of architected activity monitor event counters, reads and writes of 
AMEVCNTRO<n> are CONSTRAINED UNPREDICTABLE, and accesses to the register behave as RAZ/WI. 





Note 
AMCGCR.CGONC identifies the number of architected activity monitor event counters. 





AMEVCNTRO<n>/[31:0] can be accessed through its memory-mapped interface: 





Component Offset Instance Range 


AMU 0x000 +8n AMEVCNTRO<n> 31:0 





This interface is accessible as follows: 


7 Accesses to AMEVCNTROK<n>[31:0] are RO. 
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AMEVCNTRO<n>[63:32] can be accessed through its memory-mapped interface: 





Component Offset Instance Range 


AMU 0x004+8n AMEVCNTRO<n> 63:32 





This interface is accessible as follows: 


° Accesses to AMEVCNTRO<n>[63:32] are RO. 
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15.5.17 AMEVCNTR1<n>, Activity Monitors Event Counter Registers 1,n = 0-15 
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The AMEVCNTRI1<n> characteristics are: 


Purpose 


Provides access to the auxiliary activity monitor event counters. 


Configurations 


External register AMEVCNTR1<n>[63:0] is architecturally mapped to AArch64 System register 
AMEVCNTRI1<n>_EL0[63:0]. 


External register AMEVCNTR1<n>[63:0] is architecturally mapped to AArch32 System register 
AMEVCNTRI1<n>[63:0]. 


The power domain of AMEVCNTRI1<n> is IMPLEMENTATION DEFINED. Some or all RW fields of 
this register have defined reset values. These apply only on a reset of the reset domain in which the 
register is implemented. The register is not affected by a reset of any other reset domain. 


This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMEVCNTRI<n> are RESO. 


Attributes 
AMEVCNTRI<n> is a 64-bit register. 


Field descriptions 


The AMEVCNTRI1<n> bit assignments are: 


ACNT 


ACNT, bits [63:0] 
Auxiliary activity monitor event counter n. 


Value of auxiliary activity monitor event counter n, where n is the number of this register and is a 
number from 0 to 15. 


If the counter is enabled, writes to this register have UNPREDICTABLE results. 
On a Cold reset, this field resets to 0. 


Accessing the AMEVCNTR1<n>: 


If <n> is greater than or equal to the number of auxiliary activity monitor event counters, reads and writes of 
AMEVCNTR1<n> are CONSTRAINED UNPREDICTABLE, and accesses to the register behave as RAZ/WI. 





Note 
AMCGCR.CGINC identifies the number of auxiliary activity monitor event counters. 





AMEVCNTR1<n>[31:0] can be accessed through its memory-mapped interface: 





Component Offset Instance Range 


AMU 0x100 +8n AMEVCNTRI<n> 31:0 





This interface is accessible as follows: 


7 Accesses to AMEVCNTR1<n>[31:0] are RO. 
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AMEVCNTR1<n>[63:32] can be accessed through its memory-mapped interface: 





Component Offset Instance Range 


AMU 0x104+8n AMEVCNTRI<n> 63:32 





This interface is accessible as follows: 


° Accesses to AMEVCNTR1<n>[63:32] are RO. 
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15.5.18 AMEVTYPERDO<n>, Activity Monitors Event Type Registers 0, n = 0 - 15 
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The AMEVTYPERO<n> characteristics are: 


Purpose 
Provides information on the events that an architected activity monitor event counter 
AMEVCNTRO<n> counts. 

Configurations 
External register AMEVTYPERO<n>[3 1:0] is architecturally mapped to AArch64 System register 
AMEVTYPERO<n>_ELO[31:0]. 
External register AMEVTYPERO<n>[3 1:0] is architecturally mapped to AArch32 System register 
AMEVTYPERO<n>[3 1:0]. 
The power domain of AMEVTYPERO<n> is IMPLEMENTATION DEFINED. 
This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMEVTYPERO<n> are RESO. 

Attributes 


AMEVTYPERO<n> is a 32-bit register. 


Field descriptions 


The AMEVTYPERO<n> bit assignments are: 


31 25 24 1615 0 


Bits [31:25] 


Reserved, RAZ. 


Bits [24:16] 


Reserved, RESO. 


evtCount, bits [15:0] 


Event to count. The event number of the event that is counted by the architected activity monitor 
event counter AMEVCNTRO<n>. The value of this field is architecturally mandated for each 
architected counter. 


The following table shows the mapping between required event numbers and the corresponding 
counters: 


0x0011 When n == 0 Processor frequency cycles 
0x4004 When n == 1 Constant frequency cycles 
0x0008 When n == 2 Instructions retired 

0x4005 When n == 3 Memory stall cycles 


Accessing the AMEVTYPERO<n>: 


If <n> is greater than or equal to the number of architected activity monitor event counters, reads and writes of 
AMEVTYPERO<n> are CONSTRAINED UNPREDICTABLE, and accesses to the register behave as RAZ/WI. 


Note 
AMCGCR.CGONC identifies the number of architected activity monitor event counters. 
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AMEVTYPERO<n> can be accessed through its memory-mapped interface: 








Component Offset Instance 
AMU 0x400 +4n AMEVTYPERO<n> 
This interface is accessible as follows: 
è Accesses to this register are RO. 
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15.5.19 AMEVTYPER1<n>, Activity Monitors Event Type Registers 1, n = 0 - 15 
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The AMEVTYPER1<n> characteristics are: 


Purpose 
Provides information on the events that an auxiliary activity monitor event counter 
AMEVCNTRI<n> counts. 

Configurations 


External register AMEVTYPER1<n>[3 1:0] is architecturally mapped to AArch64 System register 
AMEVTYPERI<n>_ELO[31:0]. 


External register AMEVTYPER1<n>[3 1:0] is architecturally mapped to AArch32 System register 
AMEVTYPER1<n>[31:0]. 


The power domain of AMEVTYPER1<n> is IMPLEMENTATION DEFINED. 
This register is present only when AMUv1 is implemented. Otherwise, direct accesses to 
AMEVTYPER 1<n> are RESO. 
Attributes 
AMEVTYPER1<n> is a 32-bit register. 


Field descriptions 


The AMEVTYPER 1<n> bit assignments are: 


31 25 24 1615 0 


Bits [31:25] 
Reserved, RAZ. 


Bits [24:16] 
Reserved, RESO. 


evtCount, bits [15:0] 


Event to count. The event number of the event that is counted by the auxiliary activity monitor event 
counter AMEVCNTRI<n>. 


It is IMPLEMENTATION DEFINED what values are supported by each counter. 


If software writes a value to this field which is not supported by the corresponding counter 
AMEVCNTRI<n>, then: 


° It is UNPREDICTABLE which event will be counted. 
. The value read back is UNKNOWN. 
Note 





The event counted by AMEVCNTR1<n> might be fixed at implementation. In this case, the field 
is read-only and writes are UNDEFINED. 





If the corresponding counter AMEVCNTR1<n> is enabled, writes to this register have 
UNPREDICTABLE results. 


Accessing the AMEVTYPER1<n>: 


If <n> is greater than or equal to the number of auxiliary activity monitor event counters, reads and writes of 
AMEVTYPER1<n> are CONSTRAINED UNPREDICTABLE, and accesses to the register behave as RAZ/WI. 
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15-7142 





Note 
AMCGCR.CGINC identifies the number of auxiliary activity monitor event counters. 





AMEVTYPER1<n> can be accessed through its memory-mapped interface: 





Component Offset 


AMU 0x480 + 4n 


Instance 


AMEVTYPER1<n> 





This interface is accessible as follows: 


° Accesses to this register are RO. 
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AMIIDR, Activity Monitors Implementation Identification Register 


The AMIIDR characteristics are: 


Purpose 
Defines the implementer and revisions of the AMU. 
Configurations 
The power domain of AMIIDR is IMPLEMENTATION DEFINED. 
This register is present only when AMUvV1 is implemented. Otherwise, direct accesses to AMIIDR 
are RESO. 
Attributes 


AMIIDR is a 32-bit register. 


Field descriptions 


The AMIIDR bit assignments are: 


31 


20 19 1615 12 11 0 


ProductID Implementer 


ProductID, bits [31:20] 


This field is an AMU part identifier. 

The value of this field is IMPLEMENTATION DEFINED. 

If AMPIDRO is implemented, AMPIDRO.PART_0 matches bits [27:20] of this field. 
If AMPIDR1 is implemented, AMPIDR1.PART_1 matches bits [31:28] of this field. 


Variant, bits [19:16] 


This field distinguishes product variants or major revisions of the product. 
The value of this field is IMPLEMENTATION DEFINED. 
If AMPIDR2 is implemented, AMPIDR2.REVISION matches AMIIDR. Variant. 


Revision, bits [15:12] 


This field distinguishes minor revisions of the product. 
The value of this field is IMPLEMENTATION DEFINED. 
If AMPIDR3 is implemented, AMPIDR3.REVAND matches AMIIDR.Revision. 


Implementer, bits [11:0] 


ARM DDI 0487E.a 


ID070919 


Contains the JEP106 code of the company that implemented the AMU. 

For an Arm implementation, this field reads as 0x43B. 

Bits [11:8] contain the JEP106 continuation code of the implementer. 

Bit 7 is RESO 

Bits [6:0] contain the JEP106 identity code of the implementer. 

If AMPIDR4 is implemented, AMPIDR4.DES 2 matches bits [11:8] of this field. 
If AMPIDR2 is implemented, AMPIDR2.DES_1 matches bits [6:4] of this field. 
If AMPIDR1 is implemented, AMPIDR1.DES_0 matches bits [3:0] of this field. 
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Accessing the AMIIDR: 


AMIIDR can be accessed through its memory-mapped interface: 





Component 


AMU 


Offset Instance 


OxE08 AMIIDR 





This interface is accessible as follows: 


° Accesses to this register are RO. 
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AMPIDRO, Activity Monitors Peripheral Identification Register 0 


ARM DDI 0487E.a 


The AMPIDRO characteristics are: 


Purpose 
Provides information to identify an activity monitors component. 


For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
The power domain of AMPIDRO is IMPLEMENTATION DEFINED. 
Implementation of this register is OPTIONAL. 


This register is present only when AMUV1 is implemented. Otherwise, direct accesses to AMPIDRO 
are RESO. 


Attributes 
AMPIDR0O is a 32-bit register. 


Field descriptions 


The AMPIDRO bit assignments are: 


31 8 7 0 
RESO PART_0 
Bits [31:8] 


Reserved, RESO. 


PART 0, bits [7:0] 
Part number, least significant byte. 


The value of this field is IMPLEMENTATION DEFINED. 


Accessing the AMPIDRO: 


AMPIDRO can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU OxFEO AMPIDRO 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.22 AMPIDR1, Activity Monitors Peripheral Identification Register 1 
The AMPIDRI characteristics are: 


Purpose 
Provides information to identify an activity monitors component. 


For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
The power domain of AMPIDR1 is IMPLEMENTATION DEFINED. 
Implementation of this register is OPTIONAL. 


This register is present only when AMUvV1 is implemented. Otherwise, direct accesses to AMPIDR1 
are RESO. 


Attributes 
AMPIDR1 is a 32-bit register. 


Field descriptions 


The AMPIDRI bit assignments are: 


31 8 7 43 0 
RESO DES_0 | PART1 
Bits [31:8] 


Reserved, RESO. 


DES_0, bits [7:4] 
Designer, least significant nibble of JEP106 ID code. 
The value of this field is IMPLEMENTATION DEFINED. For Arm Limited, this field is @b1011. 


PART 1, bits [3:0] 
Part number, most significant nibble. 


The value of this field is IMPLEMENTATION DEFINED. 


Accessing the AMPIDR1: 


AMPIDR!1 can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU OxFE4 AMPIDRI 
This interface is accessible as follows: 
° Accesses to this register are RO. 
15-7146 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


External System Control Register Descriptions 
15.5 Activity Monitors external register descriptions 


15.5.23 AMPIDR2, Activity Monitors Peripheral Identification Register 2 


ARM DDI 0487E.a 
ID070919 


The AMPIDR2 characteristics are: 


Purpose 
Provides information to identify an activity monitors component. 


For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
The power domain of AMPIDR2 is IMPLEMENTATION DEFINED. 
Implementation of this register is OPTIONAL. 


This register is present only when AMUvV1 is implemented. Otherwise, direct accesses to AMPIDR2 
are RESO. 


Attributes 
AMPIDR2 is a 32-bit register. 


Field descriptions 


The AMPIDR2? bit assignments are: 


31 8 7 432 0 
RESO REVISION i DES 1 
C 
Bits [31:8] 


Reserved, RESO. 


REVISION, bits [7:4] 
Part major revision. Parts can also use this field to extend Part number to 16-bits. 


The value of this field is IMPLEMENTATION DEFINED. 


JEDEC, bit [3] 
RAO. Indicates a JEP 106 identity code is used. 


DES_1, bits [2:0] 
Designer, most significant bits of JEP 106 ID code. 
The value of this field is IMPLEMENTATION DEFINED. For Arm Limited, this field is @b011. 


Accessing the AMPIDR2: 


AMPIDR2 can be accessed through its memory-mapped interface: 





Component Offset Instance 


AMU OxFE8 AMPIDR2 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.24 AMPIDR3, Activity Monitors Peripheral Identification Register 3 
The AMPIDR3 characteristics are: 


Purpose 
Provides information to identify an activity monitors component. 


For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
The power domain of AMPIDR3 is IMPLEMENTATION DEFINED. 
Implementation of this register is OPTIONAL. 


This register is present only when AMUvV1 is implemented. Otherwise, direct accesses to AMPIDR3 
are RESO. 


Attributes 
AMPIDR3 is a 32-bit register. 


Field descriptions 


The AMPIDR3 bit assignments are: 


31 87 4 3 0 
RESO REVAND | CMOD 
Bits [31:8] 


Reserved, RESO. 


REVAND, bits [7:4] 
Part minor revision. Parts using AMPIDR2.REVISION as an extension to the Part number must use 
this field as a major revision number. 


The value of this field is IMPLEMENTATION DEFINED. 


CMOD, bits [3:0] 
Customer modified. Indicates someone other than the Designer has modified the component. 


The value of this field is IMPLEMENTATION DEFINED. 


Accessing the AMPIDR3: 


AMPIDR3 can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU OxFEC AMPIDR3 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.5.25 AMPIDR4, Activity Monitors Peripheral Identification Register 4 


ARM DDI 0487E.a 
ID070919 


The AMPIDR4 characteristics are: 


Purpose 
Provides information to identify an activity monitors component. 


For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
The power domain of AMPIDR4 is IMPLEMENTATION DEFINED. 
Implementation of this register is OPTIONAL. 


This register is present only when AMUvV1 is implemented. Otherwise, direct accesses to AMPIDR4 
are RESO. 


Attributes 
AMPIDR4 is a 32-bit register. 


Field descriptions 


The AMPIDR4 bit assignments are: 


31 8 7 43 0 
RESO SIZE DES 2 
Bits [31:8] 


Reserved, RESO. 


SIZE, bits [7:4] 
Size of the component. Logz of the number of 4KB pages from the start of the component to the end 
of the component ID registers. 


This field reads as @b0000. 


DES_2, bits [3:0] 
Designer. JEP 106 continuation code, least significant nibble. 


The value of this field is IMPLEMENTATION DEFINED. For Arm Limited, this field is @b0100. 


Accessing the AMPIDR4: 


AMPIDR4 can be accessed through its memory-mapped interface: 





Component Offset Instance 





AMU OxFDO AMPIDR4 
This interface is accessible as follows: 
° Accesses to this register are RO. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7149 


Non-Confidential 


External System Control Register Descriptions 
15.6 Generic Timer memory-mapped registers overview 


15.6 Generic Timer memory-mapped registers overview 


The Generic Timer memory-mapped registers are implemented as multiple register frames, with each register frame 
having its own base address, as follows: 


e A single CNTCTLBase register frame, at base address CNTCTLBase. 
. Between one and seven CNTBaseN register frames, each with its own base address CNTBaseN. 


è For each CNTBaseN register frame, if required, a CNTELOBaseN register frame, at base address 
CNTELOBaseN, that provides an ELO view of the CNTBaseN register frame. 


For more information, see: 
° Memory-mapped timer components on page 12-7020. 


. The CNTBaseN and CNTELOBaseN frames on page 12-7022. This section includes the memory map of the 
CNTBaseN and CNTBaseN register frames. 


$ The CNTCTLBase frame on page 12-7021. This section includes the memory map of the CNTCTLBase 
register frame. 





Note 


Providing a complete set of features in a system level implementation on page K5-7686 gives an implementation 
example for a system level implementation of the Generic Timer. 
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15.7 Generic Timer memory-mapped register descriptions 


This section describes the Generic Timer registers. Generic Timer memory-mapped registers overview on 
page 15-7150 gives an overview of these registers, and includes links to their memory maps. 
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15.7.1 CNTACR<n>, Counter-timer Access Control Registers, n = 0 -7 


The CNTACR<n> characteristics are: 


Purpose 
Provides top-level access controls for the elements of a timer frame. CNTACR<n> provides the 
controls for frame CNTBaseN. 
In addition to the CNTACR<n> control: 
° CNTNSAR controls whether CNTACR<n> is accessible by Non-secure accesses. 
° If frame CNTELOBaseN is implemented, the CNTELOACR in frame CNTBaseN provides 

additional control of accesses to frame CNTELOBaseN. 

Configurations 
The power domain of CNTACR<n> is IMPLEMENTATION DEFINED. 
On a reset of the reset domain in which it is implemented, RW fields in this register reset to 
UNKNOWN values. The register is not affected by a reset of any other reset domain. For more 
information see Power and reset domains for the system level implementation of the Generic Timer 
on page 12-7015. 
Implemented only if the value of CNTTIDR.Frame<n> is 1. 
An implementation of the counters might not provide configurable access to some or all of the 
features. In this case, the associated field in the CNTACR<n> register is: 
° RAZ/WI if access is always denied. 
° RAO/WI if access is always permitted. 

Attributes 


CNTACR<r> is a 32-bit register. 


Field descriptions 


The CNTACR<n> bit assignments are: 





RFRQ 
RVOFF 
RWVT 
RWPT 
Bits [31:6] 
Reserved, RESO. 
RWPT, bit [5] 
Read/write access to the EL1 Physical Timer registers CNTP_CVAL, CNTP_TVAL, and 
CNTP_CTL, in frame <n>. The possible values of this bit are: 
Qbd No access to the EL1 Physical Timer registers in frame <n>. The registers are RESO. 
Qb1 Read/write access to the EL1 Physical Timer registers in frame <n>. 
This field resets to an architecturally UNKNOWN value. 
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RWVT, bit [4] 


Read/write access to the Virtual Timer register CNTV_CVAL, CNTV_TVAL, and CNTV_CTL, in 
frame <n>. The possible values of this bit are: 


Qbd No access to the Virtual Timer registers in frame <n>. The registers are RESO. 
Qb1 Read/write access to the Virtual Timer registers in frame <n>. 
This field resets to an architecturally UNKNOWN value. 
RVOFF, bit [3] 
Read-only access to CNTVOFF, in frame <n>. The possible values of this bit are: 
Qbd No access to CNTVOFF in frame <n>. The register is RESO. 
Qb1 Read-only access to CNTVOFF in frame <n>. 
This field resets to an architecturally UNKNOWN value. 
RFRQ, bit [2] 
Read-only access to CNTFRQ, in frame <n>. The possible values of this bit are: 
Qbd No access to CNTFRQ in frame <n>. The register is RESO. 
Qb1 Read-only access to CNTFRQ in frame <n>. 
This field resets to an architecturally UNKNOWN value. 
RVCT, bit [1] 
Read-only access to CNTVCT, in frame <n>. The possible values of this bit are: 
Qbd No access to CNTVCT in frame <n>. The register is RESO. 
Qb1 Read-only access to CNTVCT in frame <n>. 
This field resets to an architecturally UNKNOWN value. 


RPCT, bit [0] 
Read-only access to CNTPCT, in frame <n>. The possible values of this bit are: 
Qbd No access to CNTPCT in frame <n>. The register is RESO. 
Qb1 Read-only access to CNTPCT in frame <n>. 
This field resets to an architecturally UNKNOWN value. 


Accessing the CNTACR<n>: 

In a system that recognizes two Security states: 

° CNTACR<n> is always accessible by Secure accesses. 

. CNTNSAR.NS<n> determines whether CNTACR<p> is accessible by Non-secure accesses. 


CNTACR<n> can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTCTLBase 0x040+4n CNTACR<n> 
This interface is accessible as follows: 
. Accesses to this register are RW. 
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15.7.2 CNTCR, Counter Control Register 
The CNTCR characteristics are: 


Purpose 
Enables the counter, controls the counter frequency setting, and controls counter behavior during 
debug. 

Configurations 
The power domain of CNTCR is IMPLEMENTATION DEFINED. Some or all RW fields of this register 
have defined reset values. These apply only on a reset of the reset domain in which the register is 
implemented. The register is not affected by a reset of any other reset domain. 

Attributes 


CNTCR is a 32-bit register. 


Field descriptions 


The CNTCR bit assignments are: 


Bits [31:18] 
Reserved, RESO. 


FCREQ, bits [17:8] 
Frequency change request. Indicates the number of the entry in the Frequency modes table to select. 
Selecting an unimplemented entry, or an entry that contains 0, has no effect on the counter. 


The maximum number of entries in the Frequency modes table is IMPLEMENTATION DEFINED up to 
a maximum of 1004 entries, see The Frequency modes table on page 12-7017. An implementation 
is only required to implement an FCREQ field that can hold values from 0 to the highest supported 
Frequency modes table entry. Any unrequired most-significant bits of FCREQ can be implemented 
as RESO. 


This field resets to 0. 
Bits [7:3] 
Reserved, RESO. 


SCEN, bit [2] 
When ARMV8.4-CNTSC is implemented: 


Scale Enable. 

Qbd Scaling is not enabled. The counter value is incremented by 0x1.0000000 for each 
counter tick. 

Qb1 Scaling is enabled. The counter is incremented by CNTSCR.ScaleVal for each counter 
tick. 


The SCEN bit can only be changed when the counter is disabled, when CNTCR.EN == 0. 
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If the value of CNTCR.SCEN changes when CNTCR.EN == 1 then: 
° The counter value becomes UNKNOWN. 
. The counter value remains UNKNOWN on future ticks of the clock. 


When the CNTCV register in the CNTControlBase frame of the memory mapped counter module 
is written to, the accumulated fraction information is reset to zero. 


This field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


HDBG, bit [1] 
Halt-on-debug. Controls whether a Halt-on-debug signal halts the system counter: 
Ob System counter ignores Halt-on-debug. 
Qb1 Asserted Halt-on-debug signal halts system counter update. 


This field resets to an architecturally UNKNOWN value. 


EN, bit [0] 
Enables the counter: 
Qbe System counter disabled. 
Qb1 System counter enabled. 


This field resets to Q. 


Accessing the CNTCR: 


In a system that supports Secure and Non-secure memory maps the CNTControlBase frame, that includes this 
register, is implemented only in the Secure memory map. 


CNTCR can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTControlBase 0x000 CNTCR 
This interface is accessible as follows: 
s Accesses to this register are RW. 
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15.7.3 


15-7156 


CNTCV, Counter Count Value register 


The CNTCV characteristics are: 


Purpose 


Indicates the current count value. 


Configurations 
The power domain of CNTCV is IMPLEMENTATION DEFINED. 


On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 


Attributes 
CNTCV is a 64-bit register. 


Field descriptions 


The CNTCV bit assignments are: 





0 
CountValue 
CountValue, bits [63:0] 
Indicates the counter value. 
This field resets to an architecturally UNKNOWN value. 
Accessing the CNTCV: 
Frame Accessibility 





CNTControlBase RW 





CNTReadBase RO 





A write to CNTCV must be visible in the CNTPCT register of each running processor in a finite time. 
For the instance of the register in the CNTControlBase frame: 


g In a system that supports Secure and Non-secure memory maps the CNTControlBase frame, and therefore 
this register instance, is implemented only in the Secure memory map. 


: If the counter is enabled, the effect of writing to the register is UNKNOWN. 


In an implementation that supports 64-bit atomic memory accesses, this register must be accessible using a 64-bit 
atomic access. 


CNTCV[63:0] can be accessed through its memory-mapped interface: 








Component Frame Offset Instance Range 
Timer CNTControlBase 0x008 CNTCV 63:0 
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This interface is accessible as follows: 
: Accesses to CNTCV[63:0] are RW. 


CNTCV[63:0] can be accessed through its memory-mapped interface: 








Component Frame Offset Instance Range 
Timer CNTReadBase 0x000 CNTCV 63:0 
This interface is accessible as follows: 
e Accesses to CNTCV[63:0] are RO. 
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15.7.4 


15-7158 


CNTELOACR, Counter-timer ELO Access Control Register 


The CNTELOACR characteristics are: 


Purpose 
An implementation of CNTELOACR in the frame at CNTBaseN controls whether the CNTPCT, 
CNTVCT, CNTFRQ, EL1 Physical Timer, and Virtual Timer registers are visible in the frame at 
CNTELOBaseN. 

Configurations 
The power domain of CNTELOACR is IMPLEMENTATION DEFINED. 
On a reset of the reset domain in which it is implemented, RW fields in this register reset to 
UNKNOWN values. The register is not affected by a reset of any other reset domain. For more 
information see Power and reset domains for the system level implementation of the Generic Timer 
on page 12-7015. 
Implementation of this register is OPTIONAL. 

Attributes 


CNTELOACR is a 32-bit register. 


Field descriptions 


The CNTELOACR bit assignments are: 


L ELOPCTEN 
ELOVCTEN 


ELOVTEN 
ELOPTEN 


Bits [31:10] 


Reserved, RESO. 


ELOPTEN, bit [9] 
Second view read/write access control for the EL1 Physical Timer registers. This bit controls 
whether the CNTP_CVAL, CNTP_TVAL, and CNTP_CTL registers in the current CNTBaseN 
frame are also accessible in the corresponding CNTELOBaseN frame. The possible values of this 


bit are: 
0bd No access. Registers are RESO in the second view. 
Qb1 Access permitted. If the registers are accessible in the current frame then they are 


accessible in the second view. 


This field resets to an architecturally UNKNOWN value. 


ELOVTEN, bit [8] 
Second view read/write access control for the Virtual Timer registers. This bit controls whether the 
CNTV_CVAL, CNTV_TVAL, and CNTV_CTL registers in the current CNTBaseN frame are also 
accessible in the corresponding CNTELOBaseN frame. The possible values of this bit are: 
Qbd No access. Registers are RESO in the second view. 


Qb1 Access permitted. If the registers are accessible in the current frame then they are 
accessible in the second view. 
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The definition of this bit means that, if the Virtual Timer registers are not implemented in the current 
CNTBaseN frame, then the Virtual Timer register addresses are RESO in the corresponding 
CNTELOBaseN frame, regardless of the value of this bit. 


This field resets to an architecturally UNKNOWN value. 
Bits [7:2] 
Reserved, RESO. 


ELOVCTEN, bit [1] 
Second view read access control for CNTVCT and CNTFRQ. The possible values of this bit are: 


0bd CNTVCT is not visible in the second view. 
If ELOPCTEN is set to 0, CNTFRQ is not visible in the second view. 
Qb1 Access permitted. If CNTVCT and CNTFRQ are visible in the current frame then they 


are visible in the second view. 
This field resets to an architecturally UNKNOWN value. 


ELOPCTEN, bit [0] 
Second view read access control for CNTPCT and CNTFRQ. The possible values of this bit are: 


0bd CNTPCT is not visible in the second view. 
If ELOVCTEN is set to 0, CNTFRQ is not visible in the second view. 
Qb1 Access permitted. If CNTPCT and CNTFRQ are visible in the current frame then they 


are visible in the second view. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTELOACR: 
CNTELOACR can be implemented in any implemented CNTBaseN frame. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


$ Whether the CNTBaseN frame has virtual timer capability. 
7 Whether the corresponding CNTELOBaseN frame is implemented. 


à For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 
corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 


If CNTELOACR is not implemented in an implemented CNTBaseN frame: 
è The register location in that frame is RAZ/WI. 


: If the corresponding CNTELOBaseN frame is implemented, the registers CNTFRQ, CNTP_CTL, 
CNTP_CVAL, CNTP_TVAL, CNTPCT, CNTV_CTL, CNTV_CVAL, CNTV_TVAL, and CNTVCT are not 
visible in that frame. 


CNTELOACR can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTBaseN 0x014 CNTELOACR 
This interface is accessible as follows: 
° Accesses to this register are RW. 
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15.7.5 


15-7160 


CNTFIDO, Counter Frequency ID 


The CNTFIDO characteristics are: 


Purpose 
Indicates the base frequency of the system counter. 

Configurations 
The power domain of CNTFIDO is IMPLEMENTATION DEFINED. 
If this register is implemented as an RW register, on a reset of the reset domain in which it is 
implemented, RW fields in this register reset to UNKNOWN values. The register is not affected by a 
reset of any other reset domain. For more information see Power and reset domains for the system 
level implementation of the Generic Timer on page 12-7015. 
The possible frequencies for the system counter are stored in the Frequency modes table as 32-bit 
words starting with the base frequency, CNTFIDO. For more information see The Frequency modes 
table on page 12-7017. 
The final entry in the Frequency modes table must be followed by a 32-bit word of zero value, to 
mark the end of the table. 
Typically, the Frequency modes table will be in read-only memory. However, a system 
implementation might use read/write memory for the table, and initialize the table entries as part of 
its start-up sequence. 
If the Frequency modes table is in read/write memory, Arm strongly recommends that the table is 
not updated once the system is running. 

Attributes 


CNTFID0 is a 32-bit register. 


Field descriptions 


The CNTFID0 bit assignments are: 


31 0 


Frequency, bits [31:0] 
The base frequency of the system counter, in Hz. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTFIDO: 
It is IMPLEMENTATION DEFINED whether this register is RO or RW 


In a system that supports Secure and Non-secure memory maps the CNTControlBase frame, that includes this 
register, is implemented only in the Secure memory map. 


CNTFID0 can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTControlBase 0x020 CNTFIDO 
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This interface is accessible as follows: 


° Accesses to this register are RO or RW. 
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15.7.6 


15-7162 


CNTFID<n>, Counter Frequency IDs, n > 0 


The CNTFID<n> characteristics are: 


Purpose 


Indicates alternative system counter update frequencies. 


Configurations 


Attributes 


The power domain of CNTFID<n> is IMPLEMENTATION DEFINED. 


If this register is implemented as an RW register, on a reset of the reset domain in which it is 
implemented, RW fields in this register reset to UNKNOWN values. The register is not affected by a 
reset of any other reset domain. For more information see Power and reset domains for the system 
level implementation of the Generic Timer on page 12-7015. 


The possible frequencies for the system counter are stored in the Frequency modes table as 32-bit 
words starting with the base frequency, CNTFID0, see The Frequency modes table on page 12-7017. 


The number of CNTFID<n> registers is IMPLEMENTATION DEFINED, and the only required 
CNTFID<n> register is CNTFIDO. 


The final entry in the Frequency modes table must be followed by a 32-bit word of zero value, to 
mark the end of the table. 


Typically, the Frequency modes table will be in read-only memory. However, a system 
implementation might use read/write memory for the table, and initialize the table entries as part of 
its start-up sequence. 


If the Frequency modes table is in read/write memory, Arm strongly recommends that the table is 
not updated once the system is running. 


CNTFID<n> is a 32-bit register. 


Field descriptions 


The CNTFID<n> bit assignments are: 


31 


0 


Frequency, bits [31:0] 


A system counter update frequency, in Hz. Must be an exact divisor of the base frequency. Arm 
strongly recommends that all frequency values in the Frequency modes table are integer 
power-of-two divisors of the base frequency. 


When the system timer is operating at a lower frequency than the base frequency, the increment 
applied at each counter update is given by: 


increment = (base frequency) / (selected frequency) 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTFID<n>: 


It is IMPLEMENTATION DEFINED whether this register is RO or RW 


In a system that supports Secure and Non-secure memory maps the CNTControlBase frame, that includes these 
registers, is implemented only in the Secure memory map. 
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CNTFID<n> can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTControlBase 0x020+4n CNTFID<n> 
This interface is accessible as follows: 
. Accesses to this register are RO or RW. 
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15.7.7 


15-7164 


CNTFRQ, Counter-timer Frequency 


The CNTFRQ characteristics are: 


Purpose 


This register is provided so that software can discover the frequency of the system counter. The 
instance of the register in the CNTCTLBase frame must be programmed with this value as part of 
system initialization. The value of the register is not interpreted by hardware. 


Configurations 


The power domain of CNTFRQ is IMPLEMENTATION DEFINED. 


On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 


Attributes 
CNTFRQ is a 32-bit register. 


Field descriptions 


The CNTFRQ bit assignments are: 


31 0 
Clock frequency 
Bits [31:0] 


Clock frequency. Indicates the system counter clock frequency, in Hz. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTFRQ: 
CNTFRQ must be implemented as an RW register in the CNTCTLBase frame. 


In a system that recognizes two Security states, the instance of the register in the CNTCTLBase frame is only 
accessible by Secure accesses. 


CNTFRQ can be implemented as a RO register in any implemented CNTBaseN frame, and in the corresponding 
CNTELOBaseN frame. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


$ Whether the CNTBaseN frame has virtual timer capability. 
à Whether the corresponding CNTELOBaseN frame is implemented. 


: For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 
corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 


For an implemented CNTBaseN frame: 
. CNTFRQ is accessible in that frame, as a RO register, if the value of CNTACR<n>.RFRQ is 1. 


° Otherwise, the CNTFRQ address in that frame is RAZ/WI. 
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For an implemented CNTELOBaseN frame: 


$ CNTFRQ is accessible as a RO register in that frame if both: 
— CNTFRQ is accessible in the corresponding CNTBaseN frame. 


— Either the value of CNTELOACR.ELOVCTEN is 1 or the value of CNTELOACR.ELOPCTEN is 1. 


° Otherwise, the CNTFRQ address in that frame is RAZ/WI. 


CNTFRQ can be accessed through its memory-mapped interface: 




















Component Frame Offset Instance 
Timer CNTBaseN 0x010 CNTFRQ 
This interface is accessible as follows: 
° Accesses to this register are RO. 
CNTFRQ can be accessed through its memory-mapped interface: 
Component Frame Offset Instance 
Timer CNTELOBaseN 0x010 CNTFRQ 
This interface is accessible as follows: 
Š Accesses to this register are RO. 
CNTFRQ can be accessed through its memory-mapped interface: 
Component Frame Offset Instance 
Timer CNTCTLBase 0x000 CNTFRQ 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.7.8 CNTID, Counter Identification Register 


The CNTID characteristics are: 


Purpose 
Indicates whether counter scaling is implemented. 
Configurations 
The power domain of CNTID is IMPLEMENTATION DEFINED. 
This register is present only when ARMV8.4-CNTSC is implemented. Otherwise, direct accesses to 
CNTID are RESO. 
Attributes 


CNTID is a 32-bit register. 


Field descriptions 


The CNTID bit assignments are: 


31 43 0 
RESO CNTSC 
Bits [31:4] 


Reserved, RESO. 

CNTSC, bits [3:0] 
Indicates whether Counter Scaling is implemented 
0b0000 Counter scaling is not implemented. 
0b0001 Counter scaling is implemented. 


All other values are reserved. 


Accessing the CNTID: 


In a system that supports Secure and Non-secure memory maps, the CNTControlBase frame, that includes this 
register, is implemented only in the Secure memory map. 


CNTID can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTControlBase @x1C CNTID 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.7.9 CNTNSAR, Counter-timer Non-secure Access Register 


ARM DDI 0487E.a 
ID070919 


The CNTNSAR characteristics are: 


Purpose 
Provides the highest-level control of whether frames CNTBaseN and CNTELOBaseN are accessible 
by Non-secure accesses. 


Configurations 
The power domain of CNTNSAR is IMPLEMENTATION DEFINED. 


On a reset of the reset domain in which it is implemented, RW fields in this register reset to 
UNKNOWN values. The register is not affected by a reset of any other reset domain. For more 
information see Power and reset domains for the system level implementation of the Generic Timer 
on page 12-7015. 


Attributes 
CNTNSAR is a 32-bit register. 


Field descriptions 


The CNTNSAR bit assignments are: 





Bits [31:8] 
Reserved, RESO. 


NS<n>, bit [n], for n = 0 to 7 
Non-secure access to frame n. The possible values of this bit are: 
Qbd Secure access only. Behaves as RESO to Non-secure accesses. 
Qb1 Secure and Non-secure accesses permitted. 


This bit also determines whether, in the CNTCTLBase frame, CNTACR<n> and CNT VOFF<n> are 
accessible to Non-secure accesses. 


If frame CNTBase<n>: 

° Is not implemented, then NS<n> is RESO. 

° Is not Configurable access, and is accessible only by Secure accesses, then NS<n> is RESO. 
° Is not Configurable access, and is accessible by both Secure and Non-secure accesses, then 


NS<n> is RES1. 
This field resets to an architecturally UNKNOWN value. 
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Accessing the CNTNSAR: 


In a system that recognizes two Security states, this register is only accessible by Secure accesses. 


CNTNSAR can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTCTLBase 0x004 CNTNSAR 
This interface is accessible as follows: 
° Accesses to this register are RW. 
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15.7.10 CNTP_CTL, Counter-timer Physical Timer Control 


ARM DDI 0487E.a 
ID070919 


The CNTP_CTL characteristics are: 


Purpose 
Control register for the EL1 physical timer. 

Configurations 
The power domain of CNTP_CTL is IMPLEMENTATION DEFINED. 
On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 

Attributes 


CNTP_CTL is a 32-bit register. 


Field descriptions 


The CNTP_CTL bit assignments are: 


31 


3210 


RESO al 


Bits [31:3] 


L ENABLE 
IMASK 


ISTATUS 


Reserved, RESO. 


ISTATUS, bit [2] 


The status of the timer. This bit indicates whether the timer condition is met: 
Oba Timer condition is not met. 
Qb1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 


Timer interrupt mask bit. Permitted values are: 

Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 

For more information, see the description of the ISTATUS bit. 
This field resets to an architecturally UNKNOWN value. 
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15-7170 


ENABLE, bit [0] 
Enables the timer. Permitted values are: 
Ob Timer disabled. 
Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 


CNTP_TVAL continues to count down. 


Note 


Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTP_CTL: 


CNTP_CTL can be implemented in any implemented CNTBaseN frame, and in the corresponding CNTELOBaseN 


frame. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


$ Whether the CNTBaseN frame has virtual timer capability. 


a Whether the corresponding CNTELOBaseN frame is implemented. 


s For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 


corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 
For an implemented CNTBaseN frame: 
° CNTP CTL is accessible in that frame if the value of CNTACR<n>.RWPT is 1. 
° Otherwise, the CNTP_CTL address in that frame is RAZ/WI. 
For an implemented CNTELOBaseN frame: 


° CNTP CTL is accessible in that frame if both: 
— CNTP_CTL is accessible in the corresponding CNTBaseN frame: 
— The value of CNTELOACR.ELOPTEN is 1. 


° Otherwise, the CNTP_CTL address in that frame is RAZ/WI. 


CNTP _CTL can be accessed through its memory-mapped interface: 














Component Frame Offset Instance 
Timer CNTBaseN 0x02C CNTP_CTL 
This interface is accessible as follows: 
° Accesses to this register are RW. 
CNTP_CTL can be accessed through its memory-mapped interface: 
Component Frame Offset Instance 
Timer CNTELOBaseN 0x02C CNTP_CTL 
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This interface is accessible as follows: 


s Accesses to this register are RW. 
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15.7.11 


15-7172 


CNTP_CVAL, Counter-timer Physical Timer CompareValue 


The CNTP_CVAL characteristics are: 


Purpose 


Holds the 64-bit compare value for the EL1 physical timer. 


Configurations 
The power domain of CNTP_CVAL is IMPLEMENTATION DEFINED. 


On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 


Attributes 
CNTP_CVAL is a 64-bit register. 


Field descriptions 


The CNTP_CVAL bit assignments are: 


CompareValue 


CompareValue, bits [63:0] 
Holds the EL1 physical timer Compare Value. 


When CNTP_CTL.ENABLE is 1, the timer condition is met when (CNTPCT - Compare Value) is 
greater than or equal to zero. This means that CompareValue acts like a 64-bit upcounter timer. 
When the timer condition is met: 


° CNTP_CTL.ISTATUS is set to 1. 

d An interrupt is generated if CNTP_CTL.IMASK is 0. 

When CNTP_CTL.ENABLE is 0, the timer condition is not met, but CNTPCT continues to count. 
This field resets to an architecturally UNKNOWN value. 


Accessing the CNTP_CVAL: 


CNTP_CVAL can be implemented in any implemented CNTBaseN frame, and in the corresponding 
CNTELOBaseN frame. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


$ Whether the CNTBaseN frame has virtual timer capability. 
è Whether the corresponding CNTELOBaseN frame is implemented. 


s For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 
corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 


For an implemented CNTBaseN frame: 
° CNTP_CVAL is accessible in that frame if the value of CNTACR<n>.RWPT is 1. 


° Otherwise, the CNTP_CVAL address in that frame is RAZ/WI. 
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For an implemented CNTELOBaseN frame: 


° CNTP_CVAL is accessible in that frame if both: 
—  CNTP_CVAL is accessible in the corresponding CNTBaseN frame: 
— The value of CNTELOACR.ELOPTEN is 1. 


° Otherwise, the CNTP_CVAL address in that frame is RAZ/WI. 


If the implementation supports 64-bit atomic accesses, then the CNTP_CVAL register must be accessible as an 
atomic 64-bit value. 


CNTP_CVAL[31:0] can be accessed through its memory-mapped interface: 





Component Frame Offset Instance Range 


Timer CNTBaseN 0x020 CNTP_CVAL 31:0 





This interface is accessible as follows: 
5 Accesses to CNTP_CVAL[31:0] are RW. 


CNTP_CVAL[31:0] can be accessed through its memory-mapped interface: 





Component Frame Offset Instance Range 


Timer CNTELOBaseN 0x020 CNTP_CVAL 31:0 





This interface is accessible as follows: 
- Accesses to CNTP_CVAL[31:0] are RW. 


CNTP_CVAL[63:32] can be accessed through its memory-mapped interface: 





Component Frame Offset Instance Range 


Timer CNTBaseN 0x024 CNTP_CVAL 63:32 





This interface is accessible as follows: 
s Accesses to CNTP_CVAL[63:32] are RW. 


CNTP_CVAL[63:32] can be accessed through its memory-mapped interface: 





Component Frame Offset Instance Range 


Timer CNTELOBaseN 0x024 CNTP_CVAL 63:32 





This interface is accessible as follows: 


s Accesses to CNTP_CVAL[63:32] are RW. 
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15.7.12 


15-7174 


CNTP_TVAL, Counter-timer Physical Timer TimerValue 


The CNTP_TVAL characteristics are: 


Purpose 


Configurations 
The power domain of CNTP_TVAL is IMPLEMENTATION DEFINED. 


Attributes 


Holds the timer value for the EL1 physical timer. 


On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 


CNTP_TVAL is a 32-bit register. 


Field descriptions 


The CNTP_TVAL bit assignments are: 


31 


0 


TimerValue 


Timer Value, bits [31:0] 


The TimerValue view of the EL1 physical timer. 

On a read of this register: 

. If CNTP_CTL.ENABLE is 0, the value returned is UNKNOWN. 

° If CNTP_CTL.ENABLE is 1, the value returned is (CompareValue - CNTPCT). 


On a write of this register, CompareValue is set to (CNTPCT + TimerValue), where TimerValue is 
treated as a signed 32-bit integer. 


When CNTP_CTL.ENABLE is 1, the timer condition is met when (CNTPCT - CompareValue) is 
greater than or equal to zero. This means that TimerValue acts like a 32-bit downcounter timer. 
When the timer condition is met: 


° CNTP_CTL.ISTATUS is set to 1. 
° If CNTP_CTL.IMASK is 0, an interrupt is generated. 


When CNTP_CTL.ENABLE is 0, the timer condition is not met, but CNTPCT continues to count, 
so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTP_TVAL: 


CNTP_TVAL can be implemented in any implemented CNTBaseN frame, and in the corresponding 
CNTELOBaseN frame. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


a Whether the CNTBaseN frame has virtual timer capability. 


à Whether the corresponding CNTELOBaseN frame is implemented. 
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s For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 


corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 
For an implemented CNTBaseN frame: 
° CNTP_TVAL is accessible in that frame if the value of CNTACR<n>.RWPT is 1. 
$ Otherwise, the CNTP_TVAL address in that frame is RAZ/WI. 
For an implemented CNTELOBaseN frame: 


$ CNTP_TVAL is accessible in that frame if both: 
— CNTP_TVAL is accessible in the corresponding CNTBaseN frame: 
— The value of CNTELOACR.ELOPTEN is 1. 


7 Otherwise, the CNTP_TVAL address in that frame is RAZ/WI. 


CNTP_TVAL can be accessed through its memory-mapped interface: 














Component Frame Offset Instance 
Timer CNTBaseN 0x028 CNTP_TVAL 
This interface is accessible as follows: 
° Accesses to this register are RW. 
CNTP_TVAL can be accessed through its memory-mapped interface: 
Component Frame Offset Instance 
Timer CNTELOBaseN 0x028 CNTP_TVAL 
This interface is accessible as follows: 
G Accesses to this register are RW. 
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15.7.13 


15-7176 


CNTPCT, Counter-timer Physical Count 


The CNTPCT characteristics are: 


Purpose 
Holds the 64-bit physical count value. 
Configurations 
The power domain of CNTPCT is IMPLEMENTATION DEFINED. 
For more information see Power and reset domains for the system level implementation of the 
Generic Timer on page 12-7015. 
Attributes 


CNTPCT is a 64-bit register. 


Field descriptions 


The CNTPCT bit assignments are: 


Physical count value 


Bits [63:0] 


Physical count value. 


Accessing the CNTPCT: 


CNTPCT can be implemented in any implemented CNTBaseN frame, and in the corresponding CNTELOBaseN 
frame, as a RO register. 


CNTBaseN describes the status fields that identify whether a CNTBaseN frame is implemented, and for an 
implemented frame: 


: Whether the CNTBaseN frame has virtual timer capability. 
° Whether the corresponding CNTELOBaseN frame is implemented. 


s For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 
corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 


For an implemented CNTBaseN frame: 

° CNTPCT is accessible in that frame, as a RO register, if the value of CNTACR<n>.RPCT is 1. 
. Otherwise, the CNTPCT address in that frame is RAZ/WI. 

For an implemented CNTELOBaseN frame: 


s CNTPCT is accessible in that frame if both: 
— CNTPCT is accessible in the corresponding CNTBaseN frame. 
— The value of CNTELOACR.ELOPCTEN is 1. 


. Otherwise, the CNTPCT address in that frame is RAZ/WI. 


If the implementation supports 64-bit atomic accesses, then the CNTPCT register must be accessible as an atomic 
64-bit value. 
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CNTPCT[31:0] can be accessed through its memory-mapped interface: 








This interface is accessible as follows: 
è Accesses to CNTPCT[31:0] are RO. 


CNTPCT[31:0] can be accessed through its memory-mapped interface: 








This interface is accessible as follows: 
° Accesses to CNTPCT[31:0] are RO. 


CNTPCT[63:32] can be accessed through its memory-mapped interface: 








This interface is accessible as follows: 
7 Accesses to CNTPCT[63:32] are RO. 


CNTPCT[63:32] can be accessed through its memory-mapped interface: 








This interface is accessible as follows: 


° Accesses to CNTPCT[63:32] are RO. 


Component Frame Offset Instance Range 
Timer CNTBaseN 0x000 CNTPCT 31:0 
Component Frame Offset Instance Range 
Timer CNTELOBaseN 0x000 CNTPCT 31:0 
Component Frame Offset Instance Range 
Timer CNTBaseN 0x004 CNTPCT 63:32 
Component Frame Offset Instance Range 
Timer CNTELOBaseN 0x004 CNTPCT 63:32 
15-7177 
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15.7.14 


15-7178 


CNTSCR, Counter Scale Register 


The CNTSCR characteristics are: 


Purpose 
Enables the counter, controls the counter frequency setting, and controls counter behavior during 
debug. 

Configurations 
The power domain of CNTSCR is IMPLEMENTATION DEFINED. 


Some or all fields in this register have defined reset values. These apply only on a reset of the reset 
domain in which the register is implemented. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 


This register is present only when ARMV8.4-CNTSC is implemented. Otherwise, direct accesses to 
CNTSCR are RESO. 

Attributes 
CNTSCR is a 32-bit register. 


Field descriptions 


The CNTSCR bit assignments are: 


31 0 


ScaleVal 


ScaleVal, bits [31:0] 
Scale Value 


When counter scaling is enabled, ScaleVal is the amount added to the counter value for every 
counter tick. 


Counter tick is defined as one period of the current operating frequency of the Generic counter. 


ScaleVal is expressed as an unsigned fixed point number with an 8-bit integer value and a 24-bit 
fractional value. 


CNTSCR.ScaleVal can only be changed when CNTCR.EN == 0. If the value of this field is changed 


when CNTCR.EN == 1: 
° The counter value becomes UNKNOWN. 
. The counter value remains UNKNOWN on future ticks of the clock. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTSCR: 


In a system that supports Secure and Non-secure memory maps the CNTControlBase frame, that includes this 
register, is implemented only in the Secure memory map. 


CNTSCR can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTControlBase 0x10 CNTSCR 
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This interface is accessible as follows: 


s Accesses to this register are RW. 
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15.7.15 


15-7180 


CNTSR, Counter Status Register 


The CNTSR characteristics are: 


Purpose 
Provides counter frequency status information. 

Configurations 
The power domain of CNTSR is IMPLEMENTATION DEFINED. 
Some or all fields in this register have defined reset values. These apply only on a reset of the reset 
domain in which the register is implemented. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 

Attributes 


CNTSR is a 32-bit register. 


Field descriptions 


The CNTSR bit assignments are: 


FCACK, bits [31:8] 
Frequency change acknowledge. Indicates the currently selected entry in the Frequency modes 
table, see The Frequency modes table on page 12-7017. 


This field resets to 0. 
Bits [7:2] 
Reserved, RESO. 
DBGH, bit [1] 
Indicates whether the counter is halted because the Halt-on-debug signal is asserted: 
Qbd Counter is not halted. 


Qb1 Counter is halted. 
This field resets to an architecturally UNKNOWN value. 


Bit [0] 
Reserved, RESO. 


Accessing the CNTSR: 


In a system that supports Secure and Non-secure memory maps the CNTControlBase frame, that includes this 
register, is implemented only in the Secure memory map. 
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CNTSR can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTControlBase 0x004 CNTSR 
This interface is accessible as follows: 
è Accesses to this register are RO. 
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15.7.16 


15-7182 


CNTTIDR, Counter-timer Timer ID Register 


The CNTTIDR characteristics are: 


Purpose 


Indicates the implemented timers in the memory map, and their features. For each value of N from 
0 to 7 it indicates whether: 


ë: Frame CNTBaseN is a view of an implemented timer. 
. Frame CNTBaseN has a second view, CNTELOBaseN. 
è Frame CNTBaseN has a virtual timer capability. 


Configurations 
The power domain of CNTTIDR is IMPLEMENTATION DEFINED. 


For more information see Power and reset domains for the system level implementation of the 
Generic Timer on page 12-7015. 


Attributes 
CNTTIDR is a 32-bit register. 


Field descriptions 


The CNTTIDR bit assignments are: 


28 27 24 23 20 19 16 15 12 11 


Frame<n>, bits [4n+3:4n], for n = 0 to 7 
A 4-bit field indicating the features of frame CNTBase<n>. 
Bit[3] of the field is RESO. 


Bit[2], the FELO subfield, indicates whether frame CNTBase<n> has a second view, 
CNTELOBase<n>. The possible values of this bit are: 





Bit[2] Meaning 








Qbd Frame<n> does not have a second view. The CNTELOACR register in the first view of the frame 
is RESO 
Qb1 Frame<n> has a second view, CNTELOBase<n>. 





If bit[0] is 0, bit[2] is RESO. 
Bit[1], the FVI subfield, indicates whether both: 


. Frame CNTBase<n> implements the virtual timer registers CNTV_CVAL, CNTV_TVAL, 
and CNTV_CTL. 


5 This CNTCTLBase frame implements the virtual timer offset register CNTVOFF<n>. 
The possible values of bit[1] are: 





Bit[1] Meaning 








Ob Frame<n> does not have virtual capability. The virtual time and offset registers are RESO. 
0b1 Frame<n> has virtual capability. The virtual time and offset registers are implemented 
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If bit[0] is 0, bit[1] is RESO. 


Bit[0], the FI subfield, indicates whether frame CNTBase<n> is implemented. The possible values 
of this bit are: 





Bit[0] Meaning 





Obed Frame<n> is not implemented. All registers associated with the frame are RESO. 





Qb1 Frame<n> is implemented 





Accessing the CNTTIDR: 
In a system that recognizes two Security states this register is accessible by both Secure and Non-secure accesses. 


CNTTIDR can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTCTLBase 0x008 CNTTIDR 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.7.17 


15-7184 


CNTV_CTL, Counter-timer Virtual Timer Control 


The CNTV_CTL characteristics are: 


Purpose 
Control register for the virtual timer. 

Configurations 
The power domain of CNTV_CTL is IMPLEMENTATION DEFINED. 
On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 

Attributes 


CNTV_CTL is a 32-bit register. 


Field descriptions 


The CNTV_CTL bit assignments are: 


31 


3210 


RESO al 


Bits [31:3] 


L ENABLE 
IMASK 


ISTATUS 


Reserved, RESO. 


ISTATUS, bit [2] 


The status of the timer. This bit indicates whether the timer condition is met: 
Oba Timer condition is not met. 
Qb1 Timer condition is met. 


When the value of the ENABLE bit is 1, ISTATUS indicates whether the timer condition is met. 
ISTATUS takes no account of the value of the IMASK bit. If the value of ISTATUS is 1 and the 
value of IMASK is 0 then the timer interrupt is asserted. 


When the value of the ENABLE bit is 0, the ISTATUS field is UNKNOWN. 


For more information see Operation of the CompareValue views of the timers on page D11-2797 and 
Operation of the TimerValue views of the timers on page D11-2797. 


This bit is read-only. 


IMASK, bit [1] 


Timer interrupt mask bit. Permitted values are: 

Qbd Timer interrupt is not masked by the IMASK bit. 
Qb1 Timer interrupt is masked by the IMASK bit. 

For more information, see the description of the ISTATUS bit. 
This field resets to an architecturally UNKNOWN value. 
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ENABLE, bit [0] 
Enables the timer. Permitted values are: 
Ob Timer disabled. 
Qb1 Timer enabled. 


Setting this bit to 0 disables the timer output signal, but the timer value accessible from 
CNTV_TVAL continues to count down. 


Note 


Disabling the output signal might be a power-saving option. 








This field resets to an architecturally UNKNOWN value. 


Accessing the CNTV_CTL: 


CNTV_CTL can be implemented in any implemented CNTBaseN frame that has virtual timer capability, and in the 
corresponding CNTELOBaseN frame. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


$ Whether the CNTBaseN frame has virtual timer capability. 
a Whether the corresponding CNTELOBaseN frame is implemented. 


s For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 
corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 


For an implemented CNTBaseN frame that has virtual timer capability: 

° CNTV_CTL is accessible in that frame if the value of CNTACR<n>.RWVT is 1. 
od Otherwise, the CNTV_CTL address in that frame is RAZ/WI. 

For an implemented CNTELOBaseN frame: 


° CNTV_CTL is accessible in that frame if both: 
—  CNTV_CTL is accessible in the corresponding CNTBaseN frame: 
— The value of CNTELOACR.ELOVTEN is 1. 


° Otherwise, the CNTV_CTL address in that frame is RAZ/WI. 


CNTV_CTL can be accessed through its memory-mapped interface: 





Component Frame Offset Instance 


Timer CNTBaseN 0x03C CNTV_CTL 





This interface is accessible as follows: 
° Accesses to this register are RW. 


CNTV_CTL can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTELOBaseN 0x03C CNTV_CTL 
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This interface is accessible as follows: 


s Accesses to this register are RW. 
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15.7.18 CNTV_CVAL, Counter-timer Virtual Timer CompareValue 
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The CNTV_CVAL characteristics are: 


Purpose 


Holds the 64-bit compare value for the virtual timer. 


Configurations 
The power domain of CNTV_CVAL is IMPLEMENTATION DEFINED. 


On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 


Attributes 
CNTV_CVAL is a 64-bit register. 


Field descriptions 


The CNTV_CVAL bit assignments are: 


CompareValue 


CompareValue, bits [63:0] 
Holds the virtual timer Compare Value. 


When CNTV_CTL.ENABLE is 1, the timer condition is met when (CNTVCT - CompareValue) is 
greater than or equal to zero. This means that CompareValue acts like a 64-bit upcounter timer. 
When the timer condition is met: 


° CNTV_CTL.ISTATUS is setto 1. 

à An interrupt is generated if CNTV_CTL.IMASK is 0. 

When CNTV_CTL.ENABLE is 0, the timer condition is not met, but CNT VCT continues to count. 
This field resets to an architecturally UNKNOWN value. 


Accessing the CNTV_CVAL: 


CNTV_CVAL can be implemented in any implemented CNTBaseN frame that has virtual timer capability, and in 
the corresponding CNTELOBaseN frame. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


s Whether the CNTBaseN frame has virtual timer capability. 
- Whether the corresponding CNTELOBaseN frame is implemented. 


s For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 
corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 


For an implemented CNTBaseN frame that has virtual timer capability: 
° CNTV_CVAL is accessible in that frame if the value of CNTACR<n>.RWVT is 1. 


° Otherwise, the CNTV_CVAL address in that frame is RAZ/WI. 
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For an implemented CNTELOBaseN frame: 


° CNTV_CVAL is accessible in that frame if both: 
—  CNTV_CVAL is accessible in the corresponding CNTBaseN frame: 
— The value of CNTELOACR.ELOVTEN is 1. 


° Otherwise, the CNTV_CVAL address in that frame is RAZ/WI. 


If the implementation supports 64-bit atomic accesses, then the CNTV_CVAL register must be accessible as an 
atomic 64-bit value. 


CNTV_CVAL[31:0] can be accessed through its memory-mapped interface: 





Component Frame Offset Instance Range 


Timer CNTBaseN 0x030 CNTV_CVAL 31:0 





This interface is accessible as follows: 
5 Accesses to CNTV_CVAL[31:0] are RW. 


CNTV_CVAL[31:0] can be accessed through its memory-mapped interface: 





Component Frame Offset Instance Range 


Timer CNTELOBaseN 0x030 CNTV_CVAL 31:0 





This interface is accessible as follows: 
° Accesses to CNTV_CVAL[31:0] are RW. 


CNTV_CVAL[63:32] can be accessed through its memory-mapped interface: 





Component Frame Offset Instance Range 


Timer CNTBaseN 0x034 CNTV_CVAL 63:32 





This interface is accessible as follows: 
s Accesses to CNTV_CVAL[63:32] are RW. 


CNTV_CVAL[63:32] can be accessed through its memory-mapped interface: 





Component Frame Offset Instance Range 


Timer CNTELOBaseN 0x034 CNTV_CVAL 63:32 





This interface is accessible as follows: 


s Accesses to CNTV_CVAL[63:32] are RW. 
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15.7.19 CNTV_TVAL, Counter-timer Virtual Timer TimerValue 


The CNTV_TVAL characteristics are: 


Purpose 
Holds the timer value for the virtual timer. 

Configurations 
The power domain of CNTV_TVAL is IMPLEMENTATION DEFINED. 
On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 

Attributes 


CNTV_TVAL is a 32-bit register. 


Field descriptions 


The CNTV_TVAL bit assignments are: 


31 0 


TimerValue 


Timer Value, bits [31:0] 
The TimerValue view of the virtual timer. 
On a read of this register: 
° If CNTV_CTL.ENABLE is 0, the value returned is UNKNOWN. 
: If CNTV_CTL.ENABLE is 1, the value returned is (CompareValue - CNTVCT). 


On a write of this register, Compare Value is set to (CNT VCT + TimerValue), where TimerValue is 
treated as a signed 32-bit integer. 


When CNTV_CTL.ENABLE is 1, the timer condition is met when (CNT VCT - CompareValue) is 
greater than or equal to zero. This means that TimerValue acts like a 32-bit downcounter timer. 
When the timer condition is met: 


° CNTV_CTL.ISTATUS is set to 1. 
° If CNTV_CTL.IMASK is 0, an interrupt is generated. 


When CNTV_CTL.ENABLE is 0, the timer condition is not met, but CNT VCT continues to count, 
so the TimerValue view appears to continue to count down. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTV_TVAL: 


CNTV_TVAL can be implemented in any implemented CNTBaseN frame that has virtual timer capability, and in 
the corresponding CNTELOBaseN frame. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


a Whether the CNTBaseN frame has virtual timer capability. 


à Whether the corresponding CNTELOBaseN frame is implemented. 
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15-7190 


: For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 


corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 
For an implemented CNTBaseN frame that has virtual timer capability: 
, CNTV_TVAL is accessible in that frame if the value of CNTACR<n>.RWVT is 1. 
$ Otherwise, the CNTV_TVAL address in that frame is RAZ/WI. 
For an implemented CNTELOBaseN frame: 


s CNTV_TVAL is accessible in that frame if both: 
—  CNTV_TVAL is accessible in the corresponding CNTBaseN frame: 
— The value of CNTELOACR.ELOVTEN is 1. 


7 Otherwise, the CNTV_TVAL address in that frame is RAZ/WI. 


CNTV_TVAL can be accessed through its memory-mapped interface: 











Component Frame Offset Instance 
Timer CNTBaseN 0x038 CNTV_TVAL 
This interface is accessible as follows: 
° Accesses to this register are RW. 
CNTV_TVAL can be accessed through its memory-mapped interface: 
Component Frame Offset Instance 
Timer CNTELOBaseN 0x038 CNTV_TVAL 





This interface is accessible as follows: 


G Accesses to this register are RW. 
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15.7.20 CNTVCT, Counter-timer Virtual Count 
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The CNTVCT characteristics are: 


Purpose 
Holds the 64-bit virtual count value. 
Configurations 
The power domain of CNTVCT is IMPLEMENTATION DEFINED. 
For more information see Power and reset domains for the system level implementation of the 
Generic Timer on page 12-7015. 
Attributes 


CNTVCT is a 64-bit register. 


Field descriptions 


The CNTVCT bit assignments are: 


Virtual count value 


Bits [63:0] 


Virtual count value. 


Accessing the CNTVCT: 


CNTVCT can be implemented in any implemented CNTBaseN frame, and in the corresponding CNTELOBaseN 
frame, as a RO register. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


: Whether the CNTBaseN frame has virtual timer capability. 
` Whether the corresponding CNTELOBaseN frame is implemented. 


s For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 
corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 


For an implemented CNTBaseN frame: 

° CNTVCT is accessible in that frame, as a RO register, if the value of CNTACR<n>.RVCT is 1. 
. Otherwise, the CNTVCT address in that frame is RAZ/WI. 

For an implemented CNTELOBaseN frame: 


: CNTVCT is accessible in that frame if both: 
—  CNTVCT is accessible in the corresponding CNTBaseN frame. 
— The value of CNTELOACR.ELOVCTEN is 1. 


. Otherwise, the CNTVCT address in that frame is RAZ/WI. 


If the implementation supports 64-bit atomic accesses, then the CNTVCT register must be accessible as an atomic 
64-bit value. 
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15-7192 


CNTVCT[31:0] can be accessed through its memory-mapped interface: 








This interface is accessible as follows: 
è Accesses to CNTVCT[31:0] are RO. 


CNTVCT[31:0] can be accessed through its memory-mapped interface: 








This interface is accessible as follows: 
° Accesses to CNTVCT[31:0] are RO. 


CNTVCT[63:32] can be accessed through its memory-mapped interface: 








This interface is accessible as follows: 
e Accesses to CNTVCT[63:32] are RO. 


CNTVCT[63:32] can be accessed through its memory-mapped interface: 





Component Frame Offset Instance Range 
Timer CNTBaseN 0x008 CNTVCT 31:0 
Component Frame Offset Instance Range 
Timer CNTELOBaseN 0x008 CNTVCT 31:0 
Component Frame Offset Instance Range 
Timer CNTBaseN @0x00C CNTVCT 63:32 
Component Frame Offset Instance Range 
Timer CNTELOBaseN 0x00C CNTVCT 63:32 





This interface is accessible as follows: 


° Accesses to CNTVCT[63:32] are RO. 
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15.7.21 CNTVOFF, Counter-timer Virtual Offset 
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The CNTVOFF characteristics are: 


Purpose 
Holds the 64-bit virtual offset for a CNTBaseN frame that has virtual timer capability. This is the 
offset between real time and virtual time. 

Configurations 
The power domain of CNTVOFF is IMPLEMENTATION DEFINED. 
On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 

Attributes 


CNTVOFF is a 64-bit register. 


Field descriptions 


The CNTVOFF bit assignments are: 


Virtual offset 


Bits [63:0] 
Virtual offset. 


This field resets to an architecturally UNKNOWN value. 


Accessing the CNTVOFF: 
CNTVOFF is implemented, as a RO register, in any implemented CNTBaseN frame that has virtual timer capability. 


CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames on page 12-7023 describes 
the status fields that identify whether a CNTBaseN frame is implemented, and for an implemented frame: 


s Whether the CNTBaseN frame has virtual timer capability. 
s Whether the corresponding CNTELOBaseN frame is implemented. 


è For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 
corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 


For an implemented CNTBaseN frame that has virtual timer capability: 
° CNTVOFF is accessible in that frame, as a RO register, if the value of CNTACR<n>.RVOFF is 1. 


. Otherwise, the CNTVOFF address in that frame is RAZ/WI. 





Note 


CNTVOFF is never visible in any CNTELOBaseN frame. This means that the CNTVOFF address in any 
implemented CNTELOBaseN frame is RAZ/WI. 


In an implementation that supports 64-bit atomic accesses, a CNT VOFF {<n>} register must be accessible as an 
atomic 64-bit value. 
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15-7194 


CNTVOFF{[3 1:0] can be accessed through its memory-mapped interface: 








This interface is accessible as follows: 
° Accesses to CNTVOFF[31:0] are RO. 


CNTVOFF[63:32] can be accessed through its memory-mapped interface: 





Component Frame Offset Range 
Timer CNTBaseN 0x018 31:0 
Component Frame Offset Range 
Timer CNTBaseN 0x01C 63:32 





This interface is accessible as follows: 


° Accesses to CNTVOFF[63:32] are RO. 
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15.7.22 CNTVOFF<n>, Counter-timer Virtual Offsets, n = 0 - 7 
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The CNTVOFF<n> characteristics are: 


Purpose 


Holds the 64-bit virtual offset for frame CNTBase<n>. This is the offset between real time and 
virtual time. 


Configurations 
The implementation of CNTVOFF<n> is OPTIONAL. 
The power domain of CNTVOFF<n> is IMPLEMENTATION DEFINED. 


On a reset of the reset domain in which an RW instance of this register is implemented, RW fields 
in the register reset to UNKNOWN values. The register is not affected by a reset of any other reset 
domain. For more information see Power and reset domains for the system level implementation of 
the Generic Timer on page 12-7015. 


Attributes 
CNTVOFF<n> is a 64-bit register. 


Field descriptions 


The CNTVOFF<n> bit assignments are: 


Virtual offset 


Bits [63:0] 
Virtual offset. 
This field resets to an architecturally UNKNOWN value. 


Accessing the CNTVOFF<n>: 


In the CNTCTLBase frame a CNTVOFF<n> register must be implemented, as a RW register, for each CNTBaseN 
frame that has virtual timer capability. For more information see CNTCTLBase status and control fields for the 
CNTBaseN and CNTELOBaseN frames on page 12-7023. 


Note 


The value of <n> in an instance of CNTVOFF<n> specifies the value of N for the associated CNTBaseN frame. 








In a system that recognizes two Security states, for any CNTVOFF<n> register in the CNTCTLBase frame: 
° CNTVOFF<n> is always accessible by Secure accesses. 

. CNTNSAR.NS<n> determines whether CNTVOFF<n> is accessible by Non-secure accesses. 

The register location of any unimplemented CNTVOFF<n> register in the CNTCTLBase frame is RAZ/WI. 
The CNTVOFF<n> register is accessible in the CNTBaseN frame using CNTVOFF. 


In an implementation that supports 64-bit atomic accesses, then the CNT VOFF<n> registers must be accessible as 
atomic 64-bit values. 
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CNTVOFF<n>[3 1:0] can be accessed through its memory-mapped interface: 








This interface is accessible as follows: 
° Accesses to CNTVOFF<n>[31:0] are RW. 


CNTVOFF<n>[63:32] can be accessed through its memory-mapped interface: 





Component Frame Offset Range 
Timer CNTCTLBase 0x080+8n 31:0 
Component Frame Offset Range 
Timer CNTCTLBase 0x084+8n 63:32 





This interface is accessible as follows: 


° Accesses to CNTVOFF<n>[63:32] are RW. 
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15.7.23 CounterlD<n>, Counter ID registers, n = 0 - 11 
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The CounterID<n> characteristics are: 


Purpose 


IMPLEMENTATION DEFINED identification registers 0 to 11 for the memory-mapped Generic Timer. 


Configurations 
The power domain of Counter[D<n> is IMPLEMENTATION DEFINED. 


For more information see Power and reset domains for the system level implementation of the 
Generic Timer on page 12-7015. 


These registers are implemented independently in each of the implemented Generic Timer 
memory-mapped frames. 


If the implementation of the Counter ID registers requires an architecture version, the value for this 
version of the Arm Generic Timer is version 0. 


The Counter ID registers can be implemented as a set of CoreSight ID registers, comprising 
Peripheral ID Registers and Component ID Registers. An implementation of these registers for the 
Generic Timer must use a Component class value of 0xF. 


Attributes 


CounterID<n> is a 32-bit register. 


Field descriptions 


The CounterID<n> bit assignments are: 


31 0 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


Accessing the CounterlD<n>: 


These registers must be implemented, as RO registers, in every implemented Generic Timer memory-mapped 
frame. 


For the CNTCTLBase frame, in a system that recognizes two Security states these registers are accessible by both 
Secure and Non-secure accesses. 


For the CNTControlBase frame, in a system that supports Secure and Non-secure memory maps the frame is 
implemented only in the Secure memory map, meaning these registers are implemented only in the Secure memory 
map. 


For the CNTBaseN frames, CNTCTLBase status and control fields for the CNTBaseN and CNTELOBaseN frames 
on page 12-7023 describes the status fields that identify whether a frame is implemented, and for an implemented 
frame: 


: Whether the CNTBaseN frame has virtual timer capability. 
: Whether the corresponding CNTELOBaseN frame is implemented. 


è For an implementation that recognizes two Security states, whether the CNTBaseN frame, and any 
corresponding CNTELOBaseN frame, is accessible by Non-secure accesses. 
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CounterID<n> can be accessed through its memory-mapped interface: 





Component Frame Offset Instance 


Timer CNTControlBase @xFD@+4n Counter[D<n> 





This interface is accessible as follows: 
è Accesses to this register are RO. 


CounterID<n> can be accessed through its memory-mapped interface: 





Component Frame Offset Instance 


Timer CNTReadBase 0xFD@+4n CounterID<n> 





This interface is accessible as follows: 
° Accesses to this register are RO. 


CounterID<n> can be accessed through its memory-mapped interface: 





Component Frame Offset Instance 


Timer CNTBaseN  0xFD@+4n CounterID<n> 





This interface is accessible as follows: 
° Accesses to this register are RO. 


CounterID<n> can be accessed through its memory-mapped interface: 





Component Frame Offset Instance 


Timer CNTELOBaseN 0xFD0+4n Counter[D<n> 





This interface is accessible as follows: 
° Accesses to this register are RO. 


CounterID<n> can be accessed through its memory-mapped interface: 








Component Frame Offset Instance 
Timer CNTCTLBase @0xFD0+4n Counter[D<n> 
This interface is accessible as follows: 
> Accesses to this register are RO. 
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15.8 RAS Registers 
15.8 RAS Registers 
This section describes the RAS registers. 
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15.8.1 ERRCIDRO, Component Identification Register 0 
The ERRCIDRO characteristics are: 


Purpose 
Provides discovery information for the component. 


Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRCIDRO 
are RESO. 


Attributes 
ERRCIDR0O is a 32-bit register. 


Field descriptions 


The ERRCIDRO bit assignments are: 


31 8 7 0 


RESO PRMBL_O 


Bits [31:8] 
Reserved, RESO. 
PRMBL 0, bits [7:0] 


Component identification preamble, segment 0. This field reads as x@D. 


Accessing the ERRCIDRO: 


ERRCIDRO can be accessed through its memory-mapped interface: 





Component Offset Instance 


RAS OxFFO ERRCIDRO 





This interface is accessible as follows: 


° Accesses to this register are RO. 
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15.8.2 ERRCIDR1, Component Identification Register 1 


The ERRCIDR1 characteristics are: 


Purpose 
Provides discovery information for the component. 
Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRCIDR1 
are RESO. 
Attributes 


ERRCIDRI is a 32-bit register. 


Field descriptions 


The ERRCIDR1 bit assignments are: 


31 8 7 43 0 
RESO CLASS | PRMBL_1 
Bits [31:8] 


Reserved, RESO. 


CLASS, bits [7:4] 
Component class. 
Qb1111 Generic peripheral with IMPLEMENTATION DEFINED register layout. 


This field reads as OxF. 
Other values are defined by the CoreSight Architecture. 


PRMBL 1, bits [3:0] 


Component identification preamble, segment 1. This field reads as 0x0. 


Accessing the ERRCIDR1: 


ERRCIDRI can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxFF4 ERRCIDRI1 
This interface is accessible as follows: 
è Accesses to this register are RO. 
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15.8.3 ERRCIDR2, Component Identification Register 2 
The ERRCIDR2 characteristics are: 


Purpose 
Provides discovery information for the component. 


Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRCIDR2 
are RESO. 


Attributes 
ERRCIDR2 is a 32-bit register. 


Field descriptions 


The ERRCIDR2 bit assignments are: 


31 8 7 0 


RESO PRMBL_2 


Bits [31:8] 
Reserved, RESO. 
PRMBL 2, bits [7:0] 


Component identification preamble, segment 2. This field reads as 0x05. 


Accessing the ERRCIDR2: 


ERRCIDR2 can be accessed through its memory-mapped interface: 





Component Offset Instance 


RAS OxFF8 ERRCIDR2 





This interface is accessible as follows: 


° Accesses to this register are RO. 
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15.8.4 ERRCIDR3, Component Identification Register 3 


The ERRCIDR3 characteristics are: 


Purpose 
Provides discovery information for the component. 
Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRCIDR3 
are RESO. 
Attributes 


ERRCIDR3 is a 32-bit register. 


Field descriptions 


The ERRCIDR3 bit assignments are: 


31 8 7 0 
RESO PRMBL_3 
Bits [31:8] 


Reserved, RESO. 
PRMBL 3, bits [7:0] 


Component identification preamble, segment 3. This field reads as 0xB1. 


Accessing the ERRCIDR3: 


ERRCIDR3 can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxFFC ERRCIDR3 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.8.5 ERRCRICRO, Critical Error Interrupt Configuration Register 0 
The ERRCRICRO characteristics are: 
Purpose 
Interrupt configuration register. 
Configurations 
External register ERRCRICRO is architecturally mapped to External register ERRIRQCR<n>. 
RW fields in this register reset to architecturally UNKNOWN values. 
This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERRCRICRO are RESO. 
Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 
Attributes 


ERRCRICRO is a 64-bit register. 


Field descriptions 


The ERRCRICRO bit assignments are: 


63 56 55 21 0 


RESO ADDR 


a 


Bits [63:56] 


Reserved, RESO. 


ADDR, bits [55:2] 
Message Signaled Interrupt address. 
Specifies the address that the component writes to when signaling an interrupt. 


The size of a physical address is IMPLEMENTATION DEFINED. Unimplemented high-order physical 
address bits are RESO. 


The following resets apply: 
a On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [1:0] 


Reserved, RESO. 


Accessing the ERRCRICRO: 


ERRCRICRO can be accessed through its memory-mapped interface: 





Component Offset Instance 


RAS OxEAO ERRCRICRO 
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This interface is accessible as follows: 
s Accesses to this register are RW. 
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15.8.6 ERRCRICR1, Critical Error Interrupt Configuration Register 1 


The ERRCRICR1 characteristics are: 


Purpose 
Interrupt configuration register. 

Configurations 
External register ERRCRICR1[31:0] is architecturally mapped to External register 
ERRIRQCR<n>[3 1:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERRCRICRI are RESO. 
Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 

Attributes 


ERRCRICR1 is a 32-bit register. 


Field descriptions 


The ERRCRICRI bit assignments are: 


31 0 


DATA 


DATA, bits [31:0] 
Payload for a message signaled interrupt. 


The following resets apply: 
- On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 


. On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the ERRCRICR1: 


ERRCRICRI can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxEA8 ERRCRICRI 
This interface is accessible as follows: 
s Accesses to this register are RW. 
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15.8.7 ERRCRICRz2, Critical Error Interrupt Configuration Register 2 


ARM DDI 0487E.a 
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The ERRCRICR2 characteristics are: 


Purpose 


Interrupt configuration register. 


Configurations 


External register ERRCRICR2[31:0] is architecturally mapped to External register 
ERRIRQCR<n>[63:32]. 


Some or all RW fields of this register have defined reset values. 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERRCRICR2 are RESO. 


Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 

Attributes 
ERRCRICR2 is a 32-bit register. 


Field descriptions 


The ERRCRICR2 bit assignments are: 


31 8765 4 3 0 


RESO | fs] MemAttr 
| Se 
IRQEN 


Bits [31:8] 


Reserved, RESO. 


IRQEN, bit [7] 
Message Signaled Interrupt enable. 
Enables generation of message signaled interrupts. 
Qbe Message signaled interrupts are disabled. 
Qb1 Message signaled interrupts are enabled. 
If the component does not support disabling message signaled interrupts, this bit is RESO. 


The following resets apply: 
. On a Error recovery reset, this field resets to 0. 
. On a Cold reset, this field resets to 0. 


NSMSI, bit [6] 
Security attribute. 
Defines the physical address space for message signaled interrupts. 
0bd Physical address space for message signaled interrupts is Secure. 
Qb1 Physical address space for message signaled interrupts is Non-secure. 


If the component prohibits Non-secure writes and does not support configuring the Security 
attribute, then the Security attribute for message signaled interrupts is IMPLEMENTATION DEFINED. 
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SH, bits [5:4] 


If the component allows Non-secure writes, then the Security attribute used for message signaled 
interrupts is Non-secure. 


This bit is RESO if any of the following are true: 
° The component allows Non-secure writes. 
° The component does not support configuring the Security attribute. 


On a Cold reset, this field resets to an IMPLEMENTATION DEFINED value. 


Shareability. 

Defines the Shareability domain for message signaled interrupts. 

0b00 Message signaled interrupts are in the Not shared Shareability domain. 

0b10 Message signaled interrupts are in the Outer Shareable Shareability domain. 
0b11 Message signaled interrupts are in the Inner Shareable Shareability domain. 


If the component does not support configuring the Shareability domain, this field is RES0, meaning 
the Shareability domain for message signaled interrupts is IMPLEMENTATION DEFINED. 

The following resets apply: 

° On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


MemAttr, bits [3:0] 


Memory type. 


Defines the memory type for message signaled interrupts. The values which correspond to each 
memory type are: 


0b0000 Device-nGnRnE. 

0b0001 Device-nGnRE. 

0b0010 Device-nGRE. 

0b0011 Device-GRE. 

0b0101 Outer Non-cacheable, Inner Non-cacheable. 

0b0110 Outer Non-cacheable, Inner Write-Through Cacheable. 

0b0111 Outer Non-cacheable, Inner Write-Back Cacheable. 

0b1001 Outer Write-Through Cacheable, Inner Non-cacheable. 

0b1010 Outer Write-Through Cacheable, Inner Write-Through Cacheable. 
0b1011 Outer Write-Through Cacheable, Inner Write-Back Cacheable. 
0b1101 Outer Write-Back Cacheable, Inner Non-cacheable. 

0b1110 Outer Write-Back Cacheable, Inner Write-Through Cacheable. 
Qb1111 Outer Write-Back Cacheable, Inner Write-Back Cacheable. 


If the component does not support configuring the memory type, this field is RESO, meaning the 
memory type used for message signaled interrupts is IMPLEMENTATION DEFINED. 


Note 
This is the same format as the VMSAv8-64 stage 2 memory region attributes. 








The following resets apply: 


° On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


External System Control Register Descriptions 
15.8 RAS Registers 


Accessing the ERRCRICR2: 


ERRCRICR2 can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS QxEAC ERRCRICR2 
This interface is accessible as follows: 
° Accesses to this register are RW. 
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15.8.8 


ERRDEVAFF, Device Affinity Register 


The ERRDEVAFF characteristics are: 


Purpose 
For a group that has affinity with a single PE or cluster of PEs, ERRDEVAFF is a copy of 
MPIDR_ELI or part of MPIDR_EL1: 
: Ifthe group of error records has affinity with a single PE, the affinity level is 0, ERRDEVAFF 
reads the same value as MPIDR_EL1, and ERRDEVAFF.FOV reads-as-one to indicate 
affinity level 0. 
$ If the group of error records has affinity with a cluster of PEs, the affinity level is 1, 2, or 3, 
parts of ERRDEVAFF reads the same value as parts of MPIDR_EL1, and the rest of 
ERRDEVAFF indicates the level. 
For example, if the affinity level is 2 then all of the following are true: 
- The group of error records has affinity with all PEs in the system that have the same value in 
MPIDR_EL1.{Aff3,Aff2}. 
è ERRDEVAFF. {Aff3,Aff2} reads the same value as MPIDR_EL1.{Aff3,Aff2}. 
- ERRDEVAFF.Aff1 reads as 0x80 and ERRDEVAFF. {Aff0,FOV} read-as-zero, to indicate 
affinity level 2. 
Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRDEVAFF 
are RESO. 
Present only if a group has affinity with a PE or cluster of PEs, and otherwise RESO. 
Attributes 


ERRDEVAFF is a 64-bit register. 


Field descriptions 


The ERRDEVAFF bit assignments are: 


40 39 32 31 30 29 25 24 23 1615 8 7 0 


Aff3 it RESO Aff2 Aff1 AffO 


FOV ee Po MT 


15-7210 


Bits [63:40] 


Reserved, RESO. 


Aff3, bits [39:32] 


FOV, bit [31] 


Affinity level 3. The MPIDR_EL1.Aff3 field, viewed from the highest Exception level of the 
associated PE or PEs. 


Indicates that the ERRDEVAFF.Aff0 field is valid. 


Qbd ERRDEVAFF.Aff0 is not valid, and the PE affinity level is 1, 2 or 3. 
Qb1 ERRDEVAFF.Aff0 is valid, and the PE affinity level is 0. 
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U, bit [30] 
Uniprocessor. The MPIDR_EL1.U bit viewed from the highest Exception level of the associated 
PE. 
0b0 The PE is part of a multiprocessor system. 
Qb1 The PE is part of a uniprocessor system. 


If ERRDEVAFF.Aff0 is not valid, this bit is not valid and reads as UNKNOWN. 
Bits [29:25] 
Reserved, RESO. 
MT, bit [24] 
Multithreaded. The MPIDR_EL1.MT bit viewed from the highest Exception level of the associated 


PE. 
Qbd Performance of PEs at the lowest affinity level is largely independent. 
Qb1 Performance of PEs at the lowest affinity level is very interdependent. 


If ERRDEVAFF.Aff0 is not valid, this bit is not valid and reads as UNKNOWN. 


Aff2, bits [23:16] 
Affinity level 2. 


When the PE affinity level is 0, 1, or 2, this field is the MPIDR_EL1.Aff2 field viewed from the 
highest Exception level of the associated PE or PEs. 


When the PE affinity level is 3, this field indicates that ERRDEVAFF.Aff3 field is valid, and the 
following values are defined: 


0x80 ERRDEVAFF.Aff3 is valid, and the PE affinity level is 3. 
This field reads as 0x80. 


All other values are reserved. 


Aff, bits [15:8] 
Affinity level 1. 


When the PE affinity level is 0 or 1, this field is the MPIDR_EL1.Aff1 field viewed from the highest 
Exception level of the associated PE or PEs. 


When the PE affinity level is 2 or 3, this field indicates that ERRDEVAFF. Aff2 is valid, and the 
following values are defined: 


0x00 ERRDEVAFF.Aff2 is not valid, and the PE affinity level is 3. 
0x80 ERRDEVAFF.Aff2 is valid, and the PE affinity level is 2. 


All other values are reserved. 


Aff0, bits [7:0] 
Affinity level 0. 


When the PE affinity level is 0, this field is the MPIDR_EL1.Aff0 field viewed from the highest 
Exception level of the associated PE or PEs. 


When the PE affinity level is 1, 2 or 3, this field indicates that ERRDEVAFF.Aff1 is valid, and the 
following values are defined: 


0x00 ERRDEVAFF.Aff1 is not valid, and the PE affinity level is 2 or 3. 
0x80 ERRDEVAFF.Aff1 is valid, and the PE affinity level is 1. 


All other values are reserved. 
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15.8 RAS Registers 
Accessing the ERRDEVAFF: 
ERRDEVAFF can be accessed through its memory-mapped interface: 
Component Offset Instance 
RAS OxFA8 ERRDEVAFF 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.8.9 ERRDEVARCH, Device Architecture Register 


The ERRDEVARCH characteristics are: 


Purpose 
Provides discovery information for the component. 

Configurations 
This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERRDEVARCH are UNDEFINED. 

Attributes 


ERRDEVARCH is a 32-bit register. 


Field descriptions 


The ERRDEVARCH bit assignments are: 


31 21 20 19 1615 12 11 0 


ARCHITECT hi REVISION | ARCHVER ARCHPART 


PRESENT E 


ARM DDI 0487E.a 
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ARCHITECT, bits [31:21] 


Architect. 
Defines the architect of the component. Bits [31:28] are the JEP 106 continuation code (JEP106 bank 
ID, minus 1) and bits [27:21] are the JEP106 ID code. 


0b01000111011 JEP106 continuation code 0x4, ID code 0x3B. Arm Limited. 
This field reads as 0x23B. 
Other values are defined by the JEDEC JEP 106 standard. 


PRESENT, bit [20] 
DEVARCH Present. 
Defines that the DEVARCH register is present. 


Ob Device Architecture information not present. 
Qb1 Device Architecture information present. 
This bit is RAO. 


REVISION, bits [19:16] 
Revision. 
Defines the architecture revision of the component. The defined values of this field are: 
0b0000 RAS System Architecture v1.0. 
0b0001 RAS System Architecture v1.1. As @b0000 and also: 
° Simplifies ERR<n>STATUS. 
° Adds support for additional ERR<n>MISC<m> registers. 
° Adds support for the optional RAS Timestamp Extension. 
° Adds support for the optional RAS Common Fault Injection Model Extension. 


All other values are reserved. 
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ARCHVER, bits [15:12] 
Architecture Version. 
Defines the architecture version of the component. The defined values of this field are: 
0b0000 RAS System Architecture v1. 
This field reads as 0b0000. 
All other values are reserved. 
ARCHVER and ARCHPART are also defined as a single field, ARCHID, so that ARCHVER is 
ARCHID[15:12]. 
ARCHPART, bits [11:0] 
Architecture Part. 
Defines the architecture of the component. 
OxAG0 RAS system architecture. 
This register reads as 0xAQ0. 


ARCHVER and ARCHPART are also defined as a single field, ARCHID, so that ARCHPART is 
ARCHID[11:0]. 


Accessing the ERRDEVARCH: 


ERRDEVARCH can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS @xFBC ERRDEVARCH 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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ERRDEVID, Device Configuration Register 
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The ERRDEVID characteristics are: 


Purpose 
Provides discovery information for the component. 

Configurations 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRDEVID 
are UNDEFINED. 

Attributes 


ERRDEVID is a 32-bit register. 


Field descriptions 


The ERRDEVID bit assignments are: 


31 16 15 0 


RESO NUM 


Bits [31:16] 
Reserved, RESO. 
NUM, bits [15:0] 


Highest numbered index of the error records in this group, plus one. Each implemented record is 
owned by a node. A node might own multiple records. 


This manual describes the memory-mapped view of a group with up to 56 records, the most that can 
be contained in a 4KB component, meaning the highest possible value for this field is 56. 


This field reads as an IMPLEMENTATION DEFINED value. 


Accessing the ERRDEVID: 


ERRDEVID can be accessed through its memory-mapped interface: 





Component Offset Instance 


RAS OxFC8 ERRDEVID 





This interface is accessible as follows: 


° Accesses to this register are RO. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7215 


Non-Confidential 


External System Control Register Descriptions 


15.8 RAS Registers 
15.8.11 ERRERICRO, Error Recovery Interrupt Configuration Register 0 
The ERRERICRO characteristics are: 
Purpose 
Interrupt configuration register. 
Configurations 
External register ERRERICR0O is architecturally mapped to External register ERRIRQCR<n>. 
RW fields in this register reset to architecturally UNKNOWN values. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRERICRO 
are RESO. 
Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 
Attributes 


ERRERICR0O is a 64-bit register. 


Field descriptions 


The ERRERICRO bit assignments are: 


63 56 55 21 0 


RESO ADDR 


es 


Bits [63:56] 


Reserved, RESO. 


ADDR, bits [55:2] 
Message Signaled Interrupt address. 
Specifies the address that the component writes to when signaling an interrupt. 


The size of a physical address is IMPLEMENTATION DEFINED. Unimplemented high-order physical 
address bits are RESO. 


The following resets apply: 
a On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [1:0] 


Reserved, RESO. 


Accessing the ERRERICRO: 


ERRERICRO can be accessed through its memory-mapped interface: 





Component Offset Instance 


RAS QxE90 ERRERICRO 
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This interface is accessible as follows: 
s Accesses to this register are RW. 
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15.8.12 ERRERICR1, Error Recovery Interrupt Configuration Register 1 
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The ERRERICR1 characteristics are: 


Purpose 
Interrupt configuration register. 

Configurations 
External register ERRERICR1[31:0] is architecturally mapped to External register 
ERRIRQCR<n>[3 1:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRERICR1 
are RESO. 
Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 

Attributes 


ERRERICRI is a 32-bit register. 


Field descriptions 


The ERRERICR1 bit assignments are: 


31 0 


DATA 


DATA, bits [31:0] 
Payload for a message signaled interrupt. 


The following resets apply: 
- On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 


. On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the ERRERICR1: 


ERRERICR1 can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS QxE98 ERRERICRI1 
This interface is accessible as follows: 
s Accesses to this register are RW. 
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15.8.13 ERRERICR2, Error Recovery Interrupt Configuration Register 2 
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The ERRERICR2 characteristics are: 


Purpose 
Interrupt configuration register. 

Configurations 
External register ERRERICR2[31:0] is architecturally mapped to External register 
ERRIRQCR<n>[63:32]. 
Some or all RW fields of this register have defined reset values. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRERICR2 
are RESO. 
Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 

Attributes 


ERRERICR2 is a 32-bit register. 


Field descriptions 


The ERRERICR2 bit assignments are: 


31 8765 4 3 0 


RESO | fs] MemAttr 
| Se 
IRQEN 


Bits [31:8] 


Reserved, RESO. 


IRQEN, bit [7] 
Message Signaled Interrupt enable. 
Enables generation of message signaled interrupts. 
Qbe Message signaled interrupts are disabled. 
Qb1 Message signaled interrupts are enabled. 
If the component does not support disabling message signaled interrupts, this bit is RESO. 


The following resets apply: 
. On a Error recovery reset, this field resets to 0. 
. On a Cold reset, this field resets to 0. 


NSMSI, bit [6] 
Security attribute. 
Defines the physical address space for message signaled interrupts. 
0bd Physical address space for message signaled interrupts is Secure. 
Qb1 Physical address space for message signaled interrupts is Non-secure. 


If the component prohibits Non-secure writes and does not support configuring the Security 
attribute, then the Security attribute for message signaled interrupts is IMPLEMENTATION DEFINED. 
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SH, bits [5:4] 


If the component allows Non-secure writes, then the Security attribute used for message signaled 
interrupts is Non-secure. 


This bit is RESO if any of the following are true: 
° The component allows Non-secure writes. 
° The component does not support configuring the Security attribute. 


On a Cold reset, this field resets to an IMPLEMENTATION DEFINED value. 


Shareability. 

Defines the Shareability domain for message signaled interrupts. 

0b00 Message signaled interrupts are in the Not shared Shareability domain. 

0b10 Message signaled interrupts are in the Outer Shareable Shareability domain. 
0b11 Message signaled interrupts are in the Inner Shareable Shareability domain. 


If the component does not support configuring the Shareability domain, this field is RES0, meaning 
the Shareability domain for message signaled interrupts is IMPLEMENTATION DEFINED. 

The following resets apply: 

° On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


MemAttr, bits [3:0] 


Memory type. 


Defines the memory type for message signaled interrupts. The values which correspond to each 
memory type are: 


0b0000 Device-nGnRnE. 

0b0001 Device-nGnRE. 

0b0010 Device-nGRE. 

0b0011 Device-GRE. 

0b0101 Outer Non-cacheable, Inner Non-cacheable. 

0b0110 Outer Non-cacheable, Inner Write-Through Cacheable. 

0b0111 Outer Non-cacheable, Inner Write-Back Cacheable. 

0b1001 Outer Write-Through Cacheable, Inner Non-cacheable. 

0b1010 Outer Write-Through Cacheable, Inner Write-Through Cacheable. 
0b1011 Outer Write-Through Cacheable, Inner Write-Back Cacheable. 
0b1101 Outer Write-Back Cacheable, Inner Non-cacheable. 

0b1110 Outer Write-Back Cacheable, Inner Write-Through Cacheable. 
Qb1111 Outer Write-Back Cacheable, Inner Write-Back Cacheable. 


If the component does not support configuring the memory type, this field is RESO, meaning the 
memory type used for message signaled interrupts is IMPLEMENTATION DEFINED. 


Note 
This is the same format as the VMSAv8-64 stage 2 memory region attributes. 








The following resets apply: 


° On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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Accessing the ERRERICR2: 


ERRERICR2 can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxE9C ERRERICR2 
This interface is accessible as follows: 
° Accesses to this register are RW. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7221 


Non-Confidential 


External System Control Register Descriptions 
15.8 RAS Registers 


15.8.14 ERRFHICRO, Fault-Handling Interrupt Configuration Register 0 
The ERRFHICRO characteristics are: 


Purpose 


Interrupt configuration register. 


Configurations 
External register ERRFHICR0O is architecturally mapped to External register ERRIRQCR<n>. 
RW fields in this register reset to architecturally UNKNOWN values. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERRFHICRO 
are RESO. 


Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 


Attributes 
ERRFHICR0O is a 64-bit register. 


Field descriptions 


The ERRFHICRO bit assignments are: 


63 56 55 21 0 


RESO ADDR 


a 


Bits [63:56] 


Reserved, RESO. 


ADDR, bits [55:2] 
Message Signaled Interrupt address. 
Specifies the address that the component writes to when signaling an interrupt. 


The size of a physical address is IMPLEMENTATION DEFINED. Unimplemented high-order physical 
address bits are RESO. 


The following resets apply: 
a On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [1:0] 


Reserved, RESO. 


Accessing the ERRFHICRO: 


ERRFHICRO can be accessed through its memory-mapped interface: 





Component Offset Instance 


RAS OxE80 ERRFHICRO 
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This interface is accessible as follows: 
s Accesses to this register are RW. 
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15.8.15 ERRFHICR1, Fault-Handling Interrupt Configuration Register 1 


15-7224 


The ERRFHICR1 characteristics are: 


Purpose 
Interrupt configuration register. 

Configurations 
External register ERRFHICR1[31:0] is architecturally mapped to External register 
ERRIRQCR<n>{3 1:0]. 
RW fields in this register reset to architecturally UNKNOWN values. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRFHICR1 
are RESO. 
Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 

Attributes 


ERRFHICR1 is a 32-bit register. 


Field descriptions 


The ERRFHICR1 bit assignments are: 


31 0 


DATA 


DATA, bits [31:0] 
Payload for a message signaled interrupt. 


The following resets apply: 
- On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 


. On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the ERRFHICR1: 


ERRFHICR1 can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxE88 ERRFHICRI1 
This interface is accessible as follows: 
s Accesses to this register are RW. 
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15.8.16 ERRFHICR2, Fault-Handling Interrupt Configuration Register 2 
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The ERRFHICR2 characteristics are: 


Purpose 
Interrupt configuration register. 

Configurations 
External register ERRFHICR2[31:0] is architecturally mapped to External register 
ERRIRQCR<n>[63:32]. 
Some or all RW fields of this register have defined reset values. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRFHICR2 
are RESO. 
Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 

Attributes 


ERRFHICR2 is a 32-bit register. 


Field descriptions 


The ERRFHICR2 bit assignments are: 


31 8765 4 3 0 


RESO | fs] MemAttr 
| Se 
IRQEN 


Bits [31:8] 


Reserved, RESO. 


IRQEN, bit [7] 
Message Signaled Interrupt enable. 
Enables generation of message signaled interrupts. 
Qbe Message signaled interrupts are disabled. 
Qb1 Message signaled interrupts are enabled. 
If the component does not support disabling message signaled interrupts, this bit is RESO. 


The following resets apply: 
. On a Error recovery reset, this field resets to 0. 
. On a Cold reset, this field resets to 0. 


NSMSI, bit [6] 
Security attribute. 
Defines the physical address space for message signaled interrupts. 
0bd Physical address space for message signaled interrupts is Secure. 
Qb1 Physical address space for message signaled interrupts is Non-secure. 


If the component prohibits Non-secure writes and does not support configuring the Security 
attribute, then the Security attribute for message signaled interrupts is IMPLEMENTATION DEFINED. 
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15-7226 


SH, bits [5:4] 


If the component allows Non-secure writes, then the Security attribute used for message signaled 
interrupts is Non-secure. 


This bit is RESO if any of the following are true: 
° The component allows Non-secure writes. 
° The component does not support configuring the Security attribute. 


On a Cold reset, this field resets to an IMPLEMENTATION DEFINED value. 


Shareability. 

Defines the Shareability domain for message signaled interrupts. 

0b00 Message signaled interrupts are in the Not shared Shareability domain. 

0b10 Message signaled interrupts are in the Outer Shareable Shareability domain. 
0b11 Message signaled interrupts are in the Inner Shareable Shareability domain. 


If the component does not support configuring the Shareability domain, this field is RES0, meaning 
the Shareability domain for message signaled interrupts is IMPLEMENTATION DEFINED. 

The following resets apply: 

° On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


MemAttr, bits [3:0] 


Memory type. 


Defines the memory type for message signaled interrupts. The values which correspond to each 
memory type are: 


0b0000 Device-nGnRnE. 

0b0001 Device-nGnRE. 

0b0010 Device-nGRE. 

0b0011 Device-GRE. 

0b0101 Outer Non-cacheable, Inner Non-cacheable. 

0b0110 Outer Non-cacheable, Inner Write-Through Cacheable. 

0b0111 Outer Non-cacheable, Inner Write-Back Cacheable. 

0b1001 Outer Write-Through Cacheable, Inner Non-cacheable. 

0b1010 Outer Write-Through Cacheable, Inner Write-Through Cacheable. 
0b1011 Outer Write-Through Cacheable, Inner Write-Back Cacheable. 
0b1101 Outer Write-Back Cacheable, Inner Non-cacheable. 

0b1110 Outer Write-Back Cacheable, Inner Write-Through Cacheable. 
Qb1111 Outer Write-Back Cacheable, Inner Write-Back Cacheable. 


If the component does not support configuring the memory type, this field is RESO, meaning the 
memory type used for message signaled interrupts is IMPLEMENTATION DEFINED. 


Note 
This is the same format as the VMSAv8-64 stage 2 memory region attributes. 








The following resets apply: 


° On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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Accessing the ERRFHICR2: 


ERRFHICR2 can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxE8C ERRFHICR2 
This interface is accessible as follows: 
: Accesses to this register are RW. 
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15.8.17 ERRGSR, Error Group Status Register 
The ERRGSR characteristics are: 


Purpose 


ERRGSR shows the status for the records in the group. 


Configurations 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERRGSR are 
UNDEFINED. 


This manual describes the memory-mapped view of a group with up to 56 records, the most that can 
be contained in a 4KB component. Extra records might be added by increasing the page size and 
extending ERRGSR into multiple registers. 


Attributes 
ERRGSR is a 64-bit register. 


Field descriptions 


The ERRGSR bit assignments are: 


5 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 2019 18 17 16 15 14 13 12 1110 9 8 7 6543 2 1 0 





NNNM 


Te 
S1 
S2 
S3 
S4 
S5 
S6 
S7 
S8 
s9 
S10 
S11 
S12 
S13 
S14 
S15 
S16 
S17 
S18 
S19 
20 
21 
22 
23 
24 
$25 
S26 
S27 
$28 
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Bits [63:56] 
Reserved, RESO. 
S<m>, bit [m], for m = 0 to 55 
The status for Error Record <m>. A read-only copy of ERR<n>STATUS. V. 
Ob No error. 
Qb1 One or more errors. 


If the corresponding record is not implemented, or the corresponding record does not support this 
type of reporting, this bit is RESO. 


Accessing the ERRGSR: 


ERRGSR can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS QxE0O ERRGSR 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.8.18 


15-7230 


ERRIIDR, Implementation Identification Register 


The ERRIIDR characteristics are: 


Purpose 
Defines the implementer of the component. 
Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERRIIDR are RESO. 
Attributes 


ERRIIDR is a 32-bit register. 


Field descriptions 


The ERRIIDR bit assignments are: 


31 


20 19 1615 12 11 0 


ProductID Implementer 


ProductID, bits [31:20] 


IMPLEMENTATION DEFINED. 
Part number, bits [11:0]. The part number is selected by the designer of the component. 


If ERRPIDRO and ERRPIDRI are implemented, ERRPIDRO.PART_0 matches bits [7:0] of 
ERRIIDR.ProductID and ERRPIDR1.PART_1 matches bits [11:8] of ERRIIDR.ProductID. 


Variant, bits [19:16] 


IMPLEMENTATION DEFINED. 
Component major revision. 
This field distinguishes product variants or major revisions of the product. 


If ERRPIDR2 is implemented, ERRPIDR2.REVISION matches ERRIIDR. Variant. 


Revision, bits [15:12] 


IMPLEMENTATION DEFINED. 

Component minor revision. 

This field distinguishes minor revisions of the product. 

If ERRPIDR3 is implemented, ERRPIDR3.REVAND matches ERRIIDR. Revision. 


Implementer, bits [11:0] 


IMPLEMENTATION DEFINED. 


Contains the JEP 106 code of the company that implemented the RAS component. For an Arm 
implementation, this field has the value 0x43B. 


Bits [11:8] contain the JEP106 continuation code of the implementer, and bits [6:0] contain the 
JEP 106 identity code of the implementer. Bit 7 is RESO. 

If ERRPIDR4 is implemented, ERRPIDR2 is implemented, and ERRPIDR1 is implemented, 
ERRPIDR4.DES 2 matches bits [11:8] of ERRIIDR.Implementer, ERRPIDR2.DES_1 matches 
bits [6:4] of ERRHDR.Implementer, and ERRPIDR1.DES_0 matches bits [3:0] of 
ERRIIDR.Implementer. 
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Accessing the ERRIIDR: 


ERRIIDR can be accessed through its memory-mapped interface: 





Component Offset 





RAS QxE10 
This interface is accessible as follows: 
° Accesses to this register are RO. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7231 


Non-Confidential 


External System Control Register Descriptions 


15.8 RAS Registers 


15.8.19 


15-7232 


ERRIRQCR<n>, Generic Error Interrupt Configuration Register, n = 0 - 15 


The ERRIRQCR<n> characteristics are: 


Purpose 
The ERRIRQCR<n> registers are IMPLEMENTATION DEFINED interrupt configuration registers. 


The architecture provides a recommended format for the ERRIRQCR<n> registers. The registers 
provided by the recommended layout are: 


° ERRFHICRO, ERRFHICR1, and ERRFHICR2, the fault-handling interrupt configuration 
registers. ERRFHICR<m> maps to ERRIRQCRO and ERRIRQCRI. 


° ERRERICRO, ERRERICR1, and ERRERICR2, the error recovery interrupt configuration 
registers. ERRERICR<m> maps to ERRIRQCR2 and ERRIRQCR3. 


° If ARMv8.4-RAS is implemented, ERRCRICRO, ERRCRICR1, and ERRCRICR2, the 
critical error interrupt configuration registers. ERRFHICR<m> maps to ERRIRQCR4 and 
ERRIRQCRS. 


° ERRIRQSR, the error interrupt status register. ERRIRQSR maps to ERRIRQCR15. 


This register describes the generic IMPLEMENTATION DEFINED format of the interrupt configuration 
registers, when the recommended layout is not used. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


Present only if the interrupt configuration registers are implemented. Otherwise, this register is 
RESO. 


Attributes 
ERRIRQCR<n> is a 64-bit register. 


Field descriptions 


The ERRIRQCR<n> bit assignments are: 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED controls. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


Accessing the ERRIRQCR<n>: 


ERRIRQCR<n> can be accessed through its memory-mapped interface: 





Component Offset Instance 
RAS 0xE80 + 8n ERRIRQCR<n> 
This interface is accessible as follows: 
$ Accesses to this register are RW. 
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15.8.20 ERRIRQSR, Error Interrupt Status Register 


63 
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The ERRIRQSR characteristics are: 


Purpose 
Interrupt status register. 

Configurations 
External register ERRIRQSR is architecturally mapped to External register ERRIRQCR<n>. 
RW fields in this register reset to architecturally UNKNOWN values. 
Present only if interrupt configuration registers use the recommended format. Otherwise, this 
register is RESO. 

Attributes 


ERRIRQSR is a 64-bit register. 


Field descriptions 


The ERRIRQSR bit assignments are: 


Bits [63:6] 


6543210 


=—- FHI 
FHIERR 


ERI 
ERIERR 
CRI 
CRIERR 


RESO 


Reserved, RESO. 


CRIERR, bit [5] 


CRI, bit [4] 


Critical error interrupt error. 

0b0 Interrupt write has not returned an error since this bit was last cleared to 0. 
0b1 Interrupt write has returned an error since this bit was last cleared to 0. 
This bit is read/write-one-to-clear. 

The following resets apply: 


On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 
s On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Critical error interrupt write in progress. 

0b0 Interrupt write not in progress. 

Qb1 Interrupt write in progress. 

Software must not disable an interrupt whilst the write is in progress. 


This bit is read-only. 
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Note 
This bit does not indicate whether an interrupt is active, but rather whether a write triggered by the 
interrupt is in progress. 


To determine whether an interrupt is active, software must examine the individual ERR<n>STATUS 
registers. 





ERIERR, bit [3] 


ERI, bit [2] 


Error recovery interrupt error. 

Ob Interrupt write has not returned an error since this bit was last cleared to 0. 
Qb1 Interrupt write has returned an error since this bit was last cleared to 0. 
This bit read/write-one-to-clear. 


The following resets apply: 
° On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Error recovery interrupt write in progress. 

0b0 Interrupt write not in progress. 

Qb1 Interrupt write in progress. 

Software must not disable an interrupt whilst the write is in progress. 


This bit is read-only. 





Note 
This bit does not indicate whether an interrupt is active, but rather whether a write triggered by the 
interrupt is in progress. 


To determine whether an interrupt is active, software must examine the individual ERR<n>STATUS 
registers. 





FHIERR, bit [1] 


FHL, bit [0] 


Fault handling interrupt error. 

Qbd Interrupt write has not returned an error since this bit was last cleared to 0. 
Qb1 Interrupt write has returned an error since this bit was last cleared to 0. 
This bit read/write-one-to-clear. 


The following resets apply: 
° On a Error recovery reset, this field resets to an architecturally UNKNOWN value. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Fault handling interrupt write in progress. 

0b0ð Interrupt write not in progress. 

Qb1 Interrupt write in progress. 

Software must not disable an interrupt whilst the write is in progress. 


This bit is read-only. 


Note 


This bit does not indicate whether an interrupt is active, but rather whether a write triggered by the 
interrupt is in progress. 





Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


External System Control Register Descriptions 


15.8 RAS Registers 


To determine whether an interrupt is active, software must examine the individual ERR<n>STATUS 


registers. 





Accessing the ERRIRQSR: 


ERRIRQSR can be accessed through its memory-mapped interface: 





Component 


RAS 


Offset Instance 


OxEF8 ERRIRQSR 





This interface is accessible as follows: 


° Accesses to this register are RW. 
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15.8.21 


15-7236 


ERR<n>ADDR, Error Record Address Register, n = 0 - 65534 


The ERR<n>ADDR characteristics are: 


Purpose 


If an error has an associated address, then this must be written to the address register when the error 
is recorded. It is IMPLEMENTATION DEFINED how the recorded addresses map to the software-visible 
physical addresses. 


Software might have to reconstruct the actual physical addresses using the identity of the node and 
knowledge of the system. 


Configurations 


Attributes 


Some or all RW fields of this register have defined reset values. 


This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERR<n>ADDR are UNDEFINED. 


The number of error records that are implemented is IMPLEMENTATION DEFINED. 
If error record <n> is not implemented, ERR<n>ADDR is RESO. 


ERR<n>FR describes the features implemented by the node that owns error record <n>. <q> is the 
index of the first error record owned by the same node as error record <n>. If the node owns a single 
record, then q =n. 


ERR<n>ADDBR is a 64-bit register. 


Field descriptions 


The ERR<n>ADDR bit assignments are: 


63 62 61 60 59 


56 55 


0 
psa RESO PADDR 


ed 





NS, bit [63] 


SI, bit [62] 


Non-secure attribute. 


0b0 The address is Secure. 

Qb1 The address is Non-secure. 

The following resets apply: 

. This bit is preserved on an Error Recovery reset. 

š On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Secure Incorrect. 
Indicates whether the NS bit is valid. 


Qbd The NS bit is correct. That is, it matches the programmers' view of the Non-secure 
attribute for this recorded location. 


Qb1 The NS bit might not be correct, and might not match the programmers' view of the 
Non-secure attribute for the recorded location. 


It is IMPLEMENTATION DEFINED whether this bit is read-only or read/write. 
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The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


AI, bit [61] 
Address Incorrect. 


Indicates whether the PADDR field is a valid physical address that is known to match the 
programmers' view of the physical address for the recorded location. 


0b0ð The PADDR field is a valid physical address. That is, it matches the programmers' view 
of the physical address for the recorded location. 
Qb1 The PADDR field might not be a valid physical address, and might not match the 


programmers' view of the physical address for the recorded location. 
It is IMPLEMENTATION DEFINED whether this bit is read-only or read/write. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
VA, bit [60] 

Virtual Address. 

Indicates whether the PADDR field is a virtual address. 

Qbe The PADDR field is not a virtual address. 

Qb1 The PADDR field is a virtual address. 


No context information is provided for the virtual address. When this bit is set to 1, 
ERR<n>ADDR. {NS,SLAI} must read as {0,1,1}. 


Support for this bit is optional. If this bit is not implemented and the PADDR field is a virtual 
address, then ERR<n>ADDR. {NS,SI,A}} must read as {0,1,1}. 


It is IMPLEMENTATION DEFINED whether this bit is read-only or read/write. 


The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [59:56] 


Reserved, RESO. 


PADDR, bits [55:0] 
Physical Address. Address of the recorded location. 


Ifthe physical address size implemented by this component is smaller than the size of this field, then 
high-order bits are unimplemented and either RESO or have a fixed read-only IMPLEMENTATION 
DEFINED value. 


Low-order address bits might also be unimplemented and RESO, for example, if the physical address 
is always aligned to the size of a protection granule. 


The following resets apply: 
° This field is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the ERR<n>ADDR: 


ERR<n>ADDR ignores writes if ERR<n>STATUS.AV is set to 1. 
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15.8 RAS Registers 
ERR<n>ADDR can be accessed through its memory-mapped interface: 
Component Offset Instance 
RAS 0x018+64n ERR<n>ADDR 
This interface is accessible as follows: 
è Accesses to this register are RW. 
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15.8.22 ERR<n>CTLR, Error Record Control Register, n = 0 - 65534 


63 
| IMPLEMENTATION DEFINED RESO 
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The ERR<n>CTLR characteristics are: 


Purpose 


The error control register contains enable bits for the node that writes to this record, which: 
$ Enable error detection and correction. 

° Enable an error recovery interrupt. 

s Enable a fault handling interrupt. 

. Enable error recovery reporting as a read or write error response. 

a When ARMv.4-RAS is implemented, enable a critical error interrupt. 


For each bit, if the selected node does not support the feature, then the bit is RESO. The definition of 
each record is IMPLEMENTATION DEFINED. 


Configurations 


Attributes 


Some or all RW fields of this register have defined reset values. 
The number of error records that are implemented is IMPLEMENTATION DEFINED. 


If error record <n> is not implemented, or error record <n> is not the first error record owned by the 
node, ERR<n>CTLR is RESO. 


ERR<n>FR describes the features implemented by the node. 


ERR<n>CTLR is a 64-bit register. 


Field descriptions 


The ERR<n>CTLR bit assignments are: 


32 31 14131211109 8765 43 21 0 


| ED 
IMP DEF 


UE 
WUI 
WFI 

WUE 
CFI 
WCFI 
DUI 
WDUI 
RESO 





IMPLEMENTATION DEFINED, bits [63:32] 


Bits [31:14] 


IMPLEMENTATION DEFINED. 
Reserved for IMPLEMENTATION DEFINED controls. Must permit SBZP write policy for software. 


This field reads as an IMPLEMENTATION DEFINED value and writes to this field have 
IMPLEMENTATION DEFINED behavior. 


Reserved, RESO. 
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CI, bit [13] 
When ERR<n>FR.CI == 0610: 
Critical error interrupt enable. 
When enabled, the critical error interrupt is generated for a critical error condition. 


Ob Critical error interrupt not generated for critical errors. Critical errors are treated as 
Uncontained errors. 


Qb1 Critical error interrupt generated for critical errors. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


Bit [12] 


Reserved, RESO. 


WDUL bit [11] 
When ERR<n>FR.DUI == 0611: 
Error recovery interrupt for deferred errors on writes enable. 
When enabled, the error recovery interrupt is generated for all detected Deferred errors on writes. 
ObO Error recovery interrupt not generated for deferred errors on writes. 
0b1 Error recovery interrupt generated for deferred errors on writes. 


The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


DUI, bit [10] 
When ERR<n>FR.DUI == 0610: 


Error recovery interrupt for deferred errors enable. This control applies to errors arising from both 
reads and writes. 


When enabled, an error recovery interrupt is generated for all detected Deferred errors. 
ObO Error recovery interrupt not generated for deferred errors. 
0b1 Error recovery interrupt generated for deferred errors. 


The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 


The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When ERR<n>FR.DUI == 0b11: 
When ERR<n>FR.DUI == 0b11, this field is named RDUI. 
Error recovery interrupt for deferred errors on reads enable. 


When enabled, the error recovery interrupt is generated for all detected Deferred errors on reads. 


ObO Error recovery interrupt not generated for deferred errors on reads. 
0b1 Error recovery interrupt generated for deferred errors on reads. 
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The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


WCEL bit [9] 
When ERR<n>FR. CFI == 0b11: 
Fault handling interrupt for Corrected errors on writes enable. 
When enabled: 


° Ifthe node implements Corrected error counters, then the fault handling interrupt is generated 
when a counter overflows and the overflow bit for the counter is set to 1. For more 
information, see ERR<n>MISCO. 


° Otherwise, the fault handling interrupt is also generated for all detected Corrected errors on 
writes. 

ObO Fault handling interrupt not generated for Corrected errors on writes. 

Qb1 Fault handling interrupt generated for Corrected errors on writes. 


The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


CFI, bit [8] 
When ERR<n>FR.CFI == 0b10: 


Fault handling interrupt for Corrected errors enable. This control applies to errors arising from both 
reads and writes. 


When enabled: 


° Ifthe node implements Corrected error counters, then the fault handling interrupt is generated 
when a counter overflows and the overflow bit for the counter is set to 1. For more 
information, see ERR<n>MISCO. 


° Otherwise, the fault handling interrupt is generated for all detected Corrected errors. 
0b0 Fault handling interrupt not generated for Corrected errors. 
0b1 Fault handling interrupt generated for Corrected errors. 


The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 


The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When ERR<n>FR.CFI == 0b11: 
When ERR<n>FR.CFI == 0b11, this field is named RCFI. 


Fault handling interrupt for Corrected errors on reads enable. 
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When enabled: 


° Ifthe node implements Corrected error counters, then the fault handling interrupt is generated 
when a counter overflows and the overflow bit for the counter is set to 1. For more 
information, see ERR<n>MISCO. 


° Otherwise, the fault handling interrupt is generated for all detected Corrected errors on reads. 
ObO Fault handling interrupt not generated for Corrected errors on reads. 
0b1 Fault handling interrupt generated for Corrected errors on reads. 


The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


When ERR<n>FR. UE == 0b11: 


In-band Uncorrected error reporting on writes enable. 


When enabled, responses to writes that detect an Uncorrected error that cannot be deferred are 
signaled in-band as a detected Uncorrected error (External abort). 


ObO External abort response for Uncorrected errors disabled for writes. 
0b1 External abort response for Uncorrected errors enabled for writes. 


The following resets apply: 


. This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


When ERR<n>FR. FI == 0b11: 


Fault handling interrupt on writes enable. 
When enabled: 


° The fault handling interrupt is generated for all detected Deferred errors and Uncorrected 
errors on writes. 


° If the fault handling interrupt for Corrected errors control is not implemented: 


— Ifthe node implements Corrected error counters, then the fault handling interrupt is 
also generated when a counter overflows and the overflow bit for the counter is set to 
1. 


— Otherwise, the fault handling interrupt is also generated for all detected Corrected 
errors on writes. 


Qbd Fault handling interrupt disabled on writes. 
Qb1 Fault handling interrupt enabled on writes. 


The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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Otherwise: 


Reserved, RESO. 


WUL bit [5] 
When ERR<n>FR. UI == 0b11: 
Uncorrected error recovery interrupt on writes enable. 


When enabled, the error recovery interrupt is generated for all detected Uncorrected errors on writes 
that are not deferred. 


Qbo Error recovery interrupt disabled on writes. 
Qb1 Error recovery interrupt enabled on writes. 


The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 
UE, bit [4] 
When ERR<n>FR.UE == 0610: 
In-band Uncorrected error reporting enable. 


When enabled, responses to transactions that detect an Uncorrected error that cannot be deferred are 
signaled in-band as a detected Uncorrected error (External abort). 


0b0 External abort response for Uncorrected errors disabled. 
0b1 External abort response for Uncorrected errors enabled. 
Note 





This control applies to errors arising from both reads and writes. 





The following resets apply: 

° This bit is preserved on an Error Recovery reset. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
When ERR<n>FR.UE == 0611: 

When ERR<n>FR.UE == 0b11, this field is named RUE. 

In-band Uncorrected error reporting on reads enable. 


When enabled, responses to reads that detect an Uncorrected error that cannot be deferred are 
signaled in-band as a detected Uncorrected error (External abort). 


Qbe External abort response for Uncorrected errors disabled for reads. 
Qb1 External abort response for Uncorrected errors enabled for reads. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


FI, bit [3] 
When ERR<n>FR. FI == 0610: 
Fault handling interrupt enable. This control applies to errors arising from both reads and writes. 
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When enabled: 
° The fault handling interrupt is generated for all detected Deferred errors and Uncorrected 
errors. 
° If the fault handling interrupt for Corrected errors control is not implemented: 
— Ifthe node implements Corrected error counters, then the fault handling interrupt is 
also generated when a counter overflows and the overflow bit for the counter is set to 
1. 
— Otherwise, the fault handling interrupt is also generated for all detected Corrected 
errors. 
0b0 Fault handling interrupt disabled. 
Qb1 Fault handling interrupt enabled. 
The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 
The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
e On a Cold reset, this field resets to an architecturally UNKNOWN value. 
When ERR<n>FR. FI == 0b11: 
When ERR<n>FR.FI == 0b11, this field is named RFI. 
Fault handling interrupt on reads enable. 
When enabled: 
° The fault handling interrupt is generated for all detected Deferred errors and Uncorrected 
errors on reads. 
° If the fault handling interrupt for Corrected errors control is not implemented: 
— Ifthe node implements Corrected error counters, then the fault handling interrupt is 
also generated when a counter overflows and the overflow bit for the counter is set to 
1. 
— Otherwise, the fault handling interrupt is also generated for all detected Corrected 
errors on reads. 
0b0 Fault handling interrupt disabled on reads. 
0b1 Fault handling interrupt enabled on reads. 
The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 
The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 
Reserved, RESO. 
UI, bit [2] 
When ERR<n>FR. UI == 0b10: 
Uncorrected error recovery interrupt enable. This control applies to errors arising from both reads 
and writes. 
When enabled, the error recovery interrupt is generated for all detected Uncorrected errors that are 
not deferred. 
0bd Error recovery interrupt disabled. 
Qb1 Error recovery interrupt enabled. 
The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 
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The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


When ERR<n>FR. UI == 0611: 
When ERR<n>FR.UI == 0b11, this field is named RUI. 
Uncorrected error recovery interrupt on reads enable. 


When enabled, the error recovery interrupt is generated for all detected Uncorrected errors on reads 
that are not deferred. 


0b0 Error recovery interrupt disabled on reads. 
0b1 Error recovery interrupt enabled on reads. 


The interrupt is generated even if the error syndrome is discarded because the error record already 
records a higher priority error. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Otherwise: 


Reserved, RESO. 


IMPLEMENTATION DEFINED, bit [1] 
IMPLEMENTATION DEFINED. 
Reserved for IMPLEMENTATION DEFINED controls. Must permit SBZP write policy for software. 
This bit reads as an IMPLEMENTATION DEFINED value and writes to this bit have IMPLEMENTATION 
DEFINED behavior. 
ED, bit [0] 
When ERR<n>FR.ED == 0610: 
Error reporting and logging enable. 


When disabled, the node behaves as if error detection and correction are disabled, and no errors are 
recorded or signaled by the node. Arm recommends that, when disabled, correct error detection and 
correction codes are written for writes, unless disabled by an IMPLEMENTATION DEFINED control for 
error injection. 


Qbd Error reporting disabled. 
Qb1 Error reporting enabled. 


It is IMPLEMENTATION DEFINED whether the node fully disables error detection and correction when 
reporting is disabled. That is, even with error reporting disabled, the node might continue to silently 
correct errors. Uncorrectable errors might result in corrupt data being silently propagated by the 
node. 





Note 


If this node requires initialization after Cold reset to prevent signaling false errors, then Arm 
recommends this bit is set to 0 on Cold reset. This allows boot software to initialize a node without 
signaling errors. Software can enable error reporting after the node is initialized. If the Cold reset 
value is 1, the reset values of other controls in this register are IMPLEMENTATION DEFINED and 
should not be UNKNOWN. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an IMPLEMENTATION DEFINED value. 
Otherwise: 


Reserved, RESO. 
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15.8 RAS Registers 
Accessing the ERR<n>CTLR: 
ERR<n>CTLR can be accessed through its memory-mapped interface: 
Component Offset Instance 
RAS 0x008 + 64n ERR<n>CTLR 
This interface is accessible as follows: 
: Accesses to this register are RW. 
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15.8.23 ERR<n>FR, Error Record Feature Register, n = 0 - 65534 
The ERR<n>FR characteristics are: 


Purpose 


Defines whether <n> is the first record owned by a node. If <n> is the first record owned by the 
node, also defines which of the common architecturally-defined features are implemented by the 
node and, of the implemented features, which are software programmable. 


Configurations 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERR<n>FR 
are RESO. 


Present only if error record <n> is implemented. Otherwise, this register is RESO. 
The number of error records that are implemented is IMPLEMENTATION DEFINED. 
If <n> is the first error record owned by a node, then ERR<n>FR.ED != 0b00. 

If <n> is not the first error record owned by a node, then ERR<n>FR.ED == 0b00. 


Attributes 
ERR<n>FR is a 64-bit register. 


Field descriptions 


The ERR<n>FR bit assignments are: 


When ERR<n>FR.ED != 0b00: 


32 31, 26 25 24 23 22 21 20 19 18 17 16 15 14 12 11109 8 76543 2 1 0 


63 


a IMP DEF 
IMPLEMENTATION DEFINED, bits [63:32] 


IMPLEMENTATION DEFINED. 





Reserved for identifying IMPLEMENTATION DEFINED controls. 


This field reads as an IMPLEMENTATION DEFINED value. 
Bits [31:26] 
Reserved, RESO. 
TS, bits [25:24] 
When ARMV%8.4-RAS is implemented: 
Timestamp Extension. 


Indicates whether, for each error record <m> owned by this node, ERR<n>MISC3 is used as the 
timestamp register, and, if it is, the timebase used by the timestamp. 


0b00 The node does not support a timestamp register. 
0b01 The node implements a timestamp register. The timestamp uses the same timebase as 
the system Generic Timer. 
Note 





For an error record which has an affinity to a PE, this is the same timer that is visible 
through CNTPCT_ELO at the highest Exception level on that PE. 
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0b10 The node implements a timestamp register. The timebase for the timestamp is 
IMPLEMENTATION DEFINED. 


All other values are reserved. 
Otherwise: 


Reserved, RESO. 


CI, bits [23:22] 
Critical error interrupt. 


Indicates whether the critical error interrupt and associated controls are implemented. 


0b00 Does not support critical error interrupt. 
0b01 Critical error interrupt is supported and is always enabled. 
0b10 Critical error interrupt is supported and it can be enabled using associated controls. 


All other values are reserved. 


INJ, bits [21:20] 
When ARMV8.4-RAS is implemented: 
Fault Injection Extension. 
Indicates whether the RAS Common Fault Injection Model Extension is implemented. 
0b00 The node does not support the RAS Common Fault Injection Model Extension. 


0b01 The node implements the RAS Common Fault Injection Model Extension. See 
ERR<n>PFGF for more information. 


All other values are reserved. 
Otherwise: 


Reserved, RESO. 


CEO, bits [19:18] 
When ERR<n>FR.CEC != 0600: 
Corrected Error overwrite. 


Indicates the behavior when a second Corrected error is detected after a first Corrected error has 
been recorded by an error record <m> owned by the node. 


0b00 Counts Corrected errors if a counter is implemented. Keeps the previous error 
syndrome. If the counter overflows, or no counter is implemented, then 
ERR<n>STATUS.OF is set to 1. 


0b01 Counts Corrected errors. If ERR<n>STATUS.OF == 1 before the Corrected error is 
counted, then keeps the previous syndrome. Otherwise, the previous syndrome is 
overwritten. If the counter overflows, then ERR<n>STATUS.OF is setto 1. 


All other values are reserved. 
Otherwise: 
Reserved, RESO. 
DUI, bits [17:16] 
When ERR<n>FR.UI != 0b00: 
Error recovery interrupt for deferred errors. 


Indicates whether the node implements a control for enabling error recovery interrupts on deferred 


errors. 
0b00 Does not support feature. ERR<n>CTLR.DUI is RESO. 
0b10 Feature is controllable using ERR<n>CTLR.DUI. 
Qb11 Feature is controllable using ERR<n>CTLR.WDUI for writes and 
ERR<n>CTLR.RDUI for reads. 
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All other values are reserved. 
Otherwise: 


Reserved, RESO. 


RP, bit [15] 
When ERR<n>FR.CEC != 0600: 
Repeat counter. 


Indicates whether the node implements a repeat Corrected error counter in ERR<n>MISCO for each 
error record <m> owned by the node that implements a standard Corrected error counter. 


Qbd A single CE counter is implemented. 


Qb1 A first (repeat) counter and a second (other) counter are implemented. The repeat 
counter is the same size as the primary error counter. 


Otherwise: 


Reserved, RESO. 


CEC, bits [14:12] 
Corrected Error Counter. 


Indicates whether the node implements standard Corrected error counter (CE counter) mechanisms 
in ERR<n>MISCO for each error record <m> owned by the node that can record countable errors. 


0b000 Does not implement the standard Corrected error counter model. 
0b010 Implements an 8-bit Corrected error counter in ERR<n>MISCO0[39:32]. 
0b100 Implements a 16-bit Corrected error counter in ERR<n>MISC0[47:32]. 


All other values are reserved. 





Note 


Implementations might include other error counter models, or might include the standard model and 
not indicate this in ERR<n>FR. 





CFI, bits [11:10] 
When ERR<n>FR.FI != 0600: 
Fault handling interrupt for corrected errors. 


Indicates whether the node implements a control for enabling fault handling interrupts on corrected 


errors. 

0b00 Does not support feature. ERR<n>CTLR.CFI is RESO. 

0b10 Feature is controllable using ERR<n>CTLR.CFI. 

Qb11 Feature is controllable using ERR<n>CTLR.WCFI for writes and ERR<n>CTLR.RCFI 


for reads. 
All other values are reserved. 
Otherwise: 


Reserved, RESO. 
UE, bits [9:8] 
In-band uncorrected error reporting. 


Indicates whether the node implements in-band uncorrected error reporting (External aborts), and, 
if so, whether the node implements controls for enabling and disabling the reporting. 


0b00 Does not support feature. ERR<n>CTLR.UE is RESO. 
QbO1 Feature always enabled. ERR<n>CTLR.UE is RESO. 
0b10 Feature is controllable using ERR<n>CTLR.UE. 
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Qb11 Feature is controllable using ERR<n>CTLR.WUE for writes and ERR<n>CTLR.RUE 
for reads. 
FI, bits [7:6] 
Fault handling interrupt. 


Indicates whether the node implements a fault handling interrupt, and, if so, whether the node 
implements controls for enabling and disabling the interrupt. 


0b00 Does not support feature. ERR<n>CTLR.FI is RESO. 

0b01 Feature always enabled. ERR<n>CTLR.FI is RESO. 

0b10 Feature is controllable using ERR<n>CTLR.FI. 

Qb11 Feature is controllable using ERR<n>CTLR. WFI for writes and ERR<n>CTLR.RFI for 
reads. 


UI, bits [5:4] 
Error recovery interrupt for uncorrected errors. 


Indicates whether the node implements an error recovery interrupt, and, if so, whether the node 
implements controls for enabling and disabling the interrupt. 


0b00 Does not support feature. ERR<n>CTLR.UI is RESO. 

0b01 Feature always enabled. ERR<n>CTLR.UI is RESO. 

0b10 Feature is controllable using ERR<n>CTLR.UI. 

Qb11 Feature is controllable using ERR<n>CTLR.WUI for writes and ERR<n>CTLR.RUI 
for reads. 


IMPLEMENTATION DEFINED, bits [3:2] 
IMPLEMENTATION DEFINED. 


This field reads as an IMPLEMENTATION DEFINED value. 


ED, bits [1:0] 
Error reporting and logging. 


Indicates whether <n> is the first record owned by the node, and, if it is, whether the node 
implements controls for enabling and disabling error reporting and logging. 


QbO1 Feature always enabled. ERR<n>CTLR.ED is RESO. 
0b10 Feature is controllable using ERR<n>CTLR.ED. 


The value 0b11 is reserved. 


When ERR<n>FR.ED == 0b00: 


63 2 1 0 


RESO 


Bits [63:2] 


Reserved, RESO. 


ED, bits [1:0] 
Error reporting and logging. 


Indicates whether <n> is the first record owned by the node, and, if it is, whether the node 
implements controls for enabling and disabling error reporting and logging. 


0bd0 Error record <n> is not the first record owned by the node. 
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15.8 RAS Registers 
Accessing the ERR<n>FR: 
ERR<n>FR can be accessed through its memory-mapped interface: 
Component Offset Instance 
RAS 0x000 + 64n ERR<n>FR 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.8.24 ERR<n>MISCO, Error Record Miscellaneous Register 0 


The ERR<n>MISCO characteristics are: 


Purpose 


IMPLEMENTATION DEFINED error syndrome register. The miscellaneous syndrome registers might 
contain: 


° A Corrected error counter or counters. 


° Information to identify the FRU in which the error was detected, and might contain enough 
information to locate the error within that FRU. 


° Other state information not present in the corresponding status and address registers. 


If the node <q> that owns error record <n> implements architecturally-defined error counters, so 
that ERR<n>FR.CEC != 0b00Q, and error record <n> can record countable errors, then 
ERR<n>MISCO implements the architecturally-defined error counter or counters. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv8, for the Armv8-A architecture profile. 


Configurations 


Attributes 


Some or all RW fields of this register have defined reset values. 
The number of error records that are implemented is IMPLEMENTATION DEFINED. 
If error record <n> is not implemented, ERR<n>MISCO is RESO. 


ERR<n>FR describes the features implemented by the node that owns error record <n>. <q> is the 
index of the first error record owned by the same node as error record <n>. If the node owns a single 
record, then q =n. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 





Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 





ERR<n>MISC0 is a 64-bit register. 


Field descriptions 


The ERR<n>MISCO bit assignments are: 


When ERR<q>FR.CEC == 0b000: 


63 


0 
IMPLEMENTATION DEFINED 
IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 
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IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


When ERR<q>FR.CEC == 06100 and ERR<q>FR.RP == 0: 


63 48 47 46 32 31 0 


IMPLEMENTATION DEFINED CEC IMPLEMENTATION DEFINED 


a E 


IMPLEMENTATION DEFINED, bits [63:48] 
IMPLEMENTATION DEFINED. 
IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 
OF, bit [47] 
Sticky overflow bit. 
Set to 1 when the Corrected error count field is incremented and wraps through zero. 
Obed Counter has not overflowed. 
Qb1 Counter has overflowed. 


A direct write that modifies this bit might indirectly set ERR<n>STATUS.OF to an UNKNOWN value 
and a direct write to ERR<n>STATUS.OF that clears it to zero might indirectly set this bit to an 
UNKNOWN value. 


The following resets apply: 
. This bit is preserved on an Error Recovery reset. 
è On a Cold reset, this field resets to an architecturally UNKNOWN value. 


CEC, bits [46:32] 


Corrected error count. 


Incremented for each Corrected error. It is IMPLEMENTATION DEFINED and might be 
UNPREDICTABLE whether Deferred and Uncorrected errors are counted. 


The following resets apply: 
* This field is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


When ERR<q>FR.CEC == 06010 and ERR<q>FR.RP == 0: 


63 40 39 38 32 31 0 


IMPLEMENTATION DEFINED CEC IMPLEMENTATION DEFINED 


——— o Oooo o o 
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IMPLEMENTATION DEFINED, bits [63:40] 


OF, bit [39] 


IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


Sticky overflow bit. 

Set to 1 when the Corrected error count field is incremented and wraps through zero. 
ObO Counter has not overflowed. 

Qb1 Counter has overflowed. 


A direct write that modifies this bit might indirectly set ERR<n>STATUS.OF to an UNKNOWN value 
and a direct write to ERR<n>STATUS.OF that clears it to zero might indirectly set this bit to an 
UNKNOWN value. 

The following resets apply: 

$ This bit is preserved on an Error Recovery reset. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


CEC, bits [38:32] 


Corrected error count. 


Incremented for each Corrected error. It is IMPLEMENTATION DEFINED and might be 
UNPREDICTABLE whether Deferred and Uncorrected errors are counted. 

The following resets apply: 

. This field is preserved on an Error Recovery reset. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bits [31:0] 


IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


When ERR<q>FR.CEC == 0b100 and ERR<q>FR.RP == 1: 


63 62 48 47 46 32 31 0 


OFO, bit [63] 


CECR IMPLEMENTATION DEFINED 


Sticky overflow bit, other. 

Set to 1 when the Corrected error count, other, field is incremented and wraps through zero. 
0bd Other counter has not overflowed. 

Qb1 Other counter has overflowed. 


A direct write that modifies this bit might indirectly set ERR<n>STATUS.OF to an UNKNOWN value 
and a direct write to ERR<n>STATUS.OF that clears it to zero might indirectly set this bit to an 
UNKNOWN value. 


The following resets apply: 


: This bit is preserved on an Error Recovery reset. 
$ On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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CECO, bits [62:48] 
Corrected error count, other. 


Incremented for each countable error that is not accounted for by incrementing 
ERR<n>MISCO.CECR. 


The following resets apply: 
: This field is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


OFR, bit [47] 
Sticky overflow bit, repeat. 
Set to 1 when the Corrected error count, repeat, field is incremented and wraps through zero. 
0b0 Repeat counter has not overflowed. 
0b1 Repeat counter has overflowed. 


A direct write that modifies this bit might indirectly set ERR<n>STATUS.OF to an UNKNOWN value 
and a direct write to ERR<n>STATUS.OF that clears it to zero might indirectly set this bit to an 
UNKNOWN value. 

The following resets apply: 

s This bit is preserved on an Error Recovery reset. 

- On a Cold reset, this field resets to an architecturally UNKNOWN value. 


CECR, bits [46:32] 
Corrected error count, repeat. 


Incremented for the first countable error, which also records other syndrome for the error, and 
subsequently for each countable error that matches the recorded other syndrome. Corrected errors 
are countable errors. It is IMPLEMENTATION DEFINED and might be UNPREDICTABLE whether 
Deferred and Uncorrected errors are countable errors. 


Note 


For example, the other syndrome might include the set and way information for an error detected in 
a cache. This might be recorded in the IMPLEMENTATION DEFINED ERR<n>MISC<m> fields on a 
first Corrected error. ERR<n>MISCO0.CECR is then incremented for each subsequent Corrected 
Error in the same set and way. 








The following resets apply: 
$ This field is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


When ERR<q>FR.CEC == 06010 and ERR<q>FR.RP == 1: 


63 48 4746 .. 40 39 38 |. 32 31 0 


IMPLEMENTATION DEFINED CECO CECR IMPLEMENTATION DEFINED 
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IMPLEMENTATION DEFINED, bits [63:48] 


OFO, bit [47] 


IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


Sticky overflow bit, other. 

Set to 1 when the Corrected error count, other, field is incremented and wraps through zero. 
0b0 Other counter has not overflowed. 

Qb1 Other counter has overflowed. 


A direct write that modifies this bit might indirectly set ERR<n>STATUS.OF to an UNKNOWN value 
and a direct write to ERR<n>STATUS.OF that clears it to zero might indirectly set this bit to an 
UNKNOWN value. 

The following resets apply: 

° This bit is preserved on an Error Recovery reset. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


CECO, bits [46:40] 


OFR, bit [39] 


Corrected error count, other. 


Incremented for each countable error that is not accounted for by incrementing 
ERR<n>MISC0.CECR. 


The following resets apply: 
° This field is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Sticky overflow bit, repeat. 

Set to 1 when the Corrected error count, repeat, field is incremented and wraps through zero. 
0bd Repeat counter has not overflowed. 

Qb1 Repeat counter has overflowed. 


A direct write that modifies this bit might indirectly set ERR<n>STATUS.OF to an UNKNOWN value 
and a direct write to ERR<n>STATUS.OF that clears it to zero might indirectly set this bit to an 
UNKNOWN value. 

The following resets apply: 

° This bit is preserved on an Error Recovery reset. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


CECR, bits [38:32] 


Corrected error count, repeat. 


Incremented for the first countable error, which also records other syndrome for the error, and 
subsequently for each countable error that matches the recorded other syndrome. Corrected errors 
are countable errors. It is IMPLEMENTATION DEFINED and might be UNPREDICTABLE whether 
Deferred and Uncorrected errors are countable errors. 


Note 


For example, the other syndrome might include the set and way information for an error detected in 
a cache. This might be recorded in the IMPLEMENTATION DEFINED ERR<n>MISC<m> fields on a 
first Corrected error. ERR<n>MISCO.CECR is then incremented for each subsequent Corrected 
Error in the same set and way. 





The following resets apply: 
° This field is preserved on an Error Recovery reset. 
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° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


IMPLEMENTATION DEFINED, bits [31:0] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


Accessing the ERR<n>MISCO: 
Arm recommends that a miscellaneous syndrome for multiple errors, such as a corrected error counter, is read/write. 


When ERR<n>STATUS.MV is set to 1, the miscellaneous syndrome for the most recently recorded error should 
ignore writes. 


ERR<n>MISC0 can be accessed through its memory-mapped interface: 








Component Offset Instance 
RAS 0x020 + 64n ERR<n>MISCO 
This interface is accessible as follows: 
G Accesses to this register are RW. 
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15.8.25 


15-7258 


ERR<n>MISC1, Error Record Miscellaneous Register 1, n = 0 - 65534 


The ERR<n>MISC1 characteristics are: 


Purpose 


IMPLEMENTATION DEFINED error syndrome register. The miscellaneous syndrome registers can 
contain: 


° A Corrected error counter or counters. 


° Information to identify the FRU in which the error was detected, and might contain enough 
information to locate the error within that FRU. 


° Other state information not present in the corresponding status and address registers. 


Configurations 


Attributes 


This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERR<n>MISC!1 are UNDEFINED. 


The number of error records that are implemented is IMPLEMENTATION DEFINED. 
If error record <n> is not implemented, ERR<n>MISC1 is RESO. 


ERR<n>FR describes the features implemented by the node that owns error record <n>. <q> is the 
index of the first error record owned by the same node as error record <n>. If the node owns a single 
record, then q =n. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 


Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 








ERR<n>MISC1 is a 64-bit register. 


Field descriptions 


The ERR<n>MISC1 bit assignments are: 


63 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 


IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


Accessing the ERR<n>MISC1: 


Arm recommends that a miscellaneous syndrome for multiple errors, such as a corrected error counter, is read/write. 
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When ERR<n>STATUS.MV is set to 1, the miscellaneous syndrome for the most recently recorded error should 
ignore writes. 


ERR<n>MISC1 can be accessed through its memory-mapped interface: 





Component Offset Instance 
RAS 0x028 + 64n ERR<n>MISC1 
This interface is accessible as follows: 
è Accesses to this register are RW. 
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15.8.26 


15-7260 


ERR<n>MISC2, Error Record Miscellaneous Register 2, n = 0 - 65534 


The ERR<n>MISC2 characteristics are: 


Purpose 


IMPLEMENTATION DEFINED error syndrome register. The miscellaneous syndrome registers can 
contain: 


° A Corrected error counter or counters. 


° Information to identify the FRU in which the error was detected, and might contain enough 
information to locate the error within that FRU. 


° Other state information not present in the corresponding status and address registers. 


Configurations 


Attributes 


This register is present only when ARMv8.4-RAS is implemented. Otherwise, direct accesses to 
ERR<n>MISC2 are RESO. 


The number of error records that are implemented is IMPLEMENTATION DEFINED. 
If error record <n> is not implemented, ERR<n>MISC2 is RESO. 


ERR<n>FR describes the features implemented by the node that owns error record <n>. <q> is the 
index of the first error record owned by the same node as error record <n>. If the node owns a single 
record, then q =n. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 


Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 








ERR<n>MISC2 is a 64-bit register. 


Field descriptions 


The ERR<n>MISC2 bit assignments are: 


63 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 


IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


Accessing the ERR<n>MISC2: 


Arm recommends that a miscellaneous syndrome for multiple errors, such as a corrected error counter, is read/write. 
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When ERR<n>STATUS.MV is set to 1, the miscellaneous syndrome for the most recently recorded error should 
ignore writes. 


ERR<n>MISC2 can be accessed through its memory-mapped interface: 





Component Offset Instance 
RAS 0x030 + 64n ERR<n>MISC2 
This interface is accessible as follows: 
è Accesses to this register are RW. 
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15.8.27 ERR<n>MISC3, Error Record Miscellaneous Register 3, n = 0 - 65534 


The ERR<n>MISC3 characteristics are: 


Purpose 


IMPLEMENTATION DEFINED error syndrome register. The miscellaneous syndrome registers can 
contain: 


° A Corrected error counter or counters. 


° Information to identify the FRU in which the error was detected, and might contain enough 
information to locate the error within that FRU. 


° Other state information not present in the corresponding status and address registers. 


If the node <q> that owns error record <n> supports the RAS Timestamp Extension, then 
ERR<n>MISC3 contains the timestamp value for error record <n> when the error was detected. 
Otherwise the contents of ERR<n>MISC3 are IMPLEMENTATION DEFINED. 


Configurations 


Attributes 


External register ERR<n>MISC3 is architecturally mapped to AArch64 System register 
ERXMISC3_EL1 when ERRSELR EL1.SEL == n. 


External register ERR<n>MISC3[31:0] is architecturally mapped to AArch32 System register 
ERXMISC6[31:0] when ERRSELR_EL1.SEL == n. 


External register ERR<n>MISC3[63:32] is architecturally mapped to AArch32 System register 
ERXMISC7[31:0] when ERRSELR_EL1.SEL =n. 


RW fields in this register reset to architecturally UNKNOWN values. 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERR<n>MISC3 are RESO. 


The number of error records that are implemented is IMPLEMENTATION DEFINED. 
If error record <n> is not implemented, ERR<n>MISC3 is RESO. 


ERR<n>FR describes the features implemented by the node that owns error record <n>. <q> is the 
index of the first error record owned by the same node as error record <n>. If the node owns a single 
record, then q =n. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 





Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 





ERR<n>MISC3 is a 64-bit register. 


Field descriptions 


The ERR<n>MISC3 bit assignments are: 


15-7262 
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When ERR<q>FR.TS != 0b00: 


TS 


TS, bits [63:0] 
Timestamp. 
Timestamp value recorded when the error was detected. Valid only if ERR<n>STATUS.V == 1. 
See ERR<n>FR.TS. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
Access to this field is RO or RW. 


When ERR<q>FR.TS == 0b00: 


IMPLEMENTATION DEFINED 


IMPLEMENTATION DEFINED, bits [63:0] 
IMPLEMENTATION DEFINED. 


IMPLEMENTATION DEFINED syndrome. This field reads as an IMPLEMENTATION DEFINED value and 
writes to this field have IMPLEMENTATION DEFINED behavior. 


Accessing the ERR<n>MISC3: 
Arm recommends that a miscellaneous syndrome for multiple errors, such as a corrected error counter, is read/write. 


When ERR<n>STATUS.MV is set to 1, the miscellaneous syndrome for the most recently recorded error should 
ignore writes. 


ERR<n>MISC3 can be accessed through its memory-mapped interface: 





Component Offset Instance 
RAS 0x038 + 64n ERR<n>MISC3 
This interface is accessible as follows: 
è Accesses to this register are RW. 
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15.8.28 


15-7264 


ERR<n>PFGCDN, Pseudo-fault Generation Countdown Register, n = 0 - 65534 


The ERR<n>PFGCDN characteristics are: 


Purpose 


Generates one of the errors enabled in the corresponding ERR<n>PFGCTL register. 


For details of this, see the Arm” Reliability, Availability, and Serviceability (RAS) Specification, 
Armv68, for the Armv8-A architecture profile. 


Configurations 


Attributes 


RW fields in this register reset to architecturally UNKNOWN values. 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERR<n>PFGCDN are RESO. 


Present only when the RAS Common Fault Injection Model Extension is implemented by this node 
so that ERR<n>FR.INJ != 0b00, error record <n> is implemented, and error record <n> is the first 
error record owned by a node. Otherwise, RESO. 


ERR<n>FR describes the features implemented by the node. 


ERR<n>PFGCDN is a 64-bit register. 


Field descriptions 


The ERR<n>PFGCDN bit assignments are: 


63 


Bits [63:32] 


32 31 0 


RESO CDN 


Reserved, RESO. 


CDN, bits [31:0] 


Countdown value. 

This field is copied to Error Generation Counter when either: 

$ Software writes ERR<n>PFGCTL.CDNEN with 1. 

. The Error Generation Counter decrements to zero and ERR<n>PFGCTL.R = 1. 


While ERR<n>PFGCTL.CDNEN == 1 and the Error Generation Counter is nonzero, the counter 
decrements by 1 for each cycle at an IMPLEMENTATION DEFINED clock rate. When the counter 
reaches 0, one of the errors enabled in the ERR<n>PFGCTL register is generated. 

Note 


The current Error Generation Counter value is not visible to software. 








On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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Accessing the ERR<n>PFGCDN: 
ERR<n>PFGCDN can be accessed through its memory-mapped interface: 

Component Offset Instance 

RAS 0x810 + 64n ERR<n>PFGCDN 
This interface is accessible as follows: 
: Accesses to this register are RW. 
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15.8.29 ERR<n>PFGCTL, Pseudo-fault Generation Control Register, n = 0 - 65534 


The ERR<n>PFGCTL characteristics are: 


Purpose 
Enables controlled fault generation. 

Configurations 
Some or all RW fields of this register have defined reset values. 
This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERR<n>PFGCTL are RESO. 
Present only when the RAS Common Fault Injection Model Extension is implemented by this node 
so that ERR<n>FR.INJ != 0b00, error record <n> is implemented, and error record <n> is the first 
error record owned by a node. Otherwise, RESO. 
ERR<n>FR describes the features implemented by the node. 

Attributes 


ERR<n>PFGCTL is a 64-bit register. 


Field descriptions 


The ERR<n>PFGCTL bit assignments are: 


32 31 30 29 131211109 8 76543 210 


63 
| RESO RESO 


CDNEN a = OF 


UC 
UEU 
UER 
UEO 

DE 

ER 

AV 

MV 





Bits [63:32] 


Reserved, RESO. 


CDNEN, bit [31] 


Countdown Enable. Controls transfers from the value that is held in the ERR<n>PFGCDN into the 
Error Generation Counter, and enables this counter. 


Qbd The Error Generation Counter is disabled. 


Qb1 The Error Generation Counter is enabled. On a write of 1 to this bit, the Error 
Generation Counter is set to ERR<n>PFGCDN.CDN. 


On a Cold reset, this field resets to 0. 


R, bit [30] 


Restart. Controls whether, on reaching zero, the Error Generation Counter restarts from the 
ERR<n>PFGCDN value, or stops. 


Ob On reaching 0, the Error Generation Counter stops. 


Qb1 On reaching 0, the Error Generation Counter is set to ERR<n>PFGCDN.CDN. 
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This bit is RESO if the node does not support this control. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [29:13] 


Reserved, RESO. 


MY, bit [12] 


Miscellaneous syndrome. The value that is written to ERR<n>STATUS.MV when an injected error 
is recorded. 


0bd ERR<n>STATUS.MV is set to 0 when an injected error is recorded. 
Qb1 ERR<n>STATUS.MV is set to 1 when an injected error is recorded. 


This bit reads-as-one if the node always records some syndrome in ERR<n>MISC<m>, setting 
ERR<n>STATUS.MV to 1, when an injected error is recorded. 


This bit is RESO if the node does not support this control. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
AV, bit [11] 
Address syndrome. The value that is written to ERR<n>STATUS.AV when an injected error is 


recorded. 

0bd ERR<n>STATUS.AV is set to 0 when an injected error is recorded. 

Qb1 ERR<n>STATUS.AV is set to 1 when an injected error is recorded, 

This bit reads-as-one if the node always sets ERR<n>STATUS.AV to 1 when an injected error is 
recorded. 


This bit is RESO if the node does not support this control. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


PN, bit [10] 
Poison flag. The value that is written to ERR<n>STATUS.PN when an injected error is recorded. 
0bd ERR<n>STATUS.PN is set to 0 when an injected error is recorded. 
Qb1 ERR<n>STATUS.PN is set to 1 when an injected error is recorded. 
This bit is RESO if the node does not support this control. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


ER, bit [9] 


Error Reported flag. The value that is written to ERR<n>STATUS.ER when an injected error is 
recorded. 


0bd ERR<n>STATUS.ER is set to 0 when an injected error is recorded. 
Qb1 ERR<n>STATUS.ER is set to 1 when an injected error is recorded. 
This bit is RESO if the node does not support this control. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


CI, bit [8] 


Critical Error flag. The value that is written to ERR<n>STATUS.CI when an injected error is 
recorded. 


0bd ERR<n>STATUS.CI is set to 0 when an injected error is recorded. 
Qb1 ERR<n>STATUS.CI is set to 1 when an injected error is recorded. 
This bit is RESO if the node does not support this control. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7267 
ID070919 Non-Confidential 


External System Control Register Descriptions 





15.8 RAS Registers 
CE, bits [7:6] 
Corrected Error generation enable. Controls the type of Corrected Error condition that might be 
generated. 
0b00 No error of this type is generated. 
0b01 A non-specific Corrected Error, that is, a Corrected Error that is recorded as 
ERR<n>STATUS.CE == 0b10, might be generated when the Error Generation Counter 
decrements to zero. 
0b10 A transient Corrected Error, that is, a Corrected Error that is recorded as 
ERR<n>STATUS.CE == 0b01, might be generated when the Error Generation Counter 
decrements to zero. 
0b11 A persistent Corrected Error, that is, a Corrected Error that is recorded as 
ERR<n>STATUS.CE == 0b11, might be generated when the Error Generation Counter 
decrements to zero. 
The set of permitted values for this field is defined by ERR<n>PFGF.CE. 
This field is RESO if the node does not support this control. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
DE, bit [5] 
Deferred Error generation enable. Controls whether this type of error condition might be generated. 
It is IMPLEMENTATION DEFINED whether the error is generated if the data is not consumed. 
0bd No error of this type is generated. 
Qb1 An error of this type might be generated when the Error Generation Counter decrements 
to zero. 
This bit is RESO if the node does not support this control. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
UEO, bit [4] 
Latent or Restartable Error generation enable. Controls whether this type of error condition might 
be generated. It is IMPLEMENTATION DEFINED whether the error is generated if the data is not 
consumed. 
0bd No error of this type is generated. 
Qb1 An error of this type might be generated when the Error Generation Counter decrements 
to zero. 
This bit is RESO if the node does not support this control. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
UER, bit [3] 
Signaled or Recoverable Error generation enable. Controls whether this type of error condition 
might be generated. It is IMPLEMENTATION DEFINED whether the error is generated if the data is not 
consumed. 
0bd No error of this type is generated. 
Qb1 An error of this type might be generated when the Error Generation Counter decrements 
to zero. 
This bit is RESO if the node does not support this control. 
On a Cold reset, this field resets to an architecturally UNKNOWN value. 
UEU, bit [2] 
Unrecoverable Error generation enable. Controls whether this type of error condition might be 
generated. It is IMPLEMENTATION DEFINED whether the error is generated if the data is not 
consumed. 
Qbd No error of this type is generated. 
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Qb1 An error of this type might be generated when the Error Generation Counter decrements 
to zero. 


This bit is RESO if the node does not support this control. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Uncontainable Error generation enable. Controls whether this type of error condition might be 
generated. It is IMPLEMENTATION DEFINED whether the error is generated if the data is not 
consumed. 


Qbd No error of this type is generated. 
Qb1 An error of this type might be generated when the Error Generation Counter decrements 
to zero. 


This bit is RESO if the node does not support this control. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Overflow flag. The value that is written to ERR<n>STATUS.OF when an injected error is recorded. 
0bd ERR<n>STATUS.OF is set to 0 when an injected error is recorded. 

Qb1 ERR<n>STATUS.OF is set to 1 when an injected error is recorded. 

This bit is RESO if the node does not support this control. 


On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the ERR<n>PFGCTL: 


ERR<n>PFGCTL can be accessed through its memory-mapped interface: 








Component Offset Instance 
RAS 0x808 + 64n ERR<n>PFGCTL 
This interface is accessible as follows: 
is Accesses to this register are RW. 
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15.8.30 ERR<n>PFGF, Pseudo-fault Generation Feature Register, n = 0 - 65534 
The ERR<n>PFGEF characteristics are: 
Purpose 
Defines which common architecturally-defined fault generation features are implemented. 


Configurations 


This register is present only when ARMV8.4-RAS is implemented. Otherwise, direct accesses to 
ERR<n>PFGF are RESO. 


Present only when the RAS Common Fault Injection Model Extension is implemented by this node 
so that ERR<n>FR.INJ != 0b00, error record <n> is implemented, and error record <n> is the first 
error record owned by a node. Otherwise, RESO. 


ERR<n>FR describes the features implemented by the node. 


Attributes 
ERR<n>PFGF is a 64-bit register. 


Field descriptions 


The ERR<n>PFGF bit assignments are: 


31 30 29 28 131211109 8 76543 210 


63 
| RESO | RESO 


SYN ee EE 





UEU 
UER 
UEO 
DE 
ER 
AV 
MV 


Bits [63:31] 


Reserved, RESO. 


R, bit [30] 
Restartable. Support for Error Generation Counter restart mode. 
Qbe The node does not support this feature. 
Qb1 Feature controllable. 


SYN, bit [29] 
Syndrome. Fault syndrome injection. 


Qbd When an injected error is recorded, the node sets ERR<n>STATUS. {IERR, SERR} to 
IMPLEMENTATION DEFINED values. ERR<n>STATUS. {IERR, SERR} are UNKNOWN 
when ERR<n>STATUS.V == 0. 


Qb1 When an injected error is recorded, the node does not update the 
ERR<n>STATUS. {IERR, SERR} fields. ERR<n>STATUS. {IERR, SERR} are 
writable when ERR<n>STATUS. V == 0. 
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Note 


If this bit is 1, software can write specific values into the ERR<n>STATUS. {IERR, SERR} fields 
when setting up a fault injection event. The sets of values that can be written to these fields is 
IMPLEMENTATION DEFINED. 








Reserved, RESO. 


Miscellaneous syndrome. 


Additional syndrome injection. Defines whether software can control all or part of the syndrome 
recorded in the ERR<n>MISC<m> registers when an injected error is recorded. 


It is IMPLEMENTATION DEFINED which syndrome fields in ERR<n>MISC<m> this refers to, as some 
fields might always be recorded by an error. For example, a Corrected Error counter. 


ObO When an injected error is recorded, the node might record IMPLEMENTATION DEFINED 
additional syndrome in ERR<n>MISC<m>. If any syndrome is recorded in 
ERR<n>MISC<m>, ERR<n>STATUS.MV is set to 1. 


Qb1 When an injected error is recorded, the node does not update all the syndrome fields in 
the ERR<n>MISC<m> and does one of: 


° The node does not update any fields in ERR<n>MISC<m> and sets 
ERR<n>STATUS.MV to ERR<n>PFGCTL.MV. 


° The node records some syndrome in ERR<n>MISC<m> and sets 
ERR<n>STATUS.MV to 1. ERR<n>PGFCTL.MV is RAO. 


The syndrome fields that the node does not update are unchanged and must be writable 
when ERR<n>STATUS.MV is set to 0. 


Note 


If this bit is 1, software can write specific values into the ERR<n>MISC<m> registers when setting 
up a fault injection event. The values that can be written to these registers are IMPLEMENTATION 
DEFINED. 








Address syndrome. Address syndrome injection. 


0bd When an injected error is recorded, the node either sets ERR<n>ADDR and 
ERR<n>STATUS.AV for the access, or leaves these unchanged. 

Qb1 When an injected error is recorded, the node does not update ERR<n>ADDR and does 
one of: 


° Sets ERR<n>STATUS.AV to ERR<n>PFGCTL.AV. 
° Sets ERR<n>STATUS.AV to 1. ERR<n>PFGCTL.AV is RAO. ERR<n>ADDR 
must be writable when ERR<n>STATUS.AV is set to 0. 
Note 


If this bit is 1, software can write a specific value into ERR<n>ADDR when setting up a fault 
injection event. 








Poison flag. Describes how the fault generation feature of the node sets the ERR<n>STATUS.PN 
status flag. 


Qbd When an injected error is recorded, it is IMPLEMENTATION DEFINED whether the node 
sets ERR<n>STATUS.PN to 1. 
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ER, bit [9] 


CI, bit [8] 


CE, bits [7:6] 


DE, bit [5] 


UEO, bit [4] 


Qb1 When an injected error is recorded, ERR<n>STATUS.PN is set to 
ERR<n>PFGCTL.PN. 


This behavior replaces the architecture-defined rules for setting the PN bit. 
This bit reads-as-zero if the node does not support this flag. 


Error Reported flag. Describes how the fault generation feature of the node sets the 
ERR<n>STATUS.ER status flag. 


ObO When an injected error is recorded, the node sets ERR<n>STATUS.ER according to the 
architecture-defined rules for setting the ER bit. 

Qb1 When an injected error is recorded, ERR<n>STATUS.ER is set to 
ERR<n>PFGCTL.ER. 


This behavior replaces the architecture-defined rules for setting the ER bit. 


This bit reads-as-zero if the node does not support this flag. 


Critical Error flag. Describes how the fault generation feature of the node sets the 
ERR<n>STATUS.CI status flag. 


Qbd When an injected error is recorded, it is IMPLEMENTATION DEFINED whether the node 
sets ERR<n>STATUS.CI to 1. 
Qb1 When an injected error is recorded, ERR<n>STATUS.CI is set to ERR<n>PFGCTL.CI. 


This behavior replaces the architecture-defined rules for setting the CI bit. 
This bit reads-as-zero if the node does not support this flag. 


Corrected Error generation. Describes the types of Corrected Error that the fault generation feature 
of the node can generate. 


0bd0 The fault generation feature of the node cannot generate this type of error. 

0b01 The fault generation feature of the node allows generation of a non-specific Corrected 
Error, that is, a Corrected Error that is recorded as ERR<n>STATUS.CE == 0b10. 

Qb11 The fault generation feature of the node allows generation of transient or persistent 
Corrected Errors, that is, Corrected Errors that are recorded as ERR<n>STATUS.CE == 
Qb01 and 0b11. 


All other values are reserved. 


This bit reads-as-zero if the node does not support this type of error. 


Deferred Error generation. Describes whether the fault generation feature of the node can generate 
this type of error. 


Ob The fault generation feature of the node cannot generate this type of error. 
Qb1 The fault generation feature of the node allows generation of this type of error. 


This bit reads-as-zero if the node does not support this type of error. 


Latent or Restartable Error generation. Describes whether the fault generation feature of the node 
can generate this type of error. 


Ob The fault generation feature of the node cannot generate this type of error. 
Qb1 The fault generation feature of the node allows generation of this type of error. 


This bit reads-as-zero if the node does not support this type of error. 
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Signaled or Recoverable Error generation. Describes whether the fault generation feature of the 
node can generate this type of error. 


Qbd The fault generation feature of the node cannot generate this type of error. 
Qb1 The fault generation feature of the node allows generation of this type of error. 


This bit reads-as-zero if the node does not support this type of error. 


Unrecoverable Error generation. Describes whether the fault generation feature of the node can 
generate this type of error. 


Qbd The fault generation feature of the node cannot generate this type of error. 
Qb1 The fault generation feature of the node allows generation of this type of error. 


This bit reads-as-zero if the node does not support this type of error. 


Uncontainable Error generation. Describes whether the fault generation feature of the node can 
generate this type of error. 


Qbd The fault generation feature of the node cannot generate this type of error. 
Qb1 The fault generation feature of the node allows generation of this type of error. 


This bit reads-as-zero if the node does not support this type of error. 


Overflow flag. Describes how the fault generation feature of the node sets the ERR<n>STATUS.OF 
status flag. 


Qbo When an injected error is recorded, the node sets ERR<n>STATUS.OF according to the 
architecture-defined rules for setting the OF bit. 

Qb1 When an injected error is recorded, ERR<n>STATUS.OF is set to 
ERR<n>PFGCTL.OF. This behavior replaces the architecture-defined rules for setting 
the OF bit. 


This bit reads-as-zero if the node does not support this flag. 


Accessing the ERR<n>PFGF: 


ERR<n>PFGF can be accessed through its memory-mapped interface: 








Component Offset Instance 
RAS 0x800 + 64n ERR<n>PFGF 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.8.31 ERR<n>STATUS, Error Record Primary Status Register, n = 0 - 65534 


The ERR<n>STATUS characteristics are: 


Purpose 


Contains status information for the error record, including: 

° Whether any error has been detected (valid). 

° Whether any detected error was not corrected, and returned to a master. 
° Whether any detected error was not corrected and deferred. 


° Whether an error record has been discarded because additional errors have been detected 
before the first error was handled by software (overflow). 


° Whether any error has been reported. 
° Whether the other error record registers contain valid information. 


. Whether the error was recorded because poison data was detected or because a corrupt value 
was detected by an error detection code. 


° A primary error code. 

e An IMPLEMENTATION DEFINED extended error code. 

Within this register: 

° The {AV, V, MV} bits are valid bits that define whether the error record registers are valid. 
° The {UE, OF, CE, DE, UET} bits encode the type of error or errors recorded. 

. The {CI, ER, PN, IERR, SERR} fields are syndrome fields. 


Configurations 


Attributes 


Some or all RW fields of this register have defined reset values. 


This register is present only when RAS is implemented. Otherwise, direct accesses to 
ERR<n>STATUS are UNDEFINED. 


The number of error records that are implemented is IMPLEMENTATION DEFINED. 
If error record <n> is not implemented, ERR<n>STATUS is RESO. 


ERR<n>FR describes the features implemented by the node that owns error record <n>. <q> is the 
index of the first error record owned by the same node as error record <n>. If the node owns a single 
record, then q =n. 


For IMPLEMENTATION DEFINED fields in this register, writing zero must always be supported to 
return the error record to an initial state. 


In particular, if any IMPLEMENTATION DEFINED syndrome fields might generate a Fault Handling or 
Error Recovery Interrupt request, writing zero is sufficient to deactivate the Interrupt request. 


Fields that are read-only, non-zero and ignore writes are compliant with this requirement. 


Note 


Arm recommends that any IMPLEMENTATION DEFINED syndrome fields that can generate a Fault 
Handling, Error Recovery, Critical, or IMPLEMENTATION DEFINED, interrupt request are disabled at 
Cold reset and are enabled by software writing an IMPLEMENTATION DEFINED non-zero value to an 
IMPLEMENTATION DEFINED field in ERR<q>CTRL, where q is the index of the first error record 
owned by the same node as error record n. If the node owns a single record then q = n. 








ERR<n>STATUS is a 64-bit register. 


Field descriptions 


The ERR<n>STATUS bit assignments are: 
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When ARMv8.4-RAS is implemented: 


63 32 31 30 29 28 27 26 25 24 23 22 21 201918, 1615 


8 7 0 
RESO RESO IERR | SERR 
DE 








ER 
OF 
MV 
Bits [63:32] 
Reserved, RESO. 
AV, bit [31] 
Address Valid. 
Ob ERR<n>ADDR not valid. 
Qb1 ERR<n>ADDR contains an address associated with the highest priority error recorded 
by this record. 
This bit is read/write-one-to-clear. 
The following resets apply: 
5 This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to 0. 
V, bit [30] 
Status Register Valid. 
0b0 ERR<n>STATUS not valid. 
Qb1 ERR<n>STATUS valid. At least one error has been recorded. 
This bit is read/write-one-to-clear. 
The following resets apply: 
: This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to 0. 
UE, bit [29] 
Uncorrected error. 
0b0 No errors have been detected, or all detected errors have been either corrected or 
deferred. 
0b1 At least one detected error was not corrected and not deferred. 
When clearing ERR<n>STATUS.V to 0, if this bit is nonzero, then software must write one to this 
bit to clear this bit to zero. 
This bit is not valid and reads UNKNOWN if ERR<n>STATUS.V is set to 0. 
This bit is read/write-one-to-clear. 
The following resets apply: 
s This bit is preserved on an Error Recovery reset. 
$ On a Cold reset, this field resets to an architecturally UNKNOWN value. 
ER, bit [28] 
Error Reported. 
0b0 No in-band error (External abort) reported. 
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Qb1 An External abort was signaled by the node to the master making the access or other 
transaction. This can be because any of the following are true: 


. The applicable one of the ERR<n>CTLR. {WUE,RUE,UE} bits is implemented, 
and was set to 1 when an Uncorrected error was detected. 


° The applicable one of the ERR<n>CTLR. {WUE,RUE,UE} bits is not 
implemented. 


It is IMPLEMENTATION DEFINED whether this bit can be set to 1 by a Deferred error. 


When clearing ERR<n>STATUS.V to 0, if this bit is nonzero, then software must write one to this 
bit to clear this bit to zero. 


This bit is not valid and reads UNKNOWN if any of the following are true: 

. ERR<n>STATUS.V is set to 0. 

. ERR<n>STATUS.UE is set to 0 and this bit is never set to 1 by a Deferred error. 

° ERR<n>STATUS.{UE, DE} are both set to 0, and this bit can be set to 1 by a Deferred error. 
This bit is read/write-one-to-clear. 


Note 


An External abort signaled by the node might be masked and not generate any exception. 








The following resets apply: 


° This bit is preserved on an Error Recovery reset. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
OF, bit [27] 

Overflow. 


Indicates that multiple errors have been detected. This bit is set to 1 when one of the following 


occurs: 
. A Corrected error counter is implemented, an error is counted, and the counter overflows. 
° ERR<n>STATUS.V was previously set to 1, a Corrected error counter is not implemented, 


and a Corrected error is recorded. 


° ERR<n>STATUS.V was previously set to 1, and a type of error other than a Corrected error 
is recorded. 


Otherwise, this bit is unchanged when an error is recorded. 
If a Corrected error counter is implemented: 


° A direct write that modifies the counter overflow flag indirectly might set this bit to an 
UNKNOWN value. 


° A direct write to this bit that clears this bit to zero might indirectly set the counter overflow 
flag to an UNKNOWN value. 


0b0 Since this bit was last cleared to zero, no error syndrome has been discarded and, if a 
Corrected error counter is implemented, it has not overflowed. 


Qb1 Since this bit was last cleared to zero, at least one error syndrome has been discarded or, 
if a Corrected error counter is implemented, it might have overflowed. 


If this bit is nonzero, then software must write | to this bit, to clear this bit to zero, when clearing 
ERR<n>STATUS.V to 0. 


This bit is not valid and reads UNKNOWN if ERR<n>STATUS.V is set to 0. 
This bit is read/write-one-to-clear. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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MV, bit [26] 
Miscellaneous Registers Valid. 
Ob ERR<n>MISCO0, ERR<n>MISC1, ERR<n>MISC2, and ERR<n>MISC3 are not valid. 
Qb1 The IMPLEMENTATION DEFINED contents of the ERR<n>MISCO, ERR<n>MISC1, 


ERR<n>MISC2, and ERR<n>MISC3 registers contain additional information for an 
error recorded by this record. 


This bit is read/write-one-to-clear. 


Note 

If the ERR<n>MISCO, ERR<n>MISC1, ERR<n>MISC2, and ERR<n>MISC3 registers can 
contain additional information for a previously recorded error, then the contents must be 
self-describing to software or a user. For example, certain fields might relate only to Corrected 
errors, and other fields only to the most recent error that was not discarded. 








The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to 0. 

CE, bits [25:24] 


Corrected Error. 


0b00 No errors were corrected. 

0b01 At least one transient error was corrected. 
0b10 At least one error was corrected. 

0b11 At least one persistent error was corrected. 


The mechanism by which a node detects whether a correctable error is transient or persistent is 
IMPLEMENTATION DEFINED. If no such mechanism is implemented, then the node sets this field to 
0b10 when an error is corrected. 


When clearing ERR<n>STATUS.V to 0, if this field is nonzero, then software must write ones to 
this field to clear this field to zero. 


If ERR<n>STATUS.V is set to 0, this field is not valid and reads UNKNOWN. 


This field is read/write-one-to-clear. Writing a value other than all-zeros or all-ones sets this field to 
an UNKNOWN value. 


The following resets apply: 
° This field is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 


DE, bit [23] 
Deferred Error. 
0b0ð No errors were deferred. 
Qb1 At least one error was not corrected and deferred. 
Support for deferring errors is IMPLEMENTATION DEFINED. 


When clearing ERR<n>STATUS.V to 0, if this bit is nonzero, then software must write 1 to this bit 
to clear this bit to zero. 


If ERR<n>STATUS.Y is set to 0, this bit is not valid and reads UNKNOWN. 
This bit is read/write-one-to-clear. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 
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PN, bit [22] 





Poison. 
ObO Uncorrected error or Deferred error recorded because a corrupt value was detected, for 
example, by an error detection code (EDC). 
Note 
If a producer node detects a corrupt value and defers the error by producing a poison 
value, then this bit is set to 0 at the producer node. 
Qb1 Uncorrected error or Deferred error recorded because a poison value was detected. 


Note 


This might only be an indication of poison, because, in some EDC schemes, a poison 
value is encoded as an unlikely form of corrupt data, meaning it is possible to mistake 
a corrupt value as a poison value. 








It is IMPLEMENTATION DEFINED whether a node can distinguish a poison value from a corrupt value. 


When clearing ERR<n>STATUS.V to 0, if this bit is nonzero, then software must write 1 to this bit 
to clear this bit to zero. 


This bit is not valid and reads UNKNOWN if any of the following are true: 

° ERR<n>STATUS.V is set to 0. 

° ERR<n>STATUS. {DE, UE} are both set to 0. 

This bit is read/write-one-to-clear. 

The following resets apply: 

° This bit is preserved on an Error Recovery reset. 

. On a Cold reset, this field resets to an architecturally UNKNOWN value. 
UET, bits [21:20] 

Uncorrected Error Type. 


Describes the state of the component after detecting or consuming an Uncorrected error. 


Oboe Uncorrected error, Uncontainable error (UC). 

Qb01 Uncorrected error, Unrecoverable error (UEU). 

0b10 Uncorrected error, Latent or Restartable error (UEO). 
Qb11 Uncorrected error, Signaled or Recoverable error (UER). 


When clearing ERR<n>STATUS.V to 0, if this field is nonzero, then software must write ones to 
this field to clear this field to zero. 


This field is not valid and reads UNKNOWN if any of the following are true: 
° ERR<n>STATUS.V is set to 0. 
e ERR<n>STATUS.UE is set to 0. 


This field is read/write-one-to-clear. Writing a value other than all-zeros or all-ones sets this field to 
an UNKNOWN value. 


The following resets apply: 

° This field is preserved on an Error Recovery reset. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
CI, bit [19] 

Critical error. 


Indicates whether a critical error condition has been recorded. 


0bd No critical error condition recorded. 
Qb1 Critical error condition recorded. 
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When clearing ERR<n>STATUS.V to 0, if this bit is nonzero, then software must write 1 to this bit 
to clear this bit to zero. 


This bit is not valid and reads UNKNOWN if ERR<n>STATUS.V is set to 0. 
This bit is read/write-one-to-clear. 


The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [18:16] 


Reserved, RESO. 


IERR, bits [15:8] 
IMPLEMENTATION DEFINED error code. 


Used with any primary error code SERR value. Further IMPLEMENTATION DEFINED information can 
be placed in the MISC registers. 


This field is not valid and reads UNKNOWN if ERR<n>STATUS.V is set to 0. 


The following resets apply: 
° This field is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


SERR, bits [7:0] 
Architecturally-defined primary error code. 


Indicates the type of error. The primary error code might be used by a fault handling agent to triage 
an error without requiring device-specific code. For example, to count and threshold corrected 
errors in software, or generate a short log entry. 


0x00 No error. 

0x01 IMPLEMENTATION DEFINED error. 

0x02 Data value from (non-associative) internal memory. For example, ECC from on-chip 
SRAM or buffer. 

0x03 IMPLEMENTATION DEFINED pin. For example, nSEI pin. 

0x04 Assertion failure. For example, consistency failure. 

0x05 Error detected on internal data path. For example, parity on ALU result. 

0x06 Data value from associative memory. For example, ECC error on cache data. 

0x07 Address/control value from associative memory. For example, ECC error on cache tag. 

0x08 Data value from a TLB. For example, ECC error on TLB data. 

0x09 Address/control value from a TLB. For example, ECC error on TLB tag. 

Ox0A Data value from producer. For example, parity error on write data bus. 

0x0B Address/control value from producer. For example, parity error on address bus. 

0x0C Data value from (non-associative) external memory. For example, ECC error in 
SDRAM. 

0x0D Illegal address (software fault). For example, access to unpopulated memory. 

0x0E Illegal access (software fault). For example, byte write to word register. 

OxOF Illegal state (software fault). For example, device not ready. 

0x10 Internal data register. For example, parity on a SIMD&FP register. For a PE, all 
general-purpose, stack pointer, and SIMD&FP registers are data registers. 

0x11 Internal control register. For example, Parity on a System register. For a PE, all registers 
other than general-purpose, stack pointer, and SIMD&FP registers are control registers. 

0x12 Error response from slave. For example, error response from cache write-back. 

0x13 External timeout. For example, timeout on interaction with another node. 
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0x14 Internal timeout. For example, timeout on interface within the node. 


0x15 Deferred error from slave not supported at master. For example, poisoned data received 
from a slave by a master that cannot defer the error further. 


All other values are reserved. Reserved values might be defined in a future version of the 
architecture. 


This field is not valid and reads UNKNOWN if ERR<n>STATUS.V is set to 0. 


The following resets apply: 
à This field is preserved on an Error Recovery reset. 
a On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Otherwise: 


63 32 31 30 29 28 27 26 25 24 23 22 21 20 19 16 15 


AV S 
UE 








ER 
OF 
MV 
Bits [63:32] 
Reserved, RESO. 
AV, bit [31] 
Address Valid. 
Ob ERR<n>ADDR not valid. 
Qb1 ERR<n>ADDR contains an address associated with the highest priority error recorded 
by this record. 
This bit ignores writes if any of ERR<n>STATUS. {CE, DE, UE} are set to 1, and the highest 
priority of these is not being cleared to 0 in the same write. 
This bit is read/write-one-to-clear. 
The following resets apply: 
s This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to 0. 
V, bit [30] 
Status Register Valid. 
0b0 ERR<n>STATUS not valid. 
0b1 ERR<n>STATUS valid. At least one error has been recorded. 
This bit ignores writes if any of ERR<n>STATUS. {CE, DE, UE} are set to 1, and and is not being 
cleared to 0 in the same write. 
This bit is read/write-one-to-clear. 
The following resets apply: 
- This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to 0. 
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UE, bit [29] 
Uncorrected error. 
Qbd No errors have been detected, or all detected errors have been either corrected or 
deferred. 
Qb1 At least one detected error was not corrected and not deferred. 


When clearing ERR<n>STATUS.V to 0, if this bit is nonzero, then software must write one to this 
bit to clear this bit to zero. 


If ERR<n>STATUS.OF is set to 1 and is not being cleared to 0 in the same write, this bit ignores 
writes. 


This bit is not valid and reads UNKNOWN if ERR<n>STATUS.V is set to 0. 
This bit is read/write-one-to-clear. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
ER, bit [28] 
Error Reported. 
Qbd No in-band error (External abort) reported. 
Qb1 An External abort was signaled by the node to the master making the access or other 


transaction. This can be because any of the following are true: 


° The applicable one of the ERR<n>CTLR. {WUE,RUE,UE} bits is implemented, 
and was set to 1 when an Uncorrected error was detected. 


. The applicable one of the ERR<n>CTLR. {WUE,RUE,UE} bits is not 
implemented. 


It is IMPLEMENTATION DEFINED whether this bit can be set to 1 by a Deferred error. 

If this bit is nonzero, then software must write 1 to this bit, to clear this bit to zero, when: 

° Clearing ERR<n>STATUS.V to 0. 

° Clearing ERR<n>STATUS.UE to 0, if this bit is never set to 1 by a Deferred error. 

° Clearing both ERR<n>STATUS. {UE, DE} to 0, if this bit can be set to 1 by a Deferred error. 
This bit is not valid and reads UNKNOWN if any of the following are true: 

° ERR<n>STATUS.V is set to 0. 

. ERR<n>STATUS.UE is set to 0 and this bit is never set to 1 by a Deferred error. 

° ERR<n>STATUS.{UE, DE} are both set to 0, and this bit can be set to 1 by a Deferred error. 


This bit ignores writes if any of ERR<n>STATUS. {CE, DE, UE} are set to 1, and the highest 
priority of these is not being cleared to 0 in the same write. 


This bit is read/write-one-to-clear. 





Note 
An External abort signaled by the node might be masked and not generate any exception. 





The following resets apply: 


° This bit is preserved on an Error Recovery reset. 

° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
OF, bit [27] 

Overflow. 


Indicates that multiple errors have been detected. This bit is set to 1 when one of the following 
occurs: 


. An Uncorrected error is detected and ERR<n>STATUS.UE = 1. 
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MV, bit [26] 


. A Deferred error is detected, ERR<n>STATUS.UE == 0 and ERR<n>STATUS.DE = 1. 


. A Corrected error is detected, no Corrected error counter is implemented, 
ERR<n>STATUS.UE == 0, ERR<n>STATUS.DE == 0, and ERR<n>STATUS.CE != 0b00. 
ERR<n>STATUS.CE might be updated for the new Corrected error. 


. A Corrected error counter is implemented, ERR<n>STATUS.UE == 0, 
ERR<n>STATUS.DE == 0, and the counter overflows. 


It is IMPLEMENTATION DEFINED whether this bit is set to 1 when one of the following occurs: 
° A Deferred error is detected and ERR<n>STATUS.UE = 1. 


. A Corrected error is detected, no Corrected error counter is implemented, and either or both 
the ERR<n>STATUS.UE or ERR<n>STATUS.DE bits are set to 1. 


° A Corrected error counter is implemented, either or both the ERR<n>STATUS.UE or 
ERR<n>STATUS.DE bits are set to 1, and the counter overflows. 


It is IMPLEMENTATION DEFINED whether this bit is set to 0 when one of the following occurs: 
° An Uncorrected error is detected and ERR<n>STATUS.UE == 0. 
. A Deferred error is detected, ERR<n>STATUS.UE == 0 and ERR<n>STATUS.DE = 0. 


. A Corrected error is detected, ERR<n>STATUS.UE == 0, ERR<n>STATUS.DE == 0 and 
ERR<n>STATUS.CE == 0b00. 


The IMPLEMENTATION DEFINED clearing of this bit might also depend on the value of the other error 
status bits. 


If a Corrected error counter is implemented: 


° A direct write that modifies the counter overflow flag indirectly might set this bit to an 
UNKNOWN value. 
° A direct write to this bit that clears this bit to 0 might indirectly set the counter overflow flag 
to an UNKNOWN value. 
ObO If ERR<n>STATUS.UE == 1, then no error syndrome for an Uncorrected error has been 
discarded. 


If ERR<n>STATUS.UE == 0 and ERR<n>STATUS.DE == 1, then no error syndrome 
for a Deferred error has been discarded. 


If ERR<n>STATUS.UE == 0, ERR<n>STATUS.DE == 0, and a Corrected error 
counter is implemented, then the counter has not overflowed. 


If ERR<n>STATUS.UE == 0, ERR<n>STATUS.DE == 0, ERR<n>STATUS.CE != 
0b00, and no Corrected error counter is implemented, then no error syndrome for a 
Corrected error has been discarded. 

Note 


This bit might have been set to 1 when an error syndrome was discarded and later 
cleared to 0 when a higher priority syndrome was recorded. 














Qb1 At least one error syndrome has been discarded or, if a Corrected error counter is 
implemented, it might have overflowed. 


If this bit is nonzero, then software must write | to this bit, to clear this bit to zero, when clearing 
ERR<n>STATUS.V to 0. 


This bit is not valid and reads UNKNOWN if ERR<n>STATUS.V is set to 0. 
This bit is read/write-one-to-clear. 


The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Miscellaneous Registers Valid. 
0b0ð ERR<n>MISC0 and ERR<n>MISC1 not valid. 
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Qb1 The IMPLEMENTATION DEFINED contents of the ERR<n>MISCO and ERR<n>MISC1 
registers contains additional information for an error recorded by this record. 


This bit ignores writes if any of ERR<n>STATUS. {CE, DE, UE} are set to 1, and the highest 
priority of these is not being cleared to 0 in the same write. 


This bit is read/write-one-to-clear. 


Note 


If the ERR<n>MISCO and ERR<n>MISC1 registers can contain additional information for a 
previously recorded error, then the contents must be self-describing to software or a user. For 
example, certain fields might relate only to Corrected errors, and other fields only to the most recent 
error that was not discarded. 








The following resets apply: 
° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to 0. 

CE, bits [25:24] 


Corrected Error. 


0b00 No errors were corrected. 

0b01 At least one transient error was corrected. 
0b10 At least one error was corrected. 

0b11 At least one persistent error was corrected. 


The mechanism by which a node detects whether a correctable error is transient or persistent is 
IMPLEMENTATION DEFINED. If no such mechanism is implemented, then the node sets this field to 
0b10 when an error is corrected. 


When clearing ERR<n>STATUS.V to 0, if this field is nonzero, then software must write ones to 
this field to clear this field to zero. 


If ERR<n>STATUS.OF is set to 1 and is not being cleared to 0 in the same write, this field ignores 
writes. 


If ERR<n>STATUS.V is set to 0, this field is not valid and reads UNKNOWN. 


This field is read/write-ones-to-clear. Writing a value other than all-zeros or all-ones sets this field 
to an UNKNOWN value. 


The following resets apply: 
° This field is preserved on an Error Recovery reset. 
. On a Cold reset, this field resets to an architecturally UNKNOWN value. 


DE, bit [23] 
Deferred Error. 
0b0ð No errors were deferred. 
Qb1 At least one error was not corrected and deferred. 
Support for deferring errors is IMPLEMENTATION DEFINED. 


When clearing ERR<n>STATUS.V to 0, if this bit is nonzero, then software must write 1 to this bit 
to clear this bit to zero. 


If ERR<n>STATUS.OF is set to 1 and is not being cleared to 0 in the same write, this bit ignores 
writes. 


If ERR<n>STATUS.\ is set to 0, this bit is not valid and reads UNKNOWN. 
This bit is read/write-one-to-clear. 


The following resets apply: 


° This bit is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7283 


ID070919 Non-Confidential 


External System Control Register Descriptions 
15.8 RAS Registers 


PN, bit [22] 





Poison. 
ObO Uncorrected error or Deferred error recorded because a corrupt value was detected, for 
example, by an error detection code (EDC). 
Note 
If a producer node detects a corrupt value and defers the error by producing a poison 
value, then this bit is set to 0 at the producer node. 
Qb1 Uncorrected error or Deferred error recorded because a poison value was detected. 


Note 

This might only be an indication of poison, because, in some EDC schemes, a poison 
value is encoded as an unlikely form of corrupt data, meaning it is possible to mistake 
a corrupt value as a poison value. 








It is IMPLEMENTATION DEFINED whether a node can distinguish a poison value from a corrupt value. 


When clearing ERR<n>STATUS.V to 0, if this bit is nonzero, then software must write 1 to this bit 
to clear this bit to zero. 


When clearing both ERR<n>STATUS. {DE, UE} to 0, if this bit is nonzero, then software must 
write 1 to this bit to clear this bit to zero. 


This bit is not valid and reads UNKNOWN if any of the following are true: 
. ERR<n>STATUS.V is set to 0. 
e ERR<n>STATUS. {DE, UE} are both set to 0. 


When any of ERR<n>STATUS. {CE, DE, UE} are set to 1, and the highest priority of these is not 
being cleared to 0 in the same write, this bit ignores writes. 


This bit is read/write-one-to-clear. 

The following resets apply: 

e This bit is preserved on an Error Recovery reset. 

. On a Cold reset, this field resets to an architecturally UNKNOWN value. 
UET, bits [21:20] 

Uncorrected Error Type. 


Describes the state of the component after detecting or consuming an Uncorrected error. 


0b00 Uncorrected error, Uncontainable error (UC). 

0b01 Uncorrected error, Unrecoverable error (UEU). 

0b10 Uncorrected error, Latent or Restartable error (UEO). 
0b11 Uncorrected error, Signaled or Recoverable error (UER). 


When clearing ERR<n>STATUS.V to 0, if this field is nonzero, then software must write ones to 
this field to clear this field to zero. 


When clearing ERR<n>STATUS.UE to 0, if this field is nonzero, then software must write ones to 
this field to clear this field to zero. 


This field is not valid and reads UNKNOWN if any of the following are true: 
° ERR<n>STATUS.V is set to 0. 
° ERR<n>STATUS.UE is set to 0. 


When any of ERR<n>STATUS. {CE, DE, UE} are set to 1, and the highest priority of these is not 
being cleared to 0 in the same write, this field ignores writes. 


This field is read/write-ones-to-clear. Writing a value other than all-zeros or all-ones sets this field 
to an UNKNOWN value. 
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The following resets apply: 
° This field is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Bits [19:16] 


Reserved, RESO. 


IERR, bits [15:8] 
IMPLEMENTATION DEFINED error code. 


Used with any primary error code SERR value. Further IMPLEMENTATION DEFINED information can 
be placed in the MISC registers. 


This field is not valid and reads UNKNOWN if ERR<n>STATUS.V is set to 0. 


When any of ERR<n>STATUS. {CE, DE, UE} are set to 1, and the highest priority of these is not 
being cleared to 0 in the same write, this field ignores writes. 


The following resets apply: 
° This field is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


SERR, bits [7:0] 
Architecturally-defined primary error code. 


Indicates the type of error. The primary error code might be used by a fault handling agent to triage 
an error without requiring device-specific code. For example, to count and threshold corrected 
errors in software, or generate a short log entry. 


0x00 No error. 

0x01 IMPLEMENTATION DEFINED error. 

0x02 Data value from (non-associative) internal memory. For example, ECC from on-chip 
SRAM or buffer. 

0x03 IMPLEMENTATION DEFINED pin. For example, nSEI pin. 

0x04 Assertion failure. For example, consistency failure. 

0x05 Error detected on internal data path. For example, parity on ALU result. 

0x06 Data value from associative memory. For example, ECC error on cache data. 

0x07 Address/control value from associative memory. For example, ECC error on cache tag. 

0x08 Data value from a TLB. For example, ECC error on TLB data. 

0x09 Address/control value from a TLB. For example, ECC error on TLB tag. 

0x0A Data value from producer. For example, parity error on write data bus. 

0x0B Address/control value from producer. For example, parity error on address bus. 

0x0C Data value from (non-associative) external memory. For example, ECC error in 
SDRAM. 

0x0D Illegal address (software fault). For example, access to unpopulated memory. 

0x0E Illegal access (software fault). For example, byte write to word register. 

OxOF Illegal state (software fault). For example, device not ready. 

0x10 Internal data register. For example, parity on a SIMD&FP register. For a PE, all 
general-purpose, stack pointer, and SIMD&FP registers are data registers. 

0x11 Internal control register. For example, Parity on a System register. For a PE, all registers 
other than general-purpose, stack pointer, and SIMD&FP registers are control registers. 

0x12 Error response from slave. For example, error response from cache write-back. 

0x13 External timeout. For example, timeout on interaction with another node. 

0x14 Internal timeout. For example, timeout on interface within the node. 
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0x15 Deferred error from slave not supported at master. For example, poisoned data received 
from a slave by a master that cannot defer the error further. 


All other values are reserved. Reserved values might be defined in a future version of the 
architecture. 


This field is not valid and reads UNKNOWN if ERR<n>STATUS.V is set to 0. 


When any of ERR<n>STATUS. {CE, DE, UE} are set to 1, and the highest priority of these is not 
being cleared to 0 in the same write, this field ignores writes. 


The following resets apply: 
° This field is preserved on an Error Recovery reset. 
° On a Cold reset, this field resets to an architecturally UNKNOWN value. 


Accessing the ERR<n>STATUS: 
After reading the status register, software must clear the valid bits to allow new errors to be recorded. 


Between reading the register and clearing the valid bits, a new error might have overwritten the register. To prevent 
this new error being lost: 


° When ARMV8.4-RAS is not implemented, some control bits use a form of read/write-one-to-clear and ignore 
writes depending on the values of other bits and which bits are being cleared. 


° When ARMv8.4-RAS is implemented, a write to ERR<n>STATUS is ignored if both: 
— Any of the ERR<n>STATUS. {V, UE, OF, CE, DE} fields are nonzero before the write. 


— The write does not clear the nonzero ERR<n>STATUS. {V, UE, OF, CE, DE} field(s) to zero by 
writing one(s) to the applicable field(s). 


Software must write ones to the {ER, PN, UET, CI} fields when clearing ERR<n>STATUS. {V, UE, OF, CE, DE}. 


ERR<n>STATUS can be accessed through its memory-mapped interface: 








Component Offset Instance 
RAS 0x010 + 64n ERR<n>STATUS 
This interface is accessible as follows: 
s Accesses to this register are RW. 
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ERRPIDRDO, Peripheral Identification Register 0 


ARM DDI 0487E.a 


The ERRPIDRO characteristics are: 


Purpose 
Provides discovery information about the component. 
For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 
Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRPIDRO 
are RESO. 
Attributes 


ERRPIDR0O is a 32-bit register. 


Field descriptions 


The ERRPIDRO bit assignments are: 


31 8 7 0 
RESO PART_0 
Bits [31:8] 


Reserved, RESO. 


PART_0, bits [7:0] 
Part number, bits [7:0]. 
The part number is selected by the designer of the component. The designer chooses whether to use 
a 12-bit or a 16-bit part number, and: 
è Ifa 12-bit part number is used, it is stored in ERRPIDR1.PART_1 and this field. 
. Ifa 16-bit part number is used, it is stored in ERRPIDR2.PART_ 2, ERRPIDR1.PART 1 and 
this field. 
This field reads as an IMPLEMENTATION DEFINED value. 


Accessing the ERRPIDRO: 


ERRPIDRO can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxFEQ ERRPIDRO 
This interface is accessible as follows: 
z Accesses to this register are RO. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 15-7287 


Non-Confidential 


External System Control Register Descriptions 


15.8 RAS Registers 


15.8.33 ERRPIDR1, Peripheral Identification Register 1 


15-7288 


The ERRPIDR1 characteristics are: 


Purpose 
Provides discovery information about the component. 


For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRPIDR1 
are RESO. 


Attributes 
ERRPIDR1 is a 32-bit register. 


Field descriptions 


The ERRPIDR1 bit assignments are: 


31 8 7 4 3 0 
RESO DES_0 | PART1 
Bits [31:8] 


Reserved, RESO. 


DES_0, bits [7:4] 
Designer, JEP 106 identification code, bits [3:0]. This field and ERRPIDR2.DES_1 together form 
the JEDEC-assigned JEP 106 identification code for the designer of the component. 


The code identifies the designer of the component, which might not be not the same as the 
implementer of the device containing the component. 


Note 
For a component designed by Arm Limited, the JEP106 identification code is 0x3B. 








This field reads as an IMPLEMENTATION DEFINED value. 


PART_1, bits [3:0] 
Part number, bits [11:8] 


The part number is selected by the designer of the component. The designer chooses whether to use 
a 12-bit or a 16-bit part number, and: 


è Ifa 12-bit part number is used, it is stored in this field and ERRPIDRO.PART_0. 


° Ifa 16-bit part number is used, it is stored in ERRPIDR2.PART 2, this field, and 
ERRPIDRO.PART_0. 


This field reads as an IMPLEMENTATION DEFINED value. 
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Accessing the ERRPIDR1: 


ERRPIDR1I can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxFE4 ERRPIDRI 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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ERRPIDR2, Peripheral Identification Register 2 


The ERRPIDR2 characteristics are: 


Purpose 
Provides discovery information about the component. 


For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
Implementation of this register is OPTIONAL. 


This register is present only when RAS is implemented. Otherwise, direct accesses to ERRPIDR2 
are RESO. 


Attributes 


ERRPIDR2 is a 32-bit register. 


Field descriptions 


The ERRPIDR2 bit assignments are: 


When the component uses a 12-bit part number: 


31 8 7 432 0 
RESO REVISION i DES_1 
aa 
Bits [31:8] 


Reserved, RESO. 


REVISION, bits [7:4] 
Component major revision. This field and ERRPIDR3.REVAND together form the revision number 
of the component, with REVISION being the most significant part and REVAND the least 
significant part. 


This field reads as an IMPLEMENTATION DEFINED value. 


JEDEC, bit [3] 
JEDEC-assigned JEP 106 implementer code is used. This bit is RAO. 


DES _1, bits [2:0] 


Designer, JEP 106 identification code, bits [6:4]. ERRPIDR1.DES_0 and this field together form the 
JEDEC-assigned JEP 106 identification code for the designer of the component. 


This field reads as an IMPLEMENTATION DEFINED value. 


Note 
For a component designed by Arm Limited, the JEP106 identification code is 0x3B. 
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When the component uses a 16-bit part number: 
31 8 7 43 2 0 
— e 
Io JEDEC 


Bits [31:8] 


Reserved, RESO. 


PART 2, bits [7:4] 
Part number, bits [15:12] 


The part number is selected by the designer of the component. It is stored in this field, 
ERRPIDR1.PART_1 and ERRPIDRO.PART_0. 


This field reads as an IMPLEMENTATION DEFINED value. 


JEDEC, bit [3] 
JEDEC-assigned JEP 106 implementer code is used. This bit is RAO. 


DES _1, bits [2:0] 


Designer, JEP 106 identification code, bits [6:4]. ERRPIDR1.DES_0 and this field together form the 
JEDEC-assigned JEP 106 identification code for the designer of the component. 


This field reads as an IMPLEMENTATION DEFINED value. 


Note 
For a component designed by Arm Limited, the JEP106 identification code is 0x3B. 








Accessing the ERRPIDR2: 


ERRPIDR2 can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxFE8 ERRPIDR2 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.8.35 ERRPIDR3, Peripheral Identification Register 3 


The ERRPIDR3 characteristics are: 


Purpose 
Provides discovery information about the component. 
For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 
Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRPIDR3 
are RESO. 
Attributes 


ERRPIDR3 is a 32-bit register. 


Field descriptions 


The ERRPIDR3 bit assignments are: 


31 8 7 4 3 0 
RESO REVAND | CMOD 
Bits [31:8] 


Reserved, RESO. 


REVAND, bits [7:4] 

When the component uses a 12-bit part number: 
Component minor revision. ERRPIDR2.REVISION and this field together form the revision 
number of the component, with REVISION being the most significant part and REVAND the least 
significant part. 
This field reads as an IMPLEMENTATION DEFINED value. 

When the component uses a 16-bit part number: 
Component revision. 


This field reads as an IMPLEMENTATION DEFINED value. 
Otherwise: 


Reserved, RESO. 


CMOD, bits [3:0] 
Customer Modified. If the value of this field is non-zero, then the component has IMPLEMENTATION 
DEFINED modifications. 
0b0000 The component is not modified from the original design. 
For any two components with the same Unique Component Identifier: 
° If the value of the CMOD fields of both components equals zero, the components are 
identical. 


° If the value of the CMOD field of either of the two components is non-zero, they might not 
be identical, even though they have the same Unique Component Identifier. 


° Ifthe CMOD fields of both components have the same non-zero value, it does not necessarily 
mean that they have the same modifications. 
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This field reads as an IMPLEMENTATION DEFINED value. 


Accessing the ERRPIDR3: 


ERRPIDR3 can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS OxFEC ERRPIDR3 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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15.8.36 ERRPIDR4, Peripheral Identification Register 4 


15-7294 


The ERRPIDR4 characteristics are: 


Purpose 
Provides discovery information about the component. 


For more information, see About the Peripheral identification scheme on page K2-7661 in the 
Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile. 


Configurations 
Implementation of this register is OPTIONAL. 
This register is present only when RAS is implemented. Otherwise, direct accesses to ERRPIDR4 
are RESO. 


Attributes 
ERRPIDR4 is a 32-bit register. 


Field descriptions 


The ERRPIDR4 bit assignments are: 


31 8 7 4 3 0 
RESO SIZE DES 2 
Bits [31:8] 


Reserved, RESO. 


SIZE, bits [7:4] 
Size of the component. The distance from the start of the address space used by this component to 
the end of the component identification registers. 


If the value of this field is non-zero, then the component occupies 2ERRPIDR4.SIZE 4KB blocks. 


0b0000 One of the following is true: 

° The component uses a single 4KB block. 

s The component uses an IMPLEMENTATION DEFINED number of 4KB blocks. 
Using this bit field to indicate the size of the component is deprecated. This bit field might not 
correctly indicate the size of the component. 


Arm recommends that software determine the size of the component from the Unique Component 
Identifier fields, and other IMPLEMENTATION DEFINED registers in the component. 


This register reads as an IMPLEMENTATION DEFINED value. 


DES_2, bits [3:0] 
Designer, JEP 106 continuation code. This is the JEDEC-assigned JEP 106 bank identifier for the 
designer of the component, minus 1. 
The code identifies the designer of the component, which might not be not the same as the 
implementer of the device containing the component. 


This field reads as an IMPLEMENTATION DEFINED value. 








Note 
For a component designed by Arm Limited, the JEP106 bank is 5, meaning this field has the value 
0x4. 
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Accessing the ERRPIDR4: 


ERRPIDR4 can be accessed through its memory-mapped interface: 





Component Offset Instance 





RAS QxFDO ERRPIDR4 
This interface is accessible as follows: 
° Accesses to this register are RO. 
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Architectural Pseudocode 


Chapter J1 
Armv8 Pseudocode 


This chapter contains pseudocode that describes many features of the Armv8 architecture. It contains the following 
sections: 


. Pseudocode for AArch64 operations on page J1-7300. 
. Pseudocode for AArch32 operation on page J1-7415. 
. Shared pseudocode on page J1-7493. 
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J1.1 Pseudocode for AArch64 operations 


This section holds the pseudocode for execution in AArch64 state. Functions that are listed in this section are 
identified as AArch64.FunctionName. Some of these functions have an equivalent AArch32 function, 
AArch32.FunctionName. This section is organized by functional groups, with the functional groups being indicated by 
hierarchical path names, for example aarch64/debug/breakpoint. 


The top-level sections of the AArch64 pseudocode hierarchy are: 
° aarch64/debug. 

. aarch64/exceptions on page J1-7311. 

. aarch64/functions on page J1-7331. 

. aarch64/instrs on page J1-7386. 

s aarch64/translation on page J1-7394. 


J1.1.1 aarch64/debug 


This section includes the following pseudocode functions: 

è aarch64/debug/breakpoint/AArch64.BreakpointMatch. 

: aarch64/debug/breakpoint/AArch64.BreakpointValueMatch on page J1-7301. 

s aarch64/debug/breakpoint/AArch64.StateMatch on page J1-7302. 

$ aarch64/debug/breakpoint/CheckValidStateMatch on page J1-7303. 

$ aarch64/debug/enables/AArch64. GenerateDebugExceptions on page J1-7304. 

s aarch64/debug/enables/AArch64. GenerateDebugExceptionsFrom on page J1-7304. 
s aarch64/debug/pmu/AArch64.CheckForPMUOverflow on page J1-7305. 

. aarch64/debug/pmu/AArch64.CountEvents on page J1-7305. 

a aarch64/debug/statisticalprofiling/CheckProfilingBufferAccess on page J1-7306. 

è aarch64/debug/statisticalprofiling/CheckStatisticalProfilingAccess on page J1-7306. 
è aarch64/debug/statisticalprofiling/CollectContextIDR1 on page J1-7306. 

a aarch64/debug/statisticalprofiling/CollectContextIDR2 on page J1-7307. 

a aarch64/debug/statisticalprofiling/CollectPhysicalAddress on page J1-7307. 

5 aarch64/debug/statisticalprofiling/CollectRecord on page J1-7307. 

s aarch64/debug/statisticalprofiling/CollectTimeStamp on page J1-7308. 

7 aarch64/debug/statisticalprofiling/Op Type on page J1-7308. 

$ aarch64/debug/statisticalprofiling/ProfilingBuffer Enabled on page J1-7308. 

s aarch64/debug/statisticalprofiling/ProfilingBufferOwner on page J1-7308. 

: aarch64/debug/statisticalprofiling/ProfilingSynchronizationBarrier on page J1-7308. 
è aarch64/debug/statisticalprofiling/StatisticalProfilingEnabled on page J1-7309. 

è aarch64/debug/statisticalprofiling/SysRegAccess on page J1-7309. 

- aarch64/debug/statisticalprofiling/TimeStamp on page J1-7309. 

è aarch64/debug/takeexceptiondbg/AArch64. TakeExceptionInDebugState on page J1-7309. 
è aarch64/debug/watchpoint/AArch64. WatchpointByteMatch on page J1-7310. 

7 aarch64/debug/watchpoint/AArch64.WatchpointMatch on page J1-7311. 


aarch64/debug/breakpoint/AArch64.BreakpointMatch 


// AArch64.BreakpointMatch() 


// Breakpoint matching in an AArch64 translation regime. 


boolean AArch64.BreakpointMatch(integer n, bits(64) vaddress, AccType acctype, integer size) 
assert !ELUsingAArch32(S1TranslationRegime()); 
assert n <= UInt(ID_AA64DFRO_EL1.BRPs) ; 


enabled = DBGBCR_EL1[n].E == '1'; 
ispriv = PSTATE.EL != ELQ; 
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linked = DBGBCR_EL1[n].BT == '0x01'; 
isbreakpnt = TRUE; 
linked_to = FALSE; 


state_match = AArch64.StateMatch(DBGBCR_EL1[n].SSC, DBGBCR_EL1[n].HMC, DBGBCR_EL1[n].PMC, 
linked, DBGBCR_EL1[n].LBN, isbreakpnt, acctype, ispriv); 
value_match = AArch64.BreakpointValueMatch(n, vaddress, linked_to); 


if HaveAnyAArch32() && size == 4 then // Check second halfword 
// If the breakpoint address and BAS of an Address breakpoint match the address of the 
// second halfword of an instruction, but not the address of the first halfword, it is 
// CONSTRAINED UNPREDICTABLE whether or not this breakpoint generates a Breakpoint debug 
// event. 
match_i = AArch64.BreakpointValueMatch(n, vaddress + 2, linked_to); 
if !value_match && match_i then 

value_match = ConstrainUnpredictableBool(); 


if vaddress<1> == '1' && DBGBCR_EL1[n].BAS == '1111' then 
// The above notwithstanding, if DBGBCR_EL1[n].BAS == '1111', then it is CONSTRAINED 
// UNPREDICTABLE whether or not a Breakpoint debug event is generated for an instruction 
// at the address DBGBVR_EL1[n]+2. 
if value_match then value_match = ConstrainUnpredictableBool(); 


match = value_match && state_match && enabled; 


return match; 


aarch64/debug/breakpoint/AArch64.BreakpointValueMatch 


// AArch64.BreakpointValueMatch() 


boolean AArch64.BreakpointValueMatch(integer n, bits(64) vaddress, boolean linked_to) 


// "n" is the identity of the breakpoint unit to match against. 

// "vaddress" is the current instruction address, ignored if linked_to is TRUE and for Context 
// matching breakpoints. 

// "linked_to" is TRUE if this is a call from StateMatch for linking. 


// If a non-existent breakpoint then it is CONSTRAINED UNPREDICTABLE whether this gives 
// no match or the breakpoint is mapped to another UNKNOWN implemented breakpoint. 
if n > UInt(ID_AA64DFRO_EL1.BRPs) then 

(c, n) = ConstrainUnpredictableInteger(@, UInt(ID_AA64DFRO_EL1.BRPs)); 

assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; 

if c == Constraint_DISABLED then return FALSE; 


// If this breakpoint is not enabled, it cannot generate a match. (This could also happen on a 
// call from StateMatch for linking). 

if DBGBCR_EL1[n].E == '@' then return FALSE; 

context_aware = (n >= UInt(ID_AA64DFROQ_EL1.BRPs) - UInt(ID_AA64DFRQ_EL1.CTX_CMPs)); 


// If BT is set to a reserved type, behaves either as disabled or as a not-reserved type. 
dbgtype = DBGBCR_EL1[n] .BT; 


if ((dbgtype IN {'Q@11x','11xx'} && !HaveVirtHostExt()) || // Context matching 
dbgtype == 'Q10x' || // Reserved 
(dbgtype != '@x0x' && !context_aware) || // Context matching 
(dbgtype == '1xxx' && !HaveEL(EL2))) then // EL2 extension 


(c, dbgtype) = ConstrainUnpredictableBits(); 

assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; 

if c == Constraint_DISABLED then return FALSE; 

// Otherwise the value returned by ConstrainUnpredictableBits must be a not-reserved value 


// Determine what to compare against. 
match_addr = (dbgtype == 'QxQx'); 
match_vmid = (dbgtype == '10xx'); 
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J1-7302 


match_cid = (dbgtype == 'QQ1x'); 
match_cid1 = (dbgtype IN { '101x', 'x11x'}); 
match_cid2 = (dbgtype == '11xx'); 
linked = (dbgtype == 'xxx1'); 


// If this is a call from StateMatch, return FALSE if the breakpoint is not programmed for a 
// \MID and/or context ID match, of if not context-aware. The above assertions mean that the 
// code can just test for match_addr == TRUE to confirm all these things. 

if linked_to && (!linked || match_addr) then return FALSE; 


// If called from BreakpointMatch return FALSE for Linked context ID and/or VMID matches. 
if !linked_to && linked && !match_addr then return FALSE; 


// Do the comparison. 
if match_addr then 
byte = UInt(vaddress<1:0>); 
if HaveAnyAArch32() then 
// T32 instructions can be executed at EL@ in an AArch64 translation regime. 


assert byte IN {0,2}; // "vaddress" is halfword aligned 
byte_select_match = (DBGBCR_EL1[n] .BAS<byte> == '1'); 

else 
assert byte == Q; // "vaddress" is word aligned 
byte_select_match = TRUE; // DBGBCR_EL1[n].BAS<byte> is RES1 


top = AddrTop(vaddress, TRUE, PSTATE.EL); 
BVR_match = vaddress<top:2> == DBGBVR_EL1[n]<top:2> && byte_select_match; 
elsif match_cid then 
if IsInHost() then 
BVR_match = (CONTEXTIDR_EL2 == DBGBVR_EL1[n]<31:0>); 
else 
BVR_match = (PSTATE.EL IN {EL@, EL1} && CONTEXTIDR_EL1 == DBGBVR_EL1[n]<31:0>); 
elsif match_cid1 then 
BVR_match = (PSTATE.EL IN {EL@, EL1} && !IsInHost() && CONTEXTIDR_EL1 == DBGBVR_EL1[n]<31:0>); 
if match_vmid then 
if !Havel6bitVMID() || VTCR_EL2.VS == '@' then 
vmid = ZeroExtend(VTTBR_EL2.VMID<7:0>, 16); 
bvr_vmid = ZeroExtend(DBGBVR_EL1[n]<39:32>, 16); 
else 
vmid = VTTBR_EL2.VMID; 
bvr_vmid = DBGBVR_EL1[n]<47:32>; 
BXVR_match = (PSTATE.EL IN {EL@, EL1} && EL2Enabled() && 
!IsInHost() && 
vmid == bvr_vmid); 
elsif match_cid2 then 
BXVR_match = (!IsSecure() && HaveVirtHostExt() && 
DBGBVR_EL1[n]<63:32> == CONTEXTIDR_EL2); 


bvr_match_valid = (match_addr || match_cid || match_cid1) 
bxvr_match_valid = (match_vmid || match_cid2); 


match = (!bxvr_match_valid || BXVR_match) && (!bvr_match_valid || BVR_match); 


return match; 


aarch64/debug/breakpoint/AArch64.StateMatch 


// AArch64.StateMatch() 
// Determine whether a breakpoint or watchpoint is enabled in the current mode and state. 


boolean AArch64.StateMatch(bits(2) SSC, bit HMC, bits(2) PxC, boolean linked, bits(4) LBN, 
boolean isbreakpnt, AccType acctype, boolean ispriv) 
// "SSC", "HMC", "PxC" are the control fields from the DBGBCR[n] or DBGWCR[n] register. 
// "linked" is TRUE if this is a linked breakpoint/watchpoint type. 
// "LBN" is the linked breakpoint number from the DBGBCR[n] or DBGWCR[n] register. 
// “isbreakpnt" is TRUE for breakpoints, FALSE for watchpoints. 
// “ispriv" is valid for watchpoints, and selects between privileged and unprivileged accesses. 
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// If parameters are set to a reserved type, behaves as either disabled or a defined type 
(c, SSC, HMC, PxC) = CheckValidStateMatch(SSC, HMC, PxC, isbreakpnt); 

if c == Constraint_DISABLED then return FALSE; 

// Otherwise the HMC,SSC,PxC values are either valid or the values returned by 

// CheckValidStateMatch are valid. 


EL3_match = HaveEL(EL3) && HMC == '1' && SSC<0> == '0'; 

EL2_match = HaveEL(EL2) && ((HMC == '1' && (SSC:PxC != '1000')) || SSC == '11'); 
EL1_match = PxC<@> == '1'; 

EL@_match = PxC<l> == '1'; 


if HaveNV2Ext() && acctype == AccType_NV2REGISTER && !isbreakpnt then 
priv_match = EL2_match; 
elsif !ispriv && !isbreakpnt then 
priv_match = ELQ_match; 
else 
case PSTATE.EL of 
when EL3 priv_match = EL3_match; 
when EL2 priv_match = EL2_match; 
when EL1 priv_match = EL1_match; 
when ELO priv_match = ELQ_match; 


case SSC of 
when 'Q0' security_state_match = TRUE; // Both 
when '01' security_state_match = !IsSecure(); // Non-secure only 
when '10' security_state_match = IsSecure(); // Secure only 


when '11' security_state_match = (HMC == '1' || IsSecure()); // HMC=1 -> Both, @ -> Secure 
only 


if linked then 
// "LBN" must be an enabled context-aware breakpoint unit. If it is not context-aware then 
// it is CONSTRAINED UNPREDICTABLE whether this gives no match, or LBN is mapped to some 
// UNKNOWN breakpoint that is context-aware. 
lbn = UInt(LBN); 
first_ctx_cmp = (UInt(ID_AA64DFROQ_EL1.BRPs) - UInt(ID_AA64DFRO_EL1.CTX_CMPs)); 
Jast_ctx_cmp = UInt(ID_AA64DFRQ_EL1.BRPs); 
if (lbn < first_ctx_cmp || lbn > last_ctx_cmp) then 
(c, Ibn) = ConstrainUnpredictableInteger(first_ctx_cmp, last_ctx_cmp); 
assert c IN {Constraint_DISABLED, Constraint_NONE, Constraint_UNKNOWN}; 


case c of 
when Constraint_DISABLED return FALSE; // Disabled 
when Constraint_NONE linked = FALSE; // No linking 


// Otherwise ConstrainUnpredictableInteger returned a context-aware breakpoint 


if linked then 
vaddress = bits(64) UNKNOWN; 
linked_to = TRUE; 
linked_match = AArch64.BreakpointValueMatch(lbn, vaddress, linked_to); 


return priv_match && security_state_match && (!linked || Tinked_match); 


aarch64/debug/breakpoint/CheckValidStateMatch 


// CheckValidStateMatch() 


// Checks for an invalid state match that will generate Constrained Unpredictable behavior, otherwise 
// returns Constraint_NONE. 


(Constraint, bits(2), bit, bits(2)) CheckValidStateMatch(bits(2) SSC, bit HMC, bits(2) PxC, boolean 
isbreakpnt) 
boolean reserved = FALSE; 


// Match 'Usr/Sys/Svc' only valid for AArch32 breakpoints 
if (!isbreakpnt || !HaveAArch32EL(EL1)) && HMC:PxC == '000' && SSC != '11' then 
reserved = TRUE; 


// Both EL3 and EL2 are not implemented 
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if !HaveEL(EL3) && !HaveEL(EL2) && (HMC != '@' || SSC != '00') then 
reserved = TRUE; 


// EL3 is not implemented 
if !HaveEL(EL3) && SSC IN {'@1','10'} && HMC:SSC:PxC != '10100' then 
reserved = TRUE; 


// EL3 using AArch64 only 
if (!HaveEL(EL3) || HighestELUsingAArch32()) && HMC:SSC:PxC == '11000' then 
reserved = TRUE; 


// EL2 is not implemented 
if !HaveEL(EL2) && HMC:SSC:PxC == '11100' then 
reserved = TRUE; 


// Secure EL2 is not implemented 
if !HaveSecureEL2Ext() && (HMC:SSC:PxC) IN {'@1100','10100','x11x1'} then 
reserved = TRUE; 


// Values that are not allocated in any architecture version 
if (HMC:SSC:PxC) IN {'Q1110','100x@','10110','11x10'} then 
reserved = TRUE; 


if reserved then 
// If parameters are set to a reserved type, behaves as either disabled or a defined type 
(c, <HMC,SSC,PxC>) = ConstrainUnpredictableBits(); 
assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; 
if c == Constraint_DISABLED then 
return (c, bits(2) UNKNOWN, bit UNKNOWN, bits(2) UNKNOWN); 
// Otherwise the value returned by ConstrainUnpredictableBits must be a not-reserved value 


return (Constraint_NONE, SSC, HMC, PxC); 


aarch64/debug/enables/AArch64.GenerateDebugExceptions 


// AArch64.GenerateDebugExceptions() 
// EEPE 


boolean AArch64.GenerateDebugExceptions() 
return AArch64.GenerateDebugExceptionsFrom(PSTATE.EL, IsSecure(), PSTATE.D); 
aarch64/debug/enables/AArch64.GenerateDebugExceptionsFrom 


// AArch64.GenerateDebugExceptionsFrom( ) 
[I sssssssseeesssnass2ssssseseeeeeee==== 


boolean AArch64.GenerateDebugExceptionsFrom(bits(2) from, boolean secure, bit mask) 


if OSLSR_EL1.0SLK == '1' || DoubleLockStatus() || Halted() then 
return FALSE; 


route_to_el2 = HaveEL(EL2) && (!secure || IsSecureEL2Enabled()) && (HCR_EL2.TGE == '1' | 
MDCR_EL2.TDE == '1'); 
target = (if route_to_el2 then EL2 else EL1); 


enabled = !HaveEL(EL3) || !secure || MDCR_EL3.SDD == 'Q'; 
if from == target then 

enabled = enabled && MDSCR_EL1.KDE == '1' && mask == 'Q'; 
else 


enabled = enabled && UInt(target) > UInt(from); 


return enabled; 
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aarch64/debug/pmu/AArch64.CheckForPMU Overflow 


// AArch64.CheckForPMUOverflow() 
[| ============================= 


// Signal Performance Monitors overflow IRQ and CTI overflow events 
boolean AArch64.CheckForPMUOverflow() 


pmuirq = PMCR_EL@.E == '1' && PMINTENSET_EL1<31> == '1' && PMOVSSET_EL0<31> == '1'; 
for n = 0 to UInt(PMCR_ELO.N) - 1 
if HaveEL(EL2) then 
E = (if n < UInt(MDCR_EL2.HPMN) then PMCR_ELO.E else MDCR_EL2.HPME); 
else 
E = PMCR_ELO.E; 
if E == '1' && PMINTENSET_EL1<n> == '1' && PMOVSSET_EL@<n> == '1' then pmuirq = TRUE; 


SetInterruptRequestLevel(InterruptID_PMUIRQ, if pmuirq then HIGH else LOW); 
CTI_SetEventLevel(CrossTriggerIn_PMUOverflow, if pmuirq then HIGH else LOW); 


// The request remains set until the condition is cleared. (For example, an interrupt handler 
// or cross-triggered event handler clears the overflow status flag by writing to PMOVSCLR_ELQ.) 


return pmuirq; 


aarch64/debug/pmu/AArch64.CountEvents 


// AArch64.CountEvents() 
// ===================== 


// Return TRUE if counter "n" should count its event. For the cycle counter, n == 31. 


boolean AArch64.CountEvents(integer n) 
assert n == 31 || n < UInt(PMCR_ELO.N); 


// Event counting is disabled in Debug state 
debug = Halted(); 


// In Non-secure state, some counters are reserved for EL2 
if HaveEL(EL2) then 
E = if n < UInt(MDCR_EL2.HPMN) || n == 31 then PMCR_EL@.E else MDCR_EL2.HPME; 
else 
E = PMCR_ELO.E; 
enabled = E == '1' && PMCNTENSET_EL@<n> == '1'; 
// Event counting in Secure state is prohibited unless any one of: 
// « EL3 is not implemented 
// * EL3 is using AArch64 and MDCR_EL3.SPME == 


prohibited = HaveEL(EL3) && IsSecure() && MDCR_EL3.SPME == 'Q'; 


// Event counting at EL2 is prohibited if all of: 
// » The HPMD Extension is implemented 
// » Executing at EL2 
// » PMNx is not reserved for EL2 
// * MDCR_EL2.HPMD == 
if !prohibited && HaveEL(EL2) && HaveHPMDExt() && PSTATE.EL == EL2 && (n < UInt(MDCR_EL2.HPMN) || n 
== 31) then 
prohibited = (MDCR_EL2.HPMD == '1'); 
// The IMPLEMENTATION DEFINED authentication interface might override software controls 
if prohibited && !HaveNoSecurePMUDisableOverride() then 
prohibited = !ExternalSecureNoninvasiveDebugEnabled(); 


// For the cycle counter, PMCR_EL@.DP enables counting when otherwise prohibited 
if prohibited && n == 31 then prohibited = (PMCR_ELQ.DP == '1'); 


// Event counting can be filtered by the {P, U, NSK, NSU, NSH, M, SH} bits 
filter = if n == 31 then PMCCFILTR else PMEVTYPER[n]; 
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P = filter<31>; 

U = filter<30>; 

NSK = if HaveEL(EL3) then filter<29> else '0'; 

NSU = if HaveEL(EL3) then filter<28> else 'Q'; 

NSH = if HaveEL(EL2) then filter<27> else '0'; 

M = if HaveEL(EL3) then filter<26> else 'Q'; 

SH = if HaveSecureEL2Ext() then filter<24> else '0'; 


case PSTATE.EL of 
when ELO filtered = if IsSecure() then U == '1' else U != NSU; 
when EL1 filtered = if IsSecure() then P == '1' else P != NSK; 
when EL2 filtered = (if IsSecure() then NSH == SH else NSH == '1'); 
when EL3 filtered = (M != P); 


return !debug && enabled && !prohibited && ! filtered; 


aarch64/debug/statisticalprofiling/CheckProfilingBufferAccess 


// CheckProfilingBufferAccess() 
[| ============================ 


SysRegAccess CheckProfilingBufferAccess() 
if !HaveStatisticalProfiling() || PSTATE.EL == ELO || UsingAArch32() then 
return SysRegAccess_UNDEFINED; 


if PSTATE.EL == EL1 && EL2Enabled() && MDCR_EL2.E2PB<0> != '1' then 
return SysRegAccess_TrapToEL2; 


if HaveEL(EL3) && PSTATE.EL != EL3 && MDCR_EL3.NSPB != SCR_EL3.NS:'1' then 
return SysRegAccess_TrapToEL3; 


return SysRegAccess_0K; 


aarch64/debug/statisticalprofiling/CheckStatisticalProfilingAccess 


// CheckStatisticalProfilingAccess() 
Dl ems 


SysRegAccess CheckStatisticalProfilingAccess() 
if !HaveStatisticalProfiling() || PSTATE.EL == EL@ || UsingAArch32() then 
return SysRegAccess_UNDEFINED; 


if PSTATE.EL == EL1 && EL2Enabled() && MDCR_EL2.TPMS == '1' then 
return SysRegAccess_TrapToEL2; 


if HaveEL(EL3) && PSTATE.EL != EL3 && MDCR_EL3.NSPB != SCR_EL3.NS:'1' then 
return SysRegAccess_TrapToEL3; 


return SysRegAccess_0OK; 


aarch64/debug/statisticalprofiling/CollectContextIDR1 


// CollectContextIDR1() 
|/ ==================== 


boolean CollectContextIDR1() 
if !StatisticalProfilingEnabled() then return FALSE; 
if PSTATE.EL == EL2 then return FALSE; 
if EL2Enabled() && HCR_EL2.TGE == '1' then return FALSE; 
return PMSCR_EL1.CX == '1'; 
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aarch64/debug/statisticalprofiling/CollectContextIDR2 


// CollectContextIDR2() 
|[ ==================== 


boolean CollectContextIDR2() 
if !StatisticalProfilingEnabled() then return FALSE; 
if EL2Enabled() then return FALSE; 
return PMSCR_EL2.CX == '1'; 


aarch64/debug/statisticalprofiling/CollectPhysicalAddress 


// CollectPhysicalAddress() 
|[ ======================== 


boolean CollectPhysicalAddress() 
if !StatisticalProfilingEnabled() then return FALSE; 
(secure, el) = ProfilingBufferOwner(); 
if !secure && HaveEL(EL2) then 
return PMSCR_EL2.PA == '1' && (el == EL2 || PMSCR_EL1.PA == '1'); 
else 
return PMSCR_EL1.PA == '1'; 


aarch64/debug/statisticalprofiling/CollectRecord 


// CollectRecord() 
// =============== 


boolean CollectRecord(bits(64) events, integer total_latency, OpType optype) 
assert StatisticalProfilingEnabled(); 


// Filtering by event 
if PMSFCR_EL1.FE == '1' then 
// Check for UNPREDICTABLE case 
if IsZero(PMSEVFR_EL1) && ConstrainUnpredictableBool() then 
return FALSE; 
bits(64) mask = OxFFFFQQQQFFQQFQAA<63:0>; // Bits [63:48,31:24,15:12,7,5,3,1] 
if HaveStatisticalProfiling() then 
mask<1l1> = '1'; // Alignment flag 
if HaveSVE() then mask<18:17> = Ones(); // Predicate flags 
e = events AND mask; 
m = PMSEVFR_EL1 AND mask; 
if !IsZero(NOT(e) AND m) then return FALSE; 


// Filtering by type 
if PMSFCR_EL1.FT == '1' then 
// Check for UNPREDICTABLE case 
if IsZero(PMSFCR_EL1.<B,LD,ST>) && ConstrainUnpredictableBool() then 
return FALSE; 
case optype of 
when OpType_Branch 
if PMSFCR_EL1.B == '@' then return FALSE; 
when OpType_Load 
if PMSFCR_EL1.LD == '@' then return FALSE; 
when OpType_Store 
if PMSFCR_EL1.ST == '@' then return FALSE; 
when OpType_LoadAtomic 
if PMSFCR_EL1.<LD,ST> == '@@' then return FALSE; 
otherwise 
return FALSE; 


// Filtering by latency 
if PMSFCR_EL1.FL == '1' then 
// Check for UNPREDICTABLE case 
if IsZero(PMSLATFR_EL1.MINLAT) && ConstrainUnpredictableBool() then 
return FALSE; 
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if total_latency < UInt(PMSLATFR_EL1.MINLAT) then 
return FALSE; 


return TRUE; 


aarch64/debug/statisticalprofiling/CollectTimeStamp 


// CollectTimeStamp() 
// ================== 


TimeStamp CollectTimeStamp() 
if !StatisticalProfilingEnabled() then return TimeStamp_None; 
(secure, el) = ProfilingBufferOwner(); 
if el == EL2 then 
if PMSCR_EL2.TS == 'Q' then return TimeStamp_None; 
else 
if PMSCR_EL1.TS == 'Q' then return TimeStamp_None; 
if EL2Enabled() then 
pct = PMSCR_EL2.PCT == '1' && (el == EL2 || PMSCR_EL1.PCT == '1'); 
else 
pct = PMSCR_EL1.PCT == '1'; 
return (if pct then TimeStamp_Physical else TimeStamp_Virtual); 


aarch64/debug/statisticalprofiling/OpType 


enumeration OpType { 


OpType_Load, // Any memory-read operation other than atomics, compare-and-swap, and 
swap 

OpType_Store, // Any memory-write operation, including atomics without return 

OpType_LoadAtomic, // Atomics with return, compare-and-swap and swap 

OpType_Branch, // Software write to the PC 

OpType_Other // Any other class of operation 


aarch64/debug/statisticalprofiling/ProfilingBufferEnabled 


// ProfilingBufferEnab1ed() 
// ======================== 


boolean ProfilingBufferEnabled() 
if !HaveStatisticalProfiling() then return FALSE; 
(secure, el) = ProfilingBufferOwner(); 
non_secure_bit = if secure then 'Q' else '1'; 
return (!ELUsingAArch32(el) && non_secure_bit == SCR_EL3.NS && 
PMBLIMITR_EL1.E == '1' && PMBSR_EL1.S == 'Q'); 


aarch64/debug/statisticalprofiling/ProfilingBufferOwner 


// ProfilingBufferOwner( ) 
// ====================== 


(boolean, bits(2)) ProfilingBufferOwner() 
secure = if HaveEL(EL3) then (MDCR_EL3.NSPB<1> == '0') else IsSecure(); 
el = if !secure && HaveEL(EL2) && MDCR_EL2.E2PB == '00' then EL2 else EL1; 
return (secure, el); 


aarch64/debug/statisticalprofiling/ProfilingSynchronizationBarrier 


// Barrier to ensure that all existing profiling data has been formatted, and profiling buffer 
// addresses have been translated such that writes to the profiling buffer have been initiated. 
// A following DSB completes when writes to the profiling buffer have completed. 

Profi lingSynchronizationBarrier(); 
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aarch64/debug/statisticalprofiling/StatisticalProfilingEnabled 


// StatisticalProfilingEnabled() 


boolean StatisticalProfilingEnabled() 
if !HaveStatisticalProfiling() || UsingAArch32() || !ProfilingBufferEnabled() then 
return FALSE; 


in_host = EL2Enabled() && HCR_EL2.TGE == '1'; 

(secure, el) = ProfilingBufferOwner(); 

if UInt(el) < UlInt(PSTATE.EL) || secure != IsSecure() || (in_host && el == EL1) then 
return FALSE; 


case PSTATE.EL of 
when EL3 Unreachable(); 
when EL2 spe_bit = PMSCR_EL2.E2SPE; 
when EL1 spe_bit = PMSCR_EL1.E1SPE; 
when ELO spe_bit = (if in_host then PMSCR_EL2.EQHSPE else PMSCR_EL1.EQ@SPE); 


return spe_bit == '1'; 


aarch64/debug/statisticalprofiling/SysRegAccess 


enumeration SysRegAccess { SysRegAccess_OK, 
SysRegAccess_UNDEFINED, 
SysRegAccess_TrapToEL1, 
SysRegAccess_TrapToEL2, 
SysRegAccess_TrapToEL3 }; 


aarch64/debug/statisticalprofiling/TimeStamp 


enumeration TimeStamp { 


TimeStamp_None, // No timestamp 
TimeStamp_CoreSight, // CoreSight time (IMPLEMENTATION DEFINED) 
TimeStamp_Virtual, // Physical counter value minus CNTVOFF_EL2 


TimeStamp_Physical }; // Physical counter value with no offset 


aarch64/debug/takeexceptiondbg/AArch64. TakeExceptionInDebugState 


// AArch64.TakeExceptionInDebugState() 
// Take an exception in Debug state to an Exception Level using AArché4. 


AArch64.TakeExceptionInDebugState(bits(2) target_el, ExceptionRecord exception) 
assert HaveEL(target_el) && !ELUsingAArch32(target_el) && UInt(target_el) >= UInt(PSTATE.EL); 


sync_errors = HaveIESB() && SCTLR[].IESB == '1'; 
if HaveDoubleFaultExt() then 
sync_errors = sync_errors || (SCR_EL3.EA == '1' && SCR_EL3.NMEA == '1' && PSTATE.EL == EL3); 
// SCTLR[].IESB might be ignored in Debug state. 
if !ConstrainUnpredictableBool() then 
sync_errors = FALSE; 


SynchronizeContext(); 


// If coming from AArch32 state, the top parts of the X[] registers might be set to zero 
from_32 = UsingAArch32(); 

if from_32 then AArch64.MaybeZeroRegisterUppers(); 

MaybeZeroSVEUppers(target_el); 


AArch64.ReportException(exception, target_el); 
PSTATE.EL = target_el; 


PSTATE.nRW = '0'; 
PSTATE.SP = '1'; 
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SPSR[] = bits(32) UNKNOWN; 
ELR[] = bits(64) UNKNOWN; 


// PSTATE.{SS,D,A,I,F} are not observable and ignored in Debug state, so behave as if UNKNOWN. 
PSTATE.<SS,D,A,I,F> = bits(5) UNKNOWN; 


PSTATE.IL = '0'; 

if from_32 then // Coming from AArch32 
PSTATE.IT = '00000000'; 
PSTATE.T = '0'; // PSTATE.J is RESO 


if (HavePANExt() && (PSTATE.EL == EL1 || (PSTATE.EL == EL2 && ELIsInHost(EL@))) && 
SCTLR[].SPAN == '@') then 
PSTATE.PAN = '1'; 

if HaveUAOExt() then PSTATE.UAO = '0'; 

if HaveBTIExt() then PSTATE.BTYPE = 'QQ'; 

if HaveSSBSExt() then PSTATE.SSBS = bit UNKNOWN; 

if HaveMTEExt() then PSTATE.TCO = '1'; 





DLR_EL@ = bits(64) UNKNOWN; 
DSPSR_EL@ = bits(32) UNKNOWN; 


EDSCR.ERR = '1'; 
UpdateEDSCRFields(); // Update EDSCR processor state flags. 





if sync_errors then 
SynchronizeErrors(); 


EndOfInstruction(); 


aarch64/debug/watchpoint/AArch64.WatchpointByteMatch 


// AArch64.WatchpointByteMatch() 
e 


boolean AArch64.WatchpointByteMatch(integer n, AccType acctype, bits(64) vaddress) 


el = if HaveNV2Ext() && acctype == AccType_NV2REGISTER then EL2 else PSTATE.EL; 

top = AddrTop(vaddress, FALSE, el); 

bottom = if DBGWVR_EL1[n]<2> == '1' then 2 else 3; // Word or doubleword 
byte_select_match = (DBGWCR_EL1[n] .BAS<UInt(vaddress<bottom-1:0>)> != 'Q'); 

mask = UInt(DBGWCR_EL1[n] .MASK) ; 


// If DBGWCR_EL1[n].MASK is non-zero value and DBGWCR_EL1[n].BAS is not set to '11111111', or 
// DBGWCR_EL1[n].BAS specifies a non-contiguous set of bytes behavior is CONSTRAINED 
// UNPREDICTABLE. 
if mask > @ && !IsOnes(DBGWCR_EL1[n].BAS) then 
byte_select_match = ConstrainUnpredictableBool(); 


else 
LSB = (DBGWCR_EL1[n].BAS AND NOT(DBGWCR_EL1[n].BAS - 1)); MSB = (DBGWCR_EL1[n].BAS + LSB); 
if !IsZero(MSB AND (MSB - 1)) then // Not contiguous 
byte_select_match = ConstrainUnpredictableBool() 
bottom = 3; // For the whole doubleword 


// If the address mask is set to a reserved value, the behavior is CONSTRAINED UNPREDICTABLE. 
if mask > 0 && mask <= 2 then 

(c, mask) = ConstrainUnpredictableInteger(3, 31); 

assert c IN {Constraint_DISABLED, Constraint_NONE, Constraint_UNKNOWN}; 


case c of 
when Constraint_DISABLED return FALSE; // Disabled 
when Constraint_NONE mask = Q; // No masking 


// Otherwise the value returned by ConstrainUnpredictableInteger is a not-reserved value 


if mask > bottom then 
WVR_match = (vaddress<top:mask> == DBGWVR_EL1[n]<top:mask>) ; 
// If masked bits of DBGWVR_EL1[n] are not zero, the behavior is CONSTRAINED UNPREDICTABLE. 
if WR_match && !IsZero(DBGWVR_EL1[n]<mask-1:bottom>) then 
WVR_match = ConstrainUnpredictableBool(); 
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else 
WVR_match = vaddress<top:bottom> == DBGWVR_EL1[n]<top:bottom>; 


return WR_match && byte_select_match; 


aarch64/debug/watchpoint/AArch64.WatchpointMatch 


// AArch64.WatchpointMatch() 


// Watchpoint matching in an AArch64 translation regime. 


boolean AArch64.WatchpointMatch(integer n, bits(64) vaddress, integer size, boolean ispriv, 
AccType acctype, boolean iswrite) 
assert !ELUsingAArch32(S1TranslationRegime()); 
assert n <= UInt(ID_AA64DFRO_EL1.WRPs) ; 


// “ispriv" is FALSE for LDTR/STTR instructions executed at EL1 and all 

// load/stores at EL@, TRUE for all other load/stores. "iswrite" is TRUE for stores, FALSE for 
// loads. 

enabled = DBGWCR_EL1[n].E == '1'; 

linked = DBGWCR_EL1[n].WT == '1'; 

isbreakpnt = FALSE; 


state_match = AArch64.StateMatch(DBGWCR_EL1[n].SSC, DBGWCR_EL1[n].HMC, DBGWCR_EL1[n].PAC, 
linked, DBGWCR_EL1[n].LBN, isbreakpnt, acctype, ispriv); 


1s_match = (DBGWCR_EL1[n].LSC<(if iswrite then 1 else Q)> == '1'); 


value_match = FALSE; 
for byte = @ to size - 1 
value_match = value_match || AArch64.WatchpointByteMatch(n, acctype, vaddress + byte); 


return value_match && state_match && Is_match && enabled; 


J1.1.2 aarch64/exceptions 


This section includes the following pseudocode functions: 

à aarch64/exceptions/aborts/AArch64.Abort on page J1-7312. 

` aarch64/exceptions/aborts/AArch64.AbortSyndrome on page J1-7312. 

à aarch64/exceptions/aborts/AArch64.CheckPCAlignment on page J1-7313. 

: aarch64/exceptions/aborts/AArch64.DataAbort on page J1-7313. 

s aarch64/exceptions/aborts/AArch64.EffectiveTCF on page J1-7313. 

$ aarch64/exceptions/aborts/AArch64.InstructionAbort on page J1-7314. 

: aarch64/exceptions/aborts/AArch64.PCAlignmentFault on page J1-7314. 

$ aarch64/exceptions/aborts/AArch64.ReportTagCheckFail on page J1-7314. 

s aarch64/exceptions/aborts/AArch64.SPAlignmentFault on page J1-7315. 

à aarch64/exceptions/aborts/AArch64. TagCheckFail on page J1-7315. 

a aarch64/exceptions/aborts/AArch64. TagCheckFault on page J1-7315. 
aarch64/exceptions/aborts/BranchTargetException on page J1-7316. 

7 aarch64/exceptions/asynch/AArch64. TakePhysicalFIQException on page J1-7316. 
à aarch64/exceptions/asynch/AArch64. TakePhysicalIRQException on page J1-7316. 
° aarch64/exceptions/asynch/AArch64. TakePhysicalSErrorException on page J1-7317. 
: aarch64/exceptions/asynch/AArch64. TakeVirtualFIQException on page J1-7317. 

$ aarch64/exceptions/asynch/AArch64. TakeVirtualIRQException on page J1-7317. 

s aarch64/exceptions/asynch/AArch64. TakeVirtualSErrorException on page J1-7318. 
$ aarch64/exceptions/debug/AArch64. BreakpointException on page J1-7318. 

. aarch64/exceptions/debug/AArch64.SoftwareBreakpoint on page J1-7318. 

$ aarch64/exceptions/debug/AArch64.SoftwareStepException on page J1-7319. 

` aarch64/exceptions/debug/AArch64. VectorCatchException on page J1-7319. 
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$ aarch64/exceptions/debug/AArch64.WatchpointException on page J1-7319. 

è aarch64/exceptions/exceptions/AArch64.ExceptionClass on page J1-7320. 

à aarch64/exceptions/exceptions/AArch64.ReportException on page J1-7321. 

è aarch64/exceptions/exceptions/AArch64.ResetControlRegisters on page J1-7321. 
è aarch64/exceptions/exceptions/AArch64. TakeReset on page J1-7321. 

: aarch64/exceptions/ieeefp/AArch64.F PTrappedException on page J1-7322. 

7 aarch64/exceptions/syscalls/AArch64.CallHypervisor on page J1-7323. 

- aarch64/exceptions/syscalls/AArch64.CallSecureMonitor on page J1-7323. 

$ aarch64/exceptions/syscalls/AArch64.CallSupervisor on page J1-7323. 

$ aarch64/exceptions/takeexception/AArch64. TakeException on page J1-7324. 

s aarch64/exceptions/traps/AArch64.AArch32SystemAccess Trap on page J1-7325. 

à aarch64/exceptions/traps/AArch64. AArch3 2SystemAccess TrapSyndrome on page J1-7325. 
° aarch64/exceptions/traps/AArch64.AdvSIMDFPAccessTrap on page J1-7326. 

è aarch64/exceptions/traps/AArch64. CheckCP 1 5InstrCoarseTraps on page J1-7327. 
: aarch64/exceptions/traps/AArch64. CheckF PAdvSIMDEnabled on page J1-7327. 

° aarch64/exceptions/traps/AArch64. CheckF PAdvSIMD Trap on page J1-7327. 

° aarch64/exceptions/traps/AArch64. CheckForERetTrap on page J1-7328. 

° aarch64/exceptions/traps/AArch64. CheckForSMCUndefOrTrap on page J1-7328. 
$ aarch64/exceptions/traps/AArch64. CheckForWFxTrap on page J1-7329. 

7 aarch64/exceptions/traps/AArch64. ChecklllegalState on page J1-7329. 

s aarch64/exceptions/traps/AArch64.MonitorModeTrap on page J1-7329. 

s aarch64/exceptions/traps/AArch64.SystemAccess Trap on page J1-7329. 

$ aarch64/exceptions/traps/AArch64. SystemAccess TrapSyndrome on page J1-7330. 
è aarch64/exceptions/traps/AArch64. UndefinedFault on page J1-7330. 

s aarch64/exceptions/traps/AArch64.WFxTrap on page J1-7330. 

° aarch64/exceptions/traps/CheckF PAdvSIMDEnabled64 on page J1-7331. 


aarch64/exceptions/aborts/AArch64.Abort 


// AArch64.Abort() 


// Abort and Debug exception handling in an AArch64 translation regime. 
AArch64.Abort(bits(64) vaddress, FaultRecord fault) 


if IsDebugException(fault) then 
if fault.acctype == AccType_IFETCH then 
if UsingAArch32() && fault.debugmoe == DebugException_VectorCatch then 
AArch64.VectorCatchException(fault) ; 
else 
AArch64.BreakpointException(fault) ; 
else 
AArch64.WatchpointException(vaddress, fault); 
elsif fault.acctype == AccType_IFETCH then 
AArch64.InstructionAbort(vaddress, fault); 
else 
AArch64.DataAbort(vaddress, fault); 


aarch64/exceptions/aborts/AArch64.AbortSyndrome 
// AArch64.AbortSyndrome() 


// Creates an exception syndrome record for Abort and Watchpoint exceptions 
// from an AArch64 translation regime. 


ExceptionRecord AArch64.AbortSyndrome(Exception exceptype, FaultRecord fault, bits(64) vaddress) 
exception = ExceptionSyndrome(exceptype) ; 
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d_side = exceptype IN {Exception_DataAbort, Exception_NV2DataAbort, Exception_Watchpoint, 
Exception_NV2Watchpoint}; 


exception.syndrome = AArch64.FaultSyndrome(d_side, fault); 
exception.vaddress = ZeroExtend(vaddress); 
if IPAValid(fault) then 
exception.ipavalid = TRUE; 
exception.NS = fault.ipaddress.NS; 
exception.ipaddress = fault.ipaddress.address; 
else 
exception.ipavalid = FALSE; 


return excepti on; 


aarch64/exceptions/aborts/AArch64.CheckPCAlignment 


// AArch64.CheckPCAlignment() 
|[ ========================== 


AArch64.CheckPCA1ignment() 


bits(64) pc = ThisInstrAddr(); 
if pc<1:@> != '00' then 
AArch64.PCAlignmentFault(); 


aarch64/exceptions/aborts/AArch64.DataAbort 


// AArch64.DataAbort() 
// =================== 


AArch64.DataAbort(bits(64) vaddress, FaultRecord fault) 
route_to_el3 = HaveEL(EL3) && SCR_EL3.EA == '1' && IsExternalAbort(fault); 
route_to_el2 = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && (HCR_EL2.TGE == '1' || 
(HaveRASExt() && HCR_EL2.TEA == '1' && IsExternalAbort(fault)) || 
(HaveNV2Ext() && fault.acctype == AccType_NV2REGISTER) || 
IsSecondStage(fault))); 


bits(64) preferred_exception_return = ThisInstrAddr(); 
if (HaveDoubleFaultExt() && (PSTATE.EL == EL3 || route_to_el3) && 
IsExternalAbort(fault) && SCR_EL3.EASE == '1') then 
vect_offset = 0x180; 
else 
vect_offset = 0x0; 
if HaveNV2Ext() && fault.acctype == AccType_NV2REGISTER then 
exception = AArch64.AbortSyndrome(Exception_NV2DataAbort, fault, vaddress); 
else 
exception = AArch64.AbortSyndrome(Exception_DataAbort, fault, vaddress); 
if PSTATE.EL == EL3 || route_to_el3 then 
AArch64.TakeException(EL3, exception, preferred_exception_return, vect_offset) ; 
elsif PSTATE.EL == EL2 || route_to_el2 then 
AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 
AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/aborts/AArch64.EffectiveT CF 
// AArch64.EffectiveTCF() 
// Returns the TCF field applied to Tag Check Fails in the given Exception Level. 


bits(2) AArch64.EffectiveTCF(bits(2) el) 
bits(2) tcf; 


if el == EL3 then 
tcf = SCTLR_EL3.TCF; 
elsif el == EL2 then 
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tcf = SCTLR_EL2.TCF; 

elsif el == EL1 then 
tcf = SCTLR_EL1.TCF; 

elsif el == ELO && HCR_EL2.<E2H,TGE> == '11' then 
tcf = SCTLR_EL2.TCFOQ; 

elsif el == ELO && HCR_EL2.<E2H,TGE> != '11' then 
tcf = SCTLR_EL1.TCFOQ; 


if tcf == '11' then 
(-,tcf) = ConstrainUnpredictableBits(); 


return tcf; 


aarch64/exceptions/aborts/AArch64.InstructionAbort 


// AArch64.InstructionAbort() 


AArch64.InstructionAbort(bits(64) vaddress, FaultRecord fault) 


// External aborts on instruction fetch must be taken synchronously 
if HaveDoubleFaultExt() then assert fault.statuscode != Fault_AsyncExternal; 
route_to_el3 = HaveEL(EL3) && SCR_EL3.EA == '1' && IsExternalAbort(fault) ; 
route_to_el2 = (PSTATE.EL IN {ELQ, EL1} && EL2Enabled() && 

(HCR_EL2.TGE == '1' || IsSecondStage(fault) | 

(HaveRASExt() && HCR_EL2.TEA == '1' && IsExternalAbort(fault)))); 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


exception = AArch64.AbortSyndrome(Exception_InstructionAbort, fault, vaddress); 


if PSTATE.EL == EL3 || route_to_el3 then 

AArch64.TakeException(EL3, exception, preferred_exception_return, vect_offset) ; 
elsif PSTATE.EL == EL2 || route_to_el2 then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/aborts/AArch64.PCAlignmentFault 


// AArch64.PCAlignmentFault() 


// Called on unaligned program counter in AArch64 state. 


AArch64.PCAlignmentFault() 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_PCAlignment) ; 
exception.vaddress = ThisInstrAddr(); 


if UInt(PSTATE.EL) > UInt(EL1) then 


AArch64.TakeException(PSTATE.EL, exception, preferred_exception_return, vect_offset) ; 


elsif EL2Enabled() && HCR_EL2.TGE == '1' then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/aborts/AArch64.ReportTagCheckFail 


// AArch64.ReportTagCheckFai1() 


// Records a tag fail exception into the appropriate TCFR_ELx. 


AArch64.ReportTagCheckFail(bits(2) el, bit ttbr) 
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if el == EL3 then 

assert ttbr == 'Q'; 

TFSR_EL3.TF0 = '1'; 
elsif el == EL2 then 

if ttbr == '@' then 
TFSR_EL2.TFO = '1'; 
else 
TFSR_EL2.TF1 = '1'; 
elsif el == EL1 then 

if ttbr == 'Q' then 
TFSR_EL1.TFO@ = '1'; 
else 
TFSR_EL1.TF1 = '1'; 
elsif el == ELQ then 

if ttbr == '@' then 
TFSREQ_EL1.TFO = '1'; 
else 





TFSREQ_EL1.TF1 = '1'; 


aarch64/exceptions/aborts/AArch64.SPAlignmentFault 
// AArch64.SPAlignmentFault() 

// Called on an unaligned stack pointer in AArch64 state. 
AArch64.SPAlignmentFault() 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_SPAlignment) ; 


if UInt(PSTATE.EL) > UInt(EL1) then 

AArch64.TakeException(PSTATE.EL, exception, preferred_exception_return, vect_offset) ; 
elsif EL2Enabled() && HCR_EL2.TGE == '1' then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/aborts/AArch64, TagCheckFail 
// AArch64.TagCheckFai1() 
// Handle a tag check fail condition. 


AArch64.TagCheckFail(bits(64) vaddress, boolean iswrite) 
bits(2) tcf = AArch64.EffectiveTCF(PSTATE.EL); 
if tcf == '01' then 
AArch64.TagCheckFault(vaddress, iswrite); 
elsif tcf == '10' then 
AArch64.ReportTagCheckFail(PSTATE.EL, vaddress<55>); 


aarch64/exceptions/aborts/AArch64. TagCheckFault 
// AArch64.TagCheckFault() 
// Raise a tag check fail exception. 
AArch64.TagCheckFault(bits(64) va, boolean write) 
bits(2) target_el; 
bits(64) preferred_exception_return = ThisInstrAddr(); 
integer vect_offset = 0x0; 
if PSTATE.EL == ELQ then 


target_el = if HCR_EL2.TGE == 'Q' then EL1 else EL2; 
else 
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target_el = PSTATE.EL; 


exception = ExceptionSyndrome(Exception_DataAbort) ; 
exception.syndrome<5:0> = '010001'; 
if write then 
exception.syndrome<6> = '1'; 
exception.vaddress = va; 


AArch64.TakeException(target_el, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/aborts/BranchTargetException 


// 
// 


BranchTargetException 


Raise branch target exception. 


AArch64.BranchTargetException(bits(52) vaddress) 


route_to_el2 = PSTATE.EL == ELO && EL2Enabled() && HCR_EL2.TGE == '1'; 
bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_BranchTarget) ; 
exception.syndrome<1:0> = PSTATE.BTYPE; 
exception.syndrome<24:2> = Zeros(); // RESO 


if UInt(PSTATE.EL) > UInt(EL1) then 


AArch64.TakeException(PSTATE.EL, exception, preferred_exception_return, vect_offset) ; 


elsif route_to_el2 then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/asynch/AArch64. TakePhysicalFIQException 


// AArch64.TakePhysicalFIQException() 


// 


AArch64.TakePhysicalFIQException() 


route_to_el3 = HaveEL(EL3) && SCR_EL3.FIQ == '1'; 

route_to_el2 = (PSTATE.EL IN {EL@, EL1} && EL2Enabled() && 
(HCR_EL2.TGE == '1' || HCR_EL2.FMO == '1')); 

bits(64) preferred_exception_return = ThisInstrAddr(); 

vect_offset = 0x100; 

exception = ExceptionSyndrome(Exception_FI1Q) ; 


if route_to_el3 then 

AArch64.TakeException(EL3, exception, preferred_exception_return, vect_offset) ; 
elsif PSTATE.EL == EL2 || route_to_el2 then 

assert PSTATE.EL != EL3; 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset); 
else 

assert PSTATE.EL IN {ELQ, EL1}; 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/asynch/AArch64. TakePhysicallRQException 


// AArch64.TakePhysicalIRQException() 


// 


// Take an enabled physical IRQ exception. 


AArch64.TakePhysicalIRQException() 


route_to_el3 = HaveEL(EL3) && SCR_EL3.IRQ == '1'; 
route_to_el2 = (PSTATE.EL IN {ELQ, EL1} && EL2Enabled() && 
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(HCR_EL2.TGE == '1' || HCR_EL2.IMO == '1')); 
bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x80; 


exception = ExceptionSyndrome(Exception_IRQ); 


if route_to_el3 then 

AArch64.TakeException(EL3, exception, preferred_exception_return, vect_offset); 
elsif PSTATE.EL == EL2 || route_to_el2 then 

assert PSTATE.EL != EL3; 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 

assert PSTATE.EL IN {ELQ, EL1}; 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/asynch/AArch64. TakePhysicalSErrorException 


// AArch64.TakePhysicalSErrorException() 
[T a 


AArch64.TakePhysicalSErrorException(boolean impdef_syndrome, bits(24) syndrome) 


route_to_el3 = HaveEL(EL3) && SCR_EL3.EA == '1'; 
route_to_el2 = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && 
(HCR_EL2.TGE == '1' || (!IsInHost() && HCR_EL2.AMO == '1'))); 
bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x180; 


exception = ExceptionSyndrome(Exception_SError) ; 
exception.syndrome<24> = if impdef_syndrome then '1' else 'Q'; 
exception.syndrome<23:0> = syndrome; 


ClearPendingPhysicalSError(); 


if PSTATE.EL == EL3 || route_to_el3 then 

AArch64.TakeException(EL3, exception, preferred_exception_return, vect_offset) ; 
elsif PSTATE.EL == EL2 || route_to_el2 then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset); 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/asynch/AArch64. TakeVirtualFIQException 


// AArch64.TakeVirtualFIQException() 
a 
AArch64.TakeVirtualFIQException() 
assert PSTATE.EL IN {EL0, EL1} && EL2Enabled(); 
assert HCR_EL2.TGE == '@' && HCR_EL2.FMO == '1'; // Virtual IRQ enabled if TGE==@ and FMO==1 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x100; 


exception = ExceptionSyndrome(Exception_FI1Q) ; 


AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/asynch/AArch64. TakeVirtuallRQException 


// AArch64.TakeVirtualIRQException() 
// =s 


AArch64. TakeVirtual IRQException() 
assert PSTATE.EL IN {ELQ, EL1} && EL2Enabled(); 
assert HCR_EL2.TGE == '@' && HCR_EL2.IMO == '1'; // Virtual IRQ enabled if TGE==@ and IMO==1 
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bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x80; 


exception = ExceptionSyndrome(Exception_IRQ); 


AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/asynch/AArch64.TakeVirtualSErrorException 


// AArch64.TakeVirtualSErrorException() 
// AASE 


AArch64.TakeVirtualSErrorException(boolean impdef_syndrome, bits(24) syndrome) 


assert PSTATE.EL IN {EL0, EL1} && EL2Enabled(); 
assert HCR_EL2.TGE == '@' && HCR_EL2.AMO == '1'; // Virtual SError enabled if TGE==@ and AMO==1 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x180; 


exception = ExceptionSyndrome(Exception_SError) ; 

if HaveRASExt() then 
exception.syndrome<24> = VSESR_EL2.IDS; 
exception.syndrome<23:0> = VSESR_EL2.ISS; 

else 
exception.syndrome<24> = if impdef_syndrome then '1' else 'Q'; 
if impdef_syndrome then exception.syndrome<23:0> = syndrome; 


ClearPendingVirtualSError(); 
AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/debug/AArch64.BreakpointException 


// AArch64.BreakpointException() 





AArch64.BreakpointException(FaultRecord fault) 
assert PSTATE.EL != EL3; 


route_to_el2 = (PSTATE.EL IN {ELQ, EL1} && EL2Enabled() && 
(HCR_EL2.TGE == '1' || MDCR_EL2.TDE == '1')); 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


vaddress = bits(64) UNKNOWN; 
exception = AArch64.AbortSyndrome(Exception_Breakpoint, fault, vaddress); 


if PSTATE.EL == EL2 || route_to_el2 then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset); 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/debug/AArch64.SoftwareBreakpoint 


// AArch64.SoftwareBreakpoint() 


AArch64.SoftwareBreakpoint(bits(16) immediate) 


route_to_el2 = (PSTATE.EL IN {ELQ, EL1} && 
EL2Enabled() && (HCR_EL2.TGE == '1' || MDCR_EL2.TDE == '1')); 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 
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exception = ExceptionSyndrome(Exception_SoftwareBreakpoint); 
exception.syndrome<15:0> = immediate; 


if UInt(PSTATE.EL) > UInt(EL1) then 

AArch64.TakeException(PSTATE.EL, exception, preferred_exception_return, vect_offset); 
elsif route_to_el2 then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset); 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/debug/AArch64.SoftwareStepException 


// AArch64.SoftwareStepException() 
[I 


AArch64.SoftwareStepException() 
assert PSTATE.EL != EL3; 


route_to_el2 = (PSTATE.EL IN {EL0, EL1} && EL2Enabled() && 
(HCR_EL2.TGE == '1' || MDCR_EL2.TDE == '1')); 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_SoftwareStep) ; 
if SoftwareStep_DidNotStep() then 
exception.syndrome<24> = 'Q'; 
else 
exception.syndrome<24> = '1'; 
exception.syndrome<6> = if SoftwareStep_SteppedEX() then '1' else 'Q'; 


if PSTATE.EL == EL2 || route_to_el2 then 
AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 


AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 
aarch64/exceptions/debug/AArch64.VectorCatchException 
// AArch64.VectorCatchException() 


// Nector Catch taken from ELO or EL1 to EL2. This can only be called when debug exceptions are 
// being routed to EL2, as Vector Catch is a legacy debug event. 


AArch64.VectorCatchException(FaultRecord fault) 
assert PSTATE.EL != EL2; 
assert EL2Enabled() && (HCR_EL2.TGE == '1' || MDCR_EL2.TDE == '1') 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


vaddress = bits(64) UNKNOWN; 
exception = AArch64.AbortSyndrome(Exception_VectorCatch, fault, vaddress); 


AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/debug/AArch64.WatchpointException 


// AArch64.WatchpointException() 
a 


AArch64.WatchpointException(bits(64) vaddress, FaultRecord fault) 
assert PSTATE.EL != EL3; 


route_to_el2 = (PSTATE.EL IN {EL@, EL1} && EL2Enabled() && 
(HCR_EL2.TGE == '1' || MDCR_EL2.TDE == '1')); 
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bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


if HaveNV2Ext() && fault.acctype == AccType_NV2REGISTER then 
exception = AArch64.AbortSyndrome(Exception_NV2Watchpoint, fault, vaddress); 
else 
exception = AArch64.AbortSyndrome(Exception_Watchpoint, fault, vaddress); 
if PSTATE.EL == EL2 || route_to_el2 then 
AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 
AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 
aarch64/exceptions/exceptions/AArch64.ExceptionClass 
// AArch64.ExceptionClass() 
// Returns the Exception Class and Instruction Length fields to be reported in ESR 
(integer,bit) AArch64.ExceptionClass(Exception exceptype, bits(2) target_el) 
il = if ThisInstrLength() == 32 then '1' else 'Q'; 
from_32 = UsingAArch32(); 


assert from_32 || il == '1'; // AArch64 instructions always 32-bit 


case exceptype of 


when Exception_Uncategorized ec = 0x00; il = '1'; 

when Exception_WFxTrap ec = 0x01; 

when Exception_CP15RTTrap ec = 0x03; assert from_32; 
when Exception_CP15RRTTrap ec = 0x04; assert from_32; 
when Exception_CP14RTTrap ec = 0x05; assert from_32; 
when Exception_CP14DTTrap ec = 0x06; assert from_32; 
when Exception_AdvSIMDFPAccessTrap ec = 0x07; 

when Exception_FPIDTrap ec = 0x08; 

when Exception_PACTrap ec = 0x09; 

when Exception_CP14RRTTrap ec = Ox0C; assert from_32; 
when Exception_BranchTarget ec = 0x0D; 

when Exception_I1legalState ec = 0x0E; il = '1'; 

when Exception_SupervisorCall ec = 0x11; 

when Exception_HypervisorCal] ec = 0x12; 

when Exception_MonitorCal1 ec = 0x13; 

when Exception_SystemRegisterTrap ec = 0x18; assert !from_32; 
when Exception_SVEAccessTrap ec = 0x19; assert !from_32; 
when Exception_ERetTrap ec = 0x1A; 

when Exception_InstructionAbort ec = 0x20; il = '1'; 

when Exception_PCAlignment ec = 0x22; il = '1'; 

when Exception_DataAbort ec = 0x24; 

when Exception_NV2DataAbort ec = 0x25; 

when Exception_SPAlignment ec = 0x26; il = '1'; assert !from_32; 
when Exception_FPTrappedException ec = Qx28; 

when Exception_SError ec = Ox2F; il = '1'; 

when Exception_Breakpoint ec = 0x30; il = '1'; 

when Exception_SoftwareStep ec = 0x32; il = '1'; 

when Exception_Watchpoint ec = 0x34; il = '1'; 

when Exception_NV2Watchpoint ec = 0x35; il = '1'; 

when Exception_SoftwareBreakpoint ec = 0x38; 

when Exception_VectorCatch ec = Qx3A; il = '1'; assert from_32; 
otherwise Unreachable(); 


if ec IN {0x20,0x24,0x30,0x32,0x34} && target_el == PSTATE.EL then 
ec = ec + 1; 


if ec IN {@x11, 0x12, 0x13, 0x28, 0x38} && !from_32 then 
ec = ec + 4; 


return (ec,il); 
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aarch64/exceptions/exceptions/AArch64.ReportException 


// AArch64.ReportException() 


// Report syndrome information for exception taken to AArch64 state. 
AArch64.ReportException(ExceptionRecord exception, bits(2) target_el) 
Exception exceptype = exception.exceptype; 


(ec,il) = AArch64.ExceptionClass(exceptype, target_el); 
iss = exception.syndrome; 


// IL is not valid for Data Abort exceptions without valid instruction syndrome information 
if ec IN {0x24,0x25} && iss<24> == '@' then 
il ='1'; 


ESR[target_el] = ec<5:0>:il:iss; 


if exceptype IN {Exception_InstructionAbort, Exception_PCAlignment, Exception_DataAbort, 
Exception_NV2DataAbort, Exception_NV2Watchpoint, 
Exception_Watchpoint} then 
FAR[target_el] = exception.vaddress; 
else 
FAR[target_el] = bits(64) UNKNOWN; 


if target_el == EL2 then 
if exception.ipavalid then 
HPFAR_EL2<43:4> = exception. ipaddress<51:12>; 
if HaveSecureEL2Ext() then 
if IsSecureEL2Enabled() then 
HPFAR_EL2.NS = exception.NS; 
else 
HPFAR_EL2.NS = 'Q'; 
else 
HPFAR_EL2<43:4> = bits(4@) UNKNOWN; 


return; 


aarch64/exceptions/exceptions/AArch64.ResetC ontrolRegisters 


// Resets System registers and memory-mapped control registers that have architectural ly-defined 
// reset values to those values. 
AArch64.ResetControlRegisters(boolean cold_reset); 


aarch64/exceptions/exceptions/AArch64.TakeReset 


// AArch64.TakeReset() 
D sssssssssss======== 
// Reset into AArch64 state 


AArch64.TakeReset(boolean cold_reset) 
assert !HighestELUsingAArch32(); 


// Enter the highest implemented Exception level in AArch64 state 
PSTATE.nRW = 'Q'; 
if HaveEL(EL3) then 
PSTATE.EL = EL3; 
elsif HaveEL(EL2) then 
PSTATE.EL = EL2; 
else 
PSTATE.EL = EL1; 


// Reset the system registers and other system components 
AArch64.ResetControlRegisters(cold_reset) ; 
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// Reset all other PSTATE fields 


PSTATE.SP = '1'; // Select stack pointer 

PSTATE.<D,A,I,F> = '1111';  // All asynchronous exceptions masked 

PSTATE.SS = 'Q'; // Clear software step bit 

PSTATE.DIT = 'Q'; // PSTATE.DIT is reset to @ when resetting into AArch64 
PSTATE.IL = 'Q'; // Clear Illegal Execution state bit 


// All registers, bits and fields not reset by the above pseudocode or by the BranchTo() call 


// below are UNKNOWN bitstrings after reset. In particular, the return information registers 


// ELR_ELx and SPSR_ELx have UNKNOWN values, so that it 

// is impossible to return from a reset in an architecturally defined way. 
AArch64.ResetGeneralRegisters(); 

AArch64.ResetSIMDFPRegisters(); 

AArch64.ResetSpecialRegisters(); 

ResetExternalDebugRegisters(cold_reset) ; 


bits(64) rv; // IMPLEMENTATION DEFINED reset vector 


if HaveEL(EL3) then 

rv = RVBAR_EL3; 
elsif HaveEL(EL2) then 

rv = RVBAR_EL2; 
else 

rv = RVBAR_EL1; 


// The reset vector must be correctly aligned 
assert IsZero(rv<63:PAMax()>) && IsZero(rv<1:0>); 


BranchTo(rv, BranchType_RESET) ; 


aarch64/exceptions/ieeefp/AArch64.FPTrappedException 


// AArch64.FPTrappedException() 


AArch64.FPTrappedException(boolean is_ase, integer element, bits(8) accumulated_exceptions) 


exception = ExceptionSyndrome(Exception_FPTrappedException) ; 
if is_ase then 
if boolean IMPLEMENTATION_DEFINED "vector instructions set TFV to 1" then 


exception.syndrome<23> = '1'; // TFV 
else 
exception.syndrome<23> = '0'; // TEV 
else 
exception. syndrome<23> = '1'; // TFV 
exception.syndrome<10:8> = bits(3) UNKNOWN; // VECITR 
if exception.syndrome<23> == '1' then 


exception.syndrome<7,4:@> = accumulated_exceptions<7,4:0>; // IDF, IXF,UFF,OFF,DZF,IOF 
else 
exception.syndrome<7,4:@> = bits(6) UNKNOWN; 


route_to_el2 = EL2Enabled() && HCR_EL2.TGE == '1'; 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


if UInt(PSTATE.EL) > UInt(EL1) then 

AArch64.TakeException(PSTATE.EL, exception, preferred_exception_return, vect_offset) ; 
elsif route_to_el2 then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset); 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 
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aarch64/exceptions/syscalls/AArch64.CallHypervisor 


// AArch64.CallHypervisor() 
// ======================== 
// Performs a HVC call 


AArch64.CallHypervisor(bits(16) immediate) 
assert HaveEL(EL2); 


if UsingAArch32() then AArch32.1TAdvance(); 
SSAdvance(); 

bits(64) preferred_exception_return = NextInstrAddr(); 
vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_HypervisorCal1); 
exception.syndrome<15:0> = immediate; 


if PSTATE.EL == EL3 then 

AArch64.TakeException(EL3, exception, preferred_exception_return, vect_offset); 
else 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/syscalls/AArch64.CallSecureMonitor 


// AArch64.Cal1SecureMonitor() 
// =========================== 


AArch64.Cal1SecureMonitor(bits(16) immediate) 
assert HaveEL(EL3) && !ELUsingAArch32(EL3); 
if UsingAArch32() then AArch32.1TAdvance(); 
SSAdvance(); 
bits(64) preferred_exception_return = NextInstrAddr(); 
vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_MonitorCal1); 
exception.syndrome<15:0> = immediate; 


AArch64.TakeException(EL3, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/syscalls/AArch64.CallSupervisor 
// AArch64.Cal1Supervisor() 
// Calls the Supervisor 
AArch64.CallSupervisor(bits(16) immediate) 


if UsingAArch32() then AArch32.1TAdvance(); 
SSAdvance(); 
route_to_el2 = PSTATE.EL == ELO && EL2Enabled() && HCR_EL2.TGE == '1'; 


bits(64) preferred_exception_return = NextInstrAddr(); 
vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_SupervisorCal1); 
exception.syndrome<15:0> = immediate; 


if UInt(PSTATE.EL) > UInt(EL1) then 

AArch64.TakeException(PSTATE.EL, exception, preferred_exception_return, vect_offset) ; 
elsif route_to_el2 then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 
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aarch64/exceptions/takeexception/AArch64.TakeException 


// AArch64.TakeException() 


// Take an exception to an Exception Level using AArch64. 


AArch64.TakeException(bits(2) target_el, ExceptionRecord exception, 
bits(64) preferred_exception_return, integer vect_offset) 
assert HaveEL(target_el) && !ELUsingAArch32(target_el) && UInt(target_el) >= UInt(PSTATE.EL); 


sync_errors = HavelESB() && SCTLR[].IESB == '1'; 
if HaveDoubleFaultExt() then 

sync_errors = sync_errors || (SCR_EL3.EA == '1' && SCR_EL3.NMEA == '1' && PSTATE.EL == EL3); 
if sync_errors && InsertIESBBeforeException(target_el) then 

SynchronizeErrors(); 

jesb_req = FALSE; 

sync_errors = FALSE; 

TakeUnmaskedPhysicalSErrorInterrupts(iesb_req) ; 


SynchronizeContext(); 


// If coming from AArch32 state, the top parts of the X[] registers might be set to zero 
from_32 = UsingAArch32(); 

if from_32 then AArch64.MaybeZeroRegisterUppers(); 

MaybeZeroSVEUppers(target_el); 


if UInt(target_el) > UInt(PSTATE.EL) then 
boolean lower_32; 
if target_el == EL3 then 
if EL2Enabled() then 
lower_32 = ELUsingAArch32(EL2); 
else 
lower_32 = ELUsingAArch32(EL1); 
elsif IsInHost() && PSTATE.EL == ELQ && target_el == EL2 then 
lower_32 = ELUsingAArch32(ELQ); 
else 
lower_32 = ELUsingAArch32(target_el - 1); 
vect_offset = vect_offset + (if lower_32 then 0x600 else 0x400); 


elsif PSTATE.SP == '1' then 
vect_offset = vect_offset + 0x200; 


spsr = GetPSRFromPSTATE(); 


if HaveNVExt() && PSTATE.EL == EL1 && target_el == EL1 && EL2Enabled() && HCR_EL2.<NV,NV1> == '10' 
then 
spsr<3:2> = '10'; 


if HaveBTIExt() then 
// SPSR[].BTYPE is only guaranteed valid for these exception types 
if exception.exceptype IN {Exception_SError, Exception_IRQ, Exception_FIQ, 
Exception_SoftwareStep, Exception_PCAlignment, 
Exception_InstructionAbort, Exception_Breakpoint, 
Exception_VectorCatch, Exception_SoftwareBreakpoint, 
Exception_IllegalState, Exception_BranchTarget} then 
zero_btype = FALSE; 
else 
zero_btype = ConstrainUnpredictableBool(); 
if zero_btype then spsr<11:10> = '00'; 


if HaveNV2Ext() && exception.exceptype == Exception_NV2DataAbort && target_el == EL3 then 
// external aborts are configured to be taken to EL3 
exception.exceptype = Exception_DataAbort; 

if !(exception.exceptype IN {Exception_IRQ, Exception_FIQ}) then 
AArch64.ReportException(exception, target_el); 


PSTATE.EL = target_el; 
PSTATE.nRW = 'Q'; 
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ELR[] = preferred_exception_return; 


PSTATE.SS = 'Q'; 
PSTATE.<D,A,I,F> 
PSTATE.IL = 'Q'; 
if from_32 then 





PSTATE.IT = '00000000' ; 


= '1111'; 


PSTATE.T = '0'; 
if (HavePANExt() && (PSTATE.EL == EL1 || (PSTATE.EL == EL2 && ELIsInHost(ELQ))) && 
SCTLR[].SPAN == '@') then 


PSTATE.PAN = 


jis 


// Coming from AArch32 


// PSTATE.J is RESO 


if HaveUAOExt() then PSTATE.UAO = '0'; 

if HaveBTIExt() then PSTATE.BTYPE = 'QQ'; 

if HaveSSBSExt() then PSTATE.SSBS = SCTLR[].DSSBS; 
if HaveMTEExt() then PSTATE.TCO = '1'; 





BranchTo(VBAR[ ]<63:11>:vect_offset<10:0>, BranchType_EXCEPTION) ; 


if sync_errors t 
SynchronizeE 


hen 
rrors(); 


jesb_req = TRUE; 
TakeUnmaskedPhysicalSErrorInterrupts(iesb_req) ; 


EndOfInstruction 


O; 


aarch64/exceptions/traps/AArch64.AArch32SystemAccessTrap 


// AArch64.AArch32SystemAccessTrap() 


// Trapped AARCH32 system register access. 


AArch64.AArch32SystemAccessTrap(bits(2) target_el, integer ec) 
assert HaveEL(target_el) && target_el != ELQ && UInt(target_el) >= UInt(PSTATE.EL); 


bits(64) preferred_exception_return = ThisInstrAddr(); 


vect_offset = 0x 


Q; 


exception = AArch64.AArch32SystemAccessTrapSyndrome(ThisInstr(), ec); 
AArch64.TakeException(target_el, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/traps/AArch64.AArch32SystemAccessTrapSyndrome 


// AArch64.AArch32SystemAccessTrapSyndrome() 
————————————— 
// Returns the syndrome information for traps on AArch32 MCR, MCRR, MRC, MRRC, and VMRS, VMSR 


instructions, 


// other than traps that are due to HCPTR or CPACR. 


ExceptionRecord AArch64.AArch32SystemAccessTrapSyndrome(bits(32) instr, integer ec) 


ExceptionRecord exception; 


case ec of 
when 0x0 
when 0x3 
when 0x4 
when 0x5 
when 0x6 
when Qx7 
when 0x8 
when @xC 
otherwise 


exception = ExceptionSyndrome(Exception_Uncategorized) ; 
exception = ExceptionSyndrome(Exception_CP15RTTrap) ; 
exception = ExceptionSyndrome(Exception_CP15RRTTrap) ; 
exception = ExceptionSyndrome(Exception_CP14RTTrap) ; 
exception = ExceptionSyndrome(Exception_CP14DTTrap) ; 
exception = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap) 
exception = ExceptionSyndrome(Exception_FPIDTrap) ; 

exception = ExceptionSyndrome(Exception_CP14RRTTrap) ; 
Unreachable(); 


bits(20) iss = Zeros(); 
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if exception.exceptype IN {Exception_FPIDTrap, Exception_CP14RTTrap, Exception_CP15RTTrap} then 
// Trapped MRC/MCR, VMRS on FPSID 
if exception.exceptype != Exception_FPIDTrap then // When trap is not for VMRS 


iss<19:17> = instr<7:5>; // opc2 

iss<16:14> = instr<23:21; // opcl 

iss<13:10> = instr<19:16>; // CRn 

iss<4:1> = instr<3:0>; // CRm 
else 


iss<19:17> = '000'; 

iss<16:14> = '111'; 

iss<13:10> = instr<19:16>; // reg 
iss<4:1> = '0000'; 


if instr<2@> == '1' && instr<15:12> == '1111' then // MRC, Rt==15 
iss<9:5> = '11111'; 

elsif instr<2Q> == 'Q' && instr<15:12> == '1111' then // MCR, Rt==15 
iss<9:5> = bits(5) UNKNOWN; 

else 
iss<9:5> = LookUpRIndex(UInt(instr<15:12>), PSTATE.M)<4:0>; 

elsif exception.exceptype IN {Exception_CP14RRTTrap, Exception_AdvSIMDFPAccesstTrap, 
Exception_CP15RRTTrap} then 

// Trapped MRRC/MCRR, VMRS/VMSR 

iss<19:16> = instr<7:4>; // opcl 

if instr<19:16> == '1111' then // Rt2==15 
iss<14:10> = bits(5) UNKNOWN; 

else 
iss<14:10> = LookUpRIndex(UInt(instr<19:16>), PSTATE.M)<4:Q>; 


if instr<15:12> == '1111' then // Rt==15 
iss<9:5> = bits(5) UNKNOWN; 
else 
iss<9:5> = LookUpRIndex(UInt(instr<15:12>), PSTATE.M)<4:0>; 
iss<4:1> = instr<3:0>; // CRm 
elsif exception.exceptype == Exception_CP14DTTrap then 
// Trapped LDC/STC 


jss<19:12> = instr<7:0>; // imm8 
iss<4> = instr<23>; // U 
iss<2:1l> = instr<24,21>; // PW 


if instr<19:16> == '1111' then // Rn==15, LDC(Literal addressing) /STC 
iss<9:5> = bits(5) UNKNOWN; 
iss<3> = '1'; 
elsif exception.exceptype == Exception_Uncategorized then 
// Trapped for unknown reason 
iss<9:5> = LookUpRIndex(UInt(instr<19:16>), PSTATE.M)<4:0>; // Rn 
iss<3> = 'Q'; 


iss<Q> = instr<2Q>; // Direction 


exception.syndrome<24:20> = ConditionSyndrome(); 
exception.syndrome<19:0> = iss; 


return excepti on; 


aarch64/exceptions/traps/AArch64.AdvSIMDFPAccessTrap 
// AArch64.AdvSIMDFPAccessTrap() 
// Trapped access to Advanced SIMD or FP registers due to CPACR[]. 
AArch64.AdvSIMDFPAccessTrap(bits(2) target_el) 
bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


route_to_el2 = (target_el == EL1 && EL2Enabled() && HCR_EL2.TGE == '1'); 


if route_to_el2 then 
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exception = ExceptionSyndrome(Exception_Uncategorized) ; 
AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 
exception = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap) ; 
exception.syndrome<24:2@> = ConditionSyndrome(); 
AArch64.TakeException(target_el, exception, preferred_exception_return, vect_offset) ; 


return; 


aarch64/exceptions/traps/AArch64.CheckCP15InstrCoarseTraps 
// AArch64.CheckCP15InstrCoarseTraps() 
// Check for coarse-grained AArch32 CP15 traps in HSTR_EL2 and HCR_EL2. 
boolean AArch64.CheckCP15InstrCoarseTraps(integer CRn, integer nreg, integer CRm) 


// Check for coarse-grained Hyp traps 
if PSTATE.EL IN {EL@, EL1} && EL2Enabled() then 
// Check for MCR, MRC, MCRR and MRRC disabled by HSTR_EL2<CRn/CRm> 
major = if nreg == 1 then CRn else CRm; 
if !IsInHost() && !(major IN {4,14}) && HSTR_EL2<major> == '1' then 
return TRUE; 


// Check for MRC and MCR disabled by HCR_EL2.TIDCP 
if (HCR_EL2.TIDCP == '1' && nreg == 1 & 
((CRn == 9 && CRm IN {0,1,2, 5,6,7,8 J) II 
(CRn == 10 && CRm IN {0,1, 4, 8 J II 
(CRn == 11 && CRm IN {0,1,2,3,4,5,6,7,8,15}))) then 
return TRUE; 


return FALSE; 


aarch64/exceptions/traps/AArch64.CheckFPAdvSIMDEnabled 


// AArch64.CheckFPAdvSIMDEnabled() 
// Check against CPACR[] 


AArch64.CheckFPAdvSIMDEnabled() 
if PSTATE.EL IN {EL0, EL1} && !IsInHost() then 

// Check if access disabled in CPACR_EL1 

case CPACR[].FPEN of 
when 'x@' disabled = TRUE; 
when '@1' disabled = PSTATE.EL == ELQ; 
when '11' disabled = FALSE; 

if disabled then AArch64.AdvSIMDFPAccessTrap(EL1) ; 


AArch64.CheckFPAdvSIMDTrap(); // Also check against CPTR_EL2 and CPTR_EL3 


aarch64/exceptions/traps/AArch64.CheckFPAdvSIMDTrap 
// AArch64.CheckFPAdvSIMDTrap( ) 
// Check against CPTR_EL2 and CPTR_EL3. 
AArch64.CheckFPAdvSIMDTrap() 


if PSTATE.EL IN {ELO, EL1, EL2} && EL2Enabled() then 
// Check if access disabled in CPTR_EL2 
if HaveVirtHostExt() && HCR_EL2.E2H == '1' then 
case CPTR_EL2.FPEN of 
when 'x@' disabled = !(PSTATE.EL == EL1 && HCR_EL2.TGE == '1'); 
when '@1' disabled = (PSTATE.EL == ELO && HCR_EL2.TGE == '1'); 
when '11' disabled = FALSE; 
if disabled then AArch64.AdvSIMDFPAccessTrap(EL2); 
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else 
if CPTR_EL2.TFP == '1' then AArch64.AdvSIMDFPAccessTrap(EL2); 


if HaveEL(EL3) then 
// Check if access disabled in CPTR_EL3 
if CPTR_EL3.TFP == '1' then AArch64.AdvSIMDFPAccessTrap(EL3); 


return; 


aarch64/exceptions/traps/AArch64.CheckForERetTrap 

// AArch64.CheckForERetTrap() 

// Check for trap on ERET, ERETAA, ERETAB instruction 
AArch64.CheckForERetTrap(boolean eret_with_pac, boolean pac_uses_key_a) 


// Non-secure EL1 execution of ERET, ERETAA, ERETAB when HCR_EL2.NV bit is set, is trapped to EL2 
route_to_el2 = HaveNVExt() && PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2.NV == '1'; 


if route_to_el2 then 
ExceptionRecord exception; 
bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 
exception = ExceptionSyndrome(Exception_ERetTrap) ; 


if !eret_with_pac then // ERET 
exception.syndrome<1l> = 'Q'; 
exception.syndrome<@> = 'Q'; // RESO 
else 
exception.syndrome<1> = '1'; 
if pac_uses_key_a then // ERETAA 


exception.syndrome<@> = 'Q'; 
else // ERETAB 
exception.syndrome<@> = '1'; 
AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/traps/AArch64.CheckForSMCUndefOrTrap 
// AArch64.CheckForSMCUndef0OrTrap() 
// Check for UNDEFINED or trap on SMC instruction 


AArch64.CheckForSMCUndefOrTrap(bits(16) imm) 
route_to_el2 = PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2.TSC == '1'; 
if PSTATE.EL == ELO then UNDEFINED; 
if !HaveEL(EL3) then 
if PSTATE.EL == EL1 && EL2Enabled() then 
if HaveNVExt() && HCR_EL2.NV == '1' && HCR_EL2.TSC == '1' then 
route_to_el2 = TRUE; 
else 
UNDEFINED; 
else 
UNDEFINED; 
else 
route_to_el2 = PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2.TSC == 
if route_to_el2 then 
bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 
exception = ExceptionSyndrome(Exception_MonitorCal1); 
exception.syndrome<15:0> = imm; 
AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset); 


m 
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aarch64/exceptions/traps/AArch64.CheckForWFxTrap 


// AArch64.CheckForWFxTrap() 
[I ae 
// Check for trap on WFE or WFI instruction 


AArch64.CheckForWFxTrap(bits(2) target_el, boolean is_wfe) 
assert HaveEL(target_el); 


case target_el of 
when EL1 trap = (if is_wfe then SCTLR[].nTWE else SCTLR[].nTWI) == '0'; 
when EL2 trap = (if is_wfe then HCR_EL2.TWE else HCR_EL2.TWI) == '1'; 
when EL3 trap = (if is_wfe then SCR_EL3.TWE else SCR_EL3.TWI) == '1'; 
if trap then 
AArch64.WFxTrap(target_el, is_wfe); 


aarch64/exceptions/traps/AArch64.ChecklllegalState 
// AArch64.CheckI11legalState() 
// Check PSTATE.IL bit and generate Illegal Execution state exception if set. 
AArch64.CheckI1legalState() 
if PSTATE.IL == '1' then 


route_to_el2 = PSTATE.EL == ELO && EL2Enabled() && HCR_EL2.TGE == '1'; 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_I1legalState) ; 


if UInt(PSTATE.EL) > UInt(EL1) then 

AArch64.TakeException(PSTATE.EL, exception, preferred_exception_return, vect_offset); 
elsif route_to_el2 then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/traps/AArch64.MonitorModeTrap 
// AArch64.MonitorModeTrap() 
 —— ee 
// Trapped use of Monitor mode features in a Secure EL1 AArch32 mode 
AArch64.MonitorModeTrap() 
bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 
exception = ExceptionSyndrome(Exception_Uncategorized) ; 
if IsSecureEL2Enabled() then 
AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
AArch64.TakeException(EL3, exception, preferred_exception_return, vect_offset) ; 
aarch64/exceptions/traps/AArch64.SystemAccessTrap 
// AArch64.SystemAccessTrap() 


// Trapped access to AArch64 system register or system instruction. 


AArch64.SystemAccessTrap(bits(2) target_el, integer ec) 
assert HaveEL(target_el) && target_el != ELQ && UInt(target_el) >= UInt(PSTATE.EL); 


bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 
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exception = AArch64.SystemAccessTrapSyndrome(ThisInstr(), ec); 


AArch64.TakeException(target_el, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/traps/AArch64.SystemAccessTrapSyndrome 


// AArch64.SystemAccessTrapSyndrome() 


// Returns the syndrome information for traps on AArch64 MSR/MRS instructions. 


ExceptionRecord AArch64.SystemAccessTrapSyndrome(bits(32) instr, integer ec) 


ExceptionRecord exception; 
case ec of 


when 0x0 // Trapped access due to unknown 


reason. 
exception = ExceptionSyndrome(Exception_Uncategorized) ; 


when Qx7 // Trapped access to SVE, Advance 


SIMD&FP system register. 
exception = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap) ; 
exception. syndrome<24:2@> = ConditionSyndrome(); 


when Qx18 // Trapped access to system 


register or system instruction. 
exception = ExceptionSyndrome(Exception_SystemRegisterTrap) ; 
instr = ThisInstr(); 


exception. syndrome<21:20> = instr<20:19>; // Ope 
exception. syndrome<19:17> = instr<7:5>; // Op2 
exception. syndrome<16:14> = instr<18:16>; // Op1 
exception. syndrome<13:10> = instr<15:12>; // CRn 
exception.syndrome<9:5> = instr<4:0>; // Rt 
exception.syndrome<4:1> = instr<11:8>; // CRm 
exception. syndrome<Q> = instr<21>; // Direction 
otherwise 
Unreachable(); 


return excepti on; 


aarch64/exceptions/traps/AArch64.UndefinedFault 


// AArch64.UndefinedFault() 
|[ ======================== 


AArch64.UndefinedFault() 
route_to_el2 = PSTATE.EL == ELO && EL2Enabled() && HCR_EL2.TGE == '1'; 
bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_Uncategorized) ; 


if UInt(PSTATE.EL) > UInt(EL1) then 


AArch64.TakeException(PSTATE.EL, exception, preferred_exception_return, vect_offset) ; 


elsif route_to_el2 then 


AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 


else 


AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset); 


aarch64/exceptions/traps/AArch64.WFxTrap 


// AArch64.WFxTrap() 
// ================= 


AArch64.WFxTrap(bits(2) target_el, boolean is_wfe) 
assert UInt(target_el) > UInt(PSTATE.EL); 


bits(64) preferred_exception_return = ThisInstrAddr(); 


vect_offset = 0x0; 
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exception = ExceptionSyndrome(Exception_WFxTrap) ; 
exception.syndrome<24:20> = ConditionSyndrome(); 
exception.syndrome<@> = if is_wfe then '1' else 'Q'; 


if target_el == EL1 && EL2Enabled() && HCR_EL2.TGE == '1' then 
AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset); 
else 
AArch64.TakeException(target_el, exception, preferred_exception_return, vect_offset) ; 


aarch64/exceptions/traps/CheckFPAdvSIMDEnabled64 


// CheckFPAdvSIMDEnab1ed64() 
// ========================= 


// AArch64 instruction wrapper 


CheckFPAdvSIMDEnabled64() 
AArch64.CheckFPAdvSIMDEnabled(); 


J1.1.3 aarch64/functions 


This section includes the following pseudocode functions: 

° aarch64/functions/aborts/AArch64.CreateFaultRecord on page J1-7334. 

$ aarch64/functions/aborts/AArch64.FaultSyndrome on page J1-7334. 

° aarch64/functions/exclusive/AArch64.ExclusiveMonitorsPass on page J1-7335. 
° aarch64/functions/exclusive/AArch64.IsExclusiveVA on page J1-7335. 

e aarch64/functions/exclusive/AArch64.MarkExclusiveVA on page J1-7335. 

° aarch64/functions/exclusive/AArch64.SetExclusiveMonitors on page J1-7335. 

è aarch64/functions/fusedrstep/F PRSqrtStepF used on page J1-7336. 

. aarch64/functions/fusedrstep/FPRecipStepFused on page J1-7336. 

a aarch64/functions/memory/AArch64.AccessIsTagChecked on page J1-7337. 

° aarch64/functions/memory/AArch64.Address WithAllocationTag on page J1-7337. 
: aarch64/functions/memory/AArch64.AllocationTagFromAddress on page J1-7338. 
7 aarch64/functions/memory/AArch64.CheckAlignment on page J1-7338. 

s aarch64/functions/memory/AArch64.CheckTag on page J1-7338. 

s aarch64/functions/memory/AArch64.MemSingle on page J1-7338. 

$ aarch64/functions/memory/AArch64.MemTag on page J1-7339. 

s aarch64/functions/memory/AArch64.PhysicalTag on page J1-7340. 

à aarch64/functions/memory/AArch64. TranslateAddressForAtomicAccess on page J1-7340. 
è aarch64/functions/memory/CheckSPAlignment on page J1-7341. 

. aarch64/functions/memory/IsBlockDescriptorNTBitValid on page J1-7341. 

7 aarch64/functions/memory/Mem on page J1-7341. 

è aarch64/functions/memory/MemAtomic on page J1-7342. 

. aarch64/functions/memory/MemAtomicCompareAndSwap on page J1-7343. 

5 aarch64/functions/pac/addpac/AddPAC on page J1-7343. 

$ aarch64/functions/pac/addpacda/AddPACDA on page J1-7344. 

$ aarch64/functions/pac/addpacdb/AddPACDB on page J1-7345. 

$ aarch64/functions/pac/addpacga/AddPACGA on page J1-7346. 

. aarch64/functions/pac/addpacia/AddPACIA on page J1-7346. 

$ aarch64/functions/pac/addpacib/AddPACIB on page J1-7347. 

. aarch64/functions/pac/auth/Auth on page J1-7347. 

° aarch64/functions/pac/authda/AuthDA on page J1-7348. 

. aarch64/functions/pac/authdb/AuthDB on page J1-7349. 

. aarch64/functions/pac/authia/AuthIA on page J1-7349. 

. aarch64/functions/pac/authib/AuthIB on page J1-7350. 
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aarch64/functions/pac/calcbottompacbit/CalculateBottomPACBit on page J1-7351. 
aarch64/functions/pac/calculatetbi/CalculateTBI on page J1-7351. 
aarch64/functions/pac/computepac/ComputePAC on page J1-7352. 
aarch64/functions/pac/computepac/PACCellInvShuffle on page J1-7352. 
aarch64/functions/pac/computepac/PACCellShuffle on page J1-7353. 
aarch64/functions/pac/computepac/PACInvSub on page J1-7353. 
aarch64/functions/pac/computepac/PACMult on page J1-7354. 
aarch64/functions/pac/computepac/PACSub on page J1-7354. 
aarch64/functions/pac/computepac/RotCell on page J1-7355. 
aarch64/functions/pac/computepac/TweakCellInvRot on page J1-7355. 
aarch64/functions/pac/computepac/TweakCellRot on page J1-7355. 
aarch64/functions/pac/computepac/TweakInvShuffle on page J1-7355. 
aarch64/functions/pac/computepac/TweakShuffle on page J1-7356. 
aarch64/functions/pac/pac/HaveEnhancedPAC on page J1-7356. 
aarch64/functions/pac/pac/HavePACExt on page J1-7356. 
aarch64/functions/pac/pac/PtrHas UpperAndLowerAddRanges on page J1-7356. 
aarch64/functions/pac/strip/Strip on page J1-7356. 
aarch64/functions/pac/trappacuse/TrapPACUse on page J1-7357. 
aarch64/functions/ras/AArch64.ESBOperation on page J1-7357. 
aarch64/functions/ras/AArch64.PhysicalSErrorSyndrome on page J1-7358. 
aarch64/functions/ras/AArch64.ReportDeferredSError on page J1-7358. 
aarch64/functions/ras/AArch64.vESB Operation on page J1-7358. 
aarch64/functions/registers/AArch64.MaybeZeroRegister Uppers on page J1-7359. 
aarch64/functions/registers/AArch64. ResetGeneralRegisters on page J1-7359. 
aarch64/functions/registers/AArch64.ResetSIMDF PRegisters on page J1-7359. 
aarch64/functions/registers/AArch64.ResetSpecialRegisters on page J1-7359. 
aarch64/functions/registers/AArch64. ResetSystemRegisters on page J1-7360. 
aarch64/functions/registers/PC on page J1-7360. 
aarch64/functions/registers/SP on page J1-7360. 
aarch64/functions/registers/V on page J1-7361. 
aarch64/functions/registers/Vpart on page J1-7361. 
aarch64/functions/registers/X on page J1-7362. 
aarch64/functions/sve/AArch32.IsF PEnabled on page J1-7362. 
aarch64/functions/sve/AArch64.IsF PEnabled on page J1-7362. 
aarch64/functions/sve/CeilPow2 on page J1-7363. 
aarch64/functions/sve/CheckSVEEnabled on page J1-7363. 
aarch64/functions/sve/DecodePredCount on page J1-7364. 
aarch64/functions/sve/ElemF FR on page J1-7364. 
aarch64/functions/sve/ElemP on page J1-7364. 

aarch64/functions/sve/FFR on page J1-7365. 
aarch64/functions/sve/FPCompareNE on page J1-7365. 
aarch64/functions/sve/F PCompareUN on page J1-7365. 
aarch64/functions/sve/F PConvertSVE on page J1-7365. 
aarch64/functions/sve/FPExpA on page J1-7366. 
aarch64/functions/sve/F PExp Coefficient on page J1-7366. 
aarch64/functions/sve/F PMinNormal on page J1-7369. 
aarch64/functions/sve/FPOne on page J1-7369. 
aarch64/functions/sve/F PPointFive on page J1-7369. 

aarch64/functions/sve/F PProcess on page J1-7369. 
aarch64/functions/sve/F PScale on page J1-7370. 
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. aarch64/functions/sve/FP TrigMAdd on page J1-7370. 

è aarch64/functions/sve/F P TrigMAddCoefficient on page J1-7370. 

à aarch64/functions/sve/F PTrigSMul on page J1-7371. 

è aarch64/functions/sve/F PTrigSSel on page J1-7371. 

° aarch64/functions/sve/FirstActive on page J1-7372. 

° aarch64/functions/sve/FloorPow2 on page J1-7372. 

. aarch64/functions/sve/HaveSVE on page J1-7372. 

° aarch64/functions/sve/ImplementedSVE VectorLength on page J1-7372. 

. aarch64/functions/sve/IsEven on page J1-7372. 

$ aarch64/functions/sve/IsF PEnabled on page J1-7372. 

. aarch64/functions/sve/IsSVEEnabled on page J1-7373. 

° aarch64/functions/sve/LastActive on page J1-7373. 

° aarch64/functions/sve/LastActiveElement on page J1-7373. 

è aarch64/functions/sve/MAX_PL on page J1-7373. 

: aarch64/functions/sve/MAX_VL on page J1-7374. 

° aarch64/functions/sve/MaybeZeroSVEUppers on page J1-7374. 

° aarch64/functions/sve/MemNF on page J1-7374. 

. aarch64/functions/sve/MemSingleNF on page J1-7375. 

° aarch64/functions/sve/NoneActive on page J1-7375. 

° aarch64/functions/sve/P on page J1-7376. 

. aarch64/functions/sve/PL on page J1-7376. 

. aarch64/functions/sve/PredTest on page J1-7376. 

. aarch64/functions/sve/ReducePredicated on page J1-7376. 

è aarch64/functions/sve/Reverse on page J1-7376. 

° aarch64/functions/sve/SVEAccessTrap on page J1-7377. 

° aarch64/functions/sve/SVECmp on page J1-7377. 

è aarch64/functions/sve/SVEMoveMaskPreferred on page J1-7377. 

. aarch64/functions/sve/System on page J1-7378. 

° aarch64/functions/sve/VL on page J1-7378. 

. aarch64/functions/sve/Z on page J1-7378. 

° aarch64/functions/sysregisters/CNTKCTL on page J1-7379. 

$ aarch64/functions/sysregisters/CNTKCTLType on page J1-7379. 

d aarch64/functions/sysregisters/CPACR on page J1-7379. 

. aarch64/functions/sysregisters/CPACR Type on page J1-7379. 

. aarch64/functions/sysregisters/ELR on page J1-7379. 

è aarch64/functions/sysregisters/ESR on page J1-7380. 

e aarch64/functions/sysregisters/ESRType on page J1-7380. 

à aarch64/functions/sysregisters/FAR on page J1-7380. 

: aarch64/functions/sysregisters/MAIR on page J1-7381. 

° aarch64/functions/sysregisters/MAIR Type on page J1-7381. 

s aarch64/functions/sysregisters/SCTLR on page J1-7381. 

. aarch64/functions/sysregisters/SCTLR Type on page J1-7382. 

. aarch64/functions/sysregisters/VBAR on page J1-7382. 

. aarch64/functions/system/AArch64.AllocationTagAccessIsEnabled on page J1-7382. 
. aarch64/functions/system/AArch64.CheckSystemAccess on page J1-7382. 
$ aarch64/functions/system/AArch64.ChooseNonExcludedTag on page J1-7383. 
à aarch64/functions/system/AArch64.ExecutingATS1xPInstr on page J1-7383. 
è aarch64/functions/system/AArch64.ExecutingBROrBLROrRetInstr on page J1-7384. 
aarch64/functions/system/AArch64.ExecutingBTInstr on page J1-7384. 

à aarch64/functions/system/AArch64.ExecutingERETInstr on page J1-7384. 
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. aarch64/functions/system/AArch64.NextRandomTagBit on page J1-7384. 
. aarch64/functions/system/AArch64.RandomTag on page J1-7385. 

à aarch64/functions/system/AArch64.SysInstr on page J1-7385. 

è aarch64/functions/system/AArch64.SysInstr WithResult on page J1-7385. 
è aarch64/functions/system/AArch64.SysRegRead on page J1-7385. 

: aarch64/functions/system/AArch64.SysReg Write on page J1-7385. 

. aarch64/functions/system/BTypeCompatible on page J1-7385. 

. aarch64/functions/system/BTypeCompatible_BTI on page J1-7385. 

$ aarch64/functions/system/BTypeCompatible_PACIXSP on page J1-7386. 
s aarch64/functions/system/BTypeNext on page J1-7386. 

. aarch64/functions/system/InGuardedPage on page J1-7386. 


aarch64/functions/aborts/AArch64.CreateFaultRecord 


// AArch64.CreateFaultRecord() 


FaultRecord AArch64.CreateFaultRecord(Fault statuscode, bits(52) ipaddress, boolean NS, 


integer level, AccType acctype, boolean write, bit extflag, 


bits(2) errortype, boolean secondstage, boolean s2fslwalk) 


FaultRecord fault; 
fault.statuscode = statuscode; 


fault.domain = bits(4) UNKNOWN; // Not used from AArch64 
fault.debugmoe = bits(4) UNKNOWN; // Not used from AArch64 
fault.errortype = errortype; 

fault.ipaddress.NS = if NS then '1' else 'Q'; 

fault. ipaddress.address = ipaddress; 

fault. level = level; 

fault.acctype = acctype; 

fault.write = write; 

fault.extflag = extflag; 

fault.secondstage = secondstage; 

fault.s2fslwalk = s2fslwalk; 





return fault; 


aarch64/functions/aborts/AArch64.FaultSyndrome 


// AArch64.FaultSyndrome() 

J) ssssssssseesssses====== 

// Creates an exception syndrome value for Abort and Watchpoint exceptions taken to 
// an Exception Level using AArch64. 


bits(25) AArch64.FaultSyndrome(boolean d_side, FaultRecord fault) 
assert fault.statuscode != Fault_None; 


bits(25) iss = Zeros(); 


if HaveRASExt() && IsExternalSyncAbort(fault) then iss<12:11> = fault.errortype; // SET 


if d_side then 


if IsSecondStage(fault) && !fault.s2fslwalk then iss<24:14> = LSInstructionSyndrome(); 


if HaveNV2Ext() && fault.acctype == AccType_NV2REGISTER then 


iss<13> = '1'; // Value of '1' indicates fault is generated by use of VNCR_EL2 


if fault.acctype IN {AccType_DC, AccType_DC_UNPRIV, AccType_IC, AccType_AT} then 
iss<8> = '1'; iss<6> = '1'; 
else 
iss<6> = if fault.write then '1' else 'Q'; 
if IsExternalAbort(fault) then iss<9> = fault.extflag; 
iss<7> = if fault.s2fslwalk then '1' else 'Q'; 
iss<5:0> = EncodeLDFSC(fault.statuscode, fault. level); 


return iss; 
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aarch64/functions/exclusive/AArch64.ExclusiveMonitorsPass 


// AArch64.ExclusiveMonitorsPass() 
[I ae 


// Return TRUE if the Exclusives monitors for the current PE include all of the addresses 
// associated with the virtual address region of size bytes starting at address. 
// The immediately following memory write must be to the same addresses. 


boolean AArch64.ExclusiveMonitorsPass(bits(64) address, integer size) 


// It is IMPLEMENTATION DEFINED whether the detection of memory aborts happens 

// before or after the check on the local Exclusives monitor. As a result a failure 
// of the local monitor can occur on some implementations even if the memory 

// access would give an memory abort. 


acctype = AccType_ATOMIC; 
iswrite = TRUE; 
aligned = (address == Align(address, size)); 


if !aligned then 
secondstage = FALSE; 
AArch64.Abort(address, AArch64.AlignmentFault(acctype, iswrite, secondstage)); 


passed = AArch64.IsExclusiveVA(address, ProcessorID(), size); 
if !passed then 
return FALSE; 
memaddrdesc = AArch64.TranslateAddress(address, acctype, iswrite, aligned, size); 


// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
AArch64.Abort(address, memaddrdesc. fault); 


passed = IsExclusiveLocal (memaddrdesc.paddress, ProcessorID(), size); 
ClearExclusiveLocal(ProcessorID()); 


if passed then 
if memaddrdesc.memattrs.shareable then 
passed = IsExclusiveGlobal(memaddrdesc.paddress, ProcessorID(), size); 


return passed; 


aarch64/functions/exclusive/AArch64.IsExclusiveVA 


// An optional IMPLEMENTATION DEFINED test for an exclusive access to a virtual 
// address region of size bytes starting at address. 


// 

// It is permitted (but not required) for this function to return FALSE and 
// cause a store exclusive to fail if the virtual address region is not 

// totally included within the region recorded by MarkExclusiveVA(). 


// 

// It is always safe to return TRUE which will check the physical address only. 
boolean AArch64.IsExclusiveVA(bits(64) address, integer processorid, integer size); 
aarch64/functions/exclusive/AArch64.MarkExclusiveVA 

// Optionally record an exclusive access to the virtual address region of size bytes 
// starting at address for processorid. 

AArch64.MarkExclusiveVA(bits(64) address, integer processorid, integer size); 


aarch64/functions/exclusive/AArch64.SetExclusiveMonitors 


// AArch64.SetExclusiveMonitors() 
—————————— 


// Sets the Exclusives monitors for the current PE to record the addresses associated 
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// with the virtual address region of size bytes starting at address. 
AArch64.SetExclusiveMonitors(bits(64) address, integer size) 


acctype = AccType_ATOMIC; 

iswrite = FALSE; 

aligned = (address == Align(address, size)); 

memaddrdesc = AArch64.TranslateAddress(address, acctype, iswrite, aligned, size); 


// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
return; 


if memaddrdesc.memattrs.shareable then 
MarkExclusiveGlobal(memaddrdesc.paddress, ProcessorID(), size); 


MarkExclusiveLocal(memaddrdesc.paddress, ProcessorID(), size); 


AArch64.MarkExclusiveVA(address, ProcessorID(), size); 


aarch64/functions/fusedrstep/FPRSqrtStepFused 


// FPRSqrtStepFused() 
// ================== 


bits(N) FPRSqrtStepFused(bits(N) op1, bits(N) op2) 
assert N IN {16, 32, 64}; 
bits(N) result; 
op1 = FPNeg(op1); 
(typel,signl,valuel) = FPUnpack(op1, FPCR); 
(type2,sign2,value2) = FPUnpack(op2, FPCR); 
(done, result) = FPProcessNaNs(typel, type2, op1, op2, FPCR); 
if !done then 
infl = (typel == FPType_Infinity); 
inf2 = (type2 == FPType_Infinity); 
zerol = (typel == FPType_Zero); 
zero2 = (type2 == FPType_Zero); 
if (infl && zero2) || (zerol && inf2) then 
result = FPOnePointFive('0'); 
elsif inf1 || inf2 then 
result = FPInfinity(sign1 EOR sign2); 
else 
// Fully fused multiply-add and halve 
result_value = (3.0 + (valuel » value2)) / 2.0; 
if result_value == 0.0 then 
// Sign of exact zero result depends on rounding mode 
sign = if FPRoundingMode(FPCR) == FPRounding_NEGINF then '1' else 'Q'; 
result = FPZero(sign); 
else 
result = FPRound(result_value, FPCR); 
return result; 


aarch64/functions/fusedrstep/FPRecipStepFused 


// FPRecipStepFused() 
// ================== 


bits(N) FPRecipStepFused(bits(N) op1, bits(N) op2) 
assert N IN {16, 32, 64}; 
bits(N) result; 
op1 = FPNeg(op1); 
(typel,sign1,valuel) = FPUnpack(op1, FPCR); 
(type2,sign2,value2) = FPUnpack(op2, FPCR); 
(done, result) = FPProcessNaNs(typel, type2, op1, op2, FPCR); 
if !done then 
infl = (typel == FPType_Infinity); 
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inf2 = (type2 == FPType_Infinity); 
zerol = (typel == FPType_Zero); 
zero2 = (type2 == FPType_Zero); 
if (infl && zero2) || (zerol && inf2) then 
result = FPTwo('Q'); 
elsif inf1 || inf2 then 
result = FPInfinity(sign1 EOR sign2); 
else 
// Fully fused multiply-add 
result_value = 2.0 + (valuel » value2); 
if result_value == 0.0 then 
// Sign of exact zero result depends on rounding mode 
sign = if FPRoundingMode(FPCR) == FPRounding_NEGINF then '1' else 'Q'; 
result = FPZero(sign); 
else 
result = FPRound(result_value, FPCR); 
return result; 


aarch64/functions/memory/AArch64.AccesslsTagChecked 


// AArch64.AccessIsTagChecked() 


// TRUE if a given access is tag-checked, FALSE otherwise. 


boolean AArch64.AccessIsTagChecked(bits(64) vaddr, AccType acctype) 
if PSTATE.M<4> == '1' then return FALSE; 


if EffectiveTBI(vaddr, FALSE, PSTATE.EL) == 'Q' then 
return FALSE; 


if EffectiveTCMA(vaddr, PSTATE.EL) == '1' && (vaddr<59:55> == '00000' || vaddr<59:55> == '11111') 
then 
return FALSE; 


if !AArch64.AllocationTagAccessIsEnabled() then 
return FALSE; 


if acctype IN {AccType_IFETCH, AccType_PTW} then 
return FALSE; 


if acctype == AccType_NV2REGISTER then 
return FALSE; 


if PSTATE.TCO=='1' then 
return FALSE; 


if IsNonTagCheckedInstruction() then 
return FALSE; 





return TRUE; 


aarch64/functions/memory/AArch64.AddressWithAllocationTag 
// AArch64.AddresswithAllocationTag() 


// Generate a 64-bit value containing a Logical Address Tag from a 64-bit 
// virtual address and an Allocation Tag. 
// If the extension is disabled, treats the Allocation Tag as '0000'. 


bits(64) AArch64.AddresswithAllocationTag(bits(64) address, bits(4) allocation_tag) 
bits(64) result = address; 
bits(4) tag; 
if AArch64.AllocationTagAccessIsEnabled() then 
tag = allocation_tag; 
else 
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tag = '0000'; 
result<59:56> = tag; 
return result; 


aarch64/functions/memory/AArch64.AllocationTagFromAddress 
// AArch64.AllocationTagFromAddress() 
// Generate an ALlocation Tag from a 64-bit value containing a Logical Address Tag. 


bits(4) AArch64.AllocationTagFromAddress(bits(64) tagged_address) 
return tagged_address<59:56>; 


aarch64/functions/memory/AArch64.CheckAlignment 


// AArch64.CheckAlignment() 
// ======================== 


boolean AArch64.CheckAlignment(bits(64) address, integer alignment, AccType acctype, 
boolean iswrite) 


aligned = (address == Align(address, alignment)); 

atomic = acctype IN { AccType_ATOMIC, AccType_ATOMICRW, AccType_ORDEREDATOMIC, 
AccType_ORDEREDATOMICRW }; 

ordered = acctype IN { AccType_ORDERED, AccType_ORDEREDRW, AccType_LIMITEDORDERED, 
AccType_ORDEREDATOMIC, AccType_ORDEREDATOMICRW }; 

vector = acctype == AccType_VEC; 

if SCTLR[].A == '1' then check = TRUE; 

elsif HaveUA16Ext() then 


check = (UInt(address<0+:4>) + alignment > 16) && ((ordered && SCTLR[].nAA == 'Q') || atomic); 


else check = atomic || ordered; 


if check && !aligned then 
secondstage = FALSE; 
AArch64.Abort(address, AArch64.AlignmentFault(acctype, iswrite, secondstage)); 


return aligned; 


aarch64/functions/memory/AArch64.CheckTag 
// AArch64.CheckTag() 


// Performs a Tag Check operation for a memory access and returns 
// whether the check passed 


boolean AArch64.CheckTag(AddressDescriptor memaddrdesc, bits(4) ptag, boolean write) 
if memaddrdesc.memattrs.tagged then 
return ptag == _MemTag[memaddrdesc]; 
else 
return TRUE; 


aarch64/functions/memory/AArch64.MemSingle 
// AArch64.MemSingle[] - non-assignment (read) form 


[[ ========================== 


// Perform an atomic, little-endian read of 'size' bytes. 


bits(sizex8) AArch64.MemSingle[bits(64) address, integer size, AccType acctype, boolean wasaligned] 


assert size IN {1, 2, 4, 8, 16}; 
assert address == Align(address, size); 


AddressDescriptor memaddrdesc; 
bits(sizex8) value; 
iswrite = FALSE; 
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// MMU or MPU 
memaddrdesc = AArch64.TranslateAddress(address, acctype, iswrite, wasaligned, size); 
// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
AArch64.Abort(address, memaddrdesc. fault); 


// Memory array access 
accdesc = CreateAccessDescriptor(acctype) ; 
if HaveMTEExt() then 
if AArch64.AccessIsTagChecked(ZeroExtend(address, 64), acctype) then 
bits(4) ptag = AArch64.PhysicalTag(ZeroExtend(address, 64)); 
if !AArch64.CheckTag(memaddrdesc, ptag, iswrite) then 
AArch64.TagCheckFail(ZeroExtend(address, 64), iswrite); 
value = _Mem[memaddrdesc, size, accdesc]; 
return value; 


// AArch64.MemSingle[] - assignment (write) form 
// Perform an atomic, little-endian write of 'size' bytes. 


AArch64.MemSingle[bits(64) address, integer size, AccType acctype, boolean wasaligned] = bits(sizex8) 
value 

assert size IN {1, 2, 4, 8, 16}; 

assert address == Align(address, size); 


AddressDescriptor memaddrdesc; 
iswrite = TRUE; 


// MMU or MPU 
memaddrdesc = AArch64.TranslateAddress(address, acctype, iswrite, wasaligned, size); 


// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
AArch64.Abort(address, memaddrdesc. fault); 


// Effect on exclusives 
if memaddrdesc.memattrs.shareable then 
ClearExclusiveByAddress(memaddrdesc.paddress, ProcessorID(), size); 


// Memory array access 
accdesc = CreateAccessDescriptor(acctype) ; 
if HaveMTEExt() then 
if AArch64.AccessIsTagChecked(ZeroExtend(address, 64), acctype) then 
bits(4) ptag = AArch64.PhysicalTag(ZeroExtend(address, 64)); 
if !AArch64.CheckTag(memaddrdesc, ptag, iswrite) then 
AArch64.TagCheckFail(ZeroExtend(address, 64), iswrite); 
_Mem[memaddrdesc, size, accdesc] = value; 
return; 


aarch64/functions/memory/AArch64.MemTag 


// AArch64.MemTag[] - non-assignment (read) form 





// Load an Allocation Tag from memory. 


bits(4) AArch64.MemTag[bits(64) address] 
AddressDescriptor memaddrdesc; 
bits(4) value; 
iswrite = FALSE; 


memaddrdesc = AArch64.TranslateAddress(address, AccType_NORMAL, iswrite, TRUE, TAG_GRANULE) ; 
// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 

AArch64.Abort(address, memaddrdesc. fault); 


// Return the granule tag if tagging is enabled... 
if AArch64.AllocationTagAccessIsEnabled() && memaddrdesc.memattrs.tagged then 
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return _MemTag[memaddrdesc] ; 

else 
// ...otherwise read tag as zero. 
return 'Q000'; 


// AArch64.MemTag[] - assignment (write) form 
// Store an Allocation Tag to memory. 


AArch64.MemTag[bits(64) address] = bits(4) value 
AddressDescriptor memaddrdesc; 
jiswrite = TRUE; 


// Stores of allocation tags must be aligned 
if address != Align(address, TAG_GRANULE) then 
boolean secondstage = FALSE; 
AArch64.Abort(address, AArch64.AlignmentFault(AccType_NORMAL, iswrite, secondstage)); 


wasaligned = TRUE; 
memaddrdesc = AArch64.TranslateAddress(address, AccType_NORMAL, iswrite, wasaligned, TAG_GRANULE) ; 


// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
AArch64.Abort(address, memaddrdesc. fault); 


// Memory array access 
if AArch64.AllocationTagAccessIsEnabled() && memaddrdesc.memattrs.tagged then 
_MemTag[memaddrdesc] = value; 
aarch64/functions/memory/AArch64.PhysicalTag 
// AArch64.PhysicalTag() 
// Generate a Physical Tag from a Logical Tag in an address 
bits(4) AArch64.PhysicalTag(bits(64) vaddr) 
return vaddr<59:56>; 
aarch64/functions/memory/AArch64.TranslateAddressF orAtomicAccess 
// AArch64.TranslateAddressForAtomi cAccess() 
[I aene 
// Performs an alignment check for atomic memory operations. 
// Also translates 64-bit Virtual Address into Physical Address. 
AddressDescriptor AArch64.TranslateAddressForAtomicAccess(bits(64) address, integer sizeinbits) 
boolean iswrite = FALSE; 
size = sizeinbits DIV 8; 
assert size IN {1, 2, 4, 8, 16}; 
aligned = AArch64.CheckAlignment(address, size, AccType_ATOMICRW, iswrite); 


// MMU or MPU lookup 
memaddrdesc = AArch64.TranslateAddress(address, AccType_ATOMICRW, iswrite, aligned, size); 


// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
AArch64.Abort(address, memaddrdesc. fault); 


// Effect on exclusives 
if memaddrdesc.memattrs.shareable then 
ClearExclusiveByAddress(memaddrdesc.paddress, ProcessorID(), size); 


if HaveMTEExt() && AArch64.AccessIsTagChecked(address, AccType_ATOMICRW) then 
bits(4) ptag = AArch64.PhysicalTag(address); 
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if !AArch64.CheckTag(memaddrdesc, ptag, iswrite) then 
AArch64.TagCheckFail(address, iswrite); 


return memaddrdesc; 


aarch64/functions/memory/CheckSPAlignment 


// CheckSPAlignment() 


// Check correct stack pointer alignment for AArch64 state. 


CheckSPAlignment() 
bits(64) sp = SP[]; 
if PSTATE.EL == ELO then 
stack_align_check = (SCTLR[].SAQ@ != 'Q'); 
else 
stack_align_check = (SCTLR[].SA != 'Q'); 


if stack_align_check && sp != Align(sp, 16) then 
AArch64.SPAlignmentFault(); 


return; 


aarch64/functions/memory/IsBlockDescriptorNTBitValid 


// If the implementation supports changing the block size without a break-before-make 
// approach, then for implementations that have level 1 or 2 support, the nT bit in 
// the block descriptor is valid. 

boolean IsBlockDescriptorNTBitValid(); 


aarch64/functions/memory/Mem 
// Mem[] - non-assignment (read) form 


// Perform a read of 'size' bytes. The access byte order is reversed for a big-endian access. 
// Instruction fetches would call AArch64.MemSingle directly. 


bits(sizex8) Mem[bits(64) address, integer size, AccType acctype] 
assert size IN {1, 2, 4, 8, 16}; 
bits(sizex8) value; 
boolean iswrite = FALSE; 


aligned = AArch64.CheckAlignment(address, size, acctype, iswrite); 
if size != 16 || !(acctype IN {AccType_VEC, AccType_VECSTREAM}) then 
atomic = aligned; 
else 
// 128-bit SIMD&FP loads are treated as a pair of 64-bit single-copy atomic accesses 
// 64-bit aligned. 
atomic = address == Align(address, 8); 


if !atomic then 
assert size > 1; 
value<7:0> = AArch64.MemSingle[address, 1, acctype, aligned]; 


// For subsequent bytes it is CONSTRAINED UNPREDICTABLE whether an unaligned Device memory 
// access will generate an Alignment Fault, as to get this far means the first byte did 
// not, so we must be changing to a new translation page. 
if !aligned then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_FAULT, Constraint_NONE}; 
if c == Constraint_NONE then aligned = TRUE; 


for i = 1 to size-1 
value<8#i+7:8%i> = AArch64.MemSingle[address+i, 1, acctype, aligned]; 
elsif size == 16 && acctype IN {AccType_VEC, AccType_VECSTREAM} then 
value<63:0> = AArch64.MemSingle[address, 8, acctype, aligned]; 
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value<127:64> = AArch64.MemSingle[address+8, 8, acctype, aligned]; 
else 
value = AArch64.MemSingle[address, size, acctype, aligned]; 


if (HaveNV2Ext() && acctype == AccType_NV2REGISTER && SCTLR_EL2.EE == '1') || BigEndian() then 


value = BigEndianReverse(value) ; 
return value; 


// Mem[] - assignment (write) form 
// Perform a write of 'size' bytes. The byte order is reversed for a big-endian access. 


Mem[bits(64) address, integer size, AccType acctype] = bits(sizex8) value 
boolean iswrite = TRUE; 


if (HaveNV2Ext() && acctype == AccType_NV2REGISTER && SCTLR_EL2.EE == '1') || BigEndian() then 


value = BigEndianReverse(value) ; 


aligned = AArch64.CheckAlignment(address, size, acctype, iswrite); 
if size != 16 || !(acctype IN {AccType_VEC, AccType_VECSTREAM}) then 
atomic = aligned; 
else 
// 128-bit SIMD&FP stores are treated as a pair of 64-bit single-copy atomic accesses 
// 64-bit aligned. 
atomic = address == Align(address, 8); 


if !atomic then 
assert size > 1; 
AArch64.MemSingle[address, 1, acctype, aligned] = value<7:0>; 


// For subsequent bytes it is CONSTRAINED UNPREDICTABLE whether an unaligned Device memory 


// access will generate an Alignment Fault, as to get this far means the first byte did 
// not, so we must be changing to a new translation page. 
if !aligned then 

c = ConstrainUnpredictable(); 

assert c IN {Constraint_FAULT, Constraint_NONE}; 

if c == Constraint_NONE then aligned = TRUE; 


for i = 1 to size-1 
AArch64.MemSingle[address+i, 1, acctype, aligned] = value<8#i+7:8+i>; 
elsif size == 16 && acctype IN {AccType_VEC, AccType_VECSTREAM} then 
AArch64.MemSingle[address, 8, acctype, aligned] = value<63:0>; 
AArch64.MemSingle[address+8, 8, acctype, aligned] = value<127:64>; 
else 
AArch64.MemSingle[address, size, acctype, aligned] = value; 
return; 


aarch64/functions/memory/MemAtomic 
// MemAtomic() 


// Performs load and store memory operations for a given virtual address. 


bits(size) MemAtomic(bits(64) address, MemAtomicOp op, bits(size) value, AccType ldacctype, AccType 


stacctype) 
bits(size) newvalue; 
memaddrdesc = AArch64.TranslateAddressForAtomicAccess(address, size); 
ldaccdesc = CreateAccessDescriptor(ldacctype) ; 
staccdesc = CreateAccessDescriptor(stacctype) ; 


// All observers in the shareability domain observe the 
// following load and store atomically. 
oldvalue = _Mem[memaddrdesc, size DIV 8, ldaccdesc]; 
if BigEndian() then 
oldvalue = BigEndianReverse(oldvalue) ; 


case op of 
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when MemAtomicOp_ADD 
when MemAtomicOp_BIC 
when MemAtomicOp_EOR 
when MemAtomicOp_ORR 
when MemAtomi cOp_SMAX 
when MemAtomicOp_SMIN 
when MemAtomi cOp_UMAX 
when MemAtomicOp_UMIN 
when MemAtomi cOp_SWP 








if BigEndian() then 


newvalue 
newvalue 
newvalue 
newvalue 
newvalue 
newvalue 
newvalue 
newvalue 
newvalue 


oldvalue + val 


ue; 


Armv8 Pseudocode 
J1.1 Pseudocode for AArch64 operations 


oldvalue AND NOT(value); 
oldvalue EOR value; 


oldvalue OR value; 


if SInt(oldval 
if SInt(oldval 
if UInt(oldval 
if UInt(oldval 
value; 





newvalue = BigEndianReverse(newvalue); 
_Mem[memaddrdesc, size DIV 8, staccdesc] = newvalue; 


// Load operations return the old (pre-operation) value 


return oldvalue; 


ue) 
ue) 
ue) 
ue) 


> SInt(value) then oldvalue else value; 
> SInt(value) then value else oldvalue; 
> UInt(value) then oldvalue else value; 
> UInt(value) then value else oldvalue; 


aarch64/functions/memory/MemAtomicCompareAndSwap 


// MemAtomi cCompareAndSwap( ) 


// Compares the value stored at the passed-in memory address against the passed-in expected 
// value. If the comparison is successful, the value at the passed-in memory address is swapped 
// with the passed-in new_value. 


bits(size) MemAtomicCompareAndSwap(bits(64) address, bits(size) expectedvalue, 

bits(size) newvalue, AccType Idacctype, AccType stacctype) 
memaddrdesc = AArch64.TranslateAddressForAtomicAccess(address, size); 

ldaccdesc = CreateAccessDescriptor(ldacctype) ; 
staccdesc = CreateAccessDescriptor(stacctype) ; 


// All observers in the shareability domain observe the 


// following load and store atomically. 
oldvalue = _Mem[memaddrdesc, size DIV 8, ldaccdesc]; 


if BigEndian() then 


oldvalue = BigEndianReverse(oldvalue) ; 


if oldvalue == expectedvalue then 


if BigEndian() then 


newvalue = BigEndianReverse(newvalue) ; 


_Mem[memaddrdesc, size DIV 8, staccdesc] = newvalue; 


return oldvalue; 


aarch64/functions/pac/addpac/AddPAC 


// AddPAC() 


// Calculates the pointer authentication code for a 64-bit quantity and then 
// inserts that into pointer authentication code field of that 64-bit quantity. 


bits(64) AddPAC(bits(64) ptr, bits(64) modifier, bits(128) K, boolean data) 


bits(64) PAC; 
bits(64) result; 
bits(64) ext_ptr; 
bits(64) extfield; 
bit selbit; 


boolean tbi = CalculateTBI(ptr, data); 


integer top_bit = if tbi then 55 else 63; 


// If tagged pointers are in use for a regime with two TTBRs, use bit<55> of 

// the pointer to select between upper and lower ranges, and preserve this. 

// This handles the awkward case where there is apparently no correct choice between 

// the upper and lower address range - ie an addr of 1xxxxxxx@... with TBI@=0 and TBI1=1 
// and Oxxxxxxx1 with TBI1=@ and TBIQ=1: 


if PtrHasUpperAndLowerAddRanges() then 


assert SlTranslationRegime() IN {EL1, EL2}; 
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if SlTranslationRegime() == EL1 then 
// EL1 translation regime registers 
if data then 
selbit = if TCR_EL1.TBI1 == '1' || TCR_EL1.TBIO == '1' then ptr<55> else ptr<63>; 
else 
if ((TCR_EL1.TBI1 == '1' && TCR_EL1.TBID1 == 'Q') || 
(TCR_EL1.TBIO == '1' && TCR_EL1.TBID@ == '@')) then 
selbit = ptr<55>; 
else 
selbit = ptr<63>; 
else 
// EL2 translation regime registers 
if data then 
selbit = if ((HaveEL(EL2) && TCR_EL2.TBI1 == '1') || 
(HaveEL(EL2) && TCR_EL2.TBI@ == '1')) then ptr<55> else ptr<63>; 
else 
selbit = if ((HaveEL(EL2) && TCR_EL2.TBI1 == '1' && TCR_EL1.TBID1 == '@') || 
(HaveEL(EL2) && TCR_EL2.TBI@ == '1' && TCR_EL1.TBID@ == 'Q')) then ptr<55> 
else ptr<63>; 
else selbit = if tbi then ptr<55> else ptr<63>; 


integer bottom_PAC_bit = CalculateBottomPACBit(selbit) ; 





// The pointer authentication code field takes all the available bits in between 
extfield = Replicate(selbit, 64); 


// Compute the pointer authentication code for a ptr with good extension bits 
if tbi then 

ext_ptr = ptr<63:56>:extfield<(56-bottom_PAC_bit)-1:0>:ptr<bottom_PAC_bit-1:0>; 
else 

ext_ptr = extfield<(64-bottom_PAC_bit)-1:0>:ptr<bottom_PAC_bit-1:0>; 


PAC = ComputePAC(ext_ptr, modifier, K<127:64>, K<63:Q>); 


// Check if the ptr has good extension bits and corrupt the pointer authentication code if not 
if !IsZero(ptr<top_bit:bottom_PAC_bit>) && !IsOnes(ptr<top_bit:bottom_PAC_bit>) then 
if HaveEnhancedPAC() then 
PAC = Zeros(); 
else 
PAC<top_bit-1> = NOT(PAC<top_bit-1>) ; 


// Preserve the determination between upper and lower address at bit<55> and insert PAC 
if tbi then 
result = ptr<63:56>:selbit:PAC<54:bottom_PAC_bit>:ptr<bottom_PAC_bit-1:0>; 
else 
result = PAC<63:56>:selbit:PAC<54:bottom_PAC_bit>:ptr<bottom_PAC_bit-1:0>; 
return result; 


aarch64/functions/pac/addpacda/AddPACDA 
// AddPACDA() 


// Returns a 64-bit value containing X, but replacing the pointer authentication code 
// field bits with a pointer authentication code, where the pointer authentication 

// code is derived using a cryptographic algorithm as a combination of X, Y and the 
// APDAKey_EL1. 


bits(64) AddPACDA(bits(64) X, bits(64) Y) 
boolean TrapEL2; 
boolean TrapEL3; 
bits(1) Enable; 
bits(128) APDAKey_EL1; 


APDAKey_EL1 = APDAKeyHi_EL1<63:@> : APDAKeyLo_EL1<63:0>; 


case PSTATE.EL of 
when ELQ 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Armv8 Pseudocode 
J1.1 Pseudocode for AArch64 operations 


boolean IsEL1Regime = S1TranslationRegime() == EL1; 

Enable = if IsEL1Regime then SCTLR_EL1.EnDA else SCTLR_EL2.EnDA; 
rapEL2 = (EL2Enabled() && HCR_EL2.API == 'Q' && 

(HCR_EL2.TGE == '@' || HCR_EL2.E2H == '@')); 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 


when EL1 
Enable = SCTLR_EL1.EnDA; 
TrapEL2 = EL2Enabled() && HCR_EL2.API == 'Q'; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL2 


Enable = SCTLR_EL2.EnDA; 
TrapEL2 = FALSE; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL3 
Enable = SCTLR_EL3.EnDA; 
TrapEL2 = FALSE; 

TrapEL3 = FALSE; 

















if Enable == 'Q' then return X; 

elsif TrapEL2 then TrapPACUse(EL2); 

elsif TrapEL3 then TrapPACUse(EL3); 

else return AddPAC(X, Y, APDAKey_EL1, TRUE); 


aarch64/functions/pac/addpacdb/AddPACDB 
// AddPACDB() 


// Returns a 64-bit value containing X, but replacing the pointer authentication code 
// field bits with a pointer authentication code, where the pointer authentication 

// code is derived using a cryptographic algorithm as a combination of X, Y and the 
// APDBKey_EL1. 


bits(64) AddPACDB(bits(64) X, bits(64) Y) 
boolean TrapEL2; 
boolean TrapEL3; 
bits(1) Enable; 
bits(128) APDBKey_EL1; 


APDBKey_EL1 = APDBKeyHi_EL1<63:@> : APDBKeyLo_EL1<63:0>; 


case PSTATE.EL of 
when ELQ 
boolean IsEL1Regime = S1TranslationRegime() == EL1; 
Enable = if IsEL1Regime then SCTLR_EL1.EnDB else SCTLR_EL2.EnDB; 
rapEL2 = (EL2Enabled() && HCR_EL2.API == 'Q' && 
(HCR_EL2.TGE == '@' || HCR_EL2.E2H == '0')); 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL1 
Enable = SCTLR_EL1.EnDB; 
TrapEL2 = EL2Enabled() && HCR_EL2.API == 'Q'; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 





when EL2 

Enable = SCTLR_EL2.EnDB; 

TrapEL2 = FALSE; 

TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL3 


Enable = SCTLR_EL3.EnDB; 
TrapEL2 = FALSE; 
TrapEL3 = FALSE; 








if Enable == '@' then return X; 

elsif TrapEL2 then TrapPACUse(EL2); 

elsif TrapEL3 then TrapPACUse(EL3); 

else return AddPAC(X, Y, APDBKey_EL1, TRUE); 
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aarch64/functions/pac/addpacga/AddPACGA 
// AddPACGA() 
// Returns a 64-bit value where the lower 32 bits are 0, and the upper 32 bits contain 
// a 32-bit pointer authentication code which is derived using a cryptographic 
// algorithm as a combination of X, Y and the APGAKey_EL1. 
bits(64) AddPACGA(bits(64) X, bits(64) Y) 
boolean TrapEL2; 
boolean TrapEL3; 
bits(128) APGAKey_EL1; 
APGAKey_EL1 = APGAKeyHi_EL1<63:@> : APGAKeyLo_EL1<63:0>; 


case PSTATE.EL of 


when EL@ 
TrapEL2 = (EL2Enabled() && HCR_EL2.API == '0' && 
(HCR_EL2.TGE == '@' || HCR_EL2.E2H == '0')); 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL1 


TrapEL2 = EL2Enabled() && HCR_EL2.API == 'Q'; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL2 
TrapEL2 = FALSE; 

TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL3 
TrapEL2 = FALSE; 
TrapEL3 = FALSE; 








if TrapEL2 then TrapPACUse(EL2); 
elsif TrapEL3 then TrapPACUse(EL3); 
else return ComputePAC(X, Y, APGAKey_EL1<127:64>, APGAKey_EL1<63:0>)<63:32>:Zeros(32); 


aarch64/functions/pac/addpacia/AddPACIA 
// AddPACIA() 


// Returns a 64-bit value containing X, but replacing the pointer authentication code 
// field bits with a pointer authentication code, where the pointer authentication 

// code is derived using a cryptographic algorithm as a combination of X, Y, and the 
// APIAKey_EL1. 


bits(64) AddPACIA(bits(64) X, bits(64) Y) 
boolean TrapEL2; 
boolean TrapEL3; 
bits(1) Enable; 
bits(128) APIAKey_EL1; 


APTAKey_EL1 = APIAKeyHi_EL1<63:0>:APIAKeyLo_EL1<63:0>; 


case PSTATE.EL of 
when ELQ 
boolean IsEL1Regime = S1TranslationRegime() == EL1; 
Enable = if IsEL1Regime then SCTLR_EL1.EnIA else SCTLR_EL2.EnIA; 
rapEL2 = (EL2Enabled() && HCR_EL2.API == 'Q' && 
(HCR_EL2.TGE == '@' || HCR_EL2.E2H == '0')); 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL1 
Enable = SCTLR_EL1.EnIA; 
TrapEL2 = EL2Enabled() && HCR_EL2.API == 'Q'; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 











when EL2 
Enable = SCTLR_EL2.EnIA; 
TrapEL2 = FALSE; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL3 
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Enable = SCTLR_EL3.EnIA; 
TrapEL2 = FALSE; 
TrapEL3 = FALSE; 


if Enable == 'Q' then return X; 

elsif TrapEL2 then TrapPACUse(EL2); 

elsif TrapEL3 then TrapPACUse(EL3); 

else return AddPAC(X, Y, APIAKey_EL1, FALSE); 


aarch64/functions/pac/addpacib/AddPACIB 
// AddPACIB() 


// Returns a 64-bit value containing X, but replacing the pointer authentication code 
// field bits with a pointer authentication code, where the pointer authentication 

// code is derived using a cryptographic algorithm as a combination of X, Y and the 
// APIBKey_EL1. 


bits(64) AddPACIB(bits(64) X, bits(64) Y) 
boolean TrapEL2; 
boolean TrapEL3; 
bits(1) Enable; 
bits(128) APIBKey_EL1; 


APIBKey_EL1 = APIBKeyHi_EL1<63:@> : APIBKeyLo_EL1<63:0>; 


case PSTATE.EL of 
when ELQ 
boolean IsEL1Regime = S1TranslationRegime() == EL1; 
Enable = if IsEL1Regime then SCTLR_EL1.EnIB else SCTLR_EL2.EnIB; 
TrapEL2 = (EL2Enabled() && HCR_EL2.API == '0' && 
(HCR_EL2.TGE == '@' || HCR_EL2.E2H == '@')); 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL1 
Enable = SCTLR_EL1.EnIB; 


TrapEL2 = EL2Enabled() && HCR_EL2.API == 'Q'; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL2 


Enable = SCTLR_EL2.EnIB; 

TrapEL2 = FALSE; 

TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL3 
Enable = SCTLR_EL3.EnIB; 
TrapEL2 = FALSE; 

TrapEL3 = FALSE; 














if Enable == 'Q' then return X; 

elsif TrapEL2 then TrapPACUse(EL2); 

elsif TrapEL3 then TrapPACUse(EL3); 

else return AddPAC(X, Y, APIBKey_EL1, FALSE); 


aarch64/functions/pac/auth/Auth 
// Auth() 


// Restores the upper bits of the address to be all zeros or all ones (based on the 

// value of bit[55]) and computes and checks the pointer authentication code. If the 

// check passes, then the restored address is returned. If the check fails, the 

// second-top and third-top bits of the extension bits in the pointer authentication code 
// field are corrupted to ensure that accessing the address will give a translation fault. 


bits(64) Auth(bits(64) ptr, bits(64) modifier, bits(128) K, boolean data, bit keynumber) 
bits(64) PAC; 
bits(64) result; 
bits(64) original_ptr 
bits(2) error_code; 


nannan 
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bits(64) extfield; 


// Reconstruct the extension field used of adding the PAC to the pointer 
boolean tbi = CalculateTBI(ptr, data); 

integer bottom_PAC_bit = CalculateBottomPACBit(ptr<55>) ; 

extfield = Replicate(ptr<55>, 64); 


if tbi then 
original_ptr 

else 
original_ptr = extfield<64-bottom_PAC_bit-1:0>:ptr<bottom_PAC_bit-1:0>; 


PAC = ComputePAC(original_ptr, modifier, K<127:64>, K<63:0>); 
// Check pointer authentication code 
if tbi then 
if PAC<54:bottom_PAC_bit> == ptr<54:bottom_PAC_bit> then 
result = original_ptr; 
else 
error_code = keynumber:NOT(keynumber) ; 
result = original_ptr<63:55>:error_code:original_ptr<52:0>; 
else 
if ((PAC<54:bottom_PAC_bit> == ptr<54:bottom_PAC_bit>) && 
(PAC<63:56> == ptr<63:56>)) then 
result = original_ptr; 
else 
error_code = keynumber:NOT(keynumber) ; 
result = original_ptr<63>:error_code:original_ptr<60:Q>; 
return result; 





aarch64/functions/pac/authda/AuthDA 
// AuthDA() 


// Returns a 64-bit value containing X, but replacing the pointer authentication code 
// field bits with the extension of the address bits. The instruction checks a pointer 


ptr<63:56>:extfield<56-bottom_PAC_bit-1:0>:ptr<bottom_PAC_bit-1:0>; 


// authentication code in the pointer authentication code field bits of X, using the same 


// algorithm and key as AddPACDA(). 


bits(64) AuthDA(bits(64) X, bits(64) Y) 
boolean TrapEL2; 
boolean TrapEL3; 
bits(1) Enable; 
bits(128) APDAKey_EL1; 


APDAKey_EL1 = APDAKeyHi_EL1<63:@> : APDAKeyLo_EL1<63:0>; 


case PSTATE.EL of 
when EL@ 
boolean IsEL1Regime = S1TranslationRegime() == EL1; 
Enable = if IsEL1Regime then SCTLR_EL1.EnDA else SCTLR_EL2.EnDA; 
rapEL2 = (EL2Enabled() && HCR_EL2.API == 'Q' && 
(HCR_EL2.TGE == '@' || HCR_EL2.E2H == 'Q')); 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL1 
Enable = SCTLR_EL1.EnDA; 


TrapEL2 = EL2Enabled() && HCR_EL2.API == 'Q'; 

TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL2 

Enable = SCTLR_EL2.EnDA; 

TrapEL2 = FALSE; 

TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL3 


Enable = SCTLR_EL3.EnDA; 
TrapEL2 = FALSE; 
TrapEL3 = FALSE; 








if Enable == 'Q' then return X; 
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elsif TrapEL2 then TrapPACUse(EL2); 
elsif TrapEL3 then TrapPACUse(EL3); 
else return Auth(X, Y, APDAKey_EL1, TRUE, 'Q'); 


aarch64/functions/pac/authdb/AuthDB 
// AuthDB() 


// Returns a 64-bit value containing X, but replacing the pointer authentication code 

// field bits with the extension of the address bits. The instruction checks a 

// pointer authentication code in the pointer authentication code field bits of X, using 
// the same algorithm and key as AddPACDB(). 


bits(64) AuthDB(bits(64) X, bits(64) Y) 
boolean TrapEL2; 
boolean TrapEL3; 
bits(1) Enable; 
bits(128) APDBKey_EL1; 


APDBKey_EL1 = APDBKeyHi_EL1<63:@> : APDBKeyLo_EL1<63:0>; 


case PSTATE.EL of 
when ELQ 
boolean IsEL1Regime = S1TranslationRegime() == EL1; 
Enable = if IsEL1Regime then SCTLR_EL1.EnDB else SCTLR_EL2.EnDB; 
TrapEL2 = (EL2Enabled() && HCR_EL2.API == '0' && 
(HCR_EL2.TGE == '@' || HCR_EL2.E2H == 'Q')); 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL1 
Enable = SCTLR_EL1.EnDB; 
TrapEL2 = EL2Enabled() && HCR_EL2.API == 'Q'; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL2 
Enable = SCTLR_EL2.EnDB; 
TrapEL2 = FALSE; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL3 
Enable = SCTLR_EL3.EnDB; 
TrapEL2 = FALSE; 
TrapEL3 = FALSE; 














if Enable == 'Q' then return X; 

elsif TrapEL2 then TrapPACUse(EL2); 

elsif TrapEL3 then TrapPACUse(EL3); 

else return Auth(X, Y, APDBKey_EL1, TRUE, '1'); 


aarch64/functions/pac/authia/AuthlA 
// AuthIA() 


// Returns a 64-bit value containing X, but replacing the pointer authentication code 

// field bits with the extension of the address bits. The instruction checks a pointer 

// authentication code in the pointer authentication code field bits of X, using the same 
// algorithm and key as AddPACIA(). 


bits(64) AuthIA(bits(64) X, bits(64) Y) 
boolean TrapEL2; 
boolean TrapEL3; 
bits(1) Enable; 
bits(128) APIAKey_EL1; 


APIAKey_EL1 = APIAKeyHi_EL1<63:@> : APIAKeyLo_EL1<63:0>; 
case PSTATE.EL of 


when ELQ 
boolean IsEL1Regime = S1TranslationRegime() == EL1; 
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Enable = if IsEL1Regime then SCTLR_EL1.EnIA else SCTLR_EL2.EnIA; 


rapEL2 


TrapEL3 
when EL1 
Enable = 
TrapEL2 
TrapEL3 
when EL2 
Enable = 
TrapEL2 
TrapEL3 
when EL3 
Enable = 
TrapEL2 
TrapEL3 








if Enable == 'Q' 
elsif TrapEL2 th 
elsif TrapEL3 th 
else return Aut 


= (EL2Enabled() && HCR_EL2.API == '0' && 
(HCR_EL2.TGE == '@' || HCR_EL2.E2H == '@')); 
= HaveEL(EL3) && SCR_EL3.API == 'Q'; 


SCTLR_EL1.EnIA; 
EL2Enabled() && HCR_EL2.API == '0'; 
HaveEL(EL3) && SCR_EL3.API == '0'; 


SCTLR_EL2.EnIA; 
= FALSE; 
= HaveEL(EL3) && SCR_EL3.API == 'Q'; 


SCTLR_EL3.EnIA; 
FALSE; 
FALSE; 


then return X; 

en TrapPACUse(EL2); 

en TrapPACUse(EL3); 

h(X, Y, APIAKey_EL1, FALSE, '@'); 


aarch64/functions/pac/authib/AuthIB 


// AuthIB() 


// Returns a 64-bit 


value containing X, but replacing the pointer authentication code 
// field bits with the extension of the address bits. The instruction checks a pointer 


// authentication code in the pointer authentication code field bits of X, using the same 
// algorithm and key as AddPACIB(). 


bits(64) AuthIB(bits(64) X, bits(64) Y) 


boolean TrapEL2; 
boolean TrapEL3; 
bits(1) Enable; 


bits(128) APIBKey_EL1; 


APIBKey_EL1 = APIBKeyHi_EL1<63:@> : APIBKeyLo_EL1<63:0>; 


case PSTATE.EL of 








when ELQ 
boolean IsEL1Regime = S1TranslationRegime() == EL1; 
Enable = if IsEL1Regime then SCTLR_EL1.EnIB else SCTLR_EL2.En1B; 
TrapEL2 = (EL2Enabled() && HCR_EL2.API == '0' && 

(HCR_EL2.TGE == '@' || HCR_EL2.E2H == '@')); 

TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 

when EL1 
Enable = SCTLR_EL1.EnIB; 
TrapEL2 = EL2Enabled() && HCR_EL2.API == 'Q'; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 

when EL2 
Enable = SCTLR_EL2.EnIB; 
TrapEL2 = FALSE; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 

when EL3 
Enable = SCTLR_EL3.EnIB; 
TrapEL2 = FALSE; 
TrapEL3 = FALSE; 

if Enable == '@' then return X; 








elsif TrapEL2 then TrapPACUse(EL2); 
elsif TrapEL3 then TrapPACUse(EL3); 
else return Auth(X, Y, APIBKey_EL1, FALSE, '1'); 
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aarch64/functions/pac/calcbottompacbit/CalculateBottomPACBit 


// CalculateBottomPACBit() 
|[ ======================= 


integer CalculateBottomPACBit(bit top_bit) 


integer tsz_field; 


if PtrHasUpperAndLowerAddRanges() then 
assert SlTranslationRegime() IN {EL1, EL2}; 
if SlTranslationRegime() == EL1 then 
// EL1 translation regime registers 
tsz_field = if top_bit == '1' then UInt(TCR_EL1.T1SZ) else UInt(TCR_EL1.TOSZ) ; 
using64k = if top_bit == '1' then TCR_EL1.TG1 == '11' else TCR_EL1.TGO == '01'; 
else 
// EL2 translation regime registers 
assert HaveEL(EL2); 
tsz_field = if top_bit == '1' then UInt(TCR_EL2.T1SZ) else UInt(TCR_EL2.TOSZ) ; 
using64k = if top_bit == '1' then TCR_EL2.TG1 == '11' else TCR_EL2.TGQ == '01'; 
else 
tsz_field = if PSTATE.EL == EL2 then UInt(TCR_EL2.TQSZ) else UInt(TCR_EL3.TQSZ); 
using64k = if PSTATE.EL == EL2 then TCR_EL2.TG@ == '@1' else TCR_EL3.TGO == 'Q1'; 


max_limit_tsz_field = (if !HaveSmal]PageTblExt() then 39 else if using64k then 47 else 48); 
if tsz_field > max_limit_tsz_field then 

// TCR_ELx.TySZ is out of range 

c = ConstrainUnpredictable(); 

assert c IN {Constraint_FORCE, Constraint_NONE}; 

if c == Constraint_FORCE then tsz_field = max_limit_tsz_field; 
tszmin = if using64k && VAMax() == 52 then 12 else 16; 
if tsz_field < tszmin then 

c = ConstrainUnpredictable(); 

assert c IN {Constraint_FORCE, Constraint_NONE}; 

if c == Constraint_FORCE then tsz_field = tszmin; 
return (64-tsz_field); 


aarch64/functions/pac/calculatetbi/CalculateTBI 


// CalculateTBI() 
|{ = 


boolean CalculateTBI(bits(64) ptr, boolean data) 
boolean tbi = FALSE; 


if PtrHasUpperAndLowerAddRanges() then 
assert SlTranslationRegime() IN {EL1, EL2}; 
if SlTranslationRegime() == EL1 then 
// EL1 translation regime registers 
if data then 


tbi = if ptr<55> == '1' then TCR_EL1.TBI1 == '1' else TCR_EL1.TBIO == '1'; 


else 
if ptr<55> == '1' then 
tbi = TCR_EL1.TBI1 == '1' && TCR_EL1.TBID1 == 'Q'; 
else 
tbi = TCR_EL1.TBIO 


'1' && TCR_EL1.TBIDO == '0'; 
else 
// EL2 translation regime registers 
if data then 
tbi = if ptr<55> == '1' then TCR_EL2.TBI1 == '1' else TCR_EL2.TBIO == 
else 
if ptr<55> == '1' then 
tbi = TCR_EL2.TBI1 == '1' && TCR_EL2.TBID1 == 'Q'; 
else 
tbi = TCR_EL2.TBI@ == '1' && TCR_EL2.TBID@ == 'Q'; 
elsif PSTATE.EL == EL2 then 
tbi = if data then TCR_EL2.TBI=='1' else TCR_EL2.TBI=='1' && TCR_EL2.TBID=='Q'; 
elsif PSTATE.EL == EL3 then 
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tbi = if data then TCR_EL3.TBI=='1' else TCR_EL3.TBI=='1' && TCR_EL3.TBID=='0'; 


return tbi; 


aarch64/functions/pac/computepac/ComputePAC 


array bits(64) RC[Q..4]; 


bits(64) ComputePAC(bits(64) data, bits(64) modifier, bits(64) key@, bits(64) key1) 


bits(64) workingval; 

bits(64) runningmod; 

bits(64) roundkey; 

bits(64) modkQ; 

constant bits(64) Alpha = @xC@AC29B7C97C5@DD<63:0>; 


RC[O] = 0x0000000000000000<63:0>; 
RC[1] = @x13198A2E03707344<63:0>; 
RC[2] = @xA4093822299F31D0<63:0>; 
RC[3] = 0x082EFA98EC4E6C89<63: 0>; 
RC[4] = 0x452821E638D01377<63:0>; 


modk®@ = key0<@>:key0<63:2>:(key0<63> EOR keyQ<1>); 
runningmod = modifier; 
workingval = data EOR keyQ; 
for i = 2 to 4 
roundkey = key1 EOR runningmod; 
workingval = workingval EOR roundkey; 
workingval = workingval EOR RC[i]; 
if i > 0 then 
workingval = PACCel1Shuffle(workingval) ; 
workingval = PACMult(workingva1) ; 
workingval = PACSub(workingval) ; 
runningmod = TweakShuffle(runningmod<63:0>) ; 
roundkey = modk@ EOR runningmod; 
workingval = workingval EOR roundkey; 
workingval = PACCel1Shuffle(workingva1) ; 
workingval = PACMult(workingval) ; 
workingval = PACSub(workingva1) ; 
workingval = PACCel1Shuffle(workingval) ; 
workingval = PACMult(workingval) ; 
workingval = key1 EOR workingval; 
workingval = PACCel1InvShuffle(workingval) ; 
workingval = PACInvSub(workingval) ; 
workingval = PACMult(workingval) ; 
workingval = PACCel1InvShuffle(workingval) ; 
workingval = workingval EOR keyQ; 
workingval = workingval EOR runningmod; 
for i = 0 to 4 
workingval = PACInvSub(workingva1) ; 
if i < 4 then 
workingval = PACMult(workingva1) ; 
workingval = PACCel1InvShuffle(workingval); 
runningmod = TweakInvShuffle(runningmod<63:Q>) ; 
roundkey = key1 EOR runningmod; 
workingval = workingval EOR RC[4-1]; 
workingval = workingval EOR roundkey; 
workingval = workingval EOR Alpha; 
workingval = workingval EOR modkQ; 





nr 








return workingval; 


aarch64/functions/pac/computepac/PACCelllnvShuffle 


// PACCellInvShuffle() 
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bits(64) PACCellInvShuffle(bits (64) 


aarch64/functions/pac/computepac/PACCellShuffle 


// 
// 


bits(64) outdata; 


outdata<3:0> = 
outdata<7:4> = 


outdata<15:12> 


indata<15:12>; 
indata<27:24>; 
outdata<11:8> = indata<51:48>; 


outdata<19:16> = 


outdata<23:20> 


outdata<27:24> = 


outdata<31:28> 


outdata<35:32> = 
outdata<39:36> = 


outdata<43: 40> 


outdata<47:44> = 


outdata<51:48> 


outdata<55:52> = 
outdata<59:56> = 


outdata<63: 60> 
return outdata; 


PACCel11Shuffle() 


indata<39: 36>; 
indata<59:56>; 
indata<47:44>; 
indata<7:4>; 

indata<19:16>; 
indata<35:32>; 
indata<55:52>; 
indata<31:28>; 
indata<11:8>; 
indata<23:20>; 
indata<3:0>; 

indata<43:4Q>; 
indata<63: 60>; 


indata) 


bits(64) PACCel1Shuffle(bits(64) indata) 


aarch64/functions/pac/computepac/PACInvSub 


// 
// 


bits(64) outdata; 


outdata<3:@> = indata<55:52>; 
outdata<7:4> = indata<27:24>; 
outdata<11:8> = indata<47:44>; 


outdata<15:12> 


outdata<19:16> = 


outdata<23:20> 


outdata<27:24> = 
outdata<31:28> = 


outdata<35 : 32> 


outdata<39:36> = 


outdata<43: 40> 


outdata<47:44> = 


outdata<51:48> 
outdata<55:52> 


outdata<59:56> = 


outdata<63: 60> 
return outdata; 


PACInvSub() 


indata<3:0>; 

indata<31: 28>; 
indata<51:48>; 
indata<7:4>; 

indata<43:4Q>; 
indata<35:32>; 
indata<15:12>; 
indata<59:56>; 
indata<23:20>; 
indata<11:8>; 
indata<39: 36>; 
indata<19:16>; 
indata<63: 60>; 


bits(64) PACInvSub(bits(64) Tinput) 


// This is a 4-bit substitution from 


bits(64) Toutput; 


for i = 0 to 15 
case Tinput<4#i+3:4«i> of 
when 'Q000' Toutput<4«i+3: 
when 'Q001' Toutput<4«i+3: 
when 'Q010' Toutput<4«i+3: 
when 'QQ011' Toutput<4«i+3: 
when 'Q100' Toutput<4«i+3: 
when 'Q101' Toutput<4«i+3: 
when 'Q110' Toutput<4«i+3: 
when 'Q111' Toutput<4+i+3: 
when '1000' Toutput<4«i+3: 
when '1001' Toutput<4«i+3: 
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zi> = 
si> 
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'1010'; 
'1011'; 
'0001'; 
'1001'; 
'0010'; 
'0110'; 





Non-Confidential 


Armv8 Pseudocode 
J1.1 Pseudocode for AArch64 operations 


J1-7353 


Armv8 Pseudocode 


J1.1 Pseudocode for AArch64 operations 


J1-7354 


when 
when 
when 
when 
when 
when 


"1010' 
'1011' 
'1100' 
'1101' 
'1110' 
'1111' 


return Toutput; 


Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 


*#143:4ei> = 
#143:4ei> = 


#143:4ei> 


*143:4ei> = 


#143:4ei> 


#14+3:4%i> = 


"1111'; 
"0000' ; 
0100' ; 
"1100' ; 
"Q111'; 
'0011'; 


aarch64/functions/pac/computepac/PACMult 


// PACMult() 
(=== 


bits(64) PACMult(bits(64) Sinput) 


bits(4) 
bits(4) 
bits(4) 
bits(4) 
bits(64) 


tô; 
tl; 
t2: 
t3; 


Soutput; 


for i = 0 to 3 


t0<3 
t0<3 
t1<3 
t1<3 
t2<3 
t2<3 
t3<3 
t3<3 


10> 
10> 
10> 
10> 
10> 
10> 
10> 
10> 


Soutput<4 
Soutput<4 
Soutput<4 
Soutput<4 
return Soutput; 


RotCel 1] (Sinput<4«(1+8)+3:4«(i+8)>, 1) EOR RotCell(Sinput<4«(1+4)+3:4«(i+4)>, 2); 


t0<3:0> EOR RotCell(Sinput<4*(i)+3:4«(i)>, 1); 


RotCel 1 (Sinput<4«(14+12)+3:4%(i+12)>, 1) EOR RotCell(Sinput<4«(i+4)+3:4«(i+4)>, 1); 


t1<3:@> EOR RotCell(Sinput<4«(i)+3:4«(i)>, 2); 


RotCel 1] (Sinput<4«(i4+12)+3:4«(i+12)>, 2) EOR RotCell(Sinput<4«(1+8)+3:4«(i+8)>, 1); 


t2<3:0> EOR RotCell(Sinput<4«(i)+3:4«(i)>, 1); 


RotCel 1 (Sinput<4«(14+12)4+3:4«(i+12)>, 1) EOR RotCell(Sinput<4«(i+8)+3:4%(i+8)>, 2); 


t3<3:0> EOR RotCell(Sinput<4«(i+4)+3:4«(1+4)>, 1); 


#14+3:4ei> = t3<3:0>; 


x(i+4)+3:4x(i+4)> = t2<3:0>; 
#(4+8)+3:4(148)> = t1<3:0>; 


x(1+12)+3:4»(1+12)> = t0<3:0>; 


aarch64/functions/pac/computepac/PACSub 


// PACSub() 
== 


bits(64) PACSub(bits(64) Tinput) 


// This is a 4-bit substitution from 


bits(64) Toutput; 
for i = ð to 15 
case Tinput<4#i+3:4«i> of 


when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 


"0000' 
"0001" 
'0010' 
'0011' 
'0100' 
'0101' 
'0110' 
'0111' 
"1000' 
"1001' 
"1010' 
'1011' 
'1100' 
'1101' 
'1110' 
'1111' 


return Toutput; 
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Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 
Toutput<4 


*it3: #1> 
#143: 
#143: 
#143: 
#143: 
#143: 
#143! 
*it3! 
#143 
#143 
#143 
#143 
#143 
#143 
#143: 
#143: 


i> 


i> 


RRR RR RRR RRR RR RRR 


xi> 


xi> = 
zi> = 
«i> = 
«i> = 


«i> = 
«i> = 
zi> = 
zi> = 


zi> = 
zi> = 
j> = 
«i> = 


the PRINCE-family cipher 
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aarch64/functions/pac/computepac/RotCell 


// RotCell() 


bits(4) RotCell(bits(4) incell, integer amount) 


bits(8) tmp; 
bits(4) outcell; 


// assert amount>3 || amount<1; 
tmp<7:0> = incell<3:Q>:incel1<3:@>; 
outcell = tmp<7-amount:4-amount>; 
return outcell; 


aarch64/functions/pac/computepac/TweakCelllnvRot 


// TweakCel1InvRot() 


bits(4) TweakCellInvRot(bits(4)incel1) 


bits(4) outcell; 

outcel]l<3> = incell<2>; 

outcell<2> = incell<l>; 

outcell<1> = incell<Q>; 

outcell<@> = incell<@> EOR incell<3>; 
return outcell; 


aarch64/functions/pac/computepac/TweakCellRot 


// TweakCel1Rot() 


bits(4) TweakCellRot(bits(4) incell) 


bits(4) outcell; 

outcel1l<3> = incell<@> EOR incell<1>; 
outcell<2> = incell<3>; 

outcell<1l> = incell<2>; 

outcell<@> = incell<b; 

return outcell; 


aarch64/functions/pac/computepac/TweakInvShuffle 


// TweakInvShuffle() 


bits(64) TweakInvShuffle(bits(64)indata) 


bits(64) outdata; 

outdata<3:0> = TweakCellInvRot(indata<51: 48>); 
outdata<7:4> = indata<55:52>; 

outdata<11:8> = indata<23:20>; 

outdata<15:12> = indata<27:24>; 

outdata<19:16> = indata<3:0>; 

outdata<23:20> = indata<7:4>; 

outdata<27:24> = TweakCel]lInvRot(indata<11:8>) ; 
outdata<31:28> = indata<15:12>; 

outdata<35:32> = TweakCellInvRot(indata<31: 28>) ; 
outdata<39:36> = TweakCellInvRot(indata<63: 60>); 
outdata<43:40> = TweakCellInvRot(indata<59: 56>); 
outdata<47:44> = TweakCel]lInvRot(indata<19:16>) ; 
outdata<51:48> = indata<35:32>; 

outdata<55:52> = indata<39:36>; 

outdata<59:56> = indata<43:40>; 

outdata<63:60> = TweakCellInvRot(indata<47:44>) ; 
return outdata; 
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aarch64/functions/pac/computepac/TweakShuffle 


// TweakShuffle 
// ============ 


Q 


bits(64) TweakShuffle(bits(64) indata) 


bits(64) outdata; 


outdata<3:@> = indata<19:16>; 
outdata<7:4> = indata<23:20>; 


outdata<11 
outdata<15: 
outdata<19: 
outdata<23: 
outdata<27: 
outdata<31: 
outdata<35: 
outdata<39: 
outdata<43: 
outdata<47: 
outdata<51: 
outdata<55: 
outdata<59: 
outdata<63: 


return outdata; 


aarch64/functions/pac/pac/HaveEnhancedPAC 


12> 
16> 
20> 


24> = 


28> 


32> = 
36> = 


40> 


44> = 


48> 


52> = 


56> 
60> 


// HaveEnhancedPAC() 
// ================= 


// Returns TRUE if support for EnhancedPAC is implemented, FALSE otherwise. 


:8> = TweakCellRot(indata<27:24>); 


indata<31:28>; 

TweakCel 1Rot(indata<47:44>); 
indata<11:8>; 

indata<15:12>; 

TweakCel 1Rot(indata<35: 32>); 
indata<51:48>; 
indata<55:52>; 
indata<59:56>; 

TweakCel 1Rot(indata<63: 60>) ; 
TweakCel 1Rot(indata<3:0>); 
indata<7:4>; 

TweakCel 1Rot(indata<43:40>) ; 
TweakCel 1Rot(indata<39: 36>); 








boolean HaveEnhancedPAC() 
return ( HavePACExt() 


&& boolean IMPLEMENTATION_DEFINED "Has enhanced PAC functionality" ); 


aarch64/functions/pac/pac/HavePACExt 


// HavePACExt() 
// ============ 


// Returns TRUE if support for the PAC extension is implemented, FALSE otherwise. 


boolean HavePACExt() 
return HasArchVersion(ARMv8p3); 


aarch64/functions/pac/pac/PtrHasUpperAndLowerAddRanges 


// PtrHasUpperAndLowerAddRanges( ) 


// Returns TRUE if the pointer has upper and lower address ranges, FALSE otherwise. 


boolean PtrHasUpperAndLowerAddRanges() 
return PSTATE.EL == EL1 || PSTATE.EL == ELO || (PSTATE.EL == EL2 && HCR_EL2.E2H == '1'); 


aarch64/functions/pac/strip/Strip 


// Strip() 


// Strip() returns a 64-bit value containing A, but replacing the pointer authentication 


// code field bits with the extension of the address bits. This can apply to either 
// instructions or data, where, as the use of tagged pointers is distinct, it might be 


// handled differently. 


bits(64) Strip(bits(64) A, boolean data) 
boolean TrapEL2; 
boolean TrapEL3; 
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bits(64) original_ptr 

bits(64) extfield; 

boolean tbi = CalculateTBI(A, data); 

integer bottom_PAC_bit = CalculateBottomPACBit(A<55>); 
extfield = Replicate(A<55>, 64); 


if tbi then 

original_ptr = A<63:56>:extfield< 56-bottom_PAC_bit-1:0>:A<bottom_PAC_bit-1:0>; 
else 

original_ptr = extfield< 64-bottom_PAC_bit-1:0>:A<bottom_PAC_bit-1:0>; 


case PSTATE.EL of 
when ELQ 
TrapE 


r 
N 
Ml 


(EL2Enabled() && HCR_EL2.API == 'Q' && 
(HCR_EL2.TGE == '@' || HCR_EL2.E2H == '0')); 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL1 
TrapEL2 = EL2Enabled() && HCR_EL2.API == 'Q'; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL2 
TrapEL2 = FALSE; 
TrapEL3 = HaveEL(EL3) && SCR_EL3.API == 'Q'; 
when EL3 
TrapEL2 = FALSE; 
TrapEL3 = FALSE; 








if TrapEL2 then TrapPACUse(EL2); 
elsif TrapEL3 then TrapPACUse(EL3); 
else return original_ptr; 


aarch64/functions/pac/trappacuse/TrapPACUse 


// TrapPACUse() 


// Used for the trapping of the pointer authentication functions by higher exception 
// levels. 


TrapPACUse(bits(2) target_el) 
assert HaveEL(target_el) && target_el != ELQ && UInt(target_el) >= UInt(PSTATE.EL); 


bits(64) preferred_exception_return = ThisInstrAddr(); 

ExceptionRecord exception; 

vect_offset = 0; 

exception = ExceptionSyndrome(Exception_PACTrap) ; 

AArch64.TakeException(target_el, exception, preferred_exception_return, vect_offset) ; 


aarch64/functions/ras/AArch64.ESBOperation 
// AArch64.ESBOperation() 
// Perform the AArch64 ESB operation, either for ESB executed in AArch64 state, or for 
// ESB in AArch32 state when SError interrupts are routed to an Exception level using 
// AArch64 
AArch64.ESBOperation() 
route_to_el3 = HaveEL(EL3) && SCR_EL3.EA == '1'; 


route_to_el2 = (EL2Enabled() && 
(HCR_EL2.TGE == '1' || HCR_EL2.AMO == '1')); 


target = if route_to_el3 then EL3 elsif route_to_el2 then EL2 else EL1; 


if target == EL1 then 
mask_active = PSTATE.EL IN {ELQ, EL1}; 

elsif HaveVirtHostExt() && target == EL2 && HCR_EL2.<E2H,TGE> == '11' then 
mask_active = PSTATE.EL IN {ELQ, EL2}; 
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else 
mask_active = PSTATE.EL == target; 


mask_set = (PSTATE.A == '1' && (!HaveDoubleFaultExt() || SCR_EL3.EA == 'Q' | 
PSTATE.EL != EL3 || SCR_EL3.NMEA == '0')); 


intdis = Halted() || ExternalDebugInterruptsDisabled(target) ; 


masked = (UInt(target) < UInt(PSTATE.EL)) || intdis || (mask_active && mask_set); 


// Check for a masked Physical SError pending 
if IsPhysicalSErrorPending() && masked then 


// This function might be called for an interworking case, and INTdis is masking 


// the SError interrupt. 
if ELUsingAArch32(S1TranslationRegime()) then 

syndrome32 = AArch32.PhysicalSErrorSyndrome() ; 

DISR = AArch32.ReportDeferredSError(syndrome32.AET, syndrome32.ExT); 
else 

implicit_esb = FALSE; 

syndrome64 = AArch64.PhysicalSErrorSyndrome(implicit_esb) ; 

DISR_EL1 = AArch64.ReportDeferredSError(syndrome64) ; 
ClearPendingPhysicalSError(); // Set ISR_EL1.A to 0 


return; 


aarch64/functions/ras/AArch64.PhysicalSErrorSyndrome 


// Return the SError syndrome 


bits(25) AArch64.PhysicalSErrorSyndrome(boolean implicit_esb) ; 


aarch64/functions/ras/AArch64.ReportDeferredSError 


// AArch64.ReportDeferredSError() 
// ============================== 


// Generate deferred SError syndrome 


bits(64) AArch64.ReportDeferredSError(bits(25) syndrome) 
bits(64) target; 
target<31l> = '1'; // A 
target<24> = syndrome<24>; // IDS 
target<23:0> = syndrome<23:0>; // ISS 
return target; 


aarch64/functions/ras/AArch64.vESBOperation 


// AArch64.vESBOperation() 
|[ ======================= 


// Perform the AArch64 ESB operation for virtual SError interrupts, either for ESB 
// executed in AArch64 state, or for ESB in AArch32 state with EL2 using AArch64 state 


AArch64.vESBOperation() 
assert PSTATE.EL IN {EL@, EL1} && EL2Enabled(); 


// If physical SError interrupts are routed to EL2, and TGE is not set, then a virtual 


// SError interrupt might be pending 


VSEI_enabled = HCR_EL2.TGE == '@' && HCR_EL2.AMO == '1'; 


VSEI_pending = vSEI_enabled && HCR_EL2.VSE == '1'; 


vintdis = Halted() || ExternalDebugInterruptsDisabled(EL1) 


vmasked = vintdis || PSTATE.A == '1'; 


// Check for a masked virtual SError pending 
if vSEI_pending && vmasked then 


// This function might be called for the interworking case, and INTdis is masking 


// the virtual SError interrupt. 
if ELUsingAArch32(EL1) then 


VDISR = AArch32.ReportDeferredSError(VDFSR<15:14>, VDFSR<12>); 


else 


VDISR_EL2 = AArch64.ReportDeferredSError(VSESR_EL2<24: >) ; 


J1-7358 
Non-Confidential 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Armv8 Pseudocode 
J1.1 Pseudocode for AArch64 operations 


HCR_EL2.VSE = 'Q'; // Clear pending virtual SError 


return; 


aarch64/functions/registers/AArch64.MaybeZeroRegisterUppers 


// AArch64 .MaybeZeroRegisterUppers() 


// On taking an exception to AArch64 from AArch32, it is CONSTRAINED UNPREDICTABLE whether the top 
// 32 bits of registers visible at any lower Exception level using AArch32 are set to zero. 


AArch64.MaybeZeroRegisterUppers() 
assert UsingAArch32(); // Always called from AArch32 state before entering AArch64 state 


if PSTATE.EL == ELO && !ELUsingAArch32(EL1) then 
first = 0; last = 14; include_R15 = FALSE; 

elsif PSTATE.EL IN {ELQ, EL1} && EL2Enabled() && !ELUsingAArch32(EL2) then 
first = 0; last = 30; include_R15 = FALSE; 

else 
first = 0; last = 30; include_R15 = TRUE; 


for n = first to last 
if (n != 15 || include_R15) && ConstrainUnpredictableBool() then 
_R[n]<63:32> = Zeros(); 


return; 


aarch64/functions/registers/AArch64.ResetGeneralRegisters 


// AArch64.ResetGeneralRegisters() 
// a 


AArch64.ResetGeneralRegisters() 


for i = 0 to 30 
X[i] = bits(64) UNKNOWN; 


return; 


aarch64/functions/registers/AArch64.ResetSIMDFPRegisters 


// AArch64.ResetSIMDFPRegisters() 
// EAEE 


AArch64.ResetSIMDFPRegisters() 


for i = 0 to 31 
V[i] = bits(128) UNKNOWN; 


return; 


aarch64/functions/registers/AArch64.ResetSpecialRegisters 


// AArch64.ResetSpecialRegisters() 
p EEO 


AArch64.ResetSpecialRegisters() 


// AArch64 special registers 
SP_ELO = bits(64) UNKNOWN; 
SP_EL1 = bits(64) UNKNOWN; 
SPSR_EL1 = bits(32) UNKNOWN; 
ELR_EL1 = bits(64) UNKNOWN; 
if HaveEL(EL2) then 

SP_EL2 = bits(64) UNKNOWN; 
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SPSR_EL2 = bits(32) UNKNOWN; 
ELR_EL2 = bits(64) UNKNOWN; 
if HaveEL(EL3) then 
SP_EL3 = bits(64) UNKNOWN; 
SPSR_EL3 = bits(32) UNKNOWN; 
ELR_EL3 = bits(64) UNKNOWN; 


// AArch32 special registers that are not architecturally mapped to AArch64 registers 
if HaveAArch32EL(EL1) then 
SPSR_fig = bits(32) UNKNOWN; 
SPSR_irg = bits(32) UNKNOWN; 
SPSR_abt = bits(32) UNKNOWN; 
SPSR_und = bits(32) UNKNOWN; 





// External debug special registers 
DLR_ELO = bits(64) UNKNOWN; 
DSPSR_EL@ = bits(32) UNKNOWN; 


return; 


aarch64/functions/registers/AArch64.ResetSystemRegisters 


AArch64.ResetSystemRegisters(boolean cold_reset) ; 


aarch64/functions/registers/PC 
// PC - non-assignment form 
// Read program counter. 


bits(64) PC[] 
return _PC; 


aarch64/functions/registers/SP 


// SP[] - assignment form 


// Write to stack pointer from either a 32-bit or a 64-bit value. 


SP[] = bits(width) value 
assert width IN {32,64}; 
if PSTATE.SP == 'Q' then 
SP_EL@ = ZeroExtend(value); 
else 
case PSTATE.EL of 
when ELO SP_EL@ 
when EL1 SP_EL1 
when EL2 SP_EL2 
when EL3 SP_EL3 
return; 


ZeroExtend(value) ; 
ZeroExtend(value) ; 
ZeroExtend(value) ; 
ZeroExtend(value); 


// Read stack pointer with implicit slice of 8, 16, 32 or 64 bits. 


bits(width) SP[] 
assert width IN {8,16,32,64}; 
if PSTATE.SP == '@' then 
return SP_ELQ<width-1:0>; 
else 
case PSTATE.EL of 
when EL@ return SP_ELQ@<width-1:0>; 
when EL1 return SP_EL1<width-1:0>; 
when EL2 return SP_EL2<width-1:0>; 
when EL3 return SP_EL3<width-1:0>; 
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aarch64/functions/registers/V 


// \[] - assignment form 


// Write to SIMD&FP register with implicit extension from 
// 8, 16, 32, 64 or 128 bits. 


V[integer n] = bits(width) value 
assert n >= 0 & n <= 31; 
assert width IN {8,16,32,64,128}; 
integer vlen = if IsSVEEnabled(PSTATE.EL) then VL else 128; 
if ConstrainUnpredictableBool() then 
_Z[n] = ZeroExtend(value); 
else 
_Z[n]<vlen-1:0> = ZeroExtend(value); 


// \[] - non-assignment form 


// Read from SIMD&FP register with implicit slice of 8, 16 
// 32, 64 or 128 bits. 


bits(width) V[integer n] 
assert n >= 0 && n <= 31; 
assert width IN {8,16,32,64,128}; 
return _Z[n]<width-1:0>; 


aarch64/functions/registers/Vpart 
// Npart[] - non-assignment form 


// Reads a 128-bit SIMD&FP register in up to two parts: 

// part ® returns the bottom 8, 16, 32 or 64 bits of a value held in the register; 
// part 1 returns the top half of the bottom 64 bits or the top half of the 128-bit 
// value held in the register. 


bits(width) Vpart[integer n, integer part] 
assert n >= 0 && n <= 31; 
assert part IN {Q, 1}; 
if part == @ then 
assert width < 128; 
return V[n]; 
else 
assert width IN {32,64}; 
bits(128) vreg = V[n]; 
return vreg<(width » 2)-1:width>; 


// Npart[] - assignment form 


// Writes a 128-bit SIMD&FP register in up to two parts: 
// part ® zero extends a 8, 16, 32, or 64-bit value to fill the whole register; 
// part 1 inserts a 64-bit value into the top half of the register. 


Vpart[integer n, integer part] = bits(width) value 
assert n >= 0 && n <= 31; 
assert part IN {Q, 1}; 
if part == @ then 
assert width < 128; 
V[n] = value; 
else 
assert width == 64; 
bits(64) vreg = V[n]; 
V[n] = value<63:0> : vreg; 
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aarch64/functions/registers/X 
// X[] - assignment form 
// Write to general-purpose register from either a 32-bit or a 64-bit value. 


X[integer n] = bits(width) value 
assert n >= 0 & n <= 31; 
assert width IN {32,64}; 
if n != 31 then 

_R[n] = ZeroExtend(value) 
return; 


// X[] - non-assignment form 


// Read from general-purpose register with implicit slice of 8, 16, 32 or 64 bits. 


bits(width) X[integer n] 
assert n >= 0 && n <= 31; 
assert width IN {8,16,32,64}; 
if n != 31 then 
return _R[n]<width-1:0>; 
else 
return Zeros(width); 


aarch64/functions/sve/AArch32.IsFPEnabled 


// AArch32.IsFPEnabled() 
// ===================== 


boolean AArch32.IsFPEnabled(bits(2) el) 
if el == EL@ && !ELUsingAArch32(EL1) then 
return AArch64.IsFPEnabled(el); 


if HaveEL(EL3) && ELUsingAArch32(EL3) && !IsSecure() then 
// Check if access disabled in NSACR 
if NSACR.cp10 == '@' then return FALSE; 


if el IN {ELQ, EL1} then 
// Check if access disabled in CPACR 
case CPACR.cp10 of 
when 'x@' disabled = TRUE; 
when '@1' disabled = (el == ELQ); 
when '11' disabled = FALSE; 
if disabled then return FALSE; 


if el IN {ELQ, EL1, EL2} then 
if EL2Enabled() then 
if !ELUsingAArch32(EL2) then 
if CPTR_EL2.TFP == '1' then return FALSE; 
else 
if HCPTR.TCP1@ == '1' then return FALSE; 


if HaveEL(EL3) && !ELUsingAArch32(EL3) then 
// Check if access disabled in CPTR_EL3 
if CPTR_EL3.TFP == '1' then return FALSE; 


return TRUE; 


aarch64/functions/sve/AArch64.IsFPEnabled 


// AArch64.IsFPEnabled() 
// ===================== 


boolean AArch64.IsFPEnabled(bits(2) el) 
// Check if access disabled in CPACR_EL1 
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if el IN {EL@, EL1} then 
// Check FP&SIMD at ELQ/EL1 
case CPACR[].FPEN of 
when 'x@' disabled = TRUE; 
when '@1' disabled = (el == ELQ); 
when '11' disabled = FALSE; 
if disabled then return FALSE; 


// Check if access disabled in CPTR_EL2 
if el IN {EL@, EL1, EL2} && EL2Enabled() then 
if HaveVirtHostExt() && HCR_EL2.E2H == '1' then 
if CPTR_EL2.FPEN == 'x@' then return FALSE; 
else 
if CPTR_EL2.TFP == '1' then return FALSE; 


// Check if access disabled in CPTR_EL3 
if HaveEL(EL3) then 
if CPTR_EL3.TFP == '1' then return FALSE; 


return TRUE; 


aarch64/functions/sve/CeilPow2 


// CeilPow2() 


// For a positive integer X, return the smallest power of 2 >= X 
integer CeilPow2(integer x) 
if x == 0 then return Q; 


if x == 1 then return 2; 
return FloorPow2(x - 1) +» 2; 


aarch64/functions/sve/CheckSVEEnabled 


// CheckSVEEnabled() 





Jj sssssssssse====== 
CheckSVEEnab]ed() 
// Check if access disabled in CPACR_EL1 
if PSTATE.EL IN {EL@, EL1} then 
// Check SVE at EL@/EL1 
case CPACR[].ZEN of 
when 'x@' disabled = TRUE; 
when '@1' disabled = PSTATE.EL == ELQ; 
when '11' disabled = FALSE; 
if disabled then SVEAccessTrap(EL1); 
// Check FP&SIMD at ELQ/EL1 
case CPACR[].FPEN of 
when 'x@' disabled = TRUE; 
when '@1' disabled = PSTATE.EL == ELQ; 
when '11' disabled = FALSE; 
if disabled then AArch64.AdvSIMDFPAccessTrap(EL1) ; 
if PSTATE.EL IN {EL@, EL1, EL2} && EL2Enabled() then 
if HaveVirtHostExt() && HCR_EL2.E2H == '1' then 
if CPTR_EL2.ZEN == 'x@' then SVEAccessTrap(EL2); 
if CPTR_EL2.FPEN == 'x@' then AArch64.AdvSIMDFPAccessTrap(EL2); 
else 
if CPTR_EL2.TZ == '1' then SVEAccessTrap(EL2); 
if CPTR_EL2.TFP == '1' then AArch64.AdvSIMDFPAccessTrap(EL2); 
// Check if access disabled in CPTR_EL3 
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if HaveEL(EL3) then 
if CPTR_EL3.EZ == '@' then SVEAccessTrap(EL3); 
if CPTR_EL3.TFP == '1' then AArch64.AdvSIMDFPAccessTrap(EL3); 


aarch64/functions/sve/DecodePredCount 


// DecodePredCount() 
// ================= 


integer DecodePredCount(bits(5) pattern, integer esize) 
integer elements = VL DIV esize; 
integer numElem; 
case pattern of 
when 'QQ0000' numElem = FloorPow2(elements); 


when '00001' numElem = if elements >= 1 then 1 else Q; 
when 'QQ010' numElem = if elements >= 2 then 2 else Q; 
when 'QQQ11' numElem = if elements >= 3 then 3 else Q; 
when 'Q0100' numElem = if elements >= 4 then 4 else Q; 
when 'QQ0101' numElem = if elements >= 5 then 5 else Q; 
when 'Q0110' numElem = if elements >= 6 then 6 else Q; 
when '00111' numElem = if elements >= 7 then 7 else Q; 
when 'Q1000' numElem = if elements >= 8 then 8 else Q; 
when 'Q1001' numElem = if elements >= 16 then 16 else Q; 


when 'Q1010' numElem = if elements >= 32 then 32 else Q; 


when 'Q1011' numElem = if elements >= 64 then 64 else Q; 
when 'Q1100' numElem = if elements >= 128 then 128 else Q; 
when 'Q1101' numElem = if elements >= 256 then 256 else Q; 


when '11110' numElem = elements - (elements MOD 3); 
when '11111' numElem = elements; 
otherwise numElem = Q; 

return numElem; 





when '11101' numElem = elements - (elements MOD 4); 


aarch64/functions/sve/ElemFFR 


// ElemFFR[] - non-assignment form 


// =========================== 


bit ElemFFR[integer e, integer esize] 
return ElemP[_FFR, e, esize]; 


// ElemFFR[] - assignment form 
// =========================== 


ElemFFR[integer e, integer esize] = bit value 
integer psize = esize DIV 8; 
integer n = e » psize; 
assert n >= 0 && (n + psize) <= PL; 
_FFR<n+psize-1:n> = ZeroExtend(value, psize); 
return; 


aarch64/functions/sve/ElemP 


// ElemP[] - non-assignment form 


[/ ============================= 


bit ElemP[bits(N) pred, integer e, integer esize] 
integer n = e » (esize DIV 8); 
assert n >= 0 &&n <N; 
return pred<n>; 


// ElemP[] - assignment form 


// ========================= 


ElemP[bits(N) &pred, integer e, integer esize] = bit value 
integer psize = esize DIV 8; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


Armv8 Pseudocode 
J1.1 Pseudocode for AArch64 operations 


integer n = e » psize; 

assert n >= 0 && (n + psize) <= N; 
pred<n+psize-1:n> = ZeroExtend(value, psize); 
return; 


aarch64/functions/sve/FFR 


// FFR[E] - non-assignment form 


// =========================== 


bits(width) FFR[] 
assert width == PL; 
return _FFR<width-1:0>; 


// FFR[] - assignment form 
// ======================= 


FFR[] = bits(width) value 
assert width == PL; 
if ConstrainUnpredictableBool() then 
_FFR = ZeroExtend(value); 
else 
_FFR<width-1:0> = value; 


aarch64/functions/sve/FPCompareNE 


// FPCompareNE() 
// ============= 


boolean FPCompareNE(bits(N) op1, bits(N) op2, FPCRType fpcr) 

assert N IN {16,32,64}; 

(typel,sign1,valuel) = FPUnpack(op1, fpcr); 

(type2,sign2,value2) = FPUnpack(op2, fpcr); 

if typel==FPType_SNaN || typel==FPType_QNaN || type2==FPType_SNaN || type2==FPType_QNaN then 
result = TRUE; 
if typel==FPType_SNaN || type2==FPType_SNaN then 

FPProcessException(FPExc_InvalidOp, fpcr); 

else // All non-NaN cases can be evaluated on the values produced by FPUnpack() 
result = (valuel != value2); 

return result; 


aarch64/functions/sve/FPCompareUN 


// FPCompareUN() 
// ============= 


boolean FPCompareUN(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
if typel==FPType_SNaN || type2==FPType_SNaN then 
FPProcessException(FPExc_InvalidOp, fpcr); 
return (typel==FPType_SNaN || typel==FPType_QNaN || type2==FPType_SNaN || type2==FPType_QNaN) 


aarch64/functions/sve/FPConvertSVE 


// FPConvertSVE() 
// ============== 


bits(M) FPConvertSVE(bits(N) op, FPCRType fpcr, FPRounding rounding) 
fpcr.AHP = 'Q'; 
return FPConvert(op, fpcr, rounding); 


// FPConvertSVE() 
// ============== 
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bits(M) FPConvertSVE(bits(N) op, FPCRType fpcr) 
fpcr.AHP = 'Q'; 
return FPConvert(op, fpcr, FPRoundingMode(fpcr)); 


aarch64/functions/sve/FPExpA 


// FPExpA() 
// ======== 


bits(N) FPExpA(bits(N) op) 
assert N IN {16,32,64}; 
bits(N) result; 
bits(N) coeff; 
integer idx = if N == 16 then UInt(op<4:0>) else UInt(op<5:0>); 
coeff = FPExpCoefficient[idx]; 
if N == 16 then 
result<15:0> = '0':0p<9:5>:coeff<9:0>; 
elsif N == 32 then 
result<31:0> = 'Q':o0p<13:6>:coeff<22:0>; 
else // N == 64 
result<63:0> = 'Q':op<16:6>:coeff<51:0>; 


return result; 


aarch64/functions/sve/FPExpCoefficient 


// FPExpCoefficient() 
// ================== 


bits(N) FPExpCoefficient[integer index] 
assert N IN {16,32,64}; 
integer result; 


result = 0x0356; 
result = 0x037f; 


when 
when 


if N == 16 then 
case index of 

when @ result = 0x0000; 
when 1 result = 0x0016; 
when 2 result = 0x002d; 
when 3 result = 0x0045; 
when 4 result = 0x005d; 
when 5 result = 0x0075; 
when 6 result = 0x008e; 
when 7 result = 0x00a8; 
when 8 result = 0x00c2; 
when 9 result = 0x0Qdc; 
when 10 result = 0x00f8; 
when 11 result = 0x0114; 
when 12 result = 0x0130; 
when 13 result = 0x014d; 
when 14 result = 0x016b; 
when 15 result = 0x0189; 
when 16 result = Qx01a8; 
when 17 result = QxQ1c8; 
when 18 result = Qx01e8; 
when 19 result = 0x0209; 
when 20 result = 0x022b; 
when 21 result = 0x024e; 
when 22 result = 0x0271; 
when 23 result = 0x0295; 
when 24 result = 0x02ba; 
when 25 result = Qx02e0; 
when 26 result = 0x0306; 
when 27 result = 0x032e; 

28 

29 


J1-7366 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


ARM DDI 0487E.a 
ID070919 


when 3@ result = 0x03a9; 
when 31 result = 0x03d4; 


elsif N == 32 then 
case index of 


when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
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when 
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result = 0x000000; 
result = 0x0164d2; 
result = 0x02cd87; 
result = 0x043a29; 
result = Qx@5aac3; 
result = 0x071f62; 
result = 0x08980f; 
result = Q@x@a14d5; 
result = 0x0b95c2; 
result = OxQdladf; 
result = 0x0ea43a; 
result = Qx1031dc; 
result = Qx11c3d3; 
result = Qx135a2b; 
result = 0x14f4f0; 
result = 0x16942d; 
result = 0x1837f0; 
result = 0x19e046; 
result = 0x1b8d3a; 
result = Qx1d3eda; 
result = Oxlef532; 
result = 0x20b051; 
result = Qx227043; 
result = 0x243516; 
result = Q@x25fed7; 
result = 0x27cd94; 
result = 0x29a15b; 
result = Qx2b7a3a; 
result = Qx2d583f; 
result = 0x2f3b79; 
result = 0x3123f6; 
result = Qx3311c4; 
result = 0x3504f3; 
result = 0x36fd92; 
result = 0x38fbaf; 
result = Qx3aff5b; 
result = 0x3d08a4; 
result = Qx3f179a; 
result = Qx412c4d; 
result = 0x4346cd; 
result = 0x45672a; 
result = Q@x478d75; 
result = Q@x49b9be; 
result = 0x4bec15; 
result = Qx4e248c; 
result = 0x506334; 
result = Qx52a81e; 
result = 0x54f35b; 
result = 0x5744fd; 
result = Q@x599d16; 
result = Ox5bfbb8; 
result = 0x5e60f5; 
result = Q@x6@ccdf; 
result = 0x633f89; 
result = Q@x65b907; 
result = 0x68396a; 
result = Q@x6acOc7; 
result = Qx6d4f30; 
result = Ox6fe4ba; 
result = Qx728177; 
result = 0x75257d; 
result = Qx77dQdf; 
result = 0x7a83b3; 
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when 63 result = 0x7d3e0c; 
else // N == 64 
case index of 

when @ result = 0x0000000000000; 
when 1 result = 0x@2C9A3E778061; 
when 2 result = 0x059B0D3158574; 
when 3 result = 0x0874518759BC8; 
when 4 result = 0x0B5586CF9890F; 
when 5 result = Q@x@E3EC32D3D1A2; 
when 6 result = 0x11301D0125B51; 
when 7 result = 0x1429AAEA92DE0; 
when 8 result = 0x172B83C7D517B; 
when 9 result = @x1A35BEB6FCB75; 
when 10 result = 0x1D4873168B9AA; 
when 11 result = 0x2063B88628CD6; 
when 12 result = 0x2387A6E756238; 
when 13 result = 0x26B4565E27CDD; 
when 14 result = @x29E9DF51FDEE1; 
when 15 result = 0x2D285A6E4030B; 
when 16 result = @x3Q6FEQA31B715; 
when 17 result = 0x33CQ8B26416FF; 
when 18 result = 0x371A7373AA9CB; 
when 19 result = @x3A7DB34E59FF7; 
when 20 result = Qx3DEA64C123422; 
when 21 result = 0x4160A21F72E2A; 
when 22 result = 0x44EQ86061892D; 


when 23 
when 24 
when 25 
when 26 
when 27 
when 28 
when 29 
when 30 
when 31 
when 32 
when 33 
when 34 
when 35 
when 36 
when 37 
when 38 
when 39 
when 40 
when 41 
when 42 
when 43 
when 44 
when 45 
when 46 
when 47 
when 48 
when 49 
when 50 
when 51 
when 52 
when 53 
when 54 
when 55 
when 56 
when 57 
when 58 
when 59 
when 60 
when 61 
when 62 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


result = 0x486A2B5C13CDOQ; 
result = Qx4BFDAD5362A27; 
result = 0x4F9B2769D2CA7; 
result = 0x5342B569D4F82; 
result = 0x56F4736B527DA; 
result = Q@x5ABQ7DD485429; 
result = Q0x5E76F15AD2148; 
result = 0x6247EBQ3A5585; 
result = 0x6623882552225; 
result = Qx6AQ9E667F3BCD; 
result = Qx6DFB23C651A2F; 
result = Q0x71F75E8EC5F74; 
result = Qx75FEB564267(9; 
result = 0x7A11473EBQ187; 
result = Qx7E2F336CF4E62; 
result = Q@x82589994CCE13; 
result = Qx868D99B4492ED; 
result = Q@x8ACE5422AAQDB; 
result = Qx8F1AE99157736; 
result = 0x93737BOCDC5E5; 
result = 0x97D829FDE4E50; 
result = 0x9C49182A3F090; 
result = QxAQC667B5DE565; 
result = Q@xA5503B23E255D; 
result = QxA9E6B5579FDBF; 
result = Q@xAE89F995AD3AD; 
result = Q0xB33A2B84F15FB; 
result = QxB7F76F2FB5E47; 
result = Q@xBCC1E904BC1D2; 
result = QxC199BDD85529C; 
result = QxC67F12E57D14B; 
result = QxCB72QDCEF9069; 
result = @xD072D4A07897C; 
result = @xD5818DCFBA487; 
result = QxDA9E603DB3285; 
result = Q0xDFC97337B9B5F; 
result = QOxE5Q2EE78B3FF6; 
result = OxEA4AFA2A49@DA; 
result = QxEFA1BEE615A27; 
result = QxF50765B6E4540; 
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when 63 result = @xFA7C1819E90D8; 


return result<N-1:0>; 


aarch64/functions/sve/F PMinNormal 


// FPMinNormal () 
// ============= 


bits(N) FPMinNormal(bit sign) 
assert N IN {16,32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
constant integer F =N - (E + 1); 
exp = Zeros(E-1):'1'; 
frac = Zeros(F); 
return sign : exp : frac; 


aarch64/functions/sve/FPOne 


// FPOne() 
// ======= 


bits(N) FPOne(bit sign) 
assert N IN {16,32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
constant integer F =N - (E + 1); 
exp = '0':0nes(E-1) 
frac = Zeros(F); 
return sign : exp : frac; 


aarch64/functions/sve/FPPointFive 


// FPPointFive() 
// ============= 


bits(N) FPPointFive(bit sign) 
assert N IN {16,32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
constant integer F =N - (E + 1); 
exp = 'Q':Ones(E-2):'Q'; 
frac = Zeros(F); 
return sign : exp : frac; 


aarch64/functions/sve/FPProcess 


// FPProcess() 
// =========== 


bits(N) FPProcess(bits(N) input) 
bits(N) result; 
assert N IN {16,32,64}; 
(fptype,sign,value) = FPUnpack(input, FPCR); 
if fptype == FPType_SNaN || fptype == FPType_QNaN then 
result = FPProcessNaN(fptype, input, FPCR); 
elsif fptype == FPType_Infinity then 
result = FPInfinity(sign); 
elsif fptype == FPType_Zero then 
result = FPZero(sign); 
else 
result = FPRound(value, FPCR); 
return result; 
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aarch64/functions/sve/FPScale 


// FPScale() 
|/ ========= 


bits(N) FPScale(bits (N) op, integer scale, FPCRType fpcr) 


assert N IN {16,32,64}; 
(fptype,sign,value) = FPUnpack(op, fpcr); 


if fptype == FPType_SNaN || fptype == FPType_QNaN then 


result = FPProcessNaN(fptype, op, fpcr); 
elsif fptype == FPType_Zero then 

result = FPZero(sign); 
elsif fptype == FPType_Infinity then 

result = FPInfinity(sign); 
else 

result = FPRound(value » (2.@Ascale), fpcr); 
return result; 


aarch64/functions/sve/FPTrigMAdd 


// FPTrigMAdd() 
// ============ 


bits(N) FPTrigMAdd(integer x, bits(N) op1, bits(N) op2, FPCRType fpcr) 


assert N IN {16,32,64}; 
assert x >= Q; 
assert x < 8; 
bits(N) coeff; 


if op2<N-1> == '1' then 
xX=X+8; 


op2<N-1> = '0'; 


coeff = FPTrigMAddCoefficient[x]; 
result = FPMulAdd(coeff, op1, op2, fpcr); 


return result; 


aarch64/functions/sve/FP TrigMAddCoefficient 


// FPTrigMAddCoefficient() 
// ======================= 


bits(N) FPTrigMAddCoefficient[integer index] 
assert N IN {16,32,64}; 
integer result; 


if N == 16 then 
case index of 
when @ result = 0x3c00; 
when 1 result = @xb155; 
when 2 result = 0x2030; 
when 3 result = 0x0000; 
when 4 result = 0x0000; 
when 5 result = 0x0000; 
when 6 result = 0x0000; 
when 7 result = 0x0000; 
when 8 result = 0x3cQ0; 
when 9 result = 0xb800; 
when 10 result = 0x293a; 
when 11 result = 0x0000; 
when 12 result = 0x0000; 
when 13 result = 0x0000; 
when 14 result = 0x0000; 


when 15 result = 0x0000; 
elsif N == 32 then 
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else 


case index of 
result = 0x3f800000; 
result = Q@xbe2aaaab; 


when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 


// N = 


OMONDUNAPWNE DS 


result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 


case index of 


when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 


PR 
rFPSeWONnNaunPwWNEH OS 


PRP 
AWUN 


result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 
result 


return result<N-1:0>; 


0x3c088886; 
0xb95008b9; 
0x36369d6d; 
0x00000000; 
0x00000000; 
0x00000000; 
0x3F800000; 
Oxbf000000; 
Qx3d2aaaa6; 
Q@xbab60705; 
Qx37cd37cc; 
0x00000000; 
0x00000000; 
0x00000000; 


Ox3FF0000000000000; 
Oxbfc5555555555543; 
0x3f8111111110F30c; 
Oxbf2a01a019b92Fc6; 
Qx3ec71de351F3d22b; 
Oxbe5ae5e2b60F7b91; 
Ox3de5d8408868552f; 
0x0000000000000000; 
Ox3FF0000000000000; 
OxbfeG000000000000; 
0x3fa5555555555536; 
Oxbf56c16c16c13a0b; 
Qx3efa01a019b1e8d8 ; 
Oxbe927e4F7282F468; 
@x3e21ee96d2641b13; 
Oxbda8F76380fbb401; 


aarch64/functions/sve/FPTrigSMul 


// FPTri 
i= 


bits(N) FPTrigSMul(bits(N) opl, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 


gSMul () 


result = FPMul(op1, op1, fpcr); 


(fptype, sign, value) = FPUnpack(result, fpcr); 
if (fptype != FPType_QNaN) && (fptype != FPType_SNaN) then 
result<N-1> = op2<Q>; 


return result; 


aarch64/functions/sve/FPTrigSSel 


// FPTri 
[| === 


gSSe1() 


bits(N) FPTrigSSel(bits(N) op1, bits(N) op2) 


assert N IN {16,32,64}; 


bits(N) result; 


if op2<@> == '1' then 
result = FPOne(op2<1>); 


else 


result = opl; 


Armv8 Pseudocode 
J1.1 Pseudocode for AArch64 operations 
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result<N-1> = result<N-1> EOR op2<1>; 


return result; 


aarch64/functions/sve/FirstActive 


// FirstActive() 
// ============= 


bit FirstActive(bits(N) mask, bits(N) x, integer esize) 
integer elements = N DIV (esize DIV 8); 
for e = 0 to elements-1 
if ElemP[mask, e, esize] == '1' then return ElemP[x, e, esize]; 
return '0'; 


aarch64/functions/sve/FloorPow2 


// FloorPow2() 


// For a positive integer X, return the largest power of 2 <= X 


integer FloorPow2(integer x) 
assert x >= Q; 
integer n = 1; 
if x == 0 then return Q; 
while x >= 2An do 
n=n+1; 
return 2A(n - 1); 


aarch64/functions/sve/HaveSVE 


// HaveSVE() 
(== 


boolean HaveSVE() 


return HasArchVersion(ARMv8p2) && boolean IMPLEMENTATION_DEFINED "Have SVE ISA"; 


aarch64/functions/sve/ImplementedSVEVectorLength 
// ImplementedSVEVectorLength() 
// Reduce SVE vector length to a supported value (e.g. power of two) 
integer ImplementedSVEVectorLength(integer nbits) 
return integer IMPLEMENTATION_DEFINED; 
aarch64/functions/sve/lsEven 


// IsEven() 
(i= 


boolean IsEven(integer val) 
return val MOD 2 == Q; 
aarch64/functions/sve/IsFPEnabled 


// IsFPEnabled() 
// ============= 


boolean IsFPEnabled(bits(2) el) 
if ELUsingAArch32(el) then 
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return AArch32.IsFPEnabled(el); 
else 
return AArch64.IsFPEnabled(el); 


aarch64/functions/sve/IsSVEEnabled 


// IsSVEEnabled() 
// ============== 


boolean IsSVEEnabled(bits(2) el) 
if ELUsingAArch32(el) then 
return FALSE; 


// Check if access disabled in CPACR_EL1 
if el IN {EL@, EL1} then 
// Check SVE at ELQ/EL1 
case CPACR[].ZEN of 
when 'x@' disabled = TRUE; 
when '@1' disabled = (el == ELQ); 
when '11' disabled = FALSE; 
if disabled then return FALSE; 





// Check if access disabled in CPTR_EL2 
if el IN {EL@, EL1, EL2} && EL2Enabled() then 
if HaveVirtHostExt() && HCR_EL2.E2H == '1' then 
if CPTR_EL2.ZEN == 'x@' then return FALSE; 
else 
if CPTR_EL2.TZ == '1' then return FALSE; 


// Check if access disabled in CPTR_EL3 
if HaveEL(EL3) then 
if CPTR_EL3.EZ == '@' then return FALSE; 


return TRUE; 


aarch64/functions/sve/LastActive 


// LastActive() 
// ============ 


bit LastActive(bits(N) mask, bits(N) x, integer esize) 
integer elements = N DIV (esize DIV 8); 
for e = elements-1 downto 0 
if ElemP[mask, e, esize] == '1' then return ElemP[x, e, esize]; 
return '0'; 


aarch64/functions/sve/LastActiveElement 


// LastActiveElement() 
// =================== 


integer LastActiveElement(bits(N) mask, integer esize) 
assert esize IN {8, 16, 32, 64}; 
integer elements = VL DIV esize; 
for e = elements-1 downto 0 
if ElemP[mask, e, esize] == '1' then return e; 
return -1; 


aarch64/functions/sve/MAX_PL 


constant integer MAX_PL = 256; 
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aarch64/functions/sve/MAX_VL 


constant integer MAX_VL = 2048; 


aarch64/functions/sve/MaybeZeroSVEUppers 


// MaybeZeroSVEUppers() 
// ==================== 


MaybeZeroSVEUppers(bits(2) target_el) 
boolean lower_enabled; 


if UInt(target_el) <= UInt(PSTATE.EL) || !IsSVEEnabled(target_el) then 
return; 


if target_el == EL3 then 
if EL2Enabled() then 
lower_enabled = IsFPEnabled(EL2); 
else 
lower_enabled = IsFPEnabled(EL1); 
else 
lower_enabled = IsFPEnabled(target_el - 1); 


if lower_enabled then 
integer vl = if IsSVEEnabled(PSTATE.EL) then VL else 128; 
integer pl = vl DIV 8; 
for n = @ to 31 
if ConstrainUnpredictableBool() then 
_Z[n] = ZeroExtend(_Z[n]<vl-1:0>); 
for n = @ to 15 
if ConstrainUnpredictableBool() then 
_P[n] = ZeroExtend(_P[n]<pl-1:0>); 
if ConstrainUnpredictableBool() then 
_FFR = ZeroExtend(_FFR<p1-1:0>); 


aarch64/functions/sve/MemNF 


// MemNF[] - non-assignment form 


[/ ============================= 


(bits(8*size), boolean) MemNF[bits(64) address, integer size, AccType acctype] 
assert size IN {1, 2, 4, 8, 16}; 
bits(8ssize) value; 


aligned = (address == Align(address, size)); 
A = SCTLR[].A; 


if !aligned && (A == '1') then 
return (bits(8size) UNKNOWN, TRUE); 


atomic = aligned || size == 1; 


if !atomic then 
(value<7:0>, bad) = MemSingleNF[address, 1, acctype, aligned]; 


if bad then 
return (bits(8size) UNKNOWN, TRUE); 


// For subsequent bytes it is CONSTRAINED UNPREDICTABLE whether an unaligned Device memory 
// access will generate an Alignment Fault, as to get this far means the first byte did 
// not, so we must be changing to a new translation page. 
if !aligned then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_FAULT, Constraint_NONE}; 
if c == Constraint_NONE then aligned = TRUE; 


J1-7374 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


Armv8 Pseudocode 
J1.1 Pseudocode for AArch64 operations 


for i = 1 to size-1 
(value<8+i+7:8xi>, bad) = MemSingleNF[address+i, 1, acctype, aligned]; 


if bad then 
return (bits(8size) UNKNOWN, TRUE); 
else 
(value, bad) = MemSingleNF[address, size, acctype, aligned]; 
if bad then 


return (bits(8size) UNKNOWN, TRUE); 


if BigEndian() then 
value = BigEndianReverse(value) ; 


return (value, FALSE); 


aarch64/functions/sve/MemSingleNF 


// MemSingleNF[] - non-assignment form 


[/ ============================= = 


(bits(8*size), boolean) MemSingleNF[bits(64) address, integer size, AccType acctype, boolean wasaligned] 
bits(8»size) value; 
boolean iswrite = FALSE; 
AddressDescriptor memaddrdesc; 


// Implementation may suppress NF load for any reason 
if ConstrainUnpredictableBool() then 
return (bits(8size) UNKNOWN, TRUE); 


// MMU or MPU 
memaddrdesc = AArch64.TranslateAddress(address, acctype, iswrite, wasaligned, size); 


// Non-fault load from Device memory must not be performed externally 
if memaddrdesc.memattrs.memtype == MemType_Device then 
return (bits(8size) UNKNOWN, TRUE); 


// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
return (bits(8size) UNKNOWN, TRUE); 


// Memory array access 

accdesc = CreateAccessDescriptor(acctype) ; 

if HaveMTEExt() then 

if AArch64.AccessIsTagChecked(address, acctype) then 
bits(4) ptag = AArch64.PhysicalTag(address) ; 
if !AArch64.CheckTag(memaddrdesc, ptag, iswrite) then 
return (bits(8size) UNKNOWN, TRUE); 
value = _Mem[memaddrdesc, size, accdesc]; 


return (value, FALSE); 


aarch64/functions/sve/NoneActive 


// NoneActive() 
| === 


bit NoneActive(bits(N) mask, bits(N) x, integer esize) 
integer elements = N DIV (esize DIV 8); 
for e = 0 to elements-1 


if ElemP[mask, e, esize] == '1' && ElemP[x, e, esize] == '1' then return 'Q'; 
return '1'; 
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aarch64/functions/sve/P 


P[] - non-assignment form 


bits(width) P[integer n] 


assert n >= 0 && n <= 31; 
assert width == PL; 
return _P[n]<width-1:0>; 


P[] - assignment form 


P[integer n] = bits(width) value 


assert n >= 0 && n <= 31; 

assert width == PL; 

if ConstrainUnpredictableBool() then 
_P[n] = ZeroExtend(value) ; 

else 
_P[n]<width-1:0> = value; 


aarch64/functions/sve/PL 


// PL - non-assignment form 
A ec 
integer PL 


return VL DIV 8; 


aarch64/functions/sve/PredTest 


// 
// 


PredTest() 


bits(4) PredTest(bits(N) mask, bits(N) result, integer esize) 


bit n = FirstActive(mask, result, esize); 
bit z = NoneActive(mask, result, esize); 

bit c = NOT LastActive(mask, result, esize); 
bit v = '0'; 

return niz:c:v; 


aarch64/functions/sve/ReducePredicated 


// 
// 


ReducePredicated() 


bits(esize) ReducePredicated(ReduceOp op, bits(N) input, bits(M) mask, bits(esize) identity) 


assert(N == M » 8); 

integer p2bits = CeilPow2(N); 
bits(p2bits) operand; 

integer elements = p2bits DIV esize; 


for e = Q to elements-1 
if e « esize < N && ElemP[mask, e, esize] == '1' then 
Elem[operand, e, esize] = Elem[input, e, esize]; 
else 
Elem[operand, e, esize] = identity; 


return Reduce(op, operand, esize); 


aarch64/functions/sve/Reverse 


// Reverse() 


// Reverse subwords of M bits in an N-bit word 
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bits(N) Reverse(bits(N) word, integer M) 
bits(N) result; 
integer sw = N DIV M; 
assert N == sw + M; 
for s = 0 to sw-1 
Elem[result, sw - 1 - s, M] = Elem[word, s, M]; 
return result; 


aarch64/functions/sve/SVEAccessTrap 
// SVEAccessTrap() 
// Trapped access to SVE registers due to CPACR_EL1, CPTR_EL2, or CPTR_EL3. 


SVEAccessTrap(bits(2) target_el) 
assert UInt(target_el) >= UInt(PSTATE.EL) && target_el != EL@ && HaveEL(target_el); 
route_to_el2 = target_el == EL1 && EL2Enabled() && HCR_EL2.TGE == '1'; 


exception = ExceptionSyndrome(Exception_SVEAccessTrap) ; 
bits(64) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0; 


if route_to_el2 then 
AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset) ; 
else 
AArch64.TakeException(target_el, exception, preferred_exception_return, vect_offset) ; 


aarch64/functions/sve/SVECmp 


enumeration SVECmp { Cmp_EQ, Cmp_NE, Cmp_GE, Cmp_GT, Cmp_LT, Cmp_LE, Cmp_UN }; 


aarch64/functions/sve/SVEMoveMaskPreferred 
// SVEMoveMaskPreferred() 


// Return FALSE if a bitmask immediate encoding would generate an immediate 
// value that could also be represented by a single DUP instruction. 
// Used as a condition for the preferred MOV<-DUPM alias. 


boolean SVEMoveMaskPreferred(bits(13) imm13) 
bits(64) imm; 
(imm, -) = DecodeBitMasks(imm13<12>, imm13<5:@>, imm13<11:6>, TRUE); 


// Check for 8 bit immediates 
if !IsZero(imm<7:0>) then 
// Check for 'ffffffffffffffxy' or '00000000000000xy' 
if IsZero(imm<63:7>) || IsOnes(imm<63:7>) then 
return FALSE; 


// Check for 'ffffffxyffffffxy' or '000000xy000000xy' 
if imm<63:32> == imm<31:0> && (IsZero(imm<31:7>) || IsOnes(imm<31:7>)) then 
return FALSE; 


// Check for 'ffxyffxyffxyffxy' or '00xy00xy00xy00xy ' 
if imm<63:32> == imm<31:0> && imm<31:16> == imm<15:0> && (IsZero(imm<15:7>) || 
IsOnes(imm<15:7>)) then 
return FALSE; 


// Check for 'xyxyxyxyxyxyxyxy' 
if imm<63:32> == imm<31:0> && imm<31:16> == imm<15:Q> && (imm<15:8> == imm<7:@>) then 
return FALSE; 


// Check for 16 bit immediates 
else 
// Check for 'ffffffffffffxy00' or '000000000000xy00' 
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if IsZero(imm<63:15>) || IsOnes(imm<63:15>) then 
return FALSE; 


// Check for 'ffffxy00ffffxy00' or '0000xy000000xy00' 
if imm<63:32> == imm<31:0> && (IsZero(imm<31:7>) || IsOnes(imm<31:7>)) then 
return FALSE; 


// Check for 'xy00xy00xydxyee' 
if imm<63:32> == imm<31:0> && imm<31:16> == imm<15:Q> then 
return FALSE; 


return TRUE; 


aarch64/functions/sve/System 


array bits(MAX_VL) _Z[Q..31]; 
array bits(MAX_PL) _P[Q..15]; 
bits(MAX_PL) _FFR; 


aarch64/functions/sve/VL 


// NL - non-assignment form 


integer VL 
integer vl; 


if PSTATE.EL == EL1 || (PSTATE.EL == ELO && !IsInHost()) then 
vl = UInt(ZCR_EL1.LEN) ; 


if PSTATE.EL == EL2 || (PSTATE.EL == EL@ && IsInHost()) then 
vl = UInt(ZCR_EL2.LEN); 

elsif PSTATE.EL IN {EL@, EL1} && EL2Enabled() then 
vl = Min(vl, UInt(ZCR_EL2.LEN)); 


if PSTATE.EL == EL3 then 
vl = UInt(ZCR_EL3.LEN); 
elsif HaveEL(EL3) then 
vl = Min(vl, UInt(ZCR_EL3.LEN)); 


vl = (vl + 1) » 128; 
vl = ImplementedSVEVectorLength(v1); 
return vl; 


aarch64/functions/sve/Z 


// Z[] - non-assignment form 


bits(width) Z[integer n] 
assert n >= 0 && n <= 31; 
assert width == VL; 
return _Z[n]<width-1:0>; 


// Z[] - assignment form 


Z[integer n] = bits(width) value 
assert n >= 0 && n <= 31; 
assert width == VL; 
if ConstrainUnpredictableBool() then 
_Z[n] = ZeroExtend(value); 
else 
_Z[n]<width-1:0> = value; 
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aarch64/functions/sysregisters/CNTKCTL 


// CNTKCTL[] - non-assignment form 


// 


CNTKCTLType CNTKCTL[] 


bits(32) r; 
if IsInHost() 


then 


r = CNTHCTL_EL2; 


return r; 


r = CNTKCTL_EL1; 


return r; 


aarch64/functions/sysregisters/CNTKCTLType 


type CNTKCTLType; 


aarch64/functions/sysregisters/CPACR 


// CPACR[] - non-assignment form 


// 


CPACRType CPACR[] 
bits(32) r; 
if IsInHost() 


then 


r = CPTR_EL2; 


return r; 


r = CPACR_EL1; 


return r; 


aarch64/functions/sysregisters/CPACRType 


type CPACRType; 


aarch64/functions/sysregisters/ELR 


// ELR[] - non-assignment form 


// 


bits(64) ELR[bits(2) el] 


bits(64) r; 

case el of 
when EL1 
when EL2 
when EL3 
otherwise 

return r; 


r = ELR_EL1; 
r = ELR_EL2; 
r = ELR_EL3; 


Unreachable(); 


// ELR[] - non-assignment form 


// 


bits(64) ELR[] 


assert PSTATE. 


EL != ELQ; 


return ELR[PSTATE.EL]; 


// ELR[] - assignment form 


// 


ELR[bits(2) el] = 


bits(64) value 


bits(64) r = value; 


case el of 
when EL1 
when EL2 
when EL3 
otherwise 
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return; 


// ELR[] - assignment form 
|[ ======================= 


ELR[] = bits(64) value 
assert PSTATE.EL != ELQ; 
ELR[PSTATE.EL] = value; 
return; 


aarch64/functions/sysregisters/ESR 


// ESR[] - non-assignment form 


oo 
ESRType ESR[bits(2) regime] 
bits(32) r; 
case regime of 
when EL1 r = ESR_EL1; 


when EL2 r = ESR_EL2; 

when EL3 r = ESR_EL3; 

otherwise Unreachable(); 
return r; 


// ESR[] - non-assignment form 


/ 





ESRType ESR[] 
return ESR[S1TranslationRegime()]; 


// ESR[] - assignment form 
/ 





ESR[bits(2) regime] = ESRType value 
bits(32) r = value; 
case regime of 

when EL1 ESR_EL1 = 

when EL2 ESR_EL2 

when EL3 ESR_EL3 = r; 

otherwise Unreachable(); 
return; 


oot 
“Z 


// ESR[] - assignment form 
// ======================= 


ESR[] = ESRType value 
ESR[S1TranslationRegime()] = value; 


aarch64/functions/sysregisters/ESRType 


type ESRType; 


aarch64/functions/sysregisters/FAR 


// FAR[] - non-assignment form 


[I ae 
bits(64) FAR[bits(2) regime] 
bits(64) r; 
case regime of 
when EL1 r = FAR_EL1; 


when EL2 r = FAR_EL2; 

when EL3 r = FAR_EL3; 

otherwise Unreachable(); 
return r; 
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// FAR[] - non-assignment form 


[[ =========================== 


bits(64) FAR[] 
return FAR[S1TranslationRegime()]; 


// FAR[] - assignment form 
/{ ======================= 


FAR[bits(2) regime] = bits(64) value 
bits(64) r = value; 
case regime of 

when EL1 FAR_EL1 = 

when EL2 FAR_EL2 

when EL3 FAR_EL3 = r; 

otherwise Unreachable(); 
return; 


ot 
3.3 


// FAR[] - assignment form 
/ 


FAR[] = bits(64) value 
FAR[S1TranslationRegime()] = value; 
return; 





aarch64/functions/sysregisters/MAIR 


// MAIR[] - non-assignment form 





MAIRType MAIR[bits(2) regime] 

bits(64) r; 

case regime of 
when EL1 r = MAIR_EL1; 
when EL2 r = MAIR_EL2; 
when EL3 r = MAIR_EL3; 
otherwise Unreachable(); 

return r; 


// MAIR[] - non-assignment form 
——————— es 


MAIRType MAIR[] 
return MAIR[S1TranslationRegime()]; 


aarch64/functions/sysregisters/MAIRType 


type MAIRType; 


aarch64/functions/sysregisters/SCTLR 


// SCTLR[] - non-assignment form 


[ae 
SCTLRType SCTLR[bits(2) regime] 
bits(64) r; 
case regime of 
when EL1 r = SCTLR_EL1; 


when EL2 r = SCTLR_EL2; 

when EL3 r = SCTLR_EL3; 

otherwise Unreachable(); 
return r; 


// SCTLR[] - non-assignment form 
// =======================5= 
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SCTLRType SCTLR[] 
return SCTLR[S1TranslationRegime()]; 


aarch64/functions/sysregisters/SCTLRType 


type SCTLRType; 


aarch64/functions/sysregisters/VBAR 


// \BAR[] - non-assignment form 
[ee 


bits(64) VBAR[bits(2) regime] 

bits(64) r; 

case regime of 
when EL1 r = VBAR_EL1; 
when EL2 r = VBAR_EL2; 
when EL3 r = VBAR_EL3; 
otherwise Unreachable(); 

return r; 


// \BAR[] - non-assignment form 
// a 


bits(64) VBAR[] 
return VBAR[S1TranslationRegime()]; 


aarch64/functions/system/AArch64.AllocationTagAccesslsEnabled 
// AArch64.AllocationTagAccessIsEnabled() 
// Check whether access to Allocation Tags is enabled. 


boolean AArch64.AllocationTagAccessIsEnabled() 

if SCR_EL3.ATA == 'Q' && PSTATE.EL IN {EL@, EL1, EL2} then 
return FALSE; 

elsif HCR_EL2.ATA == 'Q' && PSTATE.EL IN {EL@, EL1} && EL2Enabled() && HCR_EL2.<E2H,TGE> != '11' 

then 

return FALSE; 

elsif SCTLR_EL3.ATA == 'Q' && PSTATE.EL == EL3 then 
return FALSE; 

elsif SCTLR_EL2.ATA == 'Q' && PSTATE.EL == EL2 then 
return FALSE; 

elsif SCTLR_EL1.ATA == 'Q' && PSTATE.EL == EL1 then 
return FALSE; 

elsif SCTLR_EL2.ATAQ == '@' && PSTATE.EL == ELO && EL2Enabled() && HCR_EL2.<E2H,TGE> == '11' then 
return FALSE; 

elsif SCTLR_EL1.ATAQ == '@' && PSTATE.EL == ELO && !(EL2Enabled() && HCR_EL2.<E2H,TGE> == '11') then 
return FALSE; 








else 





return TRUE; 


aarch64/functions/system/AArch64.CheckSystemAccess 
// AArch64.CheckSystemAccess() 


// Checks if an AArch64 MSR, MRS or SYS instruction is allowed from the current exception level and 
security state. 
// Also checks for traps by TIDCP and NV access. 


AArch64.CheckSystemAccess(bits(2) op@, bits(3) opl, bits(4) crn, bits(4) crm, bits(3) op2, bits(5) rt, 
bit read) 

boolean unallocated = FALSE; 

boolean need_secure = FALSE; 
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bits(2) min_EL; 


// Check for traps by HCR_EL2.TIDCP 
if PSTATE.EL IN {EL@, EL1} && EL2Enabled() && HCR_EL2.TIDCP == '1' && op® == 'x1' && crn == '1x11' 
then 
// At ELO, it is IMPLEMENTATION_DEFINED whether attempts to execute system 
// register access instructions with reserved encodings are trapped to EL2 or UNDEFINED 
rcs_el@_trap = boolean IMPLEMENTATION_DEFINED "Reserved Control Space ELQ Trapped"; 
if PSTATE.EL == EL1 || rcs_el@_trap then 
AArch64.SystemAccessTrap(EL2, 0x18); // Exception_SystemRegisterTrap 


// Check for unallocated encodings 





case op1 of 

when 'QQx', 'Q10' 

min_EL = EL1; 
when '011' 

min_EL = ELQ; 
when '100' 

min_EL = EL2; 
when '101' 

if !HaveVirtHostExt() then UNDEFINED; 

min_EL = EL2; 
when '110' 

min_EL = EL3; 
when '111' 

min_EL = EL1; 


need_secure = TRUE; 


if UInt(PSTATE.EL) < UInt(min_EL) then 


// Check for traps on read/write access to registers named _EL2, _FL@2, _FL12 from non-secure 
EL1 when HCR_EL2.NV bit is set 

nv_access = HaveNVExt() && min_EL == EL2 && PSTATE.EL == EL1 && EL2Enabled() && HCR_EL2.NV == 
4! ; 

if !nv_access then 

UNDEFINED; 
elsif need_secure && !IsSecure() then 
UNDEFINED; 


aarch64/functions/system/AArch64.ChooseNonExcludedTag 


// AArch64.ChooseNonExcludedTag() 


// Return a tag derived from the start and the offset values, excluding 
// any tags in the given mask. 


bits(4) AArch64.ChooseNonExcludedTag(bits(4) tag, bits(4) offset, bits(16) exclude) 
if IsOnes(exclude) then 
return 'Q000'; 


if offset == 'Q000' then 
while exclude<UInt(tag)> == '1' do 
tag = tag + '0001'; 
while offset != '0000' do 
offset = offset - '0001'; 
tag = tag + '0001'; 
while exclude<UInt(tag)> == '1' do 
tag = tag + '0001'; 


return tag; 


aarch64/functions/system/AArch64.ExecutingATS1xPlinstr 


// AArch64.ExecutingATS1xPInstr() 


// Return TRUE if current instruction is AT S1E1R/WP 
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boolean AArch64.ExecutingATS1xPInstr() 
if !HavePrivATExt() then return FALSE; 


instr = ThisInstr(); 
if instr<22+:10> == '1101010100' then 
opl = instr<16+:3>; 
CRn = instr<12+:4>; 
CRm = instr<8+:4>; 
op2 = instr<5+:3>; 


return op1 == 'Q000' && CRn == 'Q111' && CRm == '1001' && op2 IN {'000','001'}; 


else 
return FALSE; 


aarch64/functions/system/AArch64.ExecutingBROrBLROrRetinstr 


// AArch64.ExecutingBROrBLROrRetInstr() 


// Returns TRUE if current instruction is a BR, BLR, RET, B[L]RA[B][Z], or RETA[B]. 


boolean AArch64.ExecutingBROrBLROrRetInstr() 
if !HaveBTIExt() then return FALSE; 


instr = ThisInstr(); 

if instr<31:25> == '1101011' && instr<20:16> == '11111' then 
opc = instr<24:21>; 
return opc != '0101'; 

else 
return FALSE; 


aarch64/functions/system/AArch64.ExecutingBTIInstr 
// AArch64.ExecutingBTIInstr() 
// =========================== 


// Returns TRUE if current instruction is a BTI. 


boolean AArch64.ExecutingBTIInstr() 
if !HaveBTIExt() then return FALSE; 


instr = ThisInstr(); 


if instr<31:22> == '1101010100' && instr<21:12> == '0000110010' && instr<4:@> == '11111' then 


CRm = instr<11:8>; 
op2 = instr<7:5>; 
return (CRm == '0100' && op2<@> == 'Q'); 
else 
return FALSE; 
aarch64/functions/system/AArch64.ExecutingERETInstr 
// AArch64.ExecutingERETInstr() 
// Returns TRUE if current instruction is ERET. 
boolean AArch64.ExecutingERETInstr() 
instr = ThisInstr(); 
return instr<31:12> == '11010110100111110000' ; 
aarch64/functions/system/AArch64.NextRandomTagBit 
// AArch64 .NextRandomTagBit() 


// Generate a random bit suitable for generating a random Allocation Tag. 


bit AArch64.NextRandomTagBit() 
bits(16) 1fsr = RGSR_EL1.SEED; 
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bit top = lfsr<5> EOR 1fsr<3> EOR 1fsr<2> EOR 1fsr<Q>; 
RGSR_EL1.SEED = top:lfsr<15:1>; 
return top; 


aarch64/functions/system/AArch64.RandomTag 
// AArch64.RandomTag() 
// Generate a random Allocation Tag. 


bits(4) AArch64.RandomTag() 
bits(4) tag; 
for i = 0 to 3 
tag<i> = AArch64.NextRandomTagBit(); 
return tag; 


aarch64/functions/system/AArch64.Sysinstr 


// Execute a system instruction with write (source operand). 
AArch64.SysInstr(integer op@, integer opl, integer crn, integer crm, integer op2, bits(64) val); 


aarch64/functions/system/AArch64.SysInstrWithResult 


// Execute a system instruction with read (result operand). 
// Returns the result of the instruction. 
bits(64) AArch64.SysInstrWithResult(integer op0, integer opl, integer crn, integer crm, integer op2); 


aarch64/functions/system/AArch64.SysRegRead 


// Read from a system register and return the contents of the register. 
bits(64) AArch64.SysRegRead(integer op0, integer opl, integer crn, integer crm, integer op2); 


aarch64/functions/system/AArch64.SysRegWrite 


// Write to a system register 
AArch64.SysRegwWrite(integer op0, integer op1, integer crn, integer crm, integer op2, bits(64) val); 


aarch64/functions/system/BTypeCompatible 


boolean BTypeCompatible; 


aarch64/functions/system/BTypeCompatible_BTI 
// BTypeCompatible_BTI 


// This function determines whether a given hint encoding is compatible with the current value of 
// PSTATE.BTYPE. A value of TRUE here indicates a valid Branch Target Identification instruction. 


boolean BTypeCompatible_BTI(bits(2) hintcode) 
case hintcode of 
when 'QQ' 
return FALSE; 
when 'Q1' 
return PSTATE.BTYPE != '11'; 
when '10' 
return PSTATE.BTYPE != '10'; 
when '11' 
return TRUE; 
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aarch64/functions/system/BTypeCompatible_PACIXSP 
// BTypeCompatible_PACIXSP() 


// Returns TRUE if PACIASP, PACIBSP instruction is implicit compatible with PSTATE.BTYPE, 
// FALSE otherwise. 


boolean BTypeCompatible_PACIXSP( ) 

if PSTATE.BTYPE IN {'Q1', '10'} then 
return TRUE; 

elsif PSTATE.BTYPE == '11' then 
index = if PSTATE.EL == ELO then 35 else 36; 
return SCTLR[]<index> == 'Q'; 

else 
return FALSE; 


aarch64/functions/system/BTypeNext 


bits(2) BTypeNext; 


aarch64/functions/system/InGuardedPage 


boolean InGuardedPage; 


J1.1.4 aarch64/instrs 


This section includes the following pseudocode functions: 

° aarch64/instrs/branch/eret/AArch64.ExceptionReturn on page J1-7387. 

è aarch64/instrs/countop/CountOp on page J1-7387. 

. aarch64/instrs/extendreg/DecodeRegExtend on page J1-7387. 

. aarch64/instrs/extendreg/ExtendReg on page J1-7388. 

- aarch64/instrs/extendreg/ExtendType on page J1-7388. 

$ aarch64/instrs/float/arithmetic/max-min/fpmaxminop/F PMaxMinOp on page J1-7388. 
. aarch64/instrs/float/arithmetic/unary/fpunaryop/F P UnaryOp on page J1-7388. 

s aarch64/instrs/float/convert/{pconvop/F PConvOp on page J1-7388. 

. aarch64/instrs/integer/bitfield/bfxpreferred/BFXPreferred on page J1-7388. 

- aarch64/instrs/integer/bitmasks/DecodeBitMasks on page J1-7389. 

. aarch64/instrs/integer/ins-ext/insert/movewide/movewideop/Move WideOp on page J1-7389. 
: aarch64/instrs/integer/logical/movwpreferred/MoveWidePreferred on page J1-7390. 

. aarch64/instrs/integer/shiftreg/DecodeShift on page J1-7390. 

g aarch64/instrs/integer/shiftreg/ShiftReg on page J1-7390. 

7 aarch64/instrs/integer/shiftreg/ShifiType on page J1-7390. 

. aarch64/instrs/logicalop/LogicalOp on page J1-7391. 

7 aarch64/instrs/memory/memop/MemAtomicOp on page J1-7391. 

. aarch64/instrs/memory/memop/MemOp on page J1-7391. 

s aarch64/instrs/memory/prefetch/Prefetch on page J1-7391. 

° aarch64/instrs/system/barriers/barrierop/MemBarrierOp on page J1-7391. 

è aarch64/instrs/system/hints/syshintop/SystemHintOp on page J1-7391. 

. aarch64/instrs/system/register/cpsr/pstatefield/PSTATEField on page J1-7392. 

a aarch64/instrs/system/sysops/sysop/Sys Op on page J1-7392. 

è aarch64/instrs/system/sysops/sysop/SystemOp on page J1-7393. 

. aarch64/instrs/vector/arithmetic/binary/uniform/logical/bsl-eor/vbitop/VBitOp on page J1-7393. 
à aarch64/instrs/vector/arithmetic/unary/cmp/compareop/CompareOp on page J1-7393. 
° aarch64/instrs/vector/logical/immediateop/ImmediateOp on page J1-7393. 

° aarch64/instrs/vector/reduce/reduceop/Reduce on page J1-7393. 
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. aarch64/instrs/vector/reduce/reduceop/ReduceOp on page J1-7394. 


aarch64/instrs/branch/eret/AArch64.ExceptionReturn 


// AArch64.ExceptionReturn() 


AArch64.ExceptionReturn(bits(64) new_pc, bits(32) spsr) 
SynchronizeContext(); 


sync_errors = HavelESB() && SCTLR[].IESB == '1'; 
if HaveDoubleFaultExt() then 
sync_errors = sync_errors || (SCR_EL3.EA == '1' && SCR_EL3.NMEA == '1' && PSTATE.EL == EL3); 
if sync_errors then 
SynchronizeErrors(); 
jesb_req = TRUE; 
TakeUnmaskedPhysicalSErrorInterrupts(iesb_req) ; 
// Attempts to change to an illegal state will invoke the Illegal Execution state mechanism 
SetPSTATEFromPSR(spsr) ; 
ClearExclusiveLocal(ProcessorID()); 
SendEventLocal(); 


if PSTATE.IL == '1' && spsr<4> == '1' && spsr<2Q> == 'Q' then 
// If the exception return is illegal, PC[63:32,1:0] are UNKNOWN 
new_pc<63:32> = bits(32) UNKNOWN; 
new_pc<1:0> = bits(2) UNKNOWN; 
elsif UsingAArch32() then // Return to AArch32 
// ELR_ELx[1:0] or ELR_ELx[@] are treated as being 0, depending on the target instruction set 


state 
if PSTATE.T == '1' then 
new_pc<@> = '0'; // T32 
else 
new_pc<1:0> = 'Q0'; // A32 
else // Return to AArch64 


// ELR_ELx[63:56] might include a tag 
new_pc = AArch64.BranchAddr(new_pc) ; 


if UsingAArch32() then 
// 32 most significant bits are ignored. 
BranchTo(new_pc<31:0>, BranchType_ERET) ; 
else 
BranchToAddr(new_pc, BranchType_ERET) ; 


aarch64/instrs/countop/CountOp 


enumeration CountOp {CountOp_CLZ, CountOp_CLS, CountOp_CNT}; 


aarch64/instrs/extendreg/DecodeRegExtend 
// DecodeRegExtend() 
// Decode a register extension option 


ExtendType DecodeRegExtend(bits(3) op) 
case op of 
when '000' return ExtendType_UXTB; 
when 'QQ@1' return ExtendType_UXTH; 
when 'Q10' return ExtendType_UXTW; 
when 'Q11' return ExtendType_UXTX; 
when '100' return ExtendType_SXTB; 
when '101' return ExtendType_SXTH; 
when '110' return ExtendType_SXTW; 
when '111' return ExtendType_SXTX; 
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aarch64/instrs/extendreg/ExtendReg 


// ExtendReg() 
// Perform a register extension and shift 


bits(N) ExtendReg(integer reg, ExtendType exttype, integer shift) 
assert shift >= 0 && shift <= 4; 
bits(N) val = X[reg]; 
boolean unsigned; 
integer len; 


case exttype of 
when ExtendType_SXTB unsigned = FALSE; len = 8; 
when ExtendType_SXTH unsigned = FALSE; len = 16; 
when ExtendType_SXTW unsigned = FALSE; len = 32; 
when ExtendType_SXTX unsigned = FALSE; len = 64; 
when ExtendType_UXTB unsigned = TRUE; len = 8; 
when ExtendType_UXTH unsigned = TRUE; len = 16; 
when ExtendType_UXTW unsigned = TRUE; len = 32; 
when ExtendType_UXTX unsigned = TRUE; len = 64; 





// Note the extended width of the intermediate value and 

// that sign extension occurs from bit <len+shift-1>, not 

// from bit <len-1>. This is equivalent to the instruction 

//  [SU]BFIZ Rtmp, Rreg, #shift, #len 

// It may also be seen as a sign/zero extend followed by a shift: 
//  LSL(Extend(val<len-1:0>, N, unsigned), shift); 


len = Min(len, N - shift) 
return Extend(val<len-1:0> : Zeros(shift), N, unsigned) ; 


aarch64/instrs/extendreg/ExtendType 


enumeration ExtendType {ExtendType_SXTB, ExtendType_SXTH, ExtendType_SXxTW, 


ExtendType_SXIX, 


ExtendType_UXTB, ExtendType_UXTH, ExtendType_UXTW, ExtendType_UXTX}; 


aarch64/instrs/float/arithmetic/max-min/fpmaxminop/FPMaxMinOp 


enumeration FPMaxMinOp {FPMaxMinOp_MAX, FPMaxMinOp_MIN, 
FPMaxMinOp_MAXNUM, FPMaxMinOp_MINNUM}; 
aarch64/instrs/float/arithmetic/unary/fpunaryop/FPUnaryOp 
enumeration FPUnaryOp {FPUnaryOp_ABS, FPUnaryOp_MOV, 
FPUnaryOp_NEG, FPUnaryOp_SQRT}; 
aarch64/instrs/float/convert/fpconvop/FPConvOp 
enumeration FPConvOp {FPConvOp_CVT_FtoI, FPConvOp_CVT_ItoF, 
FPConvOp_MOV_FtoI, FPConvOp_MOV_ItoF 
, FPConvOp_CVT_FtoI_JS 
J; 
aarch64/instrs/integer/bitfield/bfxpreferred/BFXPreferred 


// BFXPreferred() 


// Return TRUE if UBFX or SBFX is the preferred disassembly of a 
// UBFM or SBFM bitfield instruction. Must exclude more specific 
// aliases UBFIZ, SBFIZ, UXT[BH], SXT[BHW], LSL, LSR and ASR. 


boolean BFXPreferred(bit sf, bit uns, bits(6) imms, bits(6) immr) 
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integer S = UInt(imms); 
integer R = UInt(immr); 


// must not match UBFIZ/SBFIX alias 
if UInt(imms) < UInt(immr) then 
return FALSE; 


// must not match LSR/ASR/LSL alias (imms == 31 or 63) 
if imms == sf:'11111' then 
return FALSE; 


// must not match UXTx/SXTx alias 
if immr == 'Q00000' then 
// must not match 32-bit UXT[BH] or SXT[BH] 
if sf == 'Q' && imms IN {'Q00111', '001111'} then 
return FALSE; 
// must not match 64-bit SXT[BHW] 
if sf:uns == '10' && imms IN {'Q00111', '001111', 'Q11111'} then 
return FALSE; 


// must be UBFX/SBFX alias 
return TRUE; 


aarch64/instrs/integer/bitmasks/DecodeBitMasks 


// DecodeBitMasks() 


// Decode AArch64 bitfield and logical immediate masks which use a similar encoding structure 


(bits(M), bits(M)) DecodeBitMasks(bit immN, bits(6) imms, bits(6) immr, boolean immediate) 
bits(M) tmask, wmask; 
bits(6) levels; 


// Compute log2 of element size 

// 2Nlen must be in range [2, M] 

len = HighestSetBit(immN:NOT(imms) ); 
if len < 1 then UNDEFINED; 

assert M >= (1 << len); 


// Determine S, R and S - R parameters 
levels = ZeroExtend(Ones(len), 6); 


// For logical immediates an all-ones value of S is reserved 
// since it would generate a useless all-ones result (many times) 
if immediate && (imms AND levels) == levels then 

UNDEFINED; 


S = UInt(imms AND levels); 
R = UInt(immr AND levels); 
diff = S - R; // 6-bit subtract with borrow 


esize = 1 << len; 

d = UInt(diff<len-1:0>); 

welem = ZeroExtend(Ones(S + 1), esize); 
telem = ZeroExtend(Ones(d + 1), esize); 
wmask = Replicate(ROR(welem, R)); 

tmask = Replicate(telem); 

return (wmask, tmask); 


aarch64/instrs/integer/ins-ext/insert/movewide/movewideop/MoveWideOp 


enumeration MoveWideOp {MoveWideOp_N, MoveWideOp_Z, MoveWideOp_K}; 
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aarch64/instrs/integer/logical/movwpreferred/MoveWidePreferred 


// MoveWidePreferred() 


// Return TRUE if a bitmask immediate encoding would generate an immediate 
// value that could also be represented by a single MOVZ or MOVN instruction. 
// Used as a condition for the preferred MOV<-ORR alias. 


boolean MoveWidePreferred(bit sf, bit immN, bits(6) imms, bits(6) immr) 
integer S = UInt(imms); 
integer R = UInt(immr); 
integer width = if sf == '1' then 64 else 32; 


// element size must equal total immediate size 


if sf == '1' && immN:imms != '1xxxxxx' then 
return FALSE; 
if sf == 'Q' && immN:imms != 'QOxxxxx' then 


return FALSE; 


// for MOVZ must contain no more than 16 ones 

if S< 16 then 
// ones must not span halfword boundary when rotated 
return (-R MOD 16) <= (15 - S); 


// for MOVN must contain no more than 16 zeros 

if S >= width - 15 then 
// zeros must not span halfword boundary when rotated 
return (R MOD 16) <= (S - (width - 15)); 


return FALSE; 


aarch64/instrs/integer/shiftreg/DecodeShift 
// DecodeShift() 
// Decode shift encodings 


ShiftType DecodeShift(bits(2) op) 
case op of 
when 'Q0' return ShiftType_LSL; 
when 'Q1' return ShiftType_LSR; 
when '10' return ShiftType_ASR; 
when '11' return ShiftType_ROR; 


aarch64/instrs/integer/shiftreg/ShiftReg 
// ShiftReg() 
// Perform shift of a register operand 


bits(N) ShiftReg(integer reg, ShiftType shiftype, integer amount) 
bits(N) result = X[reg]; 
case shiftype of 
when ShiftType_LSL result = LSL(result, amount); 
when ShiftType_LSR result = LSR(result, amount); 
when ShiftType_ASR result = ASR(result, amount); 
when ShiftType_ROR result = ROR(result, amount); 
return result; 


aarch64/instrs/integer/shiftreg/ShiftType 


enumeration ShiftType {ShiftType_LSL, ShiftType_LSR, ShiftType_ASR, ShiftType_ROR}; 
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aarch64/instrs/logicalop/LogicalOp 


enumeration Logical0p {LogicalOp_AND, Logical0p_EOR, LogicalOp_ORR}; 


aarch64/instrs/memory/memop/MemAtomicOp 


enumeration MemAtomicOp {MemAtomicOp_ADD, 
lemAtomi cOp_BIC, 
lemAtomi cOp_EOR, 
jemAtomi cOp_ORR, 
lemAtomi cOp_SMAX , 
lemAtomi cOp_SMIN, 
lemAtomi cOp_UMAX , 
lemAtomi cOp_UMIN , 
jemAtomi cOp_SWP}; 








aarch64/instrs/memory/memop/MemOp 


enumeration MemOp {MemOp_LOAD, MemOp_STORE, MemOp_PREFETCH}; 


aarch64/instrs/memory/prefetch/Prefetch 


// Prefetch() 
// =ssssss=== 
// Decode and execute the prefetch hint on ADDRESS specified by PRFOP 
Prefetch(bits(64) address, bits(5) prfop) 
PrefetchHint hint; 
integer target; 


boolean stream; 


case prfop<4:3> of 


when '00' hint = Prefetch_READ; // PLD: prefetch for load 
when '@1' hint = Prefetch_EXEC; // PLI: preload instructions 
when '10' hint = Prefetch_WRITE; // PST: prepare for store 
when '11' return; // unallocated hint 

target = UInt(prfop<2:1>); // target cache level 

stream = (prfop<@> != '0'); // streaming (non-temporal) 

Hint_Prefetch(address, hint, target, stream); 


return; 


aarch64/instrs/system/barriers/barrierop/MemBarrierOp 


enumeration MemBarrierOp { MemBarrierOp_DSB // Data Synchronization Barrier 
, MemBarrierOp_DMB // Data Memory Barrier 
, MemBarrierOp_ISB // Instruction Synchronization Barrier 
, MemBarrierOp_SSBB // Speculative Synchronization Barrier to VA 
, MemBarrierOp_PSSBB // Speculative Synchronization Barrier to PA 
, MemBarrierOp_SB // Speculation Barrier 
F 


aarch64/instrs/system/hints/syshintop/SystemHintOp 


enumeration SystemHintOp { 
SystemHintOp_NOP, 
SystemHintOp_YIELD, 
SystemHintOp_WFE, 
SystemHintOp_WFI, 
SystemHintOp_SEV, 
SystemHintOp_SEVL, 
SystemHintOp_ESB, 
SystemHintOp_PSB, 
SystemHintOp_TSB, 
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SystemHintOp_BTI, 
SystemHintOp_CSDB 


H 


aarch64/instrs/system/register/cpsr/pstatefield/PSTATEField 


enumeration PSTATEField {PSTATEField_DAIFSet, PSTATEField_DAIFCIr, 


PSTATEField_PAN, // Armv8.1 
PSTATEField_UAO, // Armv8.2 
PSTATEField_DIT, // Armv8.4 
PSTATEField_SSBS, 
PSTATEField_TCO, // Armv8.5 
PSTATEField_SP 

F 


aarch64/instrs/system/sysops/sysop/SysOp 


// SysOp() 
// ====== 


System0p SysOp(bits(3) op1, bits(4) CRn, bits(4) CRm, bits(3) op2) 
:CRn:CRm:op2 of 


case opl 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when 


J1-7392 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


"000 
"100 
"110 
"000 
"100 
"110 
"000 
"000 
"100 
"100 
"100 
"100 
"Q11 
"000 
"000 
"Q11 
"000 
"Q11 
"Q11 
"000 
"Q11 
"000 
"000 
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"100 
"110 
"000 
"000 
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"000 
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0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
0111 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 
1000 





1000 000' return Sys_AT; // S1E1R 
1000 000' return Sys_AT; // S1E2R 
1000 000' return Sys_AT; // S1E3R 
1000 001' return Sys_AT; // S1E1W 
1000 001' return Sys_AT; // S1E2W 
1000 001' return Sys_AT; // S1E3W 
1000 010' return Sys_AT; // S1EOR 
1000 011' return Sys_AT; // S1EQW 
1000 100' return Sys_AT; // S12E1R 
1000 101' return Sys_AT; // S12E1W 
1000 110' return Sys_AT; // S12EQR 
1000 111' return Sys_AT; // S12EQW 
0100 001' return Sys_DC; // ZVA 

0110 001' return Sys_DC; // IVAC 
0110 010' return Sys_DC; // ISW 

1010 001' return Sys_DC; // CVAC 
1010 010' return Sys_DC; // CSW 

1011 001' return Sys_DC;  // CVAU 
1110 001' return Sys_DC; // CIVAC 
1110 010' return Sys DC; // CISW 
1101 001' return Sys_DC;  // CVADP 
0001 000' return Sys_IC; // IALLUIS 
0101 000' return Sys_IC; // IALLU 
0101 001' return Sys_IC; // IVAU 
0000 001' return Sys_TLBI; // IPAS2E1IS 
0000 101' return Sys_TLBI; // IPAS2LE1IS 
0011 000' return Sys_TLBI; // VMALLE1IS 
0011 000' return Sys_TLBI; // ALLE2IS 
0011 000' return Sys_TLBI; // ALLE3IS 
0011 001' return Sys_TLBI; // VAE1IS 
0011 001' return Sys_TLBI; // VAE2IS 
0011 001' return Sys_TLBI; // VAE3IS 
0011 010' return Sys_TLBI; // ASIDE1IS 
0011 011' return Sys_TLBI; // VAAE1IS 
0011 100' return Sys_TLBI; // ALLE1IS 
0011 101' return Sys_TLBI; // VALE1IS 
0011 101' return Sys_TLBI; // VALE2IS 
0011 101' return Sys_TLBI; // VALE3IS 
0011 110' return Sys_TLBI; // VMALLS12E1IS 
0011 111' return Sys_TLBI; // VAALE1IS 
0100 001' return Sys_TLBI; // IPAS2E1 
0100 101' return Sys_TLBI; // IPAS2LE1 
0111 000' return Sys_TLBI; // VMALLE1 
0111 000' return Sys_TLBI; // ALLE2 
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return 
return 
return 
return 
return 
return 
return 
return 
return 
return 
return 
return 


when 
when 
when 
when 
when 
when 
when 
when 
when 
when 
when '100 1000 
when '000 1000 
return Sys_SYS; 


Sys- TL 
Sys_TL 
Sys_TL 
Sys_TL 
Sys_TL 
Sys_TL 
Sys_TL 
Sys_TL 
Sys_TL 
Sys_TL 
Sys_TL 
Sys_TL 
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; // ALLE3 
; // VAEL 

; // VAE2 

; // VAE3 

; // ASIDE1 
; // VAAE1 
; // ALLEL 
; // VALEL 
; // VALE2 
; // VALE3 
; // VMALLS12E1 
; // VAALEL 


aarch64/instrs/system/sysops/sysop/SystemOp 


enumeration SystemOp {Sys_AT, Sys_DC, Sys_IC, Sys_TLBI, Sys_SYS}; 


aarch64/instrs/vector/arithmetic/binary/uniform/logical/bsl-eor/vbitop/VBitOp 


enumeration VBitOp 


{VBitOp_VBIF, VBitOp_VBIT, VBitOp_VBSL, VBitOp_VEOR}; 


aarch64/instrs/vector/arithmetic/unary/cmp/compareop/CompareOp 


enumeration CompareOp 


{CompareOp_GT, CompareOp_GE, CompareOp_EQ, 


CompareOp_LE, CompareOp_LT}; 


aarch64/instrs/vector/logical/immediateop/ImmediateOp 


enumeration ImmediateOp {ImmediateOp_MOVI, ImmediateOp_MVNI, 
ImmediateOp_ORR, ImmediateOp_BIC}; 


aarch64/instrs/vector/reduce/reduceop/Reduce 


// Reduce() 
// 


bits(esize) Reduce(ReduceOp op, bits(N) input, integer esize) 


integer half; 
bits(esize) hi; 
bits(esize) lo; 
bits(esize) result; 


if N == esize then 
return input<esize-1:0>; 


half = N DIV 2; 
hi = Reduce(op, input<N-1:half>, esize); 
lo = Reduce(op, input<half-1:0>, esize); 


case op of 
when ReduceOp_FMINNUM 

result = FPMinNum(lo, hi, FPCR); 
when ReduceOp_FMAXNUM 

result = FPMaxNum(lo, hi, FPCR); 
when ReduceOp_FMIN 

result = FPMin(lo, hi, FPCR); 
when ReduceOp_FMAX 

result = FPMax(lo, hi, FPCR); 
when ReduceOp_FADD 

result = FPAdd(lo, hi, FPCR); 
when ReduceOp_ADD 
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result = lo + hi; 


return result; 


aarch64/instrs/vector/reduce/reduceop/ReduceOp 


enumeration ReduceOp {ReduceOp_FMINNUM, ReduceOp_FMAXNUM, 
ReduceOp_FMIN, ReduceOp_FMAX, 
ReduceOp_FADD, ReduceOp_ADD}; 


J1.1.5 aarch64/translation 


This section includes the following pseudocode functions: 

$ aarch64/translation/attrs/AArch64.InstructionDevice. 

° aarch64/translation/attrs/AArch64.S1AttrDecode on page J1-7395. 

° aarch64/translation/attrs/AArch64. TranslateAddressS10ff on page J1-7396. 

e aarch64/translation/checks/AArch64.AccessIsPrivileged on page J1-7397. 

° aarch64/translation/checks/AArch64.AccessUsesEL on page J1-7397. 

° aarch64/translation/checks/AArch64.CheckPermission on page J1-7397. 

° aarch64/translation/checks/AArch64.CheckS2Permission on page J1-7398. 

° aarch64/translation/debug/AArch64. CheckBreakpoint on page J1-7399. 

. aarch64/translation/debug/AArch64. CheckDebug on page J1-7400. 

$ aarch64/translation/debug/AArch64.CheckWatchpoint on page J1-7400. 

s aarch64/translation/faults/AArch64.AccessFlagFault on page J1-7400. 

° aarch64/translation/faults/AArch64.AddressSizeFault on page J1-7401. 

: aarch64/translation/faults/AArch64.AlignmentFault on page J1-7401. 

$ aarch64/translation/faults/AArch64.AsynchExternalAbort on page J1-7401. 

s aarch64/translation/faults/AArch64.DebugFault on page J1-7401. 

à aarch64/translation/faults/AArch64.NoFault on page J1-7402. 

. aarch64/translation/faults/AArch64.PermissionFault on page J1-7402. 

° aarch64/translation/faults/AArch64. TranslationFault on page J1-7402. 

. aarch64/translation/translation/AArch64.CheckAndUpdateDescriptor on page J1-7402. 
° aarch64/translation/translation/AArch64.FirstStageTranslate on page J1-7403. 
. aarch64/translation/translation/AArch64.FullTranslate on page J1-7404. 

° aarch64/translation/translation/AArch64.SecondStageTranslate on page J1-7405. 
° aarch64/translation/translation/AArch64.SecondStage Walk on page J1-7405. 

° aarch64/translation/translation/AArch64. TranslateAddress on page J1-7406. 

è aarch64/translation/walk/AArch64.TranslationTableWalk on page J1-7406. 


aarch64/translation/attrs/AArch64.InstructionDevice 


// AArch64.InstructionDevice() 

// a 

// Instruction fetches from memory marked as Device but not execute-never might generate a 
// Permission Fault but are otherwise treated as if from Normal Non-cacheable memory. 


AddressDescriptor AArch64.InstructionDevice(AddressDescriptor addrdesc, bits(64) vaddress, 
bits(52) ipaddress, integer level, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk) 


c = ConstrainUnpredictable(); 
assert c IN {Constraint_NONE, Constraint_FAULT}; 


if c == Constraint_FAULT then 
addrdesc.fault = AArch64.PermissionFault(ipaddress, boolean UNKNOWN, level, acctype, iswrite, 
secondstage, s2fslwalk); 
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else 
addrdesc.memattrs.memtype = MemType_Normal ; 
addrdesc.memattrs.inner.attrs = MemAttr_NC; 
addrdesc.memattrs.inner.hints = MemHint_No; 
addrdesc.memattrs.outer = addrdesc.memattrs.inner; 
addrdesc.memattrs.tagged = FALSE; 
addrdesc.memattrs = MemAttrDefaults(addrdesc.memattrs) ; 


return addrdesc; 


aarch64/translation/attrs/AArch64.S1AttrDecode 


// AArch64.S1AttrDecode() 

JJ ssssssssssesssse====== 

// Converts the Stage 1 attribute fields, using the MAIR, to orthogonal 
// attributes and hints. 


MemoryAttributes AArch64.S1AttrDecode(bits(2) SH, bits(3) attr, AccType acctype) 
MemoryAttributes memattrs; 


mair = MAIR[]; 
index = 8 « UInt(attr); 
attrfield = mair<index+7:index>; 


memattrs.tagged = FALSE; 
if ((attrfield<7:4> != 'Q000' && attrfield<7:4> != '1111' && attrfield<3:0> == '0000') || 
(attrfield<7:4> == 'Q000' && attrfield<3:0> != 'xx@0')) then 
// Reserved, maps to an allocated value 
(-, attrfield) = ConstrainUnpredictableBits(); 
if !HaveMTEExt() && attrfield<7:4> == '1111' && attrfield<3:0> == 'Q000' then 
// Reserved, maps to an allocated value 
(-, attrfield) = ConstrainUnpredictableBits(); 


if attrfield<7:4> == '0000' then // Device 

memattrs.memtype = MemType_Device; 

case attrfield<3:0> of 
when 'Q000' memattrs.device = DeviceType_nGnRnE; 
when 'Q100' memattrs.device = DeviceType_nGnRE; 
when '1000' memattrs.device = DeviceType_nGRE; 
when '1100' memattrs.device = DeviceType_GRE; 
otherwise Unreachable(); // Reserved, handled above 


elsif attrfield<3:0> != 'Q000' then // Normal 
memattrs.memtype = MemType_Normal; 
memattrs.outer = LongConvertAttrsHints(attrfield<7:4>, acctype); 
memattrs.inner = LongConvertAttrsHints(attrfield<3:0>, acctype); 
memattrs.shareable = SH<1> == '1'; 
memattrs.outershareable = SH == '10'; 
elsif HaveMTEExt() && attrfield == '11110000' then // Normal, Tagged if WB-RWA 
memattrs.memtype = MemType_Normal; 
memattrs.outer = LongConvertAttrsHints('1111', acctype); // WB_RWA 
memattrs.inner = LongConvertAttrsHints('1111', acctype); // WB_RWA 
memattrs.shareable = SH<1> == '1'; 
memattrs.outershareable = SH == '10'; 
memattrs.tagged = (memattrs.inner.attrs == MemAttr_WB & 
memattrs.inner.hints == MemHint_RWA && 
memattrs.outer.attrs == MemAttr_WB && 
memattrs.outer.hints == MemHint_RWA); 
else 
Unreachable(); // Reserved, handled above 


return MemAttrDefaults(memattrs) ; 
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aarch64/translation/attrs/AArch64. TranslateAddressS1 Off 


// AArch64.TranslateAddressS10ff() 

// aec 

// Called for stage 1 translations when translation is disabled to supply a default translation. 
// Note that there are additional constraints on instruction prefetching that are not described in 
// this pseudocode. 


TLBRecord AArch64.TranslateAddressSl0ff(bits(64) vaddress, AccType acctype, boolean iswrite) 
assert !ELUsingAArch32(S1TranslationRegime()); 


TLBRecord result; 


Top = AddrTop(vaddress, (acctype == AccType_IFETCH), PSTATE.EL); 
if !IsZero(vaddress<Top:PAMax()>) then 
level = 0; 
ipaddress = bits(52) UNKNOWN; 
secondstage = FALSE; 
s2fslwalk = FALSE; 
result.addrdesc. fault = AArch64.AddressSizeFault(ipaddress,boolean UNKNOWN, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 


default_cacheable = (HasS2Translation() && HCR_EL2.DC == '1'); 


if default_cacheable then 
// Use default cacheable settings 
lt.addrdesc.memattrs.memtype = MemType_Normal; 
]t.addrdesc.memattrs.inner.attrs = MemAttr_WB; // Write-back 
result.addrdesc.memattrs.inner.hints = MemHint_RWA; 
lt.addrdesc.memattrs.shareable = FALSE; 
]t.addrdesc.memattrs.outershareable = FALSE; 
result.addrdesc.memattrs.tagged = HCR_EL2.DCT == '1'; 
elsif acctype != AccType_IFETCH then 
// Treat data as Device 
result.addrdesc.memattrs.memtype = MemType_Device; 
result.addrdesc.memattrs.device = DeviceType_nGnRnE; 
result.addrdesc.memattrs.inner = MemAttrHints UNKNOWN; 
result.addrdesc.memattrs.tagged = FALSE; 








else 
// Instruction cacheability controlled by SCTLR_ELx.I 
cacheable = SCTLR[].I == '1'; 
result.addrdesc.memattrs.memtype = MemType_Normal; 
if cacheable then 
result.addrdesc.memattrs.inner.attrs = MemAttr_WT; 
result.addrdesc.memattrs.inner.hints = MemHint_RA; 
else 
result.addrdesc.memattrs.inner.attrs = MemAttr_NC; 
result.addrdesc.memattrs.inner.hints = MemHint_No; 
result.addrdesc.memattrs.shareable = TRUE; 
result.addrdesc.memattrs.outershareable = TRUE; 
result.addrdesc.memattrs.tagged = FALSE; 





result.addrdesc.memattrs.outer = result.addrdesc.memattrs.inner; 
result.addrdesc.memattrs = MemAttrDefaults(result.addrdesc.memattrs) ; 
result.perms.ap = bits(3) UNKNOWN; 


result.perms.xn = 'Q'; 
result.perms.pxn = 'Q'; 





result.nG = bit UNKNOWN; 

result.contiguous = boolean UNKNOWN; 

result.domain = bits(4) UNKNOWN; 

result. level = integer UNKNOWN; 

result.blocksize = integer UNKNOWN; 
result.addrdesc.paddress.address = vaddress<51:0>; 
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result.addrdesc.paddress.NS = if IsSecure() then '0' else '1'; 
result.addrdesc.fault = AArch64.NoFault(); 
return result; 


aarch64/translation/checks/AArch64.AccesslsPrivileged 


// AArch64.AccessIsPrivileged() 


boolean AArch64.AccessIsPrivileged(AccType acctype) 
el = AArch64.AccessUsesEL(acctype) ; 


if el == ELO then 
ispriv = FALSE; 
elsif el == EL3 then 
ispriv = TRUE; 
elsif el == EL2 && (!IsInHost() || HCR_EL2.TGE == 'Q') then 
ispriv = TRUE; 
elsif HaveUAOExt() && PSTATE.UAO == '1' then 
ispriv = TRUE; 
else 
ispriv = (acctype != AccType_UNPRIV) ; 


return ispriv; 


aarch64/translation/checks/AArch64.AccessUsesEL 
// AArch64.AccessUsesEL() 
// Returns the Exception Level of the regime that will manage the translation for a given access type. 


bits(2) AArch64.AccessUsesEL(AccType acctype) 
if acctype == AccType_UNPRIV then 
return ELQ; 
elsif acctype == AccType_NV2REGISTER then 
return EL2; 
else 
return PSTATE.EL; 


aarch64/translation/checks/AArch64.CheckPermission 
// AArch64.CheckPermission() 
// Function used for permission checking from AArch64 stage 1 translations 
FaultRecord AArch64.CheckPermission(Permissions perms, bits(64) vaddress, integer level, 
bit NS, AccType acctype, boolean iswrite) 
assert !ELUsingAArch32(S1TranslationRegime()); 
wxn = SCTLR[].WXN == '1'; 
if (PSTATE.EL == ELQ || 
IsInHost() || 


(PSTATE.EL == EL1 && !HaveNV2Ext()) || 
(PSTATE.EL == EL1 && HaveNV2Ext() && (acctype != AccType_NV2REGISTER || !ELIsInHost(EL2)))) then 


priv_r = TRUE; 

priv_w = perms.ap<2> == 'Q'; 

user_r = perms.ap<1l> == '1'; 

user_w = perms.ap<2:1> == 'Q1'; 

ispriv = AArch64.AccessIsPrivileged(acctype) ; 


pan = if HavePANExt() then PSTATE.PAN else 'Q'; 
if (EL2Enabled() && ((PSTATE.EL == EL1 && HaveNVExt() && HCR_EL2.<NV, NV1> == '11') || 
(HaveNV2Ext() && acctype == AccType_NV2REGISTER && HCR_EL2.NV2 == '1'))) then 
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pan = '0'; 
is_ldst = !(acctype IN {AccType_DC, AccType_DC_UNPRIV, AccType_AT, AccType_IFETCH}); 
is_atslxp = (acctype == AccType_AT && AArch64.ExecutingATS1xPInstr()); 
if pan == '1' && user_r && ispriv && (is_ldst || is_atsixp) then 

priv_r = FALSE; 

priv_w = FALSE; 


user_xn = perms.xn == '1' || (user_w && wxn); 
priv_xn = perms.pxn == '1' || (priv_w && wxn) || user_w; 


if ispriv then 

(r, w, xn) = (priv_r, priv_w, priv_xn) 
else 

(r, w, xn) = (user_r, user_w, user_xn); 


else 
// Access from EL2 or EL3 
r = TRUE; 
w = perms.ap<2> == 'Q'; 
xn = perms.xn == '1' || (w && wxn); 


// Restriction on Secure instruction fetch 
if HaveEL(EL3) && IsSecure() && NS == '1' && SCR_EL3.SIF == '1' then 
xn = TRUE; 


if acctype == AccType_IFETCH then 
fail = xn; 
failedread = TRUE; 
elsif acctype IN { AccType_ATOMICRW, AccType_ORDEREDRW, AccType_ORDEREDATOMICRW } then 
fail = !r || Iw; 
failedread = !r; 
elsif iswrite then 
fail = !w; 
failedread = FALSE; 
elsif acctype == AccType_DC && PSTATE.EL != EL@ then 
// DC maintenance instructions operating by VA, cannot fault from stage 1 translation, 
// other than DC IVAC, which requires write permission, and operations executed at ELQ, 
// which require read permission. 
fail = FALSE; 
else 
fail = !r; 
failedread = TRUE; 





if fail then 
secondstage = FALSE; 
s2fslwalk = FALSE; 
ipaddress = bits(52) UNKNOWN; 
return AArch64.PermissionFault(ipaddress,boolean UNKNOWN, level, acctype, 
!failedread, secondstage, s2fslwalk); 
else 
return AArch64.NoFault(); 


aarch64/translation/checks/AArch64.CheckS2Permission 
// AArch64.CheckS2Permission() 
// Function used for permission checking from AArch64 stage 2 translations 
FaultRecord AArch64.CheckS2Permission(Permissions perms, bits(64) vaddress, bits(52) ipaddress, 
integer level, AccType acctype, boolean iswrite, boolean NS, 


boolean s2fslwalk, boolean hwupdatewalk) 


assert IsSecureEL2Enabled() || ( HaveEL(EL2) && !IsSecure() && !ELUsingAArch32(EL2) ) && 


HasS2Translation(); 
r = perms.ap<1> == '1'; 
w = perms.ap<2> == '1'; 


if HaveExtendedExecuteNeverExt() then 
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Armv8 Pseudocode 
J1.1 Pseudocode for AArch64 operations 


case perms.xn:perms.xxn of 
when '00' xn = FALSE; 
when '01' xn = PSTATE.EL == EL1; 
when '10' xn = TRUE; 
when '11' xn = PSTATE.EL == ELQ; 
else 
xn = perms.xn == '1'; 
// Stage 1 walk is checked as a read, regardless of the original type 
if acctype == AccType_IFETCH && !s2fslwalk then 
fail = xn; 
failedread = TRUE; 
elsif (acctype IN { AccType_ATOMICRW, AccType_ORDEREDRW, AccType_ORDEREDATOMICRW }) && !s2fslwalk 


fail = !r || Iw; 
failedread = !r; 
elsif iswrite && !s2fslwalk then 
fail = !w; 
failedread = FALSE; 
elsif acctype == AccType_DC && PSTATE.EL != ELO && !s2fslwalk then 
// DC maintenance instructions operating by VA, with the exception of DC IVAC, do 
// not generate Permission faults from stage 2 translation, other than when 
// performing a stage 1 translation table walk. 


fail = FALSE; 
elsif hwupdatewalk then 
fail = !w; 
failedread = !iswrite; 
else 
fail = !r; 


failedread = !iswrite; 


if fail then 
domain = bits(4) UNKNOWN; 
secondstage = TRUE; 
return AArch64.PermissionFault(ipaddress,NS, level, acctype, 
!failedread, secondstage, s2fslwalk); 
else 
return AArch64.NoFault(); 


ch64/translation/debug/AArch64.CheckBreakpoint 


AArch64.CheckBreakpoint() 


Called before executing the instruction of length "size" bytes at "vaddress" in an AArch64 
translation regime. 

The breakpoint can in fact be evaluated well ahead of execution, for example, at instruction 
fetch. This is the simple sequential execution of the program. 


1tRecord AArch64.CheckBreakpoint(bits(64) vaddress, AccType acctype, integer size) 
assert !ELUsingAArch32(S1TranslationRegime()); 
assert (UsingAArch32() && size IN {2,4}) || size == 4; 


match = FALSE; 


for i = @ to UInt(ID_AA64DFROQ_EL1.BRPs) 
match_i = AArch64.BreakpointMatch(i, vaddress, acctype, size); 
match = match || match_i; 


if match && HaltOnBreakpointOrwatchpoint() then 
reason = DebugHalt_Breakpoint; 
Halt(reason); 
elsif match && MDSCR_EL1.MDE == '1' && AArch64.GenerateDebugExceptions() then 
acctype = AccType_IFETCH; 
iswrite = FALSE; 
return AArch64.DebugFault(acctype, iswrite); 
else 
return AArch64.NoFault(); 
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J1.1 Pseudocode for AArch64 operations 


aarch64/translation/debug/AArch64.CheckDebug 


// AArch64.CheckDebug() 


// Called on each access to check for a debug exception or entry to Debug state. 
FaultRecord AArch64.CheckDebug(bits(64) vaddress, AccType acctype, boolean iswrite, integer size) 
FaultRecord fault = AArch64.NoFault(); 


d_side = (acctype != AccType_IFETCH); 
if HaveNV2Ext() && acctype == AccType_NV2REGISTER then 
mask = 'Q'; 
generate_exception = AArch64.GenerateDebugExceptionsFrom(EL2, IsSecure(), mask) && MDSCR_EL1.MDE 
== '1'; 
else 
generate_exception = AArch64.GenerateDebugExceptions() && MDSCR_EL1.MDE == '1'; 
halt = HaltOnBreakpointOrwWatchpoint(); 


if generate_exception || halt then 
if d_side then 
fault = AArch64.CheckWatchpoint(vaddress, acctype, iswrite, size); 
else 
fault = AArch64.CheckBreakpoint(vaddress, acctype, size); 


return fault; 


aarch64/translation/debug/AArch64.CheckWatchpoint 
// AArch64.CheckWatchpoint() 
// Called before accessing the memory location of "size" bytes at "address". 


FaultRecord AArch64.CheckWatchpoint(bits(64) vaddress, AccType acctype, 
boolean iswrite, integer size) 
assert !ELUsingAArch32(S1TranslationRegime()); 


match = FALSE; 
ispriv = AArch64.AccessIsPrivileged(acctype) ; 


for i = © to UInt(ID_AA64DFROQ_EL1.WRPs) 
match = match || AArch64.WatchpointMatch(i, vaddress, size, ispriv, acctype, iswrite); 


if match && HaltOnBreakpointOrwatchpoint() then 
if acctype != AccType_NONFAULT && acctype != AccType_CNOTFIRST then 
reason = DebugHalt_Watchpoint; 
Halt(reason); 
else 
// Fault will be reported and cancelled 
return AArch64.DebugFault(acctype, iswrite); 
elsif match && MDSCR_EL1.MDE == '1' && AArch64.GenerateDebugExceptions() then 
return AArch64.DebugFault(acctype, iswrite); 
else 
return AArch64.NoFault(); 


aarch64/translation/faults/AArch64.AccessFlagFault 


// AArch64.AccessFlagFault() 
————— 
FaultRecord AArch64.AccessFlagFault(bits(52) ipaddress,boolean NS, integer level, 
AccType acctype, boolean iswrite, boolean secondstage, 


boolean s2fslwalk) 


extflag = bit UNKNOWN; 
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J1.1 Pseudocode for AArch64 operations 


errortype = bits(2) UNKNOWN; 
return AArch64.CreateFaultRecord(Fault_AccessFlag, ipaddress, NS, level, acctype, iswrite, 
extflag, errortype, secondstage, s2fslwalk); 


aarch64/translation/faults/AArch64.AddressSizeFault 


// AArch64.AddressSizeFault() 
|[ ========================== 


FaultRecord AArch64.AddressSizeFault(bits(52) ipaddress,boolean NS, integer level, 


AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk) 


extflag = bit UNKNOWN; 

errortype = bits(2) UNKNOWN; 

return AArch64.CreateFaultRecord(Fault_AddressSize, ipaddress, NS, level, acctype, iswrite, 
extflag, errortype, secondstage, s2fslwalk); 


aarch64/translation/faults/AArch64.AlignmentFault 


// AArch64.AlignmentFault() 
// ======================== 


FaultRecord AArch64.AlignmentFault(AccType acctype, boolean iswrite, boolean secondstage) 


ipaddress = bits(52) UNKNOWN; 
level = integer UNKNOWN; 
extflag = bit UNKNOWN; 
errortype = bits(2) UNKNOWN; 
s2fslwalk = boolean UNKNOWN; 


return AArch64.CreateFaultRecord(Fault_Alignment, ipaddress, boolean UNKNOWN, level, acctype, 
iswrite, 
extflag, errortype, secondstage, s2fslwalk); 


aarch64/translation/faults/AArch64.AsynchExternalAbort 

// AArch64.AsynchExternalAbort() 

// Wrapper function for asynchronous external aborts 

FaultRecord AArch64.AsynchExternalAbort(boolean parity, bits(2) errortype, bit extflag) 


faulttype = if parity then Fault_AsyncParity else Fault_AsyncExternal; 
ipaddress = bits(52) UNKNOWN; 

level = integer UNKNOWN; 

acctype = AccType_NORMAL; 

iswrite = boolean UNKNOWN; 

secondstage = FALSE; 

s2fslwalk = FALSE; 


return AArch64.CreateFaultRecord(faulttype, ipaddress, boolean UNKNOWN, level, acctype, iswrite, 
extflag, 


errortype, secondstage, s2fslwalk); 


aarch64/translation/faults/AArch64.DebugF ault 


// AArch64 .DebugFault() 
|[ ==================== 


FaultRecord AArch64.DebugFault(AccType acctype, boolean iswrite) 
ipaddress = bits(52) UNKNOWN; 


errortype = bits(2) UNKNOWN; 
level = integer UNKNOWN; 
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J1.1 Pseudocode for AArch64 operations 


extflag = bit UNKNOWN; 
secondstage = FALSE; 
s2fslwalk = FALSE; 


return AArch64.CreateFaultRecord(Fault_Debug, ipaddress, boolean UNKNOWN, level, acctype, iswrite, 
extflag, errortype, secondstage, s2fslwalk); 


aarch64/translation/faults/AArch64.NoFault 


// AArch64.NoFault() 
// ================= 


FaultRecord AArch64.NoFault() 


ipaddress = bits(52) UNKNOWN; 
level = integer UNKNOWN; 
acctype = AccType_NORMAL; 
iswrite = boolean UNKNOWN; 
extflag = bit UNKNOWN; 
errortype = bits(2) UNKNOWN; 
secondstage = FALSE; 
s2fslwalk = FALSE; 


return AArch64.CreateFaultRecord(Fault_None, ipaddress, boolean UNKNOWN, level, acctype, iswrite, 
extflag, errortype, secondstage, s2fslwalk); 


aarch64/translation/faults/AArch64.PermissionFault 


// AArch64.PermissionFault() 
[[ ========================= 


FaultRecord AArch64.PermissionFault(bits(52) ipaddress,boolean NS, integer level, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk) 


extflag = bit UNKNOWN; 

errortype = bits(2) UNKNOWN; 

return AArch64.CreateFaultRecord(Fault_Permission, ipaddress, NS, level, acctype, iswrite, 
extflag, errortype, secondstage, s2fslwalk); 


aarch64/translation/faults/AArch64.TranslationF ault 


// AArch64.TranslationFault() 
// ========================== 


FaultRecord AArch64.TranslationFault(bits(52) ipaddress, boolean NS, integer level, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk) 


extflag = bit UNKNOWN; 

errortype = bits(2) UNKNOWN; 

return AArch64.CreateFaultRecord(Fault_Translation, ipaddress, NS, level, acctype, iswrite, 
extflag, errortype, secondstage, s2fslwalk); 


aarch64/translation/translation/AArch64.CheckAndUpdateDescriptor 
// AArch64.CheckAndUpdateDescriptor() 
oi check and.update-translation table descriptor if hardware update is configured 
FaultRecord AArch64.CheckAndUpdateDescriptor(DescriptorUpdate result, FaultRecord fault, 
boolean secondstage, bits(64) vaddress, AccType acctype, 


boolean iswrite, boolean s2fslwalk, boolean hwupdatewalk) 


boolean hw_update_AF = FALSE; 
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J1.1 Pseudocode for AArch64 operations 


boolean hw_update_AP = FALSE; 


// Check if access flag can be updated 
// Address translation instructions are permitted to update AF but not required 
if result.AF then 
if fault.statuscode == Fault_None || ConstrainUnpredictable() == Constraint_TRUE then 
hw_update_AF = TRUE; 


if result.AP && fault.statuscode == Fault_None then 
write_perm_req = (iswrite || acctype IN {AccType_ATOMICRW, AccType_ORDEREDRW, 
AccType_ORDEREDATOMICRW }) && !s2fslwalk; 
hw_update_AP = (write_perm_req && !(acctype IN {AccType_AT, AccType_DC, AccType_DC_UNPRIV})) | | 
hwupdatewalk; 


if hw_update_AF || hw_update_AP then 
if secondstage || !HasS2Translation() then 
descaddr2 = result.descaddr; 
else 
hwupdatewalk = TRUE; 
descaddr2 = AArch64.SecondStageWalk(result.descaddr, vaddress, acctype, iswrite, 8, 
hwupdatewalk) ; 
if IsFault(descaddr2) then 
return descaddr2. fault; 


accdesc = CreateAccessDescriptor(AccType_ATOMICRW) ; 
desc = _Mem[descaddr2, 8, accdesc]; 
el = AArch64.AccessUsesEL(acctype) ; 
case el of 
when EL3 
reversedescriptors = SCTLR_EL3.EE == '1'; 
when EL2 
reversedescriptors = SCTLR_EL2.EE == '1'; 
otherwise 
reversedescriptors = SCTLR_EL1.EE == '1'; 
if reversedescriptors then 
desc = BigEndianReverse(desc); 


if hw_update_AF then 
desc<10> = '1'; 
if hw_update_AP then 
desc<7> = (if secondstage then '1' else 'Q'); 


_Mem[descaddr2,8,accdesc] = if reversedescriptors then BigEndianReverse(desc) else desc; 


return fault; 


aarch64/translation/translation/AArch64.FirstStage Translate 
// AArch64.FirstStageTranslate() 


// Perform a stage 1 translation walk. The function used by Address Translation operations is 
// similar except it uses the translation regime specified for the instruction. 


AddressDescriptor AArch64.FirstStageTranslate(bits(64) vaddress, AccType acctype, boolean iswrite, 
boolean wasaligned, integer size) 


if HaveNV2Ext() && acctype == AccType_NV2REGISTER then 

sl_enabled = SCTLR_EL2.M == '1'; 
elsif HasS2Translation() then 

sl_enabled = HCR_EL2.TGE == '@' && HCR_EL2.DC == '@' && SCTLR_EL1.M == '1'; 
else 

sl_enabled = SCTLR[].M == '1'; 


ipaddress = bits(52) UNKNOWN; 
secondstage = FALSE; 
s2fslwalk = FALSE; 
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if sl_enabled then // First stage enabled 

S1 = AArch64.TranslationTableWalk(ipaddress, TRUE, vaddress, acctype, iswrite, secondstage, 

s2fslwalk, size); 
permissioncheck = TRUE; 
if acctype == AccType_IFETCH then 
InGuardedPage = S1.GP == '1'; // Global state updated on instruction fetch that denotes 
// if the fetched instruction is from a guarded page. 

else 

S1 = AArch64.TranslateAddressSl10ff(vaddress, acctype, iswrite); 

permissioncheck = FALSE; 


if UsingAArch32() && HaveTrapLoadStoreMultipleDeviceExt() && AArch32.ExecutingLSMInstr() then 
if Sl.addrdesc.memattrs.memtype == MemType_Device && S1.addrdesc.memattrs.device != 
DeviceType_GRE then 
nTLSMD = if S1TranslationRegime() == EL2 then SCTLR_EL2.nTLSMD else SCTLR_EL1.nTLSMD; 
if nTLSMD == 'Q' then 
Sl.addrdesc. fault = AArch64.AlignmentFault(acctype, iswrite, secondstage) ; 


// Check for unaligned data accesses to Device memory 
if ((!wasaligned && acctype != AccType_IFETCH) || (acctype == AccType_DCZVA)) 
&& S1.addrdesc.memattrs.memtype == MemType_Device && !IsFault(Sl.addrdesc) then 
Sl.addrdesc. fault = AArch64.AlignmentFault(acctype, iswrite, secondstage) ; 
if !IsFault(Sl.addrdesc) && permissioncheck then 
Sl.addrdesc.fault = AArch64.CheckPermission(Sl.perms, vaddress, S1. level, 
S1.addrdesc.paddress.NS, 
acctype, iswrite); 


// Check for instruction fetches from Device memory not marked as execute-never. If there has 
// not been a Permission Fault then the memory is not marked execute-never. 
if (!IsFault(Sl.addrdesc) && S1.addrdesc.memattrs.memtype == MemType_Device && 
acctype == AccType_IFETCH) then 
Sl.addrdesc = AArch64.InstructionDevice(S1.addrdesc, vaddress, ipaddress, S1. level, 
acctype, iswrite, 
secondstage, s2fslwalk); 
// Check and update translation table descriptor if required 
hwupdatewalk = FALSE; 
s2fslwalk = FALSE; 
Sl.addrdesc.fault = AArch64.CheckAndUpdateDescriptor(S1.descupdate, S1.addrdesc. fault, 
secondstage, vaddress, acctype, 
iswrite, s2fslwalk, hwupdatewalk); 


return S1.addrdesc; 


aarch64/translation/translation/AArch64.FullTranslate 
// AArch64.FullTranslate() 


// Perform both stage 1 and stage 2 translation walks for the current translation regime. The 
// function used by Address Translation operations is similar except it uses the translation 
// regime specified for the instruction. 


AddressDescriptor AArch64.FullTranslate(bits(64) vaddress, AccType acctype, boolean iswrite, 
boolean wasaligned, integer size) 


// First Stage Translation 
S1 = AArch64.FirstStageTranslate(vaddress, acctype, iswrite, wasaligned, size); 
if !IsFault(S1) && !(HaveNV2Ext() && acctype == AccType_NV2REGISTER) && HasS2Translation() then 
s2fslwalk = FALSE; 
hwupdatewalk = FALSE; 
result = AArch64.SecondStageTranslate(S1, vaddress, acctype, iswrite, wasaligned, s2fslwalk, 
size, hwupdatewalk); 
else 
result = S1; 


return result; 
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J1.1 Pseudocode for AArch64 operations 


aarch64/translation/translation/AArch64.SecondStageTranslate 


// AArch64.SecondStageTranslate() 

[I aec 

// Perform a stage 2 translation walk. The function used by Address Translation operations is 
// similar except it uses the translation regime specified for the instruction. 


AddressDescriptor AArch64.SecondStageTranslate(AddressDescriptor S1, bits(64) vaddress, 
AccType acctype, boolean iswrite, boolean wasaligned, 
boolean s2fslwalk, integer size, boolean hwupdatewalk) 
assert HasS2Translation(); 


s2_enabled = HCR_EL2.VM == '1' || HCR_EL2.DC == '1'; 
secondstage = TRUE; 


if s2_enabled then // Second stage enabled 
ipaddress = S1.paddress.address<51:0>; 
NS = Sl.paddress.NS == '1'; 
S2 = AArch64.TranslationTableWalk(ipaddress, NS, vaddress, acctype, iswrite, secondstage, 
s2fslwalk, size); 


// Check for unaligned data accesses to Device memory 

if ((!wasaligned && acctype != AccType_IFETCH) || (acctype == AccType_DCZVA)) 
&& S2.addrdesc.memattrs.memtype == MemType_Device && !IsFault(S2.addrdesc) then 
S2.addrdesc. fault = AArch64.AlignmentFault(acctype, iswrite, secondstage) ; 


// Check for permissions on Stage2 translations 
if !IsFault(S2.addrdesc) then 
S2.addrdesc.fault = AArch64.CheckS2Permission(S2.perms, vaddress, ipaddress, S2.level, 
acctype, iswrite, NS,s2fslwalk, hwupdatewalk); 


// Check for instruction fetches from Device memory not marked as execute-never. As there 
// has not been a Permission Fault then the memory is not marked execute-never. 
if (!s2fslwalk && !IsFault(S2.addrdesc) && S2.addrdesc.memattrs.memtype == MemType_Device && 
acctype == AccType_IFETCH) then 
S2.addrdesc = AArch64.InstructionDevice(S2.addrdesc, vaddress, ipaddress, S2.level, 
acctype, iswrite, 
secondstage, s2fslwalk); 


// Check for protected table walk 
if (s2fslwalk && !IsFault(S2.addrdesc) && HCR_EL2.PTW == '1' && 
S2.addrdesc.memattrs.memtype == MemType_Device) then 
S2.addrdesc.fault = AArch64.PermissionFault(ipaddress, NS, S2.level, acctype, 
iswrite, secondstage, s2fslwalk); 


// Check and update translation table descriptor if required 
S2.addrdesc.fault = AArch64.CheckAndUpdateDescriptor(S2.descupdate, S2.addrdesc. fault, 
secondstage, vaddress, acctype, 
iswrite, s2fslwalk, hwupdatewalk); 
result = CombineS1S2Desc(S1, S2.addrdesc); 
else 
result = S1; 


return result; 


aarch64/translation/translation/AArch64.SecondStageWalk 
// AArch64.SecondStageWalk() 
// ========================= 


// Perform a stage 2 translation on a stage 1 translation page table walk access. 


AddressDescriptor AArch64.SecondStageWalk(AddressDescriptor S1, bits(64) vaddress, AccType acctype, 
boolean iswrite, integer size, boolean hwupdatewalk) 


assert HasS2Translation(); 


s2fslwalk = TRUE; 
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wasaligned = TRUE; 
return AArch64.SecondStageTranslate(S1, vaddress, acctype, iswrite, wasaligned, s2fslwalk, 
size, hwupdatewalk); 


aarch64/translation/translation/AArch64.TranslateAddress 


// AArch64.TranslateAddress() 
// Main entry point for translating an address 


AddressDescriptor AArch64.TranslateAddress(bits(64) vaddress, AccType acctype, boolean iswrite, 
boolean wasaligned, integer size) 


result = AArch64.FullTranslate(vaddress, acctype, iswrite, wasaligned, size); 


if !(acctype IN {AccType_PTW, AccType_IC, AccType_AT}) && !IsFault(result) then 
result.fault = AArch64.CheckDebug(vaddress, acctype, iswrite, size); 


// Update virtual address for abort functions 
result.vaddress = ZeroExtend(vaddress); 


return result; 


aarch64/translation/walk/AArch64.TranslationTableWalk 


// AArch64.TranslationTableWalk() 

———————— 

// Returns a result of a translation table walk 

fi. 

// Implementations might cache information from memory in any number of non-coherent TLB 
// caching structures, and so avoid memory accesses that have been expressed in this 

// pseudocode. The use of such TLBs is not expressed in this pseudocode. 


TLBRecord AArch64.TranslationTableWalk(bits(52) ipaddress, boolean sl_nonsecure, bits(64) vaddress, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk, integer size) 

if !secondstage then 
assert !ELUsingAArch32(S1TranslationRegime()); 
else 
assert IsSecureEL2Enabled() || ( HaveEL(EL2) && !IsSecure() && !ELUsingAArch32(EL2) ) && 
HasS2Translation(); 


TLBRecord result; 

AddressDescriptor descaddr; 

bits(64) baseregister 

bits(64) inputaddr; // Input Address is 'vaddress' for stage 1, 'ipaddress' for stage 2 

bit nswalk; // Stage 2 translation table walks are to Secure or to Non-secure PA 
space 


descaddr.memattrs.memtype = MemType_Normal ; 


// Derived parameters for the page table walk: 

// grainsize = Log2(Size of Table) - Size of Table is 4KB, 16KB or 64KB in AArch64 
// stride = Log2(Address per Level) - Bits of address consumed at each level 

// firstblocklevel = First level where a block entry is allowed 

// ps = Physical Address size as encoded in TCR_EL1.IPS or TCR_ELx/VTCR_EL2.PS 

// inputsize = Log2(Size of Input Address) - Input Address size in bits 

// level = Level to start walk from 

// This means that the number of levels after start level = 3-level 


if !secondstage then 
// First stage translation 
inputaddr = ZeroExtend(vaddress) ; 
el = AArch64.AccessUsesEL(acctype) ; 
top = AddrTop(inputaddr, (acctype == AccType_IFETCH), el); 
if el == EL3 then 
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largegrain = TCR_EL3.TGO == '01'; 
midgrain = TCR_EL3.TGO == '10'; 
inputsize = 64 - UInt(TCR_EL3.TQ@SZ); 
inputsize_max = if Have52BitVAExt() && largegrain then 52 else 48; 
inputsize_min = 64 - (if !HaveSmallPageTblExt() then 39 else if largegrain then 47 else 48); 
if inputsize < inputsize_min then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_FORCE, Constraint_FAULT}; 
if c == Constraint_FORCE then inputsize = inputsize_min; 
ps = TCR_EL3.PS; 
basefound = inputsize >= inputsize_min && inputsize <= inputsize_max && 
IsZero(inputaddr<top: inputsize>) ; 
disabled = FALSE; 
baseregister = TTBRQ_EL3; 
descaddr.memattrs = WalkAttrDecode(TCR_EL3.SH@, TCR_EL3.ORGNQ, TCR_EL3.IRGNQ, secondstage) ; 
reversedescriptors = SCTLR_EL3.EE == '1'; 
lookupsecure = TRUE; 
singlepriv = TRUE; 
update_AF = HaveAccessFlagUpdateExt() && TCR_EL3.HA == '1'; 
update_AP = HaveDirtyBitModifierExt() && update_AF && TCR_EL3.HD == '1'; 
hierattrsdisabled = AArch64.HaveHPDExt() && TCR_EL3.HPD == '1'; 
elsif ELIsInHost(el) then 
if inputaddr<top> == 'Q' then 
largegrain = TCR_EL2.TG0 == '01'; 
midgrain = TCR_EL2.TGO == '10'; 
inputsize = 64 - UInt(TCR_EL2.T@SZ); 
inputsize_max = if HaveS2BitVAExt() && largegrain then 52 else 48; 
inputsize_min = 64 - (if !HaveSmallPageTblExt() then 39 else if largegrain then 47 else 
48); 
if inputsize < inputsize_min then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_FORCE, Constraint_FAULT}; 
if c == Constraint_FORCE then inputsize = inputsize_min; 
basefound = inputsize >= inputsize_min && inputsize <= inputsize_max && 
IsZero(inputaddr<top: inputsize>) ; 
disabled = TCR_EL2.EPD@ == '1' || (PSTATE.EL == ELO && HaveEQ@PDExt() && TCR_EL2.EQ@PD@ == 
'1'); 
baseregister = TTBRQ_EL2; 
descaddr.memattrs = WalkAttrDecode(TCR_EL2.SH@, TCR_EL2.ORGNO, TCR_EL2.IRGNO, 
secondstage) ; 
hierattrsdisabled = AArch64.HaveHPDExt() && TCR_EL2.HPD@ == '1'; 
else 
inputsize = 64 - UInt(TCR_EL2.T1SZ); 
largegrain = TCR_EL2.TG1 == '11'; // TG1 and TGO encodings differ 
midgrain = TCR_EL2.TG1 == 'Q1'; 
inputsize_max = if HaveS2BitVAExt() && largegrain then 52 else 48; 
inputsize_min = 64 - (if !HaveSmallPageTblExt() then 39 else if largegrain then 47 else 
48); 
if inputsize < inputsize_min then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_FORCE, Constraint_FAULT}; 
if c == Constraint_FORCE then inputsize = inputsize_min; 
basefound = inputsize >= inputsize_min && inputsize <= inputsize_max && 
IsOnes(inputaddr<top: inputsize>) ; 
disabled = TCR_EL2.EPD1 == '1' || (PSTATE.EL == ELO && HaveEQ@PDExt() && TCR_EL2.EQ@PD1 == 


‘1'); 
baseregister = TTBR1_EL2; 
descaddr.memattrs = WalkAttrDecode(TCR_EL2.SH1, TCR_EL2.ORGN1, TCR_EL2.IRGN1, 
secondstage) ; 
hierattrsdisabled = AArch64.HaveHPDExt() && TCR_EL2.HPD1 == '1'; 
ps = TCR_EL2.1PS; 
reversedescriptors = SCTLR_EL2.EE == '1'; 
lookupsecure = if IsSecureEL2Enabled() then IsSecure() else FALSE; 
singlepriv = FALSE; 
update_AF = HaveAccessFlagUpdateExt() && TCR_EL2.HA == '1'; 
update_AP = HaveDirtyBitModifierExt() && update_AF && TCR_EL2.HD == '1'; 
elsif el == EL2 then 
inputsize = 64 - UInt(TCR_EL2.TQ@SZ); 
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largegrain = TCR_EL2.TGO == '01'; 
midgrain = TCR_EL2.TG0 == '10'; 
inputsize_max = if Have52BitVAExt() && largegrain then 52 else 48; 
inputsize_min = 64 - (if !HaveSmallPageTblExt() then 39 else if largegrain then 47 else 48); 
if inputsize < inputsize_min then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_FORCE, Constraint_FAULT}; 
if c == Constraint_FORCE then inputsize = inputsize_min; 
ps = TCR_EL2.PS; 
basefound = inputsize >= inputsize_min && inputsize <= inputsize_max && 
IsZero(inputaddr<top: inputsize>) ; 
disabled = FALSE; 
baseregister = TTBRQ_EL2; 
descaddr.memattrs = WalkAttrDecode(TCR_EL2.SH@, TCR_EL2.ORGN@, TCR_EL2.IRGNQ, secondstage) ; 
reversedescriptors = SCTLR_EL2.EE == '1'; 
lookupsecure = if IsSecureEL2Enabled() then IsSecure() else FALSE; 
singlepriv = TRUE; 
update_AF = HaveAccessFlagUpdateExt() && TCR_EL2.HA == '1'; 
update_AP = HaveDirtyBitModifierExt() && update_AF && TCR_EL2.HD == '1'; 
hierattrsdisabled = AArch64.HaveHPDExt() && TCR_EL2.HPD == '1'; 
else 
if inputaddr<top> == 'Q' then 
inputsize = 64 - UInt(TCR_EL1.TQ@SZ); 
largegrain = TCR_EL1.TGO == '01'; 
midgrain = TCR_EL1.TGO == '10'; 
inputsize_max = if HaveS2BitVAExt() && largegrain then 52 else 48; 
inputsize_min = 64 - (if !HaveSmallPageTblExt() then 39 else if largegrain then 47 else 
48); 
if inputsize < inputsize_min then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_FORCE, Constraint_FAULT}; 
if c == Constraint_FORCE then inputsize = inputsize_min; 
basefound = inputsize >= inputsize_min && inputsize <= inputsize_max && 
IsZero(inputaddr<top: inputsize>) ; 
disabled = TCR_EL1.EPD@ == '1' || (PSTATE.EL == ELO && HaveE@PDExt() && TCR_EL1.E@PD@ == 
'1'); 
disabled = disabled || (el == EL@ && acctype == AccType_NONFAULT && TCR_EL1.NFDQ == 
TY; 
baseregister = TTBRQ_EL1; 
descaddr.memattrs = WalkAttrDecode(TCR_EL1.SH@, TCR_EL1.ORGNO, TCR_EL1.IRGNO, 
secondstage) ; 
hierattrsdisabled = AArch64.HaveHPDExt() && TCR_EL1.HPD@ == '1'; 
else 
inputsize = 64 - UInt(TCR_EL1.T1SZ); 
largegrain = TCR_EL1.TG1 == '11'; // TG1 and TGO encodings differ 
midgrain = TCR_EL1.TG1 == 'Q1'; 
inputsize_max = if HaveS2BitVAExt() && largegrain then 52 else 48; 
inputsize_min = 64 - (if !HaveSmallPageTblExt() then 39 else if largegrain then 47 else 
48); 
if inputsize < inputsize_min then 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_FORCE, Constraint_FAULT}; 
if c == Constraint_FORCE then inputsize = inputsize_min; 
basefound = inputsize >= inputsize_min && inputsize <= inputsize_max && 
IsOnes(inputaddr<top: inputsize>) ; 
disabled = TCR_EL1.EPD1 == '1' || (PSTATE.EL == ELO && HaveEQ@PDExt() && TCR_EL1.E@PD1 == 
T); 
disabled = disabled || (el == EL@ && acctype == AccType_NONFAULT && TCR_EL1.NFD1 == 
T); 
baseregister = TTBR1_EL1; 
descaddr.memattrs = WalkAttrDecode(TCR_EL1.SH1, TCR_EL1.ORGN1, TCR_EL1.IRGN1, 
secondstage) ; 
hierattrsdisabled = AArch64.HaveHPDExt() && TCR_EL1.HPD1 == '1'; 
ps = TCR_EL1.IPS; 
reversedescriptors = SCTLR_EL1.EE == '1'; 
lookupsecure = IsSecure(); 
singlepriv = FALSE; 
update_AF = HaveAccessFlagUpdateExt() && TCR_EL1.HA == '1'; 
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update_AP = HaveDirtyBitModifierExt() && update_AF && TCR_EL1.HD == '1'; 
if largegrain then 





grainsize = 16; // Log2(64KB page size) 

firstblocklevel = (if Have52BitPAExt() then 1 else 2); // Largest block is 4TB (2A42 
r 52 bit PA 

// and 512MB (2A29 bytes) 

elsif midgrain then 

grainsize = 14; // Log2(16KB page size) 

firstblocklevel = 2; // Largest block is 32MB (2A25 
else // Small grain 

grainsize = 12; // Log2(4KB page size) 

firstblocklevel = 1; // Largest block is 1GB (2A30 
stride = grainsize - 3; // Log2(page size / 8 bytes) 


// The starting level is the number of strides needed to consume the input address 
level = 4 - (1 + (inputsize - grainsize - 1) DIV stride); 


// Second stage translation 
inputaddr = ZeroExtend(ipaddress) ; 
if IsSecureBelowEL3() then 
// Second stage for Secure translation regime 
if sl_nonsecure then // Non-secure IPA space 
tOsize = VICR_EL2.TQSZ; 
tgQ VTCR_EL2.TGQ; 
nswalk = VTCR_EL2.NSW; 
else // Secure IPA space 


tO@size = VSTCR_EL2.TQSZ; 
tgQ = VSTCR_EL2.TGQ; 
nswalk = VSTCR_EL2. SW; 


// Stage 2 translation accesses the Non-secure PA space or the Secure PA space 
if nswalk == '1' then 
// When walk is Non-secure, access must be to the Non-secure PA space 
nsaccess = '1'; 
lsif !sl_nonsecure then 
// When walk is Secure and in the Secure IPA space, 
// access is specified by VSTCR_EL2.SA 
nsaccess = VSTCR_EL2.SA; 
lsif VSTCR_EL2.SW == '1' || VSTCR_EL2.SA == '1' then 
// When walk is Secure and in the Non-secure IPA space, 
// access is Non-secure when VSTCR_EL2.SA specifies the Non-secure PA space 
nsaccess = '1'; 


(gel 


(gel 





else 





// When walk is Secure and in the Non-secure IPA space, 
// if VSTCR_EL2.SA specifies the Secure PA space, access is specified by VTCR_EL2.NSA 
nsaccess = VICR_EL2.NSA; 


else 
// Second stage for Non-secure translation regime 
tOsize = VICR_EL2.TQSZ; 
tgð = VTCR_EL2.TG0; 
nswalk = '1" 
nsaccess = "1"; 


inputsize = 64 - UInt(t@size); 
largegrain = tgQ == '01'; 
midgrain = tgQ == '10'; 


inputsize_max = if Have52BitPAExt() && PAMax() == 52 && largegrain then 52 else 48; 
inputsize_min = 64 - (if !HaveSmallPageTblExt() then 39 else if largegrain then 47 else 48); 
if inputsize < inputsize_min then 

c = ConstrainUnpredictable(); 

assert c IN {Constraint_FORCE, Constraint_FAULT}; 

if c == Constraint_FORCE then inputsize = inputsize_min; 
ps = VTCR_EL2.PS; 
basefound = inputsize >= inputsize_min && inputsize <= inputsize_max && 
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IsZero(inputaddr<63:inputsize>); 
disabled = FALSE; 
descaddr.memattrs = WalkAttrDecode(VTCR_EL2.SH@, VTCR_EL2.ORGNO, VTCR_EL2.IRGNQ, secondstage); 
reversedescriptors = SCTLR_EL2.EE == '1'; 
singlepriv = TRUE; 
update_AF = HaveAccessFlagUpdateExt() && VTCR_EL2.HA == '1'; 
update_AP = HaveDirtyBitModifierExt() && update_AF && VTCR_EL2.HD == '1'; 


if IsSecureEL2Enabled() then 
lookupsecure = !s1_nonsecure; 
else 
lookupsecure = FALSE; 


if lookupsecure then 
baseregister = VSTTBR_EL2; 
startlevel UInt (VSTCR_EL2.SL@) ; 

else 


baseregister = VTTBR_EL2; 
startlevel = UInt(VTCR_EL2.SLQ); 
if largegrain then 
grainsize = 16; // Log2(64KB page size) 
level = 3 - startlevel; 
firstblocklevel = (if Have52BitPAExt() then 1 else 2); // Largest block is 4TB (2442 bytes) 
for 52 bit PA 





// and 512MB (2A29 bytes) otherwise 
elsif midgrain then 


grainsize = 14; // Log2(16KB page size) 
level = 3 - startlevel; 
firstblocklevel = 2; // Largest block is 32MB (2A25 
bytes) 
else // Small grain 
grainsize = 12; // Log2(4KB page size) 
if HaveSmal]lPageTblExt() && startlevel == 3 then 
level = startlevel; // Startlevel 3 (VTCR_EL2.SL@ or 
VSCTR_EL2.SL@ == @b11) for 4KB granule 
else 
level = 2 - startlevel; 
firstblocklevel = 1; // Largest block is 1GB (2430 bytes) 
stride = grainsize - 3; // Log2(page size / 8 bytes) 
// Limits on IPA controls based on implemented PA size. Level @ is only 
// supported by small grain translations 
if largegrain then // 64KB pages 
// Level 1 only supported if implemented PA size is greater than 2442 bytes 
if level == @ || (level == 1 && PAMax() <= 42) then basefound = FALSE; 
elsif midgrain then // 16KB pages 
// Level 1 only supported if implemented PA size is greater than 2440 bytes 
if level == @ || (level == 1 && PAMax() <= 40) then basefound = FALSE; 
else // Small grain, 4KB pages 
// Level ® only supported if implemented PA size is greater than 2442 bytes 
if level < @ || (level == @ && PAMax() <= 42) then basefound = FALSE; 
// If the inputsize exceeds the PAMax value, the behavior is CONSTRAINED UNPREDICTABLE 
inputsizecheck = inputsize; 
if inputsize > PAMax() && (!ELUsingAArch32(EL1) || inputsize > 40) then 
case ConstrainUnpredictable() of 
when Constraint_FORCE 
// Restrict the inputsize to the PAMax value 
inputsize = PAMax(); 
inputsizecheck = PAMax(); 
when Constraint_FORCENOSLCHECK 
// As FORCE, except use the configured inputsize in the size checks below 
inputsize = PAMax(); 
when Constraint_FAULT 
// Generate a translation fault 
basefound = FALSE; 
otherwise 
Unreachable(); 
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// Number of entries in the starting level table = 
// (Size of Input Address)/((Address per level)A(Num levels remaining)«(Size of Table)) 
startsizecheck = inputsizecheck - ((3 - level)xstride + grainsize); // Log2(Num of entries) 


// Check for starting level table with fewer than 2 entries or longer than 16 pages. 
// Lower bound check is: startsizecheck < Log2(2 entries) 

// Upper bound check is: startsizecheck > Log2(pagesize/8+16) 

if startsizecheck < 1 || startsizecheck > stride + 4 then basefound = FALSE; 


if !basefound || disabled then 
level = 0; // AArch32 reports this as a level 1 fault 
result.addrdesc. fault = AArch64.TranslationFault(ipaddress, sl_nonsecure, level, acctype, 


iswrite, 


secondstage, s2fslwalk); 
return result; 
case ps of 
when 'Q00' outputsize = 32; 
when 'QQ1' outputsize = 36; 
when 'Q10' outputsize = 40; 
when 'Q11' outputsize = 42; 
when '100' outputsize = 44; 
when '101' outputsize = 48; 
when '110' outputsize = (if Have52BitPAExt() && largegrain then 52 else 48); 
otherwise outputsize = integer IMPLEMENTATION_DEFINED "Reserved Intermediate Physical Address 


size value"; 


if outputsize > PAMax() then outputsize = PAMax(); 


if outputsize < 48 && !IsZero(baseregister<47:outputsize>) then 
level = 0; 
result.addrdesc. fault = AArch64.AddressSizeFault(ipaddress,sl_nonsecure, level, acctype, 


iswrite, 


secondstage, s2fslwalk); 
return result; 


// Bottom bound of the Base address is: 
// Log2(8 bytes per entry)+Log2(Number of entries in starting level table) 
// Number of entries in starting level table = 
// (Size of Input Address)/((Address per level)A(Num levels remaining)*(Size of Table)) 
baselowerbound = 3 + inputsize - ((3-level)sstride + grainsize); // Log2(Num of entries8) 
if outputsize == 52 then 
z = (if baselowerbound < 6 then 6 else baselowerbound); 
baseaddress = baseregister<5:2>:baseregister<47:z>:Zeros(z); 
else 
baseaddress = ZeroExtend(baseregister<47:baselowerbound>:Zeros(baselowerbound) ) ; 


ns_table = if lookupsecure then 'Q' else '1'; 
ap_table = '00'; 
xn_table = 'Q'; 
pxn_table = 'Q'; 


addrselecttop = inputsize - 1; 


apply_nvnvl_effect = HaveNVExt() && EL2Enabled() && HCR_EL2.<NV,NV1> == '11' && 


S1TranslationRegime() == EL1 && !secondstage; 


repeat 
addrselectbottom = (3-level)sstride + grainsize; 


bits(52) index = ZeroExtend(inputaddr<addrselecttop:addrselectbottom>: 'QQQ'); 
descaddr.paddress.address = baseaddress OR index; 
descaddr.paddress.NS = if secondstage then nswalk else ns_table; 


// If there are two stages of translation, then the first stage table walk addresses 

// are themselves subject to translation 

if secondstage || !HasS2Translation() || (HaveNV2Ext() && acctype == AccType_NV2REGISTER) then 
descaddr2 = descaddr; 
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else 
hwupdatewalk = FALSE; 
descaddr2 = AArch64.SecondStageWalk(descaddr, vaddress, acctype, iswrite, 8, hwupdatewalk); 
// Check for a fault on the stage 2 walk 
if IsFault(descaddr2) then 
result.addrdesc.fault = descaddr2.fault; 
return result; 


// Update virtual address for abort functions 
descaddr2.vaddress = ZeroExtend(vaddress); 


accdesc = CreateAccessDescriptorPTW(acctype, secondstage, s2fslwalk, level); 
desc = _Mem[descaddr2, 8, accdesc]; 


if reversedescriptors then desc = BigEndianReverse(desc); 


if desc<@> == '@' || (desc<1:@> == '01' && (level == 3 | 
(HaveBlockBBM() && IsBlockDescriptorNTBitValid() && 
desc<16> == '1'))) then 
// Fault (00), Reserved (10), Block (01) at level 3, or Block(@1) with nT bit set. 
result.addrdesc.fault = AArch64.TranslationFault(ipaddress, sl_nonsecure, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 


// Nalid Block, Page, or Table entry 
if desc<1:@> == 'Q1' || level == 3 then // Block (@1) or Page (11) 
blocktranslate = TRUE; 
else // Table (11) 
if (outputsize < 52 && largegrain && !IsZero(desc<15:12>)) || (outputsize < 48 && 
!IsZero(desc<47:outputsize>)) then 
result.addrdesc.fault = AArch64.AddressSizeFault(ipaddress,sl_nonsecure, level, 
acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 


if outputsize == 52 then 

baseaddress = desc<15:12>:desc<47:grainsize>:Zeros(grainsize) ; 
else 

baseaddress = ZeroExtend(desc<47:grainsize>:Zeros(grainsize)); 
if !secondstage then 

// Unpack the upper and lower table attributes 


ns_table = ns_table OR desc<63>; 
if !secondstage && !hierattrsdisabled then 
ap_table<l> = ap_table<1> OR desc<62>; // read-only 


if apply_nvnvi_effect then 
pxn_table = pxn_table OR desc<60>; 
else 
xn_table = xn_table OR desc<60>; 
// pxn_table and ap_table[@] apply in EL1&0 or EL2&@ translation regimes 
if !singlepriv then 
if !apply_nvnvi_effect then 
pxn_table = pxn_table OR desc<59>; 
ap_table<@> = ap_table<@> OR desc<61>; // privileged 


level = level + 1; 
addrselecttop = addrselectbottom - 1; 
blocktranslate = FALSE; 

until blocktranslate; 


// Check block size is supported at this level 
if level < firstblocklevel then 
result.addrdesc.fault = AArch64.TranslationFault(ipaddress, sl_nonsecure, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 


// Check for misprogramming of the contiguous bit 


if largegrain then 
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contiguousbitcheck = level == 2 && inputsize < 34; 
elsif midgrain then 
contiguousbitcheck = level == 2 && inputsize < 30; 
else 
contiguousbitcheck = level == 1 && inputsize < 34; 
if contiguousbitcheck && desc<52> == '1' then 
if boolean IMPLEMENTATION_DEFINED "Translation fault on misprogrammed contiguous bit" then 


result.addrdesc.fault = AArch64.TranslationFault(ipaddress, sl_nonsecure, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 


// Unpack the descriptor into address and upper and lower block attributes 
if largegrain then 

outputaddress = desc<15:12>:desc<47:addrselectbottom>: inputaddr<addrselectbottom-1:0>; 
else 

outputaddress = ZeroExtend(desc<47:addrselectbottom>: inputaddr<addrselectbottom-1:0>) ; 


// When 52-bit PA is supported, for 64 Kbyte translation granule, 
// block size might be larger than the supported output address size 
if outputsize < 52 && !IsZero(outputaddress<51:outputsize>) then 
result.addrdesc.fault = AArch64.AddressSizeFault(ipaddress,sl_nonsecure, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 


// Check Access Flag 
if desc<10> == 'Q' then 
if !update_AF then 
result.addrdesc.fault = AArch64.AccessFlagFault(ipaddress,sl_nonsecure, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 
else 
result.descupdate.AF = TRUE; 


if update_AP && desc<51> == '1' then 
// If hw update of access permission field is configured consider AP[2] as '@' / S2AP[2] as '1' 
if !secondstage && desc<7> == '1' then 
desc<7> = '0'; 
result.descupdate.AP = TRUE; 
elsif secondstage && desc<7> == 'Q' then 
desc<7> = '1'; 
result.descupdate.AP = TRUE; 


// Required descriptor if AF or AP[2]/S2AP[2] needs update 
result.descupdate.descaddr = descaddr; 


if apply_nvnvi_effect then 


holds UXN 


holds PXN 


pxn = desc<54>; // Bit[54] of the block/page descriptor 
holds PXN instead of UXN 

xn = 'Q'; // XN is 'O' 

ap = desc<7>:'Q1'; // Bit[6] of the block/page descriptor is 
treated as 'Q' regardless of value programmed 

else 

xn = desc<54>; // Bit[54] of the block/page descriptor 

pxn = desc<53>; // Bit[53] of the block/page descriptor 

ap = desc<7:6>:'1'; // Bits[7:6] of the block/page descriptor 


hold AP[2:1] 


contiguousbit = desc<52>; 

nG = desc<11>; 

sh = desc<9:8>; 

memattr = desc<5:2>; // AttrIndx and NS bit in stage 1 


result.domain = bits(4) UNKNOWN; // Domains not used 
result. level = level; 
result.blocksize = 2A((3-level)sstride + grainsize); 
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// Stage 1 translation regimes also inherit attributes from the tables 
if !secondstage then 
result.perms.xn = xn OR xn_table; 
result.perms.ap<2> = ap<2> OR ap_table<1>; // Force read-only 
// PXN, nG and AP[1] apply in EL1&0 or EL2&0 stage 1 translation regimes 
if !singlepriv then 
result.perms.ap<l> = ap<l1> AND NOT(ap_table<0>); // Force privileged only 
result.perms.pxn = pxn OR pxn_table; 
// Pages from Non-secure tables are marked non-global in Secure EL1&0 
if IsSecure() then 
result.nG = nG OR ns_table; 
else 
result.nG = nG; 


else 

result.perms.ap<1> = '1'; 

result.perms.pxn = 'Q'; 

result.nG = "Q"s 
result.GP = desc<50>; // Stage 1 block or pages might be guarded 
result.perms.ap<@> = '1'; 


result.addrdesc.memattrs = AArch64.S1AttrDecode(sh, memattr<2:@>, acctype); 
result.addrdesc.paddress.NS = memattr<3> OR ns_table; 





else 
result.perms.ap<2:1> = ap<2:1>; 
result.perms.ap<@> = '1'; 
result.perms.xn = xn; 
if HaveExtendedExecuteNeverExt() then result.perms.xxn = desc<53>; 
result.perms.pxn = '0'; 
result.nG = '0'; 


if s2fslwalk then 

result.addrdesc.memattrs = S2AttrDecode(sh, memattr, AccType_PTW); 
else 

result.addrdesc.memattrs = S2AttrDecode(sh, memattr, acctype); 
result.addrdesc.paddress.NS = nsaccess; 


result.addrdesc.paddress.address = outputaddress; 
result.addrdesc.fault = AArch64.NoFault(); 

result.contiguous = contiguousbit == '1'; 

if HaveCommonNotPrivateTransExt() then result.CnP = baseregister<Q>; 


return result; 
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J1.2 Pseudocode for AArch32 operation 


This section holds the pseudocode for execution in AArch32 state. Functions that are listed in this section are 
identified as AArch32.FunctionName. Some of these functions have an equivalent AArch64 function, 
AArch64.FunctionName. This section is organized by functional groups, with the functional groups being indicated by 
hierarchical path names, for example aarch32/debug/breakpoint. 


Note 
Many AArch32 pseudocode functions have not been updated to show the constraints on the Armv7 UNPREDICTABLE 
behaviors that are described in Appendix K1 Architectural Constraints on UNPREDICTABLE behaviors. Where 
AArch32 pseudocode shows something to be UNPREDICTABLE, check Appendix K1 for possible constraints on the 
permitted behavior. 








The top-level sections of the AArch32 pseudocode hierarchy are: 
à aarch32/debug. 

. aarch32/exceptions on page J1-7424. 

. aarch32/functions on page J1-7443. 

. aarch32/translation on page J1-7471. 


J1.2.1 aarch32/debug 
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This section includes the following pseudocode functions: 
à aarch32/debug/VCRMatch/AArch3 2. VCRMatch. 


a aarch32/debug/authentication/AArch32.SelfHostedSecurePrivilegedInvasiveDebugEnabled on 
page J1-7416. 


` aarch32/debug/breakpoint/AArch32.BreakpointMatch on page J1-7416. 

à aarch32/debug/breakpoint/AArch32.BreakpointValueMatch on page J1-7417. 

° aarch32/debug/breakpoint/AArch32.StateMatch on page J1-7418. 

5 aarch32/debug/breakpoint/CheckValidStateMatch on page J1-7419. 

$ aarch32/debug/enables/AArch32. GenerateDebugExceptions on page J1-7420. 

s aarch32/debug/enables/AArch32. GenerateDebugExceptionsFrom on page J1-7420. 

$ aarch32/debug/pmu/AArch32.CheckForPMUOverflow on page J1-7420. 

s aarch32/debug/pmu/AArch32.CountEvents on page J1-7421. 

$ aarch32/debug/takeexceptiondbg/AArch32.EnterHypModelnDebugState on page J1-7422. 
è aarch32/debug/takeexceptiondbg/AArch32.EnterModeInDebugState on page J1-7422. 

7 aarch32/debug/takeexceptiondbg/AArch32.EnterMonitorModeInDebugState on page J1-7423. 
. aarch32/debug/watchpoint/AArch32. WatchpointByteMatch on page J1-7423. 

è aarch32/debug/watchpoint/AArch32. WatchpointMatch on page J1-7424. 


aarch32/debug/VCRMatch/AArch32.VCRMatch 


// AArch32.VCRMatch() 


boolean AArch32.VCRMatch(bits(32) vaddress) 


if UsingAArch32() && ELUsingAArch32(EL1) && IsZero(vaddress<1:0>) && PSTATE.EL != EL2 then 
// Each bit position in this string corresponds to a bit in DBGVCR and an exception vector. 
match_word = Zeros(32); 


if vaddress<31:5> == ExcVectorBase()<31:5> then 
if HaveEL(EL3) && !IsSecure() then 
match_word<UInt(vaddress<4:2>) + 24> = '1'; // Non-secure vectors 
else 
match_word<UInt(vaddress<4:2>) + @> = '1'; // Secure vectors (or no EL3) 


if HaveEL(EL3) && ELUsingAArch32(EL3) && IsSecure() && vaddress<31:5> == MVBAR<31:5> then 
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match_word<UInt(vaddress<4:2>) + 8> = '1'; // Monitor vectors 


// Mask out bits not corresponding to vectors. 
if !HaveEL(EL3) then 

mask = 'Q0000000':'Q0000000':'00000000':'11011110'; // DBGVCR[31:8] are RESO 
elsif !ELUsingAArch32(EL3) then 

mask = '11011110':'Q0000000':'Q0000000':'11011110'; // DBGVCR[15:8] are RESO 
else 

mask = '11011110':'Q0000000':'11011100':'11011110'; 


match_word = match_word AND DBGVCR AND mask; 
match = !IsZero(match_word); 


// Check for UNPREDICTABLE case - match on Prefetch Abort and Data Abort vectors 
if !IsZero(match_word<28:27,12:11,4:3>) && DebugTarget() == PSTATE.EL then 
match = ConstrainUnpredictableBool(); 
else 
match = FALSE; 


return match; 


aarch32/debug/authentication/AArch32.SelfHostedSecurePrivilegedinvasiveDebugEna 
bled 


// AArch32.Se]1fHostedSecurePrivi legedInvasi veDebugEnab]ed() 
[I =se 


boolean AArch32.SelfHostedSecurePrivilegedInvasiveDebugEnabled() 
// The definition of this function is IMPLEMENTATION DEFINED. 
// In the recommended interface, AArch32.SelfHostedSecurePrivilegedInvasiveDebugEnabled returns 
// the state of the (DBGEN AND SPIDEN) signal. 
if !HaveEL(EL3) && !IsSecure() then return FALSE; 
return DBGEN == HIGH && SPIDEN == HIGH; 


aarch32/debug/breakpoint/AArch32.BreakpointMatch 
// AArch32.BreakpointMatch() 
// Breakpoint matching in an AArch32 translation regime. 


(boolean, boolean) AArch32.BreakpointMatch(integer n, bits(32) vaddress, integer size) 
assert ELUsingAArch32(S1TranslationRegime()); 
assert n <= UInt(DBGDIDR.BRPs) ; 


enabled = DBGBCR[n].E == '1'; 
ispriv = PSTATE.EL != ELQ; 
linked = DBGBCR[n].BT == '0xQ1'; 
isbreakpnt = TRUE; 

linked_to = FALSE; 


state_match = AArch32.StateMatch(DBGBCR[n].SSC, DBGBCR[n].HMC, DBGBCR[n].PMC, 
linked, DBGBCR[n].LBN, isbreakpnt, ispriv); 
(value_match, value_mismatch) = AArch32.BreakpointValueMatch(n, vaddress, linked_to); 


if size == 4 then // Check second halfword 
// If the breakpoint address and BAS of an Address breakpoint match the address of the 
// second halfword of an instruction, but not the address of the first halfword, it is 
// CONSTRAINED UNPREDICTABLE whether or not this breakpoint generates a Breakpoint debug 
// event. 
(match_i, mismatch_i) = AArch32.BreakpointValueMatch(n, vaddress + 2, linked_to); 
if !value_match && match_i then 
value_match = ConstrainUnpredictableBool(); 
if value_mismatch && !mismatch_i then 
value_mismatch = ConstrainUnpredictableBool(); 


if vaddress<l> == '1' && DBGBCR[n].BAS == '1111' then 
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// The above notwithstanding, if DBGBCR[n].BAS == '1111', then it is CONSTRAINED 

// UNPREDICTABLE whether or not a Breakpoint debug event is generated for an instruction 
// at the address DBGBVR[n]+2. 

if value_match then value_match = ConstrainUnpredictableBool(); 

if !value_mismatch then value_mismatch = ConstrainUnpredictableBool(); 


match = value_match && state_match && enabled; 
mismatch = value_mismatch && state_match && enabled; 


return (match, mismatch); 


aarch32/debug/breakpoint/AArch32.BreakpointValueMatch 
// AArch32.BreakpointValueMatch() 


// The first result is whether an Address Match or Context breakpoint is programmed on the 
// instruction at "address". The second result is whether an Address Mismatch breakpoint is 
// programmed on the instruction, that is, whether the instruction should be stepped. 


(boolean, boolean) AArch32.BreakpointValueMatch(integer n, bits(32) vaddress, boolean linked_to) 


// "n" is the identity of the breakpoint unit to match against. 

// "vaddress" is the current instruction address, ignored if linked_to is TRUE and for Context 
// matching breakpoints. 

// "linked_to" is TRUE if this is a call from StateMatch for linking. 


// If a non-existent breakpoint then it is CONSTRAINED UNPREDICTABLE whether this gives 
// no match or the breakpoint is mapped to another UNKNOWN implemented breakpoint. 
if n > UInt(DBGDIDR.BRPs) then 

(c, n) = ConstrainUnpredictableInteger(@, UInt(DBGDIDR.BRPs)); 

assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; 

if c == Constraint_DISABLED then return (FALSE, FALSE); 


// If this breakpoint is not enabled, it cannot generate a match. (This could also happen on a 
// call from StateMatch for linking). 

if DBGBCR[n].E == '@' then return (FALSE, FALSE) 

context_aware = (n >= UInt(DBGDIDR.BRPs) - UInt(DBGDIDR.CTX_CMPs) ); 


// If BT is set to a reserved type, behaves either as disabled or as a not-reserved type. 
dbgtype = DBGBCR[n] .BT; 


if ((dbgtype IN {'Q11x','11xx'} && !HaveVirtHostExt()) || // Context matching 
(dbgtype == '010x' && HaltOnBreakpointOrwatchpoint()) || // Address mismatch 
(dbgtype != '@x0x' && !context_aware) || // Context matching 
(dbgtype == '1xxx' && !HaveEL(EL2))) then // EL2 extension 


(c, dbgtype) = ConstrainUnpredictableBits(); 

assert c IN {Constraint_DISABLED, Constraint_UNKNOWN}; 

if c == Constraint_DISABLED then return (FALSE, FALSE); 

// Otherwise the value returned by ConstrainUnpredictableBits must be a not-reserved value 


// Determine what to compare against. 
match_addr = (dbgtype == 'QxQx'); 
mismatch = (dbgtype == 'Q10x'); 
match_vmid = (dbgtype == '10xx'); 
match_cid1 = (dbgtype == 'xx1x'); 
match_cid2 = (dbgtype == '11xx'); 
linked = (dbgtype == 'xxx1'); 


// If this is a call from StateMatch, return FALSE if the breakpoint is not programmed for a 
// \MID and/or context ID match, of if not context-aware. The above assertions mean that the 
// code can just test for match_addr == TRUE to confirm all these things. 

if linked_to && (!linked || match_addr) then return (FALSE, FALSE); 


// If called from BreakpointMatch return FALSE for Linked context ID and/or VMID matches. 
if !linked_to && linked && !match_addr then return (FALSE, FALSE); 
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// Do the comparison. 
if match_addr then 
byte = UInt(vaddress<1:0>); 
assert byte IN {0,2}; // "vaddress" is halfword aligned 
byte_select_match = (DBGBCR[n] .BAS<byte> == '1'); 
BVR_match = vaddress<31:2> == DBGBVR[n]<31:2> && byte_select_match; 
elsif match_cid1 then 
BVR_match = (PSTATE.EL != EL2 && CONTEXTIDR == DBGBVR[n]<31:0>); 
if match_vmid then 
if ELUsingAArch32(EL2) then 
vmid = ZeroExtend(VTTBR.VMID, 16); 
bvr_vmid = ZeroExtend(DBGBXVR[n]<7:0>, 16); 
elsif !Havel6bitVMID() || VTCR_EL2.VS == '@' then 
vmid = ZeroExtend(VTTBR_EL2.VMID<7:@>, 16); 
bvr_vmid = ZeroExtend(DBGBXVR[n]<7:0>, 16); 
else 
vmid = VTTBR_EL2.VMID; 
bvr_vmid = DBGBXVR[n]<15:@>; 
BXVR_match = (PSTATE.EL IN {EL@, EL1} && EL2Enabled() && 
vmid == bvr_vmid); 
elsif match_cid2 then 
BXVR_match = (!IsSecure() && HaveVirtHostExt() && 
!ELUsingAArch32(EL2) && 
DBGBXVR[n]<31:0> == CONTEXTIDR_EL2); 


bvr_match_valid = (match_addr || match_cid1); 
bxvr_match_valid = (match_vmid || match_cid2); 


match = (!bxvr_match_valid || BXVR_match) && (!bvr_match_valid || BVR_match); 


return (match && !mismatch, !match && mismatch); 


aarch32/debug/breakpoint/AArch32.StateMatch 


// AArch32.StateMatch() 


// Determine whether a breakpoint or watchpoint is enabled in the current mode and state. 


boolean AArch32.StateMatch(bits(2) SSC, bit HMC, bits(2) PxC, boolean linked, bits(4) LBN, 
boolean isbreakpnt, boolean ispriv) 
// "SSC", "HMC", "PxC" are the control fields from the DBGBCR[n] or DBGWCR[n] register. 
// "linked" is TRUE if this is a linked breakpoint/watchpoint type. 
// "LBN" is the linked breakpoint number from the DBGBCR[n] or DBGWCR[n] register. 
// “isbreakpnt" is TRUE for breakpoints, FALSE for watchpoints. 
// “ispriv" is valid for watchpoints, and selects between privileged and unprivileged accesses. 


// If parameters are set to a reserved type, behaves as either disabled or a defined type 
(c, SSC, HMC, PxC) = CheckValidStateMatch(SSC, HMC, PxC, isbreakpnt); 

if c == Constraint_DISABLED then return FALSE; 

// Otherwise the HMC,SSC,PxC values are either valid or the values returned by 

// CheckValidStateMatch are valid. 


PL2_match = HaveEL(EL2) && ((HMC == '1' && (SSC:PxC != '1000')) || SSC == '11'); 
PLi_match = PxC<@> == '1'; 
PL@_match = PxC<1> == '1'; 


SSU_match = isbreakpnt && HMC == '@' && PxC == '00' && SSC != '11'; 


if !ispriv && !isbreakpnt then 
priv_match = PLQ_match; 
elsif SSU_match then 
priv_match = PSTATE.M IN {M32_User,M32_Svc,M32_System}; 


else 
case PSTATE.EL of 
when EL3 priv_match = PL1_match; // EL3 and EL1 are both PL1 
when EL2 priv_match = PL2_match; 
when EL1 priv_match = PL1_match; 
when EL@ priv_match = PLQ_match; 
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case SSC of 
when '00' security_state_match = TRUE; // Both 
when '01' security_state_match = !IsSecure(); // Non-secure only 
when '10' security_state_match = IsSecure(); // Secure only 


when '11' security_state_match = (HMC == '1' || IsSecure()); // HMC=1 -> Both, @ -> Secure 
only 


if linked then 
// "LBN" must be an enabled context-aware breakpoint unit. If it is not context-aware then 
// it is CONSTRAINED UNPREDICTABLE whether this gives no match, or LBN is mapped to some 
// UNKNOWN breakpoint that is context-aware. 
lbn = UInt(LBN); 
first_ctx_cmp = (UInt(DBGDIDR.BRPs) - UInt(DBGDIDR.CTX_CMPs)); 
last_ctx_cmp = UInt(DBGDIDR.BRPs) ; 
if (lbn < first_ctx_cmp || lbn > Jast_ctx_cmp) then 
(c, Ibn) = ConstrainUnpredictableInteger(first_ctx_cmp, last_ctx_cmp); 
assert c IN {Constraint_DISABLED, Constraint_NONE, Constraint_UNKNOWN}; 


case c of 
when Constraint_DISABLED return FALSE; // Disabled 
when Constraint_NONE linked = FALSE; // No linking 


// Otherwise ConstrainUnpredictableInteger returned a context-aware breakpoint 


if linked then 
vaddress = bits(32) UNKNOWN; 
linked_to = TRUE; 
(linked_match,-) = AArch32.BreakpointValueMatch(lbn, vaddress, linked_to); 


return priv_match && security_state_match && (!linked || Jinked_match); 


aarch32/debug/breakpoint/CheckValidStateMatch 


// CheckValidStateMatch() 

// sssssesssessssse====== 

// Checks for an invalid state match that will generate Constrained Unpredictable behaviour, otherwise 
// returns Constraint_NONE. 


(Constraint, bits(2), bit, bits(2)) CheckValidStateMatch(bits(2) SSC, bit HMC, bits(2) PxC, boolean 
isbreakpnt) 
boolean reserved = FALSE; 


// Match 'Usr/Sys/Svc' only valid for AArch32 breakpoints 
if (!isbreakpnt || !HaveAArch32EL(EL1)) && HMC:PxC == '000' && SSC != '11' then 
reserved = TRUE; 


// Both EL3 and EL2 are not implemented 
if !HaveEL(EL3) && !HaveEL(EL2) && (HMC != '@' || SSC != 'Q0') then 
reserved = TRUE; 


// EL3 is not implemented 
if !HaveEL(EL3) && SSC IN {'@1','10'} && HMC:SSC:PxC != '10100' then 
reserved = TRUE; 


// EL3 using AArch64 only 
if (!HaveEL(EL3) || HighestELUsingAArch32()) && HMC:SSC:PxC == '11000' then 
reserved = TRUE; 


// EL2 is not implemented 
if !HaveEL(EL2) && HMC:SSC:PxC == '11100' then 
reserved = TRUE; 


// Secure EL2 is not implemented 
if !HaveSecureEL2Ext() && (HMC:SSC:PxC) IN {'Q1100','10100','x11x1'} then 
reserved = TRUE; 


// Values that are not allocated in any architecture version 
if (HMC:SSC:PxC) IN {'Q1110','100x@','10110','11x10'} then 
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reserved = TRUE; 


if reserved then 
// If parameters are set to a reserved type, behaves as either disabled or a defined type 
(c, <HMC,SSC,PxC>) = ConstrainUnpredictableBits(); 
assert c IN {Constraint DISABLED, Constraint UNKNOWN} ; 
if c == Constraint DISABLED then 
return (c, bits(2) UNKNOWN, bit UNKNOWN, bits(2) UNKNOWN) ; 
// Otherwise the value returned by ConstrainUnpredictableBits must be a not-reserved value 


return (Constraint NONE, SSC, HMC, PxC); 


aarch32/debug/enables/AArch32.GenerateDebugExceptions 


// AArch32.GenerateDebugExceptions() 
// ssssssssesesssseesesssseesesseee= 


boolean AArch32.GenerateDebugExceptions() 
return AArch32.GenerateDebugExceptionsFrom(PSTATE.EL, IsSecure()); 


aarch32/debug/enables/AArch32.GenerateDebugExceptionsFrom 


// AArch32.GenerateDebugExceptionsFrom( ) 
// sssssessseesssaassssseeeeeseeee===== 


boolean AArch32.GenerateDebugExceptionsFrom(bits(2) from, boolean secure) 


if from == EL@ && !ELStateUsingAArch32(EL1, secure) then 
mask = bit UNKNOWN; // PSTATE.D mask, unused for ELO case 
return AArch64.GenerateDebugExceptionsFrom(from, secure, mask); 


if DBGOSLSR.OSLK == '1' || DoubleLockStatus() || Halted() then 
return FALSE; 


if HaveEL(EL3) && secure then 
spd = if ELUsingAArch32(EL3) then SDCR.SPD else MDCR_EL3.SPD32; 
if spd<1l> == '1' then 
enabled = spd<@> == '1'; 
else 
// SPD == 0b01 is reserved, but behaves the same as QbQQ. 
enabled = AArch32.SelfHostedSecurePrivi legedInvasiveDebugEnabled() ; 
if from == ELO then enabled = enabled || SDER.SUIDEN == '1'; 
else 
enabled = from != EL2; 


return enabled; 


aarch32/debug/pmu/AArch32.CheckForPMU Overflow 
// AArch32.CheckForPMUOverflow( ) 
// Signal Performance Monitors overflow IRQ and CTI overflow events 
boolean AArch32.CheckForPMUOverflow() 


if !ELUsingAArch32(EL1) then return AArch64.CheckForPMUOverflow(); 
pmuirg = PMCR.E == '1' && PMINTENSET<31> == '1' && PMOVSSET<31> == '1'; 
for n = 0 to UInt(PMCR.N) - 1 
if HaveEL(EL2) then 
hpmn = if !ELUsingAArch32(EL2) then MDCR_EL2.HPMN else HDCR.HPMN; 
hpme = if !ELUsingAArch32(EL2) then MDCR_EL2.HPME else HDCR.HPME; 
E = (if n < UInt(hpmn) then PMCR.E else hpme); 
else 
E = PMCR.E; 
if E == '1' && PMINTENSET<n> == '1' && PMOVSSET<n> == '1' then pmuirg = TRUE; 
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SetInterruptRequestLevel(InterruptID_PMUIRQ, if pmuirq then HIGH else LOW); 
CTI_SetEventLevel(CrossTriggerIn_PMUOverflow, if pmuirq then HIGH else LOW); 


// The request remains set until the condition is cleared. (For example, an interrupt handler 
// or cross-triggered event handler clears the overflow status flag by writing to PMOVSCLR_ELQ.) 


return pmuirq; 


aarch32/debug/pmu/AArch32.CountEvents 
// AArch32.CountEvents() 
// Return TRUE if counter "n" should count its event. For the cycle counter, n == 31. 


boolean AArch32.CountEvents(integer n) 
assert n == 31 || n < UInt(PMCR.N); 


if !ELUsingAArch32(EL1) then return AArch64.CountEvents(n) ; 
// Event counting is disabled in Debug state 
debug = Halted(); 


// In Non-secure state, some counters are reserved for EL2 

if HaveEL(EL2) then 
hpmn = if !ELUsingAArch32(EL2) then MDCR_EL2.HPMN else HDCR.HPMN; 
hpme = if !ELUsingAArch32(EL2) then MDCR_EL2.HPME else HDCR.HPME; 
E = if n < UInt(hpmn) || n == 31 then PMCR.E else hpme; 

else 
E 


= PMCR.E; 
enabled = 


E == '1' && PMCNTENSET<n> == '1'; 


// Event counting in Secure state is prohibited unless any one of: 

// * EL3 is not implemented 

// * EL3 is using AArch64 and MDCR_EL3.SPME == 

// * EL3 is using AArch32 and SDCR.SPME == 

// » Executing at EL@, and SDER.SUNIDEN == 1. 

spme = (ELUsingAArch32(EL3) then SDCR.SPME else MDCR_EL3.SPME) ; 

prohibited = HaveEL(EL3) && IsSecure() && spme == 'Q' && (PSTATE.EL != EL@ || SDER.SUNIDEN == 'Q'); 


// Event counting at EL2 is prohibited if all of: 
// » The HPMD Extension is implemented 
// » Executing at EL2 
// » PMNx is not reserved for EL2 
// * HDCR.HPMD == 
if !prohibited && HaveEL(EL2) && HaveHPMDExt() && PSTATE.EL == EL2 && (n < UInt(hpmn) || n == 31) 
then 
prohibited = (hpmd == '1'); 


// The IMPLEMENTATION DEFINED authentication interface might override software controls 
if prohibited && !HaveNoSecurePMUDisableOverride() then 
prohibited = !ExternalSecureNoninvasiveDebugEnabled(); 


// For the cycle counter, PMCR.DP enables counting when otherwise prohibited 
if prohibited && n == 31 then prohibited = (PMCR.DP == '1'); 


// Event counting can be filtered by the {P, U, NSK, NSU, NSH} bits 
filter = if n == 31 then PMCCFILTR else PMEVTYPER[n] ; 


P = filter<31>; 
U = filter<3Q>; 
NSK = if HaveEL(EL3) then filter<29> else 'Q'; 
NSU = if HaveEL(EL3) then filter<28> else 'Q'; 
NSH = if HaveEL(EL2) then filter<27> else 'Q'; 


case PSTATE.EL of 
when ELO filtered = if IsSecure() then U == '1' else U != NSU; 
when EL1 filtered = if IsSecure() then P == '1' else P != NSK; 
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when EL2 filtered 
when EL3 filtered 


(NSH == '0'); 
(P == '1'); 


return !debug && enabled && !prohibited && !filtered; 


aarch32/debug/takeexceptiondbg/AArch32.EnterHypModelnDebugState 


// AArch32.EnterHypModeInDebugState() 
// sssssssseeesssaaas2sssseeeseseee== 


// Take an exception in Debug state to Hyp mode. 


AArch32.EnterHypModeInDebugState(ExceptionRecord exception) 
SynchronizeContext(); 
assert HaveEL(EL2) && !IsSecure() && ELUsingAArch32(EL2); 


AArch32.ReportHypEntry(exception) ; 

AArch32.WriteMode(M32_Hyp) ; 

SPSR[] = bits(32) UNKNOWN; 

ELR_hyp = bits(32) UNKNOWN; 

// In Debug state, the PE always execute T32 instructions when in AArch32 state, and 
// PSTATE.{SS,A,I,F} are not observable so behave as UNKNOWN. 
PSTATE.T = '1'; // PSTATE.J is RESO 
PSTATE.<SS,A,1,F> = bits(4) UNKNOWN; 

DLR = bits(32) UNKNOWN; 

DSPSR = bits(32) UNKNOWN; 

PSTATE.E = HSCTLR.EE; 

PSTATE.IL = 'Q'; 

PSTATE.IT = '00000000'; 

if HaveSSBSExt() then PSTATE.SSBS = bit UNKNOWN; 

EDSCR.ERR = '1'; 

UpdateEDSCRFields() 





EndOfInstruction(); 


aarch32/debug/takeexceptiondbg/AArch32.EnterModelnDebugState 
// AArch32.EnterModeInDebugState( ) 
// Take an exception in Debug state to a mode other than Monitor and Hyp mode. 


AArch32.EnterModeInDebugState(bits(5) target_mode) 
SynchronizeContext(); 
assert ELUsingAArch32(EL1) && PSTATE.EL != EL2; 


if PSTATE.M == M32_Monitor then SCR.NS = 'Q'; 
AArch32.WriteMode(target_mode) ; 

SPSR[] = bits(32) UNKNOWN; 

R[14] = bits(32) UNKNOWN; 

// In Debug state, the PE always execute T32 instructions when in AArch32 state, and 
// PSTATE.{SS,A,I,F} are not observable so behave as UNKNOWN. 
PSTATE.T = '1'; // PSTATE.J is RESO 
PSTATE.<SS,A,1I,F> = bits(4) UNKNOWN; 

DLR = bits(32) UNKNOWN; 

DSPSR = bits(32) UNKNOWN; 

PSTATE.E = SCTLR.EE; 

PSTATE.IL = 'Q'; 

PSTATE.IT = 'Q0000000'; 

if HavePANExt() && SCTLR.SPAN == '@' then PSTATE.PAN = '1'; 

if HaveSSBSExt() then PSTATE.SSBS = bit UNKNOWN; 





EDSCR.ERR = '1'; 
UpdateEDSCRFields(); // Update EDSCR processor state flags. 
EndOfInstruction(); 
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aarch32/debug/takeexceptiondbg/AArch32.EnterMonitorModelnDebugState 


// AArch32.EnterMonitorModeInDebugState() 
[I ae 


// Take an exception in Debug state to Monitor mode. 


AArch32.EnterMonitorModeInDebugState() 
SynchronizeContext(); 
assert HaveEL(EL3) && ELUsingAArch32(EL3); 
from_secure = IsSecure(); 
if PSTATE.M == M32_Monitor then SCR.NS = 'Q'; 
AArch32.WriteMode(M32_Monitor) ; 
SPSR[] = bits(32) UNKNOWN; 
R[14] = bits(32) UNKNOWN; 
// In Debug state, the PE always execute T32 instructions when in AArch32 state, and 
// PSTATE.{SS,A,I,F} are not observable so behave as UNKNOWN. 
PSTATE.T = '1'; // PSTATE.J is RESO 
PSTATE.<SS,A,1,F> = bits(4) UNKNOWN; 
PSTATE.E = SCTLR.EE; 
PSTATE.IL = 'Q'; 
PSTATE.IT = '00000000'; 
if HavePANExt() then 
if !from_secure then 
PSTATE.PAN = 'Q'; 
elsif SCTLR.SPAN == 'Q' then 
PSTATE.PAN = '1'; 
if HaveSSBSExt() then PSTATE.SSBS = bit UNKNOWN; 
DLR = bits(32) UNKNOWN; 
DSPSR = bits(32) UNKNOWN; 
EDSCR.ERR = '1'; 
UpdateEDSCRFields(); // Update EDSCR processor state flags. 





EndOfInstruction(); 


aarch32/debug/watchpoint/AArch32.WatchpointByteMatch 


// AArch32.WatchpointByteMatch() 
—————— 


boolean AArch32.WatchpointByteMatch(integer n, bits(32) vaddress) 


bottom = if DBGWVR[n]<2> == '1' then 2 else 3; // Word or doubleword 
byte_select_match = (DBGWCR[n] .BAS<UInt(vaddress<bottom-1:0>)> != 'Q'); 
mask = UInt(DBGWCR[n] .MASK) ; 


// If DBGWCR[n].MASK is non-zero value and DBGWCR[n].BAS is not set to '11111111', or 
// DBGWCR[n].BAS specifies a non-contiguous set of bytes behavior is CONSTRAINED 
// UNPREDICTABLE. 
if mask > @ && !IsOnes(DBGWCR[n].BAS) then 
byte_select_match = ConstrainUnpredictableBool(); 


else 
LSB = (DBGWCR[n].BAS AND NOT(DBGWCR[n].BAS - 1)); MSB = (DBGWCR[n].BAS + LSB); 
if !IsZero(MSB AND (MSB - 1)) then // Not contiguous 
byte_select_match = ConstrainUnpredictableBool () 
bottom = 3; // For the whole doubleword 


// If the address mask is set to a reserved value, the behavior is CONSTRAINED UNPREDICTABLE. 
if mask > @ && mask <= 2 then 

(c, mask) = ConstrainUnpredictableInteger(3, 31); 

assert c IN {Constraint_DISABLED, Constraint_NONE, Constraint_UNKNOWN}; 


case c of 
when Constraint_DISABLED return FALSE; // Disabled 
when Constraint_NONE mask = Q; // No masking 


// Otherwise the value returned by ConstrainUnpredictableInteger is a not-reserved value 


if mask > bottom then 
WVR_match = (vaddress<31:mask> == DBGWVR[n]<31:mask>) ; 
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// If masked bits of DBGWVR_EL1[n] are not zero, the behavior is CONSTRAINED UNPREDICTABLE. 


if WR_match && !IsZero(DBGWVR[n]<mask-1:bottom>) then 
WVR_match = ConstrainUnpredictableBool(); 
else 
WVR_match = vaddress<31:bottom> == DBGWVR[n]<31:bottom>; 


return WR_match && byte_select_match; 


aarch32/debug/watchpoint/AArch32.WatchpointMatch 


// AArch32.WatchpointMatch() 


// Watchpoint matching in an AArch32 translation regime. 


boolean AArch32.WatchpointMatch(integer n, bits(32) vaddress, integer size, boolean ispriv, 


boolean iswrite) 
assert ELUsingAArch32(S1TranslationRegime()); 
assert n <= UInt(DBGDIDR.WRPs); 


// “ispriv" is FALSE for LDRT/STRT instructions executed at EL1 and all 


// l\oad/stores at EL@, TRUE for all other load/stores. "iswrite" is TRUE for stores, FALSE for 


// loads. 

enabled = DBGWCR[n].E == '1'; 
linked = DBGWCR[n].WT == '1'; 
isbreakpnt = FALSE; 


state_match = AArch32.StateMatch(DBGWCR[n].SSC, DBGWCR[n].HMC, DBGWCR[n].PAC, 
linked, DBGWCR[n].LBN, isbreakpnt, ispriv); 


ls_match = (DBGWCR[n].LSC<(if iswrite then 1 else Q)> == '1'); 


value_match = FALSE; 
for byte = @ to size - 1 


value_match = value_match || AArch32.WatchpointByteMatch(n, vaddress + byte); 


return value_match && state_match && Is_match && enabled; 


J1.2.2 aarch32/exceptions 


This section includes the following pseudocode functions: 
° aarch32/exceptions/aborts/AArch32.Abort on page J1-7425. 


J1-7424 


s aarch32/exceptions/aborts/AArch32.AbortSyndrome on page J1-7425. 


aarch32/exceptions/aborts/AArch32.CheckPCAlignment on page J1-7426. 


aarch32/exceptions/aborts/AArch32.ReportDataAbort on page J1-7426. 


aarch32/exceptions/aborts/AArch32.ReportPrefetchAbort on page J1-7427. 
aarch32/exceptions/aborts/AArch32. TakeDataAbortException on page J1-7427. 
aarch32/exceptions/aborts/AArch32. TakePrefetchAbortException on page J1-7428. 


aarch32/exceptions/aborts/BranchTargetException on page J1-7428. 


aarch32/exceptions/asynch/AArch32. TakePhysicalFIQException on page J1-7429. 
aarch32/exceptions/asynch/AArch32. TakePhysicalIRQException on page J1-7429. 
aarch32/exceptions/asynch/AArch32. TakePhysicalSErrorException on page J1-7430. 
aarch32/exceptions/asynch/AArch32. TakeVirtualFIQException on page J1-7430. 
aarch32/exceptions/asynch/AArch32. TakeVirtualIRQException on page J1-7431. 
aarch32/exceptions/asynch/AArch32. TakeVirtualSErrorException on page J1-7431. 
aarch32/exceptions/debug/AArch32.SoftwareBreakpoint on page J1-7431. 


aarch32/exceptions/debug/DebugException on page J1-7432. 


aarch32/exceptions/exceptions/AArch32.CheckAdvSIMDOrFPRegisterTraps on page J1-7432. 


aarch32/exceptions/exceptions/AArch32.ExceptionClass on page J1-7432. 
aarch32/exceptions/exceptions/AArch32.GeneralExceptionsToAArch64 on page J1-7433. 
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$ aarch32/exceptions/exceptions/AArch32.ReportHypEntry on page J1-7433. 

è aarch32/exceptions/exceptions/AArch32.ResetControlRegisters on page J1-7433. 
à aarch32/exceptions/exceptions/AArch32.TakeReset on page J1-7434. 

è aarch32/exceptions/exceptions/Exc VectorBase on page J1-7434. 

è aarch32/exceptions/ieeefp/AArch32.FPTrappedException on page J1-7435. 

$ aarch32/exceptions/syscalls/AArch32.CallHypervisor on page J1-7435. 

7 aarch32/exceptions/syscalls/AArch32.CallSupervisor on page J1-7435. 

° aarch32/exceptions/syscalls/AArch32.TakeHVCException on page J1-7435. 

s aarch32/exceptions/syscalls/AArch32.TakeSMCException on page J1-7436. 

$ aarch32/exceptions/syscalls/AArch32.TakeSVCException on page J1-7436. 

7 aarch32/exceptions/takeexception/AArch32.EnterHypMode on page J1-7436. 

à aarch32/exceptions/takeexception/AArch32.EnterMode on page J1-7437. 

- aarch32/exceptions/takeexception/AArch32. Enter MonitorMode on page J1-7437. 
è aarch32/exceptions/traps/AArch32. CheckAdvSIMDOrFPEnabled on page J1-7438. 
e aarch32/exceptions/traps/AArch32.CheckFPAdvSIMDTrap on page J1-7438. 

° aarch32/exceptions/traps/AArch32.CheckForSMCUndefOrTrap on page J1-7439. 
° aarch32/exceptions/traps/AArch32.CheckForWFxTrap on page J1-7439. 

7 aarch32/exceptions/traps/AArch32. CheckITEnabled on page J1-7440. 

$ aarch32/exceptions/traps/AArch32. ChecklllegalState on page J1-7440. 

7 aarch32/exceptions/traps/AArch32.CheckSETENDEnabled on page J1-7440. 

- aarch32/exceptions/traps/AArch32.SystemAccess Trap on page J1-7441. 

$ aarch32/exceptions/traps/AArch32.SystemAccess TrapSyndrome on page J1-7441. 
$ aarch32/exceptions/traps/AArch32. TakeHypTrapException on page J1-7442. 

è aarch32/exceptions/traps/AArch32. TakeMonitorTrapException on page J1-7442. 
à aarch32/exceptions/traps/AArch32. Take UndefInstrException on page J1-7442. 
aarch32/exceptions/traps/AArch32. UndefinedFault on page J1-7443. 


aarch32/exceptions/aborts/AArch32.Abort 


// AArch32.Abort() 
// =============== 


// Abort and Debug exception handling in an AArch32 translation regime. 
AArch32.Abort(bits(32) vaddress, FaultRecord fault) 


// Check if routed to AArch64 state 
route_to_aarch64 = PSTATE.EL == EL@ && !ELUsingAArch32(EL1); 


if !route_to_aarch64 && EL2Enabled() && !ELUsingAArch32(EL2) then 
route_to_aarch64 = (HCR_EL2.TGE == '1' || IsSecondStage(fault) || 
(HaveRASExt() && HCR2.TEA == '1' && IsExternalAbort(fault)) || 
(IsDebugException(fault) && MDCR_EL2.TDE == '1')); 


if !route_to_aarch64 && HaveEL(EL3) && !ELUsingAArch32(EL3) then 
route_to_aarch64 = SCR_EL3.EA == '1' && IsExternalAbort(fault) ; 


if route_to_aarch64 then 
AArch64.Abort(ZeroExtend(vaddress), fault); 

elsif fault.acctype == AccType_IFETCH then 
AArch32.TakePrefetchAbortException(vaddress, fault); 

else 
AArch32.TakeDataAbortException(vaddress, fault); 


aarch32/exceptions/aborts/AArch32.AbortSyndrome 
// AArch32.AbortSyndrome() 


// Creates an exception syndrome record for Abort exceptions taken to Hyp mode 
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// from an AArch32 translation regime. 


ExceptionRecord AArch32.AbortSyndrome(Exception exceptype, FaultRecord fault, bits(32) vaddress) 


exception = ExceptionSyndrome(exceptype) ; 
d_side = exceptype == Exception_DataAbort; 


exception.syndrome = AArch32.FaultSyndrome(d_side, fault); 
exception.vaddress = ZeroExtend(vaddress); 
if IPAValid(fault) then 

exception.ipavalid = TRUE; 

exception.NS = fault.ipaddress.NS; 

exception.ipaddress = ZeroExtend(fault.ipaddress.address); 
else 

exception.ipavalid = FALSE; 


return excepti on; 


aarch32/exceptions/aborts/AArch32.CheckPCAlignment 


// AArch32.CheckPCAlignment() 


AArch32.CheckPCA1ignment() 
bits(32) pc = ThisInstrAddr(); 
if (CurrentInstrSet() == InstrSet_A32 && pc<1> == '1') || pc<@> == '1' then 
if AArch32.GeneralExceptionsToAArch64() then AArch64.PCAlignmentFault(); 
// Generate an Alignment fault Prefetch Abort exception 
vaddress = pc; 
acctype = AccType_IFETCH; 
iswrite = FALSE; 
secondstage = FALSE; 
AArch32.Abort(vaddress, AArch32.AlignmentFault(acctype, iswrite, secondstage)); 
aarch32/exceptions/aborts/AArch32.ReportDataAbort 
// AArch32.ReportDataAbort() 


// Report syndrome information for aborts taken to modes other than Hyp mode. 


AArch32.ReportDataAbort(boolean route_to_monitor, FaultRecord fault, bits(32) vaddress) 


// The encoding used in the IFSR or DFSR can be Long-descriptor format or Short-descriptor 
// format. Normally, the current translation table format determines the format. For an abort 
// from Non-secure state to Monitor mode, the IFSR or DFSR uses the Long-descriptor format if 


// any of the following applies: 
// » The Secure TIBCR.EAE is set to 1. 
// » The abort is synchronous and either: 
// - It is taken from Hyp mode. 
// - It is taken from EL1 or EL@, and the Non-secure TTBCR.EAE is set to 1. 
long_format = FALSE; 
if route_to_monitor && !IsSecure() then 
long_format = TTBCR_S.EAE == '1'; 
if !IsSErrorInterrupt(fault) && !long_format then 
long_format = PSTATE.EL == EL2 || TTBCR.EAE == '1'; 
else 
long_format = TTBCR.EAE == '1'; 
d_side = TRUE; 
if long_format then 
syndrome = AArch32.FaultStatusLD(d_side, fault); 
else 
syndrome = AArch32.FaultStatusSD(d_side, fault); 


if fault.acctype == AccType_IC then 
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if (!long_format && 
boolean IMPLEMENTATION_DEFINED "Report I-cache maintenance fault in IFSR") then 
i_syndrome = syndrome; 
syndrome<10,3:@> = EncodeSDFSC(Fault_ICacheMaint, 1); 
else 
i_syndrome = bits(32) UNKNOWN; 
if route_to_monitor then 
IFSR_S = i_syndrome; 
else 
IFSR = i_syndrome; 


if route_to_monitor then 
DFSR_S = syndrome; 
DFAR_S = vaddress; 
else 
DFSR = syndrome; 
DFAR = vaddress; 


return; 


aarch32/exceptions/aborts/AArch32.ReportPrefetchAbort 


// AArch32.ReportPrefetchAbort() 


// Report syndrome information for aborts taken to modes other than Hyp mode. 


AArch32.ReportPrefetchAbort(boolean route_to_monitor, FaultRecord fault, bits(32) vaddress) 
// The encoding used in the IFSR can be Long-descriptor format or Short-descriptor format. 
// Normally, the current translation table format determines the format. For an abort from 
// Non-secure state to Monitor mode, the IFSR uses the Long-descriptor format if any of the 
// following applies: 
// » The Secure TIBCR.EAE is set to 1. 
// » It is taken from Hyp mode. 
// » It is taken from EL1 or EL@, and the Non-secure TTBCR.EAE is set to 1. 
long_format = FALSE; 
if route_to_monitor && !IsSecure() then 
long_format = TTBCR_S.EAE == '1' || PSTATE.EL == EL2 || TTBCR.EAE == '1'; 
else 
long_format = TTBCR.EAE == '1'; 


d_side = FALSE; 
if long_format then 

fsr = AArch32.FaultStatusLD(d_side, fault); 
else 

fsr = AArch32.FaultStatusSD(d_side, fault); 


if route_to_monitor then 


IFSR_S = fsr; 

IFAR_S = vaddress; 
else 

IFSR = fsr; 


IFAR = vaddress; 


return; 


aarch32/exceptions/aborts/AArch32.TakeDataAbortException 


// AArch32.TakeDataAbortException() 
[e 


AArch32.TakeDataAbortException(bits(32) vaddress, FaultRecord fault) 
route_to_monitor = HaveEL(EL3) && SCR.EA == '1' && IsExternalAbort(fault) ; 
route_to_hyp = (HaveEL(EL2) && !IsSecure() && PSTATE.EL IN {EL@, EL1} && 

(HCR.TGE == '1' || IsSecondStage(fault) | 
(HaveRASExt() && HCR2.TEA == '1' && IsExternalAbort(fault)) || 
(IsDebugException(fault) && HDCR.TDE == '1'))); 
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bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x10; 
lr_offset = 8; 


if IsDebugException(fault) then DBGDSCRext.MOE = fault.debugmoe; 
if route_to_monitor then 
AArch32.ReportDataAbort(route_to_monitor, fault, vaddress); 
AArch32.EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); 
elsif PSTATE.EL == EL2 || route_to_hyp then 
exception = AArch32.AbortSyndrome(Exception_DataAbort, fault, vaddress); 
if PSTATE.EL == EL2 then 
AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset) ; 
else 
AArch32.EnterHypMode(exception, preferred_exception_return, 0x14); 
else 
AArch32.ReportDataAbort(route_to_monitor, fault, vaddress); 
AArch32.EnterMode(M32_Abort, preferred_exception_return, lr_offset, vect_offset) ; 


aarch32/exceptions/aborts/AArch32. TakePrefetchAbortException 


// AArch32.TakePrefetchAbortException() 
——— eee 


AArch32.TakePrefetchAbortException(bits(32) vaddress, FaultRecord fault) 
route_to_monitor = HaveEL(EL3) && SCR.EA == '1' && IsExternalAbort(fault) ; 
route_to_hyp = (HaveEL(EL2) && !IsSecure() && PSTATE.EL IN {EL@, EL1} && 

(HCR.TGE == '1' || IsSecondStage(fault) | 
(HaveRASExt() && HCR2.TEA == '1' && IsExternalAbort(fault)) || 
(IsDebugException(fault) && HDCR.TDE == '1'))); 


bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x0C; 
lr_offset = 4; 


if IsDebugException(fault) then DBGDSCRext.MOE = fault.debugmoe; 
if route_to_monitor then 
AArch32.ReportPrefetchAbort(route_to_monitor, fault, vaddress); 
AArch32.EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); 
elsif PSTATE.EL == EL2 || route_to_hyp then 
if fault.statuscode == Fault_Alignment then // PC Alignment fault 
exception = ExceptionSyndrome(Exception_PCAlignment) ; 
exception.vaddress = ThisInstrAddr(); 
else 
exception = AArch32.AbortSyndrome(Exception_InstructionAbort, fault, vaddress); 
if PSTATE.EL == EL2 then 
AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset) ; 
else 
AArch32.EnterHypMode(exception, preferred_exception_return, 0x14); 
else 
AArch32.ReportPrefetchAbort(route_to_monitor, fault, vaddress); 
AArch32.EnterMode(M32_Abort, preferred_exception_return, lr_offset, vect_offset) ; 


aarch32/exceptions/aborts/BranchTargetException 
// BranchTargetException 
// Raise branch target exception. 
AArch64.BranchTargetException(bits(52) vaddress) 
route_to_el2 = PSTATE.EL == ELO && EL2Enabled() && HCR_EL2.1TGE == '1'; 
bits(64) preferred_exception_return = ThisInstrAddr(); 


vect_offset = 0x0; 


exception = ExceptionSyndrome(Exception_BranchTarget) ; 
exception.syndrome<1:0> = PSTATE.BTYPE; 
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exception.syndrome<24:2> = Zeros(); // RESO 


if UInt(PSTATE.EL) > UInt(EL1) then 

AArch64.TakeException(PSTATE.EL, exception, preferred_exception_return, vect_offset) ; 
elsif route_to_el2 then 

AArch64.TakeException(EL2, exception, preferred_exception_return, vect_offset); 
else 

AArch64.TakeException(EL1, exception, preferred_exception_return, vect_offset) ; 


aarch32/exceptions/asynch/AArch32. TakePhysicalFIQException 


// AArch32.TakePhysicalFIQException() 


AArch32.TakePhysicalFIQException() 


// Check if routed to AArch64 state 

route_to_aarch64 = PSTATE.EL == EL@ && !ELUsingAArch32(EL1); 

if !route_to_aarch64 && EL2Enabled() && !ELUsingAArch32(EL2) then 
route_to_aarch64 = HCR_EL2.TGE == '1' || (HCR_EL2.FMO == '1' && !IsInHost()); 


if !route_to_aarch64 && HaveEL(EL3) && !ELUsingAArch32(EL3) then 
route_to_aarch64 = SCR_EL3.FIQ == '1'; 


if route_to_aarch64 then AArch64.TakePhysicalFIQException(); 
route_to_monitor = HaveEL(EL3) && SCR.FIQ == '1'; 
route_to_hyp = (PSTATE.EL IN {ELQ, EL1} && EL2Enabled() && 
(HCR.TGE == '1' || HCR.FMO == '1')); 

bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x1C; 
lr_offset = 4; 
if route_to_monitor then 

AArch32.EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); 
elsif PSTATE.EL == EL2 || route_to_hyp then 

exception = ExceptionSyndrome(Exception_F1Q) ; 

AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset) ; 
else 

AArch32.EnterMode(M32_F1Q, preferred_exception_return, lr_offset, vect_offset); 


aarch32/exceptions/asynch/AArch32.TakePhysicallRQException 
// AArch32.TakePhysicalIRQException() 

// Take an enabled physical IRQ exception. 

AArch32.TakePhysicalIRQException() 


// Check if routed to AArch64 state 
route_to_aarch64 = PSTATE.EL == EL@ && !ELUsingAArch32(EL1); 
if !route_to_aarch64 && EL2Enabled() && !ELUsingAArch32(EL2) then 
route_to_aarch64 = HCR_EL2.TGE == '1' || (HCR_EL2.IMO == '1' && !IsInHost()); 
if !route_to_aarch64 && HaveEL(EL3) && !ELUsingAArch32(EL3) then 
route_to_aarch64 = SCR_EL3.IRQ == '1'; 


if route_to_aarch64 then AArch64.TakePhysicalIRQException(); 


route_to_monitor = HaveEL(EL3) && SCR.IRQ == '1'; 
route_to_hyp = (PSTATE.EL IN {ELQ, EL1} && EL2Enabled() && 
(HCR.TGE == '1' || HCR.IMO == '1')); 

bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x18; 
lr_offset = 4; 
if route_to_monitor then 

AArch32.EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); 
elsif PSTATE.EL == EL2 || route_to_hyp then 

exception = ExceptionSyndrome(Exception_IRQ) ; 
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AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset); 
else 
AArch32.EnterMode(M32_IRQ, preferred_exception_return, lr_offset, vect_offset); 


aarch32/exceptions/asynch/AArch32. TakePhysicalSErrorException 


// AArch32.TakePhysicalSErrorException() 
[ia 


AArch32.TakePhysicalSErrorException(boolean parity, bit extflag, bits(2) errortype, 
boolean impdef_syndrome, bits(24) full_syndrome) 


ClearPendingPhysicalSError(); 
// Check if routed to AArch64 state 
route_to_aarch64 = PSTATE.EL == ELO && !ELUsingAArch32(EL1); 


if !route_to_aarch64 && EL2Enabled() && !ELUsingAArch32(EL2) then 

route_to_aarch64 = (HCR_EL2.TGE == '1' || (!IsInHost() && HCR_EL2.AMO == '1')); 
if !route_to_aarch64 && HaveEL(EL3) && !ELUsingAArch32(EL3) then 

route_to_aarch64 = SCR_EL3.EA == '1'; 


if route_to_aarch64 then 
AArch64.TakePhysicalSErrorException(impdef_syndrome, full_syndrome) ; 


route_to_monitor = HaveEL(EL3) && SCR.EA == '1'; 

route_to_hyp = (PSTATE.EL IN {ELQ, EL1} && EL2Enabled() && 
(HCR.TGE == '1' || HCR.AMO == '1')); 

bits(32) preferred_exception_return = ThisInstrAddr(); 

vect_offset = 0x10; 

lr_offset = 8; 


fault = AArch32.AsynchExternalAbort(parity, errortype, extflag); 
vaddress = bits(32) UNKNOWN; 
if route_to_monitor then 
AArch32.ReportDataAbort(route_to_monitor, fault, vaddress); 
AArch32.EnterMonitorMode(preferred_exception_return, lr_offset, vect_offset); 
elsif PSTATE.EL == EL2 || route_to_hyp then 
exception = AArch32.AbortSyndrome(Exception_DataAbort, fault, vaddress); 
if PSTATE.EL == EL2 then 
AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset) ; 
else 
AArch32.EnterHypMode(exception, preferred_exception_return, 0x14); 
else 
AArch32.ReportDataAbort(route_to_monitor, fault, vaddress); 
AArch32.EnterMode(M32_Abort, preferred_exception_return, lr_offset, vect_offset) ; 


aarch32/exceptions/asynch/AArch32. TakeVirtualFIQException 


// AArch32.TakeVirtualFIQException() 
// ETEEN 


AArch32.TakeVirtual FIQException() 
assert PSTATE.EL IN {ELQ, EL1} && EL2Enabled(); 
if ELUsingAArch32(EL2) then // Virtual IRQ enabled if TGE==@ and FMO==1 
assert HCR.TGE == '@' && HCR.FMO == '1'; 
else 
assert HCR_EL2.TGE == '@' && HCR_EL2.FMO == '1'; 
// Check if routed to AArch64 state 
if PSTATE.EL == EL@ && !ELUsingAArch32(EL1) then AArch64.TakeVirtualFIQException(); 


bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = Ox1C; 
lr_offset = 4; 


AArch32.EnterMode(M32_FIQ, preferred_exception_return, lr_offset, vect_offset); 
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aarch32/exceptions/asynch/AArch32. TakeVirtuallRQException 


// AArch32.TakeVirtualIRQException() 


AArch32.TakeVirtual IRQException() 


assert PSTATE.EL IN {ELQ, EL1} && EL2Enabled(); 


if ELUsingAArch32(EL2) then // Virtual IRQs enabled if TGE==@ and IMO==1 
assert HCR.TGE == '@' && HCR.IMO == '1'; 

else 
assert HCR_EL2.TGE == '@' && HCR_EL2.IMO == '1'; 


// Check if routed to AArch64 state 
if PSTATE.EL == ELO && !ELUsingAArch32(EL1) then AArch64.TakeVirtualIRQException(); 


bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x18; 
lr_offset = 4; 


AArch32.EnterMode(M32_IRQ, preferred_exception_return, lr_offset, vect_offset); 


aarch32/exceptions/asynch/AArch32. TakeVirtualSErrorException 


// AArch32.TakeVirtualSErrorException() 


AArch32.TakeVirtualSErrorException(bit extflag, bits(2) errortype, boolean impdef_syndrome, bits(24) 
full_syndrome) 


assert PSTATE.EL IN {ELQ, EL1} && EL2Enabled(); 
if ELUsingAArch32(EL2) then // Virtual SError enabled if TGE==0 and AMO==1 
assert HCR.TGE == '@' && HCR.AMO == '1'; 
else 
assert HCR_EL2.TGE == '@' && HCR_EL2.AMO == '1'; 
// Check if routed to AArch64 state 
if PSTATE.EL == ELO && !ELUsingAArch32(EL1) then AArch64.TakeVirtualSErrorException(impdef_syndrome, 


full_syndrome) ; 


route_to_monitor = FALSE; 


bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x10; 
lr_offset = 8; 


vaddress = bits(32) UNKNOWN; 
parity = FALSE; 
if HaveRASExt() then 
if ELUsingAArch32(EL2) then 
fault = AArch32.AsynchExternalAbort(FALSE, VDFSR.AET, VDFSR.ExT); 
else 
fault = AArch32.AsynchExternalAbort(FALSE, VSESR_EL2.AET, VSESR_EL2.ExT); 
else 
fault = AArch32.AsynchExternalAbort(parity, errortype, extflag); 


ClearPendingVirtualSError(); 
AArch32.ReportDataAbort(route_to_monitor, fault, vaddress); 
AArch32.EnterMode(M32_Abort, preferred_exception_return, lr_offset, vect_offset); 


aarch32/exceptions/debug/AArch32.SoftwareBreakpoint 


// AArch32.SoftwareBreakpoint() 


AArch32.SoftwareBreakpoint(bits(16) immediate) 
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if (EL2Enabled() && !ELUsingAArch32(EL2) && 
(HCR_EL2.TGE == '1' || MDCR_EL2.TDE == '1')) || !ELUsingAArch32(EL1) then 
AArch64.SoftwareBreakpoint(immediate); 

vaddress = bits(32) UNKNOWN; 

acctype = AccType_IFETCH; // Take as a Prefetch Abort 

iswrite = FALSE; 

entry = DebugException_BKPT; 


fault = AArch32.DebugFault(acctype, iswrite, entry); 
AArch32.Abort(vaddress, fault); 


aarch32/exceptions/debug/DebugException 


constant bits(4) DebugException_Breakpoint = '0001'; 
constant bits(4) DebugException_BKPT = '0011'; 
constant bits(4) DebugException_VectorCatch = 'Q101'; 
constant bits(4) DebugException_Watchpoint = '1010'; 


aarch32/exceptions/exceptions/AArch32.CheckAdvSIMDOrFPRegisterTraps 


// AArch32.CheckAdvSIMDOrFPRegisterTraps() 
[Ue 

// Check if an instruction that accesses an Advanced SIMD and 

// floating-point System register is trapped by an appropriate HCR.TIDx 
// ID group trap control. 


AArch32.CheckAdvSIMDOrFPRegisterTraps(bits(4) reg) 


if PSTATE.EL == EL1 && EL2Enabled() then 
tid®@ = if ELUsingAArch32(EL2) then HCR.TIDO else HCR_EL2.TIDQ; 
tid3 = if ELUsingAArch32(EL2) then HCR.TID3 else HCR_EL2.TID3; 


if (tid@ == '1' && reg == '0000') // FPSID 
|| (tid3 == '1' && reg IN {'0101', '0110', 'Q111'}) then // MVFRx 
if ELUsingAArch32(EL2) then 
AArch32.SystemAccessTrap(M32_Hyp, 0x8); // Exception_AdvSIMDFPAccessTrap 
else 
AArch64.AArch32SystemAccessTrap(EL2, 0x8); // Exception_AdvSIMDFPAccessTrap 


aarch32/exceptions/exceptions/AArch32.ExceptionClass 
// AArch32.ExceptionClass() 
7 Returns the Exception Class and Instruction Length fields to be reported in HSR 
(integer,bit) AArch32.ExceptionClass(Exception exceptype) 
il = if ThisInstrLength() == 32 then '1' else '0'; 


case exceptype of 


when Exception_Uncategorized ec = 0x00; il = '1'; 
when Exception_WFxTrap ec = 0x01; 
when Exception_CP15RTTrap ec = 0x03; 
when Exception_CP15RRTTrap ec = 0x04; 
when Exception_CP14RTTrap ec = 0x05; 
when Exception_CP14DTTrap ec = 0x06; 
when Exception_AdvSIMDFPAccessTrap ec = 0x07; 
when Exception_FPIDTrap ec = 0x08; 
when Exception_PACTrap ec = 0x09; 
when Exception_CP14RRTTrap ec = Ox0C; 
when Exception_BranchTarget ec = 0x0D; 
when Exception_I]1legalState ec = Ox@E; il = '1'; 
when Exception_SupervisorCal] ec = 0x11; 
when Exception_HypervisorCal] ec = 0x12; 
when Exception_MonitorCal1 ec = 0x13; 
when Exception_ERetTrap ec = 0x1A; 
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when Exception_InstructionAbort ec = 0x20; il = '1'; 
when Exception_PCAlignment ec = 0x22; il = '1'; 
when Exception_DataAbort ec = 0x24; 

when Exception_NV2DataAbort ec = 0x25; 

when Exception_FPTrappedException ec = Qx28; 

otherwise Unreachable(); 


if ec IN {0x20,0x24} && PSTATE.EL == EL2 then 
ec = ec + 1; 


return (ec,il); 


aarch32/exceptions/exceptions/AArch32.GeneralExceptions ToAArch64 
// AArch32.GeneralExceptionsToAArch64() 
// Returns TRUE if exceptions normally routed to EL1 are being handled at an Exception 
// level using AArch64, because either EL1 is using AArch64 or TGE is in force and EL2 
// is using AArch6é4. 
boolean AArch32.GeneralExceptionsToAArch64() 
return ((PSTATE.EL == ELO && !ELUsingAArch32(EL1)) || 
(EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1')); 
aarch32/exceptions/exceptions/AArch32.ReportHypEntry 
// AArch32.ReportHypEntry() 
// Report syndrome information to Hyp mode registers. 
AArch32.ReportHypEntry(ExceptionRecord exception) 


Exception exceptype = exception.exceptype; 


(ec,il) = AArch32.ExceptionClass(exceptype) ; 
iss = exception.syndrome; 


// IL is not valid for Data Abort exceptions without valid instruction syndrome information 
if ec IN {@x24,0x25} && iss<24> == '@' then 
il='1'; 


HSR = ec<5:0>:i1:iss; 


if exceptype IN {Exception_InstructionAbort, Exception_PCAlignment} then 
HIFAR = exception.vaddress<31:0>; 

HDFAR = bits(32) UNKNOWN; 

elsif exceptype == Exception_DataAbort then 

HIFAR = bits(32) UNKNOWN; 

HDFAR = exception. vaddress<31:0>; 


if exception.ipavalid then 
HPFAR<31:4> = exception. ipaddress<39:12>; 
else 





HPFAR<31:4> = bits(28) UNKNOWN; 


return; 


aarch32/exceptions/exceptions/AArch32.ResetC ontrolRegisters 


// Resets System registers and memory-mapped control registers that have architectural ly-defined 
// reset values to those values. 
AArch32.ResetControlRegisters(boolean cold_reset); 
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aarch32/exceptions/exceptions/AArch32.TakeReset 


// AArch32.TakeReset() 
[I ace 
// Reset into AArch32 state 


AArch32.TakeReset(boolean cold_reset) 
assert HighestELUsingAArch32(); 


// Enter the highest implemented Exception level in AArch32 state 
if HaveEL(EL3) then 
AArch32.WriteMode(M32_Svc); 
SCR.NS = 'Q'; // Secure state 
elsif HaveEL(EL2) then 
AArch32.WriteMode(M32_Hyp) ; 
else 
AArch32.WriteMode(M32_Svc); 


// Reset the CP14 and CP15 registers and other system components 
AArch32.ResetControlRegisters(cold_reset) ; 
FPEXC.EN = 'Q'; 


// Reset all other PSTATE fields, including instruction set and endianness according to the 
// SCTLR values produced by the above call to ResetControlRegisters() 


PSTATE.<A,1I,F> = '111'; // All asynchronous exceptions masked 

PSTATE.IT = 'Q0000000'; // IT block state reset 

PSTATE.T = SCTLR.TE; // Instruction set: TE=@: A32, TE=1: T32. PSTATE.J is RESO. 
PSTATE.E = SCTLR.EE; // Endianness: EE=@: little-endian, EE=1: big-endian 
PSTATE.IL = 'Q'; // Clear Illegal Execution state bit 


// All registers, bits and fields not reset by the above pseudocode or by the BranchTo() call 
// below are UNKNOWN bitstrings after reset. In particular, the return information registers 
// R14 or ELR_hyp and SPSR have UNKNOWN values, so that it 

// is impossible to return from a reset in an architecturally defined way. 
AArch32.ResetGeneralRegisters(); 

AArch32.ResetSIMDFPRegisters(); 

AArch32.ResetSpecialRegisters(); 

ResetExternalDebugRegisters(cold_reset) ; 





bits(32) rv; // IMPLEMENTATION DEFINED reset vector 
if HaveEL(EL3) then 
if MVBAR<@> == '1' then // Reset vector in MVBAR 
rv = MVBAR<31:1>:'0'; 
else 


rv = bits(32) IMPLEMENTATION_DEFINED "reset vector address"; 
else 
rv = RVBAR<31:1>:'0'; 


// The reset vector must be correctly aligned 
assert rv<0> == 'Q' && (PSTATE.T == '1' || rv<l> == '0'); 


BranchTo(rv, BranchType_RESET) ; 


aarch32/exceptions/exceptions/ExcVectorBase 


// ExcVectorBase() 


bits(32) ExcVectorBase() 
if SCTLR.V == '1' then // Hivecs selected, base = OxFFFFQ000 
return Ones(16):Zeros(16); 
else 
return VBAR<31:5>:Zeros(5); 


J1-7434 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Armv8 Pseudocode 
J1.2 Pseudocode for AArch32 operation 


aarch32/exceptions/ieeefp/AArch32.FPTrappedException 


// AArch32.FPTrappedException() 
// ascen 


AArch32.FPTrappedException(bits(8) accumulated_exceptions) 
if AArch32.GeneralExceptionsToAArch64() then 
is_ase = FALSE; 


element = Q; 
AArch64.FPTrappedException(is_ase, element, accumulated_exceptions) ; 
FPEXC.DEX = '1'; 
FPEXC. TFV = '1'; 
FPEXC<7,4:0> = accumulated_exceptions<7,4:0>; // IDF, IXF,UFF,OFF,DZF, IOF 
FPEXC<10:8> = '111'; // VECITR is RES1 


AArch32.TakeUndefInstrException(); 


aarch32/exceptions/syscalls/AArch32.CallHypervisor 
// AArch32.CallHypervisor() 
// Performs a HVC call 


AArch32.CallHypervisor(bits(16) immediate) 
assert HaveEL(EL2); 


if !ELUsingAArch32(EL2) then 
AArch64.CallHypervisor(immediate) ; 

else 
AArch32.TakeHVCException(immediate) ; 


aarch32/exceptions/syscalls/AArch32.CallSupervisor 
// AArch32.Cal1Supervisor() 

// Calls the Supervisor 

AArch32.CallSupervisor(bits(16) immediate) 


if AArch32.CurrentCond() != '1110' then 
immediate = bits(16) UNKNOWN; 

if AArch32.GeneralExceptionsToAArch64() then 
AArch64.Cal1Supervisor(immediate) ; 

else 
AArch32.TakeSVCException(immediate) ; 


aarch32/exceptions/syscalls/AArch32. TakeHVCException 


// AArch32.TakeHVCException() 


AArch32.TakeHVCException(bits(16) immediate) 
assert HaveEL(EL2) && ELUsingAArch32(EL2); 


AArch32.1TAdvance(); 

SSAdvance(); 

bits(32) preferred_exception_return = NextInstrAddr(); 
vect_offset = 0x08; 


exception = ExceptionSyndrome(Exception_HypervisorCal1); 
exception.syndrome<15:0> = immediate; 


if PSTATE.EL == EL2 then 

AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset) ; 
else 

AArch32.EnterHypMode(exception, preferred_exception_return, 0x14); 
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aarch32/exceptions/syscalls/AArch32.TakeSMCException 


// AArch32.TakeSMCException() 
// ========================== 


AArch32.TakeSMCException() 
assert HaveEL(EL3) && ELUsingAArch32(EL3); 
AArch32.1TAdvance(); 
SSAdvance(); 
bits(32) preferred_exception_return = NextInstrAddr(); 
vect_offset = 0x08; 
lr_offset = 0; 


AArch32.EnterMonitorMode(preferred_exception_return, Ir_offset, vect_offset) ; 


aarch32/exceptions/syscalls/AArch32.TakeSVCException 


// AArch32.TakeSVCException() 
// ========================== 


AArch32.TakeSVCException(bits(16) immediate) 


AArch32.1TAdvance(); 
SSAdvance(); 


route_to_hyp = PSTATE.EL == ELO && EL2Enabled() && HCR.TGE == '1'; 


bits(32) preferred_exception_return = NextInstrAddr(); 
vect_offset = 0x08; 
lr_offset = Q; 


if PSTATE.EL == EL2 || route_to_hyp then 
exception = ExceptionSyndrome(Exception_SupervisorCal1); 
exception.syndrome<15:0> = immediate; 
if PSTATE.EL == EL2 then 


AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset) ; 


else 


AArch32.EnterHypMode(exception, preferred_exception_return, 0x14); 


else 


AArch32.EnterMode(M32_Svc, preferred_exception_return, lr_offset, vect_offset); 


aarch32/exceptions/takeexception/AArch32.EnterHypMode 


// AArch32.EnterHypMode() 





// Take an exception to Hyp mode. 


AArch32.EnterHypMode(ExceptionRecord exception, bits(32) preferred_exception_return, 


integer vect_offset) 
SynchronizeContext(); 
assert HaveEL(EL2) && !IsSecure() && ELUsingAArch32(EL2); 


spsr = GetPSRFromPSTATE(); 

if !(exception.exceptype IN {Exception_IRQ, Exception_FIQ}) then 
AArch32.ReportHypEntry (exception) ; 

AArch32.WriteMode(M32_Hyp); 


SPSR[] = spsr; 

ELR_hyp = preferred_exception_return; 

PSTATE.T = HSCTLR.TE; // PSTATE.J is RESO 
PSTATE.SS = '0'; 

if !HaveEL(EL3) || SCR_GEN[].EA == '@' then PSTATE.A = '1'; 

if !HaveEL(EL3) || SCR_GEN[].IRQ == '@' then PSTATE.I = '1'; 
if !HaveEL(EL3) || SCR_GEN[].FIQ == '@' then PSTATE.F = '1'; 


PSTATE.E = HSCTLR.EE; 

PSTATE.IL = 'Q'; 

PSTATE.IT = '00000000'; 

if HaveSSBSExt() then PSTATE.SSBS = HSCTLR.DSSBS; 
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BranchTo(HVBAR<31:5>:vect_offset<4:0>, BranchType_EXCEPTION) ; 


EndOfInstruction(); 


aarch32/exceptions/takeexception/AArch32.EnterMode 


// AArch32.EnterMode() 
// Take an exception to a mode other than Monitor and Hyp mode. 


AArch32.EnterMode(bits(5) target_mode, bits(32) preferred_exception_return, integer Ir_offset, 
integer vect_offset) 
SynchronizeContext(); 
assert ELUsingAArch32(EL1) && PSTATE.EL != EL2; 


spsr = GetPSRFromPSTATE(); 
if PSTATE.M == M32_Monitor then SCR.NS = 'Q'; 
AArch32.WriteMode(target_mode) ; 
SPSR[] = spsr; 
R[14] = preferred_exception_return + lr_offset; 
PSTATE.T = SCTLR.TE; // PSTATE.J is RESO 
PSTATE.SS = 'Q'; 
if target_mode == M32_FIQ then 
PSTATE.<A,I,F> = '111'; 
elsif target_mode IN {M32_Abort, M32_IRQ} then 
PSTATE.<A,I> = '11'; 


else 

PSTATE.I = '1'; 
PSTATE.E = SCTLR.EE; 
PSTATE.IL = 'Q'; 





PSTATE.IT = 'Q0000000'; 

if HavePANExt() && SCTLR.SPAN == '@' then PSTATE.PAN = '1'; 

if HaveSSBSExt() then PSTATE.SSBS = SCTLR.DSSBS; 
BranchTo(ExcVectorBase()<31:5>:vect_offset<4:0>, BranchType_EXCEPTION) ; 


EndOfInstruction(); 


aarch32/exceptions/takeexception/AArch32.EnterMonitorMode 
// AArch32.EnterMonitorMode() 
// Take an exception to Monitor mode. 


AArch32.EnterMonitorMode(bits(32) preferred_exception_return, integer lr_offset, 

integer vect_offset) 

SynchronizeContext(); 

assert HaveEL(EL3) && ELUsingAArch32(EL3); 

from_secure = IsSecure(); 

spsr = GetPSRFromPSTATE(); 

if PSTATE.M == M32_Monitor then SCR.NS = 'Q'; 

AArch32.WriteMode(M32_Monitor) ; 


SPSR[] = spsr; 

R[14] = preferred_exception_return + Ir_offset; 

PSTATE.T = SCTLR.TE; // PSTATE.J is RESO 
PSTATE.SS = '0'; 


PSTATE.<A,I,F> = '111'; 
PSTATE.E = SCTLR.EE; 
PSTATE.IL = 'Q'; 
PSTATE.IT = '00000000'; 
if HavePANExt() then 
if !from_secure then 
PSTATE.PAN = 'Q'; 
elsif SCTLR.SPAN == 'Q' then 
PSTATE.PAN = '1'; 
if HaveSSBSExt() then PSTATE.SSBS = SCTLR.DSSBS; 
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BranchTo(MVBAR<31:5>:vect_offset<4:0>, BranchType_EXCEPTION) ; 


EndOfInstruction(); 


aarch32/exceptions/traps/AArch32.CheckAdvSIMDOrFPEnabled 
// AArch32.CheckAdvSIMDOrFPEnabled() 
// Check against CPACR, FPEXC, HCPTR, NSACR, and CPTR_EL3. 


AArch32.CheckAdvSIMDOrFPEnabled(boolean fpexc_check, boolean advsimd) 
if PSTATE.EL == EL@ && (!HaveEL(EL2) || (!ELUsingAArch32(EL2) && HCR_EL2.TGE == '@')) 
!ELUsingAArch32(EL1) then 
// The PE behaves as if FPEXC.EN is 1 
AArch64.CheckFPAdvSIMDEnabled(); 


&& 


elsif PSTATE.EL == ELO && HaveEL(EL2) && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' && 


!ELUsingAArch32(EL1) then 
if fpexc_check && HCR_EL2.RW == 'Q' then 


fpexc_en = bits(1) IMPLEMENTATION_DEFINED "FPEXC.EN value when TGE==1 and RW==0"; 


if fpexc_en == '@' then UNDEFINED; 
AArch64.CheckFPAdvSIMDEnabled() ; 
else 
cpacr_asedis = CPACR.ASEDIS; 
cpacr_cp10 = CPACR.cp10; 


if HaveEL(EL3) && ELUsingAArch32(EL3) && !IsSecure() then 
// Check if access disabled in NSACR 
if NSACR.NSASEDIS == '1' then cpacr_asedis = '1'; 
if NSACR.cp10 == '@' then cpacr_cp10 = '00'; 


if PSTATE.EL != EL2 then 
// Check if Advanced SIMD disabled in CPACR 
if advsimd && cpacr_asedis == '1' then UNDEFINED; 


if cpacr_cp10 == '10' then 
(c, cpacr_cp10) = ConstrainUnpredictableBits(); 


// Check if access disabled in CPACR 

case cpacr_cpl0 of 
when '00' disabled = TRUE; 
when '@1' disabled = PSTATE.EL == ELQ; 
when '11' disabled = FALSE; 

if disabled then UNDEFINED; 


// If required, check FPEXC enabled bit. 
if fpexc_check && FPEXC.EN == '@' then UNDEFINED; 


AArch32.CheckFPAdvSIMDTrap(advsimd) ; // Also check against HCPTR and CPTR_EL3 


aarch32/exceptions/traps/AArch32.CheckFPAdvSIMDTrap 
// AArch32.CheckFPAdvSIMDTrap( ) 
// Check against CPTR_EL2 and CPTR_EL3. 


AArch32.CheckFPAdvSIMDTrap(boolean advsimd) 
if EL2Enabled() && !ELUsingAArch32(EL2) then 
AArch64.CheckFPAdvSIMDTrap() ; 
else 
if HaveEL(EL2) && !IsSecure() then 
hcptr_tase = HCPTR.TASE; 
hcptr_cp1@ = HCPTR.TCP10; 


if HaveEL(EL3) && ELUsingAArch32(EL3) && !IsSecure() then 
// Check if access disabled in NSACR 
if NSACR.NSASEDIS == '1' then hcptr_tase = '1'; 
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if NSACR.cp10 == 'Q' then hcptr_cp10 = '1'; 


// Check if access disabled in HCPTR 

if (advsimd && hcptr_tase == '1') || hcptr_cp10 == '1' then 
exception = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap); 
exception.syndrome<24:20> = ConditionSyndrome(); 


if advsimd then 
exception.syndrome<5> = '1'; 
else 
exception.syndrome<5> = 'Q'; 
exception.syndrome<3:0> = '1010'; // coproc field, always @xA 


if PSTATE.EL == EL2 then 
AArch32.TakeUndefInstrException(exception) ; 
else 
AArch32.TakeHypTrapException(exception) ; 


if HaveEL(EL3) && !ELUsingAArch32(EL3) then 
// Check if access disabled in CPTR_EL3 
if CPTR_EL3.TFP == '1' then AArch64.AdvSIMDFPAccessTrap(EL3); 
return; 


aarch32/exceptions/traps/AArch32.CheckForSMCUndefOrTrap 
// AArch32.CheckForSMCUndef0rTrap() 
// Check for UNDEFINED or trap on SMC instruction 


AArch32.CheckForSMCUndefOrTrap() 
if !HaveEL(EL3) || PSTATE.EL == EL@ then 
UNDEFINED; 


if EL2Enabled() && !ELUsingAArch32(EL2) then 
AArch64.CheckForSMCUndefOrTrap(Zeros(16)); 
else 
route_to_hyp = HaveEL(EL2) && !IsSecure() && PSTATE.EL == EL1 && HCR.TSC == '1'; 
if route_to_hyp then 
exception = ExceptionSyndrome(Exception_MonitorCal1); 
AArch32.TakeHypTrapException(exception) ; 


aarch32/exceptions/traps/AArch32.CheckForWFxTrap 
// AArch32.CheckForWFxTrap() 
// Check for trap on WFE or WFI instruction 


AArch32.CheckForWFxTrap(bits(2) target_el, boolean is_wfe) 
assert HaveEL(target_el); 


// Check for routing to AArch64 
if !ELUsingAArch32(target_el) then 
AArch64.CheckForWFxTrap(target_el, is_wfe); 
return; 
case target_el of 
when EL1 trap = (if is_wfe then SCTLR.nTWE else SCTLR.nTWI) == 'Q'; 
when EL2 trap = (if is_wfe then HCR.TWE else HCR.TWI) == '1'; 
when EL3 trap = (if is_wfe then SCR.TWE else SCR.TWI) == '1'; 
if trap then 
if target_el == EL1 && EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TGE == '1' then 
AArch64.WFxTrap(target_el, is_wfe); 
if target_el == EL3 then 
AArch32.TakeMonitorTrapException(); 
elsif target_el == EL2 then 
exception = ExceptionSyndrome(Exception_WFxTrap) ; 
exception. syndrome<24:2@> = ConditionSyndrome(); 
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exception.syndrome<ð> = if is_wfe then '1' else '0'; 
AArch32.TakeHypTrapException(exception) ; 

else 
AArch32.TakeUndefInstrException() ; 


aarch32/exceptions/traps/AArch32.CheckITEnabled 


// AArch32.CheckITEnabled() 
[e 
// Check whether the T32 IT instruction is disabled. 


AArch32.CheckITEnabled(bits(4) mask) 
if PSTATE.EL == EL2 then 
it_disabled = HSCTLR. ITD; 
else 
it_disabled = (if ELUsingAArch32(EL1) then SCTLR.ITD else SCTLR[].ITD); 
if it_disabled == '1' then 
if mask != '1000' then UNDEFINED; 


// Otherwise whether the IT block is allowed depends on hw1 of the next instruction. 
next_instr = AArch32.MemSingle[NextInstrAddr(), 2, AccType_IFETCH, TRUE]; 


if next_instr IN {'11xxxxxxxxxxxxxx', '1011xXXXXXXXXXXX', '10100xXXXXXXXXXX", 
'O1001xXXXXXXXXXX', 'Q10001xxx1111xxx', 'Q10001xx1xxxx111'} then 
// It is IMPLEMENTATION DEFINED whether the Undefined Instruction exception is 
// taken on the IT instruction or the next instruction. This is not reflected in 
// the pseudocode, which always takes the exception on the IT instruction. This 
// also does not take into account cases where the next instruction is UNPREDICTABLE. 
UNDEFINED; 


return; 


aarch32/exceptions/traps/AArch32.ChecklllegalState 
// AArch32.CheckI11legalState() 
// Check PSTATE.IL bit and generate Illegal Execution state exception if set. 


AArch32.CheckI11egalState() 
if AArch32.GeneralExceptionsToAArch64() then 
AArch64.CheckI11legalState(); 
elsif PSTATE.IL == '1' then 
route_to_hyp = PSTATE.EL == ELO && EL2Enabled() && HCR.TGE == '1'; 


bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x04; 


if PSTATE.EL == EL2 || route_to_hyp then 
exception = ExceptionSyndrome(Exception_I1legalState) ; 
if PSTATE.EL == EL2 then 
AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset) ; 
else 
AArch32.EnterHypMode(exception, preferred_exception_return, 0x14); 
else 
AArch32.TakeUndefInstrException(); 


aarch32/exceptions/traps/AArch32.CheckSETENDEnabled 


// AArch32.CheckSETENDEnabled() 
[I ean 
// Check whether the AArch32 SETEND instruction is disabled. 


AArch32.CheckSETENDEnab1ed() 
if PSTATE.EL == EL2 then 
setend_disabled = HSCTLR.SED; 
else 
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setend_disabled = (if ELUsingAArch32(EL1) then SCTLR.SED else SCTLR[].SED); 
if setend_disabled == '1' then 
UNDEFINED; 


return; 


aarch32/exceptions/traps/AArch32.SystemAccessTrap 
// AArch32.SystemAccessTrap() 
// Trapped system register access. 


AArch32.SystemAccessTrap(bits(5) mode, integer ec) 
(valid, target_el) = ELFromM32(mode) ; 
assert valid && HaveEL(target_el) && target_el != ELQ && UInt(target_el) >= UInt(PSTATE.EL); 


if target_el == EL2 then 
exception = AArch32.SystemAccessTrapSyndrome(ThisInstr(), ec); 
AArch32.TakeHypTrapException(exception) ; 

else 
AArch32.TakeUndefInstrException(); 


aarch32/exceptions/traps/AArch32.SystemAccessTrapSyndrome 
// AArch32.SystemAccessTrapSyndrome() 


// Returns the syndrome information for traps on AArch32 MCR, MCRR, MRC, MRRC, and VMRS, VMSR 
instructions, 
// other than traps that are due to HCPTR or CPACR. 


ExceptionRecord AArch32.SystemAccessTrapSyndrome(bits(32) instr, integer ec) 
ExceptionRecord exception; 


case ec of 
when 0x0 exception = ExceptionSyndrome 
when Qx3 exception = ExceptionSyndrome 
when 0x4 exception = ExceptionSyndrome(Exception_CP15RRTTrap) ; 
when Qx5 exception = ExceptionSyndrome(Exception_CP14RTTrap) 
when 0x6 exception = ExceptionSyndrome(Exception_CP14DTTrap) 
when Qx7 exception = ExceptionSyndrome(Exception_AdvSIMDFPAccessTrap) ; 
when 0x8 exception = ExceptionSyndrome(Exception_FPIDTrap) 
when @xC exception = ExceptionSyndrome(Exception_CP14RRTTrap) ; 
otherwise Unreachable(); 


Exception_Uncategorized) ; 
Exception_CP15RTTrap) ; 


aa ATS 


bits(20) iss = Zeros(); 


if exception.exceptype IN {Exception_FPIDTrap, Exception_CP14RTTrap, Exception_CP15RTTrap} then 
// Trapped MRC/MCR, VMRS on FPSID 


iss<19:17> = instr<7:5>; // opc2 
iss<16:14> = instr<23:21; // opcl 
jss<13:10> = instr<19:16>; // CRn 
iss<8:5> = instr<15:12>; // Rt 


elsif exception.exceptype IN {Exception_CP14RRTTrap, Exception_AdvSIMDFPAccesstTrap, 
Exception_CP15RRTTrap} then 
// Trapped MRRC/MCRR, VMRS/VMSR 


iss<19:16> = instr<7:4>; // opcl 
jss<13:10> = instr<19:16>; // Rt2 
iss<8:5> = instr<15:12>; // Rt 
iss<4:1> = instr<3:0>; // CRm 


elsif exception.exceptype == Exception_CP14DTTrap then 
// Trapped LDC/STC 


jss<19:12> = instr<7:0>; // imm8 
iss<4> = instr<23>; // U 
iss<2:1> = instr<24,21>; // P,W 


if instr<19:16> == '1111' then // Rn==15, LDC(Literal addressing) /STC 
iss<8:5> = bits(4) UNKNOWN; 
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iss<3> = '1'; 
elsif exception.exceptype == Exception_Uncategorized then 
// Trapped for unknown reason 


iss<8:5> = instr<19:16>; // Rn 
iss<3> = 'Q'; 
iss<Q> = instr<20>; // Direction 


exception. syndrome<24:20> = ConditionSyndrome(); 
exception.syndrome<19:0> = iss; 


return excepti on; 


aarch32/exceptions/traps/AArch32.TakeHypTrapException 
// AArch32.TakeHypTrapException() 
// Exceptions routed to Hyp mode as a Hyp Trap exception. 
AArch32.TakeHypTrapException(integer ec) 
exception = AArch32.SystemAccessTrapSyndrome(ThisInstr(), ec); 
AArch32.TakeHypTrapException(exception) ; 
// AArch32.TakeHypTrapException() 


// Exceptions routed to Hyp mode as a Hyp Trap exception. 


AArch32.TakeHypTrapException(ExceptionRecord exception) 
assert HaveEL(EL2) && !IsSecure() && ELUsingAArch32(EL2); 


bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x14; 


AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset) ; 


aarch32/exceptions/traps/AArch32.TakeMonitorTrapException 
// AArch32.TakeMonitorTrapException() 
| ae 


// Exceptions routed to Monitor mode as a Monitor Trap exception. 


AArch32.TakeMonitorTrapException() 
assert HaveEL(EL3) && ELUsingAArch32(EL3); 


bits(32) preferred_exception_return = ThisInstrAddr(); 
vect_offset = 0x04; 
lr_offset = if CurrentInstrSet() == InstrSet_A32 then 4 else 2; 


AArch32.EnterMonitorMode(preferred_exception_return, Ir_offset, vect_offset) ; 


aarch32/exceptions/traps/AArch32.TakeUndeflinstrException 


// AArch32.TakeUndefInstrException() 
————————————EE 
AArch32.TakeUndefInstrException() 

exception = ExceptionSyndrome(Exception_Uncategorized) ; 


AArch32.TakeUndefInstrException(exception) ; 


// AArch32.TakeUndefInstrException() 
// sssssessesessssassesesseeeeseeee= 


AArch32.TakeUndefInstrException(ExceptionRecord exception) 
route_to_hyp = PSTATE.EL == ELO && EL2Enabled() && HCR.TGE == '1'; 


bits(32) preferred_exception_return = ThisInstrAddr(); 
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vect_offset = 0x04; 
lr_offset = if CurrentInstrSet() == InstrSet_A32 then 4 else 2; 


if PSTATE.EL == EL2 then 
AArch32.EnterHypMode(exception, preferred_exception_return, vect_offset); 
elsif route_to_hyp then 
AArch32.EnterHypMode(exception, preferred_exception_return, 0x14); 
else 
AArch32.EnterMode(M32_Undef, preferred_exception_return, lr_offset, vect_offset); 


aarch32/exceptions/traps/AArch32.UndefinedFault 


// AArch32.UndefinedFault() 
// ======================== 


AArch32.UndefinedFault() 


if AArch32.GeneralExceptionsToAArch64() then AArch64.UndefinedFault(); 
AArch32.TakeUndefInstrException(); 


J1.2.3 aarch32/functions 


ARM DDI 0487E.a 
ID070919 


This section includes the following pseudocode functions: 

° aarch32/functions/aborts/AArch32.CreateFaultRecord on page J1-7445. 

° aarch32/functions/aborts/AArch32.Domain Valid on page J1-7445. 

° aarch32/functions/aborts/AArch32.FaultStatusLD on page J1-7446. 

e aarch32/functions/aborts/AArch32. FaultStatusSD on page J1-7446. 

a aarch32/functions/aborts/AArch32.FaultSyndrome on page J1-7446. 

° aarch32/functions/aborts/EncodeSDFSC on page J1-7447. 

< aarch32/functions/common/A32ExpandImm on page J1-7447. 

. aarch32/functions/common/A32ExpandImm_C on page J1-7448. 

a aarch32/functions/common/DecodelmmShift on page J1-7448. 

s aarch32/functions/common/DecodeRegShift on page J1-7448. 

$ aarch32/functions/common/RRX on page J1-7448. 

7 aarch32/functions/common/RRX_C on page J1-7449. 

s aarch32/functions/common/SRType on page J1-7449. 

° aarch32/functions/common/Shift on page J1-7449. 

$ aarch32/functions/common/Shift_C on page J1-7449. 

. aarch32/functions/common/T32ExpandImm on page J1-7449. 

° aarch32/functions/common/T32ExpandImm_C on page J1-7450. 

e aarch32/functions/coproc/AArch32.CheckCP15InstrCoarseTraps on page J1-7450. 
° aarch32/functions/exclusive/AArch32.ExclusiveMonitorsPass on page J1-7450. 
e aarch32/functions/exclusive/AArch32.IsExclusiveVA on page J1-7451. 

° aarch32/functions/exclusive/AArch32.MarkExclusive VA on page J1-7451. 
$ aarch32/functions/exclusive/AArch32.SetExclusiveMonitors on page J1-7451. 
7 aarch32/functions/float/CheckAdvSIMDEnabled on page J1-7452. 

$ aarch32/functions/float/CheckAdvSIMDOrVFPEnabled on page J1-7452. 
7 aarch32/functions/float/CheckCryptoEnabled32 on page J1-7452. 

s aarch32/functions/float/CheckVFPEnabled on page J1-7452. 

s aarch32/functions/float/FPHalvedSub on page J1-7452. 

. aarch32/functions/float/FPRSqrtStep on page J1-7453. 

. aarch32/functions/float/F PRecipStep on page J1-7453. 

. aarch32/functions/float/StandardFPSCR Value on page J1-7454. 

è aarch32/functions/memory/AArch32.CheckAlignment on page J1-7454. 

° aarch32/functions/memory/AArch32.MemSingle on page J1-7454. 
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aarch32/functions/memory/Hint_PreloadData on page J1-7455. 
aarch32/functions/memory/Hint_PreloadDataF or Write on page J1-7455. 
aarch32/functions/memory/Hint_PreloadInstr on page J1-7455. 
aarch32/functions/memory/MemA on page J1-7455. 
aarch32/functions/memory/MemO on page J1-7456. 
aarch32/functions/memory/MemU on page J1-7456. 
aarch32/functions/memory/MemU_unpriv on page J1-7456. 
aarch32/functions/memory/Mem_with_type on page J1-7456. 
aarch32/functions/ras/AArch32.ESBOperation on page J1-7457. 

aarch3 2/functions/ras/AArch32.PhysicalSErrorSyndrome on page J1-7458. 
aarch32/functions/ras/AArch32.ReportDeferredSError on page J1-7458. 
aarch32/functions/ras/AArch32.SErrorSyndrome on page J1-7459. 
aarch32/functions/ras/AArch32.vESB Operation on page J1-7459. 
aarch32/functions/registers/AArch32.ResetGeneralRegisters on page J1-7459. 
aarch32/functions/registers/AArch32.ResetSIMDF PRegisters on page J1-7459. 
aarch32/functions/registers/AArch32.ResetSpecialRegisters on page J1-7460. 
aarch32/functions/registers/AArch32.ResetSystemRegisters on page J1-7460. 
aarch32/functions/registers/ALUExceptionReturn on page J1-7460. 
aarch32/functions/registers/ALUWritePC on page J1-7460. 
aarch32/functions/registers/BXWritePC on page J1-7460. 
aarch32/functions/registers/BranchWritePC on page J1-7461. 
aarch32/functions/registers/D on page J1-7461. 
aarch32/functions/registers/Din on page J1-7461. 
aarch32/functions/registers/LR on page J1-7461. 
aarch32/functions/registers/LoadWritePC on page J1-7462. 
aarch32/functions/registers/LookUpRIndex on page J1-7462. 
aarch32/functions/registers/Monitor_mode_registers on page J1-7462. 
aarch32/functions/registers/PC on page J1-7462. 
aarch32/functions/registers/PCStoreValue on page J1-7462. 
aarch32/functions/registers/O on page J1-7463. 
aarch32/functions/registers/Qin on page J1-7463. 
aarch32/functions/registers/R on page J1-7463. 
aarch32/functions/registers/RBankSelect on page J1-7463. 
aarch32/functions/registers/Rmode on page J1-7464. 
aarch32/functions/registers/S on page J1-7464. 
aarch32/functions/registers/SP on page J1-7465. 
aarch32/functions/registers/_Dclone on page J1-7465. 
aarch32/functions/system/AArch32.ExceptionReturn on page J1-7465. 
aarch32/functions/system/AArch32.ExecutingATS1xPInstr on page J1-7465. 
aarch32/functions/system/AArch32.ExecutingCP 1 0or11Instr on page J1-7466. 
aarch32/functions/system/AArch32.ExecutingLSM Instr on page J1-7466. 
aarch32/functions/system/AArch32.1TAdvance on page J1-7466. 
aarch32/functions/system/AArch32.SysRegRead on page J1-7466. 
aarch32/functions/system/AArch32.SysRegRead64 on page J1-7466. 
aarch32/functions/system/AArch32.SysRegReadCanWriteAPSR on page J1-7466. 
aarch32/functions/system/AArch32.SysReg Write on page J1-7467. 
aarch32/functions/system/AArch32.SysRegWrite64 on page J1-7467. 
aarch32/functions/system/AArch32.WriteMode on page J1-7467. 
aarch32/functions/system/AArch32.WriteModeByInstr on page J1-7467. 
aarch32/functions/system/BadMode on page J1-7468. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential 1D070919 


ARM DDI 0487E.a 
ID070919 


Armv8 Pseudocode 
J1.2 Pseudocode for AArch32 operation 


aarch32/functions/system/BankedRegisterAccess Valid on page J1-7468. 
aarch32/functions/system/CPSR WriteByInstr on page J1-7469. 
aarch32/functions/system/ConditionPassed on page J1-7469. 
aarch32/functions/system/CurrentCond on page J1-7469. 
aarch32/functions/system/InITBlock on page J1-7469. 
aarch32/functions/system/LastInITBlock on page J1-7469. 
aarch32/functions/system/SPSRWriteByInstr on page J1-7470. 
aarch32/functions/system/SPSRaccessValid on page J1-7470. 
aarch32/functions/system/SelectInstrSet on page J1-7470. 
aarch32/functions/v6simd/Sat on page J1-7471. 
aarch32/functions/v6simd/SignedSat on page J1-7471. 
aarch32/functions/v6simd/UnsignedSat on page J1-7471. 


aarch32/functions/aborts/AArch32.CreateFaultRecord 


// AArch32.CreateFaultRecord() 


// 


FaultRecord AArch32.CreateFaultRecord(Fault statuscode, bits(4@) ipaddress, bits(4) domain, 


integer level, AccType acctype, boolean write, bit extflag, 
bits(4) debugmoe, bits(2) errortype, boolean secondstage, boolean 


s2fslwalk) 


FaultRecord fault; 
fault.statuscode = statuscode; 
if (statuscode != Fault_None && PSTATE.EL != EL2 && TTBCR.EAE == '@' && !secondstage && !s2fslwalk 


AArch32.DomainValid(statuscode, level)) then 
fault.domain = domain; 

else 
fault.domain = bits(4) UNKNOWN; 





fault.debugmoe = debugmoe; 

fault.errortype = errortype; 

fault.ipaddress.NS = bit UNKNOWN; 
fault.ipaddress.address = ZeroExtend(ipaddress); 
fault. level = level; 

fault.acctype = acctype; 

fault.write = write; 

fault.extflag = extflag; 

fault.secondstage = secondstage; 

fault.s2fslwalk = s2fslwalk; 


return fault; 


aarch32/functions/aborts/AArch32.DomainValid 


// AArch32.DomainValid() 


// Returns TRUE if the Domain is valid for a Short-descriptor translation scheme. 


boolean AArch32.DomainValid(Fault statuscode, integer level) 


assert statuscode != Fault_None; 


case statuscode of 
when Fault_Domain 
return TRUE; 
when Fault_Translation, Fault_AccessFlag, Fault_SyncExternalOnWalk, Fault_SyncParityOnWalk 
return level == 2; 
otherwise 
return FALSE; 
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aarch32/functions/aborts/AArch32.FaultStatusLD 


// AArch32.FaultStatusLD() 

[I aen 

// Creates an exception fault status value for Abort and Watchpoint exceptions taken 
// to Abort mode using AArch32 and Long-descriptor format. 


bits(32) AArch32.FaultStatusLD(boolean d_side, FaultRecord fault) 
assert fault.statuscode != Fault_None; 


bits(32) fsr = Zeros(); 
if HaveRASExt() && IsAsyncAbort(fault) then fsr<15:14> = fault.errortype; 
if d_side then 
if fault.acctype IN {AccType_DC, AccType_IC, AccType_AT} then 
fsr<13> = '1'; fsr<1l> = '1'; 
else 
fsr<ll> = if fault.write then '1' else 'Q'; 
if IsExternalAbort(fault) then fsr<12> = fault.extflag; 
fsr<9> = '1'; 
fsr<5:0> = EncodeLDFSC(fault.statuscode, fault. level); 


return fsr; 


aarch32/functions/aborts/AArch32.FaultStatusSD 
// AArch32.FaultStatusSD() 


// Creates an exception fault status value for Abort and Watchpoint exceptions taken 
// to Abort mode using AArch32 and Short-descriptor format. 


bits(32) AArch32.FaultStatusSD(boolean d_side, FaultRecord fault) 
assert fault.statuscode != Fault_None; 


bits(32) fsr = Zeros(); 
if HaveRASExt() && IsAsyncAbort(fault) then fsr<15:14> = fault.errortype; 
if d_side then 
if fault.acctype IN {AccType_DC, AccType_IC, AccType_AT} then 
fsr<13> = '1'; fsr<ll> = '1'; 
else 
fsr<ll> = if fault.write then '1' else 'Q'; 
if IsExternalAbort(fault) then fsr<12> = fault.extflag; 
fsr<9> = '0'; 
fsr<10,3:0> = EncodeSDFSC(fault.statuscode, fault. level); 
if d_side then 
fsr<7:4> = fault.domain; // Domain field (data fault only) 


return fsr; 


aarch32/functions/aborts/AArch32.FaultSyndrome 


// AArch32.FaultSyndrome() 

// sssssessseesssse======= 

// Creates an exception syndrome value for Abort and Watchpoint exceptions taken to 
// AArch32 Hyp mode. 


bits(25) AArch32.FaultSyndrome(boolean d_side, FaultRecord fault) 
assert fault.statuscode != Fault_None; 


bits(25) iss = Zeros(); 
if HaveRASExt() && IsAsyncAbort(fault) then iss<11:10> = fault.errortype; // AET 
if d_side then 
if IsSecondStage(fault) && !fault.s2fslwalk then iss<24:14> = LSInstructionSyndrome(); 
if fault.acctype IN {AccType_DC, AccType_DC_UNPRIV, AccType_IC, AccType_AT} then 
iss<8> = '1'; iss<6> = '1'; 
else 
iss<6> = if fault.write then '1' else 'Q'; 
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if IsExternalAbort(fault) then iss<9> = fault.extflag; 
iss<7> = if fault.s2fslwalk then '1' else '0'; 
iss<5:0> = EncodeLDFSC(fault.statuscode, fault.level); 


return iss; 


aarch32/functions/aborts/EncodeSDFSC 
// EncodeSDFSC() 
// Function that gives the Short-descriptor FSR code for different types of Fault 
bits(5) EncodeSDFSC(Fault statuscode, integer level) 


bits(5) result; 
case statuscode of 

when Fault_AccessFlag 

assert level IN {1,2}; 

result = if level == 1 then '00011' else 'Q0110'; 
when Fault_Alignment 

result = 'Q0001'; 
when Fault_Permission 

assert level IN {1,2}; 

result = if level == 1 then 'Q1101' else 'Q1111'; 
when Fault_Domain 

assert level IN {1,2}; 

result = if level == 1 then 'Q1001' else 'Q1011'; 
when Fault_Translation 

assert level IN {1,2}; 

result = if level == 1 then '00101' else 'QQ111'; 
when Fault_SyncExternal 

result = 'Q1000'; 
when Fault_SyncExternalOnWalk 

assert level IN {1,2}; 

result = if level == 1 then 'Q1100' else 'Q1110'; 
when Fault_SyncParity 

result = '11001'; 
when Fault_SyncParityOnwalk 

assert level IN {1,2}; 

result = if level == 1 then '11100' else '11110'; 
when Fault_AsyncParity 

result = '11000'; 
when Fault_AsyncExternal 

result = '10110'; 
when Fault_Debug 

result = '00010'; 
when Fault_TLBConflict 

result = '10000'; 
when Fault_Lockdown 

result = '10100'; // IMPLEMENTATION DEFINED 
when Fault_Exclusive 

result = '10101'; // IMPLEMENTATION DEFINED 
when Fault_ICacheMaint 

result = 'Q0100'; 
otherwise 

Unreachable(); 











return result; 


aarch32/functions/common/A32Expandimm 


// A32ExpandImm() 


bits(32) A32ExpandImm(bits(12) imm12) 
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// PSTATE.C argument to following function call does not affect the imm32 result. 


(imm32, -) = A32ExpandImm_C(imm12, PSTATE.C); 


return imm32; 


aarch32/functions/common/A32Expandimm_C 


// A32ExpandImm_C() 
// ================ 


(bits(32), bit) A32ExpandImm_C(bits(12) imm12, bit carry_in) 


unrotated_value = ZeroExtend(imm12<7:0>, 32); 


(imm32, carry_out) = Shift_C(unrotated_value, SRType_ROR, 2+UInt(imm12<11:8>), carry_in); 


return (imm32, carry_out); 


aarch32/functions/common/DecodelmmShift 


// DecodeImmShi ft () 
// ================ 


(SRType, integer) DecodeImmShift(bits(2) srtype, bits(5) imm5) 


case srtype of 
when '00' 
shift_t 
when '01' 
shift_t 
when '10' 
shift_t 
when '11' 
if imm5 == '00000' then 
shift_t = SRType_RRX; shift_n 
else 
shift_t = SRType_ROR; shift_n = UInt(imm5); 


SRType_LSL; shift_n = UInt(imm5); 


1; 


return (shift_t, shift_n); 


aarch32/functions/common/DecodeRegShift 


// DecodeRegShi ft() 
// ================ 


SRType DecodeRegShift(bits(2) srtype) 
case srtype of 


when '00' shift_t = SRType_LSL; 
when '01' shift_t = SRType_LSR; 
when '10'  shift_t = SRType_ASR; 


when '11' shift_t = SRType_ROR; 
return shift_t; 


aarch32/functions/common/RRX 


// RRX() 
/[/ === 


bits(N) RRX(bits(N) x, bit carry_in) 
(result, -) = RRX_C(x, carry_in); 
return result; 
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aarch32/functions/common/RRX_C 


// RRX_C() 
// ======= 


(bits(N), bit) RRX_C(bits(N) x, bit carry_in) 
result = carry_in : x<N-1:1>; 
carry_out = x<@>; 
return (result, carry_out); 


aarch32/functions/common/SRType 


enumeration SRType {SRType_LSL, SRType_LSR, SRType_ASR, SRType_ROR, SRType_RRX}; 


aarch32/functions/common/Shift 


// Shift() 
{=== 


bits(N) Shift(bits(N) value, SRType srtype, integer amount, bit carry_in) 
(result, -) = Shift_C(value, srtype, amount, carry_in); 
return result; 


aarch32/functions/common/Shift_C 


// Shift_CQ) 
[| === 


(bits(N), bit) Shift_C(bits(N) value, SRType srtype, integer amount, bit carry_in) 
assert !(srtype == SRType_RRX && amount != 1); 


if amount == @ then 
(result, carry_out) = (value, carry_in); 
else 
case srtype of 
when SRType_LSL 
(result, carry_out) = LSL_C(value, amount); 
when SRType_LSR 
(result, carry_out) = LSR_C(value, amount); 
when SRType_ASR 
(result, carry_out) = ASR_C(value, amount); 
when SRType_ROR 
(result, carry_out) = ROR_C(value, amount); 
when SRType_RRX 
(result, carry_out) = RRX_C(value, carry_in); 


return (result, carry_out); 


aarch32/functions/common/T32Expandimm 


// T32ExpandImm() 
// ============== 


bits(32) T32ExpandImm(bits(12) imm12) 


// PSTATE.C argument to following function call does not affect the imm32 result. 
(imm32, -) = T32ExpandImm_C(imm12, PSTATE.C); 


return imm32; 
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aarch32/functions/common/T32Expandimm_C 


// T32ExpandImm_C() 


(bits(32), bit) T32ExpandImm_C(bits(12) imm12, bit carry_in) 


if imm12<11:10> == 'QQ' then 
case imm12<9:8> of 
when 'QQ' 
imm32 = ZeroExtend(imm12<7:0>, 32); 
when 'Q1' 
imm32 = 'QQQ00000' : imm12<7:0> : 'Q0000000' : imm12<7:0>; 
when '10' 
imm32 = imm12<7:@> : '@Q000000' : imm12<7:0> : '00000000'; 
when '11' 
imm32 = imm12<7:@> : imm12<7:@> : imm12<7:0> : imm12<7:0>; 
carry_out = carry_in; 
else 
unrotated_value = ZeroExtend('1':imm12<6:@>, 32); 
(imm32, carry_out) = ROR_C(unrotated_value, UInt(imm12<11:7>)); 


return (imm32, carry_out); 


aarch32/functions/coproc/AArch32.CheckCP15InstrCoarseTraps 

// AArch32.CheckCP15InstrCoarseTraps() 

// Check for coarse-grained CP15 traps in HSTR and HCR. 

boolean AArch32.CheckCP15InstrCoarseTraps(integer CRn, integer nreg, integer CRm) 


// Check for coarse-grained Hyp traps 
if PSTATE.EL IN {EL@, EL1} && EL2Enabled() then 
if PSTATE.EL == ELO && !ELUsingAArch32(EL2) then 
return AArch64.CheckCP15InstrCoarseTraps(CRn, nreg, CRm); 
// Check for MCR, MRC, MCRR and MRRC disabled by HSTR<CRn/CRm> 
major = if nreg == 1 then CRn else CRm; 
if !(major IN {4,14}) && HSTR<major> == '1' then 
return TRUE; 


// Check for MRC and MCR disabled by HCR.TIDCP 


if (HCR.TIDCP == '1' && nreg == 1 & 
((CRn == 9 && CRm IN {0,1,2, 5,6,7,8 }) Il 
(CRn == 10 && CRm IN {0,1, 4, 8 HII 


(CRn == 11 && CRm IN {0,1,2,3,4,5,6,7,8,15}))) then 
return TRUE; 


return FALSE; 


aarch32/functions/exclusive/AArch32.ExclusiveMonitorsPass 


// AArch32.ExclusiveMonitorsPass() 
[a 


// Return TRUE if the Exclusives monitors for the current PE include all of the addresses 
// associated with the virtual address region of size bytes starting at address. 
// The immediately following memory write must be to the same addresses. 


boolean AArch32.ExclusiveMonitorsPass(bits(32) address, integer size) 


// It is IMPLEMENTATION DEFINED whether the detection of memory aborts happens 

// before or after the check on the local Exclusives monitor. As a result a failure 
// of the local monitor can occur on some implementations even if the memory 

// access would give an memory abort. 
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acctype = AccType_ATOMIC; 
iswrite = TRUE; 
aligned = (address == Align(address, size)); 


if !aligned then 
secondstage = FALSE; 
AArch32.Abort(address, AArch32.AlignmentFault(acctype, iswrite, secondstage)); 


passed = AArch32.IsExclusiveVA(address, ProcessorID(), size); 
if !passed then 
return FALSE; 
memaddrdesc = AArch32.TranslateAddress(address, acctype, iswrite, aligned, size); 


// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
AArch32.Abort(address, memaddrdesc. fault); 


passed = IsExclusiveLocal (memaddrdesc.paddress, ProcessorID(), size); 
ClearExclusiveLocal(ProcessorID()); 


if passed then 
if memaddrdesc.memattrs.shareable then 
passed = IsExclusiveGlobal(memaddrdesc.paddress, ProcessorID(), size); 


return passed; 


aarch32/functions/exclusive/AArch32.IsExclusiveVA 


// An optional IMPLEMENTATION DEFINED test for an exclusive access to a virtual 
// address region of size bytes starting at address. 

// 

// It is permitted (but not required) for this function to return FALSE and 

// cause a store exclusive to fail if the virtual address region is not 

// totally included within the region recorded by MarkExclusiveVA(). 

// 


// It is always safe to return TRUE which will check the physical address only. 
boolean AArch32.IsExclusiveVA(bits(32) address, integer processorid, integer size); 
aarch32/functions/exclusive/AArch32.MarkExclusiveVA 

// Optionally record an exclusive access to the virtual address region of size bytes 
// starting at address for processorid. 

AArch32.MarkExclusiveVA(bits(32) address, integer processorid, integer size); 


aarch32/functions/exclusive/AArch32.SetExclusiveMonitors 


// AArch32.SetExclusiveMonitors() 
———E— EE 


// Sets the Exclusives monitors for the current PE to record the addresses associated 
// with the virtual address region of size bytes starting at address. 


AArch32.SetExclusiveMonitors(bits(32) address, integer size) 


acctype = AccType_ATOMIC; 

iswrite = FALSE; 

aligned = (address == Align(address, size)); 

memaddrdesc = AArch32.TranslateAddress(address, acctype, iswrite, aligned, size); 


// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
return; 


if memaddrdesc.memattrs.shareable then 
MarkExclusiveGlobal(memaddrdesc.paddress, ProcessorID(), size); 
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MarkExclusiveLocal(memaddrdesc.paddress, ProcessorID(), size); 


AArch32.MarkExclusiveVA(address, ProcessorID(), size); 


aarch32/functions/float/(CheckAdvSIMDEnabled 


// CheckAdvSIMDEnabled() 
// ===================== 


CheckAdvSIMDEnabled() 


fpexc_check = TRUE; 
advsimd = TRUE; 


AArch32.CheckAdvSIMDOrFPEnabled(fpexc_check, advsimd); 


// Return from CheckAdvSIMDOrFPEnabled() occurs only if Advanced SIMD access is permitted 


// Make temporary copy of D registers 
// _Dclone[] is used as input data for instruction pseudocode 
for i = 0 to 31 

_Dclone[i] = D[i]; 


return; 


aarch32/functions/float/(CheckAdvSIMDOrVFPEnabled 


// CheckAdvSIMDOrVFPEnab1ed() 
// ========================== 


CheckAdvSIMDOrVFPEnabled(boolean include_fpexc_check, boolean advsimd) 
AArch32.CheckAdvSIMDOrFPEnabled(include_fpexc_check, advsimd); 


// Return from CheckAdvSIMDOrFPEnabled() occurs only if VFP access is permitted 


return; 


aarch32/functions/float/CheckCryptoEnabled32 


// CheckCryptoEnabled32() 
// ====================== 


CheckCryptoEnabled32() 
CheckAdvSIMDEnabled(); 


// Return from CheckAdvSIMDEnabled() occurs only if access is permitted 


return; 


aarch32/functions/float/CheckVFPEnabled 


// CheckVFPEnabled() 
// ================= 


CheckVFPEnabled(boolean include_fpexc_check) 
advsimd = FALSE; 
AArch32.CheckAdvSIMDOrFPEnabled(include_fpexc_check, advsimd) ; 


// Return from CheckAdvSIMDOrFPEnabled() occurs only if VFP access is permitted 


return; 


aarch32/functions/float/FPHalvedSub 


// FPHalvedSub() 
// ============= 


bits(N) FPHalvedSub(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
rounding = FPRoundingMode(fpcr); 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
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(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done, result) = FPProcessNaNs(typel, type2, op1, op2, fpcr); 
if !done then 


infl = (typel == FPType_Infinity); inf2 = (type2 == FPType_Infinity); 


zerol = (typel == FPType_Zero); zero2 = (type2 == FPType_Zero); 

if infl && inf2 && signl == sign2 then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 

elsif (infl && signl == '0') || (inf2 && sign2 == '1') then 
result = FPInfinity('0'); 

elsif (infl && signl == '1') || (inf2 && sign2 == '@') then 
result = FPInfinity('1'); 

elsif zerol && zero2 && signl != sign2 then 
result = FPZero(sign1); 

else 
result_value = (valuel - value2) / 2.0; 


if result_value == 0.0 then // Sign of exact zero result depends on rounding mode 
result_sign = if rounding == FPRounding_NEGINF then '1' else 'Q'; 


result = FPZero(result_sign) ; 
else 
result = FPRound(result_value, fpcr); 
return result; 


aarch32/functions/float/FPRSqrtStep 


// FPRSqrtStep() 
// ============= 


bits(N) FPRSqrtStep(bits(N) op1, bits(N) op2) 
assert N IN {16,32}; 
FPCRType fpcr = StandardFPSCRValue(); 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done, result) = FPProcessNaNs(typel, type2, op1, op2, fpcr); 
if !done then 


infl = (typel == FPType_Infinity); inf2 = (type2 == FPType_Infinity); 


zerol = (typel == FPType_Zero); zero2 = (type2 == FPType_Zero); 
bits(N) product; 
if (infl && zero2) || (zerol && inf2) then 
product = FPZero('Q'); 
else 
product = FPMul(opl, op2, fpcr); 
bits(N) three = FPThree('Q'); 
result = FPHalvedSub(three, product, fpcr); 
return result; 


aarch32/functions/float/FPRecipStep 


// FPRecipStep() 
// ============= 


bits(N) FPRecipStep(bits(N) op1, bits(N) op2) 
assert N IN {16,32}; 
FPCRType fpcr = StandardFPSCRValue(); 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done, result) = FPProcessNaNs(typel, type2, opl, op2, fpcr); 
if !done then 
infl = (typel == FPType_Infinity); inf2 = (type2 == FPType_Infinity); 
zerol = (typel == FPType_Zero); zero2 = (type2 == FPType_Zero); 
bits(N) product; 
if (infl && zero2) || (zerol && inf2) then 
product = FPZero('Q'); 
else 
product = FPMul(opl, op2, fpcr); 
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bits(N) two = FPTwo('0'); 
result = FPSub(two, product, fpcr); 
return result; 


aarch32/functions/float/StandardFPSCRValue 


// StandardFPSCRValue() 
// ==================== 


FPCRType StandardFPSCRValue() 
return '00000' : FPSCR.AHP : '110000' : FPSCR.FZ16 : '0000000000000000000' ; 


aarch32/functions/memory/AArch32.CheckAlignment 


// AArch32.CheckAlignment() 
// ======================== 


boolean AArch32.CheckAlignment(bits(32) address, integer alignment, AccType acctype, 
boolean iswrite) 


if PSTATE.EL == ELO && !ELUsingAArch32(S1TranslationRegime()) then 
A = SCTLR[].A; //use AArch64 register, when higher Exception level is using AArch64 
elsif PSTATE.EL == EL2 then 
A = HSCTLR.A; 
else 
A = SCTLR.A; 
aligned = (address == Align(address, alignment)); 
atomic = acctype IN { AccType_ATOMIC, AccType_ATOMICRW, AccType_ORDEREDATOMIC, 
AccType_ORDEREDATOMICRW }; 
ordered = acctype IN { AccType_ORDERED, AccType_ORDEREDRW, AccType_LIMITEDORDERED, 
AccType_ORDEREDATOMIC, AccType_ORDEREDATOMICRW }; 
vector = acctype == AccType_VEC; 


// AccType_VEC is used for SIMD element alignment checks only 
check = (atomic || ordered || vector || A == '1'); 


if check && !aligned then 
secondstage = FALSE; 
AArch32.Abort(address, AArch32.AlignmentFault(acctype, iswrite, secondstage)); 


return aligned; 


aarch32/functions/memory/AArch32.MemSingle 
// AArch32.MemSingle[] - non-assignment (read) form 
// Perform an atomic, little-endian read of 'size' bytes. 


bits(sizex8) AArch32.MemSingle[bits(32) address, integer size, AccType acctype, boolean wasaligned] 
assert size IN {1, 2, 4, 8, 16}; 
assert address == Align(address, size); 


AddressDescriptor memaddrdesc; 
bits(sizex8) value; 
iswrite = FALSE; 


// MMU or MPU 
memaddrdesc = AArch32.TranslateAddress(address, acctype, iswrite, wasaligned, size); 
// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
AArch32.Abort(address, memaddrdesc. fault); 


// Memory array access 
accdesc = CreateAccessDescriptor(acctype) ; 
if HaveMTEExt() then 
if AArch64.AccessIsTagChecked(ZeroExtend(address, 64), acctype) then 
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bits(4) ptag = AArch64.PhysicalTag(ZeroExtend(address, 64)); 
if !AArch64.CheckTag(memaddrdesc, ptag, iswrite) then 
AArch64.TagCheckFail(ZeroExtend(address, 64), iswrite); 
value = _Mem[memaddrdesc, size, accdesc]; 
return value; 


// AArch32.MemSingle[] - assignment (write) form 
// Perform an atomic, little-endian write of 'size' bytes. 


AArch32.MemSingle[bits(32) address, integer size, AccType acctype, boolean wasaligned] = bits(sizex8) 
value 

assert size IN {1, 2, 4, 8, 16}; 

assert address == Align(address, size); 


AddressDescriptor memaddrdesc; 
iswrite = TRUE; 


// MMU or MPU 
memaddrdesc = AArch32.TranslateAddress(address, acctype, iswrite, wasaligned, size); 


// Check for aborts or debug exceptions 
if IsFault(memaddrdesc) then 
AArch32.Abort(address, memaddrdesc. fault); 


// Effect on exclusives 
if memaddrdesc.memattrs.shareable then 
ClearExclusiveByAddress(memaddrdesc.paddress, ProcessorID(), size); 


// Memory array access 
accdesc = CreateAccessDescriptor(acctype) ; 
if HaveMTEExt() then 
if AArch64.AccessIsTagChecked(ZeroExtend(address, 64), acctype) then 
bits(4) ptag = AArch64.PhysicalTag(ZeroExtend(address, 64)); 
if !AArch64.CheckTag(memaddrdesc, ptag, iswrite) then 
AArch64.TagCheckFail(ZeroExtend(address, 64), iswrite); 
_Mem[memaddrdesc, size, accdesc] = value; 
return; 


aarch32/functions/memory/Hint_PreloadData 


Hint_PreloadData(bits(32) address); 


aarch32/functions/memory/Hint_PreloadDataForWrite 


Hint_PreloadDataForWrite(bits(32) address); 


aarch32/functions/memory/Hint_Preloadinstr 


Hint_PreloadInstr(bits(32) address); 


aarch32/functions/memory/MemA 


// MemA[] - non-assignment form 

// EE 

bits(8size) MemA[bits(32) address, integer size] 
acctype = AccType_ATOMIC; 
return Mem_with_type[address, size, acctype]; 


// MemA[] - assignment form 


MemA[bits(32) address, integer size] = bits(8«size) value 
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acctype = AccType_ATOMIC; 
Mem_with_type[address, size, acctype] = value; 
return; 


aarch32/functions/memory/MemO 


// MemO[] - non-assignment form 


// ============================ 


bits(8size) MemO[bits(32) address, integer size] 
acctype = AccType_ORDERED; 
return Mem_with_type[address, size, acctype]; 


// MemO[] - assignment form 


// ======================== 


MemO[bits(32) address, integer size] = bits(8«size) value 
acctype = AccType_ORDERED; 
Mem_with_type[address, size, acctype] = value; 
return; 


aarch32/functions/memory/MemU 


// MemU[] - non-assignment form 


// ============================ 


bits(8size) MemU[bits(32) address, integer size] 
acctype = AccType_NORMAL; 
return Mem_with_type[address, size, acctype]; 


// MemU[] - assignment form 


// ======================== 


MemU[bits(32) address, integer size] = bits(8»size) value 
acctype = AccType_NORMAL; 
Mem_with_type[address, size, acctype] = value; 
return; 


aarch32/functions/memory/MemU_unpriv 


// MemU_unpriv[] - non-assignment form 


[[ ========================== 


bits(8*size) MemU_unpriv[bits(32) address, integer size] 
acctype = AccType_UNPRIV; 
return Mem_with_type[address, size, acctype]; 


// MemU_unpriv[] - assignment form 


// =========================== 


MemU_unpriv[bits(32) address, integer size] = bits(8»size) value 
acctype = AccType_UNPRIV; 
Mem_with_type[address, size, acctype] = value; 
return; 


aarch32/functions/memory/Mem_with_type 
// Mem_with_type[] - non-assignment (read) form 


// Perform a read of 'size' bytes. The access byte order is reversed for a big-endian access. 
// Instruction fetches would call AArch32.MemSingle directly. 


bits(sizex8) Mem_with_type[bits(32) address, integer size, AccType acctype] 
assert size IN {1, 2, 4, 8, 16}; 
bits(sizex8) value; 
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boolean iswrite = FALSE; 


aligned = AArch32.CheckAlignment(address, size, acctype, iswrite); 
if !aligned then 

assert size > 1; 

value<7:0> = AArch32.MemSingle[address, 1, acctype, aligned]; 


// For subsequent bytes it is CONSTRAINED UNPREDICTABLE whether an unaligned Device memory 
// access will generate an Alignment Fault, as to get this far means the first byte did 

// not, so we must be changing to a new translation page. 

c = ConstrainUnpredictable(); 

assert c IN {Constraint_FAULT, Constraint_NONE}; 

if c == Constraint_NONE then aligned = TRUE; 


for i = 1 to size-1 
value<8#i+7:8%i> = AArch32.MemSingle[address+i, 1, acctype, aligned]; 
else 
value = AArch32.MemSingle[address, size, acctype, aligned]; 


if BigEndian() then 
value = BigEndianReverse(value) ; 
return value; 


// Mem_with_type[] - assignment (write) form 
// Perform a write of 'size' bytes. The byte order is reversed for a big-endian access. 


Mem_with_type[bits(32) address, integer size, AccType acctype] = bits(sizex8) value 
boolean iswrite = TRUE; 


if BigEndian() then 
value = BigEndianReverse(value) ; 


aligned = AArch32.CheckAlignment(address, size, acctype, iswrite); 


if !aligned then 
assert size > 1; 
AArch32.MemSingle[address, 1, acctype, aligned] = value<7:0>; 


// For subsequent bytes it is CONSTRAINED UNPREDICTABLE whether an unaligned Device memory 
// access will generate an Alignment Fault, as to get this far means the first byte did 

// not, so we must be changing to a new translation page. 

c = ConstrainUnpredictable(); 

assert c IN {Constraint_FAULT, Constraint_NONE}; 

if c == Constraint_NONE then aligned = TRUE; 


for i = 1 to size-1 
AArch32.MemSingle[address+i, 1, acctype, aligned] = value<8#i+7:8+i>; 
else 
AArch32.MemSingle[address, size, acctype, aligned] = value; 
return; 


aarch32/functions/ras/AArch32.ESBOperation 


// AArch32.ESBOperation() 
J a 
// Perform the AArch32 ESB operation for ESB executed in AArch32 state 


AArch32.ESBOperation() 


// Check if routed to AArch64 state 

route_to_aarch64 = PSTATE.EL == ELO && !ELUsingAArch32(EL1); 

if !route_to_aarch64 && EL2Enabled() && !ELUsingAArch32(EL2) then 
route_to_aarch64 = HCR_EL2.TGE == '1' || HCR_EL2.AMO == '1'; 

if !route_to_aarch64 && HaveEL(EL3) && !ELUsingAArch32(EL3) then 
route_to_aarch64 = SCR_EL3.EA == '1'; 
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if route_to_aarch64 then 
AArch64.ESBOperation(); 
return; 


route_to_monitor = HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.EA == '1'; 
route_to_hyp = PSTATE.EL IN {EL@, EL1} && EL2Enabled() && (HCR.TGE == '1' || HCR.AMO == '1'); 


if route_to_monitor then 
target = M32_Monitor; 

elsif route_to_hyp || PSTATE.M == M32_Hyp then 
target = M32_Hyp; 

else 
target = M32_Abort; 


if IsSecure() then 

mask_active = TRUE; 
elsif target == M32_Monitor then 

mask_active = SCR.AW == '1' && (!HaveEL(EL2) || (HCR.TGE == '@' && HCR.AMO == 'Q')); 
else 

mask_active = target == M32_Abort || PSTATE.M == M32_Hyp; 


mask_set = PSTATE.A == '1'; 

(-, el) = ELFromM32(target) ; 

intdis Halted() || ExternalDebugInterruptsDisabled(el); 
masked = intdis || (mask_active && mask_set); 


// Check for a masked Physical SError pending 

if IsPhysicalSErrorPending() && masked then 
syndrome32 = AArch32.PhysicalSErrorSyndrome() ; 
DISR = AArch32.ReportDeferredSError(syndrome32.AET, syndrome32.ExT); 
ClearPendingPhysicalSError(); 


return; 


aarch32/functions/ras/AArch32.PhysicalSErrorSyndrome 
// Return the SError syndrome 
AArch32.SErrorSyndrome AArch32.PhysicalSErrorSyndrome() ; 
aarch32/functions/ras/AArch32.ReportDeferredSError 
// AArch32.ReportDeferredSError() 
// Return deferred SError syndrome 
bits(32) AArch32.ReportDeferredSError(bits(2) AET, bit ExT) 
bits(32) target; 
target<31> = '1'; // A 


syndrome = Zeros(16); 
if PSTATE.EL == EL2 then 


syndrome<11:10> = AET; // AET 

syndrome<9> = ExT; // EA 

syndrome<5:@> = 'Q10001'; // DFSC 

else 

syndrome<15:14> = AET; // AET 

syndrome<12> = ExT; // EXT 

syndrome<9> = TIBCR.EAE; // LPAE 

if TTBCR.EAE == '1' then // Long-descriptor format 
syndrome<5 : 0> = '010001'; // STATUS 

else // Short-descriptor format 
syndrome<10,3:0> = '10110'; // FS 


if HaveAnyAArch64() then 

target<24:@> = ZeroExtend(syndrome);// Any RES@ fields must be set to zero 
else 

target<15:0> = syndrome; 
return target; 
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aarch32/functions/ras/AArch32.SErrorSyndrome 


type AArch32.SErrorSyndrome is ( 
bits(2) AET, 
bit ExT 


aarch32/functions/ras/AArch32.vESBOperation 
// AArch32.vESBOperation() 
// Perform the ESB operation for virtual SError interrupts executed in AArch32 state 


AArch32.vESBOperation() 
assert PSTATE.EL IN {ELQ, EL1} && EL2Enabled(); 


// Check for EL2 using AArch64 state 
if !ELUsingAArch32(EL2) then 
AArch64.vESBOperation(); 
return; 


// If physical SError interrupts are routed to Hyp mode, and TGE is not set, then a 
// virtual SError interrupt might be pending 

vSEI_enabled = HCR.TGE == '@' && HCR.AMO == '1'; 

VSEI_pending = vSEI_enabled && HCR.VA == '1'; 

vintdis = Halted() || ExternalDebugInterruptsDisabled(EL1) 

vmasked = vintdis || PSTATE.A == '1'; 


// Check for a masked virtual SError pending 

if vSEI_pending && vmasked then 
VDISR = AArch32.ReportDeferredSError(VDFSR<15:14>, VDFSR<12>); 
HCR.VA = 'Q'; // Clear pending virtual SError 


return; 


aarch32/functions/registers/AArch32.ResetGeneralRegisters 


// AArch32.ResetGeneralRegisters() 
// ETEEN E 


AArch32.ResetGeneralRegisters() 


fori =Q@to7 
R[i] = bits(32) UNKNOWN; 
for i = 8 to 12 
Rmode[i, M32_User] = bits(32) UNKNOWN; 
Rmode[i, M32_FIQ] = bits(32) UNKNOWN; 
if HaveEL(EL2) then Rmode[13, M32_Hyp] = bits(32) UNKNOWN; // No R14_hyp 
for i = 13 to 14 
Rmode[i, M32_User] = bits(32) UNKNOWN; 
Rmode[i, M32_FIQ] = bits(32) UNKNOWN; 
Rmode[i, M32_IRQ] = bits(32) UNKNOWN; 
Rmode[i, M32_Svc] = bits(32) UNKNOWN; 
Rmode[i, M32_Abort] = bits(32) UNKNOWN; 
Rmode[i, M32_Undef] = bits(32) UNKNOWN; 
if HaveEL(EL3) then Rmode[i, M32_Monitor] = bits(32) UNKNOWN; 











return; 


aarch32/functions/registers/AArch32.ResetSIMDFPRegisters 


// AArch32.ResetSIMDFPRegisters() 
[I e 


AArch32.ResetSIMDFPRegisters() 
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for i = 0 to 15 
Q[i] = bits(128) UNKNOWN; 


return; 


aarch32/functions/registers/AArch32.ResetSpecialRegisters 


// AArch32.ResetSpecialRegisters() 
// sssssesseesssssssssssssseeess== 


AArch32.ResetSpecialRegisters() 


// AArch32 special registers 
SPSR_fiq = bits(32) UNKNOWN; 
SPSR_irq = bits(32) UNKNOWN; 
SPSR_svc = bits(32) UNKNOWN; 
SPSR_abt = bits(32) UNKNOWN; 
SPSR_und = bits(32) UNKNOWN; 
if HaveEL(EL2) then 

SPSR_hyp = bits(32) UNKNOWN; 

ELR_hyp = bits(32) UNKNOWN; 
if HaveEL(EL3) then 

SPSR_mon = bits(32) UNKNOWN; 


// External debug special registers 
DLR = bits(32) UNKNOWN; 
DSPSR = bits(32) UNKNOWN; 


return; 


aarch32/functions/registers/AArch32.ResetSystemRegisters 


AArch32.ResetSystemRegisters(boolean cold_reset) ; 


aarch32/functions/registers/ALUExceptionReturn 


// ALUExceptionReturn() 
// ssssssssssss======== 


ALUExceptionReturn(bits(32) address) 
if PSTATE.EL == EL2 then 


UNDEFINED; 
elsif PSTATE.M IN {M32_User,M32_System} then 
UNPREDICTABLE; // UNDEFINED or NOP 
else 


AArch32.ExceptionReturn(address, SPSR[]); 


aarch32/functions/registers/ALUWritePC 


// ALUWritePC() 
f= 


ALUWritePC(bits(32) address) 
if CurrentInstrSet() == InstrSet_A32 then 
BXWritePC(address, BranchType_INDIR); 
else 
BranchWritePC(address, BranchType_INDIR); 


aarch32/functions/registers/BXWritePC 


// BXWritePC() 
(=< 


BXWritePC(bits(32) address, BranchType branch_type) 
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if address<@> == '1' then 
SelectInstrSet(InstrSet_T32); 
address<@> = 'Q'; 
else 
SelectInstrSet(InstrSet_A32); 
// For branches to an unaligned PC counter in A32 state, the processor takes the branch 
// and does one of: 
// * Forces the address to be aligned 
// » Leaves the PC unaligned, meaning the target generates a PC Alignment fault. 
if address<1> == '1' && ConstrainUnpredictableBool() then 
address<1> = 'Q'; 
BranchTo(address, branch_type) ; 


aarch32/functions/registers/BranchWritePC 


// BranchWritePC() 
// =============== 


BranchWritePC(bits(32) address, BranchType branch_type) 
if CurrentInstrSet() == InstrSet_A32 then 
address<1:0> = '00'; 
else 
address<@> = 'Q'; 
BranchTo(address, branch_type) ; 


aarch32/functions/registers/D 


// D[] - non-assignment form 


bits(64) D[integer n] 
assert n >= 0 && n <= 31; 
base = (n MOD 2) « 64; 
bits(128) vreg = V[n DIV 2]; 
return vreg<base+63:base>; 


// D[] - assignment form 


D[integer n] = bits(64) value 
assert n >= 0 && n <= 31; 
base = (n MOD 2) « 64; 
bits(128) vreg = V[n DIV 2]; 
vreg<base+63:base> = value; 
V[n DIV 2] = vreg; 
return; 


aarch32/functions/registers/Din 


// Din[] - non-assignment form 


[/ =========================== 


bits(64) Din[integer n] 
assert n >= 0 && n <= 31; 
return _Dclone[n]; 


aarch32/functions/registers/LR 


// LR - assignment form 


// ==================== 


LR = bits(32) value 
R[14] = value; 
return; 
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// LR - non-assignment form 


// ======================== 
bits(32) LR 
return R[14]; 
aarch32/functions/registers/LoadWritePC 


// LoadWritePC() 
// ============= 


LoadwritePC(bits(32) address) 
BXWritePC(address, BranchType_INDIR); 
aarch32/functions/registers/LookUpRIndex 


// LookUpRIndex() 
// ============== 


integer LookUpRIndex(integer n, bits(5) mode) 
assert n >= 0 && n <= 14; 


case n of // Select index by mode: usr fiq irq svc abt und hyp 

when 8 result = RBankSelect(mode, 8, 24, 8, 8, 8, 8, 8); 
when 9 result = RBankSelect(mode, 9, 25, 9, 9, 9, 9, 9); 
when 10 result = RBankSelect(mode, 10, 26, 10, 10, 10, 10, 10); 
when 11 result = RBankSelect(mode, 11, 27, 11, 11, 11, 11, 11); 
when 12 result = RBankSelect(mode, 12, 28, 12, 12, 12, 12, 12); 
when 13 result = RBankSelect(mode, 13, 29, 17, 19, 21, 23, 15); 
when 14 result = RBankSelect(mode, 14, 30, 16, 18, 20, 22, 14); 
otherwise result = n; 





return result; 


aarch32/functions/registers/Monitor_mode_registers 


bits(32) SP_mon; 
bits(32) LR_mon; 


aarch32/functions/registers/PC 


// PC - non-assignment form 


// ======================== 


bits(32) PC 
return R[15]; // This includes the offset from AArch32 state 


aarch32/functions/registers/PCStoreValue 


// PCStoreValue() 
// ============== 


bits(32) PCStoreValue() 
// This function returns the PC value. On architecture versions before Armv7, it 
// is permitted to instead return PC+4, provided it does so consistently. It is 
// used only to describe A32 instructions, so it returns the address of the current 
// instruction plus 8 (normally) or 12 (when the alternative is permitted). 
return PC; 
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aarch32/functions/registers/Q 


// Q[] - non-assignment form 


bits(128) Q[integer n] 
assert n >= 0 && n <= 15; 
return V[n]; 


// QL] - assignment form 


Q[integer n] = bits(128) value 
assert n >= 0 && n <= 15; 
V[n] = value; 
return; 


aarch32/functions/registers/Qin 


// Qin[] - non-assignment form 


// =========================== 


bits(128) Qin[integer n] 
assert n >= 0 && n <= 15; 
return Din[2«n+1]:Din[2«n]; 


aarch32/functions/registers/R 


// R[] - assignment form 


R[ integer n] = bits(32) value 
Rmode[n, PSTATE.M] = value; 
return; 


// R[] - non-assignment form 


bits(32) R[integer n] 
if n == 15 then 
offset = (if CurrentInstrSet() == InstrSet_A32 then 8 else 4); 
return _PC<31:0> + offset; 
else 
return Rmode[n, PSTATE.M]; 


aarch32/functions/registers/RBankSelect 


// RBankSelect() 
// ============= 


integer RBankSelect(bits(5) mode, integer usr, integer fiq, integer irq, 
integer svc, integer abt, integer und, integer hyp) 


case mode of 
when M32_User result = usr; // User mode 
when M32_FIQ result = fiq; // FIQ mode 
when M32_IRQ result = irq; // IRQ mode 
when M32_Svc result = svc; // Supervisor mode 
when M32_Abort result = abt; // Abort mode 
when M32_Hyp result = hyp; // Hyp mode 
when M32_Undef result = und; // Undefined mode 
when M32_System result = usr; // System mode uses User mode registers 
otherwise Unreachable(); // Monitor mode 








return result; 
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aarch32/functions/registers/Rmode 


// Rmode[] - non-assignment form 


[/ ============================= 


bits(32) Rmode[integer n, bits(5) mode] 
assert n >= 0 & n <= 14; 


// Check for attempted use of Monitor mode in Non-secure state. 
if !IsSecure() then assert mode != M32_Monitor; 
assert !BadMode(mode); 


if mode == M32_Monitor then 
if n == 13 then return SP_mon; 
elsif n == 14 then return LR_mon; 
else return _R[n]<31:0>; 
else 
return _R[LookUpRIndex(n, mode) ]<31:0>; 


// Rmode[] - assignment form 


// ========================= 


Rmode[integer n, bits(5) mode] = bits(32) value 
assert n >= 0 && n <= 14; 


// Check for attempted use of Monitor mode in Non-secure state. 
if !IsSecure() then assert mode != M32_Monitor; 
assert !BadMode(mode); 


if mode == M32_Monitor then 
if n == 13 then SP_mon = value; 
elsif n == 14 then LR_mon = value; 
else _R[n]<31:0> = value; 

else 


// It is CONSTRAINED UNPREDICTABLE whether the upper 32 bits of the X 
// register are unchanged or set to zero. This is also tested for on 


// exception entry, as this applies to all AArch32 registers. 

if !HighestELUsingAArch32() && ConstrainUnpredictableBool() then 
_R[LookUpRIndex(n, mode)] = ZeroExtend(value); 

else 
_R[LookUpRIndex(n, mode) ]<31:@> = value; 


return; 


aarch32/functions/registers/S 


// S{] - non-assignment form 


bits(32) S[integer n] 
assert n >= 0 && n <= 31; 
base = (n MOD 4) « 32; 
bits(128) vreg = V[n DIV 4]; 
return vreg<base+31:base>; 


// S{] - assignment form 


S[integer n] = bits(32) value 
assert n >= 0 && n <= 31; 
base = (n MOD 4) « 32; 
bits(128) vreg = V[n DIV 4]; 
vreg<base+31:base> = value; 
V[n DIV 4] = vreg; 
return; 
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aarch32/functions/registers/SP 


// SP - assignment form 

[a 

SP = bits(32) value 
R[13] = value; 
return; 


// SP - non-assignment form 


// ======================== 
bits(32) SP 
return R[13]; 
aarch32/functions/registers/_Dclone 


array bits(64) _Dclone[Q..31]; 


aarch32/functions/system/AArch32.ExceptionReturn 


// AArch32.ExceptionReturn() 


AArch32.ExceptionReturn(bits(32) new_pc, bits(32) spsr) 
SynchronizeContext(); 


// Attempts to change to an illegal mode or state will invoke the Illegal Execution state 
// mechanism 

SetPSTATEFromPSR(spsr) ; 

ClearExclusiveLocal(ProcessorID()); 

SendEventLocal(); 


if PSTATE.IL == '1' then 
// If the exception return is illegal, PC[1:0] are UNKNOWN 
new_pc<1:0> = bits(2) UNKNOWN; 


else 
// LR[1:0] or LR[@] are treated as being 0, depending on the target instruction set state 
if PSTATE.T == '1' then 
new_pc<Q@> = 'Q'; // T32 
else 
new_pc<1:0> = '00'; // A32 


BranchTo(new_pc, BranchType_ERET); 


aarch32/functions/system/AArch32.ExecutingATS1xPlnstr 


// AArch32.ExecutingATS1xPInstr() 





// Return TRUE if current instruction is AT S1CPR/WP 


boolean AArch32.ExecutingATS1xPInstr() 
if !HavePrivATExt() then return FALSE; 


instr = ThisInstr(); 
if instr<24+:4> == '1110' && instr<8+:4> == '1110' then 

opl = instr<21+:3>; 

CRn = instr<16+:4>; 

CRm = instr<0+:4>; 

op2 = instr<5+:3>; 

return (op1 == '000' && CRn == 'Q111' && CRm == '1001' && op2 IN {'000','001'}); 
else 

return FALSE; 
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aarch32/functions/system/AArch32.ExecutingCP10or11Instr 


// AArch32.ExecutingCP1@or11Instr() 
// ae 


boolean AArch32.ExecutingCP10or11Instr() 
instr = ThisInstr(); 
instr_set = CurrentInstrSet(); 
assert instr_set IN {InstrSet_A32, InstrSet_T32}; 


if instr_set == InstrSet_A32 then 
return ((instr<27:24> == '1110' || instr<27:25> == '110') && instr<11:8> == '101x'); 
else // InstrSet_T32 
return (instr<31:28> == '111x' && (instr<27:24> == '1110' || instr<27:25> == '110') && 
instr<11:8> == '101x'); 


aarch32/functions/system/AArch32.ExecutingLSMInstr 


// AArch32.ExecutingLSMInstr() 





// Returns TRUE if processor is executing a Load/Store Multiple instruction 


boolean AArch32.ExecutingLSMInstr() 
instr = ThisInstr(); 
instr_set = CurrentInstrSet(); 
assert instr_set IN {InstrSet_A32, InstrSet_T32}; 


if instr_set == InstrSet_A32 then 
return (instr<28+:4> != '1111' && instr<25+:3> == '100'); 
else // InstrSet_T32 
if ThisInstrLength() == 16 then 
return (instr<12+:4> == '1100'); 
else 
return (instr<25+:7> == '1110100' && instr<22> == 'Q'); 


aarch32/functions/system/AArch32.ITAdvance 


// AArch32.1TAdvance() 


AArch32.1TAdvance() 
if PSTATE.IT<2:@> == '000' then 
PSTATE.IT = '00000000' ; 
else 
PSTATE.IT<4:@> = LSL(PSTATE.IT<4:0>, 1); 
return; 
aarch32/functions/system/AArch32.SysRegRead 
// Read from a 32-bit AArch32 System register and return the register's contents. 
bits(32) AArch32.SysRegRead(integer cp_num, bits(32) instr); 
aarch32/functions/system/AArch32.SysRegRead64 
// Read from a 64-bit AArch32 System register and return the register's contents. 
bits(64) AArch32.SysRegRead64(integer cp_num, bits(32) instr); 
aarch32/functions/system/AArch32.SysRegReadCanWriteAPSR 
// AArch32.SysRegReadCanWriteAPSR() 


// Determines whether the AArch32 System register read instruction can write to APSR flags. 


boolean AArch32.SysRegReadCanWriteAPSR(integer cp_num, bits(32) instr) 
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assert UsingAArch32() 
assert (cp_num IN {14,15}); 
assert cp_num == UInt(instr<11:8>); 





opc1 = UInt(instr<23:21>); 
opc2 = UInt(instr<7:5>); 
CRn = UInt(instr<19:16>); 
CRm = UInt(instr<3:0>); 


if cp_num == 14 && opcl == 0 && CRn == @ && CRm == 1 && opc2 == @ then // DBGDSCRint 
return TRUE; 


return FALSE; 


aarch32/functions/system/AArch32.SysRegWrite 

// Write to a 32-bit AArch32 System register. 
AArch32.SysRegWrite(integer cp_num, bits(32) instr, bits(32) val); 
aarch32/functions/system/AArch32.SysRegWrite64 

// Write to a 64-bit AArch32 System register. 
AArch32.SysRegwrite64(integer cp_num, bits(32) instr, bits(64) val); 
aarch32/functions/system/AArch32.WriteMode 

// AArch32.WriteMode() 


// Function for dealing with writes to PSTATE.M from AArch32 state only. 
// This ensures that PSTATE.EL and PSTATE.SP are always valid. 


AArch32.WriteMode(bits(5) mode) 
(valid,el) = ELFromM32(mode) ; 
assert valid; 

PSTATE.M = mode; 


PSTATE.EL = el; 

PSTATE.nRW = '1'; 

PSTATE.SP = (if mode IN {M32_User,M32_System} then 'Q' else '1'); 
return; 


aarch32/functions/system/AArch32.WriteModeByInstr 
// AArch32.WriteModeByInstr() 


// Function for dealing with writes to PSTATE.M from an AArch32 instruction, and ensuring that 
// illegal state changes are correctly flagged in PSTATE. IL. 


AArch32.WriteModeByInstr(bits(5) mode) 
(valid,el) = ELFromM32(mode) ; 


// 'valid' is set to FALSE if’ mode’ is invalid for this implementation or the current value 
// of SCR.NS/SCR_EL3.NS. Additionally, it is illegal for an instruction to write 'mode' to 
// PSTATE.EL if it would result in any of: 
// » A change to a mode that would cause entry to a higher Exception level. 
if UInt(el) > UInt(PSTATE.EL) then 

valid = FALSE; 


// * A change to or from Hyp mode. 
if (PSTATE.M == M32_Hyp || mode == M32_Hyp) && PSTATE.M != mode then 
valid = FALSE; 


// * When EL2 is implemented, the value of HCR.TGE is '1', a change to a Non-secure EL1 mode. 
if PSTATE.M == M32_Monitor && HaveEL(EL2) && el == EL1 && SCR.NS == '1' && HCR.TGE == '1' then 
valid = FALSE; 
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if !valid then 
PSTATE.IL = '1'; 

else 
AArch32.WriteMode(mode) ; 


aarch32/functions/system/BadMode 


// BadMode() 


boolean BadMode(bits(5) mode) 
// Return TRUE if 'mode' encodes a mode that is not valid for this implementation 
case mode of 
when M32_Monitor 
valid = HaveAArch32EL(EL3); 
when M32_Hyp 
valid = HaveAArch32EL(EL2); 
when M32_FIQ, M32_IRQ, M32_Svc, M32_Abort, M32_Undef, M32_System 
// If EL3 is implemented and using AArch32, then these modes are EL3 modes in Secure 
// state, and EL1 modes in Non-secure state. If EL3 is not implemented or is using 
// AArch64, then these modes are EL1 modes. 
// Therefore it is sufficient to test this implementation supports EL1 using AArch32. 
valid = HaveAArch32EL(EL1); 
when M32_User 
valid = HaveAArch32EL(ELQ); 
otherwise 
valid = FALSE; // Passed an illegal mode value 
return !valid; 


aarch32/functions/system/BankedRegisterAccessValid 
// BankedRegisterAccessValid() 


// Checks for MRS (Banked register) or MSR (Banked register) accesses to registers 
// other than the SPSRs that are invalid. This includes ELR_hyp accesses. 


BankedRegisterAccessValid(bits(5) SYSm, bits(5) mode) 


case SYSm of 








when '000xx', '00100' // R8_usr to R12_usr 
if mode != M32_FIQ then UNPREDICTABLE; 

when '00101' // SP_usr 
if mode == M32_System then UNPREDICTABLE; 

when '00110' // LR_usr 
if mode IN {M32_Hyp,M32_System} then UNPREDICTABLE; 

when '010xx', '@110x', 'Q1110' // R8_fig to R12_fig, SP_fig, LR_fiq 
if mode == M32_FIQ then UNPREDICTABLE; 

when '100Qx' // LR_irg, SP_irg 
if mode == M32_IRQ then UNPREDICTABLE; 

when '10Q1x' // LR svc, SP_svc 
if mode == M32_Svc then UNPREDICTABLE; 

when '1010x' // LR_abt, SP_abt 
if mode == M32_Abort then UNPREDICTABLE; 

when '1011x' // LR_und, SP_und 
if mode == M32_Undef then UNPREDICTABLE; 

when '1110x' // LR_mon, SP_mon 
if !HaveEL(EL3) || !IsSecure() || mode == M32_Monitor then UNPREDICTABLE; 

when '11110' // ELR_hyp, only from Monitor or Hyp mode 
if !HaveEL(EL2) || !(mode IN {M32_Monitor,M32_Hyp}) then UNPREDICTABLE; 

when '11111' // SP_hyp, only from Monitor mode 
if !HaveEL(EL2) || mode != M32_Monitor then UNPREDICTABLE; 

otherwise 
UNPREDICTABLE; 

return; 
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aarch32/functions/system/CPSRWriteBylnstr 


// CPSRWriteByInstr() 
[a 
// Update PSTATE.<N,Z,C,V,Q,GE,E,A,I,F,M> from a CPSR value written by an MSR instruction. 


CPSRWriteByInstr(bits(32) value, bits(4) bytemask) 
privileged = PSTATE.EL != ELQ; // PSTATE.<A,I,F,M> are not writable at ELO 


// Write PSTATE from 'value', ignoring bytes masked by 'bytemask' 
if bytemask<3> == '1' then 

PSTATE.<N,Z,C,V,Q> = value<31:27>; 

// Bits <26:24> are ignored 


if bytemask<2> == '1' then 
// Bit <23> is RESO 
if privileged then 
PSTATE.PAN = value<22>; 
// Bits <21:20> are RESO 
PSTATE.GE = value<19:16>; 
if bytemask<1> == '1' then 
// Bits <15:10> are RESO 
PSTATE.E = value<9>; // PSTATE.E is writable at ELQ 
if privileged then 
PSTATE.A = value<8>; 


if bytemask<@> == '1' then 
if privileged then 
PSTATE.<I,F> = value<7:6>; 
// Bit <5> is RESO 
// AArch32.WriteModeByInstr() sets PSTATE.IL to 1 if this is an illegal mode change. 
AArch32.WriteModeByInstr(value<4:0>); 


return; 


aarch32/functions/system/ConditionPassed 


// ConditionPassed() 
// ================= 


boolean ConditionPassed() 
return ConditionHolds(AArch32.CurrentCond()); 
aarch32/functions/system/CurrentCond 


bits(4) AArch32.CurrentCond(); 


aarch32/functions/system/InITBlock 


// InITBlock() 
// =========== 


boolean InITBlock() 
if CurrentInstrSet() == InstrSet_T32 then 
return PSTATE.IT<3:0> != 'Q000'; 
else 
return FALSE; 


aarch32/functions/system/LastInITBlock 


// LastInITBlock() 
// =============== 


boolean LastInITBlock() 
return (PSTATE.1IT<3:0> == '1000'); 
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aarch32/functions/system/SPSRWriteBylInstr 


// SPSRWriteByInstr() 
// ================== 


SPSRWriteByInstr(bits(32) value, bits(4) bytemask) 
new_spsr = SPSR[]; 


if bytemask<3> == '1' then 
new_spsr<31:24> = value<31:24>; // N,Z,C,V,Q flags, IT[1:0],J bits 


if bytemask<2> == '1' then 
new_spsr<23:16> = value<23:16>; // IL bit, GE[3:0] flags 


if bytemask<1> == '1' then 
new_spsr<15:8> = value<15:8>; // IT[7:2] bits, E bit, A interrupt mask 





if bytemask<@> == '1' then 

new_spsr<7:Q@> = value<7:0>; // 1,F interrupt masks, T bit, Mode bits 
SPSR[] = new_spsr; // UNPREDICTABLE if User or System mode 
return; 


aarch32/functions/system/SPSRaccessValid 


// SPSRaccessValid() 

[f sssssssssse====== 

// Checks for MRS (Banked register) or MSR (Banked register) accesses to the SPSRs 
// that are UNPREDICTABLE 


SPSRaccessValid(bits(5) SYSm, bits(5) mode) 
case SYSm of 














when 'Q1110' // SPSR_fig 
if mode == M32_FIQ then UNPREDICTABLE; 

when '1000Q' // SPSR_irq 
if mode == M32_IRQ then UNPREDICTABLE; 

when '10010' // SPSR_svc 
if mode == M32_Svc then UNPREDICTABLE; 

when '10100' // SPSR_abt 
if mode == M32_Abort then UNPREDICTABLE; 

when '10110' // SPSR_und 
if mode == M32_Undef then UNPREDICTABLE; 

when '11100' // SPSR_mon 
if !HaveEL(EL3) || mode == M32_Monitor || !IsSecure() then UNPREDICTABLE; 

when '11110' // SPSR_hyp 
if !HaveEL(EL2) || mode != M32_Monitor then UNPREDICTABLE; 

otherwise 
UNPREDICTABLE; 

return; 


aarch32/functions/system/SelectinstrSet 


// SelectInstrSet() 
// ================ 


SelectInstrSet(InstrSet iset) 
assert CurrentInstrSet() IN {InstrSet_A32, InstrSet_T32}; 
assert iset IN {InstrSet_A32, InstrSet_T32}; 
PSTATE.T = if iset == InstrSet_A32 then 'Q' else '1'; 


return; 
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aarch32/functions/v6simd/Sat 


// Sat) 
== 


bits(N) Sat(integer i, integer N, boolean unsigned) 
result = if unsigned then UnsignedSat(i, N) else SignedSat(i, N); 
return result; 


aarch32/functions/v6simd/SignedSat 


// SignedSat() 
// =========== 


bits(N) SignedSat(integer i, integer N) 
(result, -) = SignedSatQ(i, N); 
return result; 


aarch32/functions/v6simd/UnsignedSat 


// UnsignedSat() 
// ============= 


bits(N) UnsignedSat(integer i, integer N) 
(result, -) = UnsignedSatQ(i, N); 
return result; 


J1.2.4 aarch32/translation 


This section includes the following pseudocode functions: 

° aarch32/translation/attrs/AArch32.DefaultTEXDecode on page J1-7472. 

° aarch32/translation/attrs/AArch32.InstructionDevice on page J1-7473. 

. aarch32/translation/attrs/AArch32.RemappedTEXDecode on page J1-7473. 
° aarch32/translation/attrs/AArch32.S1AttrDecode on page J1-7474. 

° aarch32/translation/attrs/AArch32. TranslateAddressS1Off on page J1-7474. 
° aarch32/translation/checks/AArch32.AccessIsPrivileged on page J1-7475. 

° aarch32/translation/checks/AArch32.AccessUsesEL on page J1-7476. 

e aarch32/translation/checks/AArch32.CheckDomain on page J1-7476. 

° aarch32/translation/checks/AArch32.CheckPermission on page J1-7476. 

° aarch32/translation/checks/AArch32.CheckS2Permission on page J1-7477. 
s aarch32/translation/debug/AArch32. CheckBreakpoint on page J1-7478. 

$ aarch32/translation/debug/AArch32. CheckDebug on page J1-7479. 

° aarch32/translation/debug/AArch32.CheckVectorCatch on page J1-7479. 

s aarch32/translation/debug/AArch32. CheckWatchpoint on page J1-7479. 

5 aarch32/translation/faults/AArch32.AccessFlagFault on page J1-7480. 

° aarch32/translation/faults/AArch32.AddressSizeFault on page J1-7480. 

è aarch32/translation/faults/AArch32.AlignmentFault on page J1-7480. 

è aarch32/translation/faults/AArch32.AsynchExternalAbort on page J1-7481. 
. aarch32/translation/faults/AArch32.DebugFault on page J1-7481. 

. aarch32/translation/faults/AArch32.DomainFault on page J1-7481. 

. aarch32/translation/faults/AArch32.NoFault on page J1-7481. 

. aarch32/translation/faults/AArch32.PermissionFault on page J1-7482. 

G aarch32/translation/faults/AArch32. TranslationFault on page J1-7482. 

° aarch32/translation/translation/AArch32.FirstStageTranslate on page J1-7482. 
$ aarch32/translation/translation/AArch32.FullTranslate on page J1-7483. 

° aarch32/translation/translation/AArch32.SecondStageTranslate on page J1-7484. 
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° aarch32/translation/translation/AArch32.SecondStage Walk on page J1-7484. 

° aarch32/translation/translation/AArch32. TranslateAddress on page J1-7485. 

à aarch32/translation/walk/AArch32.TranslationTableWalkLD on page J1-7485. 
. aarch32/translation/walk/AArch32.TranslationTableWalkSD on page J1-7489. 
. aarch32/translation/walk/RemapRegsHaveResetValues on page J1-7492. 


aarch32/translation/attrs/AArch32.DefaultTEXDecode 


// AArch32.DefaultTEXDecode() 


MemoryAttributes AArch32.DefaultTEXDecode(bits(3) TEX, bit C, bit B, bit S, AccType acctype) 
MemoryAttributes memattrs; 


// Reserved values map to allocated values 

if (TEX == 'Q01' && C:B == '@1') || (TEX == '010' && C:B != 'QQ') || TEX == 'Q11' then 
bits(5) texch; 
(-, texcb) = ConstrainUnpredictableBits(); 
TEX = texcb<4:2>; C = texcb<1l>; B = texch<Q>; 


case TEX:C:B of 

when 'QQ000' 
// Device-nGnRnE 
memattrs.memtype = MemType_Device; 
memattrs.device = DeviceType_nGnRnE; 

when 'Q0001', 'Q1000' 
// Device-nGnRE 
memattrs.memtype = MemType_Device; 
memattrs.device = DeviceType_nGnRE; 

when 'Q0010', 'Q0011', '00100' 
// Write-back or Write-through Read allocate, or Non-cacheable 
memattrs.memtype = MemType_Normal; 
memattrs.inner = ShortConvertAttrsHints(C:B, acctype, FALSE); 
memattrs.outer = ShortConvertAttrsHints(C:B, acctype, FALSE); 





memattrs.shareable = (S == '1'); 
when 'QQ110' 

memattrs = MemoryAttributes IMPLEMENTATION_DEFINED; 
when 'QQ111' 


// Write-back Read and Write allocate 
memattrs.memtype = MemType_Normal; 
memattrs.inner = ShortConvertAttrsHints('@1', acctype, FALSE); 
memattrs.outer = ShortConvertAttrsHints('@1', acctype, FALSE); 
memattrs.shareable = (S == '1'); 

when '1xxxx' 
// Cacheable, TEX<1:0> = Outer attrs, {C,B} = Inner attrs 
memattrs.memtype = MemType_Normal; 
memattrs.inner = ShortConvertAttrsHints(C:B, acctype, FALSE); 
memattrs.outer = ShortConvertAttrsHints(TEX<1:@>, acctype, FALSE); 


memattrs.shareable = (S == '1'); 
otherwise 

// Reserved, handled above 

Unreachable(); 


// transient bits are not supported in this format 
memattrs.inner.transient = FALSE; 
memattrs.outer.transient = FALSE; 


// distinction between inner and outer shareable is not supported in this format 
memattrs.outershareable = memattrs.shareable; 
memattrs.tagged = FALSE; 


return MemAttrDefaults(memattrs) ; 
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aarch32/translation/attrs/AArch32.InstructionDevice 


// AArch32.InstructionDevice() 

// ae 

// Instruction fetches from memory marked as Device but not execute-never might generate a 
// Permission Fault but are otherwise treated as if from Normal Non-cacheable memory. 


AddressDescriptor AArch32.InstructionDevice(AddressDescriptor addrdesc, bits(32) vaddress, 
bits(40) ipaddress, integer level, bits(4) domain, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk) 


c = ConstrainUnpredictable(); 
assert c IN {Constraint_NONE, Constraint_FAULT}; 


if c == Constraint_FAULT then 
addrdesc.fault = AArch32.PermissionFault(ipaddress, domain, level, acctype, iswrite, 
secondstage, s2fslwalk); 
else 
addrdesc.memattrs.memtype = MemType_Normal; 
addrdesc.memattrs.inner.attrs = MemAttr_NC; 
addrdesc.memattrs.inner.hints = MemHint_No; 
addrdesc.memattrs.outer = addrdesc.memattrs. inner; 
addrdesc.memattrs.tagged = FALSE; 
addrdesc.memattrs = MemAttrDefaults(addrdesc.memattrs) ; 


return addrdesc; 


aarch32/translation/attrs/AArch32.RemappedTEXDecode 


// AArch32.RemappedTEXDecode() 


MemoryAttributes AArch32.RemappedTEXDecode(bits(3) TEX, bit C, bit B, bit S, AccType acctype) 
MemoryAttributes memattrs; 


region = UInt(TEX<Q>:C:B); // TEX<2:1> are ignored in this mapping scheme 
if region == 6 then 

memattrs = MemoryAttributes IMPLEMENTATION_DEFINED; 
else 

base = 2 » region; 

attrfield = PRRR<base+1:base>; 


if attrfield == '11' then // Reserved, maps to allocated value 
(-, attrfield) = ConstrainUnpredictableBits(); 


case attrfield of 

when 'QQ' // Device-nGnRnE 
memattrs.memtype = MemType_Device; 
memattrs.device = DeviceType_nGnRnE; 

when 'Q1' // Device-nGnRE 
memattrs.memtype = MemType_Device; 
memattrs.device = DeviceType_nGnRE; 

when '10' 
memattrs.memtype = MemType_Normal; 
memattrs.inner = ShortConvertAttrsHints(NMRR<base+1:base>, acctype, FALSE); 
memattrs.outer = ShortConvertAttrsHints(NMRR<base+17:base+16>, acctype, FALSE); 
s_bit = if S == '@' then PRRR.NS@ else PRRR.NS1; 


memattrs.shareable = (s_bit == '1'); 

memattrs.outershareable = (s_bit == '1' && PRRR<region+24> == 'Q'); 
when '11' 

Unreachable(); 


// transient bits are not supported in this format 
memattrs.inner.transient = FALSE; 
memattrs.outer.transient = FALSE; 
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memattrs.tagged = FALSE; 


return MemAttrDefaults(memattrs) ; 


aarch32/translation/attrs/AArch32.S1AttrDecode 
// AArch32.S1AttrDecode() 


// Converts the Stage 1 attribute fields, using the MAIR, to orthogonal 
// attributes and hints. 


MemoryAttributes AArch32.S1AttrDecode(bits(2) SH, bits(3) attr, AccType acctype) 
MemoryAttributes memattrs; 


if PSTATE.EL == EL2 then 
mair = HMAIR1:HMAIROQ; 
else 
mair = MAIR1:MAIRQ; 
index = 8 « UInt(attr); 
attrfield = mair<index+7:index>; 


memattrs.tagged = FALSE; 


if ((attrfield<7:4> != 'Q000' && attrfield<7:4> != '1111' && attrfield<3:0> == 'Q0000') || 


(attrfield<7:4> == 'Q000' && attrfield<3:0> != 'xx00')) then 
// Reserved, maps to an allocated value 
(-, attrfield) = ConstrainUnpredictableBits(); 
if !HaveMTEExt() && attrfield<7:4> == '1111' && attrfield<3:0> == 'Q000' then 
// Reserved, maps to an allocated value 
(-, attrfield) = ConstrainUnpredictableBits(); 


if attrfield<7:4> == '0000' then // Device 

memattrs.memtype = MemType_Device; 

case attrfield<3:0> of 
when 'Q000' memattrs.device = DeviceType_nGnRnE; 
when 'Q100' memattrs.device = DeviceType_nGnRE; 
when '1000' memattrs.device = DeviceType_nGRE; 
when '1100' memattrs.device = DeviceType_GRE; 
otherwise Unreachable(); // Reserved, handled above 


elsif attrfield<3:0> != 'Q000' then // Normal 
memattrs.memtype = MemType_Normal; 
memattrs.outer = LongConvertAttrsHints(attrfield<7:4>, acctype); 
memattrs.inner = LongConvertAttrsHints(attrfield<3:0>, acctype); 
memattrs.shareable = SH<1> == '1'; 
memattrs.outershareable = SH == '10'; 
elsif HaveMTEExt() && attrfield == '11110000' then // Normal, Tagged if WB-RWA 
memattrs.memtype = MemType_Normal; 
memattrs.outer = LongConvertAttrsHints('1111', acctype); // WB_RWA 
memattrs.inner = LongConvertAttrsHints('1111', acctype); // WB_RWA 
memattrs.shareable = SH<1> == '1'; 
memattrs.outershareable = SH == '10'; 
memattrs.tagged = (memattrs.inner.attrs == MemAttr_WB && 
memattrs.inner.hints == MemHint_RWA && 
memattrs.outer.attrs == MemAttr_WB && 
memattrs.outer.hints == MemHint_RWA); 
else 
Unreachable(); // Reserved, handled above 


return MemAttrDefaults(memattrs) ; 


aarch32/translation/attrs/AArch32. TranslateAddressS1 Off 


// AArch32.TranslateAddressS10ff() 


// Called for stage 1 translations when translation is disabled to supply a default translation. 
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// Note that there are additional constraints on instruction prefetching that are not described in 
// this pseudocode. 


TLBRecord AArch32.TranslateAddressSl0ff(bits(32) vaddress, AccType acctype, boolean iswrite) 
assert ELUsingAArch32(S1TranslationRegime()); 


TLBRecord result; 


default_cacheable = (HasS2Translation() && ((if ELUsingAArch32(EL2) then HCR.DC else HCR_EL2.DC) == 


'1')); 


if default_cacheable then 


else 


resul 


resul 


resul 


resu 


resul 


resul 
resul 
resul 
resul 


resu 


resul 
resul 
resul 


retu 


// Use default cacheable settings 

result.addrdesc.memattrs.memtype = MemType_Normal; 
result.addrdesc.memattrs.inner.attrs = MemAttr_WB; // Write-back 
result.addrdesc.memattrs.inner.hints = MemHint_RWA; 
result.addrdesc.memattrs.shareable = FALSE; 
result.addrdesc.memattrs.outershareable = FALSE; 


result.addrdesc.memattrs.tagged = HCR_EL2.DCT == '1'; 
elsif acctype != AccType_IFETCH then 


// 


Treat data as Device 


result.addrdesc.memattrs.memtype = MemType_Device; 
result.addrdesc.memattrs.device = DeviceType_nGnRnE; 
result.addrdesc.memattrs.inner = MemAttrHints UNKNOWN; 
result.addrdesc.memattrs.tagged = FALSE; 





// Instruction cacheability controlled by SCTLR/HSCTLR.I 
if PSTATE.EL == EL2 then 

cacheable = HSCTLR.I == '1'; 
else 


cacheable = SCTLR.I == '1'; 


result.addrdesc.memattrs.memtype = MemType_Normal; 


if 


cacheable then 
result.addrdesc.memattrs.inner.attrs = MemAttr_WT; 
result.addrdesc.memattrs.inner.hints = MemHint_RA; 


else 


result.addrdesc.memattrs.inner.attrs = MemAttr_NC; 
result.addrdesc.memattrs.inner.hints = MemHint_No; 


result.addrdesc.memattrs.shareable = TRUE; 
result.addrdesc.memattrs.outershareable = TRUE; 
result.addrdesc.memattrs.tagged = FALSE; 


t. 


t 


lt. 





ts 
t. 
t. 
Es 
lt. 
t 
t. 
t. 


rn 


addrdesc.memattrs.outer = result.addrdesc.memattrs.inner; 


.addrdesc.memattrs = MemAttrDefaults(result.addrdesc.memattrs) ; 


.perms.ap = bits(3) UNKNOWN; 


perms.xn = 'Q'; 


-perms.pxn = 'Q'; 


nG = bit UNKNOWN; 

contiguous = boolean UNKNOWN; 

domain = bits(4) UNKNOWN; 

level = integer UNKNOWN; 

blocksize = integer UNKNOWN; 

addrdesc.paddress.address = ZeroExtend(vaddress); 
addrdesc.paddress.NS = if IsSecure() then '0' else '1'; 
addrdesc. fault = AArch32.NoFault(); 

result; 


aarch32/translation/checks/AArch32.AccesslsPrivileged 


// AArch32.AccessIsPrivi leged() 


boolean AArch32.AccessIsPrivileged(AccType acctype) 
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el = AArch32.AccessUsesEL(acctype) ; 


if el == ELO then 
ispriv = FALSE; 

elsif el != EL1 then 
ispriv = TRUE; 


else 


ispriv = (acctype != AccType_UNPRIV) ; 


return ispriv; 


aarch32/translation/checks/AArch32.AccessUsesEL 


// AArch32.AccessUsesEL() 


// Returns the Exception Level of the regime that will manage the translation for a given access type. 


bits(2) AArch32.AccessUsesEL(AccType acctype) 
if acctype == AccType_UNPRIV then 


return ELQ; 
else 


return PSTATE.EL; 


aarch32/translation/checks/AArch32.CheckDomain 


// AArch32.CheckDomain() 


(boolean, FaultRecord) AArch32.CheckDomain(bits(4) domain, bits(32) vaddress, integer level, 


AccType acctype, boolean iswrite) 


index = 2 « UInt(domain); 
attrfield = DACR<index+1:index>; 


if attrfield == '10' then 


// Reserved value maps to an allocated value 
(-, attrfield) = ConstrainUnpredictableBits(); 


if attrfield == '00' then 
fault = AArch32.DomainFault(domain, level, acctype, iswrite); 


else 


fault = AArch32.NoFault(); 


permissioncheck = (attrfield == 'Q1'); 


return (permissioncheck, fault); 


aarch32/translation/checks/AArch32.CheckPermission 


// AArch32.CheckPermission() 


// Function used for 


permission checking from AArch32 stage 1 translations 


// Reserved, maps to an allocated value 


FaultRecord AArch32.CheckPermission(Permissions perms, bits(32) vaddress, integer level, 
bits(4) domain, bit NS, AccType acctype, boolean iswrite) 
assert ELUsingAArch32(S1TranslationRegime()); 


if PSTATE.EL != EL2 then 
wxn = SCTLR.WXN == '1'; 


if TTBCR.EAE == '1' || SCTLR.AFE == '1' || perms.ap<@> == '1' then 
priv_r = TRUE; 
priv_w = perms.ap<2> == 'Q'; 
user_r = perms.ap<l> == '1'; 
user_w = perms.ap<2:1> == 'Q1'; 

else 
priv_r = perms.ap<2:1> != 'Q0'; 
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priv_w = perms.ap<2:1> == 'Q1'; 
user_r = perms.ap<l> == '1'; 
user_w = FALSE; 

uwxn = SCTLR.UWXN == '1'; 


ispriv = AArch32.AccessIsPrivileged(acctype) ; 


pan = if HavePANExt() then PSTATE.PAN else 'Q'; 
is_Idst = !(acctype IN {AccType_DC, AccType_DC_UNPRIV, AccType_AT, AccType_IFETCH}) ; 
is_atslxp = (acctype == AccType_AT && AArch32.ExecutingATS1xPInstr()); 
if pan == '1' && user_r && ispriv && (is_ldst || is_atsixp) then 
priv_r = FALSE; 
priv_w = FALSE; 


user_xn = !user_r || perms.xn == '1' || (user_w && wxn); 
priv_xn = (!priv_r || perms.xn == '1' || perms.pxn == '1' | 
(priv_w && wxn) || (user_w && uwxn)); 


if ispriv then 

(r, w, xn) = (priv_r, priv_w, priv_xn) 
else 

(r, w, xn) = (user_r, user_w, user_xn); 


else 
// Access from EL2 
wxn = HSCTLR.WXN == '1'; 


r = TRUE; 
w = perms.ap<2> == 'Q'; 
xn = perms.xn == '1' || (w && wxn); 


// Restriction on Secure instruction fetch 

if HaveEL(EL3) && IsSecure() && NS == '1' then 
secure_instr_fetch = if ELUsingAArch32(EL3) then SCR.SIF else SCR_EL3.SIF; 
if secure_instr_fetch == '1' then xn = TRUE; 


if acctype == AccType_IFETCH then 
fail = xn; 
failedread = TRUE; 
elsif acctype IN { AccType_ATOMICRW, AccType_ORDEREDRW, AccType_ORDEREDATOMICRW } then 
fail = !r || Iw; 
failedread = !r; 
elsif acctype == AccType_DC then 
// DC maintenance instructions operating by VA, cannot fault from stage 1 translation. 
fail = FALSE; 
elsif iswrite then 
fail = !w; 
failedread = FALSE; 


else 


fail = !r; 
failedread = TRUE; 





if fail then 

secondstage = FALSE; 

s2fslwalk = FALSE; 

ipaddress = bits(4Q) UNKNOWN; 

return AArch32.PermissionFault(ipaddress, domain, level, acctype, 

!failedread, secondstage, s2fslwalk); 

else 

return AArch32.NoFault(); 


aarch32/translation/checks/AArch32.CheckS2Permission 





// Function used for permission checking from AArch32 stage 2 translations 


FaultRecord AArch32.CheckS2Permission(Permissions perms, bits(32) vaddress, bits(40) ipaddress, 


integer level, AccType acctype, boolean iswrite, 
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boolean s2fslwalk) 


assert HaveEL(EL2) && !IsSecure() && ELUsingAArch32(EL2) && HasS2Translation(); 


r = perms.ap<1> == '1'; 
w = perms.ap<2> == '1'; 
if HaveExtendedExecuteNeverExt() then 
case perms.xn:perms.xxn of 
when '00' xn = !r; 
when '01' xn = !r || PSTATE.EL == EL1; 
when '10' xn = TRUE; 
when '11' xn = !r || PSTATE.EL == ELQ; 
else 
xn = !r || perms.xn == '1'; 
// Stage 1 walk is checked as a read, regardless of the original type 
if acctype == AccType_IFETCH && !s2fslwalk then 
fail = xn; 
failedread = TRUE; 


elsif (acctype IN { AccType_ATOMICRW, AccType_ORDEREDRW, AccType_ORDEREDATOMICRW }) && !s2fs1walk 


then 
fail = !r || Iw; 
failedread = !r; 

elsif acctype == AccType_DC && !s2fslwalk then 


// DC maintenance instructions operating by VA, do not generate Permission faults 
// from stage 2 translation, other than from stage 1 translation table walk. 


fail = FALSE; 

elsif iswrite && !s2fslwalk then 
fail = iw; 
failedread = FALSE; 

else 
fail = !r; 
failedread = !iswrite; 





if fail then 
domain = bits(4) UNKNOWN; 
secondstage = TRUE; 
return AArch32.PermissionFault(ipaddress, domain, level, acctype, 
!failedread, secondstage, s2fslwalk); 
else 
return AArch32.NoFault(); 


aarch32/translation/debug/AArch32.CheckBreakpoint 


// AArch32.CheckBreakpoint() 


// Called before executing the instruction of length "size" bytes at "vaddress" in an AArch32 


// translation regime. 


// The breakpoint can in fact be evaluated well ahead of execution, for example, at instruction 


// fetch. This is the simple sequential execution of the program. 


FaultRecord AArch32.CheckBreakpoint(bits(32) vaddress, integer size) 
assert ELUsingAArch32(S1TranslationRegime()); 
assert size IN {2,4}; 


match = FALSE; 
mismatch = FALSE; 


for i = 0 to UInt(DBGDIDR.BRPs) 
(match_i, mismatch_i) = AArch32.BreakpointMatch(i, vaddress, size); 
match = match || match_i; 
mismatch = mismatch || mismatch_i; 


if match && HaltOnBreakpointOrwatchpoint() then 
reason = DebugHalt_Breakpoint; 
Halt(reason) ; 


elsif (match || mismatch) && DBGDSCRext.MDBGen == '1' && AArch32.GenerateDebugExceptions() then 


acctype = AccType_IFETCH; 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 


ID070919 


ARM DDI 0487E.a 
ID070919 


Armv8 Pseudocode 
J1.2 Pseudocode for AArch32 operation 


iswrite = FALSE; 

debugmoe = DebugException_Breakpoint; 

return AArch32.DebugFault(acctype, iswrite, debugmoe); 
else 

return AArch32.NoFault(); 


aarch32/translation/debug/AArch32.CheckDebug 
// AArch32.CheckDebug() 
// Called on each access to check for a debug exception or entry to Debug state. 
FaultRecord AArch32.CheckDebug(bits(32) vaddress, AccType acctype, boolean iswrite, integer size) 
FaultRecord fault = AArch32.NoFault(); 


d_side = (acctype != AccType_IFETCH) ; 

generate_exception = AArch32.GenerateDebugExceptions() && DBGDSCRext.MDBGen == '1'; 

halt = HaltOnBreakpointOrwatchpoint(); 

// Relative priority of Vector Catch and Breakpoint exceptions not defined in the architecture 
vector_catch_first = ConstrainUnpredictableBool(); 


if !d_side && vector_catch_first && generate_exception then 
fault = AArch32.CheckVectorCatch(vaddress, size); 


if fault.statuscode == Fault_None && (generate_exception || halt) then 
if d_side then 
fault = AArch32.CheckWatchpoint(vaddress, acctype, iswrite, size); 
else 


fault = AArch32.CheckBreakpoint(vaddress, size); 


if fault.statuscode == Fault_None && !d_side && !vector_catch_first && generate_exception then 
return AArch32.CheckVectorCatch(vaddress, size); 


return fault; 


aarch32/translation/debug/AArch32.CheckVectorCatch 


// AArch32.CheckVectorCatch() 

———————————————E 

// Called before executing the instruction of length "size" bytes at "vaddress" in an AArch32 
// translation regime. 

// Vector Catch can in fact be evaluated well ahead of execution, for example, at instruction 
// fetch. This is the simple sequential execution of the program. 


FaultRecord AArch32.CheckVectorCatch(bits(32) vaddress, integer size) 
assert ELUsingAArch32(S1TranslationRegime()); 


match = AArch32.VCRMatch(vaddress); 
if size == 4 && !match && AArch32.VCRMatch(vaddress + 2) then 
match = ConstrainUnpredictableBool(); 


if match && DBGDSCRext.MDBGen == '1' && AArch32.GenerateDebugExceptions() then 
acctype = AccType_IFETCH; 
iswrite = FALSE; 
debugmoe = DebugException_VectorCatch; 
return AArch32.DebugFault(acctype, iswrite, debugmoe); 
else 
return AArch32.NoFault(); 


aarch32/translation/debug/AArch32.CheckWatchpoint 
// AArch32.CheckWatchpoint() 


// Called before accessing the memory location of "size" bytes at "address". 
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FaultRecord AArch32.CheckWatchpoint(bits(32) vaddress, AccType acctype, 
boolean iswrite, integer size) 
assert ELUsingAArch32(S1TranslationRegime()); 


match = FALSE; 
ispriv = AArch32.AccessIsPrivileged(acctype) ; 


for i = 0 to UInt(DBGDIDR.WRPs) 
match = match || AArch32.WatchpointMatch(i, vaddress, size, ispriv, iswrite); 


if match && HaltOnBreakpointOrWatchpoint() then 
reason = DebugHalt_Watchpoint; 
Halt(reason) ; 
elsif match && DBGDSCRext.MDBGen == '1' && AArch32.GenerateDebugExceptions() then 
debugmoe = DebugException_Watchpoint; 
return AArch32.DebugFault(acctype, iswrite, debugmoe); 
else 
return AArch32.NoFault(); 


aarch32/translation/faults/AArch32.AccessFlagFault 


// AArch32.AccessFlagFault() 
|[ ========================= 


FaultRecord AArch32.AccessFlagFault(bits(4@) ipaddress, bits(4) domain, integer level, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk) 


extflag = bit UNKNOWN; 

debugmoe = bits(4) UNKNOWN; 

errortype = bits(2) UNKNOWN; 

return AArch32.CreateFaultRecord(Fault_AccessFlag, ipaddress, domain, level, acctype, iswrite, 
extflag, debugmoe, errortype, secondstage, s2fslwalk); 


aarch32/translation/faults/AArch32.AddressSizeFault 


// AArch32.AddressSizeFault() 
// ========================== 


FaultRecord AArch32.AddressSizeFault(bits(40) ipaddress, bits(4) domain, integer level, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk) 


extflag = bit UNKNOWN; 

debugmoe = bits(4) UNKNOWN; 

errortype = bits(2) UNKNOWN; 

return AArch32.CreateFaultRecord(Fault_AddressSize, ipaddress, domain, level, acctype, iswrite, 
extflag, debugmoe, errortype, secondstage, s2fslwalk); 


aarch32/translation/faults/AArch32.AlignmentFault 


// AArch32.AlignmentFault() 
|[ ======================== 


FaultRecord AArch32.AlignmentFault(AccType acctype, boolean iswrite, boolean secondstage) 


ipaddress = bits(40) UNKNOWN; 
domain = bits(4) UNKNOWN; 
level = integer UNKNOWN; 
extflag = bit UNKNOWN; 
debugmoe = bits(4) UNKNOWN; 
errortype = bits(2) UNKNOWN; 
s2fslwalk = boolean UNKNOWN; 


return AArch32.CreateFaultRecord(Fault_Alignment, ipaddress, domain, level, acctype, iswrite, 
extflag, debugmoe, errortype, secondstage, s2fslwalk); 
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aarch32/translation/faults/AArch32.AsynchExternalAbort 


// AArch32.AsynchExternalAbort() 
[[ ============================= 


// Wrapper function for asynchronous external aborts 
FaultRecord AArch32.AsynchExternalAbort(boolean parity, bits(2) errortype, bit extflag) 


faulttype = if parity then Fault_AsyncParity else Fault_AsyncExternal; 
ipaddress = bits(40) UNKNOWN; 

domain = bits(4) UNKNOWN; 

level = integer UNKNOWN; 

acctype = AccType_NORMAL; 

jiswrite = boolean UNKNOWN; 

debugmoe = bits(4) UNKNOWN; 

secondstage = FALSE; 

s2fslwalk = FALSE; 


return AArch32.CreateFaultRecord(faulttype, ipaddress, domain, level, acctype, iswrite, extflag, 


debugmoe, errortype, secondstage, s2fslwalk); 


aarch32/translation/faults/AArch32.DebugF ault 


// AArch32.DebugFau1t() 
|[ ==================== 


FaultRecord AArch32.DebugFault(AccType acctype, boolean iswrite, bits(4) debugmoe) 


ipaddress = bits(4@) UNKNOWN; 
domain = bits(4) UNKNOWN; 
errortype = bits(2) UNKNOWN; 
level = integer UNKNOWN; 
extflag = bit UNKNOWN; 
secondstage = FALSE; 
s2fslwalk = FALSE; 


return AArch32.CreateFaultRecord(Fault_Debug, ipaddress, domain, level, acctype, iswrite, 
extflag, debugmoe, errortype, secondstage, s2fslwalk); 


aarch32/translation/faults/AArch32.DomainFault 


// AArch32.DomainFault() 
// ===================== 


FaultRecord AArch32.DomainFault(bits(4) domain, integer level, AccType acctype, boolean iswrite) 


ipaddress = bits(40) UNKNOWN; 
extflag = bit UNKNOWN; 
debugmoe = bits(4) UNKNOWN; 
errortype = bits(2) UNKNOWN; 
secondstage = FALSE; 
s2fslwalk = FALSE; 


return AArch32.CreateFaultRecord(Fault_Domain, ipaddress, domain, level, acctype, iswrite, 


extflag, debugmoe, errortype, secondstage, s2fslwalk); 


aarch32/translation/faults/AArch32.NoFault 


// AArch32.NoFault() 
// ================= 


FaultRecord AArch32.NoFault() 
ipaddress = bits(40) UNKNOWN; 


domain = bits(4) UNKNOWN; 
level = integer UNKNOWN; 
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acctype = AccType_NORMAL; 
jiswrite = boolean UNKNOWN; 
extflag = bit UNKNOWN; 
debugmoe = bits(4) UNKNOWN; 
errortype = bits(2) UNKNOWN; 
secondstage = FALSE; 
s2fsiwalk = FALSE; 


return AArch32.CreateFaultRecord(Fault_None, ipaddress, domain, level, acctype, iswrite, 
extflag, debugmoe, errortype, secondstage, s2fslwalk); 


aarch32/translation/faults/AArch32.PermissionFault 


// AArch32.PermissionFault() 
// ========================= 


FaultRecord AArch32.PermissionFault(bits(40) ipaddress, bits(4) domain, integer level, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk) 


extflag = bit UNKNOWN; 

debugmoe = bits(4) UNKNOWN; 

errortype = bits(2) UNKNOWN; 

return AArch32.CreateFaultRecord(Fault_Permission, ipaddress, domain, level, acctype, iswrite, 
extflag, debugmoe, errortype, secondstage, s2fslwalk); 


aarch32/translation/faults/AArch32.TranslationF ault 


// AArch32.TranslationFault() 
// ========================== 


FaultRecord AArch32.TranslationFault(bits(40) ipaddress, bits(4) domain, integer level, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk) 


extflag = bit UNKNOWN; 

debugmoe = bits(4) UNKNOWN; 

errortype = bits(2) UNKNOWN; 

return AArch32.CreateFaultRecord(Fault_Translation, ipaddress, domain, level, acctype, iswrite, 
extflag, debugmoe, errortype, secondstage, s2fslwalk); 


aarch32/translation/translation/AArch32.FirstStageTranslate 


// AArch32.FirstStageTranslate() 

eee ee a ee 

// Perform a stage 1 translation walk. The function used by Address Translation operations is 
// similar except it uses the translation regime specified for the instruction. 


AddressDescriptor AArch32.FirstStageTranslate(bits(32) vaddress, AccType acctype, boolean iswrite, 
boolean wasaligned, integer size) 


if PSTATE.EL == EL2 then 
sl_enabled = HSCTLR.M == '1'; 

elsif EL2Enabled() then 
tge = (if ELUsingAArch32(EL2) then HCR.TGE else HCR_EL2.TGE); 
dc = (if ELUsingAArch32(EL2) then HCR.DC else HCR_EL2.DC); 
sl_enabled = tge == '0' && dc == 'Q' && SCTLR.M == '1'; 

else 
sl_enabled = SCTLR.M == '1'; 


ipaddress = bits(4Q) UNKNOWN; 
secondstage = FALSE; 
s2fsiwalk = FALSE; 


if sl_enabled then // First stage enabled 
use_long_descriptor_format = PSTATE.EL == EL2 || TTBCR.EAE == '1'; 
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if use_long_descriptor_format then 
S1 = AArch32.TranslationTableWalkLD(ipaddress, vaddress, acctype, iswrite, secondstage, 
s2fslwalk, size); 
permissioncheck = TRUE; domaincheck = FALSE; 
else 
S1 = AArch32.TranslationTableWalkSD(vaddress, acctype, iswrite, size); 
permissioncheck = TRUE; domaincheck = TRUE; 
else 
S1 = AArch32.TranslateAddressSl0ff(vaddress, acctype, iswrite); 
permissioncheck = FALSE; domaincheck = FALSE; 


if UsingAArch32() && HaveTrapLoadStoreMultipleDeviceExt() && AArch32.ExecutingLSMInstr() then 
if Sl.addrdesc.memattrs.memtype == MemType_Device && S1.addrdesc.memattrs.device != 
DeviceType_GRE then 
nTLSMD = if S1TranslationRegime() == EL2 then HSCTLR.nTLSMD else SCTLR.nTLSMD; 
if nTLSMD == 'Q' then 
Sl.addrdesc. fault = AArch32.AlignmentFault(acctype, iswrite, secondstage) ; 


// Check for unaligned data accesses to Device memory 
if ((!wasaligned && acctype != AccType_IFETCH) || (acctype == AccType_DCZVA)) 
&& S1.addrdesc.memattrs.memtype == MemType_Device && !IsFault(Sl.addrdesc) then 
Sl.addrdesc. fault = AArch32.AlignmentFault(acctype, iswrite, secondstage) ; 
if !IsFault(Sl.addrdesc) && domaincheck then 
(permissioncheck, abort) = AArch32.CheckDomain(S1.domain, vaddress, S1.level, acctype, 
iswrite); 


Sl.addrdesc.fault = abort; 
if !IsFault(Sl.addrdesc) && permissioncheck then 
Sl.addrdesc.fault = AArch32.CheckPermission(Sl.perms, vaddress, S1. level, 
S1.domain, S1.addrdesc.paddress.NS, 
acctype, iswrite); 





// Check for instruction fetches from Device memory not marked as execute-never. If there has 
// not been a Permission Fault then the memory is not marked execute-never. 
if (!IsFault(Sl.addrdesc) && S1.addrdesc.memattrs.memtype == MemType_Device && 
acctype == AccType_IFETCH) then 
Sl.addrdesc = AArch32.InstructionDevice(S1.addrdesc, vaddress, ipaddress, S1. level, 
S1.domain, acctype, iswrite, 
secondstage, s2fslwalk); 


return S1.addrdesc; 


aarch32/translation/translation/AArch32.FullTranslate 


// AArch32.FullTranslate() 

// sssssssssesessse======= 

// Perform both stage 1 and stage 2 translation walks for the current translation regime. The 
// function used by Address Translation operations is similar except it uses the translation 
// regime specified for the instruction. 


AddressDescriptor AArch32.FullTranslate(bits(32) vaddress, AccType acctype, boolean iswrite, 
boolean wasaligned, integer size) 


// First Stage Translation 

S1 = AArch32.FirstStageTranslate(vaddress, acctype, iswrite, wasaligned, size); 

if !IsFault(S1) && !(HaveNV2Ext() && acctype == AccType_NV2REGISTER) && HasS2Translation() then 
s2fslwalk = FALSE; 
result = AArch32.SecondStageTranslate(S1, vaddress, acctype, iswrite, wasaligned, s2fslwalk, 


size); 
else 
result = S1; 
return result; 
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aarch32/translation/translation/AArch32.SecondStageTranslate 


// AArch32.SecondStageTranslate() 

// =se 

// Perform a stage 2 translation walk. The function used by Address Translation operations is 
// similar except it uses the translation regime specified for the instruction. 


AddressDescriptor AArch32.SecondStageTranslate(AddressDescriptor S1, bits(32) vaddress, 
AccType acctype, boolean iswrite, boolean wasaligned, 
boolean s2fslwalk, integer size) 
assert HasS2Translation(); 
assert IsZero(S1.paddress.address<47:40>) ; 
hwupdatewalk = FALSE; 
if !ELUsingAArch32(EL2) then 
return AArch64.SecondStageTranslate(S1, ZeroExtend(vaddress, 64), acctype, iswrite, 
wasaligned, s2fslwalk, size, hwupdatewalk); 


s2_enabled = HCR.VM == '1' || HCR.DC == '1' 
secondstage = TRUE; 


if s2_enabled then // Second stage enabled 
ipaddress = S1.paddress.address<39:0>; 
S2 = AArch32.TranslationTableWalkLD(ipaddress, vaddress, acctype, iswrite, secondstage, 
s2fslwalk, size); 


// Check for unaligned data accesses to Device memory 

if ((!wasaligned && acctype != AccType_IFETCH) || (acctype == AccType_DCZVA)) 
&& S2.addrdesc.memattrs.memtype == MemType_Device && !IsFault(S2.addrdesc) then 
S2.addrdesc. fault = AArch32.AlignmentFault(acctype, iswrite, secondstage); 


// Check for permissions on Stage2 translations 
if !IsFault(S2.addrdesc) then 
S2.addrdesc.fault = AArch32.CheckS2Permission(S2.perms, vaddress, ipaddress, S2.level, 
acctype, iswrite, s2fslwalk); 


// Check for instruction fetches from Device memory not marked as execute-never. As there 
// has not been a Permission Fault then the memory is not marked execute-never. 
if (!s2fslwalk && !IsFault(S2.addrdesc) && S2.addrdesc.memattrs.memtype == MemType_Device && 
acctype == AccType_IFETCH) then 
domain = bits(4) UNKNOWN; 
S2.addrdesc = AArch32.InstructionDevice(S2.addrdesc, vaddress, ipaddress, S2.level, 
domain, acctype, iswrite, 
secondstage, s2fslwalk); 


// Check for protected table walk 
if (s2fslwalk && !IsFault(S2.addrdesc) && HCR.PTW == '1' && 
S2.addrdesc.memattrs.memtype == MemType_Device) then 
domain = bits(4) UNKNOWN; 
S2.addrdesc.fault = AArch32.PermissionFault(ipaddress, domain, S2.level, acctype, 
iswrite, secondstage, s2fslwalk); 


result = CombineS1S2Desc(S1, S2.addrdesc); 
else 
result = S1; 


return result; 


aarch32/translation/translation/AArch32.SecondStageWalk 
// AArch32.SecondStageWalk() 
// ========================= 


// Perform a stage 2 translation on a stage 1 translation page table walk access. 


AddressDescriptor AArch32.SecondStageWalk(AddressDescriptor S1, bits(32) vaddress, AccType acctype, 
boolean iswrite, integer size) 


assert HasS2Translation(); 
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s2fslwalk = TRUE; 

wasaligned = TRUE; 

return AArch32.SecondStageTranslate(S1, vaddress, acctype, iswrite, wasaligned, s2fslwalk, 
size); 


aarch32/translation/translation/AArch32.TranslateAddress 
// AArch32.TranslateAddress() 
// Main entry point for translating an address 


AddressDescriptor AArch32.TranslateAddress(bits(32) vaddress, AccType acctype, boolean iswrite, 
boolean wasaligned, integer size) 


if !ELUsingAArch32(S1TranslationRegime()) then 
return AArch64.TranslateAddress(ZeroExtend(vaddress, 64), acctype, iswrite, wasaligned, 
size); 
result = AArch32.FullTranslate(vaddress, acctype, iswrite, wasaligned, size); 


if !(acctype IN {AccType_PTW, AccType_IC, AccType_AT}) && !IsFault(result) then 
result. fault = AArch32.CheckDebug(vaddress, acctype, iswrite, size); 


// Update virtual address for abort functions 
result.vaddress = ZeroExtend(vaddress); 


return result; 


aarch32/translation/walk/AArch32.TranslationTableWalkLD 


// AArch32.TranslationTableWalkLD() 

a a 

// Returns a result of a translation table walk using the Long-descriptor format 

// 

// Implementations might cache information from memory in any number of non-coherent TLB 
// caching structures, and so avoid memory accesses that have been expressed in this 

// pseudocode. The use of such TLBs is not expressed in this pseudocode. 


TLBRecord AArch32.TranslationTableWalkLD(bits(4@) ipaddress, bits(32) vaddress, 
AccType acctype, boolean iswrite, boolean secondstage, 
boolean s2fslwalk, integer size) 
if !secondstage then 
assert ELUsingAArch32(S1TranslationRegime()); 
else 
assert HaveEL(EL2) && !IsSecure() && ELUsingAArch32(EL2) && HasS2Translation(); 


TLBRecord result; 

AddressDescriptor descaddr; 

bits(64) baseregister; 

bits(40) inputaddr; // Input Address is 'vaddress' for stage 1, 'ipaddress' for stage 2 

bit nswalk; // Stage 2 translation table walks are to Secure or to Non-secure PA 
space 


domain = bits(4) UNKNOWN; 
descaddr.memattrs.memtype = MemType_Normal ; 


// Fixed parameters for the page table walk: 


// grainsize = Log2(Size of Table) - Size of Table is 4KB in AArch32 

// stride = Log2(Address per Level) - Bits of address consumed at each level 
constant integer grainsize = 12; // Log2(4KB page size) 

constant integer stride = grainsize - 3; // Log2(page size / 8 bytes) 


// Derived parameters for the page table walk: 
// inputsize = Log2(Size of Input Address) - Input Address size in bits 
// level = Level to start walk from 
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// This means that the number of levels after start level = 3-level 


if !secondstage then 


// First stage translation 
inputaddr = ZeroExtend(vaddress) ; 
el = AArch32.AccessUsesEL(acctype) ; 
if el == EL2 then 
inputsize = 32 - UInt(HTCR.TQSZ); 
basefound = inputsize == 32 || IsZero(inputaddr<31:inputsize>) ; 
disabled = FALSE; 
baseregister = HTTBR; 
descaddr.memattrs = WalkAttrDecode(HTCR.SHO, HTCR.ORGN@, HTCR.IRGNQ, secondstage) ; 
reversedescriptors = HSCTLR.EE == '1'; 
lookupsecure = FALSE; 
singlepriv = TRUE; 
hierattrsdisabled = AArch32.HaveHPDExt() && HTCR.HPD == '1'; 
else 
basefound = FALSE; 
disabled = FALSE; 
t@size = UInt(TTBCR.TOQSZ); 
if tO@size == @ || IsZero(inputaddr<31:(32-tOsize)>) then 
inputsize = 32 - tQsize; 
basefound = TRUE; 
baseregister = TTBRQ; 
descaddr.memattrs = WalkAttrDecode(TTBCR.SHQ, TTBCR.ORGNO, TTBCR.IRGNQ, secondstage) ; 
hierattrsdisabled = AArch32.HaveHPDExt() && TTBCR.T2E == '1' && TTBCR2.HPD@ == '1'; 
tlsize = UInt(TTBCR.T1SZ); 
if (tlsize == 0 && !basefound) || (tlsize > 0 && IsOnes(inputaddr<31:(32-tlsize)>)) then 
inputsize = 32 - tlsize; 
basefound = TRUE; 
baseregister = TTBR1; 
descaddr.memattrs = WalkAttrDecode(TTBCR.SH1, TTBCR.ORGN1, TTBCR.IRGN1, secondstage) ; 
hierattrsdisabled = AArch32.HaveHPDExt() && TTBCR.T2E == '1' && TTBCR2.HPD1 == '1'; 
reversedescriptors = SCTLR.EE == '1'; 
lookupsecure = IsSecure(); 
singlepriv = FALSE; 
// The starting level is the number of strides needed to consume the input address 
level = 4 - (1 + (inputsize - grainsize - 1) DIV stride); 


// Second stage translation 
inputaddr = ipaddress; 
inputsize = 32 - SInt(VTCR.TQSZ); 
// NTCR.S must match VTCR.TQSZ[3] 
if VTCR.S != VTCR.T@SZ<3> then 
(-, inputsize) = ConstrainUnpredictableInteger(32-7, 32+8); 
basefound = inputsize == 40 || IsZero(inputaddr<39:inputsize>) ; 
disabled = FALSE; 
descaddr.memattrs = WalkAttrDecode(VTCR.SHQ, VTCR.ORGNO@, VTCR.IRGN@, secondstage) ; 
reversedescriptors = HSCTLR.EE == '1'; 
singlepriv = TRUE; 


lookupsecure = FALSE; 

baseregister = VTTBR; 

startlevel = UInt(VTCR.SLQ); 

level = 2 - startlevel; 

if level <= @ then basefound = FALSE; 


// Number of entries in the starting level table = 
// (Size of Input Address)/((Address per level)A(Num levels remaining)«(Size of Table)) 
startsizecheck = inputsize - ((3 - level)*stride + grainsize); // Log2(Num of entries) 


// Check for starting level table with fewer than 2 entries or longer than 16 pages. 

// Lower bound check is: startsizecheck < Log2(2 entries) 

// That is, VTCR.SLO == '00' and SInt(VTCR.T@SZ) > 1, Size of Input Address < 2A31 bytes 
// Upper bound check is: startsizecheck > Log2(pagesize/8+16) 

// That is, VTCR.SLO@ == '@1' and SInt(VTCR.T@SZ) < -2, Size of Input Address > 2434 bytes 
if startsizecheck < 1 || startsizecheck > stride + 4 then basefound = FALSE; 
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if !basefound || disabled then 
level = 1; // AArch64 reports this as a level @ fault 
result.addrdesc.fault = AArch32.TranslationFault(ipaddress, domain, level, acctype, iswrite, 
secondstage, s2fslwalk); 
return result; 


if !IsZero(baseregister<47:40>) then 
level = 0; 
result.addrdesc.fault = AArch32.AddressSizeFault(ipaddress, domain, level, acctype, iswrite, 
secondstage, s2fslwalk); 
return result; 


// Bottom bound of the Base address is: 

// Log2(8 bytes per entry)+Log2(Number of entries in starting level table) 

// Number of entries in starting level table = 

// (Size of Input Address)/((Address per level)A(Num levels remaining)*(Size of Table)) 
baselowerbound = 3 + inputsize - ((3-level)sstride + grainsize); // Log2(Num of entries«8) 
baseaddress = baseregister<39:baselowerbound>:Zeros(baselowerbound) ; 


ns_table = if lookupsecure then 'Q' else '1'; 
ap_table = '00'; 
xn_table = 'Q'; 
pxn_table = 'Q'; 


addrselecttop = inputsize - 1; 


repeat 
addrselectbottom = (3-level)sstride + grainsize; 


bits(40) index = ZeroExtend(inputaddr<addrselecttop:addrselectbottom>: 'QQQ'); 
descaddr.paddress.address = ZeroExtend(baseaddress OR index); 
descaddr.paddress.NS = ns_table; 


// If there are two stages of translation, then the first stage table walk addresses 
// are themselves subject to translation 
if secondstage || !HasS2Translation() || (HaveNV2Ext() && acctype == AccType_NV2REGISTER) then 
descaddr2 = descaddr; 
else 
descaddr2 = AArch32.SecondStageWalk(descaddr, vaddress, acctype, iswrite, 8); 
// Check for a fault on the stage 2 walk 
if IsFault(descaddr2) then 
result.addrdesc.fault = descaddr2.fault; 
return result; 


// Update virtual address for abort functions 
descaddr2.vaddress = ZeroExtend(vaddress); 


accdesc = CreateAccessDescriptorPTW(acctype, secondstage, s2fslwalk, level); 
desc = _Mem[descaddr2, 8, accdesc]; 


if reversedescriptors then desc = BigEndianReverse(desc); 


if desc<@> == 'Q' || (desc<1:0> == '01' && level == 3) then 
// Fault (00), Reserved (10), or Block (01) at level 3. 
result.addrdesc.fault = AArch32.TranslationFault(ipaddress, domain, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 


// Nalid Block, Page, or Table entry 
if desc<1:@> == 'Q1' || level == 3 then // Block (@1) or Page (11) 
blocktranslate = TRUE; 
else // Table (11) 
if !IsZero(desc<47:40>) then 
result.addrdesc.fault = AArch32.AddressSizeFault(ipaddress, domain, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 
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baseaddress = desc<39:grainsize>:Zeros(grainsize); 
if !secondstage then 
// Unpack the upper and lower table attributes 


ns_table = ns_table OR desc<63>; 

if !secondstage && !hierattrsdisabled then 
ap_table<l> = ap_table<1> OR desc<62>; // read-only 
xn_table = xn_table OR desc<60>; 


// pxn_table and ap_table[@] apply only in EL1&@ translation regimes 
if !singlepriv then 

pxn_table = pxn_table OR desc<59>; 

ap_table<@> = ap_table<@> OR desc<61>; // privileged 


level = level + 1; 
addrselecttop = addrselectbottom - 1; 
blocktranslate = FALSE; 

until blocktranslate; 


// Unpack the descriptor into address and upper and lower block attributes 
outputaddress = desc<39:addrselectbottom>: inputaddr<addrselectbottom-1:0>; 


// Check the output address is inside the supported range 
if !IsZero(desc<47:4@>) then 
result.addrdesc.fault = AArch32.AddressSizeFault(ipaddress, domain, level, acctype, 


iswrite, secondstage, s2fslwalk); 
return result; 


// Check the access flag 
if desc<10> == 'Q' then 
result.addrdesc. fault = AArch32.AccessFlagFault(ipaddress, domain, level, acctype, 


iswrite, secondstage, s2fslwalk); 
return result; 


xn = desc<54>; // Bit[54] of the block/page descriptor 
holds UXN 

pxn = desc<53>; // Bit[53] of the block/page descriptor 
holds PXN 

ap = desc<7:6>:'1'; // Bits[7:6] of the block/page descriptor 


hold AP[2:1] 
contiguousbit = desc<52>; 
nG = desc<11>; 
sh = desc<9:8>; 
memattr = desc<5:2>; // AttrIndx and NS bit in stage 1 


result.domain = bits(4) UNKNOWN; // Domains not used 
result. level = level; 
result.blocksize = 2A((3-level)sstride + grainsize); 


// Stage 1 translation regimes also inherit attributes from the tables 
if !secondstage then 
result.perms.xn = xn OR xn_table; 
result.perms.ap<2> = ap<2> OR ap_table<l>; // Force read-only 
// PXN, nG and AP[1] apply only in EL1&@ stage 1 translation regimes 
if !singlepriv then 
result.perms.ap<1> = ap<l> AND NOT(ap_table<@>); // Force privileged only 
result.perms.pxn = pxn OR pxn_table; 
// Pages from Non-secure tables are marked non-global in Secure EL1&0 
if IsSecure() then 
result.nG = nG OR ns_table; 
else 
result.nG = nG; 


else 

result.perms.ap<1> = '1'; 

result.perms.pxn = 'Q'; 

result.nG = '0'; 
result.GP = desc<5Q>; // Stage 1 block or pages might be guarded 
result.perms.ap<@> = '1'; 


result.addrdesc.memattrs = AArch32.S1AttrDecode(sh, memattr<2:@>, acctype); 
result.addrdesc.paddress.NS = memattr<3> OR ns_table; 
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else 
result.perms.ap<2:1> = ap<2:1>; 
result.perms.ap<ð> = '1'; 
result.perms.xn = XN; 
if HaveExtendedExecuteNeverExt() then result.perms.xxn = desc<53>; 
result. perms .pxn = '0'; 
result.nG = '0'; 


if s2fslwalk then 

result.addrdesc.memattrs = S2AttrDecode(sh, memattr, AccType_PTW); 
else 

result.addrdesc.memattrs = S2AttrDecode(sh, memattr, acctype); 
result.addrdesc.paddress.NS = '1'; 


result.addrdesc.paddress.address = ZeroExtend(outputaddress) ; 
result.addrdesc.fault = AArch32.NoFault(); 

result.contiguous = contiguousbit == '1'; 

if HaveCommonNotPrivateTransExt() then result.CnP = baseregister<Q>; 


return result; 


aarch32/translation/walk/AArch32.TranslationTableWalkSD 


// AArch32.TranslationTableWalkSD() 

 ——— ee 

// Returns a result of a translation table walk using the Short-descriptor format 

// 

// Implementations might cache information from memory in any number of non-coherent TLB 
// caching structures, and so avoid memory accesses that have been expressed in this 

// pseudocode. The use of such TLBs is not expressed in this pseudocode. 


TLBRecord AArch32.TranslationTableWalkSD(bits(32) vaddress, AccType acctype, boolean iswrite, 
integer size) 
assert ELUsingAArch32(S1TranslationRegime()); 


// This is only called when address translation is enabled 
TLBRecord result; 

AddressDescriptor lldescaddr; 

AddressDescriptor 12descaddr; 

bits (40) outputaddress; 


// Variables for Abort functions 
ipaddress = bits(4@) UNKNOWN; 
secondstage = FALSE; 

s2fslwalk = FALSE; 

NS = bit UNKNOWN; 


// Default setting of the domain 
domain = bits(4) UNKNOWN; 


// Determine correct Translation Table Base Register to use. 
bits(64) ttbr; 

n = UInt(TTBCR.N); 

if n == @ || IsZero(vaddress<31:(32-n)>) then 


ttbr = TTBROQ; 

disabled = (TIBCR.PD@ == '1'); 
else 

ttbr = TTBR1; 


disabled = (TIBCR.PD1 == '1'); 
n= 0; // TTBR1 translation always works like N=0 TTBRO translation 


// Check this Translation Table Base Register is not disabled. 
if disabled then 
level = 1; 
result.addrdesc. fault = AArch32.TranslationFault(ipaddress, domain, level, acctype, iswrite, 
secondstage, s2fslwalk); 
return result; 
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// Obtain descriptor from initial lookup. 
lidescaddr.paddress.address = ZeroExtend(ttbr<31:14-n>:vaddress<31-n:20>:'Q0'); 
lidescaddr.paddress.NS = if IsSecure() then 'Q' else '1'; 


IRGN = ttbr<@>:ttbr<6>; // TTBR.IRGN 
RGN = ttbr<4:3>; // TTBR.RGN 
SH = ttbr<1>:ttbr<5>; // TTBR.S:TTBR.NOS 


]ldescaddr.memattrs = WalkAttrDecode(SH, RGN, IRGN, secondstage) ; 


if !HaveEL(EL2) || (IsSecure() && !IsSecureEL2Enabled()) then 
// if only 1 stage of translation 
l1ldescaddr2 = 11descaddr; 

else 


J1descaddr2 = AArch32.SecondStageWalk(1ldescaddr, vaddress, acctype, iswrite, 4); 


// Check for a fault on the stage 2 walk 

if IsFault(lldescaddr2) then 
result.addrdesc.fault = lldescaddr2.fault; 
return result; 


// Update virtual address for abort functions 
J1ldescaddr2.vaddress = ZeroExtend(vaddress) ; 


accdesc = CreateAccessDescriptorPTW(acctype, secondstage, s2fslwalk, level); 
J1ldesc = _Mem[]ldescaddr2, 4,accdesc]; 


if SCTLR.EE == '1' then l1desc = BigEndianReverse(11desc); 


// Process descriptor from initial lookup. 
case lldesc<1:0> of 
when 'QQ' // Fault, Reserved 
level = 1; 


result.addrdesc.fault = AArch32.TranslationFault(ipaddress, domain, level, acctype, 
iswrite, secondstage, s2fslwalk); 


return result; 


when 'Q1' // Large page or Small page 


domain = 11desc<8:5>; 
level = 2; 

pxn = 11desc<2>; 

NS = l1desc<3>; 


// Obtain descriptor from level 2 lookup. 


]2descaddr.paddress.address = ZeroExtend(11desc<31:10>:vaddress<19:12>:'Q0'); 


]2descaddr.paddress.NS = if IsSecure() then 'Q' else '1'; 
]2descaddr.memattrs = 1ldescaddr.memattrs; 


if !HaveEL(EL2) || (IsSecure() && !IsSecureEL2Enabled()) then 
// if only 1 stage of translation 
]2descaddr2 = 12descaddr; 

else 


l2descaddr2 = AArch32.SecondStageWalk(12descaddr, vaddress, acctype, iswrite, 4); 


// Check for a fault on the stage 2 walk 

if IsFault(12descaddr2) then 
result.addrdesc. fault = 12descaddr2. fault; 
return result; 


// Update virtual address for abort functions 
]2descaddr2.vaddress = ZeroExtend(vaddress); 


accdesc = CreateAccessDescriptorPTW(acctype, secondstage, s2fslwalk, level); 


]2desc = _Mem[12descaddr2, 4, accdesc]; 
if SCTLR.EE == '1' then 12desc = BigEndianReverse(12desc) ; 


// Process descriptor from level 2 lookup. 
if 12desc<1:@> == '00' then 


result.addrdesc.fault = AArch32.TranslationFault(ipaddress, domain, level, acctype, 
iswrite, secondstage, s2fslwalk); 


return result; 
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nG = 12desc<11>; 
S = 12desc<10>; 
ap = 12desc<9,5:4>; 


if SCTLR.AFE == '1' && 12desc<4> == '@' then 
// Armv8 VMSAv8-32 does not support hardware management of the Access flag. 
result.addrdesc.fault = AArch32.AccessFlagFault(ipaddress, domain, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 


if 12desc<1> == 'Q' then // Large page 
xn = 12desc<15>; 
tex = 12desc<14:12>; 
c = 12desc<3>; 
b = 12desc<2>; 
blocksize = 64; 
outputaddress = ZeroExtend(12desc<31:16>:vaddress<15:0>); 
else // Small page 
tex = 12desc<8:6>; 
c = 12desc<3>; 
]2desc<2>; 
xn = 12desc<0>; 
blocksize = 4; 
outputaddress = ZeroExtend(12desc<31:12>:vaddress<11:0>); 


om 
iT} 


when '1x' // Section or Supersection 
NS = l1desc<19>; 
nG = l1desc<17>; 
S = l1desc<16>; 
ap = l1desc<15,11:10>; 
tex = lldesc<14:12>; 
xn = l1ldesc<4>; 
c = l1desc<3>; 
b = l1desc<2>; 
pxn = 11desc<Q>; 
level = 1; 





if SCTLR.AFE == '1' && 11ldesc<1@> == '@' then 
// Armv8 VMSAv8-32 does not support hardware management of the Access flag. 
result.addrdesc.fault = AArch32.AccessFlagFault(ipaddress, domain, level, acctype, 
iswrite, secondstage, s2fslwalk); 
return result; 


if lldesc<18> == 'Q' then // Section 
domain = l1ldesc<8:5>; 
blocksize = 1024; 
outputaddress = ZeroExtend(11desc<31:20>:vaddress<19:0>); 
else // Supersection 
domain = '0000'; 
blocksize = 16384; 
outputaddress = 11desc<8:5>:11desc<23:20>:11desc<31:24>:vaddress<23:0>; 


// Decode the TEX, C, B and S bits to produce the TLBRecord's memory attributes 
if SCTLR.TRE == '@' then 
if RemapRegsHaveResetValues() then 
result.addrdesc.memattrs = AArch32.DefaultTEXDecode(tex, c, b, S, acctype); 
else 
result.addrdesc.memattrs = MemoryAttributes IMPLEMENTATION_DEFINED; 
else 
result.addrdesc.memattrs = AArch32.RemappedTEXDecode(tex, c, b, S, acctype); 


// Set the rest of the TLBRecord, try to add it to the TLB, and return it. 
result.perms.ap = ap; 

result.perms.xn = xn; 

result.perms.pxn = pxn; 

result.nG = nG; 

result.domain = domain; 
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result.level = level; 

result.blocksize = blocksize; 
result.addrdesc.paddress.address = ZeroExtend(outputaddress); 
result.addrdesc.paddress.NS = if IsSecure() then NS else '1'; 
result.addrdesc.fault = AArch32.NoFault(); 


return result; 


aarch32/translation/walk/RemapRegsHaveResetValues 


boolean RemapRegsHaveResetValues(); 
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J1.3 Shared pseudocode 


This section holds the pseudocode that is common to execution in AArch64 state and in AArch32 state. Functions 
listed in this section are identified only by a FunctionName, without an AArch64. or AArch32. prefix. This section is 

organized by functional groups, with the functional groups being indicated by hierarchical path names, for example 
shared/debug/DebugTarget. 


The top-level sections of the shared pseudocode hierarchy are: 


shared/debug. 

shared/exceptions on page J1-7512. 
shared/functions on page J1-7514. 
shared/trace on page J1-7594. 
shared/translation on page J1-7595. 


J1.3.1 shared/debug 


ARM DDI 0487E.a 
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This section includes the following pseudocode functions: 


shared/debug/ClearStickyErrors/ClearStickyErrors on page J1-7494. 
shared/debug/DebugTarget/Debug Target on page J1-7494. 
shared/debug/DebugTarget/Debug TargetF'rom on page J1-7495. 
shared/debug/DoubleLockStatus/DoubleLockStatus on page J1-7495. 
shared/debug/authentication/AllowExternalDebugAccess on page J1-7495. 
shared/debug/authentication/AllowExternalPMUAccess on page J1-7496. 
shared/debug/authentication/Debug_authentication on page J1-7496. 
shared/debug/authentication/ExternalInvasiveDebugEnabled on page J1-7496. 
shared/debug/authentication/ExternalNoninvasiveDebugAllowed on page J1-7496. 
shared/debug/authentication/ExternalNoninvasiveDebugEnabled on page J1-7497. 
shared/debug/authentication/ExternalSecureInvasiveDebugEnabled on page J1-7497. 
shared/debug/authentication/ExternalSecureNoninvasiveDebugEnabled on page J1-7497. 
shared/debug/authentication/IsAccessSecure on page J1-7497. 
shared/debug/authentication/IsCorePowered on page J1-7497. 
shared/debug/cti/CTI_SetEventLevel on page J1-7497. 
shared/debug/cti/CTI_SignalEvent on page J1-7497. 
shared/debug/cti/CrossTrigger on page J1-7498. 
shared/debug/dccanditr/CheckForDCCInterrupts on page J1-7498. 
shared/debug/dccanditr/DBGDTRRX_ELO on page J1-7498. 
shared/debug/dccanditr/DBGDTRTX_ELO on page J1-7499. 
shared/debug/dccanditr/DBGDTR_ELO on page J1-7500. 
shared/debug/dccanditr/DTR on page J1-7500. 

shared/debug/dccanditr/EDITR on page J1-7500. 
shared/debug/halting/DCPSInstruction on page J1-7501. 
shared/debug/halting/DRPSInstruction on page J1-7502. 
shared/debug/halting/DebugHalt on page J1-7503. 
shared/debug/halting/DisableITRAndResumelnstructionPrefetch on page J1-7503. 
shared/debug/halting/ExecuteA64 on page J1-7503. 
shared/debug/halting/ExecuteT32 on page J1-7503. 
shared/debug/halting/ExitDebugState on page J1-7503. 

shared/debug/halting/Halt on page J1-7504. 
shared/debug/halting/HaltOnBreakpointOrWatchpoint on page J1-7505. 
shared/debug/halting/Halted on page J1-7505. 
shared/debug/halting/HaltingAllowed on page J1-7505. 
shared/debug/halting/Restarting on page J1-7505. 
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. shared/debug/halting/StopInstructionPrefetchAndEnablelITR on page J1-7505. 
. shared/debug/halting/UpdateEDSCRFields on page J1-7505. 

. shared/debug/haltingevents/CheckExceptionCatch on page J1-7506. 

: shared/debug/haltingevents/CheckHaltingStep on page J1-7506. 

. shared/debug/haltingevents/CheckOSUnlockCatch on page J1-7507. 

$ shared/debug/haltingevents/CheckPendingOSUnlockCatch on page J1-7507. 
. shared/debug/haltingevents/CheckPendingResetCatch on page J1-7507. 

s shared/debug/haltingevents/CheckResetCatch on page J1-7507. 

$ shared/debug/haltingevents/CheckSoftwareAccess ToDebugRegisters on page J1-7507. 
s shared/debug/haltingevents/ExternalDebugRequest on page J1-7507. 

7 shared/debug/haltingevents/HaltingStep_DidNotStep on page J1-7508. 

. shared/debug/haltingevents/HaltingStep_SteppedEX on page J1-7508. 

. shared/debug/haltingevents/RunHaltingStep on page J1-7508. 

. shared/debug/interrupts/ExternalDebuglInterruptsDisabled on page J1-7508. 
. shared/debug/interrupts/InterruptID on page J1-7508. 

. shared/debug/interrupts/SetInterruptRequestLevel on page J1-7509. 

. shared/debug/samplebasedprofiling/CreatePCSample on page J1-7509. 

7 shared/debug/samplebasedprofiling/EDPCSRlo on page J1-7509. 

$ shared/debug/samplebasedprofiling/PCSample on page J1-7510. 

7 shared/debug/samplebasedprofiling/PMPCSR on page J1-7510. 

s shared/debug/softwarestep/CheckSoftwareStep on page J1-7511. 

s shared/debug/softwarestep/DebugExceptionReturnSS on page J1-7511. 

$ shared/debug/softwarestep/SSAdvance on page J1-7511. 

. shared/debug/softwarestep/SoftwareStep_DidNotStep on page J1-7512. 

. shared/debug/softwarestep/SoftwareStep_SteppedEX on page J1-7512. 


shared/debug/ClearStickyErrors/ClearStickyErrors 


// ClearStickyErrors() 


// e 
ClearStickyErrors() 
EDSCR.TXU = 'Q'; // Clear TX underrun flag 
EDSCR.RXO = 'Q'; // Clear RX overrun flag 
if Halted() then // in Debug state 
EDSCR.ITO = 'Q'; // Clear ITR overrun flag 


// If halted and the ITR is not empty then it is UNPREDICTABLE whether the EDSCR.ERR is cleared. 
// The UNPREDICTABLE behavior also affects the instructions in flight, but this is not described 
// in the pseudocode. 
if Halted() && EDSCR.ITE == '@' && ConstrainUnpredictableBool() then 

return; 
EDSCR.ERR = 'Q'; // Clear cumulative error flag 


return; 


shared/debug/DebugTarget/DebugTarget 

// DebugTarget () 

// Returns the debug exception target Exception level 
bits(2) DebugTarget() 


secure = IsSecure(); 
return DebuglargetFrom(secure) ; 
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shared/debug/DebugTarget/DebugTargetFrom 


// DebugTargetFrom() 


bits(2) DebugTargetFrom(boolean secure) 
if HaveEL(EL2) && !secure then 
if ELUsingAArch32(EL2) then 
route_to_el2 = (HDCR.TDE == '1' || HCR.TGE == '1'); 
else 
route_to_el2 = (MDCR_EL2.TDE == '1' || HCR_EL2.TGE == '1'); 
else 
route_to_el2 = FALSE; 


if route_to_el2 then 


target = EL2; 

elsif HaveEL(EL3) && HighestELUsingAArch32() && secure then 
target = EL3; 

else 
target = EL1; 


return target; 


shared/debug/DoubleLockStatus/DoubleLockStatus 
// DoubleLockStatus() 


// Returns the state of the OS Double Lock. 
// FALSE if OSDLR_EL1.DLK == @ or DBGPRCR_EL1.CORENPDRQ == 1 or the PE is in Debug state. 
// TRUE if OSDLR_EL1.DLK == 1 and DBGPRCR_EL1.CORENPDRQ == @ and the PE is in Non-debug state. 


boolean DoubleLockStatus() 
if !HaveDoubleLock() then 
return FALSE; 
elsif ELUsingAArch32(EL1) then 
return DBGOSDLR.DLK == '1' && DBGPRCR.CORENPDRQ == '@' && !Halted(); 
else 
return OSDLR_EL1.DLK == '1' && DBGPRCR_EL1.CORENPDRQ == '@' && !Halted(); 


shared/debug/authentication/AllowExternalDebugAccess 
// AllowExternalDebugAccess() 


// Returns TRUE if an external debug interface access to the External debug registers 
// is allowed, FALSE otherwise. 


boolean AllowExternalDebugAccess() 
// The access may also be subject to OS Lock, power-down, etc. 
if HaveSecureExtDebugView() then 
return AllowExternalDebugAccess(IsAccessSecure()); 
else 
return AllowExternalDebugAccess(ExternalSecureInvasiveDebugEnabled()); 


// AllowExternalDebugAccess() 


// Returns TRUE if an external debug interface access to the External debug registers 
// is allowed for the given Security state, FALSE otherwise. 


boolean AllowExternalDebugAccess(boolean allow_secure) 
// The access may also be subject to OS Lock, power-down, etc. 
if HaveSecureExtDebugView() || ExternalInvasiveDebugEnabled() then 
if allow_secure then 
return TRUE; 
elsif HaveEL(EL3) then 
if ELUsingAArch32(EL3) then 
return SDCR.EDAD == 'Q'; 
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else 
return MDCR_EL3.EDAD == '0'; 
else 
return !IsSecure(); 
else 
return FALSE; 


shared/debug/authentication/AllowExternalPMUAccess 
// AllowExternalPMUAccess() 
// Returns TRUE if an external debug interface access to the PMU registers is allowed, FALSE otherwise. 


boolean AllowExternalPMUAccess() 
// The access may also be subject to OS Lock, power-down, etc. 
if HaveSecureExtDebugView() then 
return Al lowExternalPMUAccess(IsAccessSecure()); 
else 
return AllowExternalPMUAccess(ExternalSecureNoninvasiveDebugEnabled()); 


// AllowExternalPMUAccess() 

————————————— 

// Returns TRUE if an external debug interface access to the PMU registers is allowed for the given 
// Security state, FALSE otherwise. 


boolean AllowExternalPMUAccess(boolean allow_secure) 
// The access may also be subject to OS Lock, power-down, etc. 
if HaveSecureExtDebugView() || ExternalNoninvasiveDebugEnabled() then 
if allow_secure then 
return TRUE; 
elsif HaveEL(EL3) then 
if ELUsingAArch32(EL3) then 
return SDCR.EPMAD == 'Q'; 
else 
return MDCR_EL3.EPMAD == 'Q'; 
else 
return !IsSecure(); 
else 
return FALSE; 


shared/debug/authentication/Debug_authentication 

signal DBGEN; 

signal NIDEN; 

signal SPIDEN; 

signal SPNIDEN; 
shared/debug/authentication/ExternallnvasiveDebugEnabled 


// External InvasiveDebugEnab1ed() 


// The definition of this function is IMPLEMENTATION DEFINED. 
// In the recommended interface, this function returns the state of the DBGEN signal. 


boolean ExternalInvasiveDebugEnab1ed() 
return DBGEN == HIGH; 


shared/debug/authentication/ExternalNoninvasiveDebugAllowed 
// ExternalNoninvasiveDebugAl lowed () 
// Returns TRUE if Trace and PC Sample-based Profiling are allowed 


boolean ExternalNoninvasiveDebugA lowed() 
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return (ExternalNoninvasiveDebugEnabled() && 
(!IsSecure() || ExternalSecureNoninvasiveDebugEnabled() || 
(ELUsingAArch32(EL1) && PSTATE.EL == EL@ && SDER.SUNIDEN == '1'))); 


shared/debug/authentication/ExternalNoninvasiveDebugEnabled 
// ExternalNoninvasiveDebugEnab1ed() 
// This function returns TRUE if the ARMv8.4-Debug is implemented, otherwise this 
// function is IMPLEMENTATION DEFINED. 
// In the recommended interface, ExternalNoninvasiveDebugEnabled returns the state of the (DBGEN 
// OR NIDEN) signal. 
boolean ExternalNoninvasiveDebugEnabled() 
return !HaveNoninvasiveDebugAuth() || ExternalInvasiveDebugEnabled() || NIDEN == HIGH; 
shared/debug/authentication/ExternalSecurelnvasiveDebugEnabled 
// ExternalSecureInvasiveDebugEnab1ed() 
// The definition of this function is IMPLEMENTATION DEFINED. 
// In the recommended interface, this function returns the state of the (DBGEN AND SPIDEN) signal. 
// CoreSight allows asserting SPIDEN without also asserting DBGEN, but this is not recommended. 
boolean ExternalSecureInvasiveDebugEnab1ed() 
if !HaveEL(EL3) && !IsSecure() then return FALSE; 
return ExternalInvasiveDebugEnabled() && SPIDEN == HIGH; 
shared/debug/authentication/ExternalSecureNoninvasiveDebugEnabled 
// ExternalSecureNoninvasiveDebugEnab1ed() 
// This function returns the value of ExternalSecureInvasiveDebugEnabled() when ARMv8.4-Debug 
// is implemented. Otherwise, the definition of this function is IMPLEMENTATION DEFINED. 
// In the recommended interface, this function returns the state of the (DBGEN OR NIDEN) AND 
// (SPIDEN OR SPNIDEN) signal. 
boolean ExternalSecureNoninvasiveDebugEnab1ed() 
if !HaveEL(EL3) && !IsSecure() then return FALSE; 
if HaveNoninvasiveDebugAuth() then 
return ExternalNoninvasiveDebugEnabled() && (SPIDEN == HIGH || SPNIDEN == HIGH); 
else 
return ExternalSecureInvasiveDebugEnabled() ; 
shared/debug/authentication/IsAccessSecure 
// Returns TRUE when an access is Secure 
boolean IsAccessSecure(); 


shared/debug/authentication/IsCorePowered 


// Returns TRUE if the Core power domain is powered on, FALSE otherwise. 
boolean IsCorePowered(); 


shared/debug/cti/CTI_SetEventLevel 


// Set a Cross Trigger multi-cycle input event trigger to the specified level. 
CTI_SetEventLevel(CrossTriggerIn id, signal level); 


shared/debug/cti/CTI_SignalEvent 


// Signal a discrete event on a Cross Trigger input event trigger. 
CTI_SignalEvent(CrossTriggerIn id); 
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shared/debug/cti/CrossTrigger 


enumeration CrossTriggerOut {CrossTriggerOut_DebugRequest, Cross 
CrossTriggerOut_IRQ, CrossTriggerOut_RSVD3, 
CrossTriggerOut_TraceExtIn@, CrossTriggerOut_TraceExtIn1, 
CrossTriggerOut_TraceExtIn2, CrossTriggerOut_TraceExtIn3}; 


enumeration CrossTriggerIn {CrossTriggerIn_CrossHalt, CrossTriggerIn_PMUOverflow, 
CrossTriggerIn_RSVD2, CrossTriggerIn_RSVD3, 
CrossTriggerIn_TraceExtOut®, CrossTriggerIn_TraceExtOut1, 
CrossTriggerIn_TraceExtOut2, CrossTriggerIn_TraceExtOut3}; 








shared/debug/dccanditr/CheckForDCClnterrupts 


// CheckForDCCInterrupts() 


CheckForDCCInterrupts() 
commrx = (EDSCR.RXfull == '1'); 
commtx = (EDSCR.TXfull == '@'); 


// COMMRX and COMMTX support is optional and not recommended for new designs. 
// SetInterruptRequestLevel (InterruptID_COMMRX, if commrx then HIGH else LOW); 
// SetInterruptRequestLevel (InterruptID_COMMTX, if commtx then HIGH else LOW); 


// The value to be driven onto the common COMMIRQ signal. 
if ELUsingAArch32(EL1) then 
commirg = ((commrx && DBGDCCINT.RX == '1') || 
(commtx && DBGDCCINT.TX == '1')); 
else 
commirg = ((commrx && MDCCINT_EL1.RX == '1') || 
(commtx && MDCCINT_EL1.TX == '1')); 
SetInterruptRequestLevel (InterruptID_COMMIRQ, if commirq then HIGH else LOW); 


return; 


shared/debug/dccanditr/DBGDTRRX_ELO 
// DBGDTRRX_ELO[] (external write) 
// Called on writes to debug register QxQ8C. 


DBGDTRRX_EL@[boolean memory_mapped] = bits(32) value 


if EDPRSR<6:5,@> != '001' then // Check DLK, OSLK and PU bits 
IMPLEMENTATION_DEFINED "signal slave-generated error"; 
return; 

if EDSCR.ERR == '1' then return; // Error flag set: ignore write 


// The Software lock is OPTIONAL. 


riggerOut_RestartRequest, 


if memory_mapped && EDLSR.SLK == '1' then return; // Software lock locked: ignore write 
if EDSCR.RXfull == '1' || (Halted() && EDSCR.MA == '1' && EDSCR.ITE == '@') then 
EDSCR.RXO = '1'; EDSCR.ERR = '1'; // Overrun condition: ignore write 
return; 
EDSCR.RXfull = '1'; 
DTRRX = value; 
if Halted() && EDSCR.MA == '1' then 
EDSCR.ITE = 'Q'; // See comments in EDITR[] (external write) 
if !UsingAArch32() then 
ExecuteA64 (0xD5330501<31:0>) ; // A64 "MRS X1,DBGDTRRX_ELQ" 
ExecuteA64 (QxB8004401<31:0>) ; // A64 "STR W1, [X0], #4" 


X[1] = bits(64) UNKNOWN; 
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else 
ExecuteT32(@xEE10<15:0> /xhwls/, 0x1E15<15:0> /«hw2«/); // T32 "MRS R1,DBGDTRRXint" 
ExecuteT32(@xF840<15:0> /xhwls/, 0x1B04<15:0> /«hw2x/); // T32 "STR R1,[RO],#4" 
R[1] = bits(32) UNKNOWN; 
// If the store aborts, the Data Abort exception is taken and EDSCR.ERR is set to 1 
if EDSCR.ERR == '1' then 
EDSCR.RXfull = bit UNKNOWN; 
DBGDTRRX_ELO = bits(32) UNKNOWN; 
else 
// "MRS X1,DBGDTRRX_EL@" calls DBGDTR_EL@[] (read) which clears RXfull. 
assert EDSCR.RXfull == 'Q'; 


EDSCR.ITE = '1'; // See comments in EDITR[] (external write) 
return; 


// DBGDTRRX_ELO[] (external read) 


bits(32) DBGDTRRX_EL@[boolean memory_mapped] 
return DTRRX; 
shared/debug/dccanditr/DBGDTRTX_ELO 
// DBGDTRTX_ELO[] (external read) 
// Called on reads of debug register 0x080. 
bits(32) DBGDTRTX_EL@[boolean memory_mapped] 
if EDPRSR<6:5,@> != '001' then // Check DLK, OSLK and PU bits 
IMPLEMENTATION_DEFINED "signal slave-generated error"; 


return bits(32) UNKNOWN; 


underrun = EDSCR.TXfull == '@' || (Halted() && EDSCR.MA == '1' && EDSCR.ITE == '@') 
value = if underrun then bits(32) UNKNOWN else DTRTX; 


if EDSCR.ERR == '1' then return value; // Error flag set: no side-effects 


// The Software lock is OPTIONAL. 
if memory_mapped && EDLSR.SLK == '1' then // Software lock locked: no side-effects 
return value; 


if underrun then 
EDSCR.TXU = '1'; EDSCR.ERR = '1'; // Underrun condition: block side-effects 
return value; // Return UNKNOWN 


EDSCR.TXfull = 'Q'; 
if Halted() && EDSCR.MA == '1' then 


EDSCR.ITE = 'Q'; // See comments in EDITR[] (external write) 
if !UsingAArch32() then 

ExecuteA64 (0xB8404401<31:0>) ; // A64 "LDR W1, [X0],#4" 
else 

ExecuteT32(QxF850<15:0> /xhwls/, 0x1B04<15:0> /«hw2«/); // T32 “LDR R1, [R0], #4" 


// If the load aborts, the Data Abort exception is taken and EDSCR.ERR is set to 1 
if EDSCR.ERR == '1' then 
EDSCR.TXfull = bit UNKNOWN; 
DBGDTRTX_ELO = bits(32) UNKNOWN; 
else 
if !UsingAArch32() then 
ExecuteA64 (0xD5130501<31:0>) ; // A64 "MSR DBGDTRTX_EL®@, X1" 
else 
ExecuteT32(@xEEQ@Q<15:0> /«xhw1s/, 0x1E15<15:0> /xhw2«/); // T32 "MSR DBGDTRTXint,R1" 
// "MSR DBGDTRTX_ELO@,X1" calls DBGDTR_EL@[] (write) which sets TXfull. 
assert EDSCR.TXfull == '1'; 
if !UsingAArch32() then 
X[1] = bits(64) UNKNOWN; 
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else 
R[1] = bits(32) UNKNOWN; 
EDSCR.ITE = '1'; // See comments in EDITR[] (external write) 


return value; 


// DBGDTRTX_ELO[] (external write) 


DBGDTRTX_EL@[boolean memory_mapped] = bits(32) value 
// The Software lock is OPTIONAL. 
if memory_mapped && EDLSR.SLK == '1' then return; // Software lock locked: ignore write 
DTRTX = value; 
return; 


shared/debug/dccanditr/DBGDTR_ELO 
// DBGDTR_ELO[] (write) 
// System register writes to DBGDTR_EL@, DBGDTRTX_EL@ (AArch64) and DBGDTRTXint (AArch32) 


DBGDTR_EL@[] = bits(N) value 
// For MSR DBGDTRTX_EL@,<Rt> N=32, value=X[t]<31:0>, X[t]<63:32> is ignored 
// For MSR DBGDTR_ELQ, <Xt> N=64, value=X[t]<63:0> 
assert N IN {32,64}; 
if EDSCR.TXfull == '1' then 
value = bits(N) UNKNOWN; 
// On a 64-bit write, implement a half-duplex channel 
if N == 64 then DIRRX = value<63:32>; 


DTRTX = value<31:0>; // 32-bit or 64-bit write 
EDSCR.TXfull = '1'; 
return; 


// DBGDTR_ELQ@[] (read) 
// System register reads of DBGDTR_EL@, DBGDTRRX_EL@ (AArch64) and DBGDTRRXint (AArch32) 


bits(N) DBGDTR_ELQ[] 

// For MRS <Rt>,DBGDTRTX_EL@ N=32, X[t]=Zeros(32):result 

// For MRS <Xt>,DBGDTR_ELO N=64, X[t]=result 

assert N IN {32,64}; 

bits(N) result; 

if EDSCR.RXfull == 'Q' then 
result = bits(N) UNKNOWN; 

else 
// On a 64-bit read, implement a half-duplex channel 
// NOTE: the word order is reversed on reads with regards to writes 
if N == 64 then result<63:32> = DTRTX; 
result<31:0> = DTRRX; 

EDSCR.RXfull = 'Q'; 

return result; 


shared/debug/dccanditr/DTR 

bits(32) DTRRX; 

bits(32) DTRTX; 
shared/debug/dccanditr/EDITR 

// EDITR[] (external write) 

// Called on writes to debug register 0x084. 
EDITR[boolean memory_mapped] = bits(32) value 


if EDPRSR<6:5,@> != '001' then // Check DLK, OSLK and PU bits 
IMPLEMENTATION_DEFINED "signal slave-generated error"; 
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return; 
if EDSCR.ERR == '1' then return; // Error flag set: ignore write 


// The Software lock is OPTIONAL. 
if memory_mapped && EDLSR.SLK == '1' then return; // Software lock locked: ignore write 


if !Halted() then return; // Non-debug state: ignore write 
if EDSCR.ITE == '@' || EDSCR.MA == '1' then 
EDSCR.ITO = '1'; EDSCR.ERR = '1'; // Overrun condition: block write 
return; 
// ITE indicates whether the processor is ready to accept another instruction; the processor 
// may support multiple outstanding instructions. Unlike the "InstrComp1" flag in [v7A] there 
// is no indication that the pipeline is empty (all instructions have completed). In this 
// pseudocode, the assumption is that only one instruction can be executed at a time, 
// meaning ITE acts like "InstrComp1". 
EDSCR.ITE = 'Q'; 
if !UsingAArch32() then 
ExecuteA64(value); 
else 
ExecuteT32(value<15:0>/*hwls/, value<31:16> /«hw2«/); 
EDSCR.ITE = '1'; 


return; 


shared/debug/halting/DCPSInstruction 
// DCPSInstruction() 
// Operation of the DCPS instruction in Debug state 
DCPSInstruction(bits(2) target_el) 
SynchronizeContext(); 
case target_el of 


when EL1 
if PSTATE.EL == EL2 || (PSTATE.EL == EL3 && !UsingAArch32()) then handle_el = PSTATE.EL; 





elsif EL2Enabled() && HCR_EL2.TGE == '1' then UndefinedFault(); 
else handle_el = EL1; 

when EL2 
if !HaveEL(EL2) then UndefinedFault(); 
elsif PSTATE.EL == EL3 && !UsingAArch32() then handle_el = EL3; 
elsif !IsSecureEL2Enabled() && IsSecure() then UndefinedFault(); 
else handle_el = EL2; 

when EL3 
if EDSCR.SDD == '1' || !HaveEL(EL3) then UndefinedFault(); 
handle_el = EL3; 

otherwise 
Unreachable(); 


from_secure = IsSecure(); 
if ELUsingAArch32(handle_el) then 
if PSTATE.M == M32_Monitor then SCR.NS = 'Q'; 


assert UsingAArch32(); // Cannot move from AArch64 to AArch32 
case handle_el of 
when EL1 
AArch32.WriteMode(M32_Svc); 
if HavePANExt() && SCTLR.SPAN == 'Q' then 


PSTATE.PAN = '1'; 
when EL2 AArch32.WriteMode(M32_Hyp); 
when EL3 
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AArch32.WriteMode(M32_Monitor); 
if HavePANExt() then 
if !from_secure then 
PSTATE.PAN = 'Q'; 
elsif SCTLR.SPAN == 'Q' then 
PSTATE.PAN = '1'; 
if handle_el == EL2 then 
ELR_hyp = bits(32) UNKNOWN; HSR = bits(32) UNKNOWN; 
else 
LR = bits(32) UNKNOWN; 
SPSR[] = bits(32) UNKNOWN; 
PSTATE.E = SCTLR[].EE; 
DLR = bits(32) UNKNOWN; DSPSR = bits(32) UNKNOWN; 


else // Targeting AArch64 
if UsingAArch32() then 
AArch64 .MaybeZeroRegisterUppers(); 
MaybeZeroSVEUppers(target_el); 
PSTATE.nRW = '@'; PSTATE.SP = '1'; PSTATE.EL = handle_el; 
if HavePANExt() && ((handle_el == EL1 && SCTLR_EL1.SPAN == 'Q') || 
(handle_el == EL2 && HCR_EL2.E2H == '1' && 
HCR_EL2.TGE == '1' && SCTLR_EL2.SPAN == 'Q')) then 
PSTATE.PAN = '1'; 
ELR[] = bits(64) UNKNOWN; SPSR[] = bits(32) UNKNOWN; ESR[] = bits(32) UNKNOWN; 
DLR_EL@ = bits(64) UNKNOWN; DSPSR_EL@ = bits(32) UNKNOWN; 
if HaveUAOExt() then PSTATE.UAO = 'Q'; 


UpdateEDSCRFields(); // Update EDSCR PE state flags 
sync_errors = HavelESB() && SCTLR[].IESB == '1'; 
if HaveDoubleFaultExt() && !UsingAArch32() then 
sync_errors = sync_errors || (SCR_EL3.EA == '1' && SCR_EL3.NMEA == '1' && PSTATE.EL == EL3); 
// SCTLR[].IESB might be ignored in Debug state. 
if !ConstrainUnpredictableBool() then 
sync_errors = FALSE; 
if sync_errors then 
SynchronizeErrors(); 
return; 


shared/debug/halting/DRPSInstruction 
// DRPSInstruction() 
// Operation of the A64 DRPS and T32 ERET instructions in Debug state 
DRPSInstruction() 
SynchronizeContext(); 


sync_errors = HavelESB() && SCTLR[].IESB == '1'; 
if HaveDoubleFaultExt() && !UsingAArch32() then 
sync_errors = sync_errors || (SCR_EL3.EA == '1' && SCR_EL3.NMEA == '1' && PSTATE.EL == EL3); 
// SCTLR[].IESB might be ignored in Debug state. 
if !ConstrainUnpredictableBool() then 
sync_errors = FALSE; 
if sync_errors then 
SynchronizeErrors(); 


SetPSTATEFromPSR(SPSR[]); 


// PSTATE.{N,Z,C,V,Q,GE,SS,D,A,I,F} are not observable and ignored in Debug state, so 
// behave as if UNKNOWN. 
if UsingAArch32() then 

PSTATE.<N,Z,C,V,Q,GE,SS,A,1,F> = bits(13) UNKNOWN; 

// In AArch32, all instructions are T32 and unconditional. 


PSTATE.IT = '00000000'; PSTATE.T = '1'; // PSTATE.J is RESO 
DLR = bits(32) UNKNOWN; DSPSR = bits(32) UNKNOWN; 
else 
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PSTATE.<N,Z,C,V,SS,D,A,1,F> = bits(9) UNKNOWN; 
DLR_EL@ = bits(64) UNKNOWN; DSPSR_EL@ = bits(32) UNKNOWN; 
UpdateEDSCRFields(); // Update EDSCR PE state flags 


return; 


shared/debug/halting/DebugHalt 








constant bits(6) DebugHalt_Breakpoint = 'QQ0111'; 
constant bits(6) DebugHalt_EDBGRQ = 'Q10011'; 
constant bits(6) DebugHalt_Step_Normal = 'Q11011'; 
constant bits(6) DebugHalt_Step_Exclusive = 'Q11111'; 
constant bits(6) DebugHalt_OSUnlockCatch = '100011'; 
constant bits(6) DebugHalt_ResetCatch = '100111'; 
constant bits(6) DebugHalt_Watchpoint = '101011'; 
constant bits(6) DebugHalt_HaltInstruction = '101111'; 
constant bits(6) DebugHalt_SoftwareAccess = '110011'; 
constant bits(6) DebugHalt_ExceptionCatch = '110111'; 
constant bits(6) DebugHalt_Step_NoSyndrome = '111011'; 


shared/debug/halting/DisablelTRAndResumelnstructionPrefetch 


DisableITRAndResumeInstructionPrefetch() ; 


shared/debug/halting/ExecuteA64 


// Execute an A64 instruction in Debug state. 
ExecuteA64(bits(32) instr); 


shared/debug/halting/ExecuteT32 


// Execute a T32 instruction in Debug state. 
ExecuteT32(bits(16) hwl, bits(16) hw2); 


shared/debug/halting/ExitDebugState 


// ExitDebugState( ) 


ExitDebugState() 
assert Halted(); 
SynchronizeContext(); 


// Although EDSCR.STATUS signals that the PE is restarting, debuggers must use EDPRSR.SDR to 
// detect that the PE has restarted. 
EDSCR.STATUS = '000001'; 

EDESR<2:0@> = '000'; 


// Signal restarting 
// Clear any pending Halting debug events 


bits(64) new_pc; 
bits(32) spsr; 


if UsingAArch32() then 
new_pc = ZeroExtend(DLR); 
spsr = DSPSR; 
else 
new_pc = DLR_ELQ; 
spsr = DSPSR_ELQ; 
// If this is an illegal return, SetPSTATEFromPSR() will set PSTATE.IL. 
SetPSTATEFromPSR(spsr) ; // Can update privileged bits, even at ELO 


if UsingAArch32() then 
if ConstrainUnpredictableBool() then new_pc<@> = 'Q'; 
BranchTo(new_pc<31:@>, BranchType_DBGEXIT) ; // AArch32 branch 
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else 
// If targeting AArch32 then possibly zero the 32 most significant bits of the target PC 
if spsr<4> == '1' && ConstrainUnpredictableBool() then 
new_pc<63:32> = Zeros(); 
BranchTo(new_pc, BranchType_DBGEXIT) ; // A type of branch that is never predicted 
(EDSCR.STATUS,EDPRSR.SDR) = ('000010','1'); // Atomically signal restarted 
UpdateEDSCRFields(); // Stop signalling PE state 


DisableITRAndResumeInstructionPrefetch(); 


return; 


shared/debug/halting/Halt 


// Halt() 


// 


Halt(bits(6) reason) 


J1-7504 


CTI_SignalEvent(CrossTriggerIn_CrossHalt); // Trigger other cores to halt 


bits(64) preferred_restart_address = ThisInstrAddr(); 
spsr = GetPSRFromPSTATE(); 


if UsingAArch32() then 
// If entering from AArch32 state, spsr<21> is the DIT bit which has to be moved for DSPSR 
spsr<24> = spsr<21>; 
spsr<21> = PSTATE.SS; // Always save the SS bit 


if (HaveBTIExt() && 
! (reason IN {DebugHalt_Step_Normal, DebugHalt_Step_Exclusive, DebugHalt_Step_NoSyndrome, 
DebugHalt_Breakpoint, DebugHalt_HaltInstruction}) && 
ConstrainUnpredictableBool()) then 
DSPSR<11:10> = '00'; 


if UsingAArch32() then 
DLR = preferred_restart_address<31:0>; 
DSPSR = spsr; 

else 
DLR_ELO = preferred_restart_address; 
DSPSR_EL@ = spsr; 


EDSCR.ITE = '1'; 
EDSCR.ITO = 'Q'; 
if IsSecure() then 
EDSCR.SDD = 'Q'; // If entered in Secure state, allow debug 


elsif HaveEL(EL3) then 

EDSCR.SDD = if ExternalSecureInvasiveDebugEnabled() then '@' else '1'; 
else 

assert EDSCR.SDD == '1'; // Otherwise EDSCR.SDD is RES1 
EDSCR.MA = 'Q'; 


// PSTATE.{SS,D,A,I,F} are not observable and ignored in Debug state, so behave as if 
// UNKNOWN. PSTATE.{N,Z,C,V,Q,GE} are also not observable, but since these are not changed on 
// exception entry, this function also leaves them unchanged. PSTATE.{E,M,nRW,EL,SP} are 
// unchanged. PSTATE.IL is set to Q. 
if UsingAArch32() then 
PSTATE.<SS,A,I,F> = bits(4) UNKNOWN; 
// In AArch32, all instructions are T32 and unconditional. 
PSTATE.IT = '00000000'; 


PSTATE.T = '1'; // PSTATE.J is RESO 
else 
PSTATE.<SS,D,A,1,F> = bits(5) UNKNOWN; 
PSTATE.IL = 'Q'; 
StopInstructionPrefetchAndEnableITR(); 
EDSCR.STATUS = reason; // Signal entered Debug state 
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UpdateEDSCRFields(); // Update EDSCR PE state flags. 


return; 


shared/debug/halting/HaltOnBreakpointOrWatchpoint 


// HaltOnBreakpointOrWatchpoint() 


// Returns TRUE if the Breakpoint and Watchpoint debug events should be considered for Debug 
// state entry, FALSE if they should be considered for a debug exception. 


boolean HaltOnBreakpointOrwatchpoint() 
return HaltingAllowed() && EDSCR.HDE == '1' && OSLSR_EL1.OSLK == 'Q'; 
shared/debug/halting/Halted 


// Halted() 
[I === 


boolean Halted() 
return !(EDSCR.STATUS IN {'000001', '000010'}); // Halted 
shared/debug/halting/HaltingAllowed 
// HaltingAllowed() 
// Returns TRUE if halting is currently allowed, FALSE if halting is prohibited. 
boolean HaltingAllowed() 
if Halted() || DoubleLockStatus() then 
return FALSE; 
elsif IsSecure() then 
return ExternalSecureInvasiveDebugEnabled(); 
else 
return ExternalInvasiveDebugEnabled() 


shared/debug/halting/Restarting 


// Restarting() 
// ============ 


boolean Restarting() 
return EDSCR.STATUS == '000001'; // Restarting 
shared/debug/halting/StopInstructionPrefetchAndEnablelTR 


StopInstructionPrefetchAndEnableITR(); 


shared/debug/halting/UpdateEDSCRFields 
// UpdateEDSCRFields() 

// Update EDSCR PE state fields 
UpdateEDSCRFields() 


if !Halted() then 
EDSCR.EL = 'Q0'; 
EDSCR.NS = bit UNKNOWN; 
EDSCR.RW = '1111'; 
else 
EDSCR.EL = PSTATE.EL; 
EDSCR.NS = if IsSecure() then '@' else '1'; 
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bits(4) RW; 

RW<1> = if ELUsingAArch32(EL1) then 'Q' else '1'; 

if PSTATE.EL != ELO then 
RW<@> = RW<1>; 

else 
RW<@> = if UsingAArch32() then 'Q' else '1'; 

if !HaveEL(EL2) || (HaveEL(EL3) && SCR_GEN[].NS == '@' && !IsSecureEL2Enabled()) then 
RW<2> = RW<1>; 


else 

RW<2> = if ELUsingAArch32(EL2) then 'Q' else '1'; 
if !HaveEL(EL3) then 

RW<3> = RW<2>; 
else 


RW<3> = if ELUsingAArch32(EL3) then 'Q' else '1'; 


// The least-significant bits of EDSCR.RW are UNKNOWN if any higher EL is using AArch32. 
if RW<3> == '@' then RW<2:0> = bits(3) UNKNOWN; 
elsif RW<2> == '@' then RW<1:0> = bits(2) UNKNOWN; 
elsif RW<1> == 'Q' then RW<@> = bit UNKNOWN; 
EDSCR.RW = RW; 
return; 


shared/debug/haltingevents/CheckExceptionCatch 
// CheckExceptionCatch() 
// Check whether an Exception Catch debug event is set on the current Exception level 


CheckExceptionCatch(boolean exception_entry) 
// Called after an exception entry or exit, that is, such that IsSecure() and PSTATE.EL are correct 
// for the exception target. 
base = if IsSecure() then @ else 4; 
if HaltingAllowed() then 
if HaveExtendedECDebugEvents() then 
exception_exit = !exception_entry; 
ctrl = EDECCR<UInt(PSTATE.EL) + base + 8>:EDECCR<UInt(PSTATE.EL) + base>; 
case ctrl of 
when '00' halt 
when '@1' halt 
when '10' halt 
when '11' halt 


FALSE; 
TRUE; 
(exception_exit == TRUE); 
(exception_entry == TRUE); 


else 
halt = (EDECCR<UInt(PSTATE.EL) + base> == '1'); 
if halt then Halt(DebugHalt_ExceptionCatch) ; 


shared/debug/haltingevents/CheckHaltingStep 
// CheckHaltingStep() 
// Check whether EDESR.SS has been set by Halting Step 


CheckHaltingStep() 
if HaltingAllowed() && EDESR.SS == '1' then 
// The STATUS code depends on how we arrived at the state where EDESR.SS == 1. 
if HaltingStep_DidNotStep() then 
Halt (DebugHalt_Step_NoSyndrome) ; 
elsif HaltingStep_SteppedEX() then 
Halt (DebugHalt_Step_Exclusive) ; 
else 
Halt (DebugHalt_Step_Norma1) ; 
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shared/debug/haltingevents/CheckOSUnlockCatch 
// CheckOSUnlockCatch() 
|[ ==================== 
// Called on unlocking the OS Lock to pend an OS Unlock Catch debug event 
CheckOSUnlockCatch() 
if (HaveDoPD() && CTIDEVCTL.OSUCE == '1') || (!HaveDoPD() && EDECR.OSUCE == '1') then 
if !Halted() then EDESR.OSUC = '1'; 
shared/debug/haltingevents/CheckPendingOSUnlockCatch 
// CheckPendingOSUnlockCatch() 
// =========================== 
// Check whether EDESR.OSUC has been set by an OS Unlock Catch debug event 
CheckPendingOSUnlockCatch() 
if HaltingAllowed() && EDESR.OSUC == '1' then 
Halt(DebugHalt_OSUnlockCatch) ; 
shared/debug/haltingevents/CheckPendingResetCatch 
// CheckPendingResetCatch() 
// Check whether EDESR.RC has been set by a Reset Catch debug event 
CheckPendingResetCatch() 
if HaltingAllowed() && EDESR.RC == '1' then 
Halt (DebugHalt_ResetCatch) ; 
shared/debug/haltingevents/CheckResetCatch 
// CheckResetCatch() 


// Called after reset 


CheckResetCatch() 
if (HaveDoPD() && CTIDEVCTL.RCE == '1') || (!HaveDoPD() && EDECR.RCE == '1') then 
EDESR.RC = '1'; 


// If halting is allowed then halt immediately 
if HaltingAllowed() then Halt(DebugHalt_ResetCatch) ; 


shared/debug/haltingevents/CheckSoftwareAccessToDebugRegisters 


// CheckSoftwareAccessToDebugRegisters() 
Dl eat eee 


// Check for access to Breakpoint and Watchpoint registers. 


CheckSoftwareAccessToDebugRegisters() 
os_lock = (if ELUsingAArch32(EL1) then DBGOSLSR.OSLK else OSLSR_EL1.0SLK) ; 
if HaltingAllowed() && EDSCR.TDA == '1' && os_lock == 'Q' then 
Halt (DebugHalt_SoftwareAccess) ; 


shared/debug/haltingevents/ExternalDebugRequest 


// ExternalDebugRequest() 
// ====================== 


ExternalDebugRequest() 
if HaltingAllowed() then 
Halt(DebugHalt_EDBGRQ) ; 
// Otherwise the CTI continues to assert the debug request until it is taken. 
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shared/debug/haltingevents/HaltingStep_DidNotStep 


// Returns TRUE if the previously executed instruction was executed in the inactive state, that is, 
// if it was not itself stepped. 
boolean HaltingStep_DidNotStep() ; 


shared/debug/haltingevents/HaltingStep_SteppedEX 


// Returns TRUE if the previously executed instruction was a Load-Exclusive class instruction 
// executed in the active-not-pending state. 
boolean HaltingStep_SteppedEX(); 


shared/debug/haltingevents/RunHaltingStep 


// RunHaltingStep( ) 


RunHaltingStep(boolean exception_generated, bits(2) exception_target, boolean syscall, 
boolean reset) 
// “exception_generated" is TRUE if the previous instruction generated a synchronous exception 
// or was cancelled by an asynchronous exception. 
// 
// if "exception_generated" is TRUE then "exception_target" is the target of the exception, and 
// "syscall" is TRUE if the exception is a synchronous exception where the preferred return 
// address is the instruction following that which generated the exception. 
// 


// "reset" is TRUE if exiting reset state into the highest EL. 


if reset then assert !Halted(); // Cannot come out of reset halted 
active = EDECR.SS == '1' && !Halted(); 


if active && reset then // Coming out of reset with EDECR.SS set 
EDESR.SS = '1'; 
elsif active && HaltingAllowed() then 
if exception_generated && exception_target == EL3 then 
advance = syscall || ExternalSecureInvasiveDebugEnabled() ; 
else 
advance = TRUE; 
if advance then EDESR.SS = '1'; 


return; 


shared/debug/interrupts/ExternalDebugInterruptsDisabled 
// ExternalDebugInterruptsDisabled() 
// Determine whether EDSCR disables interrupts routed to 'target' 


boolean ExternalDebugInterruptsDisabled(bits(2) target) 
case target of 


when EL3 

int_dis = EDSCR.INTdis == '11' && ExternalSecureInvasiveDebugEnabled(); 
when EL2 

int_dis = EDSCR.INTdis == '1x' && ExternalInvasiveDebugEnabled(); 
when EL1 


if IsSecure() then 
int_dis = EDSCR.INTdis == '1x' && ExternalSecureInvasiveDebugEnabled() 
else 
int_dis 
return int_dis; 


EDSCR.INTdis != '00' && ExternalInvasiveDebugEnabled(); 


shared/debug/interrupts/InterruptID 


enumeration InterruptID {InterruptID_PMUIRQ, InterruptID_COMMIRQ, InterruptID_CTIIRQ, 
InterruptID_COMMRX, InterruptID_COMMTX}; 
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shared/debug/interrupts/SetinterruptRequestLevel 


// Set a level-sensitive interrupt to the specified level. 
SetInterruptRequestLevel(InterruptID id, signal level); 


shared/debug/samplebasedprofiling/CreatePCSample 


// CreatePCSample() 
[J es 


CreatePCSample() 
// In a simple sequential execution of the program, CreatePCSample is executed each time the PE 
// executes an instruction that can be sampled. An implementation is not constrained such that 
// reads of EDPCSRlo return the current values of PC, etc. 


pc_sample.valid = ExternalNoninvasiveDebugAllowed() && !Halted(); 

pc_sample.pc = ThisInstrAddr(); 

pc_sample.el = PSTATE.EL; 

pc_sample.rw = if UsingAArch32() then 'Q' else '1'; 

pc_sample.ns = if IsSecure() then 'Q' else '1'; 

pc_sample.contextidr = if ELUsingAArch32(EL1) then CONTEXTIDR else CONTEXTIDR_EL1; 
pc_sample.has_el2 = EL2Enabled(); 


if EL2Enabled() then 
if ELUsingAArch32(EL2) then 
pc_sample.vmid = ZeroExtend(VTTBR.VMID, 16); 
elsif !Havel6bitVMID() || VTCR_EL2.VS == '@' then 
pc_sample.vmid = ZeroExtend(VTTBR_EL2.VMID<7:0>, 16); 
else 
pc_sample.vmid = VTTBR_EL2.VMID; 
if HaveVirtHostExt() && !ELUsingAArch32(EL2) then 
pc_sample.contextidr_el2 = CONTEXTIDR_EL2; 
else 
pc_sample.contextidr_el2 = bits(32) UNKNOWN; 
pc_sample.el@h = PSTATE.EL == ELO && IsInHost(); 
return; 


shared/debug/samplebasedprofiling/EDPCSRlo 


// EDPCSRlo[] (read) 
// ================= 


bits(32) EDPCSRlo[boolean memory_mapped] 


if EDPRSR<6:5,@> != '001' then // Check DLK, OSLK and PU bits 
IMPLEMENTATION_DEFINED "signal slave-generated error"; 
return bits(32) UNKNOWN; 


// The Software lock is OPTIONAL. 
update = !memory_mapped || EDLSR.SLK == '0'; // Software locked: no side-effects 


if pc_sample.valid then 
sample = pc_sample.pc<31:>; 
if update then 
if HaveVirtHostExt() && EDSCR.SC2 == '1' then 
EDPCSRhi.PC = (if pc_sample.rw == 'Q' then Zeros(24) else pc_sample.pc<55:32>); 
EDPCSRhi.EL = pc_sample.el; 
EDPCSRhi.NS = pc_sample.ns; 
else 
EDPCSRhi = (if pc_sample.rw == 'Q' then Zeros(32) else pc_sample.pc<63: 32>); 
EDCIDSR = pc_sample.contextidr; 
if HaveVirtHostExt() && EDSCR.SC2 == '1' then 
EDVIDSR = (if HaveEL(EL2) && pc_sample.ns == '1' then pc_sample.contextidr_el2 
else bits(32) UNKNOWN); 


else 
if HaveEL(EL2) && pc_sample.ns == '1' && pc_sample.el IN {EL1,ELQ} then 
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EDVIDSR.VMID = pc_sample.vmid; 
else 
EDVIDSR.VMID = Zeros(); 
EDVIDSR.NS = pc_sample.ns; 
EDVIDSR.E2 = (if pc_sample.el == EL2 then '1' else 'Q'); 
EDVIDSR.E3 = (if pc_sample.el == EL3 then '1' else '@') AND pc_sample.rw; 
// The conditions for setting HV are not specified if PCSRhi is zero. 
// An example implementation may be "pc_sample.rw". 
EDVIDSR.HV = (if !IsZero(EDPCSRhi) then '1' else bit IMPLEMENTATION_DEFINED "@ or 1"); 


else 
sample = Ones(32); 
if update then 
EDPCSRhi = bits(32) UNKNOWN; 
EDCIDSR = bits(32) UNKNOWN; 
EDVIDSR = bits(32) UNKNOWN; 


return sample; 


shared/debug/samplebasedprofiling/PCSample 


type PCSample is ( 
boolean valid, 
bits(64) pc, 
bits(2) el, 
bit rw, 
bit ns, 
boolean has_el2, 
bits(32) contextidr, 
bits(32) contextidr_el2, 
boolean el0h, 
bits(16) vmid 

) 


PCSample pc_sample; 


shared/debug/samplebasedprofiling/PMPCSR 


// PMPCSR[] (read) 


bits(32) PMPCSR[boolean memory_mapped] 


if EDPRSR<6:5,@> != '001' then // Check DLK, OSLK and PU bits 
IMPLEMENTATION_DEFINED "signal slave-generated error"; 
return bits(32) UNKNOWN; 


// The Software lock is OPTIONAL. 
update = !memory_mapped || PMLSR.SLK == '0'; // Software locked: no side-effects 


if pc_sample.valid then 
sample = pc_sample.pc<31:0>; 
if update then 
PMPCSR<55:32> = (if pc_sample.rw == '@' then Zeros(24) else pc_sample.pc<55:32>); 
PMPCSR.EL = pc_sample.el; 
PMPCSR.NS = pc_sample.ns; 


wv 


MCIDISR = pc_sample.contextidr; 
MCID2SR = if pc_sample.has_el2 then pc_sample.contextidr_el2 else bits(32) UNKNOWN; 


wv 








PMVIDSR.VMID = (if pc_sample.has_el2 && pc_sample.el IN {EL1,ELQ} && !pc_sample.elQh 
then pc_sample.vmid else bits(16) UNKNOWN); 
else 
sample = Ones(32); 
if update then 
PMPCSR<55:32> = bits(24) UNKNOWN; 
PMPCSR.EL = bits(2) UNKNOWN; 
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PMPCSR.NS = bit UNKNOWN; 


PMCIDISR = bits(32) UNKNOWN; 
PMCID2SR = bits(32) UNKNOWN; 


PMVIDSR.VMID = bits(16) UNKNOWN; 


return sample; 


shared/debug/softwarestep/CheckSoftwareStep 
// CheckSoftwareStep() 
// Take a Software Step exception if in the active-pending state 
CheckSoftwareStep() 


// Other self-hosted debug functions will call AArch32.GenerateDebugExceptions() if called from 
// AArch32 state. However, because Software Step is only active when the debug target Exception 
// level is using AArch64, CheckSoftwareStep only calls AArch64.GenerateDebugExceptions(). 
if !ELUsingAArch32(DebugTarget()) && AArch64.GenerateDebugExceptions() then 
if MDSCR_EL1.SS == '1' && PSTATE.SS == '@' then 
AArch64.SoftwareStepException(); 


shared/debug/softwarestep/DebugExceptionReturnSS 
// DebugExceptionReturnSS() 
// Returns value to write to PSTATE.SS on an exception return or Debug state exit. 


bit DebugExceptionReturnSS(bits(32) spsr) 
assert Halted() || Restarting() || PSTATE.EL != ELO; 


SS_bit = '0'; 


if MDSCR_EL1.SS == '1' then 
if Restarting() then 
enabled_at_source = FALSE; 
elsif UsingAArch32() then 
enabled_at_source = AArch32.GenerateDebugExceptions(); 
else 
enabled_at_source = AArch64.GenerateDebugExceptions(); 


if I]legalExceptionReturn(spsr) then 
dest = PSTATE.EL; 
else 
(valid, dest) = ELFromSPSR(spsr); assert valid; 


secure = IsSecureBelowEL3() || dest == EL3; 
if ELUsingAArch32(dest) then 
enabled_at_dest = AArch32.GenerateDebugExceptionsFrom(dest, secure); 
else 
mask = spsr<9>; 
enabled_at_dest = AArch64.GenerateDebugExceptionsFrom(dest, secure, mask); 
ELd = DebugTargetFrom(secure) ; 
if !ELUsingAArch32(ELd) && !enabled_at_source && enabled_at_dest then 
SS_bit = spsr<21>; 
return SS_bit; 


shared/debug/softwarestep/SSAdvance 
// SSAdvance() 
// Advance the Software Step state machine. 
SSAdvance() 
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// A simpler implementation of this function just clears PSTATE.SS to zero regardless of the 
// current Software Step state machine. However, this check is made to illustrate that the 
// processor only needs to consider advancing the state machine from the active-not-pending 
// state. 

target = DebugTarget(); 

step_enabled = !ELUsingAArch32(target) && MDSCR_EL1.SS == '1'; 

active_not_pending = step_enabled && PSTATE.SS == '1'; 


if active_not_pending then PSTATE.SS = '0'; 


return; 


shared/debug/softwarestep/SoftwareStep_DidNotStep 

// Returns TRUE if the previously executed instruction was executed in the inactive state, that is, 
// if it was not itself stepped. 

boolean SoftwareStep_DidNotStep(); 
shared/debug/softwarestep/SoftwareStep_SteppedEX 

// Returns TRUE if the previously executed instruction was a Load-Exclusive class instruction 

// executed in the active-not-pending state. 

boolean SoftwareStep_SteppedEX(); 

J1.3.2 shared/exceptions 


This section includes the following pseudocode functions: 


à shared/exceptions/exceptions/ConditionSyndrome. 

è shared/exceptions/exceptions/Exception on page J1-7513. 

à shared/exceptions/exceptions/ExceptionRecord on page J1-7513. 

è shared/exceptions/exceptions/ExceptionSyndrome on page J1-7513. 


è shared/exceptions/traps/ReservedValue on page J1-7514. 
è shared/exceptions/traps/UnallocatedEncoding on page J1-7514. 


shared/exceptions/exceptions/ConditionSyndrome 
// ConditionSyndrome() 
// Return CV and COND fields of instruction syndrome 
bits(5) ConditionSyndrome() 
bits(5) syndrome; 


if UsingAArch32() then 
cond = AArch32.CurrentCond(); 
if PSTATE.T == 'Q' then // A32 
syndrome<4> = '1'; 
// A conditional A32 instruction that is known to pass its condition code check 
// can be presented either with COND set to @xE, the value for unconditional, or 
// the COND value held in the instruction. 
if ConditionHolds(cond) && ConstrainUnpredictableBool() then 
syndrome<3:0> = '1110'; 
else 
syndrome<3:0> = cond; 
else // 732 
// When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: 
// =» CV set to 0 and COND is set to an UNKNOWN value 
// x» CV set to 1 and COND is set to the condition code for the condition that 
// applied to the instruction. 
if boolean IMPLEMENTATION_DEFINED "Condition valid for trapped T32" then 
syndrome<4> = '1'; 
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syndrome<3:0> = cond; 
else 
syndrome<4> = 'Q'; 
syndrome<3:@> = bits(4) UNKNOWN; 
else 
syndrome<4> = '1'; 
syndrome<3:@> = '1110'; 


return synd rome; 


shared/exceptions/exceptions/Exception 


enumeration Exception {Exception_Uncategorized, 
Exception_WFxTrap, 
Exception_CP15RTTrap, 
Exception_CP15RRTTrap, 
Exception_CP14RTTrap, 
Exception_CP14DTTrap, 
Exception_AdvSIMDFPAccessTrap, 
Exception_FPIDTrap, 
// Trapped BXJ instruction not 
Exception_PACTrap, 
Exception_CP14RRTTrap, 
Exception_I1legalState, 
Exception_SupervisorCal1, 
Exception_HypervisorCal1, 
Exception_MonitorCall, 
Exception_SystemRegisterTrap, 
Exception_ERetTrap, 
Exception_InstructionAbort, 
Exception_PCAlignment, 
Exception_DataAbort, 
Exception_NV2DataAbort, 
Exception_SPAlignment, 
Exception_FPTrappedException, 
Exception_SError, 
Exception_Breakpoint, 
Exception_SoftwareStep, 
Exception_Watchpoint, 
Exception_NV2Watchpoint, 
Exception_SoftwareBreakpoint, 
Exception_VectorCatch, 
Exception_IRQ, 
Exception_SVEAccessTrap, 
Exception_BranchTarget, 
Exception_F1Q}; 


Armv8 Pseudocode 
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// Uncategorized or unknown reason 

// Trapped WFI or WFE instruction 

// Trapped AArch32 MCR or MRC access to CP15 
// Trapped AArch32 MCRR or MRRC access to CP15 
// Trapped AArch32 MCR or MRC access to CP14 
// Trapped AArch32 LDC or STC access to CP14 
// HCPTR-trapped access to SIMD or FP 

// Trapped access to SIMD or FP ID register 
supported in Armv8 

// Trapped invalid PAC use 

// Trapped MRRC access to CP14 from AArch32 
// Illegal Execution state 

// Supervisor Call 

// Hypervisor Call 

// Monitor Call or Trapped SMC instruction 
// Trapped MRS or MSR system register access 
// Trapped invalid ERET use 

// Instruction Abort or Prefetch Abort 

// PC alignment fault 

// Data Abort 

// Data abort at EL1 reported as being from EL2 
// SP alignment fault 

// IEEE trapped FP exception 

// SError interrupt 

// (Hardware) Breakpoint 

// Software Step 

// Watchpoint 

// Watchpoint at EL1 reported as being from EL2 
// Software Breakpoint Instruction 

// AArch32 Vector Catch 

// IRQ interrupt 

// HCPTR trapped access to SVE 

// Branch Target Identification 

// FIQ interrupt 


shared/exceptions/exceptions/ExceptionRecord 


type ExceptionRecord is (Exception exceptype, 


bits(25) syndrome, 
bits(64) address, 
boolean ipavalid, 
is valid 
bits(1) NS, 
is Non-secure or secure 
bits(52) ipaddress) 


// Exception class 

// Syndrome record 

// Virtual fault address 

// Physical fault address for second stage faults 


// Physical fault address for second stage faults 


// Physical fault address for second stage faults 


shared/exceptions/exceptions/ExceptionSyndrome 


// ExceptionSyndrome() 


// Return a blank exception syndrome record for an exception of the given type. 


ExceptionRecord ExceptionSyndrome(Exception exceptype) 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


J1-7513 


Armv8 Pseudocode 


J1.3 Shared pseudocode 


ExceptionRecord r; 
r.exceptype = exceptype; 


// Initialize all other fields 
r.syndrome = Zeros(); 
r.vaddress = Zeros(); 
r.ipavalid = FALSE; 
r.NS = '0'; 
r.ipaddress = Zeros(); 
return r; 


shared/exceptions/traps/ReservedValue 


// ReservedValue() 
// =============== 


ReservedValue() 
if UsingAArch32() && !AArch32.GeneralExceptionsToAArch64() then 
AArch32.TakeUndefInstrException(); 
else 
AArch64.UndefinedFault(); 


shared/exceptions/traps/UnallocatedEncoding 


// UnallocatedEncoding() 
// ===================== 


UnallocatedEncoding() 
if UsingAArch32() && AArch32.ExecutingCP10or11Instr() then 
FPEXC.DEX = '0'; 
if UsingAArch32() && !AArch32.GeneralExceptionsToAArch64() then 
AArch32.TakeUndefInstrException(); 
else 
AArch64.UndefinedFault(); 


J1.3.3 shared/functions 


J1-7514 


This section includes the following pseudocode functions: 

° shared/functions/aborts/EncodeLDFSC on page J1-7521. 

. shared/functions/aborts/IPAValid on page J1-7521. 

° shared/functions/aborts/IsAsyncAbort on page J1-7521. 

7 shared/functions/aborts/Is DebugException on page J1-7522. 

$ shared/functions/aborts/IsExternalAbort on page J1-7522. 

s shared/functions/aborts/IsExternalSyncAbort on page J1-7522. 

$ shared/functions/aborts/IsFault on page J1-7522. 

s shared/functions/aborts/IsSErrorInterrupt on page J1-7522. 

s shared/functions/aborts/IsSecondStage on page J1-7523. 

. shared/functions/aborts/LSInstructionSyndrome on page J1-7523. 
. shared/functions/common/ASR on page J1-7523. 

. shared/functions/common/ASR_C on page J1-7523. 

. shared/functions/common/Abs on page J1-7523. 

. shared/functions/common/Align on page J1-7524. 

. shared/functions/common/BitCount on page J1-7524. 

$ shared/functions/common/CountLeadingSignBits on page J1-7524. 
s shared/functions/common/CountLeadingZeroBits on page J1-7524. 
G shared/functions/common/Elem on page J1-7524. 

$ shared/functions/common/Extend on page J1-7525. 
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shared/functions/common/HighestSetBit on page J1-7525. 
shared/functions/common/Int on page J1-7525. 
shared/functions/common/IsOnes on page J1-7525. 
shared/functions/common/IsZero on page J1-7525. 
shared/functions/common/IsZeroBit on page J1-7525. 
shared/functions/common/LSL on page J1-7526. 
shared/functions/common/LSL_C on page J1-7526. 
shared/functions/common/LSR on page J1-7526. 
shared/functions/common/LSR_C on page J1-7526. 
shared/functions/common/LowestSetBit on page J1-7526. 
shared/functions/common/Max on page J1-7527. 
shared/functions/common/Min on page J1-7527. 
shared/functions/common/Ones on page J1-7527. 
shared/functions/common/ROR on page J1-7527. 
shared/functions/common/ROR_C on page J1-7527. 
shared/functions/common/Replicate on page J1-7528. 
shared/functions/common/RoundDown on page J1-7528. 
shared/functions/common/RoundTowardsZero on page J1-7528. 
shared/functions/common/RoundUp on page J1-7528. 
shared/functions/common/SInt on page J1-7528. 
shared/functions/common/SignExtend on page J1-7528. 
shared/functions/common/UInt on page J1-7528. 
shared/functions/common/ZeroExtend on page J1-7529. 
shared/functions/common/Zeros on page J1-7529. 
shared/functions/crc/BitReverse on page J1-7529. 
shared/functions/crc/HaveCRCExt on page J1-7529. 
shared/functions/crc/Poly32Mod2 on page J1-7529. 
shared/functions/crypto/AESInvMixColumns on page J1-7530. 
shared/functions/crypto/AESInvShiftRows on page J1-7530. 
shared/functions/crypto/AESInvSubBytes on page J1-7530. 
shared/functions/crypto/AESMixColumns on page J1-7530. 
shared/functions/crypto/AESShiftRows on page J1-7530. 
shared/functions/crypto/AESSubBytes on page J1-7530. 
shared/functions/crypto/HaveAESExt on page J1-7530. 
shared/functions/crypto/HaveBit128PMULLExt on page J1-7530. 
shared/functions/crypto/HaveSHA] Ext on page J1-7530. 
shared/functions/crypto/HaveSHA256Ext on page J1-7531. 
shared/functions/crypto/HaveSHA3Ext on page J1-7531. 
shared/functions/crypto/HaveSHA5 12Ext on page J1-7531. 
shared/functions/crypto/HaveSM3Ext on page J1-7531. 
shared/functions/crypto/HaveSM4Ext on page J1-7531. 
shared/functions/crypto/ROL on page J1-7532. 
shared/functions/crypto/SHA256hash on page J1-7532. 
shared/functions/crypto/SHAchoose on page J1-7532. 
shared/functions/crypto/SHAhashSIGMAO0 on page J1-7532. 
shared/functions/crypto/SHAhashSIGMA] on page J1-7532. 
shared/functions/crypto/SHAmajority on page J1-7532. 
shared/functions/crypto/SHAparity on page J1-7533. 
shared/functions/crypto/Sbox on page J1-7533. 
shared/functions/exclusive/ClearExclusiveByAddress on page J1-7533. 
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° shared/functions/exclusive/ClearExclusiveLocal on page J1-7533. 
e shared/functions/exclusive/ClearExclusiveMonitors on page J1-7533. 
° shared/functions/exclusive/ExclusiveMonitorsStatus on page J1-7533. 


e shared/functions/exclusive/IsExclusiveGlobal on page J1-7533. 

° shared/functions/exclusive/IsExclusiveLocal on page J1-7534. 

$ shared/functions/exclusive/MarkExclusiveGlobal on page J1-7534. 

. shared/functions/exclusive/MarkExclusiveLocal on page J1-7534. 

. shared/functions/exclusive/ProcessorID on page J1-7534. 

. shared/functions/extension/AArch32.HaveHPDExt on page J1-7534. 

$ shared/functions/extension/AArch64.HaveHPDExt on page J1-7534. 

. shared/functions/extension/Have52BitPAExt on page J1-7534. 

° shared/functions/extension/Have52BitVAExt on page J1-7534. 

° shared/functions/extension/HaveAtomicExt on page J1-7534. 

e shared/functions/extension/HaveBTIExt on page J1-7535. 

e shared/functions/extension/HaveBlockBBM on page J1-7535. 

e shared/functions/extension/HaveCommonNotPrivateTransExt on page J1-7535. 
° shared/functions/extension/HaveDITExt on page J1-7535. 

. shared/functions/extension/HaveDOTPExt on page J1-7535. 

° shared/functions/extension/HaveDoPD on page J1-7535. 

. shared/functions/extension/HaveDoubleFaultExt on page J1-7535. 

. shared/functions/extension/HaveDoubleLock on page J1-7536. 

. shared/functions/extension/HaveE0PDExt on page J1-7536. 

. shared/functions/extension/HaveExtendedCacheSets on page J1-7536. 

è shared/functions/extension/HaveExtendedECDebugEvents on page J1-7536. 
e shared/functions/extension/HaveExtendedExecuteNeverExt on page J1-7536. 
° shared/functions/extension/HaveF CADDExt on page J1-7536. 

° shared/functions/extension/HaveF JCVTZSExt on page J1-7536. 

: shared/functions/extension/HaveF P 16MulNoRounding ToF P32Ext on page J1-7537. 
à shared/functions/extension/HaveFlagFormatExt on page J1-7537. 

s shared/functions/extension/HaveFlagManipulateExt on page J1-7537. 

. shared/functions/extension/HaveFrintExt on page J1-7537. 

$ shared/functions/extension/HaveHPMDExt on page J1-7537. 

. shared/functions/extension/HavelDSExt on page J1-7537. 

. shared/functions/extension/HavelESB on page J1-7537. 

. shared/functions/extension/HaveMPAMExt on page J1-7538. 

° shared/functions/extension/HaveMTEExt on page J1-7538. 

° shared/functions/extension/HaveNV2Ext on page J1-7538. 

e shared/functions/extension/HaveNVExt on page J1-7538. 

° shared/functions/extension/HaveNoSecurePMUDisableOverride on page J1-7538. 
° shared/functions/extension/HaveNoninvasiveDebugAuth on page J1-7538. 

5 shared/functions/extension/HavePANExt on page J1-7539. 

. shared/functions/extension/HavePageBasedHardwareAttributes on page J1-7539. 
$ shared/functions/extension/HavePrivATExt on page J1-7539. 

. shared/functions/extension/HaveQRDMLAHExt on page J1-7539. 

$ shared/functions/extension/HaveRASExt on page J1-7539. 

. shared/functions/extension/HaveSBExt on page J1-7539. 

° shared/functions/extension/HaveSSBSExt on page J1-7539. 

e shared/functions/extension/HaveSecureEL2Ext on page J1-7540. 

° shared/functions/extension/HaveSecureExtDebug View on page J1-7540. 

` shared/functions/extension/HaveSelfHostedTrace on page J1-7540. 
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shared/functions/extension/HaveSmallPageTblExt on page J1-7540. 
shared/functions/extension/HaveStage2MemAttrControl on page J1-7540. 
shared/functions/extension/HaveStatisticalProfiling on page J1-7540. 
shared/functions/extension/HaveTraceExt on page J1-7540. 
shared/functions/extension/Have TrapLoadStoreMultipleDeviceExt on page J1-7541. 
shared/functions/extension/HaveUA16Ext on page J1-7541. 
shared/functions/extension/HaveUAOExt on page J1-7541. 
shared/functions/extension/Have VirtHostExt on page J1-7541. 
shared/functions/extension/InsertIESBBeforeException on page J1-7541. 
shared/functions/float/fixedtofp/FixedToFP on page J1-7541. 
shared/functions/float/fpabs/F PAbs on page J1-7542. 
shared/functions/float/fpadd/F PAdd on page J1-7542. 
shared/functions/float/fpcompare/F PCompare on page J1-7542. 
shared/functions/float/fpcompareeq/F PCompareEQ on page J1-7543. 
shared/functions/float/fpcomparege/F PCompareGE on page J1-7543. 
shared/functions/float/fpcomparegt/FPCompareGT on page J1-7543. 
shared/functions/float/fpconvert/F PConvert on page J1-7543. 
shared/functions/float/fpconvertnan/F PConvertNaN on page J1-7544. 
shared/functions/float/fpcrtype/FPCRType on page J1-7545. 
shared/functions/float/fpdecoderm/F PDecodeRM on page J1-7545. 
shared/functions/float/fpdecoderounding/F PDecodeRounding on page J1-7545. 
shared/functions/float/fpdefaultnan/FPDefaultNaN on page J1-7545. 
shared/functions/float/fpdiv/F PDiv on page J1-7545. 
shared/functions/float/fpexc/F PExc on page J1-7546. 
shared/functions/float/fpinfinity/F PInfinity on page J1-7546. 
shared/functions/float/fpmax/F PMax on page J1-7546. 
shared/functions/float/fpmaxnormal/F PMaxNormal on page J1-7546. 
shared/functions/float/fpmaxnum/F PMaxNum on page J1-7547. 
shared/functions/float/fpmin/F PMin on page J1-7547. 
shared/functions/float/fpminnum/F PMinNum on page J1-7547. 
shared/functions/float/fpmul/F PMul on page J1-7548. 
shared/functions/float/fpmuladd/F PMulAdd on page J1-7548. 
shared/functions/float/fpmuladdh/F PMulAddH on page J1-7549. 
shared/functions/float/fpmuladdh/F PProcessNaNs3H on page J1-7550. 
shared/functions/float/fpmulx/F PMulX on page J1-7550. 
shared/functions/float/fpneg/FP Neg on page J1-7550. 
shared/functions/float/fponepointfive/F POnePointFive on page J1-7550. 
shared/functions/float/fpprocessexception/F PProcessException on page J1-7551. 
shared/functions/float/fpprocessnan/F PProcessNaN on page J1-7551. 
shared/functions/float/fpprocessnans/F PProcessNaNs on page J1-7551. 
shared/functions/float/fpprocessnans3/F PProcessNaNs3 on page J1-7552. 
shared/functions/float/fprecipestimate/F PRecipEstimate on page J1-7552. 
shared/functions/float/fprecipestimate/RecipEstimate on page J1-7554. 
shared/functions/float/fprecpx/F PRecpX on page J1-7554. 
shared/functions/float/fpround/FPRound on page J1-7555. 
shared/functions/float/fpround/FPRoundCV on page J1-7556. 
shared/functions/float/fprounding/F PRounding on page J1-7556. 
shared/functions/float/fproundingmode/F PRoundingMode on page J1-7557. 
shared/functions/float/fproundint/F PRoundInt on page J1-7557. 
shared/functions/float/fproundintn/F PRoundIntN on page J1-7558. 
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. shared/functions/float/fprsqrtestimate/F PRSqrtEstimate on page J1-7559. 
. shared/functions/float/fprsqrtestimate/RecipSqrtEstimate on page J1-7560. 
è; shared/functions/float/fpsqrt/FPSqrt on page J1-7560. 

: shared/functions/float/fpsub/FPSub on page J1-7560. 

è shared/functions/float/fpthree/F P Three on page J1-7561. 

$ shared/functions/float/fptofixed/FPToFixed on page J1-7561. 

E shared/functions/float/fptofixedjs/FPToFixedJS on page J1-7562. 

. shared/functions/float/fptwo/FPTwo on page J1-7562. 

. shared/functions/float/fptype/F PType on page J1-7563. 

s shared/functions/float/fpunpack/FPUnpack on page J1-7563. 

. shared/functions/float/fpunpack/F PUnpackBase on page J1-7563. 

a shared/functions/float/fpunpack/F PUnpackCV on page J1-7564. 

: shared/functions/float/fpzero/F PZero on page J1-7564. 

è shared/functions/float/vfpexpandimm/VFPExpandImm on page J1-7565. 
e shared/functions/integer/AddWithCarry on page J1-7565. 

s shared/functions/memory/AArch64.BranchAddr on page J1-7565. 

` shared/functions/memory/AccType on page J1-7565. 

. shared/functions/memory/AccessDescriptor on page J1-7566. 

° shared/functions/memory/AdadrTop on page J1-7566. 

. shared/functions/memory/AddressDescriptor on page J1-7566. 

. shared/functions/memory/Allocation on page J1-7567. 

. shared/functions/memory/BigEndian on page J1-7567. 

s shared/functions/memory/BigEndianReverse on page J1-7567. 

e shared/functions/memory/Cacheability on page J1-7567. 

° shared/functions/memory/CreateAccessDescriptor on page J1-7567. 

° shared/functions/memory/CreateAccessDescriptorPTW on page J1-7567. 
è shared/functions/memory/DataMemoryBarrier on page J1-7568. 

: shared/functions/memory/DataSynchronizationBarrier on page J1-7568. 
à shared/functions/memory/Descriptor Update on page J1-7568. 

. shared/functions/memory/DeviceType on page J1-7568. 

. shared/functions/memory/EffectiveTBI on page J1-7568. 

s shared/functions/memory/EffectiveTCMA on page J1-7568. 

. shared/functions/memory/Fault on page J1-7569. 

° shared/functions/memory/FaultRecord on page J1-7569. 

. shared/functions/memory/FullAddress on page J1-7570. 

è shared/functions/memory/Hint_Prefetch on page J1-7570. 

7 shared/functions/memory/MBReqDomain on page J1-7570. 

e shared/functions/memory/MBReqTypes on page J1-7570. 

. shared/functions/memory/MemAttrHints on page J1-7570. 

° shared/functions/memory/MemType on page J1-7570. 

5 shared/functions/memory/MemoryAttributes on page J1-7570. 

. shared/functions/memory/Permissions on page J1-7570. 

$ shared/functions/memory/PrefetchHint on page J1-7571. 

. shared/functions/memory/SpeculativeStoreBypassBarrierToPA on page J1-7571. 
$ shared/functions/memory/SpeculativeStoreBypassBarrierToVA on page J1-7571. 
. shared/functions/memory/TLBRecord on page J1-7571. 

à shared/functions/memory/_Mem on page J1-7571. 

G shared/functions/mpam/DefaultMPAMinfo on page J1-7571. 
shared/functions/mpam/DefaultPARTID on page J1-7572. 

` shared/functions/mpam/DefaultPMG on page J1-7572. 
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shared/functions/mpam/GenMPAMcurEL on page J1-7572. 
shared/functions/mpam/MAP_vPARTID on page J1-7572. 
shared/functions/mpam/MPAMisEnabled on page J1-7573. 
shared/functions/mpam/MPAMis Virtual on page J1-7573. 
shared/functions/mpam/genMPAM on page J1-7573. 
shared/functions/mpam/genMPAMel on page J1-7574. 
shared/functions/mpam/genPARTID on page J1-7574. 
shared/functions/mpam/genPMG on page J1-7574. 
shared/functions/mpam/getMPAM_PARTID on page J1-7574. 
shared/functions/mpam/getMPAM_PMG on page J1-7575. 
shared/functions/mpam/mapvpmw on page J1-7575. 
shared/functions/registers/BranchTo on page J1-7576. 
shared/functions/registers/BranchToAdadr on page J1-7576. 
shared/functions/registers/BranchType on page J1-7576. 
shared/functions/registers/Hint_Branch on page J1-7576. 
shared/functions/registers/NextInstrAddr on page J1-7577. 
shared/functions/registers/ResetExternalDebugRegisters on page J1-7577. 
shared/functions/registers/ThisInstrAddr on page J1-7577. 
shared/functions/registers/_PC on page J1-7577. 
shared/functions/registers/_R on page J1-7577. 
shared/functions/sysregisters/SPSR on page J1-7577. 
shared/functions/system/Arch Version on page J1-7578. 
shared/functions/system/BranchTargetCheck on page J1-7578. 
shared/functions/system/ClearEventRegister on page J1-7578. 
shared/functions/system/ClearPendingPhysicalSError on page J1-7578. 
shared/functions/system/ClearPendingVirtualSError on page J1-7579. 
shared/functions/system/ConditionHolds on page J1-7579. 
shared/functions/system/ConsumptionOfSpeculativeDataBarrier on page J1-7579. 
shared/functions/system/CurrentInstrSet on page J1-7579. 
shared/functions/system/CurrentPL on page J1-7579. 
shared/functions/system/ELO on page J1-7579. 
shared/functions/system/EL2Enabled on page J1-7580. 
shared/functions/system/ELFromM32 on page J1-7580. 
shared/functions/system/ELFromSPSR on page J1-7580. 
shared/functions/system/ELIsInHost on page J1-7581. 
shared/functions/system/ELState UsingAArch32 on page J1-7581. 
shared/functions/system/ELState UsingAArch32K on page J1-7581. 
shared/functions/system/EL UsingAArch32 on page J1-7582. 
shared/functions/system/EL UsingAArch32K on page J1-7582. 
shared/functions/system/EndOfinstruction on page J1-7582. 
shared/functions/system/EnterLowPowerState on page J1-7582. 
shared/functions/system/EventRegister on page J1-7582. 
shared/functions/system/GetPSRFromPSTATE on page J1-7582. 
shared/functions/system/HasArch Version on page J1-7583. 
shared/functions/system/HaveAArch32EL on page J1-7583. 
shared/functions/system/HaveAnyAArch32 on page J1-7583. 
shared/functions/system/HaveAnyAArch64 on page J1-7583. 
shared/functions/system/HaveEL on page J1-7584. 
shared/functions/system/HaveEL UsingSecurityState on page J1-7584. 
shared/functions/system/HaveF P16Ext on page J1-7584. 
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shared/functions/system/HighestEL on page J1-7584. 

. shared/functions/system/HighestEL UsingAArch32 on page J1-7584. 

è shared/functions/system/Hint_Yield on page J1-7585. 

: shared/functions/system/IllegalExceptionReturn on page J1-7585. 

è shared/functions/system/InstrSet on page J1-7585. 

s shared/functions/system/InstructionSynchronizationBarrier on page J1-7585. 
. shared/functions/system/InterruptPending on page J1-7585. 

. shared/functions/system/IsEventRegisterSet on page J1-7586. 

. shared/functions/system/IsHighestEL on page J1-7586. 

s shared/functions/system/IsInHost on page J1-7586. 

. shared/functions/system/IsPhysicalSErrorPending on page J1-7586. 

a shared/functions/system/IsSecure on page J1-7586. 

- shared/functions/system/IsSecureBelowEL3 on page J1-7586. 

è shared/functions/system/IsSecureEL2Enabled on page J1-7587. 

e shared/functions/system/s VirtualSErrorPending on page J1-7587. 

s shared/functions/system/Mode_Bits on page J1-7587. 

° shared/functions/system/PLOfEL on page J1-7587. 

. shared/functions/system/PSTATE on page J1-7587. 

° shared/functions/system/PrivilegeLevel on page J1-7587. 

. shared/functions/system/ProcState on page J1-7588. 

. shared/functions/system/RestoredITBits on page J1-7588. 

. shared/functions/system/SCRType on page J1-7588. 

. shared/functions/system/SCR_GEN on page J1-7589. 

è shared/functions/system/SendEvent on page J1-7589. 

à shared/functions/system/SendEventLocal on page J1-7589. 

G shared/functions/system/SetPSTATEFromPSR on page J1-7589. 

è shared/functions/system/ShouldAdvancelT on page J1-7590. 

: shared/functions/system/SpeculationBarrier on page J1-7590. 

à shared/functions/system/SynchronizeContext on page J1-7590. 

s shared/functions/system/SynchronizeErrors on page J1-7590. 

. shared/functions/system/TakeUnmaskedPhysicalSErrorInterrupts on page J1-7590. 
$ shared/functions/system/TakeUnmaskedSErrorInterrupts on page J1-7590. 

E shared/functions/system/ThisInstr on page J1-7590. 

. shared/functions/system/ThisInstrLength on page J1-7590. 

° shared/functions/system/Unreachable on page J1-7590. 

è shared/functions/system/UsingAArch32 on page J1-7590. 

7 shared/functions/system/WaitForEvent on page J1-7591. 

e shared/functions/system/WaitForInterrupt on page J1-7591. 

` shared/functions/unpredictable/ConstrainUnpredictable on page J1-7591. 

à shared/functions/unpredictable/ConstrainUnpredictableBits on page J1-7591. 
s shared/functions/unpredictable/ConstrainUnpredictableBool on page J1-7591. 
. shared/functions/unpredictable/ConstrainUnpredictableľnteger on page J1-7591. 
s shared/functions/unpredictable/Constraint on page J1-7592. 

. shared/functions/vector/AdvSIMDExpandImm on page J1-7592. 

s shared/functions/vector/PolynomialMult on page J1-7593. 

. shared/functions/vector/SatQ on page J1-7593. 

. shared/functions/vector/SignedSatQ on page J1-7593. 

G shared/functions/vector/UnsignedRSqrtEstimate on page J1-7593. 

° shared/functions/vector/UnsignedRecipEstimate on page J1-7593. 

e shared/functions/vector/UnsignedSatQ on page J1-7594. 
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shared/functions/aborts/EncodeLDFSC 
// EncodeLDFSC() 
// Function that gives the Long-descriptor FSC code for types of Fault 
bits(6) EncodeLDFSC(Fault statuscode, integer level) 


bits(6) result; 
case statuscode of 











when Fault_AddressSize result = 'Q000':level<1:0>; assert level IN {0,1,2,3}; 
when Fault_AccessFlag result = 'Q010':level<1:0>; assert level IN {1,2,3}; 
when Fault_Permission result = 'Q011':level<1:0>; assert level IN {1,2,3}; 
when Fault_Translation result = 'Q001':level<1:0>; assert level IN {0,1,2,3}; 
when Fault_SyncExternal result = 'Q10000'; 

when Fault_SyncExternalOnWalk result = 'Q101':level<1:@>; assert level IN {0,1,2,3}; 
when Fault_SyncParity result = '011000'; 

when Fault_SyncParityOnWalk result = 'Q111':level<1:0>; assert level IN {0,1,2,3}; 
when Fault_AsyncParity result = '011001'; 

when Fault_AsyncExternal result = 'Q10001'; 

when Fault_Alignment result = '100001'; 

when Fault_Debug result = '100010'; 

when Fault_TLBConflict result = '110000'; 

when Fault_HWUpdateAccessFlag result = '110001'; 

when Fault_Lockdown result = '110100'; // IMPLEMENTATION DEFINED 

when Fault_Exclusive result = '110101'; // IMPLEMENTATION DEFINED 
otherwise Unreachable(); 


return result; 


shared/functions/aborts/IPAValid 
// IPAValid() 
// Return TRUE if the IPA is reported for the abort 


boolean IPAValid(FaultRecord fault) 
assert fault.statuscode != Fault_None; 


if fault.s2fslwalk then 
return fault.statuscode IN {Fault_AccessFlag, Fault_Permission, Fault_Translation, 
Fault_AddressSize}; 
elsif fault.secondstage then 
return fault.statuscode IN {Fault_AccessFlag, Fault_Translation, Fault_AddressSize}; 
else 
return FALSE; 


shared/functions/aborts/IsAsyncAbort 


// IsAsyncAbort() 


// Returns TRUE if the abort currently being processed is an asynchronous abort, and FALSE 
// otherwise. 


boolean IsAsyncAbort(Fault statuscode) 
assert statuscode != Fault_None; 


return (statuscode IN {Fault_AsyncExternal, Fault_AsyncParity}); 


// IsAsyncAbort() 


boolean IsAsyncAbort(FaultRecord fault) 
return IsAsyncAbort(fault.statuscode) ; 
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shared/functions/aborts/IsDebugException 


// IsDebugException() 
// ================== 


boolean IsDebugException(FaultRecord fault) 
assert fault.statuscode != Fault_None; 
return fault.statuscode == Fault_Debug; 


shared/functions/aborts/IsExternalAbort 


// IsExternalAbort() 


// Returns TRUE if the abort currently being processed is an external abort and FALSE otherwise. 


boolean IsExternalAbort(Fault statuscode) 
assert statuscode != Fault_None; 


return (statuscode IN {Fault_SyncExternal, Fault_SyncParity, Fault_SyncExternalOnWalk, 
Fault_SyncParityOnWalk, 
Fault_AsyncExternal, Fault_AsyncParity }); 


// IsExternalAbort() 
// ================= 


boolean IsExternalAbort(FaultRecord fault) 
return IsExternalAbort(fault.statuscode); 
shared/functions/aborts/IsExternalSyncAbort 
// IsExternalSyncAbort() 
// sssssessses========== 


// Returns TRUE if the abort currently being processed is an external synchronous abort and FALSE 
otherwise. 


boolean IsExternalSyncAbort(Fault statuscode) 
assert statuscode != Fault_None; 


return (statuscode IN {Fault_SyncExternal, Fault_SyncParity, Fault_SyncExternalOnWalk, 
Fault_SyncParityOnWalk}) ; 


// IsExternalSyncAbort() 
// ===================== 


boolean IsExternalSyncAbort(FaultRecord fault) 
return IsExternalSyncAbort(fault.statuscode); 
shared/functions/aborts/IsFault 
// IsFault() 
// Return TRUE if a fault is associated with an address descriptor 
boolean IsFault(AddressDescriptor addrdesc) 
return addrdesc.fault.statuscode != Fault_None; 
shared/functions/aborts/IsSErrorinterrupt 
// IsSErrorInterrupt() 
7 Returns TRUE if the abort currently being processed is an SError interrupt, and FALSE 


// otherwise. 


boolean IsSErrorInterrupt(Fault statuscode) 
assert statuscode != Fault_None; 
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return (statuscode IN {Fault_AsyncExternal, Fault_AsyncParity}); 


// IsSErrorInterrupt() 
// =================== 


boolean IsSErrorInterrupt(FaultRecord fault) 
return IsSErrorInterrupt(fault.statuscode); 


shared/functions/aborts/IsSecondStage 


// IsSecondStage() 
// =============== 


boolean IsSecondStage(FaultRecord fault) 
assert fault.statuscode != Fault_None; 


return fault.secondstage; 


shared/functions/aborts/LSInstructionSyndrome 


bits(11) LSInstructionSyndrome() ; 


shared/functions/common/ASR 


// ASRO) 
f= 


bits(N) ASR(bits(N) x, integer shift) 
assert shift >= 0; 
if shift == 0 then 
result = x; 
else 
(result, -) = ASR_C(x, shift); 
return result; 


shared/functions/common/ASR_C 


// ASR_C() 
// ======= 


(bits(N), bit) ASR_C(bits(N) x, integer shift) 
assert shift > Q; 
shift = if shift > N then N else shift; 
extended_x = SignExtend(x, shift+N); 
result = extended_x<shift+N-1:shift>; 
carry_out = extended_x<shift-1l; 
return (result, carry_out); 


shared/functions/common/Abs 


// Abs() 
i= 


integer Abs(integer x) 
return if x >= 0 then x else -x; 


// Abs() 
= 


real Abs(real x) 
return if x >= 0.0 then x else -x; 
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shared/functions/common/Align 


// Align() 
// ======= 


integer Align(integer x, integer y) 
return y « (x DIV y); 


// Align() 
// = 


bits(N) Align(bits(N) x, integer y) 
return Align(UInt(x), y)<N-1:0>; 


shared/functions/common/BitCount 


// BitCount() 
——— 


integer BitCount(bits(N) x) 
integer result = 0; 
for i = 0 to N-1 
if x<i> == '1' then 
result = result + 1; 
return result; 


shared/functions/common/CountLeadingSignBits 


// CountLeadingSignBits() 
// ====================== 


integer CountLeadingSignBits(bits(N) x) 
return CountLeadingZeroBits(x<N-1:1> EOR x<N-2:0>); 


shared/functions/common/CountLeadingZeroBits 


// CountLeadingZeroBits() 
[[ ====================== 


integer CountLeadingZeroBits(bits(N) x) 
return N - (HighestSetBit(x) + 1); 


shared/functions/common/Elem 


// Elem[] - non-assignment form 


// ============================ 


bits(size) Elem[bits(N) vector, integer e, integer size] 
assert e >= 0 && (e+1)«size <= N; 
return vector<exsize+size-1 : exsize>; 


// Elem[] - non-assignment form 


[/ ============================ 


bits(size) Elem[bits(N) vector, integer e] 
return Elem[vector, e, size]; 


// Elem[] - assignment form 


// ======================== 


Elem[bits(N) &vector, integer e, integer size] = bits(size) value 
assert e >= 0 && (e+1)«size <= N; 
vector<(e+1)#size-liexsize> = value; 
return; 
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// Elem[] - assignment form 


[J e 

Elem[bits(N) &vector, integer e] = bits(size) value 
Elem[vector, e, size] = value; 
return; 


shared/functions/common/Extend 


// Extend() 
(== 


bits(N) Extend(bits(M) x, integer N, boolean unsigned) 
return if unsigned then ZeroExtend(x, N) else SignExtend(x, N); 


// Extend() 
[I === 


bits(N) Extend(bits(M) x, boolean unsigned) 
return Extend(x, N, unsigned); 
shared/functions/common/HighestSetBit 


// HighestSetBit() 
// =============== 


integer HighestSetBit(bits(N) x) 
for i = N-1 downto 0 
if x<i> == '1' then return i; 
return -1; 


shared/functions/icommon/lnt 


// Int() 
{| ===== 


integer Int(bits(N) x, boolean unsigned) 
result = if unsigned then UInt(x) else SInt(x); 
return result; 


shared/functions/common/IsOnes 


// IsOnes() 
[I === 


boolean IsOnes(bits(N) x) 
return x == Ones(N); 
shared/functions/common/IsZero 


// IsZero() 
(=< 


boolean IsZero(bits(N) x) 
return x == Zeros(N); 
shared/functions/common/IsZeroBit 


// IsZeroBit() 
// =========== 


bit IsZeroBit(bits(N) x) 
return if IsZero(x) then '1' else 'Q'; 
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shared/functions/common/LSL 


// ISLO) 
== 


bits(N) LSL(bits(N) x, integer shift) 
assert shift >= 0; 
if shift == @ then 
result = x; 
else 
(result, -) = LSL_C(x, shift); 
return result; 


shared/functions/common/LSL_C 


// LSL_C() 
// ======= 


(bits(N), bit) LSL_C(bits(N) x, integer shift) 
assert shift > 0; 
shift = if shift > N then N else shift; 
extended_x = x : Zeros(shift); 
result = extended_x<N-1:0>; 
carry_out = extended_x<N>; 
return (result, carry_out); 


shared/functions/common/LSR 


// USRO 
ji === 


bits(N) LSR(bits(N) x, integer shift) 
assert shift >= 0; 
if shift == 0 then 
result = x; 
else 
(result, -) = LSR_C(x, shift); 
return result; 


shared/functions/common/LSR_C 


// LSR_C() 
// ======= 


(bits(N), bit) LSR_C(bits(N) x, integer shift) 
assert shift > 0; 
shift = if shift > N then N else shift; 
extended_x = ZeroExtend(x, shift+N); 
result = extended_x<shift+N-1:shift>; 
carry_out = extended_x<shift-1>; 
return (result, carry_out); 


shared/functions/common/LowestSetBit 


// LowestSetBit() 
// ============== 


integer LowestSetBit(bits(N) x) 
for i = 0 to N-1 


if x<i> == '1' then return i; 
return N; 
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shared/functions/common/Max 


// Max() 
// === 


integer Max(integer a, integer b) 
return if a >= b then a else b; 


// Max() 
// === 


real Max(real a, real b) 
return if a >= b then a else b; 


shared/functions/common/Min 


// Min) 
/] === 


integer Min(integer a, integer b) 
return if a <= b then a else b; 


// Min) 
i— 


real Min(real a, real b) 
return if a <= b then a else b; 


shared/functions/common/Ones 


// Ones() 
[| === 


bits(N) Ones(integer N) 
return Replicate('1',N); 


// Ones() 
[| ==== 


bits(N) Ones() 
return Ones(N); 


shared/functions/common/ROR 


// ROR) 
[| === 


bits(N) ROR(bits(N) x, integer shift) 
assert shift >= 0; 
if shift == 0 then 
result = x; 
else 
(result, -) = ROR_C(x, shift); 
return result; 


shared/functions/common/ROR_C 


// ROR_C() 
// ======= 


(bits(N), bit) ROR_C(bits(N) x, integer shift) 
assert shift != 0; 
m = shift MOD N; 
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result = LSR(x,m) OR LSL(x,N-m); 
carry_out = result<N-1>; 
return (result, carry_out); 


shared/functions/common/Replicate 


// Replicate() 

// e 

bits(N) Replicate(bits(M) x) 
assert N MOD M == Q; 
return Replicate(x, N DIV M); 


bits(MsN) Replicate(bits(M) x, integer N); 


shared/functions/common/RoundDown 


integer RoundDown(real x); 


shared/functions/common/RoundTowardsZero 


// RoundTowardsZero() 
// ================== 


integer RoundTowardsZero(real x) 
return if x == 0.0 then 0 else if x >= 0.0 then RoundDown(x) else RoundUp(x); 
shared/functions/common/RoundUp 


integer RoundUp(real x); 


shared/functions/common/SInt 


// Sint() 
[| === 


integer SInt(bits(N) x) 
result = 0; 
for i = 0 to N-1 
if x<i> == '1' then result = result + 2Ai; 
if x<N-1> == '1' then result = result - 2AN; 
return result; 


shared/functions/common/SignExtend 


// SignExtend() 

[f =ssssssss=== 

bits(N) SignExtend(bits(M) x, integer N) 
assert N >= M; 


return Replicate(x<M-1>, N-M) : x; 


// SignExtend() 
// ============ 


bits(N) SignExtend(bits(M) x) 
return SignExtend(x, N); 
shared/functions/common/UInt 


// UInt() 
[| === 
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integer UInt(bits(N) x) 
result = ð; 
for i = 0 to N-1 
if x<i> == '1' then result = result + 2Ai; 
return result; 


shared/functions/common/ZeroExtend 


// ZeroExtend() 

// a 

bits(N) ZeroExtend(bits(M) x, integer N) 
assert N >= M; 


return Zeros(N-M) : x; 


// ZeroExtend() 
// ============ 


bits(N) ZeroExtend(bits(M) x) 
return ZeroExtend(x, N); 
shared/functions/common/Zeros 


// Zeros() 
// ======= 


bits(N) Zeros(integer N) 
return Replicate('0',N); 


// Zeros() 
|/ ======= 


bits(N) Zeros() 
return Zeros(N); 
shared/functions/crc/BitReverse 


// BitReverse() 
(= 


bits(N) BitReverse(bits(N) data) 
bits(N) result; 
for i = 0 to N-1 
result<N-i-1> = data<i>; 
return result; 


shared/functions/crc/HaveCRCExt 


// HaveCRCExt() 
// ============ 


boolean HaveCRCExt() 
return HasArchVersion(ARMv8p1) || boolean IMPLEMENTATION_DEFINED "Have CRC extension"; 
shared/functions/crc/Poly32Mod2 


// Poly32Mod2() 
——= 


// Poly32Mod2 on a bitstring does a polynomial Modulus over {0,1} operation 
bits(32) Poly32Mod2(bits(N) data, bits(32) poly) 


assert N > 32; 
for i = N-1 downto 32 
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if data<i> == '1' then 
data<i-1:0> = data<i-1:@> EOR (poly:Zeros(i-32)); 
return data<31:0>; 


shared/functions/crypto/AESInvMixC olumns 


bits(128) AESInvMixColumns(bits (128) op); 


shared/functions/crypto/AESInvShiftRows 


bits(128) AESInvShiftRows(bits(128) op); 


shared/functions/crypto/AESInvSubBytes 


bits(128) AESInvSubBytes(bits(128) op); 


shared/functions/crypto/AESMixColumns 


bits(128) AESMixColumns(bits (128) op); 


shared/functions/crypto/AESShiftRows 


bits(128) AESShiftRows(bits(128) op); 


shared/functions/crypto/AESSubBytes 


bits(128) AESSubBytes(bits(128) op); 


shared/functions/crypto/HaveAESExt 
// HaveAESExt() 


// TRUE if AES cryptographic instructions support is implemented, 
// FALSE otherwise. 


boolean HaveAESExt() 
return boolean IMPLEMENTATION_DEFINED "Has AES Crypto instructions"; 


shared/functions/crypto/HaveBit128PMULLExt 


// HaveBit128PMULLExt() 


// TRUE if 128 bit form of PMULL instructions support is implemented, 
// FALSE otherwise. 


boolean HaveBit128PMULLExt() 
return boolean IMPLEMENTATION_DEFINED "Has 128-bit form of PMULL instructions"; 
shared/functions/crypto/HaveSHA1Ext 
// HaveSHA1Ext() 


// TRUE if SHA1 cryptographic instructions support is implemented, 
// FALSE otherwise. 


boolean HaveSHA1Ext() 
return boolean IMPLEMENTATION_DEFINED "Has SHA1 Crypto instructions"; 
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shared/functions/crypto/HaveSHA256Ext 


// HaveSHA256Ext() 
// ssssssssss===== 
// TRUE if SHA256 cryptographic instructions support is implemented, 
// FALSE otherwise. 


boolean HaveSHA256Ext() 
return boolean IMPLEMENTATION_DEFINED "Has SHA256 Crypto instructions"; 


shared/functions/crypto/HaveSHA3Ext 
// HaveSHA3Ext() 


// TRUE if SHA3 cryptographic instructions support is implemented, 
// and when SHA1 and SHA2 basic cryptographic instructions support is implemented, 
// FALSE otherwise. 


boolean HaveSHA3Ext() 
if !HasArchVersion(ARMv8p2) || !(HaveSHALExt() && HaveSHA256Ext()) then 
return FALSE; 
return boolean IMPLEMENTATION_DEFINED "Has SHA3 Crypto instructions"; 


shared/functions/crypto/HaveSHA512Ext 


// HaveSHA512Ext() 

// TRUE if SHA512 cryptographic instructions support is implemented, 

// and when SHA1 and SHA2 basic cryptographic instructions support is implemented, 
// FALSE otherwise. 


boolean HaveSHA512Ext() 
if !HasArchVersion(ARMv8p2) || !(HaveSHALExt() && HaveSHA256Ext()) then 
return FALSE; 
return boolean IMPLEMENTATION_DEFINED "Has SHA512 Crypto instructions"; 


shared/functions/crypto/HaveSM3Ext 


// HaveSM3Ext() 


// TRUE if SM3 cryptographic instructions support is implemented, 
// FALSE otherwise. 


boolean HaveSM3Ext() 
if !HasArchVersion(ARMv8p2) then 
return FALSE; 
return boolean IMPLEMENTATION_DEFINED "Has SM3 Crypto instructions"; 


shared/functions/crypto/HaveSM4Ext 


// HaveSM4Ext() 


// TRUE if SM4 cryptographic instructions support is implemented, 
// FALSE otherwise. 


boolean HaveSM4Ext() 
if !HasArchVersion(ARMv8p2) then 
return FALSE; 
return boolean IMPLEMENTATION_DEFINED "Has SM4 Crypto instructions"; 
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shared/functions/crypto/ROL 


// ROL() 
== 


bits(N) ROL(bits(N) x, integer shift) 
assert shift >= 0 && shift <= N; 
if (shift == 0) then 
return x; 
return ROR(x, N-shift); 


shared/functions/crypto/SHA256hash 


// SHA256hash() 
// ============ 


bits(128) SHA256hash(bits (128) X, bits(128) Y, bits(128) W, boolean part1) 


bits(32) chs, maj, t; 


for e = Q to 3 
chs = SHAchoose(Y<31:@>, Y<63:32>, Y<95:64>); 
maj = SHAmajority(X<31:0>, X<63:32>, X<95:64>); 
t = Y<127:96> + SHAhashSIGMA1(Y<31:@>) + chs + Elem[W, e, 32]; 
X<127:96> = t + X<127:96>; 
Y<127:96> = t + SHAhashSIGMAQ(X<31:0>) + maj; 
<Y, X> = ROL(Y : X, 32); 
return (if part1 then X else Y); 


shared/functions/crypto/SHAchoose 


// SHAchoose() 
// =========== 


bits(32) SHAchoose(bits(32) x, bits(32) y, bits(32) z) 
return (((y EOR z) AND x) EOR z); 
shared/functions/crypto/SHAhashSIGMAO 


// SHAhashSIGMAQ( ) 
// =============== 


bits(32) SHAhashSIGMAQ(bits(32) x) 
return ROR(x, 2) EOR ROR(x, 13) EOR ROR(x, 22); 
shared/functions/crypto/SHAhashSIGMA1 


// SHAhashSIGMA1() 
// =============== 


bits(32) SHAhashSIGMA1(bits(32) x) 
return ROR(x, 6) EOR ROR(x, 11) EOR ROR(x, 25) 
shared/functions/crypto/SHAmajority 


// SHAmajority() 
// ============= 


bits(32) SHAmajority(bits(32) x, bits(32) y, bits(32) z) 
return ((x AND y) OR ((x OR y) AND z)); 
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shared/functions/crypto/SHAparity 


// SHAparity() 


bits(32) SHAparity(bits(32) x, bits(32) y, bits(32) z) 
return (x EOR y EOR z); 


shared/functions/crypto/Sbox 
// Sbox() 


// Used in SM4E crypto instruction 


bits(8) Sbox(bits(8) sboxin) 

bits(8) sboxout; 

bits(2048) sboxstring = 
Oxd690e9feccel3db716b614c228fb2c052b679a762abe04c3aa441326498606999C4250F491ef987a33540b43edcfac62e4b31ca 
9c908e89580df94fa758F3fa64707a7FCF37317ba83593c19e6854Fa8686b81b27164da8bf8eb0F4b70569d351e240e5e6358d1a2 
25227¢3b01217887d40046579Fd327524c3602e7a0c4c89eeabf8ad240c7 38b5a3F7F2cef96115ale0ae5da49b341a55ad933230F 
58cble31df6e22e8266ca60c02923ab0d5 34e6fd5db3745defd8e2f03ff6a726d6c5b518d1baf92bbddbc7F11d95c411f105ad80a 
c13188a5cd7bbd2d74d012b8e5b4b08969974a0c96777e65b9F109c56ec68418F07dec3adc4d2079ee5 F3ed7cb3948<2047 : 0>; 


sboxout = sboxstring<(255-UInt(sboxin) )*8+7:(255-UInt(sboxin) )#8>; 
return sboxout; 


shared/functions/exclusive/ClearExclusiveByAddress 


// Clear the global Exclusives monitors for all PEs EXCEPT processorid if they 

// record any part of the physical address region of size bytes starting at paddress. 
// It is IMPLEMENTATION DEFINED whether the global Exclusives monitor for processorid 
// is also cleared if it records any part of the address region. 
ClearExclusiveByAddress(FullAddress paddress, integer processorid, integer size); 


shared/functions/exclusive/ClearExclusiveLocal 
// Clear the local Exclusives monitor for the specified processorid. 
ClearExclusiveLocal(integer processorid); 


shared/functions/exclusive/ClearExclusiveMonitors 


// ClearExclusiveMonitors() 


// a 
// Clear the local Exclusives monitor for the executing PE. 


ClearExclusiveMonitors() 
ClearExclusiveLocal(ProcessorID()); 


shared/functions/exclusive/ExclusiveMonitorsStatus 


// Returns '@' to indicate success if the last memory write by this PE was to 

// the same physical address region endorsed by ExclusiveMonitorsPass(). 

// Returns '1' to indicate failure if address translation resulted in a different 
// physical address. 

bit ExclusiveMonitorsStatus(); 


shared/functions/exclusive/IsExclusiveGlobal 


// Return TRUE if the global Exclusives monitor for processorid includes all of 
// the physical address region of size bytes starting at paddress. 
boolean IsExclusiveGlobal(FullAddress paddress, integer processorid, integer size); 
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shared/functions/exclusive/IsExclusiveLocal 

// Return TRUE if the local Exclusives monitor for processorid includes all of 

// the physical address region of size bytes starting at paddress. 

boolean IsExclusiveLocal(FullAddress paddress, integer processorid, integer size); 
shared/functions/exclusive/MarkExclusiveGlobal 

// Record the physical address region of size bytes starting at paddress in 

// the global Exclusives monitor for processorid. 

MarkExclusiveGlobal(FullAddress paddress, integer processorid, integer size); 
shared/functions/exclusive/MarkExclusiveLocal 

// Record the physical address region of size bytes starting at paddress in 

// the local Exclusives monitor for processorid. 

MarkExclusiveLocal(FullAddress paddress, integer processorid, integer size); 
shared/functions/exclusive/ProcessorID 

// Return the ID of the currently executing PE. 

integer ProcessorID(); 


shared/functions/extension/AArch32.HaveHPDExt 


// AArch32.HaveHPDExt() 
// ==================== 


boolean AArch32.HaveHPDExt() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/AArch64.HaveHPDExt 


// AArch64.HaveHPDExt() 
|[ ==================== 


boolean AArch64.HaveHPDExt() 
return HasArchVersion(ARMv8p1) ; 
shared/functions/extension/Have52BitPAExt 


// Have52BitPAExt() 
// ================ 


boolean Have52BitPAExt() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/Have52BitVAExt 


// Have52BitVAExt() 
// ================ 


boolean Have52BitVAExt() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/HaveAtomicExt 


// HaveAtomicExt() 
// =============== 


boolean HaveAtomicExt() 
return HasArchVersion(ARMv8p1); 
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shared/functions/extension/HaveBTIExt 
// HaveBTIExt() 
// Returns TRUE if support for Branch Target Indentification is implemented. 
boolean HaveBTIExt() 
return HasArchVersion(ARMv8p5) ; 
shared/functions/extension/HaveBlockBBM 
// HaveBlockBBM() 
// Returns TRUE if support for changing block size without requring break-before-make is implemented. 
boolean HaveBlockBBM() 
return HasArchVersion(ARMv8p4) ; 
shared/functions/extension/HaveCommonNotPrivateTransExt 


// HaveCommonNotPrivateTransExt() 


ff ese 
boolean HaveCommonNotPrivateTransExt() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/HaveDITExt 


// HaveDITExt() 
// ============ 


boolean HaveDITExt() 
return HasArchVersion(ARMv8p4) ; 
shared/functions/extension/HaveDOTPExt 
// HaveDOTPExt() 
// Returns TRUE if Dot Product feature support is implemented, and FALSE otherwise. 
boolean HaveDOTPExt() 
return HasArchVersion(ARMv8p4) || (HasArchVersion(ARMv8p2) && boolean IMPLEMENTATION_DEFINED "Has 
Dot Product extension"); 
shared/functions/extension/HaveDoPD 
// HaveDoPD() 
// ssssss==== 
// Returns TRUE if Debug Over Power Down extension 
// support is implemented and FALSE otherwise. 
boolean HaveDoPD() 
return HasArchVersion(ARMv8p2) && boolean IMPLEMENTATION_DEFINED "Has DoPD extension"; 


shared/functions/extension/HaveDoubleFaultExt 


// HaveDoubleFaultExt() 
|[ ==================== 


boolean HaveDoubleFaultExt() 
return (HasArchVersion(ARMv8p4) && HaveEL(EL3) && !ELUsingAArch32(EL3) && HaveIESB()); 
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shared/functions/extension/HaveDoubleLock 

// HaveDoubleLock() 

// sssssssssss===== 

// Returns TRUE if support for the OS Double Lock is implemented. 

boolean HaveDoubleLock() 

return !HasArchVersion(ARMv8p4) || boolean IMPLEMENTATION_DEFINED "OS Double Lock is implemented"; 

shared/functions/extension/HaveEOPDExt 

// HaveEQPDExt() 


// Returns TRUE if support for constant fault times for unprivileged accesses 
// to the memory map is implemented. 


boolean HaveE@PDExt() 
return HasArchVersion(ARMv8p5) ; 
shared/functions/extension/HaveExtendedCacheSets 


// HaveExtendedCacheSets() 
// ======================= 


boolean HaveExtendedCacheSets() 
return HasArchVersion(ARMv8p3); 
shared/functions/extension/HaveExtendedECDebugEvents 


// HaveExtendedECDebugEvents() 
// e 


boolean HaveExtendedECDebugEvents() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/HaveExtendedExecuteNeverExt 


// HaveExtendedExecuteNeverExt() 


es 
boolean HaveExtendedExecuteNeverExt() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/HaveFCADDExt 


// HaveFCADDExt() 
// ============== 


boolean HaveFCADDExt() 
return HasArchVersion(ARMv8p3); 
shared/functions/extension/HaveFJCVTZSExt 


// HaveFJCVTZSExt() 
// ================ 


boolean HaveFJCVTZSExt() 
return HasArchVersion(ARMv8p3); 
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shared/functions/extension/HaveFP16MulNoRoundingToFP32Ext 
// HaveFP16MulNoRoundingToFP32Ext() 
// Secs 
// Returns TRUE if has FP16 multiply with no intermediate rounding accumulate to FP32 instructions, 
// and FALSE otherwise 
boolean HaveFP16MulNoRoundingToFP32Ext() 
if !HaveFP16Ext() then return FALSE; 
if HasArchVersion(ARMv8p4) then return TRUE; 
return (HasArchVersion(ARMv8p2) && 
boolean IMPLEMENTATION_DEFINED "Has accumulate FP16 product into FP32 extension"); 
shared/functions/extension/HaveFlagFormatExt 
// HaveFlagFormatExt() 
// Returns TRUE if flag format conversion instructions implemented. 
boolean HaveFlagFormatExt() 
return HasArchVersion(ARMv8p5) ; 
shared/functions/extension/HaveFlagManipulateExt 
// HaveFlagManipulateExt() 
// Returns TRUE if flag manipulate instructions are implemented. 
boolean HaveFlagManipulateExt() 
return HasArchVersion(ARMv8p4) ; 
shared/functions/extension/HaveFrintExt 
// HaveFrintExt() 
[f -sssssssss==== 
// Returns TRUE if FRINT instructions are implemented. 
boolean HaveFrintExt() 
return HasArchVersion(ARMv8p5) ; 
shared/functions/extension/HaveHPMDExt 


// HaveHPMDExt() 
// ============= 


boolean HaveHPMDExt() 
return HasArchVersion(ARMv8p1) ; 
shared/functions/extension/HavelDSExt 
// HaveIDSExt() 
// Returns TRUE if ID register handling feature is implemented. 
boolean HaveIDSExt() 
return HasArchVersion(ARMv8p4) ; 
shared/functions/extension/HavelESB 


// HaveIESB() 
[I === 
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boolean HavelESB() 
return (HaveRASExt() && 
boolean IMPLEMENTATION_DEFINED "Has Implicit Error Synchronization Barrier"); 
shared/functions/extension/HaveMPAMExt 
// HaveMPAMExt () 
// Returns TRUE if MPAM is implemented, and FALSE otherwise. 
boolean HaveMPAMExt() 
return (HasArchVersion(ARMv8p2) && 
boolean IMPLEMENTATION_DEFINED "Has MPAM extension"); 
shared/functions/extension/HaveMTEExt 
// HaveMTEExt() 
// Returns TRUE if MTE implemented, and FALSE otherwise. 
boolean HaveMTEExt() 
if !HasArchVersion(ARMv8p5) then 
return FALSE; 
return boolean IMPLEMENTATION_DEFINED "Has MTE extension"; 
shared/functions/extension/HaveNV2Ext 
// HaveNV2Ext() 
// Returns TRUE if Enhanced Nested Virtualization is implemented. 
boolean HaveNV2Ext() 
return (HasArchVersion(ARMv8p4) && HaveNVExt() 
&& boolean IMPLEMENTATION_DEFINED "Has support for Enhanced Nested Virtualization") ; 
shared/functions/extension/HaveNVExt 
// HaveNVExt() 
// Returns TRUE if Nested Virtualization is implemented. 
boolean HaveNVExt() 
return HasArchVersion(ARMv8p3) && boolean IMPLEMENTATION_DEFINED "Has Nested Virtualization”; 


shared/functions/extension/HaveNoSecurePMUDisableOverride 


// HaveNoSecurePMUDi sableOverride() 
————————— 


boolean HaveNoSecurePMUDisableOverride() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/HaveNoninvasiveDebugAuth 
// HaveNoninvasiveDebugAuth() 
J] =c 


// Returns TRUE if the Non-invasive debug controls are implemented. 


boolean HaveNoninvasiveDebugAuth() 
return !HasArchVersion(ARMv8p4) ; 
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shared/functions/extension/HavePANExt 


// HavePANExt() 
// ============ 


boolean HavePANExt() 
return HasArchVersion(ARMv8p1); 
shared/functions/extension/HavePageBasedHardwareAttributes 


// HavePageBasedHardwareAttributes() 
ee 


boolean HavePageBasedHardwareAttributes() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/HavePrivATExt 


// HavePrivATExt() 
// =============== 


boolean HavePrivATExt() 
return HasArchVersion(ARMv8p2) ; 


shared/functions/extension/HaveQRDMLAHExt 


// HaveQRDMLAHExt () 
// ================ 


boolean HaveQRDMLAHExt() 
return HasArchVersion(ARMv8p1) ; 


boolean HaveAccessFlagUpdateExt( ) 
return HasArchVersion(ARMv8p1) ; 


boolean HaveDirtyBitModifierExt() 
return HasArchVersion(ARMv8p1) ; 
shared/functions/extension/HaveRASExt 


// HaveRASExt() 
[/ === 


boolean HaveRASExt() 


return (HasArchVersion(ARMv8p2) || 
boolean IMPLEMENTATION_DEFINED "Has RAS extension"); 


shared/functions/extension/HaveSBExt 
// HaveSBExt() 
// Returns TRUE if support for SB is implemented, and FALSE otherwise. 


boolean HaveSBExt() 
return HasArchVersion(ARMv8p5) || boolean IMPLEMENTATION_DEFINED "Has SB extension"; 


shared/functions/extension/HaveSSBSExt 
// HaveSSBSExt() 


// Returns TRUE if support for SSBS is implemented, and FALSE otherwise. 
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boolean HaveSSBSExt() 
return HasArchVersion(ARMv8p5) || boolean IMPLEMENTATION_DEFINED "Has SSBS extension"; 
shared/functions/extension/HaveSecureEL2Ext 
// HaveSecureEL2Ext() 
// Returns TRUE if Secure EL2 is implemented. 
boolean HaveSecureEL2Ext() 
return HasArchVersion(ARMv8p4) ; 
shared/functions/extension/HaveSecureExtDebugView 
// HaveSecureExtDebugVi ew() 
// ssssssssssesssee======== 
// Returns TRUE if support for Secure and Non-secure views of debug peripherals is implemented. 
boolean HaveSecureExtDebugVi ew( ) 
return HasArchVersion(ARMv8p4) ; 
shared/functions/extension/HaveSelfHostedTrace 


// HaveSelfHostedTrace() 
// ===================== 


boolean HaveSelfHostedTrace() 
return HasArchVersion(ARMv8p4) ; 
shared/functions/extension/HaveSmallPageTbliExt 
// HaveSmal1PageTblExt() 
// Returns TRUE if Small Page Table Support is implemented. 
boolean HaveSmal]1PageTblExt() 
return HasArchVersion(ARMv8p4) && boolean IMPLEMENTATION_DEFINED "Has Small Page Table extension"; 
shared/functions/extension/HaveStage2MemAttrControl 
// HaveStage2MemAttrControl () 
// asce 
// Returns TRUE if support for Stage2 control of memory types and cacheability attributes is 
implemented. 
boolean HaveStage2MemAttrControl () 
return HasArchVersion(ARMv8p4) ; 


shared/functions/extension/HaveStatisticalProfiling 


// HaveStatisticalProfiling() 
|[ ========================== 


boolean HaveStatisticalProfiling() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/HaveTraceExt 
// HaveTraceExt() 


// Returns TRUE if Trace functionality as described by the Trace Architecture 
// is implemented. 
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boolean HaveTraceExt() 
return boolean IMPLEMENTATION_DEFINED "Has Trace Architecture functionality"; 
shared/functions/extension/HaveTrapLoadStoreMultipleDeviceExt 


// HaveTrapLoadStoreMultipleDeviceExt() 
ee 


boolean HaveTrapLoadStoreMultip|eDeviceExt() 
return HasArchVersion(ARMv8p2) ; 
shared/functions/extension/HaveUA16Ext 
// HaveUA16Ext() 
// Returns TRUE if extended unaligned memory access support is implemented, and FALSE otherwise. 
boolean HaveUA16Ext() 
return HasArchVersion(ARMv8p4) ; 
shared/functions/extension/HaveUAOExt 


// HaveUAOExt() 
// ============ 


boolean HaveUAOExt() 
return HasArchVersion(ARMv8p2) ; 


shared/functions/extension/HaveVirtHostExt 


// HaveVirtHostExt() 
// ================= 


boolean HaveVirtHostExt() 
return HasArchVersion(ARMv8p1); 


shared/functions/extension/InsertIESBBeforeException 


// If SCTLR_ELx.IESB is 1 when an exception is generated to ELx, any pending Unrecoverable 
// SError interrupt must be taken before executing any instructions in the exception handler. 
// However, this can be before the branch to the exception handler is made. 

boolean InsertIESBBeforeException(bits(2) el); 


shared/functions/float/fixedtofp/FixedToFP 


// FixedToFP() 
[i === 


// Convert M-bit fixed point OP with FBITS fractional bits to 
// N-bit precision floating point, controlled by UNSIGNED and ROUNDING. 


bits(N) FixedToFP(bits(M) op, integer fbits, boolean unsigned, FPCRType fpcr, FPRounding rounding) 
assert N IN {16,32,64}; 
assert M IN {16,32,64}; 
bits(N) result; 
assert fbits >= 0; 
assert rounding != FPRounding_ODD; 


// Correct signed-ness 
int_operand = Int(op, unsigned); 


// Scale by fractional bits and generate a real value 
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real_operand = Real(int_operand) / 2.QAfbits; 


if real_operand == 0.0 then 
result = FPZero('0'); 
else 
result = FPRound(real_operand, fpcr, rounding); 


return result; 


shared/functions/float/fpabs/F PAbs 


// FPAbs() 
== 


bits(N) FPAbs(bits(N) op) 
assert N IN {16,32,64}; 
return 'Q' : op<N-2:0>; 


shared/functions/float/fpadd/FPAdd 


// FPAdd() 
// ======= 


bits(N) FPAdd(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
rounding = FPRoundingMode(fpcr); 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done, result) = FPProcessNaNs(typel, type2, opl, op2, fpcr); 
if !done then 


infl = (typel == FPType_Infinity); 
zerol = (typel == FPType_Zero); 


inf2 = (type2 == FPType_Infinity); 
zero2 = (type2 == FPType_Zero); 


if infl && inf2 && signl == NOT 


(sign2) then 


result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 





elsif (infl && signl == '0') || (inf2 && sign2 == '@') then 
result = FPInfinity('0'); 
elsif (infl && signl == '1') || (inf2 && sign2 == '1') then 


result = FPInfinity('1'); 
elsif zerol && zero2 && signl == sign2 then 
result = FPZero(sign1); 
else 
result_value = valuel + value2; 
if result_value == 0.0 then // Sign of exact zero result depends on rounding mode 
result_sign = if rounding == FPRounding_NEGINF then '1' else 'Q'; 
result = FPZero(result_sign) ; 
else 
result = FPRound(result_value, fpcr, rounding); 
return result; 


shared/functions/float/fpcompare/FPCompare 


// FPCompare() 
(=== 


bits(4) FPCompare(bits(N) op1, bits(N) op2, boolean signal_nans, FPCRType fpcr) 

assert N IN {16,32,64}; 

(typel,sign1,valuel) = FPUnpack(op1, fpcr); 

(type2,sign2,value2) = FPUnpack(op2, fpcr); 

if typel==FPType_SNaN || typel==FPType_QNaN || type2==FPType_SNaN || type2==FPType_QNaN then 
result = 'Q011'; 
if typel==FPType_SNaN || type2==FPType_SNaN || signal_nans then 

FPProcessException(FPExc_InvalidOp, fpcr); 

else 
// All non-NaN cases can be evaluated on the values produced by FPUnpack() 
if valuel == value2 then 
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result = 'Q110'; 
elsif valuel < value2 then 
result = '1000'; 
else // valuel > value2 
result = '0010'; 
return result; 


shared/functions/float/fpcompareeq/F PCompareEQ 


// FPCompareEQ() 
// ============= 


boolean FPCompareEQ(bits(N) op1, bits(N) op2, FPCRType fpcr) 

assert N IN {16,32,64}; 

(typel,sign1,valuel) = FPUnpack(op1, fpcr); 

(type2,sign2,value2) = FPUnpack(op2, fpcr); 

if typel==FPType_SNaN || typel==FPType_QNaN || type2==FPType_SNaN || type2==FPType_QNaN then 
result = FALSE; 
if typel==FPType_SNaN || type2==FPType_SNaN then 

FPProcessException(FPExc_InvalidOp, fpcr); 

else 
// All non-NaN cases can be evaluated on the values produced by FPUnpack() 
result = (valuel == value2) 

return result; 


shared/functions/float/fpcomparege/F PCompareGE 


// FPCompareGE() 
// ============= 


boolean FPCompareGE(bits(N) op1, bits(N) op2, FPCRType fpcr) 

assert N IN {16,32,64}; 

(typel,signl,valuel) = FPUnpack(op1, fpcr); 

(type2,sign2,value2) = FPUnpack(op2, fpcr); 

if typel==FPType_SNaN || typel==FPType_QNaN || type2==FPType_SNaN || type2==FPType_QNaN then 
result = FALSE; 
FPProcessException(FPExc_InvalidOp, fpcr); 

else 
// All non-NaN cases can be evaluated on the values produced by FPUnpack() 
result = (valuel >= value2) 

return result; 


shared/functions/float/fpcomparegt/FPCompareGT 


// FPCompareGT() 
// ============= 


boolean FPCompareGT(bits(N) op1, bits(N) op2, FPCRType fpcr) 

assert N IN {16,32,64}; 

(typel,sign1,valuel) = FPUnpack(op1, fpcr); 

(type2,sign2,value2) = FPUnpack(op2, fpcr); 

if typel==FPType_SNaN || typel==FPType_QNaN || type2==FPType_SNaN || type2==FPType_QNaN then 
result = FALSE; 
FPProcessException(FPExc_InvalidOp, fpcr); 

else 
// All non-NaN cases can be evaluated on the values produced by FPUnpack() 
result = (valuel > value2); 

return result; 


shared/functions/float/fpconvert/FPConvert 


// FPConvert() 
[i === 


// Convert floating point OP with N-bit precision to M-bit precision, 
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// with rounding controlled by ROUNDING. 
// This is used by the FP-to-FP conversion instructions and so for 
// half-precision data ignores FZ16, but observes AHP. 


bits(M) FPConvert(bits(N) op, FPCRType fpcr, FPRounding rounding) 
assert M IN {16,32,64}; 
assert N IN {16,32,64}; 
bits(M) result; 


// Unpack floating-point operand optionally with flush-to-zero. 
(fptype,sign,value) = FPUnpackCV(op, fpcr); 


alt_hp = (M == 16) && (fpcr.AHP == '1'); 


if fptype == FPType_SNaN || fptype == FPType_QNaN then 
if alt_hp then 
result = FPZero(sign); 
elsif fpcr.DN == '1' then 
result = FPDefaultNaN(); 
else 
result = FPConvertNaN(op); 
if fptype == FPType_SNaN || alt_hp then 
FPProcessException(FPExc_InvalidOp, fpcr) ; 
elsif fptype == FPType_Infinity then 
if alt_hp then 
result = sign:Ones(M-1); 
FPProcessException(FPExc_InvalidOp, fpcr); 
else 
result = FPInfinity(sign); 
elsif fptype == FPType_Zero then 
result = FPZero(sign); 
else 
result = FPRoundCV(value, fpcr, rounding); 
return result; 


// FPConvert() 


bits(M) FPConvert(bits(N) op, FPCRType fpcr) 
return FPConvert(op, fpcr, FPRoundingMode(fpcr)); 


shared/functions/float/fpconvertnan/FPConvertNaN 
// FPConvertNaN() 
// Converts a NaN of one floating-point type to another 


bits(M) FPConvertNaN(bits(N) op) 
assert N IN {16,32,64}; 
assert M IN {16,32,64}; 
bits(M) result; 
bits(51) frac; 


sign = op<N-1>; 


// Unpack payload from input NaN 

case N of 
when 64 frac = op<50:0>; 
when 32 frac = op<21:0>:Zeros(29); 
when 16 frac = op<8:@>:Zeros(42); 


// Repack payload into output NaN, while 
// converting an SNaN to a QNaN. 
case M of 
when 64 result = sign:Ones(M-52):frac; 
when 32 result = sign:Ones(M-23):frac<50:29>; 
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when 16 result = sign:Ones(M-10):frac<50:42>; 


return result; 


shared/functions/float/fpcrtype/FPCRType 


type FPCRType; 


shared/functions/float/fpdecoderm/FPDecodeRM 


// FPDecodeRM() 
// ============ 


// Decode most common AArch32 floating-point rounding encoding. 


FPRounding FPDecodeRM(bits(2) rm) 
case rm of 
when '00' return FPRounding_TIEAWAY; // A 
when '01' return FPRounding_TIEEVEN; // N 
when '10' return FPRounding_POSINF; // P 
when '11' return FPRounding_NEGINF; // M 


shared/functions/float/fpdecoderounding/FPDecodeRounding 


// FPDecodeRounding() 
// ================== 


// Decode floating-point rounding mode and common AArch64 encoding. 


FPRounding FPDecodeRounding(bits(2) rmode) 
case rmode of 
when '00' return FPRounding_TIEEVEN; // N 
when '01' return FPRounding_POSINF; // P 
when '10' return FPRounding_NEGINF; // M 
when '11' return FPRounding_ZERO; //7Z 


shared/functions/float/fpdefaultnan/FPDefaultNaN 


// FPDefaultNaN() 
// ============== 


bits(N) FPDefaultNaN() 
assert N IN {16,32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
constant integer F =N - (E + 1); 
sign = '0'; 
exp = Ones(E); 
frac = '1':Zeros(F-1); 
return sign : exp : frac; 


shared/functions/float/fpdiv/FPDiv 


// FPDiv() 
// ======= 


bits(N) FPDiv(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done, result) = FPProcessNaNs(typel, type2, op1, op2, fpcr); 
if !done then 
infl = (typel == FPType_Infinity); 
inf2 = (type2 == FPType_Infinity); 
zerol = (typel == FPType_Zero); 
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zero2 = (type2 == FPType_Zero); 
if (infl && inf2) || (zerol && zero2) then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 
elsif inf1 || zero2 then 
result = FPInfinity(sign1 EOR sign2); 
if !inf1 then FPProcessException(FPExc_DivideByZero, fpcr); 
elsif zerol || inf2 then 
result = FPZero(sign1 EOR sign2); 
else 
result = FPRound(valuel/value2, fpcr); 
return result; 


shared/functions/float/fpexc/FPExc 


enumeration FPExc {FPExc_InvalidOp, FPExc_DivideByZero, FPExc_Overflow, 
FPExc_Underflow, FPExc_Inexact, FPExc_InputDenorm}; 


shared/functions/float/fpinfinity/FPInfinity 


// FPInfinity() 
// ============ 


bits(N) FPInfinity(bit sign) 
assert N IN {16,32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
constant integer F =N - (E + 1); 
exp = Ones(E); 
frac = Zeros(F); 
return sign : exp : frac; 


shared/functions/float/fpmax/FPMax 


// FPMax() 
// ======= 


bits(N) FPMax(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done, result) = FPProcessNaNs(typel, type2, op1, op2, fpcr); 
if !done then 
if valuel > value2 then 
(fptype,sign,value) = (typel,sign1,valuel) 
else 
(fptype,sign,value) = (type2,sign2,value2); 
if fptype == FPType_Infinity then 
result = FPInfinity(sign); 
elsif fptype == FPType_Zero then 
sign = signl AND sign2; // Use most positive sign 
result = FPZero(sign); 
else 
// The use of FPRound() covers the case where there is a trapped underflow exception 
// for a denormalized number even though the result is exact. 
result = FPRound(value, fpcr); 
return result; 


shared/functions/float/fpmaxnormal/FPMaxNormal 


// FPMaxNormal () 
// ============= 


bits(N) FPMaxNormal(bit sign) 
assert N IN {16, 32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
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constant integer F =N - (E + 1); 
exp = Ones(E-1):'Q'; 

frac = Ones(F); 

return sign : exp : frac; 


shared/functions/float/fpmaxnum/FPMaxNum 


// FPMaxNum() 
(=< 


bits(N) FPMaxNum(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
(typel,-,-) = FPUnpack(op1, fpcr); 
(type2,-,-) = FPUnpack(op2, fpcr); 


// treat a single quiet-NaN as -Infinity 

if typel == FPType_QNaN && type2 != FPType_QNaN then 
op1 = FPInfinity('1') 

elsif typel != FPType_QNaN && type2 == FPType_QNaN then 
op2 = FPInfinity('1'); 


return FPMax(op1, op2, fpcr); 


shared/functions/float/fpmin/FPMin 


// FPMin() 
// ======= 


bits(N) FPMin(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done,result) = FPProcessNaNs(typel, type2, opl, op2, fpcr); 
if !done then 
if valuel < value2 then 
(fptype,sign,value) = (typel,sign1,valuel); 
else 
(fptype,sign,value) = (type2,sign2,value2); 
if fptype == FPType_Infinity then 
result = FPInfinity(sign); 
elsif fptype == FPType_Zero then 
sign = signl OR sign2; // Use most negative sign 
result = FPZero(sign); 
else 


Armv8 Pseudocode 
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// The use of FPRound() covers the case where there is a trapped underflow exception 


// for a denormalized number even though the result is exact. 


result = FPRound(value, fpcr); 
return result; 


shared/functions/float/fpminnum/FPMinNum 


// FPMinNum( ) 
[I === 


bits(N) FPMinNum(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
(typel,-,-) = FPUnpack(op1, fpcr); 
(type2,-,-) = FPUnpack(op2, fpcr); 


// Treat a single quiet-NaN as +Infinity 

if typel == FPType_QNaN && type2 != FPType_QNaN then 
op1 = FPInfinity('0'); 

elsif typel != FPType_QNaN && type2 == FPType_QNaN then 
op2 = FPInfinity('0'); 


return FPMin(opl, op2, fpcr); 
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shared/functions/float/fpmul/FPMul 


// FPMu1() 
// ======= 


bits(N) FPMul(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
(typel,sign1,value1) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done, result) = FPProcessNaNs(typel, type2, op1, op2, fpcr); 
if !done then 
infl = (typel == FPType_Infinity); 
inf2 = (type2 == FPType_Infinity); 
zerol = (typel == FPType_Zero); 
zero2 = (type2 == FPType_Zero); 
if (infl && zero2) || (zerol && inf2) then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 
elsif inf1 || inf2 then 
result = FPInfinity(sign1 EOR sign2); 
elsif zerol || zero2 then 
result = FPZero(sign1 EOR sign2); 
else 
result = FPRound(valuelsvalue2, fpcr); 
return result; 


shared/functions/float/fpmuladd/F PMulAdd 


// FPMulAdd() 


// Calculates addend + oplsxop2 with a single rounding. 


bits(N) FPMulAdd(bits(N) addend, bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
rounding = FPRoundingMode(fpcr); 
(typeA,signA,valueA) = FPUnpack(addend, fpcr); 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
infl = (typel == FPType_Infinity); zerol = (typel == FPType_Zero); 
inf2 = (type2 == FPType_Infinity); zero2 = (type2 == FPType_Zero); 
(done, result) = FPProcessNaNs3(typeA, typel, type2, addend, opl, op2, fpcr); 


if typeA == FPType_QNaN && ((infl && zero2) || (zerol && inf2)) then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 


if !done then 
infA = (typeA == FPType_Infinity); zeroA = (typeA == FPType_Zero); 


// Determine sign and type product will have if it does not cause an Invalid 
// Operation. 

signP = sign1 EOR sign2; 

infP infl || inf2; 

zeroP = zerol || zero2; 


// Non SNaN-generated Invalid Operation cases are multiplies of zero by infinity and 
// additions of opposite-signed infinities. 
if (inf1 && zero2) || (zerol && inf2) || (infA && infP && signA != signP) then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 


// Other cases involving infinities produce an infinity of the same sign. 
elsif (infA && signA == '0') || (infP && signP == '@') then 

result = FPInfinity('0'); 
elsif (infA && signA == '1') || (infP && signP == '1') then 

result = FPInfinity('1'); 
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// Cases where the result is exactly zero and its sign is not determined by the 
// rounding mode are additions of same-signed zeros. 
elsif zeroA && zeroP && signA == signP then 

result = FPZero(signA); 


// Otherwise calculate numerical result and round it. 
else 
result_value = valueA + (valuel « value2); 
if result_value == 0.0 then // Sign of exact zero result depends on rounding mode 
result_sign = if rounding == FPRounding_NEGINF then '1' else 'Q'; 
result = FPZero(result_sign); 
else 
result = FPRound(result_value, fpcr); 


return result; 


shared/functions/float/fpmuladdh/FPMulAddH 


// FPMulAddH() 


bits(N) FPMulAddH(bits(N) addend, bits(N DIV 2) op1, bits(N DIV 2) op2, FPCRType fpcr) 
assert N IN {32,64}; 
rounding = FPRoundingMode(fpcr) ; 
(typeA,signA,valueA) = FPUnpack(addend, fpcr); 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
inf1 = (typel == FPType_Infinity); zerol = (typel == FPType_Zero); 
inf2 = (type2 == FPType_Infinity); zero2 = (type2 == FPType_Zero); 
(done, result) = FPProcessNaNs3H(typeA, typel, type2, addend, op1, op2, fpcr); 
if typeA == FPType_QNaN && ((infl && zero2) || (zerol && inf2)) then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 
if !done then 
infA = (typeA == FPType_Infinity); zeroA = (typeA == FPType_Zero); 
// Determine sign and type product will have if it does not cause an Invalid 
// Operation. 
signP = sign1 EOR sign2; 
infP = infl || inf2; 
zeroP = zerol || zero2; 
// Non SNaN-generated Invalid Operation cases are multiplies of zero by infinity and 
// additions of opposite-signed infinities. 
if (inf1 && zero2) || (zerol && inf2) || (infA && infP && signA != signP) then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 
// Other cases involving infinities produce an infinity of the same sign. 
elsif (infA && signA == '0') || (infP && signP == '@') then 
result = FPInfinity('0'); 
elsif (infA && signA == '1') || (infP && signP == '1') then 
result = FPInfinity('1'); 
// Cases where the result is exactly zero and its sign is not determined by the 
// rounding mode are additions of same-signed zeros. 
elsif zeroA && zeroP && signA == signP then 
result = FPZero(signA); 
// Otherwise calculate numerical result and round it. 
else 
result_value = valueA + (valuel « value2); 
if result_value == 0.0 then // Sign of exact zero result depends on rounding mode 
result_sign = if rounding == FPRounding_NEGINF then '1' else 'Q'; 
result = FPZero(result_sign) ; 
else 
result = FPRound(result_value, fpcr); 
return result; 
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shared/functions/float/fpmuladdh/FPProcessNaNs3H 


// FPProcessNaNs3H 
[I a 


(boolean, bits(N)) 
op2, bits(N DIV 2) 

assert N IN {3 

bits(N) result 


Q 


FPProcessNaNs3H(FPType typel, FPType type2, 
op3, FPCRType fpcr) 
2,64}; 


if typel == FPType_SNaN then 
done = TRUE; result = FPProcessNaN(typel, opl, fpcr); 
elsif type2 == FPType_SNaN then 


done = TRU 
elsif type3 == 
done = TRU 
elsif typel == 
done = TRU 


E; result = FPConvertNaN(FPProcessNaN(type2, 
FPType_SNaN then 

E; result = FPConvertNaN(FPProcessNaN(type3, 
FPType_QNaN then 

E; result = FPProcessNaN(typel, op1, fpcr); 


FPType type3, bits(N) op1, bits(N DIV 2) 


op2, fpcr)); 


op3, fpcr)); 


elsif type2 == FPType_QNaN then 


done = TRUE; result = FPConvertNaN(FPProcessNaN(type2, op2, fpcr)); 


elsif type3 == FPType_QNaN then 





done = TRUE; result = FPConvertNaN(FPProcessNaN(type3, op3, fpcr)); 


else 





done = FALSE; result = Zeros(); // ‘Don't care' result 
return (done, result); 


shared/functions/float/fpmulx/FPMulX 


// FPMu1X() 
(== 


bits(N) FPMulX(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
bits(N) result; 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done, result) = FPProcessNaNs(typel, type2, op1, op2, fpcr); 
if !done then 
infl = (typel == FPType_Infinity); 
inf2 = (type2 == FPType_Infinity); 
zerol = (typel == FPType_Zero); 
zero2 = (type2 == FPType_Zero); 
if (infl && zero2) || (zerol && inf2) then 
result = FPTwo(sign1 EOR sign2); 
elsif inf1 || inf2 then 
result = FPInfinity(sign1 EOR sign2); 
elsif zerol || zero2 then 
result = FPZero(sign1 EOR sign2); 
else 
result = FPRound(valuelsvalue2, fpcr); 
return result; 


shared/functions/float/fpneg/FPNeg 


// FPNeg() 
// ======= 


bits(N) FPNeg(bits(N) op) 
assert N IN {16,32,64}; 
return NOT(op<N-1>) : op<N-2:0>; 
shared/functions/float/fponepointfive/FPOnePointFive 


// FPOnePointFive() 
// ================ 


bits(N) FPOnePointFive(bit sign) 
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assert N IN {16,32,64}; 

constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
constant integer F =N - (E + 1); 

exp = 'Q':Ones(E-1); 

frac = '1':Zeros(F-1); 

return sign : exp : frac; 


shared/functions/float/fpprocessexception/FPProcessException 


// FPProcessException() 

|[ ==================== 

// 

// The 'fpcr' argument supplies FPCR control bits. Status information is 
// updated directly in the FPSR where appropriate. 


FPProcessException(FPExc exception, FPCRType fpcr) 
// Determine the cumulative exception bit number 
case exception of 


when FPExc_Invalid0p cumul = Q; 
when FPExc_DivideByZero cumul = 1; 
when FPExc_Overflow cumul = 2; 
when FPExc_Underflow cumul = 3; 
when FPExc_Inexact cumul = 4 

7 


when FPExc_InputDenorm cumul = 
enable = cumul + 8; 
if fpcr<enable> == '1' then 
// Trapping of the exception enabled. 
// It is IMPLEMENTATION DEFINED whether the enable bit may be set at all, and 
// if so then how exceptions may be accumulated before calling FPTrappedException() 
IMPLEMENTATION_DEFINED "floating-point trap handling"; 
elsif UsingAArch32() then 
// Set the cumulative exception bit 
FPSCR<cumul> = '1'; 
else 
// Set the cumulative exception bit 
FPSR<cumul> = '1'; 
return; 


shared/functions/float/fpprocessnan/FPProcessNaN 


// FPProcessNaN() 
// ============== 


bits(N) FPProcessNaN(FPType fptype, bits(N) op, FPCRType fpcr) 
assert N IN {16,32,64}; 
assert fptype IN {FPType_QNaN, FPType_SNaN}; 


case N of 
when 16 topfrac = 9; 
when 32 topfrac = 22; 
when 64 topfrac = 51; 


result = op; 

if fptype == FPType_SNaN then 
result<topfrac> = '1'; 
FPProcessException(FPExc_InvalidOp, fpcr); 

if fpcr.DN == '1' then // DefaultNaN requested 
result = FPDefaultNaN(); 

return result; 


shared/functions/float/fpprocessnans/FPProcessNaNs 


// FPProcessNaNs() 
// =============== 
// 


// The boolean part of the return value says whether a NaN has been found and 
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// processed. The bits(N) part is only relevant if it has and supplies the 
// result of the operation. 

// 

// The 'fpcr' argument supplies FPCR control bits. Status information is 
// updated directly in the FPSR where appropriate. 


(boolean, bits(N)) FPProcessNaNs(FPType typel, FPType type2, 
bits(N) op1, bits(N) op2, 
FPCRType fpcr) 
assert N IN {16,32,64}; 
if typel == FPType_SNaN then 
done = TRUE; result = FPProcessNaN(typel, op1, fpcr); 
elsif type2 == FPType_SNaN then 
done = TRUE; result = FPProcessNaN(type2, op2, fpcr); 
elsif typel == FPType_QNaN then 
done = TRUE; result = FPProcessNaN(typel, opl, fpcr); 
elsif type2 == FPType_QNaN then 
done = TRUE; result = FPProcessNaN(type2, op2, fpcr); 
else 





done = FALSE; result = Zeros(); // ‘Don't care' result 
return (done, result); 


shared/functions/float/fpprocessnans3/FPProcessNaNs3 
// FPProcessNaNs3() 


[/ ================ 
// 


// The boolean part of the return value says whether a NaN has been found and 


// processed. The bits(N) part is only relevant if it has and supplies the 
// result of the operation. 

// 

// The 'fpcr' argument supplies FPCR control bits. Status information is 
// updated directly in the FPSR where appropriate. 


(boolean, bits(N)) FPProcessNaNs3(FPType typel, FPType type2, FPType type3, 


bits(N) op1, bits(N) op2, bits(N) op3, 
FPCRType fpcr) 
assert N IN {16,32,64}; 
if typel == FPType_SNaN then 
done = TRUE; result = FPProcessNaN(typel, opl, fpcr); 
elsif type2 == FPType_SNaN then 
done = TRUE; result = FPProcessNaN(type2, op2, fpcr); 
elsif type3 == FPType_SNaN then 
done = TRUE; result = FPProcessNaN(type3, op3, fpcr); 
elsif typel == FPType_QNaN then 
done = TRUE; result = FPProcessNaN(typel, op1, fpcr); 
elsif type2 == FPType_QNaN then 
done = TRUE; result = FPProcessNaN(type2, op2, fpcr); 
elsif type3 == FPType_QNaN then 
done = TRUE; result = FPProcessNaN(type3, op3, fpcr); 





else 





done = FALSE; result = Zeros(); // ‘Don't care' result 
return (done, result); 


shared/functions/float/fprecipestimate/FPRecipEstimate 


// FPRecipEstimate() 
// ================= 


bits(N) FPRecipEstimate(bits(N) operand, FPCRType fpcr) 
assert N IN {16,32,64}; 
(fptype,sign,value) = FPUnpack(operand, fpcr); 
if fptype == FPType_SNaN || fptype == FPType_QNaN then 
result = FPProcessNaN(fptype, operand, fpcr); 
elsif fptype == FPType_Infinity then 
result = FPZero(sign); 
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elsif fptype == FPType_Zero then 
result = FPInfinity(sign); 
FPProcessException(FPExc_DivideByZero, fpcr); 
elsif ( 
(N == 16 && Abs(value) < 2.QA-16) || 
(N == 32 && Abs(value) < 2.Q@A-128) || 
(N == 64 && Abs(value) < 2.0A-1024) 
) then 
case FPRoundingMode(fpcr) of 
when FPRounding_TIEEVEN 
overflow_to_inf = TRUE; 
when FPRounding_POSINF 


overflow_to_inf = (sign == '0'); 
when FPRounding_NEGINF 
overflow_to_inf = (sign == '1'); 


when FPRounding_ZERO 
overflow_to_inf = FALSE; 
result = if overflow_to_inf then FPInfinity(sign) else FPMaxNormal(sign) ; 
FPProcessException(FPExc_Overflow, fpcr); 
FPProcessException(FPExc_Inexact, fpcr); 
elsif ((fpcr.FZ == '1' && N != 16) || (fpcr.FZ16 == '1' && N == 16)) 
&& ( 
(N == 16 && Abs(value) >= 2.0414) || 
(N == 32 && Abs(value) >= 2.04126) || 
(N == 64 && Abs(value) >= 2.0A1022) 
) then 
// Result flushed to zero of correct sign 
result = FPZero(sign); 
if UsingAArch32() then 
FPSCR.UFC = '1'; 
else 
FPSR.UFC = '1'; 
else 
// Scale to a fixed point value in the range 0.5 <= x < 1.0 in steps of 1/512, and 
// calculate result exponent. Scaled value has copied sign bit, 
// exponent = 1022 = double-precision biased version of -1, 
// fraction = original fraction 
case N of 
when 16 
fraction = operand<9:Q@> : Zeros(42); 
exp = UInt(operand<14:10>); 
when 32 
fraction = operand<22:0> : Zeros(29); 
exp = UInt(operand<30:23>); 
when 64 
fraction = operand<51:0>; 
exp = UInt(operand<62:52>); 


if exp == @ then 


if fraction<51> == '@' then 

exp = -1; 

fraction = fraction<49:0>:'0Q'; 
else 


fraction = fraction<50:0>:'Q'; 
integer scaled = UInt('1':fraction<51:44>); 


case N of 
when 16 result_exp = 29 - exp; // In range 29-30 = -1 to 29+1 = 30 
when 32 result_exp 253 - exp; // In range 253-254 = -1 to 253+1 = 254 
when 64 result_exp = 2045 - exp; // In range 2045-2046 = -1 to 2045+1 = 2046 


// scaled is in range 256..511 representing a fixed-point number in range [0.5..1.0) 
estimate = RecipEstimate(scaled); 


// estimate is in the range 256..511 representing a fixed point result in the range [1.0..2.0) 
// Convert to scaled floating point result with copied sign bit, 
// high-order bits from estimate, and exponent calculated above. 
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fraction = estimate<7:0> : Zeros(44); 
if result_exp == @ then 

fraction = '1' : fraction<51:b; 
elsif result_exp == -1 then 

fraction = 'Q1' : fraction<51:2>; 

result_exp = Q; 


case N of 
when 16 result = sign : result_exp<N-12:0> : fraction<51:42>; 
when 32 result = sign : result_exp<N-25:0> : fraction<51:29>; 
when 64 result = sign : result_exp<N-54:0> : fraction<51:0>; 


return result; 


shared/functions/float/fprecipestimate/RecipEstimate 


// Compute estimate of reciprocal of 9-bit fixed-point number 


// 


// a is in range 256 .. 511 representing a number in the range 0.5 <= x < 1.0. 


// result is in the range 256 .. 511 representing a number in the range in the range 1.0 to 511/256. 


integer RecipEstimate(integer a) 
assert 256 <= a && a < 512; 
a = ax2+1; // round to nearest 
integer b = (2 A 19) DIV a; 
r = (b+1) DIV 2; // round to nearest 
assert 256 <= r && r < 512; 
return r; 


shared/functions/float/fprecpx/F PRecpX 


// FPRecpX() 


bits(N) FPRecpX(bits(N) op, FPCRType fpcr) 
assert N IN {16,32,64}; 


case N of 
when 16 esize = 5; 
when 32 esize = 8; 
when 64 esize 


1l 
m 
Hm 


bits 
bits 
bits 
bits 


N) result; 

esize) exp; 

esize) max_exp; 
N-(esize+1)) frac = Zeros(); 


nannan 


case N of 
when 16 exp = op<10+esize-1:10>; 
when 32 exp = op<23+esize-1:23>; 
when 64 exp = op<52+esize-1:52>; 


max_exp = Ones(esize) - 1; 


(fptype,sign,value) = FPUnpack(op, fpcr); 
if fptype == FPType_SNaN || fptype == FPType_QNaN then 
result = FPProcessNaN(fptype, op, fpcr); 
else 
if IsZero(exp) then // Zero and denormals 
result = sign:max_exp: frac; 
else // Infinities and normals 
result = sign:NOT(exp):frac; 


return result; 
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shared/functions/float/fpround/FPRound 


// FPRound() 


// Used by data processing and int/fixed <-> FP conversion instructions. 
// For half-precision data it ignores AHP, and observes FZ16. 


bits(N) FPRound(real op, FPCRType fpcr, FPRounding rounding) 
fpcr.AHP = 'Q'; 
return FPRoundBase(op, fpcr, rounding); 


// Convert a real number OP into an N-bit floating-point value using the 
// supplied rounding mode RMODE. 


bits(N) FPRoundBase(real op, FPCRType fpcr, FPRounding rounding) 
assert N IN {16,32,64}; 
assert op != 0.0; 
assert rounding != FPRounding_TIEAWAY; 
bits(N) result; 


// Obtain format parameters - minimum exponent, numbers of exponent and fraction bits. 
if N == 16 then 
minimum_exp = -14; E= 5; F= 10; 
elsif N == 32 then 
minimum_exp = -126; E = 8; F = 23; 
else // N == 64 
minimum_exp = -1022; E=11; F = 52; 


// Split value into sign, unrounded mantissa and exponent. 
if op < 0.0 then 

sign = '1'; mantissa = -op; 
else 

sign = 'Q'; mantissa = op; 
exponent = Q; 
while mantissa < 1.0 do 

mantissa = mantissa » 2.0; exponent = exponent - 1; 
while mantissa >= 2.0 do 

mantissa = mantissa / 2.0; exponent = exponent + 1; 


// Deal with flush-to-zero. 
if ((fpcr.FZ == '1' && N != 16) || (fpcr.FZ16 == '1' && N == 16)) && exponent < minimum_exp then 
// Flush-to-zero never generates a trapped exception 
if UsingAArch32() then 
FPSCR.UFC = '1'; 
else 
FPSR.UFC = '1'; 
return FPZero(sign); 


// Start creating the exponent value for the result. Start by biasing the actual exponent 
// so that the minimum exponent becomes 1, lower values @ (indicating possible underflow). 
biased_exp = Max(exponent - minimum_exp + 1, 0); 

if biased_exp == @ then mantissa = mantissa / 2.0A(minimum_exp - exponent); 


// Get the unrounded mantissa as an integer, and the "units in last place" rounding error. 
int_mant = RoundDown(mantissa « 2.0AF); // < 2.QAF if biased_exp == 0, >= 2.0AF if not 
error = mantissa » 2.QAF - Real(int_mant); 


// Underflow occurs if exponent is too small before rounding, and result is inexact or 

// the Underflow exception is trapped. 

if biased_exp == 0 && (error != 0.0 || fpcr.UFE == '1') then 
FPProcessException(FPExc_Underflow, fpcr); 


// Round result according to rounding mode. 
case rounding of 
when FPRounding_TIEEVEN 
round_up = (error > 0.5 || (error == 0.5 && int_mant<@> == '1')); 
overflow_to_inf = TRUE; 
when FPRounding_POSINF 
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round_up = (error != 0.0 && sign == '0'); 
overflow_to_inf = (sign == '0'); 

when FPRounding_NEGINF 
round_up = (error != 0.0 && sign == '1'); 
overflow_to_inf = (sign == '1'); 

when FPRounding_ZERO, FPRounding_ODD 
round_up = FALSE; 
overflow_to_inf = FALSE; 


if round_up then 
jint_mant = int_mant + 1; 


if int_mant == 2AF then // Rounded up from denormalized to normalized 
biased_exp = 1; 
if int_mant == 2A(F+1) then // Rounded up to next exponent 


biased_exp = biased_exp + 1; | int_mant = int_mant DIV 2; 


// Handle rounding to odd aka Von Neumann rounding 
if error != 0.0 && rounding == FPRounding_ODD then 
int_mant<@> = '1'; 


// Deal with overflow and generate result. 
if N != 16 || fpcr.AHP == '@' then // Single, double or IEEE half precision 
if biased_exp >= 2AE - 1 then 
result = if overflow_to_inf then FPInfinity(sign) else FPMaxNormal(sign) ; 
FPProcessException(FPExc_Overflow, fpcr); 
error = 1.0; // Ensure that an Inexact exception occurs 
else 
result = sign : biased_exp<N-F-2:0> : int_mant<F-1:0>; 
else // Alternative half precision 
if biased_exp >= 2AE then 
result = sign : Ones(N-1); 
FPProcessException(FPExc_InvalidOp, fpcr); 
error = 0.0; // Ensure that an Inexact exception does not occur 
else 
result = sign : biased_exp<N-F-2:0> : int_mant<F-1:0>; 


// Deal with Inexact exception. 
if error != 0.0 then 
FPProcessException(FPExc_Inexact, fpcr); 


return result; 


// FPRound() 


bits(N) FPRound(real op, FPCRType fpcr) 
return FPRound(op, fpcr, FPRoundingMode(fpcr)); 
shared/functions/float/fpround/F PRoundCV 
// FPRoundCVv() 


// Used for FP <-> FP conversion instructions. 
// For half-precision data ignores FZ16 and observes AHP. 


bits(N) FPRoundCV(real op, FPCRType fpcr, FPRounding rounding) 
fpcr.FZ16 = '0'; 
return FPRoundBase(op, fpcr, rounding); 


shared/functions/float/fprounding/FPRounding 
enumeration FPRounding {FPRounding_TIEEVEN, FPRounding_POSINF, 


FPRounding_NEGINF, FPRounding_ZERO, 
FPRounding_TIEAWAY, FPRounding_ODD} ; 
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// FPRoundingMode( ) 
// ================ 


// Return the current floating-point rounding mode. 
FPRounding FPRoundingMode(FPCRType fpcr) 
return FPDecodeRounding(fpcr.RMode) ; 
shared/functions/float/fproundint/FPRoundint 


// FPRoundInt() 
// ============ 


// Round OP to nearest integral floating point value using rounding mode ROUNDING. 


// If EXACT is TRUE, set FPSR.IXC if result is not numerically equal to OP. 


bits(N) FPRoundInt(bits(N) op, FPCRType fpcr, FPRounding rounding, boolean exact) 
assert rounding != FPRounding_ODD; 
assert N IN {16,32,64}; 


// Unpack using FPCR to determine if subnormals are flushed-to-zero 
(fptype,sign,value) = FPUnpack(op, fpcr); 


if fptype == FPType_SNaN || fptype == FPType_QNaN then 
result = FPProcessNaN(fptype, op, fpcr); 
elsif fptype == FPType_Infinity then 
result = FPInfinity(sign); 
elsif fptype == FPType_Zero then 
result = FPZero(sign); 
else 
// extract integer component 
jint_result = RoundDown(value); 
error = value - Real(int_result); 


// Determine whether supplied rounding mode requires an increment 
case rounding of 
when FPRounding_TIEEVEN 
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round_up = (error > 0.5 || (error == 0.5 && int_result<@> == '1')); 


when FPRounding_POSINF 
round_up = (error != 0.0); 
when FPRounding_NEGINF 
round_up = FALSE; 
when FPRounding_ZERO 
round_up = (error != 0.0 && int_result < 0); 
when FPRounding_TIEAWAY 
round_up = (error > 0.5 || (error == 0.5 && int_result >= Q)); 


if round_up then int_result = int_result + 1; 


// Convert integer value into an equivalent real value 
real_result = Real(int_result); 


// Re-encode as a floating-point value, result is always exact 
if real_result == 0.0 then 

result = FPZero(sign); 
else 

result = FPRound(real_result, fpcr, FPRounding_ZERO) ; 


// Generate inexact exceptions 
if error != 0.0 && exact then 


FPProcessException(FPExc_Inexact, fpcr); 


return result; 
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shared/functions/float/fproundintn/FPRoundIntN 


// 
// 


bits(N) FPRoundIntN(bits(N) op, FPCRType fpcr, FPRounding rounding, integer intsize) 


J1-7558 


FPRoundIntN() 


assert rounding != FPRounding_ODD; 
assert N IN {32,64}; 

assert intsize IN {32, 64}; 
integer exp; 
constant integer E 
constant integer F 


(if N == 32 then 8 else 11); 
N - (E + 1); 


// Unpack using FPCR to determine if subnormals are flushed-to-zero 
(fptype,sign,value) = FPUnpack(op, fpcr); 


if fptype IN {FPType_SNaN, FPType_QNaN, FPType_Infinity} then 
if N == 32 then 
exp = 126 + intsize; 
result = '1':exp<(E-1):0>:Zeros(F); 
else 
exp = 1022+intsize; 
result = '1':exp<(E-1):0>:Zeros(F); 
FPProcessException(FPExc_InvalidOp, fpcr); 
elsif fptype == FPType_Zero then 
result = FPZero(sign); 
else 
// Extract integer component 
jnt_result = RoundDown(value); 
error = value - Real(int_result); 


// Determine whether supplied rounding mode requires an increment 
case rounding of 
when FPRounding_TIEEVEN 
round_up = error > 0.5 || (error == 0.5 && int_result<@> == '1'); 
when FPRounding_POSINF 
round_up = error != 0.0; 
when FPRounding_NEGINF 
round_up = FALSE; 
when FPRounding_ZERO 
round_up = error != 0.0 && int_result < 0; 
when FPRounding_TIEAWAY 
round_up = error > 0.5 || (error == 0.5 && int_result >= 0); 


if round_up then int_result = int_result + 1; 


if int_result > 2A(intsize-1)-1 || int_result < -1s2A(intsize-1) then 
if N == 32 then 
exp = 126 + intsize; 
result = '1':exp<(E-1):0>:Zeros(F); 
else 
exp = 1022 + intsize; 
result = '1':exp<(E-1):0>:Zeros(F); 
FPProcessException(FPExc_InvalidOp, fpcr); 
// this case shouldn't set Inexact 
error = 0.0; 


else 
// Convert integer value into an equivalent real value 
real_result = Real(int_result); 


// Re-encode as a floating-point value, result is always exact 
if real_result == 0.0 then 

result = FPZero(sign); 
else 

result = FPRound(real_result, fpcr, FPRounding_ZERO) ; 


// Generate inexact exceptions 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 
Non-Confidential 


ARM DDI 0487E.a 
ID070919 


ARM DDI 0487E.a 
ID070919 


if error != 0.0 then 


FPProcessException(FPExc_Inexact, fpcr); 


return result; 


shared/functions/float/fprsqrtestimate/FPRSqrtEstimate 


// 
// 


bits(N) FPRSqrtEstimate(bits(N) operand, FPCRType fpcr) 


FPRSqrtEstimate() 


assert N IN {16, 32,64}; 
(fptype,sign,value) = FPUnpack(operand, fpcr); 


if fptype == FPType_SNaN || fptype == FPType_QNaN then 


result = FPProcessNaN(fptype, operand, fpcr); 


elsif fptype == FPType_Zero then 
result = FPInfinity(sign); 


FPProcessException(FPExc_DivideByZero, fpcr); 


elsif sign == '1' then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 
elsif fptype == FPType_Infinity then 
result = FPZero('0'); 
else 
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// Scale to a fixed-point value in the range 0.25 <= x < 1.0 in steps of 512, with the 
// evenness or oddness of the exponent unchanged, and calculate result exponent. 
// Scaled value has copied sign bit, exponent = 1022 or 1021 = double-precision 
// biased version of -1 or -2, fraction = original fraction extended with zeros. 


case N of 
when 16 


fraction = operand<9:Q> : Zeros(42); 


exp = UInt(operand<14:10>) ; 
when 32 


fraction = operand<22:0> : Zeros(29); 


exp = UInt(operand<30:23>); 
when 64 

fraction = operand<51:0>; 

exp = UInt(operand<62:52>); 


if exp == @ then 
while fraction<51> == '@' do 
fraction = fraction<50:0> : 'Q'; 
exp = exp - 1; 
fraction = fraction<50:0> : 'Q'; 


if exp<@> == 'Q' then 

scaled = UInt('1':fraction<51:44>); 
else 

scaled = UInt('Q1':fraction<51:45>); 


case N of 


when 16 result_exp = ( 44 - exp) DIV 2; 
when 32 result_exp = ( 380 - exp) DIV 2; 
when 64 result_exp = (3068 - exp) DIV 2; 


estimate = RecipSqrtEstimate(scaled) ; 


// estimate is in the range 256..511 representing a fixed point result in the range [1.0..2.0) 
// Convert to scaled floating point result with copied sign bit and high-order 


// fraction bits, and exponent calculated above. 


case N of 


when 16 result = 'Q' : result_exp<N-12:0> 
when 32 result = 'Q' : result_exp<N-25:0> : 
when 64 result = 'Q' : result_exp<N-54:0> 


return result; 


: estimate<7:@>:Zeros( 2); 


estimate<7:@>:Zeros(15); 


: estimate<7:@>:Zeros(44); 
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shared/functions/float/fprsqrtestimate/RecipSqrtEstimate 


// Compute estimate of reciprocal square root of 9-bit fixed-point number 


// 


// a is in range 128 .. 511 representing a number in the range 0.25 <= x < 1.0. 


// result is in the range 256 .. 511 representing a number in the range in the range 1.0 to 511/256. 


integer RecipSqrtEstimate(integer a) 
assert 128 <= a && a < 512; 
if a < 256 then // 0.25 .. 0.5 
a = ax24+1; // a in units of 1/512 rounded to nearest 
else // 0.5 .. 1.0 
a = (a >> 1) << 1; // discard bottom bit 
a = (a+1)*2; // ain units of 1/256 rounded to nearest 
integer b = 512; 
while ax(b+1)#(b+1) < 2A28 do 
b = b+1; 
// b = largest b such that b < 2A14 / sqrt(a) do 
r = (b+1) DIV 2; // round to nearest 
assert 256 <= r && r < 512; 
return r; 


shared/functions/float/fpsqrt/FPSqrt 


// FPSqrt() 
(== 


bits(N) FPSqrt(bits(N) op, FPCRType fpcr) 

assert N IN {16,32,64}; 

(fptype,sign,value) = FPUnpack(op, fpcr); 

if fptype == FPType_SNaN || fptype == FPType_QNaN then 
result = FPProcessNaN(fptype, op, fpcr); 

elsif fptype == FPType_Zero then 
result = FPZero(sign); 

elsif fptype == FPType_Infinity && sign == 'Q' then 
result = FPInfinity(sign); 

elsif sign == '1' then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 

else 





result = FPRound(Sqrt(value), fpcr); 
return result; 


shared/functions/float/fpsub/FPSub 


// FPSub() 
// ======= 


bits(N) FPSub(bits(N) op1, bits(N) op2, FPCRType fpcr) 
assert N IN {16,32,64}; 
rounding = FPRoundingMode(fpcr); 
(typel,sign1,valuel) = FPUnpack(op1, fpcr); 
(type2,sign2,value2) = FPUnpack(op2, fpcr); 
(done, result) = FPProcessNaNs(typel, type2, op1, op2, fpcr); 
if !done then 
infl = (typel == FPType_Infinity); 
inf2 = (type2 == FPType_Infinity); 
zerol = (typel == FPType_Zero); 
zero2 = (type2 == FPType_Zero); 
if infl && inf2 && signl == sign2 then 
result = FPDefaultNaN(); 
FPProcessException(FPExc_InvalidOp, fpcr); 
elsif (infl && signl == '0') || (inf2 && sign2 == '1') then 
result = FPInfinity('0'); 
elsif (infl && signl == '1') || (inf2 && sign2 == '@') then 
result = FPInfinity('1'); 
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elsif zerol && zero2 && signl == NOT(sign2) then 
result = FPZero(sign1); 
else 
result_value = valuel - value2; 
if result_value == @.0 then // Sign of exact zero result depends on rounding mode 
result_sign = if rounding == FPRounding_NEGINF then '1' else 'Q'; 
result = FPZero(result_sign) ; 
else 
result = FPRound(result_value, fpcr, rounding); 
return result; 


shared/functions/float/fpthree/FPThree 


// FPThree() 
[I === 


bits(N) FPThree(bit sign) 
assert N IN {16,32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
constant integer F =N - (E + 1); 
exp = '1':Zeros(E-1); 
frac = '1':Zeros(F-1); 
return sign : exp : frac; 


shared/functions/float/fptofixed/FPToFixed 


// FPToFixed() 
[I === 


// Convert N-bit precision floating point OP to M-bit fixed point with 
// FBITS fractional bits, controlled by UNSIGNED and ROUNDING. 


bits(M) FPToFixed(bits(N) op, integer fbits, boolean unsigned, FPCRType fpcr, FPRounding rounding) 
assert N IN {16,32,64}; 
assert M IN {16,32,64}; 
assert fbits >= 0; 
assert rounding != FPRounding_ODD; 


// Unpack using fpcr to determine if subnormals are flushed-to-zero 
(fptype,sign,value) = FPUnpack(op, fpcr); 


// If NaN, set cumulative flag or take exception 
if fptype == FPType_SNaN || fptype == FPType_QNaN then 
FPProcessException(FPExc_Invalid0p, fpcr); 


// Scale by fractional bits and produce integer rounded towards minus-infinity 
value = value » 2.0Afbits; 

int_result = RoundDown (value); 

error = value - Real(int_result); 


// Determine whether supplied rounding mode requires an increment 
case rounding of 
when FPRounding_TIEEVEN 
round_up = (error > 0.5 || (error == 0.5 && int_result<@> == '1')); 
when FPRounding_POSINF 
round_up = (error != 0.0); 
when FPRounding_NEGINF 
round_up = FALSE; 
when FPRounding_ZERO 
round_up = (error != 0.0 && int_result < 0); 
when FPRounding_TIEAWAY 
round_up = (error > 0.5 || (error == 0.5 && int_result >= @)); 


if round_up then int_result = int_result + 1; 


// Generate saturated result and exceptions 
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(result, overflow) = SatQ(int_result, M, unsigned); 

if overflow then 
FPProcessException(FPExc_InvalidOp, fpcr); 

elsif error != 0.0 then 
FPProcessException(FPExc_Inexact, fpcr); 


return result; 


shared/functions/float/fptofixedjs/FPToFixedJS 


// FPToFixedJS() 
// ============= 


// Converts a double precision floating point input value 
// to a signed integer, with rounding to zero. 


(bits(N), bit) FPToFixedJS(bits(M) op, FPCRType fpcr, boolean Is64) 
assert M == 64 && N == 32; 


// Unpack using fpcr to determine if subnormals are flushed-to-zero 
(fptype,sign,value) = FPUnpack(op, fpcr); 


Z= '1'; 

// If NaN, set cumulative flag or take exception 

if fptype == FPType_SNaN || fptype == FPType_QNaN then 
FPProcessException(FPExc_InvalidOp, fpcr); 
Z= 'O'; 


int_result = RoundDown(value); 
error = value - Real(int_result); 


// Determine whether supplied rounding mode requires an increment 


round_it_up = (error != 0.0 && int_result < Q); 
if round_it_up then int_result = int_result + 1; 


if int_result < @ then 

result = int_result - 2A32«RoundUp(Real(int_result) /Real (2A32)); 
else 

result = int_result - 2A32«RoundDown(Real(int_result) /Real(2A32)); 


// Generate exceptions 

if int_result < -(2A31) || int_result > (2A31)-1 then 
FPProcessException(FPExc_InvalidOp, fpcr); 
Z= 'Q'; 

elsif error != 0.0 then 
FPProcessException(FPExc_Inexact, fpcr); 


Z = 'Q'; 

elsif sign == '1' && value == 0.0 then 
Z= '0'; 

elsif sign == '0' && value == 0.0 && !IsZero(op<51:0>) then 
Z= "0'3 


if fptype == FPType_Infinity then result = 0; 


return (result<N-1:0>, Z); 


shared/functions/float/fptwo/FPTwo 


// FPTwo() 
// ======= 


bits(N) FPTwo(bit sign) 
assert N IN {16,32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
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constant integer F =N - (E + 1); 
exp = '1':Zeros(E-1); 

frac = Zeros(F); 

return sign : exp : frac; 


shared/functions/float/fptype/FP Type 


enumeration FPType {FPType_Nonzero, FPType_Zero, FPType_Infinity, 
FPType_QNaN, FPType_SNaN}; 


shared/functions/float/fpunpack/F PUnpack 


// FPUnpack() 

// 

// Used by data processing and int/fixed <-> FP conversion instructions. 
// For half-precision data it ignores AHP, and observes FZ16. 


(FPType, bit, real) FPUnpack(bits(N) fpval, FPCRType fpcr) 
fpcr.AHP = 'Q'; 
(fp_type, sign, value) = FPUnpackBase(fpval, fpcr); 
return (fp_type, sign, value); 


shared/functions/float/fpunpack/FPUnpackBase 


// FPUnpackBase() 

// ============== 

// 

// Unpack a floating-point number into its type, sign bit and the real number 
// that it represents. The real number result has the correct sign for numbers 
// and infinities, is very large in magnitude for infinities, and is 0.0 for 
// NaNs. (These values are chosen to simplify the description of comparisons 
// and conversions.) 

// 

// The 'fpcr' argument supplies FPCR control bits. Status information is 

// updated directly in the FPSR where appropriate. 


(FPType, bit, real) FPUnpackBase(bits(N) fpval, FPCRType fpcr) 
assert N IN {16,32,64}; 


if N == 16 then 
sign = fpval<15>; 
expl6 = fpval<14:10>; 
fracl6 = fpval<9:0>; 
if IsZero(exp16) then 
// Produce zero if value is zero or flush-to-zero is selected 
if IsZero(fracl6) || fpcr.FZ16 == '1' then 
fptype = FPType_Zero; value = 0.0; 
else 
fptype = FPType_Nonzero; value = 2.QA-14 « (Real(UInt(fracl6)) » 2.@A-10); 
elsif IsOnes(expl6) && fpcr.AHP == '@' then // Infinity or NaN in IEEE format 
if IsZero(fracl6) then 
fptype = FPType_Infinity; value = 2.0A1000000; 
else 
fptype = if fracl6<9> == '1' then FPType_QNaN else FPType_SNaN; 
value = 0.0; 
else 
fptype = FPType_Nonzero; 
value = 2.QA(UInt(exp16)-15) » (1.0 + Real(UInt(fracl6)) » 2.QA-10); 


elsif N == 32 then 


sign = fpval<31l>; 

exp32 = fpval<30:23>; 
frac32 = fpval<22:0>; 
if IsZero(exp32) then 
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// Produce zero if value is zero or flush-to-zero is selected. 
if IsZero(frac32) || fpcr.FZ == '1' then 
fptype = FPType_Zero; value = 0.0; 
if !IsZero(frac32) then // Denormalized input flushed to zero 
FPProcessException(FPExc_InputDenorm, fpcr); 
else 


fptype = FPType_Nonzero; value = 2.@A-126 « (Real(UInt(frac32)) « 


elsif IsOnes(exp32) then 
if IsZero(frac32) then 





fptype = FPType_Infinity; value = 2.0A1000000; 

else 
fptype = if frac32<22> == '1' then FPType_QNaN else FPType_SNaN; 
value = 0.0; 


else 
fptype = FPType_Nonzero; 
value = 2.0A(UInt(exp32)-127) » (1.0 + Real(UInt(frac32)) » 2.0A-23); 


else // N == 64 


sign = fpval<63>; 
exp64 = fpval<62:52>; 
frac64 = fpval<51:0>; 
if IsZero(exp64) then 
// Produce zero if value is zero or flush-to-zero is selected. 
if IsZero(frac64) || fpcr.FZ == '1' then 
fptype = FPType_Zero; value = 0.0; 
if !IsZero(frac64) then // Denormalized input flushed to zero 
FPProcessException(FPExc_InputDenorm, fpcr); 
else 
fptype = FPType_Nonzero; value = 2.QA-1022 » (Real(UInt(frac64)) 
elsif IsOnes(exp64) then 
if IsZero(frac64) then 
fptype = FPType_Infinity; value = 2.0A1000000; 
else 
fptype = if frac64<51> == '1' then FPType_QNaN else FPType_SNaN; 
value = 0.0; 
else 
fptype = FPType_Nonzero; 
value = 2.QA(UInt(exp64)-1023) « (1.0 + Real(UInt(frac64)) « 2.0A-52); 
if sign == '1' then value = -value; 
return (fptype, sign, value); 


shared/functions/float/fpunpack/FPUnpackCV 


// FPUnpackCVv() 


// Used for FP <-> FP conversion instructions. 
// For half-precision data ignores FZ16 and observes AHP. 


(FPType, bit, real) FPUnpackCV(bits(N) fpval, FPCRType fpcr) 
fpcr.FZ16 = '0'; 
(fp_type, sign, value) = FPUnpackBase(fpval, fpcr); 
return (fp_type, sign, value); 


shared/functions/float/fpzero/FPZero 


// FPZero() 
(== 


bits(N) FPZero(bit sign) 
assert N IN {16,32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
constant integer F =N - (E + 1); 
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exp Zeros(E); 
frac = Zeros(F); 
return sign : exp : frac; 


shared/functions/float/vfpexpandimm/VFPExpandimm 


// VFPExpandImm() 
// ============== 


bits(N) VFPExpandImm(bits(8) imm8) 
assert N IN {16,32,64}; 
constant integer E = (if N == 16 then 5 elsif N == 32 then 8 else 11); 
constant integer F=N-E - 1; 
sign = imm8<7>; 
exp = NOT(imm8<6>) :Replicate(imm8<6>,E-3):imm8<5:4>; 
frac = imm8<3:Q>:Zeros(F-4); 
return sign : exp : frac; 


shared/functions/integer/AddWithCarry 


// AddWithCarry() 
// ============== 


// Integer addition with carry input, returning result and NZCV flags 


(bits(N), bits(4)) AddWithCarry(bits(N) x, bits(N) y, bit carry_in) 
integer unsigned_sum = UInt(x) + UInt(y) + UInt(carry_in); 
integer signed_sum = SInt(x) + SInt(y) + UInt(carry_in); 
bits(N) result = unsigned_sum<N-1:0>; // same value as signed_sum<N-1:0> 
bit n = result<N-1>; 
bit z = if IsZero(result) then '1' else 'Q'; 
bit c = if UInt(result) == unsigned_sum then 'Q' else '1'; 
bit v = if SInt(result) == signed_sum then 'Q' else '1'; 
return (result, n:z:c:v); 


shared/functions/memory/AArch64.BranchAddr 
// AArch64.BranchAddr() 
// Return the virtual address with tag bits removed for storing to the program counter. 


bits(64) AArch64.BranchAddr(bits(64) vaddress) 

assert !UsingAArch32(); 

msbit = AddrTop(vaddress, TRUE, PSTATE.EL); 

if msbit == 63 then 
return vaddress; 

elsif (PSTATE.EL IN {EL@, EL1} || IsInHost()) && vaddress<msbit> == '1' then 
return SignExtend(vaddress<msbit:0>) ; 

else 
return ZeroExtend(vaddress<msbit:Q>) ; 


shared/functions/memory/AccType 


enumeration AccType {AccType_NORMAL, AccType_VEC, // Normal loads and stores 
AccType_STREAM, AccType_VECSTREAM, // Streaming loads and stores 
AccType_ATOMIC, AccType_ATOMICRW, // Atomic loads and stores 
AccType_ORDERED, AccType_ORDEREDRW, // Load-Acquire and Store-Release 


AccType_ORDEREDATOMIC, // Load-Acquire and Store-Release with atomic 
access 
AccType_ORDEREDATOMICRW, 
AccType_LIMITEDORDERED , // Load-LOAcquire and Store-LORelease 
AccType_UNPRIV, // Load and store unprivileged 
AccType_IFETCH, // Instruction fetch 
AccType_PTW, // Page table walk 
AccType_NONFAULT , // Non-faulting loads 
AccType_CNOTFIRST, // Contiguous FF load, not first element 
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AccType_NV2REGISTER, // MRS/MSR instruction used at EL1 and which is 
converted 


// to a memory access that uses the EL2 
translation regime 


// Other operations 


AccType_DC, // Data cache maintenance 

AccType_DC_UNPRIV, // Data cache maintenance instruction used at 
ELO 

AccType_IC, // Instruction cache maintenance 

AccType_DCZVA, // DC ZVA instructions 

AccType_AT}; // Address translation 


shared/functions/memory/AccessDescriptor 


type AccessDescriptor is ( 
AccType acctype, 
MPAMinfo mpam, 
boolean page_table_walk, 
boolean secondstage, 
boolean s2fslwalk, 
integer level 


shared/functions/memory/AddrTop 


// AddrTop() 


// Return the MSB number of a virtual address in the stage 1 translation regime for "el". 
// If EL1 is using AArch64 then addresses from ELO using AArch32 are zero-extended to 64 bits. 


integer AddrTop(bits(64) address, boolean IsInstr, bits(2) el) 
assert HaveEL(el); 
regime = S1TranslationRegime(el); 
if ELUsingAArch32(regime) then 
// AArch32 translation regime. 
return 31; 
else 
// AArch64 translation regime. 
case regime of 
when EL1 
tbi = (if address<55> == '1' then TCR_EL1.TBI1 else TCR_EL1.TBIO); 
if HavePACExt() then 
tbid = if address<55> == '1' then TCR_EL1.TBID1 else TCR_EL1.TBIDO; 
when EL2 
if HaveVirtHostExt() && ELIsInHost(el) then 
tbi = (if address<55> == '1' then TCR_EL2.TBI1 else TCR_EL2.TBIQ); 
if HavePACExt() then 
tbid = if address<55> == '1' then TCR_EL2.TBID1 else TCR_EL2.TBIDO; 
else 
tbi = TCR_EL2.TBI; 
if HavePACExt() then tbid = TCR_EL2.TBID; 
when EL3 
tbi = TCR_EL3.TBI; 
if HavePACExt() then tbid = TCR_EL3.TBID; 


return (if tbi == '1' && (!HavePACExt() || tbid == '@' || !IsInstr ) then 55 else 63); 


shared/functions/memory/AddressDescriptor 


type AddressDescriptor is ( 


FaultRecord fault, // fault.statuscode indicates whether the address is valid 
MemoryAttributes memattrs, 
FullAddress paddress, 
bits(64) vaddress 
) 
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shared/functions/memory/Allocation 


constant bits(2) MemHint_No = '00'; // No Read-Allocate, No Write-Allocate 
constant bits(2) MemHint_WA = 'Q1'; // No Read-Allocate, Write-Allocate 
constant bits(2) MemHint_RA = '10'; // Read-Allocate, No Write-Allocate 
constant bits(2) MemHint_RWA = '11'; // Read-Allocate, Write-Allocate 


shared/functions/memory/BigEndian 


// BigEndian() 
[I === 


boolean BigEndian() 
boolean bigend; 
if UsingAArch32() then 
bigend = (PSTATE.E != 'Q'); 
elsif PSTATE.EL == ELO then 
bigend = (SCTLR[].EQE != '0'); 
else 
bigend = (SCTLR[].EE != '@'); 
return bigend; 


shared/functions/memory/BigEndianReverse 


// BigEndianReverse() 
// ================== 


bits(width) BigEndianReverse (bits(width) value) 
assert width IN {8, 16, 32, 64, 128}; 
integer half = width DIV 2; 
if width == 8 then return value; 
return BigEndianReverse(value<half-1:0>) : BigEndianReverse(value<width-1:half>) ; 


shared/functions/memory/Cacheability 


constant bits(2) MemAttr_NC = '00'; // Non-cacheable 
constant bits(2) MemAttr_WT = '10'; // Write-through 
constant bits(2) MemAttr_WB = '11'; // Write-back 


shared/functions/memory/CreateAccessDescriptor 


// CreateAccessDescriptor() 


// ======================== 


AccessDescriptor CreateAccessDescriptor(AccType acctype) 
AccessDescriptor accdesc; 
accdesc.acctype = acctype; 
accdesc.mpam = GenMPAMcurEL(acctype IN {AccType_IFETCH, AccType_IC}); 
accdesc.page_table_walk = FALSE; 
return accdesc; 


shared/functions/memory/CreateAccessDescriptorPTW 


// CreateAccessDescriptorPTW() 
// e 


AccessDescriptor CreateAccessDescriptorPTW(AccType acctype, boolean secondstage, 
boolean s2fslwalk, integer level) 
AccessDescriptor accdesc; 
accdesc.acctype = acctype; 
accdesc.mpam = GenMPAMcurEL(acctype IN {AccType_IFETCH, AccType_IC}); 
accdesc.page_table_walk = TRUE; 
accdesc.s2fslwalk = s2fslwalk; 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. J1-7567 
ID070919 Non-Confidential 


Armv8 Pseudocode 
J1.3 Shared pseudocode 


accdesc.secondstage = secondstage; 
accdesc. level = level; 
return accdesc; 


shared/functions/memory/DataMemoryBarrier 


DataMemoryBarrier(MBReqDomain domain, MBReqTypes types); 


shared/functions/memory/DataSynchronizationBarrier 


DataSynchronizationBarrier(MBReqDomain domain, MBReqTypes types); 


shared/functions/memory/DescriptorUpdate 


type DescriptorUpdate is ( 
boolean AF, // AF needs to be set 
boolean AP, // AP[2] / S2AP[2] will be modified 
AddressDescriptor descaddr // Descriptor to be updated 


shared/functions/memory/DeviceType 


enumeration DeviceType {DeviceType_GRE, DeviceType_nGRE, DeviceType_nGnRE, DeviceType_nGnRnF} ; 


shared/functions/memory/EffectiveTB| 
// EffectiveTBI() 
// Returns the effective TBI in the AArch64 stage 1 translation regime for "el". 


bit EffectiveTBI(bits(64) address, boolean IsInstr, bits(2) el) 
assert HaveEL(el); 
regime = S1TranslationRegime(el); 
assert(!ELUsingAArch32(regime) ) ; 


case regime of 
when EL1 
tbi = if address<55> == '1' then TCR_EL1.TBI1 else TCR_EL1.TBIO; 
if HavePACExt() then 
tbid = if address<55> == '1' then TCR_EL1.TBID1 else TCR_EL1.TBIDQ; 
when EL2 
if HaveVirtHostExt() && ELIsInHost(el) then 
tbi = if address<55> == '1' then TCR_EL2.TBI1 else TCR_EL2.TBIO; 
if HavePACExt() then 
tbid = if address<55> == '1' then TCR_EL2.TBID1 else TCR_EL2.TBIDQ; 
else 
tbi = TCR_EL2.TBI; 
if HavePACExt() then tbid = TCR_EL2.TBID; 
when EL3 
tbi = TCR_EL3.TBI; 
if HavePACExt() then tbid = TCR_EL3.TBID; 


return (if tbi == '1' && (!HavePACExt() || tbid == '@' || !IsInstr) then '1' else '0'); 


shared/functions/memory/EffectiveTCMA 
// EffectiveTCMA() 
// Returns the effective TCMA of a virtual address in the stage 1 translation regime for "el". 
bit EffectiveTCMA(bits(64) address, bits(2) el) 


assert HaveEL(el); 
regime = S1TranslationRegime(el); 
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tcma = if address<55> == '1' then TCR_EL1.TCMA1 else TCR_EL1.TCMAQ; 


when EL2 


if HaveVirtHostExt() && ELIsInHost(el) then 


tcma = if address<55> == 


else 


tcma = TCR_EL2.TCMA; 


when EL3 


tema = TCR_EL3.TCMA; 


return tcma; 


shared/functions/memory/Fault 


enumeration Fault {Fault_None, 


Fault_AccessFlag, 
Fault_Alignment, 
Fault_Background, 


Fault_Domai 
Fault_Permi 


n, 
ssion, 


Fault_Translation, 
Fault_AddressSize, 
Fault_SyncExternal, 
Fault_SyncExternalOnWalk, 
Fault_SyncParity, 
Fault_SyncParityOnWalk, 
Fault_AsyncParity, 
Fault_AsyncExternal, 
Fault_Debug, 
Fault_TLBConflict, 
Fault_BranchTarget, 
Fault_HwWUpdateAccessFlag, 
Fault_Lockdown, 
Fault_Exclusive, 
Fault_ICacheMaint}; 





1' then TCR_EL2.TCMA1 else TCR_EL2.TCMAQ; 


shared/functions/memory/FaultRecord 


type FaultRecord is (Fault 
AccType 


statuscode, 
acctype, 


// Fault Status 
// Type of access that faulted 


FullAddress ipaddress, // Intermediate physical address 


boolean s2fsilwalk, // Is on a Stage 1 page table walk 
boolean write, // TRUE for a write, FALSE for a read 
integer level, // For translation, access flag and permission faults 
bit extflag, // IMPLEMENTATION DEFINED syndrome for external aborts 
boolean secondstage, // Is a Stage 2 abort 
bits(4) domain, // Domain number, AArch32 only 
bits(2) errortype, // [Armv8.2 RAS] AArch32 AET or AArch64 SET 
bits(4) debugmoe) // Debug method of entry, from AArch32 only 
type PARTIDtype = bits(16); 
type PMGtype = bits(8); 
type MPAMinfo is ( 
bit mpam_ns, 
PARTIDtype partid, 
PMGtype pmg 
) 
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shared/functions/memory/FullAddress 


type FullAddress is ( 
bits(52) address, 
bit NS // '0' = Secure, '1' = Non-secure 


shared/functions/memory/Hint_Prefetch 


// Signals the memory system that memory accesses of type HINT to or from the specified address are 
// likely in the near future. The memory system may take some action to speed up the memory 

// accesses when they do occur, such as pre-loading the the specified address into one or more 

// caches as indicated by the innermost cache level target (@=L1, 1=L2, etc) and non-temporal hint 
// stream. Any or all prefetch hints may be treated as a NOP. A prefetch hint must not cause a 

// synchronous abort due to Alignment or Translation faults and the like. Its only effect on 

// software-visible state should be on caches and TLBs associated with address, which must be 

// accessible by reads, writes or execution, as defined in the translation regime of the current 
// Exception level. It is guaranteed not to access Device memory. 

// A Prefetch_EXEC hint must not result in an access that could not be performed by a speculative 
// instruction fetch, therefore if all associated MMUs are disabled, then it cannot access any 

// memory location that cannot be accessed by instruction fetches. 

Hint_Prefetch(bits(64) address, PrefetchHint hint, integer target, boolean stream); 


shared/functions/memory/MBReqDomain 


enumeration MBReqDomain {MBReqDomain_Nonshareable, MBReqDomain_InnerShareable, 
MBReqDomain_OuterShareable, MBReqDomain_Ful1System}; 


shared/functions/memory/MBReqTypes 


enumeration MBReqTypes {MBReqTypes_Reads, MBReqlypes_Writes, MBReqlypes_Al1}; 


shared/functions/memory/MemAttrHints 
type MemAttrHints is ( 
bits(2) attrs, // See MemAttr_«, Cacheability attributes 


bits(2) hints, // See MemHint_«, Allocation hints 
boolean transient 


shared/functions/memory/MemType 


enumeration MemType {MemType_Normal, MemType_Device}; 


shared/functions/memory/MemoryAttributes 


type MemoryAttributes is ( 


MemType memtype, 

DeviceType device, // For Device memory types 
MemAttrHints inner, // Inner hints and attributes 
MemAttrHints outer, // Outer hints and attributes 
boolean tagged, // Tagged access 

boolean shareable, 

boolean outershareable 


shared/functions/memory/Permissions 


type Permissions is ( 
bits(3) ap, // Access permission bits 
bit xn, // Execute-never bit 
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bit xxn, // [Armv8.2] Extended execute-never bit for stage 2 
bit pxn // Privileged execute-never bit 


shared/functions/memory/PrefetchHint 


enumeration PrefetchHint {Prefetch_READ, Prefetch_WRITE, Prefetch_EXEC}; 


shared/functions/memory/SpeculativeStoreBypassBarrierToPA 


SpeculativeStoreBypassBarrierToPA() ; 


shared/functions/memory/SpeculativeStoreBypassBarrierToVA 


SpeculativeStoreBypassBarrierTovVA(); 


shared/functions/memory/TLBRecord 


type TLBRecord is ( 


Permissions perms, 

bit nG, // '0' = Global, '1' = not Global 

bits(4) domain, // AArch32 only 

bit GP, // Guarded Page 

boolean contiguous, // Contiguous bit from page table 

integer level, // AArch32 Short-descriptor format: Indicates Section/Page 
integer blocksize, // Describes size of memory translated in KBytes 
DescriptorUpdate descupdate, // [Armv8.1] Context for h/w update of table descriptor 
bit CnP, // [Armv8.2] TLB entry can be shared between different PEs 


AddressDescriptor addrdesc 


shared/functions/memory/_Mem 


// These two _Mem[] accessors are the hardware operations which perform single-copy atomic, 
// aligned, little-endian memory accesses of size bytes from/to the underlying physical 

// memory array of bytes. 

// 

// The functions address the array using desc.paddress which supplies: 

// « A 52-bit physical address 

// » A single NS bit to select between Secure and Non-secure parts of the array. 

// 

// The accdesc descriptor describes the access type: normal, exclusive, ordered, streaming, 
// etc and other parameters required to access the physical memory or for setting syndrome 
// register in the event of an external abort. 

bits(8size) _Mem[AddressDescriptor desc, integer size, AccessDescriptor accdesc]; 


_Mem[AddressDescriptor desc, integer size, AccessDescriptor accdesc] = bits(8*size) value; 


shared/functions/mpam/DefaultMPAMinfo 
// DefaultMPAMinfo 


// Returns default MPAM info. If secure is TRUE return default Secure 
// MPAMinfo, otherwise return default Non-secure MPAMinfo. 


MPAMinfo DefaultMPAMinfo(boolean secure) 
MPAMinfo DefaultInfo; 
DefaultInfo.mpam_ns = if secure then '@' else '1'; 
DefaultInfo.partid = DefaultPARTID; 
DefaultInfo.pmg DefaultPMG; 
return DefaultInfo; 
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shared/functions/mpam/DefaultPARTID 


constant PARTIDtype DefaultPARTID = Q<15:0>; 


shared/functions/mpam/DefaultPMG 


constant PMGtype DefaultPMG = 0<7:0>; 


shared/functions/mpam/GenMPAMcurEL 


// GenMPAMcurEL 

// Returns MPAMinfo for the current EL and security state. 

// InD is TRUE instruction access and FALSE otherwise. 

// May be called if MPAM is not implemented (but in an version that supports 
// MPAM), MPAM is disabled, or in AArch32. In AArch32, convert the mode to 

// EL if can and use that to drive MPAM information generation. If mode 

// cannot be converted, MPAM is not implemented, or MPAM is disabled return 

// default MPAM information for the current security state. 


MPAMinfo GenMPAMcurEL(boolean InD) 
bits(2) mpamel; 
boolean validEL; 
boolean secure = IsSecure(); 
if HaveMPAMExt() && MPAMisEnabled() then 
if UsingAArch32() then 
(validEL, mpamel) = ELFromM32(PSTATE.M); 
else 
validEL = TRUE; 
mpamel = PSTATE.EL; 
if validEL then 
return genMPAM(UInt(mpamel), InD, secure); 
return DefaultMPAMinfo(secure) ; 


shared/functions/mpam/MAP_vPARTID 
// MAP_vPARTID 


// Performs conversion of virtual PARTID into physical PARTID 
// Contains all of the error checking and implementation 
// choices for the conversion. 


(PARTIDtype, boolean) MAP_vPARTID(PARTIDtype vpartid) 
// should not ever be called if EL2 is not implemented 
// or is implemented but not enabled in the current 
// security state. 
PARTIDtype ret; 
boolean err; 
integer virt = UInt( vpartid ); 
integer vmprmax = UInt( MPAMIDR_EL1.VPMR_MAX ); 


// vpartid_max is largest vpartid supported 
integer vpartid_max = 4 » vmprmax + 3; 


// One of many ways to reduce vpartid to value less than vpartid_max. 
if virt > vpartid_max then 
virt = virt MOD (vpartid_max+1) ; 


// Check for valid mapping entry. 

if MPAMVPMV_EL2<virt> == '1' then 
// vpartid has a valid mapping so access the map. 
ret = mapvpmw(virt); 
err = FALSE; 


// Is the default virtual PARTID valid? 
elsif MPAMVPMV_EL2<@> == '1' then 
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// Yes, so use default mapping for vpartid == Q. 
ret = MPAMVPMQ_EL2<@ +: 16>; 
err = FALSE; 


// Neither is valid so use default physical PARTID. 
else 

ret = DefaultPARTID; 

err = TRUE; 


// Check that the physical PARTID is in-range. 
// This physical PARTID came from a virtual mapping entry. 
integer partid_max = UInt( MPAMIDR_EL1.PARTID_MAX ); 
if UInt(ret) > partid_max then 
// Out of range, so return default physical PARTID 
ret = DefaultPARTID; 
err = TRUE; 
return (ret, err); 


shared/functions/mpam/MPAMisEnabled 


// MPAMisEnabled 
// ssssssssss=== 
// Returns TRUE if MPAMisEnabled. 


boolean MPAMisEnabled() 
el = HighestEL(); 
case el of 
when EL3 return MPAM3_EL3.MPAMEN == '1'; 
when EL2 return MPAM2_EL2.MPAMEN == '1'; 
when EL1 return MPAM1_EL1.MPAMEN == '1'; 


shared/functions/mpam/MPAMisVirtual 
// MPAMisVirtual 


/ 
// Returns TRUE if MPAM is configured to be virtual at EL. 





boolean MPAMisVirtual(integer el) 
return ( MPAMIDR_EL1.HAS_HCR == '1' && EL2Enabled() && 
( HCR_EL2.E2H == '@' || HCR_EL2.TGE == '@' ) && 
(( el == @ && MPAMHCR_EL2.EL@_VPMEN == '1' ) || 
( el == 1 && MPAMHCR_EL2.EL1_VPMEN == '1'))); 


shared/functions/mpam/genMPAM 
// genMPAM 


// Returns MPAMinfo for exception level el. 

// If InD is TRUE returns MPAM information using PARTID_I and PMG_I fields 

// of MPAMel_ELx register and otherwise using PARTID_D and PMG_D fields. 

// Produces a Secure PARTID if Secure is TRUE and a Non-secure PARTID otherwise. 


MPAMinfo genMPAM(integer el, boolean InD, boolean secure) 
MPAMinfo returnInfo; 
PARTIDtype partidel; 
boolean perr; 
boolean gstplk = (el == @ && EL2Enabled() && 

MPAMHCR_EL2.GSTAPP_PLK == '1' && HCR_EL2.TGE == '@'); 

integer eff_el = if gstplk then 1 else el; 
(partidel, perr) = genPARTID(eff_el, InD); 
PMGtype groupel = genPMG(eff_el, InD, perr); 
returnInfo.mpam_ns = if secure then 'Q' else '1'; 
returnInfo.partid = partidel; 
returnInfo.pmg = groupel; 
return returnInfo; 
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shared/functions/mpam/genMPAMel 
// genMPAMel 


// Returns MPAMinfo for specified EL in the current security state. 
// InD is TRUE for instruction access and FALSE otherwise. 


MPAMinfo genMPAMel(bits(2) el, boolean InD) 
boolean secure = IsSecure(); 
if HaveMPAMExt() && MPAMisEnabled() then 
return genMPAM(UInt(el), InD, secure); 
return DefaultMPAMinfo(secure) ; 


shared/functions/mpam/genPARTID 
// genPARTID 


// Returns physical PARTID and error boolean for exception level el. 
// If InD is TRUE then PARTID is from MPAMel_ELx.PARTID_I and 
// otherwise from MPAMel_ELx.PARTID_D. 


(PARTIDtype, boolean) genPARTID(integer el, boolean InD) 
PARTIDtype partidel = getMPAM_PARTID(el, InD); 


integer partid_max = UInt(MPAMIDR_EL1.PARTID_MAX) ; 
if UInt(partidel) > partid_max then 
return (DefaultPARTID, TRUE); 


if MPAMisVirtual(el) then 

return MAP_vPARTID(partidel); 
else 

return (partidel, FALSE); 


shared/functions/mpam/genPMG 
// genPMG 


// Returns PMG for exception level el and I- or D-side (InD). 
// If PARTID generation (genPARTID) encountered an error, genPMG() should be 
// called with partid_err as TRUE. 


PMGtype genPMG(integer el, boolean InD, boolean partid_err) 
integer pmg_max = UInt(MPAMIDR_EL1.PMG_MAX) ; 


// It is CONSTRAINED UNPREDICTABLE whether partid_err forces PMG to 
// use the default or if it uses the PMG from getMPAM_PMG. 
if partid_err then 
return DefaultPMG; 
PMGtype groupel = getMPAM_PMG(el, InD); 
if UInt(groupel) <= pmg_max then 
return groupel; 
return DefaultPMG; 


shared/functions/mpam/getMPAM_PARTID 
// getMPAM_PARTID 


// Returns a PARTID from one of the MPAMn_ELx registers. 
// MPAMn selects the MPAMn_ELx register used. 

// If InD is TRUE, selects the PARTID_I field of that 
// register. Otherwise, selects the PARTID_D field. 


PARTIDtype getMPAM_PARTID(integer MPAMn, boolean InD) 
PARTIDtype partid; 
boolean el2avail = EL2Enabled(); 
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if InD then 
case MPAMn of 
when 3 partid = MPAM3_EL3.PARTID_I; 
when 2 partid = if el2avail then MPAM2_EL2.PARTID_I else Zeros(); 
when 1 partid = MPAM1_EL1.PARTID_I; 
when @ partid = MPAMQ_EL1.PARTID_I; 
otherwise partid = PARTIDtype UNKNOWN; 


else 
case MPAMn of 
when 3 partid = MPAM3_EL3.PARTID_D; 
when 2 partid = if el2avail then MPAM2_EL2.PARTID_D else Zeros(); 
when 1 partid = MPAM1_EL1.PARTID_D; 
when @ partid = MPAMQ_EL1.PARTID_D; 
otherwise partid = PARTIDtype UNKNOWN; 
return partid; 


shared/functions/mpam/getMPAM_PMG 
// getMPAM_PMG 


// Returns a PMG from one of the MPAMn_ELx registers. 
// MPAMn selects the MPAMn_ELx register used. 

// If InD is TRUE, selects the PMG_I field of that 
// register. Otherwise, selects the PMG_D field. 


PMGtype getMPAM_PMG(integer MPAMn, boolean InD) 
PMGtype pmg; 
boolean el2avail = EL2Enabled(); 


if InD then 
case MPAMn of 
when 3 pmg = MPAM3_EL3.PMG_I; 
when 2 pmg = if el2avail then MPAM2_EL2.PMG_I else Zeros(); 
when 1 pmg = MPAM1_EL1.PMG_I; 
when © pmg = MPAMQ_EL1.PMG_I; 
otherwise pmg = PMGtype UNKNOWN; 
else 
case MPAMn of 
when 3 pmg = MPAM3_EL3.PMG_D; 
when 2 pmg = if el2avail then MPAM2_EL2.PMG_D else Zeros(); 
when 1 pmg = MPAM1_EL1.PMG_D; 
when @ pmg = MPAMQ_EL1.PMG_D; 
otherwise pmg = PMGtype UNKNOWN; 
return pmg; 





shared/functions/mpam/mapvpmw 
// mapvpmw 


// Map a virtual PARTID into a physical PARTID using 

// the MPAMVPMn_EL2 registers. 

// vpartid is now assumed in-range and valid (checked by caller) 
// returns physical PARTID from mapping entry. 


PARTIDtype mapvpmw(integer vpartid) 
bits(64) vpmw; 
integer wd = vpartid DIV 4; 
case wd of 
when @ vpmw = MPAMVPMQ_EL2; 
when 1 vpmw = MPAMVPM1_EL2; 
when 2 vpmw = MPAMVPM2_EL2; 
when 3 vpmw = MPAMVPM3_EL2; 
when 4 vpmw = MPAMVPM4_EL2; 
when 5 vpmw = MPAMVPMS_EL2; 
when 6 vpmw = MPAMVPM6_EL2; 
when 7 vpmw = MPAMVPM7_EL2; 
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otherwise vpmw = Zeros(64); 
// vpme_lsb selects LSB of field within register 
integer vpme_Isb = (vpartid REM 4) » 16; 
return vpmw<vpme_Isb +: 16>; 


shared/functions/registers/BranchTo 


// BranchTo() 
[1 === 


// Set program counter to a new address, with a branch type 
// In AArch64 state the address might include a tag in the top eight bits. 


BranchTo(bits(N) target, BranchType branch_type) 
Hint_Branch(branch_type); 
if N == 32 then 
assert UsingAArch32(); 
_PC = ZeroExtend(target) ; 
else 
assert N == 64 && !UsingAArch32(); 
PC = AArch64.BranchAddr(target<63:0>); 
return; 


shared/functions/registers/BranchToAddr 


// BranchToAddr() 
// ============== 


// Set program counter to a new address, with a branch type 
// In AArch64 state the address does not include a tag in the top eight bits. 


BranchToAddr(bits(N) target, BranchType branch_type) 
Hint_Branch(branch_type); 
if N == 32 then 
assert UsingAArch32(); 
_PC = ZeroExtend(target) ; 
else 
assert N == 64 && !UsingAArch32(); 
-PC = target<63:0>; 
return; 


shared/functions/registers/BranchType 


enumeration BranchType { 


BranchType_DIRCALL, // Direct Branch with link 
BranchType_INDCALL, // Indirect Branch with link 
BranchType_ERET, // Exception return (indirect) 
BranchType_DBGEXIT, // Exit from Debug state 

BranchType_RET, // Indirect branch with function return hint 
BranchType_DIR, // Direct branch 

BranchType_INDIR, // Indirect branch 

BranchType_EXCEPTION, // Exception entry 

BranchType_RESET, // Reset 


BranchType_UNKNOWN} ; // Other 


shared/functions/registers/Hint_Branch 


// Report the hint passed to BranchTo() and BranchToAddr(), for consideration when processing 
// the next instruction. 
Hint_Branch(BranchType hint); 
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shared/functions/registers/NextInstrAddr 
// Return address of the sequentially next instruction. 
bits(N) NextInstrAddr(); 
shared/functions/registers/ResetExternalDebugRegisters 
// Reset the External Debug registers in the Core power domain. 
ResetExternalDebugRegisters(boolean cold_reset) ; 
shared/functions/registers/ThisInstrAddr 
// ThisInstrAddr() 
// Return address of the current instruction. 
bits(N) ThisInstrAddr() 
assert N == 64 || (N == 32 && UsingAArch32()); 
return _PC<N-1:0>; 
shared/functions/registers/_PC 


bits(64) _PC; 


shared/functions/registers/_R 


array bits(64) _R[Q..30]; 


shared/functions/sysregisters/SPSR 


// SPSR[] - non-assignment form 
Jp senmnanmmnnennnneemennennens 


bits(32) SPSR[] 
bits(32) result; 
if UsingAArch32() then 
case PSTATE.M of 


when M32_FIQ result = SPSR_fiq; 
when M32_IRQ result = SPSR_irq; 
when M32_Svc result = SPSR_svc; 


when M32_Monitor result = SPSR_mon; 
when M32_Abort result = SPSR_abt; 


when M32_Hyp result = SPSR_hyp; 
when M32_Undef result = SPSR_und; 
otherwise Unreachable(); 
else 
case PSTATE.EL of 
when EL1 result = SPSR_EL1; 
when EL2 result = SPSR_EL2; 
when EL3 result = SPSR_EL3; 
otherwise Unreachable(); 


return result; 


// SPSR[] - assignment form 
/{ ======================= 


SPSR[] = bits(32) value 
if UsingAArch32() then 
case PSTATE.M of 


when M32_FIQ SPSR_fig = value; 
when M32_IRQ SPSR_irq = value; 
when M32_Svc SPSR_svc = value; 


when M32_Monitor SPSR_mon = value; 
when M32_Abort SPSR_abt = value; 
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when M32_Hyp SPSR_hyp = value; 

when M32_Undef SPSR_und = value; 

otherwise Unreachable(); 
else 

case PSTATE.EL of 

when EL1 SPSR_EL1 = value; 

when EL2 SPSR_EL2 = value; 

when EL3 SPSR_EL3 = value; 

otherwise Unreachable(); 
return; 


shared/functions/system/ArchVersion 


enumeration ArchVersion { 
ARMv8p0 
, ARMv8p1 
, ARMv8p2 
, ARMv8p3 
, ARMv8p4 
, ARMv8p5 
J; 


shared/functions/system/BranchTargetCheck 


// BranchTargetCheck() 


// This function is executed checks if the current instruction is a valid target for a branch 
// taken into, or inside, a guarded page. It is executed on every cycle once the current 
// instruction has been decoded and the values of InGuardedPage and BTypeCompatible have been 


// determined for the current instruction. 


BranchTargetCheck() 
assert HaveBTIExt() && !UsingAArch32(); 


// The branch target check considers two state variables: 
// » InGuardedPage, which is evaluated during instruction fetch. 
// » BTypeCompatible, which is evaluated during instruction decode. 


if InGuardedPage && PSTATE.BTYPE != 'Q0' && !BTypeCompatible && !Halted() then 


bits(64) pc = ThisInstrAddr(); 
AArch64.BranchTargetException(pc<51:0>) ; 


boolean branch_instr = AArch64.ExecutingBROrBLROrRetInstr(); 
boolean bti_instr AArch64.ExecutingBTIInstr(); 





// PSTATE.BTYPE defaults to 00 for instructions that do not explictly set BTYPE. 


if !(branch_instr || bti_instr) then 
BTypeNext = '00'; 


shared/functions/system/ClearEventRegister 
// ClearEventRegister() 
[a 
// Clear the Event Register of this PE 
ClearEventRegister() 
EventRegister = '0'; 
return; 


shared/functions/system/ClearPendingPhysicalSError 


// Clear a pending physical SError interrupt 
ClearPendingPhysicalSError(); 
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// Clear a pending virtual SError interrupt 
ClearPendingVirtualSError(); 


shared/functions/system/ConditionHolds 


// ConditionHolds() 
// sssssssssss===== 
// Return TRUE iff COND currently holds 


boolean ConditionHolds(bits(4) cond) 
// Evaluate base condition. 
case cond<3:1> of 





when '000' result = (PSTATE.Z == '1'); // EQ 
when '001' result = (PSTATE.C == '1'); // CS 
when '010' result = (PSTATE.N == '1'); // MI 
when '011' result = (PSTATE.V == '1'); // NS 
when '100' result = (PSTATE.C == '1' && PSTATE.Z == '0'); // HI 
when '101' result = (PSTATE.N == PSTATE.V); // GE 
when '110' result = (PSTATE.N == PSTATE.V && PSTATE.Z == '0'); // GT 
when '111' result = TRUE; // AL 


// Condition flag values in the set '111x' indicate always true 
// Otherwise, invert condition if necessary. 
if cond<@> == '1' && cond != '1111' then 

result = !result; 


return result; 


shared/functions/system/ConsumptionOfSpeculativeDataBarrier 


ConsumptionOfSpeculativeDataBarrier(); 


shared/functions/system/CurrentinstrSet 


// CurrentInstrSet() 
[i seeanassseanssss 


InstrSet CurrentInstrSet() 


if UsingAArch32() then 
result = if PSTATE.T == '@' then InstrSet_A32 else InstrSet_T32; 


// PSTATE.J is RESO. Implementation of T32EE or Jazelle state not permitted. 


else 
result = InstrSet_A64; 
return result; 


shared/functions/system/CurrentPL 


// CurrentPL() 
// =========== 


PrivilegeLevel CurrentPL() 
return PLOfEL(PSTATE.EL); 


shared/functions/system/ELO 


constant bits(2) EL3 = '11'; 
constant bits(2) EL2 = '10'; 
constant bits(2) EL1 = '@1'; 
constant bits(2) ELO = '00'; 
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NE 
cc 
PL 
VC 
LS 
LT 
LE 
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shared/functions/system/EL2Enabled 


// EL2Enabled() 


// Returns TRUE if EL2 is present and executing 

// - with SCR_EL3.NS==1 when Non-secure EL2 is implemented, or 

// - with SCR_EL3.NS==@ when Secure EL2 is implemented and enabled, or 
// - when EL3 is not implemented. 


boolean EL2Enabled() 
return HaveEL(EL2) && (!HaveEL(EL3) || SCR_EL3.NS == '1' || IsSecureEL2Enabled()); 
shared/functions/system/ELFromM32 


// ELFromM32() 
// =========== 


(boolean,bits(2)) ELFromM32(bits(5) mode) 
// Convert an AArch32 mode encoding to an Exception level. 
// Returns (valid,EL): 


//  'valid' is TRUE if 'mode<4:0>' encodes a mode that is both valid for this implementation 


VAA and the current value of SCR.NS/SCR_EL3.NS. 
// ‘EL is the Exception level decoded from 'mode'. 
bits(2) el; 


boolean valid = !BadMode(mode); // Check for modes that are not valid for this implementati 
case mode of 
when M32_Monitor 


el = EL3; 
when M32_Hyp 
el = EL2; 


valid = valid && (!HaveEL(EL3) || SCR_GEN[].NS == '1') 
when M32_FIQ, M32_IRQ, M32_Svc, M32_Abort, M32_Undef, M32_System 
// If EL3 is implemented and using AArch32, then these modes are EL3 modes in Secure 
// state, and EL1 modes in Non-secure state. If EL3 is not implemented or is using 
// AArch64, then these modes are EL1 modes. 
el = (if HaveEL(EL3) && HighestELUsingAArch32() && SCR.NS == 'Q' then EL3 else EL1); 
when M32_User 
el = ELQ; 
otherwise 
valid = FALSE; // Passed an illegal mode value 
if !valid then el = bits(2) UNKNOWN; 
return (valid, el); 


shared/functions/system/ELFromSPSR 


// ELFromSPSR() 
// ============ 


// Convert an SPSR value encoding to an Exception level. 

// Returns (valid,EL): 

//  'valid' is TRUE if 'spsr<4:0>' encodes a valid mode for the current state. 
//  'EL' is the Exception level decoded from 'spsr' 


(boolean,bits(2)) ELFromSPSR(bits(32) spsr) 





if spsr<4> == 'Q' then // AArch64 state 
el = spsr<3:2>; 
if HighestELUsingAArch32() then // No AArch64 support 
valid = FALSE; 
elsif !HaveEL(el) then // Exception level not implemented 
valid = FALSE; 
elsif spsr<l> == '1' then // M[{1] must be 0 
valid = FALSE; 
elsif el == ELQ && spsr<@> == '1' then // for ELO, M[@] must be Q 
valid = FALSE; 
elsif el == EL2 && HaveEL(EL3) && !IsSecureEL2Enabled() && SCR_EL3.NS == '@' then 
valid = FALSE; // Unless Secure EL2 is enabled, EL2 only valid 
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Non-secure state 
else 
valid = TRUE; 
elsif HaveAnyAArch32() then // AArch32 state 
(valid, el) = ELFromM32(spsr<4:0>); 
else 
valid = FALSE; 


if !valid then el = bits(2) UNKNOWN; 
return (valid,el); 


shared/functions/system/ELIsInHost 


// ELIsInHost() 
/[/ === 


boolean ELIsInHost(bits(2) el) 
return ((IsSecureEL2Enabled() || !IsSecureBelowEL3()) && HaveVirtHostExt() && !ELUsingAArch32(EL2) 
&& 
HCR_EL2.E2H == '1' && (el == EL2 || (el == ELO && HCR_EL2.TGE == '1'))); 


shared/functions/system/ELStateUsingAArch32 


// ELStateUsingAArch32() 
// ===================== 


boolean ELStateUsingAArch32(bits(2) el, boolean secure) 
// See ELStateUsingAArch32K() for description. Must only be called in circumstances where 
// result is valid (typically, that means 'el IN {EL1,EL2,EL3}'). 
(known, aarch32) = ELStateUsingAArch32K(el, secure); 
assert known; 
return aarch32; 


shared/functions/system/ELStateUsingAArch32K 


// ELStateUsingAArch32K() 
// ====================== 


(boolean,boolean) ELStateUsingAArch32K(bits(2) el, boolean secure) 
// Returns (known, aarch32): 
//  'known' is FALSE for ELO if the current Exception level is not ELO and EL1 is 
// using AArch64, since it cannot determine the state of EL@; TRUE otherwise. 
//  'aarch32' is TRUE if the specified Exception level is using AArch32; FALSE otherwise. 
if !HaveAArch32EL(el) then 





return (TRUE, FALSE); // Exception level is using AArch64 
elsif secure && el == EL2 then 
return (TRUE, FALSE); // Secure EL2 is using AArch64 
elsif HighestELUsingAArch32() then 
return (TRUE, TRUE); // Highest Exception level, and therefore all levels 
are using AArch32 
elsif el == HighestEL() then 
return (TRUE, FALSE); // This is highest Exception level, so is using 


AArch64 


// Remainder of function deals with the interprocessing cases when highest Exception level is using 
AArch64 


boolean aarch32 = boolean UNKNOWN; 
boolean known = TRUE; 


aarch32_below_el3 = HaveEL(EL3) && SCR_EL3.RW == '@' && (!secure || !HaveSecureEL2Ext() || 
SCR_EL3.EEL2 == '@'); 
aarch32_at_ell = (aarch32_below_el3 || (HaveEL(EL2) && 
((HaveSecureEL2Ext() && SCR_EL3.EEL2 == '1') || !secure) && 
HCR_EL2.RW == 'Q' && 
!(HCR_EL2.E2H == '1' && HCR_EL2.TGE == '1' && 
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HaveVirtHostExt()))); 


if el == ELO && !aarch32_at_ell then // Only know if EL@ using AArch32 from PSTATE 
if PSTATE.EL == ELO then 
aarch32 = PSTATE.nRW == '1'; // ELO controlled by PSTATE 
else 
known = FALSE; // ELO state is UNKNOWN 
else 


aarch32 = (aarch32_below_el3 && el != EL3) || (aarch32_at_ell && el IN {EL1,ELQ}); 
if !known then aarch32 = boolean UNKNOWN; 
return (known, aarch32); 
shared/functions/system/ELUsingAArch32 


// ELUsingAArch32() 
// ================ 


boolean ELUsingAArch32(bits(2) el) 
return ELStateUsingAArch32(el, IsSecureBelowEL3()); 
shared/functions/system/ELUsingAArch32K 


// ELUsingAArch32K() 
// ================= 


(boolean,boolean) ELUsingAArch32K(bits(2) el) 
return ELStateUsingAArch32K(el, IsSecureBelowEL3()); 

shared/functions/system/EndOfinstruction 

// Terminate processing of the current instruction. 

EndOfInstruction(); 
shared/functions/system/EnterLowPowerState 

// PE enters a low-power state 

EnterLowPowerState(); 
shared/functions/system/EventRegister 


bits(1) EventRegister; 


shared/functions/system/GetPSRFromPSTATE 


// GetPSRFromPSTATE() 
// Return a PSR value which represents the current PSTATE 


bits(32) GetPSRFromPSTATE() 
bits(32) spsr = Zeros(); 
spsr<31:28> = PSTATE.<N,Z,C,V>; 
if HavePANExt() then spsr<22> = PSTATE.PAN; 


spsr<20> = PSTATE.IL; 
if PSTATE.nRW == '1' then // AArch32 state 
spsr<27> = PSTATE.Q; 


spsr<26:25> = PSTATE.IT<1:0>; 

if HaveSSBSExt() then spsr<23> = PSTATE.SSBS; 
if HaveDITExt() then spsr<21> = PSTATE.DIT; 
spsr<19:16> = PSTATE.GE; 

spsr<15:10> = PSTATE.IT<7:2>; 





spsr<9> = PSTATE.E; 
spsr<8:6> = PSTATE.<A,I,F>; // No PSTATE.D in AArch32 state 
spsr<5> = PSTATE.T; 
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assert PSTATE.M<4> == PSTATE.nRW; // bit [4] is the discriminator 
spsr<4:@> = PSTATE.M; 
else // AArch64 state 
if HaveMTEExt() then spsr<25> = PSTATE.TCO; 
if HaveDITExt() then spsr<24> = PSTATE.DIT; 
if HaveUAOExt() then spsr<23> = PSTATE.UAO; 
spsr<21> = PSTATE.SS; 
if HaveSSBSExt() then spsr<12> = PSTATE.SSBS; 
if HaveBTIExt() then spsr<11:10> = PSTATE.BTYPE; 
spsr<9:6> = PSTATE.<D,A,I,F>; 


spsr<4> = PSTATE.nRW; 
spsr<3:2> = PSTATE.EL; 
spsr<Q> = PSTATE.SP; 


return spsr; 


shared/functions/system/HasArchVersion 


// HasArchVersion() 

[a 

// Return TRUE if the implemented architecture includes the extensions defined in the specified 
// architecture version. 


boolean HasArchVersion(ArchVersion version) 
return version == ARMv8p0 || boolean IMPLEMENTATION_DEFINED; 
shared/functions/system/HaveAArch32EL 


// HaveAArch32EL() 


boolean HaveAArch32EL(bits(2) el) 
// Return TRUE if Exception level 'el' supports AArch32 in this implementation 
if !HaveEL(el) then 





return FALSE; // The Exception level is not implemented 
elsif !HaveAnyAArch32() then 
return FALSE; // No Exception level can use AArch32 
elsif HighestELUsingAArch32() then 
return TRUE; // All Exception levels are using AArch32 
elsif el == HighestEL() then 
return FALSE; // The highest Exception level is using AArch64 
elsif el == ELQ then 
return TRUE; // ELO must support using AArch32 if any AArch32 


return boolean IMPLEMENTATION_DEFINED; 


shared/functions/system/HaveAnyAArch32 

// HaveAnyAArch32() 

// Return TRUE if AArch32 state is supported at any Exception level 

boolean HaveAnyAArch32() 

return boolean IMPLEMENTATION_DEFINED; 

shared/functions/system/HaveAnyAArch64 

// HaveAnyAArch64() 

// Return TRUE if AArch64 state is supported at any Exception level 


boolean HaveAnyAArch64() 
return !HighestELUsingAArch32(); 
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shared/functions/system/HaveEL 


// HaveEL() 
// Return TRUE if Exception level 'el' is supported 


boolean HaveEL(bits(2) el) 
if el IN {EL1,ELQ} then 
return TRUE; // EL1 and ELO must exist 
return boolean IMPLEMENTATION_DEFINED; 


shared/functions/system/HaveELUsingSecurityState 
// HaveELUsingSecurityState() 


// Returns TRUE if Exception level 'el' with Security state ‘secure’ is supported, 
// FALSE otherwise. 


boolean HaveELUsingSecurityState(bits(2) el, boolean secure) 


case el of 
when EL3 
assert secure; 
return HaveEL(EL3); 
when EL2 
if secure then 
return HaveEL(EL2) && HaveSecureEL2Ext(); 
else 
return HaveEL(EL2); 
otherwise 
return (HaveEL(EL3) || 
(secure == boolean IMPLEMENTATION_DEFINED "Secure-only implementation") ); 


shared/functions/system/HaveFP16Ext 
// HaveFP16Ext() 
// Return TRUE if FP16 extension is supported 
boolean HaveFP16Ext() 
return boolean IMPLEMENTATION_DEFINED; 
shared/functions/system/HighestEL 
// HighestEL() 
// Returns the highest implemented Exception level. 
bits(2) HighestEL() 
if HaveEL(EL3) then 
return EL3; 
elsif HaveEL(EL2) then 
return EL2; 
else 
return EL1; 
shared/functions/system/HighestELUsingAArch32 
// HighestELUsingAArch32() 
// Return TRUE if configured to boot into AArch32 operation 
boolean HighestELUsingAArch32() 


if !HaveAnyAArch32() then return FALSE; 
return boolean IMPLEMENTATION_DEFINED; // e.g. CFG32SIGNAL == HIGH 


J1-7584 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


Armv8 Pseudocode 
J1.3 Shared pseudocode 


shared/functions/system/Hint_Yield 


Hint_Yield(); 


shared/functions/system/IllegalExceptionReturn 


// T1legalExceptionReturn() 


boolean I]legalExceptionReturn(bits(32) spsr) 


// Check for illegal return: 

//  » To an unimplemented Exception level. 

//  » To EL2 in Secure state, when SecureEL2 is not enabled. 
//  » To ELO using AArch64 state, with SPSR.M[Q]==1. 

//  » To AArch64 state with SPSR.M[1]==1. 

//  » To AArch32 state with an illegal value of SPSR.M. 
(valid, target) = ELFromSPSR(spsr); 

if !valid then return TRUE; 


// Check for return to higher Exception level 
if UInt(target) > UInt(PSTATE.EL) then return TRUE; 


spsr_mode_is_aarch32 = (spsr<4> == '1'); 


// Check for illegal return: 

// » To EL1, EL2 or EL3 with register width specified in the SPSR different from the 
// Execution state used in the Exception level being returned to, as determined by 
// the SCR_EL3.RW or HCR_EL2.RW bits, or as configured from reset. 

// » To ELO using AArch64 state when EL1 is using AArch32 state as determined by the 
// SCR_EL3.RW or HCR_EL2.RW bits or as configured from reset. 

//  » To AArch64 state from AArch32 state (should be caught by above) 

(known, target_el_is_aarch32) = ELUsingAArch32K(target) ; 

assert known || (target == ELO && !ELUsingAArch32(EL1)); 

if known && spsr mode-is-aarch3? != target_el_is_aarch32 then return TRUE; 


// Check for illegal return from AArch32 to AArch64 
if UsingAArch32() && !spsr_mode_is_aarch32 then return TRUE; 


// Check for illegal return to EL1 when HCR.TGE is set and when either of 
// » SecureEL2 is enabled. 
// » SecureEL2 is not enabled and EL1 is in Non-secure state. 
if HaveEL(EL2) && target == EL1 && HCR_EL2.TGE == '1' then 

if (!IsSecureBelowEL3() || IsSecureEL2Enabled()) then return TRUE; 
return FALSE; 


shared/functions/system/InstrSet 


enumeration InstrSet {InstrSet_A64, InstrSet_A32, InstrSet_T32}; 


shared/functions/system/InstructionSynchronizationBarrier 


InstructionSynchronizationBarrier(); 


shared/functions/system/InterruptPending 


// InterruptPending() 


// Return TRUE if there are any pending physical or virtual interrupts, and FALSE otherwise 


boolean InterruptPending() 


return IsPhysicalSErrorPending() || IsVirtualSErrorPending(); 
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shared/functions/system/IsEventRegisterSet 
// IsEventRegisterSet() 
// Return TRUE if the Event Register of this PE is set, and FALSE otherwise 


boolean IsEventRegisterSet() 
return EventRegister == '1'; 


shared/functions/system/IsHighestEL 
// IsHighestEL() 
// Returns TRUE if given exception level is the highest exception level implemented 


boolean IsHighestEL(bits(2) el) 
return HighestEL() == el; 


shared/functions/system/IsInHost 


// IsInHost() 
// ========== 


boolean IsInHost() 
return ELIsInHost(PSTATE.EL); 


shared/functions/system/IsPhysicalSErrorPending 


// Return TRUE if a physical SError interrupt is pending 
boolean IsPhysicalSErrorPending(); 


shared/functions/system/IsSecure 


// IsSecure() 
(=< 


// Returns TRUE if current Exception level is in Secure state. 


boolean IsSecure() 
if HaveEL(EL3) && !UsingAArch32() && PSTATE.EL == EL3 then 
return TRUE; 
elsif HaveEL(EL3) && UsingAArch32() && PSTATE.M == M32_Monitor then 
return TRUE; 
return IsSecureBelowEL3(); 


shared/functions/system/IsSecureBelowEL3 


// IsSecureBelowEL3() 

// ================== 

// Return TRUE if an Exception level below EL3 is in Secure state 

// or would be following an exception return to that level. 

// 

// Differs from IsSecure in that it ignores the current EL or Mode 
// in considering security state. 

// That is, if at AArch64 EL3 or in AArch32 Monitor mode, whether an 
// exception return would pass to Secure or Non-secure state. 


boolean IsSecureBelowEL3() 
if HaveEL(EL3) then 
return SCR_GEN[].NS == 'Q'; 
elsif HaveEL(EL2) && (!HaveSecureEL2Ext() || HighestELUsingAArch32()) then 
// If Secure EL2 is not an architecture option then we must be Non-secure. 
return FALSE; 
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else 
// TRUE if processor is Secure or FALSE if Non-secure. 
return boolean IMPLEMENTATION_DEFINED "Secure-only implementation"; 


shared/functions/system/IsSecureEL2Enabled 
// IsSecureEL2Enabled() 
// Returns TRUE if Secure EL2 is enabled, FALSE otherwise. 


boolean IsSecureEL2Enabled() 
if HaveEL(EL2) && HaveSecureEL2Ext() then 
if HaveEL(EL3) then 
if !ELUsingAArch32(EL3) && SCR_EL3.EEL2 == '1' then 
return TRUE; 
else 
return FALSE; 
else 
return IsSecure(); 
else 
return FALSE; 


shared/functions/system/IsVirtualSErrorPending 


// Return TRUE if a virtual SError interrupt is pending 
boolean IsVirtualSErrorPending(); 


shared/functions/system/Mode_Bits 


constant bits(5) M32_User = '10000'; 
constant bits(5) M32_FIQ = '10001'; 
constant bits(5) M32_IRQ = '10010'; 
constant bits(5) M32_Svc = '10011'; 
constant bits(5) M32_Monitor = '10110'; 
constant bits(5) M32_Abort = '10111'; 
constant bits(5) M32_Hyp = '11010'; 
constant bits(5) M32_Undef = '11011'; 
constant bits(5) M32_System = '11111'; 








shared/functions/system/PLOfEL 


// PLOFEL() 
(== 


PrivilegeLevel PLOfEL(bits(2) el) 
case el of 
when EL3 return if HighestELUsingAArch32() then PL1 else PL3; 
when EL2 return PL2; 
when EL1 return PL1; 
when ELO return PLO; 
shared/functions/system/PSTATE 


ProcState PSTATE; 


shared/functions/system/PrivilegeLevel 


enumeration PrivilegeLevel {PL3, PL2, PL1, PLO}; 
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shared/functions/system/ProcState 


type ProcState is ( 





bits (1) N, // Negative condition flag 

bits (1) Z, // Zero condition flag 

bits (1) C, // Carry condition flag 

bits (1) V, // oVerflow condition flag 

bits (1) D, // Debug mask bit [AArch64 only] 
bits (1) A, // SError interrupt mask bit 

bits (1) I, // IRQ mask bit 

bits (1) F, // FIQ mask bit 

bits (1) PAN, // Privileged Access Never Bit [v8.1] 

bits (1) UAO, // User Access Override [v8.2] 

bits (1) DIT, // Data Independent Timing [v8.4] 

bits (1) TCO, // Tag Check Override [v8.5, AArch64 only] 
bits (2) BTYPE, // Branch Type [v8.5] 

bits (1) SS, // Software step bit 

bits (1) IL, // Illegal Execution state bit 

bits (2) EL, // Exception Level 

bits (1) nRw, // not Register Width: 0=64, 1=32 

bits (1) SP, // Stack pointer select: Q=SP@, 1=SPx [AArch64 only] 
bits (1) Q, // Cumulative saturation flag [AArch32 only] 
bits (4) GE, // Greater than or Equal flags [AArch32 only] 
bits (1) SSBS, // Speculative Store Bypass Safe 

bits (8) IT, // If-then bits, RES@ in CPSR [AArch32 only] 
bits (1) J, // J bit, RESO [AArch32 only, RES@ in SPSR and CPSR] 
bits (1) T, // T32 bit, RESO in CPSR [AArch32 only] 
bits (1) E, // Endianness bit [AArch32 only] 
bits (5) M // Mode field [AArch32 only] 








shared/functions/system/RestoredITBits 
// RestoredITBits() 
// Get the value of PSTATE.IT to be restored on this exception return. 


bits(8) RestoredITBits(bits(32) spsr) 
it = spsr<15:10,26:25>; 


// When PSTATE.IL is set, it is CONSTRAINED UNPREDICTABLE whether the IT bits are each set 


// to zero or copied from the SPSR. 

if PSTATE.IL == '1' then 
if ConstrainUnpredictableBool() then return '00000000'; 
else return it; 


// The IT bits are forced to zero when they are set to a reserved value. 
if !IsZero(it<7:4>) && IsZero(it<3:0>) then 
return 'QQ0000000'; 


// The IT bits are forced to zero when returning to A32 state, or when returning to an EL 
// with the ITD bit set to 1, and the IT bits are describing a multi-instruction block. 


itd = if PSTATE.EL == EL2 then HSCTLR.ITD else SCTLR. ITD; 

if (spsr<5> == '@' && !IsZero(it)) || (itd == '1' && !IsZero(it<2:@>)) then 
return 'Q0000000'; 

else 
return it; 


shared/functions/system/SCRType 


type SCRType; 
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shared/functions/system/SCR_GEN 


// SCR_GEN[] 


SCRType SCR_GEN[] 
// AArch32 secure & AArch64 EL3 registers are not architecturally mapped 
assert HaveEL(EL3); 
bits(64) r; 
if HighestELUsingAArch32() then 
r = ZeroExtend(SCR); 
else 
r = SCR_EL3; 
return r; 


shared/functions/system/SendEvent 


// Signal an event to all PEs in a multiprocessor system to set their Event Registers. 
// When a PE executes the SEV instruction, it causes this function to be executed 
SendEvent(); 


shared/functions/system/SendEventLocal 


// SendEventLocal() 

[j sssssssssss===== 

// Set the local Event Register of this PE. 

// When a PE executes the SEVL instruction, it causes this function to be executed 


SendEventLocal () 
EventRegister = '1'; 
return; 


shared/functions/system/SetPSTATEFromPSR 
// SetPSTATEFromPSR( ) 
// Set PSTATE based on a PSR value 


SetPSTATEFromPSR(bits(32) spsr) 

PSTATE.SS = DebugExceptionReturnSS(spsr) ; 

if I]legalExceptionReturn(spsr) then 
PSTATE.IL = '1'; 
if HaveSSBSExt() then PSTATE.SSBS = bit UNKNOWN; 

else 
// State that is reinstated only on a legal exception return 
PSTATE.IL = spsr<20>; 


if spsr<4> == '1' then // AArch32 state 
AArch32.WriteMode(spsr<4:0>); // Sets PSTATE.EL correctly 
if HaveSSBSExt() then PSTATE.SSBS = spsr<23>; 

else // AArch64 state 
PSTATE.nRW = 'Q'; 


PSTATE.EL = spsr<3:2>; 
PSTATE.SP = spsr<Q@>; 
if HaveSSBSExt() then PSTATE.SSBS = spsr<12>; 


// If PSTATE.IL is set and returning to AArch32 state, it is CONSTRAINED UNPREDICTABLE whether 
// the T bit is set to zero or copied from SPSR. 
if PSTATE.IL == '1' && PSTATE.nRW == '1' then 

if ConstrainUnpredictableBool() then spsr<5> = 'Q'; 


// State that is reinstated regardless of illegal exception return 
PSTATE.<N,Z,C,V> = spsr<31:28>; 
if HavePANExt() then PSTATE.PAN = spsr<22>; 


if PSTATE.nRW == '1' then // AArch32 state 
PSTATE.Q = spsr<27>; 
PSTATE. IT = RestoredITBits(spsr); 
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ShouldAdvanceIT = FALSE; 
if HaveDITExt() then PSTATE.DIT = (if Restarting() then spsr<24> else spsr<21>); 


PSTATE.GE = spsr<19:16>; 
PSTATE.E = spsr<9>; 
PSTATE.<A,I,F> = spsr<8:6>; // No PSTATE.D in AArch32 state 
PSTATE.T = spsr<5>; // PSTATE.J is RESO 
else // AArch64 state 


if HaveMTEExt() then PSTATE.TCO = spsr<25>; 

if HaveDITExt() then PSTATE.DIT = spsr<24>; 

if HaveUAOExt() then PSTATE.UAO = spsr<23>; 

if HaveBTIExt() then PSTATE.BTYPE = spsr<11:10>; 

PSTATE.<D,A,1I,F> = spsr<9:6>; // No PSTATE.<Q,IT,GE,E,T> in AArch64 state 
return; 


shared/functions/system/ShouldAdvancelT 


boolean ShouldAdvancelT; 


shared/functions/system/SpeculationBarrier 


SpeculationBarrier(); 


shared/functions/system/SynchronizeContext 


SynchronizeContext(); 


shared/functions/system/SynchronizeErrors 

// Implements the error synchronization event. 

SynchronizeErrors(); 
shared/functions/system/TakeUnmaskedPhysicalSErrorInterrupts 
// Take any pending unmasked physical SError interrupt 
TakeUnmaskedPhysicalSErrorInterrupts(boolean iesb_req); 
shared/functions/system/TakeUnmaskedSErrorInterrupts 

// Take any pending unmasked physical SError interrupt or unmasked virtual SError 
// interrupt. 

TakeUnmaskedSErrorInterrupts(); 
shared/functions/system/ThisInstr 


bits(32) ThisInstr(); 


shared/functions/system/ThisInstrLength 


integer ThisInstrLength(); 


shared/functions/system/Unreachable 
Unreachable() 
assert FALSE; 
shared/functions/system/UsingAArch32 
// UsingAArch32() 


// Return TRUE if the current Exception level is using AArch32, FALSE if using AArché4. 
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boolean UsingAArch32() 
boolean aarch32 = (PSTATE.nRW == '1'); 
if !HaveAnyAArch32() then assert !aarch32; 
if HighestELUsingAArch32() then assert aarch32; 
return aarch32; 


shared/functions/system/WaitForEvent 
// WaitForEvent() 


// PE suspends its operation and enters a low-power state 
// if the Event Register is clear when the WFE is executed 


WaitForEvent() 
if EventRegister == 'Q@' then 
EnterLowPowerState(); 
return; 


shared/functions/system/WaitForInterrupt 


// WaitForInterrupt() 
// sssssessss======== 
// PE suspends its operation to enter a low-power state 
// until a WFI wake-up event occurs or the PE is reset 


WaitForInterrupt() 
EnterLowPowerState() ; 
return; 


shared/functions/unpredictable/ConstrainUnpredictable 


// Return the appropriate Constraint result to control the caller's behavior. The return value 
// is IMPLEMENTATION DEFINED within a permitted list for each UNPREDICTABLE case. 

// (The permitted list is determined by an assert or case statement at the call site.) 
Constraint ConstrainUnpredictable(); 


shared/functions/unpredictable/ConstrainUnpredictableBits 


// This is a variant of ConstrainUnpredictable for when the result can be Constraint UNKNOWN. 
// If the result is Constraint_UNKNOWN then the function also returns UNKNOWN value, but that 
// value is always an allocated value; that is, one for which the behavior is not itself 

// CONSTRAINED. 

(Constraint,bits(width)) ConstrainUnpredictableBits(); 


shared/functions/unpredictable/ConstrainUnpredictableBool 


// ConstrainUnpredictableBool() 


// This is a simple wrapper function for cases where the constrained result is either TRUE or FALSE. 
boolean ConstrainUnpredictab]eBool () 
c = ConstrainUnpredictable(); 
assert c IN {Constraint_TRUE, Constraint_FALSE}; 
return (c == Constraint_TRUE); 
shared/functions/unpredictable/ConstrainUnpredictablelnteger 
// This is a variant of ConstrainUnpredictable for when the result can be Constraint_UNKNOWN. If 
// the result is Constraint_UNKNOWN then the function also returns an UNKNOWN value in the range 


// low to high, inclusive. 
(Constraint, integer) ConstrainUnpredictableInteger(integer low, integer high); 
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shared/functions/unpredictable/Constraint 


enumeration Constraint {// General 
Constraint_NONE, // Instruction executes with 
// no change or side-effect to its described 


behavior 
Constraint_UNKNOWN, // Destination register has UNKNOWN value 
Constraint_UNDEF, // Instruction is UNDEFINED 
Constraint_UNDEFEL®, // Instruction is UNDEFINED at EL@ only 
Constraint_NOP, // Instruction executes as NOP 


Constraint_TRUE, 

Constraint_FALSE, 

Constraint_DISABLED, 

Constraint_UNCOND, // Instruction executes unconditionally 
Constraint_COND, // Instruction executes conditionally 
Constraint_ADDITIONAL_DECODE, // Instruction executes with additional decode 
// Load-store 

Constraint_WBSUPPRESS, Constraint_FAULT, 

// IPA too large 

Constraint_FORCE, Constraint_FORCENOSLCHECK}; 


shared/functions/vector/AdvSIMDExpandiImm 


// AdvSIMDExpandImm() 


bits(64) AdvSIMDExpandImm(bit op, bits(4) cmode, bits(8) imm8) 
case cmode<3:1> of 





when '000' 
imm64 = Replicate(Zeros(24):imm8, 2); 
when 'QQ1' 
imm64 = Replicate(Zeros(16):imm8:Zeros(8), 2); 
when '010' 
imm64 = Replicate(Zeros(8):imm8:Zeros(16), 2); 
when '011' 
imm64 = Replicate(imm8:Zeros(24), 2); 
when '100' 
imm64 = Replicate(Zeros(8):imm8, 4); 
when '101' 
imm64 = Replicate(imm8:Zeros(8), 4); 
when '110' 
if cmode<@> == 'Q' then 


imm64 = Replicate(Zeros(16):imm8:Ones(8), 2); 
else 
imm64 = Replicate(Zeros(8):imm8:Ones(16), 2); 
when '111' 
if cmode<@> == 'Q' && op == 'Q' then 
imm64 = Replicate(imm8, 8); 
if cmode<@> == 'Q' && op == '1' then 
imm8a = Replicate(imm8<7>, 8); imm8b = Replicate(imm8<6>, 8); 
imm8c = Replicate(imm8<5>, 8); imm8d = Replicate(imm8<4>, 8); 
imm8e = Replicate(imm8<3>, 8); imm8f = Replicate(imm8<2>, 8); 
imm8g = Replicate(imm8<1>, 8); imm8h = Replicate(imm8<0>, 8); 
imm64 = imm8a:imm8b:imm8c:imm8d: imm8e: imm8f: imm&g: imm8h; 
if cmode<@> == '1' && op == 'Q' then 
imm32 = imm8<7>:NOT(imm8<6>) :Replicate(imm8<6>,5):imm8<5:Q>:Zeros(19); 
imm64 = Replicate(imm32, 2); 
if cmode<@> == '1' && op == '1' then 
if UsingAArch32() then ReservedEncoding(); 
imm64 = imm8<7>:NOT(imm8<6>) :Replicate(imm8<6>, 8): imm8<5:Q>:Zeros(48); 








return imm64; 
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shared/functions/vector/PolynomialMult 


// PolynomialMult() 
// ================ 


bits(M+N) PolynomialMult(bits(M) op1, bits(N) op2) 
result = Zeros(M4N); 
extended_op2 = ZeroExtend(op2, M+N); 
for i=0 to M-1 
if opl<i> == '1' then 
result = result EOR LSL(extended_op2, i); 
return result; 


shared/functions/vector/SatQ 


// SatQ) 
// ====== 


(bits(N), boolean) SatQ(integer i, integer N, boolean unsigned) 
(result, sat) = if unsigned then UnsignedSatQ(i, N) else SignedSatQ(i, N); 
return (result, sat); 


shared/functions/vector/SignedSatQ 


// SignedSatQ() 
Jh aea 


(bits(N), boolean) SignedSatQ(integer i, integer N) 

if i > 2A(N-1) - 1 then 

result = 2A(N-1) - 1; saturated = TRUE; 
elsif i < -(2A(N-1)) then 

result = -(2A(N-1)); saturated = TRUE; 
else 

result = i; saturated = FALSE; 
return (result<N-1:0>, saturated); 


shared/functions/vector/UnsignedRSqrtEstimate 


// UnsignedRSqrtEstimate() 
JI ee 


bits(N) UnsignedRSqrtEstimate(bits(N) operand) 
assert N IN {16,32}; 
if operand<N-1:N-2> == '@@' then // Operands <= Qx3FFFFFFF produce OxFFFFFFFF 
result = Ones(N); 
else 
// input is in the range 0x40000000 .. Oxffffffff representing [0.25 .. 1.0) 


// estimate is in the range 256 .. 511 representing [1.0 .. 2.0) 
case N of 
when 16 estimate = RecipSqrtEstimate(UInt(operand<15:7>)); 
when 32 estimate = RecipSqrtEstimate(UInt(operand<31:23>)); 


// result is in the range 0x80000000 .. Oxff800000 representing [1.0 .. 2.0) 
result = estimate<8:0> : Zeros(N-9); 


return result; 


shared/functions/vector/UnsignedRecipEstimate 


// UnsignedRecipEstimate() 
p ee eee 


bits(N) UnsignedRecipEstimate(bits(N) operand) 
assert N IN {16,32}; 
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if operand<N-1> == '@' then // Operands <= Qx7FFFFFFF produce @xFFFFFFFF 
result = Ones(N); 

else 
// input is in the range 0x80000000 .. Oxffffffff representing [0.5 .. 1.0) 


// estimate is in the range 256 to 511 representing [1.0 .. 2.0) 
case N of 

when 16 estimate = RecipEstimate(UInt(operand<15:7>)); 

when 32 estimate = RecipEstimate(UInt(operand<31:23>)); 


// result is in the range @x80000000 .. Oxff800000 representing [1.0 .. 2.0) 
result = estimate<8:0> : Zeros(N-9); 


return result; 


shared/functions/vector/UnsignedSatQ 


// UnsignedSatQ() 
// ============== 


(bits(N), boolean) UnsignedSatQ(integer i, integer N) 
if i > 2AN - 1 then 
result = 2AN - 1; saturated = TRUE; 
elsif i < 0 then 
result = 0; saturated = TRUE; 
else 
result = i; saturated = FALSE; 
return (result<N-1:0>, saturated); 


J1.3.4 shared/trace 


This section includes the following pseudocode functions: 

$ shared/trace/selfhosted/SelfHostedTraceEnabled. 

s shared/trace/selfhosted/TraceAllowed. 

° shared/trace/selfhosted/TraceContextIDR2 on page J1-7595. 

à shared/trace/selfhosted/TraceSynchronizationBarrier on page J1-7595. 
° shared/trace/selfhosted/TraceTimeStamp on page J1-7595. 


shared/trace/selfhosted/SelfHostedTraceEnabled 
// SelfHostedTraceEnabled() 
// Returns TRUE if Self-hosted Trace is enabled. 


boolean SelfHostedTraceEnabled() 
if !HaveTraceExt() || !HaveSelfHostedTrace() then return FALSE; 
if HaveEL(EL3) then 
secure_trace_enable = (if ELUsingAArch32(EL3) then SDCR.STE else MDCR_EL3.STE); 
niden = (secure_trace_enable == 'Q' || ExternalSecureNoninvasiveDebugEnabled()); 
else 


// If no EL3, IsSecure() returns the Effective value of (SCR_EL3.NS == 'Q') 
niden = (!IsSecure() || ExternalSecureNoninvasiveDebugEnabled()); 
return (EDSCR.TFO == 'Q' || !niden); 


shared/trace/selfhosted/TraceAllowed 


// TraceAllowed() 
// ============== 


// Returns TRUE if Self-hosted Trace is allowed in the current Security state and Exception Level 


boolean TraceAllowed() 
if !HaveTraceExt() then return FALSE; 
if SelfHostedTraceEnabled() then 
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if IsSecure() && HaveEL(EL3) then 
secure_trace_enable = (if ELUsingAArch32(EL3) then SDCR.STE else MDCR_EL3.STE); 
if secure_trace_enable == '@' then return FALSE; 


TGE_bit = if EL2Enabled() then HCR_EL2.TGE else 'Q'; 
case PSTATE.EL of 
when EL3 TRE_bit = if HighestELUsingAArch32() then TRFCR.E1TRE else 'Q'; 
when EL2 TRE_bit = TRFCR_EL2.E2TRE; 
when EL1 TRE_bit = TRFCR_EL1.E1TRE; 
when ELO TRE_bit = if TGE_bit == '1' then TRFCR_EL2.EQHTRE else TRFCR_EL1.EQTRE; 
return TRE_bit == '1'; 
else 
return (!IsSecure() || ExternalSecureNoninvasiveDebugEnabled()); 


shared/trace/selfhosted/TraceContextIDR2 


// TraceContextIDR2() 
| =================- 


boolean TraceContextIDR2() 
if !TraceAllowed()|| !HaveEL(EL2) then return FALSE; 
return (!SelfHostedTraceEnabled() || TRFCR_EL2.CX == '1'); 


shared/trace/selfhosted/TraceSynchronizationBarrier 


// Memory barrier instruction that preserves the relative order of memory accesses to System 
// registers due to trace operations and other memory accesses to the same registers 
TraceSynchronizationBarrier(); 


shared/trace/selfhosted/TraceTimeStamp 


// TraceTimeStamp() 
// ================ 


TimeStamp TraceTimeStamp() 
if SelfHostedTraceEnabled() then 
if HaveEL(EL2) then 

TS_el2 = TRFCR_EL2.TS; 

if TS_el2 == '10' then (-, TS_el2) = ConstrainUnpredictableBits(); // Reserved value 

case TS_el2 of 
when '@Q' /» falls through to check TRFCR_EL1.TS «/ 
when '01' return TimeStamp_Virtual; 
when '11' return TimeStamp_Physical; 


otherwise Unreachable(); // ConstrainUnpredictableBits removes this case 
TS_ell = TRFCR_EL1.TS; 
if TS_ell == 'x@' then (-, TS_el1) = ConstrainUnpredictableBits(); // Reserved values 


case TS_ell of 
when 'Q1' return TimeStamp_Virtual; 
when '11' return TimeStamp_Physical; 
otherwise Unreachable(); // ConstrainUnpredictableBits removes this case 
else 
return TimeStamp_CoreSight; 


J1.3.5 shared/translation 


This section includes the following pseudocode functions: 

° shared/translation/attrs/CombineS1S2AttrHints on page J1-7596. 
° shared/translation/attrs/CombineS1S2Desc on page J1-7596. 

. shared/translation/attrs/CombineS1S2Device on page J1-7597. 

° shared/translation/attrs/LongConvertAttrsHints on page J1-7598. 
$ shared/translation/attrs/MemAttrDefaults on page J1-7598. 

. shared/translation/attrs/S1CacheDisabled on page J1-7598. 
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° shared/translation/attrs/S2AttrDecode on page J1-7599. 
° shared/translation/attrs/S2CacheDisabled on page J1-7599. 
° shared/translation/attrs/S2ConvertAttrs Hints on page J1-7599. 


. shared/translation/attrs/ShortConvertAttrsHints on page J1-7600. 
. shared/translation/attrs/WalkAttrDecode on page J1-7600. 
$ shared/translation/translation/HasS2Translation on page J1-7601. 


. shared/translation/translation/Have16bitVMID on page J1-7601. 

s shared/translation/translation/PAMax on page J1-7601. 

$ shared/translation/translation/S1 TranslationRegime on page J1-7601. 
$ shared/translation/translation/VAMax on page J1-7601. 


shared/translation/attrs/CombineS1S2AttrHints 

// CombineS1S2AttrHints() 

_ Combines cacheability attributes and allocation hints from stage 1 and stage 2 

MemAttrHints CombineS1S2AttrHints(MemAttrHints sldesc, MemAttrHints s2desc) 
MemAttrHints result; 


apply_force_writeback = HaveStage2MemAttrControl() && HCR_EL2.FWB == '1'; 


if apply_force_writeback then 


if s2desc.attrs == '11' then 
result.attrs = sldesc.attrs; 
elsif s2desc.attrs == '10' then 
result.attrs = MemAttr_WB; // force Write-back 
else 
result.attrs = MemAttr_NC; 
else 
if s2desc.attrs == 'Q1' || sldesc.attrs == '01' then 


result.attrs = bits(2) UNKNOWN; // Reserved 
elsif s2desc.attrs == MemAttr_NC || sldesc.attrs == MemAttr_NC then 


result.attrs = MemAttr_NC; // Non-cacheable 

elsif s2desc.attrs == MemAttr_WT || sldesc.attrs == MemAttr_WT then 
result.attrs = MemAttr_WT; // Write-through 

else 
result.attrs = MemAttr_WB; // Write-back 


if HaveStage2MemAttrControl() && HCR_EL2.FWB == '1' then 
if sldesc.attrs != MemAttr_NC && result.attrs != MemAttr_NC then 
result.hints = sldesc.hints; 
elsif sldesc.attrs == MemAttr_NC && result.attrs != MemAttr_NC then 
result.hints = MemHint_RWA; 








else 
result.hints = sldesc.hints; 
result.transient = sldesc.transient; 


return result; 


shared/translation/attrs/CombineS1S2Desc 


// CombineS1S2Desc() 





// Combines the address descriptors from stage 1 and stage 2 
AddressDescriptor CombineS1S2Desc(AddressDescriptor sldesc, AddressDescriptor s2desc) 
AddressDescriptor result; 


result.paddress = s2desc.paddress; 
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apply_force_writeback = HaveStage2MemAttrControl() && HCR_EL2.FWB == '1'; 


if IsFault(sldesc) || IsFault(s2desc) then 
result = if IsFault(sldesc) then sldesc else s2desc; 
else 
result.fault = NSPACE(NoFault) () 
if s2desc.memattrs.memtype == MemType_Device || ( 
(apply_force_writeback && sldesc.memattrs.memtype == MemType_Device && 
s2desc.memattrs.inner.attrs != '10') || 
(!apply_force_writeback && sldesc.memattrs.memtype == MemType_Device) ) then 
result.memattrs.memtype = MemType_Device; 
if sldesc.memattrs.memtype == MemType_Normal then 
result.memattrs.device = s2desc.memattrs.device; 
elsif s2desc.memattrs.memtype == MemType_Normal then 
result.memattrs.device = sldesc.memattrs.device; 
else // Both Device 
result.memattrs.device = CombineS1S2Device(sldesc.memattrs.device, 
s2desc.memattrs.device); 
result.memattrs.tagged = FALSE; 
else 
result.memattrs.memtype = MemType_Normal; 
result.memattrs.device = DeviceType UNKNOWN; 
if apply_force_writeback then 
if s2desc.memattrs.memtype == MemType_Normal && s2desc.memattrs.inner.attrs == '10' then 
result.memattrs.inner.attrs = MemAttr_WB; // force Write-back 
elsif s2desc.memattrs.inner.attrs == '11' then 
result.memattrs.inner.attrs = sldesc.memattrs.inner.attrs; 
else 
result.memattrs.inner.attrs = MemAttr_NC; 
result.memattrs.outer = result.memattrs. inner; 
else 
result.memattrs.inner = CombineS1S2AttrHints(sldesc.memattrs.inner, 
s2desc.memattrs.inner); 
result.memattrs.outer = CombineS1S2AttrHints(sldesc.memattrs.outer, 
s2desc.memattrs.outer); 
result.memattrs.shareable = (sldesc.memattrs.shareable || s2desc.memattrs.shareable); 
result.memattrs.outershareable = (sldesc.memattrs.outershareable | | 
s2desc.memattrs.outershareable); 
result.memattrs.tagged = (sldesc.memattrs.tagged && 
result.memattrs.inner.attrs == MemAttr_WB && 
result.memattrs.inner.hints == MemHint_RWA && 
result.memattrs.outer.attrs == MemAttr_WB && 
result.memattrs.outer.hints == MemHint_RWA); 


result.memattrs = MemAttrDefaults(result.memattrs); 


return result; 


shared/translation/attrs/CombineS1S2Device 
// CombineS1S2Device() 
// Combines device types from stage 1 and stage 2 
DeviceType CombineS1S2Device(DeviceType sldevice, DeviceType s2device) 


if s2device == DeviceType_nGnRnE || sldevice == DeviceType_nGnRnE then 
result = DeviceType_nGnRnE; 

elsif s2device == DeviceType_nGnRE || sldevice == DeviceType_nGnRE then 
result = DeviceType_nGnRE; 

elsif s2device == DeviceType_nGRE || sldevice == DeviceType_nGRE then 
result = DeviceType_nGRE; 

else 
result = DeviceType_GRE; 


return result; 
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shared/translation/attrs/LongC onvertAttrsHints 
// LongConvertAttrsHints() 


// Convert the long attribute fields for Normal memory as used in the MAIR fields 
// to orthogonal attributes and hints 


MemAttrHints LongConvertAttrsHints(bits(4) attrfield, AccType acctype) 
assert !IsZero(attrfield); 
MemAttrHints result; 
if S1CacheDisabled(acctype) then // Force Non-cacheable 
result.attrs = MemAttr_NC; 
result.hints = MemHint_No; 
else 
if attrfield<3:2> == '00' then // Write-through transient 
result.attrs = MemAttr_WT; 
result.hints = attrfield<1:0>; 
result.transient = TRUE; 
elsif attrfield<3:0> == '0100' then // Non-cacheable (no allocate) 
result.attrs = MemAttr_NC; 
result.hints = MemHint_No; 
result.transient = FALSE; 
elsif attrfield<3:2> == 'Q1' then // Write-back transient 
result.attrs = MemAttr_WB; 
result.hints = attrfield<1:0>; 
result.transient = TRUE; 
else // Write-through/Write-back non-transient 
result.attrs = attrfield<3:2>; 
result.hints = attrfield<1:0>; 
result.transient = FALSE; 





return result; 


shared/translation/attrs/MemAttrDefaults 
// MemAttrDefaults() 


// Supply default values for memory attributes, including overriding the shareability attributes 
// for Device and Non-cacheable memory types. 


MemoryAttributes MemAttrDefaults(MemoryAttributes memattrs) 


if memattrs.memtype == MemType_Device then 
memattrs.inner = MemAttrHints UNKNOWN; 
memattrs.outer = MemAttrHints UNKNOWN; 
memattrs.shareable = TRUE; 
memattrs.outershareable = TRUE; 
else 
memattrs.device = DeviceType UNKNOWN; 
if memattrs.inner.attrs == MemAttr_NC && memattrs.outer.attrs == MemAttr_NC then 
memattrs.shareable = TRUE; 
memattrs.outershareable = TRUE; 


return memattrs; 


shared/translation/attrs/S1CacheDisabled 


// S1CacheDisabled() 


boolean S1CacheDisabled(AccType acctype) 
if ELUsingAArch32(S1TranslationRegime()) then 
if PSTATE.EL == EL2 then 
enable = if acctype == AccType_IFETCH then HSCTLR.I else HSCTLR.C; 
else 
enable = if acctype == AccType_IFETCH then SCTLR.I else SCTLR.C; 
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else 
enable = if acctype == AccType_IFETCH then SCTLR[].I else SCTLR[].C; 
return enable == 'Q'; 


shared/translation/attrs/S2AttrDecode 
// S2AttrDecode() 
// Converts the Stage 2 attribute fields into orthogonal attributes and hints 
MemoryAttributes S2AttrDecode(bits(2) SH, bits(4) attr, AccType acctype) 
MemoryAttributes memattrs; 
apply_force_writeback = HaveStage2MemAttrControl() && HCR_EL2.FWB == '1'; 
// Device memory 
if (apply_force_writeback && attr<2> == '0') || attr<3:2> == '00' then 
memattrs.memtype = MemType_Device; 
case attr<1:0> of 
when 'QQ' memattrs.device = DeviceType_nGnRnE; 
when '01' memattrs.device = DeviceType_nGnRE; 


when '10' memattrs.device = DeviceType_nGRE; 
when '11' memattrs.device = DeviceType_GRE; 


// Normal memory 
elsif apply_force_writeback then 
if attr<2> == '1' then 
memattrs.memtype = MemType_Normal; 
memattrs.inner.attrs = attr<1:0>; 
memattrs.outer.attrs = attr<1:0>; 
elsif attr<1:0> != 'QQ' then 
memattrs.memtype = MemType_Normal; 
memattrs.outer = S2ConvertAttrsHints(attr<3:2>, acctype); 
memattrs.inner = S2ConvertAttrsHints(attr<1:@>, acctype); 
memattrs.shareable = SH<1> == '1'; 
memattrs.outershareable = SH == '10'; 
else 
memattrs = MemoryAttributes UNKNOWN; // Reserved 


return MemAttrDefaults(memattrs) ; 


shared/translation/attrs/S2CacheDisabled 


// S2CacheDisabled() 


boolean S2CacheDisabled(AccType acctype) 
if ELUsingAArch32(EL2) then 
disable = if acctype == AccType_IFETCH then HCR2.ID else HCR2.CD; 
else 
disable = if acctype == AccType_IFETCH then HCR_EL2.ID else HCR_EL2.CD; 
return disable == '1'; 


shared/translation/attrs/S2C onvertAttrsHints 


// S2ConvertAttrsHints() 


// Converts the attribute fields for Normal memory as used in stage 2 
// descriptors to orthogonal attributes and hints 


MemAttrHints S2ConvertAttrsHints(bits(2) attr, AccType acctype) 
assert !IsZero(attr); 


MemAttrHints result; 
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if HCR_EL2.FWB=='@' && S2CacheDisabled(acctype) then // Force Non-cacheable 
result.attrs = MemAttr_NC; 
result.hints = MemHint_No; 
else 
case attr of 
when 'Q1' // Non-cacheable (no allocate) 
result.attrs = MemAttr_NC; 
result.hints = MemHint_No; 
when '10' // Write-through 
result.attrs = MemAttr_WT; 
result.hints = MemHint_RWA; 
when '11' // Write-back 
result.attrs = MemAttr_WB; 
result.hints = MemHint_RWA; 


result.transient = FALSE; 


return result; 


shared/translation/attrs/ShortConvertAttrsHints 
// ShortConvertAttrsHints() 


// Converts the short attribute fields for Normal memory as used in the TTBR and 
// TEX fields to orthogonal attributes and hints 


MemAttrHints ShortConvertAttrsHints(bits(2) RGN, AccType acctype, boolean secondstage) 
MemAttrHints result; 


if (!secondstage && S1CacheDisabled(acctype)) || (secondstage && S2CacheDisabled(acctype)) then 
// Force Non-cacheable 
result.attrs = MemAttr_NC; 
result.hints = MemHint_No; 
else 
case RGN of 
when '00' // Non-cacheable (no allocate) 
result.attrs = MemAttr_NC; 
result.hints = MemHint_No; 
when 'Q1' // Write-back, Read and Write allocate 
result.attrs = MemAttr_WB; 
result.hints = MemHint_RWA; 
when '10' // Write-through, Read allocate 
result.attrs = MemAttr_WT; 
result.hints = MemHint_RA; 
when '11' // Write-back, Read allocate 
result.attrs = MemAttr_WB; 
result.hints = MemHint_RA; 


result.transient = FALSE; 


return result; 


shared/translation/attrs/WalkAttrDecode 


// WalkAttrDecode() 


MemoryAttributes WalkAttrDecode(bits(2) SH, bits(2) ORGN, bits(2) IRGN, boolean secondstage) 
MemoryAttributes memattrs; 
AccType acctype = AccType_NORMAL; 


memattrs.memtype = MemType_Normal; 
memattrs.inner = ShortConvertAttrsHints(IRGN, acctype, secondstage) ; 
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memattrs.outer = ShortConvertAttrsHints(ORGN, acctype, secondstage) ; 
memattrs.shareable = SH<1> == '1'; 

memattrs.outershareable = SH == '10'; 

memattrs.tagged = FALSE; 


return MemAttrDefaults(memattrs) ; 


shared/translation/translation/HasS2Translation 
// HasS2Translation() 
// Returns TRUE if stage 2 translation is present for the current translation regime 


boolean HasS2Translation() 
return (EL2Enabled() && !IsInHost() && PSTATE.EL IN {ELQ,EL1}); 


shared/translation/translation/Have16bitVMID 


// Returns TRUE if EL2 and support for a 16-bit VMID are implemented. 
boolean Havel6bitVMID(); 


shared/translation/translation/PAMax 
// PAMax() 


// Returns the IMPLEMENTATION DEFINED upper limit on the physical address 
// size for this processor, as log2(). 


integer PAMax() 
return integer IMPLEMENTATION_DEFINED "Maximum Physical Address Size"; 


shared/translation/translation/S1TranslationRegime 


// S1TranslationRegime() 





// Stage 1 translation regime for the given Exception level 


bits(2) S1TranslationRegime(bits(2) el) 

if el != ELO then 
return el; 

elsif HaveEL(EL3) && ELUsingAArch32(EL3) && SCR.NS == 'Q' then 
return EL3; 

elsif HaveVirtHostExt() && ELIsInHost(el) then 
return EL2; 

else 
return EL1; 


// S1TranslationRegime() 
// Returns the Exception level controlling the current Stage 1 translation regime. For the most 
// part this is unused in code because the system register accessors (SCTLR[], etc.) implicitly 
// return the correct value. 
bits(2) S1TranslationRegime() 
return S1TranslationRegime(PSTATE.EL) ; 
shared/translation/translation/VAMax 
// \VAMax() 


// Returns the IMPLEMENTATION DEFINED upper limit on the virtual address 
// size for this processor, as log2(). 
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integer VAMax() 
return integer IMPLEMENTATION_DEFINED "Maximum Virtual Address Size"; 
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Appendix K1 


Architectural Constraints on UNPREDICTABLE 
behaviors 


This chapter describes the architectural constraints on UNPREDICTABLE behaviors in the Armv8 architecture. It 
contains the following sections: 


$ AArch32 CONSTRAINED UNPREDICTABLE behaviors on page K1-7606. 
: AArch64 CONSTRAINED UNPREDICTABLE behaviors on page K1-7630. 
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K1.1 


K1-7606 


AArch32 CONSTRAINED UNPREDICTABLE behaviors 


Armv8 defines architecturally-required constraints on many behaviors that are UNPREDICTABLE in Armv7. The 
following sections define those constraints: 


Overview of the constraints on Armv7 UNPREDICTABLE behaviors on page K1-7607. 
Using R13 on page K1-7607. 

Using R15 on page K1-7607. 

Branching into an IT block on page K1-7608. 

Branching to an unaligned PC on page K1-7608. 

Loads and Stores to unaligned locations on page K1-7608. 


CONSTRAINED UNPREDICTABLE behavior associated with IT instructions and PSTATE_IT on 
page K1-7608. 


Unallocated System register access instructions on page K1-7609. 

SBZ or SBO fields T32 and A32 in instructions on page K1-7610. 

UNPREDICTABLE cases in immediate constants in T32 data-processing instructions on page K1-7610. 
UNPREDICTABLE cases in immediate constants in Advanced SIMD instructions on page K1-7611. 
CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values on page K1-7611. 
CONSTRAINED UNPREDICTABLE behavior due to inadequate context synchronization on page K1-7612 
Translation Table Base Address alignment on page K1-7612. 


Handling of System register control fields for Advanced SIMD and floating-point operation on 
page K1-7612. 


The Performance Monitors Extension on page K1-7613. 
The Activity Monitors Extension on page K1-7615. 


Syndrome register handling for CONSTRAINED UNPREDICTABLE instructions treated as UNDEFINED 
on page K1-7615. 


Out of range VA on page K1-7616. 

Instruction fetches from Device memory on page K1-7616. 

Multi-access instructions that load the PC from Device memory on page K1-7616. 

Programming CSSELR.Level for a cache level that is not implemented on page K1-7616. 

Crossing a page boundary with different memory types or Shareability attributes on page K1-7617. 
Crossing a 4KB boundary with a Device access on page K1-7617. 

UNPREDICTABLE behaviors with Load-Exclusive/Store-Exclusive pairs on page K1-7617. 
CONSTRAINED UNPREDICTABLE behavior for A32 and T32 instruction encodings on page K1-7618. 
Out of range values of the Set/Way/Index fields in cache maintenance instructions on page K1-7619. 


CONSTRAINED UNPREDICTABLE behavior for A32 and T32 System instructions in the base instruction 
set on page K1-7619. 


CONSTRAINED UNPREDICTABLE behavior, A32 and T32 Advanced SIMD and floating-point instructions 
on page K1-7621. 
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s CONSTRAINED UNPREDICTABLE behaviors associated with the VTCR on page K1-7625. 
$ CONSTRAINED UNPREDICTABLE behavior of EL2 features on page K1-7625. 
. Reserved values in System and memory-mapped registers and translation table entries on page K1-7628. 


7 CONSTRAINED UNPREDICTABLE behavior in Debug state on page K1-7629. 


K1.1.1 Overview of the constraints on Armv7 UNPREDICTABLE behaviors 


The term UNPREDICTABLE describes a number of cases where the architecture has a feature that software must not 
use. For execution in AArch32 state, where previous versions of the architecture define behavior as 
UNPREDICTABLE, the Armv8-A architecture specifies a narrow range of permitted behaviors. This range is the range 
of CONSTRAINED UNPREDICTABLE behavior. All implementations that are compliant with the architecture must 
follow the CONSTRAINED UNPREDICTABLE behavior. 





Note 


Software designed to be compatible with the Armv8-A architecture must not rely on these CONSTRAINED 
UNPREDICTABLE cases. 





K1.1.2 Using R13 


In prior versions of the architecture, the use of R13 as a named register specifier was described as UNPREDICTABLE 
in the pseudocode. In the Armv8-A architecture, the use of R13 as anamed register specifier is not UNPREDICTABLE, 
unless this is specifically stated, and R13 can be used in the regular form. Bits[1:0] of R13 are not treated as RESO, 
but can hold any values programmed into them. 


K1.1.3 Using R15 
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All uses of R15 as a named register specifier for a source register that are described as CONSTRAINED 
UNPREDICTABLE in the pseudocode or in other places in this Manual must do one of the following: 


ž Cause the instruction to be treated as UNDEFINED. 
° Cause the instruction to execute as a NOP. 
s Read or return an UNKNOWN value for the source register specified as R15. 


All uses of R15 as a named register specifier for a destination register that are described as CONSTRAINED 
UNPREDICTABLE in the pseudocode or in other places in this reference manual must do one of the following: 


. Cause the instruction to be treated as UNDEFINED. 

° Cause the instruction to execute as a NOP. 

. Ignore the write. 

° Branch to an UNKNOWN location in either A32 or T32 state. 


The choice between these behaviors might in some implementations vary from instruction to instruction, or between 
different instances of the same instruction. 


Instructions that are CONSTRAINED UNPREDICTABLE when the base register is R15 and the instruction specifies a 
writeback of the base register, are treated as having R15 as both a source register and a destination register. 


For instructions that have two destination registers, for example LDRD, MRRC, and many of the multiply instructions, 
if Rt, Rt2, RdLo, or RdHi is R15, then the other destination register of the pair is UNKNOWN, if the CONSTRAINED 
UNPREDICTABLE behavior for the write to R15 is either to ignore the write or to branch to an UNKNOWN location. 


For instructions that affect any or all of PSTATE.{N, Z, C, V}, PSTATE.Q, and PSTATE.GE when the register 
specifier is not R15, any flags affected by an instruction that is CONSTRAINED UNPREDICTABLE when the register 
specifier is R15 become UNKNOWN, 


In addition, for MRC instructions that use R15 as the destination register descriptor, and therefore target APSR_nzcv 
where these are described as being CONSTRAINED UNPREDICTABLE, PSTATE. {N, Z, C, V} becomes UNKNOWN. 
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K1.1.4 Branching into an IT block 


Branching into an IT block leads to CONSTRAINED UNPREDICTABLE behavior. Execution starts from the address 
determined by the branch, but each instruction in the IT block is: 


° Executed as if it were not in an IT block. This means that it is executed unconditionally. 
: Executed as if it had passed its Condition code check within an IT block. 
. Executed as a NOP. That is, it behaves as if it had failed the Condition code check. 


K1.1.5 Branching to an unaligned PC 


In A32 state, when branching to an address that is not word aligned and is defined to be CONSTRAINED 
UNPREDICTABLE, one of the following behaviors must occur: 


° The unaligned location is forced to be aligned. 


s The unaligned address generates an exception on the first instruction using the unaligned PC value. 


If that instruction is executed at ELO and either of the following applies, the exception is taken to EL2: 
—  EL2 is using AArch32 and the value of HCR.TGE is 1. 
—  EL2 is using AArch64 and the value of HCR_EL2.TGE is 1. 


If the instruction is executed at ELO when the applicable TGE bit is 0 the exception is taken to EL1. 


If the instruction is executed at an Exception level that is higher than ELO the exception is taken to the 
Exception level at which the instruction was executed. 


In all cases, the exception is generated only if the first instruction using the unaligned PC value is 
architecturally executed. 


If the exception that results from a branch to an unaligned PC value: 


s Is taken to an Exception level that is using AArch64, it is reported as a PC alignment fault exception, see ZSS 
encoding for an exception from an Illegal Execution state, or a PC or SP alignment fault on page D13-2935. 


à Is taken to an Exception level that is using AArch32, it is reported as a Prefetch Abort exception, see Prefetch 
Abort exception reporting a PC alignment fault exception on page G1-5544. 
Note 


Because bit[0] is used for interworking, it is impossible to specify a branch to A32 state when the bottom bit of the 
target address is 1. Therefore the bottom bit of IFAR, HIFAR, or FAR_ELx is 0 for all these cases. 








K1.1.6 Loads and Stores to unaligned locations 


Some unaligned loads and stores in the Armv7 architecture are described as UNPREDICTABLE. These are defined in 
the Armv8-A architecture to do one of the following: 


. Take an alignment fault. 


e Perform the specified load or store to the unaligned memory location. 


K1.1.7 CONSTRAINED UNPREDICTABLE behavior associated with IT instructions and PSTATE.IT 


A number of instructions in the architecture are described as being CONSTRAINED UNPREDICTABLE either: 
$ Anywhere within an IT block. 
° As an instruction within an IT block, other than the last instruction within an IT block. 


Unless otherwise stated in this manual, when these instructions are committed for execution, one of the following 


occurs: 
° An UNDEFINED exception results. 
° The instructions are executed as if they had passed the Condition code check. 
s The instructions execute as NOPs. This means that they behave as if they had failed the Condition code check. 
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The behavior might in some implementations vary from instruction to instruction, or between different instances of 
the same instruction. 


Many instructions that are CONSTRAINED UNPREDICTABLE in an IT block are branch instructions or other 
non-sequential instructions that change the PC. Where these instructions are not treated as UNDEFINED within an IT 
block, the remaining iterations of the PSTATE.IT state machine must be treated in one of the following ways: 


. PSTATE.IT is cleared to 0. 


à PSTATE.IT advances for either a sequential or a nonsequential change of the PC in the same way as it does 
for instructions that are not CONSTRAINED UNPREDICTABLE that cause a sequential change of the PC. 


Note 


This does not apply to an instruction that is the last instruction in an IT block. 








The instructions addressed by the updated PC must do one of the following: 


è Execute as if they had passed the Condition code check for the remaining iterations of the PSTATE.IT state 
machine. 
è Execute as NOPs. That is, they behave as if they had failed the Condition code check for the remaining 


iterations of the PSTATE.IT state machine. 


. Execute as if they were unconditional, or, if the instructions are part of another IT block, in accordance with 
the behavior described in Branching into an IT block on page K1-7608. 


The behavior might in some implementations vary from instruction to instruction, or between different instances of 
the same instruction. 


For exception returns or Debug state exits that cause PSTATE.IT to be set to a reserved value in T32 state or that 
return to A32 state with a nonzero value in PSTATE.IT, the PSTATE.IT bits are forced to ‘00000000’. The reserved 
values are: 


PSTATE.IT[7:4] 
PSTATE.IT[2:0] 


‘0000’ && PSTATE.IT[3:0] = ‘0000’ 
‘000’ when SCTLR/SCTLR_EL_1.ITD == ‘1’ 


l= 
l= 
Exception returns or Debug state exits that set PSTATE.IT to a non-reserved value in T32 state can occur when the 
flow of execution returns to a point: 

. Outside an IT block, but with the PSTATE.IT bits set to a value other than ‘00000000’. 


. Inside an IT block, but with a different value of the PSTATE.IT bits than if the IT block had been executed 
without an exception return or Debug state exit. 


In this case the instructions at the target of the exception return or Debug state exit must do one of the following: 


è Execute as if they passed the Condition code check for the remaining iterations of the PSTATE.IT state 
machine. 
è Execute as NOPs. That is, they behave as if they failed the Condition code check for the remaining iterations 


of the PSTATE.IT state machine. 


7 Execute as if they were unconditional, or as if the instruction were part of another IT block, in accordance 
with the behavior in Branching into an IT block on page K1-7608. 


The remaining iterations of the PSTATE.IT state machine must behave in one of the following ways: 
° The PSTATE.IT state machine advances as if it were in an IT block. 

° The PSTATE.IT bits are ignored. 

° The PSTATE.IT bits are forced to ‘00000000’. 


K1.1.8 Unallocated System register access instructions 


In Armv8-A, accesses to unallocated System register encodings are UNDEFINED. 
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K1.1.9 


K1.1.10 
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This includes: 


° Reads using encodings that are defined as WO. 
è Writes using encodings that are defined as RO. 
. MCR or MRC accesses to using a set of {coproc, CRn, opc1, CRm, opc2} values that the Armv7 architecture defined 


as UNPREDICTABLE. 


e Accesses to System registers in the (coproc==0b111x) encoding space that the Armv7 architecture defined as 
UNPREDICTABLE when particular functionality was not implemented, when an Armv8 implementation does 
not include the Exception level that provides that functionality. 


SBZ or SBO fields T32 and A32 in instructions 


Many of the A32 and T32 instructions have (0) or (1) in the instruction decode to indicate should-be-zero, SBZ, or 
should-be-one, SBO. If the instruction bit pattern of an instruction is executed with these fields not having the 
should be values, one of the following must occur: 


s The instruction is UNDEFINED. 

à The instruction executes as a NOP. 

a The instruction operates as if the bit had the should-be value. 

è Any destination registers of the instruction become UNKNOWN. 


The exceptions to this rule are: 

° LDM, LDMIA, LDMFD on page F5-4224. 
° LDMDB, LDMEA on page F5-4234. 

$ LDR (literal) on page F5-4243. 

è LDRB (literal) on page F5-4253. 

° LDRD (immediate) on page F5-4261. 

° LDRD (register) on page F5-4267. 

è LDRD (literal) on page F5-4264. 

- LDRH (literal) on page F5-4282. 

è LDRSB (literal) on page F5-4293. 

$ LDRSH (literal) on page F5-4304. 

s POP on page F5-4411. 

s PUSH on page F5-4418. 

7 SDIV on page F5-4498. 

s STM, STMIA, STMEA on page F5-4591. 
$ STMDB, STMFD on page F5-4599. 

s UDIV on page F5-4713. 


UNPREDICTABLE cases in immediate constants in T32 data-processing instructions 


The description of immediate constants in T32 data processing Modified immediate constants in T32 instructions 
on page F2-3923 include constant values that were UNPREDICTABLE in Armv7. Instruction encodings on 

page F2-3904 describes 32-bit T32 instructions as {hw1, hw2}, where hw1 is the left-hand halfword in the 32-bit 
encoding diagram for the instruction. The UNPREDICTABLE cases are those where both: 


° hw2[7:0] == 0b0000000. 

7 hw1[10] == @ and either: 
— — hw2[14:12] == 0b001. 
— — hw2[14:12] == 0b010. 
— — hw2[14:12] == 0b011. 


In Armv8 the CONSTRAINED UNPREDICTABLE behavior is that these encodings produce the value 0b0000000. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Architectural Constraints on UNPREDICTABLE behaviors 
K1.1 AArch32 CONSTRAINED UNPREDICTABLE behaviors 


K1.1.11 UNPREDICTABLE cases in immediate constants in Advanced SIMD instructions 


The description of immediate constants in Modified immediate constants in T32 and A32 Advanced SIMD 
instructions on page F2-3925 include constant values that were UNPREDICTABLE in Armv7. The UNPREDICTABLE 
cases are those where: 


g The bits that the encoding diagram shows as abcd are all 0. 
In the A32 encoding these are bits[24, 18:6, 3:0]. In the T32 encoding they are bits {hw1[12, 2:0], hw2[3:0]}. 


s The bits that the encoding diagram shows as cmode[3:1] are one of {0b001, 0b010, 0b011, 0b101, 0b110}. 
In the A32 encoding these are bits[11:9]. In the T32 encoding they are bits hw2[11:9]. 


In Armv8 the CONSTRAINED UNPREDICTABLE behavior is that these encodings produce an immediate constant value 
of zero. 


K1.1.12 CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values 


The Arm architecture allows copies of control values or data values to be cached in a cache or TLB. This can lead 
to CONSTRAINED UNPREDICTABLE behavior if the cache or TLB has not been correctly invalidated following a 
change of the control or data values. 


Unless explicitly stated otherwise, the behavior of the PE is consistent with one of: 


° The old data or control value. 
. The new data or control value. 
. An amalgamation of the old and new data or control values. 


In an implementation that includes ARMv8.2-TTCNP, this CONSTRAINED UNPREDICTABLE case can arise from 
misprogramming when setting TTBR.CnP to 1, as identified in the descriptions of the TTBR.CnP field. In this case, 
for a particular TTBR, the behavior of the PE is consistent with one of: 


7 The value of the translation table entry pointed to by that TTBR on one of the PEs within the Inner Shareable 
domain for which both the value of TTBR.CnP is 1 and the other conditions for sharing translation table 
entries pointed to by that TTBR are met. 


s An amalgamation of the values of the translation table entries pointed to by that TTBR on two or more of the 
PEs within the Inner Shareable domain for which both the value of TTBR.CnP is 1 and the other conditions 
for sharing translation table entries pointed to by that TTBR are met. 


Note 


Ifthe Effective value of a control or data value that determines the behavior of the PE results from the amalgamation 
of two or more values then that Effective value must not generate a privilege violation. So, for example: 





è Where the CONSTRAINED UNPREDICTABLE behavior occurs because inadequate invalidation of the TLB 
causes multiple hits in the TLB, the failure to invalidate the TLB by software executing at a given Exception 
level and Security state must not make it possible to access regions of memory with permissions or attributes 
that could not be accessed at that Exception level and Security state. 


° Where the CONSTRAINED UNPREDICTABLE behavior occurs because of a programming error, on one or more 
PEs in the Inner Shareable domain, when using a TTBR.CnP value of 1 to share translation table entries, the 
misprogramming must not make it possible to access regions of memory with permissions or attributes that 
could not be accessed at the Exception level of that TTBR and the Security state corresponding to the 
translation table entries being shared. 





Alternatively to this CONSTRAINED UNPREDICTABLE behavior, an implementation detecting multiple hits within a 
TLB might generate an exception, reporting the exception using the TLB Conflict fault code, see TLB conflict 
aborts on page G5-5791. 


The choice between the behaviors might, in some implementations, vary for each use of a control or data value. 
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CONSTRAINED UNPREDICTABLE behavior due to inadequate context synchronization 


The Arm architecture requires that changes to System registers must be synchronized before they take effect. This 
can lead to CONSTRAINED UNPREDICTABLE behavior if the synchronization has not been performed. 


In these cases, the behavior of the PE is consistent with the unsynchronized control value being either the old value 
or the new value. 


Where multiple control values are updated but not yet synchronized, each control value might independently be the 
old value or the new value. 


In addition, where the unsynchronized control value applies to different areas of functionality, or what an 
implementation has constructed as different areas of functionality, those areas might independently treat the control 
value as being either the old value or the new value. 


The choice between these behaviors might, in some implementations, vary for each use of a control value. 


Translation Table Base Address alignment 


A misaligned Translation Table Base Address can occur if: 


s The VMSAv8-32 Short-descriptor translation table format is enabled and TTBRO[13-N:7], which is defined 
to be RESO, contains one or more nonzero values. 


è The VMSAv8-32 Long-descriptor translation table format is enabled, and TTBRO[x-1:3], TTBR1[x-1:3], 
HTTBR[x-1:3], or VITTBR[x-1:3], which are defined to be RESO, contain one or more nonzero values. 


In the event of a misaligned Translation Table Base Address, one of the following behaviors must occur: 


. The field that is defined to be RESO is treated as if all bits were zero: 


— The value that is read back might be the value written or it might be zero. 


` The calculation of an address for a translation table walk using that register might be corrupted in those bits 
that are nonzero. 


Handling of System register control fields for Advanced SIMD and floating-point operation 


For historical reasons described in Background to the System register interface on page G1-5568, each of the 
CPACR, HCPTR, and NSACR has a pair of control fields that were defined to have identical functionality for 
controlling Advanced SIMD and floating-point operation. These fields are: 

7 CPACR. {cp10, cp11}. 

° HCPTR.{TCP10, TCP11}. 

7 NSACR. {cp10, cp11}. 


The architecture requires that both fields in one of these pairs are programmed to the same value. If this is not done, 
then the CONSTRAINED UNPREDICTABLE behavior is that behavior is the same as if the cp11, or TCP11, control field 
was equal to the cp10, or TCP 10, field in all respects other than the value read back by a direct read of the register. 
After a register write that writes different values to the two fields of a pair, a direct read of the register might return 
an UNKNOWN value for the cp11 or TCP11 field. 


Note 


This means that, when different values are written to the {cp10, cp11} fields in a single register, the architecture 
permits but does not require that a read of that register returns the value written to the cp11 field. 








CONSTRAINED UNPREDICTABLE CPACR and NSACR settings 
If CPACR.cp<n> contains the encoding ‘10’, then one of the following behaviors must occur: 


è The encoding maps onto any of the allocated values, but otherwise does not cause UNPREDICTABLE behavior. 
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° The encoding causes effects that could be achieved by a combination of more than one of the allocated 
encodings. 


Note 


In Armv7, CPACR had a D32DIS bit, and NSACR had an NSD32DIS bit. There is no CPACR.D32DIS or 
NSACR.NSD32DIS in Armv8-A, and the corresponding bits in the two registers are RESO. 








K1.1.16 The Performance Monitors Extension 
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The following subsections describe CONSTRAINED UNPREDICTABLE behaviors when accessing the Performance 
Monitors Extension in AArch32 state: 


5 CONSTRAINED UNPREDICTABLE accesses to PMXEVTYPER or PMXEVCNTR. 


7 CONSTRAINED UNPREDICTABLE accesses to PMEVCNTR<n> and PMEVTYPER<n> on 
page K1-7614. 


s CONSTRAINED UNPREDICTABLE behavior caused by HDCR.HPMN on page K1-7614. 


CONSTRAINED UNPREDICTABLE accesses to PMXEVTYPER or PMXEVCNTR 


If PMSELR.SEL is greater than the number of counters accessible at this Exception level, accesses to 
PMXEVTYPER or PMXEVCNTR can cause CONSTRAINED UNPREDICTABLE behavior. This occurs when one of 
the following is true: 


s If PMSELR.SEL is not equal to 31, and PMSELR.SEL is greater than or equal to PMCR.N, and the PE is 
executing in EL2 or EL3. 


. If ARMv8.4-SecEL2 is disabled or is not implemented, PMSELR.SEL is not 31, and PMSELR.SEL is 
greater than or equal to PMCR.N, and the PE is executing in Secure EL1 or Secure ELO. 


: If PMSELR.SEL is not 31, and PMSELR.SEL is greater than or equal to HDCR.HPMN, and the PE is 
executing in EL1 or ELO. 


In these UNPREDICTABLE cases, one of the following behaviors must occur: 

e Accesses to PMXEVTYPER or PMXEVCNTR from that mode are UNDEFINED. 

° Accesses to PMXEVTYPER or PMXEVCNTR from that mode behave as RAZ/WI. 
° Accesses to PMXEVTYPER or PMXEVCNTR from that mode execute as NOPs. 


° Accesses to PMXEVTYPER or PMXEVCNTR from that mode behave as if PMSELR.SEL contains an 
UNKNOWN value that is less than the number of counters accessible at the current Exception level and 
Security state. 


. Accesses to PMXEVTYPER or PMXEVCNTR behave as if PMSELR.SEL is 31. 


7 If EL2 is implemented and enabled in the current Security state, and PMSELR.SEL is less than the number 
of implemented counters but greater than the number of accessible counters at this Exception level, access to 
PMXEVTYPER or PMXEVCNTR from EL1 or permitted access from ELO is trapped to EL2. 


If PMSELR.SEL is equal to 31, then one of the following behaviors must occur: 
$ Accesses to PMXEVCNTR are UNDEFINED. 

° Accesses to PMXEVCNTR behave as RAZ/WI. 

s Accesses to PMXEVCNTR execute as NOPs. 


° Accesses to PMXEVCNTR behave as if PMSELR.SEL contains an UNKNOWN value that is less than the 
number of counters accessible at the current Exception level and Security state. 
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: If EL2 is implemented and enabled in the current Security state, for an access to PMXEVCNTR from EL1 
or a permitted access from ELO, if the counter is implemented but not accessible at the current Exception 
level, the register access is trapped to EL2. 


Note 


If EL2 is implemented and enabled in the current Security state, HDCR.HPMN, or MDCR_EL2.HPMN, identifies 
the number of accessible counters at ELO or EL1. Otherwise, the number of accessible counters is the number of 
implemented counters. 





Accesses from ELO to PMXEVCNTR are permitted when: 
° EL1 is using AArch32 and the values of PMUSERENR. {ER, EN} are both 1. 
è EL1 is using AArch64 and the values of PMUSERENR_ELO.{ER, EN} are both 1. 


Accesses from ELO to PMXEVTYPER are permitted when: 
$ EL1 is using AArch32 and the value of PMUSERENR.EN is 1. 
è EL1 is using AArch64 and the value of PMUSERENR_ELO.EN is 1. 





CONSTRAINED UNPREDICTABLE accesses to PMEVCNTR<n> and PMEVTYPER<n> 


If <n> is greater than the number of counters available in the current Exception level and state, reads and writes of 
PMEVCNTR<n> and PMEVTYPER<n> are CONSTRAINED UNPREDICTABLE, and the following behaviors are 


permitted: 

$ Accesses to the register are UNDEFINED. 

. Accesses to the register behave as RAZ/WI. 

° Accesses to the register execute as a NOP. 

è If EL2 is implemented and enabled in the current Security state, for an access to PMEVCNTR<n> or 


PMEVTYPER<n> from EL1 or a permitted access from ELO, if the counter is implemented but not 
accessible at the current Exception level, the register access is trapped to EL2. 


Accesses from ELO are permitted to PMEVCNTR<n> when: 

— ELl is using AArch32 and the values of PMUSERENR. {ER, EN} are both 1. 

— ELl is using AArch64 and the values of PMUSERENR_ELO.{ER, EN} are both 1. 
Accesses from ELO are permitted to PMEVTYPER<n> when: 

— ELl is using AArch32 and the value of PMUSERENR.EN is 1. 

— Ell is using AArch64 and the value of PMUSERENR_ELO.EN is 1. 


Note 


If EL2 is implemented and enabled in the current Security state, at ELO and EL1, HDCR.HPMN, or 
MDCR_EL2.HPMN, identifies the number of accessible counters. Otherwise, the number of accessible counters is 
the number of implemented counters. 








CONSTRAINED UNPREDICTABLE behavior caused by HDCR.HPMN 
If HDCR.HPMN is set to 0 or to a value greater than PMCR.N, then the CONSTRAINED UNPREDICTABLE behavior is: 
° The value returned by a direct read of HDCR.HPMN is UNKNOWN. 


. Either: 


— An UNKNOWN number of counters are reserved for EL2 use. That is, the PE behaves as if 
HDCR.HPMN is set to an UNKNOWN non-zero value less than PMCR.N. 


—  Allcounters are reserved for EL2 and EL3 use, meaning no counters are accessible from EL1 and ELO. 


K1-7614 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Architectural Constraints on UNPREDICTABLE behaviors 
K1.1 AArch32 CONSTRAINED UNPREDICTABLE behaviors 


K1.1.17 The Activity Monitors Extension 


The following subsections describe CONSTRAINED UNPREDICTABLE behaviors when accessing the Activity Monitors 
registers in AArch32 state: 


3 CONSTRAINED UNPREDICTABLE accesses to AMEVCNTRO<n> and AMEVTYPERO<n>. 
7 CONSTRAINED UNPREDICTABLE accesses to AMEVCNTRI<n> and AMEVTYPERI<n>. 
: CONSTRAINED UNPREDICTABLE accesses to AMCNTENCLRI and AMCNTENSET1. 


CONSTRAINED UNPREDICTABLE accesses to AMEVCNTRO<n> and AMEVTYPERO<n> 


If <n> is greater than the number of architected activity monitor event counters, reads and writes of 
AMEVCNTRO<n> and AMEVTYPERO<n> are CONSTRAINED UNPREDICTABLE, and the following behaviors are 


permitted: 

s Accesses to the register are UNDEFINED. 

$ Accesses to the register behave as RAZ/WI. 

. Accesses to the register execute as a NOP. 
Note 





AMCGCR.CGONC identifies the number of architected activity monitor event counters. 





CONSTRAINED UNPREDICTABLE accesses to AMEVCNTR1<n> and AMEVTYPER1<n> 


If <n> is greater than the number of auxiliary activity monitor event counters, reads and writes of 
AMEVCNTR1<n> and AMEVTYPER1<n> are CONSTRAINED UNPREDICTABLE, and the following behaviors are 





permitted: 

$ Accesses to the register are UNDEFINED. 

7 Accesses to the register behave as RAZ/WI. 

. Accesses to the register execute as a NOP. 
Note 


AMCGCR.CGINC identifies the number of auxiliary activity monitor event counters. 





CONSTRAINED UNPREDICTABLE accesses to AMCNTENCLR1 and AMCNTENSET1 


If the number of auxiliary activity monitor event counters that are implemented is zero, reads and writes of 
AMCNTENCLR1 and AMCNTENSET1 are CONSTRAINED UNPREDICTABLE, and the following behaviors are 





permitted: 
G Accesses to the register are UNDEFINED. 
. Accesses to the register behave as RAZ/WI. 
. Accesses to the register execute as a NOP. 
Note 
The number of auxiliary activity monitor event counters that are implemented is zero exactly when AMCFGR.NCG 
== 0b0000. 





K1.1.18 Syndrome register handling for CONSTRAINED UNPREDICTABLE instructions treated as 
UNDEFINED 


When a CONSTRAINED UNPREDICTABLE instruction is treated as UNDEFINED, this generates an exception: 
a If this exception is taken to an Exception level that is using AArch64 then ESR_ELx is UNKNOWN. 
s If this exception is taken to EL2 and EL2 is using AArch32, then the HSR is unknown. 
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K1.1.19 


K1.1.20 


K1.1.21 


K1.1.22 


K1-7616 


Note 


The value written to ESR or HSR must be consistent with a value that could be created as the result of an exception 
from the same Exception level that generated the exception, but resulted from a situation that is not CONSTRAINED 
UNPREDICTABLE at that Exception level. This is to avoid a possible privilege violation. 








Out of range VA 


If the PE executes an instruction for which the instruction address, size, and alignment mean it contains the bytes 
OxFFFF FFFF and 0x0000 0000, then the bytes that wrap around and appear to be from 0x0000 0000 onwards come from 
an UNKNOWN address. 


If the PE executes a load or store instruction for which the computed address, total access size, and alignment mean 
it accesses bytes @xFFFF FFFF and @x0000 0000, then the bytes that wrap around and appear to be from 0x0000 0000 
onwards come from an UNKNOWN address. 


Instruction fetches from Device memory 


Instruction fetches from Device memory are CONSTRAINED UNPREDICTABLE. 


Ifa location in memory has the Device attribute and is not marked as execute-never, then an implementation might 
perform speculative instruction accesses to this memory location when address translation is enabled. 


Ifa branch causes the program counter to point to a location in memory with the Device attribute that is not marked 
as execute-never for the current Exception level for instruction fetches, then an implementation must perform one 
of the following behaviors: 


$ It treats the instruction fetch as if it were to a memory location with the Normal, Non-cacheable attribute. 
s It generates a Permission fault. 


Multi-access instructions that load the PC from Device memory 


Multi-access instructions that load the PC from Device memory when address translation is enabled are 
UNPREDICTABLE in AArch32 state. In the Armv8-A architecture in AArch32 state an implementation must perform 
one of the following behaviors: 


$ It loads the PC from the memory location as if the memory location had the Normal Non-cacheable attribute. 
: It generates a permission fault. 


Programming CSSELR.Level for a cache level that is not implemented 


If CSSELR.Level is programmed to a cache level that is not implemented, then a read of CSSELR returns an 
UNKNOWN value in CSSELR.Level. 


If CSSELR.Level is programmed to a cache level that is not implemented, then on a read of CCSIDR an 
implementation must perform one of the following behaviors: 


. The CCSIDR read is treated as a NOP. 
. The CCSIDR read is UNDEFINED. 
. The CCSIDR read returns an UNKNOWN value. 


When ARMv8.3-CCIDX is implemented, CCSIDR2 is implemented. If CSSELR.Level is programmed to a cache 
level that is not implemented, then on a read of CCSIDR2 an implementation must perform one of the following 
behaviors: 


. The CCSIDR2 read is treated as a NOP. 
° The CCSIDR2 read is UNDEFINED. 
° The CCSIDR2 read returns an UNKNOWN value. 
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K1.1.23 Crossing a page boundary with different memory types or Shareability attributes 


A memory access from a load or store instruction that crosses a page boundary to a memory location that has a 
different memory type or Shareability attribute results in CONSTRAINED UNPREDICTABLE behavior. In this case, the 
implementation must perform one of the following behaviors: 


All memory accesses generated by the instruction use the memory type and Shareability attributes associated 
with the first address accessed by the instruction. 


All memory accesses generated by the instruction use the memory type and Shareability attributes associated 
with the last address accessed by the instruction. 


Each memory access generated by the instruction uses the memory type and Shareability attribute associated 
with its own address. 

The instruction generates an alignment fault caused by the memory type. 

For the Non-secure PL1&0 translation regime: 

— Ifthe stage 1 translation causes the mismatch then the resulting exception is taken to PL1. 

— Ifthe stage 2 translation causes the mismatch then the resulting exception is taken to PL2. 

—  Ifboth stages of translation cause the mismatch then the resulting exception can be taken to either PL1 


or PL2. 


The instruction executes as a NOP. 


K1.1.24 Crossing a 4KB boundary with a Device access 


A memory access from a load or store instruction to Device memory that crosses a 4KB boundary results in 


CONSTRAINED UNPREDICTABLE behavior. In this case, the implementation must perform one of the following 


behaviors: 


All memory accesses generated by the instruction are performed as if the presence of the boundary had no 
effect on the memory accesses. 


All memory accesses generated by the instruction are performed as if the presence of the boundary had no 
effect on the memory accesses, except that there is no guarantee of ordering between memory accesses. 
The instruction generates an Alignment fault caused by the memory type. 

For the Non-secure PL1&0 translation regime: 

— Ifthe stage 1 translation causes the boundary to be crossed then the resulting exception is taken to PL1. 
— Ifthe stage 2 translation causes the boundary to be crossed then the resulting exception is taken to PL2. 
—  Ifboth stages of translation cause the boundary to be crossed then the resulting exception can be taken 


to either PL1 or PL2. 


The instruction executes as a NOP. 


Note 





The boundary referred to is between two Device memory regions that are both of 4KB and aligned to 4KB. 





K1.1.25 UNPREDICTABLE behaviors with Load-Exclusive/Store-Exclusive pairs 


ARM DDI 0487E.a 
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Load-Exclusive and Store-Exclusive instruction usage restrictions on page E2-3859 defines a 
Load-Exclusive/Store-Exclusive pair, and identifies various CONSTRAINED UNPREDICTABLE behaviors associated 
with using Load-Exclusive/Store-Exclusive pairs. These cases were UNPREDICTABLE in Armv7. In summary, these 
cases are: 


The target virtual address of a StoreExcl instruction is different from the virtual address of the preceding 
LoadExcl instruction in the same thread of execution. 
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s The transaction size ofa StoreExc] instruction is different from the transaction size of the preceding LoadExc1 
instruction in the same thread of execution. 


s The memory attributes for a StoreExc] instruction are different from the memory attributes for the preceding 
LoadExcl instruction in the same thread of execution, either: 


— Because the translation of the accessed address changes between the LoadExc] instruction and the 
StoreExcl instruction. 


— Because the LoadExc] instruction and the StoreExcl instruction use different virtual addresses, with 
different attributes, that point to the same physical address. 


In addition, the effect of a data or unified cache invalidate, clean, or clean and invalidate instruction on a local or 
global Exclusives monitor that is in the Exclusive Access state is CONSTRAINED UNPREDICTABLE. 


See the descriptions in Load-Exclusive and Store-Exclusive instruction usage restrictions on page E2-3859 for the 
permitted behavior in each of these cases, and any constraints that might apply to whether the case is CONSTRAINED 
UNPREDICTABLE. 


Note 


Additional CONSTRAINED UNPREDICTABLE cases can apply to Load-Exclusive and Store-Exclusive instructions, see 
CONSTRAINED UNPREDICTABLE behavior for A32 and T32 System instructions in the base instruction set on 
page K1-7619. 








CONSTRAINED UNPREDICTABLE behavior for A32 and T32 instruction encodings 


The A32 and T32 instruction sets include encodings that result in CONSTRAINED UNPREDICTABLE behavior when 
they are decoded. 


CONSTRAINED UNPREDICTABLE behavior of CRC32 instruction encodings 


In the A32 and T32 instruction sets, there are encodings of the CRC32 and CRC32C instructions that result in 
CONSTRAINED UNPREDICTABLE behavior. These encodings are listed in the following places in the A32 and T32 
instruction sets: 


° Cyclic Redundancy Check on page F4-4014 for the A32 instruction set, with sz = 11. 


$ Data-processing (two source registers) on page F3-3999 for the T32 instruction set, with op1 = 10x and op2 
= 11, 


The CONSTRAINED UNPREDICTABLE behavior for these encodings is described in CRC32 on page F5-4165 and 
CRC32C on page F5-4168. 


CONSTRAINED UNPREDICTABLE behavior of other A32 instruction encodings 


In the A32 instruction set, there are encodings that result in CONSTRAINED UNPREDICTABLE behavior. These 
encodings are listed in: 


$ Miscellaneous on page F4-4048. 
s Memory hints and barriers on page F4-4059. 
5 Barriers on page F4-4060. 


The CONSTRAINED UNPREDICTABLE behavior is that an implementation must treat the encodings in one of the 
following ways: 


. The instruction encoding is UNDEFINED. 
. The instruction encoding executes as NOP. 
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K1.1.27 Out of range values of the Set/Way/Index fields in cache maintenance instructions 


In the cache maintenance by set/way instructions DCCISW, DCCSW, and DCISW, if any set/way/index argument 
is larger than the value supported by the implementation, then the behavior is CONSTRAINED UNPREDICTABLE and 
one of the following occurs: 


5 The instruction is UNDEFINED. 

$ The instruction performs cache maintenance on one of: 
— Nocache lines. 
— A single arbitrary cache line. 
— Multiple arbitrary cache lines. 





Note 


This CONSTRAINED UNPREDICTABLE behavior applies, also, to the A64 cache maintenance by set/way instructions 
DC CISW, DC CSW, and DC ISW. 





K1.1.28 CONSTRAINED UNPREDICTABLE behavior for A32 and T32 System instructions in the base 


instruction set 
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This section lists the CONSTRAINED UNPREDICTABLE behavior for the different A32 and T32 System instructions. 


Note 


If an instruction can result in CONSTRAINED UNPREDICTABLE behavior that is not specific to that particular 
instruction, see the relevant section in this appendix for a description of the CONSTRAINED UNPREDICTABLE 
behavior. 





SRS (T32) 


For a description of this instruction and the encoding, see SRS, SRSDA, SRSDB, SRSIA, SRSIB on page F5-4555. 


CONSTRAINED UNPREDICTABLE behavior 
For all encodings: 


` If the instruction specifies an illegal mode field, then one of the following behaviors must occur: 
— The instruction is UNDEFINED. 
— The instruction executes as a NOP. 
— R13 ofthe current mode is used. 


— The store occurs to an UNKNOWN address, and if the instruction specifies writeback, any 
general-purpose register that can be accessed without privilege violation from the current Exception 
level become UNKNOWN. 


SRS (A32) 


For a description of this instruction and the encoding, see SRS, SRSDA, SRSDB, SRSIA, SRSIB on page F5-4555. 


CONSTRAINED UNPREDICTABLE behavior 
For all encodings: 


° If the instruction specifies an illegal mode field, then one of the following behaviors must occur: 
— The instruction is UNDEFINED. 
— The instruction executes as a NOP. 


— R13 of the current mode is used. 
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— The store occurs to an UNKNOWN address, and if the instruction specifies writeback, any 
general-purpose register that can be accessed without privilege violation from the current Exception 
level become UNKNOWN. 


SUBS PC, LR and related instructions (T32) 


For a description of this instruction and the encoding, see the exception return form of SUB, SUBS (immediate) on 
page F5-4657. 


CONSTRAINED UNPREDICTABLE behavior 
For all encodings: 


. If this instruction is executed in User mode or in System mode, then one of the following behaviors must 
occur: 


— The instruction is UNDEFINED. 
— The instruction executes as a NOP. 


$ If the instruction transfers an illegal mode encoding to PSTATE.M, then this invokes the illegal exception 
return. 





Note 


An illegal mode encoding is either an unallocated mode encoding or one that is not accessible at the current 
Exception level. 





For encoding T5: 
. If hw2[3:0] are @b1110, and the instruction is executed when not in Hyp mode, System mode, or User mode, 
then one of the following behaviors must occur: 
— The instruction is UNDEFINED. 
— The instruction is treated as a NOP. 
— The instruction is treated as if hw2[3:0] are @b1110. 


— The program counter is set using the value in the register specified by hw2[3:0]. 


SUBS PC. LR and related instructions (A32) 


For a description of this instruction and the encoding, see the exception return forms of MOV, MOVS (register) on 
page F5-4343 and SUB, SUBS (immediate) on page F5-4657. 


CONSTRAINED UNPREDICTABLE behavior 
For all encodings: 


. If this instruction is executed in User mode or in System mode, then one of the following behaviors must 
occur: 


— The instruction is UNDEFINED. 
— The instruction executes as a NOP. 


. If the instruction transfers an illegal mode encoding to PSTATE.M, then this invokes the illegal exception 
return. 


Note 


An illegal mode encoding is either an unallocated mode encoding or one that is not accessible at the current 
Exception level. 
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K1.1.29 CONSTRAINED UNPREDICTABLE behavior, A32 and T32 Advanced SIMD and floating-point 


instructions 


ARM DDI 0487E.a 
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This section lists the CONSTRAINED UNPREDICTABLE behavior for the different A32 and T32 Advanced SIMD and 
floating-point instructions listed in Alphabetical list of Advanced SIMD and floating-point instructions on 
page F6-4782. 





Note 


. The pseudocode used in this section to describe cases that can result in CONSTRAINED UNPREDICTABLE 
behavior does not necessarily match the encoding specific pseudocode for a specific instruction. 


$ If an instruction can result in CONSTRAINED UNPREDICTABLE behavior that is not specific to that particular 
instruction, see the relevant section in this appendix for a description of the CONSTRAINED UNPREDICTABLE 
behavior. 





VCVT (between floating-point and fixed-point) 


For a description of this instruction and the encoding, see VCVT (between floating-point and fixed-point, 


floating-point) on page F6-4939. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD1 (multiple single elements) 
For a description of this instruction and the encoding, see VLD/ (multiple single elements) on page F6-5025. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD1 (single element to all lanes) 
For a description of this instruction and the encoding, see VLD/ (single element to all lanes) on page F6-5022. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD2 (multiple 2-element structures) 
For a description of this instruction and the encoding, see VLD2 (multiple 2-element structures) on page F6-5042. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD2 (single 2-element structure to one lane) 


For a description of this instruction and the encoding, see VLD2 (single 2-element structure to one lane) on 
page F6-5033. 
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If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD2 (single 2-element structure to all lanes) 


For a description of this instruction and the encoding, see VLD2 (single 2-element structure to all lanes) on 
page F6-5039. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD3 (multiple 3-element structures) 
For a description of this instruction and the encoding, see VLD3 (multiple 3-element structures) on page F6-5056. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD3 (single 3-element structure to one lane) 


For a description of this instruction and the encoding, see VLD3 (single 3-element structure to one lane) on 
page F6-5047. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD3 (single 3-element structure to all lanes) 


For a description of this instruction and the encoding, see VLD3 (single 3-element structure to all lanes) on 
page F6-5053. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD4 (multiple 4-element structures) 
For a description of this instruction and the encoding, see VLD4 (multiple 4-element structures) on page F6-5068. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD4 (single 4-element structure to one lane) 


For a description of this instruction and the encoding, see VLD4 (single 4-element structure to one lane) on 
page F6-5059. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


ARM DDI 0487E.a 
ID070919 


Architectural Constraints on UNPREDICTABLE behaviors 
K1.1 AArch32 CONSTRAINED UNPREDICTABLE behaviors 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLD4 (single 4-element structure to all lanes) 


For a description of this instruction and the encoding, see VLD4 (single 4-element structure to all lanes) on 
page F6-5065. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VLDM 
For a description of this instruction and the encoding, see VLDM, VLDMDB, VLDMIA on page F6-5071. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VMOV (between two general-purpose registers and two single-precision registers) 


For a description of this instruction and the encoding, see VMOV (between two general-purpose registers and two 
single-precision registers) on page F6-5147. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VMOV (between two general-purpose registers and a doubleword floating-point 
register) 


For a description of this instruction and the encoding, see VMOV (between two general-purpose registers and a 
doubleword floating-point register) on page F6-5126. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VST1 (multiple single elements) 
For a description of this instruction and the encoding, see VSTI (multiple single elements) on page F6-5388. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VST2 (multiple 2-element structures) 


For a description of this instruction and the encoding, see VST2 (multiple 2-element structures) on page F6-5402. 
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If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VST2 (single 2-element structure from one lane) 


For a description of this instruction and the encoding, see VST2 (single 2-element structure from one lane) on 
page F6-5396. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VST3 (multiple 3-element structures) 
For a description of this instruction and the encoding, see VST3 (multiple 3-element structures) on page F6-5413. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VST3 (single 3-element structure from one lane) 


For a description of this instruction and the encoding, see VST3 (single 3-element structure from one lane) on 
page F6-5407. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VST4 (multiple 4-element structures) 
For a description of this instruction and the encoding, see VST4 (multiple 4-element structures) on page F6-5422. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VST4 (single 4-element structure from one lane) 


For a description of this instruction and the encoding, see VST4 (single 4-element structure from one lane) on 
page F6-5416. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 


VSTM 
For a description of this instruction and the encoding, see VSTM, VSTMDB, VSTMIA on page F6-5425. 


If this instruction is not UNDEFINED, then whether it is affected by traps or enables relating to the use of the 
SIMD&FP registers when it is CONSTRAINED UNPREDICTABLE, is IMPLEMENTATION DEFINED. The implementation 
must ensure that the CONSTRAINED UNPREDICTABLE behavior does not corrupt registers that are not accessible at the 
current Exception level by instructions that are not CONSTRAINED UNPREDICTABLE. 
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K1.1.30 CONSTRAINED UNPREDICTABLE behaviors associated with the VTCR 


The following subsections describe the CONSTRAINED UNPREDICTABLE behavior associated with programming the 
VTCR: 


° Misprogramming VTCR.S. 
° Misprogramming VTCR.{SL0, TOSZ}. 


Misprogramming VTCR.S 


VTCR.S must be programmed to the value of TOSZ[3], or the effect is CONSTRAINED UNPREDICTABLE. For the 
Armv8-A architecture, if VTCR.S is not programmed correctly, then the VTCR.TOSZ value is treated as an 
UNKNOWN value. 


Note 


The CONSTRAINED UNPREDICTABLE behavior described in Misprogramming VTCR.{SLO, TOSZ} means the 
UNKNOWN VTCR.TOSZ value might generate a Translation fault. 








Misprogramming VTCR.{SLO, TOSZ} 


If the stage 2 input address size, as programmed in VTCR.TOSZ, is out of range with respect to the starting level, 
as programmed in the VTCR.SLO field, or the VTCR.SLO field is programmed to a reserved value, then at the time 
of a translation walk that uses the stage 2 translation, a stage 2 level 1 Translation Fault is generated. 


K1.1.31 CONSTRAINED UNPREDICTABLE behavior of EL2 features 


ARM DDI 0487E.a 
ID070919 


The following sections describe CONSTRAINED UNPREDICTABLE behavior that can occur in an implementation that 
includes EL2 where EL2 can use AArch32: 


$ ERET in User mode or System mode. 

. Accessing Hyp mode from outside Hyp mode. 

7 Modifying PSTATE.M when in Hyp mode on page K1-7626 

d Use of Hyp mode in Secure state on page K1-7626. 

` Execution of Load/Store unprivileged instructions in Hyp mode on page K1-7626. 
e Exception return to Hyp mode on page K1-7626. 

i Accessing registers that cannot be accessed using MSR/MRS instructions on page K1-7626. 
. Memory type handling on page K1-7627. 

° Hyp mode TLB maintenance instructions on page K1-7627. 

. Hyp mode VA to PA address translation instructions on page K1-7627. 

: Stage I default memory type on page K1-7627. 

s Trapping of general exceptions to Hyp mode on page K1-7627. 

. Prevention of rootkits using Hyp mode or Secure state on page K1-7628. 

e HVC on page K1-7628. 

. MSR (banked register) and MRS (banked register) on page K1-7628. 


ERET in User mode or System mode 


If ERET is executed in User mode or System mode, it behaves as described in SUBS PC, LR and related instructions 
(T32) on page K1-7620. 


Accessing Hyp mode from outside Hyp mode 


Attempting to change into Hyp mode or out of Hyp mode using the MSR or CPS instruction invokes the Armv§8 illegal 
exception return by not changing the mode, and setting PSTATE.IL to 1. 


SRS using the Hyp mode SP from Non-secure modes other than Hyp mode, or from Secure state, is handled as 
described in SRS (T32) on page K1-7619 and SRS (432) on page K1-7619. 
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Modifying PSTATE.M when in Hyp mode 


Attempting to change into Hyp mode or out of Hyp mode using the MSR or CPS instruction invokes the Armv§8 illegal 
exception return by not changing the mode, and setting PSTATE.IL to 1. 


SRS using the Hyp mode SP from Non-secure modes other than Hyp mode, or from Secure state, is handled as 
described in SRS (T32) on page K1-7619 and SRS (432) on page K1-7619. 


Use of Hyp mode in Secure state 


Attempting to change into Hyp mode or out of Hyp mode using the MSR or CPS instruction invokes the Armv8 illegal 
exception return by not changing the mode, and setting PSTATE.IL to 1. 


SRS using the Hyp mode SP from Non-secure modes other than Hyp mode, or from Secure state, is handled as 
described in SRS (T32) on page K1-7619 and SRS (432) on page K1-7619. 


Execution of Load/Store unprivileged instructions in Hyp mode 


If LDRT, LDRSHT, LDRHT, LDRSBT, LDRBT, STRT, STRHT or STRBT are executed in Hyp mode, then one of the following 
behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as a NOP. 


° The instruction performs the equivalent, corresponding LDR, LDRSH, LDRH, LDRSB, LDRB, STR, STRH or STRB 
instruction in Hyp mode. 


Exception return to Hyp mode 


Exception returns to Hyp mode when SCR.NS == 0 or from a Non-secure PL1 mode invokes the Armv8 illegal 
exception return. 


Accessing registers that cannot be accessed using MSR/MRS instructions 
The following MSR and MRS instructions can lead to CONSTRAINED UNPREDICTABLE behavior: 


MSR <Rm>_<mode>, <Rn> 
MSR SPSR_<mode>, <Rn> 
MSR ELR_hyp, <Rn> 
MRS <Rn>, <Rm>_<mode> 
MRS <Rn>, SPSR_<mode> 
MRS <Rn>, ELR_hyp 


If these instructions are executed in either Secure or Non-secure User mode, then one of the following behaviors 
must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as a NOP. 


If the MSR and MRS instructions attempt to access a register that cannot be legally accessed, then one of the following 
behaviors must occur: 


. The instruction is UNDEFINED. 

° The instruction executes as a NOP. 

s For MRS instructions, the destination general-purpose register becomes UNKNOWN. 

° For MSR instructions, if the register specified could be accessed from the current mode by other mechanisms, 


then this register is UNKNOWN. Otherwise the instruction executes as a NOP. 
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Memory type handling 


If the attributes for a memory location after combining stage 1 and stage 2 of a translation regime is Normal Inner 
Non-cacheable, Outer Non-cacheable, then the shareability attributes after combining the two stages of translation 
is Outer Shareable. 


Hyp mode TLB maintenance instructions 


Ifa TLBIMVAH, TLBIMVALH, TLBIMVAHIS, TLBIMVALHIS, TLBIALLH, TLBIALLHIS, TLBIALLNSNH, 
TLBIALLNSNHIS, TLBIIPAS2, TLBHPAS2L, TLBIIPAS2IS, or TLBIPAS2LIS instruction is executed in a 
Secure Privileged mode other than Monitor mode, then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
. The instruction is executes as if it had been executed in Monitor mode. 


For more information about these instructions see The scope of TLB maintenance instructions on page G5-5802. 


Hyp mode VA to PA address translation instructions 


Ifan ATS1HR or ATS1HW instruction is executed in a Secure Privileged mode other than Monitor mode, then one 
of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction is treated as a NOP. 
° The instruction is executes as if it had been executed in Monitor mode. 


For more information about these instructions see Address translation instruction naming and operation summary 
on page G5-5841. 


Stage 1 default memory type 


If HCR.DC == 1, then the behavior of the PE when executing in a Non-secure mode other than Hyp mode is 
consistent with: 


5 SCTLR.M == 0, regardless of the actual value of SCTLR.M, other than for the value returned by an explicit 
read of SCTLR.M. 


s HCR.VM == 1, regardless of the actual value of HCR.VM, other than for an explicit read of this bit. 


Trapping of general exceptions to Hyp mode 


Attempting to perform an exception return to a Non-secure PL1 mode when HCR.TGE == 1 invokes an illegal 
exception return. 


Attempting to change from Monitor mode to a Non-secure PL1 mode when HCR.TGE == 1 by executing a CPS or 
MSR instruction generates an Illegal Execution state exception, by not changing the mode, and setting PSTATE.IL 
tol. 


When EL3 is using AArch32, attempting to change from a Secure PL1 mode to a Non-secure PL1 mode when 
HCR.TGE is set, by changing SCR.NS from 0 to 1, results in no change of SCR.NS. 


Because taking an exception into Non-secure PL1 modes leads to a CONSTRAINED UNPREDICTABLE situation, the 
following additional properties apply when HCR.TGE == 1: 


. All exceptions that would be routed to EL1 are routed to EL2. 
- Non-secure SCTLR.M is treated as being 0, regardless of its actual value, other than for an explicit read of 
of this bit. 


. HCR.FMO, HCR.IMO, and HCR.AMO are treated as being 1, regardless of their actual value, other than for 
an explicit read of these bits. 
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° All virtual interrupts are disabled. 
. Any IMPLEMENTATION DEFINED mechanisms for signaling virtual interrupts are disabled. 


Prevention of rootkits using Hyp mode or Secure state 


If an HVC instruction is executed in Hyp mode when SCR.HCE == 0, then one of the following behaviors must 


occur: 
° The instruction is UNDEFINED. 
. The instruction executes as a NOP. 


Ifan SMC instruction is executed in a Secure privileged mode when SCR.SCD == 1, then one of the following 
behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as a NOP. 
HVC 


For a description of this instruction and the encoding, see HVC on page F5-4201. 


For the Al encoding, if cond field !=1110, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 

7 The instruction executes as a NOP. 

° The instruction executes unconditionally. 
° The instruction executes conditionally. 


MSR (banked register) and MRS (banked register) 


Encoding and use of banked register transfer instructions on page F5-4777 identifies cases where attempted 
execution of an MRS (banked register) or MSR (banked register) was UNPREDICTABLE in Armv7 and becomes 
CONSTRAINED UNPREDICTABLE in Armv8. This includes cases where: 


s The target register specified by the {R, SYSm} fields of the instruction encoding is not accessible from the PE 
mode in which the instruction was executed, see Usage restrictions on the banked register transfer 
instructions on page F5-4778. 


- The instruction was executed specifying unallocated {R, SYSm} field values, see Encoding the register 
argument in the banked register transfer instructions on page F5-4779. 


If one of these encodings for an MSR (banked register) or MRS (banked register) instruction is executed, then one of 
the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
. An allocated MSR (banked register) or MRS (banked register) instruction is executed. 


K1.1.32 Reserved values in System and memory-mapped registers and translation table entries 


Unless otherwise stated, all unallocated or reserved values of fields with allocated values within the AArch32 
System registers, memory-mapped registers, and translation table entries behave in one of the following ways: 


. The encoding maps onto any of the allocated values, but otherwise does not cause CONSTRAINED 
UNPREDICTABLE behavior. 
° The encoding causes effects that could be achieved by a combination of more than one of the allocated 
encodings. 
° The encoding causes the field to have no functional effect. 
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Note 


These constraints are identical to those for the equivalent AArch64 definitions, as given in Reserved values in 
System and memory-mapped registers and translation table entries on page K1-7644. 


K1.1.33 CONSTRAINED UNPREDICTABLE behavior in Debug state 


Behavior in Debug state on page H2-6714 of this manual describes the CONSTRAINED UNPREDICTABLE behaviors 
that are specifically associated with Debug state. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K1-7629 
ID070919 Non-Confidential 


Architectural Constraints on UNPREDICTABLE behaviors 
K1.2 AArch64 CONSTRAINED UNPREDICTABLE behaviors 


K1.2 


K1.2.1 


K1.2.2 


K1.2.3 


K1-7630 


AArch64 CONSTRAINED UNPREDICTABLE behaviors 


It contains the following sections: 

7 Overview of the constraints on AArch64 UNPREDICTABLE behaviors. 

è SBZ or SBO fields in A64 instructions. 

° CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values. 

è CONSTRAINED UNPREDICTABLE behavior due to inadequate context synchronization on page K1-7631. 
. Translation table base address alignment on page K1-7632. 

e The Performance Monitors Extension on page K1-7632. 

7 The Activity Monitors Extension on page K1-7634. 


s Syndrome register handling for CONSTRAINED UNPREDICTABLE instructions treated as UNDEFINED 
on page K1-7634. 


. Out of range virtual address on page K 1-7635. 

° Instruction fetches from Device memory on page K1-7635. 

š Programming the CSSELR_EL1.Level for a cache level that is not implemented on page K1-7635. 
. Crossing a page boundary with different memory types or Shareability attributes on page K1-7636. 
. Crossing a peripheral boundary with a Device access on page K1-7636. 


s CONSTRAINED UNPREDICTABLE behaviors with Load-Exclusive/Store-Exclusive pairs on 
page K1-7636. 


$ CONSTRAINED UNPREDICTABLE behavior for A64 instructions on page K1-7637. 

° Out of range values of the Set/Way/Index fields in cache maintenance instructions on page K1-7644. 

. Reserved values in System and memory-mapped registers and translation table entries on page K1-7644. 
° CONSTRAINED UNPREDICTABLE behavior in Debug state on page K1-7645. 


Overview of the constraints on AArch64 UNPREDICTABLE behaviors 


The term UNPREDICTABLE describes a number of cases where the architecture has a feature that software must not 
use. For execution in AArch64 state, the Armv8-A architecture specifies a narrow range of permitted behaviors. 
This range is the range of CONSTRAINED UNPREDICTABLE behavior. All implementations that are compliant with the 
architecture must follow the CONSTRAINED UNPREDICTABLE behavior. 


Note 


Software designed to be compatible with the Armv8-A architecture must not rely on these CONSTRAINED 
UNPREDICTABLE cases being handled in any way other than those listed under the heading CONSTRAINED 
UNPREDICTABLE. 








SBZ or SBO fields in A64 instructions 


Some A64 instructions have (0) or (1) in the instruction decode to indicate should-be-zero, SBZ, or should-be-one, 
SBO, as described in Fixed values in AArch64 instruction and System register descriptions on page C2-185. Except 
for specific cases identified in CONSTRAINED UNPREDICTABLE behaviors with Load-Exclusive/Store-Exclusive 
pairs on page K1-7636, if the instruction bit pattern of an instruction is executed with these fields not having the 
should be values, one of the following must occur: 


s The instruction is UNDEFINED. 

° The instruction executes as a NOP. 

à The instruction operates as if the bit had the should-be value. 

° Any destination registers of the instruction become UNKNOWN. 


CONSTRAINED UNPREDICTABLE behaviors due to caching of control or data values 


The Arm architecture allows copies of control values or data values to be cached in a cache or TLB. This can lead 
to UNPREDICTABLE behavior if the cache or TLB has not been correctly invalidated following a change of the control 
or data values. 
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Unless explicitly stated otherwise, the behavior of the PE is consistent with one of: 


. The old data or control value. 
. The new data or control value. 
. An amalgamation of the old and new data or control values. 


In an implementation that includes ARMv8.2-TTCNP, this CONSTRAINED UNPREDICTABLE case can arise from 
misprogramming when setting TTBR.CnP to 1, as identified in the descriptions of the TTBR.CnP field. In this case, 
for a particular TTBR, the behavior of the PE is consistent with one of: 


è The value of the translation table entry pointed to by that TTBR on one of the PEs within the Inner Shareable 
domain for which both the value of TTBR.CnP is 1 and the other conditions for sharing translation table 
entries pointed to by that TTBR are met. 


a An amalgamation of the values of the translation table entries pointed to by that TTBR on two or more of the 
PEs within the Inner Shareable domain for which both the value of TTBR.CnP is 1 and the other conditions 
for sharing translation table entries pointed to by that TTBR are met. 





Note 


Ifthe Effective value of a control or data value that determines the behavior of the PE results from the amalgamation 
of two or more values then that Effective value must not generate a privilege violation. So, for example: 


7 Where the CONSTRAINED UNPREDICTABLE behavior occurs because inadequate invalidation of the TLB 
causes multiple hits in the TLB, the failure to invalidate the TLB by software executing at a given Exception 
level and Security state must not make it possible to access regions of memory with permissions or attributes 
that could not be accessed at that Exception level and Security state. 


5 Where the CONSTRAINED UNPREDICTABLE behavior occurs because of a programming error, on one or more 
PEs in the Inner Shareable domain, when using a TTBR.CnP value of 1 to share translation table entries, the 
misprogramming must not make it possible to access regions of memory with permissions or attributes that 
could not be accessed at the Exception level of that TTBR and the Security state corresponding to the 
translation table entries being shared. 





Alternatively to this CONSTRAINED UNPREDICTABLE behavior, an implementation detecting multiple hits in a TLB 
might generate an exception, reporting the exception using the TLB conflict fault code, see TLB conflict aborts on 
page D5-2637. 


The choice between the behaviors might, in some implementations, vary for each use of a control or data value. 


K1.2.4 CONSTRAINED UNPREDICTABLE behavior due to inadequate context synchronization 


The Arm architecture requires that changes to System registers must be synchronized before they take effect. This 
can lead to UNPREDICTABLE behavior if the synchronization has not been performed. 


In these cases, the behavior of the PE is consistent with the unsynchronized control value being either the old value 
or the new value. 


Where multiple control values are updated but not yet synchronized, each control value might independently be the 
old value or the new value. 


In addition, where the unsynchronized control value applies to different areas of functionality, or what an 
implementation has constructed as different areas of functionality, those areas might independently treat the control 
value as being either the old value or the new value. 


The choice between these behaviors might, in some implementations, vary for each use of a control value. 
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Translation table base address alignment 


In the translation table base registers TTBRO_EL1, TTBR1 EL1, TTBRO_EL2, VTTBR_EL2, and TTBRO_EL3, 
register bits[48:x] hold the translation table base address, where x depends on the translation table granule size and 
the size of the addressed translation table, as described in Memory translation granule size on page DS-2526. 
Register bits[(x-1):0], unless redefined for another purpose, correspond to bits[(x-1):0] of the translation table base 
address and therefore are RESO. 


Note 


. When ARMv8.2-LPA is implemented and the 64KB granule size is used, register bits[5:2] are redefined to 
hold bits[51:48] of the translation table base address. 





s When ARMv8.2-TTCNP is implemented register bit[0] is redefined as the CnP bit. 





For these registers, if one or more RESO bits in register bits [(x-1):0] does not have a value of 0, this can result in a 
misaligned translation table base address. In this case, one of the following behaviors must occur: 


° The field that is defined to be RESO is treated as if all the bits had a value of 0: 


— The value read back might be the value written or it might be zero. 


. The calculation of an address for a translation table walk using those registers might be corrupted in those 
bits that are nonzero. 


For more information, see the appropriate TTBR.BADDR field description. 


The Performance Monitors Extension 


The following subsections describe CONSTRAINED UNPREDICTABLE behaviors when accessing the Performance 
Monitors Extension in AArch64 state: 


$ CONSTRAINED UNPREDICTABLE accesses to PMXEVTYPER_EL0 or PMXEVETYPER_ELO0. 


` CONSTRAINED UNPREDICTABLE accesses to PMEVCNTR<n>_EL0 and PMEVTYPER<n>_EL0 on 
page K1-7633. 


s CONSTRAINED UNPREDICTABLE behavior caused by MDCR_EL2.HPMN on page K1-7634. 


CONSTRAINED UNPREDICTABLE accesses to PMXEVTYPER_ELO or 
PMXEVETYPER_ELO 


If PMSELR_ELO.SEL is greater than the number of counters accessible at this Exception level, accesses to 
PMXEVTYPER_ ELO and PMXEVCNTR_ELO can cause CONSTRAINED UNPREDICTABLE behavior. This occurs 
when one of the following is true: 


s If PMSELR_ELO.SEL is not equal to 31, and PMSELR_ELO.SEL is greater than or equal to PMCR_ELO.N, 
and the PE is executing in EL2 or EL3. 


à If ARMv8.4-SecEL2 is disabled or is not implemented, PMSELR_ELO.SEL is not 31, and 
PMSELR_ELO.SEL is greater than or equal to PMCR_ELO.N, and the PE is executing in Secure EL1 or 
Secure ELO. 


$ If PMSELR_ELO.SEL is not 31, and PMSELR_ELO.SEL is greater than or equal to MDCR_EL2.HPMN, 
and the PE is executing in ELO or EL1. 


In these cases, one of the following behaviors must occur: 
> Accesses to PMXEVTYPER_ELO or PMXEVCNTR_ELO from that state are UNDEFINED. 
. Accesses to PMXEVTYPER_ELO or PMXEVCNTR_ELO from that state behave as RAZ/WI. 


E Accesses to PMXEVTYPER_EL0 or PMXEVCNTR_ELO from that state execute as NOPs. 
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Accesses to PMXEVTYPER_ ELO or PMXEVCNTR_ELO from that state behave as if PMSELR_ELO.SEL 
contains an UNKNOWN value that is less than the number of counters accessible at the current Exception level 
and Security state. 


Accesses to PMXEVTYPER ELO or PMXEVCNTR_ELO from that state behave as if PMSELR_ELO.SEL 
is 31. 


If EL2 is implemented and enabled in the current Security state, and PMSELR_ELO.SEL is less than the 
number of implemented counters but greater than or equal to the number of accessible counters at this 
Exception level, access to PMXEVTYPER_ELO or PMXEVCNTR_ELO from EL1 or a permitted access 
from ELO is trapped to EL2. 


Note 
If EL2 is implemented and enabled in the current Security state, MDCR_EL2.HPMN identifies the number 
of accessible counters at ELO or EL1. Otherwise, the number of accessible counters is the number of 
implemented counters. 
Accesses from ELO to PMXEVCNTR_ELO are permitted when: 
— ELl is using AArch32 and the values of PMUSERENR. {ER, EN} are both 1. 
— ELI is using AArch64 and the values of PMUSERENR_ELO. {ER, EN} are both 1. 
Accesses from ELO to PMXEVTYPER_ELO are permitted when: 
— ELl is using AArch32 and the value of PMUSERENR.EN is 1. 
— ELl is using AArch64 and the value of PMUSERENR_ELO.EN is 1. 








If PMSELR_ELO.SEL is equal to 31, then one of the following behaviors must occur: 


Accesses to PMXEVCNTR_ELO are UNDEFINED. 
Accesses to PMXEVCNTR_ELO behave as RAZ/WI. 
Accesses to PMXEVCNTR_ELO execute as NOPs. 


Accesses to PMXEVCNTR_ELO behave as if PMSELR_ELO.SEL contains an unknown value that is less 
than the number of counters accessible at the current Exception level and Security state. 


CONSTRAINED UNPREDICTABLE accesses to PMEVCNTR<n>_EL0 and 
PMEVTYPER<n>_EL0 


If <n> is greater than the number of counters available in the current Exception level and state, reads and writes of 
PMEVCNTR<n>_ELO and PMEVTYPER<n>_ELO are CONSTRAINED UNPREDICTABLE, the following behaviors 
are permitted: 
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Accesses to the register are UNDEFINED. 
Accesses to the register behave as RAZ/WI. 
Accesses to the register execute as a NOP. 


If EL2 is implemented and enabled in the current Security state, for an access to PMEVCNTR<n>_ELO or 
PMEVTYPER<n>_ELO from EL1 or a permitted access from ELO, if the counter is implemented but not 
accessible at the current Exception level, the register access is trapped to EL2. 

Accesses from ELO to PMEVCNTR<n>_ELO are permitted when: 

— ELl is using AArch32 and the value of PMUSERENR. {ER, EN} are both 1. 

— ELl is using AArch64 and the value of PMUSERENR_ELO.{ER, EN} are both 1. 

Accesses from ELO to PMEVTYPER<n>_ELO are permitted when: 

— ELl is using AArch32 and the value of PMUSERENR.EN is 1. 

— ELl is using AArch64 and the value of PMUSERENR_ELO.EN is 1. 
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CONSTRAINED UNPREDICTABLE behavior caused by MDCR_EL2.HPMN 


If MDCR_EL2.HPMN is set to 0, or to a value larger than PMCR_ELO.N, then the following CONSTRAINED 
UNPREDICTABLE behavior applies: 


° The value returned by a direct read of MDCR_EL2.HPMN is UNKNOWN. 


° Either: 


— An UNKNOWN number of counters are reserved for EL2 use. That is, the PE behaves as if 
MDCR_EL2.HPMN is set to an UNKNOWN non-zero value less than PMCR_ELO.N. 


—  Allcounters are reserved for EL2 and EL3 use, meaning no counters are accessible from EL1 and ELO. 


K1.2.7 The Activity Monitors Extension 


If <n> is greater than the number of architected activity monitor event counters, reads and writes of 
AMEVCNTRO<n>_EL0 and AMEVTYPERO<n>_ELO are CONSTRAINED UNPREDICTABLE, and the following 
behaviors are permitted: 


s Accesses to the register are UNDEFINED. 

. Accesses to the register behave as RAZ/WI. 

° Accesses to the register execute as a NOP. 
Note 





AMCGCR_ELO.CGONC identifies the number of architected activity monitor event counters. 





If <n> is greater than the number of auxiliary activity monitor event counters, reads and writes of 
AMEVCNTRI<n>_EL0and AMEVTYPER1<n>_EL0 are CONSTRAINED UNPREDICTABLE, and the following 
behaviors are permitted: 


è Accesses to the register are UNDEFINED. 

$ Accesses to the register behave as RAZ/WI. 

. Accesses to the register execute as a NOP. 
Note 





AMCGCR_EL0.CGINC identifies the number of auxiliary activity monitor event counters. 





If the number of auxiliary activity monitor event counters that are implemented is zero, reads and writes of 
AMCNTENCLRI1_ELO and AMCNTENSETO_ELO are CONSTRAINED UNPREDICTABLE, and the following 
behaviors are permitted: 


° Accesses to the register are UNDEFINED. 

. Accesses to the register behave as RAZ/WI. 

. Accesses to the register execute as a NOP. 
Note 





The number of auxiliary activity monitor event counters that are implemented is zero exactly when 
AMCFGR_EL0.NCG == 0b0000. 





K1.2.8 Syndrome register handling for CONSTRAINED UNPREDICTABLE instructions treated as 
UNDEFINED 


When a CONSTRAINED UNPREDICTABLE instruction is treated as UNDEFINED, ESR_ELx is UNKNOWN. 


K1-7634 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Architectural Constraints on UNPREDICTABLE behaviors 
K1.2 AArch64 CONSTRAINED UNPREDICTABLE behaviors 


Note 


The value written to ESR_ELx must be consistent with a value that could be created as the result of an exception 
from the same Exception level that generated the exception, but was the result of a situation that is not CONSTRAINED 
UNPREDICTABLE at that Exception level. This is to avoid a possible privilege violation. 








K1.2.9 Out of range virtual address 


If the PE executes a load or store instruction with tagged addressing disabled in the current translation regime, and 
where the computed virtual address, total access size, and alignment mean that it accesses the bytes at @xFFFF FFFF 
FFFF FFFF and 0x0000 0000 0000 0000, then the bytes that appear to be from 0x0000 0000 0000 0000 onwards are 
accessed at an UNKNOWN address. 


If the PE executes a load or store instruction with tagged addressing enabled in the current translation regime, and 
where the computed address, total access size, and alignment mean that it accesses the bytes at @xFFFF FFFF FFFF 
FFFF and 0x0000 0000 0000 0000, then the bytes that appear to be from 0x0000 0000 0000 0000 onwards are accessed 
at an unknown address and the tags associated with address also become unknown. 





Note 


Because of program counter alignment constraints, it is impossible for a PE to fetch an A64 instruction that includes 
both the byte at virtual address OxFFFF FFFF FFFF FFFF and the byte at virtual address 0x0000 0000 0000 0000. 





K1.2.10 Instruction fetches from Device memory 
Instruction fetches from Device memory are CONSTRAINED UNPREDICTABLE. 


Ifa location in memory has the Device attribute and is not marked as execute-never, then an implementation might 
perform speculative instruction accesses to this memory location at times when address translation is enabled. 


Ifa branch causes the program counter to point to an area of memory with the Device attribute that is not marked 
as execute-never for the current Exception level for instruction fetches, then an implementation must perform one 
of the following behaviors: 


5 It treats the instruction fetch as if it were to a memory location with the Normal, Non-cacheable attribute. 


è It generates a Permission fault. 


K1.2.11 Programming the CSSELR_EL1.Level for a cache level that is not implemented 


If the CSSELR_EL1.Level is programmed to a cache level that is not implemented, then a read of CSSELR_EL1 
returns an UNKNOWN value in CSSELR_EL1.Level. 


If CSSELR_EL1.Level is programmed to a cache level that is not implemented, then on a read of CCSIDR_EL1 an 
implementation must perform one of the following behaviors: 


à The CCSIDR_ELI read is treated as a NOP. 
° The CCSIDR_EL1 read is UNDEFINED. 
è The CCSIDR_EL!1 read returns an UNKNOWN value. 


When ARMv8.3-CCIDX is implemented, CCSIDR2_EL1 is implemented. If CSSELR_EL1.Level is programmed 
to a cache level that is not implemented, then on a read of CCSIDR2_EL1 an implementation must perform one of 
the following behaviors: 


s The CCSIDR2_ EL]! read is treated as a NOP. 
° The CCSIDR2_EL1 read is UNDEFINED. 
è The CCSIDR2_ELI read returns an UNKNOWN value. 
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K1.2.12 


K1.2.13 


K1.2.14 


K1-7636 


Crossing a page boundary with different memory types or Shareability attributes 


A memory access from a load or store instruction that crosses a page boundary to a memory location that has a 
different memory type or Shareability attribute results in CONSTRAINED UNPREDICTABLE behavior. In this case, the 
implementation must perform one of the following behaviors: 


e All memory accesses generated by the instruction use the memory type and Shareability attributes associated 
with the first address accessed by the instruction. 


° All memory accesses generated by the instruction use the memory type and Shareability attributes associated 
with the last address accessed by the instruction. 


à Each memory access generated by the instruction uses the memory type and Shareability attribute associated 
with its own address. 


° The instruction generates an Alignment fault caused by the memory type. 
For the EL1&0 translation regime, when EL2 is enabled in the current Security state: 
— Ifthe stage 1 translation generated the mismatch then the resulting exception is taken to EL1. 
— Ifthe stage 2 translation generated the mismatch then the resulting exception is taken to EL2. 


— Ifboth stages of translation generate the mismatch then the exception can be taken to either EL1 or 
EL2. 


. The instruction executes as a NOP. 


Crossing a peripheral boundary with a Device access 


Performing memory accesses from one load or store instruction to Device memory that crosses a boundary 
corresponding to the smallest translation granule size of the implementation causes CONSTRAINED UNPREDICTABLE 
behavior. In this case, the implementation performs one of the following behaviors: 


° All memory accesses generated by the instruction are performed as if the boundary has no effect on the 
memory accesses. 


s All memory accesses generated by the instruction are performed as if the boundary has no effect on the 
memory accesses except that there is no guarantee of ordering between memory accesses. 

2 The instruction generates an alignment fault caused by the memory type. 
For the EL1&0 translation regime, when EL2 is enabled in the current Security state: 
— Ifthe stage | translation causes the boundary to be crossed then the resulting exception is taken to EL1. 
— Ifthe stage 2 translation causes the boundary to be crossed then the resulting exception is taken to EL2. 


—  Ifboth stages of translation cause the boundary to be crossed then the resulting exception can be taken 
to either EL1 or EL2. 





è The instruction executes as a NOP. 
Note 
The boundary referred to is between two Device memory regions that are both: 
° Of the size of the smallest implemented translation granule. 
š Aligned to the size of the smallest implemented translation granule. 


CONSTRAINED UNPREDICTABLE behaviors with Load-Exclusive/Store-Exclusive pairs 


Load-Exclusive and Store-Exclusive instruction usage restrictions on page B2-163 defines a 
Load-Exclusive/Store-Exclusive pair, and identifies various CONSTRAINED UNPREDICTABLE behaviors associated 
with using Load-Exclusive/Store-Exclusive pairs. In summary, these cases are: 


$ The target virtual address of a StoreExcl instruction is different from the virtual address of the preceding 
LoadExcl instruction in the same thread of execution. 
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è The transaction size ofa StoreExc] instruction is different from the transaction size of the preceding LoadExc1 
instruction in the same thread of execution. 


7 The StoreExcl instruction accesses a different number of registers than the preceding LoadExc] instruction in 
the same thread of execution. 


è The memory attributes for a StoreExc] instruction are different from the memory attributes for the preceding 
LoadExcl instruction in the same thread of execution, either: 


— Because the translation of the accessed address changes between the LoadExc] instruction and the 
StoreExcl instruction. 


— Because the LoadExc] instruction and the StoreExcl instruction use different virtual addresses, with 
different attributes, that point to the same physical address. 


In addition, the effect of a data or unified cache invalidate, clean, or clean and invalidate instruction on a local or 
global Exclusives monitor that is in the Exclusive Access state is CONSTRAINED UNPREDICTABLE. 


See the descriptions in Load-Exclusive and Store-Exclusive instruction usage restrictions on page B2-163 for the 
permitted behavior in each of these cases, and any constraints that might apply to whether the case is CONSTRAINED 
UNPREDICTABLE. 


K1.2.15 CONSTRAINED UNPREDICTABLE behavior for A64 instructions 


ARM DDI 0487E.a 
ID070919 


This section lists the CONSTRAINED UNPREDICTABLE behavior for the different A64 instructions listed in Chapter C6 
A64 Base Instruction Descriptions and Chapter C7 A64 Advanced SIMD and Floating-point Instruction 
Descriptions. 


LDAXP 


For a description of this instruction and the encoding, see LDAXP on page C6-942. 


CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


: The instruction is UNDEFINED. 

7 The instruction executes as a NOP. 

s The instruction performs a load using the specified addressing mode, and the transfer register is set to an 
UNKNOWN value. 

LDNP 


For a description of this instruction and the encoding, see LDNP on page C6-968. 


CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 

7 The instruction executes as a NOP. 

° The instruction performs a load using the specified addressing mode, and the transfer register is set to an 
UNKNOWN value. 


LDNP (SIMD&FP) 


For a description of this instruction and the encoding, see LDNP (SIMD&FP) on page C7-1794. 


CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
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è The instruction performs a load using the specified addressing mode, and the transfer register is set to an 
UNKNOWN value. 


LDP 


For a description of this instruction and the encoding, see LDP on page C6-970. 


CONSTRAINED UNPREDICTABLE behavior 


If the instruction encoding specifies pre-indexed addressing or post-indexed addressing, and (t == n || t2 == n) 
&& n != 31, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
° The instruction performs a load using the specified addressing mode, and the base register is set to an 


UNKNOWN value. In addition, if an exception occurs during such an instruction, the base register might be 
corrupted so that the instruction cannot be repeated. 


If t == t2, then one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
$ The instruction executes as a NOP. 
7 The instruction performs all of the loads using the specified addressing mode, and the transfer register is set 


to an UNKNOWN value. 


Note 


Pre-indexed addressing and post-indexed addressing imply writeback. 








LDP (SIMD&FP) 


For a description of this instruction and the encoding, see LDP (SIMD&FP) on page C7-1796. 


CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


: The instruction is UNDEFINED. 

7 The instruction executes as a NOP. 

s The instruction performs a load using the specified addressing mode, and the transfer register is set to an 
UNKNOWN value. 

LDPSW 


For a description of this instruction and the encoding, see LDPSW on page C6-973. 


CONSTRAINED UNPREDICTABLE behavior 


If the instruction encoding specifies pre-indexed addressing or post-indexed addressing, and (t == n || t2 == n) 
&& n != 31, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
$ The instruction executes as a NOP. 
° The instruction performs a load using the specified addressing mode, and the base register is set to an 


UNKNOWN value. In addition, if an exception occurs during such an instruction, the base register might be 
corrupted so that the instruction cannot be repeated. 


If t == t2, then one of the following behaviors must occur: 


è The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
° The instruction performs all of the loads using the specified addressing mode, and the register loaded is set 


to an UNKNOWN value. 
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Note 


Pre-indexed addressing and post-indexed addressing imply writeback. 








LDR (immediate) 


For a description of this instruction and the encoding, see LDR (immediate) on page C6-976. 


CONSTRAINED UNPREDICTABLE behavior 


If the instruction encoding specifies pre-indexed addressing or post-indexed addressing, and n == t & n != 31, then 
one of the following behaviors must occur: 


$ The instruction is UNDEFINED. 
7 The instruction executes as a NOP. 
s The instruction performs the load using the specified addressing mode, and the base register is set to an 


UNKNOWN value. In addition, if an exception occurs during such an instruction, the base register might be 
corrupted so that the instruction cannot be repeated. 


Note 


Pre-indexed addressing and post-indexed addressing imply writeback. 








LDRB (immediate) 


For a description of this instruction and the encoding, see LDRB (immediate) on page C6-985. 


CONSTRAINED UNPREDICTABLE behavior 


If the instruction encoding specifies pre-indexed addressing or post-indexed addressing, and n == t & n != 31, then 
one of the following behaviors must occur: 


- The instruction is UNDEFINED. 
è The instruction executes as a NOP. 
i The instruction performs the load using the specified addressing mode, and the base register is set to an 


UNKNOWN value. In addition, if an exception occurs during such an instruction, the base register might be 
corrupted so that the instruction cannot be repeated. 


Note 
Pre-indexed addressing and post-indexed addressing imply writeback. 








LDRH (immediate) 


For a description of this instruction and the encoding, see LDRH (immediate) on page C6-990. 


CONSTRAINED UNPREDICTABLE behavior 


Ifthe instruction encoding specifies pre-indexed addressing or post-indexed addressing, and n == t & n != 31, then 
one of the following behaviors must occur: 


à The instruction is UNDEFINED. 
è The instruction executes as a NOP. 
$ The instruction performs the load using the specified addressing mode, and the base register is set to an 


UNKNOWN value. In addition, if an exception occurs during such an instruction, the base register might be 
corrupted so that the instruction cannot be repeated. 


Note 


Pre-indexed addressing and post-indexed addressing imply writeback. 
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K1-7640 


LDRSB (immediate) 


For a description of this instruction and the encoding, see LDRSB (immediate) on page C6-995. 


CONSTRAINED UNPREDICTABLE behavior 


Ifthe instruction encoding specifies pre-indexed addressing or post-indexed addressing, and n == t & n != 31, then 
one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
è The instruction executes as a NOP. 
è The instruction performs the load using the specified addressing mode, and the base register is set to an 


UNKNOWN value. In addition, if an exception occurs during such an instruction, the base register might be 
corrupted so that the instruction cannot be repeated. 


Note 
Pre-indexed addressing and post-indexed addressing imply writeback. 





LDRSH (immediate) 


For a description of this instruction and the encoding, see LDRSH (immediate) on page C6-1000. 


CONSTRAINED UNPREDICTABLE behavior 


Ifthe instruction encoding specifies pre-indexed addressing or post-indexed addressing, and n == t & n != 31, then 
one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
` The instruction executes as a NOP. 
à The instruction performs the load using the specified addressing mode, and the base register is set to an 


UNKNOWN value. In addition, if an exception occurs during such an instruction, the base register might be 
corrupted so that the instruction cannot be repeated. 


Note 


Pre-indexed addressing and post-indexed addressing imply writeback. 








LDRSW (immediate) 


For a description of this instruction and the encoding, see LDRSW (immediate) on page C6-1005. 


CONSTRAINED UNPREDICTABLE behavior 


Ifthe instruction encoding specifies pre-indexed addressing or post-indexed addressing, and n == t & n != 31, then 
one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
7 The instruction executes as a NOP. 
° The instruction performs the load using the specified addressing mode, and the base register is set to an 


UNKNOWN value. In addition, if an exception occurs during such an instruction, the base register might be 
corrupted so that the instruction cannot be repeated. 


Note 


Pre-indexed addressing and post-indexed addressing imply writeback. 








LDXP 


For a description of this instruction and the encoding, see LDXP on page C6-1067. 
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CONSTRAINED UNPREDICTABLE behavior 


If t == t2, then one of the following behaviors must occur: 


5 The instruction is UNDEFINED. 

$ The instruction executes as a NOP. 

7 The instruction performs a load using the specified addressing mode, and the transfer register is set to an 
UNKNOWN value. 

STP 


For a description of this instruction and the encoding, see STP on page C6-1236. 


CONSTRAINED UNPREDICTABLE behavior 


If the instruction encoding specifies pre-indexed addressing or post-indexed addressing, and (t == n || t2 == n) 
&& n != 31, then one of the following behaviors must occur: 


7 The instruction is UNDEFINED. 

s The instruction executes as a NOP. 

. The instruction performs a store using the specified addressing mode but the value stored is UNKNOWN. 
Note 





Pre-indexed addressing and post-indexed addressing imply writeback. 





STLXP 


For a description of this instruction and the encoding, see STLXP on page C6-1225. 


CONSTRAINED UNPREDICTABLE behavior 


Ifs == t || (s == t2), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as a NOP. 
° The instruction performs the store to the specified address, but the value stored is UNKNOWN. 


Ifs == n & n != 31 then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 

. The instruction executes as a NOP. 

° The instruction performs the store to an UNKNOWN address. 
STLXR 


For a description of this instruction and the encoding, see STLXR on page C6-1228. 


CONSTRAINED UNPREDICTABLE behavior 


Ifs == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
° The instruction performs the store to the specified address, but the value stored is UNKNOWN. 


Ifs == n & n != 31 then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
e The instruction executes as a NOP. 
: The instruction performs the store to an UNKNOWN address. 
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STLXRB 


For a description of this instruction and the encoding, see STLXRB on page C6-1230. 


CONSTRAINED UNPREDICTABLE behavior 


Ifs == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
° The instruction performs the store to the specified address, but the value stored is UNKNOWN. 


Ifs == n & n != 31 then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

° The instruction executes as a NOP. 

° The instruction performs the store to an UNKNOWN address. 
STLXRH 


For a description of this instruction and the encoding, see STLXRH on page C6-1232. 


CONSTRAINED UNPREDICTABLE behavior 


Ifs == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
° The instruction performs the store to the specified address, but the value stored is UNKNOWN. 


If s == n & n != 31 then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
° The instruction performs the store to an UNKNOWN address. 


STR (immediate) 


For a description of this instruction and the encoding, see STR (immediate) on page C6-1239. 


CONSTRAINED UNPREDICTABLE behavior 


Ifthe instruction encoding specifies pre-indexed addressing or post-indexed addressing, and n == t & n != 31, then 
one of the following behaviors must occur: 


. The instruction is UNDEFINED. 

s The instruction executes as a NOP. 

è The instruction performs a store using the specified addressing mode but the value stored is UNKNOWN. 
Note 





Pre-indexed addressing and post-indexed addressing imply writeback. 





STRB (immediate) 


For a description of this instruction and the encoding, see STRB (immediate) on page C6-1244. 


CONSTRAINED UNPREDICTABLE behavior 


If the instruction encoding specifies pre-indexed addressing or post-indexed addressing, and n == t & n != 31, then 
one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as a NOP. 
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° The instruction performs a store using the specified addressing mode but the value stored is UNKNOWN. 


Note 


Pre-indexed addressing and post-indexed addressing imply writeback. 








STRH (immediate) 


For a description of this instruction and the encoding, see STRH (immediate) on page C6-1249. 


CONSTRAINED UNPREDICTABLE behavior 


Ifthe instruction encoding specifies pre-indexed addressing or post-indexed addressing, and n == t & n != 31, then 
one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

è The instruction executes as a NOP. 

s The instruction performs a store using the specified addressing mode but the value stored is UNKNOWN. 
Note 





Pre-indexed addressing and post-indexed addressing imply writeback. 





STXP 


For a description of this instruction and the encoding, see STXP on page C6-1294. 


CONSTRAINED UNPREDICTABLE behavior 


Ifs == t || (s == t2), then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
° The instruction performs the store to the specified address, but the value stored is UNKNOWN. 


Ifs == n & n != 31 then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

. The instruction executes as a NOP. 

° The instruction performs the store to an UNKNOWN address. 
STXR 


For a description of this instruction and the encoding, see STXR on page C6-1297. 


CONSTRAINED UNPREDICTABLE behavior 


Ifs == t, then one of the following behaviors must occur: 


7 The instruction is UNDEFINED. 
è The instruction executes as a NOP. 
° The instruction performs the store to the specified address, but the value stored is UNKNOWN. 


Ifs == n & n != 31then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 

. The instruction executes as a NOP. 

° The instruction performs the store to an UNKNOWN address. 
STXRB 


For a description of this instruction and the encoding, see STXRB on page C6-1299. 
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K1.2.17 


K1-7644 


CONSTRAINED UNPREDICTABLE behavior 


Ifs == t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
. The instruction executes as a NOP. 
° The instruction performs the store to the specified address, but the value stored is UNKNOWN. 


Ifs == n & n != 31 then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 

. The instruction executes as a NOP. 

° The instruction performs the store to an UNKNOWN address. 
STXRH 


For a description of this instruction and the encoding, see STXRH on page C6-1301. 


CONSTRAINED UNPREDICTABLE behavior 


If s = t, then one of the following behaviors must occur: 


° The instruction is UNDEFINED. 
° The instruction executes as a NOP. 
° The instruction performs the store to the specified address, but the value stored is UNKNOWN. 


Ifs == n & n != 31 then one of the following behaviors must occur: 


. The instruction is UNDEFINED. 
. The instruction executes as a NOP. 
° The instruction performs the store to an UNKNOWN address. 


Out of range values of the Set/Way/Index fields in cache maintenance instructions 


In the cache maintenance by set/way instructions DC CISW, DC CSW, and DC ISW, if any set/way/index argument 
is larger than the value supported by the implementation, then the behavior is CONSTRAINED UNPREDICTABLE and 
one of the following occurs: 


$ The instruction is UNDEFINED. 

: The instruction performs cache maintenance on one of: 
—  Nocache lines. 
— A single arbitrary cache line. 
— _ Multiple arbitrary cache lines. 


Note 


This CONSTRAINED UNPREDICTABLE behavior applies, also, to the AArch32 cache maintenance by set/way 
instructions DCCISW, DCCSW, and DCISW. 








Reserved values in System and memory-mapped registers and translation table entries 


Unless otherwise stated in this manual, all unallocated or reserved values of fields with allocated values within 
AArch64 System registers, memory-mapped registers, and translation table entries behave in one of the following 
ways: 


è The unallocated value maps onto any of the allocated values, but otherwise does not cause CONSTRAINED 
UNPREDICTABLE behavior. 


. The unallocated value causes effects that could be achieved by a combination of more than one of the 
allocated values. 


. The unallocated value causes the field to have no functional effect. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Architectural Constraints on UNPREDICTABLE behaviors 
K1.2 AArch64 CONSTRAINED UNPREDICTABLE behaviors 





Note 


These constraints are identical to those for the equivalent AArch32 definitions, as given in Reserved values in 
System and memory-mapped registers and translation table entries on page K1-7628. 


K1.2.18 CONSTRAINED UNPREDICTABLE behavior in Debug state 


Behavior in Debug state on page H2-6714 of this manual describes the CONSTRAINED UNPREDICTABLE behaviors 
that are specifically associated with Debug state. 
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This appendix describes the recommended external debug interface. It contains the following sections: 
$ About the recommended external debug interface on page K2-7648. 

7 PMUEVENT bus on page K2-7652. 

. Recommended authentication interface on page K2-7653. 

. Management registers and CoreSight compliance on page K2-7655. 





Note 


This recommended external debug interface specification is not part of the Arm architecture specification. 
Implementers and users of the Armv8 architecture must not consider this appendix as a requirement of the 
architecture. It is included as an appendix to this manual only: 

: As reference material for users of Arm products that implement this interface. 

à As an example of how an external debug interface might be implemented. 


The inclusion of this appendix is no indication of whether any Arm products might, or might not, implement this 
external debug interface. For details of the implemented external debug interface you must always see the 
appropriate product documentation. 
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K2.1 About the recommended external debug interface 

See the Note on the first page of this appendix for information about the architectural status of this recommended 
debug interface. 
This specification provides a recommended external debug interface for Armv8 to define a standard set of 
connections for validation environments. In general, the connection between components, such as between the PE 
and Trace extension, is not described here, although the table does include the signals for the CTI connection. 
Table K2-1 shows the signals in the recommended interface. 

Table K2-1 Recommended debug interface signals 

Name Direction Description Notes 

DBGEN In External debug enable - 

SPIDEN In Secure privileged external debug enable - 

Secure privileged self-hosted debug Only in Secure AArch32 modes when 
enable enabled by MDCR_EL3.SPD32 

NIDEN In External profiling and trace enable If ARMv8.4-Debug is implemented, this 
signal is not implemented. 

SPNIDEN In Secure external profiling and trace enable If ARMv8.4-Debug is implemented, this 
signal is not implemented. 

EDBGRQ In External halt request IMPLEMENTATION DEFINED mechanism to 
halt the PE. See EDBGRO and DBGACK on 
page K2-7651. 

DBGACK Out Debug Acknowledge Indicate to the system that a PE is in Debug 
state. See EDBGRO and DBGACK on 
page K2-7651. 

COMMIRQ Out DCC interrupt Interface to an interrupt controller. See 
Interrupt-driven use of the DCC on 
page H4-6786 and the pseudocode for 
function CheckForDCCInterrupts(). 

PMUIRQ Out Performance Monitor overflow Interface to an interrupt controller. See 
Behavior on overflow on page D7-2675. 

COMMRX Out DTRRxX is full Provided for legacy connection to an 

interrupt controller only. See 

COMMTX Out DTRTX is empty Interrupt-driven use of the DCC on 
page H4-6786 and the pseudocode for 
function CheckForDCCInterrupts(). 

PMUEVENT/[n:0] Out Performance Monitors event bus See PMUEVENT bus on page K2-7652. 

DBGNOPWRDWN Out Emulate low-power state request Interface to a power controller. 
See Emulating low-power states on 
page H6-6811. 

DBGPWRUPREQ Out Core powerup request Interface to a power controller. 
See Powerup request mechanism on 
page H6-6810. 

DBGRSTREQ Out Warm reset request Interface to a power controller. 
See EDPRCR.CWRR. 
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K2.1 About the recommended external debug interface 


Table K2-1 Recommended debug interface signals (continued) 










































































Name Direction Description Notes 
DBGBUSCANCELREQ Out Allow asynchronous entry to Debug state Extension to the bus interface. 
See EDRCR.CBRRQ. 
DBGPWRDUP In Core powerup status Interface to a power controller. 
See EDPRSR.PU. 
DBGROMADDRJIn:12] In MDRAR_EL!1.ROMADDR n depends on the size of the physical address 
space. 
DBGROMADDRV In MDRAR ELI.Valid - 
PRESETDBG In External debug reset - 
CPUPORESET In Cold reset - 
CORERESET In Warm reset - 
PSELDBG In 
PENABLEDBG In 
PWRITEDBG In For details see AMBA APB3. Arm 
recommends a single slave port for all 
PRDATADBG[31:0] Out integrated debug components. 
PWDATADBG)31:0] In PADDRDBG31 distinguishes 
memory-mapped and Debug Access Port 
PADDRDBGjn:2]@ In Debug APB slave port accesses: 
0 Memory-mapped access 
PREADYDBG Ont 1 Debug Access Port access 
PSLVERRDBG Out If ARMv8.4-Debug is implemented, 
PPROTDBG[1] distinguishes between 
PCLKDBG In Secure and Non-secure accesses. 
PCLKENDBG In 
PPROTDBG[1] In 
CTICHIN In CoreSight channel interface For details, see the Arm® CoreSight™ 
Architecture Specification. The ACK signals 
CTICHOUTACK In are not required if the channel interface is 
CTICHOUT Out syačhronoug, 
CTICHINACK Out 
CTIIRQ Out CTI interrupt, see Description and Implements a handshake for an 
allocation of CTI triggers on edge-sensitive interrupt. 
CTIIRQACK In 
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Table K2-1 Recommended debug interface signals (continued) 



































Name Direction Description 
ATDATA[nx8-1:0] Out AMBA 4 ATB interface 
ATBYTES[n-1:0] Out 

ATID[6:0] Out 

ATREADY In 

ATVALID Out 

AFREADY Out 

AFVALID Out 

SYNCREQ In 

ATCLK In 

ATCLKEN In 

ATRESET In 


Notes 


For details, see the AMBA 4 ATB Protocol 
Specification, ATBv1.0 and ATBv1.1. Only 
available if the OPTIONAL Trace extension is 
implemented. 





a. The value of n depends on the size of the address space occupied by the Debug port. 
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Figure K2-1 shows the recommended debug interface. 





























DBGEN > 
Authentication SPIDEN > 
interface NIDEN >| 
—-SPNIDEN———_» 
pec +——_COMMTx————+ 
<+——_COMMRX———_F 
handshake 
<+——_COMMIRQ———— 
Run-control +——YDBGACk———_, 
interface ————EDBGRQ———>| 
+—DBGNOPWRDWN—— 
DBGPWRDUP——> 
<+—DBGPWRUPREQ—_ 
esta <——_DBGRSTREQ——_ 
interface —CPUPORESET——» 
CORERESET——» 
PRESETDBG———_>, 
—— ATRESET———» 
—CTICHIN———> 
——CTICHOUTACK——=> 
Cross-trigger <+——CTICHOUT———— 
channel interface) <q———CTICHINACK: 
< CTIIRQ 
CTIIRQACK———»>, 








Processing 
element 


\<——_PSELDBG—__- 
\¢———PADDRDBG 
PRDATADBG ——> 
¢——PWDATADBG —— 
}¢——_PENABLEDBG—_— 
PREADYDBG——_»> 
t+ PSLVERRDBG-——_> 
}¢——_PWRITEDBG 
}¢——_PCLKDBG 
}¢——_PCLKENDBG. 
}¢———PPROTDBG: 








Debug slave 
port, APB4 

















PMUEVENT——»> _ P 
PMUIRA— > ! 


Interface 
-DBGBUSCANCELREQ> 


\4—DBGROMADDR=—— ` 
\« _DBGROMADDRV— _ 


ATID — ` 
L ATDATA —> 
ATBYTES———> 
|¢ ———ATREADY —— 
L ATVALID ———_» 
AFREADY———> 
le——AFVALID —— 
p ATCLK 

|¢ ——_ATCLKEN———_ 
le——SYNCREQ 





Configuration 





Trace port, 
AMBA ATB 

















Figure K2-1 Recommended external debug interface, including the APB3 slave port 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 
ID070919 


Recommended External Debug Interface 
K2.1 About the recommended external debug interface 


K2.1.1 EDBGRQ and DBGACK 


EDBGRQ is an IMPLEMENTATION DEFINED means of generating the External Debug Request debug event described 
in External Debug Request debug event on page H3-6761. 


The PE asserts DBGACK when the PE is in Debug state. The PE might also include variants of this signal: 
DBGTRIGGER 


Asserted by the PE when it commits to entering Debug state. 


DBGCPUDONE 


Asserted by the PE when it has completed all Non-debug state memory accesses and Debug state 
entry is complete. DBGCPUDONE indicates that memory accesses issued by the PE result from 
operations originating from debugger commands. 


In previous architecture versions, these signals provide an interface between the PE and cross-trigger logic. In 
Armv§8, the architectural Cross-Trigger Interface provides this functionality for external debuggers. 


K2.1.2 Secure and Non-secure views of the debug registers 


ARM DDI 0487E.a 
ID070919 


If ARMv8.4-Debug is implemented, the external debug interface has views of Secure and Non-secure debug 
registers. The DAP is must ensure that accesses are made only when permitted. The Arm debug interface describes 
a standard APB-AP programmers model for APB4 which signals Secure and Non-secure accesses on the 
PPROTDBG[1] signal, and is recommended for new designs. 


If ARMv8.4-Debug is implemented, and an APB-AP implements an APB3 master port, which does not support 
Secure and Non-secure views, Arm recommends that the following is implemented: 


° If SPIDEN is HIGH and DBGEN is HIGH, all external debug accesses area treated as Secure. 
e If either SPIDEN is LOW or DBGEN is LOW, all external debug accesses are treated as Non-secure. 


Ifthe PE APB slave port is APB4, this might be implemented by, for example, fixing PPROTDBG[1] to the inverse 
of (SPIDEN & DBGEN) when bridging from APB3 to APB4. 
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K2.2 PMUEVENT bus 


The PMUEVENT bus exports Performance Monitor events from the PE to an on-chip agent. Arm recommends that 
it has the following characteristics: 


° The bus is synchronous. 

° The width of the bus is IMPLEMENTATION DEFINED. 

. It is IMPLEMENTATION DEFINED which events are exported on the bus. 

° Each exported event occupies a contiguous sub-field of the bus. Arm recommends that the sub-fields of the 


bus are occupied in the same order as the event numbers. 


° If the event can only occur once per cycle, it occupies a single bit. If the event can occur more than once per 
cycle, it is IMPLEMENTATION DEFINED how the event is encoded. The encoding depends on constraints such 
as the designated use of the event bus and the number of pins available. For example, the event can be 
encoded: 


—  Asacount, using a plain binary number. This is the most useful encoding when exporting to an 
external counter. It is not a useful encoding for exporting to a Trace extension external input. 
— Asa count, using thermometer encoding. This is the most useful encoding when exporting to a Trace 


extension. 


— Using a single bit encoding to indicate whether the event count is zero or nonzero. This is useful for 
exporting to an activity monitor where the number of pins is constrained. 


If a Trace extension is implemented, the PMUEVENT bus is normally connected to the Trace extension using the 
external inputs. TRCEXTINSELR multiplexes a wide PMUEVENT bus to a narrow set of inputs. An external 
PMUEVENT bus might also be provided. For more information, contact Arm. 
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K2.3 Recommended authentication interface 

An implementation of the Armv8 architecture must support debug authentication described in Required debug 
authentication on page H1-6702. 
The details of the debug authentication interface are IMPLEMENTATION DEFINED, but Arm recommends the use of 
the CoreSight interface, which includes the following signals for external debug authentication: 
° DBGEN. 
7 SPIDEN. 
If ARMv8.4-Debug is not implemented, Arm also recommends using the following signals: 
° NIDEN. 
° SPNIDEN. 
Arm recommends an interface in which DBGEN and SPIDEN are also used for self-hosted Secure debug 
authentication if either: 
s EL3 is using AArch32 and SDCR.SPD == 0b00. 
à Secure EL1 is using AArch32 and MDCR_EL3.SPD32 == 0b00. 
If EL3 is not implemented and the PE is in Non-secure state, SPIDEN and SPNIDEN are not implemented, and the 
PE behaves as if these signals were tied LOW. 
If EL3 is not implemented and the PE is in Secure state, SPIDEN is usually connected to DBGEN and SPNIDEN 
is connected to NIDEN, but this is not required. The recommended interface is defined as if all four signals are 
implemented. 
How the authentication signals are driven is IMPLEMENTATION DEFINED. For example, the signals might be 
hard-wired, connected to fuses, or to an authentication module. The architecture permits PEs within a cluster to have 
independent authentication interfaces, but this is not required. Arm recommends that any Trace extension has the 
same authentication interface as the PE it is connected to. 
If ARMv8.4-Debug and CoreSight ETR are both implemented, the ETR has an independent DBGEN signal that 
must be tied HIGH to enable self-hosted use of trace. 
Table K2-2 shows the debug authentication pseudocode functions and the recommended implementations. 

Table K2-2 Recommended implementation of debug enable pseudocode functions 

Pseudocode function Description Implementation 





AArch32.SelfHostedSecurePrivilegedInvasiveDebugEnabled() Secure invasive self-hosted debug (DBGEN AND SPIDEN) 


enabled in AArch32 state (legacy) 

















ExternalSecureNoninvasiveDebugEnabled()@ Secure non-invasive debug enabled (DBGEN OR NIDEN?) 
AND (SPIDEN OR 
SPNIDEN*) 
External SecureInvasiveDebugEnab1ed() Secure invasive debug enabled (DBGEN AND SPIDEN) 
ExternalNoninvasiveDebugEnabled()4 Non-secure non-invasive debug (DBGEN OR NIDEN?) 
enabled 
External InvasiveDebugEnabled() Non-secure invasive debug enabled DBGEN 
a. If ARMv8.4-Debug is implemented, ExternalSecureNoninvasiveDebugEnabled() == ExternalSecureInvasiveDebugEnabled(). 
b. If ARMv8.4-Debug is implemented, the NIDEN signal is not implemented. 


a 9 


If ARMVv8.4-Debug is implemented, the SPNIDEN signal is not implemented. 
If ARMv8.4-Debug is implemented, ExternalNoninvasiveDebugEnabled() == TRUE. 
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The Debug_authentication() pseudocode function on shared/debug on page J1-7493 defines the authentication 
signals DBGEN, SPIDEN, NIDEN and SPNIDEN. 
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K2.4 Management registers and CoreSight compliance 




































































K2.4 Management registers and CoreSight compliance 
The CoreSight architecture requires the implementation of a set of management registers that occupy the memory 
map from @xFQ0 upwards in each of the debug components. 
CoreSight compliance and complete implementation of the management registers is OPTIONAL, but Arm 
recommends that the registers are implemented. 
The CoreSight architecture specification recommends that any integration test registers are implemented starting 
from @xEFC downwards. Each of the debug components has an IMPLEMENTATION DEFINED region from 0xE80 to 
@xEFC for this purpose. 
K2.4.1 CoreSight interface register map 
Table K2-3 shows the external management register maps for the following registers: 
ED These are the external debug register. 
CTI These are the Cross-trigger interface registers. 
PMU These are the Performance Monitors registers. 
Table K2-3 CoreSight interface register map 
Mnemonic 
Offset Name 
ED CTI PMU 
OxF00 EDITCTRL CTIITCTRL PMITCTRL Integration Model Control registers 
0xF04-0xF9C - - - Reserved, RESO 
OxFAQ DBGCLAIMSET EL14 CTICLAIMSET?® - CLAIM Tag Set registers 
OxFA4 DBGCLAIMCLR EL14 CTICLAIMCLR® - CLAIM Tag Clear registers 
OxFA8 EDDEVAFF0? CTIDEVAFF0¢ PMDEVAFFO Device Affinity registers 
OxFAC EDDEVAFF 14 CTIDEVAFF 1° PMDEVAFF 1 
OxFBO EDLAR4 CTILAR¢ PMLAR4 Lock Access register 
@xFB4 EDLSR¢ CTILSR4 PMLSR4 Lock Status register 
@XFB8 DBGAUTHSTATUS_EL1# =. CTIAUTHSTATUS PMAUTHSTATUS Authentication Status register 
OxFBC EDDEVARCH CTIDEVARCH PMDEVARCH Device Architecture register 
@xFCO EDDEVID28 CTIDEVID24 - Device ID register 
OxFC4 EDDEVID18 CTIDEVID14 - 
OxFC8 EDDEVID# CTIDEVID? PMDEVID» € 
OxFCC EDDEVTYPE CTIDEVTYPE PMDEVTYPE Device Type register 
OxFDO EDPIDR4 CTIPIDR4 PMPIDR4 Peripheral ID registers 
0xFD4-0xFDC - - - Reserved, RESO 
OxFEQ EDPIDRO CTIPIDRO PMPIDRO Peripheral ID registers 
OxFE4 EDPIDR1 CTIPIDRI1 PMPIDR1 
OxFE8 EDPIDR2 CTIPIDR2 PMPIDR2 
OxFEC EDPIDR3 CTIPIDR3 PMPIDR3 
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Table K2-3 CoreSight interface register map (continued) 

















Mnemonic 
Offset Name 
ED CTI PMU 
OxFFO EDCIDRO CTICIDRO PMCIDRO Component ID registers 
OxFF4 EDCIDR1 CTICIDR1 PMCIDR1 
OxFF8 EDCIDR2 CTICIDR2 PMCIDR2 
OxFFC EDCIDR3 CTICIDR3 PMCIDR3 





a. This register must always be implemented, regardless of whether the component is CoreSight compliant. 

b. Ifimplemented, the number of CLAIM bits is IMPLEMENTATION DEFINED and can be discovered by reading CLAIMSET. 
c. Ifthe CTI implements CTIv1, this register is not implemented. See the register description for details. 

d 


. The Software lock registers are defined as part of CoreSight compliance, but their contents depend on the type of access that is made and 
whether the OPTIONAL Software lock is implemented. See the register description for details. 


e. PMDEVID is implemented only from Armv8.2 or if ARMv8.2-PCSample is implemented, otherwise its offset is RESO. 


K2.4.2 Management register access permissions 
Access to the OPTIONAL Integration Control register (ITCTRL) is IMPLEMENTATION DEFINED. 


If the Debug power domain is off, all register accesses return an error. 


Otherwise, Table K2-4 on page K2-7657, Table K2-5 on page K2-7658, and Table K2-6 on page K2-7659 show the 
response to accesses by the external debug interface to the CoreSight management registers. For definitions of the 
terms used in the tables, see External debug interface register access permissions summary on page H8-6837. 





Note 
Access to the CoreSight management registers is not affected by the values of EDAD and EPMAD. 





Table K2-4 on page K2-7657, Table K2-5 on page K2-7658, and Table K2-6 on page K2-7659 include reserved 
management registers, because the CoreSight architecture requires that these registers are always RESO. The 
descriptions in Reserved and unallocated registers on page H8-6837 does not apply to reserved management 
registers if the implementation is CoreSight compliant. 


If OPTIONAL memory-mapped access to the external debug interface is supported, there are additional constraints 
on memory-mapped accesses. See Register access permissions for memory-mapped accesses on page H8-6832. 


When HaveSecureExtDebugView() == TRUE, each debug component has a Secure and Non-secure view. The Secure 
view of a debug component is mapped into Secure physical memory and the Non-secure view of a debug component 
is mapped into Non-secure memory. Apart from access conditions, the Non-secure and Secure views of the debug 
components are identical. 


The terms in Table K2-4 on page K2-7657, Table K2-5 on page K2-7658, and Table K2-6 on page K2-7659 are 
defined as follows: 


Domain This describes the power domain in which the register is logically implemented. Registers described 
as implemented in the Core power domain might be implemented in the Debug power domain, as 
long as they exhibit the required behavior. 

Conditions This lists the conditions under which the access is attempted. 


To determine the access permissions for a register, read these columns from left to right, and stop at 
first column which lists the condition as being true. 


The conditions are: 


Off EDPRSR.PU == 0. The Core power domain is completely off, or in low-power state. In 
these cases the Core power domain registers cannot be accessed. 
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Note 


If debug power is off, then all external debug interface accesses return an error. 








DLK If the OS Double Lock is implemented and DoubleLockStatus() == TRUE. The OS 
Double Lock is locked. 


OSLK OSLSR.OSLK == 1. The OS Lock is locked. 


This provides the default access permissions, if there are no conditions that prevent access to the 
register. 


This provides the modified default access permissions for OPTIONAL memory-mapped accesses to 
the external debug interface if the OPTIONAL Software Lock is locked. See Register access 
permissions for memory-mapped accesses on page H8-6832. For all other accesses, this column is 
ignored. 


The access permissions are: 


This means that the default access permission applies. See the Default column, or the SLK column, 
if applicable. 
































RO This means that the register or field is read-only. 
RW This means that the register or field is read/write. Individual fields within the register might be RO. 
See the relevant register description for details. 
RC This means that the bit clears to 0 after a read. 
(SE) This means that accesses to this register have indirect write side effects. A side effect occurs when 
a direct read or a direct write of a register creates an indirect write to the same register or to another 
register. 
WoO This means that the register or field is write-only. 
WI This means that the register or field ignores writes. 
IMP DEF This means that the access permissions are IMPLEMENTATION DEFINED. 
Table K2-4 External debug interface access permissions, CoreSight registers (debug) 
Domain if iN to right) 
Offset Register Domain ARMv8.3-DoPD is Default SLK 
implemented off DLK OSLK 
OxFQO EDITCTRL IMP DEF IMP DEF IMPLEMENTATION DEFINED IMP DEF RO/WI 
OxF04-OxF8C Reserved Debug - - - RESO - 
OxFAQ DBGCLAIMSET ELI Core Core Error Error Error RW (SE) RO 
OxFA4 DBGCLAIMCLR ELI Core Core Error Error Error RW (SE) RO 
OxFA8 EDDEVAFFO Debug Core Error in Core domain RO - 
OxFAC EDDEVAFF 1 Debug Core Error in Core domain RO - 
OxFBO EDLAR Debug Core Error in Core domain WO (SE) - 
OxFB4 EDLSR Debug Core Error in Core domain RO - 
OxFB8 DBGAUTHSTATUS EL1 Debug Core Error in Core domain RO - 
OxFBC EDDEVARCH Debug Core Error in Core domain RO - 
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Table K2-4 External debug interface access permissions, CoreSight registers (debug) (continued) 





Domain if 


Conditions 


(priority left to right) 



















































































Offset Register Domain ARMv8.3-DoPDis Default SLK 
implemented off DLK OSLK 
OxFCO EDDEVID2 Debug Core Error in Core domain RO - 
OxFC4 EDDEVID1 Debug Core Error in Core domain RO - 
OxFC8 EDDEVID Debug Core Error in Core domain RO - 
OxFCC EDDEVTYPE Debug Core Error in Core domain RO - 
OxFDO EDPIDR4 Debug Core Error in Core domain RO - 
QxFD4-@xFDC Reserved Debug - - - RESO - 
QxFEQ-@xFEC EDPIDRO Debug Core Error in Core domain RO - 
OxFE4 EDPIDR1 Debug Core Error in Core domain RO - 
OxFE8 EDPIDR2 Debug Core Error in Core domain RO - 
OxFEC EDPIDR3 Debug Core Error in Core domain RO - 
OxFFQ EDCIDRO Debug Core Error in Core domain RO - 
OxFF4 EDCIDR1 Debug Core Error in Core domain RO - 
OxFF8 EDCIDR2 Debug Core Error in Core domain RO - 
OxFFC EDCIDR3 Debug Core Error in Core domain RO - 
Table K2-5 External debug interface access permissions, CoreSight registers (CTI) 
Conditions 
Offset Register Domain (priority 1ft ta many Default SLK 
Off DLK OSLK 
OxF0O CTUTCTRL IMP DEF IMPLEMENTATION DEFINED IMP DEF RO/WI 
OxF04-OxF8C Reserved Debug - - RESO - 
OxFAQ CTICLAIMSET Debug - - RW (SE) RO 
OxFA4 CTICLAIMCLR Debug - - RW (SE) RO 
OxFA8 CTIDEVAFF0 Debug - - RO - 
OxFAC CTIDEVAFF1 Debug - - RO - 
OxFBO CTILAR Debug - - WO (SE) - 
QxFB4 CTILSR Debug - - RO - 
OxFB8 CTIAUTHSTATUS Debug - - RO - 
OxFBC CTIDEVARCH Debug - - RO - 
OxFCO CTIDEVID2 Debug - - RO - 
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Table K2-5 External debug interface access permissions, CoreSight registers (CTI) (continued) 

























































































Conditions 
Offset Register Domain (priority left to right) Default SLK 
Off DLK OSLK 
OxFC4 CTIDEVID1 Debug - - - RO - 
OxFC8 CTIDEVID Debug - - - RO - 
OxFCC CTIDEVTYPE Debug - - - RO - 
OxFDO CTIPIDR4 Debug - - - RO - 
OxFD4-OxFDC Reserved Debug - - - RESO - 
OxFEQ CTIPIDRO Debug - - - RO - 
OxFE4 CTIPIDR1 Debug - - - RO - 
OxFE8 CTIPIDR2 Debug - - - RO - 
OxFEC CTIPIDR3 Debug - - - RO - 
OxFFQ CTICIDRO Debug - - - RO - 
OxFF4 CTICIDR1 Debug - - - RO - 
OxFF8 CTICIDR2 Debug - - - RO - 
OxFFC CTICIDR3 Debug - - - RO - 
Table K2-6 External debug interface access permissions, CoreSight registers (PMU) 
Domain if “ona ane - 
Offset Register Domain ARMv8.3-Dopp __ (Pricrity left to right) Default SLK 
is implemented off DLK OSLK 
QxF0O PMITCTRL IMP DEF IMP DEF IMPLEMENTATION DEFINED IMP DEF RO/WI 
OxFQ4-OxFA4 Reserved Debug - - - RESO - 
OxFA8 PMDEVAFF0 Debug Core Error in Core domain RO - 
QxFAC PMDEVAFF 1 Debug Core Error in Core domain RO - 
OxFBO PMLAR Debug Core Error in Core domain WO (SE) - 
QxFB4 PMLSR Debug Core Error in Core domain RO - 
OxFB8 PMAUTHSTATUS Debug Core Error in Core domain RO - 
QxFBC PMDEVARCH Debug Core Error in Core domain RO - 
QxFCQ-OxFC4. Reserved Debug - - - RESO - 
OxFC8 PMDEVID2 Debug Core Error in Core domain RO - 
QxFCC PMDEVTYPE Debug Core Error in Core domain RO - 
QxFDO PMPIDR4 Debug Core Error in Core domain RO - 
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Table K2-6 External debug interface access permissions, CoreSight registers (PMU) (continued) 





Domain if 


Conditions 
(priority left to right) 





















































Offset Register Domain ARMv8.3-DoPD Default SLK 
is implemented 
7 Off DLK  OSLK 
OxFD4-OxFDC Reserved Debug - - - RESO - 
OxFEQ PMPIDRO Debug Core Error in Core domain RO - 
OxFE4 PMPIDR1 Debug Core Error in Core domain RO - 
OxFE8 PMPIDR2 Debug Core Error in Core domain RO - 
QxFEC PMPIDR3 Debug Core Error in Core domain RO - 
OxFFQ PMCIDRO Debug Core Error in Core domain RO - 
OxFF4 PMCIDR1 Debug Core Error in Core domain RO - 
OxFF8 PMCIDR2 Debug Core Error in Core domain RO - 
OxFFC PMCIDR3 Debug Core Error in Core domain RO - 
a. Implemented from Armv8.2, or if ARMv8.2-PCSample is implemented. Otherwise this location is RESO. 
K2.4.3 Management register resets 
Table K2-7 shows the management register resets. This table does not include: 
° Read-only identification registers that have a fixed value from reset. These registers include those with the 
DEVAFFn, DEVARCH, DEVID {n}, DEVTYPE, PIDRn, and CIDRn mnemonics. 
s Registers that have the AUTHSTATUS mnemonic. This is a read-only status register that reflects the status 
outside of the reset domain of the register. 
: Registers that have the LAR mnemonic. These are write-only registers that only have an effect on writes. 
All other fields in the management registers are reset to an IMPLEMENTATION DEFINED value which can be 
UNKNOWN. The registers are in the reset domain specified in the table. 
Table K2-7 shows a summary of the management register resets. 
Table K2-7 Management register resets 
Register Reset domain Field Value Description 
CTHTCTRL IMPLEMENTATION DEFINED IME 0 Integration mode enable 
EDITCTRL 
PMITCTRL 
DBGCLAIMCLR_EL1 Cold reset CLAIM 0x00 CLAIM tags 
CTICLAIMCLR External debug CLAIM — 0x0000000 
CTILSK? If ARMv8.3-DoPD is SLK 1 Software Lock 
EDLSRa implemented, reset by Cold 
reset, otherwise External 
PMLSR2 
debug. 
a. Only if the OPTIONAL Software Lock is implemented 
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The Peripheral Identification scheme provides the standard information required by all components that conform to 
the Arm” Debug Interface Architecture Specification, ADIv5.0 to ADIv5.2, that implements the CoreSight 
identification scheme. They identify a peripheral in a particular namespace. For more information, see the Arm” 
CoreSight™ Architecture Specification. 


Table K2-8 lists the Peripheral ID Registers that make up the Peripheral Identification scheme for each component. 


Table K2-8 Peripheral Identification Registers 





























Reference 

Register offset Description External Debug CTI Performance Monitors 
OxFDO Peripheral ID4 EDPIDR4 CTIPIDR4 PMPIDR4 

OxFD4 Reserved for Peripheral ID5S - - - 

OxFD8 Reserved for Peripheral ID6 - - - 

@xFDC Reserved for Peripheral ID7 - - - 

QxFEO Peripheral IDO EDPIDRO CTIPIDRO PMPIDRO 

QxFE4 Peripheral ID1 EDPIDRI CTIPIDRI PMPIDRI 

QxFE8 Peripheral ID2 EDPIDR2 CTIPIDR2 PMPIDR2 

QxFEC Peripheral ID3 EDPIDR3 CTIPIDR3 PMPIDR3 
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Figure K2-2 shows the register field allocation scheme for the Peripheral ID Registers. 


31 


8 7 0 


RESO Peripheral ID data 


Figure K2-2 Peripheral ID register format 


Software can consider the eight Peripheral ID Registers as defining a single 64-bit Peripheral ID, as shown in 





Figure K2-3. 
Actual Peripheral ID Register fields 
EDPIDR7 EDPIDR6 EDPIDR5 EDPIDR4 EDPIDR3 EDPIDR2 EDPIDR1 EDPIDRO 
í Y Y Y Y Y Y Y =) 
7 07 07 07 07 0:7 07 07 0 
63 56 55 48 47 40 39 32 31 24:23 16.15 87 0 
\ ? 





Conceptual 64-bit Peripheral ID 


Figure K2-3 Mapping between Peripheral ID Registers and a 64-bit Peripheral ID Value 


Figure K2-3 shows the fields in the 64-bit Peripheral ID value, and includes the field values for fields that: 


. Have fixed values, including the bits that are reserved. 


s Have fixed values in an implementation that is designed by Arm. 


For more information about the fields and their values see Table K2-9 on page K2-7662. 
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Conceptual 64-bit Peripheral ID 














EDPIDR7 EDPIDR7 EDPIDR7 EDPIDR7 EDPIDR7 EDPIDR7 EDPIDR7 EDPIDR7 
0:7 07 07 43 0:7 43 0:7 432 43 07 0 
63 A A A A JIN A Y 
Reserved, RESO 4KB RevAnd Revision JEP106 Part number 
count ID code 
JEP106 Customer 


Uses JEP106 ID code 


Continuation code modified 


Figure K2-4 Peripheral ID fields, with values for a implementation designed by ARM 


Table K2-9 shows the fields in the Peripheral ID. 


Table K2-9 Fields in the Peripheral Identification Registers 























Name Size Description Registers 
4KB count 4 bits Log2 of the number of 4KB blocks occupied by the implementation. EDPIDR4 
CTIPIDR4 
PMPIDR4 
JEP106 code 4+7 Identifies the designer of the implementation. This value consists of: EDPIDR1, EDPIDR2, 
bits . A 4-bit continuation code, also described as the bank number. EDPIDR4 
. A 7-bit identification code. CTIPIDR1, 
For implementations designed by Arm, the continuation code is 0x4, indicating ros C TIPIDRA 
bank 5, and the identity code is 0x3B. PMPIDR1, PMPIDR2, 
PMPIDR4 
RevAnd 4 bits Manufacturing revision number. Indicates a late modification to the EDPIDR3 
implementation, usually as a result of an Engineering Change Order (ECO). CTIPIDR3 
This field starts at 0x0 and is incremented by the integrated circuit manufacturer PMPIDR3 
on metal fixes. 
Customer 4 bits Indicates an endorsed modification to the implementation. EDPIDR3 
modified If the system designer cannot modify the implementation supplied by the CTIPIDR3 
implementation designer then this field is RESO. PMPIDR3 
Revision 4 bits Revision number for the implementation. EDPIDR2 
Starts at 0x0 and increments by 1 at both major and minor revisions. CTIPIDR2 
PMPIDR2 
Uses JEP106 1 bit This bit is set to 1 when a JEP106 identification code is used. EDPIDR2 
ID code This bit must be 1 on all Armv8 implementations. CTIPIDR2 
PMPIDR2 
Part number 12 bits Part number for the implementation. Each organization designing to the Arm EDPIDRO, EDPIDR1 


Debug architecture specification keeps its own part number list. 


CTIPIDRO, CTIPIDR1 
PMPIDRO, PMPIDR1 
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A component is identified uniquely by the combination of the following fields: 


JEP106 continuation code. 
JEP106 identity code. 

Part number. 

Revision. 


Customer Modified. 
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. RevAnd. 


For components with a Component class of 0x9, Debug component, indicated by the Component Identification 
Registers, multiple components can have the same Part number, provided each component has a different CoreSight 
Device type. However, Arm strongly recommends that each device has a unique Part number. For more information: 


7 About the Component Identification Registers, see About the Component Identification scheme. 

E About the CoreSight Device type, see EDDEVTYPE, CTIDEVTYPE, or PMDEVTYPE. 

s About CoreSight components and their identification, see the Arm” Debug Interface Architecture 
Specification. 

Allocating revisions and part numbers 


Within the Peripheral Identification registers, the allocation of major and minor revisions, part numbers, and 
customer-modified fields is IMPLEMENTATION DEFINED, with the following set of restrictions so that: 


: The REVISION field must increase monotonically with revisions. 





Note 


Arm recommends that the REVISION field is updated for each update to the RTL, regardless of whether this 
is a major or minor update. 





e The REVAND field should increase monotonically with revisions. 





Note 


Arm recommends that the REVAND field is used only for post-release changes. For example, those due to 
engineering change order (ECO) fixes related to the debug component of the processor. 


. The PART field must have a degree of uniqueness: 


— Two component designs can have the same part number so long as they are sub-components of the 
same part and the programmers’ model for the part has the means to disambiguate sub-components. 


— Otherwise, two component designs must have unique part numbers. 


The DEVARCH (if implemented) or DEVTYPE (otherwise) register provides the means to disambiguate 
sub-components of the Debug Architecture. 


A ROM table has no DEVTYPE or DEVARCH register. However, if it is the only CLASS 0x1 component in a 
processor cluster, it can still be disambiguated. 


Multiple instances of the same component design have the same part number. 


K2.4.5 About the Component Identification scheme 


ARM DDI 0487E.a 
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The Component Identification Registers identify the processor as an Arm Debug Interface v5 component. For more 
information, see the Arm” Debug Interface Architecture Specification and the Arm® CoreSight™ Architecture 
Specification. 


The Component Identification Registers occupy the last four words of the 4KB block of debug registers. 


Table K2-10 Component Identification Registers 








Register offset Description External debug CTI Performance Monitors 
OxFFO Component IDO EDCIDRO CTICIDRO PMCIDRO 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K2-7663 


Non-Confidential 


Recommended External Debug Interface 
K2.4 Management registers and CoreSight compliance 


Table K2-10 Component Identification Registers (continued) 











Register offset Description Externaldebug CTI Performance Monitors 
OxFFO Component IDI EDCIDRI CTICIDR1 PMCIDRI1 
OxFFO Component ID2 = EDCIDR2 CTICIDR2 PMCIDR2 
OxFFO Component ID3 =EDCIDR3 CTICIDR3 PMCIDR3 





Figure K2-5 shows the register field allocation scheme for the Component ID Registers. 


31 8 7 0 


RESO Component ID Data 


Figure K2-5 Component ID Register format 


Software can consider the eight Component ID Registers as defining a single 32-bit Component ID, as shown in 
Figure K2-6. 


Actual ComponentID register fields 


EDCIDR3 EDCIDR2 EDCIDR1 EDCIDRO 











31 2423 1615 1211 87 0 

N A A ) 
Preamble Component Preamble 

Ñ class ) 





Cc t ID 
Conceptual 32-bit component ID i la 


Figure K2-6 Mapping between Component ID Registers and a 32-bit Component ID Value 
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Appendix K3 
Recommendations for Performance Monitors Event 
Numbers for IMPLEMENTATION DEFINED Events 


This appendix describes the Arm recommendations for the use of the IMPLEMENTATION DEFINED event numbers. It 
contains the following sections: 


Arm recommendations for IMPLEMENTATION DEFINED event numbers on page K3-7666. 
Summary of events for exceptions taken to an Exception level using AArch64 on page K3-7681. 
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K3.1 


Arm recommendations for IMPLEMENTATION DEFINED event numbers 


These are the Arm recommendations for the use of the IMPLEMENTATION DEFINED event numbers. Arm does not 
define these events as rigorously as those in the architectural and microarchitectural event lists, and an 
implementation might: 


Modify the definition of an event to better correspond to the implementation. 


Not use some, or many, of these event numbers. 


Table K3-1 lists the PMU IMPLEMENTATION DEFINED event numbers in event number order. 


Table K3-1 PMU IMPLEMENTATION DEFINED event numbers 





Event number 


Event mnemonic 


Description 
































0x0040 L1D_CACHE RD Attributable Level 1 data cache access, read 

0x0041 L1D_CACHE WR Attributable Level 1 data cache access, write 

0x0042 LID CACHE REFILL RD? Attributable Level 1 data cache refill, read 

0x0043 LID CACHE REFILL WR? Attributable Level 1 data cache refill, write 

0x0044 LID CACHE_REFILL INNER Attributable Level 1 data cache refill, inner 

0x0045 LID CACHE REFILL OUTER Attributable Level 1 data cache refill, outer 

0x0046 LID _ CACHE WB VICTIM Attributable Level 1 data cache Write-Back, victim 
0x0047 LID_CACHE_WB_CLEAN Level 1 data cache Write-Back, cleaning and coherency 
0x0048 L1D_CACHE INVAL Attributable Level 1 data cache invalidate 





0x0049-0x004B 


Reserved 


























0x004C LID TLB REFILL RD# Attributable Level 1 data TLB refill, read 

0x004D LID TLB REFILL WR Attributable Level 1 data TLB refill, write 

0x004E LID TLB RD Attributable Level 1 data or unified TLB access, read 
0x004F LID TLB WR Attributable Level 1 data or unified TLB access, write 
0x0050 L2D_ CACHE RD Attributable Level 2 data cache access, read 

0x0051 L2D_CACHE WR Attributable Level 2 data cache access, write 

0x0052 L2D_CACHE_REFILL_RD@ Attributable Level 2 data cache refill, read 

0x0053 L2D CACHE REFILL WRa Attributable Level 2 data cache refill, write 








0x0054-0x0055 


Reserved 











0x0056 L2D_ CACHE WB VICTIM Attributable Level 2 data cache Write-Back, victim 
0x0057 L2D_CACHE_WB_CLEAN Level 2 data cache Write-Back, cleaning and coherency 
0x0058 L2D_CACHE INVAL Attributable Level 2 data cache invalidate 





0x0059- 0x005B 


Reserved 








0x005C L2D TLB REFILL RD4 Attributable Level 2 data or unified TLB refill, read 
0x005D L2D_TLB_REFILL_WR# Attributable Level 2 data or unified TLB refill, write 
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Table K3-1 PMU IMPLEMENTATION DEFINED event numbers (continued) 





Event number 


Event mnemonic 


Description 


































































































0x005E L2D TLB RD Attributable Level 2 data or unified TLB access, read 
0x005F L2D TLB WR Attributable Level 2 data or unified TLB access, write 
0x0060 BUS_ACCESS_RD Bus access, read 

0x0061 BUS_ACCESS_WR Bus access, write 

0x0062 BUS_ACCESS_SHARED Bus access, Normal, Cacheable, Shareable 

0x0063 BUS_ACCESS_NOT_ SHARED Bus access, not Normal, Cacheable, Shareable 

0x0064 BUS_ACCESS_ NORMAL Bus access, normal 

0x0065 BUS_ACCESS_PERIPH Bus access, peripheral 

0x0066 MEM ACCESS RD Data memory access, read 

0x0067 MEM ACCESS WR Data memory access, write 

0x0068 UNALIGNED LD SPEC Unaligned access, read 

0x0069 UNALIGNED_ST_SPEC Unaligned access, write 

0x006A UNALIGNED_LDST_SPEC Unaligned access 

0x006B - Reserved 

@x006C LDREX SPEC Exclusive operation speculatively executed, LDREX or LDX 
@x006D STREX_ PASS SPEC Exclusive operation speculatively executed, STREX or STX pass 
0x006E STREX FAIL SPEC Exclusive operation speculatively executed, STREX or STX fail 
0x006F STREX SPEC Exclusive operation speculatively executed, STREX or STX 
0x0070 LD SPEC Operation speculatively executed, load 

0x0071 ST_SPEC Operation speculatively executed, store 

0x0072 LDST_SPEC Operation speculatively executed, load or store 

0x0073 DP_SPEC Operation speculatively executed, integer data processing 
0x0074 ASE _ SPEC Operation speculatively executed, Advanced SIMD instruction 
0x0075 VFP_SPEC Operation speculatively executed, floating-point instruction 
0x0076 PC_WRITE_SPEC Operation speculatively executed, software change of the PC 
0x0077 CRYPTO_SPEC Operation speculatively executed, Cryptographic instruction 
0x0078 BR_IMMED SPEC Branch speculatively executed, immediate branch 

0x0079 BR_RETURN_SPEC Branch speculatively executed, procedure return 

0x007A BR_INDIRECT_SPEC Branch speculatively executed, indirect branch 

0x007B - Reserved 

0x007C ISB_SPEC Barrier speculatively executed, ISB 

0x007D DSB_SPEC Barrier speculatively executed, DSB 
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Table K3-1 PMU IMPLEMENTATION DEFINED event numbers (continued) 





Event number 


Event mnemonic 


Description 



























































0x007E DMB_SPEC Barrier speculatively executed, DMB 

0x007F CSDB_SPEC Barrier speculatively executed, CSDB 

0x0080 - Reserved 

0x0081 EXC_UNDEF Exception taken, Other synchronous 

0x0082 EXC. SVC Exception taken, Supervisor Call 

0x0083 EXC_PABORT Exception taken, Instruction Abort 

0x0084 EXC_DABORT Exception taken, Data Abort and SError 

0x0085 - Reserved 

0x0086 EXC _IRQ Exception taken, IRQ 

0x0087 EXC FIQ Exception taken, FIQ 

0x0088 EXC_SMC Exception taken, Secure Monitor Call 

0x0089 - Reserved 

0x008A EXC_HVC Exception taken, Hypervisor Call 

0x008B EXC_TRAP_PABORT Exception taken, Instruction Abort not Taken locally? 

0x008C EXC_TRAP_DABORT Exception taken, Data Abort or SError not Taken locally» 

@x008D EXC_TRAP OTHER Exception taken, Other traps not Taken locally? 

0x008E EXC_TRAP IRQ Exception taken, IRQ not Taken locally> 

0x008F EXC. TRAP FIQ Exception taken, FIQ not Taken locally» 

0x0090 RC LD SPEC Release consistency operation speculatively executed, Load-Acquire 
0x0091 RC_ST_SPEC Release consistency operation speculatively executed, Store-Release 





0x0092-0x009F 


Reserved 














Ox00A0 L3D_CACHE RD Attributable Level 3 data or unified cache access, read 
QxQQA1 L3D_CACHE WR Attributable Level 3 data or unified cache access, write 
QxQQA2 L3D_CACHE_REFILL_RD4 Attributable Level 3 data or unified cache refill, read 
0x00A3 L3D_ CACHE REFILL WR4 Attributable Level 3 data or unified cache refill, write 








Qx@0A4-0x00A5 


Reserved 











0x00A6 L3D_CACHE_WB_VICTIM Attributable Level 3 data or unified cache Write-Back, victim 
0x00A7 L3D_CACHE_WB_CLEAN Attributable Level 3 data or unified cache Write-Back, cache clean 
0x00A8 L3D_CACHE_INVAL Attributable Level 3 data or unified cache access, invalidate 





a. For more information, see Relationship between REFILL events and associated access events on page K3-7679. 


b. The Glossary defines the term Taken locally. See also Exception levels on page D1-2268 for more information. 


0x0040, LID_CACHE_RD, Attributable Level 1 data cache access, read 
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This event is similar to Level 1 data cache access, LID CACHE, but the counter counts only 
memory-read operations that access at least the Level 1 data or unified cache. 


If the cache is shared, only events Attributable to this PE are counted. If the cache is not shared, all 
events are counted. 


See also: 
. Attributability on page D7-2677. 
° Meaningful ratios between common microarchitectural events on page D7-2720. 


0x0041, LID_CACHE_WR, Attributable Level 1 data cache access, write 


This event is similar to Level 1 data cache access, LID_CACHE, but the counter counts only 
memory-write operations that access at least the Level 1 data or unified cache. 


The counter counts DC ZVA as a store instruction. 


0x0042, LID CACHE REFILL_RD, Attributable Level 1 data cache refill, read 


This event is similar to Level 1 data cache refill, LID_CACHE_REFILL, but the counter counts 
only memory-read operations that cause a refill of at least the Level 1 data or unified cache. 





See also Relationship between REFILL events and associated access events. on page K3-7679. 


0x0043, LID CACHE REFILL_WR, Attributable Level 1 data cache refill, write 


This event is similar to Level 1 data cache refill, LID CACHE REFILL, but the counter counts 
only memory-write operations that cause a refill of at least the Level 1 data or unified cache. 





The counter counts DC ZVA as a store instruction. 


See also Relationship between REFILL events and associated access events. on page K3-7679. 


0x0044, LID CACHE REFILL_INNER, Attributable Level 1 data cache refill, inner 


This event is similar to Level 1 data cache refill, LID CACHE REFILL, but the counter counts 
only memory-read and memory-write operations that generate refills satisfied by transfer from 
another cache inside of the immediate cluster. 





Note 


The boundary between inner and outer is IMPLEMENTATION DEFINED, and it is not necessarily linked 
to other similar boundaries, such as the boundary between Inner Cacheable and Outer Cacheable or 
the boundary between Inner Shareable and Outer Shareable. 








0x0045, LID CACHE REFILL OUTER, Attributable Level 1 data cache refill, outer 


This event is similar to Level 1 data cache refill, LID CACHE REFILL, but the counter counts 
only memory-read and memory-write operations that generate refills satisfied from outside of the 
immediate cluster. 





0x0046, LID CACHE _WB_VICTIM, Attributable Level 1 data cache Write-Back, victim 


This event is similar to Level 1 data cache Write-Back, LID CACHE WB, but the counter counts 
only Write-Backs that are a result of the line being allocated for an access made by the PE. 


If ARMv8.4-PMU is not implemented, Write-Backs caused by the execution of a cache 
maintenance instruction are not counted. If ARMv8.4-PMU is implemented, it is IMPLEMENTATION 
DEFINED whether Write-Backs caused by the execution of a cache maintenance instruction are 
counted. 


It is IMPLEMENTATION DEFINED whether a write of a whole cache line that is not the result of the 
eviction of a line from the cache is counted. For example, this might occur if the PE detects 
streaming writes to memory and does not allocate lines to the cache, or as the result of a DC ZVA. 


0x0047, LID_CACHE WB_CLEAN, Level 1 data cache Write-Back, cleaning and coherency 


This event is similar to Attributable Level 1 data cache Write-Back, LID CACHE WB, but the 
counter counts only Write-Backs that are a result of a coherency operation made by another PE or 
are caused by the execution of a cache maintenance instruction. Whether Write-Backs caused by the 
execution of a cache maintenance instruction are counted is IMPLEMENTATION DEFINED. 
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Ifa coherency request from a requestor outside the PE results in a Write-Back, it is an Unattributable 
event. 


Note 


The transfer of a dirty cache line from the Level 1 data cache of this PE to the Level 1 data cache of 
another PE due to a hardware coherency operation is not counted unless the dirty cache line is also 
written back to a Level 2 cache or memory. 





0x0048, LID_ CACHE _INVAL, Attributable Level 1 data cache invalidate 
The counter counts each invalidation of a cache line in the Level | data or unified cache. 
The counter does not count events if a cache refill invalidates a line. 


If ARMv8.4-PMU is not implemented, the counter does not count locally-executed cache 
maintenance instructions that operate by set/way. If ARMv8.4-PMU is implemented, it is 
IMPLEMENTATION DEFINED whether the counter counts locally-executed cache maintenance 
instructions that operate by set/way. 


Ifa coherency request from a requestor outside the PE results in a Write-Back, it is an Unattributable 
event. 
0x004C, L1D_TLB_REFILL_RD, Attributable Level 1 data TLB refill, read 


This event is similar to Level 1 data TLB refill, L1D_TLB REFILL, but the counter counts only 
memory-read operations that cause a data TLB refill of a least the Level 1 data or unified TLB. 


See also Relationship between REFILL events and associated access events. on page K3-7679. 


0x004D, LID_TLB_REFILL_WR, Attributable Level 1 data TLB refill, write 


This event is similar to Level 1 data TLB refill, L1D_TLB REFILL, but the counter counts only 
memory-write operations that cause a data TLB refill of a least the Level 1 data or unified TLB. 


The counter counts DC ZVA as a store instruction. 


See also Relationship between REFILL events and associated access events. on page K3-7679. 


0x004E, L1ID_TLB_RD, Attributable Level 1 data or unified TLB access, read 
This event is similar to Level 1 data or unified TLB access, L1D_TLB, but the counter counts only 
memory-read operations that cause a TLB access to at least the Level 1 data or unified TLB. 
0x004F, L1ID_TLB_WR, Attributable Level 1 data or unified TLB access, write 
This event is similar to Level 1 data or unified TLB access, L1D_TLB, but the counter counts only 
memory-write operations that cause a TLB access to at least the Level | data or unified TLB. 
0x0050, L2D_CACHE RD, Attributable Level 2 data cache access, read 
This event is similar to Attributable Level 2 data cache access, L2D_ CACHE, but the counter 
counts only memory-read operations that access at least the Level 2 data or unified cache. 
0x0051, LZ2D_CACHE_WR, Attributable Level 2 data cache access, write 


This event is similar to Attributable Level 2 data cache access, L2D_ CACHE, but the counter 
counts only memory-write operations that access at least the Level 2 data or unified cache. 


The counter counts DC ZVA as a store instruction. 


0x0052, LZD_ CACHE REFILL_RD, Attributable Level 2 data cache refill, read 


This event is similar to Attributable Level 2 data cache refill, L2D CACHE REFILL, but the 
counter counts only memory-read operations that cause a refill of at least the Level 2 data or unified 
cache. 





See also Relationship between REFILL events and associated access events. on page K3-7679. 
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0x0053, LZD_ CACHE REFILL_WR, Attributable Level 2 data cache refill, write 


This event is similar to Attributable Level 2 data cache refill, L2D CACHE REFILL, but the 
counter counts only memory-write operations that cause a refill of at least the Level 2 data or unified 
cache. 





The counter counts DC ZVA as a store instruction. 


See also Relationship between REFILL events and associated access events. on page K3-7679. 


0x0056, L2D_ CACHE _WB_VICTIM, Attributable Level 2 data cache Write-Back, victim 


This event is similar to Attributable Level 2 data cache Write-Back, L2D_CACHE_WB, but the 
counter counts only Write-Backs that are a result of the line being allocated for an access made by 
the PE. 


If ARMv8.4-PMU is not implemented, Write-Backs caused by the execution of a cache 
maintenance instruction are not counted. If ARMv8.4-PMU is implemented, it is IMPLEMENTATION 
DEFINED whether Write-Backs caused by the execution of a cache maintenance instruction are 
counted. 


It is IMPLEMENTATION DEFINED whether a write of a whole cache line that is not the result of the 
eviction of a line from the cache is counted. For example, this might occur if the PE detects 
streaming writes to memory and does not allocate lines to the cache, or as the result of a DC ZVA. 


0x0057, LZ2D_CACHE WB_CLEAN, Level 2 data cache Write-Back, cleaning and coherency 
This event is similar to Attributable Level 2 data cache Write-Back, L2D_ CACHE WB, but the 
counter counts only Write-Backs that are a result of a coherency operation made by another PE or 
are caused by the execution of a cache maintenance instruction. Whether Write-Backs caused by the 
execution of a cache maintenance instruction are counted as IMPLEMENTATION DEFINED. 


Note 


The transfer of a dirty cache line from the Level 2 data cache of this PE to the Level 2 data cache of 
another PE due to a hardware coherency operation is not counted unless the dirty cache line is also 
written back to a Level 3 cache or memory. 








Ifa coherency request from a requestor outside the PE results in a Write-Back, it is an Unattributable 
event. 


0x0058, L2D_ CACHE _INVAL, Attributable Level 2 data cache invalidate 
The counter counts each invalidation of a cache line in the Level 2 data or unified cache. 
The counter does not count events if a cache refill invalidates a line. 


If ARMv8.4-PMU is not implemented, the counter does not count locally-executed cache 
maintenance instructions that operate by set/way. If ARMv8.4-PMU is implemented, it is 
IMPLEMENTATION DEFINED whether the counter counts locally-executed cache maintenance 
instructions that operate by set/way. 


Note 


Software that uses this event must know whether the Level 2 data cache is shared with other PEs. 
This event does not follow the general rule of Level 2 data cache events of only counting events that 
directly affect this PE. 








Ifa coherency request from a requestor outside the PE results in a Write-Back, it is an Unattributable 
event. 


0x005C, L2D_TLB_REFILL_RD, Attributable Level 2 data or unified TLB refill, read 


This event is similar to Attributable Level 2 data or unified TLB refill, L2D_TLB REFILL, but the 
counter counts only Attributable memory read operations that cause a TLB refill of at least the Level 
2 data or unified TLB. See also Relationship between REFILL events and associated access events. 
on page K3-7679. 
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0x005D, L2D_TLB REFILL_WR, Attributable Level 2 data or unified TLB refill, write 


This event is similar to Attributable Level 2 data or unified TLB refill, L2D_ TLB REFILL, but the 
counter counts only Attributable memory write operations that cause a TLB refill of at least the 
Level 2 data or unified TLB. See also Relationship between REFILL events and associated access 
events. on page K3-7679. 

0x005E, L2D_TLB_RD, Attributable Level 2 data or unified TLB access, read 


This event is similar to Attributable Level 2 data or unified TLB access, L2D_TLB, but the counter 
counts only Attributable memory read operations that cause a TLB access to at least the Level 2 data 
or unified TLB. 

0x005F, L2D_TLB_WR, Attributable Level 2 data or unified TLB access, write 


This event is similar to Attributable Level 2 data or unified TLB access, L2D_TLB, but the counter 
counts only Attributable memory write operations that cause a TLB access to at least the Level 2 
data or unified TLB. 

0x0060, BUS_ACCESS_RD, Bus access, read 
This event is similar to Bus access, BUS_ACCESS, but the counter counts only memory-read 
operations that access outside the boundary of the PE and its closely-coupled caches. 

0x0061, BUS_ACCESS_ WR, Bus access, write 
This event is similar to Bus access, BUS ACCESS, but the counter counts only memory-write 
operations that access outside the boundary of the PE and its closely-coupled caches. 

0x0062, BUS_ACCESS SHARED, Bus access, Normal, Cacheable, Shareable 


This event is similar to Bus access, BUS_- ACCESS, but the counter counts only memory-read and 
memory-write operations that make Normal, Cacheable, Shareable accesses outside the boundary 
of the PE and its closely-coupled caches. 


Note 


It is IMPLEMENTATION DEFINED how the PE translates the attributes from the translation table entry 
for a region to the attributes on the bus. 





In particular, a region of memory designated as Normal, Cacheable, Inner Shareable, Not Outer 
Shareable by a translation table entry, might be marked as either shareable or Non-shareable at the 
boundary of the PE and its closely-coupled caches. This depends on where the IMPLEMENTATION 
DEFINED boundary lies, between Inner and Outer Shareable. 


If the Inner Shareable extends beyond the PE boundary, and the bus indicates the distinction 
between Inner and Outer Shareable, then either is counted as shareable for the purposes of defining 
this event. 





0x0063, BUS_ ACCESS NOT_SHARED, Bus access, not Normal, Cacheable, Shareable 


This event is similar to Bus access, BUS_ACCESS, but the counter counts only memory-read and 
memory-write operations that make accesses outside the boundary of the PE and its closely-coupled 
caches that are not Normal, Cacheable, Shareable. For example, the counter counts accesses marked 


as: 

° Normal, Cacheable, Non-shareable. 
° Normal, Non-cacheable. 

° Device. 


Note 


It is IMPLEMENTATION DEFINED, how the PE translates the attributes from the translation table 
entries for a region to the attributes on the bus. 





In particular, a region of memory designated as Normal, Cacheable, Inner Shareable, Not Outer 
Shareable by a translation table entry, might be marked as either shareable or Non-shareable at the 
boundary of the PE and its closely-coupled caches. This depends on where the IMPLEMENTATION 
DEFINED boundary lies, between Inner and Outer Shareable. 
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If the Inner Shareable extends beyond the PE boundary, and the bus indicates the distinction 
between Inner and Outer Shareable, then either is counted as shareable for the purposes of defining 
this event. 


0x0064, BUS_ACCESS NORMAL, Bus access, normal 


This event is similar to Bus access, BUS_ ACCESS, but the counter counts only memory-read and 
memory-write operations that make Normal accesses outside the boundary of the PE and its 
closely-coupled caches. For example, the counter counts Normal, Cacheable and Normal, 
Non-cacheable accesses but does not count Device accesses. 

0x0065, BUS_ACCESS_ PERIPH, Bus access, peripheral 


This event is similar to Bus access, BUS_- ACCESS, but the counter counts only memory-read and 
memory-write operations that make Device accesses outside the boundary of the PE and its 
closely-coupled caches. 

0x0066, MEM ACCESS RD, Data memory access, read 
This event is similar to Data memory access, MEM _ ACCESS, but the counter counts only 
memory-read operations and SVE memory-read operations that the PE made. 

0x0067, MEM ACCESS _WR, Data memory access, write 
This event is similar to Data memory access, MEM ACCESS, but the counter counts only 
memory-write operations and SVE memory-write operations made by the PE. 

0x0068, UNALIGNED LD_SPEC. Unaligned access, read 


This event is similar to Data memory access, MEM _ ACCESS, but the counter counts only 

unaligned memory-read operations and unaligned memory-read SVE operations that the PE made. 

It also counts unaligned accesses if they are subsequently transposed into multiple aligned accesses. 
0x0069, UNALIGNED ST_SPEC, Unaligned access, write 


This event is similar to Data memory access, MEM_ ACCESS, but the counter counts only 

unaligned memory-write operations and unaligned SVE memory-write operations that the PE made. 

It also counts unaligned accesses if they are subsequently transposed into multiple aligned accesses. 
0x006A, UNALIGNED_LDST_SPEC, Unaligned access 


This event is similar to Data memory access, MEM _ ACCESS, but the counter counts only 
unaligned memory-read operations, unaligned memory-write operations, unaligned memory-read 
SVE operations, and unaligned memory-write SVE operations that the PE made. It also counts 
unaligned accesses if they are subsequently transposed into multiple aligned accesses. 

0x006C, LDREX SPEC, Exclusive operation speculatively executed, Load-Exclusive 
The counter counts Load-Exclusive instructions speculatively executed. 


The definition of speculatively executed is IMPLEMENTATION DEFINED. 


0x006D, STREX_PASS_SPEC, Exclusive operation speculatively executed, Store-Exclusive pass 
The counter counts Store-Exclusive instructions speculatively executed that completed a write. 
The definition of speculatively executed is IMPLEMENTATION DEFINED but must be the same as for 
the LDREX_SPEC event. 

0x006E, STREX_ FAIL SPEC, Exclusive operation speculatively executed, Store-Exclusive fail 


The counter counts Store-Exclusive instructions speculatively executed that fail to complete a write. 
It is within the IMPLEMENTATION DEFINED definition of speculatively executed whether this 
includes conditional instructions that fail the condition code check. 


The definition of speculatively executed is IMPLEMENTATION DEFINED but must be the same as for 
the LDREX_SPEC event. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K3-7673 
ID070919 Non-Confidential 


Recommendations for Performance Monitors Event Numbers for IMPLEMENTATION DEFINED Events 
K3.1 Arm recommendations for IMPLEMENTATION DEFINED event numbers 


0x006F, STREX_SPEC, Exclusive operation speculatively executed, Store-Exclusive 
The counter counts Store-Exclusive instructions speculatively executed. 


The definition of speculatively executed is IMPLEMENTATION DEFINED but it must be the same as for 
the LDREX_SPEC event. 


Arm recommends that this event is implemented if it is not possible to implement the exclusive 
operation speculatively executed, Store-Exclusive pass, and exclusive operation speculatively 
executed, Store-Exclusive fail, events with the same degree of speculation as the LDREX_SPEC 
event. 


0x0070, LD_SPEC, Operation speculatively executed, load 


This event is similar to Operation speculatively executed, INST_SPEC, but the counter counts only 
operations due to memory-reading instructions and operations due to memory-reading SVE 
instructions, as defined by the LD_RETIRED event. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED but must be the same as for 
the INST_SPEC event. 
0x0071, ST_SPEC, Operation speculatively executed, store 


This event is similar to Operation speculatively executed, INST_SPEC, but the counter counts only 
operations due to memory-writing instructions and operations due to memory-writing SVE 
instructions, as defined by the ST_RETIRED event. 


The counter counts DC ZVA as a store operation. 
The definition of Speculatively executed is IMPLEMENTATION DEFINED but must be the same as for 
the INST_SPEC event. 

0x0072, LDST_SPEC, Operation speculatively executed, load or store 


This event is similar to Operation speculatively executed, INST_SPEC, but the counter counts only 
operations due to memory-reading instructions, operations due to memory-writing instructions, 
operations due to memory-reading SVE instructions and operations due to memory-writing SVE 
instructions as defined by the LD RETIRED and ST_RETIRED events. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED but must be the same as for 
the INST_SPEC event. 
0x0073, DP_SPEC, Operation speculatively executed, integer data processing 


This event is similar to Operation speculatively executed, INST_SPEC, but counts only operations 
due to integer data-processing instructions. It counts the following operations that operate on the 
general-purpose registers: 


$ In AArch64 state, Data processing - immediate on page C3-214 and Data processing - 
register on page C3-219. 

° In AArch32 state, Data-processing instructions on page F1-3870. 

This includes MOV and MWN operations. 

This event also counts the following miscellaneous instructions: 


7 In AArch64 state, System register instructions on page C3-192, System instructions on 
page C3-192, and Hint instructions on page C3-193. 


à In AArch32 state, PSTATE and banked register access instructions on page F1-3878, Banked 
register access instructions on page F1-3878, Miscellaneous instructions on page F1-3883, 
other than ISB and preloads, and System register access instructions on page F1-3887, other 
than LDC and STC instructions. 


If the preload instructions PRFM, PLD, PLDW, and PLI, do not count as memory-reading instructions 
then they must count as integer data-processing instructions. 


If ISBs do not count as software change of the PC then they must count as integer data-processing 
instructions. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED, but must be the same as for 
the INST_SPEC event. 
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It is IMPLEMENTATION DEFINED whether the following instructions are counted as integer 
data-processing operations, SIMD operations, or floating-point operations, but Arm recommends 
that the instructions are all counted as integer data-processing operations: 


° For AArch64 state, from the A64 floating-point convert to integer class, operations that move 
a value between a general-purpose register and a SIMD and floating-point register without 
type conversion: 


— FMOV (general). 


° For AArch64 state, from the SIMD Move group, operations that move a values between a 
general-purpose register and an element or elements in a SIMD and floating-point register: 


— DUP (general). 

= SMOV. 

= UMOV. 

— _INS (general). 
. For AArch32 state: 


— VDUP (general-purpose register) and all VMOV instructions that transfer data between a 
general-purpose register and a SIMD and floating-point register. 


= VMRS. 
— VMSR. 


0x0074, ASE_SPEC, Operation speculatively executed, Advanced SIMD 


This event is similar to Operation speculatively executed, INST_SPEC, but the counter counts only 
operations due to Advanced SIMD data-processing instructions, see: 


è For AArch64 state, the SIMD operations listed in Data processing - SIMD and floating-point 
on page C3-227. 


s For AArch32 state, Advanced SIMD data-processing instructions on page F1-3891. 


This includes all operations that operate on the SIMD and floating-point registers, except those that 
are counted as: 


s Integer data-processing operations. 

s Floating-point data-processing operations. 
< Memory-reading operations. 

è Memory-writing operations. 


e Cryptographic operations other than PMULL, in AArch64 state. 
. VMULL, in AArch32 state. 


Advanced SIMD scalar operations are counted as Advanced SIMD operations, including those 
which operate on floating-point values. In AArch64 state, PMULL, and in AArch32 state, VMULL are 
counted as Advanced SIMD operations. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED, but must be the same as for 
the INST_SPEC event. 
0x0075, VFP_SPEC, Operation speculatively executed, floating-point 


This event is similar to Operation speculatively executed, INST_SPEC, but the counter counts only 
operations due to floating-point data-processing instructions, see: 


$ In AArch64 state, only the scalar floating-point operations listed in Data processing - SIMD 
and floating-point on page C3-227. 
Note 


This event does not count the SIMD floating-point operations listed in Data processing - 
SIMD and floating-point on page C3-227. 








° In AArch32 state, Floating-point data-processing instructions on page F1-3901. 
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This includes all operations that operate on the SIMD and floating-point registers as floating-point 
values, except for SIMD scalar operations and those that are counted as one of: 


° Integer data processing. 
. Memory-reading operations. 
è Memory-writing operations. 


The following instructions that take both an integer register and a floating-point register argument 
and perform a type conversion (to/from integer or to/from fixed-point), are counted as floating-point 
data-processing operations: 


. In AArch64 state, FCVT{<mode>}, UCVTF, and SCVTF. 
. In AArch32 state, VCVT<mode>(floating-point), VCVT, VCVTT, and VCVTB. 
The definition of Speculatively executed is IMPLEMENTATION DEFINED, but must be the same as for 
the INST_SPEC event. 
0x0076, PC_WRITE_SPEC, Operation speculatively executed, software change of the PC 


This event is similar to Operation speculatively executed, INST_SPEC, but the counter counts only 
operations due to software changes of the PC. Defined by the instruction architecturally executed, 
condition code check pass, software change of the PC event, see Common event numbers on 

page D7-2694. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED but must be the same as for 
the INST_SPEC event. 


See also PC_WRITE_RETIRED. 


0x0077, CRYPTO_SPEC, Operation speculatively executed, Cryptographic instruction 


This event is similar to Operation speculatively executed, INST_SPEC, but the counter counts only 
operations due to Cryptographic instructions, except PMULL and VMULL, see The Cryptographic 
Extension on page C3-247. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED but must be the same as for 
the INST_SPEC event. 
0x0078, BR_IMMED_ SPEC, Branch speculatively executed, immediate branch 


The counter counts immediate branch instructions speculatively executed. Defined by the 
instruction architecturally executed, immediate branch event, see Common event numbers on 
page D7-2694. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED. 
See also BR_IMMED_ RETIRED. 


0x0079, BR_RETURN_SPEC, Branch speculatively executed, procedure return 


The counter counts procedure return instructions speculatively executed. Defined by the 
BR_RETURN_RETIRED event. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED. 
See also BR_RETURN_RETIRED. 


0x007A, BR_INDIRECT_SPEC, Branch speculatively executed, indirect branch 


The counter counts indirect branch instructions speculatively executed. This includes software 
change of the PC other than exception-generating instructions and immediate branch instructions. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED. 


0x007C, ISB_SPEC, Barrier speculatively executed, ISB 


The counter counts Instruction Synchronization Barrier instructions speculatively executed, 
including CP15ISB. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED. 
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0x007D, DSB_SPEC, Barrier speculatively executed, DSB 


The counter counts data synchronization barrier instructions speculatively executed, including 
CP15DSB, SSBB and PSSBB. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED. 


0x007E, DMB_SPEC, Barrier speculatively executed, DMB 


The counter counts data memory barrier instructions speculatively executed, including CP15DSB. 
It does not include the implied barrier operations of load/store operations with release consistency 
semantics. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED. 


007F, CSDB_SPEC, Barrier speculatively executed, CSDB 


If ARMv8.5-PMU is implemented, the counter counts control speculation barrier instructions 
speculatively executed. 


The definition of Speculatively executed is IMPLEMENTATION DEFINED. 


0x0081, EXC_UNDEF, Exception taken, other synchronous 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only those 
exceptions Taken locally that are not counted as: 
° Exception taken, Supervisor Call (EXC_SVC). 
° Exception taken, Secure Monitor Call (EXC_SMC). 
a Exception taken, Hypervisor Call (EXC_HVC). 
. Exception taken, Instruction Abort (EXC_PABORT). 
- Exception taken, Data Abort or SError (EXC_DABORT). 
. Exception taken, IRQ (EXC_IRQ). 
° Exception taken, FIQ (EXC_FIQ). 


0x0082, EXC_SVC, Exception taken, Supervisor Call 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only Supervisor Call 
exceptions that are Taken locally. 

0x0083, EXC_PABORT, Exception taken, Instruction Abort 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only Instruction 
Abort exceptions that are Taken locally. 

0x0084, EXC_DABORT, Exception taken, Data Abort or SError 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only Data Abort or 
SError interrupt exceptions. The counter counts only exceptions Taken locally. 

0x0086, EXC_IRQ, Exception taken, IRQ 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only IRQ exceptions 
that are Taken locally, including Virtual IRQ exceptions. 

0x0087, EXC_FIQ, Exception taken, FIQ 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only FIQ exceptions 
that are Taken locally, including Virtual FIQ exceptions. 

0x0088, EXC_SMC, Exception taken, Secure Monitor Call 


This event is similar to Exception taken, EXC_TAKEN, but the counter counts only Secure Monitor 
Call exceptions. The counter does not increment on SMC instructions trapped as a Hyp Trap 
exception. 


0x008A, EXC_HVC, Exception taken, Hypervisor Call 


This event is similar to Exception taken, EXC_TAKEN, but the counter counts only Hypervisor Call 
exceptions. The counter counts for both Hypervisor Call exceptions Taken locally in the hypervisor 
and those taken as an exception from Non-secure EL1. 
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0x008B, EXC_TRAP_ PABORT, Exception taken, Instruction Abort not Taken locally 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only Instruction 
Abort exceptions not Taken locally. 

0x008C, EXC_TRAP DABORT, Exception taken, Data Abort or SError not Taken locally 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only Data Abort or 
SError interrupt exceptions not Taken locally. 

0x008D, EXC_TRAP OTHER, Exception taken, other traps not Taken locally 


This event is similar to Exception taken, EXC_TAKEN, but the counter counts only those traps that 
are not counted as: 

° Exception taken, Secure Monitor Call (EXC_SMC). 

. Exception taken, Hypervisor Call (EXC_HVC). 

è Exception taken, Instruction Abort not Taken locally (EXC_TRAP_PABORT). 

à Exception taken, Data Abort or SError not Taken locally (EXC_TRAP_DABORT). 

° Exception taken, IRQ not Taken locally (EXC_TRAP_IRQ). 

` Exception taken, FIQ not Taken locally (EXC_TRAP_FIQ). 


0x008E, EXC_TRAP IRQ, Exception taken, IRQ not Taken locally 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only IRQ exceptions 
not Taken locally. 

0x008F, EXC_TRAP_FIQ, Exception taken, FIQ not Taken locally 
This event is similar to Exception taken, EXC_TAKEN, but the counter counts only FIQ exceptions 
not Taken locally. 

0x0090, RC_LD_SPEC, Release consistency operation speculatively executed, Load-Acquire 
The counter counts memory-read operations with acquire or acquirepc semantics that are 
speculatively executed. 

0x0091, RC_ST_SPEC, Release consistency operation speculatively executed, Store-Release 


The counter counts memory-write operations with release semantics that are speculatively executed. 


0x00A0, L3D_CACHE_ RD, Attributable Level 3 data or unified cache access, read 


This event is similar to Attributable Level 3 data or unified cache access, L3D CACHE, but the 
counter counts only attributable memory read operations that cause a cache access to at least the 
Level 3 data or unified cache. 


0x00A1, L3D_CACHE_ WR, Attributable Level 3 data or unified cache access, write 


This event is similar to Attributable Level 3 data or unified cache access, L3D CACHE, but the 
counter counts only attributable memory write operations that cause a cache access to at least the 
Level 3 data or unified cache. 


0x00A2, L3D_CACHE_ REFILL_RD, Attributable Level 3 data or unified cache refill, read 


This event is similar to Attributable Level 3 data or unified cache refill, L3D_ CACHE REFILL, 
but the counter counts only attributable memory read operations that cause a refill of at least the 
Level 3 data or unified cache from outside the Level 3cache. See also Relationship between REFILL 
events and associated access events. on page K3-7679 





0x00A3, L3D_CACHE_ REFILL_WR, Attributable Level 3 data or unified cache refill, write 


This event is similar to Attributable Level 3 data or unified cache refill, L3D_ CACHE REFILL, 
but the counter counts only attributable memory write operations that cause a refill of at least the 
Level 3 data or unified cache from outside the Level 3cache. See also Relationship between REFILL 
events and associated access events. on page K3-7679 
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0x00A6, L3D_CACHE_WB_VICTIM, Attributable Level 3 data or unified cache Write-Back, victim 


This event is similar to Attributable Level 3 data cache Write-Back, L3D_ CACHE WB, but the 
counter counts only Write-Backs that are a result of the line being allocated for an access made by 
the PE. 


If ARMv8.4-PMU is not implemented, Write-Backs caused by the execution of a cache 
maintenance instruction are not counted. If ARMv8.4-PMU is implemented, it is IMPLEMENTATION 
DEFINED whether Write-Backs caused by the execution of a cache maintenance instruction are 
counted. 


It is IMPLEMENTATION DEFINED whether a write of a whole cache line that is not the result of the 
eviction of a line from the cache is counted. For example, this might occur if the PE detects 
streaming writes to memory and does not allocate lines to the cache, or as the result of a DC ZVA. 


0x00A7, L3D_CACHE_WB_CLEAN, Level 3 data or unified cache Write-Back, cache clean 


This event is similar to Attributable Level 3 data cache Write-Back, L3D_ CACHE WB, but the 
counter counts only Write-Backs that are a result of a coherency operation made by another PE or 
are caused by the execution of a cache maintenance instruction. Whether Write-Backs that are 
caused by the execution of a cache maintenance instruction are counted is IMPLEMENTATION 
DEFINED. 


Note 


The transfer of a dirty cache line from the Level 3 data cache of this PE to the Level 3 data cache of 
another PE due to a hardware coherency operation is not counted unless the dirty cache line is also 
written back to a Level 3 cache or memory. 








Ifa coherency request from a requestor outside the PE results in a Write-Back, it is an Unattributable 
event. 


0x00A8, L3D_CACHE_INVAL, Attributable Level 3 data or unified cache access, invalidate 
The counter counts each invalidation of a cache line in the Level 3 data or unified cache. 


The counter does not count events if a cache refill invalidates a line. 


If ARMv8.4-PMU is not implemented, the counter does not count locally-executed cache 
maintenance instructions that operate by set/way. If ARMv8.4-PMU is implemented, it is 
IMPLEMENTATION DEFINED whether the counter counts locally-executed cache maintenance 
instructions that operate by set/way. 


Note 


Software that uses this event must know whether the Level 3 data cache is shared with other PEs. 
This event does not follow the general rule of Level 3 data cache events of only counting 
Attributable events. 








K3.1.1 Relationship between REFILL events and associated access events. 


CACHE_REFILL and TLB_REFILL events count the refills for accesses that are counted by the corresponding 
CACHE or TLB event. Table K3-2 shows this correspondence. 


Table K3-2 Relationship between REFILL events and associated access events 





REFILL event Access event Ratio REFILL/Access 





0x0042 LID CACHE REFILL RD  0x0040 LID CACHE RD Attributable Level 1 cache refill rate, read 

















0x0043 LID CACHE REFILL WR _ 0x0041 Attributable Level 1 cache refill rate, write 
LID CACHE WR 
0x004C LID_TLB_REFILL_RD 0x004E LID_TLB_RD Attributable Level 1 TLB refill rate, read 
0x004D LID_TLB_REFILL_WR 0x004F LID TLB_WR Attributable Level 1 TLB refill rate, write 
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Table K3-2 Relationship between REFILL events and associated access events (continued) 





REFILL event 


0x0052 L2D CACHE REFILL RD 





Access event 


0x0050 L2D_ CACHE RD 


Ratio REFILL/Access 


Attributable Level 2 data cache refill rate, read 





0x0053 L2D CACHE REFILL WR 





0x0051 
L2D_CACHE_WR 


Attributable Level 2 data cache refill rate, write 





0x005C L2D_TLB_REFILL_RD 


0x005E L2D_TLB RD 


Attributable Level 2 data TLB refill rate, read 





0x005D L2D_TLB_REFILL_WR 


0x005F L2D TLB WR 


Attributable Level 2 data TLB refill rate, write 





0x00A2 L3D_ CACHE REFILL RD 





0x00A0 
L3D_CACHE_RD 


Attributable Level 3 data cache refill rate, read 





0x00A3 L3D CACHE REFILL WR 





0x00A1 
L3D CACHE WR 


Attributable Level 3 data cache refill rate, write 
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K3.2 Summary of events for exceptions taken to an Exception level using AArch64 
Table K3-3 shows the events for exceptions taken to an Exception level using AArch64. 
Table K3-3 Events for exceptions taken to an Exception level using AArch64 
Event number and classification for exceptions 
ESR.EC Description 
Taken locally Not Taken locally 
0x00 Unknown or uncategorized 0x0081, EXC_UNDEF 0x008D, EXC_TRAP_OTHER 
0x01 WFE/WFI traps 0x0081, EXC_UNDEF 0x008D, EXC_TRAP_OTHER 
0x03 AArch32 MCR/MRC traps on 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
(coproc==0b1111) accesses 
0x04 AArch32 MCRR/MRRC traps on 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
(coproc==0b1111) accesses 
0x05 AArch32 MCR/MRC traps on 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
(coproc==0b1110) accesses 
0x06 AArch32 LDC/STC traps on 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
(coproc==0b1110) accesses 
0x07 Advanced SIMD or FP traps 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
0x08 AArch32 MVFR* and FPSID traps - 0x008D, EXC_TRAP OTHER 
Ox0C AArch32 MCRR/MRRC traps on 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
(coproc==0b1110) accesses 
0x0E Illegal instruction set state 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
0x11 AArch32 SVC 0x0082, EXC_SVC 0x008D, EXC_TRAP_OTHER 
0x12 AArch32 HVC that is not disabled - 0x008A, EXC_HVC 
toEL2 - @x008D, EXC_TRAP_ OTHER 
0x13 AArch32 SMC that is not disabled 
toEL3 - 0x0088, EXC_SMC 
0x15 AArch64 SVC 0x0082, EXC_SVC 0x008D, EXC_TRAP_OTHER 
0x16 AArch64 HVC that is not disabled 0x008A, EXC_HVC 0x008A, EXC _ HVC 
toEL2 - 0x008D, EXC_TRAP_OTHER 
0x17 AArch64 SMC that is not disabled 
toEL3 0x0088, EXC_SMC 0x0088, EXC_SMC 
0x18 AArch64 MSR, MRS and System instruction 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
traps 
0x19 SVE traps 0x0081, EXC_UNDEF 0x008D, EXC_TRAP_OTHER 
Ox1F IMPLEMENTATION DEFINED exception IMPLEMENTATION DEFINED? IMPLEMENTATION DEFINED? 
taken to EL3 
0x20 Instruction Abort from below 0x0083, EXC_PABORT 0x008B, EXC_TRAP PABORT 
0x21 Instruction Abort from current Exception 0x0083, EXC_PABORT - 
level 
0x22 PC alignment 0x0083, EXC_PABORT 0x008B, EXC_TRAP_PABORT 
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K3.2 Summary of events for exceptions taken to an Exception level using AArch64 


Table K3-3 Events for exceptions taken to an Exception level using AArch64 (continued) 





Event number and classification for exceptions 















































ESR.EC Description 
Taken locally Not Taken locally 

0x24 Data Abort from below 0x0084, EXC_DABORT 0x008C, EXC_TRAP_DABORT 
0x25 Data Abort from current Exception level 0x0084, EXC_DABORT - 
0x26 SP alignment fault exception 0x0084, EXC_DABORT 0x008C, EXC_TRAP_DABORT 
0x28 AArch32 FP exception 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
0x2C AArch64 FP exception 0x0081, EXC_UNDEF 0x008D, EXC_TRAP OTHER 
0x2F SError interrupt 0x0084, EXC_DABORT 0x008C, EXC_TRAP_DABORT 
0x30 Breakpoint from below 0x0083, EXC_PABORT 0x008B, EXC_TRAP_PABORT 
0x31 Breakpoint from current Exception level 0x0083, EXC_PABORT - 
0x32 Software step from below 0x0083, EXC_PABORT 0x008B, EXC_TRAP_PABORT 
0x33 Software step from current Exception 0x0083, EXC_PABORT - 

level 
0x34 Watchpoint from below 0x0084, EXC_DABORT 0x008C, EXC_TRAP_DABORT 
0x35 Watchpoint from current Exception level 0x0084, EXC_DABORT - 
0x38 AArch32 BKPT instruction 0x0083, EXC_PABORT 0x008B, EXC_TRAP_PABORT 
0x3A AArch32 Vector Catch debug event 0x0083, EXC_PABORT 0x008B, EXC_TRAP_PABORT 
0x3C AArch64 BRK instruction 0x0083, EXC_PABORT 0x008B, EXC_TRAP_PABORT 





IRQ interrupt 


0x0086, EXC_IRQ 


0x008E, EXC_TRAP IRQ 





FIQ interrupt 


0x0087, EXC_FIQ 


0x008F, EXC_TRAP FIQ 





All other values 


0x008D, EXC_TRAP OTHER 





a. The exception reported with EC 0x1F is IMPLEMENTATION DEFINED, and therefore it is IMPLEMENTATION DEFINED which event counts the 
exception, except that the event that counts the exception must correctly indicate whether the exception was Taken locally. 


Note 


The Glossary defines the term Taken locally, that is used in event definitions in this chapter. See also Exception 
levels on page D1-2268 for more information. 
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Recommendations for reporting memory attributes 
on an interconnect 


This appendix describes the Arm recommendations for reporting the memory attributes that are assigned by the PE. 
It contains the following section: 


° Arm recommendations for reporting memory attributes on an interconnect on page K4-7684. 
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K4.1 


K4.1.1 


K4-7684 


Arm recommendations for reporting memory attributes on an interconnect 


The Arm architecture defines the architectural interface between software and the PE hardware. This means the 
mechanisms by which different memory type and Cacheability attributes are presented on an interface to an 
interconnect fabric such as AMBA” AXI are, strictly, outside the scope of the architecture. This appendix describes 
an approach for the interface between a PE implementation and an interconnect fabric that Arm strongly 
recommends, but these recommendations do not form part of the Armv8 architecture. 


Effect of microarchitectural choices on memory attributes 


Implementations of the Arm architecture permit considerable variability in the presentation of memory attributes 
on the interconnect fabric, particularly in cases where the PE implementation does not provide optimized support 
for a memory type. For example, an implementation might treat Write-Through locations as Non-cacheable at some 
level of cache, because functionally this is consistent with the definition of Write-Through, but for the particular 
implementation the performance trade-off does not merit the hardware directly providing Write-Through capability. 
However, in such implementations, the assigned memory attributes are not changed by the microarchitectural 
choices. The microarchitecture simply implements different ways of handling some memory attributes. 


Therefore, Arm strongly recommended that where any or all of the following memory attributes are presented on 
the interface between a PE and an interconnect fabric, the attributes that are presented are completely consistent 
with the attributes defined by the translation system: 


$ The memory type, Normal or Device. 

š The Early write acknowledgement attribute. 

a The ordering requirements. 

° The Shareability. 

è The Cacheability, including where practicable, the allocation hints. 


Effect when memory accesses are forced to be Non-cacheable 


Arm also strongly recommends that the effects of forcing accesses to Normal memory to be Non-cacheable, as 
described in Enabling and disabling the caching of memory accesses on page D4-2475 for AArch64 and in 
Enabling and disabling the caching of memory accesses in AArch32 state on page G4-5691 for AArch32, are 
reflected on the interconnect by the memory type and attributes used for memory transactions generated while the 
cache is disabled. 
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Appendix K5 


Additional Information for Implementations of the 
Generic Timer 


This appendix gives additional information about implementations of the Generic Timer. It contains the following 


sections: 
à Providing a complete set of features in a system level implementation on page K5-7686. 
s Gray-count scheme for timer distribution scheme on page K5-7688. 
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K5.1 Providing a complete set of features in a system level implementation 


As an example system design, using memory-mapped Generic Timer components as described in Chapter I2 System 
Level Implementation of the Generic Timer, the feature set of a System registers counter and timer, in an 
implementation that includes EL2 and EL3, can be implemented using the following set of timer frames: 


s A CNTCTLBase control frame. 
: The following CNTBaseNN timer frames: 


Frame 0 Accessible by Non-secure accesses, with second view and virtual capability. This provides the 
Non-secure EL1&0 timers. 


Frame 1 Accessible by Non-secure accesses, with no second view and no virtual capability. This provides 
the Non-secure EL2 timers. 


Frame 2 Accessible only by Secure accesses, with a second view but no virtual capability. This provides 
the Secure PL1&0 timers, meaning: 


° Compared to a PE where EL3 is using AArch32, it provides the only Secure state timer. 
g Compared to a PE where EL3 is using AArch64, it provides the Secure EL1&0 timer. 
Frame 3 Accessible only by Secure accesses, with no second view and no virtual capability. This provides 
the Secure EL3 timers. 
Note 


This frame is not required for a memory-mapped timer that provides only the feature set of a PE 
for which EL3 is using AArch32. 








In this implementation, the full set of implemented frames, and accessibility as memory pages in the different 
translation regimes, is as follows: 


CNTCTLBase 
The control frame. This frame is accessible in both the Secure and Non-secure memory maps, and: 
: In the Secure EL1&0 translation regime, this frame is accessible only at EL1. 
à In the Non-secure EL2 translation regime, this frame is accessible. 
° In the Non-secure EL1&0 translation regime, this frame is not accessible. 


CNTBase0 The first view of the Non-secure EL1&0 timers. This frame is accessible only in the Non-secure 
memory map, and: 


g In the Secure EL1&0 translation regime, this frame is accessible only at EL1. 

- In the Non-secure EL2 translation regime, this frame is accessible. 

. In the Non-secure EL1&0 translation regime, this frame is accessible only at EL1. 
CNTELOBase0 


The second view of CNTBase0, meaning it is the ELO view of the Non-secure EL1&0 timers. This 
frame is accessible only in the Non-secure memory map, and: 


° In the Secure EL1&0 translation regime, the architecture permits this frame to be accessible 
at EL1, or at EL1 and ELO, but does not require either of these options. 

à In the Non-secure EL2 translation regime, this frame is accessible. 

. In the Non-secure EL1&0 translation regime, this frame is accessible at EL1 and ELO. 


CNTBasel The first and only view of the Non-secure EL2 timers. This frame is accessible only in Non-secure 
memory map, and: 
° When EL3 is using AArch64: 
— Inthe Secure EL1&0 translation regime, this frame is accessible only at EL1. 
— Inthe Secure EL3 translation regime, this frame is accessible. 


è When EL3 is using AArch32, in the Secure PL1&0 translation regime, this frame is 
accessible only at PL1 (EL3). 


s In the Non-secure EL2 translation regime, this frame is accessible. 
$ In the Non-secure EL1&0 translation regime, this frame is not accessible. 
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CNTBase2 The first view of the Secure EL1&0, or PL1&0 timers. 


Note 


In AArch64 state, these timers are always called the Secure EL1&0 timers. In AArch32 state they 
are usually called the Secure PL1 &0 timers because, in AArch32 Secure state, whether some of the 
PE modes map to EL1 or to EL3 depends on whether EL3 is using AArch64 or is using AArch32, 
see Security state, Exception levels, and AArch32 execution privilege on page G1-5480. 





This frame is accessible only in the Secure memory map, and: 


° When EL3 is using AArch64: 
— Inthe Secure EL1&0 translation regime, this frame is accessible only at EL1. 
— Inthe Secure EL3 translation regime, this frame is accessible. 


. When EL3 is using AArch32, in the Secure PL1&0 translation regime, this frame is 
accessible only at PL1 (EL3). 


- Because the frame is in Secure memory, it is not accessible in any Non-secure translation 
regime. 
CNTELOBase2 
The second view of CNTBase2, meaning it is the ELO view of the Secure EL1&0, or PL1&0, timers. 
Note 


See the Note in the description of the CNTBase2 frame for more information about the naming of 
these timers. 








This frame is accessible only in the Secure memory map, and: 
$ When EL3 is using AArch64: 
— Inthe Secure EL1&0 translation regime, this frame is accessible at EL1 and ELO. 


— Inthe Secure EL3 translation regime, this frame is accessible. 


° When EL3 is using AArch32, in the Secure PL1&0 translation regime, this frame is 
accessible at PL1 (EL3) and ELO. 


° Because the frame is in Secure memory, it is not accessible in any Non-secure translation 
regime. 
CNTBase3 The first and only view of the EL3 timers. This frame is accessible only in the Secure memory map, 
and: 
$ When EL3 is using AArch64: 
— Inthe Secure EL1&0 translation regime, this frame is not accessible. 
— Inthe Secure EL3 translation regime, this frame is accessible. 


° When EL3 is using AArch32, this frame is not accessible. 


. Because the frame is in Secure memory, it is not accessible in any Non-secure translation 
regime. 





Note 


About the Virtual Memory System Architecture (VMSA) on page D5-2504 describes the VMSAv8-64 translation 
regimes, and About VMSAv8-32 on page GS-5720 describes the VMSAv8-32 translation regimes. 
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K5.2 


K5-7688 


Gray-count scheme for timer distribution scheme 


The distribution of the Counter value using a Gray-code provides a relatively simple mechanism to avoid any danger 
of the count being sampled with an intermediate value even if the clocking is asynchronous. It has a further 
advantage that the distribution is relatively low power, since only one bit changes on the main distribution wires for 
each clock tick. 


A suitable Gray-coding scheme can be achieved with the following logic: 


Gray[N] = Count[N] 
Gray[i] = (XOR(Gray[N:i+1])) XOR Count[i] for N-1 >= i >= 0 
Count[i] = XOR(Gray[N:i]) for N >= i >= @ 


This is for an N+1 bit counter, where Count is a conventional binary count value, and Gray is the corresponding 
Gray count value. 


Note 
This scheme has the advantage of being relatively simple to switch, in either direction, between operating with 
low-frequency and low-precision, and operating with high-frequency and high-precision. To achieve this, the ratio 
of the frequencies must be 2”, where n is an integer. A switch-over can occur only on the 2n+1 boundary to avoid 
losing the Gray-coding property on a switch-over. 








Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Appendix K6 
Legacy Instruction Syntax for AArch32 Instruction 
Sets 


This appendix describes the legacy instruction syntax in the Arm instruction sets, and their Unified Assembler 
Language (UAL) equivalents. It contains the following section: 


° Legacy Instruction Syntax on page K6-7690. 
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K6.1 Legacy Instruction Syntax 


Early versions of the Arm Architecture defined an assembly language for A32 (ARM) instructions, and a separate 
assembly language for T32 (Thumb) instructions. UAL is based on the A32 assembly language, with some changes 
to the instruction syntax. The appendix describes those changes. The pre-UAL mnemonics are compatible with 
UAL, and might be supported by an assembler. 


The original T32 assembly language is not compatible with UAL, and is not described in the manual. 


K6.1.1 Pre-UAL instruction syntax for the A32 base instructions 


Table K6-1 lists the syntax for the A32 base instructions that have changed after UAL was introduced. 


Table K6-1 Pre-UAL instruction syntax for the A32 base instructions 





Pre-UAL syntax UALequivalent See 





ADC<c>S ADCS<c> ADC, ADCS (immediate) on page F5-4069, 
ADC, ADCS (register) on page F5-4072, 
ADC, ADCS (register-shifted register) on page F5-4076 





ADD<c>S ADDS<c> ADD, ADDS (immediate) on page F5-4078, 
ADD, ADDS (register) on page F5-4082, 
ADD, ADDS (register-shifted register) on page F5-4086, 
ADD, ADDS (SP plus immediate) on page F5-4088, 
ADD, ADDS (SP plus register) on page F5-4091 





AND<c>S ANDS<c> AND, ANDS (immediate) on page F5-4100, 
AND, ANDS (register) on page F5-4103, 
AND, ANDS (register-shifted register) on page F5-4107 





BIC<c>S BICS<c> BIC, BICS (immediate) on page F5-4124, 
BIC, BICS (register) on page F5-4127, 
BIC, BICS (register-shifted register) on page F5-4131 





EOR<c>S EORS<c> EOR, EORS (immediate) on page F5-4186, 
EOR, EORS (register) on page F5-4189, 
EOR, EORS (register-shifted register) on page F5-4193 























LDC<c>L LDCL<c> LDC (immediate) on page F5-4220, 
LDC (literal) on page F5-4222 

LDM<c>IA, LDM<c>FD LDM<c> LDM, LDMIA, LDMFD on page F5-4224 

LDM<c>DA, LDM<c>FA — LDMDA<c> LDMDA, LDMFA on page F5-4232 

LDM<c>DB, LDM<c>EA — LDMDB<c> LDMDB, LDMEA on page F5-4234 

LDM<c>IB, LDM<c>ED — LDMIB<c> LDMIB, LDMED on page F5-4237 

LDR<c>B LDRB<c> LDRB (immediate) on page F5-4249, 


LDRB (literal) on page F5-4253, 
LDRB (register) on page F5-4255 





LDR<c>BT LDRBT<c> LDRBT on page F5-4258 





LDR<c>D LDRD<c> LDRD (immediate) on page F5-4261, 
LDRD (literal) on page F5-4264, 
LDRD (register) on page F5-4267 
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Table K6-1 Pre-UAL instruction syntax for the A32 base instructions (continued) 





Pre-UAL syntax 


UAL equivalent 


See 














LDR<c>H LDRH<c> LDRH (immediate) on page F5-4278, 
LDRH (literal) on page F5-4282, 
LDRH (register) on page F5-4284 

LDR<c>SB LDRSB<c> LDRSB (immediate) on page F5-4290. 
LDRSB (literal) on page F5-4293, 
LDRSB (register) on page F5-4295 

LDR<c>SH LDRSH<c> LDRSH (immediate) on page F5-4301, 
LDRSH (literal) on page F5-4304, 
LDRSH (register) on page F5-4306 

LDR<c>T LDRT<c> LDRT on page F5-4312 

LA<c>S MLAS<c> MLA, MLAS on page F5-4335 





LSLS <Rd>, <Rn>, #0 


MOVS <Rd>, <Rm> 





MOV, MOVS (immediate) on page F5-4339, 
MOY, MOVS (register) on page F5-4343 
























































lOV<c>S MOVS<c> 
UL<c>S MULS<c> MUL, MULS on page F5-4373 
WN<c>S MVNS<c> MVN, MVNS (immediate) on page F5-4375, 
MVN, MVNS (register) on page F5-4377, 
MVN, MVNS (register-shifted register) on page F5-4380 
ORR<c>S ORRS<C> ORR, ORRS (immediate) on page F5-4388, 
ORR, ORRS (register) on page F5-4391, 
ORR, ORRS (register-shifted register) on page F5-4395 
QADDSUBX QASX QASX on page F5-4428 
QSUBADDX QSAX OSAX on page F5-4434 
RSB<c>S RSBS<c> RSB, RSBS (immediate) on page F5-4465, 
RSB, RSBS (register) on page F5-4468, 
RSB, RSBS (register-shifted register) on page F5-4471 
RSC<c>S RSCS<c> RSC, RSCS (immediate) on page F5-4473, 
RSC, RSCS (register) on page F5-4475, 
RSC, RSCS (register-shifted register) on page F5-4477 
SADDSUBX SASX SASX on page F5-4483 
SBC<c>S SBCS<c> SBC, SBCS (immediate) on page F5-4487, 
SBC, SBCS (register), 
SBC, SBCS (register-shifted register) on page F5-4494 
SHADDSUBX SHASX SHASX on page F5-4512 
SHSUBADDX SHSAX SHSAX on page F5-4514 
SMI<c> SMC<c> SMC on page F5-4520 
SMLAL<c>S SMLALS<c> SMLAL, SMLALS on page F5-4526 
SMULL<c>S SMULLS<c> SMULL, SMULLS on page F5-4549 
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Table K6-1 Pre-UAL instruction syntax for the A32 base instructions (continued) 





Pre-UAL syntax UAL equivalent See 



















































































SSUBADDX<c> SSAX<c> SSAX on page F5-4563 
STC<c>L STCL<c> STC on page F5-4571 
STM<c>EA, STM<c>IA = STM<c> STM, STMIA, STMEA on page F5-4591 
STM<c>DA, STM<c>ED = STMDA<c> STMDA, STMED on page F5-4597 
STM<c>DB, STM<c>FD = STMDB<c> STMDB, STMFD on page F5-4599 
STM<c>IB, STM<c>FA = STMIB<c> STMIB, STMFA on page F5-4602 
STR<c>B STRB<c> STRB (immediate) on page F5-4612, 
STRB (register) on page F5-4616 
STR<c>BT STRBT<c> STRBT on page F5-4619 
STR<c>D STRD<c> STRD (immediate) on page F5-4623, 
STRD (register) on page F5-4627 
STR<c>H STRH<c> STRH (immediate) on page F5-4641, 
STRH (register) on page F5-4645 
STR<c>T STRT<c> STRT on page F5-4652 
SUB<c>S SUBS<c> SUB, SUBS (immediate) on page F5-4657, 
SUB, SUBS (register) on page F5-4661, 
SUB, SUBS (register-shifted register) on page F5-4665, 
SUB, SUBS (SP minus immediate) on page F5-4667, 
SUB, SUBS (SP minus register) on page F5-4670 
SWI SVC SVC on page F5-4673 
UADDSUBX UASX UASX on page F5-4707 
UHADDSUBX UHASX UHASX on page F5-4719 
UHSUBADDX UHSAX UHSAX on page F5-4721 
UMLAL<c>S UMLALS<c> UMLAL, UMLALS on page F5-4729 
UMULL<c>S UMULLS<c> UMULL, UMULLS on page F5-4731 
UQADDSUBX UQASX UQASX on page F5-4737 
UQSUBADDX UQSAX UQSAX on page F5-4739 
USUBADDX USAX USAX on page F5-4753 
UEXT8 UXTB UXTB on page F5-4765 
UEXT16 UXTH UXTH on page F5-4769 
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Legacy Instruction Syntax for AArch32 Instruction Sets 
K6.1 Legacy Instruction Syntax 


K6.1.2 Pre-UAL instruction syntax for the A32 floating-point instructions 


Table K6-2 lists the syntax for A32 floating-point instructions that have changed after UAL was introduced. 


Table K6-2 Pre-UAL instruction syntax for A32 floating-point instructions 





Pre-UAL syntax 


UAL equivalent 


See 


























FABSD VABS . F64 VABS on page F6-4827 

FABSS VABS . F32 

FADDD VADD. F64 VADD (floating-point) on page F6-4841 
FADDS VADD. F32 

FCMPEZD VCMPE . F64 VCMPE on page F6-4916 

FCMPEZS VCMPE.. F32 

FCMPZD VCMP . F64 VCMP on page F6-4912, 

FCMPZS VCMP . F32 








FCONSTD <Dd>, #<imm8> VMOV. 


F64 <Dd>, #<fpimm> 





FCONSTS <Sd>, #<imm8> VMOV. 


F32 <Sd>, #<fpimm> 


VMOV (immediate) on page F6-5130 
For more information, see FCONST on page K6-7695. 












































FCPYD VMOV .F64 VMOV (register) on page F6-5137 

FCPYS VMOV . F32 

FCVTDS VCVT. F64.F32 VCVT (between double-precision and single-precision) on 
page F6-4922 

FCVTSD VCVT.F32.F64 

FDIVD VDIV.F64 VDIV on page F6-4969 

FDIVS VDIV.F32 

FLDD VLDR. F64 VLDR (immediate) on page F6-5076 
VLDR (literal) on page F6-5079 

FLDMD, FLDMIAD VLDM. F64 VLDM, VLDMDB, VLDMIA on page F6-5071 

FLDMS VLDM. F32 

FLDS VLDR. F32 VLDR (immediate) on page F6-5076 
VLDR (literal) on page F6-5079 

FMACD VMLA. F64 VMLA (floating-point) on page F6-5100 

FMACS VMLA. F32 

FMDHR <Dd>, <Rt> VMOV <Dd[1]>, <Rt> VMOV (general-purpose register to scalar) on page F6-5141 
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DLR <Dd>, <Rt> 


VMOV 


<Dd[@]>, <Rt> 
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FMDRR VMOV VMOV (between two general-purpose registers and a doubleword 
floating-point register) on page F6-5126 
FMRDH <Rt>, <Dd> VMOV <Rt>, <Dd[1]> VMOV (scalar to general-purpose register) on page F6-5145 
FMRDL <Rt>, <Dd> VMOV <Rt>, <Dd[@]> 
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Table K6-2 Pre-UAL instruction syntax for A32 floating-point instructions (continued) 

















































































































Pre-UAL syntax UAL equivalent See 

FMRRD VMOV VMOV (between two general-purpose registers and a doubleword 
floating-point register) on page F6-5126 

FMRRS VMOV VMOV (between two general-purpose registers and two 
single-precision registers) on page F6-5147 

FMRS VMOV VMOV (between general-purpose register and single-precision) on 
page F6-5143 

FMRX VMRS VMRS on page F6-5156 

FMSCD VNMLS . F64 VNMLS on page F6-5189 

FMSCS VNMLS . F32 

FMSR VMOV VMOV (between general-purpose register and single-precision) on 
page F6-5143 

FMSRR VMOV VMOV (between two general-purpose registers and two 
single-precision registers) on page F6-5147 

FMSTAT VMRS APSR_nzcv, FPSCR VMRS on page F6-5156 

FMULD VMUL . F64 VMUL (floating-point) on page F6-5161 

FMULS VMUL . F32 

FMXR VMSR VMSR on page F6-5159 

FNEGD VNEG. F64 VNEG on page F6-5182 

FNEGS VNEG. F32 

FNMACD VMLS . F64 VNMLS on page F6-5189 

FNMACS VMLS . F32 

FNMSCD VNMLA. F64 VNMLA on page F6-5186 

FNMSCS VNMLA. F32 

FNMULD VNMUL . F64 VNMUL on page F6-5192 

FNMULS VNMUL . F32 

FSHTOD VCVT.F64.S16 VCVT (between floating-point and fixed-point, floating-point) on 
page F6-4939 

FSHTOS VCVT.F32.S16 

FSITOD VCVT. F64.S32 VCVT (between floating-point and integer, Advanced SIMD) on 
page F6-4926, VCVTR on page F6-4962 

FSITOS VCVT .F32.S32 

FSLTOD VCVT. F64.S32 VCVT (between floating-point and fixed-point, floating-point) on 
page F6-4939 

FSLTOS VCVT .F32.S32 

FSQRTD VSQRT . F64 VSORT on page F6-5375 

FSQRTS VSQRT. F32 

FSTD VSTR VSTR on page F6-5430 
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Legacy Instruction Syntax for AArch32 Instruction Sets 
K6.1 Legacy Instruction Syntax 


Table K6-2 Pre-UAL instruction syntax for A32 floating-point instructions (continued) 





Pre-UAL syntax 


UAL equivalent 





See 



















































































FSTMD, FSTMIAS VSTM. F64 VSTM, VSTMDB, VSTMIA on page F6-5425 

FSTMS VSTM. F32 

FSTS VSTR VSTR on page F6-5430 

FSUBD VSUB . F64 VSUB (floating-point) on page F6-5433 

FSUBS VSUB. F32 

FTOSHD VCVT. S16. F64 VCVT (between floating-point and fixed-point, floating-point) on 
page F6-4939 

FTOSHS VCVT.S16.F23 

FTOSID VCVT. S32. F64 VCVT (between floating-point and integer, Advanced SIMD) on 
page F6-4926 

FTOSIS VCVT.S32.F32 

FTOSIZD VCVTR. S32 . F64 VCVTR on page F6-4962 

FTOSIZS VCVTR. S32. F32 

FTOSLD VCVT. S32. F64 VCVT (between floating-point and fixed-point, floating-point) on 
page F6-4939 

FTOSLS VCVT.S32.F32 

FTOUHD VCVT.U16. F64 

FTOUHS VCVT.U16.F32 

FTOUID VCVT . U32. F64 VCVT (between floating-point and integer, Advanced SIMD) on 
page F6-4926 

FTOUIS VCVT.U32.F32 

FTOUIZD VCVTR.U32.F64 VCVTR on page F6-4962 

FTOUIZS VCVTR.U32.F32 

FTOULD VCVT . U32. F64 VCVT (between floating-point and fixed-point, floating-point) on 
page F6-4939 

FTOULS VCVT.U32.F32 

FUHTOD, VCVT.F64.U16 

FUHTOS VCVT.F64.U16 

FUITOD VCVT . F64.U32 VCVT (between floating-point and integer, Advanced SIMD) on 
page F6-4926 

FUITOS VCVT.F32.U32 

FULTOD VCVT . F64.U32 VCVT (between floating-point and fixed-point, floating-point) on 
page F6-4939 

FULTOS VCVT.F32.U32 

















K6.1.3 FCONST 
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The syntax of FCONST is 


FCONST<dest>{<c>} <Fd>, #<imm8> 
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K6.1 Legacy Instruction Syntax 


K6-7696 


where: 


<dest> 


<C> 


<Fd> 


<imm8> 


Specifies the destination data type. It must be one of: 

S Single-precision floating-point. 

D Double-precision floating-point. 

This is an optional field. It specifies the condition under which the instruction is executed. See 
Conditional execution on page F2-3909 for the range of available conditions and their encoding. If 
<c> is omitted, it defaults to always (AL). 

Specifies the destination register. It must be one of: 

<Dd> 64-bit name of the SIMD&FP destination register. 

<Sd> 32-bit name of the SMID&FP destination register. 


Specifies the immediate value used to generate the floating-point constant. 


FCONSTD{<c>} <Dd>, #<imm8> maps to VMOV.F64 <Dd>, #<fpimm> 


FCONSTS{<c>} <Sd>, #<imm8> maps to VMOV.F32 <Sd>, #<fpimm> 
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Address translation examples 


ARM DDI 0487E.a 
ID070919 


This appendix gives examples of address translations using the translation regimes described in Chapter D5 The 
AArch64 Virtual Memory System Architecture and Chapter G5 The AArch32 Virtual Memory System Architecture. 
It contains the following sections: 

s AArch64 Address translation examples on page K7-7698. 

. AArch32 Address translation examples on page K7-7710. 


Note 


This chapter gives examples of translation table lookups for the Armv8 address translation stages. It does not define 
any part of the address translation mechanism. If any information in this appendix appears to contradict the 
information in Chapter D5 The AArch64 Virtual Memory System Architecture or Chapter G5 The AArch32 Virtual 
Memory System Architecture then the information in Chapter D5 or Chapter G5 must be taken as the definition of 
the required behavior. 
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K7.1 


K7.1.1 


K7-7698 


AArch64 Address translation examples 


Figure D5-1 on page D5-2514 shows the VMSAv8 address translation stages that are controlled by an Exception 
level that is using AArch64. The VMSAv8-64 address translation system on page D5-2512 describes the 
VMSAv8-64 address translation scheme. This section gives examples of the use of that scheme, for common 
translation requirements. 


System registers relevant to MMU operation on page D5-2519 specifies the relevant registers, including the 
TCR_ELx and TTBR_ELx, or TTBR_ELxs, for each stage of address translation. 


For any stage of translation, a TCR_ELx.TnSZ field indicates the supported input address size. For a stage of 
address translation controlled from an Exception level using AArch64, the supported input address size is 2(64-T"SZ), 


This section describes: 


: Performing the initial lookup, for an address for which the initial lookup is either: 
— At the highest lookup level used for the appropriate translation granule size. 


— Because of the concatenation of translation tables at the initial lookup level, one level down from the 
highest level used for the translation granule size. 


These descriptions take account of the following cases: 


— The TA size is smaller than the largest size for the translation level, see Reduced IA width on 
page D5-2531. 


— Fora stage 2 translation, translation tables are concatenated, to move the initial lookup level down by 
one level, see Concatenated translation tables on page D5-2532. 


For examples of performing the initial lookup, see Examples of performing the initial lookup. 
: The full translation flow for resolving a page of memory. These examples describe resolving the largest IA 


size supported by the initial lookup level. For these examples, see Full translation flows for VMSAv8-64 
address translation on page K7-7704. 


Examples of performing the initial lookup 


The address ranges used for the initial translation table lookup depend on the translation granule, as described in: 
. Performing the initial lookup using the 4KB translation granule. 

. Performing the initial lookup using the 16KB granule on page K7-7700. 

° Performing the initial lookup using the 64KB translation granule on page K7-7702. 


Performing the initial lookup using the 4KB translation granule 


This subsection describes examples of the initial lookup when using the 4KB translation granule that Table D5-13 
on page D5-2537 shows as starting at level 0 or at level 1. It includes those stage 2 translations where concatenation 
of translation tables is required for the lookup to start at level 1. This means that it gives specific examples of the 
mechanisms described in The VMSAv8-64 address translation system on page D5-2512. 





Note 


For stage 2 translations, the same principles apply to an initial lookup that Table D5-13 on page D5-2537 shows as 
starting at level 1. In this case, for some IA sizes concatenation of translation tables means the lookup can, instead, 
start at level 2. 





The following subsections describe these examples of the initial lookup: 
. Initial lookup at level 0, 4KB translation granule on page K7-7699. 
. Initial lookup at level 1, 4KB translation granule on page K7-7699. 


In all cases, for a stage 2 translation, the VTCR_EL2.SL0 field must indicate the required initial lookup level, and 
this level must be consistent with the value of the VTCR_EL2.TOSZ field, see Overview of stage 2 translations, 
4KB granule on page DS-2537. 
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K7.1 AArch64 Address translation examples 


Initial lookup at level 0, 4KB translation granule 


This subsection describes initial lookups with an input address width of (n+1) bits, meaning the input address is 
IA[n:0]. As Table D5-13 on page D5-2537 shows, a stage 1 or stage 2 initial lookup at level 0 is required when 
39<n<47. For these lookups: 


° TTBR_ELx[47:(n-35)] specify the translation table base address. 
$ Bits[n:39] of the input address are bits[(n-36):3] of the descriptor offset in the translation table. 





Note 
This means that, when the input address width is less than 48 bits 
. The size of the translation table is reduced. 
ë More low-order bits of the TTBR_ELx are required to specify the translation table base 
address. 
° Fewer input address bit are used to specify the descriptor offset in the translation table. 


For example, if the input address width is 46 bits: 

. The translation table size is IKB, 

° TTBR_ELx bits[47:10] specify the translation table base address. 
š Input address bits[45:39] specify bits[9:3] of the descriptor offset. 





Figure K7-1 shows this lookup. 


47 y 39 38 0 


48 47 
Register-defined Translation table base address[47:x] reso TTBR 











47 x x-1 3 2 0 


íj Descriptor address* 


Supported input address range is IA[y:0], 4 < x < 12, y= x + 35. When y is 47 the field marked t is absent. 


t For an EL1&0 stage 1 translation, when EL2 is implemented and enabled in the current Security state, the IPA of the descriptor. 
Otherwise, the PA of the descriptor. 


* Field has additional properties to the default RESO definition, see the register description for more information. 
Figure K7-1 Initial lookup for VMSAv8-64 using the 4KB granule, starting at level 0 


Initial lookup at level 1, 4KB translation granule 


This subsection describes initial lookups with an input address width of (n+1) bits, meaning the input address is 
1A[n:0]. 


For a stage 1 or stage 2 initial lookup at level 1, without use of concatenated translation tables 


As Table D5-13 on page D5-2537 shows, this applies to IA[n:0], where 30 < n < 38. For these 
lookups: 


a There is a single translation table at this level. 

° TTBR_ELx[47:(n-26)] specify the translation table base address. 

$ Bits[n:30] of the input address are bits[(n-27):3] of the descriptor offset in the translation 
table. 


Figure K7-2 on page K7-7700 shows this lookup. 
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47 y 30 29 0 





63 48:47 Xx-1 0 


Register-defined Translation table base address[47:x] TTBR 


ie Y N 
47 x x-1 3 


2 0 
Supported input address range is IA[y:0], 4 < x < 12, y = x + 26. 


t For an EL1&0 stage 1 translation, when EL2 is implemented and enabled in the current Security state, the IPA of the descriptor. 
Otherwise, the PA of the descriptor. 











* Field has additional properties to the default RESO definition, see the register description for more information. 


Figure K7-2 Initial lookup for VMSAv8-64 using the 4KB granule, starting at level 1, without concatenation 


For a stage 2 initial lookup at level 1, with concatenated translation tables 


As Table D5-13 on page D5-2537 shows, this applies to IA[n:0], where 39 < n < 42. For these 


lookups: 
e There are 20-38) concatenated translation tables at this level. 
è These concatenated translation tables must be aligned to 20-38)x4KB. This means 


TTBR_ELx[(n-27):12] must be zero. 


. TTBR_ELx[47:(n-26)] specify the base address of the block of concatenated translation 
tables. 


° Bits[n:30] of the input address are bits[(n-27):3] of the descriptor offset from the base address 
of the block of concatenated translation tables. 


Figure K7-3 shows this lookup. 








y+1 
47 y 30 29 0 
\ y) 
xX 
x-1 
63 48:47 x 1211 0 


Register-defined Translation table base address[47:x] TTBR 
x i 
( Yai N 
47 


x 3 2 0 


Supported input address range is IPA[y:0], 4 < x < 16, y= x + 26. The field marked + must be zero. 
* Field has additional properties to the default RESO definition, see the register description for more information. 














Figure K7-3 Initial lookup for VMSAv8-64 using the 4KB granule, starting at level 1, with concatenation 


Performing the initial lookup using the 16KB granule 


This subsection describes examples of the initial lookup when using the 16KB translation granule that Table D5-15 
on page D5-2541 shows as starting at level 0 or at level 1. It includes those stage 2 translations where concatenation 
of translation tables is required for the lookup to start at level 1. This means that it gives specific examples of the 
mechanisms described in The VMSAv8-64 address translation system on page D5-2512. 
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Note 


For stage 2 translations, the same principles apply to an initial lookup that Table D5-15 on page D5-2541 shows as 
starting at level 1. In this case, for some IA sizes concatenation of translation tables means the lookup can, instead, 
start at level 2. 





The following subsections describe these examples of the initial lookup: 
° Initial lookup at level 0, 16KB translation granule. 
. Initial lookup at level 1, 16KB translation granule. 


In all cases, for a stage 2 translation, the VTCR_EL2.SL0 field must indicate the required initial lookup level, and 
this level must be consistent with the value of the VTCR_EL2.TOSZ field, see Overview of stage 2 translations, 
16KB granule on page D5-2541. 


Initial lookup at level 0, 16KB translation granule 


This subsection describes initial lookups with an input address width of (n+1) bits, meaning the input address is 
IA[n:0]. As Table D5-14 on page D5-2540 shows, the only case where an address translation using the 16KB 
granule starts at level 0 is a stage 1 translation of a 48-bit input address, [A[47:0]. For this lookup: 


s The required translation table has only two entries, meaning its size is 16 bytes, and it must be aligned to 16 
bytes. 


° TTBR_ELx[47:4] specify the translation table base address. 


è Bit[47] of the input address is bits[3] of the descriptor offset in the translation table. 


Figure K7-4 shows this lookup. 














47 46 0 
| Input address 
l 
63 48 47 43 0 
Register-defined | Translation table base address[47:4] Ea] TTBR 
N ) 
4 | 
47 432 0 


| [Jooo] Descriptor address" 


Supported input address range is IA[47:0]. The field marked f is RESO*. 


t For an EL1&0 stage 1 translation, when EL2 is implemented and enabled in the current Security state, the IPA of the descriptor. 
Otherwise, the PA of the descriptor. 


* Field has additional properties to the default RESO definition, see the register description for more information. 


Figure K7-4 Initial lookup for VMSAv8-64 using the 16KB granule, starting at level 0 


Initial lookup at level 1, 16KB translation granule 


This subsection describes initial lookups with an input address width of (n+1) bits, meaning the input address is 
1A[n:0]. 


For a stage 1 or stage 2 initial lookup at level 1, without use of concatenated translation tables 


As Table D5-15 on page D5-2541 shows, this applies to IA[n:0], where 36 < n < 46. For these 


lookups: 

è There is a single translation table at this level. 

° TTBR_ELx[47:(n-32)] specify the translation table base address. 

s Bits[n:36] of the input address are bits[(n-33):3] of the descriptor offset in the translation 
table. 


Figure K7-5 on page K7-7702 shows this lookup. 
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47 y 36 35 0 


63 48:47 x x-1 0 


Register-defined | Translation table base address[47:x] [eso TTBR 


( Y N 
47 x x-1 3 


2 0 
Supported input address range is IA[y:0], 4 < x < 14, y= x + 32. 


t For an EL1&0 stage 1 translation, when EL2 is implemented and enabled in the current Security state, the IPA of the descriptor. 
Otherwise, the PA of the descriptor. 











* Field has additional properties to the default RESO definition, see the register description for more information. 


Figure K7-5 Initial lookup for VMSAv8-64 using the 16KB granule, starting at level 1, without concatenation 


For a stage 2 initial lookup at level 1, with concatenated translation tables 


As Table D5-15 on page D5-2541 shows, the only case where an address translation using the 16KB 
granule starts at level 1 because of concatenation of translation tables is a stage 2 translation of a 
48-bit input address, [A[47:0]. For this lookup: 


. There are two concatenated translation tables at this level. 


a These concatenated translation tables must be aligned to 2x 16KB. This means 
TTBR_ELx[14] must be zero. 


: TTBR_ELx[47:15] specify the base address of the block of two concatenated translation 
tables. 


s Bits[47:36] of the input address are bits[14:3] of the descriptor offset from the base address 
of the block of concatenated translation tables. 


Figure K7-6 shows this lookup. 




















47 36 35 0 
\ y) 
X 
63 48:47 15 14 13 0 
Register-defined | Translation table base address[47:15] TTBR 
\ ¥ ) 1 
í Y N 


:47 15 14 3 


2 0 


Supported input address range is IPA[47:0]. The bit marked + must be zero. 
* Field has additional properties to the default RESO definition, see the register description for more information. 


Figure K7-6 Initial lookup for VMSAv8-64 using the 16KB granule, starting at level 1, with concatenation 


Performing the initial lookup using the 64KB translation granule 


This subsection describes examples of the initial lookup when using the 64KB translation granule that Table D5-17 
on page D5-2545 shows as starting at level 1 or at level 2. It includes those stage 2 translations where concatenation 
of translation tables is required for the lookup to start at level 2. This means that it gives specific examples of the 
mechanisms described in The VMSAv8-64 address translation system on page D5-2512. 
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Note 


For stage 2 translations, the same principles apply to an initial lookup that Table D5-17 on page D5-2545 shows as 
starting at level 2. In this case, for some IA sizes concatenation of translation tables means the lookup can, instead, 
start at level 3. 





The following subsections describe these examples of the initial lookup: 
° Initial lookup at level 1, 64KB translation granule. 
. Initial lookup at level 2, 64KB translation granule. 


In all cases, for a stage 2 translation, the VTCR_EL2.SL0 field must indicate the required initial lookup level, and 
this level must be consistent with the value of the VTCR_EL2.TOSZ field, see Overview of stage 2 translations, 
64KB granule on page D5-2545. 


Initial lookup at level 1, 64KB translation granule 


This subsection describes initial lookups with an input address width of (n+1) bits, meaning the input address is 
IA[n:0]. As Table D5-17 on page D5-2545 shows, a stage 1 or stage 2 initial lookup at level 1 is required when 42 
<n < 47. For these lookups: 


° The size of the translation table is 20-39) bytes. This means the size of the translation table, at this level, is 
always less than the granule size. The address of this translation table must align to the size of the table. 
a Bits[n:42] of the input address are bits[(n-39):3] of the descriptor offset in the translation table. 


° Bits[47:(n-38)] of the TTBR_ELx specify the translation table base address. 
Figure K7-7 shows this lookup. 


yt 
42 41 0 


47 y 
| Input address 
48.47 


63 Pah 0 
Register-defined Translation table base address[47:x] [Reo | TTBR 
N ) 








X 


í Y à 
47 x 3 


23 0 
[ [ooo] Descriptor address* 


Supported input address range is IA[y:0], 4 < x y = x + 38. When y is 47 the field marked ¥ is absent. 


t For an EL1&0 stage 1 translation, when EL2 is implemented and enabled in the current Security state, the IPA of the descriptor. 
Otherwise, the PA of the descriptor. 


* Field has additional properties to the default RESO definition, see the register description for more information. 





Figure K7-7 Initial lookup for VMSAv8-64 using the 64KB granule, starting at level 1 


Initial lookup at level 2, 64KB translation granule 


This subsection describes initial lookups with an input address width of (n+1) bits, meaning the input address is 
IA[n:0]. 


For a stage 1 or stage 2 initial lookup at level 2, without the use of concatenated translation tables 


As Table D5-17 on page D5-2545 shows, this applies to IA[n:0], where 29 < n < 41. For these 


lookups: 

è There is a single translation table at this level. 

° TTBR_ELx[47:(n-25)] of the specify the translation table base address. 

5 Bits[n:29] of the input address are bits[(n-26):3] of the descriptor offset in the translation 
table. 


Figure K7-8 on page K7-7704 shows this lookup. 
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47 y 29 28 0 
N ) 
RESO M 
x-1 
63 48.47 ix 0 
Register-defined | Base address[47:x] TTBR 
N J 
í Y D 
x-1 


47 


ix 3 2 0 


Supported input address range is IA[y:0]. 4 < x < 16, y = x + 25. 


t For an EL1&0 stage 1 translation, when EL2 is implemented and enabled in the current Security state, the IPA of the descriptor. 
Otherwise, the PA of the descriptor. 


* Field has additional properties to the default RESO definition, see the register description for more information. 


Figure K7-8 Initial lookup for VMSAv8-64 using the 64KB granule, starting at level 2, without concatenation 


For a stage 2 initial lookup at level 2, with concatenated translation tables 


As Table D5-17 on page D5-2545 shows, this applies to [A[n:0], where 42 <n < 45. For these 
lookups: 


. There are 20-41) concatenated translation tables at this level. 


These concatenated translation tables must be aligned to 2-4!)x64KB. This means 
TTBR_ELx[(n-26):16] must be zero. 


è: TTBR_ELx[47:(n-25)] specify the base address of the block of translation tables. 


Bits[7:42] of the input address are bits[(n-26):16] of the descriptor offset from the base 
address of the block of translation tables. 


Figure K7-9 shows this lookup. 
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Supported input address range is IPA[y:0], 4 < x < 20, y = x + 25. 
* Field has additional properties to the default RESO definition, see the register description for more information. 


Figure K7-9 Initial lookup for VMSAv8-64 using the 64KB granule, starting at level 2, with concatenation 


K7.1.2 Full translation flows for VMSAv8-64 address translation 


In a translation table walk, only the first lookup uses the translation table base address from the appropriate 
TTBR_ELx. Subsequent lookups use a combination of address information from: 


. The table descriptor read in the previous lookup. 
° The input address. 


This section describes example full translation flows, from the initial lookup to the address of a memory page. The 
example flows: 


Resolve the maximum -sized IA range supported by the initial lookup level. 
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: Do not have any concatenation of translation tables. 
a Cover only the 4KB and the 64KB translation granules. 


Examples of performing the initial lookup on page K7-7698 described how either reducing the IA range or 
concatenating translation tables affects the initial lookup. 


Note 
Reducing the IA range or concatenating translation tables affects only the initial lookup. 





The following sections describe full VMSAv8-64 translation flows, down to an entry for a memory page: 
. The address and properties fields shown in the translation flows. 

. Full translation flow using the 4KB granule and starting at level 0. 

. Full translation flow using the 4KB granule and starting at level 1 on page K7-7707. 

. Full translation flow using the 64KB granule and starting at level 1 on page K7-7708. 

. Full translation flow using the 64KB granule and starting at level 2 on page K7-7709. 


The address and properties fields shown in the translation flows 


For an EL1&0 stage 1 translation, when EL2 is implemented and enabled in the current Security state: 
° Any descriptor address is the IPA of the required descriptor. 
° The final output address is the IPA of the block or page. 


In these cases, an EL1&0 stage 2 translation is performed to translate the IPA to the required PA. 


For all other translations, the final output address is the PA of the block or page, and any descriptor address is the 
PA of the descriptor. 


Properties indicates register or translation table fields that return information, other than address information, about 
the translation or the targeted memory region. For more information see Memory attribute fields in the VMSAv8-64 
translation table format descriptors on page D5-2570. 


Full translation flow using the 4KB granule and starting at level 0 


Figure K7-10 on page K7-7706 shows the complete translation flow for a stage 1 translation table walk for a 48-bit 
input address. This lookup must start with a level 0 lookup. For more information about the fields shown in the 
figure see The address and properties fields shown in the translation flows. 
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For details of Properties fields, see the register or descriptor description. 


* Field has additional properties to the default RESO definition, see the register description for more information. 
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Figure K7-10 Complete stage 1 translation of a 48-bit address using the 4KB translation granule 


If the level 1 lookup or level 2 lookup returns a block descriptor then the translation table walk completes at that 


level. 


Figure K7-10 shows a stage 1 translation. The only difference for a stage 2 translation is that bits[63:58] of the Table 


descriptors are SBZ. 


K7-7706 Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


ARM DDI 0487E.a 


ID070919 


Address translation examples 
K7.1 AArch64 Address translation examples 


Full translation flow using the 4KB granule and starting at level 1 


Figure K7-11 shows the complete translation flow for a stage 1 translation table walk for a 39-bit input address. This 
lookup must start with a level 1 lookup. For more information about the fields shown in the figure see The address 


and properties fields shown in the translation flows on page K7-7705. 
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For details of Properties fields, see the register or descriptor description. 
* Field has additional properties to the default RESO definition, see the register description for more information. 
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Figure K7-11 Complete stage 1 translation of a 39-bit address using the 4KB translation granule 


If the level 1 lookup or the level 2 lookup returns a block descriptor then the translation table walk completes at that 


level. 


Figure K7-11 shows a stage 1 translation. The only difference for a stage 2 translation is that bits[63:58] of the Table 


descriptors are SBZ. 


Comparing this translation with the translation for a 48-bit address, shown in Figure K7-10 on page K7-7706, shows 


how the translation for the 42-bit address start the same lookup process one stage later. 
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Full translation flow using the 64KB granule and starting at level 1 


Figure K7-10 on page K7-7706 shows the complete translation flow for a stage 1 translation table walk for a 48-bit 
input address. This lookup must start with a level 0 lookup. For more information about the fields shown in the 
figure see The address and properties fields shown in the translation flows on page K7-7705. 
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For details of Properties fields, see the register or descriptor description. pan 


* Field has additional properties to the default RESO definition, see the register description for more information. 


Figure K7-12 Complete stage 1 translation of a 48-bit address using the 64KB translation granule 
If the level 2 lookup returns a block descriptor then the translation table walk completes at that level. 


Figure K7-12 shows a stage 1 translation. The only difference for a stage 2 translation is that bits[63:58] of the Table 
descriptors are SBZ. 


The level 1 lookup resolves only 6 bits of the input address. As described in Performing the initial lookup using the 
64KB translation granule on page K7-7702, this means: 


° The translation table size for this level is only 512 bytes. 
è The required translation table alignment for this level is 512 bytes. 
° The Base address field in the TTBR_ELx is extended, at the low-order end, to be bits[47:9]. 
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Full translation flow using the 64KB granule and starting at level 2 


Figure K7-11 on page K7-7707 shows the complete translation flow for a stage 1 translation table walk for a 42-bit 
input address. This lookup must start with a level 2 lookup. For more information about the fields shown in the 


figure see The address and properties fields shown in the translation flows on page K7-7705. 
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* Field has additional properties to the default RESO definition, see the register description for more information. 
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Figure K7-13 Complete stage 1 translation of a 42-bit address using the 64KB translation granule 


If the level 2 lookup returns a block descriptor then the translation table walk completes at that level. 


Figure K7-13 shows a stage 1 translation. The only difference for a stage 2 translation is that bits[63:58] of the Table 


descriptors are SBZ. 


Comparing this translation with the translation for a 48-bit address, shown in Figure K7-12 on page K7-7708, 


shows: 
s The translation for the 42-bit address starts the same lookup process one stage later. 
° Because the initial lookup resolves 13 bits of address: 
— The translation table size for this level is 64KB. 
— The required translation table alignment for this level is 64KB. 
— The Base address field in the TTBR_EL-x is bits[47:16]. 
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AArch32 Address translation examples 


The following sections give address translation examples for the VMSAv8-32 address translation formats: 
s Address translation examples using the VMSAv8-32 Short descriptor translation table format. 


è Address translation examples using the VMSAv8-32 Long descriptor translation table format on 
page K7-7715. 


Address translation examples using the VMSAv8-32 Short descriptor translation table format 


VMSAv8-32 Short-descriptor translation table format descriptors on page G5-5738 describes the memory section 
and page option for a single VMSAv8-32 address translation. The following sections show the full translation flow 
for each of these options: 


. Translation flow for a Supersection. 

. Translation flow for a Section on page K7-7711. 

. Translation flow for a Large page on page K7-7712. 
. Translation flow for a Small page on page K7-7713. 


The address and Properties fields shown in the translation flows on page K7-7714 summarizes the information 
returned by the lookup. 


Translation flow for a Supersection 


Figure K7-14 on page K7-7711 shows the complete translation flow for a Supersection. For more information about 
the fields shown in this figure see The address and Properties fields shown in the translation flows on 
page K7-7714. 
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For details of Properties fields, see the register or descriptor description 


Figure K7-14 VMSAv8-32 Short-descriptor Supersection address translation 





Note 
Figure K7-14 shows how, when the input address, the VA, addresses a Supersection, the top four bits of the 
Supersection index bits of the address overlap the bottom four bits of the Table index bits. For more information, 
see Additional requirements for Short-descriptor format translation tables on page G5-5741. 





Translation flow for a Section 


Figure K7-15 on page K7-7712 shows the complete translation flow for a Section. For more information about the 
fields shown in this figure see The address and Properties fields shown in the translation flows on page K7-7714. 
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For details of Properties fields, see the register or descriptor description. 











Figure K7-15 VMSAv8-32 Short-descriptor Section address translation 


Translation flow for a Large page 


Figure K7-16 on page K7-7713 shows the complete translation flow for a Large page. For more information about 
the fields shown in this figure see The address and Properties fields shown in the translation flows on 
page K7-7714. 
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ł This field is absent if N is 0 
L1 = Level 1, L2 = Level 2 


For a translation based on TTBRO, N is the value of TTBCR.N 
For a translation based on TTBR1, N is 0 
For details of Properties fields, see the register or descriptor description 


Figure K7-16 VMSAv8-32 Short-descriptor Large page address translation 


Note 


Figure K7-16 shows how, when the input address, the VA, addresses a Large page, the top four bits of the page index 
bits of the address overlap the bottom four bits of the /evel 1 table index bits. For more information, see Additional 
requirements for Short-descriptor format translation tables on page GS-5741. 








Translation flow for a Small page 


Figure K7-17 shows the complete translation flow for a Small page. For more information about the fields shown 
in this figure see The address and Properties fields shown in the translation flows. 
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Figure K7-17 VMSAv8-32 Short-descriptor Small page address translation 


The address and Properties fields shown in the translation flows 


For the Non-secure PL1&0 stage 1 translation tables: 
$ Any descriptor address is the IPA of the required descriptor. 
° The final output address is the IPA of the Section, Supersection, Large page, or Small page. 


In these cases, a PL1 &0 stage 2 translation is performed to translate the IPA to the required PA. 
Otherwise, the address is the PA of the descriptor, Section, Supersection, Large page, or Small page. 


Properties indicates register or translation table fields that return information, other than address information, about 
the translation or the targeted memory region. For more information see Information returned by a translation table 
lookup on page G5-5733, and the description of the register or translation table descriptor. 
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For translations using the Short-descriptor translation table format, VMSAv8-32 Short-descriptor translation table 
format descriptors on page G5-5738 describes the descriptors formats. 


K7.2.2 Address translation examples using the VMSAv8-32 Long descriptor translation table format 


ARM DDI 0487E.a 
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As described in Translation table walks, when using the VMSAv8-32 Long-descriptor translation table format on 
page G5-5761, in a translation table walk, only the first lookup uses the translation table base address from the 
appropriate TTBR. Subsequent lookups use a combination of address information from: 


° The table descriptor read in the previous lookup. 
° The input address. 


The following sections give examples of full VMSAv8-32 Long-descriptor format address translation flows, down 
to an entry for a 4KB page: 


. Full translation flow, starting at level 1 lookup. 
. Full translation flow, starting at level 2 lookup on page K7-7717. 


The address and Properties fields shown in the translation flows on page K7-7714 summarizes the information 
returned by the lookup. 


Full translation flow, starting at level 1 lookup 


Figure K7-18 on page K7-7716 shows the complete translation flow for a VMSAv8-32 Long-descriptor stage 1 
translation table walk that starts with a level 1 lookup. For more information about the fields shown in the figure 
see The address and Properties fields shown in the translation flows on page K7-7714. 
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For details of Properties fields, see the register or descriptor description. 
$ See the lookup description for more information about bits[40:47] of the TTBR and descriptors 
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Figure K7-18 Complete VMSAv8-32 Long-descriptor format stage 1 translation, starting at level 1 


If the level 1 lookup or the level 2 lookup returns a block descriptor then the translation table walk completes at that 


level. 


If bits[47:40] of the TTBR or the descriptor are not zero then the lookup will generate an Address size fault, see 


Address size fault on page G5-5812. 


A stage 2 translation that starts at a level 1 lookup differs from the translation shown in Figure K7-18 only as 


follows: 
s The possible values of n are 4-13, to support an input address of between 31 and 40 bits. 
è A descriptor and output addresses are always PAs. 
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Full translation flow, starting at level 2 lookup 


Figure K7-19 shows the complete translation flow for a stage 1 VMSAv8-32 Long-descriptor translation table walk 
that starts at a level 2 lookup. For more information about the fields shown in the figure see The address and 
Properties fields shown in the translation flows on page K7-7714. 
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Figure K7-19 Complete VMSAv8-32 Long-descriptor format stage 1 translation, starting at level 2 
If the level 2 lookup returns a block descriptor then the translation table walk completes at that level. 


If bits[47:40] of the TTBR or the descriptor are not zero then the lookup will generate an Address size fault, see 
Address size fault on page G5-5812. 


A stage 2 translation that starts at a level 2 lookup differs from the translation shown in Figure K7-19 only as 
follows: 


° The possible values of n are 7-16, to support an input address of up to 34 bits. 
è The descriptor and output addresses are always PAs. 


The address and Properties fields shown in the translation flows 


For the Non-secure PL1&0 stage 1 translation: 
è Any descriptor address is the IPA of the required descriptor. 
° The final output address is the IPA of the block or page. 


In these cases, a PL1&0 stage 2 translation is performed to translate the IPA to the required PA. 
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For all other translations, the final output address is the PA of the block or page, and any descriptor address is the 
PA of the descriptor. 


Properties indicates register or translation table fields that return information, other than address information, about 
the translation or the targeted memory region. For more information see /nformation returned by a translation table 
lookup on page G5-5733, and the description of the register or translation table descriptor. 


For translations using the Long-descriptor translation table format, VMSAv8-32 Long-descriptor translation table 


format descriptors on page G5-5747 describes the descriptors formats. 
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Appendix K8 
Example OS Save and Restore Sequences 


This appendix provides possible OS Save and Restore sequences for a v3A Debug implementation. It contains the 
following sections: 


: Save Debug registers on page K8-7720. 
s Restore Debug registers on page K8-7722. 
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Save Debug registers 


This section shows how to save the registers that are used by an external debugger. 


; On entry, XO points to a block to save the debug registers in. 
; Returns the pointer beyond the block and corrupts X1-X3 


SaveDebugRegisters 
; (1) Set OS lock. 
MOV X2,#1 ; Set the OS lock. In AArch64 state, the OS lock 
MSR OSLAR_EL1, X2 ; is writable via OSLAR. 
ISB ; Context synchronization event 


; (2) Walk through the registers, saving them 





RS X1,OSDTRRX_EL1 ; Read DTRRX 
RS X2,OSDTRTX_EL1 ; Read DTRTX 
STP W1,W2, [XO] , #8 ; Save { DTRRX, DTRTX } 
RS X1,OSECCR_EL1 ; Read ECCR 
RS X2,MDSCR_EL1 ; Read DSCR 
STP W1,W2, [X0] , #8 ; Save { ECCR, DSCR } 
[ AARCH32_SUPPORTED 
RS X1, DBGVCR32_EL2 ; Read DBGVCR 








RS X2, DBGCLAIMCLR_EL1 
STP W1,W2, [XO] , #8 
] 








Save { VCR, CLAIM } 


;; Macros for saving off a "register pair" 

3; SWB is W for watchpoint, B for breakpoint 

33 $num is the pair’s number 

3; X@ contains a pointer for the value words 

;; X1 contains a pointer for the control words 

;; W2 contains the max index 

ACRO 

SaveRP $WB,$num, $exit 

RS X3 , DBG$WB.VR$num._EL1 ; Read DBGxVRn 
STR X3, [XO] , #8 Save { xVRn } 
RS X3 , DBG$WB.CR$num._EL1 Read DBGxCRn 
STR W3, [XO] , #4 Save { xCRn }. 
[ $num > 1 :LAND: $num < 15 

CMP W1,#$num 

BEQ $exit 

] 


END 


; (3) Breakpoints 

RS X1, ID_AA64DFRO_EL1 

UBFX W1,W1,#12,#4 ; Extract BRPs field 
ACRO 


SaveRP B, $num, SaveDebugRegisters_Watchpoints 
END 

SaveBRP 0 

SaveBRP 1 

SaveBRP 2 

;; and so on to ... 

SaveBRP 15 











SaveDebugRegisters_Watchpoints 
; (4) Watchpoints 
MRS X1, ID_AA64DFRO_EL1 ; Read DBGDIDR 
UBFX W1,W1, #20, #4 ; Extract WRPs field 
MACRO 


SaveWRP $num ; Save a Watchpoint Register Pair 


SaveRP W, $num, SaveDebugRegisters_Exit 
MEND 

SaveWRP 0 

SaveWRP 1 

SaveWRP 2 
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Read CLAIM - note, have to read via CLAIMCLR 


SaveBRP $num ; Save a Breakpoint Register Pair 
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K8.1 Save Debug registers 


;; and so on to... 
SaveWRP 15 


SaveDebugRegisters_Exit 
; (5) Return the pointer to first word not read. This pointer is already in XQ, so 
; all that is needed is to return from this function. The OS double-lock (OSDLR_EL1.DLK) is 
; locked later, just before the final entry to WFI state. 
RET 
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K8.2 Restore Debug registers 
This section shows how to restore the registers that are used by an external debugger. 


; On entry, XO points to a block of saved debug registers. 
; Returns the pointer beyond the block and corrupts R1-R3,R12. 


RestoreDebugRegisters 
; (1) Lock OS lock. The lock will already be set, but this write is included to ensure it 











; is locked. 

MOV X2,#1 ; Lock the OS lock. In AArch64 state, the OS lock 
MSR OSLAR_EL1, X2 ; is writable via OSLAR. 

ISB ; Context synchronization event 
MSR MDSCR_EL1, XZR ; Initialize MDSCR_EL1 

; (2) Walk through the registers, restoring them 

LDP W1,W2, [X0] ,#8 ; Read { DTRRX,DTRTX } 

SR OSDTRRX_EL1, X1 ; Restore DTRRX 

SR OSDTRTX_EL1,X2 ; Restore DTRTX 

LDP W1,W3, [XO] ,#8 ; Read { DSCR, ECCR } 

SR OSECCR_EL1,X2 ; Restore ECCR 

[ AARCH32_SUPPORTED 

LDP W1,W2, [XO] ,#8 ; Read { VCR,CLAIM } 

SR DBGVCR32_EL2, X1 ; Restore DBGVCR 

SR DBGCLAIMSET_EL1,X2 ; Restore CLAIM - note, writes CLAIMSET 
] 

;; Macro for restoring a "register pair" 

ACRO 

RestoreRP $WB, $num, $exit 

LDR X3, [XO] , #8 ; Read { xVRn } 

SR DBG$WB.VR$num._EL1, X3 ; Restore DBGxVRn 

LDR W3, [X0] ,#4 ; Read { xCRn } 

SR DBG$WB.CR$num._EL1, X3 ; Restore DBGxCRn 


[ $num >= 1 :LAND: $num < 15 
CMP W1,#$num 

BEQ $exit 

] 
END 


; (3) Breakpoints 
RS X1, ID_AA64DFRO_EL1 





UBFX W1,W1,#12,#4 ; Extract BRPs field 

ACRO 

RestoreBRP $num ; Restore a Breakpoint Register Pair 
RestoreRP B,$num,RestoreDebugRegisters_Watchpoints 

END 


RestoreBRP 0 
RestoreBRP 1 
RestoreBRP 2 
;; and so on until ... 
RestoreBRP 15 








RestoreDebugRegisters_Watchpoints 
; (4) Watchpoints 


RS X1, ID_AA64DFRO_EL1 ; Read DBGDIDR 
UBFX W1,W1,#20,#4 ; Extract WRPs field 

ACRO 

RestoreWRP $num ; Restore a Watchpoint Register Pair 
RestoreRP W,$num,RestoreDebugRegisters_Exit 

END 


RestoreWRP 0 
RestoreWRP 1 
RestoreWRP 2 
;; and so on until ... 
RestoreWRP 15 
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RestoreDebugRegisters_Exit 


MSR MDSCR_EL1, X3 ; Restore DSCR 

; (5) Clear the OS lock. 

ISB 

MOV X2,#0 ; Clear the OS lock. In AArch64 state, the OS lock 
MSR OSLAR_EL1, X2 ; is writable via OSLAR. 


; (6) A final ISB guarantees the restored register values are visible to subsequent 
; instructions. 
ISB 


; (7) Return the pointer to first word not read. This pointer is already in XQ, so 
; all that is needed is to return from this function. 
RET 
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Appendix K9 
Recommended Upload and Download Processes for 
External Debug 


This appendix contains the following section: 


s Using memory access mode in AArch64 state on page K9-7726. 





Note 


This description is not part of the Arm architecture specification. It is included here as supplementary information, 
for the convenience of developers and users who might find this information useful. 
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K9.1 


K9-7726 


Using memory access mode in AArch64 state 


Figure K9-1 and Figure K9-2 on page K9-7727 show the processes for using memory access mode to implement a 
download (external host to target) and an upload (target to external host). 


To transfer n words of data: 
. The download sequence needs n+6 accesses by the external debug interface. 
° The upload sequence needs n+8 accesses by the external debug interface. 


In both cases, in the innermost loop the debugger can make an external access to a DTR without polling EDSCR 
after each write as underrun and overrun detection prevent failure. Normally external accesses from the debugger 
are outpaced by the memory accesses of the PE, making underruns and overruns unlikely. If this is not the case, the 
EDSCR.ERR flag is set to 1. This is checked once at the end of the sequence, although a debugger can check it more 
often, for example once for each page. If the EDSCR.ERR flag is set to 1 because of overrun or underrun, the 
debugger can restart. The address to restart from is frozen in X0. EDSCR.ERR might also be set because of a Data 
abort. 


If underruns and overruns are common, the debugger can pace itself accordingly. 


Note 


. The base address must be a multiple of 4. 





7 The order of the writes that set up the address does not matter in Debug state. 


AArch64 
Write D[n] toA 


1. DBBGDTRTX = A[63:32] 
2. DBGDTRRX = A[31:0] 
3. EDITR=“MRS X0,DBGDTR_ELO” 












































DBGDTRRX = D[) 
Issues store through ITR 
Sets ERR to 1 if there is an overrun or abort 














No 





Yes 


v 


5. EDSCR.MA = 0 

















Error 
recovery 


No——> 














Figure K9-1 Fast code download in AArch64 state (external host to target) 
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In Figure K9-1 on page K9-7726, the sequence for the fast code download is as follows: 


1. 


Setup. From the external debug interface: 


a. 
b. 
c. 
d. 


Write address [31:0] to DBGDTRRX_ELO. 
Write address [63:32] to DBGDTRTX_ELO. 
Write MRS X@, DBGDTR_EL@ to EDITR. The PE executes this instruction. 


Set EDSCR.MA to 1. 


Loop n times. From the external debug interface: 


a. 


Write to DBGDTRRX_ELO. The PE reads the word from DTRRX and stores it to memory. It 
increments X0 by 4. 


Epilogue. From the external debug interface: 


a. 


b. 


Clear EDSCR.MA to 0. 
Read EDSCR to check for overruns or Data Aborts during download. 


AArch64 
Read D[n] from A 


1. DBBGDTRTX = A[63:32] 
2. DBGDTRRX = A[31:0] 
3. EDITR=“MRS X0,DBGDTR_ELO” 























4. EDITR = “MSR, DBGDTR_ELO,X0” (sets TXfull to 1) 
5. EDSCR.MA = 1 
Set i=0 














6. Discard DBGDTRTX 
Sets ERR to 1 in the case of an underrrun or abort 
Issues a load through ITR 




















D/i-1] = DBGDTRTX 
Sets ERR to 7 if there is an underrun or abort 
Issues a load through ITR 














y 
7. EDSCR.MA = 0 
8. D[n-1] = DBGDTRTX 
Sets ERR to 1 if there is an underrun 




















Error 


No——> 
recovery 














Yes 


End 


Figure K9-2 Fast data upload in AArch64 state (target to external host) 


In Figure K9-2, the sequence for the fast code download is as follows: 


1. 


Setup. From the external debug interface: 


a. 


Write address [31:0] to DBGDTRRX_ELO. 
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b. Write address [63:32] to DBGDTRTX_ELO. 
c. Write MRS X0, DBGDTR_ELO to EDITR. 
d. Write MSR DBGDTR_EL@, X@ to EDITR. This dummy operation ensures EDSCR.TXfull == 1. 
Set EDSCR.MA to 1. 
f. Read DBGDTRTX_ELO and discard the value. The PE returns the previous DTR value, loads the first 
word, and writes it to DTR. It increments X0 by 4. 
2; Loop n-1 times. From the external debug interface: 


a. Read DBGDTRTX_ELO. The PE returns the previous DTRTX value, loads a new word, and writes it 
to DTRTX. It increments X0 by 4. 


3; Epilogue. From the external debug interface: 
a. Clear EDSCR.MA to 0. 
b. Read DBGDTRTX_ELO for the nth value. 
Con Read EDSCR to check for underruns, overruns or Data Aborts during upload. 
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Appendix K10 
Software Usage Examples 


This appendix gives software usage examples, for cases where these are likely to contribute significantly to an 
understanding of the Arm architecture. 


It contains the following sections: 
. Use of the Advanced SIMD complex number instructions on page K10-7730. 
. Use of the Armv8.2 extensions to the Cryptographic Extension on page K 10-7732. 
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K10.1 Use of the Advanced SIMD complex number instructions 


K10.1 


K10.1.1 


K10.1.2 


K10-7730 


Use of the Advanced SIMD complex number instructions 


ARMv8.3-CompNum provides instructions to aid floating-point computations of complex numbers. This section 
illustrates the use of these instructions for complex arithmetic. It is not part of the Arm architecture definition. 


This section uses the AArch64 instructions FCADD and FCMLA - usage of the AArch32 instructions VCADD and VCMLA is 
similar. 


When using the instructions implemented by ARMv8.3-CompNum, a complex numbers is represented in a 
SIMD&FP register as a pair of adjacent elements, each holding a floating-point number, with the more significant 
element holding the imaginary part of the number and the less significant element holding the real part of the 
number. 


Complex addition 


Simple complex addition on a vector of complex numbers is already provided by the vector form of the FADD 
instruction. 


The functionality that FCADD adds is to rotate each complex number in the second vector by 90 degrees or 270 degrees 
counterclockwise (considering the complex numbers on an Argand diagram) before performing the addition. 
Mathematically, this is equivalent to multiplying the second complex number by i or -i before addition. 


This means, given a complex number z stored in a pair of elements in one vector, and a complex number w stored 
in the corresponding element pair in another vector: 


. FADD calculates z + w. 





° FCADD calculates z + iw. 


Complex multiplication 


The FCMLA instruction does not provide functionality for complex multiplication directly. However, a pair of FCMLA 
instructions can provide this function. 


The FCMLA instruction operates on corresponding pairs of complex numbers stored in SIMD&FP vector registers, 
and adds the result to the corresponding complex number in the destination SIMD&FP vector register. This 
computation is as follows: 


1. The second complex number is rotated by 0, 90, 180 or 270 degrees counterclockwise. 
2: That complex number is multiplied by either the real or imaginary part of the first complex number: 
° When the rotation is 0 or 180 degrees, the real part is used. 
5 When the rotation is 90 or 270 degrees, the imaginary part is used. 
3. The resulting complex number is added to the corresponding complex number in the destination register. 


Mathematically, considering the complex numbers on an Argand diagram: 
$ Rotation by 180 degrees is equivalent to negation. 

` Rotation by 90 degrees is equivalent to multiplying by i. 

7 Rotation by 270 degrees is equivalent to multiplying by -i. 


This means that, for a first complex number z, where z = a+bi, and a second complex number w, if initially the 
corresponding complex number in the destination register is zero: 


° When the rotation is 0 degrees the result of the multiply-add is aw. 
s When the rotation is 180 degrees, the result is -aw. 
. When the rotation is 90 degrees, the result is biw. 
° When the rotation is 270 degrees, the result is -biw. 
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This means that, if the destination register is zeroed and an FCMLA instruction is executed with a rotation parameter 
of 0, and then the same instruction is executed with a rotation parameter of 90: 


° The first execution returns aw in the destination register. 
. The second execution accumulates biw to this, meaning the result is aw+biw. 
° This result is the product of (a+bi)w, which is the product zw. 


So, this pair of instructions can be used to implement complex multiplication. 
After zeroing VO, the syntax of a pair of instructions to perform this complex number multiplication might be: 


FCMLA V@.4S, V1.4S, V2.4S, #0 
FCMLA V@.4S, V1.4S, V2.4S, #90 


Other simple pairs of FCMLA instructions perform useful computations. For example, considering a first complex 
number z and second complex number w, defined as before, and a destination register that has been zeroed before 
the first FCMLA instruction is executed: 


1. The following pair of instructions calculates the complex conjugate of z multiplied by w. 
FCMLA V@.4S, V1.4S, V2.4S, #0 
FCMLA V@.4S, V1.4S, V2.4S, #270 

2; The following pair of instructions calculates the negation of z multiplied by w. 


FCMLA V@.4S, V1.4S, V2.4S, #180 
FCMLA V@.4S, V1.4S, V2.4S, #270 


3. The following pair of instructions calculates the negation of the complex conjugate of z multiplied by w. 


FCMLA V@.4S, V1.4S, V2.4S, #180 
FCMLA V@.4S, V1.4S, V2.4S, #90 











Note 


For these examples, the following caveats must be considered: 





° FCMLA performs a fused multiply-add, meaning there is no intermediate rounding. This lack of intermediate 
rounding can give unexpected results in some cases. Arm expects that these instructions are only used in 
situations where the effect of the rounding of these results is not material to the calculation. 


° When using the FCMLA instructions, the behavior of (cc+00i) multiplied by (0+i) is (NaN+NaNi), rather than 
the result expected by ISO C, which is complex ©. 
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K10.2 Use of the Armv8.2 extensions to the Cryptographic Extension 








ARM DDI 0487E.a 


K10.2.1 Use of the SHA512 instructions 
These instructions are implemented when ARMv8.2-SHA is implemented. 
The following code sequence shows the use of the SHA512 instructions to calculate a SHA512 hash iteration of 80 
rounds. This code is not fully optimized. 
// XO contains the pointer to the bottom of the (padded) 16*64 bytes of message to be 
// hashed, with space above the that message to hold a further 64 » 64 bytes of working 
// data 
// X1 contains the pointer to the Oth element of 80 64-bit constants (in ascending addresses) defined in 
the SHA2 specification 
// X2 contains a loop variable 
// V4,V5,V6, V7 hold VS@ to VS3 respectively 
// V8 holds running hash V1 
// V9 holds running hash VO 
MOV X2, #0 
loop1: 
LD1 {v0.2D}, [X0] // Data 
LD1 {V1.2D}, [X1] // K values 
ADD X1, X1, #16 
ADD XO, XO, #16 
ADD X2, X2, #16 
ADD V2.2D, V@.2D, V1.2D 
EXT V2.16B, V2.16B, V2.16B, #8 
EXT V8.16B, V6.16B, V7.16B, #8 
EXT V9.16B, V5.16B, V6.16B, #8 
ADD V7.2D, V7.2D, V2.2D 
SHA512H Q7, Q8, V9.2D 
ADD V10.2D, V5.2D, V7.2D 
SHA512H2 Q7, Q5, V4.2D 
MOV V5.16B, V4.16B 
MOV V4.16B, V7.16B 
MOV V7.16B, V6.16B 
MOV V6.16B, V10.16B 
CMP X2, #128 
BLT loop1 
// work out pointers to previous words in the data 
SUB X3, X0, #128 
SUB X4, XO, #112 
SUB X5, XO, #16 
SUB X6, XO, #56 
loop2: 
LD1 {V11.2D}, [X3] 
LD1 {V12.2D}, [X4] 
LD1 {V13.2D}, [X5] 
LD1 {V14.2D}, [X6] 
SHA512SU@ V11.2D, V12.2D 
SHA512SU1 V11.2D, V13.2D, V14.2D 
ST1 {V11.2D}, [X@] 
LD1 {V1.2D}, [X1] // K values 
ADD X0, XO, #16 
ADD X1, X1, #16 
ADD X3, X3, #16 
ADD X4, X4, #16 
ADD X5, X5, #16 
ADD X6, X6, #16 
ADD X2, X2, #16 
ADD V2.2D, V11.2D, V1.2D 
EXT V2.16B, V2.16B, V2.16B, #8 
EXT V8.16B, V6.16B, V7.16B, #8 
EXT V9.16B, V5.16B, V6.16B, #8 
ADD V7.2D, V7.2D, V2.2D 
SHA512H Q7, Q8, V9.2D 
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ADD 
SHA512 
MOV 
MOV 
MOV 
MOV 
CMP 
BLT 


V10.2D, V5.2D, V7.2D 
H2 Q7, Q5, V4.2D 

V5.16B, V4.16B 

V4.16B, V7.16B 

V7.16B, V6.16B 

V6.16B, V10.16B 

X2, #320 

loop2 


K10.2.2 Use of the SHA3 instructions 
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These instructions are implemented when ARMv8.2-SHA is implemented. 


The following code sequence shows the use of the SHA3 instructions to obtain the combined theta, phi, rho and chi 
operations of a SHA3 iteration. Arm expects the iota operation to be performed using a lookup table. 


This code is not fully optimized for multiple iterations. 


// Input 
// 


//- 

eor3 
eor3 
eor3 
eor3 
eor3 
eor3 
eor3 
eor3 
eor3 
eor3 


raxl 
raxl 
raxl 
raxl 
raxl 


//- 
eor 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 
xar 

















State: 
x=@ x=1 x=2 x=3 x=4 

=@ v12 v13 vl4 vile vil 

=1 v7 v8 v9 v5 v6 

=2 v2 v3 v4 vô vl 

=3 v22 v23 v24 v20 v21 

=4 v17 v18 v19 v15 v16 

Theta Calculations -// 

v25.16B, v12.16B, v7.16B, v2.16B 
v25.16B, v25.16B, v22.16B, v17.16B 
v26.16B, v13.16B, v8.16B, v3.16B 
v26.16B, v26.16B, v23.16B, v18.16B 
v27.16B, v14.16B, v9.16B, v4.16B 
v27.16B, v27.16B, v24.16B, v19.16B 
v28.16B, v10.16B, v5.16B, v0.16B 
v28.16B, v28.16B, v20.16B, v15.16B 
v29.16B, v11.16B, v6.16B, v1.16B 
v29.16B, v29.16B, v21.16B, v16.16B 
v30.2D, v29.2D, v26.2D 

v31.2D, v27.2D, v29.2D 

v29.2D, v25.2D, v27.2D 

v27.2D, v28.2D, v25.2D 

v25.2D, v26.2D, v28.2D 

Phi\rho Stage -// 

v12.8B, v12.8B, v30.8B 

v26.2D, v21.2D, v27.2D, #56 

v21.2D, v15.2D, v31.2D, #8 

v15.2D, v22.2D, v30.2D, #23 

v22.2D, v11.2D, v27.2D, #37 

v11.2D, v16.2D, v27.2D, #50 

v16.2D, v18.2D, v29.2D, #62 

v18.2D, v5.2D, v31.2D, #9 

v5.2D, v23.2D, v29.2D, #19 

v23.2D, v7.2D, v30.2D, #28 

v7.2D, v10.2D, v31.2D, #36 

v10.2D, v20.2D, v31.2D, #43 

v20.2D, v24.2D, v25.2D, #49 

v24.2D, v3.2D, v29.2D, #54 

v3.2D, v9.2D, v25.2D, #58 

v9.2D, v2.2D, v30.2D, #61 

v2.2D, v13.2D, v29.2D, #63 

v13.2D, v8.2D, v29.2D, #20 

v8.2D, v6.2D, v27.2D, #44 

v6.2D, v19.2D, v25.2D, #3 

v19.2D, v1.2D, v27.2D, #25 

v1.2D, v17.2D, v30.2D, #46 
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xar v17.2D, v14.2D, v25.2D, #2 


xar v14.2D, v4.2D, 
xar v4.2D, 


// XAR Output: 


// 


v@.2D, 


// 412 v2 v17 v7 v22 
// v23 v13 v3 v18 v8 
// v9 v24 v14 v4 v19 
// v15 v5 v20 v10 v26 
// vi v16 v6 v21 v11 


// 


// temp: vð, v25, v27, 


// Phi Output: 


// 


// v12 v13 v14 v10 v11 
// v7 v8 v9 v5 v6 
// v2 v3 v4 v26 vi 
// v22 v23 v24 v20 v21 
// v17 v18 v19 v15 v16 


v25.2D, #21 
v31.2D, #39 


v28, v29, v30, v31 


//- Chi transformations -// 


bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 
bcax 


v31 
v27 
v28 
v29 
v30 
vô. 
v1 
v2. 
v3. 
v4 
v5. 
v6. 
v7. 
v8. 
v9. 


v10. 


v11 


v12. 
v13. 
v14. 
v15. 
v16. 
v17. 
v18. 
v19. 


.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
16B, 


.16B, 


16B, 
16B, 


.16B, 


16B, 
16B, 
16B, 
16B, 
16B, 
16B, 
.16B, 
16B, 
16B, 
16B, 
16B, 
16B, 
16B, 
16B, 
16B, 


v26 
v1 
v2. 
v3. 
v4 
v5. 


a 





.16B, 


.16B, 


16B, 
16B, 


.16B, 


16B, 


.16B, 
.16B, 
.16B, 
.16B, 


.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 


v2. 
v3. 
v4. 


v26. 


vl. 
v7. 
v8. 
v9. 
v5. 
v6. 
v12 
v13 
v14 
v10 
vil 
v17 
v18 
v19 
v15 
v16 
v22 
v23 
v24 
v20 
v21 


// Output State from Chi: 


x=0 
v7 
v2 
v28 
v17 
v12 


x=1 
v8 
v3 
v29 
v18 
v13 


X=2 
v9 
v4 

v30 

v19 
v14 


Use of the SM3 instructions 


These instructions are implemented when ARMv8.2-SM is implemented. 


The following code sequence shows the use of the SM3 instructions to generate a SM3 hash. 


16B, 
16B, 
16B, 
16B, 
16B, 
16B, 
16B, 
16B, 
16B, 
16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 
.16B, 





x=3 
v5 
vô 
v31 
v15 
v10 








.macro MessageExpand VA, VB, VC, VD, VOUT 
EXT \VOUT().16B, \VB().16B, \VC().16B, #12 
SM3PARTW1 \VOUT().4S, \VA().4S, \VD().4S 
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EXT V17.16B, \VA().16B, \VB().16B, #12 
EXT V18.16B, \VC().16B, \VD().16B, #8 
SM3PARTW2 \VOUT().4S, V18.4S, V17.4S 
.endm 


.macro HashPt1 VA, VB, Number SM3SS1 V23.4S, V20.4S, V22.4S, V19.4S 
EOR V21.16B, \VA().16B, \VB().16B 

SM3TT1a V20.4S, V23.4S, V21.S[\Number] 

SM3TT2a V19.4S, V23.4S, \VA().S[\Number] 

SHL V24.4S, V22.4S, #1 

SRI V24.4S, V22.4S, #31 

MOV V22.16B, V24.16B 

.endm 


.macro HashPt2 VA, VB, Number SM3SS1 V23.4S, V2@.4S, V25.4S, V19.4S 
EOR V21.16B, \VA().16B, \VB().16B 

SM3TT1b V20.4S, V23.4S, V21.S[\Number] 

SM3TT2b V19.4S, V23.4S, \VA().S[\Number] 

SHL V26.4S, V25.4S, #1 

SRI V26.4S, V25.4S, #31 

MOV V25.16B, V26.16B 

.endm 


// V@-V3 holds the initial message 

// N19 holds EFGH which is the lower half of the input hash 

// N20 holds ABCD which is the upper half of the input hash 

// N21 = current VPrime 

// N22 holds T in bits[127:96] = @x79cc4519 

// V25 holds second value of T in bits[127:96] = @x9d8a7a87<31:0>; 


MessageExpand VQ, V1, V2, V3, V4 
MessageExpand V1, V2, V3, V4, V5 
MessageExpand V2, V3, V4, V5, V6 
MessageExpand V3, V4, V5, V6, V7 
MessageExpand V4, V5, V6, V7, V8 
MessageExpand V5, V6, V7, V8, V9 
MessageExpand V6, V7, V8, V9, V10 
MessageExpand V7, V8, V9, V10, V11 
MessageExpand V8, V9, V10, V11, V12 
MessageExpand V9, V10, V11, V12, V13 
MessageExpand V10, V11, V12, V13, V14 
MessageExpand V11, V12, V13, V14, V15 
MessageExpand V12, V13, V14, V15, V16 


MOV V29.16B, V19.16B 
MOV V30.16B, V20.16B 


HashPt1 V0,V1, 
HashPt1 V0,V1, 
HashPt1 V0,V1, 
HashPt1 V0,V1, 
HashPt1 V1,V2, 
HashPt1 V1,V2, 
HashPt1 V1,V2, 
HashPt1 V1,V2, 
HashPt1 V2,V3, 
HashPt1 V2,V3, 
HashPt1 V2,V3, 
HashPt1 V2,V3, 
HashPt1 V3,V4, 
HashPt1 V3,V4, 
HashPt1 V3,V4, 
HashPt1 V3,V4, 


WNHRPODWNFDWNHFOWNE © 


HashPt2 V4,V5, 0 
HashPt2 V4,V5, 1 
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HashPt2 V4,V5, 
HashPt2 V4,V5, 
HashPt2 V5,V6, 
HashPt2 V5,V6, 
HashPt2 V5,V6, 
HashPt2 V5,V6, 
HashPt2 V6,V7, 
HashPt2 V6,V7, 
HashPt2 V6,V7, 
HashPt2 V6,V7, 
HashPt2 V7,V8, 
HashPt2 V7,V8, 
HashPt2 V7,V8, 
HashPt2 V7,V8, 
HashPt2 V8,V9, 
HashPt2 V8,V9, 
HashPt2 V8,V9, 
HashPt2 V8,V9, 
HashPt2 V9,V10, © 
HashPt2 V9,V10, 1 
HashPt2 V9,V10, 2 
HashPt2 V9,V10, 3 
HashPt2 V10,V11, 
HashPt2 V10,V11, 
HashPt2 V10,V11, 
HashPt2 V10,V11, 
HashPt2 V11,V12, 
HashPt2 V11,V12, 
HashPt2 V11,V12, 
HashPt2 V11,V12, 
HashPt2 V12,V13, 
HashPt2 V12,V13, 
HashPt2 V12,V13, 
HashPt2 V12,V13, 
HashPt2 V13,V14, 
HashPt2 V13,V14, 
HashPt2 V13,V14, 
HashPt2 V13,V14, 
HashPt2 V14,V15, 
HashPt2 V14,V15, 
HashPt2 V14,V15, 
HashPt2 V14,V15, 
HashPt2 V15,V16, 
HashPt2 V15,V16, 
HashPt2 V15,V16, 
HashPt2 V15,V16, 


WNIRFOWNPRPOWOWNEFPOWNFEFH OG WwW YP 





WNRFRPOWNFPOAOWNFOWNFPOWNFOWNE © 


EOR V19.16B, V29.16B, V19.16B 
EOR V20.16B, V30.16B, V20.16B 


// N19 holds EFGH which is the lower half of the output hash 
// N20 holds ABCD which is the upper half of the output hash 


K10.2.4 Use of the SM4 instructions 


These instructions are implemented when ARMv8.2-SM is implemented. 
The following code sequences show the use of the SM4 instructions to perform SM4 encryption and decryption: 


Encryption 


// Encryption 

// \O contains 0xb27022dc677d919756aa3350a3b1lbac6<127 :0>; 
// V8 contains the Key 

// V2 contains the data to be encrypted 

// V16 contains: 0x545b6269383f464d1c232a3100070e15; 

// \17 contains: Oxc4cbd2d9a8afb6bd8c939aa170777e85 ; 
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// N18 
// N19 
// N20 
// N21 
// N22 
// N23 


EOR V8. 


M4E 
M4E 
M4E 
M4E 
M4E 
M4E 
4E 
4E 


NNNNNNNN 


4E 
M4E 
M4E 
M4E 
M4E 
M4E 
M4E 
M4E 








NNNNNNNN 





Software Usage Examples 


K10.2 Use of the Armv8.2 extensions to the Cryptographic Extension 


contains: 0x343b4249181f262dfc030alleQe7eef5; 
contains: Q@xa4abb2b9888f969d6c737a8150575e65; 
contains: 0x141b2229f8ff060ddce3eaf1cOc7ced5; 
contains: 0x848b9299686f767d4c535a6130373e45; 
contains: Oxf4fb0209d8dfe6edbcc3cadlaQa7aeb5; 
contains: 0x646b7279484f565d2c333a4110171e25; 


16b, V8.16b, V0.16b; 


EY V8.4S, V8.4S, V16.4S 

EY V9.4S, V8.4S, V17.4S 

EY V10.4S, V9.4S, V18.4S 
EY V11.4S, V10.4S, V19.4S 
EY V12.4S, V11.4S, V20.4S 
EY V13.4S, V12.4S, V21.4S 
EY V14.4S, V13.4S, V22.4S 
EY V15.4S, V14.4S, V23.4S 


V2 


V2. 


v2 


V2. 
V2. 


v2 


V2. 


v2 


// need 


Decryption 


4S, V8.4S 
4S, V9.4S 
-4S, V10.4S 
4S, V11.4S 
4S, V12.4S 
4S, V13.4S 
4S, V14.4S 
4S, V15.4S 


to reverse the order of the words at the end of the operation 
REV64 v2.4S, v2.48 
EXT V2.16B, V2.16B, V2.16B, #8 


// Decryption 


// VO contains 0xb27022dc677d919756aa3350a3b1bac6<127: >; 


// V8 contains the Key 

// V2 contains the data to be decrypted 
// V16 
// \17 
// V18 
// V19 
// V20 
// N21 
// N22 
// 23 


// need to reverse the order of the keys to do a decryption: 


contains: 0x545b6269383f464d1c232a3100070e15; 
contains: O@xc4cbd2d9a8afb6bd8c939aa170777e85; 
contains: 0x343b4249181f262dfc030alleQe7eef5; 
contains: Q@xa4abb2b9888f969d6c737a8150575e65; 
contains: 0x141b2229f8ff060ddce3eaf1cOc7ced5; 
contains: 0x848b9299686f767d4c535a6130373e45; 
contains: Oxf4fb0209d8dfe6edbcc3cadlaQa7aeb5; 
contains: 0x646b7279484f565d2c333a4110171e25; 





EOR V8.16b, V8.16b, VQ.16b; 


SM4E 
SM4E 
SM4E 
SM4E 
SM4E 
SM4E 
SM4E 
SM4E 








EY V8.4S, V8.4S, V16.4S 

EY V9.4S, V8.4S, V17.4S 

EY V10.4S, V9.4S, V18.4S 
EY V11.4S, V10.4S, V19.4S 
EY V12.4S, V11.4S, V20.4S 
EY V13.4S, V12.4S, V21.4S 
EY V14.4S, V13.4S, V22.4S 
EY V15.4S, V14.4S, V23.4S 


REV64 V8.4S, V8.4S 

EXT V8.16B, V8.16B, V8.16B, #8 
REV64 V9.4S, V9.4S 

EXT V9.16B, V9.16B, V9.16B, #8 
REV64 V10.4S, V10.4S 

EXT V10.16B, V10.16B, V10.16B, #8 
REV64 V11.4S, V11.4S 

EXT V11.16B, V11.16B, V11.16B, #8 
REV64 V12.4S, V12.4S 

EXT V12.16B, V12.16B, V12.16B, #8 
REV64 V13.4S, V13.4S 
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EXT V13.16B, V13.16B, V13.16B, #8 
REV64 V14.4S, V14.4S 
EXT V14.16B, V14.16B, V14.16B, #8 
REV64 V15.4S, V15.4S 
EXT V15.16B, V15.16B, V15.16B, #8 


SM4E V2.4S, V15.4S 
SM4E V2.4S, V14.4S 
SM4E V2.4S, V13.4S 
SM4E V2.4S, V12.4S 
SM4E V2.4S, V11.4S 
SM4E V2.4S, V10.4S 
SM4E V2.4S, V9.4S 
SM4E V2.4S, V8.4S 


// final reversal of the order of the words in the result: 
REV64 V2.4S, V2.4S 
EXT V2.16B, V2.16B, V2.16B, #8 
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This appendix gives examples of the use of the barrier instructions provided by the Armv8 architecture. It contains 
the following sections: 





Introduction on page K11-7740. 

Load-Acquire, Store-Release and barriers on page K11-7743. 

Load-Acquire Exclusive, Store-Release Exclusive and barriers on page K11-7747. 
Using a mailbox to send an interrupt on page K11-7752. 


Cache and TLB maintenance instructions and barriers on page K11-7753. 


Armv7 compatible approaches for ordering, using DMB and DSB barriers on page K11-7765. 


Note 


This information is not part of the Arm architecture specification. It is included here as supplementary information, 
for the convenience of developers and users who might require this information. 
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K11.1 Introduction 


The exact rules for the insertion of barriers into code sequences is a very complicated subject, and this appendix 
describes many of the corner cases and behaviors that are possible in an implementation of the Armv8 architecture. 


This appendix is to help programmers, hardware design engineers, and validation engineers understand the need for 
the different kinds of barriers. 


K11.1.1 Overview of memory consistency 


Early generations of microprocessors were relatively simple processing engines that executed each instruction in 
program order. In such processors, the effective behavior was that each instruction was executed in its entirety 
before a subsequent instruction started to be executed. This behavior is sometimes referred to as the Sequential 
Execution Model (SEM), and in this Manual it is described as Simple sequential execution of the program. 


In later processor generations, the needs to increase processor performance, both in terms of the frequency of 
operation and the number of instructions executed each cycle, mean that such a simple form of execution is 
abandoned. Many techniques, such as pipelining, write buffering, caching, speculation, and out-of-order execution, 
are introduced to provide improved performance. 


For general purpose PEs, such as Arm, these microarchitectural innovations are largely hidden from the programmer 
by a number of microarchitectural techniques. These techniques ensure that, within an individual PE, the behavior 
of the PE largely remains the same as the SEM. There are some exceptions to this where explicit synchronization 
is required. In the Arm architecture, these are limited to cases such as: 


a Synchronization of changes to the instruction stream. 


à Synchronization of changes to System registers. 
In both these cases, the ISB instruction provides the necessary synchronization. 


While the effect of ordering is largely hidden from the programmer within a single PE, the microarchitectural 
innovations have a profound impact on the ordering of memory accesses. Write buffering, speculation, and cache 
coherency protocols, in particular, can all mean that the order in which memory accesses occur, as seen by an 
external observer, differs significantly from the order of accesses that would appear in the SEM. This is usually 
invisible in a uniprocessor environment, but the effect becomes much more significant when multiple PEs are trying 
to communicate with memory. In reality, these effects are often only significant at particular synchronization 
boundaries between the different threads of execution. 


The problems that arise from memory ordering considerations are sometimes described as the problem of memory 
consistency. Processor architectures have adopted one or more memory consistency models, or memory models, that 
describe the permitted limits of the memory re-ordering that can be performed by an implementation of the 
architecture. The comparison and categorization of these has generated significant research and comment in 
academic circles, and Arm recommends the Memory Consistency Models for Shared Memory-Multiprocessors 
paper as an excellent detailed treatment of this subject. 


This appendix does not reproduce such a work, but instead concentrates on some cases that demonstrate the features 
of the weakly-ordered memory model of the Arm architecture from Armv6. In particular, the examples show how 
the use of the DMB and DSB memory barrier instructions can provide the necessary safeguards to limit memory 
ordering effects at the required synchronization points. 


K11.1.2 Barrier operation definitions 


The following reference, or provide, definitions of terms used in this appendix: 


DMB See Data Memory Barrier (DMB) on page B2-125. 
DSB See Data Synchronization Barrier (DSB) on page B2-128. 
ISB See Instruction Synchronization Barrier (ISB) on page B2-125. 


Observer, Completion 
See Definition of the Armv8 memory model on page B2-115. 
See Completion and endpoint ordering on page B2-120. 
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Program order 


The order of instructions as they appear in an assembly language program. This appendix does not 
attempt to describe or define the legal transformations from a program written in a higher level 
programming language, such as C or C++, into the machine language that can then be disassembled 
to give an equivalent assembly language program. Such transformations are a function of the 
semantics of the higher level language and the capabilities and options on the compiler. 


K11.1.3 Conventions 


ARM DDI 0487E.a 
ID070919 


Many of the examples are written in a stylized extension to Arm assembler, to avoid confusing the examples with 
unnecessary code sequences. 


AArch32 


The construct WAIT([Rx]==1) describes the following sequence: 


loop 
LDR R12, [Rx] 
CMP R12, #1 
BNE loop 


Also, the construct WAIT_ACQ([Rx]==1) describes the following sequence: 


loop 

LDA R12, [Rx] ; load acquire ensures it is ordered before subsequent loads/stores 
CMP R12, #1 

BNE loop 


R12 is chosen as an arbitrary temporary register that is not in use. It is named to permit the generation of a false 
dependency to ensure ordering. 


AArch64 


The construct WAIT([Xx]==1) describes the following sequence: 


loop 
LDR W12, [Xx] 
CMP W12, #1 
B.NE loop 


Also, the construct WAIT_ACQ([Xx]==1) and describes the following sequence: 


loop 

LDAR W12, [Xx] ; load acquire ensures it is ordered before subsequent loads/stores 
CMP W12, #1 

B.NE loop 


For each example, a code sequence is preceded by an identifier of the observer running it: 


° PO, P1...Px refer to caching coherent PEs that implement the Armv8 architecture, and are in the same 
shareability domain. 


. EO, E1...Ex refer to non-caching observers, that do not participate in the coherency protocol, but execute 
Armv8 instructions and have a weakly-ordered memory model. This does not preclude these observers being 
different objects, such as DMA engines or other system masters. 


These observers are unsynchronized other than as required by the documented code sequence. 


Note 


Throughout this appendix, Armv8 instruction and instruction refer to instructions from the A64, A32, or T32 
instruction set, provided by Armv8 implementations. 
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Results are expressed in terms of <agent>:<register>, such as PQ:R5. The results can be described as: 


Permissible This does not imply that the results expressed are required or are the only possible results. 
In most cases they are results that would not be possible under a sequentially consistent 
running of the code sequences on the agents involved. In general terms, this means that these 
results might be unexpected to anyone unfamiliar with memory consistency issues. 


Not permissible Results that the architecture expressly forbids. 
Required Results that the architecture expressly requires. 


The examples omit the required shareability domain arguments of DMB and DSB instructions. The arguments are 
assumed to be selected appropriately for the shareability domains of the observers. 


In AArch32 state, where the barrier function in the litmus test can be achieved by a DMB ST, that is a barrier to stores 
only, this is shown by the use of DMB [ST]. This indicates that the ST qualifier can be omitted without affecting the 
result of the test. In some implementations DMB ST is faster than DMB. 


For AArch64 code, the shareability domain of the DMB or DSB must be included. This is shown in this manual using 
the notation DMB <domain> and DSB <domain> respectively. 


Except where otherwise stated, other conventions are: 
. All memory initializes to 0. 
. RO and WO contain the value 1. 


: R1 - R4 and W1 - W4 contain arbitrary independent addresses that initialize to the same value on all PEs. 
The addresses held in these registers are shareable and: 


— The addresses held in R1 and R2 are in Write-Back Cacheable Normal memory. 
— The address held in R3 is in Write-Through Cacheable Normal memory. 
— The address held in R4 is in Non-cacheable Normal memory. 


. R5 - R8 and W5 - W8 contain: 
— When used with an STR instruction, 0x55, 0x66, 0x77, and 0x88 respectively. 
— When used with an LDR instruction, the value 0. 


è R11 and W11 contain a new instruction or new translation table entry, as appropriate, and R10 contains the 
virtual address and the ASID, for use in this change of translation table entry. 


° Memory locations are Normal memory locations unless otherwise stated. 


The examples use mnemonics for the cache maintenance and TLB maintenance instructions. The following tables 
describe the mnemonics: 


e Cache maintenance system instructions on page K14-7861. 
° TLB maintenance system instructions on page K14-7862. 
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Load-Acquire, Store-Release and barriers 


The Load-Acquire and Store-Release instructions are described in Load-Acquire, Load-AcquirePC, and 
Store-Release on page B2-129. 


The following sections show that most of the examples in sections Simple ordering and barrier cases on 
page K11-7765 and Load-Exclusive, Store-Exclusive and barriers on page K11-7769 can be achieved using the 
Load-Acquire and Store-Release instructions without the need for additional barriers. 


Message passing 


The following sections describe: 
. Resolving weakly-ordered message passing by using Acquire and Release. 


. Resolving message passing by the use of Store-Release and address dependency on page K11-7744. 


Resolving weakly-ordered message passing by using Acquire and Release 


The message passing problem described in Weakly-ordered message passing problem on page K11-7765 can be 
solved by the use of Load-Acquire and Store-Release instructions when accessing the communications flag: 


AArch32 
Pl 

STR R5, [R1] ; sets new data 

STL RO, [R2] ; sends flag indicating data ready, which is ordered after the STR 
P2 

WAIT_ACQ( [R2]==1) ; waits on flag 

LDR R5, [R1] 
AArch64 
Pl 

STR W5, [X1] ; sets new data 

STLR WO, [X2] ; sends flag indicating data ready, which is ordered after the STR 
P2 


WAIT_ACQ([X2]==1) 
LDR W5, [X1] 


waits on flag 


This ensures the observed order of both the reads and the writes allows transfer of data such that the result 
P2:R5==0x55 is guaranteed. 


This approach also works with multiple observers, in a way that further observers use the same sequence as P2 uses: 


AArch32 

P3 
WAIT_ACQ( [R2]==1) ; waits on flag 
LDR R5, [R1] 

AArch64 


P3 


WAIT_ACQ([X2]==1) 
LDR W5, [X1] 


; waits on flag 
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Resolving message passing by the use of Store-Release and address dependency 


The lack of ordering of stores discussed in Message passing with multiple observers on page K11-7766 can be 
resolved by the use of Store-Release for the store of the valid flag by P1, even when the observers are using an 


address dependency: 
AArch32 
Pl 
STR R5, [R1] ; sets new data 
STL RO, [R2] ; sends flag indicating data ready using a Store-Release 
P2 


WAIT([R2]==1) 
AND R12, R12, #0 
LDR R5, [R1, R12] 


R12 is the destination of LDR in the WAIT macro 
the load has an address dependency on R12 
: and so is ordered after the flag has been seen 


AArch64 
Pl 


sets new data 
sends flag indicating data ready using a Store-Release 


STR W5, [X1] 
STLR WO, [X2] 


P2 


WAIT ([X2]==1) 
AND W12, W12, WZR 
LDR W5, [X1, X12] 


W12 is the destination of LDR in the WAIT macro 
the load has an address dependency on W12 
: and so is ordered after the flag has been seen 


This ensures the observed order of the writes allows transfer of data such that P2:R5 and P3:R5 contain the same 
value of 0x55. 


This approach also works with multiple observers, in a way that further observers use the same sequence as P2 uses: 


AArch32 

P3 
WAIT([R2]==1) 
AND R12, R12, #0 ; R12 is the destination of LDR in the WAIT macro 
LDR R5, [R1, R12] ; the load has an address dependency on R12 


: and so is ordered after the flag has been seen 


AArch64 

P3 
WAIT ([X2]==1) 
AND W12, W12, WZR ; R12 is the destination of LDR in the WAIT macro 
LDR W5, [X1, X12] ; the load has an address dependency on W12 


: and so is ordered after the flag has been seen 
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K11.2.2 Address dependency with object construction 
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When accessing an object-oriented data structure, the address dependency rule means that barriers are not required, 
even when initializing the object. A Store-Release can be used to ensure the order of the update of the base address: 


AArch32 
Pl 
STR R5, [R1, #offset] ; 
STL R1, [R2] ; 
P2 
LDR R1, [R2] ; 
CMP R1, #0 : 
BEQ null_trap 
LDR R5, [R1, #offset] ; 
AArch64 
Pl 
STR W5, [X1, #offset] ; 
STLR X1, [X2] ; 
P2 
LDR X1, [X2] ; 
CMP X1, #0 ; 


B.EQ null_trap 
LDR W5, [X1, #offset] ; 


sets new data in a field 
updates base address 


reads base address 
checks if it is valid 


uses base address to read field 


sets new data in a field 
updates base address 


reads base address 
check if it is valid 


uses base address to read field 


It is required that P2:R5==0x55 if the null trap is not taken. This avoids P2 observing a partially constructed object 
from P1. Significantly, P2 does not need a barrier to ensure this behavior. 


The read of the base address in P2 could be a Load-Acquire, but it is not necessary in this case. 
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K11.2.3 WFE and WFI and barriers 


K11-7746 


The Wait For Event and Wait For Interrupt instructions permit the PE to suspend execution and enter a low-power 
state. An explicit DSB barrier instruction is required if it is necessary to ensure memory accesses made before the WFI 
or WFE are visible to other observers, unless some other mechanism has ensured this visibility. Examples of other 

mechanism that would guarantee the required visibility are the DMB described in Posting a store before polling for 


acknowledgement on page K11-7768, or a dependency on a load. 


The following example requires the DSB to ensure that the store is visible: 


AArch32 
Pl 


STR RO, [R2] 
DSB 
Loop 
WFI 
B Loop 


AArch64 
Pl 


STR WO, [X2] 

DSB <domain> 
Loop 

WFI 

B Loop 


This requirement is unchanged in Armv8 by the presence of Load-Acquire or Store-Release. 
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K11.3 Load-Acquire Exclusive, Store-Release Exclusive and barriers 


The Armv8 architecture adds the acquire and release semantics to Load-Exclusive and Store-Exclusive instructions, 
which allows them to gain ordering acquire and/or release semantics. 


The Load-Exclusive instruction can be specified to have acquire semantics, and the Store-Exclusive instruction can 
be specified to have release semantics. These can be arbitrarily combined to allow the atomic update created by a 
successful Load-Exclusive and Store-Exclusive pair to have any of: 


° No Ordering semantics (using LDREX and STREX). 
° Acquire only semantics (using LDAEX and STREX). 
° Release only semantics (using LDREX and STLEX). 
° Sequentially consistent semantics (using LDAEX and STLEX). 


In addition, the Armv8 specification requires that the clearing of a global monitor will generate an event for the PE 
associated with the global monitor, which can simplify the use of WFE, by removing the need for a DSB barrier and 
SEV instruction. 


K11.3.1 Acquiring a lock 


A common use of Load-Exclusive and Store-Exclusive instructions is to claim a lock to permit entry into a critical 
region. This is typically performed by testing a lock variable that indicates 0 for a free lock and some other value, 
commonly 1 or an identifier of the process holding the lock, for a taken lock. 


Note 
The inclusion of AArch32 PLDW instructions or AArch64 PFRM PST= instructions in these examples is not a functional 
requirement, but will improve performance on many implementations. The performance benefit of adding these 
instructions will vary between different implementations of the architecture. 








For a critical region, the requirement on taking a lock is usually for acquire semantics, while the clearing of a lock 
requires release semantics: 


AArch32 
Px 

PLDW[R1] ; preload into cache in unique state 
Loop 

LDAEX R5, [R1] read lock with acquire 

CMP R5, #0 check if 0 


CMPEQ R5, #0 test if store suceeded 


STREXEQ R5, RO, [R1] ; attempt to store new value 
BNE Loop ; retry if not 


; loads and stores in the critical region can now be performed 
AArch64 
Px 


PRFM PSTLIKEEP, [X1] ; preload into cache in unique state 
Loop 
LDAXR w5, [X1] ; read lock with acquire 
CBNZ W5, Loop ; check if 0 
STXR W5, WO, [X1] ; attempt to store new value 
CBNZ W5, Loop ; test if store succeeded and retry if not 


; loads and stores in the critical region can now be performed 


The acquire associated with the load is sufficient to ensure the required ordering in a lock situation. The 
Store-Exclusive will fail (and so be retried) if there is a store to the location being monitored between the 
Load-Exclusive and the Store-Exclusive. 
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K11.3.2 Releasing a lock 


The converse operation of releasing a lock does not require the use of Load-Exclusive and Store-Exclusive 
instructions, because only a single observer is able to write to the lock. However, often it is necessary for any 
observer to observe any memory updates, or any values that are loaded into memory, before they observe the release 
of the lock. Therefore, the lock release needs release semantics: 


AArch32 
Px 
; loads and stores in the critical region 
MOV RO, #0 
STL RO, [R1] ; clear the lock with release semantics 
AArch64 
Px 
; loads and stores in the critical region 
STLR WZR, [X1] ; clear the lock with release semantics 


K11.3.3 Ticket locks 


K11-7748 


When a lock is free, in order to avoid a rush to get the lock by many PEs, the use of ticket locks is common in more 
advanced systems. When the use is requested, the ticket locks determine the order of the users of the critical 
sections, in order to avoid starvation that can occur with a simple contention based spin lock. 


A ticket lock allocates each thread a ticket number when it first requests the lock, and then compares that number 
with the current number for the lock. If they are the same, then the critical section can be entered. Otherwise the 
thread waits until the current number is equal to the ticket number for that thread. 


The reading of the current number of the lock needs acquire semantics for the lock to be acquired. 





Note 
° The code in this section is little-endian code, as it views the combined current and next values as a single 
combined quantity. The addresses of the current and next ticket values need to be adjusted for a big-endian 
system. 
° The inclusion of AArch32 PLDW instructions or AArch64 PFRM PST= instructions in these examples is not a 


functional requirement, but will improve performance on many implementations. The performance benefit 
of adding these instructions will vary between different implementations of the architecture. 





This is shown in the implementation below: 
AArch32 
Px 


; R1 holds two 16 bit quantities 
; the lower halfword holds the current ticket number 
; the higher halfword holds the next ticket number 


PLDW[R1] ; preload into cache in unique state 
Loop1 

LDAEX R5, [R1] ; read current and next 

ADD R5, R5, #0x10000 ; increment the next number 

STREX R6, R5, [R1] ; and update the value 

CMP R6, #0 ; did the exclusive pass 

BNE Loop1 ; retry if not 


CMP R5, R5, ROR #16 ; is the current ticket ours 
BEQ block_start 

Loop2 
LDAH R6, [R1] ; read current value 
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CMP R6, R5, LSR #16 3; compare it with our allocated ticket 
BNE Loop2 ; retry (spin) if it is not the same 
block_start 


AArch64 
Px 


; X1 holds 2 16 bit quantities 
; the lower halfword holds the current ticket number 
; the higher halfword holds the next ticket number 


PRFM PSTLIKEEP, [X1] ; preload into cache in unique state 
Loop1 

LDAXR W5, [X1] read current and next 

ADD W5, W5, #0x10000 ; increment the next number 

STXR W6, w5, [X1] ; and update the value 

CBNZ W6, Loopl did the exclusive pass - retry if not 


AND W6, WS, #0xFFFF 

CMP W6, W5, LSR #16 ; is the current ticket ours 

B.EQ block_start 
Loop2 

LDARH W6, [X1] read current value 

CMP W6, W5, LSR #16 ; compare it with the our allocated ticket 

B.NE Loop2 retry (spin) if it isn’t the same 
block_start 


Releasing the ticket lock simply involves incrementing the current ticket number, that is still assumed to be in R3, 
and doing a Store-Release: 


AArch32 


ADD R6, R6, #1 
STLH R6, [R1] 


AArch64 


ADD W6, W6, #1 
STLRH W6, [X1] 


K11.3.4 Use of Wait For Event (WFE) and Send Event (SEV) with locks 
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The Armv8 architecture can use the Wait For Event mechanism to minimise the energy cost of polling variables by 
putting the PE into a low power state, suspending execution, until an asynchronous exception or an explicit event 
is seen by that PE. In Armv8, the event can be generated as a result of clearing the global monitor, so removing the 
need for a DSB barrier or an explicit send event message. 


This can be used with simple locks or with ticket locks. 


Note 


The inclusion of AArch32 PLDW instructions or AArch64 PFRM PST= instructions in these examples is not a functional 
requirement, but will improve performance on many implementations. The performance benefit of adding these 
instructions will vary between different implementations of the architecture. 








Simple lock 
The following is an example of lock acquire code using WFE: 
AArch32 


Px 
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PLDW[R1] ; preload into cache in unique state 
Loop 

LDAEX R5, [R1] ; read lock with acquire 

CMP R5, #0 ; check if 0 

WFENE ; sleep if the lock is held 


STREXEQ R5, RO, [R1] attempt to store new value 


CMPEQ R5, #0 ; test if store succeeded 
BNE Loop retry if not 
AArch64 
Px 
SEVL ; invalidates the WFE on the first loop iteration 
PREM PSTLIKEEP, [X1] ; allocate into cache in unique state 
Loop 
WFE 


LDAXR w5, [X1] 
CBNZ W5, Loop 
STXR W5, W0, [X1] 
CBNZ W5, Loop 


read lock with acquire 

check if 0 

attempt to store new value 

test if store succeeded and retry if not 


; loads and stores in the critical region can now be performed 


And the following is an example of lock release code: 


AArch32 
Px 
; loads and stores in the critical region 
MOV RO, #0 
STL RO, [R1] ; clear the lock 
AArch64 
Px 
; loads and stores in the critical region 
STLR WZR, [X1] ; clear the lock 


Ticket lock 


In the Ticket lock case, the Load-Exclusive instruction can be used to move the monitor into the exclusive state for 
the express purpose of creating an event when the monitor changes state: 


AArch32 
Px 


; R1 holds 2 16 bit quantities 
; the lower halfword holds the current ticket number 
; the higher halfword holds the next ticket number 


PLDW[R1] ; preload into cache in unique state 
Loop1 
LDAEX R5, [R1] ; read current and next 


ADD R5, R5, #0x10000 ; increment the next number 
STREX R6, R5, [R1] ; and update the value 

CMP R6, #0 ; did the exclusive pass 

BNE Loop ; retry if not 

CMP R5, R5, ROR #16 ; is the current ticket ours 
BEQ block_start 


SEVL 
Loop2 
WFE ; wait if there has not been a change to the count since last 
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LDAEXH R6, [R1] 

CMP R6, R5, LSR #16 

BNE Loop2 
block_start 


AArch64 


Px 


Barrier Litmus Tests 
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read 
check the current count 
check if it is equal 


; X1 holds 2 16 bit quantities 
; the lower halfword holds the current ticket number 
; the higher halfword holds the next ticket number 


PRFM PSTLIKEEP, [X1] 
Loop1 

LDAXR w5, [X1] 

ADD W5, W5, #0x10000 

STXR W6, WS, [X1] 

CBNZ W6, Loop1 


AND W6, W5, OxFFFF 
CMP W6, W5, LSR #16 
B.EQ block_start 
SEVL 
Loop2 
WFE 
LDAXRH W6, [X1] 
CMP W6, W5, LSR #16 
B.NE Loop2 
block_start 
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K11.4 


K11-7752 


Using a mailbox to send an interrupt 


In some message passing systems, it is common for one observer to update memory and then notify a second 


observer of the update by sending an interrupt, using a mailbox. 


Although a memory access might be made to initiate the sending of the mailbox interrupt, a DSB instruction is 


required to ensure the completion of previous memory accesses. 


Therefore, the following sequence is required to ensure that P2 observes the updated value: 


AArch32 
Pl 
STR R5, [R1] ; message stored to shared memory location 
DSB ST 
STR RO, [R4] ; R4 contains the address of a mailbox 
P2 
; interrupt service routine 
LDR R5, [R1] 
AArch64 
Pl 
STR w5, [X1] ; message stored to shared memory location 
DSB ST 
STR WO, [X4] ; R4 contains the address of a mailbox 
P2 
; interrupt service routine 
LDR w5, [X1] 
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K11.5 Cache and TLB maintenance instructions and barriers 


The following sections describe the use of barriers with cache and TLB maintenance instructions: 


s Data cache maintenance instructions. 

e Instruction cache maintenance instructions on page K11-7757. 

° TLB maintenance instructions and barriers on page K11-7760. 
K11.5.1 Data cache maintenance instructions 
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The following sections describe the use of barriers with data cache maintenance instructions: 

° Message passing to non-caching observers. 

s Multiprocessing message passing to non-caching observers. 

. Invalidating DMA buffers, non-functional example on page K11-7754. 

. Invalidating DMA buffers, functional example with single PE on page K11-7755. 

. Invalidating DMA buffers, functional example with multiple coherent PEs on page K11-7756. 


Message passing to non-caching observers 


The Armv8 architecture requires the use of DMB instructions to ensure the ordering of data cache maintenance 
instructions and their effects. The Load-Acquire and Store-Release instructions have no effect on cache 
maintenance instruction. This means the following message passing approaches can be used when communicating 
between caching observers and non-caching observers: 


AArch32 
Pl 
STR R5, [R1] ; updates data (assumed to be in P1 cache) 
DCCMVAC R1 ; cleans cache to point of coherency 
DMB ; ensures effects of the clean will be observed before the 
; flag is set 
STR RO, [R4] ; sends flag to external agent (Non-cacheable location) 
El 
WAIT_ACQ ([R4] == 1) ; waits for the flag (with order) 
LDR R5, [R1] ; reads the data 
AArch64 
Pl 
STR w5, [X1] ; updates data (assumed to be in P1 cache) 
DC CVAC, X1 ; cleans cache to point of coherency 
DMB ISH ; ensures effects of the clean will be observed before the 
; flag is set 
STR WO, [X4] ; sends flag to external agent (Non-cacheable location) 
El 


WAIT_ACQ ([X4] == 1) ; waits for the flag (with order) 
LDR W5, [X1] ; reads the data 


In this example, it is required that E1:R5==0x55. 


Multiprocessing message passing to non-caching observers 


The broadcast nature of the cache maintenance instructions combined with properties of barriers, means that the 
message passing principle for non-caching observers is: 


AArch32 
Pl 
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STR R5, [R1] ; updates data (assumed to be in P1 cache) 
STL RQ, [R2] ; sends a flag for P2 (ordered by the store release) 


P2 


WAIT ([R2] == 1) waits for P1 flag 


DMB ; ensures cache clean is observed after P1 flag is observed 
DCCMVAC R1 ; cleans cache to point of coherency - will clean P1 cache 
DMB ; ensures effects of the clean will be observed before the 
; flag to E1 is set 
STR RO, [R4] ; sends flag to El 
El 
WAIT_ACQ ([R4] == 1) ; waits for P2 flag (ordered) 
LDR R5, [R1] ; reads data 
AArch64 
Pl 
STR w5, [X1] ; updates data (assumed to be in P1 cache) 
STLR WO, [X2] ; sends a flag for P2 (ordered) 
P2 


WAIT ([X2] == 1) waits sfor P1 flag 


DMB SY ; ensure cache clean is observed after P1 flag is observed 

DC CVAC, X1 ; cleans cache to point of coherency, will clean P1 cache 

DMB SY ; ensures effects of the clean will be observed before the 
; flag to El is set 

STR WO, [X4] ; sends flag to El 


El 


WAIT_ACQ ([X4] == 1) 
LDR W5, [X1] 


waits for P2 flag 
reads data 


In this example, it is required that E1:R5==0x55. The clean operation executed by P2 affects the data location in the 
P1 cache. The cast-out from the P1 cache is guaranteed to be observed before P2 updates [R4]. 


Note 


The cache maintenance instructions are not ordered by the Load-Acquire and Store-Release instructions. 








Invalidating DMA buffers, non-functional example 


The basic scheme for communicating with an external observer that is a process that passes data in to a Cacheable 
memory region must take account of the architectural requirement that regions with a Normal Cacheable attribute 
can be allocated into a cache at any time, for example as a result of speculation. The following example shows this 


possibility: 
AArch32 
Pl 
DCIMVAC R1 ; ensures cache is not dirty. A clean operation could be used 
; but as the DMA will subsequently overwrite this region an 
; invalidate operation is sufficient and usually more efficient 
DMB ; ensures cache invalidation is observed before the next store 
; is observed 
STR RO, [R3] ; sends flag to external agent 
WAIT_ACQ ([R4]==1) ; waits for a different flag from an external agent 
LDR R5, [R1] 
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El 


WAIT ([R3] == 1) waits for flag 


STR R5, [R1] ; stores new data 
STL RQ, [R4] ; sends a flag 
AArch64 
P1 
DC IVAC, X1 ; ensure cache is not dirty. A clean operation could be used 


but as the DMA will subsequently overwrite this region an 
invalidate operation is sufficient and usually more efficient 
DMB SY ; ensures cache invalidation is observed before the next store 
is observed 


STR wð, [X3] sends flag to external agent 
WAIT_ACQ ([X4]==1) ; waits for a different flag from an external agent 
LDR w5, [X1] 
El 
WAIT ([X3] == 1) ; waits for flag 
STR w5, [X1] ; stores new data 
STLR WO, [X4] ; sends a flag 


If a speculative access occurs, there is no guarantee that the cache line containing [R1] is not brought back into the 
cache after the cache invalidation, but before [R1] is written by E1. Therefore, the result P1:R5=0 is permissible. 


Invalidating DMA buffers, functional example with single PE 


AArch32 
Pl 
DCIMVAC R1 ; ensures cache is not dirty. A clean operation could be used 
; but as the DMA will subsequently overwrite this region an 
; invalidate operation is sufficient and usually more efficient 
DMB ; ensures cache invalidation is observed before the next store 
; is observed 
STR RO, [R3] ; sends flag to external agent 
WAIT ([R4]==1) ; waits for a different flag from an external agent 
DMB ; ensures that cache invalidate is observed after the flag 
; from external agent is observed 
DCIMVAC R1 ; ensures cache discards stale copies before use 
LDR R5, [R1] 
El 


WAIT ([R3] == 1) waits for flag 


STR R5, [R1] ; stores new data 
STL RO, [R4] ; sends a flag 
AArch64 
P1 
DC IVAC, X1 ; ensures cache is not dirty. A clean operation could be used 


but as the DMA will subsequently overwrite this region an 
invalidate operation is sufficient and usually more efficient 
DMB SY ; ensures cache invalidation is observed before the next store 
is observed 


STR WO, [X3] ; sends flag to external agent 
WAIT ([X4]==1) ; waits for a different flag from an external agent 
DMB SY ; ensures that cache invalidate is observed after the flag 
; from external agent is observed 
DC IVAC, X1 ; ensures cache discards stale copies before use 
LDR W5, [X1] 
El 
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WAIT ([X3] == 1) ; waits for flag 
STR W5, [X1] ; stores new data 
STLR WO, [X4] ; sends a flag 


In this example, the result P1:R5 == 0x55 is required. Including a cache invalidation after the store by E1 to [R1] is 
observed ensures that the line is fetched from external memory after it has been updated. 


Invalidating DMA buffers, functional example with multiple coherent PEs 


The broadcasting of cache maintenance instructions, and the use of DMB instructions to ensure their observability, 
means that the previous example extends naturally to a multiprocessor system. Typically this requires a transfer of 
ownership of the region that the external observer is updating. 


AArch32 
PO 
(Use data from [R1], potentially using [R1] as scratch space) 
STL RO, [R2] ; signals release of [R1] 
WAIT_ACQ ([R2] == @) ; waits for new value from DMA 
LDR R5, [R1] 


P1 


WAIT ([R2] == 1) waits for release of [R1] by PO 


DCIMVAC R1 ; ensures caches are not dirty, an invalidate is sufficient 
DMB 

STR RO, [R3] ; requests new data for [R1] 

WAIT ([R4] == 1) ; waits for new data 

DMB 

DCIMVAC R1 ; ensures caches discard stale copies before use 

DMB 

MOV RO, #0 

STR RO, [R2] ; signals availability of new [R1] 


El 


WAIT ([R3] == 1) ; waits for new data request 


STR R5, [R1] ; sends new [R1] 
DMB [ST] 
STR RO, [R4] ; indicates that new data is available to P1 
AArch64 
PO 
(Use data from [X1], potentially using [X1] as scratch space) 
STLR WO, [X2] ; signals release of [X1] 
WAIT_ACQ ([X2] == @) ; waits for new value from DMA 
LDR w5, [X1] 
P1 
WAIT ([X2] == 1) ; waits for release of [R1] by PQ 
DC IVAC, X1 ; ensures caches are not dirty, an invalidate is sufficient 
DMB SY 
STR WO, [X3] ; requests new data for [R1] 
WAIT ([X4] == 1) ; waits for new data 
DMB SY 
DCIMVAC X1 ; ensures caches discard stale copies before use 
DMB SY 
STR WZR, [X2] ; signals availability of new [R1] 
El 
WAIT ([X3] == 1) ; waits for new data request 








STR W5, [X1] ; sends new [R1] 
STR WO, [X4] ; indicates new data is available to P1 
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In this example, the result PO:R5 == 0x55 is required. The DMB issued by P1 after the first data cache invalidation 
ensures that effect of the cache invalidation on PO is seen by E1 before the store by E1 to [R1]. The DMB issued by 
P1 after the second data cache invalidation ensures that its effects are seen before the store of 0 to the semaphore 
location in [R2]. 


K11.5.2 Instruction cache maintenance instructions 
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The following sections describe the use of barriers with instruction cache maintenance instructions: 
° Ensuring the visibility of updates to instructions for a uniprocessor. 


. Ensuring the visibility of updates to instructions for a multiprocessor. 


Ensuring the visibility of updates to instructions for a uniprocessor 


On a single PE, the agent that causes instruction fetches, or instruction cache linefills, is a separate memory system 
observer from the agent that causes data accesses. Therefore, any operations to invalidate the instruction cache can 
rely only on seeing updates to memory that are complete. This must be ensured by the use of a DSB instruction. 


Also, instruction cache maintenance instructions are only guaranteed to complete after the execution of a DSB, and 
an ISB is required to discard any instructions that might have been prefetched before the instruction cache 
invalidation completed. Therefore, on a uniprocessor, to ensure the visibility of an update to code and to branch to 
it, the following sequence is required: 


AArch32 
Pl 
STR R11, [R1] ; R11 contains a new instruction to be stored in program memory 
DCCMVAU R1 ; Clean to PoU makes the new instruction visible to the instruction cache 
DSB 
ICIMVAU R1 ; ensures instruction cache/branch predictor discards stale data 
BPIMVA R1 
DSB ; ensures completion of the invalidation 
ISB ; ensures instruction fetch path sees new instruction cache state 
BX R1 


In AArch64 state, the branch predictor maintenance is not required. 


AArch64 
Pl 
STR W11, [X1] ; W11 contains a new instruction to be stored in program memory 
DC CVAU, X1 ; Clean to PoU makes the new instruction visible to instruction cache 
DSB ISH 
IC IVAU, X1 ; ensures instruction cache/branch predictor discards stale data 
DSB ISH ; ensures completion of the invalidation 
ISB ; ensures instruction fetch path sees new instruction cache state 
BR X1 
— Note 


Where the changes to the instructions span multiple cache lines, then the data cache and instruction cache 
maintenance instructions can be duplicated to cover each of the lines to be cleaned and to be invalidated. 





Ensuring the visibility of updates to instructions for a multiprocessor 


The Armv8 architecture requires a PE that executes an instruction cache maintenance instruction to execute a DSB 
instruction to ensure completion of the maintenance operation. This ensures that the cache maintenance instruction 
is complete on all PEs in the Inner Shareable shareability domain. 


An ISB is not broadcast, and so does not affect other PEs. This means that any other PE must perform its own ISB 
synchronization after it knows that the update is visible, if it is necessary to ensure its synchronization with the 
update. The following example shows how this might be done: 
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AArch32 
Pl 


STR R11, [R1] 
DCCMVAU R1 
DSB 

ICIMVAU R1 
BPIMVA R 

DSB 


STR RO, [R2] 
ISB 
BX R1 


P2-Px 


WAIT ([R2] = 1) 
ISB 
BX R1 


AArch64 
Pl 


STR X11, [X1] 
DC CVAU, X1 
DSB ISH 

IC IVAU, X1 
DSB ISH 


STR WO, [X2] 
ISB 
BR R1 


P2-Px 
WAIT ([X2] == 1) 


ISB 
BR X1 


Nonfunctional approach 


R11 contains a new instruction to be stored in program memory 

clean to PoU makes the new instruction visible to the instruction cache 
ensures completion of the clean on all PEs 

ensures instruction cache discards stale data 

ensures branch predictor discards stale data 

ensures completion of the instruction cache and branch predictor 
invalidation on all PEs 

sets flag to signal completion 

synchronizes context on this PE 

branches to new code 


; waits for flag signalling completion 


synchronizes context on this PE 
branches to new code 


; X11 contains a new instruction to be stored in program memory 


clean to PoU makes the new instruction visible to the instruction cache 
ensures completion of the clean on all PEs 

ensures instruction cache/branch predictor discards stale data 

ensures completion of the instruction cache/branch predictor 
invalidation on all PEs 

sets flag to signal completion 

synchronizes context on this PE 

branches to new code 


waits for flag signalling completion 
synchronizes context on this PE 


; branches to new code 


The following sequence does not have the same effect, because a DSB is not required to complete the instruction 
cache maintenance instructions that other PEs issue: 


AArch32 
Pl 


STR R11, [R1] 
DCCMVAU R1 
DSB 

ICIMVAU R1 
BPIMVA R1 
DMB 


STR RO, [R2] 
DSB 

ISB 

BX R1 


P2-Px 


WAIT ([R2] == 1) 
DSB 


ISB 
BX R1 


: ensures branch predictor discards stale data 


; R11 contains a new instruction to be stored in program memory 


clean to PoU makes the new instruction visible to the instruction cache 
ensures completion of the clean on all PEs 
ensures instruction cache discards stale data 


ensures ordering of the store after the invalidation 

DOES NOT guarantee completion of instruction cache/branch 
predictor on other PEs 

sets flag to signal completion 
ensures completion of the invalidation on all PEs 
synchronizes context on this PE 

branches to new code 





waits for flag signalling completion 
this DSB does not guarantee completion of P1 
ICIMVAU/BPIMVA 
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AArch64 
Pl 


STR W11, [X1] ; W11 contains a new instruction to be stored in program memory 





DC CVAU, X1 ; clean to PoU makes the new instruction visible to instruction cache 
DSB ISH ; ensures completion of the clean on all PEs 
IC IVAU, X1 ; ensures instruction cache/branch predictor discards stale data 
DMB ISH ; ensures ordering of the store after the invalidation 
; DOES NOT guarantee completion of instruction cache/branch 
; predictor on other PEs 
STR WO, [X2] ; sets flag to signal completion 
DSB ISH ; ensures completion of the invalidation on all PEs 
ISB ; synchronizes context on this PE 
BR X1 ; branches to new code 
P2-Px 
WAIT ([X2] == 1) ; waits for flag signalling completion 
DSB ISH ; this DSB does not guarantee completion of P1 
; ICIMVAU/BPIMVA 
ISB 
BR X1 


In this example, P2...Px might not see the updated region of code at R1. 
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The following sections describe the use of barriers with TLB maintenance instructions: 

. Ensuring the visibility of updates to translation tables for a uniprocessor. 

. Ensuring the visibility of updates to translation tables for a multiprocessor. 

° Paging memory in and out on page K11-7761. 

. Using break-before-make when updating translation table entries on page K11-7762. 


Ensuring the visibility of updates to translation tables for a uniprocessor 


On a single PE, the agent that causes translation table walks is a separate memory system observer from the agent 
that causes data accesses. Therefore, any operations to invalidate the TLB can only rely on seeing updates to 
memory that are complete. This must be ensured by the use of a DSB instruction. 


The Armv8 architecture requires that translation table walks look in the data or unified caches at L1, so such systems 
do not require data cache cleaning. 


After the translation tables update, any old copies of entries that might be held in the TLBs must be invalidated. This 
operation is only guaranteed to affect all instructions, including instruction fetches and data accesses, after the 
execution of a DSB and an ISB. Therefore, the code for updating a translation table entry is: 


AArch32 
Pl 
STR R11, [R1] ; updates the translation table entry 
DSB ; ensures visibility of the update to translation table walks 
TLBIMVA R10 
BPIALL 
DSB ; ensures completion of the BP and TLB invalidation 
ISB ; synchronises context on this PE 


; new translation table entry can be relied upon at this point and all accesses 
; generated by this observer using 
; the old mapping have been completed 


AArch64 
Pl 
STR X11, [X1] ; updates the translation table entry 
DSB ISH ; ensures visibility of the update to translation table walks 
TLBI VAE1, X10 ; assumes we are in the EL1 
DSB ISH ; ensures completion of the TLB invalidation 
ISB ; synchronise context on this PE 


; new translation table entry can be relied upon at this point and all accesses 
; generated by this observer using 
; the old mapping have been completed 


Importantly, by the end of this sequence, all accesses that used the old translation table mappings have been 
observed by all observers. 


An example of this is where a translation table entry is marked as invalid. Such a system must provide a mechanism 
to ensure that any access to a region of memory being marked as invalid has completed before any action is taken 
as a result of the region being marked as invalid. 


Ensuring the visibility of updates to translation tables for a multiprocessor 


The same code sequence can be used in a multiprocessing system. The Armv8 architecture requires a PE that 
executes a TLB maintenance instruction to execute a DSB instruction to ensure completion of the maintenance 
operation. This ensures that the TLB maintenance instruction is complete on all PEs in the Inner Shareable 
shareability domain. 


The completion of a DSB that completes a TLB maintenance instruction ensures that all accesses that used the old 
mapping have completed. 
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AArch32 
Pl 
STR R11, [R1] ; updates the translation table entry 
DSB ; ensures visibility of the update to translation table walks 
TLBIMVAIS R10 
BPIALLIS 
DSB ; ensures completion of the BP and TLB invalidation 
ISB ; Note ISB is not broadcast and must be executed locally 


; on other PEs 
; new translation table entry can be relied upon at this point and all accesses 
; generated by any observers affected by the broadcast TLBIMVAIS operation using 
; the old mapping have been completed 


AArch64 
Pl 
STR X11, [X1] ; updates the translation table entry 
DSB ISH ; ensures visibility of the update to translation table walks 
TLBI VAE1IS, X10 
DSB ISH ; ensures completion of the TLB invalidation 
ISB ; Note ISB is not broadcast and must be executed locally 


; on other PEs 
; new translation table entry can be relied upon at this point and all accesses 
; generated by any observers affected by the broadcast TLBIMVAIS operation using 
; the old mapping have been completed 


The completion of the TLB maintenance instruction is guaranteed only by the execution of a DSB by the observer 
that performed the TLB maintenance instruction. The execution of a DSB by a different observer does not have this 
effect, even if the DSB is known to be executed after the TLB maintenance instruction is observed by that different 
observer. 


Paging memory in and out 


In a multiprocessor system there is a requirement to ensure the visibility of translation table updates when paging 
regions of memory into RAM from a backing store. This might, or might not, also involve paging existing locations 
in memory from RAM to a backing store. In such situations, the operating system selects one or more pages of 
memory that might be in use but are suitable to discard, with or without copying to a backing store, depending on 
whether or not the region of memory is writable. Disabling the translation table mappings for a page, and ensuring 
the visibility of that update to the translation tables, prevents agents accessing the page. 


For this reason, it is important that the DSB that is performed after the TLB invalidation ensures that no other updates 
to memory using those mappings are possible. 


An example sequence for the paging out of an updated region of memory, and the subsequent paging in of memory, 
is as follows: 


AArch32 

Pl 
STR R11, [R1] ; updates the translation table for the region being paged out 
DSB ; ensures visibility of the update to translation table walks 
TLBIMVAIS R10 ; invalidates the old entry 
DSB ; ensures completion of the invalidation on all PEs 
ISB ; ensures visibility of the invalidation 


BL SaveMemoryPageToBackingStore 
BL LoadMemoryFromBackingStore 





DSB ; ensures completion of the memory transfer (this could be part of 
; LoadMemoryFromBackingStore) 
ICIALLUIS ; also invalidates the branch predictor 
DSB ; ensures completion of the instruction cache 
; and branch predictor invalidation 
STR R9, [R1] ; creates a new translation table entry with a new mapping 
DSB ; ensures visibility of the new translation table mapping 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K11-7761 


ID070919 Non-Confidential 


Barrier Litmus Tests 


K11.5 Cache and TLB maintenance instructions and barriers 


K11-7762 


ISB ; ensures synchronisation of this instruction stream 
AArch64 
Pl 
STR X11, [X1] ; updates the translation table for the region being paged out 
DSB ISH ; ensures visibility of the update to translation table walks 
TLBI VAE1IS, X10 ; invalidates the old entry 
DSB ISH ; ensures completion of the invalidation on all PEs 
ISB ; ensures visibility of the invalidation 


BL SaveMemoryPageToBackingStore 
BL LoadMemoryFromBackingStore 





DSB ISH ; ensures completion of the memory transfer (this could be part of 
; LoadMemoryFromBackingStore) 

IC IALLUIS ; also invalidates the branch predictor 

DSB ISH ; ensures completion of the instruction cache 
; and branch predictor invalidation 

STR X9, [X1] ; creates a new translation table entry with a new mapping 

DSB ISH ; ensures visibility of the new translation table mapping 

ISB ; ensures synchronisation of this instruction stream 


This example assumes the memory copies are performed by an observer that is coherent with the caches of PE P1. 
This observer might be P1 itself, using a specific paging mapping. For clarity, the example omits the functional 
descriptions of SaveMemoryPageToBackingStore and LoadMemoryFromBackingStore. LoadMemoryFromBackingStore is 
required to ensure that the memory updates that it makes are visible to instruction fetches. 


In this example, the use of ICIALLUIS in AArch32 state and IC IALLUIS in AArch64 state to invalidate the entire 
instruction cache is a simplification, that might not be optimal for performance. An alternative approach involves 
invalidating all of the lines in the caches using ICIMVAU in AArch32 state and IC IVAU operations in AArch64 
state. This invalidation must be done when the mapping used for the ICIMVAU and IC IVAU operations is valid 
but not executable. 


Using break-before-make when updating translation table entries 


The Arm Architecture requires that reads to the same location are observed in order, and since application level 
software relies on this behavior, the operating system needs to maintain this illusion when it is changing a virtual to 
physical address mapping for a location, as is the case with copy on write or other memory management techniques. 
This illusion can be maintained provided that the software uses a break-before-make sequence when updating 
translation table entries whenever multiple threads of execution can use the same translation tables and the change 
to the translation entries involves any of: 


$ Changing the memory type. 
° Changing the cacheability attributes 


e Changing the output address (OA), if the OA of at least one of the old translation table entry and the new 
translation table entry is writable. 


The architecture requires use of a break-before make sequence in these situations, see Using break-before-make 
when updating translation table entries on page D5-2639 for more information. However, if software did not use a 
break-before-make approach, an implementation might give a result that would occur if the two reads to the same 
virtual address did not occur in program order. An example of such an occurrence would be an implementation of 
copy-on-write, where one PE is performing two reads to the same virtual address at the same time as a second PE, 
running code associated with the operating system, is copying the data from one physical location that is mapped to 
by that virtual address, where the page was mapped as read-only, to a different physical location which will be 
mapped as read-write. 


If the operating system changed the address mapping without going through an invalid entry, then it would be 
possible for a third PE to perform a write to the location that would be seen by the first load by the first PE, and not 
seen by the second load by the same PE. 


The required break-before-make code sequence in this case is: 


AArch32 
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Pl 
; R1, R2 contain an invalid translation table entry (that is, one with bit[@] == 0) 
; R3 contains the address of the translation table entry 
; R4 contains the Virtual Address and ASID of the VA being remapped 
; R5, R6 contain the new valid translation table entry 
STRD R1, R2, [R3] ; stores invalid entry 
DSB ISH ; ensures visibility of the update to translation table walks 
TLBIMVAIS R4 ; invalidates the old entry 
DSB ISH ; ensures completion of the invalidation on all PEs 
ICIALLUIS ; also invalidates the branch predictor 
STRD R5, R6, [R3] ; store new mapping 
DSB ISH ; ensures visibility of the update to translation table walks 
ISB ; ensures synchronisation of this instruction stream 
Note 





This example shows an update to an entry in a translation table that is using the long-descriptor format. 





AArch64 
Pl 


; X1 contains an invalid translation table entry (that is, one with bit[Q] == 0) 
; X2 contains the address of the translation table entry 

; X3 contains the Virtual Address and ASID of the VA being remapped 

; X4 contains the new valid translation table entry 


STR X1, [X2] ; stores invalid entry 

DSB ISH ; ensures visibility of the update to translation table walks 
TLBI VAE1IS, X3 ; invalidates the old entry 

DSB ISH ; ensures completion of the invalidation on all PEs 

IC IALLUIS ; also invalidates the branch predictor 

STR X4, [X2] ; store new mapping 

DSB ISH ; ensures visibility of the update to translation table walks 


ISB ensures synchronisation of this instruction stream 


If this sequence is correctly followed, then the architecture guarantees that the loads to a virtual address being 
remapped will be seen in the correct order. 


The instruction cache maintenance is only required if the mapping from input address to output address has been 
changed as part of the change of the translation table entries, and the memory being moved is executable. In this 
example, the use of ICIALLUIS in AArch32 state and IC IALLUIS in AArch64 state to invalidate the entire instruction 
cache is a simplification, that might not be optimal for performance. An alternative approach involves invalidating 
all of the lines in the caches using ICIMVAU in AArch32 state, and IC IVAU in AArch64 state. This invalidation must 
be done when the mapping used for the ICIMVAU and IC IVAU operations is valid but not executable. 


K11.5.4 Ordering of Memory-mapped device control with payloads 


ARM DDI 0487E.a 
ID070919 


With a Memory-mapped peripheral, such as a DMA, which can also access memory for its own use, it is common 
to have control or status registers which are Memory-mapped. These registers need to be accessed in an ordered 
manner with respect to the data that the Memory-mapped peripheral is handling. 


Two simple examples of this are: 


° When a processing element is writing a buffer of data, and then writing to a control register in the DMA 
peripheral to start that peripheral to access the buffer of data. 


° When a DMA peripheral has written to a buffer of data in memory, and the processing element is reading a 
status register to determine that the DMA transfer has completed, and then is reading the data. 


For the case of the processing element writing a buffer of data, before starting the DMA peripheral, the ordering 
requirements between the stores to the data buffer and the stores to the Memory-mapped a to the DMA peripheral 
can be met by the insertion of a DSB <domain> instruction between these sets of accesses as this ensures the global 
observation of the stores before the DMA is started. this is shown by the following code: 


AArch32 
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Pl 
STR R5, [R2] 
DSB 
STR RO, [R4] 
AArch64 
Pl 
STR w5, [X2] 
DSB <domain> 
STR WO, [X4] 


data written to the data buffer 


; R4 contains the address of the DMA control register 


data written to the data buffer 


X4 contains the address of the DMA control register 


For the case of DMA peripheral writing the data buffer and then setting a status register when those stores are 
complete (and so globally observed) and then having this status register polled by the processing element before the 
processing element reads the data buffer, the processing element must insert a DSB <domain> between the load that 
reads the status register, and the read of the buffer. A DMB, or load-acquire, is not sufficient as this problem is not 
solely concerned with observation order, since the polling read is actually a read of a status register at a slave, not 
the polling a data value that has been written by an observer. 


For this case, the code is therefore: 


AArch32 
Pl 
WAIT ([R4] == 1) 


DSB 
LDR R5, [R2] 


AArch64 
Pl 
WAIT ([X4] == 1) 


DSB <domain> 
LDR W5, [X2] 


R4 contains the address of the status register, 
and the value '1' indicates completion of the DMA transfer 


reads data from the data buffer 


; X4 contains the address of the status register, 


and the value '1' indicates completion of the DMA transfer 


reads data from the data buffer 
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K11.6 |Armv7 compatible approaches for ordering, using DMB and DSB barriers 


The following sections describe the Armv7 compatible approaches for ordering, using DMB and DSB barriers: 
s Simple ordering and barrier cases. 


. Load-Exclusive, Store-Exclusive and barriers on page K11-7769. 


° Using a mailbox to send an interrupt on page K11-7771. 
° Cache and TLB maintenance instructions and barriers on page K11-7771. 
K11.6.1 Simple ordering and barrier cases 


ARM DDI 0487E.a 
ID070919 


Arm implements a weakly consistent memory model for Normal memory. In general terms, this means that the order 
of memory accesses observed by other observers might not be the order that appears in the program, for either loads 
or stores. 


This section includes examples of this. 


Simple weakly consistent ordering example 


Pl 
STR R5, [R1] 
LDR R6, [R2] 
P2 
STR R6, [R2] 
LDR R5, [R1] 


In the absence of barriers, the result of P1: R6=0, P2: R5=0 is permissible. 


Message passing 


The following sections describe: 
7 Weakly-ordered message passing problem. 
° Message passing with multiple observers on page K11-7766. 


Weakly-ordered message passing problem 


P1 

STR R5, [R1] ; sets new data 

STR RO, [R2] ; sends flag indicating data ready 
P2 

WAIT([R2]==1) ; waits on flag 

LDR R5, [R1] ; reads new data 


In the absence of barriers, an end result of P2: R5=0 is permissible. 


Resolving by the addition of barriers 


The addition of barriers, to ensure the observed order of the reads and the writes, ensures that data is transferred so 
that the result P2:R5==0x55 is guaranteed, as follows: 


P1 
STR R5, [R1] ; sets new data 
DMB [ST] ; ensures all observers observe data before the flag 
STR RO, [R2] ; sends flag indicating data ready 

P2 


WAIT([R2]==1) waits on flag 
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DMB ; ensures that the load of data is after the flag has been observed 
LDR R5, [R1] 


Resolving by the use of barriers and address dependency 


There is a rule within the Arm architecture that: 


Where the value returned by a read is used for computation of the virtual address of a subsequent read or 
write, then these two memory accesses are observed in program order. 


Where the value returned by a read is used for computation of the virtual address of a subsequent read or 
write, this is called an address dependency. An address dependency exists even if the value returned by the 
first read has no effect on the virtual address. This might occur if the value returned is masked off before it 
is used, or if it confirms a predicted address value that it might have changed. 


This restriction applies only when the data value returned by a read is used as a data value to calculate the 
address of a subsequent read or write. It does not apply if the data value returned by a read determines the 
condition flags values, and the values of the flags are used for condition code evaluation to determine the 
address of a subsequent read, either through conditional execution or the evaluation of a branch. This is called 
a control dependency. 


Where both a control and address dependency exist, the ordering behavior is consistent with the address 
dependency. 


Table K11-1 shows examples of address dependencies, control dependencies, and an address and control 


dependency. 


Table K11-1 Dependency examples 





Address dependency 


Control dependency 


Address and control dependency? 











(a) (b) (c) (d) (e) 

LDR r1, [r0] LDR r1, [r0] LDR ri, [r0] LDR r1, [r0] LDR r1, [r0] 

LDR r2, [r1] AND r1, r1, #0 CMP r1, #55 CMP r1, #55 CMP r1, #0 
LDR r2, [r3, r1] LDRNE r2, [r3] MOVNE r4, #22 LDRNE r2, [r1] 





LDR r2, [r3, r4] 





a. 


The address dependency takes priority. 


This means that the data transfer example of Weakly-ordered message passing problem on page K11-7765 can also 
be satisfied as shown in the following example: 





P1 
STR R5, [R1] ; sets new data 
DMB [ST] ; ensures all observers observe data before the flag 
STR RO, [R2] ; sends flag indicating data ready 
P2 
WAIT([R2]==1) 
AND R12, R12, #0 ; R12 is destination of LDR in WAIT macro 
LDR R5, [R1, R12] ; the load has an address dependency on R12 


; and so is ordered after the flag has been seen 


The load of R5 by P2 is ordered with respect to the load from [R2] because there is an address dependency using 
R12. P1 uses a DMB to ensure that P2 does not observe the write of [R2] before the write of [R1]. 


Message passing with multiple observers 


Where the ordering of Normal memory accesses is not resolved by the use of barriers or dependencies, then different 
observers might observe the accesses in a different order, as shown in the following example: 
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STR R5, [R1] ; sets new data 
STR RO, [R2] ; sends flag indicating data ready 
P2 
WAIT([R2]==1) 
AND R12, R12, #0 ; R12 is destination of LDR in WAIT macro 
LDR R5, [R1, R12] ; the load has an address dependency on R12 
; and so is ordered after the flag has been seen 
P3 
WAIT([R2]==1) 
AND R12, R12, #0 ; R12 is destination of LDR in WAIT macro 
LDR R5, [R1, R12] ; the load is address depndent on R12 


; and so is ordered after the flag has been seen 


In this case, it is permissible for P2:R5 and P3:R5 to contain different values, because there is no order guaranteed 
between the two stores performed by P1. 


Resolving by the addition of barriers 


The addition of a barrier by P1, as shown in the following example, ensures the observed order of the writes, 
transferring data so that P2:R5 and P3:R5 both contain the value 0x55: 





P1 
STR R5, [R1] ; sets new data 
DMB [ST] ; ensures all observers observe data before the flag 
STR RO, [R2] ; sends flag indicating data ready 
P2 
WAIT([R2]==1) 
AND R12, R12, #0 ; R12 is the destination of LDR in WAIT macro 
LDR R5, [R1, R12] ; the load has an address dependency on R12 
; and so is ordered after the flag has been seen 
P3 
WAIT([R2]==1) 
AND R12, R12, #0 ; R12 is the destination of LDR in WAIT macro 
LDR R5, [R1, R12] ; the load has an address dependency on R12 


; and so is ordered after the flag has been seen 


Address dependency with object construction 


When accessing an object-oriented data structure, the address dependency rule means that barriers are not required, 
even when initializing the object: 


P1 
STR R5, [R1, #offset] ; sets new data in a field 
DMB [ST] ; ensures all observers observe data before base address is updated 
STR R1, [R2] ; updates base address 
P2 
LDR R1, [R2] ; reads for base address 
CMP R1, #0 ; checks if it is valid 
BEQ null_trap 
LDR R5, [R1, #offset] ; uses base address to read field 





If the null trap is not taken, it is required that P2:R5==0x55. This avoids P2 observing a partially constructed object 
from P1. Significantly, P2 does not require a barrier to ensure this behavior. 
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P1 requires a barrier to ensure the observed order of the writes by P1. In general, the impact of requiring a barrier 
during the construction phase is much less than the impact of requiring a barrier for every read access. 


Posting a store before polling for acknowledgement 


In the case where an observer stores to a location, and then polls for an acknowledge from a different observer, the 
weak ordering of the memory model can lead to a deadlock, as the following example shows: 


Pl 


STR RO, [R2] 
WAIT ([R3]==1) 


P2 


WAIT ([R2]==1) 
STR RO, [R3] 


In Armv7 implementations that do not include the Multiprocessing Extensions, then this can deadlock because P2 
might not observe the store by P1 in finite time. For Armv7 implementations with the Multiprocessing Extensions 
and for Armv8, this is not an issue as all stores must be observed by all observers within their shareability domain 
in finite time. 


The addition of a DMB instruction prevents this deadlock in Armv7 implementations that do not include the 
Multiprocessing Extensions: 


Pl 


STR RO, [R2] 
DMB 
WAIT ([R3]==1) 


P2 


WAIT ([R2]==1) 
STR RO, [R3] 


The DMB executed by P1 ensures that P2 observes the store by P1 before it observes the load by P1. This ensures a 
timely completion. 


The following example is a variant of the previous example, where the two observers poll the same memory 
location: 


P1 


STR RO, [R2] 
WAIT ([R2]==2) 


P2 


WAIT ([R2]==1) 
LDR RO, [R2] 
ADD RO, RO, #1 
STR RO, [R2] 


In this example, the same deadlock can occur in Armv7 implementations that do not include the Multiprocessing 
Extensions, because the architecture permits P1 to read the result of its own store to [R2] early, and continue doing 
so for an indefinite amount of time. The addition of a DMB instruction prevents this deadlock: 


Pl 


STR RO, [R2] 
DMB 
WAIT ([R2]==2) 


P2 


WAIT ([R2]==1) 
LDR RO, [R2] 
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ADD RO, RO, #1 
STR RO, [R2] 


WFE and WFI and barriers 


The Wait For Event and Wait For Interrupt instructions permit the PE to suspend execution and enter a low-power 
state. A DSB barrier instruction is required if it is necessary to ensure that memory accesses made before the WFI or 
WFE are visible to other observers, unless some other mechanism has ensured this visibility. Examples of other 
mechanism that would guarantee the required visibility are the DMB described in Posting a store before polling for 
acknowledgement on page K11-7768, or a dependency on a load. 


The following example requires the DSB to ensure that the store is visible: 
P1 


STR RO, [R2] 
DSB 
Loop 
WFI 
B Loop 


However, if the example in Posting a store before polling for acknowledgement on page K 11-7768 is extended to 
include a WFE, there is no risk of a deadlock. The extended example is: 


Pl 


STR RO, [R2] 
DMB 

Loop 
LDR R12, [R3] 
CMP R12, #1 
WFENE 
BNE Loop 


P2 


WAIT ([R2]==1) 
STR RO, [R3] 
DSB 

SEV 


In this example: 
. The DMB by P1 ensures that P2 observes the store by P1 before it observes the load by P1. 


è The dependency of the WFE on the result of the load by P1 means that this load must complete before P1 
executes the WFE. 


For more information about SEV, see Use of Wait For Event (WFE) and Send Event (SEV) with locks on 
page K11-7770. 


K11.6.2 Load-Exclusive, Store-Exclusive and barriers 


ARM DDI 0487E.a 
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The Load-Exclusive and Store-Exclusive instructions, described in Synchronization and semaphores on 

page B2-156, are predictable only with Normal memory. These instructions do not have any implicit barrier 
functionality. Therefore, any use of these instructions to implement locks of any type requires the addition of explicit 
barriers. 


Acquiring a lock 


A common use of Load-Exclusive and Store-Exclusive instructions is to claim a lock to permit entry into a critical 
region. This is typically performed by testing a lock variable that indicates 0 for a free lock and some other value, 
commonly 1 or an identifier of the process holding the lock, for a taken lock. 
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The lack of implicit barriers in the Load-Exclusive and Store-Exclusive instructions means that the mechanism 
requires a DMB instruction between acquiring a lock and making the first access to the critical region, to ensure that 
all observers observe the successful claim of the lock before they observe any subsequent loads or stores to the 
region. This example shows Px acquiring a lock: 


Px 
Loop 
LDREX R5, [R1] ; reads lock 
CMP R5, #0 ; checks if 0 
STREXEQ R5, RO, [R1] ; attempts to store new value 
CMPEQ R5, #0 ; tests if store succeeded 
BNE Loop ; retries if not 
DMB ; ensures that all subsequent accesses are observed after the 


; gaining of the lock is observed 
; loads and stores in the critical region can now be performed 


Releasing a lock 


The converse operation of releasing a lock does not require the use of Load-Exclusive and Store-Exclusive 
instructions, because only a single observer is able to write to the lock. However, often it is necessary for any 
observer to observe any memory updates, or any values that are loaded into memory, before they observe the release 
of the lock. Therefore, a DMB usually precedes the lock release, as the following example shows. 


Px 
; loads and stores in the critical region 
MOV RO, #0 
DMB ; ensures all previous accesses are observed before the lock is cleared 
STR RO, [R1] ; clears the lock 


Use of Wait For Event (WFE) and Send Event (SEV) with locks 


The Armv8 architecture includes Wait For Event and Send Event instructions, that can be executed to reduce the 
required number of iterations of a lock-acquire loop, or spinlock, to reduce power. The basic mechanism involves 
an observer that is in a spinlock executing a WFE instruction that suspends execution on that observer until an 
asynchronous exception or an explicit event, sent by some other observer using the SEV instruction, is seen by the 
suspended observer. An observer that holds the lock executes an SEV instruction to send an event after it has released 
the lock. 


The Event signal is a non-memory communication, and therefore the memory update that releases the lock must be 
observable by all observers before the SEV instruction is executed and the event is sent. This requires the use of DSB 
instruction, rather than DMB. 


Therefore, the following is an example of lock acquire code using WFE: 


Px 

Loop 

LDREX R5, [R1] ; reads lock 
CMP R5, #0 ; checks if 0 
WFENE ; sleeps if the lock is held 
STREXEQ R5, RO, [R1] ; attempts to store new value 
CMPEQ R5, #0 ; tests if store succeeded 
BNE Loop ; retries if not 
DMB ; ensures that all subsequent accesses are observed after the 


; gaining of the lock is observed 
; loads and stores in the critical region can now be performed 


And the following is an example of lock release code using SEV: 


Px 
; loads and stores in the critical region 
MOV RO, #0 
DMB ; ensures all previous accesses are observed before the lock is cleared 
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STR RQ, [R1] ; clears the lock 
DSB ; ensures completion of the store that cleared the lock before 
; sending the event 
SEV 
K11.6.3 Using a mailbox to send an interrupt 


In some message passing systems, it is common for one observer to update memory and then notify a second 
observer of the update by sending an interrupt, using a mailbox. 


Although a memory access might be made to initiate the sending of the mailbox interrupt, a DSB instruction is 
required to ensure the completion of previous memory accesses. 


Therefore, the following sequence is required to ensure that P2 observes the updated value: 


Pl 
STR R5, [R1] ; message stored to shared memory location 
DSB [ST] 
STR R1, [R4] ; R4 contains the address of a mailbox 
P2 
; interrupt service routine 
LDR R5, [R1] 


Note 


The DSB executed by P1 ensures global observation of the store to [R1].The interrupt timing ensures that the code 
executed by P2 is executed after the global observation of the update to [R1], and therefore must see this update. In 
some implementations, this might be implemented by requiring that interrupts flush non-coherent buffers that hold 
speculatively loaded data. 








K11.6.4 Cache and TLB maintenance instructions and barriers 


The following sections describe the use of barriers with cache and TLB maintenance instructions: 


$ Data cache maintenance instructions. 
° Instruction cache maintenance instructions on page K11-7774. 
e TLB maintenance instructions and barriers on page K11-7775. 


Data cache maintenance instructions 


The following sections describe the use of barriers with data cache maintenance instructions: 

° Message passing to non-caching observers. 

e Multiprocessing message passing to non-caching observers on page K11-7772. 

. Invalidating DMA buffers, non-functional example on page K11-7772. 

. Invalidating DMA buffers, functional example with single PE on page K11-7773. 

° Invalidating DMA buffers, functional example with multiple coherent PEs on page K11-7773. 


Message passing to non-caching observers 


The Armv8 architecture requires the use of DMB instructions to ensure the ordering of data cache maintenance 
instructions and their effects. This means the following message passing approaches can be used when 
communicating between caching observers and non-caching observers: 


Pl 
STR R5, [R1] ; updates data (assumed to be in P1's cache) 
DCCMVAC R1 ; cleans cache to point of coherency 
DMB ; ensures effects of the clean will be observed before the flag is set 
STR RO, [R4] ; sends flag to external agent (Non-cacheable location) 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K11-7771 


ID070919 Non-Confidential 


Barrier Litmus Tests 


K11.6 Armv7 compatible approaches for ordering, using DMB and DSB barriers 


El 


WAIT ([R4] == 1) 
DMB 
LDR R5, [R1] 


; waits for the flag 
; ensures that flag has been seen before reading data 
; reads the data 


In this example, it is required that E1:R5==0x55. 


Multiprocessing message passing to non-caching observers 


The broadcast nature of the cache maintenance instructions in Armv8, and in Armv7 implementations that include 
the Multiprocessing Extensions, combined with properties of barriers, means that the message passing principle for 
non-caching observers is: 


Pl 
STR R5, [R1] ; updates data (assumed to be in P1's cache) 
DMB [ST] ; ensures new data is observed before the flag to P2 is set 
STR RO, [R2] ; sends flag to P2 

P2 


WAIT ([R2] = 1) waits for flag from P1 


DMB ; ensures cache clean is observed after P1 flag is observed 

DCCMVAC R1 ; cleans cache to point of coherency - this cleans the cache of P1 

DMB ; ensures effects of the clean are observed before the flag to E1 is set 
STR RO, [R4] ; sends flag to E1 


El 


WAIT ([R4] == 1) waits for flag from P2 
DMB ensures that flag has been observed before reading the data 
LDR R5, [R1] ; reads the data 


In this example, it is required that E1:R5==0x55. The clean operation executed by P2 affects the data location in the 
P1 cache. The cast-out from the P1 cache is guaranteed to be observed before P2 updates [R4]. 


Invalidating DMA buffers, non-functional example 


The basic scheme for communicating with an external observer that is a process that passes data in to a Cacheable 
memory region must take account of the architectural requirement that regions with a Normal Cacheable attribute 
can be allocated into a cache at any time, for example as a result of speculation. The following example shows this 
possibility: 


P1 
DCIMVAC R1 ; ensures caches are not dirty. A clean operation could be 
; used but the DMA overwrites this region so an invalidate operation 
; is sufficient and usually more efficient 
DMB ; ensures cache invalidation is observed before the next store is observed 
STR RO, [R3] ; sends flag to external agent 
WAIT ([R4]==1) ; waits for a different flag from an external agent 
DMB ; observes flag from external agent before reading new data. However [R1] 
; could have been brought into cache earlier 
LDR R5, [R1] 
El 
WAIT ([R3] == 1) ; waits for flag 
STR R5, [R1] ; stores new data 
DMB 
STR RO, [R4] ; sends a flag 


If a speculative access occurs, there is no guarantee that the cache line containing [R1] is not brought back into the 
cache after the cache invalidation, but before [R1] is written by E1. Therefore, the result P1:R5=0 is permissible. 
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Invalidating DMA buffers, functional example with single PE 


Pl 
DCIMVAC R1 ; 
DMB ; 
STR RO, [R3] ; 
WAIT ([R4]==1) ; 
DMB ; 
DCIMVAC R1 ; 
LDR R5, [R1] 

El 


WAIT ([R3] == 1) 


STR R5, [R1] ; 
DMB [ST] 
STR RO, [R4] ; 


In this example, the result P1:R5 


ensures cache is not dirty. A clean operation could be 

used but the DMA overwrites this region so an invalidate operation 

is sufficient and usually more efficient 

ensures cache invalidation is observed before the next store is observed 
sends flag to external agent 

waits for a different flag from an external agent 

ensures that cache invalidate is observed after the flag 

from external agent is observed 

ensures cache discards stale copies before use 


waits for flag 
stores new data 


sends a flag 


== 0x55 is required. Including a cache invalidation after the store by E1 to [R1] is 


observed ensures that the line is fetched from external memory after it has been updated. 


Invalidating DMA buffers, functional example with multiple coherent PEs 


The broadcasting of cache maintenance instructions, and the use of DMB instructions to ensure their observability, 
means that the previous example extends naturally to a multiprocessor system. Typically this requires a transfer of 
ownership of the region that the external observer is updating. 


(Use data from [R1], potentially using [R1] as scratch space) 


PO 
DMB 
STR RO, [R2] ; 
WAIT ([R2] == 0) ; 
DMB 
LDR R5, [R1] 


P1 


WAIT ([R2] = 1) 


DCIMVAC R1 ; 
DMB 

STR RO, [R3] ; 
WAIT ([R4] = 1) : 
DMB 

DCIMVAC R1 ; 
DMB 

MOV RO, #0 

STR RO, [R2] ; 


El 


WAIT ([R3] == 1) 


STR R5, [R1] ; 
DMB [ST] 
STR RO, [R4] ; 


signals release of [R1] 
waits for new value from DMA 


waits for release of [R1] by PQ 
ensures caches are not dirty, invalidate is sufficient 


requests new data for [R1] 
waits for new data 


ensures caches discard stale copies before use 


signals availability of new [R1] 


waits for new data request 
sends new [R1] 


indicates new data available to P1 


In this example, the result PO:R5 == 0x55 is required. The DMB issued by P1 after the first data cache invalidation 
ensures that effect of the cache invalidation on PO is seen by E1 before the store by E1 to [R1]. The DMB issued by 
P1 after the second data cache invalidation ensures that its effects are seen before the store of 0 to the semaphore 


location in [R2]. 
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Instruction cache maintenance instructions 


The following sections describe the use of barriers with instruction cache maintenance instructions: 
. Ensuring the visibility of updates to instructions for a uniprocessor. 


. Ensuring the visibility of updates to instructions for a multiprocessor. 


Ensuring the visibility of updates to instructions for a uniprocessor 


On a single PE, the agent that causes instruction fetches, or instruction cache linefills, is a separate memory system 
observer from the agent that causes data accesses. Therefore, any operations to invalidate the instruction cache can 
rely only on seeing updates to memory that are complete. This must be ensured by the use of a DSB instruction. 


Also, instruction cache maintenance instructions are only guaranteed to complete after the execution of a DSB, and 
an ISB is required to discard any instructions that might have been prefetched before the instruction cache 
invalidation completed. Therefore, on a uniprocessor, to ensure the visibility of an update to code and to branch to 
it, the following sequence is required: 


P1 


STR R11, [R1] R11 contains a new instruction to store in program memory 


DCCMVAU R1 ; clean to PoU makes new instructions visible to instruction cache 
DSB 

ICIMVAU R1 ; ensures instruction cache and branch predictor discard stale data 
BPIMVA R1 

DSB ; ensures completion of the invalidation 

ISB ; ensures instruction fetch path observes new instruction cache state 
BX R1 


Ensuring the visibility of updates to instructions for a multiprocessor 


Armv8, and an Armv7 implementation that includes the Multiprocessing Extensions, requires a PE that executes an 
instruction cache maintenance instruction to execute a DSB instruction to ensure completion of the maintenance 
operation. This ensures that the cache maintenance instruction is complete on all PEs in the Inner Shareable 
shareability domain. 


An ISB is not broadcast, and so does not affect other PEs. This means that any other PE must perform its own ISB 
synchronization after it knows that the update is visible, if it is necessary to ensure its synchronization with the 
update. The following example shows how this might be done: 


P1 
STR R11, [R1] ; R11 contains a new instruction to store in program memory 
DCCMVAU R1 ; clean to PoU makes new instructions visible to instruction cache 
DSB ; ensures completion of the clean on all processors 
ICIMVAU R1 ; ensures instruction cache/branch predictor discards stale data 
BPIMVA R1 
DSB ; ensures completion of the instruction cache and branch predictor 

; invalidation on all PEs 

STR RO, [R2] ; sets flag to signal completion 
ISB ; synchronizes context on this PE 
BX R1 ; branches to new code 

P2-Px 


WAIT ([R2] == 1) 
ISB 
BX R1 


waits for flag signaling completion 
synchronizes context on this processor 
branches to new code 


Nonfunctional approach 


The following sequence does not have the same effect, because a DSB is not required to complete the instruction 
cache maintenance instructions that other PEs issue: 


Pl 
STR R11, [R1] ; R11 contains a new instruction to store in program memory 
DCCMVAU R1 ; clean to PoU makes new instructions visible to instruction cache 
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DSB ; ensure completion of the clean on all PEs 

ICIMVAU R1 ; ensure instruction cache/branch predictor discards stale data 

BPIMVA R1 

DMB ; ensure ordering of the store after the invalidation 
; DOES NOT guarantee completion of instruction cache/branch 
; predictor on other PEs 

STR RO, [R2] ; sets flag to signal completion 

DSB ; ensures completion of the invalidation on all PEs 

ISB ; synchronizes context on this PE 

BX R1 ; branches to new code 

P2-Px 


WAIT ([R2] == 1) 
DSB 

ISB 

BX R1 


waits for flag signaling completion 
this DSB does not guarantee completion of P1's ICIMVAU/BPIMVA 


In this example, P2...Px might not see the updated region of code at R1. 


TLB maintenance instructions and barriers 


The following sections describe the use of barriers with TLB maintenance instructions: 

. Ensuring the visibility of updates to translation tables for a uniprocessor. 

. Ensuring the visibility of updates to translation tables for a multiprocessor on page K11-7776. 
e Paging memory in and out on page K11-7776. 


Ensuring the visibility of updates to translation tables for a uniprocessor 


On a single PE, the agent that causes translation table walks is a separate memory system observer from the agent 
that causes data accesses. Therefore, any operations to invalidate the TLB can only rely on seeing updates to 
memory that are complete. This must be ensured by the use of a DSB instruction. 


In the Armv8 architecture, and in an Armv7 implementation that includes the Multiprocessing Extensions, 
translation table walks must look in the data or unified caches at L1, so such systems do not require data cache 
cleaning. 


After the translation tables update, any old copies of entries that might be held in the TLBs must be invalidated. This 
operation is only guaranteed to affect all instructions, including instruction fetches and data accesses, after the 
execution of a DSB and an ISB. Therefore, the code for updating a translation table entry is: 


P1 


STR R11, [R1] updates the translation table entry 


DSB ; ensures visibility of the update to translation table walks 
TLBIMVA R10 

BPIALL 

DSB ; ensures completion of the BP and TLB invalidation 


ISB ; synchronizes context on this PE 


; new translation table entry can be relied upon at this point and all accesses 
; generated by this observer using the old mapping have been completed 


Importantly, by the end of this sequence, all accesses that used the old translation table mappings have been 
observed by all observers. 


An example of this is where a translation table entry is marked as invalid. Such a system must provide a mechanism 
to ensure that any access to a region of memory being marked as invalid has completed before any action is taken 
as a result of the region being marked as invalid. 
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Ensuring the visibility of updates to translation tables for a multiprocessor 


The same code sequence can be used in a multiprocessing system. In the Armv8 architecture, and in an Armv7 
implementation that includes the Multiprocessing Extensions, a PE that executes a TLB maintenance instruction 
must execute a DSB instruction to ensure completion of the maintenance operation. This ensures that the TLB 
maintenance instruction is complete on all PEs in the Inner Shareable shareability domain. 


The completion of a DSB that completes a TLB maintenance instruction ensures that all accesses that used the old 
mapping have completed. 


Pl 
STR R11, [R1] ; updates the translation table entry 
DSB ; ensures visibility of the update to translation table walks 
TLBIMVAIS R10 
BPIALLIS 
DSB ; ensures completion of the BP and TLB invalidation 


ISB ; Note ISB is not broadcast and must be executed locally on other PEs 


; new translation table entry can be relied upon at this point and all accesses generated by any 
; observers affected by the broadcast TLBIMVAIS operation using the old mapping have completed 


The completion of the TLB maintenance instruction is guaranteed only by the execution of a DSB by the observer 
that performed the TLB maintenance instruction. The execution of a DSB by a different observer does not have this 
effect, even if the DSB is known to be executed after the TLB maintenance instruction is observed by that different 
observer. 


Paging memory in and out 


In a multiprocessor system there is a requirement to ensure the visibility of translation table updates when paging 
regions of memory into RAM from a backing store. This might, or might not, also involve paging existing locations 
in memory from RAM to a backing store. In such situations, the operating system selects one or more pages of 
memory that might be in use but are suitable to discard, with or without copying to a backing store, depending on 
whether or not the region of memory is writable. Disabling the translation table mappings for a page, and ensuring 
the visibility of that update to the translation tables, prevents agents accessing the page. 


For this reason, it is important that the DSB that is performed after the TLB invalidation ensures that no other updates 
to memory using those mappings are possible. 


An example sequence for the paging out of an updated region of memory, and the subsequent paging in of memory, 
is as follows: 


Pl 
STR R11, [R1] ; updates the translation table for the region being paged out 
DSB ; ensures visibility of the update to translation table walks 
TLBIMVAIS R10 ; invalidates the old entry 
DSB ; ensures completion of the invalidation on all processors 
ISB ; ensures visibility of the invalidation 


BL SaveMemoryPageToBackingStore 
BL LoadMemoryFromBackingStore 


DSB ; ensures completion of the memory transfer (this could be part of 
; LoadMemoryFromBackingStore 

ICIALLUIS ; also invalidates the branch predictor 

DSB ; ensures completion of the instruction cache 
; and branch predictor invalidation 

STR R9, [R1] ; creates a new translation table entry with a new mapping 

DSB ; ensures visibility of the new translation table mapping 

ISB ; ensures synchronization of this instruction stream 


This example assumes the memory copies are performed by an observer that is coherent with the caches of PE P1. 
This observer might be P1 itself, using a specific paging mapping. For clarity, the example omits the functional 
descriptions of SaveMemoryPageToBackingStore and LoadMemoryFromBackingStore. LoadMemoryFromBackingStore is 
required to ensure that the memory updates that it makes are visible to instruction fetches. 
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In this example, the use of ICIALLUIS to invalidate the entire instruction cache is a simplification, that might not 
be optimal for performance. An alternative approach involves invalidating all of the lines in the caches using 
ICIMVAU operations. This invalidation must be done when the mapping used for the ICIMVAU operations is valid 
but not executable. 
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Appendix K12 
Random Number Generation 


This appendix provides further information on the generation of random numbers using ARMv8.5-RNG. It contains 
the following sections: 


. Properties of the generated random number on page K12-7780. 
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Properties of the generated random number 


When ARMv8.5-RNG is implemented, reads to the RNDR and RNDRRS registers return a 64-bit random number. 
The random numbers must meet the properties and conform to the standards that are detailed in this section. 


The output random number is from a Deterministic Random Bit Generator (DRBG), which is seeded from a True 
Random Number Generator (TRNG). 


The TRNG provides entropy in the form of random numbers, from the sampled output of an unpredictable physical 
process. 


The TRNG should conform to: 

. The NIST SP800-90B standard. 
. The NIST SP800-22 standard. 

° The FIPS 140-2 standard. 

° The BSI AIS-31 standard. 


The DRBG produces random numbers from a cryptographically secure algorithm. 
The DRBG is seeded from the TRNG. 
The DRBG algorithm should conform to the NIST SP800-90A Rev 1 standard. 


The DRBG is reseeded after an IMPLEMENTATION DEFINED number of random numbers has been generated and read 
using the RNDR register. 


The DRBG is reseeded immediately before the random number is generated and read using the RNDRRS register. 
The entire random number generation should conform to the NIST SP800-90C standard. 


Note 


Since a TRNG can only generate random bits at a limited rate, the random number bits are commonly collected in 
an “entropy pool” until needed. An implementation should ensure that lower privileged software cannot impact the 
performance of higher privileged software by entirely draining this “entropy pool”. The refill time cost of the 
“entropy pool” should be paid for by the persistent caller. 








Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 
Non-Confidential ID070919 


Appendix K13 
Arm Pseudocode Definition 


This appendix provides a definition of the pseudocode that is used in this manual, and defines some helper 
procedures and functions that are used by pseudocode. It contains the following sections: 


About the Arm pseudocode on page K13-7782. 

Pseudocode for instruction descriptions on page K13-7783. 

Data types on page K13-7785. 

Operators on page K13-7790. 

Statements and control structures on page K13-7796. 

Built-in functions on page K13-7801. 

Miscellaneous helper procedures and functions on page K13-7804. 
Arm pseudocode definition index on page K13-7806. 


Note 





This appendix is not a formal language definition for the pseudocode. It is a guide to help understand the use of Arm 
pseudocode. This appendix is not complete. Changes are planned for future releases. 
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K13.1 


K13.1.1 


K13-7782 


About the Arm pseudocode 


The Arm pseudocode provides precise descriptions of some areas of the Arm architecture. This includes description 
of the decoding and operation of all valid instructions. Pseudocode for instruction descriptions on page K13-7783 
gives general information about this instruction pseudocode, including its limitations. 


The following sections describe the Arm pseudocode in detail: 
° Data types on page K13-7785. 

. Operators on page K13-7790. 

° Statements and control structures on page K13-7796. 


Built-in functions on page K 13-7801 and Miscellaneous helper procedures and functions on page K13-7804 
describe some built-in functions and pseudocode helper functions that are used by the pseudocode functions that are 
described elsewhere in this manual. Arm pseudocode definition index on page K 13-7806 contains the indexes to the 
pseudocode. 


General limitations of Arm pseudocode 


The pseudocode statements IMPLEMENTATION_DEFINED, SEE, UNDEFINED, and UNPREDICTABLE indicate behavior that 
differs from that indicated by the pseudocode being executed. If one of them is encountered: 


. Earlier behavior indicated by the pseudocode is only specified as occurring to the extent required to 
determine that the statement is executed. 


° No subsequent behavior indicated by the pseudocode occurs. 


For more information, see Special statements on page K13-7800. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


Arm Pseudocode Definition 
K13.2 Pseudocode for instruction descriptions 


K13.2 Pseudocode for instruction descriptions 


Each instruction description includes pseudocode that provides a precise description of what the instruction does, 
subject to the limitations described in General limitations of Arm pseudocode on page K13-7782 and Limitations of 
the instruction pseudocode on page K13-7784. 


In the instruction pseudocode, instruction fields are referred to by the names shown in the encoding diagram for the 
instruction. /nstruction encoding diagrams and instruction pseudocode gives more information about the 
pseudocode provided for each instruction. 


K13.2.1 Instruction encoding diagrams and instruction pseudocode 


Instruction descriptions in this manual contain: 


° An Encoding section, containing one or more encoding diagrams, each followed by some encoding-specific 
pseudocode that translates the fields of the encoding into inputs for the common pseudocode of the 
instruction, and picks out any encoding-specific special cases. 


. An Operation section, containing common pseudocode that applies to all of the encodings being described. 
The Operation section pseudocode contains a call to the EncodingSpecificOperations() function, either at its 
start or only after a condition code check performed by if ConditionPassed() then. 


An encoding diagram specifies each bit of the instruction as one of the following: 


$ An obligatory 0 or 1, represented in the diagram as 0 or 1. If this bit does not have this value, the encoding 
corresponds to a different instruction. 


- A should be 0 or 1, represented in the diagram as (0) or (1). If this bit does not have this value, the instruction 
is CONSTRAINED UNPREDICTABLE. For more information, see SBZ or SBO fields T32 and A32 in instructions 
on page K1-7610. 


$ A named single bit or a bit in a named multi-bit field. The cond field in bits[31:28] of many A32/T32 
instructions has some special rules associated with it. 


An encoding diagram matches an instruction if all obligatory bits are identical in the encoding diagram and the 
instruction, and one of the following is true: 


$ The encoding diagram is not for an A32/T32 instruction. 
: The encoding diagram is for an A32/T32 instruction that does not have a cond field in bits[3 1:28]. 


s The encoding diagram is for an A32/T32 instruction that has a cond field in bits[31:28], and bits[31:28] of 
the instruction are not 0b1111. 


In the context of the instruction pseudocode, the execution model for an instruction is: 


l. Find all encoding diagrams that match the instruction. It is possible that no encoding diagram matches. In 
that case, abandon this execution model and consult the relevant instruction set chapter instead to find out 
how the instruction is to be treated. The bit pattern of such an instruction is usually reserved and UNDEFINED, 
though there are some other possibilities. For example, unallocated hint instructions are documented as being 
reserved and executed as NOPs. 


2; If the operation pseudocode for the matching encoding diagrams starts with a condition code check, perform 
that check. If the condition code check fails, abandon this execution model and treat the instruction as a NOP. 
If there are multiple matching encoding diagrams, either all or none of their corresponding pieces of common 
pseudocode start with a condition code check. 


3. Perform the encoding-specific pseudocode for each of the matching encoding diagrams independently and in 
parallel. Each such piece of encoding-specific pseudocode starts with a bitstring variable for each named bit 
or multi-bit field in its corresponding encoding diagram, named the same as the bit or multi-bit field and 
initialized with the values of the corresponding bit or bits from the bit pattern of the instruction. 
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In a few cases, the encoding diagram contains more than one bit or field with same name. In these cases, the 
values of the different instances of those bits or fields must be identical. The encoding-specific pseudocode 
contains a special case using the Consistent() function to specify what happens if they are not identical. 
Consistent() returns TRUE if all instruction bits or fields with the same name as its argument have the same 
value, and FALSE otherwise. 


If there are multiple matching encoding diagrams, all but one of the corresponding pieces of pseudocode must 
contain a special case that indicates that it does not apply. Discard the results of all such pieces of pseudocode 
and their corresponding encoding diagrams. 


There is now one remaining piece of pseudocode and its corresponding encoding diagram left to consider. 
This pseudocode might also contain a special case, most commonly one indicating that it is CONSTRAINED 
UNPREDICTABLE. If so, abandon this execution model and treat the instruction according to the special case. 


Check the should be bits of the encoding diagram against the corresponding bits of the bit pattern of the 
instruction. If any of them do not match, abandon this execution model and treat the instruction as 
CONSTRAINED UNPREDICTABLE, see SBZ or SBO fields T32 and A32 in instructions on page K1-7610. 


Perform the rest of the operation pseudocode for the instruction description that contains the encoding 
diagram. That pseudocode starts with all variables set to the values they were left with by the 
encoding-specific pseudocode. 


The ConditionPassed() call in the common pseudocode, if present, performs step 2, and the 
EncodingSpecificOperations() call performs steps 3 and 4. 


K13.2.2 Limitations of the instruction pseudocode 


The pseudocode descriptions of instruction functionality have a number of limitations. These are mainly due to the 
fact that, for clarity and brevity, the pseudocode is a sequential and mostly deterministic language. 


These limitations include: 


K13-7784 


Pseudocode does not describe the ordering requirements when an instruction generates multiple memory 
accesses. For a description of the ordering requirements on memory accesses see Ordering constraints on 
page E2-3818. 


Pseudocode does not describe the exact rules when an UNDEFINED instruction fails its condition code check. 
In such cases, the UNDEFINED pseudocode statement lies inside the if ConditionPassed() then ... structure, 
either directly or in the EncodingSpecificOperations() function call, and so the pseudocode indicates that the 
instruction executes as a NOP. Conditional execution of undefined instructions on page G1-5538 describes 
the exact rules. 


Pseudocode does not describe the exact ordering requirements when a single floating-point instruction 
generates more than one floating-point exception and one or more of those floating-point exceptions is 
trapped. Combinations of floating-point exceptions on page E1-3798 describes the exact rules. 





Note 


There is no limitation in the case where all the floating-point exceptions are untrapped, because the 
pseudocode specifies the same behavior as the cross-referenced section. 





An exception can be taken during execution of the pseudocode for an instruction, either explicitly as a result 
of the execution of a pseudocode function such as Abort(), or implicitly, for example if an interrupt is taken 
during execution of an LDM instruction. If this happens, the pseudocode does not describe the extent to which 
the normal behavior of the instruction occurs. To determine that, see the descriptions of the exceptions in 
Handling exceptions that are taken to an Exception level using AArch32 on page G1-5501. 
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K13.3 Datatypes 


This section describes: 

$ General data type rules. 

° Bitstrings. 

° Integers on page K13-7786. 

è Reals on page K13-7786. 

e Booleans on page K13-7786. 

. Enumerations on page K13-7787. 
7 Structures on page K13-7787. 

s Tuples on page K13-7788. 

. Arrays on page K13-7789. 


K13.3.1 General data type rules 


Arm architecture pseudocode is a strongly typed language. Every literal and variable is of one of the following 
types: 


` Bitstring. 

7 Integer. 

G Boolean. 

7 Real. 

. Enumeration. 
s Tuple. 

7 Struct. 

e Array. 


The type ofa literal is determined by its syntax. A variable can be assigned to without an explicit declaration. The 
variable implicitly has the type of the assigned value. For example, the following assignments implicitly declare the 
variables x, y and z to have types integer, bitstring of length 1, and Boolean, respectively. 


x= 1 
y='1'; 
z = TRUE; 


Variables can also have their types declared explicitly by preceding the variable name with the name of the type. 
The following example declares explicitly that a variable named count is an integer. 


integer count; 
This is most often done in function definitions for the arguments and the result of the function. 


The remaining subsections describe each data type in more detail. 


K13.3.2 Bitstrings 
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This section describes the bitstring data type. 


Syntax 

bits(N) The type name of a bitstring of length N. 
bit A synonym of bits(1). 

Description 


A bitstring is a finite-length string of Os and 1s. Each length of bitstring is a different type. The minimum permitted 
length of a bitstring is 0. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K13-7785 
Non-Confidential 


Arm Pseudocode Definition 


K13.3 Data types 


Bitstring constants literals are written as a single quotation mark, followed by the string of Os and 1s, followed by 
another single quotation mark. For example, the two constants literals of type bit are '@' and '1'. Spaces can be 
included in bitstrings for clarity. 


The bits in a bitstring are numbered from left to right N-1 to 0. This numbering is used when accessing the bitstring 
using bitslices. In conversions to and from integers, bit N-1 is the MSByte and bit 0 is the LSByte. This order 
matches the order in which bitstrings derived from encoding diagrams are printed. 


Every bitstring value has a left-to-right order, with the bits being numbered in standard little-endian order. That is, 
the leftmost bit of a bitstring of length N is bit (V—1) and its right-most bit is bit 0. This order is used as the 
most-significant-to-least-significant bit order in conversions to and from integers. For bitstring constants and 
bitstrings that are derived from encoding diagrams, this order matches the way that they are printed. 


Bitstrings are the only concrete data type in pseudocode, corresponding directly to the contents values that are 
manipulated in registers, memory locations, and instructions. All other data types are abstract. 


K13.3.3 Integers 


This section describes the data type for integer numbers. 


Syntax 


integer The type name for the integer data type. 


Description 


Pseudocode integers are unbounded in size and can be either positive or negative. That is, they are mathematical 
integers rather than what computer languages and architectures commonly call integers. Computer integers are 
represented in pseudocode as bitstrings of the appropriate length, and the pseudocode provides functions to interpret 
those bitstrings as integers. 


Integer literals are normally written in decimal form, such as 0, 15, -1234. They can also be written in C-style 
hexadecimal form, such as 0x55 or 0x8@000000. Hexadecimal integer literals are treated as positive unless they have 
a preceding minus sign. For example, 0x80000000 is the integer +231. If -231 needs to be written in hexadecimal, it 
must be written as -0x80000000. 


K13.3.4 Reals 


This section describes the data type for real numbers. 


Syntax 


real The type name for the real data type. 


Description 


Pseudocode reals are unbounded in size and precision. That is, they are mathematical real numbers, not computer 
floating-point numbers. Computer floating-point numbers are represented in pseudocode as bitstrings of the 
appropriate length, and the pseudocode provides functions to interpret those bitstrings as reals. 


Real constant literals are written in decimal form with a decimal point. This means @ is an integer constant literal, 
but 0.0 is a real constant literal. 


K13.3.5 Booleans 


K13-7786 


This section describes the Boolean data type. 


Syntax 


boolean The type name for the Boolean data type. 
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TRUE The two values a Boolean variable can take. 


Description 


A Boolean is a logical TRUE or FALSE value. 





Note 


This is not the same type as bit, which is a bitstring of length 1. A Boolean can only take on one of two values: TRUE 
or FALSE. 





K13.3.6 Enumerations 


This section describes the enumeration data type. 


Syntax and examples 
enumeration Keyword to defined a new enumeration type. 


enumeration Example {Example_One, Example_Two, Example_Three}; 


A definition of a new enumeration called Example, which can take on the values Examp1e_One, 
Examp1e_Two, Example_Three. 


Description 
An enumeration is a defined set of named values. 
An enumeration must contain at least one named value. A named value must not be shared between enumerations. 


Enumerations must be defined explicitly, although a variable of an enumeration type can be declared implicitly by 
assigning one of the named values to it. By convention, each named value starts with the name of the enumeration 
followed by an underscore. The name of the enumeration is its type name, or type, and the named values are its 
possible values. 


K13.3.7 Structures 
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This section describes the structure data type. 


Syntax and examples 
type The keyword used to declare the structure data type. 


type ShiftSpec is (bits(2) shift, integer amount) 


An example definition for a new structure called ShiftSpec that contains an bitstring member called 
shift and a integer member named amount. Structure definitions must not be terminated with a 
semicolon. 


ShiftSpec abc; 


A declaration of a variable named abc of type ShiftSpec. 


abc. shift 


Syntax to refer to the individual members within the structure variable. 


Description 


A structure is a compound data type composed of one or more data items. The data items can be of different data 
types. This can include compound data types. The data items of a structure are called its members and are named. 
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In the syntax section, the example defines a structure called Shi ftSpec with two members. The first is a bitstring of 
length 2 named shift and the second is an integer named amount. After declaring a variable of that type named abc, 
the members of this structure are referred to as abc. shift and abc. amount. 


Every definition of a structure creates a different type, even if the number and type of their members are identical. 
For example: 


type ShiftSpecl is (bits(2) shift, integer amount) 
type ShiftSpec2 is (bits(2) shift, integer amount) 


ShiftSpecl and ShiftSpec2 are two different types despite having identical definitions. This means that the value in 
a variable of type ShiftSpecl cannot be assigned to variable of type Shi ftSpec2. 


K13.3.8 Tuples 


K13-7788 


This section describes the tuple data type. 


Examples 


(bits(32) shifter_result, bit shifter_carry_out) 


An example of the tuple syntax. 


(shift_t, shift_n) = ('00', 0); 


An example of assigning values to a tuple. 


Description 


A tuple is an ordered set of data items, separated by commas and enclosed in parentheses. The items can be of 
different types and a tuple must contain at least one data item. 


Tuples are often used as the return type for functions that return multiple results. For example, in the syntax section, 
the example tuple is the return type of the function Shift_C(), which performs a standard A32/T32 shift or rotation. 
Its return type is a tuple containing two data items, with the first of type bits(32) and the second of type bit. 


Each tuple is a separate compound data type. The compound data type is represented as a comma-separated list of 
ordered data types between parentheses. This means that the example tuple at the start of this section is of type 
(bits(32), bit). The general principle that types can be implied by an assignment extends to implying the type of 
the elements in the tuple. For example, in the syntax section, the example assignment implicitly declares: 

° shift_t to be of type bits(2). 

. shift_n to be of type integer. 


. (shift_t, shift_n) to be a tuple of type (bits(2), integer). 
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K13.3.9 Arrays 
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This section describes the array data type. 


Syntax 
array The type name for the array data type. 


array data_type array_name[A. .B]; 


Declaration of an array of type data_type, which might be compound data type. It is named 
array_name and is indexed with an integer range from A to B. 


Description 


An array is an ordered set of fixed size containing items of a single data type. This can include compound data types. 
Pseudocode arrays are indexed by either enumerations or integer ranges. An integer range is represented by the 
lower inclusive end of the range, then .., then the upper inclusive end of the range. 


For example: 
The following example declares an array of 31 bitstrings of length 64, indexed from 0 to 30. 
array bits(64) _R[Q..30]; 


Arrays are always explicitly declared, and there is no notation for a constant literal array. Arrays always contain at 
least one element data item, because: 


è Enumerations always contain at least one symbolic constant named value. 


è Integer ranges always contain at least one integer. 


An array declared with an enumeration type as the index must be accessed using enumeration values of that 
enumeration type. An array declared with an integer range type as the index must be accessed using integer values 
from that inclusive range. Accessing such an array with an integer value outside of the range is a coding error. 


Arrays do not usually appear directly in pseudocode. The items that syntactically look like arrays in pseudocode are 
usually array-like functions such as R[i], MemU[address, size] or Elem[vector, i, size]. These functions package 
up and abstract additional operations normally performed on accesses to the underlying arrays, such as register 
banking, memory protection, endian-dependent byte ordering, exclusive-access housekeeping and Advanced SIMD 
element processing. See Function and procedure calls on page K13-7796. 
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K13.4 Operators 


This section describes: 

. Relational operators. 

. Boolean operators. 

e Bitstring operators on page K13-7791. 

e Arithmetic operators on page K13-7791. 

e The assignment operator on page K13-7792. 
. Precedence rules on page K13-7794. 

è Conditional expressions on page K13-7794. 
. Operator polymorphism on page K13-7794. 


K13.4.1 Relational operators 


The following operations yield results of type boolean. 


Equality and non-equality 


If two variables x and y are of the same type, their values can be tested for equality by using the expression x == y 
and for non-equality by using the expression x != y. In both cases, the result is of type boolean. 


Both x and y must be of type bits(N), real, enumeration, boolean, or integer. Named values from an enumeration 
can only be compared if they are both from the same enumeration. An exception is that a bitstring can be tested for 
equality with an integer to allow a d==15 test. 


A special form of comparison is defined with a bitstring literal that can contain bit values '0', '1', and 'x'. Any bit 

with value 'x' is ignored in determining the result of the comparison. For example, if opcode is a 4-bit bitstring, the 

expression opcode == '1x0x' matches the values ‘1000’, ‘1100’, ‘1001’, and ‘1101’. This is known as a bitmask. 
Note 


This special form is permitted in the implied equality comparisons in the when parts of case .. of ... structures. 








Comparisons 

If x and y are integers or reals, then x < y, x <= y, x > y, and x >= y are less than, less than or equal, greater than, 
and greater than or equal comparisons between them, producing Boolean results. 

Set membership with IN 


<expression> IN {<set>} produces TRUE if <expression> is a member of <set>. Otherwise, it is FALSE. <set> must be 
a list of expressions separated by commas. 


K13.4.2 Boolean operators 


K13-7790 


If x is a Boolean expression, then !x is its logical inverse. 


If x and y are Boolean expressions, then x && y is the result of ANDing them together. As in the C language, if x is 
FALSE, the result is determined to be FALSE without evaluating y. 





Note 


This is known as short circuit evaluation. 





If x and y are booleans, then x || y is the result of ORing them together. As in the C language, if x is TRUE, the result 
is determined to be TRUE without evaluating y. 
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Note 


If x and y are booleans or Boolean expressions, then the result of x != y is the same as the result of exclusive-ORing 
x and y together. The operator EOR only accepts bitstring arguments. 


K13.4.3 Bitstring operators 


The following operations can be applied only to bitstrings. 


Logical operations on bitstrings 
If x is a bitstring, NOT(x) is the bitstring of the same length obtained by logically inverting every bit of x. 


If x and y are bitstrings of the same length, x AND y, x OR y, and x EOR y are the bitstrings of that same length obtained 
by logically ANDing, logically ORing, and exclusive-ORing corresponding bits of x and y together. 


Bitstring concatenation and slicing 


If x and y are bitstrings of lengths N and M respectively, then x:y is the bitstring of length N+M constructed by 
concatenating x and y in left-to-right order. 


The bitstring slicing operator addresses specific bits in a bitstring. This can be used to create a new bitstring from 
extracted bits or to set the value of specific bits. Its syntax is x<integer_list>, where x is the integer or bitstring 
being sliced, and <integer_list> is a comma-separated list of integers enclosed in angle brackets. The length of the 
resulting bitstring is equal to the number of integers in <integer_list>. In x<integer_list>, each of the integers in 
<integer_list> must be: 

s >= 0. 


. < Len(x) if x is a bitstring. 


The definition of x<integer_list> depends on whether integer_list contains more than one integer: 


. If integer_list contains more than one integer, x<i, j, k,.., n> is defined to be the concatenation: 
X<i> 1 X<j> : x<k> : .. ı X<Nn>. 
. If integer_list consists of just one integer i, x<i> is defined to be: 


—  Ifxisa bitstring, '0' if bit i of x is a zero and '1' if bit i of x is a one. 


—  Ifx isan integer, and y is the unique integer in the range 0 to 2A(i+1)-1 that is congruent to x modulo 
2A(i+1). Then x<i> is '0' ify < 2^i and '1' ify >= 2Ai. 
Loosely, this definition treats an integer as equivalent to a sufficiently long two’s complement 
representation of it as a bitstring. 


The notation for a range expression is 1:j with i >= j is shorthand for the integers in order from i down to j, with 
both end values included. For example, instr<31:28> represents instr<31, 30, 29, 28>. 


x<integer_list> is assignable provided x is an assignable bitstring and no integer appears more than once in 
<integer_list>. In particular, x<i> is assignable if x is an assignable bitstring and @ <= i < Len(x). 


Encoding diagrams for registers frequently show named bits or multi-bit fields. For example, the encoding diagram 
for the APSR shows its bit<31> as N. In such cases, the syntax APSR.N is used as a more readable synonym for 
APSR<31> as named bits can be referred to with the same syntax as referring to members of a struct. A 
comma-separated list of named bits enclosed in angle brackets following the register name allows multiple bits to 
be addressed simultaneously. For example, APSR.<N, C, Q> is synonymous with APSR <31, 29, 27>. 


K13.4.4 Arithmetic operators 


Most pseudocode arithmetic is performed on integer or real values, with operands obtained by conversions from 
bitstrings and results converted back to bitstrings. As these data types are the unbounded mathematical types, no 
issues arise about overflow or similar errors. 


ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K13-7791 
ID070919 Non-Confidential 


Arm Pseudocode Definition 


K13.4 Operators 


Unary plus and minus 


If x is an integer or real, then +x is x unchanged, -x is x with its sign reversed. Both are of the same type as x. 


Addition and subtraction 


If x and y are integers or reals, x+y and x-y are their sum and difference. Both are of type integer if x and y are both 
of type integer, and real otherwise. 


There are two cases where the types of x and y can be different. A bitstring and an integer can be added together to 
allow the operation PC + 4. An integer can be subtracted from a bitstring to allow the operation PC - 2. 


If x and y are bitstrings of the same length N, so that N = Len(x) = Len(y), then x+y and x-y are the least significant 
N bits of the results of converting x and y to integers and adding or subtracting them. Signed and unsigned 
conversions produce the same result: 


x+y = (SInt(x) + SInt(y))<N-1:0> 
(UInt(x) + UInt(y))<N-1:0> 
(SInt(x) - SInt(y))<N-1:0> 
= (UInt(x) - UInt(y))<N-1:0> 


x-y 


If xis a bitstring of length N and y is an integer, x+y and x-y are the bitstrings of length N defined by x+y = x + y<N-1:0> 
and x-y = x - y<N-1:0>. Similarly, if x is an integer and y is a bitstring of length M, x+y and x-y are the bitstrings of 
length M defined by x+y = x<M-1:0> + y and x-y = x<M-1:@ - y. 

Multiplication 


If x and y are integers or reals, then x » y is the product of x and y. It is of type integer if x and y are both of type 
integer, and real otherwise. 


Division and modulo 
If x and y are reals, then x/y is the result of dividing x by y, and is always of type real. 
If x and y are integers, then x DIV y and x MOD y are defined by: 


x DIV y = RoundDown(x/y) 
x MOD y =x - y » (x DIV y) 


It is a pseudocode error to use any of x/y, x MOD y, or x DIV y in any context where y can be zero. 


Scaling 

If x and n are of type integer, then: 

. x << n = RoundDown(x » 2An). 

. x >> n = RoundDown(x « 2A(-n)). 


Raising to a power 


If x is an integer or a real and n is an integer then xAn is the result of raising x to the power of n, and: 
° If x is of type integer then x^n is of type integer. 
° If x is of type real then x^n is of type real. 


K13.4.5 The assignment operator 


K13-7792 


The assignment operator is the = character, which assigns the value of the right-hand side to the left-hand side. An 
assignment statement takes the form: 


<assignable_expression> = <expression>; 


This following subsection defines valid expression syntax. 
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General expression syntax 


An expression is one of the following: 


. A literal. 

° A variable, optionally preceded by a data type name to declare its type. 
. The word UNKNOWN preceded by a data type name to declare its type. 

° The result of applying a language-defined operator to other expressions. 
° The result of applying a function to other expressions. 


Variable names normally consist of alphanumeric and underscore characters, starting with an alphabetic or 
underscore character. 


Each register defined in an Arm architecture specification defines a correspondingly named pseudocode bitstring 
variable, and that variable has the stated behavior of the register. For example, if a bit of a register is defined as 
RAZ/WI, then the corresponding bit of its variable reads as '0' and ignore writes. 


An expression like bits(32) UNKNOWN indicates that the result of the expression is a value of the given type, but the 
architecture does not specify what value it is and software must not rely on such values. The value produced must 
not: 


° Return information that cannot be accessed at the current or a lower level of privilege using instructions that 
are not UNPREDICTABLE or CONSTRAINED UNPREDICTABLE and do not return UNKNOWN values, 


° Be promoted as providing any useful information to software. 





Note 


UNKNOWN values are similar to the definition of UNPREDICTABLE, but do not indicate that the entire architectural 
state becomes unspecified. 





Only the following expressions are assignable. This means that these are the only expressions that can be placed on 
the left-hand side of an assignment. 


. Variables. 


° The results of applying some operators to other expressions. 


The description of each language-defined operator that can generate an assignable expression specifies the 
circumstances under which it does so. For example, those circumstances might require that one or more of 
the expressions the operator operates on is an assignable expression. 


° The results of applying array-like functions to other expressions. The description of an array-like function 
specifies the circumstances under which it can generate an assignable expression. 


Note 


If the right-hand side in an assignment is a function returning a tuple, an item in the assignment destination can be 
written as - to indicate that the corresponding item of the assigned tuple value is discarded. For example: 





(shifted, -) = LSL_C(operand, amount); 
The expression on the right-hand side itself can be a tuple. For example: 


(x, y) = (function _1(), function_2()); 





Every expression has a data type. 
° For a literal, this data type is determined by the syntax of the literal. 


° For a variable, there are the following possible sources for the data type 
— An optional preceding data type name. 


— A data type the variable was given earlier in the pseudocode by recursive application of this rule. 
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— A data type the variable is being given by assignment, either by direct assignment to the variable, or 
by assignment to a list of which the variable is a member. 


It is a pseudocode error if none of these data type sources exists for a variable, or if more than one of them 
exists and they do not agree about the type. 


: For a language-defined operator, the definition of the operator determines the data type. 


° For a function, the definition of the function determines the data type. 


K13.4.6 Precedence rules 
The precedence rules for expressions are: 


1. Literals, variables and function invocations are evaluated with higher priority than any operators using their 
results, but see Boolean operators on page K13-7790. 


2. Operators on integers follow the normal operator precedence rules of exponentiation before multiply/divide 
before add/subtract, with sequences of multiply/divides or add/subtracts evaluated left-to-right. 


3. Other expressions must be parenthesized to indicate operator precedence if ambiguity is possible, but need 
not be ifall permitted precedence orders under the type rules necessarily lead to the same result. For example, 
if i, j and k are integer variables, i > @ && j > @ && k > 0 is acceptable, but i > 0 & j > @ || k > is not. 


K13.4.7 Conditional expressions 
If x and y are two values of the same type and t is a value of type boolean, then if t then x else y is an expression 
of the same type as x and y that produces x if t is TRUE and y if t is FALSE. 


K13.4.8 Operator polymorphism 


Operators in pseudocode can be polymorphic, with different functionality when applied to different data types. Each 
resulting form of an operator has a different prototype definition. For example, the operator + has forms that act on 
various combinations of integers, reals and bitstrings. 


Table K13-1 summarizes the operand types valid for each unary operator and the result type. Table K 13-2 on 
page K13-7795 summarizes the operand types valid for each binary operator and the result type. 


Table K13-1 Result and operand types permitted for unary operators 





Operator Operand Type Result Type 

















integer integer 
real real 
NOT bits(N) bits(N) 
boolean boolean 
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Table K13-2 Result and operand types permitted for binary operators 





Operator First operand type Second operand type Result type 






















































































integer 
bits(N) 
bits(N) 
integer integer 
== boolean 
real real 
enumeration enumeration 
boolean boolean 
bits(N) bits(N) 
l= integer integer boolean 
real real 
Ts integer integer 
‘ boolean 
S= as real real 
integer integer integer 
real real real 
+, - 
bits(N) 
bits(N) bits(N) 
integer 
<<, >> integer integer integer 
integer integer integer 
* real real real 
bits(N) bits(N) bits(N) 
/ real real real 
DIV integer integer integer 
integer integer 
MOD integer 
bits(N) integer 
&&, | | boolean boolean boolean 
AND, OR, EOR bits(N) bits(N) bits(N) 
integer integer integer 
A 
real integer real 
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K13.5 Statements and control structures 


This section describes the statements and program structures available in the pseudocode: 


s Statements and Indentation. 
s Function and procedure calls. 
° Conditional control structures on page K13-7798. 


° Loop control structures on page K13-7799. 
° Special statements on page K13-7800. 
° Comments on page K13-7800. 


K13.5.1 Statements and Indentation 


A simple statement is either an assignment, a function call, or a procedure call. Each statement must be terminated 
with a semicolon. 


Indentation normally indicates the structure in compound statements. The statements contained in structures such 
as if .. then .. else .. or procedure and function definitions are indented more deeply than the statement structure 
itself. The end of a compound statement structure and their end is indicated by returning to the original indentation 
level or less. 


Indentation is normally done by four spaces for each level. Standard indentation uses four spaces for each level of 
indent. 


K13.5.2 Function and procedure calls 


This section describes how functions and procedures are defined and called in the pseudocode. 
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Procedure and function definitions 
A procedure definition has the form: 


<procedure name>(<argument prototypes>) 
<statement 1>; 
<statement 2>; 


<statement n>; 


where <argument prototypes> consists of zero or more argument definitions, separated by commas. Each argument 
definition consists of a type name followed by the name of the argument. 


Note 


This first definition line is not terminated by a semicolon. This distinguishes it from a procedure call. 








A function definition is similar, but also declares the return type of the function: 
<return type> <function name>(<argument prototypes>) 

<statement 1>; 

<statement 2>; 


<statement n>; 





Note 


A function or procedure name can include a ".". This is a convention used for functions that have similar but 
different behaviors in AArch32 and AArch6é4 states. 





Atrray-like functions are similar, but are written with square brackets and have two forms. These two forms exist 
because reading from and writing to an array element require different functions. They are frequently used in 
memory operations. An array-like function definition with a return type is equivalent to reading from an array. For 
example: 


<return type> <function name>[<argument prototypes>] 

<statement 1>; 

<statement 2>; 

<statement n>; 
Its related function definition with no return type is equivalent to writing to an array. For example: 
<function name>[<argument prototypes>] = <value prototype> 

<statement 1>; 

<statement 2>; 


<statement n>; 


The value prototype determines what data type can be written to the array. The two related functions must share the 
same name, but the value prototype and return type can be different. 


Procedure calls 


A procedure call has the form: 


<procedure_name>(<arguments>) ; 


Return statements 
A procedure return has the form: 
return; 


A function return has the form: 
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return <expression>; 


where <expression> is of the type declared in the function prototype line. 


K13.5.3 Conditional control structures 


This section describes how conditional control structures are used in the pseudocode. 


if... then... else... 


In addition to being a ternary operator, a multi-line if .. then .. else .. structure can act as a control structure and 
has the form: 


if <boolean_expression> then 
<statement 1>; 
<statement 2>; 


<statement n>; 


elsif <boolean_expression> then 
<statement a>; 
<statement b>; 


<statement z>; 
else 

<statement A>; 

<statement B>; 


<statement Z>; 
The block of lines consisting of elsif and its indented statements is optional, and multiple elsif blocks can be used. 
The block of lines consisting of else and its indented statements is optional. 


Abbreviated one-line forms can be used when the then part, and in the else part if it is present, contain only simple 
statements such as: 


if <boolean_expression> then <statement 1>; 
if <boolean_expression> then <statement 1>; else <statement A>; 
if <boolean_expression> then <statement 1>; <statement 2>; else <statement A>; 





Note 


In these forms, <statement 1>, <statement 2> and <statement A> must be terminated by semicolons. This and the 
fact that the else part is optional distinguish its use as a control structure from its use as a ternary operator. 


case ... of... 
A case ... of ... structure has the form: 
case <expression> of 
when <literal values1> 
<statement 1>; 
<statement 2>; 
<statement n>; 
when <literal values2> 
<statement 1>; 
<statement 2>; 


<statement n>; 


.. more "when" groups if required .. 
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otherwise 
<statement A>; 
<statement B>; 


<statement Z>; 


In this structure, <literal values1> and <literal values2> consist of literal values of the same type as <expression>, 
separated by commas. There can be additional when groups in the structure. Abbreviated one line forms of when and 
otherwise parts can be used when they contain only simple statements. 


If <expression> has a bitstring type, the literal values can also include bitstring literals containing 'x' bits, known 
as bitmasks. For details see Equality and non-equality on page K13-7790. 


K13.5.4 Loop control structures 
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This section describes the three loop control structures used in the pseudocode. 


repeat ... until ... 
A repeat .. until .. structure has the form: 
repeat 


<statement 1>; 
<statement 2>; 


<statement n>; 
until <boolean_expression>; 


It executes the statement block at least once, and the loop repeats until <boolean expression> evaluates to TRUE. 
Variables explicitly declared inside the loop body have scope local to that loop and might not be accessed outside 
the loop body. 


while ... do 
Awhile ... do structure has the form: 
while <boolean_expression> do 


<statement 1>; 
<statement 2>; 


<statement n>; 


It begins executing the statement block only if the Boolean expression is true. The loop then runs until the 
expression is false. 


for... 
A for ... structure has the form: 
for <assignable_expression> = <integer_exprl> to <integer_expr2> 


<statement 1>; 
<statement 2>; 


<statement n>; 


The <assignable_expression> is initialized to <integer_expr1> and compared to <integer_expr2>. If <integer_expri1> 
is less than <integer_expr2>, the loop body is executed and the <assignable_expression> incremented by one. This 
repeats until <assignable expression> is more than or equal to <integer_expr2>. 


There is an alternate form: 
for <assignable_expression> = <integer_exprl> downto <integer_expr2> 


where <integer_expr1> is decremented after the loop body executes and continues until <assignable expression> is 
less than or equal than <integer_expr2>. 
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K13.5.5 


K13.5.6 


K13-7800 


Special statements 


This section describes statements with particular architecturally-defined behaviors. 


UNDEFINED 
This subsection describes the statement: 
UNDEFINED; 


This statement indicates a special case that replaces the behavior defined by the current pseudocode, apart from 
behavior required to determine that the special case applies. The replacement behavior is that the Undefined 
Instruction exception is taken. 


UNPREDICTABLE 
This subsection describes the statement: 
UNPREDICTABLE; 


This statement indicates a special case that replaces the behavior defined by the current pseudocode, apart from 
behavior required to determine that the special case applies. The replacement behavior is UNPREDICTABLE. 


SEE... 


This subsection describes the statement: 
SEE <reference>; 


This statement indicates a special case that replaces the behavior defined by the current pseudocode, apart from 
behavior required to determine that the special case applies. The replacement behavior is that nothing occurs as a 
result of the current pseudocode because some other piece of pseudocode defines the required behavior. The 
<reference> indicates where that other pseudocode can be found. 


It usually refers to another instruction, but can also refer to another encoding or note of the same instruction. 


IMPLEMENTATION_DEFINED 
This subsection describes the statement: 
IMPLEMENTATION_DEFINED {"<text>"}; 


This statement indicates a special case that replaces the behavior defined by the current pseudocode, apart from 
behavior required to determine that the special case applies. The replacement behavior is IMPLEMENTATION 
DEFINED. An optional <text> field can give more information. 


Comments 


The pseudocode supports two styles of comments: 
. // starts a comment that is terminated by the end of the line. 


. /* starts a comment that is terminated by «/. 


/x«/ statements might not be nested, and the first «/ ends the comment. 


Note 


Comment lines do not require a terminating semicolon. 
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K13.6 Built-in functions 


This section describes: 
. Bitstring manipulation functions. 
. Arithmetic functions on page K13-7802. 


K13.6.1 Bitstring manipulation functions 
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The following bitstring manipulation functions are defined: 


Bitstring length and most significant bit 


If x is a bitstring: 
$ The bitstring length function Len(x) returns the length of x as an integer. 


Bitstring concatenation and replication 


If x is a bitstring and n is an integer with n >= 0: 


. Replicate(x, n) is the bitstring of length n+Len(x) consisting of n copies of x concatenated together. 
. Zeros(n) = Replicate('0', n). 
. Ones(n) = Replicate('1', n). 


Bitstring count 


If x is a bitstring, BitCount(x) is an integer result equal to the number of bits of x that are ones. 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K13-7801 
Non-Confidential 


Arm Pseudocode Definition 
K13.6 Built-in functions 


K13.6.2 


K13-7802 


Testing a bitstring for being all zero or all ones 


If x is a bitstring: 
. IsZero(x) produces TRUE if all of the bits of x are zeros and FALSE if any of them are ones 
. IsZeroBit(x) produces '1' ifall of the bits of x are zeros and '0' if any of them are ones. 


IsOnes(x) and IsOnesBit(x) work in the corresponding ways. This means: 


IsZero(x) = (BitCount(x) == 0) 

TsOnes(x) (BitCount(x) == Len(x)) 
IsZeroBit(x) = if IsZero(x) then '1' else 'Q' 
IsOnesBit(x) = if IsOnes(x) then '1' else 'Q' 


Lowest and highest set bits of a bitstring 
If x is a bitstring, and N = Len(x): 


° LowestSetBit(x) is the minimum bit number of any of the bits of x that are ones. If all of its bits are zeros, 
LowestSetBit(x) = N. 


. HighestSetBit(x) is the maximum bit number of any of the bits of x that are ones. If all of its bits are zeros, 
HighestSetBit(x) = -1. 


° CountLeadingZeroBits(x) is the number of zero bits at the left end of x, in the range 0 to N. This means: 


CountLeadingZeroBits(x) = N - 1 - HighestSetBit(x). 


$ CountLeadingSignBits(x) is the number of copies of the sign bit of x at the left end of x, excluding the sign 
bit itself, and is in the range 0 to N-1. This means: 


CountLeadingSignBits(x) = CountLeadingZeroBits(x<N-1:1> EOR x<N-2:0>). 


Zero-extension and sign-extension of bitstrings 


If x is a bitstring and i is an integer, then ZeroExtend(x, i) is x extended to a length of i bits, by adding sufficient 
zero bits to its left. That is, if i == Len(x), then ZeroExtend(x, i) = x, andifi > Len(x), then: 


ZeroExtend(x, i) = Replicate('@', i-Len(x)) : x 


If x is a bitstring and i is an integer, then SignExtend(x, i) is x extended to a length of i bits, by adding sufficient 
copies of its leftmost bit to its left. That is, if i == Len(x), then SignExtend(x, i) = x, andifi > Len(x), then: 


SignExtend(x, i) = Replicate(TopBit(x), i-Len(x)) : x 


It is a pseudocode error to use either ZeroExtend(x, i) or SignExtend(x, i) ina context where it is possible that 
i < Len(x). 


Converting bitstrings to integers 
If x is a bitstring, SInt() is the integer whose two’s complement representation is x. 


UInt() is the integer whose unsigned representation is x. 


Int(x, unsigned) returns either SInt(x) or UInt(x) depending on the value of its second argument. 


Arithmetic functions 


This section defines built-in arithmetic functions. 


Absolute value 


If x is either of type real or integer, Abs(x) returns the absolute value of x. The result is the same type as x. 
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Rounding and aligning 


If x is a real: 


° RoundDown(x) produces the largest integer n such that n <= x. 
° RoundUp(x) produces the smallest integer n such that n >= x. 
° RoundTowardsZero(x) produces: 

— RoundDown(x) if x > 0.0. 

— Oifx == 0.0. 


— RoundUp(x) if x < 0.0. 
If x and y are both of type integer, Align(x, y) = y » (x DIV y), and is of type integer. 


Ifx is of type bitstring and y is of type integer, Align(x, y) = (Align(UInt(x), y))<Len(x)-1:0>, and is a bitstring 
of the same length as x. 


It is a pseudocode error to use either form of Align(x, y) in any context where y can be 0. In practice, Align(x, y) 
is only used with y a constant power of two, and the bitstring form used with y = 24n has the effect of producing its 
argument with its n low-order bits forced to zero. 


Maximum and minimum 


If x and y are integers or reals, then Max(x, y) and Min(x, y) are their maximum and minimum respectively. x and 
y must both be of type integer or of type real. The function returns a value of the same type as its operands. 
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K13.7 Miscellaneous helper procedures and functions 


This section lists the prototypes of miscellaneous helper procedures and functions used by the pseudocode, together 
with a brief description of the effect of the procedure or function. The pseudocode does not define the operation of 
these helper procedures and functions. 


Note 


Chapter J1 Armv8 Pseudocode also has an entry for each of these functions, but currently these entries do not say 
anything about the effect of the function. When this information is added in Chapter J1 this section will be removed 
from the manual. 





K13.7.1 EndOfinstruction() 


This procedure terminates processing of the current instruction. 


EndOfInstruction(); 


K13.7.2 Hint_Debug() 


This procedure supplies a hint to the debug system. 


Hint_Debug(bits(4) option); 


K13.7.3 Hint_PreloadData() 
This procedure performs a preload data hint. 


Hint_PreloadData(bits(32) address); 


K13.7.4 Hint_PreloadDataF orWrite() 


This procedure performs a preload data hint with a probability that the use will be for a write. 


Hint_PreloadDataForWrite(bits(32) address); 


K13.7.5 Hint_Preloadinstr() 


This procedure performs a preload instructions hint. 


Hint_PreloadInstr(bits(32) address); 


K13.7.6 Hint_Yield() 
This procedure performs a Yield hint. 


Hint_Yield(); 


K13.7.7 IsExternalAbort() 


This function returns TRUE if the abort currently being processed is an External abort and FALSE otherwise. It is used 
only in exception entry pseudocode. 


boolean IsExternalAbort(Fault type) 
assert type != Fault_None; 


boolean IsExternalAbort(FaultRecord fault); 
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IsAsyncAbort() 


This function returns TRUE if the abort currently being processed is an asynchronous abort, and FALSE otherwise. It 
is used only in exception entry pseudocode. 


boolean IsAsyncAbort(Fault type) 
assert type != Fault_None; 


boolean IsAsyncAbort(FaultRecord fault); 


LSInstructionSyndrome() 
This function returns the extended syndrome information for a fault reported in the HSR. 


bits(11) LSInstructionSyndrome() ; 


ProcessorID() 
This function returns an integer that uniquely identifies the executing PE in the system. 


integer ProcessorID(); 


RemapRegsHaveResetValues() 


This function returns TRUE if the remap registers PRRR and NMRR have their IMPLEMENTATION DEFINED reset 
values, and FALSE otherwise. 


boolean RemapRegsHaveResetValues(); 


ResetControlRegisters() 


This function resets the System registers and memory-mapped control registers that have architecturally-defined 
reset values to those values. For more information about the affected registers see: 


° PE state on reset to AArch64 state on page D1-2290. 
° PE state on reset into AArch32 state on page G1-5559. 


AArch64.ResetControlRegisters(boolean ResetIsCold) 
AArch32.ResetControlRegisters(boolean ResetIsCold) 


ThisInstr() 
This function returns the bitstring encoding of the currently-executing instruction. 


bits(32) ThisInstr(); 


Note 


Currently, this function is used only on 32-bit instruction encodings. 








ThisInstrLength() 
This function returns the length, in bits, of the current instruction. This means it returns 32 or 16: 


integer ThisInstrLength(); 
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K13.8 Arm pseudocode definition index 


This section contains the following tables: 


° Table K13-3 which contains the pseudocode data types. 


. Table K13-4 which contains the pseudocode operators. 


° Table K13-5 on page K13-7807 which contains the pseudocode keywords and control structures. 


. Table K13-6 on page K13-7808 which contains the statements with special behaviors. 


Table K13-3 Index of pseudocode data types 





Keyword 


Meaning 





array 


Type name for the array type 





bit 


Keyword equivalent to bits(1) 





bits(N) 


Type name for the bitstring of length N data type 





boolean 


Type name for the Boolean data type 





enumeration 


Keyword to define a new enumeration type 





integer 


Type name for the integer data type 





real 


Type name for the real data type 





type 


Keyword to define a new structure 





Table K13-4 Index of pseudocode operators 





Operator 


Meaning 





Unary minus on integers or reals 





Subtraction of integers, reals and bitstrings 





Used in the left-hand side of an assignment or a tuple to discard 
the result 








Unary plus on integers or reals 





Addition of integers, reals and bitstrings 





Extract named member from a list 





Extract named bit or field from a register 





Bitstring concatenation 





Integer range in bitstring extraction operator 





Boolean NOT 





Comparison for inequality 





Around arguments of procedure or function 





Around array index 





Around arguments of array-like function 





Multiplication of integers, reals, and bitstrings 





Division of reals 
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Table K13-4 Index of pseudocode operators (continued) 





Operator 


&& 


Meaning 


Boolean AND 





Less than comparison of integers and reals 





Slicing of specified bits of bitstring or integer 





Multiply integer by power of 2 





Less than or equal comparison of integers and reals 





Assignment operator 





Comparison for equality 





Greater than comparison of integers and reals 





Greater than or equal comparison of integers and reals 





Divide integer by power of 2 





Boolean OR 





Exponential operator 





Bitwise AND of bitstrings 





Quotient from integer division 





Bitwise EOR of bitstrings 





Tests membership of a certain expression in a set of values 





MOD 


Remainder from integer division 





NOT 


Bitwise inversion of bitstrings 





OR 


Bitwise OR of bitstrings 





case .. of .. 


Control structure for the 





if .. then .. else .. 


Condition expression selecting between two values 





Table K13-5 Index of pseudocode keywords and control structures 





Operator 


[+f 


Meaning 


Comment delimiters 





Introduces comment terminated by end of line 





One of two values a Boolean can take (other than TRUE) 





Loop control structure, counting up from the initial value to the 
upper limit 





for .. = .. downto .. 


Loop control structure, counting down from the initial value to 
the lower limit 





if .. then... else ... 


Conditional control structure 





otherwise 


Introduces default case in case ... of ... control structure 
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Table K13-5 Index of pseudocode keywords and control structures (continued) 





Operator 


repeat .. until .. 


Meaning 


Loop control structure that runs at least once until the 
termination condition is satisfied 




















return Procedure or function return 
TRUE One of two values a Boolean can take (other than FALSE) 
when Introduces specific case in case .. of ... control structure 
while .. do ... Loop control structure that runs until the termination condition 
is satisfied 
Table K13-6 Index of special statements 
Keyword Meaning 





IMPLEMENTATION_DEFINED 


Describes IMPLEMENTATION DEFINED behavior 














SEE Points to other pseudocode to use instead 
UNDEFINED Cause Undefined Instruction exception 
UNKNOWN Unspecified value 

UNPREDICTABLE Unspecified behavior 
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This appendix provides indexes to the register descriptions in this manual. It contains the following sections: 
` Introduction and register disambiguation on page K14-7810. 

. Alphabetical index of AArch64 registers and System instructions on page K14-7815. 

. Functional index of AArch64 registers and System instructions on page K14-7830. 

. Alphabetical index of AArch32 registers and System instructions on page K14-7845. 

. Functional index of AArch32 registers and System instructions on page K14-7855. 

. Alphabetical index of memory-mapped registers on page K14-7867. 

. Functional index of memory-mapped registers on page K14-7874. 
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K14.1 Introduction and register disambiguation 


K14.1 


Introduction and register disambiguation 


In some sections of this manual, registers are referred to by a general name, where the description applies to more 
than one context. Generally, this is one of the following: 


The description applies to both AArch32 state and AArch64 state, and therefore the register names could 
apply to either AArch32 System registers or AArch64 System registers. 


The description applies to multiple Exception levels, and therefore at a particular Exception level the register 
names need to take the appropriate Exception. level suffix, ELO, EL1, EL2,or_EL3. 





The following sections disambiguate the general register names: 


K14.1.1 


Register name disambiguation by Execution state. 


Register name disambiguation by Exception level on page K14-7814. 


Register name disambiguation by Execution state 


Table K14-1 disambiguates the general names of the registers by Execution state. 


Table K14-1 Disambiguation of general names of registers by Execution state 



























































General name Short description AArché4 register AArch32 register 
CONTEXTIDR Context ID CONTEXTIDR ELI CONTEXTIDR 
DBGBCR Debug Breakpoint Control Registers DBGBCR<n>_EL1 DBGBCR<n> 
DBGBVR Debug Breakpoint Value Registers DBGBVR<n>_EL1 DBGBVR<n> 
DBGBXVR<n> 
DBGCLAIMCLR Debug CLAIM Tag Clear register DBGCLAIMCLR_EL1 DBGCLAIMCLR 
DBGCLAIMSET Debug CLAIM Tag Set register DBGCLAIMSET EL1 DBGCLAIMSET 
DBGDTRRX Debug Data Transfer Register, Receive DBGDTRRX_ELO DBGDTRRXint 
DBGDTRTX Debug Data Transfer Register, Transmit DBGDTRTX_ELO DBGDTRTXint 
DBGPRCR Debug Power Control Register DBGPRCR_EL1 DBGPRCR 
DBGVCR Debug Vector Catch Register DBGVCR32_EL2 DBGVCR 
DBGWCR Debug Watchpoint Control Registers DBGWCR<n>_EL1 DBGWCR<n> 
DBGWVR Debug Watchpoint Value Registers DBGWVR<n>_EL1 DBGWVR<n> 
DCCINT Debug Comms Channel Interrupt Enable MDCCINT EL1 DBGDCCINT 
Register 
DCCSR Debug Comms Channel Status Register MDCCSR_ELO DBGDSCRint 
DBGAUTHSTATUS Debug Authentication Status DBGAUTHSTATUS EL! DBGAUTHSTATUS 
DLR Debug Link Register DLR_ELO[31:0] DLR 
DSCR Debug System Control Register MDSCR_EL1 DBGDSCRext 
DSPSR Debug Saved PE State Register DSPSR_ELO DSPSR 
FAR Fault Address Register FAR ELI DFAR, IFAR 
FAR_EL2 HDFAR, HIFAR 
FAR_EL3 FAR _EL3 
HPFAR_EL2 HPFAR 
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K14.1 Introduction and register disambiguation 


Table K14-1 Disambiguation of general names of registers by Execution state (continued) 






























































General name Short description AArché4 register AArch32 register 
HCR Hypervisor Configuration Register HCR_EL2 HCR 
HCR2 
HDCR Hyp or EL2 Debug Control Register MDCR_EL2 HDCR 
HSCTLR Hypervisor System Control Register SCTLR. EL2 HSCTLR 
HTTBR EL2 Translation Table Base Register TTBRO EL2 HTTBR 
ISR Interrupt Status Register ISR_EL1 ISR 
MPIDR Multiprocessor Affinity Register MPIDR EL1 MPIDR 
OSDLR OS Double-Lock Register OSDLR_EL1 DBGOSDLR 
OSDTRRX OS Lock Data Transfer Register, Receive OSDTRRX_EL1 DBGDTRRXext 
OSDTRTX OS Lock Data Transfer Register, Transmit OSDTRTX_EL1 DBGDTRTXext 
OSECCR OS Lock Exception Catch Control Register OSECCR_EL1 DBGOSECCR 
OSLAR OS Lock Access Register OSLAR_EL1 DBGOSLAR 
OSLSR OS Lock Status Register OSLSR_EL1 DBGOSLSR 
PMMIR Performance Monitors Machine Identification PMMIR EL1 PMMIR 
Register 
SCR Secure Configuration Register SCR_EL3 SCR 
SCTLR System Control Register SCTLR_EL1 SCTLR (NS) 
SCTLR_EL2 HSCTLR 
SCTLR_EL3 SCTLR (S) 
SDCR Secure or EL3 Debug Configuration Register MDCR_EL3 SDCR 
SDER Secure Debug Enable Register SDER32_EL3 SDER 
SPSR Saved Program Status Register SPSR_EL1 SPSR (general description) 
SPSR_EL2 SPSR_abt 
SPSR_EL3 SPSR_fiq 
SPSR_hyp 
SPSR_irq 
SPSR_mon 
SPSR_ sve 
SPSR_und 
TCR Translation Control Register TCR. ELI TTBCR(NS) 
TCR EL? HICR 
TCR_EL3 TTBCR(S) 
VTCR_EL2 VTCR 
TTBR Translation Table Base Register TTBRO EL1 TTBRO 
TTBRO_EL2 TTBR1 
TTBRO_EL3 HTTBR 
TTBRI1_EL1 VTTBR 
VTTBR_EL2 
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K14.1 Introduction and register disambiguation 


Table K14-1 Disambiguation of general names of registers by Execution state (continued) 











General name Short description AArché4 register AArch32 register 
VCR PL1&0 stage 2 Translation Control Register VTCR_EL2 VTCR 
VBAR Vector Base Address Register VBAR_EL1 VBAR 
VBAR_EL2 HVBAR 
VBAR_EL3 MVBAR 
VTTBR PL1&0 stage 2 Translation Table Base Register VTTBR_EL2 VTTBR 





Table K14-2 disambiguates the general names of the System registers that provide access to the Performance 
Monitors by Execution state. 


Table K14-2 Disambiguation of general names of the Performance Monitors System registers by Execution state 













































































General name Short description AArch64 register AArch32 register 
PMCCFILTR Cycle Count Filter Register PMCCFILTR_ELO PMCCFILTR 
PMCCNTR Cycle Count Register PMCCNTR_ELO PMCCNTR 
PMCEIDO Performance Monitors Cycle Count Filter Register 0 PMCEIDO_ELO PMCEIDO 
PMCEID1 Performance Monitors Cycle Count Filter Register 1 PMCEID1 ELO PMCEID1 
PMCNTENCLR Performance Monitors Count Enable Clear register PMCNTENCLR_ELO PMINTENCLR 
PMCNTENSET Performance Monitors Count Enable Set register PMCNTENSET_ELO PMCNTENSET 
PMCR Performance Monitors Control Register PMCR_ELO PMCR 
PMEVCNTR<n> Performance Monitors Event Count Registers, n = 0-30 PMEVCNTR<n>_ELO PMEVCNTR<n> 
PMEVTYPER<n> Performance Monitors Event Type Registers, n = 0-30 PMEVTYPER<n>_ELO PMEVTYPER<n> 
PMINTENCLR Performance Monitors Interrupt Enable Clear register PMINTENCLR EL1 PMINTENCLR 
PMINTENSET Performance Monitors Interrupt Enable Set register PMINTENSET EL1 PMINTENSET 
PMMIR Performance Monitors Machine Identification Register PMMIR EL1 PMMIR 
PMOVSCLR Performance Monitors Overflow Flag Status Register PMOVSCLR_ELO PMOVSR 
PMOVSSET Performance Monitors Overflow Flag Status Set register PMOVSSET ELO PMOVSSET 
PMSELR Performance Monitors Event Counter Selection Register PMSELR ELO PMSELR 
PMSWINC Performance Monitors Software Increment register PMSWINC_ELO PMSWINC 
PMUSERENR Performance Monitors User Enable Register PMUSERENR_ELO PMUSERENR 
PMXEVCNTR Performance Monitors Selected Event Count Register PMXEVCNTR_ELO PMXEVCNTR 
PMXEVTYPER Performance Monitors Selected Event Type Register PMXEVTYPER ELO PMXEVTYPER 
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K14.1 Introduction and register disambiguation 


Table K14-3 disambiguates the general names of the System registers that provide access to the Activity Monitors 
by Execution state. 


Table K14-3 Disambiguation of general names of the Activity Monitors System registers by Execution state 














General name Short description AArch64 register AArch32 register 
AMCR Activity Monitors Control Register AMCR _ELO AMCR 

AMCFGR Activity Monitors Configuration Register AMCFGR_ELO AMCFGR 
AMCGCR Activity Monitors Counter Group Configuration AMCGCR_ELO AMCGCR 


Register 





MUSERENR 


Activity Monitors User Enable Register 


MUSERENR_ ELO 


MUSERENR 





MCNTENCLRO 


Activity Monitors Count Enable Clear Register 0 


MCNTENCLRO_ELO 


MCNTENCLRO 





MCNTENSETO 


Activity Monitors Count Enable Set Register 0 


MCNTENSETO_ELO 


MCNTENSETO 





MEVCNTRO<n> 


Activity Monitors Event Counter Registers 0, n = 0-15 


MEVCNTRO<n>_ELO 


MEVCNTRO<n> 





Activity Monitors Event Type Registers 0, n = 0-15 





MCNTENCLR1 


Activity Monitors Count Enable Clear Register 1 


MCNTENCLR1_ELO 


MCNTENCLR1 





MCNTENSET1 


Activity Monitors Count Enable Set Register 1 


MCNTENSET1 ELO 


MCNTENSET1 





MEVCNTRI<n> 


Activity Monitors Event Counter Registers 1, n = 0-15 


MEVCNTRI1<n>_ELO 


MEVCNTRI1<n> 








A 
A 
A 
A 
AMEVTYPERO<n> 
A 
A 
A 
A 


MEVTYPER1<n> 





Activity Monitors Event Type Registers 1, n = 0-15 





A 
A 
A 
A 
AMEVTYPERO<n>_ELO 
A 
A 
A 
A 


MEVTYPER1<n>_ELO 





A 
A 
A 
A 
AMEVTY PERO<n> 
A 
A 
A 
A 


MEVTYPER1<n> 





Table K14-4 disambiguates the general names of the System registers that provide access to the Performance 
Monitors by Execution state. 


Table K14-4 Disambiguation of general names of the Generic Timer System registers by Execution state 





General name 


Short description 


AArch64 register 


AArch32 register 
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CNTFRQ Counter-timer Frequency register CNTFRQ_ ELO CNTFRQ 
CNTHCTL Counter-timer Hypervisor Control register CNTHCTL_EL2 CNTHCTL 
CNTHP_CTL Counter-timer Hypervisor Physical Timer Control register CNTHP CTL EL2 CNTHP_CTL 
CNTHP_CVAL — Counter-timer Hypervisor Physical Timer CompareValue register CNTHP_CVAL_EL2 CNTHP_CVAL 
CNTHP_TVAL — Counter-timer Hypervisor Physical Timer TimerValue register CNTHP TVAL EL2 CNTHP_TVAL 
CNTKCTL Counter-timer Kernel Control register CNTKCTL ELI CNTKCTL 
CNTP_CTL Counter-timer Physical Timer Control register CNTP_CTL_ELO CNTP_CTL 
CNTP_CVAL Counter-timer Physical Timer CompareValue register CNTP_CVAL_ELO CNTP_CVAL 
CNTP_TVAL Counter-timer Physical Timer TimerValue register CNTP_TVAL ELO CNTP_TVAL 
CNTPCT Counter-timer Physical Count register CNTPCT_ELO CNTPCT 
CNTPS_CTL Counter-timer Physical Secure Timer Control register CNTPS_ CTL EL1 - 
CNTPS_CVAL Counter-timer Physical Secure Timer CompareValue register CNTPS_CVAL ELI - 
CNTPS_TVAL Counter-timer Physical Secure Timer TimerValue register CNTPS_TVAL ELI - 

CNTV_CTL Counter-timer Virtual Timer Control register CNTV_CTL ELO CNTV_CTL 
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K14.1 Introduction and register disambiguation 


Table K14-4 Disambiguation of general names of the Generic Timer System registers by Execution state (continued) 





General name 


Short description 


AArch64 register 


AArch32 register 














CNTV_CVAL Counter-timer Virtual Timer Compare Value register CNTV_CVAL _ELO CNTV_CVAL 

CNTV_TVAL Counter-timer Virtual Timer TimerValue register CNTV_TVAL_ELO CNTV_TVAL 

CNTVCT Counter-timer Virtual Count register CNTVCT_ELO CNTVCT 

CNTVOFF Counter-timer Virtual Offset register CNTVOFF_ EL2 CNTVOFF 
K14.1.2 Register name disambiguation by Exception level 


K14-7814 


Table K14-5 disambiguates the general names of the AArch64 System registers by Exception level. 


Table K14-5 Disambiguation of AArch64 System registers by Exception level 






































General form ELO EL1 EL2 EL3 
AFSRO_ELx - AFSRO_EL1 AFSRO_EL2 AFSRO_EL3 
AFSR1_ELx - AFSR1_EL1 AFSR1_EL2 AFSR1_EL3 
CONTEXTIDR ELx - CONTEXTIDR_EL1 CONTEXTIDR EL2 - 

CPTR_ELx - - CPTR_EL2 CPTR._EL3 
ELR_ELx - ELR ELI ELR EL2 ELR _EL3 
ESR_ELx - ESR_EL1 ESR_EL2 ESR_EL3 
FAR _ELx z FAR ELI FAR EL2 FAR EL3 
MAIR ELx - MAIR ELI MAIR EL2 MAIR _ EL3 
RMR ELx - RMR ELI RMR EL2 RMR EL3 
RVBAR_ELx - RVBAR ELI RVBAR_EL2 RVBAR_EL3 
SCTLR_ELx - SCTLR_EL1 SCTLR. EL2 SCTLR_EL3 





SCXTNUM_ELx 


SCXTNUM_ELO 


SCXTNUM_EL1 


SCXTNUM_EL2 


SCXTNUM_EL3 























SP_ELx SP_ELO SP_ELI SP_EL2 SP_EL3 
SPSR_ELx > SPSR_EL1 SPSR_EL2 SPSR_EL3 
TCR_ELx TCR_ELI1 TCR_EL2 TCR_EL3 
TFSR_ELx TFSREO_ ELI TFSR_ELI TFSR_EL2 TFSR_EL3 
TTBRO_ELx : TTBRO EL1 TTBRO_EL2 TTBRO_EL3 
TTBR1_ELx p TTBR1_ ELl : : 

VBAR ELx 2 VBAR_ELI VBAR_EL2 VBAR_EL3 
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K14.2 Alphabetical index of AArch64 registers and System instructions 


This section is an index of AArch64 registers and System instructions in alphabetical order. 


Table K14-6 Alphabetical index of AArch64 Registers 


















































Register Description, see 

ACTLR_EL1 ACTLR_ELI, Auxiliary Control Register (EL1) on page D13-2827 

ACTLR_EL2 ACTLR_EL2, Auxiliary Control Register (EL2) on page D13-2829 

ACTLR_EL3 ACTLR_EL3, Auxiliary Control Register (EL3) on page D13-2831 

AFSRO_EL1 AFSRO_EL1, Auxiliary Fault Status Register 0 (EL1) on page D13-2833 

AFSRO_EL2 AFSRO_EL2, Auxiliary Fault Status Register 0 (EL2) on page D13-2836 

AFSRO_EL3 AFSRO_EL3, Auxiliary Fault Status Register 0 (EL3) on page D13-2839 

AFSR1_EL1 AFSR1_EL1, Auxiliary Fault Status Register 1 (EL1) on page D13-2841 

AFSR1_EL2 AFSR1_EL2, Auxiliary Fault Status Register 1 (EL2) on page D13-2844 

AFSR1_EL3 AFSR1_EL3, Auxiliary Fault Status Register 1 (EL3) on page D13-2847 

AIDR_EL1 AIDR_ELI, Auxiliary ID Register on page D13-2849 

AMAIR_EL1 AMAIR_EL1, Auxiliary Memory Attribute Indirection Register (EL1) on page D13-2850 
AMAIR EL2 AMAIR E22, Auxiliary Memory Attribute Indirection Register (EL2) on page D13-2853 
AMAIR EL3 AMAIR _EL3, Auxiliary Memory Attribute Indirection Register (EL3) on page D13-2856 
AMCFGR_ELO AMCFGR_ELDO, Activity Monitors Configuration Register on page D13-3585 
AMCGCR_ELO AMCGCR_ELO, Activity Monitors Counter Group Configuration Register on 


page D13-3587 





AMCNTENCLRO_ELO 


AMCNTENCLRO_ELO, Activity Monitors Count Enable Clear Register 0 on 
page D13-3589 





AMCNTENCLR1_ELO 


AMCNTENCLR1_ELO, Activity Monitors Count Enable Clear Register 1 on 
page D13-3591 





AMCNTENSETO_ELO 


AMCNTENSETO_ELO, Activity Monitors Count Enable Set Register 0 on page D13-3593 

















AMCNTENSET1_ELO 


AMCNTENSET1_ELO, Activity Monitors Count Enable Set Register 1 on page D13-3595 





AMCR_ELO 


AMCR_ELDO, Activity Monitors Control Register on page D13-3597 





AMEVCNTRO<n>_ELO 


AMEVCNTRO<n>_ELO, Activity Monitors Event Counter Registers 0, n = 0 - 15 on 
page D13-3599 





AMEVCNTRI<n>_ELO 


AMEVCNTRI<n>_ELO, Activity Monitors Event Counter Registers 1, n = 0- 15 on 
page D13-3601 





AMEVTYPERO<n>_ELO 


AMEVTYPERO<n>_ELO, Activity Monitors Event Type Registers 0, n = 0 - 15 on 
page D13-3603 





AMEVTYPER1I<n>_ELO 


AMEVTYPERI<n>_ELO, Activity Monitors Event Type Registers 1, n = 0 - 15 on 
page D13-3605 








AMUSERENR _ELO 
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AMUSERENR_ELO, Activity Monitors User Enable Register on page D13-3607 
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Table K14-6 Alphabetical index of AArch64 Registers (continued) 






















































































Register Description, see 
APDAKeyHi_EL1 APDAKeyHi_EL1, Pointer Authentication Key A for Data (bits[127:64]) on 
page D13-2858 
APDAKeyLo_ EL1 APDAKeyLo_EL1, Pointer Authentication Key A for Data (bits[63:0]) on page D13-2860 
APDBKeyHi EL1 APDBKeyHi_EL1, Pointer Authentication Key B for Data (bits[127:64]) on 
page D13-2862 
APDBKeyLo EL1 APDBKeyLo_EL1, Pointer Authentication Key B for Data (bits[63:0]) on page D13-2864 
APGAKeyHi EL1 APGAKeyHi_EL1, Pointer Authentication Key A for Code (bits[127:64]) on 
page D13-2866 
APGAKeyLo_ EL1 APGAKeyLo_EL1, Pointer Authentication Key A for Code (bits[63:0]) on page D13-2868 
APIAKeyHi EL1 APIAKeyHi_EL1, Pointer Authentication Key A for Instruction (bits[127:64]) on 
page D13-2870 
APIAKeyLo_ EL1 APIAKeyLo_EL1, Pointer Authentication Key A for Instruction (bits[63:0]) on 
page D13-2872 
APIBKeyHi_EL1 APIBKeyHi_EL1, Pointer Authentication Key B for Instruction (bits[127:64]) on 
page D13-2874 
APIBKeyLo_EL1 APIBKeyLo_EL1, Pointer Authentication Key B for Instruction (bits[63:0]) on 
page D13-2876 
AT S$12E0R AT SI2EOR, Address Translate Stages 1 and 2 ELO Read on page C5-521 
AT S12E0W AT SI2E0W, Address Translate Stages 1 and 2 ELO Write on page C5-523 
AT S12E1R AT S12E1R, Address Translate Stages 1 and 2 ELI Read on page C5-525 
AT S12E1W AT SI2E1W, Address Translate Stages 1 and 2 EL1 Write on page C5-527 
AT S1EOR AT SIEOR, Address Translate Stage 1 ELO Read on page C5-529 
AT S1EOW AT SIEOW, Address Translate Stage 1 ELO Write on page C5-530 
AT SIEIR AT SIEIR, Address Translate Stage 1 ELI Read on page C5-531 
AT SIEIRP AT SIEIRP, Address Translate Stage 1 ELI Read PAN on page C5-533 
AT SIEIW AT SIEIW, Address Translate Stage 1 ELI Write on page C5-535 
AT S1E1WP AT SIEIWP, Address Translate Stage 1 ELI Write PAN on page C5-537 
AT S1E2R AT SIE2R, Address Translate Stage 1 EL2 Read on page C5-539 
AT SIE2W AT SIE2W, Address Translate Stage 1 EL2 Write on page C5-540 
AT S1E3R AT S1E3R, Address Translate Stage 1 EL3 Read on page C5-541 
AT SIE3W AT SIE3W, Address Translate Stage 1 EL3 Write on page C5-542 
CCSIDR2_EL1 CCSIDR2_EL1, Current Cache Size ID Register 2 on page D13-2878 
CCSIDR_EL1 CCSIDR_EL1, Current Cache Size ID Register on page D13-2880 
CFP RCTX CFP RCTX, Control Flow Prediction Restriction by Context on page C5-740 
CLIDR_EL1 CLIDR_EL1I, Cache Level ID Register on page D13-2883 
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Table K14-6 Alphabetical index of AArch64 Registers (continued) 





Register 


CNTFRQ ELO 


Description, see 


CNTFRO_ELO, Counter-timer Frequency register on page D13-3686 





CNTHCTL_EL2 


CNTHCTL_EL2, Counter-timer Hypervisor Control register on page D13-3688 





CNTHP_CTL_EL2 


CNTHP_CTL_EL2, Counter-timer Hypervisor Physical Timer Control register on 
page D13-3694 





CNTHP_CVAL_EL2 


CNTHP_CVAL_EL2, Counter-timer Physical Timer CompareValue register (EL2) on 
page D13-3698 





CNTHP_TVAL_EL2 


CNTHP_TVAL_EL2, Counter-timer Physical Timer Timer Value register (EL2) on 
page D13-3702 





CNTHPS_CTL_EL2 


CNTHPS_CTL_EL2, Counter-timer Secure Physical Timer Control register (EL2) on 
page D13-3705 





CNTHPS CVAL EL2 


CNTHPS_CVAL_EL2, Counter-timer Secure Physical Timer Compare Value register (EL2) 
on page D13-3709 





CNTHPS TVAL_EL2 


CNTHPS_TVAL_EL2, Counter-timer Secure Physical Timer Timer Value register (EL2) on 
page D13-3713 





CNTHV_CTL_EL2 


CNTHV_CTL_EL2, Counter-timer Virtual Timer Control register (EL2) on 
page D13-3717 





CNTHV_CVAL_EL2 


CNTHV_CVAL_EL2, Counter-timer Virtual Timer Compare Value register (EL2) on 
page D13-3721 





CNTHV_TVAL_EL2 


CNTHV_TVAL_EL2, Counter-timer Virtual Timer Timer Value Register (EL2) on 
page D13-3724 





CNTHVS_CTL_EL2 


CNTHVS_CTL_EL2, Counter-timer Secure Virtual Timer Control register (EL2) on 
page D13-3727 





CNTHVS CVAL EL2 


CNTHVS_CVAL_EL2, Counter-timer Secure Virtual Timer CompareValue register (EL2) 
on page D13-3731 





CNTHVS TVAL EL2 


CNTHVS_TVAL_EL2, Counter-timer Secure Virtual Timer TimerValue register (EL2) on 
page D13-3734 





CNTKCTL _EL1 


CNTKCTL_EL1, Counter-timer Kernel Control register on page D13-3738 





CNTP CTL ELO 


CNTP_CTL_ELO, Counter-timer Physical Timer Control register on page D13-3743 





CNTP_CVAL_ELO 


CNTP_CVAL_ELO, Counter-timer Physical Timer CompareValue register on 
page D13-3747 





CNTP_TVAL_ELO 


CNTP_TVAL_ELO, Counter-timer Physical Timer TimerValue register on page D13-3751 





CNTPCT_ELO 


CNTPCT _ELO, Counter-timer Physical Count register on page D13-3755 





CNTPS_CTL_ELI1 


CNTPS_CTL_EL1, Counter-timer Physical Secure Timer Control register on 
page D13-3757 





CNTPS_CVAL EL1 


CNTPS_CVAL_EL1, Counter-timer Physical Secure Timer CompareValue register on 
page D13-3759 





CNTPS_TVAL_EL1 


CNTPS_TVAL_EL1, Counter-timer Physical Secure Timer TimerValue register on 
page D13-3761 











CNTV_CTL_ELO 
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CNTV_CTL_ELO, Counter-timer Virtual Timer Control register on page D13-3763 
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Table K14-6 Alphabetical index of AArch64 Registers (continued) 





Register 


CNTV_CVAL_ELO 


Description, see 


CNTV_CVAL_ELO, Counter-timer Virtual Timer CompareValue register on 
page D13-3767 





CNTV_TVAL_ELO 


CNTV_TVAL_ELO, Counter-timer Virtual Timer Timer Value register on page D13-3771 





CNTVCT_ELO 


CNTVCT _ELO, Counter-timer Virtual Count register on page D13-3774 











CNTVOFF_ EL2 


CNTVOFF_EL2, Counter-timer Virtual Offset register on page D13-3776 





CONTEXTIDR ELI 


CONTEXTIDR_ELI, Context ID Register (EL1) on page D13-2886 





CONTEXTIDR_EL2 


CONTEXTIDR_EL2, Context ID Register (EL2) on page D13-2889 





























CPACR ELI] CPACR_ELI, Architectural Feature Access Control Register on page D13-2892 
CPP RCTX CPP RCTX, Cache Prefetch Prediction Restriction by Context on page C5-743 
CPTR_EL2 CPTR_EL2, Architectural Feature Trap Register (EL2) on page D13-2897 
CPTR_EL3 CPTR_EL3, Architectural Feature Trap Register (EL3) on page D13-2905 
CSSELR_EL1 CSSELR_EL1, Cache Size Selection Register on page D13-2909 

CTR_ELO CTR_ELO, Cache Type Register on page D13-2912 

CurrentEL CurrentEL, Current Exception Level on page C5-375 

DACR32_EL2 DACR32_EL2, Domain Access Control Register on page D13-2915 

DAIF DAIF, Interrupt Mask Bits on page C5-377 





DBGAUTHSTATUS_EL1 


DBGAUTHSTATUS_EL1, Debug Authentication Status register on page D13-3430 





DBGBCR<n>_EL1 


DBGBCR<n>_EL1, Debug Breakpoint Control Registers, n = 0 - 15 on page D13-3432 





DBGBVR<n>_EL1 


DBGBVR<n>_EL1, Debug Breakpoint Value Registers, n = 0 - 15 on page D13-3436 





DBGCLAIMCLR_ EL1 


DBGCLAIMCLR_ELI, Debug Claim Tag Clear register on page D13-3442 





DBGCLAIMSET EL1 


DBGCLAIMSET _EL1, Debug Claim Tag Set register on page D13-3444 





DBGDTR_ELO 


DBGDTR_ELO, Debug Data Transfer Register, half-duplex on page D13-3446 





DBGDTRRX_ELO 


DBGDTRRX_ELO, Debug Data Transfer Register, Receive on page D13-3449 





DBGDTRTX_ELO 


DBGDTRTX_ELO, Debug Data Transfer Register, Transmit on page D13-3451 





DBGPRCR_ EL1 


DBGPRCR_EL1, Debug Power Control Register on page D13-3453 





DBGVCR32_EL2 


DBGVCR32_EL2, Debug Vector Catch Register on page D13-3455 





DBGWCR<n>_EL1 


DBGWCR<n>_EL1, Debug Watchpoint Control Registers, n = 0 - 15 on page D13-3459 





DBGWVR<n>_EL1 


DBGWVR<n>_EL1, Debug Watchpoint Value Registers, n = 0 - 15 on page D13-3463 











DC CGDSW DC CGDSW, Data, Allocation Tag or unified Cache line Clean of Data and Allocation 
Tags by Set/Way on page C5-460 
DC CGDVAC DC CGDVAC, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by VA 
to PoC on page C5-462 
DC CGDVADP DC CGDVADP, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by VA 
to PoDP on page C5-464 
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Register Description, see 

DC CGDVAP DC CGDVAP, Data, Allocation Tag or unified Cache line Clean of Data and Allocation 
Tags by VA to PoP on page C5-466 

DC CGSW DC CGSW, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by Set/Way 
on page C5-468 

DC CGVAC DC CGVAC, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by VA to 
PoC on page C5-470 

DC CGVADP DC CGVADP, Data, Allocation Tag or unified Cache line Clean of Data and Allocation 
Tags by VA to PoDP on page C5-472 

DC CGVAP DC CGVAP, Data, Allocation Tag or unified Cache line Clean of Allocation Tags by VA to 
PoP on page C5-474 

DC CIGDSW DC CIGDSW, Data, Allocation Tag or unified Cache line Clean and Invalidate of Data and 
Allocation Tags by Set/Way on page C5-476 

DC CIGDVAC DC CIGDVAC, Data, Allocation Tag or unified Cache line Clean and Invalidate of Data 
and Allocation Tags by VA to PoC on page C5-478 

DC CIGSW DC CIGSW, Data, Allocation Tag or unified Cache line Clean and Invalidate of Allocation 
Tags by Set/Way on page C5-480 

DC CIGVAC DC CIGVAC, Data, Allocation Tag or unified Cache line Clean and Invalidate of 
Allocation Tags by VA to PoC on page C5-482 

DC CISW DC CISW, Data or unified Cache line Clean and Invalidate by Set/Way on page C5-484 

DC CIVAC DC CIVAC, Data or unified Cache line Clean and Invalidate by VA to PoC on page C5-486 

DC CSW DC CSW, Data or unified Cache line Clean by Set/Way on page C5-488 

DC CVAC DC CVAC, Data or unified Cache line Clean by VA to PoC on page C5-490 

DC CVADP DC CVADP, Data or unified Cache line Clean by VA to PoDP on page C5-492 

DC CVAP DC CVAP, Data or unified Cache line Clean by VA to PoP on page C5-494 

DC CVAU DC CVAU, Data or unified Cache line Clean by VA to PoU on page C5-496 

DC GVA DC GVA, Data Cache set Allocation Tag by VA on page C5-498 

DC GZVA DC GZVA, Data Cache set Allocation Tags and Zero by VA on page C5-500 

DC IGDSW DC IGDSW, Data, Allocation Tag or unified Cache line Invalidate of Data and Allocation 
Tags by Set/Way on page C5-502 

DC IGDVAC DC IGDVAC, Data, Allocation Tag or unified Cache line Invalidate of Allocation Tags by 
VA to PoC on page C5-504 

DC IGSW DC IGSW, Data, Allocation Tag or unified Cache line Invalidate of Allocation Tags by 
Set/Way on page C5-506 

DC IGVAC DCIGVAC, Data, Allocation Tag or unified Cache line Invalidate of Allocation Tags by VA 
to PoC on page C5-508 

DC ISW DC ISW, Data or unified Cache line Invalidate by Set/Way on page C5-510 

DC IVAC DC IVAC, Data or unified Cache line Invalidate by VA to PoC on page C5-512 

DC ZVA DC ZVA, Data Cache Zero by VA on page C5-514 
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Register Description, see 

DCZID_ELO DCZID_ELO, Data Cache Zero ID register on page D13-2917 

DISR_EL1 DISR_EL1, Deferred Interrupt Status Register on page D13-3648 

DIT DIT, Data Independent Timing on page C5-380 

DLR_ELO DLR_ELO, Debug Link Register on page D13-3466 

DSPSR_ELO DSPSR_ELO, Debug Saved Program Status Register on page D13-3467 
DVP RCTX DVP RCTX, Data Value Prediction Restriction by Context on page C5-746 
ELR EL1 ELR_EL], Exception Link Register (EL1) on page C5-383 

ELR_EL2 ELR_EL2, Exception Link Register (EL2) on page C5-386 

ELR_EL3 ELR_EL3, Exception Link Register (EL3) on page C5-389 

ERRIDR_EL1 ERRIDR_EL1, Error Record ID Register on page D13-3651 

ERRSELR_ EL1 ERRSELR_ELI, Error Record Select Register on page D13-3653 
ERXADDR EL1 ERXADDR EL], Selected Error Record Address Register on page D13-3655 
ERXCTLR_EL1 ERXCTLR_EL1, Selected Error Record Control Register on page D13-3657 
ERXFR_EL1 ERXFR_EL1, Selected Error Record Feature Register on page D13-3659 





ERXMISCO_EL1 


ERXMISCO_EL1, Selected Error Record Miscellaneous Register 0 on page D13-3661 





ERXMISC1_EL1 


ERXMISC1_EL1, Selected Error Record Miscellaneous Register 1 on page D13-3663 





ERXMISC2_EL1 


ERXMISC2_EL1, Selected Error Record Miscellaneous Register 2 on page D13-3665 





ERXMISC3_EL1 


ERXMISC3_EL1, Selected Error Record Miscellaneous Register 3 on page D13-3667 





ERXPFGCDN EL] 


ERXPFGCDN ELI, Selected Pseudo-fault Generation Countdown Register on 
page D13-3669 





ERXPFGCTL_EL1 


ERXPFGCTL_EL1, Selected Pseudo-fault Generation Control Register on 
page D13-3671 





ERXPFGF_EL1 


ERXPFGF_EL1, Selected Pseudo-fault Generation Feature Register on page D13-3673 





ERXSTATUS_EL1 


ERXSTATUS_EL1, Selected Error Record Primary Status Register on page D13-3675 























ESR _EL1 ESR_EL1, Exception Syndrome Register (EL1) on page D13-2919 
ESR_EL2 ESR_EL2, Exception Syndrome Register (EL2) on page D13-2958 
ESR_EL3 ESR_EL3, Exception Syndrome Register (EL3) on page D13-2997 
FAR_EL1 FAR_ELI, Fault Address Register (EL1) on page D13-3034 
FAR_EL2 FAR_EL2, Fault Address Register (EL2) on page D13-3038 
FAR_EL3 FAR_EL3, Fault Address Register (EL3) on page D13-3041 

FPCR FPCR, Floating-point Control Register on page C5-391 





FPEXC32_ EL2 


FPEXC32_EL2, Floating-Point Exception Control register on page D13-3043 





FPSR 
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Register Description, see 

GCR_EL1 GCR_ELI, Tag Control Register. on page D13-3049 

GMID_EL1 GMID_EL1, Multiple tag transfer ID register on page D13-3051 

HACR EL2 HACR_EL2, Hypervisor Auxiliary Control Register on page D13-3053 

HCR_EL2 HCR_EL2, Hypervisor Configuration Register on page D13-3055 

HPFAR_EL2 HAPFAR_EL2, Hypervisor IPA Fault Address Register on page D13-3083 

HSTR_EL2 HSTR_EL2, Hypervisor System Trap Register on page D13-3086 

IC IALLU IC IALLU, Instruction Cache Invalidate All to PoU on page C5-516 

IC IALLUIS IC IALLUIS, Instruction Cache Invalidate All to PoU, Inner Shareable on page C5-517 
IC IVAU IC IVAU, Instruction Cache line Invalidate by VA to PoU on page C5-518 





ID_AA64AFRO EL1 


ID_AA64AFRO_EL1, AArch64 Auxiliary Feature Register 0 on page D13-3089 





ID_AA64AFRI1 ELI 


ID_AA64AFRI_EL1, AArch64 Auxiliary Feature Register 1 on page D13-3091 





ID_AA64DFRO EL1 


ID_AA64DFRO_EL1, AArch64 Debug Feature Register 0 on page D13-3092 





ID_AA64DFR1_ EL1 


ID_AA64DFRI1_EL1, AArch64 Debug Feature Register 1 on page D13-3095 





ID_AA64ISARO EL1 


ID_AA64ISARO_EL1, AArch64 Instruction Set Attribute Register 0 on page D13-3096 





ID_AA64ISARI EL] 


ID_AA64ISARI1_EL1, AArch64 Instruction Set Attribute Register 1 on page D13-3101 





ID_AA64MMFRO EL1 


ID_AA64MMFRO_EL1, AArch64 Memory Model Feature Register 0 on page D13-3106 





ID_AA64MMEFRI1 EL1 


ID_AA64MMFRI1_EL1, AArch64 Memory Model Feature Register 1 on page D13-3110 





ID_AA64MMEFR2 EL1 


ID_AA64MMFR2_EL1, AArch64 Memory Model Feature Register 2 on page D13-3114 





ID_AA64PFRO_ EL] 


ID_AA64PFRO_EL1, AArch64 Processor Feature Register 0 on page D13-3120 





ID_AA64PFR1 EL] 


ID_AA64PFRI_EL1, AArch64 Processor Feature Register 1 on page D13-3125 





ID_AFRO ELI 


ID_AFRO_EL1, AArch32 Auxiliary Feature Register 0 on page D13-3128 





ID_DFRO ELI 


ID_DFRO_EL1, AArch32 Debug Feature Register 0 on page D13-3130 





ID_ISARO_EL1 


ID_ISARO_EL1, AArch32 Instruction Set Attribute Register 0 on page D13-3134 





ID_ISAR1 ELI 


ID_ISAR1_EL1, AArch32 Instruction Set Attribute Register 1 on page D13-3137 





ID_ISAR2 ELI 


ID_ISAR2_EL1, AArch32 Instruction Set Attribute Register 2 on page D13-3140 





ID_ISAR3_EL1 


ID_ISAR3_EL1, AArch32 Instruction Set Attribute Register 3 on page D13-3143 





ID_ISAR4 ELI 


ID_ISAR4_EL1, AArch32 Instruction Set Attribute Register 4 on page D13-3146 





ID_ISAR5 ELI 


ID_ISAR5_EL1, AArch32 Instruction Set Attribute Register 5 on page D13-3149 





ID_ISAR6_EL1 


ID_ISAR6_EL1, AArch32 Instruction Set Attribute Register 6 on page D13-3152 





ID_MMEFRO_EL1 


ID_MMFRO_EL1, AArch32 Memory Model Feature Register 0 on page D13-3155 





ID_MMER1 ELI 


ID_MMFRI1_ELI, AArch32 Memory Model Feature Register 1 on page D13-3158 





ID_MMER2_ ELI 
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Register 


ID_MMER3 ELI 


Description, see 


ID_MMFR3_EL1, AArch32 Memory Model Feature Register 3 on page D13-3165 





ID_MMFR4 ELI 


ID_MMFR4_EL1, AArch32 Memory Model Feature Register 4 on page D13-3169 






















































































ID_PFRO ELI ID_PFRO_EL1, AArch32 Processor Feature Register 0 on page D13-3173 
ID_PFR1 ELI ID_PFRI_EL1, AArch32 Processor Feature Register 1 on page D13-3176 
ID_PFR2 EL1 ID_PFR2_EL1, AArch32 Processor Feature Register 2 on page D13-3180 
IFSR32_EL2 IF SR32_EL2, Instruction Fault Status Register (EL2) on page D13-3182 
ISR_EL1 ISR_ELI, Interrupt Status Register on page D13-3187 

LORC EL1 LORC_EL1, LORegion Control (EL1) on page D13-3189 

LOREA EL1 LOREA_EL1, LORegion End Address (EL1) on page D13-3192 

LORID EL1 LORID_EL1, LORegionID (EL1) on page D13-3195 

LORN_EL1 LORN_EL1, LORegion Number (EL1) on page D13-3197 

LORSA_EL1 LORSA_EL1, LORegion Start Address (EL1) on page D13-3199 

MAIR ELI MAIR_EL1, Memory Attribute Indirection Register (EL1) on page D13-3202 
MAIR EL2 MAIR_EL2, Memory Attribute Indirection Register (EL2) on page D13-3206 
MAIR EL3 MAIR_EL3, Memory Attribute Indirection Register (EL3) on page D13-3210 
MDCCINT_EL1 MDCCINT_EL1, Monitor DCC Interrupt Enable Register on page D13-3474 
MDCCSR_ELO MDCCSR_ELO, Monitor DCC Status Register on page D13-3476 
MDCR_EL2 MDCR_EL2, Monitor Debug Configuration Register (EL2) on page D13-3478 
MDCR_EL3 MDCR_EL3, Monitor Debug Configuration Register (EL3) on page D13-3487 
MDRAR ELI MDRAR_EL1, Monitor Debug ROM Address Register on page D13-3495 
MDSCR_EL1 MDSCR_EL1, Monitor Debug System Control Register on page D13-3497 
MIDR ELI MIDR_ELI, Main ID Register on page D13-3213 

MPIDR ELI MPIDR_EL1, Multiprocessor Affinity Register on page D13-3216 

MVFRO EL1 MVFRO_EL1, AArch32 Media and VFP Feature Register 0 on page D13-3218 
MVFRI1 EL1 MVFRI1_EL1I, AArch32 Media and VFP Feature Register 1 on page D13-3222 
MVFR2 _ EL1 MVFR2_EL1, AArch32 Media and VFP Feature Register 2 on page D13-3226 
NZCV NZCYV, Condition Flags on page C5-400 

OSDLR_EL1 OSDLR_EL1, OS Double Lock Register on page D13-3502 

OSDTRRX_EL1 OSDTRRX_EL1, OS Lock Data Transfer Register, Receive on page D13-3504 





OSDTRTX_EL1 


OSDTRTX_EL1, OS Lock Data Transfer Register, Transmit on page D13-3506 








OSECCR_EL1 OSECCR_EL1, OS Lock Exception Catch Control Register on page D13-3508 
OSLAR_EL1 OSLAR_EL1, OS Lock Access Register on page D13-3510 
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Register Description, see 

OSLSR_EL1 OSLSR_EL1, OS Lock Status Register on page D13-3512 

PAN PAN, Privileged Access Never on page C5-402 

PAR EL1 PAR_ELI, Physical Address Register on page D13-3228 

PMBIDR_EL1 PMBIDR ELI, Profiling Buffer ID Register on page D13-3610 

PMBLIMITR_EL1 PMBLIMITR_EL1I, Profiling Buffer Limit Address Register on page D13-3613 
PMBPTR_EL1 PMBPTR_ ELI, Profiling Buffer Write Pointer Register on page D13-3615 

PMBSR _EL1 PMBSR_EL1, Profiling Buffer Status/syndrome Register on page D13-3617 
PMCCFILTR_ELO PMCCFILTR_ELO, Performance Monitors Cycle Count Filter Register on page D13-3527 
PMCCNTR_ELO PMCCNTR_ELO, Performance Monitors Cycle Count Register on page D13-3531 
PMCEIDO_ELO PMCEIDO_ELO, Performance Monitors Common Event Identification register 0 on 


page D13-3533 





PMCEID1 ELO 


PMCEID1_ELO, Performance Monitors Common Event Identification register 1 on 
page D13-3536 





PMCNTENCLR_ELO 


PMCNTENCLR_ELO, Performance Monitors Count Enable Clear register on 
page D13-3539 





PMCNTENSET_ELO 


PMCNTENSET ELO, Performance Monitors Count Enable Set register on page D13-3542 





PMCR_ELO 


PMCR_ELO, Performance Monitors Control Register on page D13-3545 





PMEVCNTR<n>_ELO 


PMEVCNTR<n>_ELO, Performance Monitors Event Count Registers, n = 0 - 30 on 
page D13-3550 





PMEVTYPER<n>_ELO 


PMEVTYPER<n>_ELO, Performance Monitors Event Type Registers, n = 0 - 30 on 
page D13-3553 





PMINTENCLR ELI 


PMINTENCLR_ELI, Performance Monitors Interrupt Enable Clear register on 
page D13-3558 





PMINTENSET EL1 


PMINTENSET _EL1, Performance Monitors Interrupt Enable Set register on 
page D13-3560 





PMMIR EL1 


PMMIR_EL1, Performance Monitors Machine Identification Register on page D13-3562 





PMOVSCLR_ELO 


PMOVSCLR_ELO, Performance Monitors Overflow Flag Status Clear Register on 
page D13-3563 





PMOVSSET_ELO 


PMOVSSET _ELO, Performance Monitors Overflow Flag Status Set register on 
page D13-3566 











PMSCR_EL1 PMSCR_EL1, Statistical Profiling Control Register (ELI) on page D13-3621 
PMSCR_EL2 PMSCR_EL2, Statistical Profiling Control Register (EL2) on page D13-3625 
PMSELR_ ELO PMSELR_ELO, Performance Monitors Event Counter Selection Register on 


page D13-3569 





PMSEVFR_EL1 


PMSEVFR_EL1, Sampling Event Filter Register on page D13-3629 








PMSFCR_EL1 
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Register Description, see 

PMSICR_EL1 PMSICR_EL1, Sampling Interval Counter Register on page D13-3637 
PMSIDR_ EL1 PMSIDR_EL1, Sampling Profiling ID Register on page D13-3640 
PMSIRR_EL1 PMSIRR_EL1, Sampling Interval Reload Register on page D13-3643 
PMSLATFR _EL1 PMSLATFR_EL1, Sampling Latency Filter Register on page D13-3645 





PMSWINC ELO 


PMSWINC_ELO, Performance Monitors Software Increment register on page D13-3572 





PMUSERENR_ELO 


PMUSERENR_ELO, Performance Monitors User Enable Register on page D13-3574 





PMXEVCNTR_ELO 


PMXEVCNTR_ELO, Performance Monitors Selected Event Count Register on 
page D13-3578 








PMXEVTYPER ELO 


PMXEVTYPER_ELO, Performance Monitors Selected Event Type Register on 
page D13-3581 



































REVIDR_ ELI REVIDR_ELI, Revision ID Register on page D13-3232 

RGSR_EL1 RGSR_EL1, Random Allocation Tag Seed Register. on page D13-3233 

RMR ELI RMR_EL1, Reset Management Register (EL1) on page D13-3235 

RMR_EL2 RMR_EL2, Reset Management Register (EL2) on page D13-3237 

RMR_EL3 RMR_EL3, Reset Management Register (EL3) on page D13-3239 

RNDR RNDR, Random Number on page D13-3241 

RNDRRS RNDRRS, Reseeded Random Number on page D13-3242 

RVBAR EL1 RVBAR_ELI, Reset Vector Base Address Register (if EL2 and EL3 not implemented) on 
page D13-3243 

RVBAR_ EL2 RVBAR_EL2, Reset Vector Base Address Register (if EL3 not implemented) on 
page D13-3244 

RVBAR_ EL3 RVBAR_EL3, Reset Vector Base Address Register (if EL3 implemented) on page D13-3245 





$3_<op1>_<Cn>_<Cm>_<op2> 





S3_<op1>_<Cn>_<Cm>_<op2>, IMPLEMENTATION DEFINED registers on 
page D13-3246 

















SCR_EL3 SCR_EL3, Secure Configuration Register on page D13-3248 

SCTLR_EL1 SCTLR_EL1, System Control Register (EL1) on page D13-3258 
SCTLR_EL2 SCTLR_EL2, System Control Register (EL2) on page D13-3274 
SCTLR_EL3 SCTLR_EL3, System Control Register (EL3) on page D13-3295 





SCXTNUM_ELO 


SCXTNUM_ELO, ELO Read/Write Software Context Number on page D13-3304 





SCXTNUM_EL1 


SCXTNUM_ELI, EL1 Read/Write Software Context Number on page D13-3306 





SCXTNUM_EL2 


SCXTNUM_EL2, EL2 Read/Write Software Context Number on page D13-3309 





SCXTNUM_EL3 


SCXTNUM_EL3, EL3 Read/Write Software Context Number on page D13-3312 








SDER32_EL2 SDER32_EL2, AArch32 Secure Debug Enable Register on page D13-3514 
SDER32_EL3 SDER32_EL3, AArch32 Secure Debug Enable Register on page D13-3516 
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Register Description, see 

SP_ELO SP_ELO, Stack Pointer (ELO) on page C5-404 

SP_EL1 SP_EL1, Stack Pointer (EL1) on page C5-406 

SP_EL2 SP_EL2, Stack Pointer (EL2) on page C5-408 

SP_EL3 SP_EL3, Stack Pointer (EL3) on page C5-410 

SPSel SPSel, Stack Pointer Select on page C5-411 

SPSR_abt SPSR_abt, Saved Program Status Register (Abort mode) on page C5-413 
SPSR_EL1 SPSR_EL1, Saved Program Status Register (EL1) on page C5-417 
SPSR_EL2 SPSR_EL2, Saved Program Status Register (EL2) on page C5-426 
SPSR_EL3 SPSR_EL3, Saved Program Status Register (EL3) on page C5-434 
SPSR_fiq SPSR_fig, Saved Program Status Register (FIQ mode) on page C5-441 
SPSR_irq SPSR_irg, Saved Program Status Register (IRQ mode) on page C5-445 
SPSR_und SPSR_und, Saved Program Status Register (Undefined mode) on page C5-449 
SSBS SSBS, Speculative Store Bypass Safe on page C5-453 

TCO TCO, Tag Check Override on page C5-455 

TCR_EL1 TCR_EL1, Translation Control Register (EL1) on page D13-3314 
TCR_EL2 TCR_EL2, Translation Control Register (EL2) on page D13-3327 
TCR_EL3 TCR_EL3, Translation Control Register (EL3) on page D13-3344 
TFSR_EL1 TFSR_EL1, Tag Fail Status Register (EL1). on page D13-3352 

TFSR_EL2 TFSR_EL2, Tag Fail Status Register (EL2). on page D13-3356 

TFSR_EL3 TFSR_EL3, Tag Fail Status Register (EL3). on page D13-3359 
TFSREO_EL1 TFSREO_EL1, Tag Fail Status Register (ELO). on page D13-3350 

TLBI ALLE1 TLBI ALLE1, TLB Invalidate All, EL] on page C5-544 

TLBI ALLEILIS TLBI ALLEIIS, TLB Invalidate All, EL1, Inner Shareable on page C5-545 
TLBI ALLEIOS TLBI ALLE1OS, TLB Invalidate All, EL1, Outer Shareable on page C5-546 
TLBI ALLE2 TLBI ALLE2, TLB Invalidate All, EL2 on page C5-547 

TLBI ALLE2IS TLBI ALLE2IS, TLB Invalidate All, EL2, Inner Shareable on page C5-548 
TLBI ALLE20S TLBI ALLE2OS, TLB Invalidate All, EL2, Outer Shareable on page C5-549 
TLBI ALLE3 TLBI ALLE3, TLB Invalidate All, EL3 on page C5-550 

TLBI ALLE3IS TLBI ALLE3IS, TLB Invalidate All, EL3, Inner Shareable on page C5-551 
TLBI ALLE308S TLBI ALLE3OS, TLB Invalidate All, EL3, Outer Shareable on page C5-552 
TLBI ASIDE1 TLBI ASIDE1, TLB Invalidate by ASID, EL] on page C5-553 

TLBI ASIDE1IS TLBI ASIDELIS, TLB Invalidate by ASID, EL1, Inner Shareable on page C5-555 
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Register Description, see 

TLBI ASIDE1OS TLBI ASIDEIOS, TLB Invalidate by ASID, EL1, Outer Shareable on page C5-557 

TLBI IPAS2E1 TLBI IPAS2E1, TLB Invalidate by Intermediate Physical Address, Stage 2, ELI] on 
page C5-559 

TLBI IPAS2E1IS TLBI IPAS2E1IS, TLB Invalidate by Intermediate Physical Address, Stage 2, ELI, Inner 
Shareable on page C5-562 

TLBI IPAS2E10S TLBI IPAS2E1OS, TLB Invalidate by Intermediate Physical Address, Stage 2, EL1, Outer 
Shareable on page C5-565 

TLBI IPAS2LE1 TLBIIPAS2LE1, TLB Invalidate by Intermediate Physical Address, Stage 2, Last level, EL1 
on page C5-568 

TLBI IPAS2LE1IS TLBI IPAS2LE1IS, TLB Invalidate by Intermediate Physical Address, Stage 2, Last level, 


ELI, Inner Shareable on page C5-571 





TLBI IPAS2LE10S 


TLBI IPAS2LE10OS, TLB Invalidate by Intermediate Physical Address, Stage 2, Last level, 
ELI, Outer Shareable on page C5-574 





























TLBI RIPAS2E1 TLBI RIPAS2E1, TLB Range Invalidate by Intermediate Physical Address, Stage 2, EL1 on 
page C5-577 

TLBI RIPAS2E1IS TLBI RIPAS2E1IS, TLB Range Invalidate by Intermediate Physical Address, Stage 2, EL1, 
Inner Shareable on page C5-580 

TLBI RIPAS2E10OS TLBI RIPAS2E10S, TLB Range Invalidate by Intermediate Physical Address, Stage 2, EL 1, 
Outer Shareable on page C5-583 

TLBI RIPAS2LE1 TLBI RIPAS2LE1, TLB Range Invalidate by Intermediate Physical Address, Stage 2, Last 
level, ELI on page C5-586 

TLBI RIPAS2LEIS TLBI RIPAS2LE1IS, TLB Range Invalidate by Intermediate Physical Address, Stage 2, Last 
level, ELI, Inner Shareable on page C5-589 

TLBI RIPAS2LE10S TLBI RIPAS2LE10S, TLB Range Invalidate by Intermediate Physical Address, Stage 2, 
Last level, ELI, Outer Shareable on page C5-592 

TLBI RVAAE1 TLBI RVAAE1, TLB Range Invalidate by VA, All ASID, EL1 on page C5-595 

TLBI RVAAEIIS TLBI RVAAEIS, TLB Range Invalidate by VA, All ASID, EL1, Inner Shareable on 
page C5-598 

TLBI RVAAEIOS TLBI RVAAEIOS, TLB Range Invalidate by VA, All ASID, EL1, Outer Shareable on 


page C5-601 





TLBI RVAALE1 


TLBI RVAALE1, TLB Range Invalidate by VA, All ASID, Last level, EL] on page C5-604 




















TLBI RVAALEIIS TLBI RVAALELIS, TLB Range Invalidate by VA, All ASID, Last Level, EL1, Inner 
Shareable on page C5-607 

TLBI RVAALE1OS TLBI RVAALE1OS, TLB Range Invalidate by VA, All ASID, Last Level, EL1, Outer 
Shareable on page C5-610 

TLBI RVAE1 TLBI RVAE1, TLB Range Invalidate by VA, EL1 on page C5-613 

TLBI RVAELUS TLBI RVAELIS, TLB Range Invalidate by VA, EL1, Inner Shareable on page C5-616 

TLBI RVAE1OS TLBI RVAE1OS, TLB Range Invalidate by VA, EL1, Outer Shareable on page C5-619 

TLBI RVAE2 TLBI RVAE2, TLB Range Invalidate by VA, EL2 on page C5-622 
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Table K14-6 Alphabetical index of AArch64 Registers (continued) 























Register Description, see 

TLBI RVAE2IS TLBI RVAE2IS, TLB Range Invalidate by VA, EL2, Inner Shareable on page C5-625 
TLBI RVAE208S TLBI RVAE2OS, TLB Range Invalidate by VA, EL2, Outer Shareable on page C5-628 
TLBI RVAE3 TLBI RVAE3, TLB Range Invalidate by VA, EL3 on page C5-631 

TLBI RVAE3IS TLBI RVAE3IS, TLB Range Invalidate by VA, EL3, Inner Shareable on page C5-633 
TLBI RVAE308S TLBI RVAE3OS, TLB Range Invalidate by VA, EL3, Outer Shareable on page C5-635 
TLBI RVALE1 TLBI RVALE1, TLB Range Invalidate by VA, Last level, EL] on page C5-637 

TLBI RVALELIS TLBI RVALELIS, TLB Range Invalidate by VA, Last level, EL1, Inner Shareable on 


page C5-640 





TLBI RVALE1OS 


TLBI RVALE1OS, TLB Range Invalidate by VA, Last level, ELI, Outer Shareable on 
page C5-643 





TLBI RVALE2 


TLBI RVALE2, TLB Range Invalidate by VA, Last level, EL2 on page C5-646 





TLBI RVALE2IS 


TLBI RVALE2IS, TLB Range Invalidate by VA, Last level, EL2, Inner Shareable on 
page C5-649 





TLBI RVALE208S 


TLBI RVALE20S, TLB Range Invalidate by VA, Last level, EL2, Outer Shareable on 
page C5-652 





TLBI RVALE3 


TLBI RVALE3, TLB Range Invalidate by VA, Last level, EL3 on page C5-655 





TLBI RVALE3IS 


TLBI RVALE3IS, TLB Range Invalidate by VA, Last level, EL3, Inner Shareable on 
page C5-657 





TLBI RVALE308S 


TLBI RVALE3OS, TLB Range Invalidate by VA, Last level, EL3, Outer Shareable on 
page C5-659 









































TLBI VAAE1 TLBI VAAE1, TLB Invalidate by VA, All ASID, EL1 on page C5-661 

TLBI VAAEIIS TLBI VAAELIS, TLB Invalidate by VA, All ASID, EL1, Inner Shareable on page C5-664 

TLBI VAAE1OS TLBI VAAE1OS, TLB Invalidate by VA, All ASID, EL1, Outer Shareable on page C5-667 

TLBI VAALE1 TLBI VAALE1, TLB Invalidate by VA, All ASID, Last level, EL] on page C5-670 

TLBI VAALEIIS TLBI VAALELIS, TLB Invalidate by VA, All ASID, Last Level, EL1, Inner Shareable on 
page C5-673 

TLBI VAALEIOS TLBI VAALE1OS, TLB Invalidate by VA, All ASID, Last Level, EL1, Outer Shareable on 
page C5-676 

TLBI VAE1 TLBI VAE1, TLB Invalidate by VA, ELI on page C5-679 

TLBI VAE1IS TLBI VAEIS, TLB Invalidate by VA, EL1, Inner Shareable on page C5-682 

TLBI VAE1OS TLBI VAE1OS, TLB Invalidate by VA, ELI, Outer Shareable on page C5-685 

TLBI VAE2 TLBI VAE2, TLB Invalidate by VA, EL2 on page C5-688 

TLBI VAE2IS TLBI VAE2IS, TLB Invalidate by VA, EL2, Inner Shareable on page C5-691 

TLBI VAE208S TLBI VAE2OS, TLB Invalidate by VA, EL2, Outer Shareable on page C5-694 

TLBI VAE3 TLBI VAE3, TLB Invalidate by VA, EL3 on page C5-697 
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Table K14-6 Alphabetical index of AArch64 Registers (continued) 































































































Register Description, see 

TLBI VAE3IS TLBI VAE3IS, TLB Invalidate by VA, EL3, Inner Shareable on page C5-699 

TLBI VAE308S TLBI VAE3OS, TLB Invalidate by VA, EL3, Outer Shareable on page C5-701 

TLBI VALE1 TLBI VALE1, TLB Invalidate by VA, Last level, EL] on page C5-703 

TLBI VALEIS TLBI VALEIIS, TLB Invalidate by VA, Last level, EL1, Inner Shareable on page C5-706 

TLBI VALEIOS TLBI VALE1OS, TLB Invalidate by VA, Last level, EL1, Outer Shareable on page C5-709 

TLBI VALE2 TLBI VALE2, TLB Invalidate by VA, Last level, EL2 on page C5-712 

TLBI VALE2IS TLBI VALE2IS, TLB Invalidate by VA, Last level, EL2, Inner Shareable on page C5-715 

TLBI VALE20S TLBI VALE2OS, TLB Invalidate by VA, Last level, EL2, Outer Shareable on page C5-718 

TLBI VALE3 TLBI VALE3, TLB Invalidate by VA, Last level, EL3 on page C5-721 

TLBI VALE3IS TLBI VALE3IS, TLB Invalidate by VA, Last level, EL3, Inner Shareable on page C5-723 

TLBI VALE30S TLBI VALE3OS, TLB Invalidate by VA, Last level, EL3, Outer Shareable on page C5-725 

TLBI VMALLEI1 TLBI VMALLE1, TLB Invalidate by VMID, All at stage 1, ELI on page C5-727 

TLBI VMALLEIIS TLBI VMALLEIIS, TLB Invalidate by VMID, All at stage 1, EL1, Inner Shareable on 
page C5-729 

TLBI VMALLEI1OS TLBI VMALLEIOS, TLB Invalidate by VMID, All at stage 1, EL1, Outer Shareable on 
page C5-731 

TLBI VMALLS12E1 TLBI VMALLS12E1, TLB Invalidate by VMID, All at Stage 1 and 2, EL1 on page C5-733 

TLBI VMALLS12E1IS TLBI VMALLS12E1IS, TLB Invalidate by VMID, All at Stage 1 and 2, EL1, Inner 
Shareable on page C5-735 

TLBI VMALLS12E10S TLBI VMALLS12E10S, TLB Invalidate by VMID, All at Stage 1 and 2, ELI, Outer 
Shareable on page C5-737 

TPIDR_ELO TPIDR_ELO, ELO Read/Write Software Thread ID Register on page D13-3361 

TPIDR_EL1 TPIDR_EL1, EL1 Software Thread ID Register on page D13-3363 

TPIDR_EL2 TPIDR_EL2, EL2 Software Thread ID Register on page D13-3365 

TPIDR_EL3 TPIDR_EL3, EL3 Software Thread ID Register on page D13-3367 

TPIDRRO_ ELO TPIDRRO_ELO, ELO Read-Only Software Thread ID Register on page D13-3369 

TRFCR_EL1 TRFCR_ELI, Trace Filter Control Register (EL1) on page D13-3518 

TRFCR_EL2 TRFCR_EL2, Trace Filter Control Register (EL2) on page D13-3522 

TTBRO_EL1 TTBRO_EL1, Translation Table Base Register 0 (ELI) on page D13-3371 

TTBRO_EL2 TTBRO_EL2, Translation Table Base Register 0 (EL2) on page D13-3376 

TTBRO_EL3 TTBRO_EL3, Translation Table Base Register 0 (EL3) on page D13-3381 

TTBR1_EL1 TTBR1_EL1, Translation Table Base Register 1 (EL1) on page D13-3384 

TTBR1_EL2 TTBR1_EL2, Translation Table Base Register 1 (EL2) on page D13-3389 

UAO UAO, User Access Override on page C5-457 
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Table K14-6 Alphabetical index of AArch64 Registers (continued) 






































Register Description, see 

VBAR_EL1 VBAR_ELI, Vector Base Address Register (EL1) on page D13-3394 

VBAR_EL2 VBAR_EL2, Vector Base Address Register (EL2) on page D13-3397 

VBAR_EL3 VBAR_EL3, Vector Base Address Register (EL3) on page D13-3400 

VDISR_EL2 VDISR_EL2, Virtual Deferred Interrupt Status Register on page D13-3677 
VMPIDR_EL2 VMPIDR_EL2, Virtualization Multiprocessor ID Register on page D13-3402 
VNCR_EL2 VNCR_EL2, Virtual Nested Control Register on page D13-3406 

VPIDR_EL2 VPIDR_EL2, Virtualization Processor ID Register on page D13-3408 
VSESR_EL2 VSESR_EL2, Virtual SError Exception Syndrome Register on page D13-3682 
VSTCR_EL2 VSTCR_EL2, Virtualization Secure Translation Control Register on page D13-3412 
VSTTBR_EL2 VSTTBR_EL2, Virtualization Secure Translation Table Base Register on page D13-3416 
VTCR_EL2 VTCR_EL2, Virtualization Translation Control Register on page D13-3419 
VTTBR_EL2 VTTBR_EL2, Virtualization Translation Table Base Register on page D13-3425 





ARM DDI 0487E.a 


ID070919 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K14-7829 


Non-Confidential 


Registers Index 
K14.3 Functional index of AArch64 registers and System instructions 


K14.3 Functional index of AArch64 registers and System instructions 


This section is an index of the AArch64 registers and System instructions, divided by functional group. Each of the 
following sections lists the registers for a functional group: 


$ Special-purpose registers. 

7 VMSA-specific registers on page K14-7831. 

° ID registers on page K14-7832. 

e Performance monitors registers on page K14-7833. 
° Debug registers on page K14-7834. 

e RAS registers on page K14-7835. 

$ Generic timer registers on page K14-7835. 


e Cache maintenance system instructions on page K14-7836. 

. Address translation system instructions on page K14-7837. 

: TLB maintenance system instructions on page K14-7838. 

° Prediction restriction System instructions on page K14-7840. 


° Base system registers on page K14-7841. 


K14.3.1 Special-purpose registers 


This section is an index to the registers in the Special-purpose registers functional group. 


Table K14-7 Special-purpose registers 


















































Register Description, see 

ELR_EL1 ELR EL1 

ELR_EL2 ELR_EL2 

ELR_EL3 ELR_EL3 

SP_ELO SP_ELO 

SP_ELI SP_EL1 

SP_EL2 SP_EL2 

SP_EL3 SP_EL3 

SPSR_abt SPSR_abt 

SPSR_EL1 SPSR_EL1 

SPSR_EL2 SPSR_EL2 

SPSR_EL3 SPSR_EL3 

SPSR_fiq SPSR_fiq 

SPSR_irq SPSR_irq 

SPSR_und SPSR_und 
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K14.3 Functional index of AArch64 registers and System instructions 


This section is an index to the registers in the Virtual memory control registers functional group. 


Table K14-8 VMSA-specific registers 














Register Description, see 
AMAIR ELI AMAIR ELI 
AMAIR EL2 AMAIR EL2 
AMAIR EL3 AMAIR EL3 





CONTEXTIDR ELI 


CONTEXTIDR_ EL1 





CONTEXTIDR_EL2 


CONTEXTIDR_EL2 



























































DACR32_EL2 DACR32_EL2 
LORC_ELI LORC_ELI 
LOREA EL! LOREA ELI 
LORID EL1 LORID EL1 
LORN EL! LORN ELI 
LORSA_EL1 LORSA _EL1 
MAIR ELl MAIR ELl 
MAIR EL2 MAIR EL2 
MAIR EL3 MAIR EL3 
TCR_ELI TCR_ELI 
TCR_EL2 TCR_EL2 
TCR_EL3 TCR_EL3 
TTBRO_ELI1 TTBRO_ELI1 
TTBRO_EL2 TTBRO_EL2 
TTBRO_EL3 TTBRO_EL3 
TTBRI_ELI1 TTBR1_ELI1 
TTBRI_EL2 TTBR1_EL2 
VTCR_EL2 VTCR_EL2 
VTTBR_EL2 VTTBR_EL2 
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K14.3.3 ID registers 


This section is an index to the registers in the Identification registers functional group. 


Table K14-9 ID registers 


























Register Description, see 
CCSIDR2_EL1 CCSIDR2_EL1 
CCSIDR_EL1 CCSIDR_ELI1 
CLIDR_EL1 CLIDR ELI 
CSSELR_EL1 CSSELR_EL1 
CTR_ELO CTR_ELO 
DCZID_ELO DCZID_ELO 
GMID_EL1 GMID_EL1 





ID_AA64AFRO EL1 


ID_AA64AFRO EL1 





ID_AA64AFRI ELI 


ID_AA64AFRI ELI 





ID_AA64DFRO EL1 


ID_AA64DFRO EL1 





ID_AA64DFR1_ EL1 


ID_AA64DFRI EL1 





ID_AA64ISARO EL1 


ID_AA64ISARO EL1 





ID_AA64ISARI EL] 


ID_AA64ISARI EL] 





ID_AA64MMFRO EL1 


ID_AA64MMFRO EL1 





ID_AA64MMEFRI1 EL1 


ID_AA64MMFRI1 EL1 





ID_AA64MMFR2 EL1 


ID_AA64MMFR2 EL] 





ID_AA64PFRO_ EL] 


ID_AA64PFRO_ EL] 





ID_AA64PFR1 EL] 


ID_AA64PFR1_ EL] 





ID_AFRO ELI 


ID_AFRO ELI 





ID_DFRO ELI 


ID_DFRO ELI 





ID_ISARO_EL1 


ID ISARO ELI 





ID_ISAR1 ELI 


ID ISAR1 ELI 





ID_ISAR2 FLI 


ID_ISAR2 ELI 





ID_ISAR3_EL1 


ID ISAR3 ELI 





ID_ISAR4 ELI 


ID_ISAR4 ELI 





ID_ISAR5 ELI 


ID ISAR5 ELI 





ID_ISAR6_EL1 


ID_ISAR6 ELI 





ID_MMERO_EL1 


ID_MMFRO_EL1 





ID_MMERI1 ELI 


ID_MMERI ELI 





ID_MMFR2 ELI 
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Table K14-9 ID registers (continued) 





Register 


ID_MMER3 ELI 


Description, see 


ID MMFR3 ELI 





ID_ MMFR4 ELI 


ID MMFR4 EL! 




















ID_PFRO_ELI ID_PFRO_ELI 
ID_PFRI_ELI ID_PFRI_ELI 
ID_PFR2 ELI ID PFR2 ELI 
MIDR EL! MIDR EL1 
MPIDR_EL1 MPIDR_EL1 
REVIDR EL! REVIDR_EL1 





K14.3.4 Performance monitors registers 


This section is an index to the registers in the Performance Monitors registers functional group. 


Table K14-10 Performance monitors registers 
























































Register Description, see 
PMCCFILTR_ELO PMCCFILTR_ELO 
PMCCNTR_ELO PMCCNTR_ELO 
PMCEIDO_ELO PMCEIDO_ELO 
PMCEID1_ELO PMCEID1_ ELO 
PMCNTENCLR_ELO PMCNTENCLR_ELO 
PMCNTENSET_ELO PMCNTENSET_ ELO 
PMCR_ELO PMCR_ELO 
PMEVCNTR<n>_ELO PMEVCNTR<n>_ELO 
PMEVTYPER<n>_ELO PMEVTYPER<n>_ELO 
PMINTENCLR ELI PMINTENCLR_EL1 
PMINTENSET EL1 PMINTENSET_ EL1 
PMMIR EL1 PMMIR ELI 
PMOVSCLR_ELO PMOVSCLR_ELO 
PMOVSSET_ELO PMOVSSET_ELO 
PMSELR_ELO PMSELR_ELO 
PMSWINC_ELO PMSWINC_ELO 
PMUSERENR_ELO PMUSERENR ELO 





PMXEVCNTR_ELO 


PMXEVCNTR_ELO 








PMXEVTYPER ELO 





PMXEVTYPER_ELO 
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K14.3.5 Debug registers 


This section is an index to the registers in the Debug registers functional group. 


Table K14-11 Debug registers 





Register 


Description, see 





DBGAUTHSTATUS_EL1 


DBGAUTHSTATUS EL1 





DBGBCR<n>_EL1 


DBGBCR<n>_EL1 





DBGBVR<n>_EL1 


DBGBVR<n>_EL1 





DBGCLAIMCLR_ EL1 


DBGCLAIMCLR EL1 





DBGCLAIMSET EL1 


DBGCLAIMSET EL1 





DBGDTR_ELO 


DBGDTR_ELO 





DBGDTRRX_ELO 


DBGDTRRX_ELO 





DBGDTRTX_ELO 


DBGDTRTX_ELO 





DBGPRCR EL1 


DBGPRCR _EL1 





DBGVCR32_EL2 


DBGVCR32_EL2 





DBGWCR<n>_EL1 


DBGWCR<n>_EL1 





DBGWVR<n>_EL1 


DBGWVR<n>_EL1 


























DLR_ELO DLR_ELO 
DSPSR_ELO DSPSR_ELO 
MDCCINT_EL1 MDCCINT_EL1 
MDCCSR_ELO MDCCSR_ELO 
MDRAR ELI MDRAR ELI 
MDSCR_ELI MDSCR ELI 
OSDLR_ELI OSDLR_ELI 
OSDTRRX_ELI1 OSDTRRX_EL1 





OSDTRTX_EL1 


OSDTRTX_EL1 

















OSECCR_EL1 OSECCR_EL1 
OSLAR_EL1 OSLAR_EL1 
OSLSR_EL1 OSLSR_EL1 
TRFCR_EL1 TRFCR_ ELI 
TRFCR_EL2 TRFCR EL2 
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This section is an index to the registers in the RAS registers functional group. 


Table K14-12 RAS registers 























Register Description, see 
DISR_EL1 DISR_EL1 
ERRIDR_EL1 ERRIDR_ ELI 
ERRSELR_EL1 ERRSELR ELI 
ERXADDR EL! ERXADDR _EL1 
ERXCTLR_EL1 ERXCTLR_EL1 
ERXFR_EL1 ERXFR_EL1 





ERXMISCO_EL1 


ERXMISCO_EL1 





ERXMISC1_EL1 


ERXMISC1_EL1 





ERXMISC2_EL1 


ERXMISC2_ EL1 





ERXMISC3_EL1 


ERXMISC3_EL1 





ERXPFGCDN _EL1 


ERXPFGCDN_EL1 





ERXPFGCTL _EL1 


ERXPFGCTL, ELI 





ERXPFGF_ EL1 


ERXPFGF ELI 





ERXSTATUS _EL1 


ERXSTATUS_EL1 





VDISR_EL2 


VDISR_EL2 





VSESR_EL2 


VSESR_EL2 





K14.3.7 Generic timer registers 


This section is an index to the registers in the Generic Timer registers functional group. 


Table K14-13 Generic timer registers 












































Register Description, see 
CNTFRQ_ ELO CNTFRQ_ELO 
CNTHV_CTL_EL2 CNTHV_CTL_EL2 
CNTHV_CVAL_EL2 CNTHV_CVAL_EL2 
CNTHV_TVAL _EL2 CNTHV_TVAL_EL2 
CNTHVS_CTL_EL2 CNTHVS_CTL_EL2 
CNTHVS_CVAL EL2 CNTHVS_CVAL_EL2 
CNTHVS_TVAL _EL2 CNTHVS_TVAL_EL2 
CNTKCTL _EL1 CNTKCTL. ELI 
CNTP_CTL_ELO CNTP CTL ELO 
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Table K14-13 Generic timer registers (continued) 















































Register Description, see 
CNTP_CVAL_ELO CNTP_CVAL_ELO 
CNTP_TVAL_ELO CNTP_TVAL_ELO 
CNTPCT_ELO CNTPCT_ELO 
CNTPS_CTL_EL1 CNTPS_CTL_EL1 
CNTPS_CVAL_EL1 CNTPS_CVAL_EL1 
CNTPS_TVAL_EL1 CNTPS_TVAL_EL1 
CNTV_CTL_ELO CNTV_CTL_ELO 
CNTV_CVAL_ELO CNTV_CVAL_ELO 
CNTV_TVAL_ELO CNTV_TVAL_ELO 
CNTVCT_ELO CNTVCT_ELO 
K14.3.8 Cache maintenance system instructions 


This section is an index to the registers in the Cache maintenance instructions functional group. 


Table K14-14 Cache maintenance system instructions 
























































Register Description, see 

DC CGDSW DC CGDSW 

DC CGDVAC DC CGDVAC 

DC CGDVADP DC CGDVADP 

DC CGDVAP DC CGDVAP 

DC CGSW DC CGSW 

DC CGVAC DC CGVAC 

DC CGVADP DC CGVADP 

DC CGVAP DC CGVAP 

DC CIGDSW DC CIGDSW 

DC CIGDVAC DC CIGDVAC 

DC CIGSW DC CIGSW 

DC CIGVAC DC CIGVAC 

DC CISW DC CISW 

DC CIVAC DC CIVAC 

DC CSW DC CSW 

DC CVAC DC CVAC 

DC CVADP DC CVADP 
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Table K14-14 Cache maintenance system instructions (continued) 



















































































Register Description, see 
DC CVAP DC CVAP 
DC CVAU DC CVAU 
DC GVA DC GVA 
DC GZVA DC GZVA 
DC IGDSW DC IGDSW 
DC IGDVAC DC IGDVAC 
DC IGSW DC IGSW 
DC IGVAC DC IGVAC 
DC ISW DC ISW 
DC IVAC DC IVAC 
DC ZVA DC ZVA 
IC IALLU IC IALLU 
IC IALLUIS IC IALLUIS 
IC IVAU IC IVAU 
K14.3.9 Address translation system instructions 
This section is an index to the registers in the Address translation instructions functional group. 
Table K14-15 Address translation system instructions 
Register Description, see 
AT S12E0R AT S12E0R 
AT S12EOW AT S12EOW 
AT S12E1IR AT S12EIR 
AT S12E1W AT S12E1W 
AT SIEOR AT S1IEOR 
AT SIEOW AT SIEOW 
AT SIEIR AT SIEIR 
AT SIEIRP AT SIEIRP 
AT SIEIW AT SIEIW 
AT S1E1 WP AT SIE1WP 
AT S1E2R AT SIE2R 
ARM DDI 0487E.a Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. K14-7837 


ID070919 Non-Confidential 


Registers Index 


K14.3 Functional index of AArch64 registers and System instructions 


Table K14-15 Address translation system instructions (continued) 











Register Description, see 
AT SIE2W AT SIE2W 
AT SIE3R AT SIE3R 
AT SIE3W AT SIE3W 





K14.3.10 TLB maintenance system instructions 


This section is an index to the registers in the TLB maintenance instructions functional group. 


Table K14-16 TLB maintenance system instructions 













































































Register Description, see 
TLBI ALLE1 TLBI ALLE1 
TLBI ALLE1IS TLBI ALLELS 
TLBI ALLE1OS TLBI ALLE1OS 
TLBI ALLE2 TLBI ALLE2 
TLBI ALLE2IS TLBI ALLE2IS 
TLBI ALLE20S TLBI ALLE20S 
TLBI ALLE3 TLBI ALLE3 
TLBI ALLE3IS TLBI ALLE3IS 
TLBI ALLE30S TLBI ALLE30S 
TLBI ASIDE1 TLBI ASIDE1 
TLBI ASIDEIS TLBI ASIDEIIS 
TLBI ASIDE10S TLBI ASIDE1OS 
TLBI IPAS2E1 TLBI IPAS2E1 
TLBI IPAS2E1IS TLBI IPAS2E1IS 
TLBI IPAS2E1OS TLBI IPAS2E10S 
TLBI IPAS2LE1 TLBI IPAS2LE1 
TLBI IPAS2LEIIS TLBI IPAS2LE1IS 
TLBI IPAS2LE10S TLBI IPAS2LE10S 
TLBI RIPAS2E1 TLBI RIPAS2E1 
TLBI RIPAS2E1IS TLBI RIPAS2E1IS 
TLBI RIPAS2E10S TLBI RIPAS2E10S 
TLBI RIPAS2LE1 TLBI RIPAS2LE1 
TLBI RIPAS2LEIS TLBI RIPAS2LEIIS 
TLBI RIPAS2LE10S TLBI RIPAS2LE10S 
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Table K14-16 TLB maintenance system instructions (continued) 


































































































Register Description, see 
TLBI RVAAE1 TLBI RVAAE1 
TLBI RVAAEIIS TLBI RVAAELS 
TLBI RVAAEIOS TLBI RVAAE1OS 
TLBI RVAALE1 TLBI RVAALE1 
TLBI RVAALEILS TLBI RVAALEIS 
TLBI RVAALE1OS TLBI RVAALEIOS 
TLBI RVAE1 TLBI RVAE1 
TLBI RVAEIIS TLBI RVAELS 
TLBI RVAEIOS TLBI RVAE1OS 
TLBI RVAE2 TLBI RVAE2 
TLBI RVAE2IS TLBI RVAE2IS 
TLBI RVAE20S TLBI RVAE20S 
TLBI RVAE3 TLBI RVAE3 
TLBI RVAE3IS TLBI RVAE3IS 
TLBI RVAE30S TLBI RVAE30S 
TLBI RVALE1 TLBI RVALE1 
TLBI RVALE1IS TLBI RVALELUS 
TLBI RVALE1OS TLBI RVALEIOS 
TLBI RVALE2 TLBI RVALE2 
TLBI RVALEZ2IS TLBI RVALE2IS 
TLBI RVALE20S TLBI RVALE20S 
TLBI RVALE3 TLBI RVALE3 
TLBI RVALE3IS TLBI RVALE3IS 
TLBI RVALE30S TLBI RVALE30S 
TLBI VAAE1 TLBI VAAE1 
TLBI VAAEIS TLBI VAAEIIS 
TLBI VAAE10S TLBI VAAE1OS 
TLBI VAALE1 TLBI VAALE1 
TLBI VAALEIS TLBI VAALEIIS 
TLBI VAALEIOS TLBI VAALE10S 
TLBI VAE1 TLBI VAE1 

TLBI VAEIIS TLBI VAES 
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Table K14-16 TLB maintenance system instructions (continued) 
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Register Description, see 
TLBI VAEIOS TLBI VAE1OS 
TLBI VAE2 TLBI VAE2 
TLBI VAE2IS TLBI VAE2IS 
TLBI VAE20S TLBI VAE20S 
TLBI VAE3 TLBI VAE3 
TLBI VAE3IS TLBI VAE3IS 
TLBI VAE30S TLBI VAE30S 
TLBI VALE1 TLBI VALE1 
TLBI VALEIIS TLBI VALEIIS 
TLBI VALEI1OS TLBI VALE1OS 
TLBI VALE2 TLBI VALE2 
TLBI VALEZ2IS TLBI VALEZ2IS 
TLBI VALE20S TLBI VALE20S 
TLBI VALE3 TLBI VALE3 
TLBI VALE3IS TLBI VALE3IS 
TLBI VALE30S TLBI VALE30S 
TLBI VMALLEI1 TLBI VMALLE1 
TLBI VMALLEIIS TLBI VMALLEILS 
TLBI VMALLEIOS TLBI VMALLE1OS 
TLBI VMALLS12E1 TLBI VMALLS12E1 
TLBI VMALLS12E1IS TLBI VMALLS12E1IS 
TLBI VMALLS12E10S TLBI VMALLS12E10S 
K14.3.11 Prediction restriction System instructions 
This section is an index to the registers in the prediction restrictioninstructionsrestriction instructions functional 
group. 
Table K14-17 Prediction restriction System instructions 
Register Description, see 
CFP RCTX CFP RCTX 
CPP RCTX CPP RCTX 
DVP RCTX DVP RCTX 
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system registers 


This section is an index to the registers in the functional group. 


Table K14-18 Base system registers 



































Register Description, see 
ACTLR_EL1 ACTLR ELI 
ACTLR_EL2 ACTLR_EL2 
ACTLR_EL3 ACTLR ELS 
AFSRO_EL1 AFSRO_EL1 
AFSRO_EL2 AFSRO_EL2 
AFSRO_EL3 AFSRO_EL3 
AFSRI ELI AFSR1 ELI] 
AFSRI_ EL2 AFSR1_ EL2 
AFSR1_EL3 AFSR1_EL3 
AIDR_EL!1 AIDR EL1 





MCFGR_ELO 





MCGCR_ELO 





MCNTENCLRO_ELO 


MCNTENCLRO_ELO 





MCNTENCLR1_ELO 


MCNTENCLR1_ELO 





MCNTENSETO_ELO 


MCNTENSETO_ELO 








z 


CR_ELO 


MCR_ELO 





MEVCNTRO<n>_ELO 


MEVCNTRO<n>_ELO 





MEVCNTR1<n>_ELO 


MEVCNTRI1<n>_ELO 





MEVTYPERO<n>_EL0 


MEVTYPERO<n>_ELO 





MEVTYPER1<n>_ELO 


MEVTYPER1<n>_ELO 








MUSERENR_ ELO 


A 
A 
A 
A 
A 
AMCNTENSET1_ELO 
A 
A 
A 
A 
A 
A 


A 
A 
A 
A 
A 
AMCNTENSET1 ELO 
A 
A 
A 
A 
A 
A 





MUSERENR_ ELO 





APDAKeyHi_EL1 


APDAKeyHi_EL1 





APDAKeyLo_EL1 


APDAKeyLo_ ELI 





APDBKeyHi_EL1 


APDBKeyHi_ ELI 





APDBKeyLo_EL1 


APDBKeyLo_EL1 





APGAKeyHi_EL1 


APGAKeyHi_EL1 





APGAKeyLo_EL1 


APGAKeyLo_ ELI 





APIAKeyHi_EL1 


APIAKeyHi EL1 





APIAKeyLo_EL1 
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Table K14-18 Base system registers (continued) 





Register 


Description, see 


APIBKeyHi_EL1 


APIBKeyHi_EL1 





APIBKeyLo_EL1 


APIBKeyLo_EL1 













































































CNTHCTL_EL2 CNTHCTL EL2 
CNTHP_ CTL_EL2 CNTHP CTL. EL2 
CNTHP_CVAL EL2 CNTHP_CVAL EL2 
CNTHP_TVAL_EL2 CNTHP_TVAL EL2 
CNTHPS_ CTL_EL2 CNTHPS. CTL. EL2 
CNTHPS CVAL EL2 CNTHPS _CVAL EL2 
CNTHPS TVAL_ EL2 CNTHPS_TVAL EL2 
CNTVOFF_EL2 CNTVOFF EL2 
CPACR_EL1 CPACR_EL1 
CPTR_EL2 CPTR_EL2 
CPTR_EL3 CPTR_EL3 
CurrentEL CurrentEL 

DAIF DAIF 

DIT DIT 

ESR _EL1 ESR EL! 

ESR_EL2 ESR_EL2 

ESR_EL3 ESR_EL3 

FAR _ ELI FAR _EL1 

FAR_EL2 FAR_EL2 

FAR_EL3 FAR_EL3 

FPCR FPCR 





FPEXC32_ EL2 


FPEXC32_EL2 


























FPSR FPSR 
GCR_EL1 GCR ELI 
HACR_EL2 HACR_EL2 
HCR_EL2 HCR_EL2 
HPFAR_EL2 HPFAR_EL2 
HSTR_EL2 HSTR_EL2 
IFSR32_EL2 IFSR32_EL2 
ISR_EL1 ISR_EL1 
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Table K14-18 Base system registers (continued) 











































































































Register Description, see 
MDCR_EL2 MDCR_EL2 
MDCR_EL3 MDCR_EL3 
MVFRO_EL1 MVFRO ELI 
MVFRI1_EL1 MVFRI ELI 
MVFR2_ EL1 MVFR2 ELI 
NZCV NZCV 

PAN PAN 

PAR ELI PAR ELI 
PMBIDR_ ELI PMBIDR_EL1 
PMBLIMITR ELI PMBLIMITR_EL1 
PMBPTR_EL1 PMBPTR_ ELI 
PMBSR_EL1 PMBSR_ ELI 
PMSCR_EL1 PMSCR ELI 
PMSCR_EL2 PMSCR_EL2 
PMSEVFR_ EL1 PMSEVFR ELI 
PMSFCR_EL1 PMSFCR ELI 
PMSICR_EL1 PMSICR_EL1 
PMSIDR ELI PMSIDR_EL1 
PMSIRR_ ELI PMSIRR_ ELI 
PMSLATFR_EL1 PMSLATFR _EL1 
RGSR_ELI RGSR_ELI 

RMR ELI RMR ELI 

RMR EL2 RMR EL2 

RMR _EL3 RMR EL3 
RNDR RNDR 

RNDRRS RNDRRS 
RVBAR ELI RVBAR ELI 
RVBAR_ EL2 RVBAR_EL2 
RVBAR EL3 RVBAR_EL3 





$3_<op1>_<Cn>_<Cm>_<op2> 





$3_<op1>_<Cn>_<Cm>_<op2> 








SCR_EL3 


SCR_EL3 





SCTLR_ELI 
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Table K14-18 Base system registers (continued) 








Register Description, see 
SCTLR_EL2 SCTLR_EL2 
SCTLR_EL3 SCTLE EL3 





SCXTNUM_ELO 


SCXTNUM_ELO 





SCXTNUM_EL1 


SCXTNUM_EL1 





SCXTNUM_EL2 


SCXTNUM_EL2 





SCXTNUM_EL3 


SCXTNUM_EL3 







































































SDER32_EL2 SDER32_EL2 
SDER32_EL3 SDER32_EL3 
SPSel SPSel 
SSBS SSBS 
TCO TCO 
TFSR_EL1 TFSR_EL1 
TFSR_EL2 TFSR_EL2 
TFSR_EL3 TFSR_EL3 
TFSREO EL1 TFSREO ELI 
TPIDR_ELO TPIDR_ELO 
TPIDR_EL1 TPIDR_EL1 
TPIDR_EL2 TPIDR_EL2 
TPIDR_EL3 TPIDR_EL3 
TPIDRRO_ELO TPIDRRO_ELO 
UAO UAO 
VBAR_EL1 VBAR_EL1 
VBAR_EL2 VBAR_EL2 
VBAR_EL3 VBAR_EL3 
VMPIDR_EL2 VMPIDR_EL2 
VNCR_EL2 VNCR_EL2 
VPIDR_EL2 VPIDR_EL2 
VSTCR_EL2 VSTCR_EL2 
VSTTBR_EL2 VSTTBR_EL2 
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K14.4 Alphabetical index of AArch32 registers and System instructions 


This section is an index of AArch32 registers and System instructions in alphabetical order. 


Table K14-19 Alphabetical index of AArch32 Registers 




























































































Register Description, see 
ACTLR ACTLR, Auxiliary Control Register on page G8-5908 
ACTLR2 ACTLR2, Auxiliary Control Register 2 on page G8-5910 
ADFSR ADFSR, Auxiliary Data Fault Status Register on page G8-5912 
AIDR AIDR, Auxiliary ID Register on page G8-5914 
AIFSR AIFSR, Auxiliary Instruction Fault Status Register on page G8-5915 
AMAIRO AMAIRO, Auxiliary Memory Attribute Indirection Register 0 on page G8-5917 
AMAIR1 AMAIRI, Auxiliary Memory Attribute Indirection Register 1 on page G8-5920 
AMCFGR AMCFGR, Activity Monitors Configuration Register on page G8-6543 
AMCGCR AMCGCR, Activity Monitors Counter Group Configuration Register on page G8-6546 
AMCNTENCLRO AMCNTENCLRO, Activity Monitors Count Enable Clear Register 0 on page G8-6548 
AMCNTENCLR1 AMCNTENCLRI, Activity Monitors Count Enable Clear Register 1 on page G8-6551 
AMCNTENSETO AMCNTENSET), Activity Monitors Count Enable Set Register 0 on page G8-6554 
AMCNTENSET1 AMCNTENSET1, Activity Monitors Count Enable Set Register 1 on page G8-6557 
AMCR AMCR, Activity Monitors Control Register on page G8-6560 
AMEVCNTRO<n> AMEVCNTRO<n>, Activity Monitors Event Counter Registers 0, n = 0 - 15 on 
page G8-6563 
AMEVCNTRI<n> AMEVCNTRI<n>, Activity Monitors Event Counter Registers 1, n = 0 - 15 on 
page G8-6566 
AMEVTYPERO<n> AMEVTYPERO<n>, Activity Monitors Event Type Registers 0, n = 0 - 15 on page G8-6571 
AMEVTYPERI<n> AMEVTYPERI<n>, Activity Monitors Event Type Registers 1, n = 0 - 15 on page G8-6573 
AMUSERENR AMUSERENR, Activity Monitors User Enable Register on page G8-6576 
APSR APSR, Application Program Status Register on page G8-5923 
ATS12NSOPR ATS1I2NSOPR, Address Translate Stages 1 and 2 Non-secure Only PL1 Read on 
page G8-5925 
ATS12NSOPW ATS12NSOPW, Address Translate Stages 1 and 2 Non-secure Only PLI Write on 
page G8-5926 
ATS12NSOUR ATSI2NSOUR, Address Translate Stages 1 and 2 Non-secure Only Unprivileged Read on 
page G8-5927 
ATS12NSOUW ATS1I2NSOUW, Address Translate Stages 1 and 2 Non-secure Only Unprivileged Write on 
page G8-5928 
ATS1CPR ATSICPR, Address Translate Stage 1 Current state PLI Read on page G8-5929 
ATS1CPRP ATS1ICPRP, Address Translate Stage 1 Current state PLI Read PAN on page G8-5930 
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Table K14-19 Alphabetical index of AArch32 Registers (continued) 



























































Register Description, see 

ATS1CPW ATSICPW, Address Translate Stage 1 Current state PLI Write on page G8-5931 
ATS1CPWP ATSICPWP, Address Translate Stage 1 Current state PLI Write PAN on page G8-5932 
ATS1CUR ATSICUR, Address Translate Stage 1 Current state Unprivileged Read on page G8-5933 
ATS1CUW ATSICUW, Address Translate Stage 1 Current state Unprivileged Write on page G8-5934 
ATS1HR ATSIHR, Address Translate Stage 1 Hyp mode Read on page G8-5935 

ATS1IHW ATSIHW, Address Translate Stage 1 Hyp mode Write on page G8-5937 

BPIALL BPIALL, Branch Predictor Invalidate All on page G8-5939 

BPIALLIS BPIALLIS, Branch Predictor Invalidate All, Inner Shareable on page G8-5940 

BPIMVA BPIMVA, Branch Predictor Invalidate by VA on page G8-5941 

CCSIDR CCSIDR, Current Cache Size ID Register on page G8-5942 

CCSIDR2 CCSIDR2, Current Cache Size ID Register 2 on page G8-5945 

CFPRCTX CFPRCTX, Control Flow Prediction Restriction by Context on page G8-5947 

CLIDR CLIDR, Cache Level ID Register on page G8-5950 

CNTFRQ CNTFROQ, Counter-timer Frequency register on page G8-6628 

CNTHCTL CNTHCTL, Counter-timer Hyp Control register on page G8-6630 

CNTHP_ CTL CNTHP_CTL, Counter-timer Hyp Physical Timer Control register on page G8-6632 
CNTHP_ CVAL CNTHP_CVAL, Counter-timer Hyp Physical CompareValue register on page G8-6636 
CNTHP_TVAL CNTHP_TVAL, Counter-timer Hyp Physical Timer TimerValue register on page G8-6640 
CNTHPS CTL CNTHPS_CTL, Counter-timer Secure Physical Timer Control Register (EL2) on 


page G8-6644 





CNTHPS_ CVAL 


CNTHPS_CVAL, Counter-timer Secure Physical Timer CompareValue Register (EL2) on 
page G8-6648 





CNTHPS_ TVAL 


CNTHPS_TVAL, Counter-timer Secure Physical Timer Timer Value Register (EL2) on 
page G8-6651 














CNTHV_CTL CNTHV_CTL, Counter-timer Virtual Timer Control register (EL2) on page G8-6654 
CNTHV_CVAL CNTHV_CVAL, Counter-timer Virtual Timer Compare Value register (EL2) on 

page G8-6657 
CNTHV_TVAL CNTHV_TVAL, Counter-timer Virtual Timer Timer Value register (EL2) on page G8-6660 
CNTHVS CTL CNTHVS_CTL, Counter-timer Secure Virtual Timer Control Register (EL2) on 


page G8-6662 





CNTHVS_CVAL 


CNTHVS_CVAL, Counter-timer Secure Virtual Timer CompareValue Register (EL2) on 
page G8-6665 





CNTHVS_TVAL 


CNTHVS_TVAL, Counter-timer Secure Virtual Timer TimerValue Register (EL2) on 
page G8-6668 











CNTKCTL 
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CNTKCTL, Counter-timer Kernel Control register on page G8-6670 
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Table K14-19 Alphabetical index of AArch32 Registers (continued) 








































































































Register Description, see 

CNTP_CTL CNTP_CTL, Counter-timer Physical Timer Control register on page G8-6673 
CNTP_CVAL CNTP_CVAL, Counter-timer Physical Timer Compare Value register on page G8-6677 
CNTP_TVAL CNTP_TVAL, Counter-timer Physical Timer TimerValue register on page G8-6680 
CNTPCT CNTPCT, Counter-timer Physical Count register on page G8-6683 

CNTV_CTL CNTV_CTL, Counter-timer Virtual Timer Control register on page G8-6685 
CNTV_CVAL CNTV_CVAL, Counter-timer Virtual Timer Compare Value register on page G8-6688 
CNTV_TVAL CNTV_TVAL, Counter-timer Virtual Timer Timer Value register on page G8-6690 
CNTVCT CNTVCT, Counter-timer Virtual Count register on page G8-6692 

CNTVOFF CNTVOFF, Counter-timer Virtual Offset register on page G8-6694 
CONTEXTIDR CONTEXTIDR, Context ID Register on page G8-5952 

CP15DMB CP15DMB, Data Memory Barrier System instruction on page G8-5955 

CP15DSB CP15DSB, Data Synchronization Barrier System instruction on page G8-5957 
CP15ISB CP15ISB, Instruction Synchronization Barrier System instruction on page G8-5959 
CPACR CPACR, Architectural Feature Access Control Register on page G8-5961 
CPPRCTX CPPRCTX, Cache Prefetch Prediction Restriction by Context on page G8-5970 
CPSR CPSR, Current Program Status Register on page G8-5965 

CSSELR CSSELR, Cache Size Selection Register on page G8-5973 

CTR CTR, Cache Type Register on page G8-5976 

DACR DACR, Domain Access Control Register on page G8-5979 

DBGAUTHSTATUS DBGAUTHSTATUS, Debug Authentication Status register on page G8-6377 
DBGBCR<n> DBGBCR<n>, Debug Breakpoint Control Registers, n = 0 - 15 on page G8-6379 
DBGBVR<n> DBGBVR<n>, Debug Breakpoint Value Registers, n = 0 - 15 on page G8-6384 
DBGBXVR<n> DBGBXVR<n>, Debug Breakpoint Extended Value Registers, n = 0 - 15 on page G8-6388 
DBGCLAIMCLR DBGCLAIMCLR, Debug Claim Tag Clear register on page G8-6391 
DBGCLAIMSET DBGCLAIMSET, Debug Claim Tag Set register on page G8-6393 

DBGDCCINT DBGDCCINT, DCC Interrupt Enable Register on page G8-6395 

DBGDEVID DBGDEVID, Debug Device ID register 0 on page G8-6397 

DBGDEVID1 DBGDEVID1, Debug Device ID register 1 on page G8-6400 

DBGDEVID2 DBGDEVID2, Debug Device ID register 2 on page G8-6402 

DBGDIDR DBGDIDR, Debug ID Register on page G8-6403 

DBGDRAR DBGDRAR, Debug ROM Address Register on page G8-6406 

DBGDSAR DBGDSAR, Debug Self Address Register on page G8-6409 
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Table K14-19 Alphabetical index of AArch32 Registers (continued) 


































































































Register Description, see 
DBGDSCRext DBGDSCRext, Debug Status and Control Register, External View on page G8-6411 
DBGDSCRint DBGDSCRint, Debug Status and Control Register, Internal View on page G8-6416 
DBGDTRRXext DBGDTRRXext, Debug OS Lock Data Transfer Register, Receive, External View on 
page G8-6419 

DBGDTRRXint DBGDTRRXint, Debug Data Transfer Register, Receive on page G8-6421 
DBGDTRTXext DBGDTRTXext, Debug OS Lock Data Transfer Register, Transmit on page G8-6423 
DBGDTRTXint DBGDTRTXint, Debug Data Transfer Register, Transmit on page G8-6425 
DBGOSDLR DBGOSDLR, Debug OS Double Lock Register on page G8-6427 
DBGOSECCR DBGOSECCR, Debug OS Lock Exception Catch Control Register on page G8-6430 
DBGOSLAR DBGOSLAR, Debug OS Lock Access Register on page G8-6432 
DBGOSLSR DBGOSLSR, Debug OS Lock Status Register on page G8-6434 
DBGPRCR DBGPRCR, Debug Power Control Register on page G8-6436 
DBGVCR DBGVCR, Debug Vector Catch Register on page G8-6438 
DBGWCR<n> DBGWCR<n>, Debug Watchpoint Control Registers, n = 0 - 15 on page G8-6444 
DBGWFAR DBGWFAR, Debug Watchpoint Fault Address Register on page G8-6448 
DBGWVR<n> DBGWVR<n>, Debug Watchpoint Value Registers, n = 0 - 15 on page G8-6450 
DCCIMVAC DCCIMVAC, Data Cache line Clean and Invalidate by VA to PoC on page G8-5981 
DCCISW DCCISW, Data Cache line Clean and Invalidate by Set/Way on page G8-5982 
DCCMVAC DCCMVAC, Data Cache line Clean by VA to PoC on page G8-5984 
DCCMVAU DCCMVAU, Data Cache line Clean by VA to PoU on page G8-5985 
DCCSW DCCSW, Data Cache line Clean by Set/Way on page G8-5987 
DCIMVAC DCIMVAC, Data Cache line Invalidate by VA to PoC on page G8-5989 
DCISW DCISW, Data Cache line Invalidate by Set/Way on page G8-5991 
DFAR DFAR, Data Fault Address Register on page G8-5993 
DFSR DFSR, Data Fault Status Register on page G8-5995 
DISR DISR, Deferred Interrupt Status Register on page G8-6580 
DLR DLR, Debug Link Register on page G8-6452 
DSPSR DSPSR, Debug Saved Program Status Register on page G8-6453 
DTLBIALL DTLBIALL, Data TLB Invalidate All on page G8-6002 
DTLBIASID DTLBIASID, Data TLB Invalidate by ASID match on page G8-6004 
DTLBIMVA DTLBIMVA, Data TLB Invalidate by VA on page G8-6006 
DVPRCTX DVPRCTX, Data Value Prediction Restriction by Context on page G8-6008 
ELR_hyp ELR_hyp, Exception Link Register (Hyp mode) on page G8-6011 
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Table K14-19 Alphabetical index of AArch32 Registers (continued) 





































































































Register Description, see 

ERRIDR ERRIDR, Error Record ID Register on page G8-6585 

ERRSELR ERRSELR, Error Record Select Register on page G8-6587 

ERXADDR ERXADDR, Selected Error Record Address Register on page G8-6590 
ERXADDR2 ERXADDRz2, Selected Error Record Address Register 2 on page G8-6592 
ERXCTLR ERXCTLR, Selected Error Record Control Register on page G8-6594 
ERXCTLR2 ERXCTLR2, Selected Error Record Control Register 2 on page G8-6596 
ERXFR ERXFR, Selected Error Record Feature Register on page G8-6598 

ERXFR2 ERXFR2, Selected Error Record Feature Register 2 on page G8-6600 
ERXMISCO ERXMISCO, Selected Error Record Miscellaneous Register 0 on page G8-6602 
ERXMISC1 ERXMISC1, Selected Error Record Miscellaneous Register 1 on page G8-6604 
ERXMISC2 ERXMISC2, Selected Error Record Miscellaneous Register 2 on page G8-6606 
ERXMISC3 ERXMISC3, Selected Error Record Miscellaneous Register 3 on page G8-6608 
ERXMISC4 ERXMISC4, Selected Error Record Miscellaneous Register 4 on page G8-6610 
ERXMISCS5 ERXMISC5S, Selected Error Record Miscellaneous Register 5 on page G8-6612 
ERXMISC6 ERXMISC6, Selected Error Record Miscellaneous Register 6 on page G8-6614 
ERXMISC7 ERXMISC7, Selected Error Record Miscellaneous Register 7 on page G8-6616 
ERXSTATUS ERXSTATUS, Selected Error Record Primary Status Register on page G8-6618 
FCSEIDR FCSEIDR, FCSE Process ID register on page G8-6012 

FPEXC FPEXC, Floating-Point Exception Control register on page G8-6014 

FPSCR FPSCR, Floating-Point Status and Control Register on page G8-6020 

FPSID FPSID, Floating-Point System ID register on page G8-6027 

HACR HACR, Hyp Auxiliary Configuration Register on page G8-6030 

HACTLR HACTLR, Hyp Auxiliary Control Register on page G8-6032 

HACTLR2 HACTLR2, Hyp Auxiliary Control Register 2 on page G8-6034 

HADFSR HADFSR, Hyp Auxiliary Data Fault Status Register on page G8-6036 
HAIFSR HAIFSR, Hyp Auxiliary Instruction Fault Status Register on page G8-6038 
HAMAIRO HAMAIRO, Hyp Auxiliary Memory Attribute Indirection Register 0 on page G8-6040 
HAMAIRI HAMAIR1, Hyp Auxiliary Memory Attribute Indirection Register 1 on page G8-6042 
HCPTR HCPTR, Hyp Architectural Feature Trap Register on page G8-6044 

HCR HCR, Hyp Configuration Register on page G8-6049 

HCR2 HCR2, Hyp Configuration Register 2 on page G8-6059 

HDCR HDCR, Hyp Debug Control Register on page G8-6457 
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Table K14-19 Alphabetical index of AArch32 Registers (continued) 








































































































Register Description, see 
HDFAR HDFAR, Hyp Data Fault Address Register on page G8-6064 
HIFAR HIFAR, Hyp Instruction Fault Address Register on page G8-6066 
HMAIRO HMAIRO, Hyp Memory Attribute Indirection Register 0 on page G8-6068 
HMAIRI1 HMAIRI1, Hyp Memory Attribute Indirection Register 1 on page G8-6071 
HPFAR HPFAR, Hyp IPA Fault Address Register on page G8-6074 
HRMR HRMR, Hyp Reset Management Register on page G8-6076 
HSCTLR HSCTLR, Hyp System Control Register on page G8-6078 
HSR HSR, Hyp Syndrome Register on page G8-6084 
HSTR HSTR, Hyp System Trap Register on page G8-6105 
HTCR HATCR, Hyp Translation Control Register on page G8-6107 
HTPIDR HATPIDR, Hyp Software Thread ID Register on page G8-6111 
HTRFCR HATRFCR, Hyp Trace Filter Control Register on page G8-6464 
HTTBR HATTBR, Hyp Translation Table Base Register on page G8-6113 
HVBAR AVBAR, Hyp Vector Base Address Register on page G8-6116 
ICIALLU ICIALLU, Instruction Cache Invalidate All to PoU on page G8-6118 
ICIALLUIS ICIALLUIS, Instruction Cache Invalidate All to PoU, Inner Shareable on page G8-6119 
ICIMVAU ICIMVAU, Instruction Cache line Invalidate by VA to PoU on page G8-6120 
ID_AFRO ID_AFRO, Auxiliary Feature Register 0 on page G8-6122 
ID_DFRO ID_DFRO, Debug Feature Register 0 on page G8-6124 
ID_ISARO ID_ISARO, Instruction Set Attribute Register 0 on page G8-6127 
ID_ISAR1 ID_ISAR1, Instruction Set Attribute Register 1 on page G8-6130 
ID_ISAR2 ID_ISAR2, Instruction Set Attribute Register 2 on page G8-6133 
ID_ISAR3 ID_ISAR3, Instruction Set Attribute Register 3 on page G8-6136 
ID_ISAR4 ID_ISAR4, Instruction Set Attribute Register 4 on page G8-6139 
ID_ISAR5 ID_ISARS, Instruction Set Attribute Register 5 on page G8-6142 
ID_ISAR6 ID_ISAR6, Instruction Set Attribute Register 6 on page G8-6145 
ID_MMFRO ID_MMFRO, Memory Model Feature Register 0 on page G8-6147 
ID_MMFRI1 ID_MMFRI1, Memory Model Feature Register 1 on page G8-6150 
ID_MMFR2 ID_MMFR2, Memory Model Feature Register 2 on page G8-6154 
ID_MMFR3 ID_MMFR3, Memory Model Feature Register 3 on page G8-6157 
ID_MMFR4 ID_MMFR4, Memory Model Feature Register 4 on page G8-6160 
ID_PFRO ID_PFRO, Processor Feature Register 0 on page G8-6164 
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Table K14-19 Alphabetical index of AArch32 Registers (continued) 


































































































Register Description, see 

ID_PFRI ID_PFRI1, Processor Feature Register 1 on page G8-6167 

ID_PFR2 ID_PFR2, Processor Feature Register 2 on page G8-6170 

IFAR IFAR, Instruction Fault Address Register on page G8-6172 

IFSR IF SR, Instruction Fault Status Register on page G8-6174 

ISR ISR, Interrupt Status Register on page G8-6179 

ITLBIALL ITLBIALL, Instruction TLB Invalidate All on page G8-6181 

ITLBIASID ITLBIASID, Instruction TLB Invalidate by ASID match on page G8-6183 

ITLBIMVA ITLBIMVA, Instruction TLB Invalidate by VA on page G8-6185 

JIDR JIDR, Jazelle ID Register on page G8-6187 

JMCR JMCR, Jazelle Main Configuration Register on page G8-6188 

JOSCR JOSCR, Jazelle OS Control Register on page G8-6190 

MAIRO MAIRO, Memory Attribute Indirection Register 0 on page G8-6192 

MAIRI MAIRI, Memory Attribute Indirection Register 1 on page G8-6195 

MIDR MIDR, Main ID Register on page G8-6198 

MPIDR MPIDR, Multiprocessor Affinity Register on page G8-6201 

MVBAR MVBAR, Monitor Vector Base Address Register on page G8-6203 

MVFRO MVFRO, Media and VFP Feature Register 0 on page G8-6205 

MVFRI1 MVFRI1, Media and VFP Feature Register 1 on page G8-6209 

MVFR2 MVFR2, Media and VFP Feature Register 2 on page G8-6213 

NMRR NMRR, Normal Memory Remap Register on page G8-6215 

NSACR NSACR, Non-Secure Access Control Register on page G8-6218 

PAR PAR, Physical Address Register on page G8-6222 

PMCCFILTR PMCCFILTR, Performance Monitors Cycle Count Filter Register on page G8-6480 

PMCCNTR PMCCNTR, Performance Monitors Cycle Count Register on page G8-6483 

PMCEIDO PMCEIDO, Performance Monitors Common Event Identification register 0 on 
page G8-6488 

PMCEID1 PMCEID1, Performance Monitors Common Event Identification register 1 on 
page G8-6491 

PMCEID2 PMCEID2, Performance Monitors Common Event Identification register 2 on 
page G8-6494 

PMCEID3 PMCEID3, Performance Monitors Common Event Identification register 3 on 
page G8-6496 

PMCNTENCLR PMCNTENCLR, Performance Monitors Count Enable Clear register on page G8-6498 

PMCNTENSET PMCNTENSET, Performance Monitors Count Enable Set register on page G8-6501 
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Table K14-19 Alphabetical index of AArch32 Registers (continued) 


































































































Register Description, see 
PMCR PMCR, Performance Monitors Control Register on page G8-6504 
PMEVCNTR<n> PMEVCNTR<n>, Performance Monitors Event Count Registers, n = 0 - 30 on 

page G8-6510 
PMEVTYPER<n> PMEVTYPER<n>, Performance Monitors Event Type Registers, n = 0 - 30 on 

page G8-6513 
PMINTENCLR PMINTENCLR, Performance Monitors Interrupt Enable Clear register on page G8-6518 
PMINTENSET PMINTENSET, Performance Monitors Interrupt Enable Set register on page G8-6520 
PMMIR PMMIR, Performance Monitors Machine Identification Register on page G8-6467 
PMOVSR PMOVSR, Performance Monitors Overflow Flag Status Register on page G8-6522 
PMOVSSET PMOVSSET, Performance Monitors Overflow Flag Status Set register on page G8-6525 
PMSELR PMSELR, Performance Monitors Event Counter Selection Register on page G8-6528 
PMSWINC PMSWINC, Performance Monitors Software Increment register on page G8-6531 
PMUSERENR PMUSERENR, Performance Monitors User Enable Register on page G8-6533 
PMXEVCNTR PMXEVCNTR, Performance Monitors Selected Event Count Register on page G8-6536 
PMXEVTYPER PMXEVTYPER, Performance Monitors Selected Event Type Register on page G8-6539 
PRRR PRRR, Primary Region Remap Register on page G8-6231 
REVIDR REVIDR, Revision ID Register on page G8-6235 
RMR RMR, Reset Management Register on page G8-6236 
RVBAR RVBAR, Reset Vector Base Address Register on page G8-6238 
SCR SCR, Secure Configuration Register on page G8-6239 
SCTLR SCTLR, System Control Register on page G8-6244 
SDCR SDCR, Secure Debug Control Register on page G8-6469 
SDER SDER, Secure Debug Enable Register on page G8-6474 
SPSR SPSR, Saved Program Status Register on page G8-6253 
SPSR_abt SPSR_abt, Saved Program Status Register (Abort mode) on page G8-6256 
SPSR_fiq SPSR_fig, Saved Program Status Register (FIQ mode) on page G8-6260 
SPSR_hyp SPSR_hyp, Saved Program Status Register (Hyp mode) on page G8-6264 
SPSR_irq SPSR_irg, Saved Program Status Register (IRQ mode) on page G8-6268 
SPSR_mon SPSR_mon, Saved Program Status Register (Monitor mode) on page G8-6272 
SPSR_ sve SPSR_svc, Saved Program Status Register (Supervisor mode) on page G8-6276 
SPSR_und SPSR_und, Saved Program Status Register (Undefined mode) on page G8-6280 
TCMTR TCMTR, TCM Type Register on page G8-6284 
TLBIALL TLBIALL, TLB Invalidate All on page G8-6285 
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Table K14-19 Alphabetical index of AArch32 Registers (continued) 




























































































Register Description, see 

TLBIALLH TLBIALLH, TLB Invalidate All, Hyp mode on page G8-6287 

TLBIALLHIS TLBIALLHIS, TLB Invalidate All, Hyp mode, Inner Shareable on page G8-6288 

TLBIALLIS TLBIALLIS, TLB Invalidate All, Inner Shareable on page G8-6289 

TLBIALLNSNH TLBIALLNSNH, TLB Invalidate All, Non-Secure Non-Hyp on page G8-6291 

TLBIALLNSNHIS TLBIALLNSNHIS, TLB Invalidate All, Non-Secure Non-Hyp, Inner Shareable on 
page G8-6292 

TLBIASID TLBIASID, TLB Invalidate by ASID match on page G8-6293 

TLBIASIDIS TLBIASIDIS, TLB Invalidate by ASID match, Inner Shareable on page G8-6295 

TLBIIPAS2 TLBIIPAS2, TLB Invalidate by Intermediate Physical Address, Stage 2 on page G8-6297 

TLBIIPAS2IS TLBIIPAS21S, TLB Invalidate by Intermediate Physical Address, Stage 2, Inner Shareable 
on page G8-6299 

TLBIIPAS2L TLBIIPAS2L, TLB Invalidate by Intermediate Physical Address, Stage 2, Last level on 
page G8-6301 

TLBHPAS2LIS TLBIIPAS2LIS, TLB Invalidate by Intermediate Physical Address, Stage 2, Last level, Inner 
Shareable on page G8-6303 

TLBIMVA TLBIMVA, TLB Invalidate by VA on page G8-6305 

TLBIMVAA TLBIMVAA, TLB Invalidate by VA, All ASID on page G8-6307 

TLBIMVAAIS TLBIMVAAIS, TLB Invalidate by VA, All ASID, Inner Shareable on page G8-6309 

TLBIMVAAL TLBIMVAAL, TLB Invalidate by VA, All ASID, Last level on page G8-6311 

TLBIMVAALIS TLBIMVAALIS, TLB Invalidate by VA, All ASID, Last level, Inner Shareable on 
page G8-6313 

TLBIMVAH TLBIMVAH, TLB Invalidate by VA, Hyp mode on page G8-6315 

TLBIMVAHIS TLBIMVAHIS, TLB Invalidate by VA, Hyp mode, Inner Shareable on page G8-6317 

TLBIMVAIS TLBIMVAIS, TLB Invalidate by VA, Inner Shareable on page G8-6319 

TLBIMVAL TLBIMVAL, TLB Invalidate by VA, Last level on page G8-6321 

TLBIMVALH TLBIMVALH, TLB Invalidate by VA, Last level, Hyp mode on page G8-6323 

TLBIMVALHIS TLBIMVALHIS, TLB Invalidate by VA, Last level, Hyp mode, Inner Shareable on 
page G8-6325 

TLBIMVALIS TLBIMVALIS, TLB Invalidate by VA, Last level, Inner Shareable on page G8-6327 

TLBTR TLBTR, TLB Type Register on page G8-6329 

TPIDRPRW TPIDRPRW, PL1 Software Thread ID Register on page G8-6331 

TPIDRURO TPIDRURO, PLO Read-Only Software Thread ID Register on page G8-6333 

TPIDRURW TPIDRURW, PLO Read/Write Software Thread ID Register on page G8-6335 

TRFCR TRFCR, Trace Filter Control Register on page G8-6476 

TTBCR TTBCR, Translation Table Base Control Register on page G8-6337 
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Table K14-19 Alphabetical index of AArch32 Registers (continued) 



































Register Description, see 

TTBCR2 TTBCR2, Translation Table Base Control Register 2 on page G8-6343 

TTBRO TTBRO, Translation Table Base Register 0 on page G8-6349 

TTBR1 TTBRI1, Translation Table Base Register 1 on page G8-6355 

VBAR VBAR, Vector Base Address Register on page G8-6361 

VDFSR VDFSR, Virtual SError Exception Syndrome Register on page G8-6620 

VDISR VDISR, Virtual Deferred Interrupt Status Register on page G8-6622 

VMPIDR VMPIDR, Virtualization Multiprocessor ID Register on page G8-6363 

VPIDR VPIDR, Virtualization Processor ID Register on page G8-6366 

VTCR VTCR, Virtualization Translation Control Register on page G8-6369 

VTTBR VTTBR, Virtualization Translation Table Base Register on page G8-6373 
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K14.5 Functional index of AArch32 registers and System instructions 


This section is an index of the AArch32 registers and System instructions, divided by functional group. Each of the 


following sections lists the registers for a functional group: 
$ Special-purpose registers. 

7 VMSA-specific registers. 

° ID registers on page K14-7856. 

e Performance monitors registers on page K14-7857. 
e Debug registers on page K14-7858. 

e RAS registers on page K14-7859. 

° Generic timer registers on page K14-7860. 


e Cache maintenance system instructions on page K14-7861. 

. Address translation system instructions on page K14-7861. 

° TLB maintenance system instructions on page K14-7862. 

7 Legacy feature registers and system instructions on page K14-7863. 


° Base system registers on page K14-7863. 


K14.5.1 Special-purpose registers 


This section is an index to the registers in the Processor state registers functional group. 


Table K14-20 Special-purpose registers 






































Register Description, see 
DLR DLR 
DSPSR DSPSR 
ELR _ hyp ELR hyp 
SPSR SPSR 
SPSR_abt SPSR_abt 
SPSR_fiq SPSR_fiq 
SPSR_hyp SPSR_hyp 
SPSR_irq SPSR_irq 
SPSR_mon SPSR_mon 
SPSR_ sve SPSR_ sve 
SPSR_und SPSR_und 





K14.5.2 VMSA-specific registers 


This section is an index to the registers in the Virtual memory control registers functional group. 


Table K14-21 VMSA-specific registers 











Register Description, see 
AMAIRO AMAIRO 
AMAIRI AMAIRI 
CONTEXTIDR CONTEXTIDR 
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Table K14-21 VMSA-specific registers (continued) 





















































Register Description, see 
DACR DACR 
HAMAITRO HAMAIRO 
HAMAIRI HAMAIRI 
HMAIRO HMAIRO 
HMAIRI HMAIRI 
HTCR HTCR 
HTTBR HTTBR 
MAIRO MAIRO 
MAIRI MAIRI 
NMRR NMRR 
PRRR PRRR 
TTBCR TTBCR 
TTBCR2 TTBCR2 
TTBRO TTBRO 
TTBRI TTBRI 
VTCR VTCR 
VTTBR VTTBR 





K14.5.3 ID registers 


This section is an index to the registers in the Identification registers functional group. 


Table K14-22 ID registers 



































Register Description, see 

CCSIDR CCSIDR 

CCSIDR2 CCSIDR2 

CLIDR CLIDR 

CSSELR CSSELR 

CTR CTR 

ID_AFRO ID_AFRO 

ID_DFRO ID_DFRO 

ID_ISARO ID_ISARO 

ID_ISARI ID_ISARI1 

ID_ISAR2 ID_ISAR2 
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Table K14-22 ID registers (continued) 

































































Register Description, see 
ID_ISAR3 ID_ISAR3 
ID_ISAR4 ID_ISAR4 
ID_ISARS ID_ISARS 
ID_ISAR6 ID_ISAR6 
ID_MMFRO ID_MMFRO 
ID_MMFRI1 ID_MMFRI1 
ID_MMER2 ID MMFR2 
ID_MMFR3 ID_MMFR3 
ID_MMFR4 ID_MMFR4 
ID_PFRO ID_PFRO 
ID PFRI ID PFRI 
ID_PFR2 ID PFR2 
MIDR MIDR 
MPIDR MPIDR 
REVIDR REVIDR 
TCMTR TCMTR 
TLBTR TLBTR 





K14.5.4 Performance monitors registers 


This section is an index to the registers in the Performance Monitors registers functional group. 


Table K14-23 Performance monitors registers 









































Register Description, see 
PMCCFILTR PMCCFILTR 
PMCCNTR PMCCNTR 
PMCEIDO PMCEIDO 
PMCEID1 PMCEID1 
PMCEID2 PMCEID2 
PMCEID3 PMCEID3 
PMCNTENCLR PMCNTENCLR 
PMCNTENSET PMCNTENSET 
PMCR PMCR 
PMEVCNTR<n> PMEVCNTR<n> 
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Table K14-23 Performance monitors registers (continued) 



































Register Description, see 
PMEVTYPER<n> PMEVTYPER<n> 
PMINTENCLR PMINTENCLR 
PMINTENSET PMINTENSET 
PMMIR PMMIR 
PMOVSR PMOVSR 
PMOVSSET PMOVSSET 
PMSELR PMSELR 
PMSWINC PMSWINC 
PMUSERENR PMUSERENR 
PMXEVCNTR PMXEVCNTR 
PMXEVTYPER PMXEVTYPER 











K14.5.5 Debug registers 


This section is an index to the registers in the Debug registers functional group. 


Table K14-24 Debug registers 





















































Register Description, see 
DBGAUTHSTATUS DBGAUTHSTATUS 
DBGBCR<n> DBGBCR<n> 
DBGBVR<n> DBGBVR<n> 
DBGBXVR<n> DBGBXVR<n> 
DBGCLAIMCLR DBGCLAIMCLR 
DBGCLAIMSET DBGCLAIMSET 
DBGDCCINT DBGDCCINT 
DBGDEVID DBGDEVID 
DBGDEVID1 DBGDEVID1 
DBGDEVID2 DBGDEVID2 
DBGDIDR DBGDIDR 
DBGDRAR DBGDRAR 
DBGDSAR DBGDSAR 
DBGDSCRext DBGDSCRext 
DBGDSCRint DBGDSCRint 
DBGDTRRXext DBGDTRRXext 
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Table K14-24 Debug registers (continued) 

























































































Register Description, see 
DBGDTRRXint DBGDTRRXint 
DBGDTRTXext DBGDTRTXext 
DBGDTRTXint DBGDTRTXint 
DBGOSDLR DBGOSDLR 
DBGOSECCR DBGOSECCR 
DBGOSLAR DBGOSLAR 
DBGOSLSR DBGOSLSR 
DBGPRCR DBGPRCR 
DBGVCR DBGVCR 
DBGWCR<n> DBGWCR<n> 
DBGWFAR DBGWFAR 
DBGWVR<n> DBGWVR<n> 
TRFCR TRFCR 
K14.5.6 RAS registers 
This section is an index to the registers in the RAS registers functional group. 
Table K14-25 RAS registers 
Register Description, see 
DISR DISR 
ERRIDR ERRIDR 
ERRSELR ERRSELR 
ERXADDR ERXADDR 
ERXADDR2 ERXADDR2 
ERXCTLR ERXCTLR 
ERXCTLR2 ERXCTLR2 
ERXFR ERXFR 
ERXFR2 ERXFR2 
ERXMISCO ERXMISCO 
ERXMISC1 ERXMISC1 
ERXMISC2 ERXMISC2 
ERXMISC3 ERXMISC3 
ERXMISC4 ERXMISC4 
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Table K14-25 RAS registers (continued) 




















Register Description, see 
ERXMISC5 ERXMISCS5 
ERXMISC6 ERXMISC6 
ERXMISC7 ERXMISC7 
ERXSTATUS ERXSTATUS 
VDFSR VDFSR 

VDISR VDISR 





K14.5.7 Generic timer registers 


This section is an index to the registers in the Generic Timer registers functional group. 


Table K14-26 Generic timer registers 













































































Register Description, see 
CNTFRQ CNTFRQ 
CNTHP_CTL CNTHP_CTL 
CNTHPS_CTL CNTHPS_CTL 
CNTHPS_CVAL CNTHPS_CVAL 
CNTHPS_TVAL CNTHPS_TVAL 
CNTHV_CTL CNTHV_CTL 
CNTHV_CVAL CNTHV_CVAL 
CNTHV_TVAL CNTHV_TVAL 
CNTHVS CTL CNTHVS_CTL 
CNTHVS_CVAL CNTHVS_CVAL 
CNTHVS_TVAL CNTHVS_TVAL 
CNTKCTL CNTKCTL 
CNTP_CTL CNTP CTL 
CNTP_CVAL CNTP_CVAL 
CNTP_TVAL CNTP_TVAL 
CNTPCT CNTPCT 
CNTV_CTL CNTV_CTL 
CNTV_CVAL CNTV_CVAL 
CNTV_TVAL CNTV_TVAL 
CNTVCT CNTVCT 
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K14.5.8 Cache maintenance system instructions 


This section is an index to the registers in the Cache maintenance instructions functional group. 


Table K14-27 Cache maintenance system instructions 












































Register Description, see 
BPIALL BPIALL 
BPIALLIS BPIALLIS 
BPIMVA BPIMVA 
DCCIMVAC DCCIMVAC 
DCCISW DCCISW 
DCCMVAC DCCMVAC 
DCCMVAU DCCMVAU 
DCCSW DCCSW 
DCIMVAC DCIMVAC 
DCISW DCISW 
ICIALLU ICIALLU 
ICIALLUIS ICIALLUIS 
ICIMVAU ICIMVAU 





K14.5.9 Address translation system instructions 


This section is an index to the registers in the Address translation instructions functional group. 


Table K14-28 Address translation system instructions 












































Register Description, see 
ATS12NSOPR ATS12NSOPR 
ATS12NSOPW ATS12NSOPW 
ATS12NSOUR ATS12NSOUR 
ATS12NSOUW ATS12NSOUW 
ATS1CPR ATSICPR 
ATSICPRP ATSICPRP 
ATS1CPW ATSICPW 
ATS1CPWP ATSICPWP 
ATSICUR ATS1CUR 
ATS1ICUW ATS1ICUW 
ATSIHR ATSIHR 
ATSIHW ATSIHW 
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K14.5.10 TLB maintenance system instructions 


This section is an index to the registers in the TLB maintenance instructions functional group. 


Table K14-29 TLB maintenance system instructions 





































































































Register Description, see 
CFPRCTX CFPRCTX 
CPPRCTX CPPRCTX 
DTLBIALL DTLBIALL 
DTLBIASID DTLBIASID 
DTLBIMVA DTLBIMVA 
DVPRCTX DVPRCTX 
ITLBIALL ITLBIALL 
ITLBIASID ITLBIASID 
ITLBIMVA ITLBIMVA 
TLBIALL TLBIALL 
TLBIALLH TLBIALLH 
TLBIALLHIS TLBIALLHIS 
TLBIALLIS TLBIALLIS 
TLBIALLNSNH TLBIALLNSNH 
TLBIALLNSNHIS TLBIALLNSNHIS 
TLBIASID TLBIASID 
TLBIASIDIS TLBIASIDIS 
TLBIIPAS2 TLBIIPAS2 
TLBIIPAS2IS TLBIIPAS2IS 
TLBITPAS2L TLBITPAS2L 
TLBIIPAS2LIS TLBIIPAS2LIS 
TLBIMVA TLBIMVA 
TLBIMVAA TLBIMVAA 
TLBIMVAAIS TLBIMVAAIS 
TLBIMVAAL TLBIMVAAL 
TLBIMVAALIS TLBIMVAALIS 
TLBIMVAH TLBIMVAH 
TLBIMVAHIS TLBIMVAHIS 
TLBIMVAIS TLBIMVAIS 
TLBIMVAL TLBIMVAL 
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Table K14-29 TLB maintenance system instructions (continued) 











Register Description, see 
TLBIMVALH TLBIMVALH 
TLBIMVALHIS TLBIMVALHIS 
TLBIMVALIS TLBIMVALIS 





K14.5.11 Prediction restriction instructions 


This section is an index to the registers in the Prediction restriction instructions functional group. 


Table K14-30 Prediction restriction System instructions 














Register Description, see 
CFPRCTX CFPRCTX 
CPPRCTX CPPRCTX 
DVPRCTX DVPRCTX 





K14.5.12 Legacy feature registers and system instructions 


This section is an index to the registers in the Legacy feature registers functional group. 


Table K14-31 Legacy feature registers and system instructions 


























Register Description, see 
CP15DMB CP15DMB 
CP15DSB CP15DSB 
CP15ISB CP15ISB 
FCSEIDR FCSEIDR 

JIDR JIDR 

JMCR JMCR 

JOSCR JOSCR 





K14.5.13 Base system registers 


This section is an index to the registers in the functional group. 


Table K14-32 Base system registers 

















Register Description, see 
ACTLR ACTLR 

ACTLR2 ACTLR2 

ADFSR ADFSR 

AIDR AIDR 
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Table K14-32 Base system registers (continued) 








































































































Register Description, see 
AIFSR AIFSR 
AMCFGR AMCFGR 
AMCGCR AMCGCR 
AMCNTENCLRO AMCNTENCLRO 
AMCNTENCLRI AMCNTENCLRI 
AMCNTENSETO AMCNTENSETO 
AMCNTENSETI1 AMCNTENSETI1 
AMCR AMCR 
AMEVCNTRO<n> AMEVCNTRO<n> 
AMEVCNTRI<n> AMEVCNTRI1<n> 
AMEVTYPERO<n> AMEVTYPERO<n> 
AMEVTYPERI<n> AMEVTYPERI<n> 
AMUSERENR AMUSERENR 
APSR APSR 
CNTHCTL CNTHCTL 
CNTHP_CVAL CNTHP_CVAL 
CNTHP_TVAL CNTHP_TVAL 
CNTVOFF CNTVOFF 
CPACR CPACR 
CPSR CPSR 
DFAR DFAR 
DFSR DFSR 
FPEXC FPEXC 
FPSCR FPSCR 
FPSID FPSID 
HACR HACR 
HACTLR HACTLR 
HACTLR2 HACTLR2 
HADFSR HADFSR 
HAIFSR HAIFSR 
HCPTR HCPTR 
HCR HCR 
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Table K14-32 Base system registers (continued) 


































































































Register Description, see 
HCR2 HCR2 
HDCR HDCR 
HDFAR HDFAR 
HIFAR HIFAR 
HPFAR HPFAR 
HRMR HRMR 
HSCTLR HSCTLR 
HSR HSR 

HSTR HSTR 
HTPIDR HTPIDR 
HTRFCR HTRFCR 
HVBAR HVBAR 
IFAR IFAR 

IFSR IFSR 

ISR ISR 
MVBAR MVBAR 
MVFRO MVFRO 
MVFRI MVFRI 
MVFR2 MVFR2 
NSACR NSACR 
PAR PAR 

RMR RMR 
RVBAR RVBAR 
SCR SCR 
SCTLR SCTLR 
SDCR SDCR 
SDER SDER 
TPIDRPRW TPIDRPRW 
TPIDRURO TPIDRURO 
TPIDRURW TPIDRURW 
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Table K14-32 Base system registers (continued) 














Register Description, see 

VBAR VBAR 

VMPIDR VMPIDR 

VPIDR VPIDR 
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K14.6 Alphabetical index of memory-mapped registers 


This section is an index of memory-mapped registers in alphabetical order. 


Table K14-33 Alphabetical index of Memory-Mapped Registers 































































































Register Description, see 
AMCFGR AMCFGR, Activity Monitors Configuration Register on page 15-7116 
AMCGCR AMCGCR, Activity Monitors Counter Group Configuration Register on page 15-7118 
AMCIDRO AMCIDRO, Activity Monitors Component Identification Register 0 on page 15-7119 
AMCIDR1 AMCIDR1, Activity Monitors Component Identification Register 1 on page 15-7120 
AMCIDR2 AMCIDR2, Activity Monitors Component Identification Register 2 on page 15-7121 
AMCIDR3 AMCIDR3, Activity Monitors Component Identification Register 3 on page 15-7122 
AMCNTENCLRO AMCNTENCLRO, Activity Monitors Count Enable Clear Register 0 on page 15-7123 
AMCNTENCLR1 AMCNTENCLRI, Activity Monitors Count Enable Clear Register 1 on page 15-7124 
AMCNTENSETO AMCNTENSET), Activity Monitors Count Enable Set Register 0 on page 15-7126 
AMCNTENSET1 AMCNTENSET1, Activity Monitors Count Enable Set Register 1 on page 15-7127 
AMCR AMCR, Activity Monitors Control Register on page 15-7129 
AMDEVAFFO AMDEVAFF0, Activity Monitors Device Affinity Register 0 on page I5-7130 
AMDEVAFFI1 AMDEVAFF1, Activity Monitors Device Affinity Register 1 on page 15-7131 
AMDEVARCH AMDEVARCH, Activity Monitors Device Architecture Register on page 15-7132 
AMDEVTYPE AMDEVTYPE, Activity Monitors Device Type Register on page 15-7134 
AMEVCNTRO<n> AMEVCNTRO<n>, Activity Monitors Event Counter Registers 0, n = 0- 15 on 

page I5-7135 
AMEVCNTRI<n> AMEVCNTRI1<n>, Activity Monitors Event Counter Registers 1, n = 0- 15 on 

page 15-7137 
AMEVTYPERO<n> AMEVTYPERO<n>, Activity Monitors Event Type Registers 0, n = 0 - 15 on page 15-7139 
AMEVTYPERI<n> AMEVTYPERI<n>, Activity Monitors Event Type Registers 1, n = 0 - 15 on page 15-7141 
AMIDR AMIIDR, Activity Monitors Implementation Identification Register on page 15-7143 
AMPIDRO AMPIDRO, Activity Monitors Peripheral Identification Register 0 on page 15-7145 
AMPIDR1 AMPIDRI, Activity Monitors Peripheral Identification Register 1 on page 15-7146 
AMPIDR2 AMPIDR2, Activity Monitors Peripheral Identification Register 2 on page 15-7147 
AMPIDR3 AMPIDR3, Activity Monitors Peripheral Identification Register 3 on page 15-7148 
AMPIDR4 AMPIDR¢4, Activity Monitors Peripheral Identification Register 4 on page 15-7149 
ASICCTL ASICCTL, CTI External Multiplexer Control register on page H9-6961 
CNTACR<n> CNTACR<n>, Counter-timer Access Control Registers, n = 0 - 7 on page 15-7152 
CNTCR CNTCR, Counter Control Register on page 15-7154 
CNTCV CNTCY, Counter Count Value register on page 15-7156 
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Table K14-33 Alphabetical index of Memory-Mapped Registers (continued) 








































































































Register Description, see 
CNTELOACR CNTELOACR, Counter-timer ELO Access Control Register on page 15-7158 
CNTFIDO CNTFIDO, Counter Frequency ID on page 15-7160 
CNTFID<n> CNTFID<n>, Counter Frequency IDs, n > 0 on page 15-7162 
CNTFRQ CNTFROQ, Counter-timer Frequency on page 15-7164 
CNTID CNTID, Counter Identification Register on page 15-7166 
CNTNSAR CNTNSAR, Counter-timer Non-secure Access Register on page 15-7167 
CNTP_CTL CNTP_CTL, Counter-timer Physical Timer Control on page 15-7169 
CNTP_CVAL CNTP_CVAL, Counter-timer Physical Timer CompareValue on page 15-7172 
CNTP_TVAL CNTP_TVAL, Counter-timer Physical Timer TimerValue on page 15-7174 
CNTPCT CNTPCT, Counter-timer Physical Count on page 15-7176 
CNTSCR CNTSCR, Counter Scale Register on page 15-7178 
CNTSR CNTSR, Counter Status Register on page 15-7180 
CNTTIDR CNTTIDR, Counter-timer Timer ID Register on page 15-7182 
CNTV_CTL CNTV_CTL, Counter-timer Virtual Timer Control on page 15-7184 
CNTV_CVAL CNTV_CVAL, Counter-timer Virtual Timer CompareValue on page 15-7187 
CNTV_TVAL CNTV_TVAL, Counter-timer Virtual Timer Timer Value on page I5-7189 
CNTVCT CNTVCT, Counter-timer Virtual Count on page 15-7191 
CNTVOFF CNTVOFF, Counter-timer Virtual Offset on page 15-7193 
CNTVOFF<n> CNTVOFF<n>, Counter-timer Virtual Offsets, n = 0 - 7 on page 15-7195 
CounterID<n> CounterID<n>, Counter ID registers, n = 0 - 11 on page 15-7197 
CTIAPPCLEAR CTIAPPCLEAR, CTI Application Trigger Clear register on page H9-6962 
CTIAPPPULSE CTIAPPPULSE, CTI Application Pulse register on page H9-6963 
CTIAPPSET CTIAPPSET, CTI Application Trigger Set register on page H9-6964 
CTIAUTHSTATUS CTIAUTHSTATUS, CTI Authentication Status register on page H9-6965 
CTICHINSTATUS CTICHINSTATUS, CTI Channel In Status register on page H9-6966 
CTICHOUTSTATUS CTICHOUTSTATUS, CTI Channel Out Status register on page H9-6967 
CTICIDRO CTICIDRO, CTI Component Identification Register 0 on page H9-6968 
CTICIDR1 CTICIDR1, CTI Component Identification Register 1 on page H9-6969 
CTICIDR2 CTICIDR2, CTI Component Identification Register 2 on page H9-6970 
CTICIDR3 CTICIDR3, CTI Component Identification Register 3 on page H9-6971 
CTICLAIMCLR CTICLAIMCLR, CTI Claim Tag Clear register on page H9-6972 
CTICLAIMSET CTICLAIMSET, CTI Claim Tag Set register on page H9-6973 
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Table K14-33 Alphabetical index of Memory-Mapped Registers (continued) 







































































Register Description, see 

CTICONTROL CTICONTROL, CTI Control register on page H9-6974 

CTIDEVAFFO CTIDEVAFF0, CTI Device Affinity register 0 on page H9-6975 

CTIDEVAFF 1 CTIDEVAFF 1, CTI Device Affinity register 1 on page H9-6976 

CTIDEVARCH CTIDEVARCH, CTI Device Architecture register on page H9-6977 

CTIDEVCTL CTIDEVCTL, CTI Device Control register on page H9-6979 

CTIDEVID CTIDEVID, CTI Device ID register 0 on page H9-698 1 

CTIDEVID1 CTIDEVID1, CTI Device ID register 1 on page H9-6983 

CTIDEVID2 CTIDEVID2, CTI Device ID register 2 on page H9-6984 

CTIDEVTYPE CTIDEVTYPE, CTI Device Type register on page H9-6985 

CTIGATE CTIGATE, CTI Channel Gate Enable register on page H9-6986 

CTIINEN<n> CTIINEN<n>, CTI Input Trigger to Output Channel Enable registers, n = 0 - 31 on 
page H9-6987 

CTINTACK CTIINTACK, CTI Output Trigger Acknowledge register on page H9-6988 

CTUTCTRL CTITCTRL, CTI Integration mode Control register on page H9-6990 

CTILAR CTILAR, CTI Lock Access Register on page H9-6992 

CTILSR CTILSR, CTI Lock Status Register on page H9-6994 

CTIOUTENK<n> CTIOUTENK<n>, CTI Input Channel to Output Trigger Enable registers, n = 0 - 31 on 
page H9-6996 

CTIPIDRO CTIPIDRO, CTI Peripheral Identification Register 0 on page H9-6997 

CTIPIDR1 CTIPIDR1, CTI Peripheral Identification Register 1 on page H9-6998 

CTIPIDR2 CTIPIDR2, CTI Peripheral Identification Register 2 on page H9-6999 

CTIPIDR3 CTIPIDR3, CTI Peripheral Identification Register 3 on page H9-7000 

CTIPIDR4 CTIPIDR4, CTI Peripheral Identification Register 4 on page H9-7001 

CTITRIGINSTATUS CTITRIGINSTATUS, CTI Trigger In Status register on page H9-7002 

CTITRIGOUTSTATUS CTITRIGOUTSTATUS, CTI Trigger Out Status register on page H9-7003 





DBGAUTHSTATUS_EL1 


DBGAUTHSTATUS_EL1, Debug Authentication Status register on page H9-6854 





DBGBCR<n>_EL1 


DBGBCR<n>_EL1, Debug Breakpoint Control Registers, n = 0 - 15 on page H9-6856 





DBGBVR<n>_EL1 


DBGBVR<n>_EL1, Debug Breakpoint Value Registers, n = 0 - 15 on page H9-6860 





DBGCLAIMCLR_ EL1 


DBGCLAIMCLR_ELI, Debug Claim Tag Clear register on page H9-6865 





DBGCLAIMSET EL1 


DBGCLAIMSET_EL1, Debug Claim Tag Set register on page H9-6867 





DBGDTRRX_ELO 


DBGDTRRX_ELO, Debug Data Transfer Register, Receive on page H9-6869 





DBGDTRTX_ELO 


DBGDTRTX_EL0, Debug Data Transfer Register, Transmit on page H9-6871 





DBGWCR<n>_EL1 
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Table K14-33 Alphabetical index of Memory-Mapped Registers (continued) 





Register 


DBGWVR<n>_EL1 


Description, see 


DBGWVR<n>_EL1, Debug Watchpoint Value Registers, n = 0 - 15 on page H9-6876 































































































EDAA32PFR EDAA32PFR, External Debug AArch32 Processor Feature Register on page H9-6878 
EDACR EDACR, External Debug Auxiliary Control Register on page H9-6880 
EDCIDRO EDCIDRO, External Debug Component Identification Register 0 on page H9-688 1 
EDCIDR1 EDCIDRI, External Debug Component Identification Register 1 on page H9-6882 
EDCIDR2 EDCIDR2, External Debug Component Identification Register 2 on page H9-6883 
EDCIDR3 EDCIDR3, External Debug Component Identification Register 3 on page H9-6884 
EDCIDSR EDCIDSR, External Debug Context ID Sample Register on page H9-6885 
EDDEVAFFO EDDEVAFFO, External Debug Device Affinity register 0 on page H9-6887 
EDDEVAFF1 EDDEVAFF1, External Debug Device Affinity register 1 on page H9-6888 
EDDEVARCH EDDEVARCH, External Debug Device Architecture register on page H9-6889 
EDDEVID EDDEVID, External Debug Device ID register 0 on page H9-6891 
EDDEVID1 EDDEVID1, External Debug Device ID register 1 on page H9-6893 
EDDEVID2 EDDEVID2, External Debug Device ID register 2 on page H9-6894 
EDDEVTY PE EDDEVTYPE, External Debug Device Type register on page H9-6895 
EDDFR EDDFR, External Debug Feature Register on page H9-6896 
EDECCR EDECCR, External Debug Exception Catch Control Register on page H9-6899 
EDECR EDECR, External Debug Execution Control Register on page H9-6904 
EDESR EDESR, External Debug Event Status Register on page H9-6906 
EDITCTRL EDITCTRL, External Debug Integration mode Control register on page H9-6908 
EDITR EDITR, External Debug Instruction Transfer Register on page H9-6910 
EDLAR EDLAR, External Debug Lock Access Register on page H9-6912 
EDLSR EDLSR, External Debug Lock Status Register on page H9-6914 
EDPCSR EDPCSR, External Debug Program Counter Sample Register on page H9-6916 
EDPFR EDPFR, External Debug Processor Feature Register on page H9-6920 
EDPIDRO EDPIDRO, External Debug Peripheral Identification Register 0 on page H9-6925 
EDPIDR1 EDPIDRI, External Debug Peripheral Identification Register 1 on page H9-6926 
EDPIDR2 EDPIDR2, External Debug Peripheral Identification Register 2 on page H9-6927 
EDPIDR3 EDPIDR3, External Debug Peripheral Identification Register 3 on page H9-6928 
EDPIDR4 EDPIDR4, External Debug Peripheral Identification Register 4 on page H9-6929 
EDPRCR EDPRCR, External Debug Power/Reset Control Register on page H9-6930 
EDPRSR EDPRSR, External Debug Processor Status Register on page H9-6935 
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Table K14-33 Alphabetical index of Memory-Mapped Registers (continued) 































































































Register Description, see 

EDRCR EDRCR, External Debug Reserve Control Register on page H9-6943 

EDSCR EDSCR, External Debug Status and Control Register on page H9-6945 

EDVIDSR EDVIDSR, External Debug Virtual Context Sample Register on page H9-6950 

EDWAR EDWAR, External Debug Watchpoint Address Register on page H9-6954 

ERRCIDRO ERRCIDRO, Component Identification Register 0 on page 15-7200 

ERRCIDRI1 ERRCIDR1, Component Identification Register 1 on page 15-7201 

ERRCIDR2 ERRCIDR2, Component Identification Register 2 on page 15-7202 

ERRCIDR3 ERRCIDR3, Component Identification Register 3 on page 15-7203 

ERRCRICRO ERRCRICRO, Critical Error Interrupt Configuration Register 0 on page 15-7204 

ERRCRICRI1 ERRCRICR1, Critical Error Interrupt Configuration Register 1 on page 15-7206 

ERRCRICR2 ERRCRICR2, Critical Error Interrupt Configuration Register 2 on page 15-7207 

ERRDEVAFF ERRDEVAFF, Device Affinity Register on page 15-7210 

ERRDEVARCH ERRDEVARCH, Device Architecture Register on page 15-7213 

ERRDEVID ERRDEVID, Device Configuration Register on page 15-7215 

ERRERICRO ERRERICRO, Error Recovery Interrupt Configuration Register 0 on page 15-7216 

ERRERICR1 ERRERICRI, Error Recovery Interrupt Configuration Register 1 on page 15-7218 

ERRERICR2 ERRERICR2, Error Recovery Interrupt Configuration Register 2 on page I5-7219 

ERRFHICRO ERRFHICRO, Fault-Handling Interrupt Configuration Register 0 on page 15-7222 

ERRFHICR1 ERRFHICRI, Fault-Handling Interrupt Configuration Register 1 on page 15-7224 

ERRFHICR2 ERRFHICR2, Fault-Handling Interrupt Configuration Register 2 on page 15-7225 

ERRGSR ERRGSR, Error Group Status Register on page 15-7228 

ERRIIDR ERRIIDR, Implementation Identification Register on page 15-7230 

ERRIRQCR<n> ERRIRQCR<n>, Generic Error Interrupt Configuration Register, n = 0 - 15 on 
page 15-7232 

ERRIRQSR ERRIRQSR, Error Interrupt Status Register on page 15-7233 

ERR<n>ADDR ERR<n>ADDR, Error Record Address Register, n = 0 - 65534 on page I5-7236 

ERR<n>CTLR ERR<n>CTLR, Error Record Control Register, n = 0 - 65534 on page 15-7239 

ERR<n>FR ERR<n>FR, Error Record Feature Register, n = 0 - 65534 on page 15-7247 

ERR<n>MISCO ERR<n>MISC0, Error Record Miscellaneous Register 0 on page 15-7252 

ERR<n>MISC1 ERR<n>MISC1, Error Record Miscellaneous Register 1, n = 0 - 65534 on page 15-7258 

ERR<n>MISC2 ERR<n>MISC2, Error Record Miscellaneous Register 2, n = 0 - 65534 on page I5-7260 

ERR<n>MISC3 ERR<n>MISC3, Error Record Miscellaneous Register 3, n = 0 - 65534 on page 15-7262 
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Table K14-33 Alphabetical index of Memory-Mapped Registers (continued) 

























































































Register Description, see 
ERR<n>PFGCDN ERR<n>PFGCDN, Pseudo-fault Generation Countdown Register, n = 0 - 65534 on 
page 15-7264 
ERR<n>PFGCTL ERR<n>PFGCTL, Pseudo-fault Generation Control Register, n = 0 - 65534 on 
page 15-7266 
ERR<n>PFGF ERR<n>PFGF, Pseudo-fault Generation Feature Register, n = 0 - 65534 on page 15-7270 
ERR<n>STATUS ERR<n>STATUS, Error Record Primary Status Register, n = 0 - 65534 on page 15-7274 
ERRPIDRO ERRPIDRO, Peripheral Identification Register 0 on page 15-7287 
ERRPIDR1 ERRPIDRI1, Peripheral Identification Register 1 on page 15-7288 
ERRPIDR2 ERRPIDR2, Peripheral Identification Register 2 on page 15-7290 
ERRPIDR3 ERRPIDR3, Peripheral Identification Register 3 on page 15-7292 
ERRPIDR4 ERRPIDR4, Peripheral Identification Register 4 on page 15-7294 
MIDR ELI MIDR_ELI, Main ID Register on page H9-6956 
OSLAR_EL1 OSLAR_EL1, OS Lock Access Register on page H9-6958 
PMAUTHSTATUS PMAUTHSTATUS, Performance Monitors Authentication Status register on page 15-7040 
PMCCFILTR_ELO PMCCFILTR_ELO, Performance Monitors Cycle Counter Filter Register on page 15-7042 
PMCCNTR_ELO PMCCNTR_ELO, Performance Monitors Cycle Counter on page 15-7045 
PMCEIDO PMCEIDO, Performance Monitors Common Event Identification register 0 on 
page 15-7047 
PMCEID1 PMCEID1, Performance Monitors Common Event Identification register 1 on 
page 15-7049 
PMCEID2 PMCEID2, Performance Monitors Common Event Identification register 2 on 
page 15-7051 
PMCEID3 PMCEID3, Performance Monitors Common Event Identification register 3 on 
page 15-7053 
PMCFGR PMCFGR, Performance Monitors Configuration Register on page 15-7055 
PMCIDISR PMCIDISR, CONTEXTIDR_EL1 Sample Register on page 15-7061 
PMCID2SR PMCID2S8R, CONTEXTIDR_EL2 Sample Register on page 15-7063 
PMCIDRO PMCIDRO, Performance Monitors Component Identification Register 0 on page 15-7057 
PMCIDR1 PMCIDRI, Performance Monitors Component Identification Register 1 on page 15-7058 
PMCIDR2 PMCIDR2, Performance Monitors Component Identification Register 2 on page 15-7059 
PMCIDR3 PMCIDR3, Performance Monitors Component Identification Register 3 on page 15-7060 
PMCNTENCLR_ELO PMCNTENCLR_ELO, Performance Monitors Count Enable Clear register on 
page 15-7065 
PMCNTENSET_ELO PMCNTENSET ELO, Performance Monitors Count Enable Set register on page 15-7067 
PMCR_ELO PMCR_ELO, Performance Monitors Control Register on page 15-7069 
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Table K14-33 Alphabetical index of Memory-Mapped Registers (continued) 




















Register Description, see 

PMDEVAFFO0 PMDEVAFFO, Performance Monitors Device Affinity register 0 on page 15-7073 
PMDEVAFFI1 PMDEVAFF1, Performance Monitors Device Affinity register 1 on page 15-7074 
PMDEVARCH PMDEVARCH, Performance Monitors Device Architecture register on page 15-7075 
PMDEVID PMDEVID, Performance Monitors Device ID register on page 15-7077 
PMDEVTYPE PMDEVTYPE, Performance Monitors Device Type register on page 15-7079 
PMEVCNTR<n>_ELO PMEVCNTR<n>_ELO, Performance Monitors Event Count Registers, n = 0 - 30 on 


page 15-7080 





PMEVTYPER<n>_ELO 


PMEVTYPER<n>_ELO, Performance Monitors Event Type Registers, n = 0 - 30 on 
page 15-7082 





PMINTENCLR ELI 


PMINTENCLR_ELI, Performance Monitors Interrupt Enable Clear register on 
page 15-7086 




















PMINTENSET EL1 PMINTENSET _EL1, Performance Monitors Interrupt Enable Set register on page 15-7088 
PMITCTRL PMITCTRL, Performance Monitors Integration mode Control register on page 15-7090 
PMLAR PMLAR, Performance Monitors Lock Access Register on page 15-7092 

PMLSR PMLSR, Performance Monitors Lock Status Register on page 15-7094 

PMMIR PMMIR, Performance Monitors Machine Identification Register on page 15-7096 
PMOVSCLR_ELO PMOVSCLR_ELO, Performance Monitors Overflow Flag Status Clear register on 


page 15-7097 





P. 


MOVSSET_ELO 


PMOVSSET_ELO, Performance Monitors Overflow Flag Status Set register on 
page 15-7099 





























PMPCSR PMPCSR, Program Counter Sample Register on page 15-7101 

PMPIDRO PMPIDRO, Performance Monitors Peripheral Identification Register 0 on page 15-7104 
PMPIDR1 PMPIDR1, Performance Monitors Peripheral Identification Register 1 on page 15-7105 
PMPIDR2 PMPIDR2, Performance Monitors Peripheral Identification Register 2 on page 15-7106 
PMPIDR3 PMPIDR3, Performance Monitors Peripheral Identification Register 3 on page 15-7107 
PMPIDR4 PMPIDR4, Performance Monitors Peripheral Identification Register 4 on page 15-7108 
PMSWINC ELO PMSWINC_ELO, Performance Monitors Software Increment register on page 15-7109 
PMVIDSR PMVIDSR, VMID Sample Register on page 15-7111 
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K14.7 Functional index of memory-mapped registers 


This section is an index of the memory-mapped registers, divided by functional group. Each of the following 


sections lists the registers for a functional group: 


ID registers. 


Performance monitors registers. 

Debug registers on page K14-7876. 

RAS registers on page K14-7877. 

Cross-trigger interface registers on page K14-7878. 


K14.7.1 ID registers 


This section is an index to the registers in the Identification registers functional group. 


Table K14-34 ID registers 

















Register Description, see 
EDAA32PFR EDAA32PFR 
EDDFR EDDFR 

EDPFR EDPFR 

MIDR ELI MIDR_ ELI 





K14.7.2 Performance monitors registers 


This section is an index to the registers in the Performance Monitors registers functional group. 


Table K14-35 Performance monitors registers 
























































Register Description, see 
PMAUTHSTATUS PMAUTHSTATUS 
PMCCFILTR_ELO PMCCFILTR_ELO 
PMCCNTR_ELO PMCCNTR_ELO 
PMCEIDO PMCEIDO 
PMCEID1 PMCEID1 
PMCEID2 PMCEID2 
PMCEID3 PMCEID3 
PMCFGR PMCFGR 
PMCIDISR PMCIDISR 
PMCID2SR PMCID2SR 
PMCIDRO PMCIDRO 
PMCIDR1 PMCIDRI 
PMCIDR2 PMCIDR2 
PMCIDR3 PMCIDR3 
PMCNTENCLR_ELO PMCNTENCLR_ELO 
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Table K14-35 Performance monitors registers (continued) 
































Register Description, see 
PMCNTENSET_ELO PMCNTENSET_ELO 
PMCR_ELO PMCR_ELO 
PMDEVAFFO PMDEVAFFO 
PMDEVAFF1 PMDEVAFFI1 
PMDEVARCH PMDEVARCH 
PMDEVID PMDEVID 
PMDEVTYPE PMDEVTYPE 
PMEVCNTR<n>_ELO PMEVCNTR<n>_ELO 
PMEVTYPER<n>_ELO PMEVTYPER<n>_ELO 
PMINTENCLR ELI PMINTENCLR_EL1 





















































PMINTENSET EL1 PMINTENSET EL1 
PMITCTRL PMITCTRL 
PMLAR PMLAR 

PMLSR PMLSR 

PMMIR PMMIR 
PMOVSCLR_ELO PMOVSCLR_ELO 
PMOVSSET_ELO PMOVSSET_ELO 
PMPCSR PMPCSR 
PMPIDRO PMPIDRO 
PMPIDR1 PMPIDRI1 
PMPIDR2 PMPIDR2 
PMPIDR3 PMPIDR3 
PMPIDR4 PMPIDR4 
PMSWINC ELO PMSWINC_ELO 
PMVIDSR PMVIDSR 





ARM DDI 0487E.a 
ID070919 


Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. 


Non-Confidential 


K14-7875 


Registers Index 


K14.7 Functional index of memory-mapped registers 


K14.7.3 Debug registers 


This section is an index to the registers in the Debug registers functional group. 


Table K14-36 Debug registers 





Register 


Description, see 





DBGAUTHSTATUS_EL1 


DBGAUTHSTATUS EL1 





DBGBCR<n>_EL1 


DBGBCR<n>_EL1 





DBGBVR<n>_EL1 


DBGBVR<n>_EL1 





DBGCLAIMCLR_ EL1 


DBGCLAIMCLR EL1 





DBGCLAIMSET EL1 


DBGCLAIMSET EL1 





DBGDTRRX_ELO 


DBGDTRRX_ELO 





DBGDTRTX_ELO 


DBGDTRTX_ELO 





DBGWCR<n>_EL1 


DBGWCR<n>_EL1 





DBGWVR<n>_EL1 


DBGWVR<n>_EL1 

































































EDACR EDACR 
EDCIDRO EDCIDRO 
EDCIDR1 EDCIDR1 
EDCIDR2 EDCIDR2 
EDCIDR3 EDCIDR3 
EDCIDSR EDCIDSR 
EDDEVAFFO EDDEVAFFO 
EDDEVAFF1 EDDEVAFF1 
EDDEVARCH EDDEVARCH 
EDDEVID EDDEVID 
EDDEVID1 EDDEVID1 
EDDEVID2 EDDEVID2 
EDDEVTYPE EDDEVTYPE 
EDECCR EDECCR 
EDECR EDECR 
EDESR EDESR 
EDITCTRL EDITCTRL 
EDITR EDITR 
EDLAR EDLAR 
EDLSR EDLSR 
EDPCSR EDPCSR 
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Table K14-36 Debug registers (continued) 






































Register Description, see 
EDPIDRO EDPIDRO 
EDPIDRI EDPIDRI 
EDPIDR2 EDPIDR2 
EDPIDR3 EDPIDR3 
EDPIDR4 EDPIDR4 
EDPRCR EDPRCR 
EDPRSR EDPRSR 
EDRCR EDRCR 
EDSCR EDSCR 
EDVIDSR EDVIDSR 
EDWAR EDWAR 
OSLAR_EL1 OSLAR_EL1 





K14.7.4 RAS registers 


This section is an index to the registers in the RAS registers functional group. 


Table K14-37 RAS registers 


















































Register Description, see 
ERRCIDRO ERRCIDRO 
ERRCIDR1 ERRCIDR1 
ERRCIDR2 ERRCIDR2 
ERRCIDR3 ERRCIDR3 
ERRCRICRO ERRCRICRO 
ERRCRICRI1 ERRCRICRI 
ERRCRICR2 ERRCRICR2 
ERRDEVAFF ERRDEVAFF 
ERRDEVARCH ERRDEVARCH 
ERRDEVID ERRDEVID 
ERRERICRO ERRERICRO 
ERRERICR1 ERRERICR1 
ERRERICR2 ERRERICR2 
ERRFHICRO ERRFHICRO 
ERRFHICR1 ERRFHICR1 
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Table K14-37 RAS registers (continued) 

































































Register Description, see 
ERRFHICR2 ERRFHICR2 
ERRGSR ERRGSR 
ERRIDR ERRIIDR 
ERRIRQCR<n> ERRIRQCR<n> 
ERRIRQSR ERRIRQSR 
ERR<n>ADDR ERR<n>ADDR 
ERR<n>CTLR ERR<n>CTLR 
ERR<n>FR ERR<n>FR 
ERR<n>MISCO ERR<n>MISCO 
ERR<n>MISC1 ERR<n>MISC1 
ERR<n>MISC2 ERR<n>MISC2 
ERR<n>MISC3 ERR<n>MISC3 
ERR<n>PFGCDN ERR<n>PFGCDN 
ERR<n>PFGCTL ERR<n>PFGCTL 
ERR<n>PFGF ERR<n>PFGF 
ERR<n>STATUS ERR<n>STATUS 
ERRPIDRO ERRPIDRO 
ERRPIDRI1 ERRPIDRI1 
ERRPIDR2 ERRPIDR2 
ERRPIDR3 ERRPIDR3 
ERRPIDR4 ERRPIDR4 





K14.7.5 Cross-trigger interface registers 


This section is an index to the registers in the Cross-Trigger Interface registers functional group. 


Table K14-38 Cross-trigger interface registers 























Register Description, see 
ASICCTL ASICCTL 
CTIAPPCLEAR CTIAPPCLEAR 
CTIAPPPULSE CTIAPPPULSE 
CTIAPPSET CTIAPPSET 
CTIAUTHSTATUS CTIAUTHSTATUS 
CTICHINSTATUS CTICHINSTATUS 
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Register Description, see 
CTICHOUTSTATUS CTICHOUTSTATUS 
CTICIDRO CTICIDRO 
CTICIDRI1 CTICIDR1 
CTICIDR2 CTICIDR2 
CTICIDR3 CTICIDR3 
CTICLAIMCLR CTICLAIMCLR 
CTICLAIMSET CTICLAIMSET 
CTICONTROL CTICONTROL 
CTIDEVAFF0O CTIDEVAFFO 
CTIDEVAFF1 CTIDEVAFF1 
CTIDEVARCH CTIDEVARCH 
CTIDEVCTL CTIDEVCTL 
CTIDEVID CTIDEVID 
CTIDEVID1 CTIDEVID1 
CTIDEVID2 CTIDEVID2 
CTIDEVTYPE CTIDEVTYPE 
CTIGATE CTIGATE 
CTIINEN<n> CTIINEN<n> 
CTIINTACK CTIINTACK 
CTIITCTRL CIUTCTRL 
CTILAR CTILAR 

CTILSR CTILSR 
CTIOUTEN<n> CTIOUTEN<n> 
CTIPIDRO CTIPIDRO 
CTIPIDRI CTIPIDR1 
CTIPIDR2 CTIPIDR2 
CTIPIDR3 CTIPIDR3 
CTIPIDR4 CTIPIDR4 
CTITRIGINSTATUS CTITRIGINSTATUS 
CTITRIGOUTSTATUS CTITRIGOUTSTATUS 
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A32 instruction A word that specifies an operation to be performed by a PE that is executing in an Exception level that is using 
AArch32 and is in A32 state. A32 instructions must be word-aligned. 


A32 instructions were previously called ARM instructions. 
See also A32 state, A64 instruction, T32 instruction. 
A32 state The AArch32 Instruction set state in which the PE executes A32 instructions. 
A32 state was previously called ARM state. 
See also T32 instruction, T32 state. 


A64 instruction A word that specifies an operation to be performed by a PE that is executing in an Exception level that is using 
AArch64. A64 instructions must be word-aligned. 


See also A32 instruction, T32 instruction. 


AArch32 The 32-bit Execution state. In AArch32 state, addresses are held in 32-bit registers, and instructions in the base 
instruction sets use 32-bit registers for their processing. AArch32 state supports the T32 and A32 instruction sets 


See also AArch64, A32 instruction, T32 instruction. 


AArch64 The 64-bit Execution state. In AArch64 state, addresses are held in 64-bit registers, and instructions in the base 
instruction set can use 64-bit registers for their processing. AArch64 state supports the A64 instruction set. 


See also AArch32, A64 instruction. 


Abort An exception caused by an illegal memory access. Aborts can be caused by the external memory system or the 
MMU. 


Addressing mode 
Means a method for generating the memory address used by a load/store instruction. 


Advanced SIMD A feature of the Arm architecture that provides SIMD operations on a register file of SIMD and floating-point 
registers. Where an implementation supports both Advanced SIMD and floating-point instructions, these 
instructions operate on the same register file. 
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Aligned 


A data item stored at an address that is exactly divisible by the highest power of 2 that divides exactly into its size 
in bytes. Aligned halfwords, words and doublewords therefore have addresses that are divisible by 2, 4 and 8 
respectively. 


An aligned access is one where the address of the access is aligned to the size of each element of the access. 


Architecturally executed 


An instruction is architecturally executed only if it would be executed in a simple sequential execution of the 
program. When such an instruction has been executed and retired it has been architecturally executed. Any 
instruction that, in a simple sequential execution of a program, is treated as a NOP because it fails its condition code 
check, is an architecturally executed instruction. 


In a PE that performs speculative execution, an instruction is not architecturally executed if the PE discards the 
results of a speculative execution. 


See also Condition code check, Simple sequential execution. 


Architecturally mapped 


Where this manual describes a register as being architecturally mapped to another register, this indicates that, in an 
implementation that supports both of the registers, the two registers access the same state. 


Architecturally UNKNOWN 


An architecturally UNKNOWN value is a value that is not defined by the architecture but must meet the requirements 
of the definition of UNKNOWN. Implementations can define the value of the field, but are not required to do so. 


See also IMPLEMENTATION DEFINED. 


ARM core registers 


ARM instruction 


Associativity 


Atomicity 


Banked register 


Base register 


Some older documentation uses ARM core registers to refer to the following set of registers for execution in 
AArch32 state: 


a The 13 general-purpose registers, RO-R12, that software can use for processing. 
° SP, the stack pointer, that can also be referred to as R13. 

. LR, the link register, that can also be referred to as R14. 

. PC, the program counter, that can also be referred to as R15. 


See also General-purpose registers. 


See A32 instruction. 
See Cache associativity. 


Describes either single-copy atomicity or multi-copy atomicity. Atomicity in the Arm architecture on page B2-110 
defines these forms of atomicity for the Arm architecture. 


See also Multi-copy atomicity, Single-copy atomicity. 


A register that has multiple instances, with the instance that is in use depending on the PE mode, Security state, or 
other PE state. 


A register specified by a load/store instruction that is used as the base value for the address calculation for the 
instruction. Depending on the instruction and its addressing mode, an offset can be added to or subtracted from the 
base register value to form the virtual address that is sent to memory. 


Base register writeback 


Behaves as if 


Describes writing back a modified value to the base register used in an address calculation. 


Where this manual indicates that a PE behaves as ifa certain condition applies, all descriptions of the operation of 
the PE must be re-evaluated taking account of that condition, together with any other conditions that affect 
operation. 


Big-endian memory 


Glossary-7882 


Means that, for example: 


è A byte or halfword at a word-aligned address is the most significant byte or halfword in the word at that 
address. 
Copyright © 2013-2019 Arm Limited or its affiliates. All rights reserved. ARM DDI 0487E.a 


Non-Confidential ID070919 


Blocking 


Branch prediction 


Breakpoint 


Byte 


Glossary 


è A byte at a halfword-aligned address is the most significant byte in the halfword at that address. 
See also Endianness, Little-endian memory. 
Describes an operation that does not permit following instructions to be executed before the operation completes. 


A non-blocking operation can permit following instructions to be executed before the operation completes, and in 
the event of encountering an exception does not signal an exception to the PE. This enables implementations to retire 
following instructions while the non-blocking operation is executing, without the need to retain precise PE state. 


Is where a PE selects a future execution path to fetch along. For example, after a branch instruction, the PE can 
choose to speculatively fetch either the instruction following the branch or the instruction at the branch target. 


See also Prefetching. 


A debug event triggered by the execution of a particular instruction, specified by one or both of the address of the 
instruction and the state of the PE when the instruction is executed. 


An 8-bit data item. 


Cache associativity 


Cache level 


Cache line 


Cache lockdown 


Cache miss 


Cache sets 


Cache way 


Coherence order 


Coherent 


The number of locations in a cache set to which an address can be assigned. Each location is identified by its way 
value. 


The position of a cache in the cache hierarchy. In the Arm architecture, the lower numbered levels are those closest 
to the PE. For more information, see Terms used in describing the cache maintenance instructions on page D4-2478. 


The basic unit of storage in a cache. Its size in words is always a power of two, usually 4 or 8 words. A cache line 
must be aligned to a suitable memory boundary. A memory cache line is a block of memory locations with the same 
size and alignment as a cache line. Memory cache lines are sometimes loosely called cache lines. 


Enables critical software and data to be loaded into the cache so that the cache lines containing them are not 
subsequently reallocated. It alleviates the delays caused by accessing a cache in a worst-case situation. This ensures 
that all subsequent accesses to the software and data concerned are cache hits and so complete quickly. 


A memory access that cannot be processed at high speed because the data it addresses is not in the cache. 


Areas of a cache, divided up to simplify and speed up the process of determining whether a cache hit occurs. The 
number of cache sets is always a power of two. 


A cache way consists of one cache line from each cache set. The cache ways are indexed from 0 to (Associativity-1). 
Each cache line in a cache way is chosen to have the same index as the cache way. For example, cache way n consists 
of the cache line with index n from each cache set. 


See Coherent. 


Data accesses from a set of observers to a byte in memory are coherent if accesses to that byte in memory by the 
members of that set of observers are consistent with there being a single total order of all writes to that byte in 
memory by all members of the set of observers. This single total order of all to writes to that memory location is the 
coherence order for that byte in memory. 


Condition code check 


The process of determining whether a conditional instruction executes normally or is treated as a NOP. For an 
instruction that includes a condition code field, that field is compared with the condition flags to determine whether 
the instruction is executed normally. For a T32 instruction in an IT block, the value of PSTATE.IT determines 
whether the instruction is executed normally. 


See also Condition code field, Condition flags, Conditional execution. 


Condition code field 
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A 4-bit field in an instruction that specifies the condition under which the instruction executes. 


See also Condition code check. 
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Condition flags 


The N, Z, C, and V bits of PSTATE, an SPSR, or FPSCR. See the register descriptions for more information. 


See also Condition code check, PSTATE. 


Conditional execution 


When a conditional instruction starts executing, if the condition code check returns TRUE, the instruction executes 
normally. Otherwise, it is treated as a NOP. 


See also Condition code check. 


CONSTRAINED UNPREDICTABLE 


Context switch 


Where an instruction can result in UNPREDICTABLE behavior, the Armv8 architecture specifies a narrow range of 
permitted behaviors. This range is the range of CONSTRAINED UNPREDICTABLE behavior. All implementations that 
are compliant with the architecture must follow the CONSTRAINED UNPREDICTABLE behavior. 


Execution at Non-secure EL1 or ELO of an instruction that is CONSTRAINED UNPREDICTABLE can be implemented 
as generating a trap exception that is taken to EL2, provided that at least one instruction that is not UNPREDICTABLE 
and is not CONSTRAINED UNPREDICTABLE causes a trap exception that is taken to EL2. 


In body text, the term CONSTRAINED UNPREDICTABLE is shown in SMALL CAPITALS. 
See also UNPREDICTABLE. 


The saving and restoring of computational state when switching between different threads or processes. In this 
manual, the term context switch describes any situation where the context is switched by an operating system and 
might or might not include changes to the address space. 


Context synchronization event 


Glossary-7884 


One of: 


° Performing an ISB operation. An ISB operation is performed when an ISB instruction is executed and does 
not fail its condition code check. 


$ Exception entry, if ARMv8.5-CSEH is not implemented or the exception is taken to AArch32 or if 
ARMv8.5-CSEH is implemented and the appropriate SCTLR_ELx.EIS bit is set. 


s Return from an exception, if ARMv8.5-CSEH is not implemented, or the exception is returning from 
AArch32 or if ARMv8.5-CSEH is implemented and the appropriate SCTLR_ELx.EOS bit is set. 


. Exit from Debug state. 
7 Executing a DCPS instruction. 
. Executing a DRPS instruction. 


The effects of a Context synchronization event are: 


x All unmasked interrupts that are pending at the time of the Context synchronization event are taken before 
the first instruction after the Context synchronization event. 


è If halting is allowed, all Halting debug events that are pending at the time of the Context synchronization 
event are taken before the first instruction after the Context synchronization event. 


è No instructions appearing in program order after an instruction that causes a Context synchronization event 
will have performed any part of their functionality until the Context synchronization event has occurred. 


7 All direct and indirect writes to System registers that are made before the Context synchronization event 
affect any instruction, including a direct read, that appears in program order after the instruction causing the 
Context synchronization event. 


s All completed changes to the translation tables for entries that, before the change, were not permitted to be 
cached in a TLB, affect all instruction fetches that appear in program order after the instruction causing the 
Context synchronization event. 


. All invalidations of TLBs, instruction caches, and, in AArch32 state, branch predictors, that are completed 
before the Context synchronization event affect all instructions that appear in program order after an 
instruction causing a Context synchronization event. 
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In AArch32 state, all Non-cacheable writes that are completed before the Context synchronization event 
affect all instructions that appear in program order after an instruction causing a Context synchronization 
event. 

è Changes to the Debug external authentication interfaces that are made before the Context synchronization 


event affect any instruction that appears in program order after the instruction causing the Context 
synchronization event. 





Note 
s The architecture requires that instructions that generate Context synchronization events do not appear to be 
executed speculatively, except that the performance monitor counters are permitted to reveal such 
speculation. 
. Context synchronization events were previously described as context synchronization operations. 





Data independent timing (DIT) 


Debugger 


Deprecated 


The time that it takes to execute a piece of code where the time is not a function of the data being operated on. For 
more information, see About PSTATE.DIT on page B1-105 and About the DIT bit on page E1-3793. 


In most of this manual, debugger refers to any agent that is performing debug. However, some chapters or parts of 
this manual require a more rigorous definition, and define debugger locally. See: 


. Definition of a debugger in the context of self-hosted debug on page D2-2398. 
. Definition of a debugger in the context of self-hosted debug on page G2-5612. 
. Definition and constraints of a debugger in the context of external debug on page H1-6700. 


Something that is present in the Arm architecture for backwards compatibility. Whenever possible software must 
avoid using deprecated features. Features that are deprecated but are not optional are present in current 
implementations of the Arm architecture, but might not be present, or might be deprecated and OPTIONAL, in future 
versions of the Arm architecture. 


See also OPTIONAL. 


Digital signal processing (DSP) 


Algorithms for processing signals that have been sampled and converted to digital form. DSP algorithms often use 
saturated arithmetic. 


Direct Memory Access (DMA) 


Direct read 


Direct write 


DMA 
DNM 


Domain 
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An operation that accesses main memory directly, without the PE performing any accesses to the data concerned. 
A direct read of a System register is a read performed by a System register access instruction. 

For more information, see Direct read on page D13-2821. 

See also Direct write, Indirect read, Indirect write. 

A direct write of a System register is a write performed by a System register access instruction. 

For more information, see Direct write on page D13-2821. 

See also Direct read, Indirect read, Indirect write. 

See Direct Memory Access (DMA). 

See Do-Not-Modify (DNM). 

In the Arm architecture, domain is used in the following contexts. 


Shareability domain Defines a set of observers for which the shareability attributes make the data or unified 
caches transparent for data accesses. 


Power domain Defines a block of logic with a single, common, power supply. 
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Memory regions domain 


When using the Short-descriptor translation table format, defines a collection of Sections, 

Large pages and Small pages of memory, that can have their access permissions switched 

rapidly by writing to the Domain Access Control Register (DACR). Arm deprecates any use 
of memory regions domains. 


Do-Not-Modify (DNM) 


Means the value must not be altered by software. DNM fields read as UNKNOWN values, and must only be written 
with the value read from the same field on the same PE. 


Double-precision value 


Doubleword 


Consists of two consecutive 32-bit words that are interpreted as a basic double-precision floating-point number 
according to the JEEE Standard for Floating-point Arithmetic. 


A 64-bit data item. Doublewords are normally at least word-aligned in Arm systems. 


Doubleword-aligned 


DSP 


Effective value 


Endianness 


Exception 


Exception vector 


Execution stream 


Explicit access 


External abort 


Means that the address is divisible by 8. 
See Digital signal processing (DSP). 


A register control field, meaning a field in a register that controls some aspect of the behavior, can be described as 
having an Effective value: 


è In some cases, the description ofa control a specifies that when control a is active it causes a register control 
field b to be treated as having a fixed value for all purposes other than direct reads, or direct reads and direct 
writes, of the register containing control field b. When control a is active that fixed value is described as the 
Effective value of register control field b. For example, when the value of HCR.DC is 1, the Effective value 
of HCR.VM is 1, regardless of its actual value. 


In other cases, in some contexts a register control field b is not implemented or is not accessible, but behavior 
of the PE is as if control field b was implemented and accessible, and had a particular value. In this case, that 
value is the Effective value of register control field b. 





Note 


Where a register control field is introduced in a particular version of the architecture, and is not implemented 
in an earlier version of the architecture, typically it will have an Effective value in that earlier version of the 
architecture. 


s Otherwise, the Effective value of a register control field is the value of that field. 
An aspect of the system memory mapping. 
See also Big-endian memory and Little-endian memory. 


Handles an event. For example, an exception could handle an external interrupt or an undefined instruction. 


A fixed address that contains the address of the first instruction of the corresponding exception handler. 


The stream of instructions that would have been executed by sequential execution of the program. 


A read from memory, or a write to memory, generated by a load or store instruction executed by the PE. Reads and 
writes generated by hardware translation table accesses are not explicit accesses. 


An abort that is generated by the external memory system. 


Fast Context Switch Extension (FCSE) 


Glossary-7886 


Modifies the behavior of an Arm memory system to enable multiple programs running on the Arm PE to use 
identical address ranges, while ensuring that the addresses they present to the rest of the memory system differ. From 
Armv6, Arm deprecates any use of the FCSE. The FCSE is: 


7 Optional in an Armv7 implementation that does not include the Multiprocessing Extensions. 
° Obsolete from the introduction of the Multiprocessing Extensions. 
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FCSE See Fast Context Switch Extension (FCSE). 


Flat address mapping 
Is where the physical address for every access is equal to its virtual address. 


Flush-to-zero mode 
A processing mode that optimizes the performance of some floating-point algorithms by replacing the denormalized 
operands and intermediate results with zeros, without significantly affecting the accuracy of their final results. 


General-purpose registers 
The registers that the base instructions use for processing: 


s In AArch32 state the general-purpose registers are RO-R14, that can also be described as RO-R12, SP, LR. 





Note 


Older documentation defines the AArch32 general-purpose registers as RO-R12, and the Arm core registers 
as RO-R12, SP, LR, and PC. 





$ In AArch64 state the general-purpose registers are: 
—  W0-W30 when accessed as 32-bit registers. 
—  X0-X30 when accessed as 64-bit registers. 


See also High registers, Low registers. 


Generated by The memory model is written in terms of reads from memory and writes to memory. These reads and writes: 
. Are generated by instructions such as loads, stores, and atomic memory accesses. 
° Correspond to the memory accesses, other than translation table walks, that are defined in the instruction 
pseudocode. 


Some instructions generate more than one read or write. 
Halfword A 16-bit data item. Halfwords are normally halfword-aligned in Arm systems. 


Halfword-aligned 
Means that the address is divisible by 2. 


High registers In AArch32 state, the general-purpose registers R8-R14. Most 16-bit T32 instructions cannot access the high 
registers. 





Note 
In some contexts, high registers refers to R8-R15, meaning R8-R14 and the PC. 





See also General-purpose registers, Low registers. 


High vectors An alternative location for the exception vectors. The high vector address range is near the top of the address space, 
rather than at the bottom. 


IGNORED Indicates that the architecture guarantees that the bit or field is not interpreted or modified by hardware. 
In body text, the term IGNORED is shown in SMALL CAPITALS. 


Immediate and offset fields 
Are unsigned unless otherwise stated. 


Immediate value 
A value that is encoded directly in the instruction and used as numeric data when the instruction is executed. Many 
A64, A32, and T32 instructions can be used with an immediate argument. 


IMP An abbreviation used in diagrams to indicate that one or more bits have IMPLEMENTATION DEFINED behavior. 
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IMPLEMENTATION DEFINED 
Means that the behavior is not architecturally defined, but must be defined and documented by individual 
implementations. 


In body text, the term IMPLEMENTATION DEFINED is shown in SMALL CAPITALS. 


Index register A register specified in some load and store instructions. The value of this register is used as an offset to be added to 
or subtracted from the base register value to form the virtual address that is sent to memory. Some instruction forms 
permit the index register value to be shifted before the addition or subtraction. 


Indirect read When an instruction uses a System register value to establish operating conditions, that use of the System register 
is an indirect read of the System register. 


For more information, including additional examples of indirect reads, see Indirect read on page D13-2821. 
See also Direct read, Direct write, Indirect write. 


Indirect write An indirect write of a System register occurs when the contents of a register are updated by some mechanism other 
than a Direct write to that register. For example, an indirect write to a register might occur as a side-effect of 
executing an instruction that does not perform a direct write to the register, or because of some operation performed 
by an external agent. 


For more information, see Indirect write on page D13-2821. 
See also Direct read, Direct write, Indirect read. 


Inline literals These are constant addresses and other data items held in the same area as the software itself. They are automatically 
generated by compilers, and can also appear in assembler code. 


Intermediate physical address (IPA) 
An implementation of virtualization, the address to which a Guest OS maps a VA. A hypervisor might then map the 
IPA to a PA. Typically, the Guest OS is unaware of the translation from IPA to PA. 


See also Physical address (PA), Virtual address (VA). 


Interworking A method of working that permits branches between software using the A32 and T32 instruction sets. 
IPA See Intermediate physical address (IPA). 
Level See Cache level. 


Level of Coherence (LoC) 
The last level of cache that must be cleaned or invalidated when cleaning or invalidating to the point of coherency. 
For more information, see Terms used in describing the cache maintenance instructions on page D4-2478. 


See also Cache level, Point of coherency (PoC). 


Level of Unification, Inner Shareable (LoUIS) 
The last level of cache that must be cleaned or invalidated when cleaning or invalidating to the point of unification 
for the Inner Shareable shareability domain. For more information, see Terms used in describing the cache 
maintenance instructions on page D4-2478. 


See also Cache level, Point of unification (PoU). 


Level of Unification, uniprocessor (LoUU) 
For a PE, the last level of cache that must be cleaned or invalidated when cleaning or invalidating to the point of 
unification for that PE. For more information, see Terms used in describing the cache maintenance instructions on 
page D4-2478. 


See also Cache level, Point of unification (PoU). 
Line See Cache line. 


Little-endian memory 
Means that, for example: 


z A byte or halfword at a word-aligned address is the least significant byte or halfword in the word at that 
address. 
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è A byte at a halfword-aligned address is the least significant byte in the halfword at that address. 
See also Big-endian memory, Endianness. 


Load/Store architecture 
An architecture where data-processing operations only operate on register contents, not directly on memory 


contents. 
LoC See Level of Coherence (LoC). 
LoUIS See Level of Unification, Inner Shareable (LoUIS). 
LoUU See Level of Unification, uniprocessor (LoUU). 
Lockdown See Cache lockdown. 
Low registers In AArch32 state, general-purpose registers RO-R7. Unlike the high registers, all T32 instructions can access the 


Low registers. 
See also General-purpose registers, High registers. 
Memory barrier See Memory barriers on page B2-124. 


Memory coherency 
The problem of ensuring that when a memory location is read, either by a data read or an instruction fetch, the value 
actually obtained is always the value that was most recently written to the location. This can be difficult when there 
are multiple possible physical locations, such as main memory and at least one of a write buffer and one or more 
levels of cache. 


Memory Management Unit (MMU) 
Provides detailed control of the part of a memory system that provides a single stage of address translation. Most of 
the control is provided using translation tables that are held in memory, and define the attributes of different regions 
of the physical memory map. 


Memory Protection Unit (MPU) 
A hardware unit whose registers provide simple control of a limited number of protection regions in memory. 


Miss See Cache miss. 
MMU See Memory Management Unit (MMU). 
MPU See Memory Protection Unit (MPU). 


Multi-copy atomicity 
The form of atomicity described in Requirements for multi-copy atomicity on page B2-112. 


See also Atomicity, Single-copy atomicity. 


NaN Not a Number. A floating-point value that can be used when neither a numeric value nor an infinity is appropriate. 
A NaN can be a quiet NaN, that propagate through most floating-point operations, or a signaling NaN, that causes 
an Invalid Operation floating-point exception when used. For more information, see the JEEE Standard for 
Floating-point Arithmetic. 


See also Quiet NaN, Signaling NaN. 


Natural eviction A natural eviction is an eviction that occurs in the course of the normal operation of the memory system, rather than 
because of an operation that explicitly causes an eviction from the cache, such as the execution of a cache 
maintenance instruction. Typically, a natural eviction occurs when the caching algorithm requires data to be cached 
but the cache does not have room for that data. 


Observer A PE or mechanism in the system, such as a peripheral device, that can generate reads from or writes to memory. 


Obsolete Obsolete indicates something that is no longer supported by Arm. When an architectural feature is described as 
obsolete, this indicates that the architecture has no support for that feature, although an earlier version of the 
architecture did support it. 


Offset addressing 
Means that the memory address is formed by adding or subtracting an offset to or from the base register value. 
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OPTIONAL When applied to a feature of the architecture, OPTIONAL indicates a feature that is not required in an implementation 
of the Arm architecture: 


° If a feature is OPTIONAL and deprecated, this indicates that the feature is being phased out of the architecture. 
Arm expects such a features to be included in a new implementation only if there is a known 
backwards-compatibility reason for the inclusion of the feature. 


A feature that is OPTIONAL and deprecated might not be present in future versions of the architecture. 
: A feature that is OPTIONAL but not deprecated is, typically, a feature added to a version of the Arm 


architecture after the initial release of that version of the architecture. Arm recommends that such features 
are included in all new implementations of the architecture. 


In body text, these meanings of the term OPTIONAL are shown in SMALL CAPITALS. 


Note 


Do not confuse these Arm-specific uses of OPTIONAL with other uses of optional, where it has its usual meaning. 
These include: 





s Optional arguments in the syntax of many instructions. 


s Behavior determined by an implementation choice, for example the optional byte order reversal in an 
Armv7-R implementation, where the SCTLR.IE bit indicates the implemented option. 





See also Deprecated. 
PA See Physical address (PA). 
PE See Processing element (PE). 


Physical address (PA) 
An address that identifies a location in the physical memory map. 


See also Intermediate physical address (IPA), Virtual address (VA). 


PoC See Point of coherency (PoC). 
PoP See Point of persistence (PoP). 
PoU See Point of unification (PoU). 


Point of coherency (PoC) 
For a particular VA, the point at which all agents that can access memory are guaranteed to see the same copy of a 
memory location. For more information, see Terms used in describing the cache maintenance instructions on 
page D4-2478. 


Point of persistence (PoP) 
The point in a memory system where there is a system guarantee that there is sufficient energy within the system to 
ensure that a write to memory will be persistent if system power is removed. For more information, see Terms used 
in describing the cache maintenance instructions on page D4-2478. 


Point of unification (PoU) 
For a particular PE, the point by which the instruction and data caches and the translation table walks of that PE are 
guaranteed to see the same copy of a memory location. For more information, see Terms used in describing the 
cache maintenance instructions on page D4-2478. 


Post-indexed addressing 
Means that the memory address is the base register value, but an offset is added to or subtracted from the base 
register value and the result is written back to the base register. 


Prefetching Prefetching refers to speculatively fetching instructions or data from the memory system. In particular, instruction 
prefetching is the process of fetching instructions from memory before the instructions that precede them, in simple 
sequential execution of the program, have finished executing. Prefetching an instruction does not mean that the 
instruction has to be executed. 
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In this manual, references to instruction or data fetching apply also to prefetching, unless the context explicitly 
indicates otherwise. 


Note 


The Prefetch Abort exception can be generated on any instruction fetch, and is not limited to speculative instruction 
fetches. 








See also Simple sequential execution. 


Pre-indexed addressing 
Means that the memory address is formed in the same way as for offset addressing, but the memory address is also 
written back to the base register. 


Processing element (PE) 
The abstract machine defined in the Arm architecture, as documented in an Arm Architecture Reference Manual. A 
PE implementation compliant with the Arm architecture must conform with the behaviors described in the 
corresponding Arm Architecture Reference Manual. 


Protection region 
A memory region whose position, size, and other properties are defined by Memory Protection Unit registers. 


Protection Unit See Memory Protection Unit (MPU). 


Pseudo-instruction 
UAL assembler syntax that assembles to an instruction encoding that is expected to disassemble to a different 
assembler syntax, and is described in this manual under that other syntax. For example, MOV <Rd>, <Rm>, LSL #<n> 
is a pseudo-instruction that is expected to disassemble as LSL <Rd>, <Rm>, #<n>. 


PSTATE An abstraction of process state information. All of the instruction sets provide instructions that operate on elements 
of PSTATE. 


See also Condition flags. 
Quadword A 128-bit data item. Quadwords are normally at least word-aligned in Arm systems. 


Quadword-aligned 
Means that the address is divisible by 16. 


Quiet NaN A NaN that propagates unchanged through most floating-point operations. 


See also NaN, Signaling NaN. 


RAO See Read-As-One (RAO). 
RAZ See Read-As-Zero (RAZ). 
RAO/SBOP In versions of the Arm architecture before Armv8, Read-As-One, Should-Be-One-or-Preserved on writes. 


In Armv8, RES1 replaces this description. 
See also UNK/SBOP, Read-As-One (RAO), RES1, Should-Be-One-or-Preserved (SBOP). 
RAO/WI Read-As-One, Writes Ignored. 
Hardware must implement the field as Read-as-One, and must ignore writes to the field. 
Software can rely on the field reading as all 1s, and on writes being ignored. 
This description can apply to a single bit that reads as 1, or to a field that reads as all 1s. 
See also Read-As-One (RAO). 
RAZ/SBZP In versions of the Arm architecture before Armv8, Read-As-Zero, Should-Be-Zero-or-Preserved on writes. 
In Armv8, RESO replaces this description. 


See also UNK/SBZP, Read-As-Zero (RAZ), RESO, Should-Be-Zero-or-Preserved (SBZP). 
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RAZ/WI 


Read-As-Zero, Writes Ignored. 

Hardware must implement the field as Read-as-Zero, and must ignore writes to the field. 
Software can rely on the field reading as all 0s, and on writes being ignored. 

This description can apply to a single bit that reads as 0, or to a field that reads as all Os. 


See also Read-As-Zero (RAZ). 


Read-allocate cache 


A cache in which a cache miss on reading data causes a cache line to be allocated into the cache. 


Read-As-One (RAO) 


Hardware must implement the field as reading as all 1s. 


Software: 
$ Can rely on the field reading as all 1s. 
7 Must use a SBOP policy to write to the field. 


This description can apply to a single bit that reads as 1, or to a field that reads as all 1s. 


See also RAO/SBOP, RAO/WI, RES1. 


Read-As-Zero (RAZ) 


Hardware must implement the field as reading as all Os. 


Software: 
7 Can rely on the field reading as all Os 
: Must use a SBZP policy to write to the field. 


This description can apply to a single bit that reads as 0, or to a field that reads as all Os. 


See also RAZ/SBZP, RAZ/WI, RESO. 


Read, modify, write 


RESO 
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Ina read, modify, write instruction sequence, a value is read to a general-purpose register, the relevant fields updated 
in that register, and the new value written back. 


A reserved bit. Used for fields in register descriptions, and for fields in architecturally-defined data structures that 
are held in memory, for example in translation table descriptors. 


Within the architecture, there are some cases where a register bit or field: 





. Is RESO in some defined architectural context. 

. Has different defined behavior in a different architectural context. 
Note 

° RESO is not used in descriptions of instruction encodings. 


$ Where an AArch32 System register is Architecturally mapped to an AArch64 System register, and a bit or 
field in that register is RESO in one Execution state and has defined behavior in the other Execution state, this 
is an example of a bit or field with behavior that depends on the architectural context. 





This means the definition of RESO for fields in read/write registers is: 


If a bit is RESO in all contexts 
For a bit in a read/write register, it is IMPLEMENTATION DEFINED whether: 


l. The bit is hardwired to 0. In this case: 


° Reads of the bit always return 0. 
° Writes to the bit are ignored. 
2. The bit can be written. In this case: 
è An indirect write to the register sets the bit to 0. 
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è A read of the bit returns the last value successfully written, by either a direct or an 
indirect write, to the bit. 


If the bit has not been successfully written since reset, then the read of the bit returns 
the reset value if there is one, or otherwise returns an UNKNOWN value. 
è A direct write to the bit must update a storage location associated with the bit. 


. The value of the bit must have no effect on the operation of the PE, other than 
determining the value read back from the bit, unless this Manual explicitly defines 
additional properties for the bit. 


Whether RESO bits or fields follow behavior 1 or behavior 2 is IMPLEMENTATION DEFINED on a 
field-by-field basis. 


If a bit is RESO only in some contexts 

For a bit in a read/write register, when the bit is described as RESO: 

° An indirect write to the register sets the bit to 0. 

: A read of the bit must return the value last successfully written to the bit, by either a direct or 
an indirect write, regardless of the use of the register when the bit was written. 
If the bit has not been successfully written since reset, then the read of the bit returns the reset 
value if there is one, or otherwise returns an UNKNOWN value. 

a A direct write to the bit must update a storage location associated with the bit. 


à While the use of the register is such that the bit is described as RESO, the value of the bit must 
have no effect on the operation of the PE, other than determining the value read back from 
that bit, unless this Manual explicitly defines additional properties for the bit. 


Considering only contexts that apply to a particular implementation, if there is a context in which a 
bit is defined as RESO, another context in which the same bit is defined as RES1, and no context in 
which the bit is defined as a functional bit, then it is IMPLEMENTATION DEFINED whether: 


d Writes to the bit are ignored, and reads of the bit return an UNKNOWN value. 
. The value of the bit can be written, and a read returns the last value written to the bit. 


The RESO description can apply to bits or fields that are read-only, or are write-only: 
° For a read-only bit, RESO indicates that the bit reads as 0, but software must treat the bit as UNKNOWN. 
° For a write-only bit, RESO indicates that software must treat the bit as SBZ. 


A bit that is RESO in a context is reserved for possible future use in that context. To preserve forward compatibility, 
software: 


: Must not rely on the bit reading as 0. 
: Must use an SBZP policy to write to the bit. 


This RESO description can apply to a single bit, or to a field for which each bit of the field must be treated as RESO. 
In body text, the term RESO is shown in SMALL CAPITALS. 
See also Read-As-Zero (RAZ), RES1, Should-Be-Zero-or-Preserved (SBZP), UNKNOWN. 


A reserved bit. Used for fields in register descriptions, and for fields in architecturally-defined data structures that 
are held in memory, for example in translation table descriptors. 


Within the architecture, there are some cases where a register bit or field: 


. Is RES! in some defined architectural context. 

. Has different defined behavior in a different architectural context. 
—— Note 

° RES] is not used in descriptions of instruction encodings. 


: Where an AArch32 System register is Architecturally mapped to an AArch64 System register, and a bit or 
field in that register is RES1 in one Execution state and has defined behavior in the other Execution state, this 
is an example of a bit or field with behavior that depends on the architectural context. 
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This means the definition of RES1 for fields in read/write registers is: 


If a bit is RES1 in all contexts 
For a bit in a read/write register, it is IMPLEMENTATION DEFINED whether: 


l. The bit is hardwired to 1. In this case: 


° Reads of the bit always return 1. 
° Writes to the bit are ignored. 
2. The bit can be written. In this case: 
s An indirect write to the register sets the bit to 1. 
à A read of the bit returns the last value successfully written, by either a direct or an 


indirect write, to the bit. 


If the bit has not been successfully written since reset, then the read of the bit returns 
the reset value if there is one, or otherwise returns an UNKNOWN value. 


à A direct write to the bit must update a storage location associated with the bit. 


è The value of the bit must have no effect on the operation of the PE, other than 
determining the value read back from the bit, unless this Manual explicitly defines 
additional properties for the bit. 


Whether RES1 bits or fields follow behavior 1 or behavior 2 is IMPLEMENTATION DEFINED on a 
field-by-field basis. 
If a bit is RES1 only in some contexts 


For a bit in a read/write register, when the bit is described as RES1: 


. An indirect write to the register sets the bit to 1. 

° A read of the bit must return the value last successfully written to the bit, regardless of the 
use of the register when the bit was written. 
— Note 


As indicated in this list, this value might be written by an indirect write to the register. 





If the bit has not been successfully written since reset, then the read of the bit returns the reset 
value if there is one, or otherwise returns an UNKNOWN value. 


: A direct write to the bit must update a storage location associated with the bit. 


- While the use of the register is such that the bit is described as RES1, the value of the bit must 
have no effect on the operation of the PE, other than determining the value read back from 
that bit, unless this Manual explicitly defines additional properties for the bit. 


Considering only contexts that apply to a particular implementation, if there is a context in which a 
bit is defined as RESO, another context in which the same bit is defined as RES1, and no context in 
which the bit is defined as a functional bit, then it is IMPLEMENTATION DEFINED whether: 


s Writes to the bit are ignored, and reads of the bit return an UNKNOWN value. 
. The value of the bit can be written, and a read returns the last value written to the bit. 


The RES! description can apply to bits or fields that are read-only, or are write-only: 
. For a read-only bit, RES1 indicates that the bit reads as 1, but software must treat the bit as UNKNOWN. 
$ For a write-only bit, RES1 indicates that software must treat the bit as SBO. 


A bit that is RES1 in a context is reserved for possible future use in that context. To preserve forward compatibility, 
software: 


: Must not rely on the bit reading as 1. 
à Must use an SBOP policy to write to the bit. 


This RES1 description can apply to a single bit, or to a field for which each bit of the field must be treated as RES1. 
In body text, the term RES1 is shown in SMALL CAPITALS. 


See also Read-As-One (RAO), RESO, Should-Be-One-or-Preserved (SBOP), UNKNOWN. 
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Rounding error 
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Unless otherwise stated: 


è Instructions that are reserved or that access reserved registers have UNPREDICTABLE or CONSTRAINED 
UNPREDICTABLE behavior. 


° Bit positions described as reserved are: 
— Inan RW or WO register, RESO. 
— Inan RO register, UNK. 


See also CONSTRAINED UNPREDICTABLE, RESO, RES1, UNDEFINED, UNK, UNPREDICTABLE. 
Reduced Instruction Set Computer. 
The value of the rounded result of an arithmetic operation minus the exact result of the operation. 


Specifies how the exact result of a floating-point operation is rounded to a value that is representable in the 
destination format. The rounding modes are defined by the JEEE Standard for Floating-point Arithmetic, see 
Floating-point standards, and terminology on page A1-53. 


Saturated arithmetic 


SBO 
SBOP 
SBZ 
SBZP 


Security hole 


Integer arithmetic in which a result that would be greater than the largest representable number is set to the largest 
representable number, and a result that would be less than the smallest representable number is set to the smallest 
representable number. Signed saturated arithmetic is often used in DSP algorithms. It contrasts with the normal 
signed integer arithmetic used in Arm processors, in which overflowing results wrap around from +23!—1 to —23! or 
vice versa. 


See Should-Be-One (SBO). 
See Should-Be-One-or-Preserved (SBOP). 
See Should-Be-Zero (SBZ). 
See Should-Be-Zero-or-Preserved (SBZP). 


A mechanism by which execution at the current level of privilege can achieve an outcome that cannot be achieved 
at the current or a lower level of privilege using instructions that are not UNPREDICTABLE and are not CONSTRAINED 
UNPREDICTABLE. The Arm architecture forbids security holes. 


See also CONSTRAINED UNPREDICTABLE, UNPREDICTABLE. 


Self-modifying code 


Set 


Code that writes one or more instructions to memory and then executes them. When using self-modifying code, you 
must use cache maintenance and barrier instructions to ensure synchronization. For more information, see Caches 
and memory hierarchy on page B2-133. 


See Cache sets. 


Should-Be-One (SBO) 


Hardware must ignore writes to the field. 


Arm strongly recommends that software writes the field as all 1s. If software writes a value that is not all 1s, it must 
expect an UNPREDICTABLE or CONSTRAINED UNPREDICTABLE result. 


This description can apply to a single bit that should be written as 1, or to a field that should be written as all 1s. 


See also CONSTRAINED UNPREDICTABLE, UNPREDICTABLE. 


Should-Be-One-or-Preserved (SBOP) 


ARM DDI 0487E.a 
ID070919 


From the introduction of the Armv8 architecture, the description Should-Be-One-or-Preserved (SBOP) is 
superseded by RESI. 


Note 


The Armv7 Large Physical Address Extension modified the definition of SBOP for register bits that are SBOP in 
some but not all contexts. The behavior of these bits is covered by the RES/ definition, but not by the generic 
definition of SBOP given here. 
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Hardware must ignore writes to the field. 


When writing this field, software must either write all 1s to this field or, if the register is being restored from a 
previously read state, write the previously read value to this field. If this is not done, then the result is unpredictable. 


This description can apply to a single bit that should be written as its preserved value or as 1, or toa field that should 
be written as its preserved value or as all 1s. 


See also CONSTRAINED UNPREDICTABLE, UNPREDICTABLE. 


Should-Be-Zero (SBZ) 


Hardware must ignore writes to the field. 


Arm strongly recommends that software writes the field as all Os. If software writes a value that is not all Os, it must 
expect an UNPREDICTABLE or CONSTRAINED UNPREDICTABLE result. 


This description can apply to a single bit that should be written as 0, or to a field that should be written as all Os. 


See also CONSTRAINED UNPREDICTABLE, UNPREDICTABLE. 


Should-Be-Zero-or-Preserved (SBZP) 


Signaling NaN 


From the introduction of the Armv8 architecture, the description Should-Be-Zero-or-Preserved (SBZP) is 
superseded by RESO. 





Note 


The Armv7 Large Physical Address Extension modified the definition of SBZP for register bits that are SBZP in 
some but not all contexts. The behavior of these bits is covered by the RESO definition, but not by the generic 
definition of SBZP given here. 





Hardware must ignore writes to the field. 


When writing this field, software must either write all Os to this field or, if the register is being restored from a 
previously read state, write the previously read value to this field. If this is not done, then the result is unpredictable. 


This description can apply to a single bit that should be written as its preserved value or as 0, or toa field that should 
be written as its preserved value or as all Os. 


See also CONSTRAINED UNPREDICTABLE, UNPREDICTABLE. 


An Invalid Operation floating-point exception occurs whenever any floating-point operation receives a signaling 
NaN as an operand. Signaling NaNs can be used in debugging, to track down some uses of uninitialized variables. 


See also NaN, Quiet NaN. 


Signed immediate and offset fields 


SIMD 


Glossary-7896 


Are encoded in two’s complement notation unless otherwise stated. 

Single-Instruction, Multiple-Data. 

The SIMD instructions in AArch32 state are: 

è The instructions summarized in Parallel addition and subtraction instructions on page F1-3876. 


$ The Advanced SIMD instructions summarized in Advanced SIMD and floating-point instructions on 
page E1-3794, when operating on vectors. 





Note 


In Armv7, some VFP instructions can operate on vectors. However, Arm deprecates those instruction uses, 
and strongly recommends that Advanced SIMD instructions are always used for vector operations. 
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Simple sequential execution 


The behavior of an implementation that fetches, decodes and completely executes each instruction before 
proceeding to the next instruction. Such an implementation performs no speculative accesses to memory, including 
to instruction memory. The implementation does not pipeline any phase of execution. In practice, this is the 
theoretical execution model that the architecture is based on, and Arm does not expect this model to correspond to 
a realistic implementation of the architecture. 


Single-copy atomicity 


The form of atomicity described in Properties of single-copy atomic accesses on page B2-112. 


See also Atomicity, Multi-copy atomicity. 


Single-precision value 


Spatial locality 


Speculative 


A 32-bit word that is interpreted as a basic single-precision floating-point number according to the JEEE Standard 
for Floating-point Arithmetic. 


The observed effect that after a program has accessed a memory location, it is likely to also access nearby memory 
locations in the near future. Caches with multi-word cache lines exploit this effect to improve performance. 


Speculative operations are: 


° Operations that are generated by instructions that appear in the Execution stream after a branch that is not 
architecturally resolved. 


7 Operations that are generated by instructions that appear in the Execution stream after an instruction where 
a synchronous exception condition has not been architecturally resolved. 


e Operations that are generated by conditional instructions for which the conditions for the instruction have not 
been architecturally resolved. 


$ Operations that are generated by instructions that appear in the Execution stream after the point at which a 
precise asynchronous exception will be taken. 


s Reads or writes generated by load or store instructions for which the data being written or the address being 
accessed comes from a register that has not been architecturally resolved. 


5 Operations generated by the hardware that are not directly generated by any instructions appearing in the 
Execution stream. 


See also Execution stream. 


Special-purpose register 


T32 instruction 


T32 state 


Taken locally 
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One ofa specified set of registers for which all direct and indirect reads and writes to the register appear to occur in 
program order relative to other instructions, without the need for any explicit synchronization: 


° Special-purpose registers on page C5-374 specifies the AArch64 Special-purpose registers. 
s AArch32 Special-purpose registers on page G1-5490 lists the AArch32 Special-purpose registers. 


One or two halfwords that specify an operation to be performed by a PE that is executing in an Exception level that 
is using AArch32 and is in T32 state. T32 instructions must be halfword-aligned. 


T32 instructions were previously called Thumb instructions. 

See also A32 instruction, A64 instruction, T32 state. 

The AArch32 Instruction set state in which the PE executes T32 instructions. 
T32 state was previously called Thumb state. 

See also A32 state, T32 instruction. 


Taken locally is a qualifier that determines which instances of an exception are counted by particular PMU events. 
See, in particular, Arm recommendations for IMPLEMENTATION DEFINED event numbers on page K3-7666. 


In this context, an exception that is Taken locally means an exception that is one of: 


° Taken to the current Exception level. 
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Note 


This is not possible when the current Exception level is ELO. 








$ Taken from ELO to EL1. 
. Taken from ELO to EL2 because the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}. 
Note 


An exception taken from ELO to EL2 because the Effective value of HCR_EL2.{E2H, TGE} is {0, 1} is not 
Taken locally. This includes exceptions taken to EL2 using AArch32 when HCR.TGE is 1. 








Temporal locality 
The observed effect that after a program has accesses a memory location, it is likely to access the same memory 
location again in the near future. Caches exploit this effect to improve performance. 


Thumb instruction 
See T32 instruction. 


TLB See Translation Lookaside Buffer (TLB). 


TLB lockdown A way to prevent specific translation table walk results being accessed. This ensures that accesses to the associated 
memory areas never cause a translation table walk. 


Translation Lookaside Buffer (TLB) 
A memory structure containing the results of translation table walks. They help to reduce the average cost of a 
memory access. Usually, there is a TLB for each memory interface of the Arm implementation. 


Translation table 
A table held in memory that defines the properties of memory areas of various sizes from 1KB to 1MB. 


Translation table walk 
The process of doing a full translation table lookup. It is performed automatically by hardware. 


Trap enable bits In VFPv2, VFPv3U, and VFPVv4U, determine whether trapped or untrapped exception handling is selected. If 
trapped exception handling is selected, the way it is carried out is IMPLEMENTATION DEFINED. 


Unaligned An unaligned access is an access where the address of the access is not aligned to the size of an element of the access. 


Unaligned memory accesses 
Are memory accesses that are not, or might not be, appropriately halfword-aligned, word-aligned, or 
doubleword-aligned. 


Unallocated Except where otherwise stated in this manual, an instruction encoding is unallocated if the architecture does not 
assign a specific function to the entire bit pattern of the instruction, but instead describes it as CONSTRAINED 
UNPREDICTABLE, UNDEFINED, UNPREDICTABLE, or as an unallocated hint instruction. 


A bit in a register is unallocated if the architecture does not assign a function to that bit. 
See also CONSTRAINED UNPREDICTABLE, UNDEFINED, UNPREDICTABLE. 


UNDEFINED Indicates cases where an attempt to execute a particular encoding bit pattern generates an exception, that is taken to 
the current Exception level, or to the default Exception level for taking exceptions if the UNDEFINED encoding was 
executed at ELO. This applies to: 


à Any encoding that is not allocated to any instruction. 
: Any encoding that is defined as never accessible at the current Exception level. 
. Some cases where an enable, disable, or trap control means an encoding is not accessible at the current 


Exception level. 


If the generated exception is taken to an Exception level that is using AArch32 then it is taken as an Undefined 
Instruction exception. 
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Unified cache 


Glossary 





Note 
On reset, the default Exception level for taking exceptions from ELO is EL1. However, an implementation might 
include controls that can change this, effectively making EL1 inactive. See the description of the Exception model 
for more information 





In body text, the term UNDEFINED is shown in SMALL CAPITALS. 
See also Undefined Instruction exception on page G1-5536. 


Is a cache used for both processing instruction fetches and processing data loads and stores. 


Unindexed addressing 


UNK 


UNK/SBOP 


UNK/SBZP 


UNKNOWN 


UNPREDICTABLE 
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Means addressing in which the base register value is used directly as the virtual address to send to memory, without 
adding or subtracting an offset. In most types of load/store instruction, unindexed addressing is performed by using 
offset addressing with an immediate offset of 0. 


In Armv7 and earlier versions of the Arm architecture, and in the M-profile, the LDC, LDC2, STC, and STC2 instructions 
have an explicit unindexed addressing mode that permits the offset field in the instruction to specify additional 
coprocessor options. 


An abbreviation indicating that software must treat a field as containing an UNKNOWN value. 


Hardware must implement the bit as read as 0, or all Os for a multi-bit field. Software must not rely on the field 
reading as zero. 


See also UNKNOWN. 
Hardware must implement the field as Read-As-One, and must ignore writes to the field. 


Software must not rely on the field reading as all 1s, and except for writing back to the register it must treat the value 
as if it is UNKNOWN. Software must use an SBOP policy to write to the field. 


This description can apply to a single bit that should be written as its preserved value or as 1, or toa field that should 
be written as its preserved value or as all 1s. 


See also Read-As-One (RAO), Should-Be-One-or-Preserved (SBOP), UNKNOWN. 
Hardware must implement the bit as Read-As-Zero, and must ignore writes to the field. 


Software must not rely on the field reading as all 0s, and except for writing back to the register must treat the value 
as if it is UNKNOWN. Software must use an SBZP policy to write to the field. 


This description can apply to a single bit that should be written as its preserved value or as 0, or to a field that should 
be written as its preserved value or as all Os. 


See also Read-As-Zero (RAZ), Should-Be-Zero-or-Preserved (SBZP), UNKNOWN. 


An UNKNOWN value does not contain valid data, and can vary from moment to moment, instruction to instruction, 
and implementation to implementation. An UNKNOWN value must not return information that cannot be accessed at 
the current or a lower level of privilege using instructions that are not UNPREDICTABLE, are not CONSTRAINED 
UNPREDICTABLE, and do not return UNKNOWN values. 


An UNKNOWN value must not be documented or promoted as having a defined value or effect. 
In body text, the term UNKNOWN is shown in SMALL CAPITALS. 


See also CONSTRAINED UNPREDICTABLE, UNDEFINED, UNK, UNPREDICTABLE. 


Means the behavior cannot be relied upon. UNPREDICTABLE behavior must not perform any function that cannot be 
performed at the current or a lower level of privilege using instructions that are not UNPREDICTABLE. 


UNPREDICTABLE behavior must not be documented or promoted as having a defined effect. 


An instruction that is UNPREDICTABLE can be implemented as UNDEFINED. 
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Execution at Non-secure EL1 or ELO of an instruction that is UNPREDICTABLE can be implemented as generating a 
trap exception that is taken to EL2, provided that at least one instruction that is not UNPREDICTABLE and is not 
CONSTRAINED UNPREDICTABLE causes a trap exception that is taken to EL2. 


In body text, the term UNPREDICTABLE is shown in SMALL CAPITALS. 


See also CONSTRAINED UNPREDICTABLE, UNDEFINED. 


VA See Virtual address (VA). 
VFP In Armv7, an extension to the Arm architecture, that provides single-precision and double-precision floating-point 
arithmetic. 


Virtual address (VA) 
An address generated by an Arm PE. This means it is an address that might be held in the program counter of the 
PE. For a PMSA implementation, the virtual address is identical to the physical address. 


See also Intermediate physical address (IPA), Physical address (PA). 


Watchpoint A debug event triggered by an access to memory, specified in terms of the address of the location in memory being 
accessed. 

Way See Cache way. 

wi Writes Ignored. In a register that software can write to, a WI attribute applied to a bit or field indicates that the bit 


or field ignores the value written by software and retains the value it had before that write. 
See also RAO/WI, RAZ/WI, RESO, RES1. 

Word A 32-bit data item. Words are normally word-aligned in Arm systems. 

Word-aligned Means that the address is divisible by 4. 


Write-allocate cache 
A cache in which a cache miss on storing data causes a cache line to be allocated into the cache. 


Write-back cache 
A cache in which when a cache hit occurs on a store access, the data is only written to the cache. Data in the cache 
can therefore be more up-to-date than data in main memory. Any such data is written back to main memory when 
the cache line is cleaned or reallocated. Another common term for a write-back cache is a copy-back cache. 


Write-through cache 
A cache in which when a cache hit occurs ona store access, the data is written both to the cache and to main memory. 
This is normally done via a write buffer, to avoid slowing down the PE. 


Write buffer A block of high-speed memory that optimizes stores to main memory. 
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